xmrig | c01ddf35e43899c6e695226a503e18459212b76a4aaf6b2b059ef5a8234849ee

Analysis

max time kernel
48s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
Size

2.0MB
MD5

9aabb55b4e19c3952fa7c271b30db271
SHA1

7ff8efde7ac733fdc4754db267948b5da824f794
SHA256

c01ddf35e43899c6e695226a503e18459212b76a4aaf6b2b059ef5a8234849ee
SHA512

5b0d0dfd9e7b3b7dd3e0100a2362bc4d289db06add0e6760b542ab203872e3fdab65035a630be1fdb387e154a9bbab9dae5229c0964473b100c19f8944091bc8
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMG:NABO

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/4688-50-0x00007FF6418C0000-0x00007FF641CB2000-memory.dmp	xmrig
behavioral2/memory/2120-61-0x00007FF767ED0000-0x00007FF7682C2000-memory.dmp	xmrig
behavioral2/memory/2532-63-0x00007FF603A00000-0x00007FF603DF2000-memory.dmp	xmrig
behavioral2/memory/1476-64-0x00007FF61AA40000-0x00007FF61AE32000-memory.dmp	xmrig
behavioral2/memory/4048-66-0x00007FF695350000-0x00007FF695742000-memory.dmp	xmrig
behavioral2/memory/2520-72-0x00007FF6B5050000-0x00007FF6B5442000-memory.dmp	xmrig
behavioral2/memory/1028-75-0x00007FF7F8710000-0x00007FF7F8B02000-memory.dmp	xmrig
behavioral2/memory/4916-65-0x00007FF68C890000-0x00007FF68CC82000-memory.dmp	xmrig
behavioral2/memory/1904-267-0x00007FF7D6CE0000-0x00007FF7D70D2000-memory.dmp	xmrig
behavioral2/memory/3468-290-0x00007FF69F5B0000-0x00007FF69F9A2000-memory.dmp	xmrig
behavioral2/memory/4492-293-0x00007FF72AD00000-0x00007FF72B0F2000-memory.dmp	xmrig
behavioral2/memory/728-295-0x00007FF60DD30000-0x00007FF60E122000-memory.dmp	xmrig
behavioral2/memory/2856-297-0x00007FF6D95A0000-0x00007FF6D9992000-memory.dmp	xmrig
behavioral2/memory/3480-299-0x00007FF66BD80000-0x00007FF66C172000-memory.dmp	xmrig
behavioral2/memory/3412-303-0x00007FF7EC3A0000-0x00007FF7EC792000-memory.dmp	xmrig
behavioral2/memory/2956-302-0x00007FF6860E0000-0x00007FF6864D2000-memory.dmp	xmrig
behavioral2/memory/2012-305-0x00007FF7484C0000-0x00007FF7488B2000-memory.dmp	xmrig
behavioral2/memory/3116-309-0x00007FF6B6A90000-0x00007FF6B6E82000-memory.dmp	xmrig
behavioral2/memory/3260-304-0x00007FF6D6E50000-0x00007FF6D7242000-memory.dmp	xmrig
behavioral2/memory/500-301-0x00007FF6A0AB0000-0x00007FF6A0EA2000-memory.dmp	xmrig
behavioral2/memory/4948-298-0x00007FF7887B0000-0x00007FF788BA2000-memory.dmp	xmrig
behavioral2/memory/3796-296-0x00007FF79C830000-0x00007FF79CC22000-memory.dmp	xmrig
behavioral2/memory/2968-294-0x00007FF60B520000-0x00007FF60B912000-memory.dmp	xmrig
behavioral2/memory/4684-51-0x00007FF7CB3A0000-0x00007FF7CB792000-memory.dmp	xmrig
behavioral2/memory/2120-1542-0x00007FF767ED0000-0x00007FF7682C2000-memory.dmp	xmrig
behavioral2/memory/2532-1562-0x00007FF603A00000-0x00007FF603DF2000-memory.dmp	xmrig
behavioral2/memory/4048-1590-0x00007FF695350000-0x00007FF695742000-memory.dmp	xmrig
behavioral2/memory/1476-1588-0x00007FF61AA40000-0x00007FF61AE32000-memory.dmp	xmrig
behavioral2/memory/4916-1565-0x00007FF68C890000-0x00007FF68CC82000-memory.dmp	xmrig
behavioral2/memory/4684-1538-0x00007FF7CB3A0000-0x00007FF7CB792000-memory.dmp	xmrig
behavioral2/memory/4688-1478-0x00007FF6418C0000-0x00007FF641CB2000-memory.dmp	xmrig
behavioral2/memory/2520-1609-0x00007FF6B5050000-0x00007FF6B5442000-memory.dmp	xmrig
behavioral2/memory/1028-1618-0x00007FF7F8710000-0x00007FF7F8B02000-memory.dmp	xmrig
behavioral2/memory/2968-1636-0x00007FF60B520000-0x00007FF60B912000-memory.dmp	xmrig
behavioral2/memory/3468-1638-0x00007FF69F5B0000-0x00007FF69F9A2000-memory.dmp	xmrig
behavioral2/memory/4492-1637-0x00007FF72AD00000-0x00007FF72B0F2000-memory.dmp	xmrig
behavioral2/memory/3796-1645-0x00007FF79C830000-0x00007FF79CC22000-memory.dmp	xmrig
behavioral2/memory/3480-1673-0x00007FF66BD80000-0x00007FF66C172000-memory.dmp	xmrig
behavioral2/memory/4252-1873-0x00007FF7C6510000-0x00007FF7C6902000-memory.dmp	xmrig
behavioral2/memory/3412-1690-0x00007FF7EC3A0000-0x00007FF7EC792000-memory.dmp	xmrig
behavioral2/memory/3260-1668-0x00007FF6D6E50000-0x00007FF6D7242000-memory.dmp	xmrig
behavioral2/memory/2012-1666-0x00007FF7484C0000-0x00007FF7488B2000-memory.dmp	xmrig
behavioral2/memory/2956-1663-0x00007FF6860E0000-0x00007FF6864D2000-memory.dmp	xmrig
behavioral2/memory/500-1653-0x00007FF6A0AB0000-0x00007FF6A0EA2000-memory.dmp	xmrig
behavioral2/memory/3116-1652-0x00007FF6B6A90000-0x00007FF6B6E82000-memory.dmp	xmrig
behavioral2/memory/4948-1647-0x00007FF7887B0000-0x00007FF788BA2000-memory.dmp	xmrig
behavioral2/memory/2856-1646-0x00007FF6D95A0000-0x00007FF6D9992000-memory.dmp	xmrig
behavioral2/memory/728-1643-0x00007FF60DD30000-0x00007FF60E122000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
5	4940	powershell.exe
9	4940	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4940	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4688	uKcoJVN.exe
4684	KDxhUOn.exe
2120	fdxtwBM.exe
2532	IKHyhZZ.exe
1476	JehbfHv.exe
4916	rPodemx.exe
4048	gUjuasb.exe
2520	wtnoGVU.exe
4252	SHZiSOI.exe
1028	LYornaH.exe
3468	YNjhEWC.exe
4492	NqCrmDr.exe
2968	BdwvWrN.exe
728	nwVWbYg.exe
3796	GuHCoal.exe
2856	ddVAXnp.exe
4948	YurmGko.exe
3480	jHRQsai.exe
500	OxyABYc.exe
2956	qgggoSW.exe
3412	kjCaDrc.exe
3260	GgwZnbF.exe
2012	wdrgABB.exe
3116	ZGpGNIK.exe
556	CXcXlVu.exe
1508	ypfbDGR.exe
1796	YpKOCmC.exe
1396	lqbjSBi.exe
3908	yAICsjj.exe
1128	tEzUcWt.exe
2016	JXUugpk.exe
3892	HqmAXrU.exe
1660	xwVGJoe.exe
3856	eWrrwDD.exe
1808	SkErhfM.exe
3952	KuxnNYB.exe
3428	qDpAnqM.exe
4312	OhNzxBx.exe
116	XGuSedY.exe
4924	VsQnWjI.exe
4732	vRymupL.exe
2840	vfJbvIR.exe
4468	sOXRCFL.exe
3392	KFCmSjA.exe
3592	FXDDZZu.exe
1008	QIlEWIx.exe
4584	uGbSSEt.exe
4808	kqUiUYb.exe
4680	psBObFn.exe
4528	EBBMdYt.exe
1568	nbcabLo.exe
3968	qxnBNom.exe
3780	NfoHKEn.exe
3552	imtqisi.exe
3076	GFSAlzY.exe
2912	yPEzpKN.exe
1688	fdjOwyl.exe
2972	VrrSedt.exe
2828	UwWGOSV.exe
3596	OkWuqvo.exe
4148	mVkGvie.exe
2448	DnVxzeS.exe
2476	PDwfgeQ.exe
2868	FPyLQux.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1904-0-0x00007FF7D6CE0000-0x00007FF7D70D2000-memory.dmp	upx
behavioral2/files/0x0008000000023244-6.dat	upx
behavioral2/files/0x0008000000023247-19.dat	upx
behavioral2/files/0x000800000002324c-18.dat	upx
behavioral2/files/0x0009000000023248-29.dat	upx
behavioral2/files/0x000900000002324b-36.dat	upx
behavioral2/files/0x000700000002324d-41.dat	upx
behavioral2/files/0x000700000002324e-46.dat	upx
behavioral2/memory/4688-50-0x00007FF6418C0000-0x00007FF641CB2000-memory.dmp	upx
behavioral2/files/0x000700000002324f-54.dat	upx
behavioral2/files/0x0007000000023250-59.dat	upx
behavioral2/memory/2120-61-0x00007FF767ED0000-0x00007FF7682C2000-memory.dmp	upx
behavioral2/memory/2532-63-0x00007FF603A00000-0x00007FF603DF2000-memory.dmp	upx
behavioral2/memory/1476-64-0x00007FF61AA40000-0x00007FF61AE32000-memory.dmp	upx
behavioral2/memory/4252-67-0x00007FF7C6510000-0x00007FF7C6902000-memory.dmp	upx
behavioral2/memory/4048-66-0x00007FF695350000-0x00007FF695742000-memory.dmp	upx
behavioral2/memory/2520-72-0x00007FF6B5050000-0x00007FF6B5442000-memory.dmp	upx
behavioral2/files/0x0007000000023251-73.dat	upx
behavioral2/memory/1028-75-0x00007FF7F8710000-0x00007FF7F8B02000-memory.dmp	upx
behavioral2/memory/4916-65-0x00007FF68C890000-0x00007FF68CC82000-memory.dmp	upx
behavioral2/files/0x0007000000023252-79.dat	upx
behavioral2/files/0x0007000000023257-104.dat	upx
behavioral2/files/0x0007000000023259-114.dat	upx
behavioral2/files/0x000700000002325c-129.dat	upx
behavioral2/files/0x000700000002325e-139.dat	upx
behavioral2/files/0x000700000002325f-144.dat	upx
behavioral2/files/0x0007000000023261-154.dat	upx
behavioral2/files/0x0007000000023264-169.dat	upx
behavioral2/files/0x0007000000023266-179.dat	upx
behavioral2/files/0x0007000000023267-184.dat	upx
behavioral2/memory/1904-267-0x00007FF7D6CE0000-0x00007FF7D70D2000-memory.dmp	upx
behavioral2/memory/3468-290-0x00007FF69F5B0000-0x00007FF69F9A2000-memory.dmp	upx
behavioral2/memory/4492-293-0x00007FF72AD00000-0x00007FF72B0F2000-memory.dmp	upx
behavioral2/memory/728-295-0x00007FF60DD30000-0x00007FF60E122000-memory.dmp	upx
behavioral2/memory/2856-297-0x00007FF6D95A0000-0x00007FF6D9992000-memory.dmp	upx
behavioral2/memory/3480-299-0x00007FF66BD80000-0x00007FF66C172000-memory.dmp	upx
behavioral2/memory/3412-303-0x00007FF7EC3A0000-0x00007FF7EC792000-memory.dmp	upx
behavioral2/memory/2956-302-0x00007FF6860E0000-0x00007FF6864D2000-memory.dmp	upx
behavioral2/memory/2012-305-0x00007FF7484C0000-0x00007FF7488B2000-memory.dmp	upx
behavioral2/memory/3116-309-0x00007FF6B6A90000-0x00007FF6B6E82000-memory.dmp	upx
behavioral2/memory/3260-304-0x00007FF6D6E50000-0x00007FF6D7242000-memory.dmp	upx
behavioral2/memory/500-301-0x00007FF6A0AB0000-0x00007FF6A0EA2000-memory.dmp	upx
behavioral2/memory/4948-298-0x00007FF7887B0000-0x00007FF788BA2000-memory.dmp	upx
behavioral2/memory/3796-296-0x00007FF79C830000-0x00007FF79CC22000-memory.dmp	upx
behavioral2/memory/2968-294-0x00007FF60B520000-0x00007FF60B912000-memory.dmp	upx
behavioral2/files/0x0007000000023265-174.dat	upx
behavioral2/files/0x0007000000023263-164.dat	upx
behavioral2/files/0x0007000000023262-159.dat	upx
behavioral2/files/0x0007000000023260-149.dat	upx
behavioral2/files/0x000700000002325d-134.dat	upx
behavioral2/files/0x000700000002325b-124.dat	upx
behavioral2/files/0x000700000002325a-119.dat	upx
behavioral2/files/0x0007000000023258-109.dat	upx
behavioral2/files/0x0007000000023256-99.dat	upx
behavioral2/files/0x0007000000023255-94.dat	upx
behavioral2/files/0x0007000000023254-89.dat	upx
behavioral2/files/0x0007000000023253-84.dat	upx
behavioral2/memory/4684-51-0x00007FF7CB3A0000-0x00007FF7CB792000-memory.dmp	upx
behavioral2/memory/2120-1542-0x00007FF767ED0000-0x00007FF7682C2000-memory.dmp	upx
behavioral2/memory/2532-1562-0x00007FF603A00000-0x00007FF603DF2000-memory.dmp	upx
behavioral2/memory/4048-1590-0x00007FF695350000-0x00007FF695742000-memory.dmp	upx
behavioral2/memory/1476-1588-0x00007FF61AA40000-0x00007FF61AE32000-memory.dmp	upx
behavioral2/memory/4916-1565-0x00007FF68C890000-0x00007FF68CC82000-memory.dmp	upx
behavioral2/memory/4684-1538-0x00007FF7CB3A0000-0x00007FF7CB792000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
5	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\QfQQXeS.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\gyGpvEE.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\YkGDBmi.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\dYxqgeP.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\cZLwTme.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\zDZuttn.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\czeylJJ.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\bhproPB.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\aNpjtBK.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\yJYOhAU.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\YQQbigX.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\okDYVhC.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\tDERSzi.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\zFjkcxI.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\YBViNtw.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\lqbjSBi.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\aVknTOV.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\trnQzOr.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\aHYEJpP.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\gDJrnxc.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\bVZBjlp.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\hVTrHrg.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\rPodemx.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\QnJGkmn.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\VsQnWjI.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\yPEzpKN.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\fWYenTT.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\glDhchm.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\OhNzxBx.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\rrXVDID.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\JbOucMF.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\MrxLZPU.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\YMlGovU.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\uhjEaXi.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\WwJzTNP.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\XKSiPgd.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\tzMvWai.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\zZiVGQq.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\InIiFrQ.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\TJIdFhg.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\wQMYZfN.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\XPPyvkO.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\plSoDcm.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\dGZSVMC.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\kVPaOnx.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\ddVAXnp.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\ulkuDYJ.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\JRbSACk.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\lHeDaGr.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\LsjoXwu.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\otWytbw.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\uKcoJVN.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\vQKpZOF.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\GgwZnbF.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\nbcabLo.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\IWwxeWm.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\kHMbsZS.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\hWrLsTV.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\AEBOhkD.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\xwVGJoe.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\DzApBlr.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\tpVjkWz.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\gJuuZUY.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
File created	C:\Windows\System\sOXRCFL.exe	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4940	powershell.exe
4940	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
Token: SeDebugPrivilege	4940	powershell.exe
Token: SeLockMemoryPrivilege	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 4940	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	91
PID 1904 wrote to memory of 4940	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	91
PID 1904 wrote to memory of 4688	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	92
PID 1904 wrote to memory of 4688	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	92
PID 1904 wrote to memory of 4684	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	93
PID 1904 wrote to memory of 4684	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	93
PID 1904 wrote to memory of 2120	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	94
PID 1904 wrote to memory of 2120	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	94
PID 1904 wrote to memory of 2532	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	95
PID 1904 wrote to memory of 2532	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	95
PID 1904 wrote to memory of 1476	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	96
PID 1904 wrote to memory of 1476	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	96
PID 1904 wrote to memory of 4916	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	97
PID 1904 wrote to memory of 4916	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	97
PID 1904 wrote to memory of 4048	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	98
PID 1904 wrote to memory of 4048	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	98
PID 1904 wrote to memory of 2520	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	99
PID 1904 wrote to memory of 2520	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	99
PID 1904 wrote to memory of 4252	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	100
PID 1904 wrote to memory of 4252	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	100
PID 1904 wrote to memory of 1028	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	101
PID 1904 wrote to memory of 1028	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	101
PID 1904 wrote to memory of 3468	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	102
PID 1904 wrote to memory of 3468	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	102
PID 1904 wrote to memory of 4492	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	103
PID 1904 wrote to memory of 4492	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	103
PID 1904 wrote to memory of 2968	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	104
PID 1904 wrote to memory of 2968	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	104
PID 1904 wrote to memory of 728	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	105
PID 1904 wrote to memory of 728	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	105
PID 1904 wrote to memory of 3796	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	106
PID 1904 wrote to memory of 3796	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	106
PID 1904 wrote to memory of 2856	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	107
PID 1904 wrote to memory of 2856	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	107
PID 1904 wrote to memory of 4948	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	108
PID 1904 wrote to memory of 4948	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	108
PID 1904 wrote to memory of 3480	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	109
PID 1904 wrote to memory of 3480	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	109
PID 1904 wrote to memory of 500	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	110
PID 1904 wrote to memory of 500	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	110
PID 1904 wrote to memory of 2956	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	111
PID 1904 wrote to memory of 2956	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	111
PID 1904 wrote to memory of 3412	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	112
PID 1904 wrote to memory of 3412	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	112
PID 1904 wrote to memory of 3260	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	113
PID 1904 wrote to memory of 3260	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	113
PID 1904 wrote to memory of 2012	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	114
PID 1904 wrote to memory of 2012	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	114
PID 1904 wrote to memory of 3116	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	115
PID 1904 wrote to memory of 3116	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	115
PID 1904 wrote to memory of 556	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	116
PID 1904 wrote to memory of 556	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	116
PID 1904 wrote to memory of 1508	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	117
PID 1904 wrote to memory of 1508	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	117
PID 1904 wrote to memory of 1796	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	118
PID 1904 wrote to memory of 1796	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	118
PID 1904 wrote to memory of 1396	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	119
PID 1904 wrote to memory of 1396	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	119
PID 1904 wrote to memory of 3908	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	120
PID 1904 wrote to memory of 3908	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	120
PID 1904 wrote to memory of 1128	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	121
PID 1904 wrote to memory of 1128	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	121
PID 1904 wrote to memory of 2016	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	122
PID 1904 wrote to memory of 2016	1904	9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe	122

C:\Users\Admin\AppData\Local\Temp\9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9aabb55b4e19c3952fa7c271b30db271_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4940
- C:\Windows\System\uKcoJVN.exe
  C:\Windows\System\uKcoJVN.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\KDxhUOn.exe
  C:\Windows\System\KDxhUOn.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\fdxtwBM.exe
  C:\Windows\System\fdxtwBM.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\IKHyhZZ.exe
  C:\Windows\System\IKHyhZZ.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\JehbfHv.exe
  C:\Windows\System\JehbfHv.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\rPodemx.exe
  C:\Windows\System\rPodemx.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\gUjuasb.exe
  C:\Windows\System\gUjuasb.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\wtnoGVU.exe
  C:\Windows\System\wtnoGVU.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\SHZiSOI.exe
  C:\Windows\System\SHZiSOI.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\LYornaH.exe
  C:\Windows\System\LYornaH.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\YNjhEWC.exe
  C:\Windows\System\YNjhEWC.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\NqCrmDr.exe
  C:\Windows\System\NqCrmDr.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\BdwvWrN.exe
  C:\Windows\System\BdwvWrN.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\nwVWbYg.exe
  C:\Windows\System\nwVWbYg.exe
  2⤵
  - Executes dropped EXE
  PID:728
- C:\Windows\System\GuHCoal.exe
  C:\Windows\System\GuHCoal.exe
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Windows\System\ddVAXnp.exe
  C:\Windows\System\ddVAXnp.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\YurmGko.exe
  C:\Windows\System\YurmGko.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\jHRQsai.exe
  C:\Windows\System\jHRQsai.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\OxyABYc.exe
  C:\Windows\System\OxyABYc.exe
  2⤵
  - Executes dropped EXE
  PID:500
- C:\Windows\System\qgggoSW.exe
  C:\Windows\System\qgggoSW.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\kjCaDrc.exe
  C:\Windows\System\kjCaDrc.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\GgwZnbF.exe
  C:\Windows\System\GgwZnbF.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\wdrgABB.exe
  C:\Windows\System\wdrgABB.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\ZGpGNIK.exe
  C:\Windows\System\ZGpGNIK.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\CXcXlVu.exe
  C:\Windows\System\CXcXlVu.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\ypfbDGR.exe
  C:\Windows\System\ypfbDGR.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\YpKOCmC.exe
  C:\Windows\System\YpKOCmC.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\lqbjSBi.exe
  C:\Windows\System\lqbjSBi.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\yAICsjj.exe
  C:\Windows\System\yAICsjj.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\tEzUcWt.exe
  C:\Windows\System\tEzUcWt.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\JXUugpk.exe
  C:\Windows\System\JXUugpk.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\HqmAXrU.exe
  C:\Windows\System\HqmAXrU.exe
  2⤵
  - Executes dropped EXE
  PID:3892
- C:\Windows\System\xwVGJoe.exe
  C:\Windows\System\xwVGJoe.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\eWrrwDD.exe
  C:\Windows\System\eWrrwDD.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\SkErhfM.exe
  C:\Windows\System\SkErhfM.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\KuxnNYB.exe
  C:\Windows\System\KuxnNYB.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\qDpAnqM.exe
  C:\Windows\System\qDpAnqM.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\OhNzxBx.exe
  C:\Windows\System\OhNzxBx.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\XGuSedY.exe
  C:\Windows\System\XGuSedY.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\VsQnWjI.exe
  C:\Windows\System\VsQnWjI.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\vRymupL.exe
  C:\Windows\System\vRymupL.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\vfJbvIR.exe
  C:\Windows\System\vfJbvIR.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\sOXRCFL.exe
  C:\Windows\System\sOXRCFL.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\KFCmSjA.exe
  C:\Windows\System\KFCmSjA.exe
  2⤵
  - Executes dropped EXE
  PID:3392
- C:\Windows\System\FXDDZZu.exe
  C:\Windows\System\FXDDZZu.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\QIlEWIx.exe
  C:\Windows\System\QIlEWIx.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\uGbSSEt.exe
  C:\Windows\System\uGbSSEt.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\kqUiUYb.exe
  C:\Windows\System\kqUiUYb.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\psBObFn.exe
  C:\Windows\System\psBObFn.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\EBBMdYt.exe
  C:\Windows\System\EBBMdYt.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\nbcabLo.exe
  C:\Windows\System\nbcabLo.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\qxnBNom.exe
  C:\Windows\System\qxnBNom.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\NfoHKEn.exe
  C:\Windows\System\NfoHKEn.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System\imtqisi.exe
  C:\Windows\System\imtqisi.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\GFSAlzY.exe
  C:\Windows\System\GFSAlzY.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\yPEzpKN.exe
  C:\Windows\System\yPEzpKN.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\fdjOwyl.exe
  C:\Windows\System\fdjOwyl.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\VrrSedt.exe
  C:\Windows\System\VrrSedt.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\UwWGOSV.exe
  C:\Windows\System\UwWGOSV.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\OkWuqvo.exe
  C:\Windows\System\OkWuqvo.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\mVkGvie.exe
  C:\Windows\System\mVkGvie.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\PDwfgeQ.exe
  C:\Windows\System\PDwfgeQ.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\DnVxzeS.exe
  C:\Windows\System\DnVxzeS.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\FPyLQux.exe
  C:\Windows\System\FPyLQux.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\EOAhUIs.exe
  C:\Windows\System\EOAhUIs.exe
  2⤵
  PID:4136
- C:\Windows\System\wGyTeKB.exe
  C:\Windows\System\wGyTeKB.exe
  2⤵
  PID:1068
- C:\Windows\System\YFArriv.exe
  C:\Windows\System\YFArriv.exe
  2⤵
  PID:1900
- C:\Windows\System\nPdqmMC.exe
  C:\Windows\System\nPdqmMC.exe
  2⤵
  PID:2024
- C:\Windows\System\EsRHTWP.exe
  C:\Windows\System\EsRHTWP.exe
  2⤵
  PID:1240
- C:\Windows\System\hAXfylW.exe
  C:\Windows\System\hAXfylW.exe
  2⤵
  PID:3512
- C:\Windows\System\WwmSIOM.exe
  C:\Windows\System\WwmSIOM.exe
  2⤵
  PID:4920
- C:\Windows\System\SCIqMho.exe
  C:\Windows\System\SCIqMho.exe
  2⤵
  PID:5148
- C:\Windows\System\ilxdRhg.exe
  C:\Windows\System\ilxdRhg.exe
  2⤵
  PID:5168
- C:\Windows\System\WXWfptP.exe
  C:\Windows\System\WXWfptP.exe
  2⤵
  PID:5188
- C:\Windows\System\ueuiriX.exe
  C:\Windows\System\ueuiriX.exe
  2⤵
  PID:5212
- C:\Windows\System\pefTMDY.exe
  C:\Windows\System\pefTMDY.exe
  2⤵
  PID:5240
- C:\Windows\System\czeylJJ.exe
  C:\Windows\System\czeylJJ.exe
  2⤵
  PID:5336
- C:\Windows\System\uKXtIZc.exe
  C:\Windows\System\uKXtIZc.exe
  2⤵
  PID:5352
- C:\Windows\System\JRbSACk.exe
  C:\Windows\System\JRbSACk.exe
  2⤵
  PID:5376
- C:\Windows\System\dFYMPIN.exe
  C:\Windows\System\dFYMPIN.exe
  2⤵
  PID:5396
- C:\Windows\System\jAvqMFx.exe
  C:\Windows\System\jAvqMFx.exe
  2⤵
  PID:5452
- C:\Windows\System\BNHFEtx.exe
  C:\Windows\System\BNHFEtx.exe
  2⤵
  PID:5472
- C:\Windows\System\oEsUUxC.exe
  C:\Windows\System\oEsUUxC.exe
  2⤵
  PID:5496
- C:\Windows\System\cNKmGWP.exe
  C:\Windows\System\cNKmGWP.exe
  2⤵
  PID:5520
- C:\Windows\System\plSoDcm.exe
  C:\Windows\System\plSoDcm.exe
  2⤵
  PID:5544
- C:\Windows\System\gTOXmIj.exe
  C:\Windows\System\gTOXmIj.exe
  2⤵
  PID:5564
- C:\Windows\System\RTxndXE.exe
  C:\Windows\System\RTxndXE.exe
  2⤵
  PID:5580
- C:\Windows\System\WlgbxeD.exe
  C:\Windows\System\WlgbxeD.exe
  2⤵
  PID:5608
- C:\Windows\System\InIiFrQ.exe
  C:\Windows\System\InIiFrQ.exe
  2⤵
  PID:5672
- C:\Windows\System\mEjMlMy.exe
  C:\Windows\System\mEjMlMy.exe
  2⤵
  PID:5696
- C:\Windows\System\zFjkcxI.exe
  C:\Windows\System\zFjkcxI.exe
  2⤵
  PID:5724
- C:\Windows\System\HMoYEFK.exe
  C:\Windows\System\HMoYEFK.exe
  2⤵
  PID:5752
- C:\Windows\System\oxohAQe.exe
  C:\Windows\System\oxohAQe.exe
  2⤵
  PID:5768
- C:\Windows\System\tpVjkWz.exe
  C:\Windows\System\tpVjkWz.exe
  2⤵
  PID:5792
- C:\Windows\System\JHnVkYp.exe
  C:\Windows\System\JHnVkYp.exe
  2⤵
  PID:5844
- C:\Windows\System\dYxqgeP.exe
  C:\Windows\System\dYxqgeP.exe
  2⤵
  PID:5864
- C:\Windows\System\PBqOgxe.exe
  C:\Windows\System\PBqOgxe.exe
  2⤵
  PID:5888
- C:\Windows\System\JgqCMXv.exe
  C:\Windows\System\JgqCMXv.exe
  2⤵
  PID:5908
- C:\Windows\System\IWwxeWm.exe
  C:\Windows\System\IWwxeWm.exe
  2⤵
  PID:5932
- C:\Windows\System\QovYayY.exe
  C:\Windows\System\QovYayY.exe
  2⤵
  PID:5948
- C:\Windows\System\YdILuaQ.exe
  C:\Windows\System\YdILuaQ.exe
  2⤵
  PID:5968
- C:\Windows\System\bQUlBin.exe
  C:\Windows\System\bQUlBin.exe
  2⤵
  PID:5992
- C:\Windows\System\DZKjmAb.exe
  C:\Windows\System\DZKjmAb.exe
  2⤵
  PID:6024
- C:\Windows\System\TXemlia.exe
  C:\Windows\System\TXemlia.exe
  2⤵
  PID:6048
- C:\Windows\System\VugPsEa.exe
  C:\Windows\System\VugPsEa.exe
  2⤵
  PID:6068
- C:\Windows\System\dGZSVMC.exe
  C:\Windows\System\dGZSVMC.exe
  2⤵
  PID:6084
- C:\Windows\System\NWlZRzw.exe
  C:\Windows\System\NWlZRzw.exe
  2⤵
  PID:6108
- C:\Windows\System\AsQNmIU.exe
  C:\Windows\System\AsQNmIU.exe
  2⤵
  PID:6132
- C:\Windows\System\lHeDaGr.exe
  C:\Windows\System\lHeDaGr.exe
  2⤵
  PID:5128
- C:\Windows\System\YBViNtw.exe
  C:\Windows\System\YBViNtw.exe
  2⤵
  PID:5184
- C:\Windows\System\syXSPTe.exe
  C:\Windows\System\syXSPTe.exe
  2⤵
  PID:5260
- C:\Windows\System\bOGhMzD.exe
  C:\Windows\System\bOGhMzD.exe
  2⤵
  PID:5300
- C:\Windows\System\HzVppAN.exe
  C:\Windows\System\HzVppAN.exe
  2⤵
  PID:5344
- C:\Windows\System\GNRbeiF.exe
  C:\Windows\System\GNRbeiF.exe
  2⤵
  PID:5392
- C:\Windows\System\egLWIHk.exe
  C:\Windows\System\egLWIHk.exe
  2⤵
  PID:5440
- C:\Windows\System\QnJGkmn.exe
  C:\Windows\System\QnJGkmn.exe
  2⤵
  PID:5468
- C:\Windows\System\FOHhSqd.exe
  C:\Windows\System\FOHhSqd.exe
  2⤵
  PID:5528
- C:\Windows\System\QKITSrN.exe
  C:\Windows\System\QKITSrN.exe
  2⤵
  PID:5576
- C:\Windows\System\gCbNZNW.exe
  C:\Windows\System\gCbNZNW.exe
  2⤵
  PID:5636
- C:\Windows\System\PEkluYc.exe
  C:\Windows\System\PEkluYc.exe
  2⤵
  PID:5664
- C:\Windows\System\nMtfntC.exe
  C:\Windows\System\nMtfntC.exe
  2⤵
  PID:5688
- C:\Windows\System\IxiyngS.exe
  C:\Windows\System\IxiyngS.exe
  2⤵
  PID:3788
- C:\Windows\System\ZYibwLz.exe
  C:\Windows\System\ZYibwLz.exe
  2⤵
  PID:5760
- C:\Windows\System\OGsIqka.exe
  C:\Windows\System\OGsIqka.exe
  2⤵
  PID:5740
- C:\Windows\System\lnJxJFc.exe
  C:\Windows\System\lnJxJFc.exe
  2⤵
  PID:5816
- C:\Windows\System\tDERSzi.exe
  C:\Windows\System\tDERSzi.exe
  2⤵
  PID:5880
- C:\Windows\System\KhjXLTc.exe
  C:\Windows\System\KhjXLTc.exe
  2⤵
  PID:5988
- C:\Windows\System\vIBgQTf.exe
  C:\Windows\System\vIBgQTf.exe
  2⤵
  PID:5944
- C:\Windows\System\BEpZXQh.exe
  C:\Windows\System\BEpZXQh.exe
  2⤵
  PID:5984
- C:\Windows\System\QqhbWBY.exe
  C:\Windows\System\QqhbWBY.exe
  2⤵
  PID:6100
- C:\Windows\System\WsNeWJH.exe
  C:\Windows\System\WsNeWJH.exe
  2⤵
  PID:6056
- C:\Windows\System\NSGzQEu.exe
  C:\Windows\System\NSGzQEu.exe
  2⤵
  PID:5360
- C:\Windows\System\IWSxecW.exe
  C:\Windows\System\IWSxecW.exe
  2⤵
  PID:2864
- C:\Windows\System\FsnhGMc.exe
  C:\Windows\System\FsnhGMc.exe
  2⤵
  PID:5488
- C:\Windows\System\UCQVmOb.exe
  C:\Windows\System\UCQVmOb.exe
  2⤵
  PID:5424
- C:\Windows\System\sbLONnd.exe
  C:\Windows\System\sbLONnd.exe
  2⤵
  PID:2252
- C:\Windows\System\NJBwGlV.exe
  C:\Windows\System\NJBwGlV.exe
  2⤵
  PID:5800
- C:\Windows\System\PfKdTCo.exe
  C:\Windows\System\PfKdTCo.exe
  2⤵
  PID:5788
- C:\Windows\System\pvfaKQo.exe
  C:\Windows\System\pvfaKQo.exe
  2⤵
  PID:6156
- C:\Windows\System\pJjUGVo.exe
  C:\Windows\System\pJjUGVo.exe
  2⤵
  PID:6176
- C:\Windows\System\UZvTPdt.exe
  C:\Windows\System\UZvTPdt.exe
  2⤵
  PID:6196
- C:\Windows\System\fCBBZDG.exe
  C:\Windows\System\fCBBZDG.exe
  2⤵
  PID:6212
- C:\Windows\System\SWSlGfe.exe
  C:\Windows\System\SWSlGfe.exe
  2⤵
  PID:6232
- C:\Windows\System\HimRGoZ.exe
  C:\Windows\System\HimRGoZ.exe
  2⤵
  PID:6260
- C:\Windows\System\dczBbXE.exe
  C:\Windows\System\dczBbXE.exe
  2⤵
  PID:6392
- C:\Windows\System\nnMsGDb.exe
  C:\Windows\System\nnMsGDb.exe
  2⤵
  PID:6416
- C:\Windows\System\woFIXxY.exe
  C:\Windows\System\woFIXxY.exe
  2⤵
  PID:6436
- C:\Windows\System\pgdDSWS.exe
  C:\Windows\System\pgdDSWS.exe
  2⤵
  PID:6648
- C:\Windows\System\gVMBDvB.exe
  C:\Windows\System\gVMBDvB.exe
  2⤵
  PID:6676
- C:\Windows\System\uRlIudD.exe
  C:\Windows\System\uRlIudD.exe
  2⤵
  PID:6700
- C:\Windows\System\kHMbsZS.exe
  C:\Windows\System\kHMbsZS.exe
  2⤵
  PID:6720
- C:\Windows\System\YMlGovU.exe
  C:\Windows\System\YMlGovU.exe
  2⤵
  PID:6744
- C:\Windows\System\ZSQwiik.exe
  C:\Windows\System\ZSQwiik.exe
  2⤵
  PID:6764
- C:\Windows\System\jvxWdpH.exe
  C:\Windows\System\jvxWdpH.exe
  2⤵
  PID:6788
- C:\Windows\System\uhjEaXi.exe
  C:\Windows\System\uhjEaXi.exe
  2⤵
  PID:6812
- C:\Windows\System\RdMMvJE.exe
  C:\Windows\System\RdMMvJE.exe
  2⤵
  PID:6832
- C:\Windows\System\vtClUXq.exe
  C:\Windows\System\vtClUXq.exe
  2⤵
  PID:6852
- C:\Windows\System\UIvPKLE.exe
  C:\Windows\System\UIvPKLE.exe
  2⤵
  PID:6876
- C:\Windows\System\jrOnRHk.exe
  C:\Windows\System\jrOnRHk.exe
  2⤵
  PID:6900
- C:\Windows\System\RBvCosG.exe
  C:\Windows\System\RBvCosG.exe
  2⤵
  PID:6920
- C:\Windows\System\gJuuZUY.exe
  C:\Windows\System\gJuuZUY.exe
  2⤵
  PID:6944
- C:\Windows\System\dSeGuRX.exe
  C:\Windows\System\dSeGuRX.exe
  2⤵
  PID:6964
- C:\Windows\System\bQWlyEc.exe
  C:\Windows\System\bQWlyEc.exe
  2⤵
  PID:6980
- C:\Windows\System\ONcoMYE.exe
  C:\Windows\System\ONcoMYE.exe
  2⤵
  PID:7000
- C:\Windows\System\aHYEJpP.exe
  C:\Windows\System\aHYEJpP.exe
  2⤵
  PID:7020
- C:\Windows\System\XpIjizq.exe
  C:\Windows\System\XpIjizq.exe
  2⤵
  PID:7080
- C:\Windows\System\Wyjwjbl.exe
  C:\Windows\System\Wyjwjbl.exe
  2⤵
  PID:7104
- C:\Windows\System\WvzCwXt.exe
  C:\Windows\System\WvzCwXt.exe
  2⤵
  PID:5112
- C:\Windows\System\OpOjIcC.exe
  C:\Windows\System\OpOjIcC.exe
  2⤵
  PID:5364
- C:\Windows\System\crsjSzO.exe
  C:\Windows\System\crsjSzO.exe
  2⤵
  PID:6036
- C:\Windows\System\TkNPfyd.exe
  C:\Windows\System\TkNPfyd.exe
  2⤵
  PID:5572
- C:\Windows\System\VlfvkKj.exe
  C:\Windows\System\VlfvkKj.exe
  2⤵
  PID:5856
- C:\Windows\System\xoApGSN.exe
  C:\Windows\System\xoApGSN.exe
  2⤵
  PID:5832
- C:\Windows\System\bhproPB.exe
  C:\Windows\System\bhproPB.exe
  2⤵
  PID:6076
- C:\Windows\System\StKhhuI.exe
  C:\Windows\System\StKhhuI.exe
  2⤵
  PID:5748
- C:\Windows\System\rrXVDID.exe
  C:\Windows\System\rrXVDID.exe
  2⤵
  PID:6228
- C:\Windows\System\xENQFZp.exe
  C:\Windows\System\xENQFZp.exe
  2⤵
  PID:6328
- C:\Windows\System\VFPSiTe.exe
  C:\Windows\System\VFPSiTe.exe
  2⤵
  PID:6388
- C:\Windows\System\GzNjcCc.exe
  C:\Windows\System\GzNjcCc.exe
  2⤵
  PID:6464
- C:\Windows\System\kTMAjdH.exe
  C:\Windows\System\kTMAjdH.exe
  2⤵
  PID:6540
- C:\Windows\System\aOQkuno.exe
  C:\Windows\System\aOQkuno.exe
  2⤵
  PID:6404
- C:\Windows\System\xxDESuG.exe
  C:\Windows\System\xxDESuG.exe
  2⤵
  PID:6604
- C:\Windows\System\JmzDyQL.exe
  C:\Windows\System\JmzDyQL.exe
  2⤵
  PID:2924
- C:\Windows\System\iGCdika.exe
  C:\Windows\System\iGCdika.exe
  2⤵
  PID:6712
- C:\Windows\System\mfbffMV.exe
  C:\Windows\System\mfbffMV.exe
  2⤵
  PID:6840
- C:\Windows\System\rxELHKv.exe
  C:\Windows\System\rxELHKv.exe
  2⤵
  PID:6716
- C:\Windows\System\PFpJtWV.exe
  C:\Windows\System\PFpJtWV.exe
  2⤵
  PID:6756
- C:\Windows\System\JSjacRH.exe
  C:\Windows\System\JSjacRH.exe
  2⤵
  PID:6872
- C:\Windows\System\luNyqUF.exe
  C:\Windows\System\luNyqUF.exe
  2⤵
  PID:6884
- C:\Windows\System\ulkuDYJ.exe
  C:\Windows\System\ulkuDYJ.exe
  2⤵
  PID:6952
- C:\Windows\System\gxaZhVE.exe
  C:\Windows\System\gxaZhVE.exe
  2⤵
  PID:7044
- C:\Windows\System\xzeakNu.exe
  C:\Windows\System\xzeakNu.exe
  2⤵
  PID:7144
- C:\Windows\System\CqKdcYo.exe
  C:\Windows\System\CqKdcYo.exe
  2⤵
  PID:3588
- C:\Windows\System\gvjgKHe.exe
  C:\Windows\System\gvjgKHe.exe
  2⤵
  PID:5140
- C:\Windows\System\KxcvEun.exe
  C:\Windows\System\KxcvEun.exe
  2⤵
  PID:6432
- C:\Windows\System\nsQbXZf.exe
  C:\Windows\System\nsQbXZf.exe
  2⤵
  PID:6664
- C:\Windows\System\RdatoES.exe
  C:\Windows\System\RdatoES.exe
  2⤵
  PID:6992
- C:\Windows\System\hWrLsTV.exe
  C:\Windows\System\hWrLsTV.exe
  2⤵
  PID:6828
- C:\Windows\System\YHzImRk.exe
  C:\Windows\System\YHzImRk.exe
  2⤵
  PID:4316
- C:\Windows\System\ENZnhsq.exe
  C:\Windows\System\ENZnhsq.exe
  2⤵
  PID:7064
- C:\Windows\System\MUFuMRN.exe
  C:\Windows\System\MUFuMRN.exe
  2⤵
  PID:6208
- C:\Windows\System\MIgNfqw.exe
  C:\Windows\System\MIgNfqw.exe
  2⤵
  PID:6672
- C:\Windows\System\RBOHAZB.exe
  C:\Windows\System\RBOHAZB.exe
  2⤵
  PID:7196
- C:\Windows\System\cKwriTN.exe
  C:\Windows\System\cKwriTN.exe
  2⤵
  PID:7264
- C:\Windows\System\lcudtsx.exe
  C:\Windows\System\lcudtsx.exe
  2⤵
  PID:7284
- C:\Windows\System\cZLwTme.exe
  C:\Windows\System\cZLwTme.exe
  2⤵
  PID:7316
- C:\Windows\System\nySQJtN.exe
  C:\Windows\System\nySQJtN.exe
  2⤵
  PID:7340
- C:\Windows\System\CztVBTB.exe
  C:\Windows\System\CztVBTB.exe
  2⤵
  PID:7404
- C:\Windows\System\yTHgDFQ.exe
  C:\Windows\System\yTHgDFQ.exe
  2⤵
  PID:7420
- C:\Windows\System\POrpUjS.exe
  C:\Windows\System\POrpUjS.exe
  2⤵
  PID:7444
- C:\Windows\System\FUrnwfC.exe
  C:\Windows\System\FUrnwfC.exe
  2⤵
  PID:7484
- C:\Windows\System\hJcgSLf.exe
  C:\Windows\System\hJcgSLf.exe
  2⤵
  PID:7512
- C:\Windows\System\LdlLWlP.exe
  C:\Windows\System\LdlLWlP.exe
  2⤵
  PID:7536
- C:\Windows\System\qxsdjnZ.exe
  C:\Windows\System\qxsdjnZ.exe
  2⤵
  PID:7592
- C:\Windows\System\aXuFkkZ.exe
  C:\Windows\System\aXuFkkZ.exe
  2⤵
  PID:7628
- C:\Windows\System\PFkGSnc.exe
  C:\Windows\System\PFkGSnc.exe
  2⤵
  PID:7664
- C:\Windows\System\xzcyZuO.exe
  C:\Windows\System\xzcyZuO.exe
  2⤵
  PID:7680
- C:\Windows\System\JbOucMF.exe
  C:\Windows\System\JbOucMF.exe
  2⤵
  PID:7704
- C:\Windows\System\mipdvAd.exe
  C:\Windows\System\mipdvAd.exe
  2⤵
  PID:7724
- C:\Windows\System\RtdkLOk.exe
  C:\Windows\System\RtdkLOk.exe
  2⤵
  PID:7740
- C:\Windows\System\vDmzXMy.exe
  C:\Windows\System\vDmzXMy.exe
  2⤵
  PID:7760
- C:\Windows\System\bypeZlG.exe
  C:\Windows\System\bypeZlG.exe
  2⤵
  PID:7780
- C:\Windows\System\EosxrfZ.exe
  C:\Windows\System\EosxrfZ.exe
  2⤵
  PID:7880
- C:\Windows\System\eMzQTcR.exe
  C:\Windows\System\eMzQTcR.exe
  2⤵
  PID:7900
- C:\Windows\System\gLfiKyp.exe
  C:\Windows\System\gLfiKyp.exe
  2⤵
  PID:7916
- C:\Windows\System\hNsQTuY.exe
  C:\Windows\System\hNsQTuY.exe
  2⤵
  PID:7964
- C:\Windows\System\DHPnuhG.exe
  C:\Windows\System\DHPnuhG.exe
  2⤵
  PID:8032
- C:\Windows\System\vsiMsHv.exe
  C:\Windows\System\vsiMsHv.exe
  2⤵
  PID:8048
- C:\Windows\System\aHnSHPX.exe
  C:\Windows\System\aHnSHPX.exe
  2⤵
  PID:8072
- C:\Windows\System\TJIdFhg.exe
  C:\Windows\System\TJIdFhg.exe
  2⤵
  PID:8088
- C:\Windows\System\tKzVpgV.exe
  C:\Windows\System\tKzVpgV.exe
  2⤵
  PID:8104
- C:\Windows\System\PjdkygI.exe
  C:\Windows\System\PjdkygI.exe
  2⤵
  PID:8128
- C:\Windows\System\GUcXwsl.exe
  C:\Windows\System\GUcXwsl.exe
  2⤵
  PID:8144
- C:\Windows\System\szBuqAm.exe
  C:\Windows\System\szBuqAm.exe
  2⤵
  PID:8160
- C:\Windows\System\tCDTBJX.exe
  C:\Windows\System\tCDTBJX.exe
  2⤵
  PID:8176
- C:\Windows\System\lStlKQj.exe
  C:\Windows\System\lStlKQj.exe
  2⤵
  PID:6600
- C:\Windows\System\baMEoEf.exe
  C:\Windows\System\baMEoEf.exe
  2⤵
  PID:5104
- C:\Windows\System\OjZgdWM.exe
  C:\Windows\System\OjZgdWM.exe
  2⤵
  PID:7192
- C:\Windows\System\SnOcJWF.exe
  C:\Windows\System\SnOcJWF.exe
  2⤵
  PID:7180
- C:\Windows\System\UJBLgYr.exe
  C:\Windows\System\UJBLgYr.exe
  2⤵
  PID:7308
- C:\Windows\System\aNpjtBK.exe
  C:\Windows\System\aNpjtBK.exe
  2⤵
  PID:7428
- C:\Windows\System\FuXctrq.exe
  C:\Windows\System\FuXctrq.exe
  2⤵
  PID:7468
- C:\Windows\System\bpFmzjo.exe
  C:\Windows\System\bpFmzjo.exe
  2⤵
  PID:6016
- C:\Windows\System\AaLhcUF.exe
  C:\Windows\System\AaLhcUF.exe
  2⤵
  PID:7580
- C:\Windows\System\kSXhMKL.exe
  C:\Windows\System\kSXhMKL.exe
  2⤵
  PID:7616
- C:\Windows\System\BvVJQWe.exe
  C:\Windows\System\BvVJQWe.exe
  2⤵
  PID:7736
- C:\Windows\System\tVcblzF.exe
  C:\Windows\System\tVcblzF.exe
  2⤵
  PID:7672
- C:\Windows\System\WAGOqfV.exe
  C:\Windows\System\WAGOqfV.exe
  2⤵
  PID:7776
- C:\Windows\System\YbmLgga.exe
  C:\Windows\System\YbmLgga.exe
  2⤵
  PID:7836
- C:\Windows\System\kVPaOnx.exe
  C:\Windows\System\kVPaOnx.exe
  2⤵
  PID:7892
- C:\Windows\System\KyylJYc.exe
  C:\Windows\System\KyylJYc.exe
  2⤵
  PID:7952
- C:\Windows\System\nhtAqua.exe
  C:\Windows\System\nhtAqua.exe
  2⤵
  PID:7604
- C:\Windows\System\SempvEn.exe
  C:\Windows\System\SempvEn.exe
  2⤵
  PID:7720
- C:\Windows\System\eCofcuz.exe
  C:\Windows\System\eCofcuz.exe
  2⤵
  PID:7652
- C:\Windows\System\xgFfkju.exe
  C:\Windows\System\xgFfkju.exe
  2⤵
  PID:7996
- C:\Windows\System\tRdryju.exe
  C:\Windows\System\tRdryju.exe
  2⤵
  PID:8156
- C:\Windows\System\dqXJGtC.exe
  C:\Windows\System\dqXJGtC.exe
  2⤵
  PID:7276
- C:\Windows\System\tImXlvd.exe
  C:\Windows\System\tImXlvd.exe
  2⤵
  PID:7336
- C:\Windows\System\qiBicyQ.exe
  C:\Windows\System\qiBicyQ.exe
  2⤵
  PID:5156
- C:\Windows\System\XsKfTKf.exe
  C:\Windows\System\XsKfTKf.exe
  2⤵
  PID:7692
- C:\Windows\System\YkwqlDC.exe
  C:\Windows\System\YkwqlDC.exe
  2⤵
  PID:8012
- C:\Windows\System\oQLBbHs.exe
  C:\Windows\System\oQLBbHs.exe
  2⤵
  PID:8152
- C:\Windows\System\YqhHGGT.exe
  C:\Windows\System\YqhHGGT.exe
  2⤵
  PID:8208
- C:\Windows\System\NUEJZLX.exe
  C:\Windows\System\NUEJZLX.exe
  2⤵
  PID:8228
- C:\Windows\System\mNSHgOv.exe
  C:\Windows\System\mNSHgOv.exe
  2⤵
  PID:8244
- C:\Windows\System\bhcajow.exe
  C:\Windows\System\bhcajow.exe
  2⤵
  PID:8420
- C:\Windows\System\DzApBlr.exe
  C:\Windows\System\DzApBlr.exe
  2⤵
  PID:8436
- C:\Windows\System\aVknTOV.exe
  C:\Windows\System\aVknTOV.exe
  2⤵
  PID:8452
- C:\Windows\System\vQKpZOF.exe
  C:\Windows\System\vQKpZOF.exe
  2⤵
  PID:8476
- C:\Windows\System\gDJrnxc.exe
  C:\Windows\System\gDJrnxc.exe
  2⤵
  PID:8536
- C:\Windows\System\vhCnxXn.exe
  C:\Windows\System\vhCnxXn.exe
  2⤵
  PID:8556
- C:\Windows\System\SNPhqMN.exe
  C:\Windows\System\SNPhqMN.exe
  2⤵
  PID:8576
- C:\Windows\System\zRLmgpn.exe
  C:\Windows\System\zRLmgpn.exe
  2⤵
  PID:8596
- C:\Windows\System\LqIfRCY.exe
  C:\Windows\System\LqIfRCY.exe
  2⤵
  PID:8632
- C:\Windows\System\Smsztvw.exe
  C:\Windows\System\Smsztvw.exe
  2⤵
  PID:8652
- C:\Windows\System\ABSRfci.exe
  C:\Windows\System\ABSRfci.exe
  2⤵
  PID:8672
- C:\Windows\System\suHWsOi.exe
  C:\Windows\System\suHWsOi.exe
  2⤵
  PID:8696
- C:\Windows\System\OQHlBNV.exe
  C:\Windows\System\OQHlBNV.exe
  2⤵
  PID:8716
- C:\Windows\System\QlxgtcP.exe
  C:\Windows\System\QlxgtcP.exe
  2⤵
  PID:8732
- C:\Windows\System\bVZBjlp.exe
  C:\Windows\System\bVZBjlp.exe
  2⤵
  PID:8748
- C:\Windows\System\pvIsEGa.exe
  C:\Windows\System\pvIsEGa.exe
  2⤵
  PID:8764
- C:\Windows\System\QfQQXeS.exe
  C:\Windows\System\QfQQXeS.exe
  2⤵
  PID:8796
- C:\Windows\System\gwMoubr.exe
  C:\Windows\System\gwMoubr.exe
  2⤵
  PID:8828
- C:\Windows\System\FTlfxIK.exe
  C:\Windows\System\FTlfxIK.exe
  2⤵
  PID:8848
- C:\Windows\System\dxQXtYi.exe
  C:\Windows\System\dxQXtYi.exe
  2⤵
  PID:8924
- C:\Windows\System\hWwosTr.exe
  C:\Windows\System\hWwosTr.exe
  2⤵
  PID:8948
- C:\Windows\System\hVTrHrg.exe
  C:\Windows\System\hVTrHrg.exe
  2⤵
  PID:8976
- C:\Windows\System\MrxLZPU.exe
  C:\Windows\System\MrxLZPU.exe
  2⤵
  PID:8992
- C:\Windows\System\bIYxEir.exe
  C:\Windows\System\bIYxEir.exe
  2⤵
  PID:9012
- C:\Windows\System\DNpYkWJ.exe
  C:\Windows\System\DNpYkWJ.exe
  2⤵
  PID:9036
- C:\Windows\System\giFzYRc.exe
  C:\Windows\System\giFzYRc.exe
  2⤵
  PID:9060
- C:\Windows\System\TmwEETH.exe
  C:\Windows\System\TmwEETH.exe
  2⤵
  PID:9076
- C:\Windows\System\fWYenTT.exe
  C:\Windows\System\fWYenTT.exe
  2⤵
  PID:9104
- C:\Windows\System\lXkmkzk.exe
  C:\Windows\System\lXkmkzk.exe
  2⤵
  PID:9120
- C:\Windows\System\yJYOhAU.exe
  C:\Windows\System\yJYOhAU.exe
  2⤵
  PID:9136
- C:\Windows\System\AgibaTz.exe
  C:\Windows\System\AgibaTz.exe
  2⤵
  PID:9152
- C:\Windows\System\OcGHSOm.exe
  C:\Windows\System\OcGHSOm.exe
  2⤵
  PID:9168
- C:\Windows\System\epEmNLf.exe
  C:\Windows\System\epEmNLf.exe
  2⤵
  PID:9192
- C:\Windows\System\ZhQUFqI.exe
  C:\Windows\System\ZhQUFqI.exe
  2⤵
  PID:7612
- C:\Windows\System\doEmWvi.exe
  C:\Windows\System\doEmWvi.exe
  2⤵
  PID:7984
- C:\Windows\System\RQmNeJV.exe
  C:\Windows\System\RQmNeJV.exe
  2⤵
  PID:3732
- C:\Windows\System\nwZIPJq.exe
  C:\Windows\System\nwZIPJq.exe
  2⤵
  PID:3680
- C:\Windows\System\pnaLWHT.exe
  C:\Windows\System\pnaLWHT.exe
  2⤵
  PID:7376
- C:\Windows\System\mvGfKCr.exe
  C:\Windows\System\mvGfKCr.exe
  2⤵
  PID:7848
- C:\Windows\System\ybhxLTy.exe
  C:\Windows\System\ybhxLTy.exe
  2⤵
  PID:8296
- C:\Windows\System\WwJzTNP.exe
  C:\Windows\System\WwJzTNP.exe
  2⤵
  PID:8376
- C:\Windows\System\StjHBPg.exe
  C:\Windows\System\StjHBPg.exe
  2⤵
  PID:8344
- C:\Windows\System\CHqRuAy.exe
  C:\Windows\System\CHqRuAy.exe
  2⤵
  PID:8612
- C:\Windows\System\bjEbigu.exe
  C:\Windows\System\bjEbigu.exe
  2⤵
  PID:8644
- C:\Windows\System\IXBdnbv.exe
  C:\Windows\System\IXBdnbv.exe
  2⤵
  PID:8444
- C:\Windows\System\MuBkMLi.exe
  C:\Windows\System\MuBkMLi.exe
  2⤵
  PID:8520
- C:\Windows\System\GwYxZEY.exe
  C:\Windows\System\GwYxZEY.exe
  2⤵
  PID:8788
- C:\Windows\System\lfAaGkO.exe
  C:\Windows\System\lfAaGkO.exe
  2⤵
  PID:8864
- C:\Windows\System\RZVHkGG.exe
  C:\Windows\System\RZVHkGG.exe
  2⤵
  PID:8704
- C:\Windows\System\ygJLRFi.exe
  C:\Windows\System\ygJLRFi.exe
  2⤵
  PID:8592
- C:\Windows\System\wjkNycM.exe
  C:\Windows\System\wjkNycM.exe
  2⤵
  PID:8616
- C:\Windows\System\orRxfwF.exe
  C:\Windows\System\orRxfwF.exe
  2⤵
  PID:8812
- C:\Windows\System\qyUPakD.exe
  C:\Windows\System\qyUPakD.exe
  2⤵
  PID:8664
- C:\Windows\System\haMpYly.exe
  C:\Windows\System\haMpYly.exe
  2⤵
  PID:8968
- C:\Windows\System\thKgEnN.exe
  C:\Windows\System\thKgEnN.exe
  2⤵
  PID:9020
- C:\Windows\System\wQMYZfN.exe
  C:\Windows\System\wQMYZfN.exe
  2⤵
  PID:9056
- C:\Windows\System\AKsTkek.exe
  C:\Windows\System\AKsTkek.exe
  2⤵
  PID:8904
- C:\Windows\System\wgBOcFM.exe
  C:\Windows\System\wgBOcFM.exe
  2⤵
  PID:8352
- C:\Windows\System\yYoCsYY.exe
  C:\Windows\System\yYoCsYY.exe
  2⤵
  PID:9100
- C:\Windows\System\HJoQxsK.exe
  C:\Windows\System\HJoQxsK.exe
  2⤵
  PID:9204
- C:\Windows\System\CvbOAQN.exe
  C:\Windows\System\CvbOAQN.exe
  2⤵
  PID:8492
- C:\Windows\System\PAoFIXY.exe
  C:\Windows\System\PAoFIXY.exe
  2⤵
  PID:8552
- C:\Windows\System\THGqDlE.exe
  C:\Windows\System\THGqDlE.exe
  2⤵
  PID:8268
- C:\Windows\System\KlipYHf.exe
  C:\Windows\System\KlipYHf.exe
  2⤵
  PID:8100
- C:\Windows\System\LHeVadx.exe
  C:\Windows\System\LHeVadx.exe
  2⤵
  PID:8312
- C:\Windows\System\JmHRlnE.exe
  C:\Windows\System\JmHRlnE.exe
  2⤵
  PID:8532
- C:\Windows\System\zDZuttn.exe
  C:\Windows\System\zDZuttn.exe
  2⤵
  PID:9224
- C:\Windows\System\WJNPAeR.exe
  C:\Windows\System\WJNPAeR.exe
  2⤵
  PID:9240
- C:\Windows\System\DfopDwB.exe
  C:\Windows\System\DfopDwB.exe
  2⤵
  PID:9260
- C:\Windows\System\afuCGun.exe
  C:\Windows\System\afuCGun.exe
  2⤵
  PID:9280
- C:\Windows\System\LsjoXwu.exe
  C:\Windows\System\LsjoXwu.exe
  2⤵
  PID:9300
- C:\Windows\System\qBrUyRU.exe
  C:\Windows\System\qBrUyRU.exe
  2⤵
  PID:9320
- C:\Windows\System\VSwDxHP.exe
  C:\Windows\System\VSwDxHP.exe
  2⤵
  PID:9344
- C:\Windows\System\BHvggvW.exe
  C:\Windows\System\BHvggvW.exe
  2⤵
  PID:9364
- C:\Windows\System\ycepWCL.exe
  C:\Windows\System\ycepWCL.exe
  2⤵
  PID:9380
- C:\Windows\System\yrjXFdl.exe
  C:\Windows\System\yrjXFdl.exe
  2⤵
  PID:9400
- C:\Windows\System\MdWlRwT.exe
  C:\Windows\System\MdWlRwT.exe
  2⤵
  PID:9420
- C:\Windows\System\IZUOPwD.exe
  C:\Windows\System\IZUOPwD.exe
  2⤵
  PID:9968
- C:\Windows\System\ULUwrCK.exe
  C:\Windows\System\ULUwrCK.exe
  2⤵
  PID:9996
- C:\Windows\System\XidlNOZ.exe
  C:\Windows\System\XidlNOZ.exe
  2⤵
  PID:10012
- C:\Windows\System\EwBfUrw.exe
  C:\Windows\System\EwBfUrw.exe
  2⤵
  PID:10032
- C:\Windows\System\zSONdBq.exe
  C:\Windows\System\zSONdBq.exe
  2⤵
  PID:10060
- C:\Windows\System\MMCeHmq.exe
  C:\Windows\System\MMCeHmq.exe
  2⤵
  PID:10080
- C:\Windows\System\vLVsPDu.exe
  C:\Windows\System\vLVsPDu.exe
  2⤵
  PID:10100
- C:\Windows\System\ltCrdyy.exe
  C:\Windows\System\ltCrdyy.exe
  2⤵
  PID:10128
- C:\Windows\System\hsaFzYp.exe
  C:\Windows\System\hsaFzYp.exe
  2⤵
  PID:10152
- C:\Windows\System\IXCXHEf.exe
  C:\Windows\System\IXCXHEf.exe
  2⤵
  PID:10176
- C:\Windows\System\dgpMAOk.exe
  C:\Windows\System\dgpMAOk.exe
  2⤵
  PID:10196
- C:\Windows\System\ShkZwMG.exe
  C:\Windows\System\ShkZwMG.exe
  2⤵
  PID:10224
- C:\Windows\System\WCRslnT.exe
  C:\Windows\System\WCRslnT.exe
  2⤵
  PID:8428
- C:\Windows\System\aSGfuTK.exe
  C:\Windows\System\aSGfuTK.exe
  2⤵
  PID:8804
- C:\Windows\System\trnQzOr.exe
  C:\Windows\System\trnQzOr.exe
  2⤵
  PID:9008
- C:\Windows\System\mUQvhTW.exe
  C:\Windows\System\mUQvhTW.exe
  2⤵
  PID:8844
- C:\Windows\System\yaFSRuo.exe
  C:\Windows\System\yaFSRuo.exe
  2⤵
  PID:4576
- C:\Windows\System\rqtJuIG.exe
  C:\Windows\System\rqtJuIG.exe
  2⤵
  PID:8960
- C:\Windows\System\sURadLF.exe
  C:\Windows\System\sURadLF.exe
  2⤵
  PID:9492
- C:\Windows\System\YbmXkGP.exe
  C:\Windows\System\YbmXkGP.exe
  2⤵
  PID:8340
- C:\Windows\System\aAWTxhy.exe
  C:\Windows\System\aAWTxhy.exe
  2⤵
  PID:8284
- C:\Windows\System\EOvnKPH.exe
  C:\Windows\System\EOvnKPH.exe
  2⤵
  PID:8584
- C:\Windows\System\pXqvHAk.exe
  C:\Windows\System\pXqvHAk.exe
  2⤵
  PID:9592
- C:\Windows\System\cwKYqVR.exe
  C:\Windows\System\cwKYqVR.exe
  2⤵
  PID:9648
- C:\Windows\System\gyGpvEE.exe
  C:\Windows\System\gyGpvEE.exe
  2⤵
  PID:9308
- C:\Windows\System\iaNMurU.exe
  C:\Windows\System\iaNMurU.exe
  2⤵
  PID:9336
- C:\Windows\System\hZlXWpY.exe
  C:\Windows\System\hZlXWpY.exe
  2⤵
  PID:9392
- C:\Windows\System\AuZrtmo.exe
  C:\Windows\System\AuZrtmo.exe
  2⤵
  PID:9432
- C:\Windows\System\xVDunqh.exe
  C:\Windows\System\xVDunqh.exe
  2⤵
  PID:9848
- C:\Windows\System\sLJBBQY.exe
  C:\Windows\System\sLJBBQY.exe
  2⤵
  PID:9600
- C:\Windows\System\DhwXWMJ.exe
  C:\Windows\System\DhwXWMJ.exe
  2⤵
  PID:8772
- C:\Windows\System\eSQBnUi.exe
  C:\Windows\System\eSQBnUi.exe
  2⤵
  PID:9208
- C:\Windows\System\iWhkBjx.exe
  C:\Windows\System\iWhkBjx.exe
  2⤵
  PID:9160
- C:\Windows\System\AbRWCQv.exe
  C:\Windows\System\AbRWCQv.exe
  2⤵
  PID:9476
- C:\Windows\System\VRGJxhT.exe
  C:\Windows\System\VRGJxhT.exe
  2⤵
  PID:8816
- C:\Windows\System\YKxBBYg.exe
  C:\Windows\System\YKxBBYg.exe
  2⤵
  PID:4488
- C:\Windows\System\XKSiPgd.exe
  C:\Windows\System\XKSiPgd.exe
  2⤵
  PID:9880
- C:\Windows\System\RfHWrPz.exe
  C:\Windows\System\RfHWrPz.exe
  2⤵
  PID:10096
- C:\Windows\System\vQPzpOQ.exe
  C:\Windows\System\vQPzpOQ.exe
  2⤵
  PID:9672
- C:\Windows\System\cQRzyfx.exe
  C:\Windows\System\cQRzyfx.exe
  2⤵
  PID:9984
- C:\Windows\System\FDLeBdB.exe
  C:\Windows\System\FDLeBdB.exe
  2⤵
  PID:10140
- C:\Windows\System\fNFYVuE.exe
  C:\Windows\System\fNFYVuE.exe
  2⤵
  PID:5052
- C:\Windows\System\ylpjZhD.exe
  C:\Windows\System\ylpjZhD.exe
  2⤵
  PID:10248
- C:\Windows\System\fZwlRLn.exe
  C:\Windows\System\fZwlRLn.exe
  2⤵
  PID:10264
- C:\Windows\System\KOOgvOI.exe
  C:\Windows\System\KOOgvOI.exe
  2⤵
  PID:10284
- C:\Windows\System\NhWqyrY.exe
  C:\Windows\System\NhWqyrY.exe
  2⤵
  PID:10304
- C:\Windows\System\otCVpUS.exe
  C:\Windows\System\otCVpUS.exe
  2⤵
  PID:10320
- C:\Windows\System\DSLjFmc.exe
  C:\Windows\System\DSLjFmc.exe
  2⤵
  PID:10336
- C:\Windows\System\BAnHvRT.exe
  C:\Windows\System\BAnHvRT.exe
  2⤵
  PID:10352
- C:\Windows\System\qXWYBWR.exe
  C:\Windows\System\qXWYBWR.exe
  2⤵
  PID:10372
- C:\Windows\System\qAuydSp.exe
  C:\Windows\System\qAuydSp.exe
  2⤵
  PID:10388
- C:\Windows\System\glDhchm.exe
  C:\Windows\System\glDhchm.exe
  2⤵
  PID:10412
- C:\Windows\System\BCNbgcC.exe
  C:\Windows\System\BCNbgcC.exe
  2⤵
  PID:10436
- C:\Windows\System\zkSlNtO.exe
  C:\Windows\System\zkSlNtO.exe
  2⤵
  PID:10456
- C:\Windows\System\vSXCDwR.exe
  C:\Windows\System\vSXCDwR.exe
  2⤵
  PID:10476
- C:\Windows\System\lSuftBb.exe
  C:\Windows\System\lSuftBb.exe
  2⤵
  PID:10548
- C:\Windows\System\AbmIliB.exe
  C:\Windows\System\AbmIliB.exe
  2⤵
  PID:10572
- C:\Windows\System\tzMvWai.exe
  C:\Windows\System\tzMvWai.exe
  2⤵
  PID:10588
- C:\Windows\System\dEjaeJz.exe
  C:\Windows\System\dEjaeJz.exe
  2⤵
  PID:10612
- C:\Windows\System\MCdUgIq.exe
  C:\Windows\System\MCdUgIq.exe
  2⤵
  PID:10640
- C:\Windows\System\hOsjrFJ.exe
  C:\Windows\System\hOsjrFJ.exe
  2⤵
  PID:10664
- C:\Windows\System\IeFBFpf.exe
  C:\Windows\System\IeFBFpf.exe
  2⤵
  PID:10688
- C:\Windows\System\otWytbw.exe
  C:\Windows\System\otWytbw.exe
  2⤵
  PID:10716
- C:\Windows\System\uhhBNso.exe
  C:\Windows\System\uhhBNso.exe
  2⤵
  PID:10748
- C:\Windows\System\UNqsKJh.exe
  C:\Windows\System\UNqsKJh.exe
  2⤵
  PID:10768
- C:\Windows\System\TduiKpH.exe
  C:\Windows\System\TduiKpH.exe
  2⤵
  PID:10792
- C:\Windows\System\BLlOvoR.exe
  C:\Windows\System\BLlOvoR.exe
  2⤵
  PID:10844
- C:\Windows\System\RlsAZyy.exe
  C:\Windows\System\RlsAZyy.exe
  2⤵
  PID:10860
- C:\Windows\System\TduXTOk.exe
  C:\Windows\System\TduXTOk.exe
  2⤵
  PID:10880
- C:\Windows\System\SYvBuVV.exe
  C:\Windows\System\SYvBuVV.exe
  2⤵
  PID:10968
- C:\Windows\System\XPPyvkO.exe
  C:\Windows\System\XPPyvkO.exe
  2⤵
  PID:10992
- C:\Windows\System\xjhgrpj.exe
  C:\Windows\System\xjhgrpj.exe
  2⤵
  PID:11016
- C:\Windows\System\ESCyxCd.exe
  C:\Windows\System\ESCyxCd.exe
  2⤵
  PID:11048
- C:\Windows\System\EfkeTIz.exe
  C:\Windows\System\EfkeTIz.exe
  2⤵
  PID:11152
- C:\Windows\System\ibHjMia.exe
  C:\Windows\System\ibHjMia.exe
  2⤵
  PID:11172
- C:\Windows\System\vCRMHJX.exe
  C:\Windows\System\vCRMHJX.exe
  2⤵
  PID:11200
- C:\Windows\System\xvwyerN.exe
  C:\Windows\System\xvwyerN.exe
  2⤵
  PID:11228
- C:\Windows\System\AhQSBsH.exe
  C:\Windows\System\AhQSBsH.exe
  2⤵
  PID:9744
- C:\Windows\System\YQQbigX.exe
  C:\Windows\System\YQQbigX.exe
  2⤵
  PID:9292
- C:\Windows\System\zcpsviG.exe
  C:\Windows\System\zcpsviG.exe
  2⤵
  PID:9940
- C:\Windows\System\OmehLsO.exe
  C:\Windows\System\OmehLsO.exe
  2⤵
  PID:10276
- C:\Windows\System\TkibqkJ.exe
  C:\Windows\System\TkibqkJ.exe
  2⤵
  PID:10312
- C:\Windows\System\KWjNNmO.exe
  C:\Windows\System\KWjNNmO.exe
  2⤵
  PID:10404
- C:\Windows\System\cKpTJro.exe
  C:\Windows\System\cKpTJro.exe
  2⤵
  PID:2288
- C:\Windows\System\VITsznM.exe
  C:\Windows\System\VITsznM.exe
  2⤵
  PID:10328
- C:\Windows\System\xyGwknm.exe
  C:\Windows\System\xyGwknm.exe
  2⤵
  PID:4240
- C:\Windows\System\iSMsMay.exe
  C:\Windows\System\iSMsMay.exe
  2⤵
  PID:10396
- C:\Windows\System\PyCUveH.exe
  C:\Windows\System\PyCUveH.exe
  2⤵
  PID:10452
- C:\Windows\System\KnuPiGj.exe
  C:\Windows\System\KnuPiGj.exe
  2⤵
  PID:10724
- C:\Windows\System\bSinFnY.exe
  C:\Windows\System\bSinFnY.exe
  2⤵
  PID:10524
- C:\Windows\System\bFRJGws.exe
  C:\Windows\System\bFRJGws.exe
  2⤵
  PID:2272
- C:\Windows\System\AxjKGZJ.exe
  C:\Windows\System\AxjKGZJ.exe
  2⤵
  PID:10740
- C:\Windows\System\SCxanbp.exe
  C:\Windows\System\SCxanbp.exe
  2⤵
  PID:10648
- C:\Windows\System\xaURNlw.exe
  C:\Windows\System\xaURNlw.exe
  2⤵
  PID:10596
- C:\Windows\System\lHKEaAo.exe
  C:\Windows\System\lHKEaAo.exe
  2⤵
  PID:10920
- C:\Windows\System\AzPIQag.exe
  C:\Windows\System\AzPIQag.exe
  2⤵
  PID:10876
- C:\Windows\System\PVSLKlW.exe
  C:\Windows\System\PVSLKlW.exe
  2⤵
  PID:10980
- C:\Windows\System\XgTcjzj.exe
  C:\Windows\System\XgTcjzj.exe
  2⤵
  PID:10932
- C:\Windows\System\AJpopvz.exe
  C:\Windows\System\AJpopvz.exe
  2⤵
  PID:11024
- C:\Windows\System\okDYVhC.exe
  C:\Windows\System\okDYVhC.exe
  2⤵
  PID:11056
- C:\Windows\System\KFNrJSQ.exe
  C:\Windows\System\KFNrJSQ.exe
  2⤵
  PID:11140
- C:\Windows\System\cWyvNew.exe
  C:\Windows\System\cWyvNew.exe
  2⤵
  PID:11216
- C:\Windows\System\PpyKLna.exe
  C:\Windows\System\PpyKLna.exe
  2⤵
  PID:11148
- C:\Windows\System\OVmjifd.exe
  C:\Windows\System\OVmjifd.exe
  2⤵
  PID:11184
- C:\Windows\System\byeLLNp.exe
  C:\Windows\System\byeLLNp.exe
  2⤵
  PID:10380
- C:\Windows\System\yKvJFHY.exe
  C:\Windows\System\yKvJFHY.exe
  2⤵
  PID:10484
- C:\Windows\System\zZiVGQq.exe
  C:\Windows\System\zZiVGQq.exe
  2⤵
  PID:11248
- C:\Windows\System\UQethoy.exe
  C:\Windows\System\UQethoy.exe
  2⤵
  PID:10188
- C:\Windows\System\KxSzFCl.exe
  C:\Windows\System\KxSzFCl.exe
  2⤵
  PID:10292
- C:\Windows\System\vGcQKOW.exe
  C:\Windows\System\vGcQKOW.exe
  2⤵
  PID:11276
- C:\Windows\System\FfmLfjK.exe
  C:\Windows\System\FfmLfjK.exe
  2⤵
  PID:11292
- C:\Windows\System\HvszXAt.exe
  C:\Windows\System\HvszXAt.exe
  2⤵
  PID:11348
- C:\Windows\System\aoqtvPx.exe
  C:\Windows\System\aoqtvPx.exe
  2⤵
  PID:11364
- C:\Windows\System\HowHZya.exe
  C:\Windows\System\HowHZya.exe
  2⤵
  PID:11384
- C:\Windows\System\lFrbAMt.exe
  C:\Windows\System\lFrbAMt.exe
  2⤵
  PID:11408
- C:\Windows\System\OgZIpPb.exe
  C:\Windows\System\OgZIpPb.exe
  2⤵
  PID:11428
- C:\Windows\System\WaguysU.exe
  C:\Windows\System\WaguysU.exe
  2⤵
  PID:11448
- C:\Windows\System\qYfnVRM.exe
  C:\Windows\System\qYfnVRM.exe
  2⤵
  PID:11528
- C:\Windows\System\YkGDBmi.exe
  C:\Windows\System\YkGDBmi.exe
  2⤵
  PID:11556
- C:\Windows\System\WAtQkWc.exe
  C:\Windows\System\WAtQkWc.exe
  2⤵
  PID:11648
- C:\Windows\System\tOOFkit.exe
  C:\Windows\System\tOOFkit.exe
  2⤵
  PID:11672
- C:\Windows\System\sbwldzr.exe
  C:\Windows\System\sbwldzr.exe
  2⤵
  PID:11704
- C:\Windows\System\HlTrmyU.exe
  C:\Windows\System\HlTrmyU.exe
  2⤵
  PID:11840
- C:\Windows\System\YoMcGCJ.exe
  C:\Windows\System\YoMcGCJ.exe
  2⤵
  PID:11860
- C:\Windows\System\etEghRT.exe
  C:\Windows\System\etEghRT.exe
  2⤵
  PID:11876
- C:\Windows\System\IGQNyYQ.exe
  C:\Windows\System\IGQNyYQ.exe
  2⤵
  PID:11900
- C:\Windows\System\gMvahvD.exe
  C:\Windows\System\gMvahvD.exe
  2⤵
  PID:11992
- C:\Windows\System\zcNczkD.exe
  C:\Windows\System\zcNczkD.exe
  2⤵
  PID:12016
- C:\Windows\System\zCBxGKF.exe
  C:\Windows\System\zCBxGKF.exe
  2⤵
  PID:12040
- C:\Windows\System\KEVVVXN.exe
  C:\Windows\System\KEVVVXN.exe
  2⤵
  PID:12072
- C:\Windows\System\iDenpOA.exe
  C:\Windows\System\iDenpOA.exe
  2⤵
  PID:12092
- C:\Windows\System\AEBOhkD.exe
  C:\Windows\System\AEBOhkD.exe
  2⤵
  PID:12108
- C:\Windows\System\AQVvIVX.exe
  C:\Windows\System\AQVvIVX.exe
  2⤵
  PID:12148
- C:\Windows\System\vaoHjtt.exe
  C:\Windows\System\vaoHjtt.exe
  2⤵
  PID:12168
- C:\Windows\System\EfQDCob.exe
  C:\Windows\System\EfQDCob.exe
  2⤵
  PID:2156
- C:\Windows\System\wzTqSRa.exe
  C:\Windows\System\wzTqSRa.exe
  2⤵
  PID:9920
- C:\Windows\System\uWFyzIS.exe
  C:\Windows\System\uWFyzIS.exe
  2⤵
  PID:10432
- C:\Windows\System\eklenHz.exe
  C:\Windows\System\eklenHz.exe
  2⤵
  PID:11208
- C:\Windows\System\fEghiQD.exe
  C:\Windows\System\fEghiQD.exe
  2⤵
  PID:11444
- C:\Windows\System\IfgQtMI.exe
  C:\Windows\System\IfgQtMI.exe
  2⤵
  PID:1344
- C:\Windows\System\CMNaSvM.exe
  C:\Windows\System\CMNaSvM.exe
  2⤵
  PID:11604
- C:\Windows\System\VrzsFFS.exe
  C:\Windows\System\VrzsFFS.exe
  2⤵
  PID:3660
- C:\Windows\System\AOPsUEb.exe
  C:\Windows\System\AOPsUEb.exe
  2⤵
  PID:11644
- C:\Windows\System\zqVEWTo.exe
  C:\Windows\System\zqVEWTo.exe
  2⤵
  PID:11624
- C:\Windows\System\lJLtBub.exe
  C:\Windows\System\lJLtBub.exe
  2⤵
  PID:11660
- C:\Windows\System\zPJsMTY.exe
  C:\Windows\System\zPJsMTY.exe
  2⤵
  PID:11548
- C:\Windows\System\OqCDGlN.exe
  C:\Windows\System\OqCDGlN.exe
  2⤵
  PID:2396
- C:\Windows\System\AhfcKiF.exe
  C:\Windows\System\AhfcKiF.exe
  2⤵
  PID:11664
- C:\Windows\System\UQhapoy.exe
  C:\Windows\System\UQhapoy.exe
  2⤵
  PID:11828
- C:\Windows\System\ilNYPMP.exe
  C:\Windows\System\ilNYPMP.exe
  2⤵
  PID:11896
- C:\Windows\System\BuslzjE.exe
  C:\Windows\System\BuslzjE.exe
  2⤵
  PID:11952
- C:\Windows\System\SfTfQLW.exe
  C:\Windows\System\SfTfQLW.exe
  2⤵
  PID:11856
- C:\Windows\System\LDzcOlQ.exe
  C:\Windows\System\LDzcOlQ.exe
  2⤵
  PID:11988
- C:\Windows\System\oSVnjZN.exe
  C:\Windows\System\oSVnjZN.exe
  2⤵
  PID:11944
- C:\Windows\System\QsGSfjb.exe
  C:\Windows\System\QsGSfjb.exe
  2⤵
  PID:7992
- C:\Windows\System\hpUCtHu.exe
  C:\Windows\System\hpUCtHu.exe
  2⤵
  PID:12048
- C:\Windows\System\bbRreTG.exe
  C:\Windows\System\bbRreTG.exe
  2⤵
  PID:12088
- C:\Windows\System\lMgNXvj.exe
  C:\Windows\System\lMgNXvj.exe
  2⤵
  PID:12144
- C:\Windows\System\DaVgtBL.exe
  C:\Windows\System\DaVgtBL.exe
  2⤵
  PID:9276
- C:\Windows\System\wbnnmFw.exe
  C:\Windows\System\wbnnmFw.exe
  2⤵
  PID:12252
- C:\Windows\System\gmQGlyh.exe
  C:\Windows\System\gmQGlyh.exe
  2⤵
  PID:10520
- C:\Windows\System\MRcgHRi.exe
  C:\Windows\System\MRcgHRi.exe
  2⤵
  PID:10832
- C:\Windows\System\HRIujNp.exe
  C:\Windows\System\HRIujNp.exe
  2⤵
  PID:3080
- C:\Windows\System\ljDGFIz.exe
  C:\Windows\System\ljDGFIz.exe
  2⤵
  PID:2408
- C:\Windows\System\FBeudXP.exe
  C:\Windows\System\FBeudXP.exe
  2⤵
  PID:3472
- C:\Windows\System\vLBPwSg.exe
  C:\Windows\System\vLBPwSg.exe
  2⤵
  PID:11040
- C:\Windows\System\lfYngSl.exe
  C:\Windows\System\lfYngSl.exe
  2⤵
  PID:10852
- C:\Windows\System\mFyuUUL.exe
  C:\Windows\System\mFyuUUL.exe
  2⤵
  PID:11516
- C:\Windows\System\FbGLCpg.exe
  C:\Windows\System\FbGLCpg.exe
  2⤵
  PID:4928
- C:\Windows\System\GfawczX.exe
  C:\Windows\System\GfawczX.exe
  2⤵
  PID:332
- C:\Windows\System\bvgrMws.exe
  C:\Windows\System\bvgrMws.exe
  2⤵
  PID:5444
- C:\Windows\System\usKihyl.exe
  C:\Windows\System\usKihyl.exe
  2⤵
  PID:4284
- C:\Windows\System\LoYYPFm.exe
  C:\Windows\System\LoYYPFm.exe
  2⤵
  PID:11072
- C:\Windows\System\jhLXyOm.exe
  C:\Windows\System\jhLXyOm.exe
  2⤵
  PID:1592
- C:\Windows\System\UhkSdNy.exe
  C:\Windows\System\UhkSdNy.exe
  2⤵
  PID:11564
- C:\Windows\System\SbQXzTw.exe
  C:\Windows\System\SbQXzTw.exe
  2⤵
  PID:11908
- C:\Windows\System\mFdKIKt.exe
  C:\Windows\System\mFdKIKt.exe
  2⤵
  PID:4412
- C:\Windows\System\URIJxAL.exe
  C:\Windows\System\URIJxAL.exe
  2⤵
  PID:11936
- C:\Windows\System\oBQbEsj.exe
  C:\Windows\System\oBQbEsj.exe
  2⤵
  PID:5644
- C:\Windows\System\eYGPZkT.exe
  C:\Windows\System\eYGPZkT.exe
  2⤵
  PID:1804
- C:\Windows\System\fXuDEWO.exe
  C:\Windows\System\fXuDEWO.exe
  2⤵
  PID:12248
- C:\Windows\System\BiAVqmo.exe
  C:\Windows\System\BiAVqmo.exe
  2⤵
  PID:11440
- C:\Windows\System\DubqSuy.exe
  C:\Windows\System\DubqSuy.exe
  2⤵
  PID:4456
- C:\Windows\System\rQkOcrb.exe
  C:\Windows\System\rQkOcrb.exe
  2⤵
  PID:1960
- C:\Windows\System\CLzntTr.exe
  C:\Windows\System\CLzntTr.exe
  2⤵
  PID:4140
- C:\Windows\System\MXHoLLX.exe
  C:\Windows\System\MXHoLLX.exe
  2⤵
  PID:12196
- C:\Windows\System\XZAMwEw.exe
  C:\Windows\System\XZAMwEw.exe
  2⤵
  PID:4908
- C:\Windows\System\FuKUIcI.exe
  C:\Windows\System\FuKUIcI.exe
  2⤵
  PID:1756
- C:\Windows\System\BdtzeBO.exe
  C:\Windows\System\BdtzeBO.exe
  2⤵
  PID:3528
- C:\Windows\System\gorEkwc.exe
  C:\Windows\System\gorEkwc.exe
  2⤵
  PID:10696
- C:\Windows\System\VHSkfOP.exe
  C:\Windows\System\VHSkfOP.exe
  2⤵
  PID:2144
- C:\Windows\System\nlEfiVD.exe
  C:\Windows\System\nlEfiVD.exe
  2⤵
  PID:4400
- C:\Windows\System\lvlaUsn.exe
  C:\Windows\System\lvlaUsn.exe
  2⤵
  PID:3848
- C:\Windows\System\TnzdrkW.exe
  C:\Windows\System\TnzdrkW.exe
  2⤵
  PID:4628
- C:\Windows\System\yqHXdoJ.exe
  C:\Windows\System\yqHXdoJ.exe
  2⤵
  PID:3948
- C:\Windows\System\beMbssR.exe
  C:\Windows\System\beMbssR.exe
  2⤵
  PID:5000
- C:\Windows\System\SEFoYXm.exe
  C:\Windows\System\SEFoYXm.exe
  2⤵
  PID:12332
- C:\Windows\System\TetdNFw.exe
  C:\Windows\System\TetdNFw.exe
  2⤵
  PID:12356
- C:\Windows\System\GHXhpvv.exe
  C:\Windows\System\GHXhpvv.exe
  2⤵
  PID:12396
- C:\Windows\System\vWaHPWb.exe
  C:\Windows\System\vWaHPWb.exe
  2⤵
  PID:12416
- C:\Windows\System\zRMaPDC.exe
  C:\Windows\System\zRMaPDC.exe
  2⤵
  PID:12440
- C:\Windows\System\UCbDCAy.exe
  C:\Windows\System\UCbDCAy.exe
  2⤵
  PID:12460
- C:\Windows\System\WrKnppS.exe
  C:\Windows\System\WrKnppS.exe
  2⤵
  PID:12480
- C:\Windows\System\GZNWyGJ.exe
  C:\Windows\System\GZNWyGJ.exe
  2⤵
  PID:12540
- C:\Windows\System\LCQwJtL.exe
  C:\Windows\System\LCQwJtL.exe
  2⤵
  PID:12568
- C:\Windows\System\GfJHmgP.exe
  C:\Windows\System\GfJHmgP.exe
  2⤵
  PID:12596
- C:\Windows\System\hYVuuub.exe
  C:\Windows\System\hYVuuub.exe
  2⤵
  PID:12676
- C:\Windows\System\KXCUywg.exe
  C:\Windows\System\KXCUywg.exe
  2⤵
  PID:12716
- C:\Windows\System\eSYkBSG.exe
  C:\Windows\System\eSYkBSG.exe
  2⤵
  PID:12764
- C:\Windows\System\ByeiVYY.exe
  C:\Windows\System\ByeiVYY.exe
  2⤵
  PID:12784
- C:\Windows\System\ydplsVT.exe
  C:\Windows\System\ydplsVT.exe
  2⤵
  PID:12816
- C:\Windows\System\qlmyCoO.exe
  C:\Windows\System\qlmyCoO.exe
  2⤵
  PID:12836
- C:\Windows\System\cCimuQI.exe
  C:\Windows\System\cCimuQI.exe
  2⤵
  PID:12856
- C:\Windows\System\eGgQzpG.exe
  C:\Windows\System\eGgQzpG.exe
  2⤵
  PID:12912
- C:\Windows\System\QXqxBCH.exe
  C:\Windows\System\QXqxBCH.exe
  2⤵
  PID:12936
- C:\Windows\System\YrkqzxA.exe
  C:\Windows\System\YrkqzxA.exe
  2⤵
  PID:12968
- C:\Windows\System\GWfFbUU.exe
  C:\Windows\System\GWfFbUU.exe
  2⤵
  PID:13044
- C:\Windows\System\bHeBdmm.exe
  C:\Windows\System\bHeBdmm.exe
  2⤵
  PID:13064
- C:\Windows\System\sZCXJPP.exe
  C:\Windows\System\sZCXJPP.exe
  2⤵
  PID:13084
- C:\Windows\System\yFzrcYw.exe
  C:\Windows\System\yFzrcYw.exe
  2⤵
  PID:13104
- C:\Windows\System\eRbzhaT.exe
  C:\Windows\System\eRbzhaT.exe
  2⤵
  PID:13124
- C:\Windows\System\AUXQdtr.exe
  C:\Windows\System\AUXQdtr.exe
  2⤵
  PID:13140
- C:\Windows\System\zGrIXue.exe
  C:\Windows\System\zGrIXue.exe
  2⤵
  PID:13188
- C:\Windows\System\AKWOqQO.exe
  C:\Windows\System\AKWOqQO.exe
  2⤵
  PID:13208
- C:\Windows\System\jplpxhq.exe
  C:\Windows\System\jplpxhq.exe
  2⤵
  PID:13256
- C:\Windows\System\daKNXZh.exe
  C:\Windows\System\daKNXZh.exe
  2⤵
  PID:13296
- C:\Windows\System\EznsxMx.exe
  C:\Windows\System\EznsxMx.exe
  2⤵
  PID:3396
- C:\Windows\System\fGlhzmu.exe
  C:\Windows\System\fGlhzmu.exe
  2⤵
  PID:2212
- C:\Windows\System\KRuGhKK.exe
  C:\Windows\System\KRuGhKK.exe
  2⤵
  PID:4104
- C:\Windows\System\lDpmVzu.exe
  C:\Windows\System\lDpmVzu.exe
  2⤵
  PID:11972
- C:\Windows\System\TWAmVQv.exe
  C:\Windows\System\TWAmVQv.exe
  2⤵
  PID:3996
- C:\Windows\System\KjrJbhX.exe
  C:\Windows\System\KjrJbhX.exe
  2⤵
  PID:2304
- C:\Windows\System\xsxrrrR.exe
  C:\Windows\System\xsxrrrR.exe
  2⤵
  PID:12388
- C:\Windows\System\HdEYvxz.exe
  C:\Windows\System\HdEYvxz.exe
  2⤵
  PID:4980
- C:\Windows\System\ewKZkUk.exe
  C:\Windows\System\ewKZkUk.exe
  2⤵
  PID:12448
- C:\Windows\System\dUYJMoA.exe
  C:\Windows\System\dUYJMoA.exe
  2⤵
  PID:12380
- C:\Windows\System\NhgbHie.exe
  C:\Windows\System\NhgbHie.exe
  2⤵
  PID:12648
- C:\Windows\System\fjxMEOw.exe
  C:\Windows\System\fjxMEOw.exe
  2⤵
  PID:12660
- C:\Windows\System\gMYneJC.exe
  C:\Windows\System\gMYneJC.exe
  2⤵
  PID:12204
- C:\Windows\System\NBFzoWZ.exe
  C:\Windows\System\NBFzoWZ.exe
  2⤵
  PID:12732
- C:\Windows\System\RqcerNK.exe
  C:\Windows\System\RqcerNK.exe
  2⤵
  PID:12140
- C:\Windows\System\HbCXMEZ.exe
  C:\Windows\System\HbCXMEZ.exe
  2⤵
  PID:12824
- C:\Windows\System\pMZXdoI.exe
  C:\Windows\System\pMZXdoI.exe
  2⤵
  PID:12848
- C:\Windows\System\iswlMrR.exe
  C:\Windows\System\iswlMrR.exe
  2⤵
  PID:12908
- C:\Windows\System\uhiWonk.exe
  C:\Windows\System\uhiWonk.exe
  2⤵
  PID:12960
- C:\Windows\System\WvVrFMb.exe
  C:\Windows\System\WvVrFMb.exe
  2⤵
  PID:11948
- C:\Windows\System\DJWSOcj.exe
  C:\Windows\System\DJWSOcj.exe
  2⤵
  PID:12984
- C:\Windows\System\azPStJj.exe
  C:\Windows\System\azPStJj.exe
  2⤵
  PID:13168
- C:\Windows\System\BTzgGkH.exe
  C:\Windows\System\BTzgGkH.exe
  2⤵
  PID:13232
- C:\Windows\System\mkfZcFQ.exe
  C:\Windows\System\mkfZcFQ.exe
  2⤵
  PID:13244
- C:\Windows\System\zUIpGuV.exe
  C:\Windows\System\zUIpGuV.exe
  2⤵
  PID:13268
- C:\Windows\System\kUaPcIc.exe
  C:\Windows\System\kUaPcIc.exe
  2⤵
  PID:2356
- C:\Windows\System\ExsDfjt.exe
  C:\Windows\System\ExsDfjt.exe
  2⤵
  PID:13304
- C:\Windows\System\janjfZS.exe
  C:\Windows\System\janjfZS.exe
  2⤵
  PID:10760
- C:\Windows\System\AfHkNAu.exe
  C:\Windows\System\AfHkNAu.exe
  2⤵
  PID:3240
- C:\Windows\System\WBUpSKS.exe
  C:\Windows\System\WBUpSKS.exe
  2⤵
  PID:4960
- C:\Windows\System\aCozOvP.exe
  C:\Windows\System\aCozOvP.exe
  2⤵
  PID:10960
- C:\Windows\System\ZzeQvfg.exe
  C:\Windows\System\ZzeQvfg.exe
  2⤵
  PID:11960
- C:\Windows\System\VbATrfo.exe
  C:\Windows\System\VbATrfo.exe
  2⤵
  PID:12436
- C:\Windows\System\oCRsikQ.exe
  C:\Windows\System\oCRsikQ.exe
  2⤵
  PID:5628
- C:\Windows\System\VBMPobl.exe
  C:\Windows\System\VBMPobl.exe
  2⤵
  PID:5684
- C:\Windows\System\nqLrMuJ.exe
  C:\Windows\System\nqLrMuJ.exe
  2⤵
  PID:13148
- C:\Windows\System\RIssHMI.exe
  C:\Windows\System\RIssHMI.exe
  2⤵
  PID:12520
- C:\Windows\System\EIZEMcD.exe
  C:\Windows\System\EIZEMcD.exe
  2⤵
  PID:5712
- C:\Windows\System\nfcaYvI.exe
  C:\Windows\System\nfcaYvI.exe
  2⤵
  PID:5836
- C:\Windows\System\gYgjnIO.exe
  C:\Windows\System\gYgjnIO.exe
  2⤵
  PID:13132
- C:\Windows\System\pqHJhUr.exe
  C:\Windows\System\pqHJhUr.exe
  2⤵
  PID:5928
- C:\Windows\System\KswmCbe.exe
  C:\Windows\System\KswmCbe.exe
  2⤵
  PID:6020
- C:\Windows\System\ygFwHlp.exe
  C:\Windows\System\ygFwHlp.exe
  2⤵
  PID:2748
- C:\Windows\System\hiEYEGS.exe
  C:\Windows\System\hiEYEGS.exe
  2⤵
  PID:11360
- C:\Windows\System\cvImmko.exe
  C:\Windows\System\cvImmko.exe
  2⤵
  PID:5388
- C:\Windows\System\DnmjLaP.exe
  C:\Windows\System\DnmjLaP.exe
  2⤵
  PID:11336
- C:\Windows\System\bNlaWtW.exe
  C:\Windows\System\bNlaWtW.exe
  2⤵
  PID:6060
- C:\Windows\System\VStxaQz.exe
  C:\Windows\System\VStxaQz.exe
  2⤵
  PID:12340
- C:\Windows\System\FfgLARG.exe
  C:\Windows\System\FfgLARG.exe
  2⤵
  PID:3616
- C:\Windows\System\xxYmhRz.exe
  C:\Windows\System\xxYmhRz.exe
  2⤵
  PID:12776
- C:\Windows\System\uslDWqW.exe
  C:\Windows\System\uslDWqW.exe
  2⤵
  PID:6220
- C:\Windows\System\lGgnsHX.exe
  C:\Windows\System\lGgnsHX.exe
  2⤵
  PID:12920
- C:\Windows\System\YgPyDcq.exe
  C:\Windows\System\YgPyDcq.exe
  2⤵
  PID:5904
- C:\Windows\System\VlhVmkI.exe
  C:\Windows\System\VlhVmkI.exe
  2⤵
  PID:6448
- C:\Windows\System\OHkyavR.exe
  C:\Windows\System\OHkyavR.exe
  2⤵
  PID:4656
- C:\Windows\System\vMpUWyO.exe
  C:\Windows\System\vMpUWyO.exe
  2⤵
  PID:12316
- C:\Windows\System\sxnXsgG.exe
  C:\Windows\System\sxnXsgG.exe
  2⤵
  PID:8360
- C:\Windows\System\tOjWaLV.exe
  C:\Windows\System\tOjWaLV.exe
  2⤵
  PID:5248
- C:\Windows\System\yEQnTjg.exe
  C:\Windows\System\yEQnTjg.exe
  2⤵
  PID:1772
- C:\Windows\System\nivyhUe.exe
  C:\Windows\System\nivyhUe.exe
  2⤵
  PID:1164
- C:\Windows\System\QKTjghG.exe
  C:\Windows\System\QKTjghG.exe
  2⤵
  PID:13172
- C:\Windows\System\jzKtGMm.exe
  C:\Windows\System\jzKtGMm.exe
  2⤵
  PID:6696
- C:\Windows\System\WwaoXoW.exe
  C:\Windows\System\WwaoXoW.exe
  2⤵
  PID:6184
- C:\Windows\System\DEzsRXF.exe
  C:\Windows\System\DEzsRXF.exe
  2⤵
  PID:6488
- C:\Windows\System\BTeKBDj.exe
  C:\Windows\System\BTeKBDj.exe
  2⤵
  PID:6316
- C:\Windows\System\iWNpNuE.exe
  C:\Windows\System\iWNpNuE.exe
  2⤵
  PID:6568
- C:\Windows\System\QOPUYQR.exe
  C:\Windows\System\QOPUYQR.exe
  2⤵
  PID:6624
- C:\Windows\System\GSEyKIF.exe
  C:\Windows\System\GSEyKIF.exe
  2⤵
  PID:6608
- C:\Windows\System\nKaDQdq.exe
  C:\Windows\System\nKaDQdq.exe
  2⤵
  PID:10384
- C:\Windows\System\RUgDnma.exe
  C:\Windows\System\RUgDnma.exe
  2⤵
  PID:6580
- C:\Windows\System\dLxrQBA.exe
  C:\Windows\System\dLxrQBA.exe
  2⤵
  PID:5280
- C:\Windows\System\ebwmwPj.exe
  C:\Windows\System\ebwmwPj.exe
  2⤵
  PID:5732
- C:\Windows\System\cYjysFK.exe
  C:\Windows\System\cYjysFK.exe
  2⤵
  PID:5916
- C:\Windows\System\VpUWtQI.exe
  C:\Windows\System\VpUWtQI.exe
  2⤵
  PID:3132
- C:\Windows\System\BZGvfOX.exe
  C:\Windows\System\BZGvfOX.exe
  2⤵
  PID:5776
- C:\Windows\System\GnEabTF.exe
  C:\Windows\System\GnEabTF.exe
  2⤵
  PID:5368
- C:\Windows\System\tHnyifb.exe
  C:\Windows\System\tHnyifb.exe
  2⤵
  PID:6012
- C:\Windows\System\aKuSaWB.exe
  C:\Windows\System\aKuSaWB.exe
  2⤵
  PID:6368
- C:\Windows\System\oVAbqaG.exe
  C:\Windows\System\oVAbqaG.exe
  2⤵
  PID:13428
- C:\Windows\System\zRaEacf.exe
  C:\Windows\System\zRaEacf.exe
  2⤵
  PID:13448
- C:\Windows\System\hZCOuYW.exe
  C:\Windows\System\hZCOuYW.exe
  2⤵
  PID:13468
- C:\Windows\System\UlxgLti.exe
  C:\Windows\System\UlxgLti.exe
  2⤵
  PID:13492
- C:\Windows\System\XDIGQOu.exe
  C:\Windows\System\XDIGQOu.exe
  2⤵
  PID:13520
- C:\Windows\System\vOfIleH.exe
  C:\Windows\System\vOfIleH.exe
  2⤵
  PID:13536
- C:\Windows\System\ElEwxOj.exe
  C:\Windows\System\ElEwxOj.exe
  2⤵
  PID:13556
- C:\Windows\System\lZWfPQy.exe
  C:\Windows\System\lZWfPQy.exe
  2⤵
  PID:13572
- C:\Windows\System\MKsMBSF.exe
  C:\Windows\System\MKsMBSF.exe
  2⤵
  PID:13596
- C:\Windows\System\geFboWB.exe
  C:\Windows\System\geFboWB.exe
  2⤵
  PID:14136
- C:\Windows\System\ilhVaVt.exe
  C:\Windows\System\ilhVaVt.exe
  2⤵
  PID:14180
- C:\Windows\System\HTkXwnr.exe
  C:\Windows\System\HTkXwnr.exe
  2⤵
  PID:14196
- C:\Windows\System\lKqNqbQ.exe
  C:\Windows\System\lKqNqbQ.exe
  2⤵
  PID:14216
- C:\Windows\System\oajNDml.exe
  C:\Windows\System\oajNDml.exe
  2⤵
  PID:14232
- C:\Windows\System\PXulZsB.exe
  C:\Windows\System\PXulZsB.exe
  2⤵
  PID:14248
- C:\Windows\System\BwoIztT.exe
  C:\Windows\System\BwoIztT.exe
  2⤵
  PID:14268
- C:\Windows\System\nsHjeDO.exe
  C:\Windows\System\nsHjeDO.exe
  2⤵
  PID:14284
- C:\Windows\System\ULEonhx.exe
  C:\Windows\System\ULEonhx.exe
  2⤵
  PID:14316
- C:\Windows\System\rflWtrJ.exe
  C:\Windows\System\rflWtrJ.exe
  2⤵
  PID:12812
- C:\Windows\System\iupUzli.exe
  C:\Windows\System\iupUzli.exe
  2⤵
  PID:6324
- C:\Windows\System\WeAIKbd.exe
  C:\Windows\System\WeAIKbd.exe
  2⤵
  PID:13236
- C:\Windows\System\ZscQwkA.exe
  C:\Windows\System\ZscQwkA.exe
  2⤵
  PID:4812
- C:\Windows\System\VeLJsIx.exe
  C:\Windows\System\VeLJsIx.exe
  2⤵
  PID:5716
- C:\Windows\System\QgIwqKo.exe
  C:\Windows\System\QgIwqKo.exe
  2⤵
  PID:7048
- C:\Windows\System\TbPKWvY.exe
  C:\Windows\System\TbPKWvY.exe
  2⤵
  PID:5604
- C:\Windows\System\lLPnUaO.exe
  C:\Windows\System\lLPnUaO.exe
  2⤵
  PID:6584
- C:\Windows\System\HexWOXS.exe
  C:\Windows\System\HexWOXS.exe
  2⤵
  PID:6912
- C:\Windows\System\zjxgGqo.exe
  C:\Windows\System\zjxgGqo.exe
  2⤵
  PID:5132
- C:\Windows\System\WcwxkwU.exe
  C:\Windows\System\WcwxkwU.exe
  2⤵
  PID:6472
- C:\Windows\System\EgeyYKk.exe
  C:\Windows\System\EgeyYKk.exe
  2⤵
  PID:7128
- C:\Windows\System\cHyUBYw.exe
  C:\Windows\System\cHyUBYw.exe
  2⤵
  PID:12312
- C:\Windows\System\Vxjemcv.exe
  C:\Windows\System\Vxjemcv.exe
  2⤵
  PID:13672
- C:\Windows\System\fsvscal.exe
  C:\Windows\System\fsvscal.exe
  2⤵
  PID:13368
- C:\Windows\System\VXCDFrL.exe
  C:\Windows\System\VXCDFrL.exe
  2⤵
  PID:13396
- C:\Windows\System\LsfMwSs.exe
  C:\Windows\System\LsfMwSs.exe
  2⤵
  PID:13420
- C:\Windows\System\pDscDAk.exe
  C:\Windows\System\pDscDAk.exe
  2⤵
  PID:13720
- C:\Windows\System\FiHHWfs.exe
  C:\Windows\System\FiHHWfs.exe
  2⤵
  PID:13804
- C:\Windows\System\gxLCWGf.exe
  C:\Windows\System\gxLCWGf.exe
  2⤵
  PID:13900
- C:\Windows\System\aeyorZA.exe
  C:\Windows\System\aeyorZA.exe
  2⤵
  PID:13924
- C:\Windows\System\eOanfve.exe
  C:\Windows\System\eOanfve.exe
  2⤵
  PID:7640
- C:\Windows\System\cXMKBMQ.exe
  C:\Windows\System\cXMKBMQ.exe
  2⤵
  PID:7348
- C:\Windows\System\BezOBQD.exe
  C:\Windows\System\BezOBQD.exe
  2⤵
  PID:14004
- C:\Windows\System\rvwnhZq.exe
  C:\Windows\System\rvwnhZq.exe
  2⤵
  PID:6928
- C:\Windows\System\JkSHEli.exe
  C:\Windows\System\JkSHEli.exe
  2⤵
  PID:7184
- C:\Windows\System\rnniofF.exe
  C:\Windows\System\rnniofF.exe
  2⤵
  PID:6092
- C:\Windows\System\QrfURDf.exe
  C:\Windows\System\QrfURDf.exe
  2⤵
  PID:7476
- C:\Windows\System\mvxTQWB.exe
  C:\Windows\System\mvxTQWB.exe
  2⤵
  PID:7464
- C:\Windows\System\ArWqUkg.exe
  C:\Windows\System\ArWqUkg.exe
  2⤵
  PID:7756
- C:\Windows\System\UZsWBbX.exe
  C:\Windows\System\UZsWBbX.exe
  2⤵
  PID:7556
- C:\Windows\System\rTGZSIp.exe
  C:\Windows\System\rTGZSIp.exe
  2⤵
  PID:14124
- C:\Windows\System\NClbWDr.exe
  C:\Windows\System\NClbWDr.exe
  2⤵
  PID:14012
- C:\Windows\System\rOwIWBu.exe
  C:\Windows\System\rOwIWBu.exe
  2⤵
  PID:14160
- C:\Windows\System\DEXzyoQ.exe
  C:\Windows\System\DEXzyoQ.exe
  2⤵
  PID:13960
- C:\Windows\System\ODvlVmr.exe
  C:\Windows\System\ODvlVmr.exe
  2⤵
  PID:14028
- C:\Windows\System\waedGEF.exe
  C:\Windows\System\waedGEF.exe
  2⤵
  PID:14084
- C:\Windows\System\zTlxwNb.exe
  C:\Windows\System\zTlxwNb.exe
  2⤵
  PID:14172
- C:\Windows\System\IcAWnzp.exe
  C:\Windows\System\IcAWnzp.exe
  2⤵
  PID:7324
- C:\Windows\System\RjaOhPz.exe
  C:\Windows\System\RjaOhPz.exe
  2⤵
  PID:7852
- C:\Windows\System\ySZXOmW.exe
  C:\Windows\System\ySZXOmW.exe
  2⤵
  PID:7820
- C:\Windows\System\rDfseaf.exe
  C:\Windows\System\rDfseaf.exe
  2⤵
  PID:13976
- C:\Windows\System\xDuhhsw.exe
  C:\Windows\System\xDuhhsw.exe
  2⤵
  PID:13984
- C:\Windows\System\VGzDfNf.exe
  C:\Windows\System\VGzDfNf.exe
  2⤵
  PID:14204
- C:\Windows\System\PrwbdVX.exe
  C:\Windows\System\PrwbdVX.exe
  2⤵
  PID:6860
- C:\Windows\System\HlnRJLK.exe
  C:\Windows\System\HlnRJLK.exe
  2⤵
  PID:6460
- C:\Windows\System\WSjHLSY.exe
  C:\Windows\System\WSjHLSY.exe
  2⤵
  PID:10928
- C:\Windows\System\XoZmPiU.exe
  C:\Windows\System\XoZmPiU.exe
  2⤵
  PID:14260
- C:\Windows\System\lRzFWCH.exe
  C:\Windows\System\lRzFWCH.exe
  2⤵
  PID:14024
- C:\Windows\System\yKwIgar.exe
  C:\Windows\System\yKwIgar.exe
  2⤵
  PID:7716
- C:\Windows\System\YlMUPQg.exe
  C:\Windows\System\YlMUPQg.exe
  2⤵
  PID:14060
- C:\Windows\System\jQEhxte.exe
  C:\Windows\System\jQEhxte.exe
  2⤵
  PID:14096
- C:\Windows\System\iRwLXyc.exe
  C:\Windows\System\iRwLXyc.exe
  2⤵
  PID:8020
- C:\Windows\System\zBpfKks.exe
  C:\Windows\System\zBpfKks.exe
  2⤵
  PID:7924
- C:\Windows\System\FrZQFNW.exe
  C:\Windows\System\FrZQFNW.exe
  2⤵
  PID:7804
- C:\Windows\System\gwWfMdK.exe
  C:\Windows\System\gwWfMdK.exe
  2⤵
  PID:14144
- C:\Windows\System\Zxexvhi.exe
  C:\Windows\System\Zxexvhi.exe
  2⤵
  PID:14244
- C:\Windows\System\gTEcecf.exe
  C:\Windows\System\gTEcecf.exe
  2⤵
  PID:7584
- C:\Windows\System\igOcwaL.exe
  C:\Windows\System\igOcwaL.exe
  2⤵
  PID:14056
- C:\Windows\System\xQKnEwf.exe
  C:\Windows\System\xQKnEwf.exe
  2⤵
  PID:6500
- C:\Windows\System\zgrIZrV.exe
  C:\Windows\System\zgrIZrV.exe
  2⤵
  PID:8068
- C:\Windows\System\qhwFVXG.exe
  C:\Windows\System\qhwFVXG.exe
  2⤵
  PID:7332
- C:\Windows\System\OUTvTXy.exe
  C:\Windows\System\OUTvTXy.exe
  2⤵
  PID:8080
- C:\Windows\System\sgYdSiL.exe
  C:\Windows\System\sgYdSiL.exe
  2⤵
  PID:7072
- C:\Windows\System\dBuVIcA.exe
  C:\Windows\System\dBuVIcA.exe
  2⤵
  PID:13564
- C:\Windows\System\xmKNASk.exe
  C:\Windows\System\xmKNASk.exe
  2⤵
  PID:8588
- C:\Windows\System\zgHWIEA.exe
  C:\Windows\System\zgHWIEA.exe
  2⤵
  PID:13756
- C:\Windows\System\PBuhZul.exe
  C:\Windows\System\PBuhZul.exe
  2⤵
  PID:12712
- C:\Windows\System\zVcEoPy.exe
  C:\Windows\System\zVcEoPy.exe
  2⤵
  PID:6688
- C:\Windows\System\ojnIeco.exe
  C:\Windows\System\ojnIeco.exe
  2⤵
  PID:9088
- C:\Windows\System\ZyDJVEy.exe
  C:\Windows\System\ZyDJVEy.exe
  2⤵
  PID:8628
- C:\Windows\System\nKcuJva.exe
  C:\Windows\System\nKcuJva.exe
  2⤵
  PID:7364
- C:\Windows\System\oqXWUzD.exe
  C:\Windows\System\oqXWUzD.exe
  2⤵
  PID:7712
- C:\Windows\System\ZbFLAcm.exe
  C:\Windows\System\ZbFLAcm.exe
  2⤵
  PID:14008
- C:\Windows\System\HfBcAak.exe
  C:\Windows\System\HfBcAak.exe
  2⤵
  PID:8316
- C:\Windows\System\ZEVDAKT.exe
  C:\Windows\System\ZEVDAKT.exe
  2⤵
  PID:7156
- C:\Windows\System\wLRLEeZ.exe
  C:\Windows\System\wLRLEeZ.exe
  2⤵
  PID:14064
- C:\Windows\System\lKkBhfm.exe
  C:\Windows\System\lKkBhfm.exe
  2⤵
  PID:14128
- C:\Windows\System\uNQiTnP.exe
  C:\Windows\System\uNQiTnP.exe
  2⤵
  PID:12240
- C:\Windows\System\agiCMwH.exe
  C:\Windows\System\agiCMwH.exe
  2⤵
  PID:12256
- C:\Windows\System\ArOlmgg.exe
  C:\Windows\System\ArOlmgg.exe
  2⤵
  PID:12264
- C:\Windows\System\XUuAAiS.exe
  C:\Windows\System\XUuAAiS.exe
  2⤵
  PID:4720
- C:\Windows\System\MlivEyr.exe
  C:\Windows\System\MlivEyr.exe
  2⤵
  PID:6644
- C:\Windows\System\ZWbVGBY.exe
  C:\Windows\System\ZWbVGBY.exe
  2⤵
  PID:8488
- C:\Windows\System\Ylapncr.exe
  C:\Windows\System\Ylapncr.exe
  2⤵
  PID:6004
- C:\Windows\System\hNzFdbu.exe
  C:\Windows\System\hNzFdbu.exe
  2⤵
  PID:6776
- C:\Windows\System\JhFShpu.exe
  C:\Windows\System\JhFShpu.exe
  2⤵
  PID:13316
- C:\Windows\System\bxmxoZJ.exe
  C:\Windows\System\bxmxoZJ.exe
  2⤵
  PID:9388
- C:\Windows\System\IFlHSjB.exe
  C:\Windows\System\IFlHSjB.exe
  2⤵
  PID:7120
- C:\Windows\System\amPiUOo.exe
  C:\Windows\System\amPiUOo.exe
  2⤵
  PID:6932
- C:\Windows\System\FjLSMlq.exe
  C:\Windows\System\FjLSMlq.exe
  2⤵
  PID:6096
- C:\Windows\System\pjuGLQu.exe
  C:\Windows\System\pjuGLQu.exe
  2⤵
  PID:7504
- C:\Windows\System\xwahgzx.exe
  C:\Windows\System\xwahgzx.exe
  2⤵
  PID:13852
- C:\Windows\System\VlWQHRY.exe
  C:\Windows\System\VlWQHRY.exe
  2⤵
  PID:13568
- C:\Windows\System\lZdzQsH.exe
  C:\Windows\System\lZdzQsH.exe
  2⤵
  PID:11768
- C:\Windows\System\zDDPzct.exe
  C:\Windows\System\zDDPzct.exe
  2⤵
  PID:14168
- C:\Windows\System\fIAQMcR.exe
  C:\Windows\System\fIAQMcR.exe
  2⤵
  PID:13724
- C:\Windows\System\UvsjeLQ.exe
  C:\Windows\System\UvsjeLQ.exe
  2⤵
  PID:9580
- C:\Windows\System\DqNJPHE.exe
  C:\Windows\System\DqNJPHE.exe
  2⤵
  PID:9676
- C:\Windows\System\BTjHcQH.exe
  C:\Windows\System\BTjHcQH.exe
  2⤵
  PID:9604
- C:\Windows\System\CvJwYWQ.exe
  C:\Windows\System\CvJwYWQ.exe
  2⤵
  PID:9852
- C:\Windows\System\YlKniER.exe
  C:\Windows\System\YlKniER.exe
  2⤵
  PID:9892
- C:\Windows\System\ylgVjGc.exe
  C:\Windows\System\ylgVjGc.exe
  2⤵
  PID:9792
- C:\Windows\System\qCqngxj.exe
  C:\Windows\System\qCqngxj.exe
  2⤵
  PID:13968
- C:\Windows\System\KXngJYN.exe
  C:\Windows\System\KXngJYN.exe
  2⤵
  PID:8004
- C:\Windows\System\dljIeUn.exe
  C:\Windows\System\dljIeUn.exe
  2⤵
  PID:2624
- C:\Windows\System\KJshPZq.exe
  C:\Windows\System\KJshPZq.exe
  2⤵
  PID:14240
- C:\Windows\System\enGIQnM.exe
  C:\Windows\System\enGIQnM.exe
  2⤵
  PID:7832
- C:\Windows\System\jbDlzRg.exe
  C:\Windows\System\jbDlzRg.exe
  2⤵
  PID:11084
- C:\Windows\System\nvITxAG.exe
  C:\Windows\System\nvITxAG.exe
  2⤵
  PID:9756
- C:\Windows\System\iLPuUcQ.exe
  C:\Windows\System\iLPuUcQ.exe
  2⤵
  PID:9736
- C:\Windows\System\doVOoim.exe
  C:\Windows\System\doVOoim.exe
  2⤵
  PID:7292
- C:\Windows\System\kHkcGAq.exe
  C:\Windows\System\kHkcGAq.exe
  2⤵
  PID:8972
- C:\Windows\System\uppXVNo.exe
  C:\Windows\System\uppXVNo.exe
  2⤵
  PID:6760
- C:\Windows\System\exnUltn.exe
  C:\Windows\System\exnUltn.exe
  2⤵
  PID:7304
- C:\Windows\System\OtSezpK.exe
  C:\Windows\System\OtSezpK.exe
  2⤵
  PID:10004
- C:\Windows\System\FyuMgMt.exe
  C:\Windows\System\FyuMgMt.exe
  2⤵
  PID:10444
- C:\Windows\System\QEoSrkb.exe
  C:\Windows\System\QEoSrkb.exe
  2⤵
  PID:10684
- C:\Windows\System\qfCoiwJ.exe
  C:\Windows\System\qfCoiwJ.exe
  2⤵
  PID:14296
- C:\Windows\System\lzARaDX.exe
  C:\Windows\System\lzARaDX.exe
  2⤵
  PID:10620
- C:\Windows\System\KPvwJZq.exe
  C:\Windows\System\KPvwJZq.exe
  2⤵
  PID:10428
- C:\Windows\System\hYybwoG.exe
  C:\Windows\System\hYybwoG.exe
  2⤵
  PID:10604
- C:\Windows\System\pSgBusS.exe
  C:\Windows\System\pSgBusS.exe
  2⤵
  PID:8412
- C:\Windows\System\JFiJuWc.exe
  C:\Windows\System\JFiJuWc.exe
  2⤵
  PID:8936
- C:\Windows\System\VeWdIBR.exe
  C:\Windows\System\VeWdIBR.exe
  2⤵
  PID:7748
- C:\Windows\System\HRcTZPI.exe
  C:\Windows\System\HRcTZPI.exe
  2⤵
  PID:9232
- C:\Windows\System\MDzzZnV.exe
  C:\Windows\System\MDzzZnV.exe
  2⤵
  PID:10812
- C:\Windows\System\FmWgotd.exe
  C:\Windows\System\FmWgotd.exe
  2⤵
  PID:8940
- C:\Windows\System\NGnQdFa.exe
  C:\Windows\System\NGnQdFa.exe
  2⤵
  PID:10956
- C:\Windows\System\RoawTZf.exe
  C:\Windows\System\RoawTZf.exe
  2⤵
  PID:8472
- C:\Windows\System\GXgqUpX.exe
  C:\Windows\System\GXgqUpX.exe
  2⤵
  PID:14256
- C:\Windows\System\IYrhDJc.exe
  C:\Windows\System\IYrhDJc.exe
  2⤵
  PID:8876
- C:\Windows\System\lAUpbMX.exe
  C:\Windows\System\lAUpbMX.exe
  2⤵
  PID:10936
- C:\Windows\System\ngvnnri.exe
  C:\Windows\System\ngvnnri.exe
  2⤵
  PID:11080
- C:\Windows\System\DwLbWBK.exe
  C:\Windows\System\DwLbWBK.exe
  2⤵
  PID:11124
- C:\Windows\System\mzbuETa.exe
  C:\Windows\System\mzbuETa.exe
  2⤵
  PID:10468
- C:\Windows\System\IkNTEzS.exe
  C:\Windows\System\IkNTEzS.exe
  2⤵
  PID:4120
- C:\Windows\System\MMHfSxX.exe
  C:\Windows\System\MMHfSxX.exe
  2⤵
  PID:7800
- C:\Windows\System\lMQcPWj.exe
  C:\Windows\System\lMQcPWj.exe
  2⤵
  PID:11120
- C:\Windows\System\yPQDeGV.exe
  C:\Windows\System\yPQDeGV.exe
  2⤵
  PID:12268
- C:\Windows\System\qQbAGkq.exe
  C:\Windows\System\qQbAGkq.exe
  2⤵
  PID:10472
- C:\Windows\System\cNJHeOb.exe
  C:\Windows\System\cNJHeOb.exe
  2⤵
  PID:9512
- C:\Windows\System\dMSQbZy.exe
  C:\Windows\System\dMSQbZy.exe
  2⤵
  PID:6376
- C:\Windows\System\lqUaaof.exe
  C:\Windows\System\lqUaaof.exe
  2⤵
  PID:8044
- C:\Windows\System\kNNyhCd.exe
  C:\Windows\System\kNNyhCd.exe
  2⤵
  PID:6668
- C:\Windows\System\BDeZQrr.exe
  C:\Windows\System\BDeZQrr.exe
  2⤵
  PID:5976
- C:\Windows\System\hpbWCwl.exe
  C:\Windows\System\hpbWCwl.exe
  2⤵
  PID:13484
- C:\Windows\System\uWSziZE.exe
  C:\Windows\System\uWSziZE.exe
  2⤵
  PID:8400
- C:\Windows\System\owhmOaS.exe
  C:\Windows\System\owhmOaS.exe
  2⤵
  PID:13404
- C:\Windows\System\vLsbkTd.exe
  C:\Windows\System\vLsbkTd.exe
  2⤵
  PID:9576
- C:\Windows\System\BjCizaq.exe
  C:\Windows\System\BjCizaq.exe
  2⤵
  PID:13528
- C:\Windows\System\KAcByEG.exe
  C:\Windows\System\KAcByEG.exe
  2⤵
  PID:10448
- C:\Windows\System\poimtiG.exe
  C:\Windows\System\poimtiG.exe
  2⤵
  PID:13864
- C:\Windows\System\IZzqTRG.exe
  C:\Windows\System\IZzqTRG.exe
  2⤵
  PID:6908
- C:\Windows\System\lAmQDuf.exe
  C:\Windows\System\lAmQDuf.exe
  2⤵
  PID:9780
- C:\Windows\System\EOOEqgz.exe
  C:\Windows\System\EOOEqgz.exe
  2⤵
  PID:11796
- C:\Windows\System\JaoYGSp.exe
  C:\Windows\System\JaoYGSp.exe
  2⤵
  PID:9932
- C:\Windows\System\mzSRjri.exe
  C:\Windows\System\mzSRjri.exe
  2⤵
  PID:8140
- C:\Windows\System\lHXdxVw.exe
  C:\Windows\System\lHXdxVw.exe
  2⤵
  PID:12320
- C:\Windows\System\RbWXmHp.exe
  C:\Windows\System\RbWXmHp.exe
  2⤵
  PID:9712
- C:\Windows\System\GsTNbFu.exe
  C:\Windows\System\GsTNbFu.exe
  2⤵
  PID:11484
- C:\Windows\System\nlTFlbP.exe
  C:\Windows\System\nlTFlbP.exe
  2⤵
  PID:11460
- C:\Windows\System\ANwDkFj.exe
  C:\Windows\System\ANwDkFj.exe
  2⤵
  PID:7436
- C:\Windows\System\DuTOdbW.exe
  C:\Windows\System\DuTOdbW.exe
  2⤵
  PID:2064
- C:\Windows\System\JglqMSr.exe
  C:\Windows\System\JglqMSr.exe
  2⤵
  PID:11032
- C:\Windows\System\cOMldnS.exe
  C:\Windows\System\cOMldnS.exe
  2⤵
  PID:9776
- C:\Windows\System\rfYUveh.exe
  C:\Windows\System\rfYUveh.exe
  2⤵
  PID:11612
- C:\Windows\System\fXkKfaD.exe
  C:\Windows\System\fXkKfaD.exe
  2⤵
  PID:9860
- C:\Windows\System\aCNcpXV.exe
  C:\Windows\System\aCNcpXV.exe
  2⤵
  PID:10184
- C:\Windows\System\ogmpSUb.exe
  C:\Windows\System\ogmpSUb.exe
  2⤵
  PID:9128
- C:\Windows\System\REVWIVP.exe
  C:\Windows\System\REVWIVP.exe
  2⤵
  PID:9624
- C:\Windows\System\SHVkimC.exe
  C:\Windows\System\SHVkimC.exe
  2⤵
  PID:10512
- C:\Windows\System\bZjtMrp.exe
  C:\Windows\System\bZjtMrp.exe
  2⤵
  PID:14188
- C:\Windows\System\FYFxeaE.exe
  C:\Windows\System\FYFxeaE.exe
  2⤵
  PID:11724
- C:\Windows\System\iqTaDiP.exe
  C:\Windows\System\iqTaDiP.exe
  2⤵
  PID:9768
- C:\Windows\System\koEHrRQ.exe
  C:\Windows\System\koEHrRQ.exe
  2⤵
  PID:8504
- C:\Windows\System\iEBnPSv.exe
  C:\Windows\System\iEBnPSv.exe
  2⤵
  PID:14192
- C:\Windows\System\HnwWlru.exe
  C:\Windows\System\HnwWlru.exe
  2⤵
  PID:11000
- C:\Windows\System\qVHliwx.exe
  C:\Windows\System\qVHliwx.exe
  2⤵
  PID:12220
- C:\Windows\System\wEwWiBR.exe
  C:\Windows\System\wEwWiBR.exe
  2⤵
  PID:10536
- C:\Windows\System\RMNXNZu.exe
  C:\Windows\System\RMNXNZu.exe
  2⤵
  PID:13016
- C:\Windows\System\AdAuIoU.exe
  C:\Windows\System\AdAuIoU.exe
  2⤵
  PID:8888
- C:\Windows\System\WBDsIsF.exe
  C:\Windows\System\WBDsIsF.exe
  2⤵
  PID:8328
- C:\Windows\System\HLRIoMo.exe
  C:\Windows\System\HLRIoMo.exe
  2⤵
  PID:10492
- C:\Windows\System\iIQzsuU.exe
  C:\Windows\System\iIQzsuU.exe
  2⤵
  PID:8356
- C:\Windows\System\QtyEBqu.exe
  C:\Windows\System\QtyEBqu.exe
  2⤵
  PID:8840
- C:\Windows\System\hdIbHYN.exe
  C:\Windows\System\hdIbHYN.exe
  2⤵
  PID:9956
- C:\Windows\System\RJaLKyW.exe
  C:\Windows\System\RJaLKyW.exe
  2⤵
  PID:712
- C:\Windows\System\EIgDCZJ.exe
  C:\Windows\System\EIgDCZJ.exe
  2⤵
  PID:9564
- C:\Windows\System\KTEERXT.exe
  C:\Windows\System\KTEERXT.exe
  2⤵
  PID:10708
- C:\Windows\System\GQWegIy.exe
  C:\Windows\System\GQWegIy.exe
  2⤵
  PID:8544
- C:\Windows\System\oZLhdvH.exe
  C:\Windows\System\oZLhdvH.exe
  2⤵
  PID:9248
- C:\Windows\System\FKoKSqp.exe
  C:\Windows\System\FKoKSqp.exe
  2⤵
  PID:9352
- C:\Windows\System\KOTEKal.exe
  C:\Windows\System\KOTEKal.exe
  2⤵
  PID:10944
- C:\Windows\System\KWDwEYH.exe
  C:\Windows\System\KWDwEYH.exe
  2⤵
  PID:11112
- C:\Windows\System\gGFlyUp.exe
  C:\Windows\System\gGFlyUp.exe
  2⤵
  PID:1800
- C:\Windows\System\pHxzZEE.exe
  C:\Windows\System\pHxzZEE.exe
  2⤵
  PID:9800
- C:\Windows\System\RkenhLy.exe
  C:\Windows\System\RkenhLy.exe
  2⤵
  PID:11584
- C:\Windows\System\AoveXfE.exe
  C:\Windows\System\AoveXfE.exe
  2⤵
  PID:11464
- C:\Windows\System\WLEMaSb.exe
  C:\Windows\System\WLEMaSb.exe
  2⤵
  PID:8912
- C:\Windows\System\PhnnkUc.exe
  C:\Windows\System\PhnnkUc.exe
  2⤵
  PID:12584
- C:\Windows\System\AJepeMl.exe
  C:\Windows\System\AJepeMl.exe
  2⤵
  PID:9520
- C:\Windows\System\QFqSSdq.exe
  C:\Windows\System\QFqSSdq.exe
  2⤵
  PID:13948
- C:\Windows\System\GojMRgd.exe
  C:\Windows\System\GojMRgd.exe
  2⤵
  PID:8680
- C:\Windows\System\RxXDzvn.exe
  C:\Windows\System\RxXDzvn.exe
  2⤵
  PID:9068
- C:\Windows\System\DIeVgjW.exe
  C:\Windows\System\DIeVgjW.exe
  2⤵
  PID:9636
- C:\Windows\System\OLMtEfj.exe
  C:\Windows\System\OLMtEfj.exe
  2⤵
  PID:628
- C:\Windows\System\gBnYPez.exe
  C:\Windows\System\gBnYPez.exe
  2⤵
  PID:8688
- C:\Windows\System\cVxildZ.exe
  C:\Windows\System\cVxildZ.exe
  2⤵
  PID:12176
- C:\Windows\System\EekYgul.exe
  C:\Windows\System\EekYgul.exe
  2⤵
  PID:14148
- C:\Windows\System\rpPSWhA.exe
  C:\Windows\System\rpPSWhA.exe
  2⤵
  PID:12180
- C:\Windows\System\tViZQuJ.exe
  C:\Windows\System\tViZQuJ.exe
  2⤵
  PID:8188
- C:\Windows\System\REmaIyK.exe
  C:\Windows\System\REmaIyK.exe
  2⤵
  PID:10896
- C:\Windows\System\tEmEoUN.exe
  C:\Windows\System\tEmEoUN.exe
  2⤵
  PID:12116
- C:\Windows\System\FSLJaMU.exe
  C:\Windows\System\FSLJaMU.exe
  2⤵
  PID:2112
- C:\Windows\System\nAkPzeP.exe
  C:\Windows\System\nAkPzeP.exe
  2⤵
  PID:9540
- C:\Windows\System\VXvhdxl.exe
  C:\Windows\System\VXvhdxl.exe
  2⤵
  PID:13012
- C:\Windows\System\IAQzynM.exe
  C:\Windows\System\IAQzynM.exe
  2⤵
  PID:2860
- C:\Windows\System\hdXvlqN.exe
  C:\Windows\System\hdXvlqN.exe
  2⤵
  PID:11492
- C:\Windows\System\rPzNKKf.exe
  C:\Windows\System\rPzNKKf.exe
  2⤵
  PID:4460
- C:\Windows\System\GFNBwHR.exe
  C:\Windows\System\GFNBwHR.exe
  2⤵
  PID:11192
- C:\Windows\System\FOmWYqb.exe
  C:\Windows\System\FOmWYqb.exe
  2⤵
  PID:3784
- C:\Windows\System\AIxKqGA.exe
  C:\Windows\System\AIxKqGA.exe
  2⤵
  PID:11256
- C:\Windows\System\sEkVhYd.exe
  C:\Windows\System\sEkVhYd.exe
  2⤵
  PID:4236
- C:\Windows\System\PLTNTHU.exe
  C:\Windows\System\PLTNTHU.exe
  2⤵
  PID:11808
- C:\Windows\System\zfoEjuu.exe
  C:\Windows\System\zfoEjuu.exe
  2⤵
  PID:11328
- C:\Windows\System\iJLwLtH.exe
  C:\Windows\System\iJLwLtH.exe
  2⤵
  PID:2040
- C:\Windows\System\NrLjTfW.exe
  C:\Windows\System\NrLjTfW.exe
  2⤵
  PID:12620
- C:\Windows\System\tGkhQJC.exe
  C:\Windows\System\tGkhQJC.exe
  2⤵
  PID:8932
- C:\Windows\System\IqhuKnl.exe
  C:\Windows\System\IqhuKnl.exe
  2⤵
  PID:11916
- C:\Windows\System\ohoyxmc.exe
  C:\Windows\System\ohoyxmc.exe
  2⤵
  PID:1556
- C:\Windows\System\ysALBOQ.exe
  C:\Windows\System\ysALBOQ.exe
  2⤵
  PID:9840
- C:\Windows\System\xwHMKWY.exe
  C:\Windows\System\xwHMKWY.exe
  2⤵
  PID:260
- C:\Windows\System\BAfIsSD.exe
  C:\Windows\System\BAfIsSD.exe
  2⤵
  PID:9328
- C:\Windows\System\NXTZADE.exe
  C:\Windows\System\NXTZADE.exe
  2⤵
  PID:9468
- C:\Windows\System\WmsVZGb.exe
  C:\Windows\System\WmsVZGb.exe
  2⤵
  PID:6172
- C:\Windows\System\RqWuBwm.exe
  C:\Windows\System\RqWuBwm.exe
  2⤵
  PID:11372
- C:\Windows\System\gciTQYE.exe
  C:\Windows\System\gciTQYE.exe
  2⤵
  PID:3692
- C:\Windows\System\djSMjNv.exe
  C:\Windows\System\djSMjNv.exe
  2⤵
  PID:9096
- C:\Windows\System\Bpxqiji.exe
  C:\Windows\System\Bpxqiji.exe
  2⤵
  PID:3684
- C:\Windows\System\yQvpixq.exe
  C:\Windows\System\yQvpixq.exe
  2⤵
  PID:1836
- C:\Windows\System\FHuEwos.exe
  C:\Windows\System\FHuEwos.exe
  2⤵
  PID:3852
- C:\Windows\System\ixCUCic.exe
  C:\Windows\System\ixCUCic.exe
  2⤵
  PID:9844
- C:\Windows\System\teiFHCK.exe
  C:\Windows\System\teiFHCK.exe
  2⤵
  PID:1324
- C:\Windows\System\rGcXApE.exe
  C:\Windows\System\rGcXApE.exe
  2⤵
  PID:14324
- C:\Windows\System\bZXJjKY.exe
  C:\Windows\System\bZXJjKY.exe
  2⤵
  PID:11964
- C:\Windows\System\JWgnUUw.exe
  C:\Windows\System\JWgnUUw.exe
  2⤵
  PID:6000
- C:\Windows\System\CXkZRDq.exe
  C:\Windows\System\CXkZRDq.exe
  2⤵
  PID:12404
- C:\Windows\System\CUWWhLE.exe
  C:\Windows\System\CUWWhLE.exe
  2⤵
  PID:4380
- C:\Windows\System\wbQjJYq.exe
  C:\Windows\System\wbQjJYq.exe
  2⤵
  PID:14344
- C:\Windows\System\ioCsSHZ.exe
  C:\Windows\System\ioCsSHZ.exe
  2⤵
  PID:14364
- C:\Windows\System\DYvouhS.exe
  C:\Windows\System\DYvouhS.exe
  2⤵
  PID:14384
- C:\Windows\System\IXrGwMp.exe
  C:\Windows\System\IXrGwMp.exe
  2⤵
  PID:14404
- C:\Windows\System\NYkwvvh.exe
  C:\Windows\System\NYkwvvh.exe
  2⤵
  PID:14424
- C:\Windows\System\rdCsEmN.exe
  C:\Windows\System\rdCsEmN.exe
  2⤵
  PID:14440
- C:\Windows\System\DkRzivN.exe
  C:\Windows\System\DkRzivN.exe
  2⤵
  PID:14456
- C:\Windows\System\XQmINdz.exe
  C:\Windows\System\XQmINdz.exe
  2⤵
  PID:14488
- C:\Windows\System\IETaYvA.exe
  C:\Windows\System\IETaYvA.exe
  2⤵
  PID:14504
- C:\Windows\System\zlUPnBv.exe
  C:\Windows\System\zlUPnBv.exe
  2⤵
  PID:14524
- C:\Windows\System\bKrZfAE.exe
  C:\Windows\System\bKrZfAE.exe
  2⤵
  PID:14692
- C:\Windows\System\lQFbGCp.exe
  C:\Windows\System\lQFbGCp.exe
  2⤵
  PID:14708
- C:\Windows\System\mTKxUgM.exe
  C:\Windows\System\mTKxUgM.exe
  2⤵
  PID:14728
- C:\Windows\System\cTHEqOh.exe
  C:\Windows\System\cTHEqOh.exe
  2⤵
  PID:14892
- C:\Windows\System\kdwTAPn.exe
  C:\Windows\System\kdwTAPn.exe
  2⤵
  PID:14908
- C:\Windows\System\aYequqU.exe
  C:\Windows\System\aYequqU.exe
  2⤵
  PID:14932
- C:\Windows\System\FDINWKP.exe
  C:\Windows\System\FDINWKP.exe
  2⤵
  PID:14948
- C:\Windows\System\oWJyHfu.exe
  C:\Windows\System\oWJyHfu.exe
  2⤵
  PID:14980
- C:\Windows\System\BFGPwVT.exe
  C:\Windows\System\BFGPwVT.exe
  2⤵
  PID:15004
- C:\Windows\System\lMJnXqA.exe
  C:\Windows\System\lMJnXqA.exe
  2⤵
  PID:15032
- C:\Windows\System\kQoPjvz.exe
  C:\Windows\System\kQoPjvz.exe
  2⤵
  PID:15056
- C:\Windows\System\jDGxfGS.exe
  C:\Windows\System\jDGxfGS.exe
  2⤵
  PID:15072
- C:\Windows\System\hwRYLPH.exe
  C:\Windows\System\hwRYLPH.exe
  2⤵
  PID:15156
- C:\Windows\System\uogeeUE.exe
  C:\Windows\System\uogeeUE.exe
  2⤵
  PID:15172
- C:\Windows\System\leBQKcr.exe
  C:\Windows\System\leBQKcr.exe
  2⤵
  PID:15188
- C:\Windows\System\Laojigy.exe
  C:\Windows\System\Laojigy.exe
  2⤵
  PID:15204
- C:\Windows\System\cyGrrPZ.exe
  C:\Windows\System\cyGrrPZ.exe
  2⤵
  PID:15220
- C:\Windows\System\bIBvthN.exe
  C:\Windows\System\bIBvthN.exe
  2⤵
  PID:15240
- C:\Windows\System\GnzVRyE.exe
  C:\Windows\System\GnzVRyE.exe
  2⤵
  PID:15260
- C:\Windows\System\cZZsWvI.exe
  C:\Windows\System\cZZsWvI.exe
  2⤵
  PID:15320
- C:\Windows\System\YcaPsbp.exe
  C:\Windows\System\YcaPsbp.exe
  2⤵
  PID:15336
- C:\Windows\System\YQUDxxu.exe
  C:\Windows\System\YQUDxxu.exe
  2⤵
  PID:15356
- C:\Windows\System\EErKskO.exe
  C:\Windows\System\EErKskO.exe
  2⤵
  PID:3828
- C:\Windows\System\HLyIXYS.exe
  C:\Windows\System\HLyIXYS.exe
  2⤵
  PID:11392
- C:\Windows\System\pnPSvAo.exe
  C:\Windows\System\pnPSvAo.exe
  2⤵
  PID:560
- C:\Windows\System\ccTvBvB.exe
  C:\Windows\System\ccTvBvB.exe
  2⤵
  PID:14520
- C:\Windows\System\zFKeOgt.exe
  C:\Windows\System\zFKeOgt.exe
  2⤵
  PID:14340
- C:\Windows\System\iPfSpMm.exe
  C:\Windows\System\iPfSpMm.exe
  2⤵
  PID:14412
- C:\Windows\System\ItPMDAB.exe
  C:\Windows\System\ItPMDAB.exe
  2⤵
  PID:12512
- C:\Windows\System\rRWocmx.exe
  C:\Windows\System\rRWocmx.exe
  2⤵
  PID:14372
- C:\Windows\System\TiOBkUg.exe
  C:\Windows\System\TiOBkUg.exe
  2⤵
  PID:14564
- C:\Windows\System\qRveBAH.exe
  C:\Windows\System\qRveBAH.exe
  2⤵
  PID:14776
- C:\Windows\System\xPDBmEU.exe
  C:\Windows\System\xPDBmEU.exe
  2⤵
  PID:14640
- C:\Windows\System\CdUZXft.exe
  C:\Windows\System\CdUZXft.exe
  2⤵
  PID:14812
- C:\Windows\System\yzbufgm.exe
  C:\Windows\System\yzbufgm.exe
  2⤵
  PID:14840
- C:\Windows\System\TNBgFPG.exe
  C:\Windows\System\TNBgFPG.exe
  2⤵
  PID:14860
- C:\Windows\System\KyflOcc.exe
  C:\Windows\System\KyflOcc.exe
  2⤵
  PID:14828
- C:\Windows\System\XJKbQyA.exe
  C:\Windows\System\XJKbQyA.exe
  2⤵
  PID:13292
- C:\Windows\System\DUGdRPT.exe
  C:\Windows\System\DUGdRPT.exe
  2⤵
  PID:15352
- C:\Windows\System\GTERbMC.exe
  C:\Windows\System\GTERbMC.exe
  2⤵
  PID:1088
- C:\Windows\System\poLESiu.exe
  C:\Windows\System\poLESiu.exe
  2⤵
  PID:12368
- C:\Windows\System\vVkJYcv.exe
  C:\Windows\System\vVkJYcv.exe
  2⤵
  PID:14380
- C:\Windows\System\pKXoUXK.exe
  C:\Windows\System\pKXoUXK.exe
  2⤵
  PID:14480
- C:\Windows\System\HbWjkIm.exe
  C:\Windows\System\HbWjkIm.exe
  2⤵
  PID:13272
- C:\Windows\System\GCATHbZ.exe
  C:\Windows\System\GCATHbZ.exe
  2⤵
  PID:184
- C:\Windows\System\nuBeBlj.exe
  C:\Windows\System\nuBeBlj.exe
  2⤵
  PID:14848
- C:\Windows\System\MnFvyHi.exe
  C:\Windows\System\MnFvyHi.exe
  2⤵
  PID:14356
- C:\Windows\System\wHistnP.exe
  C:\Windows\System\wHistnP.exe
  2⤵
  PID:14884
- C:\Windows\System\ueEdMIx.exe
  C:\Windows\System\ueEdMIx.exe
  2⤵
  PID:14916
- C:\Windows\System\BkIhLvJ.exe
  C:\Windows\System\BkIhLvJ.exe
  2⤵
  PID:14852
- C:\Windows\System\FwjDjwt.exe
  C:\Windows\System\FwjDjwt.exe
  2⤵
  PID:15024
- C:\Windows\System\YCJNkBB.exe
  C:\Windows\System\YCJNkBB.exe
  2⤵
  PID:15144
- C:\Windows\System\KwNkAxL.exe
  C:\Windows\System\KwNkAxL.exe
  2⤵
  PID:14960
- C:\Windows\System\ZyfguJi.exe
  C:\Windows\System\ZyfguJi.exe
  2⤵
  PID:15196
- C:\Windows\System\JBdrFvy.exe
  C:\Windows\System\JBdrFvy.exe
  2⤵
  PID:14420
- C:\Windows\System\IsKiZRJ.exe
  C:\Windows\System\IsKiZRJ.exe
  2⤵
  PID:5408
- C:\Windows\System\NtzAcGx.exe
  C:\Windows\System\NtzAcGx.exe
  2⤵
  PID:2440
- C:\Windows\System\BDNcQpV.exe
  C:\Windows\System\BDNcQpV.exe
  2⤵
  PID:10464
- C:\Windows\System\zcpZGRo.exe
  C:\Windows\System\zcpZGRo.exe
  2⤵
  PID:2412
- C:\Windows\System\nnubhRO.exe
  C:\Windows\System\nnubhRO.exe
  2⤵
  PID:14432
- C:\Windows\System\ILKPVyg.exe
  C:\Windows\System\ILKPVyg.exe
  2⤵
  PID:10272
- C:\Windows\System\ttouFUu.exe
  C:\Windows\System\ttouFUu.exe
  2⤵
  PID:12304
- C:\Windows\System\MTxVQtP.exe
  C:\Windows\System\MTxVQtP.exe
  2⤵
  PID:12612
- C:\Windows\System\ZmbERJL.exe
  C:\Windows\System\ZmbERJL.exe
  2⤵
  PID:15100
- C:\Windows\System\NNVEEhe.exe
  C:\Windows\System\NNVEEhe.exe
  2⤵
  PID:15344
- C:\Windows\System\TteUbPr.exe
  C:\Windows\System\TteUbPr.exe
  2⤵
  PID:12132
- C:\Windows\System\aUhEolw.exe
  C:\Windows\System\aUhEolw.exe
  2⤵
  PID:12704
- C:\Windows\System\LoAJWmr.exe
  C:\Windows\System\LoAJWmr.exe
  2⤵
  PID:6268
- C:\Windows\System\OHlkgmI.exe
  C:\Windows\System\OHlkgmI.exe
  2⤵
  PID:6148
- C:\Windows\System\PiYutwJ.exe
  C:\Windows\System\PiYutwJ.exe
  2⤵
  PID:12468
- C:\Windows\System\Dysrpud.exe
  C:\Windows\System\Dysrpud.exe
  2⤵
  PID:3008
- C:\Windows\System\lZDzMTx.exe
  C:\Windows\System\lZDzMTx.exe
  2⤵
  PID:15288
- C:\Windows\System\ArmXpQn.exe
  C:\Windows\System\ArmXpQn.exe
  2⤵
  PID:5088
- C:\Windows\System\jWiJSHx.exe
  C:\Windows\System\jWiJSHx.exe
  2⤵
  PID:11748
- C:\Windows\System\FYxgfFG.exe
  C:\Windows\System\FYxgfFG.exe
  2⤵
  PID:2200
- C:\Windows\System\qDASfic.exe
  C:\Windows\System\qDASfic.exe
  2⤵
  PID:6356
- C:\Windows\System\DQBqSDH.exe
  C:\Windows\System\DQBqSDH.exe
  2⤵
  PID:12296
- C:\Windows\System\kWcZQcU.exe
  C:\Windows\System\kWcZQcU.exe
  2⤵
  PID:1176
- C:\Windows\System\LGvCgth.exe
  C:\Windows\System\LGvCgth.exe
  2⤵
  PID:4208
- C:\Windows\System\LMgaJuV.exe
  C:\Windows\System\LMgaJuV.exe
  2⤵
  PID:6336
- C:\Windows\System\yiCgzlf.exe
  C:\Windows\System\yiCgzlf.exe
  2⤵
  PID:5536
- C:\Windows\System\iiDWRns.exe
  C:\Windows\System\iiDWRns.exe
  2⤵
  PID:14756
- C:\Windows\System\CBBVUkZ.exe
  C:\Windows\System\CBBVUkZ.exe
  2⤵
  PID:12756
- C:\Windows\System\WuunPTu.exe
  C:\Windows\System\WuunPTu.exe
  2⤵
  PID:5276
- C:\Windows\System\nZGUnqa.exe
  C:\Windows\System\nZGUnqa.exe
  2⤵
  PID:13032
- C:\Windows\System\LgGJfhx.exe
  C:\Windows\System\LgGJfhx.exe
  2⤵
  PID:2604
- C:\Windows\System\mhFLkzk.exe
  C:\Windows\System\mhFLkzk.exe
  2⤵
  PID:1516
- C:\Windows\System\FZUPHFY.exe
  C:\Windows\System\FZUPHFY.exe
  2⤵
  PID:14964
- C:\Windows\System\mprWtGU.exe
  C:\Windows\System\mprWtGU.exe
  2⤵
  PID:15080
- C:\Windows\System\AEYUZKR.exe
  C:\Windows\System\AEYUZKR.exe
  2⤵
  PID:12472
- C:\Windows\System\ZqvTRYG.exe
  C:\Windows\System\ZqvTRYG.exe
  2⤵
  PID:12348
- C:\Windows\System\MVpGVLm.exe
  C:\Windows\System\MVpGVLm.exe
  2⤵
  PID:13224
- C:\Windows\System\xjdJkCR.exe
  C:\Windows\System\xjdJkCR.exe
  2⤵
  PID:4036
- C:\Windows\System\WdOUrJQ.exe
  C:\Windows\System\WdOUrJQ.exe
  2⤵
  PID:5036
- C:\Windows\System\pxQXxgL.exe
  C:\Windows\System\pxQXxgL.exe
  2⤵
  PID:7644
- C:\Windows\System\GRhprdX.exe
  C:\Windows\System\GRhprdX.exe
  2⤵
  PID:7388
- C:\Windows\System\lFTyWph.exe
  C:\Windows\System\lFTyWph.exe
  2⤵
  PID:13328
- C:\Windows\System\VsrnZbd.exe
  C:\Windows\System\VsrnZbd.exe
  2⤵
  PID:10756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3900 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
1⤵
PID:11500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ghx4sqgl.gpa.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BdwvWrN.exe

Filesize
2.0MB

MD5
92676017426d87aa283adaa87338466d

SHA1
98edef18ec1145a2f5f08370ddbcc5cf692af620

SHA256
7bfec4a0315f7ee5eaa57e75c9f96716a74719b7efab0c4875037a9a3c31602b

SHA512
61263d8f42df6b472e275fdc42fdca9c259985a12d2b658f792da7beae584cba6242ded42e7a64dd0e0fd4287d07404ebc1c01c2e2de0ca9dd244d5e419dd69a

Download Submit
C:\Windows\System\CXcXlVu.exe

Filesize
2.0MB

MD5
1f1435cffff720199c2d4fee24fcf482

SHA1
38fba8a980562fe0acc6d3017986837caf6ea530

SHA256
c5facba35cdc0f22e40aa343c202e2038f172697ab10369b3eb0397966ce82ff

SHA512
dacded9b2806032e1563418ff70ae17c84260ec6404428d5a1ddfcc6c897c61bc8a03699a376fffd1a3811d38b82b505f3e0663facb8cf854bd9f2f5bffb1eb2

Download Submit
C:\Windows\System\GgwZnbF.exe

Filesize
2.0MB

MD5
68822a7ae6ad0462139694be0065f030

SHA1
71fce7a4d42a3ebd65acfc85e4c454db52d7580c

SHA256
62b5db31010436d699c22f74deaf542a25f7a6f366be4133ebb13e7a6dc15c7b

SHA512
4c528e63da76433d0e320325d3d631d73ec31a80f44c31f17a31998ef17e120cf3fa050a23841b3f3bd59d7230969b328e92d625acb6189269d48a8a096b67ad

Download Submit
C:\Windows\System\GuHCoal.exe

Filesize
2.0MB

MD5
be435b0924ffea2f8d639ba0cddfd5da

SHA1
2532de03a20919858b174a4712c875d99f7fc85a

SHA256
81d2a762f7452d3fbae776342fb06aaa9b3fc71e26e3d48bb797e5af3c1f1af2

SHA512
f134256bae57bb14abefa7e70811f3bdf8dab6ffb653a6048d3a28db308cd7071dcb49f240a65ccc63bc4c57eca3c18810b121636d875faee980bad4a3f110f6

Download Submit
C:\Windows\System\HqmAXrU.exe

Filesize
2.1MB

MD5
d059ceccf9586748f369775ee4d23d27

SHA1
b439303f25d55f9a3d7a26ebe612fb93181fcd3e

SHA256
e3ff14c1e5e4325cade7c2392278713cd0e81fcf1fe65fe15e1cc9296efdcc08

SHA512
d332e9c145e5d24d40d52148468c2c6737df93a6a1a281a74067643163f9b3d878a0eb47b0d53b151d323766807ca3ad1fca6125362f9b31789aad96ea9c96ee

Download Submit
C:\Windows\System\IKHyhZZ.exe

Filesize
2.0MB

MD5
9f8bf004a0550dc81368a3e6edc99fa2

SHA1
9992e378397dd1e0f869211723ccc7642fcec25e

SHA256
e696468211dca91da459aa13ad0e0cdf599a80002045ea1fd26e1d6e5f1b6fda

SHA512
970149e1d1cba5f585b3334b6b097cd05694748e44a4c5a52c68347a673f178b60146e02a019d8f170b0a93d8aac6667c21985b46baf3b0f742deb8cfa510b27

Download Submit
C:\Windows\System\JXUugpk.exe

Filesize
2.1MB

MD5
36f1d5ec4fb401a03a6d81ffaecb32b6

SHA1
4d4ac05c87b8a0c0313c8f7806520677e2477857

SHA256
7b3e19c50c866bb4589cab74e8e5f0915c561bf39d8258f28c60749d8b3f416f

SHA512
bc864d504dfb26eef19e4b17cd9d5c3bdead933237b5f08323cf6194b5eaa31ed737130059bdae1d5cd2280385a16682307913b5dc39d863868a1de5de53ded1

Download Submit
C:\Windows\System\JehbfHv.exe

Filesize
2.0MB

MD5
3e17009add7d30505fb48efc72cc5d05

SHA1
96b04353cfd89953360ba61b3753439694024efd

SHA256
cee53c5de8e60682569e3b848fb6d1169e87facb77b50c8213303f0ece02c2ea

SHA512
f11d143acf13c2d14df8904f4af78c7fd5b83a864e1c28340fc8da71afba97e4d5f928038159a3bcf6b81917a3b74403612d19abf28e1dbaceb5b041e2e4945f

Download Submit
C:\Windows\System\KDxhUOn.exe

Filesize
2.0MB

MD5
432fdafbc6e456d6fb1dea6fe25c0742

SHA1
214fe96675d58035212b169ad562eaddbeb5f41d

SHA256
a2dd8a512b13ece345edd8dccbd802ebabba723ceea83eddd166eaa0f7febdd4

SHA512
e1ef783187e01c3184667f6713ad05cb20d5296fe6bbe18ad323cb6e4bb1fb143c957fe420d878d7c98d9afcf4bba07818b3542b36e5ac04d4eb2fc792037305

Download Submit
C:\Windows\System\LYornaH.exe

Filesize
2.0MB

MD5
5b51f4d497eb53ac39348b53e8d4fa45

SHA1
2517b8778054928d8c798217cd5a48edffcdc43d

SHA256
74e9271d85a2025e6ab96c6162e7d0af775edc6366a179043f3e4fd6bfc75b1b

SHA512
ae3995583e0909f4f275b77b4565fd2ab7783ecfdf4b7f00867a9f94cbcb60c6eae6194afb13d46d0aa535a79f2027e6cabde1bd52b8b545ea75e07a870df620

Download Submit
C:\Windows\System\NqCrmDr.exe

Filesize
2.0MB

MD5
346dea65d8b3dd784aa3213c0f967de5

SHA1
2eb0b0bf9c750e67f77a5935187c30103798dfa5

SHA256
dfc8faea9910eb6c4659d33a963b02e6530983f502dc2e91b8ab12ed01119707

SHA512
b55b4b8fb8f30c16d89decaa98bcf4cb4889c17abd53435a3c75942bccd31aaded9e12c7e1a7aabe850379f54542d525236b7814050ecfa46f316b3d038ee05f

Download Submit
C:\Windows\System\OxyABYc.exe

Filesize
2.0MB

MD5
f1ecafd3c3f1d8676fc9e25d14d3238a

SHA1
9f2904b950c7ef8fe662d56cd88876af515ac207

SHA256
13acd1b61e85816d393b2c72833bf34d6f266b8d80de74871550fc2f5be671f6

SHA512
8be4b99714b87a34af2ab2a15f4dff1d29a94c14e30dac93c1ff0c58ef7bc0b2bef7a45e1e04924b64501e1c580a1d4dea412a8169bd5dc1745af98cc9d747b2

Download Submit
C:\Windows\System\SHZiSOI.exe

Filesize
2.0MB

MD5
0d9f1a55c2f5c3a3495102c60dfd004a

SHA1
0352d9aa7bfbcb9e805ac791feacdb3b8b4ca87d

SHA256
2e7a4fedacd17f61907ea8f639cc9e77301e835ac9670190db63113ae58cddf5

SHA512
91060e2ef172932ec7635c8d1f7bd4d49a0ee96f94f3931e8021b30813213f29973bab79fb2deae04afc3f6c2e76c905a45a1818b3e524b3c94b90c44f66d22b

Download Submit
C:\Windows\System\YNjhEWC.exe

Filesize
2.0MB

MD5
2a10731c6da9bb8f1d3cdad20a776757

SHA1
7c8ed082af648aae7abbf2b7b86c937c68955ca0

SHA256
af94a295ac3dcf6c11da3fbe85c048591694046d842f323618e3c479e4d0e7ef

SHA512
3304cb4931010e6cd888d2b5dd6111dd301b752d15a2d28b6ab61f7b1e2148a5e8d7db0d55ba72f8dd4b7fe091f182098ddf4b2ed4ea177ef252e98bc58cd04d

Download Submit
C:\Windows\System\YpKOCmC.exe

Filesize
2.0MB

MD5
dc96d1bdaae2394ba13a9d280cd65f5a

SHA1
9864acf6e46dae1683f61d3e033de598d66b38d4

SHA256
5a5a54358470322068245d175c634f5cb3a9411f59777f0149c31167db4c2e10

SHA512
9e752dd6c61fe811a5ecda2d517de1d718fcf932bdea9d3dc54b9ce231c848e3a5a6b0a91eeec10a1ed6b524847a0e396ca6848b7737fec7b9015c4407ed23b1

Download Submit
C:\Windows\System\YurmGko.exe

Filesize
2.0MB

MD5
d6851dbeffb7e0a50bb7405a5f677dd7

SHA1
19850317597e17c3586b96a7ac6ab8c79f0c9418

SHA256
a395709ae93cdc93aebf4d6aec125e38477b93197b18246b0d41177caa4cb8dc

SHA512
1cfcae4c2e767051d4e71d40d9817b1a726a073ceb41ab989bbf731a72c8b1de12857b4fc2860bc1f9f1e3e535e8072cb8fd2403784feb7cb55440565b0d358e

Download Submit
C:\Windows\System\ZGpGNIK.exe

Filesize
2.0MB

MD5
c1ae0d0c7499807cba40d74fabb7d26c

SHA1
f6f5ff750e86b53053aa9be75eedc86420e32af7

SHA256
c5d64dd23c54384e2886f8914b1b28874bb957d7caf0a1c111d0f7094bc23a58

SHA512
5f7527e5b03cc7c29ed2c28e891b15c8401f9bec149a843c4156924391927c235d1c076a3ef8a00b72e367e519d55eeac7894b1cd2f3238d6c35781e020e1945

Download Submit
C:\Windows\System\ddVAXnp.exe

Filesize
2.0MB

MD5
2ddb87c532cca95e5bb1049bac3adbfb

SHA1
79e85afc6ff8c102f1e261b835c622d2cb3cf28a

SHA256
9f5c368ff1ad744a208d86baa9097a1a2697995045a6983be568c2b93bcc4117

SHA512
7b3adf376067212fc0539c6161155fe3a6b6ab4edd993ff3bda1733b7a041c708d9222b52e2a7e8591b9aed09a461889d203371b928900efa81c949c30661040

Download Submit
C:\Windows\System\fdxtwBM.exe

Filesize
2.0MB

MD5
6b924d2a33b98e891bf0768be1fcbc3c

SHA1
27d3f6a3128800990ec110e30914eb1f74982096

SHA256
ccccaa627626c85aa9aa03b8c17754d814e147b7e2afa194c7751aabe49e7378

SHA512
08aff241317dc0d829679f3cfb60dc9c94f4710e714aff0ca5e945a88e23a2ff76c6ee46f1a0577bc850b4109456cc82fc4698b94d6a45a3b55efc0f845ec1a8

Download Submit
C:\Windows\System\gUjuasb.exe

Filesize
2.0MB

MD5
4c76d2d4fae735f9b0099201bcadc4a9

SHA1
bc01ed1f4ad077561d26012e34eaa23cbaf57e77

SHA256
d7a6a1d632722413445b2aa316e01e0d7119029825e1a4b48e56114b69dd1392

SHA512
bff89d9c51563965cacdc3b937c08394a7338cb318b04e4c48ad53c40cba14f3607da3ad63ae28946eeecd6a11297fd80fb348346e18942cb5e1a573a079b50e

Download Submit
C:\Windows\System\jHRQsai.exe

Filesize
2.0MB

MD5
28943f9864f9345cc296b681422cb23b

SHA1
3c416568f103e1cb44fdee4567350cf1a9d17503

SHA256
00dd3c2c660e7ef215487c5038b072ab8f9f1896fc2e9adb410eebc175a6f312

SHA512
eff110fa7875e2c99aa6166a4921f35bbba3f16187900dbf0adb13fe46763703ddddf038c9aa0aa5f5846f97e3b20c6b8c186ad56b29d765a0c46977066375ce

Download Submit
C:\Windows\System\kjCaDrc.exe

Filesize
2.0MB

MD5
c9c96c2daf77cf50e9fcc7fbbeab8964

SHA1
415817308ea2d97605b9d2dc8af200aaa47e1823

SHA256
89618e0253f3b212ca5ad11d50faf1e9243632de06f122874aa0d1f7084dbed7

SHA512
5f7b7467af13aad30c71c9777bd83767cd1895f102f5c68e4f7a25633ecacef136c46ae2da4714f414215db25dc5e7af9092a90e60ef6d14cdfd9760c858db92

Download Submit
C:\Windows\System\lqbjSBi.exe

Filesize
2.0MB

MD5
ef734608761e215fb1b810b8c3b73848

SHA1
6a8c94ab7a035531fc90547d2dd56e60913e4c72

SHA256
d7faaf1295679d177088d5f2e15c346595feef2e1469eb8970f567848d84a313

SHA512
8a8e0bccb56768528f85dbaa9307ce8935407843c19d2de6ff06a3e2dbbf8b393fc631437c81908d51affc462ee6d8c342949d83b773014c706440b473b4aef3

Download Submit
C:\Windows\System\nwVWbYg.exe

Filesize
2.0MB

MD5
a842bc6543cd48da32ededb860529af9

SHA1
3599574b3d07ffa614fce437d73a81829a1c81ef

SHA256
8440286ac318988f4d17ee55c1d76e9fdfa9cb8fa6d86dabef512bcce8c3c6db

SHA512
3bd0063420d48d24039bb6d5bcde4cc67a40e27f1c322921aa5866a72929ba846218cd2de4fdc2dd811013f0f3d88c6f86bab4223bc6d1f5b5e42a51471e33b9

Download Submit
C:\Windows\System\qgggoSW.exe

Filesize
2.0MB

MD5
b64972515a437c0b09b398f728ca9eb8

SHA1
d81f0029437f12a7976c991ac5b06f10b082d2c0

SHA256
af213ed8d1cef60b940bada8b672fdd1aab33516c59eb7a3495de82f89b89e76

SHA512
6e7b9404086e4f6095985ecd26388ba1d57a6e20d029eb89904e73081c92734bf1e788ba120c9f3aada6925664fcf22cfa26c43282be470d66e1b46d3a1a2f2d

Download Submit
C:\Windows\System\rPodemx.exe

Filesize
2.0MB

MD5
b7705b706e964e4855402f024305e5a8

SHA1
b0cac2b69b6b927b4bbf28c417e3424a1ed63fb3

SHA256
50fa652301519c4e7a49e07af614c21095a2f15b84466d26d3290f978d9c8e73

SHA512
c820a4c4ccf913cbcc1868c05e546d139509ed56f7a1bf83b4a367cb752068a944026129e370ecb1957a6e8f429070dc72f7e16aae113cd9213ad930cbbd403b

Download Submit
C:\Windows\System\tEzUcWt.exe

Filesize
2.0MB

MD5
2d402012f5d8f5c6486c6af0255e1fb8

SHA1
ce4c754e4a50b9e5a5626c70da67a5611c711b1a

SHA256
af004de858b4579e68eaa4b6f3de9ccaa0e252446479a612ca3e606c28c18572

SHA512
278af3d35ab248cfc247b5356a80de21c925ac84d7f1c96694598a8066e0110ceb83937010de5b6c144e211229067b897a8c0c127503f5d6e113398aacfe7f33

Download Submit
C:\Windows\System\uKcoJVN.exe

Filesize
2.0MB

MD5
7bb0645259faa9de291be6aebafcf3c6

SHA1
da0f60b1307dce1086f6c6cbe7c50124fe7bfb72

SHA256
b62dbb3dfc1a8f9ac8db292263183dfd8d0e40afc678ff1179888e088d4e762f

SHA512
67eeefc288b2782be17d5116bab3bc96c98eb5a45f1e676a76771b86e4f58bd695af01affb014bef2768874509ac71e2d4cbc79ee8a1fcfae9004f4d7a5158af

Download Submit
C:\Windows\System\wdrgABB.exe

Filesize
2.0MB

MD5
b0bf9c07190451cb57e2e00c9eb90d7b

SHA1
e68b799a42f1f69ed050c737e97a7b40a7f38e30

SHA256
11bbf3450cd81cae6ae154bd35298937d6d70da217899ea3506839e345078404

SHA512
bd7c9144b6cb859511237c492b6d76e5903989b7c69c209e3f3408592e71ec89a41149f9b9d73ae499e388cb526f709d8daac51205e3f0deb18eaf37c9c6396a

Download Submit
C:\Windows\System\wtnoGVU.exe

Filesize
2.0MB

MD5
52f1200fa0b9fdab799b76ce103684d1

SHA1
dc733812dd3c73a70ab10941fc1aa966830fe5ec

SHA256
eebcb22f74bdfea31a6499ca980384682b2dde7cd765008ee0585b9c43403161

SHA512
2b6993ccc68cdbcd37c6ac23763ad8c65f6a1c2622724d2429b277a49b2f8dbc9c37f0ba78b0e62f03d04212648ae146d3ff21cfb3adbf117e478e7ecb60f34c

Download Submit
C:\Windows\System\yAICsjj.exe

Filesize
2.0MB

MD5
0361e55b4d0d6ed2e5b344b28b726cff

SHA1
46ef689f1a97d83a4f3574e2a9c2d8b1a62b3f0f

SHA256
f20efe389645192229668837001c0e1625520e1468e6bd284bf029a516a06021

SHA512
ea66375610e4458f1a8333b8246cd267c14ff9fd76fb5ae27da3c0e0b284cf497c74c0c3c2ce8d981091b76ce9d783a4c016cff1306158724a7a6cabb772bc25

Download Submit
C:\Windows\System\ypfbDGR.exe

Filesize
2.0MB

MD5
3af8d70081c006c016a52646886e1020

SHA1
56939a25e95c24cc6bb69af906ce526d3705849b

SHA256
f59cd3c4956f4ce2898dfb76251ff451eb2471671662c070742df3a23d878f49

SHA512
7845de6102ddec443fcad408d045c5c23ba58ec974c9ca3f485a6fe4e3bf8f9282b3ad7d33d39c5e1112d1c25f348953f05f358b7ae2b47ed17a36521fda37f9

Download Submit
memory/500-1653-0x00007FF6A0AB0000-0x00007FF6A0EA2000-memory.dmp

Filesize
3.9MB

Download
memory/500-301-0x00007FF6A0AB0000-0x00007FF6A0EA2000-memory.dmp

Filesize
3.9MB

Download
memory/728-295-0x00007FF60DD30000-0x00007FF60E122000-memory.dmp

Filesize
3.9MB

Download
memory/728-1643-0x00007FF60DD30000-0x00007FF60E122000-memory.dmp

Filesize
3.9MB

Download
memory/1028-1618-0x00007FF7F8710000-0x00007FF7F8B02000-memory.dmp

Filesize
3.9MB

Download
memory/1028-75-0x00007FF7F8710000-0x00007FF7F8B02000-memory.dmp

Filesize
3.9MB

Download
memory/1476-1588-0x00007FF61AA40000-0x00007FF61AE32000-memory.dmp

Filesize
3.9MB

Download
memory/1476-64-0x00007FF61AA40000-0x00007FF61AE32000-memory.dmp

Filesize
3.9MB

Download
memory/1904-267-0x00007FF7D6CE0000-0x00007FF7D70D2000-memory.dmp

Filesize
3.9MB

Download
memory/1904-0-0x00007FF7D6CE0000-0x00007FF7D70D2000-memory.dmp

Filesize
3.9MB

Download
memory/1904-1-0x0000022267D90000-0x0000022267DA0000-memory.dmp

Filesize
64KB

Download
memory/2012-305-0x00007FF7484C0000-0x00007FF7488B2000-memory.dmp

Filesize
3.9MB

Download
memory/2012-1666-0x00007FF7484C0000-0x00007FF7488B2000-memory.dmp

Filesize
3.9MB

Download
memory/2120-1542-0x00007FF767ED0000-0x00007FF7682C2000-memory.dmp

Filesize
3.9MB

Download
memory/2120-61-0x00007FF767ED0000-0x00007FF7682C2000-memory.dmp

Filesize
3.9MB

Download
memory/2520-72-0x00007FF6B5050000-0x00007FF6B5442000-memory.dmp

Filesize
3.9MB

Download
memory/2520-1609-0x00007FF6B5050000-0x00007FF6B5442000-memory.dmp

Filesize
3.9MB

Download
memory/2532-1562-0x00007FF603A00000-0x00007FF603DF2000-memory.dmp

Filesize
3.9MB

Download
memory/2532-63-0x00007FF603A00000-0x00007FF603DF2000-memory.dmp

Filesize
3.9MB

Download
memory/2856-1646-0x00007FF6D95A0000-0x00007FF6D9992000-memory.dmp

Filesize
3.9MB

Download
memory/2856-297-0x00007FF6D95A0000-0x00007FF6D9992000-memory.dmp

Filesize
3.9MB

Download
memory/2956-1663-0x00007FF6860E0000-0x00007FF6864D2000-memory.dmp

Filesize
3.9MB

Download
memory/2956-302-0x00007FF6860E0000-0x00007FF6864D2000-memory.dmp

Filesize
3.9MB

Download
memory/2968-1636-0x00007FF60B520000-0x00007FF60B912000-memory.dmp

Filesize
3.9MB

Download
memory/2968-294-0x00007FF60B520000-0x00007FF60B912000-memory.dmp

Filesize
3.9MB

Download
memory/3116-1652-0x00007FF6B6A90000-0x00007FF6B6E82000-memory.dmp

Filesize
3.9MB

Download
memory/3116-309-0x00007FF6B6A90000-0x00007FF6B6E82000-memory.dmp

Filesize
3.9MB

Download
memory/3260-304-0x00007FF6D6E50000-0x00007FF6D7242000-memory.dmp

Filesize
3.9MB

Download
memory/3260-1668-0x00007FF6D6E50000-0x00007FF6D7242000-memory.dmp

Filesize
3.9MB

Download
memory/3412-1690-0x00007FF7EC3A0000-0x00007FF7EC792000-memory.dmp

Filesize
3.9MB

Download
memory/3412-303-0x00007FF7EC3A0000-0x00007FF7EC792000-memory.dmp

Filesize
3.9MB

Download
memory/3468-290-0x00007FF69F5B0000-0x00007FF69F9A2000-memory.dmp

Filesize
3.9MB

Download
memory/3468-1638-0x00007FF69F5B0000-0x00007FF69F9A2000-memory.dmp

Filesize
3.9MB

Download
memory/3480-1673-0x00007FF66BD80000-0x00007FF66C172000-memory.dmp

Filesize
3.9MB

Download
memory/3480-299-0x00007FF66BD80000-0x00007FF66C172000-memory.dmp

Filesize
3.9MB

Download
memory/3796-1645-0x00007FF79C830000-0x00007FF79CC22000-memory.dmp

Filesize
3.9MB

Download
memory/3796-296-0x00007FF79C830000-0x00007FF79CC22000-memory.dmp

Filesize
3.9MB

Download
memory/4048-1590-0x00007FF695350000-0x00007FF695742000-memory.dmp

Filesize
3.9MB

Download
memory/4048-66-0x00007FF695350000-0x00007FF695742000-memory.dmp

Filesize
3.9MB

Download
memory/4252-1873-0x00007FF7C6510000-0x00007FF7C6902000-memory.dmp

Filesize
3.9MB

Download
memory/4252-67-0x00007FF7C6510000-0x00007FF7C6902000-memory.dmp

Filesize
3.9MB

Download
memory/4492-293-0x00007FF72AD00000-0x00007FF72B0F2000-memory.dmp

Filesize
3.9MB

Download
memory/4492-1637-0x00007FF72AD00000-0x00007FF72B0F2000-memory.dmp

Filesize
3.9MB

Download
memory/4684-51-0x00007FF7CB3A0000-0x00007FF7CB792000-memory.dmp

Filesize
3.9MB

Download
memory/4684-1538-0x00007FF7CB3A0000-0x00007FF7CB792000-memory.dmp

Filesize
3.9MB

Download
memory/4688-50-0x00007FF6418C0000-0x00007FF641CB2000-memory.dmp

Filesize
3.9MB

Download
memory/4688-1478-0x00007FF6418C0000-0x00007FF641CB2000-memory.dmp

Filesize
3.9MB

Download
memory/4916-1565-0x00007FF68C890000-0x00007FF68CC82000-memory.dmp

Filesize
3.9MB

Download
memory/4916-65-0x00007FF68C890000-0x00007FF68CC82000-memory.dmp

Filesize
3.9MB

Download
memory/4940-58-0x00007FFC3DC90000-0x00007FFC3E751000-memory.dmp

Filesize
10.8MB

Download
memory/4940-47-0x00007FFC3DC90000-0x00007FFC3E751000-memory.dmp

Filesize
10.8MB

Download
memory/4940-332-0x000002901DF60000-0x000002901E706000-memory.dmp

Filesize
7.6MB

Download
memory/4940-16-0x000002901D280000-0x000002901D2A2000-memory.dmp

Filesize
136KB

Download
memory/4940-71-0x00007FFC3DC90000-0x00007FFC3E751000-memory.dmp

Filesize
10.8MB

Download
memory/4940-3-0x00007FFC3DC93000-0x00007FFC3DC95000-memory.dmp

Filesize
8KB

Download
memory/4948-298-0x00007FF7887B0000-0x00007FF788BA2000-memory.dmp

Filesize
3.9MB

Download
memory/4948-1647-0x00007FF7887B0000-0x00007FF788BA2000-memory.dmp

Filesize
3.9MB

Download