xmrig | 8737674684000595f33b9bccacde0db7dc16013deaf023d0a782c8baf2509501

Analysis

max time kernel
151s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 10:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
Size

2.2MB
MD5

10466726947deaabb48419d6b5b653d7
SHA1

82a1fc0edca40f9fcef42e20023c38ef3e6c85de
SHA256

8737674684000595f33b9bccacde0db7dc16013deaf023d0a782c8baf2509501
SHA512

406355c276b808b27b8dba07dd5a75e5772e297543fb4804cf3f6cc4593bc4e37d91aab2ea684635dff74f1efc2180763b99f591fecb8f97b63460ddc1fe3ecc
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9cb6k:NABT

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 45 IoCs

miner

resource	yara_rule
behavioral2/memory/3940-192-0x00007FF6E9980000-0x00007FF6E9D72000-memory.dmp	xmrig
behavioral2/memory/832-201-0x00007FF7EE410000-0x00007FF7EE802000-memory.dmp	xmrig
behavioral2/memory/4624-211-0x00007FF6EAC30000-0x00007FF6EB022000-memory.dmp	xmrig
behavioral2/memory/2008-214-0x00007FF73BE90000-0x00007FF73C282000-memory.dmp	xmrig
behavioral2/memory/4444-225-0x00007FF70B6C0000-0x00007FF70BAB2000-memory.dmp	xmrig
behavioral2/memory/4916-1655-0x00007FF673E00000-0x00007FF6741F2000-memory.dmp	xmrig
behavioral2/memory/3500-1710-0x00007FF7906D0000-0x00007FF790AC2000-memory.dmp	xmrig
behavioral2/memory/2920-1768-0x00007FF6A9F20000-0x00007FF6AA312000-memory.dmp	xmrig
behavioral2/memory/1428-1769-0x00007FF76EEB0000-0x00007FF76F2A2000-memory.dmp	xmrig
behavioral2/memory/2008-1821-0x00007FF73BE90000-0x00007FF73C282000-memory.dmp	xmrig
behavioral2/memory/2296-1818-0x00007FF6ACBD0000-0x00007FF6ACFC2000-memory.dmp	xmrig
behavioral2/memory/2300-1815-0x00007FF6E8900000-0x00007FF6E8CF2000-memory.dmp	xmrig
behavioral2/memory/2440-1792-0x00007FF7FAA80000-0x00007FF7FAE72000-memory.dmp	xmrig
behavioral2/memory/3608-1789-0x00007FF620200000-0x00007FF6205F2000-memory.dmp	xmrig
behavioral2/memory/3900-1791-0x00007FF7D2E20000-0x00007FF7D3212000-memory.dmp	xmrig
behavioral2/memory/2316-1775-0x00007FF644970000-0x00007FF644D62000-memory.dmp	xmrig
behavioral2/memory/1988-1760-0x00007FF6349A0000-0x00007FF634D92000-memory.dmp	xmrig
behavioral2/memory/940-1847-0x00007FF75EA10000-0x00007FF75EE02000-memory.dmp	xmrig
behavioral2/memory/1968-1855-0x00007FF7BD740000-0x00007FF7BDB32000-memory.dmp	xmrig
behavioral2/memory/4444-1853-0x00007FF70B6C0000-0x00007FF70BAB2000-memory.dmp	xmrig
behavioral2/memory/832-1856-0x00007FF7EE410000-0x00007FF7EE802000-memory.dmp	xmrig
behavioral2/memory/4280-1817-0x00007FF642CB0000-0x00007FF6430A2000-memory.dmp	xmrig
behavioral2/memory/3940-1837-0x00007FF6E9980000-0x00007FF6E9D72000-memory.dmp	xmrig
behavioral2/memory/4292-1813-0x00007FF75EFD0000-0x00007FF75F3C2000-memory.dmp	xmrig
behavioral2/memory/3768-1834-0x00007FF7FA640000-0x00007FF7FAA32000-memory.dmp	xmrig
behavioral2/memory/4624-1806-0x00007FF6EAC30000-0x00007FF6EB022000-memory.dmp	xmrig
behavioral2/memory/4024-1804-0x00007FF668530000-0x00007FF668922000-memory.dmp	xmrig
behavioral2/memory/4564-1830-0x00007FF7AB1F0000-0x00007FF7AB5E2000-memory.dmp	xmrig
behavioral2/memory/4564-226-0x00007FF7AB1F0000-0x00007FF7AB5E2000-memory.dmp	xmrig
behavioral2/memory/4280-224-0x00007FF642CB0000-0x00007FF6430A2000-memory.dmp	xmrig
behavioral2/memory/4024-223-0x00007FF668530000-0x00007FF668922000-memory.dmp	xmrig
behavioral2/memory/5084-221-0x00007FF76CBC0000-0x00007FF76CFB2000-memory.dmp	xmrig
behavioral2/memory/4292-206-0x00007FF75EFD0000-0x00007FF75F3C2000-memory.dmp	xmrig
behavioral2/memory/3768-199-0x00007FF7FA640000-0x00007FF7FAA32000-memory.dmp	xmrig
behavioral2/memory/2300-179-0x00007FF6E8900000-0x00007FF6E8CF2000-memory.dmp	xmrig
behavioral2/memory/940-172-0x00007FF75EA10000-0x00007FF75EE02000-memory.dmp	xmrig
behavioral2/memory/2296-164-0x00007FF6ACBD0000-0x00007FF6ACFC2000-memory.dmp	xmrig
behavioral2/memory/1968-156-0x00007FF7BD740000-0x00007FF7BDB32000-memory.dmp	xmrig
behavioral2/memory/3608-155-0x00007FF620200000-0x00007FF6205F2000-memory.dmp	xmrig
behavioral2/memory/1988-146-0x00007FF6349A0000-0x00007FF634D92000-memory.dmp	xmrig
behavioral2/memory/2316-144-0x00007FF644970000-0x00007FF644D62000-memory.dmp	xmrig
behavioral2/memory/1428-126-0x00007FF76EEB0000-0x00007FF76F2A2000-memory.dmp	xmrig
behavioral2/memory/3900-106-0x00007FF7D2E20000-0x00007FF7D3212000-memory.dmp	xmrig
behavioral2/memory/2440-97-0x00007FF7FAA80000-0x00007FF7FAE72000-memory.dmp	xmrig
behavioral2/memory/2920-82-0x00007FF6A9F20000-0x00007FF6AA312000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
6	2076	powershell.exe
11	2076	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2076	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4916	dTfhzYt.exe
3500	zhwmqNZ.exe
2920	rIEPTtO.exe
5084	NOnOUYQ.exe
2440	nxwTKwa.exe
3900	gBOaonD.exe
1428	AxScXvV.exe
2316	XDPPhEY.exe
1988	xLUOVNV.exe
3608	FBffVBI.exe
1968	AdPxqqy.exe
2296	SQPcHQc.exe
940	ZJLScmD.exe
4024	YMOBAKw.exe
4280	VKEUkRJ.exe
2300	PSLjGlC.exe
3940	obsahDg.exe
3768	wheQNlp.exe
832	AOvwDaB.exe
4292	lqpGkpe.exe
4444	ncKsTfN.exe
4624	TQIiAJc.exe
2008	THgyouk.exe
4564	vQNqcih.exe
5060	hIBNIie.exe
4860	YukVmUl.exe
3860	ySXELyy.exe
3444	QfXOIlP.exe
4296	hTWhspL.exe
4392	VRbXZPx.exe
1680	EVjNUju.exe
4988	aWngbLU.exe
2992	EqxMTDu.exe
1912	hOEYPNn.exe
2080	uLGOPgn.exe
4908	MprwZVW.exe
2340	dTkywxF.exe
4236	rnPQLrr.exe
3160	xAilxVW.exe
864	CkWvdWe.exe
1500	VMkOeNM.exe
3776	sPlmBtn.exe
2232	OTMCuOX.exe
572	UsBsTQQ.exe
3660	qEWhPpP.exe
1156	PgPbVWN.exe
980	rdEKlis.exe
4396	nvFSNUd.exe
5140	ZPmRzfp.exe
5160	YwnuKDI.exe
5184	FEXWyqx.exe
5200	ekWWncq.exe
5220	QImQuco.exe
5244	FogCski.exe
5268	fZfFaYO.exe
5292	TQJrgoa.exe
5336	VJravfI.exe
5352	NqZPWcT.exe
5368	KmzgUJm.exe
5384	aQcXSUi.exe
5400	cawmGpV.exe
5416	tgVMfTB.exe
5432	tyYvrva.exe
5448	snNElBg.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3456-0-0x00007FF7D7A00000-0x00007FF7D7DF2000-memory.dmp	upx
behavioral2/files/0x0008000000023246-5.dat	upx
behavioral2/memory/4916-8-0x00007FF673E00000-0x00007FF6741F2000-memory.dmp	upx
behavioral2/files/0x0008000000023249-12.dat	upx
behavioral2/files/0x000800000002324a-10.dat	upx
behavioral2/memory/3500-17-0x00007FF7906D0000-0x00007FF790AC2000-memory.dmp	upx
behavioral2/files/0x000800000002324c-21.dat	upx
behavioral2/files/0x000800000002324e-25.dat	upx
behavioral2/files/0x0007000000023250-37.dat	upx
behavioral2/files/0x0007000000023257-72.dat	upx
behavioral2/files/0x0007000000023255-99.dat	upx
behavioral2/files/0x0007000000023259-104.dat	upx
behavioral2/files/0x0007000000023260-120.dat	upx
behavioral2/files/0x0007000000023265-143.dat	upx
behavioral2/files/0x0007000000023264-149.dat	upx
behavioral2/files/0x0007000000023266-159.dat	upx
behavioral2/files/0x0007000000023267-171.dat	upx
behavioral2/files/0x0008000000023263-183.dat	upx
behavioral2/memory/3940-192-0x00007FF6E9980000-0x00007FF6E9D72000-memory.dmp	upx
behavioral2/memory/832-201-0x00007FF7EE410000-0x00007FF7EE802000-memory.dmp	upx
behavioral2/memory/4624-211-0x00007FF6EAC30000-0x00007FF6EB022000-memory.dmp	upx
behavioral2/memory/2008-214-0x00007FF73BE90000-0x00007FF73C282000-memory.dmp	upx
behavioral2/memory/4444-225-0x00007FF70B6C0000-0x00007FF70BAB2000-memory.dmp	upx
behavioral2/memory/4916-1655-0x00007FF673E00000-0x00007FF6741F2000-memory.dmp	upx
behavioral2/memory/3500-1710-0x00007FF7906D0000-0x00007FF790AC2000-memory.dmp	upx
behavioral2/memory/2920-1768-0x00007FF6A9F20000-0x00007FF6AA312000-memory.dmp	upx
behavioral2/memory/1428-1769-0x00007FF76EEB0000-0x00007FF76F2A2000-memory.dmp	upx
behavioral2/memory/2008-1821-0x00007FF73BE90000-0x00007FF73C282000-memory.dmp	upx
behavioral2/memory/2296-1818-0x00007FF6ACBD0000-0x00007FF6ACFC2000-memory.dmp	upx
behavioral2/memory/2300-1815-0x00007FF6E8900000-0x00007FF6E8CF2000-memory.dmp	upx
behavioral2/memory/2440-1792-0x00007FF7FAA80000-0x00007FF7FAE72000-memory.dmp	upx
behavioral2/memory/3608-1789-0x00007FF620200000-0x00007FF6205F2000-memory.dmp	upx
behavioral2/memory/3900-1791-0x00007FF7D2E20000-0x00007FF7D3212000-memory.dmp	upx
behavioral2/memory/2316-1775-0x00007FF644970000-0x00007FF644D62000-memory.dmp	upx
behavioral2/memory/1988-1760-0x00007FF6349A0000-0x00007FF634D92000-memory.dmp	upx
behavioral2/memory/940-1847-0x00007FF75EA10000-0x00007FF75EE02000-memory.dmp	upx
behavioral2/memory/1968-1855-0x00007FF7BD740000-0x00007FF7BDB32000-memory.dmp	upx
behavioral2/memory/4444-1853-0x00007FF70B6C0000-0x00007FF70BAB2000-memory.dmp	upx
behavioral2/memory/832-1856-0x00007FF7EE410000-0x00007FF7EE802000-memory.dmp	upx
behavioral2/memory/4280-1817-0x00007FF642CB0000-0x00007FF6430A2000-memory.dmp	upx
behavioral2/memory/3940-1837-0x00007FF6E9980000-0x00007FF6E9D72000-memory.dmp	upx
behavioral2/memory/4292-1813-0x00007FF75EFD0000-0x00007FF75F3C2000-memory.dmp	upx
behavioral2/memory/3768-1834-0x00007FF7FA640000-0x00007FF7FAA32000-memory.dmp	upx
behavioral2/memory/4624-1806-0x00007FF6EAC30000-0x00007FF6EB022000-memory.dmp	upx
behavioral2/memory/4024-1804-0x00007FF668530000-0x00007FF668922000-memory.dmp	upx
behavioral2/memory/4564-1830-0x00007FF7AB1F0000-0x00007FF7AB5E2000-memory.dmp	upx
behavioral2/memory/4564-226-0x00007FF7AB1F0000-0x00007FF7AB5E2000-memory.dmp	upx
behavioral2/memory/4280-224-0x00007FF642CB0000-0x00007FF6430A2000-memory.dmp	upx
behavioral2/memory/4024-223-0x00007FF668530000-0x00007FF668922000-memory.dmp	upx
behavioral2/memory/5084-221-0x00007FF76CBC0000-0x00007FF76CFB2000-memory.dmp	upx
behavioral2/memory/4292-206-0x00007FF75EFD0000-0x00007FF75F3C2000-memory.dmp	upx
behavioral2/memory/3768-199-0x00007FF7FA640000-0x00007FF7FAA32000-memory.dmp	upx
behavioral2/files/0x0007000000023268-185.dat	upx
behavioral2/files/0x000700000002326a-182.dat	upx
behavioral2/files/0x0008000000023262-180.dat	upx
behavioral2/memory/2300-179-0x00007FF6E8900000-0x00007FF6E8CF2000-memory.dmp	upx
behavioral2/files/0x0007000000023269-178.dat	upx
behavioral2/memory/940-172-0x00007FF75EA10000-0x00007FF75EE02000-memory.dmp	upx
behavioral2/memory/2296-164-0x00007FF6ACBD0000-0x00007FF6ACFC2000-memory.dmp	upx
behavioral2/memory/1968-156-0x00007FF7BD740000-0x00007FF7BDB32000-memory.dmp	upx
behavioral2/memory/3608-155-0x00007FF620200000-0x00007FF6205F2000-memory.dmp	upx
behavioral2/files/0x0007000000023261-147.dat	upx
behavioral2/memory/1988-146-0x00007FF6349A0000-0x00007FF634D92000-memory.dmp	upx
behavioral2/memory/2316-144-0x00007FF644970000-0x00007FF644D62000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
6	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\kqnxDSv.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\lFJwlxa.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\ypvyXGc.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\aSAgaPX.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\rhOOaxx.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\VaDlbkV.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\hWQmGes.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\GHmlsgV.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\MdSoneZ.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\hPcPTVt.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\mMmBAIY.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\AOvwDaB.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\yMFqMOR.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\SzSxIpB.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\RChctaJ.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\eYKklbe.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\EdDbhJu.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\WJmuwIx.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\eWFZAQa.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\VJravfI.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\rmHaCGF.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\wjQouVG.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\QgwmoRR.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\jgnIlkq.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\GaYaPWd.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\oqmEYcX.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\GAdHnVn.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\hvuqhSf.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\FVOhXeE.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\eoSfZOv.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\wlJbetR.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\bmhIPFU.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\ZljtDPj.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\ygWLayP.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\bJwjNic.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\TVfOahG.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\BjsiSOP.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\LVOtnkv.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\XTtVBjS.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\bYMEsjz.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\POFCBnb.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\ggXNYhx.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\uLGOPgn.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\KmzgUJm.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\auKKgCl.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\uTPAbmA.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\xETIzAF.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\tpTldsM.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\JDdiaYk.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\EDxiwYR.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\ONaZQII.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\lGiderq.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\vqzJtpr.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\EYvFgXM.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\dOGQjRC.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\vLrvGDM.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\zkMyHDJ.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\xHGEpuV.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\jdpaEbF.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\PcOclrf.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\qWrTYUW.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\NkfoCvf.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\IBUHXsN.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\HBbyXyI.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2076	powershell.exe
2076	powershell.exe
2076	powershell.exe
2076	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
Token: SeDebugPrivilege	2076	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3456 wrote to memory of 2076	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	94
PID 3456 wrote to memory of 2076	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	94
PID 3456 wrote to memory of 4916	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	95
PID 3456 wrote to memory of 4916	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	95
PID 3456 wrote to memory of 3500	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	96
PID 3456 wrote to memory of 3500	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	96
PID 3456 wrote to memory of 2920	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	97
PID 3456 wrote to memory of 2920	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	97
PID 3456 wrote to memory of 5084	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	98
PID 3456 wrote to memory of 5084	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	98
PID 3456 wrote to memory of 2440	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	99
PID 3456 wrote to memory of 2440	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	99
PID 3456 wrote to memory of 3900	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	100
PID 3456 wrote to memory of 3900	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	100
PID 3456 wrote to memory of 1428	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	101
PID 3456 wrote to memory of 1428	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	101
PID 3456 wrote to memory of 2316	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	102
PID 3456 wrote to memory of 2316	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	102
PID 3456 wrote to memory of 1988	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	103
PID 3456 wrote to memory of 1988	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	103
PID 3456 wrote to memory of 3608	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	104
PID 3456 wrote to memory of 3608	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	104
PID 3456 wrote to memory of 1968	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	105
PID 3456 wrote to memory of 1968	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	105
PID 3456 wrote to memory of 2296	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	106
PID 3456 wrote to memory of 2296	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	106
PID 3456 wrote to memory of 940	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	107
PID 3456 wrote to memory of 940	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	107
PID 3456 wrote to memory of 4024	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	108
PID 3456 wrote to memory of 4024	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	108
PID 3456 wrote to memory of 4292	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	109
PID 3456 wrote to memory of 4292	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	109
PID 3456 wrote to memory of 4280	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	110
PID 3456 wrote to memory of 4280	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	110
PID 3456 wrote to memory of 2300	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	111
PID 3456 wrote to memory of 2300	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	111
PID 3456 wrote to memory of 3940	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	112
PID 3456 wrote to memory of 3940	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	112
PID 3456 wrote to memory of 3768	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	113
PID 3456 wrote to memory of 3768	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	113
PID 3456 wrote to memory of 832	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	114
PID 3456 wrote to memory of 832	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	114
PID 3456 wrote to memory of 4444	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	115
PID 3456 wrote to memory of 4444	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	115
PID 3456 wrote to memory of 4624	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	116
PID 3456 wrote to memory of 4624	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	116
PID 3456 wrote to memory of 2008	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	117
PID 3456 wrote to memory of 2008	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	117
PID 3456 wrote to memory of 4564	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	118
PID 3456 wrote to memory of 4564	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	118
PID 3456 wrote to memory of 5060	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	119
PID 3456 wrote to memory of 5060	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	119
PID 3456 wrote to memory of 4860	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	120
PID 3456 wrote to memory of 4860	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	120
PID 3456 wrote to memory of 3860	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	121
PID 3456 wrote to memory of 3860	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	121
PID 3456 wrote to memory of 3444	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	122
PID 3456 wrote to memory of 3444	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	122
PID 3456 wrote to memory of 4296	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	123
PID 3456 wrote to memory of 4296	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	123
PID 3456 wrote to memory of 4392	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	124
PID 3456 wrote to memory of 4392	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	124
PID 3456 wrote to memory of 1680	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	125
PID 3456 wrote to memory of 1680	3456	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	125

C:\Users\Admin\AppData\Local\Temp\10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2076
- C:\Windows\System\dTfhzYt.exe
  C:\Windows\System\dTfhzYt.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\zhwmqNZ.exe
  C:\Windows\System\zhwmqNZ.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\rIEPTtO.exe
  C:\Windows\System\rIEPTtO.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\NOnOUYQ.exe
  C:\Windows\System\NOnOUYQ.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\nxwTKwa.exe
  C:\Windows\System\nxwTKwa.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\gBOaonD.exe
  C:\Windows\System\gBOaonD.exe
  2⤵
  - Executes dropped EXE
  PID:3900
- C:\Windows\System\AxScXvV.exe
  C:\Windows\System\AxScXvV.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\XDPPhEY.exe
  C:\Windows\System\XDPPhEY.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\xLUOVNV.exe
  C:\Windows\System\xLUOVNV.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\FBffVBI.exe
  C:\Windows\System\FBffVBI.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\AdPxqqy.exe
  C:\Windows\System\AdPxqqy.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\SQPcHQc.exe
  C:\Windows\System\SQPcHQc.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\ZJLScmD.exe
  C:\Windows\System\ZJLScmD.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\YMOBAKw.exe
  C:\Windows\System\YMOBAKw.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\lqpGkpe.exe
  C:\Windows\System\lqpGkpe.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\VKEUkRJ.exe
  C:\Windows\System\VKEUkRJ.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\PSLjGlC.exe
  C:\Windows\System\PSLjGlC.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\obsahDg.exe
  C:\Windows\System\obsahDg.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\wheQNlp.exe
  C:\Windows\System\wheQNlp.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\AOvwDaB.exe
  C:\Windows\System\AOvwDaB.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\ncKsTfN.exe
  C:\Windows\System\ncKsTfN.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\TQIiAJc.exe
  C:\Windows\System\TQIiAJc.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\THgyouk.exe
  C:\Windows\System\THgyouk.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\vQNqcih.exe
  C:\Windows\System\vQNqcih.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\hIBNIie.exe
  C:\Windows\System\hIBNIie.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\YukVmUl.exe
  C:\Windows\System\YukVmUl.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\ySXELyy.exe
  C:\Windows\System\ySXELyy.exe
  2⤵
  - Executes dropped EXE
  PID:3860
- C:\Windows\System\QfXOIlP.exe
  C:\Windows\System\QfXOIlP.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\hTWhspL.exe
  C:\Windows\System\hTWhspL.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\VRbXZPx.exe
  C:\Windows\System\VRbXZPx.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\EVjNUju.exe
  C:\Windows\System\EVjNUju.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\aWngbLU.exe
  C:\Windows\System\aWngbLU.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\EqxMTDu.exe
  C:\Windows\System\EqxMTDu.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\hOEYPNn.exe
  C:\Windows\System\hOEYPNn.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\uLGOPgn.exe
  C:\Windows\System\uLGOPgn.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\MprwZVW.exe
  C:\Windows\System\MprwZVW.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\dTkywxF.exe
  C:\Windows\System\dTkywxF.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\rnPQLrr.exe
  C:\Windows\System\rnPQLrr.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System\xAilxVW.exe
  C:\Windows\System\xAilxVW.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\CkWvdWe.exe
  C:\Windows\System\CkWvdWe.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\VMkOeNM.exe
  C:\Windows\System\VMkOeNM.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\sPlmBtn.exe
  C:\Windows\System\sPlmBtn.exe
  2⤵
  - Executes dropped EXE
  PID:3776
- C:\Windows\System\OTMCuOX.exe
  C:\Windows\System\OTMCuOX.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\UsBsTQQ.exe
  C:\Windows\System\UsBsTQQ.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\qEWhPpP.exe
  C:\Windows\System\qEWhPpP.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\PgPbVWN.exe
  C:\Windows\System\PgPbVWN.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\rdEKlis.exe
  C:\Windows\System\rdEKlis.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\nvFSNUd.exe
  C:\Windows\System\nvFSNUd.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\ZPmRzfp.exe
  C:\Windows\System\ZPmRzfp.exe
  2⤵
  - Executes dropped EXE
  PID:5140
- C:\Windows\System\YwnuKDI.exe
  C:\Windows\System\YwnuKDI.exe
  2⤵
  - Executes dropped EXE
  PID:5160
- C:\Windows\System\FEXWyqx.exe
  C:\Windows\System\FEXWyqx.exe
  2⤵
  - Executes dropped EXE
  PID:5184
- C:\Windows\System\ekWWncq.exe
  C:\Windows\System\ekWWncq.exe
  2⤵
  - Executes dropped EXE
  PID:5200
- C:\Windows\System\QImQuco.exe
  C:\Windows\System\QImQuco.exe
  2⤵
  - Executes dropped EXE
  PID:5220
- C:\Windows\System\FogCski.exe
  C:\Windows\System\FogCski.exe
  2⤵
  - Executes dropped EXE
  PID:5244
- C:\Windows\System\fZfFaYO.exe
  C:\Windows\System\fZfFaYO.exe
  2⤵
  - Executes dropped EXE
  PID:5268
- C:\Windows\System\TQJrgoa.exe
  C:\Windows\System\TQJrgoa.exe
  2⤵
  - Executes dropped EXE
  PID:5292
- C:\Windows\System\VJravfI.exe
  C:\Windows\System\VJravfI.exe
  2⤵
  - Executes dropped EXE
  PID:5336
- C:\Windows\System\NqZPWcT.exe
  C:\Windows\System\NqZPWcT.exe
  2⤵
  - Executes dropped EXE
  PID:5352
- C:\Windows\System\KmzgUJm.exe
  C:\Windows\System\KmzgUJm.exe
  2⤵
  - Executes dropped EXE
  PID:5368
- C:\Windows\System\aQcXSUi.exe
  C:\Windows\System\aQcXSUi.exe
  2⤵
  - Executes dropped EXE
  PID:5384
- C:\Windows\System\cawmGpV.exe
  C:\Windows\System\cawmGpV.exe
  2⤵
  - Executes dropped EXE
  PID:5400
- C:\Windows\System\tgVMfTB.exe
  C:\Windows\System\tgVMfTB.exe
  2⤵
  - Executes dropped EXE
  PID:5416
- C:\Windows\System\tyYvrva.exe
  C:\Windows\System\tyYvrva.exe
  2⤵
  - Executes dropped EXE
  PID:5432
- C:\Windows\System\snNElBg.exe
  C:\Windows\System\snNElBg.exe
  2⤵
  - Executes dropped EXE
  PID:5448
- C:\Windows\System\ypvyXGc.exe
  C:\Windows\System\ypvyXGc.exe
  2⤵
  PID:5464
- C:\Windows\System\jMGddCD.exe
  C:\Windows\System\jMGddCD.exe
  2⤵
  PID:5480
- C:\Windows\System\Kpygway.exe
  C:\Windows\System\Kpygway.exe
  2⤵
  PID:5520
- C:\Windows\System\RSYsnqV.exe
  C:\Windows\System\RSYsnqV.exe
  2⤵
  PID:5536
- C:\Windows\System\KnpQFCh.exe
  C:\Windows\System\KnpQFCh.exe
  2⤵
  PID:5552
- C:\Windows\System\emyStvV.exe
  C:\Windows\System\emyStvV.exe
  2⤵
  PID:5568
- C:\Windows\System\yrpTWVX.exe
  C:\Windows\System\yrpTWVX.exe
  2⤵
  PID:5584
- C:\Windows\System\rnLZovU.exe
  C:\Windows\System\rnLZovU.exe
  2⤵
  PID:5604
- C:\Windows\System\DuSFsRm.exe
  C:\Windows\System\DuSFsRm.exe
  2⤵
  PID:5620
- C:\Windows\System\JNuVWRw.exe
  C:\Windows\System\JNuVWRw.exe
  2⤵
  PID:5636
- C:\Windows\System\TQhtCuF.exe
  C:\Windows\System\TQhtCuF.exe
  2⤵
  PID:5668
- C:\Windows\System\IcoFbUM.exe
  C:\Windows\System\IcoFbUM.exe
  2⤵
  PID:5684
- C:\Windows\System\HPXwGyN.exe
  C:\Windows\System\HPXwGyN.exe
  2⤵
  PID:5896
- C:\Windows\System\uqSPPvT.exe
  C:\Windows\System\uqSPPvT.exe
  2⤵
  PID:5924
- C:\Windows\System\SaDmpIY.exe
  C:\Windows\System\SaDmpIY.exe
  2⤵
  PID:5948
- C:\Windows\System\HpRmkhY.exe
  C:\Windows\System\HpRmkhY.exe
  2⤵
  PID:5976
- C:\Windows\System\JqpSWXz.exe
  C:\Windows\System\JqpSWXz.exe
  2⤵
  PID:5996
- C:\Windows\System\eyUTaXh.exe
  C:\Windows\System\eyUTaXh.exe
  2⤵
  PID:6024
- C:\Windows\System\lhMJlLK.exe
  C:\Windows\System\lhMJlLK.exe
  2⤵
  PID:6040
- C:\Windows\System\yCIflkv.exe
  C:\Windows\System\yCIflkv.exe
  2⤵
  PID:6056
- C:\Windows\System\yhFFPru.exe
  C:\Windows\System\yhFFPru.exe
  2⤵
  PID:6096
- C:\Windows\System\igCgudk.exe
  C:\Windows\System\igCgudk.exe
  2⤵
  PID:2304
- C:\Windows\System\HgpThCy.exe
  C:\Windows\System\HgpThCy.exe
  2⤵
  PID:2688
- C:\Windows\System\gBbdgEJ.exe
  C:\Windows\System\gBbdgEJ.exe
  2⤵
  PID:3516
- C:\Windows\System\IeektvS.exe
  C:\Windows\System\IeektvS.exe
  2⤵
  PID:5192
- C:\Windows\System\ldfkuBZ.exe
  C:\Windows\System\ldfkuBZ.exe
  2⤵
  PID:5344
- C:\Windows\System\DqsVKOB.exe
  C:\Windows\System\DqsVKOB.exe
  2⤵
  PID:5240
- C:\Windows\System\cTCuWvT.exe
  C:\Windows\System\cTCuWvT.exe
  2⤵
  PID:5276
- C:\Windows\System\omksbAD.exe
  C:\Windows\System\omksbAD.exe
  2⤵
  PID:5360
- C:\Windows\System\tWvInFX.exe
  C:\Windows\System\tWvInFX.exe
  2⤵
  PID:5408
- C:\Windows\System\KsPbeDD.exe
  C:\Windows\System\KsPbeDD.exe
  2⤵
  PID:5680
- C:\Windows\System\tZDWUxs.exe
  C:\Windows\System\tZDWUxs.exe
  2⤵
  PID:2348
- C:\Windows\System\ImeATgX.exe
  C:\Windows\System\ImeATgX.exe
  2⤵
  PID:5984
- C:\Windows\System\yMFqMOR.exe
  C:\Windows\System\yMFqMOR.exe
  2⤵
  PID:6012
- C:\Windows\System\dLMriJC.exe
  C:\Windows\System\dLMriJC.exe
  2⤵
  PID:6048
- C:\Windows\System\jTfBAzF.exe
  C:\Windows\System\jTfBAzF.exe
  2⤵
  PID:6076
- C:\Windows\System\lZKZSFK.exe
  C:\Windows\System\lZKZSFK.exe
  2⤵
  PID:6136
- C:\Windows\System\EXNOceE.exe
  C:\Windows\System\EXNOceE.exe
  2⤵
  PID:2040
- C:\Windows\System\ZGTUrgR.exe
  C:\Windows\System\ZGTUrgR.exe
  2⤵
  PID:2552
- C:\Windows\System\azlZBRn.exe
  C:\Windows\System\azlZBRn.exe
  2⤵
  PID:5136
- C:\Windows\System\ZDpbTNJ.exe
  C:\Windows\System\ZDpbTNJ.exe
  2⤵
  PID:5232
- C:\Windows\System\yVWBZEJ.exe
  C:\Windows\System\yVWBZEJ.exe
  2⤵
  PID:5304
- C:\Windows\System\cXjnWkw.exe
  C:\Windows\System\cXjnWkw.exe
  2⤵
  PID:5380
- C:\Windows\System\XseKJqd.exe
  C:\Windows\System\XseKJqd.exe
  2⤵
  PID:5440
- C:\Windows\System\wlJbetR.exe
  C:\Windows\System\wlJbetR.exe
  2⤵
  PID:5560
- C:\Windows\System\KeHyDwg.exe
  C:\Windows\System\KeHyDwg.exe
  2⤵
  PID:6152
- C:\Windows\System\AfYISQt.exe
  C:\Windows\System\AfYISQt.exe
  2⤵
  PID:6176
- C:\Windows\System\QgwmoRR.exe
  C:\Windows\System\QgwmoRR.exe
  2⤵
  PID:6220
- C:\Windows\System\eJiPUIw.exe
  C:\Windows\System\eJiPUIw.exe
  2⤵
  PID:6236
- C:\Windows\System\qWNNhrZ.exe
  C:\Windows\System\qWNNhrZ.exe
  2⤵
  PID:6360
- C:\Windows\System\rTVewsC.exe
  C:\Windows\System\rTVewsC.exe
  2⤵
  PID:6424
- C:\Windows\System\kGtjdhW.exe
  C:\Windows\System\kGtjdhW.exe
  2⤵
  PID:6488
- C:\Windows\System\hvuqhSf.exe
  C:\Windows\System\hvuqhSf.exe
  2⤵
  PID:6516
- C:\Windows\System\riXyXwd.exe
  C:\Windows\System\riXyXwd.exe
  2⤵
  PID:6564
- C:\Windows\System\UtoMqJk.exe
  C:\Windows\System\UtoMqJk.exe
  2⤵
  PID:6580
- C:\Windows\System\hYvyBaR.exe
  C:\Windows\System\hYvyBaR.exe
  2⤵
  PID:6604
- C:\Windows\System\OrwKrFN.exe
  C:\Windows\System\OrwKrFN.exe
  2⤵
  PID:6628
- C:\Windows\System\RChctaJ.exe
  C:\Windows\System\RChctaJ.exe
  2⤵
  PID:6656
- C:\Windows\System\KjNDyun.exe
  C:\Windows\System\KjNDyun.exe
  2⤵
  PID:6704
- C:\Windows\System\nrDDCHD.exe
  C:\Windows\System\nrDDCHD.exe
  2⤵
  PID:6732
- C:\Windows\System\jMcgKAJ.exe
  C:\Windows\System\jMcgKAJ.exe
  2⤵
  PID:6764
- C:\Windows\System\GgQpzeQ.exe
  C:\Windows\System\GgQpzeQ.exe
  2⤵
  PID:6788
- C:\Windows\System\jeqENKZ.exe
  C:\Windows\System\jeqENKZ.exe
  2⤵
  PID:6828
- C:\Windows\System\NnBLpdW.exe
  C:\Windows\System\NnBLpdW.exe
  2⤵
  PID:6872
- C:\Windows\System\ZYKMwpQ.exe
  C:\Windows\System\ZYKMwpQ.exe
  2⤵
  PID:6900
- C:\Windows\System\IwxYrcZ.exe
  C:\Windows\System\IwxYrcZ.exe
  2⤵
  PID:6928
- C:\Windows\System\ZxShUTB.exe
  C:\Windows\System\ZxShUTB.exe
  2⤵
  PID:6948
- C:\Windows\System\AKyDKPX.exe
  C:\Windows\System\AKyDKPX.exe
  2⤵
  PID:6964
- C:\Windows\System\YXoQrRb.exe
  C:\Windows\System\YXoQrRb.exe
  2⤵
  PID:6996
- C:\Windows\System\bwFTnVZ.exe
  C:\Windows\System\bwFTnVZ.exe
  2⤵
  PID:7016
- C:\Windows\System\PgKKquX.exe
  C:\Windows\System\PgKKquX.exe
  2⤵
  PID:7036
- C:\Windows\System\ftGiJaB.exe
  C:\Windows\System\ftGiJaB.exe
  2⤵
  PID:7064
- C:\Windows\System\HBbyXyI.exe
  C:\Windows\System\HBbyXyI.exe
  2⤵
  PID:7084
- C:\Windows\System\hUDJexg.exe
  C:\Windows\System\hUDJexg.exe
  2⤵
  PID:7108
- C:\Windows\System\bJwjNic.exe
  C:\Windows\System\bJwjNic.exe
  2⤵
  PID:7132
- C:\Windows\System\RkAjzSW.exe
  C:\Windows\System\RkAjzSW.exe
  2⤵
  PID:7156
- C:\Windows\System\yXEZqzy.exe
  C:\Windows\System\yXEZqzy.exe
  2⤵
  PID:5912
- C:\Windows\System\WUqGPuA.exe
  C:\Windows\System\WUqGPuA.exe
  2⤵
  PID:5652
- C:\Windows\System\HHIySVU.exe
  C:\Windows\System\HHIySVU.exe
  2⤵
  PID:2260
- C:\Windows\System\eHlfWFS.exe
  C:\Windows\System\eHlfWFS.exe
  2⤵
  PID:6004
- C:\Windows\System\VLivkTB.exe
  C:\Windows\System\VLivkTB.exe
  2⤵
  PID:2196
- C:\Windows\System\sQiuuLa.exe
  C:\Windows\System\sQiuuLa.exe
  2⤵
  PID:3612
- C:\Windows\System\THRlBhR.exe
  C:\Windows\System\THRlBhR.exe
  2⤵
  PID:5704
- C:\Windows\System\TONSgvO.exe
  C:\Windows\System\TONSgvO.exe
  2⤵
  PID:6160
- C:\Windows\System\pcdBdsH.exe
  C:\Windows\System\pcdBdsH.exe
  2⤵
  PID:5128
- C:\Windows\System\jgnIlkq.exe
  C:\Windows\System\jgnIlkq.exe
  2⤵
  PID:5708
- C:\Windows\System\aZFiDBF.exe
  C:\Windows\System\aZFiDBF.exe
  2⤵
  PID:2276
- C:\Windows\System\tcoPHqc.exe
  C:\Windows\System\tcoPHqc.exe
  2⤵
  PID:2832
- C:\Windows\System\aJOMLKc.exe
  C:\Windows\System\aJOMLKc.exe
  2⤵
  PID:4816
- C:\Windows\System\MlLOUFl.exe
  C:\Windows\System\MlLOUFl.exe
  2⤵
  PID:516
- C:\Windows\System\ZhXSImY.exe
  C:\Windows\System\ZhXSImY.exe
  2⤵
  PID:4440
- C:\Windows\System\DeWzAXt.exe
  C:\Windows\System\DeWzAXt.exe
  2⤵
  PID:3244
- C:\Windows\System\MTYJFMI.exe
  C:\Windows\System\MTYJFMI.exe
  2⤵
  PID:6420
- C:\Windows\System\rHmHZuP.exe
  C:\Windows\System\rHmHZuP.exe
  2⤵
  PID:6392
- C:\Windows\System\LeSmoIl.exe
  C:\Windows\System\LeSmoIl.exe
  2⤵
  PID:6436
- C:\Windows\System\kXgvXOg.exe
  C:\Windows\System\kXgvXOg.exe
  2⤵
  PID:6464
- C:\Windows\System\eikFYCv.exe
  C:\Windows\System\eikFYCv.exe
  2⤵
  PID:688
- C:\Windows\System\fUCsDnb.exe
  C:\Windows\System\fUCsDnb.exe
  2⤵
  PID:4432
- C:\Windows\System\AaKrrzJ.exe
  C:\Windows\System\AaKrrzJ.exe
  2⤵
  PID:1880
- C:\Windows\System\ZxCPgrL.exe
  C:\Windows\System\ZxCPgrL.exe
  2⤵
  PID:6596
- C:\Windows\System\DuGrcOi.exe
  C:\Windows\System\DuGrcOi.exe
  2⤵
  PID:6620
- C:\Windows\System\gDqKmDG.exe
  C:\Windows\System\gDqKmDG.exe
  2⤵
  PID:6664
- C:\Windows\System\HzFItyG.exe
  C:\Windows\System\HzFItyG.exe
  2⤵
  PID:3984
- C:\Windows\System\XVWdoED.exe
  C:\Windows\System\XVWdoED.exe
  2⤵
  PID:3476
- C:\Windows\System\CKiEpco.exe
  C:\Windows\System\CKiEpco.exe
  2⤵
  PID:4980
- C:\Windows\System\JcvnMaP.exe
  C:\Windows\System\JcvnMaP.exe
  2⤵
  PID:6728
- C:\Windows\System\atrnsih.exe
  C:\Windows\System\atrnsih.exe
  2⤵
  PID:6776
- C:\Windows\System\SIiIABA.exe
  C:\Windows\System\SIiIABA.exe
  2⤵
  PID:6824
- C:\Windows\System\DFtbHaa.exe
  C:\Windows\System\DFtbHaa.exe
  2⤵
  PID:6860
- C:\Windows\System\MIHNtMZ.exe
  C:\Windows\System\MIHNtMZ.exe
  2⤵
  PID:2656
- C:\Windows\System\PBjzsQz.exe
  C:\Windows\System\PBjzsQz.exe
  2⤵
  PID:6956
- C:\Windows\System\yfYsujF.exe
  C:\Windows\System\yfYsujF.exe
  2⤵
  PID:6988
- C:\Windows\System\xzRaSXq.exe
  C:\Windows\System\xzRaSXq.exe
  2⤵
  PID:7028
- C:\Windows\System\gfFwKYi.exe
  C:\Windows\System\gfFwKYi.exe
  2⤵
  PID:7148
- C:\Windows\System\SwExwGJ.exe
  C:\Windows\System\SwExwGJ.exe
  2⤵
  PID:5592
- C:\Windows\System\xQoNsXE.exe
  C:\Windows\System\xQoNsXE.exe
  2⤵
  PID:404
- C:\Windows\System\WrTQDVq.exe
  C:\Windows\System\WrTQDVq.exe
  2⤵
  PID:7140
- C:\Windows\System\QICpqeC.exe
  C:\Windows\System\QICpqeC.exe
  2⤵
  PID:4544
- C:\Windows\System\susraNo.exe
  C:\Windows\System\susraNo.exe
  2⤵
  PID:5052
- C:\Windows\System\mWiEycp.exe
  C:\Windows\System\mWiEycp.exe
  2⤵
  PID:6408
- C:\Windows\System\KiUDnFr.exe
  C:\Windows\System\KiUDnFr.exe
  2⤵
  PID:3416
- C:\Windows\System\yrKgLZv.exe
  C:\Windows\System\yrKgLZv.exe
  2⤵
  PID:1572
- C:\Windows\System\iXEtPUY.exe
  C:\Windows\System\iXEtPUY.exe
  2⤵
  PID:420
- C:\Windows\System\HLbdLsN.exe
  C:\Windows\System\HLbdLsN.exe
  2⤵
  PID:2136
- C:\Windows\System\LkjNFLO.exe
  C:\Windows\System\LkjNFLO.exe
  2⤵
  PID:6752
- C:\Windows\System\KdjsDkx.exe
  C:\Windows\System\KdjsDkx.exe
  2⤵
  PID:2020
- C:\Windows\System\jPTFcyC.exe
  C:\Windows\System\jPTFcyC.exe
  2⤵
  PID:4996
- C:\Windows\System\nufhIVk.exe
  C:\Windows\System\nufhIVk.exe
  2⤵
  PID:3524
- C:\Windows\System\TuqDdXq.exe
  C:\Windows\System\TuqDdXq.exe
  2⤵
  PID:4508
- C:\Windows\System\SndNwpK.exe
  C:\Windows\System\SndNwpK.exe
  2⤵
  PID:6600
- C:\Windows\System\oikxHIn.exe
  C:\Windows\System\oikxHIn.exe
  2⤵
  PID:7176
- C:\Windows\System\VmvACDI.exe
  C:\Windows\System\VmvACDI.exe
  2⤵
  PID:7196
- C:\Windows\System\kBEcEUC.exe
  C:\Windows\System\kBEcEUC.exe
  2⤵
  PID:7216
- C:\Windows\System\CfsOexq.exe
  C:\Windows\System\CfsOexq.exe
  2⤵
  PID:7244
- C:\Windows\System\bqrDjxR.exe
  C:\Windows\System\bqrDjxR.exe
  2⤵
  PID:7264
- C:\Windows\System\kCVPJhJ.exe
  C:\Windows\System\kCVPJhJ.exe
  2⤵
  PID:7280
- C:\Windows\System\eBoksyU.exe
  C:\Windows\System\eBoksyU.exe
  2⤵
  PID:7304
- C:\Windows\System\aJONAug.exe
  C:\Windows\System\aJONAug.exe
  2⤵
  PID:7324
- C:\Windows\System\AgpZSCu.exe
  C:\Windows\System\AgpZSCu.exe
  2⤵
  PID:7344
- C:\Windows\System\lQUxIvC.exe
  C:\Windows\System\lQUxIvC.exe
  2⤵
  PID:7368
- C:\Windows\System\RarhBHv.exe
  C:\Windows\System\RarhBHv.exe
  2⤵
  PID:7396
- C:\Windows\System\uuqXEXO.exe
  C:\Windows\System\uuqXEXO.exe
  2⤵
  PID:7416
- C:\Windows\System\VvBUwYG.exe
  C:\Windows\System\VvBUwYG.exe
  2⤵
  PID:7448
- C:\Windows\System\mQezMtX.exe
  C:\Windows\System\mQezMtX.exe
  2⤵
  PID:7472
- C:\Windows\System\TnvACBq.exe
  C:\Windows\System\TnvACBq.exe
  2⤵
  PID:7496
- C:\Windows\System\qPpIowS.exe
  C:\Windows\System\qPpIowS.exe
  2⤵
  PID:7512
- C:\Windows\System\afTbfwB.exe
  C:\Windows\System\afTbfwB.exe
  2⤵
  PID:7540
- C:\Windows\System\HiuDHhC.exe
  C:\Windows\System\HiuDHhC.exe
  2⤵
  PID:7556
- C:\Windows\System\IuPwXNT.exe
  C:\Windows\System\IuPwXNT.exe
  2⤵
  PID:7576
- C:\Windows\System\rQMEhhO.exe
  C:\Windows\System\rQMEhhO.exe
  2⤵
  PID:7596
- C:\Windows\System\bBlauFi.exe
  C:\Windows\System\bBlauFi.exe
  2⤵
  PID:7620
- C:\Windows\System\QhmQhsP.exe
  C:\Windows\System\QhmQhsP.exe
  2⤵
  PID:7640
- C:\Windows\System\vTFqmfz.exe
  C:\Windows\System\vTFqmfz.exe
  2⤵
  PID:7836
- C:\Windows\System\XEJslqx.exe
  C:\Windows\System\XEJslqx.exe
  2⤵
  PID:7868
- C:\Windows\System\IRQhYCC.exe
  C:\Windows\System\IRQhYCC.exe
  2⤵
  PID:7888
- C:\Windows\System\cBNJniA.exe
  C:\Windows\System\cBNJniA.exe
  2⤵
  PID:7916
- C:\Windows\System\ZWdGlTr.exe
  C:\Windows\System\ZWdGlTr.exe
  2⤵
  PID:7944
- C:\Windows\System\gAVSUpc.exe
  C:\Windows\System\gAVSUpc.exe
  2⤵
  PID:7964
- C:\Windows\System\eNdBzYN.exe
  C:\Windows\System\eNdBzYN.exe
  2⤵
  PID:7988
- C:\Windows\System\krWvBwg.exe
  C:\Windows\System\krWvBwg.exe
  2⤵
  PID:8004
- C:\Windows\System\IfYyFvT.exe
  C:\Windows\System\IfYyFvT.exe
  2⤵
  PID:8036
- C:\Windows\System\BmSGBBo.exe
  C:\Windows\System\BmSGBBo.exe
  2⤵
  PID:8064
- C:\Windows\System\kyDXPMv.exe
  C:\Windows\System\kyDXPMv.exe
  2⤵
  PID:8096
- C:\Windows\System\lwhyNRy.exe
  C:\Windows\System\lwhyNRy.exe
  2⤵
  PID:8112
- C:\Windows\System\cujTsfW.exe
  C:\Windows\System\cujTsfW.exe
  2⤵
  PID:8136
- C:\Windows\System\TvHfhbO.exe
  C:\Windows\System\TvHfhbO.exe
  2⤵
  PID:8172
- C:\Windows\System\Yhqeoac.exe
  C:\Windows\System\Yhqeoac.exe
  2⤵
  PID:6780
- C:\Windows\System\gRENtHb.exe
  C:\Windows\System\gRENtHb.exe
  2⤵
  PID:1656
- C:\Windows\System\zVzncQh.exe
  C:\Windows\System\zVzncQh.exe
  2⤵
  PID:6944
- C:\Windows\System\MXjcGBk.exe
  C:\Windows\System\MXjcGBk.exe
  2⤵
  PID:1692
- C:\Windows\System\NiQmwct.exe
  C:\Windows\System\NiQmwct.exe
  2⤵
  PID:7048
- C:\Windows\System\TtKbzrw.exe
  C:\Windows\System\TtKbzrw.exe
  2⤵
  PID:2380
- C:\Windows\System\HHeDzuj.exe
  C:\Windows\System\HHeDzuj.exe
  2⤵
  PID:5916
- C:\Windows\System\sGjOcXA.exe
  C:\Windows\System\sGjOcXA.exe
  2⤵
  PID:6496
- C:\Windows\System\BMiDWOU.exe
  C:\Windows\System\BMiDWOU.exe
  2⤵
  PID:7468
- C:\Windows\System\AoOqvRJ.exe
  C:\Windows\System\AoOqvRJ.exe
  2⤵
  PID:7224
- C:\Windows\System\LmgqAcV.exe
  C:\Windows\System\LmgqAcV.exe
  2⤵
  PID:2996
- C:\Windows\System\zJHqFUG.exe
  C:\Windows\System\zJHqFUG.exe
  2⤵
  PID:3448
- C:\Windows\System\pcBcohh.exe
  C:\Windows\System\pcBcohh.exe
  2⤵
  PID:7676
- C:\Windows\System\IPXIssU.exe
  C:\Windows\System\IPXIssU.exe
  2⤵
  PID:7388
- C:\Windows\System\UeJhgkQ.exe
  C:\Windows\System\UeJhgkQ.exe
  2⤵
  PID:836
- C:\Windows\System\TfJYaxE.exe
  C:\Windows\System\TfJYaxE.exe
  2⤵
  PID:6612
- C:\Windows\System\urMTvem.exe
  C:\Windows\System\urMTvem.exe
  2⤵
  PID:7744
- C:\Windows\System\BnHwVDj.exe
  C:\Windows\System\BnHwVDj.exe
  2⤵
  PID:7760
- C:\Windows\System\EYvFgXM.exe
  C:\Windows\System\EYvFgXM.exe
  2⤵
  PID:7184
- C:\Windows\System\PHVHLEQ.exe
  C:\Windows\System\PHVHLEQ.exe
  2⤵
  PID:7260
- C:\Windows\System\fpBWejg.exe
  C:\Windows\System\fpBWejg.exe
  2⤵
  PID:7844
- C:\Windows\System\amlgFPN.exe
  C:\Windows\System\amlgFPN.exe
  2⤵
  PID:7716
- C:\Windows\System\IibdnTB.exe
  C:\Windows\System\IibdnTB.exe
  2⤵
  PID:7956
- C:\Windows\System\giqgJor.exe
  C:\Windows\System\giqgJor.exe
  2⤵
  PID:8128
- C:\Windows\System\hPcPTVt.exe
  C:\Windows\System\hPcPTVt.exe
  2⤵
  PID:6184
- C:\Windows\System\payfpBV.exe
  C:\Windows\System\payfpBV.exe
  2⤵
  PID:5088
- C:\Windows\System\gBknOOW.exe
  C:\Windows\System\gBknOOW.exe
  2⤵
  PID:7880
- C:\Windows\System\cAoSjiX.exe
  C:\Windows\System\cAoSjiX.exe
  2⤵
  PID:2660
- C:\Windows\System\sibwcaO.exe
  C:\Windows\System\sibwcaO.exe
  2⤵
  PID:7608
- C:\Windows\System\VaDlbkV.exe
  C:\Windows\System\VaDlbkV.exe
  2⤵
  PID:6388
- C:\Windows\System\YhWmvHA.exe
  C:\Windows\System\YhWmvHA.exe
  2⤵
  PID:7360
- C:\Windows\System\jFbNVHg.exe
  C:\Windows\System\jFbNVHg.exe
  2⤵
  PID:7504
- C:\Windows\System\lwEtIOk.exe
  C:\Windows\System\lwEtIOk.exe
  2⤵
  PID:8216
- C:\Windows\System\mlnmoxY.exe
  C:\Windows\System\mlnmoxY.exe
  2⤵
  PID:8236
- C:\Windows\System\MAgIprR.exe
  C:\Windows\System\MAgIprR.exe
  2⤵
  PID:8256
- C:\Windows\System\PcOclrf.exe
  C:\Windows\System\PcOclrf.exe
  2⤵
  PID:8280
- C:\Windows\System\hWQmGes.exe
  C:\Windows\System\hWQmGes.exe
  2⤵
  PID:8300
- C:\Windows\System\LlchOSH.exe
  C:\Windows\System\LlchOSH.exe
  2⤵
  PID:8324
- C:\Windows\System\BXzEiAw.exe
  C:\Windows\System\BXzEiAw.exe
  2⤵
  PID:8344
- C:\Windows\System\DEqoynZ.exe
  C:\Windows\System\DEqoynZ.exe
  2⤵
  PID:8364
- C:\Windows\System\qsOaOpt.exe
  C:\Windows\System\qsOaOpt.exe
  2⤵
  PID:8384
- C:\Windows\System\TupSbJB.exe
  C:\Windows\System\TupSbJB.exe
  2⤵
  PID:8400
- C:\Windows\System\xMQrxRg.exe
  C:\Windows\System\xMQrxRg.exe
  2⤵
  PID:8424
- C:\Windows\System\GdByREG.exe
  C:\Windows\System\GdByREG.exe
  2⤵
  PID:8444
- C:\Windows\System\FVOhXeE.exe
  C:\Windows\System\FVOhXeE.exe
  2⤵
  PID:8460
- C:\Windows\System\KSjNzht.exe
  C:\Windows\System\KSjNzht.exe
  2⤵
  PID:8480
- C:\Windows\System\lOeuCyn.exe
  C:\Windows\System\lOeuCyn.exe
  2⤵
  PID:8504
- C:\Windows\System\NwpeBTX.exe
  C:\Windows\System\NwpeBTX.exe
  2⤵
  PID:8528
- C:\Windows\System\bWpPtAV.exe
  C:\Windows\System\bWpPtAV.exe
  2⤵
  PID:8548
- C:\Windows\System\eYKklbe.exe
  C:\Windows\System\eYKklbe.exe
  2⤵
  PID:8568
- C:\Windows\System\ndFAVCI.exe
  C:\Windows\System\ndFAVCI.exe
  2⤵
  PID:8588
- C:\Windows\System\OoRgRDI.exe
  C:\Windows\System\OoRgRDI.exe
  2⤵
  PID:8616
- C:\Windows\System\roGYSCo.exe
  C:\Windows\System\roGYSCo.exe
  2⤵
  PID:8636
- C:\Windows\System\AFowHmV.exe
  C:\Windows\System\AFowHmV.exe
  2⤵
  PID:8656
- C:\Windows\System\qnICUTb.exe
  C:\Windows\System\qnICUTb.exe
  2⤵
  PID:8680
- C:\Windows\System\HpPPMxr.exe
  C:\Windows\System\HpPPMxr.exe
  2⤵
  PID:8700
- C:\Windows\System\kPjejZW.exe
  C:\Windows\System\kPjejZW.exe
  2⤵
  PID:8720
- C:\Windows\System\xcqKJWv.exe
  C:\Windows\System\xcqKJWv.exe
  2⤵
  PID:8744
- C:\Windows\System\owdpbVW.exe
  C:\Windows\System\owdpbVW.exe
  2⤵
  PID:8764
- C:\Windows\System\rmHaCGF.exe
  C:\Windows\System\rmHaCGF.exe
  2⤵
  PID:8936
- C:\Windows\System\lZkmJRy.exe
  C:\Windows\System\lZkmJRy.exe
  2⤵
  PID:2484
- C:\Windows\System\YOLiGqP.exe
  C:\Windows\System\YOLiGqP.exe
  2⤵
  PID:7960
- C:\Windows\System\fXmfCgO.exe
  C:\Windows\System\fXmfCgO.exe
  2⤵
  PID:8044
- C:\Windows\System\QQUJcUs.exe
  C:\Windows\System\QQUJcUs.exe
  2⤵
  PID:8224
- C:\Windows\System\gPrgHdE.exe
  C:\Windows\System\gPrgHdE.exe
  2⤵
  PID:7572
- C:\Windows\System\KysVpyC.exe
  C:\Windows\System\KysVpyC.exe
  2⤵
  PID:6652
- C:\Windows\System\WVrPfnP.exe
  C:\Windows\System\WVrPfnP.exe
  2⤵
  PID:6892
- C:\Windows\System\wTwVGwx.exe
  C:\Windows\System\wTwVGwx.exe
  2⤵
  PID:8228
- C:\Windows\System\EwAooCV.exe
  C:\Windows\System\EwAooCV.exe
  2⤵
  PID:8336
- C:\Windows\System\GZqgXHW.exe
  C:\Windows\System\GZqgXHW.exe
  2⤵
  PID:8144
- C:\Windows\System\fmWxqXP.exe
  C:\Windows\System\fmWxqXP.exe
  2⤵
  PID:8608
- C:\Windows\System\HoqocPZ.exe
  C:\Windows\System\HoqocPZ.exe
  2⤵
  PID:8672
- C:\Windows\System\qnkdFaB.exe
  C:\Windows\System\qnkdFaB.exe
  2⤵
  PID:8072
- C:\Windows\System\PoanafU.exe
  C:\Windows\System\PoanafU.exe
  2⤵
  PID:8276
- C:\Windows\System\gZCDIgu.exe
  C:\Windows\System\gZCDIgu.exe
  2⤵
  PID:8376
- C:\Windows\System\qWrTYUW.exe
  C:\Windows\System\qWrTYUW.exe
  2⤵
  PID:8420
- C:\Windows\System\YdDJyzr.exe
  C:\Windows\System\YdDJyzr.exe
  2⤵
  PID:8988
- C:\Windows\System\pZWhcPp.exe
  C:\Windows\System\pZWhcPp.exe
  2⤵
  PID:8596
- C:\Windows\System\nWqMffZ.exe
  C:\Windows\System\nWqMffZ.exe
  2⤵
  PID:8648
- C:\Windows\System\hFIgPLQ.exe
  C:\Windows\System\hFIgPLQ.exe
  2⤵
  PID:8692
- C:\Windows\System\gMspNiR.exe
  C:\Windows\System\gMspNiR.exe
  2⤵
  PID:8872
- C:\Windows\System\AxiEntK.exe
  C:\Windows\System\AxiEntK.exe
  2⤵
  PID:9100
- C:\Windows\System\wCSsRLF.exe
  C:\Windows\System\wCSsRLF.exe
  2⤵
  PID:9192
- C:\Windows\System\dQVFSmp.exe
  C:\Windows\System\dQVFSmp.exe
  2⤵
  PID:8972
- C:\Windows\System\MoMqEtP.exe
  C:\Windows\System\MoMqEtP.exe
  2⤵
  PID:9028
- C:\Windows\System\HSQvvtO.exe
  C:\Windows\System\HSQvvtO.exe
  2⤵
  PID:9188
- C:\Windows\System\SCRcvDZ.exe
  C:\Windows\System\SCRcvDZ.exe
  2⤵
  PID:8248
- C:\Windows\System\BjsiSOP.exe
  C:\Windows\System\BjsiSOP.exe
  2⤵
  PID:6804
- C:\Windows\System\PAMPndN.exe
  C:\Windows\System\PAMPndN.exe
  2⤵
  PID:8564
- C:\Windows\System\EdDbhJu.exe
  C:\Windows\System\EdDbhJu.exe
  2⤵
  PID:9136
- C:\Windows\System\LLHZYgb.exe
  C:\Windows\System\LLHZYgb.exe
  2⤵
  PID:8356
- C:\Windows\System\KYUSdsE.exe
  C:\Windows\System\KYUSdsE.exe
  2⤵
  PID:4796
- C:\Windows\System\ZgHbjjb.exe
  C:\Windows\System\ZgHbjjb.exe
  2⤵
  PID:9228
- C:\Windows\System\fzwAsLJ.exe
  C:\Windows\System\fzwAsLJ.exe
  2⤵
  PID:9248
- C:\Windows\System\xHGEpuV.exe
  C:\Windows\System\xHGEpuV.exe
  2⤵
  PID:9268
- C:\Windows\System\EDxiwYR.exe
  C:\Windows\System\EDxiwYR.exe
  2⤵
  PID:9292
- C:\Windows\System\OCdcCyB.exe
  C:\Windows\System\OCdcCyB.exe
  2⤵
  PID:9312
- C:\Windows\System\cCpRBsc.exe
  C:\Windows\System\cCpRBsc.exe
  2⤵
  PID:9340
- C:\Windows\System\kTAsSTg.exe
  C:\Windows\System\kTAsSTg.exe
  2⤵
  PID:9372
- C:\Windows\System\dCoyUUi.exe
  C:\Windows\System\dCoyUUi.exe
  2⤵
  PID:9400
- C:\Windows\System\yNgGRHu.exe
  C:\Windows\System\yNgGRHu.exe
  2⤵
  PID:9428
- C:\Windows\System\QGwOALe.exe
  C:\Windows\System\QGwOALe.exe
  2⤵
  PID:9452
- C:\Windows\System\tFleKYY.exe
  C:\Windows\System\tFleKYY.exe
  2⤵
  PID:9472
- C:\Windows\System\wypaksb.exe
  C:\Windows\System\wypaksb.exe
  2⤵
  PID:9500
- C:\Windows\System\uxiqhwd.exe
  C:\Windows\System\uxiqhwd.exe
  2⤵
  PID:9536
- C:\Windows\System\MiRMetW.exe
  C:\Windows\System\MiRMetW.exe
  2⤵
  PID:9556
- C:\Windows\System\ctImIkj.exe
  C:\Windows\System\ctImIkj.exe
  2⤵
  PID:9576
- C:\Windows\System\xoUOdli.exe
  C:\Windows\System\xoUOdli.exe
  2⤵
  PID:9600
- C:\Windows\System\hyfOvRP.exe
  C:\Windows\System\hyfOvRP.exe
  2⤵
  PID:9624
- C:\Windows\System\bvDAASU.exe
  C:\Windows\System\bvDAASU.exe
  2⤵
  PID:9644
- C:\Windows\System\OIDLVPe.exe
  C:\Windows\System\OIDLVPe.exe
  2⤵
  PID:9660
- C:\Windows\System\KpJNugd.exe
  C:\Windows\System\KpJNugd.exe
  2⤵
  PID:9676
- C:\Windows\System\xvRRtpd.exe
  C:\Windows\System\xvRRtpd.exe
  2⤵
  PID:9696
- C:\Windows\System\GRjQNZk.exe
  C:\Windows\System\GRjQNZk.exe
  2⤵
  PID:9724
- C:\Windows\System\BMYQNPb.exe
  C:\Windows\System\BMYQNPb.exe
  2⤵
  PID:9740
- C:\Windows\System\LXyEbXX.exe
  C:\Windows\System\LXyEbXX.exe
  2⤵
  PID:9764
- C:\Windows\System\jdpaEbF.exe
  C:\Windows\System\jdpaEbF.exe
  2⤵
  PID:9784
- C:\Windows\System\LVOtnkv.exe
  C:\Windows\System\LVOtnkv.exe
  2⤵
  PID:9808
- C:\Windows\System\XTtVBjS.exe
  C:\Windows\System\XTtVBjS.exe
  2⤵
  PID:9824
- C:\Windows\System\VGRlcIg.exe
  C:\Windows\System\VGRlcIg.exe
  2⤵
  PID:9848
- C:\Windows\System\dOGQjRC.exe
  C:\Windows\System\dOGQjRC.exe
  2⤵
  PID:9876
- C:\Windows\System\eAsgIZC.exe
  C:\Windows\System\eAsgIZC.exe
  2⤵
  PID:9896
- C:\Windows\System\iYptGGa.exe
  C:\Windows\System\iYptGGa.exe
  2⤵
  PID:9916
- C:\Windows\System\KhyRJsq.exe
  C:\Windows\System\KhyRJsq.exe
  2⤵
  PID:9936
- C:\Windows\System\aSAgaPX.exe
  C:\Windows\System\aSAgaPX.exe
  2⤵
  PID:10024
- C:\Windows\System\eElXnwZ.exe
  C:\Windows\System\eElXnwZ.exe
  2⤵
  PID:10040
- C:\Windows\System\iOenPdt.exe
  C:\Windows\System\iOenPdt.exe
  2⤵
  PID:10068
- C:\Windows\System\bYMEsjz.exe
  C:\Windows\System\bYMEsjz.exe
  2⤵
  PID:10084
- C:\Windows\System\ilrYLNa.exe
  C:\Windows\System\ilrYLNa.exe
  2⤵
  PID:10104
- C:\Windows\System\AeKfkCN.exe
  C:\Windows\System\AeKfkCN.exe
  2⤵
  PID:10124
- C:\Windows\System\jgrzPor.exe
  C:\Windows\System\jgrzPor.exe
  2⤵
  PID:10144
- C:\Windows\System\UxGkNbC.exe
  C:\Windows\System\UxGkNbC.exe
  2⤵
  PID:10164
- C:\Windows\System\YtRaqAU.exe
  C:\Windows\System\YtRaqAU.exe
  2⤵
  PID:10188
- C:\Windows\System\tyZJIhW.exe
  C:\Windows\System\tyZJIhW.exe
  2⤵
  PID:10208
- C:\Windows\System\IkDfjUr.exe
  C:\Windows\System\IkDfjUr.exe
  2⤵
  PID:8120
- C:\Windows\System\VqpjEhn.exe
  C:\Windows\System\VqpjEhn.exe
  2⤵
  PID:7592
- C:\Windows\System\pmmvgEp.exe
  C:\Windows\System\pmmvgEp.exe
  2⤵
  PID:7464
- C:\Windows\System\uJXXvGj.exe
  C:\Windows\System\uJXXvGj.exe
  2⤵
  PID:8520
- C:\Windows\System\LfVFjdA.exe
  C:\Windows\System\LfVFjdA.exe
  2⤵
  PID:8372
- C:\Windows\System\LlczRBe.exe
  C:\Windows\System\LlczRBe.exe
  2⤵
  PID:9240
- C:\Windows\System\dkPqWOm.exe
  C:\Windows\System\dkPqWOm.exe
  2⤵
  PID:8960
- C:\Windows\System\qvYmNgk.exe
  C:\Windows\System\qvYmNgk.exe
  2⤵
  PID:9460
- C:\Windows\System\yJHjVif.exe
  C:\Windows\System\yJHjVif.exe
  2⤵
  PID:7692
- C:\Windows\System\xgetkfm.exe
  C:\Windows\System\xgetkfm.exe
  2⤵
  PID:9800
- C:\Windows\System\fRfYjsy.exe
  C:\Windows\System\fRfYjsy.exe
  2⤵
  PID:9320
- C:\Windows\System\gpirfzo.exe
  C:\Windows\System\gpirfzo.exe
  2⤵
  PID:8832
- C:\Windows\System\wNRsPyN.exe
  C:\Windows\System\wNRsPyN.exe
  2⤵
  PID:9568
- C:\Windows\System\PwrWgBO.exe
  C:\Windows\System\PwrWgBO.exe
  2⤵
  PID:9612
- C:\Windows\System\POFCBnb.exe
  C:\Windows\System\POFCBnb.exe
  2⤵
  PID:9652
- C:\Windows\System\jCespIq.exe
  C:\Windows\System\jCespIq.exe
  2⤵
  PID:9692
- C:\Windows\System\ApwrGvg.exe
  C:\Windows\System\ApwrGvg.exe
  2⤵
  PID:9736
- C:\Windows\System\oZqwpKF.exe
  C:\Windows\System\oZqwpKF.exe
  2⤵
  PID:7896
- C:\Windows\System\uNsrnUn.exe
  C:\Windows\System\uNsrnUn.exe
  2⤵
  PID:9284
- C:\Windows\System\TOSTPBn.exe
  C:\Windows\System\TOSTPBn.exe
  2⤵
  PID:9384
- C:\Windows\System\hGlbbce.exe
  C:\Windows\System\hGlbbce.exe
  2⤵
  PID:9412
- C:\Windows\System\iJJVyqZ.exe
  C:\Windows\System\iJJVyqZ.exe
  2⤵
  PID:10556
- C:\Windows\System\XAyIRxZ.exe
  C:\Windows\System\XAyIRxZ.exe
  2⤵
  PID:10592
- C:\Windows\System\wjQouVG.exe
  C:\Windows\System\wjQouVG.exe
  2⤵
  PID:10612
- C:\Windows\System\akPsdNK.exe
  C:\Windows\System\akPsdNK.exe
  2⤵
  PID:10636
- C:\Windows\System\PSHoNWj.exe
  C:\Windows\System\PSHoNWj.exe
  2⤵
  PID:10660
- C:\Windows\System\FgRQQnn.exe
  C:\Windows\System\FgRQQnn.exe
  2⤵
  PID:10684
- C:\Windows\System\jBqPVUn.exe
  C:\Windows\System\jBqPVUn.exe
  2⤵
  PID:10704
- C:\Windows\System\PjoZEhx.exe
  C:\Windows\System\PjoZEhx.exe
  2⤵
  PID:10780
- C:\Windows\System\cJbjvJZ.exe
  C:\Windows\System\cJbjvJZ.exe
  2⤵
  PID:10804
- C:\Windows\System\VbalerT.exe
  C:\Windows\System\VbalerT.exe
  2⤵
  PID:10828
- C:\Windows\System\kqnxDSv.exe
  C:\Windows\System\kqnxDSv.exe
  2⤵
  PID:10928
- C:\Windows\System\fKFcApg.exe
  C:\Windows\System\fKFcApg.exe
  2⤵
  PID:10944
- C:\Windows\System\jonyyjK.exe
  C:\Windows\System\jonyyjK.exe
  2⤵
  PID:10968
- C:\Windows\System\heanRyA.exe
  C:\Windows\System\heanRyA.exe
  2⤵
  PID:10992
- C:\Windows\System\BxzyPBi.exe
  C:\Windows\System\BxzyPBi.exe
  2⤵
  PID:11008
- C:\Windows\System\jhknEUo.exe
  C:\Windows\System\jhknEUo.exe
  2⤵
  PID:11040
- C:\Windows\System\GaYaPWd.exe
  C:\Windows\System\GaYaPWd.exe
  2⤵
  PID:11088
- C:\Windows\System\GwiLpHR.exe
  C:\Windows\System\GwiLpHR.exe
  2⤵
  PID:11104
- C:\Windows\System\iHfkhWC.exe
  C:\Windows\System\iHfkhWC.exe
  2⤵
  PID:11124
- C:\Windows\System\vsikeki.exe
  C:\Windows\System\vsikeki.exe
  2⤵
  PID:11144
- C:\Windows\System\ilVJYfW.exe
  C:\Windows\System\ilVJYfW.exe
  2⤵
  PID:11224
- C:\Windows\System\yMIFKgv.exe
  C:\Windows\System\yMIFKgv.exe
  2⤵
  PID:11240
- C:\Windows\System\aNeTmYO.exe
  C:\Windows\System\aNeTmYO.exe
  2⤵
  PID:11256
- C:\Windows\System\tWaYJrn.exe
  C:\Windows\System\tWaYJrn.exe
  2⤵
  PID:10064
- C:\Windows\System\TshTocy.exe
  C:\Windows\System\TshTocy.exe
  2⤵
  PID:9904
- C:\Windows\System\XYCqkvv.exe
  C:\Windows\System\XYCqkvv.exe
  2⤵
  PID:10136
- C:\Windows\System\oQwGcZv.exe
  C:\Windows\System\oQwGcZv.exe
  2⤵
  PID:9060
- C:\Windows\System\KgfXWvp.exe
  C:\Windows\System\KgfXWvp.exe
  2⤵
  PID:8676
- C:\Windows\System\SbWkxRK.exe
  C:\Windows\System\SbWkxRK.exe
  2⤵
  PID:9444
- C:\Windows\System\MNfYYXy.exe
  C:\Windows\System\MNfYYXy.exe
  2⤵
  PID:9588
- C:\Windows\System\YyPpqPt.exe
  C:\Windows\System\YyPpqPt.exe
  2⤵
  PID:9712
- C:\Windows\System\jRdKdpv.exe
  C:\Windows\System\jRdKdpv.exe
  2⤵
  PID:9996
- C:\Windows\System\eRigTte.exe
  C:\Windows\System\eRigTte.exe
  2⤵
  PID:10288
- C:\Windows\System\kdVpGFw.exe
  C:\Windows\System\kdVpGFw.exe
  2⤵
  PID:10568
- C:\Windows\System\CDXyCVN.exe
  C:\Windows\System\CDXyCVN.exe
  2⤵
  PID:10696
- C:\Windows\System\BcAxHGw.exe
  C:\Windows\System\BcAxHGw.exe
  2⤵
  PID:10348
- C:\Windows\System\mJsMlxs.exe
  C:\Windows\System\mJsMlxs.exe
  2⤵
  PID:10480
- C:\Windows\System\fDrcYjp.exe
  C:\Windows\System\fDrcYjp.exe
  2⤵
  PID:10524
- C:\Windows\System\kMlcZZs.exe
  C:\Windows\System\kMlcZZs.exe
  2⤵
  PID:10608
- C:\Windows\System\sYrRTLl.exe
  C:\Windows\System\sYrRTLl.exe
  2⤵
  PID:10652
- C:\Windows\System\FFLLuCT.exe
  C:\Windows\System\FFLLuCT.exe
  2⤵
  PID:10728
- C:\Windows\System\Bjjejvf.exe
  C:\Windows\System\Bjjejvf.exe
  2⤵
  PID:10788
- C:\Windows\System\yzIEJFw.exe
  C:\Windows\System\yzIEJFw.exe
  2⤵
  PID:10820
- C:\Windows\System\Cghkfhb.exe
  C:\Windows\System\Cghkfhb.exe
  2⤵
  PID:10868
- C:\Windows\System\dQTDZKr.exe
  C:\Windows\System\dQTDZKr.exe
  2⤵
  PID:10888
- C:\Windows\System\XJwukxK.exe
  C:\Windows\System\XJwukxK.exe
  2⤵
  PID:10960
- C:\Windows\System\WJmuwIx.exe
  C:\Windows\System\WJmuwIx.exe
  2⤵
  PID:512
- C:\Windows\System\JCiJAMU.exe
  C:\Windows\System\JCiJAMU.exe
  2⤵
  PID:11024
- C:\Windows\System\YBvDIiF.exe
  C:\Windows\System\YBvDIiF.exe
  2⤵
  PID:11004
- C:\Windows\System\Cyllydg.exe
  C:\Windows\System\Cyllydg.exe
  2⤵
  PID:11140
- C:\Windows\System\FCttHrA.exe
  C:\Windows\System\FCttHrA.exe
  2⤵
  PID:8012
- C:\Windows\System\KqPNxVf.exe
  C:\Windows\System\KqPNxVf.exe
  2⤵
  PID:11192
- C:\Windows\System\gmfgSlJ.exe
  C:\Windows\System\gmfgSlJ.exe
  2⤵
  PID:9564
- C:\Windows\System\yOGoGcF.exe
  C:\Windows\System\yOGoGcF.exe
  2⤵
  PID:10372
- C:\Windows\System\IcElOGZ.exe
  C:\Windows\System\IcElOGZ.exe
  2⤵
  PID:9816
- C:\Windows\System\JcHRaGq.exe
  C:\Windows\System\JcHRaGq.exe
  2⤵
  PID:3844
- C:\Windows\System\nGrvYIq.exe
  C:\Windows\System\nGrvYIq.exe
  2⤵
  PID:9632
- C:\Windows\System\xznEQOh.exe
  C:\Windows\System\xznEQOh.exe
  2⤵
  PID:10800
- C:\Windows\System\adEShWy.exe
  C:\Windows\System\adEShWy.exe
  2⤵
  PID:10112
- C:\Windows\System\ORRFgTS.exe
  C:\Windows\System\ORRFgTS.exe
  2⤵
  PID:10340
- C:\Windows\System\uWbvUoU.exe
  C:\Windows\System\uWbvUoU.exe
  2⤵
  PID:11276
- C:\Windows\System\RKsZVtD.exe
  C:\Windows\System\RKsZVtD.exe
  2⤵
  PID:11304
- C:\Windows\System\HdiOoKT.exe
  C:\Windows\System\HdiOoKT.exe
  2⤵
  PID:11324
- C:\Windows\System\qxWvnSG.exe
  C:\Windows\System\qxWvnSG.exe
  2⤵
  PID:11344
- C:\Windows\System\CcUnBHR.exe
  C:\Windows\System\CcUnBHR.exe
  2⤵
  PID:11368
- C:\Windows\System\lGiderq.exe
  C:\Windows\System\lGiderq.exe
  2⤵
  PID:11392
- C:\Windows\System\YwHRpoZ.exe
  C:\Windows\System\YwHRpoZ.exe
  2⤵
  PID:11448
- C:\Windows\System\oqmEYcX.exe
  C:\Windows\System\oqmEYcX.exe
  2⤵
  PID:11480
- C:\Windows\System\gghKuPC.exe
  C:\Windows\System\gghKuPC.exe
  2⤵
  PID:11504
- C:\Windows\System\PKBJXKD.exe
  C:\Windows\System\PKBJXKD.exe
  2⤵
  PID:11520
- C:\Windows\System\WqwgEzR.exe
  C:\Windows\System\WqwgEzR.exe
  2⤵
  PID:11548
- C:\Windows\System\VrnIrFL.exe
  C:\Windows\System\VrnIrFL.exe
  2⤵
  PID:11568
- C:\Windows\System\vWEvvWj.exe
  C:\Windows\System\vWEvvWj.exe
  2⤵
  PID:11600
- C:\Windows\System\YKxHSYY.exe
  C:\Windows\System\YKxHSYY.exe
  2⤵
  PID:11624
- C:\Windows\System\mnFAKHt.exe
  C:\Windows\System\mnFAKHt.exe
  2⤵
  PID:11644
- C:\Windows\System\wVKMSmQ.exe
  C:\Windows\System\wVKMSmQ.exe
  2⤵
  PID:11664
- C:\Windows\System\pPVXWNi.exe
  C:\Windows\System\pPVXWNi.exe
  2⤵
  PID:11692
- C:\Windows\System\WvNFtRg.exe
  C:\Windows\System\WvNFtRg.exe
  2⤵
  PID:11716
- C:\Windows\System\AJTuHKf.exe
  C:\Windows\System\AJTuHKf.exe
  2⤵
  PID:11740
- C:\Windows\System\MizFFzL.exe
  C:\Windows\System\MizFFzL.exe
  2⤵
  PID:11760
- C:\Windows\System\DmVNUqk.exe
  C:\Windows\System\DmVNUqk.exe
  2⤵
  PID:11780
- C:\Windows\System\LpiWFib.exe
  C:\Windows\System\LpiWFib.exe
  2⤵
  PID:11812
- C:\Windows\System\FIKNblV.exe
  C:\Windows\System\FIKNblV.exe
  2⤵
  PID:11832
- C:\Windows\System\ViCHShA.exe
  C:\Windows\System\ViCHShA.exe
  2⤵
  PID:11848
- C:\Windows\System\cOwmOJM.exe
  C:\Windows\System\cOwmOJM.exe
  2⤵
  PID:11864
- C:\Windows\System\ueyRTZK.exe
  C:\Windows\System\ueyRTZK.exe
  2⤵
  PID:11880
- C:\Windows\System\mLTMGOj.exe
  C:\Windows\System\mLTMGOj.exe
  2⤵
  PID:11904
- C:\Windows\System\EJEiyUZ.exe
  C:\Windows\System\EJEiyUZ.exe
  2⤵
  PID:11924
- C:\Windows\System\NTSdvCY.exe
  C:\Windows\System\NTSdvCY.exe
  2⤵
  PID:11948
- C:\Windows\System\JWZWOgX.exe
  C:\Windows\System\JWZWOgX.exe
  2⤵
  PID:11968
- C:\Windows\System\MIqJCnA.exe
  C:\Windows\System\MIqJCnA.exe
  2⤵
  PID:11984
- C:\Windows\System\RUmswTf.exe
  C:\Windows\System\RUmswTf.exe
  2⤵
  PID:12008
- C:\Windows\System\JxTwqBC.exe
  C:\Windows\System\JxTwqBC.exe
  2⤵
  PID:12028
- C:\Windows\System\ecFUdbt.exe
  C:\Windows\System\ecFUdbt.exe
  2⤵
  PID:12048
- C:\Windows\System\STtxyxj.exe
  C:\Windows\System\STtxyxj.exe
  2⤵
  PID:12068
- C:\Windows\System\rCQgJiK.exe
  C:\Windows\System\rCQgJiK.exe
  2⤵
  PID:12116
- C:\Windows\System\qrQGwDW.exe
  C:\Windows\System\qrQGwDW.exe
  2⤵
  PID:10200
- C:\Windows\System\eLgpsbd.exe
  C:\Windows\System\eLgpsbd.exe
  2⤵
  PID:7732
- C:\Windows\System\JGUhVPK.exe
  C:\Windows\System\JGUhVPK.exe
  2⤵
  PID:10544
- C:\Windows\System\yngWZbn.exe
  C:\Windows\System\yngWZbn.exe
  2⤵
  PID:10512
- C:\Windows\System\TVfOahG.exe
  C:\Windows\System\TVfOahG.exe
  2⤵
  PID:11384
- C:\Windows\System\SeLyxQW.exe
  C:\Windows\System\SeLyxQW.exe
  2⤵
  PID:11436
- C:\Windows\System\rAqdFRK.exe
  C:\Windows\System\rAqdFRK.exe
  2⤵
  PID:11748
- C:\Windows\System\zMuxoso.exe
  C:\Windows\System\zMuxoso.exe
  2⤵
  PID:11512
- C:\Windows\System\TMBNudv.exe
  C:\Windows\System\TMBNudv.exe
  2⤵
  PID:12016
- C:\Windows\System\uQMGihl.exe
  C:\Windows\System\uQMGihl.exe
  2⤵
  PID:12112
- C:\Windows\System\NkfoCvf.exe
  C:\Windows\System\NkfoCvf.exe
  2⤵
  PID:11472
- C:\Windows\System\cGZAlyW.exe
  C:\Windows\System\cGZAlyW.exe
  2⤵
  PID:11992
- C:\Windows\System\ZfRhrVU.exe
  C:\Windows\System\ZfRhrVU.exe
  2⤵
  PID:11804
- C:\Windows\System\fQdXFDx.exe
  C:\Windows\System\fQdXFDx.exe
  2⤵
  PID:11916
- C:\Windows\System\nSWcLCf.exe
  C:\Windows\System\nSWcLCf.exe
  2⤵
  PID:9548
- C:\Windows\System\ZJkpxWC.exe
  C:\Windows\System\ZJkpxWC.exe
  2⤵
  PID:10644
- C:\Windows\System\ZljtDPj.exe
  C:\Windows\System\ZljtDPj.exe
  2⤵
  PID:11336
- C:\Windows\System\nqwoYsW.exe
  C:\Windows\System\nqwoYsW.exe
  2⤵
  PID:8408
- C:\Windows\System\KVaFdIK.exe
  C:\Windows\System\KVaFdIK.exe
  2⤵
  PID:11724
- C:\Windows\System\SZwScos.exe
  C:\Windows\System\SZwScos.exe
  2⤵
  PID:12124
- C:\Windows\System\tZVMYmq.exe
  C:\Windows\System\tZVMYmq.exe
  2⤵
  PID:12184
- C:\Windows\System\jDRJVCZ.exe
  C:\Windows\System\jDRJVCZ.exe
  2⤵
  PID:11756
- C:\Windows\System\JFzfIhf.exe
  C:\Windows\System\JFzfIhf.exe
  2⤵
  PID:12240
- C:\Windows\System\qfRsxVo.exe
  C:\Windows\System\qfRsxVo.exe
  2⤵
  PID:11772
- C:\Windows\System\OasinQu.exe
  C:\Windows\System\OasinQu.exe
  2⤵
  PID:11844
- C:\Windows\System\hZGlCxM.exe
  C:\Windows\System\hZGlCxM.exe
  2⤵
  PID:12292
- C:\Windows\System\jZlyRFJ.exe
  C:\Windows\System\jZlyRFJ.exe
  2⤵
  PID:12308
- C:\Windows\System\KQHpAnQ.exe
  C:\Windows\System\KQHpAnQ.exe
  2⤵
  PID:12328
- C:\Windows\System\fQsMsQZ.exe
  C:\Windows\System\fQsMsQZ.exe
  2⤵
  PID:12364
- C:\Windows\System\enPwekk.exe
  C:\Windows\System\enPwekk.exe
  2⤵
  PID:12384
- C:\Windows\System\EuMQIiz.exe
  C:\Windows\System\EuMQIiz.exe
  2⤵
  PID:12408
- C:\Windows\System\FAjQHyk.exe
  C:\Windows\System\FAjQHyk.exe
  2⤵
  PID:12452
- C:\Windows\System\bmhIPFU.exe
  C:\Windows\System\bmhIPFU.exe
  2⤵
  PID:12504
- C:\Windows\System\ESfgKtH.exe
  C:\Windows\System\ESfgKtH.exe
  2⤵
  PID:12528
- C:\Windows\System\mpKXAiB.exe
  C:\Windows\System\mpKXAiB.exe
  2⤵
  PID:12548
- C:\Windows\System\vLrvGDM.exe
  C:\Windows\System\vLrvGDM.exe
  2⤵
  PID:12572
- C:\Windows\System\RbOaPCv.exe
  C:\Windows\System\RbOaPCv.exe
  2⤵
  PID:12600
- C:\Windows\System\IBUHXsN.exe
  C:\Windows\System\IBUHXsN.exe
  2⤵
  PID:12628
- C:\Windows\System\yVgENTP.exe
  C:\Windows\System\yVgENTP.exe
  2⤵
  PID:12648
- C:\Windows\System\VjuMvzL.exe
  C:\Windows\System\VjuMvzL.exe
  2⤵
  PID:12672
- C:\Windows\System\XOnfzbh.exe
  C:\Windows\System\XOnfzbh.exe
  2⤵
  PID:12700
- C:\Windows\System\DEeUxoM.exe
  C:\Windows\System\DEeUxoM.exe
  2⤵
  PID:12720
- C:\Windows\System\fwQdeOh.exe
  C:\Windows\System\fwQdeOh.exe
  2⤵
  PID:12744
- C:\Windows\System\vHlohTL.exe
  C:\Windows\System\vHlohTL.exe
  2⤵
  PID:12764
- C:\Windows\System\pZftmpY.exe
  C:\Windows\System\pZftmpY.exe
  2⤵
  PID:12788
- C:\Windows\System\OMMUqDB.exe
  C:\Windows\System\OMMUqDB.exe
  2⤵
  PID:12812
- C:\Windows\System\ncIKZWy.exe
  C:\Windows\System\ncIKZWy.exe
  2⤵
  PID:12836
- C:\Windows\System\gDDIKPc.exe
  C:\Windows\System\gDDIKPc.exe
  2⤵
  PID:12868
- C:\Windows\System\VEcrMzT.exe
  C:\Windows\System\VEcrMzT.exe
  2⤵
  PID:12884
- C:\Windows\System\FAMQMxV.exe
  C:\Windows\System\FAMQMxV.exe
  2⤵
  PID:12908
- C:\Windows\System\lFJwlxa.exe
  C:\Windows\System\lFJwlxa.exe
  2⤵
  PID:12928
- C:\Windows\System\oWoKcHL.exe
  C:\Windows\System\oWoKcHL.exe
  2⤵
  PID:12948
- C:\Windows\System\lvooUgf.exe
  C:\Windows\System\lvooUgf.exe
  2⤵
  PID:12968
- C:\Windows\System\UXRXlQD.exe
  C:\Windows\System\UXRXlQD.exe
  2⤵
  PID:12992
- C:\Windows\System\UKRlVJQ.exe
  C:\Windows\System\UKRlVJQ.exe
  2⤵
  PID:13012
- C:\Windows\System\mMmBAIY.exe
  C:\Windows\System\mMmBAIY.exe
  2⤵
  PID:13032
- C:\Windows\System\rcQOxvi.exe
  C:\Windows\System\rcQOxvi.exe
  2⤵
  PID:13052
- C:\Windows\System\ONaZQII.exe
  C:\Windows\System\ONaZQII.exe
  2⤵
  PID:13072
- C:\Windows\System\ysbloIE.exe
  C:\Windows\System\ysbloIE.exe
  2⤵
  PID:13088
- C:\Windows\System\EtstObB.exe
  C:\Windows\System\EtstObB.exe
  2⤵
  PID:13112
- C:\Windows\System\ryEVQmP.exe
  C:\Windows\System\ryEVQmP.exe
  2⤵
  PID:13128
- C:\Windows\System\SzSxIpB.exe
  C:\Windows\System\SzSxIpB.exe
  2⤵
  PID:13148
- C:\Windows\System\tpTldsM.exe
  C:\Windows\System\tpTldsM.exe
  2⤵
  PID:13172
- C:\Windows\System\FacZcrr.exe
  C:\Windows\System\FacZcrr.exe
  2⤵
  PID:12624
- C:\Windows\System\JDdiaYk.exe
  C:\Windows\System\JDdiaYk.exe
  2⤵
  PID:12668
- C:\Windows\System\QILarzm.exe
  C:\Windows\System\QILarzm.exe
  2⤵
  PID:12760
- C:\Windows\System\KabPBrO.exe
  C:\Windows\System\KabPBrO.exe
  2⤵
  PID:13208
- C:\Windows\System\XgfDghW.exe
  C:\Windows\System\XgfDghW.exe
  2⤵
  PID:12860
- C:\Windows\System\cAVhltV.exe
  C:\Windows\System\cAVhltV.exe
  2⤵
  PID:12892
- C:\Windows\System\BjzsWRQ.exe
  C:\Windows\System\BjzsWRQ.exe
  2⤵
  PID:13308
- C:\Windows\System\pLzDyxL.exe
  C:\Windows\System\pLzDyxL.exe
  2⤵
  PID:13136
- C:\Windows\System\faUkkVM.exe
  C:\Windows\System\faUkkVM.exe
  2⤵
  PID:2588
- C:\Windows\System\ggXNYhx.exe
  C:\Windows\System\ggXNYhx.exe
  2⤵
  PID:12808
- C:\Windows\System\bozVmRE.exe
  C:\Windows\System\bozVmRE.exe
  2⤵
  PID:2252
- C:\Windows\System\JiAFRDv.exe
  C:\Windows\System\JiAFRDv.exe
  2⤵
  PID:3532
- C:\Windows\System\aZZxMNg.exe
  C:\Windows\System\aZZxMNg.exe
  2⤵
  PID:12824
- C:\Windows\System\uTPAbmA.exe
  C:\Windows\System\uTPAbmA.exe
  2⤵
  PID:4732
- C:\Windows\System\mAfNsXr.exe
  C:\Windows\System\mAfNsXr.exe
  2⤵
  PID:3716
- C:\Windows\System\FkWhszw.exe
  C:\Windows\System\FkWhszw.exe
  2⤵
  PID:13184
- C:\Windows\System\zkMyHDJ.exe
  C:\Windows\System\zkMyHDJ.exe
  2⤵
  PID:12900
- C:\Windows\System\kCDrsCY.exe
  C:\Windows\System\kCDrsCY.exe
  2⤵
  PID:13096
- C:\Windows\System\gUJJWHY.exe
  C:\Windows\System\gUJJWHY.exe
  2⤵
  PID:13280
- C:\Windows\System\jUUeuxd.exe
  C:\Windows\System\jUUeuxd.exe
  2⤵
  PID:3004
- C:\Windows\System\TSeQugO.exe
  C:\Windows\System\TSeQugO.exe
  2⤵
  PID:12320
- C:\Windows\System\QeWphDf.exe
  C:\Windows\System\QeWphDf.exe
  2⤵
  PID:4040
- C:\Windows\System\GhckErT.exe
  C:\Windows\System\GhckErT.exe
  2⤵
  PID:4976
- C:\Windows\System\XhBnEpP.exe
  C:\Windows\System\XhBnEpP.exe
  2⤵
  PID:13064
- C:\Windows\System\wmFdcgG.exe
  C:\Windows\System\wmFdcgG.exe
  2⤵
  PID:2984
- C:\Windows\System\MDuLSxy.exe
  C:\Windows\System\MDuLSxy.exe
  2⤵
  PID:4468
- C:\Windows\System\JrvhEzc.exe
  C:\Windows\System\JrvhEzc.exe
  2⤵
  PID:10396
- C:\Windows\System\eWFZAQa.exe
  C:\Windows\System\eWFZAQa.exe
  2⤵
  PID:1600
- C:\Windows\System\rMCGcdm.exe
  C:\Windows\System\rMCGcdm.exe
  2⤵
  PID:13080
- C:\Windows\System\GHmlsgV.exe
  C:\Windows\System\GHmlsgV.exe
  2⤵
  PID:3544
- C:\Windows\System\PKQUmNB.exe
  C:\Windows\System\PKQUmNB.exe
  2⤵
  PID:4972
- C:\Windows\System\RnHitRv.exe
  C:\Windows\System\RnHitRv.exe
  2⤵
  PID:2976
- C:\Windows\System\MdSoneZ.exe
  C:\Windows\System\MdSoneZ.exe
  2⤵
  PID:3932
- C:\Windows\System\NmMjiHU.exe
  C:\Windows\System\NmMjiHU.exe
  2⤵
  PID:6696
- C:\Windows\System\oNBQTwa.exe
  C:\Windows\System\oNBQTwa.exe
  2⤵
  PID:4384
- C:\Windows\System\iWjWaDI.exe
  C:\Windows\System\iWjWaDI.exe
  2⤵
  PID:1752
- C:\Windows\System\pjewfSt.exe
  C:\Windows\System\pjewfSt.exe
  2⤵
  PID:1336
- C:\Windows\System\rhOOaxx.exe
  C:\Windows\System\rhOOaxx.exe
  2⤵
  PID:888
- C:\Windows\System\fsCPluj.exe
  C:\Windows\System\fsCPluj.exe
  2⤵
  PID:6680
- C:\Windows\System\IiXwUHW.exe
  C:\Windows\System\IiXwUHW.exe
  2⤵
  PID:13256
- C:\Windows\System\vqzJtpr.exe
  C:\Windows\System\vqzJtpr.exe
  2⤵
  PID:5208
- C:\Windows\System\sTJaDlO.exe
  C:\Windows\System\sTJaDlO.exe
  2⤵
  PID:6880
- C:\Windows\System\JNrTTVN.exe
  C:\Windows\System\JNrTTVN.exe
  2⤵
  PID:6980
- C:\Windows\System\JPjMaxY.exe
  C:\Windows\System\JPjMaxY.exe
  2⤵
  PID:6064
- C:\Windows\System\mkngdZE.exe
  C:\Windows\System\mkngdZE.exe
  2⤵
  PID:5728
- C:\Windows\System\HUMiZuL.exe
  C:\Windows\System\HUMiZuL.exe
  2⤵
  PID:2160
- C:\Windows\System\OFtmczb.exe
  C:\Windows\System\OFtmczb.exe
  2⤵
  PID:4920
- C:\Windows\System\rSxdpjn.exe
  C:\Windows\System\rSxdpjn.exe
  2⤵
  PID:5600
- C:\Windows\System\fUSQPav.exe
  C:\Windows\System\fUSQPav.exe
  2⤵
  PID:5316
- C:\Windows\System\eoSfZOv.exe
  C:\Windows\System\eoSfZOv.exe
  2⤵
  PID:5800
- C:\Windows\System\SWusFny.exe
  C:\Windows\System\SWusFny.exe
  2⤵
  PID:5320
- C:\Windows\System\hQeNeyB.exe
  C:\Windows\System\hQeNeyB.exe
  2⤵
  PID:13320
- C:\Windows\System\AgCFega.exe
  C:\Windows\System\AgCFega.exe
  2⤵
  PID:13344
- C:\Windows\System\WZerSFS.exe
  C:\Windows\System\WZerSFS.exe
  2⤵
  PID:13360
- C:\Windows\System\pcJiRWU.exe
  C:\Windows\System\pcJiRWU.exe
  2⤵
  PID:13380
- C:\Windows\System\CSXmnlr.exe
  C:\Windows\System\CSXmnlr.exe
  2⤵
  PID:13396
- C:\Windows\System\evWtQVT.exe
  C:\Windows\System\evWtQVT.exe
  2⤵
  PID:13416
- C:\Windows\System\pxadnwY.exe
  C:\Windows\System\pxadnwY.exe
  2⤵
  PID:13432
- C:\Windows\System\rPTRldX.exe
  C:\Windows\System\rPTRldX.exe
  2⤵
  PID:13448
- C:\Windows\System\RZnBcwh.exe
  C:\Windows\System\RZnBcwh.exe
  2⤵
  PID:13464
- C:\Windows\System\xbtGhcz.exe
  C:\Windows\System\xbtGhcz.exe
  2⤵
  PID:13480
- C:\Windows\System\OmZUETG.exe
  C:\Windows\System\OmZUETG.exe
  2⤵
  PID:13496
- C:\Windows\System\WuXNzjm.exe
  C:\Windows\System\WuXNzjm.exe
  2⤵
  PID:13516
- C:\Windows\System\UORfNld.exe
  C:\Windows\System\UORfNld.exe
  2⤵
  PID:13536
- C:\Windows\System\QdZFBib.exe
  C:\Windows\System\QdZFBib.exe
  2⤵
  PID:13556
- C:\Windows\System\fFmSgtM.exe
  C:\Windows\System\fFmSgtM.exe
  2⤵
  PID:13576
- C:\Windows\System\OnPWEhL.exe
  C:\Windows\System\OnPWEhL.exe
  2⤵
  PID:13592
- C:\Windows\System\ilvnhDE.exe
  C:\Windows\System\ilvnhDE.exe
  2⤵
  PID:13608
- C:\Windows\System\lqGDOIZ.exe
  C:\Windows\System\lqGDOIZ.exe
  2⤵
  PID:13628
- C:\Windows\System\OzLuQxw.exe
  C:\Windows\System\OzLuQxw.exe
  2⤵
  PID:13644
- C:\Windows\System\ttPOMkr.exe
  C:\Windows\System\ttPOMkr.exe
  2⤵
  PID:13660
- C:\Windows\System\NCWJujC.exe
  C:\Windows\System\NCWJujC.exe
  2⤵
  PID:13740
- C:\Windows\System\GGqwlWx.exe
  C:\Windows\System\GGqwlWx.exe
  2⤵
  PID:13760
- C:\Windows\System\vyNCCti.exe
  C:\Windows\System\vyNCCti.exe
  2⤵
  PID:13788
- C:\Windows\System\TXsddqN.exe
  C:\Windows\System\TXsddqN.exe
  2⤵
  PID:13812
- C:\Windows\System\hHmIcGD.exe
  C:\Windows\System\hHmIcGD.exe
  2⤵
  PID:13836
- C:\Windows\System\mGiglnQ.exe
  C:\Windows\System\mGiglnQ.exe
  2⤵
  PID:13864
- C:\Windows\System\WaCrSYO.exe
  C:\Windows\System\WaCrSYO.exe
  2⤵
  PID:13880
- C:\Windows\System\xETIzAF.exe
  C:\Windows\System\xETIzAF.exe
  2⤵
  PID:13904
- C:\Windows\System\ygWLayP.exe
  C:\Windows\System\ygWLayP.exe
  2⤵
  PID:13928
- C:\Windows\System\CWzYQsb.exe
  C:\Windows\System\CWzYQsb.exe
  2⤵
  PID:13952
- C:\Windows\System\VKTyiwH.exe
  C:\Windows\System\VKTyiwH.exe
  2⤵
  PID:13972
- C:\Windows\System\GAdHnVn.exe
  C:\Windows\System\GAdHnVn.exe
  2⤵
  PID:13992
- C:\Windows\System\ltSAIhd.exe
  C:\Windows\System\ltSAIhd.exe
  2⤵
  PID:14012
- C:\Windows\System\auKKgCl.exe
  C:\Windows\System\auKKgCl.exe
  2⤵
  PID:14040
- C:\Windows\System\jZZGkRF.exe
  C:\Windows\System\jZZGkRF.exe
  2⤵
  PID:14064
- C:\Windows\System\NxbaQYB.exe
  C:\Windows\System\NxbaQYB.exe
  2⤵
  PID:14084
- C:\Windows\System\lwmzRry.exe
  C:\Windows\System\lwmzRry.exe
  2⤵
  PID:14104
- C:\Windows\System\KZWTlkt.exe
  C:\Windows\System\KZWTlkt.exe
  2⤵
  PID:14136
- C:\Windows\System\BJzQNJg.exe
  C:\Windows\System\BJzQNJg.exe
  2⤵
  PID:14240
- C:\Windows\System\fIFteBo.exe
  C:\Windows\System\fIFteBo.exe
  2⤵
  PID:14256
- C:\Windows\System\JRaVzNQ.exe
  C:\Windows\System\JRaVzNQ.exe
  2⤵
  PID:14272
- C:\Windows\System\WTLOjps.exe
  C:\Windows\System\WTLOjps.exe
  2⤵
  PID:5736
- C:\Windows\System\Acvxflo.exe
  C:\Windows\System\Acvxflo.exe
  2⤵
  PID:4684
- C:\Windows\System\zRBgIEX.exe
  C:\Windows\System\zRBgIEX.exe
  2⤵
  PID:13352
- C:\Windows\System\GaQerDR.exe
  C:\Windows\System\GaQerDR.exe
  2⤵
  PID:13680
- C:\Windows\System\NNZfpXQ.exe
  C:\Windows\System\NNZfpXQ.exe
  2⤵
  PID:6204
- C:\Windows\System\OfAuxbY.exe
  C:\Windows\System\OfAuxbY.exe
  2⤵
  PID:13600
- C:\Windows\System\oTsPtoa.exe
  C:\Windows\System\oTsPtoa.exe
  2⤵
  PID:6908
- C:\Windows\System\agToTUs.exe
  C:\Windows\System\agToTUs.exe
  2⤵
  PID:13640
- C:\Windows\System\XEFxpRF.exe
  C:\Windows\System\XEFxpRF.exe
  2⤵
  PID:5168
- C:\Windows\System\hHlpSmV.exe
  C:\Windows\System\hHlpSmV.exe
  2⤵
  PID:13724
- C:\Windows\System\cvbMVKd.exe
  C:\Windows\System\cvbMVKd.exe
  2⤵
  PID:6188
- C:\Windows\System\MugViPj.exe
  C:\Windows\System\MugViPj.exe
  2⤵
  PID:13756
- C:\Windows\System\WaVHmvJ.exe
  C:\Windows\System\WaVHmvJ.exe
  2⤵
  PID:13784
- C:\Windows\System\OwakiZv.exe
  C:\Windows\System\OwakiZv.exe
  2⤵
  PID:13844
- C:\Windows\System\tdYufbz.exe
  C:\Windows\System\tdYufbz.exe
  2⤵
  PID:13944
- C:\Windows\System\oyEbrCw.exe
  C:\Windows\System\oyEbrCw.exe
  2⤵
  PID:14080
- C:\Windows\System\jexrwVW.exe
  C:\Windows\System\jexrwVW.exe
  2⤵
  PID:5504
- C:\Windows\System\BRthjnN.exe
  C:\Windows\System\BRthjnN.exe
  2⤵
  PID:14252
- C:\Windows\System\EEBefXS.exe
  C:\Windows\System\EEBefXS.exe
  2⤵
  PID:2248
- C:\Windows\System\nlpEvSX.exe
  C:\Windows\System\nlpEvSX.exe
  2⤵
  PID:2012
- C:\Windows\System\obMybnc.exe
  C:\Windows\System\obMybnc.exe
  2⤵
  PID:6208
- C:\Windows\System\vpfsous.exe
  C:\Windows\System\vpfsous.exe
  2⤵
  PID:4352
- C:\Windows\System\ukJCtUM.exe
  C:\Windows\System\ukJCtUM.exe
  2⤵
  PID:14116
- C:\Windows\System\oZhlCfC.exe
  C:\Windows\System\oZhlCfC.exe
  2⤵
  PID:2632
- C:\Windows\System\ruVYrpl.exe
  C:\Windows\System\ruVYrpl.exe
  2⤵
  PID:2680
- C:\Windows\System\RomGewN.exe
  C:\Windows\System\RomGewN.exe
  2⤵
  PID:13524
- C:\Windows\System\KZSwbVd.exe
  C:\Windows\System\KZSwbVd.exe
  2⤵
  PID:13156
- C:\Windows\System\clytlVc.exe
  C:\Windows\System\clytlVc.exe
  2⤵
  PID:5972
- C:\Windows\System\wOYyLeL.exe
  C:\Windows\System\wOYyLeL.exe
  2⤵
  PID:5920
- C:\Windows\System\qXraijv.exe
  C:\Windows\System\qXraijv.exe
  2⤵
  PID:13024
- C:\Windows\System\VgvsmXL.exe
  C:\Windows\System\VgvsmXL.exe
  2⤵
  PID:13584
- C:\Windows\System\GhJrsiF.exe
  C:\Windows\System\GhJrsiF.exe
  2⤵
  PID:1568
- C:\Windows\System\CWifmBH.exe
  C:\Windows\System\CWifmBH.exe
  2⤵
  PID:4152
- C:\Windows\System\zTnyCbY.exe
  C:\Windows\System\zTnyCbY.exe
  2⤵
  PID:828
- C:\Windows\System\gMzTcZa.exe
  C:\Windows\System\gMzTcZa.exe
  2⤵
  PID:13636
- C:\Windows\System\rPDBUtv.exe
  C:\Windows\System\rPDBUtv.exe
  2⤵
  PID:14112
- C:\Windows\System\ODRQtge.exe
  C:\Windows\System\ODRQtge.exe
  2⤵
  PID:13800
- C:\Windows\System\yFoKixf.exe
  C:\Windows\System\yFoKixf.exe
  2⤵
  PID:13832
- C:\Windows\System\frtkVAq.exe
  C:\Windows\System\frtkVAq.exe
  2⤵
  PID:5888
- C:\Windows\System\BrxshIK.exe
  C:\Windows\System\BrxshIK.exe
  2⤵
  PID:5804
- C:\Windows\System\iCdHvuV.exe
  C:\Windows\System\iCdHvuV.exe
  2⤵
  PID:5968
- C:\Windows\System\jykBgwn.exe
  C:\Windows\System\jykBgwn.exe
  2⤵
  PID:14100
- C:\Windows\System\wfsxDqv.exe
  C:\Windows\System\wfsxDqv.exe
  2⤵
  PID:14308
- C:\Windows\System\VWyQyHv.exe
  C:\Windows\System\VWyQyHv.exe
  2⤵
  PID:12544
- C:\Windows\System\kFvbAMU.exe
  C:\Windows\System\kFvbAMU.exe
  2⤵
  PID:13368
- C:\Windows\System\dRdenFJ.exe
  C:\Windows\System\dRdenFJ.exe
  2⤵
  PID:14224
- C:\Windows\System\PHaGUjm.exe
  C:\Windows\System\PHaGUjm.exe
  2⤵
  PID:2308
- C:\Windows\System\XIHUHTZ.exe
  C:\Windows\System\XIHUHTZ.exe
  2⤵
  PID:2452
- C:\Windows\System\nezsdKL.exe
  C:\Windows\System\nezsdKL.exe
  2⤵
  PID:14284
- C:\Windows\System\VLralxG.exe
  C:\Windows\System\VLralxG.exe
  2⤵
  PID:6552
- C:\Windows\System\qiFqvzX.exe
  C:\Windows\System\qiFqvzX.exe
  2⤵
  PID:13000
- C:\Windows\System\RfffwVu.exe
  C:\Windows\System\RfffwVu.exe
  2⤵
  PID:6640
- C:\Windows\System\AnsDZYD.exe
  C:\Windows\System\AnsDZYD.exe
  2⤵
  PID:5796
- C:\Windows\System\UCdsMmE.exe
  C:\Windows\System\UCdsMmE.exe
  2⤵
  PID:6316
- C:\Windows\System\DfwGIgm.exe
  C:\Windows\System\DfwGIgm.exe
  2⤵
  PID:14092
- C:\Windows\System\lnuSCHd.exe
  C:\Windows\System\lnuSCHd.exe
  2⤵
  PID:2796
- C:\Windows\System\NZausbD.exe
  C:\Windows\System\NZausbD.exe
  2⤵
  PID:1788
- C:\Windows\System\UKrUjin.exe
  C:\Windows\System\UKrUjin.exe
  2⤵
  PID:5564
- C:\Windows\System\OFHjYCk.exe
  C:\Windows\System\OFHjYCk.exe
  2⤵
  PID:6816
- C:\Windows\System\Gdtzsjl.exe
  C:\Windows\System\Gdtzsjl.exe
  2⤵
  PID:13372
- C:\Windows\System\wReCTmd.exe
  C:\Windows\System\wReCTmd.exe
  2⤵
  PID:12336
- C:\Windows\System\bNLnIxz.exe
  C:\Windows\System\bNLnIxz.exe
  2⤵
  PID:6268
- C:\Windows\System\uiAwqev.exe
  C:\Windows\System\uiAwqev.exe
  2⤵
  PID:6720
- C:\Windows\System\rdPfKOp.exe
  C:\Windows\System\rdPfKOp.exe
  2⤵
  PID:14348
- C:\Windows\System\JNmVSvT.exe
  C:\Windows\System\JNmVSvT.exe
  2⤵
  PID:14364
- C:\Windows\System\ddEQQbH.exe
  C:\Windows\System\ddEQQbH.exe
  2⤵
  PID:14388
- C:\Windows\System\LqftYns.exe
  C:\Windows\System\LqftYns.exe
  2⤵
  PID:14412
- C:\Windows\System\JQVbAKf.exe
  C:\Windows\System\JQVbAKf.exe
  2⤵
  PID:14428
- C:\Windows\System\ddJNseI.exe
  C:\Windows\System\ddJNseI.exe
  2⤵
  PID:14472
- C:\Windows\System\YIBGUgB.exe
  C:\Windows\System\YIBGUgB.exe
  2⤵
  PID:14488
- C:\Windows\System\ORmKNcm.exe
  C:\Windows\System\ORmKNcm.exe
  2⤵
  PID:14536
- C:\Windows\System\kQWGfnF.exe
  C:\Windows\System\kQWGfnF.exe
  2⤵
  PID:14552
- C:\Windows\System\vVTGtfP.exe
  C:\Windows\System\vVTGtfP.exe
  2⤵
  PID:14572
- C:\Windows\System\xbOzLTV.exe
  C:\Windows\System\xbOzLTV.exe
  2⤵
  PID:14592
- C:\Windows\System\glxCcFL.exe
  C:\Windows\System\glxCcFL.exe
  2⤵
  PID:14612
- C:\Windows\System\JumWswN.exe
  C:\Windows\System\JumWswN.exe
  2⤵
  PID:14636
- C:\Windows\System\RhydXqx.exe
  C:\Windows\System\RhydXqx.exe
  2⤵
  PID:14668
- C:\Windows\System\rAAvvOi.exe
  C:\Windows\System\rAAvvOi.exe
  2⤵
  PID:14708
- C:\Windows\System\MZUAqLx.exe
  C:\Windows\System\MZUAqLx.exe
  2⤵
  PID:14724
- C:\Windows\System\mZDNQrw.exe
  C:\Windows\System\mZDNQrw.exe
  2⤵
  PID:14748
- C:\Windows\System\easdDno.exe
  C:\Windows\System\easdDno.exe
  2⤵
  PID:14804
- C:\Windows\System\TXTVXCx.exe
  C:\Windows\System\TXTVXCx.exe
  2⤵
  PID:14824
- C:\Windows\System\RiROSYG.exe
  C:\Windows\System\RiROSYG.exe
  2⤵
  PID:14860
- C:\Windows\System\eERCaYW.exe
  C:\Windows\System\eERCaYW.exe
  2⤵
  PID:14876
- C:\Windows\System\ztSRjop.exe
  C:\Windows\System\ztSRjop.exe
  2⤵
  PID:14896
- C:\Windows\System\BvVJLQY.exe
  C:\Windows\System\BvVJLQY.exe
  2⤵
  PID:14920
- C:\Windows\System\nDOiFsF.exe
  C:\Windows\System\nDOiFsF.exe
  2⤵
  PID:14944
- C:\Windows\System\XEajjFI.exe
  C:\Windows\System\XEajjFI.exe
  2⤵
  PID:14964
- C:\Windows\System\aesilqr.exe
  C:\Windows\System\aesilqr.exe
  2⤵
  PID:14980
- C:\Windows\System\JKJWOGM.exe
  C:\Windows\System\JKJWOGM.exe
  2⤵
  PID:14996
- C:\Windows\System\RqEiFIj.exe
  C:\Windows\System\RqEiFIj.exe
  2⤵
  PID:15024
- C:\Windows\System\PYwDkZm.exe
  C:\Windows\System\PYwDkZm.exe
  2⤵
  PID:15048
- C:\Windows\System\ePALIhT.exe
  C:\Windows\System\ePALIhT.exe
  2⤵
  PID:15064
- C:\Windows\System\xjSDbvJ.exe
  C:\Windows\System\xjSDbvJ.exe
  2⤵
  PID:15108
- C:\Windows\System\gsrvXZB.exe
  C:\Windows\System\gsrvXZB.exe
  2⤵
  PID:15124
- C:\Windows\System\HVVHEZJ.exe
  C:\Windows\System\HVVHEZJ.exe
  2⤵
  PID:15164
- C:\Windows\System\AqaCEQS.exe
  C:\Windows\System\AqaCEQS.exe
  2⤵
  PID:15256
- C:\Windows\System\MMCWWlb.exe
  C:\Windows\System\MMCWWlb.exe
  2⤵
  PID:15276
- C:\Windows\System\dNALOxj.exe
  C:\Windows\System\dNALOxj.exe
  2⤵
  PID:15308
- C:\Windows\System\wUcgiZs.exe
  C:\Windows\System\wUcgiZs.exe
  2⤵
  PID:4592
- C:\Windows\System\rkbefpI.exe
  C:\Windows\System\rkbefpI.exe
  2⤵
  PID:6384
- C:\Windows\System\FOHyjpi.exe
  C:\Windows\System\FOHyjpi.exe
  2⤵
  PID:13712
- C:\Windows\System\zJwqtGW.exe
  C:\Windows\System\zJwqtGW.exe
  2⤵
  PID:7004
- C:\Windows\System\nzzzTEK.exe
  C:\Windows\System\nzzzTEK.exe
  2⤵
  PID:14560
- C:\Windows\System\ZdrfIMT.exe
  C:\Windows\System\ZdrfIMT.exe
  2⤵
  PID:14588
- C:\Windows\System\XzLZPCN.exe
  C:\Windows\System\XzLZPCN.exe
  2⤵
  PID:7380
- C:\Windows\System\aKcrjok.exe
  C:\Windows\System\aKcrjok.exe
  2⤵
  PID:14644
- C:\Windows\System\IiZZcqM.exe
  C:\Windows\System\IiZZcqM.exe
  2⤵
  PID:14892
- C:\Windows\System\drzuANF.exe
  C:\Windows\System\drzuANF.exe
  2⤵
  PID:14544
- C:\Windows\System\nmMvnAr.exe
  C:\Windows\System\nmMvnAr.exe
  2⤵
  PID:15044
- C:\Windows\System\vKlIGdQ.exe
  C:\Windows\System\vKlIGdQ.exe
  2⤵
  PID:14784
- C:\Windows\System\fGdfZPM.exe
  C:\Windows\System\fGdfZPM.exe
  2⤵
  PID:14816
- C:\Windows\System\GSZTgQp.exe
  C:\Windows\System\GSZTgQp.exe
  2⤵
  PID:14844
- C:\Windows\System\nSOQPqX.exe
  C:\Windows\System\nSOQPqX.exe
  2⤵
  PID:14884
- C:\Windows\System\xqKnvSD.exe
  C:\Windows\System\xqKnvSD.exe
  2⤵
  PID:14792
- C:\Windows\System\TpEPOZe.exe
  C:\Windows\System\TpEPOZe.exe
  2⤵
  PID:15136
- C:\Windows\System\PaUoLpn.exe
  C:\Windows\System\PaUoLpn.exe
  2⤵
  PID:15192
- C:\Windows\System\YxAREDS.exe
  C:\Windows\System\YxAREDS.exe
  2⤵
  PID:14932
- C:\Windows\System\OOUiOuX.exe
  C:\Windows\System\OOUiOuX.exe
  2⤵
  PID:14976
- C:\Windows\System\gsJBqPT.exe
  C:\Windows\System\gsJBqPT.exe
  2⤵
  PID:15352
- C:\Windows\System\fJdWcsP.exe
  C:\Windows\System\fJdWcsP.exe
  2⤵
  PID:7204
- C:\Windows\System\VsulKTi.exe
  C:\Windows\System\VsulKTi.exe
  2⤵
  PID:6432
- C:\Windows\System\RRmRVEV.exe
  C:\Windows\System\RRmRVEV.exe
  2⤵
  PID:7312
- C:\Windows\System\DgbLgkW.exe
  C:\Windows\System\DgbLgkW.exe
  2⤵
  PID:5312
- C:\Windows\System\wvXULjE.exe
  C:\Windows\System\wvXULjE.exe
  2⤵
  PID:15188
- C:\Windows\System\KbPPBkz.exe
  C:\Windows\System\KbPPBkz.exe
  2⤵
  PID:15240
- C:\Windows\System\kklTcRN.exe
  C:\Windows\System\kklTcRN.exe
  2⤵
  PID:15296
- C:\Windows\System\EGGrvGt.exe
  C:\Windows\System\EGGrvGt.exe
  2⤵
  PID:15324
- C:\Windows\System\bYvbaAe.exe
  C:\Windows\System\bYvbaAe.exe
  2⤵
  PID:6808
- C:\Windows\System\uHmkrUn.exe
  C:\Windows\System\uHmkrUn.exe
  2⤵
  PID:8168
- C:\Windows\System\omNfUUJ.exe
  C:\Windows\System\omNfUUJ.exe
  2⤵
  PID:6748
- C:\Windows\System\iUPFnsw.exe
  C:\Windows\System\iUPFnsw.exe
  2⤵
  PID:6036
- C:\Windows\System\PbQSGZy.exe
  C:\Windows\System\PbQSGZy.exe
  2⤵
  PID:8200
- C:\Windows\System\zGTRbHd.exe
  C:\Windows\System\zGTRbHd.exe
  2⤵
  PID:6856
- C:\Windows\System\TuGiYtf.exe
  C:\Windows\System\TuGiYtf.exe
  2⤵
  PID:6724
- C:\Windows\System\bBsOiLM.exe
  C:\Windows\System\bBsOiLM.exe
  2⤵
  PID:7636
- C:\Windows\System\APKzQFy.exe
  C:\Windows\System\APKzQFy.exe
  2⤵
  PID:7720
- C:\Windows\System\gsEZeJv.exe
  C:\Windows\System\gsEZeJv.exe
  2⤵
  PID:7228
- C:\Windows\System\dratnPM.exe
  C:\Windows\System\dratnPM.exe
  2⤵
  PID:7784
- C:\Windows\System\YpJvOAm.exe
  C:\Windows\System\YpJvOAm.exe
  2⤵
  PID:7940
- C:\Windows\System\BSoqcjf.exe
  C:\Windows\System\BSoqcjf.exe
  2⤵
  PID:6648
- C:\Windows\System\ttZjihJ.exe
  C:\Windows\System\ttZjihJ.exe
  2⤵
  PID:14072
- C:\Windows\System\XAKtKZx.exe
  C:\Windows\System\XAKtKZx.exe
  2⤵
  PID:14456
- C:\Windows\System\vZnQSRm.exe
  C:\Windows\System\vZnQSRm.exe
  2⤵
  PID:4632
- C:\Windows\System\OGqSHHl.exe
  C:\Windows\System\OGqSHHl.exe
  2⤵
  PID:14500
- C:\Windows\System\mHmpjJZ.exe
  C:\Windows\System\mHmpjJZ.exe
  2⤵
  PID:14684
- C:\Windows\System\EjcPsSH.exe
  C:\Windows\System\EjcPsSH.exe
  2⤵
  PID:14700
- C:\Windows\System\TcIbSrV.exe
  C:\Windows\System\TcIbSrV.exe
  2⤵
  PID:7736
- C:\Windows\System\yScJxxx.exe
  C:\Windows\System\yScJxxx.exe
  2⤵
  PID:8792
- C:\Windows\System\RygZGPW.exe
  C:\Windows\System\RygZGPW.exe
  2⤵
  PID:14628
- C:\Windows\System\fEYMGcm.exe
  C:\Windows\System\fEYMGcm.exe
  2⤵
  PID:14508
- C:\Windows\System\FYgOQeQ.exe
  C:\Windows\System\FYgOQeQ.exe
  2⤵
  PID:13288
- C:\Windows\System\WjQyicF.exe
  C:\Windows\System\WjQyicF.exe
  2⤵
  PID:7904
- C:\Windows\System\AYaogCt.exe
  C:\Windows\System\AYaogCt.exe
  2⤵
  PID:15316
- C:\Windows\System\gHujeLm.exe
  C:\Windows\System\gHujeLm.exe
  2⤵
  PID:15088
- C:\Windows\System\tzsMIOk.exe
  C:\Windows\System\tzsMIOk.exe
  2⤵
  PID:6688
- C:\Windows\System\RkgWonO.exe
  C:\Windows\System\RkgWonO.exe
  2⤵
  PID:15096
- C:\Windows\System\vVmbsoQ.exe
  C:\Windows\System\vVmbsoQ.exe
  2⤵
  PID:7856
- C:\Windows\System\eZUvaxW.exe
  C:\Windows\System\eZUvaxW.exe
  2⤵
  PID:7352
- C:\Windows\System\FkebJSM.exe
  C:\Windows\System\FkebJSM.exe
  2⤵
  PID:8088
- C:\Windows\System\RqTXyva.exe
  C:\Windows\System\RqTXyva.exe
  2⤵
  PID:8288
- C:\Windows\System\PJgwWPs.exe
  C:\Windows\System\PJgwWPs.exe
  2⤵
  PID:8352
- C:\Windows\System\NYnmCSr.exe
  C:\Windows\System\NYnmCSr.exe
  2⤵
  PID:15116
- C:\Windows\System\LRzPhXW.exe
  C:\Windows\System\LRzPhXW.exe
  2⤵
  PID:15292
- C:\Windows\System\GwpMIaJ.exe
  C:\Windows\System\GwpMIaJ.exe
  2⤵
  PID:7796
- C:\Windows\System\SRQJTkx.exe
  C:\Windows\System\SRQJTkx.exe
  2⤵
  PID:14632
- C:\Windows\System\hgLwNOa.exe
  C:\Windows\System\hgLwNOa.exe
  2⤵
  PID:7664
- C:\Windows\System\szhivuZ.exe
  C:\Windows\System\szhivuZ.exe
  2⤵
  PID:14656
- C:\Windows\System\jguXpCu.exe
  C:\Windows\System\jguXpCu.exe
  2⤵
  PID:6836
- C:\Windows\System\qyPlZgP.exe
  C:\Windows\System\qyPlZgP.exe
  2⤵
  PID:4524
- C:\Windows\System\eVymDHp.exe
  C:\Windows\System\eVymDHp.exe
  2⤵
  PID:8928
- C:\Windows\System\yuAoDhL.exe
  C:\Windows\System\yuAoDhL.exe
  2⤵
  PID:8920
- C:\Windows\System\pVensrb.exe
  C:\Windows\System\pVensrb.exe
  2⤵
  PID:15348
- C:\Windows\System\YvnVGSq.exe
  C:\Windows\System\YvnVGSq.exe
  2⤵
  PID:14836
- C:\Windows\System\RqZowKm.exe
  C:\Windows\System\RqZowKm.exe
  2⤵
  PID:15216
- C:\Windows\System\VxiKDGS.exe
  C:\Windows\System\VxiKDGS.exe
  2⤵
  PID:8024
- C:\Windows\System\YBjakAn.exe
  C:\Windows\System\YBjakAn.exe
  2⤵
  PID:15288
- C:\Windows\System\lpUDgqX.exe
  C:\Windows\System\lpUDgqX.exe
  2⤵
  PID:7924
- C:\Windows\System\CsolSPC.exe
  C:\Windows\System\CsolSPC.exe
  2⤵
  PID:8048
- C:\Windows\System\IvjImEo.exe
  C:\Windows\System\IvjImEo.exe
  2⤵
  PID:7936
- C:\Windows\System\XQEeVOr.exe
  C:\Windows\System\XQEeVOr.exe
  2⤵
  PID:7808
- C:\Windows\System\WRvvGUF.exe
  C:\Windows\System\WRvvGUF.exe
  2⤵
  PID:7764
- C:\Windows\System\rLpWVZh.exe
  C:\Windows\System\rLpWVZh.exe
  2⤵
  PID:9024
- C:\Windows\System\UAFKNOc.exe
  C:\Windows\System\UAFKNOc.exe
  2⤵
  PID:8816
- C:\Windows\System\SatrQTQ.exe
  C:\Windows\System\SatrQTQ.exe
  2⤵
  PID:7612
- C:\Windows\System\WjlaQwq.exe
  C:\Windows\System\WjlaQwq.exe
  2⤵
  PID:8808
- C:\Windows\System\xwExbGl.exe
  C:\Windows\System\xwExbGl.exe
  2⤵
  PID:640
- C:\Windows\System\uDNANvW.exe
  C:\Windows\System\uDNANvW.exe
  2⤵
  PID:9748
- C:\Windows\System\XAVXaNq.exe
  C:\Windows\System\XAVXaNq.exe
  2⤵
  PID:8944
- C:\Windows\System\ynfrwxJ.exe
  C:\Windows\System\ynfrwxJ.exe
  2⤵
  PID:6760
- C:\Windows\System\LMEuEth.exe
  C:\Windows\System\LMEuEth.exe
  2⤵
  PID:7208
- C:\Windows\System\OXXJezg.exe
  C:\Windows\System\OXXJezg.exe
  2⤵
  PID:8492
- C:\Windows\System\pZtbdBd.exe
  C:\Windows\System\pZtbdBd.exe
  2⤵
  PID:14936
- C:\Windows\System\flfueMJ.exe
  C:\Windows\System\flfueMJ.exe
  2⤵
  PID:9236
- C:\Windows\System\PHgGFyC.exe
  C:\Windows\System\PHgGFyC.exe
  2⤵
  PID:8132
- C:\Windows\System\VkvQSLZ.exe
  C:\Windows\System\VkvQSLZ.exe
  2⤵
  PID:14496
- C:\Windows\System\GormjKR.exe
  C:\Windows\System\GormjKR.exe
  2⤵
  PID:9688
- C:\Windows\System\UiFPtQt.exe
  C:\Windows\System\UiFPtQt.exe
  2⤵
  PID:7440
- C:\Windows\System\maxDxPt.exe
  C:\Windows\System\maxDxPt.exe
  2⤵
  PID:9596
- C:\Windows\System\eGkRGRW.exe
  C:\Windows\System\eGkRGRW.exe
  2⤵
  PID:10308
- C:\Windows\System\wxVuLiY.exe
  C:\Windows\System\wxVuLiY.exe
  2⤵
  PID:8340
- C:\Windows\System\SVWfCbc.exe
  C:\Windows\System\SVWfCbc.exe
  2⤵
  PID:10552
- C:\Windows\System\nmwnFEp.exe
  C:\Windows\System\nmwnFEp.exe
  2⤵
  PID:10268
- C:\Windows\System\hjuRYze.exe
  C:\Windows\System\hjuRYze.exe
  2⤵
  PID:10492
- C:\Windows\System\mLdvpGY.exe
  C:\Windows\System\mLdvpGY.exe
  2⤵
  PID:9468
- C:\Windows\System\VaxEWeH.exe
  C:\Windows\System\VaxEWeH.exe
  2⤵
  PID:10536
- C:\Windows\System\QyhlCIc.exe
  C:\Windows\System\QyhlCIc.exe
  2⤵
  PID:10692
- C:\Windows\System\LvgxLlc.exe
  C:\Windows\System\LvgxLlc.exe
  2⤵
  PID:10036
- C:\Windows\System\KBrCNeh.exe
  C:\Windows\System\KBrCNeh.exe
  2⤵
  PID:10272
- C:\Windows\System\nFCuLWs.exe
  C:\Windows\System\nFCuLWs.exe
  2⤵
  PID:11216
- C:\Windows\System\xxXhIET.exe
  C:\Windows\System\xxXhIET.exe
  2⤵
  PID:8544
- C:\Windows\System\paQHuxn.exe
  C:\Windows\System\paQHuxn.exe
  2⤵
  PID:9756
- C:\Windows\System\qmwTyZR.exe
  C:\Windows\System\qmwTyZR.exe
  2⤵
  PID:10336
- C:\Windows\System\QDqUCBe.exe
  C:\Windows\System\QDqUCBe.exe
  2⤵
  PID:9708
- C:\Windows\System\FlhVhyo.exe
  C:\Windows\System\FlhVhyo.exe
  2⤵
  PID:10328
- C:\Windows\System\FTqEWdU.exe
  C:\Windows\System\FTqEWdU.exe
  2⤵
  PID:14732
- C:\Windows\System\cpKbZsd.exe
  C:\Windows\System\cpKbZsd.exe
  2⤵
  PID:8860
- C:\Windows\System\qLBOHlG.exe
  C:\Windows\System\qLBOHlG.exe
  2⤵
  PID:10500
- C:\Windows\System\UtOwtGu.exe
  C:\Windows\System\UtOwtGu.exe
  2⤵
  PID:10764
- C:\Windows\System\PyPQwtB.exe
  C:\Windows\System\PyPQwtB.exe
  2⤵
  PID:9952
- C:\Windows\System\HkPIOdI.exe
  C:\Windows\System\HkPIOdI.exe
  2⤵
  PID:8752
- C:\Windows\System\fkOaHCu.exe
  C:\Windows\System\fkOaHCu.exe
  2⤵
  PID:2892
- C:\Windows\System\QrWNYoY.exe
  C:\Windows\System\QrWNYoY.exe
  2⤵
  PID:9112
- C:\Windows\System\gMzSMqX.exe
  C:\Windows\System\gMzSMqX.exe
  2⤵
  PID:11200
- C:\Windows\System\SfNKJMX.exe
  C:\Windows\System\SfNKJMX.exe
  2⤵
  PID:8868
- C:\Windows\System\KPvTLHV.exe
  C:\Windows\System\KPvTLHV.exe
  2⤵
  PID:6356
- C:\Windows\System\KRWqzHL.exe
  C:\Windows\System\KRWqzHL.exe
  2⤵
  PID:15248
- C:\Windows\System\rTipbOa.exe
  C:\Windows\System\rTipbOa.exe
  2⤵
  PID:10856
- C:\Windows\System\ztEJaGh.exe
  C:\Windows\System\ztEJaGh.exe
  2⤵
  PID:11052
- C:\Windows\System\UHztDyy.exe
  C:\Windows\System\UHztDyy.exe
  2⤵
  PID:10444
- C:\Windows\System\tCEzBGL.exe
  C:\Windows\System\tCEzBGL.exe
  2⤵
  PID:9424
- C:\Windows\System\qHqoHmj.exe
  C:\Windows\System\qHqoHmj.exe
  2⤵
  PID:10172
- C:\Windows\System\rJGcJpA.exe
  C:\Windows\System\rJGcJpA.exe
  2⤵
  PID:8360
- C:\Windows\System\WufhqkY.exe
  C:\Windows\System\WufhqkY.exe
  2⤵
  PID:9968
- C:\Windows\System\PgUPUei.exe
  C:\Windows\System\PgUPUei.exe
  2⤵
  PID:10220
- C:\Windows\System\pYCKTob.exe
  C:\Windows\System\pYCKTob.exe
  2⤵
  PID:10232
- C:\Windows\System\MQArLJA.exe
  C:\Windows\System\MQArLJA.exe
  2⤵
  PID:10580
- C:\Windows\System\aZUNIGy.exe
  C:\Windows\System\aZUNIGy.exe
  2⤵
  PID:11584
- C:\Windows\System\cVRWwBe.exe
  C:\Windows\System\cVRWwBe.exe
  2⤵
  PID:11288
- C:\Windows\System\OhMSVjV.exe
  C:\Windows\System\OhMSVjV.exe
  2⤵
  PID:11356
- C:\Windows\System\dWaoqzr.exe
  C:\Windows\System\dWaoqzr.exe
  2⤵
  PID:14000
- C:\Windows\System\OBuhkCt.exe
  C:\Windows\System\OBuhkCt.exe
  2⤵
  PID:12080
- C:\Windows\System\BuTsjzJ.exe
  C:\Windows\System\BuTsjzJ.exe
  2⤵
  PID:12092
- C:\Windows\System\SIkqWBm.exe
  C:\Windows\System\SIkqWBm.exe
  2⤵
  PID:10004
- C:\Windows\System\diSjqeL.exe
  C:\Windows\System\diSjqeL.exe
  2⤵
  PID:14788
- C:\Windows\System\meDoNvU.exe
  C:\Windows\System\meDoNvU.exe
  2⤵
  PID:9172
- C:\Windows\System\eNsoZMs.exe
  C:\Windows\System\eNsoZMs.exe
  2⤵
  PID:15032
- C:\Windows\System\YATKVxz.exe
  C:\Windows\System\YATKVxz.exe
  2⤵
  PID:7728
- C:\Windows\System\ePccJoL.exe
  C:\Windows\System\ePccJoL.exe
  2⤵
  PID:11468
- C:\Windows\System\yJawrNI.exe
  C:\Windows\System\yJawrNI.exe
  2⤵
  PID:9156
- C:\Windows\System\WOpqhsr.exe
  C:\Windows\System\WOpqhsr.exe
  2⤵
  PID:10080
- C:\Windows\System\JruBhFH.exe
  C:\Windows\System\JruBhFH.exe
  2⤵
  PID:10032
- C:\Windows\System\PIjbguu.exe
  C:\Windows\System\PIjbguu.exe
  2⤵
  PID:11020
- C:\Windows\System\HhqyiCT.exe
  C:\Windows\System\HhqyiCT.exe
  2⤵
  PID:10768
- C:\Windows\System\ACRWhvW.exe
  C:\Windows\System\ACRWhvW.exe
  2⤵
  PID:10760
- C:\Windows\System\YTrTmLR.exe
  C:\Windows\System\YTrTmLR.exe
  2⤵
  PID:12212
- C:\Windows\System\CiSPWKU.exe
  C:\Windows\System\CiSPWKU.exe
  2⤵
  PID:10496
- C:\Windows\System\Pcnglio.exe
  C:\Windows\System\Pcnglio.exe
  2⤵
  PID:11352
- C:\Windows\System\NaaTwLa.exe
  C:\Windows\System\NaaTwLa.exe
  2⤵
  PID:10724
- C:\Windows\System\PuxvQlN.exe
  C:\Windows\System\PuxvQlN.exe
  2⤵
  PID:11788
- C:\Windows\System\LOTxmbl.exe
  C:\Windows\System\LOTxmbl.exe
  2⤵
  PID:10528
- C:\Windows\System\khVUNUK.exe
  C:\Windows\System\khVUNUK.exe
  2⤵
  PID:744
- C:\Windows\System\MvpeTma.exe
  C:\Windows\System\MvpeTma.exe
  2⤵
  PID:12000
- C:\Windows\System\WAfJbkk.exe
  C:\Windows\System\WAfJbkk.exe
  2⤵
  PID:10776
- C:\Windows\System\zhnAuNe.exe
  C:\Windows\System\zhnAuNe.exe
  2⤵
  PID:8932
- C:\Windows\System\EGBISlQ.exe
  C:\Windows\System\EGBISlQ.exe
  2⤵
  PID:9324
- C:\Windows\System\MLkMrVJ.exe
  C:\Windows\System\MLkMrVJ.exe
  2⤵
  PID:10736
- C:\Windows\System\WPLcgxl.exe
  C:\Windows\System\WPLcgxl.exe
  2⤵
  PID:10284
- C:\Windows\System\RMcMBTL.exe
  C:\Windows\System\RMcMBTL.exe
  2⤵
  PID:10916
- C:\Windows\System\ogIAMob.exe
  C:\Windows\System\ogIAMob.exe
  2⤵
  PID:9928
- C:\Windows\System\lVgeaEO.exe
  C:\Windows\System\lVgeaEO.exe
  2⤵
  PID:9420
- C:\Windows\System\tvqdBSe.exe
  C:\Windows\System\tvqdBSe.exe
  2⤵
  PID:8732
- C:\Windows\System\kKkjOwm.exe
  C:\Windows\System\kKkjOwm.exe
  2⤵
  PID:9636
- C:\Windows\System\OrrhrYH.exe
  C:\Windows\System\OrrhrYH.exe
  2⤵
  PID:11800
- C:\Windows\System\wFgCmGh.exe
  C:\Windows\System\wFgCmGh.exe
  2⤵
  PID:8740
- C:\Windows\System\jjVlXXo.exe
  C:\Windows\System\jjVlXXo.exe
  2⤵
  PID:10900
- C:\Windows\System\dvHWdRD.exe
  C:\Windows\System\dvHWdRD.exe
  2⤵
  PID:10056
- C:\Windows\System\DfeQqLa.exe
  C:\Windows\System\DfeQqLa.exe
  2⤵
  PID:15236
- C:\Windows\System\ZUzTWkn.exe
  C:\Windows\System\ZUzTWkn.exe
  2⤵
  PID:11248
- C:\Windows\System\EoThUZV.exe
  C:\Windows\System\EoThUZV.exe
  2⤵
  PID:10876
- C:\Windows\System\rIwVTiA.exe
  C:\Windows\System\rIwVTiA.exe
  2⤵
  PID:10548
- C:\Windows\System\foLouQX.exe
  C:\Windows\System\foLouQX.exe
  2⤵
  PID:6800
- C:\Windows\System\IQGbLhN.exe
  C:\Windows\System\IQGbLhN.exe
  2⤵
  PID:4460
- C:\Windows\System\fgmmGuE.exe
  C:\Windows\System\fgmmGuE.exe
  2⤵
  PID:12264
- C:\Windows\System\PChshkp.exe
  C:\Windows\System\PChshkp.exe
  2⤵
  PID:12140
- C:\Windows\System\lltxvSa.exe
  C:\Windows\System\lltxvSa.exe
  2⤵
  PID:11500
- C:\Windows\System\zJJPPyA.exe
  C:\Windows\System\zJJPPyA.exe
  2⤵
  PID:10476
- C:\Windows\System\MkSueqc.exe
  C:\Windows\System\MkSueqc.exe
  2⤵
  PID:11608
- C:\Windows\System\vqvWgVQ.exe
  C:\Windows\System\vqvWgVQ.exe
  2⤵
  PID:10300
- C:\Windows\System\NDwFnQq.exe
  C:\Windows\System\NDwFnQq.exe
  2⤵
  PID:6532
- C:\Windows\System\VOovIgB.exe
  C:\Windows\System\VOovIgB.exe
  2⤵
  PID:8032
- C:\Windows\System\PmkmEFx.exe
  C:\Windows\System\PmkmEFx.exe
  2⤵
  PID:8856
- C:\Windows\System\qfmWDoj.exe
  C:\Windows\System\qfmWDoj.exe
  2⤵
  PID:9348
- C:\Windows\System\OKfRybP.exe
  C:\Windows\System\OKfRybP.exe
  2⤵
  PID:11076
- C:\Windows\System\ztXWnkO.exe
  C:\Windows\System\ztXWnkO.exe
  2⤵
  PID:12224
- C:\Windows\System\Saafxoa.exe
  C:\Windows\System\Saafxoa.exe
  2⤵
  PID:6540
- C:\Windows\System\NuowwuC.exe
  C:\Windows\System\NuowwuC.exe
  2⤵
  PID:8924
- C:\Windows\System\iZFPQKf.exe
  C:\Windows\System\iZFPQKf.exe
  2⤵
  PID:8604
- C:\Windows\System\zpnjRwB.exe
  C:\Windows\System\zpnjRwB.exe
  2⤵
  PID:10292
- C:\Windows\System\OWsCtOU.exe
  C:\Windows\System\OWsCtOU.exe
  2⤵
  PID:9584
- C:\Windows\System\rmfkzJB.exe
  C:\Windows\System\rmfkzJB.exe
  2⤵
  PID:9988
- C:\Windows\System\VhANsvE.exe
  C:\Windows\System\VhANsvE.exe
  2⤵
  PID:10748
- C:\Windows\System\ezpVaQr.exe
  C:\Windows\System\ezpVaQr.exe
  2⤵
  PID:7568
- C:\Windows\System\iFpEOwe.exe
  C:\Windows\System\iFpEOwe.exe
  2⤵
  PID:10700
- C:\Windows\System\HBkGAcG.exe
  C:\Windows\System\HBkGAcG.exe
  2⤵
  PID:10176
- C:\Windows\System\Jxrrdqx.exe
  C:\Windows\System\Jxrrdqx.exe
  2⤵
  PID:12588
- C:\Windows\System\tIRTjkZ.exe
  C:\Windows\System\tIRTjkZ.exe
  2⤵
  PID:10256
- C:\Windows\System\ClgkVnm.exe
  C:\Windows\System\ClgkVnm.exe
  2⤵
  PID:12664
- C:\Windows\System\NqYwbLg.exe
  C:\Windows\System\NqYwbLg.exe
  2⤵
  PID:10672
- C:\Windows\System\XWnjhqo.exe
  C:\Windows\System\XWnjhqo.exe
  2⤵
  PID:12400
- C:\Windows\System\hVmOPPM.exe
  C:\Windows\System\hVmOPPM.exe
  2⤵
  PID:11964
- C:\Windows\System\DrLrIXx.exe
  C:\Windows\System\DrLrIXx.exe
  2⤵
  PID:12344
- C:\Windows\System\YvIRnwS.exe
  C:\Windows\System\YvIRnwS.exe
  2⤵
  PID:12040
- C:\Windows\System\NJOYosH.exe
  C:\Windows\System\NJOYosH.exe
  2⤵
  PID:13244
- C:\Windows\System\VoBsTYm.exe
  C:\Windows\System\VoBsTYm.exe
  2⤵
  PID:11000
- C:\Windows\System\mjasFIs.exe
  C:\Windows\System\mjasFIs.exe
  2⤵
  PID:12728
- C:\Windows\System\qnprkIB.exe
  C:\Windows\System\qnprkIB.exe
  2⤵
  PID:13276
- C:\Windows\System\WvXdvui.exe
  C:\Windows\System\WvXdvui.exe
  2⤵
  PID:12172
- C:\Windows\System\sDyBLBW.exe
  C:\Windows\System\sDyBLBW.exe
  2⤵
  PID:7232
- C:\Windows\System\JqbMWrk.exe
  C:\Windows\System\JqbMWrk.exe
  2⤵
  PID:10472
- C:\Windows\System\TDpUTCD.exe
  C:\Windows\System\TDpUTCD.exe
  2⤵
  PID:13188
- C:\Windows\System\qNkiVYG.exe
  C:\Windows\System\qNkiVYG.exe
  2⤵
  PID:12468
- C:\Windows\System\giukyjK.exe
  C:\Windows\System\giukyjK.exe
  2⤵
  PID:9280
- C:\Windows\System\tBmLINA.exe
  C:\Windows\System\tBmLINA.exe
  2⤵
  PID:12200
- C:\Windows\System\rMujmJm.exe
  C:\Windows\System\rMujmJm.exe
  2⤵
  PID:12684
- C:\Windows\System\xAsQzCj.exe
  C:\Windows\System\xAsQzCj.exe
  2⤵
  PID:10216
- C:\Windows\System\mbwhumu.exe
  C:\Windows\System\mbwhumu.exe
  2⤵
  PID:12880
- C:\Windows\System\CIfApYY.exe
  C:\Windows\System\CIfApYY.exe
  2⤵
  PID:12828
- C:\Windows\System\HSAfFHE.exe
  C:\Windows\System\HSAfFHE.exe
  2⤵
  PID:8652
- C:\Windows\System\ydVPgny.exe
  C:\Windows\System\ydVPgny.exe
  2⤵
  PID:12188
- C:\Windows\System\XoCCDFg.exe
  C:\Windows\System\XoCCDFg.exe
  2⤵
  PID:12244
- C:\Windows\System\gTjAMWI.exe
  C:\Windows\System\gTjAMWI.exe
  2⤵
  PID:9520
- C:\Windows\System\LWLhapF.exe
  C:\Windows\System\LWLhapF.exe
  2⤵
  PID:8164
- C:\Windows\System\ovENMYk.exe
  C:\Windows\System\ovENMYk.exe
  2⤵
  PID:1300
- C:\Windows\System\ZHebKPB.exe
  C:\Windows\System\ZHebKPB.exe
  2⤵
  PID:13060
- C:\Windows\System\uDhMcTC.exe
  C:\Windows\System\uDhMcTC.exe
  2⤵
  PID:7552
- C:\Windows\System\CnKhKFb.exe
  C:\Windows\System\CnKhKFb.exe
  2⤵
  PID:12324
- C:\Windows\System\vglcJiv.exe
  C:\Windows\System\vglcJiv.exe
  2⤵
  PID:2208
- C:\Windows\System\MhXpEHj.exe
  C:\Windows\System\MhXpEHj.exe
  2⤵
  PID:12256
- C:\Windows\System\OdsyOfM.exe
  C:\Windows\System\OdsyOfM.exe
  2⤵
  PID:12620
- C:\Windows\System\unHYNnD.exe
  C:\Windows\System\unHYNnD.exe
  2⤵
  PID:14848
- C:\Windows\System\GLdCebS.exe
  C:\Windows\System\GLdCebS.exe
  2⤵
  PID:12696
- C:\Windows\System\TdqxAqP.exe
  C:\Windows\System\TdqxAqP.exe
  2⤵
  PID:11376
- C:\Windows\System\fEghApM.exe
  C:\Windows\System\fEghApM.exe
  2⤵
  PID:12428
- C:\Windows\System\DYLkJwr.exe
  C:\Windows\System\DYLkJwr.exe
  2⤵
  PID:10344
- C:\Windows\System\sogiaLd.exe
  C:\Windows\System\sogiaLd.exe
  2⤵
  PID:12556
- C:\Windows\System\pzRMVav.exe
  C:\Windows\System\pzRMVav.exe
  2⤵
  PID:12432
- C:\Windows\System\gfLhkpn.exe
  C:\Windows\System\gfLhkpn.exe
  2⤵
  PID:15380
- C:\Windows\System\GKLEaYN.exe
  C:\Windows\System\GKLEaYN.exe
  2⤵
  PID:15408
- C:\Windows\System\EJjSdJW.exe
  C:\Windows\System\EJjSdJW.exe
  2⤵
  PID:15556
- C:\Windows\System\dtMMMNz.exe
  C:\Windows\System\dtMMMNz.exe
  2⤵
  PID:15580
- C:\Windows\System\fyYRqKK.exe
  C:\Windows\System\fyYRqKK.exe
  2⤵
  PID:15600
- C:\Windows\System\RinQeBJ.exe
  C:\Windows\System\RinQeBJ.exe
  2⤵
  PID:15632
- C:\Windows\System\cicuDgc.exe
  C:\Windows\System\cicuDgc.exe
  2⤵
  PID:15712
- C:\Windows\System\IZBenrP.exe
  C:\Windows\System\IZBenrP.exe
  2⤵
  PID:15732
- C:\Windows\System\lcoFMjF.exe
  C:\Windows\System\lcoFMjF.exe
  2⤵
  PID:15752
- C:\Windows\System\oIYmGvQ.exe
  C:\Windows\System\oIYmGvQ.exe
  2⤵
  PID:15776
- C:\Windows\System\OCkTECA.exe
  C:\Windows\System\OCkTECA.exe
  2⤵
  PID:15804
- C:\Windows\System\RyzpvKG.exe
  C:\Windows\System\RyzpvKG.exe
  2⤵
  PID:15828
- C:\Windows\System\RHaLTKf.exe
  C:\Windows\System\RHaLTKf.exe
  2⤵
  PID:15852
- C:\Windows\System\DzYqGFc.exe
  C:\Windows\System\DzYqGFc.exe
  2⤵
  PID:15876
- C:\Windows\System\AYGAQIY.exe
  C:\Windows\System\AYGAQIY.exe
  2⤵
  PID:15900
- C:\Windows\System\ETRYJGR.exe
  C:\Windows\System\ETRYJGR.exe
  2⤵
  PID:15924
- C:\Windows\System\VcgvOpi.exe
  C:\Windows\System\VcgvOpi.exe
  2⤵
  PID:15948
- C:\Windows\System\ZyOBNdU.exe
  C:\Windows\System\ZyOBNdU.exe
  2⤵
  PID:15972
- C:\Windows\System\WGVrSyO.exe
  C:\Windows\System\WGVrSyO.exe
  2⤵
  PID:16000
- C:\Windows\System\UIWYGtO.exe
  C:\Windows\System\UIWYGtO.exe
  2⤵
  PID:16020
- C:\Windows\System\UEtRneF.exe
  C:\Windows\System\UEtRneF.exe
  2⤵
  PID:16044
- C:\Windows\System\mxrxCNN.exe
  C:\Windows\System\mxrxCNN.exe
  2⤵
  PID:16068
- C:\Windows\System\WgwaHzr.exe
  C:\Windows\System\WgwaHzr.exe
  2⤵
  PID:16084
- C:\Windows\System\uaCHCEB.exe
  C:\Windows\System\uaCHCEB.exe
  2⤵
  PID:16100
- C:\Windows\System\gjmHRxP.exe
  C:\Windows\System\gjmHRxP.exe
  2⤵
  PID:16120
- C:\Windows\System\QmKwqwv.exe
  C:\Windows\System\QmKwqwv.exe
  2⤵
  PID:16140
- C:\Windows\System\dfxMADI.exe
  C:\Windows\System\dfxMADI.exe
  2⤵
  PID:16164
- C:\Windows\System\rwdTecW.exe
  C:\Windows\System\rwdTecW.exe
  2⤵
  PID:16184
- C:\Windows\System\MYEPsKO.exe
  C:\Windows\System\MYEPsKO.exe
  2⤵
  PID:16204
- C:\Windows\System\bbXjcDJ.exe
  C:\Windows\System\bbXjcDJ.exe
  2⤵
  PID:16232
- C:\Windows\System\ocWTjwp.exe
  C:\Windows\System\ocWTjwp.exe
  2⤵
  PID:11688
- C:\Windows\System\ATXjELd.exe
  C:\Windows\System\ATXjELd.exe
  2⤵
  PID:12756
- C:\Windows\System\EcotTPd.exe
  C:\Windows\System\EcotTPd.exe
  2⤵
  PID:12136
- C:\Windows\System\JhLPpyF.exe
  C:\Windows\System\JhLPpyF.exe
  2⤵
  PID:4488
- C:\Windows\System\GjKjXkY.exe
  C:\Windows\System\GjKjXkY.exe
  2⤵
  PID:15544
- C:\Windows\System\oTDHbdj.exe
  C:\Windows\System\oTDHbdj.exe
  2⤵
  PID:15596
- C:\Windows\System\pLgVMUG.exe
  C:\Windows\System\pLgVMUG.exe
  2⤵
  PID:13164
- C:\Windows\System\NueOSZa.exe
  C:\Windows\System\NueOSZa.exe
  2⤵
  PID:8896
- C:\Windows\System\ARQXCTd.exe
  C:\Windows\System\ARQXCTd.exe
  2⤵
  PID:12420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3wq21id0.ivw.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AOvwDaB.exe

Filesize
2.2MB

MD5
fd2abe98f7decd8810099a05f3485fe3

SHA1
4978393063df9860fbf8b92b35dd923f4b234a53

SHA256
65d510d37e71b037d4923678cacb620889cc700336c1aa6753d99f1e8b94b9d6

SHA512
429e13bc017e60018221813ac78d0aa138365eda6490a38b2721249039472a9a629a3f835ded6b1849c2ba2dd9648839a2b73cb40de370eb5df1c9d88259bc10

Download Submit
C:\Windows\System\AdPxqqy.exe

Filesize
2.2MB

MD5
f3c42eaaecbed5e1517a07d2ef61e474

SHA1
cb2e03819f5315ca9e661d132e8df114ce67858c

SHA256
e3c34599d9e8229dcf673000fb20a8631e61a5f91f1877d7865e262aacc6f5d0

SHA512
9d81cac4da28b1b76c7cce5045d96a03f5e61e202b30c56d4ea2832dd66ca741e252e9ca4ecd1d22d2948a9e13a05b3f2fc14220d341d3c22f5482bd91b241a6

Download Submit
C:\Windows\System\AxScXvV.exe

Filesize
2.2MB

MD5
a53f31a10a25959bb12d7a878f9c2e15

SHA1
9d3ae0d458089c8b21dc7eddf0ad9b352c8d94f8

SHA256
fa208b782a771de8b6023df73f171f0b08cb6e4a316b658bb8c26c11c0466dce

SHA512
5d071d71610a61d2fa31459a8081b69fed8039f53e9ea472d3bb127e2c0dd9bdd8ccb64571cee46f4de39e6bd97e31870267112ff9ae126e381066a1094484ce

Download Submit
C:\Windows\System\EVjNUju.exe

Filesize
2.3MB

MD5
6ab9073ae2a106088349eb48f46e3c1a

SHA1
63c939944087e5dd9064d264136df7f0bee547ad

SHA256
22f19fe1ab13a09a9b23379ddd9fa832671a4dde8d2fbb012a6da1153a2e8319

SHA512
ebae22c329b2aed8a7fb0cc411b18a43e454d78a18c9b45fa59d4c948360ae7d8a7b819af53e3ff99cb49750e0b0e6ba4322a4caf8b8dec800d15cf0be325ac4

Download Submit
C:\Windows\System\EqxMTDu.exe

Filesize
2.3MB

MD5
54ab13be50cfa78bc02086d3a6f51bfe

SHA1
15e3650079ec630b7acf4553bad6a77161395f13

SHA256
014cce8d8c172f4096a21ee5d81237fd0b556b655de517fb6f47bc9a4904d03a

SHA512
4d7f2fba9e13d9b6e9b24e787215ca946d221e78e3621dbd45bdfdfbd0389daecf10991145ab086e4eef66cfc28716f91504de36ab8538ae792af9117d4ece64

Download Submit
C:\Windows\System\FBffVBI.exe

Filesize
2.2MB

MD5
1abe35cb639f131c94f27a7b42fd1bdb

SHA1
306365f07dfeb2f5c376fe25f89d41110ae1221d

SHA256
9a18bc3676694b8b4b3dd3ba3a1752a4a82adfd21221ba983e97df1491a0e418

SHA512
44257c5424fecd2a850b1934ea7dc39852d9ef5d3c3380eb5ad229d9dcdf481f17f48a79048ca8b9b96e88a3b1ee9348b7e73ef5585456767c6c5e0461a8f5da

Download Submit
C:\Windows\System\NOnOUYQ.exe

Filesize
2.2MB

MD5
677de92e27bd21dca7837515ae27ef43

SHA1
a8fe1f4024a1fb5bbfa9efe6441dc9ba99e6255b

SHA256
ff6188f6b220a1d5692e4bbfa16ece3631d054827e205ce967b4307116f1bda7

SHA512
d69cb4a07feb1ad9914aab6f18d777b3e80588b210f3e1aad1fd60db3b0fe10ae14e1a966067fc9424ee24f06cf2a99945423b02802e6e2016c83496a72594fe

Download Submit
C:\Windows\System\PSLjGlC.exe

Filesize
2.2MB

MD5
b634046c100fa5edc328ba92cd7a8b7d

SHA1
5493f9aa7034b96d4cfdf54b339842ec21bdc753

SHA256
3af3af66952e40cfd41da7f396c06c557931ca8488639f8b2ac2ec3d8e4fac24

SHA512
9d19c85bc9cba4d1974f00b2e12fe1918c7a138138d213241445c12a6f9d6388c6bd37f845400eef25b0cecd42de8da38d922812225c23c8a549cbcedef23bbc

Download Submit
C:\Windows\System\QfXOIlP.exe

Filesize
2.3MB

MD5
4e11ca15ab49795f07531b8c01b8e54d

SHA1
4f5251197216d900ff7520e7780ed8f2b8dc4d3f

SHA256
bb97cb4bca7a8953b996bbad0e3e5a31b714a2dc43a33f78e9b443f344d3862b

SHA512
f87b16b2c2788c2c81accbb6abe042f7add6a51ab5eec8131d3ea8b8b112a27c152c1ab8cd452e1374cbd9a8183060cf50004930b45148eab32a9657a29d17fe

Download Submit
C:\Windows\System\SQPcHQc.exe

Filesize
2.2MB

MD5
a8ff2f83ed8b5d202584e7635229202c

SHA1
1cb22a027eee72f9220d2649b11681352846f0d6

SHA256
d49eb24907019de80c6362b86c06e69b2e2e2b3297e7fb69aad079396ef5fd8a

SHA512
fa54ca7be1106fc10a8071f32460ded10c138bb1e8ff251690eab2b717b429ded5404125d24178b1dbb0a4ff1e9bce43e39f257e324488d22279e3fc57283004

Download Submit
C:\Windows\System\THgyouk.exe

Filesize
2.2MB

MD5
4e3b0ec1f28d2b728b837291e8f55f71

SHA1
1a3069462fc932d44a981dd31ad75ef79511bc36

SHA256
c1f6c9a7f38b7ac250cc1fe518b31daac66d14cdc0d401030377e245735eaf3e

SHA512
b80abb9ab5099c193e5a08045cbaedfd2c5c186089f80981cb2a8d072cb925e85294ea9c586da161785f3225088db78fdefcb031dbcdb8d84504076da3fa072c

Download Submit
C:\Windows\System\TQIiAJc.exe

Filesize
2.2MB

MD5
1ecad08fb390bf70fbd65243c29da060

SHA1
0ae257b2cc747726b73d6bbc1690a6b85c872e71

SHA256
201e2ffcf60adb013db4c2063b1f849a41f7e523e7d6881efc36c8aecc883b05

SHA512
936f65255d93ba40b4e0f4365d2b80f1d61da061a781e80e10a58a1445547636ea64fcece9c2f7c54f5b2006931bb9a6d24cfd5307489c8c3e5afce86be5800d

Download Submit
C:\Windows\System\VKEUkRJ.exe

Filesize
2.2MB

MD5
96bc00f8f8af3192381b0702303d83f3

SHA1
88b7839630c432c65d4f2e5a8ceddd05ad11126f

SHA256
32c3530a9bed0e5906b3d04b0a726d70cf91e3be4e8fe995ae21e7136971cdda

SHA512
30160213e155c4a092c3b980c9bce052f4cccbdc9bd899257153a41bda5b863f502880b1a049d0fde85a93f7801c78f3fa64c79301e3bdc9c5e2d01a2caf403a

Download Submit
C:\Windows\System\VRbXZPx.exe

Filesize
2.3MB

MD5
b871caef27343f2768a11e74523a9980

SHA1
efb2679b00f248c359809c6d83ebd373d779cca4

SHA256
eede89b198661eda2cc5c83f4c2f088bbb63179489bfbb239b6a6e04dd67da87

SHA512
23480c59b956e78c9cc36ec2d25c3519b00e84ea1b332519e4a7a97f25cacdfe78dd7577a88bcab57f0dad2a8d2b7dc1f818bf81e3bafd449ae1b983f034ec97

Download Submit
C:\Windows\System\XDPPhEY.exe

Filesize
2.2MB

MD5
ac5bbf97424fbdef4cac41c08f0737c5

SHA1
351e46c9e2c858cca078b4e633408b89cfd0e6a1

SHA256
70d4ded096800500a529bac8cf505f93b022961a1179f81030fa94db3c7150c5

SHA512
9fa38785cce5e070e484638404f8c45d898c5415a98ce5bd35bcf1cbffbe7a053daf49888ba2d2445f0e16a05c5983e57a3fae7f2ed981e816a37e3fade01044

Download Submit
C:\Windows\System\YMOBAKw.exe

Filesize
2.2MB

MD5
2c719dc87b66c3edb545a3a52b7572fa

SHA1
895aee9337e4a52a25f250f4f385614661ce8bdd

SHA256
0af4c04cfe5cb19782b88e9f176b40011d5387e5fa201103e242e9ac36d4da0b

SHA512
11f48064a5d6b4e177dc31226e3d4019e5f61506f6911b9f374cdefd03da2b386e034111f0be7e1473a0073ec583840a5716a2a28d97bbcd39e4048a16d3b943

Download Submit
C:\Windows\System\YukVmUl.exe

Filesize
2.3MB

MD5
6754c38d43cd04b0d94e8ddfe562175f

SHA1
369ed2546fd74992466fde79987256c6292ce729

SHA256
86da0e126cbde673d7e7543376d64142056541b02fb811bd606c70b9a96ba847

SHA512
7f00b6e5ee3b71c8adb45903678b8f07cf2b12b24cb0d6cc5cfb669e0756a7767bf5bb0c0523f77f0bf8ed0c30331e359c2d0fce112aa2d0199f6648baf5f0bf

Download Submit
C:\Windows\System\ZJLScmD.exe

Filesize
2.2MB

MD5
1784f5edf5d757ce59194ac3ef760913

SHA1
c4a86913ec1ddd739ec6676988f717a1e46d2ab8

SHA256
9899cee62de49a8ca66c797ecb66d44c75bf2ad249e58113cd11ebd2fdd60917

SHA512
9fa2482b3278591ed37e40913f855862ef36c90e053078d4078ea0f7d3679930f2d5c1387c6597a2bffdf3fe84b66f9b6bf284d900577cd92c872931ab47c55a

Download Submit
C:\Windows\System\aWngbLU.exe

Filesize
2.3MB

MD5
e2412b207c4494a73d9c5fbb3d56f4e0

SHA1
088888df039adbdde9ffddfd272f2e00d359750b

SHA256
2c98cbafe30e3bd8a0dbeb0e8c9b98f0ceee673e1b5d76249a2eeca2b0e46cdd

SHA512
4ac0f27bfd7c5969b37c0806f7d6ca991590a5de57fa119993b7e6641f9016e5e328f08a91927f31fdb67193bec64eabe0364cc64983c53cec04decb5b14b00f

Download Submit
C:\Windows\System\dTfhzYt.exe

Filesize
2.2MB

MD5
f0457bd1b840d2765faf0f7a673eebaf

SHA1
44242630ad6caba733bc7b80b6c986c485d96c98

SHA256
d31ffc55de00db30618a75a7aa26e9ca4acd5df5e999144e7c064eb31640f685

SHA512
fe6d66f8a571f739f4842e128edf0c24df13de74f5c200fd4c56a1aa95bf6bc1d5c02c6d873ae0450a628cdadcf98d811a006a2912f8439d22e7e3547c64561d

Download Submit
C:\Windows\System\gBOaonD.exe

Filesize
2.2MB

MD5
5ff964ab14bb97e1ecb07538b7faa5d1

SHA1
c2f1bc3dd8595fe1120dc8e7000b81c03b6b9d67

SHA256
bacb398a5893bb469ce6a43ae7024674d50ec6791961cdc045c74374af6fae37

SHA512
4cf12e76692c4d6eaa2230838a0e9c96718fbbad7cb07e0c75cfa6bdceb901ab9bbac208c43e37f5e373f6da6144e380e5813a4dda5a723f3b19dfbb11b9c735

Download Submit
C:\Windows\System\hIBNIie.exe

Filesize
2.2MB

MD5
fe6b64dd9238cf85591986a90f16b424

SHA1
a7e04821c70a755981a9c23f7c349ece2f019c4e

SHA256
71df3d43373744e73a9aad4ede42f824a3a53172edbc521dac2b2c46054b81c1

SHA512
c4e5146308d914cf0e3fc888e352ec4014becaa225d3cde9970ac3f288c78caa96381ebbfd6a952f15b52cd6e494ea98a6926632ab35b9b95664256f3372e485

Download Submit
C:\Windows\System\hTWhspL.exe

Filesize
2.3MB

MD5
b7ddf88b13284f456edcfd984c53fa52

SHA1
a43be3c77cb979dfd8681280521d2653e0898cec

SHA256
2bec2c25e94dc3259a2dcb618813a91b16025efe6f5be8b99c4b096626a63caa

SHA512
4921125c531a8c54653fa54825302919ff820287982a674439395b817cb8342af6d3541c96ca479f63f6efb5d2cccbdcc57d32a02b2d1e48e84ce8dea90bb906

Download Submit
C:\Windows\System\lqpGkpe.exe

Filesize
2.2MB

MD5
084a5b41094e16f1c36f5b8e04f22d12

SHA1
da4e1fec863d7076f47b2447f178378f92a62812

SHA256
8a6ffb93da9b029048fa303d7ec1319f07c054b4b2a63d1645cfe6a53657492e

SHA512
028805a95d85f1d25d3d30735befb88c11d741263e36e7e61ea7805da0e7d6f55ba4c2d503765e90da3f258ca46b1068be69c30c74730d95878851a28267ace9

Download Submit
C:\Windows\System\ncKsTfN.exe

Filesize
2.2MB

MD5
627158d742537b3fbcd7688565f1025f

SHA1
2e8c8964cf6f4e8c59bf5b38d611a9ff26204964

SHA256
4e91c9c24f2e6207fd2e1406ad6034d81dfa644f563054ebc883a1a3ea47014a

SHA512
88723d88c53376e9e57b5b17c5cb702613b36d58abc747d56b4b76818539230da108f39ace514a6f44cafb6e1e962aa10230df5eaa5034cb01d680217c66d11c

Download Submit
C:\Windows\System\nxwTKwa.exe

Filesize
2.2MB

MD5
d9eacf30995f2ee0f7e24587adb8f5b6

SHA1
0fa4c9b1467223913388c9b5dfddac23177d6d6c

SHA256
91b43dd1972d014d8435be1445e85b38564458c933f5c0660f78f37211e8169e

SHA512
dca70e3ebe9a139ebdd5324b3095547604f5ca774a510160dcee2b747f53de0517f3429da25af2bf03387a2cc47a9ea4092f09b5b9666729ad63cfbe4a9f7085

Download Submit
C:\Windows\System\obsahDg.exe

Filesize
2.2MB

MD5
234798db48bdf73079e0811f73866ff6

SHA1
124a36236e9c8bf14c0d6b75279eba63f26d8e6e

SHA256
7e852644efca679b18a13c2299e628e17f8cfdccc1c36f61cfcbd7e260a96c0e

SHA512
e1a02b712fd113349391e4deef4ab732055effc32a49fd574cc7d4a9ea52a29a74a2aa97813efaf9a7f2a30a11dc85e1d1931f1d55b06e00634d32cec25b8df4

Download Submit
C:\Windows\System\rIEPTtO.exe

Filesize
2.2MB

MD5
cdc06013ba635ae8f4b77cfce8ce1ff5

SHA1
782c649f6b4bbe813526e838e6c5dbe45903c43b

SHA256
a21a38dd89151344b5a8cbb29546fc7f982914e2269968cfad10d470c0e9d65f

SHA512
641616fb97151742e7c80ec8f694ce522bdbccb4363841ebf78847ba1ba4b1bda723d10893c24189bdc50a3ca76b71a174a7fcd469e6987db11cb6d8209377e8

Download Submit
C:\Windows\System\vQNqcih.exe

Filesize
2.2MB

MD5
f04bd942d00437720a88227a45c3a707

SHA1
37a1c73e44a8f6c992859edcfbc0407235d005be

SHA256
9f73bf2b91876d78347df4d81a1100426fd86cb00bbc4bad571641378806431f

SHA512
60af0d142c0f709b5556d883d1762e43a0f3d1e576c90f4bd67bffe314005b089f8c77a7f13dd40348577c4c4b7d7673d7061585588254ddac3e1aea215bdbfa

Download Submit
C:\Windows\System\wheQNlp.exe

Filesize
2.2MB

MD5
d843a2dee62e8c8465bce83be2693c51

SHA1
61779e5c548a2a2b56e6f90f620c9c073fef64ea

SHA256
a1894aca779148111b8e3a54de2df1c2a3bcbee826d1f8948cb18a03eabc0368

SHA512
e53b79e839739a651112457be3309b24e4cf5bc7fe20167138e4af00cb8096fcf8975db0e5867c4248e4d5ce5996ab6cc579d8a21aa4d2f7b17f707ceda255a1

Download Submit
C:\Windows\System\xLUOVNV.exe

Filesize
2.2MB

MD5
772f00ba83ee5c6800c7f169b42ad6de

SHA1
31ded1419b4312365aabb076eaf0809c9f9e5002

SHA256
8e7ec84403c8235cf1773c0e8fe4d42eb442aadeded5a34cebe5a1c3cef5e404

SHA512
6157d2eb5088ab635c095a17eafec1c161d7895c1aa0d2910df80195b83d2aa10f03261f3bd497e01c005318000b6cf621efa92a9b7e42f8ae64e05d1d33a56e

Download Submit
C:\Windows\System\ySXELyy.exe

Filesize
2.3MB

MD5
0b3f7bb544b09c89683389ac350d576a

SHA1
f8b06654c7169ea5283539f414afc2b38e16e0e5

SHA256
79cca34bbd932c2e73037862127e62e3f3626c10c82d0fbbaaad5d2fc6a6519d

SHA512
0c3e99d32e0207426df1e3cef231eafba880ec0acc603cd098dfc02ffc73304c3916a0a433cf57e210bb77668df295ce462cf4f32f42e2a40b3e73ecd7778923

Download Submit
C:\Windows\System\zhwmqNZ.exe

Filesize
2.2MB

MD5
856eaa6bc649739ba3bb41305cf38036

SHA1
5963053042586fcddc0aaa975474d02c1f2c9abc

SHA256
3d8443c8d6803811bc29228a7d36f83b6997811015a7e18dee6c8270f798771e

SHA512
2a06a3664bd58d6261e8fe04af1f89bfc9304d1fe7dae3dc0f699956701ce1b4bfad03fe2ed3b31c54a92431bc8cb9ca2d04c491dea6c3db98fd9ba62e8de1c2

Download Submit
memory/832-1856-0x00007FF7EE410000-0x00007FF7EE802000-memory.dmp

Filesize
3.9MB

Download
memory/832-201-0x00007FF7EE410000-0x00007FF7EE802000-memory.dmp

Filesize
3.9MB

Download
memory/940-172-0x00007FF75EA10000-0x00007FF75EE02000-memory.dmp

Filesize
3.9MB

Download
memory/940-1847-0x00007FF75EA10000-0x00007FF75EE02000-memory.dmp

Filesize
3.9MB

Download
memory/1428-126-0x00007FF76EEB0000-0x00007FF76F2A2000-memory.dmp

Filesize
3.9MB

Download
memory/1428-1769-0x00007FF76EEB0000-0x00007FF76F2A2000-memory.dmp

Filesize
3.9MB

Download
memory/1968-156-0x00007FF7BD740000-0x00007FF7BDB32000-memory.dmp

Filesize
3.9MB

Download
memory/1968-1855-0x00007FF7BD740000-0x00007FF7BDB32000-memory.dmp

Filesize
3.9MB

Download
memory/1988-146-0x00007FF6349A0000-0x00007FF634D92000-memory.dmp

Filesize
3.9MB

Download
memory/1988-1760-0x00007FF6349A0000-0x00007FF634D92000-memory.dmp

Filesize
3.9MB

Download
memory/2008-214-0x00007FF73BE90000-0x00007FF73C282000-memory.dmp

Filesize
3.9MB

Download
memory/2008-1821-0x00007FF73BE90000-0x00007FF73C282000-memory.dmp

Filesize
3.9MB

Download
memory/2076-459-0x0000025FEF8D0000-0x0000025FF0076000-memory.dmp

Filesize
7.6MB

Download
memory/2076-6373-0x00007FF82DDE3000-0x00007FF82DDE5000-memory.dmp

Filesize
8KB

Download
memory/2076-62-0x00007FF82DDE0000-0x00007FF82E8A1000-memory.dmp

Filesize
10.8MB

Download
memory/2076-11-0x00007FF82DDE3000-0x00007FF82DDE5000-memory.dmp

Filesize
8KB

Download
memory/2076-68-0x0000025FEBD10000-0x0000025FEBD32000-memory.dmp

Filesize
136KB

Download
memory/2076-6431-0x00007FF82DDE0000-0x00007FF82E8A1000-memory.dmp

Filesize
10.8MB

Download
memory/2076-220-0x00007FF82DDE0000-0x00007FF82E8A1000-memory.dmp

Filesize
10.8MB

Download
memory/2296-1818-0x00007FF6ACBD0000-0x00007FF6ACFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2296-164-0x00007FF6ACBD0000-0x00007FF6ACFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2300-179-0x00007FF6E8900000-0x00007FF6E8CF2000-memory.dmp

Filesize
3.9MB

Download
memory/2300-1815-0x00007FF6E8900000-0x00007FF6E8CF2000-memory.dmp

Filesize
3.9MB

Download
memory/2316-144-0x00007FF644970000-0x00007FF644D62000-memory.dmp

Filesize
3.9MB

Download
memory/2316-1775-0x00007FF644970000-0x00007FF644D62000-memory.dmp

Filesize
3.9MB

Download
memory/2440-97-0x00007FF7FAA80000-0x00007FF7FAE72000-memory.dmp

Filesize
3.9MB

Download
memory/2440-1792-0x00007FF7FAA80000-0x00007FF7FAE72000-memory.dmp

Filesize
3.9MB

Download
memory/2920-82-0x00007FF6A9F20000-0x00007FF6AA312000-memory.dmp

Filesize
3.9MB

Download
memory/2920-1768-0x00007FF6A9F20000-0x00007FF6AA312000-memory.dmp

Filesize
3.9MB

Download
memory/3456-0-0x00007FF7D7A00000-0x00007FF7D7DF2000-memory.dmp

Filesize
3.9MB

Download
memory/3456-1-0x0000019267EC0000-0x0000019267ED0000-memory.dmp

Filesize
64KB

Download
memory/3500-17-0x00007FF7906D0000-0x00007FF790AC2000-memory.dmp

Filesize
3.9MB

Download
memory/3500-1710-0x00007FF7906D0000-0x00007FF790AC2000-memory.dmp

Filesize
3.9MB

Download
memory/3608-155-0x00007FF620200000-0x00007FF6205F2000-memory.dmp

Filesize
3.9MB

Download
memory/3608-1789-0x00007FF620200000-0x00007FF6205F2000-memory.dmp

Filesize
3.9MB

Download
memory/3768-1834-0x00007FF7FA640000-0x00007FF7FAA32000-memory.dmp

Filesize
3.9MB

Download
memory/3768-199-0x00007FF7FA640000-0x00007FF7FAA32000-memory.dmp

Filesize
3.9MB

Download
memory/3900-106-0x00007FF7D2E20000-0x00007FF7D3212000-memory.dmp

Filesize
3.9MB

Download
memory/3900-1791-0x00007FF7D2E20000-0x00007FF7D3212000-memory.dmp

Filesize
3.9MB

Download
memory/3940-192-0x00007FF6E9980000-0x00007FF6E9D72000-memory.dmp

Filesize
3.9MB

Download
memory/3940-1837-0x00007FF6E9980000-0x00007FF6E9D72000-memory.dmp

Filesize
3.9MB

Download
memory/4024-223-0x00007FF668530000-0x00007FF668922000-memory.dmp

Filesize
3.9MB

Download
memory/4024-1804-0x00007FF668530000-0x00007FF668922000-memory.dmp

Filesize
3.9MB

Download
memory/4280-224-0x00007FF642CB0000-0x00007FF6430A2000-memory.dmp

Filesize
3.9MB

Download
memory/4280-1817-0x00007FF642CB0000-0x00007FF6430A2000-memory.dmp

Filesize
3.9MB

Download
memory/4292-206-0x00007FF75EFD0000-0x00007FF75F3C2000-memory.dmp

Filesize
3.9MB

Download
memory/4292-1813-0x00007FF75EFD0000-0x00007FF75F3C2000-memory.dmp

Filesize
3.9MB

Download
memory/4444-1853-0x00007FF70B6C0000-0x00007FF70BAB2000-memory.dmp

Filesize
3.9MB

Download
memory/4444-225-0x00007FF70B6C0000-0x00007FF70BAB2000-memory.dmp

Filesize
3.9MB

Download
memory/4564-226-0x00007FF7AB1F0000-0x00007FF7AB5E2000-memory.dmp

Filesize
3.9MB

Download
memory/4564-1830-0x00007FF7AB1F0000-0x00007FF7AB5E2000-memory.dmp

Filesize
3.9MB

Download
memory/4624-211-0x00007FF6EAC30000-0x00007FF6EB022000-memory.dmp

Filesize
3.9MB

Download
memory/4624-1806-0x00007FF6EAC30000-0x00007FF6EB022000-memory.dmp

Filesize
3.9MB

Download
memory/4916-1655-0x00007FF673E00000-0x00007FF6741F2000-memory.dmp

Filesize
3.9MB

Download
memory/4916-8-0x00007FF673E00000-0x00007FF6741F2000-memory.dmp

Filesize
3.9MB

Download
memory/5084-221-0x00007FF76CBC0000-0x00007FF76CFB2000-memory.dmp

Filesize
3.9MB

Download