xmrig | ebacefbee77304def269ced9caf4641552de9cf888e4682e4cc0794f740356f8

Analysis

max time kernel
141s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 06:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
Size

1.9MB
MD5

2de6db55e9c497b3e2d21e13dd768475
SHA1

692dbfbb94009e56897f70bb428f9a34d55c1896
SHA256

ebacefbee77304def269ced9caf4641552de9cf888e4682e4cc0794f740356f8
SHA512

4eaf68ce0536b0a66f2c085bd6c9e0696eeb06c1fe1e632d74c7b789f67ed4ab4543c901b4806166bbac5759b665c9cb43e1b2f93e897a6e9611852e0251a9d3
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafl:NAB+

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 41 IoCs

miner

resource	yara_rule
behavioral2/memory/4684-17-0x00007FF6B84B0000-0x00007FF6B88A2000-memory.dmp	xmrig
behavioral2/memory/2432-198-0x00007FF76EFD0000-0x00007FF76F3C2000-memory.dmp	xmrig
behavioral2/memory/4596-263-0x00007FF65F9C0000-0x00007FF65FDB2000-memory.dmp	xmrig
behavioral2/memory/4748-294-0x00007FF7D3810000-0x00007FF7D3C02000-memory.dmp	xmrig
behavioral2/memory/3756-330-0x00007FF6DDB50000-0x00007FF6DDF42000-memory.dmp	xmrig
behavioral2/memory/4460-383-0x00007FF6CBFE0000-0x00007FF6CC3D2000-memory.dmp	xmrig
behavioral2/memory/4988-734-0x00007FF71FFF0000-0x00007FF7203E2000-memory.dmp	xmrig
behavioral2/memory/2864-731-0x00007FF627480000-0x00007FF627872000-memory.dmp	xmrig
behavioral2/memory/5072-614-0x00007FF675C80000-0x00007FF676072000-memory.dmp	xmrig
behavioral2/memory/436-553-0x00007FF6F2320000-0x00007FF6F2712000-memory.dmp	xmrig
behavioral2/memory/3804-550-0x00007FF64EA90000-0x00007FF64EE82000-memory.dmp	xmrig
behavioral2/memory/2644-506-0x00007FF76F800000-0x00007FF76FBF2000-memory.dmp	xmrig
behavioral2/memory/2632-443-0x00007FF7EF8F0000-0x00007FF7EFCE2000-memory.dmp	xmrig
behavioral2/memory/3208-440-0x00007FF68F420000-0x00007FF68F812000-memory.dmp	xmrig
behavioral2/memory/876-406-0x00007FF605420000-0x00007FF605812000-memory.dmp	xmrig
behavioral2/memory/3748-382-0x00007FF632EE0000-0x00007FF6332D2000-memory.dmp	xmrig
behavioral2/memory/3064-293-0x00007FF75D6C0000-0x00007FF75DAB2000-memory.dmp	xmrig
behavioral2/memory/4992-234-0x00007FF6969E0000-0x00007FF696DD2000-memory.dmp	xmrig
behavioral2/memory/4700-165-0x00007FF754760000-0x00007FF754B52000-memory.dmp	xmrig
behavioral2/memory/3760-126-0x00007FF68C8E0000-0x00007FF68CCD2000-memory.dmp	xmrig
behavioral2/memory/4184-103-0x00007FF615E70000-0x00007FF616262000-memory.dmp	xmrig
behavioral2/memory/2416-6596-0x00007FF6DBDA0000-0x00007FF6DC192000-memory.dmp	xmrig
behavioral2/memory/4684-6599-0x00007FF6B84B0000-0x00007FF6B88A2000-memory.dmp	xmrig
behavioral2/memory/2764-6612-0x00007FF654150000-0x00007FF654542000-memory.dmp	xmrig
behavioral2/memory/2000-6629-0x00007FF7E2540000-0x00007FF7E2932000-memory.dmp	xmrig
behavioral2/memory/4700-6659-0x00007FF754760000-0x00007FF754B52000-memory.dmp	xmrig
behavioral2/memory/4184-6672-0x00007FF615E70000-0x00007FF616262000-memory.dmp	xmrig
behavioral2/memory/2432-6682-0x00007FF76EFD0000-0x00007FF76F3C2000-memory.dmp	xmrig
behavioral2/memory/3760-6678-0x00007FF68C8E0000-0x00007FF68CCD2000-memory.dmp	xmrig
behavioral2/memory/5072-6657-0x00007FF675C80000-0x00007FF676072000-memory.dmp	xmrig
behavioral2/memory/876-6693-0x00007FF605420000-0x00007FF605812000-memory.dmp	xmrig
behavioral2/memory/3064-6697-0x00007FF75D6C0000-0x00007FF75DAB2000-memory.dmp	xmrig
behavioral2/memory/3748-6804-0x00007FF632EE0000-0x00007FF6332D2000-memory.dmp	xmrig
behavioral2/memory/4460-6775-0x00007FF6CBFE0000-0x00007FF6CC3D2000-memory.dmp	xmrig
behavioral2/memory/3804-6711-0x00007FF64EA90000-0x00007FF64EE82000-memory.dmp	xmrig
behavioral2/memory/436-6708-0x00007FF6F2320000-0x00007FF6F2712000-memory.dmp	xmrig
behavioral2/memory/4992-6703-0x00007FF6969E0000-0x00007FF696DD2000-memory.dmp	xmrig
behavioral2/memory/3756-6730-0x00007FF6DDB50000-0x00007FF6DDF42000-memory.dmp	xmrig
behavioral2/memory/3208-6704-0x00007FF68F420000-0x00007FF68F812000-memory.dmp	xmrig
behavioral2/memory/4748-6814-0x00007FF7D3810000-0x00007FF7D3C02000-memory.dmp	xmrig
behavioral2/memory/2644-6797-0x00007FF76F800000-0x00007FF76FBF2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2856	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2416	PrWygyo.exe
4684	SukpaiN.exe
2764	UihsaKt.exe
2000	gYgKsnU.exe
4184	wjZZfNH.exe
3760	xwiCNCO.exe
4700	tFHjPJz.exe
5072	JSajoEk.exe
2432	jSQYuHO.exe
4992	NtEfDKg.exe
4596	vdubOTV.exe
3064	RnGxfJC.exe
4748	jNTRWlB.exe
3756	pmGAIij.exe
3748	knNYVuE.exe
4460	eEVyXMn.exe
876	SwVtkSR.exe
2864	qXtLxKh.exe
3208	YpgNjoP.exe
4988	SPWicPG.exe
2632	ySBYhnU.exe
2644	hlQxAQK.exe
3804	NPImaFk.exe
436	rIGeCHH.exe
396	nklexzS.exe
2268	PVnitws.exe
4004	gKTJdHI.exe
1912	IeKivHS.exe
1464	KEEHmTP.exe
2316	VHLKBFL.exe
1012	UWJzeoB.exe
4652	AoChXaT.exe
5028	RiasPBh.exe
5056	pBBkCFP.exe
4216	CsJFxMy.exe
1904	lxfbIgQ.exe
2912	cLokgTE.exe
3440	WqXiiRM.exe
3780	MXSVBZD.exe
3628	tbYhuuX.exe
620	GaPETkI.exe
2788	RLmqhsF.exe
4772	lmhdOWJ.exe
2312	oCPvPPM.exe
1004	SzxrCrl.exe
2488	eKjxxXv.exe
4788	shyOcpT.exe
3688	kxeHLjb.exe
3500	HVTPgwv.exe
2244	oBkXsSA.exe
4568	LkfAuqi.exe
3828	ReVJWze.exe
3932	zsTSbts.exe
2132	YyUakQh.exe
3556	yojzjaq.exe
2328	lKHRSTX.exe
3148	DCaCIfi.exe
1032	ybrViLt.exe
1928	xdmvFto.exe
2508	wHWRYvz.exe
752	SJsINEe.exe
3188	QYQgbwx.exe
2396	OFsYSHW.exe
2884	bOKgfBc.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4340-0-0x00007FF694020000-0x00007FF694412000-memory.dmp	upx
behavioral2/files/0x000800000002343d-5.dat	upx
behavioral2/files/0x0007000000023442-8.dat	upx
behavioral2/memory/2416-9-0x00007FF6DBDA0000-0x00007FF6DC192000-memory.dmp	upx
behavioral2/memory/4684-17-0x00007FF6B84B0000-0x00007FF6B88A2000-memory.dmp	upx
behavioral2/files/0x0007000000023443-20.dat	upx
behavioral2/memory/2764-23-0x00007FF654150000-0x00007FF654542000-memory.dmp	upx
behavioral2/files/0x0007000000023446-39.dat	upx
behavioral2/files/0x0007000000023447-50.dat	upx
behavioral2/files/0x0007000000023453-107.dat	upx
behavioral2/files/0x000700000002345c-158.dat	upx
behavioral2/files/0x000700000002345b-153.dat	upx
behavioral2/memory/2432-198-0x00007FF76EFD0000-0x00007FF76F3C2000-memory.dmp	upx
behavioral2/memory/4596-263-0x00007FF65F9C0000-0x00007FF65FDB2000-memory.dmp	upx
behavioral2/memory/4748-294-0x00007FF7D3810000-0x00007FF7D3C02000-memory.dmp	upx
behavioral2/memory/3756-330-0x00007FF6DDB50000-0x00007FF6DDF42000-memory.dmp	upx
behavioral2/memory/4460-383-0x00007FF6CBFE0000-0x00007FF6CC3D2000-memory.dmp	upx
behavioral2/memory/4988-734-0x00007FF71FFF0000-0x00007FF7203E2000-memory.dmp	upx
behavioral2/memory/2864-731-0x00007FF627480000-0x00007FF627872000-memory.dmp	upx
behavioral2/memory/5072-614-0x00007FF675C80000-0x00007FF676072000-memory.dmp	upx
behavioral2/memory/436-553-0x00007FF6F2320000-0x00007FF6F2712000-memory.dmp	upx
behavioral2/memory/3804-550-0x00007FF64EA90000-0x00007FF64EE82000-memory.dmp	upx
behavioral2/memory/2644-506-0x00007FF76F800000-0x00007FF76FBF2000-memory.dmp	upx
behavioral2/memory/2632-443-0x00007FF7EF8F0000-0x00007FF7EFCE2000-memory.dmp	upx
behavioral2/memory/3208-440-0x00007FF68F420000-0x00007FF68F812000-memory.dmp	upx
behavioral2/memory/876-406-0x00007FF605420000-0x00007FF605812000-memory.dmp	upx
behavioral2/memory/3748-382-0x00007FF632EE0000-0x00007FF6332D2000-memory.dmp	upx
behavioral2/memory/3064-293-0x00007FF75D6C0000-0x00007FF75DAB2000-memory.dmp	upx
behavioral2/memory/4992-234-0x00007FF6969E0000-0x00007FF696DD2000-memory.dmp	upx
behavioral2/files/0x0007000000023462-195.dat	upx
behavioral2/files/0x0007000000023461-194.dat	upx
behavioral2/files/0x0007000000023456-189.dat	upx
behavioral2/files/0x000700000002345f-188.dat	upx
behavioral2/files/0x000700000002345e-184.dat	upx
behavioral2/files/0x0007000000023455-181.dat	upx
behavioral2/files/0x0007000000023454-172.dat	upx
behavioral2/memory/4700-165-0x00007FF754760000-0x00007FF754B52000-memory.dmp	upx
behavioral2/files/0x000700000002345d-164.dat	upx
behavioral2/files/0x0007000000023458-150.dat	upx
behavioral2/files/0x000700000002345a-145.dat	upx
behavioral2/files/0x0007000000023457-141.dat	upx
behavioral2/files/0x0007000000023451-135.dat	upx
behavioral2/files/0x000700000002344e-133.dat	upx
behavioral2/files/0x000800000002343e-169.dat	upx
behavioral2/memory/3760-126-0x00007FF68C8E0000-0x00007FF68CCD2000-memory.dmp	upx
behavioral2/files/0x0007000000023452-144.dat	upx
behavioral2/files/0x0007000000023459-137.dat	upx
behavioral2/files/0x000700000002344f-112.dat	upx
behavioral2/files/0x000700000002344d-109.dat	upx
behavioral2/memory/4184-103-0x00007FF615E70000-0x00007FF616262000-memory.dmp	upx
behavioral2/files/0x0007000000023449-100.dat	upx
behavioral2/files/0x000700000002344c-118.dat	upx
behavioral2/files/0x000700000002344b-90.dat	upx
behavioral2/files/0x0007000000023450-78.dat	upx
behavioral2/files/0x000700000002344a-60.dat	upx
behavioral2/files/0x0007000000023445-46.dat	upx
behavioral2/files/0x0007000000023448-54.dat	upx
behavioral2/files/0x0007000000023444-43.dat	upx
behavioral2/memory/2000-27-0x00007FF7E2540000-0x00007FF7E2932000-memory.dmp	upx
behavioral2/files/0x0007000000023441-11.dat	upx
behavioral2/memory/2416-6596-0x00007FF6DBDA0000-0x00007FF6DC192000-memory.dmp	upx
behavioral2/memory/4684-6599-0x00007FF6B84B0000-0x00007FF6B88A2000-memory.dmp	upx
behavioral2/memory/2764-6612-0x00007FF654150000-0x00007FF654542000-memory.dmp	upx
behavioral2/memory/2000-6629-0x00007FF7E2540000-0x00007FF7E2932000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\dSZJykO.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\nxDtIMr.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\ffSVPJE.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\VthSYBZ.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\UOmPiuJ.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\IzQDJRf.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\MBepCZU.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\CEhpXAP.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\AZMFCCb.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\gnKeWVN.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\ENvnizg.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\JMhasMr.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\WWdyHVJ.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\HNccueU.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\pdrXtac.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\cJDFIbt.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\wUVfKYk.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\PaUsfwZ.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\xdVSQWN.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\qltTPAv.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\wqJJhtY.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\rRufVtr.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\NqjrXqp.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\XmCEcvn.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\tATaHZd.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\RGpzVPl.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\DCpcOSc.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\RyCzOea.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\kYpXIpy.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\kXgveLc.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\iTMEkCx.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\pwNDvaW.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\YkAcuVb.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\PNsNdde.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\qogzkVe.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\okzEtMa.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\DuIHBnr.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\nvcSsKT.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\rlFJHzR.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\QHMXYCF.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\RLWMsSW.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\zAKOMMQ.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\bAztIVx.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\nQgCZln.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\RdcSRfh.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\GyFtndI.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\oGDLkZD.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\mRSBbnN.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\ZjCSzib.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\rxCjCrq.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\cLqZkkv.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\yTASJLn.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\WumgymD.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\RBHKHnk.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\FJOxRec.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\VScHgnK.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\YwFyWzB.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\rhYNKNA.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\TBsDCaX.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\yJJONTq.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\mxhorGf.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\rAEPjMN.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\WHFptUx.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
File created	C:\Windows\System\kAUxuTu.exe	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2856	powershell.exe
2856	powershell.exe
2856	powershell.exe
2856	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
Token: SeDebugPrivilege	2856	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4340 wrote to memory of 2856	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	86
PID 4340 wrote to memory of 2856	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	86
PID 4340 wrote to memory of 2416	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	87
PID 4340 wrote to memory of 2416	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	87
PID 4340 wrote to memory of 4684	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	88
PID 4340 wrote to memory of 4684	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	88
PID 4340 wrote to memory of 2764	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	89
PID 4340 wrote to memory of 2764	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	89
PID 4340 wrote to memory of 2000	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	90
PID 4340 wrote to memory of 2000	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	90
PID 4340 wrote to memory of 4184	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	91
PID 4340 wrote to memory of 4184	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	91
PID 4340 wrote to memory of 3760	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	92
PID 4340 wrote to memory of 3760	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	92
PID 4340 wrote to memory of 4700	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	93
PID 4340 wrote to memory of 4700	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	93
PID 4340 wrote to memory of 5072	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	94
PID 4340 wrote to memory of 5072	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	94
PID 4340 wrote to memory of 2432	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	95
PID 4340 wrote to memory of 2432	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	95
PID 4340 wrote to memory of 4992	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	96
PID 4340 wrote to memory of 4992	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	96
PID 4340 wrote to memory of 4596	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	97
PID 4340 wrote to memory of 4596	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	97
PID 4340 wrote to memory of 3064	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	98
PID 4340 wrote to memory of 3064	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	98
PID 4340 wrote to memory of 4748	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	99
PID 4340 wrote to memory of 4748	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	99
PID 4340 wrote to memory of 3756	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	100
PID 4340 wrote to memory of 3756	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	100
PID 4340 wrote to memory of 3748	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	101
PID 4340 wrote to memory of 3748	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	101
PID 4340 wrote to memory of 4460	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	102
PID 4340 wrote to memory of 4460	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	102
PID 4340 wrote to memory of 876	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	103
PID 4340 wrote to memory of 876	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	103
PID 4340 wrote to memory of 2864	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	104
PID 4340 wrote to memory of 2864	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	104
PID 4340 wrote to memory of 3208	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	105
PID 4340 wrote to memory of 3208	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	105
PID 4340 wrote to memory of 4988	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	106
PID 4340 wrote to memory of 4988	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	106
PID 4340 wrote to memory of 2632	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	107
PID 4340 wrote to memory of 2632	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	107
PID 4340 wrote to memory of 2644	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	108
PID 4340 wrote to memory of 2644	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	108
PID 4340 wrote to memory of 3804	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	109
PID 4340 wrote to memory of 3804	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	109
PID 4340 wrote to memory of 436	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	110
PID 4340 wrote to memory of 436	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	110
PID 4340 wrote to memory of 396	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	111
PID 4340 wrote to memory of 396	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	111
PID 4340 wrote to memory of 2268	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	112
PID 4340 wrote to memory of 2268	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	112
PID 4340 wrote to memory of 4004	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	113
PID 4340 wrote to memory of 4004	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	113
PID 4340 wrote to memory of 1912	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	114
PID 4340 wrote to memory of 1912	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	114
PID 4340 wrote to memory of 1464	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	115
PID 4340 wrote to memory of 1464	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	115
PID 4340 wrote to memory of 2316	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	116
PID 4340 wrote to memory of 2316	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	116
PID 4340 wrote to memory of 1012	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	117
PID 4340 wrote to memory of 1012	4340	2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe	117

C:\Users\Admin\AppData\Local\Temp\2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2de6db55e9c497b3e2d21e13dd768475_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2856
- C:\Windows\System\PrWygyo.exe
  C:\Windows\System\PrWygyo.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\SukpaiN.exe
  C:\Windows\System\SukpaiN.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\UihsaKt.exe
  C:\Windows\System\UihsaKt.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\gYgKsnU.exe
  C:\Windows\System\gYgKsnU.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\wjZZfNH.exe
  C:\Windows\System\wjZZfNH.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\xwiCNCO.exe
  C:\Windows\System\xwiCNCO.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\tFHjPJz.exe
  C:\Windows\System\tFHjPJz.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\JSajoEk.exe
  C:\Windows\System\JSajoEk.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\jSQYuHO.exe
  C:\Windows\System\jSQYuHO.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\NtEfDKg.exe
  C:\Windows\System\NtEfDKg.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\vdubOTV.exe
  C:\Windows\System\vdubOTV.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\RnGxfJC.exe
  C:\Windows\System\RnGxfJC.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\jNTRWlB.exe
  C:\Windows\System\jNTRWlB.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\pmGAIij.exe
  C:\Windows\System\pmGAIij.exe
  2⤵
  - Executes dropped EXE
  PID:3756
- C:\Windows\System\knNYVuE.exe
  C:\Windows\System\knNYVuE.exe
  2⤵
  - Executes dropped EXE
  PID:3748
- C:\Windows\System\eEVyXMn.exe
  C:\Windows\System\eEVyXMn.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\SwVtkSR.exe
  C:\Windows\System\SwVtkSR.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\qXtLxKh.exe
  C:\Windows\System\qXtLxKh.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\YpgNjoP.exe
  C:\Windows\System\YpgNjoP.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\SPWicPG.exe
  C:\Windows\System\SPWicPG.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\ySBYhnU.exe
  C:\Windows\System\ySBYhnU.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\hlQxAQK.exe
  C:\Windows\System\hlQxAQK.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\NPImaFk.exe
  C:\Windows\System\NPImaFk.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\rIGeCHH.exe
  C:\Windows\System\rIGeCHH.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\nklexzS.exe
  C:\Windows\System\nklexzS.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\PVnitws.exe
  C:\Windows\System\PVnitws.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\gKTJdHI.exe
  C:\Windows\System\gKTJdHI.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\IeKivHS.exe
  C:\Windows\System\IeKivHS.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\KEEHmTP.exe
  C:\Windows\System\KEEHmTP.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\VHLKBFL.exe
  C:\Windows\System\VHLKBFL.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\UWJzeoB.exe
  C:\Windows\System\UWJzeoB.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\AoChXaT.exe
  C:\Windows\System\AoChXaT.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\RiasPBh.exe
  C:\Windows\System\RiasPBh.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\oCPvPPM.exe
  C:\Windows\System\oCPvPPM.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\pBBkCFP.exe
  C:\Windows\System\pBBkCFP.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\CsJFxMy.exe
  C:\Windows\System\CsJFxMy.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System\lxfbIgQ.exe
  C:\Windows\System\lxfbIgQ.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\cLokgTE.exe
  C:\Windows\System\cLokgTE.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\WqXiiRM.exe
  C:\Windows\System\WqXiiRM.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\MXSVBZD.exe
  C:\Windows\System\MXSVBZD.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System\HVTPgwv.exe
  C:\Windows\System\HVTPgwv.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\tbYhuuX.exe
  C:\Windows\System\tbYhuuX.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\GaPETkI.exe
  C:\Windows\System\GaPETkI.exe
  2⤵
  - Executes dropped EXE
  PID:620
- C:\Windows\System\RLmqhsF.exe
  C:\Windows\System\RLmqhsF.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\lmhdOWJ.exe
  C:\Windows\System\lmhdOWJ.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\SzxrCrl.exe
  C:\Windows\System\SzxrCrl.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\eKjxxXv.exe
  C:\Windows\System\eKjxxXv.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\shyOcpT.exe
  C:\Windows\System\shyOcpT.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\kxeHLjb.exe
  C:\Windows\System\kxeHLjb.exe
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Windows\System\oBkXsSA.exe
  C:\Windows\System\oBkXsSA.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\LkfAuqi.exe
  C:\Windows\System\LkfAuqi.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\ReVJWze.exe
  C:\Windows\System\ReVJWze.exe
  2⤵
  - Executes dropped EXE
  PID:3828
- C:\Windows\System\zsTSbts.exe
  C:\Windows\System\zsTSbts.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\YyUakQh.exe
  C:\Windows\System\YyUakQh.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\yojzjaq.exe
  C:\Windows\System\yojzjaq.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\zzGuUPB.exe
  C:\Windows\System\zzGuUPB.exe
  2⤵
  PID:4832
- C:\Windows\System\lKHRSTX.exe
  C:\Windows\System\lKHRSTX.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\DCaCIfi.exe
  C:\Windows\System\DCaCIfi.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\ybrViLt.exe
  C:\Windows\System\ybrViLt.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\xdmvFto.exe
  C:\Windows\System\xdmvFto.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\wHWRYvz.exe
  C:\Windows\System\wHWRYvz.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\SJsINEe.exe
  C:\Windows\System\SJsINEe.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\QYQgbwx.exe
  C:\Windows\System\QYQgbwx.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System\OFsYSHW.exe
  C:\Windows\System\OFsYSHW.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\bOKgfBc.exe
  C:\Windows\System\bOKgfBc.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\AnsKhmh.exe
  C:\Windows\System\AnsKhmh.exe
  2⤵
  PID:4496
- C:\Windows\System\ojwprii.exe
  C:\Windows\System\ojwprii.exe
  2⤵
  PID:3572
- C:\Windows\System\MdpFnem.exe
  C:\Windows\System\MdpFnem.exe
  2⤵
  PID:1720
- C:\Windows\System\zAmBwch.exe
  C:\Windows\System\zAmBwch.exe
  2⤵
  PID:2332
- C:\Windows\System\HPWSCPY.exe
  C:\Windows\System\HPWSCPY.exe
  2⤵
  PID:4624
- C:\Windows\System\mvrxzzS.exe
  C:\Windows\System\mvrxzzS.exe
  2⤵
  PID:5140
- C:\Windows\System\AYKWbrg.exe
  C:\Windows\System\AYKWbrg.exe
  2⤵
  PID:5164
- C:\Windows\System\hCCMkEc.exe
  C:\Windows\System\hCCMkEc.exe
  2⤵
  PID:5192
- C:\Windows\System\FseFjFE.exe
  C:\Windows\System\FseFjFE.exe
  2⤵
  PID:5228
- C:\Windows\System\ThmNjPP.exe
  C:\Windows\System\ThmNjPP.exe
  2⤵
  PID:5248
- C:\Windows\System\XINrlQq.exe
  C:\Windows\System\XINrlQq.exe
  2⤵
  PID:5284
- C:\Windows\System\oFYRvWS.exe
  C:\Windows\System\oFYRvWS.exe
  2⤵
  PID:5304
- C:\Windows\System\AeOwcfR.exe
  C:\Windows\System\AeOwcfR.exe
  2⤵
  PID:5324
- C:\Windows\System\BQatuAb.exe
  C:\Windows\System\BQatuAb.exe
  2⤵
  PID:5376
- C:\Windows\System\hsPMESN.exe
  C:\Windows\System\hsPMESN.exe
  2⤵
  PID:5400
- C:\Windows\System\vpeECAd.exe
  C:\Windows\System\vpeECAd.exe
  2⤵
  PID:5424
- C:\Windows\System\nLYPKWK.exe
  C:\Windows\System\nLYPKWK.exe
  2⤵
  PID:5448
- C:\Windows\System\GftDoRI.exe
  C:\Windows\System\GftDoRI.exe
  2⤵
  PID:5468
- C:\Windows\System\BVeUILu.exe
  C:\Windows\System\BVeUILu.exe
  2⤵
  PID:5488
- C:\Windows\System\HJYpTPO.exe
  C:\Windows\System\HJYpTPO.exe
  2⤵
  PID:5548
- C:\Windows\System\AaJGdsj.exe
  C:\Windows\System\AaJGdsj.exe
  2⤵
  PID:5568
- C:\Windows\System\rYmqrqo.exe
  C:\Windows\System\rYmqrqo.exe
  2⤵
  PID:5588
- C:\Windows\System\cZNXXeB.exe
  C:\Windows\System\cZNXXeB.exe
  2⤵
  PID:5624
- C:\Windows\System\uwVYfPg.exe
  C:\Windows\System\uwVYfPg.exe
  2⤵
  PID:5652
- C:\Windows\System\kcVmrzr.exe
  C:\Windows\System\kcVmrzr.exe
  2⤵
  PID:5676
- C:\Windows\System\XOrHNXo.exe
  C:\Windows\System\XOrHNXo.exe
  2⤵
  PID:5700
- C:\Windows\System\bePiaiC.exe
  C:\Windows\System\bePiaiC.exe
  2⤵
  PID:5720
- C:\Windows\System\uOZygri.exe
  C:\Windows\System\uOZygri.exe
  2⤵
  PID:5748
- C:\Windows\System\yWZBVny.exe
  C:\Windows\System\yWZBVny.exe
  2⤵
  PID:5772
- C:\Windows\System\oOiOvVL.exe
  C:\Windows\System\oOiOvVL.exe
  2⤵
  PID:5792
- C:\Windows\System\hPXEgmV.exe
  C:\Windows\System\hPXEgmV.exe
  2⤵
  PID:5808
- C:\Windows\System\kkmQNje.exe
  C:\Windows\System\kkmQNje.exe
  2⤵
  PID:5828
- C:\Windows\System\OrcLMsm.exe
  C:\Windows\System\OrcLMsm.exe
  2⤵
  PID:5848
- C:\Windows\System\WuJfIdy.exe
  C:\Windows\System\WuJfIdy.exe
  2⤵
  PID:5864
- C:\Windows\System\ibKtgLd.exe
  C:\Windows\System\ibKtgLd.exe
  2⤵
  PID:5892
- C:\Windows\System\mUHbwNK.exe
  C:\Windows\System\mUHbwNK.exe
  2⤵
  PID:5912
- C:\Windows\System\ZwXAOYC.exe
  C:\Windows\System\ZwXAOYC.exe
  2⤵
  PID:5940
- C:\Windows\System\kItPRpq.exe
  C:\Windows\System\kItPRpq.exe
  2⤵
  PID:5960
- C:\Windows\System\XumOdGw.exe
  C:\Windows\System\XumOdGw.exe
  2⤵
  PID:5984
- C:\Windows\System\iKHaUbw.exe
  C:\Windows\System\iKHaUbw.exe
  2⤵
  PID:6000
- C:\Windows\System\MAAqVbn.exe
  C:\Windows\System\MAAqVbn.exe
  2⤵
  PID:6036
- C:\Windows\System\UAqnHKt.exe
  C:\Windows\System\UAqnHKt.exe
  2⤵
  PID:6052
- C:\Windows\System\AxvDStg.exe
  C:\Windows\System\AxvDStg.exe
  2⤵
  PID:6084
- C:\Windows\System\htCPgEM.exe
  C:\Windows\System\htCPgEM.exe
  2⤵
  PID:6100
- C:\Windows\System\CXzjAfB.exe
  C:\Windows\System\CXzjAfB.exe
  2⤵
  PID:6128
- C:\Windows\System\pyLfXgL.exe
  C:\Windows\System\pyLfXgL.exe
  2⤵
  PID:4344
- C:\Windows\System\FjXgVCF.exe
  C:\Windows\System\FjXgVCF.exe
  2⤵
  PID:2944
- C:\Windows\System\TRXUBBL.exe
  C:\Windows\System\TRXUBBL.exe
  2⤵
  PID:2156
- C:\Windows\System\BVAJaGP.exe
  C:\Windows\System\BVAJaGP.exe
  2⤵
  PID:2480
- C:\Windows\System\pFPYkAl.exe
  C:\Windows\System\pFPYkAl.exe
  2⤵
  PID:1516
- C:\Windows\System\iCsFvXn.exe
  C:\Windows\System\iCsFvXn.exe
  2⤵
  PID:3436
- C:\Windows\System\aBJPcRW.exe
  C:\Windows\System\aBJPcRW.exe
  2⤵
  PID:4932
- C:\Windows\System\qynNRjy.exe
  C:\Windows\System\qynNRjy.exe
  2⤵
  PID:3608
- C:\Windows\System\VGCbxKV.exe
  C:\Windows\System\VGCbxKV.exe
  2⤵
  PID:5320
- C:\Windows\System\YJmlWDB.exe
  C:\Windows\System\YJmlWDB.exe
  2⤵
  PID:5800
- C:\Windows\System\aThzOtj.exe
  C:\Windows\System\aThzOtj.exe
  2⤵
  PID:5900
- C:\Windows\System\GzqDSAg.exe
  C:\Windows\System\GzqDSAg.exe
  2⤵
  PID:5172
- C:\Windows\System\AlanZCt.exe
  C:\Windows\System\AlanZCt.exe
  2⤵
  PID:6008
- C:\Windows\System\NpUThtT.exe
  C:\Windows\System\NpUThtT.exe
  2⤵
  PID:6024
- C:\Windows\System\AmzNzkT.exe
  C:\Windows\System\AmzNzkT.exe
  2⤵
  PID:5332
- C:\Windows\System\cYYiLDP.exe
  C:\Windows\System\cYYiLDP.exe
  2⤵
  PID:2152
- C:\Windows\System\cCVAAJT.exe
  C:\Windows\System\cCVAAJT.exe
  2⤵
  PID:5992
- C:\Windows\System\OdPEyWp.exe
  C:\Windows\System\OdPEyWp.exe
  2⤵
  PID:5500
- C:\Windows\System\ZTZcSjK.exe
  C:\Windows\System\ZTZcSjK.exe
  2⤵
  PID:6148
- C:\Windows\System\FIyheMj.exe
  C:\Windows\System\FIyheMj.exe
  2⤵
  PID:6180
- C:\Windows\System\xrQbSnr.exe
  C:\Windows\System\xrQbSnr.exe
  2⤵
  PID:6200
- C:\Windows\System\XniqXZe.exe
  C:\Windows\System\XniqXZe.exe
  2⤵
  PID:6220
- C:\Windows\System\ypURsMC.exe
  C:\Windows\System\ypURsMC.exe
  2⤵
  PID:6236
- C:\Windows\System\vbooEze.exe
  C:\Windows\System\vbooEze.exe
  2⤵
  PID:6264
- C:\Windows\System\MmTlnwC.exe
  C:\Windows\System\MmTlnwC.exe
  2⤵
  PID:6280
- C:\Windows\System\CrWupJP.exe
  C:\Windows\System\CrWupJP.exe
  2⤵
  PID:6304
- C:\Windows\System\ttwiiJH.exe
  C:\Windows\System\ttwiiJH.exe
  2⤵
  PID:6320
- C:\Windows\System\qLEuJVr.exe
  C:\Windows\System\qLEuJVr.exe
  2⤵
  PID:6344
- C:\Windows\System\ONPBaEc.exe
  C:\Windows\System\ONPBaEc.exe
  2⤵
  PID:6364
- C:\Windows\System\HyTXEWL.exe
  C:\Windows\System\HyTXEWL.exe
  2⤵
  PID:6384
- C:\Windows\System\hIKSJZa.exe
  C:\Windows\System\hIKSJZa.exe
  2⤵
  PID:6420
- C:\Windows\System\tXmLAhp.exe
  C:\Windows\System\tXmLAhp.exe
  2⤵
  PID:6436
- C:\Windows\System\jbZoQpH.exe
  C:\Windows\System\jbZoQpH.exe
  2⤵
  PID:6460
- C:\Windows\System\IcHzrVS.exe
  C:\Windows\System\IcHzrVS.exe
  2⤵
  PID:6492
- C:\Windows\System\ZwansVW.exe
  C:\Windows\System\ZwansVW.exe
  2⤵
  PID:6516
- C:\Windows\System\PXoHdvf.exe
  C:\Windows\System\PXoHdvf.exe
  2⤵
  PID:6536
- C:\Windows\System\DAmpCQc.exe
  C:\Windows\System\DAmpCQc.exe
  2⤵
  PID:6560
- C:\Windows\System\CTBltHz.exe
  C:\Windows\System\CTBltHz.exe
  2⤵
  PID:6576
- C:\Windows\System\cXADfuE.exe
  C:\Windows\System\cXADfuE.exe
  2⤵
  PID:6600
- C:\Windows\System\RdcSRfh.exe
  C:\Windows\System\RdcSRfh.exe
  2⤵
  PID:6624
- C:\Windows\System\zKrZzkZ.exe
  C:\Windows\System\zKrZzkZ.exe
  2⤵
  PID:6648
- C:\Windows\System\qyhgyLV.exe
  C:\Windows\System\qyhgyLV.exe
  2⤵
  PID:6668
- C:\Windows\System\QmAVJcQ.exe
  C:\Windows\System\QmAVJcQ.exe
  2⤵
  PID:6712
- C:\Windows\System\JPgbvXp.exe
  C:\Windows\System\JPgbvXp.exe
  2⤵
  PID:6732
- C:\Windows\System\zOxhTxQ.exe
  C:\Windows\System\zOxhTxQ.exe
  2⤵
  PID:6748
- C:\Windows\System\cLqZkkv.exe
  C:\Windows\System\cLqZkkv.exe
  2⤵
  PID:6768
- C:\Windows\System\SFKIAyv.exe
  C:\Windows\System\SFKIAyv.exe
  2⤵
  PID:6788
- C:\Windows\System\xzyWVcN.exe
  C:\Windows\System\xzyWVcN.exe
  2⤵
  PID:6812
- C:\Windows\System\jwXTziO.exe
  C:\Windows\System\jwXTziO.exe
  2⤵
  PID:6856
- C:\Windows\System\DpcgoYb.exe
  C:\Windows\System\DpcgoYb.exe
  2⤵
  PID:6876
- C:\Windows\System\FrtqcNM.exe
  C:\Windows\System\FrtqcNM.exe
  2⤵
  PID:6896
- C:\Windows\System\vXdHGOO.exe
  C:\Windows\System\vXdHGOO.exe
  2⤵
  PID:6916
- C:\Windows\System\biKDwro.exe
  C:\Windows\System\biKDwro.exe
  2⤵
  PID:6936
- C:\Windows\System\TFpvYVy.exe
  C:\Windows\System\TFpvYVy.exe
  2⤵
  PID:6964
- C:\Windows\System\bjXEXYO.exe
  C:\Windows\System\bjXEXYO.exe
  2⤵
  PID:6980
- C:\Windows\System\NLVssUl.exe
  C:\Windows\System\NLVssUl.exe
  2⤵
  PID:7008
- C:\Windows\System\vkmijsV.exe
  C:\Windows\System\vkmijsV.exe
  2⤵
  PID:7024
- C:\Windows\System\hEbULUd.exe
  C:\Windows\System\hEbULUd.exe
  2⤵
  PID:7052
- C:\Windows\System\MiGrcRZ.exe
  C:\Windows\System\MiGrcRZ.exe
  2⤵
  PID:7068
- C:\Windows\System\jRNZCeO.exe
  C:\Windows\System\jRNZCeO.exe
  2⤵
  PID:7088
- C:\Windows\System\ZeGqVfS.exe
  C:\Windows\System\ZeGqVfS.exe
  2⤵
  PID:7116
- C:\Windows\System\JbSTeVf.exe
  C:\Windows\System\JbSTeVf.exe
  2⤵
  PID:7132
- C:\Windows\System\rxNKzYV.exe
  C:\Windows\System\rxNKzYV.exe
  2⤵
  PID:7156
- C:\Windows\System\pdhACaX.exe
  C:\Windows\System\pdhACaX.exe
  2⤵
  PID:5716
- C:\Windows\System\zjmIFmD.exe
  C:\Windows\System\zjmIFmD.exe
  2⤵
  PID:5756
- C:\Windows\System\uVZjnQm.exe
  C:\Windows\System\uVZjnQm.exe
  2⤵
  PID:5840
- C:\Windows\System\VOTYvGF.exe
  C:\Windows\System\VOTYvGF.exe
  2⤵
  PID:5504
- C:\Windows\System\qxtEqoh.exe
  C:\Windows\System\qxtEqoh.exe
  2⤵
  PID:3424
- C:\Windows\System\KemUjcL.exe
  C:\Windows\System\KemUjcL.exe
  2⤵
  PID:5932
- C:\Windows\System\GMrbfqg.exe
  C:\Windows\System\GMrbfqg.exe
  2⤵
  PID:5364
- C:\Windows\System\uRwBfOA.exe
  C:\Windows\System\uRwBfOA.exe
  2⤵
  PID:5224
- C:\Windows\System\anCOuyp.exe
  C:\Windows\System\anCOuyp.exe
  2⤵
  PID:3308
- C:\Windows\System\OJRlwpE.exe
  C:\Windows\System\OJRlwpE.exe
  2⤵
  PID:4116
- C:\Windows\System\yKitSFT.exe
  C:\Windows\System\yKitSFT.exe
  2⤵
  PID:4160
- C:\Windows\System\wmqLKXR.exe
  C:\Windows\System\wmqLKXR.exe
  2⤵
  PID:6260
- C:\Windows\System\VkPUBzW.exe
  C:\Windows\System\VkPUBzW.exe
  2⤵
  PID:5564
- C:\Windows\System\dmGaWTw.exe
  C:\Windows\System\dmGaWTw.exe
  2⤵
  PID:5408
- C:\Windows\System\wbZVqRm.exe
  C:\Windows\System\wbZVqRm.exe
  2⤵
  PID:6572
- C:\Windows\System\kglTMjr.exe
  C:\Windows\System\kglTMjr.exe
  2⤵
  PID:6676
- C:\Windows\System\wqLmBeZ.exe
  C:\Windows\System\wqLmBeZ.exe
  2⤵
  PID:6244
- C:\Windows\System\uedjZNH.exe
  C:\Windows\System\uedjZNH.exe
  2⤵
  PID:5240
- C:\Windows\System\tNLMBPO.exe
  C:\Windows\System\tNLMBPO.exe
  2⤵
  PID:3020
- C:\Windows\System\RpgbJBI.exe
  C:\Windows\System\RpgbJBI.exe
  2⤵
  PID:5760
- C:\Windows\System\PxIrerJ.exe
  C:\Windows\System\PxIrerJ.exe
  2⤵
  PID:6952
- C:\Windows\System\amphDen.exe
  C:\Windows\System\amphDen.exe
  2⤵
  PID:5460
- C:\Windows\System\jbFqDDf.exe
  C:\Windows\System\jbFqDDf.exe
  2⤵
  PID:7016
- C:\Windows\System\JGUaqFK.exe
  C:\Windows\System\JGUaqFK.exe
  2⤵
  PID:5644
- C:\Windows\System\adqgKrW.exe
  C:\Windows\System\adqgKrW.exe
  2⤵
  PID:6196
- C:\Windows\System\RGtMAVM.exe
  C:\Windows\System\RGtMAVM.exe
  2⤵
  PID:7176
- C:\Windows\System\EtUyUct.exe
  C:\Windows\System\EtUyUct.exe
  2⤵
  PID:7200
- C:\Windows\System\zBcnAdz.exe
  C:\Windows\System\zBcnAdz.exe
  2⤵
  PID:7220
- C:\Windows\System\PmodVaK.exe
  C:\Windows\System\PmodVaK.exe
  2⤵
  PID:7244
- C:\Windows\System\KwdAUvz.exe
  C:\Windows\System\KwdAUvz.exe
  2⤵
  PID:7268
- C:\Windows\System\dBEOqkg.exe
  C:\Windows\System\dBEOqkg.exe
  2⤵
  PID:7292
- C:\Windows\System\KrdXGZh.exe
  C:\Windows\System\KrdXGZh.exe
  2⤵
  PID:7308
- C:\Windows\System\VmFAYGJ.exe
  C:\Windows\System\VmFAYGJ.exe
  2⤵
  PID:7332
- C:\Windows\System\Evgzaek.exe
  C:\Windows\System\Evgzaek.exe
  2⤵
  PID:7348
- C:\Windows\System\zELqdbP.exe
  C:\Windows\System\zELqdbP.exe
  2⤵
  PID:7372
- C:\Windows\System\SgNTKik.exe
  C:\Windows\System\SgNTKik.exe
  2⤵
  PID:7396
- C:\Windows\System\MaCMWdn.exe
  C:\Windows\System\MaCMWdn.exe
  2⤵
  PID:7412
- C:\Windows\System\lMxbrME.exe
  C:\Windows\System\lMxbrME.exe
  2⤵
  PID:7436
- C:\Windows\System\BorwieC.exe
  C:\Windows\System\BorwieC.exe
  2⤵
  PID:7460
- C:\Windows\System\qOWFJil.exe
  C:\Windows\System\qOWFJil.exe
  2⤵
  PID:7480
- C:\Windows\System\EFSwWqV.exe
  C:\Windows\System\EFSwWqV.exe
  2⤵
  PID:7500
- C:\Windows\System\ZaMeoxO.exe
  C:\Windows\System\ZaMeoxO.exe
  2⤵
  PID:7524
- C:\Windows\System\TfGKTdV.exe
  C:\Windows\System\TfGKTdV.exe
  2⤵
  PID:7548
- C:\Windows\System\oueRUMo.exe
  C:\Windows\System\oueRUMo.exe
  2⤵
  PID:7564
- C:\Windows\System\emYlqNj.exe
  C:\Windows\System\emYlqNj.exe
  2⤵
  PID:7588
- C:\Windows\System\DlLwaYS.exe
  C:\Windows\System\DlLwaYS.exe
  2⤵
  PID:7636
- C:\Windows\System\ASBDPGZ.exe
  C:\Windows\System\ASBDPGZ.exe
  2⤵
  PID:7652
- C:\Windows\System\KzMAjNk.exe
  C:\Windows\System\KzMAjNk.exe
  2⤵
  PID:7712
- C:\Windows\System\CNfmSlW.exe
  C:\Windows\System\CNfmSlW.exe
  2⤵
  PID:7732
- C:\Windows\System\dLufYSK.exe
  C:\Windows\System\dLufYSK.exe
  2⤵
  PID:7756
- C:\Windows\System\MiDEqHd.exe
  C:\Windows\System\MiDEqHd.exe
  2⤵
  PID:7776
- C:\Windows\System\wYPuvnv.exe
  C:\Windows\System\wYPuvnv.exe
  2⤵
  PID:7800
- C:\Windows\System\NUgoiya.exe
  C:\Windows\System\NUgoiya.exe
  2⤵
  PID:7824
- C:\Windows\System\gNkkLTq.exe
  C:\Windows\System\gNkkLTq.exe
  2⤵
  PID:7848
- C:\Windows\System\DbsFUTT.exe
  C:\Windows\System\DbsFUTT.exe
  2⤵
  PID:7864
- C:\Windows\System\ZhpJIQa.exe
  C:\Windows\System\ZhpJIQa.exe
  2⤵
  PID:7888
- C:\Windows\System\eEGVOrS.exe
  C:\Windows\System\eEGVOrS.exe
  2⤵
  PID:7908
- C:\Windows\System\ppTsOjV.exe
  C:\Windows\System\ppTsOjV.exe
  2⤵
  PID:7928
- C:\Windows\System\EpOCwAl.exe
  C:\Windows\System\EpOCwAl.exe
  2⤵
  PID:7944
- C:\Windows\System\fWgoATo.exe
  C:\Windows\System\fWgoATo.exe
  2⤵
  PID:7972
- C:\Windows\System\uaDnVmE.exe
  C:\Windows\System\uaDnVmE.exe
  2⤵
  PID:8000
- C:\Windows\System\HjDOlYl.exe
  C:\Windows\System\HjDOlYl.exe
  2⤵
  PID:8016
- C:\Windows\System\QIcJLob.exe
  C:\Windows\System\QIcJLob.exe
  2⤵
  PID:8032
- C:\Windows\System\QQElBlS.exe
  C:\Windows\System\QQElBlS.exe
  2⤵
  PID:8052
- C:\Windows\System\RRplodK.exe
  C:\Windows\System\RRplodK.exe
  2⤵
  PID:8072
- C:\Windows\System\SPskSDc.exe
  C:\Windows\System\SPskSDc.exe
  2⤵
  PID:8092
- C:\Windows\System\oyBjQkd.exe
  C:\Windows\System\oyBjQkd.exe
  2⤵
  PID:8116
- C:\Windows\System\VapWxSn.exe
  C:\Windows\System\VapWxSn.exe
  2⤵
  PID:8136
- C:\Windows\System\WgXHQfj.exe
  C:\Windows\System\WgXHQfj.exe
  2⤵
  PID:8156
- C:\Windows\System\wqJJhtY.exe
  C:\Windows\System\wqJJhtY.exe
  2⤵
  PID:8180
- C:\Windows\System\ITYQkBb.exe
  C:\Windows\System\ITYQkBb.exe
  2⤵
  PID:6780
- C:\Windows\System\RFcHcRA.exe
  C:\Windows\System\RFcHcRA.exe
  2⤵
  PID:6312
- C:\Windows\System\cuMBTxB.exe
  C:\Windows\System\cuMBTxB.exe
  2⤵
  PID:6352
- C:\Windows\System\paXhTnM.exe
  C:\Windows\System\paXhTnM.exe
  2⤵
  PID:6408
- C:\Windows\System\vqANsAp.exe
  C:\Windows\System\vqANsAp.exe
  2⤵
  PID:6444
- C:\Windows\System\VGWyCZc.exe
  C:\Windows\System\VGWyCZc.exe
  2⤵
  PID:6888
- C:\Windows\System\EgCaWUv.exe
  C:\Windows\System\EgCaWUv.exe
  2⤵
  PID:5660
- C:\Windows\System\HTvhAhG.exe
  C:\Windows\System\HTvhAhG.exe
  2⤵
  PID:6528
- C:\Windows\System\IDFeCZD.exe
  C:\Windows\System\IDFeCZD.exe
  2⤵
  PID:6632
- C:\Windows\System\ZmUMngV.exe
  C:\Windows\System\ZmUMngV.exe
  2⤵
  PID:6512
- C:\Windows\System\qRZFrpc.exe
  C:\Windows\System\qRZFrpc.exe
  2⤵
  PID:7108
- C:\Windows\System\HkMcSJA.exe
  C:\Windows\System\HkMcSJA.exe
  2⤵
  PID:6584
- C:\Windows\System\IwFFepX.exe
  C:\Windows\System\IwFFepX.exe
  2⤵
  PID:6740
- C:\Windows\System\zothzbw.exe
  C:\Windows\System\zothzbw.exe
  2⤵
  PID:5156
- C:\Windows\System\ptXXfIP.exe
  C:\Windows\System\ptXXfIP.exe
  2⤵
  PID:7420
- C:\Windows\System\LGQwirJ.exe
  C:\Windows\System\LGQwirJ.exe
  2⤵
  PID:7476
- C:\Windows\System\iNbIrxV.exe
  C:\Windows\System\iNbIrxV.exe
  2⤵
  PID:7520
- C:\Windows\System\pSUIxEl.exe
  C:\Windows\System\pSUIxEl.exe
  2⤵
  PID:7584
- C:\Windows\System\KQvnEaj.exe
  C:\Windows\System\KQvnEaj.exe
  2⤵
  PID:7644
- C:\Windows\System\QBrFoSL.exe
  C:\Windows\System\QBrFoSL.exe
  2⤵
  PID:6092
- C:\Windows\System\baXiCBn.exe
  C:\Windows\System\baXiCBn.exe
  2⤵
  PID:6932
- C:\Windows\System\LGkODpY.exe
  C:\Windows\System\LGkODpY.exe
  2⤵
  PID:7748
- C:\Windows\System\MoJYDOs.exe
  C:\Windows\System\MoJYDOs.exe
  2⤵
  PID:8200
- C:\Windows\System\GrVRDrO.exe
  C:\Windows\System\GrVRDrO.exe
  2⤵
  PID:8220
- C:\Windows\System\hekMpyP.exe
  C:\Windows\System\hekMpyP.exe
  2⤵
  PID:8236
- C:\Windows\System\TaNZNjc.exe
  C:\Windows\System\TaNZNjc.exe
  2⤵
  PID:8264
- C:\Windows\System\HWOcUHG.exe
  C:\Windows\System\HWOcUHG.exe
  2⤵
  PID:8284
- C:\Windows\System\zCyArbe.exe
  C:\Windows\System\zCyArbe.exe
  2⤵
  PID:8304
- C:\Windows\System\nHFuYlu.exe
  C:\Windows\System\nHFuYlu.exe
  2⤵
  PID:8328
- C:\Windows\System\hWbHwKP.exe
  C:\Windows\System\hWbHwKP.exe
  2⤵
  PID:8352
- C:\Windows\System\pJldBOW.exe
  C:\Windows\System\pJldBOW.exe
  2⤵
  PID:8384
- C:\Windows\System\Egdimqe.exe
  C:\Windows\System\Egdimqe.exe
  2⤵
  PID:8408
- C:\Windows\System\iiwXnwZ.exe
  C:\Windows\System\iiwXnwZ.exe
  2⤵
  PID:8424
- C:\Windows\System\vsFgFTR.exe
  C:\Windows\System\vsFgFTR.exe
  2⤵
  PID:8440
- C:\Windows\System\xnYFPMB.exe
  C:\Windows\System\xnYFPMB.exe
  2⤵
  PID:8468
- C:\Windows\System\iEHmgpR.exe
  C:\Windows\System\iEHmgpR.exe
  2⤵
  PID:8488
- C:\Windows\System\lAApepB.exe
  C:\Windows\System\lAApepB.exe
  2⤵
  PID:8512
- C:\Windows\System\dzEXaIx.exe
  C:\Windows\System\dzEXaIx.exe
  2⤵
  PID:8532
- C:\Windows\System\vcJbjNL.exe
  C:\Windows\System\vcJbjNL.exe
  2⤵
  PID:8556
- C:\Windows\System\fofowpY.exe
  C:\Windows\System\fofowpY.exe
  2⤵
  PID:8576
- C:\Windows\System\VDbnFbk.exe
  C:\Windows\System\VDbnFbk.exe
  2⤵
  PID:8600
- C:\Windows\System\nZwoTvd.exe
  C:\Windows\System\nZwoTvd.exe
  2⤵
  PID:8620
- C:\Windows\System\hVDouKE.exe
  C:\Windows\System\hVDouKE.exe
  2⤵
  PID:8644
- C:\Windows\System\sbNaZSE.exe
  C:\Windows\System\sbNaZSE.exe
  2⤵
  PID:8660
- C:\Windows\System\hfUVqst.exe
  C:\Windows\System\hfUVqst.exe
  2⤵
  PID:8680
- C:\Windows\System\aqUtmMw.exe
  C:\Windows\System\aqUtmMw.exe
  2⤵
  PID:8704
- C:\Windows\System\vcIudgE.exe
  C:\Windows\System\vcIudgE.exe
  2⤵
  PID:8720
- C:\Windows\System\dILVHVS.exe
  C:\Windows\System\dILVHVS.exe
  2⤵
  PID:8740
- C:\Windows\System\gMaMwJe.exe
  C:\Windows\System\gMaMwJe.exe
  2⤵
  PID:8756
- C:\Windows\System\aLYDDKJ.exe
  C:\Windows\System\aLYDDKJ.exe
  2⤵
  PID:8776
- C:\Windows\System\SCDucTf.exe
  C:\Windows\System\SCDucTf.exe
  2⤵
  PID:8796
- C:\Windows\System\FcSdcVS.exe
  C:\Windows\System\FcSdcVS.exe
  2⤵
  PID:8812
- C:\Windows\System\qXBNOyE.exe
  C:\Windows\System\qXBNOyE.exe
  2⤵
  PID:8828
- C:\Windows\System\IxFuItE.exe
  C:\Windows\System\IxFuItE.exe
  2⤵
  PID:8848
- C:\Windows\System\FeaPmgh.exe
  C:\Windows\System\FeaPmgh.exe
  2⤵
  PID:8868
- C:\Windows\System\RAIPcET.exe
  C:\Windows\System\RAIPcET.exe
  2⤵
  PID:8892
- C:\Windows\System\pyymIwN.exe
  C:\Windows\System\pyymIwN.exe
  2⤵
  PID:8908
- C:\Windows\System\diReRsW.exe
  C:\Windows\System\diReRsW.exe
  2⤵
  PID:8928
- C:\Windows\System\kGNcTLG.exe
  C:\Windows\System\kGNcTLG.exe
  2⤵
  PID:8956
- C:\Windows\System\kEuCUfn.exe
  C:\Windows\System\kEuCUfn.exe
  2⤵
  PID:8972
- C:\Windows\System\ZPdbWmQ.exe
  C:\Windows\System\ZPdbWmQ.exe
  2⤵
  PID:9000
- C:\Windows\System\CSvTfPz.exe
  C:\Windows\System\CSvTfPz.exe
  2⤵
  PID:9028
- C:\Windows\System\LSijMAj.exe
  C:\Windows\System\LSijMAj.exe
  2⤵
  PID:9048
- C:\Windows\System\TCZfBkA.exe
  C:\Windows\System\TCZfBkA.exe
  2⤵
  PID:9064
- C:\Windows\System\tMhgtYL.exe
  C:\Windows\System\tMhgtYL.exe
  2⤵
  PID:9088
- C:\Windows\System\pxBqwNA.exe
  C:\Windows\System\pxBqwNA.exe
  2⤵
  PID:9108
- C:\Windows\System\ITNbkzl.exe
  C:\Windows\System\ITNbkzl.exe
  2⤵
  PID:9132
- C:\Windows\System\DpoRNGW.exe
  C:\Windows\System\DpoRNGW.exe
  2⤵
  PID:9148
- C:\Windows\System\xTfKYJd.exe
  C:\Windows\System\xTfKYJd.exe
  2⤵
  PID:9172
- C:\Windows\System\UYNXafQ.exe
  C:\Windows\System\UYNXafQ.exe
  2⤵
  PID:9192
- C:\Windows\System\PkxVivP.exe
  C:\Windows\System\PkxVivP.exe
  2⤵
  PID:7808
- C:\Windows\System\ZQqJtpo.exe
  C:\Windows\System\ZQqJtpo.exe
  2⤵
  PID:7840
- C:\Windows\System\PNtGPER.exe
  C:\Windows\System\PNtGPER.exe
  2⤵
  PID:7904
- C:\Windows\System\ZfIDVuX.exe
  C:\Windows\System\ZfIDVuX.exe
  2⤵
  PID:7924
- C:\Windows\System\SSzzekQ.exe
  C:\Windows\System\SSzzekQ.exe
  2⤵
  PID:8012
- C:\Windows\System\FkCYLoe.exe
  C:\Windows\System\FkCYLoe.exe
  2⤵
  PID:8024
- C:\Windows\System\ETQSelD.exe
  C:\Windows\System\ETQSelD.exe
  2⤵
  PID:8128
- C:\Windows\System\IxmqPQZ.exe
  C:\Windows\System\IxmqPQZ.exe
  2⤵
  PID:852
- C:\Windows\System\rgwCreb.exe
  C:\Windows\System\rgwCreb.exe
  2⤵
  PID:7152
- C:\Windows\System\IVgkwNz.exe
  C:\Windows\System\IVgkwNz.exe
  2⤵
  PID:2960
- C:\Windows\System\aIcFviE.exe
  C:\Windows\System\aIcFviE.exe
  2⤵
  PID:6928
- C:\Windows\System\xJRGftY.exe
  C:\Windows\System\xJRGftY.exe
  2⤵
  PID:6616
- C:\Windows\System\lWDRaVm.exe
  C:\Windows\System\lWDRaVm.exe
  2⤵
  PID:4060
- C:\Windows\System\tgYdVGu.exe
  C:\Windows\System\tgYdVGu.exe
  2⤵
  PID:6728
- C:\Windows\System\yzvTOrD.exe
  C:\Windows\System\yzvTOrD.exe
  2⤵
  PID:1620
- C:\Windows\System\OuTIdoj.exe
  C:\Windows\System\OuTIdoj.exe
  2⤵
  PID:5816
- C:\Windows\System\JiDsfnB.exe
  C:\Windows\System\JiDsfnB.exe
  2⤵
  PID:7324
- C:\Windows\System\aelmMlA.exe
  C:\Windows\System\aelmMlA.exe
  2⤵
  PID:7444
- C:\Windows\System\vFbUIHz.exe
  C:\Windows\System\vFbUIHz.exe
  2⤵
  PID:7688
- C:\Windows\System\pQPHyHB.exe
  C:\Windows\System\pQPHyHB.exe
  2⤵
  PID:444
- C:\Windows\System\iFjGJvN.exe
  C:\Windows\System\iFjGJvN.exe
  2⤵
  PID:7792
- C:\Windows\System\jOjPhEt.exe
  C:\Windows\System\jOjPhEt.exe
  2⤵
  PID:7832
- C:\Windows\System\GmwuWKx.exe
  C:\Windows\System\GmwuWKx.exe
  2⤵
  PID:7900
- C:\Windows\System\eONRinj.exe
  C:\Windows\System\eONRinj.exe
  2⤵
  PID:8296
- C:\Windows\System\ikEfKXY.exe
  C:\Windows\System\ikEfKXY.exe
  2⤵
  PID:5052
- C:\Windows\System\eceyryo.exe
  C:\Windows\System\eceyryo.exe
  2⤵
  PID:8044
- C:\Windows\System\VKUXsjh.exe
  C:\Windows\System\VKUXsjh.exe
  2⤵
  PID:7384
- C:\Windows\System\tZYDgGU.exe
  C:\Windows\System\tZYDgGU.exe
  2⤵
  PID:7660
- C:\Windows\System\APdIZGu.exe
  C:\Windows\System\APdIZGu.exe
  2⤵
  PID:8888
- C:\Windows\System\kHyJFRB.exe
  C:\Windows\System\kHyJFRB.exe
  2⤵
  PID:9228
- C:\Windows\System\zoAMvDz.exe
  C:\Windows\System\zoAMvDz.exe
  2⤵
  PID:9244
- C:\Windows\System\JdMHofw.exe
  C:\Windows\System\JdMHofw.exe
  2⤵
  PID:9260
- C:\Windows\System\gSnCxKX.exe
  C:\Windows\System\gSnCxKX.exe
  2⤵
  PID:9284
- C:\Windows\System\KjkEIgB.exe
  C:\Windows\System\KjkEIgB.exe
  2⤵
  PID:9308
- C:\Windows\System\dhLeYco.exe
  C:\Windows\System\dhLeYco.exe
  2⤵
  PID:9336
- C:\Windows\System\zqoRdiE.exe
  C:\Windows\System\zqoRdiE.exe
  2⤵
  PID:9352
- C:\Windows\System\SfJlyCG.exe
  C:\Windows\System\SfJlyCG.exe
  2⤵
  PID:9376
- C:\Windows\System\xFjveBy.exe
  C:\Windows\System\xFjveBy.exe
  2⤵
  PID:9392
- C:\Windows\System\rYBDlrY.exe
  C:\Windows\System\rYBDlrY.exe
  2⤵
  PID:9416
- C:\Windows\System\JmEDhRV.exe
  C:\Windows\System\JmEDhRV.exe
  2⤵
  PID:9436
- C:\Windows\System\RLtgWXe.exe
  C:\Windows\System\RLtgWXe.exe
  2⤵
  PID:9460
- C:\Windows\System\izPThwG.exe
  C:\Windows\System\izPThwG.exe
  2⤵
  PID:9484
- C:\Windows\System\oqPHcOh.exe
  C:\Windows\System\oqPHcOh.exe
  2⤵
  PID:9520
- C:\Windows\System\sJkRYZL.exe
  C:\Windows\System\sJkRYZL.exe
  2⤵
  PID:9540
- C:\Windows\System\MGOlSKK.exe
  C:\Windows\System\MGOlSKK.exe
  2⤵
  PID:9564
- C:\Windows\System\PBwUbDU.exe
  C:\Windows\System\PBwUbDU.exe
  2⤵
  PID:9592
- C:\Windows\System\hEKFftG.exe
  C:\Windows\System\hEKFftG.exe
  2⤵
  PID:9608
- C:\Windows\System\khtoRWF.exe
  C:\Windows\System\khtoRWF.exe
  2⤵
  PID:9628
- C:\Windows\System\oNLDdYi.exe
  C:\Windows\System\oNLDdYi.exe
  2⤵
  PID:9648
- C:\Windows\System\bBMdIBl.exe
  C:\Windows\System\bBMdIBl.exe
  2⤵
  PID:9672
- C:\Windows\System\wJeOUnv.exe
  C:\Windows\System\wJeOUnv.exe
  2⤵
  PID:9696
- C:\Windows\System\aQbyTYp.exe
  C:\Windows\System\aQbyTYp.exe
  2⤵
  PID:9724
- C:\Windows\System\VhjuBBL.exe
  C:\Windows\System\VhjuBBL.exe
  2⤵
  PID:9744
- C:\Windows\System\cLCPPkb.exe
  C:\Windows\System\cLCPPkb.exe
  2⤵
  PID:9768
- C:\Windows\System\HYvUbNz.exe
  C:\Windows\System\HYvUbNz.exe
  2⤵
  PID:9796
- C:\Windows\System\qZsqNuc.exe
  C:\Windows\System\qZsqNuc.exe
  2⤵
  PID:9812
- C:\Windows\System\otfrnrT.exe
  C:\Windows\System\otfrnrT.exe
  2⤵
  PID:9840
- C:\Windows\System\laelTAD.exe
  C:\Windows\System\laelTAD.exe
  2⤵
  PID:9856
- C:\Windows\System\DrJCOis.exe
  C:\Windows\System\DrJCOis.exe
  2⤵
  PID:9884
- C:\Windows\System\YEPeVPy.exe
  C:\Windows\System\YEPeVPy.exe
  2⤵
  PID:9904
- C:\Windows\System\WmaEJdQ.exe
  C:\Windows\System\WmaEJdQ.exe
  2⤵
  PID:9932
- C:\Windows\System\CNArskw.exe
  C:\Windows\System\CNArskw.exe
  2⤵
  PID:9948
- C:\Windows\System\DvbEvIx.exe
  C:\Windows\System\DvbEvIx.exe
  2⤵
  PID:9972
- C:\Windows\System\pLLjToZ.exe
  C:\Windows\System\pLLjToZ.exe
  2⤵
  PID:9996
- C:\Windows\System\qEecUDS.exe
  C:\Windows\System\qEecUDS.exe
  2⤵
  PID:10012
- C:\Windows\System\jZppYGA.exe
  C:\Windows\System\jZppYGA.exe
  2⤵
  PID:10032
- C:\Windows\System\wAjQcHc.exe
  C:\Windows\System\wAjQcHc.exe
  2⤵
  PID:10052
- C:\Windows\System\topaUSc.exe
  C:\Windows\System\topaUSc.exe
  2⤵
  PID:10072
- C:\Windows\System\xkbDIGq.exe
  C:\Windows\System\xkbDIGq.exe
  2⤵
  PID:10096
- C:\Windows\System\tBTCUXN.exe
  C:\Windows\System\tBTCUXN.exe
  2⤵
  PID:10124
- C:\Windows\System\rqXEvmi.exe
  C:\Windows\System\rqXEvmi.exe
  2⤵
  PID:10156
- C:\Windows\System\mYCBahH.exe
  C:\Windows\System\mYCBahH.exe
  2⤵
  PID:10180
- C:\Windows\System\dktXlmy.exe
  C:\Windows\System\dktXlmy.exe
  2⤵
  PID:10208
- C:\Windows\System\CzUkXVs.exe
  C:\Windows\System\CzUkXVs.exe
  2⤵
  PID:10224
- C:\Windows\System\hlxRTPV.exe
  C:\Windows\System\hlxRTPV.exe
  2⤵
  PID:7728
- C:\Windows\System\YxYxfHV.exe
  C:\Windows\System\YxYxfHV.exe
  2⤵
  PID:9184
- C:\Windows\System\OQemool.exe
  C:\Windows\System\OQemool.exe
  2⤵
  PID:7960
- C:\Windows\System\wmkXWSb.exe
  C:\Windows\System\wmkXWSb.exe
  2⤵
  PID:8112
- C:\Windows\System\RIcJfjX.exe
  C:\Windows\System\RIcJfjX.exe
  2⤵
  PID:8148
- C:\Windows\System\KiBxjHS.exe
  C:\Windows\System\KiBxjHS.exe
  2⤵
  PID:7560
- C:\Windows\System\vgCgxhJ.exe
  C:\Windows\System\vgCgxhJ.exe
  2⤵
  PID:7684
- C:\Windows\System\qQHzYJe.exe
  C:\Windows\System\qQHzYJe.exe
  2⤵
  PID:8216
- C:\Windows\System\QmdXyTx.exe
  C:\Windows\System\QmdXyTx.exe
  2⤵
  PID:5220
- C:\Windows\System\CedLFsm.exe
  C:\Windows\System\CedLFsm.exe
  2⤵
  PID:5604
- C:\Windows\System\YwAjBDF.exe
  C:\Windows\System\YwAjBDF.exe
  2⤵
  PID:1360
- C:\Windows\System\mrvNEEl.exe
  C:\Windows\System\mrvNEEl.exe
  2⤵
  PID:8672
- C:\Windows\System\yBYYSfG.exe
  C:\Windows\System\yBYYSfG.exe
  2⤵
  PID:8572
- C:\Windows\System\lXhmMSg.exe
  C:\Windows\System\lXhmMSg.exe
  2⤵
  PID:7364
- C:\Windows\System\bKNuxzN.exe
  C:\Windows\System\bKNuxzN.exe
  2⤵
  PID:10264
- C:\Windows\System\cAATibF.exe
  C:\Windows\System\cAATibF.exe
  2⤵
  PID:10284
- C:\Windows\System\yTjjdpz.exe
  C:\Windows\System\yTjjdpz.exe
  2⤵
  PID:10300
- C:\Windows\System\jCpvkPm.exe
  C:\Windows\System\jCpvkPm.exe
  2⤵
  PID:10320
- C:\Windows\System\mIMuCwV.exe
  C:\Windows\System\mIMuCwV.exe
  2⤵
  PID:10336
- C:\Windows\System\lMsSORP.exe
  C:\Windows\System\lMsSORP.exe
  2⤵
  PID:10352
- C:\Windows\System\pXEZrOA.exe
  C:\Windows\System\pXEZrOA.exe
  2⤵
  PID:10372
- C:\Windows\System\PlsfLeg.exe
  C:\Windows\System\PlsfLeg.exe
  2⤵
  PID:10392
- C:\Windows\System\aTCSWRd.exe
  C:\Windows\System\aTCSWRd.exe
  2⤵
  PID:10420
- C:\Windows\System\XdBhmMZ.exe
  C:\Windows\System\XdBhmMZ.exe
  2⤵
  PID:10440
- C:\Windows\System\jpXcDla.exe
  C:\Windows\System\jpXcDla.exe
  2⤵
  PID:10464
- C:\Windows\System\EHquWza.exe
  C:\Windows\System\EHquWza.exe
  2⤵
  PID:10488
- C:\Windows\System\CaPpvSy.exe
  C:\Windows\System\CaPpvSy.exe
  2⤵
  PID:10504
- C:\Windows\System\xZQLTMG.exe
  C:\Windows\System\xZQLTMG.exe
  2⤵
  PID:10528
- C:\Windows\System\xADmVfP.exe
  C:\Windows\System\xADmVfP.exe
  2⤵
  PID:10552
- C:\Windows\System\HMnbAKU.exe
  C:\Windows\System\HMnbAKU.exe
  2⤵
  PID:10580
- C:\Windows\System\XKAntAX.exe
  C:\Windows\System\XKAntAX.exe
  2⤵
  PID:10604
- C:\Windows\System\rlMCSAQ.exe
  C:\Windows\System\rlMCSAQ.exe
  2⤵
  PID:10628
- C:\Windows\System\WWTUwTS.exe
  C:\Windows\System\WWTUwTS.exe
  2⤵
  PID:10648
- C:\Windows\System\OuJITaQ.exe
  C:\Windows\System\OuJITaQ.exe
  2⤵
  PID:10672
- C:\Windows\System\sUZngce.exe
  C:\Windows\System\sUZngce.exe
  2⤵
  PID:10700
- C:\Windows\System\DraumZk.exe
  C:\Windows\System\DraumZk.exe
  2⤵
  PID:10720
- C:\Windows\System\IsLBaaT.exe
  C:\Windows\System\IsLBaaT.exe
  2⤵
  PID:10740
- C:\Windows\System\VSFgBDr.exe
  C:\Windows\System\VSFgBDr.exe
  2⤵
  PID:10764
- C:\Windows\System\MRYwvdh.exe
  C:\Windows\System\MRYwvdh.exe
  2⤵
  PID:10792
- C:\Windows\System\xxEejLm.exe
  C:\Windows\System\xxEejLm.exe
  2⤵
  PID:10816
- C:\Windows\System\qPegVNT.exe
  C:\Windows\System\qPegVNT.exe
  2⤵
  PID:10840
- C:\Windows\System\YeOcXiT.exe
  C:\Windows\System\YeOcXiT.exe
  2⤵
  PID:10856
- C:\Windows\System\MGxKUHx.exe
  C:\Windows\System\MGxKUHx.exe
  2⤵
  PID:10880
- C:\Windows\System\OPmOxQs.exe
  C:\Windows\System\OPmOxQs.exe
  2⤵
  PID:10900
- C:\Windows\System\hsVyyeo.exe
  C:\Windows\System\hsVyyeo.exe
  2⤵
  PID:10924
- C:\Windows\System\xtgofal.exe
  C:\Windows\System\xtgofal.exe
  2⤵
  PID:10940
- C:\Windows\System\KvwIHPp.exe
  C:\Windows\System\KvwIHPp.exe
  2⤵
  PID:10964
- C:\Windows\System\rxpQLKG.exe
  C:\Windows\System\rxpQLKG.exe
  2⤵
  PID:11000
- C:\Windows\System\jjgaALm.exe
  C:\Windows\System\jjgaALm.exe
  2⤵
  PID:11036
- C:\Windows\System\InCKVOs.exe
  C:\Windows\System\InCKVOs.exe
  2⤵
  PID:11052
- C:\Windows\System\TaBDref.exe
  C:\Windows\System\TaBDref.exe
  2⤵
  PID:11080
- C:\Windows\System\YWIjvZM.exe
  C:\Windows\System\YWIjvZM.exe
  2⤵
  PID:11104
- C:\Windows\System\lGQiLow.exe
  C:\Windows\System\lGQiLow.exe
  2⤵
  PID:11124
- C:\Windows\System\EUwiIVD.exe
  C:\Windows\System\EUwiIVD.exe
  2⤵
  PID:11152
- C:\Windows\System\mjYgglE.exe
  C:\Windows\System\mjYgglE.exe
  2⤵
  PID:11168
- C:\Windows\System\FFFKCNw.exe
  C:\Windows\System\FFFKCNw.exe
  2⤵
  PID:11196
- C:\Windows\System\LoBhlCc.exe
  C:\Windows\System\LoBhlCc.exe
  2⤵
  PID:11216
- C:\Windows\System\SdrJysj.exe
  C:\Windows\System\SdrJysj.exe
  2⤵
  PID:11236
- C:\Windows\System\BUvynDg.exe
  C:\Windows\System\BUvynDg.exe
  2⤵
  PID:11256
- C:\Windows\System\MrQjNed.exe
  C:\Windows\System\MrQjNed.exe
  2⤵
  PID:8964
- C:\Windows\System\DoYfKuU.exe
  C:\Windows\System\DoYfKuU.exe
  2⤵
  PID:9224
- C:\Windows\System\zVxXhFe.exe
  C:\Windows\System\zVxXhFe.exe
  2⤵
  PID:8996
- C:\Windows\System\rOggRkE.exe
  C:\Windows\System\rOggRkE.exe
  2⤵
  PID:9320
- C:\Windows\System\jJmxheF.exe
  C:\Windows\System\jJmxheF.exe
  2⤵
  PID:9452
- C:\Windows\System\uYhsDQG.exe
  C:\Windows\System\uYhsDQG.exe
  2⤵
  PID:9156
- C:\Windows\System\MwcEyLG.exe
  C:\Windows\System\MwcEyLG.exe
  2⤵
  PID:11020
- C:\Windows\System\ZpExPqF.exe
  C:\Windows\System\ZpExPqF.exe
  2⤵
  PID:11044
- C:\Windows\System\xFTADFZ.exe
  C:\Windows\System\xFTADFZ.exe
  2⤵
  PID:11140
- C:\Windows\System\UsjEXlB.exe
  C:\Windows\System\UsjEXlB.exe
  2⤵
  PID:11204
- C:\Windows\System\BFiIuWX.exe
  C:\Windows\System\BFiIuWX.exe
  2⤵
  PID:9752
- C:\Windows\System\cpaButI.exe
  C:\Windows\System\cpaButI.exe
  2⤵
  PID:6644
- C:\Windows\System\OqKmmDS.exe
  C:\Windows\System\OqKmmDS.exe
  2⤵
  PID:9328
- C:\Windows\System\akGUlkf.exe
  C:\Windows\System\akGUlkf.exe
  2⤵
  PID:10044
- C:\Windows\System\YwFyWzB.exe
  C:\Windows\System\YwFyWzB.exe
  2⤵
  PID:10088
- C:\Windows\System\wiDvOiK.exe
  C:\Windows\System\wiDvOiK.exe
  2⤵
  PID:10140
- C:\Windows\System\EyOCabP.exe
  C:\Windows\System\EyOCabP.exe
  2⤵
  PID:9532
- C:\Windows\System\OvmCYnL.exe
  C:\Windows\System\OvmCYnL.exe
  2⤵
  PID:7496
- C:\Windows\System\GihlzqX.exe
  C:\Windows\System\GihlzqX.exe
  2⤵
  PID:8244
- C:\Windows\System\kozevAd.exe
  C:\Windows\System\kozevAd.exe
  2⤵
  PID:9656
- C:\Windows\System\DDngnGt.exe
  C:\Windows\System\DDngnGt.exe
  2⤵
  PID:11276
- C:\Windows\System\SOWVeSi.exe
  C:\Windows\System\SOWVeSi.exe
  2⤵
  PID:11296
- C:\Windows\System\JXTbPtk.exe
  C:\Windows\System\JXTbPtk.exe
  2⤵
  PID:11320
- C:\Windows\System\xrHHXdB.exe
  C:\Windows\System\xrHHXdB.exe
  2⤵
  PID:11340
- C:\Windows\System\zXpSfcx.exe
  C:\Windows\System\zXpSfcx.exe
  2⤵
  PID:11368
- C:\Windows\System\zPaNgcd.exe
  C:\Windows\System\zPaNgcd.exe
  2⤵
  PID:11388
- C:\Windows\System\cDbFBsp.exe
  C:\Windows\System\cDbFBsp.exe
  2⤵
  PID:11408
- C:\Windows\System\vMzaRWT.exe
  C:\Windows\System\vMzaRWT.exe
  2⤵
  PID:11432
- C:\Windows\System\zTsCGKs.exe
  C:\Windows\System\zTsCGKs.exe
  2⤵
  PID:11448
- C:\Windows\System\DCHUKNZ.exe
  C:\Windows\System\DCHUKNZ.exe
  2⤵
  PID:11472
- C:\Windows\System\sfVMVdI.exe
  C:\Windows\System\sfVMVdI.exe
  2⤵
  PID:11512
- C:\Windows\System\TztHbdY.exe
  C:\Windows\System\TztHbdY.exe
  2⤵
  PID:11532
- C:\Windows\System\zXwFRCi.exe
  C:\Windows\System\zXwFRCi.exe
  2⤵
  PID:11548
- C:\Windows\System\jsDZThA.exe
  C:\Windows\System\jsDZThA.exe
  2⤵
  PID:11564
- C:\Windows\System\GDKasCj.exe
  C:\Windows\System\GDKasCj.exe
  2⤵
  PID:11580
- C:\Windows\System\xRHPGur.exe
  C:\Windows\System\xRHPGur.exe
  2⤵
  PID:11596
- C:\Windows\System\JzKlxSO.exe
  C:\Windows\System\JzKlxSO.exe
  2⤵
  PID:11612
- C:\Windows\System\qXyUMbA.exe
  C:\Windows\System\qXyUMbA.exe
  2⤵
  PID:11628
- C:\Windows\System\cLHgglM.exe
  C:\Windows\System\cLHgglM.exe
  2⤵
  PID:11644
- C:\Windows\System\ajKnjqL.exe
  C:\Windows\System\ajKnjqL.exe
  2⤵
  PID:11660
- C:\Windows\System\ZnDjhSI.exe
  C:\Windows\System\ZnDjhSI.exe
  2⤵
  PID:11676
- C:\Windows\System\zoiCHEr.exe
  C:\Windows\System\zoiCHEr.exe
  2⤵
  PID:11692
- C:\Windows\System\ZioeWXG.exe
  C:\Windows\System\ZioeWXG.exe
  2⤵
  PID:11708
- C:\Windows\System\LILJmAw.exe
  C:\Windows\System\LILJmAw.exe
  2⤵
  PID:11728
- C:\Windows\System\kEVNQHe.exe
  C:\Windows\System\kEVNQHe.exe
  2⤵
  PID:11752
- C:\Windows\System\VdpFnrQ.exe
  C:\Windows\System\VdpFnrQ.exe
  2⤵
  PID:11776
- C:\Windows\System\uUiGliI.exe
  C:\Windows\System\uUiGliI.exe
  2⤵
  PID:11800
- C:\Windows\System\hwStnFN.exe
  C:\Windows\System\hwStnFN.exe
  2⤵
  PID:11828
- C:\Windows\System\iBhYDPC.exe
  C:\Windows\System\iBhYDPC.exe
  2⤵
  PID:11852
- C:\Windows\System\WgVIbYc.exe
  C:\Windows\System\WgVIbYc.exe
  2⤵
  PID:11876
- C:\Windows\System\lnMlmBB.exe
  C:\Windows\System\lnMlmBB.exe
  2⤵
  PID:11904
- C:\Windows\System\HsTiBFH.exe
  C:\Windows\System\HsTiBFH.exe
  2⤵
  PID:11928
- C:\Windows\System\uoxHWOj.exe
  C:\Windows\System\uoxHWOj.exe
  2⤵
  PID:11948
- C:\Windows\System\WViOJtt.exe
  C:\Windows\System\WViOJtt.exe
  2⤵
  PID:11984
- C:\Windows\System\givrPMx.exe
  C:\Windows\System\givrPMx.exe
  2⤵
  PID:12012
- C:\Windows\System\hvHxUbD.exe
  C:\Windows\System\hvHxUbD.exe
  2⤵
  PID:12048
- C:\Windows\System\DWqieKF.exe
  C:\Windows\System\DWqieKF.exe
  2⤵
  PID:12064
- C:\Windows\System\nlmVqae.exe
  C:\Windows\System\nlmVqae.exe
  2⤵
  PID:12088
- C:\Windows\System\mnkHINv.exe
  C:\Windows\System\mnkHINv.exe
  2⤵
  PID:12116
- C:\Windows\System\NKToqou.exe
  C:\Windows\System\NKToqou.exe
  2⤵
  PID:12136
- C:\Windows\System\norwhSG.exe
  C:\Windows\System\norwhSG.exe
  2⤵
  PID:12160
- C:\Windows\System\ofJcicB.exe
  C:\Windows\System\ofJcicB.exe
  2⤵
  PID:12184
- C:\Windows\System\LOLmazb.exe
  C:\Windows\System\LOLmazb.exe
  2⤵
  PID:12224
- C:\Windows\System\EylEdEs.exe
  C:\Windows\System\EylEdEs.exe
  2⤵
  PID:12240
- C:\Windows\System\JAHrulq.exe
  C:\Windows\System\JAHrulq.exe
  2⤵
  PID:12264
- C:\Windows\System\bWiuEGh.exe
  C:\Windows\System\bWiuEGh.exe
  2⤵
  PID:6044
- C:\Windows\System\ajPLRtr.exe
  C:\Windows\System\ajPLRtr.exe
  2⤵
  PID:8568
- C:\Windows\System\dtwuvXW.exe
  C:\Windows\System\dtwuvXW.exe
  2⤵
  PID:2580
- C:\Windows\System\NLlftJQ.exe
  C:\Windows\System\NLlftJQ.exe
  2⤵
  PID:7264
- C:\Windows\System\JwwxYct.exe
  C:\Windows\System\JwwxYct.exe
  2⤵
  PID:10472
- C:\Windows\System\wCYsitd.exe
  C:\Windows\System\wCYsitd.exe
  2⤵
  PID:10576
- C:\Windows\System\uzRCNgz.exe
  C:\Windows\System\uzRCNgz.exe
  2⤵
  PID:10668
- C:\Windows\System\gaZwgAF.exe
  C:\Windows\System\gaZwgAF.exe
  2⤵
  PID:9296
- C:\Windows\System\fUmnlEX.exe
  C:\Windows\System\fUmnlEX.exe
  2⤵
  PID:10848
- C:\Windows\System\CJGGtkc.exe
  C:\Windows\System\CJGGtkc.exe
  2⤵
  PID:10912
- C:\Windows\System\SFbjEza.exe
  C:\Windows\System\SFbjEza.exe
  2⤵
  PID:10976
- C:\Windows\System\WYOVxqh.exe
  C:\Windows\System\WYOVxqh.exe
  2⤵
  PID:9588
- C:\Windows\System\bnvcBAu.exe
  C:\Windows\System\bnvcBAu.exe
  2⤵
  PID:8920
- C:\Windows\System\aNpzZIU.exe
  C:\Windows\System\aNpzZIU.exe
  2⤵
  PID:12316
- C:\Windows\System\qBZlmSc.exe
  C:\Windows\System\qBZlmSc.exe
  2⤵
  PID:12340
- C:\Windows\System\HfllkHR.exe
  C:\Windows\System\HfllkHR.exe
  2⤵
  PID:12364
- C:\Windows\System\mQgIAUX.exe
  C:\Windows\System\mQgIAUX.exe
  2⤵
  PID:12388
- C:\Windows\System\JzAjNpO.exe
  C:\Windows\System\JzAjNpO.exe
  2⤵
  PID:12408
- C:\Windows\System\GdXBrLM.exe
  C:\Windows\System\GdXBrLM.exe
  2⤵
  PID:12432
- C:\Windows\System\hWPSWOY.exe
  C:\Windows\System\hWPSWOY.exe
  2⤵
  PID:12456
- C:\Windows\System\vTTGMPi.exe
  C:\Windows\System\vTTGMPi.exe
  2⤵
  PID:12476
- C:\Windows\System\vYGBwto.exe
  C:\Windows\System\vYGBwto.exe
  2⤵
  PID:12496
- C:\Windows\System\DfRilSm.exe
  C:\Windows\System\DfRilSm.exe
  2⤵
  PID:12524
- C:\Windows\System\wHdQonI.exe
  C:\Windows\System\wHdQonI.exe
  2⤵
  PID:12544
- C:\Windows\System\lmNeYaA.exe
  C:\Windows\System\lmNeYaA.exe
  2⤵
  PID:12568
- C:\Windows\System\yXVVoDL.exe
  C:\Windows\System\yXVVoDL.exe
  2⤵
  PID:12596
- C:\Windows\System\NtAHCUI.exe
  C:\Windows\System\NtAHCUI.exe
  2⤵
  PID:12620
- C:\Windows\System\jwpoppK.exe
  C:\Windows\System\jwpoppK.exe
  2⤵
  PID:12636
- C:\Windows\System\pdNupZY.exe
  C:\Windows\System\pdNupZY.exe
  2⤵
  PID:12664
- C:\Windows\System\JAVCZhM.exe
  C:\Windows\System\JAVCZhM.exe
  2⤵
  PID:12688
- C:\Windows\System\zlFcwgW.exe
  C:\Windows\System\zlFcwgW.exe
  2⤵
  PID:12712
- C:\Windows\System\mCfSqBY.exe
  C:\Windows\System\mCfSqBY.exe
  2⤵
  PID:12732
- C:\Windows\System\lEPwEFV.exe
  C:\Windows\System\lEPwEFV.exe
  2⤵
  PID:12748
- C:\Windows\System\IszkTqA.exe
  C:\Windows\System\IszkTqA.exe
  2⤵
  PID:12764
- C:\Windows\System\UTPjdyG.exe
  C:\Windows\System\UTPjdyG.exe
  2⤵
  PID:12780
- C:\Windows\System\DROFGur.exe
  C:\Windows\System\DROFGur.exe
  2⤵
  PID:12796
- C:\Windows\System\UypidTb.exe
  C:\Windows\System\UypidTb.exe
  2⤵
  PID:12816
- C:\Windows\System\OrHhnmj.exe
  C:\Windows\System\OrHhnmj.exe
  2⤵
  PID:12832
- C:\Windows\System\uEnqtgJ.exe
  C:\Windows\System\uEnqtgJ.exe
  2⤵
  PID:12848
- C:\Windows\System\JVmqcbC.exe
  C:\Windows\System\JVmqcbC.exe
  2⤵
  PID:12864
- C:\Windows\System\ngiTiQm.exe
  C:\Windows\System\ngiTiQm.exe
  2⤵
  PID:12880
- C:\Windows\System\HHlrfDa.exe
  C:\Windows\System\HHlrfDa.exe
  2⤵
  PID:12896
- C:\Windows\System\zSbLAFa.exe
  C:\Windows\System\zSbLAFa.exe
  2⤵
  PID:12916
- C:\Windows\System\WMzwnNB.exe
  C:\Windows\System\WMzwnNB.exe
  2⤵
  PID:12940
- C:\Windows\System\jGLAsNW.exe
  C:\Windows\System\jGLAsNW.exe
  2⤵
  PID:12960
- C:\Windows\System\vxPFaHN.exe
  C:\Windows\System\vxPFaHN.exe
  2⤵
  PID:12980
- C:\Windows\System\IIKuZeB.exe
  C:\Windows\System\IIKuZeB.exe
  2⤵
  PID:13000
- C:\Windows\System\dUDdaKJ.exe
  C:\Windows\System\dUDdaKJ.exe
  2⤵
  PID:13024
- C:\Windows\System\QoOOWsc.exe
  C:\Windows\System\QoOOWsc.exe
  2⤵
  PID:13044
- C:\Windows\System\DKSUYEV.exe
  C:\Windows\System\DKSUYEV.exe
  2⤵
  PID:13068
- C:\Windows\System\YSbsqJM.exe
  C:\Windows\System\YSbsqJM.exe
  2⤵
  PID:13092
- C:\Windows\System\gHOjePI.exe
  C:\Windows\System\gHOjePI.exe
  2⤵
  PID:13116
- C:\Windows\System\vYrIWGO.exe
  C:\Windows\System\vYrIWGO.exe
  2⤵
  PID:13136
- C:\Windows\System\QUNRPOl.exe
  C:\Windows\System\QUNRPOl.exe
  2⤵
  PID:13160
- C:\Windows\System\CTBqiAI.exe
  C:\Windows\System\CTBqiAI.exe
  2⤵
  PID:13184
- C:\Windows\System\RPoINTn.exe
  C:\Windows\System\RPoINTn.exe
  2⤵
  PID:13208
- C:\Windows\System\Rkttexn.exe
  C:\Windows\System\Rkttexn.exe
  2⤵
  PID:13232
- C:\Windows\System\BDInhZL.exe
  C:\Windows\System\BDInhZL.exe
  2⤵
  PID:13252
- C:\Windows\System\VMPWepa.exe
  C:\Windows\System\VMPWepa.exe
  2⤵
  PID:13272
- C:\Windows\System\MSjtnNQ.exe
  C:\Windows\System\MSjtnNQ.exe
  2⤵
  PID:12584
- C:\Windows\System\bkSaSYb.exe
  C:\Windows\System\bkSaSYb.exe
  2⤵
  PID:12696
- C:\Windows\System\NuDppcJ.exe
  C:\Windows\System\NuDppcJ.exe
  2⤵
  PID:12776
- C:\Windows\System\exTqFYE.exe
  C:\Windows\System\exTqFYE.exe
  2⤵
  PID:12872
- C:\Windows\System\DKtLvQI.exe
  C:\Windows\System\DKtLvQI.exe
  2⤵
  PID:12912
- C:\Windows\System\tmdTrLM.exe
  C:\Windows\System\tmdTrLM.exe
  2⤵
  PID:13076
- C:\Windows\System\wIyPwBC.exe
  C:\Windows\System\wIyPwBC.exe
  2⤵
  PID:11304
- C:\Windows\System\IBtEIqR.exe
  C:\Windows\System\IBtEIqR.exe
  2⤵
  PID:13200
- C:\Windows\System\rZIKlaX.exe
  C:\Windows\System\rZIKlaX.exe
  2⤵
  PID:13268
- C:\Windows\System\HVAUzLG.exe
  C:\Windows\System\HVAUzLG.exe
  2⤵
  PID:13308
- C:\Windows\System\ZaEGqSu.exe
  C:\Windows\System\ZaEGqSu.exe
  2⤵
  PID:9836
- C:\Windows\System\IBsOIbZ.exe
  C:\Windows\System\IBsOIbZ.exe
  2⤵
  PID:9956
- C:\Windows\System\EsYsnKh.exe
  C:\Windows\System\EsYsnKh.exe
  2⤵
  PID:10024
- C:\Windows\System\uSfUXvN.exe
  C:\Windows\System\uSfUXvN.exe
  2⤵
  PID:11944
- C:\Windows\System\kazSyUv.exe
  C:\Windows\System\kazSyUv.exe
  2⤵
  PID:3592
- C:\Windows\System\TNghRvF.exe
  C:\Windows\System\TNghRvF.exe
  2⤵
  PID:8820
- C:\Windows\System\ZVEREAW.exe
  C:\Windows\System\ZVEREAW.exe
  2⤵
  PID:10588
- C:\Windows\System\HswvQbu.exe
  C:\Windows\System\HswvQbu.exe
  2⤵
  PID:12536
- C:\Windows\System\KpJGuLx.exe
  C:\Windows\System\KpJGuLx.exe
  2⤵
  PID:9560
- C:\Windows\System\rGHMoyi.exe
  C:\Windows\System\rGHMoyi.exe
  2⤵
  PID:7064
- C:\Windows\System\xXoqapW.exe
  C:\Windows\System\xXoqapW.exe
  2⤵
  PID:692
- C:\Windows\System\IaqIuxJ.exe
  C:\Windows\System\IaqIuxJ.exe
  2⤵
  PID:8416
- C:\Windows\System\TFxIOnK.exe
  C:\Windows\System\TFxIOnK.exe
  2⤵
  PID:11360
- C:\Windows\System\FATCSdr.exe
  C:\Windows\System\FATCSdr.exe
  2⤵
  PID:11468
- C:\Windows\System\UlqHqmV.exe
  C:\Windows\System\UlqHqmV.exe
  2⤵
  PID:11572
- C:\Windows\System\uLKOUjr.exe
  C:\Windows\System\uLKOUjr.exe
  2⤵
  PID:11740
- C:\Windows\System\QHHHYdb.exe
  C:\Windows\System\QHHHYdb.exe
  2⤵
  PID:11796
- C:\Windows\System\fjhZSbP.exe
  C:\Windows\System\fjhZSbP.exe
  2⤵
  PID:11896
- C:\Windows\System\lmJDBWI.exe
  C:\Windows\System\lmJDBWI.exe
  2⤵
  PID:11972
- C:\Windows\System\FJWcuos.exe
  C:\Windows\System\FJWcuos.exe
  2⤵
  PID:12044
- C:\Windows\System\gnNeAha.exe
  C:\Windows\System\gnNeAha.exe
  2⤵
  PID:12096
- C:\Windows\System\nfeTHDs.exe
  C:\Windows\System\nfeTHDs.exe
  2⤵
  PID:6704
- C:\Windows\System\otZMEgP.exe
  C:\Windows\System\otZMEgP.exe
  2⤵
  PID:11288
- C:\Windows\System\PQdkenE.exe
  C:\Windows\System\PQdkenE.exe
  2⤵
  PID:11416
- C:\Windows\System\TCUQPBz.exe
  C:\Windows\System\TCUQPBz.exe
  2⤵
  PID:12144
- C:\Windows\System\fuVwKyI.exe
  C:\Windows\System\fuVwKyI.exe
  2⤵
  PID:12252
- C:\Windows\System\DBlYouy.exe
  C:\Windows\System\DBlYouy.exe
  2⤵
  PID:3576
- C:\Windows\System\AlEsClo.exe
  C:\Windows\System\AlEsClo.exe
  2⤵
  PID:10876
- C:\Windows\System\tjZXaIm.exe
  C:\Windows\System\tjZXaIm.exe
  2⤵
  PID:10960
- C:\Windows\System\DpflzmF.exe
  C:\Windows\System\DpflzmF.exe
  2⤵
  PID:12504
- C:\Windows\System\aRSgXfs.exe
  C:\Windows\System\aRSgXfs.exe
  2⤵
  PID:12676
- C:\Windows\System\kUgCETP.exe
  C:\Windows\System\kUgCETP.exe
  2⤵
  PID:12760
- C:\Windows\System\boxSQZe.exe
  C:\Windows\System\boxSQZe.exe
  2⤵
  PID:11524
- C:\Windows\System\ZGgEugv.exe
  C:\Windows\System\ZGgEugv.exe
  2⤵
  PID:13052
- C:\Windows\System\UHkFhOh.exe
  C:\Windows\System\UHkFhOh.exe
  2⤵
  PID:13168
- C:\Windows\System\qHAyyTN.exe
  C:\Windows\System\qHAyyTN.exe
  2⤵
  PID:9864
- C:\Windows\System\uZCkhkf.exe
  C:\Windows\System\uZCkhkf.exe
  2⤵
  PID:400
- C:\Windows\System\PMocaom.exe
  C:\Windows\System\PMocaom.exe
  2⤵
  PID:9168
- C:\Windows\System\NJQeTAR.exe
  C:\Windows\System\NJQeTAR.exe
  2⤵
  PID:12132
- C:\Windows\System\fpmTAwu.exe
  C:\Windows\System\fpmTAwu.exe
  2⤵
  PID:2736
- C:\Windows\System\Prdurdv.exe
  C:\Windows\System\Prdurdv.exe
  2⤵
  PID:1908
- C:\Windows\System\cENhfNA.exe
  C:\Windows\System\cENhfNA.exe
  2⤵
  PID:11688
- C:\Windows\System\yTkPuCc.exe
  C:\Windows\System\yTkPuCc.exe
  2⤵
  PID:10204
- C:\Windows\System\auTgbyT.exe
  C:\Windows\System\auTgbyT.exe
  2⤵
  PID:10544
- C:\Windows\System\jAuWYla.exe
  C:\Windows\System\jAuWYla.exe
  2⤵
  PID:12192
- C:\Windows\System\OooEsLe.exe
  C:\Windows\System\OooEsLe.exe
  2⤵
  PID:11860
- C:\Windows\System\ofmmRST.exe
  C:\Windows\System\ofmmRST.exe
  2⤵
  PID:11332
- C:\Windows\System\HTIjYrp.exe
  C:\Windows\System\HTIjYrp.exe
  2⤵
  PID:12860
- C:\Windows\System\TJQTrHR.exe
  C:\Windows\System\TJQTrHR.exe
  2⤵
  PID:1640
- C:\Windows\System\ziYzrTy.exe
  C:\Windows\System\ziYzrTy.exe
  2⤵
  PID:6376
- C:\Windows\System\RgPLzQM.exe
  C:\Windows\System\RgPLzQM.exe
  2⤵
  PID:9556
- C:\Windows\System\wSyvFnx.exe
  C:\Windows\System\wSyvFnx.exe
  2⤵
  PID:11668
- C:\Windows\System\WKngsWo.exe
  C:\Windows\System\WKngsWo.exe
  2⤵
  PID:4600
- C:\Windows\System\ixATEKw.exe
  C:\Windows\System\ixATEKw.exe
  2⤵
  PID:8900
- C:\Windows\System\hAMxQJt.exe
  C:\Windows\System\hAMxQJt.exe
  2⤵
  PID:12352
- C:\Windows\System\LEcguZN.exe
  C:\Windows\System\LEcguZN.exe
  2⤵
  PID:10408
- C:\Windows\System\gylByYm.exe
  C:\Windows\System\gylByYm.exe
  2⤵
  PID:12828
- C:\Windows\System\cpNlxGd.exe
  C:\Windows\System\cpNlxGd.exe
  2⤵
  PID:9624
- C:\Windows\System\UZokCBY.exe
  C:\Windows\System\UZokCBY.exe
  2⤵
  PID:13132
- C:\Windows\System\LSYotAg.exe
  C:\Windows\System\LSYotAg.exe
  2⤵
  PID:6532
- C:\Windows\System\XSDfEVQ.exe
  C:\Windows\System\XSDfEVQ.exe
  2⤵
  PID:8856
- C:\Windows\System\lpngGZT.exe
  C:\Windows\System\lpngGZT.exe
  2⤵
  PID:4656
- C:\Windows\System\XjTbZcY.exe
  C:\Windows\System\XjTbZcY.exe
  2⤵
  PID:12000
- C:\Windows\System\WlTSXRF.exe
  C:\Windows\System\WlTSXRF.exe
  2⤵
  PID:10484
- C:\Windows\System\BfXxCPo.exe
  C:\Windows\System\BfXxCPo.exe
  2⤵
  PID:2784
- C:\Windows\System\Ojownpc.exe
  C:\Windows\System\Ojownpc.exe
  2⤵
  PID:1124
- C:\Windows\System\Tohhlaw.exe
  C:\Windows\System\Tohhlaw.exe
  2⤵
  PID:4704
- C:\Windows\System\rJHzDeW.exe
  C:\Windows\System\rJHzDeW.exe
  2⤵
  PID:3768
- C:\Windows\System\UreoGDT.exe
  C:\Windows\System\UreoGDT.exe
  2⤵
  PID:11920
- C:\Windows\System\EwXiLvq.exe
  C:\Windows\System\EwXiLvq.exe
  2⤵
  PID:9360
- C:\Windows\System\qpOQdvB.exe
  C:\Windows\System\qpOQdvB.exe
  2⤵
  PID:11380
- C:\Windows\System\ZKvBihB.exe
  C:\Windows\System\ZKvBihB.exe
  2⤵
  PID:1580
- C:\Windows\System\dtuqBGr.exe
  C:\Windows\System\dtuqBGr.exe
  2⤵
  PID:4612
- C:\Windows\System\QjwKjRX.exe
  C:\Windows\System\QjwKjRX.exe
  2⤵
  PID:4524
- C:\Windows\System\GMJVAMo.exe
  C:\Windows\System\GMJVAMo.exe
  2⤵
  PID:7196
- C:\Windows\System\AHjIGTr.exe
  C:\Windows\System\AHjIGTr.exe
  2⤵
  PID:13176
- C:\Windows\System\hKdtDDc.exe
  C:\Windows\System\hKdtDDc.exe
  2⤵
  PID:11308
- C:\Windows\System\LyBzojQ.exe
  C:\Windows\System\LyBzojQ.exe
  2⤵
  PID:12492
- C:\Windows\System\paqfWHm.exe
  C:\Windows\System\paqfWHm.exe
  2⤵
  PID:12148
- C:\Windows\System\ABasWaY.exe
  C:\Windows\System\ABasWaY.exe
  2⤵
  PID:4644
- C:\Windows\System\WMYCamZ.exe
  C:\Windows\System\WMYCamZ.exe
  2⤵
  PID:5060
- C:\Windows\System\rUhxXsM.exe
  C:\Windows\System\rUhxXsM.exe
  2⤵
  PID:10448
- C:\Windows\System\GBNPlCR.exe
  C:\Windows\System\GBNPlCR.exe
  2⤵
  PID:4728
- C:\Windows\System\aOcYPdc.exe
  C:\Windows\System\aOcYPdc.exe
  2⤵
  PID:1624
- C:\Windows\System\MFjykNA.exe
  C:\Windows\System\MFjykNA.exe
  2⤵
  PID:13320
- C:\Windows\System\SuJsNtM.exe
  C:\Windows\System\SuJsNtM.exe
  2⤵
  PID:13384
- C:\Windows\System\HoSLjjH.exe
  C:\Windows\System\HoSLjjH.exe
  2⤵
  PID:13420
- C:\Windows\System\BBPOpcP.exe
  C:\Windows\System\BBPOpcP.exe
  2⤵
  PID:13468
- C:\Windows\System\GaDYGdh.exe
  C:\Windows\System\GaDYGdh.exe
  2⤵
  PID:13508
- C:\Windows\System\DdprKxj.exe
  C:\Windows\System\DdprKxj.exe
  2⤵
  PID:13680
- C:\Windows\System\uPgDLRt.exe
  C:\Windows\System\uPgDLRt.exe
  2⤵
  PID:13700
- C:\Windows\System\IIoTPpW.exe
  C:\Windows\System\IIoTPpW.exe
  2⤵
  PID:13724
- C:\Windows\System\jArEpGl.exe
  C:\Windows\System\jArEpGl.exe
  2⤵
  PID:13744
- C:\Windows\System\fkirStL.exe
  C:\Windows\System\fkirStL.exe
  2⤵
  PID:13760
- C:\Windows\System\DolNzjy.exe
  C:\Windows\System\DolNzjy.exe
  2⤵
  PID:13776
- C:\Windows\System\JotAEpg.exe
  C:\Windows\System\JotAEpg.exe
  2⤵
  PID:13800
- C:\Windows\System\vyWykcj.exe
  C:\Windows\System\vyWykcj.exe
  2⤵
  PID:13988
- C:\Windows\System\SATtJuF.exe
  C:\Windows\System\SATtJuF.exe
  2⤵
  PID:14004
- C:\Windows\System\GHMnAsr.exe
  C:\Windows\System\GHMnAsr.exe
  2⤵
  PID:14028
- C:\Windows\System\ahAduiW.exe
  C:\Windows\System\ahAduiW.exe
  2⤵
  PID:14052
- C:\Windows\System\vWeITzA.exe
  C:\Windows\System\vWeITzA.exe
  2⤵
  PID:14156
- C:\Windows\System\ibXSPpL.exe
  C:\Windows\System\ibXSPpL.exe
  2⤵
  PID:14176
- C:\Windows\System\fFaQEgh.exe
  C:\Windows\System\fFaQEgh.exe
  2⤵
  PID:14228
- C:\Windows\System\GbRGYrV.exe
  C:\Windows\System\GbRGYrV.exe
  2⤵
  PID:14248
- C:\Windows\System\tRcrhMU.exe
  C:\Windows\System\tRcrhMU.exe
  2⤵
  PID:14272
- C:\Windows\System\vVNXjDf.exe
  C:\Windows\System\vVNXjDf.exe
  2⤵
  PID:14292
- C:\Windows\System\xonKLyu.exe
  C:\Windows\System\xonKLyu.exe
  2⤵
  PID:14328
- C:\Windows\System\YruMDQq.exe
  C:\Windows\System\YruMDQq.exe
  2⤵
  PID:5728
- C:\Windows\System\OjkDEFK.exe
  C:\Windows\System\OjkDEFK.exe
  2⤵
  PID:13336
- C:\Windows\System\pQMPtAg.exe
  C:\Windows\System\pQMPtAg.exe
  2⤵
  PID:10380
- C:\Windows\System\BEfRvfK.exe
  C:\Windows\System\BEfRvfK.exe
  2⤵
  PID:12084
- C:\Windows\System\MUMIotF.exe
  C:\Windows\System\MUMIotF.exe
  2⤵
  PID:13480
- C:\Windows\System\LOHcMLl.exe
  C:\Windows\System\LOHcMLl.exe
  2⤵
  PID:13392
- C:\Windows\System\eboIMFJ.exe
  C:\Windows\System\eboIMFJ.exe
  2⤵
  PID:13484
- C:\Windows\System\VwBdsvh.exe
  C:\Windows\System\VwBdsvh.exe
  2⤵
  PID:1844
- C:\Windows\System\NXtyMMh.exe
  C:\Windows\System\NXtyMMh.exe
  2⤵
  PID:13332
- C:\Windows\System\RctMhyJ.exe
  C:\Windows\System\RctMhyJ.exe
  2⤵
  PID:13440
- C:\Windows\System\AKkBhwR.exe
  C:\Windows\System\AKkBhwR.exe
  2⤵
  PID:5340
- C:\Windows\System\epqlUfr.exe
  C:\Windows\System\epqlUfr.exe
  2⤵
  PID:3684
- C:\Windows\System\lJLUnnS.exe
  C:\Windows\System\lJLUnnS.exe
  2⤵
  PID:11824
- C:\Windows\System\KVtqPgo.exe
  C:\Windows\System\KVtqPgo.exe
  2⤵
  PID:9500
- C:\Windows\System\lsqtaAs.exe
  C:\Windows\System\lsqtaAs.exe
  2⤵
  PID:13648
- C:\Windows\System\muePHot.exe
  C:\Windows\System\muePHot.exe
  2⤵
  PID:1856
- C:\Windows\System\rxwgWYc.exe
  C:\Windows\System\rxwgWYc.exe
  2⤵
  PID:14136
- C:\Windows\System\PddpWvW.exe
  C:\Windows\System\PddpWvW.exe
  2⤵
  PID:13732
- C:\Windows\System\lboUFkt.exe
  C:\Windows\System\lboUFkt.exe
  2⤵
  PID:13792
- C:\Windows\System\oDYfqbw.exe
  C:\Windows\System\oDYfqbw.exe
  2⤵
  PID:13876
- C:\Windows\System\ZEwJCye.exe
  C:\Windows\System\ZEwJCye.exe
  2⤵
  PID:13828
- C:\Windows\System\nSIUZCe.exe
  C:\Windows\System\nSIUZCe.exe
  2⤵
  PID:1964
- C:\Windows\System\CnHmrJP.exe
  C:\Windows\System\CnHmrJP.exe
  2⤵
  PID:13904
- C:\Windows\System\vCTGMow.exe
  C:\Windows\System\vCTGMow.exe
  2⤵
  PID:13960
- C:\Windows\System\BUOAKrw.exe
  C:\Windows\System\BUOAKrw.exe
  2⤵
  PID:13952
- C:\Windows\System\VGMWAjN.exe
  C:\Windows\System\VGMWAjN.exe
  2⤵
  PID:732
- C:\Windows\System\fjHepfe.exe
  C:\Windows\System\fjHepfe.exe
  2⤵
  PID:14064
- C:\Windows\System\CkQHjNN.exe
  C:\Windows\System\CkQHjNN.exe
  2⤵
  PID:14068
- C:\Windows\System\pgEdysQ.exe
  C:\Windows\System\pgEdysQ.exe
  2⤵
  PID:14128
- C:\Windows\System\eEwGWXK.exe
  C:\Windows\System\eEwGWXK.exe
  2⤵
  PID:6508
- C:\Windows\System\aMPHpaF.exe
  C:\Windows\System\aMPHpaF.exe
  2⤵
  PID:424
- C:\Windows\System\BvrdxbU.exe
  C:\Windows\System\BvrdxbU.exe
  2⤵
  PID:14244
- C:\Windows\System\HowWxaU.exe
  C:\Windows\System\HowWxaU.exe
  2⤵
  PID:13296
- C:\Windows\System\QzQgTMP.exe
  C:\Windows\System\QzQgTMP.exe
  2⤵
  PID:3912
- C:\Windows\System\LhVTePm.exe
  C:\Windows\System\LhVTePm.exe
  2⤵
  PID:10312
- C:\Windows\System\mCuQwvg.exe
  C:\Windows\System\mCuQwvg.exe
  2⤵
  PID:3132
- C:\Windows\System\oLchDXl.exe
  C:\Windows\System\oLchDXl.exe
  2⤵
  PID:13752
- C:\Windows\System\TMclBPb.exe
  C:\Windows\System\TMclBPb.exe
  2⤵
  PID:14000
- C:\Windows\System\rLkvMgX.exe
  C:\Windows\System\rLkvMgX.exe
  2⤵
  PID:14060
- C:\Windows\System\ilJzmry.exe
  C:\Windows\System\ilJzmry.exe
  2⤵
  PID:14304
- C:\Windows\System\QpgvrNe.exe
  C:\Windows\System\QpgvrNe.exe
  2⤵
  PID:7048
- C:\Windows\System\PvIiGFb.exe
  C:\Windows\System\PvIiGFb.exe
  2⤵
  PID:4052
- C:\Windows\System\JDxXSfl.exe
  C:\Windows\System\JDxXSfl.exe
  2⤵
  PID:13328
- C:\Windows\System\ztkGyMR.exe
  C:\Windows\System\ztkGyMR.exe
  2⤵
  PID:2568
- C:\Windows\System\smZnvAE.exe
  C:\Windows\System\smZnvAE.exe
  2⤵
  PID:5116
- C:\Windows\System\wFqEujM.exe
  C:\Windows\System\wFqEujM.exe
  2⤵
  PID:9944
- C:\Windows\System\zNoWyrU.exe
  C:\Windows\System\zNoWyrU.exe
  2⤵
  PID:4484
- C:\Windows\System\sLDGgnh.exe
  C:\Windows\System\sLDGgnh.exe
  2⤵
  PID:13668
- C:\Windows\System\WrsQGNv.exe
  C:\Windows\System\WrsQGNv.exe
  2⤵
  PID:13836
- C:\Windows\System\LgQNJSB.exe
  C:\Windows\System\LgQNJSB.exe
  2⤵
  PID:13940
- C:\Windows\System\mPVsFes.exe
  C:\Windows\System\mPVsFes.exe
  2⤵
  PID:232
- C:\Windows\System\WUWiwTU.exe
  C:\Windows\System\WUWiwTU.exe
  2⤵
  PID:3204
- C:\Windows\System\WeZZdKq.exe
  C:\Windows\System\WeZZdKq.exe
  2⤵
  PID:14140
- C:\Windows\System\WGjjCoW.exe
  C:\Windows\System\WGjjCoW.exe
  2⤵
  PID:1380
- C:\Windows\System\UgLUrqk.exe
  C:\Windows\System\UgLUrqk.exe
  2⤵
  PID:13644
- C:\Windows\System\lhZygmV.exe
  C:\Windows\System\lhZygmV.exe
  2⤵
  PID:2148
- C:\Windows\System\synHWzl.exe
  C:\Windows\System\synHWzl.exe
  2⤵
  PID:4808
- C:\Windows\System\egbbIWx.exe
  C:\Windows\System\egbbIWx.exe
  2⤵
  PID:1520
- C:\Windows\System\jZODERE.exe
  C:\Windows\System\jZODERE.exe
  2⤵
  PID:13360
- C:\Windows\System\UXSbBaR.exe
  C:\Windows\System\UXSbBaR.exe
  2⤵
  PID:1776
- C:\Windows\System\vDVgcOP.exe
  C:\Windows\System\vDVgcOP.exe
  2⤵
  PID:13432
- C:\Windows\System\lAJuoBz.exe
  C:\Windows\System\lAJuoBz.exe
  2⤵
  PID:1688
- C:\Windows\System\pkmOwYH.exe
  C:\Windows\System\pkmOwYH.exe
  2⤵
  PID:3464
- C:\Windows\System\TVZwtlu.exe
  C:\Windows\System\TVZwtlu.exe
  2⤵
  PID:4128
- C:\Windows\System\MLDdBxw.exe
  C:\Windows\System\MLDdBxw.exe
  2⤵
  PID:1116
- C:\Windows\System\pQXiyIE.exe
  C:\Windows\System\pQXiyIE.exe
  2⤵
  PID:1352
- C:\Windows\System\jaEFohJ.exe
  C:\Windows\System\jaEFohJ.exe
  2⤵
  PID:5008
- C:\Windows\System\BdfRtSp.exe
  C:\Windows\System\BdfRtSp.exe
  2⤵
  PID:1916
- C:\Windows\System\wcLaSYC.exe
  C:\Windows\System\wcLaSYC.exe
  2⤵
  PID:5648
- C:\Windows\System\ehyUkkK.exe
  C:\Windows\System\ehyUkkK.exe
  2⤵
  PID:8500
- C:\Windows\System\JyjwhAr.exe
  C:\Windows\System\JyjwhAr.exe
  2⤵
  PID:8068
- C:\Windows\System\BLxBCrN.exe
  C:\Windows\System\BLxBCrN.exe
  2⤵
  PID:1036
- C:\Windows\System\dehqabt.exe
  C:\Windows\System\dehqabt.exe
  2⤵
  PID:3944
- C:\Windows\System\ulfoobB.exe
  C:\Windows\System\ulfoobB.exe
  2⤵
  PID:13556
- C:\Windows\System\UFYPjIa.exe
  C:\Windows\System\UFYPjIa.exe
  2⤵
  PID:11492
- C:\Windows\System\EiuLsVG.exe
  C:\Windows\System\EiuLsVG.exe
  2⤵
  PID:13896
- C:\Windows\System\QCfehyT.exe
  C:\Windows\System\QCfehyT.exe
  2⤵
  PID:5744
- C:\Windows\System\WyCyJoi.exe
  C:\Windows\System\WyCyJoi.exe
  2⤵
  PID:3720
- C:\Windows\System\lxYERAT.exe
  C:\Windows\System\lxYERAT.exe
  2⤵
  PID:3400
- C:\Windows\System\owBNAnz.exe
  C:\Windows\System\owBNAnz.exe
  2⤵
  PID:4812
- C:\Windows\System\ruLMYSc.exe
  C:\Windows\System\ruLMYSc.exe
  2⤵
  PID:1152
- C:\Windows\System\rKiXqNd.exe
  C:\Windows\System\rKiXqNd.exe
  2⤵
  PID:5128
- C:\Windows\System\rnKYZXe.exe
  C:\Windows\System\rnKYZXe.exe
  2⤵
  PID:11684
- C:\Windows\System\ciLUKHK.exe
  C:\Windows\System\ciLUKHK.exe
  2⤵
  PID:5576
- C:\Windows\System\EsQwuYv.exe
  C:\Windows\System\EsQwuYv.exe
  2⤵
  PID:5612
- C:\Windows\System\exqoQdw.exe
  C:\Windows\System\exqoQdw.exe
  2⤵
  PID:5464
- C:\Windows\System\IEYrbgJ.exe
  C:\Windows\System\IEYrbgJ.exe
  2⤵
  PID:2976
- C:\Windows\System\IbPEXZw.exe
  C:\Windows\System\IbPEXZw.exe
  2⤵
  PID:13496
- C:\Windows\System\kMokQnv.exe
  C:\Windows\System\kMokQnv.exe
  2⤵
  PID:13984
- C:\Windows\System\kkjivpz.exe
  C:\Windows\System\kkjivpz.exe
  2⤵
  PID:6120
- C:\Windows\System\lAsbtCm.exe
  C:\Windows\System\lAsbtCm.exe
  2⤵
  PID:13976
- C:\Windows\System\PgRAZeW.exe
  C:\Windows\System\PgRAZeW.exe
  2⤵
  PID:4084
- C:\Windows\System\jmKvroC.exe
  C:\Windows\System\jmKvroC.exe
  2⤵
  PID:1704
- C:\Windows\System\UnRgKGy.exe
  C:\Windows\System\UnRgKGy.exe
  2⤵
  PID:14104
- C:\Windows\System\FMzhrqM.exe
  C:\Windows\System\FMzhrqM.exe
  2⤵
  PID:916
- C:\Windows\System\iadHSWK.exe
  C:\Windows\System\iadHSWK.exe
  2⤵
  PID:6176
- C:\Windows\System\VQatVVO.exe
  C:\Windows\System\VQatVVO.exe
  2⤵
  PID:3352
- C:\Windows\System\vAGRoyt.exe
  C:\Windows\System\vAGRoyt.exe
  2⤵
  PID:5584
- C:\Windows\System\TWAvgYj.exe
  C:\Windows\System\TWAvgYj.exe
  2⤵
  PID:5084
- C:\Windows\System\bbNRCDk.exe
  C:\Windows\System\bbNRCDk.exe
  2⤵
  PID:508
- C:\Windows\System\tykxlPB.exe
  C:\Windows\System\tykxlPB.exe
  2⤵
  PID:2832
- C:\Windows\System\DxifJPK.exe
  C:\Windows\System\DxifJPK.exe
  2⤵
  PID:1808
- C:\Windows\System\AMyGzuy.exe
  C:\Windows\System\AMyGzuy.exe
  2⤵
  PID:1256
- C:\Windows\System\LiBYpAV.exe
  C:\Windows\System\LiBYpAV.exe
  2⤵
  PID:5540
- C:\Windows\System\tMjtaIj.exe
  C:\Windows\System\tMjtaIj.exe
  2⤵
  PID:5336
- C:\Windows\System\JbrERBo.exe
  C:\Windows\System\JbrERBo.exe
  2⤵
  PID:5036
- C:\Windows\System\ilMdjMB.exe
  C:\Windows\System\ilMdjMB.exe
  2⤵
  PID:13892
- C:\Windows\System\krniHqW.exe
  C:\Windows\System\krniHqW.exe
  2⤵
  PID:9692
- C:\Windows\System\RppZPuj.exe
  C:\Windows\System\RppZPuj.exe
  2⤵
  PID:5236
- C:\Windows\System\aspprqL.exe
  C:\Windows\System\aspprqL.exe
  2⤵
  PID:13216
- C:\Windows\System\otPbSvX.exe
  C:\Windows\System\otPbSvX.exe
  2⤵
  PID:664
- C:\Windows\System\AgNiFgU.exe
  C:\Windows\System\AgNiFgU.exe
  2⤵
  PID:14188
- C:\Windows\System\wkjXiFm.exe
  C:\Windows\System\wkjXiFm.exe
  2⤵
  PID:13196
- C:\Windows\System\JIjwVhh.exe
  C:\Windows\System\JIjwVhh.exe
  2⤵
  PID:4944
- C:\Windows\System\uJqKzYw.exe
  C:\Windows\System\uJqKzYw.exe
  2⤵
  PID:1128
- C:\Windows\System\tuZJQwN.exe
  C:\Windows\System\tuZJQwN.exe
  2⤵
  PID:3472
- C:\Windows\System\Mpnqros.exe
  C:\Windows\System\Mpnqros.exe
  2⤵
  PID:5956
- C:\Windows\System\YFOQcnP.exe
  C:\Windows\System\YFOQcnP.exe
  2⤵
  PID:5936
- C:\Windows\System\RCzYeVm.exe
  C:\Windows\System\RCzYeVm.exe
  2⤵
  PID:6096
- C:\Windows\System\YIbvayI.exe
  C:\Windows\System\YIbvayI.exe
  2⤵
  PID:6080
- C:\Windows\System\JgoBUSw.exe
  C:\Windows\System\JgoBUSw.exe
  2⤵
  PID:5600
- C:\Windows\System\FDcjRDK.exe
  C:\Windows\System\FDcjRDK.exe
  2⤵
  PID:2516
- C:\Windows\System\YNAVmLZ.exe
  C:\Windows\System\YNAVmLZ.exe
  2⤵
  PID:4632
- C:\Windows\System\pDlNnio.exe
  C:\Windows\System\pDlNnio.exe
  2⤵
  PID:7112
- C:\Windows\System\TDxeeJw.exe
  C:\Windows\System\TDxeeJw.exe
  2⤵
  PID:7956
- C:\Windows\System\ApSwbzq.exe
  C:\Windows\System\ApSwbzq.exe
  2⤵
  PID:6844
- C:\Windows\System\NtfNdAu.exe
  C:\Windows\System\NtfNdAu.exe
  2⤵
  PID:2956
- C:\Windows\System\IaUSJop.exe
  C:\Windows\System\IaUSJop.exe
  2⤵
  PID:13128
- C:\Windows\System\liWvSin.exe
  C:\Windows\System\liWvSin.exe
  2⤵
  PID:6016
- C:\Windows\System\TtCVbKy.exe
  C:\Windows\System\TtCVbKy.exe
  2⤵
  PID:1544
- C:\Windows\System\PWVUxst.exe
  C:\Windows\System\PWVUxst.exe
  2⤵
  PID:4584
- C:\Windows\System\LhpesAV.exe
  C:\Windows\System\LhpesAV.exe
  2⤵
  PID:8100
- C:\Windows\System\KdJUKAe.exe
  C:\Windows\System\KdJUKAe.exe
  2⤵
  PID:6960
- C:\Windows\System\TrxTiZb.exe
  C:\Windows\System\TrxTiZb.exe
  2⤵
  PID:7664
- C:\Windows\System\HimBZrg.exe
  C:\Windows\System\HimBZrg.exe
  2⤵
  PID:9128
- C:\Windows\System\UQirGJR.exe
  C:\Windows\System\UQirGJR.exe
  2⤵
  PID:7844
- C:\Windows\System\CowrTnb.exe
  C:\Windows\System\CowrTnb.exe
  2⤵
  PID:11608
- C:\Windows\System\rOvabQk.exe
  C:\Windows\System\rOvabQk.exe
  2⤵
  PID:7604
- C:\Windows\System\VDffEJg.exe
  C:\Windows\System\VDffEJg.exe
  2⤵
  PID:13060
- C:\Windows\System\pRioCnO.exe
  C:\Windows\System\pRioCnO.exe
  2⤵
  PID:12576
- C:\Windows\System\SLeoddm.exe
  C:\Windows\System\SLeoddm.exe
  2⤵
  PID:7576
- C:\Windows\System\oHxdpFN.exe
  C:\Windows\System\oHxdpFN.exe
  2⤵
  PID:4416
- C:\Windows\System\RcXkhjU.exe
  C:\Windows\System\RcXkhjU.exe
  2⤵
  PID:5532
- C:\Windows\System\oVvisxh.exe
  C:\Windows\System\oVvisxh.exe
  2⤵
  PID:1652
- C:\Windows\System\tJgSnNl.exe
  C:\Windows\System\tJgSnNl.exe
  2⤵
  PID:8208
- C:\Windows\System\hKIRpAP.exe
  C:\Windows\System\hKIRpAP.exe
  2⤵
  PID:7820
- C:\Windows\System\iKQTyGi.exe
  C:\Windows\System\iKQTyGi.exe
  2⤵
  PID:13612
- C:\Windows\System\HOfKQcc.exe
  C:\Windows\System\HOfKQcc.exe
  2⤵
  PID:12968
- C:\Windows\System\gyigJaE.exe
  C:\Windows\System\gyigJaE.exe
  2⤵
  PID:8168
- C:\Windows\System\aygKVQD.exe
  C:\Windows\System\aygKVQD.exe
  2⤵
  PID:6656
- C:\Windows\System\UkAwirY.exe
  C:\Windows\System\UkAwirY.exe
  2⤵
  PID:8316
- C:\Windows\System\ihrZNxE.exe
  C:\Windows\System\ihrZNxE.exe
  2⤵
  PID:13880
- C:\Windows\System\CVViQzv.exe
  C:\Windows\System\CVViQzv.exe
  2⤵
  PID:13928
- C:\Windows\System\ARUWNqC.exe
  C:\Windows\System\ARUWNqC.exe
  2⤵
  PID:6912
- C:\Windows\System\eOyzlyE.exe
  C:\Windows\System\eOyzlyE.exe
  2⤵
  PID:4092
- C:\Windows\System\ifJXXKD.exe
  C:\Windows\System\ifJXXKD.exe
  2⤵
  PID:7676
- C:\Windows\System\mcZSSpp.exe
  C:\Windows\System\mcZSSpp.exe
  2⤵
  PID:13808
- C:\Windows\System\UJFljAE.exe
  C:\Windows\System\UJFljAE.exe
  2⤵
  PID:14088
- C:\Windows\System\oRXgWDx.exe
  C:\Windows\System\oRXgWDx.exe
  2⤵
  PID:7380
- C:\Windows\System\IUrvtUa.exe
  C:\Windows\System\IUrvtUa.exe
  2⤵
  PID:9868
- C:\Windows\System\mCEUguZ.exe
  C:\Windows\System\mCEUguZ.exe
  2⤵
  PID:8084
- C:\Windows\System\bDrviii.exe
  C:\Windows\System\bDrviii.exe
  2⤵
  PID:14268
- C:\Windows\System\CuObOqa.exe
  C:\Windows\System\CuObOqa.exe
  2⤵
  PID:13348
- C:\Windows\System\uDXXtmg.exe
  C:\Windows\System\uDXXtmg.exe
  2⤵
  PID:7472
- C:\Windows\System\ZOBkswr.exe
  C:\Windows\System\ZOBkswr.exe
  2⤵
  PID:2168
- C:\Windows\System\yttNPCk.exe
  C:\Windows\System\yttNPCk.exe
  2⤵
  PID:6612
- C:\Windows\System\ycLRyUZ.exe
  C:\Windows\System\ycLRyUZ.exe
  2⤵
  PID:6032
- C:\Windows\System\gOAAyJD.exe
  C:\Windows\System\gOAAyJD.exe
  2⤵
  PID:12156
- C:\Windows\System\oKuZqVs.exe
  C:\Windows\System\oKuZqVs.exe
  2⤵
  PID:11132
- C:\Windows\System\rxICfcz.exe
  C:\Windows\System\rxICfcz.exe
  2⤵
  PID:1712
- C:\Windows\System\mXHAHIz.exe
  C:\Windows\System\mXHAHIz.exe
  2⤵
  PID:8360
- C:\Windows\System\bfEhasu.exe
  C:\Windows\System\bfEhasu.exe
  2⤵
  PID:13492
- C:\Windows\System\EqcyOZW.exe
  C:\Windows\System\EqcyOZW.exe
  2⤵
  PID:9096
- C:\Windows\System\HHTXIbT.exe
  C:\Windows\System\HHTXIbT.exe
  2⤵
  PID:6524
- C:\Windows\System\WpmAtZT.exe
  C:\Windows\System\WpmAtZT.exe
  2⤵
  PID:10620
- C:\Windows\System\zdBVaDE.exe
  C:\Windows\System\zdBVaDE.exe
  2⤵
  PID:9732
- C:\Windows\System\yuqdAfU.exe
  C:\Windows\System\yuqdAfU.exe
  2⤵
  PID:8520
- C:\Windows\System\KsWzXFw.exe
  C:\Windows\System\KsWzXFw.exe
  2⤵
  PID:4264
- C:\Windows\System\pgmVSNf.exe
  C:\Windows\System\pgmVSNf.exe
  2⤵
  PID:5384
- C:\Windows\System\LhBeXgq.exe
  C:\Windows\System\LhBeXgq.exe
  2⤵
  PID:7188
- C:\Windows\System\fgPXxco.exe
  C:\Windows\System\fgPXxco.exe
  2⤵
  PID:936
- C:\Windows\System\gZZaAbt.exe
  C:\Windows\System\gZZaAbt.exe
  2⤵
  PID:14144
- C:\Windows\System\DCigMIG.exe
  C:\Windows\System\DCigMIG.exe
  2⤵
  PID:10728
- C:\Windows\System\lUBbxef.exe
  C:\Windows\System\lUBbxef.exe
  2⤵
  PID:8124
- C:\Windows\System\VWFjdVN.exe
  C:\Windows\System\VWFjdVN.exe
  2⤵
  PID:5512
- C:\Windows\System\nnCibXR.exe
  C:\Windows\System\nnCibXR.exe
  2⤵
  PID:4572
- C:\Windows\System\WjzewFo.exe
  C:\Windows\System\WjzewFo.exe
  2⤵
  PID:9636
- C:\Windows\System\BmZYQly.exe
  C:\Windows\System\BmZYQly.exe
  2⤵
  PID:1668
- C:\Windows\System\KinbsJM.exe
  C:\Windows\System\KinbsJM.exe
  2⤵
  PID:6820
- C:\Windows\System\JZNjjaf.exe
  C:\Windows\System\JZNjjaf.exe
  2⤵
  PID:8460
- C:\Windows\System\lzKASfu.exe
  C:\Windows\System\lzKASfu.exe
  2⤵
  PID:6372
- C:\Windows\System\mBmfhih.exe
  C:\Windows\System\mBmfhih.exe
  2⤵
  PID:2720
- C:\Windows\System\FXPjZlz.exe
  C:\Windows\System\FXPjZlz.exe
  2⤵
  PID:10716
- C:\Windows\System\tLkuWdY.exe
  C:\Windows\System\tLkuWdY.exe
  2⤵
  PID:6428
- C:\Windows\System\xdliSoa.exe
  C:\Windows\System\xdliSoa.exe
  2⤵
  PID:8260
- C:\Windows\System\jWswBRU.exe
  C:\Windows\System\jWswBRU.exe
  2⤵
  PID:10416
- C:\Windows\System\YZVaaMR.exe
  C:\Windows\System\YZVaaMR.exe
  2⤵
  PID:7628
- C:\Windows\System\eaVTYoS.exe
  C:\Windows\System\eaVTYoS.exe
  2⤵
  PID:7996
- C:\Windows\System\uzOHhBO.exe
  C:\Windows\System\uzOHhBO.exe
  2⤵
  PID:10596
- C:\Windows\System\qVENIJC.exe
  C:\Windows\System\qVENIJC.exe
  2⤵
  PID:10660
- C:\Windows\System\kAswEap.exe
  C:\Windows\System\kAswEap.exe
  2⤵
  PID:7192
- C:\Windows\System\BgXIjYQ.exe
  C:\Windows\System\BgXIjYQ.exe
  2⤵
  PID:7144
- C:\Windows\System\sQhbwCW.exe
  C:\Windows\System\sQhbwCW.exe
  2⤵
  PID:13900
- C:\Windows\System\FvcIiqr.exe
  C:\Windows\System\FvcIiqr.exe
  2⤵
  PID:8692
- C:\Windows\System\zHgluPY.exe
  C:\Windows\System\zHgluPY.exe
  2⤵
  PID:10836
- C:\Windows\System\kcfBsEA.exe
  C:\Windows\System\kcfBsEA.exe
  2⤵
  PID:9504
- C:\Windows\System\MmEUNWM.exe
  C:\Windows\System\MmEUNWM.exe
  2⤵
  PID:6336
- C:\Windows\System\CtHiWKs.exe
  C:\Windows\System\CtHiWKs.exe
  2⤵
  PID:8336
- C:\Windows\System\WegcGMS.exe
  C:\Windows\System\WegcGMS.exe
  2⤵
  PID:7172
- C:\Windows\System\rajKKto.exe
  C:\Windows\System\rajKKto.exe
  2⤵
  PID:7796
- C:\Windows\System\OCKtbrl.exe
  C:\Windows\System\OCKtbrl.exe
  2⤵
  PID:9788
- C:\Windows\System\GJcYIbe.exe
  C:\Windows\System\GJcYIbe.exe
  2⤵
  PID:3492
- C:\Windows\System\brHcAfn.exe
  C:\Windows\System\brHcAfn.exe
  2⤵
  PID:7356
- C:\Windows\System\irPcHAq.exe
  C:\Windows\System\irPcHAq.exe
  2⤵
  PID:13264
- C:\Windows\System\DrGJBBI.exe
  C:\Windows\System\DrGJBBI.exe
  2⤵
  PID:7624
- C:\Windows\System\UkJzbdI.exe
  C:\Windows\System\UkJzbdI.exe
  2⤵
  PID:9784
- C:\Windows\System\kBCABOX.exe
  C:\Windows\System\kBCABOX.exe
  2⤵
  PID:13444
- C:\Windows\System\nCZRZpH.exe
  C:\Windows\System\nCZRZpH.exe
  2⤵
  PID:11496
- C:\Windows\System\qDSyWWh.exe
  C:\Windows\System\qDSyWWh.exe
  2⤵
  PID:8372
- C:\Windows\System\ElPRRDF.exe
  C:\Windows\System\ElPRRDF.exe
  2⤵
  PID:9444
- C:\Windows\System\JvjqYqe.exe
  C:\Windows\System\JvjqYqe.exe
  2⤵
  PID:10980
- C:\Windows\System\SGpICOM.exe
  C:\Windows\System\SGpICOM.exe
  2⤵
  PID:8696
- C:\Windows\System\UaPKKrR.exe
  C:\Windows\System\UaPKKrR.exe
  2⤵
  PID:8432
- C:\Windows\System\ZxdLyQj.exe
  C:\Windows\System\ZxdLyQj.exe
  2⤵
  PID:2888
- C:\Windows\System\YsFyBYW.exe
  C:\Windows\System\YsFyBYW.exe
  2⤵
  PID:9116
- C:\Windows\System\ECdaDNM.exe
  C:\Windows\System\ECdaDNM.exe
  2⤵
  PID:8632
- C:\Windows\System\KVQavCm.exe
  C:\Windows\System\KVQavCm.exe
  2⤵
  PID:13364
- C:\Windows\System\mpgFpFJ.exe
  C:\Windows\System\mpgFpFJ.exe
  2⤵
  PID:4856
- C:\Windows\System\rEmnLWL.exe
  C:\Windows\System\rEmnLWL.exe
  2⤵
  PID:12592
- C:\Windows\System\RAUaArF.exe
  C:\Windows\System\RAUaArF.exe
  2⤵
  PID:5244
- C:\Windows\System\IVBePCI.exe
  C:\Windows\System\IVBePCI.exe
  2⤵
  PID:6340
- C:\Windows\System\wMZyghl.exe
  C:\Windows\System\wMZyghl.exe
  2⤵
  PID:7612
- C:\Windows\System\KiiwCoN.exe
  C:\Windows\System\KiiwCoN.exe
  2⤵
  PID:12208
- C:\Windows\System\rzhnPoK.exe
  C:\Windows\System\rzhnPoK.exe
  2⤵
  PID:9760
- C:\Windows\System\RgQxpLg.exe
  C:\Windows\System\RgQxpLg.exe
  2⤵
  PID:5736
- C:\Windows\System\WVWxcii.exe
  C:\Windows\System\WVWxcii.exe
  2⤵
  PID:9332
- C:\Windows\System\vlEzSnT.exe
  C:\Windows\System\vlEzSnT.exe
  2⤵
  PID:8860
- C:\Windows\System\AdBIphE.exe
  C:\Windows\System\AdBIphE.exe
  2⤵
  PID:9576
- C:\Windows\System\XzNoYqR.exe
  C:\Windows\System\XzNoYqR.exe
  2⤵
  PID:9412
- C:\Windows\System\ItAugrh.exe
  C:\Windows\System\ItAugrh.exe
  2⤵
  PID:12296
- C:\Windows\System\RISpJiw.exe
  C:\Windows\System\RISpJiw.exe
  2⤵
  PID:4732
- C:\Windows\System\TXbIjcQ.exe
  C:\Windows\System\TXbIjcQ.exe
  2⤵
  PID:9516
- C:\Windows\System\QGpHbgB.exe
  C:\Windows\System\QGpHbgB.exe
  2⤵
  PID:12936
- C:\Windows\System\RICijeq.exe
  C:\Windows\System\RICijeq.exe
  2⤵
  PID:9072
- C:\Windows\System\ggbZfUa.exe
  C:\Windows\System\ggbZfUa.exe
  2⤵
  PID:10120
- C:\Windows\System\qbZVOgC.exe
  C:\Windows\System\qbZVOgC.exe
  2⤵
  PID:11460
- C:\Windows\System\uKDxYVm.exe
  C:\Windows\System\uKDxYVm.exe
  2⤵
  PID:8924
- C:\Windows\System\gfobhHm.exe
  C:\Windows\System\gfobhHm.exe
  2⤵
  PID:9316
- C:\Windows\System\ZrpkWxh.exe
  C:\Windows\System\ZrpkWxh.exe
  2⤵
  PID:8104
- C:\Windows\System\SOwephT.exe
  C:\Windows\System\SOwephT.exe
  2⤵
  PID:11508
- C:\Windows\System\iBctevG.exe
  C:\Windows\System\iBctevG.exe
  2⤵
  PID:5032
- C:\Windows\System\PiZPMpu.exe
  C:\Windows\System\PiZPMpu.exe
  2⤵
  PID:11968
- C:\Windows\System\zQvxdWs.exe
  C:\Windows\System\zQvxdWs.exe
  2⤵
  PID:848
- C:\Windows\System\cGrohjf.exe
  C:\Windows\System\cGrohjf.exe
  2⤵
  PID:11500
- C:\Windows\System\CWDTGmn.exe
  C:\Windows\System\CWDTGmn.exe
  2⤵
  PID:3560
- C:\Windows\System\TvITDcX.exe
  C:\Windows\System\TvITDcX.exe
  2⤵
  PID:10316
- C:\Windows\System\IQGBIWi.exe
  C:\Windows\System\IQGBIWi.exe
  2⤵
  PID:9736
- C:\Windows\System\dGicXeP.exe
  C:\Windows\System\dGicXeP.exe
  2⤵
  PID:13356
- C:\Windows\System\nYZuxEp.exe
  C:\Windows\System\nYZuxEp.exe
  2⤵
  PID:10524
- C:\Windows\System\GVrIoGR.exe
  C:\Windows\System\GVrIoGR.exe
  2⤵
  PID:8164
- C:\Windows\System\dUOpVRK.exe
  C:\Windows\System\dUOpVRK.exe
  2⤵
  PID:8396
- C:\Windows\System\dOAYNDl.exe
  C:\Windows\System\dOAYNDl.exe
  2⤵
  PID:13008
- C:\Windows\System\MQvKhMc.exe
  C:\Windows\System\MQvKhMc.exe
  2⤵
  PID:6948
- C:\Windows\System\IrkFBxT.exe
  C:\Windows\System\IrkFBxT.exe
  2⤵
  PID:8636
- C:\Windows\System\tYXdXOb.exe
  C:\Windows\System\tYXdXOb.exe
  2⤵
  PID:12028
- C:\Windows\System\OYdhBTh.exe
  C:\Windows\System\OYdhBTh.exe
  2⤵
  PID:9456
- C:\Windows\System\TeHPGwA.exe
  C:\Windows\System\TeHPGwA.exe
  2⤵
  PID:9960
- C:\Windows\System\ZIQcyDZ.exe
  C:\Windows\System\ZIQcyDZ.exe
  2⤵
  PID:868
- C:\Windows\System\EKqENSY.exe
  C:\Windows\System\EKqENSY.exe
  2⤵
  PID:12444
- C:\Windows\System\TmvQoWE.exe
  C:\Windows\System\TmvQoWE.exe
  2⤵
  PID:9480
- C:\Windows\System\uygBpVn.exe
  C:\Windows\System\uygBpVn.exe
  2⤵
  PID:12004
- C:\Windows\System\OPrzhRy.exe
  C:\Windows\System\OPrzhRy.exe
  2⤵
  PID:12220
- C:\Windows\System\PnZwhSw.exe
  C:\Windows\System\PnZwhSw.exe
  2⤵
  PID:6552
- C:\Windows\System\zRzpRFo.exe
  C:\Windows\System\zRzpRFo.exe
  2⤵
  PID:12312
- C:\Windows\System\urHVuSD.exe
  C:\Windows\System\urHVuSD.exe
  2⤵
  PID:7432
- C:\Windows\System\fWATMGG.exe
  C:\Windows\System\fWATMGG.exe
  2⤵
  PID:7340
- C:\Windows\System\kMPimVS.exe
  C:\Windows\System\kMPimVS.exe
  2⤵
  PID:12024
- C:\Windows\System\sngGxAc.exe
  C:\Windows\System\sngGxAc.exe
  2⤵
  PID:8392
- C:\Windows\System\tPhVAPY.exe
  C:\Windows\System\tPhVAPY.exe
  2⤵
  PID:8404
- C:\Windows\System\ZPfZvCJ.exe
  C:\Windows\System\ZPfZvCJ.exe
  2⤵
  PID:932
- C:\Windows\System\mjqUJHj.exe
  C:\Windows\System\mjqUJHj.exe
  2⤵
  PID:12608
- C:\Windows\System\gIoJQKn.exe
  C:\Windows\System\gIoJQKn.exe
  2⤵
  PID:3744
- C:\Windows\System\BLrucmM.exe
  C:\Windows\System\BLrucmM.exe
  2⤵
  PID:8784
- C:\Windows\System\TbQlOKY.exe
  C:\Windows\System\TbQlOKY.exe
  2⤵
  PID:10068
- C:\Windows\System\UtttvTp.exe
  C:\Windows\System\UtttvTp.exe
  2⤵
  PID:6908
- C:\Windows\System\mvtnbrX.exe
  C:\Windows\System\mvtnbrX.exe
  2⤵
  PID:10772
- C:\Windows\System\REobsOx.exe
  C:\Windows\System\REobsOx.exe
  2⤵
  PID:10256
- C:\Windows\System\rEvfMUe.exe
  C:\Windows\System\rEvfMUe.exe
  2⤵
  PID:8768
- C:\Windows\System\cLBmiEL.exe
  C:\Windows\System\cLBmiEL.exe
  2⤵
  PID:12112
- C:\Windows\System\vbJILbj.exe
  C:\Windows\System\vbJILbj.exe
  2⤵
  PID:10536
- C:\Windows\System\aCrQoew.exe
  C:\Windows\System\aCrQoew.exe
  2⤵
  PID:10636
- C:\Windows\System\LtegzgO.exe
  C:\Windows\System\LtegzgO.exe
  2⤵
  PID:10808
- C:\Windows\System\DBHxOpm.exe
  C:\Windows\System\DBHxOpm.exe
  2⤵
  PID:13244
- C:\Windows\System\YmnjJAJ.exe
  C:\Windows\System\YmnjJAJ.exe
  2⤵
  PID:13452
- C:\Windows\System\NOkkgej.exe
  C:\Windows\System\NOkkgej.exe
  2⤵
  PID:11964
- C:\Windows\System\bhrQgZp.exe
  C:\Windows\System\bhrQgZp.exe
  2⤵
  PID:11328
- C:\Windows\System\tfkgxAy.exe
  C:\Windows\System\tfkgxAy.exe
  2⤵
  PID:12904
- C:\Windows\System\tEAZhaR.exe
  C:\Windows\System\tEAZhaR.exe
  2⤵
  PID:10760
- C:\Windows\System\XXyhEgv.exe
  C:\Windows\System\XXyhEgv.exe
  2⤵
  PID:12856
- C:\Windows\System\WQuSISv.exe
  C:\Windows\System\WQuSISv.exe
  2⤵
  PID:9848
- C:\Windows\System\eUMoXSi.exe
  C:\Windows\System\eUMoXSi.exe
  2⤵
  PID:12448
- C:\Windows\System\BWjMEMs.exe
  C:\Windows\System\BWjMEMs.exe
  2⤵
  PID:10736
- C:\Windows\System\iFWeSdH.exe
  C:\Windows\System\iFWeSdH.exe
  2⤵
  PID:10864
- C:\Windows\System\sMziXUD.exe
  C:\Windows\System\sMziXUD.exe
  2⤵
  PID:7140
- C:\Windows\System\KTBSdvH.exe
  C:\Windows\System\KTBSdvH.exe
  2⤵
  PID:948
- C:\Windows\System\uyOVies.exe
  C:\Windows\System\uyOVies.exe
  2⤵
  PID:11788
- C:\Windows\System\FufVFbC.exe
  C:\Windows\System\FufVFbC.exe
  2⤵
  PID:12564
- C:\Windows\System\FtJDfma.exe
  C:\Windows\System\FtJDfma.exe
  2⤵
  PID:12824
- C:\Windows\System\Rjfrqme.exe
  C:\Windows\System\Rjfrqme.exe
  2⤵
  PID:10404
- C:\Windows\System\AhCDhOJ.exe
  C:\Windows\System\AhCDhOJ.exe
  2⤵
  PID:9968
- C:\Windows\System\jWNYfVy.exe
  C:\Windows\System\jWNYfVy.exe
  2⤵
  PID:13292
- C:\Windows\System\HEMuLou.exe
  C:\Windows\System\HEMuLou.exe
  2⤵
  PID:12360
- C:\Windows\System\LJwDmrB.exe
  C:\Windows\System\LJwDmrB.exe
  2⤵
  PID:13056
- C:\Windows\System\XORvJVO.exe
  C:\Windows\System\XORvJVO.exe
  2⤵
  PID:10388
- C:\Windows\System\RaxcolO.exe
  C:\Windows\System\RaxcolO.exe
  2⤵
  PID:13172
- C:\Windows\System\KHWAGjP.exe
  C:\Windows\System\KHWAGjP.exe
  2⤵
  PID:8552
- C:\Windows\System\bZgVWoB.exe
  C:\Windows\System\bZgVWoB.exe
  2⤵
  PID:12804
- C:\Windows\System\axxRYKt.exe
  C:\Windows\System\axxRYKt.exe
  2⤵
  PID:7872
- C:\Windows\System\nPKdasR.exe
  C:\Windows\System\nPKdasR.exe
  2⤵
  PID:12060
- C:\Windows\System\EYWOJPQ.exe
  C:\Windows\System\EYWOJPQ.exe
  2⤵
  PID:12972
- C:\Windows\System\QpGCaaa.exe
  C:\Windows\System\QpGCaaa.exe
  2⤵
  PID:13416
- C:\Windows\System\uzFNbpe.exe
  C:\Windows\System\uzFNbpe.exe
  2⤵
  PID:10040
- C:\Windows\System\FtiyBJG.exe
  C:\Windows\System\FtiyBJG.exe
  2⤵
  PID:8420
- C:\Windows\System\xxASuCK.exe
  C:\Windows\System\xxASuCK.exe
  2⤵
  PID:10456
- C:\Windows\System\VLnctqa.exe
  C:\Windows\System\VLnctqa.exe
  2⤵
  PID:6048
- C:\Windows\System\vWLNsPJ.exe
  C:\Windows\System\vWLNsPJ.exe
  2⤵
  PID:1860
- C:\Windows\System\jVKbyBU.exe
  C:\Windows\System\jVKbyBU.exe
  2⤵
  PID:8936
- C:\Windows\System\BPboftm.exe
  C:\Windows\System\BPboftm.exe
  2⤵
  PID:10708
- C:\Windows\System\eZIsWgU.exe
  C:\Windows\System\eZIsWgU.exe
  2⤵
  PID:10812
- C:\Windows\System\gUlEFEm.exe
  C:\Windows\System\gUlEFEm.exe
  2⤵
  PID:7284
- C:\Windows\System\cnpHmPc.exe
  C:\Windows\System\cnpHmPc.exe
  2⤵
  PID:7772
- C:\Windows\System\VBhWEGo.exe
  C:\Windows\System\VBhWEGo.exe
  2⤵
  PID:9400
- C:\Windows\System\oYhnMNy.exe
  C:\Windows\System\oYhnMNy.exe
  2⤵
  PID:10852

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 472 -p 11580 -ip 11580
1⤵
PID:7196

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 660 -p 12816 -ip 12816
1⤵
PID:1624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0hcunfn2.glj.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AoChXaT.exe

Filesize
1.9MB

MD5
6c17bd441875554b53694ebf455fd5ed

SHA1
044b1356cf4bc5978374d1bfb7522db5f42505a7

SHA256
c6973cb0e0ac249b3df5953411d36fddc6b3b25db2b3b9cb986c882133d91177

SHA512
dcb9336470952af8391a11c41def29546034afad9154d2befc39f3a7deb5a7dc56b6b3a800f5e350f9e765829356ba382d42c3f2f22935ba8976188718c97401

Download Submit
C:\Windows\System\CsJFxMy.exe

Filesize
1.9MB

MD5
f6d9d8b2c4b85ec20708e9153bb64e19

SHA1
7a6503453c32c3206f2ef7a51ad9e1e43550619f

SHA256
0c2e10fc503441e38a41c0125cf90bf35b1717c6bde646b72c81c6b18777695a

SHA512
f82454a6fb3e77512a93b6bc4fbb49bec41481e6fea2bbb9474a0163a7cf37df70a2a0bd59c182291219eb48b92ae9611437c7d9e2379150b9e2df327d3d663a

Download Submit
C:\Windows\System\EKGCdER.exe

Filesize
8B

MD5
30a9dfceb37577cb23b97b50ee0ca790

SHA1
b56360a546aafbfa7ce003cd05916a7ab7239259

SHA256
44dda0d0cfe87b066fcb3ae3e2b0cbc86f86ca0fdd14c7ce736c7a63fedce1f4

SHA512
f1ae1743e6029aabc9e7387b476be46b30f000874bca6e0907b605cfb329a40abfc7d4eb3d891027c469be0356b370267e0531be7c50ab8183a5aad8ce1cbe57

Download Submit
C:\Windows\System\IeKivHS.exe

Filesize
1.9MB

MD5
11e0e46613d50e7ce8efc6d35f67ff91

SHA1
93710ef5db7e474b999d383acbc4ed3e64a15cb7

SHA256
3a7114139d1a2bab292b5ddfb4fdb6bc389e2961306542c766dcb83327fabfd6

SHA512
54a0b86abd73e3c86b47b030efb43df21a56a9f7953b2e7557afd1d55619a3e5acc7f2c4dfec186a67c38b23f216f2d26de245289af7a6d4b98e624c78fe3ed8

Download Submit
C:\Windows\System\JSajoEk.exe

Filesize
1.9MB

MD5
8d30d8d996e3face9372fd1fa583548f

SHA1
eba56a08b179ad25d3fa2721b6f7b1ddfbafc350

SHA256
91aab52c262af8667e7e2d8dc2257091a277136da5832cddaa9668aa10aa5d12

SHA512
8ef2cdd621fd8dee76d1246038cc45f56c669ccf84735f927d52f8c6e22b0d473c1793acbaa3c3f28fe2cdf4071a16302a96e723dc98156cf686449fe45c8e86

Download Submit
C:\Windows\System\KEEHmTP.exe

Filesize
1.9MB

MD5
adf12d923848a5c64761bd9c1c53c0d1

SHA1
0fd4b6ea305481f606c2f6a2f3a9430ff5f841b9

SHA256
d33a14cc3361e987ac9b31ab8bc9d06a5cb9b34f564383798b4caea5e48871eb

SHA512
08278dc6191f6a35b03037c59774fc8753eef2e61b512e445a6bdccaf1297eed2af80ecdd7bc1617c4fa2ebde501afde6fab58b8fd52bec87d489656456bcfef

Download Submit
C:\Windows\System\NPImaFk.exe

Filesize
1.9MB

MD5
bf0808d945f1b741b34c245a1d3d4871

SHA1
e39818ee7b5c9f66b046010f3cee315e09d02c7d

SHA256
f7f6fca778ac91d47c0d8c8e27f15284375a4535134a54b0ac5a70d50ad2296a

SHA512
e44d5c94cefe320d379f27575c13bfb24e5e014c09a0dfb6edd155ad75ca5f6bf1514df66b7420dc565bdd64cea91062b3d9c0fe95f2ebf998b209ef1a4cb8a4

Download Submit
C:\Windows\System\NtEfDKg.exe

Filesize
1.9MB

MD5
cfcee7a2406a7e546e79408941532f81

SHA1
7ee6545b37a9c30a4cbb08a5193ae36856cb062e

SHA256
d86bfd792cfb891712619dd11835e924774f78ec5f759430be040f7a0152fe8a

SHA512
5adc19844aa08a0411d31ffec5cba8d0ad040e1df1144803f3129d818531da8587004e111e288c860653e2662c952238f1bbf6a92b21607f3cf67df814e7b9e8

Download Submit
C:\Windows\System\PVnitws.exe

Filesize
1.9MB

MD5
73ecd66906b6679576a07ce6fe1ff2f4

SHA1
613798cc83ddfd3a1d6e0ddbda40d18d5e346585

SHA256
77e957e7b2a464241b808996d42f51f234ac99a9f6ebb9d8b0da399278480f71

SHA512
14e7edd5cd0d8687a99ffeaa1bbbb27c8fc3f43412c34a50afe92ceeaca27f5805c8b47fda31fd6a34f0c931fb7c3a76ad9f854ad606eaac1440e98bec565c15

Download Submit
C:\Windows\System\PrWygyo.exe

Filesize
1.9MB

MD5
be76ce947959ebbbcb1f2e32e2750498

SHA1
bec392c50c6d9cabf58ea10b985089eec8f770e8

SHA256
bd8c6e20691c5bbfc0c7e40b810f40432e2218eb3f62691d8cd54b401f65f89c

SHA512
1c279ee8a55cc74966c1d28f03ff4485c1286ef1d3e2bd51d42bb3605a21b4ca8da371363561eae790ec8deb018f3cb830c8aa46c3d81890e928e03bea82f5a5

Download Submit
C:\Windows\System\RiasPBh.exe

Filesize
1.9MB

MD5
ba8fe9ad306467976f3716f43d486228

SHA1
9f3571b92e27add5e8bb6a1f68ab9f058763ab95

SHA256
1b4185df9d96f42b4fdeeae317e797db8efbcfbce20dc9780549b208c6dbce01

SHA512
8130259bd0b858ca2b34153fe953682638a4ae48c31fdc3deaa38e886bd67009b1e6b66acc52272f026e0a3f7e9c3f7cbe8e944100f517fa52d883c357b3abb6

Download Submit
C:\Windows\System\RnGxfJC.exe

Filesize
1.9MB

MD5
619a060f9e15925b70e84e001c8aa996

SHA1
b05d70d968bc28b05daabc9efff431dd4f11bcbd

SHA256
2f15970c99df499337a512ce9766553c6e1fd28ee0a4f070dfe2ef4a8931bcca

SHA512
b468d6ac0c5aa31d8cb328bc4b5dc4e0c9e2b9e5d3e66ed9c2fb720fa5628def18090db39a15e163b34f43cd13f723c615805571ede345a849027837ff5c17ae

Download Submit
C:\Windows\System\SPWicPG.exe

Filesize
1.9MB

MD5
1927bd530fb0a20dc1231838f833a5e2

SHA1
9708e3638da688e635dfd442867f9e03b9231cbb

SHA256
e4a32ce68f2a755dddfdc533e11c9a8b895be5de8f0bef98605d07f67491a605

SHA512
7d2dbde9bf9e74beeb9686e5bfbe6b7fb4372e39a2f1201b76974a7a616ea2ef5ef8c90617368f0e8718f72bcfdd5270d4dc87fc2df5adef4335367a266a6e08

Download Submit
C:\Windows\System\SukpaiN.exe

Filesize
1.9MB

MD5
3729d38f86f4d1a770422d23516f8487

SHA1
3e9b1ae049af3a4300c63a4e9e67fde5bc843ef0

SHA256
5ba3d23a802f1fc43cd28bab12d146c92d49ef5b87419bf25eb5c3102c37b7fc

SHA512
affafdbc73dde9094b0826dee10e271465f1e5fa3ff6f1ed95f783b354de15e364a4b8fb76621f66ffeb5c634341ee904add492e36e03d4083fc01167645cb5f

Download Submit
C:\Windows\System\SwVtkSR.exe

Filesize
1.9MB

MD5
1e8ebe52f7678d6c73690f568b2787ce

SHA1
f3f0ef0022b2923bb82f4d326fde291074ef296b

SHA256
49bf37bbff472bf32b204ae6b5221afd518d7ee9255876fcb8b6011d446ffd6e

SHA512
73dedcd07a63ad854754f27cafe1efec0d47a5fb9dae1f5d8aa508763d77e4d0a1c87c6713717eb437fb2b131e14253ec64de42b84763f06d722495be43abbce

Download Submit
C:\Windows\System\UWJzeoB.exe

Filesize
1.9MB

MD5
8e1333cc8afd318579a8d5d4575e7f5b

SHA1
569d1de2b69abd2d8da7ba8658ddcc3ac74a7bb1

SHA256
ac855e4d53a239edbf62345da326adca1e7aa550c6b6906a880c0a0d31248df1

SHA512
49d16297674c672488338a89eec35042200cc2c1b60fb5626d275306eb2aae509ed9a6ccb286e98d991c0acefad239882285953ea89115f570ef9b47de49575c

Download Submit
C:\Windows\System\UihsaKt.exe

Filesize
1.9MB

MD5
1e25527710df54946cb1ef93af838e8d

SHA1
5048ff97d967ba37a2d563966dd06395609987ec

SHA256
23eeb19643cb47769acd230918ad59cdef6366d3811ffe49f64ff7f3aa9fa272

SHA512
9263b03ace0f6c6b141369a387ca6eb20d1caa7ee7bf1d568f723b357329239004207c17a3c3c35e72c689468eda8ff8336d4154dd746f8306027c3edc15895c

Download Submit
C:\Windows\System\VHLKBFL.exe

Filesize
1.9MB

MD5
c0000a7f440ee12d13271837ccdadacd

SHA1
1c0b82a5eb7bacef8aca179e6eb14c988157a85e

SHA256
b22be81f5c4d2722f8b96bbddf09d432ea772bf963ff526da8895bab06aee663

SHA512
99e9aa21f04dc74656d21027332b2b0d856d4e17388c601d08b2635cad1d49198fa0f7495d0bdb5ead405b5f5be335c4711309ed05dd870eb1b74c3967ee2fd0

Download Submit
C:\Windows\System\YpgNjoP.exe

Filesize
1.9MB

MD5
0f395a3d4d5e98fab5e3e4392b021297

SHA1
bb4611d2801db49b295f1b7bd43b1cb49cec69fc

SHA256
1bf3466bd3cd2fcef3b71b2eb7f679bf7533a50dd23e6e1330e4562d7b0f5ced

SHA512
716bef87166448bef0f72343503002557b0fd339d95ee7e6049d440cf5e85bc363a78b3c0f82a4d168bec600f792aa8f559f7dc61ab433a7f6d3dee68c4bf8d3

Download Submit
C:\Windows\System\ZGCDXBc.exe

Filesize
18B

MD5
12d764af0242c5e9d5789b2b47191cab

SHA1
27c955d8895a3dd74067d2c8c2ddd4db89461025

SHA256
22fad68840942c3468f5bd85214408fef29e825f9fa4402f948647dd9bfcfbbf

SHA512
345f6542208a71772d6f12acd8a7a946bff3a5b0364922fdfdbb97f70b74edd2676762bb63e6f4b3817ce1c84a3d722837cfba2c47e6d30027d13c7c41912d58

Download Submit
C:\Windows\System\eEVyXMn.exe

Filesize
1.9MB

MD5
5cad527cd16e3edd676901eda7992cf1

SHA1
5167aa02202923f92c7b457f7a308def4808fc55

SHA256
7f2cd378b6eacf9519f2cf3d246d272207551b5981c0f8e967bb7e828e956440

SHA512
d07cc2eca668565921e865538a6a9d1ab88f16a1993c18a01d973a6c63c04c320763231f428bc9be925d80bcd77a19aee69a5ac7b5860f913c3722f10e0f4a28

Download Submit
C:\Windows\System\gKTJdHI.exe

Filesize
1.9MB

MD5
e654550fa1c8ada72f0d64d8ab5010e2

SHA1
bf6a1beb2ccd4fb3a54ead5f476c1ae400215b55

SHA256
7dd202adeb5fa46bef7e09c416b4d994a855f31747eb5fec74020e6027737039

SHA512
fcc3ff4a7c1fdb2730193dfb48d5aa096166073166b974b3689a439a25412cd7298d54d76c8401ec00fcfe4c5fda92a83a83115e96912f9cc3b247b8eb29cc63

Download Submit
C:\Windows\System\gYgKsnU.exe

Filesize
1.9MB

MD5
8bb9d0f72bf90f96be6390f10002d5f3

SHA1
14b3666cb2d1d30c94ad1292ed58cb55fbd8caec

SHA256
99f3c27ad9b42fb93048af56957fa666039f243de1873b0fc32bd6da1cace4d5

SHA512
1e0f25c13e1ecc280d66d94b9c488ca21bac2b1d6f81298d2d75f2a55d7dc61ac1dc9a454332952bb3a80023ed352598619dadeddf5657215e87b942eeec8faa

Download Submit
C:\Windows\System\hlQxAQK.exe

Filesize
1.9MB

MD5
ee7c326f769668cf90830eda050101cc

SHA1
e66462e36e801f297580e708d41847ad3c23d9ba

SHA256
097e4ac52c4c16b4a486da7b407385654cdb5f002c0e4ef6478e3e4c210164d8

SHA512
f122b2a826240030f6c6c7e6004ddc6bbfc3dd0d2fcbe42b2c485f20ee90b81ddd1889e5b8feb00647f45256e1f2b74d3600e035cdf92065e4dc435c2803058e

Download Submit
C:\Windows\System\jNTRWlB.exe

Filesize
1.9MB

MD5
98ff95944682ea218214041fef4ec74d

SHA1
466e36ab324667b7c41abd4324bafed2f5b2a2a3

SHA256
a87187b63119135b044bc130ce0f31be175b0cc62913230d149df28cf80debb0

SHA512
365874086ded1f0012ecc596187a97cb16fa0ee505975275985ee090755f83570e2f38fa419039a8522d5827a9d8410db71f26adaaf107e65bec94f1e899a2bb

Download Submit
C:\Windows\System\jSQYuHO.exe

Filesize
1.9MB

MD5
ca0b43c0f3557f467b761b2784af45db

SHA1
9dc77f27e90f3967aca76e5511ed2758ffa54e06

SHA256
810cce553e4c8c090f3d17217d7a258ff6810471d81984f7c3587f9f6d0ab785

SHA512
7a339764e93592c2f4ab498162fedf386f42f325c8b32c1760327e5d515aa6e17b1157fbefb810632873b36e00d431dd00b753dbdc9ba53b856c055ff0d36f7d

Download Submit
C:\Windows\System\knNYVuE.exe

Filesize
1.9MB

MD5
7ef6132aa09cad1b45581c56596c9c31

SHA1
f0a3cddfa71d60dd73d948122bddf8eb6fd2948c

SHA256
0fe8e4831df2c39b19e6f259ea05960cd891184aa1a6060b477d4a5e74851b22

SHA512
755c934f4931fafd9f4d455a6f6fbc893fa131b6937939d9de2846be8d891ad086ccea363bbf7b96d1a902d58fc75ad69e866700b0853d5348d0f98ee6fce4bd

Download Submit
C:\Windows\System\nklexzS.exe

Filesize
1.9MB

MD5
7c0e039814a8cdd03008584fab526454

SHA1
15e9c6fbd5472751cb4732a11cdf5b1be162d766

SHA256
efc2cbb1b27607419e417d81a4efb7162b0917a91183fd30df6109da997ad5f3

SHA512
c4e0da82d6e5d220a5ca81586ee9d26119dbd1c8871d99bd75f62fd47318d701c441ee4cff044a5f1276125082ccd0effa2e7b50ff585193b5ea29493c7c7fe4

Download Submit
C:\Windows\System\pBBkCFP.exe

Filesize
1.9MB

MD5
cae1656bd0b7019a5024967b2b97ac65

SHA1
097d3ae8beb255cc3f227e8450137e50370cafc1

SHA256
90be30d5ccbcc5c299a454edc2b5598009464b72895dc58bad3d1af76ceb2af8

SHA512
de7f8dcbe4e5b6b666ee8b1cc29ccb3bb9456238febc18c2a01595666787155d7c097b5212170f821103e30aa073797d918f77133b10c01bdd512817ad386e46

Download Submit
C:\Windows\System\pmGAIij.exe

Filesize
1.9MB

MD5
9a9aa3f6fe8c026c9799b7c98d62b5ce

SHA1
ca941636c14b10aa4c849b3f9bd482faf556de41

SHA256
1c34009ead43850c112d9e59b73342ab38d15061da39d3e55f257ccbbbfbf738

SHA512
6cd0782492f13d6a22366a1dfe34361a8ba74f6803c5cd14f70ffa21ef5d4695549b082da9513cc80c551ec4808fcd6c533fbd1885deaffae1558831546b32be

Download Submit
C:\Windows\System\qXtLxKh.exe

Filesize
1.9MB

MD5
0eca53929c1aeafa30bdc57b04585502

SHA1
9d514f7507fb334deac4e84854e03dac29f2819d

SHA256
3394e76d0edd1ee3fdf139ddbf1dceaa0f0be417f1c2f48d8dae9b9977ecb052

SHA512
2acfb3975c9aa241c76dc9c5aa2e85e0eb9c5d427bb7edc56bce42da53cdcf076f71b707fc22b1b5264fa1db1c8f133620dfba99c22787d9c853f4c35496f8ad

Download Submit
C:\Windows\System\rIGeCHH.exe

Filesize
1.9MB

MD5
4c1a3c338c677ba31555c1ea93dde694

SHA1
d6f8e419e7baab3a8cfa4e4073356363b52610b1

SHA256
d9783614ac1beb1872501b57a4af698fe8d051190aedb779c2f7de7fcaa73083

SHA512
e21bf30cdb827964b107e5c616d4affc93a7e171f99088070d588f44161b37a88793583e10cf143c80aee834788dedf111bb56ac8de6f3a1c222b6eb78c403e3

Download Submit
C:\Windows\System\tFHjPJz.exe

Filesize
1.9MB

MD5
c63a785251d607f03f2ed8a5b193fb13

SHA1
ba46c09584bb612a7953f7ff14c9fe8542f23bbd

SHA256
eaf55c21f137ac8c56241754477ba4cb7b1a2d1ec33efa0bc802cacc4b9a50d7

SHA512
79c589d1eac61b216cbdd25360323f98ca972e8fe450fba93051abbcb2616763de46f7e0c6aadae5de77ba1a87a2bd0c875a44feebc7d20dc5d63937074957ca

Download Submit
C:\Windows\System\vdubOTV.exe

Filesize
1.9MB

MD5
915641a51fef88476e909ef2982cda9e

SHA1
2e2a130aa94924f4e463a4af50fa3f11240cb1b7

SHA256
16af181cebf8d46690ea378d36486fc2ebf8cd9ea111989f15e93f086213c5a0

SHA512
187a9ef5a4882da20c71193e9c762af21ced15e700e02e4d75ff2486ce1b72534cf0f1ad7f643bcdacdd79094b2b7c4bdc5a776776f23211a2c4d778ba817421

Download Submit
C:\Windows\System\wjZZfNH.exe

Filesize
1.9MB

MD5
da03ed76744dd22fad27b50e4770aba1

SHA1
945258a0a5062c475a021151fe7909d477128da0

SHA256
7725bfc07115b0340b434a02b8881255ab8e9feb70fb946679f21afbef504eff

SHA512
95303f4970fafb3cb6e10899d3ec12b94203e452d0c558a4037604dc8e221ac3fea7e073fa72599a7f27868d2b1daa589ae3cb3261595bb80e3ac5d1758382d6

Download Submit
C:\Windows\System\xwiCNCO.exe

Filesize
1.9MB

MD5
e26cd8b96c53aecbd1616ea160dbc095

SHA1
a50ffa70beb7f5dfbc7af483fff3b6eb39398bcc

SHA256
087198440e40a5d851d25df9fbcbdf9257e65d54f0be9624a330025816bb27b5

SHA512
50cad8256561ad657f41062efd70bf320af31384f98f4f0f8df5ee34ab8f2d70cc382823f49a40c1f8d6e26285d8cf401a8d05f4f094d75a117b76faf3798b65

Download Submit
C:\Windows\System\ySBYhnU.exe

Filesize
1.9MB

MD5
520b9394cf8cf60c91f650a53e523118

SHA1
fa914c0121b337f3fd96e94b5ce945738df5538e

SHA256
14785678349303ec2233a36791bab19e0acd4ed34fd1b53303076b94680fe951

SHA512
225c69cb369fa5998b8aacba8afc5ae79d71be826430161d7cded6a1308c845c81cf01e0b47a195d6249c6f7a7aa8a0734ba87f2264a251ea9f84bba6c5a29c0

Download Submit
memory/436-553-0x00007FF6F2320000-0x00007FF6F2712000-memory.dmp

Filesize
3.9MB

Download
memory/436-6708-0x00007FF6F2320000-0x00007FF6F2712000-memory.dmp

Filesize
3.9MB

Download
memory/876-406-0x00007FF605420000-0x00007FF605812000-memory.dmp

Filesize
3.9MB

Download
memory/876-6693-0x00007FF605420000-0x00007FF605812000-memory.dmp

Filesize
3.9MB

Download
memory/2000-27-0x00007FF7E2540000-0x00007FF7E2932000-memory.dmp

Filesize
3.9MB

Download
memory/2000-6629-0x00007FF7E2540000-0x00007FF7E2932000-memory.dmp

Filesize
3.9MB

Download
memory/2416-9-0x00007FF6DBDA0000-0x00007FF6DC192000-memory.dmp

Filesize
3.9MB

Download
memory/2416-6596-0x00007FF6DBDA0000-0x00007FF6DC192000-memory.dmp

Filesize
3.9MB

Download
memory/2432-198-0x00007FF76EFD0000-0x00007FF76F3C2000-memory.dmp

Filesize
3.9MB

Download
memory/2432-6682-0x00007FF76EFD0000-0x00007FF76F3C2000-memory.dmp

Filesize
3.9MB

Download
memory/2632-443-0x00007FF7EF8F0000-0x00007FF7EFCE2000-memory.dmp

Filesize
3.9MB

Download
memory/2644-6797-0x00007FF76F800000-0x00007FF76FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/2644-506-0x00007FF76F800000-0x00007FF76FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/2764-6612-0x00007FF654150000-0x00007FF654542000-memory.dmp

Filesize
3.9MB

Download
memory/2764-23-0x00007FF654150000-0x00007FF654542000-memory.dmp

Filesize
3.9MB

Download
memory/2856-79-0x00007FFD7D5F0000-0x00007FFD7E0B1000-memory.dmp

Filesize
10.8MB

Download
memory/2856-251-0x000002833A9D0000-0x000002833A9F2000-memory.dmp

Filesize
136KB

Download
memory/2856-216-0x00007FFD7D5F0000-0x00007FFD7E0B1000-memory.dmp

Filesize
10.8MB

Download
memory/2856-40-0x00007FFD7D5F3000-0x00007FFD7D5F5000-memory.dmp

Filesize
8KB

Download
memory/2864-731-0x00007FF627480000-0x00007FF627872000-memory.dmp

Filesize
3.9MB

Download
memory/3064-293-0x00007FF75D6C0000-0x00007FF75DAB2000-memory.dmp

Filesize
3.9MB

Download
memory/3064-6697-0x00007FF75D6C0000-0x00007FF75DAB2000-memory.dmp

Filesize
3.9MB

Download
memory/3208-440-0x00007FF68F420000-0x00007FF68F812000-memory.dmp

Filesize
3.9MB

Download
memory/3208-6704-0x00007FF68F420000-0x00007FF68F812000-memory.dmp

Filesize
3.9MB

Download
memory/3748-6804-0x00007FF632EE0000-0x00007FF6332D2000-memory.dmp

Filesize
3.9MB

Download
memory/3748-382-0x00007FF632EE0000-0x00007FF6332D2000-memory.dmp

Filesize
3.9MB

Download
memory/3756-330-0x00007FF6DDB50000-0x00007FF6DDF42000-memory.dmp

Filesize
3.9MB

Download
memory/3756-6730-0x00007FF6DDB50000-0x00007FF6DDF42000-memory.dmp

Filesize
3.9MB

Download
memory/3760-6678-0x00007FF68C8E0000-0x00007FF68CCD2000-memory.dmp

Filesize
3.9MB

Download
memory/3760-126-0x00007FF68C8E0000-0x00007FF68CCD2000-memory.dmp

Filesize
3.9MB

Download
memory/3804-6711-0x00007FF64EA90000-0x00007FF64EE82000-memory.dmp

Filesize
3.9MB

Download
memory/3804-550-0x00007FF64EA90000-0x00007FF64EE82000-memory.dmp

Filesize
3.9MB

Download
memory/4184-103-0x00007FF615E70000-0x00007FF616262000-memory.dmp

Filesize
3.9MB

Download
memory/4184-6672-0x00007FF615E70000-0x00007FF616262000-memory.dmp

Filesize
3.9MB

Download
memory/4340-0-0x00007FF694020000-0x00007FF694412000-memory.dmp

Filesize
3.9MB

Download
memory/4340-1-0x0000022BAC1A0000-0x0000022BAC1B0000-memory.dmp

Filesize
64KB

Download
memory/4460-383-0x00007FF6CBFE0000-0x00007FF6CC3D2000-memory.dmp

Filesize
3.9MB

Download
memory/4460-6775-0x00007FF6CBFE0000-0x00007FF6CC3D2000-memory.dmp

Filesize
3.9MB

Download
memory/4596-263-0x00007FF65F9C0000-0x00007FF65FDB2000-memory.dmp

Filesize
3.9MB

Download
memory/4684-17-0x00007FF6B84B0000-0x00007FF6B88A2000-memory.dmp

Filesize
3.9MB

Download
memory/4684-6599-0x00007FF6B84B0000-0x00007FF6B88A2000-memory.dmp

Filesize
3.9MB

Download
memory/4700-165-0x00007FF754760000-0x00007FF754B52000-memory.dmp

Filesize
3.9MB

Download
memory/4700-6659-0x00007FF754760000-0x00007FF754B52000-memory.dmp

Filesize
3.9MB

Download
memory/4748-294-0x00007FF7D3810000-0x00007FF7D3C02000-memory.dmp

Filesize
3.9MB

Download
memory/4748-6814-0x00007FF7D3810000-0x00007FF7D3C02000-memory.dmp

Filesize
3.9MB

Download
memory/4988-734-0x00007FF71FFF0000-0x00007FF7203E2000-memory.dmp

Filesize
3.9MB

Download
memory/4992-6703-0x00007FF6969E0000-0x00007FF696DD2000-memory.dmp

Filesize
3.9MB

Download
memory/4992-234-0x00007FF6969E0000-0x00007FF696DD2000-memory.dmp

Filesize
3.9MB

Download
memory/5072-6657-0x00007FF675C80000-0x00007FF676072000-memory.dmp

Filesize
3.9MB

Download
memory/5072-614-0x00007FF675C80000-0x00007FF676072000-memory.dmp

Filesize
3.9MB

Download