xmrig | b1d9248f4a3605d972808675e3e08b526656f82ca1b9beb6718d65ff3aac9940

Analysis

max time kernel
152s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 03:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
Size

2.2MB
MD5

0f95b38fa957dfc7484d8cf542f413e8
SHA1

7f5e84674836e0f167a7913edce52b84e5572c74
SHA256

b1d9248f4a3605d972808675e3e08b526656f82ca1b9beb6718d65ff3aac9940
SHA512

a415094bd89cea4f0e7ca7b82960d8918fd3a8835ac1ca92946a3b3879eed281b84456fc6c5abd721454d6bff10c79dd41f29f31ac269686495901e89237a489
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qr3:NABI

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 44 IoCs

miner

resource	yara_rule
behavioral2/memory/4032-29-0x00007FF7C3F60000-0x00007FF7C4352000-memory.dmp	xmrig
behavioral2/memory/4584-42-0x00007FF6431D0000-0x00007FF6435C2000-memory.dmp	xmrig
behavioral2/memory/3112-100-0x00007FF7AFC90000-0x00007FF7B0082000-memory.dmp	xmrig
behavioral2/memory/2232-103-0x00007FF79A9A0000-0x00007FF79AD92000-memory.dmp	xmrig
behavioral2/memory/2356-113-0x00007FF7D49F0000-0x00007FF7D4DE2000-memory.dmp	xmrig
behavioral2/memory/2684-382-0x00007FF77FBD0000-0x00007FF77FFC2000-memory.dmp	xmrig
behavioral2/memory/4588-402-0x00007FF7D1EF0000-0x00007FF7D22E2000-memory.dmp	xmrig
behavioral2/memory/1028-443-0x00007FF788280000-0x00007FF788672000-memory.dmp	xmrig
behavioral2/memory/1068-471-0x00007FF72A8C0000-0x00007FF72ACB2000-memory.dmp	xmrig
behavioral2/memory/2696-551-0x00007FF731250000-0x00007FF731642000-memory.dmp	xmrig
behavioral2/memory/2900-546-0x00007FF735180000-0x00007FF735572000-memory.dmp	xmrig
behavioral2/memory/2844-509-0x00007FF79AB10000-0x00007FF79AF02000-memory.dmp	xmrig
behavioral2/memory/2548-420-0x00007FF752A50000-0x00007FF752E42000-memory.dmp	xmrig
behavioral2/memory/1788-413-0x00007FF718A10000-0x00007FF718E02000-memory.dmp	xmrig
behavioral2/memory/2396-116-0x00007FF74CD00000-0x00007FF74D0F2000-memory.dmp	xmrig
behavioral2/memory/4628-106-0x00007FF667730000-0x00007FF667B22000-memory.dmp	xmrig
behavioral2/memory/3688-86-0x00007FF6C3FC0000-0x00007FF6C43B2000-memory.dmp	xmrig
behavioral2/memory/3488-85-0x00007FF78DCF0000-0x00007FF78E0E2000-memory.dmp	xmrig
behavioral2/memory/3528-76-0x00007FF7F0670000-0x00007FF7F0A62000-memory.dmp	xmrig
behavioral2/memory/4692-71-0x00007FF7B6E00000-0x00007FF7B71F2000-memory.dmp	xmrig
behavioral2/memory/4584-1571-0x00007FF6431D0000-0x00007FF6435C2000-memory.dmp	xmrig
behavioral2/memory/4032-1692-0x00007FF7C3F60000-0x00007FF7C4352000-memory.dmp	xmrig
behavioral2/memory/3688-1696-0x00007FF6C3FC0000-0x00007FF6C43B2000-memory.dmp	xmrig
behavioral2/memory/2684-1863-0x00007FF77FBD0000-0x00007FF77FFC2000-memory.dmp	xmrig
behavioral2/memory/3204-1884-0x00007FF78E0D0000-0x00007FF78E4C2000-memory.dmp	xmrig
behavioral2/memory/3744-1972-0x00007FF75C520000-0x00007FF75C912000-memory.dmp	xmrig
behavioral2/memory/3196-1974-0x00007FF7F2BC0000-0x00007FF7F2FB2000-memory.dmp	xmrig
behavioral2/memory/1436-1984-0x00007FF783180000-0x00007FF783572000-memory.dmp	xmrig
behavioral2/memory/3112-2003-0x00007FF7AFC90000-0x00007FF7B0082000-memory.dmp	xmrig
behavioral2/memory/2900-2057-0x00007FF735180000-0x00007FF735572000-memory.dmp	xmrig
behavioral2/memory/2548-2020-0x00007FF752A50000-0x00007FF752E42000-memory.dmp	xmrig
behavioral2/memory/4588-2019-0x00007FF7D1EF0000-0x00007FF7D22E2000-memory.dmp	xmrig
behavioral2/memory/2844-2037-0x00007FF79AB10000-0x00007FF79AF02000-memory.dmp	xmrig
behavioral2/memory/1788-2018-0x00007FF718A10000-0x00007FF718E02000-memory.dmp	xmrig
behavioral2/memory/2232-2000-0x00007FF79A9A0000-0x00007FF79AD92000-memory.dmp	xmrig
behavioral2/memory/4628-1993-0x00007FF667730000-0x00007FF667B22000-memory.dmp	xmrig
behavioral2/memory/2396-1990-0x00007FF74CD00000-0x00007FF74D0F2000-memory.dmp	xmrig
behavioral2/memory/2356-1986-0x00007FF7D49F0000-0x00007FF7D4DE2000-memory.dmp	xmrig
behavioral2/memory/4692-1981-0x00007FF7B6E00000-0x00007FF7B71F2000-memory.dmp	xmrig
behavioral2/memory/3924-1973-0x00007FF7459D0000-0x00007FF745DC2000-memory.dmp	xmrig
behavioral2/memory/3528-1963-0x00007FF7F0670000-0x00007FF7F0A62000-memory.dmp	xmrig
behavioral2/memory/2696-2069-0x00007FF731250000-0x00007FF731642000-memory.dmp	xmrig
behavioral2/memory/1068-2033-0x00007FF72A8C0000-0x00007FF72ACB2000-memory.dmp	xmrig
behavioral2/memory/1028-2029-0x00007FF788280000-0x00007FF788672000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	3220	powershell.exe
7	3220	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3220	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3688	WGXOaey.exe
4032	HuKohRL.exe
2684	SRbWcDp.exe
4584	BiUSdoa.exe
3204	YCNBSTc.exe
1436	mnMCVFT.exe
4692	NHAFhvw.exe
3196	JaBsZFu.exe
3528	DgnkNex.exe
3744	BqndqJc.exe
3924	LpQNzwb.exe
3112	jwUjYNx.exe
2232	qSJZbXQ.exe
4628	JZAAfrY.exe
2356	DjhQdbY.exe
2396	ymuSvRy.exe
4588	WMbTBew.exe
1788	QOcIfbo.exe
2548	RGTrErG.exe
1028	sgxGheC.exe
1068	qxRzudt.exe
2844	hATkKCf.exe
2900	DZdASpd.exe
2696	MkRWSdC.exe
3956	FfcKosc.exe
3500	FcCKCRz.exe
532	RgiLqaI.exe
4496	GOFYMRy.exe
3128	renGTkB.exe
1768	KFFHukS.exe
220	qGMedeO.exe
4756	kBfkMFy.exe
2720	yoCgSDr.exe
1388	pfDaBth.exe
2264	EebKDGH.exe
436	fOjJRGd.exe
2448	vPvlonS.exe
2172	xesAGfr.exe
2080	bYCrCyh.exe
4256	qseaJbc.exe
4636	VMHLuyT.exe
836	EmcwPVJ.exe
1400	JMeWagX.exe
1900	OWttktJ.exe
5052	jaHmYXY.exe
664	hQQJrNs.exe
4932	NQCKlKH.exe
756	jbBJUgn.exe
740	jAQjsZn.exe
448	FGGVIRO.exe
4188	jeqVJxN.exe
4644	hjjoumg.exe
5124	nxwVMxL.exe
5144	vNaYGiI.exe
5172	HHiqDRP.exe
5200	MwrMvVs.exe
5228	bhBbeay.exe
5288	ynHieEW.exe
5312	NOPgMUz.exe
5332	iaaJlLC.exe
5352	frniIXG.exe
5384	pJQoCnM.exe
5424	OaYhAoe.exe
5456	nSvQpdD.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3488-0-0x00007FF78DCF0000-0x00007FF78E0E2000-memory.dmp	upx
behavioral2/files/0x000900000002326d-5.dat	upx
behavioral2/files/0x0008000000023273-13.dat	upx
behavioral2/files/0x0007000000023274-16.dat	upx
behavioral2/memory/3688-7-0x00007FF6C3FC0000-0x00007FF6C43B2000-memory.dmp	upx
behavioral2/memory/2684-28-0x00007FF77FBD0000-0x00007FF77FFC2000-memory.dmp	upx
behavioral2/memory/4032-29-0x00007FF7C3F60000-0x00007FF7C4352000-memory.dmp	upx
behavioral2/files/0x0007000000023275-38.dat	upx
behavioral2/files/0x0007000000023278-41.dat	upx
behavioral2/memory/4584-42-0x00007FF6431D0000-0x00007FF6435C2000-memory.dmp	upx
behavioral2/memory/3204-43-0x00007FF78E0D0000-0x00007FF78E4C2000-memory.dmp	upx
behavioral2/files/0x0008000000023271-48.dat	upx
behavioral2/memory/1436-54-0x00007FF783180000-0x00007FF783572000-memory.dmp	upx
behavioral2/files/0x0007000000023279-66.dat	upx
behavioral2/files/0x0008000000023277-67.dat	upx
behavioral2/files/0x000700000002327b-73.dat	upx
behavioral2/files/0x000700000002327c-77.dat	upx
behavioral2/files/0x000700000002327d-84.dat	upx
behavioral2/memory/3112-100-0x00007FF7AFC90000-0x00007FF7B0082000-memory.dmp	upx
behavioral2/memory/2232-103-0x00007FF79A9A0000-0x00007FF79AD92000-memory.dmp	upx
behavioral2/files/0x000700000002327f-108.dat	upx
behavioral2/memory/2356-113-0x00007FF7D49F0000-0x00007FF7D4DE2000-memory.dmp	upx
behavioral2/files/0x0007000000023281-117.dat	upx
behavioral2/files/0x0007000000023283-127.dat	upx
behavioral2/files/0x0007000000023284-135.dat	upx
behavioral2/files/0x0007000000023286-143.dat	upx
behavioral2/files/0x0007000000023289-155.dat	upx
behavioral2/files/0x000700000002328a-163.dat	upx
behavioral2/files/0x0007000000023290-195.dat	upx
behavioral2/files/0x000700000002328f-191.dat	upx
behavioral2/memory/2684-382-0x00007FF77FBD0000-0x00007FF77FFC2000-memory.dmp	upx
behavioral2/memory/4588-402-0x00007FF7D1EF0000-0x00007FF7D22E2000-memory.dmp	upx
behavioral2/memory/1028-443-0x00007FF788280000-0x00007FF788672000-memory.dmp	upx
behavioral2/memory/1068-471-0x00007FF72A8C0000-0x00007FF72ACB2000-memory.dmp	upx
behavioral2/memory/2696-551-0x00007FF731250000-0x00007FF731642000-memory.dmp	upx
behavioral2/memory/2900-546-0x00007FF735180000-0x00007FF735572000-memory.dmp	upx
behavioral2/memory/2844-509-0x00007FF79AB10000-0x00007FF79AF02000-memory.dmp	upx
behavioral2/memory/2548-420-0x00007FF752A50000-0x00007FF752E42000-memory.dmp	upx
behavioral2/memory/1788-413-0x00007FF718A10000-0x00007FF718E02000-memory.dmp	upx
behavioral2/files/0x000700000002328e-183.dat	upx
behavioral2/files/0x000700000002328d-180.dat	upx
behavioral2/files/0x000700000002328c-176.dat	upx
behavioral2/files/0x000700000002328b-168.dat	upx
behavioral2/files/0x0007000000023288-156.dat	upx
behavioral2/files/0x0007000000023287-151.dat	upx
behavioral2/files/0x0007000000023285-141.dat	upx
behavioral2/files/0x0007000000023282-125.dat	upx
behavioral2/memory/2396-116-0x00007FF74CD00000-0x00007FF74D0F2000-memory.dmp	upx
behavioral2/files/0x0007000000023280-111.dat	upx
behavioral2/memory/4628-106-0x00007FF667730000-0x00007FF667B22000-memory.dmp	upx
behavioral2/files/0x000700000002327e-101.dat	upx
behavioral2/files/0x000700000002327a-97.dat	upx
behavioral2/memory/3744-89-0x00007FF75C520000-0x00007FF75C912000-memory.dmp	upx
behavioral2/memory/3688-86-0x00007FF6C3FC0000-0x00007FF6C43B2000-memory.dmp	upx
behavioral2/memory/3488-85-0x00007FF78DCF0000-0x00007FF78E0E2000-memory.dmp	upx
behavioral2/memory/3924-80-0x00007FF7459D0000-0x00007FF745DC2000-memory.dmp	upx
behavioral2/memory/3528-76-0x00007FF7F0670000-0x00007FF7F0A62000-memory.dmp	upx
behavioral2/memory/4692-71-0x00007FF7B6E00000-0x00007FF7B71F2000-memory.dmp	upx
behavioral2/memory/3196-61-0x00007FF7F2BC0000-0x00007FF7F2FB2000-memory.dmp	upx
behavioral2/files/0x0008000000023276-60.dat	upx
behavioral2/memory/4584-1571-0x00007FF6431D0000-0x00007FF6435C2000-memory.dmp	upx
behavioral2/memory/4032-1692-0x00007FF7C3F60000-0x00007FF7C4352000-memory.dmp	upx
behavioral2/memory/3688-1696-0x00007FF6C3FC0000-0x00007FF6C43B2000-memory.dmp	upx
behavioral2/memory/2684-1863-0x00007FF77FBD0000-0x00007FF77FFC2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\wiufSTz.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\kQBKXMi.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\SAUjZox.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\ndvaunU.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\CfWvJJL.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\bSbvJRk.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\SwaPfhW.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\NgoiGui.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\BQzopAQ.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\AKbqsTr.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\GumUpvt.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\nWKHxUH.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\OghcCPA.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\KVuekYF.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\QOcIfbo.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\RgiLqaI.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\XIiJzxg.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\QIcxaeV.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\WzQSQJy.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\bsbFERj.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\lSfnTqq.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\EyScnnP.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\nVarbRW.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\xcmKRUJ.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\EebKDGH.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\zmkvZoC.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\oWiqRZu.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\cQWMhkj.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\egzFmbq.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\ITPGUbb.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\UYZVxtt.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\WHKedLt.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\LUvKhli.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\yinvlYe.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\fZNkSSM.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\sABYAds.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\YDptyGQ.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\IuDkEAN.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\MNhndrg.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\pIeSEBh.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\GOFYMRy.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\hgMtVCW.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\gegYsPT.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\rgWYLQS.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\kqrElHN.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\naEsvmk.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\qSJZbXQ.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\ymuSvRy.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\kBfkMFy.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\oWTHjtm.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\dJDIRjU.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\tmEIZfC.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\NYwBjvC.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\FIaUXle.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\QQUQgqH.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\ntIWlaF.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\yoCgSDr.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\VTBKjAq.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\oxGimvl.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\SRbWcDp.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\nwnmCfi.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\XxvgXzM.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\SRDyVWN.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\LpQNzwb.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3220	powershell.exe
3220	powershell.exe
3220	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
Token: SeDebugPrivilege	3220	powershell.exe
Token: SeLockMemoryPrivilege	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3488 wrote to memory of 3220	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	92
PID 3488 wrote to memory of 3220	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	92
PID 3488 wrote to memory of 3688	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	93
PID 3488 wrote to memory of 3688	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	93
PID 3488 wrote to memory of 4032	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	94
PID 3488 wrote to memory of 4032	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	94
PID 3488 wrote to memory of 2684	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	95
PID 3488 wrote to memory of 2684	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	95
PID 3488 wrote to memory of 4584	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	96
PID 3488 wrote to memory of 4584	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	96
PID 3488 wrote to memory of 3204	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	97
PID 3488 wrote to memory of 3204	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	97
PID 3488 wrote to memory of 1436	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	98
PID 3488 wrote to memory of 1436	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	98
PID 3488 wrote to memory of 4692	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	99
PID 3488 wrote to memory of 4692	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	99
PID 3488 wrote to memory of 3196	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	100
PID 3488 wrote to memory of 3196	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	100
PID 3488 wrote to memory of 3528	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	101
PID 3488 wrote to memory of 3528	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	101
PID 3488 wrote to memory of 3744	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	102
PID 3488 wrote to memory of 3744	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	102
PID 3488 wrote to memory of 3924	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	103
PID 3488 wrote to memory of 3924	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	103
PID 3488 wrote to memory of 3112	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	104
PID 3488 wrote to memory of 3112	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	104
PID 3488 wrote to memory of 2232	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	105
PID 3488 wrote to memory of 2232	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	105
PID 3488 wrote to memory of 4628	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	106
PID 3488 wrote to memory of 4628	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	106
PID 3488 wrote to memory of 2356	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	107
PID 3488 wrote to memory of 2356	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	107
PID 3488 wrote to memory of 2396	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	108
PID 3488 wrote to memory of 2396	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	108
PID 3488 wrote to memory of 4588	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	109
PID 3488 wrote to memory of 4588	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	109
PID 3488 wrote to memory of 1788	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	110
PID 3488 wrote to memory of 1788	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	110
PID 3488 wrote to memory of 2548	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	111
PID 3488 wrote to memory of 2548	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	111
PID 3488 wrote to memory of 1028	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	112
PID 3488 wrote to memory of 1028	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	112
PID 3488 wrote to memory of 1068	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	113
PID 3488 wrote to memory of 1068	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	113
PID 3488 wrote to memory of 2844	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	114
PID 3488 wrote to memory of 2844	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	114
PID 3488 wrote to memory of 2900	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	115
PID 3488 wrote to memory of 2900	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	115
PID 3488 wrote to memory of 2696	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	116
PID 3488 wrote to memory of 2696	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	116
PID 3488 wrote to memory of 3956	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	117
PID 3488 wrote to memory of 3956	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	117
PID 3488 wrote to memory of 3500	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	118
PID 3488 wrote to memory of 3500	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	118
PID 3488 wrote to memory of 532	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	119
PID 3488 wrote to memory of 532	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	119
PID 3488 wrote to memory of 4496	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	120
PID 3488 wrote to memory of 4496	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	120
PID 3488 wrote to memory of 3128	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	121
PID 3488 wrote to memory of 3128	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	121
PID 3488 wrote to memory of 1768	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	122
PID 3488 wrote to memory of 1768	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	122
PID 3488 wrote to memory of 220	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	123
PID 3488 wrote to memory of 220	3488	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	123

C:\Users\Admin\AppData\Local\Temp\0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3220
- C:\Windows\System\WGXOaey.exe
  C:\Windows\System\WGXOaey.exe
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Windows\System\HuKohRL.exe
  C:\Windows\System\HuKohRL.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\SRbWcDp.exe
  C:\Windows\System\SRbWcDp.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\BiUSdoa.exe
  C:\Windows\System\BiUSdoa.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\YCNBSTc.exe
  C:\Windows\System\YCNBSTc.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\mnMCVFT.exe
  C:\Windows\System\mnMCVFT.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\NHAFhvw.exe
  C:\Windows\System\NHAFhvw.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\JaBsZFu.exe
  C:\Windows\System\JaBsZFu.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\DgnkNex.exe
  C:\Windows\System\DgnkNex.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\BqndqJc.exe
  C:\Windows\System\BqndqJc.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\LpQNzwb.exe
  C:\Windows\System\LpQNzwb.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\jwUjYNx.exe
  C:\Windows\System\jwUjYNx.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\qSJZbXQ.exe
  C:\Windows\System\qSJZbXQ.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\JZAAfrY.exe
  C:\Windows\System\JZAAfrY.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\DjhQdbY.exe
  C:\Windows\System\DjhQdbY.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\ymuSvRy.exe
  C:\Windows\System\ymuSvRy.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\WMbTBew.exe
  C:\Windows\System\WMbTBew.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\QOcIfbo.exe
  C:\Windows\System\QOcIfbo.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\RGTrErG.exe
  C:\Windows\System\RGTrErG.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\sgxGheC.exe
  C:\Windows\System\sgxGheC.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\qxRzudt.exe
  C:\Windows\System\qxRzudt.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\hATkKCf.exe
  C:\Windows\System\hATkKCf.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\DZdASpd.exe
  C:\Windows\System\DZdASpd.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\MkRWSdC.exe
  C:\Windows\System\MkRWSdC.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\FfcKosc.exe
  C:\Windows\System\FfcKosc.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\FcCKCRz.exe
  C:\Windows\System\FcCKCRz.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\RgiLqaI.exe
  C:\Windows\System\RgiLqaI.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\GOFYMRy.exe
  C:\Windows\System\GOFYMRy.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\renGTkB.exe
  C:\Windows\System\renGTkB.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\KFFHukS.exe
  C:\Windows\System\KFFHukS.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\qGMedeO.exe
  C:\Windows\System\qGMedeO.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\kBfkMFy.exe
  C:\Windows\System\kBfkMFy.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\yoCgSDr.exe
  C:\Windows\System\yoCgSDr.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\pfDaBth.exe
  C:\Windows\System\pfDaBth.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\EebKDGH.exe
  C:\Windows\System\EebKDGH.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\fOjJRGd.exe
  C:\Windows\System\fOjJRGd.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\vPvlonS.exe
  C:\Windows\System\vPvlonS.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\xesAGfr.exe
  C:\Windows\System\xesAGfr.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\bYCrCyh.exe
  C:\Windows\System\bYCrCyh.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\qseaJbc.exe
  C:\Windows\System\qseaJbc.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\VMHLuyT.exe
  C:\Windows\System\VMHLuyT.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\EmcwPVJ.exe
  C:\Windows\System\EmcwPVJ.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\JMeWagX.exe
  C:\Windows\System\JMeWagX.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\OWttktJ.exe
  C:\Windows\System\OWttktJ.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\jaHmYXY.exe
  C:\Windows\System\jaHmYXY.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\hQQJrNs.exe
  C:\Windows\System\hQQJrNs.exe
  2⤵
  - Executes dropped EXE
  PID:664
- C:\Windows\System\NQCKlKH.exe
  C:\Windows\System\NQCKlKH.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\jbBJUgn.exe
  C:\Windows\System\jbBJUgn.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\jAQjsZn.exe
  C:\Windows\System\jAQjsZn.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\FGGVIRO.exe
  C:\Windows\System\FGGVIRO.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\jeqVJxN.exe
  C:\Windows\System\jeqVJxN.exe
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Windows\System\hjjoumg.exe
  C:\Windows\System\hjjoumg.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\nxwVMxL.exe
  C:\Windows\System\nxwVMxL.exe
  2⤵
  - Executes dropped EXE
  PID:5124
- C:\Windows\System\vNaYGiI.exe
  C:\Windows\System\vNaYGiI.exe
  2⤵
  - Executes dropped EXE
  PID:5144
- C:\Windows\System\HHiqDRP.exe
  C:\Windows\System\HHiqDRP.exe
  2⤵
  - Executes dropped EXE
  PID:5172
- C:\Windows\System\MwrMvVs.exe
  C:\Windows\System\MwrMvVs.exe
  2⤵
  - Executes dropped EXE
  PID:5200
- C:\Windows\System\bhBbeay.exe
  C:\Windows\System\bhBbeay.exe
  2⤵
  - Executes dropped EXE
  PID:5228
- C:\Windows\System\ynHieEW.exe
  C:\Windows\System\ynHieEW.exe
  2⤵
  - Executes dropped EXE
  PID:5288
- C:\Windows\System\NOPgMUz.exe
  C:\Windows\System\NOPgMUz.exe
  2⤵
  - Executes dropped EXE
  PID:5312
- C:\Windows\System\iaaJlLC.exe
  C:\Windows\System\iaaJlLC.exe
  2⤵
  - Executes dropped EXE
  PID:5332
- C:\Windows\System\frniIXG.exe
  C:\Windows\System\frniIXG.exe
  2⤵
  - Executes dropped EXE
  PID:5352
- C:\Windows\System\pJQoCnM.exe
  C:\Windows\System\pJQoCnM.exe
  2⤵
  - Executes dropped EXE
  PID:5384
- C:\Windows\System\OaYhAoe.exe
  C:\Windows\System\OaYhAoe.exe
  2⤵
  - Executes dropped EXE
  PID:5424
- C:\Windows\System\nSvQpdD.exe
  C:\Windows\System\nSvQpdD.exe
  2⤵
  - Executes dropped EXE
  PID:5456
- C:\Windows\System\TreChlN.exe
  C:\Windows\System\TreChlN.exe
  2⤵
  PID:5480
- C:\Windows\System\zqXHUbR.exe
  C:\Windows\System\zqXHUbR.exe
  2⤵
  PID:5516
- C:\Windows\System\CkTIgfW.exe
  C:\Windows\System\CkTIgfW.exe
  2⤵
  PID:5544
- C:\Windows\System\GjUAtZU.exe
  C:\Windows\System\GjUAtZU.exe
  2⤵
  PID:5564
- C:\Windows\System\NYwBjvC.exe
  C:\Windows\System\NYwBjvC.exe
  2⤵
  PID:5588
- C:\Windows\System\hqmHnOa.exe
  C:\Windows\System\hqmHnOa.exe
  2⤵
  PID:5628
- C:\Windows\System\dpNZemh.exe
  C:\Windows\System\dpNZemh.exe
  2⤵
  PID:5644
- C:\Windows\System\vyBjRCt.exe
  C:\Windows\System\vyBjRCt.exe
  2⤵
  PID:5668
- C:\Windows\System\xiyPLQK.exe
  C:\Windows\System\xiyPLQK.exe
  2⤵
  PID:5688
- C:\Windows\System\XIiJzxg.exe
  C:\Windows\System\XIiJzxg.exe
  2⤵
  PID:5712
- C:\Windows\System\xDiOBwQ.exe
  C:\Windows\System\xDiOBwQ.exe
  2⤵
  PID:5768
- C:\Windows\System\FIuOilY.exe
  C:\Windows\System\FIuOilY.exe
  2⤵
  PID:5784
- C:\Windows\System\LOVPyZq.exe
  C:\Windows\System\LOVPyZq.exe
  2⤵
  PID:5800
- C:\Windows\System\UFrvVWp.exe
  C:\Windows\System\UFrvVWp.exe
  2⤵
  PID:5828
- C:\Windows\System\KVfNupI.exe
  C:\Windows\System\KVfNupI.exe
  2⤵
  PID:5852
- C:\Windows\System\czBNEXU.exe
  C:\Windows\System\czBNEXU.exe
  2⤵
  PID:5872
- C:\Windows\System\YzcoFgk.exe
  C:\Windows\System\YzcoFgk.exe
  2⤵
  PID:5896
- C:\Windows\System\wGCEtEd.exe
  C:\Windows\System\wGCEtEd.exe
  2⤵
  PID:5924
- C:\Windows\System\TNGhJgx.exe
  C:\Windows\System\TNGhJgx.exe
  2⤵
  PID:5948
- C:\Windows\System\pNtUcOj.exe
  C:\Windows\System\pNtUcOj.exe
  2⤵
  PID:6052
- C:\Windows\System\ZklUJDB.exe
  C:\Windows\System\ZklUJDB.exe
  2⤵
  PID:6068
- C:\Windows\System\fVTuICr.exe
  C:\Windows\System\fVTuICr.exe
  2⤵
  PID:6108
- C:\Windows\System\Oneqggn.exe
  C:\Windows\System\Oneqggn.exe
  2⤵
  PID:6140
- C:\Windows\System\vWNmCMg.exe
  C:\Windows\System\vWNmCMg.exe
  2⤵
  PID:5164
- C:\Windows\System\mMaYnxf.exe
  C:\Windows\System\mMaYnxf.exe
  2⤵
  PID:5212
- C:\Windows\System\ZWHtYJP.exe
  C:\Windows\System\ZWHtYJP.exe
  2⤵
  PID:5260
- C:\Windows\System\IaxqtNC.exe
  C:\Windows\System\IaxqtNC.exe
  2⤵
  PID:5296
- C:\Windows\System\vVayDcX.exe
  C:\Windows\System\vVayDcX.exe
  2⤵
  PID:5324
- C:\Windows\System\hgMtVCW.exe
  C:\Windows\System\hgMtVCW.exe
  2⤵
  PID:3884
- C:\Windows\System\IAosuOB.exe
  C:\Windows\System\IAosuOB.exe
  2⤵
  PID:5396
- C:\Windows\System\CKtpCzP.exe
  C:\Windows\System\CKtpCzP.exe
  2⤵
  PID:5440
- C:\Windows\System\FIaUXle.exe
  C:\Windows\System\FIaUXle.exe
  2⤵
  PID:5472
- C:\Windows\System\xCYMZJa.exe
  C:\Windows\System\xCYMZJa.exe
  2⤵
  PID:5524
- C:\Windows\System\FXnmMvX.exe
  C:\Windows\System\FXnmMvX.exe
  2⤵
  PID:5572
- C:\Windows\System\nXDxzak.exe
  C:\Windows\System\nXDxzak.exe
  2⤵
  PID:4336
- C:\Windows\System\OxdkJlz.exe
  C:\Windows\System\OxdkJlz.exe
  2⤵
  PID:5732
- C:\Windows\System\AJERXkH.exe
  C:\Windows\System\AJERXkH.exe
  2⤵
  PID:3704
- C:\Windows\System\ynwFfLO.exe
  C:\Windows\System\ynwFfLO.exe
  2⤵
  PID:5796
- C:\Windows\System\TyjZUmr.exe
  C:\Windows\System\TyjZUmr.exe
  2⤵
  PID:4924
- C:\Windows\System\XDySukL.exe
  C:\Windows\System\XDySukL.exe
  2⤵
  PID:5892
- C:\Windows\System\nKmxgoK.exe
  C:\Windows\System\nKmxgoK.exe
  2⤵
  PID:5920
- C:\Windows\System\LxdsrvL.exe
  C:\Windows\System\LxdsrvL.exe
  2⤵
  PID:5980
- C:\Windows\System\jvFOytn.exe
  C:\Windows\System\jvFOytn.exe
  2⤵
  PID:5972
- C:\Windows\System\kSYSvuG.exe
  C:\Windows\System\kSYSvuG.exe
  2⤵
  PID:6084
- C:\Windows\System\DVrRjdy.exe
  C:\Windows\System\DVrRjdy.exe
  2⤵
  PID:4048
- C:\Windows\System\kQBKXMi.exe
  C:\Windows\System\kQBKXMi.exe
  2⤵
  PID:5984
- C:\Windows\System\WETTdwT.exe
  C:\Windows\System\WETTdwT.exe
  2⤵
  PID:4384
- C:\Windows\System\RhyYTQf.exe
  C:\Windows\System\RhyYTQf.exe
  2⤵
  PID:1032
- C:\Windows\System\QQUQgqH.exe
  C:\Windows\System\QQUQgqH.exe
  2⤵
  PID:1072
- C:\Windows\System\RljryuI.exe
  C:\Windows\System\RljryuI.exe
  2⤵
  PID:4448
- C:\Windows\System\lodDxqg.exe
  C:\Windows\System\lodDxqg.exe
  2⤵
  PID:456
- C:\Windows\System\lmpCTqA.exe
  C:\Windows\System\lmpCTqA.exe
  2⤵
  PID:5220
- C:\Windows\System\oNZgNkK.exe
  C:\Windows\System\oNZgNkK.exe
  2⤵
  PID:3484
- C:\Windows\System\WUguHtY.exe
  C:\Windows\System\WUguHtY.exe
  2⤵
  PID:5488
- C:\Windows\System\fILjvoP.exe
  C:\Windows\System\fILjvoP.exe
  2⤵
  PID:5608
- C:\Windows\System\plfproH.exe
  C:\Windows\System\plfproH.exe
  2⤵
  PID:5700
- C:\Windows\System\gWrgPvr.exe
  C:\Windows\System\gWrgPvr.exe
  2⤵
  PID:5776
- C:\Windows\System\jCVQeut.exe
  C:\Windows\System\jCVQeut.exe
  2⤵
  PID:5864
- C:\Windows\System\VgYjsJU.exe
  C:\Windows\System\VgYjsJU.exe
  2⤵
  PID:1984
- C:\Windows\System\aKgAqDl.exe
  C:\Windows\System\aKgAqDl.exe
  2⤵
  PID:4404
- C:\Windows\System\EYDjqcP.exe
  C:\Windows\System\EYDjqcP.exe
  2⤵
  PID:6116
- C:\Windows\System\jIcAzRY.exe
  C:\Windows\System\jIcAzRY.exe
  2⤵
  PID:6020
- C:\Windows\System\sQPsxcz.exe
  C:\Windows\System\sQPsxcz.exe
  2⤵
  PID:6100
- C:\Windows\System\FiEYOzO.exe
  C:\Windows\System\FiEYOzO.exe
  2⤵
  PID:6036
- C:\Windows\System\AjnzTqz.exe
  C:\Windows\System\AjnzTqz.exe
  2⤵
  PID:5940
- C:\Windows\System\axrhygU.exe
  C:\Windows\System\axrhygU.exe
  2⤵
  PID:6152
- C:\Windows\System\gwXcMWc.exe
  C:\Windows\System\gwXcMWc.exe
  2⤵
  PID:6168
- C:\Windows\System\ggMnkTG.exe
  C:\Windows\System\ggMnkTG.exe
  2⤵
  PID:6196
- C:\Windows\System\fnvkgah.exe
  C:\Windows\System\fnvkgah.exe
  2⤵
  PID:6216
- C:\Windows\System\lVAMCpl.exe
  C:\Windows\System\lVAMCpl.exe
  2⤵
  PID:6236
- C:\Windows\System\tzvpZew.exe
  C:\Windows\System\tzvpZew.exe
  2⤵
  PID:6252
- C:\Windows\System\HggoqFh.exe
  C:\Windows\System\HggoqFh.exe
  2⤵
  PID:6272
- C:\Windows\System\ezNHzei.exe
  C:\Windows\System\ezNHzei.exe
  2⤵
  PID:6292
- C:\Windows\System\AtgIpQV.exe
  C:\Windows\System\AtgIpQV.exe
  2⤵
  PID:6316
- C:\Windows\System\ITPGUbb.exe
  C:\Windows\System\ITPGUbb.exe
  2⤵
  PID:6340
- C:\Windows\System\LkqCWPn.exe
  C:\Windows\System\LkqCWPn.exe
  2⤵
  PID:6360
- C:\Windows\System\yEgodLg.exe
  C:\Windows\System\yEgodLg.exe
  2⤵
  PID:6380
- C:\Windows\System\ntIWlaF.exe
  C:\Windows\System\ntIWlaF.exe
  2⤵
  PID:6396
- C:\Windows\System\UzyTKCk.exe
  C:\Windows\System\UzyTKCk.exe
  2⤵
  PID:6420
- C:\Windows\System\zmkvZoC.exe
  C:\Windows\System\zmkvZoC.exe
  2⤵
  PID:6440
- C:\Windows\System\PlTqQzP.exe
  C:\Windows\System\PlTqQzP.exe
  2⤵
  PID:6464
- C:\Windows\System\TnrMTEE.exe
  C:\Windows\System\TnrMTEE.exe
  2⤵
  PID:6488
- C:\Windows\System\oyNJyUY.exe
  C:\Windows\System\oyNJyUY.exe
  2⤵
  PID:6504
- C:\Windows\System\XqmaZRf.exe
  C:\Windows\System\XqmaZRf.exe
  2⤵
  PID:6532
- C:\Windows\System\DIjTEAm.exe
  C:\Windows\System\DIjTEAm.exe
  2⤵
  PID:6552
- C:\Windows\System\gegYsPT.exe
  C:\Windows\System\gegYsPT.exe
  2⤵
  PID:6576
- C:\Windows\System\xQfAJjk.exe
  C:\Windows\System\xQfAJjk.exe
  2⤵
  PID:6592
- C:\Windows\System\DqdxZrP.exe
  C:\Windows\System\DqdxZrP.exe
  2⤵
  PID:6616
- C:\Windows\System\KQJyNPd.exe
  C:\Windows\System\KQJyNPd.exe
  2⤵
  PID:6640
- C:\Windows\System\PmrjKkE.exe
  C:\Windows\System\PmrjKkE.exe
  2⤵
  PID:6660
- C:\Windows\System\ZFkcHIJ.exe
  C:\Windows\System\ZFkcHIJ.exe
  2⤵
  PID:6680
- C:\Windows\System\UIMoVdE.exe
  C:\Windows\System\UIMoVdE.exe
  2⤵
  PID:6700
- C:\Windows\System\sIUgTys.exe
  C:\Windows\System\sIUgTys.exe
  2⤵
  PID:6720
- C:\Windows\System\WzQSQJy.exe
  C:\Windows\System\WzQSQJy.exe
  2⤵
  PID:6740
- C:\Windows\System\DKiHqef.exe
  C:\Windows\System\DKiHqef.exe
  2⤵
  PID:6756
- C:\Windows\System\IUULitP.exe
  C:\Windows\System\IUULitP.exe
  2⤵
  PID:6780
- C:\Windows\System\QQbJqwY.exe
  C:\Windows\System\QQbJqwY.exe
  2⤵
  PID:6796
- C:\Windows\System\ukHNPUT.exe
  C:\Windows\System\ukHNPUT.exe
  2⤵
  PID:6820
- C:\Windows\System\szKDblL.exe
  C:\Windows\System\szKDblL.exe
  2⤵
  PID:6840
- C:\Windows\System\asFjeSs.exe
  C:\Windows\System\asFjeSs.exe
  2⤵
  PID:6860
- C:\Windows\System\IBMWyNg.exe
  C:\Windows\System\IBMWyNg.exe
  2⤵
  PID:6880
- C:\Windows\System\UsSTJRs.exe
  C:\Windows\System\UsSTJRs.exe
  2⤵
  PID:6904
- C:\Windows\System\rwuohTA.exe
  C:\Windows\System\rwuohTA.exe
  2⤵
  PID:6928
- C:\Windows\System\CrkcKbH.exe
  C:\Windows\System\CrkcKbH.exe
  2⤵
  PID:6948
- C:\Windows\System\ovaPxnY.exe
  C:\Windows\System\ovaPxnY.exe
  2⤵
  PID:6972
- C:\Windows\System\VTBKjAq.exe
  C:\Windows\System\VTBKjAq.exe
  2⤵
  PID:6988
- C:\Windows\System\QIcxaeV.exe
  C:\Windows\System\QIcxaeV.exe
  2⤵
  PID:7012
- C:\Windows\System\GGQIYEz.exe
  C:\Windows\System\GGQIYEz.exe
  2⤵
  PID:7036
- C:\Windows\System\dpujlvJ.exe
  C:\Windows\System\dpujlvJ.exe
  2⤵
  PID:7060
- C:\Windows\System\YXeUtxs.exe
  C:\Windows\System\YXeUtxs.exe
  2⤵
  PID:7076
- C:\Windows\System\KQMBonW.exe
  C:\Windows\System\KQMBonW.exe
  2⤵
  PID:7100
- C:\Windows\System\SxeVCrF.exe
  C:\Windows\System\SxeVCrF.exe
  2⤵
  PID:7116
- C:\Windows\System\FsWzxkN.exe
  C:\Windows\System\FsWzxkN.exe
  2⤵
  PID:7136
- C:\Windows\System\ToMnTaL.exe
  C:\Windows\System\ToMnTaL.exe
  2⤵
  PID:6228
- C:\Windows\System\wEGZiKY.exe
  C:\Windows\System\wEGZiKY.exe
  2⤵
  PID:6816
- C:\Windows\System\UMRgcro.exe
  C:\Windows\System\UMRgcro.exe
  2⤵
  PID:6856
- C:\Windows\System\POlbmni.exe
  C:\Windows\System\POlbmni.exe
  2⤵
  PID:6548
- C:\Windows\System\ezUhadr.exe
  C:\Windows\System\ezUhadr.exe
  2⤵
  PID:6896
- C:\Windows\System\yJRrZRK.exe
  C:\Windows\System\yJRrZRK.exe
  2⤵
  PID:6956
- C:\Windows\System\xIadWfK.exe
  C:\Windows\System\xIadWfK.exe
  2⤵
  PID:7048
- C:\Windows\System\hqSEJCi.exe
  C:\Windows\System\hqSEJCi.exe
  2⤵
  PID:6356
- C:\Windows\System\iaLlKvk.exe
  C:\Windows\System\iaLlKvk.exe
  2⤵
  PID:6184
- C:\Windows\System\fspkdiK.exe
  C:\Windows\System\fspkdiK.exe
  2⤵
  PID:7144
- C:\Windows\System\bsbFERj.exe
  C:\Windows\System\bsbFERj.exe
  2⤵
  PID:6244
- C:\Windows\System\KjnTQNG.exe
  C:\Windows\System\KjnTQNG.exe
  2⤵
  PID:548
- C:\Windows\System\WGYYaKP.exe
  C:\Windows\System\WGYYaKP.exe
  2⤵
  PID:3300
- C:\Windows\System\ndOHsZT.exe
  C:\Windows\System\ndOHsZT.exe
  2⤵
  PID:6776
- C:\Windows\System\VjvebsN.exe
  C:\Windows\System\VjvebsN.exe
  2⤵
  PID:5012
- C:\Windows\System\JGsMXIM.exe
  C:\Windows\System\JGsMXIM.exe
  2⤵
  PID:6544
- C:\Windows\System\aVSNpxR.exe
  C:\Windows\System\aVSNpxR.exe
  2⤵
  PID:6964
- C:\Windows\System\YqdrEtE.exe
  C:\Windows\System\YqdrEtE.exe
  2⤵
  PID:6672
- C:\Windows\System\NJKLAnG.exe
  C:\Windows\System\NJKLAnG.exe
  2⤵
  PID:7096
- C:\Windows\System\UYZVxtt.exe
  C:\Windows\System\UYZVxtt.exe
  2⤵
  PID:7180
- C:\Windows\System\oHIScKb.exe
  C:\Windows\System\oHIScKb.exe
  2⤵
  PID:7216
- C:\Windows\System\SpWybwj.exe
  C:\Windows\System\SpWybwj.exe
  2⤵
  PID:7236
- C:\Windows\System\RnOXrZm.exe
  C:\Windows\System\RnOXrZm.exe
  2⤵
  PID:7256
- C:\Windows\System\UZakRHW.exe
  C:\Windows\System\UZakRHW.exe
  2⤵
  PID:7276
- C:\Windows\System\OnSiwkq.exe
  C:\Windows\System\OnSiwkq.exe
  2⤵
  PID:7300
- C:\Windows\System\qBXcySk.exe
  C:\Windows\System\qBXcySk.exe
  2⤵
  PID:7328
- C:\Windows\System\loyKQSx.exe
  C:\Windows\System\loyKQSx.exe
  2⤵
  PID:7348
- C:\Windows\System\DnfPksk.exe
  C:\Windows\System\DnfPksk.exe
  2⤵
  PID:7364
- C:\Windows\System\bUKzsjI.exe
  C:\Windows\System\bUKzsjI.exe
  2⤵
  PID:7384
- C:\Windows\System\nsGRTYS.exe
  C:\Windows\System\nsGRTYS.exe
  2⤵
  PID:7400
- C:\Windows\System\dLdEHNa.exe
  C:\Windows\System\dLdEHNa.exe
  2⤵
  PID:7448
- C:\Windows\System\mabZQQl.exe
  C:\Windows\System\mabZQQl.exe
  2⤵
  PID:7468
- C:\Windows\System\MZGJYUP.exe
  C:\Windows\System\MZGJYUP.exe
  2⤵
  PID:7488
- C:\Windows\System\OoaDaUp.exe
  C:\Windows\System\OoaDaUp.exe
  2⤵
  PID:7536
- C:\Windows\System\JaUBoxW.exe
  C:\Windows\System\JaUBoxW.exe
  2⤵
  PID:7568
- C:\Windows\System\PLdIjhE.exe
  C:\Windows\System\PLdIjhE.exe
  2⤵
  PID:7584
- C:\Windows\System\OGGDCuB.exe
  C:\Windows\System\OGGDCuB.exe
  2⤵
  PID:7620
- C:\Windows\System\sABYAds.exe
  C:\Windows\System\sABYAds.exe
  2⤵
  PID:7640
- C:\Windows\System\KPEmdlA.exe
  C:\Windows\System\KPEmdlA.exe
  2⤵
  PID:7672
- C:\Windows\System\PQQxomO.exe
  C:\Windows\System\PQQxomO.exe
  2⤵
  PID:7696
- C:\Windows\System\vTyLEXK.exe
  C:\Windows\System\vTyLEXK.exe
  2⤵
  PID:7724
- C:\Windows\System\tKixSHa.exe
  C:\Windows\System\tKixSHa.exe
  2⤵
  PID:7748
- C:\Windows\System\RbMmcgY.exe
  C:\Windows\System\RbMmcgY.exe
  2⤵
  PID:7768
- C:\Windows\System\SKAYBnQ.exe
  C:\Windows\System\SKAYBnQ.exe
  2⤵
  PID:7792
- C:\Windows\System\lVdRwSn.exe
  C:\Windows\System\lVdRwSn.exe
  2⤵
  PID:7816
- C:\Windows\System\oZgbAeO.exe
  C:\Windows\System\oZgbAeO.exe
  2⤵
  PID:7840
- C:\Windows\System\FvNAuQp.exe
  C:\Windows\System\FvNAuQp.exe
  2⤵
  PID:7864
- C:\Windows\System\bSbvJRk.exe
  C:\Windows\System\bSbvJRk.exe
  2⤵
  PID:7880
- C:\Windows\System\SvtWaFE.exe
  C:\Windows\System\SvtWaFE.exe
  2⤵
  PID:7904
- C:\Windows\System\vzEzmUT.exe
  C:\Windows\System\vzEzmUT.exe
  2⤵
  PID:7924
- C:\Windows\System\iGBfOVc.exe
  C:\Windows\System\iGBfOVc.exe
  2⤵
  PID:7952
- C:\Windows\System\abMfKKj.exe
  C:\Windows\System\abMfKKj.exe
  2⤵
  PID:7968
- C:\Windows\System\iAQROEJ.exe
  C:\Windows\System\iAQROEJ.exe
  2⤵
  PID:7996
- C:\Windows\System\wSSbjaA.exe
  C:\Windows\System\wSSbjaA.exe
  2⤵
  PID:8032
- C:\Windows\System\HldJnDd.exe
  C:\Windows\System\HldJnDd.exe
  2⤵
  PID:8052
- C:\Windows\System\OMTyoMx.exe
  C:\Windows\System\OMTyoMx.exe
  2⤵
  PID:8076
- C:\Windows\System\oWTHjtm.exe
  C:\Windows\System\oWTHjtm.exe
  2⤵
  PID:8104
- C:\Windows\System\umNKjDo.exe
  C:\Windows\System\umNKjDo.exe
  2⤵
  PID:8132
- C:\Windows\System\oyBfTYm.exe
  C:\Windows\System\oyBfTYm.exe
  2⤵
  PID:6836
- C:\Windows\System\FvcwBIe.exe
  C:\Windows\System\FvcwBIe.exe
  2⤵
  PID:6920
- C:\Windows\System\HGAOYrY.exe
  C:\Windows\System\HGAOYrY.exe
  2⤵
  PID:7320
- C:\Windows\System\snTcEIk.exe
  C:\Windows\System\snTcEIk.exe
  2⤵
  PID:7444
- C:\Windows\System\ozpZuSL.exe
  C:\Windows\System\ozpZuSL.exe
  2⤵
  PID:7496
- C:\Windows\System\uvUOxfn.exe
  C:\Windows\System\uvUOxfn.exe
  2⤵
  PID:7764
- C:\Windows\System\jCbytGo.exe
  C:\Windows\System\jCbytGo.exe
  2⤵
  PID:7824
- C:\Windows\System\GVbIfSh.exe
  C:\Windows\System\GVbIfSh.exe
  2⤵
  PID:7636
- C:\Windows\System\ADinSue.exe
  C:\Windows\System\ADinSue.exe
  2⤵
  PID:7556
- C:\Windows\System\othATtG.exe
  C:\Windows\System\othATtG.exe
  2⤵
  PID:8140
- C:\Windows\System\ppoUbLJ.exe
  C:\Windows\System\ppoUbLJ.exe
  2⤵
  PID:7592
- C:\Windows\System\deQpVvP.exe
  C:\Windows\System\deQpVvP.exe
  2⤵
  PID:7760
- C:\Windows\System\uwRMuBT.exe
  C:\Windows\System\uwRMuBT.exe
  2⤵
  PID:8024
- C:\Windows\System\WyftOnl.exe
  C:\Windows\System\WyftOnl.exe
  2⤵
  PID:7900
- C:\Windows\System\rdrZugh.exe
  C:\Windows\System\rdrZugh.exe
  2⤵
  PID:7284
- C:\Windows\System\XSgECHB.exe
  C:\Windows\System\XSgECHB.exe
  2⤵
  PID:7228
- C:\Windows\System\ALLqRcx.exe
  C:\Windows\System\ALLqRcx.exe
  2⤵
  PID:8088
- C:\Windows\System\vkmFeVO.exe
  C:\Windows\System\vkmFeVO.exe
  2⤵
  PID:7580
- C:\Windows\System\MUqJsDO.exe
  C:\Windows\System\MUqJsDO.exe
  2⤵
  PID:7788
- C:\Windows\System\yinvlYe.exe
  C:\Windows\System\yinvlYe.exe
  2⤵
  PID:8096
- C:\Windows\System\oWiqRZu.exe
  C:\Windows\System\oWiqRZu.exe
  2⤵
  PID:3580
- C:\Windows\System\SKDuOQF.exe
  C:\Windows\System\SKDuOQF.exe
  2⤵
  PID:7316
- C:\Windows\System\RPMYUmW.exe
  C:\Windows\System\RPMYUmW.exe
  2⤵
  PID:8200
- C:\Windows\System\qmfEnAw.exe
  C:\Windows\System\qmfEnAw.exe
  2⤵
  PID:8220
- C:\Windows\System\vVJPvUJ.exe
  C:\Windows\System\vVJPvUJ.exe
  2⤵
  PID:8240
- C:\Windows\System\CymkXzu.exe
  C:\Windows\System\CymkXzu.exe
  2⤵
  PID:8264
- C:\Windows\System\MuldYkw.exe
  C:\Windows\System\MuldYkw.exe
  2⤵
  PID:8284
- C:\Windows\System\anGAakk.exe
  C:\Windows\System\anGAakk.exe
  2⤵
  PID:8324
- C:\Windows\System\qIbujIU.exe
  C:\Windows\System\qIbujIU.exe
  2⤵
  PID:8344
- C:\Windows\System\iabehtc.exe
  C:\Windows\System\iabehtc.exe
  2⤵
  PID:8372
- C:\Windows\System\TDaqKCl.exe
  C:\Windows\System\TDaqKCl.exe
  2⤵
  PID:8396
- C:\Windows\System\iMOYRoJ.exe
  C:\Windows\System\iMOYRoJ.exe
  2⤵
  PID:8416
- C:\Windows\System\nPDrFbC.exe
  C:\Windows\System\nPDrFbC.exe
  2⤵
  PID:8436
- C:\Windows\System\iIIxnml.exe
  C:\Windows\System\iIIxnml.exe
  2⤵
  PID:8460
- C:\Windows\System\OrBMxyi.exe
  C:\Windows\System\OrBMxyi.exe
  2⤵
  PID:8496
- C:\Windows\System\XxvgXzM.exe
  C:\Windows\System\XxvgXzM.exe
  2⤵
  PID:8516
- C:\Windows\System\kVWwcyz.exe
  C:\Windows\System\kVWwcyz.exe
  2⤵
  PID:8540
- C:\Windows\System\xXAcveq.exe
  C:\Windows\System\xXAcveq.exe
  2⤵
  PID:8564
- C:\Windows\System\fNVyuMQ.exe
  C:\Windows\System\fNVyuMQ.exe
  2⤵
  PID:8596
- C:\Windows\System\rgWYLQS.exe
  C:\Windows\System\rgWYLQS.exe
  2⤵
  PID:8624
- C:\Windows\System\XGDQZfg.exe
  C:\Windows\System\XGDQZfg.exe
  2⤵
  PID:8644
- C:\Windows\System\qXVFeNM.exe
  C:\Windows\System\qXVFeNM.exe
  2⤵
  PID:8840
- C:\Windows\System\wiufSTz.exe
  C:\Windows\System\wiufSTz.exe
  2⤵
  PID:8876
- C:\Windows\System\sRdLxAc.exe
  C:\Windows\System\sRdLxAc.exe
  2⤵
  PID:8908
- C:\Windows\System\WHKedLt.exe
  C:\Windows\System\WHKedLt.exe
  2⤵
  PID:8928
- C:\Windows\System\Uwldqwr.exe
  C:\Windows\System\Uwldqwr.exe
  2⤵
  PID:8944
- C:\Windows\System\pCgqCet.exe
  C:\Windows\System\pCgqCet.exe
  2⤵
  PID:8960
- C:\Windows\System\OgHMZln.exe
  C:\Windows\System\OgHMZln.exe
  2⤵
  PID:8976
- C:\Windows\System\WVpKuID.exe
  C:\Windows\System\WVpKuID.exe
  2⤵
  PID:8996
- C:\Windows\System\FtOQHTA.exe
  C:\Windows\System\FtOQHTA.exe
  2⤵
  PID:9020
- C:\Windows\System\vTzsONT.exe
  C:\Windows\System\vTzsONT.exe
  2⤵
  PID:9056
- C:\Windows\System\SAUjZox.exe
  C:\Windows\System\SAUjZox.exe
  2⤵
  PID:9084
- C:\Windows\System\YqmghXM.exe
  C:\Windows\System\YqmghXM.exe
  2⤵
  PID:9100
- C:\Windows\System\angiaow.exe
  C:\Windows\System\angiaow.exe
  2⤵
  PID:9124
- C:\Windows\System\LUvKhli.exe
  C:\Windows\System\LUvKhli.exe
  2⤵
  PID:9148
- C:\Windows\System\ROpmKSc.exe
  C:\Windows\System\ROpmKSc.exe
  2⤵
  PID:9168
- C:\Windows\System\uYXAcZn.exe
  C:\Windows\System\uYXAcZn.exe
  2⤵
  PID:9188
- C:\Windows\System\BaKOZeL.exe
  C:\Windows\System\BaKOZeL.exe
  2⤵
  PID:9208
- C:\Windows\System\DEsgRxa.exe
  C:\Windows\System\DEsgRxa.exe
  2⤵
  PID:7812
- C:\Windows\System\sbvDImH.exe
  C:\Windows\System\sbvDImH.exe
  2⤵
  PID:7616
- C:\Windows\System\ylWlsCv.exe
  C:\Windows\System\ylWlsCv.exe
  2⤵
  PID:7632
- C:\Windows\System\oxGimvl.exe
  C:\Windows\System\oxGimvl.exe
  2⤵
  PID:8260
- C:\Windows\System\SShjzSU.exe
  C:\Windows\System\SShjzSU.exe
  2⤵
  PID:7920
- C:\Windows\System\fKaqALn.exe
  C:\Windows\System\fKaqALn.exe
  2⤵
  PID:8280
- C:\Windows\System\SRDyVWN.exe
  C:\Windows\System\SRDyVWN.exe
  2⤵
  PID:8368
- C:\Windows\System\njxnwxb.exe
  C:\Windows\System\njxnwxb.exe
  2⤵
  PID:8448
- C:\Windows\System\ndvaunU.exe
  C:\Windows\System\ndvaunU.exe
  2⤵
  PID:8504
- C:\Windows\System\lSfnTqq.exe
  C:\Windows\System\lSfnTqq.exe
  2⤵
  PID:8476
- C:\Windows\System\Fewkilb.exe
  C:\Windows\System\Fewkilb.exe
  2⤵
  PID:8392
- C:\Windows\System\fuIZDVk.exe
  C:\Windows\System\fuIZDVk.exe
  2⤵
  PID:8528
- C:\Windows\System\hFKsbpZ.exe
  C:\Windows\System\hFKsbpZ.exe
  2⤵
  PID:8580
- C:\Windows\System\qMnDMtL.exe
  C:\Windows\System\qMnDMtL.exe
  2⤵
  PID:8740
- C:\Windows\System\AtQHOzc.exe
  C:\Windows\System\AtQHOzc.exe
  2⤵
  PID:8816
- C:\Windows\System\kqrElHN.exe
  C:\Windows\System\kqrElHN.exe
  2⤵
  PID:9016
- C:\Windows\System\FPWEaGe.exe
  C:\Windows\System\FPWEaGe.exe
  2⤵
  PID:9176
- C:\Windows\System\FyEXHnk.exe
  C:\Windows\System\FyEXHnk.exe
  2⤵
  PID:9076
- C:\Windows\System\uKeZKvR.exe
  C:\Windows\System\uKeZKvR.exe
  2⤵
  PID:7460
- C:\Windows\System\vewDRdb.exe
  C:\Windows\System\vewDRdb.exe
  2⤵
  PID:7916
- C:\Windows\System\eJzLXBm.exe
  C:\Windows\System\eJzLXBm.exe
  2⤵
  PID:8248
- C:\Windows\System\RlLCezR.exe
  C:\Windows\System\RlLCezR.exe
  2⤵
  PID:8272
- C:\Windows\System\BBFTwNF.exe
  C:\Windows\System\BBFTwNF.exe
  2⤵
  PID:6212
- C:\Windows\System\yuAKMdK.exe
  C:\Windows\System\yuAKMdK.exe
  2⤵
  PID:8404
- C:\Windows\System\nGwaPXz.exe
  C:\Windows\System\nGwaPXz.exe
  2⤵
  PID:8296
- C:\Windows\System\GjJfoRE.exe
  C:\Windows\System\GjJfoRE.exe
  2⤵
  PID:8956
- C:\Windows\System\cboGHBU.exe
  C:\Windows\System\cboGHBU.exe
  2⤵
  PID:8972
- C:\Windows\System\TwjJySs.exe
  C:\Windows\System\TwjJySs.exe
  2⤵
  PID:8920
- C:\Windows\System\tyOynGN.exe
  C:\Windows\System\tyOynGN.exe
  2⤵
  PID:7940
- C:\Windows\System\jPYkoGx.exe
  C:\Windows\System\jPYkoGx.exe
  2⤵
  PID:8524
- C:\Windows\System\lZGkEvg.exe
  C:\Windows\System\lZGkEvg.exe
  2⤵
  PID:9220
- C:\Windows\System\PfKnktw.exe
  C:\Windows\System\PfKnktw.exe
  2⤵
  PID:9240
- C:\Windows\System\knzsqkM.exe
  C:\Windows\System\knzsqkM.exe
  2⤵
  PID:9256
- C:\Windows\System\eQLGcRp.exe
  C:\Windows\System\eQLGcRp.exe
  2⤵
  PID:9276
- C:\Windows\System\AKbqsTr.exe
  C:\Windows\System\AKbqsTr.exe
  2⤵
  PID:9300
- C:\Windows\System\YqmIrEy.exe
  C:\Windows\System\YqmIrEy.exe
  2⤵
  PID:9324
- C:\Windows\System\pIeSEBh.exe
  C:\Windows\System\pIeSEBh.exe
  2⤵
  PID:9348
- C:\Windows\System\EspjImX.exe
  C:\Windows\System\EspjImX.exe
  2⤵
  PID:9368
- C:\Windows\System\lOSRrFe.exe
  C:\Windows\System\lOSRrFe.exe
  2⤵
  PID:9388
- C:\Windows\System\YDptyGQ.exe
  C:\Windows\System\YDptyGQ.exe
  2⤵
  PID:9412
- C:\Windows\System\CJRNEbP.exe
  C:\Windows\System\CJRNEbP.exe
  2⤵
  PID:9436
- C:\Windows\System\WuZgVdt.exe
  C:\Windows\System\WuZgVdt.exe
  2⤵
  PID:9452
- C:\Windows\System\KZipWHl.exe
  C:\Windows\System\KZipWHl.exe
  2⤵
  PID:9476
- C:\Windows\System\RUigQKP.exe
  C:\Windows\System\RUigQKP.exe
  2⤵
  PID:9496
- C:\Windows\System\lTANoPe.exe
  C:\Windows\System\lTANoPe.exe
  2⤵
  PID:9644
- C:\Windows\System\GumUpvt.exe
  C:\Windows\System\GumUpvt.exe
  2⤵
  PID:9672
- C:\Windows\System\YGQkgOi.exe
  C:\Windows\System\YGQkgOi.exe
  2⤵
  PID:9696
- C:\Windows\System\CAdIGtw.exe
  C:\Windows\System\CAdIGtw.exe
  2⤵
  PID:9716
- C:\Windows\System\uaqbApc.exe
  C:\Windows\System\uaqbApc.exe
  2⤵
  PID:9736
- C:\Windows\System\PxSkpEG.exe
  C:\Windows\System\PxSkpEG.exe
  2⤵
  PID:9760
- C:\Windows\System\NbnhJZj.exe
  C:\Windows\System\NbnhJZj.exe
  2⤵
  PID:9780
- C:\Windows\System\ZMrpmzu.exe
  C:\Windows\System\ZMrpmzu.exe
  2⤵
  PID:9812
- C:\Windows\System\FDVwkBR.exe
  C:\Windows\System\FDVwkBR.exe
  2⤵
  PID:9840
- C:\Windows\System\RZjqzrq.exe
  C:\Windows\System\RZjqzrq.exe
  2⤵
  PID:9860
- C:\Windows\System\zXbuOSA.exe
  C:\Windows\System\zXbuOSA.exe
  2⤵
  PID:9880
- C:\Windows\System\zibShbh.exe
  C:\Windows\System\zibShbh.exe
  2⤵
  PID:9896
- C:\Windows\System\SwaPfhW.exe
  C:\Windows\System\SwaPfhW.exe
  2⤵
  PID:9916
- C:\Windows\System\XzUQPEX.exe
  C:\Windows\System\XzUQPEX.exe
  2⤵
  PID:9936
- C:\Windows\System\CDybRZR.exe
  C:\Windows\System\CDybRZR.exe
  2⤵
  PID:9956
- C:\Windows\System\VjXhhBs.exe
  C:\Windows\System\VjXhhBs.exe
  2⤵
  PID:9980
- C:\Windows\System\zScpElG.exe
  C:\Windows\System\zScpElG.exe
  2⤵
  PID:10000
- C:\Windows\System\cqGfnwa.exe
  C:\Windows\System\cqGfnwa.exe
  2⤵
  PID:10036
- C:\Windows\System\GyGVgKt.exe
  C:\Windows\System\GyGVgKt.exe
  2⤵
  PID:10052
- C:\Windows\System\vHkvVqf.exe
  C:\Windows\System\vHkvVqf.exe
  2⤵
  PID:10136
- C:\Windows\System\tMEYKwR.exe
  C:\Windows\System\tMEYKwR.exe
  2⤵
  PID:10156
- C:\Windows\System\VIlwvct.exe
  C:\Windows\System\VIlwvct.exe
  2⤵
  PID:10184
- C:\Windows\System\nWKHxUH.exe
  C:\Windows\System\nWKHxUH.exe
  2⤵
  PID:10204
- C:\Windows\System\CpByNAU.exe
  C:\Windows\System\CpByNAU.exe
  2⤵
  PID:10220
- C:\Windows\System\mYSSUeG.exe
  C:\Windows\System\mYSSUeG.exe
  2⤵
  PID:8892
- C:\Windows\System\uHecRvc.exe
  C:\Windows\System\uHecRvc.exe
  2⤵
  PID:9236
- C:\Windows\System\YMuvcdL.exe
  C:\Windows\System\YMuvcdL.exe
  2⤵
  PID:4280
- C:\Windows\System\PwBETeC.exe
  C:\Windows\System\PwBETeC.exe
  2⤵
  PID:9876
- C:\Windows\System\HjEGOJX.exe
  C:\Windows\System\HjEGOJX.exe
  2⤵
  PID:9912
- C:\Windows\System\OdbXAeu.exe
  C:\Windows\System\OdbXAeu.exe
  2⤵
  PID:9972
- C:\Windows\System\ESlxZzr.exe
  C:\Windows\System\ESlxZzr.exe
  2⤵
  PID:9804
- C:\Windows\System\FVMBvzT.exe
  C:\Windows\System\FVMBvzT.exe
  2⤵
  PID:10060
- C:\Windows\System\hZnBWIv.exe
  C:\Windows\System\hZnBWIv.exe
  2⤵
  PID:9928
- C:\Windows\System\cQWMhkj.exe
  C:\Windows\System\cQWMhkj.exe
  2⤵
  PID:9964
- C:\Windows\System\UmbEkpR.exe
  C:\Windows\System\UmbEkpR.exe
  2⤵
  PID:9032
- C:\Windows\System\hksWWNM.exe
  C:\Windows\System\hksWWNM.exe
  2⤵
  PID:10032
- C:\Windows\System\dwxFcHn.exe
  C:\Windows\System\dwxFcHn.exe
  2⤵
  PID:9180
- C:\Windows\System\YdKGToY.exe
  C:\Windows\System\YdKGToY.exe
  2⤵
  PID:10232
- C:\Windows\System\ImfpuAM.exe
  C:\Windows\System\ImfpuAM.exe
  2⤵
  PID:10148
- C:\Windows\System\oFLuKlQ.exe
  C:\Windows\System\oFLuKlQ.exe
  2⤵
  PID:10176
- C:\Windows\System\fGKwvVZ.exe
  C:\Windows\System\fGKwvVZ.exe
  2⤵
  PID:5340
- C:\Windows\System\qClcrCi.exe
  C:\Windows\System\qClcrCi.exe
  2⤵
  PID:9316
- C:\Windows\System\PfjxZwJ.exe
  C:\Windows\System\PfjxZwJ.exe
  2⤵
  PID:9460
- C:\Windows\System\PyRZuAB.exe
  C:\Windows\System\PyRZuAB.exe
  2⤵
  PID:2872
- C:\Windows\System\qHsYlwg.exe
  C:\Windows\System\qHsYlwg.exe
  2⤵
  PID:8868
- C:\Windows\System\hkYIFEJ.exe
  C:\Windows\System\hkYIFEJ.exe
  2⤵
  PID:10080
- C:\Windows\System\aBKvUWP.exe
  C:\Windows\System\aBKvUWP.exe
  2⤵
  PID:9832
- C:\Windows\System\kHkhoBf.exe
  C:\Windows\System\kHkhoBf.exe
  2⤵
  PID:10024
- C:\Windows\System\MTOuCCl.exe
  C:\Windows\System\MTOuCCl.exe
  2⤵
  PID:9284
- C:\Windows\System\ROYfIkc.exe
  C:\Windows\System\ROYfIkc.exe
  2⤵
  PID:10048
- C:\Windows\System\TMfqXPm.exe
  C:\Windows\System\TMfqXPm.exe
  2⤵
  PID:10172
- C:\Windows\System\OghcCPA.exe
  C:\Windows\System\OghcCPA.exe
  2⤵
  PID:9776
- C:\Windows\System\IZHAWFT.exe
  C:\Windows\System\IZHAWFT.exe
  2⤵
  PID:10092
- C:\Windows\System\vsGtUIN.exe
  C:\Windows\System\vsGtUIN.exe
  2⤵
  PID:10380
- C:\Windows\System\wWiKptz.exe
  C:\Windows\System\wWiKptz.exe
  2⤵
  PID:10404
- C:\Windows\System\iuqiIhH.exe
  C:\Windows\System\iuqiIhH.exe
  2⤵
  PID:10420
- C:\Windows\System\OrsvTXb.exe
  C:\Windows\System\OrsvTXb.exe
  2⤵
  PID:10436
- C:\Windows\System\oPupvQb.exe
  C:\Windows\System\oPupvQb.exe
  2⤵
  PID:10452
- C:\Windows\System\nVarbRW.exe
  C:\Windows\System\nVarbRW.exe
  2⤵
  PID:10472
- C:\Windows\System\HDBwOHH.exe
  C:\Windows\System\HDBwOHH.exe
  2⤵
  PID:10508
- C:\Windows\System\CfWvJJL.exe
  C:\Windows\System\CfWvJJL.exe
  2⤵
  PID:10528
- C:\Windows\System\pHZoRnh.exe
  C:\Windows\System\pHZoRnh.exe
  2⤵
  PID:10548
- C:\Windows\System\aulqsnh.exe
  C:\Windows\System\aulqsnh.exe
  2⤵
  PID:10568
- C:\Windows\System\IkuFPEi.exe
  C:\Windows\System\IkuFPEi.exe
  2⤵
  PID:10596
- C:\Windows\System\MPxLXSx.exe
  C:\Windows\System\MPxLXSx.exe
  2⤵
  PID:10612
- C:\Windows\System\zBtrSel.exe
  C:\Windows\System\zBtrSel.exe
  2⤵
  PID:10628
- C:\Windows\System\PBBJOLa.exe
  C:\Windows\System\PBBJOLa.exe
  2⤵
  PID:10696
- C:\Windows\System\QPgNCcC.exe
  C:\Windows\System\QPgNCcC.exe
  2⤵
  PID:10728
- C:\Windows\System\IGcgFNg.exe
  C:\Windows\System\IGcgFNg.exe
  2⤵
  PID:10744
- C:\Windows\System\zssZyvs.exe
  C:\Windows\System\zssZyvs.exe
  2⤵
  PID:10760
- C:\Windows\System\iCrGNWP.exe
  C:\Windows\System\iCrGNWP.exe
  2⤵
  PID:10780
- C:\Windows\System\yrHeUnV.exe
  C:\Windows\System\yrHeUnV.exe
  2⤵
  PID:10804
- C:\Windows\System\EyScnnP.exe
  C:\Windows\System\EyScnnP.exe
  2⤵
  PID:10824
- C:\Windows\System\bGLXaJm.exe
  C:\Windows\System\bGLXaJm.exe
  2⤵
  PID:10840
- C:\Windows\System\cYmeYNS.exe
  C:\Windows\System\cYmeYNS.exe
  2⤵
  PID:10860
- C:\Windows\System\jpADsiI.exe
  C:\Windows\System\jpADsiI.exe
  2⤵
  PID:10876
- C:\Windows\System\dJDIRjU.exe
  C:\Windows\System\dJDIRjU.exe
  2⤵
  PID:10896
- C:\Windows\System\IRKBnNX.exe
  C:\Windows\System\IRKBnNX.exe
  2⤵
  PID:10988
- C:\Windows\System\tmEIZfC.exe
  C:\Windows\System\tmEIZfC.exe
  2⤵
  PID:11012
- C:\Windows\System\IUikDLy.exe
  C:\Windows\System\IUikDLy.exe
  2⤵
  PID:11044
- C:\Windows\System\ZqgjvpW.exe
  C:\Windows\System\ZqgjvpW.exe
  2⤵
  PID:11060
- C:\Windows\System\eMBYbSF.exe
  C:\Windows\System\eMBYbSF.exe
  2⤵
  PID:11076
- C:\Windows\System\CDqjqqq.exe
  C:\Windows\System\CDqjqqq.exe
  2⤵
  PID:11180
- C:\Windows\System\jCdwgBZ.exe
  C:\Windows\System\jCdwgBZ.exe
  2⤵
  PID:11196
- C:\Windows\System\jPiAVQk.exe
  C:\Windows\System\jPiAVQk.exe
  2⤵
  PID:11216
- C:\Windows\System\lMUFAMP.exe
  C:\Windows\System\lMUFAMP.exe
  2⤵
  PID:11232
- C:\Windows\System\fZNkSSM.exe
  C:\Windows\System\fZNkSSM.exe
  2⤵
  PID:11248
- C:\Windows\System\Ihljbiu.exe
  C:\Windows\System\Ihljbiu.exe
  2⤵
  PID:1608
- C:\Windows\System\AAHzgqO.exe
  C:\Windows\System\AAHzgqO.exe
  2⤵
  PID:10300
- C:\Windows\System\byhmOCy.exe
  C:\Windows\System\byhmOCy.exe
  2⤵
  PID:10364
- C:\Windows\System\yeqnGSA.exe
  C:\Windows\System\yeqnGSA.exe
  2⤵
  PID:10256
- C:\Windows\System\KsoNWOC.exe
  C:\Windows\System\KsoNWOC.exe
  2⤵
  PID:10484
- C:\Windows\System\KVuekYF.exe
  C:\Windows\System\KVuekYF.exe
  2⤵
  PID:10488
- C:\Windows\System\TjhXvQK.exe
  C:\Windows\System\TjhXvQK.exe
  2⤵
  PID:10264
- C:\Windows\System\BxBBJpN.exe
  C:\Windows\System\BxBBJpN.exe
  2⤵
  PID:2332
- C:\Windows\System\ifSqZAX.exe
  C:\Windows\System\ifSqZAX.exe
  2⤵
  PID:10492
- C:\Windows\System\cTIcMzL.exe
  C:\Windows\System\cTIcMzL.exe
  2⤵
  PID:10392
- C:\Windows\System\QiJgurH.exe
  C:\Windows\System\QiJgurH.exe
  2⤵
  PID:10576
- C:\Windows\System\YbbINNl.exe
  C:\Windows\System\YbbINNl.exe
  2⤵
  PID:10432
- C:\Windows\System\gwtroDM.exe
  C:\Windows\System\gwtroDM.exe
  2⤵
  PID:10592
- C:\Windows\System\huluMeq.exe
  C:\Windows\System\huluMeq.exe
  2⤵
  PID:10504
- C:\Windows\System\IBAlSfQ.exe
  C:\Windows\System\IBAlSfQ.exe
  2⤵
  PID:10640
- C:\Windows\System\oHmXqOY.exe
  C:\Windows\System\oHmXqOY.exe
  2⤵
  PID:1988
- C:\Windows\System\psbRJKA.exe
  C:\Windows\System\psbRJKA.exe
  2⤵
  PID:10740
- C:\Windows\System\vdwwIJt.exe
  C:\Windows\System\vdwwIJt.exe
  2⤵
  PID:10812
- C:\Windows\System\lhqvsmo.exe
  C:\Windows\System\lhqvsmo.exe
  2⤵
  PID:10836
- C:\Windows\System\sIvcMcH.exe
  C:\Windows\System\sIvcMcH.exe
  2⤵
  PID:11052
- C:\Windows\System\SDFLBbI.exe
  C:\Windows\System\SDFLBbI.exe
  2⤵
  PID:10944
- C:\Windows\System\wYtzYyb.exe
  C:\Windows\System\wYtzYyb.exe
  2⤵
  PID:10752
- C:\Windows\System\UQJeVMF.exe
  C:\Windows\System\UQJeVMF.exe
  2⤵
  PID:10868
- C:\Windows\System\fAKUOdb.exe
  C:\Windows\System\fAKUOdb.exe
  2⤵
  PID:11152
- C:\Windows\System\ehWFtuR.exe
  C:\Windows\System\ehWFtuR.exe
  2⤵
  PID:11088
- C:\Windows\System\pCywSSN.exe
  C:\Windows\System\pCywSSN.exe
  2⤵
  PID:10680
- C:\Windows\System\WHPVQmY.exe
  C:\Windows\System\WHPVQmY.exe
  2⤵
  PID:10692
- C:\Windows\System\JvNwMqi.exe
  C:\Windows\System\JvNwMqi.exe
  2⤵
  PID:11112
- C:\Windows\System\bAvPEQQ.exe
  C:\Windows\System\bAvPEQQ.exe
  2⤵
  PID:10564
- C:\Windows\System\IuDkEAN.exe
  C:\Windows\System\IuDkEAN.exe
  2⤵
  PID:10276
- C:\Windows\System\IliImYg.exe
  C:\Windows\System\IliImYg.exe
  2⤵
  PID:10652
- C:\Windows\System\fshsTbF.exe
  C:\Windows\System\fshsTbF.exe
  2⤵
  PID:10428
- C:\Windows\System\IyzOuoj.exe
  C:\Windows\System\IyzOuoj.exe
  2⤵
  PID:11276
- C:\Windows\System\poeUFFR.exe
  C:\Windows\System\poeUFFR.exe
  2⤵
  PID:11300
- C:\Windows\System\evLGChf.exe
  C:\Windows\System\evLGChf.exe
  2⤵
  PID:11420
- C:\Windows\System\pffaeHo.exe
  C:\Windows\System\pffaeHo.exe
  2⤵
  PID:11444
- C:\Windows\System\NVIudjb.exe
  C:\Windows\System\NVIudjb.exe
  2⤵
  PID:11464
- C:\Windows\System\BhgiExv.exe
  C:\Windows\System\BhgiExv.exe
  2⤵
  PID:11480
- C:\Windows\System\JzpJbcs.exe
  C:\Windows\System\JzpJbcs.exe
  2⤵
  PID:11508
- C:\Windows\System\wVrFazx.exe
  C:\Windows\System\wVrFazx.exe
  2⤵
  PID:11528
- C:\Windows\System\TYSKwbZ.exe
  C:\Windows\System\TYSKwbZ.exe
  2⤵
  PID:11544
- C:\Windows\System\ZIRbhwZ.exe
  C:\Windows\System\ZIRbhwZ.exe
  2⤵
  PID:11564
- C:\Windows\System\fWrgbES.exe
  C:\Windows\System\fWrgbES.exe
  2⤵
  PID:11588
- C:\Windows\System\NgoiGui.exe
  C:\Windows\System\NgoiGui.exe
  2⤵
  PID:11612
- C:\Windows\System\xcmKRUJ.exe
  C:\Windows\System\xcmKRUJ.exe
  2⤵
  PID:11632
- C:\Windows\System\youmMjX.exe
  C:\Windows\System\youmMjX.exe
  2⤵
  PID:11652
- C:\Windows\System\vnrHSDU.exe
  C:\Windows\System\vnrHSDU.exe
  2⤵
  PID:11684
- C:\Windows\System\ZyqyRzQ.exe
  C:\Windows\System\ZyqyRzQ.exe
  2⤵
  PID:11704
- C:\Windows\System\zeDbsKX.exe
  C:\Windows\System\zeDbsKX.exe
  2⤵
  PID:11868
- C:\Windows\System\gmhHlsV.exe
  C:\Windows\System\gmhHlsV.exe
  2⤵
  PID:11888
- C:\Windows\System\DSRSduO.exe
  C:\Windows\System\DSRSduO.exe
  2⤵
  PID:11912
- C:\Windows\System\OlergiK.exe
  C:\Windows\System\OlergiK.exe
  2⤵
  PID:11948
- C:\Windows\System\dJcGKlw.exe
  C:\Windows\System\dJcGKlw.exe
  2⤵
  PID:11972
- C:\Windows\System\wuYxaqZ.exe
  C:\Windows\System\wuYxaqZ.exe
  2⤵
  PID:11992
- C:\Windows\System\qrBDmEz.exe
  C:\Windows\System\qrBDmEz.exe
  2⤵
  PID:12012
- C:\Windows\System\nTqwJxp.exe
  C:\Windows\System\nTqwJxp.exe
  2⤵
  PID:12036
- C:\Windows\System\YYXBOvj.exe
  C:\Windows\System\YYXBOvj.exe
  2⤵
  PID:12064
- C:\Windows\System\xzLvWwb.exe
  C:\Windows\System\xzLvWwb.exe
  2⤵
  PID:12088
- C:\Windows\System\iDoqPoB.exe
  C:\Windows\System\iDoqPoB.exe
  2⤵
  PID:12108
- C:\Windows\System\egzFmbq.exe
  C:\Windows\System\egzFmbq.exe
  2⤵
  PID:12124
- C:\Windows\System\BOsLExN.exe
  C:\Windows\System\BOsLExN.exe
  2⤵
  PID:12148
- C:\Windows\System\qqZhWim.exe
  C:\Windows\System\qqZhWim.exe
  2⤵
  PID:10584
- C:\Windows\System\uZsHDFn.exe
  C:\Windows\System\uZsHDFn.exe
  2⤵
  PID:10604
- C:\Windows\System\VGDzvoG.exe
  C:\Windows\System\VGDzvoG.exe
  2⤵
  PID:10964
- C:\Windows\System\fVbdGBc.exe
  C:\Windows\System\fVbdGBc.exe
  2⤵
  PID:11136
- C:\Windows\System\UiOOxur.exe
  C:\Windows\System\UiOOxur.exe
  2⤵
  PID:2312
- C:\Windows\System\vzYxfRi.exe
  C:\Windows\System\vzYxfRi.exe
  2⤵
  PID:10416
- C:\Windows\System\BQzopAQ.exe
  C:\Windows\System\BQzopAQ.exe
  2⤵
  PID:11672
- C:\Windows\System\LcrwCWb.exe
  C:\Windows\System\LcrwCWb.exe
  2⤵
  PID:11460
- C:\Windows\System\WbArMpx.exe
  C:\Windows\System\WbArMpx.exe
  2⤵
  PID:11524
- C:\Windows\System\VBIcMTo.exe
  C:\Windows\System\VBIcMTo.exe
  2⤵
  PID:11628
- C:\Windows\System\MNhndrg.exe
  C:\Windows\System\MNhndrg.exe
  2⤵
  PID:11920
- C:\Windows\System\IRlAVOZ.exe
  C:\Windows\System\IRlAVOZ.exe
  2⤵
  PID:12008
- C:\Windows\System\ozIlylc.exe
  C:\Windows\System\ozIlylc.exe
  2⤵
  PID:12240
- C:\Windows\System\euiysJt.exe
  C:\Windows\System\euiysJt.exe
  2⤵
  PID:11980
- C:\Windows\System\oUMKsaM.exe
  C:\Windows\System\oUMKsaM.exe
  2⤵
  PID:12212
- C:\Windows\System\qCMeqAh.exe
  C:\Windows\System\qCMeqAh.exe
  2⤵
  PID:12052
- C:\Windows\System\aOGAlyF.exe
  C:\Windows\System\aOGAlyF.exe
  2⤵
  PID:12100
- C:\Windows\System\AwrFKQC.exe
  C:\Windows\System\AwrFKQC.exe
  2⤵
  PID:10996
- C:\Windows\System\iyJsimt.exe
  C:\Windows\System\iyJsimt.exe
  2⤵
  PID:12180
- C:\Windows\System\KbMVyls.exe
  C:\Windows\System\KbMVyls.exe
  2⤵
  PID:11208
- C:\Windows\System\wqJSkgq.exe
  C:\Windows\System\wqJSkgq.exe
  2⤵
  PID:11412
- C:\Windows\System\ZFWqulA.exe
  C:\Windows\System\ZFWqulA.exe
  2⤵
  PID:10708
- C:\Windows\System\OFHnZaB.exe
  C:\Windows\System\OFHnZaB.exe
  2⤵
  PID:11028
- C:\Windows\System\naEsvmk.exe
  C:\Windows\System\naEsvmk.exe
  2⤵
  PID:11272
- C:\Windows\System\nwnmCfi.exe
  C:\Windows\System\nwnmCfi.exe
  2⤵
  PID:11724
- C:\Windows\System\IfqgaRN.exe
  C:\Windows\System\IfqgaRN.exe
  2⤵
  PID:11372
- C:\Windows\System\mSdfMBY.exe
  C:\Windows\System\mSdfMBY.exe
  2⤵
  PID:10088
- C:\Windows\System\HzdJHQi.exe
  C:\Windows\System\HzdJHQi.exe
  2⤵
  PID:4852
- C:\Windows\System\UOwiVxn.exe
  C:\Windows\System\UOwiVxn.exe
  2⤵
  PID:7128
- C:\Windows\System\tpJJMjt.exe
  C:\Windows\System\tpJJMjt.exe
  2⤵
  PID:11496
- C:\Windows\System\MqljLCO.exe
  C:\Windows\System\MqljLCO.exe
  2⤵
  PID:11780
- C:\Windows\System\mhJZhRW.exe
  C:\Windows\System\mhJZhRW.exe
  2⤵
  PID:3552
- C:\Windows\System\QbAVUBf.exe
  C:\Windows\System\QbAVUBf.exe
  2⤵
  PID:11940
- C:\Windows\System\VoidyXW.exe
  C:\Windows\System\VoidyXW.exe
  2⤵
  PID:11964
- C:\Windows\System\svSBsBX.exe
  C:\Windows\System\svSBsBX.exe
  2⤵
  PID:12084
- C:\Windows\System\byhGHpK.exe
  C:\Windows\System\byhGHpK.exe
  2⤵
  PID:11676
- C:\Windows\System\OGjysKg.exe
  C:\Windows\System\OGjysKg.exe
  2⤵
  PID:4820
- C:\Windows\System\GofFhGZ.exe
  C:\Windows\System\GofFhGZ.exe
  2⤵
  PID:12136
- C:\Windows\System\ABdGria.exe
  C:\Windows\System\ABdGria.exe
  2⤵
  PID:4668
- C:\Windows\System\YxOKpOB.exe
  C:\Windows\System\YxOKpOB.exe
  2⤵
  PID:3716
- C:\Windows\System\JOrBRTV.exe
  C:\Windows\System\JOrBRTV.exe
  2⤵
  PID:4868
- C:\Windows\System\UmryzCq.exe
  C:\Windows\System\UmryzCq.exe
  2⤵
  PID:4516
- C:\Windows\System\pmATAWq.exe
  C:\Windows\System\pmATAWq.exe
  2⤵
  PID:12304
- C:\Windows\System\rsIMToq.exe
  C:\Windows\System\rsIMToq.exe
  2⤵
  PID:12332
- C:\Windows\System\hWBugaz.exe
  C:\Windows\System\hWBugaz.exe
  2⤵
  PID:12356
- C:\Windows\System\cNPXFio.exe
  C:\Windows\System\cNPXFio.exe
  2⤵
  PID:12380
- C:\Windows\System\vbAUnWo.exe
  C:\Windows\System\vbAUnWo.exe
  2⤵
  PID:12408
- C:\Windows\System\oeLpRmt.exe
  C:\Windows\System\oeLpRmt.exe
  2⤵
  PID:12424
- C:\Windows\System\wTOooyl.exe
  C:\Windows\System\wTOooyl.exe
  2⤵
  PID:12456
- C:\Windows\System\fKrpzAE.exe
  C:\Windows\System\fKrpzAE.exe
  2⤵
  PID:12476
- C:\Windows\System\vogQxkO.exe
  C:\Windows\System\vogQxkO.exe
  2⤵
  PID:12496
- C:\Windows\System\JkgJGeD.exe
  C:\Windows\System\JkgJGeD.exe
  2⤵
  PID:12516
- C:\Windows\System\ffEVolp.exe
  C:\Windows\System\ffEVolp.exe
  2⤵
  PID:12540
- C:\Windows\System\hTXIVbh.exe
  C:\Windows\System\hTXIVbh.exe
  2⤵
  PID:12568
- C:\Windows\System\LyLZCdN.exe
  C:\Windows\System\LyLZCdN.exe
  2⤵
  PID:12588
- C:\Windows\System\SrTwBvl.exe
  C:\Windows\System\SrTwBvl.exe
  2⤵
  PID:12608
- C:\Windows\System\fiXqRLW.exe
  C:\Windows\System\fiXqRLW.exe
  2⤵
  PID:12640
- C:\Windows\System\DNtmPkq.exe
  C:\Windows\System\DNtmPkq.exe
  2⤵
  PID:12664
- C:\Windows\System\XpXuhOV.exe
  C:\Windows\System\XpXuhOV.exe
  2⤵
  PID:12684
- C:\Windows\System\wDhKoAc.exe
  C:\Windows\System\wDhKoAc.exe
  2⤵
  PID:12784
- C:\Windows\System\bWppqju.exe
  C:\Windows\System\bWppqju.exe
  2⤵
  PID:12800
- C:\Windows\System\jgWkAVC.exe
  C:\Windows\System\jgWkAVC.exe
  2⤵
  PID:12816
- C:\Windows\System\WkFgkiq.exe
  C:\Windows\System\WkFgkiq.exe
  2⤵
  PID:12840
- C:\Windows\System\hEnMIfJ.exe
  C:\Windows\System\hEnMIfJ.exe
  2⤵
  PID:12868
- C:\Windows\System\YIFClpT.exe
  C:\Windows\System\YIFClpT.exe
  2⤵
  PID:12896
- C:\Windows\System\HMZdMAz.exe
  C:\Windows\System\HMZdMAz.exe
  2⤵
  PID:12916
- C:\Windows\System\wAABxiZ.exe
  C:\Windows\System\wAABxiZ.exe
  2⤵
  PID:12940
- C:\Windows\System\NIePoDp.exe
  C:\Windows\System\NIePoDp.exe
  2⤵
  PID:12964
- C:\Windows\System\mJIYStt.exe
  C:\Windows\System\mJIYStt.exe
  2⤵
  PID:12992
- C:\Windows\System\kOxcUMK.exe
  C:\Windows\System\kOxcUMK.exe
  2⤵
  PID:13016
- C:\Windows\System\HOeyDgL.exe
  C:\Windows\System\HOeyDgL.exe
  2⤵
  PID:13036
- C:\Windows\System\hqtBqdF.exe
  C:\Windows\System\hqtBqdF.exe
  2⤵
  PID:13136
- C:\Windows\System\boItncO.exe
  C:\Windows\System\boItncO.exe
  2⤵
  PID:13256
- C:\Windows\System\jupyTQK.exe
  C:\Windows\System\jupyTQK.exe
  2⤵
  PID:13276
- C:\Windows\System\ByMUenW.exe
  C:\Windows\System\ByMUenW.exe
  2⤵
  PID:10952
- C:\Windows\System\zJclFqI.exe
  C:\Windows\System\zJclFqI.exe
  2⤵
  PID:12604
- C:\Windows\System\iILGIIN.exe
  C:\Windows\System\iILGIIN.exe
  2⤵
  PID:12420
- C:\Windows\System\cWIXQGV.exe
  C:\Windows\System\cWIXQGV.exe
  2⤵
  PID:12376
- C:\Windows\System\NpOVxrW.exe
  C:\Windows\System\NpOVxrW.exe
  2⤵
  PID:12740
- C:\Windows\System\vZrIHet.exe
  C:\Windows\System\vZrIHet.exe
  2⤵
  PID:13044
- C:\Windows\System\dgnEYOP.exe
  C:\Windows\System\dgnEYOP.exe
  2⤵
  PID:13172
- C:\Windows\System\xSmRmkK.exe
  C:\Windows\System\xSmRmkK.exe
  2⤵
  PID:12772
- C:\Windows\System\xiLmYSc.exe
  C:\Windows\System\xiLmYSc.exe
  2⤵
  PID:13012
- C:\Windows\System\nwVuJel.exe
  C:\Windows\System\nwVuJel.exe
  2⤵
  PID:12956
- C:\Windows\System\lXzZHnz.exe
  C:\Windows\System\lXzZHnz.exe
  2⤵
  PID:13212
- C:\Windows\System\fzLvpgv.exe
  C:\Windows\System\fzLvpgv.exe
  2⤵
  PID:13152
- C:\Windows\System\ILbSjLg.exe
  C:\Windows\System\ILbSjLg.exe
  2⤵
  PID:12828
- C:\Windows\System\IvdnTrF.exe
  C:\Windows\System\IvdnTrF.exe
  2⤵
  PID:3916
- C:\Windows\System\LLOUScu.exe
  C:\Windows\System\LLOUScu.exe
  2⤵
  PID:2564
- C:\Windows\System\FoIrQzk.exe
  C:\Windows\System\FoIrQzk.exe
  2⤵
  PID:12296
- C:\Windows\System\NAknvmm.exe
  C:\Windows\System\NAknvmm.exe
  2⤵
  PID:5000
- C:\Windows\System\uEHbYZw.exe
  C:\Windows\System\uEHbYZw.exe
  2⤵
  PID:3648
- C:\Windows\System\CUFeafY.exe
  C:\Windows\System\CUFeafY.exe
  2⤵
  PID:12812
- C:\Windows\System\QAqDdbQ.exe
  C:\Windows\System\QAqDdbQ.exe
  2⤵
  PID:12888
- C:\Windows\System\oxwnozV.exe
  C:\Windows\System\oxwnozV.exe
  2⤵
  PID:12824
- C:\Windows\System\vGOJgbX.exe
  C:\Windows\System\vGOJgbX.exe
  2⤵
  PID:13320
- C:\Windows\System\ntxsZFB.exe
  C:\Windows\System\ntxsZFB.exe
  2⤵
  PID:13340
- C:\Windows\System\hLrXwmw.exe
  C:\Windows\System\hLrXwmw.exe
  2⤵
  PID:13364
- C:\Windows\System\YvDOtwz.exe
  C:\Windows\System\YvDOtwz.exe
  2⤵
  PID:13388
- C:\Windows\System\zsHuVvU.exe
  C:\Windows\System\zsHuVvU.exe
  2⤵
  PID:13412
- C:\Windows\System\tXJvYJP.exe
  C:\Windows\System\tXJvYJP.exe
  2⤵
  PID:13524
- C:\Windows\System\DburZou.exe
  C:\Windows\System\DburZou.exe
  2⤵
  PID:13540
- C:\Windows\System\gDXIxSm.exe
  C:\Windows\System\gDXIxSm.exe
  2⤵
  PID:13772
- C:\Windows\System\GXWYOPA.exe
  C:\Windows\System\GXWYOPA.exe
  2⤵
  PID:13796
- C:\Windows\System\XVvTADs.exe
  C:\Windows\System\XVvTADs.exe
  2⤵
  PID:13844
- C:\Windows\System\DjNmFDF.exe
  C:\Windows\System\DjNmFDF.exe
  2⤵
  PID:13872
- C:\Windows\System\IMeYafi.exe
  C:\Windows\System\IMeYafi.exe
  2⤵
  PID:13928
- C:\Windows\System\yeDLxiI.exe
  C:\Windows\System\yeDLxiI.exe
  2⤵
  PID:13948
- C:\Windows\System\vGIhGKS.exe
  C:\Windows\System\vGIhGKS.exe
  2⤵
  PID:13976
- C:\Windows\System\deHLVTr.exe
  C:\Windows\System\deHLVTr.exe
  2⤵
  PID:13992
- C:\Windows\System\TpUNGvK.exe
  C:\Windows\System\TpUNGvK.exe
  2⤵
  PID:14024
- C:\Windows\System\iNjftQG.exe
  C:\Windows\System\iNjftQG.exe
  2⤵
  PID:14044
- C:\Windows\System\eDqityx.exe
  C:\Windows\System\eDqityx.exe
  2⤵
  PID:14068
- C:\Windows\System\DYMwHIO.exe
  C:\Windows\System\DYMwHIO.exe
  2⤵
  PID:14084
- C:\Windows\System\wEfvkgZ.exe
  C:\Windows\System\wEfvkgZ.exe
  2⤵
  PID:14108
- C:\Windows\System\psJrOVm.exe
  C:\Windows\System\psJrOVm.exe
  2⤵
  PID:14164
- C:\Windows\System\VTLANTY.exe
  C:\Windows\System\VTLANTY.exe
  2⤵
  PID:14188
- C:\Windows\System\qVINsLL.exe
  C:\Windows\System\qVINsLL.exe
  2⤵
  PID:14204
- C:\Windows\System\qyXCqCr.exe
  C:\Windows\System\qyXCqCr.exe
  2⤵
  PID:14220
- C:\Windows\System\wHXpUek.exe
  C:\Windows\System\wHXpUek.exe
  2⤵
  PID:14236
- C:\Windows\System\VblxrgC.exe
  C:\Windows\System\VblxrgC.exe
  2⤵
  PID:14276
- C:\Windows\System\RgmMdlC.exe
  C:\Windows\System\RgmMdlC.exe
  2⤵
  PID:14296
- C:\Windows\System\loxcdDx.exe
  C:\Windows\System\loxcdDx.exe
  2⤵
  PID:14312
- C:\Windows\System\bdYWSVL.exe
  C:\Windows\System\bdYWSVL.exe
  2⤵
  PID:12196
- C:\Windows\System\fwdcIDv.exe
  C:\Windows\System\fwdcIDv.exe
  2⤵
  PID:4276
- C:\Windows\System\fKvjGtD.exe
  C:\Windows\System\fKvjGtD.exe
  2⤵
  PID:544
- C:\Windows\System\xsFUmKy.exe
  C:\Windows\System\xsFUmKy.exe
  2⤵
  PID:13612
- C:\Windows\System\HNXuqGd.exe
  C:\Windows\System\HNXuqGd.exe
  2⤵
  PID:13536
- C:\Windows\System\GLZdZSA.exe
  C:\Windows\System\GLZdZSA.exe
  2⤵
  PID:3944
- C:\Windows\System\yoXHIcU.exe
  C:\Windows\System\yoXHIcU.exe
  2⤵
  PID:13508
- C:\Windows\System\AdOhwMg.exe
  C:\Windows\System\AdOhwMg.exe
  2⤵
  PID:13480
- C:\Windows\System\TSBCrtM.exe
  C:\Windows\System\TSBCrtM.exe
  2⤵
  PID:13532
- C:\Windows\System\YmtxFwo.exe
  C:\Windows\System\YmtxFwo.exe
  2⤵
  PID:13556
- C:\Windows\System\uJAvsaM.exe
  C:\Windows\System\uJAvsaM.exe
  2⤵
  PID:13600
- C:\Windows\System\LItsyYk.exe
  C:\Windows\System\LItsyYk.exe
  2⤵
  PID:13620
- C:\Windows\System\mGrJDhB.exe
  C:\Windows\System\mGrJDhB.exe
  2⤵
  PID:13824
- C:\Windows\System\ULEpyoJ.exe
  C:\Windows\System\ULEpyoJ.exe
  2⤵
  PID:4732
- C:\Windows\System\vpwuReJ.exe
  C:\Windows\System\vpwuReJ.exe
  2⤵
  PID:13672
- C:\Windows\System\guwVvLj.exe
  C:\Windows\System\guwVvLj.exe
  2⤵
  PID:13736
- C:\Windows\System\XvyDUgS.exe
  C:\Windows\System\XvyDUgS.exe
  2⤵
  PID:13428
- C:\Windows\System\PSjBGkq.exe
  C:\Windows\System\PSjBGkq.exe
  2⤵
  PID:4172
- C:\Windows\System\InxeTrJ.exe
  C:\Windows\System\InxeTrJ.exe
  2⤵
  PID:2512
- C:\Windows\System\uOHAPKu.exe
  C:\Windows\System\uOHAPKu.exe
  2⤵
  PID:11956
- C:\Windows\System\jNfxJte.exe
  C:\Windows\System\jNfxJte.exe
  2⤵
  PID:13920
- C:\Windows\System\ZsWTcSd.exe
  C:\Windows\System\ZsWTcSd.exe
  2⤵
  PID:3740
- C:\Windows\System\arkuJpC.exe
  C:\Windows\System\arkuJpC.exe
  2⤵
  PID:13900
- C:\Windows\System\xRvujbW.exe
  C:\Windows\System\xRvujbW.exe
  2⤵
  PID:14008
- C:\Windows\System\sSdWEya.exe
  C:\Windows\System\sSdWEya.exe
  2⤵
  PID:13944
- C:\Windows\System\iaFKbdB.exe
  C:\Windows\System\iaFKbdB.exe
  2⤵
  PID:1328
- C:\Windows\System\JVtHzyI.exe
  C:\Windows\System\JVtHzyI.exe
  2⤵
  PID:13680
- C:\Windows\System\NLxUPZs.exe
  C:\Windows\System\NLxUPZs.exe
  2⤵
  PID:13484
- C:\Windows\System\BaHZCss.exe
  C:\Windows\System\BaHZCss.exe
  2⤵
  PID:12988
- C:\Windows\System\wSfwCUy.exe
  C:\Windows\System\wSfwCUy.exe
  2⤵
  PID:13820
- C:\Windows\System\qXKCOvQ.exe
  C:\Windows\System\qXKCOvQ.exe
  2⤵
  PID:13236
- C:\Windows\System\DqOurnN.exe
  C:\Windows\System\DqOurnN.exe
  2⤵
  PID:14116
- C:\Windows\System\uzfFUGj.exe
  C:\Windows\System\uzfFUGj.exe
  2⤵
  PID:4564
- C:\Windows\System\NRhXXMH.exe
  C:\Windows\System\NRhXXMH.exe
  2⤵
  PID:14292
- C:\Windows\System\eIjUNBR.exe
  C:\Windows\System\eIjUNBR.exe
  2⤵
  PID:4860
- C:\Windows\System\pRisrLD.exe
  C:\Windows\System\pRisrLD.exe
  2⤵
  PID:14308
- C:\Windows\System\mzSsYDM.exe
  C:\Windows\System\mzSsYDM.exe
  2⤵
  PID:12492
- C:\Windows\System\uZfOMDL.exe
  C:\Windows\System\uZfOMDL.exe
  2⤵
  PID:5436
- C:\Windows\System\QwXSKWY.exe
  C:\Windows\System\QwXSKWY.exe
  2⤵
  PID:8852
- C:\Windows\System\faEbdCp.exe
  C:\Windows\System\faEbdCp.exe
  2⤵
  PID:4492
- C:\Windows\System\gyWYnbz.exe
  C:\Windows\System\gyWYnbz.exe
  2⤵
  PID:14052
- C:\Windows\System\ZztMkiQ.exe
  C:\Windows\System\ZztMkiQ.exe
  2⤵
  PID:2260
- C:\Windows\System\MqqwIla.exe
  C:\Windows\System\MqqwIla.exe
  2⤵
  PID:2116
- C:\Windows\System\zyhykrj.exe
  C:\Windows\System\zyhykrj.exe
  2⤵
  PID:1384
- C:\Windows\System\hvIFHyM.exe
  C:\Windows\System\hvIFHyM.exe
  2⤵
  PID:2160
- C:\Windows\System\bBrSVgS.exe
  C:\Windows\System\bBrSVgS.exe
  2⤵
  PID:3952
- C:\Windows\System\MvNCtqL.exe
  C:\Windows\System\MvNCtqL.exe
  2⤵
  PID:5576
- C:\Windows\System\VQdntwG.exe
  C:\Windows\System\VQdntwG.exe
  2⤵
  PID:3388
- C:\Windows\System\TnsWCPu.exe
  C:\Windows\System\TnsWCPu.exe
  2⤵
  PID:5624
- C:\Windows\System\HeWSGbf.exe
  C:\Windows\System\HeWSGbf.exe
  2⤵
  PID:14284
- C:\Windows\System\XVEYUVF.exe
  C:\Windows\System\XVEYUVF.exe
  2⤵
  PID:13704
- C:\Windows\System\VXSChfD.exe
  C:\Windows\System\VXSChfD.exe
  2⤵
  PID:13964
- C:\Windows\System\YgEHLlL.exe
  C:\Windows\System\YgEHLlL.exe
  2⤵
  PID:14000
- C:\Windows\System\dGQrWgP.exe
  C:\Windows\System\dGQrWgP.exe
  2⤵
  PID:5720
- C:\Windows\System\ULzolTx.exe
  C:\Windows\System\ULzolTx.exe
  2⤵
  PID:14228
- C:\Windows\System\DKRmMke.exe
  C:\Windows\System\DKRmMke.exe
  2⤵
  PID:4596
- C:\Windows\System\UPmFOYN.exe
  C:\Windows\System\UPmFOYN.exe
  2⤵
  PID:5540
- C:\Windows\System\dVcEXMh.exe
  C:\Windows\System\dVcEXMh.exe
  2⤵
  PID:5272
- C:\Windows\System\IZUzoAy.exe
  C:\Windows\System\IZUzoAy.exe
  2⤵
  PID:13360
- C:\Windows\System\kFhIimA.exe
  C:\Windows\System\kFhIimA.exe
  2⤵
  PID:6624
- C:\Windows\System\PTqoSvi.exe
  C:\Windows\System\PTqoSvi.exe
  2⤵
  PID:5600
- C:\Windows\System\bBfADdj.exe
  C:\Windows\System\bBfADdj.exe
  2⤵
  PID:6304
- C:\Windows\System\KUqyyfF.exe
  C:\Windows\System\KUqyyfF.exe
  2⤵
  PID:2908
- C:\Windows\System\EVPiFuV.exe
  C:\Windows\System\EVPiFuV.exe
  2⤵
  PID:8808
- C:\Windows\System\vUZkxgh.exe
  C:\Windows\System\vUZkxgh.exe
  2⤵
  PID:5160
- C:\Windows\System\MBizjxf.exe
  C:\Windows\System\MBizjxf.exe
  2⤵
  PID:6568
- C:\Windows\System\FgRsBla.exe
  C:\Windows\System\FgRsBla.exe
  2⤵
  PID:5880
- C:\Windows\System\LrfdYPs.exe
  C:\Windows\System\LrfdYPs.exe
  2⤵
  PID:5748
- C:\Windows\System\GNQBlfJ.exe
  C:\Windows\System\GNQBlfJ.exe
  2⤵
  PID:13488
- C:\Windows\System\ImcvBuf.exe
  C:\Windows\System\ImcvBuf.exe
  2⤵
  PID:5740
- C:\Windows\System\qTevxLZ.exe
  C:\Windows\System\qTevxLZ.exe
  2⤵
  PID:6428
- C:\Windows\System\lptLeop.exe
  C:\Windows\System\lptLeop.exe
  2⤵
  PID:5604
- C:\Windows\System\NpaahEx.exe
  C:\Windows\System\NpaahEx.exe
  2⤵
  PID:5360
- C:\Windows\System\hhGBxcB.exe
  C:\Windows\System\hhGBxcB.exe
  2⤵
  PID:5412
- C:\Windows\System\bSJFDxr.exe
  C:\Windows\System\bSJFDxr.exe
  2⤵
  PID:13956
- C:\Windows\System\UzdNyQR.exe
  C:\Windows\System\UzdNyQR.exe
  2⤵
  PID:6032
- C:\Windows\System\BqZllOW.exe
  C:\Windows\System\BqZllOW.exe
  2⤵
  PID:6448
- C:\Windows\System\zgcqXEt.exe
  C:\Windows\System\zgcqXEt.exe
  2⤵
  PID:6436
- C:\Windows\System\QCMyGCe.exe
  C:\Windows\System\QCMyGCe.exe
  2⤵
  PID:5168
- C:\Windows\System\Axjvvsv.exe
  C:\Windows\System\Axjvvsv.exe
  2⤵
  PID:2132
- C:\Windows\System\wcSZuKd.exe
  C:\Windows\System\wcSZuKd.exe
  2⤵
  PID:7000
- C:\Windows\System\vFlaAUP.exe
  C:\Windows\System\vFlaAUP.exe
  2⤵
  PID:12616
- C:\Windows\System\NqPyVJR.exe
  C:\Windows\System\NqPyVJR.exe
  2⤵
  PID:6708
- C:\Windows\System\MsBgQfu.exe
  C:\Windows\System\MsBgQfu.exe
  2⤵
  PID:972
- C:\Windows\System\DgawQUi.exe
  C:\Windows\System\DgawQUi.exe
  2⤵
  PID:1928
- C:\Windows\System\FRsmrJF.exe
  C:\Windows\System\FRsmrJF.exe
  2⤵
  PID:4544
- C:\Windows\System\KmLEtoT.exe
  C:\Windows\System\KmLEtoT.exe
  2⤵
  PID:6136
- C:\Windows\System\golYNpk.exe
  C:\Windows\System\golYNpk.exe
  2⤵
  PID:6848
- C:\Windows\System\nWPneKf.exe
  C:\Windows\System\nWPneKf.exe
  2⤵
  PID:5736
- C:\Windows\System\fMtUYvR.exe
  C:\Windows\System\fMtUYvR.exe
  2⤵
  PID:6188
- C:\Windows\System\AVtvyHc.exe
  C:\Windows\System\AVtvyHc.exe
  2⤵
  PID:4272
- C:\Windows\System\MFSsrXu.exe
  C:\Windows\System\MFSsrXu.exe
  2⤵
  PID:3440
- C:\Windows\System\EAJEPtP.exe
  C:\Windows\System\EAJEPtP.exe
  2⤵
  PID:3972
- C:\Windows\System\nxPZyPV.exe
  C:\Windows\System\nxPZyPV.exe
  2⤵
  PID:5304
- C:\Windows\System\aWrvlDC.exe
  C:\Windows\System\aWrvlDC.exe
  2⤵
  PID:6728
- C:\Windows\System\wopQIkN.exe
  C:\Windows\System\wopQIkN.exe
  2⤵
  PID:6608
- C:\Windows\System\IfgvzBs.exe
  C:\Windows\System\IfgvzBs.exe
  2⤵
  PID:5848
- C:\Windows\System\CmZbcdP.exe
  C:\Windows\System\CmZbcdP.exe
  2⤵
  PID:8612
- C:\Windows\System\DVpOLti.exe
  C:\Windows\System\DVpOLti.exe
  2⤵
  PID:8860
- C:\Windows\System\HcVVenK.exe
  C:\Windows\System\HcVVenK.exe
  2⤵
  PID:5860
- C:\Windows\System\eWLJenQ.exe
  C:\Windows\System\eWLJenQ.exe
  2⤵
  PID:5132
- C:\Windows\System\VagHAAd.exe
  C:\Windows\System\VagHAAd.exe
  2⤵
  PID:6772
- C:\Windows\System\ZboqjHi.exe
  C:\Windows\System\ZboqjHi.exe
  2⤵
  PID:2676
- C:\Windows\System\KKepAin.exe
  C:\Windows\System\KKepAin.exe
  2⤵
  PID:5560
- C:\Windows\System\QfIWkIH.exe
  C:\Windows\System\QfIWkIH.exe
  2⤵
  PID:2976
- C:\Windows\System\xlDnRpU.exe
  C:\Windows\System\xlDnRpU.exe
  2⤵
  PID:1876
- C:\Windows\System\OCxxxND.exe
  C:\Windows\System\OCxxxND.exe
  2⤵
  PID:13696
- C:\Windows\System\QgYEoOw.exe
  C:\Windows\System\QgYEoOw.exe
  2⤵
  PID:14268
- C:\Windows\System\qcGcDZw.exe
  C:\Windows\System\qcGcDZw.exe
  2⤵
  PID:5728
- C:\Windows\System\ZgmbODR.exe
  C:\Windows\System\ZgmbODR.exe
  2⤵
  PID:12116
- C:\Windows\System\CtMBkey.exe
  C:\Windows\System\CtMBkey.exe
  2⤵
  PID:5960
- C:\Windows\System\smpLTZO.exe
  C:\Windows\System\smpLTZO.exe
  2⤵
  PID:2248
- C:\Windows\System\yvhQifU.exe
  C:\Windows\System\yvhQifU.exe
  2⤵
  PID:5988
- C:\Windows\System\CcPyXmQ.exe
  C:\Windows\System\CcPyXmQ.exe
  2⤵
  PID:12348
- C:\Windows\System\IXfApPR.exe
  C:\Windows\System\IXfApPR.exe
  2⤵
  PID:1368
- C:\Windows\System\CGwCJpY.exe
  C:\Windows\System\CGwCJpY.exe
  2⤵
  PID:1064
- C:\Windows\System\ttJeMoW.exe
  C:\Windows\System\ttJeMoW.exe
  2⤵
  PID:2680
- C:\Windows\System\qJIlfna.exe
  C:\Windows\System\qJIlfna.exe
  2⤵
  PID:4376
- C:\Windows\System\qtJDBff.exe
  C:\Windows\System\qtJDBff.exe
  2⤵
  PID:1512
- C:\Windows\System\avKqmfz.exe
  C:\Windows\System\avKqmfz.exe
  2⤵
  PID:7408
- C:\Windows\System\WNBjGTY.exe
  C:\Windows\System\WNBjGTY.exe
  2⤵
  PID:3192
- C:\Windows\System\nXhHxzK.exe
  C:\Windows\System\nXhHxzK.exe
  2⤵
  PID:7160
- C:\Windows\System\PLswwtn.exe
  C:\Windows\System\PLswwtn.exe
  2⤵
  PID:8016
- C:\Windows\System\YsbTzfs.exe
  C:\Windows\System\YsbTzfs.exe
  2⤵
  PID:5968
- C:\Windows\System\zqrbwwg.exe
  C:\Windows\System\zqrbwwg.exe
  2⤵
  PID:5348
- C:\Windows\System\aFoVgBl.exe
  C:\Windows\System\aFoVgBl.exe
  2⤵
  PID:12532
- C:\Windows\System\XKIZult.exe
  C:\Windows\System\XKIZult.exe
  2⤵
  PID:7604
- C:\Windows\System\hgBfuIJ.exe
  C:\Windows\System\hgBfuIJ.exe
  2⤵
  PID:8164
- C:\Windows\System\ZgTULRG.exe
  C:\Windows\System\ZgTULRG.exe
  2⤵
  PID:6912
- C:\Windows\System\QuNFUcZ.exe
  C:\Windows\System\QuNFUcZ.exe
  2⤵
  PID:7732
- C:\Windows\System\UEXiSBP.exe
  C:\Windows\System\UEXiSBP.exe
  2⤵
  PID:8012
- C:\Windows\System\cpVLLjo.exe
  C:\Windows\System\cpVLLjo.exe
  2⤵
  PID:6676
- C:\Windows\System\FGkPXna.exe
  C:\Windows\System\FGkPXna.exe
  2⤵
  PID:8100
- C:\Windows\System\VQQRcFZ.exe
  C:\Windows\System\VQQRcFZ.exe
  2⤵
  PID:5636
- C:\Windows\System\oeUzHap.exe
  C:\Windows\System\oeUzHap.exe
  2⤵
  PID:12548
- C:\Windows\System\mTVhoGC.exe
  C:\Windows\System\mTVhoGC.exe
  2⤵
  PID:2188
- C:\Windows\System\JikeuvO.exe
  C:\Windows\System\JikeuvO.exe
  2⤵
  PID:7056
- C:\Windows\System\smEuevJ.exe
  C:\Windows\System\smEuevJ.exe
  2⤵
  PID:5404
- C:\Windows\System\tKJhROl.exe
  C:\Windows\System\tKJhROl.exe
  2⤵
  PID:8688
- C:\Windows\System\OBtnbRB.exe
  C:\Windows\System\OBtnbRB.exe
  2⤵
  PID:3636
- C:\Windows\System\HgnUDHs.exe
  C:\Windows\System\HgnUDHs.exe
  2⤵
  PID:14364
- C:\Windows\System\xjLZpgO.exe
  C:\Windows\System\xjLZpgO.exe
  2⤵
  PID:14380
- C:\Windows\System\KPqfGHh.exe
  C:\Windows\System\KPqfGHh.exe
  2⤵
  PID:14404
- C:\Windows\System\MbTqBKI.exe
  C:\Windows\System\MbTqBKI.exe
  2⤵
  PID:14424
- C:\Windows\System\YOaLFeb.exe
  C:\Windows\System\YOaLFeb.exe
  2⤵
  PID:14448
- C:\Windows\System\vEQJHqr.exe
  C:\Windows\System\vEQJHqr.exe
  2⤵
  PID:14472
- C:\Windows\System\zdZiASN.exe
  C:\Windows\System\zdZiASN.exe
  2⤵
  PID:14496
- C:\Windows\System\rKOJYIX.exe
  C:\Windows\System\rKOJYIX.exe
  2⤵
  PID:14516
- C:\Windows\System\KzrEWfJ.exe
  C:\Windows\System\KzrEWfJ.exe
  2⤵
  PID:14536
- C:\Windows\System\EuGYbrM.exe
  C:\Windows\System\EuGYbrM.exe
  2⤵
  PID:14552
- C:\Windows\System\qlDCrng.exe
  C:\Windows\System\qlDCrng.exe
  2⤵
  PID:14756
- C:\Windows\System\JzNlGzd.exe
  C:\Windows\System\JzNlGzd.exe
  2⤵
  PID:14772
- C:\Windows\System\FMPKrZA.exe
  C:\Windows\System\FMPKrZA.exe
  2⤵
  PID:14792
- C:\Windows\System\FZesejf.exe
  C:\Windows\System\FZesejf.exe
  2⤵
  PID:14808
- C:\Windows\System\byCODuG.exe
  C:\Windows\System\byCODuG.exe
  2⤵
  PID:14972
- C:\Windows\System\OZOfLKE.exe
  C:\Windows\System\OZOfLKE.exe
  2⤵
  PID:15288
- C:\Windows\System\BMjLHoL.exe
  C:\Windows\System\BMjLHoL.exe
  2⤵
  PID:5840
- C:\Windows\System\mckEokh.exe
  C:\Windows\System\mckEokh.exe
  2⤵
  PID:14464
- C:\Windows\System\TYovJsC.exe
  C:\Windows\System\TYovJsC.exe
  2⤵
  PID:7108
- C:\Windows\System\Yjzzenm.exe
  C:\Windows\System\Yjzzenm.exe
  2⤵
  PID:7964
- C:\Windows\System\RMFwAxB.exe
  C:\Windows\System\RMFwAxB.exe
  2⤵
  PID:7360
- C:\Windows\System\HZZFDGT.exe
  C:\Windows\System\HZZFDGT.exe
  2⤵
  PID:7656
- C:\Windows\System\DqBzrsy.exe
  C:\Windows\System\DqBzrsy.exe
  2⤵
  PID:6852
- C:\Windows\System\zQPDtTm.exe
  C:\Windows\System\zQPDtTm.exe
  2⤵
  PID:7608
- C:\Windows\System\QizwQrw.exe
  C:\Windows\System\QizwQrw.exe
  2⤵
  PID:7312
- C:\Windows\System\YmblueO.exe
  C:\Windows\System\YmblueO.exe
  2⤵
  PID:3816
- C:\Windows\System\sTEdPAw.exe
  C:\Windows\System\sTEdPAw.exe
  2⤵
  PID:6612
- C:\Windows\System\lrUDWOU.exe
  C:\Windows\System\lrUDWOU.exe
  2⤵
  PID:7780
- C:\Windows\System\Zrrcert.exe
  C:\Windows\System\Zrrcert.exe
  2⤵
  PID:14580
- C:\Windows\System\PEwhqHo.exe
  C:\Windows\System\PEwhqHo.exe
  2⤵
  PID:7396
- C:\Windows\System\gGhzUrG.exe
  C:\Windows\System\gGhzUrG.exe
  2⤵
  PID:7704
- C:\Windows\System\nXRGLNf.exe
  C:\Windows\System\nXRGLNf.exe
  2⤵
  PID:7612
- C:\Windows\System\EDWRHUI.exe
  C:\Windows\System\EDWRHUI.exe
  2⤵
  PID:1516
- C:\Windows\System\orOllLH.exe
  C:\Windows\System\orOllLH.exe
  2⤵
  PID:5452
- C:\Windows\System\fxJLDPF.exe
  C:\Windows\System\fxJLDPF.exe
  2⤵
  PID:14376
- C:\Windows\System\IoypygB.exe
  C:\Windows\System\IoypygB.exe
  2⤵
  PID:14400
- C:\Windows\System\sSsrzBW.exe
  C:\Windows\System\sSsrzBW.exe
  2⤵
  PID:14432
- C:\Windows\System\OcbMchb.exe
  C:\Windows\System\OcbMchb.exe
  2⤵
  PID:14504
- C:\Windows\System\YEsgDmo.exe
  C:\Windows\System\YEsgDmo.exe
  2⤵
  PID:14544
- C:\Windows\System\xfRYGpp.exe
  C:\Windows\System\xfRYGpp.exe
  2⤵
  PID:8708
- C:\Windows\System\XgdvljX.exe
  C:\Windows\System\XgdvljX.exe
  2⤵
  PID:14612
- C:\Windows\System\DvFcKMF.exe
  C:\Windows\System\DvFcKMF.exe
  2⤵
  PID:14636
- C:\Windows\System\zNjcGkO.exe
  C:\Windows\System\zNjcGkO.exe
  2⤵
  PID:8772
- C:\Windows\System\ZLlHmQq.exe
  C:\Windows\System\ZLlHmQq.exe
  2⤵
  PID:9036
- C:\Windows\System\DTRNkYn.exe
  C:\Windows\System\DTRNkYn.exe
  2⤵
  PID:14484
- C:\Windows\System\szYBziI.exe
  C:\Windows\System\szYBziI.exe
  2⤵
  PID:14768
- C:\Windows\System\CECSHsi.exe
  C:\Windows\System\CECSHsi.exe
  2⤵
  PID:14968
- C:\Windows\System\TtIZNMY.exe
  C:\Windows\System\TtIZNMY.exe
  2⤵
  PID:8340
- C:\Windows\System\ZmbdmNL.exe
  C:\Windows\System\ZmbdmNL.exe
  2⤵
  PID:15284
- C:\Windows\System\uItvKfv.exe
  C:\Windows\System\uItvKfv.exe
  2⤵
  PID:8716
- C:\Windows\System\qSgGqWi.exe
  C:\Windows\System\qSgGqWi.exe
  2⤵
  PID:8636
- C:\Windows\System\eLEYZEA.exe
  C:\Windows\System\eLEYZEA.exe
  2⤵
  PID:2652
- C:\Windows\System\wbGyXwX.exe
  C:\Windows\System\wbGyXwX.exe
  2⤵
  PID:9040
- C:\Windows\System\WqSCxbk.exe
  C:\Windows\System\WqSCxbk.exe
  2⤵
  PID:8936
- C:\Windows\System\SHOfVGr.exe
  C:\Windows\System\SHOfVGr.exe
  2⤵
  PID:7232
- C:\Windows\System\cMDDLWd.exe
  C:\Windows\System\cMDDLWd.exe
  2⤵
  PID:8720
- C:\Windows\System\GlfMJDX.exe
  C:\Windows\System\GlfMJDX.exe
  2⤵
  PID:8884
- C:\Windows\System\ajhnSKK.exe
  C:\Windows\System\ajhnSKK.exe
  2⤵
  PID:15328
- C:\Windows\System\ZTpdOUj.exe
  C:\Windows\System\ZTpdOUj.exe
  2⤵
  PID:8896
- C:\Windows\System\bxyvVGv.exe
  C:\Windows\System\bxyvVGv.exe
  2⤵
  PID:9828
- C:\Windows\System\CCryuji.exe
  C:\Windows\System\CCryuji.exe
  2⤵
  PID:10124
- C:\Windows\System\NgsVURe.exe
  C:\Windows\System\NgsVURe.exe
  2⤵
  PID:7912
- C:\Windows\System\baxptwG.exe
  C:\Windows\System\baxptwG.exe
  2⤵
  PID:9620
- C:\Windows\System\fFIQVaS.exe
  C:\Windows\System\fFIQVaS.exe
  2⤵
  PID:15332
- C:\Windows\System\CrNRdzI.exe
  C:\Windows\System\CrNRdzI.exe
  2⤵
  PID:8232
- C:\Windows\System\MBUVpZV.exe
  C:\Windows\System\MBUVpZV.exe
  2⤵
  PID:6124
- C:\Windows\System\OBPepXy.exe
  C:\Windows\System\OBPepXy.exe
  2⤵
  PID:9164
- C:\Windows\System\slZKmOh.exe
  C:\Windows\System\slZKmOh.exe
  2⤵
  PID:14124
- C:\Windows\System\JTDutPl.exe
  C:\Windows\System\JTDutPl.exe
  2⤵
  PID:9944
- C:\Windows\System\gtBHuWo.exe
  C:\Windows\System\gtBHuWo.exe
  2⤵
  PID:9424
- C:\Windows\System\OQgvmAs.exe
  C:\Windows\System\OQgvmAs.exe
  2⤵
  PID:6060
- C:\Windows\System\BZrVdkl.exe
  C:\Windows\System\BZrVdkl.exe
  2⤵
  PID:10180
- C:\Windows\System\UNLeDpW.exe
  C:\Windows\System\UNLeDpW.exe
  2⤵
  PID:2832
- C:\Windows\System\viKzxWp.exe
  C:\Windows\System\viKzxWp.exe
  2⤵
  PID:13232
- C:\Windows\System\wlmSiJt.exe
  C:\Windows\System\wlmSiJt.exe
  2⤵
  PID:4652
- C:\Windows\System\CVOGtng.exe
  C:\Windows\System\CVOGtng.exe
  2⤵
  PID:9272
- C:\Windows\System\CtfPSrw.exe
  C:\Windows\System\CtfPSrw.exe
  2⤵
  PID:7172
- C:\Windows\System\sYpbEOt.exe
  C:\Windows\System\sYpbEOt.exe
  2⤵
  PID:6688
- C:\Windows\System\TbobXqL.exe
  C:\Windows\System\TbobXqL.exe
  2⤵
  PID:9924
- C:\Windows\System\WjsciRQ.exe
  C:\Windows\System\WjsciRQ.exe
  2⤵
  PID:13448
- C:\Windows\System\EpxwjyB.exe
  C:\Windows\System\EpxwjyB.exe
  2⤵
  PID:3548
- C:\Windows\System\lHWAfrE.exe
  C:\Windows\System\lHWAfrE.exe
  2⤵
  PID:6328
- C:\Windows\System\FSoauVc.exe
  C:\Windows\System\FSoauVc.exe
  2⤵
  PID:9296
- C:\Windows\System\diSTyEy.exe
  C:\Windows\System\diSTyEy.exe
  2⤵
  PID:9336
- C:\Windows\System\RxyyTmq.exe
  C:\Windows\System\RxyyTmq.exe
  2⤵
  PID:9664
- C:\Windows\System\iNwRCTg.exe
  C:\Windows\System\iNwRCTg.exe
  2⤵
  PID:7292
- C:\Windows\System\YreahIa.exe
  C:\Windows\System\YreahIa.exe
  2⤵
  PID:7660
- C:\Windows\System\mOBRkij.exe
  C:\Windows\System\mOBRkij.exe
  2⤵
  PID:8332
- C:\Windows\System\BIeTCHa.exe
  C:\Windows\System\BIeTCHa.exe
  2⤵
  PID:9320
- C:\Windows\System\DuOjzZf.exe
  C:\Windows\System\DuOjzZf.exe
  2⤵
  PID:8432
- C:\Windows\System\apPGQYs.exe
  C:\Windows\System\apPGQYs.exe
  2⤵
  PID:9360
- C:\Windows\System\YfIpupA.exe
  C:\Windows\System\YfIpupA.exe
  2⤵
  PID:8356
- C:\Windows\System\JHfOCMX.exe
  C:\Windows\System\JHfOCMX.exe
  2⤵
  PID:7432
- C:\Windows\System\ftUmndK.exe
  C:\Windows\System\ftUmndK.exe
  2⤵
  PID:12708
- C:\Windows\System\CyymBWl.exe
  C:\Windows\System\CyymBWl.exe
  2⤵
  PID:9948
- C:\Windows\System\ZceOHYG.exe
  C:\Windows\System\ZceOHYG.exe
  2⤵
  PID:5680
- C:\Windows\System\RrZJTmi.exe
  C:\Windows\System\RrZJTmi.exe
  2⤵
  PID:7176
- C:\Windows\System\uFTLihk.exe
  C:\Windows\System\uFTLihk.exe
  2⤵
  PID:6632
- C:\Windows\System\SeSDLXW.exe
  C:\Windows\System\SeSDLXW.exe
  2⤵
  PID:3244
- C:\Windows\System\QOlXokb.exe
  C:\Windows\System\QOlXokb.exe
  2⤵
  PID:8656
- C:\Windows\System\PFwWjVL.exe
  C:\Windows\System\PFwWjVL.exe
  2⤵
  PID:6264
- C:\Windows\System\tCmFdou.exe
  C:\Windows\System\tCmFdou.exe
  2⤵
  PID:14396
- C:\Windows\System\BJWWcTf.exe
  C:\Windows\System\BJWWcTf.exe
  2⤵
  PID:13296
- C:\Windows\System\CtVKKuv.exe
  C:\Windows\System\CtVKKuv.exe
  2⤵
  PID:10228
- C:\Windows\System\wglujpc.exe
  C:\Windows\System\wglujpc.exe
  2⤵
  PID:9080
- C:\Windows\System\QxTrbCm.exe
  C:\Windows\System\QxTrbCm.exe
  2⤵
  PID:9848
- C:\Windows\System\iSQMHAG.exe
  C:\Windows\System\iSQMHAG.exe
  2⤵
  PID:9684
- C:\Windows\System\wvddgnZ.exe
  C:\Windows\System\wvddgnZ.exe
  2⤵
  PID:14884
- C:\Windows\System\xkaIcqU.exe
  C:\Windows\System\xkaIcqU.exe
  2⤵
  PID:8724
- C:\Windows\System\HIAFhBL.exe
  C:\Windows\System\HIAFhBL.exe
  2⤵
  PID:14720
- C:\Windows\System\ZcJVwNl.exe
  C:\Windows\System\ZcJVwNl.exe
  2⤵
  PID:8572
- C:\Windows\System\kLxOnly.exe
  C:\Windows\System\kLxOnly.exe
  2⤵
  PID:9132
- C:\Windows\System\NUSeghn.exe
  C:\Windows\System\NUSeghn.exe
  2⤵
  PID:10316
- C:\Windows\System\RnzVPnc.exe
  C:\Windows\System\RnzVPnc.exe
  2⤵
  PID:15152
- C:\Windows\System\AMManDM.exe
  C:\Windows\System\AMManDM.exe
  2⤵
  PID:15336
- C:\Windows\System\XCDWXeW.exe
  C:\Windows\System\XCDWXeW.exe
  2⤵
  PID:14924
- C:\Windows\System\SauodAu.exe
  C:\Windows\System\SauodAu.exe
  2⤵
  PID:9048
- C:\Windows\System\ivreOKA.exe
  C:\Windows\System\ivreOKA.exe
  2⤵
  PID:12556
- C:\Windows\System\ZGGSCGq.exe
  C:\Windows\System\ZGGSCGq.exe
  2⤵
  PID:10336
- C:\Windows\System\VZUhiiG.exe
  C:\Windows\System\VZUhiiG.exe
  2⤵
  PID:9604
- C:\Windows\System\NmqArSK.exe
  C:\Windows\System\NmqArSK.exe
  2⤵
  PID:15124
- C:\Windows\System\DsLBmEm.exe
  C:\Windows\System\DsLBmEm.exe
  2⤵
  PID:9136
- C:\Windows\System\ICythOp.exe
  C:\Windows\System\ICythOp.exe
  2⤵
  PID:15312
- C:\Windows\System\IvQasrm.exe
  C:\Windows\System\IvQasrm.exe
  2⤵
  PID:10556
- C:\Windows\System\vicfjwJ.exe
  C:\Windows\System\vicfjwJ.exe
  2⤵
  PID:6732
- C:\Windows\System\kYAwFHY.exe
  C:\Windows\System\kYAwFHY.exe
  2⤵
  PID:11000
- C:\Windows\System\FmzaPdu.exe
  C:\Windows\System\FmzaPdu.exe
  2⤵
  PID:10976
- C:\Windows\System\lDSzing.exe
  C:\Windows\System\lDSzing.exe
  2⤵
  PID:10104
- C:\Windows\System\IhOUbns.exe
  C:\Windows\System\IhOUbns.exe
  2⤵
  PID:6412
- C:\Windows\System\OjJNTAU.exe
  C:\Windows\System\OjJNTAU.exe
  2⤵
  PID:7392
- C:\Windows\System\EyLPdyj.exe
  C:\Windows\System\EyLPdyj.exe
  2⤵
  PID:12168
- C:\Windows\System\setqVPh.exe
  C:\Windows\System\setqVPh.exe
  2⤵
  PID:10236
- C:\Windows\System\RbyZkpl.exe
  C:\Windows\System\RbyZkpl.exe
  2⤵
  PID:8856
- C:\Windows\System\EvBjZfW.exe
  C:\Windows\System\EvBjZfW.exe
  2⤵
  PID:8120
- C:\Windows\System\gToxdPJ.exe
  C:\Windows\System\gToxdPJ.exe
  2⤵
  PID:7200
- C:\Windows\System\tHjvdxQ.exe
  C:\Windows\System\tHjvdxQ.exe
  2⤵
  PID:4124
- C:\Windows\System\YcrPQbg.exe
  C:\Windows\System\YcrPQbg.exe
  2⤵
  PID:6456
- C:\Windows\System\uRWjZbu.exe
  C:\Windows\System\uRWjZbu.exe
  2⤵
  PID:7372
- C:\Windows\System\YLoWNDw.exe
  C:\Windows\System\YLoWNDw.exe
  2⤵
  PID:10656
- C:\Windows\System\DSFcfxa.exe
  C:\Windows\System\DSFcfxa.exe
  2⤵
  PID:12692
- C:\Windows\System\YCJQXmP.exe
  C:\Windows\System\YCJQXmP.exe
  2⤵
  PID:8548
- C:\Windows\System\ickBLZN.exe
  C:\Windows\System\ickBLZN.exe
  2⤵
  PID:7896
- C:\Windows\System\GETsFHb.exe
  C:\Windows\System\GETsFHb.exe
  2⤵
  PID:6648
- C:\Windows\System\ECyQiPs.exe
  C:\Windows\System\ECyQiPs.exe
  2⤵
  PID:9308
- C:\Windows\System\prugfYT.exe
  C:\Windows\System\prugfYT.exe
  2⤵
  PID:7072
- C:\Windows\System\RqZxdnT.exe
  C:\Windows\System\RqZxdnT.exe
  2⤵
  PID:14576
- C:\Windows\System\uXrLKCq.exe
  C:\Windows\System\uXrLKCq.exe
  2⤵
  PID:2472
- C:\Windows\System\qgnLYzq.exe
  C:\Windows\System\qgnLYzq.exe
  2⤵
  PID:8704
- C:\Windows\System\GpVcIxl.exe
  C:\Windows\System\GpVcIxl.exe
  2⤵
  PID:2868
- C:\Windows\System\zbKsxrP.exe
  C:\Windows\System\zbKsxrP.exe
  2⤵
  PID:7132
- C:\Windows\System\AkFAtet.exe
  C:\Windows\System\AkFAtet.exe
  2⤵
  PID:8252
- C:\Windows\System\WGhpMRC.exe
  C:\Windows\System\WGhpMRC.exe
  2⤵
  PID:10936
- C:\Windows\System\bHXvxaG.exe
  C:\Windows\System\bHXvxaG.exe
  2⤵
  PID:10672
- C:\Windows\System\yaDCirf.exe
  C:\Windows\System\yaDCirf.exe
  2⤵
  PID:13208
- C:\Windows\System\asGWxsJ.exe
  C:\Windows\System\asGWxsJ.exe
  2⤵
  PID:9800
- C:\Windows\System\rWYBXtL.exe
  C:\Windows\System\rWYBXtL.exe
  2⤵
  PID:9752
- C:\Windows\System\uHguVDY.exe
  C:\Windows\System\uHguVDY.exe
  2⤵
  PID:13656
- C:\Windows\System\RgAywaN.exe
  C:\Windows\System\RgAywaN.exe
  2⤵
  PID:13644
- C:\Windows\System\ctRhEPj.exe
  C:\Windows\System\ctRhEPj.exe
  2⤵
  PID:8952
- C:\Windows\System\ELlQPiT.exe
  C:\Windows\System\ELlQPiT.exe
  2⤵
  PID:3392
- C:\Windows\System\IZEEbQZ.exe
  C:\Windows\System\IZEEbQZ.exe
  2⤵
  PID:4420
- C:\Windows\System\drWphdx.exe
  C:\Windows\System\drWphdx.exe
  2⤵
  PID:8484
- C:\Windows\System\wVWKiiI.exe
  C:\Windows\System\wVWKiiI.exe
  2⤵
  PID:10348
- C:\Windows\System\AvElwiV.exe
  C:\Windows\System\AvElwiV.exe
  2⤵
  PID:9768
- C:\Windows\System\JzpZszH.exe
  C:\Windows\System\JzpZszH.exe
  2⤵
  PID:11160
- C:\Windows\System\SpAViir.exe
  C:\Windows\System\SpAViir.exe
  2⤵
  PID:10792
- C:\Windows\System\RqcwmJE.exe
  C:\Windows\System\RqcwmJE.exe
  2⤵
  PID:6888
- C:\Windows\System\FdstjaT.exe
  C:\Windows\System\FdstjaT.exe
  2⤵
  PID:13924
- C:\Windows\System\fOIBgze.exe
  C:\Windows\System\fOIBgze.exe
  2⤵
  PID:4536
- C:\Windows\System\KmiHLVn.exe
  C:\Windows\System\KmiHLVn.exe
  2⤵
  PID:11584
- C:\Windows\System\QZITMEj.exe
  C:\Windows\System\QZITMEj.exe
  2⤵
  PID:10580
- C:\Windows\System\XfaIpsj.exe
  C:\Windows\System\XfaIpsj.exe
  2⤵
  PID:4028
- C:\Windows\System\fUBHeiR.exe
  C:\Windows\System\fUBHeiR.exe
  2⤵
  PID:10016
- C:\Windows\System\HPygkAP.exe
  C:\Windows\System\HPygkAP.exe
  2⤵
  PID:8160
- C:\Windows\System\pBYUCjq.exe
  C:\Windows\System\pBYUCjq.exe
  2⤵
  PID:11156
- C:\Windows\System\MnItMtR.exe
  C:\Windows\System\MnItMtR.exe
  2⤵
  PID:11500
- C:\Windows\System\ovkafYZ.exe
  C:\Windows\System\ovkafYZ.exe
  2⤵
  PID:11260
- C:\Windows\System\tGLUOYF.exe
  C:\Windows\System\tGLUOYF.exe
  2⤵
  PID:11572
- C:\Windows\System\UbWhUTP.exe
  C:\Windows\System\UbWhUTP.exe
  2⤵
  PID:9968
- C:\Windows\System\AooNyyX.exe
  C:\Windows\System\AooNyyX.exe
  2⤵
  PID:15376
- C:\Windows\System\pozfJKF.exe
  C:\Windows\System\pozfJKF.exe
  2⤵
  PID:15408
- C:\Windows\System\FhzAvQV.exe
  C:\Windows\System\FhzAvQV.exe
  2⤵
  PID:15600
- C:\Windows\System\HIXFlyZ.exe
  C:\Windows\System\HIXFlyZ.exe
  2⤵
  PID:15624
- C:\Windows\System\BXsbiJh.exe
  C:\Windows\System\BXsbiJh.exe
  2⤵
  PID:15648
- C:\Windows\System\iwHqKdW.exe
  C:\Windows\System\iwHqKdW.exe
  2⤵
  PID:15672
- C:\Windows\System\IWTZfcx.exe
  C:\Windows\System\IWTZfcx.exe
  2⤵
  PID:15708
- C:\Windows\System\kqGsUkV.exe
  C:\Windows\System\kqGsUkV.exe
  2⤵
  PID:15960
- C:\Windows\System\xsUSNmN.exe
  C:\Windows\System\xsUSNmN.exe
  2⤵
  PID:15980
- C:\Windows\System\oCiBbcE.exe
  C:\Windows\System\oCiBbcE.exe
  2⤵
  PID:16004
- C:\Windows\System\utTUuwk.exe
  C:\Windows\System\utTUuwk.exe
  2⤵
  PID:16028
- C:\Windows\System\kBGfkGK.exe
  C:\Windows\System\kBGfkGK.exe
  2⤵
  PID:16056
- C:\Windows\System\STvVUbT.exe
  C:\Windows\System\STvVUbT.exe
  2⤵
  PID:16080
- C:\Windows\System\sfCOmXW.exe
  C:\Windows\System\sfCOmXW.exe
  2⤵
  PID:16100
- C:\Windows\System\pAYLjBi.exe
  C:\Windows\System\pAYLjBi.exe
  2⤵
  PID:16116
- C:\Windows\System\JnurgCt.exe
  C:\Windows\System\JnurgCt.exe
  2⤵
  PID:16136
- C:\Windows\System\IohTFSv.exe
  C:\Windows\System\IohTFSv.exe
  2⤵
  PID:16164
- C:\Windows\System\KgNhVeB.exe
  C:\Windows\System\KgNhVeB.exe
  2⤵
  PID:16188
- C:\Windows\System\qfxKsTJ.exe
  C:\Windows\System\qfxKsTJ.exe
  2⤵
  PID:16216
- C:\Windows\System\vOmXHEj.exe
  C:\Windows\System\vOmXHEj.exe
  2⤵
  PID:16240
- C:\Windows\System\YWeQOQc.exe
  C:\Windows\System\YWeQOQc.exe
  2⤵
  PID:16268
- C:\Windows\System\uptvyVL.exe
  C:\Windows\System\uptvyVL.exe
  2⤵
  PID:16288
- C:\Windows\System\GtMUgJW.exe
  C:\Windows\System\GtMUgJW.exe
  2⤵
  PID:16312
- C:\Windows\System\mbiQkZg.exe
  C:\Windows\System\mbiQkZg.exe
  2⤵
  PID:16336
- C:\Windows\System\YgsHSMI.exe
  C:\Windows\System\YgsHSMI.exe
  2⤵
  PID:14036
- C:\Windows\System\CPcGzzl.exe
  C:\Windows\System\CPcGzzl.exe
  2⤵
  PID:9552
- C:\Windows\System\WWlulTB.exe
  C:\Windows\System\WWlulTB.exe
  2⤵
  PID:11036
- C:\Windows\System\akAhMGG.exe
  C:\Windows\System\akAhMGG.exe
  2⤵
  PID:10960
- C:\Windows\System\EnzLGhm.exe
  C:\Windows\System\EnzLGhm.exe
  2⤵
  PID:9096
- C:\Windows\System\JbqTbaL.exe
  C:\Windows\System\JbqTbaL.exe
  2⤵
  PID:10664
- C:\Windows\System\VZtmRNR.exe
  C:\Windows\System\VZtmRNR.exe
  2⤵
  PID:12020
- C:\Windows\System\RpJrPyy.exe
  C:\Windows\System\RpJrPyy.exe
  2⤵
  PID:12072
- C:\Windows\System\ruQoMTd.exe
  C:\Windows\System\ruQoMTd.exe
  2⤵
  PID:12140
- C:\Windows\System\zuJLUGn.exe
  C:\Windows\System\zuJLUGn.exe
  2⤵
  PID:11640
- C:\Windows\System\LmApgbi.exe
  C:\Windows\System\LmApgbi.exe
  2⤵
  PID:11092
- C:\Windows\System\dsdojqK.exe
  C:\Windows\System\dsdojqK.exe
  2⤵
  PID:10260
- C:\Windows\System\VXpDvkV.exe
  C:\Windows\System\VXpDvkV.exe
  2⤵
  PID:4704
- C:\Windows\System\bhZLzhK.exe
  C:\Windows\System\bhZLzhK.exe
  2⤵
  PID:11292
- C:\Windows\System\KRlebmu.exe
  C:\Windows\System\KRlebmu.exe
  2⤵
  PID:15440
- C:\Windows\System\ERzhyLP.exe
  C:\Windows\System\ERzhyLP.exe
  2⤵
  PID:4456
- C:\Windows\System\DdeRzTx.exe
  C:\Windows\System\DdeRzTx.exe
  2⤵
  PID:4468
- C:\Windows\System\XXaZuro.exe
  C:\Windows\System\XXaZuro.exe
  2⤵
  PID:3896
- C:\Windows\System\eICMaEJ.exe
  C:\Windows\System\eICMaEJ.exe
  2⤵
  PID:13396
- C:\Windows\System\DUghGKs.exe
  C:\Windows\System\DUghGKs.exe
  2⤵
  PID:5684
- C:\Windows\System\iLsJKcd.exe
  C:\Windows\System\iLsJKcd.exe
  2⤵
  PID:11132
- C:\Windows\System\hEKebth.exe
  C:\Windows\System\hEKebth.exe
  2⤵
  PID:8768
- C:\Windows\System\HEJdOOY.exe
  C:\Windows\System\HEJdOOY.exe
  2⤵
  PID:15476
- C:\Windows\System\fZRASFv.exe
  C:\Windows\System\fZRASFv.exe
  2⤵
  PID:15492
- C:\Windows\System\sMJYGuV.exe
  C:\Windows\System\sMJYGuV.exe
  2⤵
  PID:12200
- C:\Windows\System\UNjBEOS.exe
  C:\Windows\System\UNjBEOS.exe
  2⤵
  PID:6300
- C:\Windows\System\MShTrQB.exe
  C:\Windows\System\MShTrQB.exe
  2⤵
  PID:10820
- C:\Windows\System\COkyjVV.exe
  C:\Windows\System\COkyjVV.exe
  2⤵
  PID:8700
- C:\Windows\System\qrPnTdw.exe
  C:\Windows\System\qrPnTdw.exe
  2⤵
  PID:12164
- C:\Windows\System\wlWKKZq.exe
  C:\Windows\System\wlWKKZq.exe
  2⤵
  PID:7416
- C:\Windows\System\vcDgEPq.exe
  C:\Windows\System\vcDgEPq.exe
  2⤵
  PID:10624
- C:\Windows\System\bVvUVnq.exe
  C:\Windows\System\bVvUVnq.exe
  2⤵
  PID:15392
- C:\Windows\System\DmsnbCU.exe
  C:\Windows\System\DmsnbCU.exe
  2⤵
  PID:11308
- C:\Windows\System\dNYLWoR.exe
  C:\Windows\System\dNYLWoR.exe
  2⤵
  PID:11432
- C:\Windows\System\eYPmKOo.exe
  C:\Windows\System\eYPmKOo.exe
  2⤵
  PID:10916
- C:\Windows\System\AlBUvbb.exe
  C:\Windows\System\AlBUvbb.exe
  2⤵
  PID:13176
- C:\Windows\System\JFjnqhV.exe
  C:\Windows\System\JFjnqhV.exe
  2⤵
  PID:11768
- C:\Windows\System\EUicVUr.exe
  C:\Windows\System\EUicVUr.exe
  2⤵
  PID:14800
- C:\Windows\System\sUXUXyc.exe
  C:\Windows\System\sUXUXyc.exe
  2⤵
  PID:10720
- C:\Windows\System\CcouUfX.exe
  C:\Windows\System\CcouUfX.exe
  2⤵
  PID:14708
- C:\Windows\System\Vymwbzr.exe
  C:\Windows\System\Vymwbzr.exe
  2⤵
  PID:10296
- C:\Windows\System\sOaiIZz.exe
  C:\Windows\System\sOaiIZz.exe
  2⤵
  PID:10132
- C:\Windows\System\FxaBQxL.exe
  C:\Windows\System\FxaBQxL.exe
  2⤵
  PID:15536
- C:\Windows\System\iSVVHdm.exe
  C:\Windows\System\iSVVHdm.exe
  2⤵
  PID:15552
- C:\Windows\System\DznDJnp.exe
  C:\Windows\System\DznDJnp.exe
  2⤵
  PID:7264
- C:\Windows\System\ScQSpMS.exe
  C:\Windows\System\ScQSpMS.exe
  2⤵
  PID:15580
- C:\Windows\System\GLftHms.exe
  C:\Windows\System\GLftHms.exe
  2⤵
  PID:11020
- C:\Windows\System\DoNSTpJ.exe
  C:\Windows\System\DoNSTpJ.exe
  2⤵
  PID:10856
- C:\Windows\System\fBMmYXn.exe
  C:\Windows\System\fBMmYXn.exe
  2⤵
  PID:15968
- C:\Windows\System\JdkzNdB.exe
  C:\Windows\System\JdkzNdB.exe
  2⤵
  PID:11560
- C:\Windows\System\ZFtEUpQ.exe
  C:\Windows\System\ZFtEUpQ.exe
  2⤵
  PID:16148
- C:\Windows\System\eXbxSCU.exe
  C:\Windows\System\eXbxSCU.exe
  2⤵
  PID:16296
- C:\Windows\System\xUchOmc.exe
  C:\Windows\System\xUchOmc.exe
  2⤵
  PID:4020
- C:\Windows\System\eoijcaA.exe
  C:\Windows\System\eoijcaA.exe
  2⤵
  PID:608
- C:\Windows\System\EiEMqnP.exe
  C:\Windows\System\EiEMqnP.exe
  2⤵
  PID:15908
- C:\Windows\System\nnlaEVF.exe
  C:\Windows\System\nnlaEVF.exe
  2⤵
  PID:15664
- C:\Windows\System\UcOZQSN.exe
  C:\Windows\System\UcOZQSN.exe
  2⤵
  PID:15720
- C:\Windows\System\bsaCLwr.exe
  C:\Windows\System\bsaCLwr.exe
  2⤵
  PID:15976
- C:\Windows\System\KJQDDri.exe
  C:\Windows\System\KJQDDri.exe
  2⤵
  PID:15748
- C:\Windows\System\KUwuXHT.exe
  C:\Windows\System\KUwuXHT.exe
  2⤵
  PID:15764
- C:\Windows\System\QWXwPki.exe
  C:\Windows\System\QWXwPki.exe
  2⤵
  PID:16128
- C:\Windows\System\ebWpAbD.exe
  C:\Windows\System\ebWpAbD.exe
  2⤵
  PID:11472
- C:\Windows\System\NLrVMlK.exe
  C:\Windows\System\NLrVMlK.exe
  2⤵
  PID:16224
- C:\Windows\System\LcPQvSV.exe
  C:\Windows\System\LcPQvSV.exe
  2⤵
  PID:16320
- C:\Windows\System\eRxOQRo.exe
  C:\Windows\System\eRxOQRo.exe
  2⤵
  PID:15828
- C:\Windows\System\czckkZf.exe
  C:\Windows\System\czckkZf.exe
  2⤵
  PID:7828
- C:\Windows\System\gFeBkxH.exe
  C:\Windows\System\gFeBkxH.exe
  2⤵
  PID:15884
- C:\Windows\System\xHZLenU.exe
  C:\Windows\System\xHZLenU.exe
  2⤵
  PID:9656
- C:\Windows\System\utLUOTY.exe
  C:\Windows\System\utLUOTY.exe
  2⤵
  PID:11696
- C:\Windows\System\CdNUEnA.exe
  C:\Windows\System\CdNUEnA.exe
  2⤵
  PID:12864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1428 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
1⤵
PID:12248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_15rk2ayg.cqu.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BiUSdoa.exe

Filesize
2.2MB

MD5
7b5811e665668f792aee2d3ce8dc1634

SHA1
05c1f2b9248277cfaebface56a531d6e2a270347

SHA256
67a69d088a0ed95911d47291b7fee9ded7910fae74f81033c9e40089b5ec7872

SHA512
05bccc14dc23899dfbc4ae1c8e074b114aa109d118b70d20d7e5a62c115662a2d776e89a0ccb2399c16bc7b206431680586a6efba82af804a4ee3b4a4265112a

Download Submit
C:\Windows\System\BqndqJc.exe

Filesize
2.2MB

MD5
4144e8f70c146f19c18ce76bad1e0653

SHA1
8ee70698c6ab886d1261197492ad7cdda60cfc14

SHA256
2d1bb811445f9fc8a7d09f41562367afbc75eaa6bdbeb49b2478eb742ee126b8

SHA512
dd23b26ece1b4e9f39b94da17b7ad211367db126aeb73a00a0cbe30590b01cebd9de1538dce62070ba0fe2b74bd127f0c3c34f5ce60e51b0ac5477ae9cc8c1a9

Download Submit
C:\Windows\System\DZdASpd.exe

Filesize
2.2MB

MD5
2472c23dd88341527d1a070183badc30

SHA1
c907efdb6e222d3a5a52d75cdd118d90399d6327

SHA256
21f842523fa3d2c8f7fddab64ad657f59b3d34e8d88be978e16803e736fc9761

SHA512
992b632b22b9fc5dcf820d6829714d106bee06d002c89a5db48b1dbf7efb14011740a1a0973ea55eb02c1b9acc1f81e977d17293dd8e12315bbdba6a6f4c4417

Download Submit
C:\Windows\System\DgnkNex.exe

Filesize
2.2MB

MD5
0eb28c9d5d4d7a95ee12d28731e6fbe9

SHA1
cd88827f6b56cf7e4e45f5fa5491cc26776dcd2d

SHA256
6e9cfb607e73c5bcbc9ffe280a24d87cee6c0d1970b31d2dc4082bbbc87fd7dc

SHA512
2e1a3546f2f177b7c7c64a7ec08971735a49c1300f8e75a6af360010dd9cefe65012c2b6742f3a5863e838643ad7d305a51af3a58e09f6fcf293d7bd89dab403

Download Submit
C:\Windows\System\DjhQdbY.exe

Filesize
2.2MB

MD5
b2df27f0249a7a4675311fd42ca4a48f

SHA1
a994f8321c0ae80d921f68008c0c0f842b1ec167

SHA256
6b7b26c794fec9ce7ab38ffc66fbbda8f41eac0253de59eb455bd319a2f67b19

SHA512
e7a552a7508e911481b14e88b5ab2e5d833577e88caee52e4adf2adc2db1a8299566bcb7a190890fd6d6aaa6865f8fd71ed0cbb32b93c4e0d04e9126976079bd

Download Submit
C:\Windows\System\FcCKCRz.exe

Filesize
2.2MB

MD5
034dcb613a218822254bf32c9de69426

SHA1
a52fe552da7a158d76ad8f9f2a48fb8bf909a626

SHA256
93230c0609798da9f89a54eaed6e2e9a85be4a890f4c21991173c8e74bf82c51

SHA512
9bb7e02db9c2b115cc8e22d2e3f0c7b2d9ec9534e8ebe707eda93801eaf45402562c8b9cf2df296e82adf0a56c0c3547e1d14a7b3f8e7d20833133b883c2e4b9

Download Submit
C:\Windows\System\FfcKosc.exe

Filesize
2.2MB

MD5
32051179c9e3e1635c82888f11fe1047

SHA1
0552f299a63e05f9a51dab850460d073b8eba4dd

SHA256
dc15e9e43dc5ab67dfa633ad36efff7a66dd49c7ec88729d583655ece8947d29

SHA512
d67c950597657f2713bf4bfc058c0b2a08fcd509e9dc63037ef6a6a60f31167220db60800b36b0971fb99fd04e976dd1e31704d8984de3a1d682ba46600bbd38

Download Submit
C:\Windows\System\GOFYMRy.exe

Filesize
2.2MB

MD5
ffc578f83275f7b2a823fcf2859a490b

SHA1
8a82368c10ae5a4ace52c5d24a12350824880e42

SHA256
fa25ce1a88de73f98fddde8cc483debca131df36eb82c4295ba6f1bc9160843a

SHA512
dcc44c48ff71be9108a39f4e6d0ef90c2d66fe5540e33aeb61f6027488569014684c5b920683344e178f26cb3ded84ecb181a6c4c6fdbdee6b78e4a326e9ecf5

Download Submit
C:\Windows\System\HuKohRL.exe

Filesize
2.2MB

MD5
8bbd136ea65cbca68b4ff5fc54600414

SHA1
a8161b328cae8ea9b6a23a7b588cdba314af6465

SHA256
482d7ce461748bfd57b34f30f68f855f467c9a52f5c213520865233155e5292a

SHA512
431631625a34126c5dddd87b12bb3cf1d61c6cec0be9c70318517cbbaec7a42f11ec6026b0db2e08601c63a32f8ad08dc77cee8e55ebba4962a326b438fe66a2

Download Submit
C:\Windows\System\JZAAfrY.exe

Filesize
2.2MB

MD5
35e854ad053f6ac2b9167b9fb095b6f9

SHA1
dbd33efd46e68f3aaa86e93805e0e291043760e2

SHA256
ac699ebf1125045e3269f22f053f79187af2df14ebdbb43ff2c97a985543af00

SHA512
beb15e6e3d8f550448388f43079b60e2769254327e7fc640f9310ced81e3985f633143145321c00645e402d15afb6922870a9e4ac189c0d487c7ad97bae36916

Download Submit
C:\Windows\System\JaBsZFu.exe

Filesize
2.2MB

MD5
dbbdf35ab308b74378646c5896eb8267

SHA1
a2321438e25e9e56fe24144460e7d75484e2329a

SHA256
263101b745dc16cb155bb4f825a1ba5d0dd6be9a6b5c8e7082821b81e34df52d

SHA512
f876d92e50f430aac885eecf6771679bf1322a892c56275d1a80fa9105e1430910f968dfad1c55aba10c2a787eafd8220a4e766210a6385b680a4fdd045f8ab3

Download Submit
C:\Windows\System\KFFHukS.exe

Filesize
2.2MB

MD5
d5fb309b8b9d63634f44a19159efd3c6

SHA1
ca42167da8826185dc291fca0db391f6b930053f

SHA256
d5ea6ef1a77d9d366ac3e5bd0233f8e8416b2e805eb8f49c2959a3143b934821

SHA512
b6e921751c30ac4db414c81ccbb9290e111011fea8e0f1126fab1c3b9550cf18b74e5ad3fc7cd9e03b0cc1bf7c0c0bb004da2e202c9b9e146d8a54d6aae1610a

Download Submit
C:\Windows\System\LpQNzwb.exe

Filesize
2.2MB

MD5
5e753d3e8f827e3b7fccdbcb72b495d1

SHA1
a617eed5b1685eaa9efbbfd1ec345f3aba3362f8

SHA256
deaed35734c213cb481b7252ded39bbc2e98b67e38b8187adf8d954b974d1efc

SHA512
fdab9e2a7bd863b0c5a6deebcf3be7254e7b28208c0b7cf7f92a8b7b3b3de852f4cca6ee7458557ca0b02183fe3759fb2a3a7046e5d5f8eef90c6ca3b1866e4e

Download Submit
C:\Windows\System\MkRWSdC.exe

Filesize
2.2MB

MD5
6cca0db47f2238e140388bb5d4d0255f

SHA1
0a8d1a4e0c2695ac442825ad2d6a2803b0bc8d12

SHA256
5d3475b99525cc17f51102dc63f072af35d986d7e09bcefa57d93ba5a8a16419

SHA512
7f75b4e2265fbd7943b5627279c4921954bfe0a1eb5cb28a3ba504b8c6d85c0342a3cfd6ad22deec120dd0efd5dffa8e207eca324f17fcc15b90db1d743d7f65

Download Submit
C:\Windows\System\NHAFhvw.exe

Filesize
2.2MB

MD5
6300086fa87134464161c11b2eb36353

SHA1
1336d8c6387e37c4ba1e9e0c958d0ad16244859e

SHA256
04db4bd5367efd68b1baf057eebcc7da0a41131b25a38d803b115c37e91fb00d

SHA512
62fc4b61daa65e6fb2d3f67c8fafce02081f83f44f5766925657bd6245b524fe40cb65ce89ec06aeae3c044ad28b4de9c29b49f37cb8b97bbce56caa5d582938

Download Submit
C:\Windows\System\QOcIfbo.exe

Filesize
2.2MB

MD5
b2d1484d5daaeb54bb4b20054ba30ce0

SHA1
937e0dd4367236eb37b8cb40bacfd99b7075fc44

SHA256
e8ba3837ecb15d4f597653992c2a22399601aace274867bb8368e5c2d0702b2f

SHA512
2a76f8927f725f1507771ca2e297f6cb6b1b3b257c561de1a50b57dc404de1916b21a3688d739c073174b1eb0498cecefcced05f6ccb4019f20e7a8af72a6f07

Download Submit
C:\Windows\System\RGTrErG.exe

Filesize
2.2MB

MD5
673ca10ed866f6d3727aea007875de6c

SHA1
0e6313b47c9e73a717978ca5248ee8e98b4d79a4

SHA256
743b3fa2475ce1a28226d291e3ebadb692f60a13f6e3c5020bc186d3cccf3aa9

SHA512
d54a7f3f1bbd680738d7c73d35b2eca9dd148c3718f6309e273dc226acde4e9a9fe5b902c9256896d7a885d741c6ea0e41bf55f6f0f121981f2280a7cfeb2948

Download Submit
C:\Windows\System\RgiLqaI.exe

Filesize
2.2MB

MD5
92305537af51972667a95f6af2443b3b

SHA1
169fbe8bcd359a9ef6c5a9c4a2fd8547ba1afe03

SHA256
55d38576ecaf715f9b67918fbd6ef1b268d0541af95326b9f917fdbb7c417179

SHA512
ecae86c302eecf20369a59b9a03739677dd4d98b2390acf085e9ab39e1dcbe3248cefba73777822da1a5ee86d64711f0059806e0b17c5610de1cfa128f65b7f7

Download Submit
C:\Windows\System\SRbWcDp.exe

Filesize
2.2MB

MD5
a294688a89dfecad93c302f5be1d5c48

SHA1
e7e9d49623cc877c5fe1f17896d5d8a3c5f111f1

SHA256
11fd3ba9c25de6a7cc76d6238398c2e4504652a0685612d6f9bf9201a1a643a8

SHA512
f20de681a0bb850b810df2bb47fa539ae1f2edcebbed10afa3345ddcf97c479fd38a72a94b7b31bd6fabfec30f37e47bda02a5a48a8fd52da2b61f0aeb8030a8

Download Submit
C:\Windows\System\WGXOaey.exe

Filesize
2.2MB

MD5
36c08c1df810904e534b03b8639c1310

SHA1
705e291f1d13c90627c75c07e6f922946356d5eb

SHA256
71903b9fcf489e87f574713ba54b3900baf528515117f961c85c9b4c1ee5dc3c

SHA512
a85df8c3633cd8c7100c0d3267c2bdbc1b070f2981ab1e3748ef4265a2d71825e326f7ed24f342e6e523920e33ae963adc41d738a6c359eb99716f149304ef90

Download Submit
C:\Windows\System\WMbTBew.exe

Filesize
2.2MB

MD5
0e29833ee0b08248df920d28c8bd185c

SHA1
96b8cddcdb5712e90bd898241b52b578336e8938

SHA256
dda23415c48144e7f57053bd6c069dc77ad19c46d56ebe85b08799454c4ab421

SHA512
0929f0529d3a411b7d330a4bd39426d22eb7a26a1e77b981d027d22dab378743f69bebb120fea52caa28b617cb1395bc82ffe83e79e1cdd28f79488723ffce93

Download Submit
C:\Windows\System\YCNBSTc.exe

Filesize
2.2MB

MD5
1611a79dae76c1e233b94a85ee347dfd

SHA1
7c27041a9af51d52324637921675a6b6460b3ca9

SHA256
70882eb10aab75e11daed2a14c5995a85a059e32a023c2d3bb964c0c682a8522

SHA512
a878da2079254180d1a7f35c7da8b2cae17e2d99794f35d75188b5936f4b86131767c7d9204f1af4197c358ec2cdb3b6212cbd27f2c40e1b829bc5b76b9f1474

Download Submit
C:\Windows\System\hATkKCf.exe

Filesize
2.2MB

MD5
9cdf33607f39aacc6ce0780ddc699bb8

SHA1
176cd1a77b3a0bbb84946ced4d0d41dff720bd3c

SHA256
4a082458f747c43d1dfc1b23017c41f5714f9474ba768551c478604d0781c330

SHA512
15a9e938e0828e530f9770ca62d91747e4691364844220742f0fd3feb078ed3354d6190c954cc779df91c7d0c30fb57066dfc2745b16d04dae8573460bd9bdbe

Download Submit
C:\Windows\System\jwUjYNx.exe

Filesize
2.2MB

MD5
5156eead2d4c7cf0df7aa9c33f24668f

SHA1
16587e24b5c9f6c9de4765b6139a0bafbcf13044

SHA256
4dd198f87f1f5dead15f251d7641836331d59fec7dbda1f00a76acf1ce9fd983

SHA512
689f7773e29afb9fe00df8b07e86b9af81ccd7ef5fdc10d2d2bc27db1ae44856675fbd146d408d7853848af92bf2da2a339545dc1c298aa9549b9273c006bc37

Download Submit
C:\Windows\System\kBfkMFy.exe

Filesize
2.2MB

MD5
4fa2c3e731582fca45db766002f52024

SHA1
638633808457e40b243b66930238d5eae6e91518

SHA256
b47dbd375499a51159f08928322a338e6b90ae0d25a826a667b4d96734771ea1

SHA512
ef81d578dadef4cdcb8a0805a40c7c62cfdf26befa7283e599ea247552c6384961781aaa0e32021c2cf4cb474cd6eda92e84218243794f7478b7800e07af740a

Download Submit
C:\Windows\System\mnMCVFT.exe

Filesize
2.2MB

MD5
d551e8cf6f2e4ebedbaa6deece534bd8

SHA1
5a49f20209566939d4b071a542ae973ae6f626c7

SHA256
130286b22f28a3659aab6c0bb11a338f50976dcc88848dbc48755e075a12b7e8

SHA512
810b38a0abc14db4707469e6a7e7caf9b96086fcbce8d12c56d83e5e2b19ed6476cbef5616add729607a2d8eeb63c2324355f3783d2442c0a266461a41914525

Download Submit
C:\Windows\System\qGMedeO.exe

Filesize
2.2MB

MD5
b1af55df6b2472274be804beb3203160

SHA1
1c906528c9ea5ee0f97dc5a91fc2e07cfa1c6e3e

SHA256
8ff0a49e6e3937591f9467ac89de7cb54054104b56ad84cd540f72535269a649

SHA512
7ad1222fdc8ba852b5a490531ff54510527ca6d2150f546dd3d7d3a9f19f7ee0654648b052ef492157e8cec9129f46deea9d0b4ffc3660f744eef6992ee69862

Download Submit
C:\Windows\System\qSJZbXQ.exe

Filesize
2.2MB

MD5
8daaee84ee7a3aa73a88d5443dabbc14

SHA1
d54df70dff6f62f874d20b2b8409cb38b52af5de

SHA256
2c92a56f9c24972ac5a5a254d25ae34e9813c3f7a88a4c14968b58b4fe96a1f7

SHA512
2888092f904f507e60a3d2f78a8a156fe78d0da24f7a69e601c93e52b50f09aa926b73238d7c044a16f52ce35d73f6c1c208688d691dc0495de58ffdcc99a750

Download Submit
C:\Windows\System\qxRzudt.exe

Filesize
2.2MB

MD5
b23573793af22da505c9453f6982c287

SHA1
38463187bfcea5179507c9183d70d21a27c1e1bb

SHA256
cd0190fa80af3b26300fbe514a906912e3bfa8df44c2f8c73c206d7f33ef2b15

SHA512
92c06d07d8fbee8c9eccfaabfcbfb9f670f49b19687c1afe89b2e43a148ab11ded0379e74536e83a198580e3e19e7c1d5d799f96c67015e2449251209deb915b

Download Submit
C:\Windows\System\renGTkB.exe

Filesize
2.2MB

MD5
e100cf50d8d429cc693ea6b8b4fbb140

SHA1
588cda4b53afaaed0bfe513c7e2957745479321c

SHA256
cb99faad0b8bf5900c7035d71618c608eb7fea268fb0ecfb12528e0136f46ba5

SHA512
2d69f32d9fc37438a15318d7582e52acb5d051399a855518e8534342c665c4376656288adbf1044272e60f85aaa26b3e7328975afa3b19ace7c3b69924767063

Download Submit
C:\Windows\System\sgxGheC.exe

Filesize
2.2MB

MD5
844c18cebbe0c7b8b27ceba88381cb31

SHA1
60c14bd5d011b62c8dd4c22e9cfd256f9d104450

SHA256
f9c58408eccbd7229631d78b29954a8fd61428b8fce49974c6f42c169f7c3893

SHA512
20a393e96085cf6f1de7479c84e93943ad7a04aa99141c0e0fccd6a907747f9fbeb018bf7b97baf51317f888ae8c416713ff422e2d6f9b3ede09978c3c58b10f

Download Submit
C:\Windows\System\ymuSvRy.exe

Filesize
2.2MB

MD5
111eca3ae6dd9318aa91eb865ea11da1

SHA1
fd6ec05ccc715cf50cfa0cc174245fcf160ecdde

SHA256
a7bb23a58a34d35c27521f62e60952c8e7a150b603a90fd532d2987091fc7f12

SHA512
c34f41a52d0c754e3dd2307c26f7371dd1d467fef8cb0103ea2df82d77169759e743226a3b61b0d133cda627e191457e0f96aaccacd95851eed565f0605cadf3

Download Submit
memory/1028-443-0x00007FF788280000-0x00007FF788672000-memory.dmp

Filesize
3.9MB

Download
memory/1028-2029-0x00007FF788280000-0x00007FF788672000-memory.dmp

Filesize
3.9MB

Download
memory/1068-2033-0x00007FF72A8C0000-0x00007FF72ACB2000-memory.dmp

Filesize
3.9MB

Download
memory/1068-471-0x00007FF72A8C0000-0x00007FF72ACB2000-memory.dmp

Filesize
3.9MB

Download
memory/1436-1984-0x00007FF783180000-0x00007FF783572000-memory.dmp

Filesize
3.9MB

Download
memory/1436-54-0x00007FF783180000-0x00007FF783572000-memory.dmp

Filesize
3.9MB

Download
memory/1788-413-0x00007FF718A10000-0x00007FF718E02000-memory.dmp

Filesize
3.9MB

Download
memory/1788-2018-0x00007FF718A10000-0x00007FF718E02000-memory.dmp

Filesize
3.9MB

Download
memory/2232-103-0x00007FF79A9A0000-0x00007FF79AD92000-memory.dmp

Filesize
3.9MB

Download
memory/2232-2000-0x00007FF79A9A0000-0x00007FF79AD92000-memory.dmp

Filesize
3.9MB

Download
memory/2356-1986-0x00007FF7D49F0000-0x00007FF7D4DE2000-memory.dmp

Filesize
3.9MB

Download
memory/2356-113-0x00007FF7D49F0000-0x00007FF7D4DE2000-memory.dmp

Filesize
3.9MB

Download
memory/2396-1990-0x00007FF74CD00000-0x00007FF74D0F2000-memory.dmp

Filesize
3.9MB

Download
memory/2396-116-0x00007FF74CD00000-0x00007FF74D0F2000-memory.dmp

Filesize
3.9MB

Download
memory/2548-2020-0x00007FF752A50000-0x00007FF752E42000-memory.dmp

Filesize
3.9MB

Download
memory/2548-420-0x00007FF752A50000-0x00007FF752E42000-memory.dmp

Filesize
3.9MB

Download
memory/2684-28-0x00007FF77FBD0000-0x00007FF77FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2684-382-0x00007FF77FBD0000-0x00007FF77FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2684-1863-0x00007FF77FBD0000-0x00007FF77FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2696-2069-0x00007FF731250000-0x00007FF731642000-memory.dmp

Filesize
3.9MB

Download
memory/2696-551-0x00007FF731250000-0x00007FF731642000-memory.dmp

Filesize
3.9MB

Download
memory/2844-2037-0x00007FF79AB10000-0x00007FF79AF02000-memory.dmp

Filesize
3.9MB

Download
memory/2844-509-0x00007FF79AB10000-0x00007FF79AF02000-memory.dmp

Filesize
3.9MB

Download
memory/2900-2057-0x00007FF735180000-0x00007FF735572000-memory.dmp

Filesize
3.9MB

Download
memory/2900-546-0x00007FF735180000-0x00007FF735572000-memory.dmp

Filesize
3.9MB

Download
memory/3112-2003-0x00007FF7AFC90000-0x00007FF7B0082000-memory.dmp

Filesize
3.9MB

Download
memory/3112-100-0x00007FF7AFC90000-0x00007FF7B0082000-memory.dmp

Filesize
3.9MB

Download
memory/3196-1974-0x00007FF7F2BC0000-0x00007FF7F2FB2000-memory.dmp

Filesize
3.9MB

Download
memory/3196-61-0x00007FF7F2BC0000-0x00007FF7F2FB2000-memory.dmp

Filesize
3.9MB

Download
memory/3204-43-0x00007FF78E0D0000-0x00007FF78E4C2000-memory.dmp

Filesize
3.9MB

Download
memory/3204-1884-0x00007FF78E0D0000-0x00007FF78E4C2000-memory.dmp

Filesize
3.9MB

Download
memory/3220-8-0x00000206AC480000-0x00000206AC490000-memory.dmp

Filesize
64KB

Download
memory/3220-25-0x00000206AC430000-0x00000206AC452000-memory.dmp

Filesize
136KB

Download
memory/3220-27-0x00007FFAE3680000-0x00007FFAE4141000-memory.dmp

Filesize
10.8MB

Download
memory/3220-110-0x00007FFAE3680000-0x00007FFAE4141000-memory.dmp

Filesize
10.8MB

Download
memory/3220-275-0x00000206AFA00000-0x00000206B01A6000-memory.dmp

Filesize
7.6MB

Download
memory/3220-9-0x00007FFAE3683000-0x00007FFAE3685000-memory.dmp

Filesize
8KB

Download
memory/3488-85-0x00007FF78DCF0000-0x00007FF78E0E2000-memory.dmp

Filesize
3.9MB

Download
memory/3488-0-0x00007FF78DCF0000-0x00007FF78E0E2000-memory.dmp

Filesize
3.9MB

Download
memory/3488-1-0x00000253C0810000-0x00000253C0820000-memory.dmp

Filesize
64KB

Download
memory/3528-76-0x00007FF7F0670000-0x00007FF7F0A62000-memory.dmp

Filesize
3.9MB

Download
memory/3528-1963-0x00007FF7F0670000-0x00007FF7F0A62000-memory.dmp

Filesize
3.9MB

Download
memory/3688-7-0x00007FF6C3FC0000-0x00007FF6C43B2000-memory.dmp

Filesize
3.9MB

Download
memory/3688-1696-0x00007FF6C3FC0000-0x00007FF6C43B2000-memory.dmp

Filesize
3.9MB

Download
memory/3688-86-0x00007FF6C3FC0000-0x00007FF6C43B2000-memory.dmp

Filesize
3.9MB

Download
memory/3744-1972-0x00007FF75C520000-0x00007FF75C912000-memory.dmp

Filesize
3.9MB

Download
memory/3744-89-0x00007FF75C520000-0x00007FF75C912000-memory.dmp

Filesize
3.9MB

Download
memory/3924-80-0x00007FF7459D0000-0x00007FF745DC2000-memory.dmp

Filesize
3.9MB

Download
memory/3924-1973-0x00007FF7459D0000-0x00007FF745DC2000-memory.dmp

Filesize
3.9MB

Download
memory/4032-1692-0x00007FF7C3F60000-0x00007FF7C4352000-memory.dmp

Filesize
3.9MB

Download
memory/4032-29-0x00007FF7C3F60000-0x00007FF7C4352000-memory.dmp

Filesize
3.9MB

Download
memory/4584-1571-0x00007FF6431D0000-0x00007FF6435C2000-memory.dmp

Filesize
3.9MB

Download
memory/4584-42-0x00007FF6431D0000-0x00007FF6435C2000-memory.dmp

Filesize
3.9MB

Download
memory/4588-402-0x00007FF7D1EF0000-0x00007FF7D22E2000-memory.dmp

Filesize
3.9MB

Download
memory/4588-2019-0x00007FF7D1EF0000-0x00007FF7D22E2000-memory.dmp

Filesize
3.9MB

Download
memory/4628-1993-0x00007FF667730000-0x00007FF667B22000-memory.dmp

Filesize
3.9MB

Download
memory/4628-106-0x00007FF667730000-0x00007FF667B22000-memory.dmp

Filesize
3.9MB

Download
memory/4692-71-0x00007FF7B6E00000-0x00007FF7B71F2000-memory.dmp

Filesize
3.9MB

Download
memory/4692-1981-0x00007FF7B6E00000-0x00007FF7B71F2000-memory.dmp

Filesize
3.9MB

Download