xmrig | 1194f0584653f19706fc2bd9b1e702a99174433635e79cf879377a0bd3ac4004

Analysis

max time kernel
150s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 18:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
Size

1.7MB
MD5

05ccdd21a728f1b69ccac94145175e18
SHA1

30710097db20ff87e36c1b4cf1a24fa7d6049c94
SHA256

1194f0584653f19706fc2bd9b1e702a99174433635e79cf879377a0bd3ac4004
SHA512

7e097436db904b402d07c1c78781221dfde199363749a7d12d7d4c026fc944dd467673a1f52d8e89aae9ed243b17b0359eca589f086e490c82a250477d8996fb
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SGkMK7:NABe

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 25 IoCs

miner

resource	yara_rule
behavioral2/memory/3116-67-0x00007FF72AEC0000-0x00007FF72B2B2000-memory.dmp	xmrig
behavioral2/memory/3288-80-0x00007FF6AE320000-0x00007FF6AE712000-memory.dmp	xmrig
behavioral2/memory/3392-86-0x00007FF71C7D0000-0x00007FF71CBC2000-memory.dmp	xmrig
behavioral2/memory/2704-87-0x00007FF7E40D0000-0x00007FF7E44C2000-memory.dmp	xmrig
behavioral2/memory/1012-85-0x00007FF729C80000-0x00007FF72A072000-memory.dmp	xmrig
behavioral2/memory/2268-82-0x00007FF6BA3C0000-0x00007FF6BA7B2000-memory.dmp	xmrig
behavioral2/memory/1116-81-0x00007FF6B0FA0000-0x00007FF6B1392000-memory.dmp	xmrig
behavioral2/memory/2404-76-0x00007FF7308E0000-0x00007FF730CD2000-memory.dmp	xmrig
behavioral2/memory/2804-66-0x00007FF603150000-0x00007FF603542000-memory.dmp	xmrig
behavioral2/memory/2004-49-0x00007FF775E30000-0x00007FF776222000-memory.dmp	xmrig
behavioral2/memory/3440-185-0x00007FF6A2150000-0x00007FF6A2542000-memory.dmp	xmrig
behavioral2/memory/4592-178-0x00007FF679510000-0x00007FF679902000-memory.dmp	xmrig
behavioral2/memory/4480-2537-0x00007FF6A51A0000-0x00007FF6A5592000-memory.dmp	xmrig
behavioral2/memory/768-3927-0x00007FF6921D0000-0x00007FF6925C2000-memory.dmp	xmrig
behavioral2/memory/3332-4772-0x00007FF6162B0000-0x00007FF6166A2000-memory.dmp	xmrig
behavioral2/memory/3580-4777-0x00007FF6B0B60000-0x00007FF6B0F52000-memory.dmp	xmrig
behavioral2/memory/1804-5551-0x00007FF62AF60000-0x00007FF62B352000-memory.dmp	xmrig
behavioral2/memory/3744-5553-0x00007FF65EA50000-0x00007FF65EE42000-memory.dmp	xmrig
behavioral2/memory/1004-5556-0x00007FF6F5D40000-0x00007FF6F6132000-memory.dmp	xmrig
behavioral2/memory/1116-5580-0x00007FF6B0FA0000-0x00007FF6B1392000-memory.dmp	xmrig
behavioral2/memory/3288-5594-0x00007FF6AE320000-0x00007FF6AE712000-memory.dmp	xmrig
behavioral2/memory/2404-5618-0x00007FF7308E0000-0x00007FF730CD2000-memory.dmp	xmrig
behavioral2/memory/3392-5655-0x00007FF71C7D0000-0x00007FF71CBC2000-memory.dmp	xmrig
behavioral2/memory/3744-7081-0x00007FF65EA50000-0x00007FF65EE42000-memory.dmp	xmrig
behavioral2/memory/1004-7100-0x00007FF6F5D40000-0x00007FF6F6132000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
836	gODvDZl.exe
2004	uqYqpza.exe
3288	EHHNYEC.exe
1116	cZlCAua.exe
2804	UqgXxwI.exe
2268	uZYwDmG.exe
3116	pOVmbgA.exe
1012	PTVlpPk.exe
4480	yLhMVtB.exe
2404	FJXNAVc.exe
3392	RtguFWU.exe
2704	pSJfGeb.exe
3332	InfHEyO.exe
768	pXcXdiV.exe
3580	gxDkLTG.exe
1804	QUWkZPt.exe
4592	aenMzHm.exe
3440	LEBACzc.exe
3744	ysMouLC.exe
1004	dGfgrqG.exe
3096	ABOKJWi.exe
4824	IKhWiFM.exe
3788	RRNZAoS.exe
4156	FSeLhZx.exe
692	UVWwLOt.exe
2488	ZwYCacb.exe
2188	DMtYxUA.exe
4972	jTsREgB.exe
1432	mwbkOgf.exe
912	WEOPWSB.exe
3900	sxkNWPj.exe
2336	WveHvwt.exe
4836	wpXKVLF.exe
4056	SNAnvpf.exe
3024	ZAXHXJw.exe
4348	TXLnCUd.exe
4360	dduSEqa.exe
4932	AToMLUg.exe
4236	dVGusAD.exe
3924	YobLePh.exe
1808	dLlxAhF.exe
4136	JOKfGHC.exe
1928	GjJEwJc.exe
432	qVmNgzz.exe
4880	WarJDAy.exe
4464	couVjJc.exe
2720	dhzkDOj.exe
2372	qYLrUye.exe
4960	dnZtnIl.exe
4388	gJRVTrs.exe
3960	wdkKWPk.exe
4940	TgSOZoA.exe
936	jsNEyum.exe
4164	BzvRwqn.exe
3728	NZtltAU.exe
2884	BtCrliw.exe
4356	TgXSPrw.exe
4340	ALDDUQz.exe
1816	YUlwwYm.exe
5096	QwCyOms.exe
4140	QfGaMFZ.exe
4552	uuSZuVd.exe
4868	jyxAdxW.exe
3244	dizRGdz.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/880-0-0x00007FF6BA100000-0x00007FF6BA4F2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba3-7.dat	upx
behavioral2/files/0x000a000000023ba2-11.dat	upx
behavioral2/memory/836-14-0x00007FF74D1C0000-0x00007FF74D5B2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba4-18.dat	upx
behavioral2/files/0x000a000000023ba5-29.dat	upx
behavioral2/files/0x000a000000023ba7-37.dat	upx
behavioral2/files/0x000a000000023ba8-50.dat	upx
behavioral2/files/0x000a000000023bac-65.dat	upx
behavioral2/memory/3116-67-0x00007FF72AEC0000-0x00007FF72B2B2000-memory.dmp	upx
behavioral2/files/0x000a000000023bad-75.dat	upx
behavioral2/memory/3288-80-0x00007FF6AE320000-0x00007FF6AE712000-memory.dmp	upx
behavioral2/memory/3392-86-0x00007FF71C7D0000-0x00007FF71CBC2000-memory.dmp	upx
behavioral2/memory/2704-87-0x00007FF7E40D0000-0x00007FF7E44C2000-memory.dmp	upx
behavioral2/memory/1012-85-0x00007FF729C80000-0x00007FF72A072000-memory.dmp	upx
behavioral2/memory/2268-82-0x00007FF6BA3C0000-0x00007FF6BA7B2000-memory.dmp	upx
behavioral2/memory/1116-81-0x00007FF6B0FA0000-0x00007FF6B1392000-memory.dmp	upx
behavioral2/files/0x000b000000023bab-77.dat	upx
behavioral2/memory/2404-76-0x00007FF7308E0000-0x00007FF730CD2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba9-73.dat	upx
behavioral2/memory/4480-71-0x00007FF6A51A0000-0x00007FF6A5592000-memory.dmp	upx
behavioral2/memory/2804-66-0x00007FF603150000-0x00007FF603542000-memory.dmp	upx
behavioral2/files/0x000a000000023ba6-54.dat	upx
behavioral2/memory/2004-49-0x00007FF775E30000-0x00007FF776222000-memory.dmp	upx
behavioral2/files/0x000c000000023b9d-17.dat	upx
behavioral2/files/0x000b000000023baa-90.dat	upx
behavioral2/files/0x0031000000023bb0-127.dat	upx
behavioral2/files/0x000a000000023bb7-140.dat	upx
behavioral2/files/0x0031000000023bb2-151.dat	upx
behavioral2/files/0x000a000000023bb8-164.dat	upx
behavioral2/memory/3096-175-0x00007FF640E70000-0x00007FF641262000-memory.dmp	upx
behavioral2/files/0x000a000000023bbd-182.dat	upx
behavioral2/files/0x000a000000023bbe-189.dat	upx
behavioral2/files/0x000a000000023bbf-196.dat	upx
behavioral2/memory/3440-185-0x00007FF6A2150000-0x00007FF6A2542000-memory.dmp	upx
behavioral2/files/0x000a000000023bbc-181.dat	upx
behavioral2/files/0x000a000000023bbb-179.dat	upx
behavioral2/memory/4592-178-0x00007FF679510000-0x00007FF679902000-memory.dmp	upx
behavioral2/files/0x000a000000023bba-172.dat	upx
behavioral2/files/0x000a000000023bb9-170.dat	upx
behavioral2/files/0x000a000000023bb3-168.dat	upx
behavioral2/files/0x000a000000023bb5-166.dat	upx
behavioral2/files/0x000a000000023bb6-162.dat	upx
behavioral2/memory/1004-160-0x00007FF6F5D40000-0x00007FF6F6132000-memory.dmp	upx
behavioral2/files/0x000a000000023bb4-157.dat	upx
behavioral2/memory/3744-150-0x00007FF65EA50000-0x00007FF65EE42000-memory.dmp	upx
behavioral2/memory/1804-148-0x00007FF62AF60000-0x00007FF62B352000-memory.dmp	upx
behavioral2/files/0x000a000000023baf-138.dat	upx
behavioral2/memory/3580-132-0x00007FF6B0B60000-0x00007FF6B0F52000-memory.dmp	upx
behavioral2/files/0x000a000000023bae-121.dat	upx
behavioral2/files/0x0031000000023bb1-114.dat	upx
behavioral2/memory/768-110-0x00007FF6921D0000-0x00007FF6925C2000-memory.dmp	upx
behavioral2/memory/3332-103-0x00007FF6162B0000-0x00007FF6166A2000-memory.dmp	upx
behavioral2/files/0x000b000000023b9f-102.dat	upx
behavioral2/memory/4480-2537-0x00007FF6A51A0000-0x00007FF6A5592000-memory.dmp	upx
behavioral2/memory/768-3927-0x00007FF6921D0000-0x00007FF6925C2000-memory.dmp	upx
behavioral2/memory/3332-4772-0x00007FF6162B0000-0x00007FF6166A2000-memory.dmp	upx
behavioral2/memory/3580-4777-0x00007FF6B0B60000-0x00007FF6B0F52000-memory.dmp	upx
behavioral2/memory/1804-5551-0x00007FF62AF60000-0x00007FF62B352000-memory.dmp	upx
behavioral2/memory/3744-5553-0x00007FF65EA50000-0x00007FF65EE42000-memory.dmp	upx
behavioral2/memory/1004-5556-0x00007FF6F5D40000-0x00007FF6F6132000-memory.dmp	upx
behavioral2/memory/1116-5580-0x00007FF6B0FA0000-0x00007FF6B1392000-memory.dmp	upx
behavioral2/memory/3288-5594-0x00007FF6AE320000-0x00007FF6AE712000-memory.dmp	upx
behavioral2/memory/2404-5618-0x00007FF7308E0000-0x00007FF730CD2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ZYmSWDr.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\hjQinyc.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\xjBGbKC.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\QAQffFG.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\BRnDvkF.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\eHEDGZW.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\kETCztA.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\omSfUaz.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\NSMzXCX.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\PLFBoGt.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\dCXWbqg.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\KDmwlsq.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\ctGcvao.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\YKKwRQO.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\lbpfcbY.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\wJPKGHe.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\TOHYNyE.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\ijAWhlv.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\QZRpwuG.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\dhjHVQF.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\TIJsVGg.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\INWBDnb.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\SfCwDuK.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\bIJAaXu.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\zEAdvjr.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\ynKOXld.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\vFFEqBh.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\wRpqIfI.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\fxBMkwT.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\RhrpFXE.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\MGKjBdN.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\VTzOFvP.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\xtocOHx.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\tcwOSHe.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\qiQLJWz.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\Uunwlld.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\MwVuTPC.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\LELgRgB.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\HfnINKW.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\dEALIra.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\LZQcIzV.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\lxwkEkN.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\TfaDmKT.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\gLnDfhQ.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\oWMkAYW.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\IHSUlmV.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\ztdUPpC.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\tqSFCCm.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\PNMJPAb.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\jEGEMjP.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\vkczepp.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\PQkmepu.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\cIrNMsh.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\bOdZXlm.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\GOApwRU.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\GCWCFzb.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\NkkbKxV.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\TiEfrld.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\NSDptIe.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\JfpkzVC.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\GfTVBJs.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\xVJgONQ.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\jGnbzjt.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\jCQCFTM.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4084	powershell.exe
4084	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
Token: SeDebugPrivilege	4084	powershell.exe
Token: SeLockMemoryPrivilege	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 4084	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	85
PID 880 wrote to memory of 4084	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	85
PID 880 wrote to memory of 836	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	86
PID 880 wrote to memory of 836	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	86
PID 880 wrote to memory of 2004	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	87
PID 880 wrote to memory of 2004	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	87
PID 880 wrote to memory of 3288	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	88
PID 880 wrote to memory of 3288	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	88
PID 880 wrote to memory of 1116	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	89
PID 880 wrote to memory of 1116	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	89
PID 880 wrote to memory of 2804	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	90
PID 880 wrote to memory of 2804	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	90
PID 880 wrote to memory of 2268	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	91
PID 880 wrote to memory of 2268	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	91
PID 880 wrote to memory of 3116	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	92
PID 880 wrote to memory of 3116	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	92
PID 880 wrote to memory of 1012	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	93
PID 880 wrote to memory of 1012	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	93
PID 880 wrote to memory of 4480	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	94
PID 880 wrote to memory of 4480	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	94
PID 880 wrote to memory of 2404	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	95
PID 880 wrote to memory of 2404	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	95
PID 880 wrote to memory of 3392	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	96
PID 880 wrote to memory of 3392	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	96
PID 880 wrote to memory of 2704	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	97
PID 880 wrote to memory of 2704	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	97
PID 880 wrote to memory of 3332	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	98
PID 880 wrote to memory of 3332	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	98
PID 880 wrote to memory of 768	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	99
PID 880 wrote to memory of 768	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	99
PID 880 wrote to memory of 3580	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	100
PID 880 wrote to memory of 3580	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	100
PID 880 wrote to memory of 1804	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	101
PID 880 wrote to memory of 1804	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	101
PID 880 wrote to memory of 3744	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	102
PID 880 wrote to memory of 3744	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	102
PID 880 wrote to memory of 4592	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	103
PID 880 wrote to memory of 4592	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	103
PID 880 wrote to memory of 3440	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	104
PID 880 wrote to memory of 3440	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	104
PID 880 wrote to memory of 692	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	105
PID 880 wrote to memory of 692	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	105
PID 880 wrote to memory of 1004	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	106
PID 880 wrote to memory of 1004	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	106
PID 880 wrote to memory of 3096	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	107
PID 880 wrote to memory of 3096	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	107
PID 880 wrote to memory of 4824	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	108
PID 880 wrote to memory of 4824	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	108
PID 880 wrote to memory of 3788	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	109
PID 880 wrote to memory of 3788	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	109
PID 880 wrote to memory of 4156	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	110
PID 880 wrote to memory of 4156	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	110
PID 880 wrote to memory of 2488	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	111
PID 880 wrote to memory of 2488	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	111
PID 880 wrote to memory of 2188	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	112
PID 880 wrote to memory of 2188	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	112
PID 880 wrote to memory of 4972	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	113
PID 880 wrote to memory of 4972	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	113
PID 880 wrote to memory of 1432	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	114
PID 880 wrote to memory of 1432	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	114
PID 880 wrote to memory of 912	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	115
PID 880 wrote to memory of 912	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	115
PID 880 wrote to memory of 3900	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	117
PID 880 wrote to memory of 3900	880	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	117

C:\Users\Admin\AppData\Local\Temp\05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4084
- C:\Windows\System\gODvDZl.exe
  C:\Windows\System\gODvDZl.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\uqYqpza.exe
  C:\Windows\System\uqYqpza.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\EHHNYEC.exe
  C:\Windows\System\EHHNYEC.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\cZlCAua.exe
  C:\Windows\System\cZlCAua.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\UqgXxwI.exe
  C:\Windows\System\UqgXxwI.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\uZYwDmG.exe
  C:\Windows\System\uZYwDmG.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\pOVmbgA.exe
  C:\Windows\System\pOVmbgA.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\PTVlpPk.exe
  C:\Windows\System\PTVlpPk.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\yLhMVtB.exe
  C:\Windows\System\yLhMVtB.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\FJXNAVc.exe
  C:\Windows\System\FJXNAVc.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\RtguFWU.exe
  C:\Windows\System\RtguFWU.exe
  2⤵
  - Executes dropped EXE
  PID:3392
- C:\Windows\System\pSJfGeb.exe
  C:\Windows\System\pSJfGeb.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\InfHEyO.exe
  C:\Windows\System\InfHEyO.exe
  2⤵
  - Executes dropped EXE
  PID:3332
- C:\Windows\System\pXcXdiV.exe
  C:\Windows\System\pXcXdiV.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\gxDkLTG.exe
  C:\Windows\System\gxDkLTG.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\QUWkZPt.exe
  C:\Windows\System\QUWkZPt.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\ysMouLC.exe
  C:\Windows\System\ysMouLC.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\aenMzHm.exe
  C:\Windows\System\aenMzHm.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\LEBACzc.exe
  C:\Windows\System\LEBACzc.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\UVWwLOt.exe
  C:\Windows\System\UVWwLOt.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\dGfgrqG.exe
  C:\Windows\System\dGfgrqG.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\ABOKJWi.exe
  C:\Windows\System\ABOKJWi.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\IKhWiFM.exe
  C:\Windows\System\IKhWiFM.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\RRNZAoS.exe
  C:\Windows\System\RRNZAoS.exe
  2⤵
  - Executes dropped EXE
  PID:3788
- C:\Windows\System\FSeLhZx.exe
  C:\Windows\System\FSeLhZx.exe
  2⤵
  - Executes dropped EXE
  PID:4156
- C:\Windows\System\ZwYCacb.exe
  C:\Windows\System\ZwYCacb.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\DMtYxUA.exe
  C:\Windows\System\DMtYxUA.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\jTsREgB.exe
  C:\Windows\System\jTsREgB.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\mwbkOgf.exe
  C:\Windows\System\mwbkOgf.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\WEOPWSB.exe
  C:\Windows\System\WEOPWSB.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\sxkNWPj.exe
  C:\Windows\System\sxkNWPj.exe
  2⤵
  - Executes dropped EXE
  PID:3900
- C:\Windows\System\WveHvwt.exe
  C:\Windows\System\WveHvwt.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\wpXKVLF.exe
  C:\Windows\System\wpXKVLF.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\SNAnvpf.exe
  C:\Windows\System\SNAnvpf.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\ZAXHXJw.exe
  C:\Windows\System\ZAXHXJw.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\TXLnCUd.exe
  C:\Windows\System\TXLnCUd.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\dduSEqa.exe
  C:\Windows\System\dduSEqa.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\AToMLUg.exe
  C:\Windows\System\AToMLUg.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\dVGusAD.exe
  C:\Windows\System\dVGusAD.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System\YobLePh.exe
  C:\Windows\System\YobLePh.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\dLlxAhF.exe
  C:\Windows\System\dLlxAhF.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\JOKfGHC.exe
  C:\Windows\System\JOKfGHC.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\GjJEwJc.exe
  C:\Windows\System\GjJEwJc.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\qVmNgzz.exe
  C:\Windows\System\qVmNgzz.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\WarJDAy.exe
  C:\Windows\System\WarJDAy.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\couVjJc.exe
  C:\Windows\System\couVjJc.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\dhzkDOj.exe
  C:\Windows\System\dhzkDOj.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\qYLrUye.exe
  C:\Windows\System\qYLrUye.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\dnZtnIl.exe
  C:\Windows\System\dnZtnIl.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\gJRVTrs.exe
  C:\Windows\System\gJRVTrs.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\wdkKWPk.exe
  C:\Windows\System\wdkKWPk.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\TgSOZoA.exe
  C:\Windows\System\TgSOZoA.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\jsNEyum.exe
  C:\Windows\System\jsNEyum.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\BzvRwqn.exe
  C:\Windows\System\BzvRwqn.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\NZtltAU.exe
  C:\Windows\System\NZtltAU.exe
  2⤵
  - Executes dropped EXE
  PID:3728
- C:\Windows\System\BtCrliw.exe
  C:\Windows\System\BtCrliw.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\TgXSPrw.exe
  C:\Windows\System\TgXSPrw.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\ALDDUQz.exe
  C:\Windows\System\ALDDUQz.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\YUlwwYm.exe
  C:\Windows\System\YUlwwYm.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\QwCyOms.exe
  C:\Windows\System\QwCyOms.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\QfGaMFZ.exe
  C:\Windows\System\QfGaMFZ.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\uuSZuVd.exe
  C:\Windows\System\uuSZuVd.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\jyxAdxW.exe
  C:\Windows\System\jyxAdxW.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\dizRGdz.exe
  C:\Windows\System\dizRGdz.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\jqAzKpM.exe
  C:\Windows\System\jqAzKpM.exe
  2⤵
  PID:3064
- C:\Windows\System\IYeGTQL.exe
  C:\Windows\System\IYeGTQL.exe
  2⤵
  PID:4840
- C:\Windows\System\xsdCxgY.exe
  C:\Windows\System\xsdCxgY.exe
  2⤵
  PID:3496
- C:\Windows\System\FywozFS.exe
  C:\Windows\System\FywozFS.exe
  2⤵
  PID:1652
- C:\Windows\System\hHprcAB.exe
  C:\Windows\System\hHprcAB.exe
  2⤵
  PID:1484
- C:\Windows\System\xmiIKkM.exe
  C:\Windows\System\xmiIKkM.exe
  2⤵
  PID:524
- C:\Windows\System\ivJzTmj.exe
  C:\Windows\System\ivJzTmj.exe
  2⤵
  PID:2892
- C:\Windows\System\WKyRlfq.exe
  C:\Windows\System\WKyRlfq.exe
  2⤵
  PID:2324
- C:\Windows\System\fQlmXtw.exe
  C:\Windows\System\fQlmXtw.exe
  2⤵
  PID:5128
- C:\Windows\System\dQBEVNo.exe
  C:\Windows\System\dQBEVNo.exe
  2⤵
  PID:5152
- C:\Windows\System\xQABDkG.exe
  C:\Windows\System\xQABDkG.exe
  2⤵
  PID:5180
- C:\Windows\System\KLUmpto.exe
  C:\Windows\System\KLUmpto.exe
  2⤵
  PID:5208
- C:\Windows\System\ARhMKIK.exe
  C:\Windows\System\ARhMKIK.exe
  2⤵
  PID:5236
- C:\Windows\System\moPnqYz.exe
  C:\Windows\System\moPnqYz.exe
  2⤵
  PID:5268
- C:\Windows\System\eAjFLKQ.exe
  C:\Windows\System\eAjFLKQ.exe
  2⤵
  PID:5292
- C:\Windows\System\xQDoUsh.exe
  C:\Windows\System\xQDoUsh.exe
  2⤵
  PID:5320
- C:\Windows\System\smQwEnU.exe
  C:\Windows\System\smQwEnU.exe
  2⤵
  PID:5348
- C:\Windows\System\XNImNfH.exe
  C:\Windows\System\XNImNfH.exe
  2⤵
  PID:5376
- C:\Windows\System\FTXZqUB.exe
  C:\Windows\System\FTXZqUB.exe
  2⤵
  PID:5404
- C:\Windows\System\WBidwnG.exe
  C:\Windows\System\WBidwnG.exe
  2⤵
  PID:5432
- C:\Windows\System\hJDmuUF.exe
  C:\Windows\System\hJDmuUF.exe
  2⤵
  PID:5460
- C:\Windows\System\KUGCYwo.exe
  C:\Windows\System\KUGCYwo.exe
  2⤵
  PID:5488
- C:\Windows\System\ppIQXvX.exe
  C:\Windows\System\ppIQXvX.exe
  2⤵
  PID:5516
- C:\Windows\System\EoOaFCE.exe
  C:\Windows\System\EoOaFCE.exe
  2⤵
  PID:5544
- C:\Windows\System\SlJeveE.exe
  C:\Windows\System\SlJeveE.exe
  2⤵
  PID:5572
- C:\Windows\System\uYadMkp.exe
  C:\Windows\System\uYadMkp.exe
  2⤵
  PID:5604
- C:\Windows\System\AVAzIGz.exe
  C:\Windows\System\AVAzIGz.exe
  2⤵
  PID:5628
- C:\Windows\System\guWCQEi.exe
  C:\Windows\System\guWCQEi.exe
  2⤵
  PID:5656
- C:\Windows\System\HbVwcpn.exe
  C:\Windows\System\HbVwcpn.exe
  2⤵
  PID:5684
- C:\Windows\System\zckgnlW.exe
  C:\Windows\System\zckgnlW.exe
  2⤵
  PID:5712
- C:\Windows\System\xXjeWjo.exe
  C:\Windows\System\xXjeWjo.exe
  2⤵
  PID:5740
- C:\Windows\System\mPJEomM.exe
  C:\Windows\System\mPJEomM.exe
  2⤵
  PID:5768
- C:\Windows\System\fPIwJuQ.exe
  C:\Windows\System\fPIwJuQ.exe
  2⤵
  PID:5796
- C:\Windows\System\xLKCUVu.exe
  C:\Windows\System\xLKCUVu.exe
  2⤵
  PID:5824
- C:\Windows\System\HHhSrdw.exe
  C:\Windows\System\HHhSrdw.exe
  2⤵
  PID:5876
- C:\Windows\System\xVeIKeh.exe
  C:\Windows\System\xVeIKeh.exe
  2⤵
  PID:5944
- C:\Windows\System\jeeHrAu.exe
  C:\Windows\System\jeeHrAu.exe
  2⤵
  PID:5960
- C:\Windows\System\RCxSoRC.exe
  C:\Windows\System\RCxSoRC.exe
  2⤵
  PID:5976
- C:\Windows\System\RZQvwBM.exe
  C:\Windows\System\RZQvwBM.exe
  2⤵
  PID:5996
- C:\Windows\System\hxBlduM.exe
  C:\Windows\System\hxBlduM.exe
  2⤵
  PID:6016
- C:\Windows\System\JnKPKtv.exe
  C:\Windows\System\JnKPKtv.exe
  2⤵
  PID:6040
- C:\Windows\System\tluTohW.exe
  C:\Windows\System\tluTohW.exe
  2⤵
  PID:6080
- C:\Windows\System\qATPrBu.exe
  C:\Windows\System\qATPrBu.exe
  2⤵
  PID:6104
- C:\Windows\System\mZihvqr.exe
  C:\Windows\System\mZihvqr.exe
  2⤵
  PID:6124
- C:\Windows\System\lsxZoyA.exe
  C:\Windows\System\lsxZoyA.exe
  2⤵
  PID:3284
- C:\Windows\System\XpiSQrE.exe
  C:\Windows\System\XpiSQrE.exe
  2⤵
  PID:4300
- C:\Windows\System\HCTyRsJ.exe
  C:\Windows\System\HCTyRsJ.exe
  2⤵
  PID:4728
- C:\Windows\System\nIXsUgV.exe
  C:\Windows\System\nIXsUgV.exe
  2⤵
  PID:3680
- C:\Windows\System\EnUvjTX.exe
  C:\Windows\System\EnUvjTX.exe
  2⤵
  PID:3212
- C:\Windows\System\ouefdnr.exe
  C:\Windows\System\ouefdnr.exe
  2⤵
  PID:5340
- C:\Windows\System\vajOYcy.exe
  C:\Windows\System\vajOYcy.exe
  2⤵
  PID:5396
- C:\Windows\System\CCJszIt.exe
  C:\Windows\System\CCJszIt.exe
  2⤵
  PID:5472
- C:\Windows\System\XEraFlh.exe
  C:\Windows\System\XEraFlh.exe
  2⤵
  PID:5500
- C:\Windows\System\YkyPpgc.exe
  C:\Windows\System\YkyPpgc.exe
  2⤵
  PID:4616
- C:\Windows\System\pYSrBLK.exe
  C:\Windows\System\pYSrBLK.exe
  2⤵
  PID:5588
- C:\Windows\System\SOnTwwf.exe
  C:\Windows\System\SOnTwwf.exe
  2⤵
  PID:2676
- C:\Windows\System\jfooZcS.exe
  C:\Windows\System\jfooZcS.exe
  2⤵
  PID:5668
- C:\Windows\System\JIfXvRw.exe
  C:\Windows\System\JIfXvRw.exe
  2⤵
  PID:5700
- C:\Windows\System\BdmYtPM.exe
  C:\Windows\System\BdmYtPM.exe
  2⤵
  PID:5784
- C:\Windows\System\MnZeWWk.exe
  C:\Windows\System\MnZeWWk.exe
  2⤵
  PID:4060
- C:\Windows\System\yZQRylS.exe
  C:\Windows\System\yZQRylS.exe
  2⤵
  PID:5836
- C:\Windows\System\iOKCvsR.exe
  C:\Windows\System\iOKCvsR.exe
  2⤵
  PID:3036
- C:\Windows\System\BtCfzHX.exe
  C:\Windows\System\BtCfzHX.exe
  2⤵
  PID:2468
- C:\Windows\System\tqQYdQJ.exe
  C:\Windows\System\tqQYdQJ.exe
  2⤵
  PID:904
- C:\Windows\System\PtYnsyj.exe
  C:\Windows\System\PtYnsyj.exe
  2⤵
  PID:5940
- C:\Windows\System\BYEcPQg.exe
  C:\Windows\System\BYEcPQg.exe
  2⤵
  PID:3724
- C:\Windows\System\YhjcojO.exe
  C:\Windows\System\YhjcojO.exe
  2⤵
  PID:5968
- C:\Windows\System\XOtONyi.exe
  C:\Windows\System\XOtONyi.exe
  2⤵
  PID:6100
- C:\Windows\System\OkfBAcZ.exe
  C:\Windows\System\OkfBAcZ.exe
  2⤵
  PID:5012
- C:\Windows\System\yzKbkEz.exe
  C:\Windows\System\yzKbkEz.exe
  2⤵
  PID:5220
- C:\Windows\System\ZHzIqkf.exe
  C:\Windows\System\ZHzIqkf.exe
  2⤵
  PID:948
- C:\Windows\System\oRAKeGb.exe
  C:\Windows\System\oRAKeGb.exe
  2⤵
  PID:5200
- C:\Windows\System\mQrEUJw.exe
  C:\Windows\System\mQrEUJw.exe
  2⤵
  PID:5420
- C:\Windows\System\dvTZoAg.exe
  C:\Windows\System\dvTZoAg.exe
  2⤵
  PID:5556
- C:\Windows\System\ZhsGqiU.exe
  C:\Windows\System\ZhsGqiU.exe
  2⤵
  PID:5652
- C:\Windows\System\kzNqHRW.exe
  C:\Windows\System\kzNqHRW.exe
  2⤵
  PID:3704
- C:\Windows\System\odEMaVp.exe
  C:\Windows\System\odEMaVp.exe
  2⤵
  PID:3328
- C:\Windows\System\MowsWKd.exe
  C:\Windows\System\MowsWKd.exe
  2⤵
  PID:4760
- C:\Windows\System\hjORzOK.exe
  C:\Windows\System\hjORzOK.exe
  2⤵
  PID:5920
- C:\Windows\System\SZVCIAA.exe
  C:\Windows\System\SZVCIAA.exe
  2⤵
  PID:6088
- C:\Windows\System\EbXojcf.exe
  C:\Windows\System\EbXojcf.exe
  2⤵
  PID:5140
- C:\Windows\System\lJBrCas.exe
  C:\Windows\System\lJBrCas.exe
  2⤵
  PID:5584
- C:\Windows\System\HjicAbE.exe
  C:\Windows\System\HjicAbE.exe
  2⤵
  PID:5728
- C:\Windows\System\etkJIOX.exe
  C:\Windows\System\etkJIOX.exe
  2⤵
  PID:3336
- C:\Windows\System\ZenBVZY.exe
  C:\Windows\System\ZenBVZY.exe
  2⤵
  PID:1428
- C:\Windows\System\bixtzUt.exe
  C:\Windows\System\bixtzUt.exe
  2⤵
  PID:5428
- C:\Windows\System\YMiqXeD.exe
  C:\Windows\System\YMiqXeD.exe
  2⤵
  PID:5856
- C:\Windows\System\jcTGzQY.exe
  C:\Windows\System\jcTGzQY.exe
  2⤵
  PID:6172
- C:\Windows\System\KQnJJlF.exe
  C:\Windows\System\KQnJJlF.exe
  2⤵
  PID:6208
- C:\Windows\System\XpMVczg.exe
  C:\Windows\System\XpMVczg.exe
  2⤵
  PID:6236
- C:\Windows\System\lXQHFwp.exe
  C:\Windows\System\lXQHFwp.exe
  2⤵
  PID:6252
- C:\Windows\System\zpDXsps.exe
  C:\Windows\System\zpDXsps.exe
  2⤵
  PID:6288
- C:\Windows\System\LQHuYRZ.exe
  C:\Windows\System\LQHuYRZ.exe
  2⤵
  PID:6308
- C:\Windows\System\qfNCJRd.exe
  C:\Windows\System\qfNCJRd.exe
  2⤵
  PID:6328
- C:\Windows\System\EHEfWTx.exe
  C:\Windows\System\EHEfWTx.exe
  2⤵
  PID:6352
- C:\Windows\System\KbZAIDh.exe
  C:\Windows\System\KbZAIDh.exe
  2⤵
  PID:6380
- C:\Windows\System\tEXqutQ.exe
  C:\Windows\System\tEXqutQ.exe
  2⤵
  PID:6404
- C:\Windows\System\oRYzSJg.exe
  C:\Windows\System\oRYzSJg.exe
  2⤵
  PID:6452
- C:\Windows\System\QvnQFDq.exe
  C:\Windows\System\QvnQFDq.exe
  2⤵
  PID:6468
- C:\Windows\System\IznsGBu.exe
  C:\Windows\System\IznsGBu.exe
  2⤵
  PID:6488
- C:\Windows\System\PYeeEVx.exe
  C:\Windows\System\PYeeEVx.exe
  2⤵
  PID:6516
- C:\Windows\System\OkkUQXZ.exe
  C:\Windows\System\OkkUQXZ.exe
  2⤵
  PID:6532
- C:\Windows\System\vNDQDsz.exe
  C:\Windows\System\vNDQDsz.exe
  2⤵
  PID:6576
- C:\Windows\System\VDLOlpa.exe
  C:\Windows\System\VDLOlpa.exe
  2⤵
  PID:6596
- C:\Windows\System\CziVXSN.exe
  C:\Windows\System\CziVXSN.exe
  2⤵
  PID:6620
- C:\Windows\System\RmnlkSh.exe
  C:\Windows\System\RmnlkSh.exe
  2⤵
  PID:6636
- C:\Windows\System\iZJykIz.exe
  C:\Windows\System\iZJykIz.exe
  2⤵
  PID:6664
- C:\Windows\System\PVBJNuL.exe
  C:\Windows\System\PVBJNuL.exe
  2⤵
  PID:6688
- C:\Windows\System\LyxkbrM.exe
  C:\Windows\System\LyxkbrM.exe
  2⤵
  PID:6708
- C:\Windows\System\pZEqUih.exe
  C:\Windows\System\pZEqUih.exe
  2⤵
  PID:6744
- C:\Windows\System\nvABrqj.exe
  C:\Windows\System\nvABrqj.exe
  2⤵
  PID:6788
- C:\Windows\System\wyPDIJf.exe
  C:\Windows\System\wyPDIJf.exe
  2⤵
  PID:6820
- C:\Windows\System\AmWVfiu.exe
  C:\Windows\System\AmWVfiu.exe
  2⤵
  PID:6868
- C:\Windows\System\WprioyZ.exe
  C:\Windows\System\WprioyZ.exe
  2⤵
  PID:6896
- C:\Windows\System\HZishrW.exe
  C:\Windows\System\HZishrW.exe
  2⤵
  PID:6912
- C:\Windows\System\fzLjiRS.exe
  C:\Windows\System\fzLjiRS.exe
  2⤵
  PID:6932
- C:\Windows\System\XxivKYG.exe
  C:\Windows\System\XxivKYG.exe
  2⤵
  PID:6948
- C:\Windows\System\iMANRWX.exe
  C:\Windows\System\iMANRWX.exe
  2⤵
  PID:6996
- C:\Windows\System\XiVFRTc.exe
  C:\Windows\System\XiVFRTc.exe
  2⤵
  PID:7024
- C:\Windows\System\CxNStxY.exe
  C:\Windows\System\CxNStxY.exe
  2⤵
  PID:7048
- C:\Windows\System\NxHXfvw.exe
  C:\Windows\System\NxHXfvw.exe
  2⤵
  PID:7104
- C:\Windows\System\qdTgIGH.exe
  C:\Windows\System\qdTgIGH.exe
  2⤵
  PID:7124
- C:\Windows\System\RUFxiPW.exe
  C:\Windows\System\RUFxiPW.exe
  2⤵
  PID:7148
- C:\Windows\System\uxoDtIU.exe
  C:\Windows\System\uxoDtIU.exe
  2⤵
  PID:6052
- C:\Windows\System\IQyPVpi.exe
  C:\Windows\System\IQyPVpi.exe
  2⤵
  PID:5312
- C:\Windows\System\gkAnMEq.exe
  C:\Windows\System\gkAnMEq.exe
  2⤵
  PID:6280
- C:\Windows\System\dnbCNmV.exe
  C:\Windows\System\dnbCNmV.exe
  2⤵
  PID:6300
- C:\Windows\System\orfINTS.exe
  C:\Windows\System\orfINTS.exe
  2⤵
  PID:6336
- C:\Windows\System\RYDXSgg.exe
  C:\Windows\System\RYDXSgg.exe
  2⤵
  PID:6396
- C:\Windows\System\mdSIVIX.exe
  C:\Windows\System\mdSIVIX.exe
  2⤵
  PID:6480
- C:\Windows\System\TQphdNl.exe
  C:\Windows\System\TQphdNl.exe
  2⤵
  PID:6588
- C:\Windows\System\YVapzLH.exe
  C:\Windows\System\YVapzLH.exe
  2⤵
  PID:6700
- C:\Windows\System\XrmxiqL.exe
  C:\Windows\System\XrmxiqL.exe
  2⤵
  PID:6652
- C:\Windows\System\piAjHNG.exe
  C:\Windows\System\piAjHNG.exe
  2⤵
  PID:6864
- C:\Windows\System\xWYNhnQ.exe
  C:\Windows\System\xWYNhnQ.exe
  2⤵
  PID:6956
- C:\Windows\System\HeLxlMe.exe
  C:\Windows\System\HeLxlMe.exe
  2⤵
  PID:6876
- C:\Windows\System\OwkxRDJ.exe
  C:\Windows\System\OwkxRDJ.exe
  2⤵
  PID:7016
- C:\Windows\System\QASUkTJ.exe
  C:\Windows\System\QASUkTJ.exe
  2⤵
  PID:6980
- C:\Windows\System\xbIZvrE.exe
  C:\Windows\System\xbIZvrE.exe
  2⤵
  PID:7160
- C:\Windows\System\AONKpmN.exe
  C:\Windows\System\AONKpmN.exe
  2⤵
  PID:5252
- C:\Windows\System\IacVzeG.exe
  C:\Windows\System\IacVzeG.exe
  2⤵
  PID:6244
- C:\Windows\System\groEKOg.exe
  C:\Windows\System\groEKOg.exe
  2⤵
  PID:6444
- C:\Windows\System\StbWDQR.exe
  C:\Windows\System\StbWDQR.exe
  2⤵
  PID:6836
- C:\Windows\System\CvcSpuO.exe
  C:\Windows\System\CvcSpuO.exe
  2⤵
  PID:6612
- C:\Windows\System\lTpwBCW.exe
  C:\Windows\System\lTpwBCW.exe
  2⤵
  PID:6908
- C:\Windows\System\xiKJXdC.exe
  C:\Windows\System\xiKJXdC.exe
  2⤵
  PID:6928
- C:\Windows\System\sICVnWN.exe
  C:\Windows\System\sICVnWN.exe
  2⤵
  PID:6968
- C:\Windows\System\QMdioCt.exe
  C:\Windows\System\QMdioCt.exe
  2⤵
  PID:6880
- C:\Windows\System\QEEDrOl.exe
  C:\Windows\System\QEEDrOl.exe
  2⤵
  PID:5528
- C:\Windows\System\tUGJBZo.exe
  C:\Windows\System\tUGJBZo.exe
  2⤵
  PID:6904
- C:\Windows\System\Varlrnc.exe
  C:\Windows\System\Varlrnc.exe
  2⤵
  PID:6616
- C:\Windows\System\FdpoqNb.exe
  C:\Windows\System\FdpoqNb.exe
  2⤵
  PID:7184
- C:\Windows\System\PKLwHAJ.exe
  C:\Windows\System\PKLwHAJ.exe
  2⤵
  PID:7216
- C:\Windows\System\PDPoyyb.exe
  C:\Windows\System\PDPoyyb.exe
  2⤵
  PID:7236
- C:\Windows\System\ymVSEQG.exe
  C:\Windows\System\ymVSEQG.exe
  2⤵
  PID:7260
- C:\Windows\System\oLXrfzX.exe
  C:\Windows\System\oLXrfzX.exe
  2⤵
  PID:7284
- C:\Windows\System\zhCeKoa.exe
  C:\Windows\System\zhCeKoa.exe
  2⤵
  PID:7308
- C:\Windows\System\ftInKGY.exe
  C:\Windows\System\ftInKGY.exe
  2⤵
  PID:7328
- C:\Windows\System\ILwIGlf.exe
  C:\Windows\System\ILwIGlf.exe
  2⤵
  PID:7344
- C:\Windows\System\FtWthwZ.exe
  C:\Windows\System\FtWthwZ.exe
  2⤵
  PID:7368
- C:\Windows\System\LFdcuqZ.exe
  C:\Windows\System\LFdcuqZ.exe
  2⤵
  PID:7400
- C:\Windows\System\DtbOKMp.exe
  C:\Windows\System\DtbOKMp.exe
  2⤵
  PID:7456
- C:\Windows\System\tYijNNr.exe
  C:\Windows\System\tYijNNr.exe
  2⤵
  PID:7488
- C:\Windows\System\BgmdGBP.exe
  C:\Windows\System\BgmdGBP.exe
  2⤵
  PID:7516
- C:\Windows\System\kjLwvVL.exe
  C:\Windows\System\kjLwvVL.exe
  2⤵
  PID:7536
- C:\Windows\System\qtmdcqN.exe
  C:\Windows\System\qtmdcqN.exe
  2⤵
  PID:7556
- C:\Windows\System\yYWVWwO.exe
  C:\Windows\System\yYWVWwO.exe
  2⤵
  PID:7576
- C:\Windows\System\JPyMXGX.exe
  C:\Windows\System\JPyMXGX.exe
  2⤵
  PID:7604
- C:\Windows\System\dWoSLNc.exe
  C:\Windows\System\dWoSLNc.exe
  2⤵
  PID:7624
- C:\Windows\System\IzkFpHS.exe
  C:\Windows\System\IzkFpHS.exe
  2⤵
  PID:7644
- C:\Windows\System\VUcOKue.exe
  C:\Windows\System\VUcOKue.exe
  2⤵
  PID:7668
- C:\Windows\System\SfygrgI.exe
  C:\Windows\System\SfygrgI.exe
  2⤵
  PID:7684
- C:\Windows\System\haFcLnj.exe
  C:\Windows\System\haFcLnj.exe
  2⤵
  PID:7732
- C:\Windows\System\cctnouO.exe
  C:\Windows\System\cctnouO.exe
  2⤵
  PID:7752
- C:\Windows\System\BuZYgCH.exe
  C:\Windows\System\BuZYgCH.exe
  2⤵
  PID:7776
- C:\Windows\System\ohoQDuA.exe
  C:\Windows\System\ohoQDuA.exe
  2⤵
  PID:7876
- C:\Windows\System\OoXgLLO.exe
  C:\Windows\System\OoXgLLO.exe
  2⤵
  PID:7900
- C:\Windows\System\hNpoAjp.exe
  C:\Windows\System\hNpoAjp.exe
  2⤵
  PID:7936
- C:\Windows\System\WEKhPdd.exe
  C:\Windows\System\WEKhPdd.exe
  2⤵
  PID:7952
- C:\Windows\System\JHLRvAx.exe
  C:\Windows\System\JHLRvAx.exe
  2⤵
  PID:7984
- C:\Windows\System\qjJqESX.exe
  C:\Windows\System\qjJqESX.exe
  2⤵
  PID:8012
- C:\Windows\System\UTQmtWe.exe
  C:\Windows\System\UTQmtWe.exe
  2⤵
  PID:8028
- C:\Windows\System\fUIsVsL.exe
  C:\Windows\System\fUIsVsL.exe
  2⤵
  PID:8056
- C:\Windows\System\qhffnet.exe
  C:\Windows\System\qhffnet.exe
  2⤵
  PID:8084
- C:\Windows\System\dPZqdHH.exe
  C:\Windows\System\dPZqdHH.exe
  2⤵
  PID:8120
- C:\Windows\System\egFkHaE.exe
  C:\Windows\System\egFkHaE.exe
  2⤵
  PID:8140
- C:\Windows\System\eMYJqVq.exe
  C:\Windows\System\eMYJqVq.exe
  2⤵
  PID:8160
- C:\Windows\System\tjIUMTt.exe
  C:\Windows\System\tjIUMTt.exe
  2⤵
  PID:8184
- C:\Windows\System\SzFGNIU.exe
  C:\Windows\System\SzFGNIU.exe
  2⤵
  PID:7176
- C:\Windows\System\PGdtRVb.exe
  C:\Windows\System\PGdtRVb.exe
  2⤵
  PID:7248
- C:\Windows\System\ysiNSKD.exe
  C:\Windows\System\ysiNSKD.exe
  2⤵
  PID:7336
- C:\Windows\System\jFivzFm.exe
  C:\Windows\System\jFivzFm.exe
  2⤵
  PID:7376
- C:\Windows\System\IWFEUjk.exe
  C:\Windows\System\IWFEUjk.exe
  2⤵
  PID:7532
- C:\Windows\System\yDFGgaF.exe
  C:\Windows\System\yDFGgaF.exe
  2⤵
  PID:7508
- C:\Windows\System\GvpIHXQ.exe
  C:\Windows\System\GvpIHXQ.exe
  2⤵
  PID:7640
- C:\Windows\System\hftfEap.exe
  C:\Windows\System\hftfEap.exe
  2⤵
  PID:7596
- C:\Windows\System\HOyjugE.exe
  C:\Windows\System\HOyjugE.exe
  2⤵
  PID:7800
- C:\Windows\System\NVyvlfm.exe
  C:\Windows\System\NVyvlfm.exe
  2⤵
  PID:7832
- C:\Windows\System\wdAXovt.exe
  C:\Windows\System\wdAXovt.exe
  2⤵
  PID:7896
- C:\Windows\System\IoyLWlo.exe
  C:\Windows\System\IoyLWlo.exe
  2⤵
  PID:7964
- C:\Windows\System\cSHzGem.exe
  C:\Windows\System\cSHzGem.exe
  2⤵
  PID:8036
- C:\Windows\System\IGJJuhS.exe
  C:\Windows\System\IGJJuhS.exe
  2⤵
  PID:8064
- C:\Windows\System\QOhXSHe.exe
  C:\Windows\System\QOhXSHe.exe
  2⤵
  PID:8152
- C:\Windows\System\Glktfwo.exe
  C:\Windows\System\Glktfwo.exe
  2⤵
  PID:6344
- C:\Windows\System\sIAhONK.exe
  C:\Windows\System\sIAhONK.exe
  2⤵
  PID:7420
- C:\Windows\System\uaCxlGj.exe
  C:\Windows\System\uaCxlGj.exe
  2⤵
  PID:7324
- C:\Windows\System\FqPDrOk.exe
  C:\Windows\System\FqPDrOk.exe
  2⤵
  PID:7552
- C:\Windows\System\erTcpIG.exe
  C:\Windows\System\erTcpIG.exe
  2⤵
  PID:7588
- C:\Windows\System\cjFcnWO.exe
  C:\Windows\System\cjFcnWO.exe
  2⤵
  PID:7760
- C:\Windows\System\qJtWfik.exe
  C:\Windows\System\qJtWfik.exe
  2⤵
  PID:8004
- C:\Windows\System\NSPocoy.exe
  C:\Windows\System\NSPocoy.exe
  2⤵
  PID:8108
- C:\Windows\System\XuVKTzY.exe
  C:\Windows\System\XuVKTzY.exe
  2⤵
  PID:7232
- C:\Windows\System\jLFTqyY.exe
  C:\Windows\System\jLFTqyY.exe
  2⤵
  PID:7892
- C:\Windows\System\sUmFPTP.exe
  C:\Windows\System\sUmFPTP.exe
  2⤵
  PID:8200
- C:\Windows\System\kDXzHJN.exe
  C:\Windows\System\kDXzHJN.exe
  2⤵
  PID:8224
- C:\Windows\System\DrHETlh.exe
  C:\Windows\System\DrHETlh.exe
  2⤵
  PID:8248
- C:\Windows\System\tPGjwQD.exe
  C:\Windows\System\tPGjwQD.exe
  2⤵
  PID:8276
- C:\Windows\System\zPHMFvo.exe
  C:\Windows\System\zPHMFvo.exe
  2⤵
  PID:8336
- C:\Windows\System\WSKWAwB.exe
  C:\Windows\System\WSKWAwB.exe
  2⤵
  PID:8356
- C:\Windows\System\SsBglvD.exe
  C:\Windows\System\SsBglvD.exe
  2⤵
  PID:8380
- C:\Windows\System\uzJBKHu.exe
  C:\Windows\System\uzJBKHu.exe
  2⤵
  PID:8400
- C:\Windows\System\tmKliYX.exe
  C:\Windows\System\tmKliYX.exe
  2⤵
  PID:8428
- C:\Windows\System\aFyhhHK.exe
  C:\Windows\System\aFyhhHK.exe
  2⤵
  PID:8468
- C:\Windows\System\MsnZHTQ.exe
  C:\Windows\System\MsnZHTQ.exe
  2⤵
  PID:8488
- C:\Windows\System\EEieRYq.exe
  C:\Windows\System\EEieRYq.exe
  2⤵
  PID:8520
- C:\Windows\System\NlegwqM.exe
  C:\Windows\System\NlegwqM.exe
  2⤵
  PID:8540
- C:\Windows\System\uSSpSuL.exe
  C:\Windows\System\uSSpSuL.exe
  2⤵
  PID:8564
- C:\Windows\System\gvBJKSR.exe
  C:\Windows\System\gvBJKSR.exe
  2⤵
  PID:8580
- C:\Windows\System\MgBvLYv.exe
  C:\Windows\System\MgBvLYv.exe
  2⤵
  PID:8600
- C:\Windows\System\TOLzsOp.exe
  C:\Windows\System\TOLzsOp.exe
  2⤵
  PID:8624
- C:\Windows\System\TBzecRZ.exe
  C:\Windows\System\TBzecRZ.exe
  2⤵
  PID:8652
- C:\Windows\System\RjCJfjy.exe
  C:\Windows\System\RjCJfjy.exe
  2⤵
  PID:8720
- C:\Windows\System\yYNRUUg.exe
  C:\Windows\System\yYNRUUg.exe
  2⤵
  PID:8736
- C:\Windows\System\TuJzjad.exe
  C:\Windows\System\TuJzjad.exe
  2⤵
  PID:8760
- C:\Windows\System\MzLwNwg.exe
  C:\Windows\System\MzLwNwg.exe
  2⤵
  PID:8796
- C:\Windows\System\XVWURKO.exe
  C:\Windows\System\XVWURKO.exe
  2⤵
  PID:8820
- C:\Windows\System\GqFzBiE.exe
  C:\Windows\System\GqFzBiE.exe
  2⤵
  PID:8836
- C:\Windows\System\kihHrnr.exe
  C:\Windows\System\kihHrnr.exe
  2⤵
  PID:8868
- C:\Windows\System\doUnOru.exe
  C:\Windows\System\doUnOru.exe
  2⤵
  PID:8916
- C:\Windows\System\MdNPjBP.exe
  C:\Windows\System\MdNPjBP.exe
  2⤵
  PID:8932
- C:\Windows\System\ahOyDJr.exe
  C:\Windows\System\ahOyDJr.exe
  2⤵
  PID:8976
- C:\Windows\System\nKgUOso.exe
  C:\Windows\System\nKgUOso.exe
  2⤵
  PID:9004
- C:\Windows\System\UpbXePb.exe
  C:\Windows\System\UpbXePb.exe
  2⤵
  PID:9032
- C:\Windows\System\RLuURnc.exe
  C:\Windows\System\RLuURnc.exe
  2⤵
  PID:9056
- C:\Windows\System\JPZeYQu.exe
  C:\Windows\System\JPZeYQu.exe
  2⤵
  PID:9076
- C:\Windows\System\dBIMFCJ.exe
  C:\Windows\System\dBIMFCJ.exe
  2⤵
  PID:9100
- C:\Windows\System\IEkusGD.exe
  C:\Windows\System\IEkusGD.exe
  2⤵
  PID:9136
- C:\Windows\System\yWiTXNv.exe
  C:\Windows\System\yWiTXNv.exe
  2⤵
  PID:9164
- C:\Windows\System\GshFqYv.exe
  C:\Windows\System\GshFqYv.exe
  2⤵
  PID:9200
- C:\Windows\System\eczavlx.exe
  C:\Windows\System\eczavlx.exe
  2⤵
  PID:7480
- C:\Windows\System\ylrnraY.exe
  C:\Windows\System\ylrnraY.exe
  2⤵
  PID:8216
- C:\Windows\System\SfkRTDr.exe
  C:\Windows\System\SfkRTDr.exe
  2⤵
  PID:8288
- C:\Windows\System\HMRXDll.exe
  C:\Windows\System\HMRXDll.exe
  2⤵
  PID:8324
- C:\Windows\System\MeArpYF.exe
  C:\Windows\System\MeArpYF.exe
  2⤵
  PID:8376
- C:\Windows\System\gssEzHe.exe
  C:\Windows\System\gssEzHe.exe
  2⤵
  PID:8424
- C:\Windows\System\motjyyE.exe
  C:\Windows\System\motjyyE.exe
  2⤵
  PID:8512
- C:\Windows\System\mHxcRnG.exe
  C:\Windows\System\mHxcRnG.exe
  2⤵
  PID:8592
- C:\Windows\System\jTdOYYK.exe
  C:\Windows\System\jTdOYYK.exe
  2⤵
  PID:8668
- C:\Windows\System\xQZsjzR.exe
  C:\Windows\System\xQZsjzR.exe
  2⤵
  PID:8684
- C:\Windows\System\xUaGKGb.exe
  C:\Windows\System\xUaGKGb.exe
  2⤵
  PID:8816
- C:\Windows\System\PDuADZc.exe
  C:\Windows\System\PDuADZc.exe
  2⤵
  PID:8864
- C:\Windows\System\DHFvGGX.exe
  C:\Windows\System\DHFvGGX.exe
  2⤵
  PID:8928
- C:\Windows\System\vmuYaBa.exe
  C:\Windows\System\vmuYaBa.exe
  2⤵
  PID:8996
- C:\Windows\System\mMePghp.exe
  C:\Windows\System\mMePghp.exe
  2⤵
  PID:9048
- C:\Windows\System\orJWurM.exe
  C:\Windows\System\orJWurM.exe
  2⤵
  PID:9068
- C:\Windows\System\yJdkVOp.exe
  C:\Windows\System\yJdkVOp.exe
  2⤵
  PID:7548
- C:\Windows\System\PTzCjKU.exe
  C:\Windows\System\PTzCjKU.exe
  2⤵
  PID:8240
- C:\Windows\System\RWxZpTU.exe
  C:\Windows\System\RWxZpTU.exe
  2⤵
  PID:8396
- C:\Windows\System\fYBPHkl.exe
  C:\Windows\System\fYBPHkl.exe
  2⤵
  PID:8484
- C:\Windows\System\RnfGZMn.exe
  C:\Windows\System\RnfGZMn.exe
  2⤵
  PID:8548
- C:\Windows\System\dChJaJU.exe
  C:\Windows\System\dChJaJU.exe
  2⤵
  PID:8712
- C:\Windows\System\yDDgthg.exe
  C:\Windows\System\yDDgthg.exe
  2⤵
  PID:8832
- C:\Windows\System\lOfxcqr.exe
  C:\Windows\System\lOfxcqr.exe
  2⤵
  PID:8952
- C:\Windows\System\qoTBQGk.exe
  C:\Windows\System\qoTBQGk.exe
  2⤵
  PID:8256
- C:\Windows\System\NBYxSSU.exe
  C:\Windows\System\NBYxSSU.exe
  2⤵
  PID:2600
- C:\Windows\System\EPHbfBH.exe
  C:\Windows\System\EPHbfBH.exe
  2⤵
  PID:9232
- C:\Windows\System\GvsJSMD.exe
  C:\Windows\System\GvsJSMD.exe
  2⤵
  PID:9248
- C:\Windows\System\OkBBgTf.exe
  C:\Windows\System\OkBBgTf.exe
  2⤵
  PID:9264
- C:\Windows\System\cjtRuET.exe
  C:\Windows\System\cjtRuET.exe
  2⤵
  PID:9280
- C:\Windows\System\QzOTeMN.exe
  C:\Windows\System\QzOTeMN.exe
  2⤵
  PID:9296
- C:\Windows\System\FEQuByt.exe
  C:\Windows\System\FEQuByt.exe
  2⤵
  PID:9316
- C:\Windows\System\zbDfKkk.exe
  C:\Windows\System\zbDfKkk.exe
  2⤵
  PID:9364
- C:\Windows\System\dwYNuLL.exe
  C:\Windows\System\dwYNuLL.exe
  2⤵
  PID:9408
- C:\Windows\System\akGpwfP.exe
  C:\Windows\System\akGpwfP.exe
  2⤵
  PID:9424
- C:\Windows\System\RzhVboF.exe
  C:\Windows\System\RzhVboF.exe
  2⤵
  PID:9440
- C:\Windows\System\BmWvqDP.exe
  C:\Windows\System\BmWvqDP.exe
  2⤵
  PID:9488
- C:\Windows\System\lPDqknx.exe
  C:\Windows\System\lPDqknx.exe
  2⤵
  PID:9544
- C:\Windows\System\qTRrMOF.exe
  C:\Windows\System\qTRrMOF.exe
  2⤵
  PID:9608
- C:\Windows\System\mSlRwPg.exe
  C:\Windows\System\mSlRwPg.exe
  2⤵
  PID:9656
- C:\Windows\System\fTuXosy.exe
  C:\Windows\System\fTuXosy.exe
  2⤵
  PID:9676
- C:\Windows\System\vCiddWa.exe
  C:\Windows\System\vCiddWa.exe
  2⤵
  PID:9700
- C:\Windows\System\UaaOVQX.exe
  C:\Windows\System\UaaOVQX.exe
  2⤵
  PID:9724
- C:\Windows\System\wlDZlji.exe
  C:\Windows\System\wlDZlji.exe
  2⤵
  PID:9768
- C:\Windows\System\uBixXAy.exe
  C:\Windows\System\uBixXAy.exe
  2⤵
  PID:9788
- C:\Windows\System\ZanYzHZ.exe
  C:\Windows\System\ZanYzHZ.exe
  2⤵
  PID:9808
- C:\Windows\System\ANeQAXs.exe
  C:\Windows\System\ANeQAXs.exe
  2⤵
  PID:9836
- C:\Windows\System\NJkLgFo.exe
  C:\Windows\System\NJkLgFo.exe
  2⤵
  PID:9852
- C:\Windows\System\GtUYQws.exe
  C:\Windows\System\GtUYQws.exe
  2⤵
  PID:9880
- C:\Windows\System\fIzMXJJ.exe
  C:\Windows\System\fIzMXJJ.exe
  2⤵
  PID:9904
- C:\Windows\System\lOopqmQ.exe
  C:\Windows\System\lOopqmQ.exe
  2⤵
  PID:9932
- C:\Windows\System\XMKogcw.exe
  C:\Windows\System\XMKogcw.exe
  2⤵
  PID:9952
- C:\Windows\System\WrvcGGy.exe
  C:\Windows\System\WrvcGGy.exe
  2⤵
  PID:10008
- C:\Windows\System\iSWXqZn.exe
  C:\Windows\System\iSWXqZn.exe
  2⤵
  PID:10028
- C:\Windows\System\TKjsocF.exe
  C:\Windows\System\TKjsocF.exe
  2⤵
  PID:10060
- C:\Windows\System\UhEMetk.exe
  C:\Windows\System\UhEMetk.exe
  2⤵
  PID:10076
- C:\Windows\System\hgrdOQN.exe
  C:\Windows\System\hgrdOQN.exe
  2⤵
  PID:10100
- C:\Windows\System\PyAnogX.exe
  C:\Windows\System\PyAnogX.exe
  2⤵
  PID:10132
- C:\Windows\System\rOMzykT.exe
  C:\Windows\System\rOMzykT.exe
  2⤵
  PID:10156
- C:\Windows\System\gIpZhcf.exe
  C:\Windows\System\gIpZhcf.exe
  2⤵
  PID:10176
- C:\Windows\System\bWRCsgF.exe
  C:\Windows\System\bWRCsgF.exe
  2⤵
  PID:10212
- C:\Windows\System\LAsZXRz.exe
  C:\Windows\System\LAsZXRz.exe
  2⤵
  PID:4416
- C:\Windows\System\FYNAFcB.exe
  C:\Windows\System\FYNAFcB.exe
  2⤵
  PID:9348
- C:\Windows\System\RvYZnin.exe
  C:\Windows\System\RvYZnin.exe
  2⤵
  PID:9392
- C:\Windows\System\ZdVBILA.exe
  C:\Windows\System\ZdVBILA.exe
  2⤵
  PID:8480
- C:\Windows\System\ZHXDuKy.exe
  C:\Windows\System\ZHXDuKy.exe
  2⤵
  PID:2116
- C:\Windows\System\lfWOhMW.exe
  C:\Windows\System\lfWOhMW.exe
  2⤵
  PID:9276
- C:\Windows\System\EadLzml.exe
  C:\Windows\System\EadLzml.exe
  2⤵
  PID:8352
- C:\Windows\System\rOqZpsD.exe
  C:\Windows\System\rOqZpsD.exe
  2⤵
  PID:9224
- C:\Windows\System\FXUvsqW.exe
  C:\Windows\System\FXUvsqW.exe
  2⤵
  PID:9388
- C:\Windows\System\xFmivTk.exe
  C:\Windows\System\xFmivTk.exe
  2⤵
  PID:9528
- C:\Windows\System\JXjAaRQ.exe
  C:\Windows\System\JXjAaRQ.exe
  2⤵
  PID:9708
- C:\Windows\System\abhFeJh.exe
  C:\Windows\System\abhFeJh.exe
  2⤵
  PID:9744
- C:\Windows\System\HCdbtnh.exe
  C:\Windows\System\HCdbtnh.exe
  2⤵
  PID:9800
- C:\Windows\System\aRmJzip.exe
  C:\Windows\System\aRmJzip.exe
  2⤵
  PID:9916
- C:\Windows\System\ypCauRK.exe
  C:\Windows\System\ypCauRK.exe
  2⤵
  PID:9848
- C:\Windows\System\fcAPXqI.exe
  C:\Windows\System\fcAPXqI.exe
  2⤵
  PID:9960
- C:\Windows\System\RiTFgst.exe
  C:\Windows\System\RiTFgst.exe
  2⤵
  PID:10124
- C:\Windows\System\HIDYcZs.exe
  C:\Windows\System\HIDYcZs.exe
  2⤵
  PID:10168
- C:\Windows\System\JoWsVcL.exe
  C:\Windows\System\JoWsVcL.exe
  2⤵
  PID:10072
- C:\Windows\System\pSeGTaK.exe
  C:\Windows\System\pSeGTaK.exe
  2⤵
  PID:10232
- C:\Windows\System\tItjlkT.exe
  C:\Windows\System\tItjlkT.exe
  2⤵
  PID:9272
- C:\Windows\System\efEKGnd.exe
  C:\Windows\System\efEKGnd.exe
  2⤵
  PID:9292
- C:\Windows\System\uESLpau.exe
  C:\Windows\System\uESLpau.exe
  2⤵
  PID:9344
- C:\Windows\System\awSrojE.exe
  C:\Windows\System\awSrojE.exe
  2⤵
  PID:9476
- C:\Windows\System\zteuAGN.exe
  C:\Windows\System\zteuAGN.exe
  2⤵
  PID:9716
- C:\Windows\System\hlrrQZe.exe
  C:\Windows\System\hlrrQZe.exe
  2⤵
  PID:9948
- C:\Windows\System\vjlxxMM.exe
  C:\Windows\System\vjlxxMM.exe
  2⤵
  PID:10148
- C:\Windows\System\VVnKSqr.exe
  C:\Windows\System\VVnKSqr.exe
  2⤵
  PID:9132
- C:\Windows\System\thpFiei.exe
  C:\Windows\System\thpFiei.exe
  2⤵
  PID:9376
- C:\Windows\System\qfsUxMX.exe
  C:\Windows\System\qfsUxMX.exe
  2⤵
  PID:9672
- C:\Windows\System\xcGlwCA.exe
  C:\Windows\System\xcGlwCA.exe
  2⤵
  PID:9692
- C:\Windows\System\VvWltjU.exe
  C:\Windows\System\VvWltjU.exe
  2⤵
  PID:9764
- C:\Windows\System\ufdUZAG.exe
  C:\Windows\System\ufdUZAG.exe
  2⤵
  PID:9120
- C:\Windows\System\RbOvjac.exe
  C:\Windows\System\RbOvjac.exe
  2⤵
  PID:10248
- C:\Windows\System\zPhFagL.exe
  C:\Windows\System\zPhFagL.exe
  2⤵
  PID:10264
- C:\Windows\System\CdUMVkO.exe
  C:\Windows\System\CdUMVkO.exe
  2⤵
  PID:10292
- C:\Windows\System\pPiGalg.exe
  C:\Windows\System\pPiGalg.exe
  2⤵
  PID:10312
- C:\Windows\System\DYFPOBU.exe
  C:\Windows\System\DYFPOBU.exe
  2⤵
  PID:10348
- C:\Windows\System\MvOoVsG.exe
  C:\Windows\System\MvOoVsG.exe
  2⤵
  PID:10368
- C:\Windows\System\euCBKnI.exe
  C:\Windows\System\euCBKnI.exe
  2⤵
  PID:10416
- C:\Windows\System\HIrsbYB.exe
  C:\Windows\System\HIrsbYB.exe
  2⤵
  PID:10436
- C:\Windows\System\NsTueMB.exe
  C:\Windows\System\NsTueMB.exe
  2⤵
  PID:10456
- C:\Windows\System\ucTLLva.exe
  C:\Windows\System\ucTLLva.exe
  2⤵
  PID:10512
- C:\Windows\System\USTUlIi.exe
  C:\Windows\System\USTUlIi.exe
  2⤵
  PID:10536
- C:\Windows\System\jqHnRdP.exe
  C:\Windows\System\jqHnRdP.exe
  2⤵
  PID:10564
- C:\Windows\System\SMNPTMu.exe
  C:\Windows\System\SMNPTMu.exe
  2⤵
  PID:10592
- C:\Windows\System\DwyEdJQ.exe
  C:\Windows\System\DwyEdJQ.exe
  2⤵
  PID:10616
- C:\Windows\System\aEoreXc.exe
  C:\Windows\System\aEoreXc.exe
  2⤵
  PID:10636
- C:\Windows\System\leBZMTS.exe
  C:\Windows\System\leBZMTS.exe
  2⤵
  PID:10660
- C:\Windows\System\rgHlHCw.exe
  C:\Windows\System\rgHlHCw.exe
  2⤵
  PID:10676
- C:\Windows\System\FhudTnQ.exe
  C:\Windows\System\FhudTnQ.exe
  2⤵
  PID:10712
- C:\Windows\System\wqfmaut.exe
  C:\Windows\System\wqfmaut.exe
  2⤵
  PID:10736
- C:\Windows\System\JyITSUc.exe
  C:\Windows\System\JyITSUc.exe
  2⤵
  PID:10764
- C:\Windows\System\ZLdBXrj.exe
  C:\Windows\System\ZLdBXrj.exe
  2⤵
  PID:10780
- C:\Windows\System\LzkEZBn.exe
  C:\Windows\System\LzkEZBn.exe
  2⤵
  PID:10800
- C:\Windows\System\WzIBtFR.exe
  C:\Windows\System\WzIBtFR.exe
  2⤵
  PID:10852
- C:\Windows\System\YjmWTEw.exe
  C:\Windows\System\YjmWTEw.exe
  2⤵
  PID:10884
- C:\Windows\System\vwubEVm.exe
  C:\Windows\System\vwubEVm.exe
  2⤵
  PID:10924
- C:\Windows\System\HUhfppB.exe
  C:\Windows\System\HUhfppB.exe
  2⤵
  PID:10948
- C:\Windows\System\CvzVAnp.exe
  C:\Windows\System\CvzVAnp.exe
  2⤵
  PID:10964
- C:\Windows\System\ldmCrcS.exe
  C:\Windows\System\ldmCrcS.exe
  2⤵
  PID:10992
- C:\Windows\System\GjUSOeP.exe
  C:\Windows\System\GjUSOeP.exe
  2⤵
  PID:11032
- C:\Windows\System\KpPnwDk.exe
  C:\Windows\System\KpPnwDk.exe
  2⤵
  PID:11060
- C:\Windows\System\jWiVrby.exe
  C:\Windows\System\jWiVrby.exe
  2⤵
  PID:11104
- C:\Windows\System\kbevSWc.exe
  C:\Windows\System\kbevSWc.exe
  2⤵
  PID:11128
- C:\Windows\System\IrJXQKh.exe
  C:\Windows\System\IrJXQKh.exe
  2⤵
  PID:11156
- C:\Windows\System\SGOknZE.exe
  C:\Windows\System\SGOknZE.exe
  2⤵
  PID:11176
- C:\Windows\System\hrYocRN.exe
  C:\Windows\System\hrYocRN.exe
  2⤵
  PID:11224
- C:\Windows\System\ouAhiyR.exe
  C:\Windows\System\ouAhiyR.exe
  2⤵
  PID:11240
- C:\Windows\System\tCfjjuh.exe
  C:\Windows\System\tCfjjuh.exe
  2⤵
  PID:10048
- C:\Windows\System\MCSlhGr.exe
  C:\Windows\System\MCSlhGr.exe
  2⤵
  PID:10256
- C:\Windows\System\XJiLxoe.exe
  C:\Windows\System\XJiLxoe.exe
  2⤵
  PID:10360
- C:\Windows\System\fGDrYVO.exe
  C:\Windows\System\fGDrYVO.exe
  2⤵
  PID:10404
- C:\Windows\System\LCSzaGz.exe
  C:\Windows\System\LCSzaGz.exe
  2⤵
  PID:10476
- C:\Windows\System\tWJpnrD.exe
  C:\Windows\System\tWJpnrD.exe
  2⤵
  PID:10556
- C:\Windows\System\GsmhSpC.exe
  C:\Windows\System\GsmhSpC.exe
  2⤵
  PID:10624
- C:\Windows\System\hteccFb.exe
  C:\Windows\System\hteccFb.exe
  2⤵
  PID:10672
- C:\Windows\System\AYlsrQB.exe
  C:\Windows\System\AYlsrQB.exe
  2⤵
  PID:10728
- C:\Windows\System\eQsHaNX.exe
  C:\Windows\System\eQsHaNX.exe
  2⤵
  PID:10832
- C:\Windows\System\MQFjwnK.exe
  C:\Windows\System\MQFjwnK.exe
  2⤵
  PID:10892
- C:\Windows\System\cKPDWAI.exe
  C:\Windows\System\cKPDWAI.exe
  2⤵
  PID:10984
- C:\Windows\System\kJoouXW.exe
  C:\Windows\System\kJoouXW.exe
  2⤵
  PID:11020
- C:\Windows\System\EwxKJSa.exe
  C:\Windows\System\EwxKJSa.exe
  2⤵
  PID:11048
- C:\Windows\System\THPtJNz.exe
  C:\Windows\System\THPtJNz.exe
  2⤵
  PID:8576
- C:\Windows\System\zXkvdtC.exe
  C:\Windows\System\zXkvdtC.exe
  2⤵
  PID:11148
- C:\Windows\System\paHOmFW.exe
  C:\Windows\System\paHOmFW.exe
  2⤵
  PID:11216
- C:\Windows\System\wZQxxeu.exe
  C:\Windows\System\wZQxxeu.exe
  2⤵
  PID:10324
- C:\Windows\System\VwYkCjp.exe
  C:\Windows\System\VwYkCjp.exe
  2⤵
  PID:10392
- C:\Windows\System\eXmDesT.exe
  C:\Windows\System\eXmDesT.exe
  2⤵
  PID:10632
- C:\Windows\System\MQgzYUa.exe
  C:\Windows\System\MQgzYUa.exe
  2⤵
  PID:10824
- C:\Windows\System\nINulTy.exe
  C:\Windows\System\nINulTy.exe
  2⤵
  PID:10864
- C:\Windows\System\ATTRPpc.exe
  C:\Windows\System\ATTRPpc.exe
  2⤵
  PID:10940
- C:\Windows\System\BnMWAJa.exe
  C:\Windows\System\BnMWAJa.exe
  2⤵
  PID:11080
- C:\Windows\System\iGvhkMU.exe
  C:\Windows\System\iGvhkMU.exe
  2⤵
  PID:4852
- C:\Windows\System\nPeLIDL.exe
  C:\Windows\System\nPeLIDL.exe
  2⤵
  PID:1440
- C:\Windows\System\lxZRmUp.exe
  C:\Windows\System\lxZRmUp.exe
  2⤵
  PID:11204
- C:\Windows\System\RRhfXNp.exe
  C:\Windows\System\RRhfXNp.exe
  2⤵
  PID:10552
- C:\Windows\System\ixDdZXB.exe
  C:\Windows\System\ixDdZXB.exe
  2⤵
  PID:10788
- C:\Windows\System\eVsFOAv.exe
  C:\Windows\System\eVsFOAv.exe
  2⤵
  PID:11188
- C:\Windows\System\ZTWbFib.exe
  C:\Windows\System\ZTWbFib.exe
  2⤵
  PID:3236
- C:\Windows\System\TaNxbSX.exe
  C:\Windows\System\TaNxbSX.exe
  2⤵
  PID:516
- C:\Windows\System\maDEDvt.exe
  C:\Windows\System\maDEDvt.exe
  2⤵
  PID:3816
- C:\Windows\System\ednRmAJ.exe
  C:\Windows\System\ednRmAJ.exe
  2⤵
  PID:11028
- C:\Windows\System\pYDHlIZ.exe
  C:\Windows\System\pYDHlIZ.exe
  2⤵
  PID:11276
- C:\Windows\System\dEpNxOZ.exe
  C:\Windows\System\dEpNxOZ.exe
  2⤵
  PID:11316
- C:\Windows\System\KnjkRxI.exe
  C:\Windows\System\KnjkRxI.exe
  2⤵
  PID:11356
- C:\Windows\System\DEcKigd.exe
  C:\Windows\System\DEcKigd.exe
  2⤵
  PID:11380
- C:\Windows\System\WmUcjXl.exe
  C:\Windows\System\WmUcjXl.exe
  2⤵
  PID:11400
- C:\Windows\System\mwQDjDr.exe
  C:\Windows\System\mwQDjDr.exe
  2⤵
  PID:11420
- C:\Windows\System\ldrgGUK.exe
  C:\Windows\System\ldrgGUK.exe
  2⤵
  PID:11452
- C:\Windows\System\ObWaCdE.exe
  C:\Windows\System\ObWaCdE.exe
  2⤵
  PID:11476
- C:\Windows\System\kSEmJKu.exe
  C:\Windows\System\kSEmJKu.exe
  2⤵
  PID:11504
- C:\Windows\System\XeiDWrX.exe
  C:\Windows\System\XeiDWrX.exe
  2⤵
  PID:11520
- C:\Windows\System\NYpgnAQ.exe
  C:\Windows\System\NYpgnAQ.exe
  2⤵
  PID:11580
- C:\Windows\System\fwnHqSa.exe
  C:\Windows\System\fwnHqSa.exe
  2⤵
  PID:11620
- C:\Windows\System\yEybJmA.exe
  C:\Windows\System\yEybJmA.exe
  2⤵
  PID:11636
- C:\Windows\System\fBJcSHS.exe
  C:\Windows\System\fBJcSHS.exe
  2⤵
  PID:11656
- C:\Windows\System\qKhNDdC.exe
  C:\Windows\System\qKhNDdC.exe
  2⤵
  PID:11688
- C:\Windows\System\HvXZUyg.exe
  C:\Windows\System\HvXZUyg.exe
  2⤵
  PID:11736
- C:\Windows\System\TeYeHKU.exe
  C:\Windows\System\TeYeHKU.exe
  2⤵
  PID:11756
- C:\Windows\System\QedJrdd.exe
  C:\Windows\System\QedJrdd.exe
  2⤵
  PID:11776
- C:\Windows\System\poddxWl.exe
  C:\Windows\System\poddxWl.exe
  2⤵
  PID:11796
- C:\Windows\System\TTAGTyf.exe
  C:\Windows\System\TTAGTyf.exe
  2⤵
  PID:11812
- C:\Windows\System\rzXgjqw.exe
  C:\Windows\System\rzXgjqw.exe
  2⤵
  PID:11836
- C:\Windows\System\mJhSjPL.exe
  C:\Windows\System\mJhSjPL.exe
  2⤵
  PID:11856
- C:\Windows\System\fczpqAQ.exe
  C:\Windows\System\fczpqAQ.exe
  2⤵
  PID:11872
- C:\Windows\System\EIoOdWu.exe
  C:\Windows\System\EIoOdWu.exe
  2⤵
  PID:11920
- C:\Windows\System\cCxLeHn.exe
  C:\Windows\System\cCxLeHn.exe
  2⤵
  PID:12000
- C:\Windows\System\KRaSAYB.exe
  C:\Windows\System\KRaSAYB.exe
  2⤵
  PID:12016
- C:\Windows\System\iTuFtHM.exe
  C:\Windows\System\iTuFtHM.exe
  2⤵
  PID:12032
- C:\Windows\System\QEynHdC.exe
  C:\Windows\System\QEynHdC.exe
  2⤵
  PID:12084
- C:\Windows\System\jCcYdxm.exe
  C:\Windows\System\jCcYdxm.exe
  2⤵
  PID:12104
- C:\Windows\System\jvmRsRc.exe
  C:\Windows\System\jvmRsRc.exe
  2⤵
  PID:12120
- C:\Windows\System\jomxodc.exe
  C:\Windows\System\jomxodc.exe
  2⤵
  PID:12152
- C:\Windows\System\wOwUoyE.exe
  C:\Windows\System\wOwUoyE.exe
  2⤵
  PID:12168
- C:\Windows\System\JnBREyu.exe
  C:\Windows\System\JnBREyu.exe
  2⤵
  PID:12192
- C:\Windows\System\CXBqEGf.exe
  C:\Windows\System\CXBqEGf.exe
  2⤵
  PID:12212
- C:\Windows\System\QVIiCht.exe
  C:\Windows\System\QVIiCht.exe
  2⤵
  PID:12248
- C:\Windows\System\nodmPXe.exe
  C:\Windows\System\nodmPXe.exe
  2⤵
  PID:12284
- C:\Windows\System\tvgAEMv.exe
  C:\Windows\System\tvgAEMv.exe
  2⤵
  PID:11220
- C:\Windows\System\eGEQFjl.exe
  C:\Windows\System\eGEQFjl.exe
  2⤵
  PID:11324
- C:\Windows\System\NnDjTMB.exe
  C:\Windows\System\NnDjTMB.exe
  2⤵
  PID:11308
- C:\Windows\System\oFVKkrL.exe
  C:\Windows\System\oFVKkrL.exe
  2⤵
  PID:11388
- C:\Windows\System\KYFXQlJ.exe
  C:\Windows\System\KYFXQlJ.exe
  2⤵
  PID:10908
- C:\Windows\System\oxllLJk.exe
  C:\Windows\System\oxllLJk.exe
  2⤵
  PID:11472
- C:\Windows\System\YEKSZVa.exe
  C:\Windows\System\YEKSZVa.exe
  2⤵
  PID:11560
- C:\Windows\System\BSrhAKF.exe
  C:\Windows\System\BSrhAKF.exe
  2⤵
  PID:11612
- C:\Windows\System\UixDWji.exe
  C:\Windows\System\UixDWji.exe
  2⤵
  PID:11652
- C:\Windows\System\pastCuz.exe
  C:\Windows\System\pastCuz.exe
  2⤵
  PID:11748
- C:\Windows\System\ptEevDo.exe
  C:\Windows\System\ptEevDo.exe
  2⤵
  PID:11892
- C:\Windows\System\WcHeWGd.exe
  C:\Windows\System\WcHeWGd.exe
  2⤵
  PID:11960
- C:\Windows\System\dbNlAxj.exe
  C:\Windows\System\dbNlAxj.exe
  2⤵
  PID:12008
- C:\Windows\System\XlwhsvN.exe
  C:\Windows\System\XlwhsvN.exe
  2⤵
  PID:12076
- C:\Windows\System\GYmKSTo.exe
  C:\Windows\System\GYmKSTo.exe
  2⤵
  PID:12096
- C:\Windows\System\cEbztLp.exe
  C:\Windows\System\cEbztLp.exe
  2⤵
  PID:12116
- C:\Windows\System\XuYWkjQ.exe
  C:\Windows\System\XuYWkjQ.exe
  2⤵
  PID:12184
- C:\Windows\System\MVzubEB.exe
  C:\Windows\System\MVzubEB.exe
  2⤵
  PID:2180
- C:\Windows\System\stBeOap.exe
  C:\Windows\System\stBeOap.exe
  2⤵
  PID:11272
- C:\Windows\System\QaqXOnB.exe
  C:\Windows\System\QaqXOnB.exe
  2⤵
  PID:11416
- C:\Windows\System\bKEOODu.exe
  C:\Windows\System\bKEOODu.exe
  2⤵
  PID:11444
- C:\Windows\System\qvaJBrt.exe
  C:\Windows\System\qvaJBrt.exe
  2⤵
  PID:11648
- C:\Windows\System\aYPasoJ.exe
  C:\Windows\System\aYPasoJ.exe
  2⤵
  PID:11676
- C:\Windows\System\TvtgapG.exe
  C:\Windows\System\TvtgapG.exe
  2⤵
  PID:11828
- C:\Windows\System\EDshzgG.exe
  C:\Windows\System\EDshzgG.exe
  2⤵
  PID:11944
- C:\Windows\System\eLNzWeZ.exe
  C:\Windows\System\eLNzWeZ.exe
  2⤵
  PID:12220
- C:\Windows\System\XMsFBLf.exe
  C:\Windows\System\XMsFBLf.exe
  2⤵
  PID:4524
- C:\Windows\System\UYtQPLn.exe
  C:\Windows\System\UYtQPLn.exe
  2⤵
  PID:11808
- C:\Windows\System\eGMNgvz.exe
  C:\Windows\System\eGMNgvz.exe
  2⤵
  PID:12336
- C:\Windows\System\avOHvBK.exe
  C:\Windows\System\avOHvBK.exe
  2⤵
  PID:12356
- C:\Windows\System\QWKNqtF.exe
  C:\Windows\System\QWKNqtF.exe
  2⤵
  PID:12456
- C:\Windows\System\eIfVwWR.exe
  C:\Windows\System\eIfVwWR.exe
  2⤵
  PID:12480
- C:\Windows\System\ijeOEaj.exe
  C:\Windows\System\ijeOEaj.exe
  2⤵
  PID:12496
- C:\Windows\System\VfmKnVt.exe
  C:\Windows\System\VfmKnVt.exe
  2⤵
  PID:12516
- C:\Windows\System\OaMdkqC.exe
  C:\Windows\System\OaMdkqC.exe
  2⤵
  PID:12540
- C:\Windows\System\ZYiuptn.exe
  C:\Windows\System\ZYiuptn.exe
  2⤵
  PID:12584
- C:\Windows\System\nCzwXrR.exe
  C:\Windows\System\nCzwXrR.exe
  2⤵
  PID:12600
- C:\Windows\System\nwhFvAt.exe
  C:\Windows\System\nwhFvAt.exe
  2⤵
  PID:12628
- C:\Windows\System\bdzFNpl.exe
  C:\Windows\System\bdzFNpl.exe
  2⤵
  PID:12720
- C:\Windows\System\KzyaZOk.exe
  C:\Windows\System\KzyaZOk.exe
  2⤵
  PID:12736
- C:\Windows\System\PPbFDWi.exe
  C:\Windows\System\PPbFDWi.exe
  2⤵
  PID:12752
- C:\Windows\System\MKTigpK.exe
  C:\Windows\System\MKTigpK.exe
  2⤵
  PID:12772
- C:\Windows\System\hMfOocH.exe
  C:\Windows\System\hMfOocH.exe
  2⤵
  PID:12792
- C:\Windows\System\nEyYkpI.exe
  C:\Windows\System\nEyYkpI.exe
  2⤵
  PID:12808
- C:\Windows\System\yRyDJQM.exe
  C:\Windows\System\yRyDJQM.exe
  2⤵
  PID:12824
- C:\Windows\System\KpDVzuw.exe
  C:\Windows\System\KpDVzuw.exe
  2⤵
  PID:12844
- C:\Windows\System\EwphjWr.exe
  C:\Windows\System\EwphjWr.exe
  2⤵
  PID:12860
- C:\Windows\System\yUeJpxK.exe
  C:\Windows\System\yUeJpxK.exe
  2⤵
  PID:12876
- C:\Windows\System\YBoQsnJ.exe
  C:\Windows\System\YBoQsnJ.exe
  2⤵
  PID:12892
- C:\Windows\System\TSgFtpn.exe
  C:\Windows\System\TSgFtpn.exe
  2⤵
  PID:12908
- C:\Windows\System\RwwwyYm.exe
  C:\Windows\System\RwwwyYm.exe
  2⤵
  PID:12924
- C:\Windows\System\FwDHnPE.exe
  C:\Windows\System\FwDHnPE.exe
  2⤵
  PID:12940
- C:\Windows\System\DsrpQIx.exe
  C:\Windows\System\DsrpQIx.exe
  2⤵
  PID:12960
- C:\Windows\System\aeRtWyA.exe
  C:\Windows\System\aeRtWyA.exe
  2⤵
  PID:12976
- C:\Windows\System\QsDlzrB.exe
  C:\Windows\System\QsDlzrB.exe
  2⤵
  PID:12992
- C:\Windows\System\QxRPfbM.exe
  C:\Windows\System\QxRPfbM.exe
  2⤵
  PID:13008
- C:\Windows\System\yHMSkJx.exe
  C:\Windows\System\yHMSkJx.exe
  2⤵
  PID:13024
- C:\Windows\System\pYAfbah.exe
  C:\Windows\System\pYAfbah.exe
  2⤵
  PID:13040
- C:\Windows\System\ylcCRFx.exe
  C:\Windows\System\ylcCRFx.exe
  2⤵
  PID:13056
- C:\Windows\System\QPCOhUr.exe
  C:\Windows\System\QPCOhUr.exe
  2⤵
  PID:13080
- C:\Windows\System\wFPHLVy.exe
  C:\Windows\System\wFPHLVy.exe
  2⤵
  PID:13184
- C:\Windows\System\ckBeEvg.exe
  C:\Windows\System\ckBeEvg.exe
  2⤵
  PID:12112
- C:\Windows\System\xJeLgei.exe
  C:\Windows\System\xJeLgei.exe
  2⤵
  PID:12376
- C:\Windows\System\HVXPvQm.exe
  C:\Windows\System\HVXPvQm.exe
  2⤵
  PID:12352
- C:\Windows\System\DvCtrGi.exe
  C:\Windows\System\DvCtrGi.exe
  2⤵
  PID:12472
- C:\Windows\System\fzOFUgs.exe
  C:\Windows\System\fzOFUgs.exe
  2⤵
  PID:12528
- C:\Windows\System\rVHefUZ.exe
  C:\Windows\System\rVHefUZ.exe
  2⤵
  PID:4408
- C:\Windows\System\LSEzEQx.exe
  C:\Windows\System\LSEzEQx.exe
  2⤵
  PID:412
- C:\Windows\System\vuzssFw.exe
  C:\Windows\System\vuzssFw.exe
  2⤵
  PID:12596
- C:\Windows\System\GTSjsfc.exe
  C:\Windows\System\GTSjsfc.exe
  2⤵
  PID:12936
- C:\Windows\System\ssgvqOZ.exe
  C:\Windows\System\ssgvqOZ.exe
  2⤵
  PID:12636
- C:\Windows\System\LswDyTq.exe
  C:\Windows\System\LswDyTq.exe
  2⤵
  PID:12668
- C:\Windows\System\SRYnwQP.exe
  C:\Windows\System\SRYnwQP.exe
  2⤵
  PID:12768
- C:\Windows\System\uvMBpBb.exe
  C:\Windows\System\uvMBpBb.exe
  2⤵
  PID:12804
- C:\Windows\System\HjkPbTy.exe
  C:\Windows\System\HjkPbTy.exe
  2⤵
  PID:12888
- C:\Windows\System\vMCYdKO.exe
  C:\Windows\System\vMCYdKO.exe
  2⤵
  PID:12952
- C:\Windows\System\jVVOyXd.exe
  C:\Windows\System\jVVOyXd.exe
  2⤵
  PID:13052
- C:\Windows\System\athCmHT.exe
  C:\Windows\System\athCmHT.exe
  2⤵
  PID:13068
- C:\Windows\System\dlkqNgJ.exe
  C:\Windows\System\dlkqNgJ.exe
  2⤵
  PID:13108
- C:\Windows\System\AbJcpIw.exe
  C:\Windows\System\AbJcpIw.exe
  2⤵
  PID:13260
- C:\Windows\System\yKdZsHf.exe
  C:\Windows\System\yKdZsHf.exe
  2⤵
  PID:12368
- C:\Windows\System\zFiQYuq.exe
  C:\Windows\System\zFiQYuq.exe
  2⤵
  PID:12412
- C:\Windows\System\HranTgn.exe
  C:\Windows\System\HranTgn.exe
  2⤵
  PID:10700
- C:\Windows\System\CLbKpqG.exe
  C:\Windows\System\CLbKpqG.exe
  2⤵
  PID:12608
- C:\Windows\System\HeiirZA.exe
  C:\Windows\System\HeiirZA.exe
  2⤵
  PID:12400
- C:\Windows\System\WvAcuXd.exe
  C:\Windows\System\WvAcuXd.exe
  2⤵
  PID:12728
- C:\Windows\System\oDVdVwR.exe
  C:\Windows\System\oDVdVwR.exe
  2⤵
  PID:12904
- C:\Windows\System\rTnPjNQ.exe
  C:\Windows\System\rTnPjNQ.exe
  2⤵
  PID:3376
- C:\Windows\System\hUTiMOO.exe
  C:\Windows\System\hUTiMOO.exe
  2⤵
  PID:12704
- C:\Windows\System\BfEwtRY.exe
  C:\Windows\System\BfEwtRY.exe
  2⤵
  PID:12464
- C:\Windows\System\TPOiMde.exe
  C:\Windows\System\TPOiMde.exe
  2⤵
  PID:3256
- C:\Windows\System\FFPioVg.exe
  C:\Windows\System\FFPioVg.exe
  2⤵
  PID:2060
- C:\Windows\System\UBFAaQE.exe
  C:\Windows\System\UBFAaQE.exe
  2⤵
  PID:12524
- C:\Windows\System\pbmQTcZ.exe
  C:\Windows\System\pbmQTcZ.exe
  2⤵
  PID:12164
- C:\Windows\System\BByGCaj.exe
  C:\Windows\System\BByGCaj.exe
  2⤵
  PID:2768
- C:\Windows\System\JYoPnNY.exe
  C:\Windows\System\JYoPnNY.exe
  2⤵
  PID:13376
- C:\Windows\System\cIrTzJU.exe
  C:\Windows\System\cIrTzJU.exe
  2⤵
  PID:13692
- C:\Windows\System\yMNqDGr.exe
  C:\Windows\System\yMNqDGr.exe
  2⤵
  PID:13348
- C:\Windows\System\uYmWXPL.exe
  C:\Windows\System\uYmWXPL.exe
  2⤵
  PID:13628
- C:\Windows\System\FhRabhf.exe
  C:\Windows\System\FhRabhf.exe
  2⤵
  PID:13844
- C:\Windows\System\EPwMnWl.exe
  C:\Windows\System\EPwMnWl.exe
  2⤵
  PID:13864
- C:\Windows\System\zGVSsNA.exe
  C:\Windows\System\zGVSsNA.exe
  2⤵
  PID:13888
- C:\Windows\System\PDsfUXs.exe
  C:\Windows\System\PDsfUXs.exe
  2⤵
  PID:13956
- C:\Windows\System\FOAeNrY.exe
  C:\Windows\System\FOAeNrY.exe
  2⤵
  PID:14004
- C:\Windows\System\ApleumW.exe
  C:\Windows\System\ApleumW.exe
  2⤵
  PID:14104
- C:\Windows\System\UvtjeoN.exe
  C:\Windows\System\UvtjeoN.exe
  2⤵
  PID:14132
- C:\Windows\System\zGfZJiX.exe
  C:\Windows\System\zGfZJiX.exe
  2⤵
  PID:14164
- C:\Windows\System\uZgtJik.exe
  C:\Windows\System\uZgtJik.exe
  2⤵
  PID:14208
- C:\Windows\System\FGsNXzD.exe
  C:\Windows\System\FGsNXzD.exe
  2⤵
  PID:14272
- C:\Windows\System\JTwykwo.exe
  C:\Windows\System\JTwykwo.exe
  2⤵
  PID:13308
- C:\Windows\System\hhuyjbX.exe
  C:\Windows\System\hhuyjbX.exe
  2⤵
  PID:13384
- C:\Windows\System\dGSPlzk.exe
  C:\Windows\System\dGSPlzk.exe
  2⤵
  PID:13396
- C:\Windows\System\lsKvXXA.exe
  C:\Windows\System\lsKvXXA.exe
  2⤵
  PID:13620
- C:\Windows\System\AyJuYhK.exe
  C:\Windows\System\AyJuYhK.exe
  2⤵
  PID:3800
- C:\Windows\System\uDirAxg.exe
  C:\Windows\System\uDirAxg.exe
  2⤵
  PID:13440
- C:\Windows\System\fZJVOLf.exe
  C:\Windows\System\fZJVOLf.exe
  2⤵
  PID:14180
- C:\Windows\System\FMyAfzT.exe
  C:\Windows\System\FMyAfzT.exe
  2⤵
  PID:13776
- C:\Windows\System\DhmCFsJ.exe
  C:\Windows\System\DhmCFsJ.exe
  2⤵
  PID:1668
- C:\Windows\System\DxDShOH.exe
  C:\Windows\System\DxDShOH.exe
  2⤵
  PID:13516
- C:\Windows\System\BvtGUSF.exe
  C:\Windows\System\BvtGUSF.exe
  2⤵
  PID:7272
- C:\Windows\System\CrIHbzM.exe
  C:\Windows\System\CrIHbzM.exe
  2⤵
  PID:6024
- C:\Windows\System\uEnjYqJ.exe
  C:\Windows\System\uEnjYqJ.exe
  2⤵
  PID:13940
- C:\Windows\System\RMlPUze.exe
  C:\Windows\System\RMlPUze.exe
  2⤵
  PID:13796
- C:\Windows\System\VWzjlMz.exe
  C:\Windows\System\VWzjlMz.exe
  2⤵
  PID:8304
- C:\Windows\System\LdBzdaC.exe
  C:\Windows\System\LdBzdaC.exe
  2⤵
  PID:3492
- C:\Windows\System\qJhYuGa.exe
  C:\Windows\System\qJhYuGa.exe
  2⤵
  PID:7932
- C:\Windows\System\lqFPeou.exe
  C:\Windows\System\lqFPeou.exe
  2⤵
  PID:14124
- C:\Windows\System\uYrCiRd.exe
  C:\Windows\System\uYrCiRd.exe
  2⤵
  PID:14224
- C:\Windows\System\bxahcut.exe
  C:\Windows\System\bxahcut.exe
  2⤵
  PID:14240
- C:\Windows\System\GXzfsPI.exe
  C:\Windows\System\GXzfsPI.exe
  2⤵
  PID:14300
- C:\Windows\System\rOZKZsu.exe
  C:\Windows\System\rOZKZsu.exe
  2⤵
  PID:13332
- C:\Windows\System\XFnwZze.exe
  C:\Windows\System\XFnwZze.exe
  2⤵
  PID:14040
- C:\Windows\System\zkraZZs.exe
  C:\Windows\System\zkraZZs.exe
  2⤵
  PID:13852
- C:\Windows\System\vtqZVMJ.exe
  C:\Windows\System\vtqZVMJ.exe
  2⤵
  PID:13944
- C:\Windows\System\elUBjRk.exe
  C:\Windows\System\elUBjRk.exe
  2⤵
  PID:13948
- C:\Windows\System\AQaECiG.exe
  C:\Windows\System\AQaECiG.exe
  2⤵
  PID:8292
- C:\Windows\System\lBeArzG.exe
  C:\Windows\System\lBeArzG.exe
  2⤵
  PID:3320
- C:\Windows\System\rppbdfR.exe
  C:\Windows\System\rppbdfR.exe
  2⤵
  PID:14036
- C:\Windows\System\EZhIixV.exe
  C:\Windows\System\EZhIixV.exe
  2⤵
  PID:14076
- C:\Windows\System\IVExahm.exe
  C:\Windows\System\IVExahm.exe
  2⤵
  PID:8072
- C:\Windows\System\joTfqtQ.exe
  C:\Windows\System\joTfqtQ.exe
  2⤵
  PID:9876
- C:\Windows\System\VULzsgD.exe
  C:\Windows\System\VULzsgD.exe
  2⤵
  PID:14192
- C:\Windows\System\DhqYwTD.exe
  C:\Windows\System\DhqYwTD.exe
  2⤵
  PID:4012
- C:\Windows\System\LgbxgpS.exe
  C:\Windows\System\LgbxgpS.exe
  2⤵
  PID:10120
- C:\Windows\System\OuaMjPT.exe
  C:\Windows\System\OuaMjPT.exe
  2⤵
  PID:8344
- C:\Windows\System\uASjYzI.exe
  C:\Windows\System\uASjYzI.exe
  2⤵
  PID:7620
- C:\Windows\System\OtGilIM.exe
  C:\Windows\System\OtGilIM.exe
  2⤵
  PID:2732
- C:\Windows\System\YmOKZPP.exe
  C:\Windows\System\YmOKZPP.exe
  2⤵
  PID:9760
- C:\Windows\System\GGtaVRw.exe
  C:\Windows\System\GGtaVRw.exe
  2⤵
  PID:13460
- C:\Windows\System\RYcJXgc.exe
  C:\Windows\System\RYcJXgc.exe
  2⤵
  PID:13604
- C:\Windows\System\UyDhRLv.exe
  C:\Windows\System\UyDhRLv.exe
  2⤵
  PID:13680
- C:\Windows\System\WaIhqiN.exe
  C:\Windows\System\WaIhqiN.exe
  2⤵
  PID:13644
- C:\Windows\System\GZsLNJh.exe
  C:\Windows\System\GZsLNJh.exe
  2⤵
  PID:13824
- C:\Windows\System\jXVrayl.exe
  C:\Windows\System\jXVrayl.exe
  2⤵
  PID:1156
- C:\Windows\System\YoVkDVD.exe
  C:\Windows\System\YoVkDVD.exe
  2⤵
  PID:10876
- C:\Windows\System\IqmIMSe.exe
  C:\Windows\System\IqmIMSe.exe
  2⤵
  PID:7788
- C:\Windows\System\WixoPTv.exe
  C:\Windows\System\WixoPTv.exe
  2⤵
  PID:5972
- C:\Windows\System\KYfGBaM.exe
  C:\Windows\System\KYfGBaM.exe
  2⤵
  PID:8260
- C:\Windows\System\ttLuoBt.exe
  C:\Windows\System\ttLuoBt.exe
  2⤵
  PID:4828
- C:\Windows\System\IVepgqz.exe
  C:\Windows\System\IVepgqz.exe
  2⤵
  PID:9572
- C:\Windows\System\hmZmCsJ.exe
  C:\Windows\System\hmZmCsJ.exe
  2⤵
  PID:8328
- C:\Windows\System\PQdJtUn.exe
  C:\Windows\System\PQdJtUn.exe
  2⤵
  PID:9684
- C:\Windows\System\hwtryXR.exe
  C:\Windows\System\hwtryXR.exe
  2⤵
  PID:9696
- C:\Windows\System\tswlHsG.exe
  C:\Windows\System\tswlHsG.exe
  2⤵
  PID:9748
- C:\Windows\System\mEmNnCy.exe
  C:\Windows\System\mEmNnCy.exe
  2⤵
  PID:6416
- C:\Windows\System\YpZTXJU.exe
  C:\Windows\System\YpZTXJU.exe
  2⤵
  PID:1992
- C:\Windows\System\EkpXsBr.exe
  C:\Windows\System\EkpXsBr.exe
  2⤵
  PID:10400
- C:\Windows\System\UswRbxw.exe
  C:\Windows\System\UswRbxw.exe
  2⤵
  PID:14096
- C:\Windows\System\vBSkRmN.exe
  C:\Windows\System\vBSkRmN.exe
  2⤵
  PID:10484
- C:\Windows\System\aPfgdav.exe
  C:\Windows\System\aPfgdav.exe
  2⤵
  PID:1612
- C:\Windows\System\MUUHtKx.exe
  C:\Windows\System\MUUHtKx.exe
  2⤵
  PID:14160
- C:\Windows\System\ReRfUiw.exe
  C:\Windows\System\ReRfUiw.exe
  2⤵
  PID:4676
- C:\Windows\System\rAIlpHO.exe
  C:\Windows\System\rAIlpHO.exe
  2⤵
  PID:8716
- C:\Windows\System\ZODkAgN.exe
  C:\Windows\System\ZODkAgN.exe
  2⤵
  PID:5748
- C:\Windows\System\txrFKQK.exe
  C:\Windows\System\txrFKQK.exe
  2⤵
  PID:9972
- C:\Windows\System\qIntUJN.exe
  C:\Windows\System\qIntUJN.exe
  2⤵
  PID:14260
- C:\Windows\System\jfwUsHL.exe
  C:\Windows\System\jfwUsHL.exe
  2⤵
  PID:14296
- C:\Windows\System\PiIQzHD.exe
  C:\Windows\System\PiIQzHD.exe
  2⤵
  PID:10188
- C:\Windows\System\lEJWubK.exe
  C:\Windows\System\lEJWubK.exe
  2⤵
  PID:7352
- C:\Windows\System\eRCIQzJ.exe
  C:\Windows\System\eRCIQzJ.exe
  2⤵
  PID:6784
- C:\Windows\System\GpDosav.exe
  C:\Windows\System\GpDosav.exe
  2⤵
  PID:6760
- C:\Windows\System\dDtKheU.exe
  C:\Windows\System\dDtKheU.exe
  2⤵
  PID:8964
- C:\Windows\System\zaLMQRR.exe
  C:\Windows\System\zaLMQRR.exe
  2⤵
  PID:4504
- C:\Windows\System\jBdFZRQ.exe
  C:\Windows\System\jBdFZRQ.exe
  2⤵
  PID:13488
- C:\Windows\System\OJbXnhg.exe
  C:\Windows\System\OJbXnhg.exe
  2⤵
  PID:13344
- C:\Windows\System\tQYjouO.exe
  C:\Windows\System\tQYjouO.exe
  2⤵
  PID:13596
- C:\Windows\System\wtTNXgx.exe
  C:\Windows\System\wtTNXgx.exe
  2⤵
  PID:7916
- C:\Windows\System\msiLsOM.exe
  C:\Windows\System\msiLsOM.exe
  2⤵
  PID:11208
- C:\Windows\System\liccSUM.exe
  C:\Windows\System\liccSUM.exe
  2⤵
  PID:9152
- C:\Windows\System\OgTCpNF.exe
  C:\Windows\System\OgTCpNF.exe
  2⤵
  PID:3688
- C:\Windows\System\zlWumDO.exe
  C:\Windows\System\zlWumDO.exe
  2⤵
  PID:13748
- C:\Windows\System\lUFhSuT.exe
  C:\Windows\System\lUFhSuT.exe
  2⤵
  PID:13732
- C:\Windows\System\mAzzyqt.exe
  C:\Windows\System\mAzzyqt.exe
  2⤵
  PID:1488
- C:\Windows\System\dXDtITC.exe
  C:\Windows\System\dXDtITC.exe
  2⤵
  PID:10408
- C:\Windows\System\Oeuznur.exe
  C:\Windows\System\Oeuznur.exe
  2⤵
  PID:10612
- C:\Windows\System\EsKlJjA.exe
  C:\Windows\System\EsKlJjA.exe
  2⤵
  PID:10708
- C:\Windows\System\MZDqMHh.exe
  C:\Windows\System\MZDqMHh.exe
  2⤵
  PID:10732
- C:\Windows\System\plVDVJi.exe
  C:\Windows\System\plVDVJi.exe
  2⤵
  PID:3564
- C:\Windows\System\imsvwGi.exe
  C:\Windows\System\imsvwGi.exe
  2⤵
  PID:244
- C:\Windows\System\yWKqtnH.exe
  C:\Windows\System\yWKqtnH.exe
  2⤵
  PID:1656
- C:\Windows\System\kyQamoW.exe
  C:\Windows\System\kyQamoW.exe
  2⤵
  PID:13916
- C:\Windows\System\KxVVfKk.exe
  C:\Windows\System\KxVVfKk.exe
  2⤵
  PID:1764
- C:\Windows\System\LTovjYi.exe
  C:\Windows\System\LTovjYi.exe
  2⤵
  PID:5400
- C:\Windows\System\zHlqKyu.exe
  C:\Windows\System\zHlqKyu.exe
  2⤵
  PID:2632
- C:\Windows\System\gIzRIlb.exe
  C:\Windows\System\gIzRIlb.exe
  2⤵
  PID:8648
- C:\Windows\System\IzcLKuX.exe
  C:\Windows\System\IzcLKuX.exe
  2⤵
  PID:4020
- C:\Windows\System\yySwqQg.exe
  C:\Windows\System\yySwqQg.exe
  2⤵
  PID:5280
- C:\Windows\System\guSJVWd.exe
  C:\Windows\System\guSJVWd.exe
  2⤵
  PID:5412
- C:\Windows\System\rEuSNlv.exe
  C:\Windows\System\rEuSNlv.exe
  2⤵
  PID:7772
- C:\Windows\System\lPQSYCR.exe
  C:\Windows\System\lPQSYCR.exe
  2⤵
  PID:5664
- C:\Windows\System\DnZMNRb.exe
  C:\Windows\System\DnZMNRb.exe
  2⤵
  PID:9924
- C:\Windows\System\iHmmRRE.exe
  C:\Windows\System\iHmmRRE.exe
  2⤵
  PID:5764
- C:\Windows\System\WJJgRbX.exe
  C:\Windows\System\WJJgRbX.exe
  2⤵
  PID:5912
- C:\Windows\System\iskwBwc.exe
  C:\Windows\System\iskwBwc.exe
  2⤵
  PID:5816
- C:\Windows\System\cMatRDQ.exe
  C:\Windows\System\cMatRDQ.exe
  2⤵
  PID:5852
- C:\Windows\System\PJfTjKj.exe
  C:\Windows\System\PJfTjKj.exe
  2⤵
  PID:5864
- C:\Windows\System\ZaXPgfM.exe
  C:\Windows\System\ZaXPgfM.exe
  2⤵
  PID:9712
- C:\Windows\System\yFrXTyn.exe
  C:\Windows\System\yFrXTyn.exe
  2⤵
  PID:4432
- C:\Windows\System\GIneOEk.exe
  C:\Windows\System\GIneOEk.exe
  2⤵
  PID:14152
- C:\Windows\System\CqBqGZd.exe
  C:\Windows\System\CqBqGZd.exe
  2⤵
  PID:12176
- C:\Windows\System\JSjVFoF.exe
  C:\Windows\System\JSjVFoF.exe
  2⤵
  PID:14248
- C:\Windows\System\qjJxFLd.exe
  C:\Windows\System\qjJxFLd.exe
  2⤵
  PID:6068
- C:\Windows\System\WelDXBM.exe
  C:\Windows\System\WelDXBM.exe
  2⤵
  PID:1144
- C:\Windows\System\IaLkaPe.exe
  C:\Windows\System\IaLkaPe.exe
  2⤵
  PID:3640
- C:\Windows\System\fdqviRR.exe
  C:\Windows\System\fdqviRR.exe
  2⤵
  PID:7140
- C:\Windows\System\ggiCrqP.exe
  C:\Windows\System\ggiCrqP.exe
  2⤵
  PID:12504
- C:\Windows\System\PuQOQeH.exe
  C:\Windows\System\PuQOQeH.exe
  2⤵
  PID:468
- C:\Windows\System\rnuGgUI.exe
  C:\Windows\System\rnuGgUI.exe
  2⤵
  PID:6848
- C:\Windows\System\eJadxke.exe
  C:\Windows\System\eJadxke.exe
  2⤵
  PID:4804
- C:\Windows\System\LaSkBlj.exe
  C:\Windows\System\LaSkBlj.exe
  2⤵
  PID:1460
- C:\Windows\System\hGCBFLE.exe
  C:\Windows\System\hGCBFLE.exe
  2⤵
  PID:13952
- C:\Windows\System\xTPtRSx.exe
  C:\Windows\System\xTPtRSx.exe
  2⤵
  PID:5368
- C:\Windows\System\GTLYdfe.exe
  C:\Windows\System\GTLYdfe.exe
  2⤵
  PID:1660
- C:\Windows\System\edmxnPa.exe
  C:\Windows\System\edmxnPa.exe
  2⤵
  PID:11972
- C:\Windows\System\uqsUZyB.exe
  C:\Windows\System\uqsUZyB.exe
  2⤵
  PID:5088
- C:\Windows\System\LXCFkkE.exe
  C:\Windows\System\LXCFkkE.exe
  2⤵
  PID:1680
- C:\Windows\System\yagRNkP.exe
  C:\Windows\System\yagRNkP.exe
  2⤵
  PID:13768
- C:\Windows\System\iuFwKsN.exe
  C:\Windows\System\iuFwKsN.exe
  2⤵
  PID:2216
- C:\Windows\System\jHfzaDc.exe
  C:\Windows\System\jHfzaDc.exe
  2⤵
  PID:13708
- C:\Windows\System\GqleXCC.exe
  C:\Windows\System\GqleXCC.exe
  2⤵
  PID:13172
- C:\Windows\System\ZSPhZuJ.exe
  C:\Windows\System\ZSPhZuJ.exe
  2⤵
  PID:12292
- C:\Windows\System\BMjEuyG.exe
  C:\Windows\System\BMjEuyG.exe
  2⤵
  PID:12324
- C:\Windows\System\zzxyMNC.exe
  C:\Windows\System\zzxyMNC.exe
  2⤵
  PID:8392
- C:\Windows\System\kTBJRIA.exe
  C:\Windows\System\kTBJRIA.exe
  2⤵
  PID:6716
- C:\Windows\System\khmzcer.exe
  C:\Windows\System\khmzcer.exe
  2⤵
  PID:13792
- C:\Windows\System\GuZBCLo.exe
  C:\Windows\System\GuZBCLo.exe
  2⤵
  PID:348
- C:\Windows\System\goOFqdI.exe
  C:\Windows\System\goOFqdI.exe
  2⤵
  PID:13856
- C:\Windows\System\kBQKoiz.exe
  C:\Windows\System\kBQKoiz.exe
  2⤵
  PID:5160
- C:\Windows\System\PkLUAdU.exe
  C:\Windows\System\PkLUAdU.exe
  2⤵
  PID:7100
- C:\Windows\System\aJubdwh.exe
  C:\Windows\System\aJubdwh.exe
  2⤵
  PID:13404
- C:\Windows\System\NjfaDSN.exe
  C:\Windows\System\NjfaDSN.exe
  2⤵
  PID:7112
- C:\Windows\System\LGKzaMw.exe
  C:\Windows\System\LGKzaMw.exe
  2⤵
  PID:3148
- C:\Windows\System\nogcdnJ.exe
  C:\Windows\System\nogcdnJ.exe
  2⤵
  PID:11540
- C:\Windows\System\ayxUrTW.exe
  C:\Windows\System\ayxUrTW.exe
  2⤵
  PID:5144
- C:\Windows\System\cNDPenZ.exe
  C:\Windows\System\cNDPenZ.exe
  2⤵
  PID:5484
- C:\Windows\System\sPLilyg.exe
  C:\Windows\System\sPLilyg.exe
  2⤵
  PID:5540
- C:\Windows\System\aohGGIf.exe
  C:\Windows\System\aohGGIf.exe
  2⤵
  PID:5600
- C:\Windows\System\GGOtCAp.exe
  C:\Windows\System\GGOtCAp.exe
  2⤵
  PID:7080
- C:\Windows\System\lUpzDeu.exe
  C:\Windows\System\lUpzDeu.exe
  2⤵
  PID:5248
- C:\Windows\System\DXruwra.exe
  C:\Windows\System\DXruwra.exe
  2⤵
  PID:6572
- C:\Windows\System\JSjjcqC.exe
  C:\Windows\System\JSjjcqC.exe
  2⤵
  PID:6420
- C:\Windows\System\mUehzEv.exe
  C:\Windows\System\mUehzEv.exe
  2⤵
  PID:14032
- C:\Windows\System\pxWHUOJ.exe
  C:\Windows\System\pxWHUOJ.exe
  2⤵
  PID:8312
- C:\Windows\System\xaNGBZu.exe
  C:\Windows\System\xaNGBZu.exe
  2⤵
  PID:7392
- C:\Windows\System\wjgJDET.exe
  C:\Windows\System\wjgJDET.exe
  2⤵
  PID:7428
- C:\Windows\System\abBHMYw.exe
  C:\Windows\System\abBHMYw.exe
  2⤵
  PID:7464
- C:\Windows\System\JDeurnZ.exe
  C:\Windows\System\JDeurnZ.exe
  2⤵
  PID:7524
- C:\Windows\System\bxDidyw.exe
  C:\Windows\System\bxDidyw.exe
  2⤵
  PID:7612
- C:\Windows\System\fItHEdG.exe
  C:\Windows\System\fItHEdG.exe
  2⤵
  PID:540
- C:\Windows\System\iKEqVbn.exe
  C:\Windows\System\iKEqVbn.exe
  2⤵
  PID:7720
- C:\Windows\System\sfaGvvt.exe
  C:\Windows\System\sfaGvvt.exe
  2⤵
  PID:3948
- C:\Windows\System\sbOExKh.exe
  C:\Windows\System\sbOExKh.exe
  2⤵
  PID:7888
- C:\Windows\System\vIdgtCe.exe
  C:\Windows\System\vIdgtCe.exe
  2⤵
  PID:12440
- C:\Windows\System\mEUEXTi.exe
  C:\Windows\System\mEUEXTi.exe
  2⤵
  PID:1436
- C:\Windows\System\KLhNWgM.exe
  C:\Windows\System\KLhNWgM.exe
  2⤵
  PID:8116
- C:\Windows\System\EUDJcGj.exe
  C:\Windows\System\EUDJcGj.exe
  2⤵
  PID:8232
- C:\Windows\System\ZpXMrkz.exe
  C:\Windows\System\ZpXMrkz.exe
  2⤵
  PID:3952
- C:\Windows\System\CYVVmWR.exe
  C:\Windows\System\CYVVmWR.exe
  2⤵
  PID:8940
- C:\Windows\System\neZwGBB.exe
  C:\Windows\System\neZwGBB.exe
  2⤵
  PID:7728
- C:\Windows\System\huKZUQn.exe
  C:\Windows\System\huKZUQn.exe
  2⤵
  PID:2480
- C:\Windows\System\DzCjvng.exe
  C:\Windows\System\DzCjvng.exe
  2⤵
  PID:10912
- C:\Windows\System\sWFwaFn.exe
  C:\Windows\System\sWFwaFn.exe
  2⤵
  PID:13356
- C:\Windows\System\yZpKmhq.exe
  C:\Windows\System\yZpKmhq.exe
  2⤵
  PID:11112
- C:\Windows\System\hBawrZL.exe
  C:\Windows\System\hBawrZL.exe
  2⤵
  PID:8024
- C:\Windows\System\ajlsJOV.exe
  C:\Windows\System\ajlsJOV.exe
  2⤵
  PID:8212
- C:\Windows\System\nRmHtFu.exe
  C:\Windows\System\nRmHtFu.exe
  2⤵
  PID:2140
- C:\Windows\System\smpcAxW.exe
  C:\Windows\System\smpcAxW.exe
  2⤵
  PID:11980
- C:\Windows\System\GCLvduS.exe
  C:\Windows\System\GCLvduS.exe
  2⤵
  PID:8560
- C:\Windows\System\FelTdVB.exe
  C:\Windows\System\FelTdVB.exe
  2⤵
  PID:13588
- C:\Windows\System\PUatNip.exe
  C:\Windows\System\PUatNip.exe
  2⤵
  PID:2936
- C:\Windows\System\gZPeTen.exe
  C:\Windows\System\gZPeTen.exe
  2⤵
  PID:9124
- C:\Windows\System\adBPAYq.exe
  C:\Windows\System\adBPAYq.exe
  2⤵
  PID:9208
- C:\Windows\System\pCaKAgI.exe
  C:\Windows\System\pCaKAgI.exe
  2⤵
  PID:8420
- C:\Windows\System\LiBQSiq.exe
  C:\Windows\System\LiBQSiq.exe
  2⤵
  PID:6432
- C:\Windows\System\rKJWNVp.exe
  C:\Windows\System\rKJWNVp.exe
  2⤵
  PID:8780
- C:\Windows\System\lDxKHFQ.exe
  C:\Windows\System\lDxKHFQ.exe
  2⤵
  PID:8924
- C:\Windows\System\yuWefse.exe
  C:\Windows\System\yuWefse.exe
  2⤵
  PID:6660
- C:\Windows\System\TrhbemX.exe
  C:\Windows\System\TrhbemX.exe
  2⤵
  PID:10848
- C:\Windows\System\LNwGqby.exe
  C:\Windows\System\LNwGqby.exe
  2⤵
  PID:13860
- C:\Windows\System\qFsuKaF.exe
  C:\Windows\System\qFsuKaF.exe
  2⤵
  PID:3708
- C:\Windows\System\AVQZKvZ.exe
  C:\Windows\System\AVQZKvZ.exe
  2⤵
  PID:7060
- C:\Windows\System\MUMnPpd.exe
  C:\Windows\System\MUMnPpd.exe
  2⤵
  PID:9452
- C:\Windows\System\eDKMVqV.exe
  C:\Windows\System\eDKMVqV.exe
  2⤵
  PID:11556
- C:\Windows\System\hRfHLuO.exe
  C:\Windows\System\hRfHLuO.exe
  2⤵
  PID:9524
- C:\Windows\System\HqnwAFb.exe
  C:\Windows\System\HqnwAFb.exe
  2⤵
  PID:9552
- C:\Windows\System\FiJMCeq.exe
  C:\Windows\System\FiJMCeq.exe
  2⤵
  PID:5568
- C:\Windows\System\XDsXrSD.exe
  C:\Windows\System\XDsXrSD.exe
  2⤵
  PID:5648
- C:\Windows\System\WLJwxxa.exe
  C:\Windows\System\WLJwxxa.exe
  2⤵
  PID:3984
- C:\Windows\System\MNJYZUg.exe
  C:\Windows\System\MNJYZUg.exe
  2⤵
  PID:9892
- C:\Windows\System\AUvTdvH.exe
  C:\Windows\System\AUvTdvH.exe
  2⤵
  PID:3468
- C:\Windows\System\qjxKitr.exe
  C:\Windows\System\qjxKitr.exe
  2⤵
  PID:14016
- C:\Windows\System\EanozdL.exe
  C:\Windows\System\EanozdL.exe
  2⤵
  PID:6264
- C:\Windows\System\sYlHcZT.exe
  C:\Windows\System\sYlHcZT.exe
  2⤵
  PID:9244
- C:\Windows\System\RuMAGAF.exe
  C:\Windows\System\RuMAGAF.exe
  2⤵
  PID:9308
- C:\Windows\System\MNuMbWz.exe
  C:\Windows\System\MNuMbWz.exe
  2⤵
  PID:9644
- C:\Windows\System\IiEaHxM.exe
  C:\Windows\System\IiEaHxM.exe
  2⤵
  PID:14012
- C:\Windows\System\kCsNhQn.exe
  C:\Windows\System\kCsNhQn.exe
  2⤵
  PID:14064
- C:\Windows\System\nvMSDwX.exe
  C:\Windows\System\nvMSDwX.exe
  2⤵
  PID:7600
- C:\Windows\System\acWnJYf.exe
  C:\Windows\System\acWnJYf.exe
  2⤵
  PID:7696
- C:\Windows\System\CdBIwsw.exe
  C:\Windows\System\CdBIwsw.exe
  2⤵
  PID:6096
- C:\Windows\System\rbZXbDM.exe
  C:\Windows\System\rbZXbDM.exe
  2⤵
  PID:7852
- C:\Windows\System\JcUadrG.exe
  C:\Windows\System\JcUadrG.exe
  2⤵
  PID:10044
- C:\Windows\System\PfAnskL.exe
  C:\Windows\System\PfAnskL.exe
  2⤵
  PID:9336
- C:\Windows\System\yEVnljn.exe
  C:\Windows\System\yEVnljn.exe
  2⤵
  PID:14264
- C:\Windows\System\ZLvcxnt.exe
  C:\Windows\System\ZLvcxnt.exe
  2⤵
  PID:4668
- C:\Windows\System\JNOLHbI.exe
  C:\Windows\System\JNOLHbI.exe
  2⤵
  PID:10464
- C:\Windows\System\BadprOs.exe
  C:\Windows\System\BadprOs.exe
  2⤵
  PID:7224
- C:\Windows\System\WifUKiy.exe
  C:\Windows\System\WifUKiy.exe
  2⤵
  PID:6892
- C:\Windows\System\dOWLjNr.exe
  C:\Windows\System\dOWLjNr.exe
  2⤵
  PID:10648
- C:\Windows\System\ptXWFQh.exe
  C:\Windows\System\ptXWFQh.exe
  2⤵
  PID:10688
- C:\Windows\System\lnDjtQE.exe
  C:\Windows\System\lnDjtQE.exe
  2⤵
  PID:10836
- C:\Windows\System\NcetiKS.exe
  C:\Windows\System\NcetiKS.exe
  2⤵
  PID:10896
- C:\Windows\System\YsPypaf.exe
  C:\Windows\System\YsPypaf.exe
  2⤵
  PID:11004
- C:\Windows\System\oHeFcjT.exe
  C:\Windows\System\oHeFcjT.exe
  2⤵
  PID:9040
- C:\Windows\System\Dqjqoym.exe
  C:\Windows\System\Dqjqoym.exe
  2⤵
  PID:4520
- C:\Windows\System\ujdUVtr.exe
  C:\Windows\System\ujdUVtr.exe
  2⤵
  PID:13036
- C:\Windows\System\Uivxgny.exe
  C:\Windows\System\Uivxgny.exe
  2⤵
  PID:3372
- C:\Windows\System\mIkXLyV.exe
  C:\Windows\System\mIkXLyV.exe
  2⤵
  PID:6028
- C:\Windows\System\fbgObOm.exe
  C:\Windows\System\fbgObOm.exe
  2⤵
  PID:8444
- C:\Windows\System\mgmYQfJ.exe
  C:\Windows\System\mgmYQfJ.exe
  2⤵
  PID:8496
- C:\Windows\System\uxmxnWl.exe
  C:\Windows\System\uxmxnWl.exe
  2⤵
  PID:4820
- C:\Windows\System\qWQYlhu.exe
  C:\Windows\System\qWQYlhu.exe
  2⤵
  PID:2952
- C:\Windows\System\DfWXaDG.exe
  C:\Windows\System\DfWXaDG.exe
  2⤵
  PID:10588
- C:\Windows\System\SzNIJsE.exe
  C:\Windows\System\SzNIJsE.exe
  2⤵
  PID:2512
- C:\Windows\System\QyLlljT.exe
  C:\Windows\System\QyLlljT.exe
  2⤵
  PID:8504
- C:\Windows\System\VvvidOY.exe
  C:\Windows\System\VvvidOY.exe
  2⤵
  PID:10384
- C:\Windows\System\kVeaGVO.exe
  C:\Windows\System\kVeaGVO.exe
  2⤵
  PID:11140
- C:\Windows\System\ImEULtN.exe
  C:\Windows\System\ImEULtN.exe
  2⤵
  PID:6428
- C:\Windows\System\WfDLJiX.exe
  C:\Windows\System\WfDLJiX.exe
  2⤵
  PID:11284
- C:\Windows\System\wFkQXia.exe
  C:\Windows\System\wFkQXia.exe
  2⤵
  PID:2940
- C:\Windows\System\qLnfQGg.exe
  C:\Windows\System\qLnfQGg.exe
  2⤵
  PID:12820
- C:\Windows\System\vXiQlDp.exe
  C:\Windows\System\vXiQlDp.exe
  2⤵
  PID:11428
- C:\Windows\System\MupKuaw.exe
  C:\Windows\System\MupKuaw.exe
  2⤵
  PID:11532
- C:\Windows\System\aJTsVoN.exe
  C:\Windows\System\aJTsVoN.exe
  2⤵
  PID:13900
- C:\Windows\System\zvSfCZZ.exe
  C:\Windows\System\zvSfCZZ.exe
  2⤵
  PID:11600
- C:\Windows\System\aazaWsz.exe
  C:\Windows\System\aazaWsz.exe
  2⤵
  PID:11616
- C:\Windows\System\qXlFUjk.exe
  C:\Windows\System\qXlFUjk.exe
  2⤵
  PID:11696
- C:\Windows\System\DMlbRjp.exe
  C:\Windows\System\DMlbRjp.exe
  2⤵
  PID:11728
- C:\Windows\System\VgxirrW.exe
  C:\Windows\System\VgxirrW.exe
  2⤵
  PID:13140
- C:\Windows\System\QDXwzLp.exe
  C:\Windows\System\QDXwzLp.exe
  2⤵
  PID:9504
- C:\Windows\System\zojAocu.exe
  C:\Windows\System\zojAocu.exe
  2⤵
  PID:3660
- C:\Windows\System\AmAjGPO.exe
  C:\Windows\System\AmAjGPO.exe
  2⤵
  PID:11984
- C:\Windows\System\CnHZLXs.exe
  C:\Windows\System\CnHZLXs.exe
  2⤵
  PID:9600
- C:\Windows\System\iioSGvM.exe
  C:\Windows\System\iioSGvM.exe
  2⤵
  PID:5524
- C:\Windows\System\NHYLfMd.exe
  C:\Windows\System\NHYLfMd.exe
  2⤵
  PID:5680
- C:\Windows\System\ygYBziA.exe
  C:\Windows\System\ygYBziA.exe
  2⤵
  PID:12200
- C:\Windows\System\VxegPdt.exe
  C:\Windows\System\VxegPdt.exe
  2⤵
  PID:10116
- C:\Windows\System\TjJeori.exe
  C:\Windows\System\TjJeori.exe
  2⤵
  PID:12268
- C:\Windows\System\flBfWYc.exe
  C:\Windows\System\flBfWYc.exe
  2⤵
  PID:9432
- C:\Windows\System\sBfeSZs.exe
  C:\Windows\System\sBfeSZs.exe
  2⤵
  PID:11484
- C:\Windows\System\aqcOaoG.exe
  C:\Windows\System\aqcOaoG.exe
  2⤵
  PID:11724
- C:\Windows\System\tSiOnKM.exe
  C:\Windows\System\tSiOnKM.exe
  2⤵
  PID:8236
- C:\Windows\System\LNPaDkf.exe
  C:\Windows\System\LNPaDkf.exe
  2⤵
  PID:7172
- C:\Windows\System\zziMAkJ.exe
  C:\Windows\System\zziMAkJ.exe
  2⤵
  PID:11820
- C:\Windows\System\cZjyZVl.exe
  C:\Windows\System\cZjyZVl.exe
  2⤵
  PID:11824
- C:\Windows\System\aLmMCKW.exe
  C:\Windows\System\aLmMCKW.exe
  2⤵
  PID:12148
- C:\Windows\System\KGsynpm.exe
  C:\Windows\System\KGsynpm.exe
  2⤵
  PID:10004
- C:\Windows\System\LwqnbHb.exe
  C:\Windows\System\LwqnbHb.exe
  2⤵
  PID:9980
- C:\Windows\System\qAVkINq.exe
  C:\Windows\System\qAVkINq.exe
  2⤵
  PID:7816
- C:\Windows\System\SUfACjk.exe
  C:\Windows\System\SUfACjk.exe
  2⤵
  PID:12364
- C:\Windows\System\sBLXRYU.exe
  C:\Windows\System\sBLXRYU.exe
  2⤵
  PID:14308
- C:\Windows\System\lStyjqP.exe
  C:\Windows\System\lStyjqP.exe
  2⤵
  PID:5168
- C:\Windows\System\hkPeSMQ.exe
  C:\Windows\System\hkPeSMQ.exe
  2⤵
  PID:7960
- C:\Windows\System\aIOTIgZ.exe
  C:\Windows\System\aIOTIgZ.exe
  2⤵
  PID:12532
- C:\Windows\System\YTScALp.exe
  C:\Windows\System\YTScALp.exe
  2⤵
  PID:6860
- C:\Windows\System\OHyEMYB.exe
  C:\Windows\System\OHyEMYB.exe
  2⤵
  PID:12760
- C:\Windows\System\QumRFoR.exe
  C:\Windows\System\QumRFoR.exe
  2⤵
  PID:2200
- C:\Windows\System\mrdGlLo.exe
  C:\Windows\System\mrdGlLo.exe
  2⤵
  PID:13336
- C:\Windows\System\kQCvXbN.exe
  C:\Windows\System\kQCvXbN.exe
  2⤵
  PID:7504
- C:\Windows\System\zwSwOeJ.exe
  C:\Windows\System\zwSwOeJ.exe
  2⤵
  PID:13200
- C:\Windows\System\qWGvsOm.exe
  C:\Windows\System\qWGvsOm.exe
  2⤵
  PID:13120
- C:\Windows\System\yasichT.exe
  C:\Windows\System\yasichT.exe
  2⤵
  PID:10904
- C:\Windows\System\WneVOOj.exe
  C:\Windows\System\WneVOOj.exe
  2⤵
  PID:11460
- C:\Windows\System\vUOWzCJ.exe
  C:\Windows\System\vUOWzCJ.exe
  2⤵
  PID:5644
- C:\Windows\System\EUcQWXC.exe
  C:\Windows\System\EUcQWXC.exe
  2⤵
  PID:11784
- C:\Windows\System\KqqXaag.exe
  C:\Windows\System\KqqXaag.exe
  2⤵
  PID:11008
- C:\Windows\System\QxIXLay.exe
  C:\Windows\System\QxIXLay.exe
  2⤵
  PID:13280
- C:\Windows\System\CfZapga.exe
  C:\Windows\System\CfZapga.exe
  2⤵
  PID:8048
- C:\Windows\System\LEymnqG.exe
  C:\Windows\System\LEymnqG.exe
  2⤵
  PID:4272
- C:\Windows\System\fodqGJz.exe
  C:\Windows\System\fodqGJz.exe
  2⤵
  PID:10428
- C:\Windows\System\SSxiNcR.exe
  C:\Windows\System\SSxiNcR.exe
  2⤵
  PID:13540
- C:\Windows\System\cZMgAcG.exe
  C:\Windows\System\cZMgAcG.exe
  2⤵
  PID:7316
- C:\Windows\System\IybBoFy.exe
  C:\Windows\System\IybBoFy.exe
  2⤵
  PID:12744
- C:\Windows\System\aeuqAAL.exe
  C:\Windows\System\aeuqAAL.exe
  2⤵
  PID:8640
- C:\Windows\System\SNMXmjh.exe
  C:\Windows\System\SNMXmjh.exe
  2⤵
  PID:7544
- C:\Windows\System\fqQbKwS.exe
  C:\Windows\System\fqQbKwS.exe
  2⤵
  PID:13000
- C:\Windows\System\YxcckNe.exe
  C:\Windows\System\YxcckNe.exe
  2⤵
  PID:12640
- C:\Windows\System\RjDoaCT.exe
  C:\Windows\System\RjDoaCT.exe
  2⤵
  PID:12972
- C:\Windows\System\rMVMNrK.exe
  C:\Windows\System\rMVMNrK.exe
  2⤵
  PID:8664
- C:\Windows\System\oYdtJab.exe
  C:\Windows\System\oYdtJab.exe
  2⤵
  PID:13496
- C:\Windows\System\StbIDio.exe
  C:\Windows\System\StbIDio.exe
  2⤵
  PID:12624
- C:\Windows\System\UOQwmBa.exe
  C:\Windows\System\UOQwmBa.exe
  2⤵
  PID:6164
- C:\Windows\System\NDwUOBC.exe
  C:\Windows\System\NDwUOBC.exe
  2⤵
  PID:11236
- C:\Windows\System\yPQQbMz.exe
  C:\Windows\System\yPQQbMz.exe
  2⤵
  PID:6224
- C:\Windows\System\BvOaDul.exe
  C:\Windows\System\BvOaDul.exe
  2⤵
  PID:8756
- C:\Windows\System\DYZShaF.exe
  C:\Windows\System\DYZShaF.exe
  2⤵
  PID:10828
- C:\Windows\System\ITXkKkT.exe
  C:\Windows\System\ITXkKkT.exe
  2⤵
  PID:12852
- C:\Windows\System\zCyxkca.exe
  C:\Windows\System\zCyxkca.exe
  2⤵
  PID:11536
- C:\Windows\System\BKcRuKE.exe
  C:\Windows\System\BKcRuKE.exe
  2⤵
  PID:11596
- C:\Windows\System\TgRRwgf.exe
  C:\Windows\System\TgRRwgf.exe
  2⤵
  PID:9212
- C:\Windows\System\WEEkEvl.exe
  C:\Windows\System\WEEkEvl.exe
  2⤵
  PID:10000
- C:\Windows\System\VImSPUT.exe
  C:\Windows\System\VImSPUT.exe
  2⤵
  PID:11804
- C:\Windows\System\sUuVcty.exe
  C:\Windows\System\sUuVcty.exe
  2⤵
  PID:11916
- C:\Windows\System\FPIrPPw.exe
  C:\Windows\System\FPIrPPw.exe
  2⤵
  PID:1384
- C:\Windows\System\pAaJwxq.exe
  C:\Windows\System\pAaJwxq.exe
  2⤵
  PID:11844
- C:\Windows\System\PcyHKWS.exe
  C:\Windows\System\PcyHKWS.exe
  2⤵
  PID:4900
- C:\Windows\System\saepCZN.exe
  C:\Windows\System\saepCZN.exe
  2⤵
  PID:9484
- C:\Windows\System\qYVGVpQ.exe
  C:\Windows\System\qYVGVpQ.exe
  2⤵
  PID:9776
- C:\Windows\System\xZzihXy.exe
  C:\Windows\System\xZzihXy.exe
  2⤵
  PID:9860
- C:\Windows\System\ZvuKZWL.exe
  C:\Windows\System\ZvuKZWL.exe
  2⤵
  PID:12344
- C:\Windows\System\lZQYTwG.exe
  C:\Windows\System\lZQYTwG.exe
  2⤵
  PID:12304
- C:\Windows\System\fiOKpPt.exe
  C:\Windows\System\fiOKpPt.exe
  2⤵
  PID:12612
- C:\Windows\System\mKcNGrZ.exe
  C:\Windows\System\mKcNGrZ.exe
  2⤵
  PID:10412
- C:\Windows\System\SgspzFY.exe
  C:\Windows\System\SgspzFY.exe
  2⤵
  PID:13720
- C:\Windows\System\YivFKFf.exe
  C:\Windows\System\YivFKFf.exe
  2⤵
  PID:13128
- C:\Windows\System\RTysvLq.exe
  C:\Windows\System\RTysvLq.exe
  2⤵
  PID:12272
- C:\Windows\System\UlxoVqf.exe
  C:\Windows\System\UlxoVqf.exe
  2⤵
  PID:9664
- C:\Windows\System\OEDcYJc.exe
  C:\Windows\System\OEDcYJc.exe
  2⤵
  PID:11084
- C:\Windows\System\zJaFuxz.exe
  C:\Windows\System\zJaFuxz.exe
  2⤵
  PID:10340
- C:\Windows\System\HAIYuZF.exe
  C:\Windows\System\HAIYuZF.exe
  2⤵
  PID:13544
- C:\Windows\System\pHdPlcN.exe
  C:\Windows\System\pHdPlcN.exe
  2⤵
  PID:12680
- C:\Windows\System\wVvHGAH.exe
  C:\Windows\System\wVvHGAH.exe
  2⤵
  PID:13552
- C:\Windows\System\raAUBlW.exe
  C:\Windows\System\raAUBlW.exe
  2⤵
  PID:2364
- C:\Windows\System\MkUpgpg.exe
  C:\Windows\System\MkUpgpg.exe
  2⤵
  PID:10448
- C:\Windows\System\qHiSSdZ.exe
  C:\Windows\System\qHiSSdZ.exe
  2⤵
  PID:1640
- C:\Windows\System\DjkCIYn.exe
  C:\Windows\System\DjkCIYn.exe
  2⤵
  PID:9196
- C:\Windows\System\UTpEaIq.exe
  C:\Windows\System\UTpEaIq.exe
  2⤵
  PID:13840
- C:\Windows\System\dDXUQyI.exe
  C:\Windows\System\dDXUQyI.exe
  2⤵
  PID:9460
- C:\Windows\System\WCBQrae.exe
  C:\Windows\System\WCBQrae.exe
  2⤵
  PID:6496
- C:\Windows\System\vhHvBvA.exe
  C:\Windows\System\vhHvBvA.exe
  2⤵
  PID:5936
- C:\Windows\System\jJUswmq.exe
  C:\Windows\System\jJUswmq.exe
  2⤵
  PID:11992
- C:\Windows\System\joLoHPt.exe
  C:\Windows\System\joLoHPt.exe
  2⤵
  PID:12224
- C:\Windows\System\ppFDpMz.exe
  C:\Windows\System\ppFDpMz.exe
  2⤵
  PID:11868
- C:\Windows\System\TRFIvxJ.exe
  C:\Windows\System\TRFIvxJ.exe
  2⤵
  PID:12160
- C:\Windows\System\nHJMxuI.exe
  C:\Windows\System\nHJMxuI.exe
  2⤵
  PID:5328
- C:\Windows\System\tOCyqdi.exe
  C:\Windows\System\tOCyqdi.exe
  2⤵
  PID:3228
- C:\Windows\System\oGDVLHX.exe
  C:\Windows\System\oGDVLHX.exe
  2⤵
  PID:8772
- C:\Windows\System\ziQTxiy.exe
  C:\Windows\System\ziQTxiy.exe
  2⤵
  PID:12404
- C:\Windows\System\VZBrhsN.exe
  C:\Windows\System\VZBrhsN.exe
  2⤵
  PID:12580
- C:\Windows\System\JCYQgmh.exe
  C:\Windows\System\JCYQgmh.exe
  2⤵
  PID:12932
- C:\Windows\System\vtxgtgu.exe
  C:\Windows\System\vtxgtgu.exe
  2⤵
  PID:13152
- C:\Windows\System\uEaPkhR.exe
  C:\Windows\System\uEaPkhR.exe
  2⤵
  PID:11296
- C:\Windows\System\fHnxxRP.exe
  C:\Windows\System\fHnxxRP.exe
  2⤵
  PID:13640
- C:\Windows\System\mhwwAAA.exe
  C:\Windows\System\mhwwAAA.exe
  2⤵
  PID:13532
- C:\Windows\System\wIWVpNE.exe
  C:\Windows\System\wIWVpNE.exe
  2⤵
  PID:9896
- C:\Windows\System\FBkBNsJ.exe
  C:\Windows\System\FBkBNsJ.exe
  2⤵
  PID:12328
- C:\Windows\System\XOqJbTE.exe
  C:\Windows\System\XOqJbTE.exe
  2⤵
  PID:14116
- C:\Windows\System\mdRTWGY.exe
  C:\Windows\System\mdRTWGY.exe
  2⤵
  PID:13420
- C:\Windows\System\tluuHjO.exe
  C:\Windows\System\tluuHjO.exe
  2⤵
  PID:7796
- C:\Windows\System\hBGhCsi.exe
  C:\Windows\System\hBGhCsi.exe
  2⤵
  PID:13676
- C:\Windows\System\NiIpUXC.exe
  C:\Windows\System\NiIpUXC.exe
  2⤵
  PID:12840
- C:\Windows\System\zBRxpbU.exe
  C:\Windows\System\zBRxpbU.exe
  2⤵
  PID:8556
- C:\Windows\System\qvVtYDE.exe
  C:\Windows\System\qvVtYDE.exe
  2⤵
  PID:452
- C:\Windows\System\umKFCsL.exe
  C:\Windows\System\umKFCsL.exe
  2⤵
  PID:9092
- C:\Windows\System\WSUvFyk.exe
  C:\Windows\System\WSUvFyk.exe
  2⤵
  PID:11672
- C:\Windows\System\JXCzzJY.exe
  C:\Windows\System\JXCzzJY.exe
  2⤵
  PID:4996
- C:\Windows\System\uoNRLxW.exe
  C:\Windows\System\uoNRLxW.exe
  2⤵
  PID:14140
- C:\Windows\System\AblsOOe.exe
  C:\Windows\System\AblsOOe.exe
  2⤵
  PID:8888
- C:\Windows\System\dJrPYjO.exe
  C:\Windows\System\dJrPYjO.exe
  2⤵
  PID:7440
- C:\Windows\System\tJctCUS.exe
  C:\Windows\System\tJctCUS.exe
  2⤵
  PID:13568
- C:\Windows\System\srTqkJy.exe
  C:\Windows\System\srTqkJy.exe
  2⤵
  PID:5308
- C:\Windows\System\mWNyxuV.exe
  C:\Windows\System\mWNyxuV.exe
  2⤵
  PID:11016
- C:\Windows\System\OtGUSat.exe
  C:\Windows\System\OtGUSat.exe
  2⤵
  PID:6772
- C:\Windows\System\IsSDTkc.exe
  C:\Windows\System\IsSDTkc.exe
  2⤵
  PID:14340
- C:\Windows\System\sVTRAuH.exe
  C:\Windows\System\sVTRAuH.exe
  2⤵
  PID:14372
- C:\Windows\System\aCmbkVV.exe
  C:\Windows\System\aCmbkVV.exe
  2⤵
  PID:14404
- C:\Windows\System\nWSXnTm.exe
  C:\Windows\System\nWSXnTm.exe
  2⤵
  PID:14436
- C:\Windows\System\BflErAw.exe
  C:\Windows\System\BflErAw.exe
  2⤵
  PID:14464
- C:\Windows\System\TeiBjGl.exe
  C:\Windows\System\TeiBjGl.exe
  2⤵
  PID:14492
- C:\Windows\System\RiwBubM.exe
  C:\Windows\System\RiwBubM.exe
  2⤵
  PID:14520
- C:\Windows\System\JQQGgGn.exe
  C:\Windows\System\JQQGgGn.exe
  2⤵
  PID:14548
- C:\Windows\System\XZsMLkn.exe
  C:\Windows\System\XZsMLkn.exe
  2⤵
  PID:14576
- C:\Windows\System\LjRvHEj.exe
  C:\Windows\System\LjRvHEj.exe
  2⤵
  PID:14624
- C:\Windows\System\gjgwAds.exe
  C:\Windows\System\gjgwAds.exe
  2⤵
  PID:14652
- C:\Windows\System\Gtdtrzx.exe
  C:\Windows\System\Gtdtrzx.exe
  2⤵
  PID:14676
- C:\Windows\System\gJXhUmH.exe
  C:\Windows\System\gJXhUmH.exe
  2⤵
  PID:14820
- C:\Windows\System\tKTAzgd.exe
  C:\Windows\System\tKTAzgd.exe
  2⤵
  PID:14996
- C:\Windows\System\jPkeFrW.exe
  C:\Windows\System\jPkeFrW.exe
  2⤵
  PID:15012
- C:\Windows\System\SqUnLBE.exe
  C:\Windows\System\SqUnLBE.exe
  2⤵
  PID:15152
- C:\Windows\System\WIQPjDd.exe
  C:\Windows\System\WIQPjDd.exe
  2⤵
  PID:15244
- C:\Windows\System\ufFqLfH.exe
  C:\Windows\System\ufFqLfH.exe
  2⤵
  PID:14480
- C:\Windows\System\bgXspmT.exe
  C:\Windows\System\bgXspmT.exe
  2⤵
  PID:13832
- C:\Windows\System\ljvBgZo.exe
  C:\Windows\System\ljvBgZo.exe
  2⤵
  PID:15212
- C:\Windows\System\cKTZhVW.exe
  C:\Windows\System\cKTZhVW.exe
  2⤵
  PID:15172
- C:\Windows\System\wIHBBXJ.exe
  C:\Windows\System\wIHBBXJ.exe
  2⤵
  PID:4540
- C:\Windows\System\VRVxDVe.exe
  C:\Windows\System\VRVxDVe.exe
  2⤵
  PID:13704
- C:\Windows\System\dOrJoPW.exe
  C:\Windows\System\dOrJoPW.exe
  2⤵
  PID:13892
- C:\Windows\System\cnXVpvb.exe
  C:\Windows\System\cnXVpvb.exe
  2⤵
  PID:14660
- C:\Windows\System\eAzjGZC.exe
  C:\Windows\System\eAzjGZC.exe
  2⤵
  PID:15008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d34evciy.u5j.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ABOKJWi.exe

Filesize
1.7MB

MD5
b7288aeeb390878d6dbbe2775171d16e

SHA1
61d32d631dd5dcd6f28317f213585ff19ea5ec11

SHA256
0ee37d2c7826afc92d1f9273e4ea31bf1e505a63d3580c473eca171e5f311bb3

SHA512
3f2e4d83346f9beb3897b6d63983d9b7d59ac09fd5d7e79c5f2f309869c25885ebdd30fa312ac7207845b7a813c8fd237cbb8c39ec74eff3987158764b103f72

Download Submit
C:\Windows\System\DMtYxUA.exe

Filesize
1.7MB

MD5
4de1671f7dad027855523edc239766a6

SHA1
7f121807f49bee8235cf7f191c6b1079a0a4a5dc

SHA256
14a382dd8a31c35d68076a9707bd9da884bc4b13167db1ebd2957a009e16a06b

SHA512
92a1cbfbc0d33812202882d7b6be2eff5b4048dac44018dbda3effe75c8c7119152f7528b38abee22d9d61cebc471b5fc992bdbfcf59c8f5ee7a61a2d363695d

Download Submit
C:\Windows\System\EHHNYEC.exe

Filesize
1.7MB

MD5
12776be6206ee2ed78999f9a15334ae3

SHA1
7d6ab1228b29ac21ad6e79b779ad18b10eae8987

SHA256
7b3aee34cb5da3fed32c2d16be5cf597ad46f6f0ccc967fd76bf9a90ed6f5fd8

SHA512
6643c28c58bed9f3875ccc5be7d46614ee31a881242a08d221abf3b1bc4e089319c0d93889b967dd051730eb07078b9ccdcaff211bbc8940362d1f107a7aabaa

Download Submit
C:\Windows\System\FJXNAVc.exe

Filesize
1.7MB

MD5
21d38922483620149d4bdfba29e35d1d

SHA1
9774ac9aaf33feea961c3ad612c5ccb7b34b3344

SHA256
e8e5f1e9f53f722979a49093016258931d0536d12da62be84fdd2ec09826abf2

SHA512
e8f44e4423b4123e5a755877da34cda356ce6d9d0fb62240af8c8c83b1c630412017228db22eb36bbfdf8b286cc5b5a9ed56f8e008d18be9086862bf31a43299

Download Submit
C:\Windows\System\FSeLhZx.exe

Filesize
1.7MB

MD5
51b0c6cb3647b2f68c30803f93c30d2d

SHA1
4d5d6c1cf222d3368bc46f016119656b392bd903

SHA256
ddd160d58a7821d92268d610b41dc85497571981d96c5bf33cd8c5505cc0bb23

SHA512
73bf2f2ee1725e4fc7a7597e9080e0b8a5437037e884c2edf6e6606550b39fd50a3024fa16e1aea6eb69be48ea51dd07745ab67a12125bf940f5c09326c0a83a

Download Submit
C:\Windows\System\IKhWiFM.exe

Filesize
1.7MB

MD5
e55db610dec792296b5591e81cab54e1

SHA1
4fad64c2b42300221331a1960906dad88acc3484

SHA256
2becf8a1fef731f4c909d716261f5abbd6f2ffd2fc8d64c0ad2e32810aa30885

SHA512
ba9fee45dcebbc98e4d93eff9053c023b06b2d1104a724e31f0a35b962a813b3edbe4f7a75906a9d247c0f9aa060610ff49ba07e26cd8e2f2e4a77ada7f77b59

Download Submit
C:\Windows\System\InfHEyO.exe

Filesize
1.7MB

MD5
2f598fc1e670af70779b3972dbb3ecbb

SHA1
0ee0b229e84b41cf7bd5950453f9a1d29f057099

SHA256
664c2f1d0b5bf6de234a1c4112cf60d2600744a2240e1d47335fdb576c380dd9

SHA512
e3ab5d9420fc80b5dc1960c2139ec269ade46aadea525e1e19d78e66d3efaa89cfa58211a55c6e25276838c65ab7309218532b7bc0b3224e88093db3f5326b9b

Download Submit
C:\Windows\System\LEBACzc.exe

Filesize
1.7MB

MD5
821bc20ef1dcd6373b1cafd62fb96a0e

SHA1
e56e0b00f417ff2fe49d0c1fb2dcdb2e668badd0

SHA256
2de9fa346a47e2e8823c3fed98000bca96463b8a96aa470bc019d405b168322b

SHA512
99b6e6b058115df871717870ceb75904498fb78522d27b49288edfcfbdc1ba5de48f026479f7838ce890c2d52aef59e6fb811658aec66a2d72f7217ed55bfcf8

Download Submit
C:\Windows\System\PTVlpPk.exe

Filesize
1.7MB

MD5
e74a3a6b118851fb9b2ad4d88b4f4b71

SHA1
bcc165158592c0f3097a95b118d0670c353532df

SHA256
8b3ae1f0d0ae97b343f93fce50cffe2281bac3bd2029ef25f0cec1d42a1af0e9

SHA512
161affb93bc21fa0f5a142e36b1c385ad136ee1e5f861cd5c0d91644aae7b6b2151f306d230fdb253948d274dd6d32651b84e43329b31a9ebeccaefd34a24229

Download Submit
C:\Windows\System\QUWkZPt.exe

Filesize
1.7MB

MD5
cb631461272efb7bc7573a5f4533dc35

SHA1
454ad6513ba83ecc62e7e26900817f0d7fbfa4df

SHA256
0687ff1af8e67245b356ad439d4df342777ab607fbe44e255c149d8ccb4a80ac

SHA512
1282e6ccaba866a0e013bae6b49c427a505f41b48c73515823cb8fb4eb64de0681247bb82dd5e758f138030f9fe5d168e3f5438a2cf7fe998eb60889db03b67c

Download Submit
C:\Windows\System\RRNZAoS.exe

Filesize
1.7MB

MD5
357289e65ded086e1f11bb44f59aade8

SHA1
d4380d58c509a34add65cb1f03cb547779f5376c

SHA256
7d36a1c31a8b0f1108bebf0914c440be72b8e5d29c91e396fc884a2bd3c66aba

SHA512
b0eccbe84a52be775d6663d7ad42e26eef221bf159d235c1b50c249ef98ac642791041e5a6fd0c322ac5ffd7093c2aef97cd5ea866fc3e01ed13fdf9303f80db

Download Submit
C:\Windows\System\RtguFWU.exe

Filesize
1.7MB

MD5
6245154c1f44ac57e8bb46386f0e10ec

SHA1
bd900deee8c150f656064f31bb651add07bbd394

SHA256
853111c20d66355fae0f7fdc80e6a54edcf96b07f43e9fe70d554b759e070121

SHA512
1aa39669df348cf20e7ba037cf24ef1f9945926d933044a9110364bb948c0616d7b15d3e10495067d2f3c6e506c6c3726b765016bc72e34fa95f2f58697cce1a

Download Submit
C:\Windows\System\UVWwLOt.exe

Filesize
1.7MB

MD5
6849eaf42bc234e7b777e930eed8c8a2

SHA1
7773000f770c44d2812eec155a43952bd475bc30

SHA256
bdb8dcc19a0f58aeb77934e32fd8139e1304abede933798fc92c65e503639fa9

SHA512
284bbc9c2655c1ee6cb3c57685b3f6c10ac6b88fdc2078b2daa3a67a4e89558ea784b63cd15872cc5af7ffc2ef43adb37f0877c0ed83d5ecebdade732076e1ee

Download Submit
C:\Windows\System\UqgXxwI.exe

Filesize
1.7MB

MD5
2c2e682d7cf8b88ea00fc5d6ee28394d

SHA1
12920fd8b737d207e55fe7cc9ce75bc0c03459da

SHA256
2b45014ee7defec71c5cfa2207f83d00f8e135b1b5d77a0107f01e1afbe69c04

SHA512
830977353a00cd79e2688be92947f9f9482cab68942dd4b469c56406393250e2f1567cba4ea231d0f5dff10cc5d65bb3522ef2a3710cf52796af3fc34bd7de4f

Download Submit
C:\Windows\System\WEOPWSB.exe

Filesize
1.7MB

MD5
27b89ca9014919904936f39b3a33b147

SHA1
d97e7ffcbb4c502af5eeea2a512c7cd12ea5028e

SHA256
1847d8bd23c58c6cda14e2a22c61df55dd9f6d8b8ec343a734309de16ad61419

SHA512
0fd95e3bcb93217101b9ce3f5da3abfaeec147f5cc259c28fccc41674d01e96dbb09b912c4cbec84253c3f4858c21870aff4d3d9dba8334ee0e43ec70e0d8cdb

Download Submit
C:\Windows\System\WveHvwt.exe

Filesize
1.7MB

MD5
b1f2658de02c2ca68e8eadb250d3aa26

SHA1
b0ef7cfc84b5ffc7440769859047a39036304285

SHA256
95d68c14ab52d80e36f2a7061f2b43728bd8ce08c85cb7e578b839c00b061bdc

SHA512
6e89de02bbc4da6d1c8e9a518437d464a4631b34af074a0738740900f49b8f23bfb956448f06e4b75944c81396f89506ad050ee93e7607e6e2b4f2d9bdbc5a78

Download Submit
C:\Windows\System\ZwYCacb.exe

Filesize
1.7MB

MD5
226a653d4dabe805cba03f7dfaf07356

SHA1
2d8d4eb1a6dc7b14776e1edbf4063ea71644adae

SHA256
67bb72317be13dcfedd086ab6f444bcb494f64e90a4d30e1b03231c71ddd3c69

SHA512
deff8803e91d90758b2cbb1d29bfdd30ea8dac1dc8ea317ca26644590056ac8d1c42e840d61d0fdfe8987931be4f620bb4fced6a7bd2dfd3bfaf800c94c129e6

Download Submit
C:\Windows\System\aenMzHm.exe

Filesize
1.7MB

MD5
f1493990fb8d9a594b5d09cce18c0ce9

SHA1
4c4e8b69327f86389c34c30eefcf30bb0f61bfec

SHA256
08e47e7651f4ed77bcf5d67a6d8655a423eb90725f25b53537bd6c82dfa9f520

SHA512
9ec265306531235f3dff1d1c7b5a3edf650147e5be5258a1239a0cbf27d87bf1444615a8ba3d3563410e0a201a15ecb506448251636cd5b36f6a81b721e95a88

Download Submit
C:\Windows\System\cZlCAua.exe

Filesize
1.7MB

MD5
1aa276a560e1d55bdcf1eaf41576159e

SHA1
f60ebe785ef7381bd223954352959b0c6e02bfb1

SHA256
8ffd899c770101e9e115ffe11034ed0932800262f453198f0f2afef3034f82a4

SHA512
0b599f8d673a047ba042cd576c32ae2b4a22738bb05544e6514eae1b9c372c6464a2a4d526baac39625d5b3b690aad6733c99d5b666ae0f0bc61aee73c5352ff

Download Submit
C:\Windows\System\dGfgrqG.exe

Filesize
1.7MB

MD5
42803e0444e22b43eb9a76533db27bd5

SHA1
6cd46aed430a6a0b682b7a92e926f0206817894e

SHA256
422f897ae343b377376e18dbb2697a12d072630d5f4d919fc2e664f31492dffa

SHA512
00aa45d8907c74a70796549d522889cec6019a745ee1a47386c959e72f052921c3716e3ab11b6a2560e17556c1ef4482da560d375d610122b732a33df46b5548

Download Submit
C:\Windows\System\fkMvkYg.exe

Filesize
18B

MD5
08c2d624b31bc7470db835335f208c81

SHA1
fce1aebaeda4bd8f0bed7438e845f52352ff3c25

SHA256
a2b296b21be6fc23fa3bfa83156b51765f88899ad7888ed99bdb74c01d64f8e1

SHA512
952d81ac5a462657d1a81bc4117d9ec3a8b5eb4c0eb9ee28c987d771ff170e66490ca912c240708de14e0e23b131b41a1a306d2523eb555296575a5924ed8fa6

Download Submit
C:\Windows\System\gODvDZl.exe

Filesize
1.7MB

MD5
2f7174d397f5288b531ceb6db21d6904

SHA1
4fbe0a5a36641c5bcff88b72f20d70ddf1c82f4b

SHA256
e80f63a898204956789d2ebc27e7678a13ceb130f8bb7e188d4f4c06973b9996

SHA512
82119dce7ed5dffd4b7001030a4583b7b9b4962751b33561d007a6565c5d4996657199a646bc2469a94f33279dc49c72847e7ace6665312ca47b168a90c2d3fe

Download Submit
C:\Windows\System\gxDkLTG.exe

Filesize
1.7MB

MD5
b5205fb0acefdd6c9c052729f372a786

SHA1
37df1021aff3d667c338aa400cdb50b10b95c306

SHA256
1bf057828ab10e46073e4a64b3265fdd68378d843e5875878f97211708ef3da8

SHA512
60572cf7999255c447eb74ffe09a551a1c2467630933f2d7f1f2b43ec2030452b24d93ab64864b1a0d34199faf807a73ad413825b275e5f40b46880dd0aee81e

Download Submit
C:\Windows\System\jTsREgB.exe

Filesize
1.7MB

MD5
e85d9ddffd4028bd923b66dd1ab7d7f1

SHA1
6c06e0f4a5629752c7e2c96b437532b51685a626

SHA256
8ecd0d2cfef8309fc4e346fb03430bba9f06d826916176dc445337f00cca91d9

SHA512
b5ff69158880cbec52df8a076eb937ddc3c7a26c348b07ce5d92c96caf99f7becb857e15f378d2eb1deeb2419fd699b37e9538a5785ce97e5518b64d14f78dc3

Download Submit
C:\Windows\System\mwbkOgf.exe

Filesize
1.7MB

MD5
a44058be75b907c8206e76e424911b73

SHA1
f8ba33fc656b55f98b7981141dec3d73219375c1

SHA256
67f3d6d075a4438abcad27012a1105a9374b1fafd92ddc3d22c43cb96da51802

SHA512
1d78068947247bf43519adbf9bc4f3aaac19cf7fac4964fce952a1bd6bc8799c61e64459de011046a93bab361d46ca6df6836d3e3bcacd408dca20327ae1bae7

Download Submit
C:\Windows\System\pOVmbgA.exe

Filesize
1.7MB

MD5
3b42d4fab9e57a976d7987169f4bdbe6

SHA1
7bac0d535bd8f7a75eab995ded3228656fb6e0a1

SHA256
54b56561f8b0a3a0648e98628e9603614fc2417c2397332290b0619103ef5879

SHA512
f8f474419b84080679fb97b61f94c11887f0f623a4b691911c1165f0344a003021b312e82d407c2faa289942402eaeb727df6313f42a45e49aeb25185d35dee5

Download Submit
C:\Windows\System\pSJfGeb.exe

Filesize
1.7MB

MD5
60789c0247aa9e99c858382650edfbef

SHA1
044608f78d6e38ec64cc2216d3a4d1a79111533b

SHA256
867ecfc53ffce5156f612d6cbe651e6ff0ed3704a95355b644035f670d11343a

SHA512
a1b9d2e7fb9873f3acfeb21a55c7f21ca803ee7c8da00932befec3de5b8b71ccf665268534050aff85a16db546fe25a512ff5917ea57f2ddbbbd93fc4856cf83

Download Submit
C:\Windows\System\pXcXdiV.exe

Filesize
1.7MB

MD5
b8c0ed8e901af1ff54e87a2ce30b2e92

SHA1
3e57f62ec2829c9e57ee4ddb506370fb8589f16b

SHA256
9976024d44a47bdce931ab30ee72225c6c0c6c11f5d590b7c2fe0ec4b675d5f5

SHA512
65907510bfbce355005e4e0671313af0e16d2a6a9cd2313c301040e481806d442ac64b83c211c96ea72eb4a47c96ab0da54cc12a35448d173d2911a0bfcda12b

Download Submit
C:\Windows\System\sxkNWPj.exe

Filesize
1.7MB

MD5
7579143e56e47d182b14c9891b699d2e

SHA1
d2ba24d6af9db5be0df0cf28dc65d7ee9bb929da

SHA256
814c28d90f6b2ca5ba477eb14b4ab0ec72d72da26c62658765a0ae0287b5d3b8

SHA512
f00957d95ce1aaf21458fa0125cff43ffc618027b1dc6becc81a8d239a176f93d53a14a9007bd1f3c4e103e023ac40dd7f3907668b9645fae1bccff04eb84530

Download Submit
C:\Windows\System\uZYwDmG.exe

Filesize
1.7MB

MD5
85e30bef31486f89d6783f326ec3bc4f

SHA1
d0f5581374b73bf683d4d3f268875ecd46753c80

SHA256
fca3586bf4b348b42832aed201c94f650712659782b7e2e2e34150bdecfe5e9b

SHA512
9999ad210c289f3d9a21c9859db17f3e001b2bb46f124dd131b77affb06a2236e7cf184fa01cd9301b928df818e2dc04170219fc19f5bb8f9973ae9b0f6a70e1

Download Submit
C:\Windows\System\uqYqpza.exe

Filesize
1.7MB

MD5
f32980b281b22235b128b4a16002a83c

SHA1
97ae40aa67923d12ed4cae83d325504d6570b768

SHA256
f85ceffb392da8679cc1f348bc41095789e799f7d29bc9aca71508ec19369ae2

SHA512
eebcf47d693ca93c437fb825a9a861fc0d1ee2de13fba49d604dea18bc762a012a606397e59bb96c3ab5175b9d9f9bce2f81728caa3ab3dfc19621388c869925

Download Submit
C:\Windows\System\yLhMVtB.exe

Filesize
1.7MB

MD5
0db43bdbf019c3dfac996ce292f59c88

SHA1
4ee3a442109b831d9693966f037be322148acb3d

SHA256
f87a64294e66b6d7e3cc5d1489ef47313ebf689c353289cd0f0eb178861fb971

SHA512
b4dd20d63c6606e47d77be901cdb5ef740636942b0f37388fc79bcd7799000e0a823b7c5f3d2065f98312bffa271a3393c13519619dd69c7a8a8fb0bfbc8ea4a

Download Submit
C:\Windows\System\ysMouLC.exe

Filesize
1.7MB

MD5
d0ab881af97763807f83b1793e5587fe

SHA1
f3ce2f1ee8186cbb1a49c2dbdc2fb643544be3d7

SHA256
0dffe2435000e2d918593d11b5f2f788fb754ea7e3e254181fd56c669d60fbcf

SHA512
591ef547f7c6b0de81c4f6d9c67f6b9857fdc36f86fef0c7b2f918296168cc449dec671415573219e6b791dcfb301c1e03abcf122d8c75deb737cd02ddcc5832

Download Submit
memory/768-110-0x00007FF6921D0000-0x00007FF6925C2000-memory.dmp

Filesize
3.9MB

Download
memory/768-3927-0x00007FF6921D0000-0x00007FF6925C2000-memory.dmp

Filesize
3.9MB

Download
memory/836-14-0x00007FF74D1C0000-0x00007FF74D5B2000-memory.dmp

Filesize
3.9MB

Download
memory/880-0-0x00007FF6BA100000-0x00007FF6BA4F2000-memory.dmp

Filesize
3.9MB

Download
memory/880-1-0x0000023DAA9F0000-0x0000023DAAA00000-memory.dmp

Filesize
64KB

Download
memory/1004-160-0x00007FF6F5D40000-0x00007FF6F6132000-memory.dmp

Filesize
3.9MB

Download
memory/1004-5556-0x00007FF6F5D40000-0x00007FF6F6132000-memory.dmp

Filesize
3.9MB

Download
memory/1004-7100-0x00007FF6F5D40000-0x00007FF6F6132000-memory.dmp

Filesize
3.9MB

Download
memory/1012-85-0x00007FF729C80000-0x00007FF72A072000-memory.dmp

Filesize
3.9MB

Download
memory/1116-5580-0x00007FF6B0FA0000-0x00007FF6B1392000-memory.dmp

Filesize
3.9MB

Download
memory/1116-81-0x00007FF6B0FA0000-0x00007FF6B1392000-memory.dmp

Filesize
3.9MB

Download
memory/1804-148-0x00007FF62AF60000-0x00007FF62B352000-memory.dmp

Filesize
3.9MB

Download
memory/1804-5551-0x00007FF62AF60000-0x00007FF62B352000-memory.dmp

Filesize
3.9MB

Download
memory/2004-49-0x00007FF775E30000-0x00007FF776222000-memory.dmp

Filesize
3.9MB

Download
memory/2268-82-0x00007FF6BA3C0000-0x00007FF6BA7B2000-memory.dmp

Filesize
3.9MB

Download
memory/2404-5618-0x00007FF7308E0000-0x00007FF730CD2000-memory.dmp

Filesize
3.9MB

Download
memory/2404-76-0x00007FF7308E0000-0x00007FF730CD2000-memory.dmp

Filesize
3.9MB

Download
memory/2704-87-0x00007FF7E40D0000-0x00007FF7E44C2000-memory.dmp

Filesize
3.9MB

Download
memory/2804-66-0x00007FF603150000-0x00007FF603542000-memory.dmp

Filesize
3.9MB

Download
memory/3096-175-0x00007FF640E70000-0x00007FF641262000-memory.dmp

Filesize
3.9MB

Download
memory/3116-67-0x00007FF72AEC0000-0x00007FF72B2B2000-memory.dmp

Filesize
3.9MB

Download
memory/3288-80-0x00007FF6AE320000-0x00007FF6AE712000-memory.dmp

Filesize
3.9MB

Download
memory/3288-5594-0x00007FF6AE320000-0x00007FF6AE712000-memory.dmp

Filesize
3.9MB

Download
memory/3332-103-0x00007FF6162B0000-0x00007FF6166A2000-memory.dmp

Filesize
3.9MB

Download
memory/3332-4772-0x00007FF6162B0000-0x00007FF6166A2000-memory.dmp

Filesize
3.9MB

Download
memory/3392-86-0x00007FF71C7D0000-0x00007FF71CBC2000-memory.dmp

Filesize
3.9MB

Download
memory/3392-5655-0x00007FF71C7D0000-0x00007FF71CBC2000-memory.dmp

Filesize
3.9MB

Download
memory/3440-185-0x00007FF6A2150000-0x00007FF6A2542000-memory.dmp

Filesize
3.9MB

Download
memory/3580-132-0x00007FF6B0B60000-0x00007FF6B0F52000-memory.dmp

Filesize
3.9MB

Download
memory/3580-4777-0x00007FF6B0B60000-0x00007FF6B0F52000-memory.dmp

Filesize
3.9MB

Download
memory/3744-5553-0x00007FF65EA50000-0x00007FF65EE42000-memory.dmp

Filesize
3.9MB

Download
memory/3744-7081-0x00007FF65EA50000-0x00007FF65EE42000-memory.dmp

Filesize
3.9MB

Download
memory/3744-150-0x00007FF65EA50000-0x00007FF65EE42000-memory.dmp

Filesize
3.9MB

Download
memory/4084-35-0x0000026C50CB0000-0x0000026C50CC0000-memory.dmp

Filesize
64KB

Download
memory/4084-1506-0x00007FFC3A130000-0x00007FFC3ABF1000-memory.dmp

Filesize
10.8MB

Download
memory/4084-33-0x00007FFC3A130000-0x00007FFC3ABF1000-memory.dmp

Filesize
10.8MB

Download
memory/4084-34-0x0000026C50CB0000-0x0000026C50CC0000-memory.dmp

Filesize
64KB

Download
memory/4084-61-0x0000026C38A70000-0x0000026C38A92000-memory.dmp

Filesize
136KB

Download
memory/4480-2537-0x00007FF6A51A0000-0x00007FF6A5592000-memory.dmp

Filesize
3.9MB

Download
memory/4480-71-0x00007FF6A51A0000-0x00007FF6A5592000-memory.dmp

Filesize
3.9MB

Download
memory/4592-178-0x00007FF679510000-0x00007FF679902000-memory.dmp

Filesize
3.9MB

Download