xmrig | a2becd02be1bbe62d9877a89312ac2fe79b03370c623d93a120647eb85161540

Analysis

max time kernel
66s
max time network
64s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
26-04-2024 13:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
Size

1.9MB
MD5

00e907fe20a6967ddda75289543b174b
SHA1

def58e89abab32b5ca32058e6b94f7b26cdcd12b
SHA256

a2becd02be1bbe62d9877a89312ac2fe79b03370c623d93a120647eb85161540
SHA512

3f83f96f2689196ab84dfede160813139161a5a8421abd1a3e8f3d68b8c50c4dedb45603aef9dda5bff43cd4c0ef5dc4145184d3fa3c6d65b11974a50fb01977
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p/pOVXf:NABQ

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 42 IoCs

miner

resource	yara_rule
behavioral2/memory/3716-346-0x00007FF71CD60000-0x00007FF71D152000-memory.dmp	xmrig
behavioral2/memory/2424-372-0x00007FF6365D0000-0x00007FF6369C2000-memory.dmp	xmrig
behavioral2/memory/4396-379-0x00007FF608CB0000-0x00007FF6090A2000-memory.dmp	xmrig
behavioral2/memory/2316-378-0x00007FF77F540000-0x00007FF77F932000-memory.dmp	xmrig
behavioral2/memory/2672-377-0x00007FF6D0F50000-0x00007FF6D1342000-memory.dmp	xmrig
behavioral2/memory/1524-376-0x00007FF733910000-0x00007FF733D02000-memory.dmp	xmrig
behavioral2/memory/3184-375-0x00007FF69BE60000-0x00007FF69C252000-memory.dmp	xmrig
behavioral2/memory/4368-374-0x00007FF77AA40000-0x00007FF77AE32000-memory.dmp	xmrig
behavioral2/memory/2888-373-0x00007FF67ADE0000-0x00007FF67B1D2000-memory.dmp	xmrig
behavioral2/memory/332-371-0x00007FF6F8B00000-0x00007FF6F8EF2000-memory.dmp	xmrig
behavioral2/memory/3344-321-0x00007FF66A8E0000-0x00007FF66ACD2000-memory.dmp	xmrig
behavioral2/memory/2296-269-0x00007FF6BA9F0000-0x00007FF6BADE2000-memory.dmp	xmrig
behavioral2/memory/2960-264-0x00007FF6D0E60000-0x00007FF6D1252000-memory.dmp	xmrig
behavioral2/memory/1720-249-0x00007FF6B0900000-0x00007FF6B0CF2000-memory.dmp	xmrig
behavioral2/memory/2528-238-0x00007FF716D50000-0x00007FF717142000-memory.dmp	xmrig
behavioral2/memory/3484-211-0x00007FF769CA0000-0x00007FF76A092000-memory.dmp	xmrig
behavioral2/memory/1580-167-0x00007FF781940000-0x00007FF781D32000-memory.dmp	xmrig
behavioral2/memory/2736-164-0x00007FF6AB570000-0x00007FF6AB962000-memory.dmp	xmrig
behavioral2/memory/1812-123-0x00007FF73B5B0000-0x00007FF73B9A2000-memory.dmp	xmrig
behavioral2/memory/4028-97-0x00007FF74AF30000-0x00007FF74B322000-memory.dmp	xmrig
behavioral2/memory/3968-72-0x00007FF6E50B0000-0x00007FF6E54A2000-memory.dmp	xmrig
behavioral2/memory/1524-2949-0x00007FF733910000-0x00007FF733D02000-memory.dmp	xmrig
behavioral2/memory/3968-2953-0x00007FF6E50B0000-0x00007FF6E54A2000-memory.dmp	xmrig
behavioral2/memory/4028-2952-0x00007FF74AF30000-0x00007FF74B322000-memory.dmp	xmrig
behavioral2/memory/2672-2955-0x00007FF6D0F50000-0x00007FF6D1342000-memory.dmp	xmrig
behavioral2/memory/1812-2963-0x00007FF73B5B0000-0x00007FF73B9A2000-memory.dmp	xmrig
behavioral2/memory/1580-2962-0x00007FF781940000-0x00007FF781D32000-memory.dmp	xmrig
behavioral2/memory/2736-2959-0x00007FF6AB570000-0x00007FF6AB962000-memory.dmp	xmrig
behavioral2/memory/3484-2958-0x00007FF769CA0000-0x00007FF76A092000-memory.dmp	xmrig
behavioral2/memory/2296-2979-0x00007FF6BA9F0000-0x00007FF6BADE2000-memory.dmp	xmrig
behavioral2/memory/2960-2988-0x00007FF6D0E60000-0x00007FF6D1252000-memory.dmp	xmrig
behavioral2/memory/2528-2987-0x00007FF716D50000-0x00007FF717142000-memory.dmp	xmrig
behavioral2/memory/3344-2983-0x00007FF66A8E0000-0x00007FF66ACD2000-memory.dmp	xmrig
behavioral2/memory/1720-2982-0x00007FF6B0900000-0x00007FF6B0CF2000-memory.dmp	xmrig
behavioral2/memory/2316-2978-0x00007FF77F540000-0x00007FF77F932000-memory.dmp	xmrig
behavioral2/memory/3716-2975-0x00007FF71CD60000-0x00007FF71D152000-memory.dmp	xmrig
behavioral2/memory/332-2974-0x00007FF6F8B00000-0x00007FF6F8EF2000-memory.dmp	xmrig
behavioral2/memory/2424-2971-0x00007FF6365D0000-0x00007FF6369C2000-memory.dmp	xmrig
behavioral2/memory/2888-2967-0x00007FF67ADE0000-0x00007FF67B1D2000-memory.dmp	xmrig
behavioral2/memory/3184-2966-0x00007FF69BE60000-0x00007FF69C252000-memory.dmp	xmrig
behavioral2/memory/4396-2970-0x00007FF608CB0000-0x00007FF6090A2000-memory.dmp	xmrig
behavioral2/memory/4368-3035-0x00007FF77AA40000-0x00007FF77AE32000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1524	jwbjpNX.exe
2672	ugcLTDy.exe
3968	ceGBzvz.exe
4028	OaVVzHf.exe
1812	uhFRPOP.exe
2736	XyAkiAH.exe
1580	XMXcgdG.exe
3484	NWchFyd.exe
2528	llyYosK.exe
1720	nVrJKHP.exe
2960	gOMaqut.exe
2296	rogHeUz.exe
3344	lhxTyTO.exe
2316	KZsYXYd.exe
3716	JRehrqi.exe
332	oERHAvZ.exe
2424	XXVjcVV.exe
2888	rErySEd.exe
4396	HFYsQku.exe
4368	ZuUGRLG.exe
3184	grSoOKy.exe
3316	teFWAYb.exe
3664	PCkkgWC.exe
4376	IjYtTVS.exe
4308	kSZUHAN.exe
3604	tLDHRpW.exe
2312	bxcbtPm.exe
1508	TOLhtph.exe
5072	etRKqVS.exe
4656	dKloBBR.exe
3644	ysuWQIC.exe
5060	EPdKPXx.exe
4560	osnvuXB.exe
4552	CiSUwCO.exe
4644	PWmcexS.exe
1312	IyiCarU.exe
3924	PPRABGK.exe
1660	KpKUZkC.exe
4496	zWuWNkC.exe
1084	npwsBMx.exe
404	zXIYBgO.exe
2404	QwMzmBJ.exe
4184	ksNkTYr.exe
1100	hTUjVGg.exe
4424	jlmbedN.exe
4004	FjnHyql.exe
3172	JjfMLvm.exe
3724	wzKdeJW.exe
4508	YgQBwFz.exe
1164	KrSwAXo.exe
1012	ypNoYqo.exe
1192	saUMCZc.exe
2628	EHKMvCN.exe
3256	GdMJyxh.exe
3236	BfllQrr.exe
2064	fgXRojS.exe
3560	CYujfKM.exe
4540	LdookTL.exe
4092	srrUELI.exe
3036	nysdrfh.exe
376	ZaGgcKC.exe
1688	cIuLzLp.exe
2200	SpeSUne.exe
4476	lmlgzKW.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/640-0-0x00007FF796300000-0x00007FF7966F2000-memory.dmp	upx
behavioral2/files/0x000c000000023b52-5.dat	upx
behavioral2/files/0x000a000000023bb0-8.dat	upx
behavioral2/files/0x000b000000023baf-12.dat	upx
behavioral2/files/0x000a000000023bb5-34.dat	upx
behavioral2/files/0x0031000000023bb6-44.dat	upx
behavioral2/files/0x000a000000023bbc-78.dat	upx
behavioral2/files/0x000a000000023bba-105.dat	upx
behavioral2/files/0x000a000000023bcb-134.dat	upx
behavioral2/files/0x000a000000023bd1-178.dat	upx
behavioral2/memory/3716-346-0x00007FF71CD60000-0x00007FF71D152000-memory.dmp	upx
behavioral2/memory/2424-372-0x00007FF6365D0000-0x00007FF6369C2000-memory.dmp	upx
behavioral2/memory/4396-379-0x00007FF608CB0000-0x00007FF6090A2000-memory.dmp	upx
behavioral2/memory/2316-378-0x00007FF77F540000-0x00007FF77F932000-memory.dmp	upx
behavioral2/memory/2672-377-0x00007FF6D0F50000-0x00007FF6D1342000-memory.dmp	upx
behavioral2/memory/1524-376-0x00007FF733910000-0x00007FF733D02000-memory.dmp	upx
behavioral2/memory/3184-375-0x00007FF69BE60000-0x00007FF69C252000-memory.dmp	upx
behavioral2/memory/4368-374-0x00007FF77AA40000-0x00007FF77AE32000-memory.dmp	upx
behavioral2/memory/2888-373-0x00007FF67ADE0000-0x00007FF67B1D2000-memory.dmp	upx
behavioral2/memory/332-371-0x00007FF6F8B00000-0x00007FF6F8EF2000-memory.dmp	upx
behavioral2/memory/3344-321-0x00007FF66A8E0000-0x00007FF66ACD2000-memory.dmp	upx
behavioral2/memory/2296-269-0x00007FF6BA9F0000-0x00007FF6BADE2000-memory.dmp	upx
behavioral2/memory/2960-264-0x00007FF6D0E60000-0x00007FF6D1252000-memory.dmp	upx
behavioral2/memory/1720-249-0x00007FF6B0900000-0x00007FF6B0CF2000-memory.dmp	upx
behavioral2/memory/2528-238-0x00007FF716D50000-0x00007FF717142000-memory.dmp	upx
behavioral2/memory/3484-211-0x00007FF769CA0000-0x00007FF76A092000-memory.dmp	upx
behavioral2/files/0x000a000000023bd7-208.dat	upx
behavioral2/files/0x000a000000023bd6-203.dat	upx
behavioral2/files/0x000a000000023bc7-192.dat	upx
behavioral2/files/0x000a000000023bc0-188.dat	upx
behavioral2/files/0x000a000000023bc4-185.dat	upx
behavioral2/files/0x000a000000023bd3-182.dat	upx
behavioral2/files/0x000a000000023bd2-181.dat	upx
behavioral2/files/0x000a000000023bc3-175.dat	upx
behavioral2/files/0x000a000000023bd0-174.dat	upx
behavioral2/files/0x000a000000023bc1-168.dat	upx
behavioral2/memory/1580-167-0x00007FF781940000-0x00007FF781D32000-memory.dmp	upx
behavioral2/memory/2736-164-0x00007FF6AB570000-0x00007FF6AB962000-memory.dmp	upx
behavioral2/files/0x000a000000023bcf-163.dat	upx
behavioral2/files/0x000a000000023bce-162.dat	upx
behavioral2/files/0x000a000000023bc8-161.dat	upx
behavioral2/files/0x000a000000023bcd-160.dat	upx
behavioral2/files/0x000a000000023bc5-159.dat	upx
behavioral2/files/0x000a000000023bbb-141.dat	upx
behavioral2/files/0x000a000000023bbe-137.dat	upx
behavioral2/files/0x000a000000023bbd-135.dat	upx
behavioral2/files/0x000a000000023bca-133.dat	upx
behavioral2/files/0x000a000000023bc2-130.dat	upx
behavioral2/files/0x000a000000023bc9-129.dat	upx
behavioral2/memory/1812-123-0x00007FF73B5B0000-0x00007FF73B9A2000-memory.dmp	upx
behavioral2/files/0x000a000000023bc6-117.dat	upx
behavioral2/files/0x000a000000023bbf-116.dat	upx
behavioral2/files/0x000a000000023bcc-158.dat	upx
behavioral2/files/0x000a000000023bb9-102.dat	upx
behavioral2/files/0x0031000000023bb8-125.dat	upx
behavioral2/memory/4028-97-0x00007FF74AF30000-0x00007FF74B322000-memory.dmp	upx
behavioral2/files/0x0031000000023bb7-84.dat	upx
behavioral2/memory/3968-72-0x00007FF6E50B0000-0x00007FF6E54A2000-memory.dmp	upx
behavioral2/files/0x000a000000023bb4-50.dat	upx
behavioral2/files/0x000a000000023bb2-45.dat	upx
behavioral2/files/0x000a000000023bb3-37.dat	upx
behavioral2/files/0x000a000000023bb1-22.dat	upx
behavioral2/memory/1524-2949-0x00007FF733910000-0x00007FF733D02000-memory.dmp	upx
behavioral2/memory/3968-2953-0x00007FF6E50B0000-0x00007FF6E54A2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\XmSjjNM.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\dKloBBR.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\IgtWmBh.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\nSYAdmZ.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\njxoBSb.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\VMNfwFv.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\IbqlWSz.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\IXPzFpI.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\nRCthRq.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\YGSlTIv.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\xyQmYGS.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\MiWySJp.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\vrnqyOq.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\yZwNBbJ.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\LxwhVcC.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\oOrzBat.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\oPHFtfU.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\oPCWGfn.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\NCBUene.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\qvznMVZ.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\rNmPAhe.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\oPMMiXr.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\DvWesdJ.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\jxjCTOW.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\QzQBITY.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\IyiCarU.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\KrSwAXo.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\rJMvIrr.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\ZomiXeM.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\EOuvfzZ.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\oMHAONv.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\ssIqwsl.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\DLzdFXY.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\dZlQueV.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\mgPxIDc.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\nUuuran.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\MclUAog.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\EINQvdv.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\LPNRQck.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\tyznCkX.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\jKHOaDZ.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\HPovXuz.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\pDIoAzI.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\pklKXZa.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\FlwtgGK.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\IYAjweZ.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\qUSVvhc.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\bwOkPEs.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\NUoBoQo.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\rogHeUz.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\iJUgEaa.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\EwtvIJH.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\TyeUlhF.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\nzpdGdb.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\kHJbfPV.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\ylyyqYK.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\KShHeVF.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\BSZkTrD.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\nvBetsN.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\vUaZxWa.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\wZJbyAu.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\ZrzatIT.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\FrCtHzb.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
File created	C:\Windows\System\LYfsdlw.exe	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2344	powershell.exe
2344	powershell.exe
2344	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
Token: SeDebugPrivilege	2344	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 2344	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	83
PID 640 wrote to memory of 2344	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	83
PID 640 wrote to memory of 1524	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	84
PID 640 wrote to memory of 1524	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	84
PID 640 wrote to memory of 2672	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	85
PID 640 wrote to memory of 2672	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	85
PID 640 wrote to memory of 3968	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	86
PID 640 wrote to memory of 3968	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	86
PID 640 wrote to memory of 4028	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	87
PID 640 wrote to memory of 4028	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	87
PID 640 wrote to memory of 1812	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	88
PID 640 wrote to memory of 1812	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	88
PID 640 wrote to memory of 2736	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	89
PID 640 wrote to memory of 2736	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	89
PID 640 wrote to memory of 1580	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	90
PID 640 wrote to memory of 1580	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	90
PID 640 wrote to memory of 3484	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	91
PID 640 wrote to memory of 3484	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	91
PID 640 wrote to memory of 2528	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	92
PID 640 wrote to memory of 2528	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	92
PID 640 wrote to memory of 1720	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	93
PID 640 wrote to memory of 1720	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	93
PID 640 wrote to memory of 2960	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	94
PID 640 wrote to memory of 2960	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	94
PID 640 wrote to memory of 2296	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	95
PID 640 wrote to memory of 2296	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	95
PID 640 wrote to memory of 3344	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	96
PID 640 wrote to memory of 3344	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	96
PID 640 wrote to memory of 2424	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	97
PID 640 wrote to memory of 2424	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	97
PID 640 wrote to memory of 2316	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	98
PID 640 wrote to memory of 2316	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	98
PID 640 wrote to memory of 3716	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	99
PID 640 wrote to memory of 3716	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	99
PID 640 wrote to memory of 332	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	100
PID 640 wrote to memory of 332	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	100
PID 640 wrote to memory of 3664	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	101
PID 640 wrote to memory of 3664	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	101
PID 640 wrote to memory of 2888	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	102
PID 640 wrote to memory of 2888	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	102
PID 640 wrote to memory of 4396	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	103
PID 640 wrote to memory of 4396	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	103
PID 640 wrote to memory of 2312	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	104
PID 640 wrote to memory of 2312	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	104
PID 640 wrote to memory of 4368	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	105
PID 640 wrote to memory of 4368	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	105
PID 640 wrote to memory of 3184	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	106
PID 640 wrote to memory of 3184	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	106
PID 640 wrote to memory of 3316	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	107
PID 640 wrote to memory of 3316	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	107
PID 640 wrote to memory of 4376	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	108
PID 640 wrote to memory of 4376	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	108
PID 640 wrote to memory of 4308	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	109
PID 640 wrote to memory of 4308	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	109
PID 640 wrote to memory of 5060	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	110
PID 640 wrote to memory of 5060	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	110
PID 640 wrote to memory of 3604	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	111
PID 640 wrote to memory of 3604	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	111
PID 640 wrote to memory of 1508	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	112
PID 640 wrote to memory of 1508	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	112
PID 640 wrote to memory of 5072	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	113
PID 640 wrote to memory of 5072	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	113
PID 640 wrote to memory of 4656	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	114
PID 640 wrote to memory of 4656	640	00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe	114

C:\Users\Admin\AppData\Local\Temp\00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\00e907fe20a6967ddda75289543b174b_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2344
- C:\Windows\System\jwbjpNX.exe
  C:\Windows\System\jwbjpNX.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\ugcLTDy.exe
  C:\Windows\System\ugcLTDy.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\ceGBzvz.exe
  C:\Windows\System\ceGBzvz.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\OaVVzHf.exe
  C:\Windows\System\OaVVzHf.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\uhFRPOP.exe
  C:\Windows\System\uhFRPOP.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\XyAkiAH.exe
  C:\Windows\System\XyAkiAH.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\XMXcgdG.exe
  C:\Windows\System\XMXcgdG.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\NWchFyd.exe
  C:\Windows\System\NWchFyd.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\llyYosK.exe
  C:\Windows\System\llyYosK.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\nVrJKHP.exe
  C:\Windows\System\nVrJKHP.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\gOMaqut.exe
  C:\Windows\System\gOMaqut.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\rogHeUz.exe
  C:\Windows\System\rogHeUz.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\lhxTyTO.exe
  C:\Windows\System\lhxTyTO.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System\XXVjcVV.exe
  C:\Windows\System\XXVjcVV.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\KZsYXYd.exe
  C:\Windows\System\KZsYXYd.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\JRehrqi.exe
  C:\Windows\System\JRehrqi.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System\oERHAvZ.exe
  C:\Windows\System\oERHAvZ.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\PCkkgWC.exe
  C:\Windows\System\PCkkgWC.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\rErySEd.exe
  C:\Windows\System\rErySEd.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\HFYsQku.exe
  C:\Windows\System\HFYsQku.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\bxcbtPm.exe
  C:\Windows\System\bxcbtPm.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\ZuUGRLG.exe
  C:\Windows\System\ZuUGRLG.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\grSoOKy.exe
  C:\Windows\System\grSoOKy.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\teFWAYb.exe
  C:\Windows\System\teFWAYb.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System\IjYtTVS.exe
  C:\Windows\System\IjYtTVS.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\kSZUHAN.exe
  C:\Windows\System\kSZUHAN.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\EPdKPXx.exe
  C:\Windows\System\EPdKPXx.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\tLDHRpW.exe
  C:\Windows\System\tLDHRpW.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\TOLhtph.exe
  C:\Windows\System\TOLhtph.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\etRKqVS.exe
  C:\Windows\System\etRKqVS.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\dKloBBR.exe
  C:\Windows\System\dKloBBR.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\ysuWQIC.exe
  C:\Windows\System\ysuWQIC.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\osnvuXB.exe
  C:\Windows\System\osnvuXB.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\CiSUwCO.exe
  C:\Windows\System\CiSUwCO.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\PWmcexS.exe
  C:\Windows\System\PWmcexS.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\IyiCarU.exe
  C:\Windows\System\IyiCarU.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\PPRABGK.exe
  C:\Windows\System\PPRABGK.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\KpKUZkC.exe
  C:\Windows\System\KpKUZkC.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\zWuWNkC.exe
  C:\Windows\System\zWuWNkC.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\npwsBMx.exe
  C:\Windows\System\npwsBMx.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\zXIYBgO.exe
  C:\Windows\System\zXIYBgO.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\QwMzmBJ.exe
  C:\Windows\System\QwMzmBJ.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\ksNkTYr.exe
  C:\Windows\System\ksNkTYr.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\hTUjVGg.exe
  C:\Windows\System\hTUjVGg.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\jlmbedN.exe
  C:\Windows\System\jlmbedN.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\FjnHyql.exe
  C:\Windows\System\FjnHyql.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\JjfMLvm.exe
  C:\Windows\System\JjfMLvm.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\wzKdeJW.exe
  C:\Windows\System\wzKdeJW.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\YgQBwFz.exe
  C:\Windows\System\YgQBwFz.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\KrSwAXo.exe
  C:\Windows\System\KrSwAXo.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\ypNoYqo.exe
  C:\Windows\System\ypNoYqo.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\saUMCZc.exe
  C:\Windows\System\saUMCZc.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\EHKMvCN.exe
  C:\Windows\System\EHKMvCN.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\nysdrfh.exe
  C:\Windows\System\nysdrfh.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\ZaGgcKC.exe
  C:\Windows\System\ZaGgcKC.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\GdMJyxh.exe
  C:\Windows\System\GdMJyxh.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\BfllQrr.exe
  C:\Windows\System\BfllQrr.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\cIuLzLp.exe
  C:\Windows\System\cIuLzLp.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\fgXRojS.exe
  C:\Windows\System\fgXRojS.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\CYujfKM.exe
  C:\Windows\System\CYujfKM.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\LdookTL.exe
  C:\Windows\System\LdookTL.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\srrUELI.exe
  C:\Windows\System\srrUELI.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\SpeSUne.exe
  C:\Windows\System\SpeSUne.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\lmlgzKW.exe
  C:\Windows\System\lmlgzKW.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\EWhcpFl.exe
  C:\Windows\System\EWhcpFl.exe
  2⤵
  PID:4136
- C:\Windows\System\BkmIEbE.exe
  C:\Windows\System\BkmIEbE.exe
  2⤵
  PID:5116
- C:\Windows\System\tXRSjeA.exe
  C:\Windows\System\tXRSjeA.exe
  2⤵
  PID:2828
- C:\Windows\System\fAtYroW.exe
  C:\Windows\System\fAtYroW.exe
  2⤵
  PID:3780
- C:\Windows\System\FRxMgVj.exe
  C:\Windows\System\FRxMgVj.exe
  2⤵
  PID:1196
- C:\Windows\System\YGSlTIv.exe
  C:\Windows\System\YGSlTIv.exe
  2⤵
  PID:744
- C:\Windows\System\sdmMLrX.exe
  C:\Windows\System\sdmMLrX.exe
  2⤵
  PID:2852
- C:\Windows\System\hTTdlXc.exe
  C:\Windows\System\hTTdlXc.exe
  2⤵
  PID:4224
- C:\Windows\System\YIwdulK.exe
  C:\Windows\System\YIwdulK.exe
  2⤵
  PID:2044
- C:\Windows\System\EZPcqDB.exe
  C:\Windows\System\EZPcqDB.exe
  2⤵
  PID:3692
- C:\Windows\System\RrioKYH.exe
  C:\Windows\System\RrioKYH.exe
  2⤵
  PID:2648
- C:\Windows\System\DDZjmhh.exe
  C:\Windows\System\DDZjmhh.exe
  2⤵
  PID:3228
- C:\Windows\System\HFgXijX.exe
  C:\Windows\System\HFgXijX.exe
  2⤵
  PID:3456
- C:\Windows\System\RHCALRq.exe
  C:\Windows\System\RHCALRq.exe
  2⤵
  PID:1152
- C:\Windows\System\wyZiLAW.exe
  C:\Windows\System\wyZiLAW.exe
  2⤵
  PID:4692
- C:\Windows\System\qkhZkIt.exe
  C:\Windows\System\qkhZkIt.exe
  2⤵
  PID:1760
- C:\Windows\System\MlyRANJ.exe
  C:\Windows\System\MlyRANJ.exe
  2⤵
  PID:4664
- C:\Windows\System\JwYRlej.exe
  C:\Windows\System\JwYRlej.exe
  2⤵
  PID:5124
- C:\Windows\System\SNyowNj.exe
  C:\Windows\System\SNyowNj.exe
  2⤵
  PID:5140
- C:\Windows\System\tscDZVO.exe
  C:\Windows\System\tscDZVO.exe
  2⤵
  PID:5168
- C:\Windows\System\EWCmNhY.exe
  C:\Windows\System\EWCmNhY.exe
  2⤵
  PID:5188
- C:\Windows\System\RhcdZKo.exe
  C:\Windows\System\RhcdZKo.exe
  2⤵
  PID:5204
- C:\Windows\System\JoRCiPT.exe
  C:\Windows\System\JoRCiPT.exe
  2⤵
  PID:5252
- C:\Windows\System\UFuPQFG.exe
  C:\Windows\System\UFuPQFG.exe
  2⤵
  PID:5276
- C:\Windows\System\XFONSpV.exe
  C:\Windows\System\XFONSpV.exe
  2⤵
  PID:5300
- C:\Windows\System\KdQIshP.exe
  C:\Windows\System\KdQIshP.exe
  2⤵
  PID:5316
- C:\Windows\System\qTfxNHb.exe
  C:\Windows\System\qTfxNHb.exe
  2⤵
  PID:5336
- C:\Windows\System\SqjZUhQ.exe
  C:\Windows\System\SqjZUhQ.exe
  2⤵
  PID:5356
- C:\Windows\System\QoVJkeB.exe
  C:\Windows\System\QoVJkeB.exe
  2⤵
  PID:5380
- C:\Windows\System\UydyFcz.exe
  C:\Windows\System\UydyFcz.exe
  2⤵
  PID:5404
- C:\Windows\System\luUEoXN.exe
  C:\Windows\System\luUEoXN.exe
  2⤵
  PID:5428
- C:\Windows\System\KQglFuD.exe
  C:\Windows\System\KQglFuD.exe
  2⤵
  PID:5468
- C:\Windows\System\NSodvJz.exe
  C:\Windows\System\NSodvJz.exe
  2⤵
  PID:5484
- C:\Windows\System\WforrYo.exe
  C:\Windows\System\WforrYo.exe
  2⤵
  PID:5500
- C:\Windows\System\ZlwPEzT.exe
  C:\Windows\System\ZlwPEzT.exe
  2⤵
  PID:5520
- C:\Windows\System\IBonmNC.exe
  C:\Windows\System\IBonmNC.exe
  2⤵
  PID:5536
- C:\Windows\System\QnafdVh.exe
  C:\Windows\System\QnafdVh.exe
  2⤵
  PID:5560
- C:\Windows\System\cmmbneN.exe
  C:\Windows\System\cmmbneN.exe
  2⤵
  PID:5576
- C:\Windows\System\GpiJTud.exe
  C:\Windows\System\GpiJTud.exe
  2⤵
  PID:5592
- C:\Windows\System\zExXOfQ.exe
  C:\Windows\System\zExXOfQ.exe
  2⤵
  PID:5612
- C:\Windows\System\kITUrwM.exe
  C:\Windows\System\kITUrwM.exe
  2⤵
  PID:5628
- C:\Windows\System\IgtWmBh.exe
  C:\Windows\System\IgtWmBh.exe
  2⤵
  PID:5644
- C:\Windows\System\HRsSsXA.exe
  C:\Windows\System\HRsSsXA.exe
  2⤵
  PID:5712
- C:\Windows\System\bAuWkHf.exe
  C:\Windows\System\bAuWkHf.exe
  2⤵
  PID:5864
- C:\Windows\System\JmolIYa.exe
  C:\Windows\System\JmolIYa.exe
  2⤵
  PID:5880
- C:\Windows\System\RagXbSP.exe
  C:\Windows\System\RagXbSP.exe
  2⤵
  PID:5900
- C:\Windows\System\awyDYRG.exe
  C:\Windows\System\awyDYRG.exe
  2⤵
  PID:5916
- C:\Windows\System\cWDFzAD.exe
  C:\Windows\System\cWDFzAD.exe
  2⤵
  PID:6044
- C:\Windows\System\TinMkkb.exe
  C:\Windows\System\TinMkkb.exe
  2⤵
  PID:6064
- C:\Windows\System\haazrqm.exe
  C:\Windows\System\haazrqm.exe
  2⤵
  PID:6080
- C:\Windows\System\qgwtUSW.exe
  C:\Windows\System\qgwtUSW.exe
  2⤵
  PID:6096
- C:\Windows\System\NyLAccD.exe
  C:\Windows\System\NyLAccD.exe
  2⤵
  PID:6112
- C:\Windows\System\cgdHisW.exe
  C:\Windows\System\cgdHisW.exe
  2⤵
  PID:6132
- C:\Windows\System\PxrlUvX.exe
  C:\Windows\System\PxrlUvX.exe
  2⤵
  PID:1992
- C:\Windows\System\nGlFHGE.exe
  C:\Windows\System\nGlFHGE.exe
  2⤵
  PID:2040
- C:\Windows\System\xlposgI.exe
  C:\Windows\System\xlposgI.exe
  2⤵
  PID:3832
- C:\Windows\System\mNfEOik.exe
  C:\Windows\System\mNfEOik.exe
  2⤵
  PID:2460
- C:\Windows\System\sfTTnFu.exe
  C:\Windows\System\sfTTnFu.exe
  2⤵
  PID:916
- C:\Windows\System\IUOYtbz.exe
  C:\Windows\System\IUOYtbz.exe
  2⤵
  PID:4348
- C:\Windows\System\sCDglun.exe
  C:\Windows\System\sCDglun.exe
  2⤵
  PID:3612
- C:\Windows\System\xwlimWr.exe
  C:\Windows\System\xwlimWr.exe
  2⤵
  PID:2684
- C:\Windows\System\kaLjqhO.exe
  C:\Windows\System\kaLjqhO.exe
  2⤵
  PID:1272
- C:\Windows\System\iNXuEHq.exe
  C:\Windows\System\iNXuEHq.exe
  2⤵
  PID:456
- C:\Windows\System\IqgbAkF.exe
  C:\Windows\System\IqgbAkF.exe
  2⤵
  PID:3268
- C:\Windows\System\lUkTvRm.exe
  C:\Windows\System\lUkTvRm.exe
  2⤵
  PID:2808
- C:\Windows\System\ZTrGlce.exe
  C:\Windows\System\ZTrGlce.exe
  2⤵
  PID:4940
- C:\Windows\System\AsiPXLp.exe
  C:\Windows\System\AsiPXLp.exe
  2⤵
  PID:5416
- C:\Windows\System\bjRSosz.exe
  C:\Windows\System\bjRSosz.exe
  2⤵
  PID:5448
- C:\Windows\System\xpUsZQv.exe
  C:\Windows\System\xpUsZQv.exe
  2⤵
  PID:5508
- C:\Windows\System\lnUdmUF.exe
  C:\Windows\System\lnUdmUF.exe
  2⤵
  PID:5544
- C:\Windows\System\ZPKBAMP.exe
  C:\Windows\System\ZPKBAMP.exe
  2⤵
  PID:5588
- C:\Windows\System\CDruYpk.exe
  C:\Windows\System\CDruYpk.exe
  2⤵
  PID:5636
- C:\Windows\System\vIvwmdg.exe
  C:\Windows\System\vIvwmdg.exe
  2⤵
  PID:1576
- C:\Windows\System\zdKUqEs.exe
  C:\Windows\System\zdKUqEs.exe
  2⤵
  PID:3104
- C:\Windows\System\XgnDzoW.exe
  C:\Windows\System\XgnDzoW.exe
  2⤵
  PID:4480
- C:\Windows\System\TLPcjhe.exe
  C:\Windows\System\TLPcjhe.exe
  2⤵
  PID:4932
- C:\Windows\System\eAyOKtw.exe
  C:\Windows\System\eAyOKtw.exe
  2⤵
  PID:3284
- C:\Windows\System\PQITHgi.exe
  C:\Windows\System\PQITHgi.exe
  2⤵
  PID:3120
- C:\Windows\System\xvDPdYq.exe
  C:\Windows\System\xvDPdYq.exe
  2⤵
  PID:4528
- C:\Windows\System\pqwVmkI.exe
  C:\Windows\System\pqwVmkI.exe
  2⤵
  PID:3920
- C:\Windows\System\TnvKVOh.exe
  C:\Windows\System\TnvKVOh.exe
  2⤵
  PID:1480
- C:\Windows\System\BUwLyXN.exe
  C:\Windows\System\BUwLyXN.exe
  2⤵
  PID:1556
- C:\Windows\System\ypAvact.exe
  C:\Windows\System\ypAvact.exe
  2⤵
  PID:2016
- C:\Windows\System\SQhEbds.exe
  C:\Windows\System\SQhEbds.exe
  2⤵
  PID:4848
- C:\Windows\System\HHPYsLL.exe
  C:\Windows\System\HHPYsLL.exe
  2⤵
  PID:2388
- C:\Windows\System\NCgbXjl.exe
  C:\Windows\System\NCgbXjl.exe
  2⤵
  PID:4468
- C:\Windows\System\hDXmTWD.exe
  C:\Windows\System\hDXmTWD.exe
  2⤵
  PID:4956
- C:\Windows\System\lnFkPrQ.exe
  C:\Windows\System\lnFkPrQ.exe
  2⤵
  PID:5444
- C:\Windows\System\uWMiXYL.exe
  C:\Windows\System\uWMiXYL.exe
  2⤵
  PID:5756
- C:\Windows\System\xMzgAbe.exe
  C:\Windows\System\xMzgAbe.exe
  2⤵
  PID:5772
- C:\Windows\System\lzcAaoz.exe
  C:\Windows\System\lzcAaoz.exe
  2⤵
  PID:5796
- C:\Windows\System\deYBikB.exe
  C:\Windows\System\deYBikB.exe
  2⤵
  PID:5860
- C:\Windows\System\mYNIMUR.exe
  C:\Windows\System\mYNIMUR.exe
  2⤵
  PID:6040
- C:\Windows\System\iPNrNOG.exe
  C:\Windows\System\iPNrNOG.exe
  2⤵
  PID:5820
- C:\Windows\System\lrsmKko.exe
  C:\Windows\System\lrsmKko.exe
  2⤵
  PID:5872
- C:\Windows\System\Dwckxso.exe
  C:\Windows\System\Dwckxso.exe
  2⤵
  PID:3312
- C:\Windows\System\aJGBFCa.exe
  C:\Windows\System\aJGBFCa.exe
  2⤵
  PID:6104
- C:\Windows\System\rzozSQn.exe
  C:\Windows\System\rzozSQn.exe
  2⤵
  PID:2900
- C:\Windows\System\VzxiGqJ.exe
  C:\Windows\System\VzxiGqJ.exe
  2⤵
  PID:3648
- C:\Windows\System\kMPBAXW.exe
  C:\Windows\System\kMPBAXW.exe
  2⤵
  PID:1640
- C:\Windows\System\nvTeORL.exe
  C:\Windows\System\nvTeORL.exe
  2⤵
  PID:3132
- C:\Windows\System\gXPIaXn.exe
  C:\Windows\System\gXPIaXn.exe
  2⤵
  PID:1460
- C:\Windows\System\YKqabay.exe
  C:\Windows\System\YKqabay.exe
  2⤵
  PID:5000
- C:\Windows\System\BtNqnMw.exe
  C:\Windows\System\BtNqnMw.exe
  2⤵
  PID:5824
- C:\Windows\System\dzWiKHQ.exe
  C:\Windows\System\dzWiKHQ.exe
  2⤵
  PID:4524
- C:\Windows\System\pbBlVbq.exe
  C:\Windows\System\pbBlVbq.exe
  2⤵
  PID:3552
- C:\Windows\System\ppGlUrG.exe
  C:\Windows\System\ppGlUrG.exe
  2⤵
  PID:1708
- C:\Windows\System\oLQWobF.exe
  C:\Windows\System\oLQWobF.exe
  2⤵
  PID:1912
- C:\Windows\System\lvpXCZk.exe
  C:\Windows\System\lvpXCZk.exe
  2⤵
  PID:6160
- C:\Windows\System\tiFhCZU.exe
  C:\Windows\System\tiFhCZU.exe
  2⤵
  PID:6188
- C:\Windows\System\vrKxuGm.exe
  C:\Windows\System\vrKxuGm.exe
  2⤵
  PID:6204
- C:\Windows\System\OcHtUgV.exe
  C:\Windows\System\OcHtUgV.exe
  2⤵
  PID:6224
- C:\Windows\System\LgbiKbO.exe
  C:\Windows\System\LgbiKbO.exe
  2⤵
  PID:6248
- C:\Windows\System\BJFTOGc.exe
  C:\Windows\System\BJFTOGc.exe
  2⤵
  PID:6264
- C:\Windows\System\GddGAjR.exe
  C:\Windows\System\GddGAjR.exe
  2⤵
  PID:6296
- C:\Windows\System\WDmOfhw.exe
  C:\Windows\System\WDmOfhw.exe
  2⤵
  PID:6316
- C:\Windows\System\dgbFGXv.exe
  C:\Windows\System\dgbFGXv.exe
  2⤵
  PID:6336
- C:\Windows\System\fyKXzuI.exe
  C:\Windows\System\fyKXzuI.exe
  2⤵
  PID:6364
- C:\Windows\System\mPYdrFt.exe
  C:\Windows\System\mPYdrFt.exe
  2⤵
  PID:6384
- C:\Windows\System\DhcCZVz.exe
  C:\Windows\System\DhcCZVz.exe
  2⤵
  PID:6404
- C:\Windows\System\ywFlVNY.exe
  C:\Windows\System\ywFlVNY.exe
  2⤵
  PID:6424
- C:\Windows\System\ypzDjMH.exe
  C:\Windows\System\ypzDjMH.exe
  2⤵
  PID:6448
- C:\Windows\System\pbcwCFd.exe
  C:\Windows\System\pbcwCFd.exe
  2⤵
  PID:6468
- C:\Windows\System\ONsHGQp.exe
  C:\Windows\System\ONsHGQp.exe
  2⤵
  PID:6500
- C:\Windows\System\svpcnbI.exe
  C:\Windows\System\svpcnbI.exe
  2⤵
  PID:6516
- C:\Windows\System\UOAcZTT.exe
  C:\Windows\System\UOAcZTT.exe
  2⤵
  PID:6552
- C:\Windows\System\KTlFWCE.exe
  C:\Windows\System\KTlFWCE.exe
  2⤵
  PID:6572
- C:\Windows\System\QJZOEDt.exe
  C:\Windows\System\QJZOEDt.exe
  2⤵
  PID:6596
- C:\Windows\System\xoMgOvN.exe
  C:\Windows\System\xoMgOvN.exe
  2⤵
  PID:6620
- C:\Windows\System\nlqDpih.exe
  C:\Windows\System\nlqDpih.exe
  2⤵
  PID:6648
- C:\Windows\System\UTigTsD.exe
  C:\Windows\System\UTigTsD.exe
  2⤵
  PID:6668
- C:\Windows\System\LHjJbfn.exe
  C:\Windows\System\LHjJbfn.exe
  2⤵
  PID:6692
- C:\Windows\System\zAqfRgZ.exe
  C:\Windows\System\zAqfRgZ.exe
  2⤵
  PID:6708
- C:\Windows\System\ZdcPKPX.exe
  C:\Windows\System\ZdcPKPX.exe
  2⤵
  PID:6732
- C:\Windows\System\pPuVbEq.exe
  C:\Windows\System\pPuVbEq.exe
  2⤵
  PID:6764
- C:\Windows\System\pKXDbQU.exe
  C:\Windows\System\pKXDbQU.exe
  2⤵
  PID:6788
- C:\Windows\System\hVTuUUS.exe
  C:\Windows\System\hVTuUUS.exe
  2⤵
  PID:6816
- C:\Windows\System\HcvbBqg.exe
  C:\Windows\System\HcvbBqg.exe
  2⤵
  PID:6840
- C:\Windows\System\kTqlDVO.exe
  C:\Windows\System\kTqlDVO.exe
  2⤵
  PID:6864
- C:\Windows\System\PAuAukS.exe
  C:\Windows\System\PAuAukS.exe
  2⤵
  PID:6888
- C:\Windows\System\XyeKlQq.exe
  C:\Windows\System\XyeKlQq.exe
  2⤵
  PID:6912
- C:\Windows\System\RDehors.exe
  C:\Windows\System\RDehors.exe
  2⤵
  PID:6928
- C:\Windows\System\FShJcPJ.exe
  C:\Windows\System\FShJcPJ.exe
  2⤵
  PID:6952
- C:\Windows\System\eAdZToQ.exe
  C:\Windows\System\eAdZToQ.exe
  2⤵
  PID:6968
- C:\Windows\System\CNJQofW.exe
  C:\Windows\System\CNJQofW.exe
  2⤵
  PID:6996
- C:\Windows\System\KYykSyj.exe
  C:\Windows\System\KYykSyj.exe
  2⤵
  PID:7024
- C:\Windows\System\QkhejoV.exe
  C:\Windows\System\QkhejoV.exe
  2⤵
  PID:7048
- C:\Windows\System\rZWHgYI.exe
  C:\Windows\System\rZWHgYI.exe
  2⤵
  PID:7068
- C:\Windows\System\XXaeDfi.exe
  C:\Windows\System\XXaeDfi.exe
  2⤵
  PID:7092
- C:\Windows\System\oXOSnkx.exe
  C:\Windows\System\oXOSnkx.exe
  2⤵
  PID:7108
- C:\Windows\System\qSzxDJN.exe
  C:\Windows\System\qSzxDJN.exe
  2⤵
  PID:7136
- C:\Windows\System\fsDsBOw.exe
  C:\Windows\System\fsDsBOw.exe
  2⤵
  PID:7152
- C:\Windows\System\IXPzFpI.exe
  C:\Windows\System\IXPzFpI.exe
  2⤵
  PID:764
- C:\Windows\System\JREpcui.exe
  C:\Windows\System\JREpcui.exe
  2⤵
  PID:1892
- C:\Windows\System\tpTfTen.exe
  C:\Windows\System\tpTfTen.exe
  2⤵
  PID:6092
- C:\Windows\System\FfqTZKw.exe
  C:\Windows\System\FfqTZKw.exe
  2⤵
  PID:1280
- C:\Windows\System\qYwsLvD.exe
  C:\Windows\System\qYwsLvD.exe
  2⤵
  PID:2244
- C:\Windows\System\nSPPPrM.exe
  C:\Windows\System\nSPPPrM.exe
  2⤵
  PID:3556
- C:\Windows\System\MtURMZF.exe
  C:\Windows\System\MtURMZF.exe
  2⤵
  PID:5572
- C:\Windows\System\maPTtcH.exe
  C:\Windows\System\maPTtcH.exe
  2⤵
  PID:4084
- C:\Windows\System\qVAHxWx.exe
  C:\Windows\System\qVAHxWx.exe
  2⤵
  PID:6196
- C:\Windows\System\NXWDYsC.exe
  C:\Windows\System\NXWDYsC.exe
  2⤵
  PID:5528
- C:\Windows\System\ucMxLyH.exe
  C:\Windows\System\ucMxLyH.exe
  2⤵
  PID:6356
- C:\Windows\System\sFLWcsq.exe
  C:\Windows\System\sFLWcsq.exe
  2⤵
  PID:6416
- C:\Windows\System\AlGKRqX.exe
  C:\Windows\System\AlGKRqX.exe
  2⤵
  PID:4512
- C:\Windows\System\oixvQXM.exe
  C:\Windows\System\oixvQXM.exe
  2⤵
  PID:6540
- C:\Windows\System\vUaZxWa.exe
  C:\Windows\System\vUaZxWa.exe
  2⤵
  PID:6588
- C:\Windows\System\NawNMit.exe
  C:\Windows\System\NawNMit.exe
  2⤵
  PID:2692
- C:\Windows\System\tiKvyOy.exe
  C:\Windows\System\tiKvyOy.exe
  2⤵
  PID:6700
- C:\Windows\System\UKEJQhw.exe
  C:\Windows\System\UKEJQhw.exe
  2⤵
  PID:540
- C:\Windows\System\QxzXPVY.exe
  C:\Windows\System\QxzXPVY.exe
  2⤵
  PID:6148
- C:\Windows\System\yandBWy.exe
  C:\Windows\System\yandBWy.exe
  2⤵
  PID:6812
- C:\Windows\System\XPlBbqW.exe
  C:\Windows\System\XPlBbqW.exe
  2⤵
  PID:6332
- C:\Windows\System\YrACODI.exe
  C:\Windows\System\YrACODI.exe
  2⤵
  PID:6924
- C:\Windows\System\Taesqqg.exe
  C:\Windows\System\Taesqqg.exe
  2⤵
  PID:6964
- C:\Windows\System\lJmJxJH.exe
  C:\Windows\System\lJmJxJH.exe
  2⤵
  PID:6420
- C:\Windows\System\OnXNGxL.exe
  C:\Windows\System\OnXNGxL.exe
  2⤵
  PID:7040
- C:\Windows\System\rayLwLi.exe
  C:\Windows\System\rayLwLi.exe
  2⤵
  PID:212
- C:\Windows\System\xKxrUOc.exe
  C:\Windows\System\xKxrUOc.exe
  2⤵
  PID:1928
- C:\Windows\System\TFyyglY.exe
  C:\Windows\System\TFyyglY.exe
  2⤵
  PID:2192
- C:\Windows\System\pDIoAzI.exe
  C:\Windows\System\pDIoAzI.exe
  2⤵
  PID:7184
- C:\Windows\System\icNPgoL.exe
  C:\Windows\System\icNPgoL.exe
  2⤵
  PID:7208
- C:\Windows\System\EZwSVHs.exe
  C:\Windows\System\EZwSVHs.exe
  2⤵
  PID:7228
- C:\Windows\System\BMtxFHP.exe
  C:\Windows\System\BMtxFHP.exe
  2⤵
  PID:7252
- C:\Windows\System\fLUEiqq.exe
  C:\Windows\System\fLUEiqq.exe
  2⤵
  PID:7272
- C:\Windows\System\mSZILbl.exe
  C:\Windows\System\mSZILbl.exe
  2⤵
  PID:7296
- C:\Windows\System\VRMTHIX.exe
  C:\Windows\System\VRMTHIX.exe
  2⤵
  PID:7312
- C:\Windows\System\DhKIwKm.exe
  C:\Windows\System\DhKIwKm.exe
  2⤵
  PID:7336
- C:\Windows\System\RQnacAZ.exe
  C:\Windows\System\RQnacAZ.exe
  2⤵
  PID:7356
- C:\Windows\System\kHKKOny.exe
  C:\Windows\System\kHKKOny.exe
  2⤵
  PID:7384
- C:\Windows\System\ROcORwU.exe
  C:\Windows\System\ROcORwU.exe
  2⤵
  PID:7404
- C:\Windows\System\KvpyYMy.exe
  C:\Windows\System\KvpyYMy.exe
  2⤵
  PID:7424
- C:\Windows\System\BQpjvhb.exe
  C:\Windows\System\BQpjvhb.exe
  2⤵
  PID:7444
- C:\Windows\System\micZpKF.exe
  C:\Windows\System\micZpKF.exe
  2⤵
  PID:7468
- C:\Windows\System\OKAlOjS.exe
  C:\Windows\System\OKAlOjS.exe
  2⤵
  PID:7488
- C:\Windows\System\iIBDrNK.exe
  C:\Windows\System\iIBDrNK.exe
  2⤵
  PID:7508
- C:\Windows\System\mSiPECu.exe
  C:\Windows\System\mSiPECu.exe
  2⤵
  PID:7528
- C:\Windows\System\pUTboNT.exe
  C:\Windows\System\pUTboNT.exe
  2⤵
  PID:7552
- C:\Windows\System\lTPnkjn.exe
  C:\Windows\System\lTPnkjn.exe
  2⤵
  PID:7572
- C:\Windows\System\JlJUNwF.exe
  C:\Windows\System\JlJUNwF.exe
  2⤵
  PID:7604
- C:\Windows\System\jXTagCi.exe
  C:\Windows\System\jXTagCi.exe
  2⤵
  PID:7628
- C:\Windows\System\JWTfwFY.exe
  C:\Windows\System\JWTfwFY.exe
  2⤵
  PID:7648
- C:\Windows\System\SuonWbn.exe
  C:\Windows\System\SuonWbn.exe
  2⤵
  PID:7676
- C:\Windows\System\CKNtibM.exe
  C:\Windows\System\CKNtibM.exe
  2⤵
  PID:7696
- C:\Windows\System\xUJqkYV.exe
  C:\Windows\System\xUJqkYV.exe
  2⤵
  PID:7720
- C:\Windows\System\yqUswwp.exe
  C:\Windows\System\yqUswwp.exe
  2⤵
  PID:7740
- C:\Windows\System\NKbSNES.exe
  C:\Windows\System\NKbSNES.exe
  2⤵
  PID:7764
- C:\Windows\System\EwdpAKR.exe
  C:\Windows\System\EwdpAKR.exe
  2⤵
  PID:7784
- C:\Windows\System\JhodQKr.exe
  C:\Windows\System\JhodQKr.exe
  2⤵
  PID:7804
- C:\Windows\System\tDSSWly.exe
  C:\Windows\System\tDSSWly.exe
  2⤵
  PID:7832
- C:\Windows\System\fbcJJtA.exe
  C:\Windows\System\fbcJJtA.exe
  2⤵
  PID:7852
- C:\Windows\System\LchkpOE.exe
  C:\Windows\System\LchkpOE.exe
  2⤵
  PID:7872
- C:\Windows\System\NxoJCEa.exe
  C:\Windows\System\NxoJCEa.exe
  2⤵
  PID:7892
- C:\Windows\System\nxIzgbA.exe
  C:\Windows\System\nxIzgbA.exe
  2⤵
  PID:7920
- C:\Windows\System\VjXFXTG.exe
  C:\Windows\System\VjXFXTG.exe
  2⤵
  PID:7936
- C:\Windows\System\vwYOUrw.exe
  C:\Windows\System\vwYOUrw.exe
  2⤵
  PID:7968
- C:\Windows\System\ydKplaE.exe
  C:\Windows\System\ydKplaE.exe
  2⤵
  PID:8004
- C:\Windows\System\UyLRYvG.exe
  C:\Windows\System\UyLRYvG.exe
  2⤵
  PID:8020
- C:\Windows\System\obMXvSz.exe
  C:\Windows\System\obMXvSz.exe
  2⤵
  PID:8040
- C:\Windows\System\wZJbyAu.exe
  C:\Windows\System\wZJbyAu.exe
  2⤵
  PID:8060
- C:\Windows\System\IvGIWDA.exe
  C:\Windows\System\IvGIWDA.exe
  2⤵
  PID:8084
- C:\Windows\System\dSNRjLx.exe
  C:\Windows\System\dSNRjLx.exe
  2⤵
  PID:8104
- C:\Windows\System\cQVwVYt.exe
  C:\Windows\System\cQVwVYt.exe
  2⤵
  PID:8124
- C:\Windows\System\bjsWsJq.exe
  C:\Windows\System\bjsWsJq.exe
  2⤵
  PID:8148
- C:\Windows\System\uiHrjde.exe
  C:\Windows\System\uiHrjde.exe
  2⤵
  PID:8172
- C:\Windows\System\BmTvySq.exe
  C:\Windows\System\BmTvySq.exe
  2⤵
  PID:6608
- C:\Windows\System\dNOocTi.exe
  C:\Windows\System\dNOocTi.exe
  2⤵
  PID:1156
- C:\Windows\System\DLzdFXY.exe
  C:\Windows\System\DLzdFXY.exe
  2⤵
  PID:548
- C:\Windows\System\urvyNsn.exe
  C:\Windows\System\urvyNsn.exe
  2⤵
  PID:6184
- C:\Windows\System\sRjLKvv.exe
  C:\Windows\System\sRjLKvv.exe
  2⤵
  PID:6272
- C:\Windows\System\ofDOccg.exe
  C:\Windows\System\ofDOccg.exe
  2⤵
  PID:6344
- C:\Windows\System\SCmwoQe.exe
  C:\Windows\System\SCmwoQe.exe
  2⤵
  PID:6476
- C:\Windows\System\ZrzatIT.exe
  C:\Windows\System\ZrzatIT.exe
  2⤵
  PID:6988
- C:\Windows\System\tbFNXFv.exe
  C:\Windows\System\tbFNXFv.exe
  2⤵
  PID:6716
- C:\Windows\System\FrCtHzb.exe
  C:\Windows\System\FrCtHzb.exe
  2⤵
  PID:6308
- C:\Windows\System\jvPpMci.exe
  C:\Windows\System\jvPpMci.exe
  2⤵
  PID:6412
- C:\Windows\System\GdzDTBJ.exe
  C:\Windows\System\GdzDTBJ.exe
  2⤵
  PID:7160
- C:\Windows\System\nBbYsUq.exe
  C:\Windows\System\nBbYsUq.exe
  2⤵
  PID:7264
- C:\Windows\System\nuzmUNw.exe
  C:\Windows\System\nuzmUNw.exe
  2⤵
  PID:7304
- C:\Windows\System\iNvuinu.exe
  C:\Windows\System\iNvuinu.exe
  2⤵
  PID:5492
- C:\Windows\System\FYAPDCr.exe
  C:\Windows\System\FYAPDCr.exe
  2⤵
  PID:7400
- C:\Windows\System\DHqXaRV.exe
  C:\Windows\System\DHqXaRV.exe
  2⤵
  PID:6396
- C:\Windows\System\RmTYrhd.exe
  C:\Windows\System\RmTYrhd.exe
  2⤵
  PID:6512
- C:\Windows\System\Pwmprtn.exe
  C:\Windows\System\Pwmprtn.exe
  2⤵
  PID:7548
- C:\Windows\System\txvPXpL.exe
  C:\Windows\System\txvPXpL.exe
  2⤵
  PID:5496
- C:\Windows\System\dLGmmxQ.exe
  C:\Windows\System\dLGmmxQ.exe
  2⤵
  PID:8200
- C:\Windows\System\SVEuZNm.exe
  C:\Windows\System\SVEuZNm.exe
  2⤵
  PID:8224
- C:\Windows\System\SJxxlen.exe
  C:\Windows\System\SJxxlen.exe
  2⤵
  PID:8244
- C:\Windows\System\iwgNBfn.exe
  C:\Windows\System\iwgNBfn.exe
  2⤵
  PID:8268
- C:\Windows\System\vySxPAg.exe
  C:\Windows\System\vySxPAg.exe
  2⤵
  PID:8284
- C:\Windows\System\eGjafQe.exe
  C:\Windows\System\eGjafQe.exe
  2⤵
  PID:8312
- C:\Windows\System\MtRIjvl.exe
  C:\Windows\System\MtRIjvl.exe
  2⤵
  PID:8336
- C:\Windows\System\cRUYRnL.exe
  C:\Windows\System\cRUYRnL.exe
  2⤵
  PID:8360
- C:\Windows\System\DWIfRrE.exe
  C:\Windows\System\DWIfRrE.exe
  2⤵
  PID:8376
- C:\Windows\System\QFjNmBb.exe
  C:\Windows\System\QFjNmBb.exe
  2⤵
  PID:8400
- C:\Windows\System\mHMRblH.exe
  C:\Windows\System\mHMRblH.exe
  2⤵
  PID:8424
- C:\Windows\System\MqukKRn.exe
  C:\Windows\System\MqukKRn.exe
  2⤵
  PID:8444
- C:\Windows\System\XSkfxei.exe
  C:\Windows\System\XSkfxei.exe
  2⤵
  PID:8464
- C:\Windows\System\yAFWFDl.exe
  C:\Windows\System\yAFWFDl.exe
  2⤵
  PID:8488
- C:\Windows\System\xDPzJuj.exe
  C:\Windows\System\xDPzJuj.exe
  2⤵
  PID:8508
- C:\Windows\System\Drxmrdp.exe
  C:\Windows\System\Drxmrdp.exe
  2⤵
  PID:8536
- C:\Windows\System\ZVIFvix.exe
  C:\Windows\System\ZVIFvix.exe
  2⤵
  PID:8556
- C:\Windows\System\tlIHupH.exe
  C:\Windows\System\tlIHupH.exe
  2⤵
  PID:8576
- C:\Windows\System\HGGJnyr.exe
  C:\Windows\System\HGGJnyr.exe
  2⤵
  PID:8600
- C:\Windows\System\lyInVTQ.exe
  C:\Windows\System\lyInVTQ.exe
  2⤵
  PID:8620
- C:\Windows\System\YLqKKRU.exe
  C:\Windows\System\YLqKKRU.exe
  2⤵
  PID:8644
- C:\Windows\System\xkNytyE.exe
  C:\Windows\System\xkNytyE.exe
  2⤵
  PID:8664
- C:\Windows\System\FNlNMEl.exe
  C:\Windows\System\FNlNMEl.exe
  2⤵
  PID:8692
- C:\Windows\System\NcyWCtA.exe
  C:\Windows\System\NcyWCtA.exe
  2⤵
  PID:8712
- C:\Windows\System\nXYiJtV.exe
  C:\Windows\System\nXYiJtV.exe
  2⤵
  PID:8748
- C:\Windows\System\pLjknFq.exe
  C:\Windows\System\pLjknFq.exe
  2⤵
  PID:8772
- C:\Windows\System\UwbyAYD.exe
  C:\Windows\System\UwbyAYD.exe
  2⤵
  PID:8792
- C:\Windows\System\wGHEyUa.exe
  C:\Windows\System\wGHEyUa.exe
  2⤵
  PID:8812
- C:\Windows\System\dZlQueV.exe
  C:\Windows\System\dZlQueV.exe
  2⤵
  PID:8840
- C:\Windows\System\gJqUWHh.exe
  C:\Windows\System\gJqUWHh.exe
  2⤵
  PID:8864
- C:\Windows\System\LQrblje.exe
  C:\Windows\System\LQrblje.exe
  2⤵
  PID:8888
- C:\Windows\System\NfVYEWC.exe
  C:\Windows\System\NfVYEWC.exe
  2⤵
  PID:8912
- C:\Windows\System\OVDvHid.exe
  C:\Windows\System\OVDvHid.exe
  2⤵
  PID:8932
- C:\Windows\System\xhvwCQl.exe
  C:\Windows\System\xhvwCQl.exe
  2⤵
  PID:8952
- C:\Windows\System\YPUrCQt.exe
  C:\Windows\System\YPUrCQt.exe
  2⤵
  PID:8976
- C:\Windows\System\MhiFKjW.exe
  C:\Windows\System\MhiFKjW.exe
  2⤵
  PID:9004
- C:\Windows\System\geSmLMD.exe
  C:\Windows\System\geSmLMD.exe
  2⤵
  PID:9020
- C:\Windows\System\YYRaPuJ.exe
  C:\Windows\System\YYRaPuJ.exe
  2⤵
  PID:9040
- C:\Windows\System\DlkqEAm.exe
  C:\Windows\System\DlkqEAm.exe
  2⤵
  PID:9068
- C:\Windows\System\stCkkEf.exe
  C:\Windows\System\stCkkEf.exe
  2⤵
  PID:9088
- C:\Windows\System\WjzREPM.exe
  C:\Windows\System\WjzREPM.exe
  2⤵
  PID:9108
- C:\Windows\System\ipKsDPH.exe
  C:\Windows\System\ipKsDPH.exe
  2⤵
  PID:9136
- C:\Windows\System\RAgCkDh.exe
  C:\Windows\System\RAgCkDh.exe
  2⤵
  PID:9160
- C:\Windows\System\xlqqTbu.exe
  C:\Windows\System\xlqqTbu.exe
  2⤵
  PID:9176
- C:\Windows\System\jUTjbdX.exe
  C:\Windows\System\jUTjbdX.exe
  2⤵
  PID:9204
- C:\Windows\System\xYanRRG.exe
  C:\Windows\System\xYanRRG.exe
  2⤵
  PID:7644
- C:\Windows\System\SlkaUqU.exe
  C:\Windows\System\SlkaUqU.exe
  2⤵
  PID:6444
- C:\Windows\System\mgPxIDc.exe
  C:\Windows\System\mgPxIDc.exe
  2⤵
  PID:5852
- C:\Windows\System\syyjPdZ.exe
  C:\Windows\System\syyjPdZ.exe
  2⤵
  PID:6640
- C:\Windows\System\qMBldad.exe
  C:\Windows\System\qMBldad.exe
  2⤵
  PID:7200
- C:\Windows\System\JhSHwwg.exe
  C:\Windows\System\JhSHwwg.exe
  2⤵
  PID:7900
- C:\Windows\System\YxELYZf.exe
  C:\Windows\System\YxELYZf.exe
  2⤵
  PID:7956
- C:\Windows\System\LABIlGa.exe
  C:\Windows\System\LABIlGa.exe
  2⤵
  PID:7992
- C:\Windows\System\rNggujO.exe
  C:\Windows\System\rNggujO.exe
  2⤵
  PID:8140
- C:\Windows\System\LYfsdlw.exe
  C:\Windows\System\LYfsdlw.exe
  2⤵
  PID:7164
- C:\Windows\System\rbolkQh.exe
  C:\Windows\System\rbolkQh.exe
  2⤵
  PID:6524
- C:\Windows\System\KIzJEET.exe
  C:\Windows\System\KIzJEET.exe
  2⤵
  PID:6832
- C:\Windows\System\PElpPwf.exe
  C:\Windows\System\PElpPwf.exe
  2⤵
  PID:7280
- C:\Windows\System\xYeieCy.exe
  C:\Windows\System\xYeieCy.exe
  2⤵
  PID:7580
- C:\Windows\System\nppfaCt.exe
  C:\Windows\System\nppfaCt.exe
  2⤵
  PID:7080
- C:\Windows\System\IKQPXMF.exe
  C:\Windows\System\IKQPXMF.exe
  2⤵
  PID:8208
- C:\Windows\System\zpIOFCd.exe
  C:\Windows\System\zpIOFCd.exe
  2⤵
  PID:8240
- C:\Windows\System\HUbBbsY.exe
  C:\Windows\System\HUbBbsY.exe
  2⤵
  PID:8300
- C:\Windows\System\UnxFxbd.exe
  C:\Windows\System\UnxFxbd.exe
  2⤵
  PID:7760
- C:\Windows\System\jznmJGx.exe
  C:\Windows\System\jznmJGx.exe
  2⤵
  PID:9220
- C:\Windows\System\vNJgiBr.exe
  C:\Windows\System\vNJgiBr.exe
  2⤵
  PID:9248
- C:\Windows\System\MWowROY.exe
  C:\Windows\System\MWowROY.exe
  2⤵
  PID:9272
- C:\Windows\System\iSUVZyu.exe
  C:\Windows\System\iSUVZyu.exe
  2⤵
  PID:9300
- C:\Windows\System\ulSJaub.exe
  C:\Windows\System\ulSJaub.exe
  2⤵
  PID:9320
- C:\Windows\System\tHdSrpS.exe
  C:\Windows\System\tHdSrpS.exe
  2⤵
  PID:9348
- C:\Windows\System\QTwBYTv.exe
  C:\Windows\System\QTwBYTv.exe
  2⤵
  PID:9364
- C:\Windows\System\QoECFze.exe
  C:\Windows\System\QoECFze.exe
  2⤵
  PID:9384
- C:\Windows\System\xdvnRmF.exe
  C:\Windows\System\xdvnRmF.exe
  2⤵
  PID:9408
- C:\Windows\System\CybHdlJ.exe
  C:\Windows\System\CybHdlJ.exe
  2⤵
  PID:9428
- C:\Windows\System\rslIGXV.exe
  C:\Windows\System\rslIGXV.exe
  2⤵
  PID:9448
- C:\Windows\System\YlHwmJG.exe
  C:\Windows\System\YlHwmJG.exe
  2⤵
  PID:9472
- C:\Windows\System\iKsRUEG.exe
  C:\Windows\System\iKsRUEG.exe
  2⤵
  PID:9500
- C:\Windows\System\LVRvUDl.exe
  C:\Windows\System\LVRvUDl.exe
  2⤵
  PID:9520
- C:\Windows\System\cOWVNzf.exe
  C:\Windows\System\cOWVNzf.exe
  2⤵
  PID:9544
- C:\Windows\System\eMvOWsY.exe
  C:\Windows\System\eMvOWsY.exe
  2⤵
  PID:9560
- C:\Windows\System\VCRVgai.exe
  C:\Windows\System\VCRVgai.exe
  2⤵
  PID:9584
- C:\Windows\System\UMiCtTV.exe
  C:\Windows\System\UMiCtTV.exe
  2⤵
  PID:9608
- C:\Windows\System\nvBetsN.exe
  C:\Windows\System\nvBetsN.exe
  2⤵
  PID:9792
- C:\Windows\System\jaePXwF.exe
  C:\Windows\System\jaePXwF.exe
  2⤵
  PID:9816
- C:\Windows\System\RjHmIXG.exe
  C:\Windows\System\RjHmIXG.exe
  2⤵
  PID:9836
- C:\Windows\System\iJUgEaa.exe
  C:\Windows\System\iJUgEaa.exe
  2⤵
  PID:9856
- C:\Windows\System\PhBjUFk.exe
  C:\Windows\System\PhBjUFk.exe
  2⤵
  PID:9880
- C:\Windows\System\bbeaAjc.exe
  C:\Windows\System\bbeaAjc.exe
  2⤵
  PID:9904
- C:\Windows\System\EZclrFv.exe
  C:\Windows\System\EZclrFv.exe
  2⤵
  PID:9928
- C:\Windows\System\dxCdktw.exe
  C:\Windows\System\dxCdktw.exe
  2⤵
  PID:9948
- C:\Windows\System\KDMuMwV.exe
  C:\Windows\System\KDMuMwV.exe
  2⤵
  PID:9972
- C:\Windows\System\ypLdeCY.exe
  C:\Windows\System\ypLdeCY.exe
  2⤵
  PID:9996
- C:\Windows\System\zmrmxER.exe
  C:\Windows\System\zmrmxER.exe
  2⤵
  PID:10016
- C:\Windows\System\Oxykyeu.exe
  C:\Windows\System\Oxykyeu.exe
  2⤵
  PID:10040
- C:\Windows\System\TgTxqjW.exe
  C:\Windows\System\TgTxqjW.exe
  2⤵
  PID:10056
- C:\Windows\System\Okorppo.exe
  C:\Windows\System\Okorppo.exe
  2⤵
  PID:10080
- C:\Windows\System\kOSoMQt.exe
  C:\Windows\System\kOSoMQt.exe
  2⤵
  PID:10104
- C:\Windows\System\kkhhWov.exe
  C:\Windows\System\kkhhWov.exe
  2⤵
  PID:10124
- C:\Windows\System\PKeAPHK.exe
  C:\Windows\System\PKeAPHK.exe
  2⤵
  PID:10152
- C:\Windows\System\xlLMtSr.exe
  C:\Windows\System\xlLMtSr.exe
  2⤵
  PID:10172
- C:\Windows\System\tBXDqHE.exe
  C:\Windows\System\tBXDqHE.exe
  2⤵
  PID:10192
- C:\Windows\System\pnYGPYy.exe
  C:\Windows\System\pnYGPYy.exe
  2⤵
  PID:10212
- C:\Windows\System\ldXmcfF.exe
  C:\Windows\System\ldXmcfF.exe
  2⤵
  PID:10236
- C:\Windows\System\NCBUene.exe
  C:\Windows\System\NCBUene.exe
  2⤵
  PID:8544
- C:\Windows\System\uRavThW.exe
  C:\Windows\System\uRavThW.exe
  2⤵
  PID:8568
- C:\Windows\System\lCkuSNE.exe
  C:\Windows\System\lCkuSNE.exe
  2⤵
  PID:8640
- C:\Windows\System\NnTdOON.exe
  C:\Windows\System\NnTdOON.exe
  2⤵
  PID:8680
- C:\Windows\System\QAKaYUE.exe
  C:\Windows\System\QAKaYUE.exe
  2⤵
  PID:8756
- C:\Windows\System\Thubwpw.exe
  C:\Windows\System\Thubwpw.exe
  2⤵
  PID:7372
- C:\Windows\System\riFWBNe.exe
  C:\Windows\System\riFWBNe.exe
  2⤵
  PID:8092
- C:\Windows\System\oFWdMET.exe
  C:\Windows\System\oFWdMET.exe
  2⤵
  PID:7484
- C:\Windows\System\kUKNrYt.exe
  C:\Windows\System\kUKNrYt.exe
  2⤵
  PID:9060
- C:\Windows\System\XQpQgbV.exe
  C:\Windows\System\XQpQgbV.exe
  2⤵
  PID:7224
- C:\Windows\System\TFjevrR.exe
  C:\Windows\System\TFjevrR.exe
  2⤵
  PID:7516
- C:\Windows\System\JEJmjZK.exe
  C:\Windows\System\JEJmjZK.exe
  2⤵
  PID:7584
- C:\Windows\System\YPeyqxm.exe
  C:\Windows\System\YPeyqxm.exe
  2⤵
  PID:8232
- C:\Windows\System\TPnAzAZ.exe
  C:\Windows\System\TPnAzAZ.exe
  2⤵
  PID:8120
- C:\Windows\System\HlJWwUu.exe
  C:\Windows\System\HlJWwUu.exe
  2⤵
  PID:7524
- C:\Windows\System\HvUlMZl.exe
  C:\Windows\System\HvUlMZl.exe
  2⤵
  PID:6560
- C:\Windows\System\GsHPAFV.exe
  C:\Windows\System\GsHPAFV.exe
  2⤵
  PID:8392
- C:\Windows\System\EtffWTe.exe
  C:\Windows\System\EtffWTe.exe
  2⤵
  PID:9260
- C:\Windows\System\qvznMVZ.exe
  C:\Windows\System\qvznMVZ.exe
  2⤵
  PID:8496
- C:\Windows\System\GnxLZHK.exe
  C:\Windows\System\GnxLZHK.exe
  2⤵
  PID:8592
- C:\Windows\System\dknpOle.exe
  C:\Windows\System\dknpOle.exe
  2⤵
  PID:9396
- C:\Windows\System\rNmPAhe.exe
  C:\Windows\System\rNmPAhe.exe
  2⤵
  PID:7980
- C:\Windows\System\aMgXEDv.exe
  C:\Windows\System\aMgXEDv.exe
  2⤵
  PID:9580
- C:\Windows\System\mJVUVWA.exe
  C:\Windows\System\mJVUVWA.exe
  2⤵
  PID:8096
- C:\Windows\System\oQSwKbJ.exe
  C:\Windows\System\oQSwKbJ.exe
  2⤵
  PID:10256
- C:\Windows\System\VJwtzlY.exe
  C:\Windows\System\VJwtzlY.exe
  2⤵
  PID:10280
- C:\Windows\System\QLaLFNa.exe
  C:\Windows\System\QLaLFNa.exe
  2⤵
  PID:10300
- C:\Windows\System\MiNLMru.exe
  C:\Windows\System\MiNLMru.exe
  2⤵
  PID:10324
- C:\Windows\System\lqpmjtA.exe
  C:\Windows\System\lqpmjtA.exe
  2⤵
  PID:10352
- C:\Windows\System\WUYapyH.exe
  C:\Windows\System\WUYapyH.exe
  2⤵
  PID:10376
- C:\Windows\System\tyBiOri.exe
  C:\Windows\System\tyBiOri.exe
  2⤵
  PID:10400
- C:\Windows\System\UTAZPGv.exe
  C:\Windows\System\UTAZPGv.exe
  2⤵
  PID:10416
- C:\Windows\System\WjCQdkl.exe
  C:\Windows\System\WjCQdkl.exe
  2⤵
  PID:10448
- C:\Windows\System\syCkPUQ.exe
  C:\Windows\System\syCkPUQ.exe
  2⤵
  PID:10472
- C:\Windows\System\hozCVBx.exe
  C:\Windows\System\hozCVBx.exe
  2⤵
  PID:10496
- C:\Windows\System\uzBwNjX.exe
  C:\Windows\System\uzBwNjX.exe
  2⤵
  PID:10528
- C:\Windows\System\mhSRkAo.exe
  C:\Windows\System\mhSRkAo.exe
  2⤵
  PID:10544
- C:\Windows\System\KwZTTWE.exe
  C:\Windows\System\KwZTTWE.exe
  2⤵
  PID:10568
- C:\Windows\System\CBfZuBF.exe
  C:\Windows\System\CBfZuBF.exe
  2⤵
  PID:10592
- C:\Windows\System\mjGJGfp.exe
  C:\Windows\System\mjGJGfp.exe
  2⤵
  PID:10620
- C:\Windows\System\mTHuVhn.exe
  C:\Windows\System\mTHuVhn.exe
  2⤵
  PID:10644
- C:\Windows\System\MdjLfFW.exe
  C:\Windows\System\MdjLfFW.exe
  2⤵
  PID:10668
- C:\Windows\System\vAFqfvG.exe
  C:\Windows\System\vAFqfvG.exe
  2⤵
  PID:10692
- C:\Windows\System\cPnQmgA.exe
  C:\Windows\System\cPnQmgA.exe
  2⤵
  PID:10716
- C:\Windows\System\UIoFULl.exe
  C:\Windows\System\UIoFULl.exe
  2⤵
  PID:10736
- C:\Windows\System\IOPmKNQ.exe
  C:\Windows\System\IOPmKNQ.exe
  2⤵
  PID:10760
- C:\Windows\System\dxiPigo.exe
  C:\Windows\System\dxiPigo.exe
  2⤵
  PID:10780
- C:\Windows\System\tbPvNxW.exe
  C:\Windows\System\tbPvNxW.exe
  2⤵
  PID:10804
- C:\Windows\System\aSBCGyE.exe
  C:\Windows\System\aSBCGyE.exe
  2⤵
  PID:10824
- C:\Windows\System\YEAPDsg.exe
  C:\Windows\System\YEAPDsg.exe
  2⤵
  PID:10848
- C:\Windows\System\wxHgxMB.exe
  C:\Windows\System\wxHgxMB.exe
  2⤵
  PID:10872
- C:\Windows\System\ZZUDzpb.exe
  C:\Windows\System\ZZUDzpb.exe
  2⤵
  PID:10892
- C:\Windows\System\MULsTPI.exe
  C:\Windows\System\MULsTPI.exe
  2⤵
  PID:10912
- C:\Windows\System\LvscAbm.exe
  C:\Windows\System\LvscAbm.exe
  2⤵
  PID:10948
- C:\Windows\System\vNFbyOM.exe
  C:\Windows\System\vNFbyOM.exe
  2⤵
  PID:10968
- C:\Windows\System\eCfVJrd.exe
  C:\Windows\System\eCfVJrd.exe
  2⤵
  PID:10992
- C:\Windows\System\hRGuHFt.exe
  C:\Windows\System\hRGuHFt.exe
  2⤵
  PID:11020
- C:\Windows\System\OsSUytX.exe
  C:\Windows\System\OsSUytX.exe
  2⤵
  PID:11040
- C:\Windows\System\HVSsoAY.exe
  C:\Windows\System\HVSsoAY.exe
  2⤵
  PID:11060
- C:\Windows\System\YXWNFHU.exe
  C:\Windows\System\YXWNFHU.exe
  2⤵
  PID:11084
- C:\Windows\System\iTQkWYS.exe
  C:\Windows\System\iTQkWYS.exe
  2⤵
  PID:11104
- C:\Windows\System\EjqEdvy.exe
  C:\Windows\System\EjqEdvy.exe
  2⤵
  PID:11124
- C:\Windows\System\syJCmid.exe
  C:\Windows\System\syJCmid.exe
  2⤵
  PID:11148
- C:\Windows\System\bTkpWuv.exe
  C:\Windows\System\bTkpWuv.exe
  2⤵
  PID:11168
- C:\Windows\System\ELutUHh.exe
  C:\Windows\System\ELutUHh.exe
  2⤵
  PID:11196
- C:\Windows\System\CYaUcvS.exe
  C:\Windows\System\CYaUcvS.exe
  2⤵
  PID:11212
- C:\Windows\System\XhvuzWg.exe
  C:\Windows\System\XhvuzWg.exe
  2⤵
  PID:11240
- C:\Windows\System\zaUltai.exe
  C:\Windows\System\zaUltai.exe
  2⤵
  PID:11260
- C:\Windows\System\HtTZiFd.exe
  C:\Windows\System\HtTZiFd.exe
  2⤵
  PID:5844
- C:\Windows\System\QFTjlOS.exe
  C:\Windows\System\QFTjlOS.exe
  2⤵
  PID:8924
- C:\Windows\System\HsLaVRz.exe
  C:\Windows\System\HsLaVRz.exe
  2⤵
  PID:6328
- C:\Windows\System\ybAyGqh.exe
  C:\Windows\System\ybAyGqh.exe
  2⤵
  PID:9732
- C:\Windows\System\HTExhRD.exe
  C:\Windows\System\HTExhRD.exe
  2⤵
  PID:9152
- C:\Windows\System\KYZXAQM.exe
  C:\Windows\System\KYZXAQM.exe
  2⤵
  PID:7376
- C:\Windows\System\cjOSUDz.exe
  C:\Windows\System\cjOSUDz.exe
  2⤵
  PID:7504
- C:\Windows\System\HJGuSTy.exe
  C:\Windows\System\HJGuSTy.exe
  2⤵
  PID:7216
- C:\Windows\System\OUkLdof.exe
  C:\Windows\System\OUkLdof.exe
  2⤵
  PID:9892
- C:\Windows\System\daFoAfZ.exe
  C:\Windows\System\daFoAfZ.exe
  2⤵
  PID:9980
- C:\Windows\System\dpstGGv.exe
  C:\Windows\System\dpstGGv.exe
  2⤵
  PID:8276
- C:\Windows\System\LPNRQck.exe
  C:\Windows\System\LPNRQck.exe
  2⤵
  PID:6684
- C:\Windows\System\qslxrHO.exe
  C:\Windows\System\qslxrHO.exe
  2⤵
  PID:7636
- C:\Windows\System\uicwtaQ.exe
  C:\Windows\System\uicwtaQ.exe
  2⤵
  PID:7748
- C:\Windows\System\VDGHDyR.exe
  C:\Windows\System\VDGHDyR.exe
  2⤵
  PID:8504
- C:\Windows\System\QISvFUj.exe
  C:\Windows\System\QISvFUj.exe
  2⤵
  PID:9420
- C:\Windows\System\SwelIzS.exe
  C:\Windows\System\SwelIzS.exe
  2⤵
  PID:9444
- C:\Windows\System\TDdPhCz.exe
  C:\Windows\System\TDdPhCz.exe
  2⤵
  PID:8720
- C:\Windows\System\fVmshOB.exe
  C:\Windows\System\fVmshOB.exe
  2⤵
  PID:8472
- C:\Windows\System\hrXskTi.exe
  C:\Windows\System\hrXskTi.exe
  2⤵
  PID:11276
- C:\Windows\System\JftnjIt.exe
  C:\Windows\System\JftnjIt.exe
  2⤵
  PID:11296
- C:\Windows\System\rbieyUC.exe
  C:\Windows\System\rbieyUC.exe
  2⤵
  PID:11316
- C:\Windows\System\helNGQE.exe
  C:\Windows\System\helNGQE.exe
  2⤵
  PID:11340
- C:\Windows\System\BBJHkik.exe
  C:\Windows\System\BBJHkik.exe
  2⤵
  PID:11364
- C:\Windows\System\oeDqDLZ.exe
  C:\Windows\System\oeDqDLZ.exe
  2⤵
  PID:11384
- C:\Windows\System\opBXHaH.exe
  C:\Windows\System\opBXHaH.exe
  2⤵
  PID:11408
- C:\Windows\System\bpYJBmP.exe
  C:\Windows\System\bpYJBmP.exe
  2⤵
  PID:11432
- C:\Windows\System\gTteAoG.exe
  C:\Windows\System\gTteAoG.exe
  2⤵
  PID:11448
- C:\Windows\System\qNmOQKR.exe
  C:\Windows\System\qNmOQKR.exe
  2⤵
  PID:11472
- C:\Windows\System\lsejmWS.exe
  C:\Windows\System\lsejmWS.exe
  2⤵
  PID:11500
- C:\Windows\System\yMIzLnF.exe
  C:\Windows\System\yMIzLnF.exe
  2⤵
  PID:11520
- C:\Windows\System\eBsUbAC.exe
  C:\Windows\System\eBsUbAC.exe
  2⤵
  PID:11544
- C:\Windows\System\BmFlHiQ.exe
  C:\Windows\System\BmFlHiQ.exe
  2⤵
  PID:11568
- C:\Windows\System\kmCumyu.exe
  C:\Windows\System\kmCumyu.exe
  2⤵
  PID:11592
- C:\Windows\System\KUQKsZz.exe
  C:\Windows\System\KUQKsZz.exe
  2⤵
  PID:11612
- C:\Windows\System\YlvfVCW.exe
  C:\Windows\System\YlvfVCW.exe
  2⤵
  PID:11632
- C:\Windows\System\wCqWTHY.exe
  C:\Windows\System\wCqWTHY.exe
  2⤵
  PID:11656
- C:\Windows\System\aIRbjLM.exe
  C:\Windows\System\aIRbjLM.exe
  2⤵
  PID:11684
- C:\Windows\System\VVYtiXu.exe
  C:\Windows\System\VVYtiXu.exe
  2⤵
  PID:11700
- C:\Windows\System\jWAZbsL.exe
  C:\Windows\System\jWAZbsL.exe
  2⤵
  PID:11720
- C:\Windows\System\sOviaqz.exe
  C:\Windows\System\sOviaqz.exe
  2⤵
  PID:11740
- C:\Windows\System\pklKXZa.exe
  C:\Windows\System\pklKXZa.exe
  2⤵
  PID:11764
- C:\Windows\System\xlDKAyr.exe
  C:\Windows\System\xlDKAyr.exe
  2⤵
  PID:11784
- C:\Windows\System\XRARMIn.exe
  C:\Windows\System\XRARMIn.exe
  2⤵
  PID:11808
- C:\Windows\System\PwjvjfR.exe
  C:\Windows\System\PwjvjfR.exe
  2⤵
  PID:11832
- C:\Windows\System\skhPJyf.exe
  C:\Windows\System\skhPJyf.exe
  2⤵
  PID:11860
- C:\Windows\System\yZwNBbJ.exe
  C:\Windows\System\yZwNBbJ.exe
  2⤵
  PID:11884
- C:\Windows\System\eyCwuvW.exe
  C:\Windows\System\eyCwuvW.exe
  2⤵
  PID:11908
- C:\Windows\System\RsAJWjD.exe
  C:\Windows\System\RsAJWjD.exe
  2⤵
  PID:11940
- C:\Windows\System\wmDjHLP.exe
  C:\Windows\System\wmDjHLP.exe
  2⤵
  PID:11964
- C:\Windows\System\VIzricG.exe
  C:\Windows\System\VIzricG.exe
  2⤵
  PID:11984
- C:\Windows\System\tFnClpL.exe
  C:\Windows\System\tFnClpL.exe
  2⤵
  PID:12008
- C:\Windows\System\FImtgvQ.exe
  C:\Windows\System\FImtgvQ.exe
  2⤵
  PID:12048
- C:\Windows\System\oDGSqtE.exe
  C:\Windows\System\oDGSqtE.exe
  2⤵
  PID:12068
- C:\Windows\System\NyJdTCD.exe
  C:\Windows\System\NyJdTCD.exe
  2⤵
  PID:12092
- C:\Windows\System\mIivJEj.exe
  C:\Windows\System\mIivJEj.exe
  2⤵
  PID:12116
- C:\Windows\System\eaWzpyM.exe
  C:\Windows\System\eaWzpyM.exe
  2⤵
  PID:12136
- C:\Windows\System\NswhrUB.exe
  C:\Windows\System\NswhrUB.exe
  2⤵
  PID:12160
- C:\Windows\System\JkaRFyo.exe
  C:\Windows\System\JkaRFyo.exe
  2⤵
  PID:12184
- C:\Windows\System\QWpJBYb.exe
  C:\Windows\System\QWpJBYb.exe
  2⤵
  PID:12208
- C:\Windows\System\YumdtjS.exe
  C:\Windows\System\YumdtjS.exe
  2⤵
  PID:12232
- C:\Windows\System\ylyyqYK.exe
  C:\Windows\System\ylyyqYK.exe
  2⤵
  PID:12252
- C:\Windows\System\gFulKSv.exe
  C:\Windows\System\gFulKSv.exe
  2⤵
  PID:12280
- C:\Windows\System\SMwlXsj.exe
  C:\Windows\System\SMwlXsj.exe
  2⤵
  PID:9484
- C:\Windows\System\ZXcCvwJ.exe
  C:\Windows\System\ZXcCvwJ.exe
  2⤵
  PID:10268
- C:\Windows\System\TgyvCxV.exe
  C:\Windows\System\TgyvCxV.exe
  2⤵
  PID:10316
- C:\Windows\System\QVrqRvM.exe
  C:\Windows\System\QVrqRvM.exe
  2⤵
  PID:10412
- C:\Windows\System\MpPNSaN.exe
  C:\Windows\System\MpPNSaN.exe
  2⤵
  PID:8948
- C:\Windows\System\HtgirMi.exe
  C:\Windows\System\HtgirMi.exe
  2⤵
  PID:8996
- C:\Windows\System\gEewBoW.exe
  C:\Windows\System\gEewBoW.exe
  2⤵
  PID:10564
- C:\Windows\System\kfyzdKU.exe
  C:\Windows\System\kfyzdKU.exe
  2⤵
  PID:1188
- C:\Windows\System\HeuGVXV.exe
  C:\Windows\System\HeuGVXV.exe
  2⤵
  PID:10640
- C:\Windows\System\ZBzmiaC.exe
  C:\Windows\System\ZBzmiaC.exe
  2⤵
  PID:9100
- C:\Windows\System\cwggazy.exe
  C:\Windows\System\cwggazy.exe
  2⤵
  PID:9128
- C:\Windows\System\swqgUNQ.exe
  C:\Windows\System\swqgUNQ.exe
  2⤵
  PID:9196
- C:\Windows\System\DljqxHW.exe
  C:\Windows\System\DljqxHW.exe
  2⤵
  PID:10840
- C:\Windows\System\DoiUiaf.exe
  C:\Windows\System\DoiUiaf.exe
  2⤵
  PID:10888
- C:\Windows\System\QNNLlPB.exe
  C:\Windows\System\QNNLlPB.exe
  2⤵
  PID:3244
- C:\Windows\System\gsJtPyc.exe
  C:\Windows\System\gsJtPyc.exe
  2⤵
  PID:9828
- C:\Windows\System\HZlQwfV.exe
  C:\Windows\System\HZlQwfV.exe
  2⤵
  PID:9852
- C:\Windows\System\vVyrwhY.exe
  C:\Windows\System\vVyrwhY.exe
  2⤵
  PID:11052
- C:\Windows\System\CwMfNFA.exe
  C:\Windows\System\CwMfNFA.exe
  2⤵
  PID:11076
- C:\Windows\System\mGbiLub.exe
  C:\Windows\System\mGbiLub.exe
  2⤵
  PID:11164
- C:\Windows\System\oDSzuzD.exe
  C:\Windows\System\oDSzuzD.exe
  2⤵
  PID:12300
- C:\Windows\System\sSjfAWS.exe
  C:\Windows\System\sSjfAWS.exe
  2⤵
  PID:12324
- C:\Windows\System\kPVBilu.exe
  C:\Windows\System\kPVBilu.exe
  2⤵
  PID:12344
- C:\Windows\System\xGfKAuZ.exe
  C:\Windows\System\xGfKAuZ.exe
  2⤵
  PID:12368
- C:\Windows\System\pMUOeBX.exe
  C:\Windows\System\pMUOeBX.exe
  2⤵
  PID:12392
- C:\Windows\System\mjBkQwc.exe
  C:\Windows\System\mjBkQwc.exe
  2⤵
  PID:12412
- C:\Windows\System\EKIlRwo.exe
  C:\Windows\System\EKIlRwo.exe
  2⤵
  PID:12444
- C:\Windows\System\XOeZMKA.exe
  C:\Windows\System\XOeZMKA.exe
  2⤵
  PID:12468
- C:\Windows\System\jAWuiVo.exe
  C:\Windows\System\jAWuiVo.exe
  2⤵
  PID:12488
- C:\Windows\System\jaKtzii.exe
  C:\Windows\System\jaKtzii.exe
  2⤵
  PID:12504
- C:\Windows\System\vvzdLaC.exe
  C:\Windows\System\vvzdLaC.exe
  2⤵
  PID:12524
- C:\Windows\System\cISDHtK.exe
  C:\Windows\System\cISDHtK.exe
  2⤵
  PID:12548
- C:\Windows\System\EqNsBaa.exe
  C:\Windows\System\EqNsBaa.exe
  2⤵
  PID:12568
- C:\Windows\System\rJMvIrr.exe
  C:\Windows\System\rJMvIrr.exe
  2⤵
  PID:12588
- C:\Windows\System\cfdIMTp.exe
  C:\Windows\System\cfdIMTp.exe
  2⤵
  PID:12608
- C:\Windows\System\cWEAlpM.exe
  C:\Windows\System\cWEAlpM.exe
  2⤵
  PID:12628
- C:\Windows\System\avEUpvO.exe
  C:\Windows\System\avEUpvO.exe
  2⤵
  PID:12652
- C:\Windows\System\UfPnFLB.exe
  C:\Windows\System\UfPnFLB.exe
  2⤵
  PID:12672
- C:\Windows\System\oVMmdxt.exe
  C:\Windows\System\oVMmdxt.exe
  2⤵
  PID:12696
- C:\Windows\System\DHMhiGo.exe
  C:\Windows\System\DHMhiGo.exe
  2⤵
  PID:12720
- C:\Windows\System\HkLbQyX.exe
  C:\Windows\System\HkLbQyX.exe
  2⤵
  PID:12748
- C:\Windows\System\AiKYRow.exe
  C:\Windows\System\AiKYRow.exe
  2⤵
  PID:12772
- C:\Windows\System\PSKOACx.exe
  C:\Windows\System\PSKOACx.exe
  2⤵
  PID:12800
- C:\Windows\System\fzuZWqO.exe
  C:\Windows\System\fzuZWqO.exe
  2⤵
  PID:12820
- C:\Windows\System\ApDWcOa.exe
  C:\Windows\System\ApDWcOa.exe
  2⤵
  PID:12840
- C:\Windows\System\yEzDkor.exe
  C:\Windows\System\yEzDkor.exe
  2⤵
  PID:12864
- C:\Windows\System\PVTNBPJ.exe
  C:\Windows\System\PVTNBPJ.exe
  2⤵
  PID:12888
- C:\Windows\System\FDWwSYb.exe
  C:\Windows\System\FDWwSYb.exe
  2⤵
  PID:12904
- C:\Windows\System\MazxJju.exe
  C:\Windows\System\MazxJju.exe
  2⤵
  PID:12928
- C:\Windows\System\qiWcWlV.exe
  C:\Windows\System\qiWcWlV.exe
  2⤵
  PID:12952
- C:\Windows\System\LxwhVcC.exe
  C:\Windows\System\LxwhVcC.exe
  2⤵
  PID:12976
- C:\Windows\System\oOrzBat.exe
  C:\Windows\System\oOrzBat.exe
  2⤵
  PID:12996
- C:\Windows\System\nRkKfzD.exe
  C:\Windows\System\nRkKfzD.exe
  2⤵
  PID:13020
- C:\Windows\System\vyRMFpT.exe
  C:\Windows\System\vyRMFpT.exe
  2⤵
  PID:13044
- C:\Windows\System\VPrajpQ.exe
  C:\Windows\System\VPrajpQ.exe
  2⤵
  PID:13072
- C:\Windows\System\LcksMEJ.exe
  C:\Windows\System\LcksMEJ.exe
  2⤵
  PID:13088
- C:\Windows\System\aIUFyyG.exe
  C:\Windows\System\aIUFyyG.exe
  2⤵
  PID:13112
- C:\Windows\System\nSYAdmZ.exe
  C:\Windows\System\nSYAdmZ.exe
  2⤵
  PID:13136
- C:\Windows\System\rkZWFqs.exe
  C:\Windows\System\rkZWFqs.exe
  2⤵
  PID:13164
- C:\Windows\System\UGYlDXA.exe
  C:\Windows\System\UGYlDXA.exe
  2⤵
  PID:13188
- C:\Windows\System\ZWuoCVS.exe
  C:\Windows\System\ZWuoCVS.exe
  2⤵
  PID:13212
- C:\Windows\System\CtRiyRX.exe
  C:\Windows\System\CtRiyRX.exe
  2⤵
  PID:13232
- C:\Windows\System\tyznCkX.exe
  C:\Windows\System\tyznCkX.exe
  2⤵
  PID:13256
- C:\Windows\System\wYNBBan.exe
  C:\Windows\System\wYNBBan.exe
  2⤵
  PID:12432
- C:\Windows\System\oPMMiXr.exe
  C:\Windows\System\oPMMiXr.exe
  2⤵
  PID:12540
- C:\Windows\System\IKEdtni.exe
  C:\Windows\System\IKEdtni.exe
  2⤵
  PID:12600
- C:\Windows\System\LLNFHbu.exe
  C:\Windows\System\LLNFHbu.exe
  2⤵
  PID:4080
- C:\Windows\System\ZpusaKp.exe
  C:\Windows\System\ZpusaKp.exe
  2⤵
  PID:10100
- C:\Windows\System\KguSano.exe
  C:\Windows\System\KguSano.exe
  2⤵
  PID:11268
- C:\Windows\System\CdIvobn.exe
  C:\Windows\System\CdIvobn.exe
  2⤵
  PID:11540
- C:\Windows\System\xWHTiaS.exe
  C:\Windows\System\xWHTiaS.exe
  2⤵
  PID:7436
- C:\Windows\System\BLRrvfE.exe
  C:\Windows\System\BLRrvfE.exe
  2⤵
  PID:12660
- C:\Windows\System\xsAuchN.exe
  C:\Windows\System\xsAuchN.exe
  2⤵
  PID:9964
- C:\Windows\System\cluQbao.exe
  C:\Windows\System\cluQbao.exe
  2⤵
  PID:11516
- C:\Windows\System\uOyLKhm.exe
  C:\Windows\System\uOyLKhm.exe
  2⤵
  PID:10956
- C:\Windows\System\lUolxCr.exe
  C:\Windows\System\lUolxCr.exe
  2⤵
  PID:3912
- C:\Windows\System\ViDmwed.exe
  C:\Windows\System\ViDmwed.exe
  2⤵
  PID:10264
- C:\Windows\System\sInZSgN.exe
  C:\Windows\System\sInZSgN.exe
  2⤵
  PID:12032
- C:\Windows\System\DqxxsOT.exe
  C:\Windows\System\DqxxsOT.exe
  2⤵
  PID:4844
- C:\Windows\System\RQWWLqc.exe
  C:\Windows\System\RQWWLqc.exe
  2⤵
  PID:9116
- C:\Windows\System\oOOYNLa.exe
  C:\Windows\System\oOOYNLa.exe
  2⤵
  PID:12668
- C:\Windows\System\dtzlkUN.exe
  C:\Windows\System\dtzlkUN.exe
  2⤵
  PID:4568
- C:\Windows\System\pzaBNpO.exe
  C:\Windows\System\pzaBNpO.exe
  2⤵
  PID:8820
- C:\Windows\System\XTXOarl.exe
  C:\Windows\System\XTXOarl.exe
  2⤵
  PID:9456
- C:\Windows\System\xJhJwut.exe
  C:\Windows\System\xJhJwut.exe
  2⤵
  PID:9872
- C:\Windows\System\OcOZpzr.exe
  C:\Windows\System\OcOZpzr.exe
  2⤵
  PID:12732
- C:\Windows\System\YRliquP.exe
  C:\Windows\System\YRliquP.exe
  2⤵
  PID:13008
- C:\Windows\System\GjaZelP.exe
  C:\Windows\System\GjaZelP.exe
  2⤵
  PID:13224
- C:\Windows\System\cdakFQZ.exe
  C:\Windows\System\cdakFQZ.exe
  2⤵
  PID:6256
- C:\Windows\System\HngpQGt.exe
  C:\Windows\System\HngpQGt.exe
  2⤵
  PID:9380
- C:\Windows\System\DAdxPtv.exe
  C:\Windows\System\DAdxPtv.exe
  2⤵
  PID:10480
- C:\Windows\System\qWtAUmv.exe
  C:\Windows\System\qWtAUmv.exe
  2⤵
  PID:6772
- C:\Windows\System\ClmZHbP.exe
  C:\Windows\System\ClmZHbP.exe
  2⤵
  PID:6904
- C:\Windows\System\eLkczba.exe
  C:\Windows\System\eLkczba.exe
  2⤵
  PID:12108
- C:\Windows\System\vcWIqma.exe
  C:\Windows\System\vcWIqma.exe
  2⤵
  PID:1008
- C:\Windows\System\YgQYDId.exe
  C:\Windows\System\YgQYDId.exe
  2⤵
  PID:13032
- C:\Windows\System\SrrWnnK.exe
  C:\Windows\System\SrrWnnK.exe
  2⤵
  PID:9184
- C:\Windows\System\RoxdjrZ.exe
  C:\Windows\System\RoxdjrZ.exe
  2⤵
  PID:8012
- C:\Windows\System\TVdQvqn.exe
  C:\Windows\System\TVdQvqn.exe
  2⤵
  PID:6852
- C:\Windows\System\WDcQDLF.exe
  C:\Windows\System\WDcQDLF.exe
  2⤵
  PID:11824
- C:\Windows\System\QCmAlkS.exe
  C:\Windows\System\QCmAlkS.exe
  2⤵
  PID:10132
- C:\Windows\System\TogjvUu.exe
  C:\Windows\System\TogjvUu.exe
  2⤵
  PID:12460
- C:\Windows\System\ncEKzBw.exe
  C:\Windows\System\ncEKzBw.exe
  2⤵
  PID:11184
- C:\Windows\System\uxGRLtV.exe
  C:\Windows\System\uxGRLtV.exe
  2⤵
  PID:11796
- C:\Windows\System\zoPZiix.exe
  C:\Windows\System\zoPZiix.exe
  2⤵
  PID:11780
- C:\Windows\System\znWtzXS.exe
  C:\Windows\System\znWtzXS.exe
  2⤵
  PID:10068
- C:\Windows\System\msORIqQ.exe
  C:\Windows\System\msORIqQ.exe
  2⤵
  PID:11708
- C:\Windows\System\gXbFFVu.exe
  C:\Windows\System\gXbFFVu.exe
  2⤵
  PID:8904
- C:\Windows\System\ODuUnnh.exe
  C:\Windows\System\ODuUnnh.exe
  2⤵
  PID:10980
- C:\Windows\System\aGLBuIV.exe
  C:\Windows\System\aGLBuIV.exe
  2⤵
  PID:10772
- C:\Windows\System\EwtvIJH.exe
  C:\Windows\System\EwtvIJH.exe
  2⤵
  PID:3880
- C:\Windows\System\JQuyXsX.exe
  C:\Windows\System\JQuyXsX.exe
  2⤵
  PID:8076
- C:\Windows\System\fkcewHz.exe
  C:\Windows\System\fkcewHz.exe
  2⤵
  PID:7476
- C:\Windows\System\gjwbPfF.exe
  C:\Windows\System\gjwbPfF.exe
  2⤵
  PID:10512
- C:\Windows\System\wCfshju.exe
  C:\Windows\System\wCfshju.exe
  2⤵
  PID:11732
- C:\Windows\System\GecTFXR.exe
  C:\Windows\System\GecTFXR.exe
  2⤵
  PID:12836
- C:\Windows\System\VwJZmdN.exe
  C:\Windows\System\VwJZmdN.exe
  2⤵
  PID:11308
- C:\Windows\System\TnIimxo.exe
  C:\Windows\System\TnIimxo.exe
  2⤵
  PID:12988
- C:\Windows\System\XiHpmzb.exe
  C:\Windows\System\XiHpmzb.exe
  2⤵
  PID:2184
- C:\Windows\System\EhXpNgR.exe
  C:\Windows\System\EhXpNgR.exe
  2⤵
  PID:2220
- C:\Windows\System\ZXCCOzk.exe
  C:\Windows\System\ZXCCOzk.exe
  2⤵
  PID:9676
- C:\Windows\System\ZXrcuQs.exe
  C:\Windows\System\ZXrcuQs.exe
  2⤵
  PID:7084
- C:\Windows\System\lKWnatQ.exe
  C:\Windows\System\lKWnatQ.exe
  2⤵
  PID:12828
- C:\Windows\System\iqHjuRX.exe
  C:\Windows\System\iqHjuRX.exe
  2⤵
  PID:12060
- C:\Windows\System\KWnTFqo.exe
  C:\Windows\System\KWnTFqo.exe
  2⤵
  PID:13144
- C:\Windows\System\yxDYxzH.exe
  C:\Windows\System\yxDYxzH.exe
  2⤵
  PID:7148
- C:\Windows\System\RcBzWbf.exe
  C:\Windows\System\RcBzWbf.exe
  2⤵
  PID:7772
- C:\Windows\System\mlZVSWx.exe
  C:\Windows\System\mlZVSWx.exe
  2⤵
  PID:12364
- C:\Windows\System\paGcxMT.exe
  C:\Windows\System\paGcxMT.exe
  2⤵
  PID:12704
- C:\Windows\System\ArlIzCL.exe
  C:\Windows\System\ArlIzCL.exe
  2⤵
  PID:11640
- C:\Windows\System\fpGEBMe.exe
  C:\Windows\System\fpGEBMe.exe
  2⤵
  PID:10344
- C:\Windows\System\wCZRsXQ.exe
  C:\Windows\System\wCZRsXQ.exe
  2⤵
  PID:10456
- C:\Windows\System\VSBgGeD.exe
  C:\Windows\System\VSBgGeD.exe
  2⤵
  PID:13104
- C:\Windows\System\EQKzMkM.exe
  C:\Windows\System\EQKzMkM.exe
  2⤵
  PID:12936
- C:\Windows\System\BOJmXbM.exe
  C:\Windows\System\BOJmXbM.exe
  2⤵
  PID:12856
- C:\Windows\System\qUSVvhc.exe
  C:\Windows\System\qUSVvhc.exe
  2⤵
  PID:13496
- C:\Windows\System\HgWjtfS.exe
  C:\Windows\System\HgWjtfS.exe
  2⤵
  PID:13688
- C:\Windows\System\dmvqtqe.exe
  C:\Windows\System\dmvqtqe.exe
  2⤵
  PID:13720
- C:\Windows\System\NBpLQTi.exe
  C:\Windows\System\NBpLQTi.exe
  2⤵
  PID:13744
- C:\Windows\System\oyuMrnH.exe
  C:\Windows\System\oyuMrnH.exe
  2⤵
  PID:13768
- C:\Windows\System\LYXMywB.exe
  C:\Windows\System\LYXMywB.exe
  2⤵
  PID:13820
- C:\Windows\System\xYfhuXh.exe
  C:\Windows\System\xYfhuXh.exe
  2⤵
  PID:13856
- C:\Windows\System\tUvAYsV.exe
  C:\Windows\System\tUvAYsV.exe
  2⤵
  PID:14000
- C:\Windows\System\KMDykKp.exe
  C:\Windows\System\KMDykKp.exe
  2⤵
  PID:14016
- C:\Windows\System\EWTmuDM.exe
  C:\Windows\System\EWTmuDM.exe
  2⤵
  PID:14040
- C:\Windows\System\wOznLlx.exe
  C:\Windows\System\wOznLlx.exe
  2⤵
  PID:14072
- C:\Windows\System\SJdJDNE.exe
  C:\Windows\System\SJdJDNE.exe
  2⤵
  PID:14120
- C:\Windows\System\RjZQmyf.exe
  C:\Windows\System\RjZQmyf.exe
  2⤵
  PID:14152
- C:\Windows\System\LjPHZpe.exe
  C:\Windows\System\LjPHZpe.exe
  2⤵
  PID:14176
- C:\Windows\System\XiLMMGL.exe
  C:\Windows\System\XiLMMGL.exe
  2⤵
  PID:14200
- C:\Windows\System\uCUDguF.exe
  C:\Windows\System\uCUDguF.exe
  2⤵
  PID:14220
- C:\Windows\System\OUTLKcA.exe
  C:\Windows\System\OUTLKcA.exe
  2⤵
  PID:14252
- C:\Windows\System\gZvtPRY.exe
  C:\Windows\System\gZvtPRY.exe
  2⤵
  PID:14276
- C:\Windows\System\xTNCQFa.exe
  C:\Windows\System\xTNCQFa.exe
  2⤵
  PID:14296
- C:\Windows\System\PjZQoQE.exe
  C:\Windows\System\PjZQoQE.exe
  2⤵
  PID:13368
- C:\Windows\System\rJYFEgT.exe
  C:\Windows\System\rJYFEgT.exe
  2⤵
  PID:13416
- C:\Windows\System\SrvBlBS.exe
  C:\Windows\System\SrvBlBS.exe
  2⤵
  PID:13596
- C:\Windows\System\xgtDyzB.exe
  C:\Windows\System\xgtDyzB.exe
  2⤵
  PID:13480
- C:\Windows\System\aCOMqFI.exe
  C:\Windows\System\aCOMqFI.exe
  2⤵
  PID:13636
- C:\Windows\System\jukazhl.exe
  C:\Windows\System\jukazhl.exe
  2⤵
  PID:13376
- C:\Windows\System\sjyNajt.exe
  C:\Windows\System\sjyNajt.exe
  2⤵
  PID:1564
- C:\Windows\System\IaEhCXX.exe
  C:\Windows\System\IaEhCXX.exe
  2⤵
  PID:12272
- C:\Windows\System\dmqaUQN.exe
  C:\Windows\System\dmqaUQN.exe
  2⤵
  PID:14024
- C:\Windows\System\XiwBmpj.exe
  C:\Windows\System\XiwBmpj.exe
  2⤵
  PID:14216
- C:\Windows\System\CkOhoAC.exe
  C:\Windows\System\CkOhoAC.exe
  2⤵
  PID:14284
- C:\Windows\System\bMzjdKg.exe
  C:\Windows\System\bMzjdKg.exe
  2⤵
  PID:13548
- C:\Windows\System\zOHqvrs.exe
  C:\Windows\System\zOHqvrs.exe
  2⤵
  PID:5532
- C:\Windows\System\xSsQmiL.exe
  C:\Windows\System\xSsQmiL.exe
  2⤵
  PID:13392
- C:\Windows\System\WOlgxii.exe
  C:\Windows\System\WOlgxii.exe
  2⤵
  PID:13128
- C:\Windows\System\EKiCoKs.exe
  C:\Windows\System\EKiCoKs.exe
  2⤵
  PID:10204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_423csd5f.elx.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\CiSUwCO.exe

Filesize
1.9MB

MD5
0743aa23fcebf5046b3e4de36c0ff752

SHA1
02b5fb2df3f17a72394664ac47402953e9200f88

SHA256
70b0479304da66d96ccadcb17a1d533c6557a93641c2dcf737c6a5242ad75db0

SHA512
c7d9a140f89a7b45df1e2a9c3ae702478d626dd2a18fe5fd2320499fbfc863386747564b7d125bb1ab1d765c777160e74ad625e047ecd9ee716ce0ca1dc14948

Download Submit
C:\Windows\System\EPdKPXx.exe

Filesize
1.9MB

MD5
0a071a4cb084225bbe0c8c8133e9950d

SHA1
cab2c6ccc4a9281a9be3d560cb017b209ad63665

SHA256
4684aa677cc3bf9520115642b35a38da0dccbeedb1dd18b8b7602abb0e434366

SHA512
7dcbb19c8ba201e8a94573530bc19926c9e047b1049c2079f76847c26bb5a5bebdd0f8db09225b59715eec4f23e6048f70a92792db48d7cee055a4cbb69f26d5

Download Submit
C:\Windows\System\HFYsQku.exe

Filesize
1.9MB

MD5
a238c98782ac3d519810f7437a077af1

SHA1
cc30058c95cef50a7d8e02df2133b56c9405650e

SHA256
de24f12e1e04e60dc86bbde20f4dc81c8ab5b6749261d8478beb7b9a223039e8

SHA512
967b2ca99f33715bca3a3fe6a7845065715b05ac5e94ccdc822757199b32c82067b650fdd5efbb6dff0e6e021754641c0692e9c1d4a634c459889cd2a66aa974

Download Submit
C:\Windows\System\IjYtTVS.exe

Filesize
1.9MB

MD5
eee0e05e1dd0f0f1232f956f3cfdddd1

SHA1
27e00230b3bb75432dbae8d2688bb2ee65ac153f

SHA256
46551b6ce162d82d65d2f80905589fe6d542ef3324b46648f5d35f4dca756a5c

SHA512
250c0cc2ac3d4919c7de78286ac57c7918250b97eb2627313962a711b652562157aefccddcac0bfe3cff137c60f9d402d65b3e1d449ca9e13292a47b301eb127

Download Submit
C:\Windows\System\IyiCarU.exe

Filesize
1.9MB

MD5
eae17c7c2a58360d5047e328e9d1e4e6

SHA1
f89b8b1d61358220512a1590171c9fe7c0eed1f8

SHA256
5c29912315ee3853410155fe1441ef9b298ca3e90ddd89004af02332bfed75b1

SHA512
eade97d16f3a25c6d606303be680cd271ebbd8b74629687387efb72e2721669a87caffc617244fa19840fc96d5eb1eef8be13aabe96696d5d93bb1855727bb51

Download Submit
C:\Windows\System\JRehrqi.exe

Filesize
1.9MB

MD5
54611731148a5d8ca9e0ed3c999b2ab2

SHA1
c545fda28a3b37009e16b51b54b2421e72a2c609

SHA256
25a91614432cbb34299331e468a0c380092125d138f000104d0c6c4be7b5a416

SHA512
56c7e4ea7c8f47e694c0902a8987ba724f332c99f840df0f6ad9ad6060744f4aca774a8a3ca70fbdbdebb8a2012b780378099d58ad51645b9ce076b118ff65bf

Download Submit
C:\Windows\System\KZsYXYd.exe

Filesize
1.9MB

MD5
3dfccdb17c591d4d5503a47b7ebba35b

SHA1
a7733529371c97f502b0d6278f74c0291e39eb69

SHA256
8a9b9aac4aebe108e7ec558ee8dffc58fe623a2e574ff9bd5d5ea47b0c7ba59b

SHA512
f933b45f955f7ec26d875ec88b4adc9f968ecdefaffc18da6c70bbc7876e24d078835b8fe47cf8043c91495c6b8e01ccbd171c10ed6bdf2bdff17d1ba18b360b

Download Submit
C:\Windows\System\KpKUZkC.exe

Filesize
1.9MB

MD5
17f48dd4169918caaa3c354a29d414ad

SHA1
592b5cf8475c66b3cb347b76fccd86c0f339f6d4

SHA256
53645e299dc303122fbfa6929a9ac1f2b22b95a0a60357d95d625e8b0e0fe1ed

SHA512
1b29c05c338f74fbc381d5a04d81a30437201202986d359a0e34e499b29a91f563c80cdefc6656de8b80636290645dfb6eda72d84090556be215fd5b06612153

Download Submit
C:\Windows\System\NWchFyd.exe

Filesize
1.9MB

MD5
bd129695e479f8f65585e369d5f7f695

SHA1
226d5b3962fcb98219a45947db247e0ba1b1908d

SHA256
54a789c5e6ec3913eeba544a8f25f0f51c8f4199fa0373fff3b5dfc3fdf46037

SHA512
31db1a662754259c49ffa76517dd63a4c49e97a64611251bce0db72bafa995415ec96593d864c852420ec769694df73853d0350c2c13c5170de6a3d07d512665

Download Submit
C:\Windows\System\OaVVzHf.exe

Filesize
1.9MB

MD5
4862e56dafb8b0ebfea5787bf190676b

SHA1
90d909a83f47543c2145773400d30e5d638e8fa0

SHA256
a583d4808567acd7de051bf9b25d46f114acdaaccb22c9433db570aa9f2c007e

SHA512
f6a9ca57a5fd2b63633205b4c0bc64f413206028b0e58db9d7f448648d04ce9cc6647629052a8520e15ecc1c961e435ba4293935bc75a23186a262a3ca1e6a15

Download Submit
C:\Windows\System\PCkkgWC.exe

Filesize
1.9MB

MD5
4c92430b6107a856021a9d26f758e403

SHA1
ba85157e0484c1bfe808b0c348db52565b8e0eac

SHA256
71b73bff64c4b3518e8baf8955865f4be7b1cab18fc8376705639f654503ede9

SHA512
59bff2ad71538d204e663c852390a6a347a9d9eaa73aa6dc3deca7248cdf50a48dc16dd5080819ad5e3821835949a35539d7c20900cebd2a3e6dac846e1022c0

Download Submit
C:\Windows\System\PPRABGK.exe

Filesize
1.9MB

MD5
902d5bee628b390115725005dd6b06a8

SHA1
e25535901c93f2625ddc76e3bd3d3ebcc927c2f0

SHA256
20514e97eaf544819396a6715b0e93a7962f26a40da6bbd5a5311e38283a653d

SHA512
9fe5fe4a01dc88c9438fc175d1d6b0bcb88f91643fd4a809c5cb191b4477aa60f90b422732775d547732766858210be621cc63b21e358f15335e36f3520a26c6

Download Submit
C:\Windows\System\PWmcexS.exe

Filesize
1.9MB

MD5
30965a0bfe29ec007c77c192d86d7338

SHA1
7e4dbf33d35bc61bded4b983f35488f53c4169c2

SHA256
ebb92b5fc342eafe7856f1f56b14b96936aab3fd1cd8c4560c3edda6bddd7e26

SHA512
28045a16611547b5734737bd67ad1849318b9ddf2193fbe181f52afbc9a844a8cf0355268df1af9e3caf29a45421be30c53446d9f5b0a68c6db5109997cc6aa9

Download Submit
C:\Windows\System\TOLhtph.exe

Filesize
1.9MB

MD5
c6bd57614464977676d4f347da507679

SHA1
0b2c516b09d19070e8b25a5e873a1ae9da10ef8c

SHA256
48aa7449a3dea3a7bb780a6f2e7e809e5aa4b2af25e9dab494b581373bc1d82e

SHA512
b55cf8a9868c0e23e3b1e9d3d0634522447204f0cb5924ff5429fe22b01047fa8e7d15fc8e31a7454eff7958017a0728dad184615886941dc8cbb3eb9b4fe0e6

Download Submit
C:\Windows\System\XMXcgdG.exe

Filesize
1.9MB

MD5
ce0f8f29bb397f22542695a0525ee50b

SHA1
e3e3580b2afb3595536066d21095f808922731dd

SHA256
4d7775e427ba9ee29599947210b0a487d5e9eb110b479666ddc6194d01062173

SHA512
9da49b9cd28db6949011c0a90c9fbdecc4f5ce3e88ab5fd22112206dbb99727f36e78f95e08b3046a202c0f77c9a15e6a395208889173c887ea071769add7edc

Download Submit
C:\Windows\System\XXVjcVV.exe

Filesize
1.9MB

MD5
a48b1b8a3b8a81c399defc9fab11ed18

SHA1
6c389471b80fa108431ce527822439f21c877baf

SHA256
5d340d199ede92e21a192b54f3fb705ed2e23a321cc128986db278454f95ce99

SHA512
40c0a01ca306285eaf1f8dca22d05d2dc730c1803247e35ecac470b75d07ba7ec2e396cd4b15cad79dd4ab862844ac191dd2c4db3535af6208efcc7e648d5e4d

Download Submit
C:\Windows\System\XyAkiAH.exe

Filesize
1.9MB

MD5
095b1c69c90282d45c71610b8a587206

SHA1
9dd6aebb6cf4791d1635cc85d292f6c8a727ab36

SHA256
c820c98064b09df0ebd601a58c924b71f6a5e346e4daffac73767f45726b9c86

SHA512
0356f9d61efcb1fc93365ec4d06a6e4097c86119429f57b4c6c30584479f844a18d6460fc6cd0a972447329c55d828b1e70ccff20aa29d45e11642c991fdd6b0

Download Submit
C:\Windows\System\ZuUGRLG.exe

Filesize
1.9MB

MD5
8ef3e1cfd990b9989fc30476b643ed74

SHA1
3e90bf6416dccc81c2376b3234297aca73dbc1d4

SHA256
ef9246eb3b8c5f935874f069dd16444c0c8ac623caeae8c63c82cd2438efad37

SHA512
31816c2292485c7918c1c59c7c88ca850883fc5976b68aed467cce114fc3c43f6b36a7522770ff11f9f39c4a80042627a3cc721837f7be2f3179e897f22ed4a0

Download Submit
C:\Windows\System\bxcbtPm.exe

Filesize
1.9MB

MD5
dcb935a6107790097e70017a4ba8c56b

SHA1
1212e49a2f5b4c76196ae86aa5dc9aaca02c4ac0

SHA256
8e18208a651f9370ab65789abf68db3bb3728e0dc3fa99ffcce565daffcce71c

SHA512
b4e03d45f63b2df458624fed1fc3399b15a6d40c840874f5a23005eb02e18602b724edb815e6f98f000a4d82a00d07980071c18ea8ca864a11c64c2a28348e40

Download Submit
C:\Windows\System\ceGBzvz.exe

Filesize
1.9MB

MD5
766813677f0d05cf0362c7659f1c7adc

SHA1
ff47ded08849cf895efb9a1e08845a944a74ad00

SHA256
3d4f57d46bc46c617765f3d4119e7e7bd3cf16008514b0acbc6cdd394e829dba

SHA512
1365f4665cd711c97cd6fc514fb5490a926a8e8423e85cb11ecda0646969849b238f679a7524ca6b789bf8db96150f4296d4eb8985467192dc26c52beafeb387

Download Submit
C:\Windows\System\dKloBBR.exe

Filesize
1.9MB

MD5
a7fe0a3dc10a41eae110eaa54513e53b

SHA1
0b51b751714dc61f41cf66c332ae2fa0079323f5

SHA256
246f220d15586af702913f24e20ff61c5647f8b9090e2c716e7bd35c77f5aef2

SHA512
3612e9dd96e4e85b8e291795011ace77107c3680129a4f4ffc9e4df57621648d02c8f79fabf120cc53b16259f0c10b20ff53012699ad2053247b8e8cfd852dde

Download Submit
C:\Windows\System\etRKqVS.exe

Filesize
1.9MB

MD5
ad164f26ad81369ccddc6cb900746dba

SHA1
3796606c104cb336099cc72369ce70c7a77daf5d

SHA256
0344ee33413cc613ffe68ca667e7f459bd92f6645422478ab3b7eb97d79da761

SHA512
dea8cb07ed3b3f06b34e58fc1761fb142ad5e91df51284db02e9a559f6f9d1f871756e3450862dbae7565f2d1015806e45f2c084ca0de403a354eb4ffc82c038

Download Submit
C:\Windows\System\gOMaqut.exe

Filesize
1.9MB

MD5
ae86bfebd5bd0bb4df5422e004adad7b

SHA1
c50b0ea45835e14ce8a459b279cfb8730b63dbfe

SHA256
77d602f5357839157c244c28b6a5d02a07d58ebb3d42c6f80d6737b596c97467

SHA512
4caa53339f76eb9d462311daf94ad851ee543538507a6301c5ce21045b0f23faca0ef644fbc1149d5348b4d14e7854be20844a1d976afdea9a68ed3e31ebcc3b

Download Submit
C:\Windows\System\grSoOKy.exe

Filesize
1.9MB

MD5
93f0a8b73f1e75261d5345a4c640dc60

SHA1
312b37f9dede6f6dead6971506f8c6d68fa97dcc

SHA256
3e56ba1b95cda5e2f96ddaa229d66f12bd6ddcc118b8400c7a8b959eec7e6063

SHA512
a6b18d2cf7b9041ec580fd6b4123f8e2462fe715aea9c3beff60d9d266bad681f63eea208e7cd3609fb04c2204ec421738999b78e0f666e432ee7f38f2dcd27e

Download Submit
C:\Windows\System\jwbjpNX.exe

Filesize
1.9MB

MD5
5c6d8bdfea58c91e7a8976b71cf4af13

SHA1
593996569726ab9009317f44f675c51d59ccabe2

SHA256
4ead31b98c137bf0748092d441f7adbb93eb564f83fb87c6ddd7af4e25f1f8c0

SHA512
b049c97f4ed46f661427855ab00cca6ff002f7d169f7236ce4611f8497d2f6fbf95ace27ebacbc3990266da1f4fd2f415305b6f51ae72273b83261ece4442881

Download Submit
C:\Windows\System\kSZUHAN.exe

Filesize
1.9MB

MD5
1f63e70d6729ca7ad6d11fc59d7a0bee

SHA1
4d515eb64c8d7184521b8b5364e819df4cc8939c

SHA256
fcf728113e8c5fa37559f0fdcafcb7e1bce7a8c837228e1274b38f8330f76cd2

SHA512
ac9fd393b8db483eda7016b107e3e6b20c849dcbe1ce8e66a673b22263ec30fdf8b3eddabe6399769cadd65938d35d528572f563df12d6ab7b61da8f65b0c141

Download Submit
C:\Windows\System\lhxTyTO.exe

Filesize
1.9MB

MD5
cc8cff73d2cd371a6b663f305812f8dd

SHA1
137b78a991cad933d22438607101e070c96e9bcb

SHA256
7006f9277528d19bfb6da18f3671ee1e68122d334a5f1d526cb9240c8a5eb2c3

SHA512
46402f00708c0b46aac844aaaf7eda8e8c70f00d7376efead20951be32a33127bc6863eb3a3c6757df88fc36a119b1bc423b1469757d4419c08d8b06b83da99f

Download Submit
C:\Windows\System\llyYosK.exe

Filesize
1.9MB

MD5
1d7e211547472ac2e2a7cd2f7596947a

SHA1
0e286f752e0547cd2457bdfa2320167e27876eb4

SHA256
b7c47952f03fa10d6de29b3329dd032dc76a7f18f76b0caffee48997086ca57b

SHA512
0159f6087d42db5694c93eb17085909ca1a3d196310f0fb43b51a27b668ceb9e5e4009d21a3a5cdcc367ce5fcbe3feaa8a87ed571f660963288f074c19afa5db

Download Submit
C:\Windows\System\nVrJKHP.exe

Filesize
1.9MB

MD5
83996c9ba99126510b881652aefeddb2

SHA1
609beec7a46963e286283f66b6e08f268df75ebe

SHA256
720daf01c4870f0210a75ce67e8f606d3405c378199c3e6cf7290c6a10f76f5e

SHA512
a68d6576eb34a040bf375b3f362c6af3d9f855bc3e1f50091b67563251062ec9f48eedea7c631cfdb590b645353db6305621114dfe9eadad5028a265cc0c1694

Download Submit
C:\Windows\System\npwsBMx.exe

Filesize
1.9MB

MD5
b4defdca344955bd3709d55d196a34ec

SHA1
ce744e9653e10f15e310e3be00e1ad4ca3108626

SHA256
75158ffce6dcccaf4de64e925e33b31accc382f368c011adaa35dd7aeea931d0

SHA512
275fc5896269768d7aa8147e29f0da79c5d1f39edd6e25669a033a9595a85e8fdc722a3f48a3965f1516b2c17f1bbce9596e698b4d336d996266bb1d1df135bc

Download Submit
C:\Windows\System\oERHAvZ.exe

Filesize
1.9MB

MD5
426a89c8404722941d980c0cca58458d

SHA1
97ffc22a89a6d9bbc448846a81eeef06c9a62a0a

SHA256
22268411e1f65f1da00796a13daa8a853e1f96097a937f8e4ef56997cb94864f

SHA512
71b11bd8ad11d40833fc46c422fee68635509a6184d3cf454b23df4b4da450aaa475a94731a39a16e56789fa765c22d9369dbedaa7c6a76243bf5bbb9b1e40f8

Download Submit
C:\Windows\System\osnvuXB.exe

Filesize
1.9MB

MD5
5720251a67883695fe0956d2e7fb78b8

SHA1
c75e2a8e452a14c6bcc61918267fbd8539fd192d

SHA256
a965ed38cad2c4309cf7c3789288d0e00296843a36d1c1387cfe689eabc0be29

SHA512
0c9fb2e8b1ab2a13360a3fc19de9de5d2f9980dab9b2b28694cde218f679ab0ade6e841f7563342cb09d7788bfd180322d3828ab0ac10f44e2aebcfcd8f3de91

Download Submit
C:\Windows\System\rErySEd.exe

Filesize
1.9MB

MD5
37851282345b22af314d56903b066070

SHA1
03ccdb0274b91a5420e88675cd5d04de58b50eeb

SHA256
da48fdb7b800803f96cebd6ae850466036d78bd726858e6189fa69ad0c58427d

SHA512
6956b9fd5b94ae2dc25c285c07c5b89641179c8a07183b44d5df58221e51f7463443ee8e146795695e77c583e268961512cca7b3d73af352e54d126bee700a0a

Download Submit
C:\Windows\System\rogHeUz.exe

Filesize
1.9MB

MD5
b2cb8f6a0c8ba58b67e6dd2c3143a4a7

SHA1
7b8df3c64819cab1494a96e7d8758dd564bb74ac

SHA256
e9f264a594ac781f6fd87e8554bc01d97c4e614ad502175f59333546a7bcc597

SHA512
5e3be1c1e10246d6e1bf166f10f376df670fd4a89fd36bf5b595dca13c205595632afd0214d9162e3779802e2a65b6c9755b4bc153494326b02cfe4423495214

Download Submit
C:\Windows\System\tLDHRpW.exe

Filesize
1.9MB

MD5
649b7abb3a8b3a3ae817da41d9ef63b0

SHA1
ebee5f5b3fa8cd9075eaf4f17869816b34e14fde

SHA256
c3aa87409d030926507cc4aa4ae21e206d9ec4bc70d490aa2dd8b709407fde2f

SHA512
a036cfd133237ab296e006eb85a165313040cd94fab2353ea98f9aad7ebb371474aa19d703cdb865a6c37a5a06d57a8cf26664cbbb3deb1ead284681804e52c0

Download Submit
C:\Windows\System\teFWAYb.exe

Filesize
1.9MB

MD5
e5eb279cc535f4d511d6d2a72abdd9d0

SHA1
7f332c1bfd8c6e90487cf07a4b8691c2d2f672d6

SHA256
87973e5a60fb58f275c8ed13e8fd30bc50c949ea13c59a450ea351fd2a593b67

SHA512
d8546fb54811b9b78c8a46578d06c5c1d2da263a507ffe9d406f782bfe900042f03a5589306992552aaac04b68b7e068fcbbab5b10dbfce148133ee6cb8e47dd

Download Submit
C:\Windows\System\uYujgPe.exe

Filesize
8B

MD5
7e1e9fcc71af27d4f3a70b3e20ac77b9

SHA1
09ec64762a6dbe9e03ecdb61ea5de2d274d170f0

SHA256
2f18658787aeca4d305f9fde7c9bc7343e5969bd51ec0e2c8583a2e506b9b404

SHA512
3beada4b1cd8ead153972e6e1293d504f7cea2d7323223a87897681d13a0872baba6942b9d88c8943892c0ad02e1f51ed3730edd702cc7d53ab31d006770ca91

Download Submit
C:\Windows\System\ugcLTDy.exe

Filesize
1.9MB

MD5
918fb36e60be2d29f8714dc8ce7123cb

SHA1
49eeedd13b671b646a3dcb1c9f151a26a719e8e6

SHA256
312f53a960e7a65a9804c65971bf679e9f38c997bd562a8d85e99f3c2cae1d33

SHA512
a69d1549be1871829b16b70648009d5c66987d10df0c14da9b060be90c9605e0b254ce43afe70eee88a0301039a14ce2cf0c74c8451d8b70d09808eeac77eccf

Download Submit
C:\Windows\System\uhFRPOP.exe

Filesize
1.9MB

MD5
6d933a9b11152d1936776199e3d4a70f

SHA1
3cd268f6eca3c705305c314292a865270eb88f1f

SHA256
cb91d87faec7bc4c32df32257c09a48da18dc888c9dd213041c3aaf62bd4a9e7

SHA512
7a971d5bc7ac597b21a8ddee6fa655629f351090111637a42d87bc780539fccf5a45fbd8c1de6aa55192e07dfa1948b3b742291ad3fe9f21862fed8a1bbfe1ec

Download Submit
C:\Windows\System\ysuWQIC.exe

Filesize
1.9MB

MD5
c6415938eb770c0c5ed2434c56c8a0de

SHA1
e5ef10747cea7b43761f1cac1f4905b27970c7f6

SHA256
00cfc1ae7cb3a3b31bdc2416efd0f3c96eda57f41792704bd3ee7e96a93cba6f

SHA512
9b021a8f60dd53db6f4f730baa41c7b107336016066e17ef91f237053e71a2e443c76419fbfca9c84ee6030c23e3de0db62adf0e3fb2a91202bbc9608f14702e

Download Submit
C:\Windows\System\zWuWNkC.exe

Filesize
1.9MB

MD5
8730f402cc2b9bce1a106199d7681800

SHA1
c69b12934f1bb34647b14953082546cac351983e

SHA256
881b8cdac8d7f39fbd50405b844ab230fd0c2e368fe485566249d57a33ae4ec9

SHA512
596f784933bb7dc29572c108fb08069415da575995781084297b1d87ca2745d9950be9302b2383d76af05952d858c87b72bf7cd845977c8c4be099daf3c2744b

Download Submit
memory/332-2974-0x00007FF6F8B00000-0x00007FF6F8EF2000-memory.dmp

Filesize
3.9MB

Download
memory/332-371-0x00007FF6F8B00000-0x00007FF6F8EF2000-memory.dmp

Filesize
3.9MB

Download
memory/640-0-0x00007FF796300000-0x00007FF7966F2000-memory.dmp

Filesize
3.9MB

Download
memory/640-1-0x000001AD3BFB0000-0x000001AD3BFC0000-memory.dmp

Filesize
64KB

Download
memory/1524-376-0x00007FF733910000-0x00007FF733D02000-memory.dmp

Filesize
3.9MB

Download
memory/1524-2949-0x00007FF733910000-0x00007FF733D02000-memory.dmp

Filesize
3.9MB

Download
memory/1580-167-0x00007FF781940000-0x00007FF781D32000-memory.dmp

Filesize
3.9MB

Download
memory/1580-2962-0x00007FF781940000-0x00007FF781D32000-memory.dmp

Filesize
3.9MB

Download
memory/1720-249-0x00007FF6B0900000-0x00007FF6B0CF2000-memory.dmp

Filesize
3.9MB

Download
memory/1720-2982-0x00007FF6B0900000-0x00007FF6B0CF2000-memory.dmp

Filesize
3.9MB

Download
memory/1812-123-0x00007FF73B5B0000-0x00007FF73B9A2000-memory.dmp

Filesize
3.9MB

Download
memory/1812-2963-0x00007FF73B5B0000-0x00007FF73B9A2000-memory.dmp

Filesize
3.9MB

Download
memory/2296-269-0x00007FF6BA9F0000-0x00007FF6BADE2000-memory.dmp

Filesize
3.9MB

Download
memory/2296-2979-0x00007FF6BA9F0000-0x00007FF6BADE2000-memory.dmp

Filesize
3.9MB

Download
memory/2316-378-0x00007FF77F540000-0x00007FF77F932000-memory.dmp

Filesize
3.9MB

Download
memory/2316-2978-0x00007FF77F540000-0x00007FF77F932000-memory.dmp

Filesize
3.9MB

Download
memory/2344-63-0x0000022A75FE0000-0x0000022A75FF0000-memory.dmp

Filesize
64KB

Download
memory/2344-155-0x0000022A781D0000-0x0000022A781F2000-memory.dmp

Filesize
136KB

Download
memory/2344-94-0x0000022A75FE0000-0x0000022A75FF0000-memory.dmp

Filesize
64KB

Download
memory/2344-43-0x00007FFAE6C60000-0x00007FFAE7721000-memory.dmp

Filesize
10.8MB

Download
memory/2424-2971-0x00007FF6365D0000-0x00007FF6369C2000-memory.dmp

Filesize
3.9MB

Download
memory/2424-372-0x00007FF6365D0000-0x00007FF6369C2000-memory.dmp

Filesize
3.9MB

Download
memory/2528-238-0x00007FF716D50000-0x00007FF717142000-memory.dmp

Filesize
3.9MB

Download
memory/2528-2987-0x00007FF716D50000-0x00007FF717142000-memory.dmp

Filesize
3.9MB

Download
memory/2672-377-0x00007FF6D0F50000-0x00007FF6D1342000-memory.dmp

Filesize
3.9MB

Download
memory/2672-2955-0x00007FF6D0F50000-0x00007FF6D1342000-memory.dmp

Filesize
3.9MB

Download
memory/2736-164-0x00007FF6AB570000-0x00007FF6AB962000-memory.dmp

Filesize
3.9MB

Download
memory/2736-2959-0x00007FF6AB570000-0x00007FF6AB962000-memory.dmp

Filesize
3.9MB

Download
memory/2888-2967-0x00007FF67ADE0000-0x00007FF67B1D2000-memory.dmp

Filesize
3.9MB

Download
memory/2888-373-0x00007FF67ADE0000-0x00007FF67B1D2000-memory.dmp

Filesize
3.9MB

Download
memory/2960-264-0x00007FF6D0E60000-0x00007FF6D1252000-memory.dmp

Filesize
3.9MB

Download
memory/2960-2988-0x00007FF6D0E60000-0x00007FF6D1252000-memory.dmp

Filesize
3.9MB

Download
memory/3184-375-0x00007FF69BE60000-0x00007FF69C252000-memory.dmp

Filesize
3.9MB

Download
memory/3184-2966-0x00007FF69BE60000-0x00007FF69C252000-memory.dmp

Filesize
3.9MB

Download
memory/3344-321-0x00007FF66A8E0000-0x00007FF66ACD2000-memory.dmp

Filesize
3.9MB

Download
memory/3344-2983-0x00007FF66A8E0000-0x00007FF66ACD2000-memory.dmp

Filesize
3.9MB

Download
memory/3484-211-0x00007FF769CA0000-0x00007FF76A092000-memory.dmp

Filesize
3.9MB

Download
memory/3484-2958-0x00007FF769CA0000-0x00007FF76A092000-memory.dmp

Filesize
3.9MB

Download
memory/3716-2975-0x00007FF71CD60000-0x00007FF71D152000-memory.dmp

Filesize
3.9MB

Download
memory/3716-346-0x00007FF71CD60000-0x00007FF71D152000-memory.dmp

Filesize
3.9MB

Download
memory/3968-2953-0x00007FF6E50B0000-0x00007FF6E54A2000-memory.dmp

Filesize
3.9MB

Download
memory/3968-72-0x00007FF6E50B0000-0x00007FF6E54A2000-memory.dmp

Filesize
3.9MB

Download
memory/4028-2952-0x00007FF74AF30000-0x00007FF74B322000-memory.dmp

Filesize
3.9MB

Download
memory/4028-97-0x00007FF74AF30000-0x00007FF74B322000-memory.dmp

Filesize
3.9MB

Download
memory/4368-374-0x00007FF77AA40000-0x00007FF77AE32000-memory.dmp

Filesize
3.9MB

Download
memory/4368-3035-0x00007FF77AA40000-0x00007FF77AE32000-memory.dmp

Filesize
3.9MB

Download
memory/4396-379-0x00007FF608CB0000-0x00007FF6090A2000-memory.dmp

Filesize
3.9MB

Download
memory/4396-2970-0x00007FF608CB0000-0x00007FF6090A2000-memory.dmp

Filesize
3.9MB

Download