xmrig | b401487bc8b5b87f28f3a42a7b76d250d26aa68169d0b65ff64ad2c15b580b78

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2024, 02:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
Size

2.8MB
MD5

1586689957b6eabd23350e2f28a9cc3c
SHA1

d0690cba5911cdefb023415e542eb16d58e5db30
SHA256

b401487bc8b5b87f28f3a42a7b76d250d26aa68169d0b65ff64ad2c15b580b78
SHA512

b41361b7b5f1aa6d12f1cbabba45df6298902a949f21e9ad407899c8b3b818ab27f9d29f37e860efe703221adb8de884677f039e152f359345394e76d231e3e2
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5I/8:NABh

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 45 IoCs

miner

resource	yara_rule
behavioral2/memory/4712-683-0x00007FF74EED0000-0x00007FF74F2C2000-memory.dmp	xmrig
behavioral2/memory/3460-697-0x00007FF671ED0000-0x00007FF6722C2000-memory.dmp	xmrig
behavioral2/memory/732-729-0x00007FF762530000-0x00007FF762922000-memory.dmp	xmrig
behavioral2/memory/3732-727-0x00007FF7163A0000-0x00007FF716792000-memory.dmp	xmrig
behavioral2/memory/4348-720-0x00007FF625C60000-0x00007FF626052000-memory.dmp	xmrig
behavioral2/memory/1836-717-0x00007FF7CE540000-0x00007FF7CE932000-memory.dmp	xmrig
behavioral2/memory/1772-695-0x00007FF7418A0000-0x00007FF741C92000-memory.dmp	xmrig
behavioral2/memory/4676-684-0x00007FF7F8430000-0x00007FF7F8822000-memory.dmp	xmrig
behavioral2/memory/3864-738-0x00007FF6BBBD0000-0x00007FF6BBFC2000-memory.dmp	xmrig
behavioral2/memory/5064-739-0x00007FF631DA0000-0x00007FF632192000-memory.dmp	xmrig
behavioral2/memory/2520-750-0x00007FF7491E0000-0x00007FF7495D2000-memory.dmp	xmrig
behavioral2/memory/3796-749-0x00007FF7EB470000-0x00007FF7EB862000-memory.dmp	xmrig
behavioral2/memory/2876-745-0x00007FF7B8E50000-0x00007FF7B9242000-memory.dmp	xmrig
behavioral2/memory/5076-744-0x00007FF698670000-0x00007FF698A62000-memory.dmp	xmrig
behavioral2/memory/1472-88-0x00007FF60F3E0000-0x00007FF60F7D2000-memory.dmp	xmrig
behavioral2/memory/1560-84-0x00007FF6A8900000-0x00007FF6A8CF2000-memory.dmp	xmrig
behavioral2/memory/4672-78-0x00007FF75F7C0000-0x00007FF75FBB2000-memory.dmp	xmrig
behavioral2/memory/3456-74-0x00007FF6D7870000-0x00007FF6D7C62000-memory.dmp	xmrig
behavioral2/memory/752-65-0x00007FF7DD8A0000-0x00007FF7DDC92000-memory.dmp	xmrig
behavioral2/memory/1184-60-0x00007FF658430000-0x00007FF658822000-memory.dmp	xmrig
behavioral2/memory/4512-53-0x00007FF760090000-0x00007FF760482000-memory.dmp	xmrig
behavioral2/memory/2380-51-0x00007FF7FAEF0000-0x00007FF7FB2E2000-memory.dmp	xmrig
behavioral2/memory/3456-3855-0x00007FF6D7870000-0x00007FF6D7C62000-memory.dmp	xmrig
behavioral2/memory/2380-3857-0x00007FF7FAEF0000-0x00007FF7FB2E2000-memory.dmp	xmrig
behavioral2/memory/4512-3865-0x00007FF760090000-0x00007FF760482000-memory.dmp	xmrig
behavioral2/memory/4672-3870-0x00007FF75F7C0000-0x00007FF75FBB2000-memory.dmp	xmrig
behavioral2/memory/1184-3874-0x00007FF658430000-0x00007FF658822000-memory.dmp	xmrig
behavioral2/memory/1560-3877-0x00007FF6A8900000-0x00007FF6A8CF2000-memory.dmp	xmrig
behavioral2/memory/752-3880-0x00007FF7DD8A0000-0x00007FF7DDC92000-memory.dmp	xmrig
behavioral2/memory/5076-3887-0x00007FF698670000-0x00007FF698A62000-memory.dmp	xmrig
behavioral2/memory/1472-3891-0x00007FF60F3E0000-0x00007FF60F7D2000-memory.dmp	xmrig
behavioral2/memory/2876-3896-0x00007FF7B8E50000-0x00007FF7B9242000-memory.dmp	xmrig
behavioral2/memory/2088-3884-0x00007FF70CA40000-0x00007FF70CE32000-memory.dmp	xmrig
behavioral2/memory/3796-3899-0x00007FF7EB470000-0x00007FF7EB862000-memory.dmp	xmrig
behavioral2/memory/2520-3902-0x00007FF7491E0000-0x00007FF7495D2000-memory.dmp	xmrig
behavioral2/memory/732-3920-0x00007FF762530000-0x00007FF762922000-memory.dmp	xmrig
behavioral2/memory/5064-3931-0x00007FF631DA0000-0x00007FF632192000-memory.dmp	xmrig
behavioral2/memory/3460-3926-0x00007FF671ED0000-0x00007FF6722C2000-memory.dmp	xmrig
behavioral2/memory/4676-3923-0x00007FF7F8430000-0x00007FF7F8822000-memory.dmp	xmrig
behavioral2/memory/4348-3917-0x00007FF625C60000-0x00007FF626052000-memory.dmp	xmrig
behavioral2/memory/1836-3916-0x00007FF7CE540000-0x00007FF7CE932000-memory.dmp	xmrig
behavioral2/memory/1772-3914-0x00007FF7418A0000-0x00007FF741C92000-memory.dmp	xmrig
behavioral2/memory/3732-3910-0x00007FF7163A0000-0x00007FF716792000-memory.dmp	xmrig
behavioral2/memory/4712-3908-0x00007FF74EED0000-0x00007FF74F2C2000-memory.dmp	xmrig
behavioral2/memory/3864-3912-0x00007FF6BBBD0000-0x00007FF6BBFC2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
9	4628	powershell.exe
11	4628	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4628	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4208	oLzlIWX.exe
3456	LiitNQE.exe
2380	HIREIfT.exe
4512	YUkkczo.exe
4672	wJbTmIQ.exe
1184	wgLYnDF.exe
1560	WczQRup.exe
752	lKeNRrt.exe
1472	hXuIqgv.exe
2088	rVqBkqp.exe
5076	IIYnEnJ.exe
2876	aZjnLNP.exe
3796	CkPMHIa.exe
2520	KLnRAMQ.exe
4712	Qgbthcl.exe
4676	QRcoZyn.exe
1772	NTXTlvq.exe
3460	TyEQgXM.exe
1836	aLaehqV.exe
4348	KZHVuhR.exe
3732	IENPVtd.exe
732	MxiZMKs.exe
3864	TJlyHsx.exe
5064	MLQhRoO.exe
3048	kUgCloQ.exe
2776	ZbufLhA.exe
4576	MZHphVz.exe
2184	aFPYJQt.exe
2124	DAeKqHG.exe
2300	EHvyFsJ.exe
3336	FxTjOlW.exe
1300	LFGideE.exe
3588	krjdHqX.exe
2364	kTkmPhA.exe
1616	paImAgP.exe
3632	JxaGIum.exe
3972	RyShSUg.exe
4044	kqwDNMc.exe
2576	XccfzyU.exe
384	JGkVhVW.exe
1212	uLxilOk.exe
4056	Pohkoir.exe
4508	aNLfzeF.exe
3568	OLPzSvE.exe
4540	xSQMZHT.exe
1068	zJtcmcc.exe
1420	acFCwEf.exe
4360	MrSoojB.exe
844	seePbDO.exe
3932	yDeacWN.exe
556	UyKRYvT.exe
2356	wlZlRkP.exe
1872	aSCzhmk.exe
4720	yrZBaSA.exe
1148	usiHIxx.exe
2716	boJXCOE.exe
4944	HPwdCCj.exe
2888	KivnQEV.exe
3676	fjveZPv.exe
5028	wyzNxsc.exe
3644	Jenmisg.exe
2368	EtUTqjt.exe
4300	mDkEkYs.exe
3028	ihgoWfn.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1800-0-0x00007FF6B4AC0000-0x00007FF6B4EB2000-memory.dmp	upx
behavioral2/files/0x000d000000023ab7-5.dat	upx
behavioral2/files/0x000a000000023b76-7.dat	upx
behavioral2/files/0x000b000000023b75-15.dat	upx
behavioral2/files/0x000a000000023b77-22.dat	upx
behavioral2/files/0x000a000000023b79-41.dat	upx
behavioral2/files/0x000b000000023b7b-50.dat	upx
behavioral2/files/0x000a000000023b7c-63.dat	upx
behavioral2/memory/2088-70-0x00007FF70CA40000-0x00007FF70CE32000-memory.dmp	upx
behavioral2/files/0x000a000000023b7e-80.dat	upx
behavioral2/files/0x000b000000023b73-85.dat	upx
behavioral2/files/0x000a000000023b82-101.dat	upx
behavioral2/files/0x000a000000023b84-111.dat	upx
behavioral2/files/0x000a000000023b86-121.dat	upx
behavioral2/files/0x000a000000023b8d-156.dat	upx
behavioral2/files/0x000a000000023b92-181.dat	upx
behavioral2/memory/4712-683-0x00007FF74EED0000-0x00007FF74F2C2000-memory.dmp	upx
behavioral2/memory/3460-697-0x00007FF671ED0000-0x00007FF6722C2000-memory.dmp	upx
behavioral2/memory/732-729-0x00007FF762530000-0x00007FF762922000-memory.dmp	upx
behavioral2/memory/3732-727-0x00007FF7163A0000-0x00007FF716792000-memory.dmp	upx
behavioral2/memory/4348-720-0x00007FF625C60000-0x00007FF626052000-memory.dmp	upx
behavioral2/memory/1836-717-0x00007FF7CE540000-0x00007FF7CE932000-memory.dmp	upx
behavioral2/memory/1772-695-0x00007FF7418A0000-0x00007FF741C92000-memory.dmp	upx
behavioral2/memory/4676-684-0x00007FF7F8430000-0x00007FF7F8822000-memory.dmp	upx
behavioral2/memory/3864-738-0x00007FF6BBBD0000-0x00007FF6BBFC2000-memory.dmp	upx
behavioral2/memory/5064-739-0x00007FF631DA0000-0x00007FF632192000-memory.dmp	upx
behavioral2/memory/2520-750-0x00007FF7491E0000-0x00007FF7495D2000-memory.dmp	upx
behavioral2/memory/3796-749-0x00007FF7EB470000-0x00007FF7EB862000-memory.dmp	upx
behavioral2/memory/2876-745-0x00007FF7B8E50000-0x00007FF7B9242000-memory.dmp	upx
behavioral2/memory/5076-744-0x00007FF698670000-0x00007FF698A62000-memory.dmp	upx
behavioral2/files/0x000a000000023b93-186.dat	upx
behavioral2/files/0x000a000000023b91-184.dat	upx
behavioral2/files/0x000a000000023b90-179.dat	upx
behavioral2/files/0x000a000000023b8f-174.dat	upx
behavioral2/files/0x000a000000023b8e-169.dat	upx
behavioral2/files/0x000a000000023b8c-159.dat	upx
behavioral2/files/0x000a000000023b8b-154.dat	upx
behavioral2/files/0x000a000000023b8a-149.dat	upx
behavioral2/files/0x000a000000023b89-144.dat	upx
behavioral2/files/0x000a000000023b88-139.dat	upx
behavioral2/files/0x000a000000023b87-134.dat	upx
behavioral2/files/0x000a000000023b85-124.dat	upx
behavioral2/files/0x000a000000023b83-114.dat	upx
behavioral2/files/0x000a000000023b81-104.dat	upx
behavioral2/files/0x000a000000023b80-99.dat	upx
behavioral2/files/0x000a000000023b7f-92.dat	upx
behavioral2/memory/1472-88-0x00007FF60F3E0000-0x00007FF60F7D2000-memory.dmp	upx
behavioral2/memory/1560-84-0x00007FF6A8900000-0x00007FF6A8CF2000-memory.dmp	upx
behavioral2/memory/4672-78-0x00007FF75F7C0000-0x00007FF75FBB2000-memory.dmp	upx
behavioral2/memory/3456-74-0x00007FF6D7870000-0x00007FF6D7C62000-memory.dmp	upx
behavioral2/files/0x000b000000023b7a-72.dat	upx
behavioral2/files/0x000a000000023b7d-66.dat	upx
behavioral2/memory/752-65-0x00007FF7DD8A0000-0x00007FF7DDC92000-memory.dmp	upx
behavioral2/memory/1184-60-0x00007FF658430000-0x00007FF658822000-memory.dmp	upx
behavioral2/memory/4512-53-0x00007FF760090000-0x00007FF760482000-memory.dmp	upx
behavioral2/memory/2380-51-0x00007FF7FAEF0000-0x00007FF7FB2E2000-memory.dmp	upx
behavioral2/files/0x000a000000023b78-48.dat	upx
behavioral2/memory/4208-10-0x00007FF7DBF10000-0x00007FF7DC302000-memory.dmp	upx
behavioral2/memory/3456-3855-0x00007FF6D7870000-0x00007FF6D7C62000-memory.dmp	upx
behavioral2/memory/2380-3857-0x00007FF7FAEF0000-0x00007FF7FB2E2000-memory.dmp	upx
behavioral2/memory/4512-3865-0x00007FF760090000-0x00007FF760482000-memory.dmp	upx
behavioral2/memory/4672-3870-0x00007FF75F7C0000-0x00007FF75FBB2000-memory.dmp	upx
behavioral2/memory/1184-3874-0x00007FF658430000-0x00007FF658822000-memory.dmp	upx
behavioral2/memory/1560-3877-0x00007FF6A8900000-0x00007FF6A8CF2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\JSLsBQN.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\ITuSLqL.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\xvladRa.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\kBHPXjN.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\QNwkSoP.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\CZTKDkH.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\EJZJFPl.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\lUaRclw.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\bxogxgu.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\GnqyLtm.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\FzabEUy.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\oXPnKJq.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\sQdaQvi.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\YRembdg.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\KLlikwR.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\gkYMvUE.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\WSZCDrB.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\IGlvKPo.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\OYqTIeS.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\eEqJUWf.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\uQzmUrS.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\rwBkVpO.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\SyDGcuG.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\LtKrmph.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\CVbJKpC.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\QsjoLhy.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\XUiyfpN.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\XSlhshs.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\KkBqooG.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\XyVtCWj.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\orNMuMC.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\StVcoaB.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\fkDpBuU.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\LRJxuHq.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\ZWvJrcH.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\GSRLvBG.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\zXnVPRi.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\oRZtGFL.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\TyKPMCA.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\zzNtJMT.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\ZlGizwE.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\VFpljJI.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\qahmnnC.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\GgNtitt.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\bFPRbAK.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\oLSvPTw.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\kQaxUgR.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\gBxmSlO.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\bRoHTDf.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\zzEZDVj.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\JbJkEYN.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\krjdHqX.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\oDRHTqI.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\UypQJgX.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\LkcnKUE.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\KdlpWPv.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\aSwRFay.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\uBQJzMu.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\NlBeJck.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\CSJYBvd.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\EcCyaFH.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\wiyHsUV.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\JlvEjlT.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\Voqcife.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4628	powershell.exe
4628	powershell.exe
4628	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
Token: SeDebugPrivilege	4628	powershell.exe
Token: SeLockMemoryPrivilege	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 4628	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	84
PID 1800 wrote to memory of 4628	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	84
PID 1800 wrote to memory of 4208	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	85
PID 1800 wrote to memory of 4208	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	85
PID 1800 wrote to memory of 3456	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	86
PID 1800 wrote to memory of 3456	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	86
PID 1800 wrote to memory of 2380	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	87
PID 1800 wrote to memory of 2380	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	87
PID 1800 wrote to memory of 4512	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	88
PID 1800 wrote to memory of 4512	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	88
PID 1800 wrote to memory of 1184	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	89
PID 1800 wrote to memory of 1184	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	89
PID 1800 wrote to memory of 4672	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	90
PID 1800 wrote to memory of 4672	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	90
PID 1800 wrote to memory of 752	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	91
PID 1800 wrote to memory of 752	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	91
PID 1800 wrote to memory of 1560	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	92
PID 1800 wrote to memory of 1560	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	92
PID 1800 wrote to memory of 1472	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	93
PID 1800 wrote to memory of 1472	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	93
PID 1800 wrote to memory of 2088	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	94
PID 1800 wrote to memory of 2088	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	94
PID 1800 wrote to memory of 5076	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	95
PID 1800 wrote to memory of 5076	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	95
PID 1800 wrote to memory of 2876	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	96
PID 1800 wrote to memory of 2876	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	96
PID 1800 wrote to memory of 3796	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	97
PID 1800 wrote to memory of 3796	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	97
PID 1800 wrote to memory of 2520	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	98
PID 1800 wrote to memory of 2520	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	98
PID 1800 wrote to memory of 4712	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	99
PID 1800 wrote to memory of 4712	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	99
PID 1800 wrote to memory of 4676	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	100
PID 1800 wrote to memory of 4676	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	100
PID 1800 wrote to memory of 1772	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	101
PID 1800 wrote to memory of 1772	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	101
PID 1800 wrote to memory of 3460	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	102
PID 1800 wrote to memory of 3460	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	102
PID 1800 wrote to memory of 1836	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	103
PID 1800 wrote to memory of 1836	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	103
PID 1800 wrote to memory of 4348	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	104
PID 1800 wrote to memory of 4348	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	104
PID 1800 wrote to memory of 3732	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	105
PID 1800 wrote to memory of 3732	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	105
PID 1800 wrote to memory of 732	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	106
PID 1800 wrote to memory of 732	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	106
PID 1800 wrote to memory of 3864	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	107
PID 1800 wrote to memory of 3864	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	107
PID 1800 wrote to memory of 5064	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	108
PID 1800 wrote to memory of 5064	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	108
PID 1800 wrote to memory of 3048	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	109
PID 1800 wrote to memory of 3048	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	109
PID 1800 wrote to memory of 2776	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	110
PID 1800 wrote to memory of 2776	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	110
PID 1800 wrote to memory of 4576	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	111
PID 1800 wrote to memory of 4576	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	111
PID 1800 wrote to memory of 2184	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	112
PID 1800 wrote to memory of 2184	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	112
PID 1800 wrote to memory of 2124	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	113
PID 1800 wrote to memory of 2124	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	113
PID 1800 wrote to memory of 2300	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	114
PID 1800 wrote to memory of 2300	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	114
PID 1800 wrote to memory of 3336	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	115
PID 1800 wrote to memory of 3336	1800	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4628
- C:\Windows\System\oLzlIWX.exe
  C:\Windows\System\oLzlIWX.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\LiitNQE.exe
  C:\Windows\System\LiitNQE.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\HIREIfT.exe
  C:\Windows\System\HIREIfT.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\YUkkczo.exe
  C:\Windows\System\YUkkczo.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\wgLYnDF.exe
  C:\Windows\System\wgLYnDF.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\wJbTmIQ.exe
  C:\Windows\System\wJbTmIQ.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\lKeNRrt.exe
  C:\Windows\System\lKeNRrt.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\WczQRup.exe
  C:\Windows\System\WczQRup.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\hXuIqgv.exe
  C:\Windows\System\hXuIqgv.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\rVqBkqp.exe
  C:\Windows\System\rVqBkqp.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\IIYnEnJ.exe
  C:\Windows\System\IIYnEnJ.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\aZjnLNP.exe
  C:\Windows\System\aZjnLNP.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\CkPMHIa.exe
  C:\Windows\System\CkPMHIa.exe
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Windows\System\KLnRAMQ.exe
  C:\Windows\System\KLnRAMQ.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\Qgbthcl.exe
  C:\Windows\System\Qgbthcl.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\QRcoZyn.exe
  C:\Windows\System\QRcoZyn.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\NTXTlvq.exe
  C:\Windows\System\NTXTlvq.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\TyEQgXM.exe
  C:\Windows\System\TyEQgXM.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\aLaehqV.exe
  C:\Windows\System\aLaehqV.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\KZHVuhR.exe
  C:\Windows\System\KZHVuhR.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\IENPVtd.exe
  C:\Windows\System\IENPVtd.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\MxiZMKs.exe
  C:\Windows\System\MxiZMKs.exe
  2⤵
  - Executes dropped EXE
  PID:732
- C:\Windows\System\TJlyHsx.exe
  C:\Windows\System\TJlyHsx.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System\MLQhRoO.exe
  C:\Windows\System\MLQhRoO.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\kUgCloQ.exe
  C:\Windows\System\kUgCloQ.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\ZbufLhA.exe
  C:\Windows\System\ZbufLhA.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\MZHphVz.exe
  C:\Windows\System\MZHphVz.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\aFPYJQt.exe
  C:\Windows\System\aFPYJQt.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\DAeKqHG.exe
  C:\Windows\System\DAeKqHG.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\EHvyFsJ.exe
  C:\Windows\System\EHvyFsJ.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\FxTjOlW.exe
  C:\Windows\System\FxTjOlW.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\LFGideE.exe
  C:\Windows\System\LFGideE.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\krjdHqX.exe
  C:\Windows\System\krjdHqX.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\kTkmPhA.exe
  C:\Windows\System\kTkmPhA.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\paImAgP.exe
  C:\Windows\System\paImAgP.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\JxaGIum.exe
  C:\Windows\System\JxaGIum.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\RyShSUg.exe
  C:\Windows\System\RyShSUg.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\kqwDNMc.exe
  C:\Windows\System\kqwDNMc.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\XccfzyU.exe
  C:\Windows\System\XccfzyU.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\JGkVhVW.exe
  C:\Windows\System\JGkVhVW.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\uLxilOk.exe
  C:\Windows\System\uLxilOk.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\Pohkoir.exe
  C:\Windows\System\Pohkoir.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\aNLfzeF.exe
  C:\Windows\System\aNLfzeF.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\OLPzSvE.exe
  C:\Windows\System\OLPzSvE.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\xSQMZHT.exe
  C:\Windows\System\xSQMZHT.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\zJtcmcc.exe
  C:\Windows\System\zJtcmcc.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\acFCwEf.exe
  C:\Windows\System\acFCwEf.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\MrSoojB.exe
  C:\Windows\System\MrSoojB.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\seePbDO.exe
  C:\Windows\System\seePbDO.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\yDeacWN.exe
  C:\Windows\System\yDeacWN.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\UyKRYvT.exe
  C:\Windows\System\UyKRYvT.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\wlZlRkP.exe
  C:\Windows\System\wlZlRkP.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\aSCzhmk.exe
  C:\Windows\System\aSCzhmk.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\yrZBaSA.exe
  C:\Windows\System\yrZBaSA.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\usiHIxx.exe
  C:\Windows\System\usiHIxx.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\boJXCOE.exe
  C:\Windows\System\boJXCOE.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\HPwdCCj.exe
  C:\Windows\System\HPwdCCj.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\KivnQEV.exe
  C:\Windows\System\KivnQEV.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\fjveZPv.exe
  C:\Windows\System\fjveZPv.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System\wyzNxsc.exe
  C:\Windows\System\wyzNxsc.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\Jenmisg.exe
  C:\Windows\System\Jenmisg.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\EtUTqjt.exe
  C:\Windows\System\EtUTqjt.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\mDkEkYs.exe
  C:\Windows\System\mDkEkYs.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\ihgoWfn.exe
  C:\Windows\System\ihgoWfn.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\fNyryuf.exe
  C:\Windows\System\fNyryuf.exe
  2⤵
  PID:4984
- C:\Windows\System\jYDqlcT.exe
  C:\Windows\System\jYDqlcT.exe
  2⤵
  PID:4716
- C:\Windows\System\iBHiZXm.exe
  C:\Windows\System\iBHiZXm.exe
  2⤵
  PID:3224
- C:\Windows\System\KOTbtWk.exe
  C:\Windows\System\KOTbtWk.exe
  2⤵
  PID:5072
- C:\Windows\System\HbMcFuM.exe
  C:\Windows\System\HbMcFuM.exe
  2⤵
  PID:3652
- C:\Windows\System\LsKcXNx.exe
  C:\Windows\System\LsKcXNx.exe
  2⤵
  PID:5056
- C:\Windows\System\kaqxKxL.exe
  C:\Windows\System\kaqxKxL.exe
  2⤵
  PID:2056
- C:\Windows\System\JqJzbQH.exe
  C:\Windows\System\JqJzbQH.exe
  2⤵
  PID:5136
- C:\Windows\System\gJeKMem.exe
  C:\Windows\System\gJeKMem.exe
  2⤵
  PID:5180
- C:\Windows\System\GFqGnCV.exe
  C:\Windows\System\GFqGnCV.exe
  2⤵
  PID:5212
- C:\Windows\System\yrNQvtv.exe
  C:\Windows\System\yrNQvtv.exe
  2⤵
  PID:5228
- C:\Windows\System\UFUArud.exe
  C:\Windows\System\UFUArud.exe
  2⤵
  PID:5256
- C:\Windows\System\LJNuDjL.exe
  C:\Windows\System\LJNuDjL.exe
  2⤵
  PID:5284
- C:\Windows\System\sMiJMim.exe
  C:\Windows\System\sMiJMim.exe
  2⤵
  PID:5312
- C:\Windows\System\SefXfCc.exe
  C:\Windows\System\SefXfCc.exe
  2⤵
  PID:5336
- C:\Windows\System\IEiMurT.exe
  C:\Windows\System\IEiMurT.exe
  2⤵
  PID:5364
- C:\Windows\System\RjhwGWc.exe
  C:\Windows\System\RjhwGWc.exe
  2⤵
  PID:5396
- C:\Windows\System\yOvkzRr.exe
  C:\Windows\System\yOvkzRr.exe
  2⤵
  PID:5424
- C:\Windows\System\aAAuRPu.exe
  C:\Windows\System\aAAuRPu.exe
  2⤵
  PID:5452
- C:\Windows\System\PnTeEvw.exe
  C:\Windows\System\PnTeEvw.exe
  2⤵
  PID:5480
- C:\Windows\System\BviOgJn.exe
  C:\Windows\System\BviOgJn.exe
  2⤵
  PID:5504
- C:\Windows\System\flMMYNG.exe
  C:\Windows\System\flMMYNG.exe
  2⤵
  PID:5532
- C:\Windows\System\RAielZa.exe
  C:\Windows\System\RAielZa.exe
  2⤵
  PID:5560
- C:\Windows\System\nXwoQNh.exe
  C:\Windows\System\nXwoQNh.exe
  2⤵
  PID:5588
- C:\Windows\System\URgIjlR.exe
  C:\Windows\System\URgIjlR.exe
  2⤵
  PID:5616
- C:\Windows\System\UOIRtZY.exe
  C:\Windows\System\UOIRtZY.exe
  2⤵
  PID:5648
- C:\Windows\System\WIuuLLy.exe
  C:\Windows\System\WIuuLLy.exe
  2⤵
  PID:5676
- C:\Windows\System\CAPppVt.exe
  C:\Windows\System\CAPppVt.exe
  2⤵
  PID:5704
- C:\Windows\System\rfJbAdQ.exe
  C:\Windows\System\rfJbAdQ.exe
  2⤵
  PID:5732
- C:\Windows\System\rHeCdxh.exe
  C:\Windows\System\rHeCdxh.exe
  2⤵
  PID:5760
- C:\Windows\System\XdfnYVe.exe
  C:\Windows\System\XdfnYVe.exe
  2⤵
  PID:5784
- C:\Windows\System\yyFbTpD.exe
  C:\Windows\System\yyFbTpD.exe
  2⤵
  PID:5804
- C:\Windows\System\mauDyIc.exe
  C:\Windows\System\mauDyIc.exe
  2⤵
  PID:5832
- C:\Windows\System\cPLQRUl.exe
  C:\Windows\System\cPLQRUl.exe
  2⤵
  PID:5860
- C:\Windows\System\dRndyYD.exe
  C:\Windows\System\dRndyYD.exe
  2⤵
  PID:5888
- C:\Windows\System\rNiSZXX.exe
  C:\Windows\System\rNiSZXX.exe
  2⤵
  PID:5916
- C:\Windows\System\WgCFMon.exe
  C:\Windows\System\WgCFMon.exe
  2⤵
  PID:5944
- C:\Windows\System\NrTHrHy.exe
  C:\Windows\System\NrTHrHy.exe
  2⤵
  PID:5972
- C:\Windows\System\QUXIbwW.exe
  C:\Windows\System\QUXIbwW.exe
  2⤵
  PID:6000
- C:\Windows\System\SuspHyK.exe
  C:\Windows\System\SuspHyK.exe
  2⤵
  PID:6028
- C:\Windows\System\bIfyREV.exe
  C:\Windows\System\bIfyREV.exe
  2⤵
  PID:6056
- C:\Windows\System\pogMDQT.exe
  C:\Windows\System\pogMDQT.exe
  2⤵
  PID:6084
- C:\Windows\System\neWyupL.exe
  C:\Windows\System\neWyupL.exe
  2⤵
  PID:6112
- C:\Windows\System\RqJmASJ.exe
  C:\Windows\System\RqJmASJ.exe
  2⤵
  PID:6140
- C:\Windows\System\GFHGCyn.exe
  C:\Windows\System\GFHGCyn.exe
  2⤵
  PID:4888
- C:\Windows\System\eSyVdSW.exe
  C:\Windows\System\eSyVdSW.exe
  2⤵
  PID:3000
- C:\Windows\System\EGNwHgz.exe
  C:\Windows\System\EGNwHgz.exe
  2⤵
  PID:4924
- C:\Windows\System\IeLiVyd.exe
  C:\Windows\System\IeLiVyd.exe
  2⤵
  PID:2772
- C:\Windows\System\rSAcJsx.exe
  C:\Windows\System\rSAcJsx.exe
  2⤵
  PID:5196
- C:\Windows\System\SpGzoAb.exe
  C:\Windows\System\SpGzoAb.exe
  2⤵
  PID:5248
- C:\Windows\System\llhaGUW.exe
  C:\Windows\System\llhaGUW.exe
  2⤵
  PID:5324
- C:\Windows\System\QQGGIJY.exe
  C:\Windows\System\QQGGIJY.exe
  2⤵
  PID:5384
- C:\Windows\System\aHnFkYj.exe
  C:\Windows\System\aHnFkYj.exe
  2⤵
  PID:5440
- C:\Windows\System\VZTwHHf.exe
  C:\Windows\System\VZTwHHf.exe
  2⤵
  PID:5496
- C:\Windows\System\dFdcBnZ.exe
  C:\Windows\System\dFdcBnZ.exe
  2⤵
  PID:5556
- C:\Windows\System\CHOPvJI.exe
  C:\Windows\System\CHOPvJI.exe
  2⤵
  PID:2484
- C:\Windows\System\tCCZiEv.exe
  C:\Windows\System\tCCZiEv.exe
  2⤵
  PID:5668
- C:\Windows\System\gSlMyZt.exe
  C:\Windows\System\gSlMyZt.exe
  2⤵
  PID:5744
- C:\Windows\System\oDaemOR.exe
  C:\Windows\System\oDaemOR.exe
  2⤵
  PID:5800
- C:\Windows\System\NvecsdY.exe
  C:\Windows\System\NvecsdY.exe
  2⤵
  PID:5872
- C:\Windows\System\NDfQlmY.exe
  C:\Windows\System\NDfQlmY.exe
  2⤵
  PID:5932
- C:\Windows\System\ZFhNJUt.exe
  C:\Windows\System\ZFhNJUt.exe
  2⤵
  PID:5992
- C:\Windows\System\orHZDDN.exe
  C:\Windows\System\orHZDDN.exe
  2⤵
  PID:6068
- C:\Windows\System\nCOgwQh.exe
  C:\Windows\System\nCOgwQh.exe
  2⤵
  PID:6124
- C:\Windows\System\tNttJfi.exe
  C:\Windows\System\tNttJfi.exe
  2⤵
  PID:452
- C:\Windows\System\szTsZbL.exe
  C:\Windows\System\szTsZbL.exe
  2⤵
  PID:2284
- C:\Windows\System\CuErYns.exe
  C:\Windows\System\CuErYns.exe
  2⤵
  PID:5240
- C:\Windows\System\LEKOwJy.exe
  C:\Windows\System\LEKOwJy.exe
  2⤵
  PID:5360
- C:\Windows\System\fObGfvo.exe
  C:\Windows\System\fObGfvo.exe
  2⤵
  PID:5468
- C:\Windows\System\QmREqWI.exe
  C:\Windows\System\QmREqWI.exe
  2⤵
  PID:5636
- C:\Windows\System\bxwEVsE.exe
  C:\Windows\System\bxwEVsE.exe
  2⤵
  PID:5772
- C:\Windows\System\eBtQPgO.exe
  C:\Windows\System\eBtQPgO.exe
  2⤵
  PID:5904
- C:\Windows\System\rdekixH.exe
  C:\Windows\System\rdekixH.exe
  2⤵
  PID:6044
- C:\Windows\System\TlEBtEM.exe
  C:\Windows\System\TlEBtEM.exe
  2⤵
  PID:1720
- C:\Windows\System\RYPGRyB.exe
  C:\Windows\System\RYPGRyB.exe
  2⤵
  PID:5220
- C:\Windows\System\ZIAZIJR.exe
  C:\Windows\System\ZIAZIJR.exe
  2⤵
  PID:6172
- C:\Windows\System\QiVJqyl.exe
  C:\Windows\System\QiVJqyl.exe
  2⤵
  PID:6200
- C:\Windows\System\stOxNsS.exe
  C:\Windows\System\stOxNsS.exe
  2⤵
  PID:6228
- C:\Windows\System\DGfBndB.exe
  C:\Windows\System\DGfBndB.exe
  2⤵
  PID:6256
- C:\Windows\System\SnqNXLL.exe
  C:\Windows\System\SnqNXLL.exe
  2⤵
  PID:6284
- C:\Windows\System\wVfxhVI.exe
  C:\Windows\System\wVfxhVI.exe
  2⤵
  PID:6312
- C:\Windows\System\ynYugiX.exe
  C:\Windows\System\ynYugiX.exe
  2⤵
  PID:6340
- C:\Windows\System\wRInpPj.exe
  C:\Windows\System\wRInpPj.exe
  2⤵
  PID:6368
- C:\Windows\System\TsAmkmi.exe
  C:\Windows\System\TsAmkmi.exe
  2⤵
  PID:6392
- C:\Windows\System\vUFnqNG.exe
  C:\Windows\System\vUFnqNG.exe
  2⤵
  PID:6424
- C:\Windows\System\hcykuBm.exe
  C:\Windows\System\hcykuBm.exe
  2⤵
  PID:6452
- C:\Windows\System\VxLpYjx.exe
  C:\Windows\System\VxLpYjx.exe
  2⤵
  PID:6480
- C:\Windows\System\UkhQSAX.exe
  C:\Windows\System\UkhQSAX.exe
  2⤵
  PID:6508
- C:\Windows\System\MrouyDN.exe
  C:\Windows\System\MrouyDN.exe
  2⤵
  PID:6536
- C:\Windows\System\dZhQWjJ.exe
  C:\Windows\System\dZhQWjJ.exe
  2⤵
  PID:6564
- C:\Windows\System\uYLpggJ.exe
  C:\Windows\System\uYLpggJ.exe
  2⤵
  PID:6592
- C:\Windows\System\FRraOjU.exe
  C:\Windows\System\FRraOjU.exe
  2⤵
  PID:6616
- C:\Windows\System\wrzakim.exe
  C:\Windows\System\wrzakim.exe
  2⤵
  PID:6644
- C:\Windows\System\eaSZTvc.exe
  C:\Windows\System\eaSZTvc.exe
  2⤵
  PID:6672
- C:\Windows\System\hGKcbNl.exe
  C:\Windows\System\hGKcbNl.exe
  2⤵
  PID:6704
- C:\Windows\System\eCWzYjy.exe
  C:\Windows\System\eCWzYjy.exe
  2⤵
  PID:6732
- C:\Windows\System\UwFRSfn.exe
  C:\Windows\System\UwFRSfn.exe
  2⤵
  PID:6760
- C:\Windows\System\uAXTqSL.exe
  C:\Windows\System\uAXTqSL.exe
  2⤵
  PID:6784
- C:\Windows\System\SExCfbM.exe
  C:\Windows\System\SExCfbM.exe
  2⤵
  PID:6816
- C:\Windows\System\wvxdwou.exe
  C:\Windows\System\wvxdwou.exe
  2⤵
  PID:6844
- C:\Windows\System\UkgKRnX.exe
  C:\Windows\System\UkgKRnX.exe
  2⤵
  PID:6872
- C:\Windows\System\WJOrvnW.exe
  C:\Windows\System\WJOrvnW.exe
  2⤵
  PID:6896
- C:\Windows\System\ZJuJEzN.exe
  C:\Windows\System\ZJuJEzN.exe
  2⤵
  PID:6924
- C:\Windows\System\zXJzViG.exe
  C:\Windows\System\zXJzViG.exe
  2⤵
  PID:6952
- C:\Windows\System\rgdxmXx.exe
  C:\Windows\System\rgdxmXx.exe
  2⤵
  PID:6984
- C:\Windows\System\IpVmJsy.exe
  C:\Windows\System\IpVmJsy.exe
  2⤵
  PID:7012
- C:\Windows\System\NPUPnYF.exe
  C:\Windows\System\NPUPnYF.exe
  2⤵
  PID:7040
- C:\Windows\System\EEjVkkV.exe
  C:\Windows\System\EEjVkkV.exe
  2⤵
  PID:7068
- C:\Windows\System\dVXyunj.exe
  C:\Windows\System\dVXyunj.exe
  2⤵
  PID:7096
- C:\Windows\System\INkngoJ.exe
  C:\Windows\System\INkngoJ.exe
  2⤵
  PID:7124
- C:\Windows\System\IodJkht.exe
  C:\Windows\System\IodJkht.exe
  2⤵
  PID:7152
- C:\Windows\System\wvKSVXs.exe
  C:\Windows\System\wvKSVXs.exe
  2⤵
  PID:5696
- C:\Windows\System\WOaJhdN.exe
  C:\Windows\System\WOaJhdN.exe
  2⤵
  PID:2592
- C:\Windows\System\DEhyzdE.exe
  C:\Windows\System\DEhyzdE.exe
  2⤵
  PID:6184
- C:\Windows\System\DtCpzTM.exe
  C:\Windows\System\DtCpzTM.exe
  2⤵
  PID:6220
- C:\Windows\System\YzmZIPD.exe
  C:\Windows\System\YzmZIPD.exe
  2⤵
  PID:6268
- C:\Windows\System\PztASMN.exe
  C:\Windows\System\PztASMN.exe
  2⤵
  PID:6468
- C:\Windows\System\rCdfKlk.exe
  C:\Windows\System\rCdfKlk.exe
  2⤵
  PID:6500
- C:\Windows\System\XuAtStX.exe
  C:\Windows\System\XuAtStX.exe
  2⤵
  PID:6548
- C:\Windows\System\XyJsaEl.exe
  C:\Windows\System\XyJsaEl.exe
  2⤵
  PID:6580
- C:\Windows\System\CcsoQyt.exe
  C:\Windows\System\CcsoQyt.exe
  2⤵
  PID:3948
- C:\Windows\System\DSBWSdm.exe
  C:\Windows\System\DSBWSdm.exe
  2⤵
  PID:6640
- C:\Windows\System\qjejPcs.exe
  C:\Windows\System\qjejPcs.exe
  2⤵
  PID:6688
- C:\Windows\System\VAUrULq.exe
  C:\Windows\System\VAUrULq.exe
  2⤵
  PID:6716
- C:\Windows\System\KRpsXGw.exe
  C:\Windows\System\KRpsXGw.exe
  2⤵
  PID:4592
- C:\Windows\System\xLXipOD.exe
  C:\Windows\System\xLXipOD.exe
  2⤵
  PID:6804
- C:\Windows\System\RevNaVB.exe
  C:\Windows\System\RevNaVB.exe
  2⤵
  PID:6836
- C:\Windows\System\mLdmsHs.exe
  C:\Windows\System\mLdmsHs.exe
  2⤵
  PID:6860
- C:\Windows\System\WQMThQy.exe
  C:\Windows\System\WQMThQy.exe
  2⤵
  PID:6888
- C:\Windows\System\meYdUwj.exe
  C:\Windows\System\meYdUwj.exe
  2⤵
  PID:6972
- C:\Windows\System\oUXQzRv.exe
  C:\Windows\System\oUXQzRv.exe
  2⤵
  PID:7004
- C:\Windows\System\UMedjcz.exe
  C:\Windows\System\UMedjcz.exe
  2⤵
  PID:1072
- C:\Windows\System\jKIaUIA.exe
  C:\Windows\System\jKIaUIA.exe
  2⤵
  PID:7112
- C:\Windows\System\giFUmlB.exe
  C:\Windows\System\giFUmlB.exe
  2⤵
  PID:3896
- C:\Windows\System\RiNjozX.exe
  C:\Windows\System\RiNjozX.exe
  2⤵
  PID:2136
- C:\Windows\System\xUfbrbw.exe
  C:\Windows\System\xUfbrbw.exe
  2⤵
  PID:5964
- C:\Windows\System\wUjGWQB.exe
  C:\Windows\System\wUjGWQB.exe
  2⤵
  PID:6156
- C:\Windows\System\gGMOuCE.exe
  C:\Windows\System\gGMOuCE.exe
  2⤵
  PID:4296
- C:\Windows\System\SNAuiqn.exe
  C:\Windows\System\SNAuiqn.exe
  2⤵
  PID:6212
- C:\Windows\System\BxwRKMD.exe
  C:\Windows\System\BxwRKMD.exe
  2⤵
  PID:5092
- C:\Windows\System\rBvykCY.exe
  C:\Windows\System\rBvykCY.exe
  2⤵
  PID:6556
- C:\Windows\System\QvhwbXV.exe
  C:\Windows\System\QvhwbXV.exe
  2⤵
  PID:6748
- C:\Windows\System\Dgcilkg.exe
  C:\Windows\System\Dgcilkg.exe
  2⤵
  PID:6828
- C:\Windows\System\JEUTCaq.exe
  C:\Windows\System\JEUTCaq.exe
  2⤵
  PID:2892
- C:\Windows\System\pexZxEK.exe
  C:\Windows\System\pexZxEK.exe
  2⤵
  PID:7032
- C:\Windows\System\IQLylCT.exe
  C:\Windows\System\IQLylCT.exe
  2⤵
  PID:4696
- C:\Windows\System\DfvrUSD.exe
  C:\Windows\System\DfvrUSD.exe
  2⤵
  PID:5844
- C:\Windows\System\XcwFEGG.exe
  C:\Windows\System\XcwFEGG.exe
  2⤵
  PID:3228
- C:\Windows\System\utmVcSJ.exe
  C:\Windows\System\utmVcSJ.exe
  2⤵
  PID:6724
- C:\Windows\System\uGMGFZp.exe
  C:\Windows\System\uGMGFZp.exe
  2⤵
  PID:2316
- C:\Windows\System\FRAoMBq.exe
  C:\Windows\System\FRAoMBq.exe
  2⤵
  PID:6352
- C:\Windows\System\hxFeLly.exe
  C:\Windows\System\hxFeLly.exe
  2⤵
  PID:6968
- C:\Windows\System\bldMaxi.exe
  C:\Windows\System\bldMaxi.exe
  2⤵
  PID:1480
- C:\Windows\System\DuUxaId.exe
  C:\Windows\System\DuUxaId.exe
  2⤵
  PID:2652
- C:\Windows\System\uITRDLU.exe
  C:\Windows\System\uITRDLU.exe
  2⤵
  PID:7024
- C:\Windows\System\DsoyxNV.exe
  C:\Windows\System\DsoyxNV.exe
  2⤵
  PID:1052
- C:\Windows\System\azCKkZI.exe
  C:\Windows\System\azCKkZI.exe
  2⤵
  PID:3512
- C:\Windows\System\TDpwxhR.exe
  C:\Windows\System\TDpwxhR.exe
  2⤵
  PID:6608
- C:\Windows\System\ufpQYzd.exe
  C:\Windows\System\ufpQYzd.exe
  2⤵
  PID:7184
- C:\Windows\System\DkdUsLF.exe
  C:\Windows\System\DkdUsLF.exe
  2⤵
  PID:7228
- C:\Windows\System\cxYCPLt.exe
  C:\Windows\System\cxYCPLt.exe
  2⤵
  PID:7252
- C:\Windows\System\ImKQWPZ.exe
  C:\Windows\System\ImKQWPZ.exe
  2⤵
  PID:7272
- C:\Windows\System\MMZRoUR.exe
  C:\Windows\System\MMZRoUR.exe
  2⤵
  PID:7312
- C:\Windows\System\UJFPgSz.exe
  C:\Windows\System\UJFPgSz.exe
  2⤵
  PID:7344
- C:\Windows\System\oMTEKJT.exe
  C:\Windows\System\oMTEKJT.exe
  2⤵
  PID:7364
- C:\Windows\System\yblDzvs.exe
  C:\Windows\System\yblDzvs.exe
  2⤵
  PID:7380
- C:\Windows\System\EaxOevH.exe
  C:\Windows\System\EaxOevH.exe
  2⤵
  PID:7400
- C:\Windows\System\ikInmwj.exe
  C:\Windows\System\ikInmwj.exe
  2⤵
  PID:7424
- C:\Windows\System\aKbxpnr.exe
  C:\Windows\System\aKbxpnr.exe
  2⤵
  PID:7472
- C:\Windows\System\oeICWCe.exe
  C:\Windows\System\oeICWCe.exe
  2⤵
  PID:7516
- C:\Windows\System\YEcCkgz.exe
  C:\Windows\System\YEcCkgz.exe
  2⤵
  PID:7544
- C:\Windows\System\uRmbREa.exe
  C:\Windows\System\uRmbREa.exe
  2⤵
  PID:7564
- C:\Windows\System\UFakybf.exe
  C:\Windows\System\UFakybf.exe
  2⤵
  PID:7588
- C:\Windows\System\ZrxoZwq.exe
  C:\Windows\System\ZrxoZwq.exe
  2⤵
  PID:7604
- C:\Windows\System\LYaKiyW.exe
  C:\Windows\System\LYaKiyW.exe
  2⤵
  PID:7628
- C:\Windows\System\KDAsxTM.exe
  C:\Windows\System\KDAsxTM.exe
  2⤵
  PID:7680
- C:\Windows\System\PckJJDQ.exe
  C:\Windows\System\PckJJDQ.exe
  2⤵
  PID:7704
- C:\Windows\System\BkdCRgK.exe
  C:\Windows\System\BkdCRgK.exe
  2⤵
  PID:7732
- C:\Windows\System\LJqZzpL.exe
  C:\Windows\System\LJqZzpL.exe
  2⤵
  PID:7756
- C:\Windows\System\HEXBdlT.exe
  C:\Windows\System\HEXBdlT.exe
  2⤵
  PID:7796
- C:\Windows\System\cxdVvng.exe
  C:\Windows\System\cxdVvng.exe
  2⤵
  PID:7824
- C:\Windows\System\zZnilIM.exe
  C:\Windows\System\zZnilIM.exe
  2⤵
  PID:7844
- C:\Windows\System\QBYKFnz.exe
  C:\Windows\System\QBYKFnz.exe
  2⤵
  PID:7872
- C:\Windows\System\pxyjNMG.exe
  C:\Windows\System\pxyjNMG.exe
  2⤵
  PID:7892
- C:\Windows\System\jZakSES.exe
  C:\Windows\System\jZakSES.exe
  2⤵
  PID:7912
- C:\Windows\System\sqiKWDn.exe
  C:\Windows\System\sqiKWDn.exe
  2⤵
  PID:7928
- C:\Windows\System\CThCqsE.exe
  C:\Windows\System\CThCqsE.exe
  2⤵
  PID:7960
- C:\Windows\System\FPKRhBC.exe
  C:\Windows\System\FPKRhBC.exe
  2⤵
  PID:8016
- C:\Windows\System\lUaRclw.exe
  C:\Windows\System\lUaRclw.exe
  2⤵
  PID:8036
- C:\Windows\System\sfwzKUD.exe
  C:\Windows\System\sfwzKUD.exe
  2⤵
  PID:8056
- C:\Windows\System\esSBjZn.exe
  C:\Windows\System\esSBjZn.exe
  2⤵
  PID:8084
- C:\Windows\System\eFHiowX.exe
  C:\Windows\System\eFHiowX.exe
  2⤵
  PID:8112
- C:\Windows\System\qKTMnWc.exe
  C:\Windows\System\qKTMnWc.exe
  2⤵
  PID:8140
- C:\Windows\System\FuAGOYj.exe
  C:\Windows\System\FuAGOYj.exe
  2⤵
  PID:8164
- C:\Windows\System\ayIslBS.exe
  C:\Windows\System\ayIslBS.exe
  2⤵
  PID:7204
- C:\Windows\System\TCSjrBJ.exe
  C:\Windows\System\TCSjrBJ.exe
  2⤵
  PID:7244
- C:\Windows\System\NHPsMrw.exe
  C:\Windows\System\NHPsMrw.exe
  2⤵
  PID:4092
- C:\Windows\System\sUYELfk.exe
  C:\Windows\System\sUYELfk.exe
  2⤵
  PID:7336
- C:\Windows\System\GtWuZvf.exe
  C:\Windows\System\GtWuZvf.exe
  2⤵
  PID:7420
- C:\Windows\System\QrwHBNX.exe
  C:\Windows\System\QrwHBNX.exe
  2⤵
  PID:7480
- C:\Windows\System\oNnPHQO.exe
  C:\Windows\System\oNnPHQO.exe
  2⤵
  PID:7540
- C:\Windows\System\zsqAfiI.exe
  C:\Windows\System\zsqAfiI.exe
  2⤵
  PID:7560
- C:\Windows\System\PrDbmYB.exe
  C:\Windows\System\PrDbmYB.exe
  2⤵
  PID:7652
- C:\Windows\System\FwJxpwk.exe
  C:\Windows\System\FwJxpwk.exe
  2⤵
  PID:7700
- C:\Windows\System\Xvvlxem.exe
  C:\Windows\System\Xvvlxem.exe
  2⤵
  PID:7776
- C:\Windows\System\PtNeiXG.exe
  C:\Windows\System\PtNeiXG.exe
  2⤵
  PID:7856
- C:\Windows\System\mWIXbrS.exe
  C:\Windows\System\mWIXbrS.exe
  2⤵
  PID:7900
- C:\Windows\System\dxhvVfO.exe
  C:\Windows\System\dxhvVfO.exe
  2⤵
  PID:7972
- C:\Windows\System\WZfZZgy.exe
  C:\Windows\System\WZfZZgy.exe
  2⤵
  PID:8032
- C:\Windows\System\KPpDUxv.exe
  C:\Windows\System\KPpDUxv.exe
  2⤵
  PID:8108
- C:\Windows\System\nWnEBXA.exe
  C:\Windows\System\nWnEBXA.exe
  2⤵
  PID:7200
- C:\Windows\System\JOBoiDk.exe
  C:\Windows\System\JOBoiDk.exe
  2⤵
  PID:7284
- C:\Windows\System\izWxpDs.exe
  C:\Windows\System\izWxpDs.exe
  2⤵
  PID:7352
- C:\Windows\System\LmSBSiJ.exe
  C:\Windows\System\LmSBSiJ.exe
  2⤵
  PID:7512
- C:\Windows\System\QbCSZQe.exe
  C:\Windows\System\QbCSZQe.exe
  2⤵
  PID:7572
- C:\Windows\System\kHfKghF.exe
  C:\Windows\System\kHfKghF.exe
  2⤵
  PID:7744
- C:\Windows\System\VhxVPgF.exe
  C:\Windows\System\VhxVPgF.exe
  2⤵
  PID:7956
- C:\Windows\System\uzZExDe.exe
  C:\Windows\System\uzZExDe.exe
  2⤵
  PID:7496
- C:\Windows\System\YBYzuYL.exe
  C:\Windows\System\YBYzuYL.exe
  2⤵
  PID:7288
- C:\Windows\System\ojMqQQA.exe
  C:\Windows\System\ojMqQQA.exe
  2⤵
  PID:7788
- C:\Windows\System\JgAAzba.exe
  C:\Windows\System\JgAAzba.exe
  2⤵
  PID:7836
- C:\Windows\System\MXxrxUk.exe
  C:\Windows\System\MXxrxUk.exe
  2⤵
  PID:8204
- C:\Windows\System\FWxzlRQ.exe
  C:\Windows\System\FWxzlRQ.exe
  2⤵
  PID:8224
- C:\Windows\System\umdWYiY.exe
  C:\Windows\System\umdWYiY.exe
  2⤵
  PID:8256
- C:\Windows\System\UAgDRbU.exe
  C:\Windows\System\UAgDRbU.exe
  2⤵
  PID:8276
- C:\Windows\System\wUrXWqz.exe
  C:\Windows\System\wUrXWqz.exe
  2⤵
  PID:8300
- C:\Windows\System\bFPRbAK.exe
  C:\Windows\System\bFPRbAK.exe
  2⤵
  PID:8344
- C:\Windows\System\rJVRFFH.exe
  C:\Windows\System\rJVRFFH.exe
  2⤵
  PID:8372
- C:\Windows\System\IdNNFxP.exe
  C:\Windows\System\IdNNFxP.exe
  2⤵
  PID:8392
- C:\Windows\System\iDBewMw.exe
  C:\Windows\System\iDBewMw.exe
  2⤵
  PID:8436
- C:\Windows\System\exwbWbb.exe
  C:\Windows\System\exwbWbb.exe
  2⤵
  PID:8464
- C:\Windows\System\qOykjRg.exe
  C:\Windows\System\qOykjRg.exe
  2⤵
  PID:8484
- C:\Windows\System\MGmQcrT.exe
  C:\Windows\System\MGmQcrT.exe
  2⤵
  PID:8504
- C:\Windows\System\FoKvaHm.exe
  C:\Windows\System\FoKvaHm.exe
  2⤵
  PID:8528
- C:\Windows\System\sqqOHoV.exe
  C:\Windows\System\sqqOHoV.exe
  2⤵
  PID:8568
- C:\Windows\System\iIsZjsB.exe
  C:\Windows\System\iIsZjsB.exe
  2⤵
  PID:8588
- C:\Windows\System\cHvjgib.exe
  C:\Windows\System\cHvjgib.exe
  2⤵
  PID:8612
- C:\Windows\System\NMDAHwm.exe
  C:\Windows\System\NMDAHwm.exe
  2⤵
  PID:8640
- C:\Windows\System\OqmfocY.exe
  C:\Windows\System\OqmfocY.exe
  2⤵
  PID:8668
- C:\Windows\System\YpTHDhs.exe
  C:\Windows\System\YpTHDhs.exe
  2⤵
  PID:8716
- C:\Windows\System\IdypyRh.exe
  C:\Windows\System\IdypyRh.exe
  2⤵
  PID:8744
- C:\Windows\System\kojgSuU.exe
  C:\Windows\System\kojgSuU.exe
  2⤵
  PID:8776
- C:\Windows\System\vePreNS.exe
  C:\Windows\System\vePreNS.exe
  2⤵
  PID:8804
- C:\Windows\System\FfMMvwK.exe
  C:\Windows\System\FfMMvwK.exe
  2⤵
  PID:8820
- C:\Windows\System\XbAYMlv.exe
  C:\Windows\System\XbAYMlv.exe
  2⤵
  PID:8864
- C:\Windows\System\HeJwyPi.exe
  C:\Windows\System\HeJwyPi.exe
  2⤵
  PID:8884
- C:\Windows\System\UHXOpHa.exe
  C:\Windows\System\UHXOpHa.exe
  2⤵
  PID:8916
- C:\Windows\System\YBZgHcO.exe
  C:\Windows\System\YBZgHcO.exe
  2⤵
  PID:8936
- C:\Windows\System\LExXSgh.exe
  C:\Windows\System\LExXSgh.exe
  2⤵
  PID:8968
- C:\Windows\System\pjOjpIr.exe
  C:\Windows\System\pjOjpIr.exe
  2⤵
  PID:8992
- C:\Windows\System\qltXkTD.exe
  C:\Windows\System\qltXkTD.exe
  2⤵
  PID:9032
- C:\Windows\System\cQJTbVk.exe
  C:\Windows\System\cQJTbVk.exe
  2⤵
  PID:9056
- C:\Windows\System\pnUbAup.exe
  C:\Windows\System\pnUbAup.exe
  2⤵
  PID:9080
- C:\Windows\System\aPincfh.exe
  C:\Windows\System\aPincfh.exe
  2⤵
  PID:9120
- C:\Windows\System\FwyMCVP.exe
  C:\Windows\System\FwyMCVP.exe
  2⤵
  PID:9148
- C:\Windows\System\jIvEzQq.exe
  C:\Windows\System\jIvEzQq.exe
  2⤵
  PID:9172
- C:\Windows\System\euqYBhZ.exe
  C:\Windows\System\euqYBhZ.exe
  2⤵
  PID:9196
- C:\Windows\System\NHqyfSD.exe
  C:\Windows\System\NHqyfSD.exe
  2⤵
  PID:8196
- C:\Windows\System\qxPlOcN.exe
  C:\Windows\System\qxPlOcN.exe
  2⤵
  PID:8264
- C:\Windows\System\CwWtNaZ.exe
  C:\Windows\System\CwWtNaZ.exe
  2⤵
  PID:8324
- C:\Windows\System\VIcvrcs.exe
  C:\Windows\System\VIcvrcs.exe
  2⤵
  PID:8360
- C:\Windows\System\ziTnpHt.exe
  C:\Windows\System\ziTnpHt.exe
  2⤵
  PID:8500
- C:\Windows\System\qggMHfa.exe
  C:\Windows\System\qggMHfa.exe
  2⤵
  PID:8584
- C:\Windows\System\ckKZvFW.exe
  C:\Windows\System\ckKZvFW.exe
  2⤵
  PID:8628
- C:\Windows\System\ElgYFAi.exe
  C:\Windows\System\ElgYFAi.exe
  2⤵
  PID:8712
- C:\Windows\System\WOLgXAA.exe
  C:\Windows\System\WOLgXAA.exe
  2⤵
  PID:8760
- C:\Windows\System\CqgmRlj.exe
  C:\Windows\System\CqgmRlj.exe
  2⤵
  PID:8816
- C:\Windows\System\nLFxxQa.exe
  C:\Windows\System\nLFxxQa.exe
  2⤵
  PID:8900
- C:\Windows\System\grptdcc.exe
  C:\Windows\System\grptdcc.exe
  2⤵
  PID:8932
- C:\Windows\System\QEwNLHY.exe
  C:\Windows\System\QEwNLHY.exe
  2⤵
  PID:8984
- C:\Windows\System\gexPGAd.exe
  C:\Windows\System\gexPGAd.exe
  2⤵
  PID:9020
- C:\Windows\System\TbnBHyi.exe
  C:\Windows\System\TbnBHyi.exe
  2⤵
  PID:9156
- C:\Windows\System\PvdgzJc.exe
  C:\Windows\System\PvdgzJc.exe
  2⤵
  PID:8236
- C:\Windows\System\SpwGfyb.exe
  C:\Windows\System\SpwGfyb.exe
  2⤵
  PID:8320
- C:\Windows\System\wlOGuHN.exe
  C:\Windows\System\wlOGuHN.exe
  2⤵
  PID:8456
- C:\Windows\System\HPmLhIs.exe
  C:\Windows\System\HPmLhIs.exe
  2⤵
  PID:8688
- C:\Windows\System\ztIzYWD.exe
  C:\Windows\System\ztIzYWD.exe
  2⤵
  PID:8788
- C:\Windows\System\mFhLPMo.exe
  C:\Windows\System\mFhLPMo.exe
  2⤵
  PID:8176
- C:\Windows\System\NkzUrcb.exe
  C:\Windows\System\NkzUrcb.exe
  2⤵
  PID:9064
- C:\Windows\System\fJXbzoD.exe
  C:\Windows\System\fJXbzoD.exe
  2⤵
  PID:8580
- C:\Windows\System\DPOuysD.exe
  C:\Windows\System\DPOuysD.exe
  2⤵
  PID:8740
- C:\Windows\System\eQooImX.exe
  C:\Windows\System\eQooImX.exe
  2⤵
  PID:8928
- C:\Windows\System\TbUyElu.exe
  C:\Windows\System\TbUyElu.exe
  2⤵
  PID:8384
- C:\Windows\System\gQxSdnt.exe
  C:\Windows\System\gQxSdnt.exe
  2⤵
  PID:9220
- C:\Windows\System\hGvXRYw.exe
  C:\Windows\System\hGvXRYw.exe
  2⤵
  PID:9240
- C:\Windows\System\PasRtXe.exe
  C:\Windows\System\PasRtXe.exe
  2⤵
  PID:9304
- C:\Windows\System\QDJfMTp.exe
  C:\Windows\System\QDJfMTp.exe
  2⤵
  PID:9324
- C:\Windows\System\tFFHPfL.exe
  C:\Windows\System\tFFHPfL.exe
  2⤵
  PID:9344
- C:\Windows\System\buTHcUy.exe
  C:\Windows\System\buTHcUy.exe
  2⤵
  PID:9396
- C:\Windows\System\VfuzEUZ.exe
  C:\Windows\System\VfuzEUZ.exe
  2⤵
  PID:9412
- C:\Windows\System\cznDKyr.exe
  C:\Windows\System\cznDKyr.exe
  2⤵
  PID:9452
- C:\Windows\System\tDNjvEM.exe
  C:\Windows\System\tDNjvEM.exe
  2⤵
  PID:9472
- C:\Windows\System\qrOnQUP.exe
  C:\Windows\System\qrOnQUP.exe
  2⤵
  PID:9500
- C:\Windows\System\sZstnWK.exe
  C:\Windows\System\sZstnWK.exe
  2⤵
  PID:9532
- C:\Windows\System\wusiOgV.exe
  C:\Windows\System\wusiOgV.exe
  2⤵
  PID:9552
- C:\Windows\System\zBJLSdN.exe
  C:\Windows\System\zBJLSdN.exe
  2⤵
  PID:9596
- C:\Windows\System\dicHVIh.exe
  C:\Windows\System\dicHVIh.exe
  2⤵
  PID:9632
- C:\Windows\System\rbNBZfy.exe
  C:\Windows\System\rbNBZfy.exe
  2⤵
  PID:9648
- C:\Windows\System\ZteIyyE.exe
  C:\Windows\System\ZteIyyE.exe
  2⤵
  PID:9664
- C:\Windows\System\axjWikn.exe
  C:\Windows\System\axjWikn.exe
  2⤵
  PID:9740
- C:\Windows\System\CofEafY.exe
  C:\Windows\System\CofEafY.exe
  2⤵
  PID:9756
- C:\Windows\System\tvdcusI.exe
  C:\Windows\System\tvdcusI.exe
  2⤵
  PID:9804
- C:\Windows\System\MkLfgDh.exe
  C:\Windows\System\MkLfgDh.exe
  2⤵
  PID:9824
- C:\Windows\System\wztHxqd.exe
  C:\Windows\System\wztHxqd.exe
  2⤵
  PID:9852
- C:\Windows\System\vIEoVAJ.exe
  C:\Windows\System\vIEoVAJ.exe
  2⤵
  PID:9880
- C:\Windows\System\EhEIjWj.exe
  C:\Windows\System\EhEIjWj.exe
  2⤵
  PID:9908
- C:\Windows\System\dcjqhUx.exe
  C:\Windows\System\dcjqhUx.exe
  2⤵
  PID:9936
- C:\Windows\System\iuJLzjL.exe
  C:\Windows\System\iuJLzjL.exe
  2⤵
  PID:9984
- C:\Windows\System\vZlofWG.exe
  C:\Windows\System\vZlofWG.exe
  2⤵
  PID:10004
- C:\Windows\System\SLougvh.exe
  C:\Windows\System\SLougvh.exe
  2⤵
  PID:10032
- C:\Windows\System\vDDuNPe.exe
  C:\Windows\System\vDDuNPe.exe
  2⤵
  PID:10052
- C:\Windows\System\VKaOEmz.exe
  C:\Windows\System\VKaOEmz.exe
  2⤵
  PID:10084
- C:\Windows\System\KiIBLkZ.exe
  C:\Windows\System\KiIBLkZ.exe
  2⤵
  PID:10112
- C:\Windows\System\IFxnfIU.exe
  C:\Windows\System\IFxnfIU.exe
  2⤵
  PID:10140
- C:\Windows\System\wLklWVK.exe
  C:\Windows\System\wLklWVK.exe
  2⤵
  PID:10160
- C:\Windows\System\VhooiQo.exe
  C:\Windows\System\VhooiQo.exe
  2⤵
  PID:10188
- C:\Windows\System\aDJMEqV.exe
  C:\Windows\System\aDJMEqV.exe
  2⤵
  PID:10220
- C:\Windows\System\nZkvHbS.exe
  C:\Windows\System\nZkvHbS.exe
  2⤵
  PID:9160
- C:\Windows\System\kbeLhOB.exe
  C:\Windows\System\kbeLhOB.exe
  2⤵
  PID:9268
- C:\Windows\System\tDRXeDl.exe
  C:\Windows\System\tDRXeDl.exe
  2⤵
  PID:9368
- C:\Windows\System\wFWgtwg.exe
  C:\Windows\System\wFWgtwg.exe
  2⤵
  PID:9440
- C:\Windows\System\LoWrrHr.exe
  C:\Windows\System\LoWrrHr.exe
  2⤵
  PID:9480
- C:\Windows\System\zRUIzOA.exe
  C:\Windows\System\zRUIzOA.exe
  2⤵
  PID:4356
- C:\Windows\System\oLSvPTw.exe
  C:\Windows\System\oLSvPTw.exe
  2⤵
  PID:9576
- C:\Windows\System\xBDoxQY.exe
  C:\Windows\System\xBDoxQY.exe
  2⤵
  PID:9608
- C:\Windows\System\puPCELo.exe
  C:\Windows\System\puPCELo.exe
  2⤵
  PID:9700
- C:\Windows\System\RhBeigv.exe
  C:\Windows\System\RhBeigv.exe
  2⤵
  PID:9716
- C:\Windows\System\eZbswMR.exe
  C:\Windows\System\eZbswMR.exe
  2⤵
  PID:9796
- C:\Windows\System\CIAMQpj.exe
  C:\Windows\System\CIAMQpj.exe
  2⤵
  PID:9872
- C:\Windows\System\bpeOVdg.exe
  C:\Windows\System\bpeOVdg.exe
  2⤵
  PID:9924
- C:\Windows\System\ihIrLIm.exe
  C:\Windows\System\ihIrLIm.exe
  2⤵
  PID:9976
- C:\Windows\System\pHWhDJf.exe
  C:\Windows\System\pHWhDJf.exe
  2⤵
  PID:10040
- C:\Windows\System\WDViQRu.exe
  C:\Windows\System\WDViQRu.exe
  2⤵
  PID:10128
- C:\Windows\System\NfMLMEJ.exe
  C:\Windows\System\NfMLMEJ.exe
  2⤵
  PID:10180
- C:\Windows\System\lUerTln.exe
  C:\Windows\System\lUerTln.exe
  2⤵
  PID:8912
- C:\Windows\System\hZAxgJv.exe
  C:\Windows\System\hZAxgJv.exe
  2⤵
  PID:9380
- C:\Windows\System\qgofOTE.exe
  C:\Windows\System\qgofOTE.exe
  2⤵
  PID:9404
- C:\Windows\System\KQSrFOf.exe
  C:\Windows\System\KQSrFOf.exe
  2⤵
  PID:9512
- C:\Windows\System\CxvaKxa.exe
  C:\Windows\System\CxvaKxa.exe
  2⤵
  PID:9584
- C:\Windows\System\rPPipKq.exe
  C:\Windows\System\rPPipKq.exe
  2⤵
  PID:9732
- C:\Windows\System\Wwnyfwu.exe
  C:\Windows\System\Wwnyfwu.exe
  2⤵
  PID:9980
- C:\Windows\System\xDHBhCF.exe
  C:\Windows\System\xDHBhCF.exe
  2⤵
  PID:10096
- C:\Windows\System\iERWLoD.exe
  C:\Windows\System\iERWLoD.exe
  2⤵
  PID:9236
- C:\Windows\System\copqmGi.exe
  C:\Windows\System\copqmGi.exe
  2⤵
  PID:9544
- C:\Windows\System\PBniRQD.exe
  C:\Windows\System\PBniRQD.exe
  2⤵
  PID:9640
- C:\Windows\System\DGNmVOU.exe
  C:\Windows\System\DGNmVOU.exe
  2⤵
  PID:10048
- C:\Windows\System\TFCfKoG.exe
  C:\Windows\System\TFCfKoG.exe
  2⤵
  PID:9340
- C:\Windows\System\zvlhvUw.exe
  C:\Windows\System\zvlhvUw.exe
  2⤵
  PID:2216
- C:\Windows\System\SoNBGjT.exe
  C:\Windows\System\SoNBGjT.exe
  2⤵
  PID:1248
- C:\Windows\System\uTIfHDd.exe
  C:\Windows\System\uTIfHDd.exe
  2⤵
  PID:10256
- C:\Windows\System\TjpmEuo.exe
  C:\Windows\System\TjpmEuo.exe
  2⤵
  PID:10276
- C:\Windows\System\aMWxhDS.exe
  C:\Windows\System\aMWxhDS.exe
  2⤵
  PID:10356
- C:\Windows\System\NqSfQqi.exe
  C:\Windows\System\NqSfQqi.exe
  2⤵
  PID:10372
- C:\Windows\System\vGTxesU.exe
  C:\Windows\System\vGTxesU.exe
  2⤵
  PID:10400
- C:\Windows\System\RlmHwns.exe
  C:\Windows\System\RlmHwns.exe
  2⤵
  PID:10424
- C:\Windows\System\rQptmkc.exe
  C:\Windows\System\rQptmkc.exe
  2⤵
  PID:10444
- C:\Windows\System\BFkqFJH.exe
  C:\Windows\System\BFkqFJH.exe
  2⤵
  PID:10464
- C:\Windows\System\NLgcvhf.exe
  C:\Windows\System\NLgcvhf.exe
  2⤵
  PID:10492
- C:\Windows\System\JbXSglt.exe
  C:\Windows\System\JbXSglt.exe
  2⤵
  PID:10516
- C:\Windows\System\RQjrAnm.exe
  C:\Windows\System\RQjrAnm.exe
  2⤵
  PID:10540
- C:\Windows\System\tonlXJq.exe
  C:\Windows\System\tonlXJq.exe
  2⤵
  PID:10576
- C:\Windows\System\bWfurKe.exe
  C:\Windows\System\bWfurKe.exe
  2⤵
  PID:10624
- C:\Windows\System\goVnEjO.exe
  C:\Windows\System\goVnEjO.exe
  2⤵
  PID:10648
- C:\Windows\System\JFeMmyv.exe
  C:\Windows\System\JFeMmyv.exe
  2⤵
  PID:10676
- C:\Windows\System\hLsvzbc.exe
  C:\Windows\System\hLsvzbc.exe
  2⤵
  PID:10696
- C:\Windows\System\XtbgamE.exe
  C:\Windows\System\XtbgamE.exe
  2⤵
  PID:10740
- C:\Windows\System\JUUjByb.exe
  C:\Windows\System\JUUjByb.exe
  2⤵
  PID:10756
- C:\Windows\System\xpEyReZ.exe
  C:\Windows\System\xpEyReZ.exe
  2⤵
  PID:10776
- C:\Windows\System\OiHPgsO.exe
  C:\Windows\System\OiHPgsO.exe
  2⤵
  PID:10800
- C:\Windows\System\dffBuhJ.exe
  C:\Windows\System\dffBuhJ.exe
  2⤵
  PID:10828
- C:\Windows\System\UqVLKaZ.exe
  C:\Windows\System\UqVLKaZ.exe
  2⤵
  PID:10844
- C:\Windows\System\eiWNrLL.exe
  C:\Windows\System\eiWNrLL.exe
  2⤵
  PID:10876
- C:\Windows\System\EcjGVJy.exe
  C:\Windows\System\EcjGVJy.exe
  2⤵
  PID:10920
- C:\Windows\System\hGDLHcH.exe
  C:\Windows\System\hGDLHcH.exe
  2⤵
  PID:10940
- C:\Windows\System\uGuZjfV.exe
  C:\Windows\System\uGuZjfV.exe
  2⤵
  PID:10968
- C:\Windows\System\qPVNxfI.exe
  C:\Windows\System\qPVNxfI.exe
  2⤵
  PID:11008
- C:\Windows\System\wTuzRUo.exe
  C:\Windows\System\wTuzRUo.exe
  2⤵
  PID:11028
- C:\Windows\System\bTlDoKF.exe
  C:\Windows\System\bTlDoKF.exe
  2⤵
  PID:11052
- C:\Windows\System\aVhhHxS.exe
  C:\Windows\System\aVhhHxS.exe
  2⤵
  PID:11076
- C:\Windows\System\qUqhjxq.exe
  C:\Windows\System\qUqhjxq.exe
  2⤵
  PID:11132
- C:\Windows\System\sgUqChy.exe
  C:\Windows\System\sgUqChy.exe
  2⤵
  PID:11148
- C:\Windows\System\jlCbozU.exe
  C:\Windows\System\jlCbozU.exe
  2⤵
  PID:11172
- C:\Windows\System\dgeGBXd.exe
  C:\Windows\System\dgeGBXd.exe
  2⤵
  PID:11216
- C:\Windows\System\USCMzcN.exe
  C:\Windows\System\USCMzcN.exe
  2⤵
  PID:11248
- C:\Windows\System\OPNoSgl.exe
  C:\Windows\System\OPNoSgl.exe
  2⤵
  PID:9540
- C:\Windows\System\ClJOivP.exe
  C:\Windows\System\ClJOivP.exe
  2⤵
  PID:10272
- C:\Windows\System\ROYYKvP.exe
  C:\Windows\System\ROYYKvP.exe
  2⤵
  PID:10320
- C:\Windows\System\FauMbaV.exe
  C:\Windows\System\FauMbaV.exe
  2⤵
  PID:10392
- C:\Windows\System\aoIGObY.exe
  C:\Windows\System\aoIGObY.exe
  2⤵
  PID:10512
- C:\Windows\System\CgLUskm.exe
  C:\Windows\System\CgLUskm.exe
  2⤵
  PID:9560
- C:\Windows\System\DgnPXaj.exe
  C:\Windows\System\DgnPXaj.exe
  2⤵
  PID:10632
- C:\Windows\System\oOyComQ.exe
  C:\Windows\System\oOyComQ.exe
  2⤵
  PID:10716
- C:\Windows\System\EdxgEjq.exe
  C:\Windows\System\EdxgEjq.exe
  2⤵
  PID:1056
- C:\Windows\System\RhCdPxI.exe
  C:\Windows\System\RhCdPxI.exe
  2⤵
  PID:10752
- C:\Windows\System\vodRxWY.exe
  C:\Windows\System\vodRxWY.exe
  2⤵
  PID:10816
- C:\Windows\System\xPLLyni.exe
  C:\Windows\System\xPLLyni.exe
  2⤵
  PID:10888
- C:\Windows\System\KAPSLUp.exe
  C:\Windows\System\KAPSLUp.exe
  2⤵
  PID:10932
- C:\Windows\System\eogYvlI.exe
  C:\Windows\System\eogYvlI.exe
  2⤵
  PID:10984
- C:\Windows\System\SpHrMau.exe
  C:\Windows\System\SpHrMau.exe
  2⤵
  PID:11104
- C:\Windows\System\hozeIWD.exe
  C:\Windows\System\hozeIWD.exe
  2⤵
  PID:11144
- C:\Windows\System\APuKCNa.exe
  C:\Windows\System\APuKCNa.exe
  2⤵
  PID:11208
- C:\Windows\System\osmxmAc.exe
  C:\Windows\System\osmxmAc.exe
  2⤵
  PID:10244
- C:\Windows\System\FmGUtOQ.exe
  C:\Windows\System\FmGUtOQ.exe
  2⤵
  PID:10508
- C:\Windows\System\jxQYSke.exe
  C:\Windows\System\jxQYSke.exe
  2⤵
  PID:10500
- C:\Windows\System\OvhHpEp.exe
  C:\Windows\System\OvhHpEp.exe
  2⤵
  PID:10644
- C:\Windows\System\uzaGtRw.exe
  C:\Windows\System\uzaGtRw.exe
  2⤵
  PID:2596
- C:\Windows\System\aaTzPdw.exe
  C:\Windows\System\aaTzPdw.exe
  2⤵
  PID:10868
- C:\Windows\System\OYqTIeS.exe
  C:\Windows\System\OYqTIeS.exe
  2⤵
  PID:11000
- C:\Windows\System\zNjGeBx.exe
  C:\Windows\System\zNjGeBx.exe
  2⤵
  PID:11196
- C:\Windows\System\ZhUmCul.exe
  C:\Windows\System\ZhUmCul.exe
  2⤵
  PID:3236
- C:\Windows\System\IURqayB.exe
  C:\Windows\System\IURqayB.exe
  2⤵
  PID:10596
- C:\Windows\System\GpqwKAd.exe
  C:\Windows\System\GpqwKAd.exe
  2⤵
  PID:11120
- C:\Windows\System\lPZryZx.exe
  C:\Windows\System\lPZryZx.exe
  2⤵
  PID:11020
- C:\Windows\System\EfAgmUa.exe
  C:\Windows\System\EfAgmUa.exe
  2⤵
  PID:10964
- C:\Windows\System\suxMxqm.exe
  C:\Windows\System\suxMxqm.exe
  2⤵
  PID:11276
- C:\Windows\System\IRBoJed.exe
  C:\Windows\System\IRBoJed.exe
  2⤵
  PID:11308
- C:\Windows\System\mJyrukg.exe
  C:\Windows\System\mJyrukg.exe
  2⤵
  PID:11328
- C:\Windows\System\OenFHrC.exe
  C:\Windows\System\OenFHrC.exe
  2⤵
  PID:11376
- C:\Windows\System\cXSEZjJ.exe
  C:\Windows\System\cXSEZjJ.exe
  2⤵
  PID:11392
- C:\Windows\System\PIxiqxa.exe
  C:\Windows\System\PIxiqxa.exe
  2⤵
  PID:11440
- C:\Windows\System\BHkIGVf.exe
  C:\Windows\System\BHkIGVf.exe
  2⤵
  PID:11460
- C:\Windows\System\ufoCgUx.exe
  C:\Windows\System\ufoCgUx.exe
  2⤵
  PID:11500
- C:\Windows\System\JSbtfHA.exe
  C:\Windows\System\JSbtfHA.exe
  2⤵
  PID:11520
- C:\Windows\System\EoXlawT.exe
  C:\Windows\System\EoXlawT.exe
  2⤵
  PID:11552
- C:\Windows\System\UYmfdHg.exe
  C:\Windows\System\UYmfdHg.exe
  2⤵
  PID:11572
- C:\Windows\System\XSnAVLC.exe
  C:\Windows\System\XSnAVLC.exe
  2⤵
  PID:11592
- C:\Windows\System\DwVhFSh.exe
  C:\Windows\System\DwVhFSh.exe
  2⤵
  PID:11628
- C:\Windows\System\YgtETMo.exe
  C:\Windows\System\YgtETMo.exe
  2⤵
  PID:11656
- C:\Windows\System\lKXnDiR.exe
  C:\Windows\System\lKXnDiR.exe
  2⤵
  PID:11696
- C:\Windows\System\pVFIDHa.exe
  C:\Windows\System\pVFIDHa.exe
  2⤵
  PID:11720
- C:\Windows\System\xeFeAqk.exe
  C:\Windows\System\xeFeAqk.exe
  2⤵
  PID:11748
- C:\Windows\System\bEOqFcJ.exe
  C:\Windows\System\bEOqFcJ.exe
  2⤵
  PID:11776
- C:\Windows\System\IjNeJoV.exe
  C:\Windows\System\IjNeJoV.exe
  2⤵
  PID:11800
- C:\Windows\System\oZEEVnj.exe
  C:\Windows\System\oZEEVnj.exe
  2⤵
  PID:11840
- C:\Windows\System\HtxKvKI.exe
  C:\Windows\System\HtxKvKI.exe
  2⤵
  PID:11944
- C:\Windows\System\CCPLNos.exe
  C:\Windows\System\CCPLNos.exe
  2⤵
  PID:11960
- C:\Windows\System\mcQmjKx.exe
  C:\Windows\System\mcQmjKx.exe
  2⤵
  PID:11988
- C:\Windows\System\yjtojpv.exe
  C:\Windows\System\yjtojpv.exe
  2⤵
  PID:12032
- C:\Windows\System\grqcyVi.exe
  C:\Windows\System\grqcyVi.exe
  2⤵
  PID:12052
- C:\Windows\System\IOGbgiO.exe
  C:\Windows\System\IOGbgiO.exe
  2⤵
  PID:12084
- C:\Windows\System\pGllYZx.exe
  C:\Windows\System\pGllYZx.exe
  2⤵
  PID:12116
- C:\Windows\System\obHKMHH.exe
  C:\Windows\System\obHKMHH.exe
  2⤵
  PID:12140
- C:\Windows\System\OcInDAh.exe
  C:\Windows\System\OcInDAh.exe
  2⤵
  PID:12160
- C:\Windows\System\GJhesKa.exe
  C:\Windows\System\GJhesKa.exe
  2⤵
  PID:12188
- C:\Windows\System\fxVxcWm.exe
  C:\Windows\System\fxVxcWm.exe
  2⤵
  PID:12228
- C:\Windows\System\LMsjpYM.exe
  C:\Windows\System\LMsjpYM.exe
  2⤵
  PID:12248
- C:\Windows\System\eRWEnuD.exe
  C:\Windows\System\eRWEnuD.exe
  2⤵
  PID:12272
- C:\Windows\System\xLAikAs.exe
  C:\Windows\System\xLAikAs.exe
  2⤵
  PID:11268
- C:\Windows\System\iDZMUhQ.exe
  C:\Windows\System\iDZMUhQ.exe
  2⤵
  PID:11324
- C:\Windows\System\BAhWslU.exe
  C:\Windows\System\BAhWslU.exe
  2⤵
  PID:11404
- C:\Windows\System\wfxWkaP.exe
  C:\Windows\System\wfxWkaP.exe
  2⤵
  PID:11452
- C:\Windows\System\FTWFIlo.exe
  C:\Windows\System\FTWFIlo.exe
  2⤵
  PID:11516
- C:\Windows\System\hPAiyMl.exe
  C:\Windows\System\hPAiyMl.exe
  2⤵
  PID:11564
- C:\Windows\System\yuKGtZl.exe
  C:\Windows\System\yuKGtZl.exe
  2⤵
  PID:11636
- C:\Windows\System\BTpEIZI.exe
  C:\Windows\System\BTpEIZI.exe
  2⤵
  PID:11712
- C:\Windows\System\wUWMvST.exe
  C:\Windows\System\wUWMvST.exe
  2⤵
  PID:11796
- C:\Windows\System\ddiAGhg.exe
  C:\Windows\System\ddiAGhg.exe
  2⤵
  PID:11872
- C:\Windows\System\IBdasfc.exe
  C:\Windows\System\IBdasfc.exe
  2⤵
  PID:11892
- C:\Windows\System\ZVxdtrr.exe
  C:\Windows\System\ZVxdtrr.exe
  2⤵
  PID:11932
- C:\Windows\System\BxAqlJf.exe
  C:\Windows\System\BxAqlJf.exe
  2⤵
  PID:11856
- C:\Windows\System\ydsvcKw.exe
  C:\Windows\System\ydsvcKw.exe
  2⤵
  PID:12016
- C:\Windows\System\tYEmTzB.exe
  C:\Windows\System\tYEmTzB.exe
  2⤵
  PID:12072
- C:\Windows\System\NZEuvZc.exe
  C:\Windows\System\NZEuvZc.exe
  2⤵
  PID:12156
- C:\Windows\System\NHgpzuf.exe
  C:\Windows\System\NHgpzuf.exe
  2⤵
  PID:12220
- C:\Windows\System\ChdNsLr.exe
  C:\Windows\System\ChdNsLr.exe
  2⤵
  PID:12244
- C:\Windows\System\PVMAmRI.exe
  C:\Windows\System\PVMAmRI.exe
  2⤵
  PID:11320
- C:\Windows\System\SLjPUaN.exe
  C:\Windows\System\SLjPUaN.exe
  2⤵
  PID:11456
- C:\Windows\System\CdtyoDF.exe
  C:\Windows\System\CdtyoDF.exe
  2⤵
  PID:11588
- C:\Windows\System\uzhBvHl.exe
  C:\Windows\System\uzhBvHl.exe
  2⤵
  PID:11768
- C:\Windows\System\zeBTlMV.exe
  C:\Windows\System\zeBTlMV.exe
  2⤵
  PID:5416
- C:\Windows\System\OngYhbQ.exe
  C:\Windows\System\OngYhbQ.exe
  2⤵
  PID:2016
- C:\Windows\System\pkIJhht.exe
  C:\Windows\System\pkIJhht.exe
  2⤵
  PID:11904
- C:\Windows\System\pDQlbOx.exe
  C:\Windows\System\pDQlbOx.exe
  2⤵
  PID:11984
- C:\Windows\System\koyHOMO.exe
  C:\Windows\System\koyHOMO.exe
  2⤵
  PID:12148
- C:\Windows\System\PTTuRyh.exe
  C:\Windows\System\PTTuRyh.exe
  2⤵
  PID:12240
- C:\Windows\System\LWDLiSV.exe
  C:\Windows\System\LWDLiSV.exe
  2⤵
  PID:11676
- C:\Windows\System\JCvANCs.exe
  C:\Windows\System\JCvANCs.exe
  2⤵
  PID:5080
- C:\Windows\System\FRYWOBa.exe
  C:\Windows\System\FRYWOBa.exe
  2⤵
  PID:11996
- C:\Windows\System\cEtOrWR.exe
  C:\Windows\System\cEtOrWR.exe
  2⤵
  PID:11360
- C:\Windows\System\zVTlevd.exe
  C:\Windows\System\zVTlevd.exe
  2⤵
  PID:12312
- C:\Windows\System\zyaCIzE.exe
  C:\Windows\System\zyaCIzE.exe
  2⤵
  PID:12336
- C:\Windows\System\fPgOLJZ.exe
  C:\Windows\System\fPgOLJZ.exe
  2⤵
  PID:12356
- C:\Windows\System\XvxTxCD.exe
  C:\Windows\System\XvxTxCD.exe
  2⤵
  PID:12380
- C:\Windows\System\XjlicGK.exe
  C:\Windows\System\XjlicGK.exe
  2⤵
  PID:12428
- C:\Windows\System\irXeakQ.exe
  C:\Windows\System\irXeakQ.exe
  2⤵
  PID:12448
- C:\Windows\System\JlHMqjy.exe
  C:\Windows\System\JlHMqjy.exe
  2⤵
  PID:12504
- C:\Windows\System\oDnsPOQ.exe
  C:\Windows\System\oDnsPOQ.exe
  2⤵
  PID:12524
- C:\Windows\System\xcZAvfI.exe
  C:\Windows\System\xcZAvfI.exe
  2⤵
  PID:12540
- C:\Windows\System\LThslOF.exe
  C:\Windows\System\LThslOF.exe
  2⤵
  PID:12568
- C:\Windows\System\pWVUNPO.exe
  C:\Windows\System\pWVUNPO.exe
  2⤵
  PID:12592
- C:\Windows\System\sNEbtQv.exe
  C:\Windows\System\sNEbtQv.exe
  2⤵
  PID:12612
- C:\Windows\System\pighBWo.exe
  C:\Windows\System\pighBWo.exe
  2⤵
  PID:12636
- C:\Windows\System\uZddyvq.exe
  C:\Windows\System\uZddyvq.exe
  2⤵
  PID:12696
- C:\Windows\System\aMHvqqS.exe
  C:\Windows\System\aMHvqqS.exe
  2⤵
  PID:12720
- C:\Windows\System\EPehXmL.exe
  C:\Windows\System\EPehXmL.exe
  2⤵
  PID:12740
- C:\Windows\System\nwubktS.exe
  C:\Windows\System\nwubktS.exe
  2⤵
  PID:12788
- C:\Windows\System\hGckPpj.exe
  C:\Windows\System\hGckPpj.exe
  2⤵
  PID:12804
- C:\Windows\System\jQzdXbO.exe
  C:\Windows\System\jQzdXbO.exe
  2⤵
  PID:12844
- C:\Windows\System\ckbKnRD.exe
  C:\Windows\System\ckbKnRD.exe
  2⤵
  PID:12864
- C:\Windows\System\IUotHaI.exe
  C:\Windows\System\IUotHaI.exe
  2⤵
  PID:12900
- C:\Windows\System\eNIXofx.exe
  C:\Windows\System\eNIXofx.exe
  2⤵
  PID:12928
- C:\Windows\System\yckVIDp.exe
  C:\Windows\System\yckVIDp.exe
  2⤵
  PID:12944
- C:\Windows\System\UMujnPw.exe
  C:\Windows\System\UMujnPw.exe
  2⤵
  PID:12972
- C:\Windows\System\ccWmaJD.exe
  C:\Windows\System\ccWmaJD.exe
  2⤵
  PID:12992
- C:\Windows\System\hIMTcrc.exe
  C:\Windows\System\hIMTcrc.exe
  2⤵
  PID:13012
- C:\Windows\System\Wqcqziw.exe
  C:\Windows\System\Wqcqziw.exe
  2⤵
  PID:13056
- C:\Windows\System\lAAFYSn.exe
  C:\Windows\System\lAAFYSn.exe
  2⤵
  PID:12728
- C:\Windows\System\osbJleh.exe
  C:\Windows\System\osbJleh.exe
  2⤵
  PID:12800
- C:\Windows\System\EXFhrhM.exe
  C:\Windows\System\EXFhrhM.exe
  2⤵
  PID:12920
- C:\Windows\System\aJZoeCV.exe
  C:\Windows\System\aJZoeCV.exe
  2⤵
  PID:12984
- C:\Windows\System\PnmPPkH.exe
  C:\Windows\System\PnmPPkH.exe
  2⤵
  PID:13076
- C:\Windows\System\sWjyqSM.exe
  C:\Windows\System\sWjyqSM.exe
  2⤵
  PID:13064
- C:\Windows\System\BEDTWih.exe
  C:\Windows\System\BEDTWih.exe
  2⤵
  PID:13088
- C:\Windows\System\WyXwobx.exe
  C:\Windows\System\WyXwobx.exe
  2⤵
  PID:4960
- C:\Windows\System\PrNzfPi.exe
  C:\Windows\System\PrNzfPi.exe
  2⤵
  PID:13200
- C:\Windows\System\gyEEqJd.exe
  C:\Windows\System\gyEEqJd.exe
  2⤵
  PID:13240
- C:\Windows\System\BDgMTRC.exe
  C:\Windows\System\BDgMTRC.exe
  2⤵
  PID:4364
- C:\Windows\System\QZNOujZ.exe
  C:\Windows\System\QZNOujZ.exe
  2⤵
  PID:1092
- C:\Windows\System\IIveYtt.exe
  C:\Windows\System\IIveYtt.exe
  2⤵
  PID:13160
- C:\Windows\System\zvgcexz.exe
  C:\Windows\System\zvgcexz.exe
  2⤵
  PID:13296
- C:\Windows\System\VmnqzjH.exe
  C:\Windows\System\VmnqzjH.exe
  2⤵
  PID:10656
- C:\Windows\System\ruvaTWW.exe
  C:\Windows\System\ruvaTWW.exe
  2⤵
  PID:11600
- C:\Windows\System\PVgAdnA.exe
  C:\Windows\System\PVgAdnA.exe
  2⤵
  PID:12352
- C:\Windows\System\ymayGgO.exe
  C:\Windows\System\ymayGgO.exe
  2⤵
  PID:12420
- C:\Windows\System\coyCKlY.exe
  C:\Windows\System\coyCKlY.exe
  2⤵
  PID:12376
- C:\Windows\System\ALBhusr.exe
  C:\Windows\System\ALBhusr.exe
  2⤵
  PID:12488
- C:\Windows\System\qeTTTlc.exe
  C:\Windows\System\qeTTTlc.exe
  2⤵
  PID:12704
- C:\Windows\System\qOuuePh.exe
  C:\Windows\System\qOuuePh.exe
  2⤵
  PID:12772
- C:\Windows\System\XqyKUBM.exe
  C:\Windows\System\XqyKUBM.exe
  2⤵
  PID:12828
- C:\Windows\System\FPNFxCM.exe
  C:\Windows\System\FPNFxCM.exe
  2⤵
  PID:12884
- C:\Windows\System\IMQmAsr.exe
  C:\Windows\System\IMQmAsr.exe
  2⤵
  PID:13080
- C:\Windows\System\tRbRGMl.exe
  C:\Windows\System\tRbRGMl.exe
  2⤵
  PID:13032
- C:\Windows\System\ceUUbzB.exe
  C:\Windows\System\ceUUbzB.exe
  2⤵
  PID:13180
- C:\Windows\System\VVTbdRb.exe
  C:\Windows\System\VVTbdRb.exe
  2⤵
  PID:3628
- C:\Windows\System\aiYTTwB.exe
  C:\Windows\System\aiYTTwB.exe
  2⤵
  PID:13228
- C:\Windows\System\RpxdKSF.exe
  C:\Windows\System\RpxdKSF.exe
  2⤵
  PID:13208
- C:\Windows\System\lLysBmY.exe
  C:\Windows\System\lLysBmY.exe
  2⤵
  PID:3704
- C:\Windows\System\djwMKqi.exe
  C:\Windows\System\djwMKqi.exe
  2⤵
  PID:4932
- C:\Windows\System\wQHOOsI.exe
  C:\Windows\System\wQHOOsI.exe
  2⤵
  PID:4332
- C:\Windows\System\CiLYWsV.exe
  C:\Windows\System\CiLYWsV.exe
  2⤵
  PID:1388
- C:\Windows\System\YeSlmAc.exe
  C:\Windows\System\YeSlmAc.exe
  2⤵
  PID:5096
- C:\Windows\System\CWwvCYC.exe
  C:\Windows\System\CWwvCYC.exe
  2⤵
  PID:2448
- C:\Windows\System\nisRuNL.exe
  C:\Windows\System\nisRuNL.exe
  2⤵
  PID:11980
- C:\Windows\System\UoFsbRZ.exe
  C:\Windows\System\UoFsbRZ.exe
  2⤵
  PID:1088
- C:\Windows\System\qPzQQCZ.exe
  C:\Windows\System\qPzQQCZ.exe
  2⤵
  PID:12372
- C:\Windows\System\PODeGRW.exe
  C:\Windows\System\PODeGRW.exe
  2⤵
  PID:3604
- C:\Windows\System\MhvpHqP.exe
  C:\Windows\System\MhvpHqP.exe
  2⤵
  PID:13308
- C:\Windows\System\dNiSCAZ.exe
  C:\Windows\System\dNiSCAZ.exe
  2⤵
  PID:2992
- C:\Windows\System\ECnOJbO.exe
  C:\Windows\System\ECnOJbO.exe
  2⤵
  PID:3312
- C:\Windows\System\vMdikIe.exe
  C:\Windows\System\vMdikIe.exe
  2⤵
  PID:3820
- C:\Windows\System\irBXMil.exe
  C:\Windows\System\irBXMil.exe
  2⤵
  PID:6996
- C:\Windows\System\huuiFcg.exe
  C:\Windows\System\huuiFcg.exe
  2⤵
  PID:3944
- C:\Windows\System\khuUIkB.exe
  C:\Windows\System\khuUIkB.exe
  2⤵
  PID:2768
- C:\Windows\System\PNvcECD.exe
  C:\Windows\System\PNvcECD.exe
  2⤵
  PID:2500
- C:\Windows\System\HuGdJsQ.exe
  C:\Windows\System\HuGdJsQ.exe
  2⤵
  PID:964
- C:\Windows\System\hepLZEl.exe
  C:\Windows\System\hepLZEl.exe
  2⤵
  PID:4244
- C:\Windows\System\GDPRnCZ.exe
  C:\Windows\System\GDPRnCZ.exe
  2⤵
  PID:12832
- C:\Windows\System\jXxlHGc.exe
  C:\Windows\System\jXxlHGc.exe
  2⤵
  PID:2332
- C:\Windows\System\pAgFbUA.exe
  C:\Windows\System\pAgFbUA.exe
  2⤵
  PID:5000
- C:\Windows\System\pOcUYEG.exe
  C:\Windows\System\pOcUYEG.exe
  2⤵
  PID:12708
- C:\Windows\System\xNFEmDx.exe
  C:\Windows\System\xNFEmDx.exe
  2⤵
  PID:3464
- C:\Windows\System\jICZwyY.exe
  C:\Windows\System\jICZwyY.exe
  2⤵
  PID:13004
- C:\Windows\System\UwAfvhg.exe
  C:\Windows\System\UwAfvhg.exe
  2⤵
  PID:640
- C:\Windows\System\qbKPHsG.exe
  C:\Windows\System\qbKPHsG.exe
  2⤵
  PID:6604
- C:\Windows\System\MjKesIp.exe
  C:\Windows\System\MjKesIp.exe
  2⤵
  PID:4148
- C:\Windows\System\nwGnHOa.exe
  C:\Windows\System\nwGnHOa.exe
  2⤵
  PID:980
- C:\Windows\System\CRTdzid.exe
  C:\Windows\System\CRTdzid.exe
  2⤵
  PID:6948
- C:\Windows\System\rITGXZF.exe
  C:\Windows\System\rITGXZF.exe
  2⤵
  PID:4660
- C:\Windows\System\bFEneGF.exe
  C:\Windows\System\bFEneGF.exe
  2⤵
  PID:5084
- C:\Windows\System\qxrkmwV.exe
  C:\Windows\System\qxrkmwV.exe
  2⤵
  PID:6772
- C:\Windows\System\YCtcOnD.exe
  C:\Windows\System\YCtcOnD.exe
  2⤵
  PID:696
- C:\Windows\System\fevrBIF.exe
  C:\Windows\System\fevrBIF.exe
  2⤵
  PID:4168
- C:\Windows\System\LNORqNU.exe
  C:\Windows\System\LNORqNU.exe
  2⤵
  PID:2212
- C:\Windows\System\HDaMDBk.exe
  C:\Windows\System\HDaMDBk.exe
  2⤵
  PID:744
- C:\Windows\System\vtUttUN.exe
  C:\Windows\System\vtUttUN.exe
  2⤵
  PID:12988
- C:\Windows\System\NhGiCWv.exe
  C:\Windows\System\NhGiCWv.exe
  2⤵
  PID:804
- C:\Windows\System\wQOkQSz.exe
  C:\Windows\System\wQOkQSz.exe
  2⤵
  PID:4928
- C:\Windows\System\MdCHKDS.exe
  C:\Windows\System\MdCHKDS.exe
  2⤵
  PID:4968
- C:\Windows\System\EdWKvQr.exe
  C:\Windows\System\EdWKvQr.exe
  2⤵
  PID:2816
- C:\Windows\System\FiCgcSD.exe
  C:\Windows\System\FiCgcSD.exe
  2⤵
  PID:13140
- C:\Windows\System\ZNIwDJJ.exe
  C:\Windows\System\ZNIwDJJ.exe
  2⤵
  PID:13164
- C:\Windows\System\KeqNRBW.exe
  C:\Windows\System\KeqNRBW.exe
  2⤵
  PID:4856
- C:\Windows\System\PfCDJxC.exe
  C:\Windows\System\PfCDJxC.exe
  2⤵
  PID:2280
- C:\Windows\System\gVREkgJ.exe
  C:\Windows\System\gVREkgJ.exe
  2⤵
  PID:7076
- C:\Windows\System\MESFoff.exe
  C:\Windows\System\MESFoff.exe
  2⤵
  PID:2828
- C:\Windows\System\eUVPWGh.exe
  C:\Windows\System\eUVPWGh.exe
  2⤵
  PID:1216
- C:\Windows\System\fzEtISP.exe
  C:\Windows\System\fzEtISP.exe
  2⤵
  PID:4948
- C:\Windows\System\LCXIhgK.exe
  C:\Windows\System\LCXIhgK.exe
  2⤵
  PID:8
- C:\Windows\System\xBaSEue.exe
  C:\Windows\System\xBaSEue.exe
  2⤵
  PID:2128
- C:\Windows\System\uCQgGkn.exe
  C:\Windows\System\uCQgGkn.exe
  2⤵
  PID:1844
- C:\Windows\System\aIcgyRK.exe
  C:\Windows\System\aIcgyRK.exe
  2⤵
  PID:1436
- C:\Windows\System\xMgLgSv.exe
  C:\Windows\System\xMgLgSv.exe
  2⤵
  PID:13260
- C:\Windows\System\usXCeBu.exe
  C:\Windows\System\usXCeBu.exe
  2⤵
  PID:4776
- C:\Windows\System\noptYix.exe
  C:\Windows\System\noptYix.exe
  2⤵
  PID:4940
- C:\Windows\System\KhAIZns.exe
  C:\Windows\System\KhAIZns.exe
  2⤵
  PID:3156
- C:\Windows\System\HPICPal.exe
  C:\Windows\System\HPICPal.exe
  2⤵
  PID:4072
- C:\Windows\System\NHxqknA.exe
  C:\Windows\System\NHxqknA.exe
  2⤵
  PID:3608
- C:\Windows\System\GtbMpqK.exe
  C:\Windows\System\GtbMpqK.exe
  2⤵
  PID:4368
- C:\Windows\System\crPMuew.exe
  C:\Windows\System\crPMuew.exe
  2⤵
  PID:2412
- C:\Windows\System\oFYldrf.exe
  C:\Windows\System\oFYldrf.exe
  2⤵
  PID:12408
- C:\Windows\System\wdhFpiA.exe
  C:\Windows\System\wdhFpiA.exe
  2⤵
  PID:4520
- C:\Windows\System\ZhDIpGA.exe
  C:\Windows\System\ZhDIpGA.exe
  2⤵
  PID:4352
- C:\Windows\System\ZqNvUFf.exe
  C:\Windows\System\ZqNvUFf.exe
  2⤵
  PID:4604
- C:\Windows\System\ObkggqA.exe
  C:\Windows\System\ObkggqA.exe
  2⤵
  PID:1452
- C:\Windows\System\RCXKTEq.exe
  C:\Windows\System\RCXKTEq.exe
  2⤵
  PID:3024
- C:\Windows\System\yeaSHfK.exe
  C:\Windows\System\yeaSHfK.exe
  2⤵
  PID:1464
- C:\Windows\System\AHFLIHs.exe
  C:\Windows\System\AHFLIHs.exe
  2⤵
  PID:12440
- C:\Windows\System\uJSLbEp.exe
  C:\Windows\System\uJSLbEp.exe
  2⤵
  PID:3368
- C:\Windows\System\QzYWwQK.exe
  C:\Windows\System\QzYWwQK.exe
  2⤵
  PID:6912
- C:\Windows\System\VuYItrm.exe
  C:\Windows\System\VuYItrm.exe
  2⤵
  PID:5160
- C:\Windows\System\PlVMsMe.exe
  C:\Windows\System\PlVMsMe.exe
  2⤵
  PID:4024
- C:\Windows\System\SCoxmlB.exe
  C:\Windows\System\SCoxmlB.exe
  2⤵
  PID:3736
- C:\Windows\System\hEYFDJk.exe
  C:\Windows\System\hEYFDJk.exe
  2⤵
  PID:1576
- C:\Windows\System\ZgnLQPV.exe
  C:\Windows\System\ZgnLQPV.exe
  2⤵
  PID:12752
- C:\Windows\System\KzWbfQg.exe
  C:\Windows\System\KzWbfQg.exe
  2⤵
  PID:12576
- C:\Windows\System\MCxFSed.exe
  C:\Windows\System\MCxFSed.exe
  2⤵
  PID:5308
- C:\Windows\System\hBLyoHh.exe
  C:\Windows\System\hBLyoHh.exe
  2⤵
  PID:12860
- C:\Windows\System\TkGBVQA.exe
  C:\Windows\System\TkGBVQA.exe
  2⤵
  PID:12824
- C:\Windows\System\EPLQVol.exe
  C:\Windows\System\EPLQVol.exe
  2⤵
  PID:5348
- C:\Windows\System\LuMtjto.exe
  C:\Windows\System\LuMtjto.exe
  2⤵
  PID:544
- C:\Windows\System\hzOKRiw.exe
  C:\Windows\System\hzOKRiw.exe
  2⤵
  PID:5432
- C:\Windows\System\EYTwvxv.exe
  C:\Windows\System\EYTwvxv.exe
  2⤵
  PID:2920
- C:\Windows\System\wGIDrbf.exe
  C:\Windows\System\wGIDrbf.exe
  2⤵
  PID:6412
- C:\Windows\System\UYqPgUd.exe
  C:\Windows\System\UYqPgUd.exe
  2⤵
  PID:5488
- C:\Windows\System\oKKaRnJ.exe
  C:\Windows\System\oKKaRnJ.exe
  2⤵
  PID:6252
- C:\Windows\System\cTmvUBZ.exe
  C:\Windows\System\cTmvUBZ.exe
  2⤵
  PID:6524
- C:\Windows\System\MQqKfrx.exe
  C:\Windows\System\MQqKfrx.exe
  2⤵
  PID:6408
- C:\Windows\System\XIrxhOX.exe
  C:\Windows\System\XIrxhOX.exe
  2⤵
  PID:1548
- C:\Windows\System\TpVoziC.exe
  C:\Windows\System\TpVoziC.exe
  2⤵
  PID:7192
- C:\Windows\System\TQeGQJu.exe
  C:\Windows\System\TQeGQJu.exe
  2⤵
  PID:3380
- C:\Windows\System\NqPmMVP.exe
  C:\Windows\System\NqPmMVP.exe
  2⤵
  PID:4656
- C:\Windows\System\EuYrolv.exe
  C:\Windows\System\EuYrolv.exe
  2⤵
  PID:5628
- C:\Windows\System\QIRKFhk.exe
  C:\Windows\System\QIRKFhk.exe
  2⤵
  PID:1868
- C:\Windows\System\IPQzXqb.exe
  C:\Windows\System\IPQzXqb.exe
  2⤵
  PID:5672
- C:\Windows\System\ZMUzFRs.exe
  C:\Windows\System\ZMUzFRs.exe
  2⤵
  PID:7412
- C:\Windows\System\Rzdidji.exe
  C:\Windows\System\Rzdidji.exe
  2⤵
  PID:7452
- C:\Windows\System\vQuATlm.exe
  C:\Windows\System\vQuATlm.exe
  2⤵
  PID:5712
- C:\Windows\System\eCSovWw.exe
  C:\Windows\System\eCSovWw.exe
  2⤵
  PID:7488
- C:\Windows\System\yYtcIvf.exe
  C:\Windows\System\yYtcIvf.exe
  2⤵
  PID:13104
- C:\Windows\System\stTHWVV.exe
  C:\Windows\System\stTHWVV.exe
  2⤵
  PID:2640
- C:\Windows\System\CnHItFN.exe
  C:\Windows\System\CnHItFN.exe
  2⤵
  PID:7640
- C:\Windows\System\FbDKpGv.exe
  C:\Windows\System\FbDKpGv.exe
  2⤵
  PID:5768
- C:\Windows\System\GzHeAcu.exe
  C:\Windows\System\GzHeAcu.exe
  2⤵
  PID:892
- C:\Windows\System\ihkoYHf.exe
  C:\Windows\System\ihkoYHf.exe
  2⤵
  PID:5812
- C:\Windows\System\AUGikVt.exe
  C:\Windows\System\AUGikVt.exe
  2⤵
  PID:4320
- C:\Windows\System\PnQVpNz.exe
  C:\Windows\System\PnQVpNz.exe
  2⤵
  PID:4780
- C:\Windows\System\LkcnKUE.exe
  C:\Windows\System\LkcnKUE.exe
  2⤵
  PID:7764
- C:\Windows\System\xzzHctO.exe
  C:\Windows\System\xzzHctO.exe
  2⤵
  PID:13212
- C:\Windows\System\DaSAfEH.exe
  C:\Windows\System\DaSAfEH.exe
  2⤵
  PID:7804
- C:\Windows\System\iAxnhWg.exe
  C:\Windows\System\iAxnhWg.exe
  2⤵
  PID:5912
- C:\Windows\System\QIWKUbK.exe
  C:\Windows\System\QIWKUbK.exe
  2⤵
  PID:13204
- C:\Windows\System\unzGpzo.exe
  C:\Windows\System\unzGpzo.exe
  2⤵
  PID:3996
- C:\Windows\System\ngBcaau.exe
  C:\Windows\System\ngBcaau.exe
  2⤵
  PID:5952
- C:\Windows\System\lUtLpNJ.exe
  C:\Windows\System\lUtLpNJ.exe
  2⤵
  PID:7992
- C:\Windows\System\AhsLiIq.exe
  C:\Windows\System\AhsLiIq.exe
  2⤵
  PID:7036
- C:\Windows\System\BVHgIjw.exe
  C:\Windows\System\BVHgIjw.exe
  2⤵
  PID:3152
- C:\Windows\System\WkyqWSD.exe
  C:\Windows\System\WkyqWSD.exe
  2⤵
  PID:2784
- C:\Windows\System\uDJDrFG.exe
  C:\Windows\System\uDJDrFG.exe
  2⤵
  PID:5980
- C:\Windows\System\TjJkQIV.exe
  C:\Windows\System\TjJkQIV.exe
  2⤵
  PID:8068
- C:\Windows\System\OaxekIf.exe
  C:\Windows\System\OaxekIf.exe
  2⤵
  PID:13300
- C:\Windows\System\laeXhDM.exe
  C:\Windows\System\laeXhDM.exe
  2⤵
  PID:6052
- C:\Windows\System\bEkmbuQ.exe
  C:\Windows\System\bEkmbuQ.exe
  2⤵
  PID:7172
- C:\Windows\System\sdVlxHR.exe
  C:\Windows\System\sdVlxHR.exe
  2⤵
  PID:6080
- C:\Windows\System\PVEeejl.exe
  C:\Windows\System\PVEeejl.exe
  2⤵
  PID:7360
- C:\Windows\System\DjNsiMC.exe
  C:\Windows\System\DjNsiMC.exe
  2⤵
  PID:880
- C:\Windows\System\TEVnAeQ.exe
  C:\Windows\System\TEVnAeQ.exe
  2⤵
  PID:7616
- C:\Windows\System\HooZAfF.exe
  C:\Windows\System\HooZAfF.exe
  2⤵
  PID:13288
- C:\Windows\System\AecSZnY.exe
  C:\Windows\System\AecSZnY.exe
  2⤵
  PID:3376
- C:\Windows\System\cEKeQTA.exe
  C:\Windows\System\cEKeQTA.exe
  2⤵
  PID:7884
- C:\Windows\System\GOtWybF.exe
  C:\Windows\System\GOtWybF.exe
  2⤵
  PID:12608
- C:\Windows\System\GNCsDmK.exe
  C:\Windows\System\GNCsDmK.exe
  2⤵
  PID:4556
- C:\Windows\System\FSgGlAv.exe
  C:\Windows\System\FSgGlAv.exe
  2⤵
  PID:8120
- C:\Windows\System\SutIGZd.exe
  C:\Windows\System\SutIGZd.exe
  2⤵
  PID:12400
- C:\Windows\System\ZrxsbmT.exe
  C:\Windows\System\ZrxsbmT.exe
  2⤵
  PID:5176
- C:\Windows\System\LAkVIwD.exe
  C:\Windows\System\LAkVIwD.exe
  2⤵
  PID:7716
- C:\Windows\System\GENGKyF.exe
  C:\Windows\System\GENGKyF.exe
  2⤵
  PID:5204
- C:\Windows\System\tpEnKfz.exe
  C:\Windows\System\tpEnKfz.exe
  2⤵
  PID:6944
- C:\Windows\System\KdlpWPv.exe
  C:\Windows\System\KdlpWPv.exe
  2⤵
  PID:5272
- C:\Windows\System\HJNySlt.exe
  C:\Windows\System\HJNySlt.exe
  2⤵
  PID:7224
- C:\Windows\System\jlBZVJa.exe
  C:\Windows\System\jlBZVJa.exe
  2⤵
  PID:5168
- C:\Windows\System\ecWmCfB.exe
  C:\Windows\System\ecWmCfB.exe
  2⤵
  PID:4812
- C:\Windows\System\ohIhLKK.exe
  C:\Windows\System\ohIhLKK.exe
  2⤵
  PID:5208
- C:\Windows\System\YstceaV.exe
  C:\Windows\System\YstceaV.exe
  2⤵
  PID:3552
- C:\Windows\System\jopKkWM.exe
  C:\Windows\System\jopKkWM.exe
  2⤵
  PID:4936
- C:\Windows\System\fBpVPqc.exe
  C:\Windows\System\fBpVPqc.exe
  2⤵
  PID:468
- C:\Windows\System\EYnrRdx.exe
  C:\Windows\System\EYnrRdx.exe
  2⤵
  PID:5552
- C:\Windows\System\VtfjXim.exe
  C:\Windows\System\VtfjXim.exe
  2⤵
  PID:8424
- C:\Windows\System\ohxWFpE.exe
  C:\Windows\System\ohxWFpE.exe
  2⤵
  PID:4800
- C:\Windows\System\LDxMDRo.exe
  C:\Windows\System\LDxMDRo.exe
  2⤵
  PID:2064
- C:\Windows\System\KFZTjdM.exe
  C:\Windows\System\KFZTjdM.exe
  2⤵
  PID:8536
- C:\Windows\System\UCaVpXG.exe
  C:\Windows\System\UCaVpXG.exe
  2⤵
  PID:13084
- C:\Windows\System\NuPiuAp.exe
  C:\Windows\System\NuPiuAp.exe
  2⤵
  PID:4272
- C:\Windows\System\UJLtuMh.exe
  C:\Windows\System\UJLtuMh.exe
  2⤵
  PID:12296
- C:\Windows\System\gnwOvRO.exe
  C:\Windows\System\gnwOvRO.exe
  2⤵
  PID:6464
- C:\Windows\System\PtPixwm.exe
  C:\Windows\System\PtPixwm.exe
  2⤵
  PID:5460
- C:\Windows\System\NfvwEPN.exe
  C:\Windows\System\NfvwEPN.exe
  2⤵
  PID:8764
- C:\Windows\System\NcMQpym.exe
  C:\Windows\System\NcMQpym.exe
  2⤵
  PID:5512
- C:\Windows\System\bnMlMoF.exe
  C:\Windows\System\bnMlMoF.exe
  2⤵
  PID:5928
- C:\Windows\System\LFbjLYT.exe
  C:\Windows\System\LFbjLYT.exe
  2⤵
  PID:6324
- C:\Windows\System\AXTDkCV.exe
  C:\Windows\System\AXTDkCV.exe
  2⤵
  PID:8948
- C:\Windows\System\dJepMkl.exe
  C:\Windows\System\dJepMkl.exe
  2⤵
  PID:1080
- C:\Windows\System\IAwpBVS.exe
  C:\Windows\System\IAwpBVS.exe
  2⤵
  PID:9024
- C:\Windows\System\IydGLsq.exe
  C:\Windows\System\IydGLsq.exe
  2⤵
  PID:3976
- C:\Windows\System\DKiMRWF.exe
  C:\Windows\System\DKiMRWF.exe
  2⤵
  PID:1312
- C:\Windows\System\ozlJAre.exe
  C:\Windows\System\ozlJAre.exe
  2⤵
  PID:7280
- C:\Windows\System\BvLEjTR.exe
  C:\Windows\System\BvLEjTR.exe
  2⤵
  PID:7300
- C:\Windows\System\YYBKmnL.exe
  C:\Windows\System\YYBKmnL.exe
  2⤵
  PID:9168
- C:\Windows\System\AWZPpsg.exe
  C:\Windows\System\AWZPpsg.exe
  2⤵
  PID:8248
- C:\Windows\System\UxQbhBG.exe
  C:\Windows\System\UxQbhBG.exe
  2⤵
  PID:13100
- C:\Windows\System\NTXRwSq.exe
  C:\Windows\System\NTXRwSq.exe
  2⤵
  PID:8476
- C:\Windows\System\CqNRDfs.exe
  C:\Windows\System\CqNRDfs.exe
  2⤵
  PID:5100
- C:\Windows\System\yxCgKnG.exe
  C:\Windows\System\yxCgKnG.exe
  2⤵
  PID:4840
- C:\Windows\System\eDzUITi.exe
  C:\Windows\System\eDzUITi.exe
  2⤵
  PID:7484
- C:\Windows\System\hNxCtGN.exe
  C:\Windows\System\hNxCtGN.exe
  2⤵
  PID:8696
- C:\Windows\System\toJkTlX.exe
  C:\Windows\System\toJkTlX.exe
  2⤵
  PID:7524
- C:\Windows\System\bKmeQee.exe
  C:\Windows\System\bKmeQee.exe
  2⤵
  PID:8736
- C:\Windows\System\glyJQKy.exe
  C:\Windows\System\glyJQKy.exe
  2⤵
  PID:5528
- C:\Windows\System\XOHmqBD.exe
  C:\Windows\System\XOHmqBD.exe
  2⤵
  PID:13144
- C:\Windows\System\pzvQifC.exe
  C:\Windows\System\pzvQifC.exe
  2⤵
  PID:5792
- C:\Windows\System\KvCOWmo.exe
  C:\Windows\System\KvCOWmo.exe
  2⤵
  PID:7648
- C:\Windows\System\BBNuRkU.exe
  C:\Windows\System\BBNuRkU.exe
  2⤵
  PID:5780
- C:\Windows\System\oDkNvMp.exe
  C:\Windows\System\oDkNvMp.exe
  2⤵
  PID:8220
- C:\Windows\System\trsXSXa.exe
  C:\Windows\System\trsXSXa.exe
  2⤵
  PID:7712
- C:\Windows\System\XjVEJmi.exe
  C:\Windows\System\XjVEJmi.exe
  2⤵
  PID:8692
- C:\Windows\System\DSNzujC.exe
  C:\Windows\System\DSNzujC.exe
  2⤵
  PID:5840
- C:\Windows\System\scjobGV.exe
  C:\Windows\System\scjobGV.exe
  2⤵
  PID:12872
- C:\Windows\System\GdGkssa.exe
  C:\Windows\System\GdGkssa.exe
  2⤵
  PID:6148
- C:\Windows\System\DAhUIkm.exe
  C:\Windows\System\DAhUIkm.exe
  2⤵
  PID:3200
- C:\Windows\System\CMuTGQc.exe
  C:\Windows\System\CMuTGQc.exe
  2⤵
  PID:13196
- C:\Windows\System\XxTRDdx.exe
  C:\Windows\System\XxTRDdx.exe
  2⤵
  PID:6152
- C:\Windows\System\YJFfmLi.exe
  C:\Windows\System\YJFfmLi.exe
  2⤵
  PID:6196
- C:\Windows\System\lOLiPwV.exe
  C:\Windows\System\lOLiPwV.exe
  2⤵
  PID:2140
- C:\Windows\System\tHFciKo.exe
  C:\Windows\System\tHFciKo.exe
  2⤵
  PID:9272
- C:\Windows\System\LmlfsYo.exe
  C:\Windows\System\LmlfsYo.exe
  2⤵
  PID:9284
- C:\Windows\System\vuWrOXi.exe
  C:\Windows\System\vuWrOXi.exe
  2⤵
  PID:12416
- C:\Windows\System\hiYuIyJ.exe
  C:\Windows\System\hiYuIyJ.exe
  2⤵
  PID:6264
- C:\Windows\System\VaUvevr.exe
  C:\Windows\System\VaUvevr.exe
  2⤵
  PID:9460
- C:\Windows\System\EBsPGLJ.exe
  C:\Windows\System\EBsPGLJ.exe
  2⤵
  PID:9488
- C:\Windows\System\jOtKSBU.exe
  C:\Windows\System\jOtKSBU.exe
  2⤵
  PID:6320
- C:\Windows\System\ITuSLqL.exe
  C:\Windows\System\ITuSLqL.exe
  2⤵
  PID:6364
- C:\Windows\System\GCnwlEO.exe
  C:\Windows\System\GCnwlEO.exe
  2⤵
  PID:13280
- C:\Windows\System\YZhQZZA.exe
  C:\Windows\System\YZhQZZA.exe
  2⤵
  PID:6376
- C:\Windows\System\rYIcZCP.exe
  C:\Windows\System\rYIcZCP.exe
  2⤵
  PID:6420
- C:\Windows\System\vtTaTrh.exe
  C:\Windows\System\vtTaTrh.exe
  2⤵
  PID:9792
- C:\Windows\System\PPZqKln.exe
  C:\Windows\System\PPZqKln.exe
  2⤵
  PID:6448
- C:\Windows\System\QPZXgbR.exe
  C:\Windows\System\QPZXgbR.exe
  2⤵
  PID:7740
- C:\Windows\System\lwxkGZc.exe
  C:\Windows\System\lwxkGZc.exe
  2⤵
  PID:1444
- C:\Windows\System\xwSpyfK.exe
  C:\Windows\System\xwSpyfK.exe
  2⤵
  PID:6504
- C:\Windows\System\aBOnZCJ.exe
  C:\Windows\System\aBOnZCJ.exe
  2⤵
  PID:9992
- C:\Windows\System\dfbfcLK.exe
  C:\Windows\System\dfbfcLK.exe
  2⤵
  PID:4684
- C:\Windows\System\kuemPlL.exe
  C:\Windows\System\kuemPlL.exe
  2⤵
  PID:1344
- C:\Windows\System\lOySUhh.exe
  C:\Windows\System\lOySUhh.exe
  2⤵
  PID:3424
- C:\Windows\System\HTxfSUj.exe
  C:\Windows\System\HTxfSUj.exe
  2⤵
  PID:6588
- C:\Windows\System\LIoRbDX.exe
  C:\Windows\System\LIoRbDX.exe
  2⤵
  PID:7664
- C:\Windows\System\AlHNGFV.exe
  C:\Windows\System\AlHNGFV.exe
  2⤵
  PID:6652
- C:\Windows\System\RqmGHac.exe
  C:\Windows\System\RqmGHac.exe
  2⤵
  PID:7908
- C:\Windows\System\HOQIlJB.exe
  C:\Windows\System\HOQIlJB.exe
  2⤵
  PID:5304
- C:\Windows\System\ZOLfAid.exe
  C:\Windows\System\ZOLfAid.exe
  2⤵
  PID:9376
- C:\Windows\System\aCBACDK.exe
  C:\Windows\System\aCBACDK.exe
  2⤵
  PID:3572
- C:\Windows\System\PoraOnh.exe
  C:\Windows\System\PoraOnh.exe
  2⤵
  PID:6684
- C:\Windows\System\KbDfABk.exe
  C:\Windows\System\KbDfABk.exe
  2⤵
  PID:9656
- C:\Windows\System\QxvWyVk.exe
  C:\Windows\System\QxvWyVk.exe
  2⤵
  PID:8240
- C:\Windows\System\IDkUSYu.exe
  C:\Windows\System\IDkUSYu.exe
  2⤵
  PID:5436
- C:\Windows\System\igXLoJw.exe
  C:\Windows\System\igXLoJw.exe
  2⤵
  PID:6740
- C:\Windows\System\lHERRmC.exe
  C:\Windows\System\lHERRmC.exe
  2⤵
  PID:8328
- C:\Windows\System\PZXeSlI.exe
  C:\Windows\System\PZXeSlI.exe
  2⤵
  PID:9944
- C:\Windows\System\sZMbyea.exe
  C:\Windows\System\sZMbyea.exe
  2⤵
  PID:5280
- C:\Windows\System\iSSCKpE.exe
  C:\Windows\System\iSSCKpE.exe
  2⤵
  PID:8432
- C:\Windows\System\DqsKRSO.exe
  C:\Windows\System\DqsKRSO.exe
  2⤵
  PID:4456
- C:\Windows\System\OluUCpk.exe
  C:\Windows\System\OluUCpk.exe
  2⤵
  PID:4700
- C:\Windows\System\iMULTnD.exe
  C:\Windows\System\iMULTnD.exe
  2⤵
  PID:5612
- C:\Windows\System\FsRQphb.exe
  C:\Windows\System\FsRQphb.exe
  2⤵
  PID:2980
- C:\Windows\System\DwFDSBg.exe
  C:\Windows\System\DwFDSBg.exe
  2⤵
  PID:6852
- C:\Windows\System\nzHmRNN.exe
  C:\Windows\System\nzHmRNN.exe
  2⤵
  PID:9972
- C:\Windows\System\HCOiEKI.exe
  C:\Windows\System\HCOiEKI.exe
  2⤵
  PID:9996
- C:\Windows\System\kailDkh.exe
  C:\Windows\System\kailDkh.exe
  2⤵
  PID:5372
- C:\Windows\System\pQBkHEM.exe
  C:\Windows\System\pQBkHEM.exe
  2⤵
  PID:9436
- C:\Windows\System\yMYXcRK.exe
  C:\Windows\System\yMYXcRK.exe
  2⤵
  PID:5692
- C:\Windows\System\tYZHAdo.exe
  C:\Windows\System\tYZHAdo.exe
  2⤵
  PID:8704
- C:\Windows\System\eahYMpK.exe
  C:\Windows\System\eahYMpK.exe
  2⤵
  PID:10152
- C:\Windows\System\SAkcnWw.exe
  C:\Windows\System\SAkcnWw.exe
  2⤵
  PID:3900
- C:\Windows\System\OramNWL.exe
  C:\Windows\System\OramNWL.exe
  2⤵
  PID:5820
- C:\Windows\System\XWBceNn.exe
  C:\Windows\System\XWBceNn.exe
  2⤵
  PID:1368
- C:\Windows\System\KrMIHeL.exe
  C:\Windows\System\KrMIHeL.exe
  2⤵
  PID:6992
- C:\Windows\System\lBpcGks.exe
  C:\Windows\System\lBpcGks.exe
  2⤵
  PID:10328
- C:\Windows\System\wNFRnmp.exe
  C:\Windows\System\wNFRnmp.exe
  2⤵
  PID:10324
- C:\Windows\System\jknApQt.exe
  C:\Windows\System\jknApQt.exe
  2⤵
  PID:8960
- C:\Windows\System\LmIgjXt.exe
  C:\Windows\System\LmIgjXt.exe
  2⤵
  PID:5544
- C:\Windows\System\kYounuI.exe
  C:\Windows\System\kYounuI.exe
  2⤵
  PID:7092
- C:\Windows\System\AGqfKpN.exe
  C:\Windows\System\AGqfKpN.exe
  2⤵
  PID:5600
- C:\Windows\System\WSuqrJF.exe
  C:\Windows\System\WSuqrJF.exe
  2⤵
  PID:10380
- C:\Windows\System\SjoCFqC.exe
  C:\Windows\System\SjoCFqC.exe
  2⤵
  PID:7132
- C:\Windows\System\xcIOIRJ.exe
  C:\Windows\System\xcIOIRJ.exe
  2⤵
  PID:10420
- C:\Windows\System\ibrRfIz.exe
  C:\Windows\System\ibrRfIz.exe
  2⤵
  PID:3832
- C:\Windows\System\GyCyCcL.exe
  C:\Windows\System\GyCyCcL.exe
  2⤵
  PID:684
- C:\Windows\System\TwpRMUf.exe
  C:\Windows\System\TwpRMUf.exe
  2⤵
  PID:10604
- C:\Windows\System\IMjdzAZ.exe
  C:\Windows\System\IMjdzAZ.exe
  2⤵
  PID:10608
- C:\Windows\System\QhqJfYp.exe
  C:\Windows\System\QhqJfYp.exe
  2⤵
  PID:5152
- C:\Windows\System\KnRVVYT.exe
  C:\Windows\System\KnRVVYT.exe
  2⤵
  PID:7500
- C:\Windows\System\AVUimtG.exe
  C:\Windows\System\AVUimtG.exe
  2⤵
  PID:10808
- C:\Windows\System\LZbCADp.exe
  C:\Windows\System\LZbCADp.exe
  2⤵
  PID:5740
- C:\Windows\System\oyHVsVA.exe
  C:\Windows\System\oyHVsVA.exe
  2⤵
  PID:13128
- C:\Windows\System\DxKHugE.exe
  C:\Windows\System\DxKHugE.exe
  2⤵
  PID:4996
- C:\Windows\System\chesvja.exe
  C:\Windows\System\chesvja.exe
  2⤵
  PID:6240
- C:\Windows\System\iGWXAaf.exe
  C:\Windows\System\iGWXAaf.exe
  2⤵
  PID:9040
- C:\Windows\System\CQmLHpU.exe
  C:\Windows\System\CQmLHpU.exe
  2⤵
  PID:6276
- C:\Windows\System\RRWswbm.exe
  C:\Windows\System\RRWswbm.exe
  2⤵
  PID:12820
- C:\Windows\System\eICcuWo.exe
  C:\Windows\System\eICcuWo.exe
  2⤵
  PID:6040
- C:\Windows\System\QeqvUhh.exe
  C:\Windows\System\QeqvUhh.exe
  2⤵
  PID:8284
- C:\Windows\System\iOFHloN.exe
  C:\Windows\System\iOFHloN.exe
  2⤵
  PID:8548
- C:\Windows\System\SMBREqC.exe
  C:\Windows\System\SMBREqC.exe
  2⤵
  PID:10300
- C:\Windows\System\BdmTLXA.exe
  C:\Windows\System\BdmTLXA.exe
  2⤵
  PID:5884
- C:\Windows\System\AajEkWr.exe
  C:\Windows\System\AajEkWr.exe
  2⤵
  PID:7832
- C:\Windows\System\SDJYWvH.exe
  C:\Windows\System\SDJYWvH.exe
  2⤵
  PID:6168
- C:\Windows\System\RsUjLPp.exe
  C:\Windows\System\RsUjLPp.exe
  2⤵
  PID:5924
- C:\Windows\System\pvjjyeq.exe
  C:\Windows\System\pvjjyeq.exe
  2⤵
  PID:10840
- C:\Windows\System\GDmLIlg.exe
  C:\Windows\System\GDmLIlg.exe
  2⤵
  PID:5968
- C:\Windows\System\CpJPDxM.exe
  C:\Windows\System\CpJPDxM.exe
  2⤵
  PID:4436
- C:\Windows\System\EHJqkUc.exe
  C:\Windows\System\EHJqkUc.exe
  2⤵
  PID:11024
- C:\Windows\System\AYpgJnV.exe
  C:\Windows\System\AYpgJnV.exe
  2⤵
  PID:9280
- C:\Windows\System\swEOUyP.exe
  C:\Windows\System\swEOUyP.exe
  2⤵
  PID:11260
- C:\Windows\System\ycHNclv.exe
  C:\Windows\System\ycHNclv.exe
  2⤵
  PID:6280
- C:\Windows\System\LMnxDSI.exe
  C:\Windows\System\LMnxDSI.exe
  2⤵
  PID:8004
- C:\Windows\System\AFMQeNQ.exe
  C:\Windows\System\AFMQeNQ.exe
  2⤵
  PID:6308
- C:\Windows\System\ftgjZNM.exe
  C:\Windows\System\ftgjZNM.exe
  2⤵
  PID:9508
- C:\Windows\System\ckhpjyV.exe
  C:\Windows\System\ckhpjyV.exe
  2⤵
  PID:4916
- C:\Windows\System\mEatzyI.exe
  C:\Windows\System\mEatzyI.exe
  2⤵
  PID:8124
- C:\Windows\System\xerqYHR.exe
  C:\Windows\System\xerqYHR.exe
  2⤵
  PID:11064
- C:\Windows\System\jKpnHxH.exe
  C:\Windows\System\jKpnHxH.exe
  2⤵
  PID:6108
- C:\Windows\System\KiLroHV.exe
  C:\Windows\System\KiLroHV.exe
  2⤵
  PID:6360
- C:\Windows\System\uCrOlvP.exe
  C:\Windows\System\uCrOlvP.exe
  2⤵
  PID:4572
- C:\Windows\System\KBTZptT.exe
  C:\Windows\System\KBTZptT.exe
  2⤵
  PID:10472
- C:\Windows\System\hRhjEed.exe
  C:\Windows\System\hRhjEed.exe
  2⤵
  PID:6460
- C:\Windows\System\hkkjBqf.exe
  C:\Windows\System\hkkjBqf.exe
  2⤵
  PID:9948
- C:\Windows\System\EkwJGUf.exe
  C:\Windows\System\EkwJGUf.exe
  2⤵
  PID:11400
- C:\Windows\System\pYQHaZy.exe
  C:\Windows\System\pYQHaZy.exe
  2⤵
  PID:12348
- C:\Windows\System\goZKHUI.exe
  C:\Windows\System\goZKHUI.exe
  2⤵
  PID:8184
- C:\Windows\System\FCwzQVi.exe
  C:\Windows\System\FCwzQVi.exe
  2⤵
  PID:11536
- C:\Windows\System\GcxuZIm.exe
  C:\Windows\System\GcxuZIm.exe
  2⤵
  PID:10120
- C:\Windows\System\tzbGFFP.exe
  C:\Windows\System\tzbGFFP.exe
  2⤵
  PID:11668
- C:\Windows\System\JAYZBfd.exe
  C:\Windows\System\JAYZBfd.exe
  2⤵
  PID:11764
- C:\Windows\System\dFVDMYB.exe
  C:\Windows\System\dFVDMYB.exe
  2⤵
  PID:6600
- C:\Windows\System\iIeGbPv.exe
  C:\Windows\System\iIeGbPv.exe
  2⤵
  PID:8064
- C:\Windows\System\nQuOEHz.exe
  C:\Windows\System\nQuOEHz.exe
  2⤵
  PID:11972
- C:\Windows\System\rQEeVJz.exe
  C:\Windows\System\rQEeVJz.exe
  2⤵
  PID:6700
- C:\Windows\System\BdmXSkP.exe
  C:\Windows\System\BdmXSkP.exe
  2⤵
  PID:9704
- C:\Windows\System\rPqraXa.exe
  C:\Windows\System\rPqraXa.exe
  2⤵
  PID:12260
- C:\Windows\System\GsSfxEW.exe
  C:\Windows\System\GsSfxEW.exe
  2⤵
  PID:3144
- C:\Windows\System\UkzNpKj.exe
  C:\Windows\System\UkzNpKj.exe
  2⤵
  PID:10016
- C:\Windows\System\OgmfCMj.exe
  C:\Windows\System\OgmfCMj.exe
  2⤵
  PID:6812
- C:\Windows\System\ycwFumb.exe
  C:\Windows\System\ycwFumb.exe
  2⤵
  PID:10212
- C:\Windows\System\hnqMQES.exe
  C:\Windows\System\hnqMQES.exe
  2⤵
  PID:11784
- C:\Windows\System\qvmbEBc.exe
  C:\Windows\System\qvmbEBc.exe
  2⤵
  PID:11828
- C:\Windows\System\yFXfyVN.exe
  C:\Windows\System\yFXfyVN.exe
  2⤵
  PID:9568
- C:\Windows\System\hNBenFF.exe
  C:\Windows\System\hNBenFF.exe
  2⤵
  PID:5344
- C:\Windows\System\iOLhoml.exe
  C:\Windows\System\iOLhoml.exe
  2⤵
  PID:12176
- C:\Windows\System\IJwKsIh.exe
  C:\Windows\System\IJwKsIh.exe
  2⤵
  PID:5724
- C:\Windows\System\Kjvriji.exe
  C:\Windows\System\Kjvriji.exe
  2⤵
  PID:11412
- C:\Windows\System\MvshdLW.exe
  C:\Windows\System\MvshdLW.exe
  2⤵
  PID:9360
- C:\Windows\System\MjqjiMG.exe
  C:\Windows\System\MjqjiMG.exe
  2⤵
  PID:6964
- C:\Windows\System\aiQtIrT.exe
  C:\Windows\System\aiQtIrT.exe
  2⤵
  PID:6884
- C:\Windows\System\EIdTVhW.exe
  C:\Windows\System\EIdTVhW.exe
  2⤵
  PID:6380
- C:\Windows\System\PTjxIJc.exe
  C:\Windows\System\PTjxIJc.exe
  2⤵
  PID:12404
- C:\Windows\System\XVBPfWa.exe
  C:\Windows\System\XVBPfWa.exe
  2⤵
  PID:1456
- C:\Windows\System\KHUGlIt.exe
  C:\Windows\System\KHUGlIt.exe
  2⤵
  PID:9068
- C:\Windows\System\GzdVnGd.exe
  C:\Windows\System\GzdVnGd.exe
  2⤵
  PID:9132
- C:\Windows\System\DqRhEov.exe
  C:\Windows\System\DqRhEov.exe
  2⤵
  PID:1240
- C:\Windows\System\SLVhIOL.exe
  C:\Windows\System\SLVhIOL.exe
  2⤵
  PID:12756
- C:\Windows\System\YLrkjbd.exe
  C:\Windows\System\YLrkjbd.exe
  2⤵
  PID:12856
- C:\Windows\System\IQzjTOz.exe
  C:\Windows\System\IQzjTOz.exe
  2⤵
  PID:8556
- C:\Windows\System\hvLnULe.exe
  C:\Windows\System\hvLnULe.exe
  2⤵
  PID:8784
- C:\Windows\System\OSKpIyS.exe
  C:\Windows\System\OSKpIyS.exe
  2⤵
  PID:5720
- C:\Windows\System\KQzIFyK.exe
  C:\Windows\System\KQzIFyK.exe
  2⤵
  PID:5660
- C:\Windows\System\moInbNT.exe
  C:\Windows\System\moInbNT.exe
  2⤵
  PID:5828
- C:\Windows\System\fwzaEkL.exe
  C:\Windows\System\fwzaEkL.exe
  2⤵
  PID:5956
- C:\Windows\System\foVshrc.exe
  C:\Windows\System\foVshrc.exe
  2⤵
  PID:8604
- C:\Windows\System\EJujCRP.exe
  C:\Windows\System\EJujCRP.exe
  2⤵
  PID:6100
- C:\Windows\System\XdjJGxi.exe
  C:\Windows\System\XdjJGxi.exe
  2⤵
  PID:10416
- C:\Windows\System\hQQnzNw.exe
  C:\Windows\System\hQQnzNw.exe
  2⤵
  PID:7144
- C:\Windows\System\druoZEC.exe
  C:\Windows\System\druoZEC.exe
  2⤵
  PID:7196
- C:\Windows\System\yqkDAYo.exe
  C:\Windows\System\yqkDAYo.exe
  2⤵
  PID:7240
- C:\Windows\System\ffuyaTu.exe
  C:\Windows\System\ffuyaTu.exe
  2⤵
  PID:4908
- C:\Windows\System\QhkrBta.exe
  C:\Windows\System\QhkrBta.exe
  2⤵
  PID:8380
- C:\Windows\System\hfDciwK.exe
  C:\Windows\System\hfDciwK.exe
  2⤵
  PID:7440
- C:\Windows\System\IRsKbvZ.exe
  C:\Windows\System\IRsKbvZ.exe
  2⤵
  PID:7444
- C:\Windows\System\vLYuFCU.exe
  C:\Windows\System\vLYuFCU.exe
  2⤵
  PID:7468
- C:\Windows\System\jgcFREW.exe
  C:\Windows\System\jgcFREW.exe
  2⤵
  PID:6236
- C:\Windows\System\GeuXcAD.exe
  C:\Windows\System\GeuXcAD.exe
  2⤵
  PID:10364
- C:\Windows\System\xfikAWY.exe
  C:\Windows\System\xfikAWY.exe
  2⤵
  PID:3928
- C:\Windows\System\xdOrxbH.exe
  C:\Windows\System\xdOrxbH.exe
  2⤵
  PID:7636
- C:\Windows\System\IIRqPux.exe
  C:\Windows\System\IIRqPux.exe
  2⤵
  PID:9528
- C:\Windows\System\rXGHslr.exe
  C:\Windows\System\rXGHslr.exe
  2⤵
  PID:3620
- C:\Windows\System\YsesAja.exe
  C:\Windows\System\YsesAja.exe
  2⤵
  PID:6092
- C:\Windows\System\EbsiVLq.exe
  C:\Windows\System\EbsiVLq.exe
  2⤵
  PID:632
- C:\Windows\System\icMwMMi.exe
  C:\Windows\System\icMwMMi.exe
  2⤵
  PID:13284
- C:\Windows\System\ZkRhajh.exe
  C:\Windows\System\ZkRhajh.exe
  2⤵
  PID:7816
- C:\Windows\System\EDqiiMb.exe
  C:\Windows\System\EDqiiMb.exe
  2⤵
  PID:8096
- C:\Windows\System\HYlIIPt.exe
  C:\Windows\System\HYlIIPt.exe
  2⤵
  PID:8100
- C:\Windows\System\GkyAbIu.exe
  C:\Windows\System\GkyAbIu.exe
  2⤵
  PID:11472
- C:\Windows\System\uijSOUz.exe
  C:\Windows\System\uijSOUz.exe
  2⤵
  PID:8180
- C:\Windows\System\DCYPNqQ.exe
  C:\Windows\System\DCYPNqQ.exe
  2⤵
  PID:432
- C:\Windows\System\rtPlBcD.exe
  C:\Windows\System\rtPlBcD.exe
  2⤵
  PID:7396
- C:\Windows\System\jrUYnKE.exe
  C:\Windows\System\jrUYnKE.exe
  2⤵
  PID:11692
- C:\Windows\System\XPdxalM.exe
  C:\Windows\System\XPdxalM.exe
  2⤵
  PID:11848
- C:\Windows\System\gkknEDS.exe
  C:\Windows\System\gkknEDS.exe
  2⤵
  PID:7688
- C:\Windows\System\mbCyTXV.exe
  C:\Windows\System\mbCyTXV.exe
  2⤵
  PID:7924
- C:\Windows\System\TMoCkey.exe
  C:\Windows\System\TMoCkey.exe
  2⤵
  PID:8104
- C:\Windows\System\mgLtotF.exe
  C:\Windows\System\mgLtotF.exe
  2⤵
  PID:12012
- C:\Windows\System\aKjXQgr.exe
  C:\Windows\System\aKjXQgr.exe
  2⤵
  PID:12080
- C:\Windows\System\EZYBtMG.exe
  C:\Windows\System\EZYBtMG.exe
  2⤵
  PID:12124
- C:\Windows\System\ueOUnlp.exe
  C:\Windows\System\ueOUnlp.exe
  2⤵
  PID:7880
- C:\Windows\System\TElHaPf.exe
  C:\Windows\System\TElHaPf.exe
  2⤵
  PID:8028
- C:\Windows\System\sIuIySp.exe
  C:\Windows\System\sIuIySp.exe
  2⤵
  PID:12168
- C:\Windows\System\SVvQOuF.exe
  C:\Windows\System\SVvQOuF.exe
  2⤵
  PID:8308
- C:\Windows\System\cjhCCRx.exe
  C:\Windows\System\cjhCCRx.exe
  2⤵
  PID:1304
- C:\Windows\System\IxXaytQ.exe
  C:\Windows\System\IxXaytQ.exe
  2⤵
  PID:11648
- C:\Windows\System\mpaLNUl.exe
  C:\Windows\System\mpaLNUl.exe
  2⤵
  PID:8404
- C:\Windows\System\nyoDpij.exe
  C:\Windows\System\nyoDpij.exe
  2⤵
  PID:8368
- C:\Windows\System\ROUdaBi.exe
  C:\Windows\System\ROUdaBi.exe
  2⤵
  PID:11952
- C:\Windows\System\RkcgSEf.exe
  C:\Windows\System\RkcgSEf.exe
  2⤵
  PID:12096
- C:\Windows\System\kVUHWwc.exe
  C:\Windows\System\kVUHWwc.exe
  2⤵
  PID:11164
- C:\Windows\System\dJixWqu.exe
  C:\Windows\System\dJixWqu.exe
  2⤵
  PID:8636
- C:\Windows\System\GbEVdYN.exe
  C:\Windows\System\GbEVdYN.exe
  2⤵
  PID:8656
- C:\Windows\System\vkqIMEy.exe
  C:\Windows\System\vkqIMEy.exe
  2⤵
  PID:8732
- C:\Windows\System\peAvmoP.exe
  C:\Windows\System\peAvmoP.exe
  2⤵
  PID:11384
- C:\Windows\System\RDchoXF.exe
  C:\Windows\System\RDchoXF.exe
  2⤵
  PID:11884
- C:\Windows\System\mcEQsiv.exe
  C:\Windows\System\mcEQsiv.exe
  2⤵
  PID:12412
- C:\Windows\System\XwUpBFi.exe
  C:\Windows\System\XwUpBFi.exe
  2⤵
  PID:5568
- C:\Windows\System\tdyvHLh.exe
  C:\Windows\System\tdyvHLh.exe
  2⤵
  PID:3960
- C:\Windows\System\PbBIWuK.exe
  C:\Windows\System\PbBIWuK.exe
  2⤵
  PID:9116
- C:\Windows\System\ooNIEuG.exe
  C:\Windows\System\ooNIEuG.exe
  2⤵
  PID:9016
- C:\Windows\System\fkDpBuU.exe
  C:\Windows\System\fkDpBuU.exe
  2⤵
  PID:10600
- C:\Windows\System\cxMVDrc.exe
  C:\Windows\System\cxMVDrc.exe
  2⤵
  PID:9088
- C:\Windows\System\PWanRJK.exe
  C:\Windows\System\PWanRJK.exe
  2⤵
  PID:12880
- C:\Windows\System\jXUpXyk.exe
  C:\Windows\System\jXUpXyk.exe
  2⤵
  PID:10852
- C:\Windows\System\OkTkgMn.exe
  C:\Windows\System\OkTkgMn.exe
  2⤵
  PID:13044
- C:\Windows\System\vqKGLVa.exe
  C:\Windows\System\vqKGLVa.exe
  2⤵
  PID:13148
- C:\Windows\System\ErTdhRt.exe
  C:\Windows\System\ErTdhRt.exe
  2⤵
  PID:13108
- C:\Windows\System\kfWsKsk.exe
  C:\Windows\System\kfWsKsk.exe
  2⤵
  PID:8428
- C:\Windows\System\foXPDrE.exe
  C:\Windows\System\foXPDrE.exe
  2⤵
  PID:2536
- C:\Windows\System\emZFdjX.exe
  C:\Windows\System\emZFdjX.exe
  2⤵
  PID:11240
- C:\Windows\System\MUjnRow.exe
  C:\Windows\System\MUjnRow.exe
  2⤵
  PID:13232
- C:\Windows\System\bdkSIiw.exe
  C:\Windows\System\bdkSIiw.exe
  2⤵
  PID:7768
- C:\Windows\System\WHSGLch.exe
  C:\Windows\System\WHSGLch.exe
  2⤵
  PID:9108
- C:\Windows\System\mpnYecc.exe
  C:\Windows\System\mpnYecc.exe
  2⤵
  PID:10736
- C:\Windows\System\uHRxuRJ.exe
  C:\Windows\System\uHRxuRJ.exe
  2⤵
  PID:4536
- C:\Windows\System\tykBDDb.exe
  C:\Windows\System\tykBDDb.exe
  2⤵
  PID:7948
- C:\Windows\System\gIDMQkN.exe
  C:\Windows\System\gIDMQkN.exe
  2⤵
  PID:8956
- C:\Windows\System\RPulHzQ.exe
  C:\Windows\System\RPulHzQ.exe
  2⤵
  PID:11192
- C:\Windows\System\IADpZpU.exe
  C:\Windows\System\IADpZpU.exe
  2⤵
  PID:9484
- C:\Windows\System\JCQTSVS.exe
  C:\Windows\System\JCQTSVS.exe
  2⤵
  PID:7088
- C:\Windows\System\weVLRIV.exe
  C:\Windows\System\weVLRIV.exe
  2⤵
  PID:6336
- C:\Windows\System\eJtxFWq.exe
  C:\Windows\System\eJtxFWq.exe
  2⤵
  PID:9292
- C:\Windows\System\NzaQKjp.exe
  C:\Windows\System\NzaQKjp.exe
  2⤵
  PID:9384
- C:\Windows\System\iEZZdXl.exe
  C:\Windows\System\iEZZdXl.exe
  2⤵
  PID:7888
- C:\Windows\System\XUEXMiW.exe
  C:\Windows\System\XUEXMiW.exe
  2⤵
  PID:9424
- C:\Windows\System\enVIukK.exe
  C:\Windows\System\enVIukK.exe
  2⤵
  PID:6476
- C:\Windows\System\LIiZzhV.exe
  C:\Windows\System\LIiZzhV.exe
  2⤵
  PID:11408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v0ggn4vu.qua.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AiOAkUz.exe

Filesize
8B

MD5
b2496acc5e17e2c67abf0e50b34299c5

SHA1
e4d3a01a7b24014db52a37c4589da1d759e5cc01

SHA256
c1d0a5469aea2b6129f1befd08eacde0c0a8692b1b5daa6dcde087be41f93473

SHA512
ef684a29718cef3f70c3e4fcbaeffb53bbda0c6389282a7b2bddfe4ab783804c217814821e0c2a754448b3cb6bb99b294f93749f85fd1748233def0d92fa8251

Download Submit
C:\Windows\System\CkPMHIa.exe

Filesize
2.8MB

MD5
c0b89e167191f9eb4d16cc595a09ef56

SHA1
6a09d010b75ea649e59ce11a8bf016f4bf0fa1ea

SHA256
4f7d94b19321a0375ea9888ba4d9b83e88102c8a9c2237f7ef604980d7cb604a

SHA512
7c1cbfaa14c34acad3343817b7a9b6e94e5605c425867adfc7470ccc03e9c583cbf9bf03469294d268d900776cdd1abb90d5ee4a696f13d41833e6b54f9114da

Download Submit
C:\Windows\System\DAeKqHG.exe

Filesize
2.8MB

MD5
766e11e6a24705a27b27ab67ab67825b

SHA1
7e2eb54fc07a6daa3245d2427c9cacfea2827584

SHA256
fd7ee3d2ac578073f8cca93f7f838bdb7bd8d0a502e8158afaa17922e4c88c7d

SHA512
7ee32614cbde2345dd43b4157899017cfa9ff069c2dec2b85a1d946ecc86bd4fedaf5446a8d945862a924c74714d873bf9bea15f40581d8dffadb26b9d5fe23f

Download Submit
C:\Windows\System\EHvyFsJ.exe

Filesize
2.8MB

MD5
b9d3031455b7bcf4ab7b36da7540e77b

SHA1
c8bf35b9ec0208b6ddbd50e1c3499d0c528fa377

SHA256
15ab1e45ffa328971cef3d4e78c828006757fe6c58e9ebf0d1c80b4158b7fa44

SHA512
73b6701260a1f550b7728c3d2c76312118625a2f1a36d74ee9ccec4da76a2f6a37d6ae231777ed84c4e3dee1c34e8e437cba1d2d8ef6cdae0eddacea72adb3ca

Download Submit
C:\Windows\System\FxTjOlW.exe

Filesize
2.8MB

MD5
439ba7ba0378cc7f6f663f952233cb17

SHA1
5cdb0bf2d2f35ba53a1fff5a1a3b0fe783c5f918

SHA256
7fc2180eadd30e8b58a1023680749b0752bcca0ca5fac977438ecf9f36a40596

SHA512
63a13515cfc77a2b228cd94afa154fb0125e54883b22a5922c29819d49819867d105cd5c2b4868f37fa0a1764382cf7feb80d8bbe0d719b92fd83edd3aec1101

Download Submit
C:\Windows\System\HIREIfT.exe

Filesize
2.8MB

MD5
3a598be4d17fd4656f476fd41c12b5e7

SHA1
455546d37a57c739386a244c8ee8132748895647

SHA256
9ef86ef328c7a30a4641e7142f664f5cf75613391704391a0fb0a4be7af4f6ab

SHA512
d452286eb8ffc26e51e9cf06696578a5ff89588c868fba12b8c96960ec36df1f80f43a058b8c46deeef972a642c9e76d004a1b07afc9078092f7e8647d81d2a2

Download Submit
C:\Windows\System\IENPVtd.exe

Filesize
2.8MB

MD5
35f8a4332c74ba07cdf2f870af76739b

SHA1
c238364489e37a45701596a1ea82c6bb0c125e4e

SHA256
82d86630eb026f5ebcb9965807680605daedf294ad35a29ea03915e3b97f3b57

SHA512
249e18df2a347ab1ef69cea00ec563f4a8a839fcd7b6e72a42ac7c07d81cb1b3d6e72af6e5d651050bd7d0b2540f8aadc78f100586d32a2d5da80bf56367937a

Download Submit
C:\Windows\System\IIYnEnJ.exe

Filesize
2.8MB

MD5
ffc51f17455b0c9a79fb209a7b93a0ca

SHA1
bf0b41b89be2f86410a4fc7e0e7e53c31f01cd1e

SHA256
70116cde71b4d8204233376532afdc70ab86af7365b47412239d04b09eac9a44

SHA512
b4dc1c36d5773857bab21a2a22a3195da4fcadbbe66f6e39045f96b93b45e117cc0a8b038e4371947bd6ab2c801a95ebb973624f0a48dbc5ccde77d4947de2cb

Download Submit
C:\Windows\System\KLnRAMQ.exe

Filesize
2.8MB

MD5
2ad026324b427e6736100eb4fdce2269

SHA1
aa706d7a9aadda7c2f186aa3bafb0993f41928ea

SHA256
806923379aa359938c78cc8f2dc1b85a7261a101350aca373430af6220369a20

SHA512
a376774612e83281c2aa16c86839756a985b2706aeefcf03d4d89bd9e977758443825755eb71a488f06494d94d2da3bbfe886cfbb90fef3c52e8b515cd3ec3f5

Download Submit
C:\Windows\System\KZHVuhR.exe

Filesize
2.8MB

MD5
96ea7dd2d01df4ab7f9ba44ea27d7349

SHA1
69288c8aae8c3a8144de8d28f1b3c665a9c4262d

SHA256
7027a7cdf705275c96f5a5157e8ad13ae7e047845bce23f2d255dd48fa587c63

SHA512
df41ef7cd35d5605da57bf9c0e7d2a4708e61ab42378b601d00b190fcaf22e0dd59040ef8e2f86cc4105dcff39138d827d8b27879ce2dbe6e386c3326f4ee7a5

Download Submit
C:\Windows\System\LFGideE.exe

Filesize
2.8MB

MD5
62cb4dd1762bb70781ba33f41c5c076e

SHA1
bd690d19a38e377772b1bf99e648b73a41ae23f4

SHA256
1a4ab67c92bfd5c24d38ee261209fae05851601c045cfa42ca382de1bcc66ce9

SHA512
59bd77663e86e8471bb70e16f23f941cca27d8058c8a4e2d4a9d6137863ef795b0b54293f36c5c16d8ac2adee2b4cdef1633738b205e2873a6f91a3c19b2a665

Download Submit
C:\Windows\System\LiitNQE.exe

Filesize
2.8MB

MD5
0163082abc8eedaeb11da8e5b0fe8a1e

SHA1
9a7307e903a26a292c526bf7d019cb61a29e815b

SHA256
9faa1cc5ba4faf31a9f01849288b74f27c502043acc9fb78c895780654731a52

SHA512
d41db39974abbb95902998b136d80ebca33b06f1c19ac724a1ecfa9c9d8a766b32c7d1e597e535297924b41a3dc9716606953ee170261773bed6a14095ad2c4d

Download Submit
C:\Windows\System\MLQhRoO.exe

Filesize
2.8MB

MD5
747834a7984459821ee5b56acc0ab0b5

SHA1
8054d3b7bcfa83dd3da681eab620bc3210c8d997

SHA256
96bdf6404a98a538cf2a601f46ab0cd02291112550ebf1654427475299376056

SHA512
a452f2123d7ed3cae2d9c15265d38f06cabebf7d41d3c6ddf3431366f0b6a7a855adc4dfa5e4d157e7976091a4c4538a57e5e9ee3eb72bb755be23c96ee10681

Download Submit
C:\Windows\System\MZHphVz.exe

Filesize
2.8MB

MD5
94beea13aeb021f7759edca08d070665

SHA1
2477551467c3972330bdeab23b63958ef4e9ee4b

SHA256
e4dcdb50786d7389f5509edac2f00d46c08603827f35df1c42767b0a88505d01

SHA512
2396048a2144e209fe6c4a2b12de4ad03a53cd1c2acefa0565a7634ca6cd2d6e880aac4402280484ca968f7c46427cb2dd7bfc686b412aa3cd24047cf487194b

Download Submit
C:\Windows\System\MxiZMKs.exe

Filesize
2.8MB

MD5
f2e019d3ce0291e2e30f3bbc4a2c22e0

SHA1
f75a553acc8b90e5e480754b70f8940234a44735

SHA256
50ddfe4b8c98392ec5920c61393a23f9a8580d774a4999d285b6576f16670439

SHA512
c95cd0c2ae79cc5d40d5745e05188a55d5602e41ce75dfec2856b66922dc13e18ec77a36429f362193434776678c58ca1c1863bf2d3cd6648840b37c76ee8a38

Download Submit
C:\Windows\System\NTXTlvq.exe

Filesize
2.8MB

MD5
077ead0d49eb0bacb82294fad9cb7756

SHA1
e9d4f9e1b529b87b120f09735c5948fb8d663f9a

SHA256
95e78a36071ce6a75b7425bd4aedb506d3866570164f6cd2e64e058d7ac98d10

SHA512
693b2e6137e23b1bde8bca1ef4b49dc8076fe2f9069d805be0f672151a5430321856df3a40cf9758729e3f26f1e3c0ad11e090b031825d7cb1a90c01abfbfcb0

Download Submit
C:\Windows\System\QRcoZyn.exe

Filesize
2.8MB

MD5
693b187441f7141a59afd79fcf7519d5

SHA1
7ee5541815b47204773f19dad5ddfbced204f9b6

SHA256
cd14388c6afb5d34471e8a7a421adb2fd8028ffcc6d55b5fff6b5ebb3b2ea1f1

SHA512
91607b1c6a9824fbfdfe5d8fe9888ad605ea412f1f9c090aa05c130b95d61d59191129d5a896be4c81054fd7b9f40bdd3667ddc48d6a069b473036bd0152d30c

Download Submit
C:\Windows\System\Qgbthcl.exe

Filesize
2.8MB

MD5
adae6676330f2b60a2d56999b74c5644

SHA1
c84748574a27c59f349df6b7c3f46fde4868e92f

SHA256
ca6a536dfba370955c126f154b683a4e367339e045412db0a5426233da3fe2f8

SHA512
a17e3d46f121ddd9a76ca14c592343669dd9b6b9565b28e7508d6f252b0742e4e0bf3b585ccad222b686f736c6fd15e72cf31ad88eb13524dfb8449c68ef3c19

Download Submit
C:\Windows\System\TJlyHsx.exe

Filesize
2.8MB

MD5
496afabd507b7ed8e4f1f2657df9993e

SHA1
bb5ada3a414dced11f38b4ea4c80f6cda3c63302

SHA256
e4e6915229a0df27f4c346c41a8971b384c46fed9590918340841f07c1a53207

SHA512
539cca6701619ca29e7002ba22b40c7abd9191d06e34fd8789d918f5907f7741c804d451c691d272efaec0f39fd25d6d86e0daaf11c1707be3b7cac58f783635

Download Submit
C:\Windows\System\TyEQgXM.exe

Filesize
2.8MB

MD5
bd273286d65338297c460f29f8da00ae

SHA1
d1eafaafda10c93e6da6d635ad56514625b9427f

SHA256
b4be601ff2e1220bb0a432d488caa71be70d64fb0627a2d4b489559cc5f069b4

SHA512
2fce1483aa10ca3b26618b7b131ab2fe5e9dc2aac62f35c5886b0de2624d1589a7494764be8c0bc39daa4b0f77ea16cc4a4d0ef629c21ea765f9db4ed704bc5c

Download Submit
C:\Windows\System\WczQRup.exe

Filesize
2.8MB

MD5
3c48bdd9d0898d44daab1c9f71cb737a

SHA1
0b94428883d24aaae216cd3c1fce66ae6b82dec2

SHA256
3a89f6a090ab278379c2350c4710216f19124b7096ec303d46a313aa0fc698e6

SHA512
1efa22e2510ddfdef1fba3436f22e2c1f71bcc982eba839b0487b75018b3afa41b59b02ad451721903c2d9f43eca019b4e229f32defe11c6a70aa768c83376a5

Download Submit
C:\Windows\System\YUkkczo.exe

Filesize
2.8MB

MD5
75ea91188c0a804b931ab02ed88ece12

SHA1
8c467297c406dec17d4a6dfffb526c97c5dc470a

SHA256
97e1980e32fe29c5ad7e31c64c12fc33a86e22d1b8f928c8fc94cd2011f5aa94

SHA512
62972192ec553d4b59e2d76ccaaee68640c03aebd10c11b06d0ac3e5af887ca24dfb3be60eccfed80cc9b9df1a89bd72114f513c5e249827ebbef1f27ecf0315

Download Submit
C:\Windows\System\ZbufLhA.exe

Filesize
2.8MB

MD5
84ec1af202c1b6fb00b37e75f71adb42

SHA1
c9e81c4ecacc3b8fcd008e72527dacf59dcf0b51

SHA256
343ff71fbc61112dcd295aa71bf765d669a711c0782af7329d09795993566fdb

SHA512
ea602188c5faff5b417fd6fbfac8e0f40986fce1ba64b7123c8965365a23cf42ce25587577307e14e3a8e83df1411542a5834cc96a495156393c11db435bfc7b

Download Submit
C:\Windows\System\aFPYJQt.exe

Filesize
2.8MB

MD5
c05833a73d74781b7063addd2b34f277

SHA1
b1871a4f3070c25d16c5d839d2cafac0492d0a63

SHA256
d7a96bc6cfe89a4b01724d57b522b5c0dc68e5d1ac720928211de771a5bf0edc

SHA512
07fa715db33676f43d42e4da7e7c3e4c36c9ac817988283cb7942d0eec3fee71aa3e3a326f350475574aa57fd24e829a65290f2b1aa9a4d9f4f636783d2438ac

Download Submit
C:\Windows\System\aLaehqV.exe

Filesize
2.8MB

MD5
fbbdc5c3a2474c32996fd292d33ab998

SHA1
961d1c7812e96aae14038e63fac47e43de5eb47c

SHA256
00708f09510489d0da96de1b62826e07b5b80876f46d4b103c5bfb5837ead4ba

SHA512
5c72e268998f495cfa1ad81e7fad0515f3e776be37d68d1e2535d36dd393d4b7b2229499078061814e7cc2cf9732033c3bc37713a5fc86345028d22ba8765dee

Download Submit
C:\Windows\System\aZjnLNP.exe

Filesize
2.8MB

MD5
e9fabd0efc81a24d3566e5b51b330716

SHA1
a4692cc7739564eb7586eb29ece911798ca42efb

SHA256
c9a946242c87228c353324267245654c190e3264a826fb3786845e3c209e481d

SHA512
8af671d1abab417fa9cda6ad87aab7968093a92e35b9355e023779af6c74d9427765c20e4b5f7d6fb4e44624d391e1fcda3c680d327139113d548561014bf525

Download Submit
C:\Windows\System\hXuIqgv.exe

Filesize
2.8MB

MD5
9a3b690b2a57f5dae0d612ee13e7d225

SHA1
8c13b6f6b309f9f0a5f08badf8cf2cfcb25b7f9e

SHA256
60962fd786e359f5dd30f44192f90265d62b86c23cf03fcae936d83636c2f0ee

SHA512
53ddc7df4d3b05afb3b30cda3e143f21ec9a07f9299f1932f0416c1d6684b0f4d43384a6cb837245fcc6fdbbfd6ef0f27292b1d2b751a0166747595184e0a78a

Download Submit
C:\Windows\System\kUgCloQ.exe

Filesize
2.8MB

MD5
e5d993e5046ea05f97d0aa50404c9548

SHA1
bf2bb8f2dfa75c99c7e1960acf053332d79169e8

SHA256
912be94147366096988e928120f70990b23c69ecdf7b320103adc70237cfa9e2

SHA512
03937788bd22b38b5021dac40e48b68a1e00f61cc86c2b2e2d6c5c0a10ef5f0c933ae5891e972b42036780d1480e10c4abb77a085b333276fcfbb12add26613f

Download Submit
C:\Windows\System\krjdHqX.exe

Filesize
2.8MB

MD5
da39f7d2b2738ac22d180b6d6b1cdc16

SHA1
d6f313a37940c9741344e1605a52528a50201e39

SHA256
43f79b858417439f6d2afb336498c8492336fdf5c701088cedf5997813bf3f07

SHA512
afc8a71d7d6fe334b1adaed26785c79cb863997df0da8be8627239e81a523e9c00617800ea7316a2a2c8fbeefe978be0033349c01b3f16ebc998477b4279a58c

Download Submit
C:\Windows\System\lKeNRrt.exe

Filesize
2.8MB

MD5
6022e77262226ebcd390a0898c1cd1f9

SHA1
0753211f1fcab90d63ec15ce53f627878a00b549

SHA256
8f712bc316316e288688be37f0334dc07842e5baf0a8b1ea094bb40b458965d9

SHA512
2569316526059440217f59a59f617646a6ff1d6faa47601fd884aec6b28a9567e2cd7d6aac80736f4fafdb294f97c8502ae2c0ad55ca69bd84f781ae61e0788e

Download Submit
C:\Windows\System\oLzlIWX.exe

Filesize
2.8MB

MD5
de538cb112108350ec554db8c6932791

SHA1
1a07c655b131402bdbe9533a862058230bdf1402

SHA256
2ed1485971d4786c436337e6c7a620013736edf9bd8f57922bbfb3ce177deb4b

SHA512
16d89c67ade18f24cc2dd141e013dcdf9f73537deb23a47c11a1dcfac83314de3634787ff15bb4a762cb1eafb6b6aad811d36a78bcc8119229887e9fec69fbce

Download Submit
C:\Windows\System\rVqBkqp.exe

Filesize
2.8MB

MD5
dd57c51252350f0e0d875e08541568f2

SHA1
9b8c0991e6d12684a2a513e02e9fbc4ede80d091

SHA256
e488c388b8c612b5cc99a13dbe81b96f44ce03bbf9c46c620b6e0318c917bc12

SHA512
0ec289a34b0647cab240b204e8242118a4f10bd17120e7e24d5626821f22bb447e3b210405ba7bc0ade84bd005e6df203b43f37293ef755bb6fef3f739ae743a

Download Submit
C:\Windows\System\wJbTmIQ.exe

Filesize
2.8MB

MD5
3aabdf93fad5ab785283fc864e5a82e7

SHA1
01ebd84293e2679615c46e97c6976a86fb80dc0f

SHA256
1e90e8f023bc2678b9ee4695dec3dc74cb66f30e88ae5b44bc0e0a9e7c2824b5

SHA512
8ae2d27a67fd35f74a1cb8ebd1a643dc623ce8d1079017764a50f84c7d15b4a1cb7dfe1a7ab48d72db62d7fe8f4142dff90928738595ba1d536ee66318c30099

Download Submit
C:\Windows\System\wgLYnDF.exe

Filesize
2.8MB

MD5
6fdb6101a5f4c65af7b2988d63562529

SHA1
774472abb1f1f9f5eb34ecceb99071bd28f76dfa

SHA256
9a9c0eea89cfd3a9924ad4eeb29932669173dff2c086b2652a66c853a7a812cc

SHA512
08f050943b20598aa15e6eb517d88cd1f722ab98c73e3df0a3bf90e70b48e5447008fb20e77ddf4fbfc717f16f28f962638f9261c0683eba34b61c0d7668fc13

Download Submit
memory/732-3920-0x00007FF762530000-0x00007FF762922000-memory.dmp

Filesize
3.9MB

Download
memory/732-729-0x00007FF762530000-0x00007FF762922000-memory.dmp

Filesize
3.9MB

Download
memory/752-65-0x00007FF7DD8A0000-0x00007FF7DDC92000-memory.dmp

Filesize
3.9MB

Download
memory/752-3880-0x00007FF7DD8A0000-0x00007FF7DDC92000-memory.dmp

Filesize
3.9MB

Download
memory/1184-60-0x00007FF658430000-0x00007FF658822000-memory.dmp

Filesize
3.9MB

Download
memory/1184-3874-0x00007FF658430000-0x00007FF658822000-memory.dmp

Filesize
3.9MB

Download
memory/1472-3891-0x00007FF60F3E0000-0x00007FF60F7D2000-memory.dmp

Filesize
3.9MB

Download
memory/1472-88-0x00007FF60F3E0000-0x00007FF60F7D2000-memory.dmp

Filesize
3.9MB

Download
memory/1560-84-0x00007FF6A8900000-0x00007FF6A8CF2000-memory.dmp

Filesize
3.9MB

Download
memory/1560-3877-0x00007FF6A8900000-0x00007FF6A8CF2000-memory.dmp

Filesize
3.9MB

Download
memory/1772-695-0x00007FF7418A0000-0x00007FF741C92000-memory.dmp

Filesize
3.9MB

Download
memory/1772-3914-0x00007FF7418A0000-0x00007FF741C92000-memory.dmp

Filesize
3.9MB

Download
memory/1800-0-0x00007FF6B4AC0000-0x00007FF6B4EB2000-memory.dmp

Filesize
3.9MB

Download
memory/1800-1-0x000001B5BBF80000-0x000001B5BBF90000-memory.dmp

Filesize
64KB

Download
memory/1836-717-0x00007FF7CE540000-0x00007FF7CE932000-memory.dmp

Filesize
3.9MB

Download
memory/1836-3916-0x00007FF7CE540000-0x00007FF7CE932000-memory.dmp

Filesize
3.9MB

Download
memory/2088-70-0x00007FF70CA40000-0x00007FF70CE32000-memory.dmp

Filesize
3.9MB

Download
memory/2088-3884-0x00007FF70CA40000-0x00007FF70CE32000-memory.dmp

Filesize
3.9MB

Download
memory/2380-3857-0x00007FF7FAEF0000-0x00007FF7FB2E2000-memory.dmp

Filesize
3.9MB

Download
memory/2380-51-0x00007FF7FAEF0000-0x00007FF7FB2E2000-memory.dmp

Filesize
3.9MB

Download
memory/2520-3902-0x00007FF7491E0000-0x00007FF7495D2000-memory.dmp

Filesize
3.9MB

Download
memory/2520-750-0x00007FF7491E0000-0x00007FF7495D2000-memory.dmp

Filesize
3.9MB

Download
memory/2876-3896-0x00007FF7B8E50000-0x00007FF7B9242000-memory.dmp

Filesize
3.9MB

Download
memory/2876-745-0x00007FF7B8E50000-0x00007FF7B9242000-memory.dmp

Filesize
3.9MB

Download
memory/3456-74-0x00007FF6D7870000-0x00007FF6D7C62000-memory.dmp

Filesize
3.9MB

Download
memory/3456-3855-0x00007FF6D7870000-0x00007FF6D7C62000-memory.dmp

Filesize
3.9MB

Download
memory/3460-697-0x00007FF671ED0000-0x00007FF6722C2000-memory.dmp

Filesize
3.9MB

Download
memory/3460-3926-0x00007FF671ED0000-0x00007FF6722C2000-memory.dmp

Filesize
3.9MB

Download
memory/3732-3910-0x00007FF7163A0000-0x00007FF716792000-memory.dmp

Filesize
3.9MB

Download
memory/3732-727-0x00007FF7163A0000-0x00007FF716792000-memory.dmp

Filesize
3.9MB

Download
memory/3796-3899-0x00007FF7EB470000-0x00007FF7EB862000-memory.dmp

Filesize
3.9MB

Download
memory/3796-749-0x00007FF7EB470000-0x00007FF7EB862000-memory.dmp

Filesize
3.9MB

Download
memory/3864-3912-0x00007FF6BBBD0000-0x00007FF6BBFC2000-memory.dmp

Filesize
3.9MB

Download
memory/3864-738-0x00007FF6BBBD0000-0x00007FF6BBFC2000-memory.dmp

Filesize
3.9MB

Download
memory/4208-10-0x00007FF7DBF10000-0x00007FF7DC302000-memory.dmp

Filesize
3.9MB

Download
memory/4348-3917-0x00007FF625C60000-0x00007FF626052000-memory.dmp

Filesize
3.9MB

Download
memory/4348-720-0x00007FF625C60000-0x00007FF626052000-memory.dmp

Filesize
3.9MB

Download
memory/4512-3865-0x00007FF760090000-0x00007FF760482000-memory.dmp

Filesize
3.9MB

Download
memory/4512-53-0x00007FF760090000-0x00007FF760482000-memory.dmp

Filesize
3.9MB

Download
memory/4628-38-0x000001C93FBA0000-0x000001C93FBC2000-memory.dmp

Filesize
136KB

Download
memory/4628-23-0x00007FF9AE6B0000-0x00007FF9AF171000-memory.dmp

Filesize
10.8MB

Download
memory/4628-11-0x00007FF9AE6B3000-0x00007FF9AE6B5000-memory.dmp

Filesize
8KB

Download
memory/4628-761-0x000001C941210000-0x000001C9419B6000-memory.dmp

Filesize
7.6MB

Download
memory/4628-27-0x00007FF9AE6B0000-0x00007FF9AF171000-memory.dmp

Filesize
10.8MB

Download
memory/4672-3870-0x00007FF75F7C0000-0x00007FF75FBB2000-memory.dmp

Filesize
3.9MB

Download
memory/4672-78-0x00007FF75F7C0000-0x00007FF75FBB2000-memory.dmp

Filesize
3.9MB

Download
memory/4676-3923-0x00007FF7F8430000-0x00007FF7F8822000-memory.dmp

Filesize
3.9MB

Download
memory/4676-684-0x00007FF7F8430000-0x00007FF7F8822000-memory.dmp

Filesize
3.9MB

Download
memory/4712-683-0x00007FF74EED0000-0x00007FF74F2C2000-memory.dmp

Filesize
3.9MB

Download
memory/4712-3908-0x00007FF74EED0000-0x00007FF74F2C2000-memory.dmp

Filesize
3.9MB

Download
memory/5064-3931-0x00007FF631DA0000-0x00007FF632192000-memory.dmp

Filesize
3.9MB

Download
memory/5064-739-0x00007FF631DA0000-0x00007FF632192000-memory.dmp

Filesize
3.9MB

Download
memory/5076-3887-0x00007FF698670000-0x00007FF698A62000-memory.dmp

Filesize
3.9MB

Download
memory/5076-744-0x00007FF698670000-0x00007FF698A62000-memory.dmp

Filesize
3.9MB

Download