xmrig | 08c02d1df230fbcad5b6e12ce971fa6171eae8c63c26eb1b9021b7926ba68b20

Analysis

max time kernel
23s
max time network
32s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 15:08

Sharing

Copy URL Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
Size

1.8MB
MD5

010b3b1bbbb485f5fa1715de5e2abce3
SHA1

7dc102f8e505b8545138b15f69c515c2a1179046
SHA256

08c02d1df230fbcad5b6e12ce971fa6171eae8c63c26eb1b9021b7926ba68b20
SHA512

63a066fd777126f1ba2fd14deaf0c2dc8789295c95aaee4f8bdee210d0cd4ed6a1049e8c6ba8727ee6896948f20e35ade0cfa06cd029fb572032668f2dfbd17f
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrl9X:NABg

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 21 IoCs

miner

resource	yara_rule
behavioral2/memory/1576-207-0x00007FF62B710000-0x00007FF62BB02000-memory.dmp	xmrig
behavioral2/memory/2528-222-0x00007FF78D490000-0x00007FF78D882000-memory.dmp	xmrig
behavioral2/memory/1720-248-0x00007FF6F8CB0000-0x00007FF6F90A2000-memory.dmp	xmrig
behavioral2/memory/3220-256-0x00007FF772990000-0x00007FF772D82000-memory.dmp	xmrig
behavioral2/memory/2140-265-0x00007FF7C1920000-0x00007FF7C1D12000-memory.dmp	xmrig
behavioral2/memory/332-269-0x00007FF754920000-0x00007FF754D12000-memory.dmp	xmrig
behavioral2/memory/2936-268-0x00007FF6CAC80000-0x00007FF6CB072000-memory.dmp	xmrig
behavioral2/memory/4264-267-0x00007FF6BA870000-0x00007FF6BAC62000-memory.dmp	xmrig
behavioral2/memory/5068-266-0x00007FF7E93A0000-0x00007FF7E9792000-memory.dmp	xmrig
behavioral2/memory/4768-264-0x00007FF6A11C0000-0x00007FF6A15B2000-memory.dmp	xmrig
behavioral2/memory/3828-263-0x00007FF685370000-0x00007FF685762000-memory.dmp	xmrig
behavioral2/memory/1108-262-0x00007FF6617D0000-0x00007FF661BC2000-memory.dmp	xmrig
behavioral2/memory/412-260-0x00007FF72C270000-0x00007FF72C662000-memory.dmp	xmrig
behavioral2/memory/3344-255-0x00007FF797060000-0x00007FF797452000-memory.dmp	xmrig
behavioral2/memory/1620-237-0x00007FF6BB720000-0x00007FF6BBB12000-memory.dmp	xmrig
behavioral2/memory/1908-161-0x00007FF604060000-0x00007FF604452000-memory.dmp	xmrig
behavioral2/memory/2252-125-0x00007FF7219A0000-0x00007FF721D92000-memory.dmp	xmrig
behavioral2/memory/3044-109-0x00007FF686000000-0x00007FF6863F2000-memory.dmp	xmrig
behavioral2/memory/4028-108-0x00007FF7D19A0000-0x00007FF7D1D92000-memory.dmp	xmrig
behavioral2/memory/3104-76-0x00007FF61D9F0000-0x00007FF61DDE2000-memory.dmp	xmrig
behavioral2/memory/1524-56-0x00007FF6E8A10000-0x00007FF6E8E02000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1524	IHhEUFU.exe
3104	cZrCJbG.exe
4264	baDmTbG.exe
4028	iJmOAdt.exe
3044	EntZfuo.exe
2252	RHdnUSt.exe
1908	cHfYmzU.exe
1576	obWeUiC.exe
2528	OicQJtV.exe
1620	cZMlHno.exe
1720	XwCoKRa.exe
2936	DfjwpNp.exe
3344	bfaROwt.exe
3220	mVgTEZX.exe
412	xMgKBiC.exe
332	AntWdQN.exe
1108	etqoydn.exe
3828	fmcQmyc.exe
4768	OSuhaGc.exe
2140	vcIKakM.exe
5068	AfJfrFY.exe
4368	sWWBoWp.exe
4996	VBRasKN.exe
4652	kyrxWUq.exe
4980	WleMqZA.exe
3068	nGaAPtX.exe
4528	IMBrBKO.exe
4040	exrkQQC.exe
4620	KcpzUJP.exe
2972	VZbivvT.exe
392	hHorDtu.exe
524	JkjUJuD.exe
452	TSerVOF.exe
4564	okqsjvo.exe
4428	uKssDJg.exe
2956	EpVdUQw.exe
60	owMQMHi.exe
2996	HzYaLpI.exe
1084	sBxPWyS.exe
404	cadelGH.exe
3768	VyeHGcE.exe
4372	EsSSNdh.exe
1100	tePupVT.exe
3536	IOVlHDe.exe
3460	yxINVhV.exe
2764	WglyBAs.exe
1152	tMGQYln.exe
2732	qIoScqD.exe
3268	fpfObjH.exe
2484	ThQPceS.exe
4452	kXanrcq.exe
2136	tQsdqgi.exe
4316	MiAKHbU.exe
3280	ROPPQsN.exe
4456	YUWenWy.exe
3868	ohpirlI.exe
1612	hsdKtKy.exe
3616	WLTOGGy.exe
5000	iddgbyu.exe
848	thAtmMn.exe
2304	YzHIZzI.exe
4184	IHbNHcf.exe
448	fMgOKTW.exe
2160	aZsZSBG.exe

UPX packed file 59 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2060-0-0x00007FF6C9480000-0x00007FF6C9872000-memory.dmp	upx
behavioral2/files/0x000c000000023b52-7.dat	upx
behavioral2/files/0x000b000000023bac-8.dat	upx
behavioral2/files/0x000a000000023bb0-6.dat	upx
behavioral2/files/0x000a000000023bb3-31.dat	upx
behavioral2/files/0x000a000000023bba-67.dat	upx
behavioral2/files/0x000a000000023bbf-88.dat	upx
behavioral2/files/0x000a000000023bbb-113.dat	upx
behavioral2/files/0x000a000000023bcd-163.dat	upx
behavioral2/files/0x000a000000023bc6-201.dat	upx
behavioral2/memory/1576-207-0x00007FF62B710000-0x00007FF62BB02000-memory.dmp	upx
behavioral2/memory/2528-222-0x00007FF78D490000-0x00007FF78D882000-memory.dmp	upx
behavioral2/memory/1720-248-0x00007FF6F8CB0000-0x00007FF6F90A2000-memory.dmp	upx
behavioral2/memory/3220-256-0x00007FF772990000-0x00007FF772D82000-memory.dmp	upx
behavioral2/memory/2140-265-0x00007FF7C1920000-0x00007FF7C1D12000-memory.dmp	upx
behavioral2/memory/332-269-0x00007FF754920000-0x00007FF754D12000-memory.dmp	upx
behavioral2/memory/2936-268-0x00007FF6CAC80000-0x00007FF6CB072000-memory.dmp	upx
behavioral2/memory/4264-267-0x00007FF6BA870000-0x00007FF6BAC62000-memory.dmp	upx
behavioral2/memory/5068-266-0x00007FF7E93A0000-0x00007FF7E9792000-memory.dmp	upx
behavioral2/memory/4768-264-0x00007FF6A11C0000-0x00007FF6A15B2000-memory.dmp	upx
behavioral2/memory/3828-263-0x00007FF685370000-0x00007FF685762000-memory.dmp	upx
behavioral2/memory/1108-262-0x00007FF6617D0000-0x00007FF661BC2000-memory.dmp	upx
behavioral2/memory/412-260-0x00007FF72C270000-0x00007FF72C662000-memory.dmp	upx
behavioral2/memory/3344-255-0x00007FF797060000-0x00007FF797452000-memory.dmp	upx
behavioral2/memory/1620-237-0x00007FF6BB720000-0x00007FF6BBB12000-memory.dmp	upx
behavioral2/files/0x000a000000023bc5-200.dat	upx
behavioral2/files/0x000a000000023bd2-199.dat	upx
behavioral2/files/0x000a000000023bd0-195.dat	upx
behavioral2/files/0x000a000000023bcb-191.dat	upx
behavioral2/files/0x000a000000023bcf-190.dat	upx
behavioral2/files/0x000b000000023bad-189.dat	upx
behavioral2/memory/1908-161-0x00007FF604060000-0x00007FF604452000-memory.dmp	upx
behavioral2/files/0x000a000000023bbe-155.dat	upx
behavioral2/files/0x000a000000023bcc-154.dat	upx
behavioral2/files/0x000a000000023bd1-198.dat	upx
behavioral2/files/0x000a000000023bc4-146.dat	upx
behavioral2/files/0x000a000000023bc3-143.dat	upx
behavioral2/files/0x000a000000023bbd-140.dat	upx
behavioral2/files/0x000a000000023bc1-137.dat	upx
behavioral2/files/0x000a000000023bc0-135.dat	upx
behavioral2/files/0x000a000000023bca-134.dat	upx
behavioral2/files/0x000a000000023bc9-133.dat	upx
behavioral2/files/0x000a000000023bc8-130.dat	upx
behavioral2/files/0x000a000000023bc2-139.dat	upx
behavioral2/files/0x000a000000023bbc-116.dat	upx
behavioral2/files/0x000a000000023bc7-112.dat	upx
behavioral2/memory/2252-125-0x00007FF7219A0000-0x00007FF721D92000-memory.dmp	upx
behavioral2/memory/3044-109-0x00007FF686000000-0x00007FF6863F2000-memory.dmp	upx
behavioral2/memory/4028-108-0x00007FF7D19A0000-0x00007FF7D1D92000-memory.dmp	upx
behavioral2/files/0x0031000000023bb8-94.dat	upx
behavioral2/files/0x000a000000023bb9-92.dat	upx
behavioral2/files/0x0031000000023bb6-79.dat	upx
behavioral2/memory/3104-76-0x00007FF61D9F0000-0x00007FF61DDE2000-memory.dmp	upx
behavioral2/files/0x0031000000023bb7-68.dat	upx
behavioral2/files/0x000a000000023bb4-60.dat	upx
behavioral2/files/0x000a000000023bb5-58.dat	upx
behavioral2/memory/1524-56-0x00007FF6E8A10000-0x00007FF6E8E02000-memory.dmp	upx
behavioral2/files/0x000a000000023bb2-38.dat	upx
behavioral2/files/0x000a000000023bb1-25.dat	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\uLrcGbE.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\hFgLDUz.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\bcqqyWc.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\tClmbXZ.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\EZgyTuR.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\hqNlOSN.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\zTyDmsL.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\MrddCda.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\YfTcBAn.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\VKeuIIn.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\XSOOiKG.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\NnkLamw.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\JXSRJoq.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\ouIsWRh.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\ErATbUA.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\RkRhwIb.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\jVnPInu.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\abBxIKu.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\cbkvVJK.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\FgubjxP.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\EntZfuo.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\KishTnF.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\RTcOKWH.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\wJJSYNs.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\HdzjlPr.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\etqoydn.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\vTXJXJD.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\SRdIaIT.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\wYGlzdW.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\bSVpKep.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\ThQPceS.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\OZmdpzT.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\AgDAlPH.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\eVRkeuB.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\IysneYy.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\IMhnuNG.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\SvJETsy.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\GvOQjGP.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\eXylkjv.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\NVRvsec.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\ikRCCQY.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\GxmfWNJ.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\noJWFBb.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\qtdUPHt.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\aofbGGb.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\VAwyHWC.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\WHkcDBH.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\mOFCsot.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\dXCzhCi.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\oPabqUb.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\UDarIWw.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\fUVmJCa.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\bQGLWeU.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\fRqilgh.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\nEfxcPl.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\owMQMHi.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\ptICbFF.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\xpbsOCZ.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\rMDEGRl.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\tUBXaIo.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\WrKgjvd.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\XwCoKRa.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\fpfObjH.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
File created	C:\Windows\System\EntRbWp.exe	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1560	powershell.exe
1560	powershell.exe
1560	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1560	powershell.exe
Token: SeLockMemoryPrivilege	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 1560	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	84
PID 2060 wrote to memory of 1560	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	84
PID 2060 wrote to memory of 1524	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	85
PID 2060 wrote to memory of 1524	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	85
PID 2060 wrote to memory of 3104	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	86
PID 2060 wrote to memory of 3104	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	86
PID 2060 wrote to memory of 4264	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	87
PID 2060 wrote to memory of 4264	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	87
PID 2060 wrote to memory of 4028	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	88
PID 2060 wrote to memory of 4028	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	88
PID 2060 wrote to memory of 3044	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	89
PID 2060 wrote to memory of 3044	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	89
PID 2060 wrote to memory of 2252	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	90
PID 2060 wrote to memory of 2252	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	90
PID 2060 wrote to memory of 1908	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	91
PID 2060 wrote to memory of 1908	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	91
PID 2060 wrote to memory of 1576	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	92
PID 2060 wrote to memory of 1576	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	92
PID 2060 wrote to memory of 1620	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	93
PID 2060 wrote to memory of 1620	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	93
PID 2060 wrote to memory of 2528	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	94
PID 2060 wrote to memory of 2528	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	94
PID 2060 wrote to memory of 1720	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	95
PID 2060 wrote to memory of 1720	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	95
PID 2060 wrote to memory of 2936	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	96
PID 2060 wrote to memory of 2936	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	96
PID 2060 wrote to memory of 3344	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	97
PID 2060 wrote to memory of 3344	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	97
PID 2060 wrote to memory of 3220	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	98
PID 2060 wrote to memory of 3220	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	98
PID 2060 wrote to memory of 412	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	99
PID 2060 wrote to memory of 412	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	99
PID 2060 wrote to memory of 5068	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	100
PID 2060 wrote to memory of 5068	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	100
PID 2060 wrote to memory of 332	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	101
PID 2060 wrote to memory of 332	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	101
PID 2060 wrote to memory of 1108	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	102
PID 2060 wrote to memory of 1108	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	102
PID 2060 wrote to memory of 3828	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	103
PID 2060 wrote to memory of 3828	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	103
PID 2060 wrote to memory of 4768	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	104
PID 2060 wrote to memory of 4768	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	104
PID 2060 wrote to memory of 2140	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	105
PID 2060 wrote to memory of 2140	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	105
PID 2060 wrote to memory of 4368	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	106
PID 2060 wrote to memory of 4368	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	106
PID 2060 wrote to memory of 4996	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	107
PID 2060 wrote to memory of 4996	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	107
PID 2060 wrote to memory of 4652	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	108
PID 2060 wrote to memory of 4652	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	108
PID 2060 wrote to memory of 4980	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	109
PID 2060 wrote to memory of 4980	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	109
PID 2060 wrote to memory of 3068	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	110
PID 2060 wrote to memory of 3068	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	110
PID 2060 wrote to memory of 4528	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	111
PID 2060 wrote to memory of 4528	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	111
PID 2060 wrote to memory of 4040	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	112
PID 2060 wrote to memory of 4040	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	112
PID 2060 wrote to memory of 4620	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	113
PID 2060 wrote to memory of 4620	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	113
PID 2060 wrote to memory of 4564	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	114
PID 2060 wrote to memory of 4564	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	114
PID 2060 wrote to memory of 2972	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	115
PID 2060 wrote to memory of 2972	2060	010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\010b3b1bbbb485f5fa1715de5e2abce3_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1560
- C:\Windows\System\IHhEUFU.exe
  C:\Windows\System\IHhEUFU.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\cZrCJbG.exe
  C:\Windows\System\cZrCJbG.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\baDmTbG.exe
  C:\Windows\System\baDmTbG.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\iJmOAdt.exe
  C:\Windows\System\iJmOAdt.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\EntZfuo.exe
  C:\Windows\System\EntZfuo.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\RHdnUSt.exe
  C:\Windows\System\RHdnUSt.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\cHfYmzU.exe
  C:\Windows\System\cHfYmzU.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\obWeUiC.exe
  C:\Windows\System\obWeUiC.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\cZMlHno.exe
  C:\Windows\System\cZMlHno.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\OicQJtV.exe
  C:\Windows\System\OicQJtV.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\XwCoKRa.exe
  C:\Windows\System\XwCoKRa.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\DfjwpNp.exe
  C:\Windows\System\DfjwpNp.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\bfaROwt.exe
  C:\Windows\System\bfaROwt.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System\mVgTEZX.exe
  C:\Windows\System\mVgTEZX.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\xMgKBiC.exe
  C:\Windows\System\xMgKBiC.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\AfJfrFY.exe
  C:\Windows\System\AfJfrFY.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\AntWdQN.exe
  C:\Windows\System\AntWdQN.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\etqoydn.exe
  C:\Windows\System\etqoydn.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\fmcQmyc.exe
  C:\Windows\System\fmcQmyc.exe
  2⤵
  - Executes dropped EXE
  PID:3828
- C:\Windows\System\OSuhaGc.exe
  C:\Windows\System\OSuhaGc.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\vcIKakM.exe
  C:\Windows\System\vcIKakM.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\sWWBoWp.exe
  C:\Windows\System\sWWBoWp.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\VBRasKN.exe
  C:\Windows\System\VBRasKN.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\kyrxWUq.exe
  C:\Windows\System\kyrxWUq.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\WleMqZA.exe
  C:\Windows\System\WleMqZA.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\nGaAPtX.exe
  C:\Windows\System\nGaAPtX.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\IMBrBKO.exe
  C:\Windows\System\IMBrBKO.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\exrkQQC.exe
  C:\Windows\System\exrkQQC.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\KcpzUJP.exe
  C:\Windows\System\KcpzUJP.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\okqsjvo.exe
  C:\Windows\System\okqsjvo.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\VZbivvT.exe
  C:\Windows\System\VZbivvT.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\hHorDtu.exe
  C:\Windows\System\hHorDtu.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\VyeHGcE.exe
  C:\Windows\System\VyeHGcE.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\JkjUJuD.exe
  C:\Windows\System\JkjUJuD.exe
  2⤵
  - Executes dropped EXE
  PID:524
- C:\Windows\System\TSerVOF.exe
  C:\Windows\System\TSerVOF.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\uKssDJg.exe
  C:\Windows\System\uKssDJg.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\EpVdUQw.exe
  C:\Windows\System\EpVdUQw.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\owMQMHi.exe
  C:\Windows\System\owMQMHi.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\HzYaLpI.exe
  C:\Windows\System\HzYaLpI.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\sBxPWyS.exe
  C:\Windows\System\sBxPWyS.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\cadelGH.exe
  C:\Windows\System\cadelGH.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\EsSSNdh.exe
  C:\Windows\System\EsSSNdh.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\tePupVT.exe
  C:\Windows\System\tePupVT.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\IOVlHDe.exe
  C:\Windows\System\IOVlHDe.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\yxINVhV.exe
  C:\Windows\System\yxINVhV.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\WglyBAs.exe
  C:\Windows\System\WglyBAs.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\tMGQYln.exe
  C:\Windows\System\tMGQYln.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\qIoScqD.exe
  C:\Windows\System\qIoScqD.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\fpfObjH.exe
  C:\Windows\System\fpfObjH.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\ThQPceS.exe
  C:\Windows\System\ThQPceS.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\kXanrcq.exe
  C:\Windows\System\kXanrcq.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\tQsdqgi.exe
  C:\Windows\System\tQsdqgi.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\MiAKHbU.exe
  C:\Windows\System\MiAKHbU.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\ROPPQsN.exe
  C:\Windows\System\ROPPQsN.exe
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Windows\System\YUWenWy.exe
  C:\Windows\System\YUWenWy.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\ohpirlI.exe
  C:\Windows\System\ohpirlI.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\hsdKtKy.exe
  C:\Windows\System\hsdKtKy.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\WLTOGGy.exe
  C:\Windows\System\WLTOGGy.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\iddgbyu.exe
  C:\Windows\System\iddgbyu.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\thAtmMn.exe
  C:\Windows\System\thAtmMn.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\YzHIZzI.exe
  C:\Windows\System\YzHIZzI.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\IHbNHcf.exe
  C:\Windows\System\IHbNHcf.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\fMgOKTW.exe
  C:\Windows\System\fMgOKTW.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\lkzSmXe.exe
  C:\Windows\System\lkzSmXe.exe
  2⤵
  PID:2800
- C:\Windows\System\aZsZSBG.exe
  C:\Windows\System\aZsZSBG.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\HRVoXtf.exe
  C:\Windows\System\HRVoXtf.exe
  2⤵
  PID:2376
- C:\Windows\System\MoTfACl.exe
  C:\Windows\System\MoTfACl.exe
  2⤵
  PID:4172
- C:\Windows\System\nvTuTvA.exe
  C:\Windows\System\nvTuTvA.exe
  2⤵
  PID:4484
- C:\Windows\System\IMhnuNG.exe
  C:\Windows\System\IMhnuNG.exe
  2⤵
  PID:4536
- C:\Windows\System\oQEZAme.exe
  C:\Windows\System\oQEZAme.exe
  2⤵
  PID:5044
- C:\Windows\System\ptICbFF.exe
  C:\Windows\System\ptICbFF.exe
  2⤵
  PID:1928
- C:\Windows\System\SvJETsy.exe
  C:\Windows\System\SvJETsy.exe
  2⤵
  PID:3968
- C:\Windows\System\CwsMSXB.exe
  C:\Windows\System\CwsMSXB.exe
  2⤵
  PID:2660
- C:\Windows\System\zNIkrbE.exe
  C:\Windows\System\zNIkrbE.exe
  2⤵
  PID:2524
- C:\Windows\System\XBJhokR.exe
  C:\Windows\System\XBJhokR.exe
  2⤵
  PID:4136
- C:\Windows\System\FPQRUKY.exe
  C:\Windows\System\FPQRUKY.exe
  2⤵
  PID:4900
- C:\Windows\System\NhpLpKe.exe
  C:\Windows\System\NhpLpKe.exe
  2⤵
  PID:2284
- C:\Windows\System\cHwCAzd.exe
  C:\Windows\System\cHwCAzd.exe
  2⤵
  PID:4436
- C:\Windows\System\HuoYNVw.exe
  C:\Windows\System\HuoYNVw.exe
  2⤵
  PID:1244
- C:\Windows\System\HxCQytC.exe
  C:\Windows\System\HxCQytC.exe
  2⤵
  PID:4408
- C:\Windows\System\DldIIrW.exe
  C:\Windows\System\DldIIrW.exe
  2⤵
  PID:1924
- C:\Windows\System\HYLKmsq.exe
  C:\Windows\System\HYLKmsq.exe
  2⤵
  PID:3876
- C:\Windows\System\AlBOfEk.exe
  C:\Windows\System\AlBOfEk.exe
  2⤵
  PID:4036
- C:\Windows\System\mPwDBVw.exe
  C:\Windows\System\mPwDBVw.exe
  2⤵
  PID:4552
- C:\Windows\System\bCSKGAE.exe
  C:\Windows\System\bCSKGAE.exe
  2⤵
  PID:3596
- C:\Windows\System\xjoTaON.exe
  C:\Windows\System\xjoTaON.exe
  2⤵
  PID:4012
- C:\Windows\System\AMhyzAH.exe
  C:\Windows\System\AMhyzAH.exe
  2⤵
  PID:3972
- C:\Windows\System\cWhiQDZ.exe
  C:\Windows\System\cWhiQDZ.exe
  2⤵
  PID:2360
- C:\Windows\System\mOFCsot.exe
  C:\Windows\System\mOFCsot.exe
  2⤵
  PID:3948
- C:\Windows\System\YJSsYWy.exe
  C:\Windows\System\YJSsYWy.exe
  2⤵
  PID:1824
- C:\Windows\System\jxpxybV.exe
  C:\Windows\System\jxpxybV.exe
  2⤵
  PID:312
- C:\Windows\System\tGjTxgm.exe
  C:\Windows\System\tGjTxgm.exe
  2⤵
  PID:3348
- C:\Windows\System\hyAtSIb.exe
  C:\Windows\System\hyAtSIb.exe
  2⤵
  PID:4512
- C:\Windows\System\YghkuNj.exe
  C:\Windows\System\YghkuNj.exe
  2⤵
  PID:5072
- C:\Windows\System\tTbFtVT.exe
  C:\Windows\System\tTbFtVT.exe
  2⤵
  PID:3520
- C:\Windows\System\QTHqmFH.exe
  C:\Windows\System\QTHqmFH.exe
  2⤵
  PID:4396
- C:\Windows\System\AnXgtoS.exe
  C:\Windows\System\AnXgtoS.exe
  2⤵
  PID:1644
- C:\Windows\System\qAEXRdk.exe
  C:\Windows\System\qAEXRdk.exe
  2⤵
  PID:3124
- C:\Windows\System\twGNget.exe
  C:\Windows\System\twGNget.exe
  2⤵
  PID:1932
- C:\Windows\System\jkojoLP.exe
  C:\Windows\System\jkojoLP.exe
  2⤵
  PID:2456
- C:\Windows\System\vUjOsSh.exe
  C:\Windows\System\vUjOsSh.exe
  2⤵
  PID:5132
- C:\Windows\System\UjeFxEb.exe
  C:\Windows\System\UjeFxEb.exe
  2⤵
  PID:5156
- C:\Windows\System\iudxDhT.exe
  C:\Windows\System\iudxDhT.exe
  2⤵
  PID:5192
- C:\Windows\System\IuYRcNr.exe
  C:\Windows\System\IuYRcNr.exe
  2⤵
  PID:5212
- C:\Windows\System\AHKHsLR.exe
  C:\Windows\System\AHKHsLR.exe
  2⤵
  PID:5232
- C:\Windows\System\tOEFTqX.exe
  C:\Windows\System\tOEFTqX.exe
  2⤵
  PID:5256
- C:\Windows\System\EZgyTuR.exe
  C:\Windows\System\EZgyTuR.exe
  2⤵
  PID:5276
- C:\Windows\System\QDXLAyv.exe
  C:\Windows\System\QDXLAyv.exe
  2⤵
  PID:5328
- C:\Windows\System\pfQHXgS.exe
  C:\Windows\System\pfQHXgS.exe
  2⤵
  PID:5344
- C:\Windows\System\GXWjRdU.exe
  C:\Windows\System\GXWjRdU.exe
  2⤵
  PID:5372
- C:\Windows\System\zpCSlYU.exe
  C:\Windows\System\zpCSlYU.exe
  2⤵
  PID:5392
- C:\Windows\System\BISFTZI.exe
  C:\Windows\System\BISFTZI.exe
  2⤵
  PID:5416
- C:\Windows\System\qWDkIaM.exe
  C:\Windows\System\qWDkIaM.exe
  2⤵
  PID:5444
- C:\Windows\System\aEdtXCr.exe
  C:\Windows\System\aEdtXCr.exe
  2⤵
  PID:5464
- C:\Windows\System\KvTqqzn.exe
  C:\Windows\System\KvTqqzn.exe
  2⤵
  PID:5492
- C:\Windows\System\BYYPiXi.exe
  C:\Windows\System\BYYPiXi.exe
  2⤵
  PID:5508
- C:\Windows\System\wGICQqb.exe
  C:\Windows\System\wGICQqb.exe
  2⤵
  PID:5532
- C:\Windows\System\KishTnF.exe
  C:\Windows\System\KishTnF.exe
  2⤵
  PID:5548
- C:\Windows\System\hFrjxaN.exe
  C:\Windows\System\hFrjxaN.exe
  2⤵
  PID:5572
- C:\Windows\System\xpbsOCZ.exe
  C:\Windows\System\xpbsOCZ.exe
  2⤵
  PID:5592
- C:\Windows\System\buyBefg.exe
  C:\Windows\System\buyBefg.exe
  2⤵
  PID:5616
- C:\Windows\System\dYxQHaU.exe
  C:\Windows\System\dYxQHaU.exe
  2⤵
  PID:5636
- C:\Windows\System\swvNYyw.exe
  C:\Windows\System\swvNYyw.exe
  2⤵
  PID:5656
- C:\Windows\System\iEtqOHT.exe
  C:\Windows\System\iEtqOHT.exe
  2⤵
  PID:5672
- C:\Windows\System\FBJSdoN.exe
  C:\Windows\System\FBJSdoN.exe
  2⤵
  PID:5700
- C:\Windows\System\vPUftEb.exe
  C:\Windows\System\vPUftEb.exe
  2⤵
  PID:5724
- C:\Windows\System\jhGQZJS.exe
  C:\Windows\System\jhGQZJS.exe
  2⤵
  PID:5744
- C:\Windows\System\QWcbWTu.exe
  C:\Windows\System\QWcbWTu.exe
  2⤵
  PID:5768
- C:\Windows\System\hgQOCxo.exe
  C:\Windows\System\hgQOCxo.exe
  2⤵
  PID:5788
- C:\Windows\System\aBqUZVR.exe
  C:\Windows\System\aBqUZVR.exe
  2⤵
  PID:5812
- C:\Windows\System\PTyhRGq.exe
  C:\Windows\System\PTyhRGq.exe
  2⤵
  PID:5832
- C:\Windows\System\oQuAtFT.exe
  C:\Windows\System\oQuAtFT.exe
  2⤵
  PID:5860
- C:\Windows\System\OdGLiWZ.exe
  C:\Windows\System\OdGLiWZ.exe
  2⤵
  PID:5880
- C:\Windows\System\oTJerLH.exe
  C:\Windows\System\oTJerLH.exe
  2⤵
  PID:5900
- C:\Windows\System\bJXzmLC.exe
  C:\Windows\System\bJXzmLC.exe
  2⤵
  PID:5920
- C:\Windows\System\zMwTfcE.exe
  C:\Windows\System\zMwTfcE.exe
  2⤵
  PID:5940
- C:\Windows\System\cSeLnih.exe
  C:\Windows\System\cSeLnih.exe
  2⤵
  PID:5960
- C:\Windows\System\bFrRynV.exe
  C:\Windows\System\bFrRynV.exe
  2⤵
  PID:5980
- C:\Windows\System\pixkvcq.exe
  C:\Windows\System\pixkvcq.exe
  2⤵
  PID:6004
- C:\Windows\System\OZmdpzT.exe
  C:\Windows\System\OZmdpzT.exe
  2⤵
  PID:6028
- C:\Windows\System\egseZWk.exe
  C:\Windows\System\egseZWk.exe
  2⤵
  PID:6048
- C:\Windows\System\GvOQjGP.exe
  C:\Windows\System\GvOQjGP.exe
  2⤵
  PID:6072
- C:\Windows\System\iejxwoN.exe
  C:\Windows\System\iejxwoN.exe
  2⤵
  PID:6088
- C:\Windows\System\JuGGZbm.exe
  C:\Windows\System\JuGGZbm.exe
  2⤵
  PID:6112
- C:\Windows\System\YVgGqqO.exe
  C:\Windows\System\YVgGqqO.exe
  2⤵
  PID:6128
- C:\Windows\System\gTrBrOY.exe
  C:\Windows\System\gTrBrOY.exe
  2⤵
  PID:1192
- C:\Windows\System\DgZhsIH.exe
  C:\Windows\System\DgZhsIH.exe
  2⤵
  PID:4944
- C:\Windows\System\OLAQiUI.exe
  C:\Windows\System\OLAQiUI.exe
  2⤵
  PID:852
- C:\Windows\System\fZdcrZC.exe
  C:\Windows\System\fZdcrZC.exe
  2⤵
  PID:5220
- C:\Windows\System\ebrhGFp.exe
  C:\Windows\System\ebrhGFp.exe
  2⤵
  PID:5152
- C:\Windows\System\XifJZyn.exe
  C:\Windows\System\XifJZyn.exe
  2⤵
  PID:3252
- C:\Windows\System\yinsOFT.exe
  C:\Windows\System\yinsOFT.exe
  2⤵
  PID:5272
- C:\Windows\System\eFaLwIZ.exe
  C:\Windows\System\eFaLwIZ.exe
  2⤵
  PID:5268
- C:\Windows\System\WQFyyFX.exe
  C:\Windows\System\WQFyyFX.exe
  2⤵
  PID:5352
- C:\Windows\System\Aqwkcuv.exe
  C:\Windows\System\Aqwkcuv.exe
  2⤵
  PID:5360
- C:\Windows\System\ZGFttBc.exe
  C:\Windows\System\ZGFttBc.exe
  2⤵
  PID:5648
- C:\Windows\System\UDarIWw.exe
  C:\Windows\System\UDarIWw.exe
  2⤵
  PID:5384
- C:\Windows\System\ZhSMkEc.exe
  C:\Windows\System\ZhSMkEc.exe
  2⤵
  PID:5412
- C:\Windows\System\ZsLjiDP.exe
  C:\Windows\System\ZsLjiDP.exe
  2⤵
  PID:5504
- C:\Windows\System\rKpKXQV.exe
  C:\Windows\System\rKpKXQV.exe
  2⤵
  PID:5852
- C:\Windows\System\bdGwvhv.exe
  C:\Windows\System\bdGwvhv.exe
  2⤵
  PID:5896
- C:\Windows\System\aYmXOZP.exe
  C:\Windows\System\aYmXOZP.exe
  2⤵
  PID:5544
- C:\Windows\System\mHhjUrS.exe
  C:\Windows\System\mHhjUrS.exe
  2⤵
  PID:5612
- C:\Windows\System\wYGlzdW.exe
  C:\Windows\System\wYGlzdW.exe
  2⤵
  PID:5632
- C:\Windows\System\dnpZYOf.exe
  C:\Windows\System\dnpZYOf.exe
  2⤵
  PID:5696
- C:\Windows\System\ZRWKpIs.exe
  C:\Windows\System\ZRWKpIs.exe
  2⤵
  PID:6080
- C:\Windows\System\mfZQiJK.exe
  C:\Windows\System\mfZQiJK.exe
  2⤵
  PID:5284
- C:\Windows\System\ibvNKdJ.exe
  C:\Windows\System\ibvNKdJ.exe
  2⤵
  PID:5776
- C:\Windows\System\VFNslRb.exe
  C:\Windows\System\VFNslRb.exe
  2⤵
  PID:5500
- C:\Windows\System\UbNsCqy.exe
  C:\Windows\System\UbNsCqy.exe
  2⤵
  PID:6156
- C:\Windows\System\iECbyCA.exe
  C:\Windows\System\iECbyCA.exe
  2⤵
  PID:6176
- C:\Windows\System\ESipodE.exe
  C:\Windows\System\ESipodE.exe
  2⤵
  PID:6200
- C:\Windows\System\DCindBt.exe
  C:\Windows\System\DCindBt.exe
  2⤵
  PID:6220
- C:\Windows\System\DYtCnqU.exe
  C:\Windows\System\DYtCnqU.exe
  2⤵
  PID:6240
- C:\Windows\System\PEbvWHh.exe
  C:\Windows\System\PEbvWHh.exe
  2⤵
  PID:6260
- C:\Windows\System\eMBiCKb.exe
  C:\Windows\System\eMBiCKb.exe
  2⤵
  PID:6284
- C:\Windows\System\nCMdXCp.exe
  C:\Windows\System\nCMdXCp.exe
  2⤵
  PID:6308
- C:\Windows\System\MzpoyEl.exe
  C:\Windows\System\MzpoyEl.exe
  2⤵
  PID:6328
- C:\Windows\System\quLxqga.exe
  C:\Windows\System\quLxqga.exe
  2⤵
  PID:6352
- C:\Windows\System\dXCzhCi.exe
  C:\Windows\System\dXCzhCi.exe
  2⤵
  PID:6368
- C:\Windows\System\DnwqReI.exe
  C:\Windows\System\DnwqReI.exe
  2⤵
  PID:6396
- C:\Windows\System\ApOLIfg.exe
  C:\Windows\System\ApOLIfg.exe
  2⤵
  PID:6412
- C:\Windows\System\jfirLpI.exe
  C:\Windows\System\jfirLpI.exe
  2⤵
  PID:6440
- C:\Windows\System\hFgLDUz.exe
  C:\Windows\System\hFgLDUz.exe
  2⤵
  PID:6472
- C:\Windows\System\FSEvixW.exe
  C:\Windows\System\FSEvixW.exe
  2⤵
  PID:6488
- C:\Windows\System\nJSYJnI.exe
  C:\Windows\System\nJSYJnI.exe
  2⤵
  PID:6508
- C:\Windows\System\JTYCGgk.exe
  C:\Windows\System\JTYCGgk.exe
  2⤵
  PID:6528
- C:\Windows\System\JNDhFKA.exe
  C:\Windows\System\JNDhFKA.exe
  2⤵
  PID:6548
- C:\Windows\System\haXFKHs.exe
  C:\Windows\System\haXFKHs.exe
  2⤵
  PID:6564
- C:\Windows\System\CWihydD.exe
  C:\Windows\System\CWihydD.exe
  2⤵
  PID:6588
- C:\Windows\System\DZOaPza.exe
  C:\Windows\System\DZOaPza.exe
  2⤵
  PID:6612
- C:\Windows\System\GckyLoj.exe
  C:\Windows\System\GckyLoj.exe
  2⤵
  PID:6628
- C:\Windows\System\tutuECV.exe
  C:\Windows\System\tutuECV.exe
  2⤵
  PID:6656
- C:\Windows\System\XBDRETQ.exe
  C:\Windows\System\XBDRETQ.exe
  2⤵
  PID:6676
- C:\Windows\System\dVirzhp.exe
  C:\Windows\System\dVirzhp.exe
  2⤵
  PID:6692
- C:\Windows\System\xzXmyfu.exe
  C:\Windows\System\xzXmyfu.exe
  2⤵
  PID:6712
- C:\Windows\System\sBCgydi.exe
  C:\Windows\System\sBCgydi.exe
  2⤵
  PID:6736
- C:\Windows\System\JMoOYTD.exe
  C:\Windows\System\JMoOYTD.exe
  2⤵
  PID:6752
- C:\Windows\System\Vzjfpte.exe
  C:\Windows\System\Vzjfpte.exe
  2⤵
  PID:6776
- C:\Windows\System\fVODkWb.exe
  C:\Windows\System\fVODkWb.exe
  2⤵
  PID:6800
- C:\Windows\System\ftiNUyM.exe
  C:\Windows\System\ftiNUyM.exe
  2⤵
  PID:6816
- C:\Windows\System\eMKLFOf.exe
  C:\Windows\System\eMKLFOf.exe
  2⤵
  PID:6844
- C:\Windows\System\uLrcGbE.exe
  C:\Windows\System\uLrcGbE.exe
  2⤵
  PID:6860
- C:\Windows\System\BKyoQUa.exe
  C:\Windows\System\BKyoQUa.exe
  2⤵
  PID:6884
- C:\Windows\System\dmnvypc.exe
  C:\Windows\System\dmnvypc.exe
  2⤵
  PID:7012
- C:\Windows\System\FlCpVoA.exe
  C:\Windows\System\FlCpVoA.exe
  2⤵
  PID:7048
- C:\Windows\System\xczuafS.exe
  C:\Windows\System\xczuafS.exe
  2⤵
  PID:7068
- C:\Windows\System\hEipRXo.exe
  C:\Windows\System\hEipRXo.exe
  2⤵
  PID:7092
- C:\Windows\System\IvYbKtn.exe
  C:\Windows\System\IvYbKtn.exe
  2⤵
  PID:7112
- C:\Windows\System\GbLJUBn.exe
  C:\Windows\System\GbLJUBn.exe
  2⤵
  PID:7132
- C:\Windows\System\AApheie.exe
  C:\Windows\System\AApheie.exe
  2⤵
  PID:7156
- C:\Windows\System\espRKco.exe
  C:\Windows\System\espRKco.exe
  2⤵
  PID:6056
- C:\Windows\System\AAjrhtV.exe
  C:\Windows\System\AAjrhtV.exe
  2⤵
  PID:5876
- C:\Windows\System\oUUmpAY.exe
  C:\Windows\System\oUUmpAY.exe
  2⤵
  PID:1484
- C:\Windows\System\ElDumIM.exe
  C:\Windows\System\ElDumIM.exe
  2⤵
  PID:5912
- C:\Windows\System\cWQEtcy.exe
  C:\Windows\System\cWQEtcy.exe
  2⤵
  PID:5800
- C:\Windows\System\MyBPHzc.exe
  C:\Windows\System\MyBPHzc.exe
  2⤵
  PID:6064
- C:\Windows\System\AMkcYuG.exe
  C:\Windows\System\AMkcYuG.exe
  2⤵
  PID:5968
- C:\Windows\System\PszEzvl.exe
  C:\Windows\System\PszEzvl.exe
  2⤵
  PID:5092
- C:\Windows\System\VAwyHWC.exe
  C:\Windows\System\VAwyHWC.exe
  2⤵
  PID:4508
- C:\Windows\System\VRDXvCw.exe
  C:\Windows\System\VRDXvCw.exe
  2⤵
  PID:5204
- C:\Windows\System\ChFscrq.exe
  C:\Windows\System\ChFscrq.exe
  2⤵
  PID:5436
- C:\Windows\System\VaKgBRz.exe
  C:\Windows\System\VaKgBRz.exe
  2⤵
  PID:6172
- C:\Windows\System\oyjAccZ.exe
  C:\Windows\System\oyjAccZ.exe
  2⤵
  PID:6812
- C:\Windows\System\HyGgndZ.exe
  C:\Windows\System\HyGgndZ.exe
  2⤵
  PID:6340
- C:\Windows\System\swuZgME.exe
  C:\Windows\System\swuZgME.exe
  2⤵
  PID:6892
- C:\Windows\System\BZkeQvJ.exe
  C:\Windows\System\BZkeQvJ.exe
  2⤵
  PID:6420
- C:\Windows\System\KKJPVHk.exe
  C:\Windows\System\KKJPVHk.exe
  2⤵
  PID:5972
- C:\Windows\System\yFncNUv.exe
  C:\Windows\System\yFncNUv.exe
  2⤵
  PID:6484
- C:\Windows\System\WhPmbQs.exe
  C:\Windows\System\WhPmbQs.exe
  2⤵
  PID:6236
- C:\Windows\System\riWKDxw.exe
  C:\Windows\System\riWKDxw.exe
  2⤵
  PID:6648
- C:\Windows\System\DQlutlW.exe
  C:\Windows\System\DQlutlW.exe
  2⤵
  PID:6732
- C:\Windows\System\GKlYYuM.exe
  C:\Windows\System\GKlYYuM.exe
  2⤵
  PID:7172
- C:\Windows\System\CluRlzn.exe
  C:\Windows\System\CluRlzn.exe
  2⤵
  PID:7196
- C:\Windows\System\OEOleMl.exe
  C:\Windows\System\OEOleMl.exe
  2⤵
  PID:7216
- C:\Windows\System\pYbmLUw.exe
  C:\Windows\System\pYbmLUw.exe
  2⤵
  PID:7236
- C:\Windows\System\glhNMRG.exe
  C:\Windows\System\glhNMRG.exe
  2⤵
  PID:7260
- C:\Windows\System\tfltAKP.exe
  C:\Windows\System\tfltAKP.exe
  2⤵
  PID:7284
- C:\Windows\System\OJuPxLy.exe
  C:\Windows\System\OJuPxLy.exe
  2⤵
  PID:7312
- C:\Windows\System\OgLwqhE.exe
  C:\Windows\System\OgLwqhE.exe
  2⤵
  PID:7340
- C:\Windows\System\UTzaQZZ.exe
  C:\Windows\System\UTzaQZZ.exe
  2⤵
  PID:7360
- C:\Windows\System\QSslFxJ.exe
  C:\Windows\System\QSslFxJ.exe
  2⤵
  PID:7384
- C:\Windows\System\NBvyuvj.exe
  C:\Windows\System\NBvyuvj.exe
  2⤵
  PID:7400
- C:\Windows\System\ajykmBF.exe
  C:\Windows\System\ajykmBF.exe
  2⤵
  PID:7424
- C:\Windows\System\wEgwrtC.exe
  C:\Windows\System\wEgwrtC.exe
  2⤵
  PID:7444
- C:\Windows\System\OxVHouv.exe
  C:\Windows\System\OxVHouv.exe
  2⤵
  PID:7468
- C:\Windows\System\aIuHvGq.exe
  C:\Windows\System\aIuHvGq.exe
  2⤵
  PID:7488
- C:\Windows\System\fJdHEpP.exe
  C:\Windows\System\fJdHEpP.exe
  2⤵
  PID:7508
- C:\Windows\System\lpXxQHn.exe
  C:\Windows\System\lpXxQHn.exe
  2⤵
  PID:7528
- C:\Windows\System\sDDhjrx.exe
  C:\Windows\System\sDDhjrx.exe
  2⤵
  PID:7552
- C:\Windows\System\ITQVRoa.exe
  C:\Windows\System\ITQVRoa.exe
  2⤵
  PID:7572
- C:\Windows\System\nUEIPdA.exe
  C:\Windows\System\nUEIPdA.exe
  2⤵
  PID:7600
- C:\Windows\System\zgAazfA.exe
  C:\Windows\System\zgAazfA.exe
  2⤵
  PID:7620
- C:\Windows\System\VyplmqK.exe
  C:\Windows\System\VyplmqK.exe
  2⤵
  PID:7640
- C:\Windows\System\gLbykZu.exe
  C:\Windows\System\gLbykZu.exe
  2⤵
  PID:7660
- C:\Windows\System\WeoGMwd.exe
  C:\Windows\System\WeoGMwd.exe
  2⤵
  PID:7688
- C:\Windows\System\JuoZOii.exe
  C:\Windows\System\JuoZOii.exe
  2⤵
  PID:7708
- C:\Windows\System\jVnPInu.exe
  C:\Windows\System\jVnPInu.exe
  2⤵
  PID:7728
- C:\Windows\System\msFHeeB.exe
  C:\Windows\System\msFHeeB.exe
  2⤵
  PID:7748
- C:\Windows\System\rQtPdaA.exe
  C:\Windows\System\rQtPdaA.exe
  2⤵
  PID:7768
- C:\Windows\System\XyxFXzl.exe
  C:\Windows\System\XyxFXzl.exe
  2⤵
  PID:7784
- C:\Windows\System\PLoFfQL.exe
  C:\Windows\System\PLoFfQL.exe
  2⤵
  PID:7812
- C:\Windows\System\EYpbFHi.exe
  C:\Windows\System\EYpbFHi.exe
  2⤵
  PID:7832
- C:\Windows\System\JaAVhKl.exe
  C:\Windows\System\JaAVhKl.exe
  2⤵
  PID:7848
- C:\Windows\System\qnbrqKU.exe
  C:\Windows\System\qnbrqKU.exe
  2⤵
  PID:7872
- C:\Windows\System\bMhKgur.exe
  C:\Windows\System\bMhKgur.exe
  2⤵
  PID:7892
- C:\Windows\System\ytClCcw.exe
  C:\Windows\System\ytClCcw.exe
  2⤵
  PID:7920
- C:\Windows\System\sQEnCpk.exe
  C:\Windows\System\sQEnCpk.exe
  2⤵
  PID:7936
- C:\Windows\System\jZBVUZa.exe
  C:\Windows\System\jZBVUZa.exe
  2⤵
  PID:7964
- C:\Windows\System\JxDGdPq.exe
  C:\Windows\System\JxDGdPq.exe
  2⤵
  PID:7988
- C:\Windows\System\pkFZiHa.exe
  C:\Windows\System\pkFZiHa.exe
  2⤵
  PID:8008
- C:\Windows\System\tSSVaZD.exe
  C:\Windows\System\tSSVaZD.exe
  2⤵
  PID:8028
- C:\Windows\System\uchfZBP.exe
  C:\Windows\System\uchfZBP.exe
  2⤵
  PID:8044
- C:\Windows\System\wyyWuLU.exe
  C:\Windows\System\wyyWuLU.exe
  2⤵
  PID:8064
- C:\Windows\System\JrNjtDU.exe
  C:\Windows\System\JrNjtDU.exe
  2⤵
  PID:8088
- C:\Windows\System\AgDAlPH.exe
  C:\Windows\System\AgDAlPH.exe
  2⤵
  PID:8112
- C:\Windows\System\ZvUvnHy.exe
  C:\Windows\System\ZvUvnHy.exe
  2⤵
  PID:8140
- C:\Windows\System\zsKauIL.exe
  C:\Windows\System\zsKauIL.exe
  2⤵
  PID:8156
- C:\Windows\System\NnkLamw.exe
  C:\Windows\System\NnkLamw.exe
  2⤵
  PID:8180
- C:\Windows\System\XCpxECG.exe
  C:\Windows\System\XCpxECG.exe
  2⤵
  PID:6876
- C:\Windows\System\luimNnz.exe
  C:\Windows\System\luimNnz.exe
  2⤵
  PID:7100
- C:\Windows\System\sDbkDhi.exe
  C:\Windows\System\sDbkDhi.exe
  2⤵
  PID:7140
- C:\Windows\System\GhNBCra.exe
  C:\Windows\System\GhNBCra.exe
  2⤵
  PID:5828
- C:\Windows\System\vQNmIUQ.exe
  C:\Windows\System\vQNmIUQ.exe
  2⤵
  PID:5928
- C:\Windows\System\onwICQp.exe
  C:\Windows\System\onwICQp.exe
  2⤵
  PID:2212
- C:\Windows\System\YyKmzJb.exe
  C:\Windows\System\YyKmzJb.exe
  2⤵
  PID:1952
- C:\Windows\System\LbqgDUO.exe
  C:\Windows\System\LbqgDUO.exe
  2⤵
  PID:6060
- C:\Windows\System\IixONDH.exe
  C:\Windows\System\IixONDH.exe
  2⤵
  PID:6324
- C:\Windows\System\QVMmlWd.exe
  C:\Windows\System\QVMmlWd.exe
  2⤵
  PID:6972
- C:\Windows\System\atrrOym.exe
  C:\Windows\System\atrrOym.exe
  2⤵
  PID:7244
- C:\Windows\System\LAHjBFW.exe
  C:\Windows\System\LAHjBFW.exe
  2⤵
  PID:6728
- C:\Windows\System\tGCLJiK.exe
  C:\Windows\System\tGCLJiK.exe
  2⤵
  PID:6620
- C:\Windows\System\VkIoeBw.exe
  C:\Windows\System\VkIoeBw.exe
  2⤵
  PID:6500
- C:\Windows\System\wgKZQdE.exe
  C:\Windows\System\wgKZQdE.exe
  2⤵
  PID:7308
- C:\Windows\System\kIYCzNe.exe
  C:\Windows\System\kIYCzNe.exe
  2⤵
  PID:7376
- C:\Windows\System\OtzsUOU.exe
  C:\Windows\System\OtzsUOU.exe
  2⤵
  PID:6044
- C:\Windows\System\MFjOKoC.exe
  C:\Windows\System\MFjOKoC.exe
  2⤵
  PID:6956
- C:\Windows\System\bivndvO.exe
  C:\Windows\System\bivndvO.exe
  2⤵
  PID:7744
- C:\Windows\System\BfnpSEI.exe
  C:\Windows\System\BfnpSEI.exe
  2⤵
  PID:7844
- C:\Windows\System\aouaNkk.exe
  C:\Windows\System\aouaNkk.exe
  2⤵
  PID:7916
- C:\Windows\System\TbDDIOU.exe
  C:\Windows\System\TbDDIOU.exe
  2⤵
  PID:7208
- C:\Windows\System\zAjTkvO.exe
  C:\Windows\System\zAjTkvO.exe
  2⤵
  PID:7256
- C:\Windows\System\nlfFPiS.exe
  C:\Windows\System\nlfFPiS.exe
  2⤵
  PID:7036
- C:\Windows\System\VckffKZ.exe
  C:\Windows\System\VckffKZ.exe
  2⤵
  PID:8204
- C:\Windows\System\WqbZtRd.exe
  C:\Windows\System\WqbZtRd.exe
  2⤵
  PID:8224
- C:\Windows\System\SisDCPX.exe
  C:\Windows\System\SisDCPX.exe
  2⤵
  PID:8260
- C:\Windows\System\LVDEzhZ.exe
  C:\Windows\System\LVDEzhZ.exe
  2⤵
  PID:8284
- C:\Windows\System\HycTGZk.exe
  C:\Windows\System\HycTGZk.exe
  2⤵
  PID:8304
- C:\Windows\System\MtzKFKG.exe
  C:\Windows\System\MtzKFKG.exe
  2⤵
  PID:8324
- C:\Windows\System\JUzTnmu.exe
  C:\Windows\System\JUzTnmu.exe
  2⤵
  PID:8340
- C:\Windows\System\pjohuOc.exe
  C:\Windows\System\pjohuOc.exe
  2⤵
  PID:8368
- C:\Windows\System\URqZRno.exe
  C:\Windows\System\URqZRno.exe
  2⤵
  PID:8388
- C:\Windows\System\pZZtpBE.exe
  C:\Windows\System\pZZtpBE.exe
  2⤵
  PID:8412
- C:\Windows\System\rlIgiqg.exe
  C:\Windows\System\rlIgiqg.exe
  2⤵
  PID:8432
- C:\Windows\System\iaJEwfV.exe
  C:\Windows\System\iaJEwfV.exe
  2⤵
  PID:8452
- C:\Windows\System\XhWyjZA.exe
  C:\Windows\System\XhWyjZA.exe
  2⤵
  PID:8476
- C:\Windows\System\sqpTFCy.exe
  C:\Windows\System\sqpTFCy.exe
  2⤵
  PID:8500
- C:\Windows\System\axiloKF.exe
  C:\Windows\System\axiloKF.exe
  2⤵
  PID:8524
- C:\Windows\System\NraiTIJ.exe
  C:\Windows\System\NraiTIJ.exe
  2⤵
  PID:8544
- C:\Windows\System\yQjcadi.exe
  C:\Windows\System\yQjcadi.exe
  2⤵
  PID:8572
- C:\Windows\System\igZjyjT.exe
  C:\Windows\System\igZjyjT.exe
  2⤵
  PID:8592
- C:\Windows\System\dmYaJdl.exe
  C:\Windows\System\dmYaJdl.exe
  2⤵
  PID:8616
- C:\Windows\System\ZmvJlVO.exe
  C:\Windows\System\ZmvJlVO.exe
  2⤵
  PID:8636
- C:\Windows\System\OnNXCwO.exe
  C:\Windows\System\OnNXCwO.exe
  2⤵
  PID:8656
- C:\Windows\System\yMdApyJ.exe
  C:\Windows\System\yMdApyJ.exe
  2⤵
  PID:8680
- C:\Windows\System\hIpwWEr.exe
  C:\Windows\System\hIpwWEr.exe
  2⤵
  PID:8704
- C:\Windows\System\vOIZxBa.exe
  C:\Windows\System\vOIZxBa.exe
  2⤵
  PID:8728
- C:\Windows\System\ugakPcc.exe
  C:\Windows\System\ugakPcc.exe
  2⤵
  PID:8748
- C:\Windows\System\jzKDQVq.exe
  C:\Windows\System\jzKDQVq.exe
  2⤵
  PID:8772
- C:\Windows\System\DwXLgFs.exe
  C:\Windows\System\DwXLgFs.exe
  2⤵
  PID:8792
- C:\Windows\System\cuIHmza.exe
  C:\Windows\System\cuIHmza.exe
  2⤵
  PID:8816
- C:\Windows\System\vdrgDjl.exe
  C:\Windows\System\vdrgDjl.exe
  2⤵
  PID:8832
- C:\Windows\System\gojLGbp.exe
  C:\Windows\System\gojLGbp.exe
  2⤵
  PID:8856
- C:\Windows\System\abBxIKu.exe
  C:\Windows\System\abBxIKu.exe
  2⤵
  PID:8884
- C:\Windows\System\KLkwtGC.exe
  C:\Windows\System\KLkwtGC.exe
  2⤵
  PID:8904
- C:\Windows\System\GkJHjto.exe
  C:\Windows\System\GkJHjto.exe
  2⤵
  PID:8924
- C:\Windows\System\wKEmzBm.exe
  C:\Windows\System\wKEmzBm.exe
  2⤵
  PID:8940
- C:\Windows\System\cVRoBzG.exe
  C:\Windows\System\cVRoBzG.exe
  2⤵
  PID:8956
- C:\Windows\System\QXxlwdH.exe
  C:\Windows\System\QXxlwdH.exe
  2⤵
  PID:8976
- C:\Windows\System\pGXPWzm.exe
  C:\Windows\System\pGXPWzm.exe
  2⤵
  PID:8996
- C:\Windows\System\cKdxOrh.exe
  C:\Windows\System\cKdxOrh.exe
  2⤵
  PID:9020
- C:\Windows\System\CGCpebN.exe
  C:\Windows\System\CGCpebN.exe
  2⤵
  PID:9040
- C:\Windows\System\GHnkIcv.exe
  C:\Windows\System\GHnkIcv.exe
  2⤵
  PID:9060
- C:\Windows\System\KGNrEth.exe
  C:\Windows\System\KGNrEth.exe
  2⤵
  PID:9084
- C:\Windows\System\wXMoNjG.exe
  C:\Windows\System\wXMoNjG.exe
  2⤵
  PID:9100
- C:\Windows\System\OPZkGyk.exe
  C:\Windows\System\OPZkGyk.exe
  2⤵
  PID:9120
- C:\Windows\System\XGzjxAw.exe
  C:\Windows\System\XGzjxAw.exe
  2⤵
  PID:9140
- C:\Windows\System\kbUifhq.exe
  C:\Windows\System\kbUifhq.exe
  2⤵
  PID:9164
- C:\Windows\System\GphiXsz.exe
  C:\Windows\System\GphiXsz.exe
  2⤵
  PID:9208
- C:\Windows\System\zOoDRww.exe
  C:\Windows\System\zOoDRww.exe
  2⤵
  PID:8036
- C:\Windows\System\seYUEel.exe
  C:\Windows\System\seYUEel.exe
  2⤵
  PID:8084
- C:\Windows\System\TOGmwQu.exe
  C:\Windows\System\TOGmwQu.exe
  2⤵
  PID:8124
- C:\Windows\System\xqwcPii.exe
  C:\Windows\System\xqwcPii.exe
  2⤵
  PID:7464
- C:\Windows\System\ltTjdxS.exe
  C:\Windows\System\ltTjdxS.exe
  2⤵
  PID:7544
- C:\Windows\System\wztJyBF.exe
  C:\Windows\System\wztJyBF.exe
  2⤵
  PID:7128
- C:\Windows\System\MghSwcM.exe
  C:\Windows\System\MghSwcM.exe
  2⤵
  PID:6560
- C:\Windows\System\XgNGoPD.exe
  C:\Windows\System\XgNGoPD.exe
  2⤵
  PID:7676
- C:\Windows\System\ugijoeL.exe
  C:\Windows\System\ugijoeL.exe
  2⤵
  PID:6580
- C:\Windows\System\RTcOKWH.exe
  C:\Windows\System\RTcOKWH.exe
  2⤵
  PID:5316
- C:\Windows\System\gOMrAts.exe
  C:\Windows\System\gOMrAts.exe
  2⤵
  PID:7824
- C:\Windows\System\uGnYzGa.exe
  C:\Windows\System\uGnYzGa.exe
  2⤵
  PID:6208
- C:\Windows\System\CUHumpC.exe
  C:\Windows\System\CUHumpC.exe
  2⤵
  PID:8000
- C:\Windows\System\POvZzuR.exe
  C:\Windows\System\POvZzuR.exe
  2⤵
  PID:7232
- C:\Windows\System\QdyFNHP.exe
  C:\Windows\System\QdyFNHP.exe
  2⤵
  PID:8240
- C:\Windows\System\xOpuURA.exe
  C:\Windows\System\xOpuURA.exe
  2⤵
  PID:8072
- C:\Windows\System\tDGwaIB.exe
  C:\Windows\System\tDGwaIB.exe
  2⤵
  PID:9224
- C:\Windows\System\oaxYDuG.exe
  C:\Windows\System\oaxYDuG.exe
  2⤵
  PID:9384
- C:\Windows\System\qodPkWh.exe
  C:\Windows\System\qodPkWh.exe
  2⤵
  PID:9408
- C:\Windows\System\osZkogQ.exe
  C:\Windows\System\osZkogQ.exe
  2⤵
  PID:9424
- C:\Windows\System\sRXWvIq.exe
  C:\Windows\System\sRXWvIq.exe
  2⤵
  PID:9444
- C:\Windows\System\vdajRAV.exe
  C:\Windows\System\vdajRAV.exe
  2⤵
  PID:9464
- C:\Windows\System\GXLlVJz.exe
  C:\Windows\System\GXLlVJz.exe
  2⤵
  PID:9492
- C:\Windows\System\uSOedNf.exe
  C:\Windows\System\uSOedNf.exe
  2⤵
  PID:9512
- C:\Windows\System\htaGcdQ.exe
  C:\Windows\System\htaGcdQ.exe
  2⤵
  PID:9536
- C:\Windows\System\JQITDiB.exe
  C:\Windows\System\JQITDiB.exe
  2⤵
  PID:9560
- C:\Windows\System\UCWHTcz.exe
  C:\Windows\System\UCWHTcz.exe
  2⤵
  PID:9576
- C:\Windows\System\WkQhxLl.exe
  C:\Windows\System\WkQhxLl.exe
  2⤵
  PID:9604
- C:\Windows\System\dXYLOSd.exe
  C:\Windows\System\dXYLOSd.exe
  2⤵
  PID:9620
- C:\Windows\System\SCgFwrm.exe
  C:\Windows\System\SCgFwrm.exe
  2⤵
  PID:9644
- C:\Windows\System\jxZzFwz.exe
  C:\Windows\System\jxZzFwz.exe
  2⤵
  PID:9664
- C:\Windows\System\YwxiDjV.exe
  C:\Windows\System\YwxiDjV.exe
  2⤵
  PID:9692
- C:\Windows\System\HmVgxLn.exe
  C:\Windows\System\HmVgxLn.exe
  2⤵
  PID:9708
- C:\Windows\System\cNbZpXv.exe
  C:\Windows\System\cNbZpXv.exe
  2⤵
  PID:9724
- C:\Windows\System\niiaphY.exe
  C:\Windows\System\niiaphY.exe
  2⤵
  PID:9748
- C:\Windows\System\EkHJsAv.exe
  C:\Windows\System\EkHJsAv.exe
  2⤵
  PID:9768
- C:\Windows\System\ayvOmdx.exe
  C:\Windows\System\ayvOmdx.exe
  2⤵
  PID:9788
- C:\Windows\System\DhRftCO.exe
  C:\Windows\System\DhRftCO.exe
  2⤵
  PID:9808
- C:\Windows\System\Vdmyzzo.exe
  C:\Windows\System\Vdmyzzo.exe
  2⤵
  PID:9840
- C:\Windows\System\nxzIjcv.exe
  C:\Windows\System\nxzIjcv.exe
  2⤵
  PID:9860
- C:\Windows\System\bPRtPlO.exe
  C:\Windows\System\bPRtPlO.exe
  2⤵
  PID:9884
- C:\Windows\System\LjVvXTJ.exe
  C:\Windows\System\LjVvXTJ.exe
  2⤵
  PID:9912
- C:\Windows\System\RJXjFks.exe
  C:\Windows\System\RJXjFks.exe
  2⤵
  PID:9936
- C:\Windows\System\TReWEhJ.exe
  C:\Windows\System\TReWEhJ.exe
  2⤵
  PID:9952
- C:\Windows\System\GXtMJaj.exe
  C:\Windows\System\GXtMJaj.exe
  2⤵
  PID:9968
- C:\Windows\System\VoSOzcd.exe
  C:\Windows\System\VoSOzcd.exe
  2⤵
  PID:9988
- C:\Windows\System\jswVuEv.exe
  C:\Windows\System\jswVuEv.exe
  2⤵
  PID:10008
- C:\Windows\System\XLAXUsO.exe
  C:\Windows\System\XLAXUsO.exe
  2⤵
  PID:10032
- C:\Windows\System\fgRcGlL.exe
  C:\Windows\System\fgRcGlL.exe
  2⤵
  PID:10052
- C:\Windows\System\EntRbWp.exe
  C:\Windows\System\EntRbWp.exe
  2⤵
  PID:10068
- C:\Windows\System\bOQtgAm.exe
  C:\Windows\System\bOQtgAm.exe
  2⤵
  PID:10092
- C:\Windows\System\unxsfcC.exe
  C:\Windows\System\unxsfcC.exe
  2⤵
  PID:10116
- C:\Windows\System\adgYMIi.exe
  C:\Windows\System\adgYMIi.exe
  2⤵
  PID:10140
- C:\Windows\System\tPsYUek.exe
  C:\Windows\System\tPsYUek.exe
  2⤵
  PID:10164
- C:\Windows\System\wCZxKCU.exe
  C:\Windows\System\wCZxKCU.exe
  2⤵
  PID:10180
- C:\Windows\System\qtSPBZx.exe
  C:\Windows\System\qtSPBZx.exe
  2⤵
  PID:10212
- C:\Windows\System\WqcwgDE.exe
  C:\Windows\System\WqcwgDE.exe
  2⤵
  PID:10232
- C:\Windows\System\gpnPAbr.exe
  C:\Windows\System\gpnPAbr.exe
  2⤵
  PID:8104
- C:\Windows\System\vjimorp.exe
  C:\Windows\System\vjimorp.exe
  2⤵
  PID:8428
- C:\Windows\System\HTAlsnh.exe
  C:\Windows\System\HTAlsnh.exe
  2⤵
  PID:7524
- C:\Windows\System\bjrGeZv.exe
  C:\Windows\System\bjrGeZv.exe
  2⤵
  PID:7588
- C:\Windows\System\ikRCCQY.exe
  C:\Windows\System\ikRCCQY.exe
  2⤵
  PID:8608
- C:\Windows\System\jzJYpOv.exe
  C:\Windows\System\jzJYpOv.exe
  2⤵
  PID:6016
- C:\Windows\System\XXCyHGX.exe
  C:\Windows\System\XXCyHGX.exe
  2⤵
  PID:8672
- C:\Windows\System\WcTzpjY.exe
  C:\Windows\System\WcTzpjY.exe
  2⤵
  PID:8712
- C:\Windows\System\XfbaHtr.exe
  C:\Windows\System\XfbaHtr.exe
  2⤵
  PID:6708
- C:\Windows\System\AqzPKaP.exe
  C:\Windows\System\AqzPKaP.exe
  2⤵
  PID:8808
- C:\Windows\System\XhlFTTe.exe
  C:\Windows\System\XhlFTTe.exe
  2⤵
  PID:8920
- C:\Windows\System\zuenEqv.exe
  C:\Windows\System\zuenEqv.exe
  2⤵
  PID:8968
- C:\Windows\System\nKnrYnF.exe
  C:\Windows\System\nKnrYnF.exe
  2⤵
  PID:7764
- C:\Windows\System\nhpdWTa.exe
  C:\Windows\System\nhpdWTa.exe
  2⤵
  PID:1080
- C:\Windows\System\XXGsHwg.exe
  C:\Windows\System\XXGsHwg.exe
  2⤵
  PID:7864
- C:\Windows\System\JeMUmGC.exe
  C:\Windows\System\JeMUmGC.exe
  2⤵
  PID:9116
- C:\Windows\System\UBWFvig.exe
  C:\Windows\System\UBWFvig.exe
  2⤵
  PID:7884
- C:\Windows\System\FIZPBqV.exe
  C:\Windows\System\FIZPBqV.exe
  2⤵
  PID:8056
- C:\Windows\System\GhERTgr.exe
  C:\Windows\System\GhERTgr.exe
  2⤵
  PID:7408
- C:\Windows\System\kSLeThU.exe
  C:\Windows\System\kSLeThU.exe
  2⤵
  PID:7248
- C:\Windows\System\zCyrIen.exe
  C:\Windows\System\zCyrIen.exe
  2⤵
  PID:7792
- C:\Windows\System\CxjsLSe.exe
  C:\Windows\System\CxjsLSe.exe
  2⤵
  PID:7044
- C:\Windows\System\JFmLljC.exe
  C:\Windows\System\JFmLljC.exe
  2⤵
  PID:8348
- C:\Windows\System\Vlndvdb.exe
  C:\Windows\System\Vlndvdb.exe
  2⤵
  PID:8408
- C:\Windows\System\hqNlOSN.exe
  C:\Windows\System\hqNlOSN.exe
  2⤵
  PID:9292
- C:\Windows\System\OMScSbq.exe
  C:\Windows\System\OMScSbq.exe
  2⤵
  PID:7500
- C:\Windows\System\LztNBcn.exe
  C:\Windows\System\LztNBcn.exe
  2⤵
  PID:9320
- C:\Windows\System\opVyUjL.exe
  C:\Windows\System\opVyUjL.exe
  2⤵
  PID:7152
- C:\Windows\System\KJlvTmb.exe
  C:\Windows\System\KJlvTmb.exe
  2⤵
  PID:10256
- C:\Windows\System\ZuLeakF.exe
  C:\Windows\System\ZuLeakF.exe
  2⤵
  PID:10284
- C:\Windows\System\LQdfweK.exe
  C:\Windows\System\LQdfweK.exe
  2⤵
  PID:10308
- C:\Windows\System\xsiokFy.exe
  C:\Windows\System\xsiokFy.exe
  2⤵
  PID:10332
- C:\Windows\System\BnxIHDX.exe
  C:\Windows\System\BnxIHDX.exe
  2⤵
  PID:10356
- C:\Windows\System\SOqaGrw.exe
  C:\Windows\System\SOqaGrw.exe
  2⤵
  PID:10372
- C:\Windows\System\zUosvVt.exe
  C:\Windows\System\zUosvVt.exe
  2⤵
  PID:10396
- C:\Windows\System\lYDriYn.exe
  C:\Windows\System\lYDriYn.exe
  2⤵
  PID:10420
- C:\Windows\System\hRMzlWE.exe
  C:\Windows\System\hRMzlWE.exe
  2⤵
  PID:10440
- C:\Windows\System\EGejDsS.exe
  C:\Windows\System\EGejDsS.exe
  2⤵
  PID:10460
- C:\Windows\System\eGSCyva.exe
  C:\Windows\System\eGSCyva.exe
  2⤵
  PID:10484
- C:\Windows\System\QFuuARt.exe
  C:\Windows\System\QFuuARt.exe
  2⤵
  PID:10504
- C:\Windows\System\mVdHidZ.exe
  C:\Windows\System\mVdHidZ.exe
  2⤵
  PID:10528
- C:\Windows\System\AUVNcnI.exe
  C:\Windows\System\AUVNcnI.exe
  2⤵
  PID:10548
- C:\Windows\System\OiHNFZD.exe
  C:\Windows\System\OiHNFZD.exe
  2⤵
  PID:10572
- C:\Windows\System\uzLfzcz.exe
  C:\Windows\System\uzLfzcz.exe
  2⤵
  PID:10592
- C:\Windows\System\IkjyBVP.exe
  C:\Windows\System\IkjyBVP.exe
  2⤵
  PID:10616
- C:\Windows\System\BcRYZRx.exe
  C:\Windows\System\BcRYZRx.exe
  2⤵
  PID:10644
- C:\Windows\System\XyuuejK.exe
  C:\Windows\System\XyuuejK.exe
  2⤵
  PID:10668
- C:\Windows\System\DxGmSKp.exe
  C:\Windows\System\DxGmSKp.exe
  2⤵
  PID:10692
- C:\Windows\System\MhYXbOI.exe
  C:\Windows\System\MhYXbOI.exe
  2⤵
  PID:10712
- C:\Windows\System\PPkkcDi.exe
  C:\Windows\System\PPkkcDi.exe
  2⤵
  PID:10748
- C:\Windows\System\Bpgxraz.exe
  C:\Windows\System\Bpgxraz.exe
  2⤵
  PID:10768
- C:\Windows\System\nnLPbJw.exe
  C:\Windows\System\nnLPbJw.exe
  2⤵
  PID:10788
- C:\Windows\System\ptLyVba.exe
  C:\Windows\System\ptLyVba.exe
  2⤵
  PID:10812
- C:\Windows\System\wdnNkKL.exe
  C:\Windows\System\wdnNkKL.exe
  2⤵
  PID:10836
- C:\Windows\System\xypwDHE.exe
  C:\Windows\System\xypwDHE.exe
  2⤵
  PID:10860
- C:\Windows\System\YmLSWAL.exe
  C:\Windows\System\YmLSWAL.exe
  2⤵
  PID:10876
- C:\Windows\System\FGkKnNw.exe
  C:\Windows\System\FGkKnNw.exe
  2⤵
  PID:10896
- C:\Windows\System\yhbpjwW.exe
  C:\Windows\System\yhbpjwW.exe
  2⤵
  PID:10912
- C:\Windows\System\KFEBOww.exe
  C:\Windows\System\KFEBOww.exe
  2⤵
  PID:10928
- C:\Windows\System\otuUwUI.exe
  C:\Windows\System\otuUwUI.exe
  2⤵
  PID:10944
- C:\Windows\System\JXSRJoq.exe
  C:\Windows\System\JXSRJoq.exe
  2⤵
  PID:10960
- C:\Windows\System\fUVmJCa.exe
  C:\Windows\System\fUVmJCa.exe
  2⤵
  PID:10984
- C:\Windows\System\GhaytRv.exe
  C:\Windows\System\GhaytRv.exe
  2⤵
  PID:11008
- C:\Windows\System\SgzpCLV.exe
  C:\Windows\System\SgzpCLV.exe
  2⤵
  PID:11024
- C:\Windows\System\ntxJQxl.exe
  C:\Windows\System\ntxJQxl.exe
  2⤵
  PID:11044
- C:\Windows\System\izpKxvG.exe
  C:\Windows\System\izpKxvG.exe
  2⤵
  PID:11064
- C:\Windows\System\aMNRZLn.exe
  C:\Windows\System\aMNRZLn.exe
  2⤵
  PID:11088
- C:\Windows\System\XXtBbfY.exe
  C:\Windows\System\XXtBbfY.exe
  2⤵
  PID:11104
- C:\Windows\System\JuCLKBZ.exe
  C:\Windows\System\JuCLKBZ.exe
  2⤵
  PID:11128
- C:\Windows\System\aKqqSEA.exe
  C:\Windows\System\aKqqSEA.exe
  2⤵
  PID:11144
- C:\Windows\System\HVOOxOV.exe
  C:\Windows\System\HVOOxOV.exe
  2⤵
  PID:11172
- C:\Windows\System\mIJHbHU.exe
  C:\Windows\System\mIJHbHU.exe
  2⤵
  PID:11196
- C:\Windows\System\qmwYFcB.exe
  C:\Windows\System\qmwYFcB.exe
  2⤵
  PID:11216
- C:\Windows\System\LrQZKzR.exe
  C:\Windows\System\LrQZKzR.exe
  2⤵
  PID:11240
- C:\Windows\System\RikRJsC.exe
  C:\Windows\System\RikRJsC.exe
  2⤵
  PID:9392
- C:\Windows\System\YWRBsqm.exe
  C:\Windows\System\YWRBsqm.exe
  2⤵
  PID:8768
- C:\Windows\System\dldLrbf.exe
  C:\Windows\System\dldLrbf.exe
  2⤵
  PID:8788
- C:\Windows\System\EjLTmOT.exe
  C:\Windows\System\EjLTmOT.exe
  2⤵
  PID:8896
- C:\Windows\System\WOWguCC.exe
  C:\Windows\System\WOWguCC.exe
  2⤵
  PID:8932
- C:\Windows\System\VrYorjF.exe
  C:\Windows\System\VrYorjF.exe
  2⤵
  PID:9700
- C:\Windows\System\jQCcDfl.exe
  C:\Windows\System\jQCcDfl.exe
  2⤵
  PID:9764
- C:\Windows\System\oFehWOQ.exe
  C:\Windows\System\oFehWOQ.exe
  2⤵
  PID:9796
- C:\Windows\System\ZymlRGL.exe
  C:\Windows\System\ZymlRGL.exe
  2⤵
  PID:9852
- C:\Windows\System\cYiTRvL.exe
  C:\Windows\System\cYiTRvL.exe
  2⤵
  PID:9996
- C:\Windows\System\uGVaekP.exe
  C:\Windows\System\uGVaekP.exe
  2⤵
  PID:10132
- C:\Windows\System\VvndJux.exe
  C:\Windows\System\VvndJux.exe
  2⤵
  PID:7740
- C:\Windows\System\JpTUznB.exe
  C:\Windows\System\JpTUznB.exe
  2⤵
  PID:7480
- C:\Windows\System\BMaUyWh.exe
  C:\Windows\System\BMaUyWh.exe
  2⤵
  PID:5244
- C:\Windows\System\YLidjJY.exe
  C:\Windows\System\YLidjJY.exe
  2⤵
  PID:8600
- C:\Windows\System\McuaxXh.exe
  C:\Windows\System\McuaxXh.exe
  2⤵
  PID:8256
- C:\Windows\System\rNKuxAy.exe
  C:\Windows\System\rNKuxAy.exe
  2⤵
  PID:9012
- C:\Windows\System\eVHDSYZ.exe
  C:\Windows\System\eVHDSYZ.exe
  2⤵
  PID:7368
- C:\Windows\System\rdvgCpG.exe
  C:\Windows\System\rdvgCpG.exe
  2⤵
  PID:9220
- C:\Windows\System\oPabqUb.exe
  C:\Windows\System\oPabqUb.exe
  2⤵
  PID:11276
- C:\Windows\System\LZrBdGn.exe
  C:\Windows\System\LZrBdGn.exe
  2⤵
  PID:11300
- C:\Windows\System\edsJSVY.exe
  C:\Windows\System\edsJSVY.exe
  2⤵
  PID:11320
- C:\Windows\System\yocYuXH.exe
  C:\Windows\System\yocYuXH.exe
  2⤵
  PID:11340
- C:\Windows\System\rTyjukn.exe
  C:\Windows\System\rTyjukn.exe
  2⤵
  PID:11364
- C:\Windows\System\tbGqIfJ.exe
  C:\Windows\System\tbGqIfJ.exe
  2⤵
  PID:11388
- C:\Windows\System\dTjNbZz.exe
  C:\Windows\System\dTjNbZz.exe
  2⤵
  PID:11408
- C:\Windows\System\CNPSyvZ.exe
  C:\Windows\System\CNPSyvZ.exe
  2⤵
  PID:11432
- C:\Windows\System\lqlSPvt.exe
  C:\Windows\System\lqlSPvt.exe
  2⤵
  PID:11452
- C:\Windows\System\SMeyqod.exe
  C:\Windows\System\SMeyqod.exe
  2⤵
  PID:11476
- C:\Windows\System\mugXaeH.exe
  C:\Windows\System\mugXaeH.exe
  2⤵
  PID:11496
- C:\Windows\System\OHpYNgP.exe
  C:\Windows\System\OHpYNgP.exe
  2⤵
  PID:11512
- C:\Windows\System\rXfqgbd.exe
  C:\Windows\System\rXfqgbd.exe
  2⤵
  PID:11536
- C:\Windows\System\pyxZJlj.exe
  C:\Windows\System\pyxZJlj.exe
  2⤵
  PID:11556
- C:\Windows\System\gcqtOkr.exe
  C:\Windows\System\gcqtOkr.exe
  2⤵
  PID:11584
- C:\Windows\System\jvAniSd.exe
  C:\Windows\System\jvAniSd.exe
  2⤵
  PID:11608
- C:\Windows\System\KqGVvoi.exe
  C:\Windows\System\KqGVvoi.exe
  2⤵
  PID:11632
- C:\Windows\System\ZsIUixb.exe
  C:\Windows\System\ZsIUixb.exe
  2⤵
  PID:11652
- C:\Windows\System\TFQWcHP.exe
  C:\Windows\System\TFQWcHP.exe
  2⤵
  PID:11676
- C:\Windows\System\FSwHDJb.exe
  C:\Windows\System\FSwHDJb.exe
  2⤵
  PID:11696
- C:\Windows\System\gEkKIre.exe
  C:\Windows\System\gEkKIre.exe
  2⤵
  PID:11720
- C:\Windows\System\nAPfkiR.exe
  C:\Windows\System\nAPfkiR.exe
  2⤵
  PID:11740
- C:\Windows\System\TfMHNqO.exe
  C:\Windows\System\TfMHNqO.exe
  2⤵
  PID:11776
- C:\Windows\System\PfgXQMF.exe
  C:\Windows\System\PfgXQMF.exe
  2⤵
  PID:11792
- C:\Windows\System\mQLshvo.exe
  C:\Windows\System\mQLshvo.exe
  2⤵
  PID:11816
- C:\Windows\System\xhyfrPk.exe
  C:\Windows\System\xhyfrPk.exe
  2⤵
  PID:11836
- C:\Windows\System\KrnbkEy.exe
  C:\Windows\System\KrnbkEy.exe
  2⤵
  PID:11856
- C:\Windows\System\gvEWqlz.exe
  C:\Windows\System\gvEWqlz.exe
  2⤵
  PID:11880
- C:\Windows\System\YXtaavw.exe
  C:\Windows\System\YXtaavw.exe
  2⤵
  PID:11900
- C:\Windows\System\CyUtrcP.exe
  C:\Windows\System\CyUtrcP.exe
  2⤵
  PID:11924
- C:\Windows\System\sxAWwXH.exe
  C:\Windows\System\sxAWwXH.exe
  2⤵
  PID:11940
- C:\Windows\System\UXsfeZm.exe
  C:\Windows\System\UXsfeZm.exe
  2⤵
  PID:11956
- C:\Windows\System\bcqqyWc.exe
  C:\Windows\System\bcqqyWc.exe
  2⤵
  PID:11972
- C:\Windows\System\JIqLenb.exe
  C:\Windows\System\JIqLenb.exe
  2⤵
  PID:11992
- C:\Windows\System\PosSejv.exe
  C:\Windows\System\PosSejv.exe
  2⤵
  PID:12012
- C:\Windows\System\WLdHCsw.exe
  C:\Windows\System\WLdHCsw.exe
  2⤵
  PID:12028
- C:\Windows\System\NwlvXdB.exe
  C:\Windows\System\NwlvXdB.exe
  2⤵
  PID:12048
- C:\Windows\System\OQAxygo.exe
  C:\Windows\System\OQAxygo.exe
  2⤵
  PID:12064
- C:\Windows\System\eXylkjv.exe
  C:\Windows\System\eXylkjv.exe
  2⤵
  PID:12084
- C:\Windows\System\asHhoZI.exe
  C:\Windows\System\asHhoZI.exe
  2⤵
  PID:12112
- C:\Windows\System\hKqjJqM.exe
  C:\Windows\System\hKqjJqM.exe
  2⤵
  PID:12128
- C:\Windows\System\xjVfbYV.exe
  C:\Windows\System\xjVfbYV.exe
  2⤵
  PID:12148
- C:\Windows\System\eukWZKr.exe
  C:\Windows\System\eukWZKr.exe
  2⤵
  PID:12168
- C:\Windows\System\ujnYurb.exe
  C:\Windows\System\ujnYurb.exe
  2⤵
  PID:12192
- C:\Windows\System\eHAoabi.exe
  C:\Windows\System\eHAoabi.exe
  2⤵
  PID:12212
- C:\Windows\System\ouIsWRh.exe
  C:\Windows\System\ouIsWRh.exe
  2⤵
  PID:12232
- C:\Windows\System\IDMIYXb.exe
  C:\Windows\System\IDMIYXb.exe
  2⤵
  PID:12252
- C:\Windows\System\xEqAvSC.exe
  C:\Windows\System\xEqAvSC.exe
  2⤵
  PID:12276
- C:\Windows\System\dwjAtZz.exe
  C:\Windows\System\dwjAtZz.exe
  2⤵
  PID:6608
- C:\Windows\System\UWaNqLy.exe
  C:\Windows\System\UWaNqLy.exe
  2⤵
  PID:8512
- C:\Windows\System\pmWrOwH.exe
  C:\Windows\System\pmWrOwH.exe
  2⤵
  PID:8460
- C:\Windows\System\aWjtWby.exe
  C:\Windows\System\aWjtWby.exe
  2⤵
  PID:9352
- C:\Windows\System\GfXzoUU.exe
  C:\Windows\System\GfXzoUU.exe
  2⤵
  PID:8692
- C:\Windows\System\GJbhCte.exe
  C:\Windows\System\GJbhCte.exe
  2⤵
  PID:9420
- C:\Windows\System\bixtPDk.exe
  C:\Windows\System\bixtPDk.exe
  2⤵
  PID:10428
- C:\Windows\System\ECsGZgA.exe
  C:\Windows\System\ECsGZgA.exe
  2⤵
  PID:10480
- C:\Windows\System\tTkydKQ.exe
  C:\Windows\System\tTkydKQ.exe
  2⤵
  PID:9460
- C:\Windows\System\aILnVdS.exe
  C:\Windows\System\aILnVdS.exe
  2⤵
  PID:9488
- C:\Windows\System\VKeuIIn.exe
  C:\Windows\System\VKeuIIn.exe
  2⤵
  PID:9508
- C:\Windows\System\TntQcxf.exe
  C:\Windows\System\TntQcxf.exe
  2⤵
  PID:9548
- C:\Windows\System\tZjdgUK.exe
  C:\Windows\System\tZjdgUK.exe
  2⤵
  PID:10612
- C:\Windows\System\ftxWQsc.exe
  C:\Windows\System\ftxWQsc.exe
  2⤵
  PID:9628
- C:\Windows\System\PBFRhvV.exe
  C:\Windows\System\PBFRhvV.exe
  2⤵
  PID:9676
- C:\Windows\System\UJlCxbz.exe
  C:\Windows\System\UJlCxbz.exe
  2⤵
  PID:10844
- C:\Windows\System\cqKntIJ.exe
  C:\Windows\System\cqKntIJ.exe
  2⤵
  PID:10884
- C:\Windows\System\xbMMGbm.exe
  C:\Windows\System\xbMMGbm.exe
  2⤵
  PID:10924
- C:\Windows\System\TEApnNF.exe
  C:\Windows\System\TEApnNF.exe
  2⤵
  PID:9080
- C:\Windows\System\ErATbUA.exe
  C:\Windows\System\ErATbUA.exe
  2⤵
  PID:11020
- C:\Windows\System\jzBdKDS.exe
  C:\Windows\System\jzBdKDS.exe
  2⤵
  PID:11056
- C:\Windows\System\TwyznZx.exe
  C:\Windows\System\TwyznZx.exe
  2⤵
  PID:9948
- C:\Windows\System\mhCXlYo.exe
  C:\Windows\System\mhCXlYo.exe
  2⤵
  PID:11116
- C:\Windows\System\jFSaEFa.exe
  C:\Windows\System\jFSaEFa.exe
  2⤵
  PID:12292
- C:\Windows\System\HrpQlfj.exe
  C:\Windows\System\HrpQlfj.exe
  2⤵
  PID:12316
- C:\Windows\System\CqVJXTR.exe
  C:\Windows\System\CqVJXTR.exe
  2⤵
  PID:12336
- C:\Windows\System\dxYLfvV.exe
  C:\Windows\System\dxYLfvV.exe
  2⤵
  PID:12360
- C:\Windows\System\WrKgjvd.exe
  C:\Windows\System\WrKgjvd.exe
  2⤵
  PID:12380
- C:\Windows\System\AFBEMVg.exe
  C:\Windows\System\AFBEMVg.exe
  2⤵
  PID:12404
- C:\Windows\System\wtsrkHW.exe
  C:\Windows\System\wtsrkHW.exe
  2⤵
  PID:12432
- C:\Windows\System\xlpdlvV.exe
  C:\Windows\System\xlpdlvV.exe
  2⤵
  PID:12448
- C:\Windows\System\BCZogmV.exe
  C:\Windows\System\BCZogmV.exe
  2⤵
  PID:12472
- C:\Windows\System\HCdeHzG.exe
  C:\Windows\System\HCdeHzG.exe
  2⤵
  PID:12488
- C:\Windows\System\yNuzGJG.exe
  C:\Windows\System\yNuzGJG.exe
  2⤵
  PID:12508
- C:\Windows\System\LGEJlAl.exe
  C:\Windows\System\LGEJlAl.exe
  2⤵
  PID:12536
- C:\Windows\System\ftOWpvV.exe
  C:\Windows\System\ftOWpvV.exe
  2⤵
  PID:12556
- C:\Windows\System\LKNBAOD.exe
  C:\Windows\System\LKNBAOD.exe
  2⤵
  PID:12580
- C:\Windows\System\WYBDQmy.exe
  C:\Windows\System\WYBDQmy.exe
  2⤵
  PID:12600
- C:\Windows\System\VUxbIxu.exe
  C:\Windows\System\VUxbIxu.exe
  2⤵
  PID:12624
- C:\Windows\System\shlKPod.exe
  C:\Windows\System\shlKPod.exe
  2⤵
  PID:12644
- C:\Windows\System\wJJSYNs.exe
  C:\Windows\System\wJJSYNs.exe
  2⤵
  PID:12668
- C:\Windows\System\cNDGwWK.exe
  C:\Windows\System\cNDGwWK.exe
  2⤵
  PID:12688
- C:\Windows\System\hCQzirq.exe
  C:\Windows\System\hCQzirq.exe
  2⤵
  PID:12704
- C:\Windows\System\PZOdUhq.exe
  C:\Windows\System\PZOdUhq.exe
  2⤵
  PID:12728
- C:\Windows\System\cOnsJjP.exe
  C:\Windows\System\cOnsJjP.exe
  2⤵
  PID:12752
- C:\Windows\System\OhZRAsR.exe
  C:\Windows\System\OhZRAsR.exe
  2⤵
  PID:12776
- C:\Windows\System\SBuNprg.exe
  C:\Windows\System\SBuNprg.exe
  2⤵
  PID:12792
- C:\Windows\System\irWycIE.exe
  C:\Windows\System\irWycIE.exe
  2⤵
  PID:12808
- C:\Windows\System\bSVpKep.exe
  C:\Windows\System\bSVpKep.exe
  2⤵
  PID:12828
- C:\Windows\System\nAitQAU.exe
  C:\Windows\System\nAitQAU.exe
  2⤵
  PID:12844
- C:\Windows\System\Ruzxgrk.exe
  C:\Windows\System\Ruzxgrk.exe
  2⤵
  PID:12860
- C:\Windows\System\KgSvGPS.exe
  C:\Windows\System\KgSvGPS.exe
  2⤵
  PID:12880
- C:\Windows\System\ahkxaaS.exe
  C:\Windows\System\ahkxaaS.exe
  2⤵
  PID:12896
- C:\Windows\System\TCZzIkW.exe
  C:\Windows\System\TCZzIkW.exe
  2⤵
  PID:12920
- C:\Windows\System\zTyDmsL.exe
  C:\Windows\System\zTyDmsL.exe
  2⤵
  PID:12944
- C:\Windows\System\dCUPCvc.exe
  C:\Windows\System\dCUPCvc.exe
  2⤵
  PID:12964
- C:\Windows\System\eBHibfo.exe
  C:\Windows\System\eBHibfo.exe
  2⤵
  PID:12984
- C:\Windows\System\CpFuddm.exe
  C:\Windows\System\CpFuddm.exe
  2⤵
  PID:13004
- C:\Windows\System\fDYURhn.exe
  C:\Windows\System\fDYURhn.exe
  2⤵
  PID:13024
- C:\Windows\System\ivhjIus.exe
  C:\Windows\System\ivhjIus.exe
  2⤵
  PID:10200
- C:\Windows\System\YktQMyZ.exe
  C:\Windows\System\YktQMyZ.exe
  2⤵
  PID:10280
- C:\Windows\System\dEarjvY.exe
  C:\Windows\System\dEarjvY.exe
  2⤵
  PID:7164
- C:\Windows\System\OZehQJt.exe
  C:\Windows\System\OZehQJt.exe
  2⤵
  PID:11124
- C:\Windows\System\hTnqOCw.exe
  C:\Windows\System\hTnqOCw.exe
  2⤵
  PID:11212
- C:\Windows\System\pOCVUHy.exe
  C:\Windows\System\pOCVUHy.exe
  2⤵
  PID:12504
- C:\Windows\System\bbMEldH.exe
  C:\Windows\System\bbMEldH.exe
  2⤵
  PID:12608
- C:\Windows\System\seozHIJ.exe
  C:\Windows\System\seozHIJ.exe
  2⤵
  PID:12700
- C:\Windows\System\iaEdjwp.exe
  C:\Windows\System\iaEdjwp.exe
  2⤵
  PID:9052
- C:\Windows\System\SFgmhcK.exe
  C:\Windows\System\SFgmhcK.exe
  2⤵
  PID:12824
- C:\Windows\System\CbCboGj.exe
  C:\Windows\System\CbCboGj.exe
  2⤵
  PID:7332
- C:\Windows\System\igZKlCy.exe
  C:\Windows\System\igZKlCy.exe
  2⤵
  PID:8652
- C:\Windows\System\lQietCv.exe
  C:\Windows\System\lQietCv.exe
  2⤵
  PID:8296
- C:\Windows\System\EQrgaEM.exe
  C:\Windows\System\EQrgaEM.exe
  2⤵
  PID:11644
- C:\Windows\System\idhXREt.exe
  C:\Windows\System\idhXREt.exe
  2⤵
  PID:9380
- C:\Windows\System\MwJGqgH.exe
  C:\Windows\System\MwJGqgH.exe
  2⤵
  PID:11424
- C:\Windows\System\zqzLBAi.exe
  C:\Windows\System\zqzLBAi.exe
  2⤵
  PID:11712
- C:\Windows\System\kIcPRJD.exe
  C:\Windows\System\kIcPRJD.exe
  2⤵
  PID:10380
- C:\Windows\System\ruOakZf.exe
  C:\Windows\System\ruOakZf.exe
  2⤵
  PID:12856
- C:\Windows\System\JEeIivU.exe
  C:\Windows\System\JEeIivU.exe
  2⤵
  PID:12096
- C:\Windows\System\gDCTqxH.exe
  C:\Windows\System\gDCTqxH.exe
  2⤵
  PID:13268
- C:\Windows\System\uhhtYva.exe
  C:\Windows\System\uhhtYva.exe
  2⤵
  PID:9960
- C:\Windows\System\cIsjlsc.exe
  C:\Windows\System\cIsjlsc.exe
  2⤵
  PID:13048
- C:\Windows\System\SRdIaIT.exe
  C:\Windows\System\SRdIaIT.exe
  2⤵
  PID:12004
- C:\Windows\System\JtvXOQr.exe
  C:\Windows\System\JtvXOQr.exe
  2⤵
  PID:9280
- C:\Windows\System\SGHYnfC.exe
  C:\Windows\System\SGHYnfC.exe
  2⤵
  PID:12268
- C:\Windows\System\tjgqfpW.exe
  C:\Windows\System\tjgqfpW.exe
  2⤵
  PID:13196
- C:\Windows\System\sVWLVuB.exe
  C:\Windows\System\sVWLVuB.exe
  2⤵
  PID:10328
- C:\Windows\System\VSsPdeL.exe
  C:\Windows\System\VSsPdeL.exe
  2⤵
  PID:11876
- C:\Windows\System\DKmobrt.exe
  C:\Windows\System\DKmobrt.exe
  2⤵
  PID:9932
- C:\Windows\System\rTpSAex.exe
  C:\Windows\System\rTpSAex.exe
  2⤵
  PID:12500
- C:\Windows\System\PZQgFQK.exe
  C:\Windows\System\PZQgFQK.exe
  2⤵
  PID:9568
- C:\Windows\System\amSaItk.exe
  C:\Windows\System\amSaItk.exe
  2⤵
  PID:8992
- C:\Windows\System\fBRHVZD.exe
  C:\Windows\System\fBRHVZD.exe
  2⤵
  PID:10832
- C:\Windows\System\aSzhjcd.exe
  C:\Windows\System\aSzhjcd.exe
  2⤵
  PID:12056
- C:\Windows\System\LRTztAA.exe
  C:\Windows\System\LRTztAA.exe
  2⤵
  PID:12552
- C:\Windows\System\KwPexCk.exe
  C:\Windows\System\KwPexCk.exe
  2⤵
  PID:10632
- C:\Windows\System\YevYovt.exe
  C:\Windows\System\YevYovt.exe
  2⤵
  PID:12724
- C:\Windows\System\sYygvTl.exe
  C:\Windows\System\sYygvTl.exe
  2⤵
  PID:4056
- C:\Windows\System\BsPjbxS.exe
  C:\Windows\System\BsPjbxS.exe
  2⤵
  PID:2444
- C:\Windows\System\OZyKlXY.exe
  C:\Windows\System\OZyKlXY.exe
  2⤵
  PID:6644
- C:\Windows\System\pkIPQwN.exe
  C:\Windows\System\pkIPQwN.exe
  2⤵
  PID:7908
- C:\Windows\System\nEfxcPl.exe
  C:\Windows\System\nEfxcPl.exe
  2⤵
  PID:11312
- C:\Windows\System\KqWpPXd.exe
  C:\Windows\System\KqWpPXd.exe
  2⤵
  PID:13108
- C:\Windows\System\fWZxtsF.exe
  C:\Windows\System\fWZxtsF.exe
  2⤵
  PID:11492
- C:\Windows\System\LOzHaXf.exe
  C:\Windows\System\LOzHaXf.exe
  2⤵
  PID:11640
- C:\Windows\System\JPJkegh.exe
  C:\Windows\System\JPJkegh.exe
  2⤵
  PID:8400
- C:\Windows\System\nWZaqhu.exe
  C:\Windows\System\nWZaqhu.exe
  2⤵
  PID:10584
- C:\Windows\System\ppCxang.exe
  C:\Windows\System\ppCxang.exe
  2⤵
  PID:10580
- C:\Windows\System\jUPQXDq.exe
  C:\Windows\System\jUPQXDq.exe
  2⤵
  PID:12876
- C:\Windows\System\wpellug.exe
  C:\Windows\System\wpellug.exe
  2⤵
  PID:3912
- C:\Windows\System\ANTbiJL.exe
  C:\Windows\System\ANTbiJL.exe
  2⤵
  PID:12124
- C:\Windows\System\sAfkWgn.exe
  C:\Windows\System\sAfkWgn.exe
  2⤵
  PID:6432
- C:\Windows\System\wDJEuYi.exe
  C:\Windows\System\wDJEuYi.exe
  2⤵
  PID:8336
- C:\Windows\System\JBmcYby.exe
  C:\Windows\System\JBmcYby.exe
  2⤵
  PID:12044
- C:\Windows\System\zXElMNK.exe
  C:\Windows\System\zXElMNK.exe
  2⤵
  PID:5096
- C:\Windows\System\aofbGGb.exe
  C:\Windows\System\aofbGGb.exe
  2⤵
  PID:10292
- C:\Windows\System\wkTTgRe.exe
  C:\Windows\System\wkTTgRe.exe
  2⤵
  PID:6924
- C:\Windows\System\YuNYDAR.exe
  C:\Windows\System\YuNYDAR.exe
  2⤵
  PID:10316
- C:\Windows\System\yUaNylR.exe
  C:\Windows\System\yUaNylR.exe
  2⤵
  PID:7084
- C:\Windows\System\FRLOMki.exe
  C:\Windows\System\FRLOMki.exe
  2⤵
  PID:10404
- C:\Windows\System\eegsXld.exe
  C:\Windows\System\eegsXld.exe
  2⤵
  PID:10764
- C:\Windows\System\WdKQAvz.exe
  C:\Windows\System\WdKQAvz.exe
  2⤵
  PID:8988
- C:\Windows\System\GyEmAyO.exe
  C:\Windows\System\GyEmAyO.exe
  2⤵
  PID:8756
- C:\Windows\System\EWwnNPh.exe
  C:\Windows\System\EWwnNPh.exe
  2⤵
  PID:10088
- C:\Windows\System\upZOZbr.exe
  C:\Windows\System\upZOZbr.exe
  2⤵
  PID:4708
- C:\Windows\System\QDYcUFq.exe
  C:\Windows\System\QDYcUFq.exe
  2⤵
  PID:9132
- C:\Windows\System\VUjzkNn.exe
  C:\Windows\System\VUjzkNn.exe
  2⤵
  PID:12740
- C:\Windows\System\AeQbAke.exe
  C:\Windows\System\AeQbAke.exe
  2⤵
  PID:13584
- C:\Windows\System\BwseGhp.exe
  C:\Windows\System\BwseGhp.exe
  2⤵
  PID:13656
- C:\Windows\System\geECbOj.exe
  C:\Windows\System\geECbOj.exe
  2⤵
  PID:13684
- C:\Windows\System\nTaGtYT.exe
  C:\Windows\System\nTaGtYT.exe
  2⤵
  PID:13876
- C:\Windows\System\ZwDVDlZ.exe
  C:\Windows\System\ZwDVDlZ.exe
  2⤵
  PID:14024
- C:\Windows\System\mpOlqrZ.exe
  C:\Windows\System\mpOlqrZ.exe
  2⤵
  PID:14084
- C:\Windows\System\NXLWexx.exe
  C:\Windows\System\NXLWexx.exe
  2⤵
  PID:14140
- C:\Windows\System\lGQgZsz.exe
  C:\Windows\System\lGQgZsz.exe
  2⤵
  PID:14184
- C:\Windows\System\hnTrlSO.exe
  C:\Windows\System\hnTrlSO.exe
  2⤵
  PID:14200
- C:\Windows\System\cwAgZsC.exe
  C:\Windows\System\cwAgZsC.exe
  2⤵
  PID:14220
- C:\Windows\System\LkDtUEh.exe
  C:\Windows\System\LkDtUEh.exe
  2⤵
  PID:14240
- C:\Windows\System\DxJIbGu.exe
  C:\Windows\System\DxJIbGu.exe
  2⤵
  PID:14260
- C:\Windows\System\TPmVwqD.exe
  C:\Windows\System\TPmVwqD.exe
  2⤵
  PID:13336
- C:\Windows\System\UfeRBvT.exe
  C:\Windows\System\UfeRBvT.exe
  2⤵
  PID:13088
- C:\Windows\System\vBcmSZT.exe
  C:\Windows\System\vBcmSZT.exe
  2⤵
  PID:13360
- C:\Windows\System\mMenOlb.exe
  C:\Windows\System\mMenOlb.exe
  2⤵
  PID:8872
- C:\Windows\System\vmqsoXF.exe
  C:\Windows\System\vmqsoXF.exe
  2⤵
  PID:13596
- C:\Windows\System\egyJSix.exe
  C:\Windows\System\egyJSix.exe
  2⤵
  PID:13556
- C:\Windows\System\ZbBAtSb.exe
  C:\Windows\System\ZbBAtSb.exe
  2⤵
  PID:13704
- C:\Windows\System\FXsxgKs.exe
  C:\Windows\System\FXsxgKs.exe
  2⤵
  PID:13760
- C:\Windows\System\uiJvCYC.exe
  C:\Windows\System\uiJvCYC.exe
  2⤵
  PID:13892
- C:\Windows\System\aJsMOTT.exe
  C:\Windows\System\aJsMOTT.exe
  2⤵
  PID:13924
- C:\Windows\System\ZDjeMnj.exe
  C:\Windows\System\ZDjeMnj.exe
  2⤵
  PID:13984
- C:\Windows\System\OZjTilU.exe
  C:\Windows\System\OZjTilU.exe
  2⤵
  PID:13996
- C:\Windows\System\HnvCuwC.exe
  C:\Windows\System\HnvCuwC.exe
  2⤵
  PID:14032
- C:\Windows\System\PYrxlOY.exe
  C:\Windows\System\PYrxlOY.exe
  2⤵
  PID:14072
- C:\Windows\System\fHPxkvD.exe
  C:\Windows\System\fHPxkvD.exe
  2⤵
  PID:14020
- C:\Windows\System\CRwdlIQ.exe
  C:\Windows\System\CRwdlIQ.exe
  2⤵
  PID:14076
- C:\Windows\System\gQOcaSa.exe
  C:\Windows\System\gQOcaSa.exe
  2⤵
  PID:14120
- C:\Windows\System\UHikcpg.exe
  C:\Windows\System\UHikcpg.exe
  2⤵
  PID:14156
- C:\Windows\System\gQTFrFs.exe
  C:\Windows\System\gQTFrFs.exe
  2⤵
  PID:14124
- C:\Windows\System\ZTyyHtZ.exe
  C:\Windows\System\ZTyyHtZ.exe
  2⤵
  PID:14232
- C:\Windows\System\CoRrADj.exe
  C:\Windows\System\CoRrADj.exe
  2⤵
  PID:13308
- C:\Windows\System\QCmGcMX.exe
  C:\Windows\System\QCmGcMX.exe
  2⤵
  PID:13428
- C:\Windows\System\yXHuoZL.exe
  C:\Windows\System\yXHuoZL.exe
  2⤵
  PID:13560
- C:\Windows\System\oUDGMiH.exe
  C:\Windows\System\oUDGMiH.exe
  2⤵
  PID:13832
- C:\Windows\System\EKPezCg.exe
  C:\Windows\System\EKPezCg.exe
  2⤵
  PID:13828
- C:\Windows\System\GkCMQMV.exe
  C:\Windows\System\GkCMQMV.exe
  2⤵
  PID:4480
- C:\Windows\System\DrGSTmZ.exe
  C:\Windows\System\DrGSTmZ.exe
  2⤵
  PID:2404
- C:\Windows\System\AmmvhEt.exe
  C:\Windows\System\AmmvhEt.exe
  2⤵
  PID:3648
- C:\Windows\System\iEBvFCn.exe
  C:\Windows\System\iEBvFCn.exe
  2⤵
  PID:408
- C:\Windows\System\nsMqirT.exe
  C:\Windows\System\nsMqirT.exe
  2⤵
  PID:13852
- C:\Windows\System\wNsTzZr.exe
  C:\Windows\System\wNsTzZr.exe
  2⤵
  PID:8060
- C:\Windows\System\iWTHWcw.exe
  C:\Windows\System\iWTHWcw.exe
  2⤵
  PID:12140
- C:\Windows\System\MdrfdSN.exe
  C:\Windows\System\MdrfdSN.exe
  2⤵
  PID:13472
- C:\Windows\System\upORBfR.exe
  C:\Windows\System\upORBfR.exe
  2⤵
  PID:14324
- C:\Windows\System\qqptNIh.exe
  C:\Windows\System\qqptNIh.exe
  2⤵
  PID:14180
- C:\Windows\System\pUaxfRE.exe
  C:\Windows\System\pUaxfRE.exe
  2⤵
  PID:13960
- C:\Windows\System\GjIewGk.exe
  C:\Windows\System\GjIewGk.exe
  2⤵
  PID:13700
- C:\Windows\System\PhsEkaw.exe
  C:\Windows\System\PhsEkaw.exe
  2⤵
  PID:13736
- C:\Windows\System\CxgMwDh.exe
  C:\Windows\System\CxgMwDh.exe
  2⤵
  PID:13788
- C:\Windows\System\ARLJxCq.exe
  C:\Windows\System\ARLJxCq.exe
  2⤵
  PID:4360
- C:\Windows\System\BMdLIAC.exe
  C:\Windows\System\BMdLIAC.exe
  2⤵
  PID:3364
- C:\Windows\System\lpvPihg.exe
  C:\Windows\System\lpvPihg.exe
  2⤵
  PID:1288
- C:\Windows\System\dqKhmJQ.exe
  C:\Windows\System\dqKhmJQ.exe
  2⤵
  PID:14320
- C:\Windows\System\XloslrA.exe
  C:\Windows\System\XloslrA.exe
  2⤵
  PID:5840
- C:\Windows\System\kcsEdDA.exe
  C:\Windows\System\kcsEdDA.exe
  2⤵
  PID:13252

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:13844

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:13612

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:10640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lajsvl50.ak1.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AfJfrFY.exe

Filesize
1.9MB

MD5
3a8f71a53bd67660d3370ed442d77d50

SHA1
fa283006e26680137034cded6910c514ef50f724

SHA256
73121e1e7862314729e883e2ba58914eb28edd9b8a79c4b208ee7cccddb4cfab

SHA512
c59b808b23804012b309c387b9ac081633a9290ea439b20a13a1534c999d25605de89205d7ab6623bb31e961e5101d527380c949652917f3c9f6bf7185a36d8b

Download Submit
C:\Windows\System\AntWdQN.exe

Filesize
1.9MB

MD5
c2431bd28affc1113140743c593aa211

SHA1
162716ae7471251adb12ada04556c617d3bfe43b

SHA256
8b02923dec3a8d74f99e73e7bef05744a25a6fa51216b41f421275ed68fadde5

SHA512
61400d4eb03a9139808691f8ad7201d4b54384d5011065f87070f74a3b55feb31452cf2949058135017b252d19b2e40608c407fb93da794b6af8ab613b12c235

Download Submit
C:\Windows\System\DfjwpNp.exe

Filesize
1.9MB

MD5
907b63b24da06f08011f2a4b399b3f04

SHA1
d5d301ac099a7ce3d7deaed2c9cdb937b1d0f8c4

SHA256
b6dc8456d7696e71f479372218575e99fb779996bf2383d9cb1d6be98d7fee44

SHA512
8a21b1069c3dd9155fcee3ecfbb018aab510a82eb410fb53747273129b408e7e8f6363e9d36052d49172bb7aef93f0a677a81fcff2dc13d4e46ee5497a5272ff

Download Submit
C:\Windows\System\EntZfuo.exe

Filesize
1.8MB

MD5
5f5f6974a1e09ffd1a8ca4c4ca60fb41

SHA1
e432daa41ee938d2ddc406a2bee26608a496e044

SHA256
c57dc9e1c76184e475c04f76b5033398cbc02a991a7ad625793311e6b73dbcfc

SHA512
c3d1397b9143614ab8d3c92dd320c24ec8e0eb0792157df45a7844c8295a5063c83f06d867205ee51c6f9c9543a7236601b82c9a449f255a55dfcb6abeeabf5b

Download Submit
C:\Windows\System\EpVdUQw.exe

Filesize
1.9MB

MD5
f1792e943a212b5af2230e578ae1e623

SHA1
2b0a71e97e25aeb289e98b32441a760357d414ea

SHA256
0996ad32bd6e93134a79d45a765388e04c12c07f2107d2f7f971d1ef060b40da

SHA512
a528511ae8a621cec8a02b91a80b528680eb6c863b696b7d2a50462f7b1b162dd2d74b26c603c44b4898a0f7d751111db3f3fc183e057e927b2ffb51a7b4c555

Download Submit
C:\Windows\System\IHhEUFU.exe

Filesize
1.8MB

MD5
d42ca4b164a3fda25b73c932bccdf495

SHA1
0bfa02ab1d3959af35c48bd2a7eff71d141b3909

SHA256
b10f391a1dfacbaa664a9ba59ce713a2df9a5869a6ee99d9677e3e6a16668e46

SHA512
0212b3ffe4f9abd619fd9dbd6c293931f7762f5f2e2e395f0c663a96f5b79419b42c463f8a856fa242063dcd953a9c0d898a23e0784848a59538b4a2a7ad302d

Download Submit
C:\Windows\System\IMBrBKO.exe

Filesize
1.9MB

MD5
29cb442b98e3b72d37afacc1693b1f3a

SHA1
02e753cb829dc66211e90fd660df6feffab134d4

SHA256
edc3a96098b8a612abcc2afddf0dc31d57af04c4764e45efbebcb584975d12d8

SHA512
1227c628f81c502a68e2f1a1aeb373fb7f1931e1704e63c12fb297ad5799301d44d4de3e763b330f4c612f8bf47f64210213c8ce0d04e7c01934680e0225209a

Download Submit
C:\Windows\System\JkjUJuD.exe

Filesize
1.9MB

MD5
6b331bc2a9fcf47da4b18ed2316b6372

SHA1
7473e08dd3b387a12806409cace242df77497fa1

SHA256
b61f7d4b70491a6a2f85abedcdce8c6d405a0cde0de0048087d6561ea3d3be8a

SHA512
6c76586117e2d05870a88d639982a9f1df3aed7e4e795333e9558f7c11beec1ff6989da30119794f7b8f15d2f6ead351b997207aca996e254a7ffff1f103aeee

Download Submit
C:\Windows\System\KcpzUJP.exe

Filesize
1.9MB

MD5
2da94ff7ca1d1a238ffaf15fa073fbd1

SHA1
776c87737849a39a34a38b99dd945e0e1e3ee8ae

SHA256
ff5e8b78aed3bb01d11fb9e7f5396d0551cd3c750619fd5d9a5897acfe4117e3

SHA512
2638cf012331cf054f6d05289b597013152abbffcc064fab3015db1ec25094b66d8e1455de4572f2edb4f13c7353d0750652524a41a65c295e7d3c6feb3cca82

Download Submit
C:\Windows\System\OSuhaGc.exe

Filesize
1.9MB

MD5
61e1931df57ac69d8928a6a95dd55527

SHA1
545d22a7caa96ba32ad491adc5d2c4365010d697

SHA256
7e4d94508604ba7cee6236287f46f07e28d1ca14d7ef43d5f9a882a08feb990e

SHA512
8333c17d47b915497a28f8a381b6959db414d16f8fb7f6cd5d7d9acbaefc0ea41d9972c46aba82698aa9346a42bb1206c4d1e1f3b6d8c31b934ab207e1cf09ba

Download Submit
C:\Windows\System\OicQJtV.exe

Filesize
1.9MB

MD5
1e38b5efc9a263f0c59a3f242850140f

SHA1
27e975ab25a0d669718ae263e897110da67942cf

SHA256
75523cabc256158c7efc84e84728c10fb3f54021a12e6b3386abbb41f8dc6d36

SHA512
a67e6de6c087e4fab960005784ac11f51211d2cb1d543c254b1852262d30d3d7a31e94847b59a0f3de3d1953df83df937103926b14b914269062fe3d1934f110

Download Submit
C:\Windows\System\RHdnUSt.exe

Filesize
1.8MB

MD5
b77475dd74a9569567a2c7bb2fef79fb

SHA1
9d6ad65aa34338bbe90faa126456735f5a5c82ce

SHA256
5a95318d3c897bdf506e132df5389d76912a40465419110db582065689262239

SHA512
3142832c216da669b353a5312dd57b4f38c82274e5315c69d80d4f9e01e93c71fddcc71566e789bda5a8abed33498c2e56a948b63439ada941be2ec062414560

Download Submit
C:\Windows\System\TSerVOF.exe

Filesize
1.9MB

MD5
1eb02a6dad21fae9b26123d138b8c12d

SHA1
d9dd05d7841f3687ff06546ba573b234995b609e

SHA256
21818cff40492698820e6217bb4ca2e64f708553bb792a980430f6f0be09ed42

SHA512
5868ced386405a3113fe5e892fe8d34b4d21983cde741b50a7baae37c3522cc6470aa53281f8c2035084949b6d609a83e827974620057c0dfd04bd9c00f5af0e

Download Submit
C:\Windows\System\VBRasKN.exe

Filesize
1.9MB

MD5
d825a2de2763a31e4c385567d9567fc1

SHA1
46a5215ec1cca344e1ee2896136765213931fe55

SHA256
39351834ccc3bf7a0cea90a481908f4cac41e859095f269fb38e4b9183091b95

SHA512
22baccf5373751c9bf64ba1f7328b66c58b09b0980d0efef12444716588d49deea9c0ad384f44a9e805f2abae1dae3d442aec1567d4c67f744142a1b4fab161e

Download Submit
C:\Windows\System\VZbivvT.exe

Filesize
1.9MB

MD5
4c94376a476bab98434a3c99280c575a

SHA1
b356d309342ac4bec97ec2d21c2606d6e9b8ef2e

SHA256
fffdcc5a2ab1f82dc8ceed30d895b279524953e2ef1ddb3fa9c6fe22b21c406e

SHA512
54e150a0095f6170661730606d46010218f09df600c6e0fdda14de49881b2bda732cc2bda6ca1e4f910a3dc47a90e0e7f09c8f4279026e0ed1dcb804c26e537f

Download Submit
C:\Windows\System\WleMqZA.exe

Filesize
1.9MB

MD5
b321172a8e91e0aa9e6e18e6cc1abec8

SHA1
80553ab3e62161b90ebe78c5f2446e016f4f3336

SHA256
f4caedc151b2d532cf7f4eada898b505cb62a035c45967393527bca0f1987503

SHA512
90bc6c2e148d77858ea92e78a20814d76b98689be6faba693812515642d0016d9a536ae58023c1c60ed2e91a87c26c36bee907b9d2c2e14427f8dfa8762dd56b

Download Submit
C:\Windows\System\XwCoKRa.exe

Filesize
1.9MB

MD5
c2311776593959b0d45a1be7b931e6c7

SHA1
170b6c33e4483fd3ec05e0a225f76f0594f7519f

SHA256
8cb6c9606f3dcc4f407828c3f442cd3046ac6f7e16798ed5fb2ae08b6a79f724

SHA512
8067898644be0ab16458e69d3ba8369256bbdf49ac8b2fc3b6f4641a2d021e5a7bffb4864ed8d061fe7ff39ddfcbc1b0ac16f05050453ca85586cf442a3f0a91

Download Submit
C:\Windows\System\bUfJYGs.exe

Filesize
8B

MD5
b849dbcfb08ac877290add49e99178d8

SHA1
e96fe151173fd43a6d834740f52198931a388bf9

SHA256
a924546cb05e0d111a25fcb8e7f183457926abae319588a0b32ef2b05d457163

SHA512
8b4a01f83882b6e5a7d86633f11ab4b0beb94666eb64954ae2be067858515a1f39d026e62a6fa7cb4c876187b4f3fb07031095ae0126acf1cb139bd0d21d7863

Download Submit
C:\Windows\System\baDmTbG.exe

Filesize
1.8MB

MD5
87e9c7227b2968a3eec008702bec8f5d

SHA1
11edcc6265e8583dd67befd4164c1e93b71c9096

SHA256
5151c02c78df7891cacf0917f911c052a300b06a9b697fc24b903d319a8cdb2f

SHA512
6d629586dbce95a7f2b9177ca4a28961ab4bb2b09a4a8360bbb712ca7ed388346a5033bbea6c206d6c6b83f06a8252fd6f439f6bf9d34474935d9af88ea53f10

Download Submit
C:\Windows\System\bfaROwt.exe

Filesize
1.9MB

MD5
22430ac4215d4fea485a471d631ea2ae

SHA1
6e1fd7665994f8c89f3395b4ee38cbc6b8ffcc03

SHA256
1f49673474c3835ee4d278ce91779f86e2a5535fa6c15dbd69015f49b8b6d7bd

SHA512
5edd73f93a14e93662a500a9e0c4188fdcf68520f90b96368df06f7299f2defedc3ac6336f36cb05101eabcb0119fa3f72a3995159d8f2133a049eb1aa60f65f

Download Submit
C:\Windows\System\cHfYmzU.exe

Filesize
1.8MB

MD5
59dd855e43c154a9d7dd9bc7be2b55f7

SHA1
77526f070040d5f32306db2ff18411776cced5e1

SHA256
0a1c8cc2d0618cd2f8bb7a1679e6a793f00c1ecb6d4ca0569abacdd339be29fd

SHA512
ec4c62960692b4dc2b64d93c58ab2fad3231e15d87a9018022e24ebd410a08e4690e3b567a1b52d61335c36aa928c1627daf4aa160d4d0739308497d50d958c6

Download Submit
C:\Windows\System\cZMlHno.exe

Filesize
1.8MB

MD5
d0a060817284a320306864c45c389334

SHA1
8d1e55f06debe90b80a9b78187c42df4d3dad6ce

SHA256
116f95538b57f47a3ee9720b6c470f035b6e448581cc94377e0a8676edcc433c

SHA512
3bcd98b254bad20e6c180113292c6728d3b47a936fbf5acd9b569aa0e36d82353925971f3838b3e3abdc69aa9d836b8e197ac94d5ea7a0591d15e2c9131eea91

Download Submit
C:\Windows\System\cZrCJbG.exe

Filesize
1.8MB

MD5
48573eed8087e7a98752caad0c7c934c

SHA1
ce55ff4882f9a83c364c8c74ce72892cb0f361c6

SHA256
1b7e824801613ac3d47919ecffaf917ee3986f76f347f51fcdb71cea4606c8e6

SHA512
b96685a195216b680e63d017c94ef43a288e698e2a2faa0049551fde52933d4067508f602ec822624bf2397d69b5c0aa6bdfc5c2e204505cd37d3479f8419271

Download Submit
C:\Windows\System\etqoydn.exe

Filesize
1.9MB

MD5
ede4d78504d03f2861bde75bc582369b

SHA1
256383e85e244fcdcbae8d704fcf7ee7af9bf6c1

SHA256
143e6d4fd3d6c5dd70b1e1bf279ff3084594ddc379f4e2c32fde1c3be45af246

SHA512
60be06afaa49e21fb2788b462451c86fed16415cc0ad440125783956298fc332037c1dc458748595c6cc6a090a84afdc917a753e50c1eec6e98f280c2eae4be2

Download Submit
C:\Windows\System\exrkQQC.exe

Filesize
1.9MB

MD5
3ed861535d1025312625a818c443013e

SHA1
d811556e0b59c2234e118eff77611ac388954272

SHA256
d17c79ce81b4608fe51110c9a3c537f9b92523253600919ec41834144bb6ef97

SHA512
f8f9ebbe0d80a43e4bf24d07454dba552ef12becc4dce1a6747bef8ed6b500772a812d8cd0dbc3fa1a81e4c6d4ce6e21c545afb02281609300dd60ef9ce6cfe4

Download Submit
C:\Windows\System\fmcQmyc.exe

Filesize
1.9MB

MD5
36b9048528f6f0c0db540b4c1ec29acf

SHA1
2a49c56f4e44c1deaa6b5094104e19800820e18b

SHA256
6285dcbd6bb5bd7a3137cda53f7439c128fecf23951bc637b39c809fa7750dbf

SHA512
05990425971b32e8499b4cec8511fde8083efd10254a46b2f68e9f550433ffd7ebe5f139c189d204be7848df0c1a3e3ff1131ba468c0d1f8c2595ee351cb2608

Download Submit
C:\Windows\System\hHorDtu.exe

Filesize
1.9MB

MD5
98727ab8065531e8c4f15a0b40bfde37

SHA1
7b94662d3583afa4cf184e60005af5eb7fdccf9b

SHA256
eac15aed7654ebc9a26ba3ae92c1089a07d120c5869ea3027e2b677e24bb5144

SHA512
581d54ee8e41f6c94caf720e7e783c9f14efba26db4cc80a14191fcb61a18cc45a4fce8363296877ac38593d7fb1b7aa58493d761e7e6df3281cd056fe287319

Download Submit
C:\Windows\System\iJmOAdt.exe

Filesize
1.8MB

MD5
87ac7358a0d9d4ed1ec29eeb231527c6

SHA1
c6302650e40d441c4e2d665f534489aa40c74caa

SHA256
70e75f2656c1396e6a16ae6604416976b27cd4946f7448ff514d40949b11087c

SHA512
0efcd64249ce04dbb2c773e5444b095de54ec3d51d3270377b50ac2cc75198487062157df8cd27934332023a86234da4cbc5783ac13c473f59e88b752493d17f

Download Submit
C:\Windows\System\kyrxWUq.exe

Filesize
1.9MB

MD5
319651d2b4e3cad8594ca48274300fa4

SHA1
d5b487edb5c4595e00dfb145159160695b6222c6

SHA256
341c1e3bf854e50546eace9e8faeca4311bf95f1cc952513ef6da4384f557d87

SHA512
789de753a928f612c449b75216a1d1ef3ecc91169be0c6e9e52da3149213ea737e23955e5be78c7828f0c2eff40f8313adf1aafe50eebd8f1b977ceb6d6e1126

Download Submit
C:\Windows\System\mVgTEZX.exe

Filesize
1.9MB

MD5
97dd7684b992e02444f22791f7702f82

SHA1
453613ddbca7809954720231a73da4530faeb92b

SHA256
0127201ee2a2dcafb8a4d1cd11320b4fa0dc6a4c0f90ac80b0632fc10ee50e4d

SHA512
4a0670ba1148d50c1949ca819f7a69281be705955e5513a0d509bbfcc7e2148b9555adf6a00a9a279bb37f9e7e1e066a5a853a4ef79c7b1d490bbbaff4dade40

Download Submit
C:\Windows\System\nGaAPtX.exe

Filesize
1.9MB

MD5
5156b183fcb5fd2b6c95e43af3eb5117

SHA1
1f4b9f1f58e12dd9833172598b7b8bae0cbc0172

SHA256
38759764031dd4c2a587e276bdd7b48c49cd8ce3117357883761db68d1b463d1

SHA512
363ec9c8afe9793106c6515d59202b9f6f7d99237c35df0c2191032724f07fd5e06ec56c29accd5029fe72c3a10fcf08d4983b82fa005babda0753a4b2c9c98b

Download Submit
C:\Windows\System\obWeUiC.exe

Filesize
1.8MB

MD5
ff41a238a0294978e42827a70c1a9a6e

SHA1
3ccc7b2b76e95ddc9ed1abc92be65918eaac8ff9

SHA256
1887cec1fef2b54d5a4cfd87c952125435d559cf5006914d5496a41453ab8ef3

SHA512
f3d28b65622fb88a3dee25ff1fbc9a4d7bb1db1d96f9298ff7dec8773bfcc488962f13055ba01ea015e5c316a60c6de1c9b4e68a79f3ec0ab3578a6f03ff7674

Download Submit
C:\Windows\System\okqsjvo.exe

Filesize
1.9MB

MD5
f8fcaa317574747a95340ea9e465be9b

SHA1
a95e5770de4c4d5cbda9191cd51ac936cee491ef

SHA256
0cdce0606a96eec47e07b698adca49dd137c0b2714a8abf80932f3d642ea1e88

SHA512
3170cb6351d464fd539744005835027af6f576eafc5c7f19483fc37aac5a43f441324194f701aeb8f1a57a4e4bbc6d0aaf4d8de138c0786d85785b9443099706

Download Submit
C:\Windows\System\owMQMHi.exe

Filesize
1.9MB

MD5
ca10e2b1e2768ddc425d31aaaed51da1

SHA1
7768ec688d840a76fae265cf1201a17c69fbb020

SHA256
fd566e95d1268369a9f35e1950f3f5691aaff69dc7de3b4dafd26e39afa6b26e

SHA512
4d2beec62d76500809c00df1fd0183bcbbe1f311f71781528d2db28315a4420e075375b0594a13c7589980044214db78b071a365a3ac0ec4dca45e13cb77cda7

Download Submit
C:\Windows\System\sWWBoWp.exe

Filesize
1.9MB

MD5
1e6d72f2f95c6d5045303faccf85551b

SHA1
0869035408334a5fbdc7f11546998a106f4ba19a

SHA256
aaec6c4024e1ca403784fee0bb60ea07ab2d28cebfa265537725090fa810722e

SHA512
aa2296fa1928a6189dc618f1d42884d0100d2bca8eb9c0933517ea5d0372af9063abf8865dc32fe266712bd341b0c4323bfa93b30aa922ebaeebfb4e457625f3

Download Submit
C:\Windows\System\uKssDJg.exe

Filesize
1.9MB

MD5
9d40b3f0b60e4667aebfd53785de104b

SHA1
db70c86210fbaad0139244109b36006a6fc19c03

SHA256
5979ab8fbe08ce7907e67c3bfa329e5f9a4729492f7ef5ee2e697927920bcce8

SHA512
76bbf9fa430798ac963cac2d10ddc7e9af8d3ea6354e80f90ec5a559d46fe108dabd7064502416fd4a1284047ef9b3a32ac8feddbe54da51910472c093a4c3fd

Download Submit
C:\Windows\System\vcIKakM.exe

Filesize
1.9MB

MD5
3a3a67229681c402c61c0027a2b4fa1d

SHA1
55671649216fea0ed8ca3923419b909b114b247b

SHA256
b7cb9431d5a861442a61523bfb192ef1f1100176c7f24eaa883845218e83e35b

SHA512
d7b0b283fa2695c1237578a895ead86e008c6a6fb21093cee8d53b6afa8e952213a8eb42f336a9c800786b5ef22f5251136f7da6f29f3fed07b3ca556ec28eea

Download Submit
C:\Windows\System\xMgKBiC.exe

Filesize
1.9MB

MD5
ca7876b18cf5d8353995e64f9faf293a

SHA1
b020964217f9de7cb5222147446a1af3da8548f9

SHA256
acd3171995ee1500396953bf1f8f388aba7fb51340a9cec35a0ee0cb35ff3985

SHA512
b298b96168d1ff699d4467e3b2bcda7ffbcb2e566fc614ef93d100b28b6bb26bdd0fa4a299c89b8bed9791f8cf80363e0b7d06fbe78d6496738dbb7bb960ae74

Download Submit
memory/332-269-0x00007FF754920000-0x00007FF754D12000-memory.dmp

Filesize
3.9MB

Download
memory/412-260-0x00007FF72C270000-0x00007FF72C662000-memory.dmp

Filesize
3.9MB

Download
memory/1108-262-0x00007FF6617D0000-0x00007FF661BC2000-memory.dmp

Filesize
3.9MB

Download
memory/1524-56-0x00007FF6E8A10000-0x00007FF6E8E02000-memory.dmp

Filesize
3.9MB

Download
memory/1560-45-0x00007FFAE6EB0000-0x00007FFAE7971000-memory.dmp

Filesize
10.8MB

Download
memory/1560-53-0x00000224F77B0000-0x00000224F77C0000-memory.dmp

Filesize
64KB

Download
memory/1560-185-0x00000224F7C50000-0x00000224F7C72000-memory.dmp

Filesize
136KB

Download
memory/1576-207-0x00007FF62B710000-0x00007FF62BB02000-memory.dmp

Filesize
3.9MB

Download
memory/1620-237-0x00007FF6BB720000-0x00007FF6BBB12000-memory.dmp

Filesize
3.9MB

Download
memory/1720-248-0x00007FF6F8CB0000-0x00007FF6F90A2000-memory.dmp

Filesize
3.9MB

Download
memory/1908-161-0x00007FF604060000-0x00007FF604452000-memory.dmp

Filesize
3.9MB

Download
memory/2060-1-0x00000242A7E70000-0x00000242A7E80000-memory.dmp

Filesize
64KB

Download
memory/2060-0-0x00007FF6C9480000-0x00007FF6C9872000-memory.dmp

Filesize
3.9MB

Download
memory/2140-265-0x00007FF7C1920000-0x00007FF7C1D12000-memory.dmp

Filesize
3.9MB

Download
memory/2252-125-0x00007FF7219A0000-0x00007FF721D92000-memory.dmp

Filesize
3.9MB

Download
memory/2528-222-0x00007FF78D490000-0x00007FF78D882000-memory.dmp

Filesize
3.9MB

Download
memory/2936-268-0x00007FF6CAC80000-0x00007FF6CB072000-memory.dmp

Filesize
3.9MB

Download
memory/3044-109-0x00007FF686000000-0x00007FF6863F2000-memory.dmp

Filesize
3.9MB

Download
memory/3104-76-0x00007FF61D9F0000-0x00007FF61DDE2000-memory.dmp

Filesize
3.9MB

Download
memory/3220-256-0x00007FF772990000-0x00007FF772D82000-memory.dmp

Filesize
3.9MB

Download
memory/3344-255-0x00007FF797060000-0x00007FF797452000-memory.dmp

Filesize
3.9MB

Download
memory/3828-263-0x00007FF685370000-0x00007FF685762000-memory.dmp

Filesize
3.9MB

Download
memory/4028-108-0x00007FF7D19A0000-0x00007FF7D1D92000-memory.dmp

Filesize
3.9MB

Download
memory/4264-267-0x00007FF6BA870000-0x00007FF6BAC62000-memory.dmp

Filesize
3.9MB

Download
memory/4768-264-0x00007FF6A11C0000-0x00007FF6A15B2000-memory.dmp

Filesize
3.9MB

Download
memory/5068-266-0x00007FF7E93A0000-0x00007FF7E9792000-memory.dmp

Filesize
3.9MB

Download