xmrig | b8e5ffeb576cb4decfb7e31d7d5a01a6b0767ddeaa8d84daf63672526da9629f

Analysis

max time kernel
152s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 19:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
Size

1.9MB
MD5

141fdc4fb7552bb3fe7edf414215a5b4
SHA1

fd2cbe224bffec71e4759ed5351e262d7cd60e32
SHA256

b8e5ffeb576cb4decfb7e31d7d5a01a6b0767ddeaa8d84daf63672526da9629f
SHA512

51bea71315a87c69443064fbbb33fca8ef962e87fa00e844dc5c5237d87d689755861f8aba9a17c76732b8b6752f6a1356ce1863f8210ee6f6f5e6b58781bc75
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrljU9:NABB

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 43 IoCs

miner

resource	yara_rule
behavioral2/memory/4740-42-0x00007FF6F5510000-0x00007FF6F5902000-memory.dmp	xmrig
behavioral2/memory/4460-47-0x00007FF7A6380000-0x00007FF7A6772000-memory.dmp	xmrig
behavioral2/memory/1712-50-0x00007FF66D780000-0x00007FF66DB72000-memory.dmp	xmrig
behavioral2/memory/3636-338-0x00007FF7DDDE0000-0x00007FF7DE1D2000-memory.dmp	xmrig
behavioral2/memory/3692-346-0x00007FF6B53F0000-0x00007FF6B57E2000-memory.dmp	xmrig
behavioral2/memory/4756-352-0x00007FF6280D0000-0x00007FF6284C2000-memory.dmp	xmrig
behavioral2/memory/3228-354-0x00007FF786F60000-0x00007FF787352000-memory.dmp	xmrig
behavioral2/memory/2440-356-0x00007FF720420000-0x00007FF720812000-memory.dmp	xmrig
behavioral2/memory/4516-358-0x00007FF7A96A0000-0x00007FF7A9A92000-memory.dmp	xmrig
behavioral2/memory/1656-359-0x00007FF69BC70000-0x00007FF69C062000-memory.dmp	xmrig
behavioral2/memory/4076-361-0x00007FF7038C0000-0x00007FF703CB2000-memory.dmp	xmrig
behavioral2/memory/4380-363-0x00007FF6342E0000-0x00007FF6346D2000-memory.dmp	xmrig
behavioral2/memory/4744-366-0x00007FF72C6C0000-0x00007FF72CAB2000-memory.dmp	xmrig
behavioral2/memory/3656-377-0x00007FF6B37D0000-0x00007FF6B3BC2000-memory.dmp	xmrig
behavioral2/memory/3136-378-0x00007FF7A9A80000-0x00007FF7A9E72000-memory.dmp	xmrig
behavioral2/memory/4092-382-0x00007FF6009C0000-0x00007FF600DB2000-memory.dmp	xmrig
behavioral2/memory/64-381-0x00007FF6BBB60000-0x00007FF6BBF52000-memory.dmp	xmrig
behavioral2/memory/920-372-0x00007FF6A6B20000-0x00007FF6A6F12000-memory.dmp	xmrig
behavioral2/memory/3312-369-0x00007FF772BE0000-0x00007FF772FD2000-memory.dmp	xmrig
behavioral2/memory/4868-351-0x00007FF6606C0000-0x00007FF660AB2000-memory.dmp	xmrig
behavioral2/memory/2244-335-0x00007FF6885C0000-0x00007FF6889B2000-memory.dmp	xmrig
behavioral2/memory/3616-49-0x00007FF64D230000-0x00007FF64D622000-memory.dmp	xmrig
behavioral2/memory/3792-1789-0x00007FF7F9630000-0x00007FF7F9A22000-memory.dmp	xmrig
behavioral2/memory/3616-1883-0x00007FF64D230000-0x00007FF64D622000-memory.dmp	xmrig
behavioral2/memory/2440-2014-0x00007FF720420000-0x00007FF720812000-memory.dmp	xmrig
behavioral2/memory/3692-2032-0x00007FF6B53F0000-0x00007FF6B57E2000-memory.dmp	xmrig
behavioral2/memory/3228-2011-0x00007FF786F60000-0x00007FF787352000-memory.dmp	xmrig
behavioral2/memory/4744-2147-0x00007FF72C6C0000-0x00007FF72CAB2000-memory.dmp	xmrig
behavioral2/memory/1656-2154-0x00007FF69BC70000-0x00007FF69C062000-memory.dmp	xmrig
behavioral2/memory/4516-2146-0x00007FF7A96A0000-0x00007FF7A9A92000-memory.dmp	xmrig
behavioral2/memory/3136-2145-0x00007FF7A9A80000-0x00007FF7A9E72000-memory.dmp	xmrig
behavioral2/memory/4380-2143-0x00007FF6342E0000-0x00007FF6346D2000-memory.dmp	xmrig
behavioral2/memory/3656-2142-0x00007FF6B37D0000-0x00007FF6B3BC2000-memory.dmp	xmrig
behavioral2/memory/3312-2148-0x00007FF772BE0000-0x00007FF772FD2000-memory.dmp	xmrig
behavioral2/memory/4076-2101-0x00007FF7038C0000-0x00007FF703CB2000-memory.dmp	xmrig
behavioral2/memory/4868-1963-0x00007FF6606C0000-0x00007FF660AB2000-memory.dmp	xmrig
behavioral2/memory/4756-1953-0x00007FF6280D0000-0x00007FF6284C2000-memory.dmp	xmrig
behavioral2/memory/2244-1947-0x00007FF6885C0000-0x00007FF6889B2000-memory.dmp	xmrig
behavioral2/memory/1712-1943-0x00007FF66D780000-0x00007FF66DB72000-memory.dmp	xmrig
behavioral2/memory/3412-1951-0x00007FF7CEF80000-0x00007FF7CF372000-memory.dmp	xmrig
behavioral2/memory/4092-2201-0x00007FF6009C0000-0x00007FF600DB2000-memory.dmp	xmrig
behavioral2/memory/64-2198-0x00007FF6BBB60000-0x00007FF6BBF52000-memory.dmp	xmrig
behavioral2/memory/1432-4091-0x00007FF79C3D0000-0x00007FF79C7C2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
11	2548	powershell.exe
16	2548	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2548	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3792	QFyTeDw.exe
3616	gEHsOLs.exe
4740	mPzcdEZ.exe
4460	kdYJfqV.exe
1712	FEVzcqd.exe
3412	uhuDHin.exe
2244	WnBvWTX.exe
3636	lmYBdJJ.exe
3692	IaunLLk.exe
4868	svdgGIy.exe
4756	yswzLtg.exe
3228	jLLSNYY.exe
2440	IUbPDPK.exe
4516	rwrhetH.exe
1656	soNHgUI.exe
4076	YDHfIZv.exe
4380	AYasIPq.exe
4744	bRhODwf.exe
3312	JHiOdYH.exe
920	JZcVXzc.exe
3656	VWCwUDh.exe
3136	qNdYAxF.exe
64	FENvdog.exe
4092	AAaPEqb.exe
3232	uYbLoWP.exe
3548	qHIChRX.exe
2528	zTsSmIV.exe
3120	MtqpsRM.exe
4352	QQpJfFq.exe
2872	ANvuexr.exe
1324	hbiIxfB.exe
4072	BxRwKdh.exe
740	EoBPPHs.exe
1812	vQrSHoS.exe
2556	EkfsOOX.exe
3612	VwkifNx.exe
4520	UfDFday.exe
4488	BwVUoXy.exe
3400	vszauvT.exe
792	IAwDUiP.exe
4820	NSEnfFc.exe
1904	CxFkwZJ.exe
4836	qfRlsuj.exe
3064	UDnKDsF.exe
1348	kpbeiab.exe
1672	GCBnvFp.exe
2796	EnxcNzp.exe
3720	iEVOHqU.exe
1000	BLBfOYu.exe
3056	bdtyDyg.exe
1748	pWnoKzU.exe
2196	nEknFfU.exe
5124	dHKuLdo.exe
5152	NEcluqI.exe
5180	rqwMfmz.exe
5212	gaaDOzQ.exe
5228	KpYmMwR.exe
5252	gGuwbbv.exe
5288	TjLOoqu.exe
5324	PFIhixq.exe
5352	xawlNpW.exe
5380	ItfWkYh.exe
5408	ROusDya.exe
5436	AHGJoQw.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1432-0-0x00007FF79C3D0000-0x00007FF79C7C2000-memory.dmp	upx
behavioral2/files/0x0009000000023285-6.dat	upx
behavioral2/memory/3792-7-0x00007FF7F9630000-0x00007FF7F9A22000-memory.dmp	upx
behavioral2/files/0x000700000002328e-16.dat	upx
behavioral2/files/0x000900000002328b-22.dat	upx
behavioral2/files/0x000800000002328c-33.dat	upx
behavioral2/files/0x000800000002328a-38.dat	upx
behavioral2/memory/4740-42-0x00007FF6F5510000-0x00007FF6F5902000-memory.dmp	upx
behavioral2/files/0x000800000002328d-45.dat	upx
behavioral2/memory/4460-47-0x00007FF7A6380000-0x00007FF7A6772000-memory.dmp	upx
behavioral2/memory/1712-50-0x00007FF66D780000-0x00007FF66DB72000-memory.dmp	upx
behavioral2/memory/3412-51-0x00007FF7CEF80000-0x00007FF7CF372000-memory.dmp	upx
behavioral2/files/0x000700000002328f-56.dat	upx
behavioral2/files/0x0007000000023290-61.dat	upx
behavioral2/files/0x0007000000023292-71.dat	upx
behavioral2/files/0x0007000000023294-81.dat	upx
behavioral2/files/0x0007000000023295-86.dat	upx
behavioral2/files/0x0007000000023293-76.dat	upx
behavioral2/files/0x0007000000023291-66.dat	upx
behavioral2/files/0x0007000000023296-91.dat	upx
behavioral2/files/0x0007000000023298-101.dat	upx
behavioral2/files/0x0007000000023299-106.dat	upx
behavioral2/files/0x000700000002329a-111.dat	upx
behavioral2/files/0x000700000002329b-116.dat	upx
behavioral2/files/0x000700000002329d-126.dat	upx
behavioral2/files/0x000700000002329e-131.dat	upx
behavioral2/files/0x000700000002329f-138.dat	upx
behavioral2/files/0x00070000000232a0-144.dat	upx
behavioral2/files/0x00070000000232a2-154.dat	upx
behavioral2/files/0x00070000000232a5-169.dat	upx
behavioral2/files/0x00070000000232a7-175.dat	upx
behavioral2/files/0x00070000000232a8-183.dat	upx
behavioral2/files/0x00070000000232a6-173.dat	upx
behavioral2/files/0x00070000000232a4-164.dat	upx
behavioral2/memory/3636-338-0x00007FF7DDDE0000-0x00007FF7DE1D2000-memory.dmp	upx
behavioral2/memory/3692-346-0x00007FF6B53F0000-0x00007FF6B57E2000-memory.dmp	upx
behavioral2/memory/4756-352-0x00007FF6280D0000-0x00007FF6284C2000-memory.dmp	upx
behavioral2/memory/3228-354-0x00007FF786F60000-0x00007FF787352000-memory.dmp	upx
behavioral2/memory/2440-356-0x00007FF720420000-0x00007FF720812000-memory.dmp	upx
behavioral2/memory/4516-358-0x00007FF7A96A0000-0x00007FF7A9A92000-memory.dmp	upx
behavioral2/memory/1656-359-0x00007FF69BC70000-0x00007FF69C062000-memory.dmp	upx
behavioral2/memory/4076-361-0x00007FF7038C0000-0x00007FF703CB2000-memory.dmp	upx
behavioral2/memory/4380-363-0x00007FF6342E0000-0x00007FF6346D2000-memory.dmp	upx
behavioral2/memory/4744-366-0x00007FF72C6C0000-0x00007FF72CAB2000-memory.dmp	upx
behavioral2/memory/3656-377-0x00007FF6B37D0000-0x00007FF6B3BC2000-memory.dmp	upx
behavioral2/memory/3136-378-0x00007FF7A9A80000-0x00007FF7A9E72000-memory.dmp	upx
behavioral2/memory/4092-382-0x00007FF6009C0000-0x00007FF600DB2000-memory.dmp	upx
behavioral2/memory/64-381-0x00007FF6BBB60000-0x00007FF6BBF52000-memory.dmp	upx
behavioral2/memory/920-372-0x00007FF6A6B20000-0x00007FF6A6F12000-memory.dmp	upx
behavioral2/memory/3312-369-0x00007FF772BE0000-0x00007FF772FD2000-memory.dmp	upx
behavioral2/memory/4868-351-0x00007FF6606C0000-0x00007FF660AB2000-memory.dmp	upx
behavioral2/memory/2244-335-0x00007FF6885C0000-0x00007FF6889B2000-memory.dmp	upx
behavioral2/files/0x00070000000232a3-159.dat	upx
behavioral2/files/0x00070000000232a1-146.dat	upx
behavioral2/files/0x000700000002329c-121.dat	upx
behavioral2/files/0x0007000000023297-96.dat	upx
behavioral2/memory/3616-49-0x00007FF64D230000-0x00007FF64D622000-memory.dmp	upx
behavioral2/memory/3792-1789-0x00007FF7F9630000-0x00007FF7F9A22000-memory.dmp	upx
behavioral2/memory/3616-1883-0x00007FF64D230000-0x00007FF64D622000-memory.dmp	upx
behavioral2/memory/2440-2014-0x00007FF720420000-0x00007FF720812000-memory.dmp	upx
behavioral2/memory/3692-2032-0x00007FF6B53F0000-0x00007FF6B57E2000-memory.dmp	upx
behavioral2/memory/3228-2011-0x00007FF786F60000-0x00007FF787352000-memory.dmp	upx
behavioral2/memory/4744-2147-0x00007FF72C6C0000-0x00007FF72CAB2000-memory.dmp	upx
behavioral2/memory/1656-2154-0x00007FF69BC70000-0x00007FF69C062000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
11	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\DpZzqnL.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\BmmjhzV.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\KEVBElL.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\lVYtECZ.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\BryyKWl.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\NcgsRDw.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\zPZQaZg.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\WZOfHAL.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\ZQCCfCm.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\faqaYYt.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\sBcgXbo.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\GbMfFnB.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\JuMbFLw.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\pmYFaeL.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\ActUPWu.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\kcIuasp.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\TjLOoqu.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\OZmSLec.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\SwLJpxQ.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\bkgxcXw.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\PwOdsDR.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\mWemaWl.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\SdUEdxZ.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\PqSpAbS.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\gcmLuoS.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\pWnoKzU.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\GZDNvko.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\ZsNSwvL.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\uYRPpxj.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\PNIXvFT.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\pALZWuG.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\GBAapMV.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\AeYPMqP.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\FsOCAAT.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\eDUWVuZ.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\FcVVghv.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\dOWJSsC.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\vWKJHtD.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\YAmRTOx.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\cybdXWg.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\qjyuMkt.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\mMwbBtQ.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\xLRTRqf.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\xTRhXfX.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\GyAEvrB.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\dqWekyC.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\svdgGIy.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\NEcluqI.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\CXMfGmx.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\tYWaWoY.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\mCmjgHk.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\NmNSGvR.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\PpOYqGL.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\EXRIqBL.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\FfkKesB.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\RfMeahz.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\troNvdb.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\QqVCopM.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\AsCQwGN.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\dgpVQeA.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\xkuGEGE.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\qlprppc.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\mAUJILk.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\yIrnHpf.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2548	powershell.exe
2548	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	powershell.exe
Token: SeLockMemoryPrivilege	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1432 wrote to memory of 2548	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	92
PID 1432 wrote to memory of 2548	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	92
PID 1432 wrote to memory of 3792	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	93
PID 1432 wrote to memory of 3792	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	93
PID 1432 wrote to memory of 3616	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	94
PID 1432 wrote to memory of 3616	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	94
PID 1432 wrote to memory of 4740	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	95
PID 1432 wrote to memory of 4740	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	95
PID 1432 wrote to memory of 4460	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	96
PID 1432 wrote to memory of 4460	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	96
PID 1432 wrote to memory of 1712	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	97
PID 1432 wrote to memory of 1712	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	97
PID 1432 wrote to memory of 3412	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	98
PID 1432 wrote to memory of 3412	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	98
PID 1432 wrote to memory of 2244	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	99
PID 1432 wrote to memory of 2244	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	99
PID 1432 wrote to memory of 3636	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	100
PID 1432 wrote to memory of 3636	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	100
PID 1432 wrote to memory of 3692	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	101
PID 1432 wrote to memory of 3692	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	101
PID 1432 wrote to memory of 4868	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	102
PID 1432 wrote to memory of 4868	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	102
PID 1432 wrote to memory of 4756	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	103
PID 1432 wrote to memory of 4756	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	103
PID 1432 wrote to memory of 3228	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	104
PID 1432 wrote to memory of 3228	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	104
PID 1432 wrote to memory of 2440	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	105
PID 1432 wrote to memory of 2440	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	105
PID 1432 wrote to memory of 4516	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	106
PID 1432 wrote to memory of 4516	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	106
PID 1432 wrote to memory of 1656	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	107
PID 1432 wrote to memory of 1656	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	107
PID 1432 wrote to memory of 4076	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	108
PID 1432 wrote to memory of 4076	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	108
PID 1432 wrote to memory of 4380	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	109
PID 1432 wrote to memory of 4380	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	109
PID 1432 wrote to memory of 4744	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	110
PID 1432 wrote to memory of 4744	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	110
PID 1432 wrote to memory of 3312	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	111
PID 1432 wrote to memory of 3312	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	111
PID 1432 wrote to memory of 920	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	112
PID 1432 wrote to memory of 920	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	112
PID 1432 wrote to memory of 3656	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	113
PID 1432 wrote to memory of 3656	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	113
PID 1432 wrote to memory of 3136	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	114
PID 1432 wrote to memory of 3136	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	114
PID 1432 wrote to memory of 64	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	115
PID 1432 wrote to memory of 64	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	115
PID 1432 wrote to memory of 4092	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	116
PID 1432 wrote to memory of 4092	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	116
PID 1432 wrote to memory of 3232	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	117
PID 1432 wrote to memory of 3232	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	117
PID 1432 wrote to memory of 3548	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	118
PID 1432 wrote to memory of 3548	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	118
PID 1432 wrote to memory of 2528	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	119
PID 1432 wrote to memory of 2528	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	119
PID 1432 wrote to memory of 3120	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	120
PID 1432 wrote to memory of 3120	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	120
PID 1432 wrote to memory of 4352	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	121
PID 1432 wrote to memory of 4352	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	121
PID 1432 wrote to memory of 2872	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	122
PID 1432 wrote to memory of 2872	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	122
PID 1432 wrote to memory of 1324	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	123
PID 1432 wrote to memory of 1324	1432	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	123

C:\Users\Admin\AppData\Local\Temp\141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2548
- C:\Windows\System\QFyTeDw.exe
  C:\Windows\System\QFyTeDw.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System\gEHsOLs.exe
  C:\Windows\System\gEHsOLs.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\mPzcdEZ.exe
  C:\Windows\System\mPzcdEZ.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\kdYJfqV.exe
  C:\Windows\System\kdYJfqV.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\FEVzcqd.exe
  C:\Windows\System\FEVzcqd.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\uhuDHin.exe
  C:\Windows\System\uhuDHin.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\WnBvWTX.exe
  C:\Windows\System\WnBvWTX.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\lmYBdJJ.exe
  C:\Windows\System\lmYBdJJ.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\IaunLLk.exe
  C:\Windows\System\IaunLLk.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\svdgGIy.exe
  C:\Windows\System\svdgGIy.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\yswzLtg.exe
  C:\Windows\System\yswzLtg.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\jLLSNYY.exe
  C:\Windows\System\jLLSNYY.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\IUbPDPK.exe
  C:\Windows\System\IUbPDPK.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\rwrhetH.exe
  C:\Windows\System\rwrhetH.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\soNHgUI.exe
  C:\Windows\System\soNHgUI.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\YDHfIZv.exe
  C:\Windows\System\YDHfIZv.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\AYasIPq.exe
  C:\Windows\System\AYasIPq.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\bRhODwf.exe
  C:\Windows\System\bRhODwf.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\JHiOdYH.exe
  C:\Windows\System\JHiOdYH.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\JZcVXzc.exe
  C:\Windows\System\JZcVXzc.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\VWCwUDh.exe
  C:\Windows\System\VWCwUDh.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\qNdYAxF.exe
  C:\Windows\System\qNdYAxF.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\FENvdog.exe
  C:\Windows\System\FENvdog.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\AAaPEqb.exe
  C:\Windows\System\AAaPEqb.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\uYbLoWP.exe
  C:\Windows\System\uYbLoWP.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\qHIChRX.exe
  C:\Windows\System\qHIChRX.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\zTsSmIV.exe
  C:\Windows\System\zTsSmIV.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\MtqpsRM.exe
  C:\Windows\System\MtqpsRM.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\QQpJfFq.exe
  C:\Windows\System\QQpJfFq.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\ANvuexr.exe
  C:\Windows\System\ANvuexr.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\hbiIxfB.exe
  C:\Windows\System\hbiIxfB.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\BxRwKdh.exe
  C:\Windows\System\BxRwKdh.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\EoBPPHs.exe
  C:\Windows\System\EoBPPHs.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\vQrSHoS.exe
  C:\Windows\System\vQrSHoS.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\EkfsOOX.exe
  C:\Windows\System\EkfsOOX.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\VwkifNx.exe
  C:\Windows\System\VwkifNx.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\UfDFday.exe
  C:\Windows\System\UfDFday.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\BwVUoXy.exe
  C:\Windows\System\BwVUoXy.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\vszauvT.exe
  C:\Windows\System\vszauvT.exe
  2⤵
  - Executes dropped EXE
  PID:3400
- C:\Windows\System\IAwDUiP.exe
  C:\Windows\System\IAwDUiP.exe
  2⤵
  - Executes dropped EXE
  PID:792
- C:\Windows\System\NSEnfFc.exe
  C:\Windows\System\NSEnfFc.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\CxFkwZJ.exe
  C:\Windows\System\CxFkwZJ.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\qfRlsuj.exe
  C:\Windows\System\qfRlsuj.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\UDnKDsF.exe
  C:\Windows\System\UDnKDsF.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\kpbeiab.exe
  C:\Windows\System\kpbeiab.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\GCBnvFp.exe
  C:\Windows\System\GCBnvFp.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\EnxcNzp.exe
  C:\Windows\System\EnxcNzp.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\iEVOHqU.exe
  C:\Windows\System\iEVOHqU.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\BLBfOYu.exe
  C:\Windows\System\BLBfOYu.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\bdtyDyg.exe
  C:\Windows\System\bdtyDyg.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\pWnoKzU.exe
  C:\Windows\System\pWnoKzU.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\nEknFfU.exe
  C:\Windows\System\nEknFfU.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\dHKuLdo.exe
  C:\Windows\System\dHKuLdo.exe
  2⤵
  - Executes dropped EXE
  PID:5124
- C:\Windows\System\NEcluqI.exe
  C:\Windows\System\NEcluqI.exe
  2⤵
  - Executes dropped EXE
  PID:5152
- C:\Windows\System\rqwMfmz.exe
  C:\Windows\System\rqwMfmz.exe
  2⤵
  - Executes dropped EXE
  PID:5180
- C:\Windows\System\gaaDOzQ.exe
  C:\Windows\System\gaaDOzQ.exe
  2⤵
  - Executes dropped EXE
  PID:5212
- C:\Windows\System\KpYmMwR.exe
  C:\Windows\System\KpYmMwR.exe
  2⤵
  - Executes dropped EXE
  PID:5228
- C:\Windows\System\gGuwbbv.exe
  C:\Windows\System\gGuwbbv.exe
  2⤵
  - Executes dropped EXE
  PID:5252
- C:\Windows\System\TjLOoqu.exe
  C:\Windows\System\TjLOoqu.exe
  2⤵
  - Executes dropped EXE
  PID:5288
- C:\Windows\System\PFIhixq.exe
  C:\Windows\System\PFIhixq.exe
  2⤵
  - Executes dropped EXE
  PID:5324
- C:\Windows\System\xawlNpW.exe
  C:\Windows\System\xawlNpW.exe
  2⤵
  - Executes dropped EXE
  PID:5352
- C:\Windows\System\ItfWkYh.exe
  C:\Windows\System\ItfWkYh.exe
  2⤵
  - Executes dropped EXE
  PID:5380
- C:\Windows\System\ROusDya.exe
  C:\Windows\System\ROusDya.exe
  2⤵
  - Executes dropped EXE
  PID:5408
- C:\Windows\System\AHGJoQw.exe
  C:\Windows\System\AHGJoQw.exe
  2⤵
  - Executes dropped EXE
  PID:5436
- C:\Windows\System\uolyTIt.exe
  C:\Windows\System\uolyTIt.exe
  2⤵
  PID:5464
- C:\Windows\System\NaXFLQu.exe
  C:\Windows\System\NaXFLQu.exe
  2⤵
  PID:5492
- C:\Windows\System\tMsEmde.exe
  C:\Windows\System\tMsEmde.exe
  2⤵
  PID:5516
- C:\Windows\System\zzRNyVJ.exe
  C:\Windows\System\zzRNyVJ.exe
  2⤵
  PID:5548
- C:\Windows\System\eDfgcjo.exe
  C:\Windows\System\eDfgcjo.exe
  2⤵
  PID:5564
- C:\Windows\System\NJmxBdW.exe
  C:\Windows\System\NJmxBdW.exe
  2⤵
  PID:5596
- C:\Windows\System\APpMVXq.exe
  C:\Windows\System\APpMVXq.exe
  2⤵
  PID:5620
- C:\Windows\System\pSHgIKU.exe
  C:\Windows\System\pSHgIKU.exe
  2⤵
  PID:5644
- C:\Windows\System\ddtnsMV.exe
  C:\Windows\System\ddtnsMV.exe
  2⤵
  PID:5664
- C:\Windows\System\lmWRAxc.exe
  C:\Windows\System\lmWRAxc.exe
  2⤵
  PID:5688
- C:\Windows\System\oKNPqQI.exe
  C:\Windows\System\oKNPqQI.exe
  2⤵
  PID:5732
- C:\Windows\System\hvEpcQc.exe
  C:\Windows\System\hvEpcQc.exe
  2⤵
  PID:5756
- C:\Windows\System\cUPZcMH.exe
  C:\Windows\System\cUPZcMH.exe
  2⤵
  PID:5788
- C:\Windows\System\EmiPAHp.exe
  C:\Windows\System\EmiPAHp.exe
  2⤵
  PID:5816
- C:\Windows\System\XmYvwFp.exe
  C:\Windows\System\XmYvwFp.exe
  2⤵
  PID:5836
- C:\Windows\System\RDEZNqo.exe
  C:\Windows\System\RDEZNqo.exe
  2⤵
  PID:5852
- C:\Windows\System\xdnTxHk.exe
  C:\Windows\System\xdnTxHk.exe
  2⤵
  PID:5880
- C:\Windows\System\dBONvYh.exe
  C:\Windows\System\dBONvYh.exe
  2⤵
  PID:5972
- C:\Windows\System\rwiNHOx.exe
  C:\Windows\System\rwiNHOx.exe
  2⤵
  PID:5992
- C:\Windows\System\prYMZuH.exe
  C:\Windows\System\prYMZuH.exe
  2⤵
  PID:6024
- C:\Windows\System\RfMeahz.exe
  C:\Windows\System\RfMeahz.exe
  2⤵
  PID:3976
- C:\Windows\System\bWfHfjh.exe
  C:\Windows\System\bWfHfjh.exe
  2⤵
  PID:2184
- C:\Windows\System\KfVWxjo.exe
  C:\Windows\System\KfVWxjo.exe
  2⤵
  PID:3740
- C:\Windows\System\EKSseeS.exe
  C:\Windows\System\EKSseeS.exe
  2⤵
  PID:2004
- C:\Windows\System\audhuDi.exe
  C:\Windows\System\audhuDi.exe
  2⤵
  PID:5248
- C:\Windows\System\BdqBTtF.exe
  C:\Windows\System\BdqBTtF.exe
  2⤵
  PID:5280
- C:\Windows\System\cRGZZXd.exe
  C:\Windows\System\cRGZZXd.exe
  2⤵
  PID:5332
- C:\Windows\System\NXmaUId.exe
  C:\Windows\System\NXmaUId.exe
  2⤵
  PID:5392
- C:\Windows\System\cDuQalK.exe
  C:\Windows\System\cDuQalK.exe
  2⤵
  PID:5472
- C:\Windows\System\EafCxjC.exe
  C:\Windows\System\EafCxjC.exe
  2⤵
  PID:5512
- C:\Windows\System\CiABKfH.exe
  C:\Windows\System\CiABKfH.exe
  2⤵
  PID:5556
- C:\Windows\System\qiGSiQc.exe
  C:\Windows\System\qiGSiQc.exe
  2⤵
  PID:5588
- C:\Windows\System\hlmeqLJ.exe
  C:\Windows\System\hlmeqLJ.exe
  2⤵
  PID:5616
- C:\Windows\System\bqLwgFh.exe
  C:\Windows\System\bqLwgFh.exe
  2⤵
  PID:608
- C:\Windows\System\mAUJILk.exe
  C:\Windows\System\mAUJILk.exe
  2⤵
  PID:5676
- C:\Windows\System\PojrVul.exe
  C:\Windows\System\PojrVul.exe
  2⤵
  PID:636
- C:\Windows\System\mgWCokz.exe
  C:\Windows\System\mgWCokz.exe
  2⤵
  PID:4892
- C:\Windows\System\qyQStsp.exe
  C:\Windows\System\qyQStsp.exe
  2⤵
  PID:5764
- C:\Windows\System\xLgxmHI.exe
  C:\Windows\System\xLgxmHI.exe
  2⤵
  PID:5780
- C:\Windows\System\WnYbLTH.exe
  C:\Windows\System\WnYbLTH.exe
  2⤵
  PID:3368
- C:\Windows\System\LRphtyH.exe
  C:\Windows\System\LRphtyH.exe
  2⤵
  PID:4324
- C:\Windows\System\ApnMHPm.exe
  C:\Windows\System\ApnMHPm.exe
  2⤵
  PID:6032
- C:\Windows\System\RSPVtDx.exe
  C:\Windows\System\RSPVtDx.exe
  2⤵
  PID:4752
- C:\Windows\System\GXlvrxe.exe
  C:\Windows\System\GXlvrxe.exe
  2⤵
  PID:4500
- C:\Windows\System\vAXcLDs.exe
  C:\Windows\System\vAXcLDs.exe
  2⤵
  PID:4328
- C:\Windows\System\flyENzd.exe
  C:\Windows\System\flyENzd.exe
  2⤵
  PID:5040
- C:\Windows\System\ZDfEpfC.exe
  C:\Windows\System\ZDfEpfC.exe
  2⤵
  PID:5192
- C:\Windows\System\YkfbzZH.exe
  C:\Windows\System\YkfbzZH.exe
  2⤵
  PID:5428
- C:\Windows\System\bitnmWA.exe
  C:\Windows\System\bitnmWA.exe
  2⤵
  PID:800
- C:\Windows\System\MdxKSRj.exe
  C:\Windows\System\MdxKSRj.exe
  2⤵
  PID:5632
- C:\Windows\System\yqmxJly.exe
  C:\Windows\System\yqmxJly.exe
  2⤵
  PID:2408
- C:\Windows\System\FQQHjkH.exe
  C:\Windows\System\FQQHjkH.exe
  2⤵
  PID:5680
- C:\Windows\System\PBtoANc.exe
  C:\Windows\System\PBtoANc.exe
  2⤵
  PID:5796
- C:\Windows\System\QcxUsOA.exe
  C:\Windows\System\QcxUsOA.exe
  2⤵
  PID:6020
- C:\Windows\System\MRcxkWW.exe
  C:\Windows\System\MRcxkWW.exe
  2⤵
  PID:6108
- C:\Windows\System\HYOpAnD.exe
  C:\Windows\System\HYOpAnD.exe
  2⤵
  PID:5196
- C:\Windows\System\OiPTnCm.exe
  C:\Windows\System\OiPTnCm.exe
  2⤵
  PID:2088
- C:\Windows\System\AMdeDpA.exe
  C:\Windows\System\AMdeDpA.exe
  2⤵
  PID:5728
- C:\Windows\System\NGjNBqI.exe
  C:\Windows\System\NGjNBqI.exe
  2⤵
  PID:5772
- C:\Windows\System\wvBITJV.exe
  C:\Windows\System\wvBITJV.exe
  2⤵
  PID:2768
- C:\Windows\System\QPRCYJj.exe
  C:\Windows\System\QPRCYJj.exe
  2⤵
  PID:448
- C:\Windows\System\MXvhgab.exe
  C:\Windows\System\MXvhgab.exe
  2⤵
  PID:5544
- C:\Windows\System\MHfNsBb.exe
  C:\Windows\System\MHfNsBb.exe
  2⤵
  PID:5864
- C:\Windows\System\GZdTBdR.exe
  C:\Windows\System\GZdTBdR.exe
  2⤵
  PID:6160
- C:\Windows\System\RvgxZbF.exe
  C:\Windows\System\RvgxZbF.exe
  2⤵
  PID:6196
- C:\Windows\System\sWOBPQC.exe
  C:\Windows\System\sWOBPQC.exe
  2⤵
  PID:6248
- C:\Windows\System\uWcKASk.exe
  C:\Windows\System\uWcKASk.exe
  2⤵
  PID:6272
- C:\Windows\System\bZeJQRs.exe
  C:\Windows\System\bZeJQRs.exe
  2⤵
  PID:6308
- C:\Windows\System\NcgsRDw.exe
  C:\Windows\System\NcgsRDw.exe
  2⤵
  PID:6348
- C:\Windows\System\EUPjpxo.exe
  C:\Windows\System\EUPjpxo.exe
  2⤵
  PID:6380
- C:\Windows\System\SXzxFzI.exe
  C:\Windows\System\SXzxFzI.exe
  2⤵
  PID:6404
- C:\Windows\System\uzahzfR.exe
  C:\Windows\System\uzahzfR.exe
  2⤵
  PID:6436
- C:\Windows\System\aQOsyzG.exe
  C:\Windows\System\aQOsyzG.exe
  2⤵
  PID:6456
- C:\Windows\System\IyBcehL.exe
  C:\Windows\System\IyBcehL.exe
  2⤵
  PID:6472
- C:\Windows\System\JCMSsbE.exe
  C:\Windows\System\JCMSsbE.exe
  2⤵
  PID:6500
- C:\Windows\System\zmecVqq.exe
  C:\Windows\System\zmecVqq.exe
  2⤵
  PID:6524
- C:\Windows\System\xNfhslB.exe
  C:\Windows\System\xNfhslB.exe
  2⤵
  PID:6540
- C:\Windows\System\NpvqfWS.exe
  C:\Windows\System\NpvqfWS.exe
  2⤵
  PID:6560
- C:\Windows\System\uztITox.exe
  C:\Windows\System\uztITox.exe
  2⤵
  PID:6576
- C:\Windows\System\YoESfjh.exe
  C:\Windows\System\YoESfjh.exe
  2⤵
  PID:6600
- C:\Windows\System\lSlwZUV.exe
  C:\Windows\System\lSlwZUV.exe
  2⤵
  PID:6628
- C:\Windows\System\lseSCOE.exe
  C:\Windows\System\lseSCOE.exe
  2⤵
  PID:6648
- C:\Windows\System\nHULWYc.exe
  C:\Windows\System\nHULWYc.exe
  2⤵
  PID:6664
- C:\Windows\System\xBmExmk.exe
  C:\Windows\System\xBmExmk.exe
  2⤵
  PID:6684
- C:\Windows\System\MGsThfN.exe
  C:\Windows\System\MGsThfN.exe
  2⤵
  PID:6708
- C:\Windows\System\ownbDOw.exe
  C:\Windows\System\ownbDOw.exe
  2⤵
  PID:6768
- C:\Windows\System\EtaRrTE.exe
  C:\Windows\System\EtaRrTE.exe
  2⤵
  PID:6792
- C:\Windows\System\dmFjgWu.exe
  C:\Windows\System\dmFjgWu.exe
  2⤵
  PID:6816
- C:\Windows\System\zPZQaZg.exe
  C:\Windows\System\zPZQaZg.exe
  2⤵
  PID:6836
- C:\Windows\System\VkjrcFI.exe
  C:\Windows\System\VkjrcFI.exe
  2⤵
  PID:6868
- C:\Windows\System\uVQPTty.exe
  C:\Windows\System\uVQPTty.exe
  2⤵
  PID:6896
- C:\Windows\System\OZToHde.exe
  C:\Windows\System\OZToHde.exe
  2⤵
  PID:6916
- C:\Windows\System\KXOiegE.exe
  C:\Windows\System\KXOiegE.exe
  2⤵
  PID:6940
- C:\Windows\System\kvjzNaR.exe
  C:\Windows\System\kvjzNaR.exe
  2⤵
  PID:6964
- C:\Windows\System\HZrmFsk.exe
  C:\Windows\System\HZrmFsk.exe
  2⤵
  PID:6984
- C:\Windows\System\Ysakuyg.exe
  C:\Windows\System\Ysakuyg.exe
  2⤵
  PID:7008
- C:\Windows\System\SyghwcB.exe
  C:\Windows\System\SyghwcB.exe
  2⤵
  PID:7024
- C:\Windows\System\dsSdkQB.exe
  C:\Windows\System\dsSdkQB.exe
  2⤵
  PID:7052
- C:\Windows\System\KKjkucu.exe
  C:\Windows\System\KKjkucu.exe
  2⤵
  PID:7076
- C:\Windows\System\xUjAaNX.exe
  C:\Windows\System\xUjAaNX.exe
  2⤵
  PID:7092
- C:\Windows\System\GqRxDme.exe
  C:\Windows\System\GqRxDme.exe
  2⤵
  PID:7112
- C:\Windows\System\bbfIVMS.exe
  C:\Windows\System\bbfIVMS.exe
  2⤵
  PID:7132
- C:\Windows\System\DPCIDID.exe
  C:\Windows\System\DPCIDID.exe
  2⤵
  PID:7156
- C:\Windows\System\TTCmyYo.exe
  C:\Windows\System\TTCmyYo.exe
  2⤵
  PID:5920
- C:\Windows\System\AsCQwGN.exe
  C:\Windows\System\AsCQwGN.exe
  2⤵
  PID:5964
- C:\Windows\System\QNISXpr.exe
  C:\Windows\System\QNISXpr.exe
  2⤵
  PID:6156
- C:\Windows\System\LDgklvh.exe
  C:\Windows\System\LDgklvh.exe
  2⤵
  PID:5948
- C:\Windows\System\smMwFbq.exe
  C:\Windows\System\smMwFbq.exe
  2⤵
  PID:6264
- C:\Windows\System\EMKaYkn.exe
  C:\Windows\System\EMKaYkn.exe
  2⤵
  PID:6212
- C:\Windows\System\dzXFVss.exe
  C:\Windows\System\dzXFVss.exe
  2⤵
  PID:6336
- C:\Windows\System\uqWlDkS.exe
  C:\Windows\System\uqWlDkS.exe
  2⤵
  PID:6064
- C:\Windows\System\oGNzqTP.exe
  C:\Windows\System\oGNzqTP.exe
  2⤵
  PID:6372
- C:\Windows\System\mhdbQKV.exe
  C:\Windows\System\mhdbQKV.exe
  2⤵
  PID:6428
- C:\Windows\System\TqxZqwy.exe
  C:\Windows\System\TqxZqwy.exe
  2⤵
  PID:6492
- C:\Windows\System\pANAQvu.exe
  C:\Windows\System\pANAQvu.exe
  2⤵
  PID:6572
- C:\Windows\System\XEsXqMU.exe
  C:\Windows\System\XEsXqMU.exe
  2⤵
  PID:6640
- C:\Windows\System\SdUEdxZ.exe
  C:\Windows\System\SdUEdxZ.exe
  2⤵
  PID:6620
- C:\Windows\System\svrMMwS.exe
  C:\Windows\System\svrMMwS.exe
  2⤵
  PID:6784
- C:\Windows\System\mnOSXnv.exe
  C:\Windows\System\mnOSXnv.exe
  2⤵
  PID:6704
- C:\Windows\System\AKxKKnI.exe
  C:\Windows\System\AKxKKnI.exe
  2⤵
  PID:6936
- C:\Windows\System\jEgAAsO.exe
  C:\Windows\System\jEgAAsO.exe
  2⤵
  PID:6848
- C:\Windows\System\VEckLLB.exe
  C:\Windows\System\VEckLLB.exe
  2⤵
  PID:6880
- C:\Windows\System\EmOONnT.exe
  C:\Windows\System\EmOONnT.exe
  2⤵
  PID:6912
- C:\Windows\System\aZXQzvD.exe
  C:\Windows\System\aZXQzvD.exe
  2⤵
  PID:6776
- C:\Windows\System\hqhJwUF.exe
  C:\Windows\System\hqhJwUF.exe
  2⤵
  PID:6828
- C:\Windows\System\kfrMqWz.exe
  C:\Windows\System\kfrMqWz.exe
  2⤵
  PID:6956
- C:\Windows\System\PwoUmdc.exe
  C:\Windows\System\PwoUmdc.exe
  2⤵
  PID:5308
- C:\Windows\System\RAGwnJg.exe
  C:\Windows\System\RAGwnJg.exe
  2⤵
  PID:912
- C:\Windows\System\jNdFGfp.exe
  C:\Windows\System\jNdFGfp.exe
  2⤵
  PID:6316
- C:\Windows\System\ikVvIHf.exe
  C:\Windows\System\ikVvIHf.exe
  2⤵
  PID:7104
- C:\Windows\System\ijjHOPr.exe
  C:\Windows\System\ijjHOPr.exe
  2⤵
  PID:7180
- C:\Windows\System\bzpeMPq.exe
  C:\Windows\System\bzpeMPq.exe
  2⤵
  PID:7200
- C:\Windows\System\eHgeGnt.exe
  C:\Windows\System\eHgeGnt.exe
  2⤵
  PID:7220
- C:\Windows\System\UrxqIfp.exe
  C:\Windows\System\UrxqIfp.exe
  2⤵
  PID:7236
- C:\Windows\System\ICmDcet.exe
  C:\Windows\System\ICmDcet.exe
  2⤵
  PID:7256
- C:\Windows\System\ZvkSaQb.exe
  C:\Windows\System\ZvkSaQb.exe
  2⤵
  PID:7280
- C:\Windows\System\YCQhXHF.exe
  C:\Windows\System\YCQhXHF.exe
  2⤵
  PID:7300
- C:\Windows\System\RwYWgRr.exe
  C:\Windows\System\RwYWgRr.exe
  2⤵
  PID:7316
- C:\Windows\System\UUvgLNe.exe
  C:\Windows\System\UUvgLNe.exe
  2⤵
  PID:7340
- C:\Windows\System\tpJwAJM.exe
  C:\Windows\System\tpJwAJM.exe
  2⤵
  PID:7356
- C:\Windows\System\tFZjdpo.exe
  C:\Windows\System\tFZjdpo.exe
  2⤵
  PID:7380
- C:\Windows\System\mOZZIPu.exe
  C:\Windows\System\mOZZIPu.exe
  2⤵
  PID:7408
- C:\Windows\System\xEqBkwg.exe
  C:\Windows\System\xEqBkwg.exe
  2⤵
  PID:7428
- C:\Windows\System\ZKLddPE.exe
  C:\Windows\System\ZKLddPE.exe
  2⤵
  PID:7452
- C:\Windows\System\OiYxqjK.exe
  C:\Windows\System\OiYxqjK.exe
  2⤵
  PID:7476
- C:\Windows\System\ikJuOls.exe
  C:\Windows\System\ikJuOls.exe
  2⤵
  PID:7504
- C:\Windows\System\gIGPxpE.exe
  C:\Windows\System\gIGPxpE.exe
  2⤵
  PID:7524
- C:\Windows\System\peRkMQx.exe
  C:\Windows\System\peRkMQx.exe
  2⤵
  PID:7548
- C:\Windows\System\BmcOstB.exe
  C:\Windows\System\BmcOstB.exe
  2⤵
  PID:7564
- C:\Windows\System\OBjXSaq.exe
  C:\Windows\System\OBjXSaq.exe
  2⤵
  PID:7748
- C:\Windows\System\troNvdb.exe
  C:\Windows\System\troNvdb.exe
  2⤵
  PID:7776
- C:\Windows\System\pAwFSST.exe
  C:\Windows\System\pAwFSST.exe
  2⤵
  PID:7808
- C:\Windows\System\rQOTdFy.exe
  C:\Windows\System\rQOTdFy.exe
  2⤵
  PID:7832
- C:\Windows\System\whjwmts.exe
  C:\Windows\System\whjwmts.exe
  2⤵
  PID:7856
- C:\Windows\System\iSFrmTY.exe
  C:\Windows\System\iSFrmTY.exe
  2⤵
  PID:7880
- C:\Windows\System\zrFGAAp.exe
  C:\Windows\System\zrFGAAp.exe
  2⤵
  PID:7912
- C:\Windows\System\ucuumAu.exe
  C:\Windows\System\ucuumAu.exe
  2⤵
  PID:7932
- C:\Windows\System\sEggQWr.exe
  C:\Windows\System\sEggQWr.exe
  2⤵
  PID:7984
- C:\Windows\System\EIHNivQ.exe
  C:\Windows\System\EIHNivQ.exe
  2⤵
  PID:8008
- C:\Windows\System\MQRrNwV.exe
  C:\Windows\System\MQRrNwV.exe
  2⤵
  PID:8072
- C:\Windows\System\CuDNsXo.exe
  C:\Windows\System\CuDNsXo.exe
  2⤵
  PID:8092
- C:\Windows\System\eBkhNcO.exe
  C:\Windows\System\eBkhNcO.exe
  2⤵
  PID:8112
- C:\Windows\System\ZxeuIAi.exe
  C:\Windows\System\ZxeuIAi.exe
  2⤵
  PID:8136
- C:\Windows\System\TnspRmJ.exe
  C:\Windows\System\TnspRmJ.exe
  2⤵
  PID:8164
- C:\Windows\System\BFmnmQC.exe
  C:\Windows\System\BFmnmQC.exe
  2⤵
  PID:8184
- C:\Windows\System\pAsgmND.exe
  C:\Windows\System\pAsgmND.exe
  2⤵
  PID:6908
- C:\Windows\System\GGahjMq.exe
  C:\Windows\System\GGahjMq.exe
  2⤵
  PID:3744
- C:\Windows\System\tJPkFsm.exe
  C:\Windows\System\tJPkFsm.exe
  2⤵
  PID:6800
- C:\Windows\System\hecQOXS.exe
  C:\Windows\System\hecQOXS.exe
  2⤵
  PID:6452
- C:\Windows\System\LkALnfC.exe
  C:\Windows\System\LkALnfC.exe
  2⤵
  PID:7100
- C:\Windows\System\DKpBOPJ.exe
  C:\Windows\System\DKpBOPJ.exe
  2⤵
  PID:7276
- C:\Windows\System\fcjjaXN.exe
  C:\Windows\System\fcjjaXN.exe
  2⤵
  PID:5504
- C:\Windows\System\WiQZoQj.exe
  C:\Windows\System\WiQZoQj.exe
  2⤵
  PID:7800
- C:\Windows\System\aYyuMCB.exe
  C:\Windows\System\aYyuMCB.exe
  2⤵
  PID:7364
- C:\Windows\System\stGXSMd.exe
  C:\Windows\System\stGXSMd.exe
  2⤵
  PID:7444
- C:\Windows\System\aZmtOVc.exe
  C:\Windows\System\aZmtOVc.exe
  2⤵
  PID:7492
- C:\Windows\System\tPDlBTE.exe
  C:\Windows\System\tPDlBTE.exe
  2⤵
  PID:7532
- C:\Windows\System\wJQKeaC.exe
  C:\Windows\System\wJQKeaC.exe
  2⤵
  PID:7608
- C:\Windows\System\yoCmjof.exe
  C:\Windows\System\yoCmjof.exe
  2⤵
  PID:7668
- C:\Windows\System\dTSfHhZ.exe
  C:\Windows\System\dTSfHhZ.exe
  2⤵
  PID:8052
- C:\Windows\System\kGtGCoP.exe
  C:\Windows\System\kGtGCoP.exe
  2⤵
  PID:7816
- C:\Windows\System\HSSYqHH.exe
  C:\Windows\System\HSSYqHH.exe
  2⤵
  PID:7848
- C:\Windows\System\HNldgdg.exe
  C:\Windows\System\HNldgdg.exe
  2⤵
  PID:7824
- C:\Windows\System\XDzRAOB.exe
  C:\Windows\System\XDzRAOB.exe
  2⤵
  PID:7920
- C:\Windows\System\fJhlUtU.exe
  C:\Windows\System\fJhlUtU.exe
  2⤵
  PID:7324
- C:\Windows\System\luqHbAM.exe
  C:\Windows\System\luqHbAM.exe
  2⤵
  PID:8176
- C:\Windows\System\NxImefw.exe
  C:\Windows\System\NxImefw.exe
  2⤵
  PID:8020
- C:\Windows\System\DSCdJzk.exe
  C:\Windows\System\DSCdJzk.exe
  2⤵
  PID:8160
- C:\Windows\System\RucOUDs.exe
  C:\Windows\System\RucOUDs.exe
  2⤵
  PID:7308
- C:\Windows\System\pEFEanL.exe
  C:\Windows\System\pEFEanL.exe
  2⤵
  PID:6092
- C:\Windows\System\eRXuWCE.exe
  C:\Windows\System\eRXuWCE.exe
  2⤵
  PID:8208
- C:\Windows\System\WxDPFhf.exe
  C:\Windows\System\WxDPFhf.exe
  2⤵
  PID:8228
- C:\Windows\System\yHnSllD.exe
  C:\Windows\System\yHnSllD.exe
  2⤵
  PID:8244
- C:\Windows\System\BjmUdKp.exe
  C:\Windows\System\BjmUdKp.exe
  2⤵
  PID:8268
- C:\Windows\System\PttiYPT.exe
  C:\Windows\System\PttiYPT.exe
  2⤵
  PID:8288
- C:\Windows\System\fcxwWCP.exe
  C:\Windows\System\fcxwWCP.exe
  2⤵
  PID:8308
- C:\Windows\System\KgHzjyw.exe
  C:\Windows\System\KgHzjyw.exe
  2⤵
  PID:8328
- C:\Windows\System\zmkiIrh.exe
  C:\Windows\System\zmkiIrh.exe
  2⤵
  PID:8348
- C:\Windows\System\zFSRFWy.exe
  C:\Windows\System\zFSRFWy.exe
  2⤵
  PID:8368
- C:\Windows\System\fgoIBUe.exe
  C:\Windows\System\fgoIBUe.exe
  2⤵
  PID:8384
- C:\Windows\System\pYDDCNc.exe
  C:\Windows\System\pYDDCNc.exe
  2⤵
  PID:8400
- C:\Windows\System\dbJOSQo.exe
  C:\Windows\System\dbJOSQo.exe
  2⤵
  PID:8424
- C:\Windows\System\NYBtuXp.exe
  C:\Windows\System\NYBtuXp.exe
  2⤵
  PID:8444
- C:\Windows\System\krStemN.exe
  C:\Windows\System\krStemN.exe
  2⤵
  PID:8464
- C:\Windows\System\PFroSlc.exe
  C:\Windows\System\PFroSlc.exe
  2⤵
  PID:8484
- C:\Windows\System\gENVAON.exe
  C:\Windows\System\gENVAON.exe
  2⤵
  PID:8500
- C:\Windows\System\hdtDLev.exe
  C:\Windows\System\hdtDLev.exe
  2⤵
  PID:8524
- C:\Windows\System\AzGDTjj.exe
  C:\Windows\System\AzGDTjj.exe
  2⤵
  PID:8544
- C:\Windows\System\POVLhXF.exe
  C:\Windows\System\POVLhXF.exe
  2⤵
  PID:8568
- C:\Windows\System\maoZKjN.exe
  C:\Windows\System\maoZKjN.exe
  2⤵
  PID:8584
- C:\Windows\System\IXYTQiq.exe
  C:\Windows\System\IXYTQiq.exe
  2⤵
  PID:8612
- C:\Windows\System\lzdhsop.exe
  C:\Windows\System\lzdhsop.exe
  2⤵
  PID:8636
- C:\Windows\System\QQjILiN.exe
  C:\Windows\System\QQjILiN.exe
  2⤵
  PID:8652
- C:\Windows\System\bNBMLsn.exe
  C:\Windows\System\bNBMLsn.exe
  2⤵
  PID:8820
- C:\Windows\System\XVnuuMd.exe
  C:\Windows\System\XVnuuMd.exe
  2⤵
  PID:8964
- C:\Windows\System\DjmaQVJ.exe
  C:\Windows\System\DjmaQVJ.exe
  2⤵
  PID:8984
- C:\Windows\System\ANwjVOO.exe
  C:\Windows\System\ANwjVOO.exe
  2⤵
  PID:9004
- C:\Windows\System\FMPLgYq.exe
  C:\Windows\System\FMPLgYq.exe
  2⤵
  PID:9024
- C:\Windows\System\ZdULRhX.exe
  C:\Windows\System\ZdULRhX.exe
  2⤵
  PID:9176
- C:\Windows\System\dERcrEI.exe
  C:\Windows\System\dERcrEI.exe
  2⤵
  PID:7472
- C:\Windows\System\ZEMpJLu.exe
  C:\Windows\System\ZEMpJLu.exe
  2⤵
  PID:7520
- C:\Windows\System\xYDGGYd.exe
  C:\Windows\System\xYDGGYd.exe
  2⤵
  PID:7720
- C:\Windows\System\RbwwNvn.exe
  C:\Windows\System\RbwwNvn.exe
  2⤵
  PID:7516
- C:\Windows\System\nWEqRKD.exe
  C:\Windows\System\nWEqRKD.exe
  2⤵
  PID:7828
- C:\Windows\System\vOoymQK.exe
  C:\Windows\System\vOoymQK.exe
  2⤵
  PID:6424
- C:\Windows\System\MDdryXV.exe
  C:\Windows\System\MDdryXV.exe
  2⤵
  PID:8152
- C:\Windows\System\BuoXWkq.exe
  C:\Windows\System\BuoXWkq.exe
  2⤵
  PID:7416
- C:\Windows\System\JenPGga.exe
  C:\Windows\System\JenPGga.exe
  2⤵
  PID:8440
- C:\Windows\System\VfHIJlX.exe
  C:\Windows\System\VfHIJlX.exe
  2⤵
  PID:7372
- C:\Windows\System\KhSUanz.exe
  C:\Windows\System\KhSUanz.exe
  2⤵
  PID:7192
- C:\Windows\System\IYSdtBU.exe
  C:\Windows\System\IYSdtBU.exe
  2⤵
  PID:8224
- C:\Windows\System\SFEooou.exe
  C:\Windows\System\SFEooou.exe
  2⤵
  PID:8284
- C:\Windows\System\vDPoGiX.exe
  C:\Windows\System\vDPoGiX.exe
  2⤵
  PID:8340
- C:\Windows\System\DwjPfUe.exe
  C:\Windows\System\DwjPfUe.exe
  2⤵
  PID:7660
- C:\Windows\System\hOwBHPG.exe
  C:\Windows\System\hOwBHPG.exe
  2⤵
  PID:8392
- C:\Windows\System\pSgeBpk.exe
  C:\Windows\System\pSgeBpk.exe
  2⤵
  PID:8532
- C:\Windows\System\LuWoBgQ.exe
  C:\Windows\System\LuWoBgQ.exe
  2⤵
  PID:8688
- C:\Windows\System\vZGBRpq.exe
  C:\Windows\System\vZGBRpq.exe
  2⤵
  PID:8732
- C:\Windows\System\FfMBcgT.exe
  C:\Windows\System\FfMBcgT.exe
  2⤵
  PID:6116
- C:\Windows\System\immraby.exe
  C:\Windows\System\immraby.exe
  2⤵
  PID:8492
- C:\Windows\System\wRmDbGD.exe
  C:\Windows\System\wRmDbGD.exe
  2⤵
  PID:8540
- C:\Windows\System\TWWmaoA.exe
  C:\Windows\System\TWWmaoA.exe
  2⤵
  PID:8592
- C:\Windows\System\RNvKiZF.exe
  C:\Windows\System\RNvKiZF.exe
  2⤵
  PID:8624
- C:\Windows\System\rGERDnc.exe
  C:\Windows\System\rGERDnc.exe
  2⤵
  PID:8976
- C:\Windows\System\wMFPHLe.exe
  C:\Windows\System\wMFPHLe.exe
  2⤵
  PID:8740
- C:\Windows\System\TMGxugM.exe
  C:\Windows\System\TMGxugM.exe
  2⤵
  PID:8828
- C:\Windows\System\tbYMMmP.exe
  C:\Windows\System\tbYMMmP.exe
  2⤵
  PID:8892
- C:\Windows\System\cNgvqNo.exe
  C:\Windows\System\cNgvqNo.exe
  2⤵
  PID:9128
- C:\Windows\System\EpQglvn.exe
  C:\Windows\System\EpQglvn.exe
  2⤵
  PID:7392
- C:\Windows\System\jyXmPtg.exe
  C:\Windows\System\jyXmPtg.exe
  2⤵
  PID:8992
- C:\Windows\System\pkJdnWm.exe
  C:\Windows\System\pkJdnWm.exe
  2⤵
  PID:9168
- C:\Windows\System\QsyWNQk.exe
  C:\Windows\System\QsyWNQk.exe
  2⤵
  PID:9076
- C:\Windows\System\OZmSLec.exe
  C:\Windows\System\OZmSLec.exe
  2⤵
  PID:6760
- C:\Windows\System\VMcgYaZ.exe
  C:\Windows\System\VMcgYaZ.exe
  2⤵
  PID:6368
- C:\Windows\System\JRmCQWW.exe
  C:\Windows\System\JRmCQWW.exe
  2⤵
  PID:7460
- C:\Windows\System\SkTZTZw.exe
  C:\Windows\System\SkTZTZw.exe
  2⤵
  PID:6656
- C:\Windows\System\xxKTyxp.exe
  C:\Windows\System\xxKTyxp.exe
  2⤵
  PID:8148
- C:\Windows\System\Pczndxc.exe
  C:\Windows\System\Pczndxc.exe
  2⤵
  PID:9212
- C:\Windows\System\fRjtzDw.exe
  C:\Windows\System\fRjtzDw.exe
  2⤵
  PID:8536
- C:\Windows\System\HBmfqvk.exe
  C:\Windows\System\HBmfqvk.exe
  2⤵
  PID:8660
- C:\Windows\System\vaJDwNn.exe
  C:\Windows\System\vaJDwNn.exe
  2⤵
  PID:8960
- C:\Windows\System\jglOfVw.exe
  C:\Windows\System\jglOfVw.exe
  2⤵
  PID:9016
- C:\Windows\System\eInhAEV.exe
  C:\Windows\System\eInhAEV.exe
  2⤵
  PID:9224
- C:\Windows\System\KOxOkcm.exe
  C:\Windows\System\KOxOkcm.exe
  2⤵
  PID:9240
- C:\Windows\System\rZHivhe.exe
  C:\Windows\System\rZHivhe.exe
  2⤵
  PID:9268
- C:\Windows\System\OEaNYrj.exe
  C:\Windows\System\OEaNYrj.exe
  2⤵
  PID:9408
- C:\Windows\System\gxScpkx.exe
  C:\Windows\System\gxScpkx.exe
  2⤵
  PID:9532
- C:\Windows\System\WdDuORR.exe
  C:\Windows\System\WdDuORR.exe
  2⤵
  PID:9552
- C:\Windows\System\TAkYXJN.exe
  C:\Windows\System\TAkYXJN.exe
  2⤵
  PID:9588
- C:\Windows\System\lNtCifY.exe
  C:\Windows\System\lNtCifY.exe
  2⤵
  PID:9620
- C:\Windows\System\oxBNzGk.exe
  C:\Windows\System\oxBNzGk.exe
  2⤵
  PID:9636
- C:\Windows\System\RJAIVys.exe
  C:\Windows\System\RJAIVys.exe
  2⤵
  PID:9656
- C:\Windows\System\MqOpDdE.exe
  C:\Windows\System\MqOpDdE.exe
  2⤵
  PID:9680
- C:\Windows\System\UttGShH.exe
  C:\Windows\System\UttGShH.exe
  2⤵
  PID:9700
- C:\Windows\System\jTkEcjA.exe
  C:\Windows\System\jTkEcjA.exe
  2⤵
  PID:9720
- C:\Windows\System\VMfXnyZ.exe
  C:\Windows\System\VMfXnyZ.exe
  2⤵
  PID:9748
- C:\Windows\System\BblwSjT.exe
  C:\Windows\System\BblwSjT.exe
  2⤵
  PID:9772
- C:\Windows\System\ZarNLwb.exe
  C:\Windows\System\ZarNLwb.exe
  2⤵
  PID:9788
- C:\Windows\System\tSQLSFq.exe
  C:\Windows\System\tSQLSFq.exe
  2⤵
  PID:9816
- C:\Windows\System\woKhKTN.exe
  C:\Windows\System\woKhKTN.exe
  2⤵
  PID:10024
- C:\Windows\System\sBYssRK.exe
  C:\Windows\System\sBYssRK.exe
  2⤵
  PID:10192
- C:\Windows\System\YEKRbHs.exe
  C:\Windows\System\YEKRbHs.exe
  2⤵
  PID:8460
- C:\Windows\System\eybQcqc.exe
  C:\Windows\System\eybQcqc.exe
  2⤵
  PID:8868
- C:\Windows\System\SdGccae.exe
  C:\Windows\System\SdGccae.exe
  2⤵
  PID:8516
- C:\Windows\System\NlqqtBS.exe
  C:\Windows\System\NlqqtBS.exe
  2⤵
  PID:8644
- C:\Windows\System\FUuFBIV.exe
  C:\Windows\System\FUuFBIV.exe
  2⤵
  PID:8324
- C:\Windows\System\zdiMjFN.exe
  C:\Windows\System\zdiMjFN.exe
  2⤵
  PID:8304
- C:\Windows\System\ENVHJwi.exe
  C:\Windows\System\ENVHJwi.exe
  2⤵
  PID:9236
- C:\Windows\System\IWWAiTc.exe
  C:\Windows\System\IWWAiTc.exe
  2⤵
  PID:6124
- C:\Windows\System\lbhEfxM.exe
  C:\Windows\System\lbhEfxM.exe
  2⤵
  PID:9288
- C:\Windows\System\YlpDBvE.exe
  C:\Windows\System\YlpDBvE.exe
  2⤵
  PID:9452
- C:\Windows\System\bhuueEW.exe
  C:\Windows\System\bhuueEW.exe
  2⤵
  PID:7900
- C:\Windows\System\oZDrcCZ.exe
  C:\Windows\System\oZDrcCZ.exe
  2⤵
  PID:9404
- C:\Windows\System\AhVEAjO.exe
  C:\Windows\System\AhVEAjO.exe
  2⤵
  PID:9304
- C:\Windows\System\jzozJXN.exe
  C:\Windows\System\jzozJXN.exe
  2⤵
  PID:1108
- C:\Windows\System\VSbPIEy.exe
  C:\Windows\System\VSbPIEy.exe
  2⤵
  PID:9672
- C:\Windows\System\pxIhoGi.exe
  C:\Windows\System\pxIhoGi.exe
  2⤵
  PID:9472
- C:\Windows\System\mOidrpf.exe
  C:\Windows\System\mOidrpf.exe
  2⤵
  PID:9516
- C:\Windows\System\JYrPwWV.exe
  C:\Windows\System\JYrPwWV.exe
  2⤵
  PID:9584
- C:\Windows\System\AcGppId.exe
  C:\Windows\System\AcGppId.exe
  2⤵
  PID:9644
- C:\Windows\System\SjeROYq.exe
  C:\Windows\System\SjeROYq.exe
  2⤵
  PID:9832
- C:\Windows\System\haGErii.exe
  C:\Windows\System\haGErii.exe
  2⤵
  PID:10068
- C:\Windows\System\qFCscbE.exe
  C:\Windows\System\qFCscbE.exe
  2⤵
  PID:10144
- C:\Windows\System\Axmiywe.exe
  C:\Windows\System\Axmiywe.exe
  2⤵
  PID:6680
- C:\Windows\System\PqSpAbS.exe
  C:\Windows\System\PqSpAbS.exe
  2⤵
  PID:10208
- C:\Windows\System\YULQCSP.exe
  C:\Windows\System\YULQCSP.exe
  2⤵
  PID:624
- C:\Windows\System\SwLJpxQ.exe
  C:\Windows\System\SwLJpxQ.exe
  2⤵
  PID:10236
- C:\Windows\System\CVMflQv.exe
  C:\Windows\System\CVMflQv.exe
  2⤵
  PID:8620
- C:\Windows\System\yNxLluL.exe
  C:\Windows\System\yNxLluL.exe
  2⤵
  PID:4420
- C:\Windows\System\DWUXBfI.exe
  C:\Windows\System\DWUXBfI.exe
  2⤵
  PID:9440
- C:\Windows\System\qEZYpwm.exe
  C:\Windows\System\qEZYpwm.exe
  2⤵
  PID:8200
- C:\Windows\System\DlInREk.exe
  C:\Windows\System\DlInREk.exe
  2⤵
  PID:9300
- C:\Windows\System\JuMbFLw.exe
  C:\Windows\System\JuMbFLw.exe
  2⤵
  PID:9540
- C:\Windows\System\TjnnjmC.exe
  C:\Windows\System\TjnnjmC.exe
  2⤵
  PID:9548
- C:\Windows\System\zGOaIFN.exe
  C:\Windows\System\zGOaIFN.exe
  2⤵
  PID:9604
- C:\Windows\System\uETXQKk.exe
  C:\Windows\System\uETXQKk.exe
  2⤵
  PID:9736
- C:\Windows\System\eQXBDJl.exe
  C:\Windows\System\eQXBDJl.exe
  2⤵
  PID:10000
- C:\Windows\System\uIQpsSn.exe
  C:\Windows\System\uIQpsSn.exe
  2⤵
  PID:7560
- C:\Windows\System\xxXilOo.exe
  C:\Windows\System\xxXilOo.exe
  2⤵
  PID:8840
- C:\Windows\System\AgylloF.exe
  C:\Windows\System\AgylloF.exe
  2⤵
  PID:9420
- C:\Windows\System\QXyBJKq.exe
  C:\Windows\System\QXyBJKq.exe
  2⤵
  PID:10120
- C:\Windows\System\evbtCgQ.exe
  C:\Windows\System\evbtCgQ.exe
  2⤵
  PID:10268
- C:\Windows\System\YqPRpKq.exe
  C:\Windows\System\YqPRpKq.exe
  2⤵
  PID:10284
- C:\Windows\System\INUGQen.exe
  C:\Windows\System\INUGQen.exe
  2⤵
  PID:10304
- C:\Windows\System\LSbmZYc.exe
  C:\Windows\System\LSbmZYc.exe
  2⤵
  PID:10404
- C:\Windows\System\nOmrAYn.exe
  C:\Windows\System\nOmrAYn.exe
  2⤵
  PID:10428
- C:\Windows\System\wuBMVPr.exe
  C:\Windows\System\wuBMVPr.exe
  2⤵
  PID:10484
- C:\Windows\System\QKEmbPX.exe
  C:\Windows\System\QKEmbPX.exe
  2⤵
  PID:10544
- C:\Windows\System\pmYFaeL.exe
  C:\Windows\System\pmYFaeL.exe
  2⤵
  PID:10580
- C:\Windows\System\mSaTGma.exe
  C:\Windows\System\mSaTGma.exe
  2⤵
  PID:10596
- C:\Windows\System\FYnGcFi.exe
  C:\Windows\System\FYnGcFi.exe
  2⤵
  PID:10620
- C:\Windows\System\tLhcrRE.exe
  C:\Windows\System\tLhcrRE.exe
  2⤵
  PID:10640
- C:\Windows\System\NwYbUIo.exe
  C:\Windows\System\NwYbUIo.exe
  2⤵
  PID:10664
- C:\Windows\System\DSyHuYq.exe
  C:\Windows\System\DSyHuYq.exe
  2⤵
  PID:10680
- C:\Windows\System\AIWlPTV.exe
  C:\Windows\System\AIWlPTV.exe
  2⤵
  PID:10696
- C:\Windows\System\gAsTnpm.exe
  C:\Windows\System\gAsTnpm.exe
  2⤵
  PID:10716
- C:\Windows\System\ZhJwWpt.exe
  C:\Windows\System\ZhJwWpt.exe
  2⤵
  PID:10744
- C:\Windows\System\tmqyWaf.exe
  C:\Windows\System\tmqyWaf.exe
  2⤵
  PID:10764
- C:\Windows\System\nMDZrLs.exe
  C:\Windows\System\nMDZrLs.exe
  2⤵
  PID:10780
- C:\Windows\System\FcVVghv.exe
  C:\Windows\System\FcVVghv.exe
  2⤵
  PID:10804
- C:\Windows\System\gcmLuoS.exe
  C:\Windows\System\gcmLuoS.exe
  2⤵
  PID:10820
- C:\Windows\System\zWLrstC.exe
  C:\Windows\System\zWLrstC.exe
  2⤵
  PID:10840
- C:\Windows\System\ePdFZkb.exe
  C:\Windows\System\ePdFZkb.exe
  2⤵
  PID:10860
- C:\Windows\System\inqaVGx.exe
  C:\Windows\System\inqaVGx.exe
  2⤵
  PID:10884
- C:\Windows\System\tlUpwFB.exe
  C:\Windows\System\tlUpwFB.exe
  2⤵
  PID:10956
- C:\Windows\System\RufdtKk.exe
  C:\Windows\System\RufdtKk.exe
  2⤵
  PID:10980
- C:\Windows\System\QgRxnXd.exe
  C:\Windows\System\QgRxnXd.exe
  2⤵
  PID:11000
- C:\Windows\System\cGsskBH.exe
  C:\Windows\System\cGsskBH.exe
  2⤵
  PID:11020
- C:\Windows\System\EfPjWgE.exe
  C:\Windows\System\EfPjWgE.exe
  2⤵
  PID:11044
- C:\Windows\System\aAbVqRI.exe
  C:\Windows\System\aAbVqRI.exe
  2⤵
  PID:11068
- C:\Windows\System\wrVcLJT.exe
  C:\Windows\System\wrVcLJT.exe
  2⤵
  PID:11088
- C:\Windows\System\rGaDtBS.exe
  C:\Windows\System\rGaDtBS.exe
  2⤵
  PID:11112
- C:\Windows\System\FlwqQvM.exe
  C:\Windows\System\FlwqQvM.exe
  2⤵
  PID:11136
- C:\Windows\System\ncAYgod.exe
  C:\Windows\System\ncAYgod.exe
  2⤵
  PID:11152
- C:\Windows\System\RdVlzfD.exe
  C:\Windows\System\RdVlzfD.exe
  2⤵
  PID:11168
- C:\Windows\System\mvjxnRp.exe
  C:\Windows\System\mvjxnRp.exe
  2⤵
  PID:11184
- C:\Windows\System\EyGUUuE.exe
  C:\Windows\System\EyGUUuE.exe
  2⤵
  PID:11200
- C:\Windows\System\WxpNEdo.exe
  C:\Windows\System\WxpNEdo.exe
  2⤵
  PID:9956
- C:\Windows\System\KFvFjnt.exe
  C:\Windows\System\KFvFjnt.exe
  2⤵
  PID:7420
- C:\Windows\System\FRScLvs.exe
  C:\Windows\System\FRScLvs.exe
  2⤵
  PID:10296
- C:\Windows\System\faqaYYt.exe
  C:\Windows\System\faqaYYt.exe
  2⤵
  PID:10328
- C:\Windows\System\aFDvgBx.exe
  C:\Windows\System\aFDvgBx.exe
  2⤵
  PID:10800
- C:\Windows\System\UANstJZ.exe
  C:\Windows\System\UANstJZ.exe
  2⤵
  PID:10832
- C:\Windows\System\SSxdcVC.exe
  C:\Windows\System\SSxdcVC.exe
  2⤵
  PID:10856
- C:\Windows\System\weGlvzd.exe
  C:\Windows\System\weGlvzd.exe
  2⤵
  PID:10924
- C:\Windows\System\ubcXodJ.exe
  C:\Windows\System\ubcXodJ.exe
  2⤵
  PID:10896
- C:\Windows\System\sfCjObY.exe
  C:\Windows\System\sfCjObY.exe
  2⤵
  PID:10992
- C:\Windows\System\NachSZq.exe
  C:\Windows\System\NachSZq.exe
  2⤵
  PID:11056
- C:\Windows\System\SLrhKaf.exe
  C:\Windows\System\SLrhKaf.exe
  2⤵
  PID:11148
- C:\Windows\System\HUzmGfn.exe
  C:\Windows\System\HUzmGfn.exe
  2⤵
  PID:11196
- C:\Windows\System\pgKHNtQ.exe
  C:\Windows\System\pgKHNtQ.exe
  2⤵
  PID:11104
- C:\Windows\System\MvZdJdF.exe
  C:\Windows\System\MvZdJdF.exe
  2⤵
  PID:9696
- C:\Windows\System\GXsBGIY.exe
  C:\Windows\System\GXsBGIY.exe
  2⤵
  PID:11080
- C:\Windows\System\GYSqxPa.exe
  C:\Windows\System\GYSqxPa.exe
  2⤵
  PID:10364
- C:\Windows\System\AhPEFjQ.exe
  C:\Windows\System\AhPEFjQ.exe
  2⤵
  PID:2324
- C:\Windows\System\wOcavWd.exe
  C:\Windows\System\wOcavWd.exe
  2⤵
  PID:10200
- C:\Windows\System\mBJWSEU.exe
  C:\Windows\System\mBJWSEU.exe
  2⤵
  PID:10384
- C:\Windows\System\mCmjgHk.exe
  C:\Windows\System\mCmjgHk.exe
  2⤵
  PID:10536
- C:\Windows\System\etlSZUB.exe
  C:\Windows\System\etlSZUB.exe
  2⤵
  PID:10688
- C:\Windows\System\YRGiYTe.exe
  C:\Windows\System\YRGiYTe.exe
  2⤵
  PID:1544
- C:\Windows\System\HGcLsrs.exe
  C:\Windows\System\HGcLsrs.exe
  2⤵
  PID:10852
- C:\Windows\System\uLKDvtM.exe
  C:\Windows\System\uLKDvtM.exe
  2⤵
  PID:10892
- C:\Windows\System\VdxKYpB.exe
  C:\Windows\System\VdxKYpB.exe
  2⤵
  PID:11036
- C:\Windows\System\sBcgXbo.exe
  C:\Windows\System\sBcgXbo.exe
  2⤵
  PID:1916
- C:\Windows\System\rwQPmRG.exe
  C:\Windows\System\rwQPmRG.exe
  2⤵
  PID:11164
- C:\Windows\System\kfqCsKZ.exe
  C:\Windows\System\kfqCsKZ.exe
  2⤵
  PID:11284
- C:\Windows\System\QJLlnNO.exe
  C:\Windows\System\QJLlnNO.exe
  2⤵
  PID:11360
- C:\Windows\System\cuXJlye.exe
  C:\Windows\System\cuXJlye.exe
  2⤵
  PID:11388
- C:\Windows\System\oHHXHmZ.exe
  C:\Windows\System\oHHXHmZ.exe
  2⤵
  PID:11408
- C:\Windows\System\vwlEvQY.exe
  C:\Windows\System\vwlEvQY.exe
  2⤵
  PID:11432
- C:\Windows\System\nrdBsYJ.exe
  C:\Windows\System\nrdBsYJ.exe
  2⤵
  PID:11448
- C:\Windows\System\YAmRTOx.exe
  C:\Windows\System\YAmRTOx.exe
  2⤵
  PID:11468
- C:\Windows\System\jnikTRH.exe
  C:\Windows\System\jnikTRH.exe
  2⤵
  PID:11508
- C:\Windows\System\QCxgRor.exe
  C:\Windows\System\QCxgRor.exe
  2⤵
  PID:11580
- C:\Windows\System\RceWrSF.exe
  C:\Windows\System\RceWrSF.exe
  2⤵
  PID:11608
- C:\Windows\System\ssxqPCj.exe
  C:\Windows\System\ssxqPCj.exe
  2⤵
  PID:11656
- C:\Windows\System\ZSDMNHc.exe
  C:\Windows\System\ZSDMNHc.exe
  2⤵
  PID:11672
- C:\Windows\System\MGBtQAS.exe
  C:\Windows\System\MGBtQAS.exe
  2⤵
  PID:11688
- C:\Windows\System\nYlcwWB.exe
  C:\Windows\System\nYlcwWB.exe
  2⤵
  PID:11704
- C:\Windows\System\Ktwhhwe.exe
  C:\Windows\System\Ktwhhwe.exe
  2⤵
  PID:11720
- C:\Windows\System\aIUgcmO.exe
  C:\Windows\System\aIUgcmO.exe
  2⤵
  PID:11736
- C:\Windows\System\LFlAOzD.exe
  C:\Windows\System\LFlAOzD.exe
  2⤵
  PID:11764
- C:\Windows\System\RsaEPPc.exe
  C:\Windows\System\RsaEPPc.exe
  2⤵
  PID:11796
- C:\Windows\System\KslsDOI.exe
  C:\Windows\System\KslsDOI.exe
  2⤵
  PID:11812
- C:\Windows\System\dPmldMy.exe
  C:\Windows\System\dPmldMy.exe
  2⤵
  PID:11836
- C:\Windows\System\lNkKYAA.exe
  C:\Windows\System\lNkKYAA.exe
  2⤵
  PID:11904
- C:\Windows\System\YcIMilC.exe
  C:\Windows\System\YcIMilC.exe
  2⤵
  PID:11976
- C:\Windows\System\ijNzXQv.exe
  C:\Windows\System\ijNzXQv.exe
  2⤵
  PID:12000
- C:\Windows\System\WZOfHAL.exe
  C:\Windows\System\WZOfHAL.exe
  2⤵
  PID:12024
- C:\Windows\System\BGIcvkx.exe
  C:\Windows\System\BGIcvkx.exe
  2⤵
  PID:12044
- C:\Windows\System\tAmAzcE.exe
  C:\Windows\System\tAmAzcE.exe
  2⤵
  PID:12064
- C:\Windows\System\uaGdtWP.exe
  C:\Windows\System\uaGdtWP.exe
  2⤵
  PID:12092
- C:\Windows\System\oLqdehD.exe
  C:\Windows\System\oLqdehD.exe
  2⤵
  PID:12112
- C:\Windows\System\bPxhqcT.exe
  C:\Windows\System\bPxhqcT.exe
  2⤵
  PID:12140
- C:\Windows\System\SselUaE.exe
  C:\Windows\System\SselUaE.exe
  2⤵
  PID:12160
- C:\Windows\System\gBmliVw.exe
  C:\Windows\System\gBmliVw.exe
  2⤵
  PID:12180
- C:\Windows\System\iEklYoE.exe
  C:\Windows\System\iEklYoE.exe
  2⤵
  PID:12204
- C:\Windows\System\IbjuVij.exe
  C:\Windows\System\IbjuVij.exe
  2⤵
  PID:12224
- C:\Windows\System\AyphutL.exe
  C:\Windows\System\AyphutL.exe
  2⤵
  PID:12240
- C:\Windows\System\IFhpSRX.exe
  C:\Windows\System\IFhpSRX.exe
  2⤵
  PID:12260
- C:\Windows\System\LAMBLGg.exe
  C:\Windows\System\LAMBLGg.exe
  2⤵
  PID:12276
- C:\Windows\System\oouLKhN.exe
  C:\Windows\System\oouLKhN.exe
  2⤵
  PID:10796
- C:\Windows\System\NejgblY.exe
  C:\Windows\System\NejgblY.exe
  2⤵
  PID:11276
- C:\Windows\System\ECUoiWH.exe
  C:\Windows\System\ECUoiWH.exe
  2⤵
  PID:11420
- C:\Windows\System\BGxwvAm.exe
  C:\Windows\System\BGxwvAm.exe
  2⤵
  PID:11280
- C:\Windows\System\BeQGUlk.exe
  C:\Windows\System\BeQGUlk.exe
  2⤵
  PID:11352
- C:\Windows\System\MtKsTEu.exe
  C:\Windows\System\MtKsTEu.exe
  2⤵
  PID:11536
- C:\Windows\System\NvZyFwW.exe
  C:\Windows\System\NvZyFwW.exe
  2⤵
  PID:11324
- C:\Windows\System\bzozByl.exe
  C:\Windows\System\bzozByl.exe
  2⤵
  PID:11376
- C:\Windows\System\YbMfndI.exe
  C:\Windows\System\YbMfndI.exe
  2⤵
  PID:11444
- C:\Windows\System\yIrnHpf.exe
  C:\Windows\System\yIrnHpf.exe
  2⤵
  PID:11492
- C:\Windows\System\jMhizSc.exe
  C:\Windows\System\jMhizSc.exe
  2⤵
  PID:11668
- C:\Windows\System\JEZdfCb.exe
  C:\Windows\System\JEZdfCb.exe
  2⤵
  PID:11700
- C:\Windows\System\MFeJGkY.exe
  C:\Windows\System\MFeJGkY.exe
  2⤵
  PID:11716
- C:\Windows\System\DzQjQtp.exe
  C:\Windows\System\DzQjQtp.exe
  2⤵
  PID:11788
- C:\Windows\System\nJbAftO.exe
  C:\Windows\System\nJbAftO.exe
  2⤵
  PID:11760
- C:\Windows\System\lmSOLen.exe
  C:\Windows\System\lmSOLen.exe
  2⤵
  PID:11824
- C:\Windows\System\XlJRIxo.exe
  C:\Windows\System\XlJRIxo.exe
  2⤵
  PID:11964
- C:\Windows\System\GVnVPUl.exe
  C:\Windows\System\GVnVPUl.exe
  2⤵
  PID:12056
- C:\Windows\System\oxnYyIT.exe
  C:\Windows\System\oxnYyIT.exe
  2⤵
  PID:12148
- C:\Windows\System\bxnrGrI.exe
  C:\Windows\System\bxnrGrI.exe
  2⤵
  PID:11888
- C:\Windows\System\mqhxIbv.exe
  C:\Windows\System\mqhxIbv.exe
  2⤵
  PID:11936
- C:\Windows\System\sBcsvzG.exe
  C:\Windows\System\sBcsvzG.exe
  2⤵
  PID:11960
- C:\Windows\System\aJRJjBA.exe
  C:\Windows\System\aJRJjBA.exe
  2⤵
  PID:12136
- C:\Windows\System\nNXPskH.exe
  C:\Windows\System\nNXPskH.exe
  2⤵
  PID:11596
- C:\Windows\System\LCwZrkY.exe
  C:\Windows\System\LCwZrkY.exe
  2⤵
  PID:12364
- C:\Windows\System\QkQcwVG.exe
  C:\Windows\System\QkQcwVG.exe
  2⤵
  PID:12384
- C:\Windows\System\aVCKNBA.exe
  C:\Windows\System\aVCKNBA.exe
  2⤵
  PID:12404
- C:\Windows\System\nEeGqBx.exe
  C:\Windows\System\nEeGqBx.exe
  2⤵
  PID:12424
- C:\Windows\System\sVIqFfP.exe
  C:\Windows\System\sVIqFfP.exe
  2⤵
  PID:12444
- C:\Windows\System\yROXaka.exe
  C:\Windows\System\yROXaka.exe
  2⤵
  PID:12464
- C:\Windows\System\ZJIGDko.exe
  C:\Windows\System\ZJIGDko.exe
  2⤵
  PID:12480
- C:\Windows\System\gajKIAg.exe
  C:\Windows\System\gajKIAg.exe
  2⤵
  PID:12524
- C:\Windows\System\LRJmoyp.exe
  C:\Windows\System\LRJmoyp.exe
  2⤵
  PID:12556
- C:\Windows\System\qVZqVSi.exe
  C:\Windows\System\qVZqVSi.exe
  2⤵
  PID:12640
- C:\Windows\System\aDrKKxF.exe
  C:\Windows\System\aDrKKxF.exe
  2⤵
  PID:12660
- C:\Windows\System\dnJpzhC.exe
  C:\Windows\System\dnJpzhC.exe
  2⤵
  PID:12680
- C:\Windows\System\jozbPyU.exe
  C:\Windows\System\jozbPyU.exe
  2⤵
  PID:12728
- C:\Windows\System\iyIxDig.exe
  C:\Windows\System\iyIxDig.exe
  2⤵
  PID:12808
- C:\Windows\System\yJyRFiM.exe
  C:\Windows\System\yJyRFiM.exe
  2⤵
  PID:12828
- C:\Windows\System\wBdYGCU.exe
  C:\Windows\System\wBdYGCU.exe
  2⤵
  PID:12848
- C:\Windows\System\uiFjYxu.exe
  C:\Windows\System\uiFjYxu.exe
  2⤵
  PID:12868
- C:\Windows\System\fvMNnjk.exe
  C:\Windows\System\fvMNnjk.exe
  2⤵
  PID:12912
- C:\Windows\System\tMvVjva.exe
  C:\Windows\System\tMvVjva.exe
  2⤵
  PID:12940
- C:\Windows\System\LbBIYFm.exe
  C:\Windows\System\LbBIYFm.exe
  2⤵
  PID:12956
- C:\Windows\System\HBANakV.exe
  C:\Windows\System\HBANakV.exe
  2⤵
  PID:12988
- C:\Windows\System\qJHFePC.exe
  C:\Windows\System\qJHFePC.exe
  2⤵
  PID:13004
- C:\Windows\System\WIRrQkt.exe
  C:\Windows\System\WIRrQkt.exe
  2⤵
  PID:13020
- C:\Windows\System\QkihdIL.exe
  C:\Windows\System\QkihdIL.exe
  2⤵
  PID:13036
- C:\Windows\System\XUWJRJG.exe
  C:\Windows\System\XUWJRJG.exe
  2⤵
  PID:13168
- C:\Windows\System\mcIrwTd.exe
  C:\Windows\System\mcIrwTd.exe
  2⤵
  PID:13184
- C:\Windows\System\hYkieNB.exe
  C:\Windows\System\hYkieNB.exe
  2⤵
  PID:13212
- C:\Windows\System\bkgxcXw.exe
  C:\Windows\System\bkgxcXw.exe
  2⤵
  PID:13232
- C:\Windows\System\eHsOman.exe
  C:\Windows\System\eHsOman.exe
  2⤵
  PID:13256
- C:\Windows\System\MRTqaYr.exe
  C:\Windows\System\MRTqaYr.exe
  2⤵
  PID:13284
- C:\Windows\System\pLVElmM.exe
  C:\Windows\System\pLVElmM.exe
  2⤵
  PID:12212
- C:\Windows\System\HtuIJkr.exe
  C:\Windows\System\HtuIJkr.exe
  2⤵
  PID:11944
- C:\Windows\System\FjIJCfw.exe
  C:\Windows\System\FjIJCfw.exe
  2⤵
  PID:11440
- C:\Windows\System\OyextjK.exe
  C:\Windows\System\OyextjK.exe
  2⤵
  PID:12440
- C:\Windows\System\RCeHCSx.exe
  C:\Windows\System\RCeHCSx.exe
  2⤵
  PID:10280
- C:\Windows\System\XnnUCPO.exe
  C:\Windows\System\XnnUCPO.exe
  2⤵
  PID:12008
- C:\Windows\System\cybdXWg.exe
  C:\Windows\System\cybdXWg.exe
  2⤵
  PID:996
- C:\Windows\System\uFsdviK.exe
  C:\Windows\System\uFsdviK.exe
  2⤵
  PID:12172
- C:\Windows\System\OXpPDIG.exe
  C:\Windows\System\OXpPDIG.exe
  2⤵
  PID:12532
- C:\Windows\System\YrrlTqO.exe
  C:\Windows\System\YrrlTqO.exe
  2⤵
  PID:13308
- C:\Windows\System\BUydqjz.exe
  C:\Windows\System\BUydqjz.exe
  2⤵
  PID:2976
- C:\Windows\System\ZIcLHZI.exe
  C:\Windows\System\ZIcLHZI.exe
  2⤵
  PID:5452
- C:\Windows\System\rnNocKK.exe
  C:\Windows\System\rnNocKK.exe
  2⤵
  PID:12120
- C:\Windows\System\rYXMvxQ.exe
  C:\Windows\System\rYXMvxQ.exe
  2⤵
  PID:12292
- C:\Windows\System\gJBRPKN.exe
  C:\Windows\System\gJBRPKN.exe
  2⤵
  PID:12416
- C:\Windows\System\FEYayyi.exe
  C:\Windows\System\FEYayyi.exe
  2⤵
  PID:12372
- C:\Windows\System\ZBeeYgd.exe
  C:\Windows\System\ZBeeYgd.exe
  2⤵
  PID:11256
- C:\Windows\System\lvJYhLn.exe
  C:\Windows\System\lvJYhLn.exe
  2⤵
  PID:12740
- C:\Windows\System\oGktWnS.exe
  C:\Windows\System\oGktWnS.exe
  2⤵
  PID:12656
- C:\Windows\System\CMEtXhn.exe
  C:\Windows\System\CMEtXhn.exe
  2⤵
  PID:12724
- C:\Windows\System\IPNbAQN.exe
  C:\Windows\System\IPNbAQN.exe
  2⤵
  PID:228
- C:\Windows\System\PNZEkBW.exe
  C:\Windows\System\PNZEkBW.exe
  2⤵
  PID:12896
- C:\Windows\System\NmNSGvR.exe
  C:\Windows\System\NmNSGvR.exe
  2⤵
  PID:2008
- C:\Windows\System\bNmdFgX.exe
  C:\Windows\System\bNmdFgX.exe
  2⤵
  PID:13124
- C:\Windows\System\ShpbWyh.exe
  C:\Windows\System\ShpbWyh.exe
  2⤵
  PID:13200
- C:\Windows\System\IkYTyRF.exe
  C:\Windows\System\IkYTyRF.exe
  2⤵
  PID:13180
- C:\Windows\System\oYUuSuN.exe
  C:\Windows\System\oYUuSuN.exe
  2⤵
  PID:13076
- C:\Windows\System\ucIotJX.exe
  C:\Windows\System\ucIotJX.exe
  2⤵
  PID:11780
- C:\Windows\System\inQcCvi.exe
  C:\Windows\System\inQcCvi.exe
  2⤵
  PID:4612
- C:\Windows\System\OZRsYap.exe
  C:\Windows\System\OZRsYap.exe
  2⤵
  PID:11564
- C:\Windows\System\GlnzmXG.exe
  C:\Windows\System\GlnzmXG.exe
  2⤵
  PID:4880
- C:\Windows\System\bqMpDLL.exe
  C:\Windows\System\bqMpDLL.exe
  2⤵
  PID:5028
- C:\Windows\System\nUymvoT.exe
  C:\Windows\System\nUymvoT.exe
  2⤵
  PID:3248
- C:\Windows\System\hyecPoO.exe
  C:\Windows\System\hyecPoO.exe
  2⤵
  PID:3840
- C:\Windows\System\kcMjzaD.exe
  C:\Windows\System\kcMjzaD.exe
  2⤵
  PID:12584
- C:\Windows\System\GjTvLmo.exe
  C:\Windows\System\GjTvLmo.exe
  2⤵
  PID:2580
- C:\Windows\System\nBGTyhm.exe
  C:\Windows\System\nBGTyhm.exe
  2⤵
  PID:12152
- C:\Windows\System\tKDcjqK.exe
  C:\Windows\System\tKDcjqK.exe
  2⤵
  PID:12460
- C:\Windows\System\yeODGJn.exe
  C:\Windows\System\yeODGJn.exe
  2⤵
  PID:4748
- C:\Windows\System\ZboqYEF.exe
  C:\Windows\System\ZboqYEF.exe
  2⤵
  PID:13328
- C:\Windows\System\QyJykeW.exe
  C:\Windows\System\QyJykeW.exe
  2⤵
  PID:13360
- C:\Windows\System\ZtkfWKL.exe
  C:\Windows\System\ZtkfWKL.exe
  2⤵
  PID:13412
- C:\Windows\System\xtadExN.exe
  C:\Windows\System\xtadExN.exe
  2⤵
  PID:13432
- C:\Windows\System\gkwxNex.exe
  C:\Windows\System\gkwxNex.exe
  2⤵
  PID:13956
- C:\Windows\System\ypmRjfy.exe
  C:\Windows\System\ypmRjfy.exe
  2⤵
  PID:13992
- C:\Windows\System\QmxTAzg.exe
  C:\Windows\System\QmxTAzg.exe
  2⤵
  PID:14088
- C:\Windows\System\cfNFbyx.exe
  C:\Windows\System\cfNFbyx.exe
  2⤵
  PID:14108
- C:\Windows\System\PwOdsDR.exe
  C:\Windows\System\PwOdsDR.exe
  2⤵
  PID:14140
- C:\Windows\System\GiAbiji.exe
  C:\Windows\System\GiAbiji.exe
  2⤵
  PID:14200
- C:\Windows\System\iosAQqj.exe
  C:\Windows\System\iosAQqj.exe
  2⤵
  PID:14224
- C:\Windows\System\IGmElEO.exe
  C:\Windows\System\IGmElEO.exe
  2⤵
  PID:14244
- C:\Windows\System\HWpMHpK.exe
  C:\Windows\System\HWpMHpK.exe
  2⤵
  PID:14260
- C:\Windows\System\sgpzWcF.exe
  C:\Windows\System\sgpzWcF.exe
  2⤵
  PID:14288
- C:\Windows\System\dxxvjIi.exe
  C:\Windows\System\dxxvjIi.exe
  2⤵
  PID:14324
- C:\Windows\System\yQBDgzJ.exe
  C:\Windows\System\yQBDgzJ.exe
  2⤵
  PID:4256
- C:\Windows\System\MDBfFTG.exe
  C:\Windows\System\MDBfFTG.exe
  2⤵
  PID:12200
- C:\Windows\System\NeaHwhk.exe
  C:\Windows\System\NeaHwhk.exe
  2⤵
  PID:13056
- C:\Windows\System\XJKNdZM.exe
  C:\Windows\System\XJKNdZM.exe
  2⤵
  PID:12072
- C:\Windows\System\FXRafPc.exe
  C:\Windows\System\FXRafPc.exe
  2⤵
  PID:13320
- C:\Windows\System\pjwLRFK.exe
  C:\Windows\System\pjwLRFK.exe
  2⤵
  PID:12620
- C:\Windows\System\WpWqwDR.exe
  C:\Windows\System\WpWqwDR.exe
  2⤵
  PID:13448
- C:\Windows\System\zHswtoV.exe
  C:\Windows\System\zHswtoV.exe
  2⤵
  PID:5080
- C:\Windows\System\ElIuXDI.exe
  C:\Windows\System\ElIuXDI.exe
  2⤵
  PID:3224
- C:\Windows\System\IyQejdl.exe
  C:\Windows\System\IyQejdl.exe
  2⤵
  PID:11568
- C:\Windows\System\ltKBgsY.exe
  C:\Windows\System\ltKBgsY.exe
  2⤵
  PID:4436
- C:\Windows\System\rchyqXh.exe
  C:\Windows\System\rchyqXh.exe
  2⤵
  PID:13540
- C:\Windows\System\CvPgzoK.exe
  C:\Windows\System\CvPgzoK.exe
  2⤵
  PID:2784
- C:\Windows\System\UdkwyHM.exe
  C:\Windows\System\UdkwyHM.exe
  2⤵
  PID:12476
- C:\Windows\System\QqfEXto.exe
  C:\Windows\System\QqfEXto.exe
  2⤵
  PID:12952
- C:\Windows\System\DIxqSgd.exe
  C:\Windows\System\DIxqSgd.exe
  2⤵
  PID:5044
- C:\Windows\System\koleECQ.exe
  C:\Windows\System\koleECQ.exe
  2⤵
  PID:3160
- C:\Windows\System\INaLnSW.exe
  C:\Windows\System\INaLnSW.exe
  2⤵
  PID:13376
- C:\Windows\System\eMDOHzC.exe
  C:\Windows\System\eMDOHzC.exe
  2⤵
  PID:13404
- C:\Windows\System\GbMfFnB.exe
  C:\Windows\System\GbMfFnB.exe
  2⤵
  PID:13564
- C:\Windows\System\zLILyIy.exe
  C:\Windows\System\zLILyIy.exe
  2⤵
  PID:13476
- C:\Windows\System\sEYSOIh.exe
  C:\Windows\System\sEYSOIh.exe
  2⤵
  PID:2236
- C:\Windows\System\pwNaiid.exe
  C:\Windows\System\pwNaiid.exe
  2⤵
  PID:13520
- C:\Windows\System\LSvMvHu.exe
  C:\Windows\System\LSvMvHu.exe
  2⤵
  PID:4340
- C:\Windows\System\sbpDxzy.exe
  C:\Windows\System\sbpDxzy.exe
  2⤵
  PID:4468
- C:\Windows\System\hkfZrjZ.exe
  C:\Windows\System\hkfZrjZ.exe
  2⤵
  PID:2532
- C:\Windows\System\dxZTLgI.exe
  C:\Windows\System\dxZTLgI.exe
  2⤵
  PID:13772
- C:\Windows\System\ddJTTUT.exe
  C:\Windows\System\ddJTTUT.exe
  2⤵
  PID:6412
- C:\Windows\System\dTrZoWX.exe
  C:\Windows\System\dTrZoWX.exe
  2⤵
  PID:6556
- C:\Windows\System\GAhtCLu.exe
  C:\Windows\System\GAhtCLu.exe
  2⤵
  PID:2432
- C:\Windows\System\kuMOAIq.exe
  C:\Windows\System\kuMOAIq.exe
  2⤵
  PID:13744
- C:\Windows\System\KEVBElL.exe
  C:\Windows\System\KEVBElL.exe
  2⤵
  PID:3244
- C:\Windows\System\hGLaEWA.exe
  C:\Windows\System\hGLaEWA.exe
  2⤵
  PID:3608
- C:\Windows\System\qeuzZVY.exe
  C:\Windows\System\qeuzZVY.exe
  2⤵
  PID:13924
- C:\Windows\System\AeMczva.exe
  C:\Windows\System\AeMczva.exe
  2⤵
  PID:13900
- C:\Windows\System\qnXaPdB.exe
  C:\Windows\System\qnXaPdB.exe
  2⤵
  PID:3580
- C:\Windows\System\msPbqUv.exe
  C:\Windows\System\msPbqUv.exe
  2⤵
  PID:13844
- C:\Windows\System\QwrNWFs.exe
  C:\Windows\System\QwrNWFs.exe
  2⤵
  PID:13888
- C:\Windows\System\xlrOsrF.exe
  C:\Windows\System\xlrOsrF.exe
  2⤵
  PID:5020
- C:\Windows\System\mMwbBtQ.exe
  C:\Windows\System\mMwbBtQ.exe
  2⤵
  PID:13980
- C:\Windows\System\SWGlUdK.exe
  C:\Windows\System\SWGlUdK.exe
  2⤵
  PID:5700
- C:\Windows\System\PKZLtWc.exe
  C:\Windows\System\PKZLtWc.exe
  2⤵
  PID:5572
- C:\Windows\System\hTDuasK.exe
  C:\Windows\System\hTDuasK.exe
  2⤵
  PID:13976
- C:\Windows\System\rJGxTWM.exe
  C:\Windows\System\rJGxTWM.exe
  2⤵
  PID:14008
- C:\Windows\System\jObxMko.exe
  C:\Windows\System\jObxMko.exe
  2⤵
  PID:14024
- C:\Windows\System\ZhClXuw.exe
  C:\Windows\System\ZhClXuw.exe
  2⤵
  PID:14056
- C:\Windows\System\jZaJYbN.exe
  C:\Windows\System\jZaJYbN.exe
  2⤵
  PID:5784
- C:\Windows\System\KagKahZ.exe
  C:\Windows\System\KagKahZ.exe
  2⤵
  PID:14076
- C:\Windows\System\uCjFxti.exe
  C:\Windows\System\uCjFxti.exe
  2⤵
  PID:12632
- C:\Windows\System\ITDDWDv.exe
  C:\Windows\System\ITDDWDv.exe
  2⤵
  PID:5296
- C:\Windows\System\GNSMIfx.exe
  C:\Windows\System\GNSMIfx.exe
  2⤵
  PID:5372
- C:\Windows\System\sClVHcV.exe
  C:\Windows\System\sClVHcV.exe
  2⤵
  PID:5300
- C:\Windows\System\kfPFrPW.exe
  C:\Windows\System\kfPFrPW.exe
  2⤵
  PID:5340
- C:\Windows\System\GyrxYVq.exe
  C:\Windows\System\GyrxYVq.exe
  2⤵
  PID:13576
- C:\Windows\System\QqVCopM.exe
  C:\Windows\System\QqVCopM.exe
  2⤵
  PID:13280
- C:\Windows\System\SHjAWst.exe
  C:\Windows\System\SHjAWst.exe
  2⤵
  PID:13336
- C:\Windows\System\sDgVdAd.exe
  C:\Windows\System\sDgVdAd.exe
  2⤵
  PID:5368
- C:\Windows\System\DpIdEdM.exe
  C:\Windows\System\DpIdEdM.exe
  2⤵
  PID:4616
- C:\Windows\System\PaAMRID.exe
  C:\Windows\System\PaAMRID.exe
  2⤵
  PID:6008
- C:\Windows\System\AwxYgJx.exe
  C:\Windows\System\AwxYgJx.exe
  2⤵
  PID:5980
- C:\Windows\System\eehHiQv.exe
  C:\Windows\System\eehHiQv.exe
  2⤵
  PID:14276
- C:\Windows\System\tahsOXT.exe
  C:\Windows\System\tahsOXT.exe
  2⤵
  PID:6048
- C:\Windows\System\vTlqBwo.exe
  C:\Windows\System\vTlqBwo.exe
  2⤵
  PID:14272
- C:\Windows\System\RNuqdVJ.exe
  C:\Windows\System\RNuqdVJ.exe
  2⤵
  PID:14256
- C:\Windows\System\XnMbeQE.exe
  C:\Windows\System\XnMbeQE.exe
  2⤵
  PID:6096
- C:\Windows\System\EUIoQat.exe
  C:\Windows\System\EUIoQat.exe
  2⤵
  PID:2204
- C:\Windows\System\CVZQIpW.exe
  C:\Windows\System\CVZQIpW.exe
  2⤵
  PID:11552
- C:\Windows\System\rWDgMmu.exe
  C:\Windows\System\rWDgMmu.exe
  2⤵
  PID:6288
- C:\Windows\System\WCYsLOH.exe
  C:\Windows\System\WCYsLOH.exe
  2⤵
  PID:13468
- C:\Windows\System\fgSqFQV.exe
  C:\Windows\System\fgSqFQV.exe
  2⤵
  PID:7036
- C:\Windows\System\vmHtFhT.exe
  C:\Windows\System\vmHtFhT.exe
  2⤵
  PID:6804
- C:\Windows\System\uUIcTFa.exe
  C:\Windows\System\uUIcTFa.exe
  2⤵
  PID:6376
- C:\Windows\System\SUvhyVh.exe
  C:\Windows\System\SUvhyVh.exe
  2⤵
  PID:2284
- C:\Windows\System\XhPgaKv.exe
  C:\Windows\System\XhPgaKv.exe
  2⤵
  PID:13472
- C:\Windows\System\dsBroUS.exe
  C:\Windows\System\dsBroUS.exe
  2⤵
  PID:6832
- C:\Windows\System\XWIMrBg.exe
  C:\Windows\System\XWIMrBg.exe
  2⤵
  PID:12400
- C:\Windows\System\DVmhtFw.exe
  C:\Windows\System\DVmhtFw.exe
  2⤵
  PID:3600
- C:\Windows\System\rdFbXKA.exe
  C:\Windows\System\rdFbXKA.exe
  2⤵
  PID:14188
- C:\Windows\System\NetTTrU.exe
  C:\Windows\System\NetTTrU.exe
  2⤵
  PID:956
- C:\Windows\System\gaPPXHP.exe
  C:\Windows\System\gaPPXHP.exe
  2⤵
  PID:5720
- C:\Windows\System\SpyIGWk.exe
  C:\Windows\System\SpyIGWk.exe
  2⤵
  PID:5316
- C:\Windows\System\KmTqqBR.exe
  C:\Windows\System\KmTqqBR.exe
  2⤵
  PID:13916
- C:\Windows\System\DWrvRkf.exe
  C:\Windows\System\DWrvRkf.exe
  2⤵
  PID:2264
- C:\Windows\System\XZqqEWT.exe
  C:\Windows\System\XZqqEWT.exe
  2⤵
  PID:4656
- C:\Windows\System\WrBlkfy.exe
  C:\Windows\System\WrBlkfy.exe
  2⤵
  PID:1560
- C:\Windows\System\bhghqhg.exe
  C:\Windows\System\bhghqhg.exe
  2⤵
  PID:14016
- C:\Windows\System\xLRTRqf.exe
  C:\Windows\System\xLRTRqf.exe
  2⤵
  PID:2428
- C:\Windows\System\eUqsjmR.exe
  C:\Windows\System\eUqsjmR.exe
  2⤵
  PID:13880
- C:\Windows\System\XrcukaL.exe
  C:\Windows\System\XrcukaL.exe
  2⤵
  PID:4920
- C:\Windows\System\fzZmDRI.exe
  C:\Windows\System\fzZmDRI.exe
  2⤵
  PID:14236
- C:\Windows\System\GRaBHyH.exe
  C:\Windows\System\GRaBHyH.exe
  2⤵
  PID:7124
- C:\Windows\System\ibMDeOJ.exe
  C:\Windows\System\ibMDeOJ.exe
  2⤵
  PID:7572
- C:\Windows\System\YUQYnci.exe
  C:\Windows\System\YUQYnci.exe
  2⤵
  PID:7352
- C:\Windows\System\fyZabMn.exe
  C:\Windows\System\fyZabMn.exe
  2⤵
  PID:6056
- C:\Windows\System\jlnOHEZ.exe
  C:\Windows\System\jlnOHEZ.exe
  2⤵
  PID:14080
- C:\Windows\System\qGZmHBr.exe
  C:\Windows\System\qGZmHBr.exe
  2⤵
  PID:7536
- C:\Windows\System\EHknROm.exe
  C:\Windows\System\EHknROm.exe
  2⤵
  PID:7688
- C:\Windows\System\jxPXqGl.exe
  C:\Windows\System\jxPXqGl.exe
  2⤵
  PID:7964
- C:\Windows\System\zmptjXQ.exe
  C:\Windows\System\zmptjXQ.exe
  2⤵
  PID:8032
- C:\Windows\System\mMZvbGZ.exe
  C:\Windows\System\mMZvbGZ.exe
  2⤵
  PID:7700
- C:\Windows\System\aVBvLiO.exe
  C:\Windows\System\aVBvLiO.exe
  2⤵
  PID:2248
- C:\Windows\System\ioiCmBp.exe
  C:\Windows\System\ioiCmBp.exe
  2⤵
  PID:14048
- C:\Windows\System\TDJkgrL.exe
  C:\Windows\System\TDJkgrL.exe
  2⤵
  PID:14064
- C:\Windows\System\eJRGRYY.exe
  C:\Windows\System\eJRGRYY.exe
  2⤵
  PID:7580
- C:\Windows\System\IxtyZgp.exe
  C:\Windows\System\IxtyZgp.exe
  2⤵
  PID:3520
- C:\Windows\System\ScrmEeS.exe
  C:\Windows\System\ScrmEeS.exe
  2⤵
  PID:4184
- C:\Windows\System\BZMnYZm.exe
  C:\Windows\System\BZMnYZm.exe
  2⤵
  PID:8864
- C:\Windows\System\NRHTWuz.exe
  C:\Windows\System\NRHTWuz.exe
  2⤵
  PID:6860
- C:\Windows\System\qYIAoTm.exe
  C:\Windows\System\qYIAoTm.exe
  2⤵
  PID:13964
- C:\Windows\System\hGdpDfs.exe
  C:\Windows\System\hGdpDfs.exe
  2⤵
  PID:13300
- C:\Windows\System\vRgtMYZ.exe
  C:\Windows\System\vRgtMYZ.exe
  2⤵
  PID:8684
- C:\Windows\System\iLtlzcc.exe
  C:\Windows\System\iLtlzcc.exe
  2⤵
  PID:8704
- C:\Windows\System\bUSLewJ.exe
  C:\Windows\System\bUSLewJ.exe
  2⤵
  PID:8872
- C:\Windows\System\KdShCgA.exe
  C:\Windows\System\KdShCgA.exe
  2⤵
  PID:8816
- C:\Windows\System\dVkVuGF.exe
  C:\Windows\System\dVkVuGF.exe
  2⤵
  PID:5048
- C:\Windows\System\qogSLPo.exe
  C:\Windows\System\qogSLPo.exe
  2⤵
  PID:8752
- C:\Windows\System\KKAcpXu.exe
  C:\Windows\System\KKAcpXu.exe
  2⤵
  PID:8728
- C:\Windows\System\NbPXEXr.exe
  C:\Windows\System\NbPXEXr.exe
  2⤵
  PID:9172
- C:\Windows\System\FCbBVSQ.exe
  C:\Windows\System\FCbBVSQ.exe
  2⤵
  PID:13968
- C:\Windows\System\yhALAFj.exe
  C:\Windows\System\yhALAFj.exe
  2⤵
  PID:9140
- C:\Windows\System\THpqdtD.exe
  C:\Windows\System\THpqdtD.exe
  2⤵
  PID:5148
- C:\Windows\System\sjpAwfT.exe
  C:\Windows\System\sjpAwfT.exe
  2⤵
  PID:2912
- C:\Windows\System\PpOYqGL.exe
  C:\Windows\System\PpOYqGL.exe
  2⤵
  PID:3272
- C:\Windows\System\uQXtZmP.exe
  C:\Windows\System\uQXtZmP.exe
  2⤵
  PID:13516
- C:\Windows\System\yYrKTbV.exe
  C:\Windows\System\yYrKTbV.exe
  2⤵
  PID:6808
- C:\Windows\System\DlHBjXY.exe
  C:\Windows\System\DlHBjXY.exe
  2⤵
  PID:5304
- C:\Windows\System\ARsscQr.exe
  C:\Windows\System\ARsscQr.exe
  2⤵
  PID:1664
- C:\Windows\System\cPSVQph.exe
  C:\Windows\System\cPSVQph.exe
  2⤵
  PID:8180
- C:\Windows\System\kqEJlHC.exe
  C:\Windows\System\kqEJlHC.exe
  2⤵
  PID:12568
- C:\Windows\System\vwmfWVB.exe
  C:\Windows\System\vwmfWVB.exe
  2⤵
  PID:8436
- C:\Windows\System\bvtpnXL.exe
  C:\Windows\System\bvtpnXL.exe
  2⤵
  PID:9020
- C:\Windows\System\EXRIqBL.exe
  C:\Windows\System\EXRIqBL.exe
  2⤵
  PID:8300
- C:\Windows\System\NLZhkFT.exe
  C:\Windows\System\NLZhkFT.exe
  2⤵
  PID:7228
- C:\Windows\System\RciyvVT.exe
  C:\Windows\System\RciyvVT.exe
  2⤵
  PID:4332
- C:\Windows\System\ttanXar.exe
  C:\Windows\System\ttanXar.exe
  2⤵
  PID:13488
- C:\Windows\System\ACXGRSB.exe
  C:\Windows\System\ACXGRSB.exe
  2⤵
  PID:9116
- C:\Windows\System\cjKUsFK.exe
  C:\Windows\System\cjKUsFK.exe
  2⤵
  PID:8604
- C:\Windows\System\tqpkGOa.exe
  C:\Windows\System\tqpkGOa.exe
  2⤵
  PID:4624
- C:\Windows\System\oeWyiKs.exe
  C:\Windows\System\oeWyiKs.exe
  2⤵
  PID:13948
- C:\Windows\System\EgIahxS.exe
  C:\Windows\System\EgIahxS.exe
  2⤵
  PID:5260
- C:\Windows\System\PIokgWY.exe
  C:\Windows\System\PIokgWY.exe
  2⤵
  PID:5684
- C:\Windows\System\xVvgXmQ.exe
  C:\Windows\System\xVvgXmQ.exe
  2⤵
  PID:9356
- C:\Windows\System\hobcroV.exe
  C:\Windows\System\hobcroV.exe
  2⤵
  PID:9396
- C:\Windows\System\AeYPMqP.exe
  C:\Windows\System\AeYPMqP.exe
  2⤵
  PID:9332
- C:\Windows\System\yxkOeTj.exe
  C:\Windows\System\yxkOeTj.exe
  2⤵
  PID:2788
- C:\Windows\System\ehzIYwh.exe
  C:\Windows\System\ehzIYwh.exe
  2⤵
  PID:7704
- C:\Windows\System\klfLfun.exe
  C:\Windows\System\klfLfun.exe
  2⤵
  PID:8472
- C:\Windows\System\xjSilqo.exe
  C:\Windows\System\xjSilqo.exe
  2⤵
  PID:9568
- C:\Windows\System\UAlaSLf.exe
  C:\Windows\System\UAlaSLf.exe
  2⤵
  PID:7636
- C:\Windows\System\GbVlbvG.exe
  C:\Windows\System\GbVlbvG.exe
  2⤵
  PID:9744
- C:\Windows\System\OXJpNdp.exe
  C:\Windows\System\OXJpNdp.exe
  2⤵
  PID:8080
- C:\Windows\System\fDRTnQl.exe
  C:\Windows\System\fDRTnQl.exe
  2⤵
  PID:9508
- C:\Windows\System\LDtZxjX.exe
  C:\Windows\System\LDtZxjX.exe
  2⤵
  PID:6608
- C:\Windows\System\IgOejSR.exe
  C:\Windows\System\IgOejSR.exe
  2⤵
  PID:8028
- C:\Windows\System\boktVNc.exe
  C:\Windows\System\boktVNc.exe
  2⤵
  PID:9936
- C:\Windows\System\SwxZLOC.exe
  C:\Windows\System\SwxZLOC.exe
  2⤵
  PID:7216
- C:\Windows\System\tbglSJG.exe
  C:\Windows\System\tbglSJG.exe
  2⤵
  PID:7188
- C:\Windows\System\fftfTOD.exe
  C:\Windows\System\fftfTOD.exe
  2⤵
  PID:8120
- C:\Windows\System\ftqwWQp.exe
  C:\Windows\System\ftqwWQp.exe
  2⤵
  PID:10016
- C:\Windows\System\oDtCNpM.exe
  C:\Windows\System\oDtCNpM.exe
  2⤵
  PID:14116
- C:\Windows\System\LPPdHsL.exe
  C:\Windows\System\LPPdHsL.exe
  2⤵
  PID:7980
- C:\Windows\System\uRLteCY.exe
  C:\Windows\System\uRLteCY.exe
  2⤵
  PID:5944
- C:\Windows\System\KfMDgvB.exe
  C:\Windows\System\KfMDgvB.exe
  2⤵
  PID:10160
- C:\Windows\System\fwzRtqL.exe
  C:\Windows\System\fwzRtqL.exe
  2⤵
  PID:5444
- C:\Windows\System\YFqZwpb.exe
  C:\Windows\System\YFqZwpb.exe
  2⤵
  PID:10128
- C:\Windows\System\gUOclug.exe
  C:\Windows\System\gUOclug.exe
  2⤵
  PID:6172
- C:\Windows\System\CbquDON.exe
  C:\Windows\System\CbquDON.exe
  2⤵
  PID:6324
- C:\Windows\System\tohfMCd.exe
  C:\Windows\System\tohfMCd.exe
  2⤵
  PID:8508
- C:\Windows\System\mzZDgJX.exe
  C:\Windows\System\mzZDgJX.exe
  2⤵
  PID:8560
- C:\Windows\System\evdAHfy.exe
  C:\Windows\System\evdAHfy.exe
  2⤵
  PID:2416
- C:\Windows\System\cPtUzYV.exe
  C:\Windows\System\cPtUzYV.exe
  2⤵
  PID:6692
- C:\Windows\System\PkyVcUZ.exe
  C:\Windows\System\PkyVcUZ.exe
  2⤵
  PID:8940
- C:\Windows\System\Wgbfdac.exe
  C:\Windows\System\Wgbfdac.exe
  2⤵
  PID:3528
- C:\Windows\System\eQCiuqD.exe
  C:\Windows\System\eQCiuqD.exe
  2⤵
  PID:9780
- C:\Windows\System\uBxAcRC.exe
  C:\Windows\System\uBxAcRC.exe
  2⤵
  PID:9664
- C:\Windows\System\ZSqyUSo.exe
  C:\Windows\System\ZSqyUSo.exe
  2⤵
  PID:9164
- C:\Windows\System\hKTONwQ.exe
  C:\Windows\System\hKTONwQ.exe
  2⤵
  PID:8876
- C:\Windows\System\PNIXvFT.exe
  C:\Windows\System\PNIXvFT.exe
  2⤵
  PID:2552
- C:\Windows\System\sNDaeUx.exe
  C:\Windows\System\sNDaeUx.exe
  2⤵
  PID:1944
- C:\Windows\System\kuERRAn.exe
  C:\Windows\System\kuERRAn.exe
  2⤵
  PID:13840
- C:\Windows\System\LtUafOs.exe
  C:\Windows\System\LtUafOs.exe
  2⤵
  PID:6952
- C:\Windows\System\JIldDKS.exe
  C:\Windows\System\JIldDKS.exe
  2⤵
  PID:13392
- C:\Windows\System\YWwnXfl.exe
  C:\Windows\System\YWwnXfl.exe
  2⤵
  PID:11120
- C:\Windows\System\kWUlOda.exe
  C:\Windows\System\kWUlOda.exe
  2⤵
  PID:13388
- C:\Windows\System\eOWQoex.exe
  C:\Windows\System\eOWQoex.exe
  2⤵
  PID:7128
- C:\Windows\System\DryVMsw.exe
  C:\Windows\System\DryVMsw.exe
  2⤵
  PID:5656
- C:\Windows\System\IUEaNri.exe
  C:\Windows\System\IUEaNri.exe
  2⤵
  PID:5364
- C:\Windows\System\FPKrhFz.exe
  C:\Windows\System\FPKrhFz.exe
  2⤵
  PID:5388
- C:\Windows\System\cHpnECf.exe
  C:\Windows\System\cHpnECf.exe
  2⤵
  PID:9400
- C:\Windows\System\WQeLWJs.exe
  C:\Windows\System\WQeLWJs.exe
  2⤵
  PID:13812
- C:\Windows\System\MkRooAQ.exe
  C:\Windows\System\MkRooAQ.exe
  2⤵
  PID:9760
- C:\Windows\System\yympixP.exe
  C:\Windows\System\yympixP.exe
  2⤵
  PID:10140
- C:\Windows\System\NctjfYL.exe
  C:\Windows\System\NctjfYL.exe
  2⤵
  PID:9844
- C:\Windows\System\npYxxry.exe
  C:\Windows\System\npYxxry.exe
  2⤵
  PID:5872
- C:\Windows\System\URiADrA.exe
  C:\Windows\System\URiADrA.exe
  2⤵
  PID:7992
- C:\Windows\System\snosVJI.exe
  C:\Windows\System\snosVJI.exe
  2⤵
  PID:9564
- C:\Windows\System\WFCpyvN.exe
  C:\Windows\System\WFCpyvN.exe
  2⤵
  PID:9616
- C:\Windows\System\rsGeXgM.exe
  C:\Windows\System\rsGeXgM.exe
  2⤵
  PID:8608
- C:\Windows\System\lFNUkXI.exe
  C:\Windows\System\lFNUkXI.exe
  2⤵
  PID:10332
- C:\Windows\System\Lthzvaw.exe
  C:\Windows\System\Lthzvaw.exe
  2⤵
  PID:10248
- C:\Windows\System\KJLMkuB.exe
  C:\Windows\System\KJLMkuB.exe
  2⤵
  PID:10564
- C:\Windows\System\pMmrlTC.exe
  C:\Windows\System\pMmrlTC.exe
  2⤵
  PID:4760
- C:\Windows\System\sAgWPip.exe
  C:\Windows\System\sAgWPip.exe
  2⤵
  PID:7784
- C:\Windows\System\IFFsaGr.exe
  C:\Windows\System\IFFsaGr.exe
  2⤵
  PID:8356
- C:\Windows\System\sZStPnh.exe
  C:\Windows\System\sZStPnh.exe
  2⤵
  PID:8100
- C:\Windows\System\DAKxskT.exe
  C:\Windows\System\DAKxskT.exe
  2⤵
  PID:7864
- C:\Windows\System\LcjUkYa.exe
  C:\Windows\System\LcjUkYa.exe
  2⤵
  PID:10080
- C:\Windows\System\moEhKNb.exe
  C:\Windows\System\moEhKNb.exe
  2⤵
  PID:5172
- C:\Windows\System\lVYtECZ.exe
  C:\Windows\System\lVYtECZ.exe
  2⤵
  PID:3912
- C:\Windows\System\EZrdHuT.exe
  C:\Windows\System\EZrdHuT.exe
  2⤵
  PID:6744
- C:\Windows\System\FHEdKeb.exe
  C:\Windows\System\FHEdKeb.exe
  2⤵
  PID:10540
- C:\Windows\System\LYOyEPE.exe
  C:\Windows\System\LYOyEPE.exe
  2⤵
  PID:10420
- C:\Windows\System\EiZZsOi.exe
  C:\Windows\System\EiZZsOi.exe
  2⤵
  PID:10636
- C:\Windows\System\ZPPZzPb.exe
  C:\Windows\System\ZPPZzPb.exe
  2⤵
  PID:6900
- C:\Windows\System\uUMPcoM.exe
  C:\Windows\System\uUMPcoM.exe
  2⤵
  PID:10760
- C:\Windows\System\DIyYrHT.exe
  C:\Windows\System\DIyYrHT.exe
  2⤵
  PID:13396
- C:\Windows\System\GCnNlaX.exe
  C:\Windows\System\GCnNlaX.exe
  2⤵
  PID:9204
- C:\Windows\System\mvZtknK.exe
  C:\Windows\System\mvZtknK.exe
  2⤵
  PID:9580
- C:\Windows\System\YDfcpeM.exe
  C:\Windows\System\YDfcpeM.exe
  2⤵
  PID:11108
- C:\Windows\System\TJWLqTu.exe
  C:\Windows\System\TJWLqTu.exe
  2⤵
  PID:11012
- C:\Windows\System\IffitWI.exe
  C:\Windows\System\IffitWI.exe
  2⤵
  PID:8048
- C:\Windows\System\XgyRBfH.exe
  C:\Windows\System\XgyRBfH.exe
  2⤵
  PID:3844
- C:\Windows\System\eHvKlIL.exe
  C:\Windows\System\eHvKlIL.exe
  2⤵
  PID:7896
- C:\Windows\System\QBgkjUG.exe
  C:\Windows\System\QBgkjUG.exe
  2⤵
  PID:2140
- C:\Windows\System\SPOfQck.exe
  C:\Windows\System\SPOfQck.exe
  2⤵
  PID:10476
- C:\Windows\System\sTWyDTU.exe
  C:\Windows\System\sTWyDTU.exe
  2⤵
  PID:10740
- C:\Windows\System\xbrmECN.exe
  C:\Windows\System\xbrmECN.exe
  2⤵
  PID:9380
- C:\Windows\System\QgzMOyt.exe
  C:\Windows\System\QgzMOyt.exe
  2⤵
  PID:10396
- C:\Windows\System\kOeFdDB.exe
  C:\Windows\System\kOeFdDB.exe
  2⤵
  PID:10464
- C:\Windows\System\HkDmjeL.exe
  C:\Windows\System\HkDmjeL.exe
  2⤵
  PID:9276
- C:\Windows\System\XALCPkV.exe
  C:\Windows\System\XALCPkV.exe
  2⤵
  PID:11304
- C:\Windows\System\ekxPpRP.exe
  C:\Windows\System\ekxPpRP.exe
  2⤵
  PID:10508
- C:\Windows\System\ZlKRdDU.exe
  C:\Windows\System\ZlKRdDU.exe
  2⤵
  PID:10692
- C:\Windows\System\ahuEXGz.exe
  C:\Windows\System\ahuEXGz.exe
  2⤵
  PID:7764
- C:\Windows\System\URYOBQD.exe
  C:\Windows\System\URYOBQD.exe
  2⤵
  PID:9572
- C:\Windows\System\SXCcXYG.exe
  C:\Windows\System\SXCcXYG.exe
  2⤵
  PID:11028
- C:\Windows\System\tCGfmpE.exe
  C:\Windows\System\tCGfmpE.exe
  2⤵
  PID:7940
- C:\Windows\System\KdcjKPK.exe
  C:\Windows\System\KdcjKPK.exe
  2⤵
  PID:10920
- C:\Windows\System\bQRNhBp.exe
  C:\Windows\System\bQRNhBp.exe
  2⤵
  PID:9812
- C:\Windows\System\qatedBh.exe
  C:\Windows\System\qatedBh.exe
  2⤵
  PID:7712
- C:\Windows\System\CMFhqSt.exe
  C:\Windows\System\CMFhqSt.exe
  2⤵
  PID:11076
- C:\Windows\System\begPAdY.exe
  C:\Windows\System\begPAdY.exe
  2⤵
  PID:12576
- C:\Windows\System\DdPkhGA.exe
  C:\Windows\System\DdPkhGA.exe
  2⤵
  PID:12716
- C:\Windows\System\FrhPJmY.exe
  C:\Windows\System\FrhPJmY.exe
  2⤵
  PID:11808
- C:\Windows\System\eHHqSdX.exe
  C:\Windows\System\eHHqSdX.exe
  2⤵
  PID:10352
- C:\Windows\System\MJgzDeN.exe
  C:\Windows\System\MJgzDeN.exe
  2⤵
  PID:8724
- C:\Windows\System\dxkAsXD.exe
  C:\Windows\System\dxkAsXD.exe
  2⤵
  PID:12736
- C:\Windows\System\ArPmEti.exe
  C:\Windows\System\ArPmEti.exe
  2⤵
  PID:8884
- C:\Windows\System\KlYaFyq.exe
  C:\Windows\System\KlYaFyq.exe
  2⤵
  PID:12304
- C:\Windows\System\VZZVlxi.exe
  C:\Windows\System\VZZVlxi.exe
  2⤵
  PID:11756
- C:\Windows\System\VzEYikE.exe
  C:\Windows\System\VzEYikE.exe
  2⤵
  PID:12216
- C:\Windows\System\vWKJHtD.exe
  C:\Windows\System\vWKJHtD.exe
  2⤵
  PID:11060
- C:\Windows\System\kwauRAX.exe
  C:\Windows\System\kwauRAX.exe
  2⤵
  PID:11504
- C:\Windows\System\MveKDcv.exe
  C:\Windows\System\MveKDcv.exe
  2⤵
  PID:11332
- C:\Windows\System\phmOnDi.exe
  C:\Windows\System\phmOnDi.exe
  2⤵
  PID:12980
- C:\Windows\System\xrgdEIx.exe
  C:\Windows\System\xrgdEIx.exe
  2⤵
  PID:3940
- C:\Windows\System\euPBSjX.exe
  C:\Windows\System\euPBSjX.exe
  2⤵
  PID:9628
- C:\Windows\System\uXRuAtl.exe
  C:\Windows\System\uXRuAtl.exe
  2⤵
  PID:12032
- C:\Windows\System\NnYLicz.exe
  C:\Windows\System\NnYLicz.exe
  2⤵
  PID:11884
- C:\Windows\System\xTRhXfX.exe
  C:\Windows\System\xTRhXfX.exe
  2⤵
  PID:3916
- C:\Windows\System\FlCvXsz.exe
  C:\Windows\System\FlCvXsz.exe
  2⤵
  PID:5704
- C:\Windows\System\eAEmBss.exe
  C:\Windows\System\eAEmBss.exe
  2⤵
  PID:13800
- C:\Windows\System\crPzabq.exe
  C:\Windows\System\crPzabq.exe
  2⤵
  PID:10632
- C:\Windows\System\pKeiVaY.exe
  C:\Windows\System\pKeiVaY.exe
  2⤵
  PID:12824
- C:\Windows\System\FvMsXNo.exe
  C:\Windows\System\FvMsXNo.exe
  2⤵
  PID:7068
- C:\Windows\System\DobdleL.exe
  C:\Windows\System\DobdleL.exe
  2⤵
  PID:5264
- C:\Windows\System\gtfGarg.exe
  C:\Windows\System\gtfGarg.exe
  2⤵
  PID:10324
- C:\Windows\System\BeokkAM.exe
  C:\Windows\System\BeokkAM.exe
  2⤵
  PID:5960
- C:\Windows\System\IHWRGcE.exe
  C:\Windows\System\IHWRGcE.exe
  2⤵
  PID:2376
- C:\Windows\System\mjmKsLl.exe
  C:\Windows\System\mjmKsLl.exe
  2⤵
  PID:12412
- C:\Windows\System\nlbSwgZ.exe
  C:\Windows\System\nlbSwgZ.exe
  2⤵
  PID:13016
- C:\Windows\System\pfHCnzF.exe
  C:\Windows\System\pfHCnzF.exe
  2⤵
  PID:10044
- C:\Windows\System\EdwZIzR.exe
  C:\Windows\System\EdwZIzR.exe
  2⤵
  PID:10912
- C:\Windows\System\IfVkCUW.exe
  C:\Windows\System\IfVkCUW.exe
  2⤵
  PID:10916
- C:\Windows\System\yBnfLgZ.exe
  C:\Windows\System\yBnfLgZ.exe
  2⤵
  PID:12504
- C:\Windows\System\UtAERyD.exe
  C:\Windows\System\UtAERyD.exe
  2⤵
  PID:11988
- C:\Windows\System\NLHzPsR.exe
  C:\Windows\System\NLHzPsR.exe
  2⤵
  PID:11644
- C:\Windows\System\FsOCAAT.exe
  C:\Windows\System\FsOCAAT.exe
  2⤵
  PID:12976
- C:\Windows\System\YQBWkmc.exe
  C:\Windows\System\YQBWkmc.exe
  2⤵
  PID:10500
- C:\Windows\System\gLrMvBy.exe
  C:\Windows\System\gLrMvBy.exe
  2⤵
  PID:11640
- C:\Windows\System\FJSuvCR.exe
  C:\Windows\System\FJSuvCR.exe
  2⤵
  PID:10276
- C:\Windows\System\zIRGEYN.exe
  C:\Windows\System\zIRGEYN.exe
  2⤵
  PID:13560
- C:\Windows\System\JFoNDdo.exe
  C:\Windows\System\JFoNDdo.exe
  2⤵
  PID:12500
- C:\Windows\System\XaBBziG.exe
  C:\Windows\System\XaBBziG.exe
  2⤵
  PID:12256
- C:\Windows\System\lFpkgiy.exe
  C:\Windows\System\lFpkgiy.exe
  2⤵
  PID:10672
- C:\Windows\System\wVNwewW.exe
  C:\Windows\System\wVNwewW.exe
  2⤵
  PID:12628
- C:\Windows\System\OTYitHF.exe
  C:\Windows\System\OTYitHF.exe
  2⤵
  PID:12352
- C:\Windows\System\rUuQeHV.exe
  C:\Windows\System\rUuQeHV.exe
  2⤵
  PID:7396
- C:\Windows\System\ObjCidE.exe
  C:\Windows\System\ObjCidE.exe
  2⤵
  PID:13720
- C:\Windows\System\giYqgjx.exe
  C:\Windows\System\giYqgjx.exe
  2⤵
  PID:9796
- C:\Windows\System\xeclyiQ.exe
  C:\Windows\System\xeclyiQ.exe
  2⤵
  PID:12356
- C:\Windows\System\REQrkZa.exe
  C:\Windows\System\REQrkZa.exe
  2⤵
  PID:5608
- C:\Windows\System\yRlBfoc.exe
  C:\Windows\System\yRlBfoc.exe
  2⤵
  PID:1276
- C:\Windows\System\BryyKWl.exe
  C:\Windows\System\BryyKWl.exe
  2⤵
  PID:10704
- C:\Windows\System\LyvwKDh.exe
  C:\Windows\System\LyvwKDh.exe
  2⤵
  PID:12592
- C:\Windows\System\ZOzmdWe.exe
  C:\Windows\System\ZOzmdWe.exe
  2⤵
  PID:10400
- C:\Windows\System\LzFkASF.exe
  C:\Windows\System\LzFkASF.exe
  2⤵
  PID:11992
- C:\Windows\System\jXZPLSw.exe
  C:\Windows\System\jXZPLSw.exe
  2⤵
  PID:2108
- C:\Windows\System\EWvZtyg.exe
  C:\Windows\System\EWvZtyg.exe
  2⤵
  PID:13740
- C:\Windows\System\JpPsJyO.exe
  C:\Windows\System\JpPsJyO.exe
  2⤵
  PID:11040
- C:\Windows\System\apIvPnV.exe
  C:\Windows\System\apIvPnV.exe
  2⤵
  PID:904
- C:\Windows\System\DNqNllT.exe
  C:\Windows\System\DNqNllT.exe
  2⤵
  PID:9948
- C:\Windows\System\XEZQdJM.exe
  C:\Windows\System\XEZQdJM.exe
  2⤵
  PID:6320
- C:\Windows\System\ZMoQLrk.exe
  C:\Windows\System\ZMoQLrk.exe
  2⤵
  PID:10020
- C:\Windows\System\TqMtRGK.exe
  C:\Windows\System\TqMtRGK.exe
  2⤵
  PID:11484
- C:\Windows\System\AtkNhdh.exe
  C:\Windows\System\AtkNhdh.exe
  2⤵
  PID:13896
- C:\Windows\System\jZkCFXy.exe
  C:\Windows\System\jZkCFXy.exe
  2⤵
  PID:13156
- C:\Windows\System\vEvTjul.exe
  C:\Windows\System\vEvTjul.exe
  2⤵
  PID:4272
- C:\Windows\System\yOdNwcP.exe
  C:\Windows\System\yOdNwcP.exe
  2⤵
  PID:9668
- C:\Windows\System\fFDTmhm.exe
  C:\Windows\System\fFDTmhm.exe
  2⤵
  PID:5928
- C:\Windows\System\QdIvmEx.exe
  C:\Windows\System\QdIvmEx.exe
  2⤵
  PID:10612
- C:\Windows\System\aLGqPdL.exe
  C:\Windows\System\aLGqPdL.exe
  2⤵
  PID:11300
- C:\Windows\System\RsAJfjr.exe
  C:\Windows\System\RsAJfjr.exe
  2⤵
  PID:14312
- C:\Windows\System\VgAAahF.exe
  C:\Windows\System\VgAAahF.exe
  2⤵
  PID:14060
- C:\Windows\System\aVRPpch.exe
  C:\Windows\System\aVRPpch.exe
  2⤵
  PID:10012
- C:\Windows\System\mgLLYTW.exe
  C:\Windows\System\mgLLYTW.exe
  2⤵
  PID:13032
- C:\Windows\System\bPVouTY.exe
  C:\Windows\System\bPVouTY.exe
  2⤵
  PID:6416
- C:\Windows\System\vKXBKtC.exe
  C:\Windows\System\vKXBKtC.exe
  2⤵
  PID:4840
- C:\Windows\System\NMqEmSg.exe
  C:\Windows\System\NMqEmSg.exe
  2⤵
  PID:11192
- C:\Windows\System\apJbrDh.exe
  C:\Windows\System\apJbrDh.exe
  2⤵
  PID:3768
- C:\Windows\System\ojjUELu.exe
  C:\Windows\System\ojjUELu.exe
  2⤵
  PID:12156
- C:\Windows\System\SAURvbI.exe
  C:\Windows\System\SAURvbI.exe
  2⤵
  PID:3984
- C:\Windows\System\nMUqbTK.exe
  C:\Windows\System\nMUqbTK.exe
  2⤵
  PID:12844
- C:\Windows\System\SbiCjOh.exe
  C:\Windows\System\SbiCjOh.exe
  2⤵
  PID:13440
- C:\Windows\System\rypAYmW.exe
  C:\Windows\System\rypAYmW.exe
  2⤵
  PID:3320
- C:\Windows\System\orjIBqM.exe
  C:\Windows\System\orjIBqM.exe
  2⤵
  PID:12452
- C:\Windows\System\hqFRMnS.exe
  C:\Windows\System\hqFRMnS.exe
  2⤵
  PID:4372
- C:\Windows\System\lhiIXSO.exe
  C:\Windows\System\lhiIXSO.exe
  2⤵
  PID:13480
- C:\Windows\System\nNHNTCi.exe
  C:\Windows\System\nNHNTCi.exe
  2⤵
  PID:10724
- C:\Windows\System\oyWFQGG.exe
  C:\Windows\System\oyWFQGG.exe
  2⤵
  PID:4908
- C:\Windows\System\IrMfDyH.exe
  C:\Windows\System\IrMfDyH.exe
  2⤵
  PID:13264
- C:\Windows\System\BmDMNxY.exe
  C:\Windows\System\BmDMNxY.exe
  2⤵
  PID:2240
- C:\Windows\System\SDqwJkH.exe
  C:\Windows\System\SDqwJkH.exe
  2⤵
  PID:1884
- C:\Windows\System\hFYpCBe.exe
  C:\Windows\System\hFYpCBe.exe
  2⤵
  PID:11864
- C:\Windows\System\RQqDJIS.exe
  C:\Windows\System\RQqDJIS.exe
  2⤵
  PID:9448
- C:\Windows\System\jPRKRhQ.exe
  C:\Windows\System\jPRKRhQ.exe
  2⤵
  PID:12548
- C:\Windows\System\zQKFGeu.exe
  C:\Windows\System\zQKFGeu.exe
  2⤵
  PID:13940
- C:\Windows\System\WXDaFKR.exe
  C:\Windows\System\WXDaFKR.exe
  2⤵
  PID:14280
- C:\Windows\System\cyuqejf.exe
  C:\Windows\System\cyuqejf.exe
  2⤵
  PID:9344
- C:\Windows\System\KGnpQDh.exe
  C:\Windows\System\KGnpQDh.exe
  2⤵
  PID:13952
- C:\Windows\System\lZRjlLa.exe
  C:\Windows\System\lZRjlLa.exe
  2⤵
  PID:3964
- C:\Windows\System\oUbMsHC.exe
  C:\Windows\System\oUbMsHC.exe
  2⤵
  PID:12324
- C:\Windows\System\tYylose.exe
  C:\Windows\System\tYylose.exe
  2⤵
  PID:12984
- C:\Windows\System\zHnDHSW.exe
  C:\Windows\System\zHnDHSW.exe
  2⤵
  PID:13852
- C:\Windows\System\BvqTbwf.exe
  C:\Windows\System\BvqTbwf.exe
  2⤵
  PID:13292
- C:\Windows\System\KmjGNMk.exe
  C:\Windows\System\KmjGNMk.exe
  2⤵
  PID:12932
- C:\Windows\System\Gbhqohm.exe
  C:\Windows\System\Gbhqohm.exe
  2⤵
  PID:7148
- C:\Windows\System\EGJoKjs.exe
  C:\Windows\System\EGJoKjs.exe
  2⤵
  PID:14136
- C:\Windows\System\ZQCCfCm.exe
  C:\Windows\System\ZQCCfCm.exe
  2⤵
  PID:5284
- C:\Windows\System\tVtgAsv.exe
  C:\Windows\System\tVtgAsv.exe
  2⤵
  PID:5060
- C:\Windows\System\Nkvoodc.exe
  C:\Windows\System\Nkvoodc.exe
  2⤵
  PID:11912
- C:\Windows\System\PBrkEOV.exe
  C:\Windows\System\PBrkEOV.exe
  2⤵
  PID:11732
- C:\Windows\System\huBRbEP.exe
  C:\Windows\System\huBRbEP.exe
  2⤵
  PID:10300
- C:\Windows\System\OXFdBWb.exe
  C:\Windows\System\OXFdBWb.exe
  2⤵
  PID:3472
- C:\Windows\System\EdOhGgW.exe
  C:\Windows\System\EdOhGgW.exe
  2⤵
  PID:4608
- C:\Windows\System\qgDXBlq.exe
  C:\Windows\System\qgDXBlq.exe
  2⤵
  PID:6328
- C:\Windows\System\vNsjYlX.exe
  C:\Windows\System\vNsjYlX.exe
  2⤵
  PID:13192
- C:\Windows\System\TaZFHNq.exe
  C:\Windows\System\TaZFHNq.exe
  2⤵
  PID:3164
- C:\Windows\System\FKxhStT.exe
  C:\Windows\System\FKxhStT.exe
  2⤵
  PID:6180
- C:\Windows\System\CuFwZgm.exe
  C:\Windows\System\CuFwZgm.exe
  2⤵
  PID:11776
- C:\Windows\System\CkMEWMo.exe
  C:\Windows\System\CkMEWMo.exe
  2⤵
  PID:5524
- C:\Windows\System\GYQtqtH.exe
  C:\Windows\System\GYQtqtH.exe
  2⤵
  PID:13680
- C:\Windows\System\VHgIDad.exe
  C:\Windows\System\VHgIDad.exe
  2⤵
  PID:5320
- C:\Windows\System\nnxgdpF.exe
  C:\Windows\System\nnxgdpF.exe
  2⤵
  PID:5968
- C:\Windows\System\JFxlUNa.exe
  C:\Windows\System\JFxlUNa.exe
  2⤵
  PID:6240
- C:\Windows\System\glSMORo.exe
  C:\Windows\System\glSMORo.exe
  2⤵
  PID:4732
- C:\Windows\System\QCzXudJ.exe
  C:\Windows\System\QCzXudJ.exe
  2⤵
  PID:4084
- C:\Windows\System\WcexxdP.exe
  C:\Windows\System\WcexxdP.exe
  2⤵
  PID:6864
- C:\Windows\System\BftGLHx.exe
  C:\Windows\System\BftGLHx.exe
  2⤵
  PID:11372
- C:\Windows\System\TlwOqEn.exe
  C:\Windows\System\TlwOqEn.exe
  2⤵
  PID:1160
- C:\Windows\System\ioCNfpr.exe
  C:\Windows\System\ioCNfpr.exe
  2⤵
  PID:13452
- C:\Windows\System\BUjbHUd.exe
  C:\Windows\System\BUjbHUd.exe
  2⤵
  PID:5432
- C:\Windows\System\NbuPWWF.exe
  C:\Windows\System\NbuPWWF.exe
  2⤵
  PID:5540
- C:\Windows\System\LJAWfJL.exe
  C:\Windows\System\LJAWfJL.exe
  2⤵
  PID:13580
- C:\Windows\System\qmeFADq.exe
  C:\Windows\System\qmeFADq.exe
  2⤵
  PID:7288
- C:\Windows\System\zIvsZEy.exe
  C:\Windows\System\zIvsZEy.exe
  2⤵
  PID:13988
- C:\Windows\System\NipsgGG.exe
  C:\Windows\System\NipsgGG.exe
  2⤵
  PID:6892
- C:\Windows\System\HFBdrtK.exe
  C:\Windows\System\HFBdrtK.exe
  2⤵
  PID:10560
- C:\Windows\System\vDLifhp.exe
  C:\Windows\System\vDLifhp.exe
  2⤵
  PID:5404
- C:\Windows\System\pylTWCs.exe
  C:\Windows\System\pylTWCs.exe
  2⤵
  PID:2252
- C:\Windows\System\DHwNrAe.exe
  C:\Windows\System\DHwNrAe.exe
  2⤵
  PID:6400
- C:\Windows\System\ukJMTjP.exe
  C:\Windows\System\ukJMTjP.exe
  2⤵
  PID:11228
- C:\Windows\System\fYmUWZY.exe
  C:\Windows\System\fYmUWZY.exe
  2⤵
  PID:7172
- C:\Windows\System\qNqDFRO.exe
  C:\Windows\System\qNqDFRO.exe
  2⤵
  PID:13944
- C:\Windows\System\NQTcoUN.exe
  C:\Windows\System\NQTcoUN.exe
  2⤵
  PID:14124
- C:\Windows\System\xhzHSoR.exe
  C:\Windows\System\xhzHSoR.exe
  2⤵
  PID:528
- C:\Windows\System\Utgiiwg.exe
  C:\Windows\System\Utgiiwg.exe
  2⤵
  PID:14344
- C:\Windows\System\nmJtMPP.exe
  C:\Windows\System\nmJtMPP.exe
  2⤵
  PID:14364
- C:\Windows\System\WhDzafb.exe
  C:\Windows\System\WhDzafb.exe
  2⤵
  PID:14384
- C:\Windows\System\nuwaoJK.exe
  C:\Windows\System\nuwaoJK.exe
  2⤵
  PID:14412
- C:\Windows\System\kfRKWbi.exe
  C:\Windows\System\kfRKWbi.exe
  2⤵
  PID:14436
- C:\Windows\System\rBxtWJh.exe
  C:\Windows\System\rBxtWJh.exe
  2⤵
  PID:14456
- C:\Windows\System\aqnvVQr.exe
  C:\Windows\System\aqnvVQr.exe
  2⤵
  PID:14480
- C:\Windows\System\WNtYotl.exe
  C:\Windows\System\WNtYotl.exe
  2⤵
  PID:14544
- C:\Windows\System\xPFYWyN.exe
  C:\Windows\System\xPFYWyN.exe
  2⤵
  PID:14584
- C:\Windows\System\yykkMTe.exe
  C:\Windows\System\yykkMTe.exe
  2⤵
  PID:14604
- C:\Windows\System\aoIdcfz.exe
  C:\Windows\System\aoIdcfz.exe
  2⤵
  PID:14624
- C:\Windows\System\AjyzFzu.exe
  C:\Windows\System\AjyzFzu.exe
  2⤵
  PID:14644
- C:\Windows\System\idYrBPf.exe
  C:\Windows\System\idYrBPf.exe
  2⤵
  PID:14664
- C:\Windows\System\zWPYWmI.exe
  C:\Windows\System\zWPYWmI.exe
  2⤵
  PID:14688
- C:\Windows\System\PrpuDqB.exe
  C:\Windows\System\PrpuDqB.exe
  2⤵
  PID:14736
- C:\Windows\System\LwzWcTm.exe
  C:\Windows\System\LwzWcTm.exe
  2⤵
  PID:14768
- C:\Windows\System\NPfVYID.exe
  C:\Windows\System\NPfVYID.exe
  2⤵
  PID:14792
- C:\Windows\System\NerIxJv.exe
  C:\Windows\System\NerIxJv.exe
  2⤵
  PID:14816
- C:\Windows\System\Dguqgsk.exe
  C:\Windows\System\Dguqgsk.exe
  2⤵
  PID:14840
- C:\Windows\System\kcIuasp.exe
  C:\Windows\System\kcIuasp.exe
  2⤵
  PID:14896
- C:\Windows\System\TziysOl.exe
  C:\Windows\System\TziysOl.exe
  2⤵
  PID:14948
- C:\Windows\System\RJmsYrL.exe
  C:\Windows\System\RJmsYrL.exe
  2⤵
  PID:14964
- C:\Windows\System\RdjJBIU.exe
  C:\Windows\System\RdjJBIU.exe
  2⤵
  PID:14988
- C:\Windows\System\bmkBCQV.exe
  C:\Windows\System\bmkBCQV.exe
  2⤵
  PID:15016
- C:\Windows\System\zhsDGPg.exe
  C:\Windows\System\zhsDGPg.exe
  2⤵
  PID:15036
- C:\Windows\System\xqNkjpG.exe
  C:\Windows\System\xqNkjpG.exe
  2⤵
  PID:15064
- C:\Windows\System\ShPCama.exe
  C:\Windows\System\ShPCama.exe
  2⤵
  PID:15080
- C:\Windows\System\mhGEMto.exe
  C:\Windows\System\mhGEMto.exe
  2⤵
  PID:15108
- C:\Windows\System\qjyuMkt.exe
  C:\Windows\System\qjyuMkt.exe
  2⤵
  PID:14812
- C:\Windows\System\KATGzxz.exe
  C:\Windows\System\KATGzxz.exe
  2⤵
  PID:14924
- C:\Windows\System\NVQNWwx.exe
  C:\Windows\System\NVQNWwx.exe
  2⤵
  PID:14960
- C:\Windows\System\OOeCSRe.exe
  C:\Windows\System\OOeCSRe.exe
  2⤵
  PID:15032
- C:\Windows\System\kcduMPk.exe
  C:\Windows\System\kcduMPk.exe
  2⤵
  PID:8788
- C:\Windows\System\bbqIkDZ.exe
  C:\Windows\System\bbqIkDZ.exe
  2⤵
  PID:15120
- C:\Windows\System\NvRwSWx.exe
  C:\Windows\System\NvRwSWx.exe
  2⤵
  PID:8916
- C:\Windows\System\epOOHBC.exe
  C:\Windows\System\epOOHBC.exe
  2⤵
  PID:8812
- C:\Windows\System\pkrheeC.exe
  C:\Windows\System\pkrheeC.exe
  2⤵
  PID:9032
- C:\Windows\System\xbiEyBn.exe
  C:\Windows\System\xbiEyBn.exe
  2⤵
  PID:15220
- C:\Windows\System\xRMIRbf.exe
  C:\Windows\System\xRMIRbf.exe
  2⤵
  PID:15244
- C:\Windows\System\QCuRCQs.exe
  C:\Windows\System\QCuRCQs.exe
  2⤵
  PID:15276
- C:\Windows\System\RsGUjzU.exe
  C:\Windows\System\RsGUjzU.exe
  2⤵
  PID:5696

C:\Windows\system32\WerFaultSecure.exe
"C:\Windows\system32\WerFaultSecure.exe" -protectedcrash -p 10212 -i 10212 -h 508 -j 440 -s 556 -d 0
1⤵
PID:13816

C:\Windows\system32\WerFaultSecure.exe
C:\Windows\system32\WerFaultSecure.exe -u -p 10212 -s 764
1⤵
PID:5144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ihgdrvfs.ugq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AAaPEqb.exe

Filesize
1.9MB

MD5
97d34db23a845a8552c45e82a940c64e

SHA1
feb8638a161e45108e33ca3fc5e7d0bc98bf3c2b

SHA256
929a7e0dba825d954275ed5b39c1e11cfbc3222751039d160e91d06be41de1f8

SHA512
6311fec2340eddb84f8d38282e1553e6cae3cc7cfb90e3af92995b4503bacd47bff70551b92496b573f28cc90cfe09c64f201579f0311a3dc712b9c5e07c3c00

Download Submit
C:\Windows\System\ANvuexr.exe

Filesize
1.9MB

MD5
2ce7bfcbaabd840f0075bd82092aa081

SHA1
95c3328a4a2c1921b79c1d467076bde10022f73f

SHA256
95d7b645ac44373d0c3ca61c8878c711ffcb6d02a4924caa02efd3ef679f0270

SHA512
5fe10fac05b4d9613576c0ff43948c414d85493871dd13f30f5c3b7654aaecac965a9a4e24e422973b8250b7f47ed9c4fc54c731920778152eef78de01b6ccae

Download Submit
C:\Windows\System\AYasIPq.exe

Filesize
1.9MB

MD5
df10f4740c75c19d8b0340bbad477c74

SHA1
0e0433a3c5475d3cc1cf1b8f610dfef9125bc6a0

SHA256
fda0ed382f5b9793a32bd4178df8f5929a7c7ed4627cefdc47083ed1e869dace

SHA512
4be966aec64e48f712f7bc2d5ee3a6612b100fc7a98f5d981218768ddc42b1a1d3dd08f7ed831716dcb4f6f1e179d5bebed389680be5d9cda24f3920898845eb

Download Submit
C:\Windows\System\BxRwKdh.exe

Filesize
1.9MB

MD5
d635a45164440b227d28140898532cd2

SHA1
ca8dadd21fe9e4548382d47d7c7fcba4373577d2

SHA256
b3b0cac99d3ac27c830cf543120987283dcd095d721e55c2d42fbc30e586e252

SHA512
c1ffe1e641ae8ff6df88ae1e40a2a96e2a17228874d72af059c171e1849ef3fef4b73bdf482279119b1509b12341e1d634d2d47177c983467ab016ff29a27fd6

Download Submit
C:\Windows\System\FENvdog.exe

Filesize
1.9MB

MD5
bb6909af71c9e6969c42c31adb17978c

SHA1
13d4a9a06a8b9021301d1b2b8458e4932bf1d0f2

SHA256
c0a064cf6cf31a97c0e042fde548f1d95359f47da00cd00cfc87d34e7a260052

SHA512
9c09284e80cbfb7bcc66f1d1e0fc538afa6c962b6581e70ea6469e9f3e919292f097d439dcc098120881f02c895d8c561a3ca201e0b46edf000aa312c8fcd824

Download Submit
C:\Windows\System\FEVzcqd.exe

Filesize
1.9MB

MD5
f0929fdb2209fa24938f12cade28297d

SHA1
f2ed6b26cf9d0d24c2b23c959f1b3310b5437ca7

SHA256
52d41bb154dc6a1051f865173d6c51525928953cfc4f76516a14724502b4fd40

SHA512
701575d5374d9bb467fb7c67a0c071e98dffec1b5bb28b13ecaebf1739ae0f1aa74b536d44253f178a9bfd4d8bb0c75e3a434613c77c7e243e9ad54bd09dd820

Download Submit
C:\Windows\System\IUbPDPK.exe

Filesize
1.9MB

MD5
bc9aa6c0e52a39a21ffe724ad2417e17

SHA1
03cb009cb2cb5e3d8c4bd377d2dbc799ea5198b4

SHA256
6eb3c58aeeea2dcc7afde146d4a4f8c26361a65181f1b8f86a329af0b604d3e8

SHA512
e9c1ddf261cbb247205f03cddbf52350c0fa7ce7288708f3e2b38606e27b1e4c20d7eef6d18cf331dc4fcf403add3adfaf655ac7cc96f17bfce46a0210232c41

Download Submit
C:\Windows\System\IaunLLk.exe

Filesize
1.9MB

MD5
d19084696fb4446bcf84a39f7a0c0dcf

SHA1
e7b56ee1e74f747bcf09c8b40359794626bcb269

SHA256
d271c20d4a1bc93401741c4f1008f155089c6a5e4ab1dd2e7d18e3b4a335a438

SHA512
4083fbd6e95f6bd3be1ee6109ffff5154778eb017cb635815022b103d325e1cb6e931054ce9c020b199d21d2abe2a2d31b539126e13355919edd0948264a7079

Download Submit
C:\Windows\System\JHiOdYH.exe

Filesize
1.9MB

MD5
8822be09dd6620460089b9d25a8a2afe

SHA1
800e6c496c95d7f025f27615fb14ef1df6f9177b

SHA256
55c42138637d9b4cb1341986da5cc87de07189aad271d50d3e1a6a8ec134267c

SHA512
65ac61b84e5248d8d23f1abe2e25aa70353bbe443c0afd7eb54fe9920c15337d1b92da5a99dfcff5da5d2a680c0737698bbb8a70585f94e0f6458fce765fe113

Download Submit
C:\Windows\System\JZcVXzc.exe

Filesize
1.9MB

MD5
1a3d136624cdb77abb477bb115845077

SHA1
b096ef49a721c8a37a71c7fa970b32ca3ca032b0

SHA256
55f159c2ad4e790b1ac106aa8befcb895a65eea9e5a399271a0d76bb05bc2739

SHA512
3de5f7ffccf2b5952cd511f54f9f10db8bf6683c38df1c6d53479c6fa0e7b6129dbaf1e15601e791805be04ef4c3c8d1b7bef81a5898d006b1a06a66cab20b5c

Download Submit
C:\Windows\System\MtqpsRM.exe

Filesize
1.9MB

MD5
491d4836319c78bb95a0a326566a6fb9

SHA1
4d8e02e6123985119285cf241ab935bf681fdeb2

SHA256
e0f24882dfad4b7125c2082ff6d010bd374b3d69c85211ff5f88148e921e0080

SHA512
3cba3cfd48e4588353397dad9fce76448db16eff653490fe96c1343f57e04ddaec15b06c05a8d3fcfeaa589ff6be0bf7a143fe712e63903a28a1e6723a44cd8d

Download Submit
C:\Windows\System\QFyTeDw.exe

Filesize
1.9MB

MD5
548dbc3b1ab6f514ece4c6fb87873ed2

SHA1
d14bdf3053ee67ed27aa12499f2262046cfd50eb

SHA256
a468f73094d175ab0e172207a3f94267e9869b63ac32f2349735ac1497295d74

SHA512
eda59dfa518c1f98fe9b1c175dda941f23302645d3d270e1a114446e4872e92cca30d0e0908ec3d1b02c6f9fbf549a24ef448b0ccad1b1b9d79f5ad854b851c8

Download Submit
C:\Windows\System\QQpJfFq.exe

Filesize
1.9MB

MD5
33ef6068ec60136b90af4a6e54357f4e

SHA1
8409a84ad69666ce0804c532e66dcf32066804f0

SHA256
7bc7fe656a0ae1a2040f9fd2211c4c4340138b95e6cd86e5604c197def482cc4

SHA512
d7e71e5c370d940ab5f050cc73be02214d7eb41e7b285acfd840be87ed2f32ea423f54d22c07aa14ec2c167f079c82e44ecc1355a34caea22bd67ce40431b426

Download Submit
C:\Windows\System\VWCwUDh.exe

Filesize
1.9MB

MD5
18e5e68868efe20cc04e345a84883632

SHA1
37bd06ec7f53f15d77bde570be91986deddecb1e

SHA256
768e2d50a152be66da390ef722f5166747bca33b1b1037139fe7da96b4cc4acc

SHA512
6e66e7a35a80d2107fada8fc603342f7fb474e0ace5cb13e29295976fb37c0223af12d65fd43a4ee79b8867c99040708a0fc57c8116889df11de9627cf6b33af

Download Submit
C:\Windows\System\WnBvWTX.exe

Filesize
1.9MB

MD5
796fb7d9de18e57e2c8cf534345b6689

SHA1
90b32b9755463eb9c8d6ec4a9114a0f6b0161423

SHA256
f2aa314dfebe62cb36e7f6e9281ffcd6ca58792568429a8d6d16d8ccff1cb5f7

SHA512
722018e2336a205962408e3e7d1c0311eaa089bc8198088ee45f4b2d03993032ec25ca46b5a35b28bc00654fcc199737795d2c457581b4bcd82cb6a9b789d69f

Download Submit
C:\Windows\System\YDHfIZv.exe

Filesize
1.9MB

MD5
fe1c447ba1e58716bd678c5370c844dd

SHA1
94b721489e15b01ff9fc77c9dd27ee57204b0c37

SHA256
f3274fbcd722e1a89a9aa1e85be07b614320e8a60678cd9d4e43f9fcef99edc1

SHA512
f2c87fb013ea8f2267a2d353e300c37e0021f35e0645ddacfc0b02cb292b2e13a15b245afe8fd9ec013d6432c4b9ab82b038d25c42557b55e57b0891d0e3a47f

Download Submit
C:\Windows\System\bRhODwf.exe

Filesize
1.9MB

MD5
3cd756485df8c6e5f5da670a3b01a1b2

SHA1
6c552dc7f6c391084419754255fec0c94e7d642a

SHA256
a7a7a289ec6b94a96123497ba43b9ef8f39a5e5a195a9da37187502b249e2df9

SHA512
feb9b661721e0a6326244e5bd3f6b19e2be28b0d900c6583fed873373bfc1a4e575e840f3bc261f2218d9660189c313f6ad3ba975b80f748cd6be71a0976cd8d

Download Submit
C:\Windows\System\gEHsOLs.exe

Filesize
1.9MB

MD5
f15fb1877565014a880830656a3a9a74

SHA1
131955382b3c959a416bb2cc8f7ae79a8c260b7b

SHA256
9d8445a7003be4c97f9895333a8d4d1a2566919f9ec91ae693f5e591373e6cdc

SHA512
faf616b5b959639736e42b2d3f190d74848bd871d8951addb56d6f4ccde72c9f7fdf2f997f7c7919a1d1a8b6229a63da257feb4ee600f4a52d6d0cac35416b93

Download Submit
C:\Windows\System\hbiIxfB.exe

Filesize
1.9MB

MD5
5664223016dcf6efc84b41f8e694df4c

SHA1
b33aec1d683f512dad105049178963cd64f8ef28

SHA256
d8eaf447ebee54b07353d4e7c28baab1d5fb61e433097544e93045cc1e3502a8

SHA512
358f060e7647f4f61df4077fa60f0874b2f617c57afcf12da5e8dd950ff2d7d0fa2a008be7c267db997c19a68259d3e146e5cee4b6b87b1032457c47ce763ab0

Download Submit
C:\Windows\System\jLLSNYY.exe

Filesize
1.9MB

MD5
11d966f73ee89728b3d5e6019de377fe

SHA1
f6f71fa5fd675210e2a989852aa35759fc632c44

SHA256
6f660902166dec9100f6680386048df1d4dbe17218e42218341c21e14e0fa2a3

SHA512
d71d312555994dc711457789f104c176f0ec199f76acd62576ec28db1086497b00876c6e41bc7829d041358c869d1d6d3381411e963283fd039ac985dd72297b

Download Submit
C:\Windows\System\kdYJfqV.exe

Filesize
1.9MB

MD5
613caa056009b5d3027a67c0dc568e01

SHA1
44a2619895c072c23c06263faabd4f298a2fcf9f

SHA256
12c40115a1e3906879180a65cd7592cb5b98160356e608e81589b2c6381674e5

SHA512
3eaf1945fce00fddd97f435426812644b82924550b20ddc1b00429888f50ca58bcbf932c694190e8391cee7f917e44bdea303ede02d44a7c0b767d49dbc32a65

Download Submit
C:\Windows\System\lmYBdJJ.exe

Filesize
1.9MB

MD5
b7b6b3b3e37cc310bf72abe547cd4f62

SHA1
faa8390a9ea07c8244c23a8dc4da39854146cf12

SHA256
712e98780d5385ee805092543bca2e920b9dec5c6c048deeaf2ae5a3208bef5d

SHA512
b4a566b6454d3b564f37dd37630c43acfb0493b7d6d6687ecb4fa158f9ec4323d75248d00d6431379d2655a8f7989bde3174cbffc660389f53ee49d943758655

Download Submit
C:\Windows\System\mPzcdEZ.exe

Filesize
1.9MB

MD5
89e47c96dc01a83112cf8297677912c6

SHA1
f45688cbdb7d3daf74e5e612e2d044e1931f021f

SHA256
6f4a6b7ebc286a695e28b058584415add99b2cf078c6a5f3c5346b86ad169163

SHA512
3f79cbc28fc6483152a796cf0b45a5c9a33c7e50028bc72cee85645618195770ac4171845cdb955ab7f96f47094948e9e21a44a326fa9744eb7bdeee2c97fbc8

Download Submit
C:\Windows\System\qHIChRX.exe

Filesize
1.9MB

MD5
ba303d64389f05e8452ab70b01b159d3

SHA1
ebb044874472d17bbf49cf1db38204b12c7b1f15

SHA256
2e57f1e83324b9982c648d51c05c7bd3464b017b85945cf53509887f44475fb0

SHA512
fc60f38084e4ead988cd9873c0011c7c16f2b5e50eb94690781f987362df6e40c644b8a95445fb668bb681218bda34bcffba46281b793a4f1f22cda39a8d85e5

Download Submit
C:\Windows\System\qNdYAxF.exe

Filesize
1.9MB

MD5
268e96d8d14c4f7dd8f12c78d7dc2953

SHA1
333fd0dec925da26cbdc6296f63016a5ef61d6fc

SHA256
ecff9b1f963a71817e9660403092c07d1647393dc50ee43990e1f878632f1475

SHA512
44a3383f245cacc70e4222e1c30d73d2baf2a428544b6a5823ec56ab2bc6aa9bf4a23078f3699d400be19f70fb79d2f59f51ca6b3004740841c40064b5440eb5

Download Submit
C:\Windows\System\rwrhetH.exe

Filesize
1.9MB

MD5
2038fef360512c541750584abd489c00

SHA1
fb10ee440e51709522f5ac09bca6d2dea4bc4c4e

SHA256
5808e528d0ab6a1aca0f12658976a8bf8fa068441d94125554e361536ef4929b

SHA512
7c656b8cafd145d366076b8cb51a826cbe7772b091222bea8e3c4cb3dba5dc2021bfd77bc48ea6c384419d70f5aaddc8ba92c026baae4bbc8c5ba2579e9909da

Download Submit
C:\Windows\System\soNHgUI.exe

Filesize
1.9MB

MD5
652e923af95147094f74984110a06115

SHA1
a9915ef4f08d98e1a6d3cf7e89f6cce8ec9ca101

SHA256
7309b7b38e9a881e9d24abf8a5e5bb2c531e36697f6ac64fd88240db9941b8e7

SHA512
9ba8b94810824ed81e21475a8eccb38d4f4086142554687d95f23434273d4545ba92700ac5eba04319d81d92e5d3b4c218f74943db501e078f1bb95d56254140

Download Submit
C:\Windows\System\svdgGIy.exe

Filesize
1.9MB

MD5
20d2e6448631885809ec550c7f327316

SHA1
b5d802561935a5ebafa3969c41274db42efa42a4

SHA256
8f8258eb2c2dd557a74189f842b8515e417b9103fa224a041b47f71e4f2b42b3

SHA512
1b8ec800e9cc7ce1370f4eede0544d515f218a7dfb0f4be119dad0fc555f795822d30f913493719ab7618630a3279a7d62e8e2f29d7a4914652a4583eff111d6

Download Submit
C:\Windows\System\uYbLoWP.exe

Filesize
1.9MB

MD5
e2bf91059fdd95c5db98eeb026521f27

SHA1
15f541d43a7d57f3a414d8edb75a3b854e4b7f54

SHA256
b63bbb9b611706996dbad3c15919b97afa93791771a929ff821a2ca626f0cb4d

SHA512
f8060aea366f4cfc96891b9f4b88136c10b935f1cc77f33934b695cdee517ea9be9fbfef4042faf4dbf3a9f592bf711e4b41f3560aa0c34c8356421b69e8a488

Download Submit
C:\Windows\System\uhuDHin.exe

Filesize
1.9MB

MD5
09b83e2ecc0e22bbeb8774654b996a1f

SHA1
1c5be498f0f74322a42f557ab69932d9da001a30

SHA256
9dedaf477576615546908f46cf7688aa1951b27931e1e06c2841d8b4f16acb65

SHA512
68f378b71fc0e035cd94606e26e5553b7db9208ede1fc8e6e6fc4292af579aa1aafca63dffac1476a6d156f2d89b7eed899b0422f9f4867f0edcc4c86af1c3a5

Download Submit
C:\Windows\System\yswzLtg.exe

Filesize
1.9MB

MD5
ef804489630436a022b0d835bc7c76df

SHA1
de601c4708391ec753f18e01459c654713baf7c4

SHA256
42c4d1caa16aaf5ba4a2176fad8959afd8d5d94a850023585d76e095e7fb6fff

SHA512
b7dcd1e5d70deb52508342237a58f1adbd0ac1e5487bd34591c40376bf4c1c9e09f2a9a83c5dd2d27f3b60cbb1fcdf06b57f42954003f0c87f52e12205cc676f

Download Submit
C:\Windows\System\zTsSmIV.exe

Filesize
1.9MB

MD5
e59cef2d4eec3b03a012d5a543515f6e

SHA1
34ba4ebedbdfe99b968cdd01568f2b78324e10a4

SHA256
0846b79b3ca176d93b10b72d0ff5056296e8b9cbb8951fcce7c8269b221e06d7

SHA512
9357e770c2a7063fcb6fbbc9465b7654a7deae14b1e38fe9311e0e919f8ef25a520c9c83d9369952573acf78c42de5b2a99cb29cb5b5ae384a4c5f819867005e

Download Submit
memory/64-381-0x00007FF6BBB60000-0x00007FF6BBF52000-memory.dmp

Filesize
3.9MB

Download
memory/64-2198-0x00007FF6BBB60000-0x00007FF6BBF52000-memory.dmp

Filesize
3.9MB

Download
memory/920-372-0x00007FF6A6B20000-0x00007FF6A6F12000-memory.dmp

Filesize
3.9MB

Download
memory/1432-0-0x00007FF79C3D0000-0x00007FF79C7C2000-memory.dmp

Filesize
3.9MB

Download
memory/1432-1-0x000001BAC2140000-0x000001BAC2150000-memory.dmp

Filesize
64KB

Download
memory/1432-4091-0x00007FF79C3D0000-0x00007FF79C7C2000-memory.dmp

Filesize
3.9MB

Download
memory/1656-2154-0x00007FF69BC70000-0x00007FF69C062000-memory.dmp

Filesize
3.9MB

Download
memory/1656-359-0x00007FF69BC70000-0x00007FF69C062000-memory.dmp

Filesize
3.9MB

Download
memory/1712-50-0x00007FF66D780000-0x00007FF66DB72000-memory.dmp

Filesize
3.9MB

Download
memory/1712-1943-0x00007FF66D780000-0x00007FF66DB72000-memory.dmp

Filesize
3.9MB

Download
memory/2244-335-0x00007FF6885C0000-0x00007FF6889B2000-memory.dmp

Filesize
3.9MB

Download
memory/2244-1947-0x00007FF6885C0000-0x00007FF6889B2000-memory.dmp

Filesize
3.9MB

Download
memory/2440-2014-0x00007FF720420000-0x00007FF720812000-memory.dmp

Filesize
3.9MB

Download
memory/2440-356-0x00007FF720420000-0x00007FF720812000-memory.dmp

Filesize
3.9MB

Download
memory/2548-41-0x00007FF9872D0000-0x00007FF987D91000-memory.dmp

Filesize
10.8MB

Download
memory/2548-825-0x000001CD73C60000-0x000001CD74406000-memory.dmp

Filesize
7.6MB

Download
memory/2548-46-0x00007FF9872D0000-0x00007FF987D91000-memory.dmp

Filesize
10.8MB

Download
memory/2548-4601-0x00007FF9872D3000-0x00007FF9872D5000-memory.dmp

Filesize
8KB

Download
memory/2548-35-0x00007FF9872D0000-0x00007FF987D91000-memory.dmp

Filesize
10.8MB

Download
memory/2548-21-0x000001CD725F0000-0x000001CD72612000-memory.dmp

Filesize
136KB

Download
memory/2548-4957-0x00007FF9872D0000-0x00007FF987D91000-memory.dmp

Filesize
10.8MB

Download
memory/2548-3-0x00007FF9872D3000-0x00007FF9872D5000-memory.dmp

Filesize
8KB

Download
memory/2548-4951-0x00007FF9872D0000-0x00007FF987D91000-memory.dmp

Filesize
10.8MB

Download
memory/2548-4948-0x00007FF9872D0000-0x00007FF987D91000-memory.dmp

Filesize
10.8MB

Download
memory/3136-2145-0x00007FF7A9A80000-0x00007FF7A9E72000-memory.dmp

Filesize
3.9MB

Download
memory/3136-378-0x00007FF7A9A80000-0x00007FF7A9E72000-memory.dmp

Filesize
3.9MB

Download
memory/3228-354-0x00007FF786F60000-0x00007FF787352000-memory.dmp

Filesize
3.9MB

Download
memory/3228-2011-0x00007FF786F60000-0x00007FF787352000-memory.dmp

Filesize
3.9MB

Download
memory/3312-369-0x00007FF772BE0000-0x00007FF772FD2000-memory.dmp

Filesize
3.9MB

Download
memory/3312-2148-0x00007FF772BE0000-0x00007FF772FD2000-memory.dmp

Filesize
3.9MB

Download
memory/3412-1951-0x00007FF7CEF80000-0x00007FF7CF372000-memory.dmp

Filesize
3.9MB

Download
memory/3412-51-0x00007FF7CEF80000-0x00007FF7CF372000-memory.dmp

Filesize
3.9MB

Download
memory/3616-49-0x00007FF64D230000-0x00007FF64D622000-memory.dmp

Filesize
3.9MB

Download
memory/3616-1883-0x00007FF64D230000-0x00007FF64D622000-memory.dmp

Filesize
3.9MB

Download
memory/3636-338-0x00007FF7DDDE0000-0x00007FF7DE1D2000-memory.dmp

Filesize
3.9MB

Download
memory/3656-377-0x00007FF6B37D0000-0x00007FF6B3BC2000-memory.dmp

Filesize
3.9MB

Download
memory/3656-2142-0x00007FF6B37D0000-0x00007FF6B3BC2000-memory.dmp

Filesize
3.9MB

Download
memory/3692-346-0x00007FF6B53F0000-0x00007FF6B57E2000-memory.dmp

Filesize
3.9MB

Download
memory/3692-2032-0x00007FF6B53F0000-0x00007FF6B57E2000-memory.dmp

Filesize
3.9MB

Download
memory/3792-1789-0x00007FF7F9630000-0x00007FF7F9A22000-memory.dmp

Filesize
3.9MB

Download
memory/3792-7-0x00007FF7F9630000-0x00007FF7F9A22000-memory.dmp

Filesize
3.9MB

Download
memory/4076-361-0x00007FF7038C0000-0x00007FF703CB2000-memory.dmp

Filesize
3.9MB

Download
memory/4076-2101-0x00007FF7038C0000-0x00007FF703CB2000-memory.dmp

Filesize
3.9MB

Download
memory/4092-2201-0x00007FF6009C0000-0x00007FF600DB2000-memory.dmp

Filesize
3.9MB

Download
memory/4092-382-0x00007FF6009C0000-0x00007FF600DB2000-memory.dmp

Filesize
3.9MB

Download
memory/4380-2143-0x00007FF6342E0000-0x00007FF6346D2000-memory.dmp

Filesize
3.9MB

Download
memory/4380-363-0x00007FF6342E0000-0x00007FF6346D2000-memory.dmp

Filesize
3.9MB

Download
memory/4460-47-0x00007FF7A6380000-0x00007FF7A6772000-memory.dmp

Filesize
3.9MB

Download
memory/4516-358-0x00007FF7A96A0000-0x00007FF7A9A92000-memory.dmp

Filesize
3.9MB

Download
memory/4516-2146-0x00007FF7A96A0000-0x00007FF7A9A92000-memory.dmp

Filesize
3.9MB

Download
memory/4740-42-0x00007FF6F5510000-0x00007FF6F5902000-memory.dmp

Filesize
3.9MB

Download
memory/4744-366-0x00007FF72C6C0000-0x00007FF72CAB2000-memory.dmp

Filesize
3.9MB

Download
memory/4744-2147-0x00007FF72C6C0000-0x00007FF72CAB2000-memory.dmp

Filesize
3.9MB

Download
memory/4756-352-0x00007FF6280D0000-0x00007FF6284C2000-memory.dmp

Filesize
3.9MB

Download
memory/4756-1953-0x00007FF6280D0000-0x00007FF6284C2000-memory.dmp

Filesize
3.9MB

Download
memory/4868-1963-0x00007FF6606C0000-0x00007FF660AB2000-memory.dmp

Filesize
3.9MB

Download
memory/4868-351-0x00007FF6606C0000-0x00007FF660AB2000-memory.dmp

Filesize
3.9MB

Download