xmrig | 4bdd155b37467a45b5dcc9e4b25e0261eee65eb2a3e0e1a39ffea57c6bc75ec5

Analysis

max time kernel
150s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 22:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01dba670367f609d53464ad432d14526_JaffaCakes118.exe
Size

2.2MB
MD5

01dba670367f609d53464ad432d14526
SHA1

275e9f77ed24662836bc01a748dd5e2002a59f3b
SHA256

4bdd155b37467a45b5dcc9e4b25e0261eee65eb2a3e0e1a39ffea57c6bc75ec5
SHA512

2268dc4dc1d69c21e3e515107dadbbfcaf73db9f8b9ff7bd985466ede51f0908394569c8cc6f0b9beeff0bc38a287b735ce73355d29707384ba47eb235d26ccd
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafnmo5mB:NAB1

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 37 IoCs

miner

resource	yara_rule
behavioral2/memory/772-117-0x00007FF760270000-0x00007FF760662000-memory.dmp	xmrig
behavioral2/memory/4980-391-0x00007FF7C2460000-0x00007FF7C2852000-memory.dmp	xmrig
behavioral2/memory/1456-457-0x00007FF7CE700000-0x00007FF7CEAF2000-memory.dmp	xmrig
behavioral2/memory/3688-453-0x00007FF6B08D0000-0x00007FF6B0CC2000-memory.dmp	xmrig
behavioral2/memory/1760-654-0x00007FF6803D0000-0x00007FF6807C2000-memory.dmp	xmrig
behavioral2/memory/2536-670-0x00007FF7A32A0000-0x00007FF7A3692000-memory.dmp	xmrig
behavioral2/memory/2612-725-0x00007FF6EF9B0000-0x00007FF6EFDA2000-memory.dmp	xmrig
behavioral2/memory/2336-789-0x00007FF798920000-0x00007FF798D12000-memory.dmp	xmrig
behavioral2/memory/3236-816-0x00007FF646C90000-0x00007FF647082000-memory.dmp	xmrig
behavioral2/memory/3320-788-0x00007FF795670000-0x00007FF795A62000-memory.dmp	xmrig
behavioral2/memory/2156-655-0x00007FF6A44A0000-0x00007FF6A4892000-memory.dmp	xmrig
behavioral2/memory/3276-614-0x00007FF6C9E30000-0x00007FF6CA222000-memory.dmp	xmrig
behavioral2/memory/1892-598-0x00007FF72EC10000-0x00007FF72F002000-memory.dmp	xmrig
behavioral2/memory/1896-363-0x00007FF6F4650000-0x00007FF6F4A42000-memory.dmp	xmrig
behavioral2/memory/4032-306-0x00007FF6E4150000-0x00007FF6E4542000-memory.dmp	xmrig
behavioral2/memory/1060-260-0x00007FF6419C0000-0x00007FF641DB2000-memory.dmp	xmrig
behavioral2/memory/2768-237-0x00007FF6CB040000-0x00007FF6CB432000-memory.dmp	xmrig
behavioral2/memory/3716-227-0x00007FF630230000-0x00007FF630622000-memory.dmp	xmrig
behavioral2/memory/1444-186-0x00007FF752F30000-0x00007FF753322000-memory.dmp	xmrig
behavioral2/memory/1280-148-0x00007FF7AFBB0000-0x00007FF7AFFA2000-memory.dmp	xmrig
behavioral2/memory/3024-4572-0x00007FF6E65F0000-0x00007FF6E69E2000-memory.dmp	xmrig
behavioral2/memory/3320-4585-0x00007FF795670000-0x00007FF795A62000-memory.dmp	xmrig
behavioral2/memory/3716-4592-0x00007FF630230000-0x00007FF630622000-memory.dmp	xmrig
behavioral2/memory/3688-4638-0x00007FF6B08D0000-0x00007FF6B0CC2000-memory.dmp	xmrig
behavioral2/memory/2612-4635-0x00007FF6EF9B0000-0x00007FF6EFDA2000-memory.dmp	xmrig
behavioral2/memory/1892-4629-0x00007FF72EC10000-0x00007FF72F002000-memory.dmp	xmrig
behavioral2/memory/4980-4612-0x00007FF7C2460000-0x00007FF7C2852000-memory.dmp	xmrig
behavioral2/memory/2768-4610-0x00007FF6CB040000-0x00007FF6CB432000-memory.dmp	xmrig
behavioral2/memory/1896-4608-0x00007FF6F4650000-0x00007FF6F4A42000-memory.dmp	xmrig
behavioral2/memory/1060-4603-0x00007FF6419C0000-0x00007FF641DB2000-memory.dmp	xmrig
behavioral2/memory/1444-4601-0x00007FF752F30000-0x00007FF753322000-memory.dmp	xmrig
behavioral2/memory/4032-4597-0x00007FF6E4150000-0x00007FF6E4542000-memory.dmp	xmrig
behavioral2/memory/1456-4698-0x00007FF7CE700000-0x00007FF7CEAF2000-memory.dmp	xmrig
behavioral2/memory/2156-4690-0x00007FF6A44A0000-0x00007FF6A4892000-memory.dmp	xmrig
behavioral2/memory/2536-4696-0x00007FF7A32A0000-0x00007FF7A3692000-memory.dmp	xmrig
behavioral2/memory/3276-4746-0x00007FF6C9E30000-0x00007FF6CA222000-memory.dmp	xmrig
behavioral2/memory/3236-4685-0x00007FF646C90000-0x00007FF647082000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3024	ytecApr.exe
3320	RcZaslR.exe
772	ZDsPACB.exe
1280	PbpjVSr.exe
1444	Xdnjczr.exe
3716	yDDjgMl.exe
2768	VstLAcD.exe
1060	QnopXGk.exe
4032	dBbczSg.exe
1896	aQTtLhb.exe
4980	bsJsQOD.exe
3688	sWKfkDN.exe
1456	PMDcAav.exe
1892	FSJIIcN.exe
3276	kGLAvsn.exe
2336	NqFGQlL.exe
1760	gjphgcW.exe
2156	yXgjdOZ.exe
2536	NPEcCwh.exe
2612	hOhxjyQ.exe
3236	tbbCzUG.exe
624	pEuFoWn.exe
4816	pSCwuNU.exe
4884	PmcXaDc.exe
804	XvWcohz.exe
760	nkOYfKS.exe
5060	bIdvXqS.exe
1916	mTqzYgy.exe
1564	CVFOBxr.exe
4516	ndKEdpB.exe
652	bANVuGN.exe
3508	BOlKQZX.exe
1544	CJSLMhI.exe
536	iJDnlgb.exe
3856	xPMnOWH.exe
904	yBMrSaG.exe
1920	qIGzkpw.exe
1208	fjJDwHR.exe
4888	ZBQyZwG.exe
2268	LpvqXKp.exe
3388	BehJrtU.exe
3928	kGPZxnL.exe
2400	sdXnZDU.exe
2104	kuWqWML.exe
2624	DQoGAnb.exe
4052	qkJQIKR.exe
2332	CrRplSj.exe
2828	tgylexe.exe
4448	AXjKIBp.exe
1248	vvWwrCT.exe
1192	vAvCMMY.exe
3344	SRIOxGw.exe
4692	qeruWgD.exe
4356	JxcItVc.exe
1924	vhQgvWS.exe
2816	skuflvq.exe
5108	bIHLtIK.exe
4252	eWrOmhV.exe
1400	ezWbmwA.exe
3888	OsjVuyI.exe
212	lWKfdIm.exe
940	hqMLHqJ.exe
3752	aKVDKxm.exe
1268	MgbStVk.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3264-0-0x00007FF7169E0000-0x00007FF716DD2000-memory.dmp	upx
behavioral2/memory/3024-13-0x00007FF6E65F0000-0x00007FF6E69E2000-memory.dmp	upx
behavioral2/files/0x000a000000023bbf-22.dat	upx
behavioral2/files/0x000a000000023bc0-32.dat	upx
behavioral2/files/0x000a000000023bc4-57.dat	upx
behavioral2/files/0x000a000000023bc1-58.dat	upx
behavioral2/memory/772-117-0x00007FF760270000-0x00007FF760662000-memory.dmp	upx
behavioral2/files/0x000a000000023bce-112.dat	upx
behavioral2/files/0x000a000000023bc8-90.dat	upx
behavioral2/files/0x000a000000023bcc-89.dat	upx
behavioral2/files/0x000a000000023bc9-77.dat	upx
behavioral2/files/0x000a000000023bcd-109.dat	upx
behavioral2/files/0x000a000000023bc3-69.dat	upx
behavioral2/files/0x000a000000023bc2-68.dat	upx
behavioral2/files/0x000a000000023bc6-63.dat	upx
behavioral2/files/0x000a000000023bcb-84.dat	upx
behavioral2/files/0x000a000000023bca-83.dat	upx
behavioral2/files/0x000a000000023bc5-51.dat	upx
behavioral2/memory/4980-391-0x00007FF7C2460000-0x00007FF7C2852000-memory.dmp	upx
behavioral2/memory/1456-457-0x00007FF7CE700000-0x00007FF7CEAF2000-memory.dmp	upx
behavioral2/memory/3688-453-0x00007FF6B08D0000-0x00007FF6B0CC2000-memory.dmp	upx
behavioral2/memory/1760-654-0x00007FF6803D0000-0x00007FF6807C2000-memory.dmp	upx
behavioral2/memory/2536-670-0x00007FF7A32A0000-0x00007FF7A3692000-memory.dmp	upx
behavioral2/memory/2612-725-0x00007FF6EF9B0000-0x00007FF6EFDA2000-memory.dmp	upx
behavioral2/memory/2336-789-0x00007FF798920000-0x00007FF798D12000-memory.dmp	upx
behavioral2/memory/3236-816-0x00007FF646C90000-0x00007FF647082000-memory.dmp	upx
behavioral2/memory/3320-788-0x00007FF795670000-0x00007FF795A62000-memory.dmp	upx
behavioral2/memory/2156-655-0x00007FF6A44A0000-0x00007FF6A4892000-memory.dmp	upx
behavioral2/memory/3276-614-0x00007FF6C9E30000-0x00007FF6CA222000-memory.dmp	upx
behavioral2/memory/1892-598-0x00007FF72EC10000-0x00007FF72F002000-memory.dmp	upx
behavioral2/memory/1896-363-0x00007FF6F4650000-0x00007FF6F4A42000-memory.dmp	upx
behavioral2/memory/4032-306-0x00007FF6E4150000-0x00007FF6E4542000-memory.dmp	upx
behavioral2/memory/1060-260-0x00007FF6419C0000-0x00007FF641DB2000-memory.dmp	upx
behavioral2/memory/2768-237-0x00007FF6CB040000-0x00007FF6CB432000-memory.dmp	upx
behavioral2/memory/3716-227-0x00007FF630230000-0x00007FF630622000-memory.dmp	upx
behavioral2/files/0x000a000000023bd1-203.dat	upx
behavioral2/files/0x000a000000023bea-202.dat	upx
behavioral2/files/0x000b000000023be2-198.dat	upx
behavioral2/files/0x000a000000023bd0-196.dat	upx
behavioral2/files/0x000b000000023be1-195.dat	upx
behavioral2/files/0x000b000000023be0-194.dat	upx
behavioral2/memory/1444-186-0x00007FF752F30000-0x00007FF753322000-memory.dmp	upx
behavioral2/files/0x000a000000023bd7-182.dat	upx
behavioral2/files/0x000a000000023bdf-181.dat	upx
behavioral2/files/0x000a000000023bdd-168.dat	upx
behavioral2/files/0x000b000000023bd6-167.dat	upx
behavioral2/files/0x000a000000023bdb-163.dat	upx
behavioral2/files/0x000a000000023bda-162.dat	upx
behavioral2/files/0x000a000000023bd9-151.dat	upx
behavioral2/files/0x000a000000023bcf-188.dat	upx
behavioral2/memory/1280-148-0x00007FF7AFBB0000-0x00007FF7AFFA2000-memory.dmp	upx
behavioral2/files/0x000a000000023bd8-147.dat	upx
behavioral2/files/0x000a000000023bc7-139.dat	upx
behavioral2/files/0x000a000000023bd4-136.dat	upx
behavioral2/files/0x000a000000023bd3-132.dat	upx
behavioral2/files/0x000a000000023bdc-165.dat	upx
behavioral2/files/0x000a000000023bd2-129.dat	upx
behavioral2/files/0x000a000000023bbc-29.dat	upx
behavioral2/files/0x000a000000023bbe-25.dat	upx
behavioral2/files/0x000a000000023bbd-35.dat	upx
behavioral2/files/0x000e000000023baf-8.dat	upx
behavioral2/memory/3024-4572-0x00007FF6E65F0000-0x00007FF6E69E2000-memory.dmp	upx
behavioral2/memory/3320-4585-0x00007FF795670000-0x00007FF795A62000-memory.dmp	upx
behavioral2/memory/3716-4592-0x00007FF630230000-0x00007FF630622000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\gvFnRRQ.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\tAQaiNx.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\gWDRHZm.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\CywCxoy.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\lRiyzje.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\aGFXVjB.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\RfAfnrL.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\nKpTQnu.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\jcqXwyz.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\bFEkiDE.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\tklEUIH.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\qVnqLIq.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\UlNBasb.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\cSuwfcM.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\SxKHhtF.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\NxDoSHg.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\YLXErSf.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\IVVbFuY.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\TrsiZBq.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\dwQOISO.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\fJxZPXS.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\tUTePAI.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\cSRdMyA.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\PBLDFWR.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\OaujroQ.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\hVofDDc.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\usokVGH.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\VPOwwTm.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\aTlZMSc.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\VoaMafJ.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\IxhCAVK.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\hcONypG.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\rrxVkSk.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\MEbPQKw.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\ZQetHHy.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\MnkDnDF.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\rkIrGpW.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\GfKltUI.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\ioxsaCF.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\RFxooqG.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\PIAbGTp.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\hctwyAp.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\VByRODv.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\vRFmvXE.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\OYbTWWm.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\UpWxqTp.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\KXOpeZN.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\kxRBylU.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\pgXhdzq.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\ZLOSBEM.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\nkNSeiv.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\nSrPwxG.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\HvTWulI.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\yLAkFeo.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\pqrypiB.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\WghBHuQ.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\UVqfmep.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\SzOpHkG.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\PLrzcSB.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\dYBcQaQ.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\CMDzxZS.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\cPuWRFR.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\WdDrZjr.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
File created	C:\Windows\System\qxWEIvq.exe	01dba670367f609d53464ad432d14526_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1520	powershell.exe
1520	powershell.exe
1520	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe
Token: SeDebugPrivilege	1520	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 1520	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	86
PID 3264 wrote to memory of 1520	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	86
PID 3264 wrote to memory of 3024	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	87
PID 3264 wrote to memory of 3024	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	87
PID 3264 wrote to memory of 1280	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	88
PID 3264 wrote to memory of 1280	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	88
PID 3264 wrote to memory of 3320	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	89
PID 3264 wrote to memory of 3320	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	89
PID 3264 wrote to memory of 772	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	90
PID 3264 wrote to memory of 772	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	90
PID 3264 wrote to memory of 1444	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	91
PID 3264 wrote to memory of 1444	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	91
PID 3264 wrote to memory of 3716	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	92
PID 3264 wrote to memory of 3716	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	92
PID 3264 wrote to memory of 2768	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	93
PID 3264 wrote to memory of 2768	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	93
PID 3264 wrote to memory of 1060	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	94
PID 3264 wrote to memory of 1060	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	94
PID 3264 wrote to memory of 4032	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	95
PID 3264 wrote to memory of 4032	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	95
PID 3264 wrote to memory of 1896	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	96
PID 3264 wrote to memory of 1896	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	96
PID 3264 wrote to memory of 4980	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	97
PID 3264 wrote to memory of 4980	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	97
PID 3264 wrote to memory of 3688	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	98
PID 3264 wrote to memory of 3688	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	98
PID 3264 wrote to memory of 1456	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	99
PID 3264 wrote to memory of 1456	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	99
PID 3264 wrote to memory of 1892	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	100
PID 3264 wrote to memory of 1892	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	100
PID 3264 wrote to memory of 3276	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	101
PID 3264 wrote to memory of 3276	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	101
PID 3264 wrote to memory of 2336	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	102
PID 3264 wrote to memory of 2336	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	102
PID 3264 wrote to memory of 1760	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	103
PID 3264 wrote to memory of 1760	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	103
PID 3264 wrote to memory of 2156	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	104
PID 3264 wrote to memory of 2156	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	104
PID 3264 wrote to memory of 2536	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	105
PID 3264 wrote to memory of 2536	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	105
PID 3264 wrote to memory of 2612	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	106
PID 3264 wrote to memory of 2612	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	106
PID 3264 wrote to memory of 3236	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	107
PID 3264 wrote to memory of 3236	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	107
PID 3264 wrote to memory of 624	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	108
PID 3264 wrote to memory of 624	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	108
PID 3264 wrote to memory of 4816	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	109
PID 3264 wrote to memory of 4816	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	109
PID 3264 wrote to memory of 4884	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	110
PID 3264 wrote to memory of 4884	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	110
PID 3264 wrote to memory of 804	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	111
PID 3264 wrote to memory of 804	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	111
PID 3264 wrote to memory of 760	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	112
PID 3264 wrote to memory of 760	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	112
PID 3264 wrote to memory of 5060	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	113
PID 3264 wrote to memory of 5060	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	113
PID 3264 wrote to memory of 1916	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	114
PID 3264 wrote to memory of 1916	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	114
PID 3264 wrote to memory of 1564	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	115
PID 3264 wrote to memory of 1564	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	115
PID 3264 wrote to memory of 4516	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	116
PID 3264 wrote to memory of 4516	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	116
PID 3264 wrote to memory of 652	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	117
PID 3264 wrote to memory of 652	3264	01dba670367f609d53464ad432d14526_JaffaCakes118.exe	117

C:\Users\Admin\AppData\Local\Temp\01dba670367f609d53464ad432d14526_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\01dba670367f609d53464ad432d14526_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1520
- C:\Windows\System\ytecApr.exe
  C:\Windows\System\ytecApr.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\PbpjVSr.exe
  C:\Windows\System\PbpjVSr.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\RcZaslR.exe
  C:\Windows\System\RcZaslR.exe
  2⤵
  - Executes dropped EXE
  PID:3320
- C:\Windows\System\ZDsPACB.exe
  C:\Windows\System\ZDsPACB.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\Xdnjczr.exe
  C:\Windows\System\Xdnjczr.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\yDDjgMl.exe
  C:\Windows\System\yDDjgMl.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System\VstLAcD.exe
  C:\Windows\System\VstLAcD.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\QnopXGk.exe
  C:\Windows\System\QnopXGk.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\dBbczSg.exe
  C:\Windows\System\dBbczSg.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\aQTtLhb.exe
  C:\Windows\System\aQTtLhb.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\bsJsQOD.exe
  C:\Windows\System\bsJsQOD.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\sWKfkDN.exe
  C:\Windows\System\sWKfkDN.exe
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Windows\System\PMDcAav.exe
  C:\Windows\System\PMDcAav.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\FSJIIcN.exe
  C:\Windows\System\FSJIIcN.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\kGLAvsn.exe
  C:\Windows\System\kGLAvsn.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\NqFGQlL.exe
  C:\Windows\System\NqFGQlL.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\gjphgcW.exe
  C:\Windows\System\gjphgcW.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\yXgjdOZ.exe
  C:\Windows\System\yXgjdOZ.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\NPEcCwh.exe
  C:\Windows\System\NPEcCwh.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\hOhxjyQ.exe
  C:\Windows\System\hOhxjyQ.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\tbbCzUG.exe
  C:\Windows\System\tbbCzUG.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\pEuFoWn.exe
  C:\Windows\System\pEuFoWn.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\pSCwuNU.exe
  C:\Windows\System\pSCwuNU.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\PmcXaDc.exe
  C:\Windows\System\PmcXaDc.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\XvWcohz.exe
  C:\Windows\System\XvWcohz.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\nkOYfKS.exe
  C:\Windows\System\nkOYfKS.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\bIdvXqS.exe
  C:\Windows\System\bIdvXqS.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\mTqzYgy.exe
  C:\Windows\System\mTqzYgy.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\CVFOBxr.exe
  C:\Windows\System\CVFOBxr.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\ndKEdpB.exe
  C:\Windows\System\ndKEdpB.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\bANVuGN.exe
  C:\Windows\System\bANVuGN.exe
  2⤵
  - Executes dropped EXE
  PID:652
- C:\Windows\System\BOlKQZX.exe
  C:\Windows\System\BOlKQZX.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\CJSLMhI.exe
  C:\Windows\System\CJSLMhI.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\iJDnlgb.exe
  C:\Windows\System\iJDnlgb.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\kuWqWML.exe
  C:\Windows\System\kuWqWML.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\xPMnOWH.exe
  C:\Windows\System\xPMnOWH.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\yBMrSaG.exe
  C:\Windows\System\yBMrSaG.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\qIGzkpw.exe
  C:\Windows\System\qIGzkpw.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\fjJDwHR.exe
  C:\Windows\System\fjJDwHR.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\ZBQyZwG.exe
  C:\Windows\System\ZBQyZwG.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\LpvqXKp.exe
  C:\Windows\System\LpvqXKp.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\BehJrtU.exe
  C:\Windows\System\BehJrtU.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\kGPZxnL.exe
  C:\Windows\System\kGPZxnL.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\sdXnZDU.exe
  C:\Windows\System\sdXnZDU.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\DQoGAnb.exe
  C:\Windows\System\DQoGAnb.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\qkJQIKR.exe
  C:\Windows\System\qkJQIKR.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\CrRplSj.exe
  C:\Windows\System\CrRplSj.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\eWrOmhV.exe
  C:\Windows\System\eWrOmhV.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\tgylexe.exe
  C:\Windows\System\tgylexe.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\AXjKIBp.exe
  C:\Windows\System\AXjKIBp.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\vvWwrCT.exe
  C:\Windows\System\vvWwrCT.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\vAvCMMY.exe
  C:\Windows\System\vAvCMMY.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\SRIOxGw.exe
  C:\Windows\System\SRIOxGw.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System\qeruWgD.exe
  C:\Windows\System\qeruWgD.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\JxcItVc.exe
  C:\Windows\System\JxcItVc.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\vhQgvWS.exe
  C:\Windows\System\vhQgvWS.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\skuflvq.exe
  C:\Windows\System\skuflvq.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\bIHLtIK.exe
  C:\Windows\System\bIHLtIK.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\ezWbmwA.exe
  C:\Windows\System\ezWbmwA.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\OsjVuyI.exe
  C:\Windows\System\OsjVuyI.exe
  2⤵
  - Executes dropped EXE
  PID:3888
- C:\Windows\System\lWKfdIm.exe
  C:\Windows\System\lWKfdIm.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\hqMLHqJ.exe
  C:\Windows\System\hqMLHqJ.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\aKVDKxm.exe
  C:\Windows\System\aKVDKxm.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\MgbStVk.exe
  C:\Windows\System\MgbStVk.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\uEtJScK.exe
  C:\Windows\System\uEtJScK.exe
  2⤵
  PID:2112
- C:\Windows\System\rLXCIlD.exe
  C:\Windows\System\rLXCIlD.exe
  2⤵
  PID:1480
- C:\Windows\System\xnwAbDQ.exe
  C:\Windows\System\xnwAbDQ.exe
  2⤵
  PID:4284
- C:\Windows\System\ziDNtOH.exe
  C:\Windows\System\ziDNtOH.exe
  2⤵
  PID:4580
- C:\Windows\System\WDaVPsM.exe
  C:\Windows\System\WDaVPsM.exe
  2⤵
  PID:3820
- C:\Windows\System\yXFlRFm.exe
  C:\Windows\System\yXFlRFm.exe
  2⤵
  PID:2184
- C:\Windows\System\MYkdoGp.exe
  C:\Windows\System\MYkdoGp.exe
  2⤵
  PID:2856
- C:\Windows\System\eZIslIP.exe
  C:\Windows\System\eZIslIP.exe
  2⤵
  PID:1828
- C:\Windows\System\RkgzWqc.exe
  C:\Windows\System\RkgzWqc.exe
  2⤵
  PID:4240
- C:\Windows\System\jpitVez.exe
  C:\Windows\System\jpitVez.exe
  2⤵
  PID:4836
- C:\Windows\System\jqFcRrO.exe
  C:\Windows\System\jqFcRrO.exe
  2⤵
  PID:1492
- C:\Windows\System\aKjRTmg.exe
  C:\Windows\System\aKjRTmg.exe
  2⤵
  PID:1772
- C:\Windows\System\xoWaLRf.exe
  C:\Windows\System\xoWaLRf.exe
  2⤵
  PID:2368
- C:\Windows\System\vKVPixa.exe
  C:\Windows\System\vKVPixa.exe
  2⤵
  PID:2880
- C:\Windows\System\hhmSWis.exe
  C:\Windows\System\hhmSWis.exe
  2⤵
  PID:4392
- C:\Windows\System\xFLORTA.exe
  C:\Windows\System\xFLORTA.exe
  2⤵
  PID:3940
- C:\Windows\System\YuYhdUX.exe
  C:\Windows\System\YuYhdUX.exe
  2⤵
  PID:636
- C:\Windows\System\BclpWHr.exe
  C:\Windows\System\BclpWHr.exe
  2⤵
  PID:1948
- C:\Windows\System\poYQjhj.exe
  C:\Windows\System\poYQjhj.exe
  2⤵
  PID:5144
- C:\Windows\System\eqrkxoc.exe
  C:\Windows\System\eqrkxoc.exe
  2⤵
  PID:5168
- C:\Windows\System\dksfvRb.exe
  C:\Windows\System\dksfvRb.exe
  2⤵
  PID:5192
- C:\Windows\System\wBFmMHz.exe
  C:\Windows\System\wBFmMHz.exe
  2⤵
  PID:5212
- C:\Windows\System\NUCKuFO.exe
  C:\Windows\System\NUCKuFO.exe
  2⤵
  PID:5260
- C:\Windows\System\IhqTcZs.exe
  C:\Windows\System\IhqTcZs.exe
  2⤵
  PID:5292
- C:\Windows\System\gUhPvfG.exe
  C:\Windows\System\gUhPvfG.exe
  2⤵
  PID:5308
- C:\Windows\System\Mjhgrpt.exe
  C:\Windows\System\Mjhgrpt.exe
  2⤵
  PID:5332
- C:\Windows\System\HPVDJQP.exe
  C:\Windows\System\HPVDJQP.exe
  2⤵
  PID:5348
- C:\Windows\System\NphVyIJ.exe
  C:\Windows\System\NphVyIJ.exe
  2⤵
  PID:5388
- C:\Windows\System\XlaFKpM.exe
  C:\Windows\System\XlaFKpM.exe
  2⤵
  PID:5412
- C:\Windows\System\WSLnKjq.exe
  C:\Windows\System\WSLnKjq.exe
  2⤵
  PID:5440
- C:\Windows\System\ILQiPPR.exe
  C:\Windows\System\ILQiPPR.exe
  2⤵
  PID:5460
- C:\Windows\System\PNlsRHI.exe
  C:\Windows\System\PNlsRHI.exe
  2⤵
  PID:5480
- C:\Windows\System\oeccmHe.exe
  C:\Windows\System\oeccmHe.exe
  2⤵
  PID:5524
- C:\Windows\System\KkJvIrY.exe
  C:\Windows\System\KkJvIrY.exe
  2⤵
  PID:5552
- C:\Windows\System\jIcxQhm.exe
  C:\Windows\System\jIcxQhm.exe
  2⤵
  PID:5568
- C:\Windows\System\FTOtfRd.exe
  C:\Windows\System\FTOtfRd.exe
  2⤵
  PID:5584
- C:\Windows\System\GctcTdh.exe
  C:\Windows\System\GctcTdh.exe
  2⤵
  PID:5600
- C:\Windows\System\gSrBAgF.exe
  C:\Windows\System\gSrBAgF.exe
  2⤵
  PID:5624
- C:\Windows\System\rroztqN.exe
  C:\Windows\System\rroztqN.exe
  2⤵
  PID:5644
- C:\Windows\System\rfHbGOR.exe
  C:\Windows\System\rfHbGOR.exe
  2⤵
  PID:5664
- C:\Windows\System\KwZUAnW.exe
  C:\Windows\System\KwZUAnW.exe
  2⤵
  PID:5688
- C:\Windows\System\EsuYjjT.exe
  C:\Windows\System\EsuYjjT.exe
  2⤵
  PID:5708
- C:\Windows\System\OkYQPNk.exe
  C:\Windows\System\OkYQPNk.exe
  2⤵
  PID:5732
- C:\Windows\System\qKlrpHx.exe
  C:\Windows\System\qKlrpHx.exe
  2⤵
  PID:5752
- C:\Windows\System\xuqWTOn.exe
  C:\Windows\System\xuqWTOn.exe
  2⤵
  PID:5772
- C:\Windows\System\UkhxnUL.exe
  C:\Windows\System\UkhxnUL.exe
  2⤵
  PID:5792
- C:\Windows\System\VQzPziE.exe
  C:\Windows\System\VQzPziE.exe
  2⤵
  PID:5820
- C:\Windows\System\opqxNZU.exe
  C:\Windows\System\opqxNZU.exe
  2⤵
  PID:5872
- C:\Windows\System\bxoBiAP.exe
  C:\Windows\System\bxoBiAP.exe
  2⤵
  PID:5896
- C:\Windows\System\qKDZVOD.exe
  C:\Windows\System\qKDZVOD.exe
  2⤵
  PID:5932
- C:\Windows\System\zLZkdSp.exe
  C:\Windows\System\zLZkdSp.exe
  2⤵
  PID:5956
- C:\Windows\System\daANxSr.exe
  C:\Windows\System\daANxSr.exe
  2⤵
  PID:5972
- C:\Windows\System\HvfaSdw.exe
  C:\Windows\System\HvfaSdw.exe
  2⤵
  PID:6000
- C:\Windows\System\HwwLVMe.exe
  C:\Windows\System\HwwLVMe.exe
  2⤵
  PID:6020
- C:\Windows\System\ZyVLCmP.exe
  C:\Windows\System\ZyVLCmP.exe
  2⤵
  PID:6040
- C:\Windows\System\DzWAdgz.exe
  C:\Windows\System\DzWAdgz.exe
  2⤵
  PID:6056
- C:\Windows\System\ZdpotNP.exe
  C:\Windows\System\ZdpotNP.exe
  2⤵
  PID:6076
- C:\Windows\System\hsUqXYL.exe
  C:\Windows\System\hsUqXYL.exe
  2⤵
  PID:6100
- C:\Windows\System\rHKHqVc.exe
  C:\Windows\System\rHKHqVc.exe
  2⤵
  PID:6128
- C:\Windows\System\wWStdDN.exe
  C:\Windows\System\wWStdDN.exe
  2⤵
  PID:2492
- C:\Windows\System\xFXXucw.exe
  C:\Windows\System\xFXXucw.exe
  2⤵
  PID:680
- C:\Windows\System\UnVZqOY.exe
  C:\Windows\System\UnVZqOY.exe
  2⤵
  PID:4116
- C:\Windows\System\FDnYeVC.exe
  C:\Windows\System\FDnYeVC.exe
  2⤵
  PID:4484
- C:\Windows\System\LrAAstk.exe
  C:\Windows\System\LrAAstk.exe
  2⤵
  PID:3400
- C:\Windows\System\xvVSHZz.exe
  C:\Windows\System\xvVSHZz.exe
  2⤵
  PID:4292
- C:\Windows\System\WlFfsNk.exe
  C:\Windows\System\WlFfsNk.exe
  2⤵
  PID:988
- C:\Windows\System\fsuoewk.exe
  C:\Windows\System\fsuoewk.exe
  2⤵
  PID:4784
- C:\Windows\System\GYAbdMl.exe
  C:\Windows\System\GYAbdMl.exe
  2⤵
  PID:4140
- C:\Windows\System\vLAtSZu.exe
  C:\Windows\System\vLAtSZu.exe
  2⤵
  PID:4852
- C:\Windows\System\NLlQBPm.exe
  C:\Windows\System\NLlQBPm.exe
  2⤵
  PID:4744
- C:\Windows\System\bkovaGh.exe
  C:\Windows\System\bkovaGh.exe
  2⤵
  PID:3704
- C:\Windows\System\PGmWitL.exe
  C:\Windows\System\PGmWitL.exe
  2⤵
  PID:1792
- C:\Windows\System\QUWfAEn.exe
  C:\Windows\System\QUWfAEn.exe
  2⤵
  PID:2912
- C:\Windows\System\zURfGOp.exe
  C:\Windows\System\zURfGOp.exe
  2⤵
  PID:4492
- C:\Windows\System\xZAmxPa.exe
  C:\Windows\System\xZAmxPa.exe
  2⤵
  PID:436
- C:\Windows\System\AfpXfmr.exe
  C:\Windows\System\AfpXfmr.exe
  2⤵
  PID:5364
- C:\Windows\System\WpEEjPo.exe
  C:\Windows\System\WpEEjPo.exe
  2⤵
  PID:1904
- C:\Windows\System\Vptbusr.exe
  C:\Windows\System\Vptbusr.exe
  2⤵
  PID:5136
- C:\Windows\System\GImgvMU.exe
  C:\Windows\System\GImgvMU.exe
  2⤵
  PID:5224
- C:\Windows\System\cOgYOxe.exe
  C:\Windows\System\cOgYOxe.exe
  2⤵
  PID:5720
- C:\Windows\System\wBJdkBT.exe
  C:\Windows\System\wBJdkBT.exe
  2⤵
  PID:6152
- C:\Windows\System\yilemLB.exe
  C:\Windows\System\yilemLB.exe
  2⤵
  PID:6176
- C:\Windows\System\wLSyChm.exe
  C:\Windows\System\wLSyChm.exe
  2⤵
  PID:6196
- C:\Windows\System\GWqjRla.exe
  C:\Windows\System\GWqjRla.exe
  2⤵
  PID:6228
- C:\Windows\System\UHEaWSx.exe
  C:\Windows\System\UHEaWSx.exe
  2⤵
  PID:6244
- C:\Windows\System\HAZAuCK.exe
  C:\Windows\System\HAZAuCK.exe
  2⤵
  PID:6268
- C:\Windows\System\iZPIsmi.exe
  C:\Windows\System\iZPIsmi.exe
  2⤵
  PID:6292
- C:\Windows\System\TNTcmzy.exe
  C:\Windows\System\TNTcmzy.exe
  2⤵
  PID:6320
- C:\Windows\System\QAgvAaZ.exe
  C:\Windows\System\QAgvAaZ.exe
  2⤵
  PID:6348
- C:\Windows\System\vTErano.exe
  C:\Windows\System\vTErano.exe
  2⤵
  PID:6372
- C:\Windows\System\VTzvQSu.exe
  C:\Windows\System\VTzvQSu.exe
  2⤵
  PID:6408
- C:\Windows\System\QiQAuSf.exe
  C:\Windows\System\QiQAuSf.exe
  2⤵
  PID:6424
- C:\Windows\System\eObCzhe.exe
  C:\Windows\System\eObCzhe.exe
  2⤵
  PID:6440
- C:\Windows\System\lmFkZzi.exe
  C:\Windows\System\lmFkZzi.exe
  2⤵
  PID:6460
- C:\Windows\System\VytwDbE.exe
  C:\Windows\System\VytwDbE.exe
  2⤵
  PID:6516
- C:\Windows\System\IBMBytH.exe
  C:\Windows\System\IBMBytH.exe
  2⤵
  PID:6532
- C:\Windows\System\WybuxPf.exe
  C:\Windows\System\WybuxPf.exe
  2⤵
  PID:6560
- C:\Windows\System\PVGqQOZ.exe
  C:\Windows\System\PVGqQOZ.exe
  2⤵
  PID:6584
- C:\Windows\System\UXmXwXD.exe
  C:\Windows\System\UXmXwXD.exe
  2⤵
  PID:6600
- C:\Windows\System\WHOsFmf.exe
  C:\Windows\System\WHOsFmf.exe
  2⤵
  PID:6628
- C:\Windows\System\UocAAkd.exe
  C:\Windows\System\UocAAkd.exe
  2⤵
  PID:6648
- C:\Windows\System\NIOwrWs.exe
  C:\Windows\System\NIOwrWs.exe
  2⤵
  PID:6668
- C:\Windows\System\mzxDcnf.exe
  C:\Windows\System\mzxDcnf.exe
  2⤵
  PID:6692
- C:\Windows\System\aKhikbG.exe
  C:\Windows\System\aKhikbG.exe
  2⤵
  PID:6716
- C:\Windows\System\WrkymqC.exe
  C:\Windows\System\WrkymqC.exe
  2⤵
  PID:6980
- C:\Windows\System\gAixzOL.exe
  C:\Windows\System\gAixzOL.exe
  2⤵
  PID:7000
- C:\Windows\System\JMMSSnj.exe
  C:\Windows\System\JMMSSnj.exe
  2⤵
  PID:7016
- C:\Windows\System\gucwmgp.exe
  C:\Windows\System\gucwmgp.exe
  2⤵
  PID:7032
- C:\Windows\System\ICfZTBI.exe
  C:\Windows\System\ICfZTBI.exe
  2⤵
  PID:5608
- C:\Windows\System\avqkbTl.exe
  C:\Windows\System\avqkbTl.exe
  2⤵
  PID:5996
- C:\Windows\System\gxlynMY.exe
  C:\Windows\System\gxlynMY.exe
  2⤵
  PID:5700
- C:\Windows\System\EjVTstE.exe
  C:\Windows\System\EjVTstE.exe
  2⤵
  PID:6008
- C:\Windows\System\tSbugon.exe
  C:\Windows\System\tSbugon.exe
  2⤵
  PID:5764
- C:\Windows\System\GUPYROa.exe
  C:\Windows\System\GUPYROa.exe
  2⤵
  PID:5788
- C:\Windows\System\cZAcUeu.exe
  C:\Windows\System\cZAcUeu.exe
  2⤵
  PID:5864
- C:\Windows\System\EsuZxxh.exe
  C:\Windows\System\EsuZxxh.exe
  2⤵
  PID:5904
- C:\Windows\System\PLsdLfY.exe
  C:\Windows\System\PLsdLfY.exe
  2⤵
  PID:5944
- C:\Windows\System\AGOhTOJ.exe
  C:\Windows\System\AGOhTOJ.exe
  2⤵
  PID:5988
- C:\Windows\System\mvqspAd.exe
  C:\Windows\System\mvqspAd.exe
  2⤵
  PID:6052
- C:\Windows\System\lnqfwSx.exe
  C:\Windows\System\lnqfwSx.exe
  2⤵
  PID:2436
- C:\Windows\System\uxminmf.exe
  C:\Windows\System\uxminmf.exe
  2⤵
  PID:2116
- C:\Windows\System\JlQcFxh.exe
  C:\Windows\System\JlQcFxh.exe
  2⤵
  PID:6368
- C:\Windows\System\GYiWfEt.exe
  C:\Windows\System\GYiWfEt.exe
  2⤵
  PID:6452
- C:\Windows\System\DrzGCSY.exe
  C:\Windows\System\DrzGCSY.exe
  2⤵
  PID:6596
- C:\Windows\System\rRzNbTm.exe
  C:\Windows\System\rRzNbTm.exe
  2⤵
  PID:6712
- C:\Windows\System\rgfHmiJ.exe
  C:\Windows\System\rgfHmiJ.exe
  2⤵
  PID:6204
- C:\Windows\System\JQyipzA.exe
  C:\Windows\System\JQyipzA.exe
  2⤵
  PID:6380
- C:\Windows\System\FYEkHsx.exe
  C:\Windows\System\FYEkHsx.exe
  2⤵
  PID:6472
- C:\Windows\System\uBPkRIE.exe
  C:\Windows\System\uBPkRIE.exe
  2⤵
  PID:6576
- C:\Windows\System\WhJrbYP.exe
  C:\Windows\System\WhJrbYP.exe
  2⤵
  PID:6700
- C:\Windows\System\zaLLJVW.exe
  C:\Windows\System\zaLLJVW.exe
  2⤵
  PID:1972
- C:\Windows\System\Uqyujbu.exe
  C:\Windows\System\Uqyujbu.exe
  2⤵
  PID:7184
- C:\Windows\System\aoxEhxx.exe
  C:\Windows\System\aoxEhxx.exe
  2⤵
  PID:7204
- C:\Windows\System\AbSvbfZ.exe
  C:\Windows\System\AbSvbfZ.exe
  2⤵
  PID:7224
- C:\Windows\System\bsxFnzK.exe
  C:\Windows\System\bsxFnzK.exe
  2⤵
  PID:7244
- C:\Windows\System\hokPAqI.exe
  C:\Windows\System\hokPAqI.exe
  2⤵
  PID:7280
- C:\Windows\System\ULafLss.exe
  C:\Windows\System\ULafLss.exe
  2⤵
  PID:7296
- C:\Windows\System\hxCHczD.exe
  C:\Windows\System\hxCHczD.exe
  2⤵
  PID:7316
- C:\Windows\System\CCFXGPT.exe
  C:\Windows\System\CCFXGPT.exe
  2⤵
  PID:7332
- C:\Windows\System\GrlaJQY.exe
  C:\Windows\System\GrlaJQY.exe
  2⤵
  PID:7348
- C:\Windows\System\EDMgImR.exe
  C:\Windows\System\EDMgImR.exe
  2⤵
  PID:7376
- C:\Windows\System\fNjfAAG.exe
  C:\Windows\System\fNjfAAG.exe
  2⤵
  PID:7400
- C:\Windows\System\MvrvPJv.exe
  C:\Windows\System\MvrvPJv.exe
  2⤵
  PID:7424
- C:\Windows\System\hlolAit.exe
  C:\Windows\System\hlolAit.exe
  2⤵
  PID:7440
- C:\Windows\System\MjLmlIr.exe
  C:\Windows\System\MjLmlIr.exe
  2⤵
  PID:7468
- C:\Windows\System\FKZqenV.exe
  C:\Windows\System\FKZqenV.exe
  2⤵
  PID:7488
- C:\Windows\System\UEozwhH.exe
  C:\Windows\System\UEozwhH.exe
  2⤵
  PID:7512
- C:\Windows\System\rOjsovE.exe
  C:\Windows\System\rOjsovE.exe
  2⤵
  PID:7536
- C:\Windows\System\wDDnpSd.exe
  C:\Windows\System\wDDnpSd.exe
  2⤵
  PID:7556
- C:\Windows\System\OcWGrvQ.exe
  C:\Windows\System\OcWGrvQ.exe
  2⤵
  PID:7584
- C:\Windows\System\iRSHshm.exe
  C:\Windows\System\iRSHshm.exe
  2⤵
  PID:7604
- C:\Windows\System\AgTUJZo.exe
  C:\Windows\System\AgTUJZo.exe
  2⤵
  PID:7624
- C:\Windows\System\pctzDvy.exe
  C:\Windows\System\pctzDvy.exe
  2⤵
  PID:7644
- C:\Windows\System\wNNYOxh.exe
  C:\Windows\System\wNNYOxh.exe
  2⤵
  PID:7664
- C:\Windows\System\VKddDIZ.exe
  C:\Windows\System\VKddDIZ.exe
  2⤵
  PID:7688
- C:\Windows\System\mbxbEVB.exe
  C:\Windows\System\mbxbEVB.exe
  2⤵
  PID:7708
- C:\Windows\System\zVeycIJ.exe
  C:\Windows\System\zVeycIJ.exe
  2⤵
  PID:7740
- C:\Windows\System\cfsUzUN.exe
  C:\Windows\System\cfsUzUN.exe
  2⤵
  PID:7764
- C:\Windows\System\LxiWJIK.exe
  C:\Windows\System\LxiWJIK.exe
  2⤵
  PID:7788
- C:\Windows\System\ynKwfmq.exe
  C:\Windows\System\ynKwfmq.exe
  2⤵
  PID:7804
- C:\Windows\System\sTTsPIr.exe
  C:\Windows\System\sTTsPIr.exe
  2⤵
  PID:7844
- C:\Windows\System\HEKbHFg.exe
  C:\Windows\System\HEKbHFg.exe
  2⤵
  PID:7868
- C:\Windows\System\bVCXXQV.exe
  C:\Windows\System\bVCXXQV.exe
  2⤵
  PID:7892
- C:\Windows\System\mzizrEf.exe
  C:\Windows\System\mzizrEf.exe
  2⤵
  PID:7912
- C:\Windows\System\caLKxKj.exe
  C:\Windows\System\caLKxKj.exe
  2⤵
  PID:7944
- C:\Windows\System\SFBAcRT.exe
  C:\Windows\System\SFBAcRT.exe
  2⤵
  PID:7964
- C:\Windows\System\yjnhipN.exe
  C:\Windows\System\yjnhipN.exe
  2⤵
  PID:7984
- C:\Windows\System\kvewdLI.exe
  C:\Windows\System\kvewdLI.exe
  2⤵
  PID:8012
- C:\Windows\System\GaIIjqW.exe
  C:\Windows\System\GaIIjqW.exe
  2⤵
  PID:8036
- C:\Windows\System\HiNBTEF.exe
  C:\Windows\System\HiNBTEF.exe
  2⤵
  PID:8064
- C:\Windows\System\TiPHVFy.exe
  C:\Windows\System\TiPHVFy.exe
  2⤵
  PID:8084
- C:\Windows\System\lCspCDw.exe
  C:\Windows\System\lCspCDw.exe
  2⤵
  PID:8108
- C:\Windows\System\mQrqgfL.exe
  C:\Windows\System\mQrqgfL.exe
  2⤵
  PID:8132
- C:\Windows\System\YKkCiMC.exe
  C:\Windows\System\YKkCiMC.exe
  2⤵
  PID:8156
- C:\Windows\System\cpRxajO.exe
  C:\Windows\System\cpRxajO.exe
  2⤵
  PID:8180
- C:\Windows\System\WCvLQUW.exe
  C:\Windows\System\WCvLQUW.exe
  2⤵
  PID:6304
- C:\Windows\System\XuTvFqq.exe
  C:\Windows\System\XuTvFqq.exe
  2⤵
  PID:6112
- C:\Windows\System\UnKZGeS.exe
  C:\Windows\System\UnKZGeS.exe
  2⤵
  PID:7200
- C:\Windows\System\klpaKKb.exe
  C:\Windows\System\klpaKKb.exe
  2⤵
  PID:7252
- C:\Windows\System\XVhOSOr.exe
  C:\Windows\System\XVhOSOr.exe
  2⤵
  PID:6944
- C:\Windows\System\lEJGUuK.exe
  C:\Windows\System\lEJGUuK.exe
  2⤵
  PID:6968
- C:\Windows\System\SPGQudy.exe
  C:\Windows\System\SPGQudy.exe
  2⤵
  PID:7052
- C:\Windows\System\zweFNjq.exe
  C:\Windows\System\zweFNjq.exe
  2⤵
  PID:7104
- C:\Windows\System\ZIytmss.exe
  C:\Windows\System\ZIytmss.exe
  2⤵
  PID:5476
- C:\Windows\System\bBvNIfi.exe
  C:\Windows\System\bBvNIfi.exe
  2⤵
  PID:5592
- C:\Windows\System\jYDNCJd.exe
  C:\Windows\System\jYDNCJd.exe
  2⤵
  PID:5684
- C:\Windows\System\nbhroYL.exe
  C:\Windows\System\nbhroYL.exe
  2⤵
  PID:5744
- C:\Windows\System\KIUzRSf.exe
  C:\Windows\System\KIUzRSf.exe
  2⤵
  PID:5816
- C:\Windows\System\bruiIaC.exe
  C:\Windows\System\bruiIaC.exe
  2⤵
  PID:7240
- C:\Windows\System\PQTCMEK.exe
  C:\Windows\System\PQTCMEK.exe
  2⤵
  PID:6084
- C:\Windows\System\woyMqre.exe
  C:\Windows\System\woyMqre.exe
  2⤵
  PID:7360
- C:\Windows\System\ozMrvUa.exe
  C:\Windows\System\ozMrvUa.exe
  2⤵
  PID:6240
- C:\Windows\System\qTeGKgA.exe
  C:\Windows\System\qTeGKgA.exe
  2⤵
  PID:7564
- C:\Windows\System\JWlmPrm.exe
  C:\Windows\System\JWlmPrm.exe
  2⤵
  PID:2848
- C:\Windows\System\pCcVEaQ.exe
  C:\Windows\System\pCcVEaQ.exe
  2⤵
  PID:7656
- C:\Windows\System\brWyXJi.exe
  C:\Windows\System\brWyXJi.exe
  2⤵
  PID:4604
- C:\Windows\System\TXCuxpN.exe
  C:\Windows\System\TXCuxpN.exe
  2⤵
  PID:8144
- C:\Windows\System\fuoTnNT.exe
  C:\Windows\System\fuoTnNT.exe
  2⤵
  PID:7308
- C:\Windows\System\bjHZpWd.exe
  C:\Windows\System\bjHZpWd.exe
  2⤵
  PID:7012
- C:\Windows\System\CXVepau.exe
  C:\Windows\System\CXVepau.exe
  2⤵
  PID:7412
- C:\Windows\System\ICKsNJR.exe
  C:\Windows\System\ICKsNJR.exe
  2⤵
  PID:7456
- C:\Windows\System\QjneGyb.exe
  C:\Windows\System\QjneGyb.exe
  2⤵
  PID:7524
- C:\Windows\System\UcSbPaF.exe
  C:\Windows\System\UcSbPaF.exe
  2⤵
  PID:7576
- C:\Windows\System\biViywd.exe
  C:\Windows\System\biViywd.exe
  2⤵
  PID:5508
- C:\Windows\System\tDgfEUQ.exe
  C:\Windows\System\tDgfEUQ.exe
  2⤵
  PID:8208
- C:\Windows\System\RYaxfZE.exe
  C:\Windows\System\RYaxfZE.exe
  2⤵
  PID:8240
- C:\Windows\System\VxZvkzN.exe
  C:\Windows\System\VxZvkzN.exe
  2⤵
  PID:8256
- C:\Windows\System\AtUslvN.exe
  C:\Windows\System\AtUslvN.exe
  2⤵
  PID:8276
- C:\Windows\System\cVSwoBx.exe
  C:\Windows\System\cVSwoBx.exe
  2⤵
  PID:8296
- C:\Windows\System\vgTQLuZ.exe
  C:\Windows\System\vgTQLuZ.exe
  2⤵
  PID:8312
- C:\Windows\System\vLxSeNB.exe
  C:\Windows\System\vLxSeNB.exe
  2⤵
  PID:8336
- C:\Windows\System\XJItheN.exe
  C:\Windows\System\XJItheN.exe
  2⤵
  PID:8360
- C:\Windows\System\HapQZKl.exe
  C:\Windows\System\HapQZKl.exe
  2⤵
  PID:8380
- C:\Windows\System\ensxZpd.exe
  C:\Windows\System\ensxZpd.exe
  2⤵
  PID:8400
- C:\Windows\System\vamLSGF.exe
  C:\Windows\System\vamLSGF.exe
  2⤵
  PID:8600
- C:\Windows\System\XIvHYaQ.exe
  C:\Windows\System\XIvHYaQ.exe
  2⤵
  PID:8620
- C:\Windows\System\ubzYRmz.exe
  C:\Windows\System\ubzYRmz.exe
  2⤵
  PID:8636
- C:\Windows\System\LZqMabc.exe
  C:\Windows\System\LZqMabc.exe
  2⤵
  PID:8652
- C:\Windows\System\relZiFu.exe
  C:\Windows\System\relZiFu.exe
  2⤵
  PID:8668
- C:\Windows\System\ZQfDAaJ.exe
  C:\Windows\System\ZQfDAaJ.exe
  2⤵
  PID:8688
- C:\Windows\System\XCVcmrF.exe
  C:\Windows\System\XCVcmrF.exe
  2⤵
  PID:8704
- C:\Windows\System\nmECeHw.exe
  C:\Windows\System\nmECeHw.exe
  2⤵
  PID:8720
- C:\Windows\System\czFRBej.exe
  C:\Windows\System\czFRBej.exe
  2⤵
  PID:8736
- C:\Windows\System\jafixYW.exe
  C:\Windows\System\jafixYW.exe
  2⤵
  PID:8760
- C:\Windows\System\yeAbbTm.exe
  C:\Windows\System\yeAbbTm.exe
  2⤵
  PID:8872
- C:\Windows\System\dwpXzwk.exe
  C:\Windows\System\dwpXzwk.exe
  2⤵
  PID:8892
- C:\Windows\System\UrGyCcU.exe
  C:\Windows\System\UrGyCcU.exe
  2⤵
  PID:8908
- C:\Windows\System\LSYbaEL.exe
  C:\Windows\System\LSYbaEL.exe
  2⤵
  PID:8924
- C:\Windows\System\XeNbDkq.exe
  C:\Windows\System\XeNbDkq.exe
  2⤵
  PID:8944
- C:\Windows\System\wCJQfJh.exe
  C:\Windows\System\wCJQfJh.exe
  2⤵
  PID:8960
- C:\Windows\System\yWCOVxC.exe
  C:\Windows\System\yWCOVxC.exe
  2⤵
  PID:8976
- C:\Windows\System\jVrVXTG.exe
  C:\Windows\System\jVrVXTG.exe
  2⤵
  PID:8992
- C:\Windows\System\mtBvWQA.exe
  C:\Windows\System\mtBvWQA.exe
  2⤵
  PID:9020
- C:\Windows\System\UJUXOiL.exe
  C:\Windows\System\UJUXOiL.exe
  2⤵
  PID:9040
- C:\Windows\System\TZaSsSr.exe
  C:\Windows\System\TZaSsSr.exe
  2⤵
  PID:9060
- C:\Windows\System\Eplbrzr.exe
  C:\Windows\System\Eplbrzr.exe
  2⤵
  PID:9084
- C:\Windows\System\ybTyUwG.exe
  C:\Windows\System\ybTyUwG.exe
  2⤵
  PID:9104
- C:\Windows\System\jNECHnu.exe
  C:\Windows\System\jNECHnu.exe
  2⤵
  PID:9128
- C:\Windows\System\vFexKQo.exe
  C:\Windows\System\vFexKQo.exe
  2⤵
  PID:9148
- C:\Windows\System\GTEtnbt.exe
  C:\Windows\System\GTEtnbt.exe
  2⤵
  PID:9168
- C:\Windows\System\uBxlntc.exe
  C:\Windows\System\uBxlntc.exe
  2⤵
  PID:9192
- C:\Windows\System\VzcoKxD.exe
  C:\Windows\System\VzcoKxD.exe
  2⤵
  PID:9212
- C:\Windows\System\FyqboFZ.exe
  C:\Windows\System\FyqboFZ.exe
  2⤵
  PID:6636
- C:\Windows\System\JKtHGkH.exe
  C:\Windows\System\JKtHGkH.exe
  2⤵
  PID:7220
- C:\Windows\System\ATEZeHx.exe
  C:\Windows\System\ATEZeHx.exe
  2⤵
  PID:7632
- C:\Windows\System\zozfryP.exe
  C:\Windows\System\zozfryP.exe
  2⤵
  PID:7684
- C:\Windows\System\joOTVVr.exe
  C:\Windows\System\joOTVVr.exe
  2⤵
  PID:5200
- C:\Windows\System\LfVZxhE.exe
  C:\Windows\System\LfVZxhE.exe
  2⤵
  PID:7776
- C:\Windows\System\MYdlWPd.exe
  C:\Windows\System\MYdlWPd.exe
  2⤵
  PID:7852
- C:\Windows\System\HwJQcAm.exe
  C:\Windows\System\HwJQcAm.exe
  2⤵
  PID:7884
- C:\Windows\System\CQkbdXC.exe
  C:\Windows\System\CQkbdXC.exe
  2⤵
  PID:7952
- C:\Windows\System\xQOpSYO.exe
  C:\Windows\System\xQOpSYO.exe
  2⤵
  PID:7992
- C:\Windows\System\SeAixdP.exe
  C:\Windows\System\SeAixdP.exe
  2⤵
  PID:8028
- C:\Windows\System\WPDGtEq.exe
  C:\Windows\System\WPDGtEq.exe
  2⤵
  PID:8056
- C:\Windows\System\QsXElUi.exe
  C:\Windows\System\QsXElUi.exe
  2⤵
  PID:8104
- C:\Windows\System\aPbAuKF.exe
  C:\Windows\System\aPbAuKF.exe
  2⤵
  PID:6048
- C:\Windows\System\GVBSlur.exe
  C:\Windows\System\GVBSlur.exe
  2⤵
  PID:6036
- C:\Windows\System\qtDnrVL.exe
  C:\Windows\System\qtDnrVL.exe
  2⤵
  PID:8728
- C:\Windows\System\hcPWMyo.exe
  C:\Windows\System\hcPWMyo.exe
  2⤵
  PID:7480
- C:\Windows\System\eoiHKbl.exe
  C:\Windows\System\eoiHKbl.exe
  2⤵
  PID:6664
- C:\Windows\System\jXRSIBy.exe
  C:\Windows\System\jXRSIBy.exe
  2⤵
  PID:7272
- C:\Windows\System\rBLHJtZ.exe
  C:\Windows\System\rBLHJtZ.exe
  2⤵
  PID:7344
- C:\Windows\System\aarNyfn.exe
  C:\Windows\System\aarNyfn.exe
  2⤵
  PID:7600
- C:\Windows\System\UotAfWp.exe
  C:\Windows\System\UotAfWp.exe
  2⤵
  PID:8252
- C:\Windows\System\gYgqRcx.exe
  C:\Windows\System\gYgqRcx.exe
  2⤵
  PID:8332
- C:\Windows\System\KXfIECM.exe
  C:\Windows\System\KXfIECM.exe
  2⤵
  PID:8396
- C:\Windows\System\hsmKAFx.exe
  C:\Windows\System\hsmKAFx.exe
  2⤵
  PID:8304
- C:\Windows\System\KGvKddV.exe
  C:\Windows\System\KGvKddV.exe
  2⤵
  PID:8224
- C:\Windows\System\ABzkgRY.exe
  C:\Windows\System\ABzkgRY.exe
  2⤵
  PID:7328
- C:\Windows\System\sCCWKxe.exe
  C:\Windows\System\sCCWKxe.exe
  2⤵
  PID:6420
- C:\Windows\System\DaojknX.exe
  C:\Windows\System\DaojknX.exe
  2⤵
  PID:9052
- C:\Windows\System\ySuaPUa.exe
  C:\Windows\System\ySuaPUa.exe
  2⤵
  PID:9224
- C:\Windows\System\onmvFLT.exe
  C:\Windows\System\onmvFLT.exe
  2⤵
  PID:9240
- C:\Windows\System\ejAVIWr.exe
  C:\Windows\System\ejAVIWr.exe
  2⤵
  PID:9268
- C:\Windows\System\InawgQI.exe
  C:\Windows\System\InawgQI.exe
  2⤵
  PID:9288
- C:\Windows\System\sELWTbl.exe
  C:\Windows\System\sELWTbl.exe
  2⤵
  PID:9304
- C:\Windows\System\YlifMuO.exe
  C:\Windows\System\YlifMuO.exe
  2⤵
  PID:9328
- C:\Windows\System\iqvNeZZ.exe
  C:\Windows\System\iqvNeZZ.exe
  2⤵
  PID:9352
- C:\Windows\System\sKObCob.exe
  C:\Windows\System\sKObCob.exe
  2⤵
  PID:9372
- C:\Windows\System\xRiNbfY.exe
  C:\Windows\System\xRiNbfY.exe
  2⤵
  PID:9392
- C:\Windows\System\rTymYWP.exe
  C:\Windows\System\rTymYWP.exe
  2⤵
  PID:9416
- C:\Windows\System\kStamlv.exe
  C:\Windows\System\kStamlv.exe
  2⤵
  PID:9524
- C:\Windows\System\DPZcxyb.exe
  C:\Windows\System\DPZcxyb.exe
  2⤵
  PID:9540
- C:\Windows\System\lYKPvpl.exe
  C:\Windows\System\lYKPvpl.exe
  2⤵
  PID:9556
- C:\Windows\System\AMXNLFS.exe
  C:\Windows\System\AMXNLFS.exe
  2⤵
  PID:9572
- C:\Windows\System\DulIgQF.exe
  C:\Windows\System\DulIgQF.exe
  2⤵
  PID:9592
- C:\Windows\System\yIssrCb.exe
  C:\Windows\System\yIssrCb.exe
  2⤵
  PID:9608
- C:\Windows\System\KLfTKkQ.exe
  C:\Windows\System\KLfTKkQ.exe
  2⤵
  PID:9624
- C:\Windows\System\JmKndwh.exe
  C:\Windows\System\JmKndwh.exe
  2⤵
  PID:9648
- C:\Windows\System\RdHineR.exe
  C:\Windows\System\RdHineR.exe
  2⤵
  PID:9672
- C:\Windows\System\YkNsucI.exe
  C:\Windows\System\YkNsucI.exe
  2⤵
  PID:9700
- C:\Windows\System\cFPAjyS.exe
  C:\Windows\System\cFPAjyS.exe
  2⤵
  PID:9724
- C:\Windows\System\LbGvBWB.exe
  C:\Windows\System\LbGvBWB.exe
  2⤵
  PID:9744
- C:\Windows\System\ZbHlYbW.exe
  C:\Windows\System\ZbHlYbW.exe
  2⤵
  PID:9760
- C:\Windows\System\FZysvLl.exe
  C:\Windows\System\FZysvLl.exe
  2⤵
  PID:9780
- C:\Windows\System\ZNqMNPO.exe
  C:\Windows\System\ZNqMNPO.exe
  2⤵
  PID:9804
- C:\Windows\System\SrXvjAO.exe
  C:\Windows\System\SrXvjAO.exe
  2⤵
  PID:9824
- C:\Windows\System\fJxZPXS.exe
  C:\Windows\System\fJxZPXS.exe
  2⤵
  PID:9848
- C:\Windows\System\AuPjwTl.exe
  C:\Windows\System\AuPjwTl.exe
  2⤵
  PID:9864
- C:\Windows\System\yAvyDBQ.exe
  C:\Windows\System\yAvyDBQ.exe
  2⤵
  PID:9888
- C:\Windows\System\UHeVAGL.exe
  C:\Windows\System\UHeVAGL.exe
  2⤵
  PID:9916
- C:\Windows\System\lnsWmbV.exe
  C:\Windows\System\lnsWmbV.exe
  2⤵
  PID:9936
- C:\Windows\System\TpkGFOR.exe
  C:\Windows\System\TpkGFOR.exe
  2⤵
  PID:9964
- C:\Windows\System\oWorjKA.exe
  C:\Windows\System\oWorjKA.exe
  2⤵
  PID:9984
- C:\Windows\System\cpcUTWR.exe
  C:\Windows\System\cpcUTWR.exe
  2⤵
  PID:10008
- C:\Windows\System\LlhXTYK.exe
  C:\Windows\System\LlhXTYK.exe
  2⤵
  PID:10028
- C:\Windows\System\xxRabYY.exe
  C:\Windows\System\xxRabYY.exe
  2⤵
  PID:10048
- C:\Windows\System\ALSNwUL.exe
  C:\Windows\System\ALSNwUL.exe
  2⤵
  PID:10064
- C:\Windows\System\qsDQYZt.exe
  C:\Windows\System\qsDQYZt.exe
  2⤵
  PID:10088
- C:\Windows\System\JctzvRD.exe
  C:\Windows\System\JctzvRD.exe
  2⤵
  PID:10108
- C:\Windows\System\sXzFyQT.exe
  C:\Windows\System\sXzFyQT.exe
  2⤵
  PID:10128
- C:\Windows\System\MLQkIWp.exe
  C:\Windows\System\MLQkIWp.exe
  2⤵
  PID:10152
- C:\Windows\System\tLFhuIK.exe
  C:\Windows\System\tLFhuIK.exe
  2⤵
  PID:10176
- C:\Windows\System\uTeGeMX.exe
  C:\Windows\System\uTeGeMX.exe
  2⤵
  PID:10200
- C:\Windows\System\DDNJPKi.exe
  C:\Windows\System\DDNJPKi.exe
  2⤵
  PID:10216
- C:\Windows\System\UQigqrD.exe
  C:\Windows\System\UQigqrD.exe
  2⤵
  PID:9164
- C:\Windows\System\qDWwPHA.exe
  C:\Windows\System\qDWwPHA.exe
  2⤵
  PID:2528
- C:\Windows\System\hSJCbWp.exe
  C:\Windows\System\hSJCbWp.exe
  2⤵
  PID:8660
- C:\Windows\System\nvNXGjq.exe
  C:\Windows\System\nvNXGjq.exe
  2⤵
  PID:8228
- C:\Windows\System\uxFoGlR.exe
  C:\Windows\System\uxFoGlR.exe
  2⤵
  PID:8712
- C:\Windows\System\qyemShp.exe
  C:\Windows\System\qyemShp.exe
  2⤵
  PID:9112
- C:\Windows\System\FhlfqTU.exe
  C:\Windows\System\FhlfqTU.exe
  2⤵
  PID:9080
- C:\Windows\System\kPJBHqU.exe
  C:\Windows\System\kPJBHqU.exe
  2⤵
  PID:9156
- C:\Windows\System\VFkEqcg.exe
  C:\Windows\System\VFkEqcg.exe
  2⤵
  PID:9184
- C:\Windows\System\MFkxgpI.exe
  C:\Windows\System\MFkxgpI.exe
  2⤵
  PID:9344
- C:\Windows\System\rXLoZSF.exe
  C:\Windows\System\rXLoZSF.exe
  2⤵
  PID:8092
- C:\Windows\System\mRjdYJl.exe
  C:\Windows\System\mRjdYJl.exe
  2⤵
  PID:9404
- C:\Windows\System\xzQQZua.exe
  C:\Windows\System\xzQQZua.exe
  2⤵
  PID:6956
- C:\Windows\System\EGrEfEl.exe
  C:\Windows\System\EGrEfEl.exe
  2⤵
  PID:7680
- C:\Windows\System\WAehqJi.exe
  C:\Windows\System\WAehqJi.exe
  2⤵
  PID:7812
- C:\Windows\System\AuxPaYt.exe
  C:\Windows\System\AuxPaYt.exe
  2⤵
  PID:7904
- C:\Windows\System\QdmLigA.exe
  C:\Windows\System\QdmLigA.exe
  2⤵
  PID:8020
- C:\Windows\System\FJtYFya.exe
  C:\Windows\System\FJtYFya.exe
  2⤵
  PID:8904
- C:\Windows\System\OoXJuxv.exe
  C:\Windows\System\OoXJuxv.exe
  2⤵
  PID:8952
- C:\Windows\System\MENoRkT.exe
  C:\Windows\System\MENoRkT.exe
  2⤵
  PID:9004
- C:\Windows\System\xpUzYVs.exe
  C:\Windows\System\xpUzYVs.exe
  2⤵
  PID:9732
- C:\Windows\System\hAbCdfE.exe
  C:\Windows\System\hAbCdfE.exe
  2⤵
  PID:9776
- C:\Windows\System\McNFlQW.exe
  C:\Windows\System\McNFlQW.exe
  2⤵
  PID:9032
- C:\Windows\System\XNllLHg.exe
  C:\Windows\System\XNllLHg.exe
  2⤵
  PID:7448
- C:\Windows\System\RnHsMus.exe
  C:\Windows\System\RnHsMus.exe
  2⤵
  PID:10248
- C:\Windows\System\TTiYsdR.exe
  C:\Windows\System\TTiYsdR.exe
  2⤵
  PID:10272
- C:\Windows\System\RcXdIeE.exe
  C:\Windows\System\RcXdIeE.exe
  2⤵
  PID:10296
- C:\Windows\System\BhYrYgV.exe
  C:\Windows\System\BhYrYgV.exe
  2⤵
  PID:10316
- C:\Windows\System\MdTVqEi.exe
  C:\Windows\System\MdTVqEi.exe
  2⤵
  PID:10348
- C:\Windows\System\BpqgVsi.exe
  C:\Windows\System\BpqgVsi.exe
  2⤵
  PID:10364
- C:\Windows\System\EdIrqiX.exe
  C:\Windows\System\EdIrqiX.exe
  2⤵
  PID:10384
- C:\Windows\System\emEeNyy.exe
  C:\Windows\System\emEeNyy.exe
  2⤵
  PID:10400
- C:\Windows\System\ssCwDJE.exe
  C:\Windows\System\ssCwDJE.exe
  2⤵
  PID:10420
- C:\Windows\System\gswVkLl.exe
  C:\Windows\System\gswVkLl.exe
  2⤵
  PID:10440
- C:\Windows\System\ClHmoyd.exe
  C:\Windows\System\ClHmoyd.exe
  2⤵
  PID:10464
- C:\Windows\System\UJpcngr.exe
  C:\Windows\System\UJpcngr.exe
  2⤵
  PID:10488
- C:\Windows\System\fWDWowi.exe
  C:\Windows\System\fWDWowi.exe
  2⤵
  PID:10508
- C:\Windows\System\TFuDJua.exe
  C:\Windows\System\TFuDJua.exe
  2⤵
  PID:10540
- C:\Windows\System\TxdDacA.exe
  C:\Windows\System\TxdDacA.exe
  2⤵
  PID:10564
- C:\Windows\System\RSjEdYF.exe
  C:\Windows\System\RSjEdYF.exe
  2⤵
  PID:10588
- C:\Windows\System\tnrNytQ.exe
  C:\Windows\System\tnrNytQ.exe
  2⤵
  PID:10608
- C:\Windows\System\uqCZSfe.exe
  C:\Windows\System\uqCZSfe.exe
  2⤵
  PID:10628
- C:\Windows\System\zvWOLTy.exe
  C:\Windows\System\zvWOLTy.exe
  2⤵
  PID:10652
- C:\Windows\System\JDjHHOw.exe
  C:\Windows\System\JDjHHOw.exe
  2⤵
  PID:10676
- C:\Windows\System\FvxyDvX.exe
  C:\Windows\System\FvxyDvX.exe
  2⤵
  PID:10800
- C:\Windows\System\qFesmBS.exe
  C:\Windows\System\qFesmBS.exe
  2⤵
  PID:10820
- C:\Windows\System\QYOkvkj.exe
  C:\Windows\System\QYOkvkj.exe
  2⤵
  PID:10836
- C:\Windows\System\gNIcPnp.exe
  C:\Windows\System\gNIcPnp.exe
  2⤵
  PID:10852
- C:\Windows\System\QnDFtBd.exe
  C:\Windows\System\QnDFtBd.exe
  2⤵
  PID:10892
- C:\Windows\System\AqXyZzd.exe
  C:\Windows\System\AqXyZzd.exe
  2⤵
  PID:10916
- C:\Windows\System\vVmLUBD.exe
  C:\Windows\System\vVmLUBD.exe
  2⤵
  PID:10936
- C:\Windows\System\PYLjqnh.exe
  C:\Windows\System\PYLjqnh.exe
  2⤵
  PID:10960
- C:\Windows\System\dynuTwB.exe
  C:\Windows\System\dynuTwB.exe
  2⤵
  PID:10984
- C:\Windows\System\ecHfStO.exe
  C:\Windows\System\ecHfStO.exe
  2⤵
  PID:11008
- C:\Windows\System\UJJMInF.exe
  C:\Windows\System\UJJMInF.exe
  2⤵
  PID:11036
- C:\Windows\System\jeEMxTt.exe
  C:\Windows\System\jeEMxTt.exe
  2⤵
  PID:11056
- C:\Windows\System\Pclokah.exe
  C:\Windows\System\Pclokah.exe
  2⤵
  PID:11076
- C:\Windows\System\OOxpVWa.exe
  C:\Windows\System\OOxpVWa.exe
  2⤵
  PID:11100
- C:\Windows\System\jREMtJS.exe
  C:\Windows\System\jREMtJS.exe
  2⤵
  PID:11120
- C:\Windows\System\tHelpcF.exe
  C:\Windows\System\tHelpcF.exe
  2⤵
  PID:11144
- C:\Windows\System\KBBpHqv.exe
  C:\Windows\System\KBBpHqv.exe
  2⤵
  PID:11164
- C:\Windows\System\GeFppbL.exe
  C:\Windows\System\GeFppbL.exe
  2⤵
  PID:11184
- C:\Windows\System\bePuJTq.exe
  C:\Windows\System\bePuJTq.exe
  2⤵
  PID:11208
- C:\Windows\System\LfayEgA.exe
  C:\Windows\System\LfayEgA.exe
  2⤵
  PID:11232
- C:\Windows\System\AbLLngP.exe
  C:\Windows\System\AbLLngP.exe
  2⤵
  PID:11260
- C:\Windows\System\puixIpT.exe
  C:\Windows\System\puixIpT.exe
  2⤵
  PID:9300
- C:\Windows\System\NxAPcRT.exe
  C:\Windows\System\NxAPcRT.exe
  2⤵
  PID:9360
- C:\Windows\System\bKUgKAJ.exe
  C:\Windows\System\bKUgKAJ.exe
  2⤵
  PID:10100
- C:\Windows\System\AhmquHD.exe
  C:\Windows\System\AhmquHD.exe
  2⤵
  PID:10148
- C:\Windows\System\rzkWNqO.exe
  C:\Windows\System\rzkWNqO.exe
  2⤵
  PID:10224
- C:\Windows\System\OcqVuwT.exe
  C:\Windows\System\OcqVuwT.exe
  2⤵
  PID:7760
- C:\Windows\System\QEXyTaa.exe
  C:\Windows\System\QEXyTaa.exe
  2⤵
  PID:7088
- C:\Windows\System\gxapYSt.exe
  C:\Windows\System\gxapYSt.exe
  2⤵
  PID:2420
- C:\Windows\System\EtBbokz.exe
  C:\Windows\System\EtBbokz.exe
  2⤵
  PID:8696
- C:\Windows\System\yWgWnAN.exe
  C:\Windows\System\yWgWnAN.exe
  2⤵
  PID:7552
- C:\Windows\System\ifxrNtJ.exe
  C:\Windows\System\ifxrNtJ.exe
  2⤵
  PID:7496
- C:\Windows\System\QQezTxD.exe
  C:\Windows\System\QQezTxD.exe
  2⤵
  PID:9856
- C:\Windows\System\FLDfjuv.exe
  C:\Windows\System\FLDfjuv.exe
  2⤵
  PID:7276
- C:\Windows\System\wDggsAZ.exe
  C:\Windows\System\wDggsAZ.exe
  2⤵
  PID:9928
- C:\Windows\System\lagCDWf.exe
  C:\Windows\System\lagCDWf.exe
  2⤵
  PID:6436
- C:\Windows\System\aneglsK.exe
  C:\Windows\System\aneglsK.exe
  2⤵
  PID:10356
- C:\Windows\System\winbRHA.exe
  C:\Windows\System\winbRHA.exe
  2⤵
  PID:10432
- C:\Windows\System\pyJYgsr.exe
  C:\Windows\System\pyJYgsr.exe
  2⤵
  PID:9408
- C:\Windows\System\elnqxvz.exe
  C:\Windows\System\elnqxvz.exe
  2⤵
  PID:9436
- C:\Windows\System\Pmtqqdo.exe
  C:\Windows\System\Pmtqqdo.exe
  2⤵
  PID:10184
- C:\Windows\System\tYJBLlL.exe
  C:\Windows\System\tYJBLlL.exe
  2⤵
  PID:4660
- C:\Windows\System\bHhDKTW.exe
  C:\Windows\System\bHhDKTW.exe
  2⤵
  PID:8352
- C:\Windows\System\UkjMWFx.exe
  C:\Windows\System\UkjMWFx.exe
  2⤵
  PID:9548
- C:\Windows\System\WlUfbLa.exe
  C:\Windows\System\WlUfbLa.exe
  2⤵
  PID:9600
- C:\Windows\System\QaeAQIV.exe
  C:\Windows\System\QaeAQIV.exe
  2⤵
  PID:9656
- C:\Windows\System\RixSltr.exe
  C:\Windows\System\RixSltr.exe
  2⤵
  PID:9712
- C:\Windows\System\KEDBMFN.exe
  C:\Windows\System\KEDBMFN.exe
  2⤵
  PID:9812
- C:\Windows\System\GtokFUZ.exe
  C:\Windows\System\GtokFUZ.exe
  2⤵
  PID:10832
- C:\Windows\System\akjPdns.exe
  C:\Windows\System\akjPdns.exe
  2⤵
  PID:11268
- C:\Windows\System\KOeXKGN.exe
  C:\Windows\System\KOeXKGN.exe
  2⤵
  PID:11288
- C:\Windows\System\ibWmAvO.exe
  C:\Windows\System\ibWmAvO.exe
  2⤵
  PID:11308
- C:\Windows\System\nbMemPd.exe
  C:\Windows\System\nbMemPd.exe
  2⤵
  PID:11332
- C:\Windows\System\ldATuVI.exe
  C:\Windows\System\ldATuVI.exe
  2⤵
  PID:11356
- C:\Windows\System\ugnlxCd.exe
  C:\Windows\System\ugnlxCd.exe
  2⤵
  PID:11396
- C:\Windows\System\yqbZSLR.exe
  C:\Windows\System\yqbZSLR.exe
  2⤵
  PID:11412
- C:\Windows\System\SGxEeoa.exe
  C:\Windows\System\SGxEeoa.exe
  2⤵
  PID:11440
- C:\Windows\System\ajSDzCb.exe
  C:\Windows\System\ajSDzCb.exe
  2⤵
  PID:11460
- C:\Windows\System\nadXiJb.exe
  C:\Windows\System\nadXiJb.exe
  2⤵
  PID:11484
- C:\Windows\System\NyBLtbI.exe
  C:\Windows\System\NyBLtbI.exe
  2⤵
  PID:11504
- C:\Windows\System\GqMPoyd.exe
  C:\Windows\System\GqMPoyd.exe
  2⤵
  PID:11524
- C:\Windows\System\GuJqYMM.exe
  C:\Windows\System\GuJqYMM.exe
  2⤵
  PID:11552
- C:\Windows\System\dfJcxxh.exe
  C:\Windows\System\dfJcxxh.exe
  2⤵
  PID:11572
- C:\Windows\System\qFObQjv.exe
  C:\Windows\System\qFObQjv.exe
  2⤵
  PID:11592
- C:\Windows\System\LiiiFyW.exe
  C:\Windows\System\LiiiFyW.exe
  2⤵
  PID:11612
- C:\Windows\System\LKPJHUe.exe
  C:\Windows\System\LKPJHUe.exe
  2⤵
  PID:11640
- C:\Windows\System\bYRvrtl.exe
  C:\Windows\System\bYRvrtl.exe
  2⤵
  PID:11660
- C:\Windows\System\qlgHODV.exe
  C:\Windows\System\qlgHODV.exe
  2⤵
  PID:11680
- C:\Windows\System\yRnFBiU.exe
  C:\Windows\System\yRnFBiU.exe
  2⤵
  PID:11704
- C:\Windows\System\aVwCxLP.exe
  C:\Windows\System\aVwCxLP.exe
  2⤵
  PID:11728
- C:\Windows\System\iXEIfkh.exe
  C:\Windows\System\iXEIfkh.exe
  2⤵
  PID:11752
- C:\Windows\System\LvPRRcB.exe
  C:\Windows\System\LvPRRcB.exe
  2⤵
  PID:11776
- C:\Windows\System\frdhrWT.exe
  C:\Windows\System\frdhrWT.exe
  2⤵
  PID:11796
- C:\Windows\System\FeoDrWV.exe
  C:\Windows\System\FeoDrWV.exe
  2⤵
  PID:11816
- C:\Windows\System\myMDplG.exe
  C:\Windows\System\myMDplG.exe
  2⤵
  PID:11840
- C:\Windows\System\vcWRURP.exe
  C:\Windows\System\vcWRURP.exe
  2⤵
  PID:11864
- C:\Windows\System\eowvyxD.exe
  C:\Windows\System\eowvyxD.exe
  2⤵
  PID:11896
- C:\Windows\System\tmmsrHI.exe
  C:\Windows\System\tmmsrHI.exe
  2⤵
  PID:11928
- C:\Windows\System\hMERlDk.exe
  C:\Windows\System\hMERlDk.exe
  2⤵
  PID:11944
- C:\Windows\System\LGtYGOn.exe
  C:\Windows\System\LGtYGOn.exe
  2⤵
  PID:11972
- C:\Windows\System\HpdpCWf.exe
  C:\Windows\System\HpdpCWf.exe
  2⤵
  PID:11992
- C:\Windows\System\sEzmGDS.exe
  C:\Windows\System\sEzmGDS.exe
  2⤵
  PID:12008
- C:\Windows\System\VUGBDdC.exe
  C:\Windows\System\VUGBDdC.exe
  2⤵
  PID:12024
- C:\Windows\System\JAhelWy.exe
  C:\Windows\System\JAhelWy.exe
  2⤵
  PID:12040
- C:\Windows\System\jDJHfvP.exe
  C:\Windows\System\jDJHfvP.exe
  2⤵
  PID:12056
- C:\Windows\System\xOaJiuo.exe
  C:\Windows\System\xOaJiuo.exe
  2⤵
  PID:12112
- C:\Windows\System\EkQNneo.exe
  C:\Windows\System\EkQNneo.exe
  2⤵
  PID:12132
- C:\Windows\System\jxhtzCf.exe
  C:\Windows\System\jxhtzCf.exe
  2⤵
  PID:12156
- C:\Windows\System\QKGYSRV.exe
  C:\Windows\System\QKGYSRV.exe
  2⤵
  PID:12184
- C:\Windows\System\IDzDelC.exe
  C:\Windows\System\IDzDelC.exe
  2⤵
  PID:12208
- C:\Windows\System\lDunjiP.exe
  C:\Windows\System\lDunjiP.exe
  2⤵
  PID:12228
- C:\Windows\System\nvUuTVh.exe
  C:\Windows\System\nvUuTVh.exe
  2⤵
  PID:12248
- C:\Windows\System\fdGghJK.exe
  C:\Windows\System\fdGghJK.exe
  2⤵
  PID:12272
- C:\Windows\System\uSeXMqU.exe
  C:\Windows\System\uSeXMqU.exe
  2⤵
  PID:10980
- C:\Windows\System\aPeJggc.exe
  C:\Windows\System\aPeJggc.exe
  2⤵
  PID:10000
- C:\Windows\System\fJwkYDB.exe
  C:\Windows\System\fJwkYDB.exe
  2⤵
  PID:11024
- C:\Windows\System\VWPlRkq.exe
  C:\Windows\System\VWPlRkq.exe
  2⤵
  PID:11064
- C:\Windows\System\xIEuees.exe
  C:\Windows\System\xIEuees.exe
  2⤵
  PID:10472
- C:\Windows\System\pERtbKG.exe
  C:\Windows\System\pERtbKG.exe
  2⤵
  PID:10500
- C:\Windows\System\ozRdtUS.exe
  C:\Windows\System\ozRdtUS.exe
  2⤵
  PID:10560
- C:\Windows\System\BBzOqGj.exe
  C:\Windows\System\BBzOqGj.exe
  2⤵
  PID:10120
- C:\Windows\System\FgzkizL.exe
  C:\Windows\System\FgzkizL.exe
  2⤵
  PID:8616
- C:\Windows\System\XvYcswO.exe
  C:\Windows\System\XvYcswO.exe
  2⤵
  PID:6448
- C:\Windows\System\otNIDza.exe
  C:\Windows\System\otNIDza.exe
  2⤵
  PID:9016
- C:\Windows\System\ylkEEgQ.exe
  C:\Windows\System\ylkEEgQ.exe
  2⤵
  PID:9140
- C:\Windows\System\uNUtmAr.exe
  C:\Windows\System\uNUtmAr.exe
  2⤵
  PID:9208
- C:\Windows\System\pHoITxw.exe
  C:\Windows\System\pHoITxw.exe
  2⤵
  PID:8772
- C:\Windows\System\vRZKYTj.exe
  C:\Windows\System\vRZKYTj.exe
  2⤵
  PID:7772
- C:\Windows\System\YTevINw.exe
  C:\Windows\System\YTevINw.exe
  2⤵
  PID:8932
- C:\Windows\System\QSUzMnV.exe
  C:\Windows\System\QSUzMnV.exe
  2⤵
  PID:10084
- C:\Windows\System\NQgQwaA.exe
  C:\Windows\System\NQgQwaA.exe
  2⤵
  PID:10844
- C:\Windows\System\zPHrLwE.exe
  C:\Windows\System\zPHrLwE.exe
  2⤵
  PID:6580
- C:\Windows\System\ZYQtcIR.exe
  C:\Windows\System\ZYQtcIR.exe
  2⤵
  PID:10792
- C:\Windows\System\TWNDjFR.exe
  C:\Windows\System\TWNDjFR.exe
  2⤵
  PID:7724
- C:\Windows\System\JsPFrHD.exe
  C:\Windows\System\JsPFrHD.exe
  2⤵
  PID:10956
- C:\Windows\System\NmbVQan.exe
  C:\Windows\System\NmbVQan.exe
  2⤵
  PID:11456
- C:\Windows\System\vGmcCza.exe
  C:\Windows\System\vGmcCza.exe
  2⤵
  PID:12304
- C:\Windows\System\xkfwsiR.exe
  C:\Windows\System\xkfwsiR.exe
  2⤵
  PID:12328
- C:\Windows\System\NqrxhQE.exe
  C:\Windows\System\NqrxhQE.exe
  2⤵
  PID:12352
- C:\Windows\System\cfqKqwf.exe
  C:\Windows\System\cfqKqwf.exe
  2⤵
  PID:12376
- C:\Windows\System\DYrhkIf.exe
  C:\Windows\System\DYrhkIf.exe
  2⤵
  PID:12396
- C:\Windows\System\JWMNXUb.exe
  C:\Windows\System\JWMNXUb.exe
  2⤵
  PID:12420
- C:\Windows\System\RsVdTyr.exe
  C:\Windows\System\RsVdTyr.exe
  2⤵
  PID:12440
- C:\Windows\System\vLlpZOP.exe
  C:\Windows\System\vLlpZOP.exe
  2⤵
  PID:12464
- C:\Windows\System\PbLuUQl.exe
  C:\Windows\System\PbLuUQl.exe
  2⤵
  PID:12492
- C:\Windows\System\psgiWYL.exe
  C:\Windows\System\psgiWYL.exe
  2⤵
  PID:12516
- C:\Windows\System\niuHgwI.exe
  C:\Windows\System\niuHgwI.exe
  2⤵
  PID:12544
- C:\Windows\System\irxPcpY.exe
  C:\Windows\System\irxPcpY.exe
  2⤵
  PID:12572
- C:\Windows\System\jXDpzBd.exe
  C:\Windows\System\jXDpzBd.exe
  2⤵
  PID:12596
- C:\Windows\System\DvdLuhx.exe
  C:\Windows\System\DvdLuhx.exe
  2⤵
  PID:12620
- C:\Windows\System\kxMkbdM.exe
  C:\Windows\System\kxMkbdM.exe
  2⤵
  PID:12648
- C:\Windows\System\TTXkKfC.exe
  C:\Windows\System\TTXkKfC.exe
  2⤵
  PID:12668
- C:\Windows\System\dvRBTVT.exe
  C:\Windows\System\dvRBTVT.exe
  2⤵
  PID:12696
- C:\Windows\System\ObkVGfD.exe
  C:\Windows\System\ObkVGfD.exe
  2⤵
  PID:12712
- C:\Windows\System\BMMiolh.exe
  C:\Windows\System\BMMiolh.exe
  2⤵
  PID:12728
- C:\Windows\System\PdNHKcn.exe
  C:\Windows\System\PdNHKcn.exe
  2⤵
  PID:12744
- C:\Windows\System\Enbavrn.exe
  C:\Windows\System\Enbavrn.exe
  2⤵
  PID:12760
- C:\Windows\System\EUeMSLc.exe
  C:\Windows\System\EUeMSLc.exe
  2⤵
  PID:12776
- C:\Windows\System\nJXdWTc.exe
  C:\Windows\System\nJXdWTc.exe
  2⤵
  PID:12792
- C:\Windows\System\mIbMHHt.exe
  C:\Windows\System\mIbMHHt.exe
  2⤵
  PID:12808
- C:\Windows\System\inpXKaY.exe
  C:\Windows\System\inpXKaY.exe
  2⤵
  PID:12828
- C:\Windows\System\dnyqFng.exe
  C:\Windows\System\dnyqFng.exe
  2⤵
  PID:12848
- C:\Windows\System\PcFDHSx.exe
  C:\Windows\System\PcFDHSx.exe
  2⤵
  PID:12872
- C:\Windows\System\AwuZmag.exe
  C:\Windows\System\AwuZmag.exe
  2⤵
  PID:12912
- C:\Windows\System\VWloRKX.exe
  C:\Windows\System\VWloRKX.exe
  2⤵
  PID:12932
- C:\Windows\System\FGCsxJF.exe
  C:\Windows\System\FGCsxJF.exe
  2⤵
  PID:12948
- C:\Windows\System\afBXlLz.exe
  C:\Windows\System\afBXlLz.exe
  2⤵
  PID:12968
- C:\Windows\System\EAocXMe.exe
  C:\Windows\System\EAocXMe.exe
  2⤵
  PID:12996
- C:\Windows\System\OuMMoPR.exe
  C:\Windows\System\OuMMoPR.exe
  2⤵
  PID:13016
- C:\Windows\System\kgQHQYJ.exe
  C:\Windows\System\kgQHQYJ.exe
  2⤵
  PID:13036
- C:\Windows\System\cWZLMos.exe
  C:\Windows\System\cWZLMos.exe
  2⤵
  PID:13056
- C:\Windows\System\bDvOXis.exe
  C:\Windows\System\bDvOXis.exe
  2⤵
  PID:13124
- C:\Windows\System\WFJzKew.exe
  C:\Windows\System\WFJzKew.exe
  2⤵
  PID:13152
- C:\Windows\System\NDoVuCC.exe
  C:\Windows\System\NDoVuCC.exe
  2⤵
  PID:13168
- C:\Windows\System\PdWWLWQ.exe
  C:\Windows\System\PdWWLWQ.exe
  2⤵
  PID:13192
- C:\Windows\System\sTANfId.exe
  C:\Windows\System\sTANfId.exe
  2⤵
  PID:13212
- C:\Windows\System\GsDWYXa.exe
  C:\Windows\System\GsDWYXa.exe
  2⤵
  PID:13236
- C:\Windows\System\RxyCsdK.exe
  C:\Windows\System\RxyCsdK.exe
  2⤵
  PID:13264
- C:\Windows\System\jjMbofl.exe
  C:\Windows\System\jjMbofl.exe
  2⤵
  PID:11836
- C:\Windows\System\AluJojj.exe
  C:\Windows\System\AluJojj.exe
  2⤵
  PID:12708
- C:\Windows\System\DShqikL.exe
  C:\Windows\System\DShqikL.exe
  2⤵
  PID:11880
- C:\Windows\System\yYdjQqc.exe
  C:\Windows\System\yYdjQqc.exe
  2⤵
  PID:10208
- C:\Windows\System\wPTDOFh.exe
  C:\Windows\System\wPTDOFh.exe
  2⤵
  PID:8124
- C:\Windows\System\yPiiiZE.exe
  C:\Windows\System\yPiiiZE.exe
  2⤵
  PID:2136
- C:\Windows\System\mryAZuV.exe
  C:\Windows\System\mryAZuV.exe
  2⤵
  PID:9880
- C:\Windows\System\ZJJhulD.exe
  C:\Windows\System\ZJJhulD.exe
  2⤵
  PID:9312
- C:\Windows\System\CbNuBKC.exe
  C:\Windows\System\CbNuBKC.exe
  2⤵
  PID:748
- C:\Windows\System\wGMIvRS.exe
  C:\Windows\System\wGMIvRS.exe
  2⤵
  PID:13256
- C:\Windows\System\JqMYRJn.exe
  C:\Windows\System\JqMYRJn.exe
  2⤵
  PID:11180
- C:\Windows\System\HNHQVHP.exe
  C:\Windows\System\HNHQVHP.exe
  2⤵
  PID:11352
- C:\Windows\System\KGErDIT.exe
  C:\Windows\System\KGErDIT.exe
  2⤵
  PID:9536
- C:\Windows\System\DMEfsDs.exe
  C:\Windows\System\DMEfsDs.exe
  2⤵
  PID:11772
- C:\Windows\System\fGPwMUG.exe
  C:\Windows\System\fGPwMUG.exe
  2⤵
  PID:11696
- C:\Windows\System\IEwOLHs.exe
  C:\Windows\System\IEwOLHs.exe
  2⤵
  PID:11604
- C:\Windows\System\HcrKhCi.exe
  C:\Windows\System\HcrKhCi.exe
  2⤵
  PID:13112
- C:\Windows\System\yoCKxZe.exe
  C:\Windows\System\yoCKxZe.exe
  2⤵
  PID:12984
- C:\Windows\System\HBGvGNG.exe
  C:\Windows\System\HBGvGNG.exe
  2⤵
  PID:11476
- C:\Windows\System\WjRlOQN.exe
  C:\Windows\System\WjRlOQN.exe
  2⤵
  PID:11532
- C:\Windows\System\rZkdZRt.exe
  C:\Windows\System\rZkdZRt.exe
  2⤵
  PID:12552
- C:\Windows\System\RQZLfRr.exe
  C:\Windows\System\RQZLfRr.exe
  2⤵
  PID:12800
- C:\Windows\System\spczNuJ.exe
  C:\Windows\System\spczNuJ.exe
  2⤵
  PID:11608
- C:\Windows\System\oDOruIg.exe
  C:\Windows\System\oDOruIg.exe
  2⤵
  PID:12256
- C:\Windows\System\nIVIFFM.exe
  C:\Windows\System\nIVIFFM.exe
  2⤵
  PID:13204
- C:\Windows\System\JmMGEBJ.exe
  C:\Windows\System\JmMGEBJ.exe
  2⤵
  PID:13292
- C:\Windows\System\SuigigA.exe
  C:\Windows\System\SuigigA.exe
  2⤵
  PID:11204
- C:\Windows\System\uIKZVeU.exe
  C:\Windows\System\uIKZVeU.exe
  2⤵
  PID:11768
- C:\Windows\System\IRVCpvR.exe
  C:\Windows\System\IRVCpvR.exe
  2⤵
  PID:10684
- C:\Windows\System\gvuuIwu.exe
  C:\Windows\System\gvuuIwu.exe
  2⤵
  PID:11712
- C:\Windows\System\zNgiBlg.exe
  C:\Windows\System\zNgiBlg.exe
  2⤵
  PID:11468
- C:\Windows\System\htMcCLA.exe
  C:\Windows\System\htMcCLA.exe
  2⤵
  PID:12656
- C:\Windows\System\vpbBssG.exe
  C:\Windows\System\vpbBssG.exe
  2⤵
  PID:12768
- C:\Windows\System\vpWvjqB.exe
  C:\Windows\System\vpWvjqB.exe
  2⤵
  PID:12036
- C:\Windows\System\XFOGomJ.exe
  C:\Windows\System\XFOGomJ.exe
  2⤵
  PID:11652
- C:\Windows\System\kQSKQDy.exe
  C:\Windows\System\kQSKQDy.exe
  2⤵
  PID:11824
- C:\Windows\System\AkfqEtI.exe
  C:\Windows\System\AkfqEtI.exe
  2⤵
  PID:12880
- C:\Windows\System\XCemEdx.exe
  C:\Windows\System\XCemEdx.exe
  2⤵
  PID:11016
- C:\Windows\System\sprrJJk.exe
  C:\Windows\System\sprrJJk.exe
  2⤵
  PID:10376
- C:\Windows\System\XTIrjDV.exe
  C:\Windows\System\XTIrjDV.exe
  2⤵
  PID:7180
- C:\Windows\System\qHZrpuD.exe
  C:\Windows\System\qHZrpuD.exe
  2⤵
  PID:8920
- C:\Windows\System\pRnlHpj.exe
  C:\Windows\System\pRnlHpj.exe
  2⤵
  PID:12388
- C:\Windows\System\XRpnrDd.exe
  C:\Windows\System\XRpnrDd.exe
  2⤵
  PID:4012
- C:\Windows\System\dvVcnRj.exe
  C:\Windows\System\dvVcnRj.exe
  2⤵
  PID:12904
- C:\Windows\System\CRjAlKW.exe
  C:\Windows\System\CRjAlKW.exe
  2⤵
  PID:1712
- C:\Windows\System\tqNziWY.exe
  C:\Windows\System\tqNziWY.exe
  2⤵
  PID:1696
- C:\Windows\System\OzQcpUf.exe
  C:\Windows\System\OzQcpUf.exe
  2⤵
  PID:4328
- C:\Windows\System\AkiBUxs.exe
  C:\Windows\System\AkiBUxs.exe
  2⤵
  PID:12244
- C:\Windows\System\wbAadRq.exe
  C:\Windows\System\wbAadRq.exe
  2⤵
  PID:8392
- C:\Windows\System\EcwUjJL.exe
  C:\Windows\System\EcwUjJL.exe
  2⤵
  PID:11156
- C:\Windows\System\wjqVlGx.exe
  C:\Windows\System\wjqVlGx.exe
  2⤵
  PID:13132
- C:\Windows\System\ddzuUJH.exe
  C:\Windows\System\ddzuUJH.exe
  2⤵
  PID:12580
- C:\Windows\System\qPntPTz.exe
  C:\Windows\System\qPntPTz.exe
  2⤵
  PID:9844
- C:\Windows\System\qDskmIj.exe
  C:\Windows\System\qDskmIj.exe
  2⤵
  PID:4644
- C:\Windows\System\bjPVBKt.exe
  C:\Windows\System\bjPVBKt.exe
  2⤵
  PID:9620
- C:\Windows\System\QrUWxCr.exe
  C:\Windows\System\QrUWxCr.exe
  2⤵
  PID:8984
- C:\Windows\System\KLTnkBU.exe
  C:\Windows\System\KLTnkBU.exe
  2⤵
  PID:3696
- C:\Windows\System\oaZbQYR.exe
  C:\Windows\System\oaZbQYR.exe
  2⤵
  PID:5760
- C:\Windows\System\flUeWjQ.exe
  C:\Windows\System\flUeWjQ.exe
  2⤵
  PID:11912
- C:\Windows\System\JhlrbXk.exe
  C:\Windows\System\JhlrbXk.exe
  2⤵
  PID:10408
- C:\Windows\System\erHrwBd.exe
  C:\Windows\System\erHrwBd.exe
  2⤵
  PID:11340
- C:\Windows\System\auiOOzj.exe
  C:\Windows\System\auiOOzj.exe
  2⤵
  PID:12416
- C:\Windows\System\CMEthjB.exe
  C:\Windows\System\CMEthjB.exe
  2⤵
  PID:13064
- C:\Windows\System\YaKadkN.exe
  C:\Windows\System\YaKadkN.exe
  2⤵
  PID:2180
- C:\Windows\System\ViHFpJr.exe
  C:\Windows\System\ViHFpJr.exe
  2⤵
  PID:11956
- C:\Windows\System\lOJPprB.exe
  C:\Windows\System\lOJPprB.exe
  2⤵
  PID:11284
- C:\Windows\System\jEXEXvo.exe
  C:\Windows\System\jEXEXvo.exe
  2⤵
  PID:9260
- C:\Windows\System\ydMtKck.exe
  C:\Windows\System\ydMtKck.exe
  2⤵
  PID:4948
- C:\Windows\System\MwEpGMi.exe
  C:\Windows\System\MwEpGMi.exe
  2⤵
  PID:4636
- C:\Windows\System\fCTGWRC.exe
  C:\Windows\System\fCTGWRC.exe
  2⤵
  PID:1524
- C:\Windows\System\kGbvHBU.exe
  C:\Windows\System\kGbvHBU.exe
  2⤵
  PID:4444
- C:\Windows\System\mTNNrIU.exe
  C:\Windows\System\mTNNrIU.exe
  2⤵
  PID:4260
- C:\Windows\System\jvbBlNA.exe
  C:\Windows\System\jvbBlNA.exe
  2⤵
  PID:8044
- C:\Windows\System\GnhigbD.exe
  C:\Windows\System\GnhigbD.exe
  2⤵
  PID:4880
- C:\Windows\System\oaQxLCp.exe
  C:\Windows\System\oaQxLCp.exe
  2⤵
  PID:13072
- C:\Windows\System\FANnonj.exe
  C:\Windows\System\FANnonj.exe
  2⤵
  PID:1800
- C:\Windows\System\rIPMfSN.exe
  C:\Windows\System\rIPMfSN.exe
  2⤵
  PID:12836
- C:\Windows\System\SxcVMRL.exe
  C:\Windows\System\SxcVMRL.exe
  2⤵
  PID:1496
- C:\Windows\System\hjctCnR.exe
  C:\Windows\System\hjctCnR.exe
  2⤵
  PID:12564
- C:\Windows\System\nmOZqkp.exe
  C:\Windows\System\nmOZqkp.exe
  2⤵
  PID:11960
- C:\Windows\System\GEjerGc.exe
  C:\Windows\System\GEjerGc.exe
  2⤵
  PID:3976
- C:\Windows\System\gXJSRCG.exe
  C:\Windows\System\gXJSRCG.exe
  2⤵
  PID:4552
- C:\Windows\System\vlgnAHY.exe
  C:\Windows\System\vlgnAHY.exe
  2⤵
  PID:7076
- C:\Windows\System\ZUqgquT.exe
  C:\Windows\System\ZUqgquT.exe
  2⤵
  PID:12680
- C:\Windows\System\JKEEjjC.exe
  C:\Windows\System\JKEEjjC.exe
  2⤵
  PID:3492
- C:\Windows\System\gKRPQrl.exe
  C:\Windows\System\gKRPQrl.exe
  2⤵
  PID:12068
- C:\Windows\System\sNgHvlw.exe
  C:\Windows\System\sNgHvlw.exe
  2⤵
  PID:3412
- C:\Windows\System\lWOSFOd.exe
  C:\Windows\System\lWOSFOd.exe
  2⤵
  PID:3532
- C:\Windows\System\pvOyKOk.exe
  C:\Windows\System\pvOyKOk.exe
  2⤵
  PID:4612
- C:\Windows\System\TuTlziZ.exe
  C:\Windows\System\TuTlziZ.exe
  2⤵
  PID:11620
- C:\Windows\System\cjxEklZ.exe
  C:\Windows\System\cjxEklZ.exe
  2⤵
  PID:11940
- C:\Windows\System\jSzzGfR.exe
  C:\Windows\System\jSzzGfR.exe
  2⤵
  PID:4056
- C:\Windows\System\yBIiIzb.exe
  C:\Windows\System\yBIiIzb.exe
  2⤵
  PID:1436
- C:\Windows\System\ONcKWuG.exe
  C:\Windows\System\ONcKWuG.exe
  2⤵
  PID:7820
- C:\Windows\System\zdUCSWH.exe
  C:\Windows\System\zdUCSWH.exe
  2⤵
  PID:1936
- C:\Windows\System\TJJxIVO.exe
  C:\Windows\System\TJJxIVO.exe
  2⤵
  PID:2424
- C:\Windows\System\EpeHhhQ.exe
  C:\Windows\System\EpeHhhQ.exe
  2⤵
  PID:3968
- C:\Windows\System\qmpVPcq.exe
  C:\Windows\System\qmpVPcq.exe
  2⤵
  PID:4428
- C:\Windows\System\HcegzVx.exe
  C:\Windows\System\HcegzVx.exe
  2⤵
  PID:11248
- C:\Windows\System\oWqqmJa.exe
  C:\Windows\System\oWqqmJa.exe
  2⤵
  PID:13328
- C:\Windows\System\AXEDLbp.exe
  C:\Windows\System\AXEDLbp.exe
  2⤵
  PID:13356
- C:\Windows\System\aqWtgwO.exe
  C:\Windows\System\aqWtgwO.exe
  2⤵
  PID:13376
- C:\Windows\System\aaneJdV.exe
  C:\Windows\System\aaneJdV.exe
  2⤵
  PID:13404
- C:\Windows\System\RpGKPEb.exe
  C:\Windows\System\RpGKPEb.exe
  2⤵
  PID:13428
- C:\Windows\System\YBaZDMN.exe
  C:\Windows\System\YBaZDMN.exe
  2⤵
  PID:13456
- C:\Windows\System\yruvJTz.exe
  C:\Windows\System\yruvJTz.exe
  2⤵
  PID:13488
- C:\Windows\System\CVMIvWe.exe
  C:\Windows\System\CVMIvWe.exe
  2⤵
  PID:13512
- C:\Windows\System\lasQSNo.exe
  C:\Windows\System\lasQSNo.exe
  2⤵
  PID:13532
- C:\Windows\System\BSveoZI.exe
  C:\Windows\System\BSveoZI.exe
  2⤵
  PID:13556
- C:\Windows\System\IYWTffz.exe
  C:\Windows\System\IYWTffz.exe
  2⤵
  PID:13576
- C:\Windows\System\GvnvBPm.exe
  C:\Windows\System\GvnvBPm.exe
  2⤵
  PID:13604
- C:\Windows\System\HHgalNQ.exe
  C:\Windows\System\HHgalNQ.exe
  2⤵
  PID:13628
- C:\Windows\System\npqiRir.exe
  C:\Windows\System\npqiRir.exe
  2⤵
  PID:13652
- C:\Windows\System\ayrElFq.exe
  C:\Windows\System\ayrElFq.exe
  2⤵
  PID:13816
- C:\Windows\System\xBLecmD.exe
  C:\Windows\System\xBLecmD.exe
  2⤵
  PID:13876
- C:\Windows\System\ayCLaKU.exe
  C:\Windows\System\ayCLaKU.exe
  2⤵
  PID:13972
- C:\Windows\System\Wqkyfdr.exe
  C:\Windows\System\Wqkyfdr.exe
  2⤵
  PID:14020
- C:\Windows\System\hSlnKtn.exe
  C:\Windows\System\hSlnKtn.exe
  2⤵
  PID:14052
- C:\Windows\System\jimycjZ.exe
  C:\Windows\System\jimycjZ.exe
  2⤵
  PID:14316
- C:\Windows\System\hAUfsij.exe
  C:\Windows\System\hAUfsij.exe
  2⤵
  PID:13860
- C:\Windows\System\cFaCIuV.exe
  C:\Windows\System\cFaCIuV.exe
  2⤵
  PID:13968
- C:\Windows\System\IhzGMMN.exe
  C:\Windows\System\IhzGMMN.exe
  2⤵
  PID:14008
- C:\Windows\System\IiiHHwK.exe
  C:\Windows\System\IiiHHwK.exe
  2⤵
  PID:13712
- C:\Windows\System\oKVLMZw.exe
  C:\Windows\System\oKVLMZw.exe
  2⤵
  PID:10888
- C:\Windows\System\ORXaDQf.exe
  C:\Windows\System\ORXaDQf.exe
  2⤵
  PID:3912
- C:\Windows\System\JBEocsl.exe
  C:\Windows\System\JBEocsl.exe
  2⤵
  PID:14148
- C:\Windows\System\TjSFKmu.exe
  C:\Windows\System\TjSFKmu.exe
  2⤵
  PID:14112
- C:\Windows\System\KbcNujW.exe
  C:\Windows\System\KbcNujW.exe
  2⤵
  PID:14172
- C:\Windows\System\eFqgYdq.exe
  C:\Windows\System\eFqgYdq.exe
  2⤵
  PID:14208
- C:\Windows\System\fkBfqNN.exe
  C:\Windows\System\fkBfqNN.exe
  2⤵
  PID:14228
- C:\Windows\System\HCclPYx.exe
  C:\Windows\System\HCclPYx.exe
  2⤵
  PID:1536
- C:\Windows\System\YmwnGxr.exe
  C:\Windows\System\YmwnGxr.exe
  2⤵
  PID:4788
- C:\Windows\System\xVcPGhN.exe
  C:\Windows\System\xVcPGhN.exe
  2⤵
  PID:14256
- C:\Windows\System\bDZatqu.exe
  C:\Windows\System\bDZatqu.exe
  2⤵
  PID:14284
- C:\Windows\System\dAqXLTG.exe
  C:\Windows\System\dAqXLTG.exe
  2⤵
  PID:14296
- C:\Windows\System\AFqZtvn.exe
  C:\Windows\System\AFqZtvn.exe
  2⤵
  PID:10580
- C:\Windows\System\tYdGUfw.exe
  C:\Windows\System\tYdGUfw.exe
  2⤵
  PID:13316
- C:\Windows\System\yqlhDVY.exe
  C:\Windows\System\yqlhDVY.exe
  2⤵
  PID:13368
- C:\Windows\System\eiihGJd.exe
  C:\Windows\System\eiihGJd.exe
  2⤵
  PID:3028
- C:\Windows\System\saOjSHf.exe
  C:\Windows\System\saOjSHf.exe
  2⤵
  PID:7160
- C:\Windows\System\kAdPsJO.exe
  C:\Windows\System\kAdPsJO.exe
  2⤵
  PID:13400
- C:\Windows\System\JYFiNwH.exe
  C:\Windows\System\JYFiNwH.exe
  2⤵
  PID:3340
- C:\Windows\System\gdSKeLJ.exe
  C:\Windows\System\gdSKeLJ.exe
  2⤵
  PID:13676
- C:\Windows\System\fycQlZM.exe
  C:\Windows\System\fycQlZM.exe
  2⤵
  PID:13716
- C:\Windows\System\SIlXTJx.exe
  C:\Windows\System\SIlXTJx.exe
  2⤵
  PID:13784
- C:\Windows\System\xrLrpAG.exe
  C:\Windows\System\xrLrpAG.exe
  2⤵
  PID:13772
- C:\Windows\System\oKgXkRA.exe
  C:\Windows\System\oKgXkRA.exe
  2⤵
  PID:13792
- C:\Windows\System\IQnSnMz.exe
  C:\Windows\System\IQnSnMz.exe
  2⤵
  PID:13704
- C:\Windows\System\kxJLQmD.exe
  C:\Windows\System\kxJLQmD.exe
  2⤵
  PID:13832
- C:\Windows\System\tgrAvYs.exe
  C:\Windows\System\tgrAvYs.exe
  2⤵
  PID:1632
- C:\Windows\System\zNQOVwf.exe
  C:\Windows\System\zNQOVwf.exe
  2⤵
  PID:13892
- C:\Windows\System\TBOYIbD.exe
  C:\Windows\System\TBOYIbD.exe
  2⤵
  PID:13808
- C:\Windows\System\LVQlTuA.exe
  C:\Windows\System\LVQlTuA.exe
  2⤵
  PID:3384
- C:\Windows\System\LVIvAvi.exe
  C:\Windows\System\LVIvAvi.exe
  2⤵
  PID:14000
- C:\Windows\System\yYPpSwk.exe
  C:\Windows\System\yYPpSwk.exe
  2⤵
  PID:10752
- C:\Windows\System\nyrEwtN.exe
  C:\Windows\System\nyrEwtN.exe
  2⤵
  PID:4316
- C:\Windows\System\FArAlkB.exe
  C:\Windows\System\FArAlkB.exe
  2⤵
  PID:2600
- C:\Windows\System\kDiIPMu.exe
  C:\Windows\System\kDiIPMu.exe
  2⤵
  PID:4352
- C:\Windows\System\ZGdekqn.exe
  C:\Windows\System\ZGdekqn.exe
  2⤵
  PID:12612
- C:\Windows\System\BEaWLet.exe
  C:\Windows\System\BEaWLet.exe
  2⤵
  PID:14312
- C:\Windows\System\drKbEoj.exe
  C:\Windows\System\drKbEoj.exe
  2⤵
  PID:2468
- C:\Windows\System\IVmbwmA.exe
  C:\Windows\System\IVmbwmA.exe
  2⤵
  PID:13616
- C:\Windows\System\mfElrfr.exe
  C:\Windows\System\mfElrfr.exe
  2⤵
  PID:13748
- C:\Windows\System\hiLLaFT.exe
  C:\Windows\System\hiLLaFT.exe
  2⤵
  PID:13788
- C:\Windows\System\zBhPzqR.exe
  C:\Windows\System\zBhPzqR.exe
  2⤵
  PID:13904
- C:\Windows\System\vgsZzrF.exe
  C:\Windows\System\vgsZzrF.exe
  2⤵
  PID:13984
- C:\Windows\System\FtEixMK.exe
  C:\Windows\System\FtEixMK.exe
  2⤵
  PID:14164
- C:\Windows\System\MyMrKfk.exe
  C:\Windows\System\MyMrKfk.exe
  2⤵
  PID:14180
- C:\Windows\System\CpxUecS.exe
  C:\Windows\System\CpxUecS.exe
  2⤵
  PID:1408
- C:\Windows\System\pVKZJMG.exe
  C:\Windows\System\pVKZJMG.exe
  2⤵
  PID:14076
- C:\Windows\System\dVmOXND.exe
  C:\Windows\System\dVmOXND.exe
  2⤵
  PID:14324
- C:\Windows\System\ywqVDgN.exe
  C:\Windows\System\ywqVDgN.exe
  2⤵
  PID:14276
- C:\Windows\System\iGVxVuU.exe
  C:\Windows\System\iGVxVuU.exe
  2⤵
  PID:1648
- C:\Windows\System\FvyigIK.exe
  C:\Windows\System\FvyigIK.exe
  2⤵
  PID:3600
- C:\Windows\System\nrYPYun.exe
  C:\Windows\System\nrYPYun.exe
  2⤵
  PID:2964
- C:\Windows\System\aYLarvq.exe
  C:\Windows\System\aYLarvq.exe
  2⤵
  PID:5252
- C:\Windows\System\bdsGrCm.exe
  C:\Windows\System\bdsGrCm.exe
  2⤵
  PID:13344
- C:\Windows\System\lbSymcB.exe
  C:\Windows\System\lbSymcB.exe
  2⤵
  PID:3512
- C:\Windows\System\ZHUihGt.exe
  C:\Windows\System\ZHUihGt.exe
  2⤵
  PID:5244
- C:\Windows\System\lhPgeGw.exe
  C:\Windows\System\lhPgeGw.exe
  2⤵
  PID:13444
- C:\Windows\System\tyUoQku.exe
  C:\Windows\System\tyUoQku.exe
  2⤵
  PID:5540
- C:\Windows\System\WxGeIBQ.exe
  C:\Windows\System\WxGeIBQ.exe
  2⤵
  PID:13524
- C:\Windows\System\ZYCYUJI.exe
  C:\Windows\System\ZYCYUJI.exe
  2⤵
  PID:5812
- C:\Windows\System\PQgwKaJ.exe
  C:\Windows\System\PQgwKaJ.exe
  2⤵
  PID:400
- C:\Windows\System\nxcsbwW.exe
  C:\Windows\System\nxcsbwW.exe
  2⤵
  PID:5376
- C:\Windows\System\cJHuWPI.exe
  C:\Windows\System\cJHuWPI.exe
  2⤵
  PID:5836
- C:\Windows\System\RyJAoCj.exe
  C:\Windows\System\RyJAoCj.exe
  2⤵
  PID:3760
- C:\Windows\System\izKDUNM.exe
  C:\Windows\System\izKDUNM.exe
  2⤵
  PID:1560
- C:\Windows\System\GvjMmDe.exe
  C:\Windows\System\GvjMmDe.exe
  2⤵
  PID:5028
- C:\Windows\System\qCiNjrJ.exe
  C:\Windows\System\qCiNjrJ.exe
  2⤵
  PID:14100
- C:\Windows\System\HMrBpMa.exe
  C:\Windows\System\HMrBpMa.exe
  2⤵
  PID:14196
- C:\Windows\System\IDQbdoT.exe
  C:\Windows\System\IDQbdoT.exe
  2⤵
  PID:13640
- C:\Windows\System\akoszZU.exe
  C:\Windows\System\akoszZU.exe
  2⤵
  PID:5236
- C:\Windows\System\SSlYsrs.exe
  C:\Windows\System\SSlYsrs.exe
  2⤵
  PID:4396
- C:\Windows\System\XMKbEPc.exe
  C:\Windows\System\XMKbEPc.exe
  2⤵
  PID:2732
- C:\Windows\System\hiGPSba.exe
  C:\Windows\System\hiGPSba.exe
  2⤵
  PID:5780
- C:\Windows\System\JgZnxuI.exe
  C:\Windows\System\JgZnxuI.exe
  2⤵
  PID:9980
- C:\Windows\System\STrBnDB.exe
  C:\Windows\System\STrBnDB.exe
  2⤵
  PID:1868
- C:\Windows\System\SZTUrIL.exe
  C:\Windows\System\SZTUrIL.exe
  2⤵
  PID:5828
- C:\Windows\System\WOTvSKV.exe
  C:\Windows\System\WOTvSKV.exe
  2⤵
  PID:6976
- C:\Windows\System\XnVFLMt.exe
  C:\Windows\System\XnVFLMt.exe
  2⤵
  PID:5808
- C:\Windows\System\qmKkUMk.exe
  C:\Windows\System\qmKkUMk.exe
  2⤵
  PID:6088
- C:\Windows\System\xoHAeqY.exe
  C:\Windows\System\xoHAeqY.exe
  2⤵
  PID:13916
- C:\Windows\System\OrZuOcj.exe
  C:\Windows\System\OrZuOcj.exe
  2⤵
  PID:5240
- C:\Windows\System\zRLaTea.exe
  C:\Windows\System\zRLaTea.exe
  2⤵
  PID:5660
- C:\Windows\System\PsyPeQB.exe
  C:\Windows\System\PsyPeQB.exe
  2⤵
  PID:5832
- C:\Windows\System\xoXngoR.exe
  C:\Windows\System\xoXngoR.exe
  2⤵
  PID:14004
- C:\Windows\System\GqwVchT.exe
  C:\Windows\System\GqwVchT.exe
  2⤵
  PID:5924
- C:\Windows\System\ioXtObm.exe
  C:\Windows\System\ioXtObm.exe
  2⤵
  PID:5884
- C:\Windows\System\tNYqfax.exe
  C:\Windows\System\tNYqfax.exe
  2⤵
  PID:3456
- C:\Windows\System\VjONrZO.exe
  C:\Windows\System\VjONrZO.exe
  2⤵
  PID:6724
- C:\Windows\System\aZnPsoK.exe
  C:\Windows\System\aZnPsoK.exe
  2⤵
  PID:5228
- C:\Windows\System\CqzxzNx.exe
  C:\Windows\System\CqzxzNx.exe
  2⤵
  PID:5516
- C:\Windows\System\EnlxzaS.exe
  C:\Windows\System\EnlxzaS.exe
  2⤵
  PID:6752
- C:\Windows\System\saDSueJ.exe
  C:\Windows\System\saDSueJ.exe
  2⤵
  PID:2300
- C:\Windows\System\WOwReHG.exe
  C:\Windows\System\WOwReHG.exe
  2⤵
  PID:6016
- C:\Windows\System\qopxMjR.exe
  C:\Windows\System\qopxMjR.exe
  2⤵
  PID:5848
- C:\Windows\System\MmhIqmZ.exe
  C:\Windows\System\MmhIqmZ.exe
  2⤵
  PID:5232
- C:\Windows\System\obMMMAk.exe
  C:\Windows\System\obMMMAk.exe
  2⤵
  PID:5952
- C:\Windows\System\ltbrWhs.exe
  C:\Windows\System\ltbrWhs.exe
  2⤵
  PID:6680
- C:\Windows\System\lOQEfTC.exe
  C:\Windows\System\lOQEfTC.exe
  2⤵
  PID:6784
- C:\Windows\System\vhMHjDH.exe
  C:\Windows\System\vhMHjDH.exe
  2⤵
  PID:6544
- C:\Windows\System\ayEKOyC.exe
  C:\Windows\System\ayEKOyC.exe
  2⤵
  PID:13700
- C:\Windows\System\NGLBMoj.exe
  C:\Windows\System\NGLBMoj.exe
  2⤵
  PID:4668
- C:\Windows\System\uAfWMfl.exe
  C:\Windows\System\uAfWMfl.exe
  2⤵
  PID:5840
- C:\Windows\System\RupGtae.exe
  C:\Windows\System\RupGtae.exe
  2⤵
  PID:5928
- C:\Windows\System\EhgZtUI.exe
  C:\Windows\System\EhgZtUI.exe
  2⤵
  PID:6812
- C:\Windows\System\MrFybAl.exe
  C:\Windows\System\MrFybAl.exe
  2⤵
  PID:13504
- C:\Windows\System\RqfpWsK.exe
  C:\Windows\System\RqfpWsK.exe
  2⤵
  PID:14348
- C:\Windows\System\RlNqQxr.exe
  C:\Windows\System\RlNqQxr.exe
  2⤵
  PID:14444
- C:\Windows\System\mjKvoxK.exe
  C:\Windows\System\mjKvoxK.exe
  2⤵
  PID:14468
- C:\Windows\System\loJkEEl.exe
  C:\Windows\System\loJkEEl.exe
  2⤵
  PID:14492
- C:\Windows\System\ftQvewQ.exe
  C:\Windows\System\ftQvewQ.exe
  2⤵
  PID:14568
- C:\Windows\System\uqdUthV.exe
  C:\Windows\System\uqdUthV.exe
  2⤵
  PID:14596
- C:\Windows\System\CSzScUI.exe
  C:\Windows\System\CSzScUI.exe
  2⤵
  PID:14620
- C:\Windows\System\gfyUoaP.exe
  C:\Windows\System\gfyUoaP.exe
  2⤵
  PID:14672
- C:\Windows\System\tKpnCrt.exe
  C:\Windows\System\tKpnCrt.exe
  2⤵
  PID:14728
- C:\Windows\System\fzkxwZJ.exe
  C:\Windows\System\fzkxwZJ.exe
  2⤵
  PID:14764
- C:\Windows\System\MWKhQLf.exe
  C:\Windows\System\MWKhQLf.exe
  2⤵
  PID:14788
- C:\Windows\System\lrJCuSA.exe
  C:\Windows\System\lrJCuSA.exe
  2⤵
  PID:14804
- C:\Windows\System\FJpYIyT.exe
  C:\Windows\System\FJpYIyT.exe
  2⤵
  PID:14832
- C:\Windows\System\hFJsWsq.exe
  C:\Windows\System\hFJsWsq.exe
  2⤵
  PID:14876
- C:\Windows\System\fxNoKUL.exe
  C:\Windows\System\fxNoKUL.exe
  2⤵
  PID:14900
- C:\Windows\System\TwFyTrw.exe
  C:\Windows\System\TwFyTrw.exe
  2⤵
  PID:14916
- C:\Windows\System\KFyrKPf.exe
  C:\Windows\System\KFyrKPf.exe
  2⤵
  PID:14948
- C:\Windows\System\RNgKCQZ.exe
  C:\Windows\System\RNgKCQZ.exe
  2⤵
  PID:14968
- C:\Windows\System\GQlWuuL.exe
  C:\Windows\System\GQlWuuL.exe
  2⤵
  PID:14996
- C:\Windows\System\dwaXZyi.exe
  C:\Windows\System\dwaXZyi.exe
  2⤵
  PID:15012
- C:\Windows\System\BsuDrGF.exe
  C:\Windows\System\BsuDrGF.exe
  2⤵
  PID:15032
- C:\Windows\System\WyNwcmt.exe
  C:\Windows\System\WyNwcmt.exe
  2⤵
  PID:15064
- C:\Windows\System\lvocFaT.exe
  C:\Windows\System\lvocFaT.exe
  2⤵
  PID:15092
- C:\Windows\System\ExZVKao.exe
  C:\Windows\System\ExZVKao.exe
  2⤵
  PID:15120
- C:\Windows\System\HpTeDNj.exe
  C:\Windows\System\HpTeDNj.exe
  2⤵
  PID:15144
- C:\Windows\System\aArKHJa.exe
  C:\Windows\System\aArKHJa.exe
  2⤵
  PID:15260
- C:\Windows\System\jZyUJkw.exe
  C:\Windows\System\jZyUJkw.exe
  2⤵
  PID:15280
- C:\Windows\System\HWIVaNf.exe
  C:\Windows\System\HWIVaNf.exe
  2⤵
  PID:15316
- C:\Windows\System\aNlcKbs.exe
  C:\Windows\System\aNlcKbs.exe
  2⤵
  PID:15348
- C:\Windows\System\FBPVdJI.exe
  C:\Windows\System\FBPVdJI.exe
  2⤵
  PID:13564
- C:\Windows\System\UEFeOQe.exe
  C:\Windows\System\UEFeOQe.exe
  2⤵
  PID:14384
- C:\Windows\System\NvyZsOj.exe
  C:\Windows\System\NvyZsOj.exe
  2⤵
  PID:14108
- C:\Windows\System\cakbibn.exe
  C:\Windows\System\cakbibn.exe
  2⤵
  PID:14344
- C:\Windows\System\jymFFdV.exe
  C:\Windows\System\jymFFdV.exe
  2⤵
  PID:224
- C:\Windows\System\YzypyEB.exe
  C:\Windows\System\YzypyEB.exe
  2⤵
  PID:14412
- C:\Windows\System\iCIwQvR.exe
  C:\Windows\System\iCIwQvR.exe
  2⤵
  PID:3664
- C:\Windows\System\ULKzjME.exe
  C:\Windows\System\ULKzjME.exe
  2⤵
  PID:6780
- C:\Windows\System\psJdmhF.exe
  C:\Windows\System\psJdmhF.exe
  2⤵
  PID:13900
- C:\Windows\System\DjbxVaf.exe
  C:\Windows\System\DjbxVaf.exe
  2⤵
  PID:14512
- C:\Windows\System\bTMECgj.exe
  C:\Windows\System\bTMECgj.exe
  2⤵
  PID:14504
- C:\Windows\System\wpFTbHD.exe
  C:\Windows\System\wpFTbHD.exe
  2⤵
  PID:7148
- C:\Windows\System\ftpzKvX.exe
  C:\Windows\System\ftpzKvX.exe
  2⤵
  PID:14656
- C:\Windows\System\zsepuou.exe
  C:\Windows\System\zsepuou.exe
  2⤵
  PID:7072
- C:\Windows\System\cSfWecW.exe
  C:\Windows\System\cSfWecW.exe
  2⤵
  PID:14664
- C:\Windows\System\gRmIKuO.exe
  C:\Windows\System\gRmIKuO.exe
  2⤵
  PID:14724
- C:\Windows\System\kqDhhqA.exe
  C:\Windows\System\kqDhhqA.exe
  2⤵
  PID:6704
- C:\Windows\System\vMgOiEX.exe
  C:\Windows\System\vMgOiEX.exe
  2⤵
  PID:2376
- C:\Windows\System\xOFjDUr.exe
  C:\Windows\System\xOFjDUr.exe
  2⤵
  PID:6120
- C:\Windows\System\NOwSOMJ.exe
  C:\Windows\System\NOwSOMJ.exe
  2⤵
  PID:6540
- C:\Windows\System\HxDawvl.exe
  C:\Windows\System\HxDawvl.exe
  2⤵
  PID:14956
- C:\Windows\System\VNTCqAm.exe
  C:\Windows\System\VNTCqAm.exe
  2⤵
  PID:5576
- C:\Windows\System\gOBetDE.exe
  C:\Windows\System\gOBetDE.exe
  2⤵
  PID:14844
- C:\Windows\System\dvKByYk.exe
  C:\Windows\System\dvKByYk.exe
  2⤵
  PID:15052
- C:\Windows\System\YSNdJJm.exe
  C:\Windows\System\YSNdJJm.exe
  2⤵
  PID:2648
- C:\Windows\System\pSbKYQe.exe
  C:\Windows\System\pSbKYQe.exe
  2⤵
  PID:7108
- C:\Windows\System\vOlrDsq.exe
  C:\Windows\System\vOlrDsq.exe
  2⤵
  PID:15248
- C:\Windows\System\qQoZQzW.exe
  C:\Windows\System\qQoZQzW.exe
  2⤵
  PID:7140
- C:\Windows\System\cftAINf.exe
  C:\Windows\System\cftAINf.exe
  2⤵
  PID:15304
- C:\Windows\System\BSryJSl.exe
  C:\Windows\System\BSryJSl.exe
  2⤵
  PID:4080
- C:\Windows\System\hrBgBVB.exe
  C:\Windows\System\hrBgBVB.exe
  2⤵
  PID:14340
- C:\Windows\System\WJGzXQN.exe
  C:\Windows\System\WJGzXQN.exe
  2⤵
  PID:6880
- C:\Windows\System\TkkbDlH.exe
  C:\Windows\System\TkkbDlH.exe
  2⤵
  PID:12816
- C:\Windows\System\LFfQXoS.exe
  C:\Windows\System\LFfQXoS.exe
  2⤵
  PID:14268
- C:\Windows\System\oKHezRX.exe
  C:\Windows\System\oKHezRX.exe
  2⤵
  PID:14604
- C:\Windows\System\DXmTXsV.exe
  C:\Windows\System\DXmTXsV.exe
  2⤵
  PID:6896
- C:\Windows\System\QZeoXBu.exe
  C:\Windows\System\QZeoXBu.exe
  2⤵
  PID:5400
- C:\Windows\System\fayvzcr.exe
  C:\Windows\System\fayvzcr.exe
  2⤵
  PID:14640
- C:\Windows\System\hyqMHVe.exe
  C:\Windows\System\hyqMHVe.exe
  2⤵
  PID:6916
- C:\Windows\System\JMmIgfO.exe
  C:\Windows\System\JMmIgfO.exe
  2⤵
  PID:14928
- C:\Windows\System\MlVrAbB.exe
  C:\Windows\System\MlVrAbB.exe
  2⤵
  PID:15008
- C:\Windows\System\DqrbHcW.exe
  C:\Windows\System\DqrbHcW.exe
  2⤵
  PID:14940
- C:\Windows\System\tiIFdZj.exe
  C:\Windows\System\tiIFdZj.exe
  2⤵
  PID:14856
- C:\Windows\System\qpaibzn.exe
  C:\Windows\System\qpaibzn.exe
  2⤵
  PID:5560
- C:\Windows\System\dGLNlQf.exe
  C:\Windows\System\dGLNlQf.exe
  2⤵
  PID:7420
- C:\Windows\System\XJCzSpc.exe
  C:\Windows\System\XJCzSpc.exe
  2⤵
  PID:15200
- C:\Windows\System\tSFdTUl.exe
  C:\Windows\System\tSFdTUl.exe
  2⤵
  PID:7044
- C:\Windows\System\COrmcHf.exe
  C:\Windows\System\COrmcHf.exe
  2⤵
  PID:15152
- C:\Windows\System\KZlBXhA.exe
  C:\Windows\System\KZlBXhA.exe
  2⤵
  PID:15136
- C:\Windows\System\VNXodCZ.exe
  C:\Windows\System\VNXodCZ.exe
  2⤵
  PID:6216
- C:\Windows\System\gggPEYB.exe
  C:\Windows\System\gggPEYB.exe
  2⤵
  PID:15188
- C:\Windows\System\uwwqTvP.exe
  C:\Windows\System\uwwqTvP.exe
  2⤵
  PID:6252
- C:\Windows\System\muAufNm.exe
  C:\Windows\System\muAufNm.exe
  2⤵
  PID:3032
- C:\Windows\System\KMVButV.exe
  C:\Windows\System\KMVButV.exe
  2⤵
  PID:7144
- C:\Windows\System\LDRtCtl.exe
  C:\Windows\System\LDRtCtl.exe
  2⤵
  PID:5380
- C:\Windows\System\zLmntQh.exe
  C:\Windows\System\zLmntQh.exe
  2⤵
  PID:14440
- C:\Windows\System\byaxRxU.exe
  C:\Windows\System\byaxRxU.exe
  2⤵
  PID:15104
- C:\Windows\System\MBmPmDp.exe
  C:\Windows\System\MBmPmDp.exe
  2⤵
  PID:5404
- C:\Windows\System\zqiKKdh.exe
  C:\Windows\System\zqiKKdh.exe
  2⤵
  PID:3604
- C:\Windows\System\XjgjXHf.exe
  C:\Windows\System\XjgjXHf.exe
  2⤵
  PID:14372
- C:\Windows\System\ltMGhwC.exe
  C:\Windows\System\ltMGhwC.exe
  2⤵
  PID:5448
- C:\Windows\System\HiDtnSa.exe
  C:\Windows\System\HiDtnSa.exe
  2⤵
  PID:6660
- C:\Windows\System\ozrQMlC.exe
  C:\Windows\System\ozrQMlC.exe
  2⤵
  PID:7396
- C:\Windows\System\hPWlqyw.exe
  C:\Windows\System\hPWlqyw.exe
  2⤵
  PID:6432
- C:\Windows\System\zAaUTPu.exe
  C:\Windows\System\zAaUTPu.exe
  2⤵
  PID:8232
- C:\Windows\System\lJGvSgX.exe
  C:\Windows\System\lJGvSgX.exe
  2⤵
  PID:14752
- C:\Windows\System\HJkSOrD.exe
  C:\Windows\System\HJkSOrD.exe
  2⤵
  PID:14828
- C:\Windows\System\tQGNvii.exe
  C:\Windows\System\tQGNvii.exe
  2⤵
  PID:14740
- C:\Windows\System\dsYUTvx.exe
  C:\Windows\System\dsYUTvx.exe
  2⤵
  PID:15208
- C:\Windows\System\OPVxfAm.exe
  C:\Windows\System\OPVxfAm.exe
  2⤵
  PID:6884
- C:\Windows\System\szGyZFw.exe
  C:\Windows\System\szGyZFw.exe
  2⤵
  PID:6856
- C:\Windows\System\Ahhukja.exe
  C:\Windows\System\Ahhukja.exe
  2⤵
  PID:5424
- C:\Windows\System\mCHbpSc.exe
  C:\Windows\System\mCHbpSc.exe
  2⤵
  PID:8592
- C:\Windows\System\MGiTHkw.exe
  C:\Windows\System\MGiTHkw.exe
  2⤵
  PID:7544
- C:\Windows\System\hOhnykq.exe
  C:\Windows\System\hOhnykq.exe
  2⤵
  PID:2340
- C:\Windows\System\DXyYKKw.exe
  C:\Windows\System\DXyYKKw.exe
  2⤵
  PID:7500
- C:\Windows\System\AJjvLLO.exe
  C:\Windows\System\AJjvLLO.exe
  2⤵
  PID:7832
- C:\Windows\System\rBXCXcA.exe
  C:\Windows\System\rBXCXcA.exe
  2⤵
  PID:8804
- C:\Windows\System\mAbosWy.exe
  C:\Windows\System\mAbosWy.exe
  2⤵
  PID:15076
- C:\Windows\System\AZHcAHA.exe
  C:\Windows\System\AZHcAHA.exe
  2⤵
  PID:6888
- C:\Windows\System\qMMBZYS.exe
  C:\Windows\System\qMMBZYS.exe
  2⤵
  PID:6904
- C:\Windows\System\lLElJNT.exe
  C:\Windows\System\lLElJNT.exe
  2⤵
  PID:7736
- C:\Windows\System\bFXlhaO.exe
  C:\Windows\System\bFXlhaO.exe
  2⤵
  PID:7504
- C:\Windows\System\SgZjJpf.exe
  C:\Windows\System\SgZjJpf.exe
  2⤵
  PID:6908
- C:\Windows\System\XJJXKqh.exe
  C:\Windows\System\XJJXKqh.exe
  2⤵
  PID:8524
- C:\Windows\System\lUfTtKf.exe
  C:\Windows\System\lUfTtKf.exe
  2⤵
  PID:6748
- C:\Windows\System\RzaUDMC.exe
  C:\Windows\System\RzaUDMC.exe
  2⤵
  PID:6640
- C:\Windows\System\kccLazR.exe
  C:\Windows\System\kccLazR.exe
  2⤵
  PID:6848
- C:\Windows\System\TXixZHa.exe
  C:\Windows\System\TXixZHa.exe
  2⤵
  PID:5968
- C:\Windows\System\roywIhs.exe
  C:\Windows\System\roywIhs.exe
  2⤵
  PID:7908
- C:\Windows\System\qEDzIwv.exe
  C:\Windows\System\qEDzIwv.exe
  2⤵
  PID:8584
- C:\Windows\System\IlAtCjo.exe
  C:\Windows\System\IlAtCjo.exe
  2⤵
  PID:8464
- C:\Windows\System\DtBPPry.exe
  C:\Windows\System\DtBPPry.exe
  2⤵
  PID:5716
- C:\Windows\System\fSHadar.exe
  C:\Windows\System\fSHadar.exe
  2⤵
  PID:8504
- C:\Windows\System\vZFPuvR.exe
  C:\Windows\System\vZFPuvR.exe
  2⤵
  PID:15220
- C:\Windows\System\IzrzCMH.exe
  C:\Windows\System\IzrzCMH.exe
  2⤵
  PID:6212
- C:\Windows\System\mVMABSF.exe
  C:\Windows\System\mVMABSF.exe
  2⤵
  PID:6192
- C:\Windows\System\JTMLfnC.exe
  C:\Windows\System\JTMLfnC.exe
  2⤵
  PID:8808
- C:\Windows\System\QCPaBxQ.exe
  C:\Windows\System\QCPaBxQ.exe
  2⤵
  PID:7120
- C:\Windows\System\DzaIIMu.exe
  C:\Windows\System\DzaIIMu.exe
  2⤵
  PID:9720
- C:\Windows\System\WUwwgJM.exe
  C:\Windows\System\WUwwgJM.exe
  2⤵
  PID:7728
- C:\Windows\System\qPWKFQZ.exe
  C:\Windows\System\qPWKFQZ.exe
  2⤵
  PID:7384
- C:\Windows\System\xOCOCgH.exe
  C:\Windows\System\xOCOCgH.exe
  2⤵
  PID:7152
- C:\Windows\System\UHrXcik.exe
  C:\Windows\System\UHrXcik.exe
  2⤵
  PID:8520
- C:\Windows\System\EjWOpOy.exe
  C:\Windows\System\EjWOpOy.exe
  2⤵
  PID:15192
- C:\Windows\System\dBZIUVu.exe
  C:\Windows\System\dBZIUVu.exe
  2⤵
  PID:14796
- C:\Windows\System\RNfbReT.exe
  C:\Windows\System\RNfbReT.exe
  2⤵
  PID:8388
- C:\Windows\System\hylXUbK.exe
  C:\Windows\System\hylXUbK.exe
  2⤵
  PID:8824
- C:\Windows\System\AVcIUAQ.exe
  C:\Windows\System\AVcIUAQ.exe
  2⤵
  PID:1368
- C:\Windows\System\DWwqKlm.exe
  C:\Windows\System\DWwqKlm.exe
  2⤵
  PID:9480
- C:\Windows\System\NStuoKJ.exe
  C:\Windows\System\NStuoKJ.exe
  2⤵
  PID:8544
- C:\Windows\System\zjInEzr.exe
  C:\Windows\System\zjInEzr.exe
  2⤵
  PID:5564
- C:\Windows\System\LXiNfoG.exe
  C:\Windows\System\LXiNfoG.exe
  2⤵
  PID:9840
- C:\Windows\System\vBLrZLu.exe
  C:\Windows\System\vBLrZLu.exe
  2⤵
  PID:9884
- C:\Windows\System\xDwnTFk.exe
  C:\Windows\System\xDwnTFk.exe
  2⤵
  PID:8784
- C:\Windows\System\xMHVoFq.exe
  C:\Windows\System\xMHVoFq.exe
  2⤵
  PID:9588
- C:\Windows\System\rjXTiUq.exe
  C:\Windows\System\rjXTiUq.exe
  2⤵
  PID:9236
- C:\Windows\System\dQCPLuL.exe
  C:\Windows\System\dQCPLuL.exe
  2⤵
  PID:10140
- C:\Windows\System\fUuqNwu.exe
  C:\Windows\System\fUuqNwu.exe
  2⤵
  PID:9072
- C:\Windows\System\ysklbBU.exe
  C:\Windows\System\ysklbBU.exe
  2⤵
  PID:8852
- C:\Windows\System\xZjqqbr.exe
  C:\Windows\System\xZjqqbr.exe
  2⤵
  PID:9000
- C:\Windows\System\RmXJgTi.exe
  C:\Windows\System\RmXJgTi.exe
  2⤵
  PID:10692
- C:\Windows\System\yFVDlat.exe
  C:\Windows\System\yFVDlat.exe
  2⤵
  PID:8828
- C:\Windows\System\whzwtoC.exe
  C:\Windows\System\whzwtoC.exe
  2⤵
  PID:10704
- C:\Windows\System\xEpWWkA.exe
  C:\Windows\System\xEpWWkA.exe
  2⤵
  PID:7216
- C:\Windows\System\MLpNeVK.exe
  C:\Windows\System\MLpNeVK.exe
  2⤵
  PID:7292
- C:\Windows\System\VKpFivW.exe
  C:\Windows\System\VKpFivW.exe
  2⤵
  PID:8416
- C:\Windows\System\meOGxEc.exe
  C:\Windows\System\meOGxEc.exe
  2⤵
  PID:9516
- C:\Windows\System\TTcMIbx.exe
  C:\Windows\System\TTcMIbx.exe
  2⤵
  PID:8552
- C:\Windows\System\xsmXHcg.exe
  C:\Windows\System\xsmXHcg.exe
  2⤵
  PID:8612
- C:\Windows\System\ErKRcFz.exe
  C:\Windows\System\ErKRcFz.exe
  2⤵
  PID:6940
- C:\Windows\System\oOhwmev.exe
  C:\Windows\System\oOhwmev.exe
  2⤵
  PID:8856
- C:\Windows\System\oSaRRzb.exe
  C:\Windows\System\oSaRRzb.exe
  2⤵
  PID:9440
- C:\Windows\System\wybJdYM.exe
  C:\Windows\System\wybJdYM.exe
  2⤵
  PID:8812
- C:\Windows\System\OyRsZWI.exe
  C:\Windows\System\OyRsZWI.exe
  2⤵
  PID:9696
- C:\Windows\System\ZADfuhG.exe
  C:\Windows\System\ZADfuhG.exe
  2⤵
  PID:9252
- C:\Windows\System\PKxTfTX.exe
  C:\Windows\System\PKxTfTX.exe
  2⤵
  PID:10072
- C:\Windows\System\aChnTfY.exe
  C:\Windows\System\aChnTfY.exe
  2⤵
  PID:8096
- C:\Windows\System\rAYVTuz.exe
  C:\Windows\System\rAYVTuz.exe
  2⤵
  PID:9144
- C:\Windows\System\WxLyNUs.exe
  C:\Windows\System\WxLyNUs.exe
  2⤵
  PID:9660
- C:\Windows\System\BYdGzZf.exe
  C:\Windows\System\BYdGzZf.exe
  2⤵
  PID:9716
- C:\Windows\System\vZcHHfc.exe
  C:\Windows\System\vZcHHfc.exe
  2⤵
  PID:9876
- C:\Windows\System\cgJPUFa.exe
  C:\Windows\System\cgJPUFa.exe
  2⤵
  PID:10284
- C:\Windows\System\HCLkhmv.exe
  C:\Windows\System\HCLkhmv.exe
  2⤵
  PID:10576
- C:\Windows\System\LytpiOz.exe
  C:\Windows\System\LytpiOz.exe
  2⤵
  PID:9180
- C:\Windows\System\BIszJvm.exe
  C:\Windows\System\BIszJvm.exe
  2⤵
  PID:11072
- C:\Windows\System\rWZIyUM.exe
  C:\Windows\System\rWZIyUM.exe
  2⤵
  PID:4696
- C:\Windows\System\CHIPnvT.exe
  C:\Windows\System\CHIPnvT.exe
  2⤵
  PID:10744
- C:\Windows\System\EqGqanR.exe
  C:\Windows\System\EqGqanR.exe
  2⤵
  PID:10716
- C:\Windows\System\qozBtJw.exe
  C:\Windows\System\qozBtJw.exe
  2⤵
  PID:4204
- C:\Windows\System\WaTRzqy.exe
  C:\Windows\System\WaTRzqy.exe
  2⤵
  PID:5300
- C:\Windows\System\GuBbFfE.exe
  C:\Windows\System\GuBbFfE.exe
  2⤵
  PID:10324
- C:\Windows\System\eKJdXkd.exe
  C:\Windows\System\eKJdXkd.exe
  2⤵
  PID:10428
- C:\Windows\System\BlVYyDy.exe
  C:\Windows\System\BlVYyDy.exe
  2⤵
  PID:15396
- C:\Windows\System\dYVBQQl.exe
  C:\Windows\System\dYVBQQl.exe
  2⤵
  PID:15424
- C:\Windows\System\KLuSJFL.exe
  C:\Windows\System\KLuSJFL.exe
  2⤵
  PID:15452
- C:\Windows\System\WIPAXsZ.exe
  C:\Windows\System\WIPAXsZ.exe
  2⤵
  PID:15480
- C:\Windows\System\xRFwlht.exe
  C:\Windows\System\xRFwlht.exe
  2⤵
  PID:15504
- C:\Windows\System\ITOWkHe.exe
  C:\Windows\System\ITOWkHe.exe
  2⤵
  PID:15572
- C:\Windows\System\iQctdzX.exe
  C:\Windows\System\iQctdzX.exe
  2⤵
  PID:15916
- C:\Windows\System\uvFSVtk.exe
  C:\Windows\System\uvFSVtk.exe
  2⤵
  PID:15932
- C:\Windows\System\EJkSWAL.exe
  C:\Windows\System\EJkSWAL.exe
  2⤵
  PID:15948
- C:\Windows\System\EKvmLvx.exe
  C:\Windows\System\EKvmLvx.exe
  2⤵
  PID:15964
- C:\Windows\System\BafSpgU.exe
  C:\Windows\System\BafSpgU.exe
  2⤵
  PID:15980
- C:\Windows\System\wgtrKYW.exe
  C:\Windows\System\wgtrKYW.exe
  2⤵
  PID:15996
- C:\Windows\System\YUPzuBk.exe
  C:\Windows\System\YUPzuBk.exe
  2⤵
  PID:16012
- C:\Windows\System\exuayco.exe
  C:\Windows\System\exuayco.exe
  2⤵
  PID:16028
- C:\Windows\System\ZohOBgK.exe
  C:\Windows\System\ZohOBgK.exe
  2⤵
  PID:16044
- C:\Windows\System\cnBFzuO.exe
  C:\Windows\System\cnBFzuO.exe
  2⤵
  PID:16064
- C:\Windows\System\vVCKbTb.exe
  C:\Windows\System\vVCKbTb.exe
  2⤵
  PID:16080
- C:\Windows\System\IRuXinw.exe
  C:\Windows\System\IRuXinw.exe
  2⤵
  PID:16096
- C:\Windows\System\jEjDxAh.exe
  C:\Windows\System\jEjDxAh.exe
  2⤵
  PID:16112
- C:\Windows\System\PlUraxB.exe
  C:\Windows\System\PlUraxB.exe
  2⤵
  PID:16128
- C:\Windows\System\sPBfgkg.exe
  C:\Windows\System\sPBfgkg.exe
  2⤵
  PID:16144
- C:\Windows\System\PLXKVUu.exe
  C:\Windows\System\PLXKVUu.exe
  2⤵
  PID:16180
- C:\Windows\System\MmsrGfD.exe
  C:\Windows\System\MmsrGfD.exe
  2⤵
  PID:16200
- C:\Windows\System\UloGuIE.exe
  C:\Windows\System\UloGuIE.exe
  2⤵
  PID:16216
- C:\Windows\System\PymQyhc.exe
  C:\Windows\System\PymQyhc.exe
  2⤵
  PID:16240
- C:\Windows\System\ORIpOgz.exe
  C:\Windows\System\ORIpOgz.exe
  2⤵
  PID:16268
- C:\Windows\System\YbfUasF.exe
  C:\Windows\System\YbfUasF.exe
  2⤵
  PID:16304
- C:\Windows\System\DaiJiYZ.exe
  C:\Windows\System\DaiJiYZ.exe
  2⤵
  PID:16344
- C:\Windows\System\rKozILH.exe
  C:\Windows\System\rKozILH.exe
  2⤵
  PID:8308
- C:\Windows\System\beOFaJZ.exe
  C:\Windows\System\beOFaJZ.exe
  2⤵
  PID:10292
- C:\Windows\System\JOFRSXP.exe
  C:\Windows\System\JOFRSXP.exe
  2⤵
  PID:11196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_aen2gd0n.plk.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BOlKQZX.exe

Filesize
2.2MB

MD5
cae591c17c51e078ae39e00bf72e168c

SHA1
f0a11c49a9ef4a6cdabf033b8859bcc2be43d188

SHA256
cb34172cd208e7017620c15a7ecc3ea2ab3063535d643b7ad860effb90440016

SHA512
4167458bb6512c7094f969b572d298363ea57af6941f5045120b5c20dfc56f74d0103089bd7fbaaf8703d0f176f3a82d58fc33f51058525f5f60c22ea22843df

Download Submit
C:\Windows\System\CJSLMhI.exe

Filesize
2.2MB

MD5
b975c216f7d53ce7774e2aabae169c77

SHA1
6b2909d6c1191c2a4a3c21c016fdbd72a71420fb

SHA256
7ab61893e22592fd49a2b43a4474aae2b8b2ff992e69b9f8cce5ee56a620ee83

SHA512
78b0522979d326edacc7c86b1e8aa52e149b7ef77830d955f5f0132984c620c57f79dca594ca0892c1c87819892302a5a8b93e6351a416c805a4f2a1082d5e6d

Download Submit
C:\Windows\System\CVFOBxr.exe

Filesize
2.2MB

MD5
90c9c70c34cae38f40bc727f482295e7

SHA1
e8bc4fea635e5737bc4349703a790ce6b430ea60

SHA256
5bde666b32e26bc96c48b92ff4557d3eae93aa539e650d50c31b834c9aeabc27

SHA512
d512d725cfa197134f3f1aad6facf9ae7815d0ad046801eaf99b1a1438e561a3892c49d5e4e0e9802d6e43b075ac2358b2367f7a5484435d7c2e1eb08efca0de

Download Submit
C:\Windows\System\FSJIIcN.exe

Filesize
2.2MB

MD5
336f05065ffc217779a260e06c00bfb2

SHA1
9a725cb95eb8d79b4d3a51b872ae60619657abb8

SHA256
41d6ca7617ce14d8214387d98814828b23b03e06d0a6d64bb1fe066e687bc348

SHA512
ff0c7f8bb152a2d705481ed0a7ee24ce113af6ab52b966be44efc4b7874e853ad743a37b027badb416505b7ef24a6ff746c28d94393de8e7f9727084cbbd989a

Download Submit
C:\Windows\System\HXGmuOe.exe

Filesize
8B

MD5
2adac273ce248e8d242a4b12f749bb46

SHA1
300bd2c60c669d978305195f11eaf26c73d9e457

SHA256
5a695799bf8f73300a4f9c4a59fd25b209a2457abf1051a262d540e520557456

SHA512
011941b215532355e8e4d21af78180da68d2fe04927118ebe818ec14ec4bfb6a7a2d9aaa01fdfd0cd2c6dc84968b5f642ccf10cc92c29aa0e1d06bcf6f120232

Download Submit
C:\Windows\System\NPEcCwh.exe

Filesize
2.2MB

MD5
7971eb64b31dbb8f48cd9d48ddb090a9

SHA1
67ed8d10a701a401d71be9fc6e09a397d1fb9ab1

SHA256
b88ed8f79cbb62ee337fbba206ef5e56b305527b587ad094aba72397cc984c1e

SHA512
b635c86c0a19e69079941f10492893f6a77216233a6f03d1aac90d03b526266c614421d288cbb758a0a07fe4b1c1c36b34002e804706718cfc42ff460d7af8d5

Download Submit
C:\Windows\System\NqFGQlL.exe

Filesize
2.2MB

MD5
da2f9d94a2b00cb534072a1f911bf5ac

SHA1
341d503695df8454413782779371c5e845001fae

SHA256
e37cbc5212ef591e759a0577958348892cfd436972508756c06b7007ae298d87

SHA512
50241e0bbd4f3cceb59863943f896e3382cfa3abad107d77c50a65bfaf41a1496984be352a5af1b961abb5986062a36318dd6b6f45b2e4e58f13bac07feb775a

Download Submit
C:\Windows\System\PMDcAav.exe

Filesize
2.2MB

MD5
9bd81be23a623353d91604c90d329b8d

SHA1
2b9792e1ff157dbc8b9ea0dfafe554ee78420ed0

SHA256
93d95e6e61147cc3af6f851d55637f079ecce748983f06d09f5d0d25daf15666

SHA512
928f8c9624cbe4b8e779f6f4ee2f709be4d3474ac211d215d4eb57477596d807080f03965a44729e6ca5fa45045a3a6c81fbd09be6c08d8b96f5ead23d482411

Download Submit
C:\Windows\System\PbpjVSr.exe

Filesize
2.2MB

MD5
b560160cf74b32582469ed5e79d59499

SHA1
ee46d2fb1fd9a06446af040f5122f44c389dda3e

SHA256
7137e4260b915157ca86743f56b358d32536916a561a6157fe58dfd8522c5c75

SHA512
6a9853ba159070951c16ab4bd7b5e7fd863b6f185afde824b566f32d80954d33edc49be8ea8700f99906276ea0c08c3831a451f95c19ba5c4c45001c77538c24

Download Submit
C:\Windows\System\PmcXaDc.exe

Filesize
2.2MB

MD5
b13df0d20c722c1caaa8d60aa8a17de1

SHA1
877d6699d14668dbe79846a74450e2855dcd3768

SHA256
d1e44f6098b5d4ce619aaf83a22724866e2f7dc80544a0e65654d2d64b649a4c

SHA512
a256f53ddb35e115a0d2abe86617995b95f08908aed43c8048a7e5c9f069d5df883930231b9ac0b10b79bb3def142e0fe1929cd4da03a17af7de2e8c2bf3a3aa

Download Submit
C:\Windows\System\QnopXGk.exe

Filesize
2.2MB

MD5
7eeaf37e8ca90b03774024dd7e1309c9

SHA1
6d2e6ac282d340d6bcccaee549adf6e28d41ef85

SHA256
8e2c5bcde79c31cf3dd4dcb3eff9a216dac38b4d88b28b33fc6877178b28761c

SHA512
8ee2924b800181aa336f5e1b60da873527e12e52a84e9011f78e74e7ef8686b3e6faa181df25457c91e5192f23d9ce0e030ac077324be98a172cf8ba1a558506

Download Submit
C:\Windows\System\RcZaslR.exe

Filesize
2.2MB

MD5
d16746fb60cc0232aa72b5d189c651b8

SHA1
4ec04f00a9a444bc24e3c5b0e341d59fb46afd9e

SHA256
3789c730e6802ecbd2cc9c19206ea60207c78c6a851f1db184bf90a372dfc65c

SHA512
c06162e9b1ce624ac2f01fb6fe0436a853bad23cdd89225c16c60bbfbbaede091feab4aa8e996e113bf3558867cfd5810b1383a39762372aef50fb7535001084

Download Submit
C:\Windows\System\VstLAcD.exe

Filesize
2.2MB

MD5
89fdfb3a4eeeeeb80617e756c2de2f56

SHA1
6c55e9a77602137faf9fb9b70ebe56a7a282671f

SHA256
0ebf32de233355a33254bee16b5c9ae183ba489324b4f698b1c8ad1a3ea05052

SHA512
9025bb21c3e7b55b843119fbb7601e33a0ddc5acdf550f692743cf62a6aa302f79521a309a17608fa3dfc177daed91905713ec7b1c77dd999191aca4d1edf04d

Download Submit
C:\Windows\System\Xdnjczr.exe

Filesize
2.2MB

MD5
791c6b19f442c3bfcbc820dc6e17e6f4

SHA1
ed8eb3c20c6a894a288207417142df31f588a250

SHA256
20fc21fa2f124f2961411e07bc9a54f6d357297cd3d133389d3138045baf8f05

SHA512
2bbc6fc28752d2e318d21a00ccef41f7706146784abd298e56da1284569cbf838781c03f1481421178657c8d7e65dec8f5c8c50c614e32389bc4373fd19175e5

Download Submit
C:\Windows\System\XvWcohz.exe

Filesize
2.2MB

MD5
cb16122c06e1f0f4ae6e1bef19a515bb

SHA1
7347732beb6b4f77477f6820ad82f4d63da3db7a

SHA256
f5ef2eed77afb92dc6f2eac0484bad3eb055b80ee23991030b9e34c306adaf50

SHA512
855627bcba53251233e47b0e892359c6c622ae9e6f048c527dca5188024d7e22dd9fc917cf8b7752ebe07e6a815155270d1e544361f80a6e352e0efb194134c9

Download Submit
C:\Windows\System\ZBQyZwG.exe

Filesize
2.2MB

MD5
c28de04dca93cf79312b667444763f2e

SHA1
b09a91212fe2a7a03bdbd8c45e8224bf6b273e35

SHA256
3cf2c87cfd164768063a2d32c9cb2a6a3890f5e6e4c41b5e15824a9ba41ecb47

SHA512
27e12d7662a0a5cadb0910bdf23d3a269c715a53fd10ba4859a9865f448a8d7d6205ee930831c647b86c7e666001c8d3dac7deab46af8b8be16fee5a7c225189

Download Submit
C:\Windows\System\ZDsPACB.exe

Filesize
2.2MB

MD5
8edb3ec3e19be4a13a1a7e5f4eb5ca28

SHA1
3f5635a22ef37db5e5c16701db86e15a4fe48247

SHA256
193c8a5e2ddffb614276df6b4605f4cbcc445cef5bd35fff46dc5900aef65c98

SHA512
9a7d6fe2bc87e7e7adf1dfc6764c2002c39fcb695a5d226bc712f71354ea7650f30a80ad29f433c49e037cb84736a4465107510723507bfdea091e35e056fae7

Download Submit
C:\Windows\System\aQTtLhb.exe

Filesize
2.2MB

MD5
98a1a44e6a37a1ec866eca72f3214bac

SHA1
b44a112cb1b496208ab05cfe0d40294637c6e9c7

SHA256
cd4f68894cede5942dc597b75535b38acd8d062338e0d08d54c82003c17a34f2

SHA512
b24c05fedf96c49fd3eb8111efc7769b710ecd05557d570301d1a818defdc29495d431b39fdcce20ba90d49d00d9fed41fa0fa796050a5a7e73a570c6e3bed12

Download Submit
C:\Windows\System\bANVuGN.exe

Filesize
2.2MB

MD5
22a8b91dd7807cbd059fa045a1f82dff

SHA1
e8f8a88acd439d1b4c2876e8921226f25905bcd0

SHA256
ba009c601c703b9bc087101242d3e875af9155d7246ac3836669a3b7ff7e55ca

SHA512
d9ff9f9dde00ef4eef424f6111c57fafa5c8874074f207f1b2528f6b1d624dbbe9aa694bb02a79d3bbebc9bcb692efbd5e06a1486b9a1f6906bf871d8a407112

Download Submit
C:\Windows\System\bIdvXqS.exe

Filesize
2.2MB

MD5
86018f91535d425a889e7176ec8eaf86

SHA1
9da4fba4043f00eada937eafb127c413ba387ed8

SHA256
a13d2342dfff251c33a3b3c4a5b3c85214fd9a38ce629808ef8d01a2151bafbe

SHA512
f922d621713c63e5293d9b2fb322eb3d4140c202e12dce2a9671194e7ecca1ac252b143ee6a5bb58ffe5ac62b0dc2af94e847d8a8274eba506931d1d9fa2e067

Download Submit
C:\Windows\System\bsJsQOD.exe

Filesize
2.2MB

MD5
77f4f445dfe20176d44d9c8caa2df7d6

SHA1
82570d3906a32bf8e95ae22fb21c27ae520512ff

SHA256
1ddab5241d2dcb535580dc7b8272c2ca2fcc3f70c48323988e2a8d6b7e9a87c4

SHA512
138796e850e55235f76574be45702740b0b4b6468730cb654080de320ecf3123b2b5e92d02bc8981ae67c558aacab5869c0883d7d7659374124e091e53d5936a

Download Submit
C:\Windows\System\dBbczSg.exe

Filesize
2.2MB

MD5
4af2bb5d86c5f668deb5b90ce5e3a126

SHA1
aa33f6f7239e1b6f0019697a2a24547cc4599a9e

SHA256
80a844c97810c16686cf240697d79ad1341936791699f861f9814d3aff3acd00

SHA512
d6567f13b51e117de58ab49755201d33ee0d257500976403de400dd2cc1e0195eb6d7627bc0d5a096e3dced855026ce3f4300b851bc4c47c2aa91f48e281de69

Download Submit
C:\Windows\System\fjJDwHR.exe

Filesize
2.2MB

MD5
d2b837e026d65b51c2ecc14c2b218321

SHA1
6a4d1b771b70774552bcb1c949e8672522b98d74

SHA256
5c7f96d525bcefc5f1735ddf0fa7bd5ce8af88d624b3b2b7cf6ed7a89f39fa25

SHA512
b46fd580d7ddcf77b6ae6c255dacc9740cb1bf06a9a577ccecd39452b4c195d24c01884966a5f4581acbdb7d4de84067bc3f7ad17f202100c905bd3e390b112d

Download Submit
C:\Windows\System\fsxMWxc.exe

Filesize
18B

MD5
c66cdc789fed99d92127571e86ecb03d

SHA1
188873e18e6e3b9ceef082be68645df41216c2de

SHA256
aac7227006c039705440741dfa58468767a241db7d3bd85e302e4fd55fd7ced0

SHA512
ca491a8b679cfad4b78e62443d1e9e343553264817662db17ef1a796af3daf08d0f856e86dd7157e45e360cbb25ececc19a9a25447b465dc5e199a0bbaf01a20

Download Submit
C:\Windows\System\gjphgcW.exe

Filesize
2.2MB

MD5
4da14936cecddc0f73397ff7d2e78b58

SHA1
083413ce4f21c985e45b5fa67a073947ec1f634d

SHA256
3f777d5bdac97cd4dc89ef1f06b7e40c30b995895f6aaeafebab567a91a53cd2

SHA512
3afe34322cf2eea31e992503aee1016fb2c17bef8ae5d5dc41c80b3f7343bb27fdb52be4b35ba2d0fb9c51b0e79d8c8aaf6408517fd49147bdc5439a4420e97f

Download Submit
C:\Windows\System\hOhxjyQ.exe

Filesize
2.2MB

MD5
a959e13a6e572371b69fd65c2e8a96c9

SHA1
faa62276ae0073961b4eac40e39ca1d93dd0ec63

SHA256
51f8315ad9cb6d53b8eea0a76df0ee7bde93abc1a402022782218cdcd723eb6c

SHA512
3e8d036a149563e13febe4af88c9475b0184da2a0589c7bf5d5a248f1bc7deaf90ab6d915b951bb37f67733bbe951f8fa27546f822b6fe1cca17c6128e5cc077

Download Submit
C:\Windows\System\iJDnlgb.exe

Filesize
2.2MB

MD5
568ca861cccacd420ab29ab63d83be13

SHA1
1eead7823887edec9d26185dd18f8436e9969c11

SHA256
b1784abc941121dfef085ec4e02993afee84d4c3df49eb32f0ff324296847566

SHA512
9702f749880ecaa692da8ea79b785b1ed99179bd21af725d0c1293fffbd5956707b4620a87e3c4b446c0375adf42a650681e76a200a118c4619ae3f2e624d553

Download Submit
C:\Windows\System\kGLAvsn.exe

Filesize
2.2MB

MD5
9c3189cd599a253eb9567b28599d06aa

SHA1
5203bd139da88f015d7e1a93de67f5ca1256d4d5

SHA256
ee974f11e7c73e90b29396ea8480eee8cf478efb7dc13379e533247c0e76c2f3

SHA512
cda1cb4f467ea05be69d29667ae5f11bd0c6414124b06488f16da6586d2aea5f6394ed7bfbda1073496d1ed7f6749b283585d8f5c19f48bf39c1f765d41d8bc4

Download Submit
C:\Windows\System\mTqzYgy.exe

Filesize
2.2MB

MD5
bb6967ec09d3a6bac41deeb8cbd66fbb

SHA1
26dc9b267f8a32e460907e3e853d1887a906b5f3

SHA256
9e8328a37637d12198193e157ce57dbaa70040415dabfa6e0d0cb6944df0e1c2

SHA512
680ab077263320382b06de05e617a1275c6a0ddb6b630873950736291db8cac877141cb3b7e5c6f17e61aa01df6c0e2f7386ed36717061eeacf8d0cb63fd89d0

Download Submit
C:\Windows\System\ndKEdpB.exe

Filesize
2.2MB

MD5
907c2de13c238e5e41e36f160e3108f7

SHA1
e4e073f042aa76f00bd59563872e888b9db2cdc4

SHA256
370ac9f5398eafa476813b7f8fe4b685ad9053196720b1f48c7252b28cbdcd0e

SHA512
2ec8c94c68d4ecb0b5d40961c17d2ea5a4681161a49d260eddb8775ba3de39f3039950c498e8e5ea7e7287d2d375743bcfda44c7e2018ca27836193b48fe4260

Download Submit
C:\Windows\System\nkOYfKS.exe

Filesize
2.2MB

MD5
40d2abe89e59f9d26bb288e9c6ec0cf4

SHA1
a09884e490970a60d7bea3edba483938b30eda7f

SHA256
7571939c52f485c31d6df36d1c61087f588c3b4b27bc919c52a54fbad370b19d

SHA512
86170ad421001c1882d458934582c5e1623fa53f66cb79bacc15db4a33fb9563d2ec5aea02f2bf7bea83823b49ea79b58651dba650114b29c40033e5fbe69af4

Download Submit
C:\Windows\System\pEuFoWn.exe

Filesize
2.2MB

MD5
75fc27a9ea7137416f3d87f3e65c4066

SHA1
f3a07bda4ce169372e966f48ff96bfc3004ae933

SHA256
df816a199086e433d87c94613dd13128cbd3013287cee4d702ea7949307c100d

SHA512
332eb12a9509b8cefd2b80f632ba338194bf9b05a8ca693752e67ec60d5d093cbdbdac1592c09aeabe4c1505021863469ad0bb5b803f602374d219a64b064e52

Download Submit
C:\Windows\System\pSCwuNU.exe

Filesize
2.2MB

MD5
6a80affd6ae047f89491699b2b2e6623

SHA1
5945ddec7d8a6457680eb5175bfdee244ab6c77b

SHA256
e717bcee2d7aab8ca408c08a9d0652f7ee16fbe6c0b2292e71cdb963e8744cca

SHA512
5a675b8635a333e3c6ce95e87702b98954db31cc8a44340eeb96a5d27354cc4673e66b091cadf93a9e4f2d91c5d346a969ee7040391c1a9008b2cc91cbd9d483

Download Submit
C:\Windows\System\qIGzkpw.exe

Filesize
2.2MB

MD5
1682674fcd8cb0200d72220afb77bf6e

SHA1
c60ad77710e3905ab75a132d70af23585a80cedc

SHA256
a96d3be4938825e62e9c11bca94a7af0c6cda07d1d02f385e162801e0ed45187

SHA512
949e184bc15fb716a665642c7288b7f76075ddd82f92fab205c6273842bad4d0f1f3e21da4b62f4ee2d84d235e355f58e9b4732117d1af41fdbcca54feeb3c9a

Download Submit
C:\Windows\System\sWKfkDN.exe

Filesize
2.2MB

MD5
209e2198e72d8e5020303688b5a5c3c6

SHA1
10dc4d135de13b2c17aa8ad7d269e28b1f085766

SHA256
5bf7f9f2560ecaecd270bc8f1a7f8675f9d1edf0e1e7a4713d5e76df7d90218a

SHA512
e8be2b72b82887e5dc5575111cabaabd49ba61a0df2bd24e8a7d8d4b0a97b04079b676dd598212870b6f8d334c8bf14893ea631d502f3783f4582cbb33cc2563

Download Submit
C:\Windows\System\tbbCzUG.exe

Filesize
2.2MB

MD5
985f7eb0e5d3f19d7f7c753ecbd4de9e

SHA1
ec0d3c8f9de7cfdb9ba6bbb2fa94a41b9adff4f8

SHA256
ddf7232cfaf3370c5a30b5d2bec4598f80efca4aaa60fb556f7c7ffe721f7458

SHA512
4c67e1c16c5741bd035673e8fcfff51ac13813efab6beb3213e4c436b30b94edc63976725247303ba904b47b21a7db958c63f284f3be8ce887092fb98fd3b7e1

Download Submit
C:\Windows\System\xPMnOWH.exe

Filesize
2.2MB

MD5
8ac2265b3b9b63db04017064f68a6dcd

SHA1
94a2ce775d87aaf12fb84e9bb77130eeab6c5a65

SHA256
ee288faa2f43f5686caec4e97070b4c243804a37206d5af38a701fe8fb46e8b5

SHA512
c27126691901fb23aa91d4fe6bd8b0503df05b51857c609b935570121385631ea825e257467a473702dc40374d6f7545a3352809242adca05e412dd2c044f63a

Download Submit
C:\Windows\System\yBMrSaG.exe

Filesize
2.2MB

MD5
a4153b007a1d675866c88d59cb2bef22

SHA1
c06ed40fef289fe9b1e0990139d880c96b24ebcc

SHA256
0edd584f4b16a6aef74c1f653dc43bd5c06085cc6e927a9b89ce33c2176e0330

SHA512
9ec28c15f0ece36f719b61325eb5b74a918fb5b41b86040a9a3c3c3ac030b4677d5b593fd61c284581730458be33443527109742b0d6a527ee4f2021fd652830

Download Submit
C:\Windows\System\yDDjgMl.exe

Filesize
2.2MB

MD5
9c16853e280b1c965a20916c4876bc42

SHA1
7e6cf05d6f9d6e08aeeda7ccc42f651025951495

SHA256
073377564e943fb0001eff11f541fbd4128515b2f39e4dac03c9d3a6ba963ea1

SHA512
f7b236418a0acb77c6f5f5e17c1db1a0fec548caf42ea7295de71abcdfdbecff405aa2d1a8380bc8e92666e43307a76afadfb5a82370b2cf0a4b182bfd50e56f

Download Submit
C:\Windows\System\yXgjdOZ.exe

Filesize
2.2MB

MD5
f6bdcef6537187ca866118e26b1e1f4a

SHA1
53788f20b8c078c1d0b4396a28b10351a777f4f6

SHA256
af1b85ff9d76ad626705e1c98e52815873b1b0db8d184de153535829dfb9767d

SHA512
76c797d2149da0c83e3eed53fc08e8070ee703632d780b4415b988b44290d203e37e6a334d9f608f0f30dcc75a18670082e0b316e93c5c0889610db46b7df13f

Download Submit
C:\Windows\System\ytecApr.exe

Filesize
2.2MB

MD5
d6e4aead20c851f40223d6b4dd6da72a

SHA1
78dc90cb85e282bc129497b1b0a8059b269fcb88

SHA256
127889b622c0613c9ca4ba41747db1bfea8b577b384e1c8ea933a8c97d86cc78

SHA512
c2deb8e6c58ed51d37332b2542f9f89549529faff00c3db656481b2ca2d02d5a616177fb1ea50ebd4bbc461fb5d9df2f68668c68681da821602608bf9b9edacb

Download Submit
memory/772-117-0x00007FF760270000-0x00007FF760662000-memory.dmp

Filesize
3.9MB

Download
memory/1060-260-0x00007FF6419C0000-0x00007FF641DB2000-memory.dmp

Filesize
3.9MB

Download
memory/1060-4603-0x00007FF6419C0000-0x00007FF641DB2000-memory.dmp

Filesize
3.9MB

Download
memory/1280-148-0x00007FF7AFBB0000-0x00007FF7AFFA2000-memory.dmp

Filesize
3.9MB

Download
memory/1444-4601-0x00007FF752F30000-0x00007FF753322000-memory.dmp

Filesize
3.9MB

Download
memory/1444-186-0x00007FF752F30000-0x00007FF753322000-memory.dmp

Filesize
3.9MB

Download
memory/1456-457-0x00007FF7CE700000-0x00007FF7CEAF2000-memory.dmp

Filesize
3.9MB

Download
memory/1456-4698-0x00007FF7CE700000-0x00007FF7CEAF2000-memory.dmp

Filesize
3.9MB

Download
memory/1520-82-0x0000025DDF7D0000-0x0000025DDF7E0000-memory.dmp

Filesize
64KB

Download
memory/1520-107-0x0000025DDFBA0000-0x0000025DDFBC2000-memory.dmp

Filesize
136KB

Download
memory/1520-79-0x00007FFFCCD90000-0x00007FFFCD851000-memory.dmp

Filesize
10.8MB

Download
memory/1760-654-0x00007FF6803D0000-0x00007FF6807C2000-memory.dmp

Filesize
3.9MB

Download
memory/1892-598-0x00007FF72EC10000-0x00007FF72F002000-memory.dmp

Filesize
3.9MB

Download
memory/1892-4629-0x00007FF72EC10000-0x00007FF72F002000-memory.dmp

Filesize
3.9MB

Download
memory/1896-363-0x00007FF6F4650000-0x00007FF6F4A42000-memory.dmp

Filesize
3.9MB

Download
memory/1896-4608-0x00007FF6F4650000-0x00007FF6F4A42000-memory.dmp

Filesize
3.9MB

Download
memory/2156-4690-0x00007FF6A44A0000-0x00007FF6A4892000-memory.dmp

Filesize
3.9MB

Download
memory/2156-655-0x00007FF6A44A0000-0x00007FF6A4892000-memory.dmp

Filesize
3.9MB

Download
memory/2336-789-0x00007FF798920000-0x00007FF798D12000-memory.dmp

Filesize
3.9MB

Download
memory/2536-4696-0x00007FF7A32A0000-0x00007FF7A3692000-memory.dmp

Filesize
3.9MB

Download
memory/2536-670-0x00007FF7A32A0000-0x00007FF7A3692000-memory.dmp

Filesize
3.9MB

Download
memory/2612-725-0x00007FF6EF9B0000-0x00007FF6EFDA2000-memory.dmp

Filesize
3.9MB

Download
memory/2612-4635-0x00007FF6EF9B0000-0x00007FF6EFDA2000-memory.dmp

Filesize
3.9MB

Download
memory/2768-237-0x00007FF6CB040000-0x00007FF6CB432000-memory.dmp

Filesize
3.9MB

Download
memory/2768-4610-0x00007FF6CB040000-0x00007FF6CB432000-memory.dmp

Filesize
3.9MB

Download
memory/3024-4572-0x00007FF6E65F0000-0x00007FF6E69E2000-memory.dmp

Filesize
3.9MB

Download
memory/3024-13-0x00007FF6E65F0000-0x00007FF6E69E2000-memory.dmp

Filesize
3.9MB

Download
memory/3236-4685-0x00007FF646C90000-0x00007FF647082000-memory.dmp

Filesize
3.9MB

Download
memory/3236-816-0x00007FF646C90000-0x00007FF647082000-memory.dmp

Filesize
3.9MB

Download
memory/3264-1-0x000001DD42F90000-0x000001DD42FA0000-memory.dmp

Filesize
64KB

Download
memory/3264-0-0x00007FF7169E0000-0x00007FF716DD2000-memory.dmp

Filesize
3.9MB

Download
memory/3276-614-0x00007FF6C9E30000-0x00007FF6CA222000-memory.dmp

Filesize
3.9MB

Download
memory/3276-4746-0x00007FF6C9E30000-0x00007FF6CA222000-memory.dmp

Filesize
3.9MB

Download
memory/3320-4585-0x00007FF795670000-0x00007FF795A62000-memory.dmp

Filesize
3.9MB

Download
memory/3320-788-0x00007FF795670000-0x00007FF795A62000-memory.dmp

Filesize
3.9MB

Download
memory/3688-4638-0x00007FF6B08D0000-0x00007FF6B0CC2000-memory.dmp

Filesize
3.9MB

Download
memory/3688-453-0x00007FF6B08D0000-0x00007FF6B0CC2000-memory.dmp

Filesize
3.9MB

Download
memory/3716-227-0x00007FF630230000-0x00007FF630622000-memory.dmp

Filesize
3.9MB

Download
memory/3716-4592-0x00007FF630230000-0x00007FF630622000-memory.dmp

Filesize
3.9MB

Download
memory/4032-4597-0x00007FF6E4150000-0x00007FF6E4542000-memory.dmp

Filesize
3.9MB

Download
memory/4032-306-0x00007FF6E4150000-0x00007FF6E4542000-memory.dmp

Filesize
3.9MB

Download
memory/4980-4612-0x00007FF7C2460000-0x00007FF7C2852000-memory.dmp

Filesize
3.9MB

Download
memory/4980-391-0x00007FF7C2460000-0x00007FF7C2852000-memory.dmp

Filesize
3.9MB

Download