xmrig | 13294d57fb571908162b889a0988d47e62b480c23e73822b5bc8320d9e34ffd9

Analysis

max time kernel
141s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27-04-2024 22:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
Size

1.9MB
MD5

03c49bb60175c5d6a577aec9a99228ec
SHA1

ae2e6bc10568b0e00af371101039f1cfa0e51b21
SHA256

13294d57fb571908162b889a0988d47e62b480c23e73822b5bc8320d9e34ffd9
SHA512

4787d2a3a1265c989bdad5e593cf15c688e9230e3081eb45c1acbf51f0b500019733c0c023bbf3d0d0d8745c32f127aaaa8937c7eeaf25b9188130f261f1a402
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+UC:NABX

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 26 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/1844-184-0x00007FF65D1B0000-0x00007FF65D5A2000-memory.dmp	xmrig
behavioral2/memory/3640-178-0x00007FF695100000-0x00007FF6954F2000-memory.dmp	xmrig
behavioral2/memory/4416-172-0x00007FF76F760000-0x00007FF76FB52000-memory.dmp	xmrig
behavioral2/memory/3724-166-0x00007FF6C2820000-0x00007FF6C2C12000-memory.dmp	xmrig
behavioral2/memory/3456-165-0x00007FF6BE670000-0x00007FF6BEA62000-memory.dmp	xmrig
behavioral2/memory/3600-154-0x00007FF71A1D0000-0x00007FF71A5C2000-memory.dmp	xmrig
behavioral2/memory/1892-148-0x00007FF7C6680000-0x00007FF7C6A72000-memory.dmp	xmrig
behavioral2/memory/3296-147-0x00007FF6D7BD0000-0x00007FF6D7FC2000-memory.dmp	xmrig
behavioral2/memory/5100-141-0x00007FF723DB0000-0x00007FF7241A2000-memory.dmp	xmrig
behavioral2/memory/3252-119-0x00007FF757DA0000-0x00007FF758192000-memory.dmp	xmrig
behavioral2/memory/2776-118-0x00007FF768E60000-0x00007FF769252000-memory.dmp	xmrig
behavioral2/memory/4348-104-0x00007FF69F620000-0x00007FF69FA12000-memory.dmp	xmrig
behavioral2/memory/1504-96-0x00007FF7C4BE0000-0x00007FF7C4FD2000-memory.dmp	xmrig
behavioral2/memory/2100-95-0x00007FF6424B0000-0x00007FF6428A2000-memory.dmp	xmrig
behavioral2/memory/1244-87-0x00007FF693FF0000-0x00007FF6943E2000-memory.dmp	xmrig
behavioral2/memory/2848-78-0x00007FF7752F0000-0x00007FF7756E2000-memory.dmp	xmrig
behavioral2/memory/1640-74-0x00007FF6BB4D0000-0x00007FF6BB8C2000-memory.dmp	xmrig
behavioral2/memory/4504-59-0x00007FF7DA630000-0x00007FF7DAA22000-memory.dmp	xmrig
behavioral2/memory/1456-14-0x00007FF699280000-0x00007FF699672000-memory.dmp	xmrig
behavioral2/memory/1504-4919-0x00007FF7C4BE0000-0x00007FF7C4FD2000-memory.dmp	xmrig
behavioral2/memory/2100-4926-0x00007FF6424B0000-0x00007FF6428A2000-memory.dmp	xmrig
behavioral2/memory/3296-4930-0x00007FF6D7BD0000-0x00007FF6D7FC2000-memory.dmp	xmrig
behavioral2/memory/2776-4938-0x00007FF768E60000-0x00007FF769252000-memory.dmp	xmrig
behavioral2/memory/1892-4949-0x00007FF7C6680000-0x00007FF7C6A72000-memory.dmp	xmrig
behavioral2/memory/3724-4965-0x00007FF6C2820000-0x00007FF6C2C12000-memory.dmp	xmrig
behavioral2/memory/1844-4977-0x00007FF65D1B0000-0x00007FF65D5A2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

Processes:

cHkFSpX.exeUJLrdbV.exeOMEzcil.exezjCTNQc.exevouyfIa.exeCBWdUWS.exeNeKqHpR.exegyvpWbb.exeHFVqQWJ.exeaMcuBUp.exeiigoyYX.exeFLmieKG.exedLENuXc.exeuxWdNjD.exezFrrvTp.exesMtusqu.exeWXMihWw.exewTCknlX.exelRtocJi.exejJLetha.execEdYUSx.exeXOWmoga.exekhzpGpB.exeLothixF.exetCvOnes.exeaEAPRzk.exePPJsSZC.exeKfZgRYJ.exeHQndHWS.exeypfcoue.exeLeEkeYA.exeryukWAN.exebcABOhr.exexFmNZOD.exeYvKoALw.exeCCOPtiI.exeMbevnmp.exeDxbJkSj.exechBCXZl.exekHvIDWN.exefLCtkXb.exeHBIsEuZ.exeQuBwWBa.exexDNvTja.exebXQxVre.exekOcYlva.exewXhewpa.exegVkfYUP.exevhRTVtJ.exeqoJzKsT.exeEEZywzz.exeeDJJyLM.exevJgBErf.exevzLDIOo.exegxtbBAk.exeabFSraF.exeGHknCPu.exevkcYMqi.exeSVBAPYR.exehKyimCj.exeFPMuQep.exeRTNhHAI.exeOJaPDUT.exeNVRFiRg.exe

pid	process
1456	cHkFSpX.exe
712	UJLrdbV.exe
3468	OMEzcil.exe
4504	zjCTNQc.exe
1640	vouyfIa.exe
2848	CBWdUWS.exe
1244	NeKqHpR.exe
5100	gyvpWbb.exe
2100	HFVqQWJ.exe
1504	aMcuBUp.exe
4348	iigoyYX.exe
3296	FLmieKG.exe
2776	dLENuXc.exe
3252	uxWdNjD.exe
1892	zFrrvTp.exe
3600	sMtusqu.exe
3456	WXMihWw.exe
3724	wTCknlX.exe
4416	lRtocJi.exe
3640	jJLetha.exe
1844	cEdYUSx.exe
1704	XOWmoga.exe
2024	khzpGpB.exe
1584	LothixF.exe
2740	tCvOnes.exe
2896	aEAPRzk.exe
512	PPJsSZC.exe
3472	KfZgRYJ.exe
468	HQndHWS.exe
4948	ypfcoue.exe
4032	LeEkeYA.exe
2308	ryukWAN.exe
3932	bcABOhr.exe
1692	xFmNZOD.exe
1004	YvKoALw.exe
1732	CCOPtiI.exe
412	Mbevnmp.exe
4140	DxbJkSj.exe
3540	chBCXZl.exe
4400	kHvIDWN.exe
4480	fLCtkXb.exe
4764	HBIsEuZ.exe
4920	QuBwWBa.exe
3012	xDNvTja.exe
2728	bXQxVre.exe
3112	kOcYlva.exe
3348	wXhewpa.exe
2276	gVkfYUP.exe
4208	vhRTVtJ.exe
3328	qoJzKsT.exe
3896	EEZywzz.exe
5012	eDJJyLM.exe
1792	vJgBErf.exe
4912	vzLDIOo.exe
4724	gxtbBAk.exe
3392	abFSraF.exe
1992	GHknCPu.exe
5016	vkcYMqi.exe
944	SVBAPYR.exe
1528	hKyimCj.exe
1032	FPMuQep.exe
1196	RTNhHAI.exe
2008	OJaPDUT.exe
4112	NVRFiRg.exe

UPX packed file 62 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2248-0-0x00007FF72C570000-0x00007FF72C962000-memory.dmp	upx
C:\Windows\System\cHkFSpX.exe	upx
C:\Windows\System\OMEzcil.exe	upx
C:\Windows\System\UJLrdbV.exe	upx
C:\Windows\System\vouyfIa.exe	upx
C:\Windows\System\HFVqQWJ.exe	upx
C:\Windows\System\NeKqHpR.exe	upx
C:\Windows\System\aMcuBUp.exe	upx
C:\Windows\System\zFrrvTp.exe	upx
C:\Windows\System\sMtusqu.exe	upx
C:\Windows\System\jJLetha.exe	upx
C:\Windows\System\tCvOnes.exe	upx
C:\Windows\System\PPJsSZC.exe	upx
C:\Windows\System\HQndHWS.exe	upx
C:\Windows\System\LeEkeYA.exe	upx
C:\Windows\System\bcABOhr.exe	upx
C:\Windows\System\ryukWAN.exe	upx
C:\Windows\System\ypfcoue.exe	upx
behavioral2/memory/1844-184-0x00007FF65D1B0000-0x00007FF65D5A2000-memory.dmp	upx
C:\Windows\System\KfZgRYJ.exe	upx
behavioral2/memory/3640-178-0x00007FF695100000-0x00007FF6954F2000-memory.dmp	upx
behavioral2/memory/4416-172-0x00007FF76F760000-0x00007FF76FB52000-memory.dmp	upx
C:\Windows\System\aEAPRzk.exe	upx
behavioral2/memory/3724-166-0x00007FF6C2820000-0x00007FF6C2C12000-memory.dmp	upx
behavioral2/memory/3456-165-0x00007FF6BE670000-0x00007FF6BEA62000-memory.dmp	upx
C:\Windows\System\LothixF.exe	upx
behavioral2/memory/3600-154-0x00007FF71A1D0000-0x00007FF71A5C2000-memory.dmp	upx
C:\Windows\System\khzpGpB.exe	upx
behavioral2/memory/1892-148-0x00007FF7C6680000-0x00007FF7C6A72000-memory.dmp	upx
behavioral2/memory/3296-147-0x00007FF6D7BD0000-0x00007FF6D7FC2000-memory.dmp	upx
C:\Windows\System\XOWmoga.exe	upx
behavioral2/memory/5100-141-0x00007FF723DB0000-0x00007FF7241A2000-memory.dmp	upx
C:\Windows\System\cEdYUSx.exe	upx
C:\Windows\System\lRtocJi.exe	upx
C:\Windows\System\wTCknlX.exe	upx
behavioral2/memory/3252-119-0x00007FF757DA0000-0x00007FF758192000-memory.dmp	upx
behavioral2/memory/2776-118-0x00007FF768E60000-0x00007FF769252000-memory.dmp	upx
behavioral2/memory/4348-104-0x00007FF69F620000-0x00007FF69FA12000-memory.dmp	upx
C:\Windows\System\WXMihWw.exe	upx
behavioral2/memory/1504-96-0x00007FF7C4BE0000-0x00007FF7C4FD2000-memory.dmp	upx
behavioral2/memory/2100-95-0x00007FF6424B0000-0x00007FF6428A2000-memory.dmp	upx
C:\Windows\System\uxWdNjD.exe	upx
behavioral2/memory/1244-87-0x00007FF693FF0000-0x00007FF6943E2000-memory.dmp	upx
C:\Windows\System\dLENuXc.exe	upx
behavioral2/memory/2848-78-0x00007FF7752F0000-0x00007FF7756E2000-memory.dmp	upx
behavioral2/memory/1640-74-0x00007FF6BB4D0000-0x00007FF6BB8C2000-memory.dmp	upx
C:\Windows\System\FLmieKG.exe	upx
behavioral2/memory/4504-59-0x00007FF7DA630000-0x00007FF7DAA22000-memory.dmp	upx
C:\Windows\System\gyvpWbb.exe	upx
C:\Windows\System\iigoyYX.exe	upx
C:\Windows\System\CBWdUWS.exe	upx
behavioral2/memory/3468-47-0x00007FF6BF870000-0x00007FF6BFC62000-memory.dmp	upx
C:\Windows\System\zjCTNQc.exe	upx
behavioral2/memory/712-35-0x00007FF7EE680000-0x00007FF7EEA72000-memory.dmp	upx
behavioral2/memory/1456-14-0x00007FF699280000-0x00007FF699672000-memory.dmp	upx
behavioral2/memory/1504-4919-0x00007FF7C4BE0000-0x00007FF7C4FD2000-memory.dmp	upx
behavioral2/memory/2100-4926-0x00007FF6424B0000-0x00007FF6428A2000-memory.dmp	upx
behavioral2/memory/3296-4930-0x00007FF6D7BD0000-0x00007FF6D7FC2000-memory.dmp	upx
behavioral2/memory/2776-4938-0x00007FF768E60000-0x00007FF769252000-memory.dmp	upx
behavioral2/memory/1892-4949-0x00007FF7C6680000-0x00007FF7C6A72000-memory.dmp	upx
behavioral2/memory/3724-4965-0x00007FF6C2820000-0x00007FF6C2C12000-memory.dmp	upx
behavioral2/memory/1844-4977-0x00007FF65D1B0000-0x00007FF65D5A2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service
T1102

Processes:

flow ioc

3 raw.githubusercontent.com

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

Processes:

03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\System\tLjfhmJ.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\Luplmrd.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\daLNvWi.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\ogSarmL.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\jhCXYWz.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\lYUOXQf.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\TwiWGao.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\DNBjxxr.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\cbxHbQM.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\aWCbGRP.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\XDUzcVh.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\SGRApWj.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\uPViMzy.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\ckRjPcI.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\ksTbASM.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\XXmKmFg.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\dmRzoED.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\sxkRBvg.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\zlGGgYb.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\xzvOKLT.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\nJaTnOJ.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\sGuMjBV.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\CHlmZln.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\QlPHEWJ.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\YhwJimj.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\TKCZujL.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\IYMoYxm.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\xJGvbJD.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\HlEoHjd.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\VHRKHSW.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\OhiBIHH.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\hfoTfxN.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\BZqgPdF.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\kSMxdle.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\HndQmtS.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\EsODmAT.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\ifpYhIC.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\hjZufrk.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\CUsMSkQ.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\TgLyHtI.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\hxNUZGY.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\MamQzjX.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\SYGffnL.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\CRsjCdl.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\qpUvxUL.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\OxraxQH.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\lBaMBNV.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\CKIpGwN.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\NiZKVre.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\OXzNdVp.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\LzynIJM.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\kCCLGjl.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\oOUrKoK.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\nZAMYBp.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\OEfcToO.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\XSvXVje.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\Opuinsb.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\lyLUcCu.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\zxqDnfM.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\wvSKvsg.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\jdaLHcw.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\QmgPTxB.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\JwFMDoT.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\UJLZYNh.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe

Modifies data under HKEY_USERS 8 IoCs

Processes:

OfficeClickToRun.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun	OfficeClickToRun.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

4616 powershell.exe
4616 powershell.exe
4616 powershell.exe

pid	process
4616	powershell.exe
4616	powershell.exe
4616	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exepowershell.exe

description	pid	process
Token: SeLockMemoryPrivilege	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
Token: SeDebugPrivilege	4616	powershell.exe
Token: SeLockMemoryPrivilege	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe

description	pid	process	target process
PID 2248 wrote to memory of 4616	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	powershell.exe
PID 2248 wrote to memory of 4616	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	powershell.exe
PID 2248 wrote to memory of 1456	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	cHkFSpX.exe
PID 2248 wrote to memory of 1456	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	cHkFSpX.exe
PID 2248 wrote to memory of 712	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	UJLrdbV.exe
PID 2248 wrote to memory of 712	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	UJLrdbV.exe
PID 2248 wrote to memory of 3468	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	OMEzcil.exe
PID 2248 wrote to memory of 3468	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	OMEzcil.exe
PID 2248 wrote to memory of 4504	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	zjCTNQc.exe
PID 2248 wrote to memory of 4504	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	zjCTNQc.exe
PID 2248 wrote to memory of 1640	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	vouyfIa.exe
PID 2248 wrote to memory of 1640	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	vouyfIa.exe
PID 2248 wrote to memory of 2848	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	CBWdUWS.exe
PID 2248 wrote to memory of 2848	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	CBWdUWS.exe
PID 2248 wrote to memory of 1244	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	NeKqHpR.exe
PID 2248 wrote to memory of 1244	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	NeKqHpR.exe
PID 2248 wrote to memory of 4348	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	iigoyYX.exe
PID 2248 wrote to memory of 4348	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	iigoyYX.exe
PID 2248 wrote to memory of 5100	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	gyvpWbb.exe
PID 2248 wrote to memory of 5100	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	gyvpWbb.exe
PID 2248 wrote to memory of 2100	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	HFVqQWJ.exe
PID 2248 wrote to memory of 2100	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	HFVqQWJ.exe
PID 2248 wrote to memory of 1504	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	aMcuBUp.exe
PID 2248 wrote to memory of 1504	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	aMcuBUp.exe
PID 2248 wrote to memory of 3296	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	FLmieKG.exe
PID 2248 wrote to memory of 3296	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	FLmieKG.exe
PID 2248 wrote to memory of 2776	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	dLENuXc.exe
PID 2248 wrote to memory of 2776	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	dLENuXc.exe
PID 2248 wrote to memory of 3252	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	uxWdNjD.exe
PID 2248 wrote to memory of 3252	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	uxWdNjD.exe
PID 2248 wrote to memory of 1892	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	zFrrvTp.exe
PID 2248 wrote to memory of 1892	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	zFrrvTp.exe
PID 2248 wrote to memory of 3600	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	sMtusqu.exe
PID 2248 wrote to memory of 3600	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	sMtusqu.exe
PID 2248 wrote to memory of 3456	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	WXMihWw.exe
PID 2248 wrote to memory of 3456	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	WXMihWw.exe
PID 2248 wrote to memory of 3724	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	wTCknlX.exe
PID 2248 wrote to memory of 3724	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	wTCknlX.exe
PID 2248 wrote to memory of 4416	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	lRtocJi.exe
PID 2248 wrote to memory of 4416	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	lRtocJi.exe
PID 2248 wrote to memory of 3640	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	jJLetha.exe
PID 2248 wrote to memory of 3640	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	jJLetha.exe
PID 2248 wrote to memory of 1844	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	cEdYUSx.exe
PID 2248 wrote to memory of 1844	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	cEdYUSx.exe
PID 2248 wrote to memory of 1704	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	XOWmoga.exe
PID 2248 wrote to memory of 1704	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	XOWmoga.exe
PID 2248 wrote to memory of 2024	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	khzpGpB.exe
PID 2248 wrote to memory of 2024	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	khzpGpB.exe
PID 2248 wrote to memory of 1584	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	LothixF.exe
PID 2248 wrote to memory of 1584	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	LothixF.exe
PID 2248 wrote to memory of 2740	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	tCvOnes.exe
PID 2248 wrote to memory of 2740	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	tCvOnes.exe
PID 2248 wrote to memory of 2896	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	aEAPRzk.exe
PID 2248 wrote to memory of 2896	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	aEAPRzk.exe
PID 2248 wrote to memory of 512	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	PPJsSZC.exe
PID 2248 wrote to memory of 512	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	PPJsSZC.exe
PID 2248 wrote to memory of 3472	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	KfZgRYJ.exe
PID 2248 wrote to memory of 3472	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	KfZgRYJ.exe
PID 2248 wrote to memory of 468	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	HQndHWS.exe
PID 2248 wrote to memory of 468	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	HQndHWS.exe
PID 2248 wrote to memory of 4948	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	ypfcoue.exe
PID 2248 wrote to memory of 4948	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	ypfcoue.exe
PID 2248 wrote to memory of 4032	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	LeEkeYA.exe
PID 2248 wrote to memory of 4032	2248	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	LeEkeYA.exe

C:\Users\Admin\AppData\Local\Temp\03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4616
- C:\Windows\System\cHkFSpX.exe
  C:\Windows\System\cHkFSpX.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\UJLrdbV.exe
  C:\Windows\System\UJLrdbV.exe
  2⤵
  - Executes dropped EXE
  PID:712
- C:\Windows\System\OMEzcil.exe
  C:\Windows\System\OMEzcil.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\zjCTNQc.exe
  C:\Windows\System\zjCTNQc.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\vouyfIa.exe
  C:\Windows\System\vouyfIa.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\CBWdUWS.exe
  C:\Windows\System\CBWdUWS.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\NeKqHpR.exe
  C:\Windows\System\NeKqHpR.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\iigoyYX.exe
  C:\Windows\System\iigoyYX.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\gyvpWbb.exe
  C:\Windows\System\gyvpWbb.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\HFVqQWJ.exe
  C:\Windows\System\HFVqQWJ.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\aMcuBUp.exe
  C:\Windows\System\aMcuBUp.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\FLmieKG.exe
  C:\Windows\System\FLmieKG.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\dLENuXc.exe
  C:\Windows\System\dLENuXc.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\uxWdNjD.exe
  C:\Windows\System\uxWdNjD.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\System\zFrrvTp.exe
  C:\Windows\System\zFrrvTp.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\sMtusqu.exe
  C:\Windows\System\sMtusqu.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\WXMihWw.exe
  C:\Windows\System\WXMihWw.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\wTCknlX.exe
  C:\Windows\System\wTCknlX.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\lRtocJi.exe
  C:\Windows\System\lRtocJi.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\jJLetha.exe
  C:\Windows\System\jJLetha.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\cEdYUSx.exe
  C:\Windows\System\cEdYUSx.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\XOWmoga.exe
  C:\Windows\System\XOWmoga.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\khzpGpB.exe
  C:\Windows\System\khzpGpB.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\LothixF.exe
  C:\Windows\System\LothixF.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\tCvOnes.exe
  C:\Windows\System\tCvOnes.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\aEAPRzk.exe
  C:\Windows\System\aEAPRzk.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\PPJsSZC.exe
  C:\Windows\System\PPJsSZC.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\KfZgRYJ.exe
  C:\Windows\System\KfZgRYJ.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System\HQndHWS.exe
  C:\Windows\System\HQndHWS.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\ypfcoue.exe
  C:\Windows\System\ypfcoue.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\LeEkeYA.exe
  C:\Windows\System\LeEkeYA.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\ryukWAN.exe
  C:\Windows\System\ryukWAN.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\bcABOhr.exe
  C:\Windows\System\bcABOhr.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\xFmNZOD.exe
  C:\Windows\System\xFmNZOD.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\YvKoALw.exe
  C:\Windows\System\YvKoALw.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\CCOPtiI.exe
  C:\Windows\System\CCOPtiI.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\Mbevnmp.exe
  C:\Windows\System\Mbevnmp.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\DxbJkSj.exe
  C:\Windows\System\DxbJkSj.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\chBCXZl.exe
  C:\Windows\System\chBCXZl.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\kHvIDWN.exe
  C:\Windows\System\kHvIDWN.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\fLCtkXb.exe
  C:\Windows\System\fLCtkXb.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\HBIsEuZ.exe
  C:\Windows\System\HBIsEuZ.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\QuBwWBa.exe
  C:\Windows\System\QuBwWBa.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\xDNvTja.exe
  C:\Windows\System\xDNvTja.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\bXQxVre.exe
  C:\Windows\System\bXQxVre.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\kOcYlva.exe
  C:\Windows\System\kOcYlva.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\wXhewpa.exe
  C:\Windows\System\wXhewpa.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\gVkfYUP.exe
  C:\Windows\System\gVkfYUP.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\vhRTVtJ.exe
  C:\Windows\System\vhRTVtJ.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\qoJzKsT.exe
  C:\Windows\System\qoJzKsT.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\EEZywzz.exe
  C:\Windows\System\EEZywzz.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\eDJJyLM.exe
  C:\Windows\System\eDJJyLM.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\vJgBErf.exe
  C:\Windows\System\vJgBErf.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\vzLDIOo.exe
  C:\Windows\System\vzLDIOo.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\gxtbBAk.exe
  C:\Windows\System\gxtbBAk.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\abFSraF.exe
  C:\Windows\System\abFSraF.exe
  2⤵
  - Executes dropped EXE
  PID:3392
- C:\Windows\System\GHknCPu.exe
  C:\Windows\System\GHknCPu.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\vkcYMqi.exe
  C:\Windows\System\vkcYMqi.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\SVBAPYR.exe
  C:\Windows\System\SVBAPYR.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\hKyimCj.exe
  C:\Windows\System\hKyimCj.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\FPMuQep.exe
  C:\Windows\System\FPMuQep.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\RTNhHAI.exe
  C:\Windows\System\RTNhHAI.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\OJaPDUT.exe
  C:\Windows\System\OJaPDUT.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\NVRFiRg.exe
  C:\Windows\System\NVRFiRg.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\QzHAnHq.exe
  C:\Windows\System\QzHAnHq.exe
  2⤵
  PID:768
- C:\Windows\System\hmQBUWt.exe
  C:\Windows\System\hmQBUWt.exe
  2⤵
  PID:440
- C:\Windows\System\zvcuGUe.exe
  C:\Windows\System\zvcuGUe.exe
  2⤵
  PID:2632
- C:\Windows\System\XJtPzOo.exe
  C:\Windows\System\XJtPzOo.exe
  2⤵
  PID:5144
- C:\Windows\System\aDYhBnz.exe
  C:\Windows\System\aDYhBnz.exe
  2⤵
  PID:5172
- C:\Windows\System\GIvQmnf.exe
  C:\Windows\System\GIvQmnf.exe
  2⤵
  PID:5200
- C:\Windows\System\waiBoxn.exe
  C:\Windows\System\waiBoxn.exe
  2⤵
  PID:5228
- C:\Windows\System\bQvEpqo.exe
  C:\Windows\System\bQvEpqo.exe
  2⤵
  PID:5256
- C:\Windows\System\pRayNen.exe
  C:\Windows\System\pRayNen.exe
  2⤵
  PID:5284
- C:\Windows\System\XDPhcfa.exe
  C:\Windows\System\XDPhcfa.exe
  2⤵
  PID:5312
- C:\Windows\System\DYdaxld.exe
  C:\Windows\System\DYdaxld.exe
  2⤵
  PID:5340
- C:\Windows\System\LpGjEEZ.exe
  C:\Windows\System\LpGjEEZ.exe
  2⤵
  PID:5368
- C:\Windows\System\jVPkhrn.exe
  C:\Windows\System\jVPkhrn.exe
  2⤵
  PID:5396
- C:\Windows\System\RTOsNhg.exe
  C:\Windows\System\RTOsNhg.exe
  2⤵
  PID:5424
- C:\Windows\System\xKnKBue.exe
  C:\Windows\System\xKnKBue.exe
  2⤵
  PID:5452
- C:\Windows\System\XZUIwHk.exe
  C:\Windows\System\XZUIwHk.exe
  2⤵
  PID:5480
- C:\Windows\System\gfrRhvI.exe
  C:\Windows\System\gfrRhvI.exe
  2⤵
  PID:5508
- C:\Windows\System\wGHRRtg.exe
  C:\Windows\System\wGHRRtg.exe
  2⤵
  PID:5536
- C:\Windows\System\XqToUvH.exe
  C:\Windows\System\XqToUvH.exe
  2⤵
  PID:5564
- C:\Windows\System\cZPswsw.exe
  C:\Windows\System\cZPswsw.exe
  2⤵
  PID:5592
- C:\Windows\System\OAipUZi.exe
  C:\Windows\System\OAipUZi.exe
  2⤵
  PID:5620
- C:\Windows\System\SxmJxcM.exe
  C:\Windows\System\SxmJxcM.exe
  2⤵
  PID:5668
- C:\Windows\System\XJohIFc.exe
  C:\Windows\System\XJohIFc.exe
  2⤵
  PID:5688
- C:\Windows\System\gkwrRbE.exe
  C:\Windows\System\gkwrRbE.exe
  2⤵
  PID:5716
- C:\Windows\System\VyjtSFO.exe
  C:\Windows\System\VyjtSFO.exe
  2⤵
  PID:5732
- C:\Windows\System\FFDGhfj.exe
  C:\Windows\System\FFDGhfj.exe
  2⤵
  PID:5760
- C:\Windows\System\NmwQrwx.exe
  C:\Windows\System\NmwQrwx.exe
  2⤵
  PID:5788
- C:\Windows\System\fSvXqGp.exe
  C:\Windows\System\fSvXqGp.exe
  2⤵
  PID:5812
- C:\Windows\System\AFaSVLq.exe
  C:\Windows\System\AFaSVLq.exe
  2⤵
  PID:5840
- C:\Windows\System\AEYVffQ.exe
  C:\Windows\System\AEYVffQ.exe
  2⤵
  PID:5872
- C:\Windows\System\nnzHzty.exe
  C:\Windows\System\nnzHzty.exe
  2⤵
  PID:5900
- C:\Windows\System\RdhwwtL.exe
  C:\Windows\System\RdhwwtL.exe
  2⤵
  PID:5928
- C:\Windows\System\XyNnPiR.exe
  C:\Windows\System\XyNnPiR.exe
  2⤵
  PID:5956
- C:\Windows\System\rQlLxSj.exe
  C:\Windows\System\rQlLxSj.exe
  2⤵
  PID:5984
- C:\Windows\System\dSMSDiJ.exe
  C:\Windows\System\dSMSDiJ.exe
  2⤵
  PID:6012
- C:\Windows\System\ujuxjnP.exe
  C:\Windows\System\ujuxjnP.exe
  2⤵
  PID:6040
- C:\Windows\System\SbkXkTw.exe
  C:\Windows\System\SbkXkTw.exe
  2⤵
  PID:6068
- C:\Windows\System\jTNiiGH.exe
  C:\Windows\System\jTNiiGH.exe
  2⤵
  PID:6092
- C:\Windows\System\NVBGXag.exe
  C:\Windows\System\NVBGXag.exe
  2⤵
  PID:6124
- C:\Windows\System\WVMDMfK.exe
  C:\Windows\System\WVMDMfK.exe
  2⤵
  PID:3632
- C:\Windows\System\NPmfVHE.exe
  C:\Windows\System\NPmfVHE.exe
  2⤵
  PID:716
- C:\Windows\System\pbChXRI.exe
  C:\Windows\System\pbChXRI.exe
  2⤵
  PID:4840
- C:\Windows\System\sToxZYc.exe
  C:\Windows\System\sToxZYc.exe
  2⤵
  PID:3024
- C:\Windows\System\xdipzma.exe
  C:\Windows\System\xdipzma.exe
  2⤵
  PID:3784
- C:\Windows\System\hdyURHp.exe
  C:\Windows\System\hdyURHp.exe
  2⤵
  PID:5160
- C:\Windows\System\UoAMriD.exe
  C:\Windows\System\UoAMriD.exe
  2⤵
  PID:5220
- C:\Windows\System\JeyHynK.exe
  C:\Windows\System\JeyHynK.exe
  2⤵
  PID:5296
- C:\Windows\System\ajcnvrf.exe
  C:\Windows\System\ajcnvrf.exe
  2⤵
  PID:5356
- C:\Windows\System\ZLadpJs.exe
  C:\Windows\System\ZLadpJs.exe
  2⤵
  PID:5416
- C:\Windows\System\zGJDaAL.exe
  C:\Windows\System\zGJDaAL.exe
  2⤵
  PID:5492
- C:\Windows\System\nfKZpVU.exe
  C:\Windows\System\nfKZpVU.exe
  2⤵
  PID:5552
- C:\Windows\System\adTVGca.exe
  C:\Windows\System\adTVGca.exe
  2⤵
  PID:5612
- C:\Windows\System\vmKXYEy.exe
  C:\Windows\System\vmKXYEy.exe
  2⤵
  PID:5680
- C:\Windows\System\dINgyVg.exe
  C:\Windows\System\dINgyVg.exe
  2⤵
  PID:5744
- C:\Windows\System\lxGQhBx.exe
  C:\Windows\System\lxGQhBx.exe
  2⤵
  PID:5804
- C:\Windows\System\TPzTjIH.exe
  C:\Windows\System\TPzTjIH.exe
  2⤵
  PID:5864
- C:\Windows\System\wAJOkTE.exe
  C:\Windows\System\wAJOkTE.exe
  2⤵
  PID:5920
- C:\Windows\System\ducJkDz.exe
  C:\Windows\System\ducJkDz.exe
  2⤵
  PID:5976
- C:\Windows\System\KKBdulZ.exe
  C:\Windows\System\KKBdulZ.exe
  2⤵
  PID:6056
- C:\Windows\System\YdklCVU.exe
  C:\Windows\System\YdklCVU.exe
  2⤵
  PID:6112
- C:\Windows\System\bXeagHF.exe
  C:\Windows\System\bXeagHF.exe
  2⤵
  PID:2716
- C:\Windows\System\datmRXz.exe
  C:\Windows\System\datmRXz.exe
  2⤵
  PID:2068
- C:\Windows\System\JwTFdQs.exe
  C:\Windows\System\JwTFdQs.exe
  2⤵
  PID:2796
- C:\Windows\System\JVkrsgs.exe
  C:\Windows\System\JVkrsgs.exe
  2⤵
  PID:5248
- C:\Windows\System\fTyJUzz.exe
  C:\Windows\System\fTyJUzz.exe
  2⤵
  PID:4108
- C:\Windows\System\rcaaFRM.exe
  C:\Windows\System\rcaaFRM.exe
  2⤵
  PID:5520
- C:\Windows\System\aloYrXg.exe
  C:\Windows\System\aloYrXg.exe
  2⤵
  PID:5636
- C:\Windows\System\ubbomOK.exe
  C:\Windows\System\ubbomOK.exe
  2⤵
  PID:5780
- C:\Windows\System\KEXTVuA.exe
  C:\Windows\System\KEXTVuA.exe
  2⤵
  PID:5912
- C:\Windows\System\VsjnIXa.exe
  C:\Windows\System\VsjnIXa.exe
  2⤵
  PID:5972
- C:\Windows\System\WpKhGPb.exe
  C:\Windows\System\WpKhGPb.exe
  2⤵
  PID:6140
- C:\Windows\System\uZjerDW.exe
  C:\Windows\System\uZjerDW.exe
  2⤵
  PID:4276
- C:\Windows\System\ktCApsV.exe
  C:\Windows\System\ktCApsV.exe
  2⤵
  PID:5128
- C:\Windows\System\vKusuVL.exe
  C:\Windows\System\vKusuVL.exe
  2⤵
  PID:4424
- C:\Windows\System\tDpNLuC.exe
  C:\Windows\System\tDpNLuC.exe
  2⤵
  PID:5468
- C:\Windows\System\jWnZSph.exe
  C:\Windows\System\jWnZSph.exe
  2⤵
  PID:5724
- C:\Windows\System\yiotjru.exe
  C:\Windows\System\yiotjru.exe
  2⤵
  PID:4536
- C:\Windows\System\TNattVX.exe
  C:\Windows\System\TNattVX.exe
  2⤵
  PID:6172
- C:\Windows\System\ULVSnnx.exe
  C:\Windows\System\ULVSnnx.exe
  2⤵
  PID:6200
- C:\Windows\System\fjFlmpC.exe
  C:\Windows\System\fjFlmpC.exe
  2⤵
  PID:6228
- C:\Windows\System\OXGKeyh.exe
  C:\Windows\System\OXGKeyh.exe
  2⤵
  PID:6252
- C:\Windows\System\lHtJHth.exe
  C:\Windows\System\lHtJHth.exe
  2⤵
  PID:6280
- C:\Windows\System\LoOOqtT.exe
  C:\Windows\System\LoOOqtT.exe
  2⤵
  PID:6308
- C:\Windows\System\kavEoUN.exe
  C:\Windows\System\kavEoUN.exe
  2⤵
  PID:6340
- C:\Windows\System\wHZJYYD.exe
  C:\Windows\System\wHZJYYD.exe
  2⤵
  PID:6364
- C:\Windows\System\rguFfCX.exe
  C:\Windows\System\rguFfCX.exe
  2⤵
  PID:6396
- C:\Windows\System\UCVDeXa.exe
  C:\Windows\System\UCVDeXa.exe
  2⤵
  PID:6420
- C:\Windows\System\dDZZrKe.exe
  C:\Windows\System\dDZZrKe.exe
  2⤵
  PID:6448
- C:\Windows\System\vbUkKiF.exe
  C:\Windows\System\vbUkKiF.exe
  2⤵
  PID:6476
- C:\Windows\System\JUPRcfG.exe
  C:\Windows\System\JUPRcfG.exe
  2⤵
  PID:6504
- C:\Windows\System\XMNqarH.exe
  C:\Windows\System\XMNqarH.exe
  2⤵
  PID:6536
- C:\Windows\System\IkEXJOr.exe
  C:\Windows\System\IkEXJOr.exe
  2⤵
  PID:6560
- C:\Windows\System\SsInjst.exe
  C:\Windows\System\SsInjst.exe
  2⤵
  PID:6588
- C:\Windows\System\eTlGLKM.exe
  C:\Windows\System\eTlGLKM.exe
  2⤵
  PID:6620
- C:\Windows\System\toBLFld.exe
  C:\Windows\System\toBLFld.exe
  2⤵
  PID:6644
- C:\Windows\System\XppjhOt.exe
  C:\Windows\System\XppjhOt.exe
  2⤵
  PID:6672
- C:\Windows\System\NMpWsax.exe
  C:\Windows\System\NMpWsax.exe
  2⤵
  PID:6700
- C:\Windows\System\NSqAkRO.exe
  C:\Windows\System\NSqAkRO.exe
  2⤵
  PID:6728
- C:\Windows\System\EnoAJlW.exe
  C:\Windows\System\EnoAJlW.exe
  2⤵
  PID:6764
- C:\Windows\System\ArylmGc.exe
  C:\Windows\System\ArylmGc.exe
  2⤵
  PID:6788
- C:\Windows\System\QJBbEcf.exe
  C:\Windows\System\QJBbEcf.exe
  2⤵
  PID:6856
- C:\Windows\System\FsLARRI.exe
  C:\Windows\System\FsLARRI.exe
  2⤵
  PID:6884
- C:\Windows\System\AwpvXRU.exe
  C:\Windows\System\AwpvXRU.exe
  2⤵
  PID:6948
- C:\Windows\System\tELhbxj.exe
  C:\Windows\System\tELhbxj.exe
  2⤵
  PID:6968
- C:\Windows\System\xbhGjGv.exe
  C:\Windows\System\xbhGjGv.exe
  2⤵
  PID:6984
- C:\Windows\System\jYWFcRD.exe
  C:\Windows\System\jYWFcRD.exe
  2⤵
  PID:7032
- C:\Windows\System\MHMVHTK.exe
  C:\Windows\System\MHMVHTK.exe
  2⤵
  PID:7052
- C:\Windows\System\TyCUPsT.exe
  C:\Windows\System\TyCUPsT.exe
  2⤵
  PID:7072
- C:\Windows\System\sxilUHz.exe
  C:\Windows\System\sxilUHz.exe
  2⤵
  PID:7092
- C:\Windows\System\gKPmlaT.exe
  C:\Windows\System\gKPmlaT.exe
  2⤵
  PID:7112
- C:\Windows\System\spCGtPo.exe
  C:\Windows\System\spCGtPo.exe
  2⤵
  PID:7132
- C:\Windows\System\wHappfD.exe
  C:\Windows\System\wHappfD.exe
  2⤵
  PID:7152
- C:\Windows\System\adLUWfs.exe
  C:\Windows\System\adLUWfs.exe
  2⤵
  PID:3584
- C:\Windows\System\UCKPQFY.exe
  C:\Windows\System\UCKPQFY.exe
  2⤵
  PID:5444
- C:\Windows\System\DdYnEPI.exe
  C:\Windows\System\DdYnEPI.exe
  2⤵
  PID:5856
- C:\Windows\System\JARfGMV.exe
  C:\Windows\System\JARfGMV.exe
  2⤵
  PID:6188
- C:\Windows\System\vuNJTtt.exe
  C:\Windows\System\vuNJTtt.exe
  2⤵
  PID:6220
- C:\Windows\System\RNnXUXa.exe
  C:\Windows\System\RNnXUXa.exe
  2⤵
  PID:4000
- C:\Windows\System\HGnqarn.exe
  C:\Windows\System\HGnqarn.exe
  2⤵
  PID:6324
- C:\Windows\System\ZpusWXR.exe
  C:\Windows\System\ZpusWXR.exe
  2⤵
  PID:6352
- C:\Windows\System\PtxymNt.exe
  C:\Windows\System\PtxymNt.exe
  2⤵
  PID:6384
- C:\Windows\System\neZtypw.exe
  C:\Windows\System\neZtypw.exe
  2⤵
  PID:3008
- C:\Windows\System\DNyxBCp.exe
  C:\Windows\System\DNyxBCp.exe
  2⤵
  PID:6520
- C:\Windows\System\qgldrin.exe
  C:\Windows\System\qgldrin.exe
  2⤵
  PID:6576
- C:\Windows\System\JRGWWEY.exe
  C:\Windows\System\JRGWWEY.exe
  2⤵
  PID:640
- C:\Windows\System\INuBfTD.exe
  C:\Windows\System\INuBfTD.exe
  2⤵
  PID:6608
- C:\Windows\System\jMTwTHC.exe
  C:\Windows\System\jMTwTHC.exe
  2⤵
  PID:6632
- C:\Windows\System\uCxPEPw.exe
  C:\Windows\System\uCxPEPw.exe
  2⤵
  PID:6688
- C:\Windows\System\obkquSi.exe
  C:\Windows\System\obkquSi.exe
  2⤵
  PID:4132
- C:\Windows\System\lBJfBZo.exe
  C:\Windows\System\lBJfBZo.exe
  2⤵
  PID:1440
- C:\Windows\System\ARDVeXt.exe
  C:\Windows\System\ARDVeXt.exe
  2⤵
  PID:6784
- C:\Windows\System\syZeFol.exe
  C:\Windows\System\syZeFol.exe
  2⤵
  PID:6836
- C:\Windows\System\rXgUUZR.exe
  C:\Windows\System\rXgUUZR.exe
  2⤵
  PID:4152
- C:\Windows\System\yvWUQBO.exe
  C:\Windows\System\yvWUQBO.exe
  2⤵
  PID:4520
- C:\Windows\System\CtWatMg.exe
  C:\Windows\System\CtWatMg.exe
  2⤵
  PID:2596
- C:\Windows\System\FbFosZu.exe
  C:\Windows\System\FbFosZu.exe
  2⤵
  PID:2316
- C:\Windows\System\FdRYNzJ.exe
  C:\Windows\System\FdRYNzJ.exe
  2⤵
  PID:6944
- C:\Windows\System\foCNuHj.exe
  C:\Windows\System\foCNuHj.exe
  2⤵
  PID:7088
- C:\Windows\System\UbZSdjp.exe
  C:\Windows\System\UbZSdjp.exe
  2⤵
  PID:6084
- C:\Windows\System\fgzNVvr.exe
  C:\Windows\System\fgzNVvr.exe
  2⤵
  PID:4476
- C:\Windows\System\pJHeDvE.exe
  C:\Windows\System\pJHeDvE.exe
  2⤵
  PID:6212
- C:\Windows\System\fLRKlGH.exe
  C:\Windows\System\fLRKlGH.exe
  2⤵
  PID:6304
- C:\Windows\System\PxwXuXN.exe
  C:\Windows\System\PxwXuXN.exe
  2⤵
  PID:6492
- C:\Windows\System\cZHRPGI.exe
  C:\Windows\System\cZHRPGI.exe
  2⤵
  PID:6464
- C:\Windows\System\CbUcPzU.exe
  C:\Windows\System\CbUcPzU.exe
  2⤵
  PID:3556
- C:\Windows\System\bOhwuSl.exe
  C:\Windows\System\bOhwuSl.exe
  2⤵
  PID:4760
- C:\Windows\System\PZbQzHL.exe
  C:\Windows\System\PZbQzHL.exe
  2⤵
  PID:6716
- C:\Windows\System\mmbQYvP.exe
  C:\Windows\System\mmbQYvP.exe
  2⤵
  PID:6876
- C:\Windows\System\SMeYVLL.exe
  C:\Windows\System\SMeYVLL.exe
  2⤵
  PID:3816
- C:\Windows\System\LXBehmb.exe
  C:\Windows\System\LXBehmb.exe
  2⤵
  PID:1796
- C:\Windows\System\wWWNVvI.exe
  C:\Windows\System\wWWNVvI.exe
  2⤵
  PID:7144
- C:\Windows\System\zELljIs.exe
  C:\Windows\System\zELljIs.exe
  2⤵
  PID:6248
- C:\Windows\System\UwQpLVK.exe
  C:\Windows\System\UwQpLVK.exe
  2⤵
  PID:6580
- C:\Windows\System\eFZGVuE.exe
  C:\Windows\System\eFZGVuE.exe
  2⤵
  PID:4788
- C:\Windows\System\mcvPsWk.exe
  C:\Windows\System\mcvPsWk.exe
  2⤵
  PID:3552
- C:\Windows\System\njtbIwS.exe
  C:\Windows\System\njtbIwS.exe
  2⤵
  PID:3068
- C:\Windows\System\gprSeJM.exe
  C:\Windows\System\gprSeJM.exe
  2⤵
  PID:6412
- C:\Windows\System\SGBBIEt.exe
  C:\Windows\System\SGBBIEt.exe
  2⤵
  PID:6668
- C:\Windows\System\OWwkzrK.exe
  C:\Windows\System\OWwkzrK.exe
  2⤵
  PID:7180
- C:\Windows\System\yEjJowO.exe
  C:\Windows\System\yEjJowO.exe
  2⤵
  PID:7196
- C:\Windows\System\miGGnkC.exe
  C:\Windows\System\miGGnkC.exe
  2⤵
  PID:7220
- C:\Windows\System\ruIExEl.exe
  C:\Windows\System\ruIExEl.exe
  2⤵
  PID:7240
- C:\Windows\System\nqdEZMT.exe
  C:\Windows\System\nqdEZMT.exe
  2⤵
  PID:7260
- C:\Windows\System\hwmuqva.exe
  C:\Windows\System\hwmuqva.exe
  2⤵
  PID:7280
- C:\Windows\System\vaWWmON.exe
  C:\Windows\System\vaWWmON.exe
  2⤵
  PID:7308
- C:\Windows\System\llwzlin.exe
  C:\Windows\System\llwzlin.exe
  2⤵
  PID:7340
- C:\Windows\System\ZAtYQiv.exe
  C:\Windows\System\ZAtYQiv.exe
  2⤵
  PID:7400
- C:\Windows\System\USMqprU.exe
  C:\Windows\System\USMqprU.exe
  2⤵
  PID:7448
- C:\Windows\System\YfwuObH.exe
  C:\Windows\System\YfwuObH.exe
  2⤵
  PID:7472
- C:\Windows\System\GXvUoZp.exe
  C:\Windows\System\GXvUoZp.exe
  2⤵
  PID:7504
- C:\Windows\System\tUJgUqg.exe
  C:\Windows\System\tUJgUqg.exe
  2⤵
  PID:7524
- C:\Windows\System\PoSgxLG.exe
  C:\Windows\System\PoSgxLG.exe
  2⤵
  PID:7544
- C:\Windows\System\YCLRlfh.exe
  C:\Windows\System\YCLRlfh.exe
  2⤵
  PID:7572
- C:\Windows\System\ZUGMwpH.exe
  C:\Windows\System\ZUGMwpH.exe
  2⤵
  PID:7596
- C:\Windows\System\JxyyoCr.exe
  C:\Windows\System\JxyyoCr.exe
  2⤵
  PID:7624
- C:\Windows\System\nldnpOO.exe
  C:\Windows\System\nldnpOO.exe
  2⤵
  PID:7652
- C:\Windows\System\mTjpoXm.exe
  C:\Windows\System\mTjpoXm.exe
  2⤵
  PID:7684
- C:\Windows\System\qtJKtFf.exe
  C:\Windows\System\qtJKtFf.exe
  2⤵
  PID:7712
- C:\Windows\System\PYHRCFE.exe
  C:\Windows\System\PYHRCFE.exe
  2⤵
  PID:7732
- C:\Windows\System\niiqDVy.exe
  C:\Windows\System\niiqDVy.exe
  2⤵
  PID:7768
- C:\Windows\System\cUbhQDX.exe
  C:\Windows\System\cUbhQDX.exe
  2⤵
  PID:7788
- C:\Windows\System\lnsumOF.exe
  C:\Windows\System\lnsumOF.exe
  2⤵
  PID:7804
- C:\Windows\System\ATMpbQm.exe
  C:\Windows\System\ATMpbQm.exe
  2⤵
  PID:7844
- C:\Windows\System\IZvUUVu.exe
  C:\Windows\System\IZvUUVu.exe
  2⤵
  PID:7884
- C:\Windows\System\WJtDJti.exe
  C:\Windows\System\WJtDJti.exe
  2⤵
  PID:7920
- C:\Windows\System\WZoUmvU.exe
  C:\Windows\System\WZoUmvU.exe
  2⤵
  PID:7944
- C:\Windows\System\UWFAibF.exe
  C:\Windows\System\UWFAibF.exe
  2⤵
  PID:7960
- C:\Windows\System\mvWSoxf.exe
  C:\Windows\System\mvWSoxf.exe
  2⤵
  PID:8000
- C:\Windows\System\EVkCbNv.exe
  C:\Windows\System\EVkCbNv.exe
  2⤵
  PID:8032
- C:\Windows\System\RMKkipG.exe
  C:\Windows\System\RMKkipG.exe
  2⤵
  PID:8060
- C:\Windows\System\fXDkNsN.exe
  C:\Windows\System\fXDkNsN.exe
  2⤵
  PID:8076
- C:\Windows\System\LukzHjP.exe
  C:\Windows\System\LukzHjP.exe
  2⤵
  PID:8104
- C:\Windows\System\tDOBJfm.exe
  C:\Windows\System\tDOBJfm.exe
  2⤵
  PID:8132
- C:\Windows\System\MIDHQoC.exe
  C:\Windows\System\MIDHQoC.exe
  2⤵
  PID:8156
- C:\Windows\System\sojZviS.exe
  C:\Windows\System\sojZviS.exe
  2⤵
  PID:8184
- C:\Windows\System\QhmBtIK.exe
  C:\Windows\System\QhmBtIK.exe
  2⤵
  PID:6184
- C:\Windows\System\wBLsiJp.exe
  C:\Windows\System\wBLsiJp.exe
  2⤵
  PID:7288
- C:\Windows\System\GutysVz.exe
  C:\Windows\System\GutysVz.exe
  2⤵
  PID:7348
- C:\Windows\System\BJqVYKD.exe
  C:\Windows\System\BJqVYKD.exe
  2⤵
  PID:7388
- C:\Windows\System\McJkruv.exe
  C:\Windows\System\McJkruv.exe
  2⤵
  PID:7456
- C:\Windows\System\xJLcqtG.exe
  C:\Windows\System\xJLcqtG.exe
  2⤵
  PID:7500
- C:\Windows\System\IgBiSMv.exe
  C:\Windows\System\IgBiSMv.exe
  2⤵
  PID:7536
- C:\Windows\System\LaonokF.exe
  C:\Windows\System\LaonokF.exe
  2⤵
  PID:7692
- C:\Windows\System\QaOxNQz.exe
  C:\Windows\System\QaOxNQz.exe
  2⤵
  PID:7720
- C:\Windows\System\BtjaebG.exe
  C:\Windows\System\BtjaebG.exe
  2⤵
  PID:7828
- C:\Windows\System\WxclqWw.exe
  C:\Windows\System\WxclqWw.exe
  2⤵
  PID:7892
- C:\Windows\System\giaVmUv.exe
  C:\Windows\System\giaVmUv.exe
  2⤵
  PID:7928
- C:\Windows\System\mgLcOrN.exe
  C:\Windows\System\mgLcOrN.exe
  2⤵
  PID:7956
- C:\Windows\System\xcaHdHZ.exe
  C:\Windows\System\xcaHdHZ.exe
  2⤵
  PID:8024
- C:\Windows\System\lXnzoiA.exe
  C:\Windows\System\lXnzoiA.exe
  2⤵
  PID:8084
- C:\Windows\System\zHRVSdW.exe
  C:\Windows\System\zHRVSdW.exe
  2⤵
  PID:8116
- C:\Windows\System\nHqSVDW.exe
  C:\Windows\System\nHqSVDW.exe
  2⤵
  PID:8172
- C:\Windows\System\RugaKjk.exe
  C:\Windows\System\RugaKjk.exe
  2⤵
  PID:7300
- C:\Windows\System\OTgkwVF.exe
  C:\Windows\System\OTgkwVF.exe
  2⤵
  PID:7396
- C:\Windows\System\bPSpIFJ.exe
  C:\Windows\System\bPSpIFJ.exe
  2⤵
  PID:7616
- C:\Windows\System\SHnZGLN.exe
  C:\Windows\System\SHnZGLN.exe
  2⤵
  PID:7780
- C:\Windows\System\gJXvQOR.exe
  C:\Windows\System\gJXvQOR.exe
  2⤵
  PID:8028
- C:\Windows\System\AQZfFmC.exe
  C:\Windows\System\AQZfFmC.exe
  2⤵
  PID:8144
- C:\Windows\System\ZLnksFC.exe
  C:\Windows\System\ZLnksFC.exe
  2⤵
  PID:7552
- C:\Windows\System\YCahkEb.exe
  C:\Windows\System\YCahkEb.exe
  2⤵
  PID:7744
- C:\Windows\System\LBnBdTT.exe
  C:\Windows\System\LBnBdTT.exe
  2⤵
  PID:8056
- C:\Windows\System\xhVVtPQ.exe
  C:\Windows\System\xhVVtPQ.exe
  2⤵
  PID:8200
- C:\Windows\System\ujazGLE.exe
  C:\Windows\System\ujazGLE.exe
  2⤵
  PID:8220
- C:\Windows\System\SQuGORH.exe
  C:\Windows\System\SQuGORH.exe
  2⤵
  PID:8236
- C:\Windows\System\pktnBkN.exe
  C:\Windows\System\pktnBkN.exe
  2⤵
  PID:8288
- C:\Windows\System\DTgrFwv.exe
  C:\Windows\System\DTgrFwv.exe
  2⤵
  PID:8304
- C:\Windows\System\TjgMsoQ.exe
  C:\Windows\System\TjgMsoQ.exe
  2⤵
  PID:8340
- C:\Windows\System\ddZvyee.exe
  C:\Windows\System\ddZvyee.exe
  2⤵
  PID:8364
- C:\Windows\System\yoqsTLj.exe
  C:\Windows\System\yoqsTLj.exe
  2⤵
  PID:8392
- C:\Windows\System\ZPVMtVv.exe
  C:\Windows\System\ZPVMtVv.exe
  2⤵
  PID:8408
- C:\Windows\System\anYbyCX.exe
  C:\Windows\System\anYbyCX.exe
  2⤵
  PID:8440
- C:\Windows\System\YhTOpgA.exe
  C:\Windows\System\YhTOpgA.exe
  2⤵
  PID:8456
- C:\Windows\System\RbrTFqh.exe
  C:\Windows\System\RbrTFqh.exe
  2⤵
  PID:8476
- C:\Windows\System\SLKTLVC.exe
  C:\Windows\System\SLKTLVC.exe
  2⤵
  PID:8540
- C:\Windows\System\PcBznVV.exe
  C:\Windows\System\PcBznVV.exe
  2⤵
  PID:8588
- C:\Windows\System\eCBdHJi.exe
  C:\Windows\System\eCBdHJi.exe
  2⤵
  PID:8624
- C:\Windows\System\gealNjb.exe
  C:\Windows\System\gealNjb.exe
  2⤵
  PID:8656
- C:\Windows\System\iCZTIiK.exe
  C:\Windows\System\iCZTIiK.exe
  2⤵
  PID:8680
- C:\Windows\System\ygGWMqs.exe
  C:\Windows\System\ygGWMqs.exe
  2⤵
  PID:8704
- C:\Windows\System\vtKcHKl.exe
  C:\Windows\System\vtKcHKl.exe
  2⤵
  PID:8724
- C:\Windows\System\cFaueuV.exe
  C:\Windows\System\cFaueuV.exe
  2⤵
  PID:8748
- C:\Windows\System\ghakNaP.exe
  C:\Windows\System\ghakNaP.exe
  2⤵
  PID:8768
- C:\Windows\System\gehOvwv.exe
  C:\Windows\System\gehOvwv.exe
  2⤵
  PID:8820
- C:\Windows\System\DhHioBM.exe
  C:\Windows\System\DhHioBM.exe
  2⤵
  PID:8840
- C:\Windows\System\asyBvYh.exe
  C:\Windows\System\asyBvYh.exe
  2⤵
  PID:8888
- C:\Windows\System\Dgtbeve.exe
  C:\Windows\System\Dgtbeve.exe
  2⤵
  PID:8912
- C:\Windows\System\QPAtFjM.exe
  C:\Windows\System\QPAtFjM.exe
  2⤵
  PID:8932
- C:\Windows\System\bTmDcAL.exe
  C:\Windows\System\bTmDcAL.exe
  2⤵
  PID:8956
- C:\Windows\System\LSopAYC.exe
  C:\Windows\System\LSopAYC.exe
  2⤵
  PID:8972
- C:\Windows\System\KVUWdhD.exe
  C:\Windows\System\KVUWdhD.exe
  2⤵
  PID:9012
- C:\Windows\System\hhePOAw.exe
  C:\Windows\System\hhePOAw.exe
  2⤵
  PID:9032
- C:\Windows\System\JmWxjuB.exe
  C:\Windows\System\JmWxjuB.exe
  2⤵
  PID:9072
- C:\Windows\System\fUAsvad.exe
  C:\Windows\System\fUAsvad.exe
  2⤵
  PID:9100
- C:\Windows\System\VQdpeeK.exe
  C:\Windows\System\VQdpeeK.exe
  2⤵
  PID:9124
- C:\Windows\System\SbzFwjj.exe
  C:\Windows\System\SbzFwjj.exe
  2⤵
  PID:9168
- C:\Windows\System\pjIxoKm.exe
  C:\Windows\System\pjIxoKm.exe
  2⤵
  PID:9192
- C:\Windows\System\HwIdgWE.exe
  C:\Windows\System\HwIdgWE.exe
  2⤵
  PID:9212
- C:\Windows\System\jVKhFoR.exe
  C:\Windows\System\jVKhFoR.exe
  2⤵
  PID:7496
- C:\Windows\System\wAJRgJq.exe
  C:\Windows\System\wAJRgJq.exe
  2⤵
  PID:8216
- C:\Windows\System\vQTNNeJ.exe
  C:\Windows\System\vQTNNeJ.exe
  2⤵
  PID:8232
- C:\Windows\System\FMvkGkF.exe
  C:\Windows\System\FMvkGkF.exe
  2⤵
  PID:8272
- C:\Windows\System\FmslUvX.exe
  C:\Windows\System\FmslUvX.exe
  2⤵
  PID:8360
- C:\Windows\System\LkhEATk.exe
  C:\Windows\System\LkhEATk.exe
  2⤵
  PID:8380
- C:\Windows\System\ZnicZMf.exe
  C:\Windows\System\ZnicZMf.exe
  2⤵
  PID:8564
- C:\Windows\System\wdSaXJt.exe
  C:\Windows\System\wdSaXJt.exe
  2⤵
  PID:8532
- C:\Windows\System\Sehifiz.exe
  C:\Windows\System\Sehifiz.exe
  2⤵
  PID:8636
- C:\Windows\System\rfYXXJc.exe
  C:\Windows\System\rfYXXJc.exe
  2⤵
  PID:8648
- C:\Windows\System\lcqfBvg.exe
  C:\Windows\System\lcqfBvg.exe
  2⤵
  PID:8764
- C:\Windows\System\hIplDrE.exe
  C:\Windows\System\hIplDrE.exe
  2⤵
  PID:8832
- C:\Windows\System\IUmxQEI.exe
  C:\Windows\System\IUmxQEI.exe
  2⤵
  PID:8928
- C:\Windows\System\PMwJmAP.exe
  C:\Windows\System\PMwJmAP.exe
  2⤵
  PID:8992
- C:\Windows\System\sdNjYJa.exe
  C:\Windows\System\sdNjYJa.exe
  2⤵
  PID:9120
- C:\Windows\System\OcsHPob.exe
  C:\Windows\System\OcsHPob.exe
  2⤵
  PID:9152
- C:\Windows\System\DWOohjP.exe
  C:\Windows\System\DWOohjP.exe
  2⤵
  PID:9208
- C:\Windows\System\JgaCYQm.exe
  C:\Windows\System\JgaCYQm.exe
  2⤵
  PID:8296
- C:\Windows\System\WUlwfSX.exe
  C:\Windows\System\WUlwfSX.exe
  2⤵
  PID:8596
- C:\Windows\System\hDMzVGf.exe
  C:\Windows\System\hDMzVGf.exe
  2⤵
  PID:8556
- C:\Windows\System\jObXUVN.exe
  C:\Windows\System\jObXUVN.exe
  2⤵
  PID:8872
- C:\Windows\System\UwOqcdz.exe
  C:\Windows\System\UwOqcdz.exe
  2⤵
  PID:8948
- C:\Windows\System\uJlfQyS.exe
  C:\Windows\System\uJlfQyS.exe
  2⤵
  PID:8996
- C:\Windows\System\jKKutWx.exe
  C:\Windows\System\jKKutWx.exe
  2⤵
  PID:8472
- C:\Windows\System\yqueHqT.exe
  C:\Windows\System\yqueHqT.exe
  2⤵
  PID:8672
- C:\Windows\System\Nvdkjkv.exe
  C:\Windows\System\Nvdkjkv.exe
  2⤵
  PID:7316
- C:\Windows\System\UxykYea.exe
  C:\Windows\System\UxykYea.exe
  2⤵
  PID:9184
- C:\Windows\System\bWCnaEu.exe
  C:\Windows\System\bWCnaEu.exe
  2⤵
  PID:8568
- C:\Windows\System\mAMTfBx.exe
  C:\Windows\System\mAMTfBx.exe
  2⤵
  PID:9236
- C:\Windows\System\wNzfNRo.exe
  C:\Windows\System\wNzfNRo.exe
  2⤵
  PID:9260
- C:\Windows\System\GnAqPvI.exe
  C:\Windows\System\GnAqPvI.exe
  2⤵
  PID:9284
- C:\Windows\System\zKBFNtG.exe
  C:\Windows\System\zKBFNtG.exe
  2⤵
  PID:9308
- C:\Windows\System\iPKRwwW.exe
  C:\Windows\System\iPKRwwW.exe
  2⤵
  PID:9336
- C:\Windows\System\LqlPOfg.exe
  C:\Windows\System\LqlPOfg.exe
  2⤵
  PID:9364
- C:\Windows\System\XyUiWII.exe
  C:\Windows\System\XyUiWII.exe
  2⤵
  PID:9388
- C:\Windows\System\mIrNfNp.exe
  C:\Windows\System\mIrNfNp.exe
  2⤵
  PID:9412
- C:\Windows\System\nEuVpCa.exe
  C:\Windows\System\nEuVpCa.exe
  2⤵
  PID:9480
- C:\Windows\System\UnzTMEc.exe
  C:\Windows\System\UnzTMEc.exe
  2⤵
  PID:9504
- C:\Windows\System\FrfileI.exe
  C:\Windows\System\FrfileI.exe
  2⤵
  PID:9524
- C:\Windows\System\xjhVlbp.exe
  C:\Windows\System\xjhVlbp.exe
  2⤵
  PID:9544
- C:\Windows\System\SKHwgZA.exe
  C:\Windows\System\SKHwgZA.exe
  2⤵
  PID:9568
- C:\Windows\System\BWKEpAe.exe
  C:\Windows\System\BWKEpAe.exe
  2⤵
  PID:9612
- C:\Windows\System\owgrdpE.exe
  C:\Windows\System\owgrdpE.exe
  2⤵
  PID:9672
- C:\Windows\System\lkjngjA.exe
  C:\Windows\System\lkjngjA.exe
  2⤵
  PID:9696
- C:\Windows\System\FhvEgly.exe
  C:\Windows\System\FhvEgly.exe
  2⤵
  PID:9720
- C:\Windows\System\FQyEctj.exe
  C:\Windows\System\FQyEctj.exe
  2⤵
  PID:9740
- C:\Windows\System\HDAAZhX.exe
  C:\Windows\System\HDAAZhX.exe
  2⤵
  PID:9756
- C:\Windows\System\QIeBoSC.exe
  C:\Windows\System\QIeBoSC.exe
  2⤵
  PID:9772
- C:\Windows\System\nXwxbLC.exe
  C:\Windows\System\nXwxbLC.exe
  2⤵
  PID:9788
- C:\Windows\System\BSYlOyq.exe
  C:\Windows\System\BSYlOyq.exe
  2⤵
  PID:9804
- C:\Windows\System\KwYnWvU.exe
  C:\Windows\System\KwYnWvU.exe
  2⤵
  PID:9820
- C:\Windows\System\suCgSai.exe
  C:\Windows\System\suCgSai.exe
  2⤵
  PID:9836
- C:\Windows\System\jOyJmXh.exe
  C:\Windows\System\jOyJmXh.exe
  2⤵
  PID:9852
- C:\Windows\System\boUHzdj.exe
  C:\Windows\System\boUHzdj.exe
  2⤵
  PID:9868
- C:\Windows\System\qYThjjQ.exe
  C:\Windows\System\qYThjjQ.exe
  2⤵
  PID:9884
- C:\Windows\System\DAfVsQD.exe
  C:\Windows\System\DAfVsQD.exe
  2⤵
  PID:9900
- C:\Windows\System\ijmnjzm.exe
  C:\Windows\System\ijmnjzm.exe
  2⤵
  PID:9916
- C:\Windows\System\QroEcRy.exe
  C:\Windows\System\QroEcRy.exe
  2⤵
  PID:9932
- C:\Windows\System\yZCAphY.exe
  C:\Windows\System\yZCAphY.exe
  2⤵
  PID:9948
- C:\Windows\System\LMhFxkk.exe
  C:\Windows\System\LMhFxkk.exe
  2⤵
  PID:9964
- C:\Windows\System\ALpHuYT.exe
  C:\Windows\System\ALpHuYT.exe
  2⤵
  PID:10104
- C:\Windows\System\oWbjkEd.exe
  C:\Windows\System\oWbjkEd.exe
  2⤵
  PID:10120
- C:\Windows\System\MbWLASQ.exe
  C:\Windows\System\MbWLASQ.exe
  2⤵
  PID:10216
- C:\Windows\System\FMBRwnj.exe
  C:\Windows\System\FMBRwnj.exe
  2⤵
  PID:10236
- C:\Windows\System\kTWflgX.exe
  C:\Windows\System\kTWflgX.exe
  2⤵
  PID:9244
- C:\Windows\System\VqMPXlO.exe
  C:\Windows\System\VqMPXlO.exe
  2⤵
  PID:9384
- C:\Windows\System\xrIXGzG.exe
  C:\Windows\System\xrIXGzG.exe
  2⤵
  PID:9452
- C:\Windows\System\ExtmVkc.exe
  C:\Windows\System\ExtmVkc.exe
  2⤵
  PID:9520
- C:\Windows\System\eOfBRjE.exe
  C:\Windows\System\eOfBRjE.exe
  2⤵
  PID:9640
- C:\Windows\System\jUTpxFS.exe
  C:\Windows\System\jUTpxFS.exe
  2⤵
  PID:9664
- C:\Windows\System\hEZblmX.exe
  C:\Windows\System\hEZblmX.exe
  2⤵
  PID:9580
- C:\Windows\System\eBIVNXN.exe
  C:\Windows\System\eBIVNXN.exe
  2⤵
  PID:9796
- C:\Windows\System\hGqhQxe.exe
  C:\Windows\System\hGqhQxe.exe
  2⤵
  PID:9604
- C:\Windows\System\kliqEqS.exe
  C:\Windows\System\kliqEqS.exe
  2⤵
  PID:9988
- C:\Windows\System\oOFeqvP.exe
  C:\Windows\System\oOFeqvP.exe
  2⤵
  PID:9752
- C:\Windows\System\nRAXfQR.exe
  C:\Windows\System\nRAXfQR.exe
  2⤵
  PID:9848
- C:\Windows\System\AycKvpV.exe
  C:\Windows\System\AycKvpV.exe
  2⤵
  PID:9880
- C:\Windows\System\eVNFnZY.exe
  C:\Windows\System\eVNFnZY.exe
  2⤵
  PID:9980
- C:\Windows\System\OoAxBjm.exe
  C:\Windows\System\OoAxBjm.exe
  2⤵
  PID:10004
- C:\Windows\System\iUlkugT.exe
  C:\Windows\System\iUlkugT.exe
  2⤵
  PID:9316
- C:\Windows\System\jYLRpMe.exe
  C:\Windows\System\jYLRpMe.exe
  2⤵
  PID:9228
- C:\Windows\System\yTDJZqU.exe
  C:\Windows\System\yTDJZqU.exe
  2⤵
  PID:9540
- C:\Windows\System\RxscRra.exe
  C:\Windows\System\RxscRra.exe
  2⤵
  PID:9800
- C:\Windows\System\GmtXmaP.exe
  C:\Windows\System\GmtXmaP.exe
  2⤵
  PID:10024
- C:\Windows\System\TClsUIW.exe
  C:\Windows\System\TClsUIW.exe
  2⤵
  PID:9728
- C:\Windows\System\cttgpzn.exe
  C:\Windows\System\cttgpzn.exe
  2⤵
  PID:9876
- C:\Windows\System\yEItURW.exe
  C:\Windows\System\yEItURW.exe
  2⤵
  PID:10040
- C:\Windows\System\orBCgHn.exe
  C:\Windows\System\orBCgHn.exe
  2⤵
  PID:8952
- C:\Windows\System\INNFgqw.exe
  C:\Windows\System\INNFgqw.exe
  2⤵
  PID:9512
- C:\Windows\System\GxkjJLj.exe
  C:\Windows\System\GxkjJLj.exe
  2⤵
  PID:9620
- C:\Windows\System\bBOYZfK.exe
  C:\Windows\System\bBOYZfK.exe
  2⤵
  PID:10060
- C:\Windows\System\cyBEOuk.exe
  C:\Windows\System\cyBEOuk.exe
  2⤵
  PID:9812
- C:\Windows\System\SYbFSxj.exe
  C:\Windows\System\SYbFSxj.exe
  2⤵
  PID:9644
- C:\Windows\System\BvhkNpK.exe
  C:\Windows\System\BvhkNpK.exe
  2⤵
  PID:10252
- C:\Windows\System\bsCFako.exe
  C:\Windows\System\bsCFako.exe
  2⤵
  PID:10304
- C:\Windows\System\QZIxdWI.exe
  C:\Windows\System\QZIxdWI.exe
  2⤵
  PID:10328
- C:\Windows\System\rdVDpAr.exe
  C:\Windows\System\rdVDpAr.exe
  2⤵
  PID:10344
- C:\Windows\System\gsDpeTY.exe
  C:\Windows\System\gsDpeTY.exe
  2⤵
  PID:10364
- C:\Windows\System\QXqeUnb.exe
  C:\Windows\System\QXqeUnb.exe
  2⤵
  PID:10400
- C:\Windows\System\HTitlnG.exe
  C:\Windows\System\HTitlnG.exe
  2⤵
  PID:10416
- C:\Windows\System\zmCMfpt.exe
  C:\Windows\System\zmCMfpt.exe
  2⤵
  PID:10468
- C:\Windows\System\iLpJnvv.exe
  C:\Windows\System\iLpJnvv.exe
  2⤵
  PID:10508
- C:\Windows\System\ivEYLgP.exe
  C:\Windows\System\ivEYLgP.exe
  2⤵
  PID:10524
- C:\Windows\System\YnaRxWC.exe
  C:\Windows\System\YnaRxWC.exe
  2⤵
  PID:10552
- C:\Windows\System\TvVVwNR.exe
  C:\Windows\System\TvVVwNR.exe
  2⤵
  PID:10584
- C:\Windows\System\ISEVtze.exe
  C:\Windows\System\ISEVtze.exe
  2⤵
  PID:10608
- C:\Windows\System\hbTTMLE.exe
  C:\Windows\System\hbTTMLE.exe
  2⤵
  PID:10628
- C:\Windows\System\aEZZpop.exe
  C:\Windows\System\aEZZpop.exe
  2⤵
  PID:10648
- C:\Windows\System\OXFlIvM.exe
  C:\Windows\System\OXFlIvM.exe
  2⤵
  PID:10700
- C:\Windows\System\eslQiyf.exe
  C:\Windows\System\eslQiyf.exe
  2⤵
  PID:10716
- C:\Windows\System\IYMoYxm.exe
  C:\Windows\System\IYMoYxm.exe
  2⤵
  PID:10748
- C:\Windows\System\EiNQMFR.exe
  C:\Windows\System\EiNQMFR.exe
  2⤵
  PID:10764
- C:\Windows\System\rksxgYs.exe
  C:\Windows\System\rksxgYs.exe
  2⤵
  PID:10788
- C:\Windows\System\MEckwxl.exe
  C:\Windows\System\MEckwxl.exe
  2⤵
  PID:10808
- C:\Windows\System\nnlmIre.exe
  C:\Windows\System\nnlmIre.exe
  2⤵
  PID:10828
- C:\Windows\System\LqkNOAw.exe
  C:\Windows\System\LqkNOAw.exe
  2⤵
  PID:10892
- C:\Windows\System\bQiQeFx.exe
  C:\Windows\System\bQiQeFx.exe
  2⤵
  PID:10912
- C:\Windows\System\QBbVOov.exe
  C:\Windows\System\QBbVOov.exe
  2⤵
  PID:10956
- C:\Windows\System\rmpvcCh.exe
  C:\Windows\System\rmpvcCh.exe
  2⤵
  PID:10976
- C:\Windows\System\RBipprJ.exe
  C:\Windows\System\RBipprJ.exe
  2⤵
  PID:11008
- C:\Windows\System\HESkgFp.exe
  C:\Windows\System\HESkgFp.exe
  2⤵
  PID:11036
- C:\Windows\System\bKUlhyJ.exe
  C:\Windows\System\bKUlhyJ.exe
  2⤵
  PID:11060
- C:\Windows\System\qYhNVrp.exe
  C:\Windows\System\qYhNVrp.exe
  2⤵
  PID:11080
- C:\Windows\System\UrTSeJR.exe
  C:\Windows\System\UrTSeJR.exe
  2⤵
  PID:11124
- C:\Windows\System\FnIZDxe.exe
  C:\Windows\System\FnIZDxe.exe
  2⤵
  PID:11144
- C:\Windows\System\YCuDEEy.exe
  C:\Windows\System\YCuDEEy.exe
  2⤵
  PID:11180
- C:\Windows\System\TBJkmGW.exe
  C:\Windows\System\TBJkmGW.exe
  2⤵
  PID:11200
- C:\Windows\System\xFOjUOI.exe
  C:\Windows\System\xFOjUOI.exe
  2⤵
  PID:11228
- C:\Windows\System\URUIkgo.exe
  C:\Windows\System\URUIkgo.exe
  2⤵
  PID:11244
- C:\Windows\System\mPNpQoJ.exe
  C:\Windows\System\mPNpQoJ.exe
  2⤵
  PID:8812
- C:\Windows\System\xqElQZg.exe
  C:\Windows\System\xqElQZg.exe
  2⤵
  PID:10312
- C:\Windows\System\bBdoLgv.exe
  C:\Windows\System\bBdoLgv.exe
  2⤵
  PID:10360
- C:\Windows\System\aZhuzZq.exe
  C:\Windows\System\aZhuzZq.exe
  2⤵
  PID:10412
- C:\Windows\System\GIJLKCm.exe
  C:\Windows\System\GIJLKCm.exe
  2⤵
  PID:10456
- C:\Windows\System\jfBZAYa.exe
  C:\Windows\System\jfBZAYa.exe
  2⤵
  PID:10544
- C:\Windows\System\KNJZsvb.exe
  C:\Windows\System\KNJZsvb.exe
  2⤵
  PID:10640
- C:\Windows\System\YIpzLvh.exe
  C:\Windows\System\YIpzLvh.exe
  2⤵
  PID:10680
- C:\Windows\System\pPtFoYd.exe
  C:\Windows\System\pPtFoYd.exe
  2⤵
  PID:10760
- C:\Windows\System\OJnmsyn.exe
  C:\Windows\System\OJnmsyn.exe
  2⤵
  PID:10800
- C:\Windows\System\YgtQGol.exe
  C:\Windows\System\YgtQGol.exe
  2⤵
  PID:10924
- C:\Windows\System\HdeEmfP.exe
  C:\Windows\System\HdeEmfP.exe
  2⤵
  PID:10932
- C:\Windows\System\SrGLVtT.exe
  C:\Windows\System\SrGLVtT.exe
  2⤵
  PID:11028
- C:\Windows\System\iOlRoEm.exe
  C:\Windows\System\iOlRoEm.exe
  2⤵
  PID:11088
- C:\Windows\System\ZdVGmld.exe
  C:\Windows\System\ZdVGmld.exe
  2⤵
  PID:11136
- C:\Windows\System\PcaJvph.exe
  C:\Windows\System\PcaJvph.exe
  2⤵
  PID:10196
- C:\Windows\System\FsTbwBj.exe
  C:\Windows\System\FsTbwBj.exe
  2⤵
  PID:10296
- C:\Windows\System\tCKpEqG.exe
  C:\Windows\System\tCKpEqG.exe
  2⤵
  PID:10516
- C:\Windows\System\jkYPeGZ.exe
  C:\Windows\System\jkYPeGZ.exe
  2⤵
  PID:10688
- C:\Windows\System\mKDZlxN.exe
  C:\Windows\System\mKDZlxN.exe
  2⤵
  PID:10728
- C:\Windows\System\LCozfjY.exe
  C:\Windows\System\LCozfjY.exe
  2⤵
  PID:10904
- C:\Windows\System\myZyHor.exe
  C:\Windows\System\myZyHor.exe
  2⤵
  PID:11152
- C:\Windows\System\wlwLbfy.exe
  C:\Windows\System\wlwLbfy.exe
  2⤵
  PID:11220
- C:\Windows\System\zjlfwTp.exe
  C:\Windows\System\zjlfwTp.exe
  2⤵
  PID:10576
- C:\Windows\System\XqpVRXj.exe
  C:\Windows\System\XqpVRXj.exe
  2⤵
  PID:10964
- C:\Windows\System\AwZWvJM.exe
  C:\Windows\System\AwZWvJM.exe
  2⤵
  PID:11176
- C:\Windows\System\MLvIcPR.exe
  C:\Windows\System\MLvIcPR.exe
  2⤵
  PID:10452
- C:\Windows\System\tsSQJGX.exe
  C:\Windows\System\tsSQJGX.exe
  2⤵
  PID:11284
- C:\Windows\System\FppdKIV.exe
  C:\Windows\System\FppdKIV.exe
  2⤵
  PID:11304
- C:\Windows\System\kjLAsGg.exe
  C:\Windows\System\kjLAsGg.exe
  2⤵
  PID:11352
- C:\Windows\System\fEGtykI.exe
  C:\Windows\System\fEGtykI.exe
  2⤵
  PID:11372
- C:\Windows\System\sNGjJkl.exe
  C:\Windows\System\sNGjJkl.exe
  2⤵
  PID:11412
- C:\Windows\System\KHHaRGD.exe
  C:\Windows\System\KHHaRGD.exe
  2⤵
  PID:11436
- C:\Windows\System\XEMUiFk.exe
  C:\Windows\System\XEMUiFk.exe
  2⤵
  PID:11460
- C:\Windows\System\AUCsywT.exe
  C:\Windows\System\AUCsywT.exe
  2⤵
  PID:11488
- C:\Windows\System\Wkychfn.exe
  C:\Windows\System\Wkychfn.exe
  2⤵
  PID:11504
- C:\Windows\System\SAjzDxU.exe
  C:\Windows\System\SAjzDxU.exe
  2⤵
  PID:11528
- C:\Windows\System\wlYuTGq.exe
  C:\Windows\System\wlYuTGq.exe
  2⤵
  PID:11544
- C:\Windows\System\KrsxynN.exe
  C:\Windows\System\KrsxynN.exe
  2⤵
  PID:11596
- C:\Windows\System\oLloudt.exe
  C:\Windows\System\oLloudt.exe
  2⤵
  PID:11664
- C:\Windows\System\vwdRUbO.exe
  C:\Windows\System\vwdRUbO.exe
  2⤵
  PID:11684
- C:\Windows\System\gRlYgDJ.exe
  C:\Windows\System\gRlYgDJ.exe
  2⤵
  PID:11704
- C:\Windows\System\tWtGJpe.exe
  C:\Windows\System\tWtGJpe.exe
  2⤵
  PID:11732
- C:\Windows\System\nCPIOuH.exe
  C:\Windows\System\nCPIOuH.exe
  2⤵
  PID:11748
- C:\Windows\System\iQkEkwZ.exe
  C:\Windows\System\iQkEkwZ.exe
  2⤵
  PID:11776
- C:\Windows\System\aSOajFT.exe
  C:\Windows\System\aSOajFT.exe
  2⤵
  PID:11804
- C:\Windows\System\ytzxYlJ.exe
  C:\Windows\System\ytzxYlJ.exe
  2⤵
  PID:11828
- C:\Windows\System\nLdgPxH.exe
  C:\Windows\System\nLdgPxH.exe
  2⤵
  PID:11852
- C:\Windows\System\KUeOhzX.exe
  C:\Windows\System\KUeOhzX.exe
  2⤵
  PID:11872
- C:\Windows\System\fiZBvRl.exe
  C:\Windows\System\fiZBvRl.exe
  2⤵
  PID:11888
- C:\Windows\System\eoAySuU.exe
  C:\Windows\System\eoAySuU.exe
  2⤵
  PID:11924
- C:\Windows\System\dtyUstn.exe
  C:\Windows\System\dtyUstn.exe
  2⤵
  PID:11952
- C:\Windows\System\IzWNWlV.exe
  C:\Windows\System\IzWNWlV.exe
  2⤵
  PID:11972
- C:\Windows\System\kDoHkdh.exe
  C:\Windows\System\kDoHkdh.exe
  2⤵
  PID:12008
- C:\Windows\System\CugvurO.exe
  C:\Windows\System\CugvurO.exe
  2⤵
  PID:12028
- C:\Windows\System\FjPvXXc.exe
  C:\Windows\System\FjPvXXc.exe
  2⤵
  PID:12048
- C:\Windows\System\WYacxkb.exe
  C:\Windows\System\WYacxkb.exe
  2⤵
  PID:12092
- C:\Windows\System\BgBLBGM.exe
  C:\Windows\System\BgBLBGM.exe
  2⤵
  PID:12112
- C:\Windows\System\JcIRGjL.exe
  C:\Windows\System\JcIRGjL.exe
  2⤵
  PID:12184
- C:\Windows\System\ZmGZokv.exe
  C:\Windows\System\ZmGZokv.exe
  2⤵
  PID:12220
- C:\Windows\System\PGYbFJs.exe
  C:\Windows\System\PGYbFJs.exe
  2⤵
  PID:12240
- C:\Windows\System\HxeMwaE.exe
  C:\Windows\System\HxeMwaE.exe
  2⤵
  PID:12260
- C:\Windows\System\nRuTJXH.exe
  C:\Windows\System\nRuTJXH.exe
  2⤵
  PID:12280
- C:\Windows\System\GgYktMB.exe
  C:\Windows\System\GgYktMB.exe
  2⤵
  PID:10244
- C:\Windows\System\MhgGtkx.exe
  C:\Windows\System\MhgGtkx.exe
  2⤵
  PID:11404
- C:\Windows\System\zpUhWuv.exe
  C:\Windows\System\zpUhWuv.exe
  2⤵
  PID:11452
- C:\Windows\System\CHeJDwG.exe
  C:\Windows\System\CHeJDwG.exe
  2⤵
  PID:11500
- C:\Windows\System\lBChVyz.exe
  C:\Windows\System\lBChVyz.exe
  2⤵
  PID:11512
- C:\Windows\System\PtnaohU.exe
  C:\Windows\System\PtnaohU.exe
  2⤵
  PID:11564
- C:\Windows\System\twHDuaB.exe
  C:\Windows\System\twHDuaB.exe
  2⤵
  PID:11636
- C:\Windows\System\UWiaoNP.exe
  C:\Windows\System\UWiaoNP.exe
  2⤵
  PID:11700
- C:\Windows\System\IgasxVj.exe
  C:\Windows\System\IgasxVj.exe
  2⤵
  PID:11800
- C:\Windows\System\HWeOCVD.exe
  C:\Windows\System\HWeOCVD.exe
  2⤵
  PID:11784
- C:\Windows\System\qXFfaQB.exe
  C:\Windows\System\qXFfaQB.exe
  2⤵
  PID:11884
- C:\Windows\System\jKAdXNW.exe
  C:\Windows\System\jKAdXNW.exe
  2⤵
  PID:11940
- C:\Windows\System\RbAUtPH.exe
  C:\Windows\System\RbAUtPH.exe
  2⤵
  PID:12000
- C:\Windows\System\CJOivHD.exe
  C:\Windows\System\CJOivHD.exe
  2⤵
  PID:12044
- C:\Windows\System\iSLNSqW.exe
  C:\Windows\System\iSLNSqW.exe
  2⤵
  PID:12084
- C:\Windows\System\yuCOOxU.exe
  C:\Windows\System\yuCOOxU.exe
  2⤵
  PID:12140
- C:\Windows\System\TZqwkOr.exe
  C:\Windows\System\TZqwkOr.exe
  2⤵
  PID:12180
- C:\Windows\System\EHYlSIJ.exe
  C:\Windows\System\EHYlSIJ.exe
  2⤵
  PID:12236
- C:\Windows\System\dHkrvTN.exe
  C:\Windows\System\dHkrvTN.exe
  2⤵
  PID:12272
- C:\Windows\System\NndBNGI.exe
  C:\Windows\System\NndBNGI.exe
  2⤵
  PID:11368
- C:\Windows\System\DSVQeoK.exe
  C:\Windows\System\DSVQeoK.exe
  2⤵
  PID:11540
- C:\Windows\System\MvLrdqX.exe
  C:\Windows\System\MvLrdqX.exe
  2⤵
  PID:11836
- C:\Windows\System\DVjSYXe.exe
  C:\Windows\System\DVjSYXe.exe
  2⤵
  PID:11904
- C:\Windows\System\GSWNapw.exe
  C:\Windows\System\GSWNapw.exe
  2⤵
  PID:12108
- C:\Windows\System\TDksHDp.exe
  C:\Windows\System\TDksHDp.exe
  2⤵
  PID:11448
- C:\Windows\System\RNDKkGH.exe
  C:\Windows\System\RNDKkGH.exe
  2⤵
  PID:11584
- C:\Windows\System\AHMAZSg.exe
  C:\Windows\System\AHMAZSg.exe
  2⤵
  PID:11996
- C:\Windows\System\mjqDNta.exe
  C:\Windows\System\mjqDNta.exe
  2⤵
  PID:3668
- C:\Windows\System\mrEBxuB.exe
  C:\Windows\System\mrEBxuB.exe
  2⤵
  PID:11104
- C:\Windows\System\fveIXQC.exe
  C:\Windows\System\fveIXQC.exe
  2⤵
  PID:12292
- C:\Windows\System\qcpupwn.exe
  C:\Windows\System\qcpupwn.exe
  2⤵
  PID:12316
- C:\Windows\System\pOBLLUq.exe
  C:\Windows\System\pOBLLUq.exe
  2⤵
  PID:12356
- C:\Windows\System\ucdHrAS.exe
  C:\Windows\System\ucdHrAS.exe
  2⤵
  PID:12388
- C:\Windows\System\wNYfTyG.exe
  C:\Windows\System\wNYfTyG.exe
  2⤵
  PID:12428
- C:\Windows\System\RtymQIm.exe
  C:\Windows\System\RtymQIm.exe
  2⤵
  PID:12456
- C:\Windows\System\umoOdSz.exe
  C:\Windows\System\umoOdSz.exe
  2⤵
  PID:12480
- C:\Windows\System\MiCxkea.exe
  C:\Windows\System\MiCxkea.exe
  2⤵
  PID:12504
- C:\Windows\System\hEduPFK.exe
  C:\Windows\System\hEduPFK.exe
  2⤵
  PID:12536
- C:\Windows\System\uyYHadx.exe
  C:\Windows\System\uyYHadx.exe
  2⤵
  PID:12556
- C:\Windows\System\moNHcay.exe
  C:\Windows\System\moNHcay.exe
  2⤵
  PID:12588
- C:\Windows\System\qcPzzml.exe
  C:\Windows\System\qcPzzml.exe
  2⤵
  PID:12608
- C:\Windows\System\LMqoWay.exe
  C:\Windows\System\LMqoWay.exe
  2⤵
  PID:12636
- C:\Windows\System\xQjdRJI.exe
  C:\Windows\System\xQjdRJI.exe
  2⤵
  PID:12656
- C:\Windows\System\fPSuclG.exe
  C:\Windows\System\fPSuclG.exe
  2⤵
  PID:12680
- C:\Windows\System\qRscovI.exe
  C:\Windows\System\qRscovI.exe
  2⤵
  PID:12696
- C:\Windows\System\BIiteRQ.exe
  C:\Windows\System\BIiteRQ.exe
  2⤵
  PID:12736
- C:\Windows\System\YnxbsNd.exe
  C:\Windows\System\YnxbsNd.exe
  2⤵
  PID:12756
- C:\Windows\System\mopnEQD.exe
  C:\Windows\System\mopnEQD.exe
  2⤵
  PID:12856
- C:\Windows\System\sYQXZat.exe
  C:\Windows\System\sYQXZat.exe
  2⤵
  PID:12872
- C:\Windows\System\aiuvAWZ.exe
  C:\Windows\System\aiuvAWZ.exe
  2⤵
  PID:12896
- C:\Windows\System\GVgqvBW.exe
  C:\Windows\System\GVgqvBW.exe
  2⤵
  PID:12916
- C:\Windows\System\CMiHssd.exe
  C:\Windows\System\CMiHssd.exe
  2⤵
  PID:12936
- C:\Windows\System\lTVpdHe.exe
  C:\Windows\System\lTVpdHe.exe
  2⤵
  PID:12964
- C:\Windows\System\OYoNSJt.exe
  C:\Windows\System\OYoNSJt.exe
  2⤵
  PID:13004
- C:\Windows\System\ZyWHjlk.exe
  C:\Windows\System\ZyWHjlk.exe
  2⤵
  PID:13028
- C:\Windows\System\aMeiAWU.exe
  C:\Windows\System\aMeiAWU.exe
  2⤵
  PID:13052
- C:\Windows\System\jsyKwya.exe
  C:\Windows\System\jsyKwya.exe
  2⤵
  PID:13080
- C:\Windows\System\DghLXeg.exe
  C:\Windows\System\DghLXeg.exe
  2⤵
  PID:13100
- C:\Windows\System\avPOZsc.exe
  C:\Windows\System\avPOZsc.exe
  2⤵
  PID:13124
- C:\Windows\System\jKiQoVA.exe
  C:\Windows\System\jKiQoVA.exe
  2⤵
  PID:13144
- C:\Windows\System\cOsTDhp.exe
  C:\Windows\System\cOsTDhp.exe
  2⤵
  PID:13188
- C:\Windows\System\kyvJzBw.exe
  C:\Windows\System\kyvJzBw.exe
  2⤵
  PID:13216
- C:\Windows\System\zgxQbaN.exe
  C:\Windows\System\zgxQbaN.exe
  2⤵
  PID:13236
- C:\Windows\System\kWKjTiI.exe
  C:\Windows\System\kWKjTiI.exe
  2⤵
  PID:13292
- C:\Windows\System\kNFAwsy.exe
  C:\Windows\System\kNFAwsy.exe
  2⤵
  PID:11820
- C:\Windows\System\vmcyTwH.exe
  C:\Windows\System\vmcyTwH.exe
  2⤵
  PID:12312
- C:\Windows\System\NMzSxlE.exe
  C:\Windows\System\NMzSxlE.exe
  2⤵
  PID:12380
- C:\Windows\System\qzRlOYc.exe
  C:\Windows\System\qzRlOYc.exe
  2⤵
  PID:12452
- C:\Windows\System\MSiFCqe.exe
  C:\Windows\System\MSiFCqe.exe
  2⤵
  PID:13256
- C:\Windows\System\ccVfjcz.exe
  C:\Windows\System\ccVfjcz.exe
  2⤵
  PID:13284
- C:\Windows\System\eZyslFP.exe
  C:\Windows\System\eZyslFP.exe
  2⤵
  PID:12300
- C:\Windows\System\QYDTFcJ.exe
  C:\Windows\System\QYDTFcJ.exe
  2⤵
  PID:11344
- C:\Windows\System\uFuDpFt.exe
  C:\Windows\System\uFuDpFt.exe
  2⤵
  PID:5080
- C:\Windows\System\pnOUbQd.exe
  C:\Windows\System\pnOUbQd.exe
  2⤵
  PID:3420
- C:\Windows\System\TSsJdHZ.exe
  C:\Windows\System\TSsJdHZ.exe
  2⤵
  PID:12572
- C:\Windows\System\ogwcazR.exe
  C:\Windows\System\ogwcazR.exe
  2⤵
  PID:12624
- C:\Windows\System\sFrnXJH.exe
  C:\Windows\System\sFrnXJH.exe
  2⤵
  PID:12676
- C:\Windows\System\aqievcL.exe
  C:\Windows\System\aqievcL.exe
  2⤵
  PID:1388
- C:\Windows\System\kRfAhjM.exe
  C:\Windows\System\kRfAhjM.exe
  2⤵
  PID:12712
- C:\Windows\System\NekjvfH.exe
  C:\Windows\System\NekjvfH.exe
  2⤵
  PID:12784
- C:\Windows\System\XgEtHFf.exe
  C:\Windows\System\XgEtHFf.exe
  2⤵
  PID:4192
- C:\Windows\System\nYqFFhm.exe
  C:\Windows\System\nYqFFhm.exe
  2⤵
  PID:2376
- C:\Windows\System\EIxSPiE.exe
  C:\Windows\System\EIxSPiE.exe
  2⤵
  PID:13096
- C:\Windows\System\FQiiKGj.exe
  C:\Windows\System\FQiiKGj.exe
  2⤵
  PID:1472
- C:\Windows\System\TnzEiVB.exe
  C:\Windows\System\TnzEiVB.exe
  2⤵
  PID:2684
- C:\Windows\System\odxjSDy.exe
  C:\Windows\System\odxjSDy.exe
  2⤵
  PID:12852
- C:\Windows\System\bzNytgD.exe
  C:\Windows\System\bzNytgD.exe
  2⤵
  PID:12932
- C:\Windows\System\uOYCwKM.exe
  C:\Windows\System\uOYCwKM.exe
  2⤵
  PID:12976
- C:\Windows\System\NRlHdeQ.exe
  C:\Windows\System\NRlHdeQ.exe
  2⤵
  PID:13048
- C:\Windows\System\flmniRW.exe
  C:\Windows\System\flmniRW.exe
  2⤵
  PID:1808
- C:\Windows\System\EKSZKpQ.exe
  C:\Windows\System\EKSZKpQ.exe
  2⤵
  PID:1352
- C:\Windows\System\HgKuuxm.exe
  C:\Windows\System\HgKuuxm.exe
  2⤵
  PID:1304
- C:\Windows\System\PaNDGOp.exe
  C:\Windows\System\PaNDGOp.exe
  2⤵
  PID:5648
- C:\Windows\System\YXHKjtQ.exe
  C:\Windows\System\YXHKjtQ.exe
  2⤵
  PID:4428
- C:\Windows\System\abReFTA.exe
  C:\Windows\System\abReFTA.exe
  2⤵
  PID:4956
- C:\Windows\System\TzgqOOE.exe
  C:\Windows\System\TzgqOOE.exe
  2⤵
  PID:13212
- C:\Windows\System\grRGzfS.exe
  C:\Windows\System\grRGzfS.exe
  2⤵
  PID:13116
- C:\Windows\System\lJTXXfv.exe
  C:\Windows\System\lJTXXfv.exe
  2⤵
  PID:3220
- C:\Windows\System\NhDoACd.exe
  C:\Windows\System\NhDoACd.exe
  2⤵
  PID:2084
- C:\Windows\System\YYEuPtv.exe
  C:\Windows\System\YYEuPtv.exe
  2⤵
  PID:12548
- C:\Windows\System\vixBOpX.exe
  C:\Windows\System\vixBOpX.exe
  2⤵
  PID:12268
- C:\Windows\System\CbfxDLf.exe
  C:\Windows\System\CbfxDLf.exe
  2⤵
  PID:13164
- C:\Windows\System\WRMbzPs.exe
  C:\Windows\System\WRMbzPs.exe
  2⤵
  PID:2272
- C:\Windows\System\foxyIrY.exe
  C:\Windows\System\foxyIrY.exe
  2⤵
  PID:1396
- C:\Windows\System\wImxvOW.exe
  C:\Windows\System\wImxvOW.exe
  2⤵
  PID:13168
- C:\Windows\System\OoSbMrR.exe
  C:\Windows\System\OoSbMrR.exe
  2⤵
  PID:7020
- C:\Windows\System\tJyszcn.exe
  C:\Windows\System\tJyszcn.exe
  2⤵
  PID:532
- C:\Windows\System\AyCgOYP.exe
  C:\Windows\System\AyCgOYP.exe
  2⤵
  PID:448
- C:\Windows\System\itFtEbY.exe
  C:\Windows\System\itFtEbY.exe
  2⤵
  PID:4804
- C:\Windows\System\DUDvhgq.exe
  C:\Windows\System\DUDvhgq.exe
  2⤵
  PID:3576
- C:\Windows\System\NpEqkyz.exe
  C:\Windows\System\NpEqkyz.exe
  2⤵
  PID:6976
- C:\Windows\System\Xyhiwtb.exe
  C:\Windows\System\Xyhiwtb.exe
  2⤵
  PID:7068
- C:\Windows\System\BBBnKMG.exe
  C:\Windows\System\BBBnKMG.exe
  2⤵
  PID:6912
- C:\Windows\System\dXZOMrs.exe
  C:\Windows\System\dXZOMrs.exe
  2⤵
  PID:12600
- C:\Windows\System\NqoQLtV.exe
  C:\Windows\System\NqoQLtV.exe
  2⤵
  PID:6240
- C:\Windows\System\lYiwFBD.exe
  C:\Windows\System\lYiwFBD.exe
  2⤵
  PID:3916
- C:\Windows\System\EJsjlym.exe
  C:\Windows\System\EJsjlym.exe
  2⤵
  PID:1092
- C:\Windows\System\oDDQLsI.exe
  C:\Windows\System\oDDQLsI.exe
  2⤵
  PID:1624
- C:\Windows\System\gERyvjX.exe
  C:\Windows\System\gERyvjX.exe
  2⤵
  PID:3064
- C:\Windows\System\IPynhrK.exe
  C:\Windows\System\IPynhrK.exe
  2⤵
  PID:6168
- C:\Windows\System\JyGhVYE.exe
  C:\Windows\System\JyGhVYE.exe
  2⤵
  PID:4904
- C:\Windows\System\uYowgZu.exe
  C:\Windows\System\uYowgZu.exe
  2⤵
  PID:4632
- C:\Windows\System\sYWTZyb.exe
  C:\Windows\System\sYWTZyb.exe
  2⤵
  PID:7228
- C:\Windows\System\ukkFMjE.exe
  C:\Windows\System\ukkFMjE.exe
  2⤵
  PID:2500
- C:\Windows\System\HUVfYQK.exe
  C:\Windows\System\HUVfYQK.exe
  2⤵
  PID:3080
- C:\Windows\System\oevkaIl.exe
  C:\Windows\System\oevkaIl.exe
  2⤵
  PID:7908
- C:\Windows\System\Wiozyub.exe
  C:\Windows\System\Wiozyub.exe
  2⤵
  PID:2400
- C:\Windows\System\vuHaqQw.exe
  C:\Windows\System\vuHaqQw.exe
  2⤵
  PID:8148
- C:\Windows\System\xHmfIaE.exe
  C:\Windows\System\xHmfIaE.exe
  2⤵
  PID:3520
- C:\Windows\System\vTrmafx.exe
  C:\Windows\System\vTrmafx.exe
  2⤵
  PID:6720
- C:\Windows\System\HGPXwyq.exe
  C:\Windows\System\HGPXwyq.exe
  2⤵
  PID:7580
- C:\Windows\System\NFRoIsr.exe
  C:\Windows\System\NFRoIsr.exe
  2⤵
  PID:7748
- C:\Windows\System\jbRAiMd.exe
  C:\Windows\System\jbRAiMd.exe
  2⤵
  PID:8072
- C:\Windows\System\pFUKEqJ.exe
  C:\Windows\System\pFUKEqJ.exe
  2⤵
  PID:7488
- C:\Windows\System\OKsUdSL.exe
  C:\Windows\System\OKsUdSL.exe
  2⤵
  PID:7460
- C:\Windows\System\VUrdKJn.exe
  C:\Windows\System\VUrdKJn.exe
  2⤵
  PID:1872
- C:\Windows\System\aMWHNbb.exe
  C:\Windows\System\aMWHNbb.exe
  2⤵
  PID:4596
- C:\Windows\System\kXiYfwb.exe
  C:\Windows\System\kXiYfwb.exe
  2⤵
  PID:4656
- C:\Windows\System\knTrCcT.exe
  C:\Windows\System\knTrCcT.exe
  2⤵
  PID:8552
- C:\Windows\System\lSEOaYk.exe
  C:\Windows\System\lSEOaYk.exe
  2⤵
  PID:6796
- C:\Windows\System\qfJMUZh.exe
  C:\Windows\System\qfJMUZh.exe
  2⤵
  PID:1308
- C:\Windows\System\TTZhQkK.exe
  C:\Windows\System\TTZhQkK.exe
  2⤵
  PID:1248
- C:\Windows\System\xfKAYLm.exe
  C:\Windows\System\xfKAYLm.exe
  2⤵
  PID:388
- C:\Windows\System\ltEWmGq.exe
  C:\Windows\System\ltEWmGq.exe
  2⤵
  PID:3572
- C:\Windows\System\bIiyIQq.exe
  C:\Windows\System\bIiyIQq.exe
  2⤵
  PID:7320
- C:\Windows\System\jXtiGFP.exe
  C:\Windows\System\jXtiGFP.exe
  2⤵
  PID:3172
- C:\Windows\System\umGQfCv.exe
  C:\Windows\System\umGQfCv.exe
  2⤵
  PID:7636
- C:\Windows\System\YmfIpZB.exe
  C:\Windows\System\YmfIpZB.exe
  2⤵
  PID:4452
- C:\Windows\System\vvBBGYC.exe
  C:\Windows\System\vvBBGYC.exe
  2⤵
  PID:8424
- C:\Windows\System\gtMhwtz.exe
  C:\Windows\System\gtMhwtz.exe
  2⤵
  PID:5180
- C:\Windows\System\zGfUCRe.exe
  C:\Windows\System\zGfUCRe.exe
  2⤵
  PID:4960
- C:\Windows\System\MEYglho.exe
  C:\Windows\System\MEYglho.exe
  2⤵
  PID:3892
- C:\Windows\System\qpciPHE.exe
  C:\Windows\System\qpciPHE.exe
  2⤵
  PID:452
- C:\Windows\System\OxfURXl.exe
  C:\Windows\System\OxfURXl.exe
  2⤵
  PID:4072
- C:\Windows\System\NzhJrJE.exe
  C:\Windows\System\NzhJrJE.exe
  2⤵
  PID:6020
- C:\Windows\System\nygsByj.exe
  C:\Windows\System\nygsByj.exe
  2⤵
  PID:7360
- C:\Windows\System\ClnoNrO.exe
  C:\Windows\System\ClnoNrO.exe
  2⤵
  PID:6076
- C:\Windows\System\XAmoRpJ.exe
  C:\Windows\System\XAmoRpJ.exe
  2⤵
  PID:2004
- C:\Windows\System\xIAIaMe.exe
  C:\Windows\System\xIAIaMe.exe
  2⤵
  PID:10132
- C:\Windows\System\wgVyILK.exe
  C:\Windows\System\wgVyILK.exe
  2⤵
  PID:2892
- C:\Windows\System\crAibAK.exe
  C:\Windows\System\crAibAK.exe
  2⤵
  PID:5696
- C:\Windows\System\zTRFewg.exe
  C:\Windows\System\zTRFewg.exe
  2⤵
  PID:8212
- C:\Windows\System\FpYDOYU.exe
  C:\Windows\System\FpYDOYU.exe
  2⤵
  PID:7932
- C:\Windows\System\kELevjL.exe
  C:\Windows\System\kELevjL.exe
  2⤵
  PID:10324
- C:\Windows\System\swfdzwa.exe
  C:\Windows\System\swfdzwa.exe
  2⤵
  PID:4508
- C:\Windows\System\dbWZLUX.exe
  C:\Windows\System\dbWZLUX.exe
  2⤵
  PID:2616
- C:\Windows\System\HMhzJsZ.exe
  C:\Windows\System\HMhzJsZ.exe
  2⤵
  PID:4592
- C:\Windows\System\FQvmdLL.exe
  C:\Windows\System\FQvmdLL.exe
  2⤵
  PID:8884
- C:\Windows\System\txnGnQc.exe
  C:\Windows\System\txnGnQc.exe
  2⤵
  PID:5292
- C:\Windows\System\HdNXFFi.exe
  C:\Windows\System\HdNXFFi.exe
  2⤵
  PID:1228
- C:\Windows\System\fZeQNeX.exe
  C:\Windows\System\fZeQNeX.exe
  2⤵
  PID:6008
- C:\Windows\System\ZAoYbWY.exe
  C:\Windows\System\ZAoYbWY.exe
  2⤵
  PID:9552
- C:\Windows\System\ZKDXcDM.exe
  C:\Windows\System\ZKDXcDM.exe
  2⤵
  PID:5532
- C:\Windows\System\OqKTSxN.exe
  C:\Windows\System\OqKTSxN.exe
  2⤵
  PID:3964
- C:\Windows\System\EsAIcff.exe
  C:\Windows\System\EsAIcff.exe
  2⤵
  PID:5576
- C:\Windows\System\SwiscSj.exe
  C:\Windows\System\SwiscSj.exe
  2⤵
  PID:5752
- C:\Windows\System\NAxywiP.exe
  C:\Windows\System\NAxywiP.exe
  2⤵
  PID:2020
- C:\Windows\System\lMQKhPq.exe
  C:\Windows\System\lMQKhPq.exe
  2⤵
  PID:5944
- C:\Windows\System\gefRQBD.exe
  C:\Windows\System\gefRQBD.exe
  2⤵
  PID:8968
- C:\Windows\System\HPoQTEV.exe
  C:\Windows\System\HPoQTEV.exe
  2⤵
  PID:5768
- C:\Windows\System\yQDZdFG.exe
  C:\Windows\System\yQDZdFG.exe
  2⤵
  PID:4052
- C:\Windows\System\DcAgEYJ.exe
  C:\Windows\System\DcAgEYJ.exe
  2⤵
  PID:8716
- C:\Windows\System\VdANOlo.exe
  C:\Windows\System\VdANOlo.exe
  2⤵
  PID:8044
- C:\Windows\System\vFRBPVe.exe
  C:\Windows\System\vFRBPVe.exe
  2⤵
  PID:5208
- C:\Windows\System\rKKwAfx.exe
  C:\Windows\System\rKKwAfx.exe
  2⤵
  PID:3324
- C:\Windows\System\mqldrDl.exe
  C:\Windows\System\mqldrDl.exe
  2⤵
  PID:9252
- C:\Windows\System\WmGQQwR.exe
  C:\Windows\System\WmGQQwR.exe
  2⤵
  PID:2868
- C:\Windows\System\itQhNVK.exe
  C:\Windows\System\itQhNVK.exe
  2⤵
  PID:3544
- C:\Windows\System\CZUCXeL.exe
  C:\Windows\System\CZUCXeL.exe
  2⤵
  PID:5364
- C:\Windows\System\ZFcCcJv.exe
  C:\Windows\System\ZFcCcJv.exe
  2⤵
  PID:5376
- C:\Windows\System\TfoJMbX.exe
  C:\Windows\System\TfoJMbX.exe
  2⤵
  PID:4340
- C:\Windows\System\lDjBVpw.exe
  C:\Windows\System\lDjBVpw.exe
  2⤵
  PID:7324
- C:\Windows\System\XlimPcT.exe
  C:\Windows\System\XlimPcT.exe
  2⤵
  PID:9180
- C:\Windows\System\QhvSCtS.exe
  C:\Windows\System\QhvSCtS.exe
  2⤵
  PID:7532
- C:\Windows\System\ZbnyuNp.exe
  C:\Windows\System\ZbnyuNp.exe
  2⤵
  PID:9576
- C:\Windows\System\CGkacYY.exe
  C:\Windows\System\CGkacYY.exe
  2⤵
  PID:3148
- C:\Windows\System\eNnILgz.exe
  C:\Windows\System\eNnILgz.exe
  2⤵
  PID:1432
- C:\Windows\System\fdcPzTj.exe
  C:\Windows\System\fdcPzTj.exe
  2⤵
  PID:4244
- C:\Windows\System\XccBErd.exe
  C:\Windows\System\XccBErd.exe
  2⤵
  PID:5948
- C:\Windows\System\NEwIkcI.exe
  C:\Windows\System\NEwIkcI.exe
  2⤵
  PID:6224
- C:\Windows\System\rgJjZHA.exe
  C:\Windows\System\rgJjZHA.exe
  2⤵
  PID:6136
- C:\Windows\System\jQhytTi.exe
  C:\Windows\System\jQhytTi.exe
  2⤵
  PID:3648
- C:\Windows\System\zMWtBYI.exe
  C:\Windows\System\zMWtBYI.exe
  2⤵
  PID:7328
- C:\Windows\System\IpDbaCO.exe
  C:\Windows\System\IpDbaCO.exe
  2⤵
  PID:6572
- C:\Windows\System\NuEyLBM.exe
  C:\Windows\System\NuEyLBM.exe
  2⤵
  PID:4016
- C:\Windows\System\SQzbHuv.exe
  C:\Windows\System\SQzbHuv.exe
  2⤵
  PID:6600
- C:\Windows\System\NRbYPNB.exe
  C:\Windows\System\NRbYPNB.exe
  2⤵
  PID:5700
- C:\Windows\System\mRgELiE.exe
  C:\Windows\System\mRgELiE.exe
  2⤵
  PID:6908
- C:\Windows\System\zrCuPRL.exe
  C:\Windows\System\zrCuPRL.exe
  2⤵
  PID:2016
- C:\Windows\System\tZXLUCH.exe
  C:\Windows\System\tZXLUCH.exe
  2⤵
  PID:4812
- C:\Windows\System\DtKTROo.exe
  C:\Windows\System\DtKTROo.exe
  2⤵
  PID:5756
- C:\Windows\System\PcOUbHM.exe
  C:\Windows\System\PcOUbHM.exe
  2⤵
  PID:6052
- C:\Windows\System\UAaWGBv.exe
  C:\Windows\System\UAaWGBv.exe
  2⤵
  PID:6288
- C:\Windows\System\SEnIvZW.exe
  C:\Windows\System\SEnIvZW.exe
  2⤵
  PID:12416
- C:\Windows\System\GgNVuzg.exe
  C:\Windows\System\GgNVuzg.exe
  2⤵
  PID:12444
- C:\Windows\System\nTdqzkz.exe
  C:\Windows\System\nTdqzkz.exe
  2⤵
  PID:2752
- C:\Windows\System\GcYoNcJ.exe
  C:\Windows\System\GcYoNcJ.exe
  2⤵
  PID:5152
- C:\Windows\System\VwXeHjQ.exe
  C:\Windows\System\VwXeHjQ.exe
  2⤵
  PID:12544
- C:\Windows\System\awppQjZ.exe
  C:\Windows\System\awppQjZ.exe
  2⤵
  PID:4644
- C:\Windows\System\QULXkhM.exe
  C:\Windows\System\QULXkhM.exe
  2⤵
  PID:5408
- C:\Windows\System\QcGlnNj.exe
  C:\Windows\System\QcGlnNj.exe
  2⤵
  PID:6376
- C:\Windows\System\MnpAsXe.exe
  C:\Windows\System\MnpAsXe.exe
  2⤵
  PID:10340
- C:\Windows\System\nTKYvZU.exe
  C:\Windows\System\nTKYvZU.exe
  2⤵
  PID:5908
- C:\Windows\System\jXTAizl.exe
  C:\Windows\System\jXTAizl.exe
  2⤵
  PID:12704
- C:\Windows\System\uQFvkaF.exe
  C:\Windows\System\uQFvkaF.exe
  2⤵
  PID:10624
- C:\Windows\System\xKdvoAg.exe
  C:\Windows\System\xKdvoAg.exe
  2⤵
  PID:10668
- C:\Windows\System\ChaPSRP.exe
  C:\Windows\System\ChaPSRP.exe
  2⤵
  PID:5892
- C:\Windows\System\jLJwTbe.exe
  C:\Windows\System\jLJwTbe.exe
  2⤵
  PID:5448
- C:\Windows\System\pWxKyya.exe
  C:\Windows\System\pWxKyya.exe
  2⤵
  PID:11676
- C:\Windows\System\eOibONo.exe
  C:\Windows\System\eOibONo.exe
  2⤵
  PID:10448
- C:\Windows\System\RCcLnBu.exe
  C:\Windows\System\RCcLnBu.exe
  2⤵
  PID:9040
- C:\Windows\System\aVOjQgc.exe
  C:\Windows\System\aVOjQgc.exe
  2⤵
  PID:6848
- C:\Windows\System\XoXpbeY.exe
  C:\Windows\System\XoXpbeY.exe
  2⤵
  PID:10860
- C:\Windows\System\UDkKRTH.exe
  C:\Windows\System\UDkKRTH.exe
  2⤵
  PID:12884
- C:\Windows\System\mPgNvAj.exe
  C:\Windows\System\mPgNvAj.exe
  2⤵
  PID:6596
- C:\Windows\System\gAeGevS.exe
  C:\Windows\System\gAeGevS.exe
  2⤵
  PID:5516
- C:\Windows\System\aGVKCcn.exe
  C:\Windows\System\aGVKCcn.exe
  2⤵
  PID:5504
- C:\Windows\System\OVWAkQz.exe
  C:\Windows\System\OVWAkQz.exe
  2⤵
  PID:7100
- C:\Windows\System\sKoYIMg.exe
  C:\Windows\System\sKoYIMg.exe
  2⤵
  PID:5544
- C:\Windows\System\gVhnwsY.exe
  C:\Windows\System\gVhnwsY.exe
  2⤵
  PID:11072
- C:\Windows\System\Dnmrbdb.exe
  C:\Windows\System\Dnmrbdb.exe
  2⤵
  PID:4252
- C:\Windows\System\ulFvnDj.exe
  C:\Windows\System\ulFvnDj.exe
  2⤵
  PID:5828
- C:\Windows\System\VCkeTJh.exe
  C:\Windows\System\VCkeTJh.exe
  2⤵
  PID:6264
- C:\Windows\System\IaGwCPs.exe
  C:\Windows\System\IaGwCPs.exe
  2⤵
  PID:5796
- C:\Windows\System\oPmDFev.exe
  C:\Windows\System\oPmDFev.exe
  2⤵
  PID:2392
- C:\Windows\System\ReAlkAY.exe
  C:\Windows\System\ReAlkAY.exe
  2⤵
  PID:8332
- C:\Windows\System\ZMiStWK.exe
  C:\Windows\System\ZMiStWK.exe
  2⤵
  PID:5156
- C:\Windows\System\ekZNCOl.exe
  C:\Windows\System\ekZNCOl.exe
  2⤵
  PID:1332
- C:\Windows\System\JoPByih.exe
  C:\Windows\System\JoPByih.exe
  2⤵
  PID:5280
- C:\Windows\System\HPmBHfr.exe
  C:\Windows\System\HPmBHfr.exe
  2⤵
  PID:5276
- C:\Windows\System\mJBUGxh.exe
  C:\Windows\System\mJBUGxh.exe
  2⤵
  PID:7064
- C:\Windows\System\WbGtHaM.exe
  C:\Windows\System\WbGtHaM.exe
  2⤵
  PID:5336
- C:\Windows\System\yqisZDK.exe
  C:\Windows\System\yqisZDK.exe
  2⤵
  PID:4640
- C:\Windows\System\NCtejGi.exe
  C:\Windows\System\NCtejGi.exe
  2⤵
  PID:12912
- C:\Windows\System\LxLkDCM.exe
  C:\Windows\System\LxLkDCM.exe
  2⤵
  PID:6156
- C:\Windows\System\QHYeFuF.exe
  C:\Windows\System\QHYeFuF.exe
  2⤵
  PID:12772
- C:\Windows\System\UIRdZtc.exe
  C:\Windows\System\UIRdZtc.exe
  2⤵
  PID:11552
- C:\Windows\System\GfoxoXZ.exe
  C:\Windows\System\GfoxoXZ.exe
  2⤵
  PID:3968
- C:\Windows\System\UnXztvl.exe
  C:\Windows\System\UnXztvl.exe
  2⤵
  PID:9488
- C:\Windows\System\EoPGzaG.exe
  C:\Windows\System\EoPGzaG.exe
  2⤵
  PID:12844
- C:\Windows\System\UmeCztO.exe
  C:\Windows\System\UmeCztO.exe
  2⤵
  PID:9088
- C:\Windows\System\Tljqbfa.exe
  C:\Windows\System\Tljqbfa.exe
  2⤵
  PID:2820
- C:\Windows\System\eHMjOOr.exe
  C:\Windows\System\eHMjOOr.exe
  2⤵
  PID:9112
- C:\Windows\System\VHPYFAA.exe
  C:\Windows\System\VHPYFAA.exe
  2⤵
  PID:10920
- C:\Windows\System\dVilCOo.exe
  C:\Windows\System\dVilCOo.exe
  2⤵
  PID:996
- C:\Windows\System\ymzHjQb.exe
  C:\Windows\System\ymzHjQb.exe
  2⤵
  PID:8180
- C:\Windows\System\OovlrIu.exe
  C:\Windows\System\OovlrIu.exe
  2⤵
  PID:3260
- C:\Windows\System\uDauckG.exe
  C:\Windows\System\uDauckG.exe
  2⤵
  PID:5644
- C:\Windows\System\Wxyathr.exe
  C:\Windows\System\Wxyathr.exe
  2⤵
  PID:4092
- C:\Windows\System\cbJFaIq.exe
  C:\Windows\System\cbJFaIq.exe
  2⤵
  PID:8012
- C:\Windows\System\GhAZBgb.exe
  C:\Windows\System\GhAZBgb.exe
  2⤵
  PID:7204
- C:\Windows\System\bbPPHfx.exe
  C:\Windows\System\bbPPHfx.exe
  2⤵
  PID:7776
- C:\Windows\System\PxMpcsN.exe
  C:\Windows\System\PxMpcsN.exe
  2⤵
  PID:6712
- C:\Windows\System\QKGKPHz.exe
  C:\Windows\System\QKGKPHz.exe
  2⤵
  PID:8388
- C:\Windows\System\TvmZZAL.exe
  C:\Windows\System\TvmZZAL.exe
  2⤵
  PID:8604
- C:\Windows\System\GWeTpCG.exe
  C:\Windows\System\GWeTpCG.exe
  2⤵
  PID:7824
- C:\Windows\System\BuovsaJ.exe
  C:\Windows\System\BuovsaJ.exe
  2⤵
  PID:8420
- C:\Windows\System\RmYVbkQ.exe
  C:\Windows\System\RmYVbkQ.exe
  2⤵
  PID:12072
- C:\Windows\System\VEEivrO.exe
  C:\Windows\System\VEEivrO.exe
  2⤵
  PID:6556
- C:\Windows\System\pKdphKR.exe
  C:\Windows\System\pKdphKR.exe
  2⤵
  PID:7696
- C:\Windows\System\IqsdzWn.exe
  C:\Windows\System\IqsdzWn.exe
  2⤵
  PID:8008
- C:\Windows\System\TNkDXUX.exe
  C:\Windows\System\TNkDXUX.exe
  2⤵
  PID:2724
- C:\Windows\System\JmFMAmS.exe
  C:\Windows\System\JmFMAmS.exe
  2⤵
  PID:7428
- C:\Windows\System\CXkNYKa.exe
  C:\Windows\System\CXkNYKa.exe
  2⤵
  PID:11936
- C:\Windows\System\pzcKNmp.exe
  C:\Windows\System\pzcKNmp.exe
  2⤵
  PID:8756
- C:\Windows\System\fTWdeOc.exe
  C:\Windows\System\fTWdeOc.exe
  2⤵
  PID:7420
- C:\Windows\System\iCMrjQV.exe
  C:\Windows\System\iCMrjQV.exe
  2⤵
  PID:6604
- C:\Windows\System\dpDJqxX.exe
  C:\Windows\System\dpDJqxX.exe
  2⤵
  PID:10676
- C:\Windows\System\gFQYEQm.exe
  C:\Windows\System\gFQYEQm.exe
  2⤵
  PID:6320
- C:\Windows\System\NWiEvjK.exe
  C:\Windows\System\NWiEvjK.exe
  2⤵
  PID:8432
- C:\Windows\System\HsINiCq.exe
  C:\Windows\System\HsINiCq.exe
  2⤵
  PID:8464
- C:\Windows\System\oXAqNdv.exe
  C:\Windows\System\oXAqNdv.exe
  2⤵
  PID:224
- C:\Windows\System\FqmbQjS.exe
  C:\Windows\System\FqmbQjS.exe
  2⤵
  PID:6348
- C:\Windows\System\elwpzzD.exe
  C:\Windows\System\elwpzzD.exe
  2⤵
  PID:5924
- C:\Windows\System\qZcYDKY.exe
  C:\Windows\System\qZcYDKY.exe
  2⤵
  PID:9320
- C:\Windows\System\phbBbOM.exe
  C:\Windows\System\phbBbOM.exe
  2⤵
  PID:7108
- C:\Windows\System\erxvXOg.exe
  C:\Windows\System\erxvXOg.exe
  2⤵
  PID:3984
- C:\Windows\System\NVdlrkC.exe
  C:\Windows\System\NVdlrkC.exe
  2⤵
  PID:12768
- C:\Windows\System\LMXbNwk.exe
  C:\Windows\System\LMXbNwk.exe
  2⤵
  PID:7044
- C:\Windows\System\wIadNfP.exe
  C:\Windows\System\wIadNfP.exe
  2⤵
  PID:7268
- C:\Windows\System\aEDgEUV.exe
  C:\Windows\System\aEDgEUV.exe
  2⤵
  PID:11096
- C:\Windows\System\TBneJSh.exe
  C:\Windows\System\TBneJSh.exe
  2⤵
  PID:8124
- C:\Windows\System\xFiZbjJ.exe
  C:\Windows\System\xFiZbjJ.exe
  2⤵
  PID:7012
- C:\Windows\System\QKEnmcS.exe
  C:\Windows\System\QKEnmcS.exe
  2⤵
  PID:6104
- C:\Windows\System\jVzBGrk.exe
  C:\Windows\System\jVzBGrk.exe
  2⤵
  PID:8284
- C:\Windows\System\fSgJAhQ.exe
  C:\Windows\System\fSgJAhQ.exe
  2⤵
  PID:9420
- C:\Windows\System\liQiUqK.exe
  C:\Windows\System\liQiUqK.exe
  2⤵
  PID:9396
- C:\Windows\System\JFWiAuG.exe
  C:\Windows\System\JFWiAuG.exe
  2⤵
  PID:7016
- C:\Windows\System\HEwxwaN.exe
  C:\Windows\System\HEwxwaN.exe
  2⤵
  PID:9472
- C:\Windows\System\SQtPjgm.exe
  C:\Windows\System\SQtPjgm.exe
  2⤵
  PID:12208
- C:\Windows\System\EkQbfOn.exe
  C:\Windows\System\EkQbfOn.exe
  2⤵
  PID:8244
- C:\Windows\System\zQmeIWx.exe
  C:\Windows\System\zQmeIWx.exe
  2⤵
  PID:8252
- C:\Windows\System\jVWapfO.exe
  C:\Windows\System\jVWapfO.exe
  2⤵
  PID:5740
- C:\Windows\System\ghcnuCQ.exe
  C:\Windows\System\ghcnuCQ.exe
  2⤵
  PID:8128
- C:\Windows\System\DDxQZhH.exe
  C:\Windows\System\DDxQZhH.exe
  2⤵
  PID:9344
- C:\Windows\System\bDUFyoY.exe
  C:\Windows\System\bDUFyoY.exe
  2⤵
  PID:10160
- C:\Windows\System\rWykLfa.exe
  C:\Windows\System\rWykLfa.exe
  2⤵
  PID:8736
- C:\Windows\System\PVrWNYj.exe
  C:\Windows\System\PVrWNYj.exe
  2⤵
  PID:7984
- C:\Windows\System\YwCsHvT.exe
  C:\Windows\System\YwCsHvT.exe
  2⤵
  PID:7740
- C:\Windows\System\ndfPcyQ.exe
  C:\Windows\System\ndfPcyQ.exe
  2⤵
  PID:6272
- C:\Windows\System\xaYPldC.exe
  C:\Windows\System\xaYPldC.exe
  2⤵
  PID:11432
- C:\Windows\System\qbABRqg.exe
  C:\Windows\System\qbABRqg.exe
  2⤵
  PID:9560
- C:\Windows\System\vgHbVCH.exe
  C:\Windows\System\vgHbVCH.exe
  2⤵
  PID:9408
- C:\Windows\System\KnlxKEb.exe
  C:\Windows\System\KnlxKEb.exe
  2⤵
  PID:8720
- C:\Windows\System\RSyUcPL.exe
  C:\Windows\System\RSyUcPL.exe
  2⤵
  PID:11960
- C:\Windows\System\zUVBWiZ.exe
  C:\Windows\System\zUVBWiZ.exe
  2⤵
  PID:10840
- C:\Windows\System\ghDmwLl.exe
  C:\Windows\System\ghDmwLl.exe
  2⤵
  PID:9476
- C:\Windows\System\XqacoGb.exe
  C:\Windows\System\XqacoGb.exe
  2⤵
  PID:6780
- C:\Windows\System\RrvfTbg.exe
  C:\Windows\System\RrvfTbg.exe
  2⤵
  PID:7172
- C:\Windows\System\JhxkhYr.exe
  C:\Windows\System\JhxkhYr.exe
  2⤵
  PID:7816
- C:\Windows\System\cBxkoRs.exe
  C:\Windows\System\cBxkoRs.exe
  2⤵
  PID:10228
- C:\Windows\System\ZRPUSGS.exe
  C:\Windows\System\ZRPUSGS.exe
  2⤵
  PID:9692
- C:\Windows\System\GJOiuow.exe
  C:\Windows\System\GJOiuow.exe
  2⤵
  PID:2732
- C:\Windows\System\IqotPZf.exe
  C:\Windows\System\IqotPZf.exe
  2⤵
  PID:8400
- C:\Windows\System\lCnnbtO.exe
  C:\Windows\System\lCnnbtO.exe
  2⤵
  PID:1020
- C:\Windows\System\AoVTYwz.exe
  C:\Windows\System\AoVTYwz.exe
  2⤵
  PID:9984
- C:\Windows\System\apzYvAT.exe
  C:\Windows\System\apzYvAT.exe
  2⤵
  PID:9404
- C:\Windows\System\mOwntgw.exe
  C:\Windows\System\mOwntgw.exe
  2⤵
  PID:3036
- C:\Windows\System\vqbEyoX.exe
  C:\Windows\System\vqbEyoX.exe
  2⤵
  PID:10128
- C:\Windows\System\LToYoJs.exe
  C:\Windows\System\LToYoJs.exe
  2⤵
  PID:3828
- C:\Windows\System\eIJGcnj.exe
  C:\Windows\System\eIJGcnj.exe
  2⤵
  PID:1888
- C:\Windows\System\fYtfsRv.exe
  C:\Windows\System\fYtfsRv.exe
  2⤵
  PID:7980
- C:\Windows\System\LLNnPTz.exe
  C:\Windows\System\LLNnPTz.exe
  2⤵
  PID:10048
- C:\Windows\System\dYgFoGQ.exe
  C:\Windows\System\dYgFoGQ.exe
  2⤵
  PID:10696
- C:\Windows\System\XPBaQPo.exe
  C:\Windows\System\XPBaQPo.exe
  2⤵
  PID:9048
- C:\Windows\System\jPDfdOJ.exe
  C:\Windows\System\jPDfdOJ.exe
  2⤵
  PID:10548
- C:\Windows\System\DURQtTB.exe
  C:\Windows\System\DURQtTB.exe
  2⤵
  PID:7660
- C:\Windows\System\gkiGjaY.exe
  C:\Windows\System\gkiGjaY.exe
  2⤵
  PID:10136
- C:\Windows\System\ipSgwWn.exe
  C:\Windows\System\ipSgwWn.exe
  2⤵
  PID:9436
- C:\Windows\System\sgmYYDr.exe
  C:\Windows\System\sgmYYDr.exe
  2⤵
  PID:10952
- C:\Windows\System\GKFhGXy.exe
  C:\Windows\System\GKFhGXy.exe
  2⤵
  PID:7048
- C:\Windows\System\OnqznGH.exe
  C:\Windows\System\OnqznGH.exe
  2⤵
  PID:5500
- C:\Windows\System\XwgjExy.exe
  C:\Windows\System\XwgjExy.exe
  2⤵
  PID:10732
- C:\Windows\System\CNVstBd.exe
  C:\Windows\System\CNVstBd.exe
  2⤵
  PID:9828
- C:\Windows\System\OLBZqdj.exe
  C:\Windows\System\OLBZqdj.exe
  2⤵
  PID:11164
- C:\Windows\System\WFZkCrX.exe
  C:\Windows\System\WFZkCrX.exe
  2⤵
  PID:9300
- C:\Windows\System\oqTdTNc.exe
  C:\Windows\System\oqTdTNc.exe
  2⤵
  PID:9896
- C:\Windows\System\gDKokcc.exe
  C:\Windows\System\gDKokcc.exe
  2⤵
  PID:8632
- C:\Windows\System\wGlDnHG.exe
  C:\Windows\System\wGlDnHG.exe
  2⤵
  PID:10008
- C:\Windows\System\iKMLvLV.exe
  C:\Windows\System\iKMLvLV.exe
  2⤵
  PID:7896
- C:\Windows\System\FkcsdPA.exe
  C:\Windows\System\FkcsdPA.exe
  2⤵
  PID:10856
- C:\Windows\System\Lhvfcac.exe
  C:\Windows\System\Lhvfcac.exe
  2⤵
  PID:9360
- C:\Windows\System\ydKnYPO.exe
  C:\Windows\System\ydKnYPO.exe
  2⤵
  PID:10376
- C:\Windows\System\ITYRXfd.exe
  C:\Windows\System\ITYRXfd.exe
  2⤵
  PID:7124
- C:\Windows\System\hztuRjw.exe
  C:\Windows\System\hztuRjw.exe
  2⤵
  PID:9656
- C:\Windows\System\PiEMblk.exe
  C:\Windows\System\PiEMblk.exe
  2⤵
  PID:10396
- C:\Windows\System\nTGNxeJ.exe
  C:\Windows\System\nTGNxeJ.exe
  2⤵
  PID:11312
- C:\Windows\System\qjWUOnx.exe
  C:\Windows\System\qjWUOnx.exe
  2⤵
  PID:11400
- C:\Windows\System\gijSYJk.exe
  C:\Windows\System\gijSYJk.exe
  2⤵
  PID:11560
- C:\Windows\System\JhRyAqu.exe
  C:\Windows\System\JhRyAqu.exe
  2⤵
  PID:11572
- C:\Windows\System\xbUjZCG.exe
  C:\Windows\System\xbUjZCG.exe
  2⤵
  PID:9780
- C:\Windows\System\epDugKr.exe
  C:\Windows\System\epDugKr.exe
  2⤵
  PID:12100
- C:\Windows\System\NlZFrls.exe
  C:\Windows\System\NlZFrls.exe
  2⤵
  PID:11396
- C:\Windows\System\lyiNvGG.exe
  C:\Windows\System\lyiNvGG.exe
  2⤵
  PID:10948
- C:\Windows\System\TuAzUGQ.exe
  C:\Windows\System\TuAzUGQ.exe
  2⤵
  PID:6316
- C:\Windows\System\rVSoUNv.exe
  C:\Windows\System\rVSoUNv.exe
  2⤵
  PID:10536
- C:\Windows\System\mguSXdT.exe
  C:\Windows\System\mguSXdT.exe
  2⤵
  PID:8520
- C:\Windows\System\lAfhYOY.exe
  C:\Windows\System\lAfhYOY.exe
  2⤵
  PID:9380
- C:\Windows\System\mdURsjf.exe
  C:\Windows\System\mdURsjf.exe
  2⤵
  PID:2260
- C:\Windows\System\XOHEcjn.exe
  C:\Windows\System\XOHEcjn.exe
  2⤵
  PID:12532
- C:\Windows\System\CrxguGY.exe
  C:\Windows\System\CrxguGY.exe
  2⤵
  PID:10272
- C:\Windows\System\gIinIVl.exe
  C:\Windows\System\gIinIVl.exe
  2⤵
  PID:13260
- C:\Windows\System\yuEItsG.exe
  C:\Windows\System\yuEItsG.exe
  2⤵
  PID:11468
- C:\Windows\System\FfvRYoN.exe
  C:\Windows\System\FfvRYoN.exe
  2⤵
  PID:11320
- C:\Windows\System\SyxEIhs.exe
  C:\Windows\System\SyxEIhs.exe
  2⤵
  PID:10056
- C:\Windows\System\vIhpARi.exe
  C:\Windows\System\vIhpARi.exe
  2⤵
  PID:11932
- C:\Windows\System\WNqFWMb.exe
  C:\Windows\System\WNqFWMb.exe
  2⤵
  PID:11772
- C:\Windows\System\ZUdSJSH.exe
  C:\Windows\System\ZUdSJSH.exe
  2⤵
  PID:11192
- C:\Windows\System\BSjeViS.exe
  C:\Windows\System\BSjeViS.exe
  2⤵
  PID:11556
- C:\Windows\System\TPPQyQP.exe
  C:\Windows\System\TPPQyQP.exe
  2⤵
  PID:2388
- C:\Windows\System\WhLhhoD.exe
  C:\Windows\System\WhLhhoD.exe
  2⤵
  PID:11696
- C:\Windows\System\YtAhZdj.exe
  C:\Windows\System\YtAhZdj.exe
  2⤵
  PID:11644
- C:\Windows\System\NyVofPE.exe
  C:\Windows\System\NyVofPE.exe
  2⤵
  PID:12056
- C:\Windows\System\JmkDxDv.exe
  C:\Windows\System\JmkDxDv.exe
  2⤵
  PID:11212
- C:\Windows\System\VCcUVVn.exe
  C:\Windows\System\VCcUVVn.exe
  2⤵
  PID:12196
- C:\Windows\System\rRyATBp.exe
  C:\Windows\System\rRyATBp.exe
  2⤵
  PID:12144
- C:\Windows\System\ASNQEFS.exe
  C:\Windows\System\ASNQEFS.exe
  2⤵
  PID:11984
- C:\Windows\System\YxqfJcV.exe
  C:\Windows\System\YxqfJcV.exe
  2⤵
  PID:9160
- C:\Windows\System\JdklcWA.exe
  C:\Windows\System\JdklcWA.exe
  2⤵
  PID:11592
- C:\Windows\System\gmIhWgz.exe
  C:\Windows\System\gmIhWgz.exe
  2⤵
  PID:12004
- C:\Windows\System\FafHcrB.exe
  C:\Windows\System\FafHcrB.exe
  2⤵
  PID:10636
- C:\Windows\System\swUgCSt.exe
  C:\Windows\System\swUgCSt.exe
  2⤵
  PID:10848
- C:\Windows\System\ClVMYXK.exe
  C:\Windows\System\ClVMYXK.exe
  2⤵
  PID:11496
- C:\Windows\System\dzEgmwl.exe
  C:\Windows\System\dzEgmwl.exe
  2⤵
  PID:12132
- C:\Windows\System\hlieOeX.exe
  C:\Windows\System\hlieOeX.exe
  2⤵
  PID:10940
- C:\Windows\System\oetCqIA.exe
  C:\Windows\System\oetCqIA.exe
  2⤵
  PID:12368
- C:\Windows\System\rosuuTz.exe
  C:\Windows\System\rosuuTz.exe
  2⤵
  PID:12080
- C:\Windows\System\wvSKvsg.exe
  C:\Windows\System\wvSKvsg.exe
  2⤵
  PID:11208
- C:\Windows\System\idUhbNg.exe
  C:\Windows\System\idUhbNg.exe
  2⤵
  PID:11476
- C:\Windows\System\LEUCKfv.exe
  C:\Windows\System\LEUCKfv.exe
  2⤵
  PID:12040
- C:\Windows\System\jOAaryB.exe
  C:\Windows\System\jOAaryB.exe
  2⤵
  PID:13332
- C:\Windows\System\zoKyEqh.exe
  C:\Windows\System\zoKyEqh.exe
  2⤵
  PID:13352
- C:\Windows\System\gQvQXYY.exe
  C:\Windows\System\gQvQXYY.exe
  2⤵
  PID:13380
- C:\Windows\System\gJmoUmw.exe
  C:\Windows\System\gJmoUmw.exe
  2⤵
  PID:13400
- C:\Windows\System\esfKYSC.exe
  C:\Windows\System\esfKYSC.exe
  2⤵
  PID:13444
- C:\Windows\System\NOlWtlF.exe
  C:\Windows\System\NOlWtlF.exe
  2⤵
  PID:13472
- C:\Windows\System\qVNWSTG.exe
  C:\Windows\System\qVNWSTG.exe
  2⤵
  PID:13508
- C:\Windows\System\zldwaQn.exe
  C:\Windows\System\zldwaQn.exe
  2⤵
  PID:13548
- C:\Windows\System\HmWhzaO.exe
  C:\Windows\System\HmWhzaO.exe
  2⤵
  PID:13576
- C:\Windows\System\BhwJiRr.exe
  C:\Windows\System\BhwJiRr.exe
  2⤵
  PID:13604
- C:\Windows\System\FjzwXyb.exe
  C:\Windows\System\FjzwXyb.exe
  2⤵
  PID:13632
- C:\Windows\System\YrbdCLK.exe
  C:\Windows\System\YrbdCLK.exe
  2⤵
  PID:13664
- C:\Windows\System\XyIRdxn.exe
  C:\Windows\System\XyIRdxn.exe
  2⤵
  PID:13868
- C:\Windows\System\eqMuAVc.exe
  C:\Windows\System\eqMuAVc.exe
  2⤵
  PID:13892
- C:\Windows\System\OGphicA.exe
  C:\Windows\System\OGphicA.exe
  2⤵
  PID:13924
- C:\Windows\System\drHUUvO.exe
  C:\Windows\System\drHUUvO.exe
  2⤵
  PID:13952
- C:\Windows\System\VyITUXy.exe
  C:\Windows\System\VyITUXy.exe
  2⤵
  PID:13980
- C:\Windows\System\eUIHnUy.exe
  C:\Windows\System\eUIHnUy.exe
  2⤵
  PID:14024
- C:\Windows\System\CimKEXh.exe
  C:\Windows\System\CimKEXh.exe
  2⤵
  PID:14060
- C:\Windows\System\ajolpzV.exe
  C:\Windows\System\ajolpzV.exe
  2⤵
  PID:14096
- C:\Windows\System\BrfYZJy.exe
  C:\Windows\System\BrfYZJy.exe
  2⤵
  PID:14132
- C:\Windows\System\fdVOmje.exe
  C:\Windows\System\fdVOmje.exe
  2⤵
  PID:14160
- C:\Windows\System\JJcbIPP.exe
  C:\Windows\System\JJcbIPP.exe
  2⤵
  PID:14192
- C:\Windows\System\LygemUL.exe
  C:\Windows\System\LygemUL.exe
  2⤵
  PID:14252
- C:\Windows\System\vkrGrLL.exe
  C:\Windows\System\vkrGrLL.exe
  2⤵
  PID:14288
- C:\Windows\System\QQGSfRY.exe
  C:\Windows\System\QQGSfRY.exe
  2⤵
  PID:10936
- C:\Windows\System\WfGlSNV.exe
  C:\Windows\System\WfGlSNV.exe
  2⤵
  PID:12436
- C:\Windows\System\AwKsHfM.exe
  C:\Windows\System\AwKsHfM.exe
  2⤵
  PID:12276
- C:\Windows\System\XGRuIfd.exe
  C:\Windows\System\XGRuIfd.exe
  2⤵
  PID:11768
- C:\Windows\System\imjgryu.exe
  C:\Windows\System\imjgryu.exe
  2⤵
  PID:10192
- C:\Windows\System\tdbscvj.exe
  C:\Windows\System\tdbscvj.exe
  2⤵
  PID:13420
- C:\Windows\System\jKgqMOX.exe
  C:\Windows\System\jKgqMOX.exe
  2⤵
  PID:13452
- C:\Windows\System\wvjzArY.exe
  C:\Windows\System\wvjzArY.exe
  2⤵
  PID:13304
- C:\Windows\System\lKwWpxS.exe
  C:\Windows\System\lKwWpxS.exe
  2⤵
  PID:2784
- C:\Windows\System\EoUSyzv.exe
  C:\Windows\System\EoUSyzv.exe
  2⤵
  PID:13328
- C:\Windows\System\rWspPfk.exe
  C:\Windows\System\rWspPfk.exe
  2⤵
  PID:13684
- C:\Windows\System\FNTfyVI.exe
  C:\Windows\System\FNTfyVI.exe
  2⤵
  PID:12364
- C:\Windows\System\OCmNUQX.exe
  C:\Windows\System\OCmNUQX.exe
  2⤵
  PID:10336
- C:\Windows\System\MVAUlBS.exe
  C:\Windows\System\MVAUlBS.exe
  2⤵
  PID:13340
- C:\Windows\System\hQVsykc.exe
  C:\Windows\System\hQVsykc.exe
  2⤵
  PID:12520
- C:\Windows\System\qdlsjcU.exe
  C:\Windows\System\qdlsjcU.exe
  2⤵
  PID:13488
- C:\Windows\System\QjyfdYj.exe
  C:\Windows\System\QjyfdYj.exe
  2⤵
  PID:13572
- C:\Windows\System\jDHunUq.exe
  C:\Windows\System\jDHunUq.exe
  2⤵
  PID:13640
- C:\Windows\System\AOUVmIW.exe
  C:\Windows\System\AOUVmIW.exe
  2⤵
  PID:13900
- C:\Windows\System\xcZfMRM.exe
  C:\Windows\System\xcZfMRM.exe
  2⤵
  PID:13968
- C:\Windows\System\PzPHqLE.exe
  C:\Windows\System\PzPHqLE.exe
  2⤵
  PID:14012
- C:\Windows\System\xQpPVQL.exe
  C:\Windows\System\xQpPVQL.exe
  2⤵
  PID:13976
- C:\Windows\System\mtgpMfH.exe
  C:\Windows\System\mtgpMfH.exe
  2⤵
  PID:14144
- C:\Windows\System\JbWNnqU.exe
  C:\Windows\System\JbWNnqU.exe
  2⤵
  PID:14276
- C:\Windows\System\PXqMaDQ.exe
  C:\Windows\System\PXqMaDQ.exe
  2⤵
  PID:12528
- C:\Windows\System\xXwePEl.exe
  C:\Windows\System\xXwePEl.exe
  2⤵
  PID:12944
- C:\Windows\System\WwEqzMx.exe
  C:\Windows\System\WwEqzMx.exe
  2⤵
  PID:10868
- C:\Windows\System\KSCtInu.exe
  C:\Windows\System\KSCtInu.exe
  2⤵
  PID:13044
- C:\Windows\System\WXagwph.exe
  C:\Windows\System\WXagwph.exe
  2⤵
  PID:12812
- C:\Windows\System\dWlZgPL.exe
  C:\Windows\System\dWlZgPL.exe
  2⤵
  PID:11112
- C:\Windows\System\HwOYWAK.exe
  C:\Windows\System\HwOYWAK.exe
  2⤵
  PID:5032
- C:\Windows\System\sghBuLt.exe
  C:\Windows\System\sghBuLt.exe
  2⤵
  PID:13180
- C:\Windows\System\TYqYuDx.exe
  C:\Windows\System\TYqYuDx.exe
  2⤵
  PID:13540
- C:\Windows\System\XLDXUMt.exe
  C:\Windows\System\XLDXUMt.exe
  2⤵
  PID:13388
- C:\Windows\System\QkpWQtW.exe
  C:\Windows\System\QkpWQtW.exe
  2⤵
  PID:13108
- C:\Windows\System\XnARHgY.exe
  C:\Windows\System\XnARHgY.exe
  2⤵
  PID:8528
- C:\Windows\System\eCkssoe.exe
  C:\Windows\System\eCkssoe.exe
  2⤵
  PID:13520
- C:\Windows\System\dJUcJeU.exe
  C:\Windows\System\dJUcJeU.exe
  2⤵
  PID:13700
- C:\Windows\System\LrqIOpI.exe
  C:\Windows\System\LrqIOpI.exe
  2⤵
  PID:14000
- C:\Windows\System\HYnktvM.exe
  C:\Windows\System\HYnktvM.exe
  2⤵
  PID:14088
- C:\Windows\System\Txouwny.exe
  C:\Windows\System\Txouwny.exe
  2⤵
  PID:14304
- C:\Windows\System\CzUQjXm.exe
  C:\Windows\System\CzUQjXm.exe
  2⤵
  PID:14332
- C:\Windows\System\ihadzni.exe
  C:\Windows\System\ihadzni.exe
  2⤵
  PID:12716
- C:\Windows\System\PxrTUhm.exe
  C:\Windows\System\PxrTUhm.exe
  2⤵
  PID:9716
- C:\Windows\System\DEgmUyo.exe
  C:\Windows\System\DEgmUyo.exe
  2⤵
  PID:12948
- C:\Windows\System\yAZfSZB.exe
  C:\Windows\System\yAZfSZB.exe
  2⤵
  PID:11824
- C:\Windows\System\lIDyNrs.exe
  C:\Windows\System\lIDyNrs.exe
  2⤵
  PID:13628
- C:\Windows\System\LwjaRxG.exe
  C:\Windows\System\LwjaRxG.exe
  2⤵
  PID:13948
- C:\Windows\System\pHQOQba.exe
  C:\Windows\System\pHQOQba.exe
  2⤵
  PID:10100
- C:\Windows\System\wvKhbRs.exe
  C:\Windows\System\wvKhbRs.exe
  2⤵
  PID:13184
- C:\Windows\System\XmgmJLG.exe
  C:\Windows\System\XmgmJLG.exe
  2⤵
  PID:11252
- C:\Windows\System\GbhPCOd.exe
  C:\Windows\System\GbhPCOd.exe
  2⤵
  PID:14076
- C:\Windows\System\xPcmVWM.exe
  C:\Windows\System\xPcmVWM.exe
  2⤵
  PID:8616
- C:\Windows\System\DHsIuIH.exe
  C:\Windows\System\DHsIuIH.exe
  2⤵
  PID:13460
- C:\Windows\System\sQgMqFb.exe
  C:\Windows\System\sQgMqFb.exe
  2⤵
  PID:14352
- C:\Windows\System\NHONkyg.exe
  C:\Windows\System\NHONkyg.exe
  2⤵
  PID:14368
- C:\Windows\System\TvxQFwv.exe
  C:\Windows\System\TvxQFwv.exe
  2⤵
  PID:14384
- C:\Windows\System\XNnTvdX.exe
  C:\Windows\System\XNnTvdX.exe
  2⤵
  PID:14404
- C:\Windows\System\rwQKQHw.exe
  C:\Windows\System\rwQKQHw.exe
  2⤵
  PID:14432
- C:\Windows\System\sNXrUYu.exe
  C:\Windows\System\sNXrUYu.exe
  2⤵
  PID:14468
- C:\Windows\System\vmORGes.exe
  C:\Windows\System\vmORGes.exe
  2⤵
  PID:14496
- C:\Windows\System\QKLaLNn.exe
  C:\Windows\System\QKLaLNn.exe
  2⤵
  PID:14540
- C:\Windows\System\eGRFfSb.exe
  C:\Windows\System\eGRFfSb.exe
  2⤵
  PID:14576
- C:\Windows\System\cxJZGfh.exe
  C:\Windows\System\cxJZGfh.exe
  2⤵
  PID:14616
- C:\Windows\System\fUvNFkI.exe
  C:\Windows\System\fUvNFkI.exe
  2⤵
  PID:14652
- C:\Windows\System\ZdGvTDz.exe
  C:\Windows\System\ZdGvTDz.exe
  2⤵
  PID:14676
- C:\Windows\System\cKyFXlz.exe
  C:\Windows\System\cKyFXlz.exe
  2⤵
  PID:14704
- C:\Windows\System\roAceTl.exe
  C:\Windows\System\roAceTl.exe
  2⤵
  PID:14724
- C:\Windows\System\bvTREGL.exe
  C:\Windows\System\bvTREGL.exe
  2⤵
  PID:14760
- C:\Windows\System\NRurnsP.exe
  C:\Windows\System\NRurnsP.exe
  2⤵
  PID:14800
- C:\Windows\System\SCXeTFm.exe
  C:\Windows\System\SCXeTFm.exe
  2⤵
  PID:14816
- C:\Windows\System\QJGKpFj.exe
  C:\Windows\System\QJGKpFj.exe
  2⤵
  PID:14844
- C:\Windows\System\eRyLMYl.exe
  C:\Windows\System\eRyLMYl.exe
  2⤵
  PID:14876

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Modifies data under HKEY_USERS
PID:3372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2rfbxw5x.zqn.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\CBWdUWS.exe

Filesize
1.9MB

MD5
f3bbea8cbfcfda2ea48a28aead25a097

SHA1
0d8274d85e3aae311bbe7446eb5215bb1d77b6df

SHA256
e2382cd511f7ba3a539f9e3fab250a16839a066f41c3f58bb620da69856bb62e

SHA512
ad5b907d8f3139a80648549750d3f0e8b95acc667b145a43d6162c668753253173dc47689b5e639da962c14e4c8bcca45351e704465869ee6f4db446306657cd

Download Submit
C:\Windows\System\DmNbxLK.exe

Filesize
18B

MD5
5db3df0964e5c695675f39e99d1f288b

SHA1
84b597ea47f1f6b13b223cbb576a55e47a79cfaa

SHA256
15f5f6f9d4846d3bfaf7f8740e9c849aebfecfea6fc86fee82eb18d6ec03fd9f

SHA512
f71b3480e977c4ca4affaaec3f3bd31e3598fdd986ea7bafee42b5d6a8676e69449256bbab19fc0cc61412a454871e6b79cebb0c5e3610b9e98c4f089888aa18

Download Submit
C:\Windows\System\FLmieKG.exe

Filesize
1.9MB

MD5
e9d7ddeaf3761cadb76cc888395deb1b

SHA1
f70b5a48e311d19652f4508ef0ef600f1d98afc1

SHA256
e8199bb4387c4f17c490c9cd835e08d9eac425b083dd3548a115a6f16b393792

SHA512
dbde841d2acc76d586f02d7922bdd4353c7045d5be13962e63d829f242f2526c9fc9a5ade4483c2f69aad70f0d768eaebd273e35391eb16a9e4fec9a0542aea4

Download Submit
C:\Windows\System\HFVqQWJ.exe

Filesize
1.9MB

MD5
94ecae6a4ab0aaa25e291fbf58f042cf

SHA1
efed2bdeaa2ec067ef79c2b2e10ecaae3f1aaaae

SHA256
811ac0a0fdf6c1568b82191001e96fee1f1495b040a1cfc65798b0405d5b7504

SHA512
5de0d9956a776423be1ab5985b098927fbbb516baf8496fe7296572120de1d8d23cb3e5e1e078e9821175caad72357c5646496c5d0de94cc25e0bc01d215aef7

Download Submit
C:\Windows\System\HQndHWS.exe

Filesize
1.9MB

MD5
13cb60f196ed8230225e306a98297dd6

SHA1
ee132f53d18d869cb98ab3af340060eec765a360

SHA256
587423313eb8841d04b64518a92deb9394baa694ee706801d27652cfda8bc9c5

SHA512
5c334bfd4c1da0b7215d2cdeecc36fce51df8b21f65a3a65fbc1c4575f1979631765053cb7d521fe572b66251d307cb15b375f8128368d3338131f1f1c812d1f

Download Submit
C:\Windows\System\KfZgRYJ.exe

Filesize
1.9MB

MD5
9d41370c49840d0fd0b572c790028f16

SHA1
78b272e028379afb8421c7f334ef04f0ffdb47e4

SHA256
4096f70c927a8033327f8fb9dce7412cf59f57f85b8f5be98a118022aca14030

SHA512
f01a5406e645274551642cd2875da4362fd566a5fa5af3510c99328e00ab9f69255a7e8955d9df260196bc13930a5a50328a28148386c38b055e02ab9d604ae4

Download Submit
C:\Windows\System\LeEkeYA.exe

Filesize
1.9MB

MD5
aa46d978f51f09036b3a61e18dfff41a

SHA1
76c0d6bcc37cc5b837c455dd6f12b56040e8368d

SHA256
681cdb583f8ed4ed2adf3e34bcb6b403991cb7504b7c7e55c2d3483f80c32644

SHA512
ef3cbfe9e0299cd9c6f053733ec0471a8a4b7c764699dc7c472639460ee970aa5ec5d140bbe6d5a783455aebe9c2e710884b2527b0a3a2b99b77045345a44f56

Download Submit
C:\Windows\System\LothixF.exe

Filesize
1.9MB

MD5
07c6b65249bd86e8d134454574d4dde5

SHA1
67c48a2664312283307fd55962c60cb21876c744

SHA256
8b754d36ad46830d31e334880449e4ee03629ea13371289c6769a7a9036b6450

SHA512
2cce12c850973f28b1108b460827903f2b53045c698c17c8e381dfac9ee327a6ec183f90eebfe5644a0c5a75b0dcb21e72161a735f89929bcd86974e17985963

Download Submit
C:\Windows\System\NeKqHpR.exe

Filesize
1.9MB

MD5
0cf2b7f4e9103dde6dfb853977342f72

SHA1
99098331ba4a7ae6f13644c2aafe45979156499a

SHA256
da5014cc07aeb521b1205b5a5c1ff16480531d487837a9402cafc473cbb4483f

SHA512
7a6dafd7fbd2bdb10bbcb18db797b7dbc3880dc4c455da046bfbaba9a5625abae044466c90a3f5948988efb3b6c3d61c793fca2b2be1232383f032204dc92a51

Download Submit
C:\Windows\System\OMEzcil.exe

Filesize
1.9MB

MD5
85400855387ccb72004568e354b1575b

SHA1
7c3396b615216bf527035424bbca7d43a2b52269

SHA256
f0cb352d8d70344783fc646dc5dea270de53e587cb91e1a1a5da413829390e1c

SHA512
2036b1eef07ef5d2e554fe018f7ef723f8de35f1eea5428025f31dd0e5fb85796d75d5e9e80ce62033f1ecbd6e0d8c0ddc6363821c3b9346cd9eae9362294bb2

Download Submit
C:\Windows\System\OfYQLLV.exe

Filesize
8B

MD5
a8f2921c80c15a3d426e5fdff8a56196

SHA1
4dc21bf95e22427a9dafcd4930e81b62e77d5fda

SHA256
7e9bbeeba45dae16f8c444596ee4180d7313e899e46fa6263fde6904f32d92a1

SHA512
996666f646b1878ee129a778184f9520541ee458797b8bfaefed6e1f152a5436e0ff19d28744463b706ffe3e24e429f5af102aa1e7733dbeeb6210754c828802

Download Submit
C:\Windows\System\PPJsSZC.exe

Filesize
1.9MB

MD5
9b05351caeb711e06e965528b7da82e4

SHA1
9899ff8a2ce6e9ad859b7a5d4fde402b28cdc307

SHA256
a6deefa780c4b106c42989cb01a5f64922097b1ee11a36d1f59359394e15608b

SHA512
ff5505a5e7de5437e1b76e1e41f704f0c8dfec1b09a0471df97b6e95dadd2ca3becc7be41f977b896741b8f5d62c765392c7bf29e5930dc9aec14be61c737ede

Download Submit
C:\Windows\System\UJLrdbV.exe

Filesize
1.9MB

MD5
f2b6ad589216528afd4a5b16ae6b3ced

SHA1
e0a0ad211ea94e2fc19ac873791ebbc446cfa2b1

SHA256
5722ea0cc14681f5beb568e4a65e0133c3a64d90df00d4bdb0b2376454b65943

SHA512
dd140d2b485e08f9054332304a8e894795bb1b9a27bfff6fd9cccd7fa63e0600bf943cbd03d778b5741b8bd40e1bd5e2bb0521035fd61d32317a0f0eb171bf98

Download Submit
C:\Windows\System\WXMihWw.exe

Filesize
1.9MB

MD5
e26a706c1351cd23b49381485778bd17

SHA1
1b8a4fa6c8e804476d59640b54b0a742b8da2730

SHA256
ba0a791b1d3ae35db3b58f8c58dc41eab67f2133cd234e600847b81c2e47a636

SHA512
724603c2aee531c5b1b4b19fc6785c213b6390669004ef8c88c0ff60aa0728a7cfdbecd70287d0e3ea9d42f6375fe1079d42bdb10974ba53b547e8182d7d2698

Download Submit
C:\Windows\System\XOWmoga.exe

Filesize
1.9MB

MD5
a377d6dfab376aceaa6a818d4e6251b4

SHA1
ad218536599be6a0657427e53a217e0c67a0da0a

SHA256
850955b762c373309a0e3abf4812d882ca263034fed8b906a0c10c75cefc3a11

SHA512
21f6c797c72c14cf602602811f793003f0704fd9225e686c8546deae873863bf630fa45005c82293bf5913eedbb5dda812697f9a7bb2198fa49844b3455c2136

Download Submit
C:\Windows\System\aEAPRzk.exe

Filesize
1.9MB

MD5
44ad1238a6af8f9a39a3bc192650c571

SHA1
50613a8c52232e59acf9724f86da17b3c367bf20

SHA256
63e02df2b27d2fbc614fec56a81af570fe30056c829de3986bc94f44d70bc52d

SHA512
ce432c0747696ac61cb514974dcde0600a31a58436a1b755411f8ccf7ca594022e673fde33e07964e19465c474a9411c64e3e95b06fa7fd624137ced071b8a3f

Download Submit
C:\Windows\System\aMcuBUp.exe

Filesize
1.9MB

MD5
1eac356bd175cfee66c61a48dd2aa027

SHA1
da4c51c6615eeaf70903264445f1bd04553277d3

SHA256
c12f1be116901f520e25116451fac31fde534c37575fad3c702e483f8e5f35f4

SHA512
2105251bed4aa0ab2fd9d6d054b4594daed7fa5c69edfa0048d234cf2476b5d63b2fab29f90968bda1b20e0699fc9d8b4e84020e1ced61e01585de47d92d8474

Download Submit
C:\Windows\System\bcABOhr.exe

Filesize
1.9MB

MD5
9f57c33e62751707812829879e56c1a7

SHA1
873b48b0fac6461eea46b97886642905d5fb88c9

SHA256
3a1f2dc85db6322746ca1b817bc9e1f2f51887a9194868a82f6b0fec9486f081

SHA512
aa52d03a91b61385e2b88b6a813dbaa80e785f477ef9468145acf2a1d673c7e0f7a47bf7fc6de3043267a1e5b1b774a0801866ca0a74928db23317fc9ea04442

Download Submit
C:\Windows\System\cEdYUSx.exe

Filesize
1.9MB

MD5
13ff695c414028ec4e148e84ee2a5f6a

SHA1
8ca0a5b4c464b3942651a822116875557d5982e6

SHA256
3428405e39af3b1a6d2cde588124ac5390b34e5a0ff33a73aaa2992ec9cf5af0

SHA512
9a0e15de7d45f61dfa5920e7d506a74b1438e79f022f1744a42f811e817ba938d695c03aaddac89a80d00c3629ea64a697a42c934e11392fbbed913c535ec9e5

Download Submit
C:\Windows\System\cHkFSpX.exe

Filesize
1.9MB

MD5
a396323f9cc86bfad10d3503cefc523f

SHA1
1b40799dd8b05ce04ca14e6c768d1bacd2810c9f

SHA256
fc159f23646a500606d0bfbc371f53127d8132b4d74cd2e99061feaa23f049d9

SHA512
0940dd0a62bd12ae886cadd56c4ba9f3d96ecff856953e2b6e5e513492b4d69f45920673d3cc352c36b15fd9396be0991e4aa21156c010485c10b331eab89937

Download Submit
C:\Windows\System\dLENuXc.exe

Filesize
1.9MB

MD5
c8cce990cec560ea661d28120b5eb782

SHA1
1e0268f788a8c0c6b8325c699ca7e533840ab0ac

SHA256
c2617dfc5f730a2d331aa48728d6f1526cb44cd1bbdda19b923b5c0819d33aeb

SHA512
364fb6a6d412dc7c79dd24f2015c87d21e6ab3707ed7685481ebc8fef6b5929c70dac132372abfedf3ca751ae003b627fd08f5ae95c62c928890408c0457ec81

Download Submit
C:\Windows\System\gyvpWbb.exe

Filesize
1.9MB

MD5
fe0ce4768ab229ecac6f6179566ceb07

SHA1
85469a7e9d0d083c20ae544bd3df9f3541892aca

SHA256
3305dd014c75e0e064bed34b5b692654ae3ca55ae02ddbf351b5b6f7275362b2

SHA512
466d6879b072bc8d72aff8a182187f034e6f919167ca8b1ee9b8f528536167e7d037bb350cdf4458fb3beb18bde83eb1a99b6e1ff8b5aa1be0aa889c555da4a7

Download Submit
C:\Windows\System\iigoyYX.exe

Filesize
1.9MB

MD5
3d362317721ac641c7b37fdd4b1a1336

SHA1
b43dc5ea30d5c5cb768e938f0329593d9ec12cd2

SHA256
409f11f35c069c4e8dc5c339f50323c80585634785503b5c08035d784c111112

SHA512
7dfd9e75651f404dff5ba25c533e9bfdbc90b4641df884a589cc9acdbd484f3b2af721e01a960b2b9a7d6718ee03d4535af28bbfc1e49e7945f7f32824d5ace0

Download Submit
C:\Windows\System\jJLetha.exe

Filesize
1.9MB

MD5
69ffd69df8b54d19d107a97480dad83a

SHA1
5560f772023e39d586ae7815d2dd7668b866e91a

SHA256
4b849c460ae882ca9a96538b3520070a11cbc5af04c69bcf2161a86708054902

SHA512
b14ae5738ff98a5a6724c0671e6d7363744f0706722bb36598a8be2fa6621d0c68d0d03866aa6806c8c106b46257b4fb8d0d76e73f7e6f8aa0f7edcdfbcb9581

Download Submit
C:\Windows\System\khzpGpB.exe

Filesize
1.9MB

MD5
d52fbd52b358ad52b60b01736ef68820

SHA1
2efca1199504b6fe17a74b990402047179dafef4

SHA256
27d901841ae98f40b02a362a36a59b3e1af91b065931ac3e888d292e822bc70d

SHA512
f632ce16b3124a27a99eb3c381e39504a2fe9c16ab42e67e8bb1970cb0addd1f7be8273e8e8be98d589f2015df0d6fd93ebf4ea788289de0e27cee39b39869e7

Download Submit
C:\Windows\System\lRtocJi.exe

Filesize
1.9MB

MD5
6df2f45daf45a6798431c1456dd99ee8

SHA1
52bf9b473b1abb64c096a0bc099be1df40759cd4

SHA256
d5bb71082fdcebfeb9af60e835143a0a98d5807c151ce2987de2003020b1990c

SHA512
f4955195af637c19ef3799c08043592bfcf4201409e5b43ab2f21157c3d84735ada003b0caf44cfcbd78618895d4cbc60c60b4b8a488aa97b8eb30080a07ae70

Download Submit
C:\Windows\System\ryukWAN.exe

Filesize
1.9MB

MD5
c59f128b0dc4cc679d0453807392fca6

SHA1
4657693df1e0cfffaf24dacc47a0369aad3ee8e7

SHA256
106f180387690b6667d1d19c25066efdb8fdfd68d2f8b6c9ceadd6c9bf1b245d

SHA512
2b88363876eed853d0e9d52e39bd39c0f0a6390016233c59fa240aaf05130c2afcffc8296e66c6b1d600dc17179d3e09676068fdfcf5551f3681d6c37b6d9aaa

Download Submit
C:\Windows\System\sMtusqu.exe

Filesize
1.9MB

MD5
7a442b12c8b9d4d9e6e290781a5b27e5

SHA1
4d744d90729f734d4d6f93b3cb464efe4c84e1f8

SHA256
5151f823e660e7b2eb8080bec16ae3928ae7e36899e49d38f1eadad39acd7ba3

SHA512
fb8cf5fabc209b8074034ba78b40c49c1c8e5ed264e928c5ec84460c9aecc3d356ad893799980d0912b2ffeeda7563c284e93b3e4bb393f09926926ce13e0bde

Download Submit
C:\Windows\System\tCvOnes.exe

Filesize
1.9MB

MD5
5272dd52d99b8f299afd8cf71341778e

SHA1
730856e442987ba65e75f989fbf797e554964cf7

SHA256
56861981b569b6a1bb4079f43d16a03c6df59ccc60f751fce949fbb01b8038db

SHA512
940340102048373e3a9958c07e029ca7a587b3861c2e20d7fb1e7346366d31b584854a8723929f51edfef903c67d6e6f96dc27bde57da6775ae22944b579e1df

Download Submit
C:\Windows\System\uxWdNjD.exe

Filesize
1.9MB

MD5
5a5811404f3344e0320740da352ffcae

SHA1
e05a9f74d2c259b41bb9ac6a2efc3b3a1481eeff

SHA256
dd7fe197691d46eea86a09a3d1da279320bc5fca81f2df95796130771452a2a8

SHA512
e0166abdb40749f2911288df7d005fe8de9757f557d260d2696caff4dbc7b91039693adf5d442c047d0bbc71ee415c1a52548dac8388c5f145d82e0b664456f6

Download Submit
C:\Windows\System\vouyfIa.exe

Filesize
1.9MB

MD5
a838d89220ba88ee6c397461ada8b918

SHA1
4634f80cb417adc7d85613685131129753921b4d

SHA256
43b9c7ca83e947f921b625c70ccc434988edf8b5d77b2527a3a6078a1f550cc3

SHA512
71c883893c33a2e8393d0939bdb288f74a3720fea52a9e60b438a997a52af8d8ac962a72aa8204edd0c38b03d7af8d0faeb860920fb62b7a146dade35bb0f4c3

Download Submit
C:\Windows\System\wTCknlX.exe

Filesize
1.9MB

MD5
15ad7831f92acb8a05aa99072e352e57

SHA1
93a2b5a978a7e5001a2e5d5e2096cbbd85b9c7c3

SHA256
62eaae1d45d1072499259db197159f6581a20f5da99b40f41b79910d9e5168a0

SHA512
8a9510c17734a00cfef58b93272c182047fffa22592f646b1232dee933caa74a2d367e534b2c88b846ce93110729f54588e48d61f6125ef47556079238d38653

Download Submit
C:\Windows\System\ypfcoue.exe

Filesize
1.9MB

MD5
2cfb274a0c128edf717f5b9af9d67de5

SHA1
482cad7652993ee27acb103c45f72801964e6ebe

SHA256
df3ee6469a5c0f5ecea497450729261f806435bbc9fc2dcb7a2cf13b38e09f2d

SHA512
8d28afe8c0ef1d0eeaf1ae233a9e6277be0ab876c3249bdf2f5e3ea020a23399f8a198072ef4c842d25478d23035119e3a36ff2b40abfcfba2ad916fef6d45ba

Download Submit
C:\Windows\System\zFrrvTp.exe

Filesize
1.9MB

MD5
a7a7b44e6dc3f7df75debea223f74287

SHA1
e57eb9fc2ec38ee8b6cd7db399948cc953093bd1

SHA256
b98f4ac7764ec5c925c64060da1b9e206ff81d48a7655e7fe1b11c22434fda76

SHA512
d75c13ea4e4c673280bab2f58aff54e2a19fb9003fbb64623c9fb4d265268906cb3c66e6fc1eed12863840b0b38fc619bd2a7487fb1a77ca09bca6a573ea508f

Download Submit
C:\Windows\System\zjCTNQc.exe

Filesize
1.9MB

MD5
76a9fd6053fc63aa6fa63599002ff682

SHA1
b6128280a57c656dc202dbc67f3dbea59b0fcc94

SHA256
ed26209174a84877f0e5fdad9639abc4ae6970ea32bb3a110218676b749a55fe

SHA512
833dd689fa17d31250f3d0145d9ebdad1bcf71372b583fe68f2f7e1492489840595cc0ffe528f71a04ff55a2b0d578a37ab338fc65a8985bf01128013e10af69

Download Submit
memory/712-35-0x00007FF7EE680000-0x00007FF7EEA72000-memory.dmp

Filesize
3.9MB

Download
memory/1244-87-0x00007FF693FF0000-0x00007FF6943E2000-memory.dmp

Filesize
3.9MB

Download
memory/1456-14-0x00007FF699280000-0x00007FF699672000-memory.dmp

Filesize
3.9MB

Download
memory/1504-96-0x00007FF7C4BE0000-0x00007FF7C4FD2000-memory.dmp

Filesize
3.9MB

Download
memory/1504-4919-0x00007FF7C4BE0000-0x00007FF7C4FD2000-memory.dmp

Filesize
3.9MB

Download
memory/1640-74-0x00007FF6BB4D0000-0x00007FF6BB8C2000-memory.dmp

Filesize
3.9MB

Download
memory/1844-184-0x00007FF65D1B0000-0x00007FF65D5A2000-memory.dmp

Filesize
3.9MB

Download
memory/1844-4977-0x00007FF65D1B0000-0x00007FF65D5A2000-memory.dmp

Filesize
3.9MB

Download
memory/1892-4949-0x00007FF7C6680000-0x00007FF7C6A72000-memory.dmp

Filesize
3.9MB

Download
memory/1892-148-0x00007FF7C6680000-0x00007FF7C6A72000-memory.dmp

Filesize
3.9MB

Download
memory/2100-95-0x00007FF6424B0000-0x00007FF6428A2000-memory.dmp

Filesize
3.9MB

Download
memory/2100-4926-0x00007FF6424B0000-0x00007FF6428A2000-memory.dmp

Filesize
3.9MB

Download
memory/2248-1-0x0000028C50750000-0x0000028C50760000-memory.dmp

Filesize
64KB

Download
memory/2248-0-0x00007FF72C570000-0x00007FF72C962000-memory.dmp

Filesize
3.9MB

Download
memory/2776-118-0x00007FF768E60000-0x00007FF769252000-memory.dmp

Filesize
3.9MB

Download
memory/2776-4938-0x00007FF768E60000-0x00007FF769252000-memory.dmp

Filesize
3.9MB

Download
memory/2848-78-0x00007FF7752F0000-0x00007FF7756E2000-memory.dmp

Filesize
3.9MB

Download
memory/3252-119-0x00007FF757DA0000-0x00007FF758192000-memory.dmp

Filesize
3.9MB

Download
memory/3296-147-0x00007FF6D7BD0000-0x00007FF6D7FC2000-memory.dmp

Filesize
3.9MB

Download
memory/3296-4930-0x00007FF6D7BD0000-0x00007FF6D7FC2000-memory.dmp

Filesize
3.9MB

Download
memory/3456-165-0x00007FF6BE670000-0x00007FF6BEA62000-memory.dmp

Filesize
3.9MB

Download
memory/3468-47-0x00007FF6BF870000-0x00007FF6BFC62000-memory.dmp

Filesize
3.9MB

Download
memory/3600-154-0x00007FF71A1D0000-0x00007FF71A5C2000-memory.dmp

Filesize
3.9MB

Download
memory/3640-178-0x00007FF695100000-0x00007FF6954F2000-memory.dmp

Filesize
3.9MB

Download
memory/3724-4965-0x00007FF6C2820000-0x00007FF6C2C12000-memory.dmp

Filesize
3.9MB

Download
memory/3724-166-0x00007FF6C2820000-0x00007FF6C2C12000-memory.dmp

Filesize
3.9MB

Download
memory/4348-104-0x00007FF69F620000-0x00007FF69FA12000-memory.dmp

Filesize
3.9MB

Download
memory/4416-172-0x00007FF76F760000-0x00007FF76FB52000-memory.dmp

Filesize
3.9MB

Download
memory/4504-59-0x00007FF7DA630000-0x00007FF7DAA22000-memory.dmp

Filesize
3.9MB

Download
memory/4616-137-0x00007FF87EE20000-0x00007FF87F8E1000-memory.dmp

Filesize
10.8MB

Download
memory/4616-36-0x000002C2B6C10000-0x000002C2B6C20000-memory.dmp

Filesize
64KB

Download
memory/4616-37-0x000002C2B6C10000-0x000002C2B6C20000-memory.dmp

Filesize
64KB

Download
memory/4616-114-0x000002C2CF1B0000-0x000002C2CF1D2000-memory.dmp

Filesize
136KB

Download
memory/5100-141-0x00007FF723DB0000-0x00007FF7241A2000-memory.dmp

Filesize
3.9MB

Download