xmrig | 9f2c6b6544598c44c00e4018e582ddcbd8825ae1697bfa994e496960b5bf324d

Analysis

max time kernel
67s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27-04-2024 00:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
Size

1.7MB
MD5

02006dc46a47991dbae87911266b5de2
SHA1

d6394af0cd355fa7956fdc3b831ad881207673cf
SHA256

9f2c6b6544598c44c00e4018e582ddcbd8825ae1697bfa994e496960b5bf324d
SHA512

76d8ae31837f3dbdd2666c7e077d1c04abf9943fc152178a314577aeef5c365d6014274f116026e5f32242451ae4e44a21829162216babb900dbbf1ce63e3247
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWY1s38kQu12bPxvyuzaBgJ9pcFtG:Lz071uv4BPMkibTIA5I4TNrpDGgDQ6

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 41 IoCs

miner

resource	yara_rule
behavioral2/memory/2528-183-0x00007FF7A15F0000-0x00007FF7A19E2000-memory.dmp	xmrig
behavioral2/memory/2488-187-0x00007FF7C2F30000-0x00007FF7C3322000-memory.dmp	xmrig
behavioral2/memory/1128-190-0x00007FF75E780000-0x00007FF75EB72000-memory.dmp	xmrig
behavioral2/memory/4028-196-0x00007FF6F2FD0000-0x00007FF6F33C2000-memory.dmp	xmrig
behavioral2/memory/5096-200-0x00007FF6D35A0000-0x00007FF6D3992000-memory.dmp	xmrig
behavioral2/memory/4596-199-0x00007FF6EAED0000-0x00007FF6EB2C2000-memory.dmp	xmrig
behavioral2/memory/1464-198-0x00007FF73F830000-0x00007FF73FC22000-memory.dmp	xmrig
behavioral2/memory/404-195-0x00007FF7CF680000-0x00007FF7CFA72000-memory.dmp	xmrig
behavioral2/memory/2508-194-0x00007FF63D1A0000-0x00007FF63D592000-memory.dmp	xmrig
behavioral2/memory/1660-192-0x00007FF6DC710000-0x00007FF6DCB02000-memory.dmp	xmrig
behavioral2/memory/2820-189-0x00007FF7AFDC0000-0x00007FF7B01B2000-memory.dmp	xmrig
behavioral2/memory/4880-188-0x00007FF7BC5A0000-0x00007FF7BC992000-memory.dmp	xmrig
behavioral2/memory/1132-186-0x00007FF63E720000-0x00007FF63EB12000-memory.dmp	xmrig
behavioral2/memory/4364-185-0x00007FF63E4B0000-0x00007FF63E8A2000-memory.dmp	xmrig
behavioral2/memory/1956-184-0x00007FF65E4B0000-0x00007FF65E8A2000-memory.dmp	xmrig
behavioral2/memory/1156-167-0x00007FF62BC20000-0x00007FF62C012000-memory.dmp	xmrig
behavioral2/memory/3372-22-0x00007FF754700000-0x00007FF754AF2000-memory.dmp	xmrig
behavioral2/memory/3372-3194-0x00007FF754700000-0x00007FF754AF2000-memory.dmp	xmrig
behavioral2/memory/4596-3201-0x00007FF6EAED0000-0x00007FF6EB2C2000-memory.dmp	xmrig
behavioral2/memory/1764-3204-0x00007FF76E6E0000-0x00007FF76EAD2000-memory.dmp	xmrig
behavioral2/memory/1464-3207-0x00007FF73F830000-0x00007FF73FC22000-memory.dmp	xmrig
behavioral2/memory/2488-3208-0x00007FF7C2F30000-0x00007FF7C3322000-memory.dmp	xmrig
behavioral2/memory/2528-3202-0x00007FF7A15F0000-0x00007FF7A19E2000-memory.dmp	xmrig
behavioral2/memory/1956-3210-0x00007FF65E4B0000-0x00007FF65E8A2000-memory.dmp	xmrig
behavioral2/memory/1156-3212-0x00007FF62BC20000-0x00007FF62C012000-memory.dmp	xmrig
behavioral2/memory/4364-3225-0x00007FF63E4B0000-0x00007FF63E8A2000-memory.dmp	xmrig
behavioral2/memory/1132-3228-0x00007FF63E720000-0x00007FF63EB12000-memory.dmp	xmrig
behavioral2/memory/2820-3230-0x00007FF7AFDC0000-0x00007FF7B01B2000-memory.dmp	xmrig
behavioral2/memory/1660-3227-0x00007FF6DC710000-0x00007FF6DCB02000-memory.dmp	xmrig
behavioral2/memory/4880-3223-0x00007FF7BC5A0000-0x00007FF7BC992000-memory.dmp	xmrig
behavioral2/memory/5096-3221-0x00007FF6D35A0000-0x00007FF6D3992000-memory.dmp	xmrig
behavioral2/memory/4028-3217-0x00007FF6F2FD0000-0x00007FF6F33C2000-memory.dmp	xmrig
behavioral2/memory/1128-3215-0x00007FF75E780000-0x00007FF75EB72000-memory.dmp	xmrig
behavioral2/memory/404-3219-0x00007FF7CF680000-0x00007FF7CFA72000-memory.dmp	xmrig
behavioral2/memory/2508-3232-0x00007FF63D1A0000-0x00007FF63D592000-memory.dmp	xmrig
behavioral2/memory/3344-3298-0x00007FF6F5330000-0x00007FF6F5722000-memory.dmp	xmrig
behavioral2/memory/1224-3300-0x00007FF66F440000-0x00007FF66F832000-memory.dmp	xmrig
behavioral2/memory/380-3299-0x00007FF637E90000-0x00007FF638282000-memory.dmp	xmrig
behavioral2/memory/1224-3307-0x00007FF66F440000-0x00007FF66F832000-memory.dmp	xmrig
behavioral2/memory/3344-3310-0x00007FF6F5330000-0x00007FF6F5722000-memory.dmp	xmrig
behavioral2/memory/380-3323-0x00007FF637E90000-0x00007FF638282000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3372	zFouigH.exe
1764	oSNAJlf.exe
1464	CpXSYwg.exe
4596	RxRJvBP.exe
1156	WuaeYOc.exe
2528	dPrSFkK.exe
1956	JdlPZew.exe
4364	ZzWIIhm.exe
1132	NOkBWrX.exe
2488	QhMIVAv.exe
5096	NOZLxUb.exe
4880	XgbcOcd.exe
2820	lJmGvHj.exe
1128	JSWsaUF.exe
3344	ehsvWLW.exe
1660	klqgGPr.exe
380	BDqCpkk.exe
2508	JkbfwFp.exe
404	YiCxPLn.exe
4028	WwCvJxd.exe
1224	ZZAKaHF.exe
2432	xBBRDHR.exe
436	EZTnVPd.exe
4632	MNQzlmI.exe
4700	wEdZkuj.exe
3660	kitYrbO.exe
1636	OLBjNWu.exe
5008	NjCTmPe.exe
1752	giXVGtK.exe
4204	jtSbaze.exe
4400	KiVpOGr.exe
1540	eWMKgtb.exe
1020	AisVtCX.exe
2036	WmSLSsE.exe
4316	BxNvKOD.exe
1168	sBUGSdu.exe
4308	fiqJyvC.exe
5064	ftLUrQJ.exe
4720	pRhrWLU.exe
4544	NRzleLh.exe
3564	daPAenD.exe
1432	NdOUNNq.exe
2844	vEjEnho.exe
4536	UkxvSem.exe
2248	oaVJbFm.exe
3704	pmaXSVa.exe
4208	OIPMikp.exe
4752	bxfdOYq.exe
4212	YPopXAU.exe
4692	yxLfixO.exe
760	SQUruzY.exe
4476	HtPCieJ.exe
2632	XSeUhEo.exe
1924	fMjXYZI.exe
1932	GNjyJCz.exe
1916	yeMvLJz.exe
3924	itPbLpi.exe
4812	WkjSnVU.exe
2444	cPrIVXZ.exe
3208	TylNeEx.exe
680	uJueVgk.exe
4924	EyIciJG.exe
4660	saunJJc.exe
5084	yGoaHEC.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/244-0-0x00007FF6978F0000-0x00007FF697CE2000-memory.dmp	upx
behavioral2/files/0x000a000000023bca-7.dat	upx
behavioral2/files/0x000c000000023bc2-11.dat	upx
behavioral2/files/0x000a000000023bd6-76.dat	upx
behavioral2/files/0x000a000000023bdd-105.dat	upx
behavioral2/files/0x000a000000023be5-145.dat	upx
behavioral2/memory/2528-183-0x00007FF7A15F0000-0x00007FF7A19E2000-memory.dmp	upx
behavioral2/memory/2488-187-0x00007FF7C2F30000-0x00007FF7C3322000-memory.dmp	upx
behavioral2/memory/1128-190-0x00007FF75E780000-0x00007FF75EB72000-memory.dmp	upx
behavioral2/memory/4028-196-0x00007FF6F2FD0000-0x00007FF6F33C2000-memory.dmp	upx
behavioral2/memory/5096-200-0x00007FF6D35A0000-0x00007FF6D3992000-memory.dmp	upx
behavioral2/memory/4596-199-0x00007FF6EAED0000-0x00007FF6EB2C2000-memory.dmp	upx
behavioral2/memory/1464-198-0x00007FF73F830000-0x00007FF73FC22000-memory.dmp	upx
behavioral2/memory/1224-197-0x00007FF66F440000-0x00007FF66F832000-memory.dmp	upx
behavioral2/memory/404-195-0x00007FF7CF680000-0x00007FF7CFA72000-memory.dmp	upx
behavioral2/memory/2508-194-0x00007FF63D1A0000-0x00007FF63D592000-memory.dmp	upx
behavioral2/memory/380-193-0x00007FF637E90000-0x00007FF638282000-memory.dmp	upx
behavioral2/memory/1660-192-0x00007FF6DC710000-0x00007FF6DCB02000-memory.dmp	upx
behavioral2/memory/3344-191-0x00007FF6F5330000-0x00007FF6F5722000-memory.dmp	upx
behavioral2/memory/2820-189-0x00007FF7AFDC0000-0x00007FF7B01B2000-memory.dmp	upx
behavioral2/memory/4880-188-0x00007FF7BC5A0000-0x00007FF7BC992000-memory.dmp	upx
behavioral2/memory/1132-186-0x00007FF63E720000-0x00007FF63EB12000-memory.dmp	upx
behavioral2/memory/4364-185-0x00007FF63E4B0000-0x00007FF63E8A2000-memory.dmp	upx
behavioral2/memory/1956-184-0x00007FF65E4B0000-0x00007FF65E8A2000-memory.dmp	upx
behavioral2/files/0x0008000000023c0d-182.dat	upx
behavioral2/files/0x000e000000023c0b-180.dat	upx
behavioral2/files/0x0009000000023c07-178.dat	upx
behavioral2/files/0x000a000000023bdc-177.dat	upx
behavioral2/files/0x0009000000023c06-176.dat	upx
behavioral2/files/0x000a000000023be3-175.dat	upx
behavioral2/files/0x0009000000023c05-174.dat	upx
behavioral2/files/0x0008000000023c00-173.dat	upx
behavioral2/files/0x000a000000023be1-172.dat	upx
behavioral2/files/0x000e000000023bf7-171.dat	upx
behavioral2/memory/1156-167-0x00007FF62BC20000-0x00007FF62C012000-memory.dmp	upx
behavioral2/files/0x000a000000023bf0-164.dat	upx
behavioral2/files/0x000b000000023be8-161.dat	upx
behavioral2/files/0x000b000000023be7-160.dat	upx
behavioral2/files/0x000b000000023be6-156.dat	upx
behavioral2/files/0x000a000000023bd9-153.dat	upx
behavioral2/files/0x000a000000023bd8-149.dat	upx
behavioral2/files/0x000a000000023bd7-148.dat	upx
behavioral2/files/0x000a000000023be4-143.dat	upx
behavioral2/files/0x000a000000023bd5-137.dat	upx
behavioral2/files/0x000a000000023bd4-131.dat	upx
behavioral2/files/0x000a000000023be2-129.dat	upx
behavioral2/files/0x000a000000023bda-118.dat	upx
behavioral2/files/0x000a000000023be0-114.dat	upx
behavioral2/files/0x000a000000023bd2-109.dat	upx
behavioral2/files/0x000a000000023bdb-94.dat	upx
behavioral2/files/0x000a000000023bcc-89.dat	upx
behavioral2/files/0x000a000000023bdf-112.dat	upx
behavioral2/files/0x000a000000023bde-108.dat	upx
behavioral2/files/0x000a000000023bd0-99.dat	upx
behavioral2/files/0x000a000000023bd3-91.dat	upx
behavioral2/files/0x000a000000023bcf-65.dat	upx
behavioral2/files/0x000a000000023bd1-49.dat	upx
behavioral2/files/0x000a000000023bc9-43.dat	upx
behavioral2/files/0x000a000000023bcb-59.dat	upx
behavioral2/files/0x000a000000023bce-34.dat	upx
behavioral2/memory/1764-30-0x00007FF76E6E0000-0x00007FF76EAD2000-memory.dmp	upx
behavioral2/files/0x000a000000023bcd-26.dat	upx
behavioral2/memory/3372-22-0x00007FF754700000-0x00007FF754AF2000-memory.dmp	upx
behavioral2/memory/3372-3194-0x00007FF754700000-0x00007FF754AF2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\sgQoXqi.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\KsijDEp.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\faFBIeB.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\SxvCbLG.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\WgDsuCB.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\vgHscMm.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\LYsGDew.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\ulrceHP.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\EdbJInG.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\udSJHGe.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\DsDcxxC.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\TMHvCeS.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\opXMCJC.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\OEPmfQV.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\XFwavej.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\iAEdBvt.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\HYCqSnw.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\zGRtoxv.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\MUpZDIh.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\LFxWLhs.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\NuayLEF.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\YFLVaCH.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\MZQnxSS.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\DBuMALY.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\bNEvgXI.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\WqKDqri.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\HByoMEx.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\jYWiWri.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\OupzFzS.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\trFVgCq.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\Bdhgcgi.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\YvgopBx.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\QYvRgbQ.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\cXNRNiF.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\bkGvYEt.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\xWzGKfz.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\RmrPBHd.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\rFcpJPv.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\ZWquoQJ.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\OBMvXXU.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\iNmoklb.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\cKXNvdu.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\mUdGabH.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\lHuIcVk.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\aRSWOkY.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\NpxxBnM.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\SIpzBLy.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\rZkZRgk.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\JdgIErH.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\gaFMMSM.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\YEkcyrP.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\cZxXCfN.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\ZjISOtr.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\VVmBXLN.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\ayGixoY.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\OJvBIUv.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\bPWaWkz.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\GPFuEoK.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\tecpURa.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\mXrdTGn.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\TYehPjU.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\qnyRjmT.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\NonAVFZ.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\cssbbQS.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5088	powershell.exe
5088	powershell.exe
5088	powershell.exe
5088	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
Token: SeDebugPrivilege	5088	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 244 wrote to memory of 5088	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	84
PID 244 wrote to memory of 5088	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	84
PID 244 wrote to memory of 3372	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	85
PID 244 wrote to memory of 3372	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	85
PID 244 wrote to memory of 1764	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	86
PID 244 wrote to memory of 1764	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	86
PID 244 wrote to memory of 1464	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	87
PID 244 wrote to memory of 1464	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	87
PID 244 wrote to memory of 1156	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	88
PID 244 wrote to memory of 1156	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	88
PID 244 wrote to memory of 4364	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	89
PID 244 wrote to memory of 4364	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	89
PID 244 wrote to memory of 4596	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	90
PID 244 wrote to memory of 4596	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	90
PID 244 wrote to memory of 2528	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	91
PID 244 wrote to memory of 2528	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	91
PID 244 wrote to memory of 1956	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	92
PID 244 wrote to memory of 1956	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	92
PID 244 wrote to memory of 1132	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	93
PID 244 wrote to memory of 1132	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	93
PID 244 wrote to memory of 2488	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	94
PID 244 wrote to memory of 2488	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	94
PID 244 wrote to memory of 5096	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	95
PID 244 wrote to memory of 5096	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	95
PID 244 wrote to memory of 4880	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	96
PID 244 wrote to memory of 4880	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	96
PID 244 wrote to memory of 2820	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	97
PID 244 wrote to memory of 2820	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	97
PID 244 wrote to memory of 1128	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	98
PID 244 wrote to memory of 1128	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	98
PID 244 wrote to memory of 3344	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	99
PID 244 wrote to memory of 3344	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	99
PID 244 wrote to memory of 1660	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	100
PID 244 wrote to memory of 1660	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	100
PID 244 wrote to memory of 380	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	101
PID 244 wrote to memory of 380	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	101
PID 244 wrote to memory of 2508	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	102
PID 244 wrote to memory of 2508	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	102
PID 244 wrote to memory of 404	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	103
PID 244 wrote to memory of 404	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	103
PID 244 wrote to memory of 4028	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	104
PID 244 wrote to memory of 4028	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	104
PID 244 wrote to memory of 1224	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	105
PID 244 wrote to memory of 1224	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	105
PID 244 wrote to memory of 2432	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	106
PID 244 wrote to memory of 2432	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	106
PID 244 wrote to memory of 436	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	107
PID 244 wrote to memory of 436	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	107
PID 244 wrote to memory of 4632	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	108
PID 244 wrote to memory of 4632	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	108
PID 244 wrote to memory of 4700	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	109
PID 244 wrote to memory of 4700	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	109
PID 244 wrote to memory of 3660	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	110
PID 244 wrote to memory of 3660	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	110
PID 244 wrote to memory of 1636	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	111
PID 244 wrote to memory of 1636	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	111
PID 244 wrote to memory of 4308	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	112
PID 244 wrote to memory of 4308	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	112
PID 244 wrote to memory of 5008	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	113
PID 244 wrote to memory of 5008	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	113
PID 244 wrote to memory of 1752	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	114
PID 244 wrote to memory of 1752	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	114
PID 244 wrote to memory of 4204	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	115
PID 244 wrote to memory of 4204	244	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5088
- C:\Windows\System\zFouigH.exe
  C:\Windows\System\zFouigH.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\oSNAJlf.exe
  C:\Windows\System\oSNAJlf.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\CpXSYwg.exe
  C:\Windows\System\CpXSYwg.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\WuaeYOc.exe
  C:\Windows\System\WuaeYOc.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\ZzWIIhm.exe
  C:\Windows\System\ZzWIIhm.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\RxRJvBP.exe
  C:\Windows\System\RxRJvBP.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\dPrSFkK.exe
  C:\Windows\System\dPrSFkK.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\JdlPZew.exe
  C:\Windows\System\JdlPZew.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\NOkBWrX.exe
  C:\Windows\System\NOkBWrX.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\QhMIVAv.exe
  C:\Windows\System\QhMIVAv.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\NOZLxUb.exe
  C:\Windows\System\NOZLxUb.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\XgbcOcd.exe
  C:\Windows\System\XgbcOcd.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\lJmGvHj.exe
  C:\Windows\System\lJmGvHj.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\JSWsaUF.exe
  C:\Windows\System\JSWsaUF.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\ehsvWLW.exe
  C:\Windows\System\ehsvWLW.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System\klqgGPr.exe
  C:\Windows\System\klqgGPr.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\BDqCpkk.exe
  C:\Windows\System\BDqCpkk.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\JkbfwFp.exe
  C:\Windows\System\JkbfwFp.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\YiCxPLn.exe
  C:\Windows\System\YiCxPLn.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\WwCvJxd.exe
  C:\Windows\System\WwCvJxd.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\ZZAKaHF.exe
  C:\Windows\System\ZZAKaHF.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\xBBRDHR.exe
  C:\Windows\System\xBBRDHR.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\EZTnVPd.exe
  C:\Windows\System\EZTnVPd.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\MNQzlmI.exe
  C:\Windows\System\MNQzlmI.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\wEdZkuj.exe
  C:\Windows\System\wEdZkuj.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\kitYrbO.exe
  C:\Windows\System\kitYrbO.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\OLBjNWu.exe
  C:\Windows\System\OLBjNWu.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\fiqJyvC.exe
  C:\Windows\System\fiqJyvC.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\NjCTmPe.exe
  C:\Windows\System\NjCTmPe.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\giXVGtK.exe
  C:\Windows\System\giXVGtK.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\jtSbaze.exe
  C:\Windows\System\jtSbaze.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\KiVpOGr.exe
  C:\Windows\System\KiVpOGr.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\eWMKgtb.exe
  C:\Windows\System\eWMKgtb.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\AisVtCX.exe
  C:\Windows\System\AisVtCX.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\WmSLSsE.exe
  C:\Windows\System\WmSLSsE.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\BxNvKOD.exe
  C:\Windows\System\BxNvKOD.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\sBUGSdu.exe
  C:\Windows\System\sBUGSdu.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\ftLUrQJ.exe
  C:\Windows\System\ftLUrQJ.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\pRhrWLU.exe
  C:\Windows\System\pRhrWLU.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\NRzleLh.exe
  C:\Windows\System\NRzleLh.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\daPAenD.exe
  C:\Windows\System\daPAenD.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\NdOUNNq.exe
  C:\Windows\System\NdOUNNq.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\vEjEnho.exe
  C:\Windows\System\vEjEnho.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\UkxvSem.exe
  C:\Windows\System\UkxvSem.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\oaVJbFm.exe
  C:\Windows\System\oaVJbFm.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\pmaXSVa.exe
  C:\Windows\System\pmaXSVa.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\OIPMikp.exe
  C:\Windows\System\OIPMikp.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\fgHoILK.exe
  C:\Windows\System\fgHoILK.exe
  2⤵
  PID:4360
- C:\Windows\System\bxfdOYq.exe
  C:\Windows\System\bxfdOYq.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\YPopXAU.exe
  C:\Windows\System\YPopXAU.exe
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Windows\System\QacOIqn.exe
  C:\Windows\System\QacOIqn.exe
  2⤵
  PID:2780
- C:\Windows\System\yxLfixO.exe
  C:\Windows\System\yxLfixO.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\SQUruzY.exe
  C:\Windows\System\SQUruzY.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\HtPCieJ.exe
  C:\Windows\System\HtPCieJ.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\XSeUhEo.exe
  C:\Windows\System\XSeUhEo.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\fMjXYZI.exe
  C:\Windows\System\fMjXYZI.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\GNjyJCz.exe
  C:\Windows\System\GNjyJCz.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\yeMvLJz.exe
  C:\Windows\System\yeMvLJz.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\itPbLpi.exe
  C:\Windows\System\itPbLpi.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\WkjSnVU.exe
  C:\Windows\System\WkjSnVU.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\cPrIVXZ.exe
  C:\Windows\System\cPrIVXZ.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\TylNeEx.exe
  C:\Windows\System\TylNeEx.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\uJueVgk.exe
  C:\Windows\System\uJueVgk.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\EyIciJG.exe
  C:\Windows\System\EyIciJG.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\saunJJc.exe
  C:\Windows\System\saunJJc.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\yGoaHEC.exe
  C:\Windows\System\yGoaHEC.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\NaHWpwk.exe
  C:\Windows\System\NaHWpwk.exe
  2⤵
  PID:4520
- C:\Windows\System\sYXkuWy.exe
  C:\Windows\System\sYXkuWy.exe
  2⤵
  PID:1328
- C:\Windows\System\grHgMZA.exe
  C:\Windows\System\grHgMZA.exe
  2⤵
  PID:4648
- C:\Windows\System\yzvIGnA.exe
  C:\Windows\System\yzvIGnA.exe
  2⤵
  PID:4800
- C:\Windows\System\gdZbsSR.exe
  C:\Windows\System\gdZbsSR.exe
  2⤵
  PID:4152
- C:\Windows\System\eTrXvbU.exe
  C:\Windows\System\eTrXvbU.exe
  2⤵
  PID:2520
- C:\Windows\System\quiIxlI.exe
  C:\Windows\System\quiIxlI.exe
  2⤵
  PID:2544
- C:\Windows\System\Rurbaet.exe
  C:\Windows\System\Rurbaet.exe
  2⤵
  PID:516
- C:\Windows\System\zMlKJxZ.exe
  C:\Windows\System\zMlKJxZ.exe
  2⤵
  PID:2868
- C:\Windows\System\xukpTur.exe
  C:\Windows\System\xukpTur.exe
  2⤵
  PID:3200
- C:\Windows\System\WXysVUN.exe
  C:\Windows\System\WXysVUN.exe
  2⤵
  PID:1436
- C:\Windows\System\qGWjHOi.exe
  C:\Windows\System\qGWjHOi.exe
  2⤵
  PID:5052
- C:\Windows\System\PoHnXAn.exe
  C:\Windows\System\PoHnXAn.exe
  2⤵
  PID:5004
- C:\Windows\System\CPqRQLL.exe
  C:\Windows\System\CPqRQLL.exe
  2⤵
  PID:4384
- C:\Windows\System\zIIhcqG.exe
  C:\Windows\System\zIIhcqG.exe
  2⤵
  PID:1576
- C:\Windows\System\rtgeRBl.exe
  C:\Windows\System\rtgeRBl.exe
  2⤵
  PID:2080
- C:\Windows\System\xBBtYSG.exe
  C:\Windows\System\xBBtYSG.exe
  2⤵
  PID:4864
- C:\Windows\System\MctJJuW.exe
  C:\Windows\System\MctJJuW.exe
  2⤵
  PID:2964
- C:\Windows\System\nAKTwEH.exe
  C:\Windows\System\nAKTwEH.exe
  2⤵
  PID:3316
- C:\Windows\System\LjOhRWw.exe
  C:\Windows\System\LjOhRWw.exe
  2⤵
  PID:2656
- C:\Windows\System\xYFSlDC.exe
  C:\Windows\System\xYFSlDC.exe
  2⤵
  PID:5012
- C:\Windows\System\VccQJkZ.exe
  C:\Windows\System\VccQJkZ.exe
  2⤵
  PID:2692
- C:\Windows\System\XFwavej.exe
  C:\Windows\System\XFwavej.exe
  2⤵
  PID:4256
- C:\Windows\System\SxvCbLG.exe
  C:\Windows\System\SxvCbLG.exe
  2⤵
  PID:4948
- C:\Windows\System\acMNrhK.exe
  C:\Windows\System\acMNrhK.exe
  2⤵
  PID:2392
- C:\Windows\System\rubkkzf.exe
  C:\Windows\System\rubkkzf.exe
  2⤵
  PID:3480
- C:\Windows\System\DNYvqVN.exe
  C:\Windows\System\DNYvqVN.exe
  2⤵
  PID:3864
- C:\Windows\System\LfIDfRl.exe
  C:\Windows\System\LfIDfRl.exe
  2⤵
  PID:400
- C:\Windows\System\lcxJSUe.exe
  C:\Windows\System\lcxJSUe.exe
  2⤵
  PID:912
- C:\Windows\System\UYXqhCv.exe
  C:\Windows\System\UYXqhCv.exe
  2⤵
  PID:4984
- C:\Windows\System\LxMZtpW.exe
  C:\Windows\System\LxMZtpW.exe
  2⤵
  PID:2264
- C:\Windows\System\TWQouhF.exe
  C:\Windows\System\TWQouhF.exe
  2⤵
  PID:2100
- C:\Windows\System\rZkZRgk.exe
  C:\Windows\System\rZkZRgk.exe
  2⤵
  PID:3992
- C:\Windows\System\sCgyxRX.exe
  C:\Windows\System\sCgyxRX.exe
  2⤵
  PID:3264
- C:\Windows\System\feZGzRZ.exe
  C:\Windows\System\feZGzRZ.exe
  2⤵
  PID:2776
- C:\Windows\System\FVyYPGo.exe
  C:\Windows\System\FVyYPGo.exe
  2⤵
  PID:4652
- C:\Windows\System\qrSmAze.exe
  C:\Windows\System\qrSmAze.exe
  2⤵
  PID:3812
- C:\Windows\System\wqTDmtg.exe
  C:\Windows\System\wqTDmtg.exe
  2⤵
  PID:3180
- C:\Windows\System\RJNWMXY.exe
  C:\Windows\System\RJNWMXY.exe
  2⤵
  PID:4612
- C:\Windows\System\OoOAeRl.exe
  C:\Windows\System\OoOAeRl.exe
  2⤵
  PID:4792
- C:\Windows\System\ZMrDvwQ.exe
  C:\Windows\System\ZMrDvwQ.exe
  2⤵
  PID:4488
- C:\Windows\System\xfoyGJk.exe
  C:\Windows\System\xfoyGJk.exe
  2⤵
  PID:5124
- C:\Windows\System\DrHlkiM.exe
  C:\Windows\System\DrHlkiM.exe
  2⤵
  PID:5140
- C:\Windows\System\wyyRXdD.exe
  C:\Windows\System\wyyRXdD.exe
  2⤵
  PID:5168
- C:\Windows\System\flgxUJx.exe
  C:\Windows\System\flgxUJx.exe
  2⤵
  PID:5188
- C:\Windows\System\xobITpr.exe
  C:\Windows\System\xobITpr.exe
  2⤵
  PID:5212
- C:\Windows\System\lUGtiiK.exe
  C:\Windows\System\lUGtiiK.exe
  2⤵
  PID:5232
- C:\Windows\System\fIGyqAc.exe
  C:\Windows\System\fIGyqAc.exe
  2⤵
  PID:5256
- C:\Windows\System\XZurvJu.exe
  C:\Windows\System\XZurvJu.exe
  2⤵
  PID:5272
- C:\Windows\System\ogzxsay.exe
  C:\Windows\System\ogzxsay.exe
  2⤵
  PID:5296
- C:\Windows\System\UJCQIHq.exe
  C:\Windows\System\UJCQIHq.exe
  2⤵
  PID:5316
- C:\Windows\System\alWDGka.exe
  C:\Windows\System\alWDGka.exe
  2⤵
  PID:5340
- C:\Windows\System\PekacFG.exe
  C:\Windows\System\PekacFG.exe
  2⤵
  PID:5364
- C:\Windows\System\JCBmGYw.exe
  C:\Windows\System\JCBmGYw.exe
  2⤵
  PID:5424
- C:\Windows\System\QaBCUgb.exe
  C:\Windows\System\QaBCUgb.exe
  2⤵
  PID:5452
- C:\Windows\System\cyfdgEH.exe
  C:\Windows\System\cyfdgEH.exe
  2⤵
  PID:5472
- C:\Windows\System\RPiJSyq.exe
  C:\Windows\System\RPiJSyq.exe
  2⤵
  PID:5496
- C:\Windows\System\OYegVqV.exe
  C:\Windows\System\OYegVqV.exe
  2⤵
  PID:5516
- C:\Windows\System\LlDybBj.exe
  C:\Windows\System\LlDybBj.exe
  2⤵
  PID:5532
- C:\Windows\System\dfFFLlZ.exe
  C:\Windows\System\dfFFLlZ.exe
  2⤵
  PID:5560
- C:\Windows\System\hjuEmFF.exe
  C:\Windows\System\hjuEmFF.exe
  2⤵
  PID:5580
- C:\Windows\System\lpFZtvu.exe
  C:\Windows\System\lpFZtvu.exe
  2⤵
  PID:5612
- C:\Windows\System\SHPjrZI.exe
  C:\Windows\System\SHPjrZI.exe
  2⤵
  PID:5632
- C:\Windows\System\TlWzmjs.exe
  C:\Windows\System\TlWzmjs.exe
  2⤵
  PID:5656
- C:\Windows\System\MgaZvUX.exe
  C:\Windows\System\MgaZvUX.exe
  2⤵
  PID:5680
- C:\Windows\System\UnXrfrM.exe
  C:\Windows\System\UnXrfrM.exe
  2⤵
  PID:5700
- C:\Windows\System\bdUkSfs.exe
  C:\Windows\System\bdUkSfs.exe
  2⤵
  PID:5720
- C:\Windows\System\gZQUHwN.exe
  C:\Windows\System\gZQUHwN.exe
  2⤵
  PID:5744
- C:\Windows\System\okFFyug.exe
  C:\Windows\System\okFFyug.exe
  2⤵
  PID:5764
- C:\Windows\System\evxexNS.exe
  C:\Windows\System\evxexNS.exe
  2⤵
  PID:5792
- C:\Windows\System\suLFbWR.exe
  C:\Windows\System\suLFbWR.exe
  2⤵
  PID:5808
- C:\Windows\System\qiGWtNh.exe
  C:\Windows\System\qiGWtNh.exe
  2⤵
  PID:5832
- C:\Windows\System\tqdcFaN.exe
  C:\Windows\System\tqdcFaN.exe
  2⤵
  PID:5848
- C:\Windows\System\VRWXzHx.exe
  C:\Windows\System\VRWXzHx.exe
  2⤵
  PID:5872
- C:\Windows\System\DvSyIZy.exe
  C:\Windows\System\DvSyIZy.exe
  2⤵
  PID:5896
- C:\Windows\System\IWJgDjW.exe
  C:\Windows\System\IWJgDjW.exe
  2⤵
  PID:5912
- C:\Windows\System\GMNRaPl.exe
  C:\Windows\System\GMNRaPl.exe
  2⤵
  PID:5936
- C:\Windows\System\AIOpHYE.exe
  C:\Windows\System\AIOpHYE.exe
  2⤵
  PID:5952
- C:\Windows\System\OxhGVTV.exe
  C:\Windows\System\OxhGVTV.exe
  2⤵
  PID:5976
- C:\Windows\System\EIQqDtj.exe
  C:\Windows\System\EIQqDtj.exe
  2⤵
  PID:5996
- C:\Windows\System\FaVICWv.exe
  C:\Windows\System\FaVICWv.exe
  2⤵
  PID:6016
- C:\Windows\System\LFuXUbE.exe
  C:\Windows\System\LFuXUbE.exe
  2⤵
  PID:6044
- C:\Windows\System\lnkTvuW.exe
  C:\Windows\System\lnkTvuW.exe
  2⤵
  PID:6064
- C:\Windows\System\zZiEHXv.exe
  C:\Windows\System\zZiEHXv.exe
  2⤵
  PID:6084
- C:\Windows\System\DYuPfJQ.exe
  C:\Windows\System\DYuPfJQ.exe
  2⤵
  PID:6100
- C:\Windows\System\VlURBzX.exe
  C:\Windows\System\VlURBzX.exe
  2⤵
  PID:6124
- C:\Windows\System\HOFyKRb.exe
  C:\Windows\System\HOFyKRb.exe
  2⤵
  PID:6140
- C:\Windows\System\kGCUtLv.exe
  C:\Windows\System\kGCUtLv.exe
  2⤵
  PID:4876
- C:\Windows\System\YvfvTRj.exe
  C:\Windows\System\YvfvTRj.exe
  2⤵
  PID:2992
- C:\Windows\System\ZqOJhZc.exe
  C:\Windows\System\ZqOJhZc.exe
  2⤵
  PID:396
- C:\Windows\System\HmyXsHq.exe
  C:\Windows\System\HmyXsHq.exe
  2⤵
  PID:3256
- C:\Windows\System\ztcHwwZ.exe
  C:\Windows\System\ztcHwwZ.exe
  2⤵
  PID:3936
- C:\Windows\System\dQmsKNx.exe
  C:\Windows\System\dQmsKNx.exe
  2⤵
  PID:3572
- C:\Windows\System\IJcDmLI.exe
  C:\Windows\System\IJcDmLI.exe
  2⤵
  PID:1840
- C:\Windows\System\hkWlVZQ.exe
  C:\Windows\System\hkWlVZQ.exe
  2⤵
  PID:5024
- C:\Windows\System\uUhXkZe.exe
  C:\Windows\System\uUhXkZe.exe
  2⤵
  PID:5308
- C:\Windows\System\DTKeZhl.exe
  C:\Windows\System\DTKeZhl.exe
  2⤵
  PID:5348
- C:\Windows\System\YHkewaS.exe
  C:\Windows\System\YHkewaS.exe
  2⤵
  PID:5372
- C:\Windows\System\tiiKpgO.exe
  C:\Windows\System\tiiKpgO.exe
  2⤵
  PID:2728
- C:\Windows\System\IFURGSr.exe
  C:\Windows\System\IFURGSr.exe
  2⤵
  PID:5436
- C:\Windows\System\RixTqAB.exe
  C:\Windows\System\RixTqAB.exe
  2⤵
  PID:5480
- C:\Windows\System\uufLYrm.exe
  C:\Windows\System\uufLYrm.exe
  2⤵
  PID:1148
- C:\Windows\System\JyEqdOt.exe
  C:\Windows\System\JyEqdOt.exe
  2⤵
  PID:3544
- C:\Windows\System\yBpiJGF.exe
  C:\Windows\System\yBpiJGF.exe
  2⤵
  PID:5148
- C:\Windows\System\SnvyEkZ.exe
  C:\Windows\System\SnvyEkZ.exe
  2⤵
  PID:5224
- C:\Windows\System\fCxbyTK.exe
  C:\Windows\System\fCxbyTK.exe
  2⤵
  PID:5200
- C:\Windows\System\qSWUloX.exe
  C:\Windows\System\qSWUloX.exe
  2⤵
  PID:6156
- C:\Windows\System\YnYJXLE.exe
  C:\Windows\System\YnYJXLE.exe
  2⤵
  PID:6176
- C:\Windows\System\eLGTpYM.exe
  C:\Windows\System\eLGTpYM.exe
  2⤵
  PID:6196
- C:\Windows\System\CCYcyEe.exe
  C:\Windows\System\CCYcyEe.exe
  2⤵
  PID:6216
- C:\Windows\System\RTIGuqf.exe
  C:\Windows\System\RTIGuqf.exe
  2⤵
  PID:6240
- C:\Windows\System\BzZcGBt.exe
  C:\Windows\System\BzZcGBt.exe
  2⤵
  PID:6268
- C:\Windows\System\tecpURa.exe
  C:\Windows\System\tecpURa.exe
  2⤵
  PID:6288
- C:\Windows\System\YvFMUSu.exe
  C:\Windows\System\YvFMUSu.exe
  2⤵
  PID:6304
- C:\Windows\System\JdgIErH.exe
  C:\Windows\System\JdgIErH.exe
  2⤵
  PID:6324
- C:\Windows\System\SiHuplf.exe
  C:\Windows\System\SiHuplf.exe
  2⤵
  PID:6348
- C:\Windows\System\QGwlOBs.exe
  C:\Windows\System\QGwlOBs.exe
  2⤵
  PID:6368
- C:\Windows\System\LHUZyLe.exe
  C:\Windows\System\LHUZyLe.exe
  2⤵
  PID:6388
- C:\Windows\System\TsuUeEv.exe
  C:\Windows\System\TsuUeEv.exe
  2⤵
  PID:6412
- C:\Windows\System\tFVjSbR.exe
  C:\Windows\System\tFVjSbR.exe
  2⤵
  PID:6436
- C:\Windows\System\vrBeWIx.exe
  C:\Windows\System\vrBeWIx.exe
  2⤵
  PID:6460
- C:\Windows\System\mkcwOly.exe
  C:\Windows\System\mkcwOly.exe
  2⤵
  PID:6488
- C:\Windows\System\pVoffsr.exe
  C:\Windows\System\pVoffsr.exe
  2⤵
  PID:6508
- C:\Windows\System\sFIAcRh.exe
  C:\Windows\System\sFIAcRh.exe
  2⤵
  PID:6528
- C:\Windows\System\thEoHYD.exe
  C:\Windows\System\thEoHYD.exe
  2⤵
  PID:6548
- C:\Windows\System\VDfqqqR.exe
  C:\Windows\System\VDfqqqR.exe
  2⤵
  PID:6572
- C:\Windows\System\tVPQlQV.exe
  C:\Windows\System\tVPQlQV.exe
  2⤵
  PID:6588
- C:\Windows\System\rrVUjjM.exe
  C:\Windows\System\rrVUjjM.exe
  2⤵
  PID:6612
- C:\Windows\System\FuyUGdU.exe
  C:\Windows\System\FuyUGdU.exe
  2⤵
  PID:6648
- C:\Windows\System\JWEZwAC.exe
  C:\Windows\System\JWEZwAC.exe
  2⤵
  PID:6672
- C:\Windows\System\dCpbJdG.exe
  C:\Windows\System\dCpbJdG.exe
  2⤵
  PID:6692
- C:\Windows\System\ggefAUW.exe
  C:\Windows\System\ggefAUW.exe
  2⤵
  PID:6712
- C:\Windows\System\dDvtPZr.exe
  C:\Windows\System\dDvtPZr.exe
  2⤵
  PID:6728
- C:\Windows\System\mOwkZfv.exe
  C:\Windows\System\mOwkZfv.exe
  2⤵
  PID:6748
- C:\Windows\System\wiVEcKv.exe
  C:\Windows\System\wiVEcKv.exe
  2⤵
  PID:6764
- C:\Windows\System\JVulYUL.exe
  C:\Windows\System\JVulYUL.exe
  2⤵
  PID:6792
- C:\Windows\System\OiFTyUD.exe
  C:\Windows\System\OiFTyUD.exe
  2⤵
  PID:6812
- C:\Windows\System\JVazfmD.exe
  C:\Windows\System\JVazfmD.exe
  2⤵
  PID:6836
- C:\Windows\System\DBuMALY.exe
  C:\Windows\System\DBuMALY.exe
  2⤵
  PID:6856
- C:\Windows\System\zjenGLL.exe
  C:\Windows\System\zjenGLL.exe
  2⤵
  PID:6880
- C:\Windows\System\dEAAtGi.exe
  C:\Windows\System\dEAAtGi.exe
  2⤵
  PID:6896
- C:\Windows\System\wAzFnRk.exe
  C:\Windows\System\wAzFnRk.exe
  2⤵
  PID:6916
- C:\Windows\System\mXrdTGn.exe
  C:\Windows\System\mXrdTGn.exe
  2⤵
  PID:6936
- C:\Windows\System\bjNopmc.exe
  C:\Windows\System\bjNopmc.exe
  2⤵
  PID:6952
- C:\Windows\System\hilMNLi.exe
  C:\Windows\System\hilMNLi.exe
  2⤵
  PID:6972
- C:\Windows\System\vOxMaKi.exe
  C:\Windows\System\vOxMaKi.exe
  2⤵
  PID:7000
- C:\Windows\System\FrKnvAs.exe
  C:\Windows\System\FrKnvAs.exe
  2⤵
  PID:7024
- C:\Windows\System\cssbbQS.exe
  C:\Windows\System\cssbbQS.exe
  2⤵
  PID:7040
- C:\Windows\System\yJlBxSe.exe
  C:\Windows\System\yJlBxSe.exe
  2⤵
  PID:7064
- C:\Windows\System\AkUhfrs.exe
  C:\Windows\System\AkUhfrs.exe
  2⤵
  PID:7084
- C:\Windows\System\FYcrYCM.exe
  C:\Windows\System\FYcrYCM.exe
  2⤵
  PID:7108
- C:\Windows\System\MvkeQlS.exe
  C:\Windows\System\MvkeQlS.exe
  2⤵
  PID:7124
- C:\Windows\System\iNmoklb.exe
  C:\Windows\System\iNmoklb.exe
  2⤵
  PID:7148
- C:\Windows\System\onLIamO.exe
  C:\Windows\System\onLIamO.exe
  2⤵
  PID:5696
- C:\Windows\System\nFsiiqG.exe
  C:\Windows\System\nFsiiqG.exe
  2⤵
  PID:5736
- C:\Windows\System\kjNkxJl.exe
  C:\Windows\System\kjNkxJl.exe
  2⤵
  PID:5820
- C:\Windows\System\pltIgoN.exe
  C:\Windows\System\pltIgoN.exe
  2⤵
  PID:5908
- C:\Windows\System\rgmkfoQ.exe
  C:\Windows\System\rgmkfoQ.exe
  2⤵
  PID:5984
- C:\Windows\System\dVKPMDv.exe
  C:\Windows\System\dVKPMDv.exe
  2⤵
  PID:6028
- C:\Windows\System\TFuaDld.exe
  C:\Windows\System\TFuaDld.exe
  2⤵
  PID:6060
- C:\Windows\System\OkQrnGt.exe
  C:\Windows\System\OkQrnGt.exe
  2⤵
  PID:6132
- C:\Windows\System\eErgiaj.exe
  C:\Windows\System\eErgiaj.exe
  2⤵
  PID:2668
- C:\Windows\System\WhfNFdZ.exe
  C:\Windows\System\WhfNFdZ.exe
  2⤵
  PID:4796
- C:\Windows\System\cjDMkJa.exe
  C:\Windows\System\cjDMkJa.exe
  2⤵
  PID:1600
- C:\Windows\System\EyOaGts.exe
  C:\Windows\System\EyOaGts.exe
  2⤵
  PID:5328
- C:\Windows\System\HMDUOZF.exe
  C:\Windows\System\HMDUOZF.exe
  2⤵
  PID:5228
- C:\Windows\System\XPSzWnf.exe
  C:\Windows\System\XPSzWnf.exe
  2⤵
  PID:3260
- C:\Windows\System\NpxxBnM.exe
  C:\Windows\System\NpxxBnM.exe
  2⤵
  PID:5284
- C:\Windows\System\bYPUCAY.exe
  C:\Windows\System\bYPUCAY.exe
  2⤵
  PID:5692
- C:\Windows\System\CmVqRDx.exe
  C:\Windows\System\CmVqRDx.exe
  2⤵
  PID:6236
- C:\Windows\System\LAEQket.exe
  C:\Windows\System\LAEQket.exe
  2⤵
  PID:6280
- C:\Windows\System\OUUjBEQ.exe
  C:\Windows\System\OUUjBEQ.exe
  2⤵
  PID:5840
- C:\Windows\System\uqzAiRs.exe
  C:\Windows\System\uqzAiRs.exe
  2⤵
  PID:6376
- C:\Windows\System\yrEULzj.exe
  C:\Windows\System\yrEULzj.exe
  2⤵
  PID:5888
- C:\Windows\System\BEbFwML.exe
  C:\Windows\System\BEbFwML.exe
  2⤵
  PID:5944
- C:\Windows\System\KgAIASA.exe
  C:\Windows\System\KgAIASA.exe
  2⤵
  PID:6476
- C:\Windows\System\SVFdWKQ.exe
  C:\Windows\System\SVFdWKQ.exe
  2⤵
  PID:6520
- C:\Windows\System\cbhygUi.exe
  C:\Windows\System\cbhygUi.exe
  2⤵
  PID:3412
- C:\Windows\System\tHeckPt.exe
  C:\Windows\System\tHeckPt.exe
  2⤵
  PID:3540
- C:\Windows\System\PQybzkQ.exe
  C:\Windows\System\PQybzkQ.exe
  2⤵
  PID:6628
- C:\Windows\System\OjdKknC.exe
  C:\Windows\System\OjdKknC.exe
  2⤵
  PID:376
- C:\Windows\System\gmOXyjq.exe
  C:\Windows\System\gmOXyjq.exe
  2⤵
  PID:6724
- C:\Windows\System\vaAwzbM.exe
  C:\Windows\System\vaAwzbM.exe
  2⤵
  PID:6772
- C:\Windows\System\FrstlmC.exe
  C:\Windows\System\FrstlmC.exe
  2⤵
  PID:6804
- C:\Windows\System\YWIfsLW.exe
  C:\Windows\System\YWIfsLW.exe
  2⤵
  PID:6868
- C:\Windows\System\HVBVtfT.exe
  C:\Windows\System\HVBVtfT.exe
  2⤵
  PID:6912
- C:\Windows\System\izgYIvl.exe
  C:\Windows\System\izgYIvl.exe
  2⤵
  PID:6964
- C:\Windows\System\THYkLAt.exe
  C:\Windows\System\THYkLAt.exe
  2⤵
  PID:7176
- C:\Windows\System\aXEBzHc.exe
  C:\Windows\System\aXEBzHc.exe
  2⤵
  PID:7192
- C:\Windows\System\AYFuAix.exe
  C:\Windows\System\AYFuAix.exe
  2⤵
  PID:7224
- C:\Windows\System\NjgnVte.exe
  C:\Windows\System\NjgnVte.exe
  2⤵
  PID:7244
- C:\Windows\System\encxgwK.exe
  C:\Windows\System\encxgwK.exe
  2⤵
  PID:7264
- C:\Windows\System\WqKDqri.exe
  C:\Windows\System\WqKDqri.exe
  2⤵
  PID:7284
- C:\Windows\System\DqgffTM.exe
  C:\Windows\System\DqgffTM.exe
  2⤵
  PID:7304
- C:\Windows\System\CaqeZcL.exe
  C:\Windows\System\CaqeZcL.exe
  2⤵
  PID:7320
- C:\Windows\System\AYbDsSP.exe
  C:\Windows\System\AYbDsSP.exe
  2⤵
  PID:7344
- C:\Windows\System\zPLGPjG.exe
  C:\Windows\System\zPLGPjG.exe
  2⤵
  PID:7364
- C:\Windows\System\hgaymap.exe
  C:\Windows\System\hgaymap.exe
  2⤵
  PID:7384
- C:\Windows\System\EryIkEU.exe
  C:\Windows\System\EryIkEU.exe
  2⤵
  PID:7408
- C:\Windows\System\QGKzBML.exe
  C:\Windows\System\QGKzBML.exe
  2⤵
  PID:7424
- C:\Windows\System\NRdRNvQ.exe
  C:\Windows\System\NRdRNvQ.exe
  2⤵
  PID:7448
- C:\Windows\System\LJBNSDG.exe
  C:\Windows\System\LJBNSDG.exe
  2⤵
  PID:7476
- C:\Windows\System\GvrBVuR.exe
  C:\Windows\System\GvrBVuR.exe
  2⤵
  PID:7504
- C:\Windows\System\jZhXpxI.exe
  C:\Windows\System\jZhXpxI.exe
  2⤵
  PID:7524
- C:\Windows\System\udOZLjk.exe
  C:\Windows\System\udOZLjk.exe
  2⤵
  PID:7540
- C:\Windows\System\AmAgsTP.exe
  C:\Windows\System\AmAgsTP.exe
  2⤵
  PID:7568
- C:\Windows\System\TqsVPYC.exe
  C:\Windows\System\TqsVPYC.exe
  2⤵
  PID:7584
- C:\Windows\System\uHirFgm.exe
  C:\Windows\System\uHirFgm.exe
  2⤵
  PID:7604
- C:\Windows\System\HtpqOYo.exe
  C:\Windows\System\HtpqOYo.exe
  2⤵
  PID:7628
- C:\Windows\System\cgiynYF.exe
  C:\Windows\System\cgiynYF.exe
  2⤵
  PID:7644
- C:\Windows\System\ZrxnQXc.exe
  C:\Windows\System\ZrxnQXc.exe
  2⤵
  PID:7668
- C:\Windows\System\KEExviB.exe
  C:\Windows\System\KEExviB.exe
  2⤵
  PID:7688
- C:\Windows\System\beGVGBQ.exe
  C:\Windows\System\beGVGBQ.exe
  2⤵
  PID:7708
- C:\Windows\System\GTVRPLo.exe
  C:\Windows\System\GTVRPLo.exe
  2⤵
  PID:7728
- C:\Windows\System\sihpwiA.exe
  C:\Windows\System\sihpwiA.exe
  2⤵
  PID:7748
- C:\Windows\System\oNbvrrk.exe
  C:\Windows\System\oNbvrrk.exe
  2⤵
  PID:7772
- C:\Windows\System\mhtFWuR.exe
  C:\Windows\System\mhtFWuR.exe
  2⤵
  PID:7792
- C:\Windows\System\YwWEFRD.exe
  C:\Windows\System\YwWEFRD.exe
  2⤵
  PID:7812
- C:\Windows\System\KXHxKqT.exe
  C:\Windows\System\KXHxKqT.exe
  2⤵
  PID:7836
- C:\Windows\System\WRdTIdt.exe
  C:\Windows\System\WRdTIdt.exe
  2⤵
  PID:7852
- C:\Windows\System\biafGRx.exe
  C:\Windows\System\biafGRx.exe
  2⤵
  PID:7876
- C:\Windows\System\OabIdyJ.exe
  C:\Windows\System\OabIdyJ.exe
  2⤵
  PID:7892
- C:\Windows\System\JdAzSrh.exe
  C:\Windows\System\JdAzSrh.exe
  2⤵
  PID:7916
- C:\Windows\System\YAPFrSK.exe
  C:\Windows\System\YAPFrSK.exe
  2⤵
  PID:7944
- C:\Windows\System\NEqgWYX.exe
  C:\Windows\System\NEqgWYX.exe
  2⤵
  PID:7968
- C:\Windows\System\YjfnTsr.exe
  C:\Windows\System\YjfnTsr.exe
  2⤵
  PID:7988
- C:\Windows\System\PWlPpCH.exe
  C:\Windows\System\PWlPpCH.exe
  2⤵
  PID:8016
- C:\Windows\System\hdhxeeZ.exe
  C:\Windows\System\hdhxeeZ.exe
  2⤵
  PID:8036
- C:\Windows\System\JiWeOgD.exe
  C:\Windows\System\JiWeOgD.exe
  2⤵
  PID:8056
- C:\Windows\System\vhsIphX.exe
  C:\Windows\System\vhsIphX.exe
  2⤵
  PID:8072
- C:\Windows\System\GsCiBWk.exe
  C:\Windows\System\GsCiBWk.exe
  2⤵
  PID:8096
- C:\Windows\System\vUhjSWx.exe
  C:\Windows\System\vUhjSWx.exe
  2⤵
  PID:8116
- C:\Windows\System\aojNFNK.exe
  C:\Windows\System\aojNFNK.exe
  2⤵
  PID:8140
- C:\Windows\System\frrPjaD.exe
  C:\Windows\System\frrPjaD.exe
  2⤵
  PID:8164
- C:\Windows\System\Ipjzoxx.exe
  C:\Windows\System\Ipjzoxx.exe
  2⤵
  PID:8184
- C:\Windows\System\wiqezDZ.exe
  C:\Windows\System\wiqezDZ.exe
  2⤵
  PID:7020
- C:\Windows\System\vdGNlKY.exe
  C:\Windows\System\vdGNlKY.exe
  2⤵
  PID:7076
- C:\Windows\System\OupzFzS.exe
  C:\Windows\System\OupzFzS.exe
  2⤵
  PID:7104
- C:\Windows\System\rxtqaOc.exe
  C:\Windows\System\rxtqaOc.exe
  2⤵
  PID:7164
- C:\Windows\System\DwzxWoW.exe
  C:\Windows\System\DwzxWoW.exe
  2⤵
  PID:5868
- C:\Windows\System\qzriNbB.exe
  C:\Windows\System\qzriNbB.exe
  2⤵
  PID:3756
- C:\Windows\System\WXfxzNa.exe
  C:\Windows\System\WXfxzNa.exe
  2⤵
  PID:6092
- C:\Windows\System\NHVUmAC.exe
  C:\Windows\System\NHVUmAC.exe
  2⤵
  PID:5524
- C:\Windows\System\iaTpIqJ.exe
  C:\Windows\System\iaTpIqJ.exe
  2⤵
  PID:5304
- C:\Windows\System\NtxhgYc.exe
  C:\Windows\System\NtxhgYc.exe
  2⤵
  PID:536
- C:\Windows\System\Ufdtgrg.exe
  C:\Windows\System\Ufdtgrg.exe
  2⤵
  PID:5816
- C:\Windows\System\wscyTsE.exe
  C:\Windows\System\wscyTsE.exe
  2⤵
  PID:5356
- C:\Windows\System\grziers.exe
  C:\Windows\System\grziers.exe
  2⤵
  PID:4704
- C:\Windows\System\IIQUuWx.exe
  C:\Windows\System\IIQUuWx.exe
  2⤵
  PID:6500
- C:\Windows\System\KfjQMUR.exe
  C:\Windows\System\KfjQMUR.exe
  2⤵
  PID:6664
- C:\Windows\System\vJFdKPa.exe
  C:\Windows\System\vJFdKPa.exe
  2⤵
  PID:5572
- C:\Windows\System\YavhOlh.exe
  C:\Windows\System\YavhOlh.exe
  2⤵
  PID:8204
- C:\Windows\System\wPzUPTy.exe
  C:\Windows\System\wPzUPTy.exe
  2⤵
  PID:8220
- C:\Windows\System\WDauLWg.exe
  C:\Windows\System\WDauLWg.exe
  2⤵
  PID:8244
- C:\Windows\System\WGXXBBm.exe
  C:\Windows\System\WGXXBBm.exe
  2⤵
  PID:8260
- C:\Windows\System\cKXNvdu.exe
  C:\Windows\System\cKXNvdu.exe
  2⤵
  PID:8280
- C:\Windows\System\GRSSDeY.exe
  C:\Windows\System\GRSSDeY.exe
  2⤵
  PID:8304
- C:\Windows\System\uTRIiBC.exe
  C:\Windows\System\uTRIiBC.exe
  2⤵
  PID:8320
- C:\Windows\System\CcDpavp.exe
  C:\Windows\System\CcDpavp.exe
  2⤵
  PID:8344
- C:\Windows\System\SAVQnyI.exe
  C:\Windows\System\SAVQnyI.exe
  2⤵
  PID:8364
- C:\Windows\System\uoCpXgB.exe
  C:\Windows\System\uoCpXgB.exe
  2⤵
  PID:8384
- C:\Windows\System\qYxIMWq.exe
  C:\Windows\System\qYxIMWq.exe
  2⤵
  PID:8408
- C:\Windows\System\eVZSTNW.exe
  C:\Windows\System\eVZSTNW.exe
  2⤵
  PID:8424
- C:\Windows\System\eOeNesV.exe
  C:\Windows\System\eOeNesV.exe
  2⤵
  PID:8448
- C:\Windows\System\sKxKFmq.exe
  C:\Windows\System\sKxKFmq.exe
  2⤵
  PID:8468
- C:\Windows\System\WeWoTMo.exe
  C:\Windows\System\WeWoTMo.exe
  2⤵
  PID:8484
- C:\Windows\System\cfsdElg.exe
  C:\Windows\System\cfsdElg.exe
  2⤵
  PID:8508
- C:\Windows\System\gbKpSKZ.exe
  C:\Windows\System\gbKpSKZ.exe
  2⤵
  PID:8524
- C:\Windows\System\vGisUay.exe
  C:\Windows\System\vGisUay.exe
  2⤵
  PID:8552
- C:\Windows\System\XrpbnRD.exe
  C:\Windows\System\XrpbnRD.exe
  2⤵
  PID:8572
- C:\Windows\System\KhjKqFB.exe
  C:\Windows\System\KhjKqFB.exe
  2⤵
  PID:8592
- C:\Windows\System\wjLtOOT.exe
  C:\Windows\System\wjLtOOT.exe
  2⤵
  PID:8612
- C:\Windows\System\FLhQwFT.exe
  C:\Windows\System\FLhQwFT.exe
  2⤵
  PID:8632
- C:\Windows\System\iXVKbgD.exe
  C:\Windows\System\iXVKbgD.exe
  2⤵
  PID:8656
- C:\Windows\System\AhfSOni.exe
  C:\Windows\System\AhfSOni.exe
  2⤵
  PID:8676
- C:\Windows\System\BNaLxQw.exe
  C:\Windows\System\BNaLxQw.exe
  2⤵
  PID:8700
- C:\Windows\System\IodOmfS.exe
  C:\Windows\System\IodOmfS.exe
  2⤵
  PID:8720
- C:\Windows\System\MUpZDIh.exe
  C:\Windows\System\MUpZDIh.exe
  2⤵
  PID:8736
- C:\Windows\System\YhtFMdV.exe
  C:\Windows\System\YhtFMdV.exe
  2⤵
  PID:8764
- C:\Windows\System\OfWAAVD.exe
  C:\Windows\System\OfWAAVD.exe
  2⤵
  PID:8780
- C:\Windows\System\iAEdBvt.exe
  C:\Windows\System\iAEdBvt.exe
  2⤵
  PID:8804
- C:\Windows\System\hWvVQLl.exe
  C:\Windows\System\hWvVQLl.exe
  2⤵
  PID:8824
- C:\Windows\System\UkygyDy.exe
  C:\Windows\System\UkygyDy.exe
  2⤵
  PID:8852
- C:\Windows\System\tNffufp.exe
  C:\Windows\System\tNffufp.exe
  2⤵
  PID:8868
- C:\Windows\System\GjmPCBZ.exe
  C:\Windows\System\GjmPCBZ.exe
  2⤵
  PID:8896
- C:\Windows\System\fPxkltR.exe
  C:\Windows\System\fPxkltR.exe
  2⤵
  PID:8916
- C:\Windows\System\DjFoPvM.exe
  C:\Windows\System\DjFoPvM.exe
  2⤵
  PID:8936
- C:\Windows\System\wDkzdDx.exe
  C:\Windows\System\wDkzdDx.exe
  2⤵
  PID:8956
- C:\Windows\System\uaUECfD.exe
  C:\Windows\System\uaUECfD.exe
  2⤵
  PID:8980
- C:\Windows\System\TSuwntT.exe
  C:\Windows\System\TSuwntT.exe
  2⤵
  PID:9000
- C:\Windows\System\mRSCDTO.exe
  C:\Windows\System\mRSCDTO.exe
  2⤵
  PID:9020
- C:\Windows\System\jPovOmU.exe
  C:\Windows\System\jPovOmU.exe
  2⤵
  PID:9048
- C:\Windows\System\znrwtiu.exe
  C:\Windows\System\znrwtiu.exe
  2⤵
  PID:9068
- C:\Windows\System\ulAXOFX.exe
  C:\Windows\System\ulAXOFX.exe
  2⤵
  PID:9096
- C:\Windows\System\iCUfoRS.exe
  C:\Windows\System\iCUfoRS.exe
  2⤵
  PID:9116
- C:\Windows\System\pxlNpwV.exe
  C:\Windows\System\pxlNpwV.exe
  2⤵
  PID:9140
- C:\Windows\System\NvwDpLN.exe
  C:\Windows\System\NvwDpLN.exe
  2⤵
  PID:9164
- C:\Windows\System\woGxtMi.exe
  C:\Windows\System\woGxtMi.exe
  2⤵
  PID:9184
- C:\Windows\System\kMVptVH.exe
  C:\Windows\System\kMVptVH.exe
  2⤵
  PID:9208
- C:\Windows\System\ocuXplj.exe
  C:\Windows\System\ocuXplj.exe
  2⤵
  PID:4304
- C:\Windows\System\yBHREII.exe
  C:\Windows\System\yBHREII.exe
  2⤵
  PID:7188
- C:\Windows\System\kNeuLYc.exe
  C:\Windows\System\kNeuLYc.exe
  2⤵
  PID:7292
- C:\Windows\System\emlpXxp.exe
  C:\Windows\System\emlpXxp.exe
  2⤵
  PID:6300
- C:\Windows\System\ivaFaXK.exe
  C:\Windows\System\ivaFaXK.exe
  2⤵
  PID:7404
- C:\Windows\System\xoyKBpv.exe
  C:\Windows\System\xoyKBpv.exe
  2⤵
  PID:7532
- C:\Windows\System\RIwNxRf.exe
  C:\Windows\System\RIwNxRf.exe
  2⤵
  PID:7596
- C:\Windows\System\HDLfpGJ.exe
  C:\Windows\System\HDLfpGJ.exe
  2⤵
  PID:7660
- C:\Windows\System\xBiNUXj.exe
  C:\Windows\System\xBiNUXj.exe
  2⤵
  PID:7716
- C:\Windows\System\pTQRcnK.exe
  C:\Windows\System\pTQRcnK.exe
  2⤵
  PID:7808
- C:\Windows\System\rEXyXEl.exe
  C:\Windows\System\rEXyXEl.exe
  2⤵
  PID:7908
- C:\Windows\System\eYHRjwV.exe
  C:\Windows\System\eYHRjwV.exe
  2⤵
  PID:9684
- C:\Windows\System\KquKrsJ.exe
  C:\Windows\System\KquKrsJ.exe
  2⤵
  PID:9712
- C:\Windows\System\khzYmqi.exe
  C:\Windows\System\khzYmqi.exe
  2⤵
  PID:9728
- C:\Windows\System\ulrceHP.exe
  C:\Windows\System\ulrceHP.exe
  2⤵
  PID:9744
- C:\Windows\System\uhBBGoY.exe
  C:\Windows\System\uhBBGoY.exe
  2⤵
  PID:9764
- C:\Windows\System\CBUgIUJ.exe
  C:\Windows\System\CBUgIUJ.exe
  2⤵
  PID:9780
- C:\Windows\System\cvrpZzE.exe
  C:\Windows\System\cvrpZzE.exe
  2⤵
  PID:9796
- C:\Windows\System\rRYazbt.exe
  C:\Windows\System\rRYazbt.exe
  2⤵
  PID:9816
- C:\Windows\System\oKNFzgf.exe
  C:\Windows\System\oKNFzgf.exe
  2⤵
  PID:9836
- C:\Windows\System\mrClrOE.exe
  C:\Windows\System\mrClrOE.exe
  2⤵
  PID:9860
- C:\Windows\System\ZymUClj.exe
  C:\Windows\System\ZymUClj.exe
  2⤵
  PID:9892
- C:\Windows\System\SIRBcRR.exe
  C:\Windows\System\SIRBcRR.exe
  2⤵
  PID:9912
- C:\Windows\System\dtdLknG.exe
  C:\Windows\System\dtdLknG.exe
  2⤵
  PID:9944
- C:\Windows\System\BBSDRme.exe
  C:\Windows\System\BBSDRme.exe
  2⤵
  PID:9972
- C:\Windows\System\LpWmpLI.exe
  C:\Windows\System\LpWmpLI.exe
  2⤵
  PID:9988
- C:\Windows\System\fDPSvKd.exe
  C:\Windows\System\fDPSvKd.exe
  2⤵
  PID:10012
- C:\Windows\System\gYSRplc.exe
  C:\Windows\System\gYSRplc.exe
  2⤵
  PID:10036
- C:\Windows\System\fsmzRBR.exe
  C:\Windows\System\fsmzRBR.exe
  2⤵
  PID:10052
- C:\Windows\System\niOTmSn.exe
  C:\Windows\System\niOTmSn.exe
  2⤵
  PID:10084
- C:\Windows\System\eYhtALr.exe
  C:\Windows\System\eYhtALr.exe
  2⤵
  PID:10104
- C:\Windows\System\eNYuHxl.exe
  C:\Windows\System\eNYuHxl.exe
  2⤵
  PID:10124
- C:\Windows\System\ipCtDBW.exe
  C:\Windows\System\ipCtDBW.exe
  2⤵
  PID:10148
- C:\Windows\System\GtgQAsI.exe
  C:\Windows\System\GtgQAsI.exe
  2⤵
  PID:10172
- C:\Windows\System\VHGqqsx.exe
  C:\Windows\System\VHGqqsx.exe
  2⤵
  PID:10188
- C:\Windows\System\dBUKdQU.exe
  C:\Windows\System\dBUKdQU.exe
  2⤵
  PID:10212
- C:\Windows\System\NdFDJlS.exe
  C:\Windows\System\NdFDJlS.exe
  2⤵
  PID:10236
- C:\Windows\System\CLJuegh.exe
  C:\Windows\System\CLJuegh.exe
  2⤵
  PID:6932
- C:\Windows\System\KSjjLrJ.exe
  C:\Windows\System\KSjjLrJ.exe
  2⤵
  PID:6456
- C:\Windows\System\KdFtCbu.exe
  C:\Windows\System\KdFtCbu.exe
  2⤵
  PID:8228
- C:\Windows\System\NiHkrgQ.exe
  C:\Windows\System\NiHkrgQ.exe
  2⤵
  PID:7060
- C:\Windows\System\TuKpyME.exe
  C:\Windows\System\TuKpyME.exe
  2⤵
  PID:8420
- C:\Windows\System\NTOxstU.exe
  C:\Windows\System\NTOxstU.exe
  2⤵
  PID:8568
- C:\Windows\System\tRWvXWK.exe
  C:\Windows\System\tRWvXWK.exe
  2⤵
  PID:7496
- C:\Windows\System\InxkGhx.exe
  C:\Windows\System\InxkGhx.exe
  2⤵
  PID:7592
- C:\Windows\System\ByUxRlb.exe
  C:\Windows\System\ByUxRlb.exe
  2⤵
  PID:4888
- C:\Windows\System\wNXVJwD.exe
  C:\Windows\System\wNXVJwD.exe
  2⤵
  PID:7800
- C:\Windows\System\ZjAGgsI.exe
  C:\Windows\System\ZjAGgsI.exe
  2⤵
  PID:9156
- C:\Windows\System\CESJgYd.exe
  C:\Windows\System\CESJgYd.exe
  2⤵
  PID:7744
- C:\Windows\System\eWQcqwN.exe
  C:\Windows\System\eWQcqwN.exe
  2⤵
  PID:7984
- C:\Windows\System\UOTcCYH.exe
  C:\Windows\System\UOTcCYH.exe
  2⤵
  PID:8148
- C:\Windows\System\yRnKvQH.exe
  C:\Windows\System\yRnKvQH.exe
  2⤵
  PID:6212
- C:\Windows\System\WrGkjuX.exe
  C:\Windows\System\WrGkjuX.exe
  2⤵
  PID:4592
- C:\Windows\System\LPOAbfa.exe
  C:\Windows\System\LPOAbfa.exe
  2⤵
  PID:6720
- C:\Windows\System\QRzPfBo.exe
  C:\Windows\System\QRzPfBo.exe
  2⤵
  PID:5268
- C:\Windows\System\RogMZyQ.exe
  C:\Windows\System\RogMZyQ.exe
  2⤵
  PID:6192
- C:\Windows\System\rCmDWtk.exe
  C:\Windows\System\rCmDWtk.exe
  2⤵
  PID:8516
- C:\Windows\System\KtjrPWy.exe
  C:\Windows\System\KtjrPWy.exe
  2⤵
  PID:8416
- C:\Windows\System\trZTAlp.exe
  C:\Windows\System\trZTAlp.exe
  2⤵
  PID:6928
- C:\Windows\System\oBENCuQ.exe
  C:\Windows\System\oBENCuQ.exe
  2⤵
  PID:6980
- C:\Windows\System\FRJigIC.exe
  C:\Windows\System\FRJigIC.exe
  2⤵
  PID:9032
- C:\Windows\System\CMQcLxT.exe
  C:\Windows\System\CMQcLxT.exe
  2⤵
  PID:8128
- C:\Windows\System\nSkQBMI.exe
  C:\Windows\System\nSkQBMI.exe
  2⤵
  PID:6992
- C:\Windows\System\KGkvbNP.exe
  C:\Windows\System\KGkvbNP.exe
  2⤵
  PID:8288
- C:\Windows\System\JzZlpaY.exe
  C:\Windows\System\JzZlpaY.exe
  2⤵
  PID:8532
- C:\Windows\System\RxKRVqw.exe
  C:\Windows\System\RxKRVqw.exe
  2⤵
  PID:8608
- C:\Windows\System\idjIQhX.exe
  C:\Windows\System\idjIQhX.exe
  2⤵
  PID:7380
- C:\Windows\System\qkbpHcG.exe
  C:\Windows\System\qkbpHcG.exe
  2⤵
  PID:8696
- C:\Windows\System\txSUrij.exe
  C:\Windows\System\txSUrij.exe
  2⤵
  PID:7516
- C:\Windows\System\HnIyfgI.exe
  C:\Windows\System\HnIyfgI.exe
  2⤵
  PID:7612
- C:\Windows\System\JGerKHz.exe
  C:\Windows\System\JGerKHz.exe
  2⤵
  PID:8932
- C:\Windows\System\RtSuVJW.exe
  C:\Windows\System\RtSuVJW.exe
  2⤵
  PID:9016
- C:\Windows\System\WMEevWo.exe
  C:\Windows\System\WMEevWo.exe
  2⤵
  PID:7768
- C:\Windows\System\eaMjTZp.exe
  C:\Windows\System\eaMjTZp.exe
  2⤵
  PID:7844
- C:\Windows\System\hjawvaP.exe
  C:\Windows\System\hjawvaP.exe
  2⤵
  PID:7888
- C:\Windows\System\ugPxaei.exe
  C:\Windows\System\ugPxaei.exe
  2⤵
  PID:9516
- C:\Windows\System\AHFvqVc.exe
  C:\Windows\System\AHFvqVc.exe
  2⤵
  PID:7960
- C:\Windows\System\WgDsuCB.exe
  C:\Windows\System\WgDsuCB.exe
  2⤵
  PID:10252
- C:\Windows\System\nsuGodg.exe
  C:\Windows\System\nsuGodg.exe
  2⤵
  PID:10268
- C:\Windows\System\FryqmJp.exe
  C:\Windows\System\FryqmJp.exe
  2⤵
  PID:10296
- C:\Windows\System\JujxZnV.exe
  C:\Windows\System\JujxZnV.exe
  2⤵
  PID:10320
- C:\Windows\System\hfGfCxS.exe
  C:\Windows\System\hfGfCxS.exe
  2⤵
  PID:10344
- C:\Windows\System\rFOipIo.exe
  C:\Windows\System\rFOipIo.exe
  2⤵
  PID:10368
- C:\Windows\System\MisoFxU.exe
  C:\Windows\System\MisoFxU.exe
  2⤵
  PID:10384
- C:\Windows\System\aLmZgpc.exe
  C:\Windows\System\aLmZgpc.exe
  2⤵
  PID:10404
- C:\Windows\System\DjXBVJc.exe
  C:\Windows\System\DjXBVJc.exe
  2⤵
  PID:10432
- C:\Windows\System\renFUAj.exe
  C:\Windows\System\renFUAj.exe
  2⤵
  PID:10452
- C:\Windows\System\jtmUXMc.exe
  C:\Windows\System\jtmUXMc.exe
  2⤵
  PID:10472
- C:\Windows\System\RbdsOYP.exe
  C:\Windows\System\RbdsOYP.exe
  2⤵
  PID:10496
- C:\Windows\System\cXJcfRH.exe
  C:\Windows\System\cXJcfRH.exe
  2⤵
  PID:10532
- C:\Windows\System\LtSLPva.exe
  C:\Windows\System\LtSLPva.exe
  2⤵
  PID:10568
- C:\Windows\System\ILtKLLB.exe
  C:\Windows\System\ILtKLLB.exe
  2⤵
  PID:10600
- C:\Windows\System\TlqUNbb.exe
  C:\Windows\System\TlqUNbb.exe
  2⤵
  PID:10620
- C:\Windows\System\kpGQEHe.exe
  C:\Windows\System\kpGQEHe.exe
  2⤵
  PID:10640
- C:\Windows\System\PiqjwIi.exe
  C:\Windows\System\PiqjwIi.exe
  2⤵
  PID:10660
- C:\Windows\System\aXhOAts.exe
  C:\Windows\System\aXhOAts.exe
  2⤵
  PID:10684
- C:\Windows\System\xtnWzXr.exe
  C:\Windows\System\xtnWzXr.exe
  2⤵
  PID:10708
- C:\Windows\System\yLtGrxS.exe
  C:\Windows\System\yLtGrxS.exe
  2⤵
  PID:10728
- C:\Windows\System\qtPMvYm.exe
  C:\Windows\System\qtPMvYm.exe
  2⤵
  PID:10748
- C:\Windows\System\KRjzOef.exe
  C:\Windows\System\KRjzOef.exe
  2⤵
  PID:10772
- C:\Windows\System\mmOQIVb.exe
  C:\Windows\System\mmOQIVb.exe
  2⤵
  PID:10796
- C:\Windows\System\uaBwWGZ.exe
  C:\Windows\System\uaBwWGZ.exe
  2⤵
  PID:10820
- C:\Windows\System\SGaueBI.exe
  C:\Windows\System\SGaueBI.exe
  2⤵
  PID:10844
- C:\Windows\System\DBkEOgo.exe
  C:\Windows\System\DBkEOgo.exe
  2⤵
  PID:10868
- C:\Windows\System\mDByIKv.exe
  C:\Windows\System\mDByIKv.exe
  2⤵
  PID:10892
- C:\Windows\System\LdVSIPr.exe
  C:\Windows\System\LdVSIPr.exe
  2⤵
  PID:10916
- C:\Windows\System\AqDkTjK.exe
  C:\Windows\System\AqDkTjK.exe
  2⤵
  PID:10932
- C:\Windows\System\HpSLmem.exe
  C:\Windows\System\HpSLmem.exe
  2⤵
  PID:10968
- C:\Windows\System\ZyohiJx.exe
  C:\Windows\System\ZyohiJx.exe
  2⤵
  PID:10988
- C:\Windows\System\TWnxGEs.exe
  C:\Windows\System\TWnxGEs.exe
  2⤵
  PID:11004
- C:\Windows\System\LUsxePA.exe
  C:\Windows\System\LUsxePA.exe
  2⤵
  PID:11028
- C:\Windows\System\NxzEjBA.exe
  C:\Windows\System\NxzEjBA.exe
  2⤵
  PID:11044
- C:\Windows\System\UFMFcch.exe
  C:\Windows\System\UFMFcch.exe
  2⤵
  PID:11080
- C:\Windows\System\LwvLVaB.exe
  C:\Windows\System\LwvLVaB.exe
  2⤵
  PID:11104
- C:\Windows\System\gAJLIQz.exe
  C:\Windows\System\gAJLIQz.exe
  2⤵
  PID:11124
- C:\Windows\System\GPEDOpX.exe
  C:\Windows\System\GPEDOpX.exe
  2⤵
  PID:11152
- C:\Windows\System\EzzSjIC.exe
  C:\Windows\System\EzzSjIC.exe
  2⤵
  PID:11180
- C:\Windows\System\POobRbO.exe
  C:\Windows\System\POobRbO.exe
  2⤵
  PID:11204
- C:\Windows\System\iJebxTE.exe
  C:\Windows\System\iJebxTE.exe
  2⤵
  PID:11224
- C:\Windows\System\bplRptX.exe
  C:\Windows\System\bplRptX.exe
  2⤵
  PID:11240
- C:\Windows\System\LuqdZGn.exe
  C:\Windows\System\LuqdZGn.exe
  2⤵
  PID:11260
- C:\Windows\System\yTBgMZx.exe
  C:\Windows\System\yTBgMZx.exe
  2⤵
  PID:9588
- C:\Windows\System\qMCeeyt.exe
  C:\Windows\System\qMCeeyt.exe
  2⤵
  PID:7048
- C:\Windows\System\WFCBflV.exe
  C:\Windows\System\WFCBflV.exe
  2⤵
  PID:5784
- C:\Windows\System\xTZbEwZ.exe
  C:\Windows\System\xTZbEwZ.exe
  2⤵
  PID:9280
- C:\Windows\System\fkhdxED.exe
  C:\Windows\System\fkhdxED.exe
  2⤵
  PID:3772
- C:\Windows\System\mgAuBrL.exe
  C:\Windows\System\mgAuBrL.exe
  2⤵
  PID:6908
- C:\Windows\System\QDnpqil.exe
  C:\Windows\System\QDnpqil.exe
  2⤵
  PID:8196
- C:\Windows\System\bTZhcpl.exe
  C:\Windows\System\bTZhcpl.exe
  2⤵
  PID:9012
- C:\Windows\System\pCUQeyw.exe
  C:\Windows\System\pCUQeyw.exe
  2⤵
  PID:8928
- C:\Windows\System\mhoiprl.exe
  C:\Windows\System\mhoiprl.exe
  2⤵
  PID:9724
- C:\Windows\System\wbUzylX.exe
  C:\Windows\System\wbUzylX.exe
  2⤵
  PID:9804
- C:\Windows\System\bVZvVOn.exe
  C:\Windows\System\bVZvVOn.exe
  2⤵
  PID:9872
- C:\Windows\System\BxmRZXz.exe
  C:\Windows\System\BxmRZXz.exe
  2⤵
  PID:8480
- C:\Windows\System\CkDTKAk.exe
  C:\Windows\System\CkDTKAk.exe
  2⤵
  PID:11272
- C:\Windows\System\RxwwuoS.exe
  C:\Windows\System\RxwwuoS.exe
  2⤵
  PID:11296
- C:\Windows\System\EYrJWcS.exe
  C:\Windows\System\EYrJWcS.exe
  2⤵
  PID:11316
- C:\Windows\System\EhKbtGX.exe
  C:\Windows\System\EhKbtGX.exe
  2⤵
  PID:11336
- C:\Windows\System\yIxsEEM.exe
  C:\Windows\System\yIxsEEM.exe
  2⤵
  PID:11360
- C:\Windows\System\boqXPIX.exe
  C:\Windows\System\boqXPIX.exe
  2⤵
  PID:11380
- C:\Windows\System\kLwmSXp.exe
  C:\Windows\System\kLwmSXp.exe
  2⤵
  PID:11404
- C:\Windows\System\clywszj.exe
  C:\Windows\System\clywszj.exe
  2⤵
  PID:11420
- C:\Windows\System\hMyuAaS.exe
  C:\Windows\System\hMyuAaS.exe
  2⤵
  PID:11452
- C:\Windows\System\mEnpAvY.exe
  C:\Windows\System\mEnpAvY.exe
  2⤵
  PID:11476
- C:\Windows\System\dmYEZEp.exe
  C:\Windows\System\dmYEZEp.exe
  2⤵
  PID:11496
- C:\Windows\System\atTfLSJ.exe
  C:\Windows\System\atTfLSJ.exe
  2⤵
  PID:11516
- C:\Windows\System\rocxbSB.exe
  C:\Windows\System\rocxbSB.exe
  2⤵
  PID:11532
- C:\Windows\System\AveGiFa.exe
  C:\Windows\System\AveGiFa.exe
  2⤵
  PID:11548
- C:\Windows\System\yutYSYr.exe
  C:\Windows\System\yutYSYr.exe
  2⤵
  PID:11568
- C:\Windows\System\FJjOWtP.exe
  C:\Windows\System\FJjOWtP.exe
  2⤵
  PID:11584
- C:\Windows\System\BATmwCG.exe
  C:\Windows\System\BATmwCG.exe
  2⤵
  PID:11604
- C:\Windows\System\wPQSotB.exe
  C:\Windows\System\wPQSotB.exe
  2⤵
  PID:11628
- C:\Windows\System\epuCWop.exe
  C:\Windows\System\epuCWop.exe
  2⤵
  PID:11648
- C:\Windows\System\fuGEbBL.exe
  C:\Windows\System\fuGEbBL.exe
  2⤵
  PID:11672
- C:\Windows\System\iNtHBIF.exe
  C:\Windows\System\iNtHBIF.exe
  2⤵
  PID:11692
- C:\Windows\System\hDXxTUz.exe
  C:\Windows\System\hDXxTUz.exe
  2⤵
  PID:11712
- C:\Windows\System\WtexOGA.exe
  C:\Windows\System\WtexOGA.exe
  2⤵
  PID:11736
- C:\Windows\System\AiXVzwT.exe
  C:\Windows\System\AiXVzwT.exe
  2⤵
  PID:11756
- C:\Windows\System\JploHcl.exe
  C:\Windows\System\JploHcl.exe
  2⤵
  PID:11780
- C:\Windows\System\GCeJiuq.exe
  C:\Windows\System\GCeJiuq.exe
  2⤵
  PID:11800
- C:\Windows\System\WdDVOEd.exe
  C:\Windows\System\WdDVOEd.exe
  2⤵
  PID:11820
- C:\Windows\System\jrHBydJ.exe
  C:\Windows\System\jrHBydJ.exe
  2⤵
  PID:11844
- C:\Windows\System\aaguFUI.exe
  C:\Windows\System\aaguFUI.exe
  2⤵
  PID:11864
- C:\Windows\System\QOYNzaS.exe
  C:\Windows\System\QOYNzaS.exe
  2⤵
  PID:11884
- C:\Windows\System\VRrZsBd.exe
  C:\Windows\System\VRrZsBd.exe
  2⤵
  PID:11904
- C:\Windows\System\NPeFfWz.exe
  C:\Windows\System\NPeFfWz.exe
  2⤵
  PID:11924
- C:\Windows\System\wHMajdH.exe
  C:\Windows\System\wHMajdH.exe
  2⤵
  PID:11952
- C:\Windows\System\bLPuMtI.exe
  C:\Windows\System\bLPuMtI.exe
  2⤵
  PID:11972
- C:\Windows\System\YKqasIL.exe
  C:\Windows\System\YKqasIL.exe
  2⤵
  PID:11992
- C:\Windows\System\MpHZWpl.exe
  C:\Windows\System\MpHZWpl.exe
  2⤵
  PID:12024
- C:\Windows\System\fKMKieZ.exe
  C:\Windows\System\fKMKieZ.exe
  2⤵
  PID:12048
- C:\Windows\System\CCcMzYb.exe
  C:\Windows\System\CCcMzYb.exe
  2⤵
  PID:12068
- C:\Windows\System\VXMQyVP.exe
  C:\Windows\System\VXMQyVP.exe
  2⤵
  PID:12088
- C:\Windows\System\EdbJInG.exe
  C:\Windows\System\EdbJInG.exe
  2⤵
  PID:12108
- C:\Windows\System\jIYMmJG.exe
  C:\Windows\System\jIYMmJG.exe
  2⤵
  PID:12136
- C:\Windows\System\VVmBXLN.exe
  C:\Windows\System\VVmBXLN.exe
  2⤵
  PID:12160
- C:\Windows\System\SykyoaS.exe
  C:\Windows\System\SykyoaS.exe
  2⤵
  PID:12180
- C:\Windows\System\ScNYsGN.exe
  C:\Windows\System\ScNYsGN.exe
  2⤵
  PID:12204
- C:\Windows\System\TMgKvQx.exe
  C:\Windows\System\TMgKvQx.exe
  2⤵
  PID:12224
- C:\Windows\System\PGvhNAO.exe
  C:\Windows\System\PGvhNAO.exe
  2⤵
  PID:12240
- C:\Windows\System\ihMzvYH.exe
  C:\Windows\System\ihMzvYH.exe
  2⤵
  PID:12260
- C:\Windows\System\tYLGQzw.exe
  C:\Windows\System\tYLGQzw.exe
  2⤵
  PID:12284
- C:\Windows\System\pmztuIZ.exe
  C:\Windows\System\pmztuIZ.exe
  2⤵
  PID:9996
- C:\Windows\System\UsfeWUp.exe
  C:\Windows\System\UsfeWUp.exe
  2⤵
  PID:10080
- C:\Windows\System\ZPAATWj.exe
  C:\Windows\System\ZPAATWj.exe
  2⤵
  PID:8652
- C:\Windows\System\vuhHNrN.exe
  C:\Windows\System\vuhHNrN.exe
  2⤵
  PID:10180
- C:\Windows\System\nMPMaQv.exe
  C:\Windows\System\nMPMaQv.exe
  2⤵
  PID:6948
- C:\Windows\System\RJyybvH.exe
  C:\Windows\System\RJyybvH.exe
  2⤵
  PID:8328
- C:\Windows\System\AEFsyoP.exe
  C:\Windows\System\AEFsyoP.exe
  2⤵
  PID:7576
- C:\Windows\System\jTpBlLZ.exe
  C:\Windows\System\jTpBlLZ.exe
  2⤵
  PID:7780
- C:\Windows\System\XXPpjwq.exe
  C:\Windows\System\XXPpjwq.exe
  2⤵
  PID:8836
- C:\Windows\System\mOqSrzG.exe
  C:\Windows\System\mOqSrzG.exe
  2⤵
  PID:8944
- C:\Windows\System\aXcjvvr.exe
  C:\Windows\System\aXcjvvr.exe
  2⤵
  PID:6336
- C:\Windows\System\fYfEKdE.exe
  C:\Windows\System\fYfEKdE.exe
  2⤵
  PID:8492
- C:\Windows\System\ufpsTuo.exe
  C:\Windows\System\ufpsTuo.exe
  2⤵
  PID:9060
- C:\Windows\System\OCeugZp.exe
  C:\Windows\System\OCeugZp.exe
  2⤵
  PID:8212
- C:\Windows\System\UrZygeN.exe
  C:\Windows\System\UrZygeN.exe
  2⤵
  PID:8048
- C:\Windows\System\mKBwBPg.exe
  C:\Windows\System\mKBwBPg.exe
  2⤵
  PID:9204
- C:\Windows\System\kPtcZwZ.exe
  C:\Windows\System\kPtcZwZ.exe
  2⤵
  PID:7240
- C:\Windows\System\ZFjKoDP.exe
  C:\Windows\System\ZFjKoDP.exe
  2⤵
  PID:7624
- C:\Windows\System\LFxWLhs.exe
  C:\Windows\System\LFxWLhs.exe
  2⤵
  PID:9064
- C:\Windows\System\opXMCJC.exe
  C:\Windows\System\opXMCJC.exe
  2⤵
  PID:6056
- C:\Windows\System\LAsNWTX.exe
  C:\Windows\System\LAsNWTX.exe
  2⤵
  PID:832
- C:\Windows\System\QmvjkTw.exe
  C:\Windows\System\QmvjkTw.exe
  2⤵
  PID:10356
- C:\Windows\System\EOTijOM.exe
  C:\Windows\System\EOTijOM.exe
  2⤵
  PID:10392
- C:\Windows\System\JVKTDJG.exe
  C:\Windows\System\JVKTDJG.exe
  2⤵
  PID:10460
- C:\Windows\System\gcBfbNk.exe
  C:\Windows\System\gcBfbNk.exe
  2⤵
  PID:10504
- C:\Windows\System\zwoMmeR.exe
  C:\Windows\System\zwoMmeR.exe
  2⤵
  PID:9104
- C:\Windows\System\vgHscMm.exe
  C:\Windows\System\vgHscMm.exe
  2⤵
  PID:10632
- C:\Windows\System\xSilbVX.exe
  C:\Windows\System\xSilbVX.exe
  2⤵
  PID:4492
- C:\Windows\System\ViXnjhc.exe
  C:\Windows\System\ViXnjhc.exe
  2⤵
  PID:1716
- C:\Windows\System\eBqEqrj.exe
  C:\Windows\System\eBqEqrj.exe
  2⤵
  PID:10884
- C:\Windows\System\EDhiCzg.exe
  C:\Windows\System\EDhiCzg.exe
  2⤵
  PID:10984
- C:\Windows\System\lfrbMeF.exe
  C:\Windows\System\lfrbMeF.exe
  2⤵
  PID:8904
- C:\Windows\System\JvCdHCx.exe
  C:\Windows\System\JvCdHCx.exe
  2⤵
  PID:8796
- C:\Windows\System\NIObdvg.exe
  C:\Windows\System\NIObdvg.exe
  2⤵
  PID:8688
- C:\Windows\System\scBuqwX.exe
  C:\Windows\System\scBuqwX.exe
  2⤵
  PID:12292
- C:\Windows\System\vlhSvkm.exe
  C:\Windows\System\vlhSvkm.exe
  2⤵
  PID:12308
- C:\Windows\System\sgQoXqi.exe
  C:\Windows\System\sgQoXqi.exe
  2⤵
  PID:12324
- C:\Windows\System\HPCdbne.exe
  C:\Windows\System\HPCdbne.exe
  2⤵
  PID:12340
- C:\Windows\System\NsqtsNK.exe
  C:\Windows\System\NsqtsNK.exe
  2⤵
  PID:12356
- C:\Windows\System\kCYpzOS.exe
  C:\Windows\System\kCYpzOS.exe
  2⤵
  PID:12372
- C:\Windows\System\kQKlRHM.exe
  C:\Windows\System\kQKlRHM.exe
  2⤵
  PID:12388
- C:\Windows\System\UdbsJUR.exe
  C:\Windows\System\UdbsJUR.exe
  2⤵
  PID:12404
- C:\Windows\System\rxAWgfS.exe
  C:\Windows\System\rxAWgfS.exe
  2⤵
  PID:12428
- C:\Windows\System\RrwyvDH.exe
  C:\Windows\System\RrwyvDH.exe
  2⤵
  PID:12448
- C:\Windows\System\yBdAEFB.exe
  C:\Windows\System\yBdAEFB.exe
  2⤵
  PID:12468
- C:\Windows\System\XIQOPZi.exe
  C:\Windows\System\XIQOPZi.exe
  2⤵
  PID:12492
- C:\Windows\System\EjlCOWH.exe
  C:\Windows\System\EjlCOWH.exe
  2⤵
  PID:12508
- C:\Windows\System\bDiaJKb.exe
  C:\Windows\System\bDiaJKb.exe
  2⤵
  PID:12532
- C:\Windows\System\jwfZQAR.exe
  C:\Windows\System\jwfZQAR.exe
  2⤵
  PID:12556
- C:\Windows\System\ePysPDP.exe
  C:\Windows\System\ePysPDP.exe
  2⤵
  PID:12580
- C:\Windows\System\oFQXHgP.exe
  C:\Windows\System\oFQXHgP.exe
  2⤵
  PID:12604
- C:\Windows\System\GBSsWSA.exe
  C:\Windows\System\GBSsWSA.exe
  2⤵
  PID:12624
- C:\Windows\System\VitEzpf.exe
  C:\Windows\System\VitEzpf.exe
  2⤵
  PID:12648
- C:\Windows\System\CvkOLJF.exe
  C:\Windows\System\CvkOLJF.exe
  2⤵
  PID:12672
- C:\Windows\System\gXnEjKT.exe
  C:\Windows\System\gXnEjKT.exe
  2⤵
  PID:12696
- C:\Windows\System\hyvsADT.exe
  C:\Windows\System\hyvsADT.exe
  2⤵
  PID:12732
- C:\Windows\System\xhGEdJA.exe
  C:\Windows\System\xhGEdJA.exe
  2⤵
  PID:12756
- C:\Windows\System\jFRSBCl.exe
  C:\Windows\System\jFRSBCl.exe
  2⤵
  PID:12784
- C:\Windows\System\SYfhzfe.exe
  C:\Windows\System\SYfhzfe.exe
  2⤵
  PID:12804
- C:\Windows\System\BYpyBoa.exe
  C:\Windows\System\BYpyBoa.exe
  2⤵
  PID:12832
- C:\Windows\System\ZXCovxV.exe
  C:\Windows\System\ZXCovxV.exe
  2⤵
  PID:12860
- C:\Windows\System\NaAYeel.exe
  C:\Windows\System\NaAYeel.exe
  2⤵
  PID:12880
- C:\Windows\System\iVyLRQv.exe
  C:\Windows\System\iVyLRQv.exe
  2⤵
  PID:12896
- C:\Windows\System\PVRhVhZ.exe
  C:\Windows\System\PVRhVhZ.exe
  2⤵
  PID:12912
- C:\Windows\System\xQOZDwu.exe
  C:\Windows\System\xQOZDwu.exe
  2⤵
  PID:12928
- C:\Windows\System\MbtbMMN.exe
  C:\Windows\System\MbtbMMN.exe
  2⤵
  PID:12948
- C:\Windows\System\woFBTPv.exe
  C:\Windows\System\woFBTPv.exe
  2⤵
  PID:12868
- C:\Windows\System\AnswEhy.exe
  C:\Windows\System\AnswEhy.exe
  2⤵
  PID:4920
- C:\Windows\System\rqzWyEN.exe
  C:\Windows\System\rqzWyEN.exe
  2⤵
  PID:12920
- C:\Windows\System\AWhTUeg.exe
  C:\Windows\System\AWhTUeg.exe
  2⤵
  PID:12988
- C:\Windows\System\NuayLEF.exe
  C:\Windows\System\NuayLEF.exe
  2⤵
  PID:3532
- C:\Windows\System\LKnGBLR.exe
  C:\Windows\System\LKnGBLR.exe
  2⤵
  PID:9928
- C:\Windows\System\DCbDQLZ.exe
  C:\Windows\System\DCbDQLZ.exe
  2⤵
  PID:13084
- C:\Windows\System\imwkavd.exe
  C:\Windows\System\imwkavd.exe
  2⤵
  PID:12688
- C:\Windows\System\GOrHOTx.exe
  C:\Windows\System\GOrHOTx.exe
  2⤵
  PID:12872
- C:\Windows\System\zvkAqJc.exe
  C:\Windows\System\zvkAqJc.exe
  2⤵
  PID:13056
- C:\Windows\System\Kidnvji.exe
  C:\Windows\System\Kidnvji.exe
  2⤵
  PID:13068
- C:\Windows\System\SANAJQS.exe
  C:\Windows\System\SANAJQS.exe
  2⤵
  PID:13092
- C:\Windows\System\tMJRKCR.exe
  C:\Windows\System\tMJRKCR.exe
  2⤵
  PID:9584
- C:\Windows\System\JbhlGoK.exe
  C:\Windows\System\JbhlGoK.exe
  2⤵
  PID:10008
- C:\Windows\System\xIuPqkb.exe
  C:\Windows\System\xIuPqkb.exe
  2⤵
  PID:2532
- C:\Windows\System\LEAZNFs.exe
  C:\Windows\System\LEAZNFs.exe
  2⤵
  PID:7012
- C:\Windows\System\VzGOiSv.exe
  C:\Windows\System\VzGOiSv.exe
  2⤵
  PID:13048
- C:\Windows\System\flqIayE.exe
  C:\Windows\System\flqIayE.exe
  2⤵
  PID:5880
- C:\Windows\System\LMKVmiv.exe
  C:\Windows\System\LMKVmiv.exe
  2⤵
  PID:12940
- C:\Windows\System\PDAAbhE.exe
  C:\Windows\System\PDAAbhE.exe
  2⤵
  PID:3768
- C:\Windows\System\YKzvVsa.exe
  C:\Windows\System\YKzvVsa.exe
  2⤵
  PID:13156
- C:\Windows\System\VyPsHXy.exe
  C:\Windows\System\VyPsHXy.exe
  2⤵
  PID:9904
- C:\Windows\System\MkyqZEW.exe
  C:\Windows\System\MkyqZEW.exe
  2⤵
  PID:8444
- C:\Windows\System\WFNWZkh.exe
  C:\Windows\System\WFNWZkh.exe
  2⤵
  PID:10816
- C:\Windows\System\JedEmHV.exe
  C:\Windows\System\JedEmHV.exe
  2⤵
  PID:12616
- C:\Windows\System\KiWqPxN.exe
  C:\Windows\System\KiWqPxN.exe
  2⤵
  PID:12740
- C:\Windows\System\uxPcxdw.exe
  C:\Windows\System\uxPcxdw.exe
  2⤵
  PID:11268
- C:\Windows\System\WDnWGXN.exe
  C:\Windows\System\WDnWGXN.exe
  2⤵
  PID:7276
- C:\Windows\System\lEyjvHb.exe
  C:\Windows\System\lEyjvHb.exe
  2⤵
  PID:7912
- C:\Windows\System\JVJKLIE.exe
  C:\Windows\System\JVJKLIE.exe
  2⤵
  PID:10276
- C:\Windows\System\yQiuikt.exe
  C:\Windows\System\yQiuikt.exe
  2⤵
  PID:9236
- C:\Windows\System\gaFMMSM.exe
  C:\Windows\System\gaFMMSM.exe
  2⤵
  PID:7156
- C:\Windows\System\pHWNAsV.exe
  C:\Windows\System\pHWNAsV.exe
  2⤵
  PID:3792
- C:\Windows\System\pbVMHQH.exe
  C:\Windows\System\pbVMHQH.exe
  2⤵
  PID:532
- C:\Windows\System\pPLiyJx.exe
  C:\Windows\System\pPLiyJx.exe
  2⤵
  PID:12272
- C:\Windows\System\xDDYlyK.exe
  C:\Windows\System\xDDYlyK.exe
  2⤵
  PID:11940
- C:\Windows\System\lYTdCbs.exe
  C:\Windows\System\lYTdCbs.exe
  2⤵
  PID:8992
- C:\Windows\System\XgQQKKw.exe
  C:\Windows\System\XgQQKKw.exe
  2⤵
  PID:10060
- C:\Windows\System\birvqWd.exe
  C:\Windows\System\birvqWd.exe
  2⤵
  PID:12396
- C:\Windows\System\bOiHvDQ.exe
  C:\Windows\System\bOiHvDQ.exe
  2⤵
  PID:12780
- C:\Windows\System\jhvIUEs.exe
  C:\Windows\System\jhvIUEs.exe
  2⤵
  PID:12304
- C:\Windows\System\ngKYQmN.exe
  C:\Windows\System\ngKYQmN.exe
  2⤵
  PID:9672
- C:\Windows\System\MOADjKM.exe
  C:\Windows\System\MOADjKM.exe
  2⤵
  PID:8604
- C:\Windows\System\xoCoRrJ.exe
  C:\Windows\System\xoCoRrJ.exe
  2⤵
  PID:13044
- C:\Windows\System\vwhntzV.exe
  C:\Windows\System\vwhntzV.exe
  2⤵
  PID:13008
- C:\Windows\System\WxqeANp.exe
  C:\Windows\System\WxqeANp.exe
  2⤵
  PID:7100
- C:\Windows\System\OGKOBwa.exe
  C:\Windows\System\OGKOBwa.exe
  2⤵
  PID:10144
- C:\Windows\System\ihevDyJ.exe
  C:\Windows\System\ihevDyJ.exe
  2⤵
  PID:10564
- C:\Windows\System\zMbCMqX.exe
  C:\Windows\System\zMbCMqX.exe
  2⤵
  PID:12892
- C:\Windows\System\GVbQdhP.exe
  C:\Windows\System\GVbQdhP.exe
  2⤵
  PID:12460
- C:\Windows\System\ttsvWWh.exe
  C:\Windows\System\ttsvWWh.exe
  2⤵
  PID:10184
- C:\Windows\System\CLXKOBe.exe
  C:\Windows\System\CLXKOBe.exe
  2⤵
  PID:1500
- C:\Windows\System\lckiLrZ.exe
  C:\Windows\System\lckiLrZ.exe
  2⤵
  PID:10328
- C:\Windows\System\ugCQzsI.exe
  C:\Windows\System\ugCQzsI.exe
  2⤵
  PID:10132
- C:\Windows\System\xcFGaGI.exe
  C:\Windows\System\xcFGaGI.exe
  2⤵
  PID:11432
- C:\Windows\System\xNMQzuv.exe
  C:\Windows\System\xNMQzuv.exe
  2⤵
  PID:10576
- C:\Windows\System\embEvba.exe
  C:\Windows\System\embEvba.exe
  2⤵
  PID:12904
- C:\Windows\System\ZIHvHNH.exe
  C:\Windows\System\ZIHvHNH.exe
  2⤵
  PID:9852
- C:\Windows\System\JknrVzq.exe
  C:\Windows\System\JknrVzq.exe
  2⤵
  PID:11020
- C:\Windows\System\pKleOrE.exe
  C:\Windows\System\pKleOrE.exe
  2⤵
  PID:12488
- C:\Windows\System\ZFEyLSP.exe
  C:\Windows\System\ZFEyLSP.exe
  2⤵
  PID:7900
- C:\Windows\System\HYJWYRi.exe
  C:\Windows\System\HYJWYRi.exe
  2⤵
  PID:12572
- C:\Windows\System\UysJnEc.exe
  C:\Windows\System\UysJnEc.exe
  2⤵
  PID:13316
- C:\Windows\System\hEBworr.exe
  C:\Windows\System\hEBworr.exe
  2⤵
  PID:13360
- C:\Windows\System\OudYvYB.exe
  C:\Windows\System\OudYvYB.exe
  2⤵
  PID:13468
- C:\Windows\System\DQypGNj.exe
  C:\Windows\System\DQypGNj.exe
  2⤵
  PID:13508
- C:\Windows\System\tajYLpQ.exe
  C:\Windows\System\tajYLpQ.exe
  2⤵
  PID:13528
- C:\Windows\System\AmMAhvj.exe
  C:\Windows\System\AmMAhvj.exe
  2⤵
  PID:13548
- C:\Windows\System\yihMApN.exe
  C:\Windows\System\yihMApN.exe
  2⤵
  PID:13568
- C:\Windows\System\NWSoTAM.exe
  C:\Windows\System\NWSoTAM.exe
  2⤵
  PID:13588
- C:\Windows\System\rzcsbRZ.exe
  C:\Windows\System\rzcsbRZ.exe
  2⤵
  PID:13608
- C:\Windows\System\lYQoWeA.exe
  C:\Windows\System\lYQoWeA.exe
  2⤵
  PID:14084
- C:\Windows\System\mTqEggA.exe
  C:\Windows\System\mTqEggA.exe
  2⤵
  PID:14180
- C:\Windows\System\hqOIXLL.exe
  C:\Windows\System\hqOIXLL.exe
  2⤵
  PID:14204
- C:\Windows\System\DAiqulz.exe
  C:\Windows\System\DAiqulz.exe
  2⤵
  PID:14224
- C:\Windows\System\uqibOem.exe
  C:\Windows\System\uqibOem.exe
  2⤵
  PID:14240
- C:\Windows\System\ONTjzTd.exe
  C:\Windows\System\ONTjzTd.exe
  2⤵
  PID:14256
- C:\Windows\System\KnGHnRy.exe
  C:\Windows\System\KnGHnRy.exe
  2⤵
  PID:10792
- C:\Windows\System\jcNPLzb.exe
  C:\Windows\System\jcNPLzb.exe
  2⤵
  PID:9776
- C:\Windows\System\NaoZsXd.exe
  C:\Windows\System\NaoZsXd.exe
  2⤵
  PID:11188
- C:\Windows\System\deGAuuA.exe
  C:\Windows\System\deGAuuA.exe
  2⤵
  PID:1988
- C:\Windows\System\qhOxTCN.exe
  C:\Windows\System\qhOxTCN.exe
  2⤵
  PID:10908
- C:\Windows\System\edvbUNI.exe
  C:\Windows\System\edvbUNI.exe
  2⤵
  PID:11892
- C:\Windows\System\AXRsogH.exe
  C:\Windows\System\AXRsogH.exe
  2⤵
  PID:13652
- C:\Windows\System\tvgKpuq.exe
  C:\Windows\System\tvgKpuq.exe
  2⤵
  PID:13668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ts4jlata.eqw.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AisVtCX.exe

Filesize
1.7MB

MD5
a8558918bd168668dff3396554326add

SHA1
6147d63139ac9beec2e7a8ddf417246805010a05

SHA256
90c2a5b329495087f42042012eea8c4d9902cae2fab09fbcdb54aeb0029d7e13

SHA512
5511bd23cc101c2407a7c562d37ae1ff49ee3c2cb690f44f784040a1e33fd4d5a299dc4871cd5c29ed9e81e6645039bdcc0293624830a25de9088d63cca1158d

Download Submit
C:\Windows\System\BDqCpkk.exe

Filesize
1.7MB

MD5
3b26bafbe5a1d2df55147ae79f42f3f5

SHA1
8169bd8f47abaf2acc6a68f999c1d2ec9336c157

SHA256
3107abc6e711d2dd725af4713d5c43df449b764ee4874190b5ac772a326d44d3

SHA512
5d53b56a05d0ea74ac8c6bee5e6fb65b96df0403b42333db87ea49cf0c060bf398265fadede6d1aa347ed1dc0df187fbe123835be13fbf7bcfffba88861f3b0d

Download Submit
C:\Windows\System\BxNvKOD.exe

Filesize
1.7MB

MD5
efe322e7b1da7bf61d4ed4d43cbd87a3

SHA1
c2ac864772f94293a6d5e3fc1f96c0f3f4d23618

SHA256
e7de5d92ef6dcb543429f08b37b0ecbcde2da6114733ff1f2b8f778cf9f76609

SHA512
0847d38d16260aaa3d5959ec2252cfba38df341c1b9e462ba732189c006b7c3867d8753da7a3c39f0385a8d2eb5890eb9988463ab9e36dab9448eefe495a7206

Download Submit
C:\Windows\System\CpXSYwg.exe

Filesize
1.7MB

MD5
4b1da5353aaf705a313f8bc73d9c3723

SHA1
79d3be04bb306cb6f0ccca2c8da38ec6306e6e98

SHA256
64dc8a35804a28d6475d5acbe8e5b075f7a7dbf6ef70218849725ee26cfc12f9

SHA512
a088dc0b61b8df5d723e96efa45281cebb82c7754c0b23172e9ddc29d24f9f293f7aaf82c51d5dec45f980983aae5ccf705211f686a729323e3494e169e8a607

Download Submit
C:\Windows\System\EZTnVPd.exe

Filesize
1.7MB

MD5
d7e08670596a5d91c8de536c9def43da

SHA1
fe4d5d476617a2a743c1f88f995958d2e83a0bd3

SHA256
0ca10a77f557635fed64c78c16340e9986fa69f4b7a7144fb80b7bf3a5d23c3f

SHA512
ac02bfcee14967051c065db6930bbf7ba63a5e24647c66883bd46f1ebe68ac3b7f58ad0e025d8d7f4d0d4e24dccee15a62ce87573ba8e067e48473c6461128bf

Download Submit
C:\Windows\System\JSWsaUF.exe

Filesize
1.7MB

MD5
5df214b52dddc584a8e6d19cf0e22ef2

SHA1
2f6e681769c336721f5fcd7e829365dd113b380a

SHA256
928a0d7c9ebd329bc20b5909aab244ad6f1b705c28d2bc340cc19fad8c6853cd

SHA512
dcdca31c11c88cbba6aac2883d8d0ea499f2731e4848f2df1b321727522e4bb4cfde0f2c8461e51572d6d87cd9c95fa81ebcbe7dd02de144b90e0ddd78c2c688

Download Submit
C:\Windows\System\JdlPZew.exe

Filesize
1.7MB

MD5
85865116060ba50cfa50c1f0cd935dd6

SHA1
a16bb09a9bdf816a5689a9fede8f4653050fb1df

SHA256
bca46f3524e086b8cf5784b5f5d4f04aa86225b00b0cac367b44cb48639e8e3d

SHA512
e2d0867dcdeb4865bbd36624641ffc8b84ad29f7fd0dcaef2e4794eb79cc5ed60cd79e1d53209e43ba6ae67aa8520e060e0172c4f98967ef7867bf13fbd36714

Download Submit
C:\Windows\System\JkbfwFp.exe

Filesize
1.7MB

MD5
81322afade6ea8e5090e18da1895bfe9

SHA1
a07230d151e024619db7d615f8cddb9e038eeb53

SHA256
37faf07ed8b6ebba655a8e53765fe9ef2f8cac8327bac7bd670c3ffbc3ecbfa3

SHA512
641b87a28877d063b38bd478fd9466f560ed2f27189c9bf04c8c488605288c201126969857d6a77381a2e7f0c23cfdbfa4055ae5dcc5e157db0380b959ea1c2d

Download Submit
C:\Windows\System\KiVpOGr.exe

Filesize
1.7MB

MD5
2d063410df23d248319e4f326306a0f6

SHA1
83bef15da95feba99954b7d031c8d7c5d2da03bf

SHA256
c02e3d69cadc6139bc7573b5996cf31523ce1681b50a455a3666d40f6675f73d

SHA512
15c953871c47c89b4b01d5da88d0d06bae8221bc755f736e832b4d260413309d0dbd2a74d8c42e5edeed698377da3841cf3e66a992e6d91eef4699e4117adc32

Download Submit
C:\Windows\System\MNQzlmI.exe

Filesize
1.7MB

MD5
ea83d893abc2639e0f93a9b00c825efe

SHA1
1d2e13139e49acae063fb1dbcccd1d984d33bbc0

SHA256
b926aa6b6e748ce27aa41501f5a6b294cbb3aa873aec40badad24faacc846891

SHA512
9b8491ee3960d81060aa56116f4eaf39f827962c4ab03ae210a5b050f0f5877686d77a901995a6d964dc4ee3846403dfbcbdecc20b9a3666d4918f0c77c5b4c1

Download Submit
C:\Windows\System\NOZLxUb.exe

Filesize
1.7MB

MD5
c133f31c8a6ed152d80a67fef9a68568

SHA1
fc82877bc0f623c915f2515b43d44712135f0d58

SHA256
56639c9be057b57e2136d9506156a3798194186567be57a4e1fd2a6f6d34303e

SHA512
487293f6f49009212771cb8c07d704724ab1a87d3f2f7c433a6d4d8d62e46c49fab05b7bdb9aafe8684f3651fb0b2004eca8cd121bb2154fa4664c0c40968319

Download Submit
C:\Windows\System\NOkBWrX.exe

Filesize
1.7MB

MD5
df4c65a221757baeb8e5a05e2a302302

SHA1
ac93900061c36edd4336780abf9306178f44d648

SHA256
34f6f8b167c6fc385c328bf9eaf55fe274b57c0923cd8c8e2388df2eeb0a5428

SHA512
0e89fa2f90c84f39aac681630d430f51e4739c6828a8f09ba36eae4f84fee78dbe85c2ccfda8d149b7a8eada63aa5c59e552fb49b9ac277c138f9c259c2908d7

Download Submit
C:\Windows\System\NRzleLh.exe

Filesize
1.7MB

MD5
dd3aec4ff4f61e1936a4a5fb678f9889

SHA1
03817b8dc2cef96bf6414fb0a8f23acbbf88cdd6

SHA256
787bc2e8de6d14a1b213fd2af84487e6690bb24d7501eb03e859188f42a9c374

SHA512
9b7a65eaebcc26b28008dc171b3906148031cee9a50149bf0fc00bc99794324de44f5e2f3c7dc6e7d44f07e1dafa6e6a34a350b68d1e5943a8bd78882e2cf0d1

Download Submit
C:\Windows\System\NjCTmPe.exe

Filesize
1.7MB

MD5
588791c15063b8b595a3145057d7443c

SHA1
de19c0f64616e2ae03253196133e9837901b15fd

SHA256
4fd0db4251ad757f76595e4b214241baeca0e5bc162928b2fe27e53edf74476a

SHA512
485a50218c9702d8ed7905eca5a3d3af8f24a5ddf97ee775d5a88a6d40fa3d9a07f1b292357c5fede759283dcc8291e0a93916991e7da6c95fa428d68366c1f6

Download Submit
C:\Windows\System\OLBjNWu.exe

Filesize
1.7MB

MD5
802a26cd611933dc9962471db0f169c2

SHA1
729005a0c043829c7b1ea99bab551211c979aca7

SHA256
6cfdd2c453f174eb2909c460443855c75c18b1ab4ee9b413cb495632fbddcf86

SHA512
4f386414a363a2c9fb06e40049d1a8a7ab4416c79a3a6a19066355612e9c0c40db3753b7f833825d2faab7e5e6d355f9440c7615b3992fec5f8de6c98db0140b

Download Submit
C:\Windows\System\QhMIVAv.exe

Filesize
1.7MB

MD5
da0f4a9a3b175c0818a856172f2208ff

SHA1
f1ebb8f5fd9d095254b08f2a209d11afee9ec541

SHA256
cde5f8849c3ba2b89e83928ad4f475f7294fb7dbe029c51fe0a403bb97d5b1b0

SHA512
721518f76d82efbd35022e78d7b77d2351c9c6f575e4a3d33d90f03e472deba5c2edbbf51368a40ee8d127ae0410d94a7f6fa7bfb72b2b2300abc128c060ede3

Download Submit
C:\Windows\System\RxRJvBP.exe

Filesize
1.7MB

MD5
d514615394ee3c7416dd91c47019a1ea

SHA1
291240623df7e82e232a00586705bca202622771

SHA256
3b4ab950766ca464dc9fff812d1ca95b4eb87f3e4b5cd9dda393e9c4f2756a60

SHA512
31bc5620917683dff000722cf89d796ee7f39c5365c5ab94b0fc3814cec43897deceea5b76932b508b81fed117cc29934ee41fbbb6594abbcbc45de2e933129b

Download Submit
C:\Windows\System\WmSLSsE.exe

Filesize
1.7MB

MD5
e5bc86073c3caaa09bee3ba7542d9935

SHA1
5c6d0877448042ffa39b471ec41fc094b239c0d7

SHA256
1ea0291c4d41d1a96b8bfcf1298ecdbd396cfdce913ea545577ea032c6f77b3d

SHA512
1cff97a33ffa9ea77175060a0abe7cf01a3ad834675f134788a174d8867607554e273f8910338bad6bd490d6103573b265ac712099b2cc18c7f9ac5ae485786b

Download Submit
C:\Windows\System\WuaeYOc.exe

Filesize
1.7MB

MD5
a0cbf0b1526d638bc91e57536c42579f

SHA1
d2a927bb15d9835e93d9bd0b48a04df2573a5571

SHA256
482c28a6744eb9cb061ac47236bbe6348ab6123c7dc3aed8e9cea61432c771dd

SHA512
982442aa28298ba20ecdb13b6d418fca6fc9a1a2e86d695af5f327f8f20fb05e7f7fa075904914f60c0e76b8f7b1bbcd25475fc31e78ec57a27695047e1fc482

Download Submit
C:\Windows\System\WwCvJxd.exe

Filesize
1.7MB

MD5
8ad512d2de25636b953eb2dcb1b7cfb0

SHA1
9b000b5ae7984ffdd3f83bf2a3722895d37490ca

SHA256
7212a17e42556237491c3c3b22eef65518dc062f55958b5c6c667cf1b5dc748a

SHA512
b751eff8b787d4abb2af2b2d22d6543c1e5a33aa51f11e913908939a615529e34559f31a0ad0d192ea2664f878c59c90ba3e75ff3693d2206e6ec1192b59be0a

Download Submit
C:\Windows\System\XgbcOcd.exe

Filesize
1.7MB

MD5
540662c4c53c6e19b68542eb6be0e93a

SHA1
2e6f0cf701490b62455fdb09b744ebaa134fdef0

SHA256
9b429d821861c9d3aa34ca7cc782d1e4ac5f6d74de483040bb416183637dd6dd

SHA512
a4c1816eabcfe743cbefdc9f26cabaf154e18d945ee7430a2b5f18e16cb5da314227f303c9773d4bdcfc4db4420e68d306dac65203e1ce447d90f24659039fda

Download Submit
C:\Windows\System\YiCxPLn.exe

Filesize
1.7MB

MD5
e1e9fa76c642fdf1c36883f20f3c1946

SHA1
39fb96c2b4793fd479a62b7ea565ab84e8776fa1

SHA256
fc3c73377f6161c983bee06936152d5e6f25367002cd3f76f3f766b1fa7bab98

SHA512
17c0ef027d65d2f0ef369ebb2982e3303ef332e2770d067f4d27f79ebb30e7375747c6064c29543fd45a22d9a21ca3bb73fe233fb9931b99fe0835887b9dd484

Download Submit
C:\Windows\System\ZZAKaHF.exe

Filesize
1.7MB

MD5
d00e6b86e4c400efe2136f1b363cd5e1

SHA1
69cc6c327412d09b425ca17d94fe2d8fec4da1be

SHA256
c23c8cc83574f9ffc81ebc27433bdc3395e384a3e543291a6b9f33b06672a557

SHA512
0659aaedb34fcf9a955d6b88dc6da88a9b3341bb9fdf3a8abcc4b6fad571a85bb80892325e0c08a01048d45f8e54c88037b38d4ba59148acdfb79bbebe8319ec

Download Submit
C:\Windows\System\ZzWIIhm.exe

Filesize
1.7MB

MD5
e696882db3515aac58dc5b2bb2f0842d

SHA1
001c1a255621a05258cfb37115040916a80cfdc3

SHA256
ba08c7f85a057e9f2280174eb2d85971503031f7a4e0c103a3362438149f94f6

SHA512
3c7459b3f3fb41e814829f0f81ec103250c2dab576b62b1953c1c60b3e4819338cdd5d76bc46f6f5a7fa19cf07112c7a905a83e21c11db15b9339b12361045c4

Download Submit
C:\Windows\System\dPrSFkK.exe

Filesize
1.7MB

MD5
72b055c58c738395c8961de21191fdc5

SHA1
6252c071115dc188b2297f63ae9910ae3cc11e50

SHA256
dbf27f53cd06e160b79da2075f145d3df590bbb01cb856f6fdbd3c04e1907eb0

SHA512
9d8626d2d561b358868ba73c94209f26974a5abe362c33b9a7d92462774b54a71b201010c5a37c605ce4fc96b72f755db0809429bcb1e1a0e7d9c4eac4b9e676

Download Submit
C:\Windows\System\daPAenD.exe

Filesize
1.7MB

MD5
73561052b59c711e57f13f187e6f6677

SHA1
5bcf54e513ba6f4cbe1fb1f438c1c5b14bfd735c

SHA256
4aa5f01e70f8d2c931fe42300913e5c139c686575000cf026c7b83ed43aa7c5d

SHA512
5bab544df8db25951ecb06dfc71f5bcca7228097d3f8b661c71625b4078762809f10142a50ca8e906880ef806a72d50d13172fb639c098d3bbed3692f607a97b

Download Submit
C:\Windows\System\eWMKgtb.exe

Filesize
1.7MB

MD5
475f0585a2a3c67441855c3b6db4734f

SHA1
7107c55c67ea0f379851a954310d5a2063bd3cbc

SHA256
0defe496fb4d57c0dcb39706aa0414a0ef1e3527b52f5b605582360e5f155ec2

SHA512
cf2366be81d69a505df592a1109804b0835d40c5e01c3701a9a4614c58de3a07041295e0d6ac5cab74fc6b21e324cd0c61da971571aa6d00e1b670b1f26de2a2

Download Submit
C:\Windows\System\ehsvWLW.exe

Filesize
1.7MB

MD5
4073c812e8e88abc6fca8e371b9f70b1

SHA1
83e13490eddee4610f5f76627c6c2ba1d52facbb

SHA256
08f452910573c534e2a7eb3fcf48ab0170c820e2f3f21e83ae0a91814e1d2534

SHA512
f0f7729285ef82c91098b091b2e170e76973fe7fcbf8f9fd016936fa6443ab104d51e42627c3da63f6186f6a66c256de8db446c37aa1f7b761153ae2afdb1dbe

Download Submit
C:\Windows\System\fiqJyvC.exe

Filesize
1.7MB

MD5
73788ab2746db703dcf8ec777f3d7f77

SHA1
87b08ad6bbbc426750d0681e991d4be6d36b48bd

SHA256
4f0fd6d67b692f05557297a2db458a21a0c767c4fc13a654833cc8855cd3df0d

SHA512
3f5259177eb4a7ebc5ea591b9e93b8bcc62e8151e4541dcc0ea26bfce4ebc056b60a8ca7da4aca52c259317092d6e6386440f9a8f08d9b37b3aec769c2e4c820

Download Submit
C:\Windows\System\ftLUrQJ.exe

Filesize
1.7MB

MD5
ff673f3b8b3762d781de5c44f22a2389

SHA1
45dc5fb7ded6fb5d51127e3de358e0bb66b4a912

SHA256
6a5415c998235688b828a04be01bb1cf2df529d9aa725640c97ff959fe8a5a0c

SHA512
3764312b253d2eb3c1cca51f5cecd4739fa8186c57bbae7a8fb414e788215282755596375ff0fdf0a45737efd7d12b214b5427c977275a176b45c4eb2918cf78

Download Submit
C:\Windows\System\giXVGtK.exe

Filesize
1.7MB

MD5
63515067b6861e0a13efd4676d94dda2

SHA1
147bd6b93e1b03d8d935805ba5d61994902454f5

SHA256
dbcffb70b591c95cf52357ede35902f4ea6b6cef9d3b86ebbeb6a2eef9771196

SHA512
5f68169b582641bd1f69cd857332a7fb1cb37f3ed2d537672018ff0bd2dd49b4a85bb567242751fdf5c7d27f181ddcea0a445be694e1789d7cb04088ce339ac5

Download Submit
C:\Windows\System\jtSbaze.exe

Filesize
1.7MB

MD5
a39b14ba52eaf8e44a74cd43138c8853

SHA1
1677ab9fe31e12fae6c86b6e848083833df75777

SHA256
70fb1824134975ce2b1601526867174e424bf394846e871b31e9739b2f78d538

SHA512
cd482edf59d9cd9f383b466a29d4f2f5a98c89e3118cd1069e3b277d84408049e0d0e07b6919f9d7d26e8f0ae15075aac26481a04c84d24b66d51bc2a725306f

Download Submit
C:\Windows\System\kitYrbO.exe

Filesize
1.7MB

MD5
3c8c983fdaa401911c3077508cf3957a

SHA1
8f3374275b5df1d66256198950ab8afc7c16cad5

SHA256
a76d30b0460e01186e97075f7d84b5e074b1c602308fdcf31fa6a1d378442892

SHA512
1a7070f78b0ca9c46f16d496f26a5cae53db55d3173c36caef6e504bd652c7f2407c21f19902c63171c1fe9d41dcdd88c1d2ad3dc289a01187190de0f9ca424d

Download Submit
C:\Windows\System\klqgGPr.exe

Filesize
1.7MB

MD5
64c38c699eef3d270f6628ade74ef73d

SHA1
b70c1e9d6a41f8af57f1e9cfa4e21c8680f60acc

SHA256
257cd8f825fc787646865371f018c02d9a6b1af581ac05932cb4a5044607f7ba

SHA512
70df7d6316a3313d4bf480b146ef13497160ddb4d85e2fd61588efc93aa0779930c649a08307453d1a5f7a41b2cf579c787b35356ee6d8047c90bb91586b2d1d

Download Submit
C:\Windows\System\lJmGvHj.exe

Filesize
1.7MB

MD5
376f048d747027f8907aed470968d966

SHA1
ae394af237da0e5819b0489475da33c71a6acaab

SHA256
592d17c1615f883d1688d6ed3d2c72cc42d4dab59aea24f88cefd3f5f7eb94dd

SHA512
68e4dab66a122d2ac329b2e513df438c7ed0580cfb8b4e4310265f84b409644b698e5d579ed64ccc653e585685d1e6665db399deae8e6894ae8d32e8f4d21f06

Download Submit
C:\Windows\System\oSNAJlf.exe

Filesize
1.7MB

MD5
9c1d937595c2cab69796642ec1899f70

SHA1
e9ae3e3cfc43d5d219481b09cbc5eb02bac22872

SHA256
b752f6cd65d6f08ad80aba8ec4050f761b01ab61a9939ff03a1a4fa463ce89ce

SHA512
46d5dd92dc3796a84e376dfe3c568a2b36ba6b0f9a6223e12f5a9a38a891ed3647a29f8fe157bb6232ae99ad3869c2b72d5aaf00910c1d8cf9d894ee30728011

Download Submit
C:\Windows\System\pRhrWLU.exe

Filesize
1.7MB

MD5
bab2480e9054440e9460a674ea692057

SHA1
1682a9a09c8d8bcccf7025d7f603b7b47562abeb

SHA256
1bde27d1599b72768e8a0aeb2ace2657f19c39d649075eb6bbf691059213c141

SHA512
5ed9c4e269ce984e813cfe12f12d7d9a532abf92dcaec8d3dff4b659bb42223475215ebbe96c528cab1c9c710e5735d02c19a40bcddb6696bcb294ddbb121790

Download Submit
C:\Windows\System\sBUGSdu.exe

Filesize
1.7MB

MD5
c7339df3212eaa405d584cdf974bab7c

SHA1
07b17adff2baebe5ae61976fbb024755595a4357

SHA256
cbc33b9ccf77184bbed38c155cdf228b189e254ce8fa4e4cb00b2f8144901ae7

SHA512
a857a4271d5a76a0c8d43c316e7fdce4598bf36eeb55f315ca1027467b206a6c000011c3113e4b894924933d7e2837c93d0b03a0aa9731160c2d0858af696bd9

Download Submit
C:\Windows\System\vilHFvL.exe

Filesize
8B

MD5
20f50227b408431507e9e4298a89a7d5

SHA1
021be5cef03ca413a261257f3fa674d51e4eaecb

SHA256
f053af72ebaae8c20b4aa760dccbaa50d5e8c1b0612207e6dff562e592b0ee16

SHA512
a69e9f155961cdfb2c580f410cf1f9148255cadde0f420c64800ffc84ebbf2c4fc4d8c24eda7cee14ae357ad0398853cbe4f84f9db0bb9573e1f43351f2da9c0

Download Submit
C:\Windows\System\wEdZkuj.exe

Filesize
1.7MB

MD5
fd0fe981bfa77ce181cfa4e6b422a935

SHA1
91c5d0afe2e0f625ffc84dddb60d54c5ea1b81c0

SHA256
c375921436bf549312bdc69b086eb932a77824e62f5e4172541998a5937c2e11

SHA512
fb42b90c319829a185fd9593ef5724b39ca1d7dceab42bc72751a325d50739fb1b7892593b17cbfe6555866ef67abee33159e7e3a5ee9b823f3a547849c3576c

Download Submit
C:\Windows\System\xBBRDHR.exe

Filesize
1.7MB

MD5
2d0c342ce1f9dd3a3c5e06833932dfea

SHA1
0faadab3f4216641c156e28bc6631b48bd8ca924

SHA256
0471a12ce9992ffd788815ed26ba77068fe923910fd1b3dc1e5c44ddc520bbb6

SHA512
19c3a8fc33b5dce8a0e349bc4ffe84b6c4ec3db1f927a7f9b525d62d6bc9c9a1eac5d29a26c40e3bc308ffef752987ea398dab316f8db07103bb0c0804a65d48

Download Submit
C:\Windows\System\zFouigH.exe

Filesize
1.7MB

MD5
5f586f1b3e6210834fa047649d06768d

SHA1
1feb1f5a41a7a0d8fa6b4c70116db14ef4d450ee

SHA256
232e496f18dc64a7dad8d1c4780b75ea593fd021ab4a5ba69970dbee1226c9b7

SHA512
30bc1134bb6048d04b0c3ef7bee78f1430c6ed6cc8fa270c86c558d4f5d874b01eea6807f9ba233e63e51d9e5402510130657f49b78e95a400cf5456c1b36c9e

Download Submit
memory/244-0-0x00007FF6978F0000-0x00007FF697CE2000-memory.dmp

Filesize
3.9MB

Download
memory/244-1-0x000002C18C490000-0x000002C18C4A0000-memory.dmp

Filesize
64KB

Download
memory/380-3323-0x00007FF637E90000-0x00007FF638282000-memory.dmp

Filesize
3.9MB

Download
memory/380-3299-0x00007FF637E90000-0x00007FF638282000-memory.dmp

Filesize
3.9MB

Download
memory/380-193-0x00007FF637E90000-0x00007FF638282000-memory.dmp

Filesize
3.9MB

Download
memory/404-3219-0x00007FF7CF680000-0x00007FF7CFA72000-memory.dmp

Filesize
3.9MB

Download
memory/404-195-0x00007FF7CF680000-0x00007FF7CFA72000-memory.dmp

Filesize
3.9MB

Download
memory/1128-190-0x00007FF75E780000-0x00007FF75EB72000-memory.dmp

Filesize
3.9MB

Download
memory/1128-3215-0x00007FF75E780000-0x00007FF75EB72000-memory.dmp

Filesize
3.9MB

Download
memory/1132-186-0x00007FF63E720000-0x00007FF63EB12000-memory.dmp

Filesize
3.9MB

Download
memory/1132-3228-0x00007FF63E720000-0x00007FF63EB12000-memory.dmp

Filesize
3.9MB

Download
memory/1156-3212-0x00007FF62BC20000-0x00007FF62C012000-memory.dmp

Filesize
3.9MB

Download
memory/1156-167-0x00007FF62BC20000-0x00007FF62C012000-memory.dmp

Filesize
3.9MB

Download
memory/1224-3307-0x00007FF66F440000-0x00007FF66F832000-memory.dmp

Filesize
3.9MB

Download
memory/1224-197-0x00007FF66F440000-0x00007FF66F832000-memory.dmp

Filesize
3.9MB

Download
memory/1224-3300-0x00007FF66F440000-0x00007FF66F832000-memory.dmp

Filesize
3.9MB

Download
memory/1464-198-0x00007FF73F830000-0x00007FF73FC22000-memory.dmp

Filesize
3.9MB

Download
memory/1464-3207-0x00007FF73F830000-0x00007FF73FC22000-memory.dmp

Filesize
3.9MB

Download
memory/1660-3227-0x00007FF6DC710000-0x00007FF6DCB02000-memory.dmp

Filesize
3.9MB

Download
memory/1660-192-0x00007FF6DC710000-0x00007FF6DCB02000-memory.dmp

Filesize
3.9MB

Download
memory/1764-3204-0x00007FF76E6E0000-0x00007FF76EAD2000-memory.dmp

Filesize
3.9MB

Download
memory/1764-30-0x00007FF76E6E0000-0x00007FF76EAD2000-memory.dmp

Filesize
3.9MB

Download
memory/1956-184-0x00007FF65E4B0000-0x00007FF65E8A2000-memory.dmp

Filesize
3.9MB

Download
memory/1956-3210-0x00007FF65E4B0000-0x00007FF65E8A2000-memory.dmp

Filesize
3.9MB

Download
memory/2488-3208-0x00007FF7C2F30000-0x00007FF7C3322000-memory.dmp

Filesize
3.9MB

Download
memory/2488-187-0x00007FF7C2F30000-0x00007FF7C3322000-memory.dmp

Filesize
3.9MB

Download
memory/2508-3232-0x00007FF63D1A0000-0x00007FF63D592000-memory.dmp

Filesize
3.9MB

Download
memory/2508-194-0x00007FF63D1A0000-0x00007FF63D592000-memory.dmp

Filesize
3.9MB

Download
memory/2528-183-0x00007FF7A15F0000-0x00007FF7A19E2000-memory.dmp

Filesize
3.9MB

Download
memory/2528-3202-0x00007FF7A15F0000-0x00007FF7A19E2000-memory.dmp

Filesize
3.9MB

Download
memory/2820-189-0x00007FF7AFDC0000-0x00007FF7B01B2000-memory.dmp

Filesize
3.9MB

Download
memory/2820-3230-0x00007FF7AFDC0000-0x00007FF7B01B2000-memory.dmp

Filesize
3.9MB

Download
memory/3344-3310-0x00007FF6F5330000-0x00007FF6F5722000-memory.dmp

Filesize
3.9MB

Download
memory/3344-3298-0x00007FF6F5330000-0x00007FF6F5722000-memory.dmp

Filesize
3.9MB

Download
memory/3344-191-0x00007FF6F5330000-0x00007FF6F5722000-memory.dmp

Filesize
3.9MB

Download
memory/3372-3194-0x00007FF754700000-0x00007FF754AF2000-memory.dmp

Filesize
3.9MB

Download
memory/3372-22-0x00007FF754700000-0x00007FF754AF2000-memory.dmp

Filesize
3.9MB

Download
memory/4028-3217-0x00007FF6F2FD0000-0x00007FF6F33C2000-memory.dmp

Filesize
3.9MB

Download
memory/4028-196-0x00007FF6F2FD0000-0x00007FF6F33C2000-memory.dmp

Filesize
3.9MB

Download
memory/4364-3225-0x00007FF63E4B0000-0x00007FF63E8A2000-memory.dmp

Filesize
3.9MB

Download
memory/4364-185-0x00007FF63E4B0000-0x00007FF63E8A2000-memory.dmp

Filesize
3.9MB

Download
memory/4596-3201-0x00007FF6EAED0000-0x00007FF6EB2C2000-memory.dmp

Filesize
3.9MB

Download
memory/4596-199-0x00007FF6EAED0000-0x00007FF6EB2C2000-memory.dmp

Filesize
3.9MB

Download
memory/4880-3223-0x00007FF7BC5A0000-0x00007FF7BC992000-memory.dmp

Filesize
3.9MB

Download
memory/4880-188-0x00007FF7BC5A0000-0x00007FF7BC992000-memory.dmp

Filesize
3.9MB

Download
memory/5088-122-0x00000198EC4F0000-0x00000198EC500000-memory.dmp

Filesize
64KB

Download
memory/5088-386-0x00000198EC4A0000-0x00000198EC4C2000-memory.dmp

Filesize
136KB

Download
memory/5088-115-0x00007FFE63300000-0x00007FFE63DC1000-memory.dmp

Filesize
10.8MB

Download
memory/5096-3221-0x00007FF6D35A0000-0x00007FF6D3992000-memory.dmp

Filesize
3.9MB

Download
memory/5096-200-0x00007FF6D35A0000-0x00007FF6D3992000-memory.dmp

Filesize
3.9MB

Download