xmrig | d79c5c82a5955fa5745c0b7d54d2cecfb22b691b6bf0dcd79e97bf4f4f31108d

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 23:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
Size

2.1MB
MD5

3cedf3473f42fe9537fe8fa084d660e6
SHA1

ded1b3c2cb296f5f9ec06ecb2dd01ebbd53809c5
SHA256

d79c5c82a5955fa5745c0b7d54d2cecfb22b691b6bf0dcd79e97bf4f4f31108d
SHA512

5be16718a54cf43f3990e3317c99a1a5c726e2a5d87da706eb55b717b30a917be2662b9699123f862a0955c6ab352d9dd7e2d453dfd1f680f15654e4b6441d61
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafJca:NABW

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/3468-70-0x00007FF749280000-0x00007FF749672000-memory.dmp	xmrig
behavioral2/memory/3228-66-0x00007FF7CAD60000-0x00007FF7CB152000-memory.dmp	xmrig
behavioral2/memory/220-54-0x00007FF789220000-0x00007FF789612000-memory.dmp	xmrig
behavioral2/memory/2720-72-0x00007FF728DC0000-0x00007FF7291B2000-memory.dmp	xmrig
behavioral2/memory/4204-71-0x00007FF643510000-0x00007FF643902000-memory.dmp	xmrig
behavioral2/memory/1004-73-0x00007FF7C7F80000-0x00007FF7C8372000-memory.dmp	xmrig
behavioral2/memory/3656-75-0x00007FF7F4D70000-0x00007FF7F5162000-memory.dmp	xmrig
behavioral2/memory/1212-76-0x00007FF795ED0000-0x00007FF7962C2000-memory.dmp	xmrig
behavioral2/memory/1728-87-0x00007FF64B670000-0x00007FF64BA62000-memory.dmp	xmrig
behavioral2/memory/3156-88-0x00007FF6CC370000-0x00007FF6CC762000-memory.dmp	xmrig
behavioral2/memory/1208-97-0x00007FF68DDC0000-0x00007FF68E1B2000-memory.dmp	xmrig
behavioral2/memory/3692-108-0x00007FF748990000-0x00007FF748D82000-memory.dmp	xmrig
behavioral2/memory/3660-117-0x00007FF750B20000-0x00007FF750F12000-memory.dmp	xmrig
behavioral2/memory/112-120-0x00007FF63E330000-0x00007FF63E722000-memory.dmp	xmrig
behavioral2/memory/3428-125-0x00007FF7E3E90000-0x00007FF7E4282000-memory.dmp	xmrig
behavioral2/memory/112-126-0x00007FF63E330000-0x00007FF63E722000-memory.dmp	xmrig
behavioral2/memory/696-137-0x00007FF602060000-0x00007FF602452000-memory.dmp	xmrig
behavioral2/memory/3836-154-0x00007FF734D10000-0x00007FF735102000-memory.dmp	xmrig
behavioral2/memory/4656-181-0x00007FF7EA370000-0x00007FF7EA762000-memory.dmp	xmrig
behavioral2/memory/3684-169-0x00007FF7ECA30000-0x00007FF7ECE22000-memory.dmp	xmrig
behavioral2/memory/4412-160-0x00007FF61B8A0000-0x00007FF61BC92000-memory.dmp	xmrig
behavioral2/memory/4548-246-0x00007FF65D460000-0x00007FF65D852000-memory.dmp	xmrig
behavioral2/memory/452-249-0x00007FF6B0EF0000-0x00007FF6B12E2000-memory.dmp	xmrig
behavioral2/memory/996-255-0x00007FF68E470000-0x00007FF68E862000-memory.dmp	xmrig
behavioral2/memory/4328-256-0x00007FF66A430000-0x00007FF66A822000-memory.dmp	xmrig
behavioral2/memory/3656-1637-0x00007FF7F4D70000-0x00007FF7F5162000-memory.dmp	xmrig
behavioral2/memory/1004-1838-0x00007FF7C7F80000-0x00007FF7C8372000-memory.dmp	xmrig
behavioral2/memory/1212-1837-0x00007FF795ED0000-0x00007FF7962C2000-memory.dmp	xmrig
behavioral2/memory/3468-1835-0x00007FF749280000-0x00007FF749672000-memory.dmp	xmrig
behavioral2/memory/4204-1830-0x00007FF643510000-0x00007FF643902000-memory.dmp	xmrig
behavioral2/memory/2720-1828-0x00007FF728DC0000-0x00007FF7291B2000-memory.dmp	xmrig
behavioral2/memory/3228-1773-0x00007FF7CAD60000-0x00007FF7CB152000-memory.dmp	xmrig
behavioral2/memory/696-1682-0x00007FF602060000-0x00007FF602452000-memory.dmp	xmrig
behavioral2/memory/3428-2012-0x00007FF7E3E90000-0x00007FF7E4282000-memory.dmp	xmrig
behavioral2/memory/220-1629-0x00007FF789220000-0x00007FF789612000-memory.dmp	xmrig
behavioral2/memory/3836-2017-0x00007FF734D10000-0x00007FF735102000-memory.dmp	xmrig
behavioral2/memory/3660-2019-0x00007FF750B20000-0x00007FF750F12000-memory.dmp	xmrig
behavioral2/memory/3684-2021-0x00007FF7ECA30000-0x00007FF7ECE22000-memory.dmp	xmrig
behavioral2/memory/1728-2020-0x00007FF64B670000-0x00007FF64BA62000-memory.dmp	xmrig
behavioral2/memory/1208-2027-0x00007FF68DDC0000-0x00007FF68E1B2000-memory.dmp	xmrig
behavioral2/memory/4412-2069-0x00007FF61B8A0000-0x00007FF61BC92000-memory.dmp	xmrig
behavioral2/memory/4328-2091-0x00007FF66A430000-0x00007FF66A822000-memory.dmp	xmrig
behavioral2/memory/452-2067-0x00007FF6B0EF0000-0x00007FF6B12E2000-memory.dmp	xmrig
behavioral2/memory/4548-2082-0x00007FF65D460000-0x00007FF65D852000-memory.dmp	xmrig
behavioral2/memory/4656-2030-0x00007FF7EA370000-0x00007FF7EA762000-memory.dmp	xmrig
behavioral2/memory/4184-2026-0x00007FF7D3DC0000-0x00007FF7D41B2000-memory.dmp	xmrig
behavioral2/memory/3692-2068-0x00007FF748990000-0x00007FF748D82000-memory.dmp	xmrig
behavioral2/memory/996-2066-0x00007FF68E470000-0x00007FF68E862000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
5	3992	powershell.exe
12	3992	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3992	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
696	lSKEQOo.exe
3656	VpfuhuZ.exe
220	bDoTIxB.exe
3228	UpQGvSZ.exe
3468	eOCjKZP.exe
4204	KMnMgGo.exe
2720	fbONxkd.exe
1212	tCOYtXq.exe
3684	EwHXyxe.exe
1004	lxOHOby.exe
1728	InFPWsz.exe
3156	KRZEsKW.exe
1208	SGNfXry.exe
4184	GmHMnPq.exe
3692	mOZwCsq.exe
3660	vNIiJoT.exe
3428	DAJuTRr.exe
3836	PlOLpEB.exe
4412	gagYJBY.exe
4656	zSbMrSO.exe
452	DmusiyA.exe
996	vjbayPS.exe
4548	vGZgIUe.exe
4328	oFUSWZD.exe
404	oUiWnLh.exe
3668	SthECgN.exe
3812	rkLgJfC.exe
2540	UpBsRFl.exe
3908	yKvRUNO.exe
4348	lZynKTq.exe
4592	BKibLHl.exe
3460	aaQIcip.exe
3580	OibPmwH.exe
1472	ulOnaFu.exe
3396	RtRFOrF.exe
4224	KdkTraL.exe
2948	avMtXHX.exe
2672	EADEozB.exe
4320	pfqhqnE.exe
4020	oNLGhQI.exe
564	lxLyLzw.exe
2356	ZBBArfl.exe
3996	rLmyJOh.exe
3572	PwoArTE.exe
4624	tVYjltD.exe
4680	GqwDzIx.exe
4504	hJAHHln.exe
4032	TUhbDKr.exe
2568	GlmqWxa.exe
1740	gsWzuuH.exe
4788	rYMIDUf.exe
3484	hLUHRVa.exe
4924	piTjTQh.exe
4092	tiqgiGP.exe
3712	qbhhgCF.exe
3820	EyxSUae.exe
4584	uVBvPSm.exe
2656	NVHlAsq.exe
3076	xmsyVfV.exe
4892	LRZqDQF.exe
2348	IDTDHcx.exe
1964	WKygcip.exe
1304	TChKlhQ.exe
4044	dTgRavh.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/112-0-0x00007FF63E330000-0x00007FF63E722000-memory.dmp	upx
behavioral2/files/0x000900000002324b-5.dat	upx
behavioral2/memory/696-9-0x00007FF602060000-0x00007FF602452000-memory.dmp	upx
behavioral2/files/0x0008000000023251-12.dat	upx
behavioral2/files/0x0007000000023252-11.dat	upx
behavioral2/files/0x0008000000023253-33.dat	upx
behavioral2/files/0x000800000002324f-36.dat	upx
behavioral2/files/0x0008000000023254-42.dat	upx
behavioral2/files/0x0007000000023255-47.dat	upx
behavioral2/files/0x0007000000023256-58.dat	upx
behavioral2/files/0x0007000000023258-63.dat	upx
behavioral2/memory/3468-70-0x00007FF749280000-0x00007FF749672000-memory.dmp	upx
behavioral2/files/0x0007000000023257-67.dat	upx
behavioral2/memory/3228-66-0x00007FF7CAD60000-0x00007FF7CB152000-memory.dmp	upx
behavioral2/memory/220-54-0x00007FF789220000-0x00007FF789612000-memory.dmp	upx
behavioral2/memory/2720-72-0x00007FF728DC0000-0x00007FF7291B2000-memory.dmp	upx
behavioral2/memory/4204-71-0x00007FF643510000-0x00007FF643902000-memory.dmp	upx
behavioral2/memory/1004-73-0x00007FF7C7F80000-0x00007FF7C8372000-memory.dmp	upx
behavioral2/memory/3656-75-0x00007FF7F4D70000-0x00007FF7F5162000-memory.dmp	upx
behavioral2/memory/1212-76-0x00007FF795ED0000-0x00007FF7962C2000-memory.dmp	upx
behavioral2/memory/3684-77-0x00007FF7ECA30000-0x00007FF7ECE22000-memory.dmp	upx
behavioral2/files/0x0007000000023259-78.dat	upx
behavioral2/files/0x000700000002325a-84.dat	upx
behavioral2/memory/1728-87-0x00007FF64B670000-0x00007FF64BA62000-memory.dmp	upx
behavioral2/memory/3156-88-0x00007FF6CC370000-0x00007FF6CC762000-memory.dmp	upx
behavioral2/files/0x000700000002325b-90.dat	upx
behavioral2/files/0x000700000002325c-96.dat	upx
behavioral2/memory/1208-97-0x00007FF68DDC0000-0x00007FF68E1B2000-memory.dmp	upx
behavioral2/memory/4184-99-0x00007FF7D3DC0000-0x00007FF7D41B2000-memory.dmp	upx
behavioral2/files/0x000700000002325d-103.dat	upx
behavioral2/files/0x000700000002325e-110.dat	upx
behavioral2/files/0x0007000000023260-114.dat	upx
behavioral2/memory/3692-108-0x00007FF748990000-0x00007FF748D82000-memory.dmp	upx
behavioral2/memory/3660-117-0x00007FF750B20000-0x00007FF750F12000-memory.dmp	upx
behavioral2/files/0x0007000000023261-122.dat	upx
behavioral2/memory/112-120-0x00007FF63E330000-0x00007FF63E722000-memory.dmp	upx
behavioral2/memory/3428-125-0x00007FF7E3E90000-0x00007FF7E4282000-memory.dmp	upx
behavioral2/files/0x0007000000023262-130.dat	upx
behavioral2/files/0x0007000000023263-134.dat	upx
behavioral2/memory/112-126-0x00007FF63E330000-0x00007FF63E722000-memory.dmp	upx
behavioral2/memory/696-137-0x00007FF602060000-0x00007FF602452000-memory.dmp	upx
behavioral2/files/0x0007000000023265-145.dat	upx
behavioral2/memory/3836-154-0x00007FF734D10000-0x00007FF735102000-memory.dmp	upx
behavioral2/files/0x0007000000023266-153.dat	upx
behavioral2/files/0x0007000000023264-151.dat	upx
behavioral2/memory/4656-181-0x00007FF7EA370000-0x00007FF7EA762000-memory.dmp	upx
behavioral2/memory/3684-169-0x00007FF7ECA30000-0x00007FF7ECE22000-memory.dmp	upx
behavioral2/files/0x0007000000023267-162.dat	upx
behavioral2/memory/4412-160-0x00007FF61B8A0000-0x00007FF61BC92000-memory.dmp	upx
behavioral2/files/0x0007000000023269-182.dat	upx
behavioral2/files/0x000700000002326c-199.dat	upx
behavioral2/files/0x000700000002326d-204.dat	upx
behavioral2/files/0x000700000002326a-196.dat	upx
behavioral2/files/0x0007000000023268-193.dat	upx
behavioral2/files/0x000700000002326b-192.dat	upx
behavioral2/files/0x000700000002326f-213.dat	upx
behavioral2/files/0x000700000002326e-209.dat	upx
behavioral2/memory/4548-246-0x00007FF65D460000-0x00007FF65D852000-memory.dmp	upx
behavioral2/memory/452-249-0x00007FF6B0EF0000-0x00007FF6B12E2000-memory.dmp	upx
behavioral2/memory/996-255-0x00007FF68E470000-0x00007FF68E862000-memory.dmp	upx
behavioral2/memory/4328-256-0x00007FF66A430000-0x00007FF66A822000-memory.dmp	upx
behavioral2/memory/3656-1637-0x00007FF7F4D70000-0x00007FF7F5162000-memory.dmp	upx
behavioral2/memory/1004-1838-0x00007FF7C7F80000-0x00007FF7C8372000-memory.dmp	upx
behavioral2/memory/1212-1837-0x00007FF795ED0000-0x00007FF7962C2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
5	raw.githubusercontent.com
2	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\unmZuGb.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\LmubHQr.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\hjzJVEw.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\hwBPiiA.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\omlYedp.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\VpZKOBV.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\IphCkVA.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\iFNpPSK.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\VkqMyux.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\XkZcreV.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\YtzgLeL.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\eOCjKZP.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\oNLGhQI.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\TUhbDKr.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\tnmlOko.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\znnkCYu.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\QFbiMAB.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\XZptibM.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\SGNfXry.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\OZywLSt.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\cxDzuKP.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\NyPqlxN.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\PqOIFMG.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\dbzXwTO.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\iUroytG.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\qfXqhkf.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\uCRVRKj.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\OlMyATC.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\RvTnwGI.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\xEMWAMm.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\YnzhqHk.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\YVsMlJj.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\qUNIaSy.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\kItIoMU.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\GIBWWuT.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\ZZMoaNB.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\mwLqWxj.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\fuvudqe.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\kmOHGiX.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\jEjVnZH.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\ekToBOk.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\CgjAtei.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\HlgxPgA.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\hOsHXBl.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\ShUwOJo.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\KamTzaM.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\RtwKQZk.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\yuYMkap.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\ZXObnyH.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\xeNLVuK.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\savWlRA.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\GJHThrB.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\FpQMRiD.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\KBedNJl.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\aJBPiXI.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\bGShwSG.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\DBbxVGE.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\nOgFKxm.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\GuJMiWP.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\dPfbJWj.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\YoQYltO.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\lSKEQOo.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\GooSOIG.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
File created	C:\Windows\System\nEymOrB.exe	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3992	powershell.exe
3992	powershell.exe
3992	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
Token: SeDebugPrivilege	3992	powershell.exe
Token: SeLockMemoryPrivilege	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 112 wrote to memory of 3992	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	93
PID 112 wrote to memory of 3992	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	93
PID 112 wrote to memory of 696	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	94
PID 112 wrote to memory of 696	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	94
PID 112 wrote to memory of 3656	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	95
PID 112 wrote to memory of 3656	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	95
PID 112 wrote to memory of 220	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	96
PID 112 wrote to memory of 220	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	96
PID 112 wrote to memory of 3228	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	97
PID 112 wrote to memory of 3228	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	97
PID 112 wrote to memory of 3468	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	98
PID 112 wrote to memory of 3468	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	98
PID 112 wrote to memory of 4204	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	99
PID 112 wrote to memory of 4204	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	99
PID 112 wrote to memory of 2720	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	100
PID 112 wrote to memory of 2720	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	100
PID 112 wrote to memory of 1212	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	101
PID 112 wrote to memory of 1212	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	101
PID 112 wrote to memory of 3684	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	102
PID 112 wrote to memory of 3684	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	102
PID 112 wrote to memory of 1004	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	103
PID 112 wrote to memory of 1004	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	103
PID 112 wrote to memory of 1728	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	104
PID 112 wrote to memory of 1728	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	104
PID 112 wrote to memory of 3156	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	105
PID 112 wrote to memory of 3156	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	105
PID 112 wrote to memory of 1208	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	106
PID 112 wrote to memory of 1208	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	106
PID 112 wrote to memory of 4184	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	107
PID 112 wrote to memory of 4184	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	107
PID 112 wrote to memory of 3692	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	108
PID 112 wrote to memory of 3692	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	108
PID 112 wrote to memory of 3660	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	109
PID 112 wrote to memory of 3660	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	109
PID 112 wrote to memory of 3428	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	110
PID 112 wrote to memory of 3428	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	110
PID 112 wrote to memory of 3836	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	111
PID 112 wrote to memory of 3836	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	111
PID 112 wrote to memory of 4412	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	112
PID 112 wrote to memory of 4412	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	112
PID 112 wrote to memory of 4656	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	113
PID 112 wrote to memory of 4656	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	113
PID 112 wrote to memory of 996	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	114
PID 112 wrote to memory of 996	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	114
PID 112 wrote to memory of 452	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	115
PID 112 wrote to memory of 452	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	115
PID 112 wrote to memory of 4548	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	116
PID 112 wrote to memory of 4548	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	116
PID 112 wrote to memory of 4328	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	117
PID 112 wrote to memory of 4328	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	117
PID 112 wrote to memory of 3812	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	118
PID 112 wrote to memory of 3812	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	118
PID 112 wrote to memory of 404	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	119
PID 112 wrote to memory of 404	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	119
PID 112 wrote to memory of 3668	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	120
PID 112 wrote to memory of 3668	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	120
PID 112 wrote to memory of 2540	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	121
PID 112 wrote to memory of 2540	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	121
PID 112 wrote to memory of 3908	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	122
PID 112 wrote to memory of 3908	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	122
PID 112 wrote to memory of 4348	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	123
PID 112 wrote to memory of 4348	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	123
PID 112 wrote to memory of 4592	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	124
PID 112 wrote to memory of 4592	112	3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe	124

C:\Users\Admin\AppData\Local\Temp\3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3cedf3473f42fe9537fe8fa084d660e6_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3992
- C:\Windows\System\lSKEQOo.exe
  C:\Windows\System\lSKEQOo.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\VpfuhuZ.exe
  C:\Windows\System\VpfuhuZ.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\bDoTIxB.exe
  C:\Windows\System\bDoTIxB.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\UpQGvSZ.exe
  C:\Windows\System\UpQGvSZ.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\eOCjKZP.exe
  C:\Windows\System\eOCjKZP.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\KMnMgGo.exe
  C:\Windows\System\KMnMgGo.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\fbONxkd.exe
  C:\Windows\System\fbONxkd.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\tCOYtXq.exe
  C:\Windows\System\tCOYtXq.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\EwHXyxe.exe
  C:\Windows\System\EwHXyxe.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\lxOHOby.exe
  C:\Windows\System\lxOHOby.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\InFPWsz.exe
  C:\Windows\System\InFPWsz.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\KRZEsKW.exe
  C:\Windows\System\KRZEsKW.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System\SGNfXry.exe
  C:\Windows\System\SGNfXry.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\GmHMnPq.exe
  C:\Windows\System\GmHMnPq.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\mOZwCsq.exe
  C:\Windows\System\mOZwCsq.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\vNIiJoT.exe
  C:\Windows\System\vNIiJoT.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\DAJuTRr.exe
  C:\Windows\System\DAJuTRr.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\PlOLpEB.exe
  C:\Windows\System\PlOLpEB.exe
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Windows\System\gagYJBY.exe
  C:\Windows\System\gagYJBY.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\zSbMrSO.exe
  C:\Windows\System\zSbMrSO.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\vjbayPS.exe
  C:\Windows\System\vjbayPS.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\DmusiyA.exe
  C:\Windows\System\DmusiyA.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\vGZgIUe.exe
  C:\Windows\System\vGZgIUe.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\oFUSWZD.exe
  C:\Windows\System\oFUSWZD.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\rkLgJfC.exe
  C:\Windows\System\rkLgJfC.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\oUiWnLh.exe
  C:\Windows\System\oUiWnLh.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\SthECgN.exe
  C:\Windows\System\SthECgN.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\UpBsRFl.exe
  C:\Windows\System\UpBsRFl.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\yKvRUNO.exe
  C:\Windows\System\yKvRUNO.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\lZynKTq.exe
  C:\Windows\System\lZynKTq.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\BKibLHl.exe
  C:\Windows\System\BKibLHl.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\aaQIcip.exe
  C:\Windows\System\aaQIcip.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\OibPmwH.exe
  C:\Windows\System\OibPmwH.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\ulOnaFu.exe
  C:\Windows\System\ulOnaFu.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\RtRFOrF.exe
  C:\Windows\System\RtRFOrF.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Windows\System\KdkTraL.exe
  C:\Windows\System\KdkTraL.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\avMtXHX.exe
  C:\Windows\System\avMtXHX.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\EADEozB.exe
  C:\Windows\System\EADEozB.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\pfqhqnE.exe
  C:\Windows\System\pfqhqnE.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\oNLGhQI.exe
  C:\Windows\System\oNLGhQI.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\lxLyLzw.exe
  C:\Windows\System\lxLyLzw.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System\ZBBArfl.exe
  C:\Windows\System\ZBBArfl.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\rLmyJOh.exe
  C:\Windows\System\rLmyJOh.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\tVYjltD.exe
  C:\Windows\System\tVYjltD.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\PwoArTE.exe
  C:\Windows\System\PwoArTE.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\GqwDzIx.exe
  C:\Windows\System\GqwDzIx.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\hJAHHln.exe
  C:\Windows\System\hJAHHln.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\TUhbDKr.exe
  C:\Windows\System\TUhbDKr.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\GlmqWxa.exe
  C:\Windows\System\GlmqWxa.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\gsWzuuH.exe
  C:\Windows\System\gsWzuuH.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\rYMIDUf.exe
  C:\Windows\System\rYMIDUf.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\hLUHRVa.exe
  C:\Windows\System\hLUHRVa.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\piTjTQh.exe
  C:\Windows\System\piTjTQh.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\tiqgiGP.exe
  C:\Windows\System\tiqgiGP.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\qbhhgCF.exe
  C:\Windows\System\qbhhgCF.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\EyxSUae.exe
  C:\Windows\System\EyxSUae.exe
  2⤵
  - Executes dropped EXE
  PID:3820
- C:\Windows\System\uVBvPSm.exe
  C:\Windows\System\uVBvPSm.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\NVHlAsq.exe
  C:\Windows\System\NVHlAsq.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\xmsyVfV.exe
  C:\Windows\System\xmsyVfV.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\LRZqDQF.exe
  C:\Windows\System\LRZqDQF.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\IDTDHcx.exe
  C:\Windows\System\IDTDHcx.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\WKygcip.exe
  C:\Windows\System\WKygcip.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\TChKlhQ.exe
  C:\Windows\System\TChKlhQ.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\dTgRavh.exe
  C:\Windows\System\dTgRavh.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\ASaZzck.exe
  C:\Windows\System\ASaZzck.exe
  2⤵
  PID:5128
- C:\Windows\System\xwIdfLW.exe
  C:\Windows\System\xwIdfLW.exe
  2⤵
  PID:5156
- C:\Windows\System\dduhCud.exe
  C:\Windows\System\dduhCud.exe
  2⤵
  PID:5180
- C:\Windows\System\iMKQGgJ.exe
  C:\Windows\System\iMKQGgJ.exe
  2⤵
  PID:5212
- C:\Windows\System\YRxsCwB.exe
  C:\Windows\System\YRxsCwB.exe
  2⤵
  PID:5240
- C:\Windows\System\NmVLGOy.exe
  C:\Windows\System\NmVLGOy.exe
  2⤵
  PID:5264
- C:\Windows\System\PkBDzCy.exe
  C:\Windows\System\PkBDzCy.exe
  2⤵
  PID:5296
- C:\Windows\System\IRkJGQb.exe
  C:\Windows\System\IRkJGQb.exe
  2⤵
  PID:5340
- C:\Windows\System\zbrCLkz.exe
  C:\Windows\System\zbrCLkz.exe
  2⤵
  PID:5364
- C:\Windows\System\oQcPMnl.exe
  C:\Windows\System\oQcPMnl.exe
  2⤵
  PID:5384
- C:\Windows\System\GRiuuHO.exe
  C:\Windows\System\GRiuuHO.exe
  2⤵
  PID:5408
- C:\Windows\System\pLFcHUY.exe
  C:\Windows\System\pLFcHUY.exe
  2⤵
  PID:5440
- C:\Windows\System\fYNfBaG.exe
  C:\Windows\System\fYNfBaG.exe
  2⤵
  PID:5464
- C:\Windows\System\pGErWPg.exe
  C:\Windows\System\pGErWPg.exe
  2⤵
  PID:5492
- C:\Windows\System\kxbPcZW.exe
  C:\Windows\System\kxbPcZW.exe
  2⤵
  PID:5512
- C:\Windows\System\biSThht.exe
  C:\Windows\System\biSThht.exe
  2⤵
  PID:5532
- C:\Windows\System\ZAJjZBD.exe
  C:\Windows\System\ZAJjZBD.exe
  2⤵
  PID:5568
- C:\Windows\System\mqoQfuD.exe
  C:\Windows\System\mqoQfuD.exe
  2⤵
  PID:5588
- C:\Windows\System\PIlsxAo.exe
  C:\Windows\System\PIlsxAo.exe
  2⤵
  PID:5612
- C:\Windows\System\mGHgbgg.exe
  C:\Windows\System\mGHgbgg.exe
  2⤵
  PID:5632
- C:\Windows\System\rHNIhKY.exe
  C:\Windows\System\rHNIhKY.exe
  2⤵
  PID:5656
- C:\Windows\System\qAvLrFf.exe
  C:\Windows\System\qAvLrFf.exe
  2⤵
  PID:5684
- C:\Windows\System\XkZcreV.exe
  C:\Windows\System\XkZcreV.exe
  2⤵
  PID:5700
- C:\Windows\System\TiqHaEY.exe
  C:\Windows\System\TiqHaEY.exe
  2⤵
  PID:5720
- C:\Windows\System\ugsMHSo.exe
  C:\Windows\System\ugsMHSo.exe
  2⤵
  PID:5776
- C:\Windows\System\OXShjUJ.exe
  C:\Windows\System\OXShjUJ.exe
  2⤵
  PID:5812
- C:\Windows\System\AqbLvMm.exe
  C:\Windows\System\AqbLvMm.exe
  2⤵
  PID:5840
- C:\Windows\System\vQigsrd.exe
  C:\Windows\System\vQigsrd.exe
  2⤵
  PID:5872
- C:\Windows\System\OzkoKhK.exe
  C:\Windows\System\OzkoKhK.exe
  2⤵
  PID:5900
- C:\Windows\System\PKQQQiW.exe
  C:\Windows\System\PKQQQiW.exe
  2⤵
  PID:5916
- C:\Windows\System\GNsxdGB.exe
  C:\Windows\System\GNsxdGB.exe
  2⤵
  PID:5992
- C:\Windows\System\hNqqbDD.exe
  C:\Windows\System\hNqqbDD.exe
  2⤵
  PID:6008
- C:\Windows\System\csQGqax.exe
  C:\Windows\System\csQGqax.exe
  2⤵
  PID:6024
- C:\Windows\System\unmZuGb.exe
  C:\Windows\System\unmZuGb.exe
  2⤵
  PID:6040
- C:\Windows\System\fuCnuUl.exe
  C:\Windows\System\fuCnuUl.exe
  2⤵
  PID:6056
- C:\Windows\System\rGbYDXu.exe
  C:\Windows\System\rGbYDXu.exe
  2⤵
  PID:6076
- C:\Windows\System\ynQfLoD.exe
  C:\Windows\System\ynQfLoD.exe
  2⤵
  PID:6120
- C:\Windows\System\LXaBKSC.exe
  C:\Windows\System\LXaBKSC.exe
  2⤵
  PID:6140
- C:\Windows\System\qUNIaSy.exe
  C:\Windows\System\qUNIaSy.exe
  2⤵
  PID:5224
- C:\Windows\System\kLHkLWQ.exe
  C:\Windows\System\kLHkLWQ.exe
  2⤵
  PID:5336
- C:\Windows\System\VJnSbEm.exe
  C:\Windows\System\VJnSbEm.exe
  2⤵
  PID:5372
- C:\Windows\System\uaMRNsJ.exe
  C:\Windows\System\uaMRNsJ.exe
  2⤵
  PID:5428
- C:\Windows\System\frkDpjS.exe
  C:\Windows\System\frkDpjS.exe
  2⤵
  PID:5596
- C:\Windows\System\KTobrsW.exe
  C:\Windows\System\KTobrsW.exe
  2⤵
  PID:5624
- C:\Windows\System\QlOgmas.exe
  C:\Windows\System\QlOgmas.exe
  2⤵
  PID:5748
- C:\Windows\System\SKVTwhj.exe
  C:\Windows\System\SKVTwhj.exe
  2⤵
  PID:5696
- C:\Windows\System\jCzgyRC.exe
  C:\Windows\System\jCzgyRC.exe
  2⤵
  PID:5808
- C:\Windows\System\faERLFD.exe
  C:\Windows\System\faERLFD.exe
  2⤵
  PID:3292
- C:\Windows\System\PHgWxBm.exe
  C:\Windows\System\PHgWxBm.exe
  2⤵
  PID:5912
- C:\Windows\System\okXsBYt.exe
  C:\Windows\System\okXsBYt.exe
  2⤵
  PID:5932
- C:\Windows\System\fdDnNfn.exe
  C:\Windows\System\fdDnNfn.exe
  2⤵
  PID:6016
- C:\Windows\System\uyiKKPH.exe
  C:\Windows\System\uyiKKPH.exe
  2⤵
  PID:5972
- C:\Windows\System\EbenyJt.exe
  C:\Windows\System\EbenyJt.exe
  2⤵
  PID:5988
- C:\Windows\System\CSRqvDs.exe
  C:\Windows\System\CSRqvDs.exe
  2⤵
  PID:6116
- C:\Windows\System\vlxipUZ.exe
  C:\Windows\System\vlxipUZ.exe
  2⤵
  PID:1684
- C:\Windows\System\HyLimxv.exe
  C:\Windows\System\HyLimxv.exe
  2⤵
  PID:5304
- C:\Windows\System\OZywLSt.exe
  C:\Windows\System\OZywLSt.exe
  2⤵
  PID:5740
- C:\Windows\System\WRMOHof.exe
  C:\Windows\System\WRMOHof.exe
  2⤵
  PID:6048
- C:\Windows\System\mpqKpuo.exe
  C:\Windows\System\mpqKpuo.exe
  2⤵
  PID:5856
- C:\Windows\System\jXOzZcB.exe
  C:\Windows\System\jXOzZcB.exe
  2⤵
  PID:6092
- C:\Windows\System\ASyhBAi.exe
  C:\Windows\System\ASyhBAi.exe
  2⤵
  PID:6052
- C:\Windows\System\dYsRNyd.exe
  C:\Windows\System\dYsRNyd.exe
  2⤵
  PID:5196
- C:\Windows\System\eHVALIr.exe
  C:\Windows\System\eHVALIr.exe
  2⤵
  PID:5640
- C:\Windows\System\zbXwZGY.exe
  C:\Windows\System\zbXwZGY.exe
  2⤵
  PID:5800
- C:\Windows\System\mdGTTUa.exe
  C:\Windows\System\mdGTTUa.exe
  2⤵
  PID:5456
- C:\Windows\System\CEwWLxP.exe
  C:\Windows\System\CEwWLxP.exe
  2⤵
  PID:5140
- C:\Windows\System\AMdjsiN.exe
  C:\Windows\System\AMdjsiN.exe
  2⤵
  PID:6172
- C:\Windows\System\aDAfiAO.exe
  C:\Windows\System\aDAfiAO.exe
  2⤵
  PID:6192
- C:\Windows\System\mixbpfD.exe
  C:\Windows\System\mixbpfD.exe
  2⤵
  PID:6220
- C:\Windows\System\fvWfYAa.exe
  C:\Windows\System\fvWfYAa.exe
  2⤵
  PID:6236
- C:\Windows\System\VVcfCGc.exe
  C:\Windows\System\VVcfCGc.exe
  2⤵
  PID:6256
- C:\Windows\System\QRESVaw.exe
  C:\Windows\System\QRESVaw.exe
  2⤵
  PID:6280
- C:\Windows\System\ZeTOWRt.exe
  C:\Windows\System\ZeTOWRt.exe
  2⤵
  PID:6304
- C:\Windows\System\TWYeafr.exe
  C:\Windows\System\TWYeafr.exe
  2⤵
  PID:6328
- C:\Windows\System\ZZMoaNB.exe
  C:\Windows\System\ZZMoaNB.exe
  2⤵
  PID:6356
- C:\Windows\System\LBxcbRP.exe
  C:\Windows\System\LBxcbRP.exe
  2⤵
  PID:6424
- C:\Windows\System\AQzrRWl.exe
  C:\Windows\System\AQzrRWl.exe
  2⤵
  PID:6460
- C:\Windows\System\yKdkJBk.exe
  C:\Windows\System\yKdkJBk.exe
  2⤵
  PID:6488
- C:\Windows\System\NYNvHYz.exe
  C:\Windows\System\NYNvHYz.exe
  2⤵
  PID:6512
- C:\Windows\System\BJemRHa.exe
  C:\Windows\System\BJemRHa.exe
  2⤵
  PID:6532
- C:\Windows\System\Zzsuwct.exe
  C:\Windows\System\Zzsuwct.exe
  2⤵
  PID:6556
- C:\Windows\System\iFLsDFA.exe
  C:\Windows\System\iFLsDFA.exe
  2⤵
  PID:6604
- C:\Windows\System\DwviAAn.exe
  C:\Windows\System\DwviAAn.exe
  2⤵
  PID:6632
- C:\Windows\System\PrGBwBj.exe
  C:\Windows\System\PrGBwBj.exe
  2⤵
  PID:6660
- C:\Windows\System\HdsufBa.exe
  C:\Windows\System\HdsufBa.exe
  2⤵
  PID:6712
- C:\Windows\System\qhYzcNT.exe
  C:\Windows\System\qhYzcNT.exe
  2⤵
  PID:6728
- C:\Windows\System\ZSlNmpB.exe
  C:\Windows\System\ZSlNmpB.exe
  2⤵
  PID:6756
- C:\Windows\System\tZWaFCi.exe
  C:\Windows\System\tZWaFCi.exe
  2⤵
  PID:6784
- C:\Windows\System\zplBNzV.exe
  C:\Windows\System\zplBNzV.exe
  2⤵
  PID:6808
- C:\Windows\System\uYcINON.exe
  C:\Windows\System\uYcINON.exe
  2⤵
  PID:6828
- C:\Windows\System\ruWVjBL.exe
  C:\Windows\System\ruWVjBL.exe
  2⤵
  PID:6864
- C:\Windows\System\NzimIXW.exe
  C:\Windows\System\NzimIXW.exe
  2⤵
  PID:6884
- C:\Windows\System\SWyqVuf.exe
  C:\Windows\System\SWyqVuf.exe
  2⤵
  PID:6920
- C:\Windows\System\QbKqAjb.exe
  C:\Windows\System\QbKqAjb.exe
  2⤵
  PID:6948
- C:\Windows\System\lsNynXv.exe
  C:\Windows\System\lsNynXv.exe
  2⤵
  PID:6972
- C:\Windows\System\xeyzlUY.exe
  C:\Windows\System\xeyzlUY.exe
  2⤵
  PID:7000
- C:\Windows\System\xSyfDFe.exe
  C:\Windows\System\xSyfDFe.exe
  2⤵
  PID:7020
- C:\Windows\System\EHcmwoX.exe
  C:\Windows\System\EHcmwoX.exe
  2⤵
  PID:7048
- C:\Windows\System\HIkFkRt.exe
  C:\Windows\System\HIkFkRt.exe
  2⤵
  PID:7104
- C:\Windows\System\COPFLOV.exe
  C:\Windows\System\COPFLOV.exe
  2⤵
  PID:7128
- C:\Windows\System\LFBhiNm.exe
  C:\Windows\System\LFBhiNm.exe
  2⤵
  PID:7148
- C:\Windows\System\kWtAcXp.exe
  C:\Windows\System\kWtAcXp.exe
  2⤵
  PID:1468
- C:\Windows\System\JRkVvbF.exe
  C:\Windows\System\JRkVvbF.exe
  2⤵
  PID:3532
- C:\Windows\System\cTWkggp.exe
  C:\Windows\System\cTWkggp.exe
  2⤵
  PID:6212
- C:\Windows\System\YgTuEeB.exe
  C:\Windows\System\YgTuEeB.exe
  2⤵
  PID:6288
- C:\Windows\System\klZdCGh.exe
  C:\Windows\System\klZdCGh.exe
  2⤵
  PID:6320
- C:\Windows\System\gYmnQvz.exe
  C:\Windows\System\gYmnQvz.exe
  2⤵
  PID:6352
- C:\Windows\System\FpQMRiD.exe
  C:\Windows\System\FpQMRiD.exe
  2⤵
  PID:6480
- C:\Windows\System\mtvLrmn.exe
  C:\Windows\System\mtvLrmn.exe
  2⤵
  PID:6500
- C:\Windows\System\gSRdtQg.exe
  C:\Windows\System\gSRdtQg.exe
  2⤵
  PID:6528
- C:\Windows\System\WXTSZbG.exe
  C:\Windows\System\WXTSZbG.exe
  2⤵
  PID:6720
- C:\Windows\System\mitiyJu.exe
  C:\Windows\System\mitiyJu.exe
  2⤵
  PID:6736
- C:\Windows\System\bppzsnL.exe
  C:\Windows\System\bppzsnL.exe
  2⤵
  PID:6792
- C:\Windows\System\tGFsPri.exe
  C:\Windows\System\tGFsPri.exe
  2⤵
  PID:6852
- C:\Windows\System\gUcNNvt.exe
  C:\Windows\System\gUcNNvt.exe
  2⤵
  PID:6876
- C:\Windows\System\zdnibrp.exe
  C:\Windows\System\zdnibrp.exe
  2⤵
  PID:6896
- C:\Windows\System\PCvPnGI.exe
  C:\Windows\System\PCvPnGI.exe
  2⤵
  PID:7096
- C:\Windows\System\SxQxQPX.exe
  C:\Windows\System\SxQxQPX.exe
  2⤵
  PID:4324
- C:\Windows\System\SLdYuNh.exe
  C:\Windows\System\SLdYuNh.exe
  2⤵
  PID:5848
- C:\Windows\System\CNtxKsk.exe
  C:\Windows\System\CNtxKsk.exe
  2⤵
  PID:5832
- C:\Windows\System\hajigoa.exe
  C:\Windows\System\hajigoa.exe
  2⤵
  PID:6476
- C:\Windows\System\bMSCgoB.exe
  C:\Windows\System\bMSCgoB.exe
  2⤵
  PID:6688
- C:\Windows\System\jeuGpQK.exe
  C:\Windows\System\jeuGpQK.exe
  2⤵
  PID:6824
- C:\Windows\System\eabqrVf.exe
  C:\Windows\System\eabqrVf.exe
  2⤵
  PID:6960
- C:\Windows\System\tszzaZe.exe
  C:\Windows\System\tszzaZe.exe
  2⤵
  PID:6988
- C:\Windows\System\fdBgHFb.exe
  C:\Windows\System\fdBgHFb.exe
  2⤵
  PID:6368
- C:\Windows\System\VsoeBQc.exe
  C:\Windows\System\VsoeBQc.exe
  2⤵
  PID:6184
- C:\Windows\System\cxDzuKP.exe
  C:\Windows\System\cxDzuKP.exe
  2⤵
  PID:6600
- C:\Windows\System\CRZCsvh.exe
  C:\Windows\System\CRZCsvh.exe
  2⤵
  PID:6772
- C:\Windows\System\EDtDDDT.exe
  C:\Windows\System\EDtDDDT.exe
  2⤵
  PID:6944
- C:\Windows\System\UmXErLF.exe
  C:\Windows\System\UmXErLF.exe
  2⤵
  PID:7164
- C:\Windows\System\ttFTKuJ.exe
  C:\Windows\System\ttFTKuJ.exe
  2⤵
  PID:7044
- C:\Windows\System\SYDCrSc.exe
  C:\Windows\System\SYDCrSc.exe
  2⤵
  PID:7196
- C:\Windows\System\ktDwSMT.exe
  C:\Windows\System\ktDwSMT.exe
  2⤵
  PID:7220
- C:\Windows\System\KziMmwN.exe
  C:\Windows\System\KziMmwN.exe
  2⤵
  PID:7240
- C:\Windows\System\wMJSvYQ.exe
  C:\Windows\System\wMJSvYQ.exe
  2⤵
  PID:7268
- C:\Windows\System\VKznJJu.exe
  C:\Windows\System\VKznJJu.exe
  2⤵
  PID:7292
- C:\Windows\System\jmOfKzE.exe
  C:\Windows\System\jmOfKzE.exe
  2⤵
  PID:7312
- C:\Windows\System\xHUeAYD.exe
  C:\Windows\System\xHUeAYD.exe
  2⤵
  PID:7332
- C:\Windows\System\wnAKfPE.exe
  C:\Windows\System\wnAKfPE.exe
  2⤵
  PID:7352
- C:\Windows\System\erqNcOA.exe
  C:\Windows\System\erqNcOA.exe
  2⤵
  PID:7372
- C:\Windows\System\Rimytxl.exe
  C:\Windows\System\Rimytxl.exe
  2⤵
  PID:7392
- C:\Windows\System\MjGzrhj.exe
  C:\Windows\System\MjGzrhj.exe
  2⤵
  PID:7408
- C:\Windows\System\DaYIPAe.exe
  C:\Windows\System\DaYIPAe.exe
  2⤵
  PID:7432
- C:\Windows\System\krvJwJB.exe
  C:\Windows\System\krvJwJB.exe
  2⤵
  PID:7504
- C:\Windows\System\THxYWTa.exe
  C:\Windows\System\THxYWTa.exe
  2⤵
  PID:7520
- C:\Windows\System\QPCsmYC.exe
  C:\Windows\System\QPCsmYC.exe
  2⤵
  PID:7580
- C:\Windows\System\SUdQSUF.exe
  C:\Windows\System\SUdQSUF.exe
  2⤵
  PID:7600
- C:\Windows\System\ZiiqXYP.exe
  C:\Windows\System\ZiiqXYP.exe
  2⤵
  PID:7620
- C:\Windows\System\CnpIpgp.exe
  C:\Windows\System\CnpIpgp.exe
  2⤵
  PID:7648
- C:\Windows\System\aVwLFLO.exe
  C:\Windows\System\aVwLFLO.exe
  2⤵
  PID:7664
- C:\Windows\System\RKYVOlf.exe
  C:\Windows\System\RKYVOlf.exe
  2⤵
  PID:7684
- C:\Windows\System\LRCUEmi.exe
  C:\Windows\System\LRCUEmi.exe
  2⤵
  PID:7704
- C:\Windows\System\SALNNkg.exe
  C:\Windows\System\SALNNkg.exe
  2⤵
  PID:7732
- C:\Windows\System\mwLqWxj.exe
  C:\Windows\System\mwLqWxj.exe
  2⤵
  PID:7748
- C:\Windows\System\FKrREdQ.exe
  C:\Windows\System\FKrREdQ.exe
  2⤵
  PID:7776
- C:\Windows\System\PzOkIDL.exe
  C:\Windows\System\PzOkIDL.exe
  2⤵
  PID:7808
- C:\Windows\System\rATRkvm.exe
  C:\Windows\System\rATRkvm.exe
  2⤵
  PID:7832
- C:\Windows\System\XjarOLz.exe
  C:\Windows\System\XjarOLz.exe
  2⤵
  PID:7852
- C:\Windows\System\dwPsmyA.exe
  C:\Windows\System\dwPsmyA.exe
  2⤵
  PID:7868
- C:\Windows\System\IDrlgiI.exe
  C:\Windows\System\IDrlgiI.exe
  2⤵
  PID:7884
- C:\Windows\System\OhMewGv.exe
  C:\Windows\System\OhMewGv.exe
  2⤵
  PID:7952
- C:\Windows\System\nhINFWJ.exe
  C:\Windows\System\nhINFWJ.exe
  2⤵
  PID:7976
- C:\Windows\System\tbGAHwv.exe
  C:\Windows\System\tbGAHwv.exe
  2⤵
  PID:7996
- C:\Windows\System\hBThjSt.exe
  C:\Windows\System\hBThjSt.exe
  2⤵
  PID:8060
- C:\Windows\System\QiErvWB.exe
  C:\Windows\System\QiErvWB.exe
  2⤵
  PID:8088
- C:\Windows\System\UXeapKW.exe
  C:\Windows\System\UXeapKW.exe
  2⤵
  PID:8104
- C:\Windows\System\QFSzfaJ.exe
  C:\Windows\System\QFSzfaJ.exe
  2⤵
  PID:8124
- C:\Windows\System\CgjAtei.exe
  C:\Windows\System\CgjAtei.exe
  2⤵
  PID:8140
- C:\Windows\System\iCYpZEY.exe
  C:\Windows\System\iCYpZEY.exe
  2⤵
  PID:8164
- C:\Windows\System\qfXqhkf.exe
  C:\Windows\System\qfXqhkf.exe
  2⤵
  PID:8188
- C:\Windows\System\nLDqvel.exe
  C:\Windows\System\nLDqvel.exe
  2⤵
  PID:7188
- C:\Windows\System\FeNNnmK.exe
  C:\Windows\System\FeNNnmK.exe
  2⤵
  PID:7232
- C:\Windows\System\tCSHktm.exe
  C:\Windows\System\tCSHktm.exe
  2⤵
  PID:6400
- C:\Windows\System\lAWuVTM.exe
  C:\Windows\System\lAWuVTM.exe
  2⤵
  PID:7328
- C:\Windows\System\nVvenxc.exe
  C:\Windows\System\nVvenxc.exe
  2⤵
  PID:7616
- C:\Windows\System\ZPetVzF.exe
  C:\Windows\System\ZPetVzF.exe
  2⤵
  PID:7720
- C:\Windows\System\SLdHrSP.exe
  C:\Windows\System\SLdHrSP.exe
  2⤵
  PID:7636
- C:\Windows\System\FVmXEjE.exe
  C:\Windows\System\FVmXEjE.exe
  2⤵
  PID:7740
- C:\Windows\System\hMkbRNV.exe
  C:\Windows\System\hMkbRNV.exe
  2⤵
  PID:7644
- C:\Windows\System\GMppvnD.exe
  C:\Windows\System\GMppvnD.exe
  2⤵
  PID:7696
- C:\Windows\System\RtXBOYI.exe
  C:\Windows\System\RtXBOYI.exe
  2⤵
  PID:7768
- C:\Windows\System\ICQfYbA.exe
  C:\Windows\System\ICQfYbA.exe
  2⤵
  PID:7860
- C:\Windows\System\aBOnZTd.exe
  C:\Windows\System\aBOnZTd.exe
  2⤵
  PID:7972
- C:\Windows\System\azjVmIB.exe
  C:\Windows\System\azjVmIB.exe
  2⤵
  PID:8076
- C:\Windows\System\GcbNcsm.exe
  C:\Windows\System\GcbNcsm.exe
  2⤵
  PID:7940
- C:\Windows\System\pIMRXDF.exe
  C:\Windows\System\pIMRXDF.exe
  2⤵
  PID:7984
- C:\Windows\System\vGTRBku.exe
  C:\Windows\System\vGTRBku.exe
  2⤵
  PID:7216
- C:\Windows\System\SgJEeup.exe
  C:\Windows\System\SgJEeup.exe
  2⤵
  PID:8180
- C:\Windows\System\AmTMNOH.exe
  C:\Windows\System\AmTMNOH.exe
  2⤵
  PID:8096
- C:\Windows\System\KhLylfi.exe
  C:\Windows\System\KhLylfi.exe
  2⤵
  PID:8100
- C:\Windows\System\fpJdKpJ.exe
  C:\Windows\System\fpJdKpJ.exe
  2⤵
  PID:7864
- C:\Windows\System\BBfbdDG.exe
  C:\Windows\System\BBfbdDG.exe
  2⤵
  PID:8044
- C:\Windows\System\CoLLIlT.exe
  C:\Windows\System\CoLLIlT.exe
  2⤵
  PID:8200
- C:\Windows\System\kqmkKkR.exe
  C:\Windows\System\kqmkKkR.exe
  2⤵
  PID:8420
- C:\Windows\System\aQNBXfN.exe
  C:\Windows\System\aQNBXfN.exe
  2⤵
  PID:8448
- C:\Windows\System\dBWQoBx.exe
  C:\Windows\System\dBWQoBx.exe
  2⤵
  PID:8468
- C:\Windows\System\fuvudqe.exe
  C:\Windows\System\fuvudqe.exe
  2⤵
  PID:8488
- C:\Windows\System\GooSOIG.exe
  C:\Windows\System\GooSOIG.exe
  2⤵
  PID:8512
- C:\Windows\System\BhMhcyf.exe
  C:\Windows\System\BhMhcyf.exe
  2⤵
  PID:8540
- C:\Windows\System\gKyhVmQ.exe
  C:\Windows\System\gKyhVmQ.exe
  2⤵
  PID:8564
- C:\Windows\System\UsqcgvF.exe
  C:\Windows\System\UsqcgvF.exe
  2⤵
  PID:8584
- C:\Windows\System\tcpzAfe.exe
  C:\Windows\System\tcpzAfe.exe
  2⤵
  PID:8604
- C:\Windows\System\DJzVowb.exe
  C:\Windows\System\DJzVowb.exe
  2⤵
  PID:8640
- C:\Windows\System\dPfbJWj.exe
  C:\Windows\System\dPfbJWj.exe
  2⤵
  PID:8664
- C:\Windows\System\EHGxFTA.exe
  C:\Windows\System\EHGxFTA.exe
  2⤵
  PID:8684
- C:\Windows\System\mrHVkVD.exe
  C:\Windows\System\mrHVkVD.exe
  2⤵
  PID:8712
- C:\Windows\System\KSLOHWP.exe
  C:\Windows\System\KSLOHWP.exe
  2⤵
  PID:8728
- C:\Windows\System\ufyGtQz.exe
  C:\Windows\System\ufyGtQz.exe
  2⤵
  PID:8760
- C:\Windows\System\sGQmwCW.exe
  C:\Windows\System\sGQmwCW.exe
  2⤵
  PID:8780
- C:\Windows\System\NTolCQg.exe
  C:\Windows\System\NTolCQg.exe
  2⤵
  PID:8800
- C:\Windows\System\wZcYEtX.exe
  C:\Windows\System\wZcYEtX.exe
  2⤵
  PID:8820
- C:\Windows\System\HwkSKTo.exe
  C:\Windows\System\HwkSKTo.exe
  2⤵
  PID:8840
- C:\Windows\System\fgxKMdc.exe
  C:\Windows\System\fgxKMdc.exe
  2⤵
  PID:8868
- C:\Windows\System\BrXDOaO.exe
  C:\Windows\System\BrXDOaO.exe
  2⤵
  PID:8888
- C:\Windows\System\ppHzfof.exe
  C:\Windows\System\ppHzfof.exe
  2⤵
  PID:8904
- C:\Windows\System\WSCjofW.exe
  C:\Windows\System\WSCjofW.exe
  2⤵
  PID:8932
- C:\Windows\System\nlAqQiT.exe
  C:\Windows\System\nlAqQiT.exe
  2⤵
  PID:9000
- C:\Windows\System\DUGHTSf.exe
  C:\Windows\System\DUGHTSf.exe
  2⤵
  PID:9016
- C:\Windows\System\IpGVZWh.exe
  C:\Windows\System\IpGVZWh.exe
  2⤵
  PID:9036
- C:\Windows\System\laPYVEG.exe
  C:\Windows\System\laPYVEG.exe
  2⤵
  PID:9084
- C:\Windows\System\FewloRK.exe
  C:\Windows\System\FewloRK.exe
  2⤵
  PID:9104
- C:\Windows\System\zqDdKBM.exe
  C:\Windows\System\zqDdKBM.exe
  2⤵
  PID:9128
- C:\Windows\System\eBZrVkZ.exe
  C:\Windows\System\eBZrVkZ.exe
  2⤵
  PID:9144
- C:\Windows\System\TdbYJeE.exe
  C:\Windows\System\TdbYJeE.exe
  2⤵
  PID:9160
- C:\Windows\System\IhWqLcf.exe
  C:\Windows\System\IhWqLcf.exe
  2⤵
  PID:9180
- C:\Windows\System\zcaxJPA.exe
  C:\Windows\System\zcaxJPA.exe
  2⤵
  PID:9200
- C:\Windows\System\VcUUBLG.exe
  C:\Windows\System\VcUUBLG.exe
  2⤵
  PID:7628
- C:\Windows\System\HnsxuIA.exe
  C:\Windows\System\HnsxuIA.exe
  2⤵
  PID:7876
- C:\Windows\System\nKmMeHz.exe
  C:\Windows\System\nKmMeHz.exe
  2⤵
  PID:8148
- C:\Windows\System\NwcVPbt.exe
  C:\Windows\System\NwcVPbt.exe
  2⤵
  PID:8184
- C:\Windows\System\tRLatMU.exe
  C:\Windows\System\tRLatMU.exe
  2⤵
  PID:7472
- C:\Windows\System\yMGDDZF.exe
  C:\Windows\System\yMGDDZF.exe
  2⤵
  PID:8232
- C:\Windows\System\lRovfHf.exe
  C:\Windows\System\lRovfHf.exe
  2⤵
  PID:8304
- C:\Windows\System\gVdAVBL.exe
  C:\Windows\System\gVdAVBL.exe
  2⤵
  PID:8220
- C:\Windows\System\nhVymIs.exe
  C:\Windows\System\nhVymIs.exe
  2⤵
  PID:8460
- C:\Windows\System\QGNyyms.exe
  C:\Windows\System\QGNyyms.exe
  2⤵
  PID:8456
- C:\Windows\System\pvSjmoe.exe
  C:\Windows\System\pvSjmoe.exe
  2⤵
  PID:8548
- C:\Windows\System\emISuNE.exe
  C:\Windows\System\emISuNE.exe
  2⤵
  PID:8528
- C:\Windows\System\gNXFvEW.exe
  C:\Windows\System\gNXFvEW.exe
  2⤵
  PID:8532
- C:\Windows\System\aJKYdJd.exe
  C:\Windows\System\aJKYdJd.exe
  2⤵
  PID:8620
- C:\Windows\System\LxHtyNI.exe
  C:\Windows\System\LxHtyNI.exe
  2⤵
  PID:8692
- C:\Windows\System\OFyHtvq.exe
  C:\Windows\System\OFyHtvq.exe
  2⤵
  PID:8756
- C:\Windows\System\XHsabNj.exe
  C:\Windows\System\XHsabNj.exe
  2⤵
  PID:8816
- C:\Windows\System\LXhKNJG.exe
  C:\Windows\System\LXhKNJG.exe
  2⤵
  PID:8648
- C:\Windows\System\ORZqFcC.exe
  C:\Windows\System\ORZqFcC.exe
  2⤵
  PID:8876
- C:\Windows\System\FAHXPMw.exe
  C:\Windows\System\FAHXPMw.exe
  2⤵
  PID:8792
- C:\Windows\System\OjAULCp.exe
  C:\Windows\System\OjAULCp.exe
  2⤵
  PID:8948
- C:\Windows\System\mjXRQqB.exe
  C:\Windows\System\mjXRQqB.exe
  2⤵
  PID:9008
- C:\Windows\System\BTwMKQr.exe
  C:\Windows\System\BTwMKQr.exe
  2⤵
  PID:8984
- C:\Windows\System\HdEHreX.exe
  C:\Windows\System\HdEHreX.exe
  2⤵
  PID:9024
- C:\Windows\System\jhqiJen.exe
  C:\Windows\System\jhqiJen.exe
  2⤵
  PID:9120
- C:\Windows\System\wmasBrt.exe
  C:\Windows\System\wmasBrt.exe
  2⤵
  PID:7912
- C:\Windows\System\rEbhQwk.exe
  C:\Windows\System\rEbhQwk.exe
  2⤵
  PID:9092
- C:\Windows\System\qaSfBgW.exe
  C:\Windows\System\qaSfBgW.exe
  2⤵
  PID:2320
- C:\Windows\System\WDoqpRH.exe
  C:\Windows\System\WDoqpRH.exe
  2⤵
  PID:4376
- C:\Windows\System\upKYjyB.exe
  C:\Windows\System\upKYjyB.exe
  2⤵
  PID:9168
- C:\Windows\System\YfrShbP.exe
  C:\Windows\System\YfrShbP.exe
  2⤵
  PID:9208
- C:\Windows\System\ZseDnpo.exe
  C:\Windows\System\ZseDnpo.exe
  2⤵
  PID:8440
- C:\Windows\System\qjqflJb.exe
  C:\Windows\System\qjqflJb.exe
  2⤵
  PID:9220
- C:\Windows\System\ydrSvJK.exe
  C:\Windows\System\ydrSvJK.exe
  2⤵
  PID:9244
- C:\Windows\System\ZsXhhGz.exe
  C:\Windows\System\ZsXhhGz.exe
  2⤵
  PID:9264
- C:\Windows\System\wmOyGDG.exe
  C:\Windows\System\wmOyGDG.exe
  2⤵
  PID:9284
- C:\Windows\System\yUEzDAv.exe
  C:\Windows\System\yUEzDAv.exe
  2⤵
  PID:9304
- C:\Windows\System\uCRVRKj.exe
  C:\Windows\System\uCRVRKj.exe
  2⤵
  PID:9324
- C:\Windows\System\BkPZZLK.exe
  C:\Windows\System\BkPZZLK.exe
  2⤵
  PID:9344
- C:\Windows\System\hSkCPyL.exe
  C:\Windows\System\hSkCPyL.exe
  2⤵
  PID:9368
- C:\Windows\System\UkGpOvU.exe
  C:\Windows\System\UkGpOvU.exe
  2⤵
  PID:9388
- C:\Windows\System\keaQCGl.exe
  C:\Windows\System\keaQCGl.exe
  2⤵
  PID:9404
- C:\Windows\System\tnmlOko.exe
  C:\Windows\System\tnmlOko.exe
  2⤵
  PID:9428
- C:\Windows\System\WiPBVCS.exe
  C:\Windows\System\WiPBVCS.exe
  2⤵
  PID:9444
- C:\Windows\System\ZDUXmIr.exe
  C:\Windows\System\ZDUXmIr.exe
  2⤵
  PID:9468
- C:\Windows\System\eXIEuxy.exe
  C:\Windows\System\eXIEuxy.exe
  2⤵
  PID:9492
- C:\Windows\System\OMQwwBj.exe
  C:\Windows\System\OMQwwBj.exe
  2⤵
  PID:9512
- C:\Windows\System\rGWxtQq.exe
  C:\Windows\System\rGWxtQq.exe
  2⤵
  PID:9532
- C:\Windows\System\ZumBLQY.exe
  C:\Windows\System\ZumBLQY.exe
  2⤵
  PID:9548
- C:\Windows\System\RFVpUfk.exe
  C:\Windows\System\RFVpUfk.exe
  2⤵
  PID:9564
- C:\Windows\System\AqRmyjR.exe
  C:\Windows\System\AqRmyjR.exe
  2⤵
  PID:9592
- C:\Windows\System\LmubHQr.exe
  C:\Windows\System\LmubHQr.exe
  2⤵
  PID:9608
- C:\Windows\System\BPIstvX.exe
  C:\Windows\System\BPIstvX.exe
  2⤵
  PID:9632
- C:\Windows\System\XjmIhSv.exe
  C:\Windows\System\XjmIhSv.exe
  2⤵
  PID:9652
- C:\Windows\System\cpXCuFi.exe
  C:\Windows\System\cpXCuFi.exe
  2⤵
  PID:9676
- C:\Windows\System\LKSOnzr.exe
  C:\Windows\System\LKSOnzr.exe
  2⤵
  PID:9828
- C:\Windows\System\BdGjPgO.exe
  C:\Windows\System\BdGjPgO.exe
  2⤵
  PID:9848
- C:\Windows\System\ozaERdR.exe
  C:\Windows\System\ozaERdR.exe
  2⤵
  PID:9872
- C:\Windows\System\CsRjdJE.exe
  C:\Windows\System\CsRjdJE.exe
  2⤵
  PID:9896
- C:\Windows\System\qujwSlH.exe
  C:\Windows\System\qujwSlH.exe
  2⤵
  PID:9916
- C:\Windows\System\nImpreh.exe
  C:\Windows\System\nImpreh.exe
  2⤵
  PID:9948
- C:\Windows\System\HgDssIV.exe
  C:\Windows\System\HgDssIV.exe
  2⤵
  PID:9976
- C:\Windows\System\zTYUhmO.exe
  C:\Windows\System\zTYUhmO.exe
  2⤵
  PID:10000
- C:\Windows\System\MxFLcYr.exe
  C:\Windows\System\MxFLcYr.exe
  2⤵
  PID:10020
- C:\Windows\System\JZSSPhT.exe
  C:\Windows\System\JZSSPhT.exe
  2⤵
  PID:10036
- C:\Windows\System\SbKDBxW.exe
  C:\Windows\System\SbKDBxW.exe
  2⤵
  PID:10056
- C:\Windows\System\gigqSbG.exe
  C:\Windows\System\gigqSbG.exe
  2⤵
  PID:9464
- C:\Windows\System\MOetKjR.exe
  C:\Windows\System\MOetKjR.exe
  2⤵
  PID:9508
- C:\Windows\System\zXzgqOr.exe
  C:\Windows\System\zXzgqOr.exe
  2⤵
  PID:9616
- C:\Windows\System\RvFPyKi.exe
  C:\Windows\System\RvFPyKi.exe
  2⤵
  PID:9296
- C:\Windows\System\IuahLtG.exe
  C:\Windows\System\IuahLtG.exe
  2⤵
  PID:9340
- C:\Windows\System\LwRBDSf.exe
  C:\Windows\System\LwRBDSf.exe
  2⤵
  PID:9484
- C:\Windows\System\CQAiWEB.exe
  C:\Windows\System\CQAiWEB.exe
  2⤵
  PID:9776
- C:\Windows\System\bvOTAqK.exe
  C:\Windows\System\bvOTAqK.exe
  2⤵
  PID:9684
- C:\Windows\System\XnFQuSz.exe
  C:\Windows\System\XnFQuSz.exe
  2⤵
  PID:10028
- C:\Windows\System\azXgPCd.exe
  C:\Windows\System\azXgPCd.exe
  2⤵
  PID:9840
- C:\Windows\System\BwZrxkA.exe
  C:\Windows\System\BwZrxkA.exe
  2⤵
  PID:9880
- C:\Windows\System\BnmBTRj.exe
  C:\Windows\System\BnmBTRj.exe
  2⤵
  PID:9960
- C:\Windows\System\RSbHjcs.exe
  C:\Windows\System\RSbHjcs.exe
  2⤵
  PID:10048
- C:\Windows\System\FasuJEs.exe
  C:\Windows\System\FasuJEs.exe
  2⤵
  PID:10132
- C:\Windows\System\vasVKnW.exe
  C:\Windows\System\vasVKnW.exe
  2⤵
  PID:8408
- C:\Windows\System\jNiLCqY.exe
  C:\Windows\System\jNiLCqY.exe
  2⤵
  PID:8928
- C:\Windows\System\WRbMIye.exe
  C:\Windows\System\WRbMIye.exe
  2⤵
  PID:9640
- C:\Windows\System\AvlgeDq.exe
  C:\Windows\System\AvlgeDq.exe
  2⤵
  PID:9312
- C:\Windows\System\HAkNTtR.exe
  C:\Windows\System\HAkNTtR.exe
  2⤵
  PID:10140
- C:\Windows\System\ZcrmLOb.exe
  C:\Windows\System\ZcrmLOb.exe
  2⤵
  PID:9696
- C:\Windows\System\wEoFvEc.exe
  C:\Windows\System\wEoFvEc.exe
  2⤵
  PID:9864
- C:\Windows\System\XRdUCxI.exe
  C:\Windows\System\XRdUCxI.exe
  2⤵
  PID:10184
- C:\Windows\System\iUhMVpu.exe
  C:\Windows\System\iUhMVpu.exe
  2⤵
  PID:7796
- C:\Windows\System\XrXPOMY.exe
  C:\Windows\System\XrXPOMY.exe
  2⤵
  PID:9156
- C:\Windows\System\xdMvwNL.exe
  C:\Windows\System\xdMvwNL.exe
  2⤵
  PID:10192
- C:\Windows\System\YcgNJnM.exe
  C:\Windows\System\YcgNJnM.exe
  2⤵
  PID:10256
- C:\Windows\System\OnCqetB.exe
  C:\Windows\System\OnCqetB.exe
  2⤵
  PID:10280
- C:\Windows\System\StcnGPx.exe
  C:\Windows\System\StcnGPx.exe
  2⤵
  PID:10296
- C:\Windows\System\gEZskVK.exe
  C:\Windows\System\gEZskVK.exe
  2⤵
  PID:10316
- C:\Windows\System\ycMhbzC.exe
  C:\Windows\System\ycMhbzC.exe
  2⤵
  PID:10404
- C:\Windows\System\ZXObnyH.exe
  C:\Windows\System\ZXObnyH.exe
  2⤵
  PID:10428
- C:\Windows\System\XyaCYga.exe
  C:\Windows\System\XyaCYga.exe
  2⤵
  PID:10448
- C:\Windows\System\NyPqlxN.exe
  C:\Windows\System\NyPqlxN.exe
  2⤵
  PID:10468
- C:\Windows\System\ZAUCUnz.exe
  C:\Windows\System\ZAUCUnz.exe
  2⤵
  PID:10496
- C:\Windows\System\MhOkRmm.exe
  C:\Windows\System\MhOkRmm.exe
  2⤵
  PID:10524
- C:\Windows\System\iVYBaQo.exe
  C:\Windows\System\iVYBaQo.exe
  2⤵
  PID:10548
- C:\Windows\System\PqOIFMG.exe
  C:\Windows\System\PqOIFMG.exe
  2⤵
  PID:10564
- C:\Windows\System\zfgdRJB.exe
  C:\Windows\System\zfgdRJB.exe
  2⤵
  PID:10580
- C:\Windows\System\JCcWwAO.exe
  C:\Windows\System\JCcWwAO.exe
  2⤵
  PID:10600
- C:\Windows\System\AbqTcmn.exe
  C:\Windows\System\AbqTcmn.exe
  2⤵
  PID:10620
- C:\Windows\System\UoxSsiv.exe
  C:\Windows\System\UoxSsiv.exe
  2⤵
  PID:10636
- C:\Windows\System\xJXVela.exe
  C:\Windows\System\xJXVela.exe
  2⤵
  PID:10664
- C:\Windows\System\xDzzQSG.exe
  C:\Windows\System\xDzzQSG.exe
  2⤵
  PID:10684
- C:\Windows\System\ZzSzQRK.exe
  C:\Windows\System\ZzSzQRK.exe
  2⤵
  PID:10712
- C:\Windows\System\RwuVDFP.exe
  C:\Windows\System\RwuVDFP.exe
  2⤵
  PID:10732
- C:\Windows\System\ymLgyRQ.exe
  C:\Windows\System\ymLgyRQ.exe
  2⤵
  PID:10748
- C:\Windows\System\FrsjylK.exe
  C:\Windows\System\FrsjylK.exe
  2⤵
  PID:10764
- C:\Windows\System\JkHLgSg.exe
  C:\Windows\System\JkHLgSg.exe
  2⤵
  PID:10780
- C:\Windows\System\LMlzaQI.exe
  C:\Windows\System\LMlzaQI.exe
  2⤵
  PID:10804
- C:\Windows\System\ItMBsEl.exe
  C:\Windows\System\ItMBsEl.exe
  2⤵
  PID:10828
- C:\Windows\System\vzrAfqT.exe
  C:\Windows\System\vzrAfqT.exe
  2⤵
  PID:10848
- C:\Windows\System\nEymOrB.exe
  C:\Windows\System\nEymOrB.exe
  2⤵
  PID:10868
- C:\Windows\System\CjHVOns.exe
  C:\Windows\System\CjHVOns.exe
  2⤵
  PID:10888
- C:\Windows\System\lOcdREa.exe
  C:\Windows\System\lOcdREa.exe
  2⤵
  PID:10912
- C:\Windows\System\ZYVxFdO.exe
  C:\Windows\System\ZYVxFdO.exe
  2⤵
  PID:10936
- C:\Windows\System\rOKGrOk.exe
  C:\Windows\System\rOKGrOk.exe
  2⤵
  PID:10952
- C:\Windows\System\lZRZHCU.exe
  C:\Windows\System\lZRZHCU.exe
  2⤵
  PID:10968
- C:\Windows\System\QlTtzrs.exe
  C:\Windows\System\QlTtzrs.exe
  2⤵
  PID:10988
- C:\Windows\System\GuQDnwk.exe
  C:\Windows\System\GuQDnwk.exe
  2⤵
  PID:11012
- C:\Windows\System\zmzNCnR.exe
  C:\Windows\System\zmzNCnR.exe
  2⤵
  PID:11028
- C:\Windows\System\XzVeSsR.exe
  C:\Windows\System\XzVeSsR.exe
  2⤵
  PID:11048
- C:\Windows\System\KBedNJl.exe
  C:\Windows\System\KBedNJl.exe
  2⤵
  PID:11080
- C:\Windows\System\DnAEdkl.exe
  C:\Windows\System\DnAEdkl.exe
  2⤵
  PID:11100
- C:\Windows\System\hxxZGaQ.exe
  C:\Windows\System\hxxZGaQ.exe
  2⤵
  PID:11120
- C:\Windows\System\ImtBDID.exe
  C:\Windows\System\ImtBDID.exe
  2⤵
  PID:11140
- C:\Windows\System\fPHeuUf.exe
  C:\Windows\System\fPHeuUf.exe
  2⤵
  PID:11164
- C:\Windows\System\ODswBgK.exe
  C:\Windows\System\ODswBgK.exe
  2⤵
  PID:10080
- C:\Windows\System\mXjgREA.exe
  C:\Windows\System\mXjgREA.exe
  2⤵
  PID:10264
- C:\Windows\System\oRGiSfY.exe
  C:\Windows\System\oRGiSfY.exe
  2⤵
  PID:9504
- C:\Windows\System\DWKyFPO.exe
  C:\Windows\System\DWKyFPO.exe
  2⤵
  PID:9380
- C:\Windows\System\ACGgLeI.exe
  C:\Windows\System\ACGgLeI.exe
  2⤵
  PID:9544
- C:\Windows\System\vDtioSk.exe
  C:\Windows\System\vDtioSk.exe
  2⤵
  PID:10348
- C:\Windows\System\McFJCxS.exe
  C:\Windows\System\McFJCxS.exe
  2⤵
  PID:10072
- C:\Windows\System\UVMXhkw.exe
  C:\Windows\System\UVMXhkw.exe
  2⤵
  PID:10540
- C:\Windows\System\oQAhrAG.exe
  C:\Windows\System\oQAhrAG.exe
  2⤵
  PID:10572
- C:\Windows\System\zVauNgL.exe
  C:\Windows\System\zVauNgL.exe
  2⤵
  PID:10376
- C:\Windows\System\cBIzrbY.exe
  C:\Windows\System\cBIzrbY.exe
  2⤵
  PID:10424
- C:\Windows\System\YCLRIgB.exe
  C:\Windows\System\YCLRIgB.exe
  2⤵
  PID:10740
- C:\Windows\System\CJIaefH.exe
  C:\Windows\System\CJIaefH.exe
  2⤵
  PID:10488
- C:\Windows\System\FJtGmAC.exe
  C:\Windows\System\FJtGmAC.exe
  2⤵
  PID:10340
- C:\Windows\System\wlgTImj.exe
  C:\Windows\System\wlgTImj.exe
  2⤵
  PID:10960
- C:\Windows\System\SuHWqot.exe
  C:\Windows\System\SuHWqot.exe
  2⤵
  PID:10632
- C:\Windows\System\RDtgiEd.exe
  C:\Windows\System\RDtgiEd.exe
  2⤵
  PID:11044
- C:\Windows\System\SJLYWlC.exe
  C:\Windows\System\SJLYWlC.exe
  2⤵
  PID:10772
- C:\Windows\System\ECxqPNo.exe
  C:\Windows\System\ECxqPNo.exe
  2⤵
  PID:10460
- C:\Windows\System\uuoAAUd.exe
  C:\Windows\System\uuoAAUd.exe
  2⤵
  PID:10532
- C:\Windows\System\fggrVDu.exe
  C:\Windows\System\fggrVDu.exe
  2⤵
  PID:11008
- C:\Windows\System\zxXBSmu.exe
  C:\Windows\System\zxXBSmu.exe
  2⤵
  PID:10680
- C:\Windows\System\GXsmoYj.exe
  C:\Windows\System\GXsmoYj.exe
  2⤵
  PID:11136
- C:\Windows\System\lRKIqwH.exe
  C:\Windows\System\lRKIqwH.exe
  2⤵
  PID:9356
- C:\Windows\System\uVkVmxW.exe
  C:\Windows\System\uVkVmxW.exe
  2⤵
  PID:9784
- C:\Windows\System\NxxDpqD.exe
  C:\Windows\System\NxxDpqD.exe
  2⤵
  PID:11284
- C:\Windows\System\kktFOfN.exe
  C:\Windows\System\kktFOfN.exe
  2⤵
  PID:11304
- C:\Windows\System\smknJIt.exe
  C:\Windows\System\smknJIt.exe
  2⤵
  PID:11332
- C:\Windows\System\rWtcasA.exe
  C:\Windows\System\rWtcasA.exe
  2⤵
  PID:11352
- C:\Windows\System\hBbxdgm.exe
  C:\Windows\System\hBbxdgm.exe
  2⤵
  PID:11536
- C:\Windows\System\wkuHaVx.exe
  C:\Windows\System\wkuHaVx.exe
  2⤵
  PID:11564
- C:\Windows\System\tVJbSOa.exe
  C:\Windows\System\tVJbSOa.exe
  2⤵
  PID:11584
- C:\Windows\System\zMeklYw.exe
  C:\Windows\System\zMeklYw.exe
  2⤵
  PID:11604
- C:\Windows\System\ZqqbLMn.exe
  C:\Windows\System\ZqqbLMn.exe
  2⤵
  PID:11976
- C:\Windows\System\dDSmrke.exe
  C:\Windows\System\dDSmrke.exe
  2⤵
  PID:11996
- C:\Windows\System\gtiDOAC.exe
  C:\Windows\System\gtiDOAC.exe
  2⤵
  PID:12020
- C:\Windows\System\whWovQl.exe
  C:\Windows\System\whWovQl.exe
  2⤵
  PID:12048
- C:\Windows\System\tqQzWLU.exe
  C:\Windows\System\tqQzWLU.exe
  2⤵
  PID:12072
- C:\Windows\System\LNYVKPe.exe
  C:\Windows\System\LNYVKPe.exe
  2⤵
  PID:12088
- C:\Windows\System\zpXSFrs.exe
  C:\Windows\System\zpXSFrs.exe
  2⤵
  PID:12104
- C:\Windows\System\FdHyZAm.exe
  C:\Windows\System\FdHyZAm.exe
  2⤵
  PID:12120
- C:\Windows\System\ewXLmGk.exe
  C:\Windows\System\ewXLmGk.exe
  2⤵
  PID:12136
- C:\Windows\System\AhCRUoz.exe
  C:\Windows\System\AhCRUoz.exe
  2⤵
  PID:12152
- C:\Windows\System\VpZKOBV.exe
  C:\Windows\System\VpZKOBV.exe
  2⤵
  PID:12168
- C:\Windows\System\bEpymQO.exe
  C:\Windows\System\bEpymQO.exe
  2⤵
  PID:12184
- C:\Windows\System\pxDQTaE.exe
  C:\Windows\System\pxDQTaE.exe
  2⤵
  PID:12204
- C:\Windows\System\VasQKjM.exe
  C:\Windows\System\VasQKjM.exe
  2⤵
  PID:12228
- C:\Windows\System\zvacuSZ.exe
  C:\Windows\System\zvacuSZ.exe
  2⤵
  PID:12248
- C:\Windows\System\xUPvLKf.exe
  C:\Windows\System\xUPvLKf.exe
  2⤵
  PID:12264
- C:\Windows\System\NVZZDbp.exe
  C:\Windows\System\NVZZDbp.exe
  2⤵
  PID:10312
- C:\Windows\System\sPZDpCi.exe
  C:\Windows\System\sPZDpCi.exe
  2⤵
  PID:10720
- C:\Windows\System\TQUzCRR.exe
  C:\Windows\System\TQUzCRR.exe
  2⤵
  PID:11160
- C:\Windows\System\gsHxQEP.exe
  C:\Windows\System\gsHxQEP.exe
  2⤵
  PID:11324
- C:\Windows\System\aDZkUji.exe
  C:\Windows\System\aDZkUji.exe
  2⤵
  PID:10380
- C:\Windows\System\fnVxiHN.exe
  C:\Windows\System\fnVxiHN.exe
  2⤵
  PID:10440
- C:\Windows\System\gdXDgjS.exe
  C:\Windows\System\gdXDgjS.exe
  2⤵
  PID:11396
- C:\Windows\System\IJXACCb.exe
  C:\Windows\System\IJXACCb.exe
  2⤵
  PID:10796
- C:\Windows\System\VUKbSNZ.exe
  C:\Windows\System\VUKbSNZ.exe
  2⤵
  PID:10980
- C:\Windows\System\XqXHBSU.exe
  C:\Windows\System\XqXHBSU.exe
  2⤵
  PID:10248
- C:\Windows\System\wmRawns.exe
  C:\Windows\System\wmRawns.exe
  2⤵
  PID:10788
- C:\Windows\System\gYRTNCW.exe
  C:\Windows\System\gYRTNCW.exe
  2⤵
  PID:1268
- C:\Windows\System\NGaypAu.exe
  C:\Windows\System\NGaypAu.exe
  2⤵
  PID:11132
- C:\Windows\System\iqyFYgm.exe
  C:\Windows\System\iqyFYgm.exe
  2⤵
  PID:11312
- C:\Windows\System\fdMUyIH.exe
  C:\Windows\System\fdMUyIH.exe
  2⤵
  PID:10556
- C:\Windows\System\FFCkSOg.exe
  C:\Windows\System\FFCkSOg.exe
  2⤵
  PID:11788
- C:\Windows\System\mkJylZD.exe
  C:\Windows\System\mkJylZD.exe
  2⤵
  PID:11812
- C:\Windows\System\lXTWUWu.exe
  C:\Windows\System\lXTWUWu.exe
  2⤵
  PID:11672
- C:\Windows\System\HWxeoMB.exe
  C:\Windows\System\HWxeoMB.exe
  2⤵
  PID:11880
- C:\Windows\System\QpHTQit.exe
  C:\Windows\System\QpHTQit.exe
  2⤵
  PID:11520
- C:\Windows\System\UJCdWPd.exe
  C:\Windows\System\UJCdWPd.exe
  2⤵
  PID:11940
- C:\Windows\System\gBfEubD.exe
  C:\Windows\System\gBfEubD.exe
  2⤵
  PID:11760
- C:\Windows\System\NGyDsBx.exe
  C:\Windows\System\NGyDsBx.exe
  2⤵
  PID:11600
- C:\Windows\System\yzRxyMz.exe
  C:\Windows\System\yzRxyMz.exe
  2⤵
  PID:12016
- C:\Windows\System\oHJBPUA.exe
  C:\Windows\System\oHJBPUA.exe
  2⤵
  PID:11844
- C:\Windows\System\kmOHGiX.exe
  C:\Windows\System\kmOHGiX.exe
  2⤵
  PID:12116
- C:\Windows\System\HccfRoW.exe
  C:\Windows\System\HccfRoW.exe
  2⤵
  PID:12216
- C:\Windows\System\HxzXaNN.exe
  C:\Windows\System\HxzXaNN.exe
  2⤵
  PID:12272
- C:\Windows\System\bPVZIRX.exe
  C:\Windows\System\bPVZIRX.exe
  2⤵
  PID:11948
- C:\Windows\System\ddVLYoa.exe
  C:\Windows\System\ddVLYoa.exe
  2⤵
  PID:1404
- C:\Windows\System\apRpSzK.exe
  C:\Windows\System\apRpSzK.exe
  2⤵
  PID:4600
- C:\Windows\System\DYMPjTI.exe
  C:\Windows\System\DYMPjTI.exe
  2⤵
  PID:12148
- C:\Windows\System\OaSkyBL.exe
  C:\Windows\System\OaSkyBL.exe
  2⤵
  PID:12220
- C:\Windows\System\tnPGJRg.exe
  C:\Windows\System\tnPGJRg.exe
  2⤵
  PID:3472
- C:\Windows\System\PBUgYDy.exe
  C:\Windows\System\PBUgYDy.exe
  2⤵
  PID:10920
- C:\Windows\System\vQPDyzM.exe
  C:\Windows\System\vQPDyzM.exe
  2⤵
  PID:11484
- C:\Windows\System\rdEfQfo.exe
  C:\Windows\System\rdEfQfo.exe
  2⤵
  PID:10652
- C:\Windows\System\JxwqJRx.exe
  C:\Windows\System\JxwqJRx.exe
  2⤵
  PID:12292
- C:\Windows\System\RnDAAno.exe
  C:\Windows\System\RnDAAno.exe
  2⤵
  PID:12312
- C:\Windows\System\XtlTMRP.exe
  C:\Windows\System\XtlTMRP.exe
  2⤵
  PID:12332
- C:\Windows\System\KGGnVDX.exe
  C:\Windows\System\KGGnVDX.exe
  2⤵
  PID:12352
- C:\Windows\System\NdOOqFT.exe
  C:\Windows\System\NdOOqFT.exe
  2⤵
  PID:12376
- C:\Windows\System\DvlfOWj.exe
  C:\Windows\System\DvlfOWj.exe
  2⤵
  PID:12400
- C:\Windows\System\HFoeRdn.exe
  C:\Windows\System\HFoeRdn.exe
  2⤵
  PID:12424
- C:\Windows\System\DjtsIbd.exe
  C:\Windows\System\DjtsIbd.exe
  2⤵
  PID:12448
- C:\Windows\System\quNCsEm.exe
  C:\Windows\System\quNCsEm.exe
  2⤵
  PID:12488
- C:\Windows\System\fvdaoiy.exe
  C:\Windows\System\fvdaoiy.exe
  2⤵
  PID:12508
- C:\Windows\System\eufcsnq.exe
  C:\Windows\System\eufcsnq.exe
  2⤵
  PID:12528
- C:\Windows\System\eWkmpeg.exe
  C:\Windows\System\eWkmpeg.exe
  2⤵
  PID:12552
- C:\Windows\System\ENEoctK.exe
  C:\Windows\System\ENEoctK.exe
  2⤵
  PID:12576
- C:\Windows\System\rqCwdze.exe
  C:\Windows\System\rqCwdze.exe
  2⤵
  PID:12600
- C:\Windows\System\ZnbYqVj.exe
  C:\Windows\System\ZnbYqVj.exe
  2⤵
  PID:12616
- C:\Windows\System\KHblOXB.exe
  C:\Windows\System\KHblOXB.exe
  2⤵
  PID:12636
- C:\Windows\System\rSbARdU.exe
  C:\Windows\System\rSbARdU.exe
  2⤵
  PID:12660
- C:\Windows\System\jVixErL.exe
  C:\Windows\System\jVixErL.exe
  2⤵
  PID:12680
- C:\Windows\System\DghUEOh.exe
  C:\Windows\System\DghUEOh.exe
  2⤵
  PID:12708
- C:\Windows\System\akgkVOY.exe
  C:\Windows\System\akgkVOY.exe
  2⤵
  PID:12728
- C:\Windows\System\kZcUcvC.exe
  C:\Windows\System\kZcUcvC.exe
  2⤵
  PID:12748
- C:\Windows\System\xeNLVuK.exe
  C:\Windows\System\xeNLVuK.exe
  2⤵
  PID:12768
- C:\Windows\System\neeyjOb.exe
  C:\Windows\System\neeyjOb.exe
  2⤵
  PID:12788
- C:\Windows\System\lEgJByT.exe
  C:\Windows\System\lEgJByT.exe
  2⤵
  PID:12804
- C:\Windows\System\VRjnblG.exe
  C:\Windows\System\VRjnblG.exe
  2⤵
  PID:12820
- C:\Windows\System\ReAvFDn.exe
  C:\Windows\System\ReAvFDn.exe
  2⤵
  PID:12836
- C:\Windows\System\vUgFGFO.exe
  C:\Windows\System\vUgFGFO.exe
  2⤵
  PID:12852
- C:\Windows\System\vywRWMn.exe
  C:\Windows\System\vywRWMn.exe
  2⤵
  PID:12872
- C:\Windows\System\HlgxPgA.exe
  C:\Windows\System\HlgxPgA.exe
  2⤵
  PID:12904
- C:\Windows\System\aJBPiXI.exe
  C:\Windows\System\aJBPiXI.exe
  2⤵
  PID:12924
- C:\Windows\System\pUulgVG.exe
  C:\Windows\System\pUulgVG.exe
  2⤵
  PID:12948
- C:\Windows\System\HvlpANs.exe
  C:\Windows\System\HvlpANs.exe
  2⤵
  PID:12964
- C:\Windows\System\oNlGdhM.exe
  C:\Windows\System\oNlGdhM.exe
  2⤵
  PID:12984
- C:\Windows\System\HICBCdR.exe
  C:\Windows\System\HICBCdR.exe
  2⤵
  PID:13004
- C:\Windows\System\sWMoEoy.exe
  C:\Windows\System\sWMoEoy.exe
  2⤵
  PID:13020
- C:\Windows\System\irdvWBz.exe
  C:\Windows\System\irdvWBz.exe
  2⤵
  PID:13036
- C:\Windows\System\UOXLSRi.exe
  C:\Windows\System\UOXLSRi.exe
  2⤵
  PID:13056
- C:\Windows\System\jtpODYF.exe
  C:\Windows\System\jtpODYF.exe
  2⤵
  PID:13076
- C:\Windows\System\LOOIAeX.exe
  C:\Windows\System\LOOIAeX.exe
  2⤵
  PID:13104
- C:\Windows\System\aYBqEuD.exe
  C:\Windows\System\aYBqEuD.exe
  2⤵
  PID:13308
- C:\Windows\System\MSDeOVy.exe
  C:\Windows\System\MSDeOVy.exe
  2⤵
  PID:12276
- C:\Windows\System\TbcXzyc.exe
  C:\Windows\System\TbcXzyc.exe
  2⤵
  PID:12036
- C:\Windows\System\sauLbxW.exe
  C:\Windows\System\sauLbxW.exe
  2⤵
  PID:12304
- C:\Windows\System\JcfORZJ.exe
  C:\Windows\System\JcfORZJ.exe
  2⤵
  PID:12392
- C:\Windows\System\OmWVQdT.exe
  C:\Windows\System\OmWVQdT.exe
  2⤵
  PID:10420
- C:\Windows\System\gwukPdL.exe
  C:\Windows\System\gwukPdL.exe
  2⤵
  PID:11580
- C:\Windows\System\zMAHdpj.exe
  C:\Windows\System\zMAHdpj.exe
  2⤵
  PID:12560
- C:\Windows\System\OlMyATC.exe
  C:\Windows\System\OlMyATC.exe
  2⤵
  PID:3768
- C:\Windows\System\yuGUwKZ.exe
  C:\Windows\System\yuGUwKZ.exe
  2⤵
  PID:12796
- C:\Windows\System\AkPcDYb.exe
  C:\Windows\System\AkPcDYb.exe
  2⤵
  PID:10708
- C:\Windows\System\akcRxRb.exe
  C:\Windows\System\akcRxRb.exe
  2⤵
  PID:12212
- C:\Windows\System\vucIfze.exe
  C:\Windows\System\vucIfze.exe
  2⤵
  PID:12972
- C:\Windows\System\QBLObCX.exe
  C:\Windows\System\QBLObCX.exe
  2⤵
  PID:12300
- C:\Windows\System\XIjLFxf.exe
  C:\Windows\System\XIjLFxf.exe
  2⤵
  PID:13284
- C:\Windows\System\HgWKQWK.exe
  C:\Windows\System\HgWKQWK.exe
  2⤵
  PID:13068
- C:\Windows\System\yzwXdzE.exe
  C:\Windows\System\yzwXdzE.exe
  2⤵
  PID:12344
- C:\Windows\System\ZJaZZlj.exe
  C:\Windows\System\ZJaZZlj.exe
  2⤵
  PID:12384
- C:\Windows\System\xcCGLNk.exe
  C:\Windows\System\xcCGLNk.exe
  2⤵
  PID:13168
- C:\Windows\System\yHYVnHH.exe
  C:\Windows\System\yHYVnHH.exe
  2⤵
  PID:11904
- C:\Windows\System\ocMwnUS.exe
  C:\Windows\System\ocMwnUS.exe
  2⤵
  PID:11244
- C:\Windows\System\bTPImSb.exe
  C:\Windows\System\bTPImSb.exe
  2⤵
  PID:12672
- C:\Windows\System\BTcrAUK.exe
  C:\Windows\System\BTcrAUK.exe
  2⤵
  PID:4704
- C:\Windows\System\MJORmXq.exe
  C:\Windows\System\MJORmXq.exe
  2⤵
  PID:12504
- C:\Windows\System\raIIwBc.exe
  C:\Windows\System\raIIwBc.exe
  2⤵
  PID:2156
- C:\Windows\System\laMLxBz.exe
  C:\Windows\System\laMLxBz.exe
  2⤵
  PID:11992
- C:\Windows\System\BcUOygk.exe
  C:\Windows\System\BcUOygk.exe
  2⤵
  PID:13096
- C:\Windows\System\CkkGSar.exe
  C:\Windows\System\CkkGSar.exe
  2⤵
  PID:13192
- C:\Windows\System\JUoegHB.exe
  C:\Windows\System\JUoegHB.exe
  2⤵
  PID:5324
- C:\Windows\System\hrlQAhr.exe
  C:\Windows\System\hrlQAhr.exe
  2⤵
  PID:928
- C:\Windows\System\kQUXUcq.exe
  C:\Windows\System\kQUXUcq.exe
  2⤵
  PID:11636
- C:\Windows\System\nbgahsd.exe
  C:\Windows\System\nbgahsd.exe
  2⤵
  PID:11024
- C:\Windows\System\LCgmntW.exe
  C:\Windows\System\LCgmntW.exe
  2⤵
  PID:1188
- C:\Windows\System\WTkEiBI.exe
  C:\Windows\System\WTkEiBI.exe
  2⤵
  PID:12860
- C:\Windows\System\VZTVrXf.exe
  C:\Windows\System\VZTVrXf.exe
  2⤵
  PID:12724
- C:\Windows\System\hOsHXBl.exe
  C:\Windows\System\hOsHXBl.exe
  2⤵
  PID:4632
- C:\Windows\System\QafzsGz.exe
  C:\Windows\System\QafzsGz.exe
  2⤵
  PID:5476
- C:\Windows\System\ykpOVMr.exe
  C:\Windows\System\ykpOVMr.exe
  2⤵
  PID:1612
- C:\Windows\System\NBHMlxZ.exe
  C:\Windows\System\NBHMlxZ.exe
  2⤵
  PID:4436
- C:\Windows\System\PmivPbJ.exe
  C:\Windows\System\PmivPbJ.exe
  2⤵
  PID:2832
- C:\Windows\System\vXTvRYB.exe
  C:\Windows\System\vXTvRYB.exe
  2⤵
  PID:6992
- C:\Windows\System\dUTeeHy.exe
  C:\Windows\System\dUTeeHy.exe
  2⤵
  PID:7072
- C:\Windows\System\VBWCkUy.exe
  C:\Windows\System\VBWCkUy.exe
  2⤵
  PID:1120
- C:\Windows\System\xohCqXe.exe
  C:\Windows\System\xohCqXe.exe
  2⤵
  PID:6252
- C:\Windows\System\RyKYxqu.exe
  C:\Windows\System\RyKYxqu.exe
  2⤵
  PID:2080
- C:\Windows\System\jzWSzVZ.exe
  C:\Windows\System\jzWSzVZ.exe
  2⤵
  PID:12932
- C:\Windows\System\MRjfJuE.exe
  C:\Windows\System\MRjfJuE.exe
  2⤵
  PID:11340
- C:\Windows\System\DpKOomi.exe
  C:\Windows\System\DpKOomi.exe
  2⤵
  PID:2668
- C:\Windows\System\kbJsFMC.exe
  C:\Windows\System\kbJsFMC.exe
  2⤵
  PID:6656
- C:\Windows\System\XwiGxuY.exe
  C:\Windows\System\XwiGxuY.exe
  2⤵
  PID:5984
- C:\Windows\System\JLwNrDe.exe
  C:\Windows\System\JLwNrDe.exe
  2⤵
  PID:4544
- C:\Windows\System\AXVMnuT.exe
  C:\Windows\System\AXVMnuT.exe
  2⤵
  PID:13292
- C:\Windows\System\uaJyopt.exe
  C:\Windows\System\uaJyopt.exe
  2⤵
  PID:10084
- C:\Windows\System\iJVpqFp.exe
  C:\Windows\System\iJVpqFp.exe
  2⤵
  PID:12436
- C:\Windows\System\iUhKJnb.exe
  C:\Windows\System\iUhKJnb.exe
  2⤵
  PID:4864
- C:\Windows\System\KnKelvy.exe
  C:\Windows\System\KnKelvy.exe
  2⤵
  PID:4820
- C:\Windows\System\vwJHbao.exe
  C:\Windows\System\vwJHbao.exe
  2⤵
  PID:12832
- C:\Windows\System\znnkCYu.exe
  C:\Windows\System\znnkCYu.exe
  2⤵
  PID:6628
- C:\Windows\System\FTrTgUd.exe
  C:\Windows\System\FTrTgUd.exe
  2⤵
  PID:13332
- C:\Windows\System\QFFQWWg.exe
  C:\Windows\System\QFFQWWg.exe
  2⤵
  PID:13356
- C:\Windows\System\oltWXGC.exe
  C:\Windows\System\oltWXGC.exe
  2⤵
  PID:13388
- C:\Windows\System\GPPaCgX.exe
  C:\Windows\System\GPPaCgX.exe
  2⤵
  PID:13404
- C:\Windows\System\RErjJNY.exe
  C:\Windows\System\RErjJNY.exe
  2⤵
  PID:13420
- C:\Windows\System\jQwFnZS.exe
  C:\Windows\System\jQwFnZS.exe
  2⤵
  PID:13476
- C:\Windows\System\DjFtGvR.exe
  C:\Windows\System\DjFtGvR.exe
  2⤵
  PID:13492
- C:\Windows\System\aBpSJrl.exe
  C:\Windows\System\aBpSJrl.exe
  2⤵
  PID:13512
- C:\Windows\System\lQnUwas.exe
  C:\Windows\System\lQnUwas.exe
  2⤵
  PID:13532
- C:\Windows\System\fDVapxE.exe
  C:\Windows\System\fDVapxE.exe
  2⤵
  PID:13680
- C:\Windows\System\XIEEYyt.exe
  C:\Windows\System\XIEEYyt.exe
  2⤵
  PID:13788
- C:\Windows\System\JOOODAw.exe
  C:\Windows\System\JOOODAw.exe
  2⤵
  PID:13828
- C:\Windows\System\urJLzaJ.exe
  C:\Windows\System\urJLzaJ.exe
  2⤵
  PID:13872
- C:\Windows\System\ZSpkPTF.exe
  C:\Windows\System\ZSpkPTF.exe
  2⤵
  PID:13916
- C:\Windows\System\UsTkBeO.exe
  C:\Windows\System\UsTkBeO.exe
  2⤵
  PID:13968
- C:\Windows\System\fPUCSfo.exe
  C:\Windows\System\fPUCSfo.exe
  2⤵
  PID:13992
- C:\Windows\System\efAlotz.exe
  C:\Windows\System\efAlotz.exe
  2⤵
  PID:14140
- C:\Windows\System\JEThWxA.exe
  C:\Windows\System\JEThWxA.exe
  2⤵
  PID:7308
- C:\Windows\System\OitfMhR.exe
  C:\Windows\System\OitfMhR.exe
  2⤵
  PID:3120
- C:\Windows\System\JAcqnpL.exe
  C:\Windows\System\JAcqnpL.exe
  2⤵
  PID:2496
- C:\Windows\System\QXfZNOf.exe
  C:\Windows\System\QXfZNOf.exe
  2⤵
  PID:7032
- C:\Windows\System\IzxvYUl.exe
  C:\Windows\System\IzxvYUl.exe
  2⤵
  PID:13440
- C:\Windows\System\qvYvFbu.exe
  C:\Windows\System\qvYvFbu.exe
  2⤵
  PID:2296
- C:\Windows\System\savWlRA.exe
  C:\Windows\System\savWlRA.exe
  2⤵
  PID:3976
- C:\Windows\System\zHCvqSu.exe
  C:\Windows\System\zHCvqSu.exe
  2⤵
  PID:7480
- C:\Windows\System\kItIoMU.exe
  C:\Windows\System\kItIoMU.exe
  2⤵
  PID:13456
- C:\Windows\System\AAtQshZ.exe
  C:\Windows\System\AAtQshZ.exe
  2⤵
  PID:7908
- C:\Windows\System\pqrLUKe.exe
  C:\Windows\System\pqrLUKe.exe
  2⤵
  PID:8056
- C:\Windows\System\jkyUZvl.exe
  C:\Windows\System\jkyUZvl.exe
  2⤵
  PID:8176
- C:\Windows\System\YoQYltO.exe
  C:\Windows\System\YoQYltO.exe
  2⤵
  PID:13904
- C:\Windows\System\girTinE.exe
  C:\Windows\System\girTinE.exe
  2⤵
  PID:4588
- C:\Windows\System\HmDQYEd.exe
  C:\Windows\System\HmDQYEd.exe
  2⤵
  PID:13952
- C:\Windows\System\hcUzwsu.exe
  C:\Windows\System\hcUzwsu.exe
  2⤵
  PID:13520
- C:\Windows\System\CSdsxhZ.exe
  C:\Windows\System\CSdsxhZ.exe
  2⤵
  PID:14004
- C:\Windows\System\jOrVWnJ.exe
  C:\Windows\System\jOrVWnJ.exe
  2⤵
  PID:13548
- C:\Windows\System\aiGmkta.exe
  C:\Windows\System\aiGmkta.exe
  2⤵
  PID:14040
- C:\Windows\System\lbQctcU.exe
  C:\Windows\System\lbQctcU.exe
  2⤵
  PID:13772
- C:\Windows\System\GuHzIVe.exe
  C:\Windows\System\GuHzIVe.exe
  2⤵
  PID:13596
- C:\Windows\System\BSRMlNW.exe
  C:\Windows\System\BSRMlNW.exe
  2⤵
  PID:7416
- C:\Windows\System\VwhTzrw.exe
  C:\Windows\System\VwhTzrw.exe
  2⤵
  PID:14092
- C:\Windows\System\GIBWWuT.exe
  C:\Windows\System\GIBWWuT.exe
  2⤵
  PID:4216
- C:\Windows\System\mXXINkT.exe
  C:\Windows\System\mXXINkT.exe
  2⤵
  PID:1412
- C:\Windows\System\RSlCctA.exe
  C:\Windows\System\RSlCctA.exe
  2⤵
  PID:8352
- C:\Windows\System\GtFPFJn.exe
  C:\Windows\System\GtFPFJn.exe
  2⤵
  PID:8360
- C:\Windows\System\cjqDcUe.exe
  C:\Windows\System\cjqDcUe.exe
  2⤵
  PID:8368
- C:\Windows\System\GAlzUGw.exe
  C:\Windows\System\GAlzUGw.exe
  2⤵
  PID:8392
- C:\Windows\System\ZRlbodI.exe
  C:\Windows\System\ZRlbodI.exe
  2⤵
  PID:1860
- C:\Windows\System\fEnHkaI.exe
  C:\Windows\System\fEnHkaI.exe
  2⤵
  PID:2604
- C:\Windows\System\lnVJAat.exe
  C:\Windows\System\lnVJAat.exe
  2⤵
  PID:7360
- C:\Windows\System\CGaMvfC.exe
  C:\Windows\System\CGaMvfC.exe
  2⤵
  PID:2688
- C:\Windows\System\BQsKrhk.exe
  C:\Windows\System\BQsKrhk.exe
  2⤵
  PID:7092
- C:\Windows\System\wjabImv.exe
  C:\Windows\System\wjabImv.exe
  2⤵
  PID:2268
- C:\Windows\System\hJfGJDw.exe
  C:\Windows\System\hJfGJDw.exe
  2⤵
  PID:14060
- C:\Windows\System\oXDMTUk.exe
  C:\Windows\System\oXDMTUk.exe
  2⤵
  PID:8436
- C:\Windows\System\tqDguFB.exe
  C:\Windows\System\tqDguFB.exe
  2⤵
  PID:3104
- C:\Windows\System\sanBqBC.exe
  C:\Windows\System\sanBqBC.exe
  2⤵
  PID:212
- C:\Windows\System\YbGnYyP.exe
  C:\Windows\System\YbGnYyP.exe
  2⤵
  PID:4848
- C:\Windows\System\zycdWIf.exe
  C:\Windows\System\zycdWIf.exe
  2⤵
  PID:6384
- C:\Windows\System\JqFXOWq.exe
  C:\Windows\System\JqFXOWq.exe
  2⤵
  PID:2612
- C:\Windows\System\fkxGFug.exe
  C:\Windows\System\fkxGFug.exe
  2⤵
  PID:5520
- C:\Windows\System\GpVObbw.exe
  C:\Windows\System\GpVObbw.exe
  2⤵
  PID:4080
- C:\Windows\System\AJDhndL.exe
  C:\Windows\System\AJDhndL.exe
  2⤵
  PID:5036
- C:\Windows\System\PRruPpv.exe
  C:\Windows\System\PRruPpv.exe
  2⤵
  PID:5056
- C:\Windows\System\DoUxxUZ.exe
  C:\Windows\System\DoUxxUZ.exe
  2⤵
  PID:5288
- C:\Windows\System\xQpCPfN.exe
  C:\Windows\System\xQpCPfN.exe
  2⤵
  PID:5200
- C:\Windows\System\uTjtTZS.exe
  C:\Windows\System\uTjtTZS.exe
  2⤵
  PID:13732
- C:\Windows\System\WRAAawk.exe
  C:\Windows\System\WRAAawk.exe
  2⤵
  PID:5664
- C:\Windows\System\CMfYjkJ.exe
  C:\Windows\System\CMfYjkJ.exe
  2⤵
  PID:13668
- C:\Windows\System\UCHHqIN.exe
  C:\Windows\System\UCHHqIN.exe
  2⤵
  PID:13984
- C:\Windows\System\YOvIaxI.exe
  C:\Windows\System\YOvIaxI.exe
  2⤵
  PID:14232
- C:\Windows\System\GfADFgn.exe
  C:\Windows\System\GfADFgn.exe
  2⤵
  PID:13804
- C:\Windows\System\bPFSSwq.exe
  C:\Windows\System\bPFSSwq.exe
  2⤵
  PID:5644
- C:\Windows\System\vsrRvCr.exe
  C:\Windows\System\vsrRvCr.exe
  2⤵
  PID:6156
- C:\Windows\System\nSVzMgP.exe
  C:\Windows\System\nSVzMgP.exe
  2⤵
  PID:5772
- C:\Windows\System\aSroPjj.exe
  C:\Windows\System\aSroPjj.exe
  2⤵
  PID:7384
- C:\Windows\System\YhJRgys.exe
  C:\Windows\System\YhJRgys.exe
  2⤵
  PID:13864
- C:\Windows\System\gfncuIU.exe
  C:\Windows\System\gfncuIU.exe
  2⤵
  PID:14000
- C:\Windows\System\FRiTChJ.exe
  C:\Windows\System\FRiTChJ.exe
  2⤵
  PID:7260
- C:\Windows\System\CGuTHkK.exe
  C:\Windows\System\CGuTHkK.exe
  2⤵
  PID:2044
- C:\Windows\System\ZbFJiYs.exe
  C:\Windows\System\ZbFJiYs.exe
  2⤵
  PID:14168
- C:\Windows\System\LiubTQC.exe
  C:\Windows\System\LiubTQC.exe
  2⤵
  PID:5144
- C:\Windows\System\YvQJwpf.exe
  C:\Windows\System\YvQJwpf.exe
  2⤵
  PID:5564
- C:\Windows\System\UETxjDV.exe
  C:\Windows\System\UETxjDV.exe
  2⤵
  PID:5168
- C:\Windows\System\fctYGPW.exe
  C:\Windows\System\fctYGPW.exe
  2⤵
  PID:5328
- C:\Windows\System\DgypJLG.exe
  C:\Windows\System\DgypJLG.exe
  2⤵
  PID:5584
- C:\Windows\System\BwgQfCE.exe
  C:\Windows\System\BwgQfCE.exe
  2⤵
  PID:5964
- C:\Windows\System\KEZPiYq.exe
  C:\Windows\System\KEZPiYq.exe
  2⤵
  PID:6152
- C:\Windows\System\WIYIDQa.exe
  C:\Windows\System\WIYIDQa.exe
  2⤵
  PID:6088
- C:\Windows\System\rJuqWCN.exe
  C:\Windows\System\rJuqWCN.exe
  2⤵
  PID:5884
- C:\Windows\System\oEuckEx.exe
  C:\Windows\System\oEuckEx.exe
  2⤵
  PID:13812
- C:\Windows\System\rmzIQPP.exe
  C:\Windows\System\rmzIQPP.exe
  2⤵
  PID:6300
- C:\Windows\System\jsKYZhb.exe
  C:\Windows\System\jsKYZhb.exe
  2⤵
  PID:6840
- C:\Windows\System\srIWiEm.exe
  C:\Windows\System\srIWiEm.exe
  2⤵
  PID:6396
- C:\Windows\System\ADolwge.exe
  C:\Windows\System\ADolwge.exe
  2⤵
  PID:6412
- C:\Windows\System\RLYiynf.exe
  C:\Windows\System\RLYiynf.exe
  2⤵
  PID:6292
- C:\Windows\System\eiNboLF.exe
  C:\Windows\System\eiNboLF.exe
  2⤵
  PID:6624
- C:\Windows\System\prrTPox.exe
  C:\Windows\System\prrTPox.exe
  2⤵
  PID:3764
- C:\Windows\System\YEaRGeZ.exe
  C:\Windows\System\YEaRGeZ.exe
  2⤵
  PID:8276
- C:\Windows\System\dbzXwTO.exe
  C:\Windows\System\dbzXwTO.exe
  2⤵
  PID:5316
- C:\Windows\System\erLyGqz.exe
  C:\Windows\System\erLyGqz.exe
  2⤵
  PID:9648
- C:\Windows\System\ScYuZNp.exe
  C:\Windows\System\ScYuZNp.exe
  2⤵
  PID:14276
- C:\Windows\System\owfhJnn.exe
  C:\Windows\System\owfhJnn.exe
  2⤵
  PID:6620
- C:\Windows\System\SuCCrqK.exe
  C:\Windows\System\SuCCrqK.exe
  2⤵
  PID:8572
- C:\Windows\System\IAiUmks.exe
  C:\Windows\System\IAiUmks.exe
  2⤵
  PID:6540
- C:\Windows\System\NaguQHU.exe
  C:\Windows\System\NaguQHU.exe
  2⤵
  PID:3628
- C:\Windows\System\DfpuOaf.exe
  C:\Windows\System\DfpuOaf.exe
  2⤵
  PID:7452
- C:\Windows\System\XGhJKOK.exe
  C:\Windows\System\XGhJKOK.exe
  2⤵
  PID:5064
- C:\Windows\System\elHClri.exe
  C:\Windows\System\elHClri.exe
  2⤵
  PID:2220
- C:\Windows\System\MhVNQoj.exe
  C:\Windows\System\MhVNQoj.exe
  2⤵
  PID:6764
- C:\Windows\System\gZFscxq.exe
  C:\Windows\System\gZFscxq.exe
  2⤵
  PID:6836
- C:\Windows\System\QFbiMAB.exe
  C:\Windows\System\QFbiMAB.exe
  2⤵
  PID:13376
- C:\Windows\System\urnVtbo.exe
  C:\Windows\System\urnVtbo.exe
  2⤵
  PID:6132
- C:\Windows\System\iUroytG.exe
  C:\Windows\System\iUroytG.exe
  2⤵
  PID:13368
- C:\Windows\System\nXBgznh.exe
  C:\Windows\System\nXBgznh.exe
  2⤵
  PID:7112
- C:\Windows\System\NDtGWGF.exe
  C:\Windows\System\NDtGWGF.exe
  2⤵
  PID:7428
- C:\Windows\System\AsyOoQM.exe
  C:\Windows\System\AsyOoQM.exe
  2⤵
  PID:11188
- C:\Windows\System\WedZAEy.exe
  C:\Windows\System\WedZAEy.exe
  2⤵
  PID:2036
- C:\Windows\System\JFIDpuZ.exe
  C:\Windows\System\JFIDpuZ.exe
  2⤵
  PID:14172
- C:\Windows\System\ujAlojn.exe
  C:\Windows\System\ujAlojn.exe
  2⤵
  PID:6272
- C:\Windows\System\NEddBHR.exe
  C:\Windows\System\NEddBHR.exe
  2⤵
  PID:5192
- C:\Windows\System\greKqiG.exe
  C:\Windows\System\greKqiG.exe
  2⤵
  PID:5396
- C:\Windows\System\VSEgKSA.exe
  C:\Windows\System\VSEgKSA.exe
  2⤵
  PID:5524
- C:\Windows\System\EyMEcsm.exe
  C:\Windows\System\EyMEcsm.exe
  2⤵
  PID:5252
- C:\Windows\System\FDUnGct.exe
  C:\Windows\System\FDUnGct.exe
  2⤵
  PID:7760
- C:\Windows\System\YnzhqHk.exe
  C:\Windows\System\YnzhqHk.exe
  2⤵
  PID:5944
- C:\Windows\System\xqRFleu.exe
  C:\Windows\System\xqRFleu.exe
  2⤵
  PID:14240
- C:\Windows\System\mVGLytJ.exe
  C:\Windows\System\mVGLytJ.exe
  2⤵
  PID:7928
- C:\Windows\System\qjABauP.exe
  C:\Windows\System\qjABauP.exe
  2⤵
  PID:9604
- C:\Windows\System\YskbyWZ.exe
  C:\Windows\System\YskbyWZ.exe
  2⤵
  PID:7184
- C:\Windows\System\gLajKhH.exe
  C:\Windows\System\gLajKhH.exe
  2⤵
  PID:5712
- C:\Windows\System\CjTtsht.exe
  C:\Windows\System\CjTtsht.exe
  2⤵
  PID:8400
- C:\Windows\System\DIKTzVV.exe
  C:\Windows\System\DIKTzVV.exe
  2⤵
  PID:3944
- C:\Windows\System\vsmBmiG.exe
  C:\Windows\System\vsmBmiG.exe
  2⤵
  PID:9480
- C:\Windows\System\qFHqcxG.exe
  C:\Windows\System\qFHqcxG.exe
  2⤵
  PID:7080
- C:\Windows\System\rYxFMeI.exe
  C:\Windows\System\rYxFMeI.exe
  2⤵
  PID:8372
- C:\Windows\System\pEVqkPS.exe
  C:\Windows\System\pEVqkPS.exe
  2⤵
  PID:6188
- C:\Windows\System\UJhCLTu.exe
  C:\Windows\System\UJhCLTu.exe
  2⤵
  PID:7484
- C:\Windows\System\TfZExbf.exe
  C:\Windows\System\TfZExbf.exe
  2⤵
  PID:7076
- C:\Windows\System\NMvFyvr.exe
  C:\Windows\System\NMvFyvr.exe
  2⤵
  PID:8244
- C:\Windows\System\DBbxVGE.exe
  C:\Windows\System\DBbxVGE.exe
  2⤵
  PID:1708
- C:\Windows\System\MznyXzE.exe
  C:\Windows\System\MznyXzE.exe
  2⤵
  PID:9316
- C:\Windows\System\ApYCoFP.exe
  C:\Windows\System\ApYCoFP.exe
  2⤵
  PID:13624
- C:\Windows\System\LtWUBSK.exe
  C:\Windows\System\LtWUBSK.exe
  2⤵
  PID:5672
- C:\Windows\System\MACDFgO.exe
  C:\Windows\System\MACDFgO.exe
  2⤵
  PID:10336
- C:\Windows\System\zUBSWZk.exe
  C:\Windows\System\zUBSWZk.exe
  2⤵
  PID:13768
- C:\Windows\System\RtwKQZk.exe
  C:\Windows\System\RtwKQZk.exe
  2⤵
  PID:5472
- C:\Windows\System\fLfYOqi.exe
  C:\Windows\System\fLfYOqi.exe
  2⤵
  PID:4288
- C:\Windows\System\NgXtsNe.exe
  C:\Windows\System\NgXtsNe.exe
  2⤵
  PID:8216
- C:\Windows\System\exMLUmt.exe
  C:\Windows\System\exMLUmt.exe
  2⤵
  PID:7552
- C:\Windows\System\uHRjCXq.exe
  C:\Windows\System\uHRjCXq.exe
  2⤵
  PID:2172
- C:\Windows\System\LjRYsEw.exe
  C:\Windows\System\LjRYsEw.exe
  2⤵
  PID:8560
- C:\Windows\System\CTlTTIW.exe
  C:\Windows\System\CTlTTIW.exe
  2⤵
  PID:9708
- C:\Windows\System\tMzbbvj.exe
  C:\Windows\System\tMzbbvj.exe
  2⤵
  PID:7492
- C:\Windows\System\MsBFQwW.exe
  C:\Windows\System\MsBFQwW.exe
  2⤵
  PID:8660
- C:\Windows\System\aNzBPYN.exe
  C:\Windows\System\aNzBPYN.exe
  2⤵
  PID:7444
- C:\Windows\System\xwVtHlC.exe
  C:\Windows\System\xwVtHlC.exe
  2⤵
  PID:8864
- C:\Windows\System\CoDSTMA.exe
  C:\Windows\System\CoDSTMA.exe
  2⤵
  PID:3624
- C:\Windows\System\DAoiFRw.exe
  C:\Windows\System\DAoiFRw.exe
  2⤵
  PID:6340
- C:\Windows\System\mbVRzrz.exe
  C:\Windows\System\mbVRzrz.exe
  2⤵
  PID:7208
- C:\Windows\System\PntvbQF.exe
  C:\Windows\System\PntvbQF.exe
  2⤵
  PID:5112
- C:\Windows\System\QxzjMZG.exe
  C:\Windows\System\QxzjMZG.exe
  2⤵
  PID:2108
- C:\Windows\System\CjmLraM.exe
  C:\Windows\System\CjmLraM.exe
  2⤵
  PID:9064
- C:\Windows\System\jJJThZs.exe
  C:\Windows\System\jJJThZs.exe
  2⤵
  PID:8748
- C:\Windows\System\hORzsfR.exe
  C:\Windows\System\hORzsfR.exe
  2⤵
  PID:8240
- C:\Windows\System\fuazBZr.exe
  C:\Windows\System\fuazBZr.exe
  2⤵
  PID:5060
- C:\Windows\System\pFbmziL.exe
  C:\Windows\System\pFbmziL.exe
  2⤵
  PID:3776
- C:\Windows\System\eogQyig.exe
  C:\Windows\System\eogQyig.exe
  2⤵
  PID:7920
- C:\Windows\System\sKWggUw.exe
  C:\Windows\System\sKWggUw.exe
  2⤵
  PID:9412
- C:\Windows\System\nOgFKxm.exe
  C:\Windows\System\nOgFKxm.exe
  2⤵
  PID:10536
- C:\Windows\System\KdYSmjX.exe
  C:\Windows\System\KdYSmjX.exe
  2⤵
  PID:7844
- C:\Windows\System\erGWXeU.exe
  C:\Windows\System\erGWXeU.exe
  2⤵
  PID:8832
- C:\Windows\System\QGVqaeW.exe
  C:\Windows\System\QGVqaeW.exe
  2⤵
  PID:7324
- C:\Windows\System\VkqMyux.exe
  C:\Windows\System\VkqMyux.exe
  2⤵
  PID:4900
- C:\Windows\System\stRBRBT.exe
  C:\Windows\System\stRBRBT.exe
  2⤵
  PID:9436
- C:\Windows\System\nfgAKvN.exe
  C:\Windows\System\nfgAKvN.exe
  2⤵
  PID:13912
- C:\Windows\System\lWVcSDM.exe
  C:\Windows\System\lWVcSDM.exe
  2⤵
  PID:10904
- C:\Windows\System\iTezWwY.exe
  C:\Windows\System\iTezWwY.exe
  2⤵
  PID:9988
- C:\Windows\System\YreNxyo.exe
  C:\Windows\System\YreNxyo.exe
  2⤵
  PID:9772
- C:\Windows\System\yuYMkap.exe
  C:\Windows\System\yuYMkap.exe
  2⤵
  PID:10068
- C:\Windows\System\sohclDs.exe
  C:\Windows\System\sohclDs.exe
  2⤵
  PID:9860
- C:\Windows\System\XPGuTcd.exe
  C:\Windows\System\XPGuTcd.exe
  2⤵
  PID:9968
- C:\Windows\System\CmBehNI.exe
  C:\Windows\System\CmBehNI.exe
  2⤵
  PID:9500
- C:\Windows\System\fvpReOj.exe
  C:\Windows\System\fvpReOj.exe
  2⤵
  PID:9728
- C:\Windows\System\USlKcxk.exe
  C:\Windows\System\USlKcxk.exe
  2⤵
  PID:9076
- C:\Windows\System\YuuFRfP.exe
  C:\Windows\System\YuuFRfP.exe
  2⤵
  PID:3960
- C:\Windows\System\YGRIRXp.exe
  C:\Windows\System\YGRIRXp.exe
  2⤵
  PID:8852
- C:\Windows\System\JHJHhoO.exe
  C:\Windows\System\JHJHhoO.exe
  2⤵
  PID:3792
- C:\Windows\System\DcXHgGl.exe
  C:\Windows\System\DcXHgGl.exe
  2⤵
  PID:2728
- C:\Windows\System\yqgiZOP.exe
  C:\Windows\System\yqgiZOP.exe
  2⤵
  PID:9720
- C:\Windows\System\RvTnwGI.exe
  C:\Windows\System\RvTnwGI.exe
  2⤵
  PID:10152
- C:\Windows\System\NoRkpFd.exe
  C:\Windows\System\NoRkpFd.exe
  2⤵
  PID:9292
- C:\Windows\System\HahyiqF.exe
  C:\Windows\System\HahyiqF.exe
  2⤵
  PID:9600
- C:\Windows\System\PLwaPuv.exe
  C:\Windows\System\PLwaPuv.exe
  2⤵
  PID:9032
- C:\Windows\System\OAjSExs.exe
  C:\Windows\System\OAjSExs.exe
  2⤵
  PID:8500
- C:\Windows\System\YVsMlJj.exe
  C:\Windows\System\YVsMlJj.exe
  2⤵
  PID:8020
- C:\Windows\System\UaeZsfz.exe
  C:\Windows\System\UaeZsfz.exe
  2⤵
  PID:9044
- C:\Windows\System\znXIRfz.exe
  C:\Windows\System\znXIRfz.exe
  2⤵
  PID:9068
- C:\Windows\System\XcPvbyu.exe
  C:\Windows\System\XcPvbyu.exe
  2⤵
  PID:10224
- C:\Windows\System\vEDmEtD.exe
  C:\Windows\System\vEDmEtD.exe
  2⤵
  PID:3884
- C:\Windows\System\XhwQOQO.exe
  C:\Windows\System\XhwQOQO.exe
  2⤵
  PID:9620
- C:\Windows\System\TVbnVVE.exe
  C:\Windows\System\TVbnVVE.exe
  2⤵
  PID:6364
- C:\Windows\System\cBMPcSL.exe
  C:\Windows\System\cBMPcSL.exe
  2⤵
  PID:5356
- C:\Windows\System\BkiThSQ.exe
  C:\Windows\System\BkiThSQ.exe
  2⤵
  PID:10416
- C:\Windows\System\BsZImqd.exe
  C:\Windows\System\BsZImqd.exe
  2⤵
  PID:9056
- C:\Windows\System\uIVaERj.exe
  C:\Windows\System\uIVaERj.exe
  2⤵
  PID:11000
- C:\Windows\System\rkjhLNf.exe
  C:\Windows\System\rkjhLNf.exe
  2⤵
  PID:11128
- C:\Windows\System\vDVUlit.exe
  C:\Windows\System\vDVUlit.exe
  2⤵
  PID:10876
- C:\Windows\System\IuVQTTQ.exe
  C:\Windows\System\IuVQTTQ.exe
  2⤵
  PID:6800
- C:\Windows\System\yBnBmmQ.exe
  C:\Windows\System\yBnBmmQ.exe
  2⤵
  PID:10112
- C:\Windows\System\fEGJgXO.exe
  C:\Windows\System\fEGJgXO.exe
  2⤵
  PID:9748
- C:\Windows\System\GiEJjna.exe
  C:\Windows\System\GiEJjna.exe
  2⤵
  PID:9796
- C:\Windows\System\JMJVIgN.exe
  C:\Windows\System\JMJVIgN.exe
  2⤵
  PID:10328
- C:\Windows\System\GePvyar.exe
  C:\Windows\System\GePvyar.exe
  2⤵
  PID:12480
- C:\Windows\System\FJqqmQS.exe
  C:\Windows\System\FJqqmQS.exe
  2⤵
  PID:10792
- C:\Windows\System\zQSZrJh.exe
  C:\Windows\System\zQSZrJh.exe
  2⤵
  PID:9460
- C:\Windows\System\TeIfhXp.exe
  C:\Windows\System\TeIfhXp.exe
  2⤵
  PID:9936
- C:\Windows\System\efNcwwn.exe
  C:\Windows\System\efNcwwn.exe
  2⤵
  PID:8736
- C:\Windows\System\RBhMOmz.exe
  C:\Windows\System\RBhMOmz.exe
  2⤵
  PID:7692
- C:\Windows\System\fQOBVzD.exe
  C:\Windows\System\fQOBVzD.exe
  2⤵
  PID:7304
- C:\Windows\System\KDsFuib.exe
  C:\Windows\System\KDsFuib.exe
  2⤵
  PID:10412
- C:\Windows\System\JtZgHGV.exe
  C:\Windows\System\JtZgHGV.exe
  2⤵
  PID:10176
- C:\Windows\System\hwBPiiA.exe
  C:\Windows\System\hwBPiiA.exe
  2⤵
  PID:8592
- C:\Windows\System\iJDfVjW.exe
  C:\Windows\System\iJDfVjW.exe
  2⤵
  PID:8208
- C:\Windows\System\wNUJVUV.exe
  C:\Windows\System\wNUJVUV.exe
  2⤵
  PID:10168
- C:\Windows\System\GJHThrB.exe
  C:\Windows\System\GJHThrB.exe
  2⤵
  PID:9672
- C:\Windows\System\licbLpD.exe
  C:\Windows\System\licbLpD.exe
  2⤵
  PID:11404
- C:\Windows\System\fwJYmaR.exe
  C:\Windows\System\fwJYmaR.exe
  2⤵
  PID:11276
- C:\Windows\System\MAXOkBj.exe
  C:\Windows\System\MAXOkBj.exe
  2⤵
  PID:11072
- C:\Windows\System\CxWpUII.exe
  C:\Windows\System\CxWpUII.exe
  2⤵
  PID:8796
- C:\Windows\System\qdbMTFM.exe
  C:\Windows\System\qdbMTFM.exe
  2⤵
  PID:9940
- C:\Windows\System\lZKtqgJ.exe
  C:\Windows\System\lZKtqgJ.exe
  2⤵
  PID:10484
- C:\Windows\System\ekToBOk.exe
  C:\Windows\System\ekToBOk.exe
  2⤵
  PID:11248
- C:\Windows\System\kFQsyAr.exe
  C:\Windows\System\kFQsyAr.exe
  2⤵
  PID:10164
- C:\Windows\System\SnBzNzn.exe
  C:\Windows\System\SnBzNzn.exe
  2⤵
  PID:9788
- C:\Windows\System\OFidXIu.exe
  C:\Windows\System\OFidXIu.exe
  2⤵
  PID:11508
- C:\Windows\System\uPDtARh.exe
  C:\Windows\System\uPDtARh.exe
  2⤵
  PID:11572
- C:\Windows\System\sDSxwTj.exe
  C:\Windows\System\sDSxwTj.exe
  2⤵
  PID:8940
- C:\Windows\System\EjRdaxC.exe
  C:\Windows\System\EjRdaxC.exe
  2⤵
  PID:11260
- C:\Windows\System\VIdCUvK.exe
  C:\Windows\System\VIdCUvK.exe
  2⤵
  PID:11200
- C:\Windows\System\aOVCmxw.exe
  C:\Windows\System\aOVCmxw.exe
  2⤵
  PID:11804
- C:\Windows\System\sBVmPEt.exe
  C:\Windows\System\sBVmPEt.exe
  2⤵
  PID:9740
- C:\Windows\System\XZptibM.exe
  C:\Windows\System\XZptibM.exe
  2⤵
  PID:10136
- C:\Windows\System\omlYedp.exe
  C:\Windows\System\omlYedp.exe
  2⤵
  PID:6128
- C:\Windows\System\CnZybeN.exe
  C:\Windows\System\CnZybeN.exe
  2⤵
  PID:8292
- C:\Windows\System\qNgYcmT.exe
  C:\Windows\System\qNgYcmT.exe
  2⤵
  PID:10560
- C:\Windows\System\haOEFks.exe
  C:\Windows\System\haOEFks.exe
  2⤵
  PID:11744
- C:\Windows\System\HSROuyl.exe
  C:\Windows\System\HSROuyl.exe
  2⤵
  PID:1828
- C:\Windows\System\fRjxmxE.exe
  C:\Windows\System\fRjxmxE.exe
  2⤵
  PID:10016
- C:\Windows\System\bjaUFVK.exe
  C:\Windows\System\bjaUFVK.exe
  2⤵
  PID:6968
- C:\Windows\System\cDdyPun.exe
  C:\Windows\System\cDdyPun.exe
  2⤵
  PID:4248
- C:\Windows\System\ilNzRCq.exe
  C:\Windows\System\ilNzRCq.exe
  2⤵
  PID:11900
- C:\Windows\System\rUSHUVX.exe
  C:\Windows\System\rUSHUVX.exe
  2⤵
  PID:11496
- C:\Windows\System\aVToLkT.exe
  C:\Windows\System\aVToLkT.exe
  2⤵
  PID:11700
- C:\Windows\System\hWlKUsf.exe
  C:\Windows\System\hWlKUsf.exe
  2⤵
  PID:10856
- C:\Windows\System\GuJMiWP.exe
  C:\Windows\System\GuJMiWP.exe
  2⤵
  PID:10976
- C:\Windows\System\JmFwGRf.exe
  C:\Windows\System\JmFwGRf.exe
  2⤵
  PID:11620
- C:\Windows\System\xpvqOaT.exe
  C:\Windows\System\xpvqOaT.exe
  2⤵
  PID:12032
- C:\Windows\System\WRivSPa.exe
  C:\Windows\System\WRivSPa.exe
  2⤵
  PID:8228
- C:\Windows\System\aggsRbQ.exe
  C:\Windows\System\aggsRbQ.exe
  2⤵
  PID:11756
- C:\Windows\System\ojqnrGz.exe
  C:\Windows\System\ojqnrGz.exe
  2⤵
  PID:11792
- C:\Windows\System\AOrFgjd.exe
  C:\Windows\System\AOrFgjd.exe
  2⤵
  PID:9152
- C:\Windows\System\bJLMzso.exe
  C:\Windows\System\bJLMzso.exe
  2⤵
  PID:12008
- C:\Windows\System\tOdoxph.exe
  C:\Windows\System\tOdoxph.exe
  2⤵
  PID:10456
- C:\Windows\System\fMQYKwz.exe
  C:\Windows\System\fMQYKwz.exe
  2⤵
  PID:11972
- C:\Windows\System\ajIIXQf.exe
  C:\Windows\System\ajIIXQf.exe
  2⤵
  PID:14348
- C:\Windows\System\LnQHDXw.exe
  C:\Windows\System\LnQHDXw.exe
  2⤵
  PID:14548
- C:\Windows\System\enHCnnw.exe
  C:\Windows\System\enHCnnw.exe
  2⤵
  PID:14572
- C:\Windows\System\LuLXtsF.exe
  C:\Windows\System\LuLXtsF.exe
  2⤵
  PID:14592
- C:\Windows\System\VdBkrxD.exe
  C:\Windows\System\VdBkrxD.exe
  2⤵
  PID:14640
- C:\Windows\System\oCRDTpg.exe
  C:\Windows\System\oCRDTpg.exe
  2⤵
  PID:14672
- C:\Windows\System\brFcSWh.exe
  C:\Windows\System\brFcSWh.exe
  2⤵
  PID:14696
- C:\Windows\System\dgiGFFm.exe
  C:\Windows\System\dgiGFFm.exe
  2⤵
  PID:14720
- C:\Windows\System\RYSvQld.exe
  C:\Windows\System\RYSvQld.exe
  2⤵
  PID:14744
- C:\Windows\System\HUnpjbn.exe
  C:\Windows\System\HUnpjbn.exe
  2⤵
  PID:15212
- C:\Windows\System\veYUMrD.exe
  C:\Windows\System\veYUMrD.exe
  2⤵
  PID:15232
- C:\Windows\System\FSvwswy.exe
  C:\Windows\System\FSvwswy.exe
  2⤵
  PID:15248
- C:\Windows\System\vZxcrih.exe
  C:\Windows\System\vZxcrih.exe
  2⤵
  PID:15264
- C:\Windows\System\sinIzCs.exe
  C:\Windows\System\sinIzCs.exe
  2⤵
  PID:15284
- C:\Windows\System\bYjdTrI.exe
  C:\Windows\System\bYjdTrI.exe
  2⤵
  PID:15300
- C:\Windows\System\xxytugs.exe
  C:\Windows\System\xxytugs.exe
  2⤵
  PID:15316
- C:\Windows\System\fwLtvaN.exe
  C:\Windows\System\fwLtvaN.exe
  2⤵
  PID:15332
- C:\Windows\System\MCURIXA.exe
  C:\Windows\System\MCURIXA.exe
  2⤵
  PID:15348
- C:\Windows\System\WYCCfFq.exe
  C:\Windows\System\WYCCfFq.exe
  2⤵
  PID:10180
- C:\Windows\System\GovlCUa.exe
  C:\Windows\System\GovlCUa.exe
  2⤵
  PID:7456
- C:\Windows\System\uKxfrPH.exe
  C:\Windows\System\uKxfrPH.exe
  2⤵
  PID:11928
- C:\Windows\System\yylTtAL.exe
  C:\Windows\System\yylTtAL.exe
  2⤵
  PID:10464
- C:\Windows\System\BGcxEQL.exe
  C:\Windows\System\BGcxEQL.exe
  2⤵
  PID:8900
- C:\Windows\System\mjswSeW.exe
  C:\Windows\System\mjswSeW.exe
  2⤵
  PID:10596
- C:\Windows\System\bkuSwlm.exe
  C:\Windows\System\bkuSwlm.exe
  2⤵
  PID:11480
- C:\Windows\System\WWQFtOr.exe
  C:\Windows\System\WWQFtOr.exe
  2⤵
  PID:8976
- C:\Windows\System\AbsfZiv.exe
  C:\Windows\System\AbsfZiv.exe
  2⤵
  PID:11624
- C:\Windows\System\SNlCZcu.exe
  C:\Windows\System\SNlCZcu.exe
  2⤵
  PID:10964
- C:\Windows\System\BUZMiZq.exe
  C:\Windows\System\BUZMiZq.exe
  2⤵
  PID:5420
- C:\Windows\System\ysbBHpP.exe
  C:\Windows\System\ysbBHpP.exe
  2⤵
  PID:14496
- C:\Windows\System\jZLqYqX.exe
  C:\Windows\System\jZLqYqX.exe
  2⤵
  PID:11092
- C:\Windows\System\EKfLZjB.exe
  C:\Windows\System\EKfLZjB.exe
  2⤵
  PID:11840
- C:\Windows\System\FysTnDC.exe
  C:\Windows\System\FysTnDC.exe
  2⤵
  PID:12760
- C:\Windows\System\vBBGniE.exe
  C:\Windows\System\vBBGniE.exe
  2⤵
  PID:10032
- C:\Windows\System\AHwmrAx.exe
  C:\Windows\System\AHwmrAx.exe
  2⤵
  PID:11736
- C:\Windows\System\HOZcAMp.exe
  C:\Windows\System\HOZcAMp.exe
  2⤵
  PID:14564
- C:\Windows\System\HGTjNzE.exe
  C:\Windows\System\HGTjNzE.exe
  2⤵
  PID:14756
- C:\Windows\System\PYiqxKf.exe
  C:\Windows\System\PYiqxKf.exe
  2⤵
  PID:14772
- C:\Windows\System\ywXQLvO.exe
  C:\Windows\System\ywXQLvO.exe
  2⤵
  PID:15020
- C:\Windows\System\vSjdxus.exe
  C:\Windows\System\vSjdxus.exe
  2⤵
  PID:15052
- C:\Windows\System\uSbcNhE.exe
  C:\Windows\System\uSbcNhE.exe
  2⤵
  PID:14872
- C:\Windows\System\XjHafjA.exe
  C:\Windows\System\XjHafjA.exe
  2⤵
  PID:13204
- C:\Windows\System\MXwdmSG.exe
  C:\Windows\System\MXwdmSG.exe
  2⤵
  PID:13208
- C:\Windows\System\rYlvqal.exe
  C:\Windows\System\rYlvqal.exe
  2⤵
  PID:15076
- C:\Windows\System\GsNgVii.exe
  C:\Windows\System\GsNgVii.exe
  2⤵
  PID:15108
- C:\Windows\System\DoraPhX.exe
  C:\Windows\System\DoraPhX.exe
  2⤵
  PID:12976
- C:\Windows\System\KLCSniN.exe
  C:\Windows\System\KLCSniN.exe
  2⤵
  PID:12388
- C:\Windows\System\IBHKzgH.exe
  C:\Windows\System\IBHKzgH.exe
  2⤵
  PID:13212
- C:\Windows\System\hfWePfQ.exe
  C:\Windows\System\hfWePfQ.exe
  2⤵
  PID:15356
- C:\Windows\System\pJTBsws.exe
  C:\Windows\System\pJTBsws.exe
  2⤵
  PID:15188
- C:\Windows\System\hbWFkcP.exe
  C:\Windows\System\hbWFkcP.exe
  2⤵
  PID:10516
- C:\Windows\System\HfhnURs.exe
  C:\Windows\System\HfhnURs.exe
  2⤵
  PID:11416
- C:\Windows\System\nBUYTMH.exe
  C:\Windows\System\nBUYTMH.exe
  2⤵
  PID:2228
- C:\Windows\System\zkMkBms.exe
  C:\Windows\System\zkMkBms.exe
  2⤵
  PID:8680
- C:\Windows\System\DaxLXfL.exe
  C:\Windows\System\DaxLXfL.exe
  2⤵
  PID:9400
- C:\Windows\System\cHfhonN.exe
  C:\Windows\System\cHfhonN.exe
  2⤵
  PID:12260
- C:\Windows\System\BtHZNue.exe
  C:\Windows\System\BtHZNue.exe
  2⤵
  PID:11272
- C:\Windows\System\cXvBCDn.exe
  C:\Windows\System\cXvBCDn.exe
  2⤵
  PID:14404
- C:\Windows\System\CgZaUoO.exe
  C:\Windows\System\CgZaUoO.exe
  2⤵
  PID:14584
- C:\Windows\System\EDqMCBS.exe
  C:\Windows\System\EDqMCBS.exe
  2⤵
  PID:13084
- C:\Windows\System\KxIXNZW.exe
  C:\Windows\System\KxIXNZW.exe
  2⤵
  PID:11172
- C:\Windows\System\KpnZcWt.exe
  C:\Windows\System\KpnZcWt.exe
  2⤵
  PID:9688
- C:\Windows\System\jHqUjhE.exe
  C:\Windows\System\jHqUjhE.exe
  2⤵
  PID:11796
- C:\Windows\System\srTNGSL.exe
  C:\Windows\System\srTNGSL.exe
  2⤵
  PID:11800
- C:\Windows\System\IcbkHoB.exe
  C:\Windows\System\IcbkHoB.exe
  2⤵
  PID:11668
- C:\Windows\System\SujBBrk.exe
  C:\Windows\System\SujBBrk.exe
  2⤵
  PID:14380
- C:\Windows\System\gIqfMbh.exe
  C:\Windows\System\gIqfMbh.exe
  2⤵
  PID:14704
- C:\Windows\System\LyVGxmH.exe
  C:\Windows\System\LyVGxmH.exe
  2⤵
  PID:15096
- C:\Windows\System\hHXfqor.exe
  C:\Windows\System\hHXfqor.exe
  2⤵
  PID:14780
- C:\Windows\System\oCsdxGM.exe
  C:\Windows\System\oCsdxGM.exe
  2⤵
  PID:14732
- C:\Windows\System\hSYfYCI.exe
  C:\Windows\System\hSYfYCI.exe
  2⤵
  PID:12564
- C:\Windows\System\wGlqlFV.exe
  C:\Windows\System\wGlqlFV.exe
  2⤵
  PID:13136
- C:\Windows\System\OaNdicB.exe
  C:\Windows\System\OaNdicB.exe
  2⤵
  PID:12160
- C:\Windows\System\LAVHNbt.exe
  C:\Windows\System\LAVHNbt.exe
  2⤵
  PID:15152
- C:\Windows\System\pTmYkuo.exe
  C:\Windows\System\pTmYkuo.exe
  2⤵
  PID:12880
- C:\Windows\System\MCZvSww.exe
  C:\Windows\System\MCZvSww.exe
  2⤵
  PID:8924
- C:\Windows\System\mHBDDsU.exe
  C:\Windows\System\mHBDDsU.exe
  2⤵
  PID:11960
- C:\Windows\System\KSQOZlg.exe
  C:\Windows\System\KSQOZlg.exe
  2⤵
  PID:15136
- C:\Windows\System\umossyu.exe
  C:\Windows\System\umossyu.exe
  2⤵
  PID:12864
- C:\Windows\System\AptVnUo.exe
  C:\Windows\System\AptVnUo.exe
  2⤵
  PID:12784
- C:\Windows\System\fHxxTxy.exe
  C:\Windows\System\fHxxTxy.exe
  2⤵
  PID:12596
- C:\Windows\System\wIuvFeW.exe
  C:\Windows\System\wIuvFeW.exe
  2⤵
  PID:1448
- C:\Windows\System\NRZtTSE.exe
  C:\Windows\System\NRZtTSE.exe
  2⤵
  PID:13220
- C:\Windows\System\lIrIjKc.exe
  C:\Windows\System\lIrIjKc.exe
  2⤵
  PID:13012
- C:\Windows\System\vEnEZWp.exe
  C:\Windows\System\vEnEZWp.exe
  2⤵
  PID:3320
- C:\Windows\System\qzSnoer.exe
  C:\Windows\System\qzSnoer.exe
  2⤵
  PID:228
- C:\Windows\System\gqCGQeP.exe
  C:\Windows\System\gqCGQeP.exe
  2⤵
  PID:12284
- C:\Windows\System\WKzxmry.exe
  C:\Windows\System\WKzxmry.exe
  2⤵
  PID:11472
- C:\Windows\System\Heedkge.exe
  C:\Windows\System\Heedkge.exe
  2⤵
  PID:14604
- C:\Windows\System\cKaQDKf.exe
  C:\Windows\System\cKaQDKf.exe
  2⤵
  PID:14528
- C:\Windows\System\DTAQAAh.exe
  C:\Windows\System\DTAQAAh.exe
  2⤵
  PID:2284
- C:\Windows\System\CwrdHAn.exe
  C:\Windows\System\CwrdHAn.exe
  2⤵
  PID:15092
- C:\Windows\System\GUJhXQz.exe
  C:\Windows\System\GUJhXQz.exe
  2⤵
  PID:15128
- C:\Windows\System\ghndJWR.exe
  C:\Windows\System\ghndJWR.exe
  2⤵
  PID:15100
- C:\Windows\System\FTJzasU.exe
  C:\Windows\System\FTJzasU.exe
  2⤵
  PID:15004
- C:\Windows\System\zdVXEfp.exe
  C:\Windows\System\zdVXEfp.exe
  2⤵
  PID:15160
- C:\Windows\System\sycJyPf.exe
  C:\Windows\System\sycJyPf.exe
  2⤵
  PID:12572
- C:\Windows\System\lluLJXk.exe
  C:\Windows\System\lluLJXk.exe
  2⤵
  PID:6312
- C:\Windows\System\KWQUZMf.exe
  C:\Windows\System\KWQUZMf.exe
  2⤵
  PID:14636
- C:\Windows\System\XIrmskY.exe
  C:\Windows\System\XIrmskY.exe
  2⤵
  PID:13120
- C:\Windows\System\UDuHdFK.exe
  C:\Windows\System\UDuHdFK.exe
  2⤵
  PID:15072
- C:\Windows\System\twqRlDO.exe
  C:\Windows\System\twqRlDO.exe
  2⤵
  PID:12688
- C:\Windows\System\yCdxwcX.exe
  C:\Windows\System\yCdxwcX.exe
  2⤵
  PID:13272
- C:\Windows\System\CcwJeSU.exe
  C:\Windows\System\CcwJeSU.exe
  2⤵
  PID:14928
- C:\Windows\System\YFWqMWl.exe
  C:\Windows\System\YFWqMWl.exe
  2⤵
  PID:15272
- C:\Windows\System\AxHUKeX.exe
  C:\Windows\System\AxHUKeX.exe
  2⤵
  PID:5508
- C:\Windows\System\IoxYCaz.exe
  C:\Windows\System\IoxYCaz.exe
  2⤵
  PID:11896
- C:\Windows\System\ssyoHDn.exe
  C:\Windows\System\ssyoHDn.exe
  2⤵
  PID:13140
- C:\Windows\System\PXEyZOw.exe
  C:\Windows\System\PXEyZOw.exe
  2⤵
  PID:3148
- C:\Windows\System\dEwjaNs.exe
  C:\Windows\System\dEwjaNs.exe
  2⤵
  PID:11268
- C:\Windows\System\VLDlRHr.exe
  C:\Windows\System\VLDlRHr.exe
  2⤵
  PID:12652
- C:\Windows\System\OBWJbxb.exe
  C:\Windows\System\OBWJbxb.exe
  2⤵
  PID:13156
- C:\Windows\System\TyyExOT.exe
  C:\Windows\System\TyyExOT.exe
  2⤵
  PID:3432
- C:\Windows\System\swfyVtq.exe
  C:\Windows\System\swfyVtq.exe
  2⤵
  PID:15088
- C:\Windows\System\piSkewj.exe
  C:\Windows\System\piSkewj.exe
  2⤵
  PID:11112
- C:\Windows\System\lsNWOdC.exe
  C:\Windows\System\lsNWOdC.exe
  2⤵
  PID:12816
- C:\Windows\System\dlHFLfv.exe
  C:\Windows\System\dlHFLfv.exe
  2⤵
  PID:5392
- C:\Windows\System\hMKKXUY.exe
  C:\Windows\System\hMKKXUY.exe
  2⤵
  PID:2580
- C:\Windows\System\PFEWaNC.exe
  C:\Windows\System\PFEWaNC.exe
  2⤵
  PID:4532
- C:\Windows\System\UEmzuPY.exe
  C:\Windows\System\UEmzuPY.exe
  2⤵
  PID:7064
- C:\Windows\System\hYvYxcC.exe
  C:\Windows\System\hYvYxcC.exe
  2⤵
  PID:11460
- C:\Windows\System\SaaNNeV.exe
  C:\Windows\System\SaaNNeV.exe
  2⤵
  PID:14460
- C:\Windows\System\bIlxmLs.exe
  C:\Windows\System\bIlxmLs.exe
  2⤵
  PID:12920
- C:\Windows\System\miShvZa.exe
  C:\Windows\System\miShvZa.exe
  2⤵
  PID:11384
- C:\Windows\System\yWjDGyI.exe
  C:\Windows\System\yWjDGyI.exe
  2⤵
  PID:2800
- C:\Windows\System\VrkOSNL.exe
  C:\Windows\System\VrkOSNL.exe
  2⤵
  PID:13448
- C:\Windows\System\YSAFqCK.exe
  C:\Windows\System\YSAFqCK.exe
  2⤵
  PID:11724
- C:\Windows\System\yOYwtzM.exe
  C:\Windows\System\yOYwtzM.exe
  2⤵
  PID:9276
- C:\Windows\System\pDpQAcN.exe
  C:\Windows\System\pDpQAcN.exe
  2⤵
  PID:13296
- C:\Windows\System\jOPICFh.exe
  C:\Windows\System\jOPICFh.exe
  2⤵
  PID:9804
- C:\Windows\System\rhrKHWJ.exe
  C:\Windows\System\rhrKHWJ.exe
  2⤵
  PID:13576
- C:\Windows\System\fpgUeAq.exe
  C:\Windows\System\fpgUeAq.exe
  2⤵
  PID:15372
- C:\Windows\System\HqYkvST.exe
  C:\Windows\System\HqYkvST.exe
  2⤵
  PID:15400
- C:\Windows\System\ANSXrID.exe
  C:\Windows\System\ANSXrID.exe
  2⤵
  PID:15416
- C:\Windows\System\PocWjjp.exe
  C:\Windows\System\PocWjjp.exe
  2⤵
  PID:15436
- C:\Windows\System\TqnTBsf.exe
  C:\Windows\System\TqnTBsf.exe
  2⤵
  PID:15456
- C:\Windows\System\rbczqnb.exe
  C:\Windows\System\rbczqnb.exe
  2⤵
  PID:15476
- C:\Windows\System\hpeGqFr.exe
  C:\Windows\System\hpeGqFr.exe
  2⤵
  PID:15500
- C:\Windows\System\YRXWHjg.exe
  C:\Windows\System\YRXWHjg.exe
  2⤵
  PID:15576
- C:\Windows\System\yVnqZxd.exe
  C:\Windows\System\yVnqZxd.exe
  2⤵
  PID:15624
- C:\Windows\System\KfzDOwj.exe
  C:\Windows\System\KfzDOwj.exe
  2⤵
  PID:15700
- C:\Windows\System\XcOfJce.exe
  C:\Windows\System\XcOfJce.exe
  2⤵
  PID:15732
- C:\Windows\System\jPlITRh.exe
  C:\Windows\System\jPlITRh.exe
  2⤵
  PID:15752
- C:\Windows\System\guuiCyo.exe
  C:\Windows\System\guuiCyo.exe
  2⤵
  PID:15780
- C:\Windows\System\JVblUwY.exe
  C:\Windows\System\JVblUwY.exe
  2⤵
  PID:15796
- C:\Windows\System\JTRvUET.exe
  C:\Windows\System\JTRvUET.exe
  2⤵
  PID:15816
- C:\Windows\System\BWWdfZv.exe
  C:\Windows\System\BWWdfZv.exe
  2⤵
  PID:15832
- C:\Windows\System\cTiwVYr.exe
  C:\Windows\System\cTiwVYr.exe
  2⤵
  PID:15856
- C:\Windows\System\CbHaidL.exe
  C:\Windows\System\CbHaidL.exe
  2⤵
  PID:15876
- C:\Windows\System\JrKvlZC.exe
  C:\Windows\System\JrKvlZC.exe
  2⤵
  PID:15904
- C:\Windows\System\xkIPdks.exe
  C:\Windows\System\xkIPdks.exe
  2⤵
  PID:15924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:12476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hrqkr0t0.hgl.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BKibLHl.exe

Filesize
2.1MB

MD5
231f1072c2149e63e5b80f2f5bf4627b

SHA1
8d9ec100e50e5db334d6c0bf7c12c802670518bc

SHA256
f1df8ddad27f4c67f3ef0539b2679b0798373bf54868a91f40d5b50e442e3cd7

SHA512
006e1052e239b6f43bfbf7bbb710d3fab54b1b0d6538bf05585f5fd767c91bbe6ddea2c0e4515a7a4467f998d573a907fefd5c5a1fe2f1c24811974db7dcb045

Download Submit
C:\Windows\System\DAJuTRr.exe

Filesize
2.1MB

MD5
3d4b724c1f3182cfb40d1521149d1a52

SHA1
f9910fe1f2b3a214eee5654ac5d4f28334feec43

SHA256
15da3f37caec3fe0cf2c1c8b325df22dab8c1c36f3ce7358f2bcfecd22472174

SHA512
353e9f9fc6844d53adb87b5e34626ce8d6d137be4e1ea6d31a3cd040e229ec817f81d9febc8ad735407eb8632f0b30aafd6b6459c42d7db5d1253031486efbdc

Download Submit
C:\Windows\System\DmusiyA.exe

Filesize
2.1MB

MD5
b5997e207977611799d3d6b8f66b4f6c

SHA1
aa8b934f87988e342be816e5952cc25b4a0c621c

SHA256
cd3dff8b79ea2ac19d6d0b0e1ba455b6d4146a5c7b9011f1789bf6687478919a

SHA512
cb96f8151a56d087142c9c0d55a03bd7abf972949ee3d726d31513aa10f08512a02e20c9d834f95adb0ba3538b2c902a925d73800aa4bdae9b9a5f751cc14aec

Download Submit
C:\Windows\System\EwHXyxe.exe

Filesize
2.1MB

MD5
299c5872f7e93214c2d372c55ed7bfaa

SHA1
4d91dc16c91ecbf3620a99b60b92e01c1e336465

SHA256
146af1b94c6d74fe927a83597ed5e5435017bb339fc8d498bace024d2192cac1

SHA512
5a4b5a88a142c8347de9b7a34263dec3de48a6842b9aeff9fddefeeb495302d89f0fdb0df875fb5a96565a1f6501d2256ac84b9ac4b37f0a3a4af9e0cf44a1e7

Download Submit
C:\Windows\System\GmHMnPq.exe

Filesize
2.1MB

MD5
de0a4519d5fd90b491b8e047a4dd8c71

SHA1
1825797d4b97d51958e2445dd6ae884e01d046e1

SHA256
579bfbe6e2c441e86a9c7d29a20efcc7132d93cdd39f1f083456a0242d3dddce

SHA512
dce0605ef3506ab725719c1affa3bdebfa69ad99d62fa63b835ca08dbbe14e8977e254f8ab3247e858c09310ab51198f7dd03838a178422340452f1c545609fa

Download Submit
C:\Windows\System\InFPWsz.exe

Filesize
2.1MB

MD5
4e648f6c2ee06a99cb542359433fc31d

SHA1
a1ab0b8226370c692e717de64ed36025d6d71df0

SHA256
6fa35843978df8ae73b3367263dbf170a220c41c213556430bb82f7328aa9d33

SHA512
310b6b64e2fb9916541f3eae1b5315f256c5b0c47b42bafdb95267a83af93ff648439fc5ec8ad2cb156ad96604c5a2343e61b057f83280cbc1247d2195dbeeb8

Download Submit
C:\Windows\System\KMnMgGo.exe

Filesize
2.1MB

MD5
7c9e1aea4690b100d9a92cfa8a963be6

SHA1
b93dc916b7ace4cb1531dc241a1621344c3206f0

SHA256
aeace97fa3adfeb5b603132589f575ba0ffa49f7faeb6e7da259717e4b71cf87

SHA512
3725133ba70addbc491bc4223eced66ed3799cf908a98bc3092b604444152860f3d6c35966ae83e03c72bd7aae2f7b93f9cb2c5f848e21a3831a1b7f13ecfee4

Download Submit
C:\Windows\System\KRZEsKW.exe

Filesize
2.1MB

MD5
8ed47e4c9b9fee9e51752421c56122f9

SHA1
fffedfacd8bcd420dbdcc54caa2b0c9ccfbae1ff

SHA256
40b68699670f7a7aa541c5629d5d09dd11c24aec2938051a77d17c59850d1778

SHA512
e2260fea4e4a51d41a86fb1970453f1a54e9298e575666190a255daf0730d0b3831ad5df7c312cfea14e4a5734456eabc8f0bfe811a346fe51d4fa14e5431053

Download Submit
C:\Windows\System\PlOLpEB.exe

Filesize
2.1MB

MD5
b364ade14d51cb167a2943b61580c823

SHA1
b35b476f5495e657db1d5ae3eb6a3804e575bc57

SHA256
059d3c49e07dba2cf5eac92fae7837e186d4f3e0eba02c629dee124e868285ac

SHA512
72d43f72a5ac66359bdc6b412369c825332d0a3e647090b071ad396c2a017d6dc8879d0faee37a1af5152aa6c97c3051fdbbb79952b6ed4996da4be948b516c8

Download Submit
C:\Windows\System\SGNfXry.exe

Filesize
2.1MB

MD5
65598f3facc4818136e478a24c119965

SHA1
d0ef91707be947a2f33cd332ae0a1915363253f5

SHA256
ebce80c20a25c90346d43a210af8a7800cc9ad9c1d5a9d269bad37dd336ca830

SHA512
2d9ae53bd82855810f5a18c76eea4111833d0b7bb40a9c19e3ee2e4b602564bea0184a58ce7084c7820cea94f628ca83af020caaec53394736662c034674da47

Download Submit
C:\Windows\System\SthECgN.exe

Filesize
2.1MB

MD5
6c50d04af1a8d62e57423a1bf4df3f7b

SHA1
aa3e524b6e6951815b1b2cf581c24878815b2336

SHA256
0277036278bd93ab00f5bb2fdb5992011110e7e703e7c371a4ba3abc15e037b8

SHA512
2e4c21aba70b4f7928f23bc6904d85a6a524abcef5ebe6dfaa29771bb6a0b7e4be407c3f0d487f2cf28b5bde9b53aa7003ac2d6b7c0352136c3276644016c01b

Download Submit
C:\Windows\System\UpBsRFl.exe

Filesize
2.1MB

MD5
42ce4b52f61b0b2af6077607b86b713a

SHA1
91415e13fd0c9a9a8dae612acd44f40d44416311

SHA256
10fbb3d32ef22c46feafdf59e8a2ba864f0e32626b8092750977db7598ef5549

SHA512
7d6605c233e2cf40466552d225a0b174284ace6ba7676dab0e29f83ecdf23c47e906d124483936cdeec2ee14c5c870bd538a655bc904027b0616b6b3bff4934f

Download Submit
C:\Windows\System\UpQGvSZ.exe

Filesize
2.1MB

MD5
0cb8e4b5ba4067fcdc7e5a552bb4bdac

SHA1
d843b57088f558c31da7ce5194cd5f05bd7dcdac

SHA256
563a9673999cb27d5822e9cb161e7f4a87cd246a6a0a89a23f1185d266cb1cb8

SHA512
80f63be92edbf771b97eef8a779c6c4e19c6b0a8961fcb7655c27b2f757315b10e8063c744a78fe3764ddbb91a297d53c43f4296bd45f3ad7be1993f172f3d26

Download Submit
C:\Windows\System\VpfuhuZ.exe

Filesize
2.1MB

MD5
e8a0fba868e93d1961ef8a0c06a28646

SHA1
5f58c986d47cc6ff834e7d22ff8f1cdf2fc85118

SHA256
9b4468d7fff6986c21c45febfbdf84df5dcaf3c31cc2dc17ab4481f255e6ea6a

SHA512
6a74430dd8d71c43106fbad263c1a6ea43fe8411dc9b46656ed7c1a7436d6d19d6c003cb081bcd25799bc0ddae041348c047670ea5135be34fbaa66024539e8a

Download Submit
C:\Windows\System\aaQIcip.exe

Filesize
2.1MB

MD5
8c3fda39ca4eca67cf34a1f42aa1bd47

SHA1
f1b3ed2b225ca26317edf2aabeca59267cf55ad3

SHA256
780e4cb124d91290a6a690e32e61f414c1a0ecdd63c42b5cfe0662f8cd049297

SHA512
1f506823f6007c210c1488f5d54974be2bf28b3cec0fb8f91e497b94cb15657ba79be910546936a9de86390835ec0058df05dd7ca021ea792d5a3333f482ee49

Download Submit
C:\Windows\System\bDoTIxB.exe

Filesize
2.1MB

MD5
6bc47f08da6deddb2ed5850d321eb727

SHA1
730184ea4db0dcca81de86112ecab08bb77ba060

SHA256
da8c5f2318a772f63dba293e589c67796ce63377e649d8669915b93df2449c4f

SHA512
0b14554069592574b9e47953a0e819f5f708b5a706b3b347cb15d3b8ba460b1fbaec0c56b4e1211badaab5ff3942f1c6467ec69086f9ff0c329f060277388513

Download Submit
C:\Windows\System\eOCjKZP.exe

Filesize
2.1MB

MD5
8074176a9953d940b450bf9bc1528162

SHA1
69edf97c84c6a75c4d5156eeaac1edbcca757f42

SHA256
cdf575653a084f65591d4f4f10b4f5d8f06a16209a18bef1d2a399db7e0aad6f

SHA512
ce727e25adc80dec5decdec52a4d292706b945afaa746187a34a5e8bffa5767b10a310eb4e28def5fedcc12cd161c37fe6d6f21a0038cbda8c3baa69b9373bf5

Download Submit
C:\Windows\System\fbONxkd.exe

Filesize
2.1MB

MD5
e9f1b03eec724ecdccfd2953eb1af6a1

SHA1
aca439e95ff131f2bf7046d65660711000ec56cd

SHA256
49d1739d115a1c47dc72920ec90a48eb3dbce3bc0a0f5d0a84fbd618d42ba3e2

SHA512
03a5d015a022c05b65ae27561fa5c46794d275d40c713ea540cc835e0ced34888356b7a53627c0c0a95f789cb33fcf95fded6392ea8eb20b8a393e6dd8fbca29

Download Submit
C:\Windows\System\gagYJBY.exe

Filesize
2.1MB

MD5
afc3c9236aa92557d02804f6154a1ac4

SHA1
1bdeac670c99b60ff832e09771fd8e119e29b361

SHA256
1cd295e80a6b88ac19511de4c542a0368626037f06489a4e4ddd81bf48fe6735

SHA512
cc25b3c3540759349f58f3a0f5d0ff7586c1bacbc558c361b2601e673abbe103cf203ab2cab08f5e0c1a51d60b2b0f580e43a178f33b8b8012b9a9ce39da5023

Download Submit
C:\Windows\System\lSKEQOo.exe

Filesize
2.1MB

MD5
7f82571ec552311bb4f2a17582e7f6e7

SHA1
4a90ac2dddb1b53430627eecc57fa3ec194f7300

SHA256
21e562a8dbd0768defe2dae4562a03fde0c19af95a006987494a3a92efe4524e

SHA512
5f058ca6cc7f98fd4c8770de136f40bc1ec01e59cca6766b82d8069e8a571efca57bd847f02c97f711c69338a306a3a48850ebcfe203fb95ee61741053bc4498

Download Submit
C:\Windows\System\lZynKTq.exe

Filesize
2.1MB

MD5
a9398099fd511517dafba0be6e64842a

SHA1
4d91e60a3e1b6781ae9fda83f4dcccc049f9eacc

SHA256
f043593a7250885747c4d5f5ce5f71c5585ad61b8793b4b8e1557eb6b96b1de0

SHA512
80a166f4cefde4fbfb6fb97fa2353bb9e049b0e5ce9049bb4f33d88d2c0aa3af3fdd7c646f0d87ec69e5f206810cb0d16c5a3d7b71f4c7aea90bc35e8a636998

Download Submit
C:\Windows\System\lxOHOby.exe

Filesize
2.1MB

MD5
f6b081064f138162ebff0d5a7821316b

SHA1
c0bc75d54c6ca6232b69782c3d59cc324c71eac4

SHA256
eb4ac7cf6f307374fbcf90bcb995e4738d43c0a60913a9f3d1dcb827bed86c51

SHA512
025e99f577b4c522b8c84623a1c9c1fe31b94b5f16bf8b8c6d8fb6aa832383a27a397c40a8aed36caf1135e6127d773e3933dd9e488ea7a6864b7ae0abdee5db

Download Submit
C:\Windows\System\mOZwCsq.exe

Filesize
2.1MB

MD5
7309e787186ccd3b4b8d9d29d10cbdd6

SHA1
c4161842cdeeb03fc68033037f1e41e8e42af6cc

SHA256
48d3495e2fb7ba3200ad6a30069757326fe47fb9ade1763602a4206e09115f16

SHA512
ed1bc3fd7e098b84a1277c534439bb708024dcf72153de2b1b8e72f0a6d5ce4f852ab05e8123246534d172b03212ea61e4495d6c41d79a61aa1254fb2b090768

Download Submit
C:\Windows\System\oFUSWZD.exe

Filesize
2.1MB

MD5
d73903ae55a08b6180b4f0befffb5f11

SHA1
75e26ca0dd1f5c8328899719ea31cece1c3a2dc3

SHA256
1e06bd8c685e5cb3f5c32ddc52688603f97c7384733da37ed11709b1d0be18c3

SHA512
f3e480a0ef5eb66eb81a2da9ad3ad25802e9a37bbee364bbe2527a4ab73b7807fafbdcebc0662b0564194c792a7d3f6b1b89c9ab2e5e618dce7f50d02e2fdec9

Download Submit
C:\Windows\System\oUiWnLh.exe

Filesize
2.1MB

MD5
c6b0d44c46732e938e9edba043c49a81

SHA1
e6fc58e0537f47d4fab2ee8f25863beced761a70

SHA256
e0fed655b61d5cd051a9f6c6dd2e7f83d816d37836ceb091c9907dc6776507d7

SHA512
7bd9260c36d99e1a69e9a868ff7506a63cadf6c71d13ddbc1fdb7f5753bba20dfff3b82f6256dd2dbfff499dd59b2cd22b8cff4c7285d396a1e5780cb6a984b3

Download Submit
C:\Windows\System\rkLgJfC.exe

Filesize
2.1MB

MD5
2ac103ee70b607ea09bc7c51f3c1b379

SHA1
33215a05e79f8f4409e2326e07f0acc7d98cb454

SHA256
ecda8c9ade5e9dad45ef563af9191ecb4ccd314bde4afec07a6cf8c5e70689cd

SHA512
37d63e06bb4b97e82800c28dadefdfe2ef8b28b249c92325aefe7b24dc8e9b21e60cc956a7bd1f798f202beea76af820fcf08dda2934eac5b145215944036046

Download Submit
C:\Windows\System\tCOYtXq.exe

Filesize
2.1MB

MD5
7b3e91d0d3ee513c6b15f2bf918d3be6

SHA1
69f708dd81593d0b891283c979d678de397510f9

SHA256
78f95dfbb10c5f91642893a4bfd3c28d71bd2af5980389e77ea04070fba7e769

SHA512
05f14b22a7338ad5fa8882304426e9b32fc8f2e739e137d7d47f2829e221f73e53ef011f2942d991931d5ebecb0b8a2c836714de3c41dda1d76b97ee81aafd70

Download Submit
C:\Windows\System\vGZgIUe.exe

Filesize
2.1MB

MD5
8649a96c71a4414e0217d16b1517cb40

SHA1
94646387b4ba92ff9c10e75424d0939dff22fd29

SHA256
fc13e2b1fc1f3b6cbc32868ce035234cfddb7c2ce33879de0323dee10a6f93bf

SHA512
062545b92773c41354aad5976e6497eb20d2052d803465e4b4256b993c078145e9f03a2b2b346f9178daee7d6b36ef56b95ba9de23f5cbe0fc52092741e88fe4

Download Submit
C:\Windows\System\vNIiJoT.exe

Filesize
2.1MB

MD5
9095c4fc9695b92050a3fdfb8d47b796

SHA1
fb203fb429d38bfd962b26ac633634baa6ee7228

SHA256
e3552f8ca509c394f22594f72958457541dafce66e5f02b954907b05389c69ad

SHA512
eefdae5658cba7455d5c8ef3fee344090e7a00751d3546415d00e86a11adcca6576702e22942401e3b0593f312ec0aedf76d015edb84e2fc0ba8275c69bb462e

Download Submit
C:\Windows\System\vjbayPS.exe

Filesize
2.1MB

MD5
0e2207c772db4ee2d0040063eec0d7c1

SHA1
8bd4e80b77bdac4093f0c594395de447e5aa2502

SHA256
6c9f6d8bf082b7d38833ff4e47ac7239b40efca72ee356873d9272c7c6481f7c

SHA512
f97b2ff744c666609066c50fc1a8349f0b8187198ecc4842ab26053e15a037060393900fba208fede2243336862944624ea6ddc947ea1305faf053683f26e99a

Download Submit
C:\Windows\System\yKvRUNO.exe

Filesize
2.1MB

MD5
1159e47db8c719820bbd0e45783bbe14

SHA1
dca87c4709c7d7b3bbfc52cf36e0ce7973eaeb93

SHA256
eb36384a4a2e58617641fa5dbcd3895a25f46ad50eba0b5ee1055f37da3bcfef

SHA512
0102f7e209e241ed6ef435afadde380862d36fc54ded7992f14695674b82e07d14a7e5c80dc776f1e8118daee617a974e39e9858cbc32149d391147f337ad0b4

Download Submit
C:\Windows\System\zSbMrSO.exe

Filesize
2.1MB

MD5
eeb193d0307d39c3aca1ec9e2c2fcf24

SHA1
2e396187e39872ce8007df843526cecd0f0aaad9

SHA256
2dc820fd62887133948f2f518f8add8db2cb8933c9647e7d205d9b481cfb3b33

SHA512
5fa3fc1ff9e4dc6226816561b422b9fae2f8d01490eff67ecbfb3727d1f5787ad331b5da0f6690b033365f5b806dd4bcdde7cee273d01d99c431243770f55db5

Download Submit
memory/112-126-0x00007FF63E330000-0x00007FF63E722000-memory.dmp

Filesize
3.9MB

Download
memory/112-1-0x0000029F83280000-0x0000029F83290000-memory.dmp

Filesize
64KB

Download
memory/112-120-0x00007FF63E330000-0x00007FF63E722000-memory.dmp

Filesize
3.9MB

Download
memory/112-0-0x00007FF63E330000-0x00007FF63E722000-memory.dmp

Filesize
3.9MB

Download
memory/220-1629-0x00007FF789220000-0x00007FF789612000-memory.dmp

Filesize
3.9MB

Download
memory/220-54-0x00007FF789220000-0x00007FF789612000-memory.dmp

Filesize
3.9MB

Download
memory/452-249-0x00007FF6B0EF0000-0x00007FF6B12E2000-memory.dmp

Filesize
3.9MB

Download
memory/452-2067-0x00007FF6B0EF0000-0x00007FF6B12E2000-memory.dmp

Filesize
3.9MB

Download
memory/696-1682-0x00007FF602060000-0x00007FF602452000-memory.dmp

Filesize
3.9MB

Download
memory/696-9-0x00007FF602060000-0x00007FF602452000-memory.dmp

Filesize
3.9MB

Download
memory/696-137-0x00007FF602060000-0x00007FF602452000-memory.dmp

Filesize
3.9MB

Download
memory/996-255-0x00007FF68E470000-0x00007FF68E862000-memory.dmp

Filesize
3.9MB

Download
memory/996-2066-0x00007FF68E470000-0x00007FF68E862000-memory.dmp

Filesize
3.9MB

Download
memory/1004-1838-0x00007FF7C7F80000-0x00007FF7C8372000-memory.dmp

Filesize
3.9MB

Download
memory/1004-73-0x00007FF7C7F80000-0x00007FF7C8372000-memory.dmp

Filesize
3.9MB

Download
memory/1208-2027-0x00007FF68DDC0000-0x00007FF68E1B2000-memory.dmp

Filesize
3.9MB

Download
memory/1208-97-0x00007FF68DDC0000-0x00007FF68E1B2000-memory.dmp

Filesize
3.9MB

Download
memory/1212-76-0x00007FF795ED0000-0x00007FF7962C2000-memory.dmp

Filesize
3.9MB

Download
memory/1212-1837-0x00007FF795ED0000-0x00007FF7962C2000-memory.dmp

Filesize
3.9MB

Download
memory/1728-2020-0x00007FF64B670000-0x00007FF64BA62000-memory.dmp

Filesize
3.9MB

Download
memory/1728-87-0x00007FF64B670000-0x00007FF64BA62000-memory.dmp

Filesize
3.9MB

Download
memory/2720-72-0x00007FF728DC0000-0x00007FF7291B2000-memory.dmp

Filesize
3.9MB

Download
memory/2720-1828-0x00007FF728DC0000-0x00007FF7291B2000-memory.dmp

Filesize
3.9MB

Download
memory/3156-88-0x00007FF6CC370000-0x00007FF6CC762000-memory.dmp

Filesize
3.9MB

Download
memory/3228-66-0x00007FF7CAD60000-0x00007FF7CB152000-memory.dmp

Filesize
3.9MB

Download
memory/3228-1773-0x00007FF7CAD60000-0x00007FF7CB152000-memory.dmp

Filesize
3.9MB

Download
memory/3428-125-0x00007FF7E3E90000-0x00007FF7E4282000-memory.dmp

Filesize
3.9MB

Download
memory/3428-2012-0x00007FF7E3E90000-0x00007FF7E4282000-memory.dmp

Filesize
3.9MB

Download
memory/3468-1835-0x00007FF749280000-0x00007FF749672000-memory.dmp

Filesize
3.9MB

Download
memory/3468-70-0x00007FF749280000-0x00007FF749672000-memory.dmp

Filesize
3.9MB

Download
memory/3656-75-0x00007FF7F4D70000-0x00007FF7F5162000-memory.dmp

Filesize
3.9MB

Download
memory/3656-1637-0x00007FF7F4D70000-0x00007FF7F5162000-memory.dmp

Filesize
3.9MB

Download
memory/3660-117-0x00007FF750B20000-0x00007FF750F12000-memory.dmp

Filesize
3.9MB

Download
memory/3660-2019-0x00007FF750B20000-0x00007FF750F12000-memory.dmp

Filesize
3.9MB

Download
memory/3684-169-0x00007FF7ECA30000-0x00007FF7ECE22000-memory.dmp

Filesize
3.9MB

Download
memory/3684-2021-0x00007FF7ECA30000-0x00007FF7ECE22000-memory.dmp

Filesize
3.9MB

Download
memory/3684-77-0x00007FF7ECA30000-0x00007FF7ECE22000-memory.dmp

Filesize
3.9MB

Download
memory/3692-2068-0x00007FF748990000-0x00007FF748D82000-memory.dmp

Filesize
3.9MB

Download
memory/3692-108-0x00007FF748990000-0x00007FF748D82000-memory.dmp

Filesize
3.9MB

Download
memory/3836-2017-0x00007FF734D10000-0x00007FF735102000-memory.dmp

Filesize
3.9MB

Download
memory/3836-154-0x00007FF734D10000-0x00007FF735102000-memory.dmp

Filesize
3.9MB

Download
memory/3992-74-0x00007FFA05EA0000-0x00007FFA06961000-memory.dmp

Filesize
10.8MB

Download
memory/3992-29-0x00000259E5010000-0x00000259E5032000-memory.dmp

Filesize
136KB

Download
memory/3992-3-0x00007FFA05EA3000-0x00007FFA05EA5000-memory.dmp

Filesize
8KB

Download
memory/3992-135-0x00007FFA05EA0000-0x00007FFA06961000-memory.dmp

Filesize
10.8MB

Download
memory/3992-124-0x00000259E5D40000-0x00000259E64E6000-memory.dmp

Filesize
7.6MB

Download
memory/3992-44-0x00007FFA05EA0000-0x00007FFA06961000-memory.dmp

Filesize
10.8MB

Download
memory/3992-156-0x00007FFA05EA0000-0x00007FFA06961000-memory.dmp

Filesize
10.8MB

Download
memory/3992-62-0x00007FFA05EA0000-0x00007FFA06961000-memory.dmp

Filesize
10.8MB

Download
memory/3992-139-0x00007FFA05EA3000-0x00007FFA05EA5000-memory.dmp

Filesize
8KB

Download
memory/3992-441-0x00007FFA05EA0000-0x00007FFA06961000-memory.dmp

Filesize
10.8MB

Download
memory/4184-99-0x00007FF7D3DC0000-0x00007FF7D41B2000-memory.dmp

Filesize
3.9MB

Download
memory/4184-2026-0x00007FF7D3DC0000-0x00007FF7D41B2000-memory.dmp

Filesize
3.9MB

Download
memory/4204-71-0x00007FF643510000-0x00007FF643902000-memory.dmp

Filesize
3.9MB

Download
memory/4204-1830-0x00007FF643510000-0x00007FF643902000-memory.dmp

Filesize
3.9MB

Download
memory/4328-256-0x00007FF66A430000-0x00007FF66A822000-memory.dmp

Filesize
3.9MB

Download
memory/4328-2091-0x00007FF66A430000-0x00007FF66A822000-memory.dmp

Filesize
3.9MB

Download
memory/4412-2069-0x00007FF61B8A0000-0x00007FF61BC92000-memory.dmp

Filesize
3.9MB

Download
memory/4412-160-0x00007FF61B8A0000-0x00007FF61BC92000-memory.dmp

Filesize
3.9MB

Download
memory/4548-246-0x00007FF65D460000-0x00007FF65D852000-memory.dmp

Filesize
3.9MB

Download
memory/4548-2082-0x00007FF65D460000-0x00007FF65D852000-memory.dmp

Filesize
3.9MB

Download
memory/4656-181-0x00007FF7EA370000-0x00007FF7EA762000-memory.dmp

Filesize
3.9MB

Download
memory/4656-2030-0x00007FF7EA370000-0x00007FF7EA762000-memory.dmp

Filesize
3.9MB

Download