xmrig | 98a6892b4148a38e0062895f415b0469d7d7fadd46d872b5e659888295b0a3f6

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 23:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
Size

2.9MB
MD5

14f4120cb29d3dc312bb78969b1d267a
SHA1

94e58289a23c1832f4ca01f7c0b1f01532770b41
SHA256

98a6892b4148a38e0062895f415b0469d7d7fadd46d872b5e659888295b0a3f6
SHA512

78db8a5a76f12e31bd83e9bcf2652ad2b0cb32b06e0f3d62c6c7dd46ae3761c7063b520181ec7d71cc3af65672a0d4a70679c0ff6bd541dd1b22f842d3102656
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5V+JDeWg:NAB9

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/2480-51-0x00007FF7F43E0000-0x00007FF7F47D2000-memory.dmp	xmrig
behavioral2/memory/864-52-0x00007FF7B8830000-0x00007FF7B8C22000-memory.dmp	xmrig
behavioral2/memory/840-372-0x00007FF72C390000-0x00007FF72C782000-memory.dmp	xmrig
behavioral2/memory/4348-381-0x00007FF609070000-0x00007FF609462000-memory.dmp	xmrig
behavioral2/memory/3112-406-0x00007FF6724E0000-0x00007FF6728D2000-memory.dmp	xmrig
behavioral2/memory/5100-415-0x00007FF7B9480000-0x00007FF7B9872000-memory.dmp	xmrig
behavioral2/memory/4036-419-0x00007FF7E9AC0000-0x00007FF7E9EB2000-memory.dmp	xmrig
behavioral2/memory/748-427-0x00007FF6E02B0000-0x00007FF6E06A2000-memory.dmp	xmrig
behavioral2/memory/4548-425-0x00007FF7C7220000-0x00007FF7C7612000-memory.dmp	xmrig
behavioral2/memory/376-405-0x00007FF77AAD0000-0x00007FF77AEC2000-memory.dmp	xmrig
behavioral2/memory/228-370-0x00007FF77F6C0000-0x00007FF77FAB2000-memory.dmp	xmrig
behavioral2/memory/3568-462-0x00007FF7C67D0000-0x00007FF7C6BC2000-memory.dmp	xmrig
behavioral2/memory/4596-468-0x00007FF686DB0000-0x00007FF6871A2000-memory.dmp	xmrig
behavioral2/memory/2512-477-0x00007FF7A3990000-0x00007FF7A3D82000-memory.dmp	xmrig
behavioral2/memory/3944-495-0x00007FF6241E0000-0x00007FF6245D2000-memory.dmp	xmrig
behavioral2/memory/1236-499-0x00007FF699040000-0x00007FF699432000-memory.dmp	xmrig
behavioral2/memory/4024-487-0x00007FF7C8160000-0x00007FF7C8552000-memory.dmp	xmrig
behavioral2/memory/3640-472-0x00007FF65FCD0000-0x00007FF6600C2000-memory.dmp	xmrig
behavioral2/memory/2556-461-0x00007FF6014E0000-0x00007FF6018D2000-memory.dmp	xmrig
behavioral2/memory/4588-454-0x00007FF608B40000-0x00007FF608F32000-memory.dmp	xmrig
behavioral2/memory/3200-449-0x00007FF7BA310000-0x00007FF7BA702000-memory.dmp	xmrig
behavioral2/memory/3564-447-0x00007FF73ED20000-0x00007FF73F112000-memory.dmp	xmrig
behavioral2/memory/4512-39-0x00007FF7E5C10000-0x00007FF7E6002000-memory.dmp	xmrig
behavioral2/memory/4032-34-0x00007FF7FD870000-0x00007FF7FDC62000-memory.dmp	xmrig
behavioral2/memory/4512-1576-0x00007FF7E5C10000-0x00007FF7E6002000-memory.dmp	xmrig
behavioral2/memory/4032-1564-0x00007FF7FD870000-0x00007FF7FDC62000-memory.dmp	xmrig
behavioral2/memory/864-1599-0x00007FF7B8830000-0x00007FF7B8C22000-memory.dmp	xmrig
behavioral2/memory/840-1612-0x00007FF72C390000-0x00007FF72C782000-memory.dmp	xmrig
behavioral2/memory/4348-1615-0x00007FF609070000-0x00007FF609462000-memory.dmp	xmrig
behavioral2/memory/228-1611-0x00007FF77F6C0000-0x00007FF77FAB2000-memory.dmp	xmrig
behavioral2/memory/2480-1588-0x00007FF7F43E0000-0x00007FF7F47D2000-memory.dmp	xmrig
behavioral2/memory/3944-1646-0x00007FF6241E0000-0x00007FF6245D2000-memory.dmp	xmrig
behavioral2/memory/1236-1632-0x00007FF699040000-0x00007FF699432000-memory.dmp	xmrig
behavioral2/memory/3112-1656-0x00007FF6724E0000-0x00007FF6728D2000-memory.dmp	xmrig
behavioral2/memory/4036-1673-0x00007FF7E9AC0000-0x00007FF7E9EB2000-memory.dmp	xmrig
behavioral2/memory/3564-1680-0x00007FF73ED20000-0x00007FF73F112000-memory.dmp	xmrig
behavioral2/memory/4588-1684-0x00007FF608B40000-0x00007FF608F32000-memory.dmp	xmrig
behavioral2/memory/2556-1686-0x00007FF6014E0000-0x00007FF6018D2000-memory.dmp	xmrig
behavioral2/memory/3568-1688-0x00007FF7C67D0000-0x00007FF7C6BC2000-memory.dmp	xmrig
behavioral2/memory/3200-1679-0x00007FF7BA310000-0x00007FF7BA702000-memory.dmp	xmrig
behavioral2/memory/4548-1675-0x00007FF7C7220000-0x00007FF7C7612000-memory.dmp	xmrig
behavioral2/memory/3640-1701-0x00007FF65FCD0000-0x00007FF6600C2000-memory.dmp	xmrig
behavioral2/memory/2512-1706-0x00007FF7A3990000-0x00007FF7A3D82000-memory.dmp	xmrig
behavioral2/memory/4024-1716-0x00007FF7C8160000-0x00007FF7C8552000-memory.dmp	xmrig
behavioral2/memory/4596-1699-0x00007FF686DB0000-0x00007FF6871A2000-memory.dmp	xmrig
behavioral2/memory/748-1672-0x00007FF6E02B0000-0x00007FF6E06A2000-memory.dmp	xmrig
behavioral2/memory/5100-1664-0x00007FF7B9480000-0x00007FF7B9872000-memory.dmp	xmrig
behavioral2/memory/376-1662-0x00007FF77AAD0000-0x00007FF77AEC2000-memory.dmp	xmrig
behavioral2/memory/4504-5632-0x00007FF6DE2A0000-0x00007FF6DE692000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	416	powershell.exe
5	416	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
416	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4032	vcZZynR.exe
4512	nXMXFcm.exe
2480	wtRGSyt.exe
864	oTxTcfI.exe
228	PHfTeVW.exe
840	WOhqccp.exe
4348	ABzxnUD.exe
3944	LILqJQk.exe
1236	wfggeFr.exe
376	elqhBFj.exe
3112	wpjiXnL.exe
5100	nyTSYvY.exe
4036	HDCJjpY.exe
4548	jXhFaQY.exe
748	cnSbyhz.exe
3564	nfacxtd.exe
3200	CQrKgiK.exe
4588	TtXlYNL.exe
2556	JIUsSXO.exe
3568	WudSHqa.exe
4596	TsWGkGc.exe
3640	BLOcylO.exe
2512	zDMmUKy.exe
4024	cDApKIR.exe
4288	AtCjoRv.exe
3436	edaTTnJ.exe
1528	bIaosfm.exe
836	uciJRmu.exe
4436	wVXIsRw.exe
3488	trylCYN.exe
1384	QkOheNI.exe
1800	vKrWfzV.exe
4180	rPwcBZr.exe
4432	WcYqPwL.exe
3196	vGKzbiO.exe
3900	lErujUL.exe
3808	ehzimes.exe
3896	eClDuJW.exe
1428	TkVaHXA.exe
4948	DfUzUjl.exe
548	uGKqhNP.exe
1628	ooJCPPc.exe
4804	iZIrfqQ.exe
676	NsuOlWX.exe
1744	VvemsQB.exe
4712	hrRcJbk.exe
5056	fNeZTYw.exe
1852	PCNWZrg.exe
2984	qAWdkAn.exe
4924	muvCahK.exe
5044	IfaLMgd.exe
4852	YpFmasC.exe
5128	QWLWOza.exe
5144	UbPdUiy.exe
5160	YsGPKxK.exe
5184	obVnZOf.exe
5204	JQdUEUQ.exe
5228	RiAkZfn.exe
5256	GPDMpzu.exe
5284	JBXIPMF.exe
5312	DIfXtDS.exe
5340	tQWFbrT.exe
5368	GjqDfIt.exe
5396	gpOpMIS.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4504-0-0x00007FF6DE2A0000-0x00007FF6DE692000-memory.dmp	upx
behavioral2/files/0x000900000002326d-6.dat	upx
behavioral2/files/0x0008000000023273-22.dat	upx
behavioral2/files/0x0007000000023275-11.dat	upx
behavioral2/files/0x0008000000023274-31.dat	upx
behavioral2/files/0x0008000000023271-42.dat	upx
behavioral2/files/0x0007000000023277-49.dat	upx
behavioral2/memory/2480-51-0x00007FF7F43E0000-0x00007FF7F47D2000-memory.dmp	upx
behavioral2/files/0x0007000000023278-57.dat	upx
behavioral2/files/0x0007000000023279-62.dat	upx
behavioral2/memory/864-52-0x00007FF7B8830000-0x00007FF7B8C22000-memory.dmp	upx
behavioral2/files/0x0008000000023276-45.dat	upx
behavioral2/files/0x000700000002327a-69.dat	upx
behavioral2/files/0x000700000002327b-74.dat	upx
behavioral2/files/0x000700000002327c-79.dat	upx
behavioral2/files/0x000700000002327e-89.dat	upx
behavioral2/files/0x000700000002327f-94.dat	upx
behavioral2/files/0x0007000000023280-99.dat	upx
behavioral2/files/0x0007000000023281-104.dat	upx
behavioral2/files/0x0007000000023282-109.dat	upx
behavioral2/files/0x0007000000023286-129.dat	upx
behavioral2/files/0x0007000000023287-134.dat	upx
behavioral2/files/0x0007000000023289-145.dat	upx
behavioral2/files/0x000700000002328c-163.dat	upx
behavioral2/files/0x000700000002328f-175.dat	upx
behavioral2/memory/840-372-0x00007FF72C390000-0x00007FF72C782000-memory.dmp	upx
behavioral2/memory/4348-381-0x00007FF609070000-0x00007FF609462000-memory.dmp	upx
behavioral2/memory/3112-406-0x00007FF6724E0000-0x00007FF6728D2000-memory.dmp	upx
behavioral2/memory/5100-415-0x00007FF7B9480000-0x00007FF7B9872000-memory.dmp	upx
behavioral2/memory/4036-419-0x00007FF7E9AC0000-0x00007FF7E9EB2000-memory.dmp	upx
behavioral2/memory/748-427-0x00007FF6E02B0000-0x00007FF6E06A2000-memory.dmp	upx
behavioral2/memory/4548-425-0x00007FF7C7220000-0x00007FF7C7612000-memory.dmp	upx
behavioral2/memory/376-405-0x00007FF77AAD0000-0x00007FF77AEC2000-memory.dmp	upx
behavioral2/memory/228-370-0x00007FF77F6C0000-0x00007FF77FAB2000-memory.dmp	upx
behavioral2/memory/3568-462-0x00007FF7C67D0000-0x00007FF7C6BC2000-memory.dmp	upx
behavioral2/memory/4596-468-0x00007FF686DB0000-0x00007FF6871A2000-memory.dmp	upx
behavioral2/memory/2512-477-0x00007FF7A3990000-0x00007FF7A3D82000-memory.dmp	upx
behavioral2/memory/3944-495-0x00007FF6241E0000-0x00007FF6245D2000-memory.dmp	upx
behavioral2/memory/1236-499-0x00007FF699040000-0x00007FF699432000-memory.dmp	upx
behavioral2/memory/4024-487-0x00007FF7C8160000-0x00007FF7C8552000-memory.dmp	upx
behavioral2/memory/3640-472-0x00007FF65FCD0000-0x00007FF6600C2000-memory.dmp	upx
behavioral2/memory/2556-461-0x00007FF6014E0000-0x00007FF6018D2000-memory.dmp	upx
behavioral2/memory/4588-454-0x00007FF608B40000-0x00007FF608F32000-memory.dmp	upx
behavioral2/memory/3200-449-0x00007FF7BA310000-0x00007FF7BA702000-memory.dmp	upx
behavioral2/memory/3564-447-0x00007FF73ED20000-0x00007FF73F112000-memory.dmp	upx
behavioral2/files/0x0007000000023290-180.dat	upx
behavioral2/files/0x000700000002328e-170.dat	upx
behavioral2/files/0x000700000002328d-167.dat	upx
behavioral2/files/0x000700000002328b-157.dat	upx
behavioral2/files/0x000700000002328a-152.dat	upx
behavioral2/files/0x0007000000023288-143.dat	upx
behavioral2/files/0x0007000000023285-124.dat	upx
behavioral2/files/0x0007000000023284-119.dat	upx
behavioral2/files/0x0007000000023283-114.dat	upx
behavioral2/files/0x000700000002327d-84.dat	upx
behavioral2/memory/4512-39-0x00007FF7E5C10000-0x00007FF7E6002000-memory.dmp	upx
behavioral2/memory/4032-34-0x00007FF7FD870000-0x00007FF7FDC62000-memory.dmp	upx
behavioral2/memory/4512-1576-0x00007FF7E5C10000-0x00007FF7E6002000-memory.dmp	upx
behavioral2/memory/4032-1564-0x00007FF7FD870000-0x00007FF7FDC62000-memory.dmp	upx
behavioral2/memory/864-1599-0x00007FF7B8830000-0x00007FF7B8C22000-memory.dmp	upx
behavioral2/memory/840-1612-0x00007FF72C390000-0x00007FF72C782000-memory.dmp	upx
behavioral2/memory/4348-1615-0x00007FF609070000-0x00007FF609462000-memory.dmp	upx
behavioral2/memory/228-1611-0x00007FF77F6C0000-0x00007FF77FAB2000-memory.dmp	upx
behavioral2/memory/2480-1588-0x00007FF7F43E0000-0x00007FF7F47D2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\nMdpczJ.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\okWOhAh.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\LSwcdBj.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\HDCJjpY.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\EGeMlqt.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\EjWhKKH.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\sdZoMtB.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\OxhfBvV.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\DIfXtDS.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\XEVcMlJ.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\FhEZvvZ.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\usgECbc.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\aiOYPSz.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\LYxUumZ.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\MbtrfZx.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\oOUPECF.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\MrWWZmg.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\ZuNgHkp.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\HEvGgTR.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\DfUzUjl.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\YFuYGFr.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\UTaaCfV.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\YKVjoyN.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\qpGIzVR.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\VBpezJp.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\PQGchZK.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\pWZLsuY.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\hfBlACd.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\nieJBKe.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\rUsRTYp.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\wfIkQkG.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\NbiTYxT.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\GFdChxR.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\PCNWZrg.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\LNEezmb.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\YZryoUa.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\olRdYbf.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\jcbYYOF.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\gwLktTW.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\aGsjLfk.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\paneDMc.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\jHeFxFT.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\AIjvYQc.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\BYlEtpJ.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\wgEGVih.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\EbQpKpm.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\pnNDNbR.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\HgBQEyx.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\KmxzFSh.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\GVmzsHy.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\ozSiBGE.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\FeAiSKd.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\gifDNzs.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\HCYRsAo.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\toRocaU.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\KiPohqq.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\cdqCOoN.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\yUeZwIy.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\LAbeSRj.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\WYUtROS.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\ouaSZKe.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\BHagoul.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\OcvpXdm.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
File created	C:\Windows\System\ehzimes.exe	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
416	powershell.exe
416	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
Token: SeDebugPrivilege	416	powershell.exe
Token: SeLockMemoryPrivilege	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 416	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	92
PID 4504 wrote to memory of 416	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	92
PID 4504 wrote to memory of 4032	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	93
PID 4504 wrote to memory of 4032	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	93
PID 4504 wrote to memory of 4512	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	94
PID 4504 wrote to memory of 4512	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	94
PID 4504 wrote to memory of 2480	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	95
PID 4504 wrote to memory of 2480	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	95
PID 4504 wrote to memory of 864	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	96
PID 4504 wrote to memory of 864	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	96
PID 4504 wrote to memory of 228	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	97
PID 4504 wrote to memory of 228	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	97
PID 4504 wrote to memory of 840	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	98
PID 4504 wrote to memory of 840	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	98
PID 4504 wrote to memory of 4348	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	99
PID 4504 wrote to memory of 4348	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	99
PID 4504 wrote to memory of 3944	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	100
PID 4504 wrote to memory of 3944	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	100
PID 4504 wrote to memory of 1236	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	101
PID 4504 wrote to memory of 1236	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	101
PID 4504 wrote to memory of 376	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	102
PID 4504 wrote to memory of 376	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	102
PID 4504 wrote to memory of 3112	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	103
PID 4504 wrote to memory of 3112	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	103
PID 4504 wrote to memory of 5100	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	104
PID 4504 wrote to memory of 5100	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	104
PID 4504 wrote to memory of 4036	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	105
PID 4504 wrote to memory of 4036	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	105
PID 4504 wrote to memory of 4548	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	106
PID 4504 wrote to memory of 4548	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	106
PID 4504 wrote to memory of 748	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	107
PID 4504 wrote to memory of 748	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	107
PID 4504 wrote to memory of 3564	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	108
PID 4504 wrote to memory of 3564	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	108
PID 4504 wrote to memory of 3200	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	109
PID 4504 wrote to memory of 3200	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	109
PID 4504 wrote to memory of 4588	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	110
PID 4504 wrote to memory of 4588	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	110
PID 4504 wrote to memory of 2556	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	111
PID 4504 wrote to memory of 2556	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	111
PID 4504 wrote to memory of 3568	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	112
PID 4504 wrote to memory of 3568	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	112
PID 4504 wrote to memory of 4596	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	113
PID 4504 wrote to memory of 4596	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	113
PID 4504 wrote to memory of 3640	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	114
PID 4504 wrote to memory of 3640	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	114
PID 4504 wrote to memory of 2512	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	115
PID 4504 wrote to memory of 2512	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	115
PID 4504 wrote to memory of 4024	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	116
PID 4504 wrote to memory of 4024	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	116
PID 4504 wrote to memory of 4288	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	117
PID 4504 wrote to memory of 4288	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	117
PID 4504 wrote to memory of 3436	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	118
PID 4504 wrote to memory of 3436	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	118
PID 4504 wrote to memory of 1528	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	119
PID 4504 wrote to memory of 1528	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	119
PID 4504 wrote to memory of 836	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	120
PID 4504 wrote to memory of 836	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	120
PID 4504 wrote to memory of 4436	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	121
PID 4504 wrote to memory of 4436	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	121
PID 4504 wrote to memory of 3488	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	122
PID 4504 wrote to memory of 3488	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	122
PID 4504 wrote to memory of 1384	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	123
PID 4504 wrote to memory of 1384	4504	14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe	123

C:\Users\Admin\AppData\Local\Temp\14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\14f4120cb29d3dc312bb78969b1d267a_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:416
- C:\Windows\System\vcZZynR.exe
  C:\Windows\System\vcZZynR.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\nXMXFcm.exe
  C:\Windows\System\nXMXFcm.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\wtRGSyt.exe
  C:\Windows\System\wtRGSyt.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\oTxTcfI.exe
  C:\Windows\System\oTxTcfI.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\PHfTeVW.exe
  C:\Windows\System\PHfTeVW.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\WOhqccp.exe
  C:\Windows\System\WOhqccp.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\ABzxnUD.exe
  C:\Windows\System\ABzxnUD.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\LILqJQk.exe
  C:\Windows\System\LILqJQk.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\wfggeFr.exe
  C:\Windows\System\wfggeFr.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\elqhBFj.exe
  C:\Windows\System\elqhBFj.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\wpjiXnL.exe
  C:\Windows\System\wpjiXnL.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\nyTSYvY.exe
  C:\Windows\System\nyTSYvY.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\HDCJjpY.exe
  C:\Windows\System\HDCJjpY.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\jXhFaQY.exe
  C:\Windows\System\jXhFaQY.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\cnSbyhz.exe
  C:\Windows\System\cnSbyhz.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\nfacxtd.exe
  C:\Windows\System\nfacxtd.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\CQrKgiK.exe
  C:\Windows\System\CQrKgiK.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\TtXlYNL.exe
  C:\Windows\System\TtXlYNL.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\JIUsSXO.exe
  C:\Windows\System\JIUsSXO.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\WudSHqa.exe
  C:\Windows\System\WudSHqa.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\TsWGkGc.exe
  C:\Windows\System\TsWGkGc.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\BLOcylO.exe
  C:\Windows\System\BLOcylO.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\zDMmUKy.exe
  C:\Windows\System\zDMmUKy.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\cDApKIR.exe
  C:\Windows\System\cDApKIR.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\AtCjoRv.exe
  C:\Windows\System\AtCjoRv.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\edaTTnJ.exe
  C:\Windows\System\edaTTnJ.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\bIaosfm.exe
  C:\Windows\System\bIaosfm.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\uciJRmu.exe
  C:\Windows\System\uciJRmu.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\wVXIsRw.exe
  C:\Windows\System\wVXIsRw.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\trylCYN.exe
  C:\Windows\System\trylCYN.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\QkOheNI.exe
  C:\Windows\System\QkOheNI.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\vKrWfzV.exe
  C:\Windows\System\vKrWfzV.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\rPwcBZr.exe
  C:\Windows\System\rPwcBZr.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\WcYqPwL.exe
  C:\Windows\System\WcYqPwL.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\vGKzbiO.exe
  C:\Windows\System\vGKzbiO.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\lErujUL.exe
  C:\Windows\System\lErujUL.exe
  2⤵
  - Executes dropped EXE
  PID:3900
- C:\Windows\System\ehzimes.exe
  C:\Windows\System\ehzimes.exe
  2⤵
  - Executes dropped EXE
  PID:3808
- C:\Windows\System\eClDuJW.exe
  C:\Windows\System\eClDuJW.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\TkVaHXA.exe
  C:\Windows\System\TkVaHXA.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\DfUzUjl.exe
  C:\Windows\System\DfUzUjl.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\uGKqhNP.exe
  C:\Windows\System\uGKqhNP.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\ooJCPPc.exe
  C:\Windows\System\ooJCPPc.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\iZIrfqQ.exe
  C:\Windows\System\iZIrfqQ.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\NsuOlWX.exe
  C:\Windows\System\NsuOlWX.exe
  2⤵
  - Executes dropped EXE
  PID:676
- C:\Windows\System\VvemsQB.exe
  C:\Windows\System\VvemsQB.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\hrRcJbk.exe
  C:\Windows\System\hrRcJbk.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\fNeZTYw.exe
  C:\Windows\System\fNeZTYw.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\PCNWZrg.exe
  C:\Windows\System\PCNWZrg.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\qAWdkAn.exe
  C:\Windows\System\qAWdkAn.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\muvCahK.exe
  C:\Windows\System\muvCahK.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\IfaLMgd.exe
  C:\Windows\System\IfaLMgd.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\YpFmasC.exe
  C:\Windows\System\YpFmasC.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\QWLWOza.exe
  C:\Windows\System\QWLWOza.exe
  2⤵
  - Executes dropped EXE
  PID:5128
- C:\Windows\System\UbPdUiy.exe
  C:\Windows\System\UbPdUiy.exe
  2⤵
  - Executes dropped EXE
  PID:5144
- C:\Windows\System\YsGPKxK.exe
  C:\Windows\System\YsGPKxK.exe
  2⤵
  - Executes dropped EXE
  PID:5160
- C:\Windows\System\obVnZOf.exe
  C:\Windows\System\obVnZOf.exe
  2⤵
  - Executes dropped EXE
  PID:5184
- C:\Windows\System\JQdUEUQ.exe
  C:\Windows\System\JQdUEUQ.exe
  2⤵
  - Executes dropped EXE
  PID:5204
- C:\Windows\System\RiAkZfn.exe
  C:\Windows\System\RiAkZfn.exe
  2⤵
  - Executes dropped EXE
  PID:5228
- C:\Windows\System\GPDMpzu.exe
  C:\Windows\System\GPDMpzu.exe
  2⤵
  - Executes dropped EXE
  PID:5256
- C:\Windows\System\JBXIPMF.exe
  C:\Windows\System\JBXIPMF.exe
  2⤵
  - Executes dropped EXE
  PID:5284
- C:\Windows\System\DIfXtDS.exe
  C:\Windows\System\DIfXtDS.exe
  2⤵
  - Executes dropped EXE
  PID:5312
- C:\Windows\System\tQWFbrT.exe
  C:\Windows\System\tQWFbrT.exe
  2⤵
  - Executes dropped EXE
  PID:5340
- C:\Windows\System\GjqDfIt.exe
  C:\Windows\System\GjqDfIt.exe
  2⤵
  - Executes dropped EXE
  PID:5368
- C:\Windows\System\gpOpMIS.exe
  C:\Windows\System\gpOpMIS.exe
  2⤵
  - Executes dropped EXE
  PID:5396
- C:\Windows\System\cRmdikp.exe
  C:\Windows\System\cRmdikp.exe
  2⤵
  PID:5424
- C:\Windows\System\eycqCRd.exe
  C:\Windows\System\eycqCRd.exe
  2⤵
  PID:5452
- C:\Windows\System\rlQERCv.exe
  C:\Windows\System\rlQERCv.exe
  2⤵
  PID:5488
- C:\Windows\System\zoRFSee.exe
  C:\Windows\System\zoRFSee.exe
  2⤵
  PID:5524
- C:\Windows\System\loivcDK.exe
  C:\Windows\System\loivcDK.exe
  2⤵
  PID:5552
- C:\Windows\System\VBQpYDm.exe
  C:\Windows\System\VBQpYDm.exe
  2⤵
  PID:5576
- C:\Windows\System\CuqPumg.exe
  C:\Windows\System\CuqPumg.exe
  2⤵
  PID:5596
- C:\Windows\System\qSMCion.exe
  C:\Windows\System\qSMCion.exe
  2⤵
  PID:5620
- C:\Windows\System\RVIGyPM.exe
  C:\Windows\System\RVIGyPM.exe
  2⤵
  PID:5648
- C:\Windows\System\RhkUymV.exe
  C:\Windows\System\RhkUymV.exe
  2⤵
  PID:5676
- C:\Windows\System\MpcffnK.exe
  C:\Windows\System\MpcffnK.exe
  2⤵
  PID:5704
- C:\Windows\System\qMgrret.exe
  C:\Windows\System\qMgrret.exe
  2⤵
  PID:5732
- C:\Windows\System\dAyMySV.exe
  C:\Windows\System\dAyMySV.exe
  2⤵
  PID:5772
- C:\Windows\System\duyylDi.exe
  C:\Windows\System\duyylDi.exe
  2⤵
  PID:5800
- C:\Windows\System\MwPCnSD.exe
  C:\Windows\System\MwPCnSD.exe
  2⤵
  PID:5828
- C:\Windows\System\FQExCas.exe
  C:\Windows\System\FQExCas.exe
  2⤵
  PID:5848
- C:\Windows\System\AMsvCVf.exe
  C:\Windows\System\AMsvCVf.exe
  2⤵
  PID:5884
- C:\Windows\System\EjFxjrf.exe
  C:\Windows\System\EjFxjrf.exe
  2⤵
  PID:5912
- C:\Windows\System\rFOYySw.exe
  C:\Windows\System\rFOYySw.exe
  2⤵
  PID:5940
- C:\Windows\System\ckoQotD.exe
  C:\Windows\System\ckoQotD.exe
  2⤵
  PID:5960
- C:\Windows\System\yuNCnAS.exe
  C:\Windows\System\yuNCnAS.exe
  2⤵
  PID:6012
- C:\Windows\System\GtRlkKE.exe
  C:\Windows\System\GtRlkKE.exe
  2⤵
  PID:6028
- C:\Windows\System\QgFLWDq.exe
  C:\Windows\System\QgFLWDq.exe
  2⤵
  PID:6044
- C:\Windows\System\BYSNGYu.exe
  C:\Windows\System\BYSNGYu.exe
  2⤵
  PID:6060
- C:\Windows\System\rwrFbqf.exe
  C:\Windows\System\rwrFbqf.exe
  2⤵
  PID:6076
- C:\Windows\System\fkmwUSt.exe
  C:\Windows\System\fkmwUSt.exe
  2⤵
  PID:4008
- C:\Windows\System\KMBSUso.exe
  C:\Windows\System\KMBSUso.exe
  2⤵
  PID:3688
- C:\Windows\System\wSgNbwt.exe
  C:\Windows\System\wSgNbwt.exe
  2⤵
  PID:4412
- C:\Windows\System\ZnVjpLb.exe
  C:\Windows\System\ZnVjpLb.exe
  2⤵
  PID:5172
- C:\Windows\System\hfBlACd.exe
  C:\Windows\System\hfBlACd.exe
  2⤵
  PID:5216
- C:\Windows\System\FpTexQC.exe
  C:\Windows\System\FpTexQC.exe
  2⤵
  PID:5336
- C:\Windows\System\eUFvOzs.exe
  C:\Windows\System\eUFvOzs.exe
  2⤵
  PID:5412
- C:\Windows\System\paneDMc.exe
  C:\Windows\System\paneDMc.exe
  2⤵
  PID:5468
- C:\Windows\System\bFcgTdH.exe
  C:\Windows\System\bFcgTdH.exe
  2⤵
  PID:5520
- C:\Windows\System\gpZYUdh.exe
  C:\Windows\System\gpZYUdh.exe
  2⤵
  PID:5568
- C:\Windows\System\FePeiZK.exe
  C:\Windows\System\FePeiZK.exe
  2⤵
  PID:5644
- C:\Windows\System\YHQzBmw.exe
  C:\Windows\System\YHQzBmw.exe
  2⤵
  PID:5692
- C:\Windows\System\dGTAYCP.exe
  C:\Windows\System\dGTAYCP.exe
  2⤵
  PID:5752
- C:\Windows\System\YFuYGFr.exe
  C:\Windows\System\YFuYGFr.exe
  2⤵
  PID:5796
- C:\Windows\System\oZSikaR.exe
  C:\Windows\System\oZSikaR.exe
  2⤵
  PID:6072
- C:\Windows\System\NgKUFXL.exe
  C:\Windows\System\NgKUFXL.exe
  2⤵
  PID:2084
- C:\Windows\System\nwkKAxp.exe
  C:\Windows\System\nwkKAxp.exe
  2⤵
  PID:4904
- C:\Windows\System\aGXdArH.exe
  C:\Windows\System\aGXdArH.exe
  2⤵
  PID:5156
- C:\Windows\System\rBcDMlW.exe
  C:\Windows\System\rBcDMlW.exe
  2⤵
  PID:5332
- C:\Windows\System\aGnsxYH.exe
  C:\Windows\System\aGnsxYH.exe
  2⤵
  PID:5248
- C:\Windows\System\WBUFPOw.exe
  C:\Windows\System\WBUFPOw.exe
  2⤵
  PID:5444
- C:\Windows\System\UTaaCfV.exe
  C:\Windows\System\UTaaCfV.exe
  2⤵
  PID:1752
- C:\Windows\System\FExBuWK.exe
  C:\Windows\System\FExBuWK.exe
  2⤵
  PID:5792
- C:\Windows\System\RKPlrdR.exe
  C:\Windows\System\RKPlrdR.exe
  2⤵
  PID:5720
- C:\Windows\System\VSJRovT.exe
  C:\Windows\System\VSJRovT.exe
  2⤵
  PID:5724
- C:\Windows\System\FeAiSKd.exe
  C:\Windows\System\FeAiSKd.exe
  2⤵
  PID:1568
- C:\Windows\System\aAEmBVz.exe
  C:\Windows\System\aAEmBVz.exe
  2⤵
  PID:2172
- C:\Windows\System\LNEezmb.exe
  C:\Windows\System\LNEezmb.exe
  2⤵
  PID:3652
- C:\Windows\System\RvtYgCE.exe
  C:\Windows\System\RvtYgCE.exe
  2⤵
  PID:3504
- C:\Windows\System\UtQRFyb.exe
  C:\Windows\System\UtQRFyb.exe
  2⤵
  PID:6124
- C:\Windows\System\qWHbcmJ.exe
  C:\Windows\System\qWHbcmJ.exe
  2⤵
  PID:740
- C:\Windows\System\DGcKOdC.exe
  C:\Windows\System\DGcKOdC.exe
  2⤵
  PID:2116
- C:\Windows\System\OGWCeAH.exe
  C:\Windows\System\OGWCeAH.exe
  2⤵
  PID:6112
- C:\Windows\System\kzUwlqw.exe
  C:\Windows\System\kzUwlqw.exe
  2⤵
  PID:1368
- C:\Windows\System\RDOAQqy.exe
  C:\Windows\System\RDOAQqy.exe
  2⤵
  PID:5448
- C:\Windows\System\JqZlNQK.exe
  C:\Windows\System\JqZlNQK.exe
  2⤵
  PID:5900
- C:\Windows\System\cLWxZlF.exe
  C:\Windows\System\cLWxZlF.exe
  2⤵
  PID:4860
- C:\Windows\System\oJzaQZn.exe
  C:\Windows\System\oJzaQZn.exe
  2⤵
  PID:5868
- C:\Windows\System\fIbAPmt.exe
  C:\Windows\System\fIbAPmt.exe
  2⤵
  PID:6128
- C:\Windows\System\jFdMRSS.exe
  C:\Windows\System\jFdMRSS.exe
  2⤵
  PID:456
- C:\Windows\System\tiRzQlS.exe
  C:\Windows\System\tiRzQlS.exe
  2⤵
  PID:3864
- C:\Windows\System\VejrFFg.exe
  C:\Windows\System\VejrFFg.exe
  2⤵
  PID:2300
- C:\Windows\System\DjcwTNh.exe
  C:\Windows\System\DjcwTNh.exe
  2⤵
  PID:3908
- C:\Windows\System\LmiyUUW.exe
  C:\Windows\System\LmiyUUW.exe
  2⤵
  PID:6152
- C:\Windows\System\WWhwQPw.exe
  C:\Windows\System\WWhwQPw.exe
  2⤵
  PID:6172
- C:\Windows\System\iWsJGhy.exe
  C:\Windows\System\iWsJGhy.exe
  2⤵
  PID:6196
- C:\Windows\System\EGeMlqt.exe
  C:\Windows\System\EGeMlqt.exe
  2⤵
  PID:6236
- C:\Windows\System\jHeFxFT.exe
  C:\Windows\System\jHeFxFT.exe
  2⤵
  PID:6256
- C:\Windows\System\nieJBKe.exe
  C:\Windows\System\nieJBKe.exe
  2⤵
  PID:6280
- C:\Windows\System\MrWWZmg.exe
  C:\Windows\System\MrWWZmg.exe
  2⤵
  PID:6300
- C:\Windows\System\bwXwpJj.exe
  C:\Windows\System\bwXwpJj.exe
  2⤵
  PID:6356
- C:\Windows\System\neAYipt.exe
  C:\Windows\System\neAYipt.exe
  2⤵
  PID:6400
- C:\Windows\System\oEOTQbk.exe
  C:\Windows\System\oEOTQbk.exe
  2⤵
  PID:6428
- C:\Windows\System\yPuZAHI.exe
  C:\Windows\System\yPuZAHI.exe
  2⤵
  PID:6452
- C:\Windows\System\fynpJix.exe
  C:\Windows\System\fynpJix.exe
  2⤵
  PID:6472
- C:\Windows\System\NojNHRV.exe
  C:\Windows\System\NojNHRV.exe
  2⤵
  PID:6504
- C:\Windows\System\YZryoUa.exe
  C:\Windows\System\YZryoUa.exe
  2⤵
  PID:6532
- C:\Windows\System\aKgemUU.exe
  C:\Windows\System\aKgemUU.exe
  2⤵
  PID:6560
- C:\Windows\System\bFVjept.exe
  C:\Windows\System\bFVjept.exe
  2⤵
  PID:6584
- C:\Windows\System\FqpXNhW.exe
  C:\Windows\System\FqpXNhW.exe
  2⤵
  PID:6624
- C:\Windows\System\gubKGEv.exe
  C:\Windows\System\gubKGEv.exe
  2⤵
  PID:6648
- C:\Windows\System\mhZMxpW.exe
  C:\Windows\System\mhZMxpW.exe
  2⤵
  PID:6668
- C:\Windows\System\ZuNgHkp.exe
  C:\Windows\System\ZuNgHkp.exe
  2⤵
  PID:6708
- C:\Windows\System\vOvCdEg.exe
  C:\Windows\System\vOvCdEg.exe
  2⤵
  PID:6732
- C:\Windows\System\QwymRop.exe
  C:\Windows\System\QwymRop.exe
  2⤵
  PID:6756
- C:\Windows\System\hVxOlBl.exe
  C:\Windows\System\hVxOlBl.exe
  2⤵
  PID:6776
- C:\Windows\System\nMdpczJ.exe
  C:\Windows\System\nMdpczJ.exe
  2⤵
  PID:6800
- C:\Windows\System\FojUAHc.exe
  C:\Windows\System\FojUAHc.exe
  2⤵
  PID:6836
- C:\Windows\System\SNiRZJh.exe
  C:\Windows\System\SNiRZJh.exe
  2⤵
  PID:6856
- C:\Windows\System\AIjvYQc.exe
  C:\Windows\System\AIjvYQc.exe
  2⤵
  PID:6888
- C:\Windows\System\hwcfCDx.exe
  C:\Windows\System\hwcfCDx.exe
  2⤵
  PID:6908
- C:\Windows\System\NfZUkEZ.exe
  C:\Windows\System\NfZUkEZ.exe
  2⤵
  PID:6948
- C:\Windows\System\XEVcMlJ.exe
  C:\Windows\System\XEVcMlJ.exe
  2⤵
  PID:6968
- C:\Windows\System\EVwiXoz.exe
  C:\Windows\System\EVwiXoz.exe
  2⤵
  PID:6992
- C:\Windows\System\pnNDNbR.exe
  C:\Windows\System\pnNDNbR.exe
  2⤵
  PID:7052
- C:\Windows\System\GSaPmIb.exe
  C:\Windows\System\GSaPmIb.exe
  2⤵
  PID:7100
- C:\Windows\System\PpgRiNx.exe
  C:\Windows\System\PpgRiNx.exe
  2⤵
  PID:7144
- C:\Windows\System\rBVrtoA.exe
  C:\Windows\System\rBVrtoA.exe
  2⤵
  PID:2844
- C:\Windows\System\kzYsmsg.exe
  C:\Windows\System\kzYsmsg.exe
  2⤵
  PID:4152
- C:\Windows\System\mZiXoqP.exe
  C:\Windows\System\mZiXoqP.exe
  2⤵
  PID:6232
- C:\Windows\System\VKpcbzh.exe
  C:\Windows\System\VKpcbzh.exe
  2⤵
  PID:6296
- C:\Windows\System\dUHFzrY.exe
  C:\Windows\System\dUHFzrY.exe
  2⤵
  PID:6320
- C:\Windows\System\zxFUSCK.exe
  C:\Windows\System\zxFUSCK.exe
  2⤵
  PID:6420
- C:\Windows\System\umEsYvI.exe
  C:\Windows\System\umEsYvI.exe
  2⤵
  PID:6444
- C:\Windows\System\gPgiSyt.exe
  C:\Windows\System\gPgiSyt.exe
  2⤵
  PID:6464
- C:\Windows\System\SkozxLq.exe
  C:\Windows\System\SkozxLq.exe
  2⤵
  PID:6520
- C:\Windows\System\fTaamvy.exe
  C:\Windows\System\fTaamvy.exe
  2⤵
  PID:5936
- C:\Windows\System\eHiAzIb.exe
  C:\Windows\System\eHiAzIb.exe
  2⤵
  PID:6632
- C:\Windows\System\PDXdbDn.exe
  C:\Windows\System\PDXdbDn.exe
  2⤵
  PID:6688
- C:\Windows\System\NOajWAS.exe
  C:\Windows\System\NOajWAS.exe
  2⤵
  PID:6748
- C:\Windows\System\HTUvRXK.exe
  C:\Windows\System\HTUvRXK.exe
  2⤵
  PID:6772
- C:\Windows\System\eNylVke.exe
  C:\Windows\System\eNylVke.exe
  2⤵
  PID:6868
- C:\Windows\System\MmDMjGT.exe
  C:\Windows\System\MmDMjGT.exe
  2⤵
  PID:6880
- C:\Windows\System\NVtOvNq.exe
  C:\Windows\System\NVtOvNq.exe
  2⤵
  PID:6932
- C:\Windows\System\JHTZIBa.exe
  C:\Windows\System\JHTZIBa.exe
  2⤵
  PID:7012
- C:\Windows\System\DstzwQZ.exe
  C:\Windows\System\DstzwQZ.exe
  2⤵
  PID:7032
- C:\Windows\System\nDRCFYO.exe
  C:\Windows\System\nDRCFYO.exe
  2⤵
  PID:7136
- C:\Windows\System\nxXFDMw.exe
  C:\Windows\System\nxXFDMw.exe
  2⤵
  PID:6004
- C:\Windows\System\LYxUumZ.exe
  C:\Windows\System\LYxUumZ.exe
  2⤵
  PID:6188
- C:\Windows\System\rUsRTYp.exe
  C:\Windows\System\rUsRTYp.exe
  2⤵
  PID:6496
- C:\Windows\System\EmllORM.exe
  C:\Windows\System\EmllORM.exe
  2⤵
  PID:6640
- C:\Windows\System\AquKdAG.exe
  C:\Windows\System\AquKdAG.exe
  2⤵
  PID:7080
- C:\Windows\System\WYMAYzq.exe
  C:\Windows\System\WYMAYzq.exe
  2⤵
  PID:6788
- C:\Windows\System\PsCIIpA.exe
  C:\Windows\System\PsCIIpA.exe
  2⤵
  PID:7116
- C:\Windows\System\bEKuFYh.exe
  C:\Windows\System\bEKuFYh.exe
  2⤵
  PID:6168
- C:\Windows\System\jdadXbr.exe
  C:\Windows\System\jdadXbr.exe
  2⤵
  PID:6448
- C:\Windows\System\YKVjoyN.exe
  C:\Windows\System\YKVjoyN.exe
  2⤵
  PID:6660
- C:\Windows\System\tCCSFkM.exe
  C:\Windows\System\tCCSFkM.exe
  2⤵
  PID:6148
- C:\Windows\System\IqKgIYW.exe
  C:\Windows\System\IqKgIYW.exe
  2⤵
  PID:7004
- C:\Windows\System\cJRUsAU.exe
  C:\Windows\System\cJRUsAU.exe
  2⤵
  PID:7180
- C:\Windows\System\zXkJKce.exe
  C:\Windows\System\zXkJKce.exe
  2⤵
  PID:7212
- C:\Windows\System\rjGTMJS.exe
  C:\Windows\System\rjGTMJS.exe
  2⤵
  PID:7236
- C:\Windows\System\BYlEtpJ.exe
  C:\Windows\System\BYlEtpJ.exe
  2⤵
  PID:7280
- C:\Windows\System\buYjBkU.exe
  C:\Windows\System\buYjBkU.exe
  2⤵
  PID:7304
- C:\Windows\System\KYuVLix.exe
  C:\Windows\System\KYuVLix.exe
  2⤵
  PID:7328
- C:\Windows\System\lgNnEEH.exe
  C:\Windows\System\lgNnEEH.exe
  2⤵
  PID:7352
- C:\Windows\System\NtEEigX.exe
  C:\Windows\System\NtEEigX.exe
  2⤵
  PID:7416
- C:\Windows\System\tGwEQmu.exe
  C:\Windows\System\tGwEQmu.exe
  2⤵
  PID:7452
- C:\Windows\System\NRWrNRl.exe
  C:\Windows\System\NRWrNRl.exe
  2⤵
  PID:7472
- C:\Windows\System\ODWjBuI.exe
  C:\Windows\System\ODWjBuI.exe
  2⤵
  PID:7500
- C:\Windows\System\UddKuov.exe
  C:\Windows\System\UddKuov.exe
  2⤵
  PID:7520
- C:\Windows\System\stnClVH.exe
  C:\Windows\System\stnClVH.exe
  2⤵
  PID:7548
- C:\Windows\System\kWdSSCY.exe
  C:\Windows\System\kWdSSCY.exe
  2⤵
  PID:7572
- C:\Windows\System\MbtrfZx.exe
  C:\Windows\System\MbtrfZx.exe
  2⤵
  PID:7592
- C:\Windows\System\riIkYEG.exe
  C:\Windows\System\riIkYEG.exe
  2⤵
  PID:7636
- C:\Windows\System\CJreWEn.exe
  C:\Windows\System\CJreWEn.exe
  2⤵
  PID:7656
- C:\Windows\System\JRUhyGM.exe
  C:\Windows\System\JRUhyGM.exe
  2⤵
  PID:7676
- C:\Windows\System\eMJwDzZ.exe
  C:\Windows\System\eMJwDzZ.exe
  2⤵
  PID:7700
- C:\Windows\System\xybHViC.exe
  C:\Windows\System\xybHViC.exe
  2⤵
  PID:7732
- C:\Windows\System\rzKRMdM.exe
  C:\Windows\System\rzKRMdM.exe
  2⤵
  PID:7756
- C:\Windows\System\QYRZNLx.exe
  C:\Windows\System\QYRZNLx.exe
  2⤵
  PID:7780
- C:\Windows\System\llisonE.exe
  C:\Windows\System\llisonE.exe
  2⤵
  PID:7796
- C:\Windows\System\BTqpadq.exe
  C:\Windows\System\BTqpadq.exe
  2⤵
  PID:7820
- C:\Windows\System\Nzddvlv.exe
  C:\Windows\System\Nzddvlv.exe
  2⤵
  PID:7844
- C:\Windows\System\jsDQPKO.exe
  C:\Windows\System\jsDQPKO.exe
  2⤵
  PID:7864
- C:\Windows\System\CUWBlez.exe
  C:\Windows\System\CUWBlez.exe
  2⤵
  PID:7884
- C:\Windows\System\fIbjjkO.exe
  C:\Windows\System\fIbjjkO.exe
  2⤵
  PID:7908
- C:\Windows\System\IiQbIag.exe
  C:\Windows\System\IiQbIag.exe
  2⤵
  PID:7932
- C:\Windows\System\cDywwiV.exe
  C:\Windows\System\cDywwiV.exe
  2⤵
  PID:7956
- C:\Windows\System\AmQcsep.exe
  C:\Windows\System\AmQcsep.exe
  2⤵
  PID:7976
- C:\Windows\System\uPzDLAA.exe
  C:\Windows\System\uPzDLAA.exe
  2⤵
  PID:8000
- C:\Windows\System\IAfBghU.exe
  C:\Windows\System\IAfBghU.exe
  2⤵
  PID:8028
- C:\Windows\System\gbnTVxm.exe
  C:\Windows\System\gbnTVxm.exe
  2⤵
  PID:8056
- C:\Windows\System\FhEZvvZ.exe
  C:\Windows\System\FhEZvvZ.exe
  2⤵
  PID:8076
- C:\Windows\System\yZmsAgf.exe
  C:\Windows\System\yZmsAgf.exe
  2⤵
  PID:8096
- C:\Windows\System\krQbXfc.exe
  C:\Windows\System\krQbXfc.exe
  2⤵
  PID:8144
- C:\Windows\System\olRdYbf.exe
  C:\Windows\System\olRdYbf.exe
  2⤵
  PID:8172
- C:\Windows\System\mkXaxVH.exe
  C:\Windows\System\mkXaxVH.exe
  2⤵
  PID:6768
- C:\Windows\System\jvQsQYq.exe
  C:\Windows\System\jvQsQYq.exe
  2⤵
  PID:6180
- C:\Windows\System\uFxpDJh.exe
  C:\Windows\System\uFxpDJh.exe
  2⤵
  PID:7204
- C:\Windows\System\AjfhuUx.exe
  C:\Windows\System\AjfhuUx.exe
  2⤵
  PID:3884
- C:\Windows\System\RTrUxMK.exe
  C:\Windows\System\RTrUxMK.exe
  2⤵
  PID:7516
- C:\Windows\System\FCiQRre.exe
  C:\Windows\System\FCiQRre.exe
  2⤵
  PID:7468
- C:\Windows\System\ZPpurNb.exe
  C:\Windows\System\ZPpurNb.exe
  2⤵
  PID:2448
- C:\Windows\System\oFEgzvh.exe
  C:\Windows\System\oFEgzvh.exe
  2⤵
  PID:7672
- C:\Windows\System\wqJiQOF.exe
  C:\Windows\System\wqJiQOF.exe
  2⤵
  PID:7720
- C:\Windows\System\JHXPHgf.exe
  C:\Windows\System\JHXPHgf.exe
  2⤵
  PID:7716
- C:\Windows\System\sdZoMtB.exe
  C:\Windows\System\sdZoMtB.exe
  2⤵
  PID:7776
- C:\Windows\System\nJeJeLq.exe
  C:\Windows\System\nJeJeLq.exe
  2⤵
  PID:7940
- C:\Windows\System\cxQVCnM.exe
  C:\Windows\System\cxQVCnM.exe
  2⤵
  PID:7916
- C:\Windows\System\bJwTxCf.exe
  C:\Windows\System\bJwTxCf.exe
  2⤵
  PID:7968
- C:\Windows\System\ZHChbCO.exe
  C:\Windows\System\ZHChbCO.exe
  2⤵
  PID:7856
- C:\Windows\System\bkmlbvA.exe
  C:\Windows\System\bkmlbvA.exe
  2⤵
  PID:8016
- C:\Windows\System\pYDEuHG.exe
  C:\Windows\System\pYDEuHG.exe
  2⤵
  PID:7992
- C:\Windows\System\ijeRrOj.exe
  C:\Windows\System\ijeRrOj.exe
  2⤵
  PID:8088
- C:\Windows\System\qikpxHV.exe
  C:\Windows\System\qikpxHV.exe
  2⤵
  PID:6348
- C:\Windows\System\cdqCOoN.exe
  C:\Windows\System\cdqCOoN.exe
  2⤵
  PID:7424
- C:\Windows\System\ZumsHFq.exe
  C:\Windows\System\ZumsHFq.exe
  2⤵
  PID:7440
- C:\Windows\System\UaYPiXo.exe
  C:\Windows\System\UaYPiXo.exe
  2⤵
  PID:7384
- C:\Windows\System\FwvQvNx.exe
  C:\Windows\System\FwvQvNx.exe
  2⤵
  PID:7904
- C:\Windows\System\okWOhAh.exe
  C:\Windows\System\okWOhAh.exe
  2⤵
  PID:7772
- C:\Windows\System\aemEAPZ.exe
  C:\Windows\System\aemEAPZ.exe
  2⤵
  PID:3300
- C:\Windows\System\UiULvqF.exe
  C:\Windows\System\UiULvqF.exe
  2⤵
  PID:8204
- C:\Windows\System\nQMnfaQ.exe
  C:\Windows\System\nQMnfaQ.exe
  2⤵
  PID:8224
- C:\Windows\System\cxXXEJF.exe
  C:\Windows\System\cxXXEJF.exe
  2⤵
  PID:8252
- C:\Windows\System\triKLyZ.exe
  C:\Windows\System\triKLyZ.exe
  2⤵
  PID:8280
- C:\Windows\System\SsgFGAv.exe
  C:\Windows\System\SsgFGAv.exe
  2⤵
  PID:8308
- C:\Windows\System\qJbqORD.exe
  C:\Windows\System\qJbqORD.exe
  2⤵
  PID:8328
- C:\Windows\System\avqitpE.exe
  C:\Windows\System\avqitpE.exe
  2⤵
  PID:8348
- C:\Windows\System\nEIoHOo.exe
  C:\Windows\System\nEIoHOo.exe
  2⤵
  PID:8368
- C:\Windows\System\PtsVcWi.exe
  C:\Windows\System\PtsVcWi.exe
  2⤵
  PID:8404
- C:\Windows\System\GgUoNON.exe
  C:\Windows\System\GgUoNON.exe
  2⤵
  PID:8432
- C:\Windows\System\CKWHuYj.exe
  C:\Windows\System\CKWHuYj.exe
  2⤵
  PID:8456
- C:\Windows\System\eMmxNtH.exe
  C:\Windows\System\eMmxNtH.exe
  2⤵
  PID:8480
- C:\Windows\System\IuFQiTr.exe
  C:\Windows\System\IuFQiTr.exe
  2⤵
  PID:8500
- C:\Windows\System\tgWQpip.exe
  C:\Windows\System\tgWQpip.exe
  2⤵
  PID:8520
- C:\Windows\System\LxolDkU.exe
  C:\Windows\System\LxolDkU.exe
  2⤵
  PID:8552
- C:\Windows\System\yUeZwIy.exe
  C:\Windows\System\yUeZwIy.exe
  2⤵
  PID:8572
- C:\Windows\System\xtzhVAe.exe
  C:\Windows\System\xtzhVAe.exe
  2⤵
  PID:8592
- C:\Windows\System\spUUQwM.exe
  C:\Windows\System\spUUQwM.exe
  2⤵
  PID:8624
- C:\Windows\System\hCJEDQI.exe
  C:\Windows\System\hCJEDQI.exe
  2⤵
  PID:8708
- C:\Windows\System\qMCCkge.exe
  C:\Windows\System\qMCCkge.exe
  2⤵
  PID:8724
- C:\Windows\System\xBBCOGz.exe
  C:\Windows\System\xBBCOGz.exe
  2⤵
  PID:8756
- C:\Windows\System\dartEsC.exe
  C:\Windows\System\dartEsC.exe
  2⤵
  PID:8780
- C:\Windows\System\LAbeSRj.exe
  C:\Windows\System\LAbeSRj.exe
  2⤵
  PID:8864
- C:\Windows\System\wTOBKFm.exe
  C:\Windows\System\wTOBKFm.exe
  2⤵
  PID:8884
- C:\Windows\System\qEQuDTn.exe
  C:\Windows\System\qEQuDTn.exe
  2⤵
  PID:8900
- C:\Windows\System\vlaGdzP.exe
  C:\Windows\System\vlaGdzP.exe
  2⤵
  PID:8924
- C:\Windows\System\VCjXWxV.exe
  C:\Windows\System\VCjXWxV.exe
  2⤵
  PID:8948
- C:\Windows\System\pTCbWRx.exe
  C:\Windows\System\pTCbWRx.exe
  2⤵
  PID:8968
- C:\Windows\System\GtKLzRK.exe
  C:\Windows\System\GtKLzRK.exe
  2⤵
  PID:8988
- C:\Windows\System\vQlhfDH.exe
  C:\Windows\System\vQlhfDH.exe
  2⤵
  PID:9008
- C:\Windows\System\kjxVrSF.exe
  C:\Windows\System\kjxVrSF.exe
  2⤵
  PID:9028
- C:\Windows\System\BbDXIjN.exe
  C:\Windows\System\BbDXIjN.exe
  2⤵
  PID:9056
- C:\Windows\System\TYNIwlj.exe
  C:\Windows\System\TYNIwlj.exe
  2⤵
  PID:9148
- C:\Windows\System\aRsgeTe.exe
  C:\Windows\System\aRsgeTe.exe
  2⤵
  PID:9164
- C:\Windows\System\wDCpGqr.exe
  C:\Windows\System\wDCpGqr.exe
  2⤵
  PID:9184
- C:\Windows\System\mlYIdMn.exe
  C:\Windows\System\mlYIdMn.exe
  2⤵
  PID:8620
- C:\Windows\System\Llsvrod.exe
  C:\Windows\System\Llsvrod.exe
  2⤵
  PID:8292
- C:\Windows\System\PceLVOH.exe
  C:\Windows\System\PceLVOH.exe
  2⤵
  PID:8540
- C:\Windows\System\bLHbSmk.exe
  C:\Windows\System\bLHbSmk.exe
  2⤵
  PID:8376
- C:\Windows\System\ZmteLHV.exe
  C:\Windows\System\ZmteLHV.exe
  2⤵
  PID:8660
- C:\Windows\System\EjWhKKH.exe
  C:\Windows\System\EjWhKKH.exe
  2⤵
  PID:8584
- C:\Windows\System\ERBWdfD.exe
  C:\Windows\System\ERBWdfD.exe
  2⤵
  PID:8716
- C:\Windows\System\lkRiRQu.exe
  C:\Windows\System\lkRiRQu.exe
  2⤵
  PID:8836
- C:\Windows\System\trvEIVy.exe
  C:\Windows\System\trvEIVy.exe
  2⤵
  PID:8956
- C:\Windows\System\uJWdXOP.exe
  C:\Windows\System\uJWdXOP.exe
  2⤵
  PID:9036
- C:\Windows\System\UJJnuIO.exe
  C:\Windows\System\UJJnuIO.exe
  2⤵
  PID:9080
- C:\Windows\System\kGulmcI.exe
  C:\Windows\System\kGulmcI.exe
  2⤵
  PID:8048
- C:\Windows\System\OhkJiuF.exe
  C:\Windows\System\OhkJiuF.exe
  2⤵
  PID:7852
- C:\Windows\System\DMenBrI.exe
  C:\Windows\System\DMenBrI.exe
  2⤵
  PID:2652
- C:\Windows\System\xYLaFmh.exe
  C:\Windows\System\xYLaFmh.exe
  2⤵
  PID:9132
- C:\Windows\System\sknzJIk.exe
  C:\Windows\System\sknzJIk.exe
  2⤵
  PID:8488
- C:\Windows\System\HVeyjkE.exe
  C:\Windows\System\HVeyjkE.exe
  2⤵
  PID:8768
- C:\Windows\System\PMwDzkz.exe
  C:\Windows\System\PMwDzkz.exe
  2⤵
  PID:1508
- C:\Windows\System\KHJPsST.exe
  C:\Windows\System\KHJPsST.exe
  2⤵
  PID:4600
- C:\Windows\System\QUGFXFD.exe
  C:\Windows\System\QUGFXFD.exe
  2⤵
  PID:8720
- C:\Windows\System\GhPMqtO.exe
  C:\Windows\System\GhPMqtO.exe
  2⤵
  PID:9092
- C:\Windows\System\OcGODMf.exe
  C:\Windows\System\OcGODMf.exe
  2⤵
  PID:9160
- C:\Windows\System\RmAdpkR.exe
  C:\Windows\System\RmAdpkR.exe
  2⤵
  PID:9176
- C:\Windows\System\GoAjecs.exe
  C:\Windows\System\GoAjecs.exe
  2⤵
  PID:3832
- C:\Windows\System\JLZguSV.exe
  C:\Windows\System\JLZguSV.exe
  2⤵
  PID:4700
- C:\Windows\System\GGHueIV.exe
  C:\Windows\System\GGHueIV.exe
  2⤵
  PID:9020
- C:\Windows\System\CUwCUVK.exe
  C:\Windows\System\CUwCUVK.exe
  2⤵
  PID:9000
- C:\Windows\System\kEYVdaS.exe
  C:\Windows\System\kEYVdaS.exe
  2⤵
  PID:5152
- C:\Windows\System\HwstJBk.exe
  C:\Windows\System\HwstJBk.exe
  2⤵
  PID:9236
- C:\Windows\System\KBKnKJd.exe
  C:\Windows\System\KBKnKJd.exe
  2⤵
  PID:9264
- C:\Windows\System\kxaaRYz.exe
  C:\Windows\System\kxaaRYz.exe
  2⤵
  PID:9284
- C:\Windows\System\SRDcAgf.exe
  C:\Windows\System\SRDcAgf.exe
  2⤵
  PID:9308
- C:\Windows\System\MKHNRwB.exe
  C:\Windows\System\MKHNRwB.exe
  2⤵
  PID:9332
- C:\Windows\System\XEkVaCQ.exe
  C:\Windows\System\XEkVaCQ.exe
  2⤵
  PID:9352
- C:\Windows\System\UifPktN.exe
  C:\Windows\System\UifPktN.exe
  2⤵
  PID:9368
- C:\Windows\System\UJafjQw.exe
  C:\Windows\System\UJafjQw.exe
  2⤵
  PID:9484
- C:\Windows\System\gifDNzs.exe
  C:\Windows\System\gifDNzs.exe
  2⤵
  PID:9504
- C:\Windows\System\TtQTtRK.exe
  C:\Windows\System\TtQTtRK.exe
  2⤵
  PID:9524
- C:\Windows\System\sanToDA.exe
  C:\Windows\System\sanToDA.exe
  2⤵
  PID:9552
- C:\Windows\System\mAehytY.exe
  C:\Windows\System\mAehytY.exe
  2⤵
  PID:9584
- C:\Windows\System\PRabmkz.exe
  C:\Windows\System\PRabmkz.exe
  2⤵
  PID:9608
- C:\Windows\System\HgBQEyx.exe
  C:\Windows\System\HgBQEyx.exe
  2⤵
  PID:9636
- C:\Windows\System\qpGIzVR.exe
  C:\Windows\System\qpGIzVR.exe
  2⤵
  PID:9656
- C:\Windows\System\PkmcPDM.exe
  C:\Windows\System\PkmcPDM.exe
  2⤵
  PID:9684
- C:\Windows\System\kDbdeiG.exe
  C:\Windows\System\kDbdeiG.exe
  2⤵
  PID:9704
- C:\Windows\System\oUJrtSD.exe
  C:\Windows\System\oUJrtSD.exe
  2⤵
  PID:9720
- C:\Windows\System\DfHJhiS.exe
  C:\Windows\System\DfHJhiS.exe
  2⤵
  PID:9744
- C:\Windows\System\AjlFtUI.exe
  C:\Windows\System\AjlFtUI.exe
  2⤵
  PID:9780
- C:\Windows\System\rICHNhF.exe
  C:\Windows\System\rICHNhF.exe
  2⤵
  PID:9796
- C:\Windows\System\VkXrxFm.exe
  C:\Windows\System\VkXrxFm.exe
  2⤵
  PID:9820
- C:\Windows\System\SKhYbqS.exe
  C:\Windows\System\SKhYbqS.exe
  2⤵
  PID:9836
- C:\Windows\System\XHgeOrU.exe
  C:\Windows\System\XHgeOrU.exe
  2⤵
  PID:9860
- C:\Windows\System\XCaRaDM.exe
  C:\Windows\System\XCaRaDM.exe
  2⤵
  PID:9876
- C:\Windows\System\VBpezJp.exe
  C:\Windows\System\VBpezJp.exe
  2⤵
  PID:9900
- C:\Windows\System\DOCgmSX.exe
  C:\Windows\System\DOCgmSX.exe
  2⤵
  PID:9924
- C:\Windows\System\aVwNnqa.exe
  C:\Windows\System\aVwNnqa.exe
  2⤵
  PID:9952
- C:\Windows\System\yKkhikQ.exe
  C:\Windows\System\yKkhikQ.exe
  2⤵
  PID:9976
- C:\Windows\System\GbNlFnc.exe
  C:\Windows\System\GbNlFnc.exe
  2⤵
  PID:9996
- C:\Windows\System\SzKefft.exe
  C:\Windows\System\SzKefft.exe
  2⤵
  PID:10020
- C:\Windows\System\udvqBYP.exe
  C:\Windows\System\udvqBYP.exe
  2⤵
  PID:10044
- C:\Windows\System\dtrlerr.exe
  C:\Windows\System\dtrlerr.exe
  2⤵
  PID:10064
- C:\Windows\System\dQOekTz.exe
  C:\Windows\System\dQOekTz.exe
  2⤵
  PID:10080
- C:\Windows\System\GjXbIdg.exe
  C:\Windows\System\GjXbIdg.exe
  2⤵
  PID:10104
- C:\Windows\System\PBqQNZq.exe
  C:\Windows\System\PBqQNZq.exe
  2⤵
  PID:10132
- C:\Windows\System\sPrbvDF.exe
  C:\Windows\System\sPrbvDF.exe
  2⤵
  PID:10156
- C:\Windows\System\MeOLbgA.exe
  C:\Windows\System\MeOLbgA.exe
  2⤵
  PID:10184
- C:\Windows\System\tpstYrY.exe
  C:\Windows\System\tpstYrY.exe
  2⤵
  PID:10212
- C:\Windows\System\odvUzaO.exe
  C:\Windows\System\odvUzaO.exe
  2⤵
  PID:10236
- C:\Windows\System\EitUDrq.exe
  C:\Windows\System\EitUDrq.exe
  2⤵
  PID:7752
- C:\Windows\System\HiDebam.exe
  C:\Windows\System\HiDebam.exe
  2⤵
  PID:7668
- C:\Windows\System\HPLkzPH.exe
  C:\Windows\System\HPLkzPH.exe
  2⤵
  PID:4652
- C:\Windows\System\VmsJBvP.exe
  C:\Windows\System\VmsJBvP.exe
  2⤵
  PID:9920
- C:\Windows\System\DVqsuHW.exe
  C:\Windows\System\DVqsuHW.exe
  2⤵
  PID:9948
- C:\Windows\System\bFSQArr.exe
  C:\Windows\System\bFSQArr.exe
  2⤵
  PID:10100
- C:\Windows\System\bQNDzfI.exe
  C:\Windows\System\bQNDzfI.exe
  2⤵
  PID:9968
- C:\Windows\System\NjnWfhF.exe
  C:\Windows\System\NjnWfhF.exe
  2⤵
  PID:10028
- C:\Windows\System\wgEGVih.exe
  C:\Windows\System\wgEGVih.exe
  2⤵
  PID:10112
- C:\Windows\System\HEvGgTR.exe
  C:\Windows\System\HEvGgTR.exe
  2⤵
  PID:9988
- C:\Windows\System\HGQzykl.exe
  C:\Windows\System\HGQzykl.exe
  2⤵
  PID:10072
- C:\Windows\System\ZMkfiYJ.exe
  C:\Windows\System\ZMkfiYJ.exe
  2⤵
  PID:2760
- C:\Windows\System\jcbYYOF.exe
  C:\Windows\System\jcbYYOF.exe
  2⤵
  PID:9316
- C:\Windows\System\jVNVrNl.exe
  C:\Windows\System\jVNVrNl.exe
  2⤵
  PID:9516
- C:\Windows\System\AcWiXev.exe
  C:\Windows\System\AcWiXev.exe
  2⤵
  PID:1756
- C:\Windows\System\TiAxroz.exe
  C:\Windows\System\TiAxroz.exe
  2⤵
  PID:9740
- C:\Windows\System\THknpHs.exe
  C:\Windows\System\THknpHs.exe
  2⤵
  PID:9520
- C:\Windows\System\XngCovX.exe
  C:\Windows\System\XngCovX.exe
  2⤵
  PID:3512
- C:\Windows\System\lsrMNuu.exe
  C:\Windows\System\lsrMNuu.exe
  2⤵
  PID:8396
- C:\Windows\System\LXXOcjM.exe
  C:\Windows\System\LXXOcjM.exe
  2⤵
  PID:9916
- C:\Windows\System\LkfcAgI.exe
  C:\Windows\System\LkfcAgI.exe
  2⤵
  PID:10012
- C:\Windows\System\TGScedw.exe
  C:\Windows\System\TGScedw.exe
  2⤵
  PID:8532
- C:\Windows\System\ruROPlx.exe
  C:\Windows\System\ruROPlx.exe
  2⤵
  PID:1012
- C:\Windows\System\vYSAdTj.exe
  C:\Windows\System\vYSAdTj.exe
  2⤵
  PID:9544
- C:\Windows\System\MjaMbLK.exe
  C:\Windows\System\MjaMbLK.exe
  2⤵
  PID:9088
- C:\Windows\System\hzlageJ.exe
  C:\Windows\System\hzlageJ.exe
  2⤵
  PID:10256
- C:\Windows\System\XuyUbXU.exe
  C:\Windows\System\XuyUbXU.exe
  2⤵
  PID:10304
- C:\Windows\System\DtrutHL.exe
  C:\Windows\System\DtrutHL.exe
  2⤵
  PID:10328
- C:\Windows\System\hMwIfMC.exe
  C:\Windows\System\hMwIfMC.exe
  2⤵
  PID:10400
- C:\Windows\System\UmtWOiv.exe
  C:\Windows\System\UmtWOiv.exe
  2⤵
  PID:10424
- C:\Windows\System\aIEulYC.exe
  C:\Windows\System\aIEulYC.exe
  2⤵
  PID:10452
- C:\Windows\System\HCYRsAo.exe
  C:\Windows\System\HCYRsAo.exe
  2⤵
  PID:10480
- C:\Windows\System\dwfQnHq.exe
  C:\Windows\System\dwfQnHq.exe
  2⤵
  PID:10556
- C:\Windows\System\pLesWJT.exe
  C:\Windows\System\pLesWJT.exe
  2⤵
  PID:10584
- C:\Windows\System\wKdXoCc.exe
  C:\Windows\System\wKdXoCc.exe
  2⤵
  PID:10608
- C:\Windows\System\OizxzuT.exe
  C:\Windows\System\OizxzuT.exe
  2⤵
  PID:10624
- C:\Windows\System\aSQJadg.exe
  C:\Windows\System\aSQJadg.exe
  2⤵
  PID:10652
- C:\Windows\System\qrxqfrr.exe
  C:\Windows\System\qrxqfrr.exe
  2⤵
  PID:10676
- C:\Windows\System\jTrbmsU.exe
  C:\Windows\System\jTrbmsU.exe
  2⤵
  PID:10708
- C:\Windows\System\damMvnY.exe
  C:\Windows\System\damMvnY.exe
  2⤵
  PID:10756
- C:\Windows\System\xwtEWfV.exe
  C:\Windows\System\xwtEWfV.exe
  2⤵
  PID:10780
- C:\Windows\System\QiaZFsV.exe
  C:\Windows\System\QiaZFsV.exe
  2⤵
  PID:10812
- C:\Windows\System\IwRLhAN.exe
  C:\Windows\System\IwRLhAN.exe
  2⤵
  PID:10832
- C:\Windows\System\vuTQRYi.exe
  C:\Windows\System\vuTQRYi.exe
  2⤵
  PID:10864
- C:\Windows\System\fzIVCAQ.exe
  C:\Windows\System\fzIVCAQ.exe
  2⤵
  PID:10908
- C:\Windows\System\RJGuhkQ.exe
  C:\Windows\System\RJGuhkQ.exe
  2⤵
  PID:10932
- C:\Windows\System\jbLNKXd.exe
  C:\Windows\System\jbLNKXd.exe
  2⤵
  PID:10964
- C:\Windows\System\xBsHaXT.exe
  C:\Windows\System\xBsHaXT.exe
  2⤵
  PID:10984
- C:\Windows\System\iTDPjsv.exe
  C:\Windows\System\iTDPjsv.exe
  2⤵
  PID:11008
- C:\Windows\System\ZgpWrxQ.exe
  C:\Windows\System\ZgpWrxQ.exe
  2⤵
  PID:11024
- C:\Windows\System\ouIOoDM.exe
  C:\Windows\System\ouIOoDM.exe
  2⤵
  PID:11040
- C:\Windows\System\rZBFNuG.exe
  C:\Windows\System\rZBFNuG.exe
  2⤵
  PID:11080
- C:\Windows\System\UwpoSJo.exe
  C:\Windows\System\UwpoSJo.exe
  2⤵
  PID:11096
- C:\Windows\System\kPsKtLx.exe
  C:\Windows\System\kPsKtLx.exe
  2⤵
  PID:11116
- C:\Windows\System\FTUtVDi.exe
  C:\Windows\System\FTUtVDi.exe
  2⤵
  PID:11136
- C:\Windows\System\FXQLWyE.exe
  C:\Windows\System\FXQLWyE.exe
  2⤵
  PID:11160
- C:\Windows\System\KtjthmB.exe
  C:\Windows\System\KtjthmB.exe
  2⤵
  PID:11180
- C:\Windows\System\hYZwles.exe
  C:\Windows\System\hYZwles.exe
  2⤵
  PID:11240
- C:\Windows\System\vnpuFJf.exe
  C:\Windows\System\vnpuFJf.exe
  2⤵
  PID:11260
- C:\Windows\System\mEbiNcI.exe
  C:\Windows\System\mEbiNcI.exe
  2⤵
  PID:10144
- C:\Windows\System\DtxmYXs.exe
  C:\Windows\System\DtxmYXs.exe
  2⤵
  PID:8324
- C:\Windows\System\ZYRaQib.exe
  C:\Windows\System\ZYRaQib.exe
  2⤵
  PID:10368
- C:\Windows\System\TomiaMz.exe
  C:\Windows\System\TomiaMz.exe
  2⤵
  PID:10444
- C:\Windows\System\mZLqwTl.exe
  C:\Windows\System\mZLqwTl.exe
  2⤵
  PID:10504
- C:\Windows\System\uvVcFvG.exe
  C:\Windows\System\uvVcFvG.exe
  2⤵
  PID:10604
- C:\Windows\System\AweYIfZ.exe
  C:\Windows\System\AweYIfZ.exe
  2⤵
  PID:10616
- C:\Windows\System\cVcVIAD.exe
  C:\Windows\System\cVcVIAD.exe
  2⤵
  PID:10644
- C:\Windows\System\VZQqjJF.exe
  C:\Windows\System\VZQqjJF.exe
  2⤵
  PID:10828
- C:\Windows\System\zDUxAer.exe
  C:\Windows\System\zDUxAer.exe
  2⤵
  PID:10892
- C:\Windows\System\gbCZGMh.exe
  C:\Windows\System\gbCZGMh.exe
  2⤵
  PID:10940
- C:\Windows\System\iRCIFdE.exe
  C:\Windows\System\iRCIFdE.exe
  2⤵
  PID:11036
- C:\Windows\System\gaKQNsa.exe
  C:\Windows\System\gaKQNsa.exe
  2⤵
  PID:11168
- C:\Windows\System\xxgiFtb.exe
  C:\Windows\System\xxgiFtb.exe
  2⤵
  PID:11132
- C:\Windows\System\AMTOqtT.exe
  C:\Windows\System\AMTOqtT.exe
  2⤵
  PID:10276
- C:\Windows\System\DrMlifm.exe
  C:\Windows\System\DrMlifm.exe
  2⤵
  PID:10148
- C:\Windows\System\WpONJkY.exe
  C:\Windows\System\WpONJkY.exe
  2⤵
  PID:10344
- C:\Windows\System\lDHyMZq.exe
  C:\Windows\System\lDHyMZq.exe
  2⤵
  PID:10488
- C:\Windows\System\CayZAxi.exe
  C:\Windows\System\CayZAxi.exe
  2⤵
  PID:1540
- C:\Windows\System\kZeIoox.exe
  C:\Windows\System\kZeIoox.exe
  2⤵
  PID:3716
- C:\Windows\System\UspOrcE.exe
  C:\Windows\System\UspOrcE.exe
  2⤵
  PID:8444
- C:\Windows\System\TWJolXd.exe
  C:\Windows\System\TWJolXd.exe
  2⤵
  PID:10896
- C:\Windows\System\KWtvbPM.exe
  C:\Windows\System\KWtvbPM.exe
  2⤵
  PID:10952
- C:\Windows\System\cawkYNf.exe
  C:\Windows\System\cawkYNf.exe
  2⤵
  PID:10288
- C:\Windows\System\MQTunRc.exe
  C:\Windows\System\MQTunRc.exe
  2⤵
  PID:10996
- C:\Windows\System\GHrwJUw.exe
  C:\Windows\System\GHrwJUw.exe
  2⤵
  PID:400
- C:\Windows\System\PQGchZK.exe
  C:\Windows\System\PQGchZK.exe
  2⤵
  PID:10380
- C:\Windows\System\kBnAoEP.exe
  C:\Windows\System\kBnAoEP.exe
  2⤵
  PID:10472
- C:\Windows\System\vomYIkq.exe
  C:\Windows\System\vomYIkq.exe
  2⤵
  PID:4236
- C:\Windows\System\kjwlnLz.exe
  C:\Windows\System\kjwlnLz.exe
  2⤵
  PID:10920
- C:\Windows\System\aMEOqne.exe
  C:\Windows\System\aMEOqne.exe
  2⤵
  PID:11268
- C:\Windows\System\vKWHAgR.exe
  C:\Windows\System\vKWHAgR.exe
  2⤵
  PID:11284
- C:\Windows\System\rPEbouC.exe
  C:\Windows\System\rPEbouC.exe
  2⤵
  PID:11304
- C:\Windows\System\PdvfEsL.exe
  C:\Windows\System\PdvfEsL.exe
  2⤵
  PID:11384
- C:\Windows\System\csSOdSF.exe
  C:\Windows\System\csSOdSF.exe
  2⤵
  PID:11412
- C:\Windows\System\YUpQHzt.exe
  C:\Windows\System\YUpQHzt.exe
  2⤵
  PID:11480
- C:\Windows\System\oOUPECF.exe
  C:\Windows\System\oOUPECF.exe
  2⤵
  PID:11524
- C:\Windows\System\xPjgsDS.exe
  C:\Windows\System\xPjgsDS.exe
  2⤵
  PID:11540
- C:\Windows\System\cRuKjHc.exe
  C:\Windows\System\cRuKjHc.exe
  2⤵
  PID:11564
- C:\Windows\System\StNfnVY.exe
  C:\Windows\System\StNfnVY.exe
  2⤵
  PID:11588
- C:\Windows\System\KmxzFSh.exe
  C:\Windows\System\KmxzFSh.exe
  2⤵
  PID:11612
- C:\Windows\System\OxhfBvV.exe
  C:\Windows\System\OxhfBvV.exe
  2⤵
  PID:11700
- C:\Windows\System\NzCewEq.exe
  C:\Windows\System\NzCewEq.exe
  2⤵
  PID:11752
- C:\Windows\System\UeAvnJq.exe
  C:\Windows\System\UeAvnJq.exe
  2⤵
  PID:11772
- C:\Windows\System\JTMnyEB.exe
  C:\Windows\System\JTMnyEB.exe
  2⤵
  PID:11800
- C:\Windows\System\exAIXcu.exe
  C:\Windows\System\exAIXcu.exe
  2⤵
  PID:11816
- C:\Windows\System\XWZrtgT.exe
  C:\Windows\System\XWZrtgT.exe
  2⤵
  PID:11836
- C:\Windows\System\fNqaOMU.exe
  C:\Windows\System\fNqaOMU.exe
  2⤵
  PID:11864
- C:\Windows\System\qSBtqjj.exe
  C:\Windows\System\qSBtqjj.exe
  2⤵
  PID:11884
- C:\Windows\System\ollXenr.exe
  C:\Windows\System\ollXenr.exe
  2⤵
  PID:11904
- C:\Windows\System\gbtTLeM.exe
  C:\Windows\System\gbtTLeM.exe
  2⤵
  PID:11932
- C:\Windows\System\ESDcwfD.exe
  C:\Windows\System\ESDcwfD.exe
  2⤵
  PID:11952
- C:\Windows\System\hqufOkG.exe
  C:\Windows\System\hqufOkG.exe
  2⤵
  PID:11968
- C:\Windows\System\ABdHWAW.exe
  C:\Windows\System\ABdHWAW.exe
  2⤵
  PID:12000
- C:\Windows\System\uWfLXlI.exe
  C:\Windows\System\uWfLXlI.exe
  2⤵
  PID:12036
- C:\Windows\System\jFNbhxG.exe
  C:\Windows\System\jFNbhxG.exe
  2⤵
  PID:12260
- C:\Windows\System\IvzuBuB.exe
  C:\Windows\System\IvzuBuB.exe
  2⤵
  PID:2472
- C:\Windows\System\IRAiybI.exe
  C:\Windows\System\IRAiybI.exe
  2⤵
  PID:11016
- C:\Windows\System\rbtVumA.exe
  C:\Windows\System\rbtVumA.exe
  2⤵
  PID:3216
- C:\Windows\System\rcDikZx.exe
  C:\Windows\System\rcDikZx.exe
  2⤵
  PID:11300
- C:\Windows\System\uXvhwez.exe
  C:\Windows\System\uXvhwez.exe
  2⤵
  PID:11372
- C:\Windows\System\CZoPuIJ.exe
  C:\Windows\System\CZoPuIJ.exe
  2⤵
  PID:2516
- C:\Windows\System\HqHCkqV.exe
  C:\Windows\System\HqHCkqV.exe
  2⤵
  PID:11472
- C:\Windows\System\yytlrOG.exe
  C:\Windows\System\yytlrOG.exe
  2⤵
  PID:1436
- C:\Windows\System\cAkePBk.exe
  C:\Windows\System\cAkePBk.exe
  2⤵
  PID:11620
- C:\Windows\System\NlulSgM.exe
  C:\Windows\System\NlulSgM.exe
  2⤵
  PID:11680
- C:\Windows\System\JHlugcI.exe
  C:\Windows\System\JHlugcI.exe
  2⤵
  PID:11688
- C:\Windows\System\RMmAowi.exe
  C:\Windows\System\RMmAowi.exe
  2⤵
  PID:11768
- C:\Windows\System\CZJnFdk.exe
  C:\Windows\System\CZJnFdk.exe
  2⤵
  PID:11788
- C:\Windows\System\hxmLcGw.exe
  C:\Windows\System\hxmLcGw.exe
  2⤵
  PID:11828
- C:\Windows\System\yhoNYtc.exe
  C:\Windows\System\yhoNYtc.exe
  2⤵
  PID:11916
- C:\Windows\System\bKfXZWc.exe
  C:\Windows\System\bKfXZWc.exe
  2⤵
  PID:2936
- C:\Windows\System\RGgRmLX.exe
  C:\Windows\System\RGgRmLX.exe
  2⤵
  PID:12136
- C:\Windows\System\wMIptDd.exe
  C:\Windows\System\wMIptDd.exe
  2⤵
  PID:12168
- C:\Windows\System\AicsuBC.exe
  C:\Windows\System\AicsuBC.exe
  2⤵
  PID:12192
- C:\Windows\System\sDkgQrH.exe
  C:\Windows\System\sDkgQrH.exe
  2⤵
  PID:5012
- C:\Windows\System\gVwFiIP.exe
  C:\Windows\System\gVwFiIP.exe
  2⤵
  PID:12280
- C:\Windows\System\GnZXTXj.exe
  C:\Windows\System\GnZXTXj.exe
  2⤵
  PID:11064
- C:\Windows\System\XqFKkrN.exe
  C:\Windows\System\XqFKkrN.exe
  2⤵
  PID:11252
- C:\Windows\System\traADgn.exe
  C:\Windows\System\traADgn.exe
  2⤵
  PID:1492
- C:\Windows\System\WYUtROS.exe
  C:\Windows\System\WYUtROS.exe
  2⤵
  PID:11400
- C:\Windows\System\toRocaU.exe
  C:\Windows\System\toRocaU.exe
  2⤵
  PID:992
- C:\Windows\System\tZHUGla.exe
  C:\Windows\System\tZHUGla.exe
  2⤵
  PID:11348
- C:\Windows\System\FUwImOm.exe
  C:\Windows\System\FUwImOm.exe
  2⤵
  PID:4536
- C:\Windows\System\uEJzSmN.exe
  C:\Windows\System\uEJzSmN.exe
  2⤵
  PID:11608
- C:\Windows\System\febXrrF.exe
  C:\Windows\System\febXrrF.exe
  2⤵
  PID:608
- C:\Windows\System\mwsPzsO.exe
  C:\Windows\System\mwsPzsO.exe
  2⤵
  PID:11792
- C:\Windows\System\nnlImxZ.exe
  C:\Windows\System\nnlImxZ.exe
  2⤵
  PID:2132
- C:\Windows\System\suHRICK.exe
  C:\Windows\System\suHRICK.exe
  2⤵
  PID:12032
- C:\Windows\System\aOpdbUt.exe
  C:\Windows\System\aOpdbUt.exe
  2⤵
  PID:11976
- C:\Windows\System\fbHRtfP.exe
  C:\Windows\System\fbHRtfP.exe
  2⤵
  PID:4720
- C:\Windows\System\ohyUKiI.exe
  C:\Windows\System\ohyUKiI.exe
  2⤵
  PID:5728
- C:\Windows\System\pWZLsuY.exe
  C:\Windows\System\pWZLsuY.exe
  2⤵
  PID:2232
- C:\Windows\System\gwLktTW.exe
  C:\Windows\System\gwLktTW.exe
  2⤵
  PID:3952
- C:\Windows\System\MExiwiA.exe
  C:\Windows\System\MExiwiA.exe
  2⤵
  PID:5048
- C:\Windows\System\tULPhNv.exe
  C:\Windows\System\tULPhNv.exe
  2⤵
  PID:11312
- C:\Windows\System\YdmuVLk.exe
  C:\Windows\System\YdmuVLk.exe
  2⤵
  PID:2548
- C:\Windows\System\zRJCdyd.exe
  C:\Windows\System\zRJCdyd.exe
  2⤵
  PID:4256
- C:\Windows\System\kgwzhZN.exe
  C:\Windows\System\kgwzhZN.exe
  2⤵
  PID:2160
- C:\Windows\System\KEyougi.exe
  C:\Windows\System\KEyougi.exe
  2⤵
  PID:11660
- C:\Windows\System\LSwcdBj.exe
  C:\Windows\System\LSwcdBj.exe
  2⤵
  PID:664
- C:\Windows\System\pUwRihm.exe
  C:\Windows\System\pUwRihm.exe
  2⤵
  PID:11764
- C:\Windows\System\pRObLpK.exe
  C:\Windows\System\pRObLpK.exe
  2⤵
  PID:5124
- C:\Windows\System\hoEPFet.exe
  C:\Windows\System\hoEPFet.exe
  2⤵
  PID:4576
- C:\Windows\System\KPXoFVS.exe
  C:\Windows\System\KPXoFVS.exe
  2⤵
  PID:2832
- C:\Windows\System\Yjsegmv.exe
  C:\Windows\System\Yjsegmv.exe
  2⤵
  PID:11604
- C:\Windows\System\XEokLDh.exe
  C:\Windows\System\XEokLDh.exe
  2⤵
  PID:4564
- C:\Windows\System\ouaSZKe.exe
  C:\Windows\System\ouaSZKe.exe
  2⤵
  PID:3704
- C:\Windows\System\ajSiFTP.exe
  C:\Windows\System\ajSiFTP.exe
  2⤵
  PID:6984
- C:\Windows\System\vTTbWDa.exe
  C:\Windows\System\vTTbWDa.exe
  2⤵
  PID:7040
- C:\Windows\System\aGfRNBR.exe
  C:\Windows\System\aGfRNBR.exe
  2⤵
  PID:7072
- C:\Windows\System\jxKANdY.exe
  C:\Windows\System\jxKANdY.exe
  2⤵
  PID:7108
- C:\Windows\System\EbQpKpm.exe
  C:\Windows\System\EbQpKpm.exe
  2⤵
  PID:3796
- C:\Windows\System\CCoGyID.exe
  C:\Windows\System\CCoGyID.exe
  2⤵
  PID:2080
- C:\Windows\System\rStnmWb.exe
  C:\Windows\System\rStnmWb.exe
  2⤵
  PID:5684
- C:\Windows\System\sdeFjCf.exe
  C:\Windows\System\sdeFjCf.exe
  2⤵
  PID:3992
- C:\Windows\System\KiPohqq.exe
  C:\Windows\System\KiPohqq.exe
  2⤵
  PID:5536
- C:\Windows\System\inXxSPn.exe
  C:\Windows\System\inXxSPn.exe
  2⤵
  PID:5688
- C:\Windows\System\usgECbc.exe
  C:\Windows\System\usgECbc.exe
  2⤵
  PID:12268
- C:\Windows\System\UDIdRHo.exe
  C:\Windows\System\UDIdRHo.exe
  2⤵
  PID:1796
- C:\Windows\System\FBieHVS.exe
  C:\Windows\System\FBieHVS.exe
  2⤵
  PID:1512
- C:\Windows\System\dlalZbx.exe
  C:\Windows\System\dlalZbx.exe
  2⤵
  PID:10648
- C:\Windows\System\BBFqBdu.exe
  C:\Windows\System\BBFqBdu.exe
  2⤵
  PID:1976
- C:\Windows\System\CzidFeX.exe
  C:\Windows\System\CzidFeX.exe
  2⤵
  PID:12120
- C:\Windows\System\szhqIHC.exe
  C:\Windows\System\szhqIHC.exe
  2⤵
  PID:5948
- C:\Windows\System\NbiTYxT.exe
  C:\Windows\System\NbiTYxT.exe
  2⤵
  PID:3624
- C:\Windows\System\eYjIAHz.exe
  C:\Windows\System\eYjIAHz.exe
  2⤵
  PID:2680
- C:\Windows\System\vBgofUO.exe
  C:\Windows\System\vBgofUO.exe
  2⤵
  PID:5320
- C:\Windows\System\aiOYPSz.exe
  C:\Windows\System\aiOYPSz.exe
  2⤵
  PID:5476
- C:\Windows\System\gBtgqaA.exe
  C:\Windows\System\gBtgqaA.exe
  2⤵
  PID:12204
- C:\Windows\System\sYVdBAQ.exe
  C:\Windows\System\sYVdBAQ.exe
  2⤵
  PID:12176
- C:\Windows\System\KoOBtnv.exe
  C:\Windows\System\KoOBtnv.exe
  2⤵
  PID:3116
- C:\Windows\System\MAVdhgc.exe
  C:\Windows\System\MAVdhgc.exe
  2⤵
  PID:4748
- C:\Windows\System\WwPbpsE.exe
  C:\Windows\System\WwPbpsE.exe
  2⤵
  PID:11492
- C:\Windows\System\myQjIAU.exe
  C:\Windows\System\myQjIAU.exe
  2⤵
  PID:12124
- C:\Windows\System\TGWNZFR.exe
  C:\Windows\System\TGWNZFR.exe
  2⤵
  PID:5924
- C:\Windows\System\EjMvzbn.exe
  C:\Windows\System\EjMvzbn.exe
  2⤵
  PID:5432
- C:\Windows\System\fkmKOcf.exe
  C:\Windows\System\fkmKOcf.exe
  2⤵
  PID:12284
- C:\Windows\System\AOOGrQi.exe
  C:\Windows\System\AOOGrQi.exe
  2⤵
  PID:12240
- C:\Windows\System\WtSlijM.exe
  C:\Windows\System\WtSlijM.exe
  2⤵
  PID:5780
- C:\Windows\System\KyxjvtR.exe
  C:\Windows\System\KyxjvtR.exe
  2⤵
  PID:6104
- C:\Windows\System\yuDbzUX.exe
  C:\Windows\System\yuDbzUX.exe
  2⤵
  PID:3920
- C:\Windows\System\ozSiBGE.exe
  C:\Windows\System\ozSiBGE.exe
  2⤵
  PID:12304
- C:\Windows\System\sKGuGZh.exe
  C:\Windows\System\sKGuGZh.exe
  2⤵
  PID:12364
- C:\Windows\System\KLTsDYz.exe
  C:\Windows\System\KLTsDYz.exe
  2⤵
  PID:12392
- C:\Windows\System\GVmzsHy.exe
  C:\Windows\System\GVmzsHy.exe
  2⤵
  PID:12416
- C:\Windows\System\MoWgHbw.exe
  C:\Windows\System\MoWgHbw.exe
  2⤵
  PID:12480
- C:\Windows\System\JZyrqnK.exe
  C:\Windows\System\JZyrqnK.exe
  2⤵
  PID:12504
- C:\Windows\System\SUHvJon.exe
  C:\Windows\System\SUHvJon.exe
  2⤵
  PID:12532
- C:\Windows\System\jYlEahn.exe
  C:\Windows\System\jYlEahn.exe
  2⤵
  PID:12560
- C:\Windows\System\hFLMObE.exe
  C:\Windows\System\hFLMObE.exe
  2⤵
  PID:12576
- C:\Windows\System\xTnUhHP.exe
  C:\Windows\System\xTnUhHP.exe
  2⤵
  PID:12640
- C:\Windows\System\xkoqySL.exe
  C:\Windows\System\xkoqySL.exe
  2⤵
  PID:12656
- C:\Windows\System\dXTNgGO.exe
  C:\Windows\System\dXTNgGO.exe
  2⤵
  PID:12708
- C:\Windows\System\PXEBbCm.exe
  C:\Windows\System\PXEBbCm.exe
  2⤵
  PID:12724
- C:\Windows\System\siNCeXf.exe
  C:\Windows\System\siNCeXf.exe
  2⤵
  PID:12744
- C:\Windows\System\ITubuxE.exe
  C:\Windows\System\ITubuxE.exe
  2⤵
  PID:12760
- C:\Windows\System\jybVsmQ.exe
  C:\Windows\System\jybVsmQ.exe
  2⤵
  PID:12776
- C:\Windows\System\YjFiVSe.exe
  C:\Windows\System\YjFiVSe.exe
  2⤵
  PID:12940
- C:\Windows\System\MbkeOIh.exe
  C:\Windows\System\MbkeOIh.exe
  2⤵
  PID:12956
- C:\Windows\System\ApcrnrA.exe
  C:\Windows\System\ApcrnrA.exe
  2⤵
  PID:12976
- C:\Windows\System\VddlKUk.exe
  C:\Windows\System\VddlKUk.exe
  2⤵
  PID:13000
- C:\Windows\System\DBbPfIQ.exe
  C:\Windows\System\DBbPfIQ.exe
  2⤵
  PID:13020
- C:\Windows\System\jVAlAlf.exe
  C:\Windows\System\jVAlAlf.exe
  2⤵
  PID:13044
- C:\Windows\System\DsSGVMJ.exe
  C:\Windows\System\DsSGVMJ.exe
  2⤵
  PID:13072
- C:\Windows\System\NFidFmU.exe
  C:\Windows\System\NFidFmU.exe
  2⤵
  PID:13104
- C:\Windows\System\LdgxTFU.exe
  C:\Windows\System\LdgxTFU.exe
  2⤵
  PID:13128
- C:\Windows\System\axJnUbD.exe
  C:\Windows\System\axJnUbD.exe
  2⤵
  PID:13160
- C:\Windows\System\NueCfXh.exe
  C:\Windows\System\NueCfXh.exe
  2⤵
  PID:13184
- C:\Windows\System\oNKobCN.exe
  C:\Windows\System\oNKobCN.exe
  2⤵
  PID:13200
- C:\Windows\System\QSOBjiK.exe
  C:\Windows\System\QSOBjiK.exe
  2⤵
  PID:13224
- C:\Windows\System\goRrKmV.exe
  C:\Windows\System\goRrKmV.exe
  2⤵
  PID:13248
- C:\Windows\System\ZOWaYXG.exe
  C:\Windows\System\ZOWaYXG.exe
  2⤵
  PID:13272
- C:\Windows\System\kDHrHGN.exe
  C:\Windows\System\kDHrHGN.exe
  2⤵
  PID:13296
- C:\Windows\System\ExbbsLh.exe
  C:\Windows\System\ExbbsLh.exe
  2⤵
  PID:5280
- C:\Windows\System\dLIqVzo.exe
  C:\Windows\System\dLIqVzo.exe
  2⤵
  PID:12300
- C:\Windows\System\WhbCOSg.exe
  C:\Windows\System\WhbCOSg.exe
  2⤵
  PID:12292
- C:\Windows\System\CiWkaqU.exe
  C:\Windows\System\CiWkaqU.exe
  2⤵
  PID:5564
- C:\Windows\System\BHagoul.exe
  C:\Windows\System\BHagoul.exe
  2⤵
  PID:12352
- C:\Windows\System\EGHBgVO.exe
  C:\Windows\System\EGHBgVO.exe
  2⤵
  PID:12404
- C:\Windows\System\QdjVoBm.exe
  C:\Windows\System\QdjVoBm.exe
  2⤵
  PID:12596
- C:\Windows\System\brWFMNG.exe
  C:\Windows\System\brWFMNG.exe
  2⤵
  PID:5880
- C:\Windows\System\rssltKI.exe
  C:\Windows\System\rssltKI.exe
  2⤵
  PID:3528
- C:\Windows\System\aFqwlPj.exe
  C:\Windows\System\aFqwlPj.exe
  2⤵
  PID:12556
- C:\Windows\System\JYxNyij.exe
  C:\Windows\System\JYxNyij.exe
  2⤵
  PID:12572
- C:\Windows\System\gsLLjXf.exe
  C:\Windows\System\gsLLjXf.exe
  2⤵
  PID:5992
- C:\Windows\System\CnzwWOv.exe
  C:\Windows\System\CnzwWOv.exe
  2⤵
  PID:12648
- C:\Windows\System\DaZCIvA.exe
  C:\Windows\System\DaZCIvA.exe
  2⤵
  PID:12756
- C:\Windows\System\QeCYpJZ.exe
  C:\Windows\System\QeCYpJZ.exe
  2⤵
  PID:12804
- C:\Windows\System\xiERseN.exe
  C:\Windows\System\xiERseN.exe
  2⤵
  PID:12832
- C:\Windows\System\bFCmfNV.exe
  C:\Windows\System\bFCmfNV.exe
  2⤵
  PID:5292
- C:\Windows\System\ZuCcckb.exe
  C:\Windows\System\ZuCcckb.exe
  2⤵
  PID:12932
- C:\Windows\System\sQcEQyZ.exe
  C:\Windows\System\sQcEQyZ.exe
  2⤵
  PID:13016
- C:\Windows\System\owmwflJ.exe
  C:\Windows\System\owmwflJ.exe
  2⤵
  PID:13096
- C:\Windows\System\oxOmLIu.exe
  C:\Windows\System\oxOmLIu.exe
  2⤵
  PID:13196
- C:\Windows\System\LeagvqC.exe
  C:\Windows\System\LeagvqC.exe
  2⤵
  PID:13244
- C:\Windows\System\bikvMhl.exe
  C:\Windows\System\bikvMhl.exe
  2⤵
  PID:11980
- C:\Windows\System\gQNarFA.exe
  C:\Windows\System\gQNarFA.exe
  2⤵
  PID:5380
- C:\Windows\System\HJMZIId.exe
  C:\Windows\System\HJMZIId.exe
  2⤵
  PID:12528
- C:\Windows\System\kSWXVRz.exe
  C:\Windows\System\kSWXVRz.exe
  2⤵
  PID:5636
- C:\Windows\System\DaSGaDK.exe
  C:\Windows\System\DaSGaDK.exe
  2⤵
  PID:12444
- C:\Windows\System\cvgWDvG.exe
  C:\Windows\System\cvgWDvG.exe
  2⤵
  PID:640
- C:\Windows\System\ACFhmWR.exe
  C:\Windows\System\ACFhmWR.exe
  2⤵
  PID:12544
- C:\Windows\System\YllhdGJ.exe
  C:\Windows\System\YllhdGJ.exe
  2⤵
  PID:6096
- C:\Windows\System\OjAAnHI.exe
  C:\Windows\System\OjAAnHI.exe
  2⤵
  PID:12736
- C:\Windows\System\bqNUlIg.exe
  C:\Windows\System\bqNUlIg.exe
  2⤵
  PID:12772
- C:\Windows\System\mkqeOXc.exe
  C:\Windows\System\mkqeOXc.exe
  2⤵
  PID:12808
- C:\Windows\System\QgSQOQY.exe
  C:\Windows\System\QgSQOQY.exe
  2⤵
  PID:6040
- C:\Windows\System\OcvpXdm.exe
  C:\Windows\System\OcvpXdm.exe
  2⤵
  PID:6008
- C:\Windows\System\JYBdXNR.exe
  C:\Windows\System\JYBdXNR.exe
  2⤵
  PID:5672
- C:\Windows\System\GFdChxR.exe
  C:\Windows\System\GFdChxR.exe
  2⤵
  PID:3928
- C:\Windows\System\NmpPvHE.exe
  C:\Windows\System\NmpPvHE.exe
  2⤵
  PID:6092
- C:\Windows\System\wfIkQkG.exe
  C:\Windows\System\wfIkQkG.exe
  2⤵
  PID:12432
- C:\Windows\System\aGsjLfk.exe
  C:\Windows\System\aGsjLfk.exe
  2⤵
  PID:12812
- C:\Windows\System\MxYxsSz.exe
  C:\Windows\System\MxYxsSz.exe
  2⤵
  PID:5300
- C:\Windows\System\gKJczdK.exe
  C:\Windows\System\gKJczdK.exe
  2⤵
  PID:12688
- C:\Windows\System\wcFxKiy.exe
  C:\Windows\System\wcFxKiy.exe
  2⤵
  PID:5616
- C:\Windows\System\EMDyItM.exe
  C:\Windows\System\EMDyItM.exe
  2⤵
  PID:7644
- C:\Windows\System\OlarXnh.exe
  C:\Windows\System\OlarXnh.exe
  2⤵
  PID:6308
- C:\Windows\System\nsyCzLF.exe
  C:\Windows\System\nsyCzLF.exe
  2⤵
  PID:6332
- C:\Windows\System\loWatGr.exe
  C:\Windows\System\loWatGr.exe
  2⤵
  PID:5200
- C:\Windows\System\uibEpIp.exe
  C:\Windows\System\uibEpIp.exe
  2⤵
  PID:5928
- C:\Windows\System\iFviWbN.exe
  C:\Windows\System\iFviWbN.exe
  2⤵
  PID:6344
- C:\Windows\System\SkTJOcI.exe
  C:\Windows\System\SkTJOcI.exe
  2⤵
  PID:5632
- C:\Windows\System\TGjKHzT.exe
  C:\Windows\System\TGjKHzT.exe
  2⤵
  PID:13288
- C:\Windows\System\ETgoKsD.exe
  C:\Windows\System\ETgoKsD.exe
  2⤵
  PID:5904
- C:\Windows\System\GHmROha.exe
  C:\Windows\System\GHmROha.exe
  2⤵
  PID:6484
- C:\Windows\System\rEHJDFO.exe
  C:\Windows\System\rEHJDFO.exe
  2⤵
  PID:6328
- C:\Windows\System\RyuwkVz.exe
  C:\Windows\System\RyuwkVz.exe
  2⤵
  PID:13328
- C:\Windows\System\EoULHrI.exe
  C:\Windows\System\EoULHrI.exe
  2⤵
  PID:13344
- C:\Windows\System\sooDXWH.exe
  C:\Windows\System\sooDXWH.exe
  2⤵
  PID:13388
- C:\Windows\System\JOZLamF.exe
  C:\Windows\System\JOZLamF.exe
  2⤵
  PID:13420
- C:\Windows\System\ApyzHgD.exe
  C:\Windows\System\ApyzHgD.exe
  2⤵
  PID:13436
- C:\Windows\System\FtjTSjE.exe
  C:\Windows\System\FtjTSjE.exe
  2⤵
  PID:13452
- C:\Windows\System\eWVThkm.exe
  C:\Windows\System\eWVThkm.exe
  2⤵
  PID:13468
- C:\Windows\System\HOYFAZP.exe
  C:\Windows\System\HOYFAZP.exe
  2⤵
  PID:13512
- C:\Windows\System\FUAaGYZ.exe
  C:\Windows\System\FUAaGYZ.exe
  2⤵
  PID:13588
- C:\Windows\System\rDAqhPa.exe
  C:\Windows\System\rDAqhPa.exe
  2⤵
  PID:13652
- C:\Windows\System\jnXhHKZ.exe
  C:\Windows\System\jnXhHKZ.exe
  2⤵
  PID:13680
- C:\Windows\System\NxINQil.exe
  C:\Windows\System\NxINQil.exe
  2⤵
  PID:13700
- C:\Windows\System\bAvadPQ.exe
  C:\Windows\System\bAvadPQ.exe
  2⤵
  PID:13728
- C:\Windows\System\ExvmJZp.exe
  C:\Windows\System\ExvmJZp.exe
  2⤵
  PID:13744
- C:\Windows\System\PEfMCFJ.exe
  C:\Windows\System\PEfMCFJ.exe
  2⤵
  PID:13848
- C:\Windows\System\gkkGWLs.exe
  C:\Windows\System\gkkGWLs.exe
  2⤵
  PID:13868
- C:\Windows\System\ZERyKVr.exe
  C:\Windows\System\ZERyKVr.exe
  2⤵
  PID:13888
- C:\Windows\System\tkNLQLR.exe
  C:\Windows\System\tkNLQLR.exe
  2⤵
  PID:13904
- C:\Windows\System\xwamYCp.exe
  C:\Windows\System\xwamYCp.exe
  2⤵
  PID:13924
- C:\Windows\System\ixvCRIu.exe
  C:\Windows\System\ixvCRIu.exe
  2⤵
  PID:14024
- C:\Windows\System\oBYRjXB.exe
  C:\Windows\System\oBYRjXB.exe
  2⤵
  PID:14056
- C:\Windows\System\VDeGaYJ.exe
  C:\Windows\System\VDeGaYJ.exe
  2⤵
  PID:14076
- C:\Windows\System\YXBuonD.exe
  C:\Windows\System\YXBuonD.exe
  2⤵
  PID:14104
- C:\Windows\System\UbuiILX.exe
  C:\Windows\System\UbuiILX.exe
  2⤵
  PID:14124
- C:\Windows\System\igpSFEK.exe
  C:\Windows\System\igpSFEK.exe
  2⤵
  PID:14144
- C:\Windows\System\zaixGNQ.exe
  C:\Windows\System\zaixGNQ.exe
  2⤵
  PID:14160
- C:\Windows\System\KlMwatI.exe
  C:\Windows\System\KlMwatI.exe
  2⤵
  PID:14184
- C:\Windows\System\BDezwIY.exe
  C:\Windows\System\BDezwIY.exe
  2⤵
  PID:14204
- C:\Windows\System\FjbSDNB.exe
  C:\Windows\System\FjbSDNB.exe
  2⤵
  PID:14220
- C:\Windows\System\uebPvBX.exe
  C:\Windows\System\uebPvBX.exe
  2⤵
  PID:14252
- C:\Windows\System\fUjZMbr.exe
  C:\Windows\System\fUjZMbr.exe
  2⤵
  PID:14284
- C:\Windows\System\zmfhPrU.exe
  C:\Windows\System\zmfhPrU.exe
  2⤵
  PID:6864
- C:\Windows\System\joOxsay.exe
  C:\Windows\System\joOxsay.exe
  2⤵
  PID:6292
- C:\Windows\System\xprHzNq.exe
  C:\Windows\System\xprHzNq.exe
  2⤵
  PID:6412
- C:\Windows\System\uUtzrqi.exe
  C:\Windows\System\uUtzrqi.exe
  2⤵
  PID:6816
- C:\Windows\System\swCWZWF.exe
  C:\Windows\System\swCWZWF.exe
  2⤵
  PID:6220
- C:\Windows\System\iKssiKr.exe
  C:\Windows\System\iKssiKr.exe
  2⤵
  PID:8652
- C:\Windows\System\uBzHnqB.exe
  C:\Windows\System\uBzHnqB.exe
  2⤵
  PID:2560
- C:\Windows\System\HlQDHYK.exe
  C:\Windows\System\HlQDHYK.exe
  2⤵
  PID:7088
- C:\Windows\System\xOhPuxb.exe
  C:\Windows\System\xOhPuxb.exe
  2⤵
  PID:3708
- C:\Windows\System\LzuqTjU.exe
  C:\Windows\System\LzuqTjU.exe
  2⤵
  PID:13356
- C:\Windows\System\ufMYUgZ.exe
  C:\Windows\System\ufMYUgZ.exe
  2⤵
  PID:6980
- C:\Windows\System\akFTDVM.exe
  C:\Windows\System\akFTDVM.exe
  2⤵
  PID:13488
- C:\Windows\System\HGsXIPo.exe
  C:\Windows\System\HGsXIPo.exe
  2⤵
  PID:13380
- C:\Windows\System\hWDXQQk.exe
  C:\Windows\System\hWDXQQk.exe
  2⤵
  PID:13412
- C:\Windows\System\qbfQeVV.exe
  C:\Windows\System\qbfQeVV.exe
  2⤵
  PID:6388
- C:\Windows\System\obIPMlV.exe
  C:\Windows\System\obIPMlV.exe
  2⤵
  PID:7076
- C:\Windows\System\ssgZvnR.exe
  C:\Windows\System\ssgZvnR.exe
  2⤵
  PID:6728
- C:\Windows\System\rNzuyQZ.exe
  C:\Windows\System\rNzuyQZ.exe
  2⤵
  PID:13500
- C:\Windows\System\hGswxog.exe
  C:\Windows\System\hGswxog.exe
  2⤵
  PID:13604
- C:\Windows\System\iFDunTD.exe
  C:\Windows\System\iFDunTD.exe
  2⤵
  PID:13628
- C:\Windows\System\tENAYZi.exe
  C:\Windows\System\tENAYZi.exe
  2⤵
  PID:13524
- C:\Windows\System\oGTTcQw.exe
  C:\Windows\System\oGTTcQw.exe
  2⤵
  PID:13664
- C:\Windows\System\eAtDUFr.exe
  C:\Windows\System\eAtDUFr.exe
  2⤵
  PID:13552
- C:\Windows\System\mnonUfl.exe
  C:\Windows\System\mnonUfl.exe
  2⤵
  PID:13740
- C:\Windows\System\OvKpOmO.exe
  C:\Windows\System\OvKpOmO.exe
  2⤵
  PID:13572
- C:\Windows\System\sDAWang.exe
  C:\Windows\System\sDAWang.exe
  2⤵
  PID:13716
- C:\Windows\System\VKRRPdM.exe
  C:\Windows\System\VKRRPdM.exe
  2⤵
  PID:13768
- C:\Windows\System\yXAHiJA.exe
  C:\Windows\System\yXAHiJA.exe
  2⤵
  PID:14068
- C:\Windows\System\wUMZSpz.exe
  C:\Windows\System\wUMZSpz.exe
  2⤵
  PID:14216
- C:\Windows\System\mQSjRJV.exe
  C:\Windows\System\mQSjRJV.exe
  2⤵
  PID:6568
- C:\Windows\System\hpyQaBD.exe
  C:\Windows\System\hpyQaBD.exe
  2⤵
  PID:7816
- C:\Windows\System\xPuePhW.exe
  C:\Windows\System\xPuePhW.exe
  2⤵
  PID:7432
- C:\Windows\System\EHPTnQj.exe
  C:\Windows\System\EHPTnQj.exe
  2⤵
  PID:6664
- C:\Windows\System\FHFqTzP.exe
  C:\Windows\System\FHFqTzP.exe
  2⤵
  PID:7964
- C:\Windows\System\DYLLOnY.exe
  C:\Windows\System\DYLLOnY.exe
  2⤵
  PID:10372
- C:\Windows\System\BCTlWgL.exe
  C:\Windows\System\BCTlWgL.exe
  2⤵
  PID:6796
- C:\Windows\System\JeIjziA.exe
  C:\Windows\System\JeIjziA.exe
  2⤵
  PID:6528
- C:\Windows\System\aVeWMks.exe
  C:\Windows\System\aVeWMks.exe
  2⤵
  PID:10516
- C:\Windows\System\YpWCMRs.exe
  C:\Windows\System\YpWCMRs.exe
  2⤵
  PID:13540
- C:\Windows\System\HWJwBFI.exe
  C:\Windows\System\HWJwBFI.exe
  2⤵
  PID:14312
- C:\Windows\System\yKIOHDf.exe
  C:\Windows\System\yKIOHDf.exe
  2⤵
  PID:13556
- C:\Windows\System\DeNSANB.exe
  C:\Windows\System\DeNSANB.exe
  2⤵
  PID:13764
- C:\Windows\System\nxdrxUK.exe
  C:\Windows\System\nxdrxUK.exe
  2⤵
  PID:13584
- C:\Windows\System\UJUHlfJ.exe
  C:\Windows\System\UJUHlfJ.exe
  2⤵
  PID:7224
- C:\Windows\System\uWoPPTP.exe
  C:\Windows\System\uWoPPTP.exe
  2⤵
  PID:7872
- C:\Windows\System\kcDAFyk.exe
  C:\Windows\System\kcDAFyk.exe
  2⤵
  PID:6676
- C:\Windows\System\jPaVwpH.exe
  C:\Windows\System\jPaVwpH.exe
  2⤵
  PID:13692
- C:\Windows\System\VzdxrwQ.exe
  C:\Windows\System\VzdxrwQ.exe
  2⤵
  PID:6680
- C:\Windows\System\jrdyWbE.exe
  C:\Windows\System\jrdyWbE.exe
  2⤵
  PID:10664
- C:\Windows\System\rJaLQmI.exe
  C:\Windows\System\rJaLQmI.exe
  2⤵
  PID:10740
- C:\Windows\System\ZWlTGji.exe
  C:\Windows\System\ZWlTGji.exe
  2⤵
  PID:13900
- C:\Windows\System\abPneHH.exe
  C:\Windows\System\abPneHH.exe
  2⤵
  PID:13784
- C:\Windows\System\slCMlHm.exe
  C:\Windows\System\slCMlHm.exe
  2⤵
  PID:13448
- C:\Windows\System\nzxXFbu.exe
  C:\Windows\System\nzxXFbu.exe
  2⤵
  PID:7324
- C:\Windows\System\bQYloDU.exe
  C:\Windows\System\bQYloDU.exe
  2⤵
  PID:8064
- C:\Windows\System\UkgxwTJ.exe
  C:\Windows\System\UkgxwTJ.exe
  2⤵
  PID:8400
- C:\Windows\System\pZznaiB.exe
  C:\Windows\System\pZznaiB.exe
  2⤵
  PID:8120
- C:\Windows\System\yZDsZEP.exe
  C:\Windows\System\yZDsZEP.exe
  2⤵
  PID:7336
- C:\Windows\System\yXyYJYz.exe
  C:\Windows\System\yXyYJYz.exe
  2⤵
  PID:7312
- C:\Windows\System\qoQzsFY.exe
  C:\Windows\System\qoQzsFY.exe
  2⤵
  PID:13672
- C:\Windows\System\PPNLLuO.exe
  C:\Windows\System\PPNLLuO.exe
  2⤵
  PID:8640
- C:\Windows\System\GozuLTQ.exe
  C:\Windows\System\GozuLTQ.exe
  2⤵
  PID:10844
- C:\Windows\System\CTqTDDF.exe
  C:\Windows\System\CTqTDDF.exe
  2⤵
  PID:13956
- C:\Windows\System\pwJaVNK.exe
  C:\Windows\System\pwJaVNK.exe
  2⤵
  PID:7620
- C:\Windows\System\QyVwkkF.exe
  C:\Windows\System\QyVwkkF.exe
  2⤵
  PID:13324
- C:\Windows\System\eIjDvRj.exe
  C:\Windows\System\eIjDvRj.exe
  2⤵
  PID:7544
- C:\Windows\System\qkrOtQq.exe
  C:\Windows\System\qkrOtQq.exe
  2⤵
  PID:11104
- C:\Windows\System\ipeBOAw.exe
  C:\Windows\System\ipeBOAw.exe
  2⤵
  PID:11148
- C:\Windows\System\NpcEgRF.exe
  C:\Windows\System\NpcEgRF.exe
  2⤵
  PID:11208
- C:\Windows\System\QfiUYbX.exe
  C:\Windows\System\QfiUYbX.exe
  2⤵
  PID:7664
- C:\Windows\System\xSGIzPx.exe
  C:\Windows\System\xSGIzPx.exe
  2⤵
  PID:14200
- C:\Windows\System\ZkQbhIN.exe
  C:\Windows\System\ZkQbhIN.exe
  2⤵
  PID:14236
- C:\Windows\System\iUZnwDp.exe
  C:\Windows\System\iUZnwDp.exe
  2⤵
  PID:7860
- C:\Windows\System\muzwzPg.exe
  C:\Windows\System\muzwzPg.exe
  2⤵
  PID:14248
- C:\Windows\System\mVTWUCQ.exe
  C:\Windows\System\mVTWUCQ.exe
  2⤵
  PID:14264
- C:\Windows\System\EruTjwt.exe
  C:\Windows\System\EruTjwt.exe
  2⤵
  PID:6552
- C:\Windows\System\HHspLgI.exe
  C:\Windows\System\HHspLgI.exe
  2⤵
  PID:10416
- C:\Windows\System\EAIobDs.exe
  C:\Windows\System\EAIobDs.exe
  2⤵
  PID:8424
- C:\Windows\System\QhwKROl.exe
  C:\Windows\System\QhwKROl.exe
  2⤵
  PID:13600
- C:\Windows\System\lqdqGRL.exe
  C:\Windows\System\lqdqGRL.exe
  2⤵
  PID:8508
- C:\Windows\System\XoMSTld.exe
  C:\Windows\System\XoMSTld.exe
  2⤵
  PID:13968
- C:\Windows\System\QKtDoyt.exe
  C:\Windows\System\QKtDoyt.exe
  2⤵
  PID:10960
- C:\Windows\System\oaskZsq.exe
  C:\Windows\System\oaskZsq.exe
  2⤵
  PID:8632
- C:\Windows\System\pPVDFEf.exe
  C:\Windows\System\pPVDFEf.exe
  2⤵
  PID:384
- C:\Windows\System\LRMlaOT.exe
  C:\Windows\System\LRMlaOT.exe
  2⤵
  PID:8816
- C:\Windows\System\bACifON.exe
  C:\Windows\System\bACifON.exe
  2⤵
  PID:10928
- C:\Windows\System\hjmAMqe.exe
  C:\Windows\System\hjmAMqe.exe
  2⤵
  PID:8492
- C:\Windows\System\UqPquaM.exe
  C:\Windows\System\UqPquaM.exe
  2⤵
  PID:8316
- C:\Windows\System\pcPyDlt.exe
  C:\Windows\System\pcPyDlt.exe
  2⤵
  PID:9076
- C:\Windows\System\AeRyQGB.exe
  C:\Windows\System\AeRyQGB.exe
  2⤵
  PID:8852
- C:\Windows\System\HQKVLhW.exe
  C:\Windows\System\HQKVLhW.exe
  2⤵
  PID:7412
- C:\Windows\System\aDoLGwo.exe
  C:\Windows\System\aDoLGwo.exe
  2⤵
  PID:10732
- C:\Windows\System\BjVdtnQ.exe
  C:\Windows\System\BjVdtnQ.exe
  2⤵
  PID:7748
- C:\Windows\System\pDaHcLN.exe
  C:\Windows\System\pDaHcLN.exe
  2⤵
  PID:6120
- C:\Windows\System\EaKYVPE.exe
  C:\Windows\System\EaKYVPE.exe
  2⤵
  PID:9172
- C:\Windows\System\jXmYaNt.exe
  C:\Windows\System\jXmYaNt.exe
  2⤵
  PID:8872
- C:\Windows\System\HojLVyH.exe
  C:\Windows\System\HojLVyH.exe
  2⤵
  PID:13432
- C:\Windows\System\GDbVWaT.exe
  C:\Windows\System\GDbVWaT.exe
  2⤵
  PID:8788
- C:\Windows\System\tlmAaqt.exe
  C:\Windows\System\tlmAaqt.exe
  2⤵
  PID:8544
- C:\Windows\System\ZwxYJTX.exe
  C:\Windows\System\ZwxYJTX.exe
  2⤵
  PID:11460
- C:\Windows\System\fRpAYbT.exe
  C:\Windows\System\fRpAYbT.exe
  2⤵
  PID:6600
- C:\Windows\System\kDrjDsH.exe
  C:\Windows\System\kDrjDsH.exe
  2⤵
  PID:9200
- C:\Windows\System\lMEZlkE.exe
  C:\Windows\System\lMEZlkE.exe
  2⤵
  PID:13788
- C:\Windows\System\LoNniRV.exe
  C:\Windows\System\LoNniRV.exe
  2⤵
  PID:6876
- C:\Windows\System\RqUWQgm.exe
  C:\Windows\System\RqUWQgm.exe
  2⤵
  PID:8840
- C:\Windows\System\XmhaNUR.exe
  C:\Windows\System\XmhaNUR.exe
  2⤵
  PID:10360
- C:\Windows\System\WQPGmUY.exe
  C:\Windows\System\WQPGmUY.exe
  2⤵
  PID:8696
- C:\Windows\System\OhVCvgq.exe
  C:\Windows\System\OhVCvgq.exe
  2⤵
  PID:13508
- C:\Windows\System\BPGCxAd.exe
  C:\Windows\System\BPGCxAd.exe
  2⤵
  PID:8672
- C:\Windows\System\tWZwydS.exe
  C:\Windows\System\tWZwydS.exe
  2⤵
  PID:8196
- C:\Windows\System\gxMMKKa.exe
  C:\Windows\System\gxMMKKa.exe
  2⤵
  PID:10876
- C:\Windows\System\OOohlxS.exe
  C:\Windows\System\OOohlxS.exe
  2⤵
  PID:9140
- C:\Windows\System\qzgrbzf.exe
  C:\Windows\System\qzgrbzf.exe
  2⤵
  PID:13560
- C:\Windows\System\uGVIOFH.exe
  C:\Windows\System\uGVIOFH.exe
  2⤵
  PID:9388
- C:\Windows\System\GSKCgjR.exe
  C:\Windows\System\GSKCgjR.exe
  2⤵
  PID:7360
- C:\Windows\System\TtGYPei.exe
  C:\Windows\System\TtGYPei.exe
  2⤵
  PID:9564
- C:\Windows\System\TwoDkmH.exe
  C:\Windows\System\TwoDkmH.exe
  2⤵
  PID:7560
- C:\Windows\System\mNWEJTi.exe
  C:\Windows\System\mNWEJTi.exe
  2⤵
  PID:8268
- C:\Windows\System\HxEgtLg.exe
  C:\Windows\System\HxEgtLg.exe
  2⤵
  PID:9380
- C:\Windows\System\VGzOOCV.exe
  C:\Windows\System\VGzOOCV.exe
  2⤵
  PID:8124
- C:\Windows\System\WcoLZoN.exe
  C:\Windows\System\WcoLZoN.exe
  2⤵
  PID:9936
- C:\Windows\System\TOQWAWw.exe
  C:\Windows\System\TOQWAWw.exe
  2⤵
  PID:9432
- C:\Windows\System\shCYuWk.exe
  C:\Windows\System\shCYuWk.exe
  2⤵
  PID:9776
- C:\Windows\System\guzpSfo.exe
  C:\Windows\System\guzpSfo.exe
  2⤵
  PID:12156
- C:\Windows\System\GqTrvgk.exe
  C:\Windows\System\GqTrvgk.exe
  2⤵
  PID:12160
- C:\Windows\System\TGjRdVx.exe
  C:\Windows\System\TGjRdVx.exe
  2⤵
  PID:7364
- C:\Windows\System\XYTTCNE.exe
  C:\Windows\System\XYTTCNE.exe
  2⤵
  PID:11456
- C:\Windows\System\vNAixCR.exe
  C:\Windows\System\vNAixCR.exe
  2⤵
  PID:8668
- C:\Windows\System\PPEFLfZ.exe
  C:\Windows\System\PPEFLfZ.exe
  2⤵
  PID:6764
- C:\Windows\System\WzuOxkW.exe
  C:\Windows\System\WzuOxkW.exe
  2⤵
  PID:10200
- C:\Windows\System\eTaXlvV.exe
  C:\Windows\System\eTaXlvV.exe
  2⤵
  PID:8516
- C:\Windows\System\tGFUNsj.exe
  C:\Windows\System\tGFUNsj.exe
  2⤵
  PID:8476
- C:\Windows\System\vyYDvME.exe
  C:\Windows\System\vyYDvME.exe
  2⤵
  PID:12428
- C:\Windows\System\SZpeDQB.exe
  C:\Windows\System\SZpeDQB.exe
  2⤵
  PID:6352
- C:\Windows\System\rvzNDde.exe
  C:\Windows\System\rvzNDde.exe
  2⤵
  PID:13236
- C:\Windows\System\MQMwZcD.exe
  C:\Windows\System\MQMwZcD.exe
  2⤵
  PID:9096
- C:\Windows\System\WkGmUzd.exe
  C:\Windows\System\WkGmUzd.exe
  2⤵
  PID:9396
- C:\Windows\System\GsiuSlo.exe
  C:\Windows\System\GsiuSlo.exe
  2⤵
  PID:8260
- C:\Windows\System\xZfKTIG.exe
  C:\Windows\System\xZfKTIG.exe
  2⤵
  PID:11316
- C:\Windows\System\vgpMfEu.exe
  C:\Windows\System\vgpMfEu.exe
  2⤵
  PID:14048
- C:\Windows\System\IOgQhGI.exe
  C:\Windows\System\IOgQhGI.exe
  2⤵
  PID:10776
- C:\Windows\System\TAJDjOv.exe
  C:\Windows\System\TAJDjOv.exe
  2⤵
  PID:8844
- C:\Windows\System\ESzdbDy.exe
  C:\Windows\System\ESzdbDy.exe
  2⤵
  PID:8304
- C:\Windows\System\ujSjBQA.exe
  C:\Windows\System\ujSjBQA.exe
  2⤵
  PID:7156
- C:\Windows\System\ywlVuqD.exe
  C:\Windows\System\ywlVuqD.exe
  2⤵
  PID:10092
- C:\Windows\System\CqaQuBJ.exe
  C:\Windows\System\CqaQuBJ.exe
  2⤵
  PID:8976
- C:\Windows\System\KUFhLQv.exe
  C:\Windows\System\KUFhLQv.exe
  2⤵
  PID:12048
- C:\Windows\System\lxqJeHM.exe
  C:\Windows\System\lxqJeHM.exe
  2⤵
  PID:9444
- C:\Windows\System\nlhhnfo.exe
  C:\Windows\System\nlhhnfo.exe
  2⤵
  PID:5088
- C:\Windows\System\mXxIIuI.exe
  C:\Windows\System\mXxIIuI.exe
  2⤵
  PID:12152
- C:\Windows\System\qZGJUAi.exe
  C:\Windows\System\qZGJUAi.exe
  2⤵
  PID:12132
- C:\Windows\System\rHHWnFi.exe
  C:\Windows\System\rHHWnFi.exe
  2⤵
  PID:8344
- C:\Windows\System\DBFkBTC.exe
  C:\Windows\System\DBFkBTC.exe
  2⤵
  PID:11964
- C:\Windows\System\KQpuZeb.exe
  C:\Windows\System\KQpuZeb.exe
  2⤵
  PID:9256
- C:\Windows\System\ButmFBq.exe
  C:\Windows\System\ButmFBq.exe
  2⤵
  PID:552
- C:\Windows\System\ZHKYqUF.exe
  C:\Windows\System\ZHKYqUF.exe
  2⤵
  PID:9104
- C:\Windows\System\DysUwCQ.exe
  C:\Windows\System\DysUwCQ.exe
  2⤵
  PID:2128
- C:\Windows\System\QzXoJYQ.exe
  C:\Windows\System\QzXoJYQ.exe
  2⤵
  PID:9512
- C:\Windows\System\wBVrICx.exe
  C:\Windows\System\wBVrICx.exe
  2⤵
  PID:9472
- C:\Windows\System\FtPcKom.exe
  C:\Windows\System\FtPcKom.exe
  2⤵
  PID:9728
- C:\Windows\System\XqwWVnS.exe
  C:\Windows\System\XqwWVnS.exe
  2⤵
  PID:13796
- C:\Windows\System\VCPLErQ.exe
  C:\Windows\System\VCPLErQ.exe
  2⤵
  PID:7256
- C:\Windows\System\vfbdsUO.exe
  C:\Windows\System\vfbdsUO.exe
  2⤵
  PID:2000
- C:\Windows\System\WEFmrXg.exe
  C:\Windows\System\WEFmrXg.exe
  2⤵
  PID:10500
- C:\Windows\System\iXFMttE.exe
  C:\Windows\System\iXFMttE.exe
  2⤵
  PID:7448
- C:\Windows\System\WqZevih.exe
  C:\Windows\System\WqZevih.exe
  2⤵
  PID:10296
- C:\Windows\System\nGsEfBR.exe
  C:\Windows\System\nGsEfBR.exe
  2⤵
  PID:6696
- C:\Windows\System\PLagQFN.exe
  C:\Windows\System\PLagQFN.exe
  2⤵
  PID:7400
- C:\Windows\System\TcVTftL.exe
  C:\Windows\System\TcVTftL.exe
  2⤵
  PID:10548
- C:\Windows\System\MywiGdy.exe
  C:\Windows\System\MywiGdy.exe
  2⤵
  PID:10568
- C:\Windows\System\BkdDhMt.exe
  C:\Windows\System\BkdDhMt.exe
  2⤵
  PID:5036
- C:\Windows\System\eNkctbw.exe
  C:\Windows\System\eNkctbw.exe
  2⤵
  PID:9856
- C:\Windows\System\ZWWFPqk.exe
  C:\Windows\System\ZWWFPqk.exe
  2⤵
  PID:9668
- C:\Windows\System\pUKyuem.exe
  C:\Windows\System\pUKyuem.exe
  2⤵
  PID:8740
- C:\Windows\System\LytmIBh.exe
  C:\Windows\System\LytmIBh.exe
  2⤵
  PID:9816
- C:\Windows\System\TLfnxha.exe
  C:\Windows\System\TLfnxha.exe
  2⤵
  PID:11052
- C:\Windows\System\gYTjCOk.exe
  C:\Windows\System\gYTjCOk.exe
  2⤵
  PID:9792
- C:\Windows\System\gWnenEt.exe
  C:\Windows\System\gWnenEt.exe
  2⤵
  PID:10316
- C:\Windows\System\CKDrJOX.exe
  C:\Windows\System\CKDrJOX.exe
  2⤵
  PID:9292
- C:\Windows\System\TachNll.exe
  C:\Windows\System\TachNll.exe
  2⤵
  PID:10168
- C:\Windows\System\MWVNCGE.exe
  C:\Windows\System\MWVNCGE.exe
  2⤵
  PID:9464
- C:\Windows\System\Zdjizll.exe
  C:\Windows\System\Zdjizll.exe
  2⤵
  PID:8164
- C:\Windows\System\RxorPnQ.exe
  C:\Windows\System\RxorPnQ.exe
  2⤵
  PID:10684
- C:\Windows\System\RFTihgI.exe
  C:\Windows\System\RFTihgI.exe
  2⤵
  PID:7688
- C:\Windows\System\KwPhuRc.exe
  C:\Windows\System\KwPhuRc.exe
  2⤵
  PID:1988
- C:\Windows\System\VBnIHQC.exe
  C:\Windows\System\VBnIHQC.exe
  2⤵
  PID:11072
- C:\Windows\System\qgafMrQ.exe
  C:\Windows\System\qgafMrQ.exe
  2⤵
  PID:7540
- C:\Windows\System\TPtMbet.exe
  C:\Windows\System\TPtMbet.exe
  2⤵
  PID:9436
- C:\Windows\System\HIHiyEQ.exe
  C:\Windows\System\HIHiyEQ.exe
  2⤵
  PID:10688
- C:\Windows\System\HVQyNRF.exe
  C:\Windows\System\HVQyNRF.exe
  2⤵
  PID:2500
- C:\Windows\System\qDgmFpX.exe
  C:\Windows\System\qDgmFpX.exe
  2⤵
  PID:12224
- C:\Windows\System\NPbLeGF.exe
  C:\Windows\System\NPbLeGF.exe
  2⤵
  PID:7348
- C:\Windows\System\nGPYbSD.exe
  C:\Windows\System\nGPYbSD.exe
  2⤵
  PID:8664
- C:\Windows\System\IGLYLdB.exe
  C:\Windows\System\IGLYLdB.exe
  2⤵
  PID:14344
- C:\Windows\System\OAzKeIv.exe
  C:\Windows\System\OAzKeIv.exe
  2⤵
  PID:14384
- C:\Windows\System\taPajBy.exe
  C:\Windows\System\taPajBy.exe
  2⤵
  PID:14412
- C:\Windows\System\kycByBR.exe
  C:\Windows\System\kycByBR.exe
  2⤵
  PID:14436
- C:\Windows\System\bMZOFlH.exe
  C:\Windows\System\bMZOFlH.exe
  2⤵
  PID:14464
- C:\Windows\System\OiXiSIX.exe
  C:\Windows\System\OiXiSIX.exe
  2⤵
  PID:14520
- C:\Windows\System\ypSsjPg.exe
  C:\Windows\System\ypSsjPg.exe
  2⤵
  PID:14540
- C:\Windows\System\mYfuNzs.exe
  C:\Windows\System\mYfuNzs.exe
  2⤵
  PID:14564
- C:\Windows\System\cdDMhQW.exe
  C:\Windows\System\cdDMhQW.exe
  2⤵
  PID:14584
- C:\Windows\System\DZUInwG.exe
  C:\Windows\System\DZUInwG.exe
  2⤵
  PID:14612
- C:\Windows\System\ceEoyNk.exe
  C:\Windows\System\ceEoyNk.exe
  2⤵
  PID:14632
- C:\Windows\System\fpCPjdG.exe
  C:\Windows\System\fpCPjdG.exe
  2⤵
  PID:14668
- C:\Windows\System\leToWvp.exe
  C:\Windows\System\leToWvp.exe
  2⤵
  PID:14688
- C:\Windows\System\RPBwJCY.exe
  C:\Windows\System\RPBwJCY.exe
  2⤵
  PID:14708
- C:\Windows\System\jQLWhWr.exe
  C:\Windows\System\jQLWhWr.exe
  2⤵
  PID:14728
- C:\Windows\System\kKiaKzX.exe
  C:\Windows\System\kKiaKzX.exe
  2⤵
  PID:14748
- C:\Windows\System\uSlyrJj.exe
  C:\Windows\System\uSlyrJj.exe
  2⤵
  PID:14768
- C:\Windows\System\MLbJaiO.exe
  C:\Windows\System\MLbJaiO.exe
  2⤵
  PID:14788
- C:\Windows\System\EeJaLHx.exe
  C:\Windows\System\EeJaLHx.exe
  2⤵
  PID:14808
- C:\Windows\System\NJdaHyF.exe
  C:\Windows\System\NJdaHyF.exe
  2⤵
  PID:14828
- C:\Windows\System\MgRzfie.exe
  C:\Windows\System\MgRzfie.exe
  2⤵
  PID:14852
- C:\Windows\System\ATdmTkS.exe
  C:\Windows\System\ATdmTkS.exe
  2⤵
  PID:15100
- C:\Windows\System\otTdBvv.exe
  C:\Windows\System\otTdBvv.exe
  2⤵
  PID:15116
- C:\Windows\System\JkYhhPz.exe
  C:\Windows\System\JkYhhPz.exe
  2⤵
  PID:15228
- C:\Windows\System\xFkDWnC.exe
  C:\Windows\System\xFkDWnC.exe
  2⤵
  PID:15256
- C:\Windows\System\eSbGEDh.exe
  C:\Windows\System\eSbGEDh.exe
  2⤵
  PID:15276
- C:\Windows\System\dybRxhW.exe
  C:\Windows\System\dybRxhW.exe
  2⤵
  PID:15292
- C:\Windows\System\CERsnzK.exe
  C:\Windows\System\CERsnzK.exe
  2⤵
  PID:15312
- C:\Windows\System\CpUQEch.exe
  C:\Windows\System\CpUQEch.exe
  2⤵
  PID:15332
- C:\Windows\System\GwrHriO.exe
  C:\Windows\System\GwrHriO.exe
  2⤵
  PID:15352
- C:\Windows\System\DHtLERK.exe
  C:\Windows\System\DHtLERK.exe
  2⤵
  PID:11760
- C:\Windows\System\ORhqCUX.exe
  C:\Windows\System\ORhqCUX.exe
  2⤵
  PID:14340
- C:\Windows\System\RgKVOYJ.exe
  C:\Windows\System\RgKVOYJ.exe
  2⤵
  PID:14396
- C:\Windows\System\hSvHEhR.exe
  C:\Windows\System\hSvHEhR.exe
  2⤵
  PID:10944
- C:\Windows\System\NAwAxYO.exe
  C:\Windows\System\NAwAxYO.exe
  2⤵
  PID:14496
- C:\Windows\System\HtclyMc.exe
  C:\Windows\System\HtclyMc.exe
  2⤵
  PID:14432
- C:\Windows\System\bZTbdkm.exe
  C:\Windows\System\bZTbdkm.exe
  2⤵
  PID:14552
- C:\Windows\System\vbjjArP.exe
  C:\Windows\System\vbjjArP.exe
  2⤵
  PID:14604
- C:\Windows\System\vvHDlfH.exe
  C:\Windows\System\vvHDlfH.exe
  2⤵
  PID:14640
- C:\Windows\System\JPXGbkH.exe
  C:\Windows\System\JPXGbkH.exe
  2⤵
  PID:14816
- C:\Windows\System\PRZGjOP.exe
  C:\Windows\System\PRZGjOP.exe
  2⤵
  PID:14776
- C:\Windows\System\sNYeWeR.exe
  C:\Windows\System\sNYeWeR.exe
  2⤵
  PID:11380
- C:\Windows\System\oThPmyf.exe
  C:\Windows\System\oThPmyf.exe
  2⤵
  PID:14940
- C:\Windows\System\jEdgRiI.exe
  C:\Windows\System\jEdgRiI.exe
  2⤵
  PID:15032
- C:\Windows\System\BIZSbDd.exe
  C:\Windows\System\BIZSbDd.exe
  2⤵
  PID:15036
- C:\Windows\System\XVQJuUx.exe
  C:\Windows\System\XVQJuUx.exe
  2⤵
  PID:14912
- C:\Windows\System\PBHvSlV.exe
  C:\Windows\System\PBHvSlV.exe
  2⤵
  PID:15112
- C:\Windows\System\iaqNnok.exe
  C:\Windows\System\iaqNnok.exe
  2⤵
  PID:11648
- C:\Windows\System\GRArAJd.exe
  C:\Windows\System\GRArAJd.exe
  2⤵
  PID:11636
- C:\Windows\System\JkxRTYA.exe
  C:\Windows\System\JkxRTYA.exe
  2⤵
  PID:10348
- C:\Windows\System\EzJDamh.exe
  C:\Windows\System\EzJDamh.exe
  2⤵
  PID:12188
- C:\Windows\System\ObQQZoK.exe
  C:\Windows\System\ObQQZoK.exe
  2⤵
  PID:15160
- C:\Windows\System\nqeTfeS.exe
  C:\Windows\System\nqeTfeS.exe
  2⤵
  PID:12064
- C:\Windows\System\AAFqHdw.exe
  C:\Windows\System\AAFqHdw.exe
  2⤵
  PID:14452
- C:\Windows\System\NlczqhG.exe
  C:\Windows\System\NlczqhG.exe
  2⤵
  PID:11320
- C:\Windows\System\yVBhlpG.exe
  C:\Windows\System\yVBhlpG.exe
  2⤵
  PID:14824
- C:\Windows\System\akYKOUB.exe
  C:\Windows\System\akYKOUB.exe
  2⤵
  PID:14980
- C:\Windows\System\fNogdvC.exe
  C:\Windows\System\fNogdvC.exe
  2⤵
  PID:11396
- C:\Windows\System\IURyMyD.exe
  C:\Windows\System\IURyMyD.exe
  2⤵
  PID:14720
- C:\Windows\System\tJuOcxb.exe
  C:\Windows\System\tJuOcxb.exe
  2⤵
  PID:14804
- C:\Windows\System\jtGMixI.exe
  C:\Windows\System\jtGMixI.exe
  2⤵
  PID:10032
- C:\Windows\System\zCCWrqf.exe
  C:\Windows\System\zCCWrqf.exe
  2⤵
  PID:15060
- C:\Windows\System\LCrzRFl.exe
  C:\Windows\System\LCrzRFl.exe
  2⤵
  PID:15096
- C:\Windows\System\SJeeOMk.exe
  C:\Windows\System\SJeeOMk.exe
  2⤵
  PID:15164
- C:\Windows\System\nUYbRDM.exe
  C:\Windows\System\nUYbRDM.exe
  2⤵
  PID:15172
- C:\Windows\System\RaYnYdo.exe
  C:\Windows\System\RaYnYdo.exe
  2⤵
  PID:11808
- C:\Windows\System\eNDNJii.exe
  C:\Windows\System\eNDNJii.exe
  2⤵
  PID:14448
- C:\Windows\System\uVyokTi.exe
  C:\Windows\System\uVyokTi.exe
  2⤵
  PID:15268
- C:\Windows\System\EZqsXwa.exe
  C:\Windows\System\EZqsXwa.exe
  2⤵
  PID:12012
- C:\Windows\System\WZVrwQB.exe
  C:\Windows\System\WZVrwQB.exe
  2⤵
  PID:11156
- C:\Windows\System\UMHiWtQ.exe
  C:\Windows\System\UMHiWtQ.exe
  2⤵
  PID:11512
- C:\Windows\System\OFRsgyp.exe
  C:\Windows\System\OFRsgyp.exe
  2⤵
  PID:15072
- C:\Windows\System\MBsvkoM.exe
  C:\Windows\System\MBsvkoM.exe
  2⤵
  PID:14580
- C:\Windows\System\qLONQYx.exe
  C:\Windows\System\qLONQYx.exe
  2⤵
  PID:15076
- C:\Windows\System\yGsVZnP.exe
  C:\Windows\System\yGsVZnP.exe
  2⤵
  PID:11944
- C:\Windows\System\QLSWElT.exe
  C:\Windows\System\QLSWElT.exe
  2⤵
  PID:15092
- C:\Windows\System\iwCUxHy.exe
  C:\Windows\System\iwCUxHy.exe
  2⤵
  PID:11468
- C:\Windows\System\MqFfufq.exe
  C:\Windows\System\MqFfufq.exe
  2⤵
  PID:4068
- C:\Windows\System\kahvXPZ.exe
  C:\Windows\System\kahvXPZ.exe
  2⤵
  PID:15024
- C:\Windows\System\ehcpbnv.exe
  C:\Windows\System\ehcpbnv.exe
  2⤵
  PID:4408
- C:\Windows\System\oIjvTHc.exe
  C:\Windows\System\oIjvTHc.exe
  2⤵
  PID:2088
- C:\Windows\System\GbNrLbs.exe
  C:\Windows\System\GbNrLbs.exe
  2⤵
  PID:3228
- C:\Windows\System\oRjcURT.exe
  C:\Windows\System\oRjcURT.exe
  2⤵
  PID:12128
- C:\Windows\System\gUjTvqr.exe
  C:\Windows\System\gUjTvqr.exe
  2⤵
  PID:4332
- C:\Windows\System\atihPxi.exe
  C:\Windows\System\atihPxi.exe
  2⤵
  PID:15368
- C:\Windows\System\svWvpUP.exe
  C:\Windows\System\svWvpUP.exe
  2⤵
  PID:15456
- C:\Windows\System\akwNQHO.exe
  C:\Windows\System\akwNQHO.exe
  2⤵
  PID:15484
- C:\Windows\System\PwDcHTy.exe
  C:\Windows\System\PwDcHTy.exe
  2⤵
  PID:15500
- C:\Windows\System\fxZvPlF.exe
  C:\Windows\System\fxZvPlF.exe
  2⤵
  PID:15520
- C:\Windows\System\cXjAxNP.exe
  C:\Windows\System\cXjAxNP.exe
  2⤵
  PID:15540
- C:\Windows\System\nIfVMcQ.exe
  C:\Windows\System\nIfVMcQ.exe
  2⤵
  PID:15596
- C:\Windows\System\AsVsVgs.exe
  C:\Windows\System\AsVsVgs.exe
  2⤵
  PID:15616
- C:\Windows\System\DXWqkbF.exe
  C:\Windows\System\DXWqkbF.exe
  2⤵
  PID:15640
- C:\Windows\System\hnfzmDV.exe
  C:\Windows\System\hnfzmDV.exe
  2⤵
  PID:15728
- C:\Windows\System\QPPPAul.exe
  C:\Windows\System\QPPPAul.exe
  2⤵
  PID:15844
- C:\Windows\System\lpfkNPA.exe
  C:\Windows\System\lpfkNPA.exe
  2⤵
  PID:15996
- C:\Windows\System\jhskQzb.exe
  C:\Windows\System\jhskQzb.exe
  2⤵
  PID:16016
- C:\Windows\System\TvVDypj.exe
  C:\Windows\System\TvVDypj.exe
  2⤵
  PID:16032
- C:\Windows\System\JGmTDrc.exe
  C:\Windows\System\JGmTDrc.exe
  2⤵
  PID:16048
- C:\Windows\System\yNhWawS.exe
  C:\Windows\System\yNhWawS.exe
  2⤵
  PID:16084
- C:\Windows\System\gKBaMlt.exe
  C:\Windows\System\gKBaMlt.exe
  2⤵
  PID:16108
- C:\Windows\System\AvdCYZd.exe
  C:\Windows\System\AvdCYZd.exe
  2⤵
  PID:16132
- C:\Windows\System\nMmwHJk.exe
  C:\Windows\System\nMmwHJk.exe
  2⤵
  PID:16148
- C:\Windows\System\ebtYtXe.exe
  C:\Windows\System\ebtYtXe.exe
  2⤵
  PID:16168
- C:\Windows\System\jnlOvwS.exe
  C:\Windows\System\jnlOvwS.exe
  2⤵
  PID:16188
- C:\Windows\System\GTIgBnH.exe
  C:\Windows\System\GTIgBnH.exe
  2⤵
  PID:16228
- C:\Windows\System\DlROTHK.exe
  C:\Windows\System\DlROTHK.exe
  2⤵
  PID:16304
- C:\Windows\System\PyXrSjw.exe
  C:\Windows\System\PyXrSjw.exe
  2⤵
  PID:16324
- C:\Windows\System\VJgRZvn.exe
  C:\Windows\System\VJgRZvn.exe
  2⤵
  PID:16352
- C:\Windows\System\xMGUzZO.exe
  C:\Windows\System\xMGUzZO.exe
  2⤵
  PID:16380
- C:\Windows\System\UAHtJEO.exe
  C:\Windows\System\UAHtJEO.exe
  2⤵
  PID:15376
- C:\Windows\System\cKKFaGv.exe
  C:\Windows\System\cKKFaGv.exe
  2⤵
  PID:908
- C:\Windows\System\HLPlhzx.exe
  C:\Windows\System\HLPlhzx.exe
  2⤵
  PID:544
- C:\Windows\System\huTeXtr.exe
  C:\Windows\System\huTeXtr.exe
  2⤵
  PID:15404
- C:\Windows\System\XmMNKgR.exe
  C:\Windows\System\XmMNKgR.exe
  2⤵
  PID:5192
- C:\Windows\System\brannOZ.exe
  C:\Windows\System\brannOZ.exe
  2⤵
  PID:15580
- C:\Windows\System\VVRKHXe.exe
  C:\Windows\System\VVRKHXe.exe
  2⤵
  PID:15648
- C:\Windows\System\ByeNAQW.exe
  C:\Windows\System\ByeNAQW.exe
  2⤵
  PID:15756
- C:\Windows\System\IXVrgJr.exe
  C:\Windows\System\IXVrgJr.exe
  2⤵
  PID:15708
- C:\Windows\System\JHBzllm.exe
  C:\Windows\System\JHBzllm.exe
  2⤵
  PID:15992
- C:\Windows\System\ouJZgkU.exe
  C:\Windows\System\ouJZgkU.exe
  2⤵
  PID:11692
- C:\Windows\System\IOZrWSr.exe
  C:\Windows\System\IOZrWSr.exe
  2⤵
  PID:16056
- C:\Windows\System\XHAplnx.exe
  C:\Windows\System\XHAplnx.exe
  2⤵
  PID:16064
- C:\Windows\System\hJjyibo.exe
  C:\Windows\System\hJjyibo.exe
  2⤵
  PID:16220
- C:\Windows\System\SCkRJEJ.exe
  C:\Windows\System\SCkRJEJ.exe
  2⤵
  PID:16128
- C:\Windows\System\dPseGgM.exe
  C:\Windows\System\dPseGgM.exe
  2⤵
  PID:16180
- C:\Windows\System\oasJhsX.exe
  C:\Windows\System\oasJhsX.exe
  2⤵
  PID:16272
- C:\Windows\System\sibpFRL.exe
  C:\Windows\System\sibpFRL.exe
  2⤵
  PID:16300
- C:\Windows\System\gRrJrGc.exe
  C:\Windows\System\gRrJrGc.exe
  2⤵
  PID:5464
- C:\Windows\System\NBGrchT.exe
  C:\Windows\System\NBGrchT.exe
  2⤵
  PID:16312
- C:\Windows\System\VHyrLxj.exe
  C:\Windows\System\VHyrLxj.exe
  2⤵
  PID:11536
- C:\Windows\System\lDWLOuI.exe
  C:\Windows\System\lDWLOuI.exe
  2⤵
  PID:16264
- C:\Windows\System\dOfRciZ.exe
  C:\Windows\System\dOfRciZ.exe
  2⤵
  PID:11708
- C:\Windows\System\dDaIHOX.exe
  C:\Windows\System\dDaIHOX.exe
  2⤵
  PID:16340
- C:\Windows\System\VgCTfma.exe
  C:\Windows\System\VgCTfma.exe
  2⤵
  PID:15476
- C:\Windows\System\BsMxhhl.exe
  C:\Windows\System\BsMxhhl.exe
  2⤵
  PID:5268
- C:\Windows\System\FFPlyBa.exe
  C:\Windows\System\FFPlyBa.exe
  2⤵
  PID:15528
- C:\Windows\System\IaITfDX.exe
  C:\Windows\System\IaITfDX.exe
  2⤵
  PID:15448
- C:\Windows\System\mJMuYeu.exe
  C:\Windows\System\mJMuYeu.exe
  2⤵
  PID:5744
- C:\Windows\System\TUJhGzq.exe
  C:\Windows\System\TUJhGzq.exe
  2⤵
  PID:12244
- C:\Windows\System\MvaljjF.exe
  C:\Windows\System\MvaljjF.exe
  2⤵
  PID:15492
- C:\Windows\System\pUwyIYp.exe
  C:\Windows\System\pUwyIYp.exe
  2⤵
  PID:5628
- C:\Windows\System\IWYGzfu.exe
  C:\Windows\System\IWYGzfu.exe
  2⤵
  PID:5716
- C:\Windows\System\XlGuKpd.exe
  C:\Windows\System\XlGuKpd.exe
  2⤵
  PID:15824
- C:\Windows\System\raQRkFr.exe
  C:\Windows\System\raQRkFr.exe
  2⤵
  PID:15792
- C:\Windows\System\nJIjikF.exe
  C:\Windows\System\nJIjikF.exe
  2⤵
  PID:212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4148 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
1⤵
PID:11628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2vtlbrix.4y4.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ABzxnUD.exe

Filesize
2.9MB

MD5
529a293073160ecaa59dd68c08dbef2d

SHA1
735eb400a2d269897f74d4934c4309b126ad1f51

SHA256
2f81ca6e32f29cefff91fb0d4da54e4eef77533916c8a71c4c1c6b6aeef0e232

SHA512
f87597f365b112258d4fea62117b273036afd6724ce0393ed7b2aa794c596cb5f4b9e8e60810c4c6571012f701541e6fa6c5f93e3f117a216b6c7ee7d1a4b399

Download Submit
C:\Windows\System\AtCjoRv.exe

Filesize
2.9MB

MD5
1079e65bbd7133beb6e2186b74923085

SHA1
96161fc52a23e2700509337aa91e61f9b23edc9c

SHA256
366f7a5b5039bcb8d87d49400f920f805bb497169f8c631e6aeaaebb1de4792b

SHA512
f60b5aa7ad83e7a397cabb744f00979bdc23b28d415eb92ec85f7277d042029766cd36718a11ae7b8259f0e223da150b678a2ed924e5ff3f7a032911b987e859

Download Submit
C:\Windows\System\BLOcylO.exe

Filesize
2.9MB

MD5
db43fab82304186ab06b6fdf744ec43d

SHA1
c94f946ac0bab43da40dc8f6486d7522c3baa236

SHA256
c6c451b45ead57e9ee8b2b1e624bd8daed9fb0db00a7a4a59e35bd7bddda5753

SHA512
8f5795bf61d700435ce909f12e2301c46967456246e0df882df412b6ed8a69ad55141f8d1137a500633205a444fa24212d9f4af07c8c8041137df003242ba252

Download Submit
C:\Windows\System\CQrKgiK.exe

Filesize
2.9MB

MD5
3a34c091bc39f1663b013f842245196f

SHA1
2bf3e3d038d55f0fa1187a21ea284ca5bf4f2211

SHA256
af90b03e5739be226a165bbb846a7e0d6b1c5811c35289b380c626a57c27fe86

SHA512
3733847a97e2dfed77596ae02913df8fb3618dddda7f923d9ecda71d8c751c8ca3be9ca8ca362a234cb05b2e9a6f879a45bc3eaa087d68cfcda47fb6e9af68bb

Download Submit
C:\Windows\System\HDCJjpY.exe

Filesize
2.9MB

MD5
53d1a8a4982795f70b4226e28cc28129

SHA1
34eb45d028704a1db420053d8d76cbb45215ce5d

SHA256
617eb803aacc3ecc587a6ef9072f39934dd4722efa12a8b1d1d8ab3ed0609157

SHA512
7cbcdceb45397c8c1f401974316cd23396cb32bd71b6db3591f23f03aee231490b804d4d74b342ec40fd03fd70b766ab8016dbe870905d9e26572cb48eeeb845

Download Submit
C:\Windows\System\JIUsSXO.exe

Filesize
2.9MB

MD5
1d063c072738b8009eba1d4b71d340af

SHA1
564b088e9566109b68dde2ead2ed95d8f8a38138

SHA256
66404d0f6711f48cb873482d83c1ccf2fd6679cca36fdcc81691e887e677ffad

SHA512
031e39168a085cd1a2196b0b5d72d0cab3a25be0eafacce85ede0c3dc566a8e8bc72dae8de0542f0555a1c08812c6853ca84ce57fc279cb793c81c44ddf038a7

Download Submit
C:\Windows\System\LILqJQk.exe

Filesize
2.9MB

MD5
01c7ec326a3fcce828c1e0d653a728ae

SHA1
0a11a91bccd768fa93ec8e4b886eb19eae1407c3

SHA256
97c9ce40d4762fe6bd49bb98dcbcd4572da97d49493d7637617068398e75fa27

SHA512
ac5dbf0fbdab3314924d3826c0eed2d0bdea065feebb451ac8318785acd506c077c2100d2a0703cffb9d28622808366861595335a82d35db7dd15fac51c6fb0f

Download Submit
C:\Windows\System\PHfTeVW.exe

Filesize
2.9MB

MD5
d70bc434262e491a441a8c0de30f2207

SHA1
bb031d22cea222e3895af18c84f6ce9345610611

SHA256
3d7b72f94dc71b2d95d3491efc657e74e64babbd219d5b68ba4dad1bea69f5fe

SHA512
0769d12321550e5e2677da92455237af1b93c5c15d2605852284c7632200fa99cbdb475357b4944359fdd5a9c28d6d41ac627917f35b7f371815ec4ed5fadf8a

Download Submit
C:\Windows\System\QkOheNI.exe

Filesize
2.9MB

MD5
943458945fdfbb85835c57d79edc2789

SHA1
c8bbdf0cd998929f8240a6e4c777f7477961dbee

SHA256
19b3e48e5f473aac2ba18369b00f4a6678fa23b863974d3388d727652b565bf9

SHA512
8e9068451fb5adc679880f1dfd022709ad1328616a0b2a67626548629e4a1c2b4c97907454f2067e0ddc3d971f5c14cbe7d6264ea0473dfe3b61aff563fc3f4e

Download Submit
C:\Windows\System\TsWGkGc.exe

Filesize
2.9MB

MD5
7a1965a5b56d741a7a9c21a821c9d8fe

SHA1
e1a5347d2fa03635125202833259dafe590513b2

SHA256
8332a932a7259b67c4ed10ab788bc66a03908f4e0937471d119ea9f14c5cd7eb

SHA512
535b03f0e35f433960297befbaf982330efb506b429481d01ef25e09c0b5c067c2504f7a131fc23ab245a43a6cd07ec0b59e112b315b1199485413d9af3ff63e

Download Submit
C:\Windows\System\TtXlYNL.exe

Filesize
2.9MB

MD5
3c9d14b12a86b12b4e1dc532a935fb70

SHA1
3c2b873706b4bdb2e0d033c7d82815f415e4e0b9

SHA256
53cd4054704b688c4b27e59198c8c39063f909d01df618333a431c0b033776ba

SHA512
c4755b36f73f511fc8bc2bdb5968c1988a80584a9b2bbf2d35191f7693485bcdfcc82de2d27731210fa91320061c57e8200af21f820cd2b040bf23a7ddbd4187

Download Submit
C:\Windows\System\WOhqccp.exe

Filesize
2.9MB

MD5
5ec0edd85ae806e6430f0493792c4598

SHA1
a3ced52b4953a3847110d1f74cd74f4a30c15314

SHA256
6f843b1b5853a5fbf135203eeed6f30ed03c5974d27090b16d0aa7aa09f52734

SHA512
ee597522bdf1a7d3a71ce7bd0afe6d415a176d7b0b58048db2e522b41e35cb9811c86e61fc2b96f628051038f49429f1ab0a9e29fb5e0c97379fc1eb6a09644b

Download Submit
C:\Windows\System\WudSHqa.exe

Filesize
2.9MB

MD5
a910326fd4a749e1cfd5fe03ea9b2ad0

SHA1
c54cf800f40343f6d344f8c1705652e2d48e7f59

SHA256
c588e60faf365ff0a85fb4ba3e663e593537a563f754678c5a9f47730b062567

SHA512
0cd914d3b821e7288a7e2cb7cd31aef04d2a83c017f4997e1f4b81ca3eb3e272c8d01aad5595add9ba91b8138d6a80a4cd70cc6e31a7297b59de6fb1ecc85827

Download Submit
C:\Windows\System\bIaosfm.exe

Filesize
2.9MB

MD5
cdec704ec26a75c9fbfd2ef04969282b

SHA1
bab0d16c58365f3cbc66da6bb95a0d014d4ac1fd

SHA256
070a1f7670501875c15d944c41ea4dae2fad2ee93ad93fec5ce8a4b93e714d3e

SHA512
933a88fb1d661f15bebeeb7891eb723b13bdfb251f9df82d96ac1f117a736a4821ee697b3555605ea9c01be7a9883c1702c687ad437e1dd6349a76833ca43c1d

Download Submit
C:\Windows\System\cDApKIR.exe

Filesize
2.9MB

MD5
f4d0d8899338abf051ea7b591e7abeee

SHA1
ca0207019cd081ca454f59846546ba585f323250

SHA256
4c759c1cf009bbbfe9499650ec5d93204bf7649b558c5d0e73e2706b0e8587fd

SHA512
7553aed989c861b22e20961ad7072c3302ba02c93cc05de0438277679567fd47290e4a5ce3401342f14425a8e8b0a7d0128a8889459caf444682a6a116c66a2b

Download Submit
C:\Windows\System\cnSbyhz.exe

Filesize
2.9MB

MD5
8cceac56fc824367e95d263c15b8ecc8

SHA1
13df44f27d85828403f1e6963605f7bf78c5fbce

SHA256
efd8b9a6ca5e15af825018e52adaadabe55eb47764563e9fc4bdc06965c04c6c

SHA512
4c380340331060f6fb8adf742e530dfa3710dbc817fdefbe1f74ee34ece58928ea274ad9b4111277d85366848e1540f0e9bb988831c066643afac06ea42abe18

Download Submit
C:\Windows\System\edaTTnJ.exe

Filesize
2.9MB

MD5
55810de6b850aba8c89ba0d36fac4f4f

SHA1
21bed96c0401ad10e1ff5bea933efce37c71148f

SHA256
3e5a942e1267b6da8725c5979090df21d2655ea2b50c05d1ac4bbb3986dcd2b1

SHA512
46dd937abe01c255cd466b93efe5c7a5a5537d9282cba31605f98656c1689a4e2219823ccd4f969f04874ec727a0d516880743d6a33b52df59e11810a5a7ae4e

Download Submit
C:\Windows\System\elqhBFj.exe

Filesize
2.9MB

MD5
c926a0f2e10acee1e82a8aa03279dc2c

SHA1
c0e8ac1e35cc393a08b9e995db00c9e7604b190d

SHA256
2372ea94790ee115cae6f26c0c2ad8897a6054d1bd406d92517fe55f1d1d113f

SHA512
4fc9fb220b8bd398d77ea5dc2437073ce5c68d42a2053762422bc47d74364a2e6e9d597f930411790b5157cd0e69a69195ee844d6f80c605ffefe7c717b0a085

Download Submit
C:\Windows\System\jXhFaQY.exe

Filesize
2.9MB

MD5
7798aaa486d85154c7886abb46b0e13e

SHA1
aaf003ade446ef2173aca1c41f70fd3ff5cceabb

SHA256
fd5d6c0c1a2edfbee50ba1ee664d963171e5b2eb560c26cfa16d04a4d353d037

SHA512
8cb2fe14dee467665bfca96ff10808f7a33c67a71ef2b968f239180523db44ead0454b5b79802fe05ad886d0b52a0445e4823f8d09fb6853d2139e78c6beec44

Download Submit
C:\Windows\System\nXMXFcm.exe

Filesize
2.9MB

MD5
c9fa68df3ef32eb2b8bab765b5a3c8c2

SHA1
9f703d2255a60658b9e0e2b4fcad45fb244d3d65

SHA256
fe7295056c42343107ad6c06372e1dcd01f8ba894c7b9faba9329d6e8a94115d

SHA512
74202c5785c88767330fd28e9a914657a46d1c9bbd4195d38719f3d133be56c31020564370cb876ddb5bfda8f70c87e2ed9826df3c18ab4aed2dd0a91003e527

Download Submit
C:\Windows\System\nfacxtd.exe

Filesize
2.9MB

MD5
1c79ff2ad5d03bf1649dcc35000a909d

SHA1
fe81b8304cfea280f1abd95756a88697efc71960

SHA256
70cdf809eb824cf16a5626e0f7ca3cbde39350ea9a8996cd77a3aefc312c92b8

SHA512
dfcae2c24dfe7ce9dafd0f370ce77eef52e529e365ac473893a0d2aefbd0c0a1ab7b7d6a6ced4a6abca1d7f3483a2e9892f982846461d82acc9d2ab4b3402c91

Download Submit
C:\Windows\System\nyTSYvY.exe

Filesize
2.9MB

MD5
a4a4fa1cc79541bb36fef19eb8cbfc7a

SHA1
e17abd8f16df4b8fca606841e6690767e25eb330

SHA256
1ff22ef2ed3d309255b8ccad6eedc84c7f8750850530fd9a75466d899fd31e36

SHA512
88eb3f8ed22fe1730c6aa7efd986db8765a24ee7b084e5aaceb38220606fd106be10645756f1169e4b5ef6416dcea9f1db74bcb6cf405cb22b96b835411c659b

Download Submit
C:\Windows\System\oTxTcfI.exe

Filesize
2.9MB

MD5
ce19c1f43d321bba128917390a8913da

SHA1
6227b0bbd9c564e515aac41f553e653598b7213c

SHA256
45b56ff7a934b7b6e0f3a67291798ed2c8065d54ec4c0a7721857508d5c75d6c

SHA512
e9cc62faac847cfd61202f89eb915e9886b215723c5f59428c2a5654bbc7cb48736193e02a644c3c6bce4b89e8d726efcffc626e20c55c4c881feb7a348885dd

Download Submit
C:\Windows\System\trylCYN.exe

Filesize
2.9MB

MD5
e33e9bb55682f6f29d3e66957933d16b

SHA1
b2acf46fc0cdef47228493c4c7615cffba9ac6f2

SHA256
1833738f8620236b5113df7b121f3f7db55b12e3ff002c1f26e457682291940e

SHA512
0c55712be72a0059a5a0e7c18f10bbca9a374bb82acabbfc317bdc7a28cf47e714980c9fde5727931df29dd896fb739500903e9f1f4691e223a446e1bf0575c8

Download Submit
C:\Windows\System\uciJRmu.exe

Filesize
2.9MB

MD5
afe210724b36be5a83c4d177b1e2b275

SHA1
1eda35e114981a65285b4eb8bbf5498dafa64169

SHA256
bbbc807e598654fa16e06c17f0221e0ae2c305e2cb79fb6c0708b83721c13cc6

SHA512
42cf12039bb7062a4df740f2a3be1626f9cb4624cbe6339af8ab38d3b0b687bb215449b5a8a1648ab8c4fb4fe7751960a9276964be4f912ff6d6351113f9a3cf

Download Submit
C:\Windows\System\vKrWfzV.exe

Filesize
2.9MB

MD5
8a2bf6bb3320d5a17dcb5806c2c8a066

SHA1
46759b397732f8c58f904d2617518c225e6feb2b

SHA256
3c7d9ec7368e650489f5b22c9841f4dd5de9c0733d6b5f12a84ae8737f4c8be5

SHA512
6d43e3a83d1ca23388c41f76aba84878e7e92494db2ae1c8ff1664787573630c3a1bcf2caa0f5a1c0dc38609762c030a202070bdd31d892c5c04bdbd4d3bb74f

Download Submit
C:\Windows\System\vcZZynR.exe

Filesize
2.9MB

MD5
00d3e2bcb51b0e60d4eadbcde9d0066c

SHA1
834afd20ce1697204a2f6a23a04f68c2b62fe400

SHA256
3534a8a6b61fde39e2151e67a7361a108fa89c773a83aecf7d317fa9300ad7c2

SHA512
cd2942d72a7c7c381517ced285d39206340bae144ad17d001bfada362fe62f1fb6d31ab8f765546e7be32f6acc715f280f5123e505a5276847ff8459dd872567

Download Submit
C:\Windows\System\wVXIsRw.exe

Filesize
2.9MB

MD5
19e87adede46f8465950b761ea7c656d

SHA1
1ed2a668239f0187b6117324c4ab4f84e7a68c5b

SHA256
b97d4c6e717801f82868843aceadc66285a749db6c82de125682f7764ca5c176

SHA512
a512c876698f9b1ce0751ca9350a72f5694dc5b706f4b5ce092d8adc40ab6050dbeb714d80d5be2017a274fc3af22caeecffaa2c671c7edeb6749f829788830c

Download Submit
C:\Windows\System\wfggeFr.exe

Filesize
2.9MB

MD5
8d3de23b34713f5a7d9b8f3f36f6ff30

SHA1
66443199b3ad7dccdc6f456307c85632a604790a

SHA256
d6ce5efc3211eb4e2c2d3528679f2d8197a3c0a935bf5756a3dec41b911c99f5

SHA512
0d6fc86d05494c97f7c1eff5183e3c6cbc40ec0ac9309039bcdf1b0928886d5ca0c592dbd3bab2289105857a3a0fc27ed91454016044021bf1ded2d4b258150c

Download Submit
C:\Windows\System\wpjiXnL.exe

Filesize
2.9MB

MD5
6f9cdab222b31d539dc6e7555ad514f4

SHA1
9066f49eb1e8e3e84605b37cbfde0fd2ac69f096

SHA256
c04f7d52827e14676f7764a6ca4f0ede985f7bf6c866de40f7a98f75b6f21988

SHA512
085c3b6e9c4a86de386f199d4a2f0a863fa5bbe630dbcb9f1150ed886ccd61b5517bd72de49fd0befbb073928cdd164806b598fd4083fd90e27ba31dd50d6e4e

Download Submit
C:\Windows\System\wtRGSyt.exe

Filesize
2.9MB

MD5
73777f0a984a74bcb616de97ee66b5d4

SHA1
fb795531bd980b081c37752ac588ee6e4cd733af

SHA256
0b41aa67d143b88104615bcd2a5eef0ffc98a91dbaa17c6be604f877c5d52fe5

SHA512
13b3448538dc31afc62fd44c379387a8ec7cc2a2232f3dcdca776a1b01de75095ffe527359b93d462d2cb1df56b387e79a189286c6cb3494d6cf8e225f765f4a

Download Submit
C:\Windows\System\zDMmUKy.exe

Filesize
2.9MB

MD5
24dcffc7d725712dd2e7bb9a958d18e1

SHA1
5f7111b4c459a132bb9a58afa376116e2803126f

SHA256
a718c036099df95fc467772669c386b45799293bfeda611598d93c8691842439

SHA512
6894e7acf61b07cb460a5baa8fcc1f4446446d0092376e150faefece9a3fc38040f2aa9eb797f2f9cfa14f7a930661d63ce41785d412d43aa89cc5adac273086

Download Submit
memory/228-1611-0x00007FF77F6C0000-0x00007FF77FAB2000-memory.dmp

Filesize
3.9MB

Download
memory/228-370-0x00007FF77F6C0000-0x00007FF77FAB2000-memory.dmp

Filesize
3.9MB

Download
memory/376-405-0x00007FF77AAD0000-0x00007FF77AEC2000-memory.dmp

Filesize
3.9MB

Download
memory/376-1662-0x00007FF77AAD0000-0x00007FF77AEC2000-memory.dmp

Filesize
3.9MB

Download
memory/416-46-0x00007FFAE3680000-0x00007FFAE4141000-memory.dmp

Filesize
10.8MB

Download
memory/416-141-0x00000289F1FE0000-0x00000289F2786000-memory.dmp

Filesize
7.6MB

Download
memory/416-60-0x00007FFAE3680000-0x00007FFAE4141000-memory.dmp

Filesize
10.8MB

Download
memory/416-6437-0x00007FFAE3683000-0x00007FFAE3685000-memory.dmp

Filesize
8KB

Download
memory/416-32-0x00007FFAE3680000-0x00007FFAE4141000-memory.dmp

Filesize
10.8MB

Download
memory/416-10-0x00000289EE9B0000-0x00000289EE9D2000-memory.dmp

Filesize
136KB

Download
memory/416-3-0x00007FFAE3683000-0x00007FFAE3685000-memory.dmp

Filesize
8KB

Download
memory/416-6523-0x00007FFAE3680000-0x00007FFAE4141000-memory.dmp

Filesize
10.8MB

Download
memory/748-427-0x00007FF6E02B0000-0x00007FF6E06A2000-memory.dmp

Filesize
3.9MB

Download
memory/748-1672-0x00007FF6E02B0000-0x00007FF6E06A2000-memory.dmp

Filesize
3.9MB

Download
memory/840-1612-0x00007FF72C390000-0x00007FF72C782000-memory.dmp

Filesize
3.9MB

Download
memory/840-372-0x00007FF72C390000-0x00007FF72C782000-memory.dmp

Filesize
3.9MB

Download
memory/864-1599-0x00007FF7B8830000-0x00007FF7B8C22000-memory.dmp

Filesize
3.9MB

Download
memory/864-52-0x00007FF7B8830000-0x00007FF7B8C22000-memory.dmp

Filesize
3.9MB

Download
memory/1236-1632-0x00007FF699040000-0x00007FF699432000-memory.dmp

Filesize
3.9MB

Download
memory/1236-499-0x00007FF699040000-0x00007FF699432000-memory.dmp

Filesize
3.9MB

Download
memory/2480-51-0x00007FF7F43E0000-0x00007FF7F47D2000-memory.dmp

Filesize
3.9MB

Download
memory/2480-1588-0x00007FF7F43E0000-0x00007FF7F47D2000-memory.dmp

Filesize
3.9MB

Download
memory/2512-477-0x00007FF7A3990000-0x00007FF7A3D82000-memory.dmp

Filesize
3.9MB

Download
memory/2512-1706-0x00007FF7A3990000-0x00007FF7A3D82000-memory.dmp

Filesize
3.9MB

Download
memory/2556-1686-0x00007FF6014E0000-0x00007FF6018D2000-memory.dmp

Filesize
3.9MB

Download
memory/2556-461-0x00007FF6014E0000-0x00007FF6018D2000-memory.dmp

Filesize
3.9MB

Download
memory/3112-1656-0x00007FF6724E0000-0x00007FF6728D2000-memory.dmp

Filesize
3.9MB

Download
memory/3112-406-0x00007FF6724E0000-0x00007FF6728D2000-memory.dmp

Filesize
3.9MB

Download
memory/3200-449-0x00007FF7BA310000-0x00007FF7BA702000-memory.dmp

Filesize
3.9MB

Download
memory/3200-1679-0x00007FF7BA310000-0x00007FF7BA702000-memory.dmp

Filesize
3.9MB

Download
memory/3564-447-0x00007FF73ED20000-0x00007FF73F112000-memory.dmp

Filesize
3.9MB

Download
memory/3564-1680-0x00007FF73ED20000-0x00007FF73F112000-memory.dmp

Filesize
3.9MB

Download
memory/3568-462-0x00007FF7C67D0000-0x00007FF7C6BC2000-memory.dmp

Filesize
3.9MB

Download
memory/3568-1688-0x00007FF7C67D0000-0x00007FF7C6BC2000-memory.dmp

Filesize
3.9MB

Download
memory/3640-1701-0x00007FF65FCD0000-0x00007FF6600C2000-memory.dmp

Filesize
3.9MB

Download
memory/3640-472-0x00007FF65FCD0000-0x00007FF6600C2000-memory.dmp

Filesize
3.9MB

Download
memory/3944-495-0x00007FF6241E0000-0x00007FF6245D2000-memory.dmp

Filesize
3.9MB

Download
memory/3944-1646-0x00007FF6241E0000-0x00007FF6245D2000-memory.dmp

Filesize
3.9MB

Download
memory/4024-1716-0x00007FF7C8160000-0x00007FF7C8552000-memory.dmp

Filesize
3.9MB

Download
memory/4024-487-0x00007FF7C8160000-0x00007FF7C8552000-memory.dmp

Filesize
3.9MB

Download
memory/4032-1564-0x00007FF7FD870000-0x00007FF7FDC62000-memory.dmp

Filesize
3.9MB

Download
memory/4032-34-0x00007FF7FD870000-0x00007FF7FDC62000-memory.dmp

Filesize
3.9MB

Download
memory/4036-1673-0x00007FF7E9AC0000-0x00007FF7E9EB2000-memory.dmp

Filesize
3.9MB

Download
memory/4036-419-0x00007FF7E9AC0000-0x00007FF7E9EB2000-memory.dmp

Filesize
3.9MB

Download
memory/4348-381-0x00007FF609070000-0x00007FF609462000-memory.dmp

Filesize
3.9MB

Download
memory/4348-1615-0x00007FF609070000-0x00007FF609462000-memory.dmp

Filesize
3.9MB

Download
memory/4504-0-0x00007FF6DE2A0000-0x00007FF6DE692000-memory.dmp

Filesize
3.9MB

Download
memory/4504-5632-0x00007FF6DE2A0000-0x00007FF6DE692000-memory.dmp

Filesize
3.9MB

Download
memory/4504-1-0x0000014CC94C0000-0x0000014CC94D0000-memory.dmp

Filesize
64KB

Download
memory/4512-1576-0x00007FF7E5C10000-0x00007FF7E6002000-memory.dmp

Filesize
3.9MB

Download
memory/4512-39-0x00007FF7E5C10000-0x00007FF7E6002000-memory.dmp

Filesize
3.9MB

Download
memory/4548-425-0x00007FF7C7220000-0x00007FF7C7612000-memory.dmp

Filesize
3.9MB

Download
memory/4548-1675-0x00007FF7C7220000-0x00007FF7C7612000-memory.dmp

Filesize
3.9MB

Download
memory/4588-1684-0x00007FF608B40000-0x00007FF608F32000-memory.dmp

Filesize
3.9MB

Download
memory/4588-454-0x00007FF608B40000-0x00007FF608F32000-memory.dmp

Filesize
3.9MB

Download
memory/4596-1699-0x00007FF686DB0000-0x00007FF6871A2000-memory.dmp

Filesize
3.9MB

Download
memory/4596-468-0x00007FF686DB0000-0x00007FF6871A2000-memory.dmp

Filesize
3.9MB

Download
memory/5100-1664-0x00007FF7B9480000-0x00007FF7B9872000-memory.dmp

Filesize
3.9MB

Download
memory/5100-415-0x00007FF7B9480000-0x00007FF7B9872000-memory.dmp

Filesize
3.9MB

Download