xmrig | fcb627b34106a423ded1bd6ed9559bc44bce5642c77396d94b0bfc6ffddace65

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 16:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
Size

1.8MB
MD5

012bac22bb1281e6a51d34af97acc8c3
SHA1

edfd02b699577a3c1ef62a732d99226499d46917
SHA256

fcb627b34106a423ded1bd6ed9559bc44bce5642c77396d94b0bfc6ffddace65
SHA512

dde3a41a76184eb63d77ffcd5d1826ce9558a0799910cdf68863cbc64ae136a5fac5282addefa26f61ef1d43ee82dfdc983f823e663e2313cc716947485271e3
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrltI:NABF

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 23 IoCs

miner

resource	yara_rule
behavioral2/memory/2248-126-0x00007FF7604B0000-0x00007FF7608A2000-memory.dmp	xmrig
behavioral2/memory/3148-521-0x00007FF7E64B0000-0x00007FF7E68A2000-memory.dmp	xmrig
behavioral2/memory/3268-533-0x00007FF7EE180000-0x00007FF7EE572000-memory.dmp	xmrig
behavioral2/memory/4912-536-0x00007FF72B140000-0x00007FF72B532000-memory.dmp	xmrig
behavioral2/memory/4404-540-0x00007FF77B920000-0x00007FF77BD12000-memory.dmp	xmrig
behavioral2/memory/4020-544-0x00007FF638E90000-0x00007FF639282000-memory.dmp	xmrig
behavioral2/memory/3848-548-0x00007FF679F70000-0x00007FF67A362000-memory.dmp	xmrig
behavioral2/memory/3540-543-0x00007FF6F5E50000-0x00007FF6F6242000-memory.dmp	xmrig
behavioral2/memory/3508-539-0x00007FF761E90000-0x00007FF762282000-memory.dmp	xmrig
behavioral2/memory/5000-526-0x00007FF6ECA00000-0x00007FF6ECDF2000-memory.dmp	xmrig
behavioral2/memory/3972-127-0x00007FF67AFE0000-0x00007FF67B3D2000-memory.dmp	xmrig
behavioral2/memory/2356-125-0x00007FF6D8A40000-0x00007FF6D8E32000-memory.dmp	xmrig
behavioral2/memory/3028-115-0x00007FF6C5030000-0x00007FF6C5422000-memory.dmp	xmrig
behavioral2/memory/3884-100-0x00007FF72C5F0000-0x00007FF72C9E2000-memory.dmp	xmrig
behavioral2/memory/2636-95-0x00007FF706540000-0x00007FF706932000-memory.dmp	xmrig
behavioral2/memory/3812-94-0x00007FF6A73B0000-0x00007FF6A77A2000-memory.dmp	xmrig
behavioral2/memory/2328-87-0x00007FF7A0C70000-0x00007FF7A1062000-memory.dmp	xmrig
behavioral2/memory/1948-81-0x00007FF64B320000-0x00007FF64B712000-memory.dmp	xmrig
behavioral2/memory/2760-63-0x00007FF688390000-0x00007FF688782000-memory.dmp	xmrig
behavioral2/memory/748-52-0x00007FF7E4400000-0x00007FF7E47F2000-memory.dmp	xmrig
behavioral2/memory/3056-4162-0x00007FF75F370000-0x00007FF75F762000-memory.dmp	xmrig
behavioral2/memory/3972-5875-0x00007FF67AFE0000-0x00007FF67B3D2000-memory.dmp	xmrig
behavioral2/memory/4912-5965-0x00007FF72B140000-0x00007FF72B532000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3056	lioyUwy.exe
3028	kLNUVgV.exe
2356	AsSFyJg.exe
748	sckRHTh.exe
2760	nLZesKR.exe
1948	QGLWuZE.exe
2248	mVEpkNV.exe
2328	QyYUZRb.exe
3812	AxuDddo.exe
3972	XzvSjzx.exe
2636	ymDCnVv.exe
3148	BbOgcUT.exe
3884	nycfBKA.exe
5000	eBsPUZf.exe
3268	PFbhikZ.exe
4912	DThLnDB.exe
4020	SkzISHg.exe
3848	pfGqxow.exe
3508	cxAOONl.exe
4404	bYiFbOm.exe
3540	ukpaxPr.exe
3824	EIGkZrB.exe
4348	iawxxgu.exe
1220	YpdjEbK.exe
1944	bGyBpfo.exe
3132	JCFkdzg.exe
4920	kwsnRYP.exe
2984	lWbXoDv.exe
2256	iDGSGPo.exe
2184	BbRXgfV.exe
5024	kDbTtXf.exe
1912	UKtBwfZ.exe
4516	RRdAOJf.exe
2512	ovQdKLk.exe
2888	OdWXzWy.exe
1856	qNybIjP.exe
4036	uLuCqtt.exe
3552	UXbbVjO.exe
996	kDCAZZK.exe
4768	pJbRYYz.exe
4628	Yqohhzu.exe
4200	oclJAYt.exe
4360	vdbhjwW.exe
4504	eeAjPKo.exe
5100	FuJXzCO.exe
3752	UKZFSSf.exe
4600	cfsvKUj.exe
4852	XYdtvow.exe
2960	MhgELkS.exe
4140	Bjlkpto.exe
1920	IzaWyQg.exe
4716	QPyegbB.exe
3352	DzIPriV.exe
4196	JMGwMNM.exe
1228	MHOzhEu.exe
1204	hnqmOaj.exe
3672	DSndAlP.exe
2656	eAJWfRW.exe
436	pxpugWo.exe
3648	MOdMMoh.exe
4208	cTQgvXT.exe
3260	AzFEAcf.exe
1000	fGsLOXG.exe
4344	GGQJMFm.exe

UPX packed file 58 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3984-0-0x00007FF702200000-0x00007FF7025F2000-memory.dmp	upx
behavioral2/files/0x000b000000023b8b-5.dat	upx
behavioral2/files/0x000a000000023b90-7.dat	upx
behavioral2/memory/3056-14-0x00007FF75F370000-0x00007FF75F762000-memory.dmp	upx
behavioral2/files/0x000a000000023b91-27.dat	upx
behavioral2/files/0x000a000000023b92-48.dat	upx
behavioral2/files/0x000a000000023b96-58.dat	upx
behavioral2/files/0x000a000000023b9b-67.dat	upx
behavioral2/files/0x000a000000023b98-72.dat	upx
behavioral2/files/0x000a000000023b9c-92.dat	upx
behavioral2/files/0x000a000000023b9d-99.dat	upx
behavioral2/files/0x000a000000023b9e-104.dat	upx
behavioral2/memory/2248-126-0x00007FF7604B0000-0x00007FF7608A2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba1-134.dat	upx
behavioral2/files/0x000a000000023ba7-158.dat	upx
behavioral2/files/0x000a000000023ba8-171.dat	upx
behavioral2/files/0x000a000000023bab-186.dat	upx
behavioral2/memory/3148-521-0x00007FF7E64B0000-0x00007FF7E68A2000-memory.dmp	upx
behavioral2/memory/3268-533-0x00007FF7EE180000-0x00007FF7EE572000-memory.dmp	upx
behavioral2/memory/4912-536-0x00007FF72B140000-0x00007FF72B532000-memory.dmp	upx
behavioral2/memory/4404-540-0x00007FF77B920000-0x00007FF77BD12000-memory.dmp	upx
behavioral2/memory/4020-544-0x00007FF638E90000-0x00007FF639282000-memory.dmp	upx
behavioral2/memory/3848-548-0x00007FF679F70000-0x00007FF67A362000-memory.dmp	upx
behavioral2/memory/3540-543-0x00007FF6F5E50000-0x00007FF6F6242000-memory.dmp	upx
behavioral2/memory/3508-539-0x00007FF761E90000-0x00007FF762282000-memory.dmp	upx
behavioral2/memory/5000-526-0x00007FF6ECA00000-0x00007FF6ECDF2000-memory.dmp	upx
behavioral2/files/0x000a000000023bad-188.dat	upx
behavioral2/files/0x000a000000023bac-183.dat	upx
behavioral2/files/0x000a000000023baa-181.dat	upx
behavioral2/files/0x000a000000023ba9-176.dat	upx
behavioral2/files/0x000a000000023ba6-161.dat	upx
behavioral2/files/0x000a000000023ba5-153.dat	upx
behavioral2/files/0x000a000000023ba4-146.dat	upx
behavioral2/files/0x000a000000023ba3-144.dat	upx
behavioral2/files/0x000a000000023ba2-141.dat	upx
behavioral2/files/0x000a000000023ba0-132.dat	upx
behavioral2/files/0x000b000000023b8c-130.dat	upx
behavioral2/files/0x000a000000023b9f-128.dat	upx
behavioral2/memory/3972-127-0x00007FF67AFE0000-0x00007FF67B3D2000-memory.dmp	upx
behavioral2/memory/2356-125-0x00007FF6D8A40000-0x00007FF6D8E32000-memory.dmp	upx
behavioral2/files/0x000b000000023b99-122.dat	upx
behavioral2/memory/3028-115-0x00007FF6C5030000-0x00007FF6C5422000-memory.dmp	upx
behavioral2/memory/3884-100-0x00007FF72C5F0000-0x00007FF72C9E2000-memory.dmp	upx
behavioral2/memory/2636-95-0x00007FF706540000-0x00007FF706932000-memory.dmp	upx
behavioral2/files/0x000b000000023b9a-102.dat	upx
behavioral2/memory/3812-94-0x00007FF6A73B0000-0x00007FF6A77A2000-memory.dmp	upx
behavioral2/memory/2328-87-0x00007FF7A0C70000-0x00007FF7A1062000-memory.dmp	upx
behavioral2/memory/1948-81-0x00007FF64B320000-0x00007FF64B712000-memory.dmp	upx
behavioral2/files/0x000a000000023b95-64.dat	upx
behavioral2/memory/2760-63-0x00007FF688390000-0x00007FF688782000-memory.dmp	upx
behavioral2/files/0x000a000000023b94-62.dat	upx
behavioral2/files/0x000a000000023b93-55.dat	upx
behavioral2/memory/748-52-0x00007FF7E4400000-0x00007FF7E47F2000-memory.dmp	upx
behavioral2/files/0x000a000000023b97-51.dat	upx
behavioral2/files/0x000a000000023b8f-15.dat	upx
behavioral2/memory/3056-4162-0x00007FF75F370000-0x00007FF75F762000-memory.dmp	upx
behavioral2/memory/3972-5875-0x00007FF67AFE0000-0x00007FF67B3D2000-memory.dmp	upx
behavioral2/memory/4912-5965-0x00007FF72B140000-0x00007FF72B532000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\pjkzDNg.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\DyBKmur.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\WOdsQla.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\VocsQgj.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\NMIkKWL.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\ugqDsxT.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\hFROFtQ.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\NPjjZGD.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\phWKjog.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\VQBhpdg.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\KRbhanc.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\TUkvhPf.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\SEfxDuf.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\wNHpBsR.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\aXEkjJa.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\Dqfcjpg.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\GGkIIib.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\ZlJICqB.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\JgjsXBK.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\ykPIgkM.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\ludaFSd.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\OWATyMJ.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\lhSqxtV.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\qmLDdkS.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\rMqnOnH.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\nSVPguv.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\lWpQmfZ.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\AnSFvav.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\WOdhjHO.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\NnTJMuo.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\nRXPren.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\kEqqgBc.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\feyaxPf.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\WuLVwUB.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\dRZsQDf.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\FPRoUmZ.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\FXUKCTE.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\pLcFUJM.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\OOKPuac.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\skkXTgA.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\IfYDIzv.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\RuEAiUr.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\dajBGZW.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\INOctPk.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\JOCYxpn.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\bJeSTkR.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\EmuEgBf.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\djmbSbm.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\GCrOkgI.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\QoKviYJ.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\bTvXUdZ.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\AhbufEe.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\aAWEROr.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\dcGqqZA.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\ZkotFrS.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\gHYUeRS.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\TTfMEHE.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\FuqNuks.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\NyVRRJw.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\CsOfpVj.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\VcTbcHi.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\yHKbkRv.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\CJZjLuC.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
File created	C:\Windows\System\PigktGy.exe	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1764	powershell.exe
1764	powershell.exe
1764	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
Token: SeDebugPrivilege	1764	powershell.exe
Token: SeLockMemoryPrivilege	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3984 wrote to memory of 1764	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	84
PID 3984 wrote to memory of 1764	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	84
PID 3984 wrote to memory of 3056	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	85
PID 3984 wrote to memory of 3056	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	85
PID 3984 wrote to memory of 3028	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	86
PID 3984 wrote to memory of 3028	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	86
PID 3984 wrote to memory of 2356	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	87
PID 3984 wrote to memory of 2356	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	87
PID 3984 wrote to memory of 748	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	88
PID 3984 wrote to memory of 748	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	88
PID 3984 wrote to memory of 2760	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	89
PID 3984 wrote to memory of 2760	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	89
PID 3984 wrote to memory of 1948	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	90
PID 3984 wrote to memory of 1948	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	90
PID 3984 wrote to memory of 2248	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	91
PID 3984 wrote to memory of 2248	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	91
PID 3984 wrote to memory of 2328	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	92
PID 3984 wrote to memory of 2328	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	92
PID 3984 wrote to memory of 3972	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	93
PID 3984 wrote to memory of 3972	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	93
PID 3984 wrote to memory of 3812	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	94
PID 3984 wrote to memory of 3812	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	94
PID 3984 wrote to memory of 2636	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	95
PID 3984 wrote to memory of 2636	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	95
PID 3984 wrote to memory of 3148	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	96
PID 3984 wrote to memory of 3148	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	96
PID 3984 wrote to memory of 3884	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	97
PID 3984 wrote to memory of 3884	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	97
PID 3984 wrote to memory of 5000	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	98
PID 3984 wrote to memory of 5000	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	98
PID 3984 wrote to memory of 3268	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	99
PID 3984 wrote to memory of 3268	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	99
PID 3984 wrote to memory of 4912	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	100
PID 3984 wrote to memory of 4912	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	100
PID 3984 wrote to memory of 4020	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	101
PID 3984 wrote to memory of 4020	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	101
PID 3984 wrote to memory of 3848	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	102
PID 3984 wrote to memory of 3848	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	102
PID 3984 wrote to memory of 3508	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	103
PID 3984 wrote to memory of 3508	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	103
PID 3984 wrote to memory of 4404	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	104
PID 3984 wrote to memory of 4404	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	104
PID 3984 wrote to memory of 3540	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	105
PID 3984 wrote to memory of 3540	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	105
PID 3984 wrote to memory of 3824	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	106
PID 3984 wrote to memory of 3824	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	106
PID 3984 wrote to memory of 4348	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	107
PID 3984 wrote to memory of 4348	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	107
PID 3984 wrote to memory of 1220	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	108
PID 3984 wrote to memory of 1220	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	108
PID 3984 wrote to memory of 1944	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	109
PID 3984 wrote to memory of 1944	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	109
PID 3984 wrote to memory of 3132	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	110
PID 3984 wrote to memory of 3132	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	110
PID 3984 wrote to memory of 4920	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	111
PID 3984 wrote to memory of 4920	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	111
PID 3984 wrote to memory of 2984	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	112
PID 3984 wrote to memory of 2984	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	112
PID 3984 wrote to memory of 2256	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	113
PID 3984 wrote to memory of 2256	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	113
PID 3984 wrote to memory of 2184	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	114
PID 3984 wrote to memory of 2184	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	114
PID 3984 wrote to memory of 5024	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	115
PID 3984 wrote to memory of 5024	3984	012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\012bac22bb1281e6a51d34af97acc8c3_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1764
- C:\Windows\System\lioyUwy.exe
  C:\Windows\System\lioyUwy.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\kLNUVgV.exe
  C:\Windows\System\kLNUVgV.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\AsSFyJg.exe
  C:\Windows\System\AsSFyJg.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\sckRHTh.exe
  C:\Windows\System\sckRHTh.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\nLZesKR.exe
  C:\Windows\System\nLZesKR.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\QGLWuZE.exe
  C:\Windows\System\QGLWuZE.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\mVEpkNV.exe
  C:\Windows\System\mVEpkNV.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\QyYUZRb.exe
  C:\Windows\System\QyYUZRb.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\XzvSjzx.exe
  C:\Windows\System\XzvSjzx.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\AxuDddo.exe
  C:\Windows\System\AxuDddo.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\ymDCnVv.exe
  C:\Windows\System\ymDCnVv.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\BbOgcUT.exe
  C:\Windows\System\BbOgcUT.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\nycfBKA.exe
  C:\Windows\System\nycfBKA.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System\eBsPUZf.exe
  C:\Windows\System\eBsPUZf.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\PFbhikZ.exe
  C:\Windows\System\PFbhikZ.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\DThLnDB.exe
  C:\Windows\System\DThLnDB.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\SkzISHg.exe
  C:\Windows\System\SkzISHg.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\pfGqxow.exe
  C:\Windows\System\pfGqxow.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System\cxAOONl.exe
  C:\Windows\System\cxAOONl.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\bYiFbOm.exe
  C:\Windows\System\bYiFbOm.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\ukpaxPr.exe
  C:\Windows\System\ukpaxPr.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\EIGkZrB.exe
  C:\Windows\System\EIGkZrB.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\iawxxgu.exe
  C:\Windows\System\iawxxgu.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\YpdjEbK.exe
  C:\Windows\System\YpdjEbK.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\bGyBpfo.exe
  C:\Windows\System\bGyBpfo.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\JCFkdzg.exe
  C:\Windows\System\JCFkdzg.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\kwsnRYP.exe
  C:\Windows\System\kwsnRYP.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\lWbXoDv.exe
  C:\Windows\System\lWbXoDv.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\iDGSGPo.exe
  C:\Windows\System\iDGSGPo.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\BbRXgfV.exe
  C:\Windows\System\BbRXgfV.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\kDbTtXf.exe
  C:\Windows\System\kDbTtXf.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\UKtBwfZ.exe
  C:\Windows\System\UKtBwfZ.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\RRdAOJf.exe
  C:\Windows\System\RRdAOJf.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\ovQdKLk.exe
  C:\Windows\System\ovQdKLk.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\OdWXzWy.exe
  C:\Windows\System\OdWXzWy.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\qNybIjP.exe
  C:\Windows\System\qNybIjP.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\uLuCqtt.exe
  C:\Windows\System\uLuCqtt.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\UXbbVjO.exe
  C:\Windows\System\UXbbVjO.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\kDCAZZK.exe
  C:\Windows\System\kDCAZZK.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\pJbRYYz.exe
  C:\Windows\System\pJbRYYz.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\Yqohhzu.exe
  C:\Windows\System\Yqohhzu.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\oclJAYt.exe
  C:\Windows\System\oclJAYt.exe
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\System\vdbhjwW.exe
  C:\Windows\System\vdbhjwW.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\eeAjPKo.exe
  C:\Windows\System\eeAjPKo.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\FuJXzCO.exe
  C:\Windows\System\FuJXzCO.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\UKZFSSf.exe
  C:\Windows\System\UKZFSSf.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\cfsvKUj.exe
  C:\Windows\System\cfsvKUj.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\XYdtvow.exe
  C:\Windows\System\XYdtvow.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\MhgELkS.exe
  C:\Windows\System\MhgELkS.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\Bjlkpto.exe
  C:\Windows\System\Bjlkpto.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\IzaWyQg.exe
  C:\Windows\System\IzaWyQg.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\QPyegbB.exe
  C:\Windows\System\QPyegbB.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\DzIPriV.exe
  C:\Windows\System\DzIPriV.exe
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Windows\System\JMGwMNM.exe
  C:\Windows\System\JMGwMNM.exe
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Windows\System\MHOzhEu.exe
  C:\Windows\System\MHOzhEu.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\hnqmOaj.exe
  C:\Windows\System\hnqmOaj.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\DSndAlP.exe
  C:\Windows\System\DSndAlP.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\eAJWfRW.exe
  C:\Windows\System\eAJWfRW.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\pxpugWo.exe
  C:\Windows\System\pxpugWo.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\MOdMMoh.exe
  C:\Windows\System\MOdMMoh.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\cTQgvXT.exe
  C:\Windows\System\cTQgvXT.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\AzFEAcf.exe
  C:\Windows\System\AzFEAcf.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\fGsLOXG.exe
  C:\Windows\System\fGsLOXG.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\GGQJMFm.exe
  C:\Windows\System\GGQJMFm.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\KOgwFbj.exe
  C:\Windows\System\KOgwFbj.exe
  2⤵
  PID:2924
- C:\Windows\System\BYFeuRt.exe
  C:\Windows\System\BYFeuRt.exe
  2⤵
  PID:4436
- C:\Windows\System\OmdNOSa.exe
  C:\Windows\System\OmdNOSa.exe
  2⤵
  PID:3828
- C:\Windows\System\RXGvZkz.exe
  C:\Windows\System\RXGvZkz.exe
  2⤵
  PID:464
- C:\Windows\System\KGRTBuK.exe
  C:\Windows\System\KGRTBuK.exe
  2⤵
  PID:4448
- C:\Windows\System\MjRrNKb.exe
  C:\Windows\System\MjRrNKb.exe
  2⤵
  PID:2672
- C:\Windows\System\uDCwfUV.exe
  C:\Windows\System\uDCwfUV.exe
  2⤵
  PID:2240
- C:\Windows\System\yBEQMXQ.exe
  C:\Windows\System\yBEQMXQ.exe
  2⤵
  PID:2844
- C:\Windows\System\XIXAZJf.exe
  C:\Windows\System\XIXAZJf.exe
  2⤵
  PID:5148
- C:\Windows\System\ONjYSLp.exe
  C:\Windows\System\ONjYSLp.exe
  2⤵
  PID:5176
- C:\Windows\System\UXUwoRe.exe
  C:\Windows\System\UXUwoRe.exe
  2⤵
  PID:5204
- C:\Windows\System\STiYFPL.exe
  C:\Windows\System\STiYFPL.exe
  2⤵
  PID:5232
- C:\Windows\System\EyxYPtr.exe
  C:\Windows\System\EyxYPtr.exe
  2⤵
  PID:5260
- C:\Windows\System\UeFbRce.exe
  C:\Windows\System\UeFbRce.exe
  2⤵
  PID:5288
- C:\Windows\System\gMshFTr.exe
  C:\Windows\System\gMshFTr.exe
  2⤵
  PID:5316
- C:\Windows\System\auBeOlq.exe
  C:\Windows\System\auBeOlq.exe
  2⤵
  PID:5344
- C:\Windows\System\QGlFcbd.exe
  C:\Windows\System\QGlFcbd.exe
  2⤵
  PID:5372
- C:\Windows\System\QqOyYOM.exe
  C:\Windows\System\QqOyYOM.exe
  2⤵
  PID:5400
- C:\Windows\System\mbwFfjw.exe
  C:\Windows\System\mbwFfjw.exe
  2⤵
  PID:5428
- C:\Windows\System\XjdkdSV.exe
  C:\Windows\System\XjdkdSV.exe
  2⤵
  PID:5456
- C:\Windows\System\OQDrImP.exe
  C:\Windows\System\OQDrImP.exe
  2⤵
  PID:5484
- C:\Windows\System\NAXkKJX.exe
  C:\Windows\System\NAXkKJX.exe
  2⤵
  PID:5512
- C:\Windows\System\YkOAzdS.exe
  C:\Windows\System\YkOAzdS.exe
  2⤵
  PID:5540
- C:\Windows\System\XGtRKAj.exe
  C:\Windows\System\XGtRKAj.exe
  2⤵
  PID:5568
- C:\Windows\System\yjqaPrL.exe
  C:\Windows\System\yjqaPrL.exe
  2⤵
  PID:5596
- C:\Windows\System\XJqDxhh.exe
  C:\Windows\System\XJqDxhh.exe
  2⤵
  PID:5624
- C:\Windows\System\wXGjWYM.exe
  C:\Windows\System\wXGjWYM.exe
  2⤵
  PID:5652
- C:\Windows\System\FtbYxtr.exe
  C:\Windows\System\FtbYxtr.exe
  2⤵
  PID:5680
- C:\Windows\System\xxyRbNG.exe
  C:\Windows\System\xxyRbNG.exe
  2⤵
  PID:5708
- C:\Windows\System\yEiLwwj.exe
  C:\Windows\System\yEiLwwj.exe
  2⤵
  PID:5740
- C:\Windows\System\SkaOTTw.exe
  C:\Windows\System\SkaOTTw.exe
  2⤵
  PID:5764
- C:\Windows\System\YuDFgUZ.exe
  C:\Windows\System\YuDFgUZ.exe
  2⤵
  PID:5792
- C:\Windows\System\DsgDxxC.exe
  C:\Windows\System\DsgDxxC.exe
  2⤵
  PID:5820
- C:\Windows\System\zKxYiPW.exe
  C:\Windows\System\zKxYiPW.exe
  2⤵
  PID:5848
- C:\Windows\System\bYKoyUp.exe
  C:\Windows\System\bYKoyUp.exe
  2⤵
  PID:5876
- C:\Windows\System\MDgBwpK.exe
  C:\Windows\System\MDgBwpK.exe
  2⤵
  PID:5904
- C:\Windows\System\uBNGdtm.exe
  C:\Windows\System\uBNGdtm.exe
  2⤵
  PID:5932
- C:\Windows\System\oFZVbBO.exe
  C:\Windows\System\oFZVbBO.exe
  2⤵
  PID:5960
- C:\Windows\System\PMOJpSd.exe
  C:\Windows\System\PMOJpSd.exe
  2⤵
  PID:5988
- C:\Windows\System\pdomXPG.exe
  C:\Windows\System\pdomXPG.exe
  2⤵
  PID:6016
- C:\Windows\System\HZdxHoL.exe
  C:\Windows\System\HZdxHoL.exe
  2⤵
  PID:6044
- C:\Windows\System\yndAWNR.exe
  C:\Windows\System\yndAWNR.exe
  2⤵
  PID:6100
- C:\Windows\System\FgzPacB.exe
  C:\Windows\System\FgzPacB.exe
  2⤵
  PID:6124
- C:\Windows\System\jMxmkwj.exe
  C:\Windows\System\jMxmkwj.exe
  2⤵
  PID:6140
- C:\Windows\System\InnGkTa.exe
  C:\Windows\System\InnGkTa.exe
  2⤵
  PID:3032
- C:\Windows\System\uNsPWfw.exe
  C:\Windows\System\uNsPWfw.exe
  2⤵
  PID:928
- C:\Windows\System\mlYznIO.exe
  C:\Windows\System\mlYznIO.exe
  2⤵
  PID:452
- C:\Windows\System\mWwxHbx.exe
  C:\Windows\System\mWwxHbx.exe
  2⤵
  PID:388
- C:\Windows\System\fMqusdo.exe
  C:\Windows\System\fMqusdo.exe
  2⤵
  PID:3764
- C:\Windows\System\ykGRvkS.exe
  C:\Windows\System\ykGRvkS.exe
  2⤵
  PID:5188
- C:\Windows\System\AqHTmAV.exe
  C:\Windows\System\AqHTmAV.exe
  2⤵
  PID:5248
- C:\Windows\System\tbNFtFe.exe
  C:\Windows\System\tbNFtFe.exe
  2⤵
  PID:5308
- C:\Windows\System\cKmMMiR.exe
  C:\Windows\System\cKmMMiR.exe
  2⤵
  PID:5384
- C:\Windows\System\TobgUwL.exe
  C:\Windows\System\TobgUwL.exe
  2⤵
  PID:5444
- C:\Windows\System\VgJcIYh.exe
  C:\Windows\System\VgJcIYh.exe
  2⤵
  PID:5504
- C:\Windows\System\XFOwjFC.exe
  C:\Windows\System\XFOwjFC.exe
  2⤵
  PID:5580
- C:\Windows\System\dNFRGgw.exe
  C:\Windows\System\dNFRGgw.exe
  2⤵
  PID:5640
- C:\Windows\System\UtdMcwb.exe
  C:\Windows\System\UtdMcwb.exe
  2⤵
  PID:5696
- C:\Windows\System\mfxOrjw.exe
  C:\Windows\System\mfxOrjw.exe
  2⤵
  PID:5760
- C:\Windows\System\cbDTNsQ.exe
  C:\Windows\System\cbDTNsQ.exe
  2⤵
  PID:5812
- C:\Windows\System\CSFxPsj.exe
  C:\Windows\System\CSFxPsj.exe
  2⤵
  PID:5888
- C:\Windows\System\snMegEN.exe
  C:\Windows\System\snMegEN.exe
  2⤵
  PID:5928
- C:\Windows\System\PbPPNAI.exe
  C:\Windows\System\PbPPNAI.exe
  2⤵
  PID:5976
- C:\Windows\System\uxBVOqS.exe
  C:\Windows\System\uxBVOqS.exe
  2⤵
  PID:6056
- C:\Windows\System\NNrwusa.exe
  C:\Windows\System\NNrwusa.exe
  2⤵
  PID:6064
- C:\Windows\System\OkHLBjx.exe
  C:\Windows\System\OkHLBjx.exe
  2⤵
  PID:6136
- C:\Windows\System\dXhPAyT.exe
  C:\Windows\System\dXhPAyT.exe
  2⤵
  PID:5096
- C:\Windows\System\MJstEPz.exe
  C:\Windows\System\MJstEPz.exe
  2⤵
  PID:1488
- C:\Windows\System\CIuutWv.exe
  C:\Windows\System\CIuutWv.exe
  2⤵
  PID:5164
- C:\Windows\System\yUntulT.exe
  C:\Windows\System\yUntulT.exe
  2⤵
  PID:1276
- C:\Windows\System\DqvPrUq.exe
  C:\Windows\System\DqvPrUq.exe
  2⤵
  PID:5360
- C:\Windows\System\sfJOiQQ.exe
  C:\Windows\System\sfJOiQQ.exe
  2⤵
  PID:3140
- C:\Windows\System\pBOiAYu.exe
  C:\Windows\System\pBOiAYu.exe
  2⤵
  PID:5616
- C:\Windows\System\ZbCfBka.exe
  C:\Windows\System\ZbCfBka.exe
  2⤵
  PID:5748
- C:\Windows\System\WFvtNVG.exe
  C:\Windows\System\WFvtNVG.exe
  2⤵
  PID:5860
- C:\Windows\System\uStxrNt.exe
  C:\Windows\System\uStxrNt.exe
  2⤵
  PID:3336
- C:\Windows\System\OxsZrwx.exe
  C:\Windows\System\OxsZrwx.exe
  2⤵
  PID:6076
- C:\Windows\System\pbezioy.exe
  C:\Windows\System\pbezioy.exe
  2⤵
  PID:2516
- C:\Windows\System\HecKlMW.exe
  C:\Windows\System\HecKlMW.exe
  2⤵
  PID:5140
- C:\Windows\System\VQqNncH.exe
  C:\Windows\System\VQqNncH.exe
  2⤵
  PID:956
- C:\Windows\System\xNvkcyr.exe
  C:\Windows\System\xNvkcyr.exe
  2⤵
  PID:4032
- C:\Windows\System\rAzoGkM.exe
  C:\Windows\System\rAzoGkM.exe
  2⤵
  PID:3364
- C:\Windows\System\JfCsiOH.exe
  C:\Windows\System\JfCsiOH.exe
  2⤵
  PID:2396
- C:\Windows\System\OzIHoJa.exe
  C:\Windows\System\OzIHoJa.exe
  2⤵
  PID:6008
- C:\Windows\System\DOTPqmq.exe
  C:\Windows\System\DOTPqmq.exe
  2⤵
  PID:6120
- C:\Windows\System\gYMNJej.exe
  C:\Windows\System\gYMNJej.exe
  2⤵
  PID:1260
- C:\Windows\System\ILYkHkM.exe
  C:\Windows\System\ILYkHkM.exe
  2⤵
  PID:3368
- C:\Windows\System\DsKlKOM.exe
  C:\Windows\System\DsKlKOM.exe
  2⤵
  PID:3088
- C:\Windows\System\DlBZllT.exe
  C:\Windows\System\DlBZllT.exe
  2⤵
  PID:6004
- C:\Windows\System\BORRYcL.exe
  C:\Windows\System\BORRYcL.exe
  2⤵
  PID:4560
- C:\Windows\System\SshnSFQ.exe
  C:\Windows\System\SshnSFQ.exe
  2⤵
  PID:4484
- C:\Windows\System\AAeNGpV.exe
  C:\Windows\System\AAeNGpV.exe
  2⤵
  PID:3436
- C:\Windows\System\mSsYmoY.exe
  C:\Windows\System\mSsYmoY.exe
  2⤵
  PID:5608
- C:\Windows\System\dWLTsbA.exe
  C:\Windows\System\dWLTsbA.exe
  2⤵
  PID:4088
- C:\Windows\System\TVVexRb.exe
  C:\Windows\System\TVVexRb.exe
  2⤵
  PID:3640
- C:\Windows\System\wIjhUWl.exe
  C:\Windows\System\wIjhUWl.exe
  2⤵
  PID:3220
- C:\Windows\System\DIHvwIC.exe
  C:\Windows\System\DIHvwIC.exe
  2⤵
  PID:3080
- C:\Windows\System\PPkWxLU.exe
  C:\Windows\System\PPkWxLU.exe
  2⤵
  PID:2016
- C:\Windows\System\QqrAwXQ.exe
  C:\Windows\System\QqrAwXQ.exe
  2⤵
  PID:6156
- C:\Windows\System\IOmzRWe.exe
  C:\Windows\System\IOmzRWe.exe
  2⤵
  PID:6196
- C:\Windows\System\ySZWqen.exe
  C:\Windows\System\ySZWqen.exe
  2⤵
  PID:6212
- C:\Windows\System\gyzzxtD.exe
  C:\Windows\System\gyzzxtD.exe
  2⤵
  PID:6232
- C:\Windows\System\gxpnNSN.exe
  C:\Windows\System\gxpnNSN.exe
  2⤵
  PID:6272
- C:\Windows\System\lvbysvw.exe
  C:\Windows\System\lvbysvw.exe
  2⤵
  PID:6308
- C:\Windows\System\FAXSXSJ.exe
  C:\Windows\System\FAXSXSJ.exe
  2⤵
  PID:6332
- C:\Windows\System\mpSjvDO.exe
  C:\Windows\System\mpSjvDO.exe
  2⤵
  PID:6352
- C:\Windows\System\rqMTAUs.exe
  C:\Windows\System\rqMTAUs.exe
  2⤵
  PID:6372
- C:\Windows\System\ydvOTtT.exe
  C:\Windows\System\ydvOTtT.exe
  2⤵
  PID:6420
- C:\Windows\System\xHPgUEG.exe
  C:\Windows\System\xHPgUEG.exe
  2⤵
  PID:6436
- C:\Windows\System\ORXewHH.exe
  C:\Windows\System\ORXewHH.exe
  2⤵
  PID:6460
- C:\Windows\System\XvHlpuT.exe
  C:\Windows\System\XvHlpuT.exe
  2⤵
  PID:6504
- C:\Windows\System\iXormuy.exe
  C:\Windows\System\iXormuy.exe
  2⤵
  PID:6524
- C:\Windows\System\VjYheVT.exe
  C:\Windows\System\VjYheVT.exe
  2⤵
  PID:6564
- C:\Windows\System\butiEEP.exe
  C:\Windows\System\butiEEP.exe
  2⤵
  PID:6580
- C:\Windows\System\NXGTJtq.exe
  C:\Windows\System\NXGTJtq.exe
  2⤵
  PID:6600
- C:\Windows\System\JazNycA.exe
  C:\Windows\System\JazNycA.exe
  2⤵
  PID:6628
- C:\Windows\System\JTpASlQ.exe
  C:\Windows\System\JTpASlQ.exe
  2⤵
  PID:6652
- C:\Windows\System\YIoiIKo.exe
  C:\Windows\System\YIoiIKo.exe
  2⤵
  PID:6672
- C:\Windows\System\lxxKvKN.exe
  C:\Windows\System\lxxKvKN.exe
  2⤵
  PID:6696
- C:\Windows\System\RJoSbVx.exe
  C:\Windows\System\RJoSbVx.exe
  2⤵
  PID:6724
- C:\Windows\System\VZaOsBb.exe
  C:\Windows\System\VZaOsBb.exe
  2⤵
  PID:6752
- C:\Windows\System\WRXqRCt.exe
  C:\Windows\System\WRXqRCt.exe
  2⤵
  PID:6768
- C:\Windows\System\jvXxAws.exe
  C:\Windows\System\jvXxAws.exe
  2⤵
  PID:6788
- C:\Windows\System\ykQnqbl.exe
  C:\Windows\System\ykQnqbl.exe
  2⤵
  PID:6812
- C:\Windows\System\gTExRVD.exe
  C:\Windows\System\gTExRVD.exe
  2⤵
  PID:6828
- C:\Windows\System\DanZgmg.exe
  C:\Windows\System\DanZgmg.exe
  2⤵
  PID:6860
- C:\Windows\System\JlZDigo.exe
  C:\Windows\System\JlZDigo.exe
  2⤵
  PID:6908
- C:\Windows\System\XWkASwp.exe
  C:\Windows\System\XWkASwp.exe
  2⤵
  PID:6928
- C:\Windows\System\GpVMQvD.exe
  C:\Windows\System\GpVMQvD.exe
  2⤵
  PID:6988
- C:\Windows\System\AyjvXdJ.exe
  C:\Windows\System\AyjvXdJ.exe
  2⤵
  PID:7008
- C:\Windows\System\IGnpevP.exe
  C:\Windows\System\IGnpevP.exe
  2⤵
  PID:7036
- C:\Windows\System\NUKgvNI.exe
  C:\Windows\System\NUKgvNI.exe
  2⤵
  PID:7060
- C:\Windows\System\uUqZsnY.exe
  C:\Windows\System\uUqZsnY.exe
  2⤵
  PID:7080
- C:\Windows\System\yJAvaeS.exe
  C:\Windows\System\yJAvaeS.exe
  2⤵
  PID:7100
- C:\Windows\System\AVNIUPZ.exe
  C:\Windows\System\AVNIUPZ.exe
  2⤵
  PID:7136
- C:\Windows\System\KuVAqyp.exe
  C:\Windows\System\KuVAqyp.exe
  2⤵
  PID:4296
- C:\Windows\System\WiZGreT.exe
  C:\Windows\System\WiZGreT.exe
  2⤵
  PID:6184
- C:\Windows\System\FIGiHOK.exe
  C:\Windows\System\FIGiHOK.exe
  2⤵
  PID:6264
- C:\Windows\System\UaPlfpM.exe
  C:\Windows\System\UaPlfpM.exe
  2⤵
  PID:6300
- C:\Windows\System\pNRXGMg.exe
  C:\Windows\System\pNRXGMg.exe
  2⤵
  PID:6340
- C:\Windows\System\pSsFiPm.exe
  C:\Windows\System\pSsFiPm.exe
  2⤵
  PID:6432
- C:\Windows\System\MdboXTw.exe
  C:\Windows\System\MdboXTw.exe
  2⤵
  PID:6472
- C:\Windows\System\hUTQhPf.exe
  C:\Windows\System\hUTQhPf.exe
  2⤵
  PID:6576
- C:\Windows\System\ljdLsXk.exe
  C:\Windows\System\ljdLsXk.exe
  2⤵
  PID:6608
- C:\Windows\System\kcNjfPo.exe
  C:\Windows\System\kcNjfPo.exe
  2⤵
  PID:6732
- C:\Windows\System\XnzCyqb.exe
  C:\Windows\System\XnzCyqb.exe
  2⤵
  PID:6680
- C:\Windows\System\JZidsth.exe
  C:\Windows\System\JZidsth.exe
  2⤵
  PID:6760
- C:\Windows\System\rSSkLCt.exe
  C:\Windows\System\rSSkLCt.exe
  2⤵
  PID:6848
- C:\Windows\System\xCVuSpC.exe
  C:\Windows\System\xCVuSpC.exe
  2⤵
  PID:6980
- C:\Windows\System\vEUvksp.exe
  C:\Windows\System\vEUvksp.exe
  2⤵
  PID:7044
- C:\Windows\System\fLREuZD.exe
  C:\Windows\System\fLREuZD.exe
  2⤵
  PID:7072
- C:\Windows\System\cJcISLk.exe
  C:\Windows\System\cJcISLk.exe
  2⤵
  PID:7132
- C:\Windows\System\LewRzZB.exe
  C:\Windows\System\LewRzZB.exe
  2⤵
  PID:6260
- C:\Windows\System\wsSOSXU.exe
  C:\Windows\System\wsSOSXU.exe
  2⤵
  PID:6596
- C:\Windows\System\jLploSk.exe
  C:\Windows\System\jLploSk.exe
  2⤵
  PID:6740
- C:\Windows\System\BEpEsDl.exe
  C:\Windows\System\BEpEsDl.exe
  2⤵
  PID:6824
- C:\Windows\System\uosFAva.exe
  C:\Windows\System\uosFAva.exe
  2⤵
  PID:6820
- C:\Windows\System\HQwtpQe.exe
  C:\Windows\System\HQwtpQe.exe
  2⤵
  PID:368
- C:\Windows\System\buczzSQ.exe
  C:\Windows\System\buczzSQ.exe
  2⤵
  PID:6228
- C:\Windows\System\hIpXVUE.exe
  C:\Windows\System\hIpXVUE.exe
  2⤵
  PID:6476
- C:\Windows\System\ysWbwAD.exe
  C:\Windows\System\ysWbwAD.exe
  2⤵
  PID:6712
- C:\Windows\System\TmNQyXt.exe
  C:\Windows\System\TmNQyXt.exe
  2⤵
  PID:7052
- C:\Windows\System\peeTJaO.exe
  C:\Windows\System\peeTJaO.exe
  2⤵
  PID:7192
- C:\Windows\System\jxvHLkc.exe
  C:\Windows\System\jxvHLkc.exe
  2⤵
  PID:7212
- C:\Windows\System\iVbgmbb.exe
  C:\Windows\System\iVbgmbb.exe
  2⤵
  PID:7232
- C:\Windows\System\ynUOBXf.exe
  C:\Windows\System\ynUOBXf.exe
  2⤵
  PID:7256
- C:\Windows\System\giVaKLG.exe
  C:\Windows\System\giVaKLG.exe
  2⤵
  PID:7272
- C:\Windows\System\SMnBkWG.exe
  C:\Windows\System\SMnBkWG.exe
  2⤵
  PID:7300
- C:\Windows\System\drHtanF.exe
  C:\Windows\System\drHtanF.exe
  2⤵
  PID:7348
- C:\Windows\System\yMdpONK.exe
  C:\Windows\System\yMdpONK.exe
  2⤵
  PID:7424
- C:\Windows\System\SyXKYwT.exe
  C:\Windows\System\SyXKYwT.exe
  2⤵
  PID:7460
- C:\Windows\System\YnLmeny.exe
  C:\Windows\System\YnLmeny.exe
  2⤵
  PID:7480
- C:\Windows\System\WlgKqFq.exe
  C:\Windows\System\WlgKqFq.exe
  2⤵
  PID:7512
- C:\Windows\System\EQGqaUU.exe
  C:\Windows\System\EQGqaUU.exe
  2⤵
  PID:7532
- C:\Windows\System\CJDLcyJ.exe
  C:\Windows\System\CJDLcyJ.exe
  2⤵
  PID:7564
- C:\Windows\System\KFqUYVm.exe
  C:\Windows\System\KFqUYVm.exe
  2⤵
  PID:7600
- C:\Windows\System\SKaFUfk.exe
  C:\Windows\System\SKaFUfk.exe
  2⤵
  PID:7620
- C:\Windows\System\iSZNIsc.exe
  C:\Windows\System\iSZNIsc.exe
  2⤵
  PID:7660
- C:\Windows\System\bKOCmpe.exe
  C:\Windows\System\bKOCmpe.exe
  2⤵
  PID:7684
- C:\Windows\System\ASBbAmj.exe
  C:\Windows\System\ASBbAmj.exe
  2⤵
  PID:7704
- C:\Windows\System\PGRjsZT.exe
  C:\Windows\System\PGRjsZT.exe
  2⤵
  PID:7728
- C:\Windows\System\EtoUqVf.exe
  C:\Windows\System\EtoUqVf.exe
  2⤵
  PID:7764
- C:\Windows\System\UzICMaz.exe
  C:\Windows\System\UzICMaz.exe
  2⤵
  PID:7784
- C:\Windows\System\wDjvSJT.exe
  C:\Windows\System\wDjvSJT.exe
  2⤵
  PID:7816
- C:\Windows\System\QgHlbpP.exe
  C:\Windows\System\QgHlbpP.exe
  2⤵
  PID:7840
- C:\Windows\System\ZrzbrpJ.exe
  C:\Windows\System\ZrzbrpJ.exe
  2⤵
  PID:7860
- C:\Windows\System\dtzPYhD.exe
  C:\Windows\System\dtzPYhD.exe
  2⤵
  PID:7908
- C:\Windows\System\OOpscwc.exe
  C:\Windows\System\OOpscwc.exe
  2⤵
  PID:7924
- C:\Windows\System\fnsgSKK.exe
  C:\Windows\System\fnsgSKK.exe
  2⤵
  PID:7948
- C:\Windows\System\QSiFGCF.exe
  C:\Windows\System\QSiFGCF.exe
  2⤵
  PID:7988
- C:\Windows\System\KGQNKNi.exe
  C:\Windows\System\KGQNKNi.exe
  2⤵
  PID:8004
- C:\Windows\System\EBMKtux.exe
  C:\Windows\System\EBMKtux.exe
  2⤵
  PID:8024
- C:\Windows\System\ihgBCJi.exe
  C:\Windows\System\ihgBCJi.exe
  2⤵
  PID:8044
- C:\Windows\System\fqNqjHY.exe
  C:\Windows\System\fqNqjHY.exe
  2⤵
  PID:8088
- C:\Windows\System\ouHqSAr.exe
  C:\Windows\System\ouHqSAr.exe
  2⤵
  PID:8132
- C:\Windows\System\mXjdrwH.exe
  C:\Windows\System\mXjdrwH.exe
  2⤵
  PID:8152
- C:\Windows\System\TtzihYk.exe
  C:\Windows\System\TtzihYk.exe
  2⤵
  PID:8184
- C:\Windows\System\qDKHANq.exe
  C:\Windows\System\qDKHANq.exe
  2⤵
  PID:7208
- C:\Windows\System\PBNJBXd.exe
  C:\Windows\System\PBNJBXd.exe
  2⤵
  PID:6452
- C:\Windows\System\SkGxScN.exe
  C:\Windows\System\SkGxScN.exe
  2⤵
  PID:7228
- C:\Windows\System\uwkfcqy.exe
  C:\Windows\System\uwkfcqy.exe
  2⤵
  PID:7280
- C:\Windows\System\FqcHMoi.exe
  C:\Windows\System\FqcHMoi.exe
  2⤵
  PID:7324
- C:\Windows\System\gBdsJVb.exe
  C:\Windows\System\gBdsJVb.exe
  2⤵
  PID:7476
- C:\Windows\System\mpnbpuR.exe
  C:\Windows\System\mpnbpuR.exe
  2⤵
  PID:7504
- C:\Windows\System\YweIkeE.exe
  C:\Windows\System\YweIkeE.exe
  2⤵
  PID:7560
- C:\Windows\System\afbyKjH.exe
  C:\Windows\System\afbyKjH.exe
  2⤵
  PID:7652
- C:\Windows\System\GzqXiEC.exe
  C:\Windows\System\GzqXiEC.exe
  2⤵
  PID:7696
- C:\Windows\System\uharWKQ.exe
  C:\Windows\System\uharWKQ.exe
  2⤵
  PID:7756
- C:\Windows\System\KzqcEWd.exe
  C:\Windows\System\KzqcEWd.exe
  2⤵
  PID:7812
- C:\Windows\System\EYjLFUa.exe
  C:\Windows\System\EYjLFUa.exe
  2⤵
  PID:7856
- C:\Windows\System\ROzWcXA.exe
  C:\Windows\System\ROzWcXA.exe
  2⤵
  PID:7888
- C:\Windows\System\XCgqftV.exe
  C:\Windows\System\XCgqftV.exe
  2⤵
  PID:7972
- C:\Windows\System\zMoFVpJ.exe
  C:\Windows\System\zMoFVpJ.exe
  2⤵
  PID:8000
- C:\Windows\System\QNkuTFo.exe
  C:\Windows\System\QNkuTFo.exe
  2⤵
  PID:8160
- C:\Windows\System\luyCLUL.exe
  C:\Windows\System\luyCLUL.exe
  2⤵
  PID:6428
- C:\Windows\System\qEFvEBc.exe
  C:\Windows\System\qEFvEBc.exe
  2⤵
  PID:6360
- C:\Windows\System\dPKajIc.exe
  C:\Windows\System\dPKajIc.exe
  2⤵
  PID:7556
- C:\Windows\System\PqQLaeZ.exe
  C:\Windows\System\PqQLaeZ.exe
  2⤵
  PID:7700
- C:\Windows\System\yxgXlrH.exe
  C:\Windows\System\yxgXlrH.exe
  2⤵
  PID:7892
- C:\Windows\System\hvQnHXa.exe
  C:\Windows\System\hvQnHXa.exe
  2⤵
  PID:7940
- C:\Windows\System\gYxmUCr.exe
  C:\Windows\System\gYxmUCr.exe
  2⤵
  PID:8144
- C:\Windows\System\gRkDWXy.exe
  C:\Windows\System\gRkDWXy.exe
  2⤵
  PID:7184
- C:\Windows\System\KkmSjNC.exe
  C:\Windows\System\KkmSjNC.exe
  2⤵
  PID:7404
- C:\Windows\System\zaQliyT.exe
  C:\Windows\System\zaQliyT.exe
  2⤵
  PID:7640
- C:\Windows\System\rIoFpaq.exe
  C:\Windows\System\rIoFpaq.exe
  2⤵
  PID:7852
- C:\Windows\System\gLbMyDG.exe
  C:\Windows\System\gLbMyDG.exe
  2⤵
  PID:7996
- C:\Windows\System\jULSAgI.exe
  C:\Windows\System\jULSAgI.exe
  2⤵
  PID:8244
- C:\Windows\System\tLgUBBU.exe
  C:\Windows\System\tLgUBBU.exe
  2⤵
  PID:8272
- C:\Windows\System\vOPhcLf.exe
  C:\Windows\System\vOPhcLf.exe
  2⤵
  PID:8296
- C:\Windows\System\SdFfoMH.exe
  C:\Windows\System\SdFfoMH.exe
  2⤵
  PID:8312
- C:\Windows\System\WULKQzS.exe
  C:\Windows\System\WULKQzS.exe
  2⤵
  PID:8340
- C:\Windows\System\kKxrLuU.exe
  C:\Windows\System\kKxrLuU.exe
  2⤵
  PID:8368
- C:\Windows\System\ETUYrmj.exe
  C:\Windows\System\ETUYrmj.exe
  2⤵
  PID:8384
- C:\Windows\System\vuOjgrV.exe
  C:\Windows\System\vuOjgrV.exe
  2⤵
  PID:8444
- C:\Windows\System\BkwpbER.exe
  C:\Windows\System\BkwpbER.exe
  2⤵
  PID:8476
- C:\Windows\System\RAMoVUl.exe
  C:\Windows\System\RAMoVUl.exe
  2⤵
  PID:8504
- C:\Windows\System\PdWiTmd.exe
  C:\Windows\System\PdWiTmd.exe
  2⤵
  PID:8544
- C:\Windows\System\GQkfokK.exe
  C:\Windows\System\GQkfokK.exe
  2⤵
  PID:8564
- C:\Windows\System\sYyzPpQ.exe
  C:\Windows\System\sYyzPpQ.exe
  2⤵
  PID:8596
- C:\Windows\System\HSWVQgS.exe
  C:\Windows\System\HSWVQgS.exe
  2⤵
  PID:8624
- C:\Windows\System\dxPnDfH.exe
  C:\Windows\System\dxPnDfH.exe
  2⤵
  PID:8640
- C:\Windows\System\NRiHOtx.exe
  C:\Windows\System\NRiHOtx.exe
  2⤵
  PID:8684
- C:\Windows\System\pYUUWSu.exe
  C:\Windows\System\pYUUWSu.exe
  2⤵
  PID:8700
- C:\Windows\System\tWXxyzc.exe
  C:\Windows\System\tWXxyzc.exe
  2⤵
  PID:8720
- C:\Windows\System\tEzVUlq.exe
  C:\Windows\System\tEzVUlq.exe
  2⤵
  PID:8748
- C:\Windows\System\WVQcojv.exe
  C:\Windows\System\WVQcojv.exe
  2⤵
  PID:8768
- C:\Windows\System\dEOiAgL.exe
  C:\Windows\System\dEOiAgL.exe
  2⤵
  PID:8788
- C:\Windows\System\sjNHjlw.exe
  C:\Windows\System\sjNHjlw.exe
  2⤵
  PID:8832
- C:\Windows\System\WTLJPaW.exe
  C:\Windows\System\WTLJPaW.exe
  2⤵
  PID:8848
- C:\Windows\System\xXEfBkC.exe
  C:\Windows\System\xXEfBkC.exe
  2⤵
  PID:8876
- C:\Windows\System\oWAFeGC.exe
  C:\Windows\System\oWAFeGC.exe
  2⤵
  PID:8904
- C:\Windows\System\OoRybrA.exe
  C:\Windows\System\OoRybrA.exe
  2⤵
  PID:8932
- C:\Windows\System\HwinCnB.exe
  C:\Windows\System\HwinCnB.exe
  2⤵
  PID:8956
- C:\Windows\System\UGgvroE.exe
  C:\Windows\System\UGgvroE.exe
  2⤵
  PID:8976
- C:\Windows\System\SEmAYZh.exe
  C:\Windows\System\SEmAYZh.exe
  2⤵
  PID:9000
- C:\Windows\System\qmucHhw.exe
  C:\Windows\System\qmucHhw.exe
  2⤵
  PID:9036
- C:\Windows\System\tpSAVQi.exe
  C:\Windows\System\tpSAVQi.exe
  2⤵
  PID:9076
- C:\Windows\System\WEsIKOL.exe
  C:\Windows\System\WEsIKOL.exe
  2⤵
  PID:9108
- C:\Windows\System\ElZSUAf.exe
  C:\Windows\System\ElZSUAf.exe
  2⤵
  PID:9128
- C:\Windows\System\EqDmYWE.exe
  C:\Windows\System\EqDmYWE.exe
  2⤵
  PID:9156
- C:\Windows\System\sdZnZBU.exe
  C:\Windows\System\sdZnZBU.exe
  2⤵
  PID:9184
- C:\Windows\System\IAqJqTP.exe
  C:\Windows\System\IAqJqTP.exe
  2⤵
  PID:9212
- C:\Windows\System\ZQicnaf.exe
  C:\Windows\System\ZQicnaf.exe
  2⤵
  PID:8112
- C:\Windows\System\GDkIUKI.exe
  C:\Windows\System\GDkIUKI.exe
  2⤵
  PID:8236
- C:\Windows\System\sVOcZMz.exe
  C:\Windows\System\sVOcZMz.exe
  2⤵
  PID:8280
- C:\Windows\System\abAsTKl.exe
  C:\Windows\System\abAsTKl.exe
  2⤵
  PID:8380
- C:\Windows\System\LuEWNZd.exe
  C:\Windows\System\LuEWNZd.exe
  2⤵
  PID:8404
- C:\Windows\System\SliLttD.exe
  C:\Windows\System\SliLttD.exe
  2⤵
  PID:8484
- C:\Windows\System\cdVydlx.exe
  C:\Windows\System\cdVydlx.exe
  2⤵
  PID:8592
- C:\Windows\System\fNjOhaQ.exe
  C:\Windows\System\fNjOhaQ.exe
  2⤵
  PID:8660
- C:\Windows\System\JZRLYUP.exe
  C:\Windows\System\JZRLYUP.exe
  2⤵
  PID:8696
- C:\Windows\System\fEhHwOI.exe
  C:\Windows\System\fEhHwOI.exe
  2⤵
  PID:8784
- C:\Windows\System\qubelvZ.exe
  C:\Windows\System\qubelvZ.exe
  2⤵
  PID:8868
- C:\Windows\System\ZUqqXiR.exe
  C:\Windows\System\ZUqqXiR.exe
  2⤵
  PID:8844
- C:\Windows\System\hICGkiZ.exe
  C:\Windows\System\hICGkiZ.exe
  2⤵
  PID:8948
- C:\Windows\System\lSyMEan.exe
  C:\Windows\System\lSyMEan.exe
  2⤵
  PID:8988
- C:\Windows\System\xRNPCxv.exe
  C:\Windows\System\xRNPCxv.exe
  2⤵
  PID:9100
- C:\Windows\System\jNojLwV.exe
  C:\Windows\System\jNojLwV.exe
  2⤵
  PID:9164
- C:\Windows\System\KZmuQyG.exe
  C:\Windows\System\KZmuQyG.exe
  2⤵
  PID:9204
- C:\Windows\System\kOXwMfM.exe
  C:\Windows\System\kOXwMfM.exe
  2⤵
  PID:8268
- C:\Windows\System\WpwwPoZ.exe
  C:\Windows\System\WpwwPoZ.exe
  2⤵
  PID:8500
- C:\Windows\System\HNgOdxV.exe
  C:\Windows\System\HNgOdxV.exe
  2⤵
  PID:8440
- C:\Windows\System\JcrgtAa.exe
  C:\Windows\System\JcrgtAa.exe
  2⤵
  PID:8636
- C:\Windows\System\wPSMqJp.exe
  C:\Windows\System\wPSMqJp.exe
  2⤵
  PID:8728
- C:\Windows\System\OrYWLNE.exe
  C:\Windows\System\OrYWLNE.exe
  2⤵
  PID:8804
- C:\Windows\System\XDIbchT.exe
  C:\Windows\System\XDIbchT.exe
  2⤵
  PID:9092
- C:\Windows\System\yWHxnOa.exe
  C:\Windows\System\yWHxnOa.exe
  2⤵
  PID:8488
- C:\Windows\System\OCxiNly.exe
  C:\Windows\System\OCxiNly.exe
  2⤵
  PID:8820
- C:\Windows\System\fVGQGXj.exe
  C:\Windows\System\fVGQGXj.exe
  2⤵
  PID:8376
- C:\Windows\System\NmDAcPz.exe
  C:\Windows\System\NmDAcPz.exe
  2⤵
  PID:8896
- C:\Windows\System\qAxnWru.exe
  C:\Windows\System\qAxnWru.exe
  2⤵
  PID:9228
- C:\Windows\System\tmMzUMx.exe
  C:\Windows\System\tmMzUMx.exe
  2⤵
  PID:9252
- C:\Windows\System\RlRRaUi.exe
  C:\Windows\System\RlRRaUi.exe
  2⤵
  PID:9272
- C:\Windows\System\WaCVNKK.exe
  C:\Windows\System\WaCVNKK.exe
  2⤵
  PID:9296
- C:\Windows\System\rRWEWJe.exe
  C:\Windows\System\rRWEWJe.exe
  2⤵
  PID:9356
- C:\Windows\System\OjkFQOK.exe
  C:\Windows\System\OjkFQOK.exe
  2⤵
  PID:9380
- C:\Windows\System\iessIHy.exe
  C:\Windows\System\iessIHy.exe
  2⤵
  PID:9400
- C:\Windows\System\YFxjRxJ.exe
  C:\Windows\System\YFxjRxJ.exe
  2⤵
  PID:9456
- C:\Windows\System\poiTIUD.exe
  C:\Windows\System\poiTIUD.exe
  2⤵
  PID:9480
- C:\Windows\System\QawTOuj.exe
  C:\Windows\System\QawTOuj.exe
  2⤵
  PID:9500
- C:\Windows\System\RvTGfvb.exe
  C:\Windows\System\RvTGfvb.exe
  2⤵
  PID:9528
- C:\Windows\System\OQmtPOe.exe
  C:\Windows\System\OQmtPOe.exe
  2⤵
  PID:9556
- C:\Windows\System\pbAwXpW.exe
  C:\Windows\System\pbAwXpW.exe
  2⤵
  PID:9576
- C:\Windows\System\FwDEyTS.exe
  C:\Windows\System\FwDEyTS.exe
  2⤵
  PID:9600
- C:\Windows\System\LcUlKZH.exe
  C:\Windows\System\LcUlKZH.exe
  2⤵
  PID:9620
- C:\Windows\System\EaSlQdO.exe
  C:\Windows\System\EaSlQdO.exe
  2⤵
  PID:9656
- C:\Windows\System\cfIadLK.exe
  C:\Windows\System\cfIadLK.exe
  2⤵
  PID:9676
- C:\Windows\System\hScsJZf.exe
  C:\Windows\System\hScsJZf.exe
  2⤵
  PID:9712
- C:\Windows\System\sTrGLdd.exe
  C:\Windows\System\sTrGLdd.exe
  2⤵
  PID:9736
- C:\Windows\System\zCslOzE.exe
  C:\Windows\System\zCslOzE.exe
  2⤵
  PID:9760
- C:\Windows\System\gdRgOdQ.exe
  C:\Windows\System\gdRgOdQ.exe
  2⤵
  PID:9800
- C:\Windows\System\xhPajZW.exe
  C:\Windows\System\xhPajZW.exe
  2⤵
  PID:9840
- C:\Windows\System\aDjZTOt.exe
  C:\Windows\System\aDjZTOt.exe
  2⤵
  PID:9956
- C:\Windows\System\OmfaZXm.exe
  C:\Windows\System\OmfaZXm.exe
  2⤵
  PID:10004
- C:\Windows\System\TAeZTfl.exe
  C:\Windows\System\TAeZTfl.exe
  2⤵
  PID:10024
- C:\Windows\System\IRJNzFC.exe
  C:\Windows\System\IRJNzFC.exe
  2⤵
  PID:10056
- C:\Windows\System\HwusQlQ.exe
  C:\Windows\System\HwusQlQ.exe
  2⤵
  PID:10080
- C:\Windows\System\qSZxmVY.exe
  C:\Windows\System\qSZxmVY.exe
  2⤵
  PID:10100
- C:\Windows\System\kxfEeDV.exe
  C:\Windows\System\kxfEeDV.exe
  2⤵
  PID:10120
- C:\Windows\System\BtqEAfS.exe
  C:\Windows\System\BtqEAfS.exe
  2⤵
  PID:10172
- C:\Windows\System\CefHtSH.exe
  C:\Windows\System\CefHtSH.exe
  2⤵
  PID:10192
- C:\Windows\System\BMllUkB.exe
  C:\Windows\System\BMllUkB.exe
  2⤵
  PID:10228
- C:\Windows\System\FTsVplz.exe
  C:\Windows\System\FTsVplz.exe
  2⤵
  PID:8308
- C:\Windows\System\OlzNVyS.exe
  C:\Windows\System\OlzNVyS.exe
  2⤵
  PID:9240
- C:\Windows\System\mMBzHmz.exe
  C:\Windows\System\mMBzHmz.exe
  2⤵
  PID:9396
- C:\Windows\System\UijnZOu.exe
  C:\Windows\System\UijnZOu.exe
  2⤵
  PID:9420
- C:\Windows\System\BLKkuff.exe
  C:\Windows\System\BLKkuff.exe
  2⤵
  PID:9540
- C:\Windows\System\OZIPQYk.exe
  C:\Windows\System\OZIPQYk.exe
  2⤵
  PID:9628
- C:\Windows\System\RzgviQN.exe
  C:\Windows\System\RzgviQN.exe
  2⤵
  PID:9612
- C:\Windows\System\AuNMFAA.exe
  C:\Windows\System\AuNMFAA.exe
  2⤵
  PID:9728
- C:\Windows\System\MdlnINv.exe
  C:\Windows\System\MdlnINv.exe
  2⤵
  PID:9772
- C:\Windows\System\dNUxybP.exe
  C:\Windows\System\dNUxybP.exe
  2⤵
  PID:9908
- C:\Windows\System\glnLosx.exe
  C:\Windows\System\glnLosx.exe
  2⤵
  PID:9856
- C:\Windows\System\OKfjErP.exe
  C:\Windows\System\OKfjErP.exe
  2⤵
  PID:9880
- C:\Windows\System\TsTBiJJ.exe
  C:\Windows\System\TsTBiJJ.exe
  2⤵
  PID:9928
- C:\Windows\System\FadDkFz.exe
  C:\Windows\System\FadDkFz.exe
  2⤵
  PID:9988
- C:\Windows\System\xiwMnSS.exe
  C:\Windows\System\xiwMnSS.exe
  2⤵
  PID:9992
- C:\Windows\System\faaNoRT.exe
  C:\Windows\System\faaNoRT.exe
  2⤵
  PID:10140
- C:\Windows\System\XlCdRVL.exe
  C:\Windows\System\XlCdRVL.exe
  2⤵
  PID:10160
- C:\Windows\System\uCHgymn.exe
  C:\Windows\System\uCHgymn.exe
  2⤵
  PID:10184
- C:\Windows\System\dQMLSpy.exe
  C:\Windows\System\dQMLSpy.exe
  2⤵
  PID:9376
- C:\Windows\System\ayDUsRs.exe
  C:\Windows\System\ayDUsRs.exe
  2⤵
  PID:9408
- C:\Windows\System\ZRmCixq.exe
  C:\Windows\System\ZRmCixq.exe
  2⤵
  PID:9592
- C:\Windows\System\nVaRDxz.exe
  C:\Windows\System\nVaRDxz.exe
  2⤵
  PID:9668
- C:\Windows\System\eKmUrDP.exe
  C:\Windows\System\eKmUrDP.exe
  2⤵
  PID:9932
- C:\Windows\System\AqmNWEB.exe
  C:\Windows\System\AqmNWEB.exe
  2⤵
  PID:9964
- C:\Windows\System\YSJkwGU.exe
  C:\Windows\System\YSJkwGU.exe
  2⤵
  PID:9996
- C:\Windows\System\dvQmpVq.exe
  C:\Windows\System\dvQmpVq.exe
  2⤵
  PID:10180
- C:\Windows\System\MvJZJZQ.exe
  C:\Windows\System\MvJZJZQ.exe
  2⤵
  PID:10236
- C:\Windows\System\NlEkzou.exe
  C:\Windows\System\NlEkzou.exe
  2⤵
  PID:8536
- C:\Windows\System\GLJmDlz.exe
  C:\Windows\System\GLJmDlz.exe
  2⤵
  PID:9836
- C:\Windows\System\pokefHk.exe
  C:\Windows\System\pokefHk.exe
  2⤵
  PID:10216
- C:\Windows\System\GZjBMpy.exe
  C:\Windows\System\GZjBMpy.exe
  2⤵
  PID:9752
- C:\Windows\System\bDZDhsL.exe
  C:\Windows\System\bDZDhsL.exe
  2⤵
  PID:10264
- C:\Windows\System\mqxQWyP.exe
  C:\Windows\System\mqxQWyP.exe
  2⤵
  PID:10284
- C:\Windows\System\cKAyEUR.exe
  C:\Windows\System\cKAyEUR.exe
  2⤵
  PID:10316
- C:\Windows\System\YaIJVGd.exe
  C:\Windows\System\YaIJVGd.exe
  2⤵
  PID:10356
- C:\Windows\System\UQOnaXe.exe
  C:\Windows\System\UQOnaXe.exe
  2⤵
  PID:10376
- C:\Windows\System\rHQqhVV.exe
  C:\Windows\System\rHQqhVV.exe
  2⤵
  PID:10400
- C:\Windows\System\lSNVAPz.exe
  C:\Windows\System\lSNVAPz.exe
  2⤵
  PID:10440
- C:\Windows\System\emPmeOH.exe
  C:\Windows\System\emPmeOH.exe
  2⤵
  PID:10464
- C:\Windows\System\OXRuQLg.exe
  C:\Windows\System\OXRuQLg.exe
  2⤵
  PID:10492
- C:\Windows\System\mOibccQ.exe
  C:\Windows\System\mOibccQ.exe
  2⤵
  PID:10512
- C:\Windows\System\SAkkaTC.exe
  C:\Windows\System\SAkkaTC.exe
  2⤵
  PID:10532
- C:\Windows\System\IztViFa.exe
  C:\Windows\System\IztViFa.exe
  2⤵
  PID:10568
- C:\Windows\System\ssLcjCn.exe
  C:\Windows\System\ssLcjCn.exe
  2⤵
  PID:10596
- C:\Windows\System\IJiWAcF.exe
  C:\Windows\System\IJiWAcF.exe
  2⤵
  PID:10616
- C:\Windows\System\vBKvMnV.exe
  C:\Windows\System\vBKvMnV.exe
  2⤵
  PID:10648
- C:\Windows\System\DIMYbNl.exe
  C:\Windows\System\DIMYbNl.exe
  2⤵
  PID:10668
- C:\Windows\System\ptblvtK.exe
  C:\Windows\System\ptblvtK.exe
  2⤵
  PID:10688
- C:\Windows\System\gZlGycB.exe
  C:\Windows\System\gZlGycB.exe
  2⤵
  PID:10720
- C:\Windows\System\XaRtNdU.exe
  C:\Windows\System\XaRtNdU.exe
  2⤵
  PID:10740
- C:\Windows\System\IRUbpZT.exe
  C:\Windows\System\IRUbpZT.exe
  2⤵
  PID:10768
- C:\Windows\System\zLrLhtU.exe
  C:\Windows\System\zLrLhtU.exe
  2⤵
  PID:10788
- C:\Windows\System\XfWXozL.exe
  C:\Windows\System\XfWXozL.exe
  2⤵
  PID:10812
- C:\Windows\System\ydIdhhD.exe
  C:\Windows\System\ydIdhhD.exe
  2⤵
  PID:10860
- C:\Windows\System\BuSTsbD.exe
  C:\Windows\System\BuSTsbD.exe
  2⤵
  PID:10900
- C:\Windows\System\bKPwAaq.exe
  C:\Windows\System\bKPwAaq.exe
  2⤵
  PID:10948
- C:\Windows\System\HRDtTIU.exe
  C:\Windows\System\HRDtTIU.exe
  2⤵
  PID:10976
- C:\Windows\System\gDxuvYZ.exe
  C:\Windows\System\gDxuvYZ.exe
  2⤵
  PID:10996
- C:\Windows\System\kCTkZGO.exe
  C:\Windows\System\kCTkZGO.exe
  2⤵
  PID:11020
- C:\Windows\System\vqrYFXa.exe
  C:\Windows\System\vqrYFXa.exe
  2⤵
  PID:11060
- C:\Windows\System\xLgGFHM.exe
  C:\Windows\System\xLgGFHM.exe
  2⤵
  PID:11076
- C:\Windows\System\YHjDrxI.exe
  C:\Windows\System\YHjDrxI.exe
  2⤵
  PID:11116
- C:\Windows\System\GqhIZyP.exe
  C:\Windows\System\GqhIZyP.exe
  2⤵
  PID:11136
- C:\Windows\System\CDrZMKH.exe
  C:\Windows\System\CDrZMKH.exe
  2⤵
  PID:11152
- C:\Windows\System\DSZnhLW.exe
  C:\Windows\System\DSZnhLW.exe
  2⤵
  PID:11200
- C:\Windows\System\iIzJDsu.exe
  C:\Windows\System\iIzJDsu.exe
  2⤵
  PID:11216
- C:\Windows\System\JYfCIDu.exe
  C:\Windows\System\JYfCIDu.exe
  2⤵
  PID:11252
- C:\Windows\System\MgjGYoz.exe
  C:\Windows\System\MgjGYoz.exe
  2⤵
  PID:9920
- C:\Windows\System\sDGNxOw.exe
  C:\Windows\System\sDGNxOw.exe
  2⤵
  PID:10276
- C:\Windows\System\fdyGvSv.exe
  C:\Windows\System\fdyGvSv.exe
  2⤵
  PID:10312
- C:\Windows\System\xwtQUil.exe
  C:\Windows\System\xwtQUil.exe
  2⤵
  PID:10396
- C:\Windows\System\ejcrJyL.exe
  C:\Windows\System\ejcrJyL.exe
  2⤵
  PID:10472
- C:\Windows\System\ZDUDttk.exe
  C:\Windows\System\ZDUDttk.exe
  2⤵
  PID:10500
- C:\Windows\System\etJgzbJ.exe
  C:\Windows\System\etJgzbJ.exe
  2⤵
  PID:10584
- C:\Windows\System\lSVvtgt.exe
  C:\Windows\System\lSVvtgt.exe
  2⤵
  PID:10612
- C:\Windows\System\wdmoQSX.exe
  C:\Windows\System\wdmoQSX.exe
  2⤵
  PID:10696
- C:\Windows\System\QrpDxBx.exe
  C:\Windows\System\QrpDxBx.exe
  2⤵
  PID:10728
- C:\Windows\System\sKvVKIm.exe
  C:\Windows\System\sKvVKIm.exe
  2⤵
  PID:10036
- C:\Windows\System\fVUkdPJ.exe
  C:\Windows\System\fVUkdPJ.exe
  2⤵
  PID:10796
- C:\Windows\System\tGskrLZ.exe
  C:\Windows\System\tGskrLZ.exe
  2⤵
  PID:10852
- C:\Windows\System\dMtLeMI.exe
  C:\Windows\System\dMtLeMI.exe
  2⤵
  PID:10960
- C:\Windows\System\uHwGILQ.exe
  C:\Windows\System\uHwGILQ.exe
  2⤵
  PID:11040
- C:\Windows\System\JYEjZdn.exe
  C:\Windows\System\JYEjZdn.exe
  2⤵
  PID:11208
- C:\Windows\System\nXKHqcw.exe
  C:\Windows\System\nXKHqcw.exe
  2⤵
  PID:11244
- C:\Windows\System\GoKfYrc.exe
  C:\Windows\System\GoKfYrc.exe
  2⤵
  PID:10296
- C:\Windows\System\mCAhBMK.exe
  C:\Windows\System\mCAhBMK.exe
  2⤵
  PID:10368
- C:\Windows\System\wsPQpoj.exe
  C:\Windows\System\wsPQpoj.exe
  2⤵
  PID:10484
- C:\Windows\System\tVlfWnN.exe
  C:\Windows\System\tVlfWnN.exe
  2⤵
  PID:10752
- C:\Windows\System\kiUHVjT.exe
  C:\Windows\System\kiUHVjT.exe
  2⤵
  PID:10992
- C:\Windows\System\FbRJCMQ.exe
  C:\Windows\System\FbRJCMQ.exe
  2⤵
  PID:11072
- C:\Windows\System\TijjRgE.exe
  C:\Windows\System\TijjRgE.exe
  2⤵
  PID:11188
- C:\Windows\System\JfvmKKX.exe
  C:\Windows\System\JfvmKKX.exe
  2⤵
  PID:10336
- C:\Windows\System\oRqoceP.exe
  C:\Windows\System\oRqoceP.exe
  2⤵
  PID:10684
- C:\Windows\System\wtsdfSe.exe
  C:\Windows\System\wtsdfSe.exe
  2⤵
  PID:10760
- C:\Windows\System\TdIujKy.exe
  C:\Windows\System\TdIujKy.exe
  2⤵
  PID:11284
- C:\Windows\System\ajINtsr.exe
  C:\Windows\System\ajINtsr.exe
  2⤵
  PID:11312
- C:\Windows\System\qSPQuaI.exe
  C:\Windows\System\qSPQuaI.exe
  2⤵
  PID:11372
- C:\Windows\System\RJEGoLN.exe
  C:\Windows\System\RJEGoLN.exe
  2⤵
  PID:11428
- C:\Windows\System\bFUkIng.exe
  C:\Windows\System\bFUkIng.exe
  2⤵
  PID:11452
- C:\Windows\System\sCmLLln.exe
  C:\Windows\System\sCmLLln.exe
  2⤵
  PID:11476
- C:\Windows\System\BgtWErZ.exe
  C:\Windows\System\BgtWErZ.exe
  2⤵
  PID:11500
- C:\Windows\System\JnARifz.exe
  C:\Windows\System\JnARifz.exe
  2⤵
  PID:11516
- C:\Windows\System\RqvRgcK.exe
  C:\Windows\System\RqvRgcK.exe
  2⤵
  PID:11540
- C:\Windows\System\wLWpxtq.exe
  C:\Windows\System\wLWpxtq.exe
  2⤵
  PID:11568
- C:\Windows\System\YugPjVp.exe
  C:\Windows\System\YugPjVp.exe
  2⤵
  PID:11588
- C:\Windows\System\qSHlgaO.exe
  C:\Windows\System\qSHlgaO.exe
  2⤵
  PID:11624
- C:\Windows\System\HlIGbOc.exe
  C:\Windows\System\HlIGbOc.exe
  2⤵
  PID:11652
- C:\Windows\System\xcUQsIe.exe
  C:\Windows\System\xcUQsIe.exe
  2⤵
  PID:11676
- C:\Windows\System\ekoRlUh.exe
  C:\Windows\System\ekoRlUh.exe
  2⤵
  PID:11700
- C:\Windows\System\qMnNUGs.exe
  C:\Windows\System\qMnNUGs.exe
  2⤵
  PID:11720
- C:\Windows\System\SLstbsF.exe
  C:\Windows\System\SLstbsF.exe
  2⤵
  PID:11736
- C:\Windows\System\pCZRiuu.exe
  C:\Windows\System\pCZRiuu.exe
  2⤵
  PID:11852
- C:\Windows\System\AVgOSyI.exe
  C:\Windows\System\AVgOSyI.exe
  2⤵
  PID:11868
- C:\Windows\System\ELuPFIq.exe
  C:\Windows\System\ELuPFIq.exe
  2⤵
  PID:11888
- C:\Windows\System\gxTaNaE.exe
  C:\Windows\System\gxTaNaE.exe
  2⤵
  PID:11912
- C:\Windows\System\NvuHhdl.exe
  C:\Windows\System\NvuHhdl.exe
  2⤵
  PID:11928
- C:\Windows\System\wdgfKAI.exe
  C:\Windows\System\wdgfKAI.exe
  2⤵
  PID:11948
- C:\Windows\System\jwWOaZb.exe
  C:\Windows\System\jwWOaZb.exe
  2⤵
  PID:11972
- C:\Windows\System\jKFKOTW.exe
  C:\Windows\System\jKFKOTW.exe
  2⤵
  PID:11988
- C:\Windows\System\IAlyBSN.exe
  C:\Windows\System\IAlyBSN.exe
  2⤵
  PID:12008
- C:\Windows\System\AoZzpay.exe
  C:\Windows\System\AoZzpay.exe
  2⤵
  PID:12032
- C:\Windows\System\bxorXJu.exe
  C:\Windows\System\bxorXJu.exe
  2⤵
  PID:12088
- C:\Windows\System\SFOcNoY.exe
  C:\Windows\System\SFOcNoY.exe
  2⤵
  PID:12104
- C:\Windows\System\viABksG.exe
  C:\Windows\System\viABksG.exe
  2⤵
  PID:12120
- C:\Windows\System\cJRgANg.exe
  C:\Windows\System\cJRgANg.exe
  2⤵
  PID:12168
- C:\Windows\System\AaWGwAe.exe
  C:\Windows\System\AaWGwAe.exe
  2⤵
  PID:12200
- C:\Windows\System\RjSeKrg.exe
  C:\Windows\System\RjSeKrg.exe
  2⤵
  PID:12224
- C:\Windows\System\rPzJHJl.exe
  C:\Windows\System\rPzJHJl.exe
  2⤵
  PID:12244
- C:\Windows\System\ZjPtcIt.exe
  C:\Windows\System\ZjPtcIt.exe
  2⤵
  PID:10252
- C:\Windows\System\pEzGygr.exe
  C:\Windows\System\pEzGygr.exe
  2⤵
  PID:10548
- C:\Windows\System\IujJwAo.exe
  C:\Windows\System\IujJwAo.exe
  2⤵
  PID:10556
- C:\Windows\System\VWvrkfa.exe
  C:\Windows\System\VWvrkfa.exe
  2⤵
  PID:11384
- C:\Windows\System\WbZokHP.exe
  C:\Windows\System\WbZokHP.exe
  2⤵
  PID:11400
- C:\Windows\System\xnVfBUl.exe
  C:\Windows\System\xnVfBUl.exe
  2⤵
  PID:11496
- C:\Windows\System\fqLtXPy.exe
  C:\Windows\System\fqLtXPy.exe
  2⤵
  PID:11528
- C:\Windows\System\ZGQlkRZ.exe
  C:\Windows\System\ZGQlkRZ.exe
  2⤵
  PID:11576
- C:\Windows\System\jWxHFaJ.exe
  C:\Windows\System\jWxHFaJ.exe
  2⤵
  PID:11644
- C:\Windows\System\qpCIBlh.exe
  C:\Windows\System\qpCIBlh.exe
  2⤵
  PID:11716
- C:\Windows\System\DJuXSHF.exe
  C:\Windows\System\DJuXSHF.exe
  2⤵
  PID:11804
- C:\Windows\System\IDVDtkR.exe
  C:\Windows\System\IDVDtkR.exe
  2⤵
  PID:11880
- C:\Windows\System\DWvTZqy.exe
  C:\Windows\System\DWvTZqy.exe
  2⤵
  PID:11956
- C:\Windows\System\jgmygYh.exe
  C:\Windows\System\jgmygYh.exe
  2⤵
  PID:11980
- C:\Windows\System\vVkyALd.exe
  C:\Windows\System\vVkyALd.exe
  2⤵
  PID:12100
- C:\Windows\System\hsHxwyf.exe
  C:\Windows\System\hsHxwyf.exe
  2⤵
  PID:12080
- C:\Windows\System\zBEgBkc.exe
  C:\Windows\System\zBEgBkc.exe
  2⤵
  PID:920
- C:\Windows\System\BvQQmHL.exe
  C:\Windows\System\BvQQmHL.exe
  2⤵
  PID:12164
- C:\Windows\System\drqGPKx.exe
  C:\Windows\System\drqGPKx.exe
  2⤵
  PID:12240
- C:\Windows\System\eYRrkBy.exe
  C:\Windows\System\eYRrkBy.exe
  2⤵
  PID:11132
- C:\Windows\System\fwlinHL.exe
  C:\Windows\System\fwlinHL.exe
  2⤵
  PID:10944
- C:\Windows\System\yeeoVmk.exe
  C:\Windows\System\yeeoVmk.exe
  2⤵
  PID:11444
- C:\Windows\System\BmkCDXJ.exe
  C:\Windows\System\BmkCDXJ.exe
  2⤵
  PID:11632
- C:\Windows\System\HXmYJnY.exe
  C:\Windows\System\HXmYJnY.exe
  2⤵
  PID:11848
- C:\Windows\System\VUlZclk.exe
  C:\Windows\System\VUlZclk.exe
  2⤵
  PID:12028
- C:\Windows\System\jTGhnoY.exe
  C:\Windows\System\jTGhnoY.exe
  2⤵
  PID:12096
- C:\Windows\System\rzqAAQM.exe
  C:\Windows\System\rzqAAQM.exe
  2⤵
  PID:10736
- C:\Windows\System\ltxdmmx.exe
  C:\Windows\System\ltxdmmx.exe
  2⤵
  PID:11412
- C:\Windows\System\BrOPWFT.exe
  C:\Windows\System\BrOPWFT.exe
  2⤵
  PID:11648
- C:\Windows\System\JrCPmcM.exe
  C:\Windows\System\JrCPmcM.exe
  2⤵
  PID:12136
- C:\Windows\System\jOVYiJw.exe
  C:\Windows\System\jOVYiJw.exe
  2⤵
  PID:12212
- C:\Windows\System\xEVijpO.exe
  C:\Windows\System\xEVijpO.exe
  2⤵
  PID:12116
- C:\Windows\System\ehGLfJI.exe
  C:\Windows\System\ehGLfJI.exe
  2⤵
  PID:12316
- C:\Windows\System\JwXMJgX.exe
  C:\Windows\System\JwXMJgX.exe
  2⤵
  PID:12340
- C:\Windows\System\yPCCZMv.exe
  C:\Windows\System\yPCCZMv.exe
  2⤵
  PID:12380
- C:\Windows\System\vABYCCe.exe
  C:\Windows\System\vABYCCe.exe
  2⤵
  PID:12404
- C:\Windows\System\ySyTdHD.exe
  C:\Windows\System\ySyTdHD.exe
  2⤵
  PID:12424
- C:\Windows\System\RGwYDvY.exe
  C:\Windows\System\RGwYDvY.exe
  2⤵
  PID:12448
- C:\Windows\System\PWBIPTK.exe
  C:\Windows\System\PWBIPTK.exe
  2⤵
  PID:12476
- C:\Windows\System\LdtDuAY.exe
  C:\Windows\System\LdtDuAY.exe
  2⤵
  PID:12492
- C:\Windows\System\mRjKUlG.exe
  C:\Windows\System\mRjKUlG.exe
  2⤵
  PID:12520
- C:\Windows\System\lAWPmDc.exe
  C:\Windows\System\lAWPmDc.exe
  2⤵
  PID:12548
- C:\Windows\System\UuhzmwB.exe
  C:\Windows\System\UuhzmwB.exe
  2⤵
  PID:12564
- C:\Windows\System\dkZCFIz.exe
  C:\Windows\System\dkZCFIz.exe
  2⤵
  PID:12588
- C:\Windows\System\LraRfHL.exe
  C:\Windows\System\LraRfHL.exe
  2⤵
  PID:12624
- C:\Windows\System\WdxGyeG.exe
  C:\Windows\System\WdxGyeG.exe
  2⤵
  PID:12660
- C:\Windows\System\QXXDNwC.exe
  C:\Windows\System\QXXDNwC.exe
  2⤵
  PID:12680
- C:\Windows\System\nxywKHB.exe
  C:\Windows\System\nxywKHB.exe
  2⤵
  PID:12704
- C:\Windows\System\dzthkLq.exe
  C:\Windows\System\dzthkLq.exe
  2⤵
  PID:12760
- C:\Windows\System\QbyVGMt.exe
  C:\Windows\System\QbyVGMt.exe
  2⤵
  PID:12788
- C:\Windows\System\ZLoZruO.exe
  C:\Windows\System\ZLoZruO.exe
  2⤵
  PID:12836
- C:\Windows\System\mUsrWUA.exe
  C:\Windows\System\mUsrWUA.exe
  2⤵
  PID:12860
- C:\Windows\System\nudMtnu.exe
  C:\Windows\System\nudMtnu.exe
  2⤵
  PID:12880
- C:\Windows\System\yIBnKus.exe
  C:\Windows\System\yIBnKus.exe
  2⤵
  PID:12968
- C:\Windows\System\zukKopy.exe
  C:\Windows\System\zukKopy.exe
  2⤵
  PID:12984
- C:\Windows\System\jhZaltR.exe
  C:\Windows\System\jhZaltR.exe
  2⤵
  PID:13000
- C:\Windows\System\VRsRSnH.exe
  C:\Windows\System\VRsRSnH.exe
  2⤵
  PID:13016
- C:\Windows\System\RwvixtB.exe
  C:\Windows\System\RwvixtB.exe
  2⤵
  PID:13032
- C:\Windows\System\wrDrzNR.exe
  C:\Windows\System\wrDrzNR.exe
  2⤵
  PID:13048
- C:\Windows\System\GWUnlLv.exe
  C:\Windows\System\GWUnlLv.exe
  2⤵
  PID:13072
- C:\Windows\System\DbNzVap.exe
  C:\Windows\System\DbNzVap.exe
  2⤵
  PID:13088
- C:\Windows\System\JkjggDI.exe
  C:\Windows\System\JkjggDI.exe
  2⤵
  PID:13104
- C:\Windows\System\KbupzLa.exe
  C:\Windows\System\KbupzLa.exe
  2⤵
  PID:13132
- C:\Windows\System\AatLpAi.exe
  C:\Windows\System\AatLpAi.exe
  2⤵
  PID:13148
- C:\Windows\System\YTbVFdf.exe
  C:\Windows\System\YTbVFdf.exe
  2⤵
  PID:13164
- C:\Windows\System\yXesFOu.exe
  C:\Windows\System\yXesFOu.exe
  2⤵
  PID:13184
- C:\Windows\System\TFumMPr.exe
  C:\Windows\System\TFumMPr.exe
  2⤵
  PID:12980
- C:\Windows\System\OdTnabh.exe
  C:\Windows\System\OdTnabh.exe
  2⤵
  PID:13060
- C:\Windows\System\SHkWnRI.exe
  C:\Windows\System\SHkWnRI.exe
  2⤵
  PID:13128
- C:\Windows\System\OXMphHe.exe
  C:\Windows\System\OXMphHe.exe
  2⤵
  PID:12992
- C:\Windows\System\ljbmZYs.exe
  C:\Windows\System\ljbmZYs.exe
  2⤵
  PID:13096
- C:\Windows\System\szHJqjO.exe
  C:\Windows\System\szHJqjO.exe
  2⤵
  PID:13244
- C:\Windows\System\hMJkqdQ.exe
  C:\Windows\System\hMJkqdQ.exe
  2⤵
  PID:13024
- C:\Windows\System\OwYdtIL.exe
  C:\Windows\System\OwYdtIL.exe
  2⤵
  PID:13044
- C:\Windows\System\fXoytVS.exe
  C:\Windows\System\fXoytVS.exe
  2⤵
  PID:12376
- C:\Windows\System\KreoSdh.exe
  C:\Windows\System\KreoSdh.exe
  2⤵
  PID:12420
- C:\Windows\System\VLmEfnS.exe
  C:\Windows\System\VLmEfnS.exe
  2⤵
  PID:13308
- C:\Windows\System\JByxJNx.exe
  C:\Windows\System\JByxJNx.exe
  2⤵
  PID:12348
- C:\Windows\System\yXmRzCI.exe
  C:\Windows\System\yXmRzCI.exe
  2⤵
  PID:12560
- C:\Windows\System\mivGHBo.exe
  C:\Windows\System\mivGHBo.exe
  2⤵
  PID:12308
- C:\Windows\System\pYaHmkE.exe
  C:\Windows\System\pYaHmkE.exe
  2⤵
  PID:3532
- C:\Windows\System\vAlsMHO.exe
  C:\Windows\System\vAlsMHO.exe
  2⤵
  PID:12488
- C:\Windows\System\lMKxjQy.exe
  C:\Windows\System\lMKxjQy.exe
  2⤵
  PID:12696
- C:\Windows\System\mzDEaVx.exe
  C:\Windows\System\mzDEaVx.exe
  2⤵
  PID:12812
- C:\Windows\System\ISsFBic.exe
  C:\Windows\System\ISsFBic.exe
  2⤵
  PID:12848
- C:\Windows\System\erggoiC.exe
  C:\Windows\System\erggoiC.exe
  2⤵
  PID:12776
- C:\Windows\System\UpuaihP.exe
  C:\Windows\System\UpuaihP.exe
  2⤵
  PID:12944
- C:\Windows\System\gcIRUCw.exe
  C:\Windows\System\gcIRUCw.exe
  2⤵
  PID:13144
- C:\Windows\System\ujPgyhJ.exe
  C:\Windows\System\ujPgyhJ.exe
  2⤵
  PID:13240
- C:\Windows\System\buGtwDb.exe
  C:\Windows\System\buGtwDb.exe
  2⤵
  PID:12892
- C:\Windows\System\uWJTEcr.exe
  C:\Windows\System\uWJTEcr.exe
  2⤵
  PID:3100
- C:\Windows\System\QszUKrf.exe
  C:\Windows\System\QszUKrf.exe
  2⤵
  PID:13100
- C:\Windows\System\ornzEsR.exe
  C:\Windows\System\ornzEsR.exe
  2⤵
  PID:1108
- C:\Windows\System\fjlmUya.exe
  C:\Windows\System\fjlmUya.exe
  2⤵
  PID:13112
- C:\Windows\System\ItkITxR.exe
  C:\Windows\System\ItkITxR.exe
  2⤵
  PID:12616
- C:\Windows\System\kzsgUZJ.exe
  C:\Windows\System\kzsgUZJ.exe
  2⤵
  PID:12832
- C:\Windows\System\pLsoTGG.exe
  C:\Windows\System\pLsoTGG.exe
  2⤵
  PID:1796
- C:\Windows\System\eUQtngk.exe
  C:\Windows\System\eUQtngk.exe
  2⤵
  PID:6072
- C:\Windows\System\ZftpwKQ.exe
  C:\Windows\System\ZftpwKQ.exe
  2⤵
  PID:5056
- C:\Windows\System\ZlNXJQk.exe
  C:\Windows\System\ZlNXJQk.exe
  2⤵
  PID:1052
- C:\Windows\System\arEbnzh.exe
  C:\Windows\System\arEbnzh.exe
  2⤵
  PID:3696
- C:\Windows\System\loQAJiF.exe
  C:\Windows\System\loQAJiF.exe
  2⤵
  PID:13276
- C:\Windows\System\fzGoZHr.exe
  C:\Windows\System\fzGoZHr.exe
  2⤵
  PID:5196
- C:\Windows\System\rXzWgEV.exe
  C:\Windows\System\rXzWgEV.exe
  2⤵
  PID:3468
- C:\Windows\System\GQFbliY.exe
  C:\Windows\System\GQFbliY.exe
  2⤵
  PID:13192
- C:\Windows\System\wxSsucM.exe
  C:\Windows\System\wxSsucM.exe
  2⤵
  PID:2928
- C:\Windows\System\EhUqxYf.exe
  C:\Windows\System\EhUqxYf.exe
  2⤵
  PID:5048
- C:\Windows\System\UGqlbtM.exe
  C:\Windows\System\UGqlbtM.exe
  2⤵
  PID:6116
- C:\Windows\System\KlieGVr.exe
  C:\Windows\System\KlieGVr.exe
  2⤵
  PID:804
- C:\Windows\System\AOxNGFB.exe
  C:\Windows\System\AOxNGFB.exe
  2⤵
  PID:12724
- C:\Windows\System\BuwodLl.exe
  C:\Windows\System\BuwodLl.exe
  2⤵
  PID:692
- C:\Windows\System\YMMsdpZ.exe
  C:\Windows\System\YMMsdpZ.exe
  2⤵
  PID:684
- C:\Windows\System\FNCQDhu.exe
  C:\Windows\System\FNCQDhu.exe
  2⤵
  PID:6296
- C:\Windows\System\ImbkngF.exe
  C:\Windows\System\ImbkngF.exe
  2⤵
  PID:2772
- C:\Windows\System\jawOpQB.exe
  C:\Windows\System\jawOpQB.exe
  2⤵
  PID:1812
- C:\Windows\System\phZjXWw.exe
  C:\Windows\System\phZjXWw.exe
  2⤵
  PID:1672
- C:\Windows\System\ZlOHfEH.exe
  C:\Windows\System\ZlOHfEH.exe
  2⤵
  PID:6500
- C:\Windows\System\lqKbhXE.exe
  C:\Windows\System\lqKbhXE.exe
  2⤵
  PID:6220
- C:\Windows\System\XBSdvJx.exe
  C:\Windows\System\XBSdvJx.exe
  2⤵
  PID:2416
- C:\Windows\System\jpkgZef.exe
  C:\Windows\System\jpkgZef.exe
  2⤵
  PID:5076
- C:\Windows\System\XenpKEW.exe
  C:\Windows\System\XenpKEW.exe
  2⤵
  PID:2216
- C:\Windows\System\Tygxekc.exe
  C:\Windows\System\Tygxekc.exe
  2⤵
  PID:1952
- C:\Windows\System\VgIxnAJ.exe
  C:\Windows\System\VgIxnAJ.exe
  2⤵
  PID:6572
- C:\Windows\System\kxeNbAQ.exe
  C:\Windows\System\kxeNbAQ.exe
  2⤵
  PID:3924
- C:\Windows\System\GOzjFwH.exe
  C:\Windows\System\GOzjFwH.exe
  2⤵
  PID:13280
- C:\Windows\System\dnNjKwU.exe
  C:\Windows\System\dnNjKwU.exe
  2⤵
  PID:1676
- C:\Windows\System\pwNoyjm.exe
  C:\Windows\System\pwNoyjm.exe
  2⤵
  PID:7876
- C:\Windows\System\yrybPOv.exe
  C:\Windows\System\yrybPOv.exe
  2⤵
  PID:2384
- C:\Windows\System\dpRIjsk.exe
  C:\Windows\System\dpRIjsk.exe
  2⤵
  PID:7644
- C:\Windows\System\iCzDVOv.exe
  C:\Windows\System\iCzDVOv.exe
  2⤵
  PID:1908
- C:\Windows\System\tEIXqoF.exe
  C:\Windows\System\tEIXqoF.exe
  2⤵
  PID:7608
- C:\Windows\System\SmVXACJ.exe
  C:\Windows\System\SmVXACJ.exe
  2⤵
  PID:6288
- C:\Windows\System\zOUkaKJ.exe
  C:\Windows\System\zOUkaKJ.exe
  2⤵
  PID:1840
- C:\Windows\System\YuvYOvm.exe
  C:\Windows\System\YuvYOvm.exe
  2⤵
  PID:1068
- C:\Windows\System\ZHPYPTK.exe
  C:\Windows\System\ZHPYPTK.exe
  2⤵
  PID:6984
- C:\Windows\System\nNcyBbF.exe
  C:\Windows\System\nNcyBbF.exe
  2⤵
  PID:7632
- C:\Windows\System\NfGTFyd.exe
  C:\Windows\System\NfGTFyd.exe
  2⤵
  PID:8164
- C:\Windows\System\lQODMYt.exe
  C:\Windows\System\lQODMYt.exe
  2⤵
  PID:2788
- C:\Windows\System\atNSylS.exe
  C:\Windows\System\atNSylS.exe
  2⤵
  PID:5020
- C:\Windows\System\MSzuGFF.exe
  C:\Windows\System\MSzuGFF.exe
  2⤵
  PID:12888
- C:\Windows\System\hlMRoMC.exe
  C:\Windows\System\hlMRoMC.exe
  2⤵
  PID:4532
- C:\Windows\System\BjObZaY.exe
  C:\Windows\System\BjObZaY.exe
  2⤵
  PID:2660
- C:\Windows\System\fkGMYDp.exe
  C:\Windows\System\fkGMYDp.exe
  2⤵
  PID:4328
- C:\Windows\System\yKFFgPm.exe
  C:\Windows\System\yKFFgPm.exe
  2⤵
  PID:968
- C:\Windows\System\dQZGMNM.exe
  C:\Windows\System\dQZGMNM.exe
  2⤵
  PID:8464
- C:\Windows\System\NvJuzJk.exe
  C:\Windows\System\NvJuzJk.exe
  2⤵
  PID:7384
- C:\Windows\System\eWUABwQ.exe
  C:\Windows\System\eWUABwQ.exe
  2⤵
  PID:7960
- C:\Windows\System\GMGbdYT.exe
  C:\Windows\System\GMGbdYT.exe
  2⤵
  PID:8324
- C:\Windows\System\rXXlKTh.exe
  C:\Windows\System\rXXlKTh.exe
  2⤵
  PID:7128
- C:\Windows\System\eSvAFOZ.exe
  C:\Windows\System\eSvAFOZ.exe
  2⤵
  PID:2408
- C:\Windows\System\CyXltGV.exe
  C:\Windows\System\CyXltGV.exe
  2⤵
  PID:1468
- C:\Windows\System\HxARAzG.exe
  C:\Windows\System\HxARAzG.exe
  2⤵
  PID:3644
- C:\Windows\System\EoLNSuC.exe
  C:\Windows\System\EoLNSuC.exe
  2⤵
  PID:7612
- C:\Windows\System\fNAJJpb.exe
  C:\Windows\System\fNAJJpb.exe
  2⤵
  PID:4996
- C:\Windows\System\znTWHBX.exe
  C:\Windows\System\znTWHBX.exe
  2⤵
  PID:7268
- C:\Windows\System\BhioaLS.exe
  C:\Windows\System\BhioaLS.exe
  2⤵
  PID:1548
- C:\Windows\System\udqVQLr.exe
  C:\Windows\System\udqVQLr.exe
  2⤵
  PID:8892
- C:\Windows\System\eipcOLE.exe
  C:\Windows\System\eipcOLE.exe
  2⤵
  PID:3948
- C:\Windows\System\mAKDxDc.exe
  C:\Windows\System\mAKDxDc.exe
  2⤵
  PID:9136
- C:\Windows\System\BdIKwDT.exe
  C:\Windows\System\BdIKwDT.exe
  2⤵
  PID:3840
- C:\Windows\System\WrCFtZZ.exe
  C:\Windows\System\WrCFtZZ.exe
  2⤵
  PID:8528
- C:\Windows\System\lPgsblm.exe
  C:\Windows\System\lPgsblm.exe
  2⤵
  PID:4636
- C:\Windows\System\eHbWbXf.exe
  C:\Windows\System\eHbWbXf.exe
  2⤵
  PID:1668
- C:\Windows\System\LkNmWqI.exe
  C:\Windows\System\LkNmWqI.exe
  2⤵
  PID:3192
- C:\Windows\System\JnlCxRX.exe
  C:\Windows\System\JnlCxRX.exe
  2⤵
  PID:8284
- C:\Windows\System\LLnVbDM.exe
  C:\Windows\System\LLnVbDM.exe
  2⤵
  PID:8672
- C:\Windows\System\XDHTQsO.exe
  C:\Windows\System\XDHTQsO.exe
  2⤵
  PID:4896
- C:\Windows\System\niqOcvW.exe
  C:\Windows\System\niqOcvW.exe
  2⤵
  PID:644
- C:\Windows\System\xexUHSB.exe
  C:\Windows\System\xexUHSB.exe
  2⤵
  PID:9308
- C:\Windows\System\qZkHnDP.exe
  C:\Windows\System\qZkHnDP.exe
  2⤵
  PID:3836
- C:\Windows\System\MENeGlZ.exe
  C:\Windows\System\MENeGlZ.exe
  2⤵
  PID:8532
- C:\Windows\System\gTPLgDJ.exe
  C:\Windows\System\gTPLgDJ.exe
  2⤵
  PID:5156
- C:\Windows\System\wbZsQaS.exe
  C:\Windows\System\wbZsQaS.exe
  2⤵
  PID:8972
- C:\Windows\System\HhLohva.exe
  C:\Windows\System\HhLohva.exe
  2⤵
  PID:9720
- C:\Windows\System\fdJIbZk.exe
  C:\Windows\System\fdJIbZk.exe
  2⤵
  PID:5452
- C:\Windows\System\cTLlrQm.exe
  C:\Windows\System\cTLlrQm.exe
  2⤵
  PID:4008
- C:\Windows\System\GJHNpTi.exe
  C:\Windows\System\GJHNpTi.exe
  2⤵
  PID:1036
- C:\Windows\System\wmkDGYn.exe
  C:\Windows\System\wmkDGYn.exe
  2⤵
  PID:10044
- C:\Windows\System\bQpXoFf.exe
  C:\Windows\System\bQpXoFf.exe
  2⤵
  PID:10088
- C:\Windows\System\HIbFOER.exe
  C:\Windows\System\HIbFOER.exe
  2⤵
  PID:4860
- C:\Windows\System\GudHTUm.exe
  C:\Windows\System\GudHTUm.exe
  2⤵
  PID:5604
- C:\Windows\System\KoqKqgJ.exe
  C:\Windows\System\KoqKqgJ.exe
  2⤵
  PID:9324
- C:\Windows\System\gcGNbrv.exe
  C:\Windows\System\gcGNbrv.exe
  2⤵
  PID:5704
- C:\Windows\System\QPGSnJq.exe
  C:\Windows\System\QPGSnJq.exe
  2⤵
  PID:1760
- C:\Windows\System\ymZWxHE.exe
  C:\Windows\System\ymZWxHE.exe
  2⤵
  PID:9816
- C:\Windows\System\mstrmni.exe
  C:\Windows\System\mstrmni.exe
  2⤵
  PID:9944
- C:\Windows\System\mXurlhq.exe
  C:\Windows\System\mXurlhq.exe
  2⤵
  PID:9976
- C:\Windows\System\DgfOPQE.exe
  C:\Windows\System\DgfOPQE.exe
  2⤵
  PID:10220
- C:\Windows\System\qcgJZek.exe
  C:\Windows\System\qcgJZek.exe
  2⤵
  PID:8100
- C:\Windows\System\NqUgPCZ.exe
  C:\Windows\System\NqUgPCZ.exe
  2⤵
  PID:5900
- C:\Windows\System\yAlrZFS.exe
  C:\Windows\System\yAlrZFS.exe
  2⤵
  PID:9972
- C:\Windows\System\dWwRypZ.exe
  C:\Windows\System\dWwRypZ.exe
  2⤵
  PID:9348
- C:\Windows\System\scOUEsp.exe
  C:\Windows\System\scOUEsp.exe
  2⤵
  PID:6012
- C:\Windows\System\PHrnbLJ.exe
  C:\Windows\System\PHrnbLJ.exe
  2⤵
  PID:5172
- C:\Windows\System\uAWhtRq.exe
  C:\Windows\System\uAWhtRq.exe
  2⤵
  PID:9436
- C:\Windows\System\lwOqIcp.exe
  C:\Windows\System\lwOqIcp.exe
  2⤵
  PID:5228
- C:\Windows\System\zgdFGFP.exe
  C:\Windows\System\zgdFGFP.exe
  2⤵
  PID:10412
- C:\Windows\System\MarYLRT.exe
  C:\Windows\System\MarYLRT.exe
  2⤵
  PID:10448
- C:\Windows\System\UwmdpzS.exe
  C:\Windows\System\UwmdpzS.exe
  2⤵
  PID:10540
- C:\Windows\System\jmfxgMh.exe
  C:\Windows\System\jmfxgMh.exe
  2⤵
  PID:9808
- C:\Windows\System\FotmEuk.exe
  C:\Windows\System\FotmEuk.exe
  2⤵
  PID:5508
- C:\Windows\System\JzmBwFp.exe
  C:\Windows\System\JzmBwFp.exe
  2⤵
  PID:10868
- C:\Windows\System\qYGaDXP.exe
  C:\Windows\System\qYGaDXP.exe
  2⤵
  PID:10924
- C:\Windows\System\MMrjVVv.exe
  C:\Windows\System\MMrjVVv.exe
  2⤵
  PID:5284
- C:\Windows\System\crxFeGD.exe
  C:\Windows\System\crxFeGD.exe
  2⤵
  PID:5468
- C:\Windows\System\MYxzlZD.exe
  C:\Windows\System\MYxzlZD.exe
  2⤵
  PID:4884
- C:\Windows\System\sPQqKFz.exe
  C:\Windows\System\sPQqKFz.exe
  2⤵
  PID:5576
- C:\Windows\System\WEOCkfI.exe
  C:\Windows\System\WEOCkfI.exe
  2⤵
  PID:5720
- C:\Windows\System\hkpjWQL.exe
  C:\Windows\System\hkpjWQL.exe
  2⤵
  PID:4728
- C:\Windows\System\mlLeniw.exe
  C:\Windows\System\mlLeniw.exe
  2⤵
  PID:3992
- C:\Windows\System\dwWmupQ.exe
  C:\Windows\System\dwWmupQ.exe
  2⤵
  PID:2504
- C:\Windows\System\nSRPZJf.exe
  C:\Windows\System\nSRPZJf.exe
  2⤵
  PID:9224
- C:\Windows\System\nPefKBH.exe
  C:\Windows\System\nPefKBH.exe
  2⤵
  PID:11776
- C:\Windows\System\eHutRBN.exe
  C:\Windows\System\eHutRBN.exe
  2⤵
  PID:1332
- C:\Windows\System\yTCbolY.exe
  C:\Windows\System\yTCbolY.exe
  2⤵
  PID:9828
- C:\Windows\System\lqhLgFQ.exe
  C:\Windows\System\lqhLgFQ.exe
  2⤵
  PID:7488
- C:\Windows\System\jPZSJKy.exe
  C:\Windows\System\jPZSJKy.exe
  2⤵
  PID:5364
- C:\Windows\System\ZafqcmK.exe
  C:\Windows\System\ZafqcmK.exe
  2⤵
  PID:1792
- C:\Windows\System\XEDLwGf.exe
  C:\Windows\System\XEDLwGf.exe
  2⤵
  PID:11964
- C:\Windows\System\NuHOtwY.exe
  C:\Windows\System\NuHOtwY.exe
  2⤵
  PID:5716
- C:\Windows\System\fQfMTpF.exe
  C:\Windows\System\fQfMTpF.exe
  2⤵
  PID:4788
- C:\Windows\System\DTdvLeR.exe
  C:\Windows\System\DTdvLeR.exe
  2⤵
  PID:9868
- C:\Windows\System\RLbpvgb.exe
  C:\Windows\System\RLbpvgb.exe
  2⤵
  PID:3128
- C:\Windows\System\ROXHaVm.exe
  C:\Windows\System\ROXHaVm.exe
  2⤵
  PID:5968
- C:\Windows\System\kazdDgX.exe
  C:\Windows\System\kazdDgX.exe
  2⤵
  PID:8676
- C:\Windows\System\KbqfKmD.exe
  C:\Windows\System\KbqfKmD.exe
  2⤵
  PID:11836
- C:\Windows\System\xNRLroY.exe
  C:\Windows\System\xNRLroY.exe
  2⤵
  PID:10364
- C:\Windows\System\RIdyNbL.exe
  C:\Windows\System\RIdyNbL.exe
  2⤵
  PID:2584
- C:\Windows\System\hGMyiRS.exe
  C:\Windows\System\hGMyiRS.exe
  2⤵
  PID:10676
- C:\Windows\System\OobIOTm.exe
  C:\Windows\System\OobIOTm.exe
  2⤵
  PID:12152
- C:\Windows\System\rxAkxdz.exe
  C:\Windows\System\rxAkxdz.exe
  2⤵
  PID:3880
- C:\Windows\System\QLfnAxe.exe
  C:\Windows\System\QLfnAxe.exe
  2⤵
  PID:12868
- C:\Windows\System\VUNFQEM.exe
  C:\Windows\System\VUNFQEM.exe
  2⤵
  PID:3176
- C:\Windows\System\NpoibdZ.exe
  C:\Windows\System\NpoibdZ.exe
  2⤵
  PID:6388
- C:\Windows\System\FcYwkUy.exe
  C:\Windows\System\FcYwkUy.exe
  2⤵
  PID:5808
- C:\Windows\System\oOxSQpf.exe
  C:\Windows\System\oOxSQpf.exe
  2⤵
  PID:744
- C:\Windows\System\YShjHNW.exe
  C:\Windows\System\YShjHNW.exe
  2⤵
  PID:9496
- C:\Windows\System\BWLdSWW.exe
  C:\Windows\System\BWLdSWW.exe
  2⤵
  PID:11240
- C:\Windows\System\WtPnZaP.exe
  C:\Windows\System\WtPnZaP.exe
  2⤵
  PID:11924
- C:\Windows\System\FPPYLLD.exe
  C:\Windows\System\FPPYLLD.exe
  2⤵
  PID:5736
- C:\Windows\System\AVwkNvK.exe
  C:\Windows\System\AVwkNvK.exe
  2⤵
  PID:6748
- C:\Windows\System\izNBfPT.exe
  C:\Windows\System\izNBfPT.exe
  2⤵
  PID:6804
- C:\Windows\System\MKysjzJ.exe
  C:\Windows\System\MKysjzJ.exe
  2⤵
  PID:6164
- C:\Windows\System\WiFKEFZ.exe
  C:\Windows\System\WiFKEFZ.exe
  2⤵
  PID:12368
- C:\Windows\System\UyepGVo.exe
  C:\Windows\System\UyepGVo.exe
  2⤵
  PID:9332
- C:\Windows\System\XHHwOri.exe
  C:\Windows\System\XHHwOri.exe
  2⤵
  PID:5780
- C:\Windows\System\DhJZFOD.exe
  C:\Windows\System\DhJZFOD.exe
  2⤵
  PID:6032
- C:\Windows\System\SgKDdZA.exe
  C:\Windows\System\SgKDdZA.exe
  2⤵
  PID:5476
- C:\Windows\System\hvrbRtT.exe
  C:\Windows\System\hvrbRtT.exe
  2⤵
  PID:1576
- C:\Windows\System\wWMMUak.exe
  C:\Windows\System\wWMMUak.exe
  2⤵
  PID:13304
- C:\Windows\System\FjReTxy.exe
  C:\Windows\System\FjReTxy.exe
  2⤵
  PID:5552
- C:\Windows\System\SSoNhUN.exe
  C:\Windows\System\SSoNhUN.exe
  2⤵
  PID:7048
- C:\Windows\System\GikaPWG.exe
  C:\Windows\System\GikaPWG.exe
  2⤵
  PID:6348
- C:\Windows\System\VaEOuJp.exe
  C:\Windows\System\VaEOuJp.exe
  2⤵
  PID:12596
- C:\Windows\System\TPXQCFN.exe
  C:\Windows\System\TPXQCFN.exe
  2⤵
  PID:6664
- C:\Windows\System\HPvbFdT.exe
  C:\Windows\System\HPvbFdT.exe
  2⤵
  PID:5168
- C:\Windows\System\EMdzwlv.exe
  C:\Windows\System\EMdzwlv.exe
  2⤵
  PID:11320
- C:\Windows\System\EdsmLGm.exe
  C:\Windows\System\EdsmLGm.exe
  2⤵
  PID:5392
- C:\Windows\System\HTooZWl.exe
  C:\Windows\System\HTooZWl.exe
  2⤵
  PID:1564
- C:\Windows\System\gYcsrVz.exe
  C:\Windows\System\gYcsrVz.exe
  2⤵
  PID:4260
- C:\Windows\System\FqNdkYO.exe
  C:\Windows\System\FqNdkYO.exe
  2⤵
  PID:4556
- C:\Windows\System\zGazsce.exe
  C:\Windows\System\zGazsce.exe
  2⤵
  PID:4152
- C:\Windows\System\xOVxSSy.exe
  C:\Windows\System\xOVxSSy.exe
  2⤵
  PID:7472
- C:\Windows\System\pqaGQFZ.exe
  C:\Windows\System\pqaGQFZ.exe
  2⤵
  PID:6000
- C:\Windows\System\linXipQ.exe
  C:\Windows\System\linXipQ.exe
  2⤵
  PID:7872
- C:\Windows\System\iEclVMh.exe
  C:\Windows\System\iEclVMh.exe
  2⤵
  PID:4472
- C:\Windows\System\csOFucX.exe
  C:\Windows\System\csOFucX.exe
  2⤵
  PID:6208
- C:\Windows\System\fdqgski.exe
  C:\Windows\System\fdqgski.exe
  2⤵
  PID:8860
- C:\Windows\System\IQHDhtM.exe
  C:\Windows\System\IQHDhtM.exe
  2⤵
  PID:6516
- C:\Windows\System\JpLxQht.exe
  C:\Windows\System\JpLxQht.exe
  2⤵
  PID:11552
- C:\Windows\System\pslpBCO.exe
  C:\Windows\System\pslpBCO.exe
  2⤵
  PID:8360
- C:\Windows\System\sZDMImz.exe
  C:\Windows\System\sZDMImz.exe
  2⤵
  PID:10000
- C:\Windows\System\slPRBpd.exe
  C:\Windows\System\slPRBpd.exe
  2⤵
  PID:3084
- C:\Windows\System\DLWMRSt.exe
  C:\Windows\System\DLWMRSt.exe
  2⤵
  PID:6368
- C:\Windows\System\gNOyRDg.exe
  C:\Windows\System\gNOyRDg.exe
  2⤵
  PID:6252
- C:\Windows\System\TInkHSg.exe
  C:\Windows\System\TInkHSg.exe
  2⤵
  PID:8996
- C:\Windows\System\ODFapSq.exe
  C:\Windows\System\ODFapSq.exe
  2⤵
  PID:9044
- C:\Windows\System\QvYAbMM.exe
  C:\Windows\System\QvYAbMM.exe
  2⤵
  PID:6324
- C:\Windows\System\euZxHBG.exe
  C:\Windows\System\euZxHBG.exe
  2⤵
  PID:8336
- C:\Windows\System\DqoabNW.exe
  C:\Windows\System\DqoabNW.exe
  2⤵
  PID:2972
- C:\Windows\System\RdmfGKV.exe
  C:\Windows\System\RdmfGKV.exe
  2⤵
  PID:5084
- C:\Windows\System\kpnHgRI.exe
  C:\Windows\System\kpnHgRI.exe
  2⤵
  PID:7444
- C:\Windows\System\ooRwLSZ.exe
  C:\Windows\System\ooRwLSZ.exe
  2⤵
  PID:12176
- C:\Windows\System\JzhuflV.exe
  C:\Windows\System\JzhuflV.exe
  2⤵
  PID:6176
- C:\Windows\System\VIsWanK.exe
  C:\Windows\System\VIsWanK.exe
  2⤵
  PID:9180
- C:\Windows\System\TKfBsay.exe
  C:\Windows\System\TKfBsay.exe
  2⤵
  PID:8900
- C:\Windows\System\ZonyWUv.exe
  C:\Windows\System\ZonyWUv.exe
  2⤵
  PID:2404
- C:\Windows\System\Hudfkdj.exe
  C:\Windows\System\Hudfkdj.exe
  2⤵
  PID:7752
- C:\Windows\System\HQOydkl.exe
  C:\Windows\System\HQOydkl.exe
  2⤵
  PID:10564
- C:\Windows\System\UgvRGhV.exe
  C:\Windows\System\UgvRGhV.exe
  2⤵
  PID:10096
- C:\Windows\System\xVEeDTg.exe
  C:\Windows\System\xVEeDTg.exe
  2⤵
  PID:9744
- C:\Windows\System\vDUVFFM.exe
  C:\Windows\System\vDUVFFM.exe
  2⤵
  PID:7808
- C:\Windows\System\ukezNcH.exe
  C:\Windows\System\ukezNcH.exe
  2⤵
  PID:7096
- C:\Windows\System\NZdbxai.exe
  C:\Windows\System\NZdbxai.exe
  2⤵
  PID:7408
- C:\Windows\System\qqaqoJX.exe
  C:\Windows\System\qqaqoJX.exe
  2⤵
  PID:9344
- C:\Windows\System\CRWGHAd.exe
  C:\Windows\System\CRWGHAd.exe
  2⤵
  PID:9524
- C:\Windows\System\mdsulAE.exe
  C:\Windows\System\mdsulAE.exe
  2⤵
  PID:9700
- C:\Windows\System\IKunREd.exe
  C:\Windows\System\IKunREd.exe
  2⤵
  PID:8432
- C:\Windows\System\hRDTmez.exe
  C:\Windows\System\hRDTmez.exe
  2⤵
  PID:10072
- C:\Windows\System\NqKPeWK.exe
  C:\Windows\System\NqKPeWK.exe
  2⤵
  PID:6392
- C:\Windows\System\WCqYnki.exe
  C:\Windows\System\WCqYnki.exe
  2⤵
  PID:9056
- C:\Windows\System\EWckbBV.exe
  C:\Windows\System\EWckbBV.exe
  2⤵
  PID:13204
- C:\Windows\System\HGXqNnK.exe
  C:\Windows\System\HGXqNnK.exe
  2⤵
  PID:7292
- C:\Windows\System\DovcsyM.exe
  C:\Windows\System\DovcsyM.exe
  2⤵
  PID:7164
- C:\Windows\System\UukYXUo.exe
  C:\Windows\System\UukYXUo.exe
  2⤵
  PID:5856
- C:\Windows\System\DTPbWjX.exe
  C:\Windows\System\DTPbWjX.exe
  2⤵
  PID:10756
- C:\Windows\System\uOdQmEm.exe
  C:\Windows\System\uOdQmEm.exe
  2⤵
  PID:7412
- C:\Windows\System\mSfvbye.exe
  C:\Windows\System\mSfvbye.exe
  2⤵
  PID:7380
- C:\Windows\System\HVcDgrW.exe
  C:\Windows\System\HVcDgrW.exe
  2⤵
  PID:11164
- C:\Windows\System\dvSHdTr.exe
  C:\Windows\System\dvSHdTr.exe
  2⤵
  PID:11260
- C:\Windows\System\gtvCLwc.exe
  C:\Windows\System\gtvCLwc.exe
  2⤵
  PID:764
- C:\Windows\System\KnBnTzQ.exe
  C:\Windows\System\KnBnTzQ.exe
  2⤵
  PID:10560
- C:\Windows\System\gqtyCoL.exe
  C:\Windows\System\gqtyCoL.exe
  2⤵
  PID:9416
- C:\Windows\System\YMqWIfh.exe
  C:\Windows\System\YMqWIfh.exe
  2⤵
  PID:8232
- C:\Windows\System\fsfMfcS.exe
  C:\Windows\System\fsfMfcS.exe
  2⤵
  PID:11016
- C:\Windows\System\BfDLNQz.exe
  C:\Windows\System\BfDLNQz.exe
  2⤵
  PID:8032
- C:\Windows\System\lMadCMX.exe
  C:\Windows\System\lMadCMX.exe
  2⤵
  PID:9596
- C:\Windows\System\lmfsUzy.exe
  C:\Windows\System\lmfsUzy.exe
  2⤵
  PID:10608
- C:\Windows\System\flaYsPT.exe
  C:\Windows\System\flaYsPT.exe
  2⤵
  PID:9512
- C:\Windows\System\rvOGVVg.exe
  C:\Windows\System\rvOGVVg.exe
  2⤵
  PID:11392
- C:\Windows\System\DglxXWa.exe
  C:\Windows\System\DglxXWa.exe
  2⤵
  PID:11464
- C:\Windows\System\JKzuyRr.exe
  C:\Windows\System\JKzuyRr.exe
  2⤵
  PID:11672
- C:\Windows\System\HBFWOQh.exe
  C:\Windows\System\HBFWOQh.exe
  2⤵
  PID:11744
- C:\Windows\System\kQEsPNu.exe
  C:\Windows\System\kQEsPNu.exe
  2⤵
  PID:6520
- C:\Windows\System\AWytUSe.exe
  C:\Windows\System\AWytUSe.exe
  2⤵
  PID:11800
- C:\Windows\System\iyMeMUx.exe
  C:\Windows\System\iyMeMUx.exe
  2⤵
  PID:9572
- C:\Windows\System\LONrKfa.exe
  C:\Windows\System\LONrKfa.exe
  2⤵
  PID:8396
- C:\Windows\System\qymEjTn.exe
  C:\Windows\System\qymEjTn.exe
  2⤵
  PID:10068
- C:\Windows\System\UdzNzWa.exe
  C:\Windows\System\UdzNzWa.exe
  2⤵
  PID:1724
- C:\Windows\System\zzTtfOY.exe
  C:\Windows\System\zzTtfOY.exe
  2⤵
  PID:9872
- C:\Windows\System\hmloKfQ.exe
  C:\Windows\System\hmloKfQ.exe
  2⤵
  PID:12264
- C:\Windows\System\EUFBbhd.exe
  C:\Windows\System\EUFBbhd.exe
  2⤵
  PID:10340
- C:\Windows\System\QhIhbRo.exe
  C:\Windows\System\QhIhbRo.exe
  2⤵
  PID:5724
- C:\Windows\System\fSWStjG.exe
  C:\Windows\System\fSWStjG.exe
  2⤵
  PID:11408
- C:\Windows\System\hSpRMya.exe
  C:\Windows\System\hSpRMya.exe
  2⤵
  PID:11512
- C:\Windows\System\ACvsIRN.exe
  C:\Windows\System\ACvsIRN.exe
  2⤵
  PID:8760
- C:\Windows\System\BRWJRSr.exe
  C:\Windows\System\BRWJRSr.exe
  2⤵
  PID:7440
- C:\Windows\System\GXMnGSS.exe
  C:\Windows\System\GXMnGSS.exe
  2⤵
  PID:7388
- C:\Windows\System\ibjxlck.exe
  C:\Windows\System\ibjxlck.exe
  2⤵
  PID:12284
- C:\Windows\System\hZeLxuf.exe
  C:\Windows\System\hZeLxuf.exe
  2⤵
  PID:12232
- C:\Windows\System\wEhVjDu.exe
  C:\Windows\System\wEhVjDu.exe
  2⤵
  PID:11104
- C:\Windows\System\XOKufEU.exe
  C:\Windows\System\XOKufEU.exe
  2⤵
  PID:11616
- C:\Windows\System\IhymuSj.exe
  C:\Windows\System\IhymuSj.exe
  2⤵
  PID:8576
- C:\Windows\System\ficQtah.exe
  C:\Windows\System\ficQtah.exe
  2⤵
  PID:9068
- C:\Windows\System\DNBrdgy.exe
  C:\Windows\System\DNBrdgy.exe
  2⤵
  PID:9148
- C:\Windows\System\AYenRuT.exe
  C:\Windows\System\AYenRuT.exe
  2⤵
  PID:10528
- C:\Windows\System\rlTOxby.exe
  C:\Windows\System\rlTOxby.exe
  2⤵
  PID:9072
- C:\Windows\System\gXTjYpj.exe
  C:\Windows\System\gXTjYpj.exe
  2⤵
  PID:7968
- C:\Windows\System\VlOFsac.exe
  C:\Windows\System\VlOFsac.exe
  2⤵
  PID:10680
- C:\Windows\System\NiqZpSo.exe
  C:\Windows\System\NiqZpSo.exe
  2⤵
  PID:7984
- C:\Windows\System\SgrzYMP.exe
  C:\Windows\System\SgrzYMP.exe
  2⤵
  PID:12640
- C:\Windows\System\ItYTGik.exe
  C:\Windows\System\ItYTGik.exe
  2⤵
  PID:12720
- C:\Windows\System\WbyYxiE.exe
  C:\Windows\System\WbyYxiE.exe
  2⤵
  PID:12756
- C:\Windows\System\mdFZbNP.exe
  C:\Windows\System\mdFZbNP.exe
  2⤵
  PID:9892
- C:\Windows\System\IpKeoBK.exe
  C:\Windows\System\IpKeoBK.exe
  2⤵
  PID:9820
- C:\Windows\System\lXUnRqh.exe
  C:\Windows\System\lXUnRqh.exe
  2⤵
  PID:4380
- C:\Windows\System\xfcutNd.exe
  C:\Windows\System\xfcutNd.exe
  2⤵
  PID:12932
- C:\Windows\System\GAqaqet.exe
  C:\Windows\System\GAqaqet.exe
  2⤵
  PID:11328
- C:\Windows\System\BWOQlCz.exe
  C:\Windows\System\BWOQlCz.exe
  2⤵
  PID:7448
- C:\Windows\System\iEoTiaP.exe
  C:\Windows\System\iEoTiaP.exe
  2⤵
  PID:11696
- C:\Windows\System\YVsRSnI.exe
  C:\Windows\System\YVsRSnI.exe
  2⤵
  PID:11688
- C:\Windows\System\wzcSrNj.exe
  C:\Windows\System\wzcSrNj.exe
  2⤵
  PID:7312
- C:\Windows\System\oiKbVOe.exe
  C:\Windows\System\oiKbVOe.exe
  2⤵
  PID:13284
- C:\Windows\System\KIYQrHF.exe
  C:\Windows\System\KIYQrHF.exe
  2⤵
  PID:13216
- C:\Windows\System\ATDuzEf.exe
  C:\Windows\System\ATDuzEf.exe
  2⤵
  PID:8408
- C:\Windows\System\VIACLtf.exe
  C:\Windows\System\VIACLtf.exe
  2⤵
  PID:8428
- C:\Windows\System\RFknXRD.exe
  C:\Windows\System\RFknXRD.exe
  2⤵
  PID:11996
- C:\Windows\System\IELVyPz.exe
  C:\Windows\System\IELVyPz.exe
  2⤵
  PID:4368
- C:\Windows\System\spSvNoi.exe
  C:\Windows\System\spSvNoi.exe
  2⤵
  PID:13028
- C:\Windows\System\TrErFsp.exe
  C:\Windows\System\TrErFsp.exe
  2⤵
  PID:9552
- C:\Windows\System\gyjpSoZ.exe
  C:\Windows\System\gyjpSoZ.exe
  2⤵
  PID:12268
- C:\Windows\System\CczXZgT.exe
  C:\Windows\System\CczXZgT.exe
  2⤵
  PID:4632
- C:\Windows\System\VwmpTio.exe
  C:\Windows\System\VwmpTio.exe
  2⤵
  PID:10624
- C:\Windows\System\JAzwOUL.exe
  C:\Windows\System\JAzwOUL.exe
  2⤵
  PID:11692
- C:\Windows\System\ePPfcZR.exe
  C:\Windows\System\ePPfcZR.exe
  2⤵
  PID:5028
- C:\Windows\System\tRbQtfm.exe
  C:\Windows\System\tRbQtfm.exe
  2⤵
  PID:10628
- C:\Windows\System\MvFzZsf.exe
  C:\Windows\System\MvFzZsf.exe
  2⤵
  PID:12016
- C:\Windows\System\AFMtRDH.exe
  C:\Windows\System\AFMtRDH.exe
  2⤵
  PID:8332
- C:\Windows\System\nkBjQeY.exe
  C:\Windows\System\nkBjQeY.exe
  2⤵
  PID:9020
- C:\Windows\System\nmgQMIx.exe
  C:\Windows\System\nmgQMIx.exe
  2⤵
  PID:9248
- C:\Windows\System\ixogewy.exe
  C:\Windows\System\ixogewy.exe
  2⤵
  PID:12740
- C:\Windows\System\ebUWoVC.exe
  C:\Windows\System\ebUWoVC.exe
  2⤵
  PID:9544
- C:\Windows\System\jKKrhwR.exe
  C:\Windows\System\jKKrhwR.exe
  2⤵
  PID:12768
- C:\Windows\System\tmYaxcr.exe
  C:\Windows\System\tmYaxcr.exe
  2⤵
  PID:11052
- C:\Windows\System\CtgDsrw.exe
  C:\Windows\System\CtgDsrw.exe
  2⤵
  PID:9548
- C:\Windows\System\AnBGJeC.exe
  C:\Windows\System\AnBGJeC.exe
  2⤵
  PID:11824
- C:\Windows\System\FHRRTFi.exe
  C:\Windows\System\FHRRTFi.exe
  2⤵
  PID:7372
- C:\Windows\System\ZBNYqVw.exe
  C:\Windows\System\ZBNYqVw.exe
  2⤵
  PID:12060
- C:\Windows\System\bbyGkSn.exe
  C:\Windows\System\bbyGkSn.exe
  2⤵
  PID:12076
- C:\Windows\System\PAbYrbs.exe
  C:\Windows\System\PAbYrbs.exe
  2⤵
  PID:800
- C:\Windows\System\SxcdJwG.exe
  C:\Windows\System\SxcdJwG.exe
  2⤵
  PID:10800
- C:\Windows\System\SiKLysk.exe
  C:\Windows\System\SiKLysk.exe
  2⤵
  PID:11100
- C:\Windows\System\oNkqKAg.exe
  C:\Windows\System\oNkqKAg.exe
  2⤵
  PID:9152
- C:\Windows\System\zXDSBOJ.exe
  C:\Windows\System\zXDSBOJ.exe
  2⤵
  PID:10588
- C:\Windows\System\NnXlLUs.exe
  C:\Windows\System\NnXlLUs.exe
  2⤵
  PID:12772
- C:\Windows\System\GCrIKWM.exe
  C:\Windows\System\GCrIKWM.exe
  2⤵
  PID:12896
- C:\Windows\System\KZBwFKn.exe
  C:\Windows\System\KZBwFKn.exe
  2⤵
  PID:11708
- C:\Windows\System\SBKhwVW.exe
  C:\Windows\System\SBKhwVW.exe
  2⤵
  PID:9708
- C:\Windows\System\JqLASFK.exe
  C:\Windows\System\JqLASFK.exe
  2⤵
  PID:11780
- C:\Windows\System\WvGyQvJ.exe
  C:\Windows\System\WvGyQvJ.exe
  2⤵
  PID:1032
- C:\Windows\System\WeSfDmU.exe
  C:\Windows\System\WeSfDmU.exe
  2⤵
  PID:2692
- C:\Windows\System\TfpXwcw.exe
  C:\Windows\System\TfpXwcw.exe
  2⤵
  PID:11968
- C:\Windows\System\TJTQOrZ.exe
  C:\Windows\System\TJTQOrZ.exe
  2⤵
  PID:13160
- C:\Windows\System\cUegipF.exe
  C:\Windows\System\cUegipF.exe
  2⤵
  PID:9168
- C:\Windows\System\NxFHqeY.exe
  C:\Windows\System\NxFHqeY.exe
  2⤵
  PID:9024
- C:\Windows\System\XKVjtZY.exe
  C:\Windows\System\XKVjtZY.exe
  2⤵
  PID:10128
- C:\Windows\System\rXBKFMw.exe
  C:\Windows\System\rXBKFMw.exe
  2⤵
  PID:4528
- C:\Windows\System\tXYYQRS.exe
  C:\Windows\System\tXYYQRS.exe
  2⤵
  PID:6844
- C:\Windows\System\pfZtbZE.exe
  C:\Windows\System\pfZtbZE.exe
  2⤵
  PID:2428
- C:\Windows\System\XHmYaMw.exe
  C:\Windows\System\XHmYaMw.exe
  2⤵
  PID:4808
- C:\Windows\System\AVFalZp.exe
  C:\Windows\System\AVFalZp.exe
  2⤵
  PID:8096
- C:\Windows\System\bdPwsxJ.exe
  C:\Windows\System\bdPwsxJ.exe
  2⤵
  PID:11612
- C:\Windows\System\HHQFiPH.exe
  C:\Windows\System\HHQFiPH.exe
  2⤵
  PID:9084
- C:\Windows\System\MZoIlKO.exe
  C:\Windows\System\MZoIlKO.exe
  2⤵
  PID:10552
- C:\Windows\System\oVEwYIK.exe
  C:\Windows\System\oVEwYIK.exe
  2⤵
  PID:13324
- C:\Windows\System\AtysNKb.exe
  C:\Windows\System\AtysNKb.exe
  2⤵
  PID:13340
- C:\Windows\System\GTXGrTO.exe
  C:\Windows\System\GTXGrTO.exe
  2⤵
  PID:13380
- C:\Windows\System\jGTaBHv.exe
  C:\Windows\System\jGTaBHv.exe
  2⤵
  PID:13408
- C:\Windows\System\iZBAeka.exe
  C:\Windows\System\iZBAeka.exe
  2⤵
  PID:13496
- C:\Windows\System\ghuoXwJ.exe
  C:\Windows\System\ghuoXwJ.exe
  2⤵
  PID:13536
- C:\Windows\System\jWepVFV.exe
  C:\Windows\System\jWepVFV.exe
  2⤵
  PID:13564
- C:\Windows\System\mNAAmJU.exe
  C:\Windows\System\mNAAmJU.exe
  2⤵
  PID:13592
- C:\Windows\System\UArVVnT.exe
  C:\Windows\System\UArVVnT.exe
  2⤵
  PID:13620
- C:\Windows\System\ZKetyFG.exe
  C:\Windows\System\ZKetyFG.exe
  2⤵
  PID:13648
- C:\Windows\System\mSSEFTz.exe
  C:\Windows\System\mSSEFTz.exe
  2⤵
  PID:13676
- C:\Windows\System\wRFleNq.exe
  C:\Windows\System\wRFleNq.exe
  2⤵
  PID:13704
- C:\Windows\System\FcRMpEa.exe
  C:\Windows\System\FcRMpEa.exe
  2⤵
  PID:13720
- C:\Windows\System\BRUXzAX.exe
  C:\Windows\System\BRUXzAX.exe
  2⤵
  PID:13760
- C:\Windows\System\zMTdnri.exe
  C:\Windows\System\zMTdnri.exe
  2⤵
  PID:13788
- C:\Windows\System\CoEjBRt.exe
  C:\Windows\System\CoEjBRt.exe
  2⤵
  PID:13816
- C:\Windows\System\TKGLgjB.exe
  C:\Windows\System\TKGLgjB.exe
  2⤵
  PID:13844
- C:\Windows\System\bVKjZWP.exe
  C:\Windows\System\bVKjZWP.exe
  2⤵
  PID:13872
- C:\Windows\System\VKeVVgT.exe
  C:\Windows\System\VKeVVgT.exe
  2⤵
  PID:13904
- C:\Windows\System\VbNvJvk.exe
  C:\Windows\System\VbNvJvk.exe
  2⤵
  PID:13948
- C:\Windows\System\ciRaDWZ.exe
  C:\Windows\System\ciRaDWZ.exe
  2⤵
  PID:13976
- C:\Windows\System\XkAGyGz.exe
  C:\Windows\System\XkAGyGz.exe
  2⤵
  PID:14004
- C:\Windows\System\NbUNysh.exe
  C:\Windows\System\NbUNysh.exe
  2⤵
  PID:14032
- C:\Windows\System\VYNNtMH.exe
  C:\Windows\System\VYNNtMH.exe
  2⤵
  PID:14052
- C:\Windows\System\hDZKsLu.exe
  C:\Windows\System\hDZKsLu.exe
  2⤵
  PID:14080
- C:\Windows\System\DAFSchZ.exe
  C:\Windows\System\DAFSchZ.exe
  2⤵
  PID:14116
- C:\Windows\System\RaKPioe.exe
  C:\Windows\System\RaKPioe.exe
  2⤵
  PID:14144
- C:\Windows\System\SqhpfVT.exe
  C:\Windows\System\SqhpfVT.exe
  2⤵
  PID:14172
- C:\Windows\System\ioKvmdE.exe
  C:\Windows\System\ioKvmdE.exe
  2⤵
  PID:14200
- C:\Windows\System\bDbgBAO.exe
  C:\Windows\System\bDbgBAO.exe
  2⤵
  PID:14228
- C:\Windows\System\lDRZXCf.exe
  C:\Windows\System\lDRZXCf.exe
  2⤵
  PID:14256
- C:\Windows\System\DXSTnmy.exe
  C:\Windows\System\DXSTnmy.exe
  2⤵
  PID:14284
- C:\Windows\System\Xtgexif.exe
  C:\Windows\System\Xtgexif.exe
  2⤵
  PID:14312
- C:\Windows\System\PiOUaUe.exe
  C:\Windows\System\PiOUaUe.exe
  2⤵
  PID:13332
- C:\Windows\System\HhHwMVi.exe
  C:\Windows\System\HhHwMVi.exe
  2⤵
  PID:3036
- C:\Windows\System\OsXIiNP.exe
  C:\Windows\System\OsXIiNP.exe
  2⤵
  PID:13396
- C:\Windows\System\SZtBlTM.exe
  C:\Windows\System\SZtBlTM.exe
  2⤵
  PID:13416
- C:\Windows\System\SBgvjEu.exe
  C:\Windows\System\SBgvjEu.exe
  2⤵
  PID:13552
- C:\Windows\System\ocdAEdC.exe
  C:\Windows\System\ocdAEdC.exe
  2⤵
  PID:13616
- C:\Windows\System\sUAKIvj.exe
  C:\Windows\System\sUAKIvj.exe
  2⤵
  PID:6588
- C:\Windows\System\aeMxepq.exe
  C:\Windows\System\aeMxepq.exe
  2⤵
  PID:13748
- C:\Windows\System\AbKIjSG.exe
  C:\Windows\System\AbKIjSG.exe
  2⤵
  PID:1960
- C:\Windows\System\BkiuZah.exe
  C:\Windows\System\BkiuZah.exe
  2⤵
  PID:13824
- C:\Windows\System\iWCckRn.exe
  C:\Windows\System\iWCckRn.exe
  2⤵
  PID:6784
- C:\Windows\System\aVPjvrB.exe
  C:\Windows\System\aVPjvrB.exe
  2⤵
  PID:6924
- C:\Windows\System\KYeVolA.exe
  C:\Windows\System\KYeVolA.exe
  2⤵
  PID:13356
- C:\Windows\System\edPHTFs.exe
  C:\Windows\System\edPHTFs.exe
  2⤵
  PID:4540
- C:\Windows\System\LSCybtb.exe
  C:\Windows\System\LSCybtb.exe
  2⤵
  PID:7636
- C:\Windows\System\SvzZYGj.exe
  C:\Windows\System\SvzZYGj.exe
  2⤵
  PID:1612
- C:\Windows\System\DkJiDGy.exe
  C:\Windows\System\DkJiDGy.exe
  2⤵
  PID:8492
- C:\Windows\System\PgdhrEm.exe
  C:\Windows\System\PgdhrEm.exe
  2⤵
  PID:8864
- C:\Windows\System\IZmDTra.exe
  C:\Windows\System\IZmDTra.exe
  2⤵
  PID:14236
- C:\Windows\System\wacgJVy.exe
  C:\Windows\System\wacgJVy.exe
  2⤵
  PID:13012
- C:\Windows\System\icOwIcE.exe
  C:\Windows\System\icOwIcE.exe
  2⤵
  PID:14224
- C:\Windows\System\vCYeNey.exe
  C:\Windows\System\vCYeNey.exe
  2⤵
  PID:6708
- C:\Windows\System\thsivTZ.exe
  C:\Windows\System\thsivTZ.exe
  2⤵
  PID:7328
- C:\Windows\System\hqIQKJE.exe
  C:\Windows\System\hqIQKJE.exe
  2⤵
  PID:13516
- C:\Windows\System\EGWMoAy.exe
  C:\Windows\System\EGWMoAy.exe
  2⤵
  PID:13532
- C:\Windows\System\YqxRihP.exe
  C:\Windows\System\YqxRihP.exe
  2⤵
  PID:9016
- C:\Windows\System\NzDmujq.exe
  C:\Windows\System\NzDmujq.exe
  2⤵
  PID:13488
- C:\Windows\System\ZoMNYTU.exe
  C:\Windows\System\ZoMNYTU.exe
  2⤵
  PID:9636
- C:\Windows\System\sdXNatS.exe
  C:\Windows\System\sdXNatS.exe
  2⤵
  PID:13944
- C:\Windows\System\oLuNson.exe
  C:\Windows\System\oLuNson.exe
  2⤵
  PID:13196
- C:\Windows\System\kirjAwz.exe
  C:\Windows\System\kirjAwz.exe
  2⤵
  PID:4520
- C:\Windows\System\zJzXrqd.exe
  C:\Windows\System\zJzXrqd.exe
  2⤵
  PID:6952
- C:\Windows\System\inpvNFw.exe
  C:\Windows\System\inpvNFw.exe
  2⤵
  PID:14088
- C:\Windows\System\cEekHki.exe
  C:\Windows\System\cEekHki.exe
  2⤵
  PID:5464
- C:\Windows\System\XnpJaTU.exe
  C:\Windows\System\XnpJaTU.exe
  2⤵
  PID:14244
- C:\Windows\System\LAPwDKX.exe
  C:\Windows\System\LAPwDKX.exe
  2⤵
  PID:4936
- C:\Windows\System\BOewxJG.exe
  C:\Windows\System\BOewxJG.exe
  2⤵
  PID:13508
- C:\Windows\System\DJCjMGM.exe
  C:\Windows\System\DJCjMGM.exe
  2⤵
  PID:13880
- C:\Windows\System\jwCqxiM.exe
  C:\Windows\System\jwCqxiM.exe
  2⤵
  PID:912
- C:\Windows\System\MPtPqrQ.exe
  C:\Windows\System\MPtPqrQ.exe
  2⤵
  PID:14180
- C:\Windows\System\IXlCqCO.exe
  C:\Windows\System\IXlCqCO.exe
  2⤵
  PID:2624
- C:\Windows\System\gIVdxGC.exe
  C:\Windows\System\gIVdxGC.exe
  2⤵
  PID:7744
- C:\Windows\System\dfdUAEL.exe
  C:\Windows\System\dfdUAEL.exe
  2⤵
  PID:3168
- C:\Windows\System\amlKZBV.exe
  C:\Windows\System\amlKZBV.exe
  2⤵
  PID:4064
- C:\Windows\System\ezFaMwe.exe
  C:\Windows\System\ezFaMwe.exe
  2⤵
  PID:7804
- C:\Windows\System\HSOWMKZ.exe
  C:\Windows\System\HSOWMKZ.exe
  2⤵
  PID:13728
- C:\Windows\System\KOucsGD.exe
  C:\Windows\System\KOucsGD.exe
  2⤵
  PID:4388
- C:\Windows\System\FaFTguR.exe
  C:\Windows\System\FaFTguR.exe
  2⤵
  PID:4128
- C:\Windows\System\TpUSuzh.exe
  C:\Windows\System\TpUSuzh.exe
  2⤵
  PID:13588
- C:\Windows\System\MkMIwdn.exe
  C:\Windows\System\MkMIwdn.exe
  2⤵
  PID:13992
- C:\Windows\System\whpHevH.exe
  C:\Windows\System\whpHevH.exe
  2⤵
  PID:14040
- C:\Windows\System\PdhNFvb.exe
  C:\Windows\System\PdhNFvb.exe
  2⤵
  PID:14264
- C:\Windows\System\ZrsQppi.exe
  C:\Windows\System\ZrsQppi.exe
  2⤵
  PID:13636
- C:\Windows\System\BLurAZr.exe
  C:\Windows\System\BLurAZr.exe
  2⤵
  PID:2852
- C:\Windows\System\kshSDzH.exe
  C:\Windows\System\kshSDzH.exe
  2⤵
  PID:13840
- C:\Windows\System\rNIdgSl.exe
  C:\Windows\System\rNIdgSl.exe
  2⤵
  PID:13900
- C:\Windows\System\ACOBWHY.exe
  C:\Windows\System\ACOBWHY.exe
  2⤵
  PID:3608
- C:\Windows\System\JTHviVv.exe
  C:\Windows\System\JTHviVv.exe
  2⤵
  PID:4372
- C:\Windows\System\IxBUISN.exe
  C:\Windows\System\IxBUISN.exe
  2⤵
  PID:13716
- C:\Windows\System\GmNBSGf.exe
  C:\Windows\System\GmNBSGf.exe
  2⤵
  PID:13272
- C:\Windows\System\mPnOHIe.exe
  C:\Windows\System\mPnOHIe.exe
  2⤵
  PID:9924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tkeetzk1.3sq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AsSFyJg.exe

Filesize
1.8MB

MD5
1c5cf76366105a87128722e98d92f92c

SHA1
c4de4945e50f5f636e4b411638459feac95b2b9d

SHA256
7081465477cc698f480f6cc422e1bb4475e91c18b707c97da141b673741b7f55

SHA512
c8260d283e5c096306a6800f6b0e1d7e82e4cf0c5538407171a6cd59f5b8ec062f7a3a8d685a40fff72a0a75bd28ff5e6e8fdea378c2583272b5f36eabc8270b

Download Submit
C:\Windows\System\AxuDddo.exe

Filesize
1.8MB

MD5
539fd08621b91badd8e8af697f37b6e5

SHA1
dde5e82b8e2970692430f7887f017ef531a22789

SHA256
764d81c4b29ada49084d93c95f708e53631d75f1ba41c965ab9240cf8e7605d3

SHA512
468a26bfa255f83fc587ae930e240dcd517ceb259f06652a9b9adddd6fb6654dca886100f9d863975f7a5de535c411add89dc9c04494c15539c40651f1e56356

Download Submit
C:\Windows\System\BbOgcUT.exe

Filesize
1.8MB

MD5
c56307d2f9bcded52d20b962ac1aa081

SHA1
c86b36b7446d9413b15f5977ea5640b628ad83b3

SHA256
0ba5d7840c96a95480b156548705dd11f4942f2b870f30ae418aa6cb0827ddef

SHA512
47daa6c9e79138267ce292df1b8869d2b6928d17daf17e9c4aa2a19ce781958715e099814eb5e4dad83053f4319c0777b914e5e13e74fd6e337401b5c7df8479

Download Submit
C:\Windows\System\BbRXgfV.exe

Filesize
1.8MB

MD5
f70254621bd0d7cb80ee41d5b7687c58

SHA1
39f80d182cf34f1cc707d717e4c7b020e1808bb9

SHA256
9d3b81dbc942a47248ccb69f13c68fd0a8a9f451e71e347aa4483a2bcb4199c2

SHA512
78226b1a85d0beefff0c3c04a565902b1eb8d83fa49120616c0a840e40e4e6fc9c0882dc821dcd02dfeffec0b5b6c30288d36871013e3d0ac7eafb93fef3b23d

Download Submit
C:\Windows\System\DThLnDB.exe

Filesize
1.8MB

MD5
880a67c56d014f97918077240691bbd6

SHA1
70e8d4b36ba30e091e419c36487d8bfcdbb79741

SHA256
b11bf5cf72cdb81ffef2fea6991c4d162ca8156dff39cbbfbeb2c90eca6441d9

SHA512
ee3deeaf95e4ef741c09aec01e7797e2ec845cbe4a3a2d0c04067454c791afe1801ea1655a6aa9d49d622185dfe7111328207cd5bffac9a5e6f21e62c56afbf9

Download Submit
C:\Windows\System\EIGkZrB.exe

Filesize
1.8MB

MD5
b6354c5a56f694d0bbb2249877236f02

SHA1
d14c399a2ab087d3fcbd424db06eb555cd4dc1ed

SHA256
c2c13dfd46a8265006f5632c374998f33f830308ac48a40011735431abaffeee

SHA512
92b8d5164bd7138a8899f62e47cf100668ab3c4b67c3be7ddcc5d1d15d0f9cb992d96814aa95a574a9265aec246945e6b7fd5141452dee45b178d1d864bbc826

Download Submit
C:\Windows\System\JCFkdzg.exe

Filesize
1.8MB

MD5
ec716d91c0bc90ffc0d5413bb55b9ff4

SHA1
f0fe8b36738924034223c43a4c63ed396ebcb0f1

SHA256
7340cb2c4373dfd11ace01f9aa75c18fff6515ef42dda7d7edd5fe46508fd077

SHA512
1affb92153b3ab3ae936686956702ed6087e3ce190ccfb24543ea1dc8cb9d23c7e2759e56936002c3438dbd1851937768fc9941751332a429320e57f838c892d

Download Submit
C:\Windows\System\PFbhikZ.exe

Filesize
1.8MB

MD5
4fdae367f54bc13cc1222582de6a3532

SHA1
5052c409ce6e786c231ab988a3c69b8b289115bc

SHA256
b01874e54539f92805c89ba6dc8907be6c38cfd1876c99214b3b93c1c6d9b1a7

SHA512
82a38c690f497a879cd45ca72dcc5263f436cf14a44f55c516d54b7e14a723f11f07f3aa4d4597ed0e61153034697ca5395ac75439f6e67c69689ee1595b25a3

Download Submit
C:\Windows\System\QGLWuZE.exe

Filesize
1.8MB

MD5
74d7eaf44733d30ca0d9fc6cf7b04d6a

SHA1
4f3952b6074c54adb35e217fc759cec2baaa0fdc

SHA256
638a8f4c6108621ddd9a99b00bf19fec8b5f6973cd6c90e79adeeecced8cd8fe

SHA512
cd72149cbd43432c5e46e836c55d58f0ee1048b87dc31cbbd58d00369ef97fec276b24a491b64031a05267b061f43fefb226a1d15282f7bbbb03a5d1121ad0bf

Download Submit
C:\Windows\System\QhKQGgD.exe

Filesize
8B

MD5
3277aa72bb7d7f1eb1043502fbd1c406

SHA1
8712dca2f3fbc82bf0cbbeecdc5d6a26c87f443c

SHA256
e94b62f30c9ce8b0b5cea14d4367a52fe08005d1bd56ca932a1fd7fc15c61bc9

SHA512
9fb0369549dba8937fb796cbc4ade6bacf540f10f98e02675f1b04c615cbb49e396cdbd25cd29de56c7bfb889c8464199939a84fa31434a75c020caeb4f9f503

Download Submit
C:\Windows\System\QyYUZRb.exe

Filesize
1.8MB

MD5
923e36b7a8a9602ddfbd7be344301676

SHA1
462422b42ed7e355366b6548fdfadfd202a4d541

SHA256
ba1cb07f9f3df7cd9caf928ffda03eabcc55c2d5da7dad7c9a62315438f1dc00

SHA512
8d62d19da7d6270a6267af44f5dfdc3bce439e65f692cf4cd6104859000cec44526e5c917230c0a36eadaf4c89784bf717100493550dc8a5635a0793bf557948

Download Submit
C:\Windows\System\RHSosYU.exe

Filesize
18B

MD5
245dee33bd0829fb0a14fffbb01cddca

SHA1
3098465efbb0ab58d084dea73fb53b7464aa2124

SHA256
42ab9954ae85f062ea70b5a38d7cb35251b9594624f80f499a57a579cabb5d86

SHA512
4a249b410305275b4e8f1049bfb6debe0c906ca24cdd1c084f91263bd1208ad51b8937135ff9506b71885993cc7bafe2c69d5ba8bf11fa3ad12e247f4d803429

Download Submit
C:\Windows\System\RRdAOJf.exe

Filesize
1.8MB

MD5
be1688cd8a865885729a18c9a1a2f71c

SHA1
bb52c44e899a6cd6ffec40afba22c64e2c955ee4

SHA256
76605e8fbaf737ceb163f34264a078ca8cc167909872dc07a5384270594df8cc

SHA512
a6158b39f38d927911c6e707a5c97fd5a668455db16081f69e2e9443f91c8dbe8ce6a26d07aee64295c48c607e82194ceefe9e35d0c58b1942ed778d8d98fab6

Download Submit
C:\Windows\System\SkzISHg.exe

Filesize
1.8MB

MD5
f968f2c623bf356ade585c28a7e78676

SHA1
fa3cd64f3dd265abca9e4421d174060a6dcf04df

SHA256
0d99e55d5a31ff66f163060c5af772a0bc6646e1ff641616188fe0baeb659391

SHA512
af4db1125523b6df7a94c60c390f69801c22e2093bcedc25e733049b30ee362a6e3cbc29978f2dfa6ef3ad3e187f903c0d8d7a30e9e3cc1265d32c5b44bbf259

Download Submit
C:\Windows\System\UKtBwfZ.exe

Filesize
1.8MB

MD5
91220c821e61b6c48d2db49c5c95db0d

SHA1
bf881166a1b56945eeb484d397e9faafd5eabf1d

SHA256
951d52bc276bf5991709721e3f9161e751ff185d63dfcb2f7628e55ffabc3e04

SHA512
52180627d5aac9a2d316113ecf3e6bfc10b95e369833387020692b17e24804990a30fb4fc4207080fd6d970698ef3f95211abf2c7ae902ab7ca4a688e3bbda2b

Download Submit
C:\Windows\System\XzvSjzx.exe

Filesize
1.8MB

MD5
7b4e011d5a5724a4cd3df6366e881f58

SHA1
a1a45ccc90f8ab509c4ab2b3462e1b7c9ace1744

SHA256
722e45fd9aa0275bddd03977adbbc641726c057b04ccad4198da5a220eeac8cb

SHA512
23b098aceeec4231dc6ec34bd5a82e8ea4d9119f5f9201d3945e30f8981ebc5cc00bee41f6eff6726dcf5678f06c8bbcea6ec25920289c74d5d6c9751ffc7d6c

Download Submit
C:\Windows\System\YpdjEbK.exe

Filesize
1.8MB

MD5
6849ad1fd4902997279c89420c051ea9

SHA1
516c0cf58f64108f8e9057305c551588058c8582

SHA256
34f8a7bd224116c80473ca4a897ac97c641c1de1667031359342176d5a0e7f98

SHA512
d2392de30a03f509e35de6227b322b259aa7abf01ab118bb1a39e859bfe0dd39f26f771e059cb28d2e6bf7fdfa24fc32edf29070e74939e87fbc2df1e3ed986f

Download Submit
C:\Windows\System\bGyBpfo.exe

Filesize
1.8MB

MD5
bf757eabf9108f75de7a5d34aa7b28ed

SHA1
5cad7e7b611d3e5a447f841e1b4b93245066653c

SHA256
4f6901471e313a717babea4b3d1c069acef497f355ea19683e631bffd6658d22

SHA512
27876bd8c24f9f177b634826f2acb8b0fae60ae15ae7424d71d05ecea7b030836cf2b6369d47b1cb9bf183a1ab97ea87a63f5c42b4c18703851ddb3855477b0b

Download Submit
C:\Windows\System\bYiFbOm.exe

Filesize
1.8MB

MD5
63cba48244a9eaed080f0e1441f84fc9

SHA1
6fbf9af987f3363c8a774092bef532214ba5471a

SHA256
bfb4177836c54ad7f5324ec8370800ab295b7787611905436b1cd4364a2b072b

SHA512
cbc1b572cb15e76e7b8797419d8b48eb416cb73842d59488a8ab7b00d40bebe35ecccd20f38f7eeb23819e250ed758faeb39939093aea8ff9b69f9c70f014d23

Download Submit
C:\Windows\System\cxAOONl.exe

Filesize
1.8MB

MD5
6b7960c678b94a273fe0a6eff0faeeb1

SHA1
522d7081c9b5cc6e8d7839040dc3294ae634493d

SHA256
6572938a875fedfeaeebbd107d292472dcbef13850bc157f95dc6d5ab189b1ec

SHA512
f4b05f9065e375688ed9885eb83cf29b48583d5d1b4e6035c2de21ac64dd44f0b13724e567a4656f31682dcc09fd62989a08b43172cc31b77014b62c4f2411fb

Download Submit
C:\Windows\System\eBsPUZf.exe

Filesize
1.8MB

MD5
14e63de9fff43a4dfddf27f4fbb21a35

SHA1
8fb3a523914d75ff7323a891c39c9904cc84ab68

SHA256
e2ea87530abed473c5d1368c0258facc060a66fc005d0695fb6e39f1d7c75dd3

SHA512
d18cbc2de93e7e5413e2b213b3cca003c21e24b32b87619105ddb1b56148895559346d676bea0774d486ff0ef392abe37c6610ef9977f9cfa5858d2751e6f8f0

Download Submit
C:\Windows\System\iDGSGPo.exe

Filesize
1.8MB

MD5
83dd8bba89b5c3466578f7b090aefbdf

SHA1
7b2c2b0eec96394af7f982201a4d1d52cc3a45e6

SHA256
e0bdcfa4f0d539bc4f8be5c1c42b9322bfdbdde09883d6fe44c5fb672c27b9c6

SHA512
580a4f8fd04e8969ce42fff755aa62dd93b636fa5e6e5f9695751bd41359b805e88aceb658a1a66bd2cde0facd0cbf18b966c9f9a778974949ac557bf364d152

Download Submit
C:\Windows\System\iawxxgu.exe

Filesize
1.8MB

MD5
7f1c62247654c85248a95d3b475560c8

SHA1
35c7de9ef5c7d30472e31d581a7df7d737051ee7

SHA256
d59c1cabab42c56739691d484badec5f1c645caaefbe2dafa9bbc8c1228f797a

SHA512
778f074b430c6ed34f61b8b3ab014a987d74f9c9e9bad30d19b127d753ad7ff861b707a04a076a8e7c737e68d64b4fd01d0c3bb1b4b764bcbcc636c70e3c9366

Download Submit
C:\Windows\System\kDbTtXf.exe

Filesize
1.8MB

MD5
5f9fa06e2ea8857d3780ec72a48b701b

SHA1
f1d3fedf7ae394a2040d591619ec1bea90643a5e

SHA256
d8f8c88709c8a830326487cf757bfd9449458c3eee4c95be0e4e4ad736d41f05

SHA512
a0ce2d432e6d6ef619e160d1a464e4836a275bd329a1c2bd10811bbc9f407d0984a7577504672bd35c2c7d434b5c058cfe7c2affd0afa94cf958faff41811043

Download Submit
C:\Windows\System\kLNUVgV.exe

Filesize
1.8MB

MD5
5001b64e33581906af3c71b401c9fede

SHA1
cf3e53083142e42a63ebc746dd95dec666fcb7c1

SHA256
66848f045d2170f143ad284766456ac5b41cd7db3e0fa0ab37fb5dc9bc0d5157

SHA512
2ed1583ca34abf0fa62d3d8100589dc32ee0c9ab10d1580d46fd273811fb48a8ebd4c373f1ee6a50187bb1e2bd7e2eb3824a85395e084107c993190af6409b07

Download Submit
C:\Windows\System\kwsnRYP.exe

Filesize
1.8MB

MD5
d1d2202fe82f279f5d9abff9b5d37ffa

SHA1
a4ecff7f1ea586621b9d34e325987edf9e5c4128

SHA256
7ed472ee4be8ebe71547ecc1c4ecb42f0ea5e7ce8000f91e8a2bcdf0c7eea30c

SHA512
6ec6f41aa56782b7c3836b976b4bc31f8e4f6a44623e506258eabbce51d8e092902ebe35cf31f7887ed28e40cc9315589730fecf62914bf8e34e5a8832cc5fad

Download Submit
C:\Windows\System\lWbXoDv.exe

Filesize
1.8MB

MD5
c978c1ce53a01838715ebe4635f7bb11

SHA1
a81e919400eabcbeebb87dd007ccef3d239b5f94

SHA256
6cb1cc9de0fb2cb87fcdc2ae73f721a6efa849fc6b28dfb8db11ad4f355ab441

SHA512
e4e10bf01fa5db4b6979d8b69c8c747a6b1107613fd138ca2ada88dc72b5807574390fe0abd074f64b36618e5ceed3fa831962b221b585c3718a2345d4ed541c

Download Submit
C:\Windows\System\lioyUwy.exe

Filesize
1.8MB

MD5
4fdab8f6abb18f32ddbb4fd49c7ed1d7

SHA1
386dcec6a1472c51a019a3a08ae263282b89a9f6

SHA256
25d3323b00eb8cbb8b5be3b42c1bb23672bc06d59368d3cb298f637bee03d6ce

SHA512
3d943a7573a276c88d6cd5f51d263daf75d0331f69f2a9a2956f0680122122da7fa33d37507d588a8d54b93a98abd8481bfe41c170e461c9b5e3f391d73a08a7

Download Submit
C:\Windows\System\mVEpkNV.exe

Filesize
1.8MB

MD5
fa62f14517137aacee4c1bca763ba12d

SHA1
3a58c90d51da1b305cb0b8ee6d669364a74fe389

SHA256
5cb6ac8377b24af5b092db916826652a6ad518718995f0e217e3b0b299af28e3

SHA512
0a108eda49184ef7e713bee093b7e98f0ddd817c89fe7c65c5304a8b85a422fa5612a678be5ea63ca9869829140b6f75b62144c3a6b3b26a4db180b065749b22

Download Submit
C:\Windows\System\nLZesKR.exe

Filesize
1.8MB

MD5
fcd06bb29a6e01937c3924667cb2916d

SHA1
505cccd8892e2c29920e620d12afd9634a0fe773

SHA256
a1ed277ca54f12ee3ea7a42708cf32a6a80a47705ffc7d75e2fa19f5eef6f9f4

SHA512
2b1e3f357ff4010c64958446bbc2f29bd62cb5554527af7432d56330f8dcfa0c3b313f8e3f7d042dab790fb405388ccc83bedaa348f28dfc0b69f68d3740f896

Download Submit
C:\Windows\System\nycfBKA.exe

Filesize
1.8MB

MD5
83f2f7f5b3341a6af1c7cb01a69f2382

SHA1
2cba8c9d5c72f25206dfecbbc4a33692adcbf8c6

SHA256
7067d1a52290f7443a139926901b349ef8f1099bfea82c04c51600d1001bdf69

SHA512
c8f2366fcc23da2d8307026f4f819ef5acf645281c73c9138f34c1942f83dc80b4acac593656600e79e70aa3a8a05e37f32e1ab64ae862c8bf56b60983169417

Download Submit
C:\Windows\System\pfGqxow.exe

Filesize
1.8MB

MD5
030541bec88e4f142b8478e1f235b090

SHA1
3c15687ad716cae80a2a912379d9b757992baff9

SHA256
0be0cf3791d9a763a919bcc3d65e3b153ea7127fc29d2e764d7b1510275a843b

SHA512
ea593d934e563f7c54c54aca8a8e7e3ece783f083ba082c72cfdfe1a3785fb6f6a1638fa969ea661ef9f0b5405e046ddadc87b81ec6656b89ed178aab613dcbc

Download Submit
C:\Windows\System\sckRHTh.exe

Filesize
1.8MB

MD5
f595c621d8f02bef058a631b37f02465

SHA1
564deff45bb3b487cd1e181101c0647106dd60bb

SHA256
cdc5465d78d856feb697e6e45a6150ec1defc23ff88cf0a46b6661118e713cc3

SHA512
cba4a119b60a1e4b740d47f430de21e43b8d218f9a054eae08f583138b10684119890ef54aa41b1c8edc7525b5a5b53c12033a0b7852b98a469667b63fd8ae85

Download Submit
C:\Windows\System\ukpaxPr.exe

Filesize
1.8MB

MD5
f1625aa43efd97471f7679072a7bf21b

SHA1
2bf41c582312f74f27e5077aeeb6ee2adb849633

SHA256
d14698a9c656d309e0fbf33897c544b0437ce80e8fb13413a18550005e806ca6

SHA512
e18e7ecff29a554efd9148102d4c66a05d9451e7cd3e16ecb23b97967d920b053fc7650b585ee5f3cb09d49d91cf23a1a27868baa74f86e1cab10ed47a690e4d

Download Submit
C:\Windows\System\ymDCnVv.exe

Filesize
1.8MB

MD5
859762472bc28b66a6b1b7b943b8c3e6

SHA1
554ab93a2b5e124fce17587bd51c1572665988ad

SHA256
5676cceb54d37e8210feebe60e784b4c5dd272f42660cf44b79105607f68ff20

SHA512
87e6d1b621d860169d8840f7d08403a2606885b27467cbef44ee1a3f5b956cc67bb8841c72626465fc27f4fe8d73d185c202008ce580b8eee63ac38360c85e1c

Download Submit
memory/748-52-0x00007FF7E4400000-0x00007FF7E47F2000-memory.dmp

Filesize
3.9MB

Download
memory/1764-91-0x000001E4FFD30000-0x000001E4FFD52000-memory.dmp

Filesize
136KB

Download
memory/1764-38-0x000001E499BF0000-0x000001E499C00000-memory.dmp

Filesize
64KB

Download
memory/1764-37-0x000001E499BF0000-0x000001E499C00000-memory.dmp

Filesize
64KB

Download
memory/1764-34-0x00007FFA18F40000-0x00007FFA19A01000-memory.dmp

Filesize
10.8MB

Download
memory/1948-81-0x00007FF64B320000-0x00007FF64B712000-memory.dmp

Filesize
3.9MB

Download
memory/2248-126-0x00007FF7604B0000-0x00007FF7608A2000-memory.dmp

Filesize
3.9MB

Download
memory/2328-87-0x00007FF7A0C70000-0x00007FF7A1062000-memory.dmp

Filesize
3.9MB

Download
memory/2356-125-0x00007FF6D8A40000-0x00007FF6D8E32000-memory.dmp

Filesize
3.9MB

Download
memory/2636-95-0x00007FF706540000-0x00007FF706932000-memory.dmp

Filesize
3.9MB

Download
memory/2760-63-0x00007FF688390000-0x00007FF688782000-memory.dmp

Filesize
3.9MB

Download
memory/3028-115-0x00007FF6C5030000-0x00007FF6C5422000-memory.dmp

Filesize
3.9MB

Download
memory/3056-14-0x00007FF75F370000-0x00007FF75F762000-memory.dmp

Filesize
3.9MB

Download
memory/3056-4162-0x00007FF75F370000-0x00007FF75F762000-memory.dmp

Filesize
3.9MB

Download
memory/3148-521-0x00007FF7E64B0000-0x00007FF7E68A2000-memory.dmp

Filesize
3.9MB

Download
memory/3268-533-0x00007FF7EE180000-0x00007FF7EE572000-memory.dmp

Filesize
3.9MB

Download
memory/3508-539-0x00007FF761E90000-0x00007FF762282000-memory.dmp

Filesize
3.9MB

Download
memory/3540-543-0x00007FF6F5E50000-0x00007FF6F6242000-memory.dmp

Filesize
3.9MB

Download
memory/3812-94-0x00007FF6A73B0000-0x00007FF6A77A2000-memory.dmp

Filesize
3.9MB

Download
memory/3848-548-0x00007FF679F70000-0x00007FF67A362000-memory.dmp

Filesize
3.9MB

Download
memory/3884-100-0x00007FF72C5F0000-0x00007FF72C9E2000-memory.dmp

Filesize
3.9MB

Download
memory/3972-127-0x00007FF67AFE0000-0x00007FF67B3D2000-memory.dmp

Filesize
3.9MB

Download
memory/3972-5875-0x00007FF67AFE0000-0x00007FF67B3D2000-memory.dmp

Filesize
3.9MB

Download
memory/3984-0-0x00007FF702200000-0x00007FF7025F2000-memory.dmp

Filesize
3.9MB

Download
memory/3984-1-0x000001F977A00000-0x000001F977A10000-memory.dmp

Filesize
64KB

Download
memory/4020-544-0x00007FF638E90000-0x00007FF639282000-memory.dmp

Filesize
3.9MB

Download
memory/4404-540-0x00007FF77B920000-0x00007FF77BD12000-memory.dmp

Filesize
3.9MB

Download
memory/4912-536-0x00007FF72B140000-0x00007FF72B532000-memory.dmp

Filesize
3.9MB

Download
memory/4912-5965-0x00007FF72B140000-0x00007FF72B532000-memory.dmp

Filesize
3.9MB

Download
memory/5000-526-0x00007FF6ECA00000-0x00007FF6ECDF2000-memory.dmp

Filesize
3.9MB

Download