xmrig | e0ab871f2dad8cfde88b431a84b7ed8606d6a536a8dd4f6416a3645a6f0c07a5

Analysis

max time kernel
128s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 14:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
Size

1.9MB
MD5

00ee4a2c347162b043d32f07620e57dc
SHA1

2fec5354f69d2af7151d7710a2db1c1d3f21db12
SHA256

e0ab871f2dad8cfde88b431a84b7ed8606d6a536a8dd4f6416a3645a6f0c07a5
SHA512

b7dfc77e640f683ae8c521f12ffd305712150a24d093375186508db6f67956d1cda7643481e011e09157b2c674dd30926a3604027f01e95165711cdd7c8f9bdd
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1B:NABi

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 16 IoCs

miner

resource	yara_rule
behavioral2/memory/3952-38-0x00007FF732ED0000-0x00007FF7332C2000-memory.dmp	xmrig
behavioral2/memory/212-70-0x00007FF75BCE0000-0x00007FF75C0D2000-memory.dmp	xmrig
behavioral2/memory/3492-91-0x00007FF7E5BA0000-0x00007FF7E5F92000-memory.dmp	xmrig
behavioral2/memory/3140-102-0x00007FF7A4580000-0x00007FF7A4972000-memory.dmp	xmrig
behavioral2/memory/3456-96-0x00007FF686EC0000-0x00007FF6872B2000-memory.dmp	xmrig
behavioral2/memory/3840-66-0x00007FF77DEA0000-0x00007FF77E292000-memory.dmp	xmrig
behavioral2/memory/2492-60-0x00007FF75FE60000-0x00007FF760252000-memory.dmp	xmrig
behavioral2/memory/1664-55-0x00007FF7A89A0000-0x00007FF7A8D92000-memory.dmp	xmrig
behavioral2/memory/4464-51-0x00007FF7B7E00000-0x00007FF7B81F2000-memory.dmp	xmrig
behavioral2/memory/4108-39-0x00007FF7A0830000-0x00007FF7A0C22000-memory.dmp	xmrig
behavioral2/memory/1304-30-0x00007FF626B70000-0x00007FF626F62000-memory.dmp	xmrig
behavioral2/memory/4376-1865-0x00007FF6BFFF0000-0x00007FF6C03E2000-memory.dmp	xmrig
behavioral2/memory/2264-2599-0x00007FF7CD580000-0x00007FF7CD972000-memory.dmp	xmrig
behavioral2/memory/3844-3792-0x00007FF6E7DE0000-0x00007FF6E81D2000-memory.dmp	xmrig
behavioral2/memory/3512-4308-0x00007FF623930000-0x00007FF623D22000-memory.dmp	xmrig
behavioral2/memory/1056-5181-0x00007FF68A500000-0x00007FF68A8F2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1664	hDrvIcC.exe
1304	qQnuksr.exe
3952	LVgKYjY.exe
4108	mkWSbkS.exe
4464	cPwGCqr.exe
2492	LwXXfkm.exe
3840	amcidJa.exe
212	KUoNMsG.exe
4924	JglANFu.exe
2264	fUtLpko.exe
3492	ezjizTr.exe
3456	RWlioom.exe
1852	BTKiQGR.exe
3140	TACNGDO.exe
5068	iBpoPPf.exe
3844	rHbHTgo.exe
4192	ODkRGaI.exe
1596	qfcKkuz.exe
3512	amZedxo.exe
384	CdjMBhi.exe
1056	xzQFRRZ.exe
3532	jmDTmHF.exe
1032	OEoXUtj.exe
1108	cDnvPMS.exe
4608	zdkBmqg.exe
928	OJSDEgi.exe
4904	SVnRIPB.exe
4948	qCyAeag.exe
4720	bcDcRTx.exe
3584	VtLBjMo.exe
4424	ZmEZdwU.exe
3596	BuwgJWw.exe
820	OzABbqy.exe
4280	ZbIMrKR.exe
2936	jcAeJdo.exe
5052	QnOjEjM.exe
4880	lgLBtQF.exe
2028	xeaPuOv.exe
4420	mKnKire.exe
4628	EtsdswQ.exe
3668	ufTwCOO.exe
4216	shjgJre.exe
1540	qzfLjcW.exe
4320	iNqeRwn.exe
3164	VoBAanY.exe
3096	kfICQHN.exe
2280	Rtgonud.exe
2796	aKEpfSP.exe
4672	fOKzgoJ.exe
2904	YpfXUpz.exe
924	POuvckO.exe
2596	qCsLhJm.exe
4768	dXKTaDC.exe
1860	JmsLMVw.exe
1484	FTTQOjr.exe
1272	WDgbwCK.exe
644	JYZctla.exe
3488	awGmSzi.exe
2712	RvIUJDb.exe
4732	smNDGAU.exe
5116	jMMJEBh.exe
3160	grufPAq.exe
5032	EsZSJHk.exe
4616	BxAlksp.exe

UPX packed file 59 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4376-0-0x00007FF6BFFF0000-0x00007FF6C03E2000-memory.dmp	upx
behavioral2/files/0x000d000000023b8c-5.dat	upx
behavioral2/files/0x000a000000023b92-9.dat	upx
behavioral2/files/0x000a000000023b91-13.dat	upx
behavioral2/memory/3952-38-0x00007FF732ED0000-0x00007FF7332C2000-memory.dmp	upx
behavioral2/files/0x000a000000023b97-54.dat	upx
behavioral2/files/0x000a000000023b96-56.dat	upx
behavioral2/memory/212-70-0x00007FF75BCE0000-0x00007FF75C0D2000-memory.dmp	upx
behavioral2/memory/4924-75-0x00007FF620400000-0x00007FF6207F2000-memory.dmp	upx
behavioral2/memory/2264-84-0x00007FF7CD580000-0x00007FF7CD972000-memory.dmp	upx
behavioral2/memory/3492-91-0x00007FF7E5BA0000-0x00007FF7E5F92000-memory.dmp	upx
behavioral2/files/0x000a000000023b9e-97.dat	upx
behavioral2/files/0x000b000000023b8e-103.dat	upx
behavioral2/files/0x000a000000023b9f-119.dat	upx
behavioral2/files/0x000a000000023ba2-136.dat	upx
behavioral2/memory/1056-147-0x00007FF68A500000-0x00007FF68A8F2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba6-158.dat	upx
behavioral2/files/0x000a000000023baa-175.dat	upx
behavioral2/files/0x000a000000023bad-191.dat	upx
behavioral2/files/0x000a000000023bae-195.dat	upx
behavioral2/files/0x000a000000023bac-185.dat	upx
behavioral2/files/0x000a000000023bab-181.dat	upx
behavioral2/files/0x000a000000023ba9-171.dat	upx
behavioral2/files/0x000a000000023ba8-168.dat	upx
behavioral2/files/0x000a000000023ba7-163.dat	upx
behavioral2/files/0x000a000000023ba5-153.dat	upx
behavioral2/files/0x000a000000023ba4-148.dat	upx
behavioral2/files/0x000a000000023ba3-142.dat	upx
behavioral2/memory/384-141-0x00007FF77C150000-0x00007FF77C542000-memory.dmp	upx
behavioral2/files/0x000a000000023ba1-131.dat	upx
behavioral2/memory/3512-130-0x00007FF623930000-0x00007FF623D22000-memory.dmp	upx
behavioral2/files/0x000a000000023ba0-125.dat	upx
behavioral2/memory/1596-124-0x00007FF68E4E0000-0x00007FF68E8D2000-memory.dmp	upx
behavioral2/memory/4192-118-0x00007FF7E5980000-0x00007FF7E5D72000-memory.dmp	upx
behavioral2/memory/3844-112-0x00007FF6E7DE0000-0x00007FF6E81D2000-memory.dmp	upx
behavioral2/memory/5068-106-0x00007FF741120000-0x00007FF741512000-memory.dmp	upx
behavioral2/memory/3140-102-0x00007FF7A4580000-0x00007FF7A4972000-memory.dmp	upx
behavioral2/files/0x000a000000023b9c-100.dat	upx
behavioral2/memory/3456-96-0x00007FF686EC0000-0x00007FF6872B2000-memory.dmp	upx
behavioral2/files/0x000a000000023b9b-94.dat	upx
behavioral2/files/0x000a000000023b9d-88.dat	upx
behavioral2/files/0x000b000000023b98-87.dat	upx
behavioral2/memory/1852-85-0x00007FF6DA830000-0x00007FF6DAC22000-memory.dmp	upx
behavioral2/files/0x000b000000023b99-78.dat	upx
behavioral2/files/0x000a000000023b9a-71.dat	upx
behavioral2/memory/3840-66-0x00007FF77DEA0000-0x00007FF77E292000-memory.dmp	upx
behavioral2/memory/2492-60-0x00007FF75FE60000-0x00007FF760252000-memory.dmp	upx
behavioral2/memory/1664-55-0x00007FF7A89A0000-0x00007FF7A8D92000-memory.dmp	upx
behavioral2/memory/4464-51-0x00007FF7B7E00000-0x00007FF7B81F2000-memory.dmp	upx
behavioral2/memory/4108-39-0x00007FF7A0830000-0x00007FF7A0C22000-memory.dmp	upx
behavioral2/files/0x000a000000023b94-33.dat	upx
behavioral2/files/0x000a000000023b95-32.dat	upx
behavioral2/memory/1304-30-0x00007FF626B70000-0x00007FF626F62000-memory.dmp	upx
behavioral2/files/0x000a000000023b93-28.dat	upx
behavioral2/memory/4376-1865-0x00007FF6BFFF0000-0x00007FF6C03E2000-memory.dmp	upx
behavioral2/memory/2264-2599-0x00007FF7CD580000-0x00007FF7CD972000-memory.dmp	upx
behavioral2/memory/3844-3792-0x00007FF6E7DE0000-0x00007FF6E81D2000-memory.dmp	upx
behavioral2/memory/3512-4308-0x00007FF623930000-0x00007FF623D22000-memory.dmp	upx
behavioral2/memory/1056-5181-0x00007FF68A500000-0x00007FF68A8F2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\MfXFoDp.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\XZBmtup.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\ocidWjm.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\sfaJExG.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\FFNBJwn.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\YOXZcIY.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\ZrVhzUA.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\EoxqWCd.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\ecVZlzz.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\aypdkcp.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\nNxWgHE.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\qpgCanX.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\soCPJMZ.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\CNqukba.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\JYguDrz.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\kbTmusN.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\lxMYPSm.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\UdWqbHy.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\HdjDExK.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\aBlxNlB.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\mWOwvXg.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\BjmNxJG.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\oUDLMxB.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\vHWuiEY.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\CkqiNKx.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\AwEJEtC.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\ZTBoCIw.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\orgPLCm.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\ukRLTKf.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\dQAtflY.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\RWXfjYj.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\VCUWIXB.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\APzNvbI.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\hywfLpn.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\RjHWOsk.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\cGCjdgF.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\oFYffLa.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\TowYnWC.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\jBxrrKK.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\TPTxPck.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\VIQqwND.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\LQVQgGx.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\RoPnlgF.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\pgjhNZb.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\SBICsdt.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\lCZqyYx.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\WaVmbZK.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\cjQznss.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\aDRgPDA.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\gVIIxkL.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\GtIsfhR.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\YwFefOz.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\tHySpbh.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\dbcsJCa.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\jQOEJpf.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\dbRFMTg.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\lzndQMV.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\uhEdpJP.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\SzUbXLr.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\xljCEKa.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\nprbAOr.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\wAfzJPm.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\DsGnIeB.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\xyCvgVu.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3504	powershell.exe
3504	powershell.exe
3504	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
Token: SeDebugPrivilege	3504	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 3504	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	85
PID 4376 wrote to memory of 3504	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	85
PID 4376 wrote to memory of 1664	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	86
PID 4376 wrote to memory of 1664	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	86
PID 4376 wrote to memory of 1304	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	87
PID 4376 wrote to memory of 1304	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	87
PID 4376 wrote to memory of 3952	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	88
PID 4376 wrote to memory of 3952	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	88
PID 4376 wrote to memory of 4108	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	89
PID 4376 wrote to memory of 4108	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	89
PID 4376 wrote to memory of 4464	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	90
PID 4376 wrote to memory of 4464	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	90
PID 4376 wrote to memory of 2492	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	91
PID 4376 wrote to memory of 2492	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	91
PID 4376 wrote to memory of 3840	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	92
PID 4376 wrote to memory of 3840	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	92
PID 4376 wrote to memory of 212	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	93
PID 4376 wrote to memory of 212	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	93
PID 4376 wrote to memory of 4924	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	94
PID 4376 wrote to memory of 4924	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	94
PID 4376 wrote to memory of 2264	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	95
PID 4376 wrote to memory of 2264	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	95
PID 4376 wrote to memory of 3492	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	96
PID 4376 wrote to memory of 3492	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	96
PID 4376 wrote to memory of 3456	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	97
PID 4376 wrote to memory of 3456	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	97
PID 4376 wrote to memory of 1852	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	98
PID 4376 wrote to memory of 1852	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	98
PID 4376 wrote to memory of 3140	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	99
PID 4376 wrote to memory of 3140	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	99
PID 4376 wrote to memory of 5068	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	100
PID 4376 wrote to memory of 5068	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	100
PID 4376 wrote to memory of 3844	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	101
PID 4376 wrote to memory of 3844	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	101
PID 4376 wrote to memory of 4192	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	102
PID 4376 wrote to memory of 4192	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	102
PID 4376 wrote to memory of 1596	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	103
PID 4376 wrote to memory of 1596	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	103
PID 4376 wrote to memory of 3512	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	104
PID 4376 wrote to memory of 3512	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	104
PID 4376 wrote to memory of 384	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	105
PID 4376 wrote to memory of 384	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	105
PID 4376 wrote to memory of 1056	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	106
PID 4376 wrote to memory of 1056	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	106
PID 4376 wrote to memory of 3532	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	107
PID 4376 wrote to memory of 3532	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	107
PID 4376 wrote to memory of 1032	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	108
PID 4376 wrote to memory of 1032	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	108
PID 4376 wrote to memory of 1108	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	109
PID 4376 wrote to memory of 1108	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	109
PID 4376 wrote to memory of 4608	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	110
PID 4376 wrote to memory of 4608	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	110
PID 4376 wrote to memory of 928	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	111
PID 4376 wrote to memory of 928	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	111
PID 4376 wrote to memory of 4904	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	112
PID 4376 wrote to memory of 4904	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	112
PID 4376 wrote to memory of 4948	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	113
PID 4376 wrote to memory of 4948	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	113
PID 4376 wrote to memory of 4720	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	114
PID 4376 wrote to memory of 4720	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	114
PID 4376 wrote to memory of 3584	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	115
PID 4376 wrote to memory of 3584	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	115
PID 4376 wrote to memory of 4424	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	116
PID 4376 wrote to memory of 4424	4376	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3504
- C:\Windows\System\hDrvIcC.exe
  C:\Windows\System\hDrvIcC.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\qQnuksr.exe
  C:\Windows\System\qQnuksr.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\LVgKYjY.exe
  C:\Windows\System\LVgKYjY.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\mkWSbkS.exe
  C:\Windows\System\mkWSbkS.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\cPwGCqr.exe
  C:\Windows\System\cPwGCqr.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\LwXXfkm.exe
  C:\Windows\System\LwXXfkm.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\amcidJa.exe
  C:\Windows\System\amcidJa.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\KUoNMsG.exe
  C:\Windows\System\KUoNMsG.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\JglANFu.exe
  C:\Windows\System\JglANFu.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\fUtLpko.exe
  C:\Windows\System\fUtLpko.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\ezjizTr.exe
  C:\Windows\System\ezjizTr.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\RWlioom.exe
  C:\Windows\System\RWlioom.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\BTKiQGR.exe
  C:\Windows\System\BTKiQGR.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\TACNGDO.exe
  C:\Windows\System\TACNGDO.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\iBpoPPf.exe
  C:\Windows\System\iBpoPPf.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\rHbHTgo.exe
  C:\Windows\System\rHbHTgo.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System\ODkRGaI.exe
  C:\Windows\System\ODkRGaI.exe
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Windows\System\qfcKkuz.exe
  C:\Windows\System\qfcKkuz.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\amZedxo.exe
  C:\Windows\System\amZedxo.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\CdjMBhi.exe
  C:\Windows\System\CdjMBhi.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\xzQFRRZ.exe
  C:\Windows\System\xzQFRRZ.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\jmDTmHF.exe
  C:\Windows\System\jmDTmHF.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\OEoXUtj.exe
  C:\Windows\System\OEoXUtj.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\cDnvPMS.exe
  C:\Windows\System\cDnvPMS.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\zdkBmqg.exe
  C:\Windows\System\zdkBmqg.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\OJSDEgi.exe
  C:\Windows\System\OJSDEgi.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\SVnRIPB.exe
  C:\Windows\System\SVnRIPB.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\qCyAeag.exe
  C:\Windows\System\qCyAeag.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\bcDcRTx.exe
  C:\Windows\System\bcDcRTx.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\VtLBjMo.exe
  C:\Windows\System\VtLBjMo.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\ZmEZdwU.exe
  C:\Windows\System\ZmEZdwU.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\BuwgJWw.exe
  C:\Windows\System\BuwgJWw.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\OzABbqy.exe
  C:\Windows\System\OzABbqy.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\ZbIMrKR.exe
  C:\Windows\System\ZbIMrKR.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\jcAeJdo.exe
  C:\Windows\System\jcAeJdo.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\QnOjEjM.exe
  C:\Windows\System\QnOjEjM.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\lgLBtQF.exe
  C:\Windows\System\lgLBtQF.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\xeaPuOv.exe
  C:\Windows\System\xeaPuOv.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\mKnKire.exe
  C:\Windows\System\mKnKire.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\EtsdswQ.exe
  C:\Windows\System\EtsdswQ.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\ufTwCOO.exe
  C:\Windows\System\ufTwCOO.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\shjgJre.exe
  C:\Windows\System\shjgJre.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System\qzfLjcW.exe
  C:\Windows\System\qzfLjcW.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\iNqeRwn.exe
  C:\Windows\System\iNqeRwn.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\VoBAanY.exe
  C:\Windows\System\VoBAanY.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\kfICQHN.exe
  C:\Windows\System\kfICQHN.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\Rtgonud.exe
  C:\Windows\System\Rtgonud.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\aKEpfSP.exe
  C:\Windows\System\aKEpfSP.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\fOKzgoJ.exe
  C:\Windows\System\fOKzgoJ.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\YpfXUpz.exe
  C:\Windows\System\YpfXUpz.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\POuvckO.exe
  C:\Windows\System\POuvckO.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\qCsLhJm.exe
  C:\Windows\System\qCsLhJm.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\dXKTaDC.exe
  C:\Windows\System\dXKTaDC.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\JmsLMVw.exe
  C:\Windows\System\JmsLMVw.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\FTTQOjr.exe
  C:\Windows\System\FTTQOjr.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\WDgbwCK.exe
  C:\Windows\System\WDgbwCK.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\JYZctla.exe
  C:\Windows\System\JYZctla.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\awGmSzi.exe
  C:\Windows\System\awGmSzi.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\RvIUJDb.exe
  C:\Windows\System\RvIUJDb.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\smNDGAU.exe
  C:\Windows\System\smNDGAU.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\jMMJEBh.exe
  C:\Windows\System\jMMJEBh.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\grufPAq.exe
  C:\Windows\System\grufPAq.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\EsZSJHk.exe
  C:\Windows\System\EsZSJHk.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\BxAlksp.exe
  C:\Windows\System\BxAlksp.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\BREQkQl.exe
  C:\Windows\System\BREQkQl.exe
  2⤵
  PID:1548
- C:\Windows\System\SZelBzn.exe
  C:\Windows\System\SZelBzn.exe
  2⤵
  PID:5136
- C:\Windows\System\qLbHBgc.exe
  C:\Windows\System\qLbHBgc.exe
  2⤵
  PID:5164
- C:\Windows\System\dvViTCx.exe
  C:\Windows\System\dvViTCx.exe
  2⤵
  PID:5188
- C:\Windows\System\PbtXVIO.exe
  C:\Windows\System\PbtXVIO.exe
  2⤵
  PID:5216
- C:\Windows\System\lFtVbVg.exe
  C:\Windows\System\lFtVbVg.exe
  2⤵
  PID:5244
- C:\Windows\System\fbhbABB.exe
  C:\Windows\System\fbhbABB.exe
  2⤵
  PID:5268
- C:\Windows\System\MTWPitz.exe
  C:\Windows\System\MTWPitz.exe
  2⤵
  PID:5300
- C:\Windows\System\vnTOCLK.exe
  C:\Windows\System\vnTOCLK.exe
  2⤵
  PID:5328
- C:\Windows\System\djmCpye.exe
  C:\Windows\System\djmCpye.exe
  2⤵
  PID:5356
- C:\Windows\System\MWRjlTp.exe
  C:\Windows\System\MWRjlTp.exe
  2⤵
  PID:5384
- C:\Windows\System\gFmTrcz.exe
  C:\Windows\System\gFmTrcz.exe
  2⤵
  PID:5412
- C:\Windows\System\UQZafrb.exe
  C:\Windows\System\UQZafrb.exe
  2⤵
  PID:5440
- C:\Windows\System\rBPiuZJ.exe
  C:\Windows\System\rBPiuZJ.exe
  2⤵
  PID:5468
- C:\Windows\System\XFlogbi.exe
  C:\Windows\System\XFlogbi.exe
  2⤵
  PID:5496
- C:\Windows\System\dvtfXrb.exe
  C:\Windows\System\dvtfXrb.exe
  2⤵
  PID:5524
- C:\Windows\System\JMmcyHk.exe
  C:\Windows\System\JMmcyHk.exe
  2⤵
  PID:5556
- C:\Windows\System\DNQiRZB.exe
  C:\Windows\System\DNQiRZB.exe
  2⤵
  PID:5580
- C:\Windows\System\gXGiMEX.exe
  C:\Windows\System\gXGiMEX.exe
  2⤵
  PID:5608
- C:\Windows\System\asElrjg.exe
  C:\Windows\System\asElrjg.exe
  2⤵
  PID:5636
- C:\Windows\System\iQBiXNh.exe
  C:\Windows\System\iQBiXNh.exe
  2⤵
  PID:5664
- C:\Windows\System\MGWXitp.exe
  C:\Windows\System\MGWXitp.exe
  2⤵
  PID:5696
- C:\Windows\System\AwHsEiw.exe
  C:\Windows\System\AwHsEiw.exe
  2⤵
  PID:5720
- C:\Windows\System\ejuvNth.exe
  C:\Windows\System\ejuvNth.exe
  2⤵
  PID:5748
- C:\Windows\System\Zsgrvuy.exe
  C:\Windows\System\Zsgrvuy.exe
  2⤵
  PID:5776
- C:\Windows\System\YewQmbO.exe
  C:\Windows\System\YewQmbO.exe
  2⤵
  PID:5804
- C:\Windows\System\wyyUjLK.exe
  C:\Windows\System\wyyUjLK.exe
  2⤵
  PID:5832
- C:\Windows\System\lNUdFTg.exe
  C:\Windows\System\lNUdFTg.exe
  2⤵
  PID:5864
- C:\Windows\System\bDXpQLA.exe
  C:\Windows\System\bDXpQLA.exe
  2⤵
  PID:5888
- C:\Windows\System\NKaaYgU.exe
  C:\Windows\System\NKaaYgU.exe
  2⤵
  PID:5924
- C:\Windows\System\uMJoqtv.exe
  C:\Windows\System\uMJoqtv.exe
  2⤵
  PID:5944
- C:\Windows\System\qajhlzq.exe
  C:\Windows\System\qajhlzq.exe
  2⤵
  PID:5972
- C:\Windows\System\esQVwyQ.exe
  C:\Windows\System\esQVwyQ.exe
  2⤵
  PID:5988
- C:\Windows\System\HMDPjiS.exe
  C:\Windows\System\HMDPjiS.exe
  2⤵
  PID:6016
- C:\Windows\System\AVmrcXo.exe
  C:\Windows\System\AVmrcXo.exe
  2⤵
  PID:6044
- C:\Windows\System\AsfHNGz.exe
  C:\Windows\System\AsfHNGz.exe
  2⤵
  PID:6072
- C:\Windows\System\HSupAin.exe
  C:\Windows\System\HSupAin.exe
  2⤵
  PID:6100
- C:\Windows\System\bmPsULN.exe
  C:\Windows\System\bmPsULN.exe
  2⤵
  PID:6128
- C:\Windows\System\KcZlERz.exe
  C:\Windows\System\KcZlERz.exe
  2⤵
  PID:1988
- C:\Windows\System\QpGkRze.exe
  C:\Windows\System\QpGkRze.exe
  2⤵
  PID:2532
- C:\Windows\System\ruyfyen.exe
  C:\Windows\System\ruyfyen.exe
  2⤵
  PID:3900
- C:\Windows\System\lCZNiZP.exe
  C:\Windows\System\lCZNiZP.exe
  2⤵
  PID:4648
- C:\Windows\System\gYaiVsg.exe
  C:\Windows\System\gYaiVsg.exe
  2⤵
  PID:1996
- C:\Windows\System\jRkhSCb.exe
  C:\Windows\System\jRkhSCb.exe
  2⤵
  PID:5144
- C:\Windows\System\qZUhTdG.exe
  C:\Windows\System\qZUhTdG.exe
  2⤵
  PID:5204
- C:\Windows\System\htrtwcB.exe
  C:\Windows\System\htrtwcB.exe
  2⤵
  PID:3640
- C:\Windows\System\Lcngqaf.exe
  C:\Windows\System\Lcngqaf.exe
  2⤵
  PID:5316
- C:\Windows\System\gIYrjXg.exe
  C:\Windows\System\gIYrjXg.exe
  2⤵
  PID:5372
- C:\Windows\System\utLqhVB.exe
  C:\Windows\System\utLqhVB.exe
  2⤵
  PID:5452
- C:\Windows\System\GXaYExh.exe
  C:\Windows\System\GXaYExh.exe
  2⤵
  PID:5512
- C:\Windows\System\ZKIjGAe.exe
  C:\Windows\System\ZKIjGAe.exe
  2⤵
  PID:5572
- C:\Windows\System\vYsQpCf.exe
  C:\Windows\System\vYsQpCf.exe
  2⤵
  PID:5628
- C:\Windows\System\OddjpPx.exe
  C:\Windows\System\OddjpPx.exe
  2⤵
  PID:4972
- C:\Windows\System\HFVnpnv.exe
  C:\Windows\System\HFVnpnv.exe
  2⤵
  PID:5760
- C:\Windows\System\ZoTvpna.exe
  C:\Windows\System\ZoTvpna.exe
  2⤵
  PID:5820
- C:\Windows\System\tQXflfl.exe
  C:\Windows\System\tQXflfl.exe
  2⤵
  PID:5880
- C:\Windows\System\yIlHanh.exe
  C:\Windows\System\yIlHanh.exe
  2⤵
  PID:5940
- C:\Windows\System\XbaqMhN.exe
  C:\Windows\System\XbaqMhN.exe
  2⤵
  PID:3580
- C:\Windows\System\jyxtgzD.exe
  C:\Windows\System\jyxtgzD.exe
  2⤵
  PID:6060
- C:\Windows\System\dmgmUYV.exe
  C:\Windows\System\dmgmUYV.exe
  2⤵
  PID:6116
- C:\Windows\System\zvwXpyB.exe
  C:\Windows\System\zvwXpyB.exe
  2⤵
  PID:1096
- C:\Windows\System\GBuKTDp.exe
  C:\Windows\System\GBuKTDp.exe
  2⤵
  PID:2112
- C:\Windows\System\VpwtPoW.exe
  C:\Windows\System\VpwtPoW.exe
  2⤵
  PID:632
- C:\Windows\System\JOYAEcL.exe
  C:\Windows\System\JOYAEcL.exe
  2⤵
  PID:5256
- C:\Windows\System\BUHcbMH.exe
  C:\Windows\System\BUHcbMH.exe
  2⤵
  PID:5404
- C:\Windows\System\qCIdHIl.exe
  C:\Windows\System\qCIdHIl.exe
  2⤵
  PID:5540
- C:\Windows\System\hgZIzEd.exe
  C:\Windows\System\hgZIzEd.exe
  2⤵
  PID:5680
- C:\Windows\System\lTRmOBg.exe
  C:\Windows\System\lTRmOBg.exe
  2⤵
  PID:5792
- C:\Windows\System\sYGqtpM.exe
  C:\Windows\System\sYGqtpM.exe
  2⤵
  PID:5920
- C:\Windows\System\owAdXiS.exe
  C:\Windows\System\owAdXiS.exe
  2⤵
  PID:6056
- C:\Windows\System\hdrvmhY.exe
  C:\Windows\System\hdrvmhY.exe
  2⤵
  PID:4312
- C:\Windows\System\dIbjIBT.exe
  C:\Windows\System\dIbjIBT.exe
  2⤵
  PID:3468
- C:\Windows\System\NsXrquG.exe
  C:\Windows\System\NsXrquG.exe
  2⤵
  PID:4920
- C:\Windows\System\pWNmKXp.exe
  C:\Windows\System\pWNmKXp.exe
  2⤵
  PID:6160
- C:\Windows\System\FJWErlp.exe
  C:\Windows\System\FJWErlp.exe
  2⤵
  PID:6188
- C:\Windows\System\napXEot.exe
  C:\Windows\System\napXEot.exe
  2⤵
  PID:6220
- C:\Windows\System\DmLLaNe.exe
  C:\Windows\System\DmLLaNe.exe
  2⤵
  PID:6248
- C:\Windows\System\PMzfpbn.exe
  C:\Windows\System\PMzfpbn.exe
  2⤵
  PID:6272
- C:\Windows\System\imTQojT.exe
  C:\Windows\System\imTQojT.exe
  2⤵
  PID:6304
- C:\Windows\System\KuThQjL.exe
  C:\Windows\System\KuThQjL.exe
  2⤵
  PID:6328
- C:\Windows\System\MiFTtUr.exe
  C:\Windows\System\MiFTtUr.exe
  2⤵
  PID:6356
- C:\Windows\System\ybrLTNg.exe
  C:\Windows\System\ybrLTNg.exe
  2⤵
  PID:6384
- C:\Windows\System\UrDjUhf.exe
  C:\Windows\System\UrDjUhf.exe
  2⤵
  PID:6412
- C:\Windows\System\ntuSHYp.exe
  C:\Windows\System\ntuSHYp.exe
  2⤵
  PID:6440
- C:\Windows\System\KwucuIL.exe
  C:\Windows\System\KwucuIL.exe
  2⤵
  PID:6468
- C:\Windows\System\SbCGtvM.exe
  C:\Windows\System\SbCGtvM.exe
  2⤵
  PID:6496
- C:\Windows\System\SivAycl.exe
  C:\Windows\System\SivAycl.exe
  2⤵
  PID:6524
- C:\Windows\System\HZEAUUe.exe
  C:\Windows\System\HZEAUUe.exe
  2⤵
  PID:6552
- C:\Windows\System\kcFUvjX.exe
  C:\Windows\System\kcFUvjX.exe
  2⤵
  PID:6584
- C:\Windows\System\YAyLkgI.exe
  C:\Windows\System\YAyLkgI.exe
  2⤵
  PID:6608
- C:\Windows\System\hjVXSqh.exe
  C:\Windows\System\hjVXSqh.exe
  2⤵
  PID:6636
- C:\Windows\System\JVAJLGL.exe
  C:\Windows\System\JVAJLGL.exe
  2⤵
  PID:6668
- C:\Windows\System\lZfcfdp.exe
  C:\Windows\System\lZfcfdp.exe
  2⤵
  PID:6692
- C:\Windows\System\FlDjQsE.exe
  C:\Windows\System\FlDjQsE.exe
  2⤵
  PID:6724
- C:\Windows\System\HMbveCi.exe
  C:\Windows\System\HMbveCi.exe
  2⤵
  PID:6748
- C:\Windows\System\Smlnhar.exe
  C:\Windows\System\Smlnhar.exe
  2⤵
  PID:6780
- C:\Windows\System\qnukcyG.exe
  C:\Windows\System\qnukcyG.exe
  2⤵
  PID:6808
- C:\Windows\System\URxHvlt.exe
  C:\Windows\System\URxHvlt.exe
  2⤵
  PID:6836
- C:\Windows\System\QHMKsnu.exe
  C:\Windows\System\QHMKsnu.exe
  2⤵
  PID:6864
- C:\Windows\System\wUaOict.exe
  C:\Windows\System\wUaOict.exe
  2⤵
  PID:6892
- C:\Windows\System\DNVKhNf.exe
  C:\Windows\System\DNVKhNf.exe
  2⤵
  PID:6920
- C:\Windows\System\aExkJMD.exe
  C:\Windows\System\aExkJMD.exe
  2⤵
  PID:6948
- C:\Windows\System\KPontfH.exe
  C:\Windows\System\KPontfH.exe
  2⤵
  PID:6976
- C:\Windows\System\rdbcGji.exe
  C:\Windows\System\rdbcGji.exe
  2⤵
  PID:7004
- C:\Windows\System\rYriVXp.exe
  C:\Windows\System\rYriVXp.exe
  2⤵
  PID:7032
- C:\Windows\System\wTzsLNl.exe
  C:\Windows\System\wTzsLNl.exe
  2⤵
  PID:7060
- C:\Windows\System\jqhGrhO.exe
  C:\Windows\System\jqhGrhO.exe
  2⤵
  PID:7088
- C:\Windows\System\BPLGnNy.exe
  C:\Windows\System\BPLGnNy.exe
  2⤵
  PID:7116
- C:\Windows\System\eTayEYu.exe
  C:\Windows\System\eTayEYu.exe
  2⤵
  PID:7144
- C:\Windows\System\YqnEKkF.exe
  C:\Windows\System\YqnEKkF.exe
  2⤵
  PID:5488
- C:\Windows\System\hkATDqF.exe
  C:\Windows\System\hkATDqF.exe
  2⤵
  PID:1700
- C:\Windows\System\ESMMpzb.exe
  C:\Windows\System\ESMMpzb.exe
  2⤵
  PID:6092
- C:\Windows\System\GLhgpaI.exe
  C:\Windows\System\GLhgpaI.exe
  2⤵
  PID:440
- C:\Windows\System\uRuVAzd.exe
  C:\Windows\System\uRuVAzd.exe
  2⤵
  PID:6152
- C:\Windows\System\DGhhUWD.exe
  C:\Windows\System\DGhhUWD.exe
  2⤵
  PID:6184
- C:\Windows\System\scBzrQx.exe
  C:\Windows\System\scBzrQx.exe
  2⤵
  PID:6240
- C:\Windows\System\RsHAERC.exe
  C:\Windows\System\RsHAERC.exe
  2⤵
  PID:6268
- C:\Windows\System\JGkyWla.exe
  C:\Windows\System\JGkyWla.exe
  2⤵
  PID:6296
- C:\Windows\System\GjrECnY.exe
  C:\Windows\System\GjrECnY.exe
  2⤵
  PID:2004
- C:\Windows\System\jxVtecG.exe
  C:\Windows\System\jxVtecG.exe
  2⤵
  PID:6408
- C:\Windows\System\fVrRSGs.exe
  C:\Windows\System\fVrRSGs.exe
  2⤵
  PID:4576
- C:\Windows\System\fXxnGhO.exe
  C:\Windows\System\fXxnGhO.exe
  2⤵
  PID:6548
- C:\Windows\System\AVCPoFk.exe
  C:\Windows\System\AVCPoFk.exe
  2⤵
  PID:6596
- C:\Windows\System\HjMzdAO.exe
  C:\Windows\System\HjMzdAO.exe
  2⤵
  PID:3996
- C:\Windows\System\fZvCndf.exe
  C:\Windows\System\fZvCndf.exe
  2⤵
  PID:6716
- C:\Windows\System\JJoIaNz.exe
  C:\Windows\System\JJoIaNz.exe
  2⤵
  PID:3764
- C:\Windows\System\HkRCwRl.exe
  C:\Windows\System\HkRCwRl.exe
  2⤵
  PID:6820
- C:\Windows\System\dggFMGW.exe
  C:\Windows\System\dggFMGW.exe
  2⤵
  PID:6876
- C:\Windows\System\eesfAEt.exe
  C:\Windows\System\eesfAEt.exe
  2⤵
  PID:3956
- C:\Windows\System\EjTWKUV.exe
  C:\Windows\System\EjTWKUV.exe
  2⤵
  PID:6912
- C:\Windows\System\eizfJxg.exe
  C:\Windows\System\eizfJxg.exe
  2⤵
  PID:1252
- C:\Windows\System\RyapwfG.exe
  C:\Windows\System\RyapwfG.exe
  2⤵
  PID:7044
- C:\Windows\System\YhSVCTv.exe
  C:\Windows\System\YhSVCTv.exe
  2⤵
  PID:7104
- C:\Windows\System\feWRhbE.exe
  C:\Windows\System\feWRhbE.exe
  2⤵
  PID:4692
- C:\Windows\System\MisLaVi.exe
  C:\Windows\System\MisLaVi.exe
  2⤵
  PID:5676
- C:\Windows\System\pwsvwiP.exe
  C:\Windows\System\pwsvwiP.exe
  2⤵
  PID:4368
- C:\Windows\System\VnEvskJ.exe
  C:\Windows\System\VnEvskJ.exe
  2⤵
  PID:6212
- C:\Windows\System\AOJLESe.exe
  C:\Windows\System\AOJLESe.exe
  2⤵
  PID:4868
- C:\Windows\System\cNWfWKn.exe
  C:\Windows\System\cNWfWKn.exe
  2⤵
  PID:6264
- C:\Windows\System\zpJCsMO.exe
  C:\Windows\System\zpJCsMO.exe
  2⤵
  PID:6512
- C:\Windows\System\kzJSeej.exe
  C:\Windows\System\kzJSeej.exe
  2⤵
  PID:6400
- C:\Windows\System\Yyofvyh.exe
  C:\Windows\System\Yyofvyh.exe
  2⤵
  PID:1916
- C:\Windows\System\tyqejsZ.exe
  C:\Windows\System\tyqejsZ.exe
  2⤵
  PID:1300
- C:\Windows\System\WaRjuqI.exe
  C:\Windows\System\WaRjuqI.exe
  2⤵
  PID:1196
- C:\Windows\System\wLqlmGS.exe
  C:\Windows\System\wLqlmGS.exe
  2⤵
  PID:2880
- C:\Windows\System\fpyZKot.exe
  C:\Windows\System\fpyZKot.exe
  2⤵
  PID:6880
- C:\Windows\System\asAhZIZ.exe
  C:\Windows\System\asAhZIZ.exe
  2⤵
  PID:2708
- C:\Windows\System\lwaZTdC.exe
  C:\Windows\System\lwaZTdC.exe
  2⤵
  PID:6992
- C:\Windows\System\cNeMSpG.exe
  C:\Windows\System\cNeMSpG.exe
  2⤵
  PID:452
- C:\Windows\System\cLXZTNO.exe
  C:\Windows\System\cLXZTNO.exe
  2⤵
  PID:5732
- C:\Windows\System\RuVvHzV.exe
  C:\Windows\System\RuVvHzV.exe
  2⤵
  PID:6292
- C:\Windows\System\XuqSPVs.exe
  C:\Windows\System\XuqSPVs.exe
  2⤵
  PID:6576
- C:\Windows\System\jPQcivc.exe
  C:\Windows\System\jPQcivc.exe
  2⤵
  PID:1952
- C:\Windows\System\IpXujsX.exe
  C:\Windows\System\IpXujsX.exe
  2⤵
  PID:7132
- C:\Windows\System\JQcQyzx.exe
  C:\Windows\System\JQcQyzx.exe
  2⤵
  PID:5344
- C:\Windows\System\hoFAPwe.exe
  C:\Windows\System\hoFAPwe.exe
  2⤵
  PID:5048
- C:\Windows\System\lfqbvBb.exe
  C:\Windows\System\lfqbvBb.exe
  2⤵
  PID:7172
- C:\Windows\System\GWCqOVg.exe
  C:\Windows\System\GWCqOVg.exe
  2⤵
  PID:7204
- C:\Windows\System\JGKoFQs.exe
  C:\Windows\System\JGKoFQs.exe
  2⤵
  PID:7220
- C:\Windows\System\dyyixsh.exe
  C:\Windows\System\dyyixsh.exe
  2⤵
  PID:7240
- C:\Windows\System\UANHPTM.exe
  C:\Windows\System\UANHPTM.exe
  2⤵
  PID:7256
- C:\Windows\System\LWXdchN.exe
  C:\Windows\System\LWXdchN.exe
  2⤵
  PID:7296
- C:\Windows\System\GoWNhlO.exe
  C:\Windows\System\GoWNhlO.exe
  2⤵
  PID:7336
- C:\Windows\System\UWydtGn.exe
  C:\Windows\System\UWydtGn.exe
  2⤵
  PID:7364
- C:\Windows\System\znjfeTt.exe
  C:\Windows\System\znjfeTt.exe
  2⤵
  PID:7384
- C:\Windows\System\aZpIQKZ.exe
  C:\Windows\System\aZpIQKZ.exe
  2⤵
  PID:7412
- C:\Windows\System\PBCkYeb.exe
  C:\Windows\System\PBCkYeb.exe
  2⤵
  PID:7448
- C:\Windows\System\kFQBDij.exe
  C:\Windows\System\kFQBDij.exe
  2⤵
  PID:7468
- C:\Windows\System\tgtHyzO.exe
  C:\Windows\System\tgtHyzO.exe
  2⤵
  PID:7516
- C:\Windows\System\udEspXw.exe
  C:\Windows\System\udEspXw.exe
  2⤵
  PID:7544
- C:\Windows\System\WrrXqwj.exe
  C:\Windows\System\WrrXqwj.exe
  2⤵
  PID:7560
- C:\Windows\System\rnYnqjk.exe
  C:\Windows\System\rnYnqjk.exe
  2⤵
  PID:7580
- C:\Windows\System\IQYxvGQ.exe
  C:\Windows\System\IQYxvGQ.exe
  2⤵
  PID:7608
- C:\Windows\System\jIZRvFR.exe
  C:\Windows\System\jIZRvFR.exe
  2⤵
  PID:7632
- C:\Windows\System\QjKJoTu.exe
  C:\Windows\System\QjKJoTu.exe
  2⤵
  PID:7652
- C:\Windows\System\IoTdndX.exe
  C:\Windows\System\IoTdndX.exe
  2⤵
  PID:7676
- C:\Windows\System\CqYFLLe.exe
  C:\Windows\System\CqYFLLe.exe
  2⤵
  PID:7700
- C:\Windows\System\RvBcWeL.exe
  C:\Windows\System\RvBcWeL.exe
  2⤵
  PID:7720
- C:\Windows\System\fvujTyS.exe
  C:\Windows\System\fvujTyS.exe
  2⤵
  PID:7740
- C:\Windows\System\OrgmbFu.exe
  C:\Windows\System\OrgmbFu.exe
  2⤵
  PID:7788
- C:\Windows\System\fvtOcNs.exe
  C:\Windows\System\fvtOcNs.exe
  2⤵
  PID:7848
- C:\Windows\System\wBQolLc.exe
  C:\Windows\System\wBQolLc.exe
  2⤵
  PID:7872
- C:\Windows\System\fYylizi.exe
  C:\Windows\System\fYylizi.exe
  2⤵
  PID:7892
- C:\Windows\System\kWOXriR.exe
  C:\Windows\System\kWOXriR.exe
  2⤵
  PID:7940
- C:\Windows\System\cJvzXEP.exe
  C:\Windows\System\cJvzXEP.exe
  2⤵
  PID:7960
- C:\Windows\System\GuAVRYA.exe
  C:\Windows\System\GuAVRYA.exe
  2⤵
  PID:7988
- C:\Windows\System\zAmWoBb.exe
  C:\Windows\System\zAmWoBb.exe
  2⤵
  PID:8012
- C:\Windows\System\OHLQdMH.exe
  C:\Windows\System\OHLQdMH.exe
  2⤵
  PID:8032
- C:\Windows\System\tQqWZai.exe
  C:\Windows\System\tQqWZai.exe
  2⤵
  PID:8060
- C:\Windows\System\EvTGgoM.exe
  C:\Windows\System\EvTGgoM.exe
  2⤵
  PID:8084
- C:\Windows\System\eqbvQPP.exe
  C:\Windows\System\eqbvQPP.exe
  2⤵
  PID:8112
- C:\Windows\System\uyzWxWn.exe
  C:\Windows\System\uyzWxWn.exe
  2⤵
  PID:8136
- C:\Windows\System\TnWRYtb.exe
  C:\Windows\System\TnWRYtb.exe
  2⤵
  PID:8188
- C:\Windows\System\FpEcBNe.exe
  C:\Windows\System\FpEcBNe.exe
  2⤵
  PID:7076
- C:\Windows\System\xXdrIgw.exe
  C:\Windows\System\xXdrIgw.exe
  2⤵
  PID:7228
- C:\Windows\System\eXRaIOo.exe
  C:\Windows\System\eXRaIOo.exe
  2⤵
  PID:7284
- C:\Windows\System\HNmxLIH.exe
  C:\Windows\System\HNmxLIH.exe
  2⤵
  PID:7348
- C:\Windows\System\TNpUSwx.exe
  C:\Windows\System\TNpUSwx.exe
  2⤵
  PID:7392
- C:\Windows\System\rxChQVI.exe
  C:\Windows\System\rxChQVI.exe
  2⤵
  PID:7460
- C:\Windows\System\XQpJQqJ.exe
  C:\Windows\System\XQpJQqJ.exe
  2⤵
  PID:7556
- C:\Windows\System\YMzfEjz.exe
  C:\Windows\System\YMzfEjz.exe
  2⤵
  PID:7576
- C:\Windows\System\tlwSWLQ.exe
  C:\Windows\System\tlwSWLQ.exe
  2⤵
  PID:7644
- C:\Windows\System\hozyFIa.exe
  C:\Windows\System\hozyFIa.exe
  2⤵
  PID:7624
- C:\Windows\System\AiKdmwi.exe
  C:\Windows\System\AiKdmwi.exe
  2⤵
  PID:7732
- C:\Windows\System\TtfBPId.exe
  C:\Windows\System\TtfBPId.exe
  2⤵
  PID:7816
- C:\Windows\System\JVDGLdm.exe
  C:\Windows\System\JVDGLdm.exe
  2⤵
  PID:7864
- C:\Windows\System\YgHkJsa.exe
  C:\Windows\System\YgHkJsa.exe
  2⤵
  PID:7928
- C:\Windows\System\Rbqrwbz.exe
  C:\Windows\System\Rbqrwbz.exe
  2⤵
  PID:8000
- C:\Windows\System\phsiZfI.exe
  C:\Windows\System\phsiZfI.exe
  2⤵
  PID:8024
- C:\Windows\System\gDJxStX.exe
  C:\Windows\System\gDJxStX.exe
  2⤵
  PID:8108
- C:\Windows\System\ssFwSop.exe
  C:\Windows\System\ssFwSop.exe
  2⤵
  PID:8132
- C:\Windows\System\HFscZPH.exe
  C:\Windows\System\HFscZPH.exe
  2⤵
  PID:7020
- C:\Windows\System\OiWdfVf.exe
  C:\Windows\System\OiWdfVf.exe
  2⤵
  PID:7432
- C:\Windows\System\QNDTngg.exe
  C:\Windows\System\QNDTngg.exe
  2⤵
  PID:7764
- C:\Windows\System\MhQOONs.exe
  C:\Windows\System\MhQOONs.exe
  2⤵
  PID:7888
- C:\Windows\System\pLzhrdL.exe
  C:\Windows\System\pLzhrdL.exe
  2⤵
  PID:7924
- C:\Windows\System\zXwrTod.exe
  C:\Windows\System\zXwrTod.exe
  2⤵
  PID:8160
- C:\Windows\System\qiQnCRE.exe
  C:\Windows\System\qiQnCRE.exe
  2⤵
  PID:4736
- C:\Windows\System\MieWWOy.exe
  C:\Windows\System\MieWWOy.exe
  2⤵
  PID:7712
- C:\Windows\System\eZAiOiA.exe
  C:\Windows\System\eZAiOiA.exe
  2⤵
  PID:8128
- C:\Windows\System\deAIQbv.exe
  C:\Windows\System\deAIQbv.exe
  2⤵
  PID:7684
- C:\Windows\System\Ddytjqn.exe
  C:\Windows\System\Ddytjqn.exe
  2⤵
  PID:8204
- C:\Windows\System\cPsFmVe.exe
  C:\Windows\System\cPsFmVe.exe
  2⤵
  PID:8224
- C:\Windows\System\uqTWLzk.exe
  C:\Windows\System\uqTWLzk.exe
  2⤵
  PID:8256
- C:\Windows\System\xTaRVXJ.exe
  C:\Windows\System\xTaRVXJ.exe
  2⤵
  PID:8296
- C:\Windows\System\RXhbWwb.exe
  C:\Windows\System\RXhbWwb.exe
  2⤵
  PID:8320
- C:\Windows\System\zmHZOuH.exe
  C:\Windows\System\zmHZOuH.exe
  2⤵
  PID:8344
- C:\Windows\System\CVEOqpN.exe
  C:\Windows\System\CVEOqpN.exe
  2⤵
  PID:8360
- C:\Windows\System\tKpafas.exe
  C:\Windows\System\tKpafas.exe
  2⤵
  PID:8388
- C:\Windows\System\CzXGKHi.exe
  C:\Windows\System\CzXGKHi.exe
  2⤵
  PID:8408
- C:\Windows\System\EZgMqsn.exe
  C:\Windows\System\EZgMqsn.exe
  2⤵
  PID:8456
- C:\Windows\System\cRscFby.exe
  C:\Windows\System\cRscFby.exe
  2⤵
  PID:8480
- C:\Windows\System\fndYmoq.exe
  C:\Windows\System\fndYmoq.exe
  2⤵
  PID:8500
- C:\Windows\System\PiFxTrS.exe
  C:\Windows\System\PiFxTrS.exe
  2⤵
  PID:8524
- C:\Windows\System\vYNpKSN.exe
  C:\Windows\System\vYNpKSN.exe
  2⤵
  PID:8544
- C:\Windows\System\KeTTgtD.exe
  C:\Windows\System\KeTTgtD.exe
  2⤵
  PID:8564
- C:\Windows\System\FWadGWD.exe
  C:\Windows\System\FWadGWD.exe
  2⤵
  PID:8592
- C:\Windows\System\uVNGPtM.exe
  C:\Windows\System\uVNGPtM.exe
  2⤵
  PID:8640
- C:\Windows\System\IcSbiDb.exe
  C:\Windows\System\IcSbiDb.exe
  2⤵
  PID:8664
- C:\Windows\System\dWuTxQR.exe
  C:\Windows\System\dWuTxQR.exe
  2⤵
  PID:8708
- C:\Windows\System\LsGOMRU.exe
  C:\Windows\System\LsGOMRU.exe
  2⤵
  PID:8724
- C:\Windows\System\PFzwrFy.exe
  C:\Windows\System\PFzwrFy.exe
  2⤵
  PID:8748
- C:\Windows\System\lIibKgi.exe
  C:\Windows\System\lIibKgi.exe
  2⤵
  PID:8776
- C:\Windows\System\UfFlrvW.exe
  C:\Windows\System\UfFlrvW.exe
  2⤵
  PID:8792
- C:\Windows\System\QmHxBjY.exe
  C:\Windows\System\QmHxBjY.exe
  2⤵
  PID:8832
- C:\Windows\System\jWWheWe.exe
  C:\Windows\System\jWWheWe.exe
  2⤵
  PID:8852
- C:\Windows\System\sweFBQU.exe
  C:\Windows\System\sweFBQU.exe
  2⤵
  PID:8884
- C:\Windows\System\IwQHmKC.exe
  C:\Windows\System\IwQHmKC.exe
  2⤵
  PID:8940
- C:\Windows\System\fewgcTq.exe
  C:\Windows\System\fewgcTq.exe
  2⤵
  PID:8984
- C:\Windows\System\zurkRIk.exe
  C:\Windows\System\zurkRIk.exe
  2⤵
  PID:9004
- C:\Windows\System\IIKPJvb.exe
  C:\Windows\System\IIKPJvb.exe
  2⤵
  PID:9024
- C:\Windows\System\htXrnlb.exe
  C:\Windows\System\htXrnlb.exe
  2⤵
  PID:9052
- C:\Windows\System\FqkTgRP.exe
  C:\Windows\System\FqkTgRP.exe
  2⤵
  PID:9088
- C:\Windows\System\UbUiErN.exe
  C:\Windows\System\UbUiErN.exe
  2⤵
  PID:9104
- C:\Windows\System\ptkLeAl.exe
  C:\Windows\System\ptkLeAl.exe
  2⤵
  PID:9120
- C:\Windows\System\LRuVLZZ.exe
  C:\Windows\System\LRuVLZZ.exe
  2⤵
  PID:9140
- C:\Windows\System\xBqeTBE.exe
  C:\Windows\System\xBqeTBE.exe
  2⤵
  PID:9200
- C:\Windows\System\QiCzZVw.exe
  C:\Windows\System\QiCzZVw.exe
  2⤵
  PID:7192
- C:\Windows\System\UhigIGW.exe
  C:\Windows\System\UhigIGW.exe
  2⤵
  PID:8244
- C:\Windows\System\UamHzUp.exe
  C:\Windows\System\UamHzUp.exe
  2⤵
  PID:8280
- C:\Windows\System\UmWbxiF.exe
  C:\Windows\System\UmWbxiF.exe
  2⤵
  PID:8332
- C:\Windows\System\ILJmVmG.exe
  C:\Windows\System\ILJmVmG.exe
  2⤵
  PID:8512
- C:\Windows\System\nqpviiR.exe
  C:\Windows\System\nqpviiR.exe
  2⤵
  PID:8532
- C:\Windows\System\YVlUUcd.exe
  C:\Windows\System\YVlUUcd.exe
  2⤵
  PID:8648
- C:\Windows\System\dIMpQWu.exe
  C:\Windows\System\dIMpQWu.exe
  2⤵
  PID:8680
- C:\Windows\System\ptKFJCB.exe
  C:\Windows\System\ptKFJCB.exe
  2⤵
  PID:8688
- C:\Windows\System\akTrhZz.exe
  C:\Windows\System\akTrhZz.exe
  2⤵
  PID:8720
- C:\Windows\System\hyWizZC.exe
  C:\Windows\System\hyWizZC.exe
  2⤵
  PID:8820
- C:\Windows\System\WHApEBK.exe
  C:\Windows\System\WHApEBK.exe
  2⤵
  PID:3804
- C:\Windows\System\brnISrb.exe
  C:\Windows\System\brnISrb.exe
  2⤵
  PID:8932
- C:\Windows\System\woqhQNO.exe
  C:\Windows\System\woqhQNO.exe
  2⤵
  PID:9068
- C:\Windows\System\KzLMHOE.exe
  C:\Windows\System\KzLMHOE.exe
  2⤵
  PID:9132
- C:\Windows\System\uqJqAdy.exe
  C:\Windows\System\uqJqAdy.exe
  2⤵
  PID:9148
- C:\Windows\System\fSzFCIg.exe
  C:\Windows\System\fSzFCIg.exe
  2⤵
  PID:8220
- C:\Windows\System\gVNIsAO.exe
  C:\Windows\System\gVNIsAO.exe
  2⤵
  PID:8276
- C:\Windows\System\dUDtZtb.exe
  C:\Windows\System\dUDtZtb.exe
  2⤵
  PID:8508
- C:\Windows\System\WLtzUWi.exe
  C:\Windows\System\WLtzUWi.exe
  2⤵
  PID:8768
- C:\Windows\System\jqEECei.exe
  C:\Windows\System\jqEECei.exe
  2⤵
  PID:8844
- C:\Windows\System\wVpbgnI.exe
  C:\Windows\System\wVpbgnI.exe
  2⤵
  PID:9032
- C:\Windows\System\RpstMOJ.exe
  C:\Windows\System\RpstMOJ.exe
  2⤵
  PID:9096
- C:\Windows\System\gaehvJl.exe
  C:\Windows\System\gaehvJl.exe
  2⤵
  PID:8216
- C:\Windows\System\OoNBCpv.exe
  C:\Windows\System\OoNBCpv.exe
  2⤵
  PID:8328
- C:\Windows\System\RDUhUbC.exe
  C:\Windows\System\RDUhUbC.exe
  2⤵
  PID:8628
- C:\Windows\System\MIhrAdO.exe
  C:\Windows\System\MIhrAdO.exe
  2⤵
  PID:9044
- C:\Windows\System\HtGJVcV.exe
  C:\Windows\System\HtGJVcV.exe
  2⤵
  PID:9232
- C:\Windows\System\pKcXGWG.exe
  C:\Windows\System\pKcXGWG.exe
  2⤵
  PID:9256
- C:\Windows\System\rtbUFrv.exe
  C:\Windows\System\rtbUFrv.exe
  2⤵
  PID:9308
- C:\Windows\System\maIvBgh.exe
  C:\Windows\System\maIvBgh.exe
  2⤵
  PID:9328
- C:\Windows\System\ckFRVzW.exe
  C:\Windows\System\ckFRVzW.exe
  2⤵
  PID:9352
- C:\Windows\System\OZqfEYm.exe
  C:\Windows\System\OZqfEYm.exe
  2⤵
  PID:9372
- C:\Windows\System\XcYPIUR.exe
  C:\Windows\System\XcYPIUR.exe
  2⤵
  PID:9392
- C:\Windows\System\gXgevsa.exe
  C:\Windows\System\gXgevsa.exe
  2⤵
  PID:9412
- C:\Windows\System\FdezBoe.exe
  C:\Windows\System\FdezBoe.exe
  2⤵
  PID:9456
- C:\Windows\System\vcKkPJW.exe
  C:\Windows\System\vcKkPJW.exe
  2⤵
  PID:9476
- C:\Windows\System\brFLLOG.exe
  C:\Windows\System\brFLLOG.exe
  2⤵
  PID:9508
- C:\Windows\System\mCAbsWf.exe
  C:\Windows\System\mCAbsWf.exe
  2⤵
  PID:9532
- C:\Windows\System\urfMphG.exe
  C:\Windows\System\urfMphG.exe
  2⤵
  PID:9560
- C:\Windows\System\akxbOZl.exe
  C:\Windows\System\akxbOZl.exe
  2⤵
  PID:9576
- C:\Windows\System\KSPpahN.exe
  C:\Windows\System\KSPpahN.exe
  2⤵
  PID:9596
- C:\Windows\System\uSLSUAV.exe
  C:\Windows\System\uSLSUAV.exe
  2⤵
  PID:9620
- C:\Windows\System\pPXWdzg.exe
  C:\Windows\System\pPXWdzg.exe
  2⤵
  PID:9644
- C:\Windows\System\jwyCReT.exe
  C:\Windows\System\jwyCReT.exe
  2⤵
  PID:9708
- C:\Windows\System\BTzPjoc.exe
  C:\Windows\System\BTzPjoc.exe
  2⤵
  PID:9748
- C:\Windows\System\aIVOkmd.exe
  C:\Windows\System\aIVOkmd.exe
  2⤵
  PID:9772
- C:\Windows\System\BURyYiK.exe
  C:\Windows\System\BURyYiK.exe
  2⤵
  PID:9796
- C:\Windows\System\HYZtKFz.exe
  C:\Windows\System\HYZtKFz.exe
  2⤵
  PID:9824
- C:\Windows\System\mpasfIJ.exe
  C:\Windows\System\mpasfIJ.exe
  2⤵
  PID:9840
- C:\Windows\System\fdPSFda.exe
  C:\Windows\System\fdPSFda.exe
  2⤵
  PID:9864
- C:\Windows\System\LZhpnkt.exe
  C:\Windows\System\LZhpnkt.exe
  2⤵
  PID:9908
- C:\Windows\System\fJaOjcI.exe
  C:\Windows\System\fJaOjcI.exe
  2⤵
  PID:9932
- C:\Windows\System\vtcsXEx.exe
  C:\Windows\System\vtcsXEx.exe
  2⤵
  PID:9960
- C:\Windows\System\qtcgZlU.exe
  C:\Windows\System\qtcgZlU.exe
  2⤵
  PID:9980
- C:\Windows\System\aWXPPyY.exe
  C:\Windows\System\aWXPPyY.exe
  2⤵
  PID:10004
- C:\Windows\System\LtidVrp.exe
  C:\Windows\System\LtidVrp.exe
  2⤵
  PID:10084
- C:\Windows\System\MDWViPp.exe
  C:\Windows\System\MDWViPp.exe
  2⤵
  PID:10176
- C:\Windows\System\dpgeQlL.exe
  C:\Windows\System\dpgeQlL.exe
  2⤵
  PID:10200
- C:\Windows\System\hJqCQvt.exe
  C:\Windows\System\hJqCQvt.exe
  2⤵
  PID:8788
- C:\Windows\System\wOTBTJW.exe
  C:\Windows\System\wOTBTJW.exe
  2⤵
  PID:8572
- C:\Windows\System\ovBvjme.exe
  C:\Windows\System\ovBvjme.exe
  2⤵
  PID:9320
- C:\Windows\System\mjxINpl.exe
  C:\Windows\System\mjxINpl.exe
  2⤵
  PID:9344
- C:\Windows\System\wxrLQGx.exe
  C:\Windows\System\wxrLQGx.exe
  2⤵
  PID:9444
- C:\Windows\System\afznyKx.exe
  C:\Windows\System\afznyKx.exe
  2⤵
  PID:9588
- C:\Windows\System\YzTOUVR.exe
  C:\Windows\System\YzTOUVR.exe
  2⤵
  PID:9528
- C:\Windows\System\ynBfBfe.exe
  C:\Windows\System\ynBfBfe.exe
  2⤵
  PID:9612
- C:\Windows\System\YzZhArN.exe
  C:\Windows\System\YzZhArN.exe
  2⤵
  PID:9700
- C:\Windows\System\xXrjfIX.exe
  C:\Windows\System\xXrjfIX.exe
  2⤵
  PID:9732
- C:\Windows\System\HRbYuqe.exe
  C:\Windows\System\HRbYuqe.exe
  2⤵
  PID:9792
- C:\Windows\System\YZxUJUX.exe
  C:\Windows\System\YZxUJUX.exe
  2⤵
  PID:9816
- C:\Windows\System\exyWRQE.exe
  C:\Windows\System\exyWRQE.exe
  2⤵
  PID:9928
- C:\Windows\System\XtRykPe.exe
  C:\Windows\System\XtRykPe.exe
  2⤵
  PID:9956
- C:\Windows\System\RDutyzd.exe
  C:\Windows\System\RDutyzd.exe
  2⤵
  PID:9988
- C:\Windows\System\LvXLzda.exe
  C:\Windows\System\LvXLzda.exe
  2⤵
  PID:10060
- C:\Windows\System\bcNrScD.exe
  C:\Windows\System\bcNrScD.exe
  2⤵
  PID:2680
- C:\Windows\System\ZbGisCo.exe
  C:\Windows\System\ZbGisCo.exe
  2⤵
  PID:10140
- C:\Windows\System\JueVjyD.exe
  C:\Windows\System\JueVjyD.exe
  2⤵
  PID:10116
- C:\Windows\System\ljMquLj.exe
  C:\Windows\System\ljMquLj.exe
  2⤵
  PID:10184
- C:\Windows\System\MtCNxqI.exe
  C:\Windows\System\MtCNxqI.exe
  2⤵
  PID:8468
- C:\Windows\System\BUlvDWl.exe
  C:\Windows\System\BUlvDWl.exe
  2⤵
  PID:9408
- C:\Windows\System\KaZRqVp.exe
  C:\Windows\System\KaZRqVp.exe
  2⤵
  PID:9616
- C:\Windows\System\VOAeQPD.exe
  C:\Windows\System\VOAeQPD.exe
  2⤵
  PID:9744
- C:\Windows\System\QAdBOhy.exe
  C:\Windows\System\QAdBOhy.exe
  2⤵
  PID:9916
- C:\Windows\System\AUufkZn.exe
  C:\Windows\System\AUufkZn.exe
  2⤵
  PID:9836
- C:\Windows\System\lkcgdmr.exe
  C:\Windows\System\lkcgdmr.exe
  2⤵
  PID:10096
- C:\Windows\System\JmpXxmD.exe
  C:\Windows\System\JmpXxmD.exe
  2⤵
  PID:10216
- C:\Windows\System\djeSVix.exe
  C:\Windows\System\djeSVix.exe
  2⤵
  PID:9592
- C:\Windows\System\WWlkCyT.exe
  C:\Windows\System\WWlkCyT.exe
  2⤵
  PID:9572
- C:\Windows\System\ANBJdui.exe
  C:\Windows\System\ANBJdui.exe
  2⤵
  PID:9704
- C:\Windows\System\qhwsoPI.exe
  C:\Windows\System\qhwsoPI.exe
  2⤵
  PID:10056
- C:\Windows\System\TYAsvqQ.exe
  C:\Windows\System\TYAsvqQ.exe
  2⤵
  PID:10104
- C:\Windows\System\oKYMpXZ.exe
  C:\Windows\System\oKYMpXZ.exe
  2⤵
  PID:9544
- C:\Windows\System\XuTHnNh.exe
  C:\Windows\System\XuTHnNh.exe
  2⤵
  PID:10252
- C:\Windows\System\YbZVUQc.exe
  C:\Windows\System\YbZVUQc.exe
  2⤵
  PID:10272
- C:\Windows\System\fwlpXAX.exe
  C:\Windows\System\fwlpXAX.exe
  2⤵
  PID:10296
- C:\Windows\System\VSDcDzv.exe
  C:\Windows\System\VSDcDzv.exe
  2⤵
  PID:10316
- C:\Windows\System\lSxdTdq.exe
  C:\Windows\System\lSxdTdq.exe
  2⤵
  PID:10372
- C:\Windows\System\ijVqpnb.exe
  C:\Windows\System\ijVqpnb.exe
  2⤵
  PID:10416
- C:\Windows\System\QAnIMUw.exe
  C:\Windows\System\QAnIMUw.exe
  2⤵
  PID:10432
- C:\Windows\System\JjvVyzz.exe
  C:\Windows\System\JjvVyzz.exe
  2⤵
  PID:10476
- C:\Windows\System\BnjFOFp.exe
  C:\Windows\System\BnjFOFp.exe
  2⤵
  PID:10504
- C:\Windows\System\riEcQjp.exe
  C:\Windows\System\riEcQjp.exe
  2⤵
  PID:10544
- C:\Windows\System\JpuLyZO.exe
  C:\Windows\System\JpuLyZO.exe
  2⤵
  PID:10560
- C:\Windows\System\waRKyNN.exe
  C:\Windows\System\waRKyNN.exe
  2⤵
  PID:10596
- C:\Windows\System\NkEZfba.exe
  C:\Windows\System\NkEZfba.exe
  2⤵
  PID:10616
- C:\Windows\System\mhNMryq.exe
  C:\Windows\System\mhNMryq.exe
  2⤵
  PID:10636
- C:\Windows\System\blYERzf.exe
  C:\Windows\System\blYERzf.exe
  2⤵
  PID:10692
- C:\Windows\System\QotsOHW.exe
  C:\Windows\System\QotsOHW.exe
  2⤵
  PID:10712
- C:\Windows\System\aAqmPJI.exe
  C:\Windows\System\aAqmPJI.exe
  2⤵
  PID:10728
- C:\Windows\System\JjjbQqi.exe
  C:\Windows\System\JjjbQqi.exe
  2⤵
  PID:10772
- C:\Windows\System\fONsyAI.exe
  C:\Windows\System\fONsyAI.exe
  2⤵
  PID:10788
- C:\Windows\System\eaXvdba.exe
  C:\Windows\System\eaXvdba.exe
  2⤵
  PID:10812
- C:\Windows\System\ymlFLaw.exe
  C:\Windows\System\ymlFLaw.exe
  2⤵
  PID:10832
- C:\Windows\System\DmmaZTe.exe
  C:\Windows\System\DmmaZTe.exe
  2⤵
  PID:10856
- C:\Windows\System\JQSrtWc.exe
  C:\Windows\System\JQSrtWc.exe
  2⤵
  PID:10880
- C:\Windows\System\kibterZ.exe
  C:\Windows\System\kibterZ.exe
  2⤵
  PID:10920
- C:\Windows\System\atcmqxi.exe
  C:\Windows\System\atcmqxi.exe
  2⤵
  PID:10964
- C:\Windows\System\SHBSFVT.exe
  C:\Windows\System\SHBSFVT.exe
  2⤵
  PID:10984
- C:\Windows\System\pMcWJNB.exe
  C:\Windows\System\pMcWJNB.exe
  2⤵
  PID:11032
- C:\Windows\System\iRYieQU.exe
  C:\Windows\System\iRYieQU.exe
  2⤵
  PID:11048
- C:\Windows\System\fnVkwNB.exe
  C:\Windows\System\fnVkwNB.exe
  2⤵
  PID:11068
- C:\Windows\System\iTHcUia.exe
  C:\Windows\System\iTHcUia.exe
  2⤵
  PID:11096
- C:\Windows\System\ScABMex.exe
  C:\Windows\System\ScABMex.exe
  2⤵
  PID:11120
- C:\Windows\System\xKjwkQf.exe
  C:\Windows\System\xKjwkQf.exe
  2⤵
  PID:11140
- C:\Windows\System\IOVZeoj.exe
  C:\Windows\System\IOVZeoj.exe
  2⤵
  PID:11176
- C:\Windows\System\cNLhIEb.exe
  C:\Windows\System\cNLhIEb.exe
  2⤵
  PID:11196
- C:\Windows\System\fkCmkmJ.exe
  C:\Windows\System\fkCmkmJ.exe
  2⤵
  PID:11224
- C:\Windows\System\rdQNHCj.exe
  C:\Windows\System\rdQNHCj.exe
  2⤵
  PID:9636
- C:\Windows\System\ElrhFPG.exe
  C:\Windows\System\ElrhFPG.exe
  2⤵
  PID:10244
- C:\Windows\System\cmtGJqH.exe
  C:\Windows\System\cmtGJqH.exe
  2⤵
  PID:10288
- C:\Windows\System\SpkxzuT.exe
  C:\Windows\System\SpkxzuT.exe
  2⤵
  PID:10360
- C:\Windows\System\ThzAExn.exe
  C:\Windows\System\ThzAExn.exe
  2⤵
  PID:10488
- C:\Windows\System\RqNgZrz.exe
  C:\Windows\System\RqNgZrz.exe
  2⤵
  PID:10524
- C:\Windows\System\OaoObWW.exe
  C:\Windows\System\OaoObWW.exe
  2⤵
  PID:10552
- C:\Windows\System\DsKHCrh.exe
  C:\Windows\System\DsKHCrh.exe
  2⤵
  PID:10588
- C:\Windows\System\hsTcEnm.exe
  C:\Windows\System\hsTcEnm.exe
  2⤵
  PID:10684
- C:\Windows\System\ePVQLgK.exe
  C:\Windows\System\ePVQLgK.exe
  2⤵
  PID:10720
- C:\Windows\System\STdHdai.exe
  C:\Windows\System\STdHdai.exe
  2⤵
  PID:10796
- C:\Windows\System\umqBsFv.exe
  C:\Windows\System\umqBsFv.exe
  2⤵
  PID:10824
- C:\Windows\System\tBJyYho.exe
  C:\Windows\System\tBJyYho.exe
  2⤵
  PID:10868
- C:\Windows\System\TqwQAGD.exe
  C:\Windows\System\TqwQAGD.exe
  2⤵
  PID:10960
- C:\Windows\System\IMsFiKf.exe
  C:\Windows\System\IMsFiKf.exe
  2⤵
  PID:11020
- C:\Windows\System\qaaHowJ.exe
  C:\Windows\System\qaaHowJ.exe
  2⤵
  PID:11064
- C:\Windows\System\RrfqgdN.exe
  C:\Windows\System\RrfqgdN.exe
  2⤵
  PID:11104
- C:\Windows\System\rfsAhMi.exe
  C:\Windows\System\rfsAhMi.exe
  2⤵
  PID:11160
- C:\Windows\System\FmWWuhz.exe
  C:\Windows\System\FmWWuhz.exe
  2⤵
  PID:9440
- C:\Windows\System\ZxzmYbQ.exe
  C:\Windows\System\ZxzmYbQ.exe
  2⤵
  PID:10472
- C:\Windows\System\REWLMAQ.exe
  C:\Windows\System\REWLMAQ.exe
  2⤵
  PID:10644
- C:\Windows\System\yxEfkIx.exe
  C:\Windows\System\yxEfkIx.exe
  2⤵
  PID:10700
- C:\Windows\System\KEFJHDQ.exe
  C:\Windows\System\KEFJHDQ.exe
  2⤵
  PID:10948
- C:\Windows\System\fGYDDzV.exe
  C:\Windows\System\fGYDDzV.exe
  2⤵
  PID:10980
- C:\Windows\System\EkNYsSJ.exe
  C:\Windows\System\EkNYsSJ.exe
  2⤵
  PID:11256
- C:\Windows\System\aLSTYIt.exe
  C:\Windows\System\aLSTYIt.exe
  2⤵
  PID:10352
- C:\Windows\System\RssTfih.exe
  C:\Windows\System\RssTfih.exe
  2⤵
  PID:10612
- C:\Windows\System\OjSYCTV.exe
  C:\Windows\System\OjSYCTV.exe
  2⤵
  PID:11008
- C:\Windows\System\jLFxFJr.exe
  C:\Windows\System\jLFxFJr.exe
  2⤵
  PID:10332
- C:\Windows\System\cVShsfp.exe
  C:\Windows\System\cVShsfp.exe
  2⤵
  PID:11308
- C:\Windows\System\VfJhzmF.exe
  C:\Windows\System\VfJhzmF.exe
  2⤵
  PID:11328
- C:\Windows\System\udfIsdX.exe
  C:\Windows\System\udfIsdX.exe
  2⤵
  PID:11344
- C:\Windows\System\HEMiusq.exe
  C:\Windows\System\HEMiusq.exe
  2⤵
  PID:11360
- C:\Windows\System\CoBpOIM.exe
  C:\Windows\System\CoBpOIM.exe
  2⤵
  PID:11380
- C:\Windows\System\lmkgrKv.exe
  C:\Windows\System\lmkgrKv.exe
  2⤵
  PID:11428
- C:\Windows\System\SUwGYOs.exe
  C:\Windows\System\SUwGYOs.exe
  2⤵
  PID:11460
- C:\Windows\System\zEuUUMr.exe
  C:\Windows\System\zEuUUMr.exe
  2⤵
  PID:11480
- C:\Windows\System\dSGjsvw.exe
  C:\Windows\System\dSGjsvw.exe
  2⤵
  PID:11504
- C:\Windows\System\yrjusWx.exe
  C:\Windows\System\yrjusWx.exe
  2⤵
  PID:11524
- C:\Windows\System\NiDCOKu.exe
  C:\Windows\System\NiDCOKu.exe
  2⤵
  PID:11544
- C:\Windows\System\hctzHsI.exe
  C:\Windows\System\hctzHsI.exe
  2⤵
  PID:11580
- C:\Windows\System\xalzdLN.exe
  C:\Windows\System\xalzdLN.exe
  2⤵
  PID:11624
- C:\Windows\System\PlcWxhY.exe
  C:\Windows\System\PlcWxhY.exe
  2⤵
  PID:11644
- C:\Windows\System\AzAzKJf.exe
  C:\Windows\System\AzAzKJf.exe
  2⤵
  PID:11664
- C:\Windows\System\BXuyxco.exe
  C:\Windows\System\BXuyxco.exe
  2⤵
  PID:11688
- C:\Windows\System\AHLdOSn.exe
  C:\Windows\System\AHLdOSn.exe
  2⤵
  PID:11704
- C:\Windows\System\ihxVtdp.exe
  C:\Windows\System\ihxVtdp.exe
  2⤵
  PID:11780
- C:\Windows\System\OWQKXuR.exe
  C:\Windows\System\OWQKXuR.exe
  2⤵
  PID:11800
- C:\Windows\System\cddOtna.exe
  C:\Windows\System\cddOtna.exe
  2⤵
  PID:11820
- C:\Windows\System\djkoZuy.exe
  C:\Windows\System\djkoZuy.exe
  2⤵
  PID:11852
- C:\Windows\System\vRMJsta.exe
  C:\Windows\System\vRMJsta.exe
  2⤵
  PID:11868
- C:\Windows\System\lneZbjF.exe
  C:\Windows\System\lneZbjF.exe
  2⤵
  PID:11896
- C:\Windows\System\NSSwXWq.exe
  C:\Windows\System\NSSwXWq.exe
  2⤵
  PID:11916
- C:\Windows\System\ZrNYRla.exe
  C:\Windows\System\ZrNYRla.exe
  2⤵
  PID:11940
- C:\Windows\System\ZlBBNMF.exe
  C:\Windows\System\ZlBBNMF.exe
  2⤵
  PID:11968
- C:\Windows\System\ZoSEqML.exe
  C:\Windows\System\ZoSEqML.exe
  2⤵
  PID:12032
- C:\Windows\System\jZBdzXR.exe
  C:\Windows\System\jZBdzXR.exe
  2⤵
  PID:12064
- C:\Windows\System\RTczLiq.exe
  C:\Windows\System\RTczLiq.exe
  2⤵
  PID:12084
- C:\Windows\System\jjwNeTG.exe
  C:\Windows\System\jjwNeTG.exe
  2⤵
  PID:12104
- C:\Windows\System\LnORBgr.exe
  C:\Windows\System\LnORBgr.exe
  2⤵
  PID:12136
- C:\Windows\System\XRBCUgj.exe
  C:\Windows\System\XRBCUgj.exe
  2⤵
  PID:12160
- C:\Windows\System\xMKixqE.exe
  C:\Windows\System\xMKixqE.exe
  2⤵
  PID:12184
- C:\Windows\System\YExzwlm.exe
  C:\Windows\System\YExzwlm.exe
  2⤵
  PID:12200
- C:\Windows\System\DAblDzh.exe
  C:\Windows\System\DAblDzh.exe
  2⤵
  PID:12264
- C:\Windows\System\WnYTNom.exe
  C:\Windows\System\WnYTNom.exe
  2⤵
  PID:12284
- C:\Windows\System\arHRTjd.exe
  C:\Windows\System\arHRTjd.exe
  2⤵
  PID:11212
- C:\Windows\System\QfLYsRP.exe
  C:\Windows\System\QfLYsRP.exe
  2⤵
  PID:11336
- C:\Windows\System\LSDyXgi.exe
  C:\Windows\System\LSDyXgi.exe
  2⤵
  PID:11356
- C:\Windows\System\NBcnzXe.exe
  C:\Windows\System\NBcnzXe.exe
  2⤵
  PID:11420
- C:\Windows\System\qpGXirn.exe
  C:\Windows\System\qpGXirn.exe
  2⤵
  PID:11468
- C:\Windows\System\HfrUCuP.exe
  C:\Windows\System\HfrUCuP.exe
  2⤵
  PID:11564
- C:\Windows\System\KaAjVSf.exe
  C:\Windows\System\KaAjVSf.exe
  2⤵
  PID:11640
- C:\Windows\System\tYgbVQb.exe
  C:\Windows\System\tYgbVQb.exe
  2⤵
  PID:11676
- C:\Windows\System\STchJrn.exe
  C:\Windows\System\STchJrn.exe
  2⤵
  PID:11772
- C:\Windows\System\NFJFCrZ.exe
  C:\Windows\System\NFJFCrZ.exe
  2⤵
  PID:11864
- C:\Windows\System\IAOVnEs.exe
  C:\Windows\System\IAOVnEs.exe
  2⤵
  PID:11888
- C:\Windows\System\QdXSPZs.exe
  C:\Windows\System\QdXSPZs.exe
  2⤵
  PID:11936
- C:\Windows\System\dgPWcXi.exe
  C:\Windows\System\dgPWcXi.exe
  2⤵
  PID:11992
- C:\Windows\System\pEbBnTI.exe
  C:\Windows\System\pEbBnTI.exe
  2⤵
  PID:12056
- C:\Windows\System\etfFzWS.exe
  C:\Windows\System\etfFzWS.exe
  2⤵
  PID:12128
- C:\Windows\System\kRoZaWC.exe
  C:\Windows\System\kRoZaWC.exe
  2⤵
  PID:12192
- C:\Windows\System\fQvDBBM.exe
  C:\Windows\System\fQvDBBM.exe
  2⤵
  PID:12244
- C:\Windows\System\FLzZfne.exe
  C:\Windows\System\FLzZfne.exe
  2⤵
  PID:12280
- C:\Windows\System\JqmffTX.exe
  C:\Windows\System\JqmffTX.exe
  2⤵
  PID:11448
- C:\Windows\System\KLYxznV.exe
  C:\Windows\System\KLYxznV.exe
  2⤵
  PID:11576
- C:\Windows\System\cTqCenY.exe
  C:\Windows\System\cTqCenY.exe
  2⤵
  PID:11532
- C:\Windows\System\PaFBuXm.exe
  C:\Windows\System\PaFBuXm.exe
  2⤵
  PID:11700
- C:\Windows\System\hnXqCUo.exe
  C:\Windows\System\hnXqCUo.exe
  2⤵
  PID:11832
- C:\Windows\System\oiANZYo.exe
  C:\Windows\System\oiANZYo.exe
  2⤵
  PID:11960
- C:\Windows\System\vVHJLDt.exe
  C:\Windows\System\vVHJLDt.exe
  2⤵
  PID:12228
- C:\Windows\System\gBhGdty.exe
  C:\Windows\System\gBhGdty.exe
  2⤵
  PID:11320
- C:\Windows\System\wKXNdpD.exe
  C:\Windows\System\wKXNdpD.exe
  2⤵
  PID:11500
- C:\Windows\System\jLbcxah.exe
  C:\Windows\System\jLbcxah.exe
  2⤵
  PID:11984
- C:\Windows\System\RBdGgZm.exe
  C:\Windows\System\RBdGgZm.exe
  2⤵
  PID:11912
- C:\Windows\System\dEABfNj.exe
  C:\Windows\System\dEABfNj.exe
  2⤵
  PID:11612
- C:\Windows\System\jFKnUSb.exe
  C:\Windows\System\jFKnUSb.exe
  2⤵
  PID:12296
- C:\Windows\System\cqMRrbz.exe
  C:\Windows\System\cqMRrbz.exe
  2⤵
  PID:12336
- C:\Windows\System\ZmVaaNL.exe
  C:\Windows\System\ZmVaaNL.exe
  2⤵
  PID:12360
- C:\Windows\System\xWdCPpQ.exe
  C:\Windows\System\xWdCPpQ.exe
  2⤵
  PID:12392
- C:\Windows\System\ubcmISu.exe
  C:\Windows\System\ubcmISu.exe
  2⤵
  PID:12424
- C:\Windows\System\mLyjgea.exe
  C:\Windows\System\mLyjgea.exe
  2⤵
  PID:12448
- C:\Windows\System\xmsstui.exe
  C:\Windows\System\xmsstui.exe
  2⤵
  PID:12476
- C:\Windows\System\JkeRxrT.exe
  C:\Windows\System\JkeRxrT.exe
  2⤵
  PID:12496
- C:\Windows\System\KBxXQcx.exe
  C:\Windows\System\KBxXQcx.exe
  2⤵
  PID:12516
- C:\Windows\System\smMEvUn.exe
  C:\Windows\System\smMEvUn.exe
  2⤵
  PID:12556
- C:\Windows\System\hYKeDJJ.exe
  C:\Windows\System\hYKeDJJ.exe
  2⤵
  PID:12580
- C:\Windows\System\BANGJoI.exe
  C:\Windows\System\BANGJoI.exe
  2⤵
  PID:12608
- C:\Windows\System\fessAWR.exe
  C:\Windows\System\fessAWR.exe
  2⤵
  PID:12632
- C:\Windows\System\zZgUQia.exe
  C:\Windows\System\zZgUQia.exe
  2⤵
  PID:12652
- C:\Windows\System\ylVvnPP.exe
  C:\Windows\System\ylVvnPP.exe
  2⤵
  PID:12696
- C:\Windows\System\rQvsGpV.exe
  C:\Windows\System\rQvsGpV.exe
  2⤵
  PID:12724
- C:\Windows\System\xcTjfoa.exe
  C:\Windows\System\xcTjfoa.exe
  2⤵
  PID:12752
- C:\Windows\System\cwOHlSo.exe
  C:\Windows\System\cwOHlSo.exe
  2⤵
  PID:12776
- C:\Windows\System\aofFDRB.exe
  C:\Windows\System\aofFDRB.exe
  2⤵
  PID:12792
- C:\Windows\System\wKXEyTh.exe
  C:\Windows\System\wKXEyTh.exe
  2⤵
  PID:12812
- C:\Windows\System\YzWhqmP.exe
  C:\Windows\System\YzWhqmP.exe
  2⤵
  PID:12836
- C:\Windows\System\bcHeDtK.exe
  C:\Windows\System\bcHeDtK.exe
  2⤵
  PID:12852
- C:\Windows\System\RnnMuqi.exe
  C:\Windows\System\RnnMuqi.exe
  2⤵
  PID:12872
- C:\Windows\System\jPtpuVQ.exe
  C:\Windows\System\jPtpuVQ.exe
  2⤵
  PID:12924
- C:\Windows\System\ePeRFjM.exe
  C:\Windows\System\ePeRFjM.exe
  2⤵
  PID:12944
- C:\Windows\System\zVKtacb.exe
  C:\Windows\System\zVKtacb.exe
  2⤵
  PID:12988
- C:\Windows\System\ZbyJugt.exe
  C:\Windows\System\ZbyJugt.exe
  2⤵
  PID:13016
- C:\Windows\System\QezlzEE.exe
  C:\Windows\System\QezlzEE.exe
  2⤵
  PID:13036
- C:\Windows\System\KiKPPEa.exe
  C:\Windows\System\KiKPPEa.exe
  2⤵
  PID:13064
- C:\Windows\System\BZQHDzC.exe
  C:\Windows\System\BZQHDzC.exe
  2⤵
  PID:13084
- C:\Windows\System\fogXVEE.exe
  C:\Windows\System\fogXVEE.exe
  2⤵
  PID:13136
- C:\Windows\System\LKqyMML.exe
  C:\Windows\System\LKqyMML.exe
  2⤵
  PID:13164
- C:\Windows\System\kLFSUAB.exe
  C:\Windows\System\kLFSUAB.exe
  2⤵
  PID:13200
- C:\Windows\System\olcfbAv.exe
  C:\Windows\System\olcfbAv.exe
  2⤵
  PID:13220
- C:\Windows\System\xizKLmo.exe
  C:\Windows\System\xizKLmo.exe
  2⤵
  PID:13284
- C:\Windows\System\vpBrOUJ.exe
  C:\Windows\System\vpBrOUJ.exe
  2⤵
  PID:4748
- C:\Windows\System\BjumvWa.exe
  C:\Windows\System\BjumvWa.exe
  2⤵
  PID:12372
- C:\Windows\System\JPxooEI.exe
  C:\Windows\System\JPxooEI.exe
  2⤵
  PID:12384
- C:\Windows\System\PFArnsp.exe
  C:\Windows\System\PFArnsp.exe
  2⤵
  PID:12484
- C:\Windows\System\gdDzdWI.exe
  C:\Windows\System\gdDzdWI.exe
  2⤵
  PID:12552
- C:\Windows\System\NKFVvcv.exe
  C:\Windows\System\NKFVvcv.exe
  2⤵
  PID:12572
- C:\Windows\System\FIJuReE.exe
  C:\Windows\System\FIJuReE.exe
  2⤵
  PID:12704
- C:\Windows\System\VuNkJps.exe
  C:\Windows\System\VuNkJps.exe
  2⤵
  PID:12748
- C:\Windows\System\rUgRagY.exe
  C:\Windows\System\rUgRagY.exe
  2⤵
  PID:12804
- C:\Windows\System\jTXGnWs.exe
  C:\Windows\System\jTXGnWs.exe
  2⤵
  PID:1684
- C:\Windows\System\kGXWVJL.exe
  C:\Windows\System\kGXWVJL.exe
  2⤵
  PID:13276
- C:\Windows\System\UQpbAmi.exe
  C:\Windows\System\UQpbAmi.exe
  2⤵
  PID:13272
- C:\Windows\System\IxUYvbo.exe
  C:\Windows\System\IxUYvbo.exe
  2⤵
  PID:11572
- C:\Windows\System\exSimxN.exe
  C:\Windows\System\exSimxN.exe
  2⤵
  PID:13228
- C:\Windows\System\bEIMiGL.exe
  C:\Windows\System\bEIMiGL.exe
  2⤵
  PID:13280
- C:\Windows\System\kITSDho.exe
  C:\Windows\System\kITSDho.exe
  2⤵
  PID:12328
- C:\Windows\System\FNykkxu.exe
  C:\Windows\System\FNykkxu.exe
  2⤵
  PID:12376
- C:\Windows\System\MxqFgao.exe
  C:\Windows\System\MxqFgao.exe
  2⤵
  PID:1964
- C:\Windows\System\rmKzrFv.exe
  C:\Windows\System\rmKzrFv.exe
  2⤵
  PID:12712
- C:\Windows\System\DSUhIyO.exe
  C:\Windows\System\DSUhIyO.exe
  2⤵
  PID:12788
- C:\Windows\System\bvhckRy.exe
  C:\Windows\System\bvhckRy.exe
  2⤵
  PID:12936
- C:\Windows\System\cdRZrKN.exe
  C:\Windows\System\cdRZrKN.exe
  2⤵
  PID:4220
- C:\Windows\System\VYhpHBO.exe
  C:\Windows\System\VYhpHBO.exe
  2⤵
  PID:3792
- C:\Windows\System\meqhdsC.exe
  C:\Windows\System\meqhdsC.exe
  2⤵
  PID:4740
- C:\Windows\System\YNvPJvt.exe
  C:\Windows\System\YNvPJvt.exe
  2⤵
  PID:3628
- C:\Windows\System\fyOosCs.exe
  C:\Windows\System\fyOosCs.exe
  2⤵
  PID:13076
- C:\Windows\System\SWtyxnB.exe
  C:\Windows\System\SWtyxnB.exe
  2⤵
  PID:3212
- C:\Windows\System\WzHWZlC.exe
  C:\Windows\System\WzHWZlC.exe
  2⤵
  PID:3228
- C:\Windows\System\XQqalhF.exe
  C:\Windows\System\XQqalhF.exe
  2⤵
  PID:2556
- C:\Windows\System\aIClQGG.exe
  C:\Windows\System\aIClQGG.exe
  2⤵
  PID:6544
- C:\Windows\System\CGpBbon.exe
  C:\Windows\System\CGpBbon.exe
  2⤵
  PID:12456
- C:\Windows\System\jJVNWNu.exe
  C:\Windows\System\jJVNWNu.exe
  2⤵
  PID:12904
- C:\Windows\System\wEhEsAz.exe
  C:\Windows\System\wEhEsAz.exe
  2⤵
  PID:1392
- C:\Windows\System\HwCnVvD.exe
  C:\Windows\System\HwCnVvD.exe
  2⤵
  PID:6988
- C:\Windows\System\XvuvmeP.exe
  C:\Windows\System\XvuvmeP.exe
  2⤵
  PID:3000
- C:\Windows\System\eTQYjeF.exe
  C:\Windows\System\eTQYjeF.exe
  2⤵
  PID:7504
- C:\Windows\System\XEBfxEe.exe
  C:\Windows\System\XEBfxEe.exe
  2⤵
  PID:7072
- C:\Windows\System\SOhJtYP.exe
  C:\Windows\System\SOhJtYP.exe
  2⤵
  PID:4644
- C:\Windows\System\KIobzMq.exe
  C:\Windows\System\KIobzMq.exe
  2⤵
  PID:3960
- C:\Windows\System\toPVmkQ.exe
  C:\Windows\System\toPVmkQ.exe
  2⤵
  PID:5088
- C:\Windows\System\aYjpRLy.exe
  C:\Windows\System\aYjpRLy.exe
  2⤵
  PID:2312
- C:\Windows\System\oVlUsHO.exe
  C:\Windows\System\oVlUsHO.exe
  2⤵
  PID:13080
- C:\Windows\System\yVwnXsH.exe
  C:\Windows\System\yVwnXsH.exe
  2⤵
  PID:13192
- C:\Windows\System\SWZatQg.exe
  C:\Windows\System\SWZatQg.exe
  2⤵
  PID:5860
- C:\Windows\System\NJKzizy.exe
  C:\Windows\System\NJKzizy.exe
  2⤵
  PID:7916
- C:\Windows\System\NWJoTQr.exe
  C:\Windows\System\NWJoTQr.exe
  2⤵
  PID:904
- C:\Windows\System\lrNSvbe.exe
  C:\Windows\System\lrNSvbe.exe
  2⤵
  PID:8144
- C:\Windows\System\zhaJIQG.exe
  C:\Windows\System\zhaJIQG.exe
  2⤵
  PID:8172
- C:\Windows\System\KgkWbZT.exe
  C:\Windows\System\KgkWbZT.exe
  2⤵
  PID:5692
- C:\Windows\System\nWOhIXj.exe
  C:\Windows\System\nWOhIXj.exe
  2⤵
  PID:5096
- C:\Windows\System\XmpkSdo.exe
  C:\Windows\System\XmpkSdo.exe
  2⤵
  PID:8092
- C:\Windows\System\EHPcwiw.exe
  C:\Windows\System\EHPcwiw.exe
  2⤵
  PID:2820
- C:\Windows\System\ONgqKuU.exe
  C:\Windows\System\ONgqKuU.exe
  2⤵
  PID:7496
- C:\Windows\System\mThjyIQ.exe
  C:\Windows\System\mThjyIQ.exe
  2⤵
  PID:9084
- C:\Windows\System\ovlUkGm.exe
  C:\Windows\System\ovlUkGm.exe
  2⤵
  PID:7196
- C:\Windows\System\DOYKjHo.exe
  C:\Windows\System\DOYKjHo.exe
  2⤵
  PID:9152
- C:\Windows\System\kLpARTe.exe
  C:\Windows\System\kLpARTe.exe
  2⤵
  PID:12412
- C:\Windows\System\wTMprag.exe
  C:\Windows\System\wTMprag.exe
  2⤵
  PID:8588
- C:\Windows\System\RdoxCfA.exe
  C:\Windows\System\RdoxCfA.exe
  2⤵
  PID:1288
- C:\Windows\System\RzIjzcU.exe
  C:\Windows\System\RzIjzcU.exe
  2⤵
  PID:7824
- C:\Windows\System\CUVTakZ.exe
  C:\Windows\System\CUVTakZ.exe
  2⤵
  PID:7912
- C:\Windows\System\lQsbJGP.exe
  C:\Windows\System\lQsbJGP.exe
  2⤵
  PID:7620
- C:\Windows\System\ITUNnLI.exe
  C:\Windows\System\ITUNnLI.exe
  2⤵
  PID:7400
- C:\Windows\System\eKpbJgu.exe
  C:\Windows\System\eKpbJgu.exe
  2⤵
  PID:3256
- C:\Windows\System\jSBZpAk.exe
  C:\Windows\System\jSBZpAk.exe
  2⤵
  PID:7476
- C:\Windows\System\ljcdpRd.exe
  C:\Windows\System\ljcdpRd.exe
  2⤵
  PID:9428
- C:\Windows\System\ULWOGJM.exe
  C:\Windows\System\ULWOGJM.exe
  2⤵
  PID:4348
- C:\Windows\System\rQmTQaf.exe
  C:\Windows\System\rQmTQaf.exe
  2⤵
  PID:9464
- C:\Windows\System\EihqelH.exe
  C:\Windows\System\EihqelH.exe
  2⤵
  PID:9608
- C:\Windows\System\XezyNIR.exe
  C:\Windows\System\XezyNIR.exe
  2⤵
  PID:2608
- C:\Windows\System\fIePXnz.exe
  C:\Windows\System\fIePXnz.exe
  2⤵
  PID:1780
- C:\Windows\System\pXlcykj.exe
  C:\Windows\System\pXlcykj.exe
  2⤵
  PID:9780
- C:\Windows\System\dwBMPVB.exe
  C:\Windows\System\dwBMPVB.exe
  2⤵
  PID:8656
- C:\Windows\System\SUcKiSm.exe
  C:\Windows\System\SUcKiSm.exe
  2⤵
  PID:9880
- C:\Windows\System\MpUWLVj.exe
  C:\Windows\System\MpUWLVj.exe
  2⤵
  PID:7276
- C:\Windows\System\wbFBLxS.exe
  C:\Windows\System\wbFBLxS.exe
  2⤵
  PID:12332
- C:\Windows\System\tRVDARK.exe
  C:\Windows\System\tRVDARK.exe
  2⤵
  PID:13252
- C:\Windows\System\fZTAFrO.exe
  C:\Windows\System\fZTAFrO.exe
  2⤵
  PID:3660
- C:\Windows\System\uBkFAFW.exe
  C:\Windows\System\uBkFAFW.exe
  2⤵
  PID:1608
- C:\Windows\System\GtTORlB.exe
  C:\Windows\System\GtTORlB.exe
  2⤵
  PID:2128
- C:\Windows\System\qEUvdGN.exe
  C:\Windows\System\qEUvdGN.exe
  2⤵
  PID:3248
- C:\Windows\System\WPyIrkh.exe
  C:\Windows\System\WPyIrkh.exe
  2⤵
  PID:3012
- C:\Windows\System\uGqPotg.exe
  C:\Windows\System\uGqPotg.exe
  2⤵
  PID:8464
- C:\Windows\System\NifiDHb.exe
  C:\Windows\System\NifiDHb.exe
  2⤵
  PID:7052
- C:\Windows\System\qIkdWoC.exe
  C:\Windows\System\qIkdWoC.exe
  2⤵
  PID:7780
- C:\Windows\System\hYHFCjX.exe
  C:\Windows\System\hYHFCjX.exe
  2⤵
  PID:9640
- C:\Windows\System\YXiSNHK.exe
  C:\Windows\System\YXiSNHK.exe
  2⤵
  PID:5448
- C:\Windows\System\aINVijI.exe
  C:\Windows\System\aINVijI.exe
  2⤵
  PID:8980
- C:\Windows\System\TSisCme.exe
  C:\Windows\System\TSisCme.exe
  2⤵
  PID:8184
- C:\Windows\System\GZQwYTA.exe
  C:\Windows\System\GZQwYTA.exe
  2⤵
  PID:2516
- C:\Windows\System\tnNEElo.exe
  C:\Windows\System\tnNEElo.exe
  2⤵
  PID:9240
- C:\Windows\System\VdloHrD.exe
  C:\Windows\System\VdloHrD.exe
  2⤵
  PID:8104
- C:\Windows\System\FuTgGby.exe
  C:\Windows\System\FuTgGby.exe
  2⤵
  PID:8180
- C:\Windows\System\mdjgvtD.exe
  C:\Windows\System\mdjgvtD.exe
  2⤵
  PID:5708
- C:\Windows\System\gDENOKK.exe
  C:\Windows\System\gDENOKK.exe
  2⤵
  PID:5744
- C:\Windows\System\uAQaoat.exe
  C:\Windows\System\uAQaoat.exe
  2⤵
  PID:5800
- C:\Windows\System\QMEUuQI.exe
  C:\Windows\System\QMEUuQI.exe
  2⤵
  PID:5856
- C:\Windows\System\nWdFaOQ.exe
  C:\Windows\System\nWdFaOQ.exe
  2⤵
  PID:9884
- C:\Windows\System\IZOEPdw.exe
  C:\Windows\System\IZOEPdw.exe
  2⤵
  PID:5968
- C:\Windows\System\FMEMTVb.exe
  C:\Windows\System\FMEMTVb.exe
  2⤵
  PID:8196
- C:\Windows\System\JxvvXFD.exe
  C:\Windows\System\JxvvXFD.exe
  2⤵
  PID:10764
- C:\Windows\System\TFuJLnh.exe
  C:\Windows\System\TFuJLnh.exe
  2⤵
  PID:10220
- C:\Windows\System\pJMgxuG.exe
  C:\Windows\System\pJMgxuG.exe
  2⤵
  PID:1504
- C:\Windows\System\pTKpKVG.exe
  C:\Windows\System\pTKpKVG.exe
  2⤵
  PID:5008
- C:\Windows\System\DVTDsbo.exe
  C:\Windows\System\DVTDsbo.exe
  2⤵
  PID:5148
- C:\Windows\System\HnYywGe.exe
  C:\Windows\System\HnYywGe.exe
  2⤵
  PID:8968
- C:\Windows\System\WXfxKFZ.exe
  C:\Windows\System\WXfxKFZ.exe
  2⤵
  PID:4556
- C:\Windows\System\kVxxgPM.exe
  C:\Windows\System\kVxxgPM.exe
  2⤵
  PID:2040
- C:\Windows\System\HOsWNao.exe
  C:\Windows\System\HOsWNao.exe
  2⤵
  PID:11208
- C:\Windows\System\UHLredz.exe
  C:\Windows\System\UHLredz.exe
  2⤵
  PID:11240
- C:\Windows\System\MqBDsuH.exe
  C:\Windows\System\MqBDsuH.exe
  2⤵
  PID:8352
- C:\Windows\System\ILCccbY.exe
  C:\Windows\System\ILCccbY.exe
  2⤵
  PID:7532
- C:\Windows\System\fZJJAdH.exe
  C:\Windows\System\fZJJAdH.exe
  2⤵
  PID:10784
- C:\Windows\System\kxLseuX.exe
  C:\Windows\System\kxLseuX.exe
  2⤵
  PID:5520
- C:\Windows\System\emsgtWE.exe
  C:\Windows\System\emsgtWE.exe
  2⤵
  PID:4968
- C:\Windows\System\LePSpQb.exe
  C:\Windows\System\LePSpQb.exe
  2⤵
  PID:3564
- C:\Windows\System\rQmiJAz.exe
  C:\Windows\System\rQmiJAz.exe
  2⤵
  PID:11016
- C:\Windows\System\WIXpqwo.exe
  C:\Windows\System\WIXpqwo.exe
  2⤵
  PID:9280
- C:\Windows\System\RYdjROl.exe
  C:\Windows\System\RYdjROl.exe
  2⤵
  PID:10908
- C:\Windows\System\KabPwSN.exe
  C:\Windows\System\KabPwSN.exe
  2⤵
  PID:4936
- C:\Windows\System\eZGLeoU.exe
  C:\Windows\System\eZGLeoU.exe
  2⤵
  PID:4872
- C:\Windows\System\evZmQwJ.exe
  C:\Windows\System\evZmQwJ.exe
  2⤵
  PID:4468
- C:\Windows\System\GxgtWTu.exe
  C:\Windows\System\GxgtWTu.exe
  2⤵
  PID:11288
- C:\Windows\System\OdhNQuu.exe
  C:\Windows\System\OdhNQuu.exe
  2⤵
  PID:5364
- C:\Windows\System\Yxbvghi.exe
  C:\Windows\System\Yxbvghi.exe
  2⤵
  PID:3252
- C:\Windows\System\kMxrTQc.exe
  C:\Windows\System\kMxrTQc.exe
  2⤵
  PID:11488
- C:\Windows\System\OzRGUGT.exe
  C:\Windows\System\OzRGUGT.exe
  2⤵
  PID:6140
- C:\Windows\System\QQTPuyr.exe
  C:\Windows\System\QQTPuyr.exe
  2⤵
  PID:5812
- C:\Windows\System\GdUvRJu.exe
  C:\Windows\System\GdUvRJu.exe
  2⤵
  PID:7756
- C:\Windows\System\MKegbfo.exe
  C:\Windows\System\MKegbfo.exe
  2⤵
  PID:9520
- C:\Windows\System\GEJuwtC.exe
  C:\Windows\System\GEJuwtC.exe
  2⤵
  PID:10424
- C:\Windows\System\jBtFtLI.exe
  C:\Windows\System\jBtFtLI.exe
  2⤵
  PID:1528
- C:\Windows\System\edVltQY.exe
  C:\Windows\System\edVltQY.exe
  2⤵
  PID:10584
- C:\Windows\System\mEJyeoa.exe
  C:\Windows\System\mEJyeoa.exe
  2⤵
  PID:11752
- C:\Windows\System\igsNjXl.exe
  C:\Windows\System\igsNjXl.exe
  2⤵
  PID:8760
- C:\Windows\System\hTwZokn.exe
  C:\Windows\System\hTwZokn.exe
  2⤵
  PID:11764
- C:\Windows\System\UOOcigb.exe
  C:\Windows\System\UOOcigb.exe
  2⤵
  PID:4032
- C:\Windows\System\rITRyiq.exe
  C:\Windows\System\rITRyiq.exe
  2⤵
  PID:10676
- C:\Windows\System\ysGNIKN.exe
  C:\Windows\System\ysGNIKN.exe
  2⤵
  PID:5400
- C:\Windows\System\fcfgSnH.exe
  C:\Windows\System\fcfgSnH.exe
  2⤵
  PID:10072
- C:\Windows\System\dkRMYBm.exe
  C:\Windows\System\dkRMYBm.exe
  2⤵
  PID:11136
- C:\Windows\System\yLHQngg.exe
  C:\Windows\System\yLHQngg.exe
  2⤵
  PID:5460
- C:\Windows\System\gzsJgAd.exe
  C:\Windows\System\gzsJgAd.exe
  2⤵
  PID:5536
- C:\Windows\System\xMuCKdn.exe
  C:\Windows\System\xMuCKdn.exe
  2⤵
  PID:9292
- C:\Windows\System\YowDRrd.exe
  C:\Windows\System\YowDRrd.exe
  2⤵
  PID:4572
- C:\Windows\System\FGEXRuz.exe
  C:\Windows\System\FGEXRuz.exe
  2⤵
  PID:8048
- C:\Windows\System\XxWdzDY.exe
  C:\Windows\System\XxWdzDY.exe
  2⤵
  PID:10892
- C:\Windows\System\RQmgjCt.exe
  C:\Windows\System\RQmgjCt.exe
  2⤵
  PID:5768
- C:\Windows\System\bNcmGXu.exe
  C:\Windows\System\bNcmGXu.exe
  2⤵
  PID:8652
- C:\Windows\System\LLbpBzS.exe
  C:\Windows\System\LLbpBzS.exe
  2⤵
  PID:5788
- C:\Windows\System\rUaGysU.exe
  C:\Windows\System\rUaGysU.exe
  2⤵
  PID:11028
- C:\Windows\System\OmaNDTe.exe
  C:\Windows\System\OmaNDTe.exe
  2⤵
  PID:2252
- C:\Windows\System\VFKYMEA.exe
  C:\Windows\System\VFKYMEA.exe
  2⤵
  PID:12272
- C:\Windows\System\dZINMWD.exe
  C:\Windows\System\dZINMWD.exe
  2⤵
  PID:11184
- C:\Windows\System\mvslTiX.exe
  C:\Windows\System\mvslTiX.exe
  2⤵
  PID:12660
- C:\Windows\System\ULCgWFp.exe
  C:\Windows\System\ULCgWFp.exe
  2⤵
  PID:10580
- C:\Windows\System\kzmEjrt.exe
  C:\Windows\System\kzmEjrt.exe
  2⤵
  PID:11848
- C:\Windows\System\LlOeNVR.exe
  C:\Windows\System\LlOeNVR.exe
  2⤵
  PID:7056
- C:\Windows\System\duDVLha.exe
  C:\Windows\System\duDVLha.exe
  2⤵
  PID:4156
- C:\Windows\System\ihrIdNa.exe
  C:\Windows\System\ihrIdNa.exe
  2⤵
  PID:8096
- C:\Windows\System\vHKSygn.exe
  C:\Windows\System\vHKSygn.exe
  2⤵
  PID:10820
- C:\Windows\System\KgJrKpU.exe
  C:\Windows\System\KgJrKpU.exe
  2⤵
  PID:4328
- C:\Windows\System\NICsbYW.exe
  C:\Windows\System\NICsbYW.exe
  2⤵
  PID:5212
- C:\Windows\System\rzamcEc.exe
  C:\Windows\System\rzamcEc.exe
  2⤵
  PID:12152
- C:\Windows\System\kdSzuPC.exe
  C:\Windows\System\kdSzuPC.exe
  2⤵
  PID:6424
- C:\Windows\System\rNtnyNI.exe
  C:\Windows\System\rNtnyNI.exe
  2⤵
  PID:6476
- C:\Windows\System\mbwXzTk.exe
  C:\Windows\System\mbwXzTk.exe
  2⤵
  PID:6196
- C:\Windows\System\XOsPKEb.exe
  C:\Windows\System\XOsPKEb.exe
  2⤵
  PID:10468
- C:\Windows\System\MBXUujP.exe
  C:\Windows\System\MBXUujP.exe
  2⤵
  PID:10704
- C:\Windows\System\IcsTPdJ.exe
  C:\Windows\System\IcsTPdJ.exe
  2⤵
  PID:12432
- C:\Windows\System\UFwwCqe.exe
  C:\Windows\System\UFwwCqe.exe
  2⤵
  PID:4300
- C:\Windows\System\VZaDJiz.exe
  C:\Windows\System\VZaDJiz.exe
  2⤵
  PID:464
- C:\Windows\System\AhLdwJb.exe
  C:\Windows\System\AhLdwJb.exe
  2⤵
  PID:12568
- C:\Windows\System\qesWfOB.exe
  C:\Windows\System\qesWfOB.exe
  2⤵
  PID:5000
- C:\Windows\System\elvxkOS.exe
  C:\Windows\System\elvxkOS.exe
  2⤵
  PID:12684
- C:\Windows\System\DYtfIKE.exe
  C:\Windows\System\DYtfIKE.exe
  2⤵
  PID:10484
- C:\Windows\System\jpddGJo.exe
  C:\Windows\System\jpddGJo.exe
  2⤵
  PID:6352
- C:\Windows\System\KVdrnXl.exe
  C:\Windows\System\KVdrnXl.exe
  2⤵
  PID:5156
- C:\Windows\System\UWxjctr.exe
  C:\Windows\System\UWxjctr.exe
  2⤵
  PID:12896
- C:\Windows\System\cLMlmDJ.exe
  C:\Windows\System\cLMlmDJ.exe
  2⤵
  PID:12932
- C:\Windows\System\iTvQCjU.exe
  C:\Windows\System\iTvQCjU.exe
  2⤵
  PID:6464
- C:\Windows\System\zWXxnQz.exe
  C:\Windows\System\zWXxnQz.exe
  2⤵
  PID:13024
- C:\Windows\System\XcLXLfS.exe
  C:\Windows\System\XcLXLfS.exe
  2⤵
  PID:6484
- C:\Windows\System\PJAdLMa.exe
  C:\Windows\System\PJAdLMa.exe
  2⤵
  PID:7028
- C:\Windows\System\QPSOHhr.exe
  C:\Windows\System\QPSOHhr.exe
  2⤵
  PID:6540
- C:\Windows\System\uatmgck.exe
  C:\Windows\System\uatmgck.exe
  2⤵
  PID:9228
- C:\Windows\System\mgEncQS.exe
  C:\Windows\System\mgEncQS.exe
  2⤵
  PID:6068
- C:\Windows\System\cTCxiPJ.exe
  C:\Windows\System\cTCxiPJ.exe
  2⤵
  PID:2360
- C:\Windows\System\ODGOxnm.exe
  C:\Windows\System\ODGOxnm.exe
  2⤵
  PID:968
- C:\Windows\System\PdVefpS.exe
  C:\Windows\System\PdVefpS.exe
  2⤵
  PID:5076
- C:\Windows\System\JbweqXe.exe
  C:\Windows\System\JbweqXe.exe
  2⤵
  PID:6364
- C:\Windows\System\YbYInfq.exe
  C:\Windows\System\YbYInfq.exe
  2⤵
  PID:6336
- C:\Windows\System\XBaAVKT.exe
  C:\Windows\System\XBaAVKT.exe
  2⤵
  PID:6448
- C:\Windows\System\EhgiSFC.exe
  C:\Windows\System\EhgiSFC.exe
  2⤵
  PID:11088
- C:\Windows\System\UMgkdJc.exe
  C:\Windows\System\UMgkdJc.exe
  2⤵
  PID:6564
- C:\Windows\System\DKleHnr.exe
  C:\Windows\System\DKleHnr.exe
  2⤵
  PID:8632
- C:\Windows\System\UfYflus.exe
  C:\Windows\System\UfYflus.exe
  2⤵
  PID:10152
- C:\Windows\System\KCDfzoe.exe
  C:\Windows\System\KCDfzoe.exe
  2⤵
  PID:1020
- C:\Windows\System\uLSSnnl.exe
  C:\Windows\System\uLSSnnl.exe
  2⤵
  PID:6592
- C:\Windows\System\fdMAWCW.exe
  C:\Windows\System\fdMAWCW.exe
  2⤵
  PID:11172
- C:\Windows\System\EbOSdUu.exe
  C:\Windows\System\EbOSdUu.exe
  2⤵
  PID:6236
- C:\Windows\System\pvOHtCG.exe
  C:\Windows\System\pvOHtCG.exe
  2⤵
  PID:2064
- C:\Windows\System\CBabWiM.exe
  C:\Windows\System\CBabWiM.exe
  2⤵
  PID:6848
- C:\Windows\System\rSbEMvs.exe
  C:\Windows\System\rSbEMvs.exe
  2⤵
  PID:12744
- C:\Windows\System\lltScDB.exe
  C:\Windows\System\lltScDB.exe
  2⤵
  PID:3636
- C:\Windows\System\qYKOHux.exe
  C:\Windows\System\qYKOHux.exe
  2⤵
  PID:5236
- C:\Windows\System\mLSaIEj.exe
  C:\Windows\System\mLSaIEj.exe
  2⤵
  PID:412
- C:\Windows\System\lQVnmJw.exe
  C:\Windows\System\lQVnmJw.exe
  2⤵
  PID:6928
- C:\Windows\System\CdJZOZh.exe
  C:\Windows\System\CdJZOZh.exe
  2⤵
  PID:4104
- C:\Windows\System\HxkysuK.exe
  C:\Windows\System\HxkysuK.exe
  2⤵
  PID:6516
- C:\Windows\System\dKCptXY.exe
  C:\Windows\System\dKCptXY.exe
  2⤵
  PID:6796
- C:\Windows\System\FswcuMq.exe
  C:\Windows\System\FswcuMq.exe
  2⤵
  PID:13208
- C:\Windows\System\qOzfKfd.exe
  C:\Windows\System\qOzfKfd.exe
  2⤵
  PID:7096
- C:\Windows\System\wOasizT.exe
  C:\Windows\System\wOasizT.exe
  2⤵
  PID:7152
- C:\Windows\System\YvCyQWq.exe
  C:\Windows\System\YvCyQWq.exe
  2⤵
  PID:6000
- C:\Windows\System\zcZEPiq.exe
  C:\Windows\System\zcZEPiq.exe
  2⤵
  PID:10800
- C:\Windows\System\WbpnWZg.exe
  C:\Windows\System\WbpnWZg.exe
  2⤵
  PID:12784
- C:\Windows\System\mABnOQL.exe
  C:\Windows\System\mABnOQL.exe
  2⤵
  PID:5900
- C:\Windows\System\eZtBIsL.exe
  C:\Windows\System\eZtBIsL.exe
  2⤵
  PID:7484
- C:\Windows\System\batqgdq.exe
  C:\Windows\System\batqgdq.exe
  2⤵
  PID:3864
- C:\Windows\System\rgmsXGS.exe
  C:\Windows\System\rgmsXGS.exe
  2⤵
  PID:11352
- C:\Windows\System\GKESBHm.exe
  C:\Windows\System\GKESBHm.exe
  2⤵
  PID:6872
- C:\Windows\System\RrYRxzJ.exe
  C:\Windows\System\RrYRxzJ.exe
  2⤵
  PID:7800
- C:\Windows\System\BWfPMjC.exe
  C:\Windows\System\BWfPMjC.exe
  2⤵
  PID:5912
- C:\Windows\System\NmynhwF.exe
  C:\Windows\System\NmynhwF.exe
  2⤵
  PID:5180
- C:\Windows\System\nusHGdT.exe
  C:\Windows\System\nusHGdT.exe
  2⤵
  PID:816
- C:\Windows\System\kIualZJ.exe
  C:\Windows\System\kIualZJ.exe
  2⤵
  PID:3992
- C:\Windows\System\JrwUFxG.exe
  C:\Windows\System\JrwUFxG.exe
  2⤵
  PID:7408
- C:\Windows\System\GcPAsxq.exe
  C:\Windows\System\GcPAsxq.exe
  2⤵
  PID:5160
- C:\Windows\System\ulfmOnp.exe
  C:\Windows\System\ulfmOnp.exe
  2⤵
  PID:7752
- C:\Windows\System\nRSkOWV.exe
  C:\Windows\System\nRSkOWV.exe
  2⤵
  PID:7200
- C:\Windows\System\GiklQQl.exe
  C:\Windows\System\GiklQQl.exe
  2⤵
  PID:6792
- C:\Windows\System\tavdzcb.exe
  C:\Windows\System\tavdzcb.exe
  2⤵
  PID:2284
- C:\Windows\System\tPXxUeQ.exe
  C:\Windows\System\tPXxUeQ.exe
  2⤵
  PID:7292
- C:\Windows\System\AplrffX.exe
  C:\Windows\System\AplrffX.exe
  2⤵
  PID:6320
- C:\Windows\System\fkbWPxp.exe
  C:\Windows\System\fkbWPxp.exe
  2⤵
  PID:12664
- C:\Windows\System\ANMJrqM.exe
  C:\Windows\System\ANMJrqM.exe
  2⤵
  PID:7540
- C:\Windows\System\QieLSiq.exe
  C:\Windows\System\QieLSiq.exe
  2⤵
  PID:11656
- C:\Windows\System\Cdvtdla.exe
  C:\Windows\System\Cdvtdla.exe
  2⤵
  PID:7956
- C:\Windows\System\LiemXpm.exe
  C:\Windows\System\LiemXpm.exe
  2⤵
  PID:6420
- C:\Windows\System\qpWnZVL.exe
  C:\Windows\System\qpWnZVL.exe
  2⤵
  PID:11252
- C:\Windows\System\GMTiXJm.exe
  C:\Windows\System\GMTiXJm.exe
  2⤵
  PID:6532
- C:\Windows\System\ExKXcAX.exe
  C:\Windows\System\ExKXcAX.exe
  2⤵
  PID:7836
- C:\Windows\System\WZUTaOV.exe
  C:\Windows\System\WZUTaOV.exe
  2⤵
  PID:8772
- C:\Windows\System\mpGMFzi.exe
  C:\Windows\System\mpGMFzi.exe
  2⤵
  PID:8308
- C:\Windows\System\abruIXj.exe
  C:\Windows\System\abruIXj.exe
  2⤵
  PID:8576
- C:\Windows\System\pQzHWdP.exe
  C:\Windows\System\pQzHWdP.exe
  2⤵
  PID:7808
- C:\Windows\System\crzlMby.exe
  C:\Windows\System\crzlMby.exe
  2⤵
  PID:8636
- C:\Windows\System\NuzvshD.exe
  C:\Windows\System\NuzvshD.exe
  2⤵
  PID:4292
- C:\Windows\System\QXvTtpN.exe
  C:\Windows\System\QXvTtpN.exe
  2⤵
  PID:8580
- C:\Windows\System\NbMgrFc.exe
  C:\Windows\System\NbMgrFc.exe
  2⤵
  PID:8916
- C:\Windows\System\wpXxCKX.exe
  C:\Windows\System\wpXxCKX.exe
  2⤵
  PID:5508
- C:\Windows\System\JTcRjcc.exe
  C:\Windows\System\JTcRjcc.exe
  2⤵
  PID:6700
- C:\Windows\System\SAKzmFT.exe
  C:\Windows\System\SAKzmFT.exe
  2⤵
  PID:6760
- C:\Windows\System\ZHxxrul.exe
  C:\Windows\System\ZHxxrul.exe
  2⤵
  PID:7884
- C:\Windows\System\qpNzoyD.exe
  C:\Windows\System\qpNzoyD.exe
  2⤵
  PID:7428
- C:\Windows\System\yGrtqCN.exe
  C:\Windows\System\yGrtqCN.exe
  2⤵
  PID:7248
- C:\Windows\System\cKHNLiE.exe
  C:\Windows\System\cKHNLiE.exe
  2⤵
  PID:11004
- C:\Windows\System\VnehTib.exe
  C:\Windows\System\VnehTib.exe
  2⤵
  PID:7140
- C:\Windows\System\RxHOTkS.exe
  C:\Windows\System\RxHOTkS.exe
  2⤵
  PID:7672
- C:\Windows\System\sypnKZn.exe
  C:\Windows\System\sypnKZn.exe
  2⤵
  PID:7216
- C:\Windows\System\pdkUVsX.exe
  C:\Windows\System\pdkUVsX.exe
  2⤵
  PID:3400
- C:\Windows\System\dTUwavw.exe
  C:\Windows\System\dTUwavw.exe
  2⤵
  PID:7832
- C:\Windows\System\aQYRSCa.exe
  C:\Windows\System\aQYRSCa.exe
  2⤵
  PID:6580
- C:\Windows\System\upwQydl.exe
  C:\Windows\System\upwQydl.exe
  2⤵
  PID:8808
- C:\Windows\System\CGGMdQj.exe
  C:\Windows\System\CGGMdQj.exe
  2⤵
  PID:7596
- C:\Windows\System\gcFHIuF.exe
  C:\Windows\System\gcFHIuF.exe
  2⤵
  PID:7820
- C:\Windows\System\aNlmxVd.exe
  C:\Windows\System\aNlmxVd.exe
  2⤵
  PID:12400
- C:\Windows\System\sQGyPpO.exe
  C:\Windows\System\sQGyPpO.exe
  2⤵
  PID:3772
- C:\Windows\System\oNokcTr.exe
  C:\Windows\System\oNokcTr.exe
  2⤵
  PID:13348
- C:\Windows\System\rXlOqYz.exe
  C:\Windows\System\rXlOqYz.exe
  2⤵
  PID:13372
- C:\Windows\System\zGmHhar.exe
  C:\Windows\System\zGmHhar.exe
  2⤵
  PID:13400
- C:\Windows\System\kqhDuNJ.exe
  C:\Windows\System\kqhDuNJ.exe
  2⤵
  PID:13428
- C:\Windows\System\MEtUEDw.exe
  C:\Windows\System\MEtUEDw.exe
  2⤵
  PID:13452
- C:\Windows\System\FJdCUkp.exe
  C:\Windows\System\FJdCUkp.exe
  2⤵
  PID:13488
- C:\Windows\System\KEMMWEt.exe
  C:\Windows\System\KEMMWEt.exe
  2⤵
  PID:13512
- C:\Windows\System\tSlukXc.exe
  C:\Windows\System\tSlukXc.exe
  2⤵
  PID:13552
- C:\Windows\System\BXRnWhC.exe
  C:\Windows\System\BXRnWhC.exe
  2⤵
  PID:13576
- C:\Windows\System\vRJZVUr.exe
  C:\Windows\System\vRJZVUr.exe
  2⤵
  PID:13608
- C:\Windows\System\FkXlTBI.exe
  C:\Windows\System\FkXlTBI.exe
  2⤵
  PID:13632
- C:\Windows\System\xKPddpl.exe
  C:\Windows\System\xKPddpl.exe
  2⤵
  PID:13664
- C:\Windows\System\OfpbARO.exe
  C:\Windows\System\OfpbARO.exe
  2⤵
  PID:13684
- C:\Windows\System\eCzRblW.exe
  C:\Windows\System\eCzRblW.exe
  2⤵
  PID:13716
- C:\Windows\System\kqGUDnV.exe
  C:\Windows\System\kqGUDnV.exe
  2⤵
  PID:13736
- C:\Windows\System\LYnQjqn.exe
  C:\Windows\System\LYnQjqn.exe
  2⤵
  PID:13764
- C:\Windows\System\HGFbrKB.exe
  C:\Windows\System\HGFbrKB.exe
  2⤵
  PID:13796
- C:\Windows\System\VqjkJSG.exe
  C:\Windows\System\VqjkJSG.exe
  2⤵
  PID:13828
- C:\Windows\System\LwtMFll.exe
  C:\Windows\System\LwtMFll.exe
  2⤵
  PID:13864
- C:\Windows\System\Bgwhchm.exe
  C:\Windows\System\Bgwhchm.exe
  2⤵
  PID:13904
- C:\Windows\System\MESgUrc.exe
  C:\Windows\System\MESgUrc.exe
  2⤵
  PID:13932
- C:\Windows\System\qTmnwSm.exe
  C:\Windows\System\qTmnwSm.exe
  2⤵
  PID:14104
- C:\Windows\System\EDaCIkR.exe
  C:\Windows\System\EDaCIkR.exe
  2⤵
  PID:14136
- C:\Windows\System\qDQEViT.exe
  C:\Windows\System\qDQEViT.exe
  2⤵
  PID:14160
- C:\Windows\System\dyMXekk.exe
  C:\Windows\System\dyMXekk.exe
  2⤵
  PID:14196
- C:\Windows\System\CzubLOg.exe
  C:\Windows\System\CzubLOg.exe
  2⤵
  PID:14232
- C:\Windows\System\smDSQyF.exe
  C:\Windows\System\smDSQyF.exe
  2⤵
  PID:14268
- C:\Windows\System\vHWuiEY.exe
  C:\Windows\System\vHWuiEY.exe
  2⤵
  PID:14288
- C:\Windows\System\crICLCo.exe
  C:\Windows\System\crICLCo.exe
  2⤵
  PID:14328
- C:\Windows\System\iePTaDq.exe
  C:\Windows\System\iePTaDq.exe
  2⤵
  PID:5080
- C:\Windows\System\jCoChzA.exe
  C:\Windows\System\jCoChzA.exe
  2⤵
  PID:12680
- C:\Windows\System\NjjbEjo.exe
  C:\Windows\System\NjjbEjo.exe
  2⤵
  PID:8292
- C:\Windows\System\OuJWJoX.exe
  C:\Windows\System\OuJWJoX.exe
  2⤵
  PID:6756
- C:\Windows\System\OWbEKCI.exe
  C:\Windows\System\OWbEKCI.exe
  2⤵
  PID:9492
- C:\Windows\System\MkgwYCw.exe
  C:\Windows\System\MkgwYCw.exe
  2⤵
  PID:9496
- C:\Windows\System\TXWJEou.exe
  C:\Windows\System\TXWJEou.exe
  2⤵
  PID:5712
- C:\Windows\System\MQLWKjx.exe
  C:\Windows\System\MQLWKjx.exe
  2⤵
  PID:5464
- C:\Windows\System\LHdLmwQ.exe
  C:\Windows\System\LHdLmwQ.exe
  2⤵
  PID:5852
- C:\Windows\System\OyxyadD.exe
  C:\Windows\System\OyxyadD.exe
  2⤵
  PID:9452
- C:\Windows\System\XTfgpln.exe
  C:\Windows\System\XTfgpln.exe
  2⤵
  PID:9996
- C:\Windows\System\ntDykAO.exe
  C:\Windows\System\ntDykAO.exe
  2⤵
  PID:13520
- C:\Windows\System\PXHkSFu.exe
  C:\Windows\System\PXHkSFu.exe
  2⤵
  PID:8420
- C:\Windows\System\QvpiLvN.exe
  C:\Windows\System\QvpiLvN.exe
  2⤵
  PID:9720
- C:\Windows\System\QwzFJQf.exe
  C:\Windows\System\QwzFJQf.exe
  2⤵
  PID:8384
- C:\Windows\System\OPrXSjc.exe
  C:\Windows\System\OPrXSjc.exe
  2⤵
  PID:13644
- C:\Windows\System\wBXOLph.exe
  C:\Windows\System\wBXOLph.exe
  2⤵
  PID:13412
- C:\Windows\System\nCiRQiH.exe
  C:\Windows\System\nCiRQiH.exe
  2⤵
  PID:9524
- C:\Windows\System\IikfsII.exe
  C:\Windows\System\IikfsII.exe
  2⤵
  PID:13564
- C:\Windows\System\THdgoNZ.exe
  C:\Windows\System\THdgoNZ.exe
  2⤵
  PID:13344
- C:\Windows\System\OcuwQBS.exe
  C:\Windows\System\OcuwQBS.exe
  2⤵
  PID:13424
- C:\Windows\System\TNtSKos.exe
  C:\Windows\System\TNtSKos.exe
  2⤵
  PID:13948
- C:\Windows\System\kueBsdg.exe
  C:\Windows\System\kueBsdg.exe
  2⤵
  PID:9368
- C:\Windows\System\lPLQCzQ.exe
  C:\Windows\System\lPLQCzQ.exe
  2⤵
  PID:13756
- C:\Windows\System\EbmKxVZ.exe
  C:\Windows\System\EbmKxVZ.exe
  2⤵
  PID:9948
- C:\Windows\System\AQUsXoJ.exe
  C:\Windows\System\AQUsXoJ.exe
  2⤵
  PID:9724
- C:\Windows\System\QpeYWXx.exe
  C:\Windows\System\QpeYWXx.exe
  2⤵
  PID:10132
- C:\Windows\System\aWyPRfo.exe
  C:\Windows\System\aWyPRfo.exe
  2⤵
  PID:10136
- C:\Windows\System\DuJZvhJ.exe
  C:\Windows\System\DuJZvhJ.exe
  2⤵
  PID:14000
- C:\Windows\System\ZhHMdFT.exe
  C:\Windows\System\ZhHMdFT.exe
  2⤵
  PID:12588
- C:\Windows\System\FFNxWVa.exe
  C:\Windows\System\FFNxWVa.exe
  2⤵
  PID:10412
- C:\Windows\System\zXzutxX.exe
  C:\Windows\System\zXzutxX.exe
  2⤵
  PID:9924
- C:\Windows\System\mucJvZD.exe
  C:\Windows\System\mucJvZD.exe
  2⤵
  PID:10124
- C:\Windows\System\kjXbrdS.exe
  C:\Windows\System\kjXbrdS.exe
  2⤵
  PID:14156
- C:\Windows\System\oZDiodJ.exe
  C:\Windows\System\oZDiodJ.exe
  2⤵
  PID:7272
- C:\Windows\System\OZaJsSE.exe
  C:\Windows\System\OZaJsSE.exe
  2⤵
  PID:9448
- C:\Windows\System\jHQrgIN.exe
  C:\Windows\System\jHQrgIN.exe
  2⤵
  PID:10016
- C:\Windows\System\aGxjWeB.exe
  C:\Windows\System\aGxjWeB.exe
  2⤵
  PID:10512
- C:\Windows\System\HtpDMqy.exe
  C:\Windows\System\HtpDMqy.exe
  2⤵
  PID:13656
- C:\Windows\System\SLfuzUe.exe
  C:\Windows\System\SLfuzUe.exe
  2⤵
  PID:8692
- C:\Windows\System\awLLtcu.exe
  C:\Windows\System\awLLtcu.exe
  2⤵
  PID:9436
- C:\Windows\System\abTbHbX.exe
  C:\Windows\System\abTbHbX.exe
  2⤵
  PID:13380
- C:\Windows\System\btZCKGO.exe
  C:\Windows\System\btZCKGO.exe
  2⤵
  PID:7380
- C:\Windows\System\sOOgpIz.exe
  C:\Windows\System\sOOgpIz.exe
  2⤵
  PID:10852
- C:\Windows\System\TumQFaQ.exe
  C:\Windows\System\TumQFaQ.exe
  2⤵
  PID:10592
- C:\Windows\System\DUJuEJE.exe
  C:\Windows\System\DUJuEJE.exe
  2⤵
  PID:10168
- C:\Windows\System\pzbPnoF.exe
  C:\Windows\System\pzbPnoF.exe
  2⤵
  PID:13508
- C:\Windows\System\hCBYPgW.exe
  C:\Windows\System\hCBYPgW.exe
  2⤵
  PID:13604
- C:\Windows\System\lSUpcJW.exe
  C:\Windows\System\lSUpcJW.exe
  2⤵
  PID:13856
- C:\Windows\System\mAGNteP.exe
  C:\Windows\System\mAGNteP.exe
  2⤵
  PID:14172
- C:\Windows\System\NAtkslS.exe
  C:\Windows\System\NAtkslS.exe
  2⤵
  PID:13916
- C:\Windows\System\YYPgLuH.exe
  C:\Windows\System\YYPgLuH.exe
  2⤵
  PID:10520
- C:\Windows\System\fCbfQSb.exe
  C:\Windows\System\fCbfQSb.exe
  2⤵
  PID:9688
- C:\Windows\System\PjySwKJ.exe
  C:\Windows\System\PjySwKJ.exe
  2⤵
  PID:10496
- C:\Windows\System\zZwndtL.exe
  C:\Windows\System\zZwndtL.exe
  2⤵
  PID:10164
- C:\Windows\System\RTEenme.exe
  C:\Windows\System\RTEenme.exe
  2⤵
  PID:9692
- C:\Windows\System\KvxqlSd.exe
  C:\Windows\System\KvxqlSd.exe
  2⤵
  PID:11980
- C:\Windows\System\XFNYhkk.exe
  C:\Windows\System\XFNYhkk.exe
  2⤵
  PID:11588
- C:\Windows\System\XGNOHAW.exe
  C:\Windows\System\XGNOHAW.exe
  2⤵
  PID:10444
- C:\Windows\System\cUKQaRu.exe
  C:\Windows\System\cUKQaRu.exe
  2⤵
  PID:11392
- C:\Windows\System\KfUdveD.exe
  C:\Windows\System\KfUdveD.exe
  2⤵
  PID:10752
- C:\Windows\System\RDKxFey.exe
  C:\Windows\System\RDKxFey.exe
  2⤵
  PID:3948
- C:\Windows\System\WjqHzUl.exe
  C:\Windows\System\WjqHzUl.exe
  2⤵
  PID:14124
- C:\Windows\System\rwcAhNG.exe
  C:\Windows\System\rwcAhNG.exe
  2⤵
  PID:1068
- C:\Windows\System\ISUUmpz.exe
  C:\Windows\System\ISUUmpz.exe
  2⤵
  PID:11600
- C:\Windows\System\HdrZeen.exe
  C:\Windows\System\HdrZeen.exe
  2⤵
  PID:12008
- C:\Windows\System\kxqZmue.exe
  C:\Windows\System\kxqZmue.exe
  2⤵
  PID:11044
- C:\Windows\System\dFCfuDR.exe
  C:\Windows\System\dFCfuDR.exe
  2⤵
  PID:12224
- C:\Windows\System\yRkNoKm.exe
  C:\Windows\System\yRkNoKm.exe
  2⤵
  PID:11148
- C:\Windows\System\LbyCaJZ.exe
  C:\Windows\System\LbyCaJZ.exe
  2⤵
  PID:13568
- C:\Windows\System\okXTCSM.exe
  C:\Windows\System\okXTCSM.exe
  2⤵
  PID:4204
- C:\Windows\System\hxSeqvi.exe
  C:\Windows\System\hxSeqvi.exe
  2⤵
  PID:10740
- C:\Windows\System\tOYRQZq.exe
  C:\Windows\System\tOYRQZq.exe
  2⤵
  PID:10036
- C:\Windows\System\yMqYNfo.exe
  C:\Windows\System\yMqYNfo.exe
  2⤵
  PID:9904
- C:\Windows\System\DSPoNlh.exe
  C:\Windows\System\DSPoNlh.exe
  2⤵
  PID:10932
- C:\Windows\System\cpVUWFg.exe
  C:\Windows\System\cpVUWFg.exe
  2⤵
  PID:2308
- C:\Windows\System\dFoIxhw.exe
  C:\Windows\System\dFoIxhw.exe
  2⤵
  PID:14244
- C:\Windows\System\aXrICES.exe
  C:\Windows\System\aXrICES.exe
  2⤵
  PID:12096
- C:\Windows\System\UoeGUET.exe
  C:\Windows\System\UoeGUET.exe
  2⤵
  PID:11604
- C:\Windows\System\iaWxDrR.exe
  C:\Windows\System\iaWxDrR.exe
  2⤵
  PID:12176
- C:\Windows\System\yEuiosw.exe
  C:\Windows\System\yEuiosw.exe
  2⤵
  PID:11560
- C:\Windows\System\LdCAteM.exe
  C:\Windows\System\LdCAteM.exe
  2⤵
  PID:12320
- C:\Windows\System\SAbetZW.exe
  C:\Windows\System\SAbetZW.exe
  2⤵
  PID:13528
- C:\Windows\System\RxmQuZf.exe
  C:\Windows\System\RxmQuZf.exe
  2⤵
  PID:13628
- C:\Windows\System\HoOyJMS.exe
  C:\Windows\System\HoOyJMS.exe
  2⤵
  PID:14320
- C:\Windows\System\zKpDxLb.exe
  C:\Windows\System\zKpDxLb.exe
  2⤵
  PID:13808
- C:\Windows\System\QoeEBfe.exe
  C:\Windows\System\QoeEBfe.exe
  2⤵
  PID:12508
- C:\Windows\System\cMKZJtO.exe
  C:\Windows\System\cMKZJtO.exe
  2⤵
  PID:10232
- C:\Windows\System\KvFNnmJ.exe
  C:\Windows\System\KvFNnmJ.exe
  2⤵
  PID:14132
- C:\Windows\System\AtuZOEn.exe
  C:\Windows\System\AtuZOEn.exe
  2⤵
  PID:8672
- C:\Windows\System\PIrSqed.exe
  C:\Windows\System\PIrSqed.exe
  2⤵
  PID:12892
- C:\Windows\System\TyxFMqY.exe
  C:\Windows\System\TyxFMqY.exe
  2⤵
  PID:10392
- C:\Windows\System\JDsgTrt.exe
  C:\Windows\System\JDsgTrt.exe
  2⤵
  PID:13600
- C:\Windows\System\smBnRKx.exe
  C:\Windows\System\smBnRKx.exe
  2⤵
  PID:12072
- C:\Windows\System\UIodBKT.exe
  C:\Windows\System\UIodBKT.exe
  2⤵
  PID:11280
- C:\Windows\System\fbHlnBS.exe
  C:\Windows\System\fbHlnBS.exe
  2⤵
  PID:13132
- C:\Windows\System\flvhTqy.exe
  C:\Windows\System\flvhTqy.exe
  2⤵
  PID:11268
- C:\Windows\System\eISYuRy.exe
  C:\Windows\System\eISYuRy.exe
  2⤵
  PID:10408
- C:\Windows\System\SZUsCfV.exe
  C:\Windows\System\SZUsCfV.exe
  2⤵
  PID:10308
- C:\Windows\System\djSCjMJ.exe
  C:\Windows\System\djSCjMJ.exe
  2⤵
  PID:220
- C:\Windows\System\AhDYEUe.exe
  C:\Windows\System\AhDYEUe.exe
  2⤵
  PID:10840
- C:\Windows\System\JbVhIVo.exe
  C:\Windows\System\JbVhIVo.exe
  2⤵
  PID:12488
- C:\Windows\System\mPvPqOu.exe
  C:\Windows\System\mPvPqOu.exe
  2⤵
  PID:13292
- C:\Windows\System\eekRjou.exe
  C:\Windows\System\eekRjou.exe
  2⤵
  PID:11792
- C:\Windows\System\pyOdxTV.exe
  C:\Windows\System\pyOdxTV.exe
  2⤵
  PID:12844
- C:\Windows\System\rdHNwSw.exe
  C:\Windows\System\rdHNwSw.exe
  2⤵
  PID:11376
- C:\Windows\System\UjIDIPt.exe
  C:\Windows\System\UjIDIPt.exe
  2⤵
  PID:10848
- C:\Windows\System\nPcobbv.exe
  C:\Windows\System\nPcobbv.exe
  2⤵
  PID:10992
- C:\Windows\System\kxdBTgE.exe
  C:\Windows\System\kxdBTgE.exe
  2⤵
  PID:10972
- C:\Windows\System\SQjJWca.exe
  C:\Windows\System\SQjJWca.exe
  2⤵
  PID:13748
- C:\Windows\System\eassrAt.exe
  C:\Windows\System\eassrAt.exe
  2⤵
  PID:13304
- C:\Windows\System\uucOmZU.exe
  C:\Windows\System\uucOmZU.exe
  2⤵
  PID:11164
- C:\Windows\System\CLFzxaM.exe
  C:\Windows\System\CLFzxaM.exe
  2⤵
  PID:2092
- C:\Windows\System\IMbBlYN.exe
  C:\Windows\System\IMbBlYN.exe
  2⤵
  PID:12624
- C:\Windows\System\zRiONlr.exe
  C:\Windows\System\zRiONlr.exe
  2⤵
  PID:14356
- C:\Windows\System\jNPHZaR.exe
  C:\Windows\System\jNPHZaR.exe
  2⤵
  PID:14384
- C:\Windows\System\kpOkWdX.exe
  C:\Windows\System\kpOkWdX.exe
  2⤵
  PID:14424
- C:\Windows\System\CyEiXUa.exe
  C:\Windows\System\CyEiXUa.exe
  2⤵
  PID:14460
- C:\Windows\System\EURUFyz.exe
  C:\Windows\System\EURUFyz.exe
  2⤵
  PID:14512
- C:\Windows\System\ISNWaEn.exe
  C:\Windows\System\ISNWaEn.exe
  2⤵
  PID:14556
- C:\Windows\System\JXZtRUh.exe
  C:\Windows\System\JXZtRUh.exe
  2⤵
  PID:14604
- C:\Windows\System\vGmgZzC.exe
  C:\Windows\System\vGmgZzC.exe
  2⤵
  PID:14628
- C:\Windows\System\YNqEWRz.exe
  C:\Windows\System\YNqEWRz.exe
  2⤵
  PID:14652
- C:\Windows\System\TcWwwKo.exe
  C:\Windows\System\TcWwwKo.exe
  2⤵
  PID:14684
- C:\Windows\System\PVEKmGh.exe
  C:\Windows\System\PVEKmGh.exe
  2⤵
  PID:14720
- C:\Windows\System\lYlBrpB.exe
  C:\Windows\System\lYlBrpB.exe
  2⤵
  PID:14748
- C:\Windows\System\KwzOHpq.exe
  C:\Windows\System\KwzOHpq.exe
  2⤵
  PID:14776
- C:\Windows\System\gsgLBxV.exe
  C:\Windows\System\gsgLBxV.exe
  2⤵
  PID:14792
- C:\Windows\System\UjlyGNd.exe
  C:\Windows\System\UjlyGNd.exe
  2⤵
  PID:14844
- C:\Windows\System\HHovxMB.exe
  C:\Windows\System\HHovxMB.exe
  2⤵
  PID:14868
- C:\Windows\System\yIJtZfZ.exe
  C:\Windows\System\yIJtZfZ.exe
  2⤵
  PID:14888
- C:\Windows\System\ACZjTap.exe
  C:\Windows\System\ACZjTap.exe
  2⤵
  PID:14916
- C:\Windows\System\DnOdKCj.exe
  C:\Windows\System\DnOdKCj.exe
  2⤵
  PID:14948
- C:\Windows\System\AenOYSr.exe
  C:\Windows\System\AenOYSr.exe
  2⤵
  PID:14980
- C:\Windows\System\mvRfHhu.exe
  C:\Windows\System\mvRfHhu.exe
  2⤵
  PID:15000
- C:\Windows\System\NGJAmJp.exe
  C:\Windows\System\NGJAmJp.exe
  2⤵
  PID:15016
- C:\Windows\System\lhCDTBa.exe
  C:\Windows\System\lhCDTBa.exe
  2⤵
  PID:15048
- C:\Windows\System\bheVXaO.exe
  C:\Windows\System\bheVXaO.exe
  2⤵
  PID:15076
- C:\Windows\System\xYmKiXJ.exe
  C:\Windows\System\xYmKiXJ.exe
  2⤵
  PID:15120
- C:\Windows\System\iDkKnmO.exe
  C:\Windows\System\iDkKnmO.exe
  2⤵
  PID:15144
- C:\Windows\System\olvvKtq.exe
  C:\Windows\System\olvvKtq.exe
  2⤵
  PID:15176
- C:\Windows\System\zTZjioE.exe
  C:\Windows\System\zTZjioE.exe
  2⤵
  PID:15200
- C:\Windows\System\pqajNfn.exe
  C:\Windows\System\pqajNfn.exe
  2⤵
  PID:15240
- C:\Windows\System\ptZXwBI.exe
  C:\Windows\System\ptZXwBI.exe
  2⤵
  PID:15260
- C:\Windows\System\TLdChwB.exe
  C:\Windows\System\TLdChwB.exe
  2⤵
  PID:15284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_g2exf12v.l5b.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BTKiQGR.exe

Filesize
1.9MB

MD5
354a5763c22e8e33bdcea59309e58e93

SHA1
811bf3f13897b0e6182b74d0a7b841536f0229c3

SHA256
4981d1aa7e4502a6cb626d0a913ef14b8793e4290bd40e50a5282589a92933da

SHA512
7a15cf8c4c9dec891ef16277b2d45b5cf2ace99ac70e16d7f2b12a62dfe0372cb309e0d725e0bbe8c04ec608104e827dea844d39acf54d7f58b071f4bcaac868

Download Submit
C:\Windows\System\BuwgJWw.exe

Filesize
1.9MB

MD5
db21a1692e16b727e05c5523417ab394

SHA1
43474fc80dd38569011604179c45f1452e6171ad

SHA256
3baf24ca226d09465a2f0a54ce40e858c2223214897b667f2cff4d97204e4bc7

SHA512
f05631a51a6a61c2f38ed4bbb0745ec9c6c3d7ce0e156b84258a5ba03fa39acefd38e6f8fea651c0c0b4d23e7ac178ca1c0ee461c7cc8db6d95e70e1240ad6e8

Download Submit
C:\Windows\System\CdjMBhi.exe

Filesize
1.9MB

MD5
7712a96525cd250d3cdb807832111c76

SHA1
f4e86f8f55e276cb157c014328dea6e158bdfd8d

SHA256
6c664106121ae0c5a05599bf2f4da45f149307792181da43e5d28fa004d597a7

SHA512
8d7110508ce00d92907b2ed4c45994daa244d96382f6308404241002267a1a0695b3d26d2fe089c3a6a617e432f238961a0dfc65fd75ff00d3c63716acf38ace

Download Submit
C:\Windows\System\JglANFu.exe

Filesize
1.9MB

MD5
764a87651c23831954670cafdc4bec1a

SHA1
0de25dd13649c8b39834a18cd09a2f0a9fb61001

SHA256
d74b1c2873727fa790472b104381e4344fed7c36490586b099e7c5c660b60577

SHA512
d87497b4d43badfcaf3ec4765155fa49a981f0d099167617610badfa50b461b439e2c97ef22531f0b75b511ee6b95adf3982a01a309552d678207743911ae23a

Download Submit
C:\Windows\System\JoMmhUj.exe

Filesize
8B

MD5
9e16362b7eef9ff59cf4576b688fec20

SHA1
58714a79316bdda8b345ca47c2a7e8087e024871

SHA256
cb157cd47cb9ddacb8fa194262e9cc1364ca68490d93ad041938e77ef90ead7c

SHA512
53056e2e9a952538e1c61538c2bad2166adaf2d4a03d0e97e211329cd7f80967988343aa21690b08c2f1ad6d3fabfdc6095392f57b127d575de79d724d1a09de

Download Submit
C:\Windows\System\KUoNMsG.exe

Filesize
1.9MB

MD5
78ef60141dfd25678e9d01ced0d304a8

SHA1
7f23441eaae26ae931ef88321b0d09f987c98c6e

SHA256
571cf615cc9b233f9ee97d1b484b082292c9b5f57468fb15a037f825fdbb234b

SHA512
b35b516f0bd52e1a1944e5b47f892d2abf8bfbe35fe363f4ffd375ec182446c9d0b13a843cffdfb0e4c82f309b7c358836d6c7188b48e0d8c067cad4a9d1c826

Download Submit
C:\Windows\System\LVgKYjY.exe

Filesize
1.9MB

MD5
624f7310f9681c7753421dcd834711c5

SHA1
b95a6154aa00094dfc6f5533415d0922b7ce1eae

SHA256
889357080ecc49a3810f20b8df02db417b68561d98685557bcc944bb28cf2208

SHA512
54ca652cd337bbffd5d29e7a8516724ee6a817769c950747d30ba510b2855f959fee9eac4b5cd401a1e8ef15314232e974bc45b9f0916807ad1b2e46c14040b3

Download Submit
C:\Windows\System\LwXXfkm.exe

Filesize
1.9MB

MD5
3ca80325262e802381377d4e34cef1e6

SHA1
9b3f0924f508a73f43e3fe4c06f58e7a4fd1b6c0

SHA256
45f54c62d6d44560c3cc1a937107edb4699bdf37fac5da21e1a263dcae40a7cf

SHA512
129ee159fffc2e687b19ec7d2f0f2e9717c8866e88fec49a498d75e331c5f675eb057663f81703517d947c5c4a91fb71bad34fc62eacaf753d94802478dbaa6d

Download Submit
C:\Windows\System\ODkRGaI.exe

Filesize
1.9MB

MD5
927c07f53e1d3803bbe2690654565e45

SHA1
04ac8894f582d32a9aea753be623d88b318d63bd

SHA256
2fc0fcd96fae24d762a82403ab63545f7d778b3b54b0a8a1942ee6db90d79e86

SHA512
c9d64f9f56a06eb701f9e0ad5f9e0a4fd300741c4bcfaa00bd3436bb8f733d8459c729c4c8744f422c234a66c48238a44fd076d015b405ce38e8eda08be052f3

Download Submit
C:\Windows\System\OEoXUtj.exe

Filesize
1.9MB

MD5
21397e5ab8cd8e546f2b4385819e7d0d

SHA1
d1b3443ebc1b1e29de91a10dc76c313ef262747a

SHA256
15f6abb9761af886905a6b17648b3b60c03b9b2802fdc4a4be0b0e15ac11cc1c

SHA512
62c1de996b96b3a37d39e9c96706b51727273fe092fdd23db321da6e1072022d6e1fa182d95808a22b3852801a45058a448a2b99c6d7f3979f14c683af0845f3

Download Submit
C:\Windows\System\OJSDEgi.exe

Filesize
1.9MB

MD5
0bffc8b7833808fc1077f842f52d1084

SHA1
66579e2af9000773845285ac4613057b8082600f

SHA256
a8b7d9e2898fa0e029f2735eb7fae4ab28b0991b2593210cbdb044a5a00096dc

SHA512
b697969c302891eb711805572b1238db4b69e5ae16fbad7f71bacc9691d5d272a5adf6ccf6f747a0ee10759a708c8bc0e715ec59d4a34aeac468f0659e6f8e4b

Download Submit
C:\Windows\System\RWlioom.exe

Filesize
1.9MB

MD5
96e7e3dd81dffc5dac10a9b584ac5875

SHA1
3c04a9cef2dc7284ed259534ee437edfb496f0cb

SHA256
e4b7dcfb40b0a36f09c7856911c2d726d5e32091715b37444576d221aaab396c

SHA512
3a6dc52df05316710631d81739a43d528483a6f79e3621c9996f80d341574d662022dd1b88c66833d837ec3385cd5f0838f794500fc2f22be04bb7b6a42d0c63

Download Submit
C:\Windows\System\SVnRIPB.exe

Filesize
1.9MB

MD5
653af6f592ed3d47a3d7d1c0276751dd

SHA1
c1aa3a83002036afc536dd85eda8506a2e72c0a0

SHA256
9a77d5c5b8b1a889527caf736c8f8a8b8625297a2793998b25946b9497bd7481

SHA512
c27d767f0497648572d07b91296ce86eeb2c05da031cf15033da2cbb0db233d867e19812b5f61767b70babcc28f8e7ea2c43dc69a0d7277f2f7d3e14097fc861

Download Submit
C:\Windows\System\TACNGDO.exe

Filesize
1.9MB

MD5
45dab6bdc9b8ea63c609d1d4d269d5ce

SHA1
644079704c53bae034712b8d49e27d61588d4b46

SHA256
2af8131547f48654e0a175fa02a8b79e4fc96f69d4d497f096926c94f79ee5d2

SHA512
7ec15e28b12314a45265c1f49e6332560e74c2e2b024ee5369fa50b86e2fc637ce2fea4a5b79b30437c2fa73c5303ac9a0a8908d5290844224e26b6c4753b373

Download Submit
C:\Windows\System\VtLBjMo.exe

Filesize
1.9MB

MD5
b9d070263966fcb63203d8182ed065c1

SHA1
04d446b6552cf7c36a9b476a8604b19d2a27e4ff

SHA256
5a2347e09f64a9ae5ab3bd4a401d655a9fc07dc8670c16d7e9e85ff39a1eb17b

SHA512
101b1e395fb115f715f8d42fdff9394726035b4712b38bef5abc83bcadeaaff8dd6d6448e870725dbbda0da6a9ba18b3b06caec21e5c756ce8bc7e0656b38850

Download Submit
C:\Windows\System\ZmEZdwU.exe

Filesize
1.9MB

MD5
a299ec16122bc7be57c97876344f8470

SHA1
aebb06f105b52a77b29139d60e7374724d34faba

SHA256
bb3b5f99ef4d2c629e3a156d4f62dcf8195b49a958fe0d4127d68450ab91c5c4

SHA512
0e5d9560ac977f1b31a1d5e36334e515a19106b912a91af44d84d64186946ba0c023f11010efc1e948f8a3688e2087094684547d7e51ab5b0e7cf972b226e018

Download Submit
C:\Windows\System\adKEQNi.exe

Filesize
18B

MD5
b5af15b91ef901dbbad280bf2ec97d3f

SHA1
b8fc44effcf94c604b3a330099fdd05d70ca2290

SHA256
4b241b0358bbe69bc40fb7c8558ef0dacf7a7dd595b9974e7ee1287f6f6a57a6

SHA512
77e9e1cd7604d29efe33ea37dfc85035465c8eb4a6b1edf396f009c9427a6171460e7b24fac454a276653572360ea48634eb43a059b68dd9d91460bd58c1ddf1

Download Submit
C:\Windows\System\amZedxo.exe

Filesize
1.9MB

MD5
56ebd981b1fd69594c36f04a0c302232

SHA1
e19aad33c634239717a49b49d96ad9ae07a0d0c7

SHA256
28a6c122ed9d41a90ab62a014de1bb63366095a884e1242ba864c633e03f89f3

SHA512
ffa19f2e6716aba068ebbb9bd7aa29dfb42e6dfe9869502c4e972f3ba4473a6153ffee4cab486975347661fbc0c27d8f96fc80276b3702a439761dfc133e4071

Download Submit
C:\Windows\System\amcidJa.exe

Filesize
1.9MB

MD5
bc107f59a53d0bed16eaca9dbbf60fa1

SHA1
50788b3f913032b8725847efad6c198fee507b51

SHA256
a25afdec68e643af6cfa525c2b77eabfcb561c270e6780f032bbc9c3a7f8c736

SHA512
67fe3853e67fec96fc6751972957236fdf762c73f5b617b82976b42b8add76465dae67294d6a0f9b440627ea4a0d94c9336ffda8e9ee6674489ae1bda5f05718

Download Submit
C:\Windows\System\bcDcRTx.exe

Filesize
1.9MB

MD5
e7c7e07b6572cc03fce84ece183f69fd

SHA1
c190acaa51ca2c616b367217d529d5fb78f87e0a

SHA256
3b8e44580367d60d4fdca2ad83fb77974d6d97c8c233aa5c89bd20f3d53092e2

SHA512
a57d9ec71c910cc6105dbfc7abdc1d904d9b2dde1b28c798e82ad7ee1ed18ee213292607aeabebdd458518c8b0d7a15ede66503d7b58e782cb93b2d5a9475c5c

Download Submit
C:\Windows\System\cDnvPMS.exe

Filesize
1.9MB

MD5
c64f6df031e6801ac650c83d7d90d17f

SHA1
f13c36ab1f899c819b1e8293da8752fc2b87b5dd

SHA256
e50f3cbaf632e50c40d332c060561f7e1a8ee53e926bbd274c892ce2df760443

SHA512
ff60e918a676336165fb802239ce0df427001d5f3ee47e8da2a618fd134de78f2c4d63782bfaabb4cb792ce3acebf6a35d171ec3f631d5bbb2aefd215152bd50

Download Submit
C:\Windows\System\cPwGCqr.exe

Filesize
1.9MB

MD5
ca40f67385db32a02cd0c4c5c03fb1c0

SHA1
8c323774a86f035790464c8758a169ee0644287c

SHA256
27cc494ec7fd456314904ab4dce2a559179712331a5c887efd18d493df7827aa

SHA512
e3684a7e15ff7b80479da6452e575e77f1cbcf9f6c66da14cb55d7b5fac8095708cf6b51c00bd46ea98175ab6dc3b05f8fda62a16154fb5a159b9295e877b476

Download Submit
C:\Windows\System\ezjizTr.exe

Filesize
1.9MB

MD5
fdf9c65311f884e59f155bd0b8556b5c

SHA1
7a26452042628f08d3291852f135ec9f1bb8f26e

SHA256
98f344e526f819e2ae650e22b70cbe7e29af37915f83c77963921ffd309172aa

SHA512
6d4d8f9016a946242a8ba334c4c9978fb976508df44bb4eb7e8fce9d713b9c3a8159deaa9a900b56873005813d882c4e96f6fd524a489c2a13ce1751f33c395a

Download Submit
C:\Windows\System\fUtLpko.exe

Filesize
1.9MB

MD5
557aa50c099039bac63c3371f251e048

SHA1
fc72e9a2970d6b2b641f40715675a2a45310dd58

SHA256
f3e630446d144f6c6d054950f52c870f50a0a4f4ff79a1cfb6fc29e9cb270010

SHA512
9849e2e94bf147e1ba8ab218de619ed50125b0a367bc34a33e472042c636a2a0c409e6279d1b62c0ac0a97bdd4a9aff058111b42cfe70f3968c8da6185d7c97b

Download Submit
C:\Windows\System\hDrvIcC.exe

Filesize
1.9MB

MD5
e4dd3bdce0d6211b89200c553a762cb9

SHA1
bfccdb85a67df240579566af9993e982899c436c

SHA256
4c031cf8a56ac5082c1ad2f68117e7bd772d7fff49b9b6a56ada57c95a276c6d

SHA512
777b2f6291d69749757663ad1dc6150f6a36ef97c658194853bcf481f7a19e150669d0882ffd85ae98df41f8be1fb38d982c72fa9dd26abaf6b3cb1fc100061c

Download Submit
C:\Windows\System\iBpoPPf.exe

Filesize
1.9MB

MD5
aa7123996a2e548b47bdc474fb3cba0f

SHA1
4636458bcff0e008bb9af2cae978bf47657f21d2

SHA256
1a06ee2603692e9dc52a98406e168cd2897ebfb0ebafdb79d592ccee9e8b9fd2

SHA512
701e2b96161ee6d80a0b03b5df7ae95873893697f5667ddaa737df09f8f44f0a7bb29ea68c29a189a83bbd6c058fd283232355c8fafbaa512e720f38d10f1007

Download Submit
C:\Windows\System\jmDTmHF.exe

Filesize
1.9MB

MD5
dc470e2641856eb6c20e5bda5c2120e5

SHA1
8d87e43081530e6deb11e15ba99419a92c69729a

SHA256
98368bb5701acbdcc52bd1082aeb4604cbc829445a8ebe8691ffd594786506a5

SHA512
72c2edfc75c636d385195569c81758708c0e61a34b0f3dd9e35690ae7428625264bb39029dbf13f8547b31f075c003952f2ced23c0162cb2baa88107874f3f90

Download Submit
C:\Windows\System\mkWSbkS.exe

Filesize
1.9MB

MD5
55dbd34c276788a4bc66c76942105d32

SHA1
8cf37aa839b1963a0f94f9243aedf12a108571b0

SHA256
2bb2a2649130e66264cb38906da389e428f0529c9ba6489dd8608436c518865c

SHA512
d3ef0649561527572be76b422fe6e8ad21f4adbceedd6aac8d759a50f992d2ce9fc79a622fb7fae87d1df1c0d322709f33640d903faef220573a5cb9505f2c10

Download Submit
C:\Windows\System\qCyAeag.exe

Filesize
1.9MB

MD5
b6039e5d98a47f63379457d018d82ef2

SHA1
544a5b8649cb7e17bd56e158efa241f51836f238

SHA256
6df44d1561d1b52a688bbbe0ef97c1b608bbb2165b5bcdd1a12b2fc25a8a4e88

SHA512
09e5a4fc4ceb5dc420e323f16e135228e1b59a7cbd2cf5e7f437e31fc18f0e1607b1b5ea45c1c4a1090b5861b235cf4e05722803c831d7ea56c1cacf4cc27860

Download Submit
C:\Windows\System\qQnuksr.exe

Filesize
1.9MB

MD5
9d267f8bb7d68c4368a61edc8dc96d31

SHA1
4162a4d0041b0218015f553d9765a9a777940edc

SHA256
6bea677b47415e7666bc41ecd20771b491e29ac3ad0ee89518ec4ecfc1583508

SHA512
ff68136c3c1c72d69c9ec796e57e9cc2b4dfb101d79e12896845c386b1c11d99f2ba4552653d61cbaed1e2009d7644e22b1c23dcc3510ffa34bfb900581f860b

Download Submit
C:\Windows\System\qfcKkuz.exe

Filesize
1.9MB

MD5
b684c4c88331bdf218f406d2d36a7b5e

SHA1
5ecbdb2961bd22118c4555dc36a31d6c77c28053

SHA256
39cefec2bb03d98b5cedd8b7191aded516beb207e6a9a682621c0277e36ed55f

SHA512
3ee3a5ff5f215a84f85cbe5ca3da21beb77b87d51644a84ec3ec0fa3205acf739a278a040ce3ec4ca37cf9a46b802d774fb0a847274dccc1f6395e09bb6ab706

Download Submit
C:\Windows\System\rHbHTgo.exe

Filesize
1.9MB

MD5
d2563838f19d8d611598ee4b164095e5

SHA1
fb74bbf8cc1afbb0a109cfe773d1c2989a45ac7a

SHA256
afa4316755b52e9ceb5b979631a54179e683c9c547d5d64b33ce9b5217767f82

SHA512
98a59cf34a8b5e3a867c798f4043a2c23bafcbc779792f061c076192c5a784ab7833d3d5f2fc3eea53665b19cd74b753acaf326e1c649759dd707c5a16df38b4

Download Submit
C:\Windows\System\xzQFRRZ.exe

Filesize
1.9MB

MD5
6dc0c72b57cf2b7e585cba7b0a7ec2aa

SHA1
7b2aa42859f706f554a99d108bb7d6b87fd0d6b6

SHA256
026a7fa5bd48122d1d2f79a450d935368999ac6b1541aa7006361f3c46e84516

SHA512
e4213e480a35fa8b97fa4a34c963b9537c805b662d311a0334cfe81144c6dd21ae1f36372b2614854236bda22f1839f89764c78749544f3bbb433530688f006a

Download Submit
C:\Windows\System\zdkBmqg.exe

Filesize
1.9MB

MD5
010f9c54196b6c0f998b7a6d3caa9b35

SHA1
d7021c396ccdecd61e7348e8923d0d518079f29c

SHA256
140bfdb0938b593196615aa2ccdcc0c096939539026f437f55b92b5e8d0c38e9

SHA512
1f2fefeb38c83c0d06c922e2c92275a405553c402653252185595603a2a3367c1dc7a5c51ac6490e62654de70fb251b9ae0edcf09895783a9ff8fc88d4f30eab

Download Submit
memory/212-70-0x00007FF75BCE0000-0x00007FF75C0D2000-memory.dmp

Filesize
3.9MB

Download
memory/384-141-0x00007FF77C150000-0x00007FF77C542000-memory.dmp

Filesize
3.9MB

Download
memory/1056-5181-0x00007FF68A500000-0x00007FF68A8F2000-memory.dmp

Filesize
3.9MB

Download
memory/1056-147-0x00007FF68A500000-0x00007FF68A8F2000-memory.dmp

Filesize
3.9MB

Download
memory/1304-30-0x00007FF626B70000-0x00007FF626F62000-memory.dmp

Filesize
3.9MB

Download
memory/1596-124-0x00007FF68E4E0000-0x00007FF68E8D2000-memory.dmp

Filesize
3.9MB

Download
memory/1664-55-0x00007FF7A89A0000-0x00007FF7A8D92000-memory.dmp

Filesize
3.9MB

Download
memory/1852-85-0x00007FF6DA830000-0x00007FF6DAC22000-memory.dmp

Filesize
3.9MB

Download
memory/2264-2599-0x00007FF7CD580000-0x00007FF7CD972000-memory.dmp

Filesize
3.9MB

Download
memory/2264-84-0x00007FF7CD580000-0x00007FF7CD972000-memory.dmp

Filesize
3.9MB

Download
memory/2492-60-0x00007FF75FE60000-0x00007FF760252000-memory.dmp

Filesize
3.9MB

Download
memory/3140-102-0x00007FF7A4580000-0x00007FF7A4972000-memory.dmp

Filesize
3.9MB

Download
memory/3456-96-0x00007FF686EC0000-0x00007FF6872B2000-memory.dmp

Filesize
3.9MB

Download
memory/3492-91-0x00007FF7E5BA0000-0x00007FF7E5F92000-memory.dmp

Filesize
3.9MB

Download
memory/3504-50-0x000002286E110000-0x000002286E132000-memory.dmp

Filesize
136KB

Download
memory/3504-24-0x000002286E160000-0x000002286E170000-memory.dmp

Filesize
64KB

Download
memory/3504-23-0x00007FFE95580000-0x00007FFE96041000-memory.dmp

Filesize
10.8MB

Download
memory/3504-1872-0x00007FFE95580000-0x00007FFE96041000-memory.dmp

Filesize
10.8MB

Download
memory/3512-4308-0x00007FF623930000-0x00007FF623D22000-memory.dmp

Filesize
3.9MB

Download
memory/3512-130-0x00007FF623930000-0x00007FF623D22000-memory.dmp

Filesize
3.9MB

Download
memory/3840-66-0x00007FF77DEA0000-0x00007FF77E292000-memory.dmp

Filesize
3.9MB

Download
memory/3844-112-0x00007FF6E7DE0000-0x00007FF6E81D2000-memory.dmp

Filesize
3.9MB

Download
memory/3844-3792-0x00007FF6E7DE0000-0x00007FF6E81D2000-memory.dmp

Filesize
3.9MB

Download
memory/3952-38-0x00007FF732ED0000-0x00007FF7332C2000-memory.dmp

Filesize
3.9MB

Download
memory/4108-39-0x00007FF7A0830000-0x00007FF7A0C22000-memory.dmp

Filesize
3.9MB

Download
memory/4192-118-0x00007FF7E5980000-0x00007FF7E5D72000-memory.dmp

Filesize
3.9MB

Download
memory/4376-0-0x00007FF6BFFF0000-0x00007FF6C03E2000-memory.dmp

Filesize
3.9MB

Download
memory/4376-1865-0x00007FF6BFFF0000-0x00007FF6C03E2000-memory.dmp

Filesize
3.9MB

Download
memory/4376-1-0x000001D62A380000-0x000001D62A390000-memory.dmp

Filesize
64KB

Download
memory/4464-51-0x00007FF7B7E00000-0x00007FF7B81F2000-memory.dmp

Filesize
3.9MB

Download
memory/4924-75-0x00007FF620400000-0x00007FF6207F2000-memory.dmp

Filesize
3.9MB

Download
memory/5068-106-0x00007FF741120000-0x00007FF741512000-memory.dmp

Filesize
3.9MB

Download