xmrig | dc9a5120d95e6c6ba398ebb04d0304e896229a7f65d8ba7c42b0ad6dce89c229

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 00:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
Size

1.9MB
MD5

01faf1f4f08af8e45200290411e0f8ed
SHA1

3147d1f6bffb472db126ae31f07fe321ea2ce72d
SHA256

dc9a5120d95e6c6ba398ebb04d0304e896229a7f65d8ba7c42b0ad6dce89c229
SHA512

cadf24459fae0d6fed07290ce3515d7840d14eff9e0d9aeb85ed21e924cfbd3801b59a7f62dca42a85986c4e1cbdc4e3a6e03cef3afca0ab6a30f33670e9f762
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+Uh:NABE

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 31 IoCs

miner

resource	yara_rule
behavioral2/memory/4592-21-0x00007FF7B8F30000-0x00007FF7B9322000-memory.dmp	xmrig
behavioral2/memory/3984-34-0x00007FF61F500000-0x00007FF61F8F2000-memory.dmp	xmrig
behavioral2/memory/3668-41-0x00007FF787A20000-0x00007FF787E12000-memory.dmp	xmrig
behavioral2/memory/2492-42-0x00007FF71A330000-0x00007FF71A722000-memory.dmp	xmrig
behavioral2/memory/4968-48-0x00007FF7B3150000-0x00007FF7B3542000-memory.dmp	xmrig
behavioral2/memory/2772-512-0x00007FF663B40000-0x00007FF663F32000-memory.dmp	xmrig
behavioral2/memory/3384-513-0x00007FF638770000-0x00007FF638B62000-memory.dmp	xmrig
behavioral2/memory/2480-517-0x00007FF708F10000-0x00007FF709302000-memory.dmp	xmrig
behavioral2/memory/2004-523-0x00007FF6AFD90000-0x00007FF6B0182000-memory.dmp	xmrig
behavioral2/memory/4660-526-0x00007FF6A9320000-0x00007FF6A9712000-memory.dmp	xmrig
behavioral2/memory/2984-541-0x00007FF72A5E0000-0x00007FF72A9D2000-memory.dmp	xmrig
behavioral2/memory/4516-527-0x00007FF7721A0000-0x00007FF772592000-memory.dmp	xmrig
behavioral2/memory/3192-64-0x00007FF6D1C60000-0x00007FF6D2052000-memory.dmp	xmrig
behavioral2/memory/368-543-0x00007FF7B1170000-0x00007FF7B1562000-memory.dmp	xmrig
behavioral2/memory/1852-556-0x00007FF7A2630000-0x00007FF7A2A22000-memory.dmp	xmrig
behavioral2/memory/1364-579-0x00007FF6A9B80000-0x00007FF6A9F72000-memory.dmp	xmrig
behavioral2/memory/436-576-0x00007FF744930000-0x00007FF744D22000-memory.dmp	xmrig
behavioral2/memory/1800-571-0x00007FF6D5460000-0x00007FF6D5852000-memory.dmp	xmrig
behavioral2/memory/3612-550-0x00007FF78E160000-0x00007FF78E552000-memory.dmp	xmrig
behavioral2/memory/2328-52-0x00007FF62D3E0000-0x00007FF62D7D2000-memory.dmp	xmrig
behavioral2/memory/432-27-0x00007FF623710000-0x00007FF623B02000-memory.dmp	xmrig
behavioral2/memory/1028-5904-0x00007FF6A3790000-0x00007FF6A3B82000-memory.dmp	xmrig
behavioral2/memory/4592-6901-0x00007FF7B8F30000-0x00007FF7B9322000-memory.dmp	xmrig
behavioral2/memory/3984-6917-0x00007FF61F500000-0x00007FF61F8F2000-memory.dmp	xmrig
behavioral2/memory/2492-6920-0x00007FF71A330000-0x00007FF71A722000-memory.dmp	xmrig
behavioral2/memory/2028-6930-0x00007FF6580B0000-0x00007FF6584A2000-memory.dmp	xmrig
behavioral2/memory/2984-6934-0x00007FF72A5E0000-0x00007FF72A9D2000-memory.dmp	xmrig
behavioral2/memory/2772-6939-0x00007FF663B40000-0x00007FF663F32000-memory.dmp	xmrig
behavioral2/memory/436-6951-0x00007FF744930000-0x00007FF744D22000-memory.dmp	xmrig
behavioral2/memory/1364-6953-0x00007FF6A9B80000-0x00007FF6A9F72000-memory.dmp	xmrig
behavioral2/memory/1800-6947-0x00007FF6D5460000-0x00007FF6D5852000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4592	mfRvaWr.exe
432	AbzXWVH.exe
3668	KZufiSA.exe
3984	cJzlQCz.exe
2492	DMkgYoK.exe
4968	LzJLpcS.exe
2328	WaevJSd.exe
1164	ogaCvFG.exe
3192	MwXAeRB.exe
2028	MZGzYuE.exe
1028	ndkGyYw.exe
2772	mPcndiJ.exe
3384	dpBbKyh.exe
2480	TlRdmNl.exe
2004	KMcheYP.exe
4660	HPeUrkA.exe
4516	YCpowyB.exe
2984	JthOCaw.exe
368	cgCIkak.exe
3612	YHhwSnC.exe
1852	OeQwNqP.exe
1800	vCCdIVL.exe
436	zEKItWF.exe
1364	XlcYuSk.exe
2504	ZdDzZxH.exe
880	qvLfdLT.exe
512	ISpccJh.exe
712	tHxpVSZ.exe
3744	PwziKrb.exe
2376	sCwjTHp.exe
1032	jlCNcyG.exe
2000	kShHpNO.exe
2056	nemPLwq.exe
4612	keywkLi.exe
2872	spPqPqz.exe
2192	kQaYZan.exe
4976	kQyOkGw.exe
1804	ngJBgMu.exe
4400	kmdWqBb.exe
1808	IQXgsuk.exe
1784	qQFEwSN.exe
2412	pOFDSTn.exe
2144	kBhscYx.exe
4548	JxSnpnN.exe
3784	LCxlZsH.exe
2336	kqkkNVt.exe
716	IQAfPkg.exe
3440	DYbaiaw.exe
4452	JDJGsEH.exe
1264	hRXasfw.exe
2064	HZXiyWU.exe
3212	xtjXkxb.exe
3676	vopHoQZ.exe
2348	Xpfleyd.exe
1412	ulrRSgj.exe
2952	rkLxDWX.exe
1488	PUpPNqQ.exe
4696	OtXrhbI.exe
2068	CrXEDwQ.exe
2024	mUzczTK.exe
4316	RtyTRTh.exe
4460	GvtkTWQ.exe
3104	hXcFYKJ.exe
884	XwERyfm.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2500-0-0x00007FF76D910000-0x00007FF76DD02000-memory.dmp	upx
behavioral2/files/0x000b000000023b7f-5.dat	upx
behavioral2/files/0x000a000000023b87-8.dat	upx
behavioral2/files/0x000a000000023b86-12.dat	upx
behavioral2/memory/4592-21-0x00007FF7B8F30000-0x00007FF7B9322000-memory.dmp	upx
behavioral2/files/0x000a000000023b88-25.dat	upx
behavioral2/files/0x000a000000023b89-30.dat	upx
behavioral2/memory/3984-34-0x00007FF61F500000-0x00007FF61F8F2000-memory.dmp	upx
behavioral2/memory/3668-41-0x00007FF787A20000-0x00007FF787E12000-memory.dmp	upx
behavioral2/memory/2492-42-0x00007FF71A330000-0x00007FF71A722000-memory.dmp	upx
behavioral2/memory/4968-48-0x00007FF7B3150000-0x00007FF7B3542000-memory.dmp	upx
behavioral2/memory/2028-59-0x00007FF6580B0000-0x00007FF6584A2000-memory.dmp	upx
behavioral2/files/0x000a000000023b8f-65.dat	upx
behavioral2/files/0x000a000000023b90-75.dat	upx
behavioral2/files/0x000a000000023b93-84.dat	upx
behavioral2/files/0x000a000000023ba4-179.dat	upx
behavioral2/memory/2772-512-0x00007FF663B40000-0x00007FF663F32000-memory.dmp	upx
behavioral2/memory/3384-513-0x00007FF638770000-0x00007FF638B62000-memory.dmp	upx
behavioral2/memory/2480-517-0x00007FF708F10000-0x00007FF709302000-memory.dmp	upx
behavioral2/memory/2004-523-0x00007FF6AFD90000-0x00007FF6B0182000-memory.dmp	upx
behavioral2/memory/4660-526-0x00007FF6A9320000-0x00007FF6A9712000-memory.dmp	upx
behavioral2/memory/2984-541-0x00007FF72A5E0000-0x00007FF72A9D2000-memory.dmp	upx
behavioral2/memory/4516-527-0x00007FF7721A0000-0x00007FF772592000-memory.dmp	upx
behavioral2/files/0x000a000000023ba5-184.dat	upx
behavioral2/files/0x000a000000023ba3-182.dat	upx
behavioral2/files/0x000a000000023ba2-177.dat	upx
behavioral2/files/0x000a000000023ba1-172.dat	upx
behavioral2/files/0x000a000000023ba0-167.dat	upx
behavioral2/files/0x000b000000023b98-162.dat	upx
behavioral2/files/0x000a000000023b9f-157.dat	upx
behavioral2/files/0x000a000000023b9e-152.dat	upx
behavioral2/files/0x000a000000023b9d-147.dat	upx
behavioral2/files/0x000a000000023b9c-142.dat	upx
behavioral2/files/0x000a000000023b9b-137.dat	upx
behavioral2/files/0x000a000000023b9a-132.dat	upx
behavioral2/files/0x000b000000023b99-127.dat	upx
behavioral2/files/0x000a000000023b97-122.dat	upx
behavioral2/files/0x000a000000023b96-117.dat	upx
behavioral2/files/0x000a000000023b95-112.dat	upx
behavioral2/files/0x000a000000023b94-95.dat	upx
behavioral2/files/0x000a000000023b92-85.dat	upx
behavioral2/files/0x000a000000023b91-79.dat	upx
behavioral2/memory/1028-66-0x00007FF6A3790000-0x00007FF6A3B82000-memory.dmp	upx
behavioral2/memory/3192-64-0x00007FF6D1C60000-0x00007FF6D2052000-memory.dmp	upx
behavioral2/memory/368-543-0x00007FF7B1170000-0x00007FF7B1562000-memory.dmp	upx
behavioral2/memory/1852-556-0x00007FF7A2630000-0x00007FF7A2A22000-memory.dmp	upx
behavioral2/memory/1364-579-0x00007FF6A9B80000-0x00007FF6A9F72000-memory.dmp	upx
behavioral2/memory/436-576-0x00007FF744930000-0x00007FF744D22000-memory.dmp	upx
behavioral2/memory/1800-571-0x00007FF6D5460000-0x00007FF6D5852000-memory.dmp	upx
behavioral2/memory/3612-550-0x00007FF78E160000-0x00007FF78E552000-memory.dmp	upx
behavioral2/files/0x000a000000023b8e-60.dat	upx
behavioral2/files/0x000a000000023b8d-56.dat	upx
behavioral2/files/0x000a000000023b8c-54.dat	upx
behavioral2/memory/1164-53-0x00007FF7A5D80000-0x00007FF7A6172000-memory.dmp	upx
behavioral2/memory/2328-52-0x00007FF62D3E0000-0x00007FF62D7D2000-memory.dmp	upx
behavioral2/files/0x000a000000023b8b-44.dat	upx
behavioral2/files/0x000a000000023b8a-33.dat	upx
behavioral2/memory/432-27-0x00007FF623710000-0x00007FF623B02000-memory.dmp	upx
behavioral2/memory/1028-5904-0x00007FF6A3790000-0x00007FF6A3B82000-memory.dmp	upx
behavioral2/memory/4592-6901-0x00007FF7B8F30000-0x00007FF7B9322000-memory.dmp	upx
behavioral2/memory/3984-6917-0x00007FF61F500000-0x00007FF61F8F2000-memory.dmp	upx
behavioral2/memory/2492-6920-0x00007FF71A330000-0x00007FF71A722000-memory.dmp	upx
behavioral2/memory/2028-6930-0x00007FF6580B0000-0x00007FF6584A2000-memory.dmp	upx
behavioral2/memory/2984-6934-0x00007FF72A5E0000-0x00007FF72A9D2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\aDdmzNy.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\VhpkBqW.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\kfypTYr.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\aIbQHMM.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\OkQOVro.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\svxyxGS.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\DGkqNTZ.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\cWgZaoX.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\enHrIMI.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\PQpxMrv.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\DSgAEgW.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\RnNNPCe.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\uNSirFv.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\ecfuTGe.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\jDSHrph.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\vizGkFB.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\MJSmMtj.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\nbqQXLD.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\qVMyZQl.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\BQQIawJ.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\FMXkHir.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\QWBzeCo.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\lNvwzhJ.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\asWrqWd.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\VDDvxbs.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\AsqKXUQ.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\WGAPRsJ.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\cjsmsEY.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\oSqYkDD.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\VrGZUVW.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\shgcjgv.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\duLmCGO.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\veCcTkD.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\DTJuuSP.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\LFgRAjd.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\kJdXrrH.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\VsgYVnY.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\xROovKx.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\wWXrnLr.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\cAboCff.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\gnYmSvs.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\FqLnwao.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\VtNmKPA.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\CpaNeml.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\JaLmOhF.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\uOAHWny.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\BHXCtSr.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\BiBxSxs.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\PFfJALm.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\zcQdmxd.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\uBcoHPf.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\nKnYeXc.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\TDaVTmv.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\LOBIowA.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\LzGllru.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\abMltWX.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\mVscSHS.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\mdysBqv.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\HPMvXSq.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\EbeekgT.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\DFOuCqO.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\WnBqRPh.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\XfzNNqU.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
File created	C:\Windows\System\AewstLE.exe	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
Token: SeDebugPrivilege	2272	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 2272	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	89
PID 2500 wrote to memory of 2272	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	89
PID 2500 wrote to memory of 4592	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	90
PID 2500 wrote to memory of 4592	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	90
PID 2500 wrote to memory of 432	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	91
PID 2500 wrote to memory of 432	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	91
PID 2500 wrote to memory of 3668	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	92
PID 2500 wrote to memory of 3668	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	92
PID 2500 wrote to memory of 3984	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	93
PID 2500 wrote to memory of 3984	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	93
PID 2500 wrote to memory of 2492	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	94
PID 2500 wrote to memory of 2492	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	94
PID 2500 wrote to memory of 4968	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	95
PID 2500 wrote to memory of 4968	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	95
PID 2500 wrote to memory of 2328	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	96
PID 2500 wrote to memory of 2328	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	96
PID 2500 wrote to memory of 1164	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	97
PID 2500 wrote to memory of 1164	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	97
PID 2500 wrote to memory of 3192	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	98
PID 2500 wrote to memory of 3192	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	98
PID 2500 wrote to memory of 2028	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	99
PID 2500 wrote to memory of 2028	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	99
PID 2500 wrote to memory of 1028	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	100
PID 2500 wrote to memory of 1028	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	100
PID 2500 wrote to memory of 2772	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	101
PID 2500 wrote to memory of 2772	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	101
PID 2500 wrote to memory of 3384	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	102
PID 2500 wrote to memory of 3384	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	102
PID 2500 wrote to memory of 2480	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	103
PID 2500 wrote to memory of 2480	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	103
PID 2500 wrote to memory of 2004	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	104
PID 2500 wrote to memory of 2004	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	104
PID 2500 wrote to memory of 4660	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	105
PID 2500 wrote to memory of 4660	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	105
PID 2500 wrote to memory of 4516	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	106
PID 2500 wrote to memory of 4516	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	106
PID 2500 wrote to memory of 2984	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	107
PID 2500 wrote to memory of 2984	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	107
PID 2500 wrote to memory of 368	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	108
PID 2500 wrote to memory of 368	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	108
PID 2500 wrote to memory of 3612	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	109
PID 2500 wrote to memory of 3612	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	109
PID 2500 wrote to memory of 1852	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	110
PID 2500 wrote to memory of 1852	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	110
PID 2500 wrote to memory of 1800	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	111
PID 2500 wrote to memory of 1800	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	111
PID 2500 wrote to memory of 436	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	112
PID 2500 wrote to memory of 436	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	112
PID 2500 wrote to memory of 1364	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	113
PID 2500 wrote to memory of 1364	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	113
PID 2500 wrote to memory of 2504	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	114
PID 2500 wrote to memory of 2504	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	114
PID 2500 wrote to memory of 880	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	115
PID 2500 wrote to memory of 880	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	115
PID 2500 wrote to memory of 512	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	116
PID 2500 wrote to memory of 512	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	116
PID 2500 wrote to memory of 712	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	117
PID 2500 wrote to memory of 712	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	117
PID 2500 wrote to memory of 3744	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	118
PID 2500 wrote to memory of 3744	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	118
PID 2500 wrote to memory of 2376	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	119
PID 2500 wrote to memory of 2376	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	119
PID 2500 wrote to memory of 1032	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	120
PID 2500 wrote to memory of 1032	2500	01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe	120

C:\Users\Admin\AppData\Local\Temp\01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\01faf1f4f08af8e45200290411e0f8ed_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2272
- C:\Windows\System\mfRvaWr.exe
  C:\Windows\System\mfRvaWr.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\AbzXWVH.exe
  C:\Windows\System\AbzXWVH.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\KZufiSA.exe
  C:\Windows\System\KZufiSA.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\cJzlQCz.exe
  C:\Windows\System\cJzlQCz.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\DMkgYoK.exe
  C:\Windows\System\DMkgYoK.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\LzJLpcS.exe
  C:\Windows\System\LzJLpcS.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\WaevJSd.exe
  C:\Windows\System\WaevJSd.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\ogaCvFG.exe
  C:\Windows\System\ogaCvFG.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\MwXAeRB.exe
  C:\Windows\System\MwXAeRB.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\MZGzYuE.exe
  C:\Windows\System\MZGzYuE.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\ndkGyYw.exe
  C:\Windows\System\ndkGyYw.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\mPcndiJ.exe
  C:\Windows\System\mPcndiJ.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\dpBbKyh.exe
  C:\Windows\System\dpBbKyh.exe
  2⤵
  - Executes dropped EXE
  PID:3384
- C:\Windows\System\TlRdmNl.exe
  C:\Windows\System\TlRdmNl.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\KMcheYP.exe
  C:\Windows\System\KMcheYP.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\HPeUrkA.exe
  C:\Windows\System\HPeUrkA.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\YCpowyB.exe
  C:\Windows\System\YCpowyB.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\JthOCaw.exe
  C:\Windows\System\JthOCaw.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\cgCIkak.exe
  C:\Windows\System\cgCIkak.exe
  2⤵
  - Executes dropped EXE
  PID:368
- C:\Windows\System\YHhwSnC.exe
  C:\Windows\System\YHhwSnC.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\OeQwNqP.exe
  C:\Windows\System\OeQwNqP.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\vCCdIVL.exe
  C:\Windows\System\vCCdIVL.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\zEKItWF.exe
  C:\Windows\System\zEKItWF.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\XlcYuSk.exe
  C:\Windows\System\XlcYuSk.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\ZdDzZxH.exe
  C:\Windows\System\ZdDzZxH.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\qvLfdLT.exe
  C:\Windows\System\qvLfdLT.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\ISpccJh.exe
  C:\Windows\System\ISpccJh.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\tHxpVSZ.exe
  C:\Windows\System\tHxpVSZ.exe
  2⤵
  - Executes dropped EXE
  PID:712
- C:\Windows\System\PwziKrb.exe
  C:\Windows\System\PwziKrb.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\sCwjTHp.exe
  C:\Windows\System\sCwjTHp.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\jlCNcyG.exe
  C:\Windows\System\jlCNcyG.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\kShHpNO.exe
  C:\Windows\System\kShHpNO.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\nemPLwq.exe
  C:\Windows\System\nemPLwq.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\keywkLi.exe
  C:\Windows\System\keywkLi.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\spPqPqz.exe
  C:\Windows\System\spPqPqz.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\kQaYZan.exe
  C:\Windows\System\kQaYZan.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\kQyOkGw.exe
  C:\Windows\System\kQyOkGw.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\ngJBgMu.exe
  C:\Windows\System\ngJBgMu.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\kmdWqBb.exe
  C:\Windows\System\kmdWqBb.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\IQXgsuk.exe
  C:\Windows\System\IQXgsuk.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\qQFEwSN.exe
  C:\Windows\System\qQFEwSN.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\pOFDSTn.exe
  C:\Windows\System\pOFDSTn.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\kBhscYx.exe
  C:\Windows\System\kBhscYx.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\JxSnpnN.exe
  C:\Windows\System\JxSnpnN.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\LCxlZsH.exe
  C:\Windows\System\LCxlZsH.exe
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\System\kqkkNVt.exe
  C:\Windows\System\kqkkNVt.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\IQAfPkg.exe
  C:\Windows\System\IQAfPkg.exe
  2⤵
  - Executes dropped EXE
  PID:716
- C:\Windows\System\DYbaiaw.exe
  C:\Windows\System\DYbaiaw.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\JDJGsEH.exe
  C:\Windows\System\JDJGsEH.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\hRXasfw.exe
  C:\Windows\System\hRXasfw.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\HZXiyWU.exe
  C:\Windows\System\HZXiyWU.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\xtjXkxb.exe
  C:\Windows\System\xtjXkxb.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\vopHoQZ.exe
  C:\Windows\System\vopHoQZ.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System\Xpfleyd.exe
  C:\Windows\System\Xpfleyd.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\ulrRSgj.exe
  C:\Windows\System\ulrRSgj.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\rkLxDWX.exe
  C:\Windows\System\rkLxDWX.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\PUpPNqQ.exe
  C:\Windows\System\PUpPNqQ.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\OtXrhbI.exe
  C:\Windows\System\OtXrhbI.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\CrXEDwQ.exe
  C:\Windows\System\CrXEDwQ.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\mUzczTK.exe
  C:\Windows\System\mUzczTK.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\RtyTRTh.exe
  C:\Windows\System\RtyTRTh.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\GvtkTWQ.exe
  C:\Windows\System\GvtkTWQ.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\hXcFYKJ.exe
  C:\Windows\System\hXcFYKJ.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\XwERyfm.exe
  C:\Windows\System\XwERyfm.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\ZSBtQAF.exe
  C:\Windows\System\ZSBtQAF.exe
  2⤵
  PID:5132
- C:\Windows\System\oPTcKoj.exe
  C:\Windows\System\oPTcKoj.exe
  2⤵
  PID:5160
- C:\Windows\System\WWMbgNT.exe
  C:\Windows\System\WWMbgNT.exe
  2⤵
  PID:5192
- C:\Windows\System\VtrCDIv.exe
  C:\Windows\System\VtrCDIv.exe
  2⤵
  PID:5216
- C:\Windows\System\thvbvhe.exe
  C:\Windows\System\thvbvhe.exe
  2⤵
  PID:5244
- C:\Windows\System\AWqUfGM.exe
  C:\Windows\System\AWqUfGM.exe
  2⤵
  PID:5272
- C:\Windows\System\jzvbaBP.exe
  C:\Windows\System\jzvbaBP.exe
  2⤵
  PID:5300
- C:\Windows\System\AGETrMF.exe
  C:\Windows\System\AGETrMF.exe
  2⤵
  PID:5328
- C:\Windows\System\ITkkYxd.exe
  C:\Windows\System\ITkkYxd.exe
  2⤵
  PID:5356
- C:\Windows\System\pvMuhaw.exe
  C:\Windows\System\pvMuhaw.exe
  2⤵
  PID:5384
- C:\Windows\System\cKorIlG.exe
  C:\Windows\System\cKorIlG.exe
  2⤵
  PID:5412
- C:\Windows\System\sMokdge.exe
  C:\Windows\System\sMokdge.exe
  2⤵
  PID:5440
- C:\Windows\System\eAUpczW.exe
  C:\Windows\System\eAUpczW.exe
  2⤵
  PID:5468
- C:\Windows\System\QIpzCcs.exe
  C:\Windows\System\QIpzCcs.exe
  2⤵
  PID:5496
- C:\Windows\System\yfHaSDl.exe
  C:\Windows\System\yfHaSDl.exe
  2⤵
  PID:5520
- C:\Windows\System\dHTQwjf.exe
  C:\Windows\System\dHTQwjf.exe
  2⤵
  PID:5552
- C:\Windows\System\mTTtrCT.exe
  C:\Windows\System\mTTtrCT.exe
  2⤵
  PID:5584
- C:\Windows\System\nAFjjdE.exe
  C:\Windows\System\nAFjjdE.exe
  2⤵
  PID:5608
- C:\Windows\System\BVKiBDI.exe
  C:\Windows\System\BVKiBDI.exe
  2⤵
  PID:5636
- C:\Windows\System\ivQXWqY.exe
  C:\Windows\System\ivQXWqY.exe
  2⤵
  PID:5664
- C:\Windows\System\FgaKgRp.exe
  C:\Windows\System\FgaKgRp.exe
  2⤵
  PID:5688
- C:\Windows\System\bIHyLmB.exe
  C:\Windows\System\bIHyLmB.exe
  2⤵
  PID:5720
- C:\Windows\System\gsuJkRg.exe
  C:\Windows\System\gsuJkRg.exe
  2⤵
  PID:5744
- C:\Windows\System\YdWxaku.exe
  C:\Windows\System\YdWxaku.exe
  2⤵
  PID:5772
- C:\Windows\System\KfSAWpf.exe
  C:\Windows\System\KfSAWpf.exe
  2⤵
  PID:5800
- C:\Windows\System\GgOwfPy.exe
  C:\Windows\System\GgOwfPy.exe
  2⤵
  PID:5828
- C:\Windows\System\DypRrKO.exe
  C:\Windows\System\DypRrKO.exe
  2⤵
  PID:5864
- C:\Windows\System\uDzbUzo.exe
  C:\Windows\System\uDzbUzo.exe
  2⤵
  PID:5888
- C:\Windows\System\RCuosrL.exe
  C:\Windows\System\RCuosrL.exe
  2⤵
  PID:5916
- C:\Windows\System\lsOOLhV.exe
  C:\Windows\System\lsOOLhV.exe
  2⤵
  PID:5944
- C:\Windows\System\CubApMU.exe
  C:\Windows\System\CubApMU.exe
  2⤵
  PID:5972
- C:\Windows\System\ffpVWqn.exe
  C:\Windows\System\ffpVWqn.exe
  2⤵
  PID:6000
- C:\Windows\System\mbfqqye.exe
  C:\Windows\System\mbfqqye.exe
  2⤵
  PID:6028
- C:\Windows\System\alsaUPW.exe
  C:\Windows\System\alsaUPW.exe
  2⤵
  PID:6056
- C:\Windows\System\ShnYcxR.exe
  C:\Windows\System\ShnYcxR.exe
  2⤵
  PID:6084
- C:\Windows\System\JeLqqQS.exe
  C:\Windows\System\JeLqqQS.exe
  2⤵
  PID:6112
- C:\Windows\System\hWJdQwd.exe
  C:\Windows\System\hWJdQwd.exe
  2⤵
  PID:1072
- C:\Windows\System\AiXiSdy.exe
  C:\Windows\System\AiXiSdy.exe
  2⤵
  PID:4456
- C:\Windows\System\boFxaGN.exe
  C:\Windows\System\boFxaGN.exe
  2⤵
  PID:4884
- C:\Windows\System\KJSzilC.exe
  C:\Windows\System\KJSzilC.exe
  2⤵
  PID:1556
- C:\Windows\System\lnUQebl.exe
  C:\Windows\System\lnUQebl.exe
  2⤵
  PID:536
- C:\Windows\System\WZPiTdH.exe
  C:\Windows\System\WZPiTdH.exe
  2⤵
  PID:5204
- C:\Windows\System\ILQoDTQ.exe
  C:\Windows\System\ILQoDTQ.exe
  2⤵
  PID:5236
- C:\Windows\System\pTlTYeS.exe
  C:\Windows\System\pTlTYeS.exe
  2⤵
  PID:5308
- C:\Windows\System\eZCtOFL.exe
  C:\Windows\System\eZCtOFL.exe
  2⤵
  PID:5344
- C:\Windows\System\oUjliao.exe
  C:\Windows\System\oUjliao.exe
  2⤵
  PID:5392
- C:\Windows\System\IRxJMTD.exe
  C:\Windows\System\IRxJMTD.exe
  2⤵
  PID:5460
- C:\Windows\System\BlsVzDt.exe
  C:\Windows\System\BlsVzDt.exe
  2⤵
  PID:5532
- C:\Windows\System\UXjVVsf.exe
  C:\Windows\System\UXjVVsf.exe
  2⤵
  PID:5572
- C:\Windows\System\YmlhMSX.exe
  C:\Windows\System\YmlhMSX.exe
  2⤵
  PID:5644
- C:\Windows\System\hiJfNrf.exe
  C:\Windows\System\hiJfNrf.exe
  2⤵
  PID:5684
- C:\Windows\System\YUgvlDX.exe
  C:\Windows\System\YUgvlDX.exe
  2⤵
  PID:5740
- C:\Windows\System\FbXRQIM.exe
  C:\Windows\System\FbXRQIM.exe
  2⤵
  PID:5812
- C:\Windows\System\cdCyDBK.exe
  C:\Windows\System\cdCyDBK.exe
  2⤵
  PID:5080
- C:\Windows\System\xFKQVAK.exe
  C:\Windows\System\xFKQVAK.exe
  2⤵
  PID:5904
- C:\Windows\System\KojwpEj.exe
  C:\Windows\System\KojwpEj.exe
  2⤵
  PID:5980
- C:\Windows\System\OOnDiEB.exe
  C:\Windows\System\OOnDiEB.exe
  2⤵
  PID:964
- C:\Windows\System\isCfvhM.exe
  C:\Windows\System\isCfvhM.exe
  2⤵
  PID:6076
- C:\Windows\System\twoeLDL.exe
  C:\Windows\System\twoeLDL.exe
  2⤵
  PID:6140
- C:\Windows\System\atpNKSx.exe
  C:\Windows\System\atpNKSx.exe
  2⤵
  PID:4984
- C:\Windows\System\xqiHJHp.exe
  C:\Windows\System\xqiHJHp.exe
  2⤵
  PID:5148
- C:\Windows\System\CRrBmuw.exe
  C:\Windows\System\CRrBmuw.exe
  2⤵
  PID:5288
- C:\Windows\System\VHuqHrZ.exe
  C:\Windows\System\VHuqHrZ.exe
  2⤵
  PID:5376
- C:\Windows\System\ejofHil.exe
  C:\Windows\System\ejofHil.exe
  2⤵
  PID:5488
- C:\Windows\System\xRTlEBf.exe
  C:\Windows\System\xRTlEBf.exe
  2⤵
  PID:5600
- C:\Windows\System\oxUsgBa.exe
  C:\Windows\System\oxUsgBa.exe
  2⤵
  PID:4560
- C:\Windows\System\yRikoUd.exe
  C:\Windows\System\yRikoUd.exe
  2⤵
  PID:3568
- C:\Windows\System\zdBdCtv.exe
  C:\Windows\System\zdBdCtv.exe
  2⤵
  PID:5964
- C:\Windows\System\KQptkpk.exe
  C:\Windows\System\KQptkpk.exe
  2⤵
  PID:972
- C:\Windows\System\SzArfaX.exe
  C:\Windows\System\SzArfaX.exe
  2⤵
  PID:1660
- C:\Windows\System\sRGICnF.exe
  C:\Windows\System\sRGICnF.exe
  2⤵
  PID:5224
- C:\Windows\System\TzVkfjj.exe
  C:\Windows\System\TzVkfjj.exe
  2⤵
  PID:2508
- C:\Windows\System\pKebCMB.exe
  C:\Windows\System\pKebCMB.exe
  2⤵
  PID:1088
- C:\Windows\System\BjOqunJ.exe
  C:\Windows\System\BjOqunJ.exe
  2⤵
  PID:1288
- C:\Windows\System\QdbcPyS.exe
  C:\Windows\System\QdbcPyS.exe
  2⤵
  PID:4740
- C:\Windows\System\bGOPLFM.exe
  C:\Windows\System\bGOPLFM.exe
  2⤵
  PID:664
- C:\Windows\System\WSfbPFu.exe
  C:\Windows\System\WSfbPFu.exe
  2⤵
  PID:5060
- C:\Windows\System\GjvrSWc.exe
  C:\Windows\System\GjvrSWc.exe
  2⤵
  PID:3308
- C:\Windows\System\HqVwhSv.exe
  C:\Windows\System\HqVwhSv.exe
  2⤵
  PID:1516
- C:\Windows\System\qxMbmGF.exe
  C:\Windows\System\qxMbmGF.exe
  2⤵
  PID:4428
- C:\Windows\System\NJCtxOl.exe
  C:\Windows\System\NJCtxOl.exe
  2⤵
  PID:3404
- C:\Windows\System\hJKDtAt.exe
  C:\Windows\System\hJKDtAt.exe
  2⤵
  PID:4604
- C:\Windows\System\kNiYvXi.exe
  C:\Windows\System\kNiYvXi.exe
  2⤵
  PID:4124
- C:\Windows\System\tseTwEO.exe
  C:\Windows\System\tseTwEO.exe
  2⤵
  PID:4904
- C:\Windows\System\XdoTYYB.exe
  C:\Windows\System\XdoTYYB.exe
  2⤵
  PID:1392
- C:\Windows\System\cSjjpRY.exe
  C:\Windows\System\cSjjpRY.exe
  2⤵
  PID:5084
- C:\Windows\System\OtDWjGj.exe
  C:\Windows\System\OtDWjGj.exe
  2⤵
  PID:6152
- C:\Windows\System\RZjSTSW.exe
  C:\Windows\System\RZjSTSW.exe
  2⤵
  PID:6172
- C:\Windows\System\jCrbGHc.exe
  C:\Windows\System\jCrbGHc.exe
  2⤵
  PID:6236
- C:\Windows\System\RFNsqYv.exe
  C:\Windows\System\RFNsqYv.exe
  2⤵
  PID:6256
- C:\Windows\System\aBCjjbG.exe
  C:\Windows\System\aBCjjbG.exe
  2⤵
  PID:6276
- C:\Windows\System\BIwWlIK.exe
  C:\Windows\System\BIwWlIK.exe
  2⤵
  PID:6300
- C:\Windows\System\bmIGwfh.exe
  C:\Windows\System\bmIGwfh.exe
  2⤵
  PID:6332
- C:\Windows\System\oiDqFCx.exe
  C:\Windows\System\oiDqFCx.exe
  2⤵
  PID:6392
- C:\Windows\System\uAuaqha.exe
  C:\Windows\System\uAuaqha.exe
  2⤵
  PID:6408
- C:\Windows\System\BvxHzrX.exe
  C:\Windows\System\BvxHzrX.exe
  2⤵
  PID:6436
- C:\Windows\System\yRTHsOm.exe
  C:\Windows\System\yRTHsOm.exe
  2⤵
  PID:6460
- C:\Windows\System\frWVcsA.exe
  C:\Windows\System\frWVcsA.exe
  2⤵
  PID:6476
- C:\Windows\System\DYwWWpq.exe
  C:\Windows\System\DYwWWpq.exe
  2⤵
  PID:6496
- C:\Windows\System\jljePAA.exe
  C:\Windows\System\jljePAA.exe
  2⤵
  PID:6552
- C:\Windows\System\uXkzKPk.exe
  C:\Windows\System\uXkzKPk.exe
  2⤵
  PID:6604
- C:\Windows\System\SpixwpD.exe
  C:\Windows\System\SpixwpD.exe
  2⤵
  PID:6636
- C:\Windows\System\TifhmpD.exe
  C:\Windows\System\TifhmpD.exe
  2⤵
  PID:6680
- C:\Windows\System\uReCCdq.exe
  C:\Windows\System\uReCCdq.exe
  2⤵
  PID:6696
- C:\Windows\System\UPGBTgt.exe
  C:\Windows\System\UPGBTgt.exe
  2⤵
  PID:6756
- C:\Windows\System\SzBNGIq.exe
  C:\Windows\System\SzBNGIq.exe
  2⤵
  PID:6780
- C:\Windows\System\zDsJqzR.exe
  C:\Windows\System\zDsJqzR.exe
  2⤵
  PID:6804
- C:\Windows\System\yJmMnoU.exe
  C:\Windows\System\yJmMnoU.exe
  2⤵
  PID:6832
- C:\Windows\System\zmPYLXe.exe
  C:\Windows\System\zmPYLXe.exe
  2⤵
  PID:6860
- C:\Windows\System\goMspon.exe
  C:\Windows\System\goMspon.exe
  2⤵
  PID:6888
- C:\Windows\System\KPgbQIP.exe
  C:\Windows\System\KPgbQIP.exe
  2⤵
  PID:6904
- C:\Windows\System\CcAwyAD.exe
  C:\Windows\System\CcAwyAD.exe
  2⤵
  PID:6932
- C:\Windows\System\DaMdNnj.exe
  C:\Windows\System\DaMdNnj.exe
  2⤵
  PID:6964
- C:\Windows\System\TjDvEin.exe
  C:\Windows\System\TjDvEin.exe
  2⤵
  PID:6988
- C:\Windows\System\eVbPOkE.exe
  C:\Windows\System\eVbPOkE.exe
  2⤵
  PID:7028
- C:\Windows\System\jTfoyAf.exe
  C:\Windows\System\jTfoyAf.exe
  2⤵
  PID:7076
- C:\Windows\System\qWUWMiU.exe
  C:\Windows\System\qWUWMiU.exe
  2⤵
  PID:7096
- C:\Windows\System\xebBncC.exe
  C:\Windows\System\xebBncC.exe
  2⤵
  PID:7120
- C:\Windows\System\dDuoLDB.exe
  C:\Windows\System\dDuoLDB.exe
  2⤵
  PID:7160
- C:\Windows\System\YfqbFvi.exe
  C:\Windows\System\YfqbFvi.exe
  2⤵
  PID:5952
- C:\Windows\System\mdrgZcu.exe
  C:\Windows\System\mdrgZcu.exe
  2⤵
  PID:3008
- C:\Windows\System\gWyLvIj.exe
  C:\Windows\System\gWyLvIj.exe
  2⤵
  PID:6196
- C:\Windows\System\kYorILg.exe
  C:\Windows\System\kYorILg.exe
  2⤵
  PID:6244
- C:\Windows\System\IOhjvAX.exe
  C:\Windows\System\IOhjvAX.exe
  2⤵
  PID:6292
- C:\Windows\System\hSrizAi.exe
  C:\Windows\System\hSrizAi.exe
  2⤵
  PID:2112
- C:\Windows\System\joSwUYg.exe
  C:\Windows\System\joSwUYg.exe
  2⤵
  PID:6452
- C:\Windows\System\azCcVAZ.exe
  C:\Windows\System\azCcVAZ.exe
  2⤵
  PID:6400
- C:\Windows\System\rkEFRut.exe
  C:\Windows\System\rkEFRut.exe
  2⤵
  PID:6488
- C:\Windows\System\FtfHMYF.exe
  C:\Windows\System\FtfHMYF.exe
  2⤵
  PID:6524
- C:\Windows\System\XOEsPRr.exe
  C:\Windows\System\XOEsPRr.exe
  2⤵
  PID:6596
- C:\Windows\System\ZrIMElJ.exe
  C:\Windows\System\ZrIMElJ.exe
  2⤵
  PID:6652
- C:\Windows\System\ZKxucVA.exe
  C:\Windows\System\ZKxucVA.exe
  2⤵
  PID:3500
- C:\Windows\System\WWYDCLQ.exe
  C:\Windows\System\WWYDCLQ.exe
  2⤵
  PID:6692
- C:\Windows\System\lUVvjJN.exe
  C:\Windows\System\lUVvjJN.exe
  2⤵
  PID:3672
- C:\Windows\System\fjfHlYn.exe
  C:\Windows\System\fjfHlYn.exe
  2⤵
  PID:6484
- C:\Windows\System\pWvdZnC.exe
  C:\Windows\System\pWvdZnC.exe
  2⤵
  PID:1896
- C:\Windows\System\nGjnCyp.exe
  C:\Windows\System\nGjnCyp.exe
  2⤵
  PID:6792
- C:\Windows\System\ZeAQxIh.exe
  C:\Windows\System\ZeAQxIh.exe
  2⤵
  PID:6900
- C:\Windows\System\LaOkvtV.exe
  C:\Windows\System\LaOkvtV.exe
  2⤵
  PID:6956
- C:\Windows\System\GcCniAx.exe
  C:\Windows\System\GcCniAx.exe
  2⤵
  PID:7008
- C:\Windows\System\ZLuMvfU.exe
  C:\Windows\System\ZLuMvfU.exe
  2⤵
  PID:7104
- C:\Windows\System\aDPMOmj.exe
  C:\Windows\System\aDPMOmj.exe
  2⤵
  PID:7140
- C:\Windows\System\xvdnbWR.exe
  C:\Windows\System\xvdnbWR.exe
  2⤵
  PID:2476
- C:\Windows\System\PqJemmx.exe
  C:\Windows\System\PqJemmx.exe
  2⤵
  PID:6268
- C:\Windows\System\RvcqrYT.exe
  C:\Windows\System\RvcqrYT.exe
  2⤵
  PID:3748
- C:\Windows\System\dkKrpMs.exe
  C:\Windows\System\dkKrpMs.exe
  2⤵
  PID:6380
- C:\Windows\System\jgWeGtu.exe
  C:\Windows\System\jgWeGtu.exe
  2⤵
  PID:6580
- C:\Windows\System\htuROIF.exe
  C:\Windows\System\htuROIF.exe
  2⤵
  PID:3992
- C:\Windows\System\MllExPu.exe
  C:\Windows\System\MllExPu.exe
  2⤵
  PID:6748
- C:\Windows\System\ihFDrOa.exe
  C:\Windows\System\ihFDrOa.exe
  2⤵
  PID:6716
- C:\Windows\System\lPfiVPj.exe
  C:\Windows\System\lPfiVPj.exe
  2⤵
  PID:7092
- C:\Windows\System\VrByBtc.exe
  C:\Windows\System\VrByBtc.exe
  2⤵
  PID:6224
- C:\Windows\System\ldeftgx.exe
  C:\Windows\System\ldeftgx.exe
  2⤵
  PID:6728
- C:\Windows\System\LHEkKtv.exe
  C:\Windows\System\LHEkKtv.exe
  2⤵
  PID:6164
- C:\Windows\System\TmqoVes.exe
  C:\Windows\System\TmqoVes.exe
  2⤵
  PID:6872
- C:\Windows\System\FuvrmPd.exe
  C:\Windows\System\FuvrmPd.exe
  2⤵
  PID:7184
- C:\Windows\System\IVzLIVS.exe
  C:\Windows\System\IVzLIVS.exe
  2⤵
  PID:7204
- C:\Windows\System\TxhkLya.exe
  C:\Windows\System\TxhkLya.exe
  2⤵
  PID:7232
- C:\Windows\System\QHzpCwU.exe
  C:\Windows\System\QHzpCwU.exe
  2⤵
  PID:7252
- C:\Windows\System\mxlFJBE.exe
  C:\Windows\System\mxlFJBE.exe
  2⤵
  PID:7320
- C:\Windows\System\HXEZhhb.exe
  C:\Windows\System\HXEZhhb.exe
  2⤵
  PID:7336
- C:\Windows\System\PnJjpxQ.exe
  C:\Windows\System\PnJjpxQ.exe
  2⤵
  PID:7356
- C:\Windows\System\TxAAOqt.exe
  C:\Windows\System\TxAAOqt.exe
  2⤵
  PID:7380
- C:\Windows\System\moQLGDC.exe
  C:\Windows\System\moQLGDC.exe
  2⤵
  PID:7400
- C:\Windows\System\KKPhYDF.exe
  C:\Windows\System\KKPhYDF.exe
  2⤵
  PID:7416
- C:\Windows\System\VIsSNHv.exe
  C:\Windows\System\VIsSNHv.exe
  2⤵
  PID:7440
- C:\Windows\System\wJvjBjd.exe
  C:\Windows\System\wJvjBjd.exe
  2⤵
  PID:7472
- C:\Windows\System\SDpYmdB.exe
  C:\Windows\System\SDpYmdB.exe
  2⤵
  PID:7512
- C:\Windows\System\dTqQDyR.exe
  C:\Windows\System\dTqQDyR.exe
  2⤵
  PID:7540
- C:\Windows\System\JwzANrv.exe
  C:\Windows\System\JwzANrv.exe
  2⤵
  PID:7564
- C:\Windows\System\yWHdbbt.exe
  C:\Windows\System\yWHdbbt.exe
  2⤵
  PID:7584
- C:\Windows\System\QEmcsVN.exe
  C:\Windows\System\QEmcsVN.exe
  2⤵
  PID:7648
- C:\Windows\System\IiwEiJb.exe
  C:\Windows\System\IiwEiJb.exe
  2⤵
  PID:7668
- C:\Windows\System\CQLgYaH.exe
  C:\Windows\System\CQLgYaH.exe
  2⤵
  PID:7692
- C:\Windows\System\YCEoQUj.exe
  C:\Windows\System\YCEoQUj.exe
  2⤵
  PID:7720
- C:\Windows\System\RuFPGPs.exe
  C:\Windows\System\RuFPGPs.exe
  2⤵
  PID:7744
- C:\Windows\System\cDvbcBI.exe
  C:\Windows\System\cDvbcBI.exe
  2⤵
  PID:7764
- C:\Windows\System\qumJCud.exe
  C:\Windows\System\qumJCud.exe
  2⤵
  PID:7788
- C:\Windows\System\mXdeTus.exe
  C:\Windows\System\mXdeTus.exe
  2⤵
  PID:7804
- C:\Windows\System\suQStIw.exe
  C:\Windows\System\suQStIw.exe
  2⤵
  PID:7848
- C:\Windows\System\DnmzaQn.exe
  C:\Windows\System\DnmzaQn.exe
  2⤵
  PID:7872
- C:\Windows\System\sEaxpAT.exe
  C:\Windows\System\sEaxpAT.exe
  2⤵
  PID:7904
- C:\Windows\System\fJdnlpw.exe
  C:\Windows\System\fJdnlpw.exe
  2⤵
  PID:7924
- C:\Windows\System\qIaBBGT.exe
  C:\Windows\System\qIaBBGT.exe
  2⤵
  PID:7948
- C:\Windows\System\LINIMyf.exe
  C:\Windows\System\LINIMyf.exe
  2⤵
  PID:7964
- C:\Windows\System\mWFDPAT.exe
  C:\Windows\System\mWFDPAT.exe
  2⤵
  PID:8024
- C:\Windows\System\BzNYmLu.exe
  C:\Windows\System\BzNYmLu.exe
  2⤵
  PID:8044
- C:\Windows\System\GwrDfou.exe
  C:\Windows\System\GwrDfou.exe
  2⤵
  PID:8076
- C:\Windows\System\HgZFuul.exe
  C:\Windows\System\HgZFuul.exe
  2⤵
  PID:8100
- C:\Windows\System\hfgpaFt.exe
  C:\Windows\System\hfgpaFt.exe
  2⤵
  PID:8136
- C:\Windows\System\IvVYzWN.exe
  C:\Windows\System\IvVYzWN.exe
  2⤵
  PID:8152
- C:\Windows\System\MkArcWH.exe
  C:\Windows\System\MkArcWH.exe
  2⤵
  PID:8184
- C:\Windows\System\jOauzSz.exe
  C:\Windows\System\jOauzSz.exe
  2⤵
  PID:2324
- C:\Windows\System\RKlEfbW.exe
  C:\Windows\System\RKlEfbW.exe
  2⤵
  PID:7308
- C:\Windows\System\DUCDiRi.exe
  C:\Windows\System\DUCDiRi.exe
  2⤵
  PID:7332
- C:\Windows\System\xIgAdfw.exe
  C:\Windows\System\xIgAdfw.exe
  2⤵
  PID:7372
- C:\Windows\System\VTfFcRn.exe
  C:\Windows\System\VTfFcRn.exe
  2⤵
  PID:7508
- C:\Windows\System\kJTkxrU.exe
  C:\Windows\System\kJTkxrU.exe
  2⤵
  PID:7504
- C:\Windows\System\jWrgwHl.exe
  C:\Windows\System\jWrgwHl.exe
  2⤵
  PID:7576
- C:\Windows\System\yUpxYIr.exe
  C:\Windows\System\yUpxYIr.exe
  2⤵
  PID:7676
- C:\Windows\System\qHqxVSl.exe
  C:\Windows\System\qHqxVSl.exe
  2⤵
  PID:7700
- C:\Windows\System\rYGXdav.exe
  C:\Windows\System\rYGXdav.exe
  2⤵
  PID:7728
- C:\Windows\System\ZvWwdbR.exe
  C:\Windows\System\ZvWwdbR.exe
  2⤵
  PID:7800
- C:\Windows\System\bPJZnWD.exe
  C:\Windows\System\bPJZnWD.exe
  2⤵
  PID:7840
- C:\Windows\System\MSFCECg.exe
  C:\Windows\System\MSFCECg.exe
  2⤵
  PID:7992
- C:\Windows\System\OPNXsEq.exe
  C:\Windows\System\OPNXsEq.exe
  2⤵
  PID:8016
- C:\Windows\System\EEKQAqz.exe
  C:\Windows\System\EEKQAqz.exe
  2⤵
  PID:8072
- C:\Windows\System\eZKgemX.exe
  C:\Windows\System\eZKgemX.exe
  2⤵
  PID:8096
- C:\Windows\System\XyQsbpm.exe
  C:\Windows\System\XyQsbpm.exe
  2⤵
  PID:8148
- C:\Windows\System\NznPppu.exe
  C:\Windows\System\NznPppu.exe
  2⤵
  PID:7268
- C:\Windows\System\kOqYiPJ.exe
  C:\Windows\System\kOqYiPJ.exe
  2⤵
  PID:7488
- C:\Windows\System\fvYwTjf.exe
  C:\Windows\System\fvYwTjf.exe
  2⤵
  PID:7560
- C:\Windows\System\kLjxfPi.exe
  C:\Windows\System\kLjxfPi.exe
  2⤵
  PID:7856
- C:\Windows\System\qhNMjCl.exe
  C:\Windows\System\qhNMjCl.exe
  2⤵
  PID:7936
- C:\Windows\System\llJbimu.exe
  C:\Windows\System\llJbimu.exe
  2⤵
  PID:8116
- C:\Windows\System\IjPPwJI.exe
  C:\Windows\System\IjPPwJI.exe
  2⤵
  PID:7388
- C:\Windows\System\pYItPIb.exe
  C:\Windows\System\pYItPIb.exe
  2⤵
  PID:7640
- C:\Windows\System\xJcLHLg.exe
  C:\Windows\System\xJcLHLg.exe
  2⤵
  PID:7376
- C:\Windows\System\AKngTcY.exe
  C:\Windows\System\AKngTcY.exe
  2⤵
  PID:6816
- C:\Windows\System\aYcmCsk.exe
  C:\Windows\System\aYcmCsk.exe
  2⤵
  PID:8224
- C:\Windows\System\JrDUWXc.exe
  C:\Windows\System\JrDUWXc.exe
  2⤵
  PID:8244
- C:\Windows\System\sdGrQcK.exe
  C:\Windows\System\sdGrQcK.exe
  2⤵
  PID:8264
- C:\Windows\System\SCfFUKe.exe
  C:\Windows\System\SCfFUKe.exe
  2⤵
  PID:8280
- C:\Windows\System\erZqBQn.exe
  C:\Windows\System\erZqBQn.exe
  2⤵
  PID:8308
- C:\Windows\System\WSYRZOv.exe
  C:\Windows\System\WSYRZOv.exe
  2⤵
  PID:8332
- C:\Windows\System\rakAoLu.exe
  C:\Windows\System\rakAoLu.exe
  2⤵
  PID:8352
- C:\Windows\System\DZctCPW.exe
  C:\Windows\System\DZctCPW.exe
  2⤵
  PID:8376
- C:\Windows\System\fgkONdl.exe
  C:\Windows\System\fgkONdl.exe
  2⤵
  PID:8392
- C:\Windows\System\xoxPvYF.exe
  C:\Windows\System\xoxPvYF.exe
  2⤵
  PID:8444
- C:\Windows\System\WcDtuQs.exe
  C:\Windows\System\WcDtuQs.exe
  2⤵
  PID:8480
- C:\Windows\System\SANTXIg.exe
  C:\Windows\System\SANTXIg.exe
  2⤵
  PID:8532
- C:\Windows\System\dpFeAyh.exe
  C:\Windows\System\dpFeAyh.exe
  2⤵
  PID:8548
- C:\Windows\System\vUwZmkp.exe
  C:\Windows\System\vUwZmkp.exe
  2⤵
  PID:8576
- C:\Windows\System\vXVONnG.exe
  C:\Windows\System\vXVONnG.exe
  2⤵
  PID:8604
- C:\Windows\System\vsHwxMS.exe
  C:\Windows\System\vsHwxMS.exe
  2⤵
  PID:8640
- C:\Windows\System\XTbFdsr.exe
  C:\Windows\System\XTbFdsr.exe
  2⤵
  PID:8660
- C:\Windows\System\AohSRNS.exe
  C:\Windows\System\AohSRNS.exe
  2⤵
  PID:8692
- C:\Windows\System\VpMeCqW.exe
  C:\Windows\System\VpMeCqW.exe
  2⤵
  PID:8716
- C:\Windows\System\IJjqyzA.exe
  C:\Windows\System\IJjqyzA.exe
  2⤵
  PID:8740
- C:\Windows\System\oDudHVb.exe
  C:\Windows\System\oDudHVb.exe
  2⤵
  PID:8760
- C:\Windows\System\GgsyeBk.exe
  C:\Windows\System\GgsyeBk.exe
  2⤵
  PID:8800
- C:\Windows\System\fzcmdfC.exe
  C:\Windows\System\fzcmdfC.exe
  2⤵
  PID:8848
- C:\Windows\System\NAsCScZ.exe
  C:\Windows\System\NAsCScZ.exe
  2⤵
  PID:8868
- C:\Windows\System\mubHHqU.exe
  C:\Windows\System\mubHHqU.exe
  2⤵
  PID:8904
- C:\Windows\System\vuAPoKU.exe
  C:\Windows\System\vuAPoKU.exe
  2⤵
  PID:8924
- C:\Windows\System\AKbHbEI.exe
  C:\Windows\System\AKbHbEI.exe
  2⤵
  PID:8956
- C:\Windows\System\SbanqRU.exe
  C:\Windows\System\SbanqRU.exe
  2⤵
  PID:8976
- C:\Windows\System\iAeLPai.exe
  C:\Windows\System\iAeLPai.exe
  2⤵
  PID:8996
- C:\Windows\System\VgSdCfE.exe
  C:\Windows\System\VgSdCfE.exe
  2⤵
  PID:9036
- C:\Windows\System\vEcuBUO.exe
  C:\Windows\System\vEcuBUO.exe
  2⤵
  PID:9064
- C:\Windows\System\pEpJJlz.exe
  C:\Windows\System\pEpJJlz.exe
  2⤵
  PID:9084
- C:\Windows\System\KiHknnh.exe
  C:\Windows\System\KiHknnh.exe
  2⤵
  PID:9100
- C:\Windows\System\ttOoOkH.exe
  C:\Windows\System\ttOoOkH.exe
  2⤵
  PID:9120
- C:\Windows\System\YrHTHlp.exe
  C:\Windows\System\YrHTHlp.exe
  2⤵
  PID:9144
- C:\Windows\System\fpddHAW.exe
  C:\Windows\System\fpddHAW.exe
  2⤵
  PID:9188
- C:\Windows\System\HOUEkPI.exe
  C:\Windows\System\HOUEkPI.exe
  2⤵
  PID:8232
- C:\Windows\System\inqPdHu.exe
  C:\Windows\System\inqPdHu.exe
  2⤵
  PID:8304
- C:\Windows\System\aQdkwRH.exe
  C:\Windows\System\aQdkwRH.exe
  2⤵
  PID:8324
- C:\Windows\System\IYFCFfO.exe
  C:\Windows\System\IYFCFfO.exe
  2⤵
  PID:8436
- C:\Windows\System\fygHNYd.exe
  C:\Windows\System\fygHNYd.exe
  2⤵
  PID:8420
- C:\Windows\System\UCWzoXf.exe
  C:\Windows\System\UCWzoXf.exe
  2⤵
  PID:8472
- C:\Windows\System\ecsnvXv.exe
  C:\Windows\System\ecsnvXv.exe
  2⤵
  PID:8616
- C:\Windows\System\oeomZdc.exe
  C:\Windows\System\oeomZdc.exe
  2⤵
  PID:8708
- C:\Windows\System\aRfRgxP.exe
  C:\Windows\System\aRfRgxP.exe
  2⤵
  PID:8768
- C:\Windows\System\fUDQMNt.exe
  C:\Windows\System\fUDQMNt.exe
  2⤵
  PID:8824
- C:\Windows\System\VYRZSkc.exe
  C:\Windows\System\VYRZSkc.exe
  2⤵
  PID:8864
- C:\Windows\System\CyCLjPb.exe
  C:\Windows\System\CyCLjPb.exe
  2⤵
  PID:8968
- C:\Windows\System\FDRhXuN.exe
  C:\Windows\System\FDRhXuN.exe
  2⤵
  PID:8992
- C:\Windows\System\twYCyJS.exe
  C:\Windows\System\twYCyJS.exe
  2⤵
  PID:9028
- C:\Windows\System\nQBQZKi.exe
  C:\Windows\System\nQBQZKi.exe
  2⤵
  PID:9052
- C:\Windows\System\cZSPEAd.exe
  C:\Windows\System\cZSPEAd.exe
  2⤵
  PID:9156
- C:\Windows\System\EzPOngD.exe
  C:\Windows\System\EzPOngD.exe
  2⤵
  PID:9172
- C:\Windows\System\ldulHIw.exe
  C:\Windows\System\ldulHIw.exe
  2⤵
  PID:8260
- C:\Windows\System\cAnLymy.exe
  C:\Windows\System\cAnLymy.exe
  2⤵
  PID:8408
- C:\Windows\System\ZavhnNF.exe
  C:\Windows\System\ZavhnNF.exe
  2⤵
  PID:8680
- C:\Windows\System\xBYuHJG.exe
  C:\Windows\System\xBYuHJG.exe
  2⤵
  PID:8948
- C:\Windows\System\zApaOAF.exe
  C:\Windows\System\zApaOAF.exe
  2⤵
  PID:9112
- C:\Windows\System\WCcavdI.exe
  C:\Windows\System\WCcavdI.exe
  2⤵
  PID:8220
- C:\Windows\System\ysdejgi.exe
  C:\Windows\System\ysdejgi.exe
  2⤵
  PID:8568
- C:\Windows\System\ymJKJuu.exe
  C:\Windows\System\ymJKJuu.exe
  2⤵
  PID:8932
- C:\Windows\System\qFQJUzE.exe
  C:\Windows\System\qFQJUzE.exe
  2⤵
  PID:9096
- C:\Windows\System\JtHGFqs.exe
  C:\Windows\System\JtHGFqs.exe
  2⤵
  PID:9212
- C:\Windows\System\EhwZjkm.exe
  C:\Windows\System\EhwZjkm.exe
  2⤵
  PID:8648
- C:\Windows\System\xXbahML.exe
  C:\Windows\System\xXbahML.exe
  2⤵
  PID:9220
- C:\Windows\System\UzSpAlR.exe
  C:\Windows\System\UzSpAlR.exe
  2⤵
  PID:9252
- C:\Windows\System\ixhQhdv.exe
  C:\Windows\System\ixhQhdv.exe
  2⤵
  PID:9268
- C:\Windows\System\WpILGvY.exe
  C:\Windows\System\WpILGvY.exe
  2⤵
  PID:9288
- C:\Windows\System\lqdbuPF.exe
  C:\Windows\System\lqdbuPF.exe
  2⤵
  PID:9312
- C:\Windows\System\BONzVKs.exe
  C:\Windows\System\BONzVKs.exe
  2⤵
  PID:9372
- C:\Windows\System\FYCaIde.exe
  C:\Windows\System\FYCaIde.exe
  2⤵
  PID:9396
- C:\Windows\System\VYlCsld.exe
  C:\Windows\System\VYlCsld.exe
  2⤵
  PID:9416
- C:\Windows\System\wpNzftA.exe
  C:\Windows\System\wpNzftA.exe
  2⤵
  PID:9444
- C:\Windows\System\vwRYkEq.exe
  C:\Windows\System\vwRYkEq.exe
  2⤵
  PID:9484
- C:\Windows\System\gwNpREt.exe
  C:\Windows\System\gwNpREt.exe
  2⤵
  PID:9540
- C:\Windows\System\OQekQLe.exe
  C:\Windows\System\OQekQLe.exe
  2⤵
  PID:9580
- C:\Windows\System\vdlAecU.exe
  C:\Windows\System\vdlAecU.exe
  2⤵
  PID:9596
- C:\Windows\System\ytATAwV.exe
  C:\Windows\System\ytATAwV.exe
  2⤵
  PID:9624
- C:\Windows\System\hkgoPoM.exe
  C:\Windows\System\hkgoPoM.exe
  2⤵
  PID:9656
- C:\Windows\System\kkjzcKG.exe
  C:\Windows\System\kkjzcKG.exe
  2⤵
  PID:9680
- C:\Windows\System\sjHjhaR.exe
  C:\Windows\System\sjHjhaR.exe
  2⤵
  PID:9720
- C:\Windows\System\TJiZGUL.exe
  C:\Windows\System\TJiZGUL.exe
  2⤵
  PID:9740
- C:\Windows\System\NyYNDge.exe
  C:\Windows\System\NyYNDge.exe
  2⤵
  PID:9768
- C:\Windows\System\NpMdAEM.exe
  C:\Windows\System\NpMdAEM.exe
  2⤵
  PID:9792
- C:\Windows\System\yCQXFxN.exe
  C:\Windows\System\yCQXFxN.exe
  2⤵
  PID:9812
- C:\Windows\System\hmzPbXx.exe
  C:\Windows\System\hmzPbXx.exe
  2⤵
  PID:9836
- C:\Windows\System\jozIJBR.exe
  C:\Windows\System\jozIJBR.exe
  2⤵
  PID:9856
- C:\Windows\System\sfiZKDp.exe
  C:\Windows\System\sfiZKDp.exe
  2⤵
  PID:9888
- C:\Windows\System\VvgBxHx.exe
  C:\Windows\System\VvgBxHx.exe
  2⤵
  PID:9948
- C:\Windows\System\loWsUhv.exe
  C:\Windows\System\loWsUhv.exe
  2⤵
  PID:9968
- C:\Windows\System\JBTitGx.exe
  C:\Windows\System\JBTitGx.exe
  2⤵
  PID:9996
- C:\Windows\System\NWxIKUv.exe
  C:\Windows\System\NWxIKUv.exe
  2⤵
  PID:10032
- C:\Windows\System\KfeBiLT.exe
  C:\Windows\System\KfeBiLT.exe
  2⤵
  PID:10056
- C:\Windows\System\sRRXLru.exe
  C:\Windows\System\sRRXLru.exe
  2⤵
  PID:10076
- C:\Windows\System\zOARcpD.exe
  C:\Windows\System\zOARcpD.exe
  2⤵
  PID:10204
- C:\Windows\System\RAaNFam.exe
  C:\Windows\System\RAaNFam.exe
  2⤵
  PID:9240
- C:\Windows\System\jVtnRIc.exe
  C:\Windows\System\jVtnRIc.exe
  2⤵
  PID:9280
- C:\Windows\System\OtLHrHv.exe
  C:\Windows\System\OtLHrHv.exe
  2⤵
  PID:9304
- C:\Windows\System\kcBnini.exe
  C:\Windows\System\kcBnini.exe
  2⤵
  PID:9340
- C:\Windows\System\rLkcCQG.exe
  C:\Windows\System\rLkcCQG.exe
  2⤵
  PID:9404
- C:\Windows\System\OXohCcj.exe
  C:\Windows\System\OXohCcj.exe
  2⤵
  PID:9464
- C:\Windows\System\PNJBCmA.exe
  C:\Windows\System\PNJBCmA.exe
  2⤵
  PID:9528
- C:\Windows\System\eNivWky.exe
  C:\Windows\System\eNivWky.exe
  2⤵
  PID:3832
- C:\Windows\System\wZTxVxE.exe
  C:\Windows\System\wZTxVxE.exe
  2⤵
  PID:9564
- C:\Windows\System\hpzNRoK.exe
  C:\Windows\System\hpzNRoK.exe
  2⤵
  PID:9612
- C:\Windows\System\JwtYtTm.exe
  C:\Windows\System\JwtYtTm.exe
  2⤵
  PID:9616
- C:\Windows\System\IiPkgeO.exe
  C:\Windows\System\IiPkgeO.exe
  2⤵
  PID:9712
- C:\Windows\System\OmzaWOH.exe
  C:\Windows\System\OmzaWOH.exe
  2⤵
  PID:9780
- C:\Windows\System\qoFIpfB.exe
  C:\Windows\System\qoFIpfB.exe
  2⤵
  PID:9776
- C:\Windows\System\VpOJqiF.exe
  C:\Windows\System\VpOJqiF.exe
  2⤵
  PID:10028
- C:\Windows\System\SfvzsjC.exe
  C:\Windows\System\SfvzsjC.exe
  2⤵
  PID:10048
- C:\Windows\System\CTFKPHs.exe
  C:\Windows\System\CTFKPHs.exe
  2⤵
  PID:10140
- C:\Windows\System\cLYLSOj.exe
  C:\Windows\System\cLYLSOj.exe
  2⤵
  PID:10092
- C:\Windows\System\moDXyay.exe
  C:\Windows\System\moDXyay.exe
  2⤵
  PID:10096
- C:\Windows\System\CisuSSi.exe
  C:\Windows\System\CisuSSi.exe
  2⤵
  PID:9360
- C:\Windows\System\qvckbZs.exe
  C:\Windows\System\qvckbZs.exe
  2⤵
  PID:9496
- C:\Windows\System\iAsQqhh.exe
  C:\Windows\System\iAsQqhh.exe
  2⤵
  PID:9276
- C:\Windows\System\AufWuKv.exe
  C:\Windows\System\AufWuKv.exe
  2⤵
  PID:9764
- C:\Windows\System\CzoeZQs.exe
  C:\Windows\System\CzoeZQs.exe
  2⤵
  PID:9944
- C:\Windows\System\NYndahg.exe
  C:\Windows\System\NYndahg.exe
  2⤵
  PID:10052
- C:\Windows\System\QEiwatt.exe
  C:\Windows\System\QEiwatt.exe
  2⤵
  PID:9260
- C:\Windows\System\RrTWuhh.exe
  C:\Windows\System\RrTWuhh.exe
  2⤵
  PID:9076
- C:\Windows\System\nzcfZjr.exe
  C:\Windows\System\nzcfZjr.exe
  2⤵
  PID:9364
- C:\Windows\System\IXnSekB.exe
  C:\Windows\System\IXnSekB.exe
  2⤵
  PID:10192
- C:\Windows\System\zsTGmjq.exe
  C:\Windows\System\zsTGmjq.exe
  2⤵
  PID:10232
- C:\Windows\System\oJlCZot.exe
  C:\Windows\System\oJlCZot.exe
  2⤵
  PID:9700
- C:\Windows\System\VXfJVJC.exe
  C:\Windows\System\VXfJVJC.exe
  2⤵
  PID:10260
- C:\Windows\System\jacBgEW.exe
  C:\Windows\System\jacBgEW.exe
  2⤵
  PID:10276
- C:\Windows\System\oaIXzri.exe
  C:\Windows\System\oaIXzri.exe
  2⤵
  PID:10324
- C:\Windows\System\DGlhgxw.exe
  C:\Windows\System\DGlhgxw.exe
  2⤵
  PID:10340
- C:\Windows\System\daRDUdc.exe
  C:\Windows\System\daRDUdc.exe
  2⤵
  PID:10368
- C:\Windows\System\yWUvnGr.exe
  C:\Windows\System\yWUvnGr.exe
  2⤵
  PID:10396
- C:\Windows\System\rhBcobl.exe
  C:\Windows\System\rhBcobl.exe
  2⤵
  PID:10436
- C:\Windows\System\qmBaUNA.exe
  C:\Windows\System\qmBaUNA.exe
  2⤵
  PID:10452
- C:\Windows\System\PQpTBgU.exe
  C:\Windows\System\PQpTBgU.exe
  2⤵
  PID:10492
- C:\Windows\System\zFRfWLq.exe
  C:\Windows\System\zFRfWLq.exe
  2⤵
  PID:10516
- C:\Windows\System\rmxhDUG.exe
  C:\Windows\System\rmxhDUG.exe
  2⤵
  PID:10540
- C:\Windows\System\IcEtFqm.exe
  C:\Windows\System\IcEtFqm.exe
  2⤵
  PID:10560
- C:\Windows\System\iqFynGm.exe
  C:\Windows\System\iqFynGm.exe
  2⤵
  PID:10588
- C:\Windows\System\PhcToFF.exe
  C:\Windows\System\PhcToFF.exe
  2⤵
  PID:10608
- C:\Windows\System\EjlRmWx.exe
  C:\Windows\System\EjlRmWx.exe
  2⤵
  PID:10628
- C:\Windows\System\qkSCRre.exe
  C:\Windows\System\qkSCRre.exe
  2⤵
  PID:10672
- C:\Windows\System\VVvWuVz.exe
  C:\Windows\System\VVvWuVz.exe
  2⤵
  PID:10708
- C:\Windows\System\EbeekgT.exe
  C:\Windows\System\EbeekgT.exe
  2⤵
  PID:10732
- C:\Windows\System\qnpDkyH.exe
  C:\Windows\System\qnpDkyH.exe
  2⤵
  PID:10752
- C:\Windows\System\mtEfgZG.exe
  C:\Windows\System\mtEfgZG.exe
  2⤵
  PID:10784
- C:\Windows\System\WYdurpK.exe
  C:\Windows\System\WYdurpK.exe
  2⤵
  PID:10800
- C:\Windows\System\TZbqpYF.exe
  C:\Windows\System\TZbqpYF.exe
  2⤵
  PID:10820
- C:\Windows\System\fppMsRI.exe
  C:\Windows\System\fppMsRI.exe
  2⤵
  PID:10876
- C:\Windows\System\VcsGDoW.exe
  C:\Windows\System\VcsGDoW.exe
  2⤵
  PID:10896
- C:\Windows\System\rqKsqvS.exe
  C:\Windows\System\rqKsqvS.exe
  2⤵
  PID:10928
- C:\Windows\System\NZJbXPq.exe
  C:\Windows\System\NZJbXPq.exe
  2⤵
  PID:10960
- C:\Windows\System\RhDEpvG.exe
  C:\Windows\System\RhDEpvG.exe
  2⤵
  PID:10996
- C:\Windows\System\PtpUtpx.exe
  C:\Windows\System\PtpUtpx.exe
  2⤵
  PID:11016
- C:\Windows\System\vMgPBni.exe
  C:\Windows\System\vMgPBni.exe
  2⤵
  PID:11040
- C:\Windows\System\eyGTdOf.exe
  C:\Windows\System\eyGTdOf.exe
  2⤵
  PID:11072
- C:\Windows\System\lUCGaZK.exe
  C:\Windows\System\lUCGaZK.exe
  2⤵
  PID:11088
- C:\Windows\System\hOBzvZX.exe
  C:\Windows\System\hOBzvZX.exe
  2⤵
  PID:11104
- C:\Windows\System\qKYzkHm.exe
  C:\Windows\System\qKYzkHm.exe
  2⤵
  PID:11136
- C:\Windows\System\QbLMjpY.exe
  C:\Windows\System\QbLMjpY.exe
  2⤵
  PID:11188
- C:\Windows\System\sNxXjkj.exe
  C:\Windows\System\sNxXjkj.exe
  2⤵
  PID:11212
- C:\Windows\System\mnBNqfQ.exe
  C:\Windows\System\mnBNqfQ.exe
  2⤵
  PID:11252
- C:\Windows\System\adttZIT.exe
  C:\Windows\System\adttZIT.exe
  2⤵
  PID:10248
- C:\Windows\System\sdIVhCX.exe
  C:\Windows\System\sdIVhCX.exe
  2⤵
  PID:10312
- C:\Windows\System\knBlYbH.exe
  C:\Windows\System\knBlYbH.exe
  2⤵
  PID:10308
- C:\Windows\System\EoKJKcb.exe
  C:\Windows\System\EoKJKcb.exe
  2⤵
  PID:10384
- C:\Windows\System\VZntGnU.exe
  C:\Windows\System\VZntGnU.exe
  2⤵
  PID:10488
- C:\Windows\System\PSWIjMx.exe
  C:\Windows\System\PSWIjMx.exe
  2⤵
  PID:10536
- C:\Windows\System\YNQIXyS.exe
  C:\Windows\System\YNQIXyS.exe
  2⤵
  PID:10580
- C:\Windows\System\mcIZwzf.exe
  C:\Windows\System\mcIZwzf.exe
  2⤵
  PID:10648
- C:\Windows\System\PuUnQDJ.exe
  C:\Windows\System\PuUnQDJ.exe
  2⤵
  PID:10664
- C:\Windows\System\ZvFYSBx.exe
  C:\Windows\System\ZvFYSBx.exe
  2⤵
  PID:10728
- C:\Windows\System\Iibjgqg.exe
  C:\Windows\System\Iibjgqg.exe
  2⤵
  PID:10796
- C:\Windows\System\bQMbmuC.exe
  C:\Windows\System\bQMbmuC.exe
  2⤵
  PID:10920
- C:\Windows\System\CdSEHve.exe
  C:\Windows\System\CdSEHve.exe
  2⤵
  PID:10984
- C:\Windows\System\CDpUnDf.exe
  C:\Windows\System\CDpUnDf.exe
  2⤵
  PID:11060
- C:\Windows\System\EMxNFzV.exe
  C:\Windows\System\EMxNFzV.exe
  2⤵
  PID:11080
- C:\Windows\System\mjPrCiU.exe
  C:\Windows\System\mjPrCiU.exe
  2⤵
  PID:11116
- C:\Windows\System\CMkmNEG.exe
  C:\Windows\System\CMkmNEG.exe
  2⤵
  PID:11176
- C:\Windows\System\QCUSxYi.exe
  C:\Windows\System\QCUSxYi.exe
  2⤵
  PID:11236
- C:\Windows\System\jAmFeoR.exe
  C:\Windows\System\jAmFeoR.exe
  2⤵
  PID:9984
- C:\Windows\System\RChKcXp.exe
  C:\Windows\System\RChKcXp.exe
  2⤵
  PID:10596
- C:\Windows\System\vhJIBff.exe
  C:\Windows\System\vhJIBff.exe
  2⤵
  PID:10620
- C:\Windows\System\oawilpM.exe
  C:\Windows\System\oawilpM.exe
  2⤵
  PID:10956
- C:\Windows\System\Rwulwws.exe
  C:\Windows\System\Rwulwws.exe
  2⤵
  PID:11036
- C:\Windows\System\ntOlYcL.exe
  C:\Windows\System\ntOlYcL.exe
  2⤵
  PID:11052
- C:\Windows\System\SAPhnPe.exe
  C:\Windows\System\SAPhnPe.exe
  2⤵
  PID:11232
- C:\Windows\System\YDXExzx.exe
  C:\Windows\System\YDXExzx.exe
  2⤵
  PID:9300
- C:\Windows\System\HZNddhM.exe
  C:\Windows\System\HZNddhM.exe
  2⤵
  PID:10552
- C:\Windows\System\zrlxVjv.exe
  C:\Windows\System\zrlxVjv.exe
  2⤵
  PID:10780
- C:\Windows\System\MhKnNtW.exe
  C:\Windows\System\MhKnNtW.exe
  2⤵
  PID:11288
- C:\Windows\System\OCRImZw.exe
  C:\Windows\System\OCRImZw.exe
  2⤵
  PID:11328
- C:\Windows\System\MyknFZJ.exe
  C:\Windows\System\MyknFZJ.exe
  2⤵
  PID:11344
- C:\Windows\System\kIdtdJN.exe
  C:\Windows\System\kIdtdJN.exe
  2⤵
  PID:11364
- C:\Windows\System\xstreHk.exe
  C:\Windows\System\xstreHk.exe
  2⤵
  PID:11388
- C:\Windows\System\srZxQkh.exe
  C:\Windows\System\srZxQkh.exe
  2⤵
  PID:11460
- C:\Windows\System\FiKsnUv.exe
  C:\Windows\System\FiKsnUv.exe
  2⤵
  PID:11476
- C:\Windows\System\sXDjNuB.exe
  C:\Windows\System\sXDjNuB.exe
  2⤵
  PID:11492
- C:\Windows\System\oPoTGkF.exe
  C:\Windows\System\oPoTGkF.exe
  2⤵
  PID:11512
- C:\Windows\System\sharyiJ.exe
  C:\Windows\System\sharyiJ.exe
  2⤵
  PID:11540
- C:\Windows\System\bEDFzWh.exe
  C:\Windows\System\bEDFzWh.exe
  2⤵
  PID:11560
- C:\Windows\System\AFTiAAs.exe
  C:\Windows\System\AFTiAAs.exe
  2⤵
  PID:11584
- C:\Windows\System\CjHOpCL.exe
  C:\Windows\System\CjHOpCL.exe
  2⤵
  PID:11624
- C:\Windows\System\wGtTfqY.exe
  C:\Windows\System\wGtTfqY.exe
  2⤵
  PID:11664
- C:\Windows\System\AstGXBA.exe
  C:\Windows\System\AstGXBA.exe
  2⤵
  PID:11692
- C:\Windows\System\zGvASAW.exe
  C:\Windows\System\zGvASAW.exe
  2⤵
  PID:11728
- C:\Windows\System\EUBDabY.exe
  C:\Windows\System\EUBDabY.exe
  2⤵
  PID:11752
- C:\Windows\System\TUKppHT.exe
  C:\Windows\System\TUKppHT.exe
  2⤵
  PID:11768
- C:\Windows\System\oBhxSNB.exe
  C:\Windows\System\oBhxSNB.exe
  2⤵
  PID:11788
- C:\Windows\System\XrFpUCw.exe
  C:\Windows\System\XrFpUCw.exe
  2⤵
  PID:11808
- C:\Windows\System\NDZlaFG.exe
  C:\Windows\System\NDZlaFG.exe
  2⤵
  PID:11832
- C:\Windows\System\WaIJZrJ.exe
  C:\Windows\System\WaIJZrJ.exe
  2⤵
  PID:11856
- C:\Windows\System\QtGOsmx.exe
  C:\Windows\System\QtGOsmx.exe
  2⤵
  PID:11876
- C:\Windows\System\GTUeLIW.exe
  C:\Windows\System\GTUeLIW.exe
  2⤵
  PID:11940
- C:\Windows\System\mINxoaJ.exe
  C:\Windows\System\mINxoaJ.exe
  2⤵
  PID:11964
- C:\Windows\System\yWQJBny.exe
  C:\Windows\System\yWQJBny.exe
  2⤵
  PID:11980
- C:\Windows\System\WbMaNZj.exe
  C:\Windows\System\WbMaNZj.exe
  2⤵
  PID:12000
- C:\Windows\System\AsPHTNE.exe
  C:\Windows\System\AsPHTNE.exe
  2⤵
  PID:12040
- C:\Windows\System\mwAycuv.exe
  C:\Windows\System\mwAycuv.exe
  2⤵
  PID:12072
- C:\Windows\System\UrBgbKv.exe
  C:\Windows\System\UrBgbKv.exe
  2⤵
  PID:12100
- C:\Windows\System\nvKKHTk.exe
  C:\Windows\System\nvKKHTk.exe
  2⤵
  PID:12148
- C:\Windows\System\OwUdqmJ.exe
  C:\Windows\System\OwUdqmJ.exe
  2⤵
  PID:12168
- C:\Windows\System\JwDZVtX.exe
  C:\Windows\System\JwDZVtX.exe
  2⤵
  PID:12208
- C:\Windows\System\FUgIFMP.exe
  C:\Windows\System\FUgIFMP.exe
  2⤵
  PID:12232
- C:\Windows\System\ENEWgTm.exe
  C:\Windows\System\ENEWgTm.exe
  2⤵
  PID:12260
- C:\Windows\System\VwCqlzw.exe
  C:\Windows\System\VwCqlzw.exe
  2⤵
  PID:12280
- C:\Windows\System\IbDAfvE.exe
  C:\Windows\System\IbDAfvE.exe
  2⤵
  PID:11144
- C:\Windows\System\HRnbHkH.exe
  C:\Windows\System\HRnbHkH.exe
  2⤵
  PID:11316
- C:\Windows\System\xxhtEKu.exe
  C:\Windows\System\xxhtEKu.exe
  2⤵
  PID:11356
- C:\Windows\System\WPkDxxq.exe
  C:\Windows\System\WPkDxxq.exe
  2⤵
  PID:11452
- C:\Windows\System\EXocCPr.exe
  C:\Windows\System\EXocCPr.exe
  2⤵
  PID:11532
- C:\Windows\System\KZFGpfH.exe
  C:\Windows\System\KZFGpfH.exe
  2⤵
  PID:11636
- C:\Windows\System\sxHcRfL.exe
  C:\Windows\System\sxHcRfL.exe
  2⤵
  PID:11656
- C:\Windows\System\WrMVvHC.exe
  C:\Windows\System\WrMVvHC.exe
  2⤵
  PID:11716
- C:\Windows\System\Iqvbjrs.exe
  C:\Windows\System\Iqvbjrs.exe
  2⤵
  PID:11764
- C:\Windows\System\llxnALk.exe
  C:\Windows\System\llxnALk.exe
  2⤵
  PID:11820
- C:\Windows\System\yeZWnpm.exe
  C:\Windows\System\yeZWnpm.exe
  2⤵
  PID:11904
- C:\Windows\System\HXXYiBL.exe
  C:\Windows\System\HXXYiBL.exe
  2⤵
  PID:11956
- C:\Windows\System\NJdJAzR.exe
  C:\Windows\System\NJdJAzR.exe
  2⤵
  PID:12016
- C:\Windows\System\EeWPloE.exe
  C:\Windows\System\EeWPloE.exe
  2⤵
  PID:12028
- C:\Windows\System\idcGHUX.exe
  C:\Windows\System\idcGHUX.exe
  2⤵
  PID:12164
- C:\Windows\System\dFCOYgV.exe
  C:\Windows\System\dFCOYgV.exe
  2⤵
  PID:12252
- C:\Windows\System\PHPoIFO.exe
  C:\Windows\System\PHPoIFO.exe
  2⤵
  PID:10268
- C:\Windows\System\YaLZvGt.exe
  C:\Windows\System\YaLZvGt.exe
  2⤵
  PID:3240
- C:\Windows\System\HOPKXDA.exe
  C:\Windows\System\HOPKXDA.exe
  2⤵
  PID:11276
- C:\Windows\System\jkJrtWE.exe
  C:\Windows\System\jkJrtWE.exe
  2⤵
  PID:11340
- C:\Windows\System\rKeihaK.exe
  C:\Windows\System\rKeihaK.exe
  2⤵
  PID:11552
- C:\Windows\System\mdVuOVT.exe
  C:\Windows\System\mdVuOVT.exe
  2⤵
  PID:11648
- C:\Windows\System\fINLRiX.exe
  C:\Windows\System\fINLRiX.exe
  2⤵
  PID:11704
- C:\Windows\System\zSIlniA.exe
  C:\Windows\System\zSIlniA.exe
  2⤵
  PID:12012
- C:\Windows\System\SPHQoyR.exe
  C:\Windows\System\SPHQoyR.exe
  2⤵
  PID:12088
- C:\Windows\System\YslsioV.exe
  C:\Windows\System\YslsioV.exe
  2⤵
  PID:2876
- C:\Windows\System\XMvrpLp.exe
  C:\Windows\System\XMvrpLp.exe
  2⤵
  PID:5104
- C:\Windows\System\vtjuHug.exe
  C:\Windows\System\vtjuHug.exe
  2⤵
  PID:12032
- C:\Windows\System\CAWRnWc.exe
  C:\Windows\System\CAWRnWc.exe
  2⤵
  PID:11592
- C:\Windows\System\bdfXVig.exe
  C:\Windows\System\bdfXVig.exe
  2⤵
  PID:11844
- C:\Windows\System\WXlohZI.exe
  C:\Windows\System\WXlohZI.exe
  2⤵
  PID:12312
- C:\Windows\System\xUNRvlE.exe
  C:\Windows\System\xUNRvlE.exe
  2⤵
  PID:12328
- C:\Windows\System\SmyxMkx.exe
  C:\Windows\System\SmyxMkx.exe
  2⤵
  PID:12348
- C:\Windows\System\HAxoTlA.exe
  C:\Windows\System\HAxoTlA.exe
  2⤵
  PID:12376
- C:\Windows\System\lRicTZH.exe
  C:\Windows\System\lRicTZH.exe
  2⤵
  PID:12424
- C:\Windows\System\bsnZmue.exe
  C:\Windows\System\bsnZmue.exe
  2⤵
  PID:12444
- C:\Windows\System\goznuUY.exe
  C:\Windows\System\goznuUY.exe
  2⤵
  PID:12472
- C:\Windows\System\IzzTTCy.exe
  C:\Windows\System\IzzTTCy.exe
  2⤵
  PID:12500
- C:\Windows\System\onTOPOY.exe
  C:\Windows\System\onTOPOY.exe
  2⤵
  PID:12520
- C:\Windows\System\bOuOcPs.exe
  C:\Windows\System\bOuOcPs.exe
  2⤵
  PID:12556
- C:\Windows\System\vCPTSyB.exe
  C:\Windows\System\vCPTSyB.exe
  2⤵
  PID:12584
- C:\Windows\System\nkIVeNn.exe
  C:\Windows\System\nkIVeNn.exe
  2⤵
  PID:12612
- C:\Windows\System\DAGuxNx.exe
  C:\Windows\System\DAGuxNx.exe
  2⤵
  PID:12632
- C:\Windows\System\eqFTRcv.exe
  C:\Windows\System\eqFTRcv.exe
  2⤵
  PID:12664
- C:\Windows\System\DJwQfac.exe
  C:\Windows\System\DJwQfac.exe
  2⤵
  PID:12764
- C:\Windows\System\FdPPzrx.exe
  C:\Windows\System\FdPPzrx.exe
  2⤵
  PID:12788
- C:\Windows\System\gGflDXU.exe
  C:\Windows\System\gGflDXU.exe
  2⤵
  PID:12816
- C:\Windows\System\AsbGssf.exe
  C:\Windows\System\AsbGssf.exe
  2⤵
  PID:12844
- C:\Windows\System\gmSysEG.exe
  C:\Windows\System\gmSysEG.exe
  2⤵
  PID:12864
- C:\Windows\System\qkIOkoy.exe
  C:\Windows\System\qkIOkoy.exe
  2⤵
  PID:12916
- C:\Windows\System\HBYGpbh.exe
  C:\Windows\System\HBYGpbh.exe
  2⤵
  PID:12936
- C:\Windows\System\gPxEijT.exe
  C:\Windows\System\gPxEijT.exe
  2⤵
  PID:12964
- C:\Windows\System\nMclwdS.exe
  C:\Windows\System\nMclwdS.exe
  2⤵
  PID:12996
- C:\Windows\System\apzDwcc.exe
  C:\Windows\System\apzDwcc.exe
  2⤵
  PID:13016
- C:\Windows\System\sJQZIOs.exe
  C:\Windows\System\sJQZIOs.exe
  2⤵
  PID:13036
- C:\Windows\System\AidyWGq.exe
  C:\Windows\System\AidyWGq.exe
  2⤵
  PID:13084
- C:\Windows\System\GYdHfAF.exe
  C:\Windows\System\GYdHfAF.exe
  2⤵
  PID:13124
- C:\Windows\System\bELHUJb.exe
  C:\Windows\System\bELHUJb.exe
  2⤵
  PID:13144
- C:\Windows\System\wyfnFBL.exe
  C:\Windows\System\wyfnFBL.exe
  2⤵
  PID:13172
- C:\Windows\System\lDFgwSK.exe
  C:\Windows\System\lDFgwSK.exe
  2⤵
  PID:13204
- C:\Windows\System\alnjXXG.exe
  C:\Windows\System\alnjXXG.exe
  2⤵
  PID:13240
- C:\Windows\System\uwBTJkI.exe
  C:\Windows\System\uwBTJkI.exe
  2⤵
  PID:13264
- C:\Windows\System\QespIha.exe
  C:\Windows\System\QespIha.exe
  2⤵
  PID:13300
- C:\Windows\System\LQkMKIm.exe
  C:\Windows\System\LQkMKIm.exe
  2⤵
  PID:12296
- C:\Windows\System\YFIEoxB.exe
  C:\Windows\System\YFIEoxB.exe
  2⤵
  PID:12356
- C:\Windows\System\utgXwQU.exe
  C:\Windows\System\utgXwQU.exe
  2⤵
  PID:12452
- C:\Windows\System\hKmFIpT.exe
  C:\Windows\System\hKmFIpT.exe
  2⤵
  PID:12492
- C:\Windows\System\ezqawMd.exe
  C:\Windows\System\ezqawMd.exe
  2⤵
  PID:12516
- C:\Windows\System\RAFeAYd.exe
  C:\Windows\System\RAFeAYd.exe
  2⤵
  PID:12548
- C:\Windows\System\fXcTgnH.exe
  C:\Windows\System\fXcTgnH.exe
  2⤵
  PID:12576
- C:\Windows\System\CGoDJKJ.exe
  C:\Windows\System\CGoDJKJ.exe
  2⤵
  PID:12732
- C:\Windows\System\BVbpnMv.exe
  C:\Windows\System\BVbpnMv.exe
  2⤵
  PID:12720
- C:\Windows\System\hnoZlmw.exe
  C:\Windows\System\hnoZlmw.exe
  2⤵
  PID:12852
- C:\Windows\System\vbTgiAf.exe
  C:\Windows\System\vbTgiAf.exe
  2⤵
  PID:12904
- C:\Windows\System\LxnEsJi.exe
  C:\Windows\System\LxnEsJi.exe
  2⤵
  PID:12960
- C:\Windows\System\cCVdVGL.exe
  C:\Windows\System\cCVdVGL.exe
  2⤵
  PID:12988
- C:\Windows\System\JTYkieB.exe
  C:\Windows\System\JTYkieB.exe
  2⤵
  PID:4004
- C:\Windows\System\oYRJETj.exe
  C:\Windows\System\oYRJETj.exe
  2⤵
  PID:1920
- C:\Windows\System\nmXsVsH.exe
  C:\Windows\System\nmXsVsH.exe
  2⤵
  PID:3584
- C:\Windows\System\zgMDqUZ.exe
  C:\Windows\System\zgMDqUZ.exe
  2⤵
  PID:13220
- C:\Windows\System\zYVMJFR.exe
  C:\Windows\System\zYVMJFR.exe
  2⤵
  PID:3044
- C:\Windows\System\XjWZrDP.exe
  C:\Windows\System\XjWZrDP.exe
  2⤵
  PID:13272
- C:\Windows\System\ExUfUZU.exe
  C:\Windows\System\ExUfUZU.exe
  2⤵
  PID:13140
- C:\Windows\System\ODupxRQ.exe
  C:\Windows\System\ODupxRQ.exe
  2⤵
  PID:12896
- C:\Windows\System\aPyEmhf.exe
  C:\Windows\System\aPyEmhf.exe
  2⤵
  PID:1388
- C:\Windows\System\yyQlWnw.exe
  C:\Windows\System\yyQlWnw.exe
  2⤵
  PID:4664
- C:\Windows\System\ULPzgrw.exe
  C:\Windows\System\ULPzgrw.exe
  2⤵
  PID:13156
- C:\Windows\System\IqDxNsj.exe
  C:\Windows\System\IqDxNsj.exe
  2⤵
  PID:3920
- C:\Windows\System\bABntxa.exe
  C:\Windows\System\bABntxa.exe
  2⤵
  PID:904
- C:\Windows\System\BOcaquU.exe
  C:\Windows\System\BOcaquU.exe
  2⤵
  PID:5576
- C:\Windows\System\JkGWyzq.exe
  C:\Windows\System\JkGWyzq.exe
  2⤵
  PID:13116
- C:\Windows\System\KyTyBfI.exe
  C:\Windows\System\KyTyBfI.exe
  2⤵
  PID:2416
- C:\Windows\System\UuYcePU.exe
  C:\Windows\System\UuYcePU.exe
  2⤵
  PID:856
- C:\Windows\System\OjNyqNI.exe
  C:\Windows\System\OjNyqNI.exe
  2⤵
  PID:13032
- C:\Windows\System\wLfvRrj.exe
  C:\Windows\System\wLfvRrj.exe
  2⤵
  PID:5152
- C:\Windows\System\VyDGhVj.exe
  C:\Windows\System\VyDGhVj.exe
  2⤵
  PID:5020
- C:\Windows\System\NrIQKbU.exe
  C:\Windows\System\NrIQKbU.exe
  2⤵
  PID:5464
- C:\Windows\System\pAExbhZ.exe
  C:\Windows\System\pAExbhZ.exe
  2⤵
  PID:1212
- C:\Windows\System\yjDYiVr.exe
  C:\Windows\System\yjDYiVr.exe
  2⤵
  PID:6308
- C:\Windows\System\TraQeKW.exe
  C:\Windows\System\TraQeKW.exe
  2⤵
  PID:4048
- C:\Windows\System\ofQYDyI.exe
  C:\Windows\System\ofQYDyI.exe
  2⤵
  PID:12784
- C:\Windows\System\XDWvEEF.exe
  C:\Windows\System\XDWvEEF.exe
  2⤵
  PID:4912
- C:\Windows\System\XYndSQf.exe
  C:\Windows\System\XYndSQf.exe
  2⤵
  PID:3084
- C:\Windows\System\JxgDgVo.exe
  C:\Windows\System\JxgDgVo.exe
  2⤵
  PID:6052
- C:\Windows\System\fDyjClf.exe
  C:\Windows\System\fDyjClf.exe
  2⤵
  PID:4160
- C:\Windows\System\WJhbZGV.exe
  C:\Windows\System\WJhbZGV.exe
  2⤵
  PID:12480
- C:\Windows\System\vmNSHCn.exe
  C:\Windows\System\vmNSHCn.exe
  2⤵
  PID:12796
- C:\Windows\System\CHFYqUJ.exe
  C:\Windows\System\CHFYqUJ.exe
  2⤵
  PID:12880
- C:\Windows\System\VTeziUh.exe
  C:\Windows\System\VTeziUh.exe
  2⤵
  PID:13236
- C:\Windows\System\hHEEhKm.exe
  C:\Windows\System\hHEEhKm.exe
  2⤵
  PID:5716
- C:\Windows\System\RwwAkQR.exe
  C:\Windows\System\RwwAkQR.exe
  2⤵
  PID:6200
- C:\Windows\System\JQSIZPJ.exe
  C:\Windows\System\JQSIZPJ.exe
  2⤵
  PID:13248
- C:\Windows\System\OZpHmOg.exe
  C:\Windows\System\OZpHmOg.exe
  2⤵
  PID:3484
- C:\Windows\System\AFIAJFf.exe
  C:\Windows\System\AFIAJFf.exe
  2⤵
  PID:6660
- C:\Windows\System\Wbxpyfc.exe
  C:\Windows\System\Wbxpyfc.exe
  2⤵
  PID:7624
- C:\Windows\System\sdRKvxC.exe
  C:\Windows\System\sdRKvxC.exe
  2⤵
  PID:7816
- C:\Windows\System\badAIVY.exe
  C:\Windows\System\badAIVY.exe
  2⤵
  PID:4588
- C:\Windows\System\puLfkcV.exe
  C:\Windows\System\puLfkcV.exe
  2⤵
  PID:8064
- C:\Windows\System\wmqwSqE.exe
  C:\Windows\System\wmqwSqE.exe
  2⤵
  PID:4328
- C:\Windows\System\QtsGrPT.exe
  C:\Windows\System\QtsGrPT.exe
  2⤵
  PID:6540
- C:\Windows\System\qRMuGSY.exe
  C:\Windows\System\qRMuGSY.exe
  2⤵
  PID:6628
- C:\Windows\System\sByThPq.exe
  C:\Windows\System\sByThPq.exe
  2⤵
  PID:388
- C:\Windows\System\MwOfpmw.exe
  C:\Windows\System\MwOfpmw.exe
  2⤵
  PID:4880
- C:\Windows\System\fvkpXWf.exe
  C:\Windows\System\fvkpXWf.exe
  2⤵
  PID:4360
- C:\Windows\System\GaRsUqc.exe
  C:\Windows\System\GaRsUqc.exe
  2⤵
  PID:7868
- C:\Windows\System\LFhKJVO.exe
  C:\Windows\System\LFhKJVO.exe
  2⤵
  PID:3360
- C:\Windows\System\nocknwk.exe
  C:\Windows\System\nocknwk.exe
  2⤵
  PID:7980
- C:\Windows\System\DzsLOPg.exe
  C:\Windows\System\DzsLOPg.exe
  2⤵
  PID:3036
- C:\Windows\System\kinjAHr.exe
  C:\Windows\System\kinjAHr.exe
  2⤵
  PID:6772
- C:\Windows\System\VPFDWSD.exe
  C:\Windows\System\VPFDWSD.exe
  2⤵
  PID:1356
- C:\Windows\System\XDuwEmk.exe
  C:\Windows\System\XDuwEmk.exe
  2⤵
  PID:7240
- C:\Windows\System\RsQQjoy.exe
  C:\Windows\System\RsQQjoy.exe
  2⤵
  PID:8564
- C:\Windows\System\IHQlbor.exe
  C:\Windows\System\IHQlbor.exe
  2⤵
  PID:908
- C:\Windows\System\IcxXBbn.exe
  C:\Windows\System\IcxXBbn.exe
  2⤵
  PID:8748
- C:\Windows\System\DTMVkTm.exe
  C:\Windows\System\DTMVkTm.exe
  2⤵
  PID:1604
- C:\Windows\System\mtxfKEN.exe
  C:\Windows\System\mtxfKEN.exe
  2⤵
  PID:8036
- C:\Windows\System\GcVYZen.exe
  C:\Windows\System\GcVYZen.exe
  2⤵
  PID:760
- C:\Windows\System\TNJQsZr.exe
  C:\Windows\System\TNJQsZr.exe
  2⤵
  PID:7572
- C:\Windows\System\UgMeJbG.exe
  C:\Windows\System\UgMeJbG.exe
  2⤵
  PID:1732
- C:\Windows\System\YXNCQaE.exe
  C:\Windows\System\YXNCQaE.exe
  2⤵
  PID:3548
- C:\Windows\System\nRsRYzz.exe
  C:\Windows\System\nRsRYzz.exe
  2⤵
  PID:4820
- C:\Windows\System\ltclTmS.exe
  C:\Windows\System\ltclTmS.exe
  2⤵
  PID:4380
- C:\Windows\System\GeObRCd.exe
  C:\Windows\System\GeObRCd.exe
  2⤵
  PID:2612
- C:\Windows\System\yzNGcnI.exe
  C:\Windows\System\yzNGcnI.exe
  2⤵
  PID:7132
- C:\Windows\System\TOmUPIi.exe
  C:\Windows\System\TOmUPIi.exe
  2⤵
  PID:2796
- C:\Windows\System\PjCTORS.exe
  C:\Windows\System\PjCTORS.exe
  2⤵
  PID:2676
- C:\Windows\System\wPZNXib.exe
  C:\Windows\System\wPZNXib.exe
  2⤵
  PID:8900
- C:\Windows\System\CCHjNWy.exe
  C:\Windows\System\CCHjNWy.exe
  2⤵
  PID:1000
- C:\Windows\System\bxOHwNd.exe
  C:\Windows\System\bxOHwNd.exe
  2⤵
  PID:3792
- C:\Windows\System\RpoiQep.exe
  C:\Windows\System\RpoiQep.exe
  2⤵
  PID:4540
- C:\Windows\System\pQMLvWd.exe
  C:\Windows\System\pQMLvWd.exe
  2⤵
  PID:8788
- C:\Windows\System\RlPsmse.exe
  C:\Windows\System\RlPsmse.exe
  2⤵
  PID:8128
- C:\Windows\System\PZENrof.exe
  C:\Windows\System\PZENrof.exe
  2⤵
  PID:5312
- C:\Windows\System\eGxEJFc.exe
  C:\Windows\System\eGxEJFc.exe
  2⤵
  PID:8528
- C:\Windows\System\WUUbZRk.exe
  C:\Windows\System\WUUbZRk.exe
  2⤵
  PID:8272
- C:\Windows\System\wMUcGHb.exe
  C:\Windows\System\wMUcGHb.exe
  2⤵
  PID:4500
- C:\Windows\System\yHtJDxv.exe
  C:\Windows\System\yHtJDxv.exe
  2⤵
  PID:8168
- C:\Windows\System\hlvIbgU.exe
  C:\Windows\System\hlvIbgU.exe
  2⤵
  PID:3572
- C:\Windows\System\KeTdbJE.exe
  C:\Windows\System\KeTdbJE.exe
  2⤵
  PID:8912
- C:\Windows\System\uohroBJ.exe
  C:\Windows\System\uohroBJ.exe
  2⤵
  PID:4468
- C:\Windows\System\EGBvxwB.exe
  C:\Windows\System\EGBvxwB.exe
  2⤵
  PID:1984
- C:\Windows\System\ahihJnp.exe
  C:\Windows\System\ahihJnp.exe
  2⤵
  PID:5540
- C:\Windows\System\RbKUThi.exe
  C:\Windows\System\RbKUThi.exe
  2⤵
  PID:9980
- C:\Windows\System\IXZRMgA.exe
  C:\Windows\System\IXZRMgA.exe
  2⤵
  PID:5436
- C:\Windows\System\YGVYctT.exe
  C:\Windows\System\YGVYctT.exe
  2⤵
  PID:5660
- C:\Windows\System\CXXdcAk.exe
  C:\Windows\System\CXXdcAk.exe
  2⤵
  PID:5752
- C:\Windows\System\eySLtwX.exe
  C:\Windows\System\eySLtwX.exe
  2⤵
  PID:5780
- C:\Windows\System\JsBgDJY.exe
  C:\Windows\System\JsBgDJY.exe
  2⤵
  PID:5852
- C:\Windows\System\lqRbdLV.exe
  C:\Windows\System\lqRbdLV.exe
  2⤵
  PID:6576
- C:\Windows\System\gWRPEQx.exe
  C:\Windows\System\gWRPEQx.exe
  2⤵
  PID:5884
- C:\Windows\System\cfbRQlW.exe
  C:\Windows\System\cfbRQlW.exe
  2⤵
  PID:9688
- C:\Windows\System\acoYZei.exe
  C:\Windows\System\acoYZei.exe
  2⤵
  PID:5268
- C:\Windows\System\bBAgogy.exe
  C:\Windows\System\bBAgogy.exe
  2⤵
  PID:10160
- C:\Windows\System\ZKfkfqM.exe
  C:\Windows\System\ZKfkfqM.exe
  2⤵
  PID:9916
- C:\Windows\System\KGgYQOj.exe
  C:\Windows\System\KGgYQOj.exe
  2⤵
  PID:5620
- C:\Windows\System\XzJhrVb.exe
  C:\Windows\System\XzJhrVb.exe
  2⤵
  PID:10016
- C:\Windows\System\QBSCdxW.exe
  C:\Windows\System\QBSCdxW.exe
  2⤵
  PID:1424
- C:\Windows\System\AAlGTiT.exe
  C:\Windows\System\AAlGTiT.exe
  2⤵
  PID:8940
- C:\Windows\System\lZZLecs.exe
  C:\Windows\System\lZZLecs.exe
  2⤵
  PID:5768
- C:\Windows\System\OnIUZRr.exe
  C:\Windows\System\OnIUZRr.exe
  2⤵
  PID:10072
- C:\Windows\System\tUZkwzJ.exe
  C:\Windows\System\tUZkwzJ.exe
  2⤵
  PID:5156
- C:\Windows\System\vyPJZWu.exe
  C:\Windows\System\vyPJZWu.exe
  2⤵
  PID:5144
- C:\Windows\System\wwdSKjM.exe
  C:\Windows\System\wwdSKjM.exe
  2⤵
  PID:5260
- C:\Windows\System\lksAVIS.exe
  C:\Windows\System\lksAVIS.exe
  2⤵
  PID:5912
- C:\Windows\System\AmZgDFq.exe
  C:\Windows\System\AmZgDFq.exe
  2⤵
  PID:5940
- C:\Windows\System\tlFvwvu.exe
  C:\Windows\System\tlFvwvu.exe
  2⤵
  PID:10568
- C:\Windows\System\qjVzeEO.exe
  C:\Windows\System\qjVzeEO.exe
  2⤵
  PID:10768
- C:\Windows\System\VyMbdKe.exe
  C:\Windows\System\VyMbdKe.exe
  2⤵
  PID:6108
- C:\Windows\System\TzLDPXu.exe
  C:\Windows\System\TzLDPXu.exe
  2⤵
  PID:10844
- C:\Windows\System\niweJse.exe
  C:\Windows\System\niweJse.exe
  2⤵
  PID:5792
- C:\Windows\System\eTOTaNx.exe
  C:\Windows\System\eTOTaNx.exe
  2⤵
  PID:10976
- C:\Windows\System\UMwoEim.exe
  C:\Windows\System\UMwoEim.exe
  2⤵
  PID:2980
- C:\Windows\System\dGoRzno.exe
  C:\Windows\System\dGoRzno.exe
  2⤵
  PID:10288
- C:\Windows\System\UZcKPrb.exe
  C:\Windows\System\UZcKPrb.exe
  2⤵
  PID:6072
- C:\Windows\System\GjKWlRQ.exe
  C:\Windows\System\GjKWlRQ.exe
  2⤵
  PID:6132
- C:\Windows\System\faLFbzK.exe
  C:\Windows\System\faLFbzK.exe
  2⤵
  PID:4344
- C:\Windows\System\gciWcif.exe
  C:\Windows\System\gciWcif.exe
  2⤵
  PID:10480
- C:\Windows\System\TaxYTXo.exe
  C:\Windows\System\TaxYTXo.exe
  2⤵
  PID:5176
- C:\Windows\System\nmJnYZk.exe
  C:\Windows\System\nmJnYZk.exe
  2⤵
  PID:10652
- C:\Windows\System\rhHaUiT.exe
  C:\Windows\System\rhHaUiT.exe
  2⤵
  PID:9884
- C:\Windows\System\zfaDdea.exe
  C:\Windows\System\zfaDdea.exe
  2⤵
  PID:10572
- C:\Windows\System\uKPprGW.exe
  C:\Windows\System\uKPprGW.exe
  2⤵
  PID:5548
- C:\Windows\System\SuKlnVD.exe
  C:\Windows\System\SuKlnVD.exe
  2⤵
  PID:5628
- C:\Windows\System\CMWBQoS.exe
  C:\Windows\System\CMWBQoS.exe
  2⤵
  PID:5728
- C:\Windows\System\kfbJtbJ.exe
  C:\Windows\System\kfbJtbJ.exe
  2⤵
  PID:11248
- C:\Windows\System\XQSxgok.exe
  C:\Windows\System\XQSxgok.exe
  2⤵
  PID:11300
- C:\Windows\System\qYjkYsY.exe
  C:\Windows\System\qYjkYsY.exe
  2⤵
  PID:11400
- C:\Windows\System\dqVgNHQ.exe
  C:\Windows\System\dqVgNHQ.exe
  2⤵
  PID:10116
- C:\Windows\System\pFjhWJL.exe
  C:\Windows\System\pFjhWJL.exe
  2⤵
  PID:5656
- C:\Windows\System\OnRvGLS.exe
  C:\Windows\System\OnRvGLS.exe
  2⤵
  PID:5960
- C:\Windows\System\JJodlEc.exe
  C:\Windows\System\JJodlEc.exe
  2⤵
  PID:2388
- C:\Windows\System\uCtJUhx.exe
  C:\Windows\System\uCtJUhx.exe
  2⤵
  PID:11320
- C:\Windows\System\ZfxBwcv.exe
  C:\Windows\System\ZfxBwcv.exe
  2⤵
  PID:11444
- C:\Windows\System\mYjxZsA.exe
  C:\Windows\System\mYjxZsA.exe
  2⤵
  PID:5764
- C:\Windows\System\TZkebuY.exe
  C:\Windows\System\TZkebuY.exe
  2⤵
  PID:10924
- C:\Windows\System\TiIBsTD.exe
  C:\Windows\System\TiIBsTD.exe
  2⤵
  PID:5932
- C:\Windows\System\DDvTqBT.exe
  C:\Windows\System\DDvTqBT.exe
  2⤵
  PID:4332
- C:\Windows\System\gxWtpOs.exe
  C:\Windows\System\gxWtpOs.exe
  2⤵
  PID:2108
- C:\Windows\System\CeSEyBZ.exe
  C:\Windows\System\CeSEyBZ.exe
  2⤵
  PID:12216
- C:\Windows\System\WNOauqy.exe
  C:\Windows\System\WNOauqy.exe
  2⤵
  PID:12244
- C:\Windows\System\mYWeJje.exe
  C:\Windows\System\mYWeJje.exe
  2⤵
  PID:10508
- C:\Windows\System\qogWfQb.exe
  C:\Windows\System\qogWfQb.exe
  2⤵
  PID:5560
- C:\Windows\System\cRgwQls.exe
  C:\Windows\System\cRgwQls.exe
  2⤵
  PID:11324
- C:\Windows\System\DWjlPGQ.exe
  C:\Windows\System\DWjlPGQ.exe
  2⤵
  PID:10184
- C:\Windows\System\VqlpSdX.exe
  C:\Windows\System\VqlpSdX.exe
  2⤵
  PID:6360
- C:\Windows\System\mLJNIie.exe
  C:\Windows\System\mLJNIie.exe
  2⤵
  PID:5512
- C:\Windows\System\fLstYgf.exe
  C:\Windows\System\fLstYgf.exe
  2⤵
  PID:10916
- C:\Windows\System\OgpWccZ.exe
  C:\Windows\System\OgpWccZ.exe
  2⤵
  PID:9388
- C:\Windows\System\NsEuBSL.exe
  C:\Windows\System\NsEuBSL.exe
  2⤵
  PID:10320
- C:\Windows\System\BWFPsYx.exe
  C:\Windows\System\BWFPsYx.exe
  2⤵
  PID:6548
- C:\Windows\System\EfJZVii.exe
  C:\Windows\System\EfJZVii.exe
  2⤵
  PID:12952
- C:\Windows\System\QiokmlE.exe
  C:\Windows\System\QiokmlE.exe
  2⤵
  PID:10416
- C:\Windows\System\gUdAxEG.exe
  C:\Windows\System\gUdAxEG.exe
  2⤵
  PID:11800
- C:\Windows\System\EvLzlAa.exe
  C:\Windows\System\EvLzlAa.exe
  2⤵
  PID:12808
- C:\Windows\System\drpZDsj.exe
  C:\Windows\System\drpZDsj.exe
  2⤵
  PID:12304
- C:\Windows\System\bIjTUjW.exe
  C:\Windows\System\bIjTUjW.exe
  2⤵
  PID:6720
- C:\Windows\System\HCIzYZk.exe
  C:\Windows\System\HCIzYZk.exe
  2⤵
  PID:12812
- C:\Windows\System\ccUFfll.exe
  C:\Windows\System\ccUFfll.exe
  2⤵
  PID:12180
- C:\Windows\System\OZqFYOF.exe
  C:\Windows\System\OZqFYOF.exe
  2⤵
  PID:12024
- C:\Windows\System\TZvHOgs.exe
  C:\Windows\System\TZvHOgs.exe
  2⤵
  PID:2648
- C:\Windows\System\rnalrrr.exe
  C:\Windows\System\rnalrrr.exe
  2⤵
  PID:6768
- C:\Windows\System\nrBzFeG.exe
  C:\Windows\System\nrBzFeG.exe
  2⤵
  PID:12240
- C:\Windows\System\PezWOGc.exe
  C:\Windows\System\PezWOGc.exe
  2⤵
  PID:6188
- C:\Windows\System\pjrBXrX.exe
  C:\Windows\System\pjrBXrX.exe
  2⤵
  PID:11132
- C:\Windows\System\UeeZHEF.exe
  C:\Windows\System\UeeZHEF.exe
  2⤵
  PID:4472
- C:\Windows\System\lVhiDJi.exe
  C:\Windows\System\lVhiDJi.exe
  2⤵
  PID:4032
- C:\Windows\System\GDwzpEh.exe
  C:\Windows\System\GDwzpEh.exe
  2⤵
  PID:6184
- C:\Windows\System\dixJskh.exe
  C:\Windows\System\dixJskh.exe
  2⤵
  PID:11272
- C:\Windows\System\XnTSzlO.exe
  C:\Windows\System\XnTSzlO.exe
  2⤵
  PID:6572
- C:\Windows\System\kUXWoAj.exe
  C:\Windows\System\kUXWoAj.exe
  2⤵
  PID:12836
- C:\Windows\System\zjBfcSo.exe
  C:\Windows\System\zjBfcSo.exe
  2⤵
  PID:13160
- C:\Windows\System\pHxGMFK.exe
  C:\Windows\System\pHxGMFK.exe
  2⤵
  PID:9976
- C:\Windows\System\zmevPaI.exe
  C:\Windows\System\zmevPaI.exe
  2⤵
  PID:12200
- C:\Windows\System\sIlyXIW.exe
  C:\Windows\System\sIlyXIW.exe
  2⤵
  PID:13228
- C:\Windows\System\VJDQWJY.exe
  C:\Windows\System\VJDQWJY.exe
  2⤵
  PID:3432
- C:\Windows\System\JctGcCA.exe
  C:\Windows\System\JctGcCA.exe
  2⤵
  PID:6644
- C:\Windows\System\yELNRty.exe
  C:\Windows\System\yELNRty.exe
  2⤵
  PID:6852
- C:\Windows\System\rLflMLn.exe
  C:\Windows\System\rLflMLn.exe
  2⤵
  PID:6844
- C:\Windows\System\SvbQkrB.exe
  C:\Windows\System\SvbQkrB.exe
  2⤵
  PID:6840
- C:\Windows\System\FKFRcNA.exe
  C:\Windows\System\FKFRcNA.exe
  2⤵
  PID:11156
- C:\Windows\System\wQNkbfT.exe
  C:\Windows\System\wQNkbfT.exe
  2⤵
  PID:7088
- C:\Windows\System\QYHbVvL.exe
  C:\Windows\System\QYHbVvL.exe
  2⤵
  PID:9524
- C:\Windows\System\mzQYEkA.exe
  C:\Windows\System\mzQYEkA.exe
  2⤵
  PID:7460
- C:\Windows\System\YDsxISK.exe
  C:\Windows\System\YDsxISK.exe
  2⤵
  PID:12692
- C:\Windows\System\gIclAsr.exe
  C:\Windows\System\gIclAsr.exe
  2⤵
  PID:11432
- C:\Windows\System\PEpzcRA.exe
  C:\Windows\System\PEpzcRA.exe
  2⤵
  PID:6512
- C:\Windows\System\YAIBSHB.exe
  C:\Windows\System\YAIBSHB.exe
  2⤵
  PID:7628
- C:\Windows\System\lLCVfCr.exe
  C:\Windows\System\lLCVfCr.exe
  2⤵
  PID:552
- C:\Windows\System\GAWtJEK.exe
  C:\Windows\System\GAWtJEK.exe
  2⤵
  PID:1324
- C:\Windows\System\YVRYZNN.exe
  C:\Windows\System\YVRYZNN.exe
  2⤵
  PID:6776
- C:\Windows\System\kIYNKRJ.exe
  C:\Windows\System\kIYNKRJ.exe
  2⤵
  PID:7932
- C:\Windows\System\kIxjGEn.exe
  C:\Windows\System\kIxjGEn.exe
  2⤵
  PID:12596
- C:\Windows\System\vfzsLyj.exe
  C:\Windows\System\vfzsLyj.exe
  2⤵
  PID:3096
- C:\Windows\System\PxNEoHW.exe
  C:\Windows\System\PxNEoHW.exe
  2⤵
  PID:11576
- C:\Windows\System\ieEDuDu.exe
  C:\Windows\System\ieEDuDu.exe
  2⤵
  PID:6560
- C:\Windows\System\mHRahbC.exe
  C:\Windows\System\mHRahbC.exe
  2⤵
  PID:3608
- C:\Windows\System\ULoNUeu.exe
  C:\Windows\System\ULoNUeu.exe
  2⤵
  PID:8180
- C:\Windows\System\DQgUfhb.exe
  C:\Windows\System\DQgUfhb.exe
  2⤵
  PID:12436
- C:\Windows\System\LvSgsXU.exe
  C:\Windows\System\LvSgsXU.exe
  2⤵
  PID:3936
- C:\Windows\System\wGLjSnZ.exe
  C:\Windows\System\wGLjSnZ.exe
  2⤵
  PID:11168
- C:\Windows\System\hjpIpiq.exe
  C:\Windows\System\hjpIpiq.exe
  2⤵
  PID:6516
- C:\Windows\System\bJddohY.exe
  C:\Windows\System\bJddohY.exe
  2⤵
  PID:12272
- C:\Windows\System\lxNRYCr.exe
  C:\Windows\System\lxNRYCr.exe
  2⤵
  PID:8412
- C:\Windows\System\WBbXAfx.exe
  C:\Windows\System\WBbXAfx.exe
  2⤵
  PID:7216
- C:\Windows\System\RWsyBmR.exe
  C:\Windows\System\RWsyBmR.exe
  2⤵
  PID:8512
- C:\Windows\System\FkMuDDE.exe
  C:\Windows\System\FkMuDDE.exe
  2⤵
  PID:7312
- C:\Windows\System\osfPjbZ.exe
  C:\Windows\System\osfPjbZ.exe
  2⤵
  PID:12116
- C:\Windows\System\dIUcUvs.exe
  C:\Windows\System\dIUcUvs.exe
  2⤵
  PID:7284
- C:\Windows\System\AgVVFoX.exe
  C:\Windows\System\AgVVFoX.exe
  2⤵
  PID:9044
- C:\Windows\System\tkcNOEX.exe
  C:\Windows\System\tkcNOEX.exe
  2⤵
  PID:8812
- C:\Windows\System\OeTKyks.exe
  C:\Windows\System\OeTKyks.exe
  2⤵
  PID:1460
- C:\Windows\System\ufbeeCm.exe
  C:\Windows\System\ufbeeCm.exe
  2⤵
  PID:9208
- C:\Windows\System\ugOuIcn.exe
  C:\Windows\System\ugOuIcn.exe
  2⤵
  PID:8688
- C:\Windows\System\tPZXWvK.exe
  C:\Windows\System\tPZXWvK.exe
  2⤵
  PID:9128
- C:\Windows\System\juTQFUT.exe
  C:\Windows\System\juTQFUT.exe
  2⤵
  PID:6620
- C:\Windows\System\gTBJsyA.exe
  C:\Windows\System\gTBJsyA.exe
  2⤵
  PID:7988
- C:\Windows\System\lXRLkZB.exe
  C:\Windows\System\lXRLkZB.exe
  2⤵
  PID:8124
- C:\Windows\System\yzygdJD.exe
  C:\Windows\System\yzygdJD.exe
  2⤵
  PID:8360
- C:\Windows\System\bnDawWW.exe
  C:\Windows\System\bnDawWW.exe
  2⤵
  PID:7432
- C:\Windows\System\SmVYgQl.exe
  C:\Windows\System\SmVYgQl.exe
  2⤵
  PID:8384
- C:\Windows\System\LdbtLlx.exe
  C:\Windows\System\LdbtLlx.exe
  2⤵
  PID:6952
- C:\Windows\System\EAlfCCo.exe
  C:\Windows\System\EAlfCCo.exe
  2⤵
  PID:11008
- C:\Windows\System\WbLAbIQ.exe
  C:\Windows\System\WbLAbIQ.exe
  2⤵
  PID:7412
- C:\Windows\System\BxmzjWT.exe
  C:\Windows\System\BxmzjWT.exe
  2⤵
  PID:9356
- C:\Windows\System\LWExacs.exe
  C:\Windows\System\LWExacs.exe
  2⤵
  PID:8636
- C:\Windows\System\yoXSwHO.exe
  C:\Windows\System\yoXSwHO.exe
  2⤵
  PID:6128
- C:\Windows\System\PlemyLb.exe
  C:\Windows\System\PlemyLb.exe
  2⤵
  PID:9460
- C:\Windows\System\crDKNTo.exe
  C:\Windows\System\crDKNTo.exe
  2⤵
  PID:3336
- C:\Windows\System\IuDFEJP.exe
  C:\Windows\System\IuDFEJP.exe
  2⤵
  PID:7828
- C:\Windows\System\rffWHdh.exe
  C:\Windows\System\rffWHdh.exe
  2⤵
  PID:7884
- C:\Windows\System\MnSdfIH.exe
  C:\Windows\System\MnSdfIH.exe
  2⤵
  PID:9832
- C:\Windows\System\eAUlOAc.exe
  C:\Windows\System\eAUlOAc.exe
  2⤵
  PID:9160
- C:\Windows\System\xNobRhZ.exe
  C:\Windows\System\xNobRhZ.exe
  2⤵
  PID:9152
- C:\Windows\System\biwJVLp.exe
  C:\Windows\System\biwJVLp.exe
  2⤵
  PID:7156
- C:\Windows\System\TeFCZzn.exe
  C:\Windows\System\TeFCZzn.exe
  2⤵
  PID:8920
- C:\Windows\System\MhKzbPj.exe
  C:\Windows\System\MhKzbPj.exe
  2⤵
  PID:8752
- C:\Windows\System\HCiByvt.exe
  C:\Windows\System\HCiByvt.exe
  2⤵
  PID:1120
- C:\Windows\System\MwdIDmP.exe
  C:\Windows\System\MwdIDmP.exe
  2⤵
  PID:8400
- C:\Windows\System\eNRLxgy.exe
  C:\Windows\System\eNRLxgy.exe
  2⤵
  PID:10172
- C:\Windows\System\aeAznOm.exe
  C:\Windows\System\aeAznOm.exe
  2⤵
  PID:9012
- C:\Windows\System\REhhicN.exe
  C:\Windows\System\REhhicN.exe
  2⤵
  PID:9808
- C:\Windows\System\LVSsiqy.exe
  C:\Windows\System\LVSsiqy.exe
  2⤵
  PID:8776
- C:\Windows\System\hSWkuGi.exe
  C:\Windows\System\hSWkuGi.exe
  2⤵
  PID:7832
- C:\Windows\System\xHXVxBA.exe
  C:\Windows\System\xHXVxBA.exe
  2⤵
  PID:9508
- C:\Windows\System\HXezGdU.exe
  C:\Windows\System\HXezGdU.exe
  2⤵
  PID:9516
- C:\Windows\System\aNjlhqr.exe
  C:\Windows\System\aNjlhqr.exe
  2⤵
  PID:9904
- C:\Windows\System\nkoHTyH.exe
  C:\Windows\System\nkoHTyH.exe
  2⤵
  PID:8840
- C:\Windows\System\eTknwxD.exe
  C:\Windows\System\eTknwxD.exe
  2⤵
  PID:8880
- C:\Windows\System\wGIhERy.exe
  C:\Windows\System\wGIhERy.exe
  2⤵
  PID:11240
- C:\Windows\System\nWmIzUM.exe
  C:\Windows\System\nWmIzUM.exe
  2⤵
  PID:10460
- C:\Windows\System\bwLdeny.exe
  C:\Windows\System\bwLdeny.exe
  2⤵
  PID:9248
- C:\Windows\System\yLKiWOd.exe
  C:\Windows\System\yLKiWOd.exe
  2⤵
  PID:10836
- C:\Windows\System\xrupGNo.exe
  C:\Windows\System\xrupGNo.exe
  2⤵
  PID:10832
- C:\Windows\System\gnOnAeq.exe
  C:\Windows\System\gnOnAeq.exe
  2⤵
  PID:10940
- C:\Windows\System\sauGGXx.exe
  C:\Windows\System\sauGGXx.exe
  2⤵
  PID:9308
- C:\Windows\System\bVSWJNh.exe
  C:\Windows\System\bVSWJNh.exe
  2⤵
  PID:10120
- C:\Windows\System\DYzHYxf.exe
  C:\Windows\System\DYzHYxf.exe
  2⤵
  PID:9500
- C:\Windows\System\DdQFkpa.exe
  C:\Windows\System\DdQFkpa.exe
  2⤵
  PID:9760
- C:\Windows\System\dXvIOAe.exe
  C:\Windows\System\dXvIOAe.exe
  2⤵
  PID:9876
- C:\Windows\System\RbGlMTd.exe
  C:\Windows\System\RbGlMTd.exe
  2⤵
  PID:10660
- C:\Windows\System\hFDaTaP.exe
  C:\Windows\System\hFDaTaP.exe
  2⤵
  PID:9520
- C:\Windows\System\ZesvRWN.exe
  C:\Windows\System\ZesvRWN.exe
  2⤵
  PID:10952
- C:\Windows\System\nYKalKp.exe
  C:\Windows\System\nYKalKp.exe
  2⤵
  PID:6820
- C:\Windows\System\UjhpYfQ.exe
  C:\Windows\System\UjhpYfQ.exe
  2⤵
  PID:10304
- C:\Windows\System\xYRavRR.exe
  C:\Windows\System\xYRavRR.exe
  2⤵
  PID:10412
- C:\Windows\System\JVIYAzd.exe
  C:\Windows\System\JVIYAzd.exe
  2⤵
  PID:10336
- C:\Windows\System\mhGkMeF.exe
  C:\Windows\System\mhGkMeF.exe
  2⤵
  PID:6876
- C:\Windows\System\qJHLRku.exe
  C:\Windows\System\qJHLRku.exe
  2⤵
  PID:2924
- C:\Windows\System\meMCZlD.exe
  C:\Windows\System\meMCZlD.exe
  2⤵
  PID:7452
- C:\Windows\System\crcYHNO.exe
  C:\Windows\System\crcYHNO.exe
  2⤵
  PID:11024
- C:\Windows\System\tLeADAF.exe
  C:\Windows\System\tLeADAF.exe
  2⤵
  PID:12324
- C:\Windows\System\gSsfBZI.exe
  C:\Windows\System\gSsfBZI.exe
  2⤵
  PID:9828
- C:\Windows\System\VJsMINh.exe
  C:\Windows\System\VJsMINh.exe
  2⤵
  PID:8440
- C:\Windows\System\BNQHtUv.exe
  C:\Windows\System\BNQHtUv.exe
  2⤵
  PID:11528
- C:\Windows\System\XwwjjqW.exe
  C:\Windows\System\XwwjjqW.exe
  2⤵
  PID:11604
- C:\Windows\System\zIVldcA.exe
  C:\Windows\System\zIVldcA.exe
  2⤵
  PID:11640
- C:\Windows\System\UuSZaUr.exe
  C:\Windows\System\UuSZaUr.exe
  2⤵
  PID:4988
- C:\Windows\System\UCiNABw.exe
  C:\Windows\System\UCiNABw.exe
  2⤵
  PID:10828
- C:\Windows\System\ptJQzAB.exe
  C:\Windows\System\ptJQzAB.exe
  2⤵
  PID:9748
- C:\Windows\System\tmZwlND.exe
  C:\Windows\System\tmZwlND.exe
  2⤵
  PID:9824
- C:\Windows\System\BYoBPBd.exe
  C:\Windows\System\BYoBPBd.exe
  2⤵
  PID:11896
- C:\Windows\System\sPSOzXj.exe
  C:\Windows\System\sPSOzXj.exe
  2⤵
  PID:12036
- C:\Windows\System\vsACGHl.exe
  C:\Windows\System\vsACGHl.exe
  2⤵
  PID:6632
- C:\Windows\System\MPjqiAD.exe
  C:\Windows\System\MPjqiAD.exe
  2⤵
  PID:10528
- C:\Windows\System\eEzbtrI.exe
  C:\Windows\System\eEzbtrI.exe
  2⤵
  PID:11204
- C:\Windows\System\bBOngXx.exe
  C:\Windows\System\bBOngXx.exe
  2⤵
  PID:11352
- C:\Windows\System\GtpAELV.exe
  C:\Windows\System\GtpAELV.exe
  2⤵
  PID:9368
- C:\Windows\System\BWoNsxI.exe
  C:\Windows\System\BWoNsxI.exe
  2⤵
  PID:10624
- C:\Windows\System\lvCOxlS.exe
  C:\Windows\System\lvCOxlS.exe
  2⤵
  PID:11148
- C:\Windows\System\RYPihuo.exe
  C:\Windows\System\RYPihuo.exe
  2⤵
  PID:12112
- C:\Windows\System\ZtlFLFU.exe
  C:\Windows\System\ZtlFLFU.exe
  2⤵
  PID:3064
- C:\Windows\System\faMnpwA.exe
  C:\Windows\System\faMnpwA.exe
  2⤵
  PID:8236
- C:\Windows\System\oFJOKoc.exe
  C:\Windows\System\oFJOKoc.exe
  2⤵
  PID:11680
- C:\Windows\System\ieMQsBu.exe
  C:\Windows\System\ieMQsBu.exe
  2⤵
  PID:12228
- C:\Windows\System\vGsnTBQ.exe
  C:\Windows\System\vGsnTBQ.exe
  2⤵
  PID:8772
- C:\Windows\System\WbaAYAP.exe
  C:\Windows\System\WbaAYAP.exe
  2⤵
  PID:12052
- C:\Windows\System\NIvaAUs.exe
  C:\Windows\System\NIvaAUs.exe
  2⤵
  PID:12176
- C:\Windows\System\fASfHkN.exe
  C:\Windows\System\fASfHkN.exe
  2⤵
  PID:12136
- C:\Windows\System\RrzhPFn.exe
  C:\Windows\System\RrzhPFn.exe
  2⤵
  PID:12536
- C:\Windows\System\ieVkPig.exe
  C:\Windows\System\ieVkPig.exe
  2⤵
  PID:9920
- C:\Windows\System\UxDfbad.exe
  C:\Windows\System\UxDfbad.exe
  2⤵
  PID:2816
- C:\Windows\System\dJQTrIN.exe
  C:\Windows\System\dJQTrIN.exe
  2⤵
  PID:11908
- C:\Windows\System\PkFvdhQ.exe
  C:\Windows\System\PkFvdhQ.exe
  2⤵
  PID:11848
- C:\Windows\System\yBOVizR.exe
  C:\Windows\System\yBOVizR.exe
  2⤵
  PID:10012
- C:\Windows\System\zHiLPjx.exe
  C:\Windows\System\zHiLPjx.exe
  2⤵
  PID:11164
- C:\Windows\System\nSXIzKs.exe
  C:\Windows\System\nSXIzKs.exe
  2⤵
  PID:13060
- C:\Windows\System\VXDSPQU.exe
  C:\Windows\System\VXDSPQU.exe
  2⤵
  PID:11932
- C:\Windows\System\mvmHFME.exe
  C:\Windows\System\mvmHFME.exe
  2⤵
  PID:12396
- C:\Windows\System\TLdCbPI.exe
  C:\Windows\System\TLdCbPI.exe
  2⤵
  PID:11504
- C:\Windows\System\LACGKKY.exe
  C:\Windows\System\LACGKKY.exe
  2⤵
  PID:12624
- C:\Windows\System\LyNDceJ.exe
  C:\Windows\System\LyNDceJ.exe
  2⤵
  PID:12772
- C:\Windows\System\qgPwZES.exe
  C:\Windows\System\qgPwZES.exe
  2⤵
  PID:12080
- C:\Windows\System\blmoPFn.exe
  C:\Windows\System\blmoPFn.exe
  2⤵
  PID:12408
- C:\Windows\System\zgVqFGA.exe
  C:\Windows\System\zgVqFGA.exe
  2⤵
  PID:12992
- C:\Windows\System\EWCgJfI.exe
  C:\Windows\System\EWCgJfI.exe
  2⤵
  PID:11380
- C:\Windows\System\yrPYLYH.exe
  C:\Windows\System\yrPYLYH.exe
  2⤵
  PID:7656
- C:\Windows\System\FavGYXi.exe
  C:\Windows\System\FavGYXi.exe
  2⤵
  PID:13012
- C:\Windows\System\WjiAjqf.exe
  C:\Windows\System\WjiAjqf.exe
  2⤵
  PID:12372
- C:\Windows\System\UcVwwsw.exe
  C:\Windows\System\UcVwwsw.exe
  2⤵
  PID:13416
- C:\Windows\System\ssOvYRM.exe
  C:\Windows\System\ssOvYRM.exe
  2⤵
  PID:13432
- C:\Windows\System\OxKUdMs.exe
  C:\Windows\System\OxKUdMs.exe
  2⤵
  PID:13448
- C:\Windows\System\mNgfGli.exe
  C:\Windows\System\mNgfGli.exe
  2⤵
  PID:13464
- C:\Windows\System\yLxQHJb.exe
  C:\Windows\System\yLxQHJb.exe
  2⤵
  PID:13488
- C:\Windows\System\FawktVv.exe
  C:\Windows\System\FawktVv.exe
  2⤵
  PID:13536
- C:\Windows\System\ziEGxHE.exe
  C:\Windows\System\ziEGxHE.exe
  2⤵
  PID:13552
- C:\Windows\System\drCtkEI.exe
  C:\Windows\System\drCtkEI.exe
  2⤵
  PID:13576
- C:\Windows\System\DxcFdSy.exe
  C:\Windows\System\DxcFdSy.exe
  2⤵
  PID:13612
- C:\Windows\System\ncbdSnw.exe
  C:\Windows\System\ncbdSnw.exe
  2⤵
  PID:13664
- C:\Windows\System\YNVfqsh.exe
  C:\Windows\System\YNVfqsh.exe
  2⤵
  PID:13716
- C:\Windows\System\fARXyap.exe
  C:\Windows\System\fARXyap.exe
  2⤵
  PID:13736
- C:\Windows\System\NyfVbVL.exe
  C:\Windows\System\NyfVbVL.exe
  2⤵
  PID:13788
- C:\Windows\System\LQMgRWO.exe
  C:\Windows\System\LQMgRWO.exe
  2⤵
  PID:13828
- C:\Windows\System\fxCrvkJ.exe
  C:\Windows\System\fxCrvkJ.exe
  2⤵
  PID:13864
- C:\Windows\System\YDHhPOx.exe
  C:\Windows\System\YDHhPOx.exe
  2⤵
  PID:13892
- C:\Windows\System\aumXkZU.exe
  C:\Windows\System\aumXkZU.exe
  2⤵
  PID:13920
- C:\Windows\System\ISQVunB.exe
  C:\Windows\System\ISQVunB.exe
  2⤵
  PID:13948
- C:\Windows\System\TNHyDVP.exe
  C:\Windows\System\TNHyDVP.exe
  2⤵
  PID:13976
- C:\Windows\System\NWJxfFX.exe
  C:\Windows\System\NWJxfFX.exe
  2⤵
  PID:14004
- C:\Windows\System\nMNTxYc.exe
  C:\Windows\System\nMNTxYc.exe
  2⤵
  PID:14032
- C:\Windows\System\TsVpFPC.exe
  C:\Windows\System\TsVpFPC.exe
  2⤵
  PID:14060
- C:\Windows\System\lzraKyS.exe
  C:\Windows\System\lzraKyS.exe
  2⤵
  PID:14088
- C:\Windows\System\Kprhjio.exe
  C:\Windows\System\Kprhjio.exe
  2⤵
  PID:14116
- C:\Windows\System\kYEcnrr.exe
  C:\Windows\System\kYEcnrr.exe
  2⤵
  PID:14144
- C:\Windows\System\YOnyScu.exe
  C:\Windows\System\YOnyScu.exe
  2⤵
  PID:14172
- C:\Windows\System\qaOZLMa.exe
  C:\Windows\System\qaOZLMa.exe
  2⤵
  PID:14200
- C:\Windows\System\GfLIsAa.exe
  C:\Windows\System\GfLIsAa.exe
  2⤵
  PID:14228
- C:\Windows\System\qrUoUFy.exe
  C:\Windows\System\qrUoUFy.exe
  2⤵
  PID:14256
- C:\Windows\System\rhPleEU.exe
  C:\Windows\System\rhPleEU.exe
  2⤵
  PID:14284
- C:\Windows\System\easOpSL.exe
  C:\Windows\System\easOpSL.exe
  2⤵
  PID:14312
- C:\Windows\System\EPNaHLP.exe
  C:\Windows\System\EPNaHLP.exe
  2⤵
  PID:13332
- C:\Windows\System\WvMgrhy.exe
  C:\Windows\System\WvMgrhy.exe
  2⤵
  PID:13428
- C:\Windows\System\fuuOtnl.exe
  C:\Windows\System\fuuOtnl.exe
  2⤵
  PID:13364
- C:\Windows\System\tyDjMhB.exe
  C:\Windows\System\tyDjMhB.exe
  2⤵
  PID:13396
- C:\Windows\System\QbTGgTC.exe
  C:\Windows\System\QbTGgTC.exe
  2⤵
  PID:13472
- C:\Windows\System\xMnujiu.exe
  C:\Windows\System\xMnujiu.exe
  2⤵
  PID:13504
- C:\Windows\System\jhzxwiQ.exe
  C:\Windows\System\jhzxwiQ.exe
  2⤵
  PID:13408
- C:\Windows\System\HsQfjEU.exe
  C:\Windows\System\HsQfjEU.exe
  2⤵
  PID:13644
- C:\Windows\System\LPcttYg.exe
  C:\Windows\System\LPcttYg.exe
  2⤵
  PID:13640
- C:\Windows\System\hhAjeog.exe
  C:\Windows\System\hhAjeog.exe
  2⤵
  PID:13764
- C:\Windows\System\PIcSKEc.exe
  C:\Windows\System\PIcSKEc.exe
  2⤵
  PID:13800
- C:\Windows\System\ToSoKPR.exe
  C:\Windows\System\ToSoKPR.exe
  2⤵
  PID:13880
- C:\Windows\System\bRBXsiN.exe
  C:\Windows\System\bRBXsiN.exe
  2⤵
  PID:13936
- C:\Windows\System\lBxVtuc.exe
  C:\Windows\System\lBxVtuc.exe
  2⤵
  PID:14000
- C:\Windows\System\dkdluXo.exe
  C:\Windows\System\dkdluXo.exe
  2⤵
  PID:14068
- C:\Windows\System\RJmGizH.exe
  C:\Windows\System\RJmGizH.exe
  2⤵
  PID:14132
- C:\Windows\System\MonifVx.exe
  C:\Windows\System\MonifVx.exe
  2⤵
  PID:14196
- C:\Windows\System\ISZswUg.exe
  C:\Windows\System\ISZswUg.exe
  2⤵
  PID:14264
- C:\Windows\System\jdjTxCt.exe
  C:\Windows\System\jdjTxCt.exe
  2⤵
  PID:14320
- C:\Windows\System\yXrEEdr.exe
  C:\Windows\System\yXrEEdr.exe
  2⤵
  PID:13356
- C:\Windows\System\PqodJwV.exe
  C:\Windows\System\PqodJwV.exe
  2⤵
  PID:13424
- C:\Windows\System\oirfJCv.exe
  C:\Windows\System\oirfJCv.exe
  2⤵
  PID:13512
- C:\Windows\System\yjGQrIz.exe
  C:\Windows\System\yjGQrIz.exe
  2⤵
  PID:13696
- C:\Windows\System\bScrWEn.exe
  C:\Windows\System\bScrWEn.exe
  2⤵
  PID:13872
- C:\Windows\System\upIRvFv.exe
  C:\Windows\System\upIRvFv.exe
  2⤵
  PID:14040
- C:\Windows\System\winDHzf.exe
  C:\Windows\System\winDHzf.exe
  2⤵
  PID:14188
- C:\Windows\System\oHBjSLa.exe
  C:\Windows\System\oHBjSLa.exe
  2⤵
  PID:13328
- C:\Windows\System\rOgmLQJ.exe
  C:\Windows\System\rOgmLQJ.exe
  2⤵
  PID:14252
- C:\Windows\System\rJAhERK.exe
  C:\Windows\System\rJAhERK.exe
  2⤵
  PID:13388
- C:\Windows\System\cCgeBGI.exe
  C:\Windows\System\cCgeBGI.exe
  2⤵
  PID:13796
- C:\Windows\System\jauTPoE.exe
  C:\Windows\System\jauTPoE.exe
  2⤵
  PID:13524
- C:\Windows\System\OUMHlLe.exe
  C:\Windows\System\OUMHlLe.exe
  2⤵
  PID:14168
- C:\Windows\System\SFVNqHW.exe
  C:\Windows\System\SFVNqHW.exe
  2⤵
  PID:14344
- C:\Windows\System\EKoXoyj.exe
  C:\Windows\System\EKoXoyj.exe
  2⤵
  PID:14380
- C:\Windows\System\HkBPbpo.exe
  C:\Windows\System\HkBPbpo.exe
  2⤵
  PID:14408
- C:\Windows\System\fRojnSh.exe
  C:\Windows\System\fRojnSh.exe
  2⤵
  PID:14436
- C:\Windows\System\RYxCCLO.exe
  C:\Windows\System\RYxCCLO.exe
  2⤵
  PID:14452
- C:\Windows\System\JEmjjqB.exe
  C:\Windows\System\JEmjjqB.exe
  2⤵
  PID:14480
- C:\Windows\System\cFvYJgb.exe
  C:\Windows\System\cFvYJgb.exe
  2⤵
  PID:14516
- C:\Windows\System\VDRIZOA.exe
  C:\Windows\System\VDRIZOA.exe
  2⤵
  PID:14548
- C:\Windows\System\ANYZfdx.exe
  C:\Windows\System\ANYZfdx.exe
  2⤵
  PID:14576
- C:\Windows\System\YemZjje.exe
  C:\Windows\System\YemZjje.exe
  2⤵
  PID:14604
- C:\Windows\System\LEYUATN.exe
  C:\Windows\System\LEYUATN.exe
  2⤵
  PID:14636
- C:\Windows\System\RxDihHW.exe
  C:\Windows\System\RxDihHW.exe
  2⤵
  PID:14664
- C:\Windows\System\BLDbKsM.exe
  C:\Windows\System\BLDbKsM.exe
  2⤵
  PID:14692
- C:\Windows\System\PVGFTsX.exe
  C:\Windows\System\PVGFTsX.exe
  2⤵
  PID:14720
- C:\Windows\System\kTjqPqG.exe
  C:\Windows\System\kTjqPqG.exe
  2⤵
  PID:14748
- C:\Windows\System\UIdcoGt.exe
  C:\Windows\System\UIdcoGt.exe
  2⤵
  PID:14776
- C:\Windows\System\CRFtjIN.exe
  C:\Windows\System\CRFtjIN.exe
  2⤵
  PID:14808
- C:\Windows\System\slnOshy.exe
  C:\Windows\System\slnOshy.exe
  2⤵
  PID:14836
- C:\Windows\System\XrDeUBw.exe
  C:\Windows\System\XrDeUBw.exe
  2⤵
  PID:14864
- C:\Windows\System\wpNiPGn.exe
  C:\Windows\System\wpNiPGn.exe
  2⤵
  PID:14892
- C:\Windows\System\pqATSMC.exe
  C:\Windows\System\pqATSMC.exe
  2⤵
  PID:14908
- C:\Windows\System\gKJRamY.exe
  C:\Windows\System\gKJRamY.exe
  2⤵
  PID:14936
- C:\Windows\System\ogtNkQm.exe
  C:\Windows\System\ogtNkQm.exe
  2⤵
  PID:14964
- C:\Windows\System\nsVCQlx.exe
  C:\Windows\System\nsVCQlx.exe
  2⤵
  PID:15004
- C:\Windows\System\erqwuPl.exe
  C:\Windows\System\erqwuPl.exe
  2⤵
  PID:15032
- C:\Windows\System\Pfxdlzg.exe
  C:\Windows\System\Pfxdlzg.exe
  2⤵
  PID:15060
- C:\Windows\System\SkNfrCO.exe
  C:\Windows\System\SkNfrCO.exe
  2⤵
  PID:15088
- C:\Windows\System\mWjAnEI.exe
  C:\Windows\System\mWjAnEI.exe
  2⤵
  PID:15116
- C:\Windows\System\cCpzutU.exe
  C:\Windows\System\cCpzutU.exe
  2⤵
  PID:15144
- C:\Windows\System\fjohiRs.exe
  C:\Windows\System\fjohiRs.exe
  2⤵
  PID:15172
- C:\Windows\System\iqMMVTZ.exe
  C:\Windows\System\iqMMVTZ.exe
  2⤵
  PID:15204
- C:\Windows\System\DIzuTLS.exe
  C:\Windows\System\DIzuTLS.exe
  2⤵
  PID:15232
- C:\Windows\System\PAUgvAP.exe
  C:\Windows\System\PAUgvAP.exe
  2⤵
  PID:15260
- C:\Windows\System\Hdxdsoi.exe
  C:\Windows\System\Hdxdsoi.exe
  2⤵
  PID:15288
- C:\Windows\System\zbPJWUA.exe
  C:\Windows\System\zbPJWUA.exe
  2⤵
  PID:15316
- C:\Windows\System\jOaeEVZ.exe
  C:\Windows\System\jOaeEVZ.exe
  2⤵
  PID:15344
- C:\Windows\System\szBvRRe.exe
  C:\Windows\System\szBvRRe.exe
  2⤵
  PID:13544
- C:\Windows\System\DUzCoeN.exe
  C:\Windows\System\DUzCoeN.exe
  2⤵
  PID:12704
- C:\Windows\System\qArLQXG.exe
  C:\Windows\System\qArLQXG.exe
  2⤵
  PID:14416
- C:\Windows\System\LrkZCqL.exe
  C:\Windows\System\LrkZCqL.exe
  2⤵
  PID:14492
- C:\Windows\System\nSfBuXz.exe
  C:\Windows\System\nSfBuXz.exe
  2⤵
  PID:14572
- C:\Windows\System\UoZbTIs.exe
  C:\Windows\System\UoZbTIs.exe
  2⤵
  PID:14644
- C:\Windows\System\feoTcPV.exe
  C:\Windows\System\feoTcPV.exe
  2⤵
  PID:14700
- C:\Windows\System\XCcRhdu.exe
  C:\Windows\System\XCcRhdu.exe
  2⤵
  PID:14764
- C:\Windows\System\caiHvng.exe
  C:\Windows\System\caiHvng.exe
  2⤵
  PID:14824
- C:\Windows\System\Tpalznz.exe
  C:\Windows\System\Tpalznz.exe
  2⤵
  PID:14888
- C:\Windows\System\QAiPHev.exe
  C:\Windows\System\QAiPHev.exe
  2⤵
  PID:14952
- C:\Windows\System\HEJeIlB.exe
  C:\Windows\System\HEJeIlB.exe
  2⤵
  PID:15020
- C:\Windows\System\itUbjil.exe
  C:\Windows\System\itUbjil.exe
  2⤵
  PID:12640
- C:\Windows\System\yqYRcUJ.exe
  C:\Windows\System\yqYRcUJ.exe
  2⤵
  PID:15124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_w2tixm3g.fr5.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AbzXWVH.exe

Filesize
1.9MB

MD5
6cfbcc4fc4adfbaf71ab0a425f17dbc6

SHA1
b6cfd230ca3e975bc12807123256726ffa9bee90

SHA256
16dc36ebfbf06410a020a1b6e3882601b4dcd6bee25030855382eb3bc16d96e2

SHA512
c28b2a3eb4fa18b357acd8fcbd02a6f6cafffb51563aa5c5e53b2833e3cfe2454fec58119d5909d7c7f9b12a9389775931c0038e5eb5e1d1cc323be3e67bdfcf

Download Submit
C:\Windows\System\DMkgYoK.exe

Filesize
1.9MB

MD5
09dc84edfc3470bb704fd8c6aa53c59c

SHA1
4ed50308478330469ff626739f123418cd753377

SHA256
73552ba01b8cd488a7fba70d0b9dab84e10dd7385cf7d4518018135f845c3e6c

SHA512
793773e05af9a78d0bcf09fce5582964560276ac03a848bb35ecabd8e0ee9924b92c06e70782cadca366f388f71295cf89205fae1572dd117eceb2c532f78909

Download Submit
C:\Windows\System\HPeUrkA.exe

Filesize
1.9MB

MD5
51cd76f667b104dbbf829755d5deb194

SHA1
d5f5ae0d4d78a4e67d9840f7f7d2b0fb4dbd7cf3

SHA256
440314ba5ab666898c66a39f1400ccdd2a3160f4e85f62381898845991e8a4bd

SHA512
9972cbb622dd6f1b418ec23da120419adf7df1451b0cfdc28125025ef6a9f686758961e5197fc91dc2ce396dd2dc6ae5095e298c110c4df19cbdd95bd7162431

Download Submit
C:\Windows\System\ISpccJh.exe

Filesize
1.9MB

MD5
4cfff235599d603a4a652f16df9bff16

SHA1
5cce3b16c6083972054571ccdec76bb34d015e26

SHA256
fff39c7317ddded9a24ea0ac36d62522eb4e03032e638c9ed314125da0782284

SHA512
c37ee420c5fcd101233c40ff62a678559280965ade112acb7a7865beb9ed2333fb0498762709204ab29e705dfbc522f3f5453e1e9a8ef7817354ab9194a49323

Download Submit
C:\Windows\System\JthOCaw.exe

Filesize
1.9MB

MD5
b8b634d90cd5ddea1f123815c97b654e

SHA1
0fd87b2b21e407cc91834babf96dd013f1cae81f

SHA256
fa1078f20980d9c15ad04ea2ad686ab68827b9ad7ce464b68ca90cfe8c571cf5

SHA512
8b0c872f9d2e69afcf69923857270329866c671773218ff205afd7c897319be2ea7198f279fa1407adb1b1528709f250eaab53a9302581871523e5c6092ffc1c

Download Submit
C:\Windows\System\KMcheYP.exe

Filesize
1.9MB

MD5
a206882bbe142cec4386b89cd5927c94

SHA1
d712da8c1880ed77d74b8f344f1def85f3be7935

SHA256
dbe42f25646225e53b83aff34d175fe5fca3754bbc8c57c178a89eb74f45b3ef

SHA512
897b142976eb6d0074f0712599bb213fcdf8dc8e45f3023053b7545ec745553019ca642d3969fb558634c34bc8aa0dc2c54f32ac3f51ef72c8d0b41573438b8a

Download Submit
C:\Windows\System\KZufiSA.exe

Filesize
1.9MB

MD5
9a9b23a69e1e85d12197b958d4875b73

SHA1
323c77224b82c6cd0cc289071b73626e402cad36

SHA256
fad215873a1e7c5d06af50d3ed1fad6eee3d5f81085779d19d40f4dd2f96bb2c

SHA512
a24979c1d126af853fd8904fc85c6a27620f68566acb43c3113660e767f7e50107715d8ece7feac15a06e1ea77472a2539e298b663f059d8e10869ce917f94ba

Download Submit
C:\Windows\System\LzJLpcS.exe

Filesize
1.9MB

MD5
b6882af71ed26d4df0a9a75b97b95c63

SHA1
b051f800683d1b40b2731040b474e8b9d97db5a0

SHA256
da91bdf8f769fe2095de72d9d134facd383f8ee6f1768f660c2beec2567ea1e9

SHA512
902873c9bb25295df766997db10d644bd5dbf4b167274b0f7633fd2bfbb4a10212c2dfe05835b2dff395f9bef07635ab7088c738ad63dee855bdd00dfca559e9

Download Submit
C:\Windows\System\MZGzYuE.exe

Filesize
1.9MB

MD5
28c71b5d86c8310748ec5156061fb832

SHA1
4d322541f940b3321336d3e6403c8ac7a458264b

SHA256
601745620628c615c055dfdf7e5ae81507442c016eeb443b57209d8d15308ccb

SHA512
ce1d785a312fa85a555b36cf7bcdb77be4c186e862933658f9577c43943546250373ca7eb1f863e1a0da4bb85c491619719ad4a0c38bd2f069f2c1f13efcd073

Download Submit
C:\Windows\System\MwXAeRB.exe

Filesize
1.9MB

MD5
025f295e7617338cbb746b39dbcd6a86

SHA1
985b93f6a14870c1c5b22edca34d2340e1e327f3

SHA256
25e4dc92308860196efcf3bba5a571b0458d7a63a1a3584a428ba084a77074aa

SHA512
62c57052750cfc6079ab3087b710ec7349a032e9bf4d96f38469bd83a78c61d602a99dffaf94c9032591d4550813486130b3c86e74a8b8f79e8ad9205609890c

Download Submit
C:\Windows\System\OeQwNqP.exe

Filesize
1.9MB

MD5
a38d0d291384091cdedb8b431bbd2fea

SHA1
858d3c317f098caa0be1eafdeb149827bbbbe88a

SHA256
b9cc5664e59eedbea48462d46a65ad3172a2ec481e6c8da6f03effa42ef5749d

SHA512
90004b5e3ab66b9604e1bb022afde12919591be16d43337b21780b9e2b13f84ed434dff0d8273cb453e4f46b881d7379f89dc61ee88da404af20836fe507c73d

Download Submit
C:\Windows\System\PwziKrb.exe

Filesize
1.9MB

MD5
df3bff9bc223dbf5166b990408f4d10f

SHA1
bcf407f6f530493fa3d3c753ee6898138eaebd95

SHA256
0679e63ca55d73f1d8b184693095bfa3a937a214fcb5163954b01562a70690a4

SHA512
aff1d90381282230ac67fe522aac1a54cdd538ef2f2224fc33e791e82b48cd8bdf3896a34bfb1c58265487243b271241974134d6d9df8da1bfb5888d2940656d

Download Submit
C:\Windows\System\QpqSoIP.exe

Filesize
8B

MD5
a8f2921c80c15a3d426e5fdff8a56196

SHA1
4dc21bf95e22427a9dafcd4930e81b62e77d5fda

SHA256
7e9bbeeba45dae16f8c444596ee4180d7313e899e46fa6263fde6904f32d92a1

SHA512
996666f646b1878ee129a778184f9520541ee458797b8bfaefed6e1f152a5436e0ff19d28744463b706ffe3e24e429f5af102aa1e7733dbeeb6210754c828802

Download Submit
C:\Windows\System\TlRdmNl.exe

Filesize
1.9MB

MD5
8f4af5b31822fb2f2a5bfa4527c64517

SHA1
73aa8ca5c5d1ae93eeeae469ddc18919f833d856

SHA256
e258cceeb496dd1cf85ec10a451d7eabb20f9d5c0ea272b72e8f50db8e7eab20

SHA512
8c2bb6d498dc7a97c8a4d9663680f863ed5ad4f71f60bbe2e4da6b73df6f9a675426871df0dbcd737234263ce26ee088d4ca7cfe518880655f852d99630ebbd5

Download Submit
C:\Windows\System\WaevJSd.exe

Filesize
1.9MB

MD5
e03b8b60f7556f6adb7d8cb13dc124b1

SHA1
48948edb3f1d32de5f105fa74bb696591d07d047

SHA256
985539a47b00d985deda1dbe1b4aea9492b2c617c5d3934465eef9133833abd9

SHA512
32346ddc185190b5e19b7a604cd502fa6cb9a5b3d8268ec546cb7dbdf1e301b85e77e0bc44a26b3431e224a84ddd9302b4c87e6d56af4861e3e5fd86dc8f0c14

Download Submit
C:\Windows\System\XlcYuSk.exe

Filesize
1.9MB

MD5
17e3003578dd17febc64cc6ca5245f37

SHA1
f7e95ce835cb8f298132fcd0ef48a23e8cdd0357

SHA256
c8b6765909fd703cfe5658ae0b29813e05a92b43c489eb8a38e1243131d67758

SHA512
2a92e2af08b45a564b5e44710a31d3356297c38a11980389b99534aab01c325b72589087ccfe8c5056d07731b79271dc5e1abdc651e9563435e137af8f4e9d3f

Download Submit
C:\Windows\System\YCpowyB.exe

Filesize
1.9MB

MD5
e12e83ca2cf6ebcfa1522719596f996b

SHA1
cfd5e15f2b2b7dfc5c3ae1c23f197faa8a6f9276

SHA256
1c1097d8ec2ba5e46f89479fe43a128dd3cd00f94bb5dd6244954b2926de4f04

SHA512
3f5cca64312a8ba66a9748e6306eed894a1451f82fed19baf347f85a6cc04a723210d1aba8a390fe7ad0277cae0d520973d29de2caa439eec60000883ebe0457

Download Submit
C:\Windows\System\YHhwSnC.exe

Filesize
1.9MB

MD5
3404868905cbe6d4fe5aa5d210e2ab23

SHA1
0a7ec2070108d8ef5896f451722ba4045c1647ea

SHA256
f850144fa3416f3286548663767ae632e7372fbd61364a71e29d09f9e2e30143

SHA512
c2492a22a4912fdb863fd1dc320026022194357f90e19a44464c4b1b19c6d076b9b1459aaff0400f3bdc7659e494f77f1eca7b504ac2e49d260c4c1f7b978d33

Download Submit
C:\Windows\System\ZdDzZxH.exe

Filesize
1.9MB

MD5
e28873c925c140d08572359340397ba0

SHA1
b866334d6e0b5ca9870edf7407e9b0219cba020b

SHA256
ff9b8a376d66c5bda1c19bb395803680a0bb4ff64ab611d3ba876e7764dac63d

SHA512
2cb0466eaa969288b1d0ba643cfeb0ff84ab23eeef2adf9be8f457b33e2414db57cfbd9c1c4d5cc1e1b556708457cee85f589c6926bee9042a606bc5357d2231

Download Submit
C:\Windows\System\bsxnOng.exe

Filesize
18B

MD5
5db3df0964e5c695675f39e99d1f288b

SHA1
84b597ea47f1f6b13b223cbb576a55e47a79cfaa

SHA256
15f5f6f9d4846d3bfaf7f8740e9c849aebfecfea6fc86fee82eb18d6ec03fd9f

SHA512
f71b3480e977c4ca4affaaec3f3bd31e3598fdd986ea7bafee42b5d6a8676e69449256bbab19fc0cc61412a454871e6b79cebb0c5e3610b9e98c4f089888aa18

Download Submit
C:\Windows\System\cJzlQCz.exe

Filesize
1.9MB

MD5
e80a6f786faa9c9a9a9ce13dfa2160a1

SHA1
d121f97427665bd27b929bb8b37f6d4500b4d766

SHA256
6874bf5a3718fdc786f75d3535e41bdcc7f26bdd16bc4abd97f0012fdef4db6f

SHA512
9f1e683df2be82ce57af0abaf7e57058a80769a1f6de0eea9b61f6c67e97a13ec0146c2e40b73097a7be1ae81f8c27d89e12ef31ad2df5a0bf8bc88bcaf62017

Download Submit
C:\Windows\System\cgCIkak.exe

Filesize
1.9MB

MD5
6f3a9b61508af15d193f182945f9d9d0

SHA1
7a8fdc2e2c8b40afff91f34c79a89b65c99bf977

SHA256
8c8418c474089272256576d775855dddbb65d2a3b914bba495273683c5848567

SHA512
1e37efaf4c4a88579c3b9f08c1ed23153556cd924f6ff94a7e76146310a8c33ff74ce260005094da6339714e4e2d0d4b745525ce93d8c1c67d1562c49b12422a

Download Submit
C:\Windows\System\dpBbKyh.exe

Filesize
1.9MB

MD5
1bd0732ad8ba4d839e687435eb4538cf

SHA1
406f191366e0ed8bb13593d8a8b4c5ebda69043d

SHA256
68c3430eb59d165d36a6058533a25f924867ead64a8b7cffb588e9aa4766ef4f

SHA512
f9b6929f17f2544bf43a63f9e8ca3e7e31ba1f25a05bd83ac840be26c243a025e419572ecfe2f0ebd58b6f5277d65716e4d42b2be9c07042fd633764c4e9ec09

Download Submit
C:\Windows\System\jlCNcyG.exe

Filesize
1.9MB

MD5
10cafcf3b0906cc6bffd517d42f24e12

SHA1
eef89b898aa2ae1ab7c6145dc42f5ab660d06fd0

SHA256
ee9d2815baa7f7f8bc6da3de16f8c57c8dd7ea22293ed9cd7744cc673ea66955

SHA512
4466f49f8318af4152abed6cc037663425724f84de512140d2ea4f541e54762bb6bd17b169d63d11fdf07874d9c2336e35f8c4ff63dec9530fc1131bb1a519c8

Download Submit
C:\Windows\System\kShHpNO.exe

Filesize
1.9MB

MD5
33f8e104e752ae4ee00648785eed81e9

SHA1
b3e2bf23e253e4a3003a57e50cf75649f294505a

SHA256
e4bd2b455d8a692e295dd360202f04f85465a50929fd694f28b7c7a60eacf042

SHA512
e91174a17cecf39775b2c2cf6e1f059e544af439ab5a4674d28d1c2e4498314f30b8ec5f2338d1ff7be8a8185ae335c561f894f0f09206e663c1d624c9b02c83

Download Submit
C:\Windows\System\mPcndiJ.exe

Filesize
1.9MB

MD5
a49c453aade8449b3573397667f1b935

SHA1
c86ad4d748ff5a8b034b0b2f582a5b2508f55a33

SHA256
9483f3ef6ea6e29e9a94358aaf2b9abf27a9326b59353e29f54b802e19d11234

SHA512
67e37029476a5ce222ca2d87f3a3da7bcc75de6d07f9a7d645f04feffc123c7ec8369095001896b8ac91dc241d457720e3420edc77f1122c2e6583dffcd8f8e2

Download Submit
C:\Windows\System\mfRvaWr.exe

Filesize
1.9MB

MD5
233f7f0e91c0dfd3476fe73269e8035f

SHA1
4d832ed3868a5740d20dee379ffc56f75a8803cb

SHA256
4c2d557348ec5f47cc89162070b2a87d7778ea8c8fe322b13aa6fee88169ead6

SHA512
6be27346023b1070ba392c6811844478be352fd07f3e9f8bde688978dea7018c0aa5a30b41a69d9c5eb870642143ace9fa91b6c20f88abfe9842fa878c14f8da

Download Submit
C:\Windows\System\ndkGyYw.exe

Filesize
1.9MB

MD5
f9dd7f0da81a6e694920bab4e5453271

SHA1
f57c7d60e6177e9bb3fecb51402d599a83fe42f7

SHA256
a86b1a97feb412b53837e0a60479419d2163a57aac4676802f2654efeb0936cd

SHA512
c0bf32baaf6a389e6b924cd769a5d2e5f8bcf7552d27e29ac5a75f2000512f1baadf9c778a40da99dfda908b70e5f3ca9ac01d3f849b94c1a676d50d0bf8f9e9

Download Submit
C:\Windows\System\nemPLwq.exe

Filesize
1.9MB

MD5
0a1e9f256ee61ad04cd42f06a63135b8

SHA1
ceafd6cc5630dff3fd972761413b62511af1dcc0

SHA256
056fd1aad5c213dafebcd837db5e5590ec8f9487bc279c258aa003e573764717

SHA512
9cfb1b7e916e8b1e1ab45f21aa3d5210fff66e3a025779a82f8b6508e32ed844ca5307c005b5aa06d81e03c995e32b77fe12c6b1872ba348525c7ae6beb44966

Download Submit
C:\Windows\System\ogaCvFG.exe

Filesize
1.9MB

MD5
d8fd2fa71809d8f044374c704c0ebbf9

SHA1
9090aeba50674bc8fb1ce9f16652ac883a036444

SHA256
a4b178dee30f8ec87e67a62897ab8c34e5c5bd5d3b8a27745095792ffff45daa

SHA512
4c6fed7d34e809e24991db5b6652df65c199b054126b88f94f8990179cdc823f544e0ac97302ea1646d8b47f26765884cc009ed2dbc0a94924075cdfd453580f

Download Submit
C:\Windows\System\qvLfdLT.exe

Filesize
1.9MB

MD5
b3ee3e9a45760191b5728a5715e709f1

SHA1
bee637a73b9ceea75ae05594bf5c6decd776b8be

SHA256
41960fba566216a89ba4bf73eeae47c3fa3f76240b64441f2e825312c8e718c9

SHA512
d7097446b44fcf1efd89d2c0bc86300f99325448f01b0e6f2d33622fbbc74c08011e613c51d63b01130fafbbe281b36073bae2c965d9c134fec665435edea2a1

Download Submit
C:\Windows\System\sCwjTHp.exe

Filesize
1.9MB

MD5
536f1652bb88eb0b18439ddcd75573d2

SHA1
c832ddff0d1c398dd3f8472c2efa9f14f2783958

SHA256
3185cf09a015010d4ab5a5c64c27f334b0fead1d2c80a9791caa931c9e4ab0bd

SHA512
0f13ddcd2257a59200644e1d775160b8cd03d8b4a7b24ff2b86dd24391222a0d40346fa35af4aa6572a395d1645e230ab1343abaf209660f6405f243bec63bb5

Download Submit
C:\Windows\System\tHxpVSZ.exe

Filesize
1.9MB

MD5
38e2a319ea4ebb8bb842444e5ef75dd9

SHA1
3645e9b28e653bd91de2491b9839cdb9f1fcaf58

SHA256
f0650a8e7c64cc2a764d769788e2f6a48e940ffd6015d9da098f371beac87767

SHA512
94e50d20e657f8839e9adabc7be94d2279f25b6a6adfc450e01cff07d05065f7a8cbf12f74882921db884872b3aa9d417ff66b47b3c1ef8705a4dd4032275ce2

Download Submit
C:\Windows\System\vCCdIVL.exe

Filesize
1.9MB

MD5
80fb11952218c1e9e1ce94508f7fd6c7

SHA1
aff49913907c7ce19ae33b085c7df7d8660a3c04

SHA256
81a158a8b7ebfb6c644ea7b78642e53a15d21f9714547654e12617d2994c9518

SHA512
21326fb5b41c5a02d28190cc146d13f3e52f6b0a157c76eb2b981a6db06723f4b5b83c40dea5f981da6571eebac2af460193aa32e1c7fe261be56f2082e10580

Download Submit
C:\Windows\System\zEKItWF.exe

Filesize
1.9MB

MD5
cfbfb9c5d6c68061f81683860e7263aa

SHA1
d4276bee8c95b07376fa225cb2ef062810c11512

SHA256
230d7f4ecb7b002561319fbe2377ec7585b45edafac4f011b459fb4d931a832b

SHA512
f4588dbe55a0f82e367e364129a5f6ee4fe592c1243388e0e2fe1563a59c75b97ac661f000cf881b70ccad05bdff850fa9dce702570ba129bea81e8b8f17032f

Download Submit
memory/368-543-0x00007FF7B1170000-0x00007FF7B1562000-memory.dmp

Filesize
3.9MB

Download
memory/432-27-0x00007FF623710000-0x00007FF623B02000-memory.dmp

Filesize
3.9MB

Download
memory/436-576-0x00007FF744930000-0x00007FF744D22000-memory.dmp

Filesize
3.9MB

Download
memory/436-6951-0x00007FF744930000-0x00007FF744D22000-memory.dmp

Filesize
3.9MB

Download
memory/1028-66-0x00007FF6A3790000-0x00007FF6A3B82000-memory.dmp

Filesize
3.9MB

Download
memory/1028-5904-0x00007FF6A3790000-0x00007FF6A3B82000-memory.dmp

Filesize
3.9MB

Download
memory/1164-53-0x00007FF7A5D80000-0x00007FF7A6172000-memory.dmp

Filesize
3.9MB

Download
memory/1364-6953-0x00007FF6A9B80000-0x00007FF6A9F72000-memory.dmp

Filesize
3.9MB

Download
memory/1364-579-0x00007FF6A9B80000-0x00007FF6A9F72000-memory.dmp

Filesize
3.9MB

Download
memory/1800-6947-0x00007FF6D5460000-0x00007FF6D5852000-memory.dmp

Filesize
3.9MB

Download
memory/1800-571-0x00007FF6D5460000-0x00007FF6D5852000-memory.dmp

Filesize
3.9MB

Download
memory/1852-556-0x00007FF7A2630000-0x00007FF7A2A22000-memory.dmp

Filesize
3.9MB

Download
memory/2004-523-0x00007FF6AFD90000-0x00007FF6B0182000-memory.dmp

Filesize
3.9MB

Download
memory/2028-6930-0x00007FF6580B0000-0x00007FF6584A2000-memory.dmp

Filesize
3.9MB

Download
memory/2028-59-0x00007FF6580B0000-0x00007FF6584A2000-memory.dmp

Filesize
3.9MB

Download
memory/2272-104-0x000001F6B4A00000-0x000001F6B4A22000-memory.dmp

Filesize
136KB

Download
memory/2328-52-0x00007FF62D3E0000-0x00007FF62D7D2000-memory.dmp

Filesize
3.9MB

Download
memory/2480-517-0x00007FF708F10000-0x00007FF709302000-memory.dmp

Filesize
3.9MB

Download
memory/2492-6920-0x00007FF71A330000-0x00007FF71A722000-memory.dmp

Filesize
3.9MB

Download
memory/2492-42-0x00007FF71A330000-0x00007FF71A722000-memory.dmp

Filesize
3.9MB

Download
memory/2500-0-0x00007FF76D910000-0x00007FF76DD02000-memory.dmp

Filesize
3.9MB

Download
memory/2500-1-0x000001EB36F70000-0x000001EB36F80000-memory.dmp

Filesize
64KB

Download
memory/2772-6939-0x00007FF663B40000-0x00007FF663F32000-memory.dmp

Filesize
3.9MB

Download
memory/2772-512-0x00007FF663B40000-0x00007FF663F32000-memory.dmp

Filesize
3.9MB

Download
memory/2984-6934-0x00007FF72A5E0000-0x00007FF72A9D2000-memory.dmp

Filesize
3.9MB

Download
memory/2984-541-0x00007FF72A5E0000-0x00007FF72A9D2000-memory.dmp

Filesize
3.9MB

Download
memory/3192-64-0x00007FF6D1C60000-0x00007FF6D2052000-memory.dmp

Filesize
3.9MB

Download
memory/3384-513-0x00007FF638770000-0x00007FF638B62000-memory.dmp

Filesize
3.9MB

Download
memory/3612-550-0x00007FF78E160000-0x00007FF78E552000-memory.dmp

Filesize
3.9MB

Download
memory/3668-41-0x00007FF787A20000-0x00007FF787E12000-memory.dmp

Filesize
3.9MB

Download
memory/3984-34-0x00007FF61F500000-0x00007FF61F8F2000-memory.dmp

Filesize
3.9MB

Download
memory/3984-6917-0x00007FF61F500000-0x00007FF61F8F2000-memory.dmp

Filesize
3.9MB

Download
memory/4516-527-0x00007FF7721A0000-0x00007FF772592000-memory.dmp

Filesize
3.9MB

Download
memory/4592-21-0x00007FF7B8F30000-0x00007FF7B9322000-memory.dmp

Filesize
3.9MB

Download
memory/4592-6901-0x00007FF7B8F30000-0x00007FF7B9322000-memory.dmp

Filesize
3.9MB

Download
memory/4660-526-0x00007FF6A9320000-0x00007FF6A9712000-memory.dmp

Filesize
3.9MB

Download
memory/4968-48-0x00007FF7B3150000-0x00007FF7B3542000-memory.dmp

Filesize
3.9MB

Download