xmrig | 909a3987a29267613b5a96530485723fb4ec7ff981e71a96b1fe2c1b6e8aea4c

Analysis

max time kernel
116s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2024, 05:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
Size

1.6MB
MD5

b690185077d04c38e4fa85ddcfdc5666
SHA1

7f785ac5502bfe6c103504e165d1c3ef4e92bf8d
SHA256

909a3987a29267613b5a96530485723fb4ec7ff981e71a96b1fe2c1b6e8aea4c
SHA512

5a34b4c655825556956592981d41b7eed7326dbcca7245de145b8c7905f5472d23dd9a6cbe416b3bebc56b4d567a8111d4beea68569a07f641e1070f8b072151
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82Sz66E:NABf

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 47 IoCs

miner

resource	yara_rule
behavioral2/memory/5016-188-0x00007FF609030000-0x00007FF609422000-memory.dmp	xmrig
behavioral2/memory/668-212-0x00007FF6DAF40000-0x00007FF6DB332000-memory.dmp	xmrig
behavioral2/memory/4816-219-0x00007FF6439D0000-0x00007FF643DC2000-memory.dmp	xmrig
behavioral2/memory/1804-239-0x00007FF72FE50000-0x00007FF730242000-memory.dmp	xmrig
behavioral2/memory/4800-246-0x00007FF610580000-0x00007FF610972000-memory.dmp	xmrig
behavioral2/memory/4516-252-0x00007FF63DE50000-0x00007FF63E242000-memory.dmp	xmrig
behavioral2/memory/4500-251-0x00007FF6260F0000-0x00007FF6264E2000-memory.dmp	xmrig
behavioral2/memory/5068-250-0x00007FF67D420000-0x00007FF67D812000-memory.dmp	xmrig
behavioral2/memory/3284-249-0x00007FF63F320000-0x00007FF63F712000-memory.dmp	xmrig
behavioral2/memory/3924-248-0x00007FF706A40000-0x00007FF706E32000-memory.dmp	xmrig
behavioral2/memory/1160-247-0x00007FF76DE00000-0x00007FF76E1F2000-memory.dmp	xmrig
behavioral2/memory/1000-241-0x00007FF6B1200000-0x00007FF6B15F2000-memory.dmp	xmrig
behavioral2/memory/2924-238-0x00007FF701280000-0x00007FF701672000-memory.dmp	xmrig
behavioral2/memory/2440-235-0x00007FF678A70000-0x00007FF678E62000-memory.dmp	xmrig
behavioral2/memory/348-207-0x00007FF6C0930000-0x00007FF6C0D22000-memory.dmp	xmrig
behavioral2/memory/4952-187-0x00007FF6116A0000-0x00007FF611A92000-memory.dmp	xmrig
behavioral2/memory/4920-162-0x00007FF741C60000-0x00007FF742052000-memory.dmp	xmrig
behavioral2/memory/1176-50-0x00007FF640530000-0x00007FF640922000-memory.dmp	xmrig
behavioral2/memory/2720-2019-0x00007FF732440000-0x00007FF732832000-memory.dmp	xmrig
behavioral2/memory/4916-2083-0x00007FF60C890000-0x00007FF60CC82000-memory.dmp	xmrig
behavioral2/memory/2272-2460-0x00007FF766580000-0x00007FF766972000-memory.dmp	xmrig
behavioral2/memory/3380-2457-0x00007FF72E840000-0x00007FF72EC32000-memory.dmp	xmrig
behavioral2/memory/1912-2047-0x00007FF7267B0000-0x00007FF726BA2000-memory.dmp	xmrig
behavioral2/memory/3380-4214-0x00007FF72E840000-0x00007FF72EC32000-memory.dmp	xmrig
behavioral2/memory/1176-4216-0x00007FF640530000-0x00007FF640922000-memory.dmp	xmrig
behavioral2/memory/1912-4233-0x00007FF7267B0000-0x00007FF726BA2000-memory.dmp	xmrig
behavioral2/memory/2272-4244-0x00007FF766580000-0x00007FF766972000-memory.dmp	xmrig
behavioral2/memory/4916-4247-0x00007FF60C890000-0x00007FF60CC82000-memory.dmp	xmrig
behavioral2/memory/4920-4245-0x00007FF741C60000-0x00007FF742052000-memory.dmp	xmrig
behavioral2/memory/3924-4241-0x00007FF706A40000-0x00007FF706E32000-memory.dmp	xmrig
behavioral2/memory/4800-4250-0x00007FF610580000-0x00007FF610972000-memory.dmp	xmrig
behavioral2/memory/668-4251-0x00007FF6DAF40000-0x00007FF6DB332000-memory.dmp	xmrig
behavioral2/memory/4516-4294-0x00007FF63DE50000-0x00007FF63E242000-memory.dmp	xmrig
behavioral2/memory/1804-4292-0x00007FF72FE50000-0x00007FF730242000-memory.dmp	xmrig
behavioral2/memory/2924-4290-0x00007FF701280000-0x00007FF701672000-memory.dmp	xmrig
behavioral2/memory/2440-4277-0x00007FF678A70000-0x00007FF678E62000-memory.dmp	xmrig
behavioral2/memory/348-4274-0x00007FF6C0930000-0x00007FF6C0D22000-memory.dmp	xmrig
behavioral2/memory/1160-4272-0x00007FF76DE00000-0x00007FF76E1F2000-memory.dmp	xmrig
behavioral2/memory/4816-4269-0x00007FF6439D0000-0x00007FF643DC2000-memory.dmp	xmrig
behavioral2/memory/2624-4266-0x00007FF7B92A0000-0x00007FF7B9692000-memory.dmp	xmrig
behavioral2/memory/1000-4262-0x00007FF6B1200000-0x00007FF6B15F2000-memory.dmp	xmrig
behavioral2/memory/4500-4260-0x00007FF6260F0000-0x00007FF6264E2000-memory.dmp	xmrig
behavioral2/memory/5072-4256-0x00007FF6BEC90000-0x00007FF6BF082000-memory.dmp	xmrig
behavioral2/memory/5016-4267-0x00007FF609030000-0x00007FF609422000-memory.dmp	xmrig
behavioral2/memory/5068-4264-0x00007FF67D420000-0x00007FF67D812000-memory.dmp	xmrig
behavioral2/memory/3284-4258-0x00007FF63F320000-0x00007FF63F712000-memory.dmp	xmrig
behavioral2/memory/4952-4254-0x00007FF6116A0000-0x00007FF611A92000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
9	1964	powershell.exe
11	1964	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1964	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3380	YWotKGH.exe
1912	ifHbopJ.exe
3924	olqfQCL.exe
2272	igaTUqH.exe
1176	ZZGkYFf.exe
4916	bIdqeXV.exe
2624	vbOpJHe.exe
3284	wMeernR.exe
5072	uquAtKH.exe
4920	jLHeZfa.exe
5068	dDfMeoz.exe
4952	QXwwuFY.exe
5016	urMniOO.exe
348	cZYeNzH.exe
4500	BeNxWTG.exe
668	TnXKMbI.exe
4816	lmsFqry.exe
2440	uAiiBTH.exe
2924	ZsVLFxc.exe
1804	dtogetI.exe
1000	pHkcerO.exe
4800	DxLXTCL.exe
4516	CDpMRGg.exe
1160	kpEfMXD.exe
4668	HJAVDUw.exe
2124	oMczSFh.exe
1240	wQkqCst.exe
3292	JhiGyDm.exe
752	MzsOHkb.exe
3264	LYyRhEd.exe
3780	wSfnSkT.exe
2780	FfpoYSq.exe
3152	qgnFcsA.exe
4568	NPwBaIH.exe
3064	UAlSLWb.exe
5100	EMEXobS.exe
5084	EVdWuaP.exe
1548	wKjAWgn.exe
4116	unCvXRZ.exe
1568	HUJFWQR.exe
2896	mCJgAWA.exe
3656	HBFjWsr.exe
3824	frZtCEO.exe
4472	wSkURGq.exe
2432	BrRoffF.exe
408	dEWsJTU.exe
2344	PVWDTGZ.exe
3884	gXETvdl.exe
4192	JzIUyNg.exe
4664	XxslPhN.exe
4380	ugFEJyB.exe
1660	NTOPKLD.exe
4036	fifOqyb.exe
1752	yIIDixi.exe
384	naRfKAu.exe
876	xHHaAWx.exe
2436	zfXLqQS.exe
764	JgrFGsM.exe
3172	tjnizBt.exe
4484	EwZWTnn.exe
4844	QeWibgq.exe
1644	AInTUYH.exe
2268	JAQPLvy.exe
1080	bKjKLAt.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2720-0-0x00007FF732440000-0x00007FF732832000-memory.dmp	upx
behavioral2/memory/3380-17-0x00007FF72E840000-0x00007FF72EC32000-memory.dmp	upx
behavioral2/files/0x00080000000234f9-13.dat	upx
behavioral2/files/0x0007000000023503-26.dat	upx
behavioral2/files/0x0007000000023501-54.dat	upx
behavioral2/files/0x0007000000023502-59.dat	upx
behavioral2/files/0x000700000002350f-83.dat	upx
behavioral2/files/0x0007000000023518-144.dat	upx
behavioral2/files/0x0007000000023519-149.dat	upx
behavioral2/files/0x0007000000023520-179.dat	upx
behavioral2/memory/5016-188-0x00007FF609030000-0x00007FF609422000-memory.dmp	upx
behavioral2/memory/668-212-0x00007FF6DAF40000-0x00007FF6DB332000-memory.dmp	upx
behavioral2/memory/4816-219-0x00007FF6439D0000-0x00007FF643DC2000-memory.dmp	upx
behavioral2/memory/1804-239-0x00007FF72FE50000-0x00007FF730242000-memory.dmp	upx
behavioral2/memory/4800-246-0x00007FF610580000-0x00007FF610972000-memory.dmp	upx
behavioral2/memory/4516-252-0x00007FF63DE50000-0x00007FF63E242000-memory.dmp	upx
behavioral2/memory/4500-251-0x00007FF6260F0000-0x00007FF6264E2000-memory.dmp	upx
behavioral2/memory/5068-250-0x00007FF67D420000-0x00007FF67D812000-memory.dmp	upx
behavioral2/memory/3284-249-0x00007FF63F320000-0x00007FF63F712000-memory.dmp	upx
behavioral2/memory/3924-248-0x00007FF706A40000-0x00007FF706E32000-memory.dmp	upx
behavioral2/memory/1160-247-0x00007FF76DE00000-0x00007FF76E1F2000-memory.dmp	upx
behavioral2/memory/1000-241-0x00007FF6B1200000-0x00007FF6B15F2000-memory.dmp	upx
behavioral2/memory/2924-238-0x00007FF701280000-0x00007FF701672000-memory.dmp	upx
behavioral2/memory/2440-235-0x00007FF678A70000-0x00007FF678E62000-memory.dmp	upx
behavioral2/memory/348-207-0x00007FF6C0930000-0x00007FF6C0D22000-memory.dmp	upx
behavioral2/memory/4952-187-0x00007FF6116A0000-0x00007FF611A92000-memory.dmp	upx
behavioral2/files/0x0007000000023521-185.dat	upx
behavioral2/files/0x000700000002351e-181.dat	upx
behavioral2/files/0x000700000002351f-178.dat	upx
behavioral2/files/0x000700000002351d-174.dat	upx
behavioral2/files/0x000700000002351c-173.dat	upx
behavioral2/files/0x0007000000023516-172.dat	upx
behavioral2/files/0x000700000002351b-166.dat	upx
behavioral2/files/0x0007000000023514-164.dat	upx
behavioral2/memory/4920-162-0x00007FF741C60000-0x00007FF742052000-memory.dmp	upx
behavioral2/files/0x00080000000234fd-157.dat	upx
behavioral2/files/0x0007000000023513-156.dat	upx
behavioral2/files/0x000700000002351a-154.dat	upx
behavioral2/files/0x0007000000023517-138.dat	upx
behavioral2/files/0x0007000000023515-135.dat	upx
behavioral2/files/0x000700000002350c-127.dat	upx
behavioral2/memory/5072-124-0x00007FF6BEC90000-0x00007FF6BF082000-memory.dmp	upx
behavioral2/files/0x0007000000023512-123.dat	upx
behavioral2/files/0x0007000000023511-119.dat	upx
behavioral2/files/0x0007000000023509-118.dat	upx
behavioral2/files/0x000700000002350e-116.dat	upx
behavioral2/files/0x000700000002350a-112.dat	upx
behavioral2/memory/2624-107-0x00007FF7B92A0000-0x00007FF7B9692000-memory.dmp	upx
behavioral2/files/0x000700000002350d-104.dat	upx
behavioral2/files/0x000700000002350b-101.dat	upx
behavioral2/files/0x0007000000023510-93.dat	upx
behavioral2/files/0x0007000000023506-92.dat	upx
behavioral2/files/0x0007000000023505-86.dat	upx
behavioral2/memory/4916-77-0x00007FF60C890000-0x00007FF60CC82000-memory.dmp	upx
behavioral2/files/0x0007000000023507-98.dat	upx
behavioral2/files/0x0007000000023504-64.dat	upx
behavioral2/files/0x0007000000023508-46.dat	upx
behavioral2/memory/1176-50-0x00007FF640530000-0x00007FF640922000-memory.dmp	upx
behavioral2/memory/2272-35-0x00007FF766580000-0x00007FF766972000-memory.dmp	upx
behavioral2/files/0x0007000000023500-34.dat	upx
behavioral2/memory/1912-31-0x00007FF7267B0000-0x00007FF726BA2000-memory.dmp	upx
behavioral2/memory/2720-2019-0x00007FF732440000-0x00007FF732832000-memory.dmp	upx
behavioral2/memory/4916-2083-0x00007FF60C890000-0x00007FF60CC82000-memory.dmp	upx
behavioral2/memory/2272-2460-0x00007FF766580000-0x00007FF766972000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\LeETwPD.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\PgmonOr.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\zKLVjcv.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\lBsGLDn.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\RgGMmfK.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\nYgMzXX.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\frXUPLV.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\UgbbHAh.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\jgrNpKj.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\HIKxCfR.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\tCnvAkZ.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\Vxcmqdb.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\AWmFqJU.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\rdZdWLw.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\ieUSzGs.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\RcdtKTz.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\eGbqSXG.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\XRCuwva.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\icYulce.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\fOJtfeY.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\kOtGHnH.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\eqBvIvS.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\wHUlIUn.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\fNwOZNy.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\rZzfyaU.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\dvLLWis.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\kFFMUmr.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\nHGDXsE.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\xVSKlIQ.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\EATzwOH.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\eEjjjIa.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\HUJFWQR.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\kFlrGBk.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\YsxJXQD.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\szvinuz.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\NaUazSZ.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\hZVYIIq.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\qwHFYyE.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\lVaBGKO.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\UxdEwgL.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\TCqCuXQ.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\EUibbLQ.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\cfBsfHh.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\scxubib.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\hvhyhmk.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\WLSdRlN.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\wkzjoZW.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\abTaKYX.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\AlHMYYt.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\BQRcgbt.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\sCzbLtH.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\kZKBJvt.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\zPucfQx.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\KEYmBLo.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\gfBWSPw.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\YbgPIlJ.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\rLJsLwZ.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\apwTDYY.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\XxslPhN.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\CjnoTtI.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\NwgmrfP.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\drHSEZe.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\bKaqMuY.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\UAlSLWb.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1964	powershell.exe
1964	powershell.exe
1964	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
Token: SeDebugPrivilege	1964	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 1964	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	87
PID 2720 wrote to memory of 1964	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	87
PID 2720 wrote to memory of 3380	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	88
PID 2720 wrote to memory of 3380	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	88
PID 2720 wrote to memory of 1912	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	89
PID 2720 wrote to memory of 1912	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	89
PID 2720 wrote to memory of 3924	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	90
PID 2720 wrote to memory of 3924	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	90
PID 2720 wrote to memory of 2272	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	91
PID 2720 wrote to memory of 2272	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	91
PID 2720 wrote to memory of 1176	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	92
PID 2720 wrote to memory of 1176	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	92
PID 2720 wrote to memory of 4916	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	93
PID 2720 wrote to memory of 4916	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	93
PID 2720 wrote to memory of 2624	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	94
PID 2720 wrote to memory of 2624	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	94
PID 2720 wrote to memory of 3284	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	95
PID 2720 wrote to memory of 3284	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	95
PID 2720 wrote to memory of 5072	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	96
PID 2720 wrote to memory of 5072	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	96
PID 2720 wrote to memory of 4920	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	97
PID 2720 wrote to memory of 4920	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	97
PID 2720 wrote to memory of 5068	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	98
PID 2720 wrote to memory of 5068	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	98
PID 2720 wrote to memory of 4952	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	99
PID 2720 wrote to memory of 4952	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	99
PID 2720 wrote to memory of 5016	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	100
PID 2720 wrote to memory of 5016	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	100
PID 2720 wrote to memory of 1000	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	101
PID 2720 wrote to memory of 1000	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	101
PID 2720 wrote to memory of 348	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	102
PID 2720 wrote to memory of 348	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	102
PID 2720 wrote to memory of 4500	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	103
PID 2720 wrote to memory of 4500	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	103
PID 2720 wrote to memory of 668	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	104
PID 2720 wrote to memory of 668	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	104
PID 2720 wrote to memory of 4816	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	105
PID 2720 wrote to memory of 4816	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	105
PID 2720 wrote to memory of 2440	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	106
PID 2720 wrote to memory of 2440	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	106
PID 2720 wrote to memory of 2924	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	107
PID 2720 wrote to memory of 2924	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	107
PID 2720 wrote to memory of 1804	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	108
PID 2720 wrote to memory of 1804	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	108
PID 2720 wrote to memory of 1240	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	109
PID 2720 wrote to memory of 1240	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	109
PID 2720 wrote to memory of 4800	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	110
PID 2720 wrote to memory of 4800	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	110
PID 2720 wrote to memory of 4516	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	111
PID 2720 wrote to memory of 4516	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	111
PID 2720 wrote to memory of 1160	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	112
PID 2720 wrote to memory of 1160	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	112
PID 2720 wrote to memory of 4668	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	113
PID 2720 wrote to memory of 4668	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	113
PID 2720 wrote to memory of 2124	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	114
PID 2720 wrote to memory of 2124	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	114
PID 2720 wrote to memory of 3292	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	115
PID 2720 wrote to memory of 3292	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	115
PID 2720 wrote to memory of 752	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	116
PID 2720 wrote to memory of 752	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	116
PID 2720 wrote to memory of 3264	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	117
PID 2720 wrote to memory of 3264	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	117
PID 2720 wrote to memory of 3780	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	118
PID 2720 wrote to memory of 3780	2720	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	118

C:\Users\Admin\AppData\Local\Temp\b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1964
- C:\Windows\System\YWotKGH.exe
  C:\Windows\System\YWotKGH.exe
  2⤵
  - Executes dropped EXE
  PID:3380
- C:\Windows\System\ifHbopJ.exe
  C:\Windows\System\ifHbopJ.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\olqfQCL.exe
  C:\Windows\System\olqfQCL.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\igaTUqH.exe
  C:\Windows\System\igaTUqH.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\ZZGkYFf.exe
  C:\Windows\System\ZZGkYFf.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\bIdqeXV.exe
  C:\Windows\System\bIdqeXV.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\vbOpJHe.exe
  C:\Windows\System\vbOpJHe.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\wMeernR.exe
  C:\Windows\System\wMeernR.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System\uquAtKH.exe
  C:\Windows\System\uquAtKH.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\jLHeZfa.exe
  C:\Windows\System\jLHeZfa.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\dDfMeoz.exe
  C:\Windows\System\dDfMeoz.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\QXwwuFY.exe
  C:\Windows\System\QXwwuFY.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\urMniOO.exe
  C:\Windows\System\urMniOO.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\pHkcerO.exe
  C:\Windows\System\pHkcerO.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\cZYeNzH.exe
  C:\Windows\System\cZYeNzH.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\BeNxWTG.exe
  C:\Windows\System\BeNxWTG.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\TnXKMbI.exe
  C:\Windows\System\TnXKMbI.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\lmsFqry.exe
  C:\Windows\System\lmsFqry.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\uAiiBTH.exe
  C:\Windows\System\uAiiBTH.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\ZsVLFxc.exe
  C:\Windows\System\ZsVLFxc.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\dtogetI.exe
  C:\Windows\System\dtogetI.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\wQkqCst.exe
  C:\Windows\System\wQkqCst.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\DxLXTCL.exe
  C:\Windows\System\DxLXTCL.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\CDpMRGg.exe
  C:\Windows\System\CDpMRGg.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\kpEfMXD.exe
  C:\Windows\System\kpEfMXD.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\HJAVDUw.exe
  C:\Windows\System\HJAVDUw.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\oMczSFh.exe
  C:\Windows\System\oMczSFh.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\JhiGyDm.exe
  C:\Windows\System\JhiGyDm.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\MzsOHkb.exe
  C:\Windows\System\MzsOHkb.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\LYyRhEd.exe
  C:\Windows\System\LYyRhEd.exe
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Windows\System\wSfnSkT.exe
  C:\Windows\System\wSfnSkT.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System\FfpoYSq.exe
  C:\Windows\System\FfpoYSq.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\qgnFcsA.exe
  C:\Windows\System\qgnFcsA.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\NPwBaIH.exe
  C:\Windows\System\NPwBaIH.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\UAlSLWb.exe
  C:\Windows\System\UAlSLWb.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\EMEXobS.exe
  C:\Windows\System\EMEXobS.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\EVdWuaP.exe
  C:\Windows\System\EVdWuaP.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\wKjAWgn.exe
  C:\Windows\System\wKjAWgn.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\unCvXRZ.exe
  C:\Windows\System\unCvXRZ.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System\HUJFWQR.exe
  C:\Windows\System\HUJFWQR.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\mCJgAWA.exe
  C:\Windows\System\mCJgAWA.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\HBFjWsr.exe
  C:\Windows\System\HBFjWsr.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\frZtCEO.exe
  C:\Windows\System\frZtCEO.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\wSkURGq.exe
  C:\Windows\System\wSkURGq.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\BrRoffF.exe
  C:\Windows\System\BrRoffF.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\dEWsJTU.exe
  C:\Windows\System\dEWsJTU.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\PVWDTGZ.exe
  C:\Windows\System\PVWDTGZ.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\gXETvdl.exe
  C:\Windows\System\gXETvdl.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System\JzIUyNg.exe
  C:\Windows\System\JzIUyNg.exe
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Windows\System\XxslPhN.exe
  C:\Windows\System\XxslPhN.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\ugFEJyB.exe
  C:\Windows\System\ugFEJyB.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\NTOPKLD.exe
  C:\Windows\System\NTOPKLD.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\fifOqyb.exe
  C:\Windows\System\fifOqyb.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\yIIDixi.exe
  C:\Windows\System\yIIDixi.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\naRfKAu.exe
  C:\Windows\System\naRfKAu.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\xHHaAWx.exe
  C:\Windows\System\xHHaAWx.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\zfXLqQS.exe
  C:\Windows\System\zfXLqQS.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\JgrFGsM.exe
  C:\Windows\System\JgrFGsM.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\JAQPLvy.exe
  C:\Windows\System\JAQPLvy.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\tjnizBt.exe
  C:\Windows\System\tjnizBt.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\EwZWTnn.exe
  C:\Windows\System\EwZWTnn.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\QeWibgq.exe
  C:\Windows\System\QeWibgq.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\AInTUYH.exe
  C:\Windows\System\AInTUYH.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\bKjKLAt.exe
  C:\Windows\System\bKjKLAt.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\GUfrXrs.exe
  C:\Windows\System\GUfrXrs.exe
  2⤵
  PID:3684
- C:\Windows\System\UAkleSn.exe
  C:\Windows\System\UAkleSn.exe
  2⤵
  PID:3748
- C:\Windows\System\INnnSER.exe
  C:\Windows\System\INnnSER.exe
  2⤵
  PID:3904
- C:\Windows\System\UFTqotN.exe
  C:\Windows\System\UFTqotN.exe
  2⤵
  PID:1412
- C:\Windows\System\WhDOSsn.exe
  C:\Windows\System\WhDOSsn.exe
  2⤵
  PID:2684
- C:\Windows\System\gJmwwyM.exe
  C:\Windows\System\gJmwwyM.exe
  2⤵
  PID:4672
- C:\Windows\System\iDOzxtb.exe
  C:\Windows\System\iDOzxtb.exe
  2⤵
  PID:4032
- C:\Windows\System\NXRwTuZ.exe
  C:\Windows\System\NXRwTuZ.exe
  2⤵
  PID:4088
- C:\Windows\System\dMhcqpm.exe
  C:\Windows\System\dMhcqpm.exe
  2⤵
  PID:4892
- C:\Windows\System\BuyTDcn.exe
  C:\Windows\System\BuyTDcn.exe
  2⤵
  PID:3212
- C:\Windows\System\tzJUrQg.exe
  C:\Windows\System\tzJUrQg.exe
  2⤵
  PID:1016
- C:\Windows\System\mxtKzou.exe
  C:\Windows\System\mxtKzou.exe
  2⤵
  PID:2912
- C:\Windows\System\WpBQPqW.exe
  C:\Windows\System\WpBQPqW.exe
  2⤵
  PID:1636
- C:\Windows\System\nbBzMCC.exe
  C:\Windows\System\nbBzMCC.exe
  2⤵
  PID:2880
- C:\Windows\System\LfGhEFM.exe
  C:\Windows\System\LfGhEFM.exe
  2⤵
  PID:736
- C:\Windows\System\ofrBsXz.exe
  C:\Windows\System\ofrBsXz.exe
  2⤵
  PID:116
- C:\Windows\System\QPwHPTF.exe
  C:\Windows\System\QPwHPTF.exe
  2⤵
  PID:4572
- C:\Windows\System\ExZrYbv.exe
  C:\Windows\System\ExZrYbv.exe
  2⤵
  PID:212
- C:\Windows\System\tgVbFOy.exe
  C:\Windows\System\tgVbFOy.exe
  2⤵
  PID:2044
- C:\Windows\System\slefSJH.exe
  C:\Windows\System\slefSJH.exe
  2⤵
  PID:4612
- C:\Windows\System\fOJtfeY.exe
  C:\Windows\System\fOJtfeY.exe
  2⤵
  PID:1584
- C:\Windows\System\dvLLWis.exe
  C:\Windows\System\dvLLWis.exe
  2⤵
  PID:5128
- C:\Windows\System\CMZfmEF.exe
  C:\Windows\System\CMZfmEF.exe
  2⤵
  PID:5156
- C:\Windows\System\UhkjyRH.exe
  C:\Windows\System\UhkjyRH.exe
  2⤵
  PID:5172
- C:\Windows\System\rGqHIav.exe
  C:\Windows\System\rGqHIav.exe
  2⤵
  PID:5192
- C:\Windows\System\AcEjWtt.exe
  C:\Windows\System\AcEjWtt.exe
  2⤵
  PID:5212
- C:\Windows\System\frrnNxN.exe
  C:\Windows\System\frrnNxN.exe
  2⤵
  PID:5240
- C:\Windows\System\kChJeNF.exe
  C:\Windows\System\kChJeNF.exe
  2⤵
  PID:5272
- C:\Windows\System\ecWHsfO.exe
  C:\Windows\System\ecWHsfO.exe
  2⤵
  PID:5288
- C:\Windows\System\SLhJyYa.exe
  C:\Windows\System\SLhJyYa.exe
  2⤵
  PID:5312
- C:\Windows\System\aaPxuZj.exe
  C:\Windows\System\aaPxuZj.exe
  2⤵
  PID:5352
- C:\Windows\System\txyrFgN.exe
  C:\Windows\System\txyrFgN.exe
  2⤵
  PID:5372
- C:\Windows\System\YgLDSkn.exe
  C:\Windows\System\YgLDSkn.exe
  2⤵
  PID:5392
- C:\Windows\System\oPTgOZk.exe
  C:\Windows\System\oPTgOZk.exe
  2⤵
  PID:5420
- C:\Windows\System\lvULjsZ.exe
  C:\Windows\System\lvULjsZ.exe
  2⤵
  PID:5452
- C:\Windows\System\GDSyelu.exe
  C:\Windows\System\GDSyelu.exe
  2⤵
  PID:5468
- C:\Windows\System\oenDdEH.exe
  C:\Windows\System\oenDdEH.exe
  2⤵
  PID:5488
- C:\Windows\System\LlBqWKd.exe
  C:\Windows\System\LlBqWKd.exe
  2⤵
  PID:5508
- C:\Windows\System\ocpBGlm.exe
  C:\Windows\System\ocpBGlm.exe
  2⤵
  PID:5536
- C:\Windows\System\luRpRhA.exe
  C:\Windows\System\luRpRhA.exe
  2⤵
  PID:5552
- C:\Windows\System\PkvLxTT.exe
  C:\Windows\System\PkvLxTT.exe
  2⤵
  PID:5580
- C:\Windows\System\ZNkXwrd.exe
  C:\Windows\System\ZNkXwrd.exe
  2⤵
  PID:5596
- C:\Windows\System\OTHIXKg.exe
  C:\Windows\System\OTHIXKg.exe
  2⤵
  PID:5624
- C:\Windows\System\NsARZvd.exe
  C:\Windows\System\NsARZvd.exe
  2⤵
  PID:5648
- C:\Windows\System\fhhLaLV.exe
  C:\Windows\System\fhhLaLV.exe
  2⤵
  PID:5664
- C:\Windows\System\VcBeqIo.exe
  C:\Windows\System\VcBeqIo.exe
  2⤵
  PID:5696
- C:\Windows\System\bdNbcUk.exe
  C:\Windows\System\bdNbcUk.exe
  2⤵
  PID:5712
- C:\Windows\System\yZCfqTP.exe
  C:\Windows\System\yZCfqTP.exe
  2⤵
  PID:5740
- C:\Windows\System\PeaeCgr.exe
  C:\Windows\System\PeaeCgr.exe
  2⤵
  PID:5760
- C:\Windows\System\QYXtLVo.exe
  C:\Windows\System\QYXtLVo.exe
  2⤵
  PID:5788
- C:\Windows\System\PgmonOr.exe
  C:\Windows\System\PgmonOr.exe
  2⤵
  PID:5804
- C:\Windows\System\IWwbgjQ.exe
  C:\Windows\System\IWwbgjQ.exe
  2⤵
  PID:5824
- C:\Windows\System\FVPfFZQ.exe
  C:\Windows\System\FVPfFZQ.exe
  2⤵
  PID:5852
- C:\Windows\System\MhsJoec.exe
  C:\Windows\System\MhsJoec.exe
  2⤵
  PID:5872
- C:\Windows\System\FZLNsXo.exe
  C:\Windows\System\FZLNsXo.exe
  2⤵
  PID:5896
- C:\Windows\System\hcDefFS.exe
  C:\Windows\System\hcDefFS.exe
  2⤵
  PID:5916
- C:\Windows\System\xQFaltu.exe
  C:\Windows\System\xQFaltu.exe
  2⤵
  PID:5932
- C:\Windows\System\iYvWVHJ.exe
  C:\Windows\System\iYvWVHJ.exe
  2⤵
  PID:5956
- C:\Windows\System\HlnEKRn.exe
  C:\Windows\System\HlnEKRn.exe
  2⤵
  PID:5980
- C:\Windows\System\KkdTmJd.exe
  C:\Windows\System\KkdTmJd.exe
  2⤵
  PID:6008
- C:\Windows\System\PMwNnDN.exe
  C:\Windows\System\PMwNnDN.exe
  2⤵
  PID:6024
- C:\Windows\System\tRwMEAL.exe
  C:\Windows\System\tRwMEAL.exe
  2⤵
  PID:6048
- C:\Windows\System\jmkuCMW.exe
  C:\Windows\System\jmkuCMW.exe
  2⤵
  PID:6068
- C:\Windows\System\OCnOJhc.exe
  C:\Windows\System\OCnOJhc.exe
  2⤵
  PID:6092
- C:\Windows\System\wKESGzx.exe
  C:\Windows\System\wKESGzx.exe
  2⤵
  PID:6112
- C:\Windows\System\FzuDFzL.exe
  C:\Windows\System\FzuDFzL.exe
  2⤵
  PID:6136
- C:\Windows\System\PfEKgfC.exe
  C:\Windows\System\PfEKgfC.exe
  2⤵
  PID:3900
- C:\Windows\System\yCuGIbu.exe
  C:\Windows\System\yCuGIbu.exe
  2⤵
  PID:232
- C:\Windows\System\CXNnuko.exe
  C:\Windows\System\CXNnuko.exe
  2⤵
  PID:3500
- C:\Windows\System\nKpzFHk.exe
  C:\Windows\System\nKpzFHk.exe
  2⤵
  PID:4388
- C:\Windows\System\LoAQECM.exe
  C:\Windows\System\LoAQECM.exe
  2⤵
  PID:224
- C:\Windows\System\VpDWpbf.exe
  C:\Windows\System\VpDWpbf.exe
  2⤵
  PID:3148
- C:\Windows\System\lOrRaLA.exe
  C:\Windows\System\lOrRaLA.exe
  2⤵
  PID:5184
- C:\Windows\System\HbRjGxi.exe
  C:\Windows\System\HbRjGxi.exe
  2⤵
  PID:5300
- C:\Windows\System\QBHPZhY.exe
  C:\Windows\System\QBHPZhY.exe
  2⤵
  PID:812
- C:\Windows\System\OcoCvSd.exe
  C:\Windows\System\OcoCvSd.exe
  2⤵
  PID:5124
- C:\Windows\System\NuzdFbl.exe
  C:\Windows\System\NuzdFbl.exe
  2⤵
  PID:5164
- C:\Windows\System\TDgIpRG.exe
  C:\Windows\System\TDgIpRG.exe
  2⤵
  PID:4480
- C:\Windows\System\rGbeyyR.exe
  C:\Windows\System\rGbeyyR.exe
  2⤵
  PID:5252
- C:\Windows\System\WuMpTTy.exe
  C:\Windows\System\WuMpTTy.exe
  2⤵
  PID:5588
- C:\Windows\System\ucWBMOO.exe
  C:\Windows\System\ucWBMOO.exe
  2⤵
  PID:5428
- C:\Windows\System\WPzkbnB.exe
  C:\Windows\System\WPzkbnB.exe
  2⤵
  PID:5568
- C:\Windows\System\nLktmJT.exe
  C:\Windows\System\nLktmJT.exe
  2⤵
  PID:5364
- C:\Windows\System\ofcAtsa.exe
  C:\Windows\System\ofcAtsa.exe
  2⤵
  PID:5908
- C:\Windows\System\cmeVaon.exe
  C:\Windows\System\cmeVaon.exe
  2⤵
  PID:5952
- C:\Windows\System\rGMeBak.exe
  C:\Windows\System\rGMeBak.exe
  2⤵
  PID:5412
- C:\Windows\System\zAuIQhf.exe
  C:\Windows\System\zAuIQhf.exe
  2⤵
  PID:5460
- C:\Windows\System\SNyEoEf.exe
  C:\Windows\System\SNyEoEf.exe
  2⤵
  PID:5500
- C:\Windows\System\wPONzQv.exe
  C:\Windows\System\wPONzQv.exe
  2⤵
  PID:1448
- C:\Windows\System\EtEIeLP.exe
  C:\Windows\System\EtEIeLP.exe
  2⤵
  PID:5660
- C:\Windows\System\ARPgEpA.exe
  C:\Windows\System\ARPgEpA.exe
  2⤵
  PID:5704
- C:\Windows\System\UkPlgHN.exe
  C:\Windows\System\UkPlgHN.exe
  2⤵
  PID:5752
- C:\Windows\System\nYgMzXX.exe
  C:\Windows\System\nYgMzXX.exe
  2⤵
  PID:2964
- C:\Windows\System\RqHKiyT.exe
  C:\Windows\System\RqHKiyT.exe
  2⤵
  PID:4776
- C:\Windows\System\BLtmydg.exe
  C:\Windows\System\BLtmydg.exe
  2⤵
  PID:5780
- C:\Windows\System\XmjyPyB.exe
  C:\Windows\System\XmjyPyB.exe
  2⤵
  PID:5836
- C:\Windows\System\rFtbLTS.exe
  C:\Windows\System\rFtbLTS.exe
  2⤵
  PID:6148
- C:\Windows\System\aWzgPbb.exe
  C:\Windows\System\aWzgPbb.exe
  2⤵
  PID:6172
- C:\Windows\System\BhLYcvI.exe
  C:\Windows\System\BhLYcvI.exe
  2⤵
  PID:6188
- C:\Windows\System\hSavPjp.exe
  C:\Windows\System\hSavPjp.exe
  2⤵
  PID:6212
- C:\Windows\System\EtFZxyp.exe
  C:\Windows\System\EtFZxyp.exe
  2⤵
  PID:6228
- C:\Windows\System\uxiOBqa.exe
  C:\Windows\System\uxiOBqa.exe
  2⤵
  PID:6252
- C:\Windows\System\bRCcpEw.exe
  C:\Windows\System\bRCcpEw.exe
  2⤵
  PID:6276
- C:\Windows\System\TnSRiVh.exe
  C:\Windows\System\TnSRiVh.exe
  2⤵
  PID:6296
- C:\Windows\System\eScfxaS.exe
  C:\Windows\System\eScfxaS.exe
  2⤵
  PID:6316
- C:\Windows\System\SMDnrnx.exe
  C:\Windows\System\SMDnrnx.exe
  2⤵
  PID:6336
- C:\Windows\System\RHRUeZo.exe
  C:\Windows\System\RHRUeZo.exe
  2⤵
  PID:6356
- C:\Windows\System\svbolWv.exe
  C:\Windows\System\svbolWv.exe
  2⤵
  PID:6380
- C:\Windows\System\AxFSjQX.exe
  C:\Windows\System\AxFSjQX.exe
  2⤵
  PID:6400
- C:\Windows\System\zAHePgA.exe
  C:\Windows\System\zAHePgA.exe
  2⤵
  PID:6420
- C:\Windows\System\zKLVjcv.exe
  C:\Windows\System\zKLVjcv.exe
  2⤵
  PID:6444
- C:\Windows\System\genHBOD.exe
  C:\Windows\System\genHBOD.exe
  2⤵
  PID:6460
- C:\Windows\System\NdxdxKu.exe
  C:\Windows\System\NdxdxKu.exe
  2⤵
  PID:6488
- C:\Windows\System\EOTIRJh.exe
  C:\Windows\System\EOTIRJh.exe
  2⤵
  PID:6504
- C:\Windows\System\rGDLuKf.exe
  C:\Windows\System\rGDLuKf.exe
  2⤵
  PID:6528
- C:\Windows\System\RibpNdJ.exe
  C:\Windows\System\RibpNdJ.exe
  2⤵
  PID:6548
- C:\Windows\System\ZeETYKY.exe
  C:\Windows\System\ZeETYKY.exe
  2⤵
  PID:6568
- C:\Windows\System\SDqkpVJ.exe
  C:\Windows\System\SDqkpVJ.exe
  2⤵
  PID:6588
- C:\Windows\System\ENuBRtn.exe
  C:\Windows\System\ENuBRtn.exe
  2⤵
  PID:6608
- C:\Windows\System\sUACsBy.exe
  C:\Windows\System\sUACsBy.exe
  2⤵
  PID:6628
- C:\Windows\System\UuUyMAO.exe
  C:\Windows\System\UuUyMAO.exe
  2⤵
  PID:6656
- C:\Windows\System\JPHLufh.exe
  C:\Windows\System\JPHLufh.exe
  2⤵
  PID:6672
- C:\Windows\System\AYyISIP.exe
  C:\Windows\System\AYyISIP.exe
  2⤵
  PID:6692
- C:\Windows\System\RnmyUPo.exe
  C:\Windows\System\RnmyUPo.exe
  2⤵
  PID:6712
- C:\Windows\System\GLMHEXJ.exe
  C:\Windows\System\GLMHEXJ.exe
  2⤵
  PID:6740
- C:\Windows\System\HMdpDEV.exe
  C:\Windows\System\HMdpDEV.exe
  2⤵
  PID:6768
- C:\Windows\System\GFnPLUd.exe
  C:\Windows\System\GFnPLUd.exe
  2⤵
  PID:6800
- C:\Windows\System\IAIsotW.exe
  C:\Windows\System\IAIsotW.exe
  2⤵
  PID:6828
- C:\Windows\System\wJnOxNS.exe
  C:\Windows\System\wJnOxNS.exe
  2⤵
  PID:6856
- C:\Windows\System\wpLIhpZ.exe
  C:\Windows\System\wpLIhpZ.exe
  2⤵
  PID:6880
- C:\Windows\System\IUxxAKg.exe
  C:\Windows\System\IUxxAKg.exe
  2⤵
  PID:6900
- C:\Windows\System\OkzDjkv.exe
  C:\Windows\System\OkzDjkv.exe
  2⤵
  PID:6924
- C:\Windows\System\lwSlWVP.exe
  C:\Windows\System\lwSlWVP.exe
  2⤵
  PID:6944
- C:\Windows\System\DcDUGXL.exe
  C:\Windows\System\DcDUGXL.exe
  2⤵
  PID:6968
- C:\Windows\System\RiUKiep.exe
  C:\Windows\System\RiUKiep.exe
  2⤵
  PID:6988
- C:\Windows\System\QpSQIwD.exe
  C:\Windows\System\QpSQIwD.exe
  2⤵
  PID:7012
- C:\Windows\System\OhbsBjT.exe
  C:\Windows\System\OhbsBjT.exe
  2⤵
  PID:7032
- C:\Windows\System\rXYPRDj.exe
  C:\Windows\System\rXYPRDj.exe
  2⤵
  PID:7052
- C:\Windows\System\uBGyMCN.exe
  C:\Windows\System\uBGyMCN.exe
  2⤵
  PID:7080
- C:\Windows\System\DjRPumA.exe
  C:\Windows\System\DjRPumA.exe
  2⤵
  PID:7096
- C:\Windows\System\LKRdssq.exe
  C:\Windows\System\LKRdssq.exe
  2⤵
  PID:7120
- C:\Windows\System\XcNDSaP.exe
  C:\Windows\System\XcNDSaP.exe
  2⤵
  PID:7136
- C:\Windows\System\YRtBPWu.exe
  C:\Windows\System\YRtBPWu.exe
  2⤵
  PID:7152
- C:\Windows\System\jkixoIT.exe
  C:\Windows\System\jkixoIT.exe
  2⤵
  PID:6080
- C:\Windows\System\dlrhYvH.exe
  C:\Windows\System\dlrhYvH.exe
  2⤵
  PID:4732
- C:\Windows\System\UgwxPwt.exe
  C:\Windows\System\UgwxPwt.exe
  2⤵
  PID:6004
- C:\Windows\System\xNjRcOD.exe
  C:\Windows\System\xNjRcOD.exe
  2⤵
  PID:3452
- C:\Windows\System\hFhboxO.exe
  C:\Windows\System\hFhboxO.exe
  2⤵
  PID:5384
- C:\Windows\System\AsOBeLo.exe
  C:\Windows\System\AsOBeLo.exe
  2⤵
  PID:6304
- C:\Windows\System\CODTnwk.exe
  C:\Windows\System\CODTnwk.exe
  2⤵
  PID:6104
- C:\Windows\System\hNUGtsi.exe
  C:\Windows\System\hNUGtsi.exe
  2⤵
  PID:6520
- C:\Windows\System\HIpaXpG.exe
  C:\Windows\System\HIpaXpG.exe
  2⤵
  PID:6128
- C:\Windows\System\NddRJob.exe
  C:\Windows\System\NddRJob.exe
  2⤵
  PID:5612
- C:\Windows\System\zJYtLNn.exe
  C:\Windows\System\zJYtLNn.exe
  2⤵
  PID:2260
- C:\Windows\System\FpCoQvt.exe
  C:\Windows\System\FpCoQvt.exe
  2⤵
  PID:1436
- C:\Windows\System\pDXLeXM.exe
  C:\Windows\System\pDXLeXM.exe
  2⤵
  PID:5736
- C:\Windows\System\vWeMOXP.exe
  C:\Windows\System\vWeMOXP.exe
  2⤵
  PID:7184
- C:\Windows\System\KKGpkao.exe
  C:\Windows\System\KKGpkao.exe
  2⤵
  PID:7200
- C:\Windows\System\WlRIsUR.exe
  C:\Windows\System\WlRIsUR.exe
  2⤵
  PID:7224
- C:\Windows\System\hqApPFD.exe
  C:\Windows\System\hqApPFD.exe
  2⤵
  PID:7240
- C:\Windows\System\oaasgFm.exe
  C:\Windows\System\oaasgFm.exe
  2⤵
  PID:7272
- C:\Windows\System\PLCvZJs.exe
  C:\Windows\System\PLCvZJs.exe
  2⤵
  PID:7288
- C:\Windows\System\cuOVXbC.exe
  C:\Windows\System\cuOVXbC.exe
  2⤵
  PID:7312
- C:\Windows\System\uLBWAzU.exe
  C:\Windows\System\uLBWAzU.exe
  2⤵
  PID:7336
- C:\Windows\System\XHSeKsd.exe
  C:\Windows\System\XHSeKsd.exe
  2⤵
  PID:7352
- C:\Windows\System\uBEUHOk.exe
  C:\Windows\System\uBEUHOk.exe
  2⤵
  PID:7376
- C:\Windows\System\zvhhbBh.exe
  C:\Windows\System\zvhhbBh.exe
  2⤵
  PID:7396
- C:\Windows\System\frXUPLV.exe
  C:\Windows\System\frXUPLV.exe
  2⤵
  PID:7416
- C:\Windows\System\OxntUMV.exe
  C:\Windows\System\OxntUMV.exe
  2⤵
  PID:7440
- C:\Windows\System\axGvUXb.exe
  C:\Windows\System\axGvUXb.exe
  2⤵
  PID:7456
- C:\Windows\System\ihIDxQe.exe
  C:\Windows\System\ihIDxQe.exe
  2⤵
  PID:7480
- C:\Windows\System\nDrAvfy.exe
  C:\Windows\System\nDrAvfy.exe
  2⤵
  PID:7500
- C:\Windows\System\nwdUMua.exe
  C:\Windows\System\nwdUMua.exe
  2⤵
  PID:7516
- C:\Windows\System\KBzbiyV.exe
  C:\Windows\System\KBzbiyV.exe
  2⤵
  PID:7532
- C:\Windows\System\dPvwVEi.exe
  C:\Windows\System\dPvwVEi.exe
  2⤵
  PID:7548
- C:\Windows\System\ohJvaBZ.exe
  C:\Windows\System\ohJvaBZ.exe
  2⤵
  PID:7564
- C:\Windows\System\dsnyHvm.exe
  C:\Windows\System\dsnyHvm.exe
  2⤵
  PID:7580
- C:\Windows\System\DWGPjvl.exe
  C:\Windows\System\DWGPjvl.exe
  2⤵
  PID:7596
- C:\Windows\System\OrZdHeK.exe
  C:\Windows\System\OrZdHeK.exe
  2⤵
  PID:7612
- C:\Windows\System\qzxlGuX.exe
  C:\Windows\System\qzxlGuX.exe
  2⤵
  PID:7644
- C:\Windows\System\gaRPVnC.exe
  C:\Windows\System\gaRPVnC.exe
  2⤵
  PID:7684
- C:\Windows\System\aZSJtzT.exe
  C:\Windows\System\aZSJtzT.exe
  2⤵
  PID:7708
- C:\Windows\System\VOIGmOl.exe
  C:\Windows\System\VOIGmOl.exe
  2⤵
  PID:7732
- C:\Windows\System\nyxZhew.exe
  C:\Windows\System\nyxZhew.exe
  2⤵
  PID:7752
- C:\Windows\System\swdgyha.exe
  C:\Windows\System\swdgyha.exe
  2⤵
  PID:7772
- C:\Windows\System\AgPALAK.exe
  C:\Windows\System\AgPALAK.exe
  2⤵
  PID:7792
- C:\Windows\System\oROIjkZ.exe
  C:\Windows\System\oROIjkZ.exe
  2⤵
  PID:7812
- C:\Windows\System\kFlrGBk.exe
  C:\Windows\System\kFlrGBk.exe
  2⤵
  PID:7836
- C:\Windows\System\fcMyaIk.exe
  C:\Windows\System\fcMyaIk.exe
  2⤵
  PID:7852
- C:\Windows\System\mlXaqOG.exe
  C:\Windows\System\mlXaqOG.exe
  2⤵
  PID:7876
- C:\Windows\System\fJAeXpE.exe
  C:\Windows\System\fJAeXpE.exe
  2⤵
  PID:7900
- C:\Windows\System\iBBHkTV.exe
  C:\Windows\System\iBBHkTV.exe
  2⤵
  PID:7920
- C:\Windows\System\xpxUHyg.exe
  C:\Windows\System\xpxUHyg.exe
  2⤵
  PID:7944
- C:\Windows\System\vuxVCjx.exe
  C:\Windows\System\vuxVCjx.exe
  2⤵
  PID:7964
- C:\Windows\System\tESEdal.exe
  C:\Windows\System\tESEdal.exe
  2⤵
  PID:7988
- C:\Windows\System\rHzSZjF.exe
  C:\Windows\System\rHzSZjF.exe
  2⤵
  PID:8008
- C:\Windows\System\Yogxoew.exe
  C:\Windows\System\Yogxoew.exe
  2⤵
  PID:8028
- C:\Windows\System\ovubymL.exe
  C:\Windows\System\ovubymL.exe
  2⤵
  PID:8048
- C:\Windows\System\vwSyDYT.exe
  C:\Windows\System\vwSyDYT.exe
  2⤵
  PID:8080
- C:\Windows\System\iMVlgyi.exe
  C:\Windows\System\iMVlgyi.exe
  2⤵
  PID:8096
- C:\Windows\System\tABhIGz.exe
  C:\Windows\System\tABhIGz.exe
  2⤵
  PID:8120
- C:\Windows\System\Tqovqim.exe
  C:\Windows\System\Tqovqim.exe
  2⤵
  PID:8148
- C:\Windows\System\PlIZRsw.exe
  C:\Windows\System\PlIZRsw.exe
  2⤵
  PID:8164
- C:\Windows\System\YXxCkBq.exe
  C:\Windows\System\YXxCkBq.exe
  2⤵
  PID:6620
- C:\Windows\System\ZovtwCx.exe
  C:\Windows\System\ZovtwCx.exe
  2⤵
  PID:6648
- C:\Windows\System\sNoLhJb.exe
  C:\Windows\System\sNoLhJb.exe
  2⤵
  PID:5344
- C:\Windows\System\yJqhvxL.exe
  C:\Windows\System\yJqhvxL.exe
  2⤵
  PID:6700
- C:\Windows\System\sgEoNBi.exe
  C:\Windows\System\sgEoNBi.exe
  2⤵
  PID:5968
- C:\Windows\System\pfmHUmx.exe
  C:\Windows\System\pfmHUmx.exe
  2⤵
  PID:5860
- C:\Windows\System\FviuBeQ.exe
  C:\Windows\System\FviuBeQ.exe
  2⤵
  PID:6180
- C:\Windows\System\eZjejTY.exe
  C:\Windows\System\eZjejTY.exe
  2⤵
  PID:6248
- C:\Windows\System\MIwHGdx.exe
  C:\Windows\System\MIwHGdx.exe
  2⤵
  PID:6288
- C:\Windows\System\LivRDSn.exe
  C:\Windows\System\LivRDSn.exe
  2⤵
  PID:6812
- C:\Windows\System\SbktBqD.exe
  C:\Windows\System\SbktBqD.exe
  2⤵
  PID:6428
- C:\Windows\System\weNuBrs.exe
  C:\Windows\System\weNuBrs.exe
  2⤵
  PID:6912
- C:\Windows\System\bWArHhn.exe
  C:\Windows\System\bWArHhn.exe
  2⤵
  PID:6468
- C:\Windows\System\wUJqCjr.exe
  C:\Windows\System\wUJqCjr.exe
  2⤵
  PID:5888
- C:\Windows\System\BzQtlAG.exe
  C:\Windows\System\BzQtlAG.exe
  2⤵
  PID:7256
- C:\Windows\System\RYuUKgk.exe
  C:\Windows\System\RYuUKgk.exe
  2⤵
  PID:3676
- C:\Windows\System\falTvhw.exe
  C:\Windows\System\falTvhw.exe
  2⤵
  PID:8196
- C:\Windows\System\OvQAOkQ.exe
  C:\Windows\System\OvQAOkQ.exe
  2⤵
  PID:8220
- C:\Windows\System\nDcBDGa.exe
  C:\Windows\System\nDcBDGa.exe
  2⤵
  PID:8244
- C:\Windows\System\DfPHaBr.exe
  C:\Windows\System\DfPHaBr.exe
  2⤵
  PID:8260
- C:\Windows\System\qwBrjFA.exe
  C:\Windows\System\qwBrjFA.exe
  2⤵
  PID:8284
- C:\Windows\System\xQobjFJ.exe
  C:\Windows\System\xQobjFJ.exe
  2⤵
  PID:8304
- C:\Windows\System\sbKRZEv.exe
  C:\Windows\System\sbKRZEv.exe
  2⤵
  PID:8324
- C:\Windows\System\LBGVKju.exe
  C:\Windows\System\LBGVKju.exe
  2⤵
  PID:8340
- C:\Windows\System\jYVRnlw.exe
  C:\Windows\System\jYVRnlw.exe
  2⤵
  PID:8356
- C:\Windows\System\dwkHNIE.exe
  C:\Windows\System\dwkHNIE.exe
  2⤵
  PID:8372
- C:\Windows\System\IutYJUO.exe
  C:\Windows\System\IutYJUO.exe
  2⤵
  PID:8388
- C:\Windows\System\Jpyokwn.exe
  C:\Windows\System\Jpyokwn.exe
  2⤵
  PID:8404
- C:\Windows\System\fpIHhly.exe
  C:\Windows\System\fpIHhly.exe
  2⤵
  PID:8424
- C:\Windows\System\LdAJmoM.exe
  C:\Windows\System\LdAJmoM.exe
  2⤵
  PID:8448
- C:\Windows\System\ZllqRwf.exe
  C:\Windows\System\ZllqRwf.exe
  2⤵
  PID:8464
- C:\Windows\System\XliZaET.exe
  C:\Windows\System\XliZaET.exe
  2⤵
  PID:8484
- C:\Windows\System\PwSetzl.exe
  C:\Windows\System\PwSetzl.exe
  2⤵
  PID:8500
- C:\Windows\System\HxNKzAM.exe
  C:\Windows\System\HxNKzAM.exe
  2⤵
  PID:8516
- C:\Windows\System\OnayBDh.exe
  C:\Windows\System\OnayBDh.exe
  2⤵
  PID:8532
- C:\Windows\System\oSoBjtl.exe
  C:\Windows\System\oSoBjtl.exe
  2⤵
  PID:8548
- C:\Windows\System\ArDGcRt.exe
  C:\Windows\System\ArDGcRt.exe
  2⤵
  PID:8564
- C:\Windows\System\ScngoOt.exe
  C:\Windows\System\ScngoOt.exe
  2⤵
  PID:8580
- C:\Windows\System\xUOmXVr.exe
  C:\Windows\System\xUOmXVr.exe
  2⤵
  PID:8596
- C:\Windows\System\ozavNYS.exe
  C:\Windows\System\ozavNYS.exe
  2⤵
  PID:8616
- C:\Windows\System\dYxWBRU.exe
  C:\Windows\System\dYxWBRU.exe
  2⤵
  PID:8640
- C:\Windows\System\XkOLmMq.exe
  C:\Windows\System\XkOLmMq.exe
  2⤵
  PID:8664
- C:\Windows\System\HUscQMV.exe
  C:\Windows\System\HUscQMV.exe
  2⤵
  PID:8680
- C:\Windows\System\LgIlyyz.exe
  C:\Windows\System\LgIlyyz.exe
  2⤵
  PID:8704
- C:\Windows\System\EjWckbE.exe
  C:\Windows\System\EjWckbE.exe
  2⤵
  PID:8724
- C:\Windows\System\trFUvtK.exe
  C:\Windows\System\trFUvtK.exe
  2⤵
  PID:8768
- C:\Windows\System\uXgwSdO.exe
  C:\Windows\System\uXgwSdO.exe
  2⤵
  PID:8800
- C:\Windows\System\EWWnNEt.exe
  C:\Windows\System\EWWnNEt.exe
  2⤵
  PID:8816
- C:\Windows\System\FpmVSNs.exe
  C:\Windows\System\FpmVSNs.exe
  2⤵
  PID:8836
- C:\Windows\System\AoprFpM.exe
  C:\Windows\System\AoprFpM.exe
  2⤵
  PID:8856
- C:\Windows\System\CuQKLGM.exe
  C:\Windows\System\CuQKLGM.exe
  2⤵
  PID:8876
- C:\Windows\System\RpDvmKI.exe
  C:\Windows\System\RpDvmKI.exe
  2⤵
  PID:8900
- C:\Windows\System\bACdthP.exe
  C:\Windows\System\bACdthP.exe
  2⤵
  PID:8920
- C:\Windows\System\bxAswWJ.exe
  C:\Windows\System\bxAswWJ.exe
  2⤵
  PID:8936
- C:\Windows\System\xJuFEWz.exe
  C:\Windows\System\xJuFEWz.exe
  2⤵
  PID:8960
- C:\Windows\System\tXUWvaU.exe
  C:\Windows\System\tXUWvaU.exe
  2⤵
  PID:8984
- C:\Windows\System\BKgjeBO.exe
  C:\Windows\System\BKgjeBO.exe
  2⤵
  PID:9000
- C:\Windows\System\RmOaHDk.exe
  C:\Windows\System\RmOaHDk.exe
  2⤵
  PID:9028
- C:\Windows\System\qWUXMrD.exe
  C:\Windows\System\qWUXMrD.exe
  2⤵
  PID:9048
- C:\Windows\System\LmefsZg.exe
  C:\Windows\System\LmefsZg.exe
  2⤵
  PID:9072
- C:\Windows\System\DWgGNUW.exe
  C:\Windows\System\DWgGNUW.exe
  2⤵
  PID:9088
- C:\Windows\System\EANnpcW.exe
  C:\Windows\System\EANnpcW.exe
  2⤵
  PID:9124
- C:\Windows\System\ZnvykyD.exe
  C:\Windows\System\ZnvykyD.exe
  2⤵
  PID:9144
- C:\Windows\System\znjTSaC.exe
  C:\Windows\System\znjTSaC.exe
  2⤵
  PID:9164
- C:\Windows\System\DEGfOmV.exe
  C:\Windows\System\DEGfOmV.exe
  2⤵
  PID:9184
- C:\Windows\System\VwyRxQS.exe
  C:\Windows\System\VwyRxQS.exe
  2⤵
  PID:9204
- C:\Windows\System\DjBALwM.exe
  C:\Windows\System\DjBALwM.exe
  2⤵
  PID:7632
- C:\Windows\System\JyRmqSk.exe
  C:\Windows\System\JyRmqSk.exe
  2⤵
  PID:6840
- C:\Windows\System\PALffYz.exe
  C:\Windows\System\PALffYz.exe
  2⤵
  PID:7704
- C:\Windows\System\WtbCDVy.exe
  C:\Windows\System\WtbCDVy.exe
  2⤵
  PID:6388
- C:\Windows\System\xdDOvoh.exe
  C:\Windows\System\xdDOvoh.exe
  2⤵
  PID:6896
- C:\Windows\System\iMeGUJL.exe
  C:\Windows\System\iMeGUJL.exe
  2⤵
  PID:7000
- C:\Windows\System\fHduzot.exe
  C:\Windows\System\fHduzot.exe
  2⤵
  PID:6536
- C:\Windows\System\hJgsGuQ.exe
  C:\Windows\System\hJgsGuQ.exe
  2⤵
  PID:7076
- C:\Windows\System\ssjEJSv.exe
  C:\Windows\System\ssjEJSv.exe
  2⤵
  PID:7092
- C:\Windows\System\MAcIYbT.exe
  C:\Windows\System\MAcIYbT.exe
  2⤵
  PID:8064
- C:\Windows\System\WuzkErG.exe
  C:\Windows\System\WuzkErG.exe
  2⤵
  PID:7976
- C:\Windows\System\EDEkDMH.exe
  C:\Windows\System\EDEkDMH.exe
  2⤵
  PID:3612
- C:\Windows\System\fkRttgz.exe
  C:\Windows\System\fkRttgz.exe
  2⤵
  PID:7216
- C:\Windows\System\EWeLxDF.exe
  C:\Windows\System\EWeLxDF.exe
  2⤵
  PID:6668
- C:\Windows\System\SWxUvqg.exe
  C:\Windows\System\SWxUvqg.exe
  2⤵
  PID:7476
- C:\Windows\System\duaYwag.exe
  C:\Windows\System\duaYwag.exe
  2⤵
  PID:9232
- C:\Windows\System\assrgUo.exe
  C:\Windows\System\assrgUo.exe
  2⤵
  PID:9256
- C:\Windows\System\KxUoPwQ.exe
  C:\Windows\System\KxUoPwQ.exe
  2⤵
  PID:9276
- C:\Windows\System\vdShVNm.exe
  C:\Windows\System\vdShVNm.exe
  2⤵
  PID:9300
- C:\Windows\System\EvhcVER.exe
  C:\Windows\System\EvhcVER.exe
  2⤵
  PID:9324
- C:\Windows\System\oJasiXk.exe
  C:\Windows\System\oJasiXk.exe
  2⤵
  PID:9348
- C:\Windows\System\JelpvAw.exe
  C:\Windows\System\JelpvAw.exe
  2⤵
  PID:9364
- C:\Windows\System\OhsXarU.exe
  C:\Windows\System\OhsXarU.exe
  2⤵
  PID:9388
- C:\Windows\System\ucOroIh.exe
  C:\Windows\System\ucOroIh.exe
  2⤵
  PID:9404
- C:\Windows\System\KMYhpEM.exe
  C:\Windows\System\KMYhpEM.exe
  2⤵
  PID:9424
- C:\Windows\System\rQigYrg.exe
  C:\Windows\System\rQigYrg.exe
  2⤵
  PID:9448
- C:\Windows\System\GuVKJbS.exe
  C:\Windows\System\GuVKJbS.exe
  2⤵
  PID:9464
- C:\Windows\System\ZmravHI.exe
  C:\Windows\System\ZmravHI.exe
  2⤵
  PID:9480
- C:\Windows\System\rcthsKZ.exe
  C:\Windows\System\rcthsKZ.exe
  2⤵
  PID:9496
- C:\Windows\System\DgNvkld.exe
  C:\Windows\System\DgNvkld.exe
  2⤵
  PID:9516
- C:\Windows\System\FoSlaOw.exe
  C:\Windows\System\FoSlaOw.exe
  2⤵
  PID:9540
- C:\Windows\System\ZFlffHZ.exe
  C:\Windows\System\ZFlffHZ.exe
  2⤵
  PID:9568
- C:\Windows\System\ndqWLPi.exe
  C:\Windows\System\ndqWLPi.exe
  2⤵
  PID:9584
- C:\Windows\System\olkokGE.exe
  C:\Windows\System\olkokGE.exe
  2⤵
  PID:9600
- C:\Windows\System\bHaZvdT.exe
  C:\Windows\System\bHaZvdT.exe
  2⤵
  PID:9616
- C:\Windows\System\nZCwAzN.exe
  C:\Windows\System\nZCwAzN.exe
  2⤵
  PID:9632
- C:\Windows\System\HpOIIXW.exe
  C:\Windows\System\HpOIIXW.exe
  2⤵
  PID:9648
- C:\Windows\System\CxQFEad.exe
  C:\Windows\System\CxQFEad.exe
  2⤵
  PID:9664
- C:\Windows\System\ZawJIba.exe
  C:\Windows\System\ZawJIba.exe
  2⤵
  PID:9680
- C:\Windows\System\ZFzCxyc.exe
  C:\Windows\System\ZFzCxyc.exe
  2⤵
  PID:9696
- C:\Windows\System\RcdtKTz.exe
  C:\Windows\System\RcdtKTz.exe
  2⤵
  PID:9712
- C:\Windows\System\VmWulfO.exe
  C:\Windows\System\VmWulfO.exe
  2⤵
  PID:9728
- C:\Windows\System\dGPWolG.exe
  C:\Windows\System\dGPWolG.exe
  2⤵
  PID:9744
- C:\Windows\System\HHCCawD.exe
  C:\Windows\System\HHCCawD.exe
  2⤵
  PID:9764
- C:\Windows\System\zuoMmnM.exe
  C:\Windows\System\zuoMmnM.exe
  2⤵
  PID:9788
- C:\Windows\System\SgpOshz.exe
  C:\Windows\System\SgpOshz.exe
  2⤵
  PID:9812
- C:\Windows\System\rdZdWLw.exe
  C:\Windows\System\rdZdWLw.exe
  2⤵
  PID:9836
- C:\Windows\System\ojtdJLj.exe
  C:\Windows\System\ojtdJLj.exe
  2⤵
  PID:9860
- C:\Windows\System\nTDCciO.exe
  C:\Windows\System\nTDCciO.exe
  2⤵
  PID:9888
- C:\Windows\System\IeNxdJD.exe
  C:\Windows\System\IeNxdJD.exe
  2⤵
  PID:9904
- C:\Windows\System\DGEvzvq.exe
  C:\Windows\System\DGEvzvq.exe
  2⤵
  PID:9924
- C:\Windows\System\SCqaEkP.exe
  C:\Windows\System\SCqaEkP.exe
  2⤵
  PID:9948
- C:\Windows\System\bHkZbaf.exe
  C:\Windows\System\bHkZbaf.exe
  2⤵
  PID:9968
- C:\Windows\System\BQxYCkB.exe
  C:\Windows\System\BQxYCkB.exe
  2⤵
  PID:9992
- C:\Windows\System\ECYZrio.exe
  C:\Windows\System\ECYZrio.exe
  2⤵
  PID:10012
- C:\Windows\System\SPcOrNK.exe
  C:\Windows\System\SPcOrNK.exe
  2⤵
  PID:10036
- C:\Windows\System\tasNCPD.exe
  C:\Windows\System\tasNCPD.exe
  2⤵
  PID:10052
- C:\Windows\System\wmZyQRa.exe
  C:\Windows\System\wmZyQRa.exe
  2⤵
  PID:10068
- C:\Windows\System\wuvGnjJ.exe
  C:\Windows\System\wuvGnjJ.exe
  2⤵
  PID:10096
- C:\Windows\System\NFvrWpt.exe
  C:\Windows\System\NFvrWpt.exe
  2⤵
  PID:10116
- C:\Windows\System\DHLBjWa.exe
  C:\Windows\System\DHLBjWa.exe
  2⤵
  PID:10136
- C:\Windows\System\WLSdRlN.exe
  C:\Windows\System\WLSdRlN.exe
  2⤵
  PID:10156
- C:\Windows\System\TdyhSnE.exe
  C:\Windows\System\TdyhSnE.exe
  2⤵
  PID:10176
- C:\Windows\System\JwkNsrN.exe
  C:\Windows\System\JwkNsrN.exe
  2⤵
  PID:10196
- C:\Windows\System\yigAFBs.exe
  C:\Windows\System\yigAFBs.exe
  2⤵
  PID:10216
- C:\Windows\System\ePyuopG.exe
  C:\Windows\System\ePyuopG.exe
  2⤵
  PID:6432
- C:\Windows\System\KtlSLea.exe
  C:\Windows\System\KtlSLea.exe
  2⤵
  PID:5484
- C:\Windows\System\pMSfViI.exe
  C:\Windows\System\pMSfViI.exe
  2⤵
  PID:8276
- C:\Windows\System\kOtGHnH.exe
  C:\Windows\System\kOtGHnH.exe
  2⤵
  PID:7512
- C:\Windows\System\diielbx.exe
  C:\Windows\System\diielbx.exe
  2⤵
  PID:7540
- C:\Windows\System\bfohzNd.exe
  C:\Windows\System\bfohzNd.exe
  2⤵
  PID:6820
- C:\Windows\System\SMdQhCL.exe
  C:\Windows\System\SMdQhCL.exe
  2⤵
  PID:8384
- C:\Windows\System\WeRKlcT.exe
  C:\Windows\System\WeRKlcT.exe
  2⤵
  PID:8420
- C:\Windows\System\eqNPnuV.exe
  C:\Windows\System\eqNPnuV.exe
  2⤵
  PID:8492
- C:\Windows\System\QNmgXRI.exe
  C:\Windows\System\QNmgXRI.exe
  2⤵
  PID:8476
- C:\Windows\System\RLhVCIU.exe
  C:\Windows\System\RLhVCIU.exe
  2⤵
  PID:8716
- C:\Windows\System\fAtRhgx.exe
  C:\Windows\System\fAtRhgx.exe
  2⤵
  PID:6956
- C:\Windows\System\eWhekWI.exe
  C:\Windows\System\eWhekWI.exe
  2⤵
  PID:6984
- C:\Windows\System\WaXLmqI.exe
  C:\Windows\System\WaXLmqI.exe
  2⤵
  PID:7024
- C:\Windows\System\ywBDPUN.exe
  C:\Windows\System\ywBDPUN.exe
  2⤵
  PID:9020
- C:\Windows\System\aydHwIx.exe
  C:\Windows\System\aydHwIx.exe
  2⤵
  PID:7868
- C:\Windows\System\FpOrnLd.exe
  C:\Windows\System\FpOrnLd.exe
  2⤵
  PID:7892
- C:\Windows\System\ycnCgWn.exe
  C:\Windows\System\ycnCgWn.exe
  2⤵
  PID:7112
- C:\Windows\System\jaYOHKI.exe
  C:\Windows\System\jaYOHKI.exe
  2⤵
  PID:6124
- C:\Windows\System\KXayUXM.exe
  C:\Windows\System\KXayUXM.exe
  2⤵
  PID:8104
- C:\Windows\System\FrVpYRs.exe
  C:\Windows\System\FrVpYRs.exe
  2⤵
  PID:6220
- C:\Windows\System\BUlSsPz.exe
  C:\Windows\System\BUlSsPz.exe
  2⤵
  PID:6560
- C:\Windows\System\yGNLdsL.exe
  C:\Windows\System\yGNLdsL.exe
  2⤵
  PID:8040
- C:\Windows\System\eqBvIvS.exe
  C:\Windows\System\eqBvIvS.exe
  2⤵
  PID:2256
- C:\Windows\System\fIrRzwu.exe
  C:\Windows\System\fIrRzwu.exe
  2⤵
  PID:1616
- C:\Windows\System\QyOIGjE.exe
  C:\Windows\System\QyOIGjE.exe
  2⤵
  PID:7604
- C:\Windows\System\wXUwThb.exe
  C:\Windows\System\wXUwThb.exe
  2⤵
  PID:5560
- C:\Windows\System\ZNtIHxG.exe
  C:\Windows\System\ZNtIHxG.exe
  2⤵
  PID:10244
- C:\Windows\System\VuMRDWG.exe
  C:\Windows\System\VuMRDWG.exe
  2⤵
  PID:10264
- C:\Windows\System\fexnOYX.exe
  C:\Windows\System\fexnOYX.exe
  2⤵
  PID:10288
- C:\Windows\System\ekuNIeT.exe
  C:\Windows\System\ekuNIeT.exe
  2⤵
  PID:10312
- C:\Windows\System\ZgYBEJv.exe
  C:\Windows\System\ZgYBEJv.exe
  2⤵
  PID:10332
- C:\Windows\System\RkXgXVQ.exe
  C:\Windows\System\RkXgXVQ.exe
  2⤵
  PID:10356
- C:\Windows\System\eqwHXaz.exe
  C:\Windows\System\eqwHXaz.exe
  2⤵
  PID:10376
- C:\Windows\System\irOicUE.exe
  C:\Windows\System\irOicUE.exe
  2⤵
  PID:10400
- C:\Windows\System\nVWuCOY.exe
  C:\Windows\System\nVWuCOY.exe
  2⤵
  PID:10416
- C:\Windows\System\yyRLYUB.exe
  C:\Windows\System\yyRLYUB.exe
  2⤵
  PID:10440
- C:\Windows\System\KEYmBLo.exe
  C:\Windows\System\KEYmBLo.exe
  2⤵
  PID:10464
- C:\Windows\System\aBkNdpB.exe
  C:\Windows\System\aBkNdpB.exe
  2⤵
  PID:10488
- C:\Windows\System\YoXLftl.exe
  C:\Windows\System\YoXLftl.exe
  2⤵
  PID:10508
- C:\Windows\System\hduIicZ.exe
  C:\Windows\System\hduIicZ.exe
  2⤵
  PID:10528
- C:\Windows\System\pgwVVru.exe
  C:\Windows\System\pgwVVru.exe
  2⤵
  PID:10552
- C:\Windows\System\nrOVpxb.exe
  C:\Windows\System\nrOVpxb.exe
  2⤵
  PID:10572
- C:\Windows\System\HXpMLiM.exe
  C:\Windows\System\HXpMLiM.exe
  2⤵
  PID:10592
- C:\Windows\System\QmpFZKr.exe
  C:\Windows\System\QmpFZKr.exe
  2⤵
  PID:10612
- C:\Windows\System\SaLbRoI.exe
  C:\Windows\System\SaLbRoI.exe
  2⤵
  PID:10632
- C:\Windows\System\XUCCSxQ.exe
  C:\Windows\System\XUCCSxQ.exe
  2⤵
  PID:10652
- C:\Windows\System\CZIlgEz.exe
  C:\Windows\System\CZIlgEz.exe
  2⤵
  PID:10672
- C:\Windows\System\VEoUqeD.exe
  C:\Windows\System\VEoUqeD.exe
  2⤵
  PID:10692
- C:\Windows\System\BfpETiI.exe
  C:\Windows\System\BfpETiI.exe
  2⤵
  PID:10712
- C:\Windows\System\zgWNrBF.exe
  C:\Windows\System\zgWNrBF.exe
  2⤵
  PID:10728
- C:\Windows\System\XUidvrW.exe
  C:\Windows\System\XUidvrW.exe
  2⤵
  PID:10752
- C:\Windows\System\jPfBKBQ.exe
  C:\Windows\System\jPfBKBQ.exe
  2⤵
  PID:10776
- C:\Windows\System\VzWFuRG.exe
  C:\Windows\System\VzWFuRG.exe
  2⤵
  PID:10796
- C:\Windows\System\FybCwgO.exe
  C:\Windows\System\FybCwgO.exe
  2⤵
  PID:10816
- C:\Windows\System\qHGkXxv.exe
  C:\Windows\System\qHGkXxv.exe
  2⤵
  PID:10836
- C:\Windows\System\TCqCuXQ.exe
  C:\Windows\System\TCqCuXQ.exe
  2⤵
  PID:10864
- C:\Windows\System\jtaquqK.exe
  C:\Windows\System\jtaquqK.exe
  2⤵
  PID:10884
- C:\Windows\System\qbvViYp.exe
  C:\Windows\System\qbvViYp.exe
  2⤵
  PID:10900
- C:\Windows\System\oqOLIyo.exe
  C:\Windows\System\oqOLIyo.exe
  2⤵
  PID:10924
- C:\Windows\System\JqZPYov.exe
  C:\Windows\System\JqZPYov.exe
  2⤵
  PID:10948
- C:\Windows\System\pvkVWRv.exe
  C:\Windows\System\pvkVWRv.exe
  2⤵
  PID:10968
- C:\Windows\System\kGLDvPW.exe
  C:\Windows\System\kGLDvPW.exe
  2⤵
  PID:10988
- C:\Windows\System\bxCVVAt.exe
  C:\Windows\System\bxCVVAt.exe
  2⤵
  PID:11004
- C:\Windows\System\nARDWkf.exe
  C:\Windows\System\nARDWkf.exe
  2⤵
  PID:11028
- C:\Windows\System\nSPUEaD.exe
  C:\Windows\System\nSPUEaD.exe
  2⤵
  PID:11044
- C:\Windows\System\cQoFSBa.exe
  C:\Windows\System\cQoFSBa.exe
  2⤵
  PID:11068
- C:\Windows\System\iVfKTew.exe
  C:\Windows\System\iVfKTew.exe
  2⤵
  PID:11088
- C:\Windows\System\nuWBTyR.exe
  C:\Windows\System\nuWBTyR.exe
  2⤵
  PID:11108
- C:\Windows\System\ZcGvuBl.exe
  C:\Windows\System\ZcGvuBl.exe
  2⤵
  PID:11124
- C:\Windows\System\LpfaZHF.exe
  C:\Windows\System\LpfaZHF.exe
  2⤵
  PID:11140
- C:\Windows\System\qxwkgtP.exe
  C:\Windows\System\qxwkgtP.exe
  2⤵
  PID:11156
- C:\Windows\System\wmEssgg.exe
  C:\Windows\System\wmEssgg.exe
  2⤵
  PID:11176
- C:\Windows\System\OyRAGEX.exe
  C:\Windows\System\OyRAGEX.exe
  2⤵
  PID:11196
- C:\Windows\System\yUXTJXc.exe
  C:\Windows\System\yUXTJXc.exe
  2⤵
  PID:11216
- C:\Windows\System\LyeEndG.exe
  C:\Windows\System\LyeEndG.exe
  2⤵
  PID:11236
- C:\Windows\System\HFpoJSx.exe
  C:\Windows\System\HFpoJSx.exe
  2⤵
  PID:11252
- C:\Windows\System\ELgTdRk.exe
  C:\Windows\System\ELgTdRk.exe
  2⤵
  PID:7320
- C:\Windows\System\DpbKzPB.exe
  C:\Windows\System\DpbKzPB.exe
  2⤵
  PID:7348
- C:\Windows\System\rtqcrvT.exe
  C:\Windows\System\rtqcrvT.exe
  2⤵
  PID:7388
- C:\Windows\System\yJDEuAf.exe
  C:\Windows\System\yJDEuAf.exe
  2⤵
  PID:8056
- C:\Windows\System\RytUUsa.exe
  C:\Windows\System\RytUUsa.exe
  2⤵
  PID:6224
- C:\Windows\System\IOkSUmI.exe
  C:\Windows\System\IOkSUmI.exe
  2⤵
  PID:7448
- C:\Windows\System\krCzGkF.exe
  C:\Windows\System\krCzGkF.exe
  2⤵
  PID:6412
- C:\Windows\System\xhoMnrS.exe
  C:\Windows\System\xhoMnrS.exe
  2⤵
  PID:9292
- C:\Windows\System\mzsnlFX.exe
  C:\Windows\System\mzsnlFX.exe
  2⤵
  PID:7296
- C:\Windows\System\hvfXGiA.exe
  C:\Windows\System\hvfXGiA.exe
  2⤵
  PID:8212
- C:\Windows\System\fBoInZU.exe
  C:\Windows\System\fBoInZU.exe
  2⤵
  PID:8252
- C:\Windows\System\sInZJLc.exe
  C:\Windows\System\sInZJLc.exe
  2⤵
  PID:8316
- C:\Windows\System\hAjegqz.exe
  C:\Windows\System\hAjegqz.exe
  2⤵
  PID:7608
- C:\Windows\System\YlwxmtL.exe
  C:\Windows\System\YlwxmtL.exe
  2⤵
  PID:7624
- C:\Windows\System\FdYCAkk.exe
  C:\Windows\System\FdYCAkk.exe
  2⤵
  PID:9456
- C:\Windows\System\zfnzjAl.exe
  C:\Windows\System\zfnzjAl.exe
  2⤵
  PID:8540
- C:\Windows\System\rkOZxAu.exe
  C:\Windows\System\rkOZxAu.exe
  2⤵
  PID:9488
- C:\Windows\System\qFqtmev.exe
  C:\Windows\System\qFqtmev.exe
  2⤵
  PID:7696
- C:\Windows\System\wAdEMaE.exe
  C:\Windows\System\wAdEMaE.exe
  2⤵
  PID:9536
- C:\Windows\System\LcnaimH.exe
  C:\Windows\System\LcnaimH.exe
  2⤵
  PID:8656
- C:\Windows\System\nArdhAm.exe
  C:\Windows\System\nArdhAm.exe
  2⤵
  PID:9596
- C:\Windows\System\DtEhSus.exe
  C:\Windows\System\DtEhSus.exe
  2⤵
  PID:9688
- C:\Windows\System\zMyHGyk.exe
  C:\Windows\System\zMyHGyk.exe
  2⤵
  PID:8792
- C:\Windows\System\mODwtUY.exe
  C:\Windows\System\mODwtUY.exe
  2⤵
  PID:9824
- C:\Windows\System\QTiUSTi.exe
  C:\Windows\System\QTiUSTi.exe
  2⤵
  PID:9848
- C:\Windows\System\mHRTmoj.exe
  C:\Windows\System\mHRTmoj.exe
  2⤵
  PID:7768
- C:\Windows\System\UBkLDpD.exe
  C:\Windows\System\UBkLDpD.exe
  2⤵
  PID:7804
- C:\Windows\System\WwkoQjE.exe
  C:\Windows\System\WwkoQjE.exe
  2⤵
  PID:9960
- C:\Windows\System\Xddenix.exe
  C:\Windows\System\Xddenix.exe
  2⤵
  PID:10008
- C:\Windows\System\DUkCYpA.exe
  C:\Windows\System\DUkCYpA.exe
  2⤵
  PID:8976
- C:\Windows\System\zSqblVW.exe
  C:\Windows\System\zSqblVW.exe
  2⤵
  PID:9084
- C:\Windows\System\JaVbagJ.exe
  C:\Windows\System\JaVbagJ.exe
  2⤵
  PID:10224
- C:\Windows\System\qreKLwE.exe
  C:\Windows\System\qreKLwE.exe
  2⤵
  PID:8296
- C:\Windows\System\tIqzZZz.exe
  C:\Windows\System\tIqzZZz.exe
  2⤵
  PID:8092
- C:\Windows\System\BkfxPEN.exe
  C:\Windows\System\BkfxPEN.exe
  2⤵
  PID:11284
- C:\Windows\System\SeeFnfe.exe
  C:\Windows\System\SeeFnfe.exe
  2⤵
  PID:11300
- C:\Windows\System\ISWFbeE.exe
  C:\Windows\System\ISWFbeE.exe
  2⤵
  PID:11328
- C:\Windows\System\YisWpxz.exe
  C:\Windows\System\YisWpxz.exe
  2⤵
  PID:11352
- C:\Windows\System\GDAUhcu.exe
  C:\Windows\System\GDAUhcu.exe
  2⤵
  PID:11376
- C:\Windows\System\YFBWHUO.exe
  C:\Windows\System\YFBWHUO.exe
  2⤵
  PID:11400
- C:\Windows\System\mouvRHg.exe
  C:\Windows\System\mouvRHg.exe
  2⤵
  PID:11416
- C:\Windows\System\YsxJXQD.exe
  C:\Windows\System\YsxJXQD.exe
  2⤵
  PID:11440
- C:\Windows\System\LUylHur.exe
  C:\Windows\System\LUylHur.exe
  2⤵
  PID:11456
- C:\Windows\System\qqkdcUC.exe
  C:\Windows\System\qqkdcUC.exe
  2⤵
  PID:11480
- C:\Windows\System\eiteTvV.exe
  C:\Windows\System\eiteTvV.exe
  2⤵
  PID:11500
- C:\Windows\System\xpqAxJk.exe
  C:\Windows\System\xpqAxJk.exe
  2⤵
  PID:11520
- C:\Windows\System\EXCpVwf.exe
  C:\Windows\System\EXCpVwf.exe
  2⤵
  PID:11544
- C:\Windows\System\GQUQlNf.exe
  C:\Windows\System\GQUQlNf.exe
  2⤵
  PID:11564
- C:\Windows\System\LeETwPD.exe
  C:\Windows\System\LeETwPD.exe
  2⤵
  PID:11588
- C:\Windows\System\yalCEnq.exe
  C:\Windows\System\yalCEnq.exe
  2⤵
  PID:11608
- C:\Windows\System\NpiPpCS.exe
  C:\Windows\System\NpiPpCS.exe
  2⤵
  PID:11628
- C:\Windows\System\ynfaOJd.exe
  C:\Windows\System\ynfaOJd.exe
  2⤵
  PID:11660
- C:\Windows\System\kdaGWGj.exe
  C:\Windows\System\kdaGWGj.exe
  2⤵
  PID:11680
- C:\Windows\System\dUnOiDo.exe
  C:\Windows\System\dUnOiDo.exe
  2⤵
  PID:11704
- C:\Windows\System\LTNJdCU.exe
  C:\Windows\System\LTNJdCU.exe
  2⤵
  PID:11728
- C:\Windows\System\MFlgLtD.exe
  C:\Windows\System\MFlgLtD.exe
  2⤵
  PID:11756
- C:\Windows\System\MeZaRMl.exe
  C:\Windows\System\MeZaRMl.exe
  2⤵
  PID:11772
- C:\Windows\System\HFcFXBU.exe
  C:\Windows\System\HFcFXBU.exe
  2⤵
  PID:11796
- C:\Windows\System\zEmhqRY.exe
  C:\Windows\System\zEmhqRY.exe
  2⤵
  PID:11816
- C:\Windows\System\wBxnNZP.exe
  C:\Windows\System\wBxnNZP.exe
  2⤵
  PID:11840
- C:\Windows\System\qiIQrjQ.exe
  C:\Windows\System\qiIQrjQ.exe
  2⤵
  PID:11864
- C:\Windows\System\CpweOcd.exe
  C:\Windows\System\CpweOcd.exe
  2⤵
  PID:11888
- C:\Windows\System\GrfHhGK.exe
  C:\Windows\System\GrfHhGK.exe
  2⤵
  PID:11908
- C:\Windows\System\gSKqfuI.exe
  C:\Windows\System\gSKqfuI.exe
  2⤵
  PID:11932
- C:\Windows\System\bBelCaY.exe
  C:\Windows\System\bBelCaY.exe
  2⤵
  PID:11956
- C:\Windows\System\WgGUwqz.exe
  C:\Windows\System\WgGUwqz.exe
  2⤵
  PID:11972
- C:\Windows\System\BgIratt.exe
  C:\Windows\System\BgIratt.exe
  2⤵
  PID:11996
- C:\Windows\System\cpCqJvh.exe
  C:\Windows\System\cpCqJvh.exe
  2⤵
  PID:12028
- C:\Windows\System\SXqcNGX.exe
  C:\Windows\System\SXqcNGX.exe
  2⤵
  PID:12048
- C:\Windows\System\mDfwApA.exe
  C:\Windows\System\mDfwApA.exe
  2⤵
  PID:12072
- C:\Windows\System\JdGgnhN.exe
  C:\Windows\System\JdGgnhN.exe
  2⤵
  PID:12088
- C:\Windows\System\IPoDzSn.exe
  C:\Windows\System\IPoDzSn.exe
  2⤵
  PID:12104
- C:\Windows\System\oiZmNeb.exe
  C:\Windows\System\oiZmNeb.exe
  2⤵
  PID:12120
- C:\Windows\System\PiBGFPz.exe
  C:\Windows\System\PiBGFPz.exe
  2⤵
  PID:12136
- C:\Windows\System\lYhmhBK.exe
  C:\Windows\System\lYhmhBK.exe
  2⤵
  PID:12156
- C:\Windows\System\NdJujhO.exe
  C:\Windows\System\NdJujhO.exe
  2⤵
  PID:12180
- C:\Windows\System\FEczvfJ.exe
  C:\Windows\System\FEczvfJ.exe
  2⤵
  PID:12200
- C:\Windows\System\JXVbRoW.exe
  C:\Windows\System\JXVbRoW.exe
  2⤵
  PID:12224
- C:\Windows\System\VIoEujh.exe
  C:\Windows\System\VIoEujh.exe
  2⤵
  PID:12248
- C:\Windows\System\BymUtDt.exe
  C:\Windows\System\BymUtDt.exe
  2⤵
  PID:12268
- C:\Windows\System\wzNSbqZ.exe
  C:\Windows\System\wzNSbqZ.exe
  2⤵
  PID:8460
- C:\Windows\System\adfmFvi.exe
  C:\Windows\System\adfmFvi.exe
  2⤵
  PID:7724
- C:\Windows\System\lkMuQxV.exe
  C:\Windows\System\lkMuQxV.exe
  2⤵
  PID:8016
- C:\Windows\System\yNJmNXv.exe
  C:\Windows\System\yNJmNXv.exe
  2⤵
  PID:9044
- C:\Windows\System\XkpbPWW.exe
  C:\Windows\System\XkpbPWW.exe
  2⤵
  PID:6108
- C:\Windows\System\gbBWAYo.exe
  C:\Windows\System\gbBWAYo.exe
  2⤵
  PID:10284
- C:\Windows\System\ClqoSHy.exe
  C:\Windows\System\ClqoSHy.exe
  2⤵
  PID:5336
- C:\Windows\System\BgtdfHl.exe
  C:\Windows\System\BgtdfHl.exe
  2⤵
  PID:7040
- C:\Windows\System\XzjUigc.exe
  C:\Windows\System\XzjUigc.exe
  2⤵
  PID:7936
- C:\Windows\System\ZkbyckA.exe
  C:\Windows\System\ZkbyckA.exe
  2⤵
  PID:7956
- C:\Windows\System\xrKofYt.exe
  C:\Windows\System\xrKofYt.exe
  2⤵
  PID:10452
- C:\Windows\System\hoUxERv.exe
  C:\Windows\System\hoUxERv.exe
  2⤵
  PID:10524
- C:\Windows\System\eJmISKh.exe
  C:\Windows\System\eJmISKh.exe
  2⤵
  PID:10584
- C:\Windows\System\BWQkhUg.exe
  C:\Windows\System\BWQkhUg.exe
  2⤵
  PID:6272
- C:\Windows\System\pcmyApW.exe
  C:\Windows\System\pcmyApW.exe
  2⤵
  PID:9264
- C:\Windows\System\Udyhdfi.exe
  C:\Windows\System\Udyhdfi.exe
  2⤵
  PID:10708
- C:\Windows\System\LdMXgGZ.exe
  C:\Windows\System\LdMXgGZ.exe
  2⤵
  PID:10772
- C:\Windows\System\OLXnIEM.exe
  C:\Windows\System\OLXnIEM.exe
  2⤵
  PID:10940
- C:\Windows\System\qkIDtvv.exe
  C:\Windows\System\qkIDtvv.exe
  2⤵
  PID:12300
- C:\Windows\System\FRqQneG.exe
  C:\Windows\System\FRqQneG.exe
  2⤵
  PID:12316
- C:\Windows\System\tskahLm.exe
  C:\Windows\System\tskahLm.exe
  2⤵
  PID:12340
- C:\Windows\System\DpkInXh.exe
  C:\Windows\System\DpkInXh.exe
  2⤵
  PID:12356
- C:\Windows\System\tRyjQxN.exe
  C:\Windows\System\tRyjQxN.exe
  2⤵
  PID:12380
- C:\Windows\System\durvmvp.exe
  C:\Windows\System\durvmvp.exe
  2⤵
  PID:12408
- C:\Windows\System\RqIaana.exe
  C:\Windows\System\RqIaana.exe
  2⤵
  PID:12428
- C:\Windows\System\mNYUOkQ.exe
  C:\Windows\System\mNYUOkQ.exe
  2⤵
  PID:12452
- C:\Windows\System\exAoXyQ.exe
  C:\Windows\System\exAoXyQ.exe
  2⤵
  PID:12476
- C:\Windows\System\CvdBRXg.exe
  C:\Windows\System\CvdBRXg.exe
  2⤵
  PID:12492
- C:\Windows\System\YqwVgTy.exe
  C:\Windows\System\YqwVgTy.exe
  2⤵
  PID:12516
- C:\Windows\System\ZfuxXRU.exe
  C:\Windows\System\ZfuxXRU.exe
  2⤵
  PID:12540
- C:\Windows\System\PfenYmh.exe
  C:\Windows\System\PfenYmh.exe
  2⤵
  PID:12560
- C:\Windows\System\fpHtDyx.exe
  C:\Windows\System\fpHtDyx.exe
  2⤵
  PID:12580
- C:\Windows\System\mZSaKbG.exe
  C:\Windows\System\mZSaKbG.exe
  2⤵
  PID:12604
- C:\Windows\System\nqsUKkH.exe
  C:\Windows\System\nqsUKkH.exe
  2⤵
  PID:12624
- C:\Windows\System\AabnQDc.exe
  C:\Windows\System\AabnQDc.exe
  2⤵
  PID:12648
- C:\Windows\System\muWmuIL.exe
  C:\Windows\System\muWmuIL.exe
  2⤵
  PID:12672
- C:\Windows\System\EuUsNWI.exe
  C:\Windows\System\EuUsNWI.exe
  2⤵
  PID:12692
- C:\Windows\System\jlFHxEi.exe
  C:\Windows\System\jlFHxEi.exe
  2⤵
  PID:12712
- C:\Windows\System\XDfkIvR.exe
  C:\Windows\System\XDfkIvR.exe
  2⤵
  PID:12732
- C:\Windows\System\czBeIaH.exe
  C:\Windows\System\czBeIaH.exe
  2⤵
  PID:12752
- C:\Windows\System\EPXaepV.exe
  C:\Windows\System\EPXaepV.exe
  2⤵
  PID:12776
- C:\Windows\System\xLWqCDW.exe
  C:\Windows\System\xLWqCDW.exe
  2⤵
  PID:12800
- C:\Windows\System\EUibbLQ.exe
  C:\Windows\System\EUibbLQ.exe
  2⤵
  PID:12820
- C:\Windows\System\ZyJDBAq.exe
  C:\Windows\System\ZyJDBAq.exe
  2⤵
  PID:12836
- C:\Windows\System\KtgbZzM.exe
  C:\Windows\System\KtgbZzM.exe
  2⤵
  PID:12860
- C:\Windows\System\afvoDEq.exe
  C:\Windows\System\afvoDEq.exe
  2⤵
  PID:12884
- C:\Windows\System\MasKpcr.exe
  C:\Windows\System\MasKpcr.exe
  2⤵
  PID:12904
- C:\Windows\System\LaOIObq.exe
  C:\Windows\System\LaOIObq.exe
  2⤵
  PID:12928
- C:\Windows\System\izfdLFh.exe
  C:\Windows\System\izfdLFh.exe
  2⤵
  PID:12948
- C:\Windows\System\ZGZiejf.exe
  C:\Windows\System\ZGZiejf.exe
  2⤵
  PID:12972
- C:\Windows\System\MLYQcac.exe
  C:\Windows\System\MLYQcac.exe
  2⤵
  PID:12992
- C:\Windows\System\veTZCqe.exe
  C:\Windows\System\veTZCqe.exe
  2⤵
  PID:13012
- C:\Windows\System\xVSKlIQ.exe
  C:\Windows\System\xVSKlIQ.exe
  2⤵
  PID:11792
- C:\Windows\System\zlCuwdS.exe
  C:\Windows\System\zlCuwdS.exe
  2⤵
  PID:8688
- C:\Windows\System\TtJeusN.exe
  C:\Windows\System\TtJeusN.exe
  2⤵
  PID:12980
- C:\Windows\System\JlLoicv.exe
  C:\Windows\System\JlLoicv.exe
  2⤵
  PID:13024
- C:\Windows\System\aXOnIDZ.exe
  C:\Windows\System\aXOnIDZ.exe
  2⤵
  PID:7800
- C:\Windows\System\dkcTxQJ.exe
  C:\Windows\System\dkcTxQJ.exe
  2⤵
  PID:13168
- C:\Windows\System\YjvtgNG.exe
  C:\Windows\System\YjvtgNG.exe
  2⤵
  PID:13184
- C:\Windows\System\IIjtEfZ.exe
  C:\Windows\System\IIjtEfZ.exe
  2⤵
  PID:10432
- C:\Windows\System\qsUuPPQ.exe
  C:\Windows\System\qsUuPPQ.exe
  2⤵
  PID:4956
- C:\Windows\System\ROKExYN.exe
  C:\Windows\System\ROKExYN.exe
  2⤵
  PID:11012
- C:\Windows\System\CmheDHt.exe
  C:\Windows\System\CmheDHt.exe
  2⤵
  PID:11464
- C:\Windows\System\oCSTqGD.exe
  C:\Windows\System\oCSTqGD.exe
  2⤵
  PID:8748
- C:\Windows\System\PUMTXde.exe
  C:\Windows\System\PUMTXde.exe
  2⤵
  PID:8892
- C:\Windows\System\fSugdqH.exe
  C:\Windows\System\fSugdqH.exe
  2⤵
  PID:8828
- C:\Windows\System\onIzpWG.exe
  C:\Windows\System\onIzpWG.exe
  2⤵
  PID:10172
- C:\Windows\System\cfBsfHh.exe
  C:\Windows\System\cfBsfHh.exe
  2⤵
  PID:10168
- C:\Windows\System\rSgnqYj.exe
  C:\Windows\System\rSgnqYj.exe
  2⤵
  PID:8364
- C:\Windows\System\QXtvBIy.exe
  C:\Windows\System\QXtvBIy.exe
  2⤵
  PID:7172
- C:\Windows\System\kyRoKtL.exe
  C:\Windows\System\kyRoKtL.exe
  2⤵
  PID:9180
- C:\Windows\System\RaLYDCD.exe
  C:\Windows\System\RaLYDCD.exe
  2⤵
  PID:11624
- C:\Windows\System\Lehmgls.exe
  C:\Windows\System\Lehmgls.exe
  2⤵
  PID:7208
- C:\Windows\System\NXIPGLz.exe
  C:\Windows\System\NXIPGLz.exe
  2⤵
  PID:11408
- C:\Windows\System\ganuUSl.exe
  C:\Windows\System\ganuUSl.exe
  2⤵
  PID:10560
- C:\Windows\System\rXRPoHN.exe
  C:\Windows\System\rXRPoHN.exe
  2⤵
  PID:12284
- C:\Windows\System\SSkKNRb.exe
  C:\Windows\System\SSkKNRb.exe
  2⤵
  PID:10964
- C:\Windows\System\fpINech.exe
  C:\Windows\System\fpINech.exe
  2⤵
  PID:6196
- C:\Windows\System\DbNtqqL.exe
  C:\Windows\System\DbNtqqL.exe
  2⤵
  PID:9784
- C:\Windows\System\qqSWvyk.exe
  C:\Windows\System\qqSWvyk.exe
  2⤵
  PID:8208
- C:\Windows\System\xZpMWLe.exe
  C:\Windows\System\xZpMWLe.exe
  2⤵
  PID:11244
- C:\Windows\System\oKBpuTr.exe
  C:\Windows\System\oKBpuTr.exe
  2⤵
  PID:7592
- C:\Windows\System\IVExGQA.exe
  C:\Windows\System\IVExGQA.exe
  2⤵
  PID:9228
- C:\Windows\System\bYRSizA.exe
  C:\Windows\System\bYRSizA.exe
  2⤵
  PID:9288
- C:\Windows\System\lVGfsZZ.exe
  C:\Windows\System\lVGfsZZ.exe
  2⤵
  PID:7652
- C:\Windows\System\gvzZdcV.exe
  C:\Windows\System\gvzZdcV.exe
  2⤵
  PID:9524
- C:\Windows\System\WfuhBZg.exe
  C:\Windows\System\WfuhBZg.exe
  2⤵
  PID:8992
- C:\Windows\System\rWrhEED.exe
  C:\Windows\System\rWrhEED.exe
  2⤵
  PID:10460
- C:\Windows\System\VmHlKBK.exe
  C:\Windows\System\VmHlKBK.exe
  2⤵
  PID:8044
- C:\Windows\System\svjqDbj.exe
  C:\Windows\System\svjqDbj.exe
  2⤵
  PID:11980
- C:\Windows\System\iFwfNIK.exe
  C:\Windows\System\iFwfNIK.exe
  2⤵
  PID:1140
- C:\Windows\System\sPpYAUa.exe
  C:\Windows\System\sPpYAUa.exe
  2⤵
  PID:9640
- C:\Windows\System\RiRXLwP.exe
  C:\Windows\System\RiRXLwP.exe
  2⤵
  PID:11532
- C:\Windows\System\kkPEpBa.exe
  C:\Windows\System\kkPEpBa.exe
  2⤵
  PID:10144
- C:\Windows\System\WQtpnBn.exe
  C:\Windows\System\WQtpnBn.exe
  2⤵
  PID:11804
- C:\Windows\System\KtViOXV.exe
  C:\Windows\System\KtViOXV.exe
  2⤵
  PID:11964
- C:\Windows\System\FMwFBgs.exe
  C:\Windows\System\FMwFBgs.exe
  2⤵
  PID:10788
- C:\Windows\System\MWqJlSw.exe
  C:\Windows\System\MWqJlSw.exe
  2⤵
  PID:10724
- C:\Windows\System\VLQjLPY.exe
  C:\Windows\System\VLQjLPY.exe
  2⤵
  PID:6796
- C:\Windows\System\njETDSo.exe
  C:\Windows\System\njETDSo.exe
  2⤵
  PID:12332
- C:\Windows\System\kJhXRdn.exe
  C:\Windows\System\kJhXRdn.exe
  2⤵
  PID:11276
- C:\Windows\System\FeEzhjR.exe
  C:\Windows\System\FeEzhjR.exe
  2⤵
  PID:12868
- C:\Windows\System\IGciWns.exe
  C:\Windows\System\IGciWns.exe
  2⤵
  PID:12916
- C:\Windows\System\DnqYoUA.exe
  C:\Windows\System\DnqYoUA.exe
  2⤵
  PID:6156
- C:\Windows\System\kbLMAwP.exe
  C:\Windows\System\kbLMAwP.exe
  2⤵
  PID:10880
- C:\Windows\System\mDGXKkm.exe
  C:\Windows\System\mDGXKkm.exe
  2⤵
  PID:6636
- C:\Windows\System\UgYuybb.exe
  C:\Windows\System\UgYuybb.exe
  2⤵
  PID:11952
- C:\Windows\System\xmXOTOP.exe
  C:\Windows\System\xmXOTOP.exe
  2⤵
  PID:12008
- C:\Windows\System\wYqOQjV.exe
  C:\Windows\System\wYqOQjV.exe
  2⤵
  PID:11152
- C:\Windows\System\xyDTwzl.exe
  C:\Windows\System\xyDTwzl.exe
  2⤵
  PID:13268
- C:\Windows\System\zgRrkOy.exe
  C:\Windows\System\zgRrkOy.exe
  2⤵
  PID:9828
- C:\Windows\System\PBHIRyO.exe
  C:\Windows\System\PBHIRyO.exe
  2⤵
  PID:9672
- C:\Windows\System\mzrmKSo.exe
  C:\Windows\System\mzrmKSo.exe
  2⤵
  PID:6600
- C:\Windows\System\ZGPjlNC.exe
  C:\Windows\System\ZGPjlNC.exe
  2⤵
  PID:7884
- C:\Windows\System\rvFRpNN.exe
  C:\Windows\System\rvFRpNN.exe
  2⤵
  PID:12500
- C:\Windows\System\arVMdTp.exe
  C:\Windows\System\arVMdTp.exe
  2⤵
  PID:13104
- C:\Windows\System\qNsBmJP.exe
  C:\Windows\System\qNsBmJP.exe
  2⤵
  PID:9984
- C:\Windows\System\vzUlapq.exe
  C:\Windows\System\vzUlapq.exe
  2⤵
  PID:12236
- C:\Windows\System\TSXyVEZ.exe
  C:\Windows\System\TSXyVEZ.exe
  2⤵
  PID:11788
- C:\Windows\System\ZJetSKm.exe
  C:\Windows\System\ZJetSKm.exe
  2⤵
  PID:13040
- C:\Windows\System\EskPuUr.exe
  C:\Windows\System\EskPuUr.exe
  2⤵
  PID:10104
- C:\Windows\System\rSoiMtK.exe
  C:\Windows\System\rSoiMtK.exe
  2⤵
  PID:13144
- C:\Windows\System\wbnTRcX.exe
  C:\Windows\System\wbnTRcX.exe
  2⤵
  PID:7236
- C:\Windows\System\yQYqujD.exe
  C:\Windows\System\yQYqujD.exe
  2⤵
  PID:5324
- C:\Windows\System\arbbZnO.exe
  C:\Windows\System\arbbZnO.exe
  2⤵
  PID:13328
- C:\Windows\System\XnzXQdd.exe
  C:\Windows\System\XnzXQdd.exe
  2⤵
  PID:13344
- C:\Windows\System\uFefxfh.exe
  C:\Windows\System\uFefxfh.exe
  2⤵
  PID:13360
- C:\Windows\System\nGxYsSf.exe
  C:\Windows\System\nGxYsSf.exe
  2⤵
  PID:13400
- C:\Windows\System\EnHCMXp.exe
  C:\Windows\System\EnHCMXp.exe
  2⤵
  PID:13456
- C:\Windows\System\NBgyXZN.exe
  C:\Windows\System\NBgyXZN.exe
  2⤵
  PID:13484
- C:\Windows\System\eWsdYDV.exe
  C:\Windows\System\eWsdYDV.exe
  2⤵
  PID:13508
- C:\Windows\System\CqBOBrQ.exe
  C:\Windows\System\CqBOBrQ.exe
  2⤵
  PID:13536
- C:\Windows\System\nALBggG.exe
  C:\Windows\System\nALBggG.exe
  2⤵
  PID:13552
- C:\Windows\System\FSWNmCg.exe
  C:\Windows\System\FSWNmCg.exe
  2⤵
  PID:13576
- C:\Windows\System\UxdEwgL.exe
  C:\Windows\System\UxdEwgL.exe
  2⤵
  PID:13596
- C:\Windows\System\HNmZvLc.exe
  C:\Windows\System\HNmZvLc.exe
  2⤵
  PID:13620
- C:\Windows\System\TGzmLxA.exe
  C:\Windows\System\TGzmLxA.exe
  2⤵
  PID:13640
- C:\Windows\System\qEVlSvc.exe
  C:\Windows\System\qEVlSvc.exe
  2⤵
  PID:13660
- C:\Windows\System\hQGDkEQ.exe
  C:\Windows\System\hQGDkEQ.exe
  2⤵
  PID:13684
- C:\Windows\System\nzELKKy.exe
  C:\Windows\System\nzELKKy.exe
  2⤵
  PID:13760
- C:\Windows\System\wmNcTui.exe
  C:\Windows\System\wmNcTui.exe
  2⤵
  PID:13780
- C:\Windows\System\PUdfZhY.exe
  C:\Windows\System\PUdfZhY.exe
  2⤵
  PID:13952
- C:\Windows\System\tzznLzS.exe
  C:\Windows\System\tzznLzS.exe
  2⤵
  PID:13968
- C:\Windows\System\XZcANYf.exe
  C:\Windows\System\XZcANYf.exe
  2⤵
  PID:13984
- C:\Windows\System\vviSrCc.exe
  C:\Windows\System\vviSrCc.exe
  2⤵
  PID:14000
- C:\Windows\System\LhYCEFF.exe
  C:\Windows\System\LhYCEFF.exe
  2⤵
  PID:14044
- C:\Windows\System\qokSAsQ.exe
  C:\Windows\System\qokSAsQ.exe
  2⤵
  PID:14060
- C:\Windows\System\OZxEvgi.exe
  C:\Windows\System\OZxEvgi.exe
  2⤵
  PID:14080
- C:\Windows\System\lZRvwCT.exe
  C:\Windows\System\lZRvwCT.exe
  2⤵
  PID:14100
- C:\Windows\System\NQQHDVy.exe
  C:\Windows\System\NQQHDVy.exe
  2⤵
  PID:14124
- C:\Windows\System\cMBentx.exe
  C:\Windows\System\cMBentx.exe
  2⤵
  PID:14148
- C:\Windows\System\maWsyBz.exe
  C:\Windows\System\maWsyBz.exe
  2⤵
  PID:13588
- C:\Windows\System\aebkZDu.exe
  C:\Windows\System\aebkZDu.exe
  2⤵
  PID:13072
- C:\Windows\System\SGuTqTH.exe
  C:\Windows\System\SGuTqTH.exe
  2⤵
  PID:13084
- C:\Windows\System\qqCsrCm.exe
  C:\Windows\System\qqCsrCm.exe
  2⤵
  PID:13812
- C:\Windows\System\eRgIcia.exe
  C:\Windows\System\eRgIcia.exe
  2⤵
  PID:8956
- C:\Windows\System\xWgdWYc.exe
  C:\Windows\System\xWgdWYc.exe
  2⤵
  PID:14016
- C:\Windows\System\pEwVNzJ.exe
  C:\Windows\System\pEwVNzJ.exe
  2⤵
  PID:13444
- C:\Windows\System\DfjLvaq.exe
  C:\Windows\System\DfjLvaq.exe
  2⤵
  PID:14076
- C:\Windows\System\KqXtiBM.exe
  C:\Windows\System\KqXtiBM.exe
  2⤵
  PID:14116
- C:\Windows\System\GDmeFgk.exe
  C:\Windows\System\GDmeFgk.exe
  2⤵
  PID:13476
- C:\Windows\System\ZPiomaG.exe
  C:\Windows\System\ZPiomaG.exe
  2⤵
  PID:9272
- C:\Windows\System\dpnhiMX.exe
  C:\Windows\System\dpnhiMX.exe
  2⤵
  PID:14192
- C:\Windows\System\DtXkwbo.exe
  C:\Windows\System\DtXkwbo.exe
  2⤵
  PID:10564
- C:\Windows\System\utfVmak.exe
  C:\Windows\System\utfVmak.exe
  2⤵
  PID:13324
- C:\Windows\System\dWyoYwM.exe
  C:\Windows\System\dWyoYwM.exe
  2⤵
  PID:13356
- C:\Windows\System\HGMEmfO.exe
  C:\Windows\System\HGMEmfO.exe
  2⤵
  PID:13424
- C:\Windows\System\CpTJygh.exe
  C:\Windows\System\CpTJygh.exe
  2⤵
  PID:13464
- C:\Windows\System\jWThTxh.exe
  C:\Windows\System\jWThTxh.exe
  2⤵
  PID:13668
- C:\Windows\System\KOZSOIe.exe
  C:\Windows\System\KOZSOIe.exe
  2⤵
  PID:12168
- C:\Windows\System\puVkESt.exe
  C:\Windows\System\puVkESt.exe
  2⤵
  PID:10764
- C:\Windows\System\mniuVmW.exe
  C:\Windows\System\mniuVmW.exe
  2⤵
  PID:8088
- C:\Windows\System\pPCRaue.exe
  C:\Windows\System\pPCRaue.exe
  2⤵
  PID:8632
- C:\Windows\System\HmhfUfw.exe
  C:\Windows\System\HmhfUfw.exe
  2⤵
  PID:13392
- C:\Windows\System\pYDKZEa.exe
  C:\Windows\System\pYDKZEa.exe
  2⤵
  PID:13352
- C:\Windows\System\HUKrxwF.exe
  C:\Windows\System\HUKrxwF.exe
  2⤵
  PID:14028
- C:\Windows\System\eTUaAVf.exe
  C:\Windows\System\eTUaAVf.exe
  2⤵
  PID:8292
- C:\Windows\System\xXUXKRX.exe
  C:\Windows\System\xXUXKRX.exe
  2⤵
  PID:13980
- C:\Windows\System\nlhrBnB.exe
  C:\Windows\System\nlhrBnB.exe
  2⤵
  PID:14136
- C:\Windows\System\qsFcjtM.exe
  C:\Windows\System\qsFcjtM.exe
  2⤵
  PID:13656
- C:\Windows\System\KzLAbYQ.exe
  C:\Windows\System\KzLAbYQ.exe
  2⤵
  PID:14056
- C:\Windows\System\tHXbctC.exe
  C:\Windows\System\tHXbctC.exe
  2⤵
  PID:13916
- C:\Windows\System\DinKMYM.exe
  C:\Windows\System\DinKMYM.exe
  2⤵
  PID:13844
- C:\Windows\System\lYTPdhZ.exe
  C:\Windows\System\lYTPdhZ.exe
  2⤵
  PID:10960
- C:\Windows\System\mPEHYDO.exe
  C:\Windows\System\mPEHYDO.exe
  2⤵
  PID:10188
- C:\Windows\System\WtEKLdk.exe
  C:\Windows\System\WtEKLdk.exe
  2⤵
  PID:14160
- C:\Windows\System\PUxlMKU.exe
  C:\Windows\System\PUxlMKU.exe
  2⤵
  PID:13880
- C:\Windows\System\IrTowtP.exe
  C:\Windows\System\IrTowtP.exe
  2⤵
  PID:1228
- C:\Windows\System\AqwTMBv.exe
  C:\Windows\System\AqwTMBv.exe
  2⤵
  PID:14032
- C:\Windows\System\KRNYSnP.exe
  C:\Windows\System\KRNYSnP.exe
  2⤵
  PID:13448
- C:\Windows\System\TJQzocT.exe
  C:\Windows\System\TJQzocT.exe
  2⤵
  PID:14264
- C:\Windows\System\EMwrLuz.exe
  C:\Windows\System\EMwrLuz.exe
  2⤵
  PID:8076
- C:\Windows\System\zPucfQx.exe
  C:\Windows\System\zPucfQx.exe
  2⤵
  PID:11412
- C:\Windows\System\bBssyza.exe
  C:\Windows\System\bBssyza.exe
  2⤵
  PID:13676
- C:\Windows\System\kdtVRdF.exe
  C:\Windows\System\kdtVRdF.exe
  2⤵
  PID:9080
- C:\Windows\System\OjPSnwi.exe
  C:\Windows\System\OjPSnwi.exe
  2⤵
  PID:14944
- C:\Windows\System\DqqJsgi.exe
  C:\Windows\System\DqqJsgi.exe
  2⤵
  PID:14972
- C:\Windows\System\EATzwOH.exe
  C:\Windows\System\EATzwOH.exe
  2⤵
  PID:15004
- C:\Windows\System\RvFdxuJ.exe
  C:\Windows\System\RvFdxuJ.exe
  2⤵
  PID:15024
- C:\Windows\System\tFREYgQ.exe
  C:\Windows\System\tFREYgQ.exe
  2⤵
  PID:15080
- C:\Windows\System\sZaBpnf.exe
  C:\Windows\System\sZaBpnf.exe
  2⤵
  PID:15096
- C:\Windows\System\BaGuRnY.exe
  C:\Windows\System\BaGuRnY.exe
  2⤵
  PID:15132
- C:\Windows\System\xkORvJd.exe
  C:\Windows\System\xkORvJd.exe
  2⤵
  PID:15160
- C:\Windows\System\slNgTQI.exe
  C:\Windows\System\slNgTQI.exe
  2⤵
  PID:15180
- C:\Windows\System\TmQSBFA.exe
  C:\Windows\System\TmQSBFA.exe
  2⤵
  PID:15196
- C:\Windows\System\YNXUWqq.exe
  C:\Windows\System\YNXUWqq.exe
  2⤵
  PID:15212
- C:\Windows\System\yJgXsZC.exe
  C:\Windows\System\yJgXsZC.exe
  2⤵
  PID:15240
- C:\Windows\System\AQvVYqD.exe
  C:\Windows\System\AQvVYqD.exe
  2⤵
  PID:15264
- C:\Windows\System\veQsdxo.exe
  C:\Windows\System\veQsdxo.exe
  2⤵
  PID:15280
- C:\Windows\System\gijguXw.exe
  C:\Windows\System\gijguXw.exe
  2⤵
  PID:15304
- C:\Windows\System\rRwQCvv.exe
  C:\Windows\System\rRwQCvv.exe
  2⤵
  PID:14068
- C:\Windows\System\wkzjoZW.exe
  C:\Windows\System\wkzjoZW.exe
  2⤵
  PID:11748
- C:\Windows\System\QcBLdUJ.exe
  C:\Windows\System\QcBLdUJ.exe
  2⤵
  PID:14220
- C:\Windows\System\OJmvCJf.exe
  C:\Windows\System\OJmvCJf.exe
  2⤵
  PID:10916
- C:\Windows\System\isAVvvH.exe
  C:\Windows\System\isAVvvH.exe
  2⤵
  PID:14396
- C:\Windows\System\DWTbNUm.exe
  C:\Windows\System\DWTbNUm.exe
  2⤵
  PID:14432
- C:\Windows\System\qDkdOlK.exe
  C:\Windows\System\qDkdOlK.exe
  2⤵
  PID:14612
- C:\Windows\System\RlbVvqR.exe
  C:\Windows\System\RlbVvqR.exe
  2⤵
  PID:14664
- C:\Windows\System\jhQTdoY.exe
  C:\Windows\System\jhQTdoY.exe
  2⤵
  PID:14568
- C:\Windows\System\YYHeykV.exe
  C:\Windows\System\YYHeykV.exe
  2⤵
  PID:14740
- C:\Windows\System\GPunOCb.exe
  C:\Windows\System\GPunOCb.exe
  2⤵
  PID:14600
- C:\Windows\System\IgSsJAz.exe
  C:\Windows\System\IgSsJAz.exe
  2⤵
  PID:14744
- C:\Windows\System\ZpwdIOv.exe
  C:\Windows\System\ZpwdIOv.exe
  2⤵
  PID:14844
- C:\Windows\System\eWAjSBV.exe
  C:\Windows\System\eWAjSBV.exe
  2⤵
  PID:14792
- C:\Windows\System\XDiMtRn.exe
  C:\Windows\System\XDiMtRn.exe
  2⤵
  PID:14660
- C:\Windows\System\lDbACia.exe
  C:\Windows\System\lDbACia.exe
  2⤵
  PID:14700
- C:\Windows\System\gfBWSPw.exe
  C:\Windows\System\gfBWSPw.exe
  2⤵
  PID:14800
- C:\Windows\System\sShnKmG.exe
  C:\Windows\System\sShnKmG.exe
  2⤵
  PID:14820
- C:\Windows\System\oodRYxj.exe
  C:\Windows\System\oodRYxj.exe
  2⤵
  PID:14908
- C:\Windows\System\ECpPUMg.exe
  C:\Windows\System\ECpPUMg.exe
  2⤵
  PID:14988
- C:\Windows\System\QBBWoui.exe
  C:\Windows\System\QBBWoui.exe
  2⤵
  PID:15312
- C:\Windows\System\HSoQcsk.exe
  C:\Windows\System\HSoQcsk.exe
  2⤵
  PID:15192
- C:\Windows\System\YkEPlzH.exe
  C:\Windows\System\YkEPlzH.exe
  2⤵
  PID:15092
- C:\Windows\System\bcfMCfl.exe
  C:\Windows\System\bcfMCfl.exe
  2⤵
  PID:15144
- C:\Windows\System\WsczXDd.exe
  C:\Windows\System\WsczXDd.exe
  2⤵
  PID:11452
- C:\Windows\System\fRLbQwE.exe
  C:\Windows\System\fRLbQwE.exe
  2⤵
  PID:13316
- C:\Windows\System\ikxtAmA.exe
  C:\Windows\System\ikxtAmA.exe
  2⤵
  PID:14552
- C:\Windows\System\cAiChAH.exe
  C:\Windows\System\cAiChAH.exe
  2⤵
  PID:14548
- C:\Windows\System\ZeFoNaU.exe
  C:\Windows\System\ZeFoNaU.exe
  2⤵
  PID:14360
- C:\Windows\System\YSfLBgv.exe
  C:\Windows\System\YSfLBgv.exe
  2⤵
  PID:14620
- C:\Windows\System\rcvKnbT.exe
  C:\Windows\System\rcvKnbT.exe
  2⤵
  PID:14688
- C:\Windows\System\SEAFwjR.exe
  C:\Windows\System\SEAFwjR.exe
  2⤵
  PID:14736
- C:\Windows\System\opQViwj.exe
  C:\Windows\System\opQViwj.exe
  2⤵
  PID:14696
- C:\Windows\System\VzhRDGG.exe
  C:\Windows\System\VzhRDGG.exe
  2⤵
  PID:1384
- C:\Windows\System\oAYuuoc.exe
  C:\Windows\System\oAYuuoc.exe
  2⤵
  PID:14828
- C:\Windows\System\blYtAoB.exe
  C:\Windows\System\blYtAoB.exe
  2⤵
  PID:14952
- C:\Windows\System\LbkHUxK.exe
  C:\Windows\System\LbkHUxK.exe
  2⤵
  PID:14920
- C:\Windows\System\qwHFYyE.exe
  C:\Windows\System\qwHFYyE.exe
  2⤵
  PID:15020
- C:\Windows\System\efEZtdY.exe
  C:\Windows\System\efEZtdY.exe
  2⤵
  PID:15052
- C:\Windows\System\vwAQlEn.exe
  C:\Windows\System\vwAQlEn.exe
  2⤵
  PID:14640
- C:\Windows\System\wZQWNxh.exe
  C:\Windows\System\wZQWNxh.exe
  2⤵
  PID:15112
- C:\Windows\System\NzMCVpZ.exe
  C:\Windows\System\NzMCVpZ.exe
  2⤵
  PID:14916
- C:\Windows\System\qQuSqIu.exe
  C:\Windows\System\qQuSqIu.exe
  2⤵
  PID:15076
- C:\Windows\System\DWfpLKe.exe
  C:\Windows\System\DWfpLKe.exe
  2⤵
  PID:15172
- C:\Windows\System\vWfLSRn.exe
  C:\Windows\System\vWfLSRn.exe
  2⤵
  PID:14868
- C:\Windows\System\CabbWyH.exe
  C:\Windows\System\CabbWyH.exe
  2⤵
  PID:13948
- C:\Windows\System\tKAKnwo.exe
  C:\Windows\System\tKAKnwo.exe
  2⤵
  PID:14248
- C:\Windows\System\zjxnlDn.exe
  C:\Windows\System\zjxnlDn.exe
  2⤵
  PID:15168
- C:\Windows\System\UpCHHVW.exe
  C:\Windows\System\UpCHHVW.exe
  2⤵
  PID:14132
- C:\Windows\System\vuDtQBf.exe
  C:\Windows\System\vuDtQBf.exe
  2⤵
  PID:6456
- C:\Windows\System\NEQctSP.exe
  C:\Windows\System\NEQctSP.exe
  2⤵
  PID:15248
- C:\Windows\System\ZmUFpNA.exe
  C:\Windows\System\ZmUFpNA.exe
  2⤵
  PID:15140
- C:\Windows\System\AWmFqJU.exe
  C:\Windows\System\AWmFqJU.exe
  2⤵
  PID:15292
- C:\Windows\System\LsFZEwf.exe
  C:\Windows\System\LsFZEwf.exe
  2⤵
  PID:468
- C:\Windows\System\MVyRTyu.exe
  C:\Windows\System\MVyRTyu.exe
  2⤵
  PID:13804
- C:\Windows\System\tLAvebk.exe
  C:\Windows\System\tLAvebk.exe
  2⤵
  PID:13116
- C:\Windows\System\ervwdqg.exe
  C:\Windows\System\ervwdqg.exe
  2⤵
  PID:13996
- C:\Windows\System\IiaNBJr.exe
  C:\Windows\System\IiaNBJr.exe
  2⤵
  PID:15044
- C:\Windows\System\zZCmNMY.exe
  C:\Windows\System\zZCmNMY.exe
  2⤵
  PID:14096
- C:\Windows\System\exynTzt.exe
  C:\Windows\System\exynTzt.exe
  2⤵
  PID:15356
- C:\Windows\System\ICvlWKe.exe
  C:\Windows\System\ICvlWKe.exe
  2⤵
  PID:11648
- C:\Windows\System\kYLJvlA.exe
  C:\Windows\System\kYLJvlA.exe
  2⤵
  PID:14388
- C:\Windows\System\abTaKYX.exe
  C:\Windows\System\abTaKYX.exe
  2⤵
  PID:5204
- C:\Windows\System\swLjyio.exe
  C:\Windows\System\swLjyio.exe
  2⤵
  PID:14488
- C:\Windows\System\lSwtCxa.exe
  C:\Windows\System\lSwtCxa.exe
  2⤵
  PID:1192
- C:\Windows\System\LYmhBnH.exe
  C:\Windows\System\LYmhBnH.exe
  2⤵
  PID:14368
- C:\Windows\System\DVCyAoG.exe
  C:\Windows\System\DVCyAoG.exe
  2⤵
  PID:14572
- C:\Windows\System\nbUewQO.exe
  C:\Windows\System\nbUewQO.exe
  2⤵
  PID:14528
- C:\Windows\System\KJmMELJ.exe
  C:\Windows\System\KJmMELJ.exe
  2⤵
  PID:14444
- C:\Windows\System\wvggBqd.exe
  C:\Windows\System\wvggBqd.exe
  2⤵
  PID:1756
- C:\Windows\System\ajBMdgX.exe
  C:\Windows\System\ajBMdgX.exe
  2⤵
  PID:14460
- C:\Windows\System\YlJRllm.exe
  C:\Windows\System\YlJRllm.exe
  2⤵
  PID:2280
- C:\Windows\System\JJfwlTN.exe
  C:\Windows\System\JJfwlTN.exe
  2⤵
  PID:1588
- C:\Windows\System\BOpGIHR.exe
  C:\Windows\System\BOpGIHR.exe
  2⤵
  PID:1180
- C:\Windows\System\OMJKjRh.exe
  C:\Windows\System\OMJKjRh.exe
  2⤵
  PID:4648
- C:\Windows\System\rulhHOo.exe
  C:\Windows\System\rulhHOo.exe
  2⤵
  PID:15000
- C:\Windows\System\PSiiQBj.exe
  C:\Windows\System\PSiiQBj.exe
  2⤵
  PID:14596
- C:\Windows\System\UaRdxtQ.exe
  C:\Windows\System\UaRdxtQ.exe
  2⤵
  PID:14788
- C:\Windows\System\YGXAlWi.exe
  C:\Windows\System\YGXAlWi.exe
  2⤵
  PID:14780
- C:\Windows\System\GNTztIz.exe
  C:\Windows\System\GNTztIz.exe
  2⤵
  PID:1652
- C:\Windows\System\TXuriCe.exe
  C:\Windows\System\TXuriCe.exe
  2⤵
  PID:4064
- C:\Windows\System\JchfZwF.exe
  C:\Windows\System\JchfZwF.exe
  2⤵
  PID:15048
- C:\Windows\System\CmWQJTw.exe
  C:\Windows\System\CmWQJTw.exe
  2⤵
  PID:14932
- C:\Windows\System\AlHMYYt.exe
  C:\Windows\System\AlHMYYt.exe
  2⤵
  PID:15204
- C:\Windows\System\jHVmbhh.exe
  C:\Windows\System\jHVmbhh.exe
  2⤵
  PID:15016
- C:\Windows\System\laAPJbM.exe
  C:\Windows\System\laAPJbM.exe
  2⤵
  PID:14900
- C:\Windows\System\mARMsKk.exe
  C:\Windows\System\mARMsKk.exe
  2⤵
  PID:15348
- C:\Windows\System\bLnzKXH.exe
  C:\Windows\System\bLnzKXH.exe
  2⤵
  PID:15228
- C:\Windows\System\cpoPINU.exe
  C:\Windows\System\cpoPINU.exe
  2⤵
  PID:15176
- C:\Windows\System\WQYCKxb.exe
  C:\Windows\System\WQYCKxb.exe
  2⤵
  PID:15040
- C:\Windows\System\aBOlRxl.exe
  C:\Windows\System\aBOlRxl.exe
  2⤵
  PID:13652
- C:\Windows\System\gEyHHRU.exe
  C:\Windows\System\gEyHHRU.exe
  2⤵
  PID:7392
- C:\Windows\System\lvuVkZs.exe
  C:\Windows\System\lvuVkZs.exe
  2⤵
  PID:11168
- C:\Windows\System\hsnHiot.exe
  C:\Windows\System\hsnHiot.exe
  2⤵
  PID:8020
- C:\Windows\System\NeNEIcG.exe
  C:\Windows\System\NeNEIcG.exe
  2⤵
  PID:14352
- C:\Windows\System\GSmXuia.exe
  C:\Windows\System\GSmXuia.exe
  2⤵
  PID:14520
- C:\Windows\System\xkDsren.exe
  C:\Windows\System\xkDsren.exe
  2⤵
  PID:14732
- C:\Windows\System\IsGLVsS.exe
  C:\Windows\System\IsGLVsS.exe
  2⤵
  PID:14412
- C:\Windows\System\PptwLva.exe
  C:\Windows\System\PptwLva.exe
  2⤵
  PID:15036
- C:\Windows\System\xMaAIQA.exe
  C:\Windows\System\xMaAIQA.exe
  2⤵
  PID:14624
- C:\Windows\System\AQkoZwr.exe
  C:\Windows\System\AQkoZwr.exe
  2⤵
  PID:14644
- C:\Windows\System\ZrXAmis.exe
  C:\Windows\System\ZrXAmis.exe
  2⤵
  PID:2184
- C:\Windows\System\uRintDK.exe
  C:\Windows\System\uRintDK.exe
  2⤵
  PID:14108
- C:\Windows\System\cNSVXte.exe
  C:\Windows\System\cNSVXte.exe
  2⤵
  PID:14468
- C:\Windows\System\qncSTeY.exe
  C:\Windows\System\qncSTeY.exe
  2⤵
  PID:14720
- C:\Windows\System\DnGuOFw.exe
  C:\Windows\System\DnGuOFw.exe
  2⤵
  PID:4156
- C:\Windows\System\wprxXmG.exe
  C:\Windows\System\wprxXmG.exe
  2⤵
  PID:14784
- C:\Windows\System\pkwXfAh.exe
  C:\Windows\System\pkwXfAh.exe
  2⤵
  PID:14884
- C:\Windows\System\eGbqSXG.exe
  C:\Windows\System\eGbqSXG.exe
  2⤵
  PID:14728
- C:\Windows\System\biNXjew.exe
  C:\Windows\System\biNXjew.exe
  2⤵
  PID:14984
- C:\Windows\System\hwTXBpM.exe
  C:\Windows\System\hwTXBpM.exe
  2⤵
  PID:15064
- C:\Windows\System\kVYawtB.exe
  C:\Windows\System\kVYawtB.exe
  2⤵
  PID:15324
- C:\Windows\System\jRnVnOQ.exe
  C:\Windows\System\jRnVnOQ.exe
  2⤵
  PID:15236
- C:\Windows\System\ceeMUcM.exe
  C:\Windows\System\ceeMUcM.exe
  2⤵
  PID:15336
- C:\Windows\System\GaudFkD.exe
  C:\Windows\System\GaudFkD.exe
  2⤵
  PID:13020
- C:\Windows\System\KwRqgKu.exe
  C:\Windows\System\KwRqgKu.exe
  2⤵
  PID:15224
- C:\Windows\System\MSgcyKf.exe
  C:\Windows\System\MSgcyKf.exe
  2⤵
  PID:13612
- C:\Windows\System\UQDDlQa.exe
  C:\Windows\System\UQDDlQa.exe
  2⤵
  PID:14564
- C:\Windows\System\rmJsNcZ.exe
  C:\Windows\System\rmJsNcZ.exe
  2⤵
  PID:1056
- C:\Windows\System\MZAbfQt.exe
  C:\Windows\System\MZAbfQt.exe
  2⤵
  PID:15252
- C:\Windows\System\ShkKtSA.exe
  C:\Windows\System\ShkKtSA.exe
  2⤵
  PID:5036
- C:\Windows\System\bLAcCJe.exe
  C:\Windows\System\bLAcCJe.exe
  2⤵
  PID:376
- C:\Windows\System\cRBkYKj.exe
  C:\Windows\System\cRBkYKj.exe
  2⤵
  PID:15256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jzygve5o.3ik.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BeNxWTG.exe

Filesize
1.6MB

MD5
55ba046238d3f878367ef4975865b03b

SHA1
306ac3b3930b0744d8f8285af1b30cce0f1b2885

SHA256
3d51a724e4231fcf36fb19a9e5983b9958eaeebc7b2948e8db07e3f59b691963

SHA512
602cd0a0cd9d7e062b5ba3e4abc825426a73b9e0dfb43599c533f993ffc36ac16f1b5c91fc626c3da6fdf9fb4c959a2b7a99bfaa1bece67b734b21d3aad49eec

Download Submit
C:\Windows\System\BzsFNxE.exe

Filesize
8B

MD5
d33d66ea64213a11220ff46e1066e8c4

SHA1
11df077d45cb6c18dde351720388ac43664403a2

SHA256
b2aac390d4a70eec771d01aa85ea606c2fcf5e3b2ec05338e195df492df26016

SHA512
4f6272cb17b1ae9b4ebb9b755a9d4f83dd7a010a29db67c7a6463d91c58d4250809d9f6f8bdb747b657363c9141bbd4db149efd469384e92e75f03d0396ea32b

Download Submit
C:\Windows\System\CDpMRGg.exe

Filesize
1.6MB

MD5
b6c8ba5bb4c4b2c0ff1ffbdb83db7b26

SHA1
ef1c3cac67d727cc49b2cbef386472e61d084926

SHA256
2ac7dd3a17ab23630b013ec03865eeb54ff98cab16d0dede5bf68c38e7d141cd

SHA512
d7b7e89f3e6e2d32d9c84f9bc496962f0238ab22bfa08c0de7521abb1c22997e83a11182880244c268ad8c7b7f6bd74db86df457244c6122838c84e4ed379801

Download Submit
C:\Windows\System\DxLXTCL.exe

Filesize
1.6MB

MD5
432715050c27c95efed3527133bbcaa1

SHA1
36d8248d86f8b93e11f5aaaec2f51c0357935311

SHA256
99d1ded1f17f4fd6468f853367106d5e025ebedb8364cf9aa28aea8f86363279

SHA512
c59cf29a00c70ddf6cc165c5f1f3312a0998a5c950e698080b80dbb9cfcd9f11c73359c9bcee118afa4848656d2bd28e3644b498c59b82bf43c96d6bc144ff4d

Download Submit
C:\Windows\System\EMEXobS.exe

Filesize
1.6MB

MD5
be5dce3f05310ce370dff7397e72d9fa

SHA1
bce2d19d68586b836b59f447c11964c2c082ecd4

SHA256
a3ccdc858b343d9a2aeb1790f31f5d824310d3527fa0e5917c10948848bc87e2

SHA512
a49283bac66fb8e8fe9157fe965854b6b0b1276bf7032cb12777dabc1e89c4c1895fbcb64df05b84e011a455a15d4baddfb3ddbe0783d02a77c9cbaabfa75065

Download Submit
C:\Windows\System\FfpoYSq.exe

Filesize
1.6MB

MD5
896c26d02e4cc7e29b51cf57ce059b55

SHA1
e3dd237db6c759ab383290e63fbdde68ac772709

SHA256
53bf1c3523277bb60942f9fe26c8cf59e2b8d6341dbc123d3634ec60a31104fc

SHA512
0a35dcbb10a14b1f9ed19410aa9c696b1a2081784ee973d7fe0407b31bc2526a9a1e5ef2e8af91b33787772441ef17fbdd0d785a7befdf0420a547fb3ec13a30

Download Submit
C:\Windows\System\HJAVDUw.exe

Filesize
1.6MB

MD5
ee82406ec0112fc41c17a3c346fe6d0e

SHA1
737a54472f1308482c8595bf69620c8a05d499ee

SHA256
9844c86f5fbce73d92b1fd2213491f1d21c5040f827afe2bb04763eccd9512ba

SHA512
e817dfe9a72637f389f4afb0b9594315696d37e5f4a13f472f88f5a92c02e254e2bbf1e39f4cb0d4bac8932deba49aca851f058c0f602a3a820fe356fe57fbca

Download Submit
C:\Windows\System\JhiGyDm.exe

Filesize
1.6MB

MD5
d6d8180961bd111739a25d2552ae4821

SHA1
09ba6d4b0f983ce3578645073efeea6cc5ca50d6

SHA256
09b6001aa1270ca3f23c4e45bf03c31a682a6ba4436faf127f2c5daaebee0ae4

SHA512
2445d2cf4638521b0244d881a7ea38d30cbf45be4a1befba1a047f0b51fd20117bda6b13f7456dfa2ccf6264b69c43ead1f0e12e9be963dcf4e083e481c8a4ed

Download Submit
C:\Windows\System\LYyRhEd.exe

Filesize
1.6MB

MD5
38a86253e5e28881e83a0d7dc7afac4a

SHA1
50d3a17e10b783069dd484e3d6e78103c09f713a

SHA256
6b4d6f1b2898ca71440302f6239d789d044b65da75ee114cefd967dd11895e19

SHA512
fac74ddd5157dc47ca9a947755017d2f94463c20ebdb3d22a1c4bc477cf5ac9698abf45f45ccb765fe60548a5a602b783ba2cae2c7f1ce265b080e0d0edce1a3

Download Submit
C:\Windows\System\MzsOHkb.exe

Filesize
1.6MB

MD5
deb771b836bb7532926c62727365ec9f

SHA1
b58eb4e43b7594d66e77804fe6537851768f6771

SHA256
716d264f40d77014d06d5314a20f425dc590fb4366f05f93a3ce1d9ce4237846

SHA512
7d4598b0ed2a05d077a6752dfb1cf30722b47499623072861b9d4557bceecfade56ed3218873078f9c9363f4f70e42f7195f32e1adedcc7ae5618c39f96358a7

Download Submit
C:\Windows\System\NPwBaIH.exe

Filesize
1.6MB

MD5
2fa96e1a54edce2c1b68029713e0c37a

SHA1
c17fae6b0b2f334fa5b5bbffb1d2f25dac05076b

SHA256
66bb30fecbabf5e5d84c9880df6d8db0f5bb7f8b253031511e0ec358235361e1

SHA512
655aa3084aa269eae56b76901baf4f2fb6a5400108afa9324a997ee8f1d1e155554dc35574a701761a1d8dd41d391bf752d4aea8f423f4cba9852efa77ae44bd

Download Submit
C:\Windows\System\QXwwuFY.exe

Filesize
1.6MB

MD5
1d90ec6ff3e1bb697c620541a0dac571

SHA1
6d39cd921a40941e8741f63447785bfc7ddfc055

SHA256
3e7ae68ed4b064aa278f844f26da60f75eedd0092f7f7c10a9e82f5065259adb

SHA512
52805a6e73d0c11a23ffac8cf8f13956c4df2cf57aa150a88aca9edbcf8f2953da736f293157d86f39c973d92ea4592b30ebc3450623d25763b1f36aac45df43

Download Submit
C:\Windows\System\TnXKMbI.exe

Filesize
1.6MB

MD5
0335f0a4f8cbda655fe598db5023c743

SHA1
e7c7cbbb31445409adeddbe5930aa71fb87de20e

SHA256
1d84ea8047e603eb11df18598682cec3dac8df92adf37dea8524496bb8699966

SHA512
83740cecbb072b79b6e566c8629de96688cf569c6d368dc0e0e1ce5bebcc556117bf8ce8c48b1cc866abd90af2d52ef12fc1d48a32ab9b47ffdbcc79804169b1

Download Submit
C:\Windows\System\UAlSLWb.exe

Filesize
1.6MB

MD5
132106f714205aeecfcb824c86318055

SHA1
829c45e3025cd2fe6a92dfa61c86815761456851

SHA256
e3d8ba9ea6be6870421a57f4636881c1448195e84308049deeb7e46dda57536f

SHA512
369e5ec89428ee9d9c0715ac8fec55885464a04ef249b80002622f7782743a9acea0d8b2bf2f1b98b73db84187c64a76393b0df153f5363fe38dee7acc5fd20f

Download Submit
C:\Windows\System\YWotKGH.exe

Filesize
1.6MB

MD5
332f872daa602261728d9b9f168d151a

SHA1
d6ac09eac037e5bfafce1aed8b0b1e007a14912e

SHA256
a57d437dd88468901d45a85ab3d01a2e3817302029252b7a58a5820f1556f95d

SHA512
8aab0099aa65e1e440d097e0eb071fe2b025ce9fb9c189c2f5be9e5c13e0f140924cf4cb0c5b7fe79f2fa06976abca95dc7f864092f54dfbf0054c76aff42f53

Download Submit
C:\Windows\System\ZZGkYFf.exe

Filesize
1.6MB

MD5
78ce549f1f4cb08112b3afe781f25d46

SHA1
bf89511c93852b45adfceb12225b64a0b7b7b05f

SHA256
2297f1cddf30437b1c57c851b7cf9173ad11d32da3b4cf1db524a6c94094b2c4

SHA512
5cad49a5041b20141760d6918cb28063a81c6ff996576a34760ea114a4c8776811c2b96557fe6f2db92feb7fa521a8fceb5371120245543adbad62fda1eaf927

Download Submit
C:\Windows\System\ZsVLFxc.exe

Filesize
1.6MB

MD5
f3e06397d930a47e46632a6e9e6817ef

SHA1
0313e86857618e341ce1e33289097d466a16d378

SHA256
f50c656be4bf15adf9cd647131085ad88e72860917e1750b8c84e466c21cf84e

SHA512
90efe2f35e30760a40900e31beeb1327d5d3594524585b62bb12c657acf456455f3274cfdfe7fc001827f113b094763b4f757c0f63eed9171dabf88311b235a0

Download Submit
C:\Windows\System\bIdqeXV.exe

Filesize
1.6MB

MD5
7a302f09211c37d72ba81639374a248e

SHA1
541c2fd26afb0495b0946c009ad4e2bf1862d614

SHA256
be3bb7876b05ef367bade689ff44219ea04eaa625d31818a3c9972d66ead8e4f

SHA512
fcf669f6b6ef82e05b6ea81e6dcf53025e8a074f6b5a51b694b44f940b7e371add43ba32e5cd94f00ddfb29cc1cf55a25ab57a577f9ae6d9f37d1ed56e0f22cd

Download Submit
C:\Windows\System\cZYeNzH.exe

Filesize
1.6MB

MD5
c22c987628bf0ff7f47f855baeeabcf0

SHA1
5468c6abc8c610c0058e21402bda9e5bfd03d834

SHA256
2e7f544b5f9a3a939ab5e795e3d1694c151d2ee06019881228f0179912ac7130

SHA512
aaa2bb06ca20a4b88fd6fbed26512bf62dc90a936a8cf995a15cedad4f1d1a8ebf81542ad2941f9af24b6f93cb9d2e27e2f81c209a2ab9c5405bc9247fd2381d

Download Submit
C:\Windows\System\dDfMeoz.exe

Filesize
1.6MB

MD5
8ebcc3c699c691709f92f7324ec16027

SHA1
41b057038e92835d400b79f31492019d6879cc97

SHA256
46c9dfab58b67768cc8e42a228668002514907dd89df876440ce11e26ea2da97

SHA512
8d5cdf5a34b2edc79779f71af54f9b800fe8eb640bcf51c986afd98aad1838d75fdde1ed0e772d6f8ebda0b78a8834e57d46b966a5ca8b7adf81106dffe0a905

Download Submit
C:\Windows\System\dtogetI.exe

Filesize
1.6MB

MD5
07110d5336b5d65581afcd4569c52ee7

SHA1
f8d760949266628e61ff883fdc28543dca77a66a

SHA256
2d0443343f89dbbf8e0e5a9072ae33a0ea2738e5423be29b82f9f1899e35ce1f

SHA512
b987d5375593f42a2d3c19d1d5e7ec3f283f963a4d1755248a72b6eb18c7d0b48668066bc86d8cb37cf717e7480d47b4e7ad49d3f8f154b16246f2f8372a841a

Download Submit
C:\Windows\System\ifHbopJ.exe

Filesize
1.6MB

MD5
76f7f2ea494723bb5d0bcfeb9abe891b

SHA1
18a447cb93ec04513d2154cf4907b428d38489c4

SHA256
3d74335b986b9cc54e382d41da764df2f6c461ccdf0102614c3db04958c61d1f

SHA512
eacead77fec3fad26016d6ea8e8b6f95171ddf89592f26c58ac67e77edaaddaac85371ade94d2c11bfd0bf82c228cb8f35cb34c971f6f64baf6187f9060590e6

Download Submit
C:\Windows\System\igaTUqH.exe

Filesize
1.6MB

MD5
736a779f34d8bb08eeffe997233730ae

SHA1
aff96bf179dd1e11987a8a5814b77ce24681c982

SHA256
4c3dcae11d49ddcf5df550cb02c06868f55d0264acca017f870fad17df65f7b2

SHA512
477e859e9254016c5eedad210cb61f2b08a0f8f1aa9d5a71b39be626ebe939728d7a2e12014b688d7b323b6aeb8d9c46d28582f4f276a83b4ae0e04bbc6aabc0

Download Submit
C:\Windows\System\jLHeZfa.exe

Filesize
1.6MB

MD5
273438182b2c2eb934ab8eb84b77f74e

SHA1
5d39a382379d4b631753d138f576e1ea0513e0dd

SHA256
cfe74cc3a9a70a082a2108682878c68bd497a1465d8b932ea43632f43ff4bb28

SHA512
f23b2fdfa204d18bc5b833ab73597a79cb72cc7e5de6d0b824e7cbe7ac8a4d2f335756e8241bee52a763420980944be3af7f78ea5d0dc75ab0a52fd0834c440a

Download Submit
C:\Windows\System\kpEfMXD.exe

Filesize
1.6MB

MD5
51883bf1010828b5a8a675bb45095e87

SHA1
ffd6f6e4f2d855010e687424cc7e6e045ca8b13b

SHA256
574207aef8942eb379467711749335d670d956c6f76897da9fc724c869e1f58d

SHA512
be083fe2e77252e0852038c78510c40cde50b1a8ca60c2209583d12fcc18ca9aa9cc29d77c03d30643ab45811854133113378ff725d6b94efbab9897e7d1730e

Download Submit
C:\Windows\System\lmsFqry.exe

Filesize
1.6MB

MD5
4f74e09cf445a19793aab3089378f77b

SHA1
8af92cc9b3960d63b8301021dd6c5da144df4bed

SHA256
5e4d3789e4bb7ccfe96acc848ad46359b0e805bbca7e01c9e95efefa50cac72c

SHA512
f15a03de12a17e72631e7d3aee9456e9e09c45d208085f59565ac177814cd6c0ed1e6d0e8a0f7c2acbc26256248b2d2fdd189e062aa4ad803e91ef4b0759f1d4

Download Submit
C:\Windows\System\oMczSFh.exe

Filesize
1.6MB

MD5
dd4db5925a8c0fdb7c091ae5bfb0a074

SHA1
3d4f95c4a417cd77fa7d952fa0dae376ce7e84a9

SHA256
d70f4a9195aecfbc915662664f60c2cbe0ba0c16c1b62b6886224a09964bf0fd

SHA512
d1003235f36b943339d14986e58772517d35815bbab5dd0f5d3f24400075fd05174e4cf3df97f93e0ce123ca83219f35ead7824b4bb136f59b6e5b2478abd450

Download Submit
C:\Windows\System\olqfQCL.exe

Filesize
1.6MB

MD5
3dedf16463962aa4e1584b0ae983ac7e

SHA1
ccc389b4802df76c82c2d39479ec13ef2bf9d2e1

SHA256
abc9f5e582e25f16b6d00b1216591d34adc43fd8ea2c1a24dce430f8b758bdc3

SHA512
ed82e51a48af8126bd263b40f1f1196079e203931e86dfbd71e4517c53a11f94113a6282eb1bbaf93b9a2a198de7f8a8d9f2fe725535b6121f6a570d7116ab98

Download Submit
C:\Windows\System\pHkcerO.exe

Filesize
1.6MB

MD5
9bf9d9e421a2412c2545ff13a5b5ff3a

SHA1
24c0aab88325fa1f50b14c71061df8eef3ce256d

SHA256
bbe74817b7f824527578709a53cfadbc5669c8fa380a91177eb159d5a27355d8

SHA512
5a019f291ba2ed425f0d3473bb8b5eed68d0af6b0c12955b653f6a54f4f3567243a28b129583d301c1b052fe6b363b5fdae38d37c342ddfd486dc38e86061792

Download Submit
C:\Windows\System\qgnFcsA.exe

Filesize
1.6MB

MD5
d92b861c0709d0f96291f11695ba3809

SHA1
98dbc795fc25080410114574e48fdcd14e336605

SHA256
ac5dbf4e29c489b0555bbec1729bd68e690b5e35d24bcab593118db0ea5315d7

SHA512
8da6dffa026d6613eba5f449a74949012eb3fbd4f1e5d4295fce45437e090c412a7f63c2d9017aafac8068674b4c166791d78f598a57e2a65c97a1d5337b171e

Download Submit
C:\Windows\System\uAiiBTH.exe

Filesize
1.6MB

MD5
b529fa7e00a9d622c632e3bce552670f

SHA1
18dc5eb609e8213ba78c5eee170ea1a63fb7b763

SHA256
5654e5499e82192058f2cb9d29ce3fe17b136f5c66d388f2a57f6ff59f74df74

SHA512
366ed74629e442f2edfbd32e5ec4893ecb51151a656e43d739fd3c45c4b1fd385d1020593212c04aa99b29604e525edda3a4d65b5d4d1213ce95b36a8422db0b

Download Submit
C:\Windows\System\uquAtKH.exe

Filesize
1.6MB

MD5
5ee923c96e755d01a146ceab0870b02a

SHA1
c9e716313c0fe32516ee7f0f75e55058ad4e52ac

SHA256
63ea401ff13a067ece0cf1585aa342f495e68ace30e59e29ed939f9187591161

SHA512
a3f154a3ac80bf621804a6d2b2eabe590c8da08dfa7f48af195df6f3794a7b37c7550775b67adc6a63b98c0fe496689149218a0d92e7e9bc01a071f3ac3ca282

Download Submit
C:\Windows\System\urMniOO.exe

Filesize
1.6MB

MD5
ce3535e665c3c482b17cc3ade29576a4

SHA1
ef3a63afef4195040609f622dfba3ebc1921fa82

SHA256
f13b4721f87ed036005e35ce7e60ca439ff4b4a060fca00f9d3fc5e60fc1e279

SHA512
9af9f24b53d54c29aa9063ae8fc09a3a8ca4c8fdcec4896e36bf56adfb78ab7e58cf96f0148c1a17ca0abcec91c54986bff0eb9aa36ef11f3abc3388e7236411

Download Submit
C:\Windows\System\vbOpJHe.exe

Filesize
1.6MB

MD5
3fb1feb94320df273445ec461ab951d8

SHA1
0ccde9995bb40b3808a5a81659b46a0707f15f80

SHA256
cb46384164d4fdca6e513e0f9074f97388099ca4df4cb4c8d6eb5cbae207dc29

SHA512
20d2cf200d7200c5033ab4974816e69ce34737a308b55204f13cd7aab65352e96352f2f7e8a4223364cefc8899dd416341abac783a4a51f91ecb9fad9e6f7dcf

Download Submit
C:\Windows\System\wMeernR.exe

Filesize
1.6MB

MD5
fcb7e6f1d24d0da4c599e0c405ad6c16

SHA1
674fdf89a45325eefe0774a0867b10e3e7b8d627

SHA256
9b7427502505cd2c86e387fdd45b7934ca233943b6f2806ad18a2edcce106f18

SHA512
7d1e2cca4d174fb5b503daac659b1deec502349d0243680c62af4d1a9fa5c8f7a270fbe7210a747035dc4c7fff79184fb785e77bec06844613097b4a7b5a7456

Download Submit
C:\Windows\System\wQkqCst.exe

Filesize
1.6MB

MD5
4a91161ebcbfcb51eb39904e1b883005

SHA1
8ff13cf1a6be75763a3be74f856ce058ca177094

SHA256
33fb420441ce199789bd4a45b880933bdae0e806f654b643407b0a8c945181e2

SHA512
39aef53cba8b3edd139def492de4fee75d06eb4385d2fed1b7cbca48f7ff7089f8d5a3a94d0b550ab299408edbec1132f9ec9ff750bad5e1829c73abbd8b8487

Download Submit
C:\Windows\System\wSfnSkT.exe

Filesize
1.6MB

MD5
24dc7cffa2bb94a56a966c3881c22eb6

SHA1
71b19dea5bf6fcf7a54682d1e0b66aabb5421280

SHA256
4f0ff93651fe1d98b913c29c6d9124914b8af071ebf0278eb15c1d9f6ad29652

SHA512
b4f705afc8a87c04231f031f7e99505b1c55df8a9188996013ac8116b4f53c78e1e2dd984b18ded80a71a87fd21832d15f86f5805a6377a5f2af289a2e0721fb

Download Submit
memory/348-207-0x00007FF6C0930000-0x00007FF6C0D22000-memory.dmp

Filesize
3.9MB

Download
memory/348-4274-0x00007FF6C0930000-0x00007FF6C0D22000-memory.dmp

Filesize
3.9MB

Download
memory/668-212-0x00007FF6DAF40000-0x00007FF6DB332000-memory.dmp

Filesize
3.9MB

Download
memory/668-4251-0x00007FF6DAF40000-0x00007FF6DB332000-memory.dmp

Filesize
3.9MB

Download
memory/1000-241-0x00007FF6B1200000-0x00007FF6B15F2000-memory.dmp

Filesize
3.9MB

Download
memory/1000-4262-0x00007FF6B1200000-0x00007FF6B15F2000-memory.dmp

Filesize
3.9MB

Download
memory/1160-247-0x00007FF76DE00000-0x00007FF76E1F2000-memory.dmp

Filesize
3.9MB

Download
memory/1160-4272-0x00007FF76DE00000-0x00007FF76E1F2000-memory.dmp

Filesize
3.9MB

Download
memory/1176-50-0x00007FF640530000-0x00007FF640922000-memory.dmp

Filesize
3.9MB

Download
memory/1176-4216-0x00007FF640530000-0x00007FF640922000-memory.dmp

Filesize
3.9MB

Download
memory/1804-239-0x00007FF72FE50000-0x00007FF730242000-memory.dmp

Filesize
3.9MB

Download
memory/1804-4292-0x00007FF72FE50000-0x00007FF730242000-memory.dmp

Filesize
3.9MB

Download
memory/1912-31-0x00007FF7267B0000-0x00007FF726BA2000-memory.dmp

Filesize
3.9MB

Download
memory/1912-2047-0x00007FF7267B0000-0x00007FF726BA2000-memory.dmp

Filesize
3.9MB

Download
memory/1912-4233-0x00007FF7267B0000-0x00007FF726BA2000-memory.dmp

Filesize
3.9MB

Download
memory/1964-263-0x0000020B41C90000-0x0000020B42436000-memory.dmp

Filesize
7.6MB

Download
memory/1964-253-0x0000020B284B0000-0x0000020B284D2000-memory.dmp

Filesize
136KB

Download
memory/2272-4244-0x00007FF766580000-0x00007FF766972000-memory.dmp

Filesize
3.9MB

Download
memory/2272-2460-0x00007FF766580000-0x00007FF766972000-memory.dmp

Filesize
3.9MB

Download
memory/2272-35-0x00007FF766580000-0x00007FF766972000-memory.dmp

Filesize
3.9MB

Download
memory/2440-4277-0x00007FF678A70000-0x00007FF678E62000-memory.dmp

Filesize
3.9MB

Download
memory/2440-235-0x00007FF678A70000-0x00007FF678E62000-memory.dmp

Filesize
3.9MB

Download
memory/2624-107-0x00007FF7B92A0000-0x00007FF7B9692000-memory.dmp

Filesize
3.9MB

Download
memory/2624-4266-0x00007FF7B92A0000-0x00007FF7B9692000-memory.dmp

Filesize
3.9MB

Download
memory/2720-0-0x00007FF732440000-0x00007FF732832000-memory.dmp

Filesize
3.9MB

Download
memory/2720-1-0x000001F2EC650000-0x000001F2EC660000-memory.dmp

Filesize
64KB

Download
memory/2720-2019-0x00007FF732440000-0x00007FF732832000-memory.dmp

Filesize
3.9MB

Download
memory/2924-4290-0x00007FF701280000-0x00007FF701672000-memory.dmp

Filesize
3.9MB

Download
memory/2924-238-0x00007FF701280000-0x00007FF701672000-memory.dmp

Filesize
3.9MB

Download
memory/3284-4258-0x00007FF63F320000-0x00007FF63F712000-memory.dmp

Filesize
3.9MB

Download
memory/3284-249-0x00007FF63F320000-0x00007FF63F712000-memory.dmp

Filesize
3.9MB

Download
memory/3380-2457-0x00007FF72E840000-0x00007FF72EC32000-memory.dmp

Filesize
3.9MB

Download
memory/3380-4214-0x00007FF72E840000-0x00007FF72EC32000-memory.dmp

Filesize
3.9MB

Download
memory/3380-17-0x00007FF72E840000-0x00007FF72EC32000-memory.dmp

Filesize
3.9MB

Download
memory/3924-4241-0x00007FF706A40000-0x00007FF706E32000-memory.dmp

Filesize
3.9MB

Download
memory/3924-248-0x00007FF706A40000-0x00007FF706E32000-memory.dmp

Filesize
3.9MB

Download
memory/4500-4260-0x00007FF6260F0000-0x00007FF6264E2000-memory.dmp

Filesize
3.9MB

Download
memory/4500-251-0x00007FF6260F0000-0x00007FF6264E2000-memory.dmp

Filesize
3.9MB

Download
memory/4516-4294-0x00007FF63DE50000-0x00007FF63E242000-memory.dmp

Filesize
3.9MB

Download
memory/4516-252-0x00007FF63DE50000-0x00007FF63E242000-memory.dmp

Filesize
3.9MB

Download
memory/4800-246-0x00007FF610580000-0x00007FF610972000-memory.dmp

Filesize
3.9MB

Download
memory/4800-4250-0x00007FF610580000-0x00007FF610972000-memory.dmp

Filesize
3.9MB

Download
memory/4816-219-0x00007FF6439D0000-0x00007FF643DC2000-memory.dmp

Filesize
3.9MB

Download
memory/4816-4269-0x00007FF6439D0000-0x00007FF643DC2000-memory.dmp

Filesize
3.9MB

Download
memory/4916-4247-0x00007FF60C890000-0x00007FF60CC82000-memory.dmp

Filesize
3.9MB

Download
memory/4916-2083-0x00007FF60C890000-0x00007FF60CC82000-memory.dmp

Filesize
3.9MB

Download
memory/4916-77-0x00007FF60C890000-0x00007FF60CC82000-memory.dmp

Filesize
3.9MB

Download
memory/4920-4245-0x00007FF741C60000-0x00007FF742052000-memory.dmp

Filesize
3.9MB

Download
memory/4920-162-0x00007FF741C60000-0x00007FF742052000-memory.dmp

Filesize
3.9MB

Download
memory/4952-4254-0x00007FF6116A0000-0x00007FF611A92000-memory.dmp

Filesize
3.9MB

Download
memory/4952-187-0x00007FF6116A0000-0x00007FF611A92000-memory.dmp

Filesize
3.9MB

Download
memory/5016-4267-0x00007FF609030000-0x00007FF609422000-memory.dmp

Filesize
3.9MB

Download
memory/5016-188-0x00007FF609030000-0x00007FF609422000-memory.dmp

Filesize
3.9MB

Download
memory/5068-4264-0x00007FF67D420000-0x00007FF67D812000-memory.dmp

Filesize
3.9MB

Download
memory/5068-250-0x00007FF67D420000-0x00007FF67D812000-memory.dmp

Filesize
3.9MB

Download
memory/5072-4256-0x00007FF6BEC90000-0x00007FF6BF082000-memory.dmp

Filesize
3.9MB

Download
memory/5072-124-0x00007FF6BEC90000-0x00007FF6BF082000-memory.dmp

Filesize
3.9MB

Download