xmrig | cb3b3e628c8d30caf258718948f989772a5eb1affc3ab55c53e655e044a1d96d

Analysis

max time kernel
33s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 02:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
Size

2.2MB
MD5

7b5292bcaf66259c185561fb55b3f2f3
SHA1

b0ddc5a209242c09475f44acfd57c810768a6660
SHA256

cb3b3e628c8d30caf258718948f989772a5eb1affc3ab55c53e655e044a1d96d
SHA512

9ace27d05921939bd8e281715a209dee9c82f54b7b8494c519878050fc5ad197625d3063ba4916618a16d1e5113f7620e83fa1a9e4e4683f6c22f46ff1da6330
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9V:NABI

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 46 IoCs

miner

resource	yara_rule
behavioral2/memory/4672-61-0x00007FF6C12F0000-0x00007FF6C16E2000-memory.dmp	xmrig
behavioral2/memory/512-64-0x00007FF63FB20000-0x00007FF63FF12000-memory.dmp	xmrig
behavioral2/memory/5060-67-0x00007FF7F8E40000-0x00007FF7F9232000-memory.dmp	xmrig
behavioral2/memory/2524-71-0x00007FF72C630000-0x00007FF72CA22000-memory.dmp	xmrig
behavioral2/memory/5064-68-0x00007FF658A80000-0x00007FF658E72000-memory.dmp	xmrig
behavioral2/memory/4168-57-0x00007FF6C77D0000-0x00007FF6C7BC2000-memory.dmp	xmrig
behavioral2/memory/2340-53-0x00007FF66E6A0000-0x00007FF66EA92000-memory.dmp	xmrig
behavioral2/memory/1900-49-0x00007FF7AADC0000-0x00007FF7AB1B2000-memory.dmp	xmrig
behavioral2/memory/2272-79-0x00007FF75A9C0000-0x00007FF75ADB2000-memory.dmp	xmrig
behavioral2/memory/5048-80-0x00007FF7AF340000-0x00007FF7AF732000-memory.dmp	xmrig
behavioral2/memory/1864-81-0x00007FF7E2A20000-0x00007FF7E2E12000-memory.dmp	xmrig
behavioral2/memory/3476-88-0x00007FF651F90000-0x00007FF652382000-memory.dmp	xmrig
behavioral2/memory/1908-103-0x00007FF6005E0000-0x00007FF6009D2000-memory.dmp	xmrig
behavioral2/memory/412-117-0x00007FF67B960000-0x00007FF67BD52000-memory.dmp	xmrig
behavioral2/memory/1256-128-0x00007FF646E10000-0x00007FF647202000-memory.dmp	xmrig
behavioral2/memory/412-147-0x00007FF67B960000-0x00007FF67BD52000-memory.dmp	xmrig
behavioral2/memory/4312-205-0x00007FF62F970000-0x00007FF62FD62000-memory.dmp	xmrig
behavioral2/memory/2572-224-0x00007FF642AD0000-0x00007FF642EC2000-memory.dmp	xmrig
behavioral2/memory/796-229-0x00007FF7B8B30000-0x00007FF7B8F22000-memory.dmp	xmrig
behavioral2/memory/2272-212-0x00007FF75A9C0000-0x00007FF75ADB2000-memory.dmp	xmrig
behavioral2/memory/1236-164-0x00007FF617F70000-0x00007FF618362000-memory.dmp	xmrig
behavioral2/memory/1048-159-0x00007FF628630000-0x00007FF628A22000-memory.dmp	xmrig
behavioral2/memory/4688-152-0x00007FF709D90000-0x00007FF70A182000-memory.dmp	xmrig
behavioral2/memory/1528-133-0x00007FF633BA0000-0x00007FF633F92000-memory.dmp	xmrig
behavioral2/memory/2592-94-0x00007FF666E80000-0x00007FF667272000-memory.dmp	xmrig
behavioral2/memory/5064-1717-0x00007FF658A80000-0x00007FF658E72000-memory.dmp	xmrig
behavioral2/memory/2340-1714-0x00007FF66E6A0000-0x00007FF66EA92000-memory.dmp	xmrig
behavioral2/memory/4672-1708-0x00007FF6C12F0000-0x00007FF6C16E2000-memory.dmp	xmrig
behavioral2/memory/1900-1713-0x00007FF7AADC0000-0x00007FF7AB1B2000-memory.dmp	xmrig
behavioral2/memory/512-1712-0x00007FF63FB20000-0x00007FF63FF12000-memory.dmp	xmrig
behavioral2/memory/5060-1706-0x00007FF7F8E40000-0x00007FF7F9232000-memory.dmp	xmrig
behavioral2/memory/4168-1704-0x00007FF6C77D0000-0x00007FF6C7BC2000-memory.dmp	xmrig
behavioral2/memory/2524-1741-0x00007FF72C630000-0x00007FF72CA22000-memory.dmp	xmrig
behavioral2/memory/1864-1769-0x00007FF7E2A20000-0x00007FF7E2E12000-memory.dmp	xmrig
behavioral2/memory/2272-1796-0x00007FF75A9C0000-0x00007FF75ADB2000-memory.dmp	xmrig
behavioral2/memory/3476-1956-0x00007FF651F90000-0x00007FF652382000-memory.dmp	xmrig
behavioral2/memory/2592-1975-0x00007FF666E80000-0x00007FF667272000-memory.dmp	xmrig
behavioral2/memory/1908-1991-0x00007FF6005E0000-0x00007FF6009D2000-memory.dmp	xmrig
behavioral2/memory/1528-2050-0x00007FF633BA0000-0x00007FF633F92000-memory.dmp	xmrig
behavioral2/memory/1256-2074-0x00007FF646E10000-0x00007FF647202000-memory.dmp	xmrig
behavioral2/memory/4312-2188-0x00007FF62F970000-0x00007FF62FD62000-memory.dmp	xmrig
behavioral2/memory/796-2185-0x00007FF7B8B30000-0x00007FF7B8F22000-memory.dmp	xmrig
behavioral2/memory/1236-2158-0x00007FF617F70000-0x00007FF618362000-memory.dmp	xmrig
behavioral2/memory/2072-1997-0x00007FF6FF9E0000-0x00007FF6FFDD2000-memory.dmp	xmrig
behavioral2/memory/3556-1982-0x00007FF609550000-0x00007FF609942000-memory.dmp	xmrig
behavioral2/memory/5048-1760-0x00007FF7AF340000-0x00007FF7AF732000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
5	4668	powershell.exe
7	4668	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4668	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
5060	gndRKVy.exe
1900	ObIlCWm.exe
2340	YvFpXbr.exe
4168	pnPYpll.exe
4672	TqVcjLq.exe
512	ajgbCcx.exe
5064	fugdBof.exe
2524	Kwneqmg.exe
5048	BbtJmVw.exe
2272	pWfxKlp.exe
1864	SZZYcoN.exe
3476	RPBKawV.exe
2592	wqXTfHA.exe
1908	GsvneHF.exe
3556	WrIvHoW.exe
2072	eyiLEMP.exe
1256	VXSluyN.exe
1528	QjBkDzR.exe
4688	fAtjyFL.exe
4312	SArziKe.exe
1048	hwnrfWl.exe
1236	vRUWWPR.exe
2572	UjacmFj.exe
796	WRyPAvx.exe
4476	vUAfNrX.exe
4384	jMQDnBZ.exe
1600	izWtOYv.exe
4372	gKQBAtw.exe
3948	kAbxtGF.exe
2184	MdCjpyl.exe
2036	igQheXG.exe
3036	yQeQEZu.exe
3336	XJzrhdJ.exe
1728	GuKFxgU.exe
1672	vXWzdcj.exe
2588	nTubNwF.exe
1960	xSdklWt.exe
2920	QRmFpZG.exe
2080	yFutrdK.exe
2304	uIVLGwt.exe
2692	XvOtlBA.exe
3616	SVLuUTo.exe
1712	YsIIQVW.exe
3964	adQYFyP.exe
3928	DyXadiT.exe
4764	XlUHcJH.exe
2564	bqXmYic.exe
1008	dPfrjiD.exe
3852	BFTdwnn.exe
3792	HfaELmN.exe
2384	lJdiBkp.exe
2532	uhzxlCm.exe
448	pLJdUvO.exe
1716	zbVifFd.exe
2348	sAvUfKB.exe
4656	QBPsomw.exe
4772	pkfxqoY.exe
1604	pwEoLxY.exe
5148	RybSgFE.exe
5188	IRSecYH.exe
5216	ZMqffZy.exe
5236	bUvwSEy.exe
5272	kvftteb.exe
5296	PCONaGL.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/412-0-0x00007FF67B960000-0x00007FF67BD52000-memory.dmp	upx
behavioral2/files/0x000800000002323c-6.dat	upx
behavioral2/files/0x0009000000023242-11.dat	upx
behavioral2/files/0x0007000000023243-10.dat	upx
behavioral2/files/0x0007000000023246-31.dat	upx
behavioral2/files/0x0008000000023245-37.dat	upx
behavioral2/files/0x0008000000023241-42.dat	upx
behavioral2/files/0x0008000000023244-48.dat	upx
behavioral2/files/0x0007000000023247-52.dat	upx
behavioral2/memory/4672-61-0x00007FF6C12F0000-0x00007FF6C16E2000-memory.dmp	upx
behavioral2/memory/512-64-0x00007FF63FB20000-0x00007FF63FF12000-memory.dmp	upx
behavioral2/memory/5060-67-0x00007FF7F8E40000-0x00007FF7F9232000-memory.dmp	upx
behavioral2/files/0x0007000000023248-69.dat	upx
behavioral2/files/0x0007000000023249-72.dat	upx
behavioral2/files/0x000700000002324a-77.dat	upx
behavioral2/memory/2524-71-0x00007FF72C630000-0x00007FF72CA22000-memory.dmp	upx
behavioral2/memory/5064-68-0x00007FF658A80000-0x00007FF658E72000-memory.dmp	upx
behavioral2/memory/4168-57-0x00007FF6C77D0000-0x00007FF6C7BC2000-memory.dmp	upx
behavioral2/memory/2340-53-0x00007FF66E6A0000-0x00007FF66EA92000-memory.dmp	upx
behavioral2/memory/1900-49-0x00007FF7AADC0000-0x00007FF7AB1B2000-memory.dmp	upx
behavioral2/memory/2272-79-0x00007FF75A9C0000-0x00007FF75ADB2000-memory.dmp	upx
behavioral2/memory/5048-80-0x00007FF7AF340000-0x00007FF7AF732000-memory.dmp	upx
behavioral2/memory/1864-81-0x00007FF7E2A20000-0x00007FF7E2E12000-memory.dmp	upx
behavioral2/files/0x000700000002324b-86.dat	upx
behavioral2/memory/3476-88-0x00007FF651F90000-0x00007FF652382000-memory.dmp	upx
behavioral2/files/0x000700000002324c-92.dat	upx
behavioral2/files/0x000700000002324d-98.dat	upx
behavioral2/memory/1908-103-0x00007FF6005E0000-0x00007FF6009D2000-memory.dmp	upx
behavioral2/files/0x000700000002324e-102.dat	upx
behavioral2/files/0x000700000002324f-107.dat	upx
behavioral2/memory/2072-113-0x00007FF6FF9E0000-0x00007FF6FFDD2000-memory.dmp	upx
behavioral2/files/0x0007000000023251-114.dat	upx
behavioral2/files/0x0007000000023252-120.dat	upx
behavioral2/memory/412-117-0x00007FF67B960000-0x00007FF67BD52000-memory.dmp	upx
behavioral2/files/0x0007000000023253-125.dat	upx
behavioral2/memory/1256-128-0x00007FF646E10000-0x00007FF647202000-memory.dmp	upx
behavioral2/files/0x0007000000023254-134.dat	upx
behavioral2/files/0x0007000000023255-139.dat	upx
behavioral2/files/0x0007000000023256-145.dat	upx
behavioral2/memory/412-147-0x00007FF67B960000-0x00007FF67BD52000-memory.dmp	upx
behavioral2/files/0x0007000000023257-160.dat	upx
behavioral2/files/0x0007000000023258-167.dat	upx
behavioral2/files/0x000700000002325a-169.dat	upx
behavioral2/files/0x000700000002325b-176.dat	upx
behavioral2/files/0x000700000002325c-181.dat	upx
behavioral2/files/0x000700000002325d-191.dat	upx
behavioral2/files/0x000700000002325e-196.dat	upx
behavioral2/memory/4312-205-0x00007FF62F970000-0x00007FF62FD62000-memory.dmp	upx
behavioral2/files/0x000700000002325f-213.dat	upx
behavioral2/memory/2572-224-0x00007FF642AD0000-0x00007FF642EC2000-memory.dmp	upx
behavioral2/memory/796-229-0x00007FF7B8B30000-0x00007FF7B8F22000-memory.dmp	upx
behavioral2/files/0x0007000000023261-215.dat	upx
behavioral2/memory/2272-212-0x00007FF75A9C0000-0x00007FF75ADB2000-memory.dmp	upx
behavioral2/files/0x0007000000023260-209.dat	upx
behavioral2/files/0x0007000000023259-171.dat	upx
behavioral2/memory/1236-164-0x00007FF617F70000-0x00007FF618362000-memory.dmp	upx
behavioral2/memory/1048-159-0x00007FF628630000-0x00007FF628A22000-memory.dmp	upx
behavioral2/memory/4688-152-0x00007FF709D90000-0x00007FF70A182000-memory.dmp	upx
behavioral2/memory/1528-133-0x00007FF633BA0000-0x00007FF633F92000-memory.dmp	upx
behavioral2/memory/3556-109-0x00007FF609550000-0x00007FF609942000-memory.dmp	upx
behavioral2/memory/2592-94-0x00007FF666E80000-0x00007FF667272000-memory.dmp	upx
behavioral2/memory/5064-1717-0x00007FF658A80000-0x00007FF658E72000-memory.dmp	upx
behavioral2/memory/2340-1714-0x00007FF66E6A0000-0x00007FF66EA92000-memory.dmp	upx
behavioral2/memory/4672-1708-0x00007FF6C12F0000-0x00007FF6C16E2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
5	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ngsbRMm.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\QCsqdeN.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\UYKEoNN.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\JDSPvnZ.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\iURFfSx.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\JjQdzOL.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\JqijQFp.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\XHXsKRC.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\dJdOspq.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\yFutrdK.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\trfOVsX.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\pLJdUvO.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\ukWhLeD.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\ANXZJbA.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\ZxTAryC.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\VjnFXSP.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\GuKFxgU.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\YsIIQVW.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\hzOJQTu.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\QZPAXKt.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\NqixjRJ.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\HMwMdyW.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\wgCgqPE.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\XaKySFg.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\jMQDnBZ.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\YUAssbh.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\HWiiuhv.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\YWUYSZa.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\adQYFyP.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\CarCMRQ.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\tggFKKs.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\ONcQYHT.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\KABYGds.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\upoQBXJ.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\yGyjFzD.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\uIVLGwt.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\gCQmVFS.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\WWSbFfi.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\XuSDnhA.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\zoYjFyT.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\yMfgmKj.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\dZBzTSu.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\wqXTfHA.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\pkfxqoY.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\elpCNsd.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\YLFoNYD.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\YTBOsbM.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\PCONaGL.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\nIluFru.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\YqrsUmS.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\cBTMkUU.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\bUvwSEy.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\kUrLCpl.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\LUNmcyM.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\WVfQHIu.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\wXMKhcE.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\Mubgyqi.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\vZvOPTy.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\ObIlCWm.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\pZBBBSf.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\mliFhMm.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\YmdnkuH.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\tLhYfFJ.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\BcOPuXQ.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4668	powershell.exe
4668	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
Token: SeDebugPrivilege	4668	powershell.exe
Token: SeLockMemoryPrivilege	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 412 wrote to memory of 4668	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	91
PID 412 wrote to memory of 4668	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	91
PID 412 wrote to memory of 5060	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	92
PID 412 wrote to memory of 5060	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	92
PID 412 wrote to memory of 1900	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	93
PID 412 wrote to memory of 1900	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	93
PID 412 wrote to memory of 2340	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	94
PID 412 wrote to memory of 2340	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	94
PID 412 wrote to memory of 4168	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	95
PID 412 wrote to memory of 4168	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	95
PID 412 wrote to memory of 4672	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	96
PID 412 wrote to memory of 4672	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	96
PID 412 wrote to memory of 512	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	97
PID 412 wrote to memory of 512	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	97
PID 412 wrote to memory of 5064	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	98
PID 412 wrote to memory of 5064	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	98
PID 412 wrote to memory of 2524	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	99
PID 412 wrote to memory of 2524	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	99
PID 412 wrote to memory of 5048	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	100
PID 412 wrote to memory of 5048	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	100
PID 412 wrote to memory of 2272	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	101
PID 412 wrote to memory of 2272	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	101
PID 412 wrote to memory of 1864	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	102
PID 412 wrote to memory of 1864	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	102
PID 412 wrote to memory of 3476	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	103
PID 412 wrote to memory of 3476	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	103
PID 412 wrote to memory of 2592	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	104
PID 412 wrote to memory of 2592	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	104
PID 412 wrote to memory of 1908	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	105
PID 412 wrote to memory of 1908	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	105
PID 412 wrote to memory of 3556	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	106
PID 412 wrote to memory of 3556	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	106
PID 412 wrote to memory of 2072	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	107
PID 412 wrote to memory of 2072	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	107
PID 412 wrote to memory of 1256	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	108
PID 412 wrote to memory of 1256	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	108
PID 412 wrote to memory of 1528	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	109
PID 412 wrote to memory of 1528	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	109
PID 412 wrote to memory of 4688	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	110
PID 412 wrote to memory of 4688	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	110
PID 412 wrote to memory of 4312	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	111
PID 412 wrote to memory of 4312	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	111
PID 412 wrote to memory of 1048	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	112
PID 412 wrote to memory of 1048	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	112
PID 412 wrote to memory of 1236	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	113
PID 412 wrote to memory of 1236	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	113
PID 412 wrote to memory of 2572	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	114
PID 412 wrote to memory of 2572	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	114
PID 412 wrote to memory of 796	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	115
PID 412 wrote to memory of 796	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	115
PID 412 wrote to memory of 4476	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	116
PID 412 wrote to memory of 4476	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	116
PID 412 wrote to memory of 4384	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	117
PID 412 wrote to memory of 4384	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	117
PID 412 wrote to memory of 1600	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	118
PID 412 wrote to memory of 1600	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	118
PID 412 wrote to memory of 4372	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	119
PID 412 wrote to memory of 4372	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	119
PID 412 wrote to memory of 3948	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	120
PID 412 wrote to memory of 3948	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	120
PID 412 wrote to memory of 2184	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	121
PID 412 wrote to memory of 2184	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	121
PID 412 wrote to memory of 2036	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	122
PID 412 wrote to memory of 2036	412	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	122

C:\Users\Admin\AppData\Local\Temp\7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4668
- C:\Windows\System\gndRKVy.exe
  C:\Windows\System\gndRKVy.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\ObIlCWm.exe
  C:\Windows\System\ObIlCWm.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\YvFpXbr.exe
  C:\Windows\System\YvFpXbr.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\pnPYpll.exe
  C:\Windows\System\pnPYpll.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\TqVcjLq.exe
  C:\Windows\System\TqVcjLq.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\ajgbCcx.exe
  C:\Windows\System\ajgbCcx.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\fugdBof.exe
  C:\Windows\System\fugdBof.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\Kwneqmg.exe
  C:\Windows\System\Kwneqmg.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\BbtJmVw.exe
  C:\Windows\System\BbtJmVw.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\pWfxKlp.exe
  C:\Windows\System\pWfxKlp.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\SZZYcoN.exe
  C:\Windows\System\SZZYcoN.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\RPBKawV.exe
  C:\Windows\System\RPBKawV.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\wqXTfHA.exe
  C:\Windows\System\wqXTfHA.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\GsvneHF.exe
  C:\Windows\System\GsvneHF.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\WrIvHoW.exe
  C:\Windows\System\WrIvHoW.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\eyiLEMP.exe
  C:\Windows\System\eyiLEMP.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\VXSluyN.exe
  C:\Windows\System\VXSluyN.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\QjBkDzR.exe
  C:\Windows\System\QjBkDzR.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\fAtjyFL.exe
  C:\Windows\System\fAtjyFL.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\SArziKe.exe
  C:\Windows\System\SArziKe.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\hwnrfWl.exe
  C:\Windows\System\hwnrfWl.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\vRUWWPR.exe
  C:\Windows\System\vRUWWPR.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\UjacmFj.exe
  C:\Windows\System\UjacmFj.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\WRyPAvx.exe
  C:\Windows\System\WRyPAvx.exe
  2⤵
  - Executes dropped EXE
  PID:796
- C:\Windows\System\vUAfNrX.exe
  C:\Windows\System\vUAfNrX.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\jMQDnBZ.exe
  C:\Windows\System\jMQDnBZ.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\izWtOYv.exe
  C:\Windows\System\izWtOYv.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\gKQBAtw.exe
  C:\Windows\System\gKQBAtw.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\kAbxtGF.exe
  C:\Windows\System\kAbxtGF.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\MdCjpyl.exe
  C:\Windows\System\MdCjpyl.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\igQheXG.exe
  C:\Windows\System\igQheXG.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\yQeQEZu.exe
  C:\Windows\System\yQeQEZu.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\XJzrhdJ.exe
  C:\Windows\System\XJzrhdJ.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\GuKFxgU.exe
  C:\Windows\System\GuKFxgU.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\vXWzdcj.exe
  C:\Windows\System\vXWzdcj.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\nTubNwF.exe
  C:\Windows\System\nTubNwF.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\xSdklWt.exe
  C:\Windows\System\xSdklWt.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\QRmFpZG.exe
  C:\Windows\System\QRmFpZG.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\yFutrdK.exe
  C:\Windows\System\yFutrdK.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\uIVLGwt.exe
  C:\Windows\System\uIVLGwt.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\XvOtlBA.exe
  C:\Windows\System\XvOtlBA.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\SVLuUTo.exe
  C:\Windows\System\SVLuUTo.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\YsIIQVW.exe
  C:\Windows\System\YsIIQVW.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\adQYFyP.exe
  C:\Windows\System\adQYFyP.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\DyXadiT.exe
  C:\Windows\System\DyXadiT.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\XlUHcJH.exe
  C:\Windows\System\XlUHcJH.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\bqXmYic.exe
  C:\Windows\System\bqXmYic.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\dPfrjiD.exe
  C:\Windows\System\dPfrjiD.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\BFTdwnn.exe
  C:\Windows\System\BFTdwnn.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\HfaELmN.exe
  C:\Windows\System\HfaELmN.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System\lJdiBkp.exe
  C:\Windows\System\lJdiBkp.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\uhzxlCm.exe
  C:\Windows\System\uhzxlCm.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\pLJdUvO.exe
  C:\Windows\System\pLJdUvO.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\zbVifFd.exe
  C:\Windows\System\zbVifFd.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\sAvUfKB.exe
  C:\Windows\System\sAvUfKB.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\QBPsomw.exe
  C:\Windows\System\QBPsomw.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\pkfxqoY.exe
  C:\Windows\System\pkfxqoY.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\pwEoLxY.exe
  C:\Windows\System\pwEoLxY.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\RybSgFE.exe
  C:\Windows\System\RybSgFE.exe
  2⤵
  - Executes dropped EXE
  PID:5148
- C:\Windows\System\IRSecYH.exe
  C:\Windows\System\IRSecYH.exe
  2⤵
  - Executes dropped EXE
  PID:5188
- C:\Windows\System\ZMqffZy.exe
  C:\Windows\System\ZMqffZy.exe
  2⤵
  - Executes dropped EXE
  PID:5216
- C:\Windows\System\bUvwSEy.exe
  C:\Windows\System\bUvwSEy.exe
  2⤵
  - Executes dropped EXE
  PID:5236
- C:\Windows\System\kvftteb.exe
  C:\Windows\System\kvftteb.exe
  2⤵
  - Executes dropped EXE
  PID:5272
- C:\Windows\System\PCONaGL.exe
  C:\Windows\System\PCONaGL.exe
  2⤵
  - Executes dropped EXE
  PID:5296
- C:\Windows\System\RJQuugi.exe
  C:\Windows\System\RJQuugi.exe
  2⤵
  PID:5320
- C:\Windows\System\kUmfpxU.exe
  C:\Windows\System\kUmfpxU.exe
  2⤵
  PID:5348
- C:\Windows\System\YzGmjLv.exe
  C:\Windows\System\YzGmjLv.exe
  2⤵
  PID:5376
- C:\Windows\System\IElrvAj.exe
  C:\Windows\System\IElrvAj.exe
  2⤵
  PID:5404
- C:\Windows\System\UPOsGuB.exe
  C:\Windows\System\UPOsGuB.exe
  2⤵
  PID:5440
- C:\Windows\System\aUDUVpK.exe
  C:\Windows\System\aUDUVpK.exe
  2⤵
  PID:5460
- C:\Windows\System\PwTYmXS.exe
  C:\Windows\System\PwTYmXS.exe
  2⤵
  PID:5516
- C:\Windows\System\lMkuNfd.exe
  C:\Windows\System\lMkuNfd.exe
  2⤵
  PID:5536
- C:\Windows\System\JhkaLkE.exe
  C:\Windows\System\JhkaLkE.exe
  2⤵
  PID:5552
- C:\Windows\System\xXdcEZp.exe
  C:\Windows\System\xXdcEZp.exe
  2⤵
  PID:5568
- C:\Windows\System\TzVoLDj.exe
  C:\Windows\System\TzVoLDj.exe
  2⤵
  PID:5596
- C:\Windows\System\trfOVsX.exe
  C:\Windows\System\trfOVsX.exe
  2⤵
  PID:5656
- C:\Windows\System\gMmufvY.exe
  C:\Windows\System\gMmufvY.exe
  2⤵
  PID:5692
- C:\Windows\System\FHNdxvg.exe
  C:\Windows\System\FHNdxvg.exe
  2⤵
  PID:5712
- C:\Windows\System\EjRnQtC.exe
  C:\Windows\System\EjRnQtC.exe
  2⤵
  PID:5740
- C:\Windows\System\XiQdzho.exe
  C:\Windows\System\XiQdzho.exe
  2⤵
  PID:5776
- C:\Windows\System\ezyEVHp.exe
  C:\Windows\System\ezyEVHp.exe
  2⤵
  PID:5796
- C:\Windows\System\qojcwNQ.exe
  C:\Windows\System\qojcwNQ.exe
  2⤵
  PID:5820
- C:\Windows\System\rpuJfPD.exe
  C:\Windows\System\rpuJfPD.exe
  2⤵
  PID:5860
- C:\Windows\System\gCQmVFS.exe
  C:\Windows\System\gCQmVFS.exe
  2⤵
  PID:5880
- C:\Windows\System\sgWVnos.exe
  C:\Windows\System\sgWVnos.exe
  2⤵
  PID:5908
- C:\Windows\System\YUAssbh.exe
  C:\Windows\System\YUAssbh.exe
  2⤵
  PID:5936
- C:\Windows\System\VkyZLtK.exe
  C:\Windows\System\VkyZLtK.exe
  2⤵
  PID:5976
- C:\Windows\System\UAvGQLc.exe
  C:\Windows\System\UAvGQLc.exe
  2⤵
  PID:5996
- C:\Windows\System\hNNvLWH.exe
  C:\Windows\System\hNNvLWH.exe
  2⤵
  PID:6028
- C:\Windows\System\LJKdfBo.exe
  C:\Windows\System\LJKdfBo.exe
  2⤵
  PID:6048
- C:\Windows\System\ukWhLeD.exe
  C:\Windows\System\ukWhLeD.exe
  2⤵
  PID:6072
- C:\Windows\System\BxUMvBC.exe
  C:\Windows\System\BxUMvBC.exe
  2⤵
  PID:6092
- C:\Windows\System\DtdBsxq.exe
  C:\Windows\System\DtdBsxq.exe
  2⤵
  PID:6136
- C:\Windows\System\xvSoUak.exe
  C:\Windows\System\xvSoUak.exe
  2⤵
  PID:1116
- C:\Windows\System\ZvGGGTN.exe
  C:\Windows\System\ZvGGGTN.exe
  2⤵
  PID:5124
- C:\Windows\System\CarCMRQ.exe
  C:\Windows\System\CarCMRQ.exe
  2⤵
  PID:5184
- C:\Windows\System\GKlqJcF.exe
  C:\Windows\System\GKlqJcF.exe
  2⤵
  PID:5228
- C:\Windows\System\RIJZtJD.exe
  C:\Windows\System\RIJZtJD.exe
  2⤵
  PID:5312
- C:\Windows\System\KqrTCBA.exe
  C:\Windows\System\KqrTCBA.exe
  2⤵
  PID:372
- C:\Windows\System\ujQrjjw.exe
  C:\Windows\System\ujQrjjw.exe
  2⤵
  PID:5396
- C:\Windows\System\XRcgcwY.exe
  C:\Windows\System\XRcgcwY.exe
  2⤵
  PID:4728
- C:\Windows\System\kksDLGL.exe
  C:\Windows\System\kksDLGL.exe
  2⤵
  PID:5456
- C:\Windows\System\bsOLyWf.exe
  C:\Windows\System\bsOLyWf.exe
  2⤵
  PID:5500
- C:\Windows\System\tggFKKs.exe
  C:\Windows\System\tggFKKs.exe
  2⤵
  PID:5560
- C:\Windows\System\kSPtQCK.exe
  C:\Windows\System\kSPtQCK.exe
  2⤵
  PID:5588
- C:\Windows\System\YZrdBSw.exe
  C:\Windows\System\YZrdBSw.exe
  2⤵
  PID:5652
- C:\Windows\System\mjidFSA.exe
  C:\Windows\System\mjidFSA.exe
  2⤵
  PID:4604
- C:\Windows\System\CdwgKAY.exe
  C:\Windows\System\CdwgKAY.exe
  2⤵
  PID:744
- C:\Windows\System\UDWzfnh.exe
  C:\Windows\System\UDWzfnh.exe
  2⤵
  PID:3548
- C:\Windows\System\ANXZJbA.exe
  C:\Windows\System\ANXZJbA.exe
  2⤵
  PID:5704
- C:\Windows\System\AsArIgF.exe
  C:\Windows\System\AsArIgF.exe
  2⤵
  PID:5752
- C:\Windows\System\pZBBBSf.exe
  C:\Windows\System\pZBBBSf.exe
  2⤵
  PID:5836
- C:\Windows\System\ZsGyPAH.exe
  C:\Windows\System\ZsGyPAH.exe
  2⤵
  PID:5788
- C:\Windows\System\VAhWxlu.exe
  C:\Windows\System\VAhWxlu.exe
  2⤵
  PID:5896
- C:\Windows\System\lNoquGz.exe
  C:\Windows\System\lNoquGz.exe
  2⤵
  PID:5952
- C:\Windows\System\wuXJFtS.exe
  C:\Windows\System\wuXJFtS.exe
  2⤵
  PID:5992
- C:\Windows\System\JDSPvnZ.exe
  C:\Windows\System\JDSPvnZ.exe
  2⤵
  PID:6044
- C:\Windows\System\XsYVRlZ.exe
  C:\Windows\System\XsYVRlZ.exe
  2⤵
  PID:6084
- C:\Windows\System\HLJomnC.exe
  C:\Windows\System\HLJomnC.exe
  2⤵
  PID:6100
- C:\Windows\System\GtdxBzJ.exe
  C:\Windows\System\GtdxBzJ.exe
  2⤵
  PID:5136
- C:\Windows\System\UCWMlZf.exe
  C:\Windows\System\UCWMlZf.exe
  2⤵
  PID:5212
- C:\Windows\System\nQRTrEj.exe
  C:\Windows\System\nQRTrEj.exe
  2⤵
  PID:3828
- C:\Windows\System\fZlCgbI.exe
  C:\Windows\System\fZlCgbI.exe
  2⤵
  PID:5584
- C:\Windows\System\GsTgpSk.exe
  C:\Windows\System\GsTgpSk.exe
  2⤵
  PID:3728
- C:\Windows\System\RNkKvyR.exe
  C:\Windows\System\RNkKvyR.exe
  2⤵
  PID:3844
- C:\Windows\System\JjQdzOL.exe
  C:\Windows\System\JjQdzOL.exe
  2⤵
  PID:3752
- C:\Windows\System\qQwwMey.exe
  C:\Windows\System\qQwwMey.exe
  2⤵
  PID:5804
- C:\Windows\System\ViekRko.exe
  C:\Windows\System\ViekRko.exe
  2⤵
  PID:6068
- C:\Windows\System\zsCWaeT.exe
  C:\Windows\System\zsCWaeT.exe
  2⤵
  PID:5988
- C:\Windows\System\LduNqmo.exe
  C:\Windows\System\LduNqmo.exe
  2⤵
  PID:6016
- C:\Windows\System\XHXsKRC.exe
  C:\Windows\System\XHXsKRC.exe
  2⤵
  PID:3224
- C:\Windows\System\GEmBNrL.exe
  C:\Windows\System\GEmBNrL.exe
  2⤵
  PID:5336
- C:\Windows\System\kYDdcfm.exe
  C:\Windows\System\kYDdcfm.exe
  2⤵
  PID:2716
- C:\Windows\System\hRRyIFP.exe
  C:\Windows\System\hRRyIFP.exe
  2⤵
  PID:5768
- C:\Windows\System\iURFfSx.exe
  C:\Windows\System\iURFfSx.exe
  2⤵
  PID:1076
- C:\Windows\System\kUrLCpl.exe
  C:\Windows\System\kUrLCpl.exe
  2⤵
  PID:5512
- C:\Windows\System\EhniZqk.exe
  C:\Windows\System\EhniZqk.exe
  2⤵
  PID:6168
- C:\Windows\System\JZhsYCQ.exe
  C:\Windows\System\JZhsYCQ.exe
  2⤵
  PID:6188
- C:\Windows\System\LUNmcyM.exe
  C:\Windows\System\LUNmcyM.exe
  2⤵
  PID:6224
- C:\Windows\System\mMYNkxe.exe
  C:\Windows\System\mMYNkxe.exe
  2⤵
  PID:6256
- C:\Windows\System\ZxhdaJb.exe
  C:\Windows\System\ZxhdaJb.exe
  2⤵
  PID:6276
- C:\Windows\System\fsjbcTw.exe
  C:\Windows\System\fsjbcTw.exe
  2⤵
  PID:6300
- C:\Windows\System\tppmIWA.exe
  C:\Windows\System\tppmIWA.exe
  2⤵
  PID:6320
- C:\Windows\System\dmYjALd.exe
  C:\Windows\System\dmYjALd.exe
  2⤵
  PID:6440
- C:\Windows\System\dJdOspq.exe
  C:\Windows\System\dJdOspq.exe
  2⤵
  PID:6468
- C:\Windows\System\sYiInGq.exe
  C:\Windows\System\sYiInGq.exe
  2⤵
  PID:6484
- C:\Windows\System\UqBHBGV.exe
  C:\Windows\System\UqBHBGV.exe
  2⤵
  PID:6508
- C:\Windows\System\xqYHwJP.exe
  C:\Windows\System\xqYHwJP.exe
  2⤵
  PID:6536
- C:\Windows\System\aGODtzr.exe
  C:\Windows\System\aGODtzr.exe
  2⤵
  PID:6556
- C:\Windows\System\TUnomjp.exe
  C:\Windows\System\TUnomjp.exe
  2⤵
  PID:6600
- C:\Windows\System\hzOJQTu.exe
  C:\Windows\System\hzOJQTu.exe
  2⤵
  PID:6632
- C:\Windows\System\ufFZXlO.exe
  C:\Windows\System\ufFZXlO.exe
  2⤵
  PID:6652
- C:\Windows\System\NQZpUNg.exe
  C:\Windows\System\NQZpUNg.exe
  2⤵
  PID:6672
- C:\Windows\System\DfiwqjN.exe
  C:\Windows\System\DfiwqjN.exe
  2⤵
  PID:6688
- C:\Windows\System\TaTFLqf.exe
  C:\Windows\System\TaTFLqf.exe
  2⤵
  PID:6704
- C:\Windows\System\MxCBCFl.exe
  C:\Windows\System\MxCBCFl.exe
  2⤵
  PID:6720
- C:\Windows\System\OxYnsCD.exe
  C:\Windows\System\OxYnsCD.exe
  2⤵
  PID:6736
- C:\Windows\System\QoVYTyM.exe
  C:\Windows\System\QoVYTyM.exe
  2⤵
  PID:6768
- C:\Windows\System\WWSbFfi.exe
  C:\Windows\System\WWSbFfi.exe
  2⤵
  PID:6800
- C:\Windows\System\qIxiFZl.exe
  C:\Windows\System\qIxiFZl.exe
  2⤵
  PID:6820
- C:\Windows\System\XwPPdeL.exe
  C:\Windows\System\XwPPdeL.exe
  2⤵
  PID:6840
- C:\Windows\System\stCRYWR.exe
  C:\Windows\System\stCRYWR.exe
  2⤵
  PID:6856
- C:\Windows\System\iaJnews.exe
  C:\Windows\System\iaJnews.exe
  2⤵
  PID:6876
- C:\Windows\System\nGoqpVt.exe
  C:\Windows\System\nGoqpVt.exe
  2⤵
  PID:6892
- C:\Windows\System\uYUBVIV.exe
  C:\Windows\System\uYUBVIV.exe
  2⤵
  PID:6908
- C:\Windows\System\BMSDrXx.exe
  C:\Windows\System\BMSDrXx.exe
  2⤵
  PID:6924
- C:\Windows\System\LsWHSrh.exe
  C:\Windows\System\LsWHSrh.exe
  2⤵
  PID:7016
- C:\Windows\System\UQDIldy.exe
  C:\Windows\System\UQDIldy.exe
  2⤵
  PID:7032
- C:\Windows\System\YqrsUmS.exe
  C:\Windows\System\YqrsUmS.exe
  2⤵
  PID:7048
- C:\Windows\System\iwhxcun.exe
  C:\Windows\System\iwhxcun.exe
  2⤵
  PID:7068
- C:\Windows\System\ZmNHRAM.exe
  C:\Windows\System\ZmNHRAM.exe
  2⤵
  PID:7088
- C:\Windows\System\lTmyrGZ.exe
  C:\Windows\System\lTmyrGZ.exe
  2⤵
  PID:6180
- C:\Windows\System\QZPAXKt.exe
  C:\Windows\System\QZPAXKt.exe
  2⤵
  PID:6232
- C:\Windows\System\HWiiuhv.exe
  C:\Windows\System\HWiiuhv.exe
  2⤵
  PID:6244
- C:\Windows\System\nNTHstb.exe
  C:\Windows\System\nNTHstb.exe
  2⤵
  PID:6316
- C:\Windows\System\lOrnxfn.exe
  C:\Windows\System\lOrnxfn.exe
  2⤵
  PID:6392
- C:\Windows\System\HFhZWVs.exe
  C:\Windows\System\HFhZWVs.exe
  2⤵
  PID:6660
- C:\Windows\System\jkEdVne.exe
  C:\Windows\System\jkEdVne.exe
  2⤵
  PID:6764
- C:\Windows\System\KazCazP.exe
  C:\Windows\System\KazCazP.exe
  2⤵
  PID:6552
- C:\Windows\System\cBTMkUU.exe
  C:\Windows\System\cBTMkUU.exe
  2⤵
  PID:6836
- C:\Windows\System\esFNlaf.exe
  C:\Windows\System\esFNlaf.exe
  2⤵
  PID:6992
- C:\Windows\System\VXvTHRO.exe
  C:\Windows\System\VXvTHRO.exe
  2⤵
  PID:6920
- C:\Windows\System\YKfXpTx.exe
  C:\Windows\System\YKfXpTx.exe
  2⤵
  PID:6812
- C:\Windows\System\wYDSBJY.exe
  C:\Windows\System\wYDSBJY.exe
  2⤵
  PID:5956
- C:\Windows\System\tGUiwhm.exe
  C:\Windows\System\tGUiwhm.exe
  2⤵
  PID:7096
- C:\Windows\System\hDfygMI.exe
  C:\Windows\System\hDfygMI.exe
  2⤵
  PID:6288
- C:\Windows\System\pNoPvWE.exe
  C:\Windows\System\pNoPvWE.exe
  2⤵
  PID:7064
- C:\Windows\System\WVfQHIu.exe
  C:\Windows\System\WVfQHIu.exe
  2⤵
  PID:6548
- C:\Windows\System\kRgWQkQ.exe
  C:\Windows\System\kRgWQkQ.exe
  2⤵
  PID:6516
- C:\Windows\System\xkJIETm.exe
  C:\Windows\System\xkJIETm.exe
  2⤵
  PID:6264
- C:\Windows\System\CnYKUCv.exe
  C:\Windows\System\CnYKUCv.exe
  2⤵
  PID:6496
- C:\Windows\System\HeaAdgt.exe
  C:\Windows\System\HeaAdgt.exe
  2⤵
  PID:6616
- C:\Windows\System\rijVOMa.exe
  C:\Windows\System\rijVOMa.exe
  2⤵
  PID:3288
- C:\Windows\System\aerPyZY.exe
  C:\Windows\System\aerPyZY.exe
  2⤵
  PID:6788
- C:\Windows\System\XuSDnhA.exe
  C:\Windows\System\XuSDnhA.exe
  2⤵
  PID:7080
- C:\Windows\System\TBixslZ.exe
  C:\Windows\System\TBixslZ.exe
  2⤵
  PID:5168
- C:\Windows\System\RIOSECb.exe
  C:\Windows\System\RIOSECb.exe
  2⤵
  PID:6416
- C:\Windows\System\ZxTAryC.exe
  C:\Windows\System\ZxTAryC.exe
  2⤵
  PID:6904
- C:\Windows\System\mliFhMm.exe
  C:\Windows\System\mliFhMm.exe
  2⤵
  PID:7240
- C:\Windows\System\bUvlhRV.exe
  C:\Windows\System\bUvlhRV.exe
  2⤵
  PID:7256
- C:\Windows\System\YWUYSZa.exe
  C:\Windows\System\YWUYSZa.exe
  2⤵
  PID:7276
- C:\Windows\System\ZqlVqRH.exe
  C:\Windows\System\ZqlVqRH.exe
  2⤵
  PID:7324
- C:\Windows\System\cFvkbsU.exe
  C:\Windows\System\cFvkbsU.exe
  2⤵
  PID:7352
- C:\Windows\System\iKQCDoW.exe
  C:\Windows\System\iKQCDoW.exe
  2⤵
  PID:7380
- C:\Windows\System\NqixjRJ.exe
  C:\Windows\System\NqixjRJ.exe
  2⤵
  PID:7400
- C:\Windows\System\POXrPKt.exe
  C:\Windows\System\POXrPKt.exe
  2⤵
  PID:7420
- C:\Windows\System\XooHlHa.exe
  C:\Windows\System\XooHlHa.exe
  2⤵
  PID:7444
- C:\Windows\System\TalWHHs.exe
  C:\Windows\System\TalWHHs.exe
  2⤵
  PID:7464
- C:\Windows\System\Cszqvir.exe
  C:\Windows\System\Cszqvir.exe
  2⤵
  PID:7484
- C:\Windows\System\yzbcFIs.exe
  C:\Windows\System\yzbcFIs.exe
  2⤵
  PID:7504
- C:\Windows\System\AmRxpzP.exe
  C:\Windows\System\AmRxpzP.exe
  2⤵
  PID:7520
- C:\Windows\System\IHPzQcV.exe
  C:\Windows\System\IHPzQcV.exe
  2⤵
  PID:7572
- C:\Windows\System\xJflSQV.exe
  C:\Windows\System\xJflSQV.exe
  2⤵
  PID:7596
- C:\Windows\System\YmdnkuH.exe
  C:\Windows\System\YmdnkuH.exe
  2⤵
  PID:7632
- C:\Windows\System\zoYjFyT.exe
  C:\Windows\System\zoYjFyT.exe
  2⤵
  PID:7688
- C:\Windows\System\AqckXQL.exe
  C:\Windows\System\AqckXQL.exe
  2⤵
  PID:7716
- C:\Windows\System\nIluFru.exe
  C:\Windows\System\nIluFru.exe
  2⤵
  PID:7744
- C:\Windows\System\jwOMyfr.exe
  C:\Windows\System\jwOMyfr.exe
  2⤵
  PID:7764
- C:\Windows\System\XKBiUQu.exe
  C:\Windows\System\XKBiUQu.exe
  2⤵
  PID:7788
- C:\Windows\System\Vvghepd.exe
  C:\Windows\System\Vvghepd.exe
  2⤵
  PID:7804
- C:\Windows\System\aZgFLtP.exe
  C:\Windows\System\aZgFLtP.exe
  2⤵
  PID:7832
- C:\Windows\System\tJPPmiS.exe
  C:\Windows\System\tJPPmiS.exe
  2⤵
  PID:7856
- C:\Windows\System\dAGShTT.exe
  C:\Windows\System\dAGShTT.exe
  2⤵
  PID:7908
- C:\Windows\System\elpCNsd.exe
  C:\Windows\System\elpCNsd.exe
  2⤵
  PID:7928
- C:\Windows\System\ngsbRMm.exe
  C:\Windows\System\ngsbRMm.exe
  2⤵
  PID:7952
- C:\Windows\System\zKnWJSX.exe
  C:\Windows\System\zKnWJSX.exe
  2⤵
  PID:7972
- C:\Windows\System\StBMMAU.exe
  C:\Windows\System\StBMMAU.exe
  2⤵
  PID:7992
- C:\Windows\System\ONcQYHT.exe
  C:\Windows\System\ONcQYHT.exe
  2⤵
  PID:8024
- C:\Windows\System\JqijQFp.exe
  C:\Windows\System\JqijQFp.exe
  2⤵
  PID:8072
- C:\Windows\System\hfbyuLN.exe
  C:\Windows\System\hfbyuLN.exe
  2⤵
  PID:8096
- C:\Windows\System\keoyhzt.exe
  C:\Windows\System\keoyhzt.exe
  2⤵
  PID:8116
- C:\Windows\System\HMwMdyW.exe
  C:\Windows\System\HMwMdyW.exe
  2⤵
  PID:8136
- C:\Windows\System\NIGOzyi.exe
  C:\Windows\System\NIGOzyi.exe
  2⤵
  PID:8160
- C:\Windows\System\wXMKhcE.exe
  C:\Windows\System\wXMKhcE.exe
  2⤵
  PID:8176
- C:\Windows\System\vxlBvZk.exe
  C:\Windows\System\vxlBvZk.exe
  2⤵
  PID:6220
- C:\Windows\System\CKYfxQg.exe
  C:\Windows\System\CKYfxQg.exe
  2⤵
  PID:6204
- C:\Windows\System\QCsqdeN.exe
  C:\Windows\System\QCsqdeN.exe
  2⤵
  PID:7180
- C:\Windows\System\XdYNQem.exe
  C:\Windows\System\XdYNQem.exe
  2⤵
  PID:4068
- C:\Windows\System\truGRNB.exe
  C:\Windows\System\truGRNB.exe
  2⤵
  PID:7252
- C:\Windows\System\lUqiXCy.exe
  C:\Windows\System\lUqiXCy.exe
  2⤵
  PID:7320
- C:\Windows\System\brrDZiX.exe
  C:\Windows\System\brrDZiX.exe
  2⤵
  PID:7368
- C:\Windows\System\tLhYfFJ.exe
  C:\Windows\System\tLhYfFJ.exe
  2⤵
  PID:7452
- C:\Windows\System\zmgvUAG.exe
  C:\Windows\System\zmgvUAG.exe
  2⤵
  PID:7480
- C:\Windows\System\NNFxMLT.exe
  C:\Windows\System\NNFxMLT.exe
  2⤵
  PID:7528
- C:\Windows\System\vYZIIZo.exe
  C:\Windows\System\vYZIIZo.exe
  2⤵
  PID:7560
- C:\Windows\System\VMkvVod.exe
  C:\Windows\System\VMkvVod.exe
  2⤵
  PID:7624
- C:\Windows\System\LwjlVnx.exe
  C:\Windows\System\LwjlVnx.exe
  2⤵
  PID:7680
- C:\Windows\System\aSTEXZb.exe
  C:\Windows\System\aSTEXZb.exe
  2⤵
  PID:7848
- C:\Windows\System\MXAiYZr.exe
  C:\Windows\System\MXAiYZr.exe
  2⤵
  PID:3048
- C:\Windows\System\LBfuYLt.exe
  C:\Windows\System\LBfuYLt.exe
  2⤵
  PID:7904
- C:\Windows\System\YHQcjWW.exe
  C:\Windows\System\YHQcjWW.exe
  2⤵
  PID:7968
- C:\Windows\System\UYKEoNN.exe
  C:\Windows\System\UYKEoNN.exe
  2⤵
  PID:8020
- C:\Windows\System\YhhqELx.exe
  C:\Windows\System\YhhqELx.exe
  2⤵
  PID:8044
- C:\Windows\System\QLtSSRe.exe
  C:\Windows\System\QLtSSRe.exe
  2⤵
  PID:6568
- C:\Windows\System\YDsiACi.exe
  C:\Windows\System\YDsiACi.exe
  2⤵
  PID:1680
- C:\Windows\System\thAUgtB.exe
  C:\Windows\System\thAUgtB.exe
  2⤵
  PID:7512
- C:\Windows\System\OYoOvuF.exe
  C:\Windows\System\OYoOvuF.exe
  2⤵
  PID:7684
- C:\Windows\System\FDtLARa.exe
  C:\Windows\System\FDtLARa.exe
  2⤵
  PID:7392
- C:\Windows\System\HhGOuWZ.exe
  C:\Windows\System\HhGOuWZ.exe
  2⤵
  PID:7588
- C:\Windows\System\hwykizv.exe
  C:\Windows\System\hwykizv.exe
  2⤵
  PID:8128
- C:\Windows\System\yMfgmKj.exe
  C:\Windows\System\yMfgmKj.exe
  2⤵
  PID:7900
- C:\Windows\System\Mubgyqi.exe
  C:\Windows\System\Mubgyqi.exe
  2⤵
  PID:8124
- C:\Windows\System\BcOPuXQ.exe
  C:\Windows\System\BcOPuXQ.exe
  2⤵
  PID:7608
- C:\Windows\System\fEYnnLP.exe
  C:\Windows\System\fEYnnLP.exe
  2⤵
  PID:8200
- C:\Windows\System\bIkNnKh.exe
  C:\Windows\System\bIkNnKh.exe
  2⤵
  PID:8220
- C:\Windows\System\KzGGmCI.exe
  C:\Windows\System\KzGGmCI.exe
  2⤵
  PID:8236
- C:\Windows\System\cmxuYTg.exe
  C:\Windows\System\cmxuYTg.exe
  2⤵
  PID:8264
- C:\Windows\System\YWzfXEX.exe
  C:\Windows\System\YWzfXEX.exe
  2⤵
  PID:8292
- C:\Windows\System\WHkxauu.exe
  C:\Windows\System\WHkxauu.exe
  2⤵
  PID:8320
- C:\Windows\System\dCTSDdn.exe
  C:\Windows\System\dCTSDdn.exe
  2⤵
  PID:8336
- C:\Windows\System\EVGfajh.exe
  C:\Windows\System\EVGfajh.exe
  2⤵
  PID:8360
- C:\Windows\System\JlnRFJr.exe
  C:\Windows\System\JlnRFJr.exe
  2⤵
  PID:8384
- C:\Windows\System\FWUVLCe.exe
  C:\Windows\System\FWUVLCe.exe
  2⤵
  PID:8400
- C:\Windows\System\IrwmUDo.exe
  C:\Windows\System\IrwmUDo.exe
  2⤵
  PID:8420
- C:\Windows\System\xRqtECg.exe
  C:\Windows\System\xRqtECg.exe
  2⤵
  PID:8436
- C:\Windows\System\IWVizWd.exe
  C:\Windows\System\IWVizWd.exe
  2⤵
  PID:8452
- C:\Windows\System\ADiNAGF.exe
  C:\Windows\System\ADiNAGF.exe
  2⤵
  PID:8540
- C:\Windows\System\YFyRvlW.exe
  C:\Windows\System\YFyRvlW.exe
  2⤵
  PID:8568
- C:\Windows\System\vaycTEV.exe
  C:\Windows\System\vaycTEV.exe
  2⤵
  PID:8596
- C:\Windows\System\KABYGds.exe
  C:\Windows\System\KABYGds.exe
  2⤵
  PID:8616
- C:\Windows\System\fqPOXop.exe
  C:\Windows\System\fqPOXop.exe
  2⤵
  PID:8632
- C:\Windows\System\kcQclYr.exe
  C:\Windows\System\kcQclYr.exe
  2⤵
  PID:8664
- C:\Windows\System\sPcUwAI.exe
  C:\Windows\System\sPcUwAI.exe
  2⤵
  PID:8692
- C:\Windows\System\YLFoNYD.exe
  C:\Windows\System\YLFoNYD.exe
  2⤵
  PID:8716
- C:\Windows\System\dZBzTSu.exe
  C:\Windows\System\dZBzTSu.exe
  2⤵
  PID:8816
- C:\Windows\System\lFxMuNI.exe
  C:\Windows\System\lFxMuNI.exe
  2⤵
  PID:8872
- C:\Windows\System\abdTseu.exe
  C:\Windows\System\abdTseu.exe
  2⤵
  PID:8916
- C:\Windows\System\qGBivkN.exe
  C:\Windows\System\qGBivkN.exe
  2⤵
  PID:8968
- C:\Windows\System\NKMiqdn.exe
  C:\Windows\System\NKMiqdn.exe
  2⤵
  PID:8992
- C:\Windows\System\yuWEfnP.exe
  C:\Windows\System\yuWEfnP.exe
  2⤵
  PID:9012
- C:\Windows\System\KMNdlaX.exe
  C:\Windows\System\KMNdlaX.exe
  2⤵
  PID:9040
- C:\Windows\System\nbHgnEd.exe
  C:\Windows\System\nbHgnEd.exe
  2⤵
  PID:9060
- C:\Windows\System\cgBeVgR.exe
  C:\Windows\System\cgBeVgR.exe
  2⤵
  PID:9096
- C:\Windows\System\bSrTNWh.exe
  C:\Windows\System\bSrTNWh.exe
  2⤵
  PID:9116
- C:\Windows\System\EKegQXN.exe
  C:\Windows\System\EKegQXN.exe
  2⤵
  PID:9152
- C:\Windows\System\CbFFjoz.exe
  C:\Windows\System\CbFFjoz.exe
  2⤵
  PID:9176
- C:\Windows\System\VHEeniw.exe
  C:\Windows\System\VHEeniw.exe
  2⤵
  PID:9196
- C:\Windows\System\upoQBXJ.exe
  C:\Windows\System\upoQBXJ.exe
  2⤵
  PID:7960
- C:\Windows\System\OQHjcHP.exe
  C:\Windows\System\OQHjcHP.exe
  2⤵
  PID:8188
- C:\Windows\System\pvZmyVM.exe
  C:\Windows\System\pvZmyVM.exe
  2⤵
  PID:8232
- C:\Windows\System\BaflNsr.exe
  C:\Windows\System\BaflNsr.exe
  2⤵
  PID:7284
- C:\Windows\System\yGyjFzD.exe
  C:\Windows\System\yGyjFzD.exe
  2⤵
  PID:7340
- C:\Windows\System\EGYruBB.exe
  C:\Windows\System\EGYruBB.exe
  2⤵
  PID:8372
- C:\Windows\System\BpHuEWN.exe
  C:\Windows\System\BpHuEWN.exe
  2⤵
  PID:8504
- C:\Windows\System\pjnXUSW.exe
  C:\Windows\System\pjnXUSW.exe
  2⤵
  PID:8448
- C:\Windows\System\vSPzjeX.exe
  C:\Windows\System\vSPzjeX.exe
  2⤵
  PID:8576
- C:\Windows\System\cJdhjEd.exe
  C:\Windows\System\cJdhjEd.exe
  2⤵
  PID:8356
- C:\Windows\System\VjnFXSP.exe
  C:\Windows\System\VjnFXSP.exe
  2⤵
  PID:8608
- C:\Windows\System\wgCgqPE.exe
  C:\Windows\System\wgCgqPE.exe
  2⤵
  PID:8688
- C:\Windows\System\kahaEmE.exe
  C:\Windows\System\kahaEmE.exe
  2⤵
  PID:8804
- C:\Windows\System\oPqFszZ.exe
  C:\Windows\System\oPqFszZ.exe
  2⤵
  PID:8652
- C:\Windows\System\pUgSPLx.exe
  C:\Windows\System\pUgSPLx.exe
  2⤵
  PID:8856
- C:\Windows\System\lisZnJp.exe
  C:\Windows\System\lisZnJp.exe
  2⤵
  PID:8724
- C:\Windows\System\VIjySOg.exe
  C:\Windows\System\VIjySOg.exe
  2⤵
  PID:8812
- C:\Windows\System\XaKySFg.exe
  C:\Windows\System\XaKySFg.exe
  2⤵
  PID:8888
- C:\Windows\System\dsRmJnB.exe
  C:\Windows\System\dsRmJnB.exe
  2⤵
  PID:8956
- C:\Windows\System\ftGHdtx.exe
  C:\Windows\System\ftGHdtx.exe
  2⤵
  PID:8944
- C:\Windows\System\wzgzjtP.exe
  C:\Windows\System\wzgzjtP.exe
  2⤵
  PID:9088
- C:\Windows\System\EhyNzZl.exe
  C:\Windows\System\EhyNzZl.exe
  2⤵
  PID:9056
- C:\Windows\System\sAnFtgY.exe
  C:\Windows\System\sAnFtgY.exe
  2⤵
  PID:8168
- C:\Windows\System\vZvOPTy.exe
  C:\Windows\System\vZvOPTy.exe
  2⤵
  PID:8256
- C:\Windows\System\YTBOsbM.exe
  C:\Windows\System\YTBOsbM.exe
  2⤵
  PID:9192
- C:\Windows\System\PYXOAYt.exe
  C:\Windows\System\PYXOAYt.exe
  2⤵
  PID:8212
- C:\Windows\System\RIhxVgi.exe
  C:\Windows\System\RIhxVgi.exe
  2⤵
  PID:2028
- C:\Windows\System\ngYHTDW.exe
  C:\Windows\System\ngYHTDW.exe
  2⤵
  PID:8352
- C:\Windows\System\NsTDuhb.exe
  C:\Windows\System\NsTDuhb.exe
  2⤵
  PID:8880
- C:\Windows\System\hsNsAEn.exe
  C:\Windows\System\hsNsAEn.exe
  2⤵
  PID:9232
- C:\Windows\System\yDHpSKd.exe
  C:\Windows\System\yDHpSKd.exe
  2⤵
  PID:9248
- C:\Windows\System\rlwFVgq.exe
  C:\Windows\System\rlwFVgq.exe
  2⤵
  PID:9272
- C:\Windows\System\ujdDZEx.exe
  C:\Windows\System\ujdDZEx.exe
  2⤵
  PID:9288
- C:\Windows\System\FKldrMO.exe
  C:\Windows\System\FKldrMO.exe
  2⤵
  PID:9308
- C:\Windows\System\UslVCLp.exe
  C:\Windows\System\UslVCLp.exe
  2⤵
  PID:9336
- C:\Windows\System\WkXmURK.exe
  C:\Windows\System\WkXmURK.exe
  2⤵
  PID:9352
- C:\Windows\System\tQRzSIC.exe
  C:\Windows\System\tQRzSIC.exe
  2⤵
  PID:9376
- C:\Windows\System\ufzyOXO.exe
  C:\Windows\System\ufzyOXO.exe
  2⤵
  PID:9772
- C:\Windows\System\HguBcwk.exe
  C:\Windows\System\HguBcwk.exe
  2⤵
  PID:9796
- C:\Windows\System\WYoLWaW.exe
  C:\Windows\System\WYoLWaW.exe
  2⤵
  PID:9812
- C:\Windows\System\mCbUxRM.exe
  C:\Windows\System\mCbUxRM.exe
  2⤵
  PID:9832
- C:\Windows\System\etIMtaQ.exe
  C:\Windows\System\etIMtaQ.exe
  2⤵
  PID:9852
- C:\Windows\System\rzjjDxO.exe
  C:\Windows\System\rzjjDxO.exe
  2⤵
  PID:9876
- C:\Windows\System\bUdZxHd.exe
  C:\Windows\System\bUdZxHd.exe
  2⤵
  PID:9896
- C:\Windows\System\FCSelzX.exe
  C:\Windows\System\FCSelzX.exe
  2⤵
  PID:9916
- C:\Windows\System\FOfcpCF.exe
  C:\Windows\System\FOfcpCF.exe
  2⤵
  PID:9932
- C:\Windows\System\NiKBTsv.exe
  C:\Windows\System\NiKBTsv.exe
  2⤵
  PID:9948
- C:\Windows\System\ZyEQNGC.exe
  C:\Windows\System\ZyEQNGC.exe
  2⤵
  PID:9968
- C:\Windows\System\gwzhWfC.exe
  C:\Windows\System\gwzhWfC.exe
  2⤵
  PID:9988
- C:\Windows\System\tHoaett.exe
  C:\Windows\System\tHoaett.exe
  2⤵
  PID:10024
- C:\Windows\System\yYhVxXJ.exe
  C:\Windows\System\yYhVxXJ.exe
  2⤵
  PID:10040
- C:\Windows\System\ZUMLqsI.exe
  C:\Windows\System\ZUMLqsI.exe
  2⤵
  PID:10056
- C:\Windows\System\GWBcVfY.exe
  C:\Windows\System\GWBcVfY.exe
  2⤵
  PID:10076
- C:\Windows\System\pYbsYJu.exe
  C:\Windows\System\pYbsYJu.exe
  2⤵
  PID:10096
- C:\Windows\System\ifinPhD.exe
  C:\Windows\System\ifinPhD.exe
  2⤵
  PID:10124
- C:\Windows\System\gZfjKCA.exe
  C:\Windows\System\gZfjKCA.exe
  2⤵
  PID:10144
- C:\Windows\System\BGqWsGe.exe
  C:\Windows\System\BGqWsGe.exe
  2⤵
  PID:10160
- C:\Windows\System\uiibrto.exe
  C:\Windows\System\uiibrto.exe
  2⤵
  PID:10180
- C:\Windows\System\PyKTRup.exe
  C:\Windows\System\PyKTRup.exe
  2⤵
  PID:10200
- C:\Windows\System\PlUxUIo.exe
  C:\Windows\System\PlUxUIo.exe
  2⤵
  PID:10224
- C:\Windows\System\vsurYOi.exe
  C:\Windows\System\vsurYOi.exe
  2⤵
  PID:8548
- C:\Windows\System\OHLEAPH.exe
  C:\Windows\System\OHLEAPH.exe
  2⤵
  PID:8392
- C:\Windows\System\SOgKska.exe
  C:\Windows\System\SOgKska.exe
  2⤵
  PID:8284
- C:\Windows\System\HExlnFn.exe
  C:\Windows\System\HExlnFn.exe
  2⤵
  PID:8564
- C:\Windows\System\RbROGkp.exe
  C:\Windows\System\RbROGkp.exe
  2⤵
  PID:9208
- C:\Windows\System\dOJrmmJ.exe
  C:\Windows\System\dOJrmmJ.exe
  2⤵
  PID:8584
- C:\Windows\System\aJgEkCk.exe
  C:\Windows\System\aJgEkCk.exe
  2⤵
  PID:8948
- C:\Windows\System\mjeBjMh.exe
  C:\Windows\System\mjeBjMh.exe
  2⤵
  PID:9256
- C:\Windows\System\ncCMLwV.exe
  C:\Windows\System\ncCMLwV.exe
  2⤵
  PID:9348
- C:\Windows\System\mzQfnla.exe
  C:\Windows\System\mzQfnla.exe
  2⤵
  PID:7840
- C:\Windows\System\BplzSsu.exe
  C:\Windows\System\BplzSsu.exe
  2⤵
  PID:8476
- C:\Windows\System\ZNTKIqL.exe
  C:\Windows\System\ZNTKIqL.exe
  2⤵
  PID:9436
- C:\Windows\System\RhWAeAs.exe
  C:\Windows\System\RhWAeAs.exe
  2⤵
  PID:9460
- C:\Windows\System\ZlQPtpm.exe
  C:\Windows\System\ZlQPtpm.exe
  2⤵
  PID:9372
- C:\Windows\System\LmcYvQc.exe
  C:\Windows\System\LmcYvQc.exe
  2⤵
  PID:9576
- C:\Windows\System\VkUECuU.exe
  C:\Windows\System\VkUECuU.exe
  2⤵
  PID:9612
- C:\Windows\System\AmZkGwV.exe
  C:\Windows\System\AmZkGwV.exe
  2⤵
  PID:9652
- C:\Windows\System\fvJYsff.exe
  C:\Windows\System\fvJYsff.exe
  2⤵
  PID:9684
- C:\Windows\System\DuuNUPO.exe
  C:\Windows\System\DuuNUPO.exe
  2⤵
  PID:7660
- C:\Windows\System\IKfrDsM.exe
  C:\Windows\System\IKfrDsM.exe
  2⤵
  PID:4016
- C:\Windows\System\oOoMWMz.exe
  C:\Windows\System\oOoMWMz.exe
  2⤵
  PID:9784
- C:\Windows\System\SvpVDVA.exe
  C:\Windows\System\SvpVDVA.exe
  2⤵
  PID:9840
- C:\Windows\System\vGqnfnW.exe
  C:\Windows\System\vGqnfnW.exe
  2⤵
  PID:9912
- C:\Windows\System\zoBBBox.exe
  C:\Windows\System\zoBBBox.exe
  2⤵
  PID:9984
- C:\Windows\System\vxWilit.exe
  C:\Windows\System\vxWilit.exe
  2⤵
  PID:8628
- C:\Windows\System\WRUzzHR.exe
  C:\Windows\System\WRUzzHR.exe
  2⤵
  PID:10208
- C:\Windows\System\WrLOUwm.exe
  C:\Windows\System\WrLOUwm.exe
  2⤵
  PID:8860
- C:\Windows\System\GbCxAgA.exe
  C:\Windows\System\GbCxAgA.exe
  2⤵
  PID:10168
- C:\Windows\System\DjhrmTR.exe
  C:\Windows\System\DjhrmTR.exe
  2⤵
  PID:8172
- C:\Windows\System\buViTpo.exe
  C:\Windows\System\buViTpo.exe
  2⤵
  PID:8828
- C:\Windows\System\MKqWMtv.exe
  C:\Windows\System\MKqWMtv.exe
  2⤵
  PID:3104
- C:\Windows\System\EoGuxPN.exe
  C:\Windows\System\EoGuxPN.exe
  2⤵
  PID:10260
- C:\Windows\System\gpmAloZ.exe
  C:\Windows\System\gpmAloZ.exe
  2⤵
  PID:10284
- C:\Windows\System\kyXIxio.exe
  C:\Windows\System\kyXIxio.exe
  2⤵
  PID:10312
- C:\Windows\System\mWyJAvW.exe
  C:\Windows\System\mWyJAvW.exe
  2⤵
  PID:10332
- C:\Windows\System\GrznDtr.exe
  C:\Windows\System\GrznDtr.exe
  2⤵
  PID:10352
- C:\Windows\System\aPFuVAs.exe
  C:\Windows\System\aPFuVAs.exe
  2⤵
  PID:10372
- C:\Windows\System\uqChkiX.exe
  C:\Windows\System\uqChkiX.exe
  2⤵
  PID:10396
- C:\Windows\System\OXKaiip.exe
  C:\Windows\System\OXKaiip.exe
  2⤵
  PID:10420
- C:\Windows\System\nUIALxV.exe
  C:\Windows\System\nUIALxV.exe
  2⤵
  PID:10440
- C:\Windows\System\LTnXqiz.exe
  C:\Windows\System\LTnXqiz.exe
  2⤵
  PID:10460
- C:\Windows\System\vjkjTbb.exe
  C:\Windows\System\vjkjTbb.exe
  2⤵
  PID:10480
- C:\Windows\System\muayCFJ.exe
  C:\Windows\System\muayCFJ.exe
  2⤵
  PID:10500
- C:\Windows\System\iJAruig.exe
  C:\Windows\System\iJAruig.exe
  2⤵
  PID:10528
- C:\Windows\System\IQOLdIT.exe
  C:\Windows\System\IQOLdIT.exe
  2⤵
  PID:10552
- C:\Windows\System\wwYJwML.exe
  C:\Windows\System\wwYJwML.exe
  2⤵
  PID:10572
- C:\Windows\System\wFLLLDD.exe
  C:\Windows\System\wFLLLDD.exe
  2⤵
  PID:10592
- C:\Windows\System\uGWJUoI.exe
  C:\Windows\System\uGWJUoI.exe
  2⤵
  PID:10612
- C:\Windows\System\dpKRvFA.exe
  C:\Windows\System\dpKRvFA.exe
  2⤵
  PID:10640
- C:\Windows\System\ijTSuHF.exe
  C:\Windows\System\ijTSuHF.exe
  2⤵
  PID:10660
- C:\Windows\System\fEVbqIW.exe
  C:\Windows\System\fEVbqIW.exe
  2⤵
  PID:10680
- C:\Windows\System\ebZdXTX.exe
  C:\Windows\System\ebZdXTX.exe
  2⤵
  PID:10772
- C:\Windows\System\tQneZTg.exe
  C:\Windows\System\tQneZTg.exe
  2⤵
  PID:10792
- C:\Windows\System\yLpxWUt.exe
  C:\Windows\System\yLpxWUt.exe
  2⤵
  PID:10816
- C:\Windows\System\hroJUCV.exe
  C:\Windows\System\hroJUCV.exe
  2⤵
  PID:10836
- C:\Windows\System\xrvmTwJ.exe
  C:\Windows\System\xrvmTwJ.exe
  2⤵
  PID:10924
- C:\Windows\System\yYtDZNY.exe
  C:\Windows\System\yYtDZNY.exe
  2⤵
  PID:10956
- C:\Windows\System\zWwKsov.exe
  C:\Windows\System\zWwKsov.exe
  2⤵
  PID:10980
- C:\Windows\System\PrhdRRF.exe
  C:\Windows\System\PrhdRRF.exe
  2⤵
  PID:11056
- C:\Windows\System\GuhbjTO.exe
  C:\Windows\System\GuhbjTO.exe
  2⤵
  PID:9820
- C:\Windows\System\IJWxXGt.exe
  C:\Windows\System\IJWxXGt.exe
  2⤵
  PID:10324
- C:\Windows\System\eQhmvTl.exe
  C:\Windows\System\eQhmvTl.exe
  2⤵
  PID:9996
- C:\Windows\System\cvDxsim.exe
  C:\Windows\System\cvDxsim.exe
  2⤵
  PID:9280
- C:\Windows\System\aHhkGjp.exe
  C:\Windows\System\aHhkGjp.exe
  2⤵
  PID:9004
- C:\Windows\System\FTxqIlR.exe
  C:\Windows\System\FTxqIlR.exe
  2⤵
  PID:3376
- C:\Windows\System\FOCHMmq.exe
  C:\Windows\System\FOCHMmq.exe
  2⤵
  PID:10432
- C:\Windows\System\yNEbiCc.exe
  C:\Windows\System\yNEbiCc.exe
  2⤵
  PID:10456
- C:\Windows\System\frhDGIu.exe
  C:\Windows\System\frhDGIu.exe
  2⤵
  PID:10276
- C:\Windows\System\HxkwmXh.exe
  C:\Windows\System\HxkwmXh.exe
  2⤵
  PID:10300
- C:\Windows\System\obMnqru.exe
  C:\Windows\System\obMnqru.exe
  2⤵
  PID:10368
- C:\Windows\System\ZqrZFiG.exe
  C:\Windows\System\ZqrZFiG.exe
  2⤵
  PID:10848
- C:\Windows\System\vnPpIle.exe
  C:\Windows\System\vnPpIle.exe
  2⤵
  PID:10604
- C:\Windows\System\fkdzMkU.exe
  C:\Windows\System\fkdzMkU.exe
  2⤵
  PID:10668
- C:\Windows\System\KiQZIVx.exe
  C:\Windows\System\KiQZIVx.exe
  2⤵
  PID:10704
- C:\Windows\System\qaEjHsO.exe
  C:\Windows\System\qaEjHsO.exe
  2⤵
  PID:10788
- C:\Windows\System\gMOscmt.exe
  C:\Windows\System\gMOscmt.exe
  2⤵
  PID:10828
- C:\Windows\System\HcytKYE.exe
  C:\Windows\System\HcytKYE.exe
  2⤵
  PID:10900
- C:\Windows\System\CLUytLT.exe
  C:\Windows\System\CLUytLT.exe
  2⤵
  PID:10976
- C:\Windows\System\jAExvJb.exe
  C:\Windows\System\jAExvJb.exe
  2⤵
  PID:11092
- C:\Windows\System\yPvxEmX.exe
  C:\Windows\System\yPvxEmX.exe
  2⤵
  PID:11220
- C:\Windows\System\vvYIxmn.exe
  C:\Windows\System\vvYIxmn.exe
  2⤵
  PID:11076
- C:\Windows\System\NWuCQSC.exe
  C:\Windows\System\NWuCQSC.exe
  2⤵
  PID:11100
- C:\Windows\System\ygKhBwy.exe
  C:\Windows\System\ygKhBwy.exe
  2⤵
  PID:11248
- C:\Windows\System\aZhTrHo.exe
  C:\Windows\System\aZhTrHo.exe
  2⤵
  PID:9788
- C:\Windows\System\rAvRoft.exe
  C:\Windows\System\rAvRoft.exe
  2⤵
  PID:9264
- C:\Windows\System\pNskquw.exe
  C:\Windows\System\pNskquw.exe
  2⤵
  PID:10428
- C:\Windows\System\kCbmJAc.exe
  C:\Windows\System\kCbmJAc.exe
  2⤵
  PID:9284
- C:\Windows\System\PHejbAg.exe
  C:\Windows\System\PHejbAg.exe
  2⤵
  PID:10052
- C:\Windows\System\jkXYzWY.exe
  C:\Windows\System\jkXYzWY.exe
  2⤵
  PID:10196
- C:\Windows\System\HShXbqb.exe
  C:\Windows\System\HShXbqb.exe
  2⤵
  PID:10656
- C:\Windows\System\URogxuX.exe
  C:\Windows\System\URogxuX.exe
  2⤵
  PID:10348
- C:\Windows\System\Tiwygwr.exe
  C:\Windows\System\Tiwygwr.exe
  2⤵
  PID:10896
- C:\Windows\System\rKKASYt.exe
  C:\Windows\System\rKKASYt.exe
  2⤵
  PID:11280
- C:\Windows\System\vUgvQjT.exe
  C:\Windows\System\vUgvQjT.exe
  2⤵
  PID:11300
- C:\Windows\System\VJLlLiY.exe
  C:\Windows\System\VJLlLiY.exe
  2⤵
  PID:11320
- C:\Windows\System\pLuWCwm.exe
  C:\Windows\System\pLuWCwm.exe
  2⤵
  PID:11340
- C:\Windows\System\ZLLktvc.exe
  C:\Windows\System\ZLLktvc.exe
  2⤵
  PID:11364
- C:\Windows\System\pCVirzt.exe
  C:\Windows\System\pCVirzt.exe
  2⤵
  PID:11384
- C:\Windows\System\pMHVTtJ.exe
  C:\Windows\System\pMHVTtJ.exe
  2⤵
  PID:11408
- C:\Windows\System\HGhwxSx.exe
  C:\Windows\System\HGhwxSx.exe
  2⤵
  PID:11424
- C:\Windows\System\XSKZcGj.exe
  C:\Windows\System\XSKZcGj.exe
  2⤵
  PID:11444
- C:\Windows\System\TastQiY.exe
  C:\Windows\System\TastQiY.exe
  2⤵
  PID:11464
- C:\Windows\System\uoTmacd.exe
  C:\Windows\System\uoTmacd.exe
  2⤵
  PID:11484
- C:\Windows\System\UvBiVrE.exe
  C:\Windows\System\UvBiVrE.exe
  2⤵
  PID:11500
- C:\Windows\System\jUgRmgo.exe
  C:\Windows\System\jUgRmgo.exe
  2⤵
  PID:11520
- C:\Windows\System\SxPPQOu.exe
  C:\Windows\System\SxPPQOu.exe
  2⤵
  PID:11540
- C:\Windows\System\gMgLxLJ.exe
  C:\Windows\System\gMgLxLJ.exe
  2⤵
  PID:11556
- C:\Windows\System\XDmKZFK.exe
  C:\Windows\System\XDmKZFK.exe
  2⤵
  PID:11572
- C:\Windows\System\rnnuukV.exe
  C:\Windows\System\rnnuukV.exe
  2⤵
  PID:11588
- C:\Windows\System\FXsmRPl.exe
  C:\Windows\System\FXsmRPl.exe
  2⤵
  PID:11604
- C:\Windows\System\sBvdbQa.exe
  C:\Windows\System\sBvdbQa.exe
  2⤵
  PID:11624
- C:\Windows\System\xnEqtUD.exe
  C:\Windows\System\xnEqtUD.exe
  2⤵
  PID:11656
- C:\Windows\System\bVguyfa.exe
  C:\Windows\System\bVguyfa.exe
  2⤵
  PID:11672
- C:\Windows\System\ACuXAEH.exe
  C:\Windows\System\ACuXAEH.exe
  2⤵
  PID:11692
- C:\Windows\System\uBJpvGH.exe
  C:\Windows\System\uBJpvGH.exe
  2⤵
  PID:11712
- C:\Windows\System\MakRlPe.exe
  C:\Windows\System\MakRlPe.exe
  2⤵
  PID:11732
- C:\Windows\System\dcIBCxy.exe
  C:\Windows\System\dcIBCxy.exe
  2⤵
  PID:11752
- C:\Windows\System\LunZAUF.exe
  C:\Windows\System\LunZAUF.exe
  2⤵
  PID:11776
- C:\Windows\System\LbjsIQW.exe
  C:\Windows\System\LbjsIQW.exe
  2⤵
  PID:11872
- C:\Windows\System\pmAjKVx.exe
  C:\Windows\System\pmAjKVx.exe
  2⤵
  PID:11892
- C:\Windows\System\YJYchvm.exe
  C:\Windows\System\YJYchvm.exe
  2⤵
  PID:11916
- C:\Windows\System\KeVcION.exe
  C:\Windows\System\KeVcION.exe
  2⤵
  PID:11940
- C:\Windows\System\jzpcpWa.exe
  C:\Windows\System\jzpcpWa.exe
  2⤵
  PID:11960
- C:\Windows\System\OIuGAfK.exe
  C:\Windows\System\OIuGAfK.exe
  2⤵
  PID:11980
- C:\Windows\System\UoAYVMD.exe
  C:\Windows\System\UoAYVMD.exe
  2⤵
  PID:12000
- C:\Windows\System\WOlZOxx.exe
  C:\Windows\System\WOlZOxx.exe
  2⤵
  PID:12024
- C:\Windows\System\QBTlzjV.exe
  C:\Windows\System\QBTlzjV.exe
  2⤵
  PID:12044
- C:\Windows\System\RPTBFLm.exe
  C:\Windows\System\RPTBFLm.exe
  2⤵
  PID:12064
- C:\Windows\System\NEirHnx.exe
  C:\Windows\System\NEirHnx.exe
  2⤵
  PID:12088
- C:\Windows\System\zmdgwti.exe
  C:\Windows\System\zmdgwti.exe
  2⤵
  PID:12112
- C:\Windows\System\pHJBfxu.exe
  C:\Windows\System\pHJBfxu.exe
  2⤵
  PID:12132
- C:\Windows\System\dPpPiKr.exe
  C:\Windows\System\dPpPiKr.exe
  2⤵
  PID:12152
- C:\Windows\System\SeHrXgL.exe
  C:\Windows\System\SeHrXgL.exe
  2⤵
  PID:12172
- C:\Windows\System\TNFzNeq.exe
  C:\Windows\System\TNFzNeq.exe
  2⤵
  PID:12192
- C:\Windows\System\yDhcHqN.exe
  C:\Windows\System\yDhcHqN.exe
  2⤵
  PID:12212
- C:\Windows\System\UWphaIC.exe
  C:\Windows\System\UWphaIC.exe
  2⤵
  PID:11336
- C:\Windows\System\QmUNCwQ.exe
  C:\Windows\System\QmUNCwQ.exe
  2⤵
  PID:11064
- C:\Windows\System\cTYKNIw.exe
  C:\Windows\System\cTYKNIw.exe
  2⤵
  PID:11096
- C:\Windows\System\GhAJRVe.exe
  C:\Windows\System\GhAJRVe.exe
  2⤵
  PID:11472
- C:\Windows\System\wlMcTtX.exe
  C:\Windows\System\wlMcTtX.exe
  2⤵
  PID:10388
- C:\Windows\System\SGwWNJU.exe
  C:\Windows\System\SGwWNJU.exe
  2⤵
  PID:11528
- C:\Windows\System\XGllnzj.exe
  C:\Windows\System\XGllnzj.exe
  2⤵
  PID:11564
- C:\Windows\System\uiYdjrm.exe
  C:\Windows\System\uiYdjrm.exe
  2⤵
  PID:11652
- C:\Windows\System\DdDOshM.exe
  C:\Windows\System\DdDOshM.exe
  2⤵
  PID:3532
- C:\Windows\System\waWXnUW.exe
  C:\Windows\System\waWXnUW.exe
  2⤵
  PID:11812
- C:\Windows\System\EynicRL.exe
  C:\Windows\System\EynicRL.exe
  2⤵
  PID:10888
- C:\Windows\System\pZOCzbx.exe
  C:\Windows\System\pZOCzbx.exe
  2⤵
  PID:10496
- C:\Windows\System\VMCeHxt.exe
  C:\Windows\System\VMCeHxt.exe
  2⤵
  PID:11700
- C:\Windows\System\ttPsYQO.exe
  C:\Windows\System\ttPsYQO.exe
  2⤵
  PID:11360
- C:\Windows\System\sOVzTVT.exe
  C:\Windows\System\sOVzTVT.exe
  2⤵
  PID:11800
- C:\Windows\System\vfzgqUP.exe
  C:\Windows\System\vfzgqUP.exe
  2⤵
  PID:11952
- C:\Windows\System\LJDarrW.exe
  C:\Windows\System\LJDarrW.exe
  2⤵
  PID:12148
- C:\Windows\System\GdPsASB.exe
  C:\Windows\System\GdPsASB.exe
  2⤵
  PID:11828
- C:\Windows\System\hFBSsEl.exe
  C:\Windows\System\hFBSsEl.exe
  2⤵
  PID:11664
- C:\Windows\System\rWCLYmA.exe
  C:\Windows\System\rWCLYmA.exe
  2⤵
  PID:12284
- C:\Windows\System\mbIadRL.exe
  C:\Windows\System\mbIadRL.exe
  2⤵
  PID:12292
- C:\Windows\System\OxlisyZ.exe
  C:\Windows\System\OxlisyZ.exe
  2⤵
  PID:12336
- C:\Windows\System\IRwhwyB.exe
  C:\Windows\System\IRwhwyB.exe
  2⤵
  PID:12360
- C:\Windows\System\HSrGKqD.exe
  C:\Windows\System\HSrGKqD.exe
  2⤵
  PID:12384
- C:\Windows\System\OhiTIbL.exe
  C:\Windows\System\OhiTIbL.exe
  2⤵
  PID:12744
- C:\Windows\System\duQjEtg.exe
  C:\Windows\System\duQjEtg.exe
  2⤵
  PID:12768
- C:\Windows\System\MnlPdLT.exe
  C:\Windows\System\MnlPdLT.exe
  2⤵
  PID:12988
- C:\Windows\System\pKsFtqY.exe
  C:\Windows\System\pKsFtqY.exe
  2⤵
  PID:13124
- C:\Windows\System\yHiXrGB.exe
  C:\Windows\System\yHiXrGB.exe
  2⤵
  PID:13144
- C:\Windows\System\chkQlpV.exe
  C:\Windows\System\chkQlpV.exe
  2⤵
  PID:13168
- C:\Windows\System\IFXKakA.exe
  C:\Windows\System\IFXKakA.exe
  2⤵
  PID:13192
- C:\Windows\System\EDfBlGj.exe
  C:\Windows\System\EDfBlGj.exe
  2⤵
  PID:13220
- C:\Windows\System\ZzsBkLC.exe
  C:\Windows\System\ZzsBkLC.exe
  2⤵
  PID:13240
- C:\Windows\System\JLwSSWP.exe
  C:\Windows\System\JLwSSWP.exe
  2⤵
  PID:12080
- C:\Windows\System\rsmFKhW.exe
  C:\Windows\System\rsmFKhW.exe
  2⤵
  PID:12228
- C:\Windows\System\rOWJjfd.exe
  C:\Windows\System\rOWJjfd.exe
  2⤵
  PID:12240
- C:\Windows\System\HeUclUd.exe
  C:\Windows\System\HeUclUd.exe
  2⤵
  PID:11704
- C:\Windows\System\FBBqKKW.exe
  C:\Windows\System\FBBqKKW.exe
  2⤵
  PID:11640
- C:\Windows\System\ulCkYUf.exe
  C:\Windows\System\ulCkYUf.exe
  2⤵
  PID:11884
- C:\Windows\System\JbWbbhi.exe
  C:\Windows\System\JbWbbhi.exe
  2⤵
  PID:11976
- C:\Windows\System\ErOoAJY.exe
  C:\Windows\System\ErOoAJY.exe
  2⤵
  PID:12036
- C:\Windows\System\DHmqNce.exe
  C:\Windows\System\DHmqNce.exe
  2⤵
  PID:12168
- C:\Windows\System\JrFuWIq.exe
  C:\Windows\System\JrFuWIq.exe
  2⤵
  PID:5020
- C:\Windows\System\xuqUPSo.exe
  C:\Windows\System\xuqUPSo.exe
  2⤵
  PID:12452
- C:\Windows\System\hXrnrMa.exe
  C:\Windows\System\hXrnrMa.exe
  2⤵
  PID:12056
- C:\Windows\System\ureTWMH.exe
  C:\Windows\System\ureTWMH.exe
  2⤵
  PID:11648
- C:\Windows\System\stTBISH.exe
  C:\Windows\System\stTBISH.exe
  2⤵
  PID:10472
- C:\Windows\System\rZUZcKM.exe
  C:\Windows\System\rZUZcKM.exe
  2⤵
  PID:4576
- C:\Windows\System\VYaEzwN.exe
  C:\Windows\System\VYaEzwN.exe
  2⤵
  PID:12396
- C:\Windows\System\viushhx.exe
  C:\Windows\System\viushhx.exe
  2⤵
  PID:11620
- C:\Windows\System\gUYsNIM.exe
  C:\Windows\System\gUYsNIM.exe
  2⤵
  PID:2060
- C:\Windows\System\cTtLnYK.exe
  C:\Windows\System\cTtLnYK.exe
  2⤵
  PID:11276
- C:\Windows\System\cgDjILL.exe
  C:\Windows\System\cgDjILL.exe
  2⤵
  PID:868
- C:\Windows\System\HbIAkbI.exe
  C:\Windows\System\HbIAkbI.exe
  2⤵
  PID:12256
- C:\Windows\System\LDSNXml.exe
  C:\Windows\System\LDSNXml.exe
  2⤵
  PID:12328
- C:\Windows\System\WdnUujg.exe
  C:\Windows\System\WdnUujg.exe
  2⤵
  PID:11420
- C:\Windows\System\UIzGvQy.exe
  C:\Windows\System\UIzGvQy.exe
  2⤵
  PID:12460
- C:\Windows\System\oymnHxW.exe
  C:\Windows\System\oymnHxW.exe
  2⤵
  PID:4752
- C:\Windows\System\UVElUPv.exe
  C:\Windows\System\UVElUPv.exe
  2⤵
  PID:12668
- C:\Windows\System\ZZUQGae.exe
  C:\Windows\System\ZZUQGae.exe
  2⤵
  PID:12868
- C:\Windows\System\BxzWTUt.exe
  C:\Windows\System\BxzWTUt.exe
  2⤵
  PID:11332
- C:\Windows\System\ZXEbHmB.exe
  C:\Windows\System\ZXEbHmB.exe
  2⤵
  PID:11548
- C:\Windows\System\WGnNGKx.exe
  C:\Windows\System\WGnNGKx.exe
  2⤵
  PID:12552
- C:\Windows\System\FbrCRmK.exe
  C:\Windows\System\FbrCRmK.exe
  2⤵
  PID:12812
- C:\Windows\System\JdEmfIy.exe
  C:\Windows\System\JdEmfIy.exe
  2⤵
  PID:12832
- C:\Windows\System\XRyikvF.exe
  C:\Windows\System\XRyikvF.exe
  2⤵
  PID:12680
- C:\Windows\System\ohCiuKU.exe
  C:\Windows\System\ohCiuKU.exe
  2⤵
  PID:1460
- C:\Windows\System\DptHisJ.exe
  C:\Windows\System\DptHisJ.exe
  2⤵
  PID:13120
- C:\Windows\System\XPtnzkL.exe
  C:\Windows\System\XPtnzkL.exe
  2⤵
  PID:3008
- C:\Windows\System\drywOwS.exe
  C:\Windows\System\drywOwS.exe
  2⤵
  PID:12840
- C:\Windows\System\dQvKLRy.exe
  C:\Windows\System\dQvKLRy.exe
  2⤵
  PID:5056
- C:\Windows\System\ivOrTEX.exe
  C:\Windows\System\ivOrTEX.exe
  2⤵
  PID:12896
- C:\Windows\System\IoFUOpx.exe
  C:\Windows\System\IoFUOpx.exe
  2⤵
  PID:12932
- C:\Windows\System\jLEFWFe.exe
  C:\Windows\System\jLEFWFe.exe
  2⤵
  PID:12208
- C:\Windows\System\mPrxMXQ.exe
  C:\Windows\System\mPrxMXQ.exe
  2⤵
  PID:12612
- C:\Windows\System\cBAbbTk.exe
  C:\Windows\System\cBAbbTk.exe
  2⤵
  PID:2076
- C:\Windows\System\TGDvzHs.exe
  C:\Windows\System\TGDvzHs.exe
  2⤵
  PID:12268
- C:\Windows\System\UKHXmev.exe
  C:\Windows\System\UKHXmev.exe
  2⤵
  PID:12864
- C:\Windows\System\DTrkquV.exe
  C:\Windows\System\DTrkquV.exe
  2⤵
  PID:12380
- C:\Windows\System\HSugcLY.exe
  C:\Windows\System\HSugcLY.exe
  2⤵
  PID:11764
- C:\Windows\System\HXlhCWX.exe
  C:\Windows\System\HXlhCWX.exe
  2⤵
  PID:2248
- C:\Windows\System\fAnDzBO.exe
  C:\Windows\System\fAnDzBO.exe
  2⤵
  PID:10252
- C:\Windows\System\ahAPUNV.exe
  C:\Windows\System\ahAPUNV.exe
  2⤵
  PID:12828
- C:\Windows\System\aAqaegr.exe
  C:\Windows\System\aAqaegr.exe
  2⤵
  PID:444
- C:\Windows\System\LiURyAQ.exe
  C:\Windows\System\LiURyAQ.exe
  2⤵
  PID:4280
- C:\Windows\System\yjloUbr.exe
  C:\Windows\System\yjloUbr.exe
  2⤵
  PID:13316
- C:\Windows\System\wCVrysJ.exe
  C:\Windows\System\wCVrysJ.exe
  2⤵
  PID:13344
- C:\Windows\System\UpCCNub.exe
  C:\Windows\System\UpCCNub.exe
  2⤵
  PID:13364
- C:\Windows\System\nnYIlXG.exe
  C:\Windows\System\nnYIlXG.exe
  2⤵
  PID:13428
- C:\Windows\System\uLUkMTh.exe
  C:\Windows\System\uLUkMTh.exe
  2⤵
  PID:13444
- C:\Windows\System\FqBCHwD.exe
  C:\Windows\System\FqBCHwD.exe
  2⤵
  PID:13460
- C:\Windows\System\nmaHDWH.exe
  C:\Windows\System\nmaHDWH.exe
  2⤵
  PID:13568
- C:\Windows\System\hiCRzqQ.exe
  C:\Windows\System\hiCRzqQ.exe
  2⤵
  PID:13708
- C:\Windows\System\tfAqWrZ.exe
  C:\Windows\System\tfAqWrZ.exe
  2⤵
  PID:13868
- C:\Windows\System\uKOjmjh.exe
  C:\Windows\System\uKOjmjh.exe
  2⤵
  PID:14192
- C:\Windows\System\sHrWxtY.exe
  C:\Windows\System\sHrWxtY.exe
  2⤵
  PID:14220
- C:\Windows\System\DxQwMSK.exe
  C:\Windows\System\DxQwMSK.exe
  2⤵
  PID:14252
- C:\Windows\System\EvgSsfS.exe
  C:\Windows\System\EvgSsfS.exe
  2⤵
  PID:14268
- C:\Windows\System\Wlyfqxm.exe
  C:\Windows\System\Wlyfqxm.exe
  2⤵
  PID:14292
- C:\Windows\System\JdVuMaQ.exe
  C:\Windows\System\JdVuMaQ.exe
  2⤵
  PID:14316
- C:\Windows\System\qMTPDlX.exe
  C:\Windows\System\qMTPDlX.exe
  2⤵
  PID:12376
- C:\Windows\System\wANBpaw.exe
  C:\Windows\System\wANBpaw.exe
  2⤵
  PID:12248
- C:\Windows\System\UyxawHG.exe
  C:\Windows\System\UyxawHG.exe
  2⤵
  PID:6408
- C:\Windows\System\fSnerzN.exe
  C:\Windows\System\fSnerzN.exe
  2⤵
  PID:13112
- C:\Windows\System\qPXCNnA.exe
  C:\Windows\System\qPXCNnA.exe
  2⤵
  PID:3956
- C:\Windows\System\PRojHjE.exe
  C:\Windows\System\PRojHjE.exe
  2⤵
  PID:13384
- C:\Windows\System\YhOisba.exe
  C:\Windows\System\YhOisba.exe
  2⤵
  PID:13472
- C:\Windows\System\qAzvEwN.exe
  C:\Windows\System\qAzvEwN.exe
  2⤵
  PID:12252
- C:\Windows\System\VHUVAvA.exe
  C:\Windows\System\VHUVAvA.exe
  2⤵
  PID:3428
- C:\Windows\System\gACqIUu.exe
  C:\Windows\System\gACqIUu.exe
  2⤵
  PID:13668
- C:\Windows\System\bzPlZsP.exe
  C:\Windows\System\bzPlZsP.exe
  2⤵
  PID:13684
- C:\Windows\System\ryiaQGo.exe
  C:\Windows\System\ryiaQGo.exe
  2⤵
  PID:13888
- C:\Windows\System\KJlVwfS.exe
  C:\Windows\System\KJlVwfS.exe
  2⤵
  PID:13732
- C:\Windows\System\OVYLTQQ.exe
  C:\Windows\System\OVYLTQQ.exe
  2⤵
  PID:13752
- C:\Windows\System\ZhzKCda.exe
  C:\Windows\System\ZhzKCda.exe
  2⤵
  PID:13772
- C:\Windows\System\TFgnQsJ.exe
  C:\Windows\System\TFgnQsJ.exe
  2⤵
  PID:13928
- C:\Windows\System\oMsFvGy.exe
  C:\Windows\System\oMsFvGy.exe
  2⤵
  PID:13948
- C:\Windows\System\MlkMedv.exe
  C:\Windows\System\MlkMedv.exe
  2⤵
  PID:13964
- C:\Windows\System\BDWWwnl.exe
  C:\Windows\System\BDWWwnl.exe
  2⤵
  PID:13824
- C:\Windows\System\JkvyCJK.exe
  C:\Windows\System\JkvyCJK.exe
  2⤵
  PID:4344
- C:\Windows\System\LYpUqYI.exe
  C:\Windows\System\LYpUqYI.exe
  2⤵
  PID:13400
- C:\Windows\System\sQpHptp.exe
  C:\Windows\System\sQpHptp.exe
  2⤵
  PID:14112
- C:\Windows\System\PTcYpDu.exe
  C:\Windows\System\PTcYpDu.exe
  2⤵
  PID:13876
- C:\Windows\System\esxxGDM.exe
  C:\Windows\System\esxxGDM.exe
  2⤵
  PID:3016
- C:\Windows\System\TypVyRW.exe
  C:\Windows\System\TypVyRW.exe
  2⤵
  PID:13908
- C:\Windows\System\utZOQfx.exe
  C:\Windows\System\utZOQfx.exe
  2⤵
  PID:4336
- C:\Windows\System\jiileqi.exe
  C:\Windows\System\jiileqi.exe
  2⤵
  PID:14132
- C:\Windows\System\rrSTyaz.exe
  C:\Windows\System\rrSTyaz.exe
  2⤵
  PID:14164
- C:\Windows\System\nTuFtcJ.exe
  C:\Windows\System\nTuFtcJ.exe
  2⤵
  PID:12980
- C:\Windows\System\uGHAFWV.exe
  C:\Windows\System\uGHAFWV.exe
  2⤵
  PID:14024
- C:\Windows\System\bGWtWyk.exe
  C:\Windows\System\bGWtWyk.exe
  2⤵
  PID:14068
- C:\Windows\System\VicDMpo.exe
  C:\Windows\System\VicDMpo.exe
  2⤵
  PID:14088
- C:\Windows\System\UkkJZaC.exe
  C:\Windows\System\UkkJZaC.exe
  2⤵
  PID:14140
- C:\Windows\System\vdzFUGo.exe
  C:\Windows\System\vdzFUGo.exe
  2⤵
  PID:4600
- C:\Windows\System\eByPHXO.exe
  C:\Windows\System\eByPHXO.exe
  2⤵
  PID:14184
- C:\Windows\System\ImezCXl.exe
  C:\Windows\System\ImezCXl.exe
  2⤵
  PID:14216
- C:\Windows\System\lLlMqLQ.exe
  C:\Windows\System\lLlMqLQ.exe
  2⤵
  PID:14280
- C:\Windows\System\urDwPpc.exe
  C:\Windows\System\urDwPpc.exe
  2⤵
  PID:13880
- C:\Windows\System\siDbAZj.exe
  C:\Windows\System\siDbAZj.exe
  2⤵
  PID:12740
- C:\Windows\System\DpIonYh.exe
  C:\Windows\System\DpIonYh.exe
  2⤵
  PID:3132
- C:\Windows\System\JwPtRhB.exe
  C:\Windows\System\JwPtRhB.exe
  2⤵
  PID:2012
- C:\Windows\System\YPsIBpl.exe
  C:\Windows\System\YPsIBpl.exe
  2⤵
  PID:2900
- C:\Windows\System\bDfIxWJ.exe
  C:\Windows\System\bDfIxWJ.exe
  2⤵
  PID:12660
- C:\Windows\System\YLjKzOP.exe
  C:\Windows\System\YLjKzOP.exe
  2⤵
  PID:3836
- C:\Windows\System\xRNhpEh.exe
  C:\Windows\System\xRNhpEh.exe
  2⤵
  PID:5084
- C:\Windows\System\SoFBjTn.exe
  C:\Windows\System\SoFBjTn.exe
  2⤵
  PID:13520
- C:\Windows\System\GlaSAlm.exe
  C:\Windows\System\GlaSAlm.exe
  2⤵
  PID:1856
- C:\Windows\System\uQYrgZg.exe
  C:\Windows\System\uQYrgZg.exe
  2⤵
  PID:1840
- C:\Windows\System\USDEdtC.exe
  C:\Windows\System\USDEdtC.exe
  2⤵
  PID:12096
- C:\Windows\System\ozVTDjl.exe
  C:\Windows\System\ozVTDjl.exe
  2⤵
  PID:6964
- C:\Windows\System\ZYYmefK.exe
  C:\Windows\System\ZYYmefK.exe
  2⤵
  PID:6888
- C:\Windows\System\ytFPPzk.exe
  C:\Windows\System\ytFPPzk.exe
  2⤵
  PID:7228
- C:\Windows\System\FhHNLoo.exe
  C:\Windows\System\FhHNLoo.exe
  2⤵
  PID:2516
- C:\Windows\System\FeUDlDx.exe
  C:\Windows\System\FeUDlDx.exe
  2⤵
  PID:2204
- C:\Windows\System\SYUexxh.exe
  C:\Windows\System\SYUexxh.exe
  2⤵
  PID:3612
- C:\Windows\System\QKAWZYH.exe
  C:\Windows\System\QKAWZYH.exe
  2⤵
  PID:7700
- C:\Windows\System\QodsRIz.exe
  C:\Windows\System\QodsRIz.exe
  2⤵
  PID:13944
- C:\Windows\System\GawUpKT.exe
  C:\Windows\System\GawUpKT.exe
  2⤵
  PID:14076
- C:\Windows\System\BALoVmj.exe
  C:\Windows\System\BALoVmj.exe
  2⤵
  PID:13452
- C:\Windows\System\DiYklRK.exe
  C:\Windows\System\DiYklRK.exe
  2⤵
  PID:13640
- C:\Windows\System\tQnTyJY.exe
  C:\Windows\System\tQnTyJY.exe
  2⤵
  PID:1808
- C:\Windows\System\VEyFcnh.exe
  C:\Windows\System\VEyFcnh.exe
  2⤵
  PID:4408
- C:\Windows\System\pntbmUH.exe
  C:\Windows\System\pntbmUH.exe
  2⤵
  PID:5508
- C:\Windows\System\rvmUIur.exe
  C:\Windows\System\rvmUIur.exe
  2⤵
  PID:5640
- C:\Windows\System\tALLRzj.exe
  C:\Windows\System\tALLRzj.exe
  2⤵
  PID:13956
- C:\Windows\System\dWTnPMi.exe
  C:\Windows\System\dWTnPMi.exe
  2⤵
  PID:13812
- C:\Windows\System\iHOTxhL.exe
  C:\Windows\System\iHOTxhL.exe
  2⤵
  PID:5264
- C:\Windows\System\LAMovoS.exe
  C:\Windows\System\LAMovoS.exe
  2⤵
  PID:4776
- C:\Windows\System\ugiXjZx.exe
  C:\Windows\System\ugiXjZx.exe
  2⤵
  PID:3560
- C:\Windows\System\HJgWakb.exe
  C:\Windows\System\HJgWakb.exe
  2⤵
  PID:5432
- C:\Windows\System\ApXAWRB.exe
  C:\Windows\System\ApXAWRB.exe
  2⤵
  PID:4564
- C:\Windows\System\LimtrwK.exe
  C:\Windows\System\LimtrwK.exe
  2⤵
  PID:5628
- C:\Windows\System\lTtRuBX.exe
  C:\Windows\System\lTtRuBX.exe
  2⤵
  PID:5616
- C:\Windows\System\NnzEZLX.exe
  C:\Windows\System\NnzEZLX.exe
  2⤵
  PID:5876
- C:\Windows\System\HPfOuRH.exe
  C:\Windows\System\HPfOuRH.exe
  2⤵
  PID:5140
- C:\Windows\System\VonLhyV.exe
  C:\Windows\System\VonLhyV.exe
  2⤵
  PID:13264
- C:\Windows\System\AnqEcUv.exe
  C:\Windows\System\AnqEcUv.exe
  2⤵
  PID:5196
- C:\Windows\System\ShLrEdd.exe
  C:\Windows\System\ShLrEdd.exe
  2⤵
  PID:4128
- C:\Windows\System\wDETFZo.exe
  C:\Windows\System\wDETFZo.exe
  2⤵
  PID:13792
- C:\Windows\System\NdMyOQg.exe
  C:\Windows\System\NdMyOQg.exe
  2⤵
  PID:6668
- C:\Windows\System\BTXXCDi.exe
  C:\Windows\System\BTXXCDi.exe
  2⤵
  PID:2728
- C:\Windows\System\OsDxANf.exe
  C:\Windows\System\OsDxANf.exe
  2⤵
  PID:3216
- C:\Windows\System\wwtHAYr.exe
  C:\Windows\System\wwtHAYr.exe
  2⤵
  PID:5960
- C:\Windows\System\BguewBR.exe
  C:\Windows\System\BguewBR.exe
  2⤵
  PID:6108
- C:\Windows\System\CbvjexE.exe
  C:\Windows\System\CbvjexE.exe
  2⤵
  PID:3960
- C:\Windows\System\oUdqpxh.exe
  C:\Windows\System\oUdqpxh.exe
  2⤵
  PID:7012
- C:\Windows\System\aXnzQrZ.exe
  C:\Windows\System\aXnzQrZ.exe
  2⤵
  PID:5784
- C:\Windows\System\Hyqnqnp.exe
  C:\Windows\System\Hyqnqnp.exe
  2⤵
  PID:6116
- C:\Windows\System\dDsQiOv.exe
  C:\Windows\System\dDsQiOv.exe
  2⤵
  PID:14180
- C:\Windows\System\MnfNBCz.exe
  C:\Windows\System\MnfNBCz.exe
  2⤵
  PID:14016
- C:\Windows\System\sNXjXvu.exe
  C:\Windows\System\sNXjXvu.exe
  2⤵
  PID:5108
- C:\Windows\System\GJbgptx.exe
  C:\Windows\System\GJbgptx.exe
  2⤵
  PID:13796
- C:\Windows\System\rpAiDnX.exe
  C:\Windows\System\rpAiDnX.exe
  2⤵
  PID:14260
- C:\Windows\System\ybQikMm.exe
  C:\Windows\System\ybQikMm.exe
  2⤵
  PID:3092
- C:\Windows\System\Mlgaadk.exe
  C:\Windows\System\Mlgaadk.exe
  2⤵
  PID:13744
- C:\Windows\System\CjKiSwg.exe
  C:\Windows\System\CjKiSwg.exe
  2⤵
  PID:13376
- C:\Windows\System\ycTioed.exe
  C:\Windows\System\ycTioed.exe
  2⤵
  PID:5096
- C:\Windows\System\OofALsQ.exe
  C:\Windows\System\OofALsQ.exe
  2⤵
  PID:5892
- C:\Windows\System\ODRIRmi.exe
  C:\Windows\System\ODRIRmi.exe
  2⤵
  PID:6020
- C:\Windows\System\jxfvnpU.exe
  C:\Windows\System\jxfvnpU.exe
  2⤵
  PID:5872
- C:\Windows\System\GhJEGVW.exe
  C:\Windows\System\GhJEGVW.exe
  2⤵
  PID:940
- C:\Windows\System\rDUbxuf.exe
  C:\Windows\System\rDUbxuf.exe
  2⤵
  PID:5700
- C:\Windows\System\eYGwmCq.exe
  C:\Windows\System\eYGwmCq.exe
  2⤵
  PID:14240
- C:\Windows\System\RfnJMug.exe
  C:\Windows\System\RfnJMug.exe
  2⤵
  PID:5944
- C:\Windows\System\VTSgSjq.exe
  C:\Windows\System\VTSgSjq.exe
  2⤵
  PID:5532
- C:\Windows\System\rKttcGy.exe
  C:\Windows\System\rKttcGy.exe
  2⤵
  PID:14200
- C:\Windows\System\lWHhbbA.exe
  C:\Windows\System\lWHhbbA.exe
  2⤵
  PID:2344
- C:\Windows\System\xcCDVRt.exe
  C:\Windows\System\xcCDVRt.exe
  2⤵
  PID:1392
- C:\Windows\System\EpmxHWG.exe
  C:\Windows\System\EpmxHWG.exe
  2⤵
  PID:6352
- C:\Windows\System\StNYGpL.exe
  C:\Windows\System\StNYGpL.exe
  2⤵
  PID:6380
- C:\Windows\System\ItjkqQr.exe
  C:\Windows\System\ItjkqQr.exe
  2⤵
  PID:5484
- C:\Windows\System\AXpuMKD.exe
  C:\Windows\System\AXpuMKD.exe
  2⤵
  PID:6148
- C:\Windows\System\mnpRlkh.exe
  C:\Windows\System\mnpRlkh.exe
  2⤵
  PID:5848
- C:\Windows\System\DPHWgXB.exe
  C:\Windows\System\DPHWgXB.exe
  2⤵
  PID:5476
- C:\Windows\System\haCjYWd.exe
  C:\Windows\System\haCjYWd.exe
  2⤵
  PID:5984
- C:\Windows\System\HlunrRV.exe
  C:\Windows\System\HlunrRV.exe
  2⤵
  PID:1984
- C:\Windows\System\lRiIzva.exe
  C:\Windows\System\lRiIzva.exe
  2⤵
  PID:4864
- C:\Windows\System\aUBNZWC.exe
  C:\Windows\System\aUBNZWC.exe
  2⤵
  PID:6544
- C:\Windows\System\NYDfnJL.exe
  C:\Windows\System\NYDfnJL.exe
  2⤵
  PID:6396
- C:\Windows\System\cnTmpOF.exe
  C:\Windows\System\cnTmpOF.exe
  2⤵
  PID:5524
- C:\Windows\System\ncOaQrU.exe
  C:\Windows\System\ncOaQrU.exe
  2⤵
  PID:13828
- C:\Windows\System\EumwRXb.exe
  C:\Windows\System\EumwRXb.exe
  2⤵
  PID:5100
- C:\Windows\System\QtvgSMM.exe
  C:\Windows\System\QtvgSMM.exe
  2⤵
  PID:6808
- C:\Windows\System\ETThaVs.exe
  C:\Windows\System\ETThaVs.exe
  2⤵
  PID:13456
- C:\Windows\System\OeoiZZj.exe
  C:\Windows\System\OeoiZZj.exe
  2⤵
  PID:4356
- C:\Windows\System\HNYHTcw.exe
  C:\Windows\System\HNYHTcw.exe
  2⤵
  PID:5420
- C:\Windows\System\OyjtCiH.exe
  C:\Windows\System\OyjtCiH.exe
  2⤵
  PID:6640
- C:\Windows\System\jPGGEgP.exe
  C:\Windows\System\jPGGEgP.exe
  2⤵
  PID:5680
- C:\Windows\System\kqZMwYN.exe
  C:\Windows\System\kqZMwYN.exe
  2⤵
  PID:7136
- C:\Windows\System\OzRDVDl.exe
  C:\Windows\System\OzRDVDl.exe
  2⤵
  PID:6388
- C:\Windows\System\XifiQGC.exe
  C:\Windows\System\XifiQGC.exe
  2⤵
  PID:7076
- C:\Windows\System\UHoEkQW.exe
  C:\Windows\System\UHoEkQW.exe
  2⤵
  PID:14340
- C:\Windows\System\RgovzWm.exe
  C:\Windows\System\RgovzWm.exe
  2⤵
  PID:14360
- C:\Windows\System\uEOzFqn.exe
  C:\Windows\System\uEOzFqn.exe
  2⤵
  PID:14392
- C:\Windows\System\zbPEaln.exe
  C:\Windows\System\zbPEaln.exe
  2⤵
  PID:14452
- C:\Windows\System\PfFXJQf.exe
  C:\Windows\System\PfFXJQf.exe
  2⤵
  PID:14508
- C:\Windows\System\FoaXzrN.exe
  C:\Windows\System\FoaXzrN.exe
  2⤵
  PID:14524
- C:\Windows\System\WWCreVA.exe
  C:\Windows\System\WWCreVA.exe
  2⤵
  PID:14540
- C:\Windows\System\rGlcWiW.exe
  C:\Windows\System\rGlcWiW.exe
  2⤵
  PID:14556
- C:\Windows\System\xinyBDS.exe
  C:\Windows\System\xinyBDS.exe
  2⤵
  PID:14572
- C:\Windows\System\JaBkdxa.exe
  C:\Windows\System\JaBkdxa.exe
  2⤵
  PID:14592
- C:\Windows\System\cFcUPki.exe
  C:\Windows\System\cFcUPki.exe
  2⤵
  PID:14612
- C:\Windows\System\PrETQDD.exe
  C:\Windows\System\PrETQDD.exe
  2⤵
  PID:14628
- C:\Windows\System\TXKBULm.exe
  C:\Windows\System\TXKBULm.exe
  2⤵
  PID:14648
- C:\Windows\System\XcDYarv.exe
  C:\Windows\System\XcDYarv.exe
  2⤵
  PID:14796
- C:\Windows\System\fiUIfsO.exe
  C:\Windows\System\fiUIfsO.exe
  2⤵
  PID:14812
- C:\Windows\System\YqBTMHR.exe
  C:\Windows\System\YqBTMHR.exe
  2⤵
  PID:14832
- C:\Windows\System\viTGPpS.exe
  C:\Windows\System\viTGPpS.exe
  2⤵
  PID:14852
- C:\Windows\System\hXwpSOd.exe
  C:\Windows\System\hXwpSOd.exe
  2⤵
  PID:14876
- C:\Windows\System\LOSrMek.exe
  C:\Windows\System\LOSrMek.exe
  2⤵
  PID:14896
- C:\Windows\System\lhmjjkT.exe
  C:\Windows\System\lhmjjkT.exe
  2⤵
  PID:14924
- C:\Windows\System\ytbKKYH.exe
  C:\Windows\System\ytbKKYH.exe
  2⤵
  PID:14948
- C:\Windows\System\zUZBaRg.exe
  C:\Windows\System\zUZBaRg.exe
  2⤵
  PID:14968
- C:\Windows\System\HYemAoV.exe
  C:\Windows\System\HYemAoV.exe
  2⤵
  PID:14992
- C:\Windows\System\ElvbLXZ.exe
  C:\Windows\System\ElvbLXZ.exe
  2⤵
  PID:15012
- C:\Windows\System\qLycOOX.exe
  C:\Windows\System\qLycOOX.exe
  2⤵
  PID:15028
- C:\Windows\System\SnHSqFp.exe
  C:\Windows\System\SnHSqFp.exe
  2⤵
  PID:15048
- C:\Windows\System\mJbaZlh.exe
  C:\Windows\System\mJbaZlh.exe
  2⤵
  PID:15064
- C:\Windows\System\kUbeRsv.exe
  C:\Windows\System\kUbeRsv.exe
  2⤵
  PID:15080
- C:\Windows\System\YbeoUEm.exe
  C:\Windows\System\YbeoUEm.exe
  2⤵
  PID:15096
- C:\Windows\System\aaANHvP.exe
  C:\Windows\System\aaANHvP.exe
  2⤵
  PID:15116
- C:\Windows\System\fgETsxx.exe
  C:\Windows\System\fgETsxx.exe
  2⤵
  PID:15132
- C:\Windows\System\TExXnEx.exe
  C:\Windows\System\TExXnEx.exe
  2⤵
  PID:15156
- C:\Windows\System\OiApDxp.exe
  C:\Windows\System\OiApDxp.exe
  2⤵
  PID:15184
- C:\Windows\System\TzksgGx.exe
  C:\Windows\System\TzksgGx.exe
  2⤵
  PID:15204
- C:\Windows\System\imhNfWc.exe
  C:\Windows\System\imhNfWc.exe
  2⤵
  PID:15224
- C:\Windows\System\aythfFz.exe
  C:\Windows\System\aythfFz.exe
  2⤵
  PID:15248
- C:\Windows\System\pzGTEbW.exe
  C:\Windows\System\pzGTEbW.exe
  2⤵
  PID:15272
- C:\Windows\System\SbDYmbQ.exe
  C:\Windows\System\SbDYmbQ.exe
  2⤵
  PID:15292
- C:\Windows\System\NNZyVjN.exe
  C:\Windows\System\NNZyVjN.exe
  2⤵
  PID:15312
- C:\Windows\System\HVrxnOU.exe
  C:\Windows\System\HVrxnOU.exe
  2⤵
  PID:15332
- C:\Windows\System\ASZnDAf.exe
  C:\Windows\System\ASZnDAf.exe
  2⤵
  PID:5452
- C:\Windows\System\dVIjNRS.exe
  C:\Windows\System\dVIjNRS.exe
  2⤵
  PID:5948
- C:\Windows\System\GNaaYii.exe
  C:\Windows\System\GNaaYii.exe
  2⤵
  PID:7060
- C:\Windows\System\apKHLML.exe
  C:\Windows\System\apKHLML.exe
  2⤵
  PID:5248
- C:\Windows\System\briiTRp.exe
  C:\Windows\System\briiTRp.exe
  2⤵
  PID:6596
- C:\Windows\System\FTGdEFg.exe
  C:\Windows\System\FTGdEFg.exe
  2⤵
  PID:6360
- C:\Windows\System\Skozbij.exe
  C:\Windows\System\Skozbij.exe
  2⤵
  PID:6940
- C:\Windows\System\WXyxKDx.exe
  C:\Windows\System\WXyxKDx.exe
  2⤵
  PID:14440
- C:\Windows\System\DOcokbH.exe
  C:\Windows\System\DOcokbH.exe
  2⤵
  PID:14484
- C:\Windows\System\fZgeydi.exe
  C:\Windows\System\fZgeydi.exe
  2⤵
  PID:7132
- C:\Windows\System\XfBPzjF.exe
  C:\Windows\System\XfBPzjF.exe
  2⤵
  PID:6680
- C:\Windows\System\wJcKcYz.exe
  C:\Windows\System\wJcKcYz.exe
  2⤵
  PID:6792
- C:\Windows\System\htQXeKH.exe
  C:\Windows\System\htQXeKH.exe
  2⤵
  PID:6852
- C:\Windows\System\MFYspBj.exe
  C:\Windows\System\MFYspBj.exe
  2⤵
  PID:14376
- C:\Windows\System\WkgdtNI.exe
  C:\Windows\System\WkgdtNI.exe
  2⤵
  PID:6728
- C:\Windows\System\DduPgbP.exe
  C:\Windows\System\DduPgbP.exe
  2⤵
  PID:14708
- C:\Windows\System\YmECHqk.exe
  C:\Windows\System\YmECHqk.exe
  2⤵
  PID:7024
- C:\Windows\System\oAvHYnB.exe
  C:\Windows\System\oAvHYnB.exe
  2⤵
  PID:6776
- C:\Windows\System\TvHBosV.exe
  C:\Windows\System\TvHBosV.exe
  2⤵
  PID:6520
- C:\Windows\System\TnggtOZ.exe
  C:\Windows\System\TnggtOZ.exe
  2⤵
  PID:14468
- C:\Windows\System\xqIuqSu.exe
  C:\Windows\System\xqIuqSu.exe
  2⤵
  PID:6476
- C:\Windows\System\HnisydW.exe
  C:\Windows\System\HnisydW.exe
  2⤵
  PID:14516
- C:\Windows\System\Ikwylbb.exe
  C:\Windows\System\Ikwylbb.exe
  2⤵
  PID:14552
- C:\Windows\System\GKwEfvb.exe
  C:\Windows\System\GKwEfvb.exe
  2⤵
  PID:5176
- C:\Windows\System\einnopf.exe
  C:\Windows\System\einnopf.exe
  2⤵
  PID:4176
- C:\Windows\System\GtSFuwO.exe
  C:\Windows\System\GtSFuwO.exe
  2⤵
  PID:14820
- C:\Windows\System\swgWqix.exe
  C:\Windows\System\swgWqix.exe
  2⤵
  PID:14684
- C:\Windows\System\DynSJjc.exe
  C:\Windows\System\DynSJjc.exe
  2⤵
  PID:7164
- C:\Windows\System\aMsYCnl.exe
  C:\Windows\System\aMsYCnl.exe
  2⤵
  PID:15220
- C:\Windows\System\JatKFuW.exe
  C:\Windows\System\JatKFuW.exe
  2⤵
  PID:14504
- C:\Windows\System\CIzEhdr.exe
  C:\Windows\System\CIzEhdr.exe
  2⤵
  PID:14588
- C:\Windows\System\MThRWAk.exe
  C:\Windows\System\MThRWAk.exe
  2⤵
  PID:14804
- C:\Windows\System\qLDsnRm.exe
  C:\Windows\System\qLDsnRm.exe
  2⤵
  PID:11152
- C:\Windows\System\UyOjgDC.exe
  C:\Windows\System\UyOjgDC.exe
  2⤵
  PID:11232
- C:\Windows\System\yWKcKML.exe
  C:\Windows\System\yWKcKML.exe
  2⤵
  PID:9416
- C:\Windows\System\ecXCoka.exe
  C:\Windows\System\ecXCoka.exe
  2⤵
  PID:2404
- C:\Windows\System\cAuioHh.exe
  C:\Windows\System\cAuioHh.exe
  2⤵
  PID:7644
- C:\Windows\System\NJgNIZy.exe
  C:\Windows\System\NJgNIZy.exe
  2⤵
  PID:14696
- C:\Windows\System\sFLASCN.exe
  C:\Windows\System\sFLASCN.exe
  2⤵
  PID:7712
- C:\Windows\System\ZCeftNR.exe
  C:\Windows\System\ZCeftNR.exe
  2⤵
  PID:7592
- C:\Windows\System\tbaPeRA.exe
  C:\Windows\System\tbaPeRA.exe
  2⤵
  PID:14432
- C:\Windows\System\JVWqSmp.exe
  C:\Windows\System\JVWqSmp.exe
  2⤵
  PID:7964
- C:\Windows\System\pAtbctI.exe
  C:\Windows\System\pAtbctI.exe
  2⤵
  PID:8088
- C:\Windows\System\ZVODAht.exe
  C:\Windows\System\ZVODAht.exe
  2⤵
  PID:7184
- C:\Windows\System\PiQlAmH.exe
  C:\Windows\System\PiQlAmH.exe
  2⤵
  PID:6212
- C:\Windows\System\dTeVuqM.exe
  C:\Windows\System\dTeVuqM.exe
  2⤵
  PID:14728
- C:\Windows\System\MbmfzIf.exe
  C:\Windows\System\MbmfzIf.exe
  2⤵
  PID:15024
- C:\Windows\System\AgRqOof.exe
  C:\Windows\System\AgRqOof.exe
  2⤵
  PID:224
- C:\Windows\System\RYyqwps.exe
  C:\Windows\System\RYyqwps.exe
  2⤵
  PID:15180
- C:\Windows\System\CynCMGS.exe
  C:\Windows\System\CynCMGS.exe
  2⤵
  PID:7312
- C:\Windows\System\HsUcHnc.exe
  C:\Windows\System\HsUcHnc.exe
  2⤵
  PID:11760
- C:\Windows\System\ZWjpUkg.exe
  C:\Windows\System\ZWjpUkg.exe
  2⤵
  PID:7304
- C:\Windows\System\CvLmfVf.exe
  C:\Windows\System\CvLmfVf.exe
  2⤵
  PID:14548
- C:\Windows\System\pIKUmgn.exe
  C:\Windows\System\pIKUmgn.exe
  2⤵
  PID:7124
- C:\Windows\System\ehMTAKw.exe
  C:\Windows\System\ehMTAKw.exe
  2⤵
  PID:9944
- C:\Windows\System\iqehMpk.exe
  C:\Windows\System\iqehMpk.exe
  2⤵
  PID:11148
- C:\Windows\System\YSmvKqG.exe
  C:\Windows\System\YSmvKqG.exe
  2⤵
  PID:7316
- C:\Windows\System\PkLFMXg.exe
  C:\Windows\System\PkLFMXg.exe
  2⤵
  PID:15328
- C:\Windows\System\mUMHSry.exe
  C:\Windows\System\mUMHSry.exe
  2⤵
  PID:7360
- C:\Windows\System\vBDTLZt.exe
  C:\Windows\System\vBDTLZt.exe
  2⤵
  PID:8752
- C:\Windows\System\HGUPeMf.exe
  C:\Windows\System\HGUPeMf.exe
  2⤵
  PID:8308
- C:\Windows\System\DmVYQXk.exe
  C:\Windows\System\DmVYQXk.exe
  2⤵
  PID:8488
- C:\Windows\System\NUHdZUC.exe
  C:\Windows\System\NUHdZUC.exe
  2⤵
  PID:8744
- C:\Windows\System\TKoLOSq.exe
  C:\Windows\System\TKoLOSq.exe
  2⤵
  PID:8508
- C:\Windows\System\GGRRSPv.exe
  C:\Windows\System\GGRRSPv.exe
  2⤵
  PID:8460
- C:\Windows\System\nbnrsJH.exe
  C:\Windows\System\nbnrsJH.exe
  2⤵
  PID:8056
- C:\Windows\System\WejFkQE.exe
  C:\Windows\System\WejFkQE.exe
  2⤵
  PID:14080
- C:\Windows\System\wzohKtq.exe
  C:\Windows\System\wzohKtq.exe
  2⤵
  PID:8936
- C:\Windows\System\uRasrre.exe
  C:\Windows\System\uRasrre.exe
  2⤵
  PID:10884
- C:\Windows\System\hLTCBMt.exe
  C:\Windows\System\hLTCBMt.exe
  2⤵
  PID:7372
- C:\Windows\System\rmUYNtW.exe
  C:\Windows\System\rmUYNtW.exe
  2⤵
  PID:8760
- C:\Windows\System\DjnDkyy.exe
  C:\Windows\System\DjnDkyy.exe
  2⤵
  PID:8660
- C:\Windows\System\WApNLTH.exe
  C:\Windows\System\WApNLTH.exe
  2⤵
  PID:8036
- C:\Windows\System\IDpSuvU.exe
  C:\Windows\System\IDpSuvU.exe
  2⤵
  PID:9068
- C:\Windows\System\eguptWc.exe
  C:\Windows\System\eguptWc.exe
  2⤵
  PID:8952
- C:\Windows\System\DEtXnHp.exe
  C:\Windows\System\DEtXnHp.exe
  2⤵
  PID:8728
- C:\Windows\System\ZkKmORG.exe
  C:\Windows\System\ZkKmORG.exe
  2⤵
  PID:8496
- C:\Windows\System\nttexqL.exe
  C:\Windows\System\nttexqL.exe
  2⤵
  PID:8464
- C:\Windows\System\xiGydad.exe
  C:\Windows\System\xiGydad.exe
  2⤵
  PID:5308
- C:\Windows\System\AWUyukz.exe
  C:\Windows\System\AWUyukz.exe
  2⤵
  PID:14568
- C:\Windows\System\UYPvTbQ.exe
  C:\Windows\System\UYPvTbQ.exe
  2⤵
  PID:11328
- C:\Windows\System\LQIRPEa.exe
  C:\Windows\System\LQIRPEa.exe
  2⤵
  PID:7812
- C:\Windows\System\ThadlVX.exe
  C:\Windows\System\ThadlVX.exe
  2⤵
  PID:7828
- C:\Windows\System\hoPlNlb.exe
  C:\Windows\System\hoPlNlb.exe
  2⤵
  PID:8012
- C:\Windows\System\aQnDtBZ.exe
  C:\Windows\System\aQnDtBZ.exe
  2⤵
  PID:11048
- C:\Windows\System\ltGvxyU.exe
  C:\Windows\System\ltGvxyU.exe
  2⤵
  PID:11252
- C:\Windows\System\UQhlphO.exe
  C:\Windows\System\UQhlphO.exe
  2⤵
  PID:5104
- C:\Windows\System\vjJQpuZ.exe
  C:\Windows\System\vjJQpuZ.exe
  2⤵
  PID:7216
- C:\Windows\System\krYUgRQ.exe
  C:\Windows\System\krYUgRQ.exe
  2⤵
  PID:7756
- C:\Windows\System\GtFOctf.exe
  C:\Windows\System\GtFOctf.exe
  2⤵
  PID:8712
- C:\Windows\System\qKHbkvY.exe
  C:\Windows\System\qKHbkvY.exe
  2⤵
  PID:9676
- C:\Windows\System\esDRcoZ.exe
  C:\Windows\System\esDRcoZ.exe
  2⤵
  PID:9716
- C:\Windows\System\JTVLqQF.exe
  C:\Windows\System\JTVLqQF.exe
  2⤵
  PID:7864
- C:\Windows\System\KFUqlWv.exe
  C:\Windows\System\KFUqlWv.exe
  2⤵
  PID:6872
- C:\Windows\System\LiklCaS.exe
  C:\Windows\System\LiklCaS.exe
  2⤵
  PID:7292
- C:\Windows\System\ABDYmlC.exe
  C:\Windows\System\ABDYmlC.exe
  2⤵
  PID:7456
- C:\Windows\System\QtCXLhv.exe
  C:\Windows\System\QtCXLhv.exe
  2⤵
  PID:10516
- C:\Windows\System\VGSZTKJ.exe
  C:\Windows\System\VGSZTKJ.exe
  2⤵
  PID:7820
- C:\Windows\System\JXnRYCU.exe
  C:\Windows\System\JXnRYCU.exe
  2⤵
  PID:9616
- C:\Windows\System\ztTMFDt.exe
  C:\Windows\System\ztTMFDt.exe
  2⤵
  PID:9740
- C:\Windows\System\AJgtjnN.exe
  C:\Windows\System\AJgtjnN.exe
  2⤵
  PID:9656
- C:\Windows\System\khFqNwj.exe
  C:\Windows\System\khFqNwj.exe
  2⤵
  PID:14956
- C:\Windows\System\rngiifO.exe
  C:\Windows\System\rngiifO.exe
  2⤵
  PID:9424
- C:\Windows\System\GwdORlX.exe
  C:\Windows\System\GwdORlX.exe
  2⤵
  PID:15168
- C:\Windows\System\NCrNmpZ.exe
  C:\Windows\System\NCrNmpZ.exe
  2⤵
  PID:8304
- C:\Windows\System\giQNMEc.exe
  C:\Windows\System\giQNMEc.exe
  2⤵
  PID:9584
- C:\Windows\System\EyZhzww.exe
  C:\Windows\System\EyZhzww.exe
  2⤵
  PID:9532
- C:\Windows\System\fUKAjsj.exe
  C:\Windows\System\fUKAjsj.exe
  2⤵
  PID:9692
- C:\Windows\System\wKelOeY.exe
  C:\Windows\System\wKelOeY.exe
  2⤵
  PID:9728
- C:\Windows\System\KIuxNaJ.exe
  C:\Windows\System\KIuxNaJ.exe
  2⤵
  PID:9344
- C:\Windows\System\SxQdkjd.exe
  C:\Windows\System\SxQdkjd.exe
  2⤵
  PID:9296
- C:\Windows\System\XMLKmfc.exe
  C:\Windows\System\XMLKmfc.exe
  2⤵
  PID:7472
- C:\Windows\System\WWJPSlV.exe
  C:\Windows\System\WWJPSlV.exe
  2⤵
  PID:5736
- C:\Windows\System\RvctkWU.exe
  C:\Windows\System\RvctkWU.exe
  2⤵
  PID:15056
- C:\Windows\System\QZeUJjb.exe
  C:\Windows\System\QZeUJjb.exe
  2⤵
  PID:15268
- C:\Windows\System\jzyfOey.exe
  C:\Windows\System\jzyfOey.exe
  2⤵
  PID:2444
- C:\Windows\System\dwLBrMK.exe
  C:\Windows\System\dwLBrMK.exe
  2⤵
  PID:7332
- C:\Windows\System\FSwoVvG.exe
  C:\Windows\System\FSwoVvG.exe
  2⤵
  PID:8008
- C:\Windows\System\JyudtdU.exe
  C:\Windows\System\JyudtdU.exe
  2⤵
  PID:11216
- C:\Windows\System\lUZVnPr.exe
  C:\Windows\System\lUZVnPr.exe
  2⤵
  PID:12928
- C:\Windows\System\IAnMqTB.exe
  C:\Windows\System\IAnMqTB.exe
  2⤵
  PID:8040
- C:\Windows\System\ulgMMUz.exe
  C:\Windows\System\ulgMMUz.exe
  2⤵
  PID:8800
- C:\Windows\System\acWIqvQ.exe
  C:\Windows\System\acWIqvQ.exe
  2⤵
  PID:7640
- C:\Windows\System\TSOOdoX.exe
  C:\Windows\System\TSOOdoX.exe
  2⤵
  PID:10212
- C:\Windows\System\byrgWnY.exe
  C:\Windows\System\byrgWnY.exe
  2⤵
  PID:10008
- C:\Windows\System\AYylKDy.exe
  C:\Windows\System\AYylKDy.exe
  2⤵
  PID:13100
- C:\Windows\System\qBVSace.exe
  C:\Windows\System\qBVSace.exe
  2⤵
  PID:13204
- C:\Windows\System\pvTImFU.exe
  C:\Windows\System\pvTImFU.exe
  2⤵
  PID:9976
- C:\Windows\System\jgaNFBS.exe
  C:\Windows\System\jgaNFBS.exe
  2⤵
  PID:10140
- C:\Windows\System\erdylPD.exe
  C:\Windows\System\erdylPD.exe
  2⤵
  PID:8912
- C:\Windows\System\zUyOTLw.exe
  C:\Windows\System\zUyOTLw.exe
  2⤵
  PID:6404
- C:\Windows\System\qOkugDd.exe
  C:\Windows\System\qOkugDd.exe
  2⤵
  PID:14868
- C:\Windows\System\EDbZTQW.exe
  C:\Windows\System\EDbZTQW.exe
  2⤵
  PID:10172
- C:\Windows\System\TmlSEOZ.exe
  C:\Windows\System\TmlSEOZ.exe
  2⤵
  PID:7544
- C:\Windows\System\hMZAtxl.exe
  C:\Windows\System\hMZAtxl.exe
  2⤵
  PID:11032
- C:\Windows\System\fwHxsVH.exe
  C:\Windows\System\fwHxsVH.exe
  2⤵
  PID:11172
- C:\Windows\System\OCMOIXc.exe
  C:\Windows\System\OCMOIXc.exe
  2⤵
  PID:10104
- C:\Windows\System\zSiBphI.exe
  C:\Windows\System\zSiBphI.exe
  2⤵
  PID:9224
- C:\Windows\System\UvwdUgD.exe
  C:\Windows\System\UvwdUgD.exe
  2⤵
  PID:4164
- C:\Windows\System\zJpCdst.exe
  C:\Windows\System\zJpCdst.exe
  2⤵
  PID:388
- C:\Windows\System\NWCkDhq.exe
  C:\Windows\System\NWCkDhq.exe
  2⤵
  PID:9400
- C:\Windows\System\WelbGvF.exe
  C:\Windows\System\WelbGvF.exe
  2⤵
  PID:6624
- C:\Windows\System\DIXdDGr.exe
  C:\Windows\System\DIXdDGr.exe
  2⤵
  PID:10852
- C:\Windows\System\ZyKmxQR.exe
  C:\Windows\System\ZyKmxQR.exe
  2⤵
  PID:9020
- C:\Windows\System\nfgSxxz.exe
  C:\Windows\System\nfgSxxz.exe
  2⤵
  PID:7500
- C:\Windows\System\kiKujuO.exe
  C:\Windows\System\kiKujuO.exe
  2⤵
  PID:9364
- C:\Windows\System\eKVRipq.exe
  C:\Windows\System\eKVRipq.exe
  2⤵
  PID:14420
- C:\Windows\System\cctPRyw.exe
  C:\Windows\System\cctPRyw.exe
  2⤵
  PID:10652
- C:\Windows\System\yUjjIYk.exe
  C:\Windows\System\yUjjIYk.exe
  2⤵
  PID:10768
- C:\Windows\System\gNPGpoe.exe
  C:\Windows\System\gNPGpoe.exe
  2⤵
  PID:7388
- C:\Windows\System\qfoUdvi.exe
  C:\Windows\System\qfoUdvi.exe
  2⤵
  PID:15372
- C:\Windows\System\KTiLRQq.exe
  C:\Windows\System\KTiLRQq.exe
  2⤵
  PID:15392
- C:\Windows\System\oUcMUOf.exe
  C:\Windows\System\oUcMUOf.exe
  2⤵
  PID:15412
- C:\Windows\System\DZomVqZ.exe
  C:\Windows\System\DZomVqZ.exe
  2⤵
  PID:15428
- C:\Windows\System\hDbeRCu.exe
  C:\Windows\System\hDbeRCu.exe
  2⤵
  PID:15444
- C:\Windows\System\gKLCNNp.exe
  C:\Windows\System\gKLCNNp.exe
  2⤵
  PID:15464
- C:\Windows\System\gNFmmOt.exe
  C:\Windows\System\gNFmmOt.exe
  2⤵
  PID:15488
- C:\Windows\System\kDBEWbu.exe
  C:\Windows\System\kDBEWbu.exe
  2⤵
  PID:15512
- C:\Windows\System\MKhmYXN.exe
  C:\Windows\System\MKhmYXN.exe
  2⤵
  PID:15540
- C:\Windows\System\zPBpkRV.exe
  C:\Windows\System\zPBpkRV.exe
  2⤵
  PID:15564
- C:\Windows\System\vfsddlA.exe
  C:\Windows\System\vfsddlA.exe
  2⤵
  PID:15588
- C:\Windows\System\mDgKbaC.exe
  C:\Windows\System\mDgKbaC.exe
  2⤵
  PID:15608
- C:\Windows\System\vVGnRSd.exe
  C:\Windows\System\vVGnRSd.exe
  2⤵
  PID:15628
- C:\Windows\System\ZPmNUhE.exe
  C:\Windows\System\ZPmNUhE.exe
  2⤵
  PID:15648
- C:\Windows\System\QiAWFGu.exe
  C:\Windows\System\QiAWFGu.exe
  2⤵
  PID:15680
- C:\Windows\System\JCptIhy.exe
  C:\Windows\System\JCptIhy.exe
  2⤵
  PID:15700
- C:\Windows\System\LOyGipH.exe
  C:\Windows\System\LOyGipH.exe
  2⤵
  PID:15724
- C:\Windows\System\ZrADOnL.exe
  C:\Windows\System\ZrADOnL.exe
  2⤵
  PID:15744
- C:\Windows\System\evZCZZD.exe
  C:\Windows\System\evZCZZD.exe
  2⤵
  PID:15764
- C:\Windows\System\ggnvZnP.exe
  C:\Windows\System\ggnvZnP.exe
  2⤵
  PID:15784
- C:\Windows\System\aYBBXRG.exe
  C:\Windows\System\aYBBXRG.exe
  2⤵
  PID:15804
- C:\Windows\System\FyXMlzZ.exe
  C:\Windows\System\FyXMlzZ.exe
  2⤵
  PID:15832
- C:\Windows\System\MyRXTcv.exe
  C:\Windows\System\MyRXTcv.exe
  2⤵
  PID:15852
- C:\Windows\System\OFGTgRL.exe
  C:\Windows\System\OFGTgRL.exe
  2⤵
  PID:16020
- C:\Windows\System\gSHngrD.exe
  C:\Windows\System\gSHngrD.exe
  2⤵
  PID:16036
- C:\Windows\System\xYsSDoT.exe
  C:\Windows\System\xYsSDoT.exe
  2⤵
  PID:16176
- C:\Windows\System\raOXHqC.exe
  C:\Windows\System\raOXHqC.exe
  2⤵
  PID:16196
- C:\Windows\System\YmmEbuG.exe
  C:\Windows\System\YmmEbuG.exe
  2⤵
  PID:16216
- C:\Windows\System\UuJlxZz.exe
  C:\Windows\System\UuJlxZz.exe
  2⤵
  PID:16236
- C:\Windows\System\abztHLL.exe
  C:\Windows\System\abztHLL.exe
  2⤵
  PID:16264
- C:\Windows\System\yAbZYwT.exe
  C:\Windows\System\yAbZYwT.exe
  2⤵
  PID:16284
- C:\Windows\System\ahTlFFk.exe
  C:\Windows\System\ahTlFFk.exe
  2⤵
  PID:10404
- C:\Windows\System\ZGaRJZK.exe
  C:\Windows\System\ZGaRJZK.exe
  2⤵
  PID:10992
- C:\Windows\System\HHIyvIz.exe
  C:\Windows\System\HHIyvIz.exe
  2⤵
  PID:13024
- C:\Windows\System\ocSgAQn.exe
  C:\Windows\System\ocSgAQn.exe
  2⤵
  PID:10036
- C:\Windows\System\PwiLLyh.exe
  C:\Windows\System\PwiLLyh.exe
  2⤵
  PID:10176
- C:\Windows\System\wgsBnNF.exe
  C:\Windows\System\wgsBnNF.exe
  2⤵
  PID:10696
- C:\Windows\System\YRDgtjQ.exe
  C:\Windows\System\YRDgtjQ.exe
  2⤵
  PID:11036
- C:\Windows\System\JyVRXcL.exe
  C:\Windows\System\JyVRXcL.exe
  2⤵
  PID:9160
- C:\Windows\System\fqzjmlu.exe
  C:\Windows\System\fqzjmlu.exe
  2⤵
  PID:8764
- C:\Windows\System\zVEjNRp.exe
  C:\Windows\System\zVEjNRp.exe
  2⤵
  PID:9748
- C:\Windows\System\OYhJUqM.exe
  C:\Windows\System\OYhJUqM.exe
  2⤵
  PID:15780
- C:\Windows\System\srxFPwU.exe
  C:\Windows\System\srxFPwU.exe
  2⤵
  PID:10936
- C:\Windows\System\VKwAgaP.exe
  C:\Windows\System\VKwAgaP.exe
  2⤵
  PID:12944
- C:\Windows\System\WaCEKMq.exe
  C:\Windows\System\WaCEKMq.exe
  2⤵
  PID:9572
- C:\Windows\System\wAtvZCM.exe
  C:\Windows\System\wAtvZCM.exe
  2⤵
  PID:15504
- C:\Windows\System\kQgKdkE.exe
  C:\Windows\System\kQgKdkE.exe
  2⤵
  PID:15556
- C:\Windows\System\sBsDaWn.exe
  C:\Windows\System\sBsDaWn.exe
  2⤵
  PID:15600
- C:\Windows\System\XdcycEw.exe
  C:\Windows\System\XdcycEw.exe
  2⤵
  PID:15692
- C:\Windows\System\VxwMeXu.exe
  C:\Windows\System\VxwMeXu.exe
  2⤵
  PID:15736
- C:\Windows\System\jqNLcbK.exe
  C:\Windows\System\jqNLcbK.exe
  2⤵
  PID:15796
- C:\Windows\System\ijwqbcv.exe
  C:\Windows\System\ijwqbcv.exe
  2⤵
  PID:15824
- C:\Windows\System\efmLTUM.exe
  C:\Windows\System\efmLTUM.exe
  2⤵
  PID:15868
- C:\Windows\System\wjYcSdY.exe
  C:\Windows\System\wjYcSdY.exe
  2⤵
  PID:16172
- C:\Windows\System\RYuYlKL.exe
  C:\Windows\System\RYuYlKL.exe
  2⤵
  PID:11680
- C:\Windows\System\HbxIjDE.exe
  C:\Windows\System\HbxIjDE.exe
  2⤵
  PID:11788
- C:\Windows\System\RAZuFex.exe
  C:\Windows\System\RAZuFex.exe
  2⤵
  PID:13980
- C:\Windows\System\TXXrkax.exe
  C:\Windows\System\TXXrkax.exe
  2⤵
  PID:16292
- C:\Windows\System\ScNfBry.exe
  C:\Windows\System\ScNfBry.exe
  2⤵
  PID:16204
- C:\Windows\System\mmEGltu.exe
  C:\Windows\System\mmEGltu.exe
  2⤵
  PID:16224
- C:\Windows\System\ufbzsMf.exe
  C:\Windows\System\ufbzsMf.exe
  2⤵
  PID:12072
- C:\Windows\System\HupVDYq.exe
  C:\Windows\System\HupVDYq.exe
  2⤵
  PID:14904
- C:\Windows\System\ohDIbaG.exe
  C:\Windows\System\ohDIbaG.exe
  2⤵
  PID:10864
- C:\Windows\System\BKQRJxP.exe
  C:\Windows\System\BKQRJxP.exe
  2⤵
  PID:16344
- C:\Windows\System\wPxqFwz.exe
  C:\Windows\System\wPxqFwz.exe
  2⤵
  PID:12052
- C:\Windows\System\PwauRgK.exe
  C:\Windows\System\PwauRgK.exe
  2⤵
  PID:11852
- C:\Windows\System\gLhzATt.exe
  C:\Windows\System\gLhzATt.exe
  2⤵
  PID:10824
- C:\Windows\System\jXtENov.exe
  C:\Windows\System\jXtENov.exe
  2⤵
  PID:10520
- C:\Windows\System\vFHWOzJ.exe
  C:\Windows\System\vFHWOzJ.exe
  2⤵
  PID:11688
- C:\Windows\System\THYJBex.exe
  C:\Windows\System\THYJBex.exe
  2⤵
  PID:10512
- C:\Windows\System\OXtCMNX.exe
  C:\Windows\System\OXtCMNX.exe
  2⤵
  PID:15472
- C:\Windows\System\JptjgaD.exe
  C:\Windows\System\JptjgaD.exe
  2⤵
  PID:11416
- C:\Windows\System\dpbeRUo.exe
  C:\Windows\System\dpbeRUo.exe
  2⤵
  PID:10268
- C:\Windows\System\ScnMQfa.exe
  C:\Windows\System\ScnMQfa.exe
  2⤵
  PID:12764
- C:\Windows\System\nQfuGZo.exe
  C:\Windows\System\nQfuGZo.exe
  2⤵
  PID:15760
- C:\Windows\System\DbkCOao.exe
  C:\Windows\System\DbkCOao.exe
  2⤵
  PID:10740
- C:\Windows\System\nkNVnBj.exe
  C:\Windows\System\nkNVnBj.exe
  2⤵
  PID:11508
- C:\Windows\System\kEGxyEu.exe
  C:\Windows\System\kEGxyEu.exe
  2⤵
  PID:14916
- C:\Windows\System\WoZINvF.exe
  C:\Windows\System\WoZINvF.exe
  2⤵
  PID:9500
- C:\Windows\System\pqdtHgz.exe
  C:\Windows\System\pqdtHgz.exe
  2⤵
  PID:15620
- C:\Windows\System\YkmKILj.exe
  C:\Windows\System\YkmKILj.exe
  2⤵
  PID:9964
- C:\Windows\System\TRCIvHZ.exe
  C:\Windows\System\TRCIvHZ.exe
  2⤵
  PID:15876
- C:\Windows\System\rilqalg.exe
  C:\Windows\System\rilqalg.exe
  2⤵
  PID:12964
- C:\Windows\System\cAVQYtS.exe
  C:\Windows\System\cAVQYtS.exe
  2⤵
  PID:15636
- C:\Windows\System\vOhxvYB.exe
  C:\Windows\System\vOhxvYB.exe
  2⤵
  PID:12368
- C:\Windows\System\YGOIymu.exe
  C:\Windows\System\YGOIymu.exe
  2⤵
  PID:12792
- C:\Windows\System\bNSFOhf.exe
  C:\Windows\System\bNSFOhf.exe
  2⤵
  PID:12548
- C:\Windows\System\hCZxEhb.exe
  C:\Windows\System\hCZxEhb.exe
  2⤵
  PID:11380
- C:\Windows\System\nFwMuTl.exe
  C:\Windows\System\nFwMuTl.exe
  2⤵
  PID:12784
- C:\Windows\System\hlhAdDT.exe
  C:\Windows\System\hlhAdDT.exe
  2⤵
  PID:12972
- C:\Windows\System\NYFuzWK.exe
  C:\Windows\System\NYFuzWK.exe
  2⤵
  PID:12200
- C:\Windows\System\IvtiAqk.exe
  C:\Windows\System\IvtiAqk.exe
  2⤵
  PID:12736
- C:\Windows\System\qnvbYsF.exe
  C:\Windows\System\qnvbYsF.exe
  2⤵
  PID:12808
- C:\Windows\System\KEaGKhc.exe
  C:\Windows\System\KEaGKhc.exe
  2⤵
  PID:11868
- C:\Windows\System\JNPSOCx.exe
  C:\Windows\System\JNPSOCx.exe
  2⤵
  PID:13068
- C:\Windows\System\PspPddX.exe
  C:\Windows\System\PspPddX.exe
  2⤵
  PID:5144
- C:\Windows\System\GTHhkdN.exe
  C:\Windows\System\GTHhkdN.exe
  2⤵
  PID:11968
- C:\Windows\System\PmCIjXx.exe
  C:\Windows\System\PmCIjXx.exe
  2⤵
  PID:13000
- C:\Windows\System\AtOjFJt.exe
  C:\Windows\System\AtOjFJt.exe
  2⤵
  PID:13480
- C:\Windows\System\gRdxjQG.exe
  C:\Windows\System\gRdxjQG.exe
  2⤵
  PID:13260
- C:\Windows\System\CoCgARW.exe
  C:\Windows\System\CoCgARW.exe
  2⤵
  PID:13036
- C:\Windows\System\pvCRgyC.exe
  C:\Windows\System\pvCRgyC.exe
  2⤵
  PID:9712
- C:\Windows\System\PqqEEvc.exe
  C:\Windows\System\PqqEEvc.exe
  2⤵
  PID:12724
- C:\Windows\System\JsczSmY.exe
  C:\Windows\System\JsczSmY.exe
  2⤵
  PID:12308
- C:\Windows\System\xyqTnWn.exe
  C:\Windows\System\xyqTnWn.exe
  2⤵
  PID:11904
- C:\Windows\System\WubIawm.exe
  C:\Windows\System\WubIawm.exe
  2⤵
  PID:1832
- C:\Windows\System\SlJczCn.exe
  C:\Windows\System\SlJczCn.exe
  2⤵
  PID:8708
- C:\Windows\System\xCduWMK.exe
  C:\Windows\System\xCduWMK.exe
  2⤵
  PID:3164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5368 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:11632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cz0wr3od.p3y.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BbtJmVw.exe

Filesize
2.2MB

MD5
d7b3fa6e80fb43f3d2e2856764f6c35c

SHA1
9b72d0781fef702106ed97552833531450e0de80

SHA256
39dabae6148329732c41d1a804c1bab1634bd10130de9faa42ffce3874246d33

SHA512
101bed763f876a051b0ef4936f1043213d180b9b54b6d7fe1822f9f9035d50bb9fb826a585e404ae593d5c18020526058927a7c5482546a4e13dc1036c46b4f3

Download Submit
C:\Windows\System\GsvneHF.exe

Filesize
2.2MB

MD5
1f3df030389d05638464654315b879fd

SHA1
c0562cbd4edbd3105ceb5f036f424406f19c1806

SHA256
66a37683fffaf0719b71e48a9ac4b63c8f8073c393deded07092db80206a0a8b

SHA512
d518d721cee0f86cd01f02c21fc947305a2cd82d470e89ffe93d9b3f6d0b27bc896479937998ebfd9948817648c43a1602e34615f9a4e45282a6fd1674130c67

Download Submit
C:\Windows\System\Kwneqmg.exe

Filesize
2.2MB

MD5
c9498c474fb8dbb6d9aa6cc321a92b89

SHA1
4c288b35eda87310d37ebb730a5f7b6640580e42

SHA256
7e1f8d53be8786cbaec879f96c75d04f31ad6bb4da9525c2e601dfd2c57039cc

SHA512
efbc6fe4777b82cd50943bc2de78e6c598289914d7b86393b70d6b3027004270cd07497222ede6f0be224595dc9ac2ddf89c0d45a4c2935f472b663a604497d3

Download Submit
C:\Windows\System\MdCjpyl.exe

Filesize
2.2MB

MD5
3fb4e612ec9220edd485201fd4663bce

SHA1
b16d20b441e67ed66b442a0de6082b0918b1821c

SHA256
a961a68b39d61388da69137a381280dc9f4202d0efcec712d551a1f4bb839553

SHA512
5cc0d2c9af79364597c11d1bca66ed53e2ccb6d3438696e09759fa70865c1031c8683014d67898eccf6b0286dac6a632914ad17e36d88486722bd2a4e1a9736e

Download Submit
C:\Windows\System\ObIlCWm.exe

Filesize
2.2MB

MD5
6e029d99d6e4ce7b091ed1613d378f59

SHA1
2c4fc8b4e65e2bef59259f0378a47f51c97a1fdb

SHA256
f1b8743304abe5442a23eef38da833b8c8f8f156101ed6136d3f1c699125e762

SHA512
9edcdb6987b9ef26f33d6e2fd5e8119f9e37a98676070c6709dfce8c405ec26052d1d82752018186f19d56ea30b42a436f6d4309f3ea3b3f65dd41de1ca562fc

Download Submit
C:\Windows\System\QjBkDzR.exe

Filesize
2.2MB

MD5
c6cf9c79a70aec7d4ae561191d5f845e

SHA1
4ebf2385c425095599d4f6f4a7eef2532c7b9192

SHA256
7069663674ee648499758d28aead91b04cc8b10f493bb14c4122270c184b8871

SHA512
71ea0825e1998a1b8dbeab829250013de7e479faf54654bd021aa50a6ae1bfd98b52303be5d8c11e42fc97e67a424732ce5965a0b2f3e017e3e9ec76a0b9eafb

Download Submit
C:\Windows\System\RPBKawV.exe

Filesize
2.2MB

MD5
434f75cbfa1b9f2d5714b9ab357e0fe8

SHA1
c3f0d1f3a1d034c22e430e6717f8180d52770611

SHA256
acacfafd2ce145e426786f5d88c880ca9ef4e57b48fd5e59114981fe6d6006fa

SHA512
4a7b61690bdd6e194428286f3c79ce8b4a6564ae37b9e66f7759829c7fb826da2633f7cedb775fb147b2f79a885277a60739a3f37066fbe31a7bcf4440fdaace

Download Submit
C:\Windows\System\SArziKe.exe

Filesize
2.2MB

MD5
277aca1779d238744cb1d561c888e6b5

SHA1
1f11888064335cd3344ca08ee6dac22400eb250d

SHA256
7405a1bcd3c9e1e30c630a30feff5540e670bd07263dfdf1cb8a5923470334ef

SHA512
416de58ebc900ab75e8b2f850174fa5c3f0e5de7a95415a8d96511dc9a7bcf5225103dddbca09c0d1eb61d4fe06522324419e9153d83fb42d7020534bb51e7ff

Download Submit
C:\Windows\System\SZZYcoN.exe

Filesize
2.2MB

MD5
98ca4043b939f0638b79d146152dba76

SHA1
954aa42db17686d537d8bb3b134a54ffe136bf4d

SHA256
8a1a02324aded1a373813ed4186947a7e501a42885adcbd98fdd8b6310132dbe

SHA512
db459c4edcab6e73063208ca8fcfea3f20b988806e8dc097ca0cc84932a28ed8e5cbefe03eb543cf9c7d6ee82a6cb8a5d19088ddb825333823c20f022ba9aae5

Download Submit
C:\Windows\System\TqVcjLq.exe

Filesize
2.2MB

MD5
890fd2a97fe14042cbea06a0449c38e8

SHA1
dfbeb81e2476afe07e17f8dc5949bc5b5394f85e

SHA256
aea7915d563f993d38bb5df8ee6d1f3a2717630696c791321e15fc0d6e2c26b4

SHA512
98638c127e4829375ebaceb14588df0a71e2ca370261e06b7092ca985d7716ba9c9f4aa9a970907b248bbe615912722c6230a12edc93242f61e5aca6bbbcdd49

Download Submit
C:\Windows\System\UjacmFj.exe

Filesize
2.2MB

MD5
063bb8487a6b5a6f126b7490a1a73eba

SHA1
43f9cbd39e00d3af4321c983b885f2407676587e

SHA256
f78fcf0dfb0b67635e0570d3ba20ae30a09f41ffa7d75396f6f286977dbf1478

SHA512
a42c505baef269dc7074e4dba6ddf070f6ffb000f544d69012517cad0a357e2cbd100df786171b1651a71282e4bac1fa433a16539c12a78a69b8c307c6082be1

Download Submit
C:\Windows\System\VXSluyN.exe

Filesize
2.2MB

MD5
f94dd4a5b1d3e1dc7fb56fbc989b41b7

SHA1
6a39171f28a7c99e874dcb5f958eea632f8be0a1

SHA256
2bfe3d5d1fb4eec93cb8781efc1567a0d52c2626128995064420ffd7f969235f

SHA512
549618fad6ec17019552a6a65b73f9fa9d59ce28039a5a1c60d03791c2c2d847c0bdd8630c85838f3f021f6a6b24aa7a3132b16285a94923ee75cfd7464790a7

Download Submit
C:\Windows\System\WRyPAvx.exe

Filesize
2.2MB

MD5
152fd4e77946068c48f452882fca6689

SHA1
7053185b928863c98410f6478917df3a40e9b7b9

SHA256
e322d3bab1d9cb5e80072d390758727da68ab05646a8d337e104afe51a3c6041

SHA512
04d0ae533f424caeaf9647b47b2d889e0ce45aafce2380c962ec43a6ae04d0413d2758f2501e865d20efa91861d7f660ab0b10f8d7aff38e02ccfdd3383350bc

Download Submit
C:\Windows\System\WrIvHoW.exe

Filesize
2.2MB

MD5
655e8cebb48f188a7ab5499510d99af1

SHA1
3c7d551542bba8f1d5f0d17e655373325088703d

SHA256
7edf700d77cd8e866280ab59ae23c50231a9e514c9c64af30231f24c7645d027

SHA512
28c092dcc5d643b137e7904b3518101f09fc5061c30cf0561c270fd6a9e5baf59b2e464ca631191fe2dde0f5c313f5a3f1f33ed13a7f815268e9df531a44cbcf

Download Submit
C:\Windows\System\XJzrhdJ.exe

Filesize
2.2MB

MD5
895671e04136a678d8207cdd76ca6d1c

SHA1
19360f6f1b9081a96a7e8e0e79f0ac3c5a998b46

SHA256
374d55b81c1fcf3abcec33b2e4c0fce615da1e2177b2d6e04e850d5d13b2aa4e

SHA512
7b298214f1a88c4bd3794aff684a693f65c1f3697db6eb6898ebc54c1650af1e6f096c926cc3cad1b8ea7e65b9fbfbb4567c8c1143efe6b727f32f299ae0d6da

Download Submit
C:\Windows\System\YvFpXbr.exe

Filesize
2.2MB

MD5
fbd4653c09cb02f1089d988f18c1fedc

SHA1
2146c2cba4002b821c58838e76e9e085275d5ae6

SHA256
3ef9ebcd2f4ff6872037842d47a5e7074897394a5b852dd395b6eaa86be0eb83

SHA512
e644454f076fd2986b27a990652b401b2bef3b95fe8cec77b0991ac645845a4fbc947e9207d06d4c35bbd4cc19f1d1ac2bfacc1266120113fb45867ff5631d91

Download Submit
C:\Windows\System\ajgbCcx.exe

Filesize
2.2MB

MD5
5a968accd2cb0c945c6be22cec03f56c

SHA1
7d3c2308edf1f71d490c9f43a59ce5d1fcf01cac

SHA256
ff4e7e46060d02452aa8ce8710dac0354576424bc1c18bde408c8f757b15d461

SHA512
dfe16399fbfed18027e61e7bb30689a91c57fa0751f7a5f590c0d047222ce71f8c8cfbbe1b94164e7a55bea938c623e82fc7a1bac016e1e39e823dc1cb8c9a4c

Download Submit
C:\Windows\System\eyiLEMP.exe

Filesize
2.2MB

MD5
71f7675ae0f1a796339e13d16fdaad89

SHA1
95c76ce10157340c121ae2ad06c72a331dcf10ca

SHA256
f5e5d22d15be94c5fe39ed33ea944e0d768814b67c15035baad552801ca69940

SHA512
4d92c88f70ab4e278d738b322cc04efa536f91a7ea0bba6ec2aa13c5ab072eaecd3dfbd11fac3677bd133791c7821a61ce3a471b8da4a07d65640a329a8d769b

Download Submit
C:\Windows\System\fAtjyFL.exe

Filesize
2.2MB

MD5
2dfc2becabac40e46f4e12fe393f6f4c

SHA1
00d6581c43ed5bd36dbcaeea6c15a37dcd785b91

SHA256
e82288d19d2b6af6098353ed792690c984d2febe39eb94eddcb1b9c5065af136

SHA512
d434712969a1a934338466beed735500cbbc4cf394f46b810b5e5dc21a3f4035acd326a10ae1cae9b3b5b1f45be4c1567281461f3abfa6e09f476e6dec80b4a5

Download Submit
C:\Windows\System\fugdBof.exe

Filesize
2.2MB

MD5
c4c24fc9ee39ef0efb34f5b402765f1c

SHA1
b08929fc65d1174737e2f4e84bb8ee6af13ad8c2

SHA256
943a08aad16d6f9e2c425978a0faba076f7da526a52b435447193db7ba4106ef

SHA512
8eb60e574172adcd2ce78b0c7f9419dea26721d29933258add502b3760bf44cbc4e08fdb4a11739a4d4d39e6067c3bef620a9581f6bddc6d7037ad077a7f405e

Download Submit
C:\Windows\System\gKQBAtw.exe

Filesize
2.2MB

MD5
a784f48ae81fec30b2509fb9c9803977

SHA1
e4e29dc174bd22740d966ac32147e6be95990b7f

SHA256
e1dfdaccbc6e557e20c945f398b8859a92bbe5dd85283da808e01b4f0947ddc2

SHA512
b0d429a286bfd55c443aaa6ad1b073f85c9a12198d3e65428c92453665ba21d75688c71584940b7039752176209f8d99259bb26faa619637c2b3ba8fe018698a

Download Submit
C:\Windows\System\gndRKVy.exe

Filesize
2.2MB

MD5
5df3778e47dcc14a2d0c75674e88b84e

SHA1
8cdbf80385a9cda0719e9b7bf59c9d7b75f1a51e

SHA256
92d357dfc785aac18242714b9d1936d455d9c016eedfa1e3e4dd9a5c989173ad

SHA512
f737567e0cd70b2b323e975758bcf17f18b7b4e83da0798fb5498329180a7883111b0b6531eccd3d3484b3142a6254ce72b588ccc3ed6946cf7d6d89ba763e3b

Download Submit
C:\Windows\System\hwnrfWl.exe

Filesize
2.2MB

MD5
ea484a1d8c3c89c3c8d4fa0e3de8b94d

SHA1
68c64dad8fe53c95771cfeb554f65e0e54e6a3cb

SHA256
6745883d216407954cb6c0c7685a42988024cc350fbd98f2d6ba29a685dd2a71

SHA512
f55b7bce682c2f0f6cb944f4e0187dc76900beed5ae07ac211a4583db03e0ad386b8e7ac95e8ce5fb8fcec28b9d065b0884c5cbad4c1231b8f5e27773e874369

Download Submit
C:\Windows\System\igQheXG.exe

Filesize
2.2MB

MD5
d1aa45a6ce2dc81fbc2716777ea7c2b8

SHA1
23186d531c598e922fd03a030d139cf67fa625eb

SHA256
c95a96763758bc4de2fc25b56caadd46b6632f0a148e11cadc954127a5f5337d

SHA512
3208a8213f17a531729bef39f531db8820209316f960883e32dfa271b21418d8fb470e73de883c4a31cf9610d7be1913a2f003293f4b8d536523a1cd74e40596

Download Submit
C:\Windows\System\izWtOYv.exe

Filesize
2.2MB

MD5
14cd3599e497bf25c3cad9b7148c9650

SHA1
68e75bc63508bee8e681859e55dd57f0e7c396e7

SHA256
1a35564507b2c52c1dba6d3206d88c5e19907d4525f73e25b772426c681dfe2f

SHA512
d1f798509e2a6c09f172f6f807a7a922747282625d394cccede4e6a255ca97f551ef60d843c2eb59e829beea5adfa11ed069236c90d40cbe210115288e519347

Download Submit
C:\Windows\System\jMQDnBZ.exe

Filesize
2.2MB

MD5
79d2be6466908464e7d0fa031a0eb74f

SHA1
e38096a9a10bc985570fb6145bfc95e22cb546e5

SHA256
3ac5af7b11dee492ae9bf5718612a8886b4f00decae33178d1d223873c58064f

SHA512
31fe9312a71cffabb8fc98ee2ce98be8faa0aac43dffadf7f44a6cb6ca26a391de6c1b0ab6f80d6013044e1f5364193e6d145c7fb1f1870d65101576df78df3d

Download Submit
C:\Windows\System\kAbxtGF.exe

Filesize
2.2MB

MD5
066b952aeacd3e0e2aff158b42ed83a9

SHA1
196b5b1208e9936a8e2939216ce02ec574e89bf3

SHA256
658c853ed894b1f02de7d68240b3a7817b82f2519f5a676b6955cd744de93659

SHA512
3f3237a87e98cdb678e3e4e6df28be46b72563d92adbfca5acc813289731a711b58dddabaebfd2e6e15c5f639fa7e936c44a22f628b37a6a1595c93bdb4dc888

Download Submit
C:\Windows\System\pWfxKlp.exe

Filesize
2.2MB

MD5
5c90d9ee62a7450e6eb6ae7b24b80caa

SHA1
b244ebebc424332456e3d685d0afcde7bffd5262

SHA256
662ef3b55fbe718cb975f95a03aaf1541949f167e854fd7d13fc107158db3281

SHA512
f3cc515777da0c10b4d616035a844c8d4b424c8d60a33c1f5cd684b913a3fe5495285c8d800b7e3354a67f73a3b3618984207dd4119afcba79d90a37ca469e7a

Download Submit
C:\Windows\System\pnPYpll.exe

Filesize
2.2MB

MD5
4b7a3d3db1cb4228f53d77dd62937846

SHA1
371a3913baa997e687cf045f60f7a3856706cde2

SHA256
401d705d263d62e922dce1068915402876ec643514c874c7c24710ffccdf8498

SHA512
c3f2912db39ceae24d050abfe877b9bb70cde3193d6e9c1ca5bcfb8b6a2b72cd4d1a5cb772f179b8ced653b9c6bb8252e21756fb44fb9620e0c772c8541d162c

Download Submit
C:\Windows\System\vRUWWPR.exe

Filesize
2.2MB

MD5
26e743843112caf968b24be6623a90e4

SHA1
192dfe7efa5e1cd18f1250c859ad36c89ab90aeb

SHA256
d7fd19c3e65ac3920e9b5e0c33a1694ee5b3ddad5925d5a348eb50027dc7725f

SHA512
4805aa3409a2966cedd6e4e8a9420901840b0c55f9e9f28a96410a375a5af9d588e62e807ef953bdaee2e4aa56758ca4e6eb438ac3b9fbbc43d8689f45b608e9

Download Submit
C:\Windows\System\vUAfNrX.exe

Filesize
2.2MB

MD5
ba4a150ef0054c0f908a7cd1e2991ee8

SHA1
2acc4e480c1ed32915d84e0966a7c948e244780a

SHA256
c843e4cf30eecb9244c1a6a6aa496566f23180684503cd4e783cb39e1b35aa81

SHA512
9955a4711b1fa3a4515bc5535b7139abcb9619c5c2c86e47cbbeda00dc13e34caed2126fb0825a512921506f415a7541d26fa58789a4366eac0d37823e16971e

Download Submit
C:\Windows\System\wqXTfHA.exe

Filesize
2.2MB

MD5
f7c1299ada3e623257beccd7b2a9fab9

SHA1
31228d4bf72532e99f5f984dc83ed43ab9427951

SHA256
c238aa6e1d8c63569fba2c4c02724c53d9d44239f3b0127c6f7596e6b3170b9e

SHA512
59302d30f4360f117200fd359d2a93b98ec1d6df11289da2d4bdb32b89db53698b23ec06c786a0b59bfbe80d2a3381f6f12c4ae90e6722de46493c4722130558

Download Submit
C:\Windows\System\yQeQEZu.exe

Filesize
2.2MB

MD5
7757dcfd38695817b881e0ba045df265

SHA1
6e3ae1fb2a212dd4025bb794d5a3f0bb57c32209

SHA256
ddf7505e1205b211dd60e2a750c7dc6cd89152ca5a2eb4048aa020c7583f4f37

SHA512
ce181e172ecab03453dee066f634c75cd3157035e25e2f3ff78e2e98b68dc508c68305eb233e12b22715db166e9bd4f188047547e1f75e3b50755e52d838affc

Download Submit
memory/412-0-0x00007FF67B960000-0x00007FF67BD52000-memory.dmp

Filesize
3.9MB

Download
memory/412-147-0x00007FF67B960000-0x00007FF67BD52000-memory.dmp

Filesize
3.9MB

Download
memory/412-1-0x0000020981BD0000-0x0000020981BE0000-memory.dmp

Filesize
64KB

Download
memory/412-117-0x00007FF67B960000-0x00007FF67BD52000-memory.dmp

Filesize
3.9MB

Download
memory/512-64-0x00007FF63FB20000-0x00007FF63FF12000-memory.dmp

Filesize
3.9MB

Download
memory/512-1712-0x00007FF63FB20000-0x00007FF63FF12000-memory.dmp

Filesize
3.9MB

Download
memory/796-229-0x00007FF7B8B30000-0x00007FF7B8F22000-memory.dmp

Filesize
3.9MB

Download
memory/796-2185-0x00007FF7B8B30000-0x00007FF7B8F22000-memory.dmp

Filesize
3.9MB

Download
memory/1048-159-0x00007FF628630000-0x00007FF628A22000-memory.dmp

Filesize
3.9MB

Download
memory/1236-164-0x00007FF617F70000-0x00007FF618362000-memory.dmp

Filesize
3.9MB

Download
memory/1236-2158-0x00007FF617F70000-0x00007FF618362000-memory.dmp

Filesize
3.9MB

Download
memory/1256-2074-0x00007FF646E10000-0x00007FF647202000-memory.dmp

Filesize
3.9MB

Download
memory/1256-128-0x00007FF646E10000-0x00007FF647202000-memory.dmp

Filesize
3.9MB

Download
memory/1528-133-0x00007FF633BA0000-0x00007FF633F92000-memory.dmp

Filesize
3.9MB

Download
memory/1528-2050-0x00007FF633BA0000-0x00007FF633F92000-memory.dmp

Filesize
3.9MB

Download
memory/1864-81-0x00007FF7E2A20000-0x00007FF7E2E12000-memory.dmp

Filesize
3.9MB

Download
memory/1864-1769-0x00007FF7E2A20000-0x00007FF7E2E12000-memory.dmp

Filesize
3.9MB

Download
memory/1900-49-0x00007FF7AADC0000-0x00007FF7AB1B2000-memory.dmp

Filesize
3.9MB

Download
memory/1900-1713-0x00007FF7AADC0000-0x00007FF7AB1B2000-memory.dmp

Filesize
3.9MB

Download
memory/1908-1991-0x00007FF6005E0000-0x00007FF6009D2000-memory.dmp

Filesize
3.9MB

Download
memory/1908-103-0x00007FF6005E0000-0x00007FF6009D2000-memory.dmp

Filesize
3.9MB

Download
memory/2072-113-0x00007FF6FF9E0000-0x00007FF6FFDD2000-memory.dmp

Filesize
3.9MB

Download
memory/2072-1997-0x00007FF6FF9E0000-0x00007FF6FFDD2000-memory.dmp

Filesize
3.9MB

Download
memory/2272-1796-0x00007FF75A9C0000-0x00007FF75ADB2000-memory.dmp

Filesize
3.9MB

Download
memory/2272-79-0x00007FF75A9C0000-0x00007FF75ADB2000-memory.dmp

Filesize
3.9MB

Download
memory/2272-212-0x00007FF75A9C0000-0x00007FF75ADB2000-memory.dmp

Filesize
3.9MB

Download
memory/2340-53-0x00007FF66E6A0000-0x00007FF66EA92000-memory.dmp

Filesize
3.9MB

Download
memory/2340-1714-0x00007FF66E6A0000-0x00007FF66EA92000-memory.dmp

Filesize
3.9MB

Download
memory/2524-71-0x00007FF72C630000-0x00007FF72CA22000-memory.dmp

Filesize
3.9MB

Download
memory/2524-1741-0x00007FF72C630000-0x00007FF72CA22000-memory.dmp

Filesize
3.9MB

Download
memory/2572-224-0x00007FF642AD0000-0x00007FF642EC2000-memory.dmp

Filesize
3.9MB

Download
memory/2592-94-0x00007FF666E80000-0x00007FF667272000-memory.dmp

Filesize
3.9MB

Download
memory/2592-1975-0x00007FF666E80000-0x00007FF667272000-memory.dmp

Filesize
3.9MB

Download
memory/3476-1956-0x00007FF651F90000-0x00007FF652382000-memory.dmp

Filesize
3.9MB

Download
memory/3476-88-0x00007FF651F90000-0x00007FF652382000-memory.dmp

Filesize
3.9MB

Download
memory/3556-1982-0x00007FF609550000-0x00007FF609942000-memory.dmp

Filesize
3.9MB

Download
memory/3556-109-0x00007FF609550000-0x00007FF609942000-memory.dmp

Filesize
3.9MB

Download
memory/4168-1704-0x00007FF6C77D0000-0x00007FF6C7BC2000-memory.dmp

Filesize
3.9MB

Download
memory/4168-57-0x00007FF6C77D0000-0x00007FF6C7BC2000-memory.dmp

Filesize
3.9MB

Download
memory/4312-2188-0x00007FF62F970000-0x00007FF62FD62000-memory.dmp

Filesize
3.9MB

Download
memory/4312-205-0x00007FF62F970000-0x00007FF62FD62000-memory.dmp

Filesize
3.9MB

Download
memory/4668-129-0x00007FFC4E983000-0x00007FFC4E985000-memory.dmp

Filesize
8KB

Download
memory/4668-20-0x000001E1F85D0000-0x000001E1F85F2000-memory.dmp

Filesize
136KB

Download
memory/4668-47-0x00007FFC4E980000-0x00007FFC4F441000-memory.dmp

Filesize
10.8MB

Download
memory/4668-165-0x000001E1FA4C0000-0x000001E1FBB37000-memory.dmp

Filesize
22.5MB

Download
memory/4668-82-0x000001E1F9D10000-0x000001E1FA4B6000-memory.dmp

Filesize
7.6MB

Download
memory/4668-4-0x00007FFC4E983000-0x00007FFC4E985000-memory.dmp

Filesize
8KB

Download
memory/4668-146-0x00007FFC4E980000-0x00007FFC4F441000-memory.dmp

Filesize
10.8MB

Download
memory/4668-43-0x00007FFC4E980000-0x00007FFC4F441000-memory.dmp

Filesize
10.8MB

Download
memory/4672-1708-0x00007FF6C12F0000-0x00007FF6C16E2000-memory.dmp

Filesize
3.9MB

Download
memory/4672-61-0x00007FF6C12F0000-0x00007FF6C16E2000-memory.dmp

Filesize
3.9MB

Download
memory/4688-152-0x00007FF709D90000-0x00007FF70A182000-memory.dmp

Filesize
3.9MB

Download
memory/5048-80-0x00007FF7AF340000-0x00007FF7AF732000-memory.dmp

Filesize
3.9MB

Download
memory/5048-1760-0x00007FF7AF340000-0x00007FF7AF732000-memory.dmp

Filesize
3.9MB

Download
memory/5060-67-0x00007FF7F8E40000-0x00007FF7F9232000-memory.dmp

Filesize
3.9MB

Download
memory/5060-1706-0x00007FF7F8E40000-0x00007FF7F9232000-memory.dmp

Filesize
3.9MB

Download
memory/5064-1717-0x00007FF658A80000-0x00007FF658E72000-memory.dmp

Filesize
3.9MB

Download
memory/5064-68-0x00007FF658A80000-0x00007FF658E72000-memory.dmp

Filesize
3.9MB

Download