xmrig | 7488419775b1c9ff234248915ed8345dacac700de444774cc95e4cdf925efd09

Analysis

max time kernel
135s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 09:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
Size

2.2MB
MD5

04e66b44b27cbfb8672e5c6f98d9b0ad
SHA1

929f3c6340eda3083bef26cfae68ae86263f7e8e
SHA256

7488419775b1c9ff234248915ed8345dacac700de444774cc95e4cdf925efd09
SHA512

7cabd95d11e10c69b1c46f7daf2eabd4c027c47be6fbdf5e6a9fc786b3f70040e7b199cbc126aa8334be66f3efbeffc06047e7605042dd8a4146f0d75a9fd309
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfl:NABS

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/memory/2560-186-0x00007FF7B7E10000-0x00007FF7B8202000-memory.dmp	xmrig
behavioral2/memory/3928-183-0x00007FF687690000-0x00007FF687A82000-memory.dmp	xmrig
behavioral2/memory/1400-139-0x00007FF6D1260000-0x00007FF6D1652000-memory.dmp	xmrig
behavioral2/memory/632-115-0x00007FF79BD00000-0x00007FF79C0F2000-memory.dmp	xmrig
behavioral2/memory/1512-218-0x00007FF6F4D30000-0x00007FF6F5122000-memory.dmp	xmrig
behavioral2/memory/4932-231-0x00007FF7131B0000-0x00007FF7135A2000-memory.dmp	xmrig
behavioral2/memory/1428-201-0x00007FF69E3E0000-0x00007FF69E7D2000-memory.dmp	xmrig
behavioral2/memory/3976-258-0x00007FF725ED0000-0x00007FF7262C2000-memory.dmp	xmrig
behavioral2/memory/4428-429-0x00007FF623120000-0x00007FF623512000-memory.dmp	xmrig
behavioral2/memory/4516-380-0x00007FF6F7470000-0x00007FF6F7862000-memory.dmp	xmrig
behavioral2/memory/3476-360-0x00007FF73E510000-0x00007FF73E902000-memory.dmp	xmrig
behavioral2/memory/2504-324-0x00007FF6F3D00000-0x00007FF6F40F2000-memory.dmp	xmrig
behavioral2/memory/4000-306-0x00007FF6D5D10000-0x00007FF6D6102000-memory.dmp	xmrig
behavioral2/memory/2328-289-0x00007FF746EB0000-0x00007FF7472A2000-memory.dmp	xmrig
behavioral2/memory/4044-274-0x00007FF6BA7A0000-0x00007FF6BAB92000-memory.dmp	xmrig
behavioral2/memory/2028-244-0x00007FF68EBC0000-0x00007FF68EFB2000-memory.dmp	xmrig
behavioral2/memory/112-5683-0x00007FF6CC7F0000-0x00007FF6CCBE2000-memory.dmp	xmrig
behavioral2/memory/3928-5701-0x00007FF687690000-0x00007FF687A82000-memory.dmp	xmrig
behavioral2/memory/1400-5704-0x00007FF6D1260000-0x00007FF6D1652000-memory.dmp	xmrig
behavioral2/memory/1512-5721-0x00007FF6F4D30000-0x00007FF6F5122000-memory.dmp	xmrig
behavioral2/memory/632-5737-0x00007FF79BD00000-0x00007FF79C0F2000-memory.dmp	xmrig
behavioral2/memory/4932-5729-0x00007FF7131B0000-0x00007FF7135A2000-memory.dmp	xmrig
behavioral2/memory/2028-5741-0x00007FF68EBC0000-0x00007FF68EFB2000-memory.dmp	xmrig
behavioral2/memory/2504-5753-0x00007FF6F3D00000-0x00007FF6F40F2000-memory.dmp	xmrig
behavioral2/memory/2328-5773-0x00007FF746EB0000-0x00007FF7472A2000-memory.dmp	xmrig
behavioral2/memory/4428-5768-0x00007FF623120000-0x00007FF623512000-memory.dmp	xmrig
behavioral2/memory/4516-5746-0x00007FF6F7470000-0x00007FF6F7862000-memory.dmp	xmrig
behavioral2/memory/3476-5726-0x00007FF73E510000-0x00007FF73E902000-memory.dmp	xmrig
behavioral2/memory/4044-5725-0x00007FF6BA7A0000-0x00007FF6BAB92000-memory.dmp	xmrig
behavioral2/memory/4000-5718-0x00007FF6D5D10000-0x00007FF6D6102000-memory.dmp	xmrig
behavioral2/memory/2560-5712-0x00007FF7B7E10000-0x00007FF7B8202000-memory.dmp	xmrig
behavioral2/memory/1428-5709-0x00007FF69E3E0000-0x00007FF69E7D2000-memory.dmp	xmrig
behavioral2/memory/5000-7036-0x00007FF683370000-0x00007FF683762000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
112	cArLOKr.exe
3292	RufHtjp.exe
4396	sJihNsq.exe
632	pecsPrk.exe
1400	klUTAmf.exe
3928	GoomXZd.exe
3424	BYeOWCx.exe
2560	OMhkhWq.exe
1428	qHfLaqy.exe
1512	FUlzfjB.exe
4932	RiGuXOZ.exe
2028	lMDPlTv.exe
3976	TecIGYk.exe
4044	IMLhsLu.exe
2328	CpbHDCH.exe
4000	hTDBIcD.exe
2504	kVDOUWG.exe
1252	szkOLDx.exe
3476	IpisSSC.exe
4516	UXaQBEC.exe
4428	IcsNlFz.exe
2252	wrSsjrR.exe
1852	nGyBEHR.exe
4812	alwbvdX.exe
1928	SnYuULS.exe
3448	UOjhQmx.exe
4244	BXxBVCt.exe
4004	awuLTQZ.exe
1580	BRAFbmH.exe
1780	RYFWMaH.exe
3336	vHDjOlr.exe
4836	wcLFJKD.exe
868	ftbGOZY.exe
4800	gEszPGO.exe
3124	QRoJarP.exe
2492	ntAPzbF.exe
1836	uGUmgGv.exe
4976	MLwdoCj.exe
512	KfEiqCU.exe
3296	MhlYlQk.exe
3968	aDoqzhL.exe
332	jlUTcXc.exe
772	dzfzlsU.exe
612	pqkZOCI.exe
3620	GYKRzqU.exe
1788	WVSwdoH.exe
3324	BMuytCd.exe
2868	JouZelz.exe
1452	nWVByHn.exe
2200	vqGTrqk.exe
1312	fIzzcBG.exe
536	jTKwOwz.exe
4124	naSLtpg.exe
912	mydQMsq.exe
2416	tcvLuyp.exe
3428	CgZbhWz.exe
4612	dafkBLt.exe
64	fjLGomo.exe
4444	dHLttVU.exe
1528	THxjAfd.exe
3784	VIvBovR.exe
3160	iIwJJTg.exe
568	dUeXMIJ.exe
4880	khNgidB.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5000-0-0x00007FF683370000-0x00007FF683762000-memory.dmp	upx
behavioral2/files/0x000b000000023ba7-5.dat	upx
behavioral2/files/0x000a000000023bac-7.dat	upx
behavioral2/files/0x000a000000023bad-21.dat	upx
behavioral2/files/0x000a000000023bb2-45.dat	upx
behavioral2/files/0x000a000000023bc9-155.dat	upx
behavioral2/files/0x000a000000023bce-195.dat	upx
behavioral2/files/0x000a000000023bc8-194.dat	upx
behavioral2/memory/2560-186-0x00007FF7B7E10000-0x00007FF7B8202000-memory.dmp	upx
behavioral2/memory/3928-183-0x00007FF687690000-0x00007FF687A82000-memory.dmp	upx
behavioral2/files/0x000a000000023bcd-182.dat	upx
behavioral2/files/0x000b000000023ba8-179.dat	upx
behavioral2/files/0x000a000000023bc6-178.dat	upx
behavioral2/files/0x000a000000023bcb-169.dat	upx
behavioral2/files/0x000a000000023bc0-168.dat	upx
behavioral2/files/0x000a000000023bc5-166.dat	upx
behavioral2/files/0x000a000000023bba-135.dat	upx
behavioral2/files/0x0031000000023bbf-159.dat	upx
behavioral2/files/0x000a000000023bca-158.dat	upx
behavioral2/files/0x0031000000023bbe-151.dat	upx
behavioral2/files/0x000a000000023bc7-187.dat	upx
behavioral2/files/0x000a000000023bc1-143.dat	upx
behavioral2/files/0x000a000000023bbb-140.dat	upx
behavioral2/memory/1400-139-0x00007FF6D1260000-0x00007FF6D1652000-memory.dmp	upx
behavioral2/files/0x000a000000023bc4-132.dat	upx
behavioral2/files/0x000a000000023bc3-131.dat	upx
behavioral2/files/0x000a000000023bb8-129.dat	upx
behavioral2/files/0x0031000000023bbd-124.dat	upx
behavioral2/files/0x000a000000023bc2-123.dat	upx
behavioral2/files/0x000a000000023bb5-118.dat	upx
behavioral2/memory/632-115-0x00007FF79BD00000-0x00007FF79C0F2000-memory.dmp	upx
behavioral2/files/0x000a000000023bb9-108.dat	upx
behavioral2/files/0x000a000000023bb3-105.dat	upx
behavioral2/files/0x000a000000023bb7-99.dat	upx
behavioral2/files/0x000a000000023bbc-92.dat	upx
behavioral2/files/0x000a000000023bb4-85.dat	upx
behavioral2/files/0x000a000000023bb6-70.dat	upx
behavioral2/files/0x000a000000023bb1-61.dat	upx
behavioral2/files/0x000a000000023bb0-56.dat	upx
behavioral2/files/0x000a000000023bae-29.dat	upx
behavioral2/memory/3292-28-0x00007FF77AA70000-0x00007FF77AE62000-memory.dmp	upx
behavioral2/files/0x000a000000023baf-27.dat	upx
behavioral2/files/0x000a000000023bab-22.dat	upx
behavioral2/memory/112-17-0x00007FF6CC7F0000-0x00007FF6CCBE2000-memory.dmp	upx
behavioral2/memory/1512-218-0x00007FF6F4D30000-0x00007FF6F5122000-memory.dmp	upx
behavioral2/memory/4932-231-0x00007FF7131B0000-0x00007FF7135A2000-memory.dmp	upx
behavioral2/memory/1428-201-0x00007FF69E3E0000-0x00007FF69E7D2000-memory.dmp	upx
behavioral2/memory/3976-258-0x00007FF725ED0000-0x00007FF7262C2000-memory.dmp	upx
behavioral2/memory/4428-429-0x00007FF623120000-0x00007FF623512000-memory.dmp	upx
behavioral2/memory/4516-380-0x00007FF6F7470000-0x00007FF6F7862000-memory.dmp	upx
behavioral2/memory/3476-360-0x00007FF73E510000-0x00007FF73E902000-memory.dmp	upx
behavioral2/memory/2504-324-0x00007FF6F3D00000-0x00007FF6F40F2000-memory.dmp	upx
behavioral2/memory/4000-306-0x00007FF6D5D10000-0x00007FF6D6102000-memory.dmp	upx
behavioral2/memory/2328-289-0x00007FF746EB0000-0x00007FF7472A2000-memory.dmp	upx
behavioral2/memory/4044-274-0x00007FF6BA7A0000-0x00007FF6BAB92000-memory.dmp	upx
behavioral2/memory/2028-244-0x00007FF68EBC0000-0x00007FF68EFB2000-memory.dmp	upx
behavioral2/memory/112-5683-0x00007FF6CC7F0000-0x00007FF6CCBE2000-memory.dmp	upx
behavioral2/memory/3928-5701-0x00007FF687690000-0x00007FF687A82000-memory.dmp	upx
behavioral2/memory/1400-5704-0x00007FF6D1260000-0x00007FF6D1652000-memory.dmp	upx
behavioral2/memory/1512-5721-0x00007FF6F4D30000-0x00007FF6F5122000-memory.dmp	upx
behavioral2/memory/632-5737-0x00007FF79BD00000-0x00007FF79C0F2000-memory.dmp	upx
behavioral2/memory/4932-5729-0x00007FF7131B0000-0x00007FF7135A2000-memory.dmp	upx
behavioral2/memory/2028-5741-0x00007FF68EBC0000-0x00007FF68EFB2000-memory.dmp	upx
behavioral2/memory/2504-5753-0x00007FF6F3D00000-0x00007FF6F40F2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\aSEXQsF.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\MoPeKuN.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\ggJTWjR.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\rpDXYks.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\SPxkpCd.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\AJITLJo.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\NKoXuhc.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\eOINRGH.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\OPJfYPX.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\rioNPZK.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\fhkFJYy.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\jYyVmCp.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\FprbIBA.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\OQHNqiQ.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\HFEtDZh.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\cskaovw.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\kykNbFx.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\PKfxZZw.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\MiSCNrB.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\szcBanL.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\szcqvaK.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\iwOClqM.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\oXtxuON.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\cGeYCoZ.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\sGUqmRG.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\jTBBNSk.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\jqINGlM.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\BodaYlH.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\jMUdLXF.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\MAGIYtV.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\fvfttxE.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\LutbMkY.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\hemfDZV.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\eBMBGTF.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\BkrMKtc.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\LstiJHM.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\PkhMiAi.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\lQMWqNY.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\iPAiqqG.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\bPueUjp.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\lqhBvYB.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\valwsVk.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\XVxLptE.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\MpTpjCc.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\RALJoWf.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\OteEClW.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\sDrSbCt.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\snzWsSH.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\XBCzfbq.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\KOxLGrF.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\qvmpQtL.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\bSqiLvu.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\dAanUod.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\vxqSlKY.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\mZMarOz.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\upqhSMD.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\EZBAIXh.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\odNyVdg.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\YKeIWCB.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\UBzeKco.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\oswJorK.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\DlsTFjz.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\LRvmzAS.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
File created	C:\Windows\System\XoofIxW.exe	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1680	powershell.exe
1680	powershell.exe
1680	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1680	powershell.exe
Token: SeLockMemoryPrivilege	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 1680	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	86
PID 5000 wrote to memory of 1680	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	86
PID 5000 wrote to memory of 112	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	87
PID 5000 wrote to memory of 112	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	87
PID 5000 wrote to memory of 3292	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	88
PID 5000 wrote to memory of 3292	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	88
PID 5000 wrote to memory of 4396	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	89
PID 5000 wrote to memory of 4396	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	89
PID 5000 wrote to memory of 632	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	90
PID 5000 wrote to memory of 632	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	90
PID 5000 wrote to memory of 1400	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	91
PID 5000 wrote to memory of 1400	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	91
PID 5000 wrote to memory of 3928	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	92
PID 5000 wrote to memory of 3928	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	92
PID 5000 wrote to memory of 3424	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	93
PID 5000 wrote to memory of 3424	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	93
PID 5000 wrote to memory of 2560	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	94
PID 5000 wrote to memory of 2560	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	94
PID 5000 wrote to memory of 1428	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	95
PID 5000 wrote to memory of 1428	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	95
PID 5000 wrote to memory of 1512	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	96
PID 5000 wrote to memory of 1512	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	96
PID 5000 wrote to memory of 4932	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	97
PID 5000 wrote to memory of 4932	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	97
PID 5000 wrote to memory of 2028	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	98
PID 5000 wrote to memory of 2028	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	98
PID 5000 wrote to memory of 3976	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	99
PID 5000 wrote to memory of 3976	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	99
PID 5000 wrote to memory of 4044	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	100
PID 5000 wrote to memory of 4044	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	100
PID 5000 wrote to memory of 2328	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	101
PID 5000 wrote to memory of 2328	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	101
PID 5000 wrote to memory of 4000	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	102
PID 5000 wrote to memory of 4000	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	102
PID 5000 wrote to memory of 2504	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	103
PID 5000 wrote to memory of 2504	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	103
PID 5000 wrote to memory of 1252	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	104
PID 5000 wrote to memory of 1252	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	104
PID 5000 wrote to memory of 3476	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	105
PID 5000 wrote to memory of 3476	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	105
PID 5000 wrote to memory of 4516	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	106
PID 5000 wrote to memory of 4516	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	106
PID 5000 wrote to memory of 4428	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	107
PID 5000 wrote to memory of 4428	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	107
PID 5000 wrote to memory of 2252	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	108
PID 5000 wrote to memory of 2252	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	108
PID 5000 wrote to memory of 1852	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	109
PID 5000 wrote to memory of 1852	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	109
PID 5000 wrote to memory of 4812	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	110
PID 5000 wrote to memory of 4812	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	110
PID 5000 wrote to memory of 1928	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	111
PID 5000 wrote to memory of 1928	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	111
PID 5000 wrote to memory of 3448	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	112
PID 5000 wrote to memory of 3448	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	112
PID 5000 wrote to memory of 4244	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	113
PID 5000 wrote to memory of 4244	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	113
PID 5000 wrote to memory of 3336	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	114
PID 5000 wrote to memory of 3336	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	114
PID 5000 wrote to memory of 868	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	115
PID 5000 wrote to memory of 868	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	115
PID 5000 wrote to memory of 4004	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	116
PID 5000 wrote to memory of 4004	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	116
PID 5000 wrote to memory of 2492	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	117
PID 5000 wrote to memory of 2492	5000	04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe	117

C:\Users\Admin\AppData\Local\Temp\04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\04e66b44b27cbfb8672e5c6f98d9b0ad_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1680
- C:\Windows\System\cArLOKr.exe
  C:\Windows\System\cArLOKr.exe
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\System\RufHtjp.exe
  C:\Windows\System\RufHtjp.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\sJihNsq.exe
  C:\Windows\System\sJihNsq.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\pecsPrk.exe
  C:\Windows\System\pecsPrk.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\klUTAmf.exe
  C:\Windows\System\klUTAmf.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\GoomXZd.exe
  C:\Windows\System\GoomXZd.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\BYeOWCx.exe
  C:\Windows\System\BYeOWCx.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System\OMhkhWq.exe
  C:\Windows\System\OMhkhWq.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\qHfLaqy.exe
  C:\Windows\System\qHfLaqy.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\FUlzfjB.exe
  C:\Windows\System\FUlzfjB.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\RiGuXOZ.exe
  C:\Windows\System\RiGuXOZ.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\lMDPlTv.exe
  C:\Windows\System\lMDPlTv.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\TecIGYk.exe
  C:\Windows\System\TecIGYk.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\IMLhsLu.exe
  C:\Windows\System\IMLhsLu.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\CpbHDCH.exe
  C:\Windows\System\CpbHDCH.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\hTDBIcD.exe
  C:\Windows\System\hTDBIcD.exe
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Windows\System\kVDOUWG.exe
  C:\Windows\System\kVDOUWG.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\szkOLDx.exe
  C:\Windows\System\szkOLDx.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\IpisSSC.exe
  C:\Windows\System\IpisSSC.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\UXaQBEC.exe
  C:\Windows\System\UXaQBEC.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\IcsNlFz.exe
  C:\Windows\System\IcsNlFz.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\wrSsjrR.exe
  C:\Windows\System\wrSsjrR.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\nGyBEHR.exe
  C:\Windows\System\nGyBEHR.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\alwbvdX.exe
  C:\Windows\System\alwbvdX.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\SnYuULS.exe
  C:\Windows\System\SnYuULS.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\UOjhQmx.exe
  C:\Windows\System\UOjhQmx.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\BXxBVCt.exe
  C:\Windows\System\BXxBVCt.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\vHDjOlr.exe
  C:\Windows\System\vHDjOlr.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\ftbGOZY.exe
  C:\Windows\System\ftbGOZY.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\awuLTQZ.exe
  C:\Windows\System\awuLTQZ.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\ntAPzbF.exe
  C:\Windows\System\ntAPzbF.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\BRAFbmH.exe
  C:\Windows\System\BRAFbmH.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\RYFWMaH.exe
  C:\Windows\System\RYFWMaH.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\wcLFJKD.exe
  C:\Windows\System\wcLFJKD.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\pqkZOCI.exe
  C:\Windows\System\pqkZOCI.exe
  2⤵
  - Executes dropped EXE
  PID:612
- C:\Windows\System\gEszPGO.exe
  C:\Windows\System\gEszPGO.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\QRoJarP.exe
  C:\Windows\System\QRoJarP.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\uGUmgGv.exe
  C:\Windows\System\uGUmgGv.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\MLwdoCj.exe
  C:\Windows\System\MLwdoCj.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\KfEiqCU.exe
  C:\Windows\System\KfEiqCU.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\MhlYlQk.exe
  C:\Windows\System\MhlYlQk.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\aDoqzhL.exe
  C:\Windows\System\aDoqzhL.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\jlUTcXc.exe
  C:\Windows\System\jlUTcXc.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\dzfzlsU.exe
  C:\Windows\System\dzfzlsU.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\GYKRzqU.exe
  C:\Windows\System\GYKRzqU.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\WVSwdoH.exe
  C:\Windows\System\WVSwdoH.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\BMuytCd.exe
  C:\Windows\System\BMuytCd.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\JouZelz.exe
  C:\Windows\System\JouZelz.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\nWVByHn.exe
  C:\Windows\System\nWVByHn.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\vqGTrqk.exe
  C:\Windows\System\vqGTrqk.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\fIzzcBG.exe
  C:\Windows\System\fIzzcBG.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\jTKwOwz.exe
  C:\Windows\System\jTKwOwz.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\naSLtpg.exe
  C:\Windows\System\naSLtpg.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\mydQMsq.exe
  C:\Windows\System\mydQMsq.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\tcvLuyp.exe
  C:\Windows\System\tcvLuyp.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\CgZbhWz.exe
  C:\Windows\System\CgZbhWz.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\dafkBLt.exe
  C:\Windows\System\dafkBLt.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\fjLGomo.exe
  C:\Windows\System\fjLGomo.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\dHLttVU.exe
  C:\Windows\System\dHLttVU.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\THxjAfd.exe
  C:\Windows\System\THxjAfd.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\VIvBovR.exe
  C:\Windows\System\VIvBovR.exe
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\System\iIwJJTg.exe
  C:\Windows\System\iIwJJTg.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\dUeXMIJ.exe
  C:\Windows\System\dUeXMIJ.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\khNgidB.exe
  C:\Windows\System\khNgidB.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\jHiOidz.exe
  C:\Windows\System\jHiOidz.exe
  2⤵
  PID:3468
- C:\Windows\System\cYoCbnt.exe
  C:\Windows\System\cYoCbnt.exe
  2⤵
  PID:2648
- C:\Windows\System\YuHzNex.exe
  C:\Windows\System\YuHzNex.exe
  2⤵
  PID:548
- C:\Windows\System\QxDQQkx.exe
  C:\Windows\System\QxDQQkx.exe
  2⤵
  PID:4760
- C:\Windows\System\MzcQjHR.exe
  C:\Windows\System\MzcQjHR.exe
  2⤵
  PID:4984
- C:\Windows\System\oqWGiiP.exe
  C:\Windows\System\oqWGiiP.exe
  2⤵
  PID:4556
- C:\Windows\System\oLDxGUs.exe
  C:\Windows\System\oLDxGUs.exe
  2⤵
  PID:3864
- C:\Windows\System\gjVrckQ.exe
  C:\Windows\System\gjVrckQ.exe
  2⤵
  PID:1328
- C:\Windows\System\uGLnllA.exe
  C:\Windows\System\uGLnllA.exe
  2⤵
  PID:2480
- C:\Windows\System\ImwzgXm.exe
  C:\Windows\System\ImwzgXm.exe
  2⤵
  PID:2748
- C:\Windows\System\UtlleZW.exe
  C:\Windows\System\UtlleZW.exe
  2⤵
  PID:3860
- C:\Windows\System\SEhqjmi.exe
  C:\Windows\System\SEhqjmi.exe
  2⤵
  PID:3636
- C:\Windows\System\xRNPoqD.exe
  C:\Windows\System\xRNPoqD.exe
  2⤵
  PID:4212
- C:\Windows\System\mpfOkrh.exe
  C:\Windows\System\mpfOkrh.exe
  2⤵
  PID:2736
- C:\Windows\System\wqmRUie.exe
  C:\Windows\System\wqmRUie.exe
  2⤵
  PID:2812
- C:\Windows\System\jRLnYWA.exe
  C:\Windows\System\jRLnYWA.exe
  2⤵
  PID:1004
- C:\Windows\System\ZTDrCJj.exe
  C:\Windows\System\ZTDrCJj.exe
  2⤵
  PID:3456
- C:\Windows\System\RFOgxHR.exe
  C:\Windows\System\RFOgxHR.exe
  2⤵
  PID:1940
- C:\Windows\System\EPLywxf.exe
  C:\Windows\System\EPLywxf.exe
  2⤵
  PID:4364
- C:\Windows\System\pHactCj.exe
  C:\Windows\System\pHactCj.exe
  2⤵
  PID:3988
- C:\Windows\System\QURUIth.exe
  C:\Windows\System\QURUIth.exe
  2⤵
  PID:3192
- C:\Windows\System\QAXyIPV.exe
  C:\Windows\System\QAXyIPV.exe
  2⤵
  PID:4252
- C:\Windows\System\qQoHiZm.exe
  C:\Windows\System\qQoHiZm.exe
  2⤵
  PID:2372
- C:\Windows\System\ijaFFKZ.exe
  C:\Windows\System\ijaFFKZ.exe
  2⤵
  PID:3732
- C:\Windows\System\KKMahbn.exe
  C:\Windows\System\KKMahbn.exe
  2⤵
  PID:1636
- C:\Windows\System\ZlCUbsI.exe
  C:\Windows\System\ZlCUbsI.exe
  2⤵
  PID:4220
- C:\Windows\System\afWkyvX.exe
  C:\Windows\System\afWkyvX.exe
  2⤵
  PID:2668
- C:\Windows\System\rjCtbwS.exe
  C:\Windows\System\rjCtbwS.exe
  2⤵
  PID:4100
- C:\Windows\System\KrOvkvw.exe
  C:\Windows\System\KrOvkvw.exe
  2⤵
  PID:5124
- C:\Windows\System\HVLryYz.exe
  C:\Windows\System\HVLryYz.exe
  2⤵
  PID:5148
- C:\Windows\System\AVaAaPe.exe
  C:\Windows\System\AVaAaPe.exe
  2⤵
  PID:5168
- C:\Windows\System\LmJVGzM.exe
  C:\Windows\System\LmJVGzM.exe
  2⤵
  PID:5192
- C:\Windows\System\zTObZCE.exe
  C:\Windows\System\zTObZCE.exe
  2⤵
  PID:5212
- C:\Windows\System\xniwRjh.exe
  C:\Windows\System\xniwRjh.exe
  2⤵
  PID:5232
- C:\Windows\System\PNWisRJ.exe
  C:\Windows\System\PNWisRJ.exe
  2⤵
  PID:5252
- C:\Windows\System\PDMJMIJ.exe
  C:\Windows\System\PDMJMIJ.exe
  2⤵
  PID:5316
- C:\Windows\System\LJEkuIS.exe
  C:\Windows\System\LJEkuIS.exe
  2⤵
  PID:5336
- C:\Windows\System\TAGEIEC.exe
  C:\Windows\System\TAGEIEC.exe
  2⤵
  PID:5356
- C:\Windows\System\xLDMATF.exe
  C:\Windows\System\xLDMATF.exe
  2⤵
  PID:5380
- C:\Windows\System\ZLhADeR.exe
  C:\Windows\System\ZLhADeR.exe
  2⤵
  PID:5396
- C:\Windows\System\uCnByWi.exe
  C:\Windows\System\uCnByWi.exe
  2⤵
  PID:5416
- C:\Windows\System\jxjWVVG.exe
  C:\Windows\System\jxjWVVG.exe
  2⤵
  PID:5440
- C:\Windows\System\UXKDfyC.exe
  C:\Windows\System\UXKDfyC.exe
  2⤵
  PID:5460
- C:\Windows\System\LOwGutz.exe
  C:\Windows\System\LOwGutz.exe
  2⤵
  PID:5480
- C:\Windows\System\szNajZK.exe
  C:\Windows\System\szNajZK.exe
  2⤵
  PID:5496
- C:\Windows\System\ZQkxJTR.exe
  C:\Windows\System\ZQkxJTR.exe
  2⤵
  PID:5520
- C:\Windows\System\jYNPKrS.exe
  C:\Windows\System\jYNPKrS.exe
  2⤵
  PID:5540
- C:\Windows\System\HWdlOPC.exe
  C:\Windows\System\HWdlOPC.exe
  2⤵
  PID:5560
- C:\Windows\System\YwFkMWC.exe
  C:\Windows\System\YwFkMWC.exe
  2⤵
  PID:5584
- C:\Windows\System\JoGYbQf.exe
  C:\Windows\System\JoGYbQf.exe
  2⤵
  PID:5608
- C:\Windows\System\QbFVFnq.exe
  C:\Windows\System\QbFVFnq.exe
  2⤵
  PID:5632
- C:\Windows\System\DLbembu.exe
  C:\Windows\System\DLbembu.exe
  2⤵
  PID:5652
- C:\Windows\System\PpCEXwP.exe
  C:\Windows\System\PpCEXwP.exe
  2⤵
  PID:5672
- C:\Windows\System\LGuYWNO.exe
  C:\Windows\System\LGuYWNO.exe
  2⤵
  PID:5696
- C:\Windows\System\WoXdswO.exe
  C:\Windows\System\WoXdswO.exe
  2⤵
  PID:5716
- C:\Windows\System\vfkctVY.exe
  C:\Windows\System\vfkctVY.exe
  2⤵
  PID:5740
- C:\Windows\System\XnZAxph.exe
  C:\Windows\System\XnZAxph.exe
  2⤵
  PID:5756
- C:\Windows\System\bhEHfnD.exe
  C:\Windows\System\bhEHfnD.exe
  2⤵
  PID:5776
- C:\Windows\System\FSntWdi.exe
  C:\Windows\System\FSntWdi.exe
  2⤵
  PID:5796
- C:\Windows\System\mmSeUhj.exe
  C:\Windows\System\mmSeUhj.exe
  2⤵
  PID:5816
- C:\Windows\System\BuwNsrT.exe
  C:\Windows\System\BuwNsrT.exe
  2⤵
  PID:5836
- C:\Windows\System\yuDZLHa.exe
  C:\Windows\System\yuDZLHa.exe
  2⤵
  PID:5864
- C:\Windows\System\uDVOoVs.exe
  C:\Windows\System\uDVOoVs.exe
  2⤵
  PID:5880
- C:\Windows\System\CRpapCG.exe
  C:\Windows\System\CRpapCG.exe
  2⤵
  PID:5908
- C:\Windows\System\iBPNMNq.exe
  C:\Windows\System\iBPNMNq.exe
  2⤵
  PID:5924
- C:\Windows\System\icQIBbO.exe
  C:\Windows\System\icQIBbO.exe
  2⤵
  PID:5940
- C:\Windows\System\SlaLKfV.exe
  C:\Windows\System\SlaLKfV.exe
  2⤵
  PID:5964
- C:\Windows\System\EfbEqqm.exe
  C:\Windows\System\EfbEqqm.exe
  2⤵
  PID:5988
- C:\Windows\System\iafxafJ.exe
  C:\Windows\System\iafxafJ.exe
  2⤵
  PID:6012
- C:\Windows\System\FUdDDEn.exe
  C:\Windows\System\FUdDDEn.exe
  2⤵
  PID:6036
- C:\Windows\System\fthMpTS.exe
  C:\Windows\System\fthMpTS.exe
  2⤵
  PID:6060
- C:\Windows\System\wTQdrlr.exe
  C:\Windows\System\wTQdrlr.exe
  2⤵
  PID:6088
- C:\Windows\System\pNfxFKG.exe
  C:\Windows\System\pNfxFKG.exe
  2⤵
  PID:6104
- C:\Windows\System\wfHYyjp.exe
  C:\Windows\System\wfHYyjp.exe
  2⤵
  PID:6128
- C:\Windows\System\AaSjKhU.exe
  C:\Windows\System\AaSjKhU.exe
  2⤵
  PID:3092
- C:\Windows\System\GokGoOV.exe
  C:\Windows\System\GokGoOV.exe
  2⤵
  PID:4416
- C:\Windows\System\cpmAJXz.exe
  C:\Windows\System\cpmAJXz.exe
  2⤵
  PID:2076
- C:\Windows\System\PlhjPNP.exe
  C:\Windows\System\PlhjPNP.exe
  2⤵
  PID:5204
- C:\Windows\System\CaBlnQZ.exe
  C:\Windows\System\CaBlnQZ.exe
  2⤵
  PID:4600
- C:\Windows\System\sCBsksz.exe
  C:\Windows\System\sCBsksz.exe
  2⤵
  PID:2796
- C:\Windows\System\XdbptJM.exe
  C:\Windows\System\XdbptJM.exe
  2⤵
  PID:5388
- C:\Windows\System\swcwnqq.exe
  C:\Windows\System\swcwnqq.exe
  2⤵
  PID:4268
- C:\Windows\System\akWjGBa.exe
  C:\Windows\System\akWjGBa.exe
  2⤵
  PID:4020
- C:\Windows\System\KGAMjRv.exe
  C:\Windows\System\KGAMjRv.exe
  2⤵
  PID:1344
- C:\Windows\System\LZpCuos.exe
  C:\Windows\System\LZpCuos.exe
  2⤵
  PID:5580
- C:\Windows\System\hBhlqUT.exe
  C:\Windows\System\hBhlqUT.exe
  2⤵
  PID:5640
- C:\Windows\System\ROOhjVH.exe
  C:\Windows\System\ROOhjVH.exe
  2⤵
  PID:4476
- C:\Windows\System\IaOhIcl.exe
  C:\Windows\System\IaOhIcl.exe
  2⤵
  PID:5132
- C:\Windows\System\uRcqkND.exe
  C:\Windows\System\uRcqkND.exe
  2⤵
  PID:5708
- C:\Windows\System\kSbealY.exe
  C:\Windows\System\kSbealY.exe
  2⤵
  PID:5752
- C:\Windows\System\dwuBSby.exe
  C:\Windows\System\dwuBSby.exe
  2⤵
  PID:5200
- C:\Windows\System\cjRAeNn.exe
  C:\Windows\System\cjRAeNn.exe
  2⤵
  PID:5248
- C:\Windows\System\vidbdMQ.exe
  C:\Windows\System\vidbdMQ.exe
  2⤵
  PID:5876
- C:\Windows\System\dJowvOI.exe
  C:\Windows\System\dJowvOI.exe
  2⤵
  PID:6148
- C:\Windows\System\VsFuGoC.exe
  C:\Windows\System\VsFuGoC.exe
  2⤵
  PID:6168
- C:\Windows\System\YtgUxfC.exe
  C:\Windows\System\YtgUxfC.exe
  2⤵
  PID:6196
- C:\Windows\System\CtHRgfd.exe
  C:\Windows\System\CtHRgfd.exe
  2⤵
  PID:6216
- C:\Windows\System\QgvRJtR.exe
  C:\Windows\System\QgvRJtR.exe
  2⤵
  PID:6236
- C:\Windows\System\CUntywI.exe
  C:\Windows\System\CUntywI.exe
  2⤵
  PID:6256
- C:\Windows\System\PNZkgnz.exe
  C:\Windows\System\PNZkgnz.exe
  2⤵
  PID:6284
- C:\Windows\System\xnjmRAj.exe
  C:\Windows\System\xnjmRAj.exe
  2⤵
  PID:6300
- C:\Windows\System\JFqDGzZ.exe
  C:\Windows\System\JFqDGzZ.exe
  2⤵
  PID:6320
- C:\Windows\System\qbUMBFf.exe
  C:\Windows\System\qbUMBFf.exe
  2⤵
  PID:6340
- C:\Windows\System\qEtlfRz.exe
  C:\Windows\System\qEtlfRz.exe
  2⤵
  PID:6364
- C:\Windows\System\kWOSWaX.exe
  C:\Windows\System\kWOSWaX.exe
  2⤵
  PID:6388
- C:\Windows\System\CEZFXhl.exe
  C:\Windows\System\CEZFXhl.exe
  2⤵
  PID:6408
- C:\Windows\System\sHPCveU.exe
  C:\Windows\System\sHPCveU.exe
  2⤵
  PID:6436
- C:\Windows\System\GQNWRcC.exe
  C:\Windows\System\GQNWRcC.exe
  2⤵
  PID:6452
- C:\Windows\System\VArHbtZ.exe
  C:\Windows\System\VArHbtZ.exe
  2⤵
  PID:6476
- C:\Windows\System\VegDijT.exe
  C:\Windows\System\VegDijT.exe
  2⤵
  PID:6504
- C:\Windows\System\RYWxqeW.exe
  C:\Windows\System\RYWxqeW.exe
  2⤵
  PID:6528
- C:\Windows\System\ydbrqcd.exe
  C:\Windows\System\ydbrqcd.exe
  2⤵
  PID:6552
- C:\Windows\System\qBtIVLo.exe
  C:\Windows\System\qBtIVLo.exe
  2⤵
  PID:6576
- C:\Windows\System\KgFsvJL.exe
  C:\Windows\System\KgFsvJL.exe
  2⤵
  PID:6596
- C:\Windows\System\jlmxxYf.exe
  C:\Windows\System\jlmxxYf.exe
  2⤵
  PID:6624
- C:\Windows\System\QehlJkw.exe
  C:\Windows\System\QehlJkw.exe
  2⤵
  PID:6644
- C:\Windows\System\lxaDNjK.exe
  C:\Windows\System\lxaDNjK.exe
  2⤵
  PID:6664
- C:\Windows\System\vHJiOMO.exe
  C:\Windows\System\vHJiOMO.exe
  2⤵
  PID:6688
- C:\Windows\System\DYNIIWS.exe
  C:\Windows\System\DYNIIWS.exe
  2⤵
  PID:6716
- C:\Windows\System\CYKgiNW.exe
  C:\Windows\System\CYKgiNW.exe
  2⤵
  PID:6732
- C:\Windows\System\JnFwrNR.exe
  C:\Windows\System\JnFwrNR.exe
  2⤵
  PID:6752
- C:\Windows\System\RANaioQ.exe
  C:\Windows\System\RANaioQ.exe
  2⤵
  PID:6772
- C:\Windows\System\jeHwDdi.exe
  C:\Windows\System\jeHwDdi.exe
  2⤵
  PID:6800
- C:\Windows\System\gLcVuxc.exe
  C:\Windows\System\gLcVuxc.exe
  2⤵
  PID:6824
- C:\Windows\System\cPEoMun.exe
  C:\Windows\System\cPEoMun.exe
  2⤵
  PID:6844
- C:\Windows\System\Fdzurcy.exe
  C:\Windows\System\Fdzurcy.exe
  2⤵
  PID:6868
- C:\Windows\System\zKUGJTe.exe
  C:\Windows\System\zKUGJTe.exe
  2⤵
  PID:6896
- C:\Windows\System\eiQCMCN.exe
  C:\Windows\System\eiQCMCN.exe
  2⤵
  PID:6912
- C:\Windows\System\ojSSIjY.exe
  C:\Windows\System\ojSSIjY.exe
  2⤵
  PID:6936
- C:\Windows\System\aJXMbOE.exe
  C:\Windows\System\aJXMbOE.exe
  2⤵
  PID:6964
- C:\Windows\System\nqlOeMX.exe
  C:\Windows\System\nqlOeMX.exe
  2⤵
  PID:6984
- C:\Windows\System\wdJVOqV.exe
  C:\Windows\System\wdJVOqV.exe
  2⤵
  PID:7000
- C:\Windows\System\rCKIuXa.exe
  C:\Windows\System\rCKIuXa.exe
  2⤵
  PID:7024
- C:\Windows\System\ahJhaYb.exe
  C:\Windows\System\ahJhaYb.exe
  2⤵
  PID:7048
- C:\Windows\System\qTxchUb.exe
  C:\Windows\System\qTxchUb.exe
  2⤵
  PID:7072
- C:\Windows\System\rxVhJmo.exe
  C:\Windows\System\rxVhJmo.exe
  2⤵
  PID:7088
- C:\Windows\System\FvYzsVq.exe
  C:\Windows\System\FvYzsVq.exe
  2⤵
  PID:7108
- C:\Windows\System\mVpZYHZ.exe
  C:\Windows\System\mVpZYHZ.exe
  2⤵
  PID:7124
- C:\Windows\System\rpXvGsH.exe
  C:\Windows\System\rpXvGsH.exe
  2⤵
  PID:7144
- C:\Windows\System\bMIiCkO.exe
  C:\Windows\System\bMIiCkO.exe
  2⤵
  PID:7164
- C:\Windows\System\OCtfvNp.exe
  C:\Windows\System\OCtfvNp.exe
  2⤵
  PID:5976
- C:\Windows\System\BmzeUNZ.exe
  C:\Windows\System\BmzeUNZ.exe
  2⤵
  PID:5552
- C:\Windows\System\ICiwkUS.exe
  C:\Windows\System\ICiwkUS.exe
  2⤵
  PID:5332
- C:\Windows\System\mLDMIlL.exe
  C:\Windows\System\mLDMIlL.exe
  2⤵
  PID:5684
- C:\Windows\System\pGkDTKE.exe
  C:\Windows\System\pGkDTKE.exe
  2⤵
  PID:5784
- C:\Windows\System\yZlMNBY.exe
  C:\Windows\System\yZlMNBY.exe
  2⤵
  PID:2844
- C:\Windows\System\WqouJcm.exe
  C:\Windows\System\WqouJcm.exe
  2⤵
  PID:5572
- C:\Windows\System\elXBHDL.exe
  C:\Windows\System\elXBHDL.exe
  2⤵
  PID:4500
- C:\Windows\System\FQMPVDh.exe
  C:\Windows\System\FQMPVDh.exe
  2⤵
  PID:5472
- C:\Windows\System\lVpdrcI.exe
  C:\Windows\System\lVpdrcI.exe
  2⤵
  PID:5792
- C:\Windows\System\AMOgOzH.exe
  C:\Windows\System\AMOgOzH.exe
  2⤵
  PID:5528
- C:\Windows\System\UoyobEi.exe
  C:\Windows\System\UoyobEi.exe
  2⤵
  PID:6008
- C:\Windows\System\OvODNQL.exe
  C:\Windows\System\OvODNQL.exe
  2⤵
  PID:6268
- C:\Windows\System\JgbmZJi.exe
  C:\Windows\System\JgbmZJi.exe
  2⤵
  PID:6100
- C:\Windows\System\yDqtPPy.exe
  C:\Windows\System\yDqtPPy.exe
  2⤵
  PID:5644
- C:\Windows\System\YnCALnf.exe
  C:\Windows\System\YnCALnf.exe
  2⤵
  PID:6356
- C:\Windows\System\mjCVfxO.exe
  C:\Windows\System\mjCVfxO.exe
  2⤵
  PID:2308
- C:\Windows\System\XxXtmWs.exe
  C:\Windows\System\XxXtmWs.exe
  2⤵
  PID:6428
- C:\Windows\System\bLBclPG.exe
  C:\Windows\System\bLBclPG.exe
  2⤵
  PID:1424
- C:\Windows\System\ntXpMXN.exe
  C:\Windows\System\ntXpMXN.exe
  2⤵
  PID:5224
- C:\Windows\System\VDabROg.exe
  C:\Windows\System\VDabROg.exe
  2⤵
  PID:5888
- C:\Windows\System\BeEdhay.exe
  C:\Windows\System\BeEdhay.exe
  2⤵
  PID:6156
- C:\Windows\System\oaHHpfM.exe
  C:\Windows\System\oaHHpfM.exe
  2⤵
  PID:6176
- C:\Windows\System\bzrvOcI.exe
  C:\Windows\System\bzrvOcI.exe
  2⤵
  PID:6684
- C:\Windows\System\JzBKJnw.exe
  C:\Windows\System\JzBKJnw.exe
  2⤵
  PID:6248
- C:\Windows\System\GOufvoq.exe
  C:\Windows\System\GOufvoq.exe
  2⤵
  PID:6820
- C:\Windows\System\zzuUJpT.exe
  C:\Windows\System\zzuUJpT.exe
  2⤵
  PID:2204
- C:\Windows\System\WnAJIUe.exe
  C:\Windows\System\WnAJIUe.exe
  2⤵
  PID:6908
- C:\Windows\System\mumVUPn.exe
  C:\Windows\System\mumVUPn.exe
  2⤵
  PID:6980
- C:\Windows\System\cVubFRm.exe
  C:\Windows\System\cVubFRm.exe
  2⤵
  PID:7016
- C:\Windows\System\dQTQfFc.exe
  C:\Windows\System\dQTQfFc.exe
  2⤵
  PID:7184
- C:\Windows\System\MtoDXpH.exe
  C:\Windows\System\MtoDXpH.exe
  2⤵
  PID:7204
- C:\Windows\System\fboVenx.exe
  C:\Windows\System\fboVenx.exe
  2⤵
  PID:7232
- C:\Windows\System\ksBWWBc.exe
  C:\Windows\System\ksBWWBc.exe
  2⤵
  PID:7248
- C:\Windows\System\vUnbEeB.exe
  C:\Windows\System\vUnbEeB.exe
  2⤵
  PID:7272
- C:\Windows\System\QOlIepF.exe
  C:\Windows\System\QOlIepF.exe
  2⤵
  PID:7296
- C:\Windows\System\QirBAau.exe
  C:\Windows\System\QirBAau.exe
  2⤵
  PID:7312
- C:\Windows\System\guAHsyo.exe
  C:\Windows\System\guAHsyo.exe
  2⤵
  PID:7336
- C:\Windows\System\cLCfmQW.exe
  C:\Windows\System\cLCfmQW.exe
  2⤵
  PID:7364
- C:\Windows\System\lIllaCJ.exe
  C:\Windows\System\lIllaCJ.exe
  2⤵
  PID:7380
- C:\Windows\System\yDNxcSH.exe
  C:\Windows\System\yDNxcSH.exe
  2⤵
  PID:7408
- C:\Windows\System\nDVrDwh.exe
  C:\Windows\System\nDVrDwh.exe
  2⤵
  PID:7436
- C:\Windows\System\AvXrefO.exe
  C:\Windows\System\AvXrefO.exe
  2⤵
  PID:7456
- C:\Windows\System\viXyHfN.exe
  C:\Windows\System\viXyHfN.exe
  2⤵
  PID:7480
- C:\Windows\System\rstyzrI.exe
  C:\Windows\System\rstyzrI.exe
  2⤵
  PID:7500
- C:\Windows\System\NFdfply.exe
  C:\Windows\System\NFdfply.exe
  2⤵
  PID:7524
- C:\Windows\System\HoWdQpf.exe
  C:\Windows\System\HoWdQpf.exe
  2⤵
  PID:7544
- C:\Windows\System\LZbZKWk.exe
  C:\Windows\System\LZbZKWk.exe
  2⤵
  PID:7572
- C:\Windows\System\skrZglX.exe
  C:\Windows\System\skrZglX.exe
  2⤵
  PID:7596
- C:\Windows\System\JfYMtOS.exe
  C:\Windows\System\JfYMtOS.exe
  2⤵
  PID:7616
- C:\Windows\System\ARpOJPD.exe
  C:\Windows\System\ARpOJPD.exe
  2⤵
  PID:7636
- C:\Windows\System\ANOlzqc.exe
  C:\Windows\System\ANOlzqc.exe
  2⤵
  PID:7656
- C:\Windows\System\fVdqbXx.exe
  C:\Windows\System\fVdqbXx.exe
  2⤵
  PID:7676
- C:\Windows\System\MxZvKwf.exe
  C:\Windows\System\MxZvKwf.exe
  2⤵
  PID:7700
- C:\Windows\System\aIDDrdB.exe
  C:\Windows\System\aIDDrdB.exe
  2⤵
  PID:7720
- C:\Windows\System\EnfrxAU.exe
  C:\Windows\System\EnfrxAU.exe
  2⤵
  PID:7740
- C:\Windows\System\GJXxuGg.exe
  C:\Windows\System\GJXxuGg.exe
  2⤵
  PID:7764
- C:\Windows\System\oOCPcOW.exe
  C:\Windows\System\oOCPcOW.exe
  2⤵
  PID:7788
- C:\Windows\System\FwZZgHv.exe
  C:\Windows\System\FwZZgHv.exe
  2⤵
  PID:7808
- C:\Windows\System\YBeUYbd.exe
  C:\Windows\System\YBeUYbd.exe
  2⤵
  PID:7828
- C:\Windows\System\GBLtldy.exe
  C:\Windows\System\GBLtldy.exe
  2⤵
  PID:7852
- C:\Windows\System\XkJsGDi.exe
  C:\Windows\System\XkJsGDi.exe
  2⤵
  PID:7876
- C:\Windows\System\fdnOSbX.exe
  C:\Windows\System\fdnOSbX.exe
  2⤵
  PID:7900
- C:\Windows\System\XnyHzTf.exe
  C:\Windows\System\XnyHzTf.exe
  2⤵
  PID:7924
- C:\Windows\System\uJAptRj.exe
  C:\Windows\System\uJAptRj.exe
  2⤵
  PID:7944
- C:\Windows\System\XCSAaqx.exe
  C:\Windows\System\XCSAaqx.exe
  2⤵
  PID:7968
- C:\Windows\System\zdYJPNb.exe
  C:\Windows\System\zdYJPNb.exe
  2⤵
  PID:7988
- C:\Windows\System\jrEnAmU.exe
  C:\Windows\System\jrEnAmU.exe
  2⤵
  PID:8012
- C:\Windows\System\TmbGvVD.exe
  C:\Windows\System\TmbGvVD.exe
  2⤵
  PID:8032
- C:\Windows\System\JsttHgY.exe
  C:\Windows\System\JsttHgY.exe
  2⤵
  PID:8056
- C:\Windows\System\RVyMoej.exe
  C:\Windows\System\RVyMoej.exe
  2⤵
  PID:8084
- C:\Windows\System\XwPHlyd.exe
  C:\Windows\System\XwPHlyd.exe
  2⤵
  PID:8104
- C:\Windows\System\sxLublm.exe
  C:\Windows\System\sxLublm.exe
  2⤵
  PID:8132
- C:\Windows\System\eUBBCZd.exe
  C:\Windows\System\eUBBCZd.exe
  2⤵
  PID:8152
- C:\Windows\System\DpHMzGq.exe
  C:\Windows\System\DpHMzGq.exe
  2⤵
  PID:8172
- C:\Windows\System\uzQSuVE.exe
  C:\Windows\System\uzQSuVE.exe
  2⤵
  PID:7064
- C:\Windows\System\iNZNxAd.exe
  C:\Windows\System\iNZNxAd.exe
  2⤵
  PID:6472
- C:\Windows\System\EYrNQuc.exe
  C:\Windows\System\EYrNQuc.exe
  2⤵
  PID:528
- C:\Windows\System\SUVYQbL.exe
  C:\Windows\System\SUVYQbL.exe
  2⤵
  PID:5324
- C:\Windows\System\BWMEuXn.exe
  C:\Windows\System\BWMEuXn.exe
  2⤵
  PID:5456
- C:\Windows\System\UCjihpR.exe
  C:\Windows\System\UCjihpR.exe
  2⤵
  PID:6640
- C:\Windows\System\dFnPEEj.exe
  C:\Windows\System\dFnPEEj.exe
  2⤵
  PID:5872
- C:\Windows\System\EtjqJIA.exe
  C:\Windows\System\EtjqJIA.exe
  2⤵
  PID:5972
- C:\Windows\System\xThFEPa.exe
  C:\Windows\System\xThFEPa.exe
  2⤵
  PID:6252
- C:\Windows\System\EdaCEbL.exe
  C:\Windows\System\EdaCEbL.exe
  2⤵
  PID:5812
- C:\Windows\System\EmHXNOf.exe
  C:\Windows\System\EmHXNOf.exe
  2⤵
  PID:5488
- C:\Windows\System\YdnIMCS.exe
  C:\Windows\System\YdnIMCS.exe
  2⤵
  PID:6876
- C:\Windows\System\LwmjhSA.exe
  C:\Windows\System\LwmjhSA.exe
  2⤵
  PID:6932
- C:\Windows\System\GcipUzD.exe
  C:\Windows\System\GcipUzD.exe
  2⤵
  PID:6904
- C:\Windows\System\wLALdiO.exe
  C:\Windows\System\wLALdiO.exe
  2⤵
  PID:7196
- C:\Windows\System\sWuhqjf.exe
  C:\Windows\System\sWuhqjf.exe
  2⤵
  PID:7256
- C:\Windows\System\ADjHFOi.exe
  C:\Windows\System\ADjHFOi.exe
  2⤵
  PID:7344
- C:\Windows\System\sCPoLyP.exe
  C:\Windows\System\sCPoLyP.exe
  2⤵
  PID:7472
- C:\Windows\System\UXKAjUz.exe
  C:\Windows\System\UXKAjUz.exe
  2⤵
  PID:5600
- C:\Windows\System\VrzczHg.exe
  C:\Windows\System\VrzczHg.exe
  2⤵
  PID:8204
- C:\Windows\System\LyRQHPz.exe
  C:\Windows\System\LyRQHPz.exe
  2⤵
  PID:8228
- C:\Windows\System\YzlTyyC.exe
  C:\Windows\System\YzlTyyC.exe
  2⤵
  PID:8248
- C:\Windows\System\oWjNotM.exe
  C:\Windows\System\oWjNotM.exe
  2⤵
  PID:8272
- C:\Windows\System\aLeKgIE.exe
  C:\Windows\System\aLeKgIE.exe
  2⤵
  PID:8288
- C:\Windows\System\zYNMaqr.exe
  C:\Windows\System\zYNMaqr.exe
  2⤵
  PID:8312
- C:\Windows\System\eOuSwye.exe
  C:\Windows\System\eOuSwye.exe
  2⤵
  PID:8340
- C:\Windows\System\BJdgEyS.exe
  C:\Windows\System\BJdgEyS.exe
  2⤵
  PID:8368
- C:\Windows\System\jMNMSBx.exe
  C:\Windows\System\jMNMSBx.exe
  2⤵
  PID:8392
- C:\Windows\System\SHRZmCB.exe
  C:\Windows\System\SHRZmCB.exe
  2⤵
  PID:8416
- C:\Windows\System\EuvSLAR.exe
  C:\Windows\System\EuvSLAR.exe
  2⤵
  PID:8436
- C:\Windows\System\wGCqDCk.exe
  C:\Windows\System\wGCqDCk.exe
  2⤵
  PID:8456
- C:\Windows\System\tqivmJM.exe
  C:\Windows\System\tqivmJM.exe
  2⤵
  PID:8476
- C:\Windows\System\yGbTQSy.exe
  C:\Windows\System\yGbTQSy.exe
  2⤵
  PID:8496
- C:\Windows\System\ezOARvC.exe
  C:\Windows\System\ezOARvC.exe
  2⤵
  PID:8520
- C:\Windows\System\josjklt.exe
  C:\Windows\System\josjklt.exe
  2⤵
  PID:8548
- C:\Windows\System\anxJZpx.exe
  C:\Windows\System\anxJZpx.exe
  2⤵
  PID:8568
- C:\Windows\System\GCsNYJs.exe
  C:\Windows\System\GCsNYJs.exe
  2⤵
  PID:8588
- C:\Windows\System\mcdOsTU.exe
  C:\Windows\System\mcdOsTU.exe
  2⤵
  PID:8612
- C:\Windows\System\hRfeuSF.exe
  C:\Windows\System\hRfeuSF.exe
  2⤵
  PID:8640
- C:\Windows\System\azPrqUv.exe
  C:\Windows\System\azPrqUv.exe
  2⤵
  PID:8656
- C:\Windows\System\BuDiCCp.exe
  C:\Windows\System\BuDiCCp.exe
  2⤵
  PID:8680
- C:\Windows\System\eyNIPlF.exe
  C:\Windows\System\eyNIPlF.exe
  2⤵
  PID:8708
- C:\Windows\System\JtOhgzr.exe
  C:\Windows\System\JtOhgzr.exe
  2⤵
  PID:8732
- C:\Windows\System\vgbDDBZ.exe
  C:\Windows\System\vgbDDBZ.exe
  2⤵
  PID:8752
- C:\Windows\System\MgXRqDu.exe
  C:\Windows\System\MgXRqDu.exe
  2⤵
  PID:8776
- C:\Windows\System\vdISdlo.exe
  C:\Windows\System\vdISdlo.exe
  2⤵
  PID:8800
- C:\Windows\System\uGExnBE.exe
  C:\Windows\System\uGExnBE.exe
  2⤵
  PID:8824
- C:\Windows\System\cBbOssb.exe
  C:\Windows\System\cBbOssb.exe
  2⤵
  PID:8840
- C:\Windows\System\WamJnvY.exe
  C:\Windows\System\WamJnvY.exe
  2⤵
  PID:8860
- C:\Windows\System\CuLQUnx.exe
  C:\Windows\System\CuLQUnx.exe
  2⤵
  PID:8884
- C:\Windows\System\qaVWkmN.exe
  C:\Windows\System\qaVWkmN.exe
  2⤵
  PID:8908
- C:\Windows\System\OHOnqhI.exe
  C:\Windows\System\OHOnqhI.exe
  2⤵
  PID:8932
- C:\Windows\System\EKApixT.exe
  C:\Windows\System\EKApixT.exe
  2⤵
  PID:8956
- C:\Windows\System\IuKSXZr.exe
  C:\Windows\System\IuKSXZr.exe
  2⤵
  PID:8980
- C:\Windows\System\hJnMLcx.exe
  C:\Windows\System\hJnMLcx.exe
  2⤵
  PID:9016
- C:\Windows\System\tpvycAH.exe
  C:\Windows\System\tpvycAH.exe
  2⤵
  PID:9032
- C:\Windows\System\icoYdeO.exe
  C:\Windows\System\icoYdeO.exe
  2⤵
  PID:9060
- C:\Windows\System\VbuZpuR.exe
  C:\Windows\System\VbuZpuR.exe
  2⤵
  PID:9088
- C:\Windows\System\jAsGqah.exe
  C:\Windows\System\jAsGqah.exe
  2⤵
  PID:9108
- C:\Windows\System\pLKhCcx.exe
  C:\Windows\System\pLKhCcx.exe
  2⤵
  PID:9128
- C:\Windows\System\hyUyZmX.exe
  C:\Windows\System\hyUyZmX.exe
  2⤵
  PID:9152
- C:\Windows\System\VnMkOXR.exe
  C:\Windows\System\VnMkOXR.exe
  2⤵
  PID:9176
- C:\Windows\System\rEzWTHF.exe
  C:\Windows\System\rEzWTHF.exe
  2⤵
  PID:9196
- C:\Windows\System\iCddLnI.exe
  C:\Windows\System\iCddLnI.exe
  2⤵
  PID:7644
- C:\Windows\System\mXmudxT.exe
  C:\Windows\System\mXmudxT.exe
  2⤵
  PID:7692
- C:\Windows\System\eulbOKD.exe
  C:\Windows\System\eulbOKD.exe
  2⤵
  PID:6096
- C:\Windows\System\JmuSPSr.exe
  C:\Windows\System\JmuSPSr.exe
  2⤵
  PID:7868
- C:\Windows\System\DSeJtnm.exe
  C:\Windows\System\DSeJtnm.exe
  2⤵
  PID:4460
- C:\Windows\System\apbxvle.exe
  C:\Windows\System\apbxvle.exe
  2⤵
  PID:7916
- C:\Windows\System\riGBLKZ.exe
  C:\Windows\System\riGBLKZ.exe
  2⤵
  PID:7964
- C:\Windows\System\DtQODfO.exe
  C:\Windows\System\DtQODfO.exe
  2⤵
  PID:6548
- C:\Windows\System\dDltYay.exe
  C:\Windows\System\dDltYay.exe
  2⤵
  PID:6604
- C:\Windows\System\UmqsrmH.exe
  C:\Windows\System\UmqsrmH.exe
  2⤵
  PID:8120
- C:\Windows\System\jKfaOlF.exe
  C:\Windows\System\jKfaOlF.exe
  2⤵
  PID:3612
- C:\Windows\System\VTqUCau.exe
  C:\Windows\System\VTqUCau.exe
  2⤵
  PID:6492
- C:\Windows\System\WKFfasw.exe
  C:\Windows\System\WKFfasw.exe
  2⤵
  PID:6632
- C:\Windows\System\rRyAfWc.exe
  C:\Windows\System\rRyAfWc.exe
  2⤵
  PID:6264
- C:\Windows\System\SXevAyP.exe
  C:\Windows\System\SXevAyP.exe
  2⤵
  PID:6444
- C:\Windows\System\BXbceGW.exe
  C:\Windows\System\BXbceGW.exe
  2⤵
  PID:7352
- C:\Windows\System\JlWjuGy.exe
  C:\Windows\System\JlWjuGy.exe
  2⤵
  PID:5936
- C:\Windows\System\oREEqcH.exe
  C:\Windows\System\oREEqcH.exe
  2⤵
  PID:7432
- C:\Windows\System\buerNvV.exe
  C:\Windows\System\buerNvV.exe
  2⤵
  PID:7240
- C:\Windows\System\mzuDFTy.exe
  C:\Windows\System\mzuDFTy.exe
  2⤵
  PID:7552
- C:\Windows\System\bEBnzGS.exe
  C:\Windows\System\bEBnzGS.exe
  2⤵
  PID:7580
- C:\Windows\System\eHmGxfv.exe
  C:\Windows\System\eHmGxfv.exe
  2⤵
  PID:8260
- C:\Windows\System\jQsrDEg.exe
  C:\Windows\System\jQsrDEg.exe
  2⤵
  PID:8356
- C:\Windows\System\MYqlkLj.exe
  C:\Windows\System\MYqlkLj.exe
  2⤵
  PID:9220
- C:\Windows\System\oiBNPgN.exe
  C:\Windows\System\oiBNPgN.exe
  2⤵
  PID:9236
- C:\Windows\System\hIVGjKG.exe
  C:\Windows\System\hIVGjKG.exe
  2⤵
  PID:9260
- C:\Windows\System\Ifzsnza.exe
  C:\Windows\System\Ifzsnza.exe
  2⤵
  PID:9276
- C:\Windows\System\kmSvcPV.exe
  C:\Windows\System\kmSvcPV.exe
  2⤵
  PID:9304
- C:\Windows\System\JiPEDVe.exe
  C:\Windows\System\JiPEDVe.exe
  2⤵
  PID:9320
- C:\Windows\System\LhTKfLk.exe
  C:\Windows\System\LhTKfLk.exe
  2⤵
  PID:9344
- C:\Windows\System\AHApSmE.exe
  C:\Windows\System\AHApSmE.exe
  2⤵
  PID:9364
- C:\Windows\System\FdkdBlB.exe
  C:\Windows\System\FdkdBlB.exe
  2⤵
  PID:9384
- C:\Windows\System\ytjwQEy.exe
  C:\Windows\System\ytjwQEy.exe
  2⤵
  PID:9408
- C:\Windows\System\TTOyJEH.exe
  C:\Windows\System\TTOyJEH.exe
  2⤵
  PID:9432
- C:\Windows\System\IeRnugv.exe
  C:\Windows\System\IeRnugv.exe
  2⤵
  PID:9456
- C:\Windows\System\XJvyztF.exe
  C:\Windows\System\XJvyztF.exe
  2⤵
  PID:9480
- C:\Windows\System\KQuzuYc.exe
  C:\Windows\System\KQuzuYc.exe
  2⤵
  PID:9496
- C:\Windows\System\RbZiMZS.exe
  C:\Windows\System\RbZiMZS.exe
  2⤵
  PID:9520
- C:\Windows\System\rpOgYFf.exe
  C:\Windows\System\rpOgYFf.exe
  2⤵
  PID:9544
- C:\Windows\System\ZCmhYQP.exe
  C:\Windows\System\ZCmhYQP.exe
  2⤵
  PID:9572
- C:\Windows\System\TVuZGvW.exe
  C:\Windows\System\TVuZGvW.exe
  2⤵
  PID:9596
- C:\Windows\System\HwsOmlz.exe
  C:\Windows\System\HwsOmlz.exe
  2⤵
  PID:9616
- C:\Windows\System\ZHnmNcp.exe
  C:\Windows\System\ZHnmNcp.exe
  2⤵
  PID:9644
- C:\Windows\System\LUDluJt.exe
  C:\Windows\System\LUDluJt.exe
  2⤵
  PID:9672
- C:\Windows\System\WRLtYFe.exe
  C:\Windows\System\WRLtYFe.exe
  2⤵
  PID:9692
- C:\Windows\System\ItYEFwr.exe
  C:\Windows\System\ItYEFwr.exe
  2⤵
  PID:9716
- C:\Windows\System\mKsMtYo.exe
  C:\Windows\System\mKsMtYo.exe
  2⤵
  PID:9732
- C:\Windows\System\TechRlp.exe
  C:\Windows\System\TechRlp.exe
  2⤵
  PID:9756
- C:\Windows\System\XdSoLmh.exe
  C:\Windows\System\XdSoLmh.exe
  2⤵
  PID:9776
- C:\Windows\System\vpdpfvg.exe
  C:\Windows\System\vpdpfvg.exe
  2⤵
  PID:9800
- C:\Windows\System\KEUMhzH.exe
  C:\Windows\System\KEUMhzH.exe
  2⤵
  PID:9824
- C:\Windows\System\vsUCydA.exe
  C:\Windows\System\vsUCydA.exe
  2⤵
  PID:9848
- C:\Windows\System\bKUnWAK.exe
  C:\Windows\System\bKUnWAK.exe
  2⤵
  PID:9868
- C:\Windows\System\RZonvTe.exe
  C:\Windows\System\RZonvTe.exe
  2⤵
  PID:9892
- C:\Windows\System\kRHeVhI.exe
  C:\Windows\System\kRHeVhI.exe
  2⤵
  PID:9916
- C:\Windows\System\fNxsGQz.exe
  C:\Windows\System\fNxsGQz.exe
  2⤵
  PID:9944
- C:\Windows\System\ojgIIsG.exe
  C:\Windows\System\ojgIIsG.exe
  2⤵
  PID:9972
- C:\Windows\System\rDYHROe.exe
  C:\Windows\System\rDYHROe.exe
  2⤵
  PID:9988
- C:\Windows\System\nufexlW.exe
  C:\Windows\System\nufexlW.exe
  2⤵
  PID:10012
- C:\Windows\System\fmihkUm.exe
  C:\Windows\System\fmihkUm.exe
  2⤵
  PID:10036
- C:\Windows\System\LiyMZaU.exe
  C:\Windows\System\LiyMZaU.exe
  2⤵
  PID:10056
- C:\Windows\System\OYuhEps.exe
  C:\Windows\System\OYuhEps.exe
  2⤵
  PID:10088
- C:\Windows\System\VPdFpts.exe
  C:\Windows\System\VPdFpts.exe
  2⤵
  PID:10108
- C:\Windows\System\vjdzOPg.exe
  C:\Windows\System\vjdzOPg.exe
  2⤵
  PID:10136
- C:\Windows\System\pekOMRl.exe
  C:\Windows\System\pekOMRl.exe
  2⤵
  PID:10156
- C:\Windows\System\RhrAMJr.exe
  C:\Windows\System\RhrAMJr.exe
  2⤵
  PID:10180
- C:\Windows\System\bfCSViQ.exe
  C:\Windows\System\bfCSViQ.exe
  2⤵
  PID:10200
- C:\Windows\System\VRTWmtY.exe
  C:\Windows\System\VRTWmtY.exe
  2⤵
  PID:10224
- C:\Windows\System\bSzwexR.exe
  C:\Windows\System\bSzwexR.exe
  2⤵
  PID:7776
- C:\Windows\System\PPjmXYg.exe
  C:\Windows\System\PPjmXYg.exe
  2⤵
  PID:8408
- C:\Windows\System\ZYJzlhW.exe
  C:\Windows\System\ZYJzlhW.exe
  2⤵
  PID:7820
- C:\Windows\System\pIONNzH.exe
  C:\Windows\System\pIONNzH.exe
  2⤵
  PID:8528
- C:\Windows\System\LRhFdaP.exe
  C:\Windows\System\LRhFdaP.exe
  2⤵
  PID:8564
- C:\Windows\System\xDqxyJa.exe
  C:\Windows\System\xDqxyJa.exe
  2⤵
  PID:8672
- C:\Windows\System\mDNGRNK.exe
  C:\Windows\System\mDNGRNK.exe
  2⤵
  PID:8040
- C:\Windows\System\hfkQqmi.exe
  C:\Windows\System\hfkQqmi.exe
  2⤵
  PID:8796
- C:\Windows\System\eUzlBFA.exe
  C:\Windows\System\eUzlBFA.exe
  2⤵
  PID:8832
- C:\Windows\System\PiAhPku.exe
  C:\Windows\System\PiAhPku.exe
  2⤵
  PID:8920
- C:\Windows\System\ErCPsIU.exe
  C:\Windows\System\ErCPsIU.exe
  2⤵
  PID:7172
- C:\Windows\System\vjjGoMw.exe
  C:\Windows\System\vjjGoMw.exe
  2⤵
  PID:5556
- C:\Windows\System\GTPxsTU.exe
  C:\Windows\System\GTPxsTU.exe
  2⤵
  PID:5724
- C:\Windows\System\iBNTsSW.exe
  C:\Windows\System\iBNTsSW.exe
  2⤵
  PID:7356
- C:\Windows\System\VZVPNBT.exe
  C:\Windows\System\VZVPNBT.exe
  2⤵
  PID:7264
- C:\Windows\System\edANXCy.exe
  C:\Windows\System\edANXCy.exe
  2⤵
  PID:5768
- C:\Windows\System\zuTQrfR.exe
  C:\Windows\System\zuTQrfR.exe
  2⤵
  PID:8064
- C:\Windows\System\hHUkQRm.exe
  C:\Windows\System\hHUkQRm.exe
  2⤵
  PID:7564
- C:\Windows\System\ggjefSz.exe
  C:\Windows\System\ggjefSz.exe
  2⤵
  PID:8196
- C:\Windows\System\xVPdeKt.exe
  C:\Windows\System\xVPdeKt.exe
  2⤵
  PID:7624
- C:\Windows\System\XkKdXpe.exe
  C:\Windows\System\XkKdXpe.exe
  2⤵
  PID:10256
- C:\Windows\System\pRszzai.exe
  C:\Windows\System\pRszzai.exe
  2⤵
  PID:10284
- C:\Windows\System\KisCEmV.exe
  C:\Windows\System\KisCEmV.exe
  2⤵
  PID:10308
- C:\Windows\System\NttChSh.exe
  C:\Windows\System\NttChSh.exe
  2⤵
  PID:10332
- C:\Windows\System\FaYzcsE.exe
  C:\Windows\System\FaYzcsE.exe
  2⤵
  PID:10352
- C:\Windows\System\MChjriy.exe
  C:\Windows\System\MChjriy.exe
  2⤵
  PID:10380
- C:\Windows\System\LqkLlTh.exe
  C:\Windows\System\LqkLlTh.exe
  2⤵
  PID:10404
- C:\Windows\System\SInlFSV.exe
  C:\Windows\System\SInlFSV.exe
  2⤵
  PID:10424
- C:\Windows\System\kflJVyn.exe
  C:\Windows\System\kflJVyn.exe
  2⤵
  PID:10452
- C:\Windows\System\HGpsOVq.exe
  C:\Windows\System\HGpsOVq.exe
  2⤵
  PID:10472
- C:\Windows\System\exRmFqk.exe
  C:\Windows\System\exRmFqk.exe
  2⤵
  PID:10492
- C:\Windows\System\mjAjHsG.exe
  C:\Windows\System\mjAjHsG.exe
  2⤵
  PID:10512
- C:\Windows\System\tPjoPLg.exe
  C:\Windows\System\tPjoPLg.exe
  2⤵
  PID:10532
- C:\Windows\System\ILAoTfn.exe
  C:\Windows\System\ILAoTfn.exe
  2⤵
  PID:10552
- C:\Windows\System\loDicDS.exe
  C:\Windows\System\loDicDS.exe
  2⤵
  PID:10580
- C:\Windows\System\FfnBxcQ.exe
  C:\Windows\System\FfnBxcQ.exe
  2⤵
  PID:10604
- C:\Windows\System\xquPwgJ.exe
  C:\Windows\System\xquPwgJ.exe
  2⤵
  PID:10624
- C:\Windows\System\DwsBdYC.exe
  C:\Windows\System\DwsBdYC.exe
  2⤵
  PID:10644
- C:\Windows\System\ZoRgWIj.exe
  C:\Windows\System\ZoRgWIj.exe
  2⤵
  PID:10668
- C:\Windows\System\PwWINLP.exe
  C:\Windows\System\PwWINLP.exe
  2⤵
  PID:10688
- C:\Windows\System\HVfzxwE.exe
  C:\Windows\System\HVfzxwE.exe
  2⤵
  PID:10712
- C:\Windows\System\dtqzamP.exe
  C:\Windows\System\dtqzamP.exe
  2⤵
  PID:10732
- C:\Windows\System\TlHyVCe.exe
  C:\Windows\System\TlHyVCe.exe
  2⤵
  PID:10752
- C:\Windows\System\JCMNgwp.exe
  C:\Windows\System\JCMNgwp.exe
  2⤵
  PID:10772
- C:\Windows\System\rCGSQlL.exe
  C:\Windows\System\rCGSQlL.exe
  2⤵
  PID:10800
- C:\Windows\System\utkcKix.exe
  C:\Windows\System\utkcKix.exe
  2⤵
  PID:10828
- C:\Windows\System\TYGFkww.exe
  C:\Windows\System\TYGFkww.exe
  2⤵
  PID:10856
- C:\Windows\System\qxOxZLY.exe
  C:\Windows\System\qxOxZLY.exe
  2⤵
  PID:10880
- C:\Windows\System\DDByeVa.exe
  C:\Windows\System\DDByeVa.exe
  2⤵
  PID:10900
- C:\Windows\System\STtaqEF.exe
  C:\Windows\System\STtaqEF.exe
  2⤵
  PID:10920
- C:\Windows\System\OxnQAJi.exe
  C:\Windows\System\OxnQAJi.exe
  2⤵
  PID:10948
- C:\Windows\System\JzcFEON.exe
  C:\Windows\System\JzcFEON.exe
  2⤵
  PID:10968
- C:\Windows\System\iyRyJec.exe
  C:\Windows\System\iyRyJec.exe
  2⤵
  PID:10992
- C:\Windows\System\KbiyiOe.exe
  C:\Windows\System\KbiyiOe.exe
  2⤵
  PID:11020
- C:\Windows\System\KWdibdC.exe
  C:\Windows\System\KWdibdC.exe
  2⤵
  PID:11044
- C:\Windows\System\tlnSzdV.exe
  C:\Windows\System\tlnSzdV.exe
  2⤵
  PID:11068
- C:\Windows\System\Ayxqkjl.exe
  C:\Windows\System\Ayxqkjl.exe
  2⤵
  PID:11096
- C:\Windows\System\vlpYUsg.exe
  C:\Windows\System\vlpYUsg.exe
  2⤵
  PID:11112
- C:\Windows\System\mltAYmB.exe
  C:\Windows\System\mltAYmB.exe
  2⤵
  PID:11140
- C:\Windows\System\cpBmXdG.exe
  C:\Windows\System\cpBmXdG.exe
  2⤵
  PID:11160
- C:\Windows\System\dmkHnhG.exe
  C:\Windows\System\dmkHnhG.exe
  2⤵
  PID:11192
- C:\Windows\System\dZrmYIc.exe
  C:\Windows\System\dZrmYIc.exe
  2⤵
  PID:11208
- C:\Windows\System\jAViXAc.exe
  C:\Windows\System\jAViXAc.exe
  2⤵
  PID:11228
- C:\Windows\System\WqwNllO.exe
  C:\Windows\System\WqwNllO.exe
  2⤵
  PID:11252
- C:\Windows\System\sMzrUEy.exe
  C:\Windows\System\sMzrUEy.exe
  2⤵
  PID:8280
- C:\Windows\System\EpAEwtx.exe
  C:\Windows\System\EpAEwtx.exe
  2⤵
  PID:8320
- C:\Windows\System\AIDwkJk.exe
  C:\Windows\System\AIDwkJk.exe
  2⤵
  PID:8360
- C:\Windows\System\jTBBNSk.exe
  C:\Windows\System\jTBBNSk.exe
  2⤵
  PID:1812
- C:\Windows\System\FetqkAz.exe
  C:\Windows\System\FetqkAz.exe
  2⤵
  PID:8464
- C:\Windows\System\laFBmAh.exe
  C:\Windows\System\laFBmAh.exe
  2⤵
  PID:4360
- C:\Windows\System\lDYXbeG.exe
  C:\Windows\System\lDYXbeG.exe
  2⤵
  PID:9472
- C:\Windows\System\OLVmbGz.exe
  C:\Windows\System\OLVmbGz.exe
  2⤵
  PID:9516
- C:\Windows\System\sgbCwPg.exe
  C:\Windows\System\sgbCwPg.exe
  2⤵
  PID:9560
- C:\Windows\System\oeGTVzE.exe
  C:\Windows\System\oeGTVzE.exe
  2⤵
  PID:9580
- C:\Windows\System\VZsOYae.exe
  C:\Windows\System\VZsOYae.exe
  2⤵
  PID:9612
- C:\Windows\System\xHgEFPG.exe
  C:\Windows\System\xHgEFPG.exe
  2⤵
  PID:8716
- C:\Windows\System\wxKsERh.exe
  C:\Windows\System\wxKsERh.exe
  2⤵
  PID:9704
- C:\Windows\System\uKNxFXF.exe
  C:\Windows\System\uKNxFXF.exe
  2⤵
  PID:9816
- C:\Windows\System\AfqQMpT.exe
  C:\Windows\System\AfqQMpT.exe
  2⤵
  PID:8124
- C:\Windows\System\UYqNGwj.exe
  C:\Windows\System\UYqNGwj.exe
  2⤵
  PID:8948
- C:\Windows\System\dCcgDdB.exe
  C:\Windows\System\dCcgDdB.exe
  2⤵
  PID:8184
- C:\Windows\System\ozsYTgI.exe
  C:\Windows\System\ozsYTgI.exe
  2⤵
  PID:10008
- C:\Windows\System\AlVTTPU.exe
  C:\Windows\System\AlVTTPU.exe
  2⤵
  PID:9120
- C:\Windows\System\VpEiKqj.exe
  C:\Windows\System\VpEiKqj.exe
  2⤵
  PID:5508
- C:\Windows\System\OnQemcS.exe
  C:\Windows\System\OnQemcS.exe
  2⤵
  PID:10148
- C:\Windows\System\XQSrMOj.exe
  C:\Windows\System\XQSrMOj.exe
  2⤵
  PID:10232
- C:\Windows\System\xyGOIDu.exe
  C:\Windows\System\xyGOIDu.exe
  2⤵
  PID:7672
- C:\Windows\System\ghgPmqy.exe
  C:\Windows\System\ghgPmqy.exe
  2⤵
  PID:7844
- C:\Windows\System\WjBAhLf.exe
  C:\Windows\System\WjBAhLf.exe
  2⤵
  PID:7280
- C:\Windows\System\OAJdsjw.exe
  C:\Windows\System\OAJdsjw.exe
  2⤵
  PID:11268
- C:\Windows\System\QvLTwgq.exe
  C:\Windows\System\QvLTwgq.exe
  2⤵
  PID:11292
- C:\Windows\System\zyXZkhV.exe
  C:\Windows\System\zyXZkhV.exe
  2⤵
  PID:11312
- C:\Windows\System\xdQvfEC.exe
  C:\Windows\System\xdQvfEC.exe
  2⤵
  PID:11332
- C:\Windows\System\VLeNQWe.exe
  C:\Windows\System\VLeNQWe.exe
  2⤵
  PID:11356
- C:\Windows\System\JUyGxXz.exe
  C:\Windows\System\JUyGxXz.exe
  2⤵
  PID:11384
- C:\Windows\System\eGBnaXE.exe
  C:\Windows\System\eGBnaXE.exe
  2⤵
  PID:11404
- C:\Windows\System\lzWoEhx.exe
  C:\Windows\System\lzWoEhx.exe
  2⤵
  PID:11428
- C:\Windows\System\XjfeEfQ.exe
  C:\Windows\System\XjfeEfQ.exe
  2⤵
  PID:11452
- C:\Windows\System\uMCapET.exe
  C:\Windows\System\uMCapET.exe
  2⤵
  PID:11476
- C:\Windows\System\GIgFslA.exe
  C:\Windows\System\GIgFslA.exe
  2⤵
  PID:11500
- C:\Windows\System\fPTiQeK.exe
  C:\Windows\System\fPTiQeK.exe
  2⤵
  PID:11520
- C:\Windows\System\uuuCduT.exe
  C:\Windows\System\uuuCduT.exe
  2⤵
  PID:11544
- C:\Windows\System\YEBkNPR.exe
  C:\Windows\System\YEBkNPR.exe
  2⤵
  PID:11568
- C:\Windows\System\OtdOkAH.exe
  C:\Windows\System\OtdOkAH.exe
  2⤵
  PID:11592
- C:\Windows\System\GpZiWAr.exe
  C:\Windows\System\GpZiWAr.exe
  2⤵
  PID:11616
- C:\Windows\System\lGFApaK.exe
  C:\Windows\System\lGFApaK.exe
  2⤵
  PID:11636
- C:\Windows\System\KuVayos.exe
  C:\Windows\System\KuVayos.exe
  2⤵
  PID:11656
- C:\Windows\System\XBSZOIg.exe
  C:\Windows\System\XBSZOIg.exe
  2⤵
  PID:11676
- C:\Windows\System\utXlnCP.exe
  C:\Windows\System\utXlnCP.exe
  2⤵
  PID:11696
- C:\Windows\System\MnROhxP.exe
  C:\Windows\System\MnROhxP.exe
  2⤵
  PID:11720
- C:\Windows\System\UdBOBaU.exe
  C:\Windows\System\UdBOBaU.exe
  2⤵
  PID:11744
- C:\Windows\System\bTgznxK.exe
  C:\Windows\System\bTgznxK.exe
  2⤵
  PID:11768
- C:\Windows\System\QGSfGru.exe
  C:\Windows\System\QGSfGru.exe
  2⤵
  PID:11788
- C:\Windows\System\Xdnhvye.exe
  C:\Windows\System\Xdnhvye.exe
  2⤵
  PID:11812
- C:\Windows\System\CTngaop.exe
  C:\Windows\System\CTngaop.exe
  2⤵
  PID:11836
- C:\Windows\System\QqwOXWC.exe
  C:\Windows\System\QqwOXWC.exe
  2⤵
  PID:11876
- C:\Windows\System\FsoFFGG.exe
  C:\Windows\System\FsoFFGG.exe
  2⤵
  PID:11904
- C:\Windows\System\XtMXuhj.exe
  C:\Windows\System\XtMXuhj.exe
  2⤵
  PID:11924
- C:\Windows\System\EhwwHWe.exe
  C:\Windows\System\EhwwHWe.exe
  2⤵
  PID:11944
- C:\Windows\System\dewTmXZ.exe
  C:\Windows\System\dewTmXZ.exe
  2⤵
  PID:11972
- C:\Windows\System\zgjSDkS.exe
  C:\Windows\System\zgjSDkS.exe
  2⤵
  PID:11992
- C:\Windows\System\lqpxXyn.exe
  C:\Windows\System\lqpxXyn.exe
  2⤵
  PID:12020
- C:\Windows\System\eggWAPP.exe
  C:\Windows\System\eggWAPP.exe
  2⤵
  PID:12040
- C:\Windows\System\xbKcPVL.exe
  C:\Windows\System\xbKcPVL.exe
  2⤵
  PID:12072
- C:\Windows\System\VyimJzp.exe
  C:\Windows\System\VyimJzp.exe
  2⤵
  PID:12092
- C:\Windows\System\cTuuvrr.exe
  C:\Windows\System\cTuuvrr.exe
  2⤵
  PID:12112
- C:\Windows\System\Ehkyrvv.exe
  C:\Windows\System\Ehkyrvv.exe
  2⤵
  PID:12132
- C:\Windows\System\qwIuZIN.exe
  C:\Windows\System\qwIuZIN.exe
  2⤵
  PID:12152
- C:\Windows\System\UDjohOo.exe
  C:\Windows\System\UDjohOo.exe
  2⤵
  PID:12176
- C:\Windows\System\FbGfgnx.exe
  C:\Windows\System\FbGfgnx.exe
  2⤵
  PID:12192
- C:\Windows\System\iVUnCMj.exe
  C:\Windows\System\iVUnCMj.exe
  2⤵
  PID:12208
- C:\Windows\System\BxhmaSo.exe
  C:\Windows\System\BxhmaSo.exe
  2⤵
  PID:12224
- C:\Windows\System\jnTLhra.exe
  C:\Windows\System\jnTLhra.exe
  2⤵
  PID:12244
- C:\Windows\System\LDvoeau.exe
  C:\Windows\System\LDvoeau.exe
  2⤵
  PID:12264
- C:\Windows\System\BvMhjVB.exe
  C:\Windows\System\BvMhjVB.exe
  2⤵
  PID:6316
- C:\Windows\System\KuZPEtq.exe
  C:\Windows\System\KuZPEtq.exe
  2⤵
  PID:6572
- C:\Windows\System\oNXxMXe.exe
  C:\Windows\System\oNXxMXe.exe
  2⤵
  PID:8256
- C:\Windows\System\QiiVpkh.exe
  C:\Windows\System\QiiVpkh.exe
  2⤵
  PID:10304
- C:\Windows\System\LRqvlMB.exe
  C:\Windows\System\LRqvlMB.exe
  2⤵
  PID:10416
- C:\Windows\System\DKibIof.exe
  C:\Windows\System\DKibIof.exe
  2⤵
  PID:8244
- C:\Windows\System\qzxzqxF.exe
  C:\Windows\System\qzxzqxF.exe
  2⤵
  PID:9252
- C:\Windows\System\ENwGjgG.exe
  C:\Windows\System\ENwGjgG.exe
  2⤵
  PID:10544
- C:\Windows\System\jNntwfr.exe
  C:\Windows\System\jNntwfr.exe
  2⤵
  PID:10636
- C:\Windows\System\ExHIEKt.exe
  C:\Windows\System\ExHIEKt.exe
  2⤵
  PID:8492
- C:\Windows\System\qLgTkOG.exe
  C:\Windows\System\qLgTkOG.exe
  2⤵
  PID:9464
- C:\Windows\System\IbYbblk.exe
  C:\Windows\System\IbYbblk.exe
  2⤵
  PID:10852
- C:\Windows\System\BXtfQEx.exe
  C:\Windows\System\BXtfQEx.exe
  2⤵
  PID:9740
- C:\Windows\System\FirYVxr.exe
  C:\Windows\System\FirYVxr.exe
  2⤵
  PID:8852
- C:\Windows\System\NQfTOkJ.exe
  C:\Windows\System\NQfTOkJ.exe
  2⤵
  PID:12296
- C:\Windows\System\YtflBhl.exe
  C:\Windows\System\YtflBhl.exe
  2⤵
  PID:12320
- C:\Windows\System\bRGFdKP.exe
  C:\Windows\System\bRGFdKP.exe
  2⤵
  PID:12348
- C:\Windows\System\RLmaPhJ.exe
  C:\Windows\System\RLmaPhJ.exe
  2⤵
  PID:12368
- C:\Windows\System\KuQUzWT.exe
  C:\Windows\System\KuQUzWT.exe
  2⤵
  PID:12396
- C:\Windows\System\ngqfMxQ.exe
  C:\Windows\System\ngqfMxQ.exe
  2⤵
  PID:12416
- C:\Windows\System\uRmrfxk.exe
  C:\Windows\System\uRmrfxk.exe
  2⤵
  PID:12440
- C:\Windows\System\sYpacxb.exe
  C:\Windows\System\sYpacxb.exe
  2⤵
  PID:12460
- C:\Windows\System\nyfygxq.exe
  C:\Windows\System\nyfygxq.exe
  2⤵
  PID:12480
- C:\Windows\System\sVPApbr.exe
  C:\Windows\System\sVPApbr.exe
  2⤵
  PID:12504
- C:\Windows\System\oOUSgFW.exe
  C:\Windows\System\oOUSgFW.exe
  2⤵
  PID:12528
- C:\Windows\System\ZokySKw.exe
  C:\Windows\System\ZokySKw.exe
  2⤵
  PID:12548
- C:\Windows\System\QFteizT.exe
  C:\Windows\System\QFteizT.exe
  2⤵
  PID:12572
- C:\Windows\System\SasxKgw.exe
  C:\Windows\System\SasxKgw.exe
  2⤵
  PID:12596
- C:\Windows\System\hOlkFpx.exe
  C:\Windows\System\hOlkFpx.exe
  2⤵
  PID:12628
- C:\Windows\System\aUPSFET.exe
  C:\Windows\System\aUPSFET.exe
  2⤵
  PID:12652
- C:\Windows\System\dwFBWWb.exe
  C:\Windows\System\dwFBWWb.exe
  2⤵
  PID:12672
- C:\Windows\System\zVwuNEU.exe
  C:\Windows\System\zVwuNEU.exe
  2⤵
  PID:12696
- C:\Windows\System\QAiTOny.exe
  C:\Windows\System\QAiTOny.exe
  2⤵
  PID:12716
- C:\Windows\System\zdbCTxY.exe
  C:\Windows\System\zdbCTxY.exe
  2⤵
  PID:12736
- C:\Windows\System\TgOFYyM.exe
  C:\Windows\System\TgOFYyM.exe
  2⤵
  PID:12756
- C:\Windows\System\KVJgqIA.exe
  C:\Windows\System\KVJgqIA.exe
  2⤵
  PID:12780
- C:\Windows\System\HEyxqqU.exe
  C:\Windows\System\HEyxqqU.exe
  2⤵
  PID:12808
- C:\Windows\System\ugByuyz.exe
  C:\Windows\System\ugByuyz.exe
  2⤵
  PID:12832
- C:\Windows\System\yVdhEZP.exe
  C:\Windows\System\yVdhEZP.exe
  2⤵
  PID:12856
- C:\Windows\System\vLFltAW.exe
  C:\Windows\System\vLFltAW.exe
  2⤵
  PID:12880
- C:\Windows\System\QBJXsDg.exe
  C:\Windows\System\QBJXsDg.exe
  2⤵
  PID:12900
- C:\Windows\System\urQLqXh.exe
  C:\Windows\System\urQLqXh.exe
  2⤵
  PID:12920
- C:\Windows\System\faBLLPg.exe
  C:\Windows\System\faBLLPg.exe
  2⤵
  PID:12948
- C:\Windows\System\ZOmVGtf.exe
  C:\Windows\System\ZOmVGtf.exe
  2⤵
  PID:12972
- C:\Windows\System\QidAtnV.exe
  C:\Windows\System\QidAtnV.exe
  2⤵
  PID:12996
- C:\Windows\System\eApYAHG.exe
  C:\Windows\System\eApYAHG.exe
  2⤵
  PID:13016
- C:\Windows\System\sJXRWDa.exe
  C:\Windows\System\sJXRWDa.exe
  2⤵
  PID:13036
- C:\Windows\System\WtcCfYK.exe
  C:\Windows\System\WtcCfYK.exe
  2⤵
  PID:13064
- C:\Windows\System\LkQOhqk.exe
  C:\Windows\System\LkQOhqk.exe
  2⤵
  PID:13088
- C:\Windows\System\MljdIfu.exe
  C:\Windows\System\MljdIfu.exe
  2⤵
  PID:13108
- C:\Windows\System\okgJHhp.exe
  C:\Windows\System\okgJHhp.exe
  2⤵
  PID:9188
- C:\Windows\System\ejXFAhh.exe
  C:\Windows\System\ejXFAhh.exe
  2⤵
  PID:7736
- C:\Windows\System\khSuDvC.exe
  C:\Windows\System\khSuDvC.exe
  2⤵
  PID:6812
- C:\Windows\System\PREQEOj.exe
  C:\Windows\System\PREQEOj.exe
  2⤵
  PID:10192
- C:\Windows\System\ZtDjHeO.exe
  C:\Windows\System\ZtDjHeO.exe
  2⤵
  PID:4824
- C:\Windows\System\yEvTZNn.exe
  C:\Windows\System\yEvTZNn.exe
  2⤵
  PID:9540
- C:\Windows\System\OImWOXK.exe
  C:\Windows\System\OImWOXK.exe
  2⤵
  PID:11712
- C:\Windows\System\hKEiESY.exe
  C:\Windows\System\hKEiESY.exe
  2⤵
  PID:11828
- C:\Windows\System\sLsCcvu.exe
  C:\Windows\System\sLsCcvu.exe
  2⤵
  PID:12048
- C:\Windows\System\laGBvkT.exe
  C:\Windows\System\laGBvkT.exe
  2⤵
  PID:12200
- C:\Windows\System\qmJnmAG.exe
  C:\Windows\System\qmJnmAG.exe
  2⤵
  PID:7220
- C:\Windows\System\dkvALHl.exe
  C:\Windows\System\dkvALHl.exe
  2⤵
  PID:8328
- C:\Windows\System\NfhIvze.exe
  C:\Windows\System\NfhIvze.exe
  2⤵
  PID:8988
- C:\Windows\System\WngQjLM.exe
  C:\Windows\System\WngQjLM.exe
  2⤵
  PID:7936
- C:\Windows\System\GsgKKoa.exe
  C:\Windows\System\GsgKKoa.exe
  2⤵
  PID:9796
- C:\Windows\System\RXiYHUM.exe
  C:\Windows\System\RXiYHUM.exe
  2⤵
  PID:11516
- C:\Windows\System\BCszzOY.exe
  C:\Windows\System\BCszzOY.exe
  2⤵
  PID:5668
- C:\Windows\System\xuvsArR.exe
  C:\Windows\System\xuvsArR.exe
  2⤵
  PID:11920
- C:\Windows\System\jUmncvM.exe
  C:\Windows\System\jUmncvM.exe
  2⤵
  PID:11080
- C:\Windows\System\OpTDjdt.exe
  C:\Windows\System\OpTDjdt.exe
  2⤵
  PID:12660
- C:\Windows\System\dtiPOBZ.exe
  C:\Windows\System\dtiPOBZ.exe
  2⤵
  PID:1592
- C:\Windows\System\VSMndds.exe
  C:\Windows\System\VSMndds.exe
  2⤵
  PID:10588
- C:\Windows\System\kgMFeAZ.exe
  C:\Windows\System\kgMFeAZ.exe
  2⤵
  PID:1356
- C:\Windows\System\INlJJHa.exe
  C:\Windows\System\INlJJHa.exe
  2⤵
  PID:10696
- C:\Windows\System\gEawDsV.exe
  C:\Windows\System\gEawDsV.exe
  2⤵
  PID:11916
- C:\Windows\System\fvqptZV.exe
  C:\Windows\System\fvqptZV.exe
  2⤵
  PID:8076
- C:\Windows\System\SakMAiv.exe
  C:\Windows\System\SakMAiv.exe
  2⤵
  PID:12968
- C:\Windows\System\PJNLJDo.exe
  C:\Windows\System\PJNLJDo.exe
  2⤵
  PID:12896
- C:\Windows\System\AWQERcz.exe
  C:\Windows\System\AWQERcz.exe
  2⤵
  PID:9860
- C:\Windows\System\ZuQxuDu.exe
  C:\Windows\System\ZuQxuDu.exe
  2⤵
  PID:12032
- C:\Windows\System\Vllazrs.exe
  C:\Windows\System\Vllazrs.exe
  2⤵
  PID:10292
- C:\Windows\System\NzQRMIi.exe
  C:\Windows\System\NzQRMIi.exe
  2⤵
  PID:8512
- C:\Windows\System\DKgupNT.exe
  C:\Windows\System\DKgupNT.exe
  2⤵
  PID:10388
- C:\Windows\System\RtCsALD.exe
  C:\Windows\System\RtCsALD.exe
  2⤵
  PID:10524
- C:\Windows\System\eqpopbt.exe
  C:\Windows\System\eqpopbt.exe
  2⤵
  PID:8896
- C:\Windows\System\OKHFrhm.exe
  C:\Windows\System\OKHFrhm.exe
  2⤵
  PID:9116
- C:\Windows\System\ufLVVlK.exe
  C:\Windows\System\ufLVVlK.exe
  2⤵
  PID:12104
- C:\Windows\System\NzXUwww.exe
  C:\Windows\System\NzXUwww.exe
  2⤵
  PID:920
- C:\Windows\System\EsbsskR.exe
  C:\Windows\System\EsbsskR.exe
  2⤵
  PID:10840
- C:\Windows\System\vumIXBZ.exe
  C:\Windows\System\vumIXBZ.exe
  2⤵
  PID:7136
- C:\Windows\System\cDtuVpF.exe
  C:\Windows\System\cDtuVpF.exe
  2⤵
  PID:8868
- C:\Windows\System\gfyoDDq.exe
  C:\Windows\System\gfyoDDq.exe
  2⤵
  PID:11704
- C:\Windows\System\jXkQulD.exe
  C:\Windows\System\jXkQulD.exe
  2⤵
  PID:11820
- C:\Windows\System\yyYXmqL.exe
  C:\Windows\System\yyYXmqL.exe
  2⤵
  PID:8100
- C:\Windows\System\kUCeDwR.exe
  C:\Windows\System\kUCeDwR.exe
  2⤵
  PID:11120
- C:\Windows\System\wdSvpMO.exe
  C:\Windows\System\wdSvpMO.exe
  2⤵
  PID:3652
- C:\Windows\System\drbWSMT.exe
  C:\Windows\System\drbWSMT.exe
  2⤵
  PID:12124
- C:\Windows\System\eyAtsMQ.exe
  C:\Windows\System\eyAtsMQ.exe
  2⤵
  PID:12252
- C:\Windows\System\wvZKvUY.exe
  C:\Windows\System\wvZKvUY.exe
  2⤵
  PID:5228
- C:\Windows\System\BdlWyWk.exe
  C:\Windows\System\BdlWyWk.exe
  2⤵
  PID:12232
- C:\Windows\System\xiuunNf.exe
  C:\Windows\System\xiuunNf.exe
  2⤵
  PID:11224
- C:\Windows\System\zqpKaZA.exe
  C:\Windows\System\zqpKaZA.exe
  2⤵
  PID:7080
- C:\Windows\System\bKviLVO.exe
  C:\Windows\System\bKviLVO.exe
  2⤵
  PID:12788
- C:\Windows\System\LaStdrf.exe
  C:\Windows\System\LaStdrf.exe
  2⤵
  PID:11216
- C:\Windows\System\vfGEwFD.exe
  C:\Windows\System\vfGEwFD.exe
  2⤵
  PID:9168
- C:\Windows\System\UZcuZfD.exe
  C:\Windows\System\UZcuZfD.exe
  2⤵
  PID:12376
- C:\Windows\System\LOVUljq.exe
  C:\Windows\System\LOVUljq.exe
  2⤵
  PID:2304
- C:\Windows\System\gaFweoM.exe
  C:\Windows\System\gaFweoM.exe
  2⤵
  PID:12592
- C:\Windows\System\cNXuXtX.exe
  C:\Windows\System\cNXuXtX.exe
  2⤵
  PID:11352
- C:\Windows\System\MwDpzdI.exe
  C:\Windows\System\MwDpzdI.exe
  2⤵
  PID:10124
- C:\Windows\System\lvKJAEh.exe
  C:\Windows\System\lvKJAEh.exe
  2⤵
  PID:12568
- C:\Windows\System\OgOnEIW.exe
  C:\Windows\System\OgOnEIW.exe
  2⤵
  PID:10824
- C:\Windows\System\EUiNwWN.exe
  C:\Windows\System\EUiNwWN.exe
  2⤵
  PID:4832
- C:\Windows\System\pmhyRbC.exe
  C:\Windows\System\pmhyRbC.exe
  2⤵
  PID:6048
- C:\Windows\System\wkDuhlU.exe
  C:\Windows\System\wkDuhlU.exe
  2⤵
  PID:11716
- C:\Windows\System\cXvQSYE.exe
  C:\Windows\System\cXvQSYE.exe
  2⤵
  PID:5412
- C:\Windows\System\VLzLANQ.exe
  C:\Windows\System\VLzLANQ.exe
  2⤵
  PID:4676
- C:\Windows\System\RdukglO.exe
  C:\Windows\System\RdukglO.exe
  2⤵
  PID:13428
- C:\Windows\System\ikjSTQA.exe
  C:\Windows\System\ikjSTQA.exe
  2⤵
  PID:13472
- C:\Windows\System\BJwYHQa.exe
  C:\Windows\System\BJwYHQa.exe
  2⤵
  PID:13492
- C:\Windows\System\DtjqQkj.exe
  C:\Windows\System\DtjqQkj.exe
  2⤵
  PID:13520
- C:\Windows\System\WcZYqCo.exe
  C:\Windows\System\WcZYqCo.exe
  2⤵
  PID:13644
- C:\Windows\System\mThjKpW.exe
  C:\Windows\System\mThjKpW.exe
  2⤵
  PID:13856
- C:\Windows\System\dtMTvUp.exe
  C:\Windows\System\dtMTvUp.exe
  2⤵
  PID:13876
- C:\Windows\System\FpCtXGb.exe
  C:\Windows\System\FpCtXGb.exe
  2⤵
  PID:13992
- C:\Windows\System\FxUGYES.exe
  C:\Windows\System\FxUGYES.exe
  2⤵
  PID:14008
- C:\Windows\System\KqYPDUu.exe
  C:\Windows\System\KqYPDUu.exe
  2⤵
  PID:14024
- C:\Windows\System\nFmAQar.exe
  C:\Windows\System\nFmAQar.exe
  2⤵
  PID:14044
- C:\Windows\System\EPPWfxk.exe
  C:\Windows\System\EPPWfxk.exe
  2⤵
  PID:14076
- C:\Windows\System\tbiauoC.exe
  C:\Windows\System\tbiauoC.exe
  2⤵
  PID:14324
- C:\Windows\System\txhyRRX.exe
  C:\Windows\System\txhyRRX.exe
  2⤵
  PID:1684
- C:\Windows\System\SkTmiQC.exe
  C:\Windows\System\SkTmiQC.exe
  2⤵
  PID:13176
- C:\Windows\System\CUGBrXb.exe
  C:\Windows\System\CUGBrXb.exe
  2⤵
  PID:13332
- C:\Windows\System\lTkDViQ.exe
  C:\Windows\System\lTkDViQ.exe
  2⤵
  PID:13376
- C:\Windows\System\NOVWJzD.exe
  C:\Windows\System\NOVWJzD.exe
  2⤵
  PID:13032
- C:\Windows\System\wJzMQYd.exe
  C:\Windows\System\wJzMQYd.exe
  2⤵
  PID:13448
- C:\Windows\System\oNXANJu.exe
  C:\Windows\System\oNXANJu.exe
  2⤵
  PID:13484
- C:\Windows\System\lWhDEWr.exe
  C:\Windows\System\lWhDEWr.exe
  2⤵
  PID:13412
- C:\Windows\System\qGzDVjX.exe
  C:\Windows\System\qGzDVjX.exe
  2⤵
  PID:13436
- C:\Windows\System\DMkRmYK.exe
  C:\Windows\System\DMkRmYK.exe
  2⤵
  PID:6816
- C:\Windows\System\cyMZLRg.exe
  C:\Windows\System\cyMZLRg.exe
  2⤵
  PID:13712
- C:\Windows\System\OoZGgJT.exe
  C:\Windows\System\OoZGgJT.exe
  2⤵
  PID:13692
- C:\Windows\System\UTCgUlv.exe
  C:\Windows\System\UTCgUlv.exe
  2⤵
  PID:13408
- C:\Windows\System\DvkNSIT.exe
  C:\Windows\System\DvkNSIT.exe
  2⤵
  PID:12332
- C:\Windows\System\EJZwKqk.exe
  C:\Windows\System\EJZwKqk.exe
  2⤵
  PID:13200
- C:\Windows\System\AAEqowo.exe
  C:\Windows\System\AAEqowo.exe
  2⤵
  PID:2136
- C:\Windows\System\JZyABZo.exe
  C:\Windows\System\JZyABZo.exe
  2⤵
  PID:12456
- C:\Windows\System\HuZgWxI.exe
  C:\Windows\System\HuZgWxI.exe
  2⤵
  PID:11868
- C:\Windows\System\OWXEsWI.exe
  C:\Windows\System\OWXEsWI.exe
  2⤵
  PID:4548
- C:\Windows\System\TMOawas.exe
  C:\Windows\System\TMOawas.exe
  2⤵
  PID:4772
- C:\Windows\System\sAaEKdf.exe
  C:\Windows\System\sAaEKdf.exe
  2⤵
  PID:13360
- C:\Windows\System\WqnIZVC.exe
  C:\Windows\System\WqnIZVC.exe
  2⤵
  PID:13396
- C:\Windows\System\vNDUAQf.exe
  C:\Windows\System\vNDUAQf.exe
  2⤵
  PID:13580
- C:\Windows\System\cyfINva.exe
  C:\Windows\System\cyfINva.exe
  2⤵
  PID:13460
- C:\Windows\System\IYjFvfC.exe
  C:\Windows\System\IYjFvfC.exe
  2⤵
  PID:3872
- C:\Windows\System\fmHEWbV.exe
  C:\Windows\System\fmHEWbV.exe
  2⤵
  PID:8784
- C:\Windows\System\LkFKOsr.exe
  C:\Windows\System\LkFKOsr.exe
  2⤵
  PID:13796
- C:\Windows\System\JbWJdtV.exe
  C:\Windows\System\JbWJdtV.exe
  2⤵
  PID:12384
- C:\Windows\System\gSdtmkS.exe
  C:\Windows\System\gSdtmkS.exe
  2⤵
  PID:2724
- C:\Windows\System\DXcpqof.exe
  C:\Windows\System\DXcpqof.exe
  2⤵
  PID:5088
- C:\Windows\System\qKJZfCa.exe
  C:\Windows\System\qKJZfCa.exe
  2⤵
  PID:13756
- C:\Windows\System\FTGuvfP.exe
  C:\Windows\System\FTGuvfP.exe
  2⤵
  PID:13824
- C:\Windows\System\XOFrocr.exe
  C:\Windows\System\XOFrocr.exe
  2⤵
  PID:13260
- C:\Windows\System\KUHyIjQ.exe
  C:\Windows\System\KUHyIjQ.exe
  2⤵
  PID:13928
- C:\Windows\System\EENoRDO.exe
  C:\Windows\System\EENoRDO.exe
  2⤵
  PID:13940
- C:\Windows\System\nFyyafA.exe
  C:\Windows\System\nFyyafA.exe
  2⤵
  PID:3892
- C:\Windows\System\gCtAGmW.exe
  C:\Windows\System\gCtAGmW.exe
  2⤵
  PID:13944
- C:\Windows\System\MKcQQwi.exe
  C:\Windows\System\MKcQQwi.exe
  2⤵
  PID:14060
- C:\Windows\System\zDKwKSq.exe
  C:\Windows\System\zDKwKSq.exe
  2⤵
  PID:13984
- C:\Windows\System\ceRKtjZ.exe
  C:\Windows\System\ceRKtjZ.exe
  2⤵
  PID:14092
- C:\Windows\System\xLqgZly.exe
  C:\Windows\System\xLqgZly.exe
  2⤵
  PID:13792
- C:\Windows\System\CXcvXrt.exe
  C:\Windows\System\CXcvXrt.exe
  2⤵
  PID:14128
- C:\Windows\System\pUsCLYn.exe
  C:\Windows\System\pUsCLYn.exe
  2⤵
  PID:14168
- C:\Windows\System\cizlUXO.exe
  C:\Windows\System\cizlUXO.exe
  2⤵
  PID:14256
- C:\Windows\System\awwybVo.exe
  C:\Windows\System\awwybVo.exe
  2⤵
  PID:14280
- C:\Windows\System\nqmXVdf.exe
  C:\Windows\System\nqmXVdf.exe
  2⤵
  PID:14188
- C:\Windows\System\JpFjhrl.exe
  C:\Windows\System\JpFjhrl.exe
  2⤵
  PID:3312
- C:\Windows\System\NJDLLAa.exe
  C:\Windows\System\NJDLLAa.exe
  2⤵
  PID:2452
- C:\Windows\System\dNApMhh.exe
  C:\Windows\System\dNApMhh.exe
  2⤵
  PID:5032
- C:\Windows\System\tNMlfhc.exe
  C:\Windows\System\tNMlfhc.exe
  2⤵
  PID:400
- C:\Windows\System\iqqcMwQ.exe
  C:\Windows\System\iqqcMwQ.exe
  2⤵
  PID:2956
- C:\Windows\System\muIGlrb.exe
  C:\Windows\System\muIGlrb.exe
  2⤵
  PID:13372
- C:\Windows\System\DBBzrXT.exe
  C:\Windows\System\DBBzrXT.exe
  2⤵
  PID:13776
- C:\Windows\System\NORHcFC.exe
  C:\Windows\System\NORHcFC.exe
  2⤵
  PID:13948
- C:\Windows\System\BGPgEYZ.exe
  C:\Windows\System\BGPgEYZ.exe
  2⤵
  PID:14136
- C:\Windows\System\rvmOelX.exe
  C:\Windows\System\rvmOelX.exe
  2⤵
  PID:14140
- C:\Windows\System\Hbnirra.exe
  C:\Windows\System\Hbnirra.exe
  2⤵
  PID:4660
- C:\Windows\System\OOPbWKQ.exe
  C:\Windows\System\OOPbWKQ.exe
  2⤵
  PID:1364
- C:\Windows\System\IIJeUzf.exe
  C:\Windows\System\IIJeUzf.exe
  2⤵
  PID:13364
- C:\Windows\System\LNchfgu.exe
  C:\Windows\System\LNchfgu.exe
  2⤵
  PID:4224
- C:\Windows\System\ZYHkzis.exe
  C:\Windows\System\ZYHkzis.exe
  2⤵
  PID:9068
- C:\Windows\System\gCCgqBa.exe
  C:\Windows\System\gCCgqBa.exe
  2⤵
  PID:2988
- C:\Windows\System\OVoxrhT.exe
  C:\Windows\System\OVoxrhT.exe
  2⤵
  PID:3972
- C:\Windows\System\kRCNydu.exe
  C:\Windows\System\kRCNydu.exe
  2⤵
  PID:13576
- C:\Windows\System\nacIuLU.exe
  C:\Windows\System\nacIuLU.exe
  2⤵
  PID:10744
- C:\Windows\System\DucSeKd.exe
  C:\Windows\System\DucSeKd.exe
  2⤵
  PID:5084
- C:\Windows\System\vdYVwFJ.exe
  C:\Windows\System\vdYVwFJ.exe
  2⤵
  PID:3036
- C:\Windows\System\vdccyas.exe
  C:\Windows\System\vdccyas.exe
  2⤵
  PID:4940
- C:\Windows\System\SJlyaIP.exe
  C:\Windows\System\SJlyaIP.exe
  2⤵
  PID:4584
- C:\Windows\System\WjRGjrm.exe
  C:\Windows\System\WjRGjrm.exe
  2⤵
  PID:13688
- C:\Windows\System\htjLSwx.exe
  C:\Windows\System\htjLSwx.exe
  2⤵
  PID:13768
- C:\Windows\System\wGSnMjV.exe
  C:\Windows\System\wGSnMjV.exe
  2⤵
  PID:13632
- C:\Windows\System\UdDjMxT.exe
  C:\Windows\System\UdDjMxT.exe
  2⤵
  PID:13800
- C:\Windows\System\WyBwPsc.exe
  C:\Windows\System\WyBwPsc.exe
  2⤵
  PID:13500
- C:\Windows\System\PyTnXgg.exe
  C:\Windows\System\PyTnXgg.exe
  2⤵
  PID:3432
- C:\Windows\System\ycacLOb.exe
  C:\Windows\System\ycacLOb.exe
  2⤵
  PID:13960
- C:\Windows\System\PeVzbsG.exe
  C:\Windows\System\PeVzbsG.exe
  2⤵
  PID:4576
- C:\Windows\System\bARGhoQ.exe
  C:\Windows\System\bARGhoQ.exe
  2⤵
  PID:856
- C:\Windows\System\FUFxenU.exe
  C:\Windows\System\FUFxenU.exe
  2⤵
  PID:4440
- C:\Windows\System\TwmKjsy.exe
  C:\Windows\System\TwmKjsy.exe
  2⤵
  PID:3108
- C:\Windows\System\XieSgwN.exe
  C:\Windows\System\XieSgwN.exe
  2⤵
  PID:7328
- C:\Windows\System\lrpCjDW.exe
  C:\Windows\System\lrpCjDW.exe
  2⤵
  PID:10344
- C:\Windows\System\AuUSodx.exe
  C:\Windows\System\AuUSodx.exe
  2⤵
  PID:14236
- C:\Windows\System\NQnIEqK.exe
  C:\Windows\System\NQnIEqK.exe
  2⤵
  PID:3096
- C:\Windows\System\VCzCkiJ.exe
  C:\Windows\System\VCzCkiJ.exe
  2⤵
  PID:3000
- C:\Windows\System\tSHUAkS.exe
  C:\Windows\System\tSHUAkS.exe
  2⤵
  PID:2348
- C:\Windows\System\QbcorXn.exe
  C:\Windows\System\QbcorXn.exe
  2⤵
  PID:13716
- C:\Windows\System\rBNtpiy.exe
  C:\Windows\System\rBNtpiy.exe
  2⤵
  PID:3472
- C:\Windows\System\VZGaNag.exe
  C:\Windows\System\VZGaNag.exe
  2⤵
  PID:13384
- C:\Windows\System\XNLKBst.exe
  C:\Windows\System\XNLKBst.exe
  2⤵
  PID:13316
- C:\Windows\System\zhEAvQw.exe
  C:\Windows\System\zhEAvQw.exe
  2⤵
  PID:14232
- C:\Windows\System\YbBLjkr.exe
  C:\Windows\System\YbBLjkr.exe
  2⤵
  PID:4148
- C:\Windows\System\ARjHhEB.exe
  C:\Windows\System\ARjHhEB.exe
  2⤵
  PID:3528
- C:\Windows\System\peMBENv.exe
  C:\Windows\System\peMBENv.exe
  2⤵
  PID:3800
- C:\Windows\System\zYeNcSm.exe
  C:\Windows\System\zYeNcSm.exe
  2⤵
  PID:10500
- C:\Windows\System\oRxpoDD.exe
  C:\Windows\System\oRxpoDD.exe
  2⤵
  PID:4988
- C:\Windows\System\myINDXC.exe
  C:\Windows\System\myINDXC.exe
  2⤵
  PID:4484
- C:\Windows\System\xEPxLqr.exe
  C:\Windows\System\xEPxLqr.exe
  2⤵
  PID:1104
- C:\Windows\System\QfMaFNr.exe
  C:\Windows\System\QfMaFNr.exe
  2⤵
  PID:5280
- C:\Windows\System\OcMzgJu.exe
  C:\Windows\System\OcMzgJu.exe
  2⤵
  PID:2016
- C:\Windows\System\vwdoSPf.exe
  C:\Windows\System\vwdoSPf.exe
  2⤵
  PID:5184
- C:\Windows\System\POVLHiB.exe
  C:\Windows\System\POVLHiB.exe
  2⤵
  PID:13336
- C:\Windows\System\qCbqrwy.exe
  C:\Windows\System\qCbqrwy.exe
  2⤵
  PID:14036
- C:\Windows\System\SOnAqXv.exe
  C:\Windows\System\SOnAqXv.exe
  2⤵
  PID:4596
- C:\Windows\System\hCsgtSL.exe
  C:\Windows\System\hCsgtSL.exe
  2⤵
  PID:3368
- C:\Windows\System\XZWlOzR.exe
  C:\Windows\System\XZWlOzR.exe
  2⤵
  PID:884
- C:\Windows\System\OFxGQrK.exe
  C:\Windows\System\OFxGQrK.exe
  2⤵
  PID:14316
- C:\Windows\System\VlkekgQ.exe
  C:\Windows\System\VlkekgQ.exe
  2⤵
  PID:2408
- C:\Windows\System\ZOQLuyh.exe
  C:\Windows\System\ZOQLuyh.exe
  2⤵
  PID:3896
- C:\Windows\System\kWpkYlc.exe
  C:\Windows\System\kWpkYlc.exe
  2⤵
  PID:13872
- C:\Windows\System\RkREeDy.exe
  C:\Windows\System\RkREeDy.exe
  2⤵
  PID:9552
- C:\Windows\System\giiHnfv.exe
  C:\Windows\System\giiHnfv.exe
  2⤵
  PID:1196
- C:\Windows\System\zKpMgIx.exe
  C:\Windows\System\zKpMgIx.exe
  2⤵
  PID:2644
- C:\Windows\System\mbatdug.exe
  C:\Windows\System\mbatdug.exe
  2⤵
  PID:5548
- C:\Windows\System\PvsZOto.exe
  C:\Windows\System\PvsZOto.exe
  2⤵
  PID:4520
- C:\Windows\System\VWaCUhs.exe
  C:\Windows\System\VWaCUhs.exe
  2⤵
  PID:6056
- C:\Windows\System\JjBnDxR.exe
  C:\Windows\System\JjBnDxR.exe
  2⤵
  PID:6276
- C:\Windows\System\wBGevdb.exe
  C:\Windows\System\wBGevdb.exe
  2⤵
  PID:5364
- C:\Windows\System\djZEDZU.exe
  C:\Windows\System\djZEDZU.exe
  2⤵
  PID:5428
- C:\Windows\System\fNDZCsW.exe
  C:\Windows\System\fNDZCsW.exe
  2⤵
  PID:3952
- C:\Windows\System\VKgliga.exe
  C:\Windows\System\VKgliga.exe
  2⤵
  PID:14040
- C:\Windows\System\mIEgubT.exe
  C:\Windows\System\mIEgubT.exe
  2⤵
  PID:4404
- C:\Windows\System\ejtAZnK.exe
  C:\Windows\System\ejtAZnK.exe
  2⤵
  PID:5852
- C:\Windows\System\POYQXKC.exe
  C:\Windows\System\POYQXKC.exe
  2⤵
  PID:2448
- C:\Windows\System\GLobKSL.exe
  C:\Windows\System\GLobKSL.exe
  2⤵
  PID:2984
- C:\Windows\System\xAjtUNX.exe
  C:\Windows\System\xAjtUNX.exe
  2⤵
  PID:5512
- C:\Windows\System\KqBgRHW.exe
  C:\Windows\System\KqBgRHW.exe
  2⤵
  PID:3980
- C:\Windows\System\luDtMDa.exe
  C:\Windows\System\luDtMDa.exe
  2⤵
  PID:5244
- C:\Windows\System\uNrzCJy.exe
  C:\Windows\System\uNrzCJy.exe
  2⤵
  PID:5904
- C:\Windows\System\QWsNlQl.exe
  C:\Windows\System\QWsNlQl.exe
  2⤵
  PID:6080
- C:\Windows\System\iysxBDY.exe
  C:\Windows\System\iysxBDY.exe
  2⤵
  PID:5628
- C:\Windows\System\SKcNpwr.exe
  C:\Windows\System\SKcNpwr.exe
  2⤵
  PID:5436
- C:\Windows\System\QMWKsuC.exe
  C:\Windows\System\QMWKsuC.exe
  2⤵
  PID:7068
- C:\Windows\System\BBDIXvr.exe
  C:\Windows\System\BBDIXvr.exe
  2⤵
  PID:6512
- C:\Windows\System\ZwdPWEt.exe
  C:\Windows\System\ZwdPWEt.exe
  2⤵
  PID:6520
- C:\Windows\System\EEimymK.exe
  C:\Windows\System\EEimymK.exe
  2⤵
  PID:6948
- C:\Windows\System\EraGglT.exe
  C:\Windows\System\EraGglT.exe
  2⤵
  PID:13900
- C:\Windows\System\labSeMz.exe
  C:\Windows\System\labSeMz.exe
  2⤵
  PID:7100
- C:\Windows\System\FwByTVr.exe
  C:\Windows\System\FwByTVr.exe
  2⤵
  PID:6312
- C:\Windows\System\uotfqFa.exe
  C:\Windows\System\uotfqFa.exe
  2⤵
  PID:6328
- C:\Windows\System\HROKVxc.exe
  C:\Windows\System\HROKVxc.exe
  2⤵
  PID:6072
- C:\Windows\System\WbDuhnZ.exe
  C:\Windows\System\WbDuhnZ.exe
  2⤵
  PID:7668
- C:\Windows\System\HKFdUoZ.exe
  C:\Windows\System\HKFdUoZ.exe
  2⤵
  PID:7696
- C:\Windows\System\jybVuRL.exe
  C:\Windows\System\jybVuRL.exe
  2⤵
  PID:7780
- C:\Windows\System\EGRFwhd.exe
  C:\Windows\System\EGRFwhd.exe
  2⤵
  PID:6808
- C:\Windows\System\OmAKbNL.exe
  C:\Windows\System\OmAKbNL.exe
  2⤵
  PID:1784
- C:\Windows\System\XJBiJgy.exe
  C:\Windows\System\XJBiJgy.exe
  2⤵
  PID:5804
- C:\Windows\System\nNUmxvE.exe
  C:\Windows\System\nNUmxvE.exe
  2⤵
  PID:5328
- C:\Windows\System\EwxCUux.exe
  C:\Windows\System\EwxCUux.exe
  2⤵
  PID:7192
- C:\Windows\System\jewzGtX.exe
  C:\Windows\System\jewzGtX.exe
  2⤵
  PID:6188
- C:\Windows\System\ddrSHRF.exe
  C:\Windows\System\ddrSHRF.exe
  2⤵
  PID:7348
- C:\Windows\System\pnCYOtC.exe
  C:\Windows\System\pnCYOtC.exe
  2⤵
  PID:5448
- C:\Windows\System\dFtITof.exe
  C:\Windows\System\dFtITof.exe
  2⤵
  PID:6920
- C:\Windows\System\cdEeMbV.exe
  C:\Windows\System\cdEeMbV.exe
  2⤵
  PID:7560
- C:\Windows\System\QHjzZgd.exe
  C:\Windows\System\QHjzZgd.exe
  2⤵
  PID:6788
- C:\Windows\System\mizVsGs.exe
  C:\Windows\System\mizVsGs.exe
  2⤵
  PID:6960
- C:\Windows\System\QnNLwmK.exe
  C:\Windows\System\QnNLwmK.exe
  2⤵
  PID:7452
- C:\Windows\System\NFeszxD.exe
  C:\Windows\System\NFeszxD.exe
  2⤵
  PID:5268
- C:\Windows\System\palTJUH.exe
  C:\Windows\System\palTJUH.exe
  2⤵
  PID:7612
- C:\Windows\System\nQRKJtM.exe
  C:\Windows\System\nQRKJtM.exe
  2⤵
  PID:6832
- C:\Windows\System\LPCugLw.exe
  C:\Windows\System\LPCugLw.exe
  2⤵
  PID:8324
- C:\Windows\System\swTaEBI.exe
  C:\Windows\System\swTaEBI.exe
  2⤵
  PID:7468
- C:\Windows\System\ACBvnvl.exe
  C:\Windows\System\ACBvnvl.exe
  2⤵
  PID:7476
- C:\Windows\System\NOAcmDl.exe
  C:\Windows\System\NOAcmDl.exe
  2⤵
  PID:7688
- C:\Windows\System\hdfPdWr.exe
  C:\Windows\System\hdfPdWr.exe
  2⤵
  PID:8544
- C:\Windows\System\GcuGpYK.exe
  C:\Windows\System\GcuGpYK.exe
  2⤵
  PID:9080
- C:\Windows\System\ymSSSUy.exe
  C:\Windows\System\ymSSSUy.exe
  2⤵
  PID:7796
- C:\Windows\System\jVrZFxn.exe
  C:\Windows\System\jVrZFxn.exe
  2⤵
  PID:9172
- C:\Windows\System\rLqOfAZ.exe
  C:\Windows\System\rLqOfAZ.exe
  2⤵
  PID:6352
- C:\Windows\System\abrbMbh.exe
  C:\Windows\System\abrbMbh.exe
  2⤵
  PID:6588
- C:\Windows\System\RUmQhNu.exe
  C:\Windows\System\RUmQhNu.exe
  2⤵
  PID:7732
- C:\Windows\System\jcdNzXD.exe
  C:\Windows\System\jcdNzXD.exe
  2⤵
  PID:7116
- C:\Windows\System\lwdanbD.exe
  C:\Windows\System\lwdanbD.exe
  2⤵
  PID:5352
- C:\Windows\System\EtvOclY.exe
  C:\Windows\System\EtvOclY.exe
  2⤵
  PID:7492
- C:\Windows\System\McxHbzM.exe
  C:\Windows\System\McxHbzM.exe
  2⤵
  PID:8728
- C:\Windows\System\asjKTUV.exe
  C:\Windows\System\asjKTUV.exe
  2⤵
  PID:8300
- C:\Windows\System\RbwVSEy.exe
  C:\Windows\System\RbwVSEy.exe
  2⤵
  PID:9300
- C:\Windows\System\htNjUoV.exe
  C:\Windows\System\htNjUoV.exe
  2⤵
  PID:7160
- C:\Windows\System\XKWrsoi.exe
  C:\Windows\System\XKWrsoi.exe
  2⤵
  PID:7224
- C:\Windows\System\RMGVLAq.exe
  C:\Windows\System\RMGVLAq.exe
  2⤵
  PID:5404
- C:\Windows\System\OZSLlck.exe
  C:\Windows\System\OZSLlck.exe
  2⤵
  PID:8668
- C:\Windows\System\oTaIIao.exe
  C:\Windows\System\oTaIIao.exe
  2⤵
  PID:8692
- C:\Windows\System\DiPGiVl.exe
  C:\Windows\System\DiPGiVl.exe
  2⤵
  PID:14352
- C:\Windows\System\PMbYTxz.exe
  C:\Windows\System\PMbYTxz.exe
  2⤵
  PID:14376
- C:\Windows\System\DQfOgsU.exe
  C:\Windows\System\DQfOgsU.exe
  2⤵
  PID:14484
- C:\Windows\System\dICWfod.exe
  C:\Windows\System\dICWfod.exe
  2⤵
  PID:14556
- C:\Windows\System\qAkwjOn.exe
  C:\Windows\System\qAkwjOn.exe
  2⤵
  PID:14576
- C:\Windows\System\VzoRbFv.exe
  C:\Windows\System\VzoRbFv.exe
  2⤵
  PID:14604
- C:\Windows\System\ZSFwnzb.exe
  C:\Windows\System\ZSFwnzb.exe
  2⤵
  PID:14628
- C:\Windows\System\JmVUkUj.exe
  C:\Windows\System\JmVUkUj.exe
  2⤵
  PID:14652
- C:\Windows\System\bzGdeWR.exe
  C:\Windows\System\bzGdeWR.exe
  2⤵
  PID:14732
- C:\Windows\System\KFhNwSP.exe
  C:\Windows\System\KFhNwSP.exe
  2⤵
  PID:14756
- C:\Windows\System\eRvbQHW.exe
  C:\Windows\System\eRvbQHW.exe
  2⤵
  PID:14788
- C:\Windows\System\HGuIroh.exe
  C:\Windows\System\HGuIroh.exe
  2⤵
  PID:14816
- C:\Windows\System\ulpZuZN.exe
  C:\Windows\System\ulpZuZN.exe
  2⤵
  PID:14860
- C:\Windows\System\xpFmytC.exe
  C:\Windows\System\xpFmytC.exe
  2⤵
  PID:14876
- C:\Windows\System\NqXWMdY.exe
  C:\Windows\System\NqXWMdY.exe
  2⤵
  PID:14912
- C:\Windows\System\HsqeuCm.exe
  C:\Windows\System\HsqeuCm.exe
  2⤵
  PID:14944
- C:\Windows\System\ixcdfXf.exe
  C:\Windows\System\ixcdfXf.exe
  2⤵
  PID:14988
- C:\Windows\System\uOjrbIM.exe
  C:\Windows\System\uOjrbIM.exe
  2⤵
  PID:15016
- C:\Windows\System\kQpvYRO.exe
  C:\Windows\System\kQpvYRO.exe
  2⤵
  PID:15096
- C:\Windows\System\XNstvzH.exe
  C:\Windows\System\XNstvzH.exe
  2⤵
  PID:15132
- C:\Windows\System\mrDLubt.exe
  C:\Windows\System\mrDLubt.exe
  2⤵
  PID:15172
- C:\Windows\System\pvadIZi.exe
  C:\Windows\System\pvadIZi.exe
  2⤵
  PID:15208
- C:\Windows\System\UNayBFj.exe
  C:\Windows\System\UNayBFj.exe
  2⤵
  PID:15244
- C:\Windows\System\JbAuYhO.exe
  C:\Windows\System\JbAuYhO.exe
  2⤵
  PID:15268
- C:\Windows\System\FgLWnvk.exe
  C:\Windows\System\FgLWnvk.exe
  2⤵
  PID:15284
- C:\Windows\System\nDEosnK.exe
  C:\Windows\System\nDEosnK.exe
  2⤵
  PID:15308
- C:\Windows\System\ojVAkGb.exe
  C:\Windows\System\ojVAkGb.exe
  2⤵
  PID:15332
- C:\Windows\System\IHOKGKY.exe
  C:\Windows\System\IHOKGKY.exe
  2⤵
  PID:15352
- C:\Windows\System\tVzHEBS.exe
  C:\Windows\System\tVzHEBS.exe
  2⤵
  PID:9296
- C:\Windows\System\DSPWjBR.exe
  C:\Windows\System\DSPWjBR.exe
  2⤵
  PID:7008
- C:\Windows\System\Bpyjaqq.exe
  C:\Windows\System\Bpyjaqq.exe
  2⤵
  PID:9628
- C:\Windows\System\UeoxlwP.exe
  C:\Windows\System\UeoxlwP.exe
  2⤵
  PID:9376
- C:\Windows\System\fDUAqpj.exe
  C:\Windows\System\fDUAqpj.exe
  2⤵
  PID:14464
- C:\Windows\System\ZZQMyjo.exe
  C:\Windows\System\ZZQMyjo.exe
  2⤵
  PID:14496
- C:\Windows\System\sojyQyF.exe
  C:\Windows\System\sojyQyF.exe
  2⤵
  PID:6184
- C:\Windows\System\bZtdrky.exe
  C:\Windows\System\bZtdrky.exe
  2⤵
  PID:14348
- C:\Windows\System\ylGyDhZ.exe
  C:\Windows\System\ylGyDhZ.exe
  2⤵
  PID:14600
- C:\Windows\System\QRECdHk.exe
  C:\Windows\System\QRECdHk.exe
  2⤵
  PID:14540
- C:\Windows\System\eupCNZw.exe
  C:\Windows\System\eupCNZw.exe
  2⤵
  PID:14436
- C:\Windows\System\fAbrzPG.exe
  C:\Windows\System\fAbrzPG.exe
  2⤵
  PID:14688
- C:\Windows\System\zIeDqaw.exe
  C:\Windows\System\zIeDqaw.exe
  2⤵
  PID:7444
- C:\Windows\System\WLpetLs.exe
  C:\Windows\System\WLpetLs.exe
  2⤵
  PID:14784
- C:\Windows\System\jJfvAiP.exe
  C:\Windows\System\jJfvAiP.exe
  2⤵
  PID:14660
- C:\Windows\System\joitlJG.exe
  C:\Windows\System\joitlJG.exe
  2⤵
  PID:9392
- C:\Windows\System\dOQCOxH.exe
  C:\Windows\System\dOQCOxH.exe
  2⤵
  PID:14696
- C:\Windows\System\boJXyZQ.exe
  C:\Windows\System\boJXyZQ.exe
  2⤵
  PID:14908
- C:\Windows\System\HAacTLF.exe
  C:\Windows\System\HAacTLF.exe
  2⤵
  PID:14764
- C:\Windows\System\VOVXDLc.exe
  C:\Windows\System\VOVXDLc.exe
  2⤵
  PID:15128
- C:\Windows\System\srBlYyq.exe
  C:\Windows\System\srBlYyq.exe
  2⤵
  PID:15084
- C:\Windows\System\qSEFVgL.exe
  C:\Windows\System\qSEFVgL.exe
  2⤵
  PID:10068
- C:\Windows\System\IqrLkoX.exe
  C:\Windows\System\IqrLkoX.exe
  2⤵
  PID:8096
- C:\Windows\System\SufEWYP.exe
  C:\Windows\System\SufEWYP.exe
  2⤵
  PID:15236
- C:\Windows\System\PNJOoxQ.exe
  C:\Windows\System\PNJOoxQ.exe
  2⤵
  PID:10176
- C:\Windows\System\pJapWle.exe
  C:\Windows\System\pJapWle.exe
  2⤵
  PID:6724
- C:\Windows\System\afwxZkG.exe
  C:\Windows\System\afwxZkG.exe
  2⤵
  PID:15220
- C:\Windows\System\AdxhXHi.exe
  C:\Windows\System\AdxhXHi.exe
  2⤵
  PID:15320
- C:\Windows\System\zEOSWjL.exe
  C:\Windows\System\zEOSWjL.exe
  2⤵
  PID:15328
- C:\Windows\System\oXkCTBo.exe
  C:\Windows\System\oXkCTBo.exe
  2⤵
  PID:10052
- C:\Windows\System\RlHtKPY.exe
  C:\Windows\System\RlHtKPY.exe
  2⤵
  PID:7556
- C:\Windows\System\ZuCruAg.exe
  C:\Windows\System\ZuCruAg.exe
  2⤵
  PID:11956
- C:\Windows\System\xSPLiDm.exe
  C:\Windows\System\xSPLiDm.exe
  2⤵
  PID:9964
- C:\Windows\System\IdvVRZm.exe
  C:\Windows\System\IdvVRZm.exe
  2⤵
  PID:9056
- C:\Windows\System\DzLLmkF.exe
  C:\Windows\System\DzLLmkF.exe
  2⤵
  PID:5748
- C:\Windows\System\CghRsxt.exe
  C:\Windows\System\CghRsxt.exe
  2⤵
  PID:9052
- C:\Windows\System\TXHIQJy.exe
  C:\Windows\System\TXHIQJy.exe
  2⤵
  PID:8700
- C:\Windows\System\yxTSBpD.exe
  C:\Windows\System\yxTSBpD.exe
  2⤵
  PID:9440
- C:\Windows\System\nsecbLP.exe
  C:\Windows\System\nsecbLP.exe
  2⤵
  PID:9968
- C:\Windows\System\nlTpgYe.exe
  C:\Windows\System\nlTpgYe.exe
  2⤵
  PID:7320
- C:\Windows\System\VJWQncz.exe
  C:\Windows\System\VJWQncz.exe
  2⤵
  PID:10392
- C:\Windows\System\pfTbiQa.exe
  C:\Windows\System\pfTbiQa.exe
  2⤵
  PID:8628
- C:\Windows\System\NuMSOOe.exe
  C:\Windows\System\NuMSOOe.exe
  2⤵
  PID:14896
- C:\Windows\System\mhYWwMD.exe
  C:\Windows\System\mhYWwMD.exe
  2⤵
  PID:10808
- C:\Windows\System\eRCinbK.exe
  C:\Windows\System\eRCinbK.exe
  2⤵
  PID:10300
- C:\Windows\System\qnQFqnl.exe
  C:\Windows\System\qnQFqnl.exe
  2⤵
  PID:9512
- C:\Windows\System\vsvMNIH.exe
  C:\Windows\System\vsvMNIH.exe
  2⤵
  PID:11088
- C:\Windows\System\OwgJahV.exe
  C:\Windows\System\OwgJahV.exe
  2⤵
  PID:8964
- C:\Windows\System\HXkWBgG.exe
  C:\Windows\System\HXkWBgG.exe
  2⤵
  PID:15004
- C:\Windows\System\UuwMCMn.exe
  C:\Windows\System\UuwMCMn.exe
  2⤵
  PID:15080
- C:\Windows\System\oXtxuON.exe
  C:\Windows\System\oXtxuON.exe
  2⤵
  PID:13252
- C:\Windows\System\TBXKlRH.exe
  C:\Windows\System\TBXKlRH.exe
  2⤵
  PID:11872
- C:\Windows\System\qgMEiuE.exe
  C:\Windows\System\qgMEiuE.exe
  2⤵
  PID:15148
- C:\Windows\System\wKHKgqo.exe
  C:\Windows\System\wKHKgqo.exe
  2⤵
  PID:10120
- C:\Windows\System\ahxsFml.exe
  C:\Windows\System\ahxsFml.exe
  2⤵
  PID:7032
- C:\Windows\System\RqlvISI.exe
  C:\Windows\System\RqlvISI.exe
  2⤵
  PID:13236
- C:\Windows\System\ycAkpTt.exe
  C:\Windows\System\ycAkpTt.exe
  2⤵
  PID:11260
- C:\Windows\System\seUmCtt.exe
  C:\Windows\System\seUmCtt.exe
  2⤵
  PID:10080
- C:\Windows\System\JMCwYWh.exe
  C:\Windows\System\JMCwYWh.exe
  2⤵
  PID:9908
- C:\Windows\System\bHHwEat.exe
  C:\Windows\System\bHHwEat.exe
  2⤵
  PID:9832
- C:\Windows\System\qvyIshq.exe
  C:\Windows\System\qvyIshq.exe
  2⤵
  PID:8764
- C:\Windows\System\bYCSAJo.exe
  C:\Windows\System\bYCSAJo.exe
  2⤵
  PID:11344
- C:\Windows\System\avvOuME.exe
  C:\Windows\System\avvOuME.exe
  2⤵
  PID:15060
- C:\Windows\System\SrxCPeN.exe
  C:\Windows\System\SrxCPeN.exe
  2⤵
  PID:7800
- C:\Windows\System\ECTejTh.exe
  C:\Windows\System\ECTejTh.exe
  2⤵
  PID:9312
- C:\Windows\System\ztqsmmW.exe
  C:\Windows\System\ztqsmmW.exe
  2⤵
  PID:12640
- C:\Windows\System\KIGpGSs.exe
  C:\Windows\System\KIGpGSs.exe
  2⤵
  PID:8072
- C:\Windows\System\ZiZtAin.exe
  C:\Windows\System\ZiZtAin.exe
  2⤵
  PID:14448
- C:\Windows\System\bMmlSEp.exe
  C:\Windows\System\bMmlSEp.exe
  2⤵
  PID:9668
- C:\Windows\System\eRvYjHL.exe
  C:\Windows\System\eRvYjHL.exe
  2⤵
  PID:12452
- C:\Windows\System\jQgzHFN.exe
  C:\Windows\System\jQgzHFN.exe
  2⤵
  PID:7784
- C:\Windows\System\lLxFPnP.exe
  C:\Windows\System\lLxFPnP.exe
  2⤵
  PID:10328
- C:\Windows\System\UQKTmDd.exe
  C:\Windows\System\UQKTmDd.exe
  2⤵
  PID:10720
- C:\Windows\System\SrSjzEu.exe
  C:\Windows\System\SrSjzEu.exe
  2⤵
  PID:12336
- C:\Windows\System\MKnJjoG.exe
  C:\Windows\System\MKnJjoG.exe
  2⤵
  PID:13300
- C:\Windows\System\mdujLJW.exe
  C:\Windows\System\mdujLJW.exe
  2⤵
  PID:9332
- C:\Windows\System\xqAeCxr.exe
  C:\Windows\System\xqAeCxr.exe
  2⤵
  PID:14772
- C:\Windows\System\DvmCkPx.exe
  C:\Windows\System\DvmCkPx.exe
  2⤵
  PID:14672
- C:\Windows\System\uqiycOK.exe
  C:\Windows\System\uqiycOK.exe
  2⤵
  PID:7308
- C:\Windows\System\yjUAstW.exe
  C:\Windows\System\yjUAstW.exe
  2⤵
  PID:10520
- C:\Windows\System\hAsIlKe.exe
  C:\Windows\System\hAsIlKe.exe
  2⤵
  PID:7860
- C:\Windows\System\Jujjifn.exe
  C:\Windows\System\Jujjifn.exe
  2⤵
  PID:13288
- C:\Windows\System\qPQpXYz.exe
  C:\Windows\System\qPQpXYz.exe
  2⤵
  PID:11236
- C:\Windows\System\WYFsitT.exe
  C:\Windows\System\WYFsitT.exe
  2⤵
  PID:15092
- C:\Windows\System\PiCXDDu.exe
  C:\Windows\System\PiCXDDu.exe
  2⤵
  PID:10820
- C:\Windows\System\oEYQpzq.exe
  C:\Windows\System\oEYQpzq.exe
  2⤵
  PID:10864
- C:\Windows\System\AXQpmDo.exe
  C:\Windows\System\AXQpmDo.exe
  2⤵
  PID:12276
- C:\Windows\System\bsUQWia.exe
  C:\Windows\System\bsUQWia.exe
  2⤵
  PID:14868
- C:\Windows\System\tlAcBnu.exe
  C:\Windows\System\tlAcBnu.exe
  2⤵
  PID:9316
- C:\Windows\System\REmUKDg.exe
  C:\Windows\System\REmUKDg.exe
  2⤵
  PID:5372
- C:\Windows\System\iefYdgo.exe
  C:\Windows\System\iefYdgo.exe
  2⤵
  PID:12000
- C:\Windows\System\NuJMzEx.exe
  C:\Windows\System\NuJMzEx.exe
  2⤵
  PID:11632
- C:\Windows\System\TEAyQlN.exe
  C:\Windows\System\TEAyQlN.exe
  2⤵
  PID:6996
- C:\Windows\System\neXeybD.exe
  C:\Windows\System\neXeybD.exe
  2⤵
  PID:13060
- C:\Windows\System\vKHFdkA.exe
  C:\Windows\System\vKHFdkA.exe
  2⤵
  PID:10320
- C:\Windows\System\KlelEFT.exe
  C:\Windows\System\KlelEFT.exe
  2⤵
  PID:11172
- C:\Windows\System\BLyOHTx.exe
  C:\Windows\System\BLyOHTx.exe
  2⤵
  PID:13120
- C:\Windows\System\UUYmUxW.exe
  C:\Windows\System\UUYmUxW.exe
  2⤵
  PID:3956
- C:\Windows\System\QDaeuKP.exe
  C:\Windows\System\QDaeuKP.exe
  2⤵
  PID:15200
- C:\Windows\System\lgLOoSv.exe
  C:\Windows\System\lgLOoSv.exe
  2⤵
  PID:11784
- C:\Windows\System\rqjFtgG.exe
  C:\Windows\System\rqjFtgG.exe
  2⤵
  PID:10064
- C:\Windows\System\lQBxerV.exe
  C:\Windows\System\lQBxerV.exe
  2⤵
  PID:10044
- C:\Windows\System\zegPIWN.exe
  C:\Windows\System\zegPIWN.exe
  2⤵
  PID:11204
- C:\Windows\System\syJqTgD.exe
  C:\Windows\System\syJqTgD.exe
  2⤵
  PID:11528
- C:\Windows\System\tjkbfit.exe
  C:\Windows\System\tjkbfit.exe
  2⤵
  PID:10412
- C:\Windows\System\PdiBZoQ.exe
  C:\Windows\System\PdiBZoQ.exe
  2⤵
  PID:10368
- C:\Windows\System\wFvsZAh.exe
  C:\Windows\System\wFvsZAh.exe
  2⤵
  PID:13012
- C:\Windows\System\DTRqEcL.exe
  C:\Windows\System\DTRqEcL.exe
  2⤵
  PID:11856
- C:\Windows\System\nffwOjy.exe
  C:\Windows\System\nffwOjy.exe
  2⤵
  PID:13168
- C:\Windows\System\AutBaLi.exe
  C:\Windows\System\AutBaLi.exe
  2⤵
  PID:11028
- C:\Windows\System\GjRjYVh.exe
  C:\Windows\System\GjRjYVh.exe
  2⤵
  PID:10684
- C:\Windows\System\ZQjElFv.exe
  C:\Windows\System\ZQjElFv.exe
  2⤵
  PID:13204
- C:\Windows\System\koJVxbw.exe
  C:\Windows\System\koJVxbw.exe
  2⤵
  PID:10468
- C:\Windows\System\NbHfGMt.exe
  C:\Windows\System\NbHfGMt.exe
  2⤵
  PID:5832
- C:\Windows\System\KvBhqig.exe
  C:\Windows\System\KvBhqig.exe
  2⤵
  PID:9840
- C:\Windows\System\qDLNVHf.exe
  C:\Windows\System\qDLNVHf.exe
  2⤵
  PID:10096
- C:\Windows\System\zcxezos.exe
  C:\Windows\System\zcxezos.exe
  2⤵
  PID:12496
- C:\Windows\System\WvyRpFg.exe
  C:\Windows\System\WvyRpFg.exe
  2⤵
  PID:14528
- C:\Windows\System\shqyFTK.exe
  C:\Windows\System\shqyFTK.exe
  2⤵
  PID:15056
- C:\Windows\System\wJDRfHY.exe
  C:\Windows\System\wJDRfHY.exe
  2⤵
  PID:10028
- C:\Windows\System\uBvXZXI.exe
  C:\Windows\System\uBvXZXI.exe
  2⤵
  PID:13104
- C:\Windows\System\teQahkY.exe
  C:\Windows\System\teQahkY.exe
  2⤵
  PID:10748
- C:\Windows\System\uPbHZGW.exe
  C:\Windows\System\uPbHZGW.exe
  2⤵
  PID:13076
- C:\Windows\System\ZAnsCYZ.exe
  C:\Windows\System\ZAnsCYZ.exe
  2⤵
  PID:12816
- C:\Windows\System\lxWnyXH.exe
  C:\Windows\System\lxWnyXH.exe
  2⤵
  PID:15184
- C:\Windows\System\ksTwmhR.exe
  C:\Windows\System\ksTwmhR.exe
  2⤵
  PID:11320
- C:\Windows\System\Uqxggon.exe
  C:\Windows\System\Uqxggon.exe
  2⤵
  PID:9164
- C:\Windows\System\HdgYOTD.exe
  C:\Windows\System\HdgYOTD.exe
  2⤵
  PID:11364
- C:\Windows\System\QONQmDJ.exe
  C:\Windows\System\QONQmDJ.exe
  2⤵
  PID:11980
- C:\Windows\System\SyRnNhV.exe
  C:\Windows\System\SyRnNhV.exe
  2⤵
  PID:15164
- C:\Windows\System\qxemhuj.exe
  C:\Windows\System\qxemhuj.exe
  2⤵
  PID:3244
- C:\Windows\System\vblwYCc.exe
  C:\Windows\System\vblwYCc.exe
  2⤵
  PID:11012
- C:\Windows\System\JWezBEJ.exe
  C:\Windows\System\JWezBEJ.exe
  2⤵
  PID:9396
- C:\Windows\System\dGhjGGZ.exe
  C:\Windows\System\dGhjGGZ.exe
  2⤵
  PID:8768
- C:\Windows\System\UyauDlT.exe
  C:\Windows\System\UyauDlT.exe
  2⤵
  PID:9700
- C:\Windows\System\AxQrCVF.exe
  C:\Windows\System\AxQrCVF.exe
  2⤵
  PID:12120
- C:\Windows\System\qmIUpXp.exe
  C:\Windows\System\qmIUpXp.exe
  2⤵
  PID:12908
- C:\Windows\System\pRJScMp.exe
  C:\Windows\System\pRJScMp.exe
  2⤵
  PID:12168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5sv04boi.ags.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BRAFbmH.exe

Filesize
2.2MB

MD5
b30844f5360b9b5446343e60ee0365c6

SHA1
2a1c0fedd8299c2ec27f01b1b0bc35d982a44f4f

SHA256
0416a2cb96e8e241337313451d9fa5f47e0d353c12cee5a47dd698c57795807e

SHA512
4e118f56b5aa10e76e08de3678dc3cfbbf80053d7cce160c53655e7129068aa7626191a253d4f35467c25c65c6271eabf76bbd5cf3124ca7e079390aeda1f4f9

Download Submit
C:\Windows\System\BXxBVCt.exe

Filesize
2.2MB

MD5
2beee5aa2895ef9f687087c4bca6a5f2

SHA1
584fe7483d81b98d73506c1f9c7f4cc0c1883eb7

SHA256
7bab36db04c890b75b3be7db34b2f5ff1c0ee7b97a90c65cee5e9b02d6de7e93

SHA512
879d462f1abfca51e72dcd58aede6ad6f0d872e3f9c8f590fe68f4c08a0f5a6ba2add40418711251c9fcd651f179e3316d04a80a9f3027fc5aaf4ea9c12c6afd

Download Submit
C:\Windows\System\BYeOWCx.exe

Filesize
2.2MB

MD5
b4a1e535be4669669425e899182b354b

SHA1
2c000766ab9a17b1641759d4272655929db4295f

SHA256
1ddc36b7244429d5a5ca25ae3ff1043ebd3d23aa4da67225f365fa8b55898128

SHA512
844b66d2fb0ed348404b594ad04cf1137b5f60ff67740ed2597ea12a484be2dc5e73be42335bfa7ee1e90465ab1565a956f5e23a60b1f559012bb06096466916

Download Submit
C:\Windows\System\CpbHDCH.exe

Filesize
2.2MB

MD5
755140fe609d2e269feb36f3876cd700

SHA1
5c3ee21b8ef914067a9b38b7e18898f5c7714b02

SHA256
fc4d9ec1dc617c782e7e875f817b228b2174c96a4ea9ca490984fd6d57865e78

SHA512
4331c177a2db01cc633d9791dcbbe1c67a64904d6b39bf430029c3d3d73ee5aa8c43d96cf8acf8bc53c8f8bbad590088c0e187f3b5931f591b04492a9592f718

Download Submit
C:\Windows\System\FUlzfjB.exe

Filesize
2.2MB

MD5
6c237ba017b64bdbce661e53759eb612

SHA1
df97c01f3186047dd8c35bacbc4faad1f41b031a

SHA256
abf2dc6bbd0350cd7096b163a8522a3d3ed27fbd1990797aa3827b933dc3246f

SHA512
540f448386e5a5979df6855213af2cf3ef18e0dd29d7509ffdee33f474d64df6a1cda4ebf30304eb1fba6cc388c0b870ce8b6e182cfa6c0add0c631c66ae23d6

Download Submit
C:\Windows\System\GoomXZd.exe

Filesize
2.2MB

MD5
1a1f141e0f15ca5c41f3458117c3400a

SHA1
11aae5cae00af1d2b8a322cd34af99dcdd82d432

SHA256
007d8cd53e54506755efd17424fb7276d18d34590ed63f251dca99e1a3414f47

SHA512
188bfccb0b3fff3d4c7dd2579ff2ee2da89d7bfb107f4a1a5c4a90a9c52cb7e31ac80e86901bec2b1ce18a375541bba884e6a87271976bb81bcd9b2699f9e7ea

Download Submit
C:\Windows\System\IMLhsLu.exe

Filesize
2.2MB

MD5
f3d8170e2f2f62075e233b499d051a3d

SHA1
cab4e8f3365f6d29907a2e73b02bb864fee527cb

SHA256
21ba6748bb106f8a32136d2495896f8541d21d62555f73ba9ac5dc0711640652

SHA512
25c49e03c86038500e4b366d70a765182e5b61ee193b00d54e0f17b4a16c87bf5a5455386e9b0dc83e30d19468eb55cde32fdffb138bb1556326c7228798018d

Download Submit
C:\Windows\System\IcsNlFz.exe

Filesize
2.2MB

MD5
9ae07ce2c09d4187a422250db20039f0

SHA1
ddcc9d2eac56217bed0934c09111cce4fec79caa

SHA256
578348b0f99200098db38b226a68b26e1e01f1ec899cca2187a035f60f9d85a4

SHA512
e0bf7bbe862c339c64afee9b8b69fdd1367de1ee6c4793e422ee229d12f48d482199d503e809e8f4dd68f1c12929e986f342376425eb8aa488fc17832452949b

Download Submit
C:\Windows\System\IpisSSC.exe

Filesize
2.2MB

MD5
a0c05adb2c32ca8e0f7b18883bbd50f2

SHA1
d7854ff4a15359e2d559f294e5232a0f5d0be8e2

SHA256
e53013228f4a715bd3ec91409d8a3259873bc07ea3bd40cf2a185b9e664965e2

SHA512
1f2198c6cfe998fdc7b9f305a0697c00b334d176f840187249434d158826faac0818633959d5635199e3eaf0de1e0a7898a4846edd973db9c7a86da5b0910388

Download Submit
C:\Windows\System\OMhkhWq.exe

Filesize
2.2MB

MD5
5f9c970ab8bb1183d4780e01b231f412

SHA1
e26180be7cc9d946ffee0e2c0a68ee2b549a21b6

SHA256
ec9c34d7a7a19471371eb0c9fae0a688c8ac47c9172aa7a947b57d540776b190

SHA512
0f3fdcf6f1764e81b29cbd598c4fadd8cc9c0bfbc4e896916f83603f1b26ba9bce501f234f6f2795ccf37916f8ab64e0266d2a149c25db70d65c2923448dc4c0

Download Submit
C:\Windows\System\QRoJarP.exe

Filesize
2.2MB

MD5
d44afc6fb4739eb04ea8a771e0b4a893

SHA1
c3864cae21a1a4f63cdce40cf9029e12438a9b26

SHA256
9389db4f420a2ae00c7cdc0578eb9bd357a6ad9859ad13e49acff4c36a0b3ebb

SHA512
5246b077d2e8a293073a9d3e9b6ff5587c2ec41372a6107c09d42403f21d5c05ee59a18ced7c6ae4803b09307a3fc7b437cfb09803baedded75f8cabd69666be

Download Submit
C:\Windows\System\RYFWMaH.exe

Filesize
2.2MB

MD5
b0a560853b836be92872eed1341bc9b2

SHA1
147d740c14ce709b63cc06dd2a5ae51cd52a627c

SHA256
c69cd6460d5128bfe705962e9af6613acfe79d253fa380d24e52cb64151960b5

SHA512
f1cc43bd91f34b141638bf6cf15130d55038e760a772095514da45a820041e8cc3226f0a5d694750572256a5b1a61e11d839f49626a5067c455ce720513b962d

Download Submit
C:\Windows\System\RiGuXOZ.exe

Filesize
2.2MB

MD5
b98d6593ae59a537ae56795cb2662c12

SHA1
aa880e59450051daf5cb88e595390b8bafcf677a

SHA256
e7ead7db51d846a4989cc03d62eb67993fb3091b24c2d5fbf108a9acb569dc0d

SHA512
3bd19338a5c7767d306b8e68a0fccf775fa46d3f32ccaa8a21ac79254f3f279e70e7ee0acbd999b4fabca1df62d70ac94fa2da0899efd2af5abb30577e1e9f56

Download Submit
C:\Windows\System\RufHtjp.exe

Filesize
2.2MB

MD5
6b55bf72bb20729e231e20cd0e1b296b

SHA1
72f17b331262ea006fae6b73ea9197e0f5d0a9c2

SHA256
51aa7d763daae3fdd65dde65cdaa0323916709fb2dc70e3974070054fbd6681d

SHA512
3b839454fa8fdfd9d3eaadca6732662c43013b04831e55c26e3db807c262950738cbcb700a6d5d35c997772a8955731ca1131b0612309e6f249fc6c51480f30a

Download Submit
C:\Windows\System\SnYuULS.exe

Filesize
2.2MB

MD5
aae1fa59bc59a7c1937b2a9fa95b0bd7

SHA1
4970b43660d85a40b5909dd9aa76cc5f96dafb85

SHA256
f63bd12e1247b12c9ef47d6fdb60f91805a38d3247fc03537d51deb212511959

SHA512
2de70fc541853bb66db001ed38efe09e84ed591eb8e6fc40c80ba9b195f17f0f2fb46a5d012e693d68e9804e79bc3974ad8d37e9759f487e2db164fc2af680ef

Download Submit
C:\Windows\System\TecIGYk.exe

Filesize
2.2MB

MD5
51e9e30683d3a17b30397894dd89e67e

SHA1
4b05bcb624582cb76ac47f1765e46b872ee9c9d6

SHA256
cc6658920b8d608e8f053529420cc2db89ba475ca1ee7f79ec586f5c5c423980

SHA512
c5faffe1af471d93e5b2bcd2702d5b2e53d33211fb889e6289a98fd9b8098795e6dce54f3fd1699b6cac80dc01b8e233710705e3343da1b86f3c4f3d5e639524

Download Submit
C:\Windows\System\UOjhQmx.exe

Filesize
2.2MB

MD5
947cc4033bc2c305e52909490f3face7

SHA1
1fd3a63409b1107b214579afaf2beeab832a79e7

SHA256
0f0cba48c14aef7386eb90185cd1c6467c438317bdd51783d0ebe34d7977abbf

SHA512
9b892fc812554eefeaf8bd89669596e31013e2bb4433615701258b13f81794b490aebc16c86a539839df8c1608fe37c89897be5839dbac41218fbc683baed51d

Download Submit
C:\Windows\System\UXaQBEC.exe

Filesize
2.2MB

MD5
2933be0e233aee58d22100eb2f3d22de

SHA1
fe422443ac3b547ac58bc7c66087084a0e340fd1

SHA256
b77c5accbba9eac51555084dfef874fc1f6a884ab51b35bb32ae73a9a2b835d6

SHA512
51a1e687c3cc9b32393bcb1d008f5aaabb7341f462d0c00cd02c4fc2e4a1ea5d72883cd7c66ed1a3857ceb514d2e1b7071d46284dee88b00cb37928673e2ac94

Download Submit
C:\Windows\System\alwbvdX.exe

Filesize
2.2MB

MD5
e5943bf36ce5d6f36344750909b88709

SHA1
cb444fc4d82c5b23deeef7e39c78ee9e6cc4725b

SHA256
66e7a15df8799537435ad485e13379d94260b7c485c4fa17bc9c8adad6569a91

SHA512
5a94b32da7b6cf40174a5696dd3980e2ff82e433f70a6c70bc5d67b46bb7ced5c15ae84418ab6d36d9589a353532d9dd6ff23d7d59d0a9d1d9516c96f8de5151

Download Submit
C:\Windows\System\awuLTQZ.exe

Filesize
2.2MB

MD5
f21c50dadbb9235b9be3300c765ddeef

SHA1
2992ddcba83cc51f624d8c5e45cf29dff9c91f69

SHA256
db650364c636fdab7d4bb70ad403faf576d6fa65ddc5b82b47a5a0a43915d9aa

SHA512
34698b286375cd9125a39a2109633bed51a2c5426cca7261f2815165ad5c3df53cfad8dacfdf746ffc51aa5adc8f95b70ab6e330fd93eefd4c2f05db0d116873

Download Submit
C:\Windows\System\cArLOKr.exe

Filesize
2.2MB

MD5
46f0041ac887184ababa96bf34e37560

SHA1
0c70f8c7065cb5206da1a09ea590194e9ed5ccc8

SHA256
8c13058a7847422f817d3c3a0b5032d3d1770460eea4c8c1ff8b362c17b3f6cd

SHA512
9f6fc2380f958e2d2f4a554460dde7062d824f5efd08054e6bb1d3d6999b9ef1de908418589e459e5e27908c2222760a0d98787e1f22d847d1f05fa641448e23

Download Submit
C:\Windows\System\ftbGOZY.exe

Filesize
2.2MB

MD5
9e0d478311a40f46ec3b3abf8b090e96

SHA1
68e6162061b5339190ea8369cc3ed1c216b667b0

SHA256
479d1b2890e482643069f10021bd9b75532c42acbb4ba9da0ef64099ecf8325b

SHA512
bcdfd204f30e531a7973fcd8ad3fcc7fb68394a47733aee73eb4a7ea7ac8a432794e2648e7e90c2b82d806fd4d249c0793cd70f2ecd7465a3c4c74a591f68d14

Download Submit
C:\Windows\System\gEszPGO.exe

Filesize
2.2MB

MD5
4bb7ee948d506bdf597bf617f0b57d80

SHA1
898bc57a183ac7dc8953f8a070c8e744ffa46973

SHA256
63f034da1b6ce177470ce8e448a0fbb2804efa510edc09a1bf8c5396aaa46cc7

SHA512
b3326f7ccb8dc3f0ef73e8421b7c1dbf8a73debc03572231d38e0175e618cdec13f6ec7fd2d81a812b31d65b85f4f643240c5ee58bf86458fdee8ff3d753fc02

Download Submit
C:\Windows\System\hTDBIcD.exe

Filesize
2.2MB

MD5
6cac50eb102c5273ddea0a2633519645

SHA1
e91d9354b5cdd24497af5da98981228c471b184d

SHA256
64968ec5380906ae17b9dd8401b4ab20b726028ab6b742f52f7929ba0886ea1d

SHA512
1589237e8a6f15dccf070f223642226ee6105fab84a7c043bbdfd657f21ab304aa493168fbd1825e781800d9ec54c689146c40a0fd68156e8b4a19713025349f

Download Submit
C:\Windows\System\kVDOUWG.exe

Filesize
2.2MB

MD5
c6d620f7f40d2fd109a2a6edeee87611

SHA1
11b691bed3b9bebd1dda5f5b51e59275f046d471

SHA256
62f2d633433d120caa50e9b1592a45358c6aafdef990bc0d69ac26f06a884f8b

SHA512
e190b2b9570de45d1b8a78d251ef5a1a163b4ab05efb56894270a6564f2206b957ac087412053582cb9852253a4ba300a19e16cf15364559d40668d20a93f34c

Download Submit
C:\Windows\System\klUTAmf.exe

Filesize
2.2MB

MD5
cd192f05fa91ed11bd990eab8723cc5a

SHA1
5be5454bc54489a3f5c2e57f5705ae935e6cd308

SHA256
c44d283845fdad37f2ae4c3db537c546abc6aa72601b0911482efd13d4a4cfe6

SHA512
64f9accd94c3492bf369f752179f9886ee5ea5057e911e5e38f9ad011e9c182e164bb225745da67c803f05d3d0972a198eb86da6281c0e379ef5c776decceab7

Download Submit
C:\Windows\System\lMDPlTv.exe

Filesize
2.2MB

MD5
28e89b2bcce4c4513ee20e7c4a92b35b

SHA1
3cff12aafd0f50d8ea1471d98cfe26d15c5c78e0

SHA256
b0ea6d58f969e0dd4399aa07c95386cdfd79ee3d384d5da86f37fc6f4292b1e8

SHA512
ac850d06299e8c66d4cfe3335ebe94a1b5d7f89c68c5282d331a77241e9a8ddf6be4f3fedeea418ec30ee3ab12d404e820a676a2fe49e2bd7e2a525e90996203

Download Submit
C:\Windows\System\nGyBEHR.exe

Filesize
2.2MB

MD5
cb3e116f02621780de5fcf7e5a31fd31

SHA1
a550a555cd93b6d45525fd3da59eca6fca326c2b

SHA256
a5c30de0a11a34719e10d57bbb53d710c4c4b48bac680ce677b2c2d89e85320a

SHA512
1886c40c5d45408ba6b152e727ad108867f929c0463335aee24db3cbb67172f30cedafdc8beaae69f9289ac661b2022e3079649d163c277a7fb953132d75e06f

Download Submit
C:\Windows\System\ntAPzbF.exe

Filesize
2.2MB

MD5
12430d9c9884dfff949de378384d292b

SHA1
3b7a50abf1ae1e326b5b26bf663d0dee71a8fb20

SHA256
6d70224e333002a3f7e1e75b0f20cc7c1759f79f5041c9098f3cb3980f8951f3

SHA512
cae17cf33de47891addf38667baf1c1909e428229566218597d07bca92781e1b68ee78ac738fa5db82fa6b787a7dd658c01a0773f86833bc9dbf2060d35d6b63

Download Submit
C:\Windows\System\pecsPrk.exe

Filesize
2.2MB

MD5
efd959aeb081bc41f37f7713f48bf804

SHA1
f59d436af29accbab9be22d5c91cb23e8029ac45

SHA256
781dc2ddaf3b9dc12423d750ac62153c6017ddd0e1d9f86ab17d44237116fd08

SHA512
fc5518994ba4dbde50363b005f91e4d820670beffdb97052da5123ea3f3a38eed1d525daadc00b3d640fab9eabbe9fb7a249014417a186ef643a5fa47f56862c

Download Submit
C:\Windows\System\qHfLaqy.exe

Filesize
2.2MB

MD5
111dac7f29a180e7f44bc6ad512ee330

SHA1
8e75af164d54acc15c31533ccb57af7ccd43e991

SHA256
f94cc7b2b868caf5e342c6d616d7b0fcdb880f6a2bec56152f387be88edda4f0

SHA512
a88562d41319e7f319e4978105fd4389ce767521c03556fb40c34908f3b918f304c386b774ed18f978162f03b2d0d39d21702eeb1e50c88c2198abfe301bd182

Download Submit
C:\Windows\System\sJihNsq.exe

Filesize
2.2MB

MD5
9c91e86102bbbef8fa7f5fcfe4af6906

SHA1
65748b7e7844009e1e6cd1c71e5575ca23d946ab

SHA256
c7d3bd5bdcd5b201e16ef9fdcd6dbb90bb59f1e047b24b072b8537288918909c

SHA512
07baa88e2b22fcc6a87aaf55d5f884bee3d79ccc5e8cc37c964d3893983f3bb4c11421c70026fc8804bfd6db2aea82ddf5d9bb085497e69f7161af4179d681da

Download Submit
C:\Windows\System\szkOLDx.exe

Filesize
2.2MB

MD5
14423871d394b5447635bfb67be86d2e

SHA1
2355140a9a2fe41d1d961c1967bbaca3b4874de6

SHA256
2974b10bd011f87b8e3977ce9f6dcdd696b067bc6317e116869f5c4ad16b151f

SHA512
d16cd288e18de8fed5b26e969698f0a8b658d15833f0ab089b02445705445689541920cd64859fd8c4f5efd21ce813b6d4923fac72256c98f7afd7c26f280ce8

Download Submit
C:\Windows\System\uGMpBMj.exe

Filesize
18B

MD5
35bde48c57b79a5e0ea0718733e62371

SHA1
41d2e344c30d7af2c472ba7a6ded43f0a9d6d4c2

SHA256
407b155a736cda52f1eb2b18d7fea9e028f3f4f796230535df591f3124a679c0

SHA512
a6c519b6e0f42a0f961fc4c0161e01dfb018e01d40d6b50a2a61a6cfeffa9e0fa78a3d1bb24269ec827e815cd0942de8d545ba7f93aa13de1bab78f87b543dba

Download Submit
C:\Windows\System\uGUmgGv.exe

Filesize
2.2MB

MD5
ab93cf20600acb876415572d9c4883b4

SHA1
35b0004c9051a0f8db9477c4371e886f1b7b0b45

SHA256
a64c8519b3e38c08e29c75f0e7632666c1ec4bf53f8f5e96fac877f5b086014f

SHA512
17e9f487f382147aea4957cc52cc95e51d81aab0f2853054a460a126c485074120f03f7dcbad9d852aeae799a87ff465c00dda4d016fb01a7deb238a326051ca

Download Submit
C:\Windows\System\uHUBiii.exe

Filesize
8B

MD5
0b02220145771e90ebe4310a5742c9eb

SHA1
9bd568d96b03bd5446f96a7b59c08196eb5a57c3

SHA256
6135f164d0697be47c97ab606a7a1adcbc1eb3846ae4debecafb1a6ccfd23e4e

SHA512
cb08dee7f4e4dd1bb8de836a2364c078d9de5aef5dcb329e7e0b8e1cc2bfaa06c42f8b8ddf04bdb30392074759beef091a761854b0812b9a726b3c820c99a5a8

Download Submit
C:\Windows\System\vHDjOlr.exe

Filesize
2.2MB

MD5
ecd93454dc2f550ec23eda3e2a43470e

SHA1
556d13842fa68bae81e3d876fe99683126cc8d00

SHA256
6290aa57868380894ea0e277954a8a3b80172635b397d74f85323a624c77c9c4

SHA512
fd06c57c2a7f51d1b3eb0f0a2fc40b6a6dbd82927e4b040d9e9e8e65d0cac2434a112fe4abdfc9f4785c5e55040f21049e42244121dd61b76efd53af1d438723

Download Submit
C:\Windows\System\wcLFJKD.exe

Filesize
2.2MB

MD5
40addb7a0d038bf889439ae439723e0d

SHA1
d3943b1c8ae33da9a5a07b88ed13b6335660eeb5

SHA256
d49b99115090428be2ccd69068806f80c4ed8af5c22a6a7250d7a8c3cc0dff0c

SHA512
0f2af054f4de629204ccb5412532ba8120270904e0d12e0ada6d0d2d70d2bd7209c1fcfee329756003122bce957135e8dc224ee475b377c8dc031a1a97d4db2c

Download Submit
C:\Windows\System\wrSsjrR.exe

Filesize
2.2MB

MD5
ff2583eaedeaf8c0fc11bcf42ea7aaea

SHA1
eed856aaf3f0d836b331013c6dbe7df3da37901e

SHA256
7d2ef534699d384a6ecae7b38fb624e085d218917e2104a5c9cad2aa7aa264e8

SHA512
f1acf870d17752352e50c6680bdfcb9cc512f6388a20b106d12663b00cd3d22bdecf915deaab19961f127a90e2f44ea4dbe7b10b68911d660a98a763b57e2dc1

Download Submit
memory/112-5683-0x00007FF6CC7F0000-0x00007FF6CCBE2000-memory.dmp

Filesize
3.9MB

Download
memory/112-17-0x00007FF6CC7F0000-0x00007FF6CCBE2000-memory.dmp

Filesize
3.9MB

Download
memory/632-115-0x00007FF79BD00000-0x00007FF79C0F2000-memory.dmp

Filesize
3.9MB

Download
memory/632-5737-0x00007FF79BD00000-0x00007FF79C0F2000-memory.dmp

Filesize
3.9MB

Download
memory/1400-5704-0x00007FF6D1260000-0x00007FF6D1652000-memory.dmp

Filesize
3.9MB

Download
memory/1400-139-0x00007FF6D1260000-0x00007FF6D1652000-memory.dmp

Filesize
3.9MB

Download
memory/1428-5709-0x00007FF69E3E0000-0x00007FF69E7D2000-memory.dmp

Filesize
3.9MB

Download
memory/1428-201-0x00007FF69E3E0000-0x00007FF69E7D2000-memory.dmp

Filesize
3.9MB

Download
memory/1512-218-0x00007FF6F4D30000-0x00007FF6F5122000-memory.dmp

Filesize
3.9MB

Download
memory/1512-5721-0x00007FF6F4D30000-0x00007FF6F5122000-memory.dmp

Filesize
3.9MB

Download
memory/1680-203-0x0000025FFC830000-0x0000025FFC840000-memory.dmp

Filesize
64KB

Download
memory/1680-237-0x0000025FFCAB0000-0x0000025FFCAD2000-memory.dmp

Filesize
136KB

Download
memory/1680-86-0x00007FFFCB1A0000-0x00007FFFCBC61000-memory.dmp

Filesize
10.8MB

Download
memory/1680-2545-0x0000025FFC830000-0x0000025FFC840000-memory.dmp

Filesize
64KB

Download
memory/2028-5741-0x00007FF68EBC0000-0x00007FF68EFB2000-memory.dmp

Filesize
3.9MB

Download
memory/2028-244-0x00007FF68EBC0000-0x00007FF68EFB2000-memory.dmp

Filesize
3.9MB

Download
memory/2328-289-0x00007FF746EB0000-0x00007FF7472A2000-memory.dmp

Filesize
3.9MB

Download
memory/2328-5773-0x00007FF746EB0000-0x00007FF7472A2000-memory.dmp

Filesize
3.9MB

Download
memory/2504-324-0x00007FF6F3D00000-0x00007FF6F40F2000-memory.dmp

Filesize
3.9MB

Download
memory/2504-5753-0x00007FF6F3D00000-0x00007FF6F40F2000-memory.dmp

Filesize
3.9MB

Download
memory/2560-186-0x00007FF7B7E10000-0x00007FF7B8202000-memory.dmp

Filesize
3.9MB

Download
memory/2560-5712-0x00007FF7B7E10000-0x00007FF7B8202000-memory.dmp

Filesize
3.9MB

Download
memory/3292-28-0x00007FF77AA70000-0x00007FF77AE62000-memory.dmp

Filesize
3.9MB

Download
memory/3476-360-0x00007FF73E510000-0x00007FF73E902000-memory.dmp

Filesize
3.9MB

Download
memory/3476-5726-0x00007FF73E510000-0x00007FF73E902000-memory.dmp

Filesize
3.9MB

Download
memory/3928-5701-0x00007FF687690000-0x00007FF687A82000-memory.dmp

Filesize
3.9MB

Download
memory/3928-183-0x00007FF687690000-0x00007FF687A82000-memory.dmp

Filesize
3.9MB

Download
memory/3976-258-0x00007FF725ED0000-0x00007FF7262C2000-memory.dmp

Filesize
3.9MB

Download
memory/4000-5718-0x00007FF6D5D10000-0x00007FF6D6102000-memory.dmp

Filesize
3.9MB

Download
memory/4000-306-0x00007FF6D5D10000-0x00007FF6D6102000-memory.dmp

Filesize
3.9MB

Download
memory/4044-274-0x00007FF6BA7A0000-0x00007FF6BAB92000-memory.dmp

Filesize
3.9MB

Download
memory/4044-5725-0x00007FF6BA7A0000-0x00007FF6BAB92000-memory.dmp

Filesize
3.9MB

Download
memory/4428-5768-0x00007FF623120000-0x00007FF623512000-memory.dmp

Filesize
3.9MB

Download
memory/4428-429-0x00007FF623120000-0x00007FF623512000-memory.dmp

Filesize
3.9MB

Download
memory/4516-5746-0x00007FF6F7470000-0x00007FF6F7862000-memory.dmp

Filesize
3.9MB

Download
memory/4516-380-0x00007FF6F7470000-0x00007FF6F7862000-memory.dmp

Filesize
3.9MB

Download
memory/4932-5729-0x00007FF7131B0000-0x00007FF7135A2000-memory.dmp

Filesize
3.9MB

Download
memory/4932-231-0x00007FF7131B0000-0x00007FF7135A2000-memory.dmp

Filesize
3.9MB

Download
memory/5000-1-0x00000189B74F0000-0x00000189B7500000-memory.dmp

Filesize
64KB

Download
memory/5000-7036-0x00007FF683370000-0x00007FF683762000-memory.dmp

Filesize
3.9MB

Download
memory/5000-0-0x00007FF683370000-0x00007FF683762000-memory.dmp

Filesize
3.9MB

Download