xmrig | ef850e2d836c70eb4e3cdddcebdccb50375f4837f25a7ae8543ba01a5be66033

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 02:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
Size

1.4MB
MD5

0238177e30e9d3bf4de6d35c7b10b3a7
SHA1

241575296310aa34349f69519d36429366a19029
SHA256

ef850e2d836c70eb4e3cdddcebdccb50375f4837f25a7ae8543ba01a5be66033
SHA512

27c0a111c5a6225b48fada204b340ba4bb1b1918581a949ef454f59ef2b3d50bef0a6f63cf5c74b1eb0ec64b609eda1f82991f24973153b287d3d6acfa3664b5
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYKpGncHBN/VPw8nD:Lz071uv4BPMkibTIA5CJ7D

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 40 IoCs

miner

resource	yara_rule
behavioral2/memory/768-578-0x00007FF7B4BB0000-0x00007FF7B4FA2000-memory.dmp	xmrig
behavioral2/memory/1272-668-0x00007FF75BE10000-0x00007FF75C202000-memory.dmp	xmrig
behavioral2/memory/3464-674-0x00007FF7CA7B0000-0x00007FF7CABA2000-memory.dmp	xmrig
behavioral2/memory/1284-677-0x00007FF7410A0000-0x00007FF741492000-memory.dmp	xmrig
behavioral2/memory/2420-676-0x00007FF76AC70000-0x00007FF76B062000-memory.dmp	xmrig
behavioral2/memory/4504-675-0x00007FF611100000-0x00007FF6114F2000-memory.dmp	xmrig
behavioral2/memory/1572-673-0x00007FF675910000-0x00007FF675D02000-memory.dmp	xmrig
behavioral2/memory/1268-672-0x00007FF6A8210000-0x00007FF6A8602000-memory.dmp	xmrig
behavioral2/memory/4608-671-0x00007FF78C640000-0x00007FF78CA32000-memory.dmp	xmrig
behavioral2/memory/2016-670-0x00007FF6561F0000-0x00007FF6565E2000-memory.dmp	xmrig
behavioral2/memory/3252-669-0x00007FF604E60000-0x00007FF605252000-memory.dmp	xmrig
behavioral2/memory/5012-667-0x00007FF702250000-0x00007FF702642000-memory.dmp	xmrig
behavioral2/memory/2356-662-0x00007FF6095C0000-0x00007FF6099B2000-memory.dmp	xmrig
behavioral2/memory/4128-576-0x00007FF7AAF10000-0x00007FF7AB302000-memory.dmp	xmrig
behavioral2/memory/3656-392-0x00007FF6286D0000-0x00007FF628AC2000-memory.dmp	xmrig
behavioral2/memory/2656-363-0x00007FF6351F0000-0x00007FF6355E2000-memory.dmp	xmrig
behavioral2/memory/2484-302-0x00007FF628440000-0x00007FF628832000-memory.dmp	xmrig
behavioral2/memory/1416-3211-0x00007FF77D880000-0x00007FF77DC72000-memory.dmp	xmrig
behavioral2/memory/4848-3212-0x00007FF718020000-0x00007FF718412000-memory.dmp	xmrig
behavioral2/memory/3464-3214-0x00007FF7CA7B0000-0x00007FF7CABA2000-memory.dmp	xmrig
behavioral2/memory/4504-3222-0x00007FF611100000-0x00007FF6114F2000-memory.dmp	xmrig
behavioral2/memory/4488-3221-0x00007FF73ED60000-0x00007FF73F152000-memory.dmp	xmrig
behavioral2/memory/4848-3224-0x00007FF718020000-0x00007FF718412000-memory.dmp	xmrig
behavioral2/memory/1572-3228-0x00007FF675910000-0x00007FF675D02000-memory.dmp	xmrig
behavioral2/memory/2484-3230-0x00007FF628440000-0x00007FF628832000-memory.dmp	xmrig
behavioral2/memory/5012-3232-0x00007FF702250000-0x00007FF702642000-memory.dmp	xmrig
behavioral2/memory/2356-3227-0x00007FF6095C0000-0x00007FF6099B2000-memory.dmp	xmrig
behavioral2/memory/4904-3218-0x00007FF70CE50000-0x00007FF70D242000-memory.dmp	xmrig
behavioral2/memory/1416-3216-0x00007FF77D880000-0x00007FF77DC72000-memory.dmp	xmrig
behavioral2/memory/1268-3257-0x00007FF6A8210000-0x00007FF6A8602000-memory.dmp	xmrig
behavioral2/memory/2656-3258-0x00007FF6351F0000-0x00007FF6355E2000-memory.dmp	xmrig
behavioral2/memory/1284-3241-0x00007FF7410A0000-0x00007FF741492000-memory.dmp	xmrig
behavioral2/memory/4608-3239-0x00007FF78C640000-0x00007FF78CA32000-memory.dmp	xmrig
behavioral2/memory/4128-3237-0x00007FF7AAF10000-0x00007FF7AB302000-memory.dmp	xmrig
behavioral2/memory/3656-3255-0x00007FF6286D0000-0x00007FF628AC2000-memory.dmp	xmrig
behavioral2/memory/2016-3249-0x00007FF6561F0000-0x00007FF6565E2000-memory.dmp	xmrig
behavioral2/memory/3252-3245-0x00007FF604E60000-0x00007FF605252000-memory.dmp	xmrig
behavioral2/memory/2420-3243-0x00007FF76AC70000-0x00007FF76B062000-memory.dmp	xmrig
behavioral2/memory/768-3235-0x00007FF7B4BB0000-0x00007FF7B4FA2000-memory.dmp	xmrig
behavioral2/memory/1272-3277-0x00007FF75BE10000-0x00007FF75C202000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1416	LMSuHMP.exe
3464	HRljnSg.exe
4904	QSQGMrk.exe
4848	TApmkQS.exe
4488	uAVXCbK.exe
4504	NXuUbvu.exe
2484	eqHpnGA.exe
2656	AtjOkYO.exe
3656	rsIYZHf.exe
4128	eAGKDhU.exe
768	TASLOIT.exe
2420	VOivcId.exe
2356	JlKQZlI.exe
5012	xOLYdoO.exe
1272	dnBNFDw.exe
3252	JGfEvTo.exe
2016	oNYOZns.exe
1284	gCImjTF.exe
4608	MOZZSDq.exe
1268	XgmWjjU.exe
1572	pPKrKAL.exe
2024	FtmpXkZ.exe
2472	dQoZJuT.exe
2300	akMpYgk.exe
4056	Mjlecou.exe
868	CenglAV.exe
1408	ghHTaQq.exe
960	tuJtdcm.exe
468	IcXjohn.exe
1760	ggBDzza.exe
736	TKHueHT.exe
2096	oNaEeWT.exe
684	PbwEgrN.exe
4324	mQvmEDe.exe
4764	YRiXSAo.exe
456	WVvOsPw.exe
1332	VlkyhdY.exe
2588	RPFivpv.exe
3000	wejsIMM.exe
4224	nnqcVSM.exe
1800	frJGwxZ.exe
2168	WOcirVe.exe
1224	capxpSI.exe
424	hQCPTec.exe
1096	qRXLrds.exe
1484	dOvBaGd.exe
3148	cVhGyPv.exe
4708	qNSzsQT.exe
4048	WiJdZUl.exe
3508	JMEptMa.exe
3816	CgPRFcJ.exe
2404	eZAjitx.exe
3452	QngYuvl.exe
3744	MVuecKn.exe
2476	hDblDQQ.exe
4912	PGrUcVm.exe
4808	yEIEGln.exe
3652	uYFZhkW.exe
3612	OSWOXAu.exe
2208	sdvLowv.exe
4944	HfpGtAa.exe
4604	dpKXQqU.exe
3384	MZtGKCd.exe
5108	ZdOPCPU.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/32-0-0x00007FF6A25F0000-0x00007FF6A29E2000-memory.dmp	upx
behavioral2/files/0x000a000000023b89-6.dat	upx
behavioral2/files/0x000c000000023b80-7.dat	upx
behavioral2/files/0x000a000000023b8c-25.dat	upx
behavioral2/files/0x000a000000023b88-12.dat	upx
behavioral2/files/0x000a000000023b92-55.dat	upx
behavioral2/files/0x000a000000023ba4-152.dat	upx
behavioral2/files/0x000a000000023b98-210.dat	upx
behavioral2/memory/768-578-0x00007FF7B4BB0000-0x00007FF7B4FA2000-memory.dmp	upx
behavioral2/memory/1272-668-0x00007FF75BE10000-0x00007FF75C202000-memory.dmp	upx
behavioral2/memory/3464-674-0x00007FF7CA7B0000-0x00007FF7CABA2000-memory.dmp	upx
behavioral2/memory/1284-677-0x00007FF7410A0000-0x00007FF741492000-memory.dmp	upx
behavioral2/memory/2420-676-0x00007FF76AC70000-0x00007FF76B062000-memory.dmp	upx
behavioral2/memory/4504-675-0x00007FF611100000-0x00007FF6114F2000-memory.dmp	upx
behavioral2/memory/1572-673-0x00007FF675910000-0x00007FF675D02000-memory.dmp	upx
behavioral2/memory/1268-672-0x00007FF6A8210000-0x00007FF6A8602000-memory.dmp	upx
behavioral2/memory/4608-671-0x00007FF78C640000-0x00007FF78CA32000-memory.dmp	upx
behavioral2/memory/2016-670-0x00007FF6561F0000-0x00007FF6565E2000-memory.dmp	upx
behavioral2/memory/3252-669-0x00007FF604E60000-0x00007FF605252000-memory.dmp	upx
behavioral2/memory/5012-667-0x00007FF702250000-0x00007FF702642000-memory.dmp	upx
behavioral2/memory/2356-662-0x00007FF6095C0000-0x00007FF6099B2000-memory.dmp	upx
behavioral2/memory/4128-576-0x00007FF7AAF10000-0x00007FF7AB302000-memory.dmp	upx
behavioral2/memory/3656-392-0x00007FF6286D0000-0x00007FF628AC2000-memory.dmp	upx
behavioral2/memory/2656-363-0x00007FF6351F0000-0x00007FF6355E2000-memory.dmp	upx
behavioral2/memory/2484-302-0x00007FF628440000-0x00007FF628832000-memory.dmp	upx
behavioral2/files/0x000a000000023b96-197.dat	upx
behavioral2/files/0x000a000000023bb3-189.dat	upx
behavioral2/files/0x000a000000023bb2-188.dat	upx
behavioral2/files/0x000a000000023bb1-187.dat	upx
behavioral2/files/0x000a000000023baf-183.dat	upx
behavioral2/files/0x000a000000023bac-176.dat	upx
behavioral2/files/0x000a000000023b8b-175.dat	upx
behavioral2/files/0x000a000000023bad-174.dat	upx
behavioral2/files/0x000a000000023b9c-173.dat	upx
behavioral2/files/0x000a000000023baa-165.dat	upx
behavioral2/files/0x000a000000023ba8-161.dat	upx
behavioral2/files/0x000a000000023b9a-158.dat	upx
behavioral2/files/0x000a000000023ba6-156.dat	upx
behavioral2/files/0x000a000000023ba5-155.dat	upx
behavioral2/files/0x000a000000023ba3-151.dat	upx
behavioral2/files/0x000a000000023b97-202.dat	upx
behavioral2/files/0x000a000000023ba2-150.dat	upx
behavioral2/files/0x000a000000023ba1-149.dat	upx
behavioral2/files/0x000a000000023bb5-194.dat	upx
behavioral2/files/0x000a000000023ba0-144.dat	upx
behavioral2/files/0x000a000000023b90-142.dat	upx
behavioral2/files/0x000a000000023b9f-137.dat	upx
behavioral2/files/0x000a000000023b8f-133.dat	upx
behavioral2/files/0x000a000000023b9e-130.dat	upx
behavioral2/files/0x000a000000023b94-128.dat	upx
behavioral2/files/0x000a000000023bb0-186.dat	upx
behavioral2/files/0x000a000000023bae-182.dat	upx
behavioral2/files/0x000a000000023b8e-119.dat	upx
behavioral2/files/0x000a000000023b9b-113.dat	upx
behavioral2/files/0x000a000000023bab-171.dat	upx
behavioral2/files/0x000a000000023b99-102.dat	upx
behavioral2/files/0x000a000000023ba7-157.dat	upx
behavioral2/files/0x000a000000023b8d-93.dat	upx
behavioral2/files/0x000a000000023b95-88.dat	upx
behavioral2/files/0x000a000000023b91-145.dat	upx
behavioral2/files/0x000a000000023b9d-123.dat	upx
behavioral2/files/0x000a000000023b93-67.dat	upx
behavioral2/files/0x000a000000023b8a-66.dat	upx
behavioral2/memory/4488-51-0x00007FF73ED60000-0x00007FF73F152000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\JlKQZlI.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\iSrGxFT.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\coHCzWA.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\FaincfW.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\QSCFqNe.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\GiNrWIf.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\SYTaKZp.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\RfoaTHt.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\xjuDnrs.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\vsYFSFB.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\sHQjULB.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\uMROddH.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\ZmTjfSH.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\smCwoYF.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\wWFFGmX.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\VokYJfN.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\pDQOcYg.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\QBbGZQS.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\ozssSvr.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\ZXiqdPv.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\EDngKbD.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\fCqwQiV.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\mYbjvEc.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\dIPUNPK.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\RRyOvKD.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\VcfPSyl.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\kKaGTCz.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\xhnXKit.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\tXuCiPQ.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\njbnFVq.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\qeNnWSZ.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\qdbRvoE.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\mhCIuQF.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\vQXssOw.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\zGxcRcx.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\fZnRguT.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\xuKEunB.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\pyQbZhH.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\tpDhelh.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\kKCxGyh.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\kjNCNOx.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\QWSyMrB.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\EYnrsEd.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\vTbVSev.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\geByAbl.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\RpEiRSK.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\BVcNuxJ.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\HMZbFQI.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\kcdUZIq.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\eqHpnGA.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\kWMAYZI.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\VZVcHZg.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\xUlOJyj.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\IdNNlHx.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\IhjCPLJ.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\PTtVGUw.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\WHKyTmz.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\yjLEBXb.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\faLGVfr.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\BVrnSbz.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\UDovUBT.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\qWIboLz.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\cJOTxJh.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\txuaPMF.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5016	powershell.exe
5016	powershell.exe
5016	powershell.exe
5016	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5016	powershell.exe
Token: SeLockMemoryPrivilege	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 32 wrote to memory of 5016	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	85
PID 32 wrote to memory of 5016	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	85
PID 32 wrote to memory of 1416	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	86
PID 32 wrote to memory of 1416	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	86
PID 32 wrote to memory of 3464	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	87
PID 32 wrote to memory of 3464	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	87
PID 32 wrote to memory of 4904	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	88
PID 32 wrote to memory of 4904	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	88
PID 32 wrote to memory of 4848	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	89
PID 32 wrote to memory of 4848	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	89
PID 32 wrote to memory of 2656	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	90
PID 32 wrote to memory of 2656	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	90
PID 32 wrote to memory of 4488	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	91
PID 32 wrote to memory of 4488	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	91
PID 32 wrote to memory of 4504	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	92
PID 32 wrote to memory of 4504	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	92
PID 32 wrote to memory of 2484	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	93
PID 32 wrote to memory of 2484	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	93
PID 32 wrote to memory of 3656	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	94
PID 32 wrote to memory of 3656	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	94
PID 32 wrote to memory of 4128	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	95
PID 32 wrote to memory of 4128	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	95
PID 32 wrote to memory of 768	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	96
PID 32 wrote to memory of 768	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	96
PID 32 wrote to memory of 2420	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	97
PID 32 wrote to memory of 2420	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	97
PID 32 wrote to memory of 2356	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	98
PID 32 wrote to memory of 2356	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	98
PID 32 wrote to memory of 5012	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	99
PID 32 wrote to memory of 5012	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	99
PID 32 wrote to memory of 1272	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	100
PID 32 wrote to memory of 1272	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	100
PID 32 wrote to memory of 3252	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	101
PID 32 wrote to memory of 3252	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	101
PID 32 wrote to memory of 2016	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	102
PID 32 wrote to memory of 2016	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	102
PID 32 wrote to memory of 1284	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	103
PID 32 wrote to memory of 1284	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	103
PID 32 wrote to memory of 4608	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	104
PID 32 wrote to memory of 4608	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	104
PID 32 wrote to memory of 1268	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	105
PID 32 wrote to memory of 1268	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	105
PID 32 wrote to memory of 1572	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	106
PID 32 wrote to memory of 1572	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	106
PID 32 wrote to memory of 456	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	107
PID 32 wrote to memory of 456	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	107
PID 32 wrote to memory of 2024	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	108
PID 32 wrote to memory of 2024	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	108
PID 32 wrote to memory of 2472	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	109
PID 32 wrote to memory of 2472	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	109
PID 32 wrote to memory of 2300	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	110
PID 32 wrote to memory of 2300	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	110
PID 32 wrote to memory of 4056	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	111
PID 32 wrote to memory of 4056	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	111
PID 32 wrote to memory of 868	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	112
PID 32 wrote to memory of 868	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	112
PID 32 wrote to memory of 1408	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	113
PID 32 wrote to memory of 1408	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	113
PID 32 wrote to memory of 960	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	114
PID 32 wrote to memory of 960	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	114
PID 32 wrote to memory of 468	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	115
PID 32 wrote to memory of 468	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	115
PID 32 wrote to memory of 1760	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	116
PID 32 wrote to memory of 1760	32	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:32
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5016
- C:\Windows\System\LMSuHMP.exe
  C:\Windows\System\LMSuHMP.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\HRljnSg.exe
  C:\Windows\System\HRljnSg.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\QSQGMrk.exe
  C:\Windows\System\QSQGMrk.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\TApmkQS.exe
  C:\Windows\System\TApmkQS.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\AtjOkYO.exe
  C:\Windows\System\AtjOkYO.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\uAVXCbK.exe
  C:\Windows\System\uAVXCbK.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\NXuUbvu.exe
  C:\Windows\System\NXuUbvu.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\eqHpnGA.exe
  C:\Windows\System\eqHpnGA.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\rsIYZHf.exe
  C:\Windows\System\rsIYZHf.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\eAGKDhU.exe
  C:\Windows\System\eAGKDhU.exe
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\Windows\System\TASLOIT.exe
  C:\Windows\System\TASLOIT.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\VOivcId.exe
  C:\Windows\System\VOivcId.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\JlKQZlI.exe
  C:\Windows\System\JlKQZlI.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\xOLYdoO.exe
  C:\Windows\System\xOLYdoO.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\dnBNFDw.exe
  C:\Windows\System\dnBNFDw.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\JGfEvTo.exe
  C:\Windows\System\JGfEvTo.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\System\oNYOZns.exe
  C:\Windows\System\oNYOZns.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\gCImjTF.exe
  C:\Windows\System\gCImjTF.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\MOZZSDq.exe
  C:\Windows\System\MOZZSDq.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\XgmWjjU.exe
  C:\Windows\System\XgmWjjU.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\pPKrKAL.exe
  C:\Windows\System\pPKrKAL.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\WVvOsPw.exe
  C:\Windows\System\WVvOsPw.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\FtmpXkZ.exe
  C:\Windows\System\FtmpXkZ.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\dQoZJuT.exe
  C:\Windows\System\dQoZJuT.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\akMpYgk.exe
  C:\Windows\System\akMpYgk.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\Mjlecou.exe
  C:\Windows\System\Mjlecou.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\CenglAV.exe
  C:\Windows\System\CenglAV.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\ghHTaQq.exe
  C:\Windows\System\ghHTaQq.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\tuJtdcm.exe
  C:\Windows\System\tuJtdcm.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\IcXjohn.exe
  C:\Windows\System\IcXjohn.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\ggBDzza.exe
  C:\Windows\System\ggBDzza.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\TKHueHT.exe
  C:\Windows\System\TKHueHT.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\oNaEeWT.exe
  C:\Windows\System\oNaEeWT.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\PbwEgrN.exe
  C:\Windows\System\PbwEgrN.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\qNSzsQT.exe
  C:\Windows\System\qNSzsQT.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\mQvmEDe.exe
  C:\Windows\System\mQvmEDe.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\YRiXSAo.exe
  C:\Windows\System\YRiXSAo.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\RPFivpv.exe
  C:\Windows\System\RPFivpv.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\VlkyhdY.exe
  C:\Windows\System\VlkyhdY.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\wejsIMM.exe
  C:\Windows\System\wejsIMM.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\nnqcVSM.exe
  C:\Windows\System\nnqcVSM.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\frJGwxZ.exe
  C:\Windows\System\frJGwxZ.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\WOcirVe.exe
  C:\Windows\System\WOcirVe.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\capxpSI.exe
  C:\Windows\System\capxpSI.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\hQCPTec.exe
  C:\Windows\System\hQCPTec.exe
  2⤵
  - Executes dropped EXE
  PID:424
- C:\Windows\System\yEIEGln.exe
  C:\Windows\System\yEIEGln.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\qRXLrds.exe
  C:\Windows\System\qRXLrds.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\dOvBaGd.exe
  C:\Windows\System\dOvBaGd.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\cVhGyPv.exe
  C:\Windows\System\cVhGyPv.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\WiJdZUl.exe
  C:\Windows\System\WiJdZUl.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\JMEptMa.exe
  C:\Windows\System\JMEptMa.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\CgPRFcJ.exe
  C:\Windows\System\CgPRFcJ.exe
  2⤵
  - Executes dropped EXE
  PID:3816
- C:\Windows\System\eZAjitx.exe
  C:\Windows\System\eZAjitx.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\QngYuvl.exe
  C:\Windows\System\QngYuvl.exe
  2⤵
  - Executes dropped EXE
  PID:3452
- C:\Windows\System\MVuecKn.exe
  C:\Windows\System\MVuecKn.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\hDblDQQ.exe
  C:\Windows\System\hDblDQQ.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\PGrUcVm.exe
  C:\Windows\System\PGrUcVm.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\uYFZhkW.exe
  C:\Windows\System\uYFZhkW.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\OSWOXAu.exe
  C:\Windows\System\OSWOXAu.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\sdvLowv.exe
  C:\Windows\System\sdvLowv.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\HfpGtAa.exe
  C:\Windows\System\HfpGtAa.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\dpKXQqU.exe
  C:\Windows\System\dpKXQqU.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\MZtGKCd.exe
  C:\Windows\System\MZtGKCd.exe
  2⤵
  - Executes dropped EXE
  PID:3384
- C:\Windows\System\ZdOPCPU.exe
  C:\Windows\System\ZdOPCPU.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\AJDjHUz.exe
  C:\Windows\System\AJDjHUz.exe
  2⤵
  PID:3832
- C:\Windows\System\JNWbURH.exe
  C:\Windows\System\JNWbURH.exe
  2⤵
  PID:2220
- C:\Windows\System\VtcFIBL.exe
  C:\Windows\System\VtcFIBL.exe
  2⤵
  PID:1504
- C:\Windows\System\EgabAba.exe
  C:\Windows\System\EgabAba.exe
  2⤵
  PID:1532
- C:\Windows\System\sobArYP.exe
  C:\Windows\System\sobArYP.exe
  2⤵
  PID:3424
- C:\Windows\System\uRRHQEY.exe
  C:\Windows\System\uRRHQEY.exe
  2⤵
  PID:4428
- C:\Windows\System\SGeXsvA.exe
  C:\Windows\System\SGeXsvA.exe
  2⤵
  PID:4968
- C:\Windows\System\RFZRzFU.exe
  C:\Windows\System\RFZRzFU.exe
  2⤵
  PID:3248
- C:\Windows\System\PXGabmV.exe
  C:\Windows\System\PXGabmV.exe
  2⤵
  PID:2644
- C:\Windows\System\XPdJuOS.exe
  C:\Windows\System\XPdJuOS.exe
  2⤵
  PID:1700
- C:\Windows\System\KHMNkZS.exe
  C:\Windows\System\KHMNkZS.exe
  2⤵
  PID:400
- C:\Windows\System\hggHaTK.exe
  C:\Windows\System\hggHaTK.exe
  2⤵
  PID:2544
- C:\Windows\System\ezTYFPr.exe
  C:\Windows\System\ezTYFPr.exe
  2⤵
  PID:1824
- C:\Windows\System\DnrUprN.exe
  C:\Windows\System\DnrUprN.exe
  2⤵
  PID:724
- C:\Windows\System\DhzQrEl.exe
  C:\Windows\System\DhzQrEl.exe
  2⤵
  PID:4420
- C:\Windows\System\YkMVWOy.exe
  C:\Windows\System\YkMVWOy.exe
  2⤵
  PID:1044
- C:\Windows\System\sXmJvJY.exe
  C:\Windows\System\sXmJvJY.exe
  2⤵
  PID:872
- C:\Windows\System\EbRFJEa.exe
  C:\Windows\System\EbRFJEa.exe
  2⤵
  PID:2416
- C:\Windows\System\WUwApQm.exe
  C:\Windows\System\WUwApQm.exe
  2⤵
  PID:4436
- C:\Windows\System\OegvzEz.exe
  C:\Windows\System\OegvzEz.exe
  2⤵
  PID:1612
- C:\Windows\System\GReOmga.exe
  C:\Windows\System\GReOmga.exe
  2⤵
  PID:3232
- C:\Windows\System\ebJUcta.exe
  C:\Windows\System\ebJUcta.exe
  2⤵
  PID:5132
- C:\Windows\System\LtdWbis.exe
  C:\Windows\System\LtdWbis.exe
  2⤵
  PID:5156
- C:\Windows\System\dZunNiy.exe
  C:\Windows\System\dZunNiy.exe
  2⤵
  PID:5180
- C:\Windows\System\uMROddH.exe
  C:\Windows\System\uMROddH.exe
  2⤵
  PID:5196
- C:\Windows\System\kMAQFcc.exe
  C:\Windows\System\kMAQFcc.exe
  2⤵
  PID:5216
- C:\Windows\System\ZYqyhrr.exe
  C:\Windows\System\ZYqyhrr.exe
  2⤵
  PID:5232
- C:\Windows\System\BlkSbNt.exe
  C:\Windows\System\BlkSbNt.exe
  2⤵
  PID:5256
- C:\Windows\System\MiefKTL.exe
  C:\Windows\System\MiefKTL.exe
  2⤵
  PID:5276
- C:\Windows\System\QoBuHCb.exe
  C:\Windows\System\QoBuHCb.exe
  2⤵
  PID:5300
- C:\Windows\System\mzWTfuH.exe
  C:\Windows\System\mzWTfuH.exe
  2⤵
  PID:5316
- C:\Windows\System\HgcgdLu.exe
  C:\Windows\System\HgcgdLu.exe
  2⤵
  PID:5332
- C:\Windows\System\ORBeQru.exe
  C:\Windows\System\ORBeQru.exe
  2⤵
  PID:5348
- C:\Windows\System\Mvnworz.exe
  C:\Windows\System\Mvnworz.exe
  2⤵
  PID:5372
- C:\Windows\System\eYNlkja.exe
  C:\Windows\System\eYNlkja.exe
  2⤵
  PID:5392
- C:\Windows\System\oXrJWiq.exe
  C:\Windows\System\oXrJWiq.exe
  2⤵
  PID:5412
- C:\Windows\System\JKbdLvv.exe
  C:\Windows\System\JKbdLvv.exe
  2⤵
  PID:5428
- C:\Windows\System\azmYvus.exe
  C:\Windows\System\azmYvus.exe
  2⤵
  PID:5456
- C:\Windows\System\hacsTDq.exe
  C:\Windows\System\hacsTDq.exe
  2⤵
  PID:5472
- C:\Windows\System\kyYKIsM.exe
  C:\Windows\System\kyYKIsM.exe
  2⤵
  PID:5492
- C:\Windows\System\eLASsYS.exe
  C:\Windows\System\eLASsYS.exe
  2⤵
  PID:5524
- C:\Windows\System\hJBuFIV.exe
  C:\Windows\System\hJBuFIV.exe
  2⤵
  PID:5540
- C:\Windows\System\WIuJjtm.exe
  C:\Windows\System\WIuJjtm.exe
  2⤵
  PID:5564
- C:\Windows\System\XtTlHrb.exe
  C:\Windows\System\XtTlHrb.exe
  2⤵
  PID:5584
- C:\Windows\System\RPuardf.exe
  C:\Windows\System\RPuardf.exe
  2⤵
  PID:5612
- C:\Windows\System\AzLTSWD.exe
  C:\Windows\System\AzLTSWD.exe
  2⤵
  PID:5628
- C:\Windows\System\SeLzDKk.exe
  C:\Windows\System\SeLzDKk.exe
  2⤵
  PID:5652
- C:\Windows\System\sqSILsR.exe
  C:\Windows\System\sqSILsR.exe
  2⤵
  PID:5672
- C:\Windows\System\tHGWPRn.exe
  C:\Windows\System\tHGWPRn.exe
  2⤵
  PID:5696
- C:\Windows\System\VLxgGKP.exe
  C:\Windows\System\VLxgGKP.exe
  2⤵
  PID:5716
- C:\Windows\System\JyJPcrv.exe
  C:\Windows\System\JyJPcrv.exe
  2⤵
  PID:5744
- C:\Windows\System\SJvEwiD.exe
  C:\Windows\System\SJvEwiD.exe
  2⤵
  PID:5760
- C:\Windows\System\UrlfWhe.exe
  C:\Windows\System\UrlfWhe.exe
  2⤵
  PID:5792
- C:\Windows\System\dAEzsFC.exe
  C:\Windows\System\dAEzsFC.exe
  2⤵
  PID:5816
- C:\Windows\System\qTlAZnS.exe
  C:\Windows\System\qTlAZnS.exe
  2⤵
  PID:5840
- C:\Windows\System\zzNyvxn.exe
  C:\Windows\System\zzNyvxn.exe
  2⤵
  PID:5864
- C:\Windows\System\XoHtbdn.exe
  C:\Windows\System\XoHtbdn.exe
  2⤵
  PID:5884
- C:\Windows\System\WkOkfnG.exe
  C:\Windows\System\WkOkfnG.exe
  2⤵
  PID:5916
- C:\Windows\System\CGSsYvT.exe
  C:\Windows\System\CGSsYvT.exe
  2⤵
  PID:5936
- C:\Windows\System\xmPeiYE.exe
  C:\Windows\System\xmPeiYE.exe
  2⤵
  PID:5960
- C:\Windows\System\hjdcVVU.exe
  C:\Windows\System\hjdcVVU.exe
  2⤵
  PID:5984
- C:\Windows\System\oZYdLOx.exe
  C:\Windows\System\oZYdLOx.exe
  2⤵
  PID:6000
- C:\Windows\System\InMAJRR.exe
  C:\Windows\System\InMAJRR.exe
  2⤵
  PID:6024
- C:\Windows\System\NeQybGy.exe
  C:\Windows\System\NeQybGy.exe
  2⤵
  PID:6044
- C:\Windows\System\blsfvZg.exe
  C:\Windows\System\blsfvZg.exe
  2⤵
  PID:6060
- C:\Windows\System\ICImYDu.exe
  C:\Windows\System\ICImYDu.exe
  2⤵
  PID:6080
- C:\Windows\System\kUKFYhj.exe
  C:\Windows\System\kUKFYhj.exe
  2⤵
  PID:6096
- C:\Windows\System\geAMhmV.exe
  C:\Windows\System\geAMhmV.exe
  2⤵
  PID:6124
- C:\Windows\System\tjKfumQ.exe
  C:\Windows\System\tjKfumQ.exe
  2⤵
  PID:2152
- C:\Windows\System\hJoRbdv.exe
  C:\Windows\System\hJoRbdv.exe
  2⤵
  PID:2956
- C:\Windows\System\XAaBuXX.exe
  C:\Windows\System\XAaBuXX.exe
  2⤵
  PID:1604
- C:\Windows\System\QFVvWWx.exe
  C:\Windows\System\QFVvWWx.exe
  2⤵
  PID:3264
- C:\Windows\System\qUUcHTN.exe
  C:\Windows\System\qUUcHTN.exe
  2⤵
  PID:4596
- C:\Windows\System\VrRRwBQ.exe
  C:\Windows\System\VrRRwBQ.exe
  2⤵
  PID:2664
- C:\Windows\System\LMHRtUA.exe
  C:\Windows\System\LMHRtUA.exe
  2⤵
  PID:2492
- C:\Windows\System\ARibZrq.exe
  C:\Windows\System\ARibZrq.exe
  2⤵
  PID:5284
- C:\Windows\System\YeOZQQu.exe
  C:\Windows\System\YeOZQQu.exe
  2⤵
  PID:3092
- C:\Windows\System\Nnygxex.exe
  C:\Windows\System\Nnygxex.exe
  2⤵
  PID:5488
- C:\Windows\System\RpWtOCl.exe
  C:\Windows\System\RpWtOCl.exe
  2⤵
  PID:2952
- C:\Windows\System\XCQwxAn.exe
  C:\Windows\System\XCQwxAn.exe
  2⤵
  PID:5032
- C:\Windows\System\EIBmGHP.exe
  C:\Windows\System\EIBmGHP.exe
  2⤵
  PID:4068
- C:\Windows\System\tFrOFvk.exe
  C:\Windows\System\tFrOFvk.exe
  2⤵
  PID:3412
- C:\Windows\System\svEpDUn.exe
  C:\Windows\System\svEpDUn.exe
  2⤵
  PID:2020
- C:\Windows\System\YSdskWA.exe
  C:\Windows\System\YSdskWA.exe
  2⤵
  PID:4552
- C:\Windows\System\YtcXIgx.exe
  C:\Windows\System\YtcXIgx.exe
  2⤵
  PID:5224
- C:\Windows\System\RXmFxfK.exe
  C:\Windows\System\RXmFxfK.exe
  2⤵
  PID:4540
- C:\Windows\System\YwMLEpl.exe
  C:\Windows\System\YwMLEpl.exe
  2⤵
  PID:3964
- C:\Windows\System\zOnTlVm.exe
  C:\Windows\System\zOnTlVm.exe
  2⤵
  PID:4600
- C:\Windows\System\OaxLcch.exe
  C:\Windows\System\OaxLcch.exe
  2⤵
  PID:2804
- C:\Windows\System\VOygdRm.exe
  C:\Windows\System\VOygdRm.exe
  2⤵
  PID:6156
- C:\Windows\System\lOfdYtm.exe
  C:\Windows\System\lOfdYtm.exe
  2⤵
  PID:6172
- C:\Windows\System\YbZFSPz.exe
  C:\Windows\System\YbZFSPz.exe
  2⤵
  PID:6196
- C:\Windows\System\tOisypB.exe
  C:\Windows\System\tOisypB.exe
  2⤵
  PID:6212
- C:\Windows\System\OdXIbQV.exe
  C:\Windows\System\OdXIbQV.exe
  2⤵
  PID:6236
- C:\Windows\System\cAzWctX.exe
  C:\Windows\System\cAzWctX.exe
  2⤵
  PID:6252
- C:\Windows\System\cDrJrKy.exe
  C:\Windows\System\cDrJrKy.exe
  2⤵
  PID:6276
- C:\Windows\System\vhQgzQj.exe
  C:\Windows\System\vhQgzQj.exe
  2⤵
  PID:6292
- C:\Windows\System\hYYBvSy.exe
  C:\Windows\System\hYYBvSy.exe
  2⤵
  PID:6316
- C:\Windows\System\bYGoXZa.exe
  C:\Windows\System\bYGoXZa.exe
  2⤵
  PID:6332
- C:\Windows\System\SgqklZH.exe
  C:\Windows\System\SgqklZH.exe
  2⤵
  PID:6356
- C:\Windows\System\qgribVO.exe
  C:\Windows\System\qgribVO.exe
  2⤵
  PID:6376
- C:\Windows\System\PfAsUEW.exe
  C:\Windows\System\PfAsUEW.exe
  2⤵
  PID:6396
- C:\Windows\System\dYUCFGG.exe
  C:\Windows\System\dYUCFGG.exe
  2⤵
  PID:6416
- C:\Windows\System\qKnjieN.exe
  C:\Windows\System\qKnjieN.exe
  2⤵
  PID:6436
- C:\Windows\System\ZhNoEyX.exe
  C:\Windows\System\ZhNoEyX.exe
  2⤵
  PID:6452
- C:\Windows\System\PbWjtvJ.exe
  C:\Windows\System\PbWjtvJ.exe
  2⤵
  PID:6472
- C:\Windows\System\UHnydDT.exe
  C:\Windows\System\UHnydDT.exe
  2⤵
  PID:6488
- C:\Windows\System\qzZRLmg.exe
  C:\Windows\System\qzZRLmg.exe
  2⤵
  PID:6512
- C:\Windows\System\OaECGDu.exe
  C:\Windows\System\OaECGDu.exe
  2⤵
  PID:6528
- C:\Windows\System\mYbjvEc.exe
  C:\Windows\System\mYbjvEc.exe
  2⤵
  PID:6556
- C:\Windows\System\OCkLYMX.exe
  C:\Windows\System\OCkLYMX.exe
  2⤵
  PID:6572
- C:\Windows\System\pXiPfSA.exe
  C:\Windows\System\pXiPfSA.exe
  2⤵
  PID:6592
- C:\Windows\System\mSHyIXc.exe
  C:\Windows\System\mSHyIXc.exe
  2⤵
  PID:6612
- C:\Windows\System\BhfzCzB.exe
  C:\Windows\System\BhfzCzB.exe
  2⤵
  PID:6628
- C:\Windows\System\aptfJEf.exe
  C:\Windows\System\aptfJEf.exe
  2⤵
  PID:6652
- C:\Windows\System\qBqGQlz.exe
  C:\Windows\System\qBqGQlz.exe
  2⤵
  PID:6668
- C:\Windows\System\vUIFaAM.exe
  C:\Windows\System\vUIFaAM.exe
  2⤵
  PID:6692
- C:\Windows\System\WIkFwUN.exe
  C:\Windows\System\WIkFwUN.exe
  2⤵
  PID:6708
- C:\Windows\System\PTtVGUw.exe
  C:\Windows\System\PTtVGUw.exe
  2⤵
  PID:6732
- C:\Windows\System\MFglSVX.exe
  C:\Windows\System\MFglSVX.exe
  2⤵
  PID:6756
- C:\Windows\System\fHgxaCR.exe
  C:\Windows\System\fHgxaCR.exe
  2⤵
  PID:6772
- C:\Windows\System\QENwVoy.exe
  C:\Windows\System\QENwVoy.exe
  2⤵
  PID:6792
- C:\Windows\System\KLcIxcX.exe
  C:\Windows\System\KLcIxcX.exe
  2⤵
  PID:6820
- C:\Windows\System\kNMFxQq.exe
  C:\Windows\System\kNMFxQq.exe
  2⤵
  PID:6860
- C:\Windows\System\cPMTpVa.exe
  C:\Windows\System\cPMTpVa.exe
  2⤵
  PID:6888
- C:\Windows\System\qIGsPuY.exe
  C:\Windows\System\qIGsPuY.exe
  2⤵
  PID:6904
- C:\Windows\System\bwXShoY.exe
  C:\Windows\System\bwXShoY.exe
  2⤵
  PID:6920
- C:\Windows\System\TzkMyIj.exe
  C:\Windows\System\TzkMyIj.exe
  2⤵
  PID:6944
- C:\Windows\System\KcdqprA.exe
  C:\Windows\System\KcdqprA.exe
  2⤵
  PID:6968
- C:\Windows\System\cXgyzHV.exe
  C:\Windows\System\cXgyzHV.exe
  2⤵
  PID:6988
- C:\Windows\System\zIKfewv.exe
  C:\Windows\System\zIKfewv.exe
  2⤵
  PID:7012
- C:\Windows\System\ruBNbdR.exe
  C:\Windows\System\ruBNbdR.exe
  2⤵
  PID:7028
- C:\Windows\System\UryQsPF.exe
  C:\Windows\System\UryQsPF.exe
  2⤵
  PID:7044
- C:\Windows\System\gYgUDzF.exe
  C:\Windows\System\gYgUDzF.exe
  2⤵
  PID:7068
- C:\Windows\System\uoyLFoU.exe
  C:\Windows\System\uoyLFoU.exe
  2⤵
  PID:7084
- C:\Windows\System\cBrqMNN.exe
  C:\Windows\System\cBrqMNN.exe
  2⤵
  PID:7108
- C:\Windows\System\cvJdzfD.exe
  C:\Windows\System\cvJdzfD.exe
  2⤵
  PID:7124
- C:\Windows\System\EXTbSLq.exe
  C:\Windows\System\EXTbSLq.exe
  2⤵
  PID:7148
- C:\Windows\System\BNlXtiP.exe
  C:\Windows\System\BNlXtiP.exe
  2⤵
  PID:7164
- C:\Windows\System\KMQPCPE.exe
  C:\Windows\System\KMQPCPE.exe
  2⤵
  PID:248
- C:\Windows\System\IuvNfXB.exe
  C:\Windows\System\IuvNfXB.exe
  2⤵
  PID:1592
- C:\Windows\System\qKtHHrA.exe
  C:\Windows\System\qKtHHrA.exe
  2⤵
  PID:5152
- C:\Windows\System\HhFnyoq.exe
  C:\Windows\System\HhFnyoq.exe
  2⤵
  PID:5192
- C:\Windows\System\IelJGBI.exe
  C:\Windows\System\IelJGBI.exe
  2⤵
  PID:5288
- C:\Windows\System\OnQcGhX.exe
  C:\Windows\System\OnQcGhX.exe
  2⤵
  PID:5324
- C:\Windows\System\gjIMBZm.exe
  C:\Windows\System\gjIMBZm.exe
  2⤵
  PID:5364
- C:\Windows\System\IWfkhfw.exe
  C:\Windows\System\IWfkhfw.exe
  2⤵
  PID:5404
- C:\Windows\System\oWzEaxn.exe
  C:\Windows\System\oWzEaxn.exe
  2⤵
  PID:7184
- C:\Windows\System\wpUJyRR.exe
  C:\Windows\System\wpUJyRR.exe
  2⤵
  PID:7200
- C:\Windows\System\DfgtvGx.exe
  C:\Windows\System\DfgtvGx.exe
  2⤵
  PID:7224
- C:\Windows\System\xybQTMU.exe
  C:\Windows\System\xybQTMU.exe
  2⤵
  PID:7248
- C:\Windows\System\hPxNIaa.exe
  C:\Windows\System\hPxNIaa.exe
  2⤵
  PID:7268
- C:\Windows\System\BfOnYDc.exe
  C:\Windows\System\BfOnYDc.exe
  2⤵
  PID:7288
- C:\Windows\System\PdOFwqg.exe
  C:\Windows\System\PdOFwqg.exe
  2⤵
  PID:7308
- C:\Windows\System\qNiiyaw.exe
  C:\Windows\System\qNiiyaw.exe
  2⤵
  PID:7336
- C:\Windows\System\LgyAuWO.exe
  C:\Windows\System\LgyAuWO.exe
  2⤵
  PID:7360
- C:\Windows\System\vTbVSev.exe
  C:\Windows\System\vTbVSev.exe
  2⤵
  PID:7376
- C:\Windows\System\EGGfEze.exe
  C:\Windows\System\EGGfEze.exe
  2⤵
  PID:7432
- C:\Windows\System\BIYiOod.exe
  C:\Windows\System\BIYiOod.exe
  2⤵
  PID:7452
- C:\Windows\System\aukrULN.exe
  C:\Windows\System\aukrULN.exe
  2⤵
  PID:7468
- C:\Windows\System\PejVwiK.exe
  C:\Windows\System\PejVwiK.exe
  2⤵
  PID:7488
- C:\Windows\System\oFMEuIZ.exe
  C:\Windows\System\oFMEuIZ.exe
  2⤵
  PID:7520
- C:\Windows\System\VtCJNtm.exe
  C:\Windows\System\VtCJNtm.exe
  2⤵
  PID:7544
- C:\Windows\System\ioGOCJH.exe
  C:\Windows\System\ioGOCJH.exe
  2⤵
  PID:7568
- C:\Windows\System\BecLzed.exe
  C:\Windows\System\BecLzed.exe
  2⤵
  PID:7592
- C:\Windows\System\TJpRDmn.exe
  C:\Windows\System\TJpRDmn.exe
  2⤵
  PID:7612
- C:\Windows\System\kCNrddp.exe
  C:\Windows\System\kCNrddp.exe
  2⤵
  PID:7644
- C:\Windows\System\ZTgVwjm.exe
  C:\Windows\System\ZTgVwjm.exe
  2⤵
  PID:7664
- C:\Windows\System\vmbhlmf.exe
  C:\Windows\System\vmbhlmf.exe
  2⤵
  PID:7688
- C:\Windows\System\vhGyzsR.exe
  C:\Windows\System\vhGyzsR.exe
  2⤵
  PID:7704
- C:\Windows\System\mGGEThr.exe
  C:\Windows\System\mGGEThr.exe
  2⤵
  PID:7732
- C:\Windows\System\gHDtYAX.exe
  C:\Windows\System\gHDtYAX.exe
  2⤵
  PID:5552
- C:\Windows\System\AmsJILp.exe
  C:\Windows\System\AmsJILp.exe
  2⤵
  PID:5600
- C:\Windows\System\eAySpTg.exe
  C:\Windows\System\eAySpTg.exe
  2⤵
  PID:5640
- C:\Windows\System\cJdqPDT.exe
  C:\Windows\System\cJdqPDT.exe
  2⤵
  PID:5692
- C:\Windows\System\qJhBSuU.exe
  C:\Windows\System\qJhBSuU.exe
  2⤵
  PID:5768
- C:\Windows\System\GlctHqc.exe
  C:\Windows\System\GlctHqc.exe
  2⤵
  PID:5724
- C:\Windows\System\uPDdSOL.exe
  C:\Windows\System\uPDdSOL.exe
  2⤵
  PID:4836
- C:\Windows\System\VJuEOcw.exe
  C:\Windows\System\VJuEOcw.exe
  2⤵
  PID:6228
- C:\Windows\System\MAeRwMp.exe
  C:\Windows\System\MAeRwMp.exe
  2⤵
  PID:6268
- C:\Windows\System\DDxQWtN.exe
  C:\Windows\System\DDxQWtN.exe
  2⤵
  PID:6312
- C:\Windows\System\ZLfIFfa.exe
  C:\Windows\System\ZLfIFfa.exe
  2⤵
  PID:6432
- C:\Windows\System\LSYtFdM.exe
  C:\Windows\System\LSYtFdM.exe
  2⤵
  PID:6464
- C:\Windows\System\dLSiJsL.exe
  C:\Windows\System\dLSiJsL.exe
  2⤵
  PID:6520
- C:\Windows\System\eidpina.exe
  C:\Windows\System\eidpina.exe
  2⤵
  PID:6540
- C:\Windows\System\PBinRwP.exe
  C:\Windows\System\PBinRwP.exe
  2⤵
  PID:6784
- C:\Windows\System\cYwmcYc.exe
  C:\Windows\System\cYwmcYc.exe
  2⤵
  PID:5828
- C:\Windows\System\iPBIRdn.exe
  C:\Windows\System\iPBIRdn.exe
  2⤵
  PID:5784
- C:\Windows\System\tFArwTg.exe
  C:\Windows\System\tFArwTg.exe
  2⤵
  PID:5876
- C:\Windows\System\kCFGFjC.exe
  C:\Windows\System\kCFGFjC.exe
  2⤵
  PID:7036
- C:\Windows\System\WfCTugy.exe
  C:\Windows\System\WfCTugy.exe
  2⤵
  PID:5896
- C:\Windows\System\JNaKhpJ.exe
  C:\Windows\System\JNaKhpJ.exe
  2⤵
  PID:5272
- C:\Windows\System\kJihEZb.exe
  C:\Windows\System\kJihEZb.exe
  2⤵
  PID:5948
- C:\Windows\System\JwXYRWv.exe
  C:\Windows\System\JwXYRWv.exe
  2⤵
  PID:6008
- C:\Windows\System\EhNzoOL.exe
  C:\Windows\System\EhNzoOL.exe
  2⤵
  PID:6056
- C:\Windows\System\BeHhCqE.exe
  C:\Windows\System\BeHhCqE.exe
  2⤵
  PID:6108
- C:\Windows\System\nAlrZDW.exe
  C:\Windows\System\nAlrZDW.exe
  2⤵
  PID:6388
- C:\Windows\System\ddEOYWw.exe
  C:\Windows\System\ddEOYWw.exe
  2⤵
  PID:3284
- C:\Windows\System\VSjExuk.exe
  C:\Windows\System\VSjExuk.exe
  2⤵
  PID:1688
- C:\Windows\System\aaDrFXq.exe
  C:\Windows\System\aaDrFXq.exe
  2⤵
  PID:4900
- C:\Windows\System\iSrGxFT.exe
  C:\Windows\System\iSrGxFT.exe
  2⤵
  PID:992
- C:\Windows\System\okgrarA.exe
  C:\Windows\System\okgrarA.exe
  2⤵
  PID:5204
- C:\Windows\System\geByAbl.exe
  C:\Windows\System\geByAbl.exe
  2⤵
  PID:564
- C:\Windows\System\LyCSrJR.exe
  C:\Windows\System\LyCSrJR.exe
  2⤵
  PID:3444
- C:\Windows\System\dTOewhQ.exe
  C:\Windows\System\dTOewhQ.exe
  2⤵
  PID:4416
- C:\Windows\System\inBeeAF.exe
  C:\Windows\System\inBeeAF.exe
  2⤵
  PID:3952
- C:\Windows\System\juosnna.exe
  C:\Windows\System\juosnna.exe
  2⤵
  PID:6148
- C:\Windows\System\iiNHXgm.exe
  C:\Windows\System\iiNHXgm.exe
  2⤵
  PID:6340
- C:\Windows\System\cNnJvRe.exe
  C:\Windows\System\cNnJvRe.exe
  2⤵
  PID:6364
- C:\Windows\System\bSMEUZg.exe
  C:\Windows\System\bSMEUZg.exe
  2⤵
  PID:6584
- C:\Windows\System\BGsYREh.exe
  C:\Windows\System\BGsYREh.exe
  2⤵
  PID:6636
- C:\Windows\System\YQREiJI.exe
  C:\Windows\System\YQREiJI.exe
  2⤵
  PID:6676
- C:\Windows\System\QeCpCyM.exe
  C:\Windows\System\QeCpCyM.exe
  2⤵
  PID:6724
- C:\Windows\System\wMeheiB.exe
  C:\Windows\System\wMeheiB.exe
  2⤵
  PID:6748
- C:\Windows\System\sXPcCnV.exe
  C:\Windows\System\sXPcCnV.exe
  2⤵
  PID:6808
- C:\Windows\System\JOiISWd.exe
  C:\Windows\System\JOiISWd.exe
  2⤵
  PID:6836
- C:\Windows\System\kLzvpqS.exe
  C:\Windows\System\kLzvpqS.exe
  2⤵
  PID:6900
- C:\Windows\System\zcwQOFi.exe
  C:\Windows\System\zcwQOFi.exe
  2⤵
  PID:6940
- C:\Windows\System\EtPEHpX.exe
  C:\Windows\System\EtPEHpX.exe
  2⤵
  PID:6976
- C:\Windows\System\pYzWOxA.exe
  C:\Windows\System\pYzWOxA.exe
  2⤵
  PID:7104
- C:\Windows\System\uwDZsGh.exe
  C:\Windows\System\uwDZsGh.exe
  2⤵
  PID:7156
- C:\Windows\System\BRMUGyA.exe
  C:\Windows\System\BRMUGyA.exe
  2⤵
  PID:3840
- C:\Windows\System\JiJxyMR.exe
  C:\Windows\System\JiJxyMR.exe
  2⤵
  PID:5176
- C:\Windows\System\dLDuJjZ.exe
  C:\Windows\System\dLDuJjZ.exe
  2⤵
  PID:5312
- C:\Windows\System\nPSmdgv.exe
  C:\Windows\System\nPSmdgv.exe
  2⤵
  PID:7180
- C:\Windows\System\wzaFggQ.exe
  C:\Windows\System\wzaFggQ.exe
  2⤵
  PID:7212
- C:\Windows\System\oWzzSIe.exe
  C:\Windows\System\oWzzSIe.exe
  2⤵
  PID:7264
- C:\Windows\System\aPewzOF.exe
  C:\Windows\System\aPewzOF.exe
  2⤵
  PID:7304
- C:\Windows\System\JJIztRR.exe
  C:\Windows\System\JJIztRR.exe
  2⤵
  PID:7356
- C:\Windows\System\mdzlehW.exe
  C:\Windows\System\mdzlehW.exe
  2⤵
  PID:7392
- C:\Windows\System\DSRxWdO.exe
  C:\Windows\System\DSRxWdO.exe
  2⤵
  PID:7448
- C:\Windows\System\dYowgfO.exe
  C:\Windows\System\dYowgfO.exe
  2⤵
  PID:7484
- C:\Windows\System\UqBujdw.exe
  C:\Windows\System\UqBujdw.exe
  2⤵
  PID:7540
- C:\Windows\System\QBbGZQS.exe
  C:\Windows\System\QBbGZQS.exe
  2⤵
  PID:7604
- C:\Windows\System\KWrwAYs.exe
  C:\Windows\System\KWrwAYs.exe
  2⤵
  PID:7812
- C:\Windows\System\czxoSAp.exe
  C:\Windows\System\czxoSAp.exe
  2⤵
  PID:7872
- C:\Windows\System\PPHoVuc.exe
  C:\Windows\System\PPHoVuc.exe
  2⤵
  PID:7964
- C:\Windows\System\ijmpZmC.exe
  C:\Windows\System\ijmpZmC.exe
  2⤵
  PID:3664
- C:\Windows\System\aeDFjSq.exe
  C:\Windows\System\aeDFjSq.exe
  2⤵
  PID:8212
- C:\Windows\System\QrCQJIv.exe
  C:\Windows\System\QrCQJIv.exe
  2⤵
  PID:8228
- C:\Windows\System\pOFUSJm.exe
  C:\Windows\System\pOFUSJm.exe
  2⤵
  PID:8252
- C:\Windows\System\YHVoIsp.exe
  C:\Windows\System\YHVoIsp.exe
  2⤵
  PID:8276
- C:\Windows\System\YVqfSyJ.exe
  C:\Windows\System\YVqfSyJ.exe
  2⤵
  PID:8296
- C:\Windows\System\ZlWaSDN.exe
  C:\Windows\System\ZlWaSDN.exe
  2⤵
  PID:8324
- C:\Windows\System\QukcEMi.exe
  C:\Windows\System\QukcEMi.exe
  2⤵
  PID:8340
- C:\Windows\System\sgztijx.exe
  C:\Windows\System\sgztijx.exe
  2⤵
  PID:8360
- C:\Windows\System\pkbRabv.exe
  C:\Windows\System\pkbRabv.exe
  2⤵
  PID:8376
- C:\Windows\System\XBaEehK.exe
  C:\Windows\System\XBaEehK.exe
  2⤵
  PID:8400
- C:\Windows\System\XHOhMZB.exe
  C:\Windows\System\XHOhMZB.exe
  2⤵
  PID:8420
- C:\Windows\System\TaBrNqj.exe
  C:\Windows\System\TaBrNqj.exe
  2⤵
  PID:8440
- C:\Windows\System\LOntDvN.exe
  C:\Windows\System\LOntDvN.exe
  2⤵
  PID:8464
- C:\Windows\System\oAeSKme.exe
  C:\Windows\System\oAeSKme.exe
  2⤵
  PID:8496
- C:\Windows\System\SnTRqfb.exe
  C:\Windows\System\SnTRqfb.exe
  2⤵
  PID:8516
- C:\Windows\System\AuAjAsN.exe
  C:\Windows\System\AuAjAsN.exe
  2⤵
  PID:8532
- C:\Windows\System\DhFIcAJ.exe
  C:\Windows\System\DhFIcAJ.exe
  2⤵
  PID:8548
- C:\Windows\System\BDyTHcK.exe
  C:\Windows\System\BDyTHcK.exe
  2⤵
  PID:8564
- C:\Windows\System\xxzILbP.exe
  C:\Windows\System\xxzILbP.exe
  2⤵
  PID:8580
- C:\Windows\System\IyUnGDf.exe
  C:\Windows\System\IyUnGDf.exe
  2⤵
  PID:8596
- C:\Windows\System\duRsFeL.exe
  C:\Windows\System\duRsFeL.exe
  2⤵
  PID:8616
- C:\Windows\System\uMFAiGh.exe
  C:\Windows\System\uMFAiGh.exe
  2⤵
  PID:8632
- C:\Windows\System\rJePFaw.exe
  C:\Windows\System\rJePFaw.exe
  2⤵
  PID:8648
- C:\Windows\System\mpwQutm.exe
  C:\Windows\System\mpwQutm.exe
  2⤵
  PID:8688
- C:\Windows\System\OQjtjsW.exe
  C:\Windows\System\OQjtjsW.exe
  2⤵
  PID:8724
- C:\Windows\System\MUORBMD.exe
  C:\Windows\System\MUORBMD.exe
  2⤵
  PID:8752
- C:\Windows\System\yyNrcvh.exe
  C:\Windows\System\yyNrcvh.exe
  2⤵
  PID:8768
- C:\Windows\System\tWfEtmK.exe
  C:\Windows\System\tWfEtmK.exe
  2⤵
  PID:8800
- C:\Windows\System\coHCzWA.exe
  C:\Windows\System\coHCzWA.exe
  2⤵
  PID:8824
- C:\Windows\System\fWwtOyD.exe
  C:\Windows\System\fWwtOyD.exe
  2⤵
  PID:8844
- C:\Windows\System\rQLMhtz.exe
  C:\Windows\System\rQLMhtz.exe
  2⤵
  PID:8860
- C:\Windows\System\dTlpylw.exe
  C:\Windows\System\dTlpylw.exe
  2⤵
  PID:8888
- C:\Windows\System\SrAZiTQ.exe
  C:\Windows\System\SrAZiTQ.exe
  2⤵
  PID:8904
- C:\Windows\System\ZmTjfSH.exe
  C:\Windows\System\ZmTjfSH.exe
  2⤵
  PID:8928
- C:\Windows\System\MxviJFv.exe
  C:\Windows\System\MxviJFv.exe
  2⤵
  PID:8944
- C:\Windows\System\ABdGSFC.exe
  C:\Windows\System\ABdGSFC.exe
  2⤵
  PID:8968
- C:\Windows\System\zHDZlAe.exe
  C:\Windows\System\zHDZlAe.exe
  2⤵
  PID:8988
- C:\Windows\System\HMjQqNc.exe
  C:\Windows\System\HMjQqNc.exe
  2⤵
  PID:9004
- C:\Windows\System\GLjmmhY.exe
  C:\Windows\System\GLjmmhY.exe
  2⤵
  PID:9044
- C:\Windows\System\xhUdmLz.exe
  C:\Windows\System\xhUdmLz.exe
  2⤵
  PID:9064
- C:\Windows\System\vqCMXwl.exe
  C:\Windows\System\vqCMXwl.exe
  2⤵
  PID:9084
- C:\Windows\System\OdRZXYh.exe
  C:\Windows\System\OdRZXYh.exe
  2⤵
  PID:9100
- C:\Windows\System\hCEXXOO.exe
  C:\Windows\System\hCEXXOO.exe
  2⤵
  PID:9120
- C:\Windows\System\PrltDrF.exe
  C:\Windows\System\PrltDrF.exe
  2⤵
  PID:9136
- C:\Windows\System\klrhzPm.exe
  C:\Windows\System\klrhzPm.exe
  2⤵
  PID:9164
- C:\Windows\System\GKAsIRI.exe
  C:\Windows\System\GKAsIRI.exe
  2⤵
  PID:9180
- C:\Windows\System\GbxapgI.exe
  C:\Windows\System\GbxapgI.exe
  2⤵
  PID:9208
- C:\Windows\System\lSrqmpg.exe
  C:\Windows\System\lSrqmpg.exe
  2⤵
  PID:5572
- C:\Windows\System\EbzjaNs.exe
  C:\Windows\System\EbzjaNs.exe
  2⤵
  PID:5660
- C:\Windows\System\ZPIIlaB.exe
  C:\Windows\System\ZPIIlaB.exe
  2⤵
  PID:6300
- C:\Windows\System\dyJPDvi.exe
  C:\Windows\System\dyJPDvi.exe
  2⤵
  PID:3668
- C:\Windows\System\FeZfNjj.exe
  C:\Windows\System\FeZfNjj.exe
  2⤵
  PID:5924
- C:\Windows\System\kDrnbRm.exe
  C:\Windows\System\kDrnbRm.exe
  2⤵
  PID:6272
- C:\Windows\System\hseeiHF.exe
  C:\Windows\System\hseeiHF.exe
  2⤵
  PID:5148
- C:\Windows\System\uRKUXqM.exe
  C:\Windows\System\uRKUXqM.exe
  2⤵
  PID:2936
- C:\Windows\System\ssxsHtX.exe
  C:\Windows\System\ssxsHtX.exe
  2⤵
  PID:9228
- C:\Windows\System\oYWiAiM.exe
  C:\Windows\System\oYWiAiM.exe
  2⤵
  PID:9252
- C:\Windows\System\yCNCUJL.exe
  C:\Windows\System\yCNCUJL.exe
  2⤵
  PID:9272
- C:\Windows\System\EIjyGib.exe
  C:\Windows\System\EIjyGib.exe
  2⤵
  PID:9296
- C:\Windows\System\dxHImqi.exe
  C:\Windows\System\dxHImqi.exe
  2⤵
  PID:9320
- C:\Windows\System\GqaFETV.exe
  C:\Windows\System\GqaFETV.exe
  2⤵
  PID:9340
- C:\Windows\System\Iknvhgg.exe
  C:\Windows\System\Iknvhgg.exe
  2⤵
  PID:9360
- C:\Windows\System\bIbupAM.exe
  C:\Windows\System\bIbupAM.exe
  2⤵
  PID:9380
- C:\Windows\System\JohflWa.exe
  C:\Windows\System\JohflWa.exe
  2⤵
  PID:9400
- C:\Windows\System\nNgzwCz.exe
  C:\Windows\System\nNgzwCz.exe
  2⤵
  PID:9420
- C:\Windows\System\gqRZGeD.exe
  C:\Windows\System\gqRZGeD.exe
  2⤵
  PID:9440
- C:\Windows\System\gOrXTiK.exe
  C:\Windows\System\gOrXTiK.exe
  2⤵
  PID:9460
- C:\Windows\System\XmSAKoH.exe
  C:\Windows\System\XmSAKoH.exe
  2⤵
  PID:9488
- C:\Windows\System\daAbZge.exe
  C:\Windows\System\daAbZge.exe
  2⤵
  PID:9504
- C:\Windows\System\epuQhMY.exe
  C:\Windows\System\epuQhMY.exe
  2⤵
  PID:9524
- C:\Windows\System\Cadnljc.exe
  C:\Windows\System\Cadnljc.exe
  2⤵
  PID:9548
- C:\Windows\System\uEvXlsr.exe
  C:\Windows\System\uEvXlsr.exe
  2⤵
  PID:9568
- C:\Windows\System\MUrtLOX.exe
  C:\Windows\System\MUrtLOX.exe
  2⤵
  PID:9592
- C:\Windows\System\agQXLdy.exe
  C:\Windows\System\agQXLdy.exe
  2⤵
  PID:9616
- C:\Windows\System\wPDUCve.exe
  C:\Windows\System\wPDUCve.exe
  2⤵
  PID:9636
- C:\Windows\System\UgCUkfb.exe
  C:\Windows\System\UgCUkfb.exe
  2⤵
  PID:9656
- C:\Windows\System\fRTyxoC.exe
  C:\Windows\System\fRTyxoC.exe
  2⤵
  PID:9680
- C:\Windows\System\VQEHxdf.exe
  C:\Windows\System\VQEHxdf.exe
  2⤵
  PID:9700
- C:\Windows\System\lJclvrx.exe
  C:\Windows\System\lJclvrx.exe
  2⤵
  PID:9724
- C:\Windows\System\jpyUImq.exe
  C:\Windows\System\jpyUImq.exe
  2⤵
  PID:9740
- C:\Windows\System\YZxgTRm.exe
  C:\Windows\System\YZxgTRm.exe
  2⤵
  PID:9764
- C:\Windows\System\iCJpNmw.exe
  C:\Windows\System\iCJpNmw.exe
  2⤵
  PID:9792
- C:\Windows\System\ZPArVjd.exe
  C:\Windows\System\ZPArVjd.exe
  2⤵
  PID:9812
- C:\Windows\System\LtTgbvu.exe
  C:\Windows\System\LtTgbvu.exe
  2⤵
  PID:9836
- C:\Windows\System\QEQHAFH.exe
  C:\Windows\System\QEQHAFH.exe
  2⤵
  PID:9856
- C:\Windows\System\OYPwPMg.exe
  C:\Windows\System\OYPwPMg.exe
  2⤵
  PID:9888
- C:\Windows\System\VXUBAet.exe
  C:\Windows\System\VXUBAet.exe
  2⤵
  PID:9904
- C:\Windows\System\hrQBZxC.exe
  C:\Windows\System\hrQBZxC.exe
  2⤵
  PID:9932
- C:\Windows\System\jUIKZbS.exe
  C:\Windows\System\jUIKZbS.exe
  2⤵
  PID:9952
- C:\Windows\System\MCWBNUY.exe
  C:\Windows\System\MCWBNUY.exe
  2⤵
  PID:9976
- C:\Windows\System\KGfHQue.exe
  C:\Windows\System\KGfHQue.exe
  2⤵
  PID:9996
- C:\Windows\System\IksnwgJ.exe
  C:\Windows\System\IksnwgJ.exe
  2⤵
  PID:10016
- C:\Windows\System\ljvZIAf.exe
  C:\Windows\System\ljvZIAf.exe
  2⤵
  PID:10040
- C:\Windows\System\DBWUtVQ.exe
  C:\Windows\System\DBWUtVQ.exe
  2⤵
  PID:10064
- C:\Windows\System\lxfBNAO.exe
  C:\Windows\System\lxfBNAO.exe
  2⤵
  PID:10080
- C:\Windows\System\UWsvPrp.exe
  C:\Windows\System\UWsvPrp.exe
  2⤵
  PID:10104
- C:\Windows\System\RmzNVvP.exe
  C:\Windows\System\RmzNVvP.exe
  2⤵
  PID:10124
- C:\Windows\System\lTjVCrZ.exe
  C:\Windows\System\lTjVCrZ.exe
  2⤵
  PID:10140
- C:\Windows\System\YIeaYlK.exe
  C:\Windows\System\YIeaYlK.exe
  2⤵
  PID:10156
- C:\Windows\System\KhkGIOo.exe
  C:\Windows\System\KhkGIOo.exe
  2⤵
  PID:10172
- C:\Windows\System\agEMUSv.exe
  C:\Windows\System\agEMUSv.exe
  2⤵
  PID:10188
- C:\Windows\System\lTZHwZh.exe
  C:\Windows\System\lTZHwZh.exe
  2⤵
  PID:10212
- C:\Windows\System\JxlGxOH.exe
  C:\Windows\System\JxlGxOH.exe
  2⤵
  PID:10232
- C:\Windows\System\sguMIAo.exe
  C:\Windows\System\sguMIAo.exe
  2⤵
  PID:6700
- C:\Windows\System\MDOEBRu.exe
  C:\Windows\System\MDOEBRu.exe
  2⤵
  PID:6928
- C:\Windows\System\MoqDLuV.exe
  C:\Windows\System\MoqDLuV.exe
  2⤵
  PID:7144
- C:\Windows\System\FbFOevQ.exe
  C:\Windows\System\FbFOevQ.exe
  2⤵
  PID:7628
- C:\Windows\System\RwLAPzz.exe
  C:\Windows\System\RwLAPzz.exe
  2⤵
  PID:2820
- C:\Windows\System\UGAyHnd.exe
  C:\Windows\System\UGAyHnd.exe
  2⤵
  PID:8260
- C:\Windows\System\XmNNzxi.exe
  C:\Windows\System\XmNNzxi.exe
  2⤵
  PID:8332
- C:\Windows\System\TmBkOcm.exe
  C:\Windows\System\TmBkOcm.exe
  2⤵
  PID:8460
- C:\Windows\System\UiunqyL.exe
  C:\Windows\System\UiunqyL.exe
  2⤵
  PID:10256
- C:\Windows\System\KzgiAyU.exe
  C:\Windows\System\KzgiAyU.exe
  2⤵
  PID:10272
- C:\Windows\System\jtwjvrU.exe
  C:\Windows\System\jtwjvrU.exe
  2⤵
  PID:10296
- C:\Windows\System\nYMPXDM.exe
  C:\Windows\System\nYMPXDM.exe
  2⤵
  PID:10320
- C:\Windows\System\bBHXpEy.exe
  C:\Windows\System\bBHXpEy.exe
  2⤵
  PID:10336
- C:\Windows\System\qyINWFi.exe
  C:\Windows\System\qyINWFi.exe
  2⤵
  PID:10360
- C:\Windows\System\jYqrqhf.exe
  C:\Windows\System\jYqrqhf.exe
  2⤵
  PID:10476
- C:\Windows\System\cBausek.exe
  C:\Windows\System\cBausek.exe
  2⤵
  PID:10492
- C:\Windows\System\RuPnYtC.exe
  C:\Windows\System\RuPnYtC.exe
  2⤵
  PID:10508
- C:\Windows\System\YWaanPF.exe
  C:\Windows\System\YWaanPF.exe
  2⤵
  PID:10524
- C:\Windows\System\FZJZvyk.exe
  C:\Windows\System\FZJZvyk.exe
  2⤵
  PID:10540
- C:\Windows\System\btdurDF.exe
  C:\Windows\System\btdurDF.exe
  2⤵
  PID:10556
- C:\Windows\System\QJtYaLL.exe
  C:\Windows\System\QJtYaLL.exe
  2⤵
  PID:10572
- C:\Windows\System\sfDAHgy.exe
  C:\Windows\System\sfDAHgy.exe
  2⤵
  PID:10592
- C:\Windows\System\HlRhKwO.exe
  C:\Windows\System\HlRhKwO.exe
  2⤵
  PID:10608
- C:\Windows\System\lOqJJlD.exe
  C:\Windows\System\lOqJJlD.exe
  2⤵
  PID:10632
- C:\Windows\System\rEpBDuk.exe
  C:\Windows\System\rEpBDuk.exe
  2⤵
  PID:10660
- C:\Windows\System\bAxiyyq.exe
  C:\Windows\System\bAxiyyq.exe
  2⤵
  PID:10676
- C:\Windows\System\wWyPveP.exe
  C:\Windows\System\wWyPveP.exe
  2⤵
  PID:10696
- C:\Windows\System\tsIJdXo.exe
  C:\Windows\System\tsIJdXo.exe
  2⤵
  PID:10716
- C:\Windows\System\DDUmjrh.exe
  C:\Windows\System\DDUmjrh.exe
  2⤵
  PID:10740
- C:\Windows\System\KfpVATM.exe
  C:\Windows\System\KfpVATM.exe
  2⤵
  PID:10760
- C:\Windows\System\uXWJKRI.exe
  C:\Windows\System\uXWJKRI.exe
  2⤵
  PID:10780
- C:\Windows\System\qeBzywW.exe
  C:\Windows\System\qeBzywW.exe
  2⤵
  PID:10800
- C:\Windows\System\fKzQJlm.exe
  C:\Windows\System\fKzQJlm.exe
  2⤵
  PID:10820
- C:\Windows\System\ZzjEVtp.exe
  C:\Windows\System\ZzjEVtp.exe
  2⤵
  PID:10844
- C:\Windows\System\vIslWXb.exe
  C:\Windows\System\vIslWXb.exe
  2⤵
  PID:10864
- C:\Windows\System\wBETSuh.exe
  C:\Windows\System\wBETSuh.exe
  2⤵
  PID:10884
- C:\Windows\System\yvmzqfU.exe
  C:\Windows\System\yvmzqfU.exe
  2⤵
  PID:10904
- C:\Windows\System\gAyBtQr.exe
  C:\Windows\System\gAyBtQr.exe
  2⤵
  PID:10928
- C:\Windows\System\YyxFEPS.exe
  C:\Windows\System\YyxFEPS.exe
  2⤵
  PID:10948
- C:\Windows\System\NsjrvND.exe
  C:\Windows\System\NsjrvND.exe
  2⤵
  PID:10968
- C:\Windows\System\qLVVtpy.exe
  C:\Windows\System\qLVVtpy.exe
  2⤵
  PID:10988
- C:\Windows\System\gkMsDPq.exe
  C:\Windows\System\gkMsDPq.exe
  2⤵
  PID:11008
- C:\Windows\System\EyudVTq.exe
  C:\Windows\System\EyudVTq.exe
  2⤵
  PID:11032
- C:\Windows\System\EAqpPna.exe
  C:\Windows\System\EAqpPna.exe
  2⤵
  PID:11048
- C:\Windows\System\EpvfniF.exe
  C:\Windows\System\EpvfniF.exe
  2⤵
  PID:11068
- C:\Windows\System\UHMALeD.exe
  C:\Windows\System\UHMALeD.exe
  2⤵
  PID:11088
- C:\Windows\System\WbtXeOd.exe
  C:\Windows\System\WbtXeOd.exe
  2⤵
  PID:11108
- C:\Windows\System\QCBwuen.exe
  C:\Windows\System\QCBwuen.exe
  2⤵
  PID:11132
- C:\Windows\System\QlYORRp.exe
  C:\Windows\System\QlYORRp.exe
  2⤵
  PID:11148
- C:\Windows\System\rqxqFaA.exe
  C:\Windows\System\rqxqFaA.exe
  2⤵
  PID:11172
- C:\Windows\System\dxtnvWt.exe
  C:\Windows\System\dxtnvWt.exe
  2⤵
  PID:11192
- C:\Windows\System\BIZPhdI.exe
  C:\Windows\System\BIZPhdI.exe
  2⤵
  PID:11208
- C:\Windows\System\DvjUmIr.exe
  C:\Windows\System\DvjUmIr.exe
  2⤵
  PID:11228
- C:\Windows\System\PLJNtky.exe
  C:\Windows\System\PLJNtky.exe
  2⤵
  PID:11252
- C:\Windows\System\FPRimEG.exe
  C:\Windows\System\FPRimEG.exe
  2⤵
  PID:3860
- C:\Windows\System\yMgyMyy.exe
  C:\Windows\System\yMgyMyy.exe
  2⤵
  PID:7696
- C:\Windows\System\hLchJyA.exe
  C:\Windows\System\hLchJyA.exe
  2⤵
  PID:5668
- C:\Windows\System\ejThqgN.exe
  C:\Windows\System\ejThqgN.exe
  2⤵
  PID:6448
- C:\Windows\System\mFZMsiP.exe
  C:\Windows\System\mFZMsiP.exe
  2⤵
  PID:5872
- C:\Windows\System\PGJiRKT.exe
  C:\Windows\System\PGJiRKT.exe
  2⤵
  PID:9092
- C:\Windows\System\FaincfW.exe
  C:\Windows\System\FaincfW.exe
  2⤵
  PID:6036
- C:\Windows\System\eVTFRzE.exe
  C:\Windows\System\eVTFRzE.exe
  2⤵
  PID:6220
- C:\Windows\System\bJbqLbZ.exe
  C:\Windows\System\bJbqLbZ.exe
  2⤵
  PID:7756
- C:\Windows\System\xMSWLjv.exe
  C:\Windows\System\xMSWLjv.exe
  2⤵
  PID:5932
- C:\Windows\System\fOIjSlj.exe
  C:\Windows\System\fOIjSlj.exe
  2⤵
  PID:1020
- C:\Windows\System\RrGfUTa.exe
  C:\Windows\System\RrGfUTa.exe
  2⤵
  PID:9244
- C:\Windows\System\foVfidm.exe
  C:\Windows\System\foVfidm.exe
  2⤵
  PID:6620
- C:\Windows\System\JPvEjpk.exe
  C:\Windows\System\JPvEjpk.exe
  2⤵
  PID:11268
- C:\Windows\System\kxzILCS.exe
  C:\Windows\System\kxzILCS.exe
  2⤵
  PID:11292
- C:\Windows\System\GUwmBOA.exe
  C:\Windows\System\GUwmBOA.exe
  2⤵
  PID:11312
- C:\Windows\System\iiDmnnS.exe
  C:\Windows\System\iiDmnnS.exe
  2⤵
  PID:11332
- C:\Windows\System\ylrJWwl.exe
  C:\Windows\System\ylrJWwl.exe
  2⤵
  PID:11348
- C:\Windows\System\OFJAvrY.exe
  C:\Windows\System\OFJAvrY.exe
  2⤵
  PID:11364
- C:\Windows\System\UdegzEr.exe
  C:\Windows\System\UdegzEr.exe
  2⤵
  PID:11388
- C:\Windows\System\NqGztTk.exe
  C:\Windows\System\NqGztTk.exe
  2⤵
  PID:11408
- C:\Windows\System\PgMrkbz.exe
  C:\Windows\System\PgMrkbz.exe
  2⤵
  PID:11428
- C:\Windows\System\yhXsIYS.exe
  C:\Windows\System\yhXsIYS.exe
  2⤵
  PID:11452
- C:\Windows\System\okgIpgy.exe
  C:\Windows\System\okgIpgy.exe
  2⤵
  PID:11472
- C:\Windows\System\MWuMnTT.exe
  C:\Windows\System\MWuMnTT.exe
  2⤵
  PID:11492
- C:\Windows\System\HaweIVo.exe
  C:\Windows\System\HaweIVo.exe
  2⤵
  PID:11508
- C:\Windows\System\WHKyTmz.exe
  C:\Windows\System\WHKyTmz.exe
  2⤵
  PID:11528
- C:\Windows\System\cGzSfNQ.exe
  C:\Windows\System\cGzSfNQ.exe
  2⤵
  PID:11556
- C:\Windows\System\koOZhFu.exe
  C:\Windows\System\koOZhFu.exe
  2⤵
  PID:11572
- C:\Windows\System\WsIuxcU.exe
  C:\Windows\System\WsIuxcU.exe
  2⤵
  PID:11592
- C:\Windows\System\VeNuyDT.exe
  C:\Windows\System\VeNuyDT.exe
  2⤵
  PID:11612
- C:\Windows\System\TxexlkH.exe
  C:\Windows\System\TxexlkH.exe
  2⤵
  PID:11632
- C:\Windows\System\lssXXSV.exe
  C:\Windows\System\lssXXSV.exe
  2⤵
  PID:11656
- C:\Windows\System\TFWVHsj.exe
  C:\Windows\System\TFWVHsj.exe
  2⤵
  PID:11672
- C:\Windows\System\geRiCvE.exe
  C:\Windows\System\geRiCvE.exe
  2⤵
  PID:11696
- C:\Windows\System\KJfTtoX.exe
  C:\Windows\System\KJfTtoX.exe
  2⤵
  PID:11716
- C:\Windows\System\GiNrWIf.exe
  C:\Windows\System\GiNrWIf.exe
  2⤵
  PID:11736
- C:\Windows\System\OtiHgMw.exe
  C:\Windows\System\OtiHgMw.exe
  2⤵
  PID:11760
- C:\Windows\System\pURKvhY.exe
  C:\Windows\System\pURKvhY.exe
  2⤵
  PID:11780
- C:\Windows\System\BWXJdCF.exe
  C:\Windows\System\BWXJdCF.exe
  2⤵
  PID:11796
- C:\Windows\System\wEeqnWX.exe
  C:\Windows\System\wEeqnWX.exe
  2⤵
  PID:11816
- C:\Windows\System\yjLEBXb.exe
  C:\Windows\System\yjLEBXb.exe
  2⤵
  PID:11836
- C:\Windows\System\HDDhvjA.exe
  C:\Windows\System\HDDhvjA.exe
  2⤵
  PID:11860
- C:\Windows\System\RZLfpJm.exe
  C:\Windows\System\RZLfpJm.exe
  2⤵
  PID:11880
- C:\Windows\System\VQCMNAL.exe
  C:\Windows\System\VQCMNAL.exe
  2⤵
  PID:11896
- C:\Windows\System\brBGbOu.exe
  C:\Windows\System\brBGbOu.exe
  2⤵
  PID:11916
- C:\Windows\System\WWjcDhF.exe
  C:\Windows\System\WWjcDhF.exe
  2⤵
  PID:11936
- C:\Windows\System\mMrxhOI.exe
  C:\Windows\System\mMrxhOI.exe
  2⤵
  PID:11952
- C:\Windows\System\faLGVfr.exe
  C:\Windows\System\faLGVfr.exe
  2⤵
  PID:11976
- C:\Windows\System\iokOehS.exe
  C:\Windows\System\iokOehS.exe
  2⤵
  PID:11996
- C:\Windows\System\UDwOnQY.exe
  C:\Windows\System\UDwOnQY.exe
  2⤵
  PID:12016
- C:\Windows\System\PWMgIpD.exe
  C:\Windows\System\PWMgIpD.exe
  2⤵
  PID:12040
- C:\Windows\System\vaAiEiI.exe
  C:\Windows\System\vaAiEiI.exe
  2⤵
  PID:12056
- C:\Windows\System\qgrXCLs.exe
  C:\Windows\System\qgrXCLs.exe
  2⤵
  PID:12072
- C:\Windows\System\GtDzdHo.exe
  C:\Windows\System\GtDzdHo.exe
  2⤵
  PID:12088
- C:\Windows\System\dCvaiqA.exe
  C:\Windows\System\dCvaiqA.exe
  2⤵
  PID:9852
- C:\Windows\System\IVERylw.exe
  C:\Windows\System\IVERylw.exe
  2⤵
  PID:8224
- C:\Windows\System\HhtxUwl.exe
  C:\Windows\System\HhtxUwl.exe
  2⤵
  PID:10116
- C:\Windows\System\CQQfbil.exe
  C:\Windows\System\CQQfbil.exe
  2⤵
  PID:8356
- C:\Windows\System\qwFaqTE.exe
  C:\Windows\System\qwFaqTE.exe
  2⤵
  PID:8472
- C:\Windows\System\DNNypDe.exe
  C:\Windows\System\DNNypDe.exe
  2⤵
  PID:11248
- C:\Windows\System\zZgandp.exe
  C:\Windows\System\zZgandp.exe
  2⤵
  PID:9288
- C:\Windows\System\IPkWTvC.exe
  C:\Windows\System\IPkWTvC.exe
  2⤵
  PID:4040
- C:\Windows\System\rflyxzB.exe
  C:\Windows\System\rflyxzB.exe
  2⤵
  PID:6832
- C:\Windows\System\rLfQEXT.exe
  C:\Windows\System\rLfQEXT.exe
  2⤵
  PID:9532
- C:\Windows\System\PPIqiKx.exe
  C:\Windows\System\PPIqiKx.exe
  2⤵
  PID:5248
- C:\Windows\System\qPoiVhx.exe
  C:\Windows\System\qPoiVhx.exe
  2⤵
  PID:11704
- C:\Windows\System\vAGhLhe.exe
  C:\Windows\System\vAGhLhe.exe
  2⤵
  PID:7384
- C:\Windows\System\JTFkJEZ.exe
  C:\Windows\System\JTFkJEZ.exe
  2⤵
  PID:6660
- C:\Windows\System\hKVOyUu.exe
  C:\Windows\System\hKVOyUu.exe
  2⤵
  PID:11728
- C:\Windows\System\hTJhsmN.exe
  C:\Windows\System\hTJhsmN.exe
  2⤵
  PID:11604
- C:\Windows\System\ocMUGXK.exe
  C:\Windows\System\ocMUGXK.exe
  2⤵
  PID:11024
- C:\Windows\System\zxpYecS.exe
  C:\Windows\System\zxpYecS.exe
  2⤵
  PID:10048
- C:\Windows\System\iDkVgZf.exe
  C:\Windows\System\iDkVgZf.exe
  2⤵
  PID:8396
- C:\Windows\System\kWGuKHj.exe
  C:\Windows\System\kWGuKHj.exe
  2⤵
  PID:3588
- C:\Windows\System\FaFiERn.exe
  C:\Windows\System\FaFiERn.exe
  2⤵
  PID:10252
- C:\Windows\System\LNiBwcy.exe
  C:\Windows\System\LNiBwcy.exe
  2⤵
  PID:2092
- C:\Windows\System\wVMPsPG.exe
  C:\Windows\System\wVMPsPG.exe
  2⤵
  PID:8544
- C:\Windows\System\cCWFmcI.exe
  C:\Windows\System\cCWFmcI.exe
  2⤵
  PID:4780
- C:\Windows\System\dqGHbgn.exe
  C:\Windows\System\dqGHbgn.exe
  2⤵
  PID:2428
- C:\Windows\System\VIgDhAk.exe
  C:\Windows\System\VIgDhAk.exe
  2⤵
  PID:8608
- C:\Windows\System\RJnmBqj.exe
  C:\Windows\System\RJnmBqj.exe
  2⤵
  PID:9056
- C:\Windows\System\bHIICkm.exe
  C:\Windows\System\bHIICkm.exe
  2⤵
  PID:9000
- C:\Windows\System\ISjRXnL.exe
  C:\Windows\System\ISjRXnL.exe
  2⤵
  PID:8952
- C:\Windows\System\ZpZFKtA.exe
  C:\Windows\System\ZpZFKtA.exe
  2⤵
  PID:8900
- C:\Windows\System\DDofiYV.exe
  C:\Windows\System\DDofiYV.exe
  2⤵
  PID:8852
- C:\Windows\System\ONNTqXp.exe
  C:\Windows\System\ONNTqXp.exe
  2⤵
  PID:8792
- C:\Windows\System\IgeZKVX.exe
  C:\Windows\System\IgeZKVX.exe
  2⤵
  PID:8736
- C:\Windows\System\gjaIxzV.exe
  C:\Windows\System\gjaIxzV.exe
  2⤵
  PID:8660
- C:\Windows\System\ozssSvr.exe
  C:\Windows\System\ozssSvr.exe
  2⤵
  PID:9128
- C:\Windows\System\hyQJTPW.exe
  C:\Windows\System\hyQJTPW.exe
  2⤵
  PID:9376
- C:\Windows\System\CMwmFrC.exe
  C:\Windows\System\CMwmFrC.exe
  2⤵
  PID:10816
- C:\Windows\System\RgiXqDn.exe
  C:\Windows\System\RgiXqDn.exe
  2⤵
  PID:12292
- C:\Windows\System\HGSdfry.exe
  C:\Windows\System\HGSdfry.exe
  2⤵
  PID:12316
- C:\Windows\System\SQrBYlk.exe
  C:\Windows\System\SQrBYlk.exe
  2⤵
  PID:12336
- C:\Windows\System\vHvIzCI.exe
  C:\Windows\System\vHvIzCI.exe
  2⤵
  PID:12356
- C:\Windows\System\PVqROkT.exe
  C:\Windows\System\PVqROkT.exe
  2⤵
  PID:12376
- C:\Windows\System\bYtMlRy.exe
  C:\Windows\System\bYtMlRy.exe
  2⤵
  PID:12392
- C:\Windows\System\AEFQahz.exe
  C:\Windows\System\AEFQahz.exe
  2⤵
  PID:12416
- C:\Windows\System\hUBZBpG.exe
  C:\Windows\System\hUBZBpG.exe
  2⤵
  PID:12444
- C:\Windows\System\NmSgFdP.exe
  C:\Windows\System\NmSgFdP.exe
  2⤵
  PID:12472
- C:\Windows\System\xxnEgai.exe
  C:\Windows\System\xxnEgai.exe
  2⤵
  PID:12492
- C:\Windows\System\QZPMmpu.exe
  C:\Windows\System\QZPMmpu.exe
  2⤵
  PID:12512
- C:\Windows\System\BofSNDv.exe
  C:\Windows\System\BofSNDv.exe
  2⤵
  PID:12536
- C:\Windows\System\OkrOVZQ.exe
  C:\Windows\System\OkrOVZQ.exe
  2⤵
  PID:12552
- C:\Windows\System\EVyoopF.exe
  C:\Windows\System\EVyoopF.exe
  2⤵
  PID:12572
- C:\Windows\System\GPcNdmk.exe
  C:\Windows\System\GPcNdmk.exe
  2⤵
  PID:12592
- C:\Windows\System\spKKpqp.exe
  C:\Windows\System\spKKpqp.exe
  2⤵
  PID:12612
- C:\Windows\System\cSiUvIf.exe
  C:\Windows\System\cSiUvIf.exe
  2⤵
  PID:12636
- C:\Windows\System\qKDchzh.exe
  C:\Windows\System\qKDchzh.exe
  2⤵
  PID:12656
- C:\Windows\System\WOTXbmp.exe
  C:\Windows\System\WOTXbmp.exe
  2⤵
  PID:12684
- C:\Windows\System\JVmnlYl.exe
  C:\Windows\System\JVmnlYl.exe
  2⤵
  PID:12704
- C:\Windows\System\tyQaHTO.exe
  C:\Windows\System\tyQaHTO.exe
  2⤵
  PID:12724
- C:\Windows\System\wIoGtdF.exe
  C:\Windows\System\wIoGtdF.exe
  2⤵
  PID:12744
- C:\Windows\System\FRjiCgA.exe
  C:\Windows\System\FRjiCgA.exe
  2⤵
  PID:12764
- C:\Windows\System\VuETjcH.exe
  C:\Windows\System\VuETjcH.exe
  2⤵
  PID:12784
- C:\Windows\System\rfBxXMi.exe
  C:\Windows\System\rfBxXMi.exe
  2⤵
  PID:12800
- C:\Windows\System\PSBUSth.exe
  C:\Windows\System\PSBUSth.exe
  2⤵
  PID:12816
- C:\Windows\System\NqwJPfA.exe
  C:\Windows\System\NqwJPfA.exe
  2⤵
  PID:12832
- C:\Windows\System\TGkZvNE.exe
  C:\Windows\System\TGkZvNE.exe
  2⤵
  PID:12856
- C:\Windows\System\mhCIuQF.exe
  C:\Windows\System\mhCIuQF.exe
  2⤵
  PID:12880
- C:\Windows\System\QEewkZv.exe
  C:\Windows\System\QEewkZv.exe
  2⤵
  PID:12904
- C:\Windows\System\PrBjdQL.exe
  C:\Windows\System\PrBjdQL.exe
  2⤵
  PID:12920
- C:\Windows\System\IvWeEju.exe
  C:\Windows\System\IvWeEju.exe
  2⤵
  PID:12936
- C:\Windows\System\qRYXduQ.exe
  C:\Windows\System\qRYXduQ.exe
  2⤵
  PID:12968
- C:\Windows\System\YwmpuRY.exe
  C:\Windows\System\YwmpuRY.exe
  2⤵
  PID:13000
- C:\Windows\System\KnjyzFZ.exe
  C:\Windows\System\KnjyzFZ.exe
  2⤵
  PID:13020
- C:\Windows\System\bLAJoJJ.exe
  C:\Windows\System\bLAJoJJ.exe
  2⤵
  PID:13044
- C:\Windows\System\gOClrnG.exe
  C:\Windows\System\gOClrnG.exe
  2⤵
  PID:13068
- C:\Windows\System\xqWbbVt.exe
  C:\Windows\System\xqWbbVt.exe
  2⤵
  PID:13084
- C:\Windows\System\RporJRU.exe
  C:\Windows\System\RporJRU.exe
  2⤵
  PID:13108
- C:\Windows\System\TPScSfo.exe
  C:\Windows\System\TPScSfo.exe
  2⤵
  PID:13128
- C:\Windows\System\ELcDyQP.exe
  C:\Windows\System\ELcDyQP.exe
  2⤵
  PID:13148
- C:\Windows\System\dIjjkAZ.exe
  C:\Windows\System\dIjjkAZ.exe
  2⤵
  PID:10724
- C:\Windows\System\iuqQNZg.exe
  C:\Windows\System\iuqQNZg.exe
  2⤵
  PID:10900
- C:\Windows\System\BVrnSbz.exe
  C:\Windows\System\BVrnSbz.exe
  2⤵
  PID:11028
- C:\Windows\System\ipoFnSf.exe
  C:\Windows\System\ipoFnSf.exe
  2⤵
  PID:12500
- C:\Windows\System\AwXvWHh.exe
  C:\Windows\System\AwXvWHh.exe
  2⤵
  PID:12528
- C:\Windows\System\tSAcwKi.exe
  C:\Windows\System\tSAcwKi.exe
  2⤵
  PID:12560
- C:\Windows\System\dGABqOT.exe
  C:\Windows\System\dGABqOT.exe
  2⤵
  PID:10500
- C:\Windows\System\PNONDsf.exe
  C:\Windows\System\PNONDsf.exe
  2⤵
  PID:10288
- C:\Windows\System\tzTSCKm.exe
  C:\Windows\System\tzTSCKm.exe
  2⤵
  PID:10168
- C:\Windows\System\NHgWohO.exe
  C:\Windows\System\NHgWohO.exe
  2⤵
  PID:11928
- C:\Windows\System\EYBFONy.exe
  C:\Windows\System\EYBFONy.exe
  2⤵
  PID:11984
- C:\Windows\System\SYTaKZp.exe
  C:\Windows\System\SYTaKZp.exe
  2⤵
  PID:12028
- C:\Windows\System\NTcDurL.exe
  C:\Windows\System\NTcDurL.exe
  2⤵
  PID:8156
- C:\Windows\System\qlqXUdv.exe
  C:\Windows\System\qlqXUdv.exe
  2⤵
  PID:4028
- C:\Windows\System\jLshBEi.exe
  C:\Windows\System\jLshBEi.exe
  2⤵
  PID:12240
- C:\Windows\System\jOBjeKU.exe
  C:\Windows\System\jOBjeKU.exe
  2⤵
  PID:9648
- C:\Windows\System\jTSmDPp.exe
  C:\Windows\System\jTSmDPp.exe
  2⤵
  PID:6788
- C:\Windows\System\mCjXDuY.exe
  C:\Windows\System\mCjXDuY.exe
  2⤵
  PID:10308
- C:\Windows\System\LhivYUB.exe
  C:\Windows\System\LhivYUB.exe
  2⤵
  PID:6052
- C:\Windows\System\TwSlTCJ.exe
  C:\Windows\System\TwSlTCJ.exe
  2⤵
  PID:5532
- C:\Windows\System\qaheYqm.exe
  C:\Windows\System\qaheYqm.exe
  2⤵
  PID:6208
- C:\Windows\System\kRbNwCH.exe
  C:\Windows\System\kRbNwCH.exe
  2⤵
  PID:5800
- C:\Windows\System\HAASTZN.exe
  C:\Windows\System\HAASTZN.exe
  2⤵
  PID:10860
- C:\Windows\System\euAcFIv.exe
  C:\Windows\System\euAcFIv.exe
  2⤵
  PID:11076
- C:\Windows\System\kWMAYZI.exe
  C:\Windows\System\kWMAYZI.exe
  2⤵
  PID:6608
- C:\Windows\System\MZiPRHl.exe
  C:\Windows\System\MZiPRHl.exe
  2⤵
  PID:8000
- C:\Windows\System\QaWbjQd.exe
  C:\Windows\System\QaWbjQd.exe
  2⤵
  PID:9308
- C:\Windows\System\SwqFZVa.exe
  C:\Windows\System\SwqFZVa.exe
  2⤵
  PID:9516
- C:\Windows\System\mEyimWN.exe
  C:\Windows\System\mEyimWN.exe
  2⤵
  PID:9692
- C:\Windows\System\lOLlqEO.exe
  C:\Windows\System\lOLlqEO.exe
  2⤵
  PID:7388
- C:\Windows\System\OQwxTZa.exe
  C:\Windows\System\OQwxTZa.exe
  2⤵
  PID:11768
- C:\Windows\System\WfinVae.exe
  C:\Windows\System\WfinVae.exe
  2⤵
  PID:11420
- C:\Windows\System\xivVUep.exe
  C:\Windows\System\xivVUep.exe
  2⤵
  PID:9480
- C:\Windows\System\ElyUYvE.exe
  C:\Windows\System\ElyUYvE.exe
  2⤵
  PID:9604
- C:\Windows\System\nCSPeaf.exe
  C:\Windows\System\nCSPeaf.exe
  2⤵
  PID:8416
- C:\Windows\System\DScKFhX.exe
  C:\Windows\System\DScKFhX.exe
  2⤵
  PID:8560
- C:\Windows\System\JINArNp.exe
  C:\Windows\System\JINArNp.exe
  2⤵
  PID:12644
- C:\Windows\System\JqXvXSN.exe
  C:\Windows\System\JqXvXSN.exe
  2⤵
  PID:12696
- C:\Windows\System\UDovUBT.exe
  C:\Windows\System\UDovUBT.exe
  2⤵
  PID:12824
- C:\Windows\System\jScmSTC.exe
  C:\Windows\System\jScmSTC.exe
  2⤵
  PID:12864
- C:\Windows\System\vKbIbBA.exe
  C:\Windows\System\vKbIbBA.exe
  2⤵
  PID:13584
- C:\Windows\System\qmTDvIC.exe
  C:\Windows\System\qmTDvIC.exe
  2⤵
  PID:13600
- C:\Windows\System\Fonqwbe.exe
  C:\Windows\System\Fonqwbe.exe
  2⤵
  PID:13620
- C:\Windows\System\jCrzZnD.exe
  C:\Windows\System\jCrzZnD.exe
  2⤵
  PID:13648
- C:\Windows\System\heFNSTz.exe
  C:\Windows\System\heFNSTz.exe
  2⤵
  PID:13688
- C:\Windows\System\YhEtyHJ.exe
  C:\Windows\System\YhEtyHJ.exe
  2⤵
  PID:13704
- C:\Windows\System\nVzxdiT.exe
  C:\Windows\System\nVzxdiT.exe
  2⤵
  PID:13720
- C:\Windows\System\RpEiRSK.exe
  C:\Windows\System\RpEiRSK.exe
  2⤵
  PID:13756
- C:\Windows\System\oyrmtlB.exe
  C:\Windows\System\oyrmtlB.exe
  2⤵
  PID:13776
- C:\Windows\System\eqaTwiC.exe
  C:\Windows\System\eqaTwiC.exe
  2⤵
  PID:13796
- C:\Windows\System\isjdPXT.exe
  C:\Windows\System\isjdPXT.exe
  2⤵
  PID:13816
- C:\Windows\System\oNLAZnS.exe
  C:\Windows\System\oNLAZnS.exe
  2⤵
  PID:13836
- C:\Windows\System\YSQKUTj.exe
  C:\Windows\System\YSQKUTj.exe
  2⤵
  PID:13852
- C:\Windows\System\xJNOkIU.exe
  C:\Windows\System\xJNOkIU.exe
  2⤵
  PID:13876
- C:\Windows\System\WARrqKC.exe
  C:\Windows\System\WARrqKC.exe
  2⤵
  PID:13892
- C:\Windows\System\fdEnjRw.exe
  C:\Windows\System\fdEnjRw.exe
  2⤵
  PID:13916
- C:\Windows\System\fCZCceD.exe
  C:\Windows\System\fCZCceD.exe
  2⤵
  PID:13936
- C:\Windows\System\DvFWSLp.exe
  C:\Windows\System\DvFWSLp.exe
  2⤵
  PID:14108
- C:\Windows\System\nZiDWvy.exe
  C:\Windows\System\nZiDWvy.exe
  2⤵
  PID:14144
- C:\Windows\System\oPlJApL.exe
  C:\Windows\System\oPlJApL.exe
  2⤵
  PID:14280
- C:\Windows\System\ZpUNtQS.exe
  C:\Windows\System\ZpUNtQS.exe
  2⤵
  PID:8148
- C:\Windows\System\gmcyNqL.exe
  C:\Windows\System\gmcyNqL.exe
  2⤵
  PID:5440
- C:\Windows\System\mTyhPnY.exe
  C:\Windows\System\mTyhPnY.exe
  2⤵
  PID:9924
- C:\Windows\System\UbMGrQN.exe
  C:\Windows\System\UbMGrQN.exe
  2⤵
  PID:11692
- C:\Windows\System\pvbqDpv.exe
  C:\Windows\System\pvbqDpv.exe
  2⤵
  PID:4460
- C:\Windows\System\vEhdIKz.exe
  C:\Windows\System\vEhdIKz.exe
  2⤵
  PID:10520
- C:\Windows\System\CXkPUcF.exe
  C:\Windows\System\CXkPUcF.exe
  2⤵
  PID:8856
- C:\Windows\System\AzYMbel.exe
  C:\Windows\System\AzYMbel.exe
  2⤵
  PID:8236
- C:\Windows\System\bPWgazs.exe
  C:\Windows\System\bPWgazs.exe
  2⤵
  PID:11776
- C:\Windows\System\luKDEBJ.exe
  C:\Windows\System\luKDEBJ.exe
  2⤵
  PID:2032
- C:\Windows\System\sOldChj.exe
  C:\Windows\System\sOldChj.exe
  2⤵
  PID:6872
- C:\Windows\System\vpkXkvZ.exe
  C:\Windows\System\vpkXkvZ.exe
  2⤵
  PID:11180
- C:\Windows\System\hHMDJgu.exe
  C:\Windows\System\hHMDJgu.exe
  2⤵
  PID:548
- C:\Windows\System\gKIQviA.exe
  C:\Windows\System\gKIQviA.exe
  2⤵
  PID:9652
- C:\Windows\System\eblmWpe.exe
  C:\Windows\System\eblmWpe.exe
  2⤵
  PID:13496
- C:\Windows\System\uxDARJk.exe
  C:\Windows\System\uxDARJk.exe
  2⤵
  PID:8820
- C:\Windows\System\OEUBgvT.exe
  C:\Windows\System\OEUBgvT.exe
  2⤵
  PID:14096
- C:\Windows\System\CBMCugf.exe
  C:\Windows\System\CBMCugf.exe
  2⤵
  PID:3928
- C:\Windows\System\cHMuJxo.exe
  C:\Windows\System\cHMuJxo.exe
  2⤵
  PID:9432
- C:\Windows\System\MMBywpQ.exe
  C:\Windows\System\MMBywpQ.exe
  2⤵
  PID:8528
- C:\Windows\System\xdyJmBd.exe
  C:\Windows\System\xdyJmBd.exe
  2⤵
  PID:2660
- C:\Windows\System\gGfZqFl.exe
  C:\Windows\System\gGfZqFl.exe
  2⤵
  PID:4872
- C:\Windows\System\hYqBKZn.exe
  C:\Windows\System\hYqBKZn.exe
  2⤵
  PID:1940
- C:\Windows\System\BbuuYPC.exe
  C:\Windows\System\BbuuYPC.exe
  2⤵
  PID:1068
- C:\Windows\System\IaGnrvB.exe
  C:\Windows\System\IaGnrvB.exe
  2⤵
  PID:12052
- C:\Windows\System\pfxexbA.exe
  C:\Windows\System\pfxexbA.exe
  2⤵
  PID:10420
- C:\Windows\System\nGXtnWE.exe
  C:\Windows\System\nGXtnWE.exe
  2⤵
  PID:13248
- C:\Windows\System\MQwxcAK.exe
  C:\Windows\System\MQwxcAK.exe
  2⤵
  PID:13564
- C:\Windows\System\Gihjcgm.exe
  C:\Windows\System\Gihjcgm.exe
  2⤵
  PID:11064
- C:\Windows\System\XnxSomh.exe
  C:\Windows\System\XnxSomh.exe
  2⤵
  PID:13440
- C:\Windows\System\JNQqpnU.exe
  C:\Windows\System\JNQqpnU.exe
  2⤵
  PID:14264
- C:\Windows\System\PCLJpZZ.exe
  C:\Windows\System\PCLJpZZ.exe
  2⤵
  PID:8760
- C:\Windows\System\XLCFEEM.exe
  C:\Windows\System\XLCFEEM.exe
  2⤵
  PID:9696
- C:\Windows\System\jbFYpqO.exe
  C:\Windows\System\jbFYpqO.exe
  2⤵
  PID:14272
- C:\Windows\System\ifVtcEH.exe
  C:\Windows\System\ifVtcEH.exe
  2⤵
  PID:13908
- C:\Windows\System\mCOUiWB.exe
  C:\Windows\System\mCOUiWB.exe
  2⤵
  PID:13964
- C:\Windows\System\AIYhSdq.exe
  C:\Windows\System\AIYhSdq.exe
  2⤵
  PID:13948
- C:\Windows\System\FGSccSj.exe
  C:\Windows\System\FGSccSj.exe
  2⤵
  PID:13884
- C:\Windows\System\VuUEAQF.exe
  C:\Windows\System\VuUEAQF.exe
  2⤵
  PID:13804
- C:\Windows\System\auFleTN.exe
  C:\Windows\System\auFleTN.exe
  2⤵
  PID:14084
- C:\Windows\System\eyWYhDu.exe
  C:\Windows\System\eyWYhDu.exe
  2⤵
  PID:1932
- C:\Windows\System\tXuCiPQ.exe
  C:\Windows\System\tXuCiPQ.exe
  2⤵
  PID:13224
- C:\Windows\System\KkCEgNp.exe
  C:\Windows\System\KkCEgNp.exe
  2⤵
  PID:13164
- C:\Windows\System\rTTJiZV.exe
  C:\Windows\System\rTTJiZV.exe
  2⤵
  PID:9328
- C:\Windows\System\TOLHUNz.exe
  C:\Windows\System\TOLHUNz.exe
  2⤵
  PID:1236
- C:\Windows\System\cWcYTmM.exe
  C:\Windows\System\cWcYTmM.exe
  2⤵
  PID:11892
- C:\Windows\System\jEKxgrD.exe
  C:\Windows\System\jEKxgrD.exe
  2⤵
  PID:14076
- C:\Windows\System\gyxTfpX.exe
  C:\Windows\System\gyxTfpX.exe
  2⤵
  PID:10028
- C:\Windows\System\shuJMgi.exe
  C:\Windows\System\shuJMgi.exe
  2⤵
  PID:2232
- C:\Windows\System\ENFfQLl.exe
  C:\Windows\System\ENFfQLl.exe
  2⤵
  PID:3416
- C:\Windows\System\HNVChOj.exe
  C:\Windows\System\HNVChOj.exe
  2⤵
  PID:14120
- C:\Windows\System\KuiPrJE.exe
  C:\Windows\System\KuiPrJE.exe
  2⤵
  PID:11236
- C:\Windows\System\RDJRPaC.exe
  C:\Windows\System\RDJRPaC.exe
  2⤵
  PID:12124
- C:\Windows\System\vQXssOw.exe
  C:\Windows\System\vQXssOw.exe
  2⤵
  PID:4476
- C:\Windows\System\UWjzHiK.exe
  C:\Windows\System\UWjzHiK.exe
  2⤵
  PID:12144
- C:\Windows\System\uNkGZcR.exe
  C:\Windows\System\uNkGZcR.exe
  2⤵
  PID:14156
- C:\Windows\System\xVxoPrX.exe
  C:\Windows\System\xVxoPrX.exe
  2⤵
  PID:4356
- C:\Windows\System\HGRVfiX.exe
  C:\Windows\System\HGRVfiX.exe
  2⤵
  PID:12008
- C:\Windows\System\FFFbvvN.exe
  C:\Windows\System\FFFbvvN.exe
  2⤵
  PID:2012
- C:\Windows\System\tvaFAFI.exe
  C:\Windows\System\tvaFAFI.exe
  2⤵
  PID:2988
- C:\Windows\System\juYXPAK.exe
  C:\Windows\System\juYXPAK.exe
  2⤵
  PID:13504
- C:\Windows\System\wakqpit.exe
  C:\Windows\System\wakqpit.exe
  2⤵
  PID:13320
- C:\Windows\System\byLmeWr.exe
  C:\Windows\System\byLmeWr.exe
  2⤵
  PID:5636
- C:\Windows\System\SdVocsR.exe
  C:\Windows\System\SdVocsR.exe
  2⤵
  PID:13220
- C:\Windows\System\lMcLALE.exe
  C:\Windows\System\lMcLALE.exe
  2⤵
  PID:3896
- C:\Windows\System\zrilBBC.exe
  C:\Windows\System\zrilBBC.exe
  2⤵
  PID:9540
- C:\Windows\System\qTIQDme.exe
  C:\Windows\System\qTIQDme.exe
  2⤵
  PID:11276
- C:\Windows\System\VomFXkh.exe
  C:\Windows\System\VomFXkh.exe
  2⤵
  PID:13508
- C:\Windows\System\ymEzfLu.exe
  C:\Windows\System\ymEzfLu.exe
  2⤵
  PID:13580
- C:\Windows\System\sDVlvqy.exe
  C:\Windows\System\sDVlvqy.exe
  2⤵
  PID:4788
- C:\Windows\System\JfCOShg.exe
  C:\Windows\System\JfCOShg.exe
  2⤵
  PID:6800
- C:\Windows\System\BWxgshX.exe
  C:\Windows\System\BWxgshX.exe
  2⤵
  PID:10984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ygwrmcxk.md0.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AtjOkYO.exe

Filesize
1.4MB

MD5
127f92e3b6b7e42983cfffa35da00ac8

SHA1
2e081073b60ff0574f4523c345b6b0729b5997a6

SHA256
d85fe4d37c827bbedb8351026bd42e0bc4524902fb8fec326ce6adc3436a5b5e

SHA512
4062127afe05d6c70ef675a6bd58b2ca82818ccd18b405a13c7f47bef5bce3cabb39bda47b9c3721470c148494a32721d436a50e0ee2c2975cc3b00d0a674a0b

Download Submit
C:\Windows\System\CenglAV.exe

Filesize
1.4MB

MD5
3b6b35bfd932ca16d6ef2b87010250c0

SHA1
e8ca612694369af74f196d4f3b0dbb886ff4c62f

SHA256
3d580f9436a1796a46537db4ffa39ec95aa1b10a3f22c6878ef5fbf3b06e30d4

SHA512
8a26e05f7cff5e2211486497ce3ac0b666a08be4b7c290c9cf3d9359cda82cad5b4875b2cae86cfc73d33004a58522fae9624b0c13ffb32159a0c0677a2bab2e

Download Submit
C:\Windows\System\FtmpXkZ.exe

Filesize
1.4MB

MD5
0904c3b9c416ef76e2c8f826272bcd5c

SHA1
8ecae2ab0f1cdd588a8c55a719f56d914c36c644

SHA256
14551d8d93a04ed96017c79692e444e5c5cc44e793b7d15c9919d50be078e74c

SHA512
23060e7822e13c1152145977b604046d99d1f36b546e6c100e28177056a786df610eef30271f48087cd05092d6c1abe62e18400948b3f1ed12ce7ad5d89629f3

Download Submit
C:\Windows\System\HRljnSg.exe

Filesize
1.4MB

MD5
18f2d94c6bfe4a5f87672b4e5e9b57a0

SHA1
6f80c930026018795c8cf8ac633fde88b8148eba

SHA256
aa984ea6daaa110f39874c64757046eb04f4532a505dd6e514833282e2bf0200

SHA512
bb104c83bac704e2fdfbaaf8c4f45119a5ae7a115914244a1556b941e9a40281e43a0903791cfb0225ecac4629d467931e67d079fb83aaacd6e71d8ff32474c2

Download Submit
C:\Windows\System\IcXjohn.exe

Filesize
1.4MB

MD5
437455e8aadfc217961743d14786fdb2

SHA1
10baa979c00f2b9eec1630e5678520bf62e53e29

SHA256
08bef2b15b20eab38fcbad585c09dec126a06cbeea4042fb14a7f3c4cf10b7f0

SHA512
a0458121598f33a5c351fd5a174f8d1351a7ea28294a543314c71fcdd3cace7d2f762449b77eeaa30b881f6911a92d3a9a22ab2053f0ce7a09982854be5d7c79

Download Submit
C:\Windows\System\JGfEvTo.exe

Filesize
1.4MB

MD5
5fd517ed1a671ed7666bb7113012a9be

SHA1
522f4db24609fa1467f455b993237e216990e891

SHA256
9400e3b268449579969815de1cf18677525b9c431bec74098ca57858083cc0be

SHA512
83ddd483f5d809b9b05bf62a7137a446815a07da8dbf14f4faf57fd07445741368572896ffdf2dfa1104e1a4aba11568d99eb0fa52c7b17edf2786784300583c

Download Submit
C:\Windows\System\JlKQZlI.exe

Filesize
1.4MB

MD5
ec66c60f702e4146525ab1f18c3a0726

SHA1
717b3322ef100d10a630f86088df8a8e74735729

SHA256
a2c71b2f1f1f4be065b04aedf241e9d601175e4c385a1623c10b89418330de30

SHA512
e849b96658f54b62ba81447d33826270c7826919285bfd846190d4c2257cb50c73f8bf064d9ec16f987d31d3b869209f2ce96cf8c4540c246ffde606fc28f371

Download Submit
C:\Windows\System\LMSuHMP.exe

Filesize
1.4MB

MD5
656097ad0d26c4c54ae28d4d181ee4df

SHA1
0f0bb8c9c6ff3212a12385c36ae664488f32a970

SHA256
dfe93156974b57b4fdc6cbd3143df0c99ea21c5074aa833b70ee7547a846545a

SHA512
16fcc47432c08a27523a8f939794c84385e18f768e2432712c75193a9b2169f0bbc3da3efa30b1a8e640beaa1af0d2f94047e483e1116712e06e2e3729622e8a

Download Submit
C:\Windows\System\MOZZSDq.exe

Filesize
1.4MB

MD5
15bb41b03c05639f0c6b986094beb6ee

SHA1
67469954a62f51c4e230f5a794745cd7456724a7

SHA256
ffa5c1eeb1db4d1ba8f64421cad435a4a8a7fb33316f447ed8d8faf566fd9bf0

SHA512
2bb4a8a7311f0d9938db000f2917b1fd8bb770fe0349cba632e57e9a0bc9ab3868b4566fd900387a0a29f79ccbe593763ff2e74c6bc10ef74011f2f9a75eb33e

Download Submit
C:\Windows\System\Mjlecou.exe

Filesize
1.4MB

MD5
8729b11fe22388ffb180992f83716a98

SHA1
02f51bf6cbfa8e24b7fcba3c0d3e8a1e585a26cf

SHA256
499f2423582bb45b5ebe50c8f7ea2fee0d7bb99f7b8dd087cadc29d5ed2ed70c

SHA512
2b2be828a273171b54c808a9f97e874dbbe3dea038187165a61d1328be73db47d31de87d57ebd928e57a52eb907ca15ff6cc143d5d3fe7381aba1c205afd465a

Download Submit
C:\Windows\System\NXuUbvu.exe

Filesize
1.4MB

MD5
b354ba7a2317bf4939250027c0e0ab3e

SHA1
06f01fb21a4b84c58e535d7c7705ff41e2da240b

SHA256
f3c6736ab74a426f8fdc19bcc87d8ed2e9cb2d5e6a8a096f83cf03480e68944c

SHA512
92871f54cdaddb90e70b1980724cc9e64040c8ced569c3506b79d863b0ffa5d950a8049e0c4f9d9cad146d80655fd2fbd4197d65f31fdf0ca0a36cf54357648c

Download Submit
C:\Windows\System\PbwEgrN.exe

Filesize
1.4MB

MD5
5a1a37d7930fdd36410c6384781752c7

SHA1
81e2640630978adbda3df061ad2a92997e4fb298

SHA256
5b291e0d90cb64a0ced8314ac71faee9feba281c7862429e9d9bb1cb66fd51b2

SHA512
e260aa370580b7f53867ff82df4dc05a8acab99fc26b5fd24ed9e1f076f42c88f87e154718f2bc69b56bd3dfbefce8e065e2f81bddcf4373a5b0c121290157ab

Download Submit
C:\Windows\System\QSQGMrk.exe

Filesize
1.4MB

MD5
1213ee6fc5032660d449c3f1fd3129e4

SHA1
c8f08328929f148139689d726dba5f92497ffe7f

SHA256
b10213aae99e26682f3dfdd8575562c8d0b2bb6d45f71bd98bcba30f3d3bef9c

SHA512
1f6b2f001955f8c0943706eb2e01db7de7c5083b11118342d9f529c238ffbbf1b36c21ef2640e7c03512587a3b035c621f48d25ae5917fa18d4e27a905444d5f

Download Submit
C:\Windows\System\RPFivpv.exe

Filesize
1.4MB

MD5
0657e4a75e0d6ebe4d3571020384c640

SHA1
b85ba4a410f49ff51df318ee9d420d021033c884

SHA256
bb7b479a8c03f74dba45852127cd0fa702a168c3ff8580b79b9a83df84e55a1a

SHA512
df612dcce8f728d453119627897520de8cd441796bb5bd851715117db7289d412a794700d5c49165e84355b6a9f0875fed6a3e1df3de705226cc23225fec0758

Download Submit
C:\Windows\System\TASLOIT.exe

Filesize
1.4MB

MD5
2be285d84a4c54fe160807a0dbb49263

SHA1
58c32e1d1fb5603eec97d60f8a636379bbbde066

SHA256
3bbb2823df8702c0c65a7ed93e7e96b44b857f11690fc89ab9897e381726ce4a

SHA512
5c243c25e1967a24c9f515f1da1225b23850c69726935d7061c4fd80ae1c591fe0f5eb15aeae28f20e9d54831675d67b44702d2e6a58c55552a2f07fcca33c8e

Download Submit
C:\Windows\System\TApmkQS.exe

Filesize
1.4MB

MD5
e9eadf610d7e6313a822066a84ceef00

SHA1
1313ee02c7a122609868ce8629bca59b9bfba1cd

SHA256
09f4d80f48f808412071023a9cfdb0787cb8fc512379cc5bd0e6c16f11fd2b96

SHA512
0b57f610da150682b94e68c888891db84cf4e6a2b5dc2401a55f1ad3652cca9c6212eac37875a2999225cbbd8be9661f2dd37a77caf1f4266d6b791490bcbcc9

Download Submit
C:\Windows\System\TKHueHT.exe

Filesize
1.4MB

MD5
b7bc7de64dfcc1855032c644417c9297

SHA1
dc59217416c005e087ed03b10ecefb3f3e046c46

SHA256
ec370395f0428bb9388e8366a5f8420c56bb9d1bb52017c0ca9d0258bdd2a4dd

SHA512
1f66def4500ee09b07c698658d45e235b363737d1abd536c053dae7d452827c955a18507721018e7c66504ba57b8bf69d9e95b9e5dd72be8df890814f8ea982d

Download Submit
C:\Windows\System\VOivcId.exe

Filesize
1.4MB

MD5
9a680749b75d730d7da4858464a1d12e

SHA1
da5cb26513b2d9dedb55a3f507a56228331535d9

SHA256
adbdf3dade6b7857e285f551dc601b53e332d4a50cafb08d18b67a041eced626

SHA512
8556ed6a4522281d88ee65e730e889bebdc297038e829176494fba7f80f57f0a680753c06b91d2f232911269358f55bd0168bd30d4f61efd55301c38a0082588

Download Submit
C:\Windows\System\VlkyhdY.exe

Filesize
1.4MB

MD5
7d8dc4a7ea8ae8036f0966459470d957

SHA1
4812f6b014de6191d4745d19985897b589e5acdb

SHA256
f5f88562d9cb173fbf0dc3e12ae43c6c688553e58e313cee127f3d2039d3073d

SHA512
bdcefbeb7ac55cb002f9ff1874c4097a413ba0646bfeeea6b008f3d3bdbda7a2359998ed628421a9eac4c136932d1da21db8f816ad0aa40e62eed3a42c063831

Download Submit
C:\Windows\System\WOcirVe.exe

Filesize
1.4MB

MD5
c9cf2a0d56adf01a8e9eda458de9ea2c

SHA1
a4e7e0a861cec0b6a17da7be66250227cbb04cce

SHA256
83a5c574c135088205168ea3c7fc6af25a46ef1c4f1a798914872e236f17db81

SHA512
95f51ec9f4f7a2c9cf13aea2f74cc6ddfd817ee198d8d206c8722aa35acbf6b25695a8088e5792b034399427fb846b782f095a86adcd569640e72eb961512098

Download Submit
C:\Windows\System\WVvOsPw.exe

Filesize
1.4MB

MD5
399f614f9178a044fa6066afb9e1c67f

SHA1
f1946a8ab0ac0bed81b5fc77e19d7287c4306611

SHA256
287b3a1bd498a4bfb88b85c26400fd6b741e03e9ed08b07f5ab661d5c18a4dda

SHA512
ec41d60389fc405f97eac5ce1878a78ecae278024769d36bc96578de263a202b5eca70f58db3cfd154c4c75709a889bc0a79c673d7d6efe98365e35ef827f9aa

Download Submit
C:\Windows\System\WhClCZm.exe

Filesize
8B

MD5
8a9416a5ba3f4513ce86ee25fcd9ed2c

SHA1
a36f3dd1333c8cfee404b646d4c6809d7e653313

SHA256
fb7dd3a16f87fe8b7e98987069f2b605508df1550402bd2a9bfdec4856b1a59a

SHA512
c747d417c3e282ae9ec82b691c8fea9cb7d0729d1dda54d2144fa9c71dd39f2ab11cee5a6768a89cb91fd4a7ae6e579302cb4e4de8d6384014994320074580a4

Download Submit
C:\Windows\System\XgmWjjU.exe

Filesize
1.4MB

MD5
cdb38cd07d090fa5591fc3eb385efb3e

SHA1
1e9991095818fe88becc1a50e75bc22786cc003b

SHA256
9b7c891c9a7aeeba7fe0b664ae42a13b0af885ad8185ad3d4ed8ab4f1382f9bc

SHA512
93fb736298b98d022e1abc8dfd31a360da9938d7adac67d96ff8e8e93371ed82cca8cfd2b91e4c90f4b0476ac26dc92780257b80eb7ab01d3767fafb4dfd47d2

Download Submit
C:\Windows\System\YRiXSAo.exe

Filesize
1.4MB

MD5
6c055d03814dc85705d74f1856c06c5c

SHA1
35a37ab6e6e5f31fd5391a64c2faa955cfba0e04

SHA256
62773e98943f6a89fb234f41cc7a715e882e157dcbf0525af8b996f9c0d35a37

SHA512
eb3e94c82b62e116d70a02339108875851cb03030e0311e8eace3c847c5b54b3af2f2ead4b56f94d2b300773250374a7b63d5ae577f9abd0c928c4e624d71dc2

Download Submit
C:\Windows\System\akMpYgk.exe

Filesize
1.4MB

MD5
d3c44c97dca19b7bcd8d96f84e05f936

SHA1
8869e671b00c052bb7b124af87c09fe138e6453c

SHA256
be0dc19a9642674f337917d0d67feeee83e7166be7689a5a62d2a29bf88df635

SHA512
fd586beff9d74eaa81d8ec6bdbe2f0e855250c0f81c05649d6f2ccea9b0bc24adebbb6de7dd1e4f69d188b818606ccff6dc6feb447affecbca859a4f21a9e2c1

Download Submit
C:\Windows\System\capxpSI.exe

Filesize
1.4MB

MD5
fecfe6afe027d1fb9ca3db357a0b92be

SHA1
387430816df237e484f3b56a3b1bbb6619a9580e

SHA256
e75e369d02ee1ebb6589d8849b078440a1c47260b522cb9166029f48474ff449

SHA512
db10e7ce8f8c715d6de478384d7cbccdb5b6f9362c344bee08b2f1678586e09e3d8eb3285fe50722b7ccc0e284b3bccf73b6ce902f3dcd1d57cdb3ccc1696e4b

Download Submit
C:\Windows\System\dQoZJuT.exe

Filesize
1.4MB

MD5
506b5969cee853c7525bba33cf34b72a

SHA1
9a94d406bc6467184954226c64eda4abd1911455

SHA256
054dbc3f97fc7e52c5621572284b7cef4a4566efe6d4085d7206507a755253b0

SHA512
f1c6b2c0f00d2b96938601949e66223333008428282a226dd2c35c88b21ae1e537117205596070b639b97910c01bd182b2ecd06e6f53b6213d4dcefbc4b5bd43

Download Submit
C:\Windows\System\dnBNFDw.exe

Filesize
1.4MB

MD5
9b51065d03e5553fc42a7250110946be

SHA1
632a2267012f1670caa5547bac943af5708d91b7

SHA256
ed508cb8120210dd07890a11766e1cbb2c3211ec995afe92689b2b319da6dbe0

SHA512
9b51d8936ab9983b2b890157f935dfe6ba8ff7b1b0afc7b1cb987f37257c612a04a00bc1d59870480112d34a9ac0e7492438f021d7e4b01c5896cb813e9503cc

Download Submit
C:\Windows\System\eAGKDhU.exe

Filesize
1.4MB

MD5
1905ccbcfd292cbeaecf90de7f916b38

SHA1
289011b9e786cf8dd4dff1f4645f1bd5b9d0637a

SHA256
cb7a720d61646d6adddc12a235ad8729be309cfb0a3ac3693eff4f25aa8766ca

SHA512
829942b86c9ad4c9d9288f301d72e594d9c7571757196ea27ffb478476d7f9426e5ff5bda7dd168ac2362d231dc9e7484530d601e6e8a456b697cab47c6aa06f

Download Submit
C:\Windows\System\eqHpnGA.exe

Filesize
1.4MB

MD5
1412a774fc2e28859c255a45718b0247

SHA1
4f7768d3bf7b614979f55c8dcf19bfc5786dbdbd

SHA256
e29ddc671fd18c9874338e43fd7e6d54eb825c7906af32f109eba5dded37bc6f

SHA512
12b273e7f0fdbe4d1bc40e6aac221a8ff6c45e6314e805c215aa800dcfa382095ae005eb4a6a72e9d9500e8489b828df08e37b8ddf76dffc107d0d3013d41c4d

Download Submit
C:\Windows\System\frJGwxZ.exe

Filesize
1.4MB

MD5
91ecd1d837d2b7f50428d6fe6d694ecc

SHA1
ee365392de584e629594d2f0d6f98c89ac74f528

SHA256
a2717261b56c816aabecb029e7f489df708b1f2f8d7de4a16aa8ea782a5595dd

SHA512
19d1d8bc28f2f12dced103ac5722a77f8f8e5c41b7244c283e1e1db91b92293654e6bca3b0d973cb19bd337db788772210bb79009b31dc8ae67dbb5f32dbd86a

Download Submit
C:\Windows\System\gCImjTF.exe

Filesize
1.4MB

MD5
de76c0491cf256a3a3ec85a3ebae246e

SHA1
7ee5d911a84b35d2bdd1e97b2d54c43438980962

SHA256
f5b3a44d766ac1add65055e3eda342edccf7833592db52e4394ad0e53f8788fe

SHA512
26009f13a420038155721c93e17dfa82d37dbcb554103c910a4bddc02299f03ec80eefc1eb6ade7efd7a405483c13609aae899f86e5fb9964eb68ffc4ce8c915

Download Submit
C:\Windows\System\ggBDzza.exe

Filesize
1.4MB

MD5
e1e25276c91d08c5d9bb598f90011add

SHA1
68372d85cfe192ddff6808c24db27b0db540139d

SHA256
a340d3570721c281d1e3321aa56910568088f436086e25638ccc7911f4ada19a

SHA512
6c44a9bed509635f394a46687a5b98a9bdfc710f9e8a21415b9e809e504fc3de56c4e9eb81cc74524ec3c46983f34de3c4aa488e7a6f0ff88eb3c66feab9f0db

Download Submit
C:\Windows\System\ghHTaQq.exe

Filesize
1.4MB

MD5
3599816d67e98ecf7783bbf228757310

SHA1
bf084b9bfbd8cd68d467105cfb1ffde7fec692d1

SHA256
7dd6348dcafd834d7fb50dfeb8c281cb2c4f5e2721b8729d17866ac218d6b628

SHA512
b19c4baff3cafec239689162d9ca551554dfa45a1cebe915aafbd344dcf129df3cd8010a85f7144ae7da74bd681b7fe240c6440f59a09d6bb4dde9c670ece9ea

Download Submit
C:\Windows\System\hQCPTec.exe

Filesize
1.4MB

MD5
175e91a51a167a56e13e94433f0a191b

SHA1
0f4c90d93460e274bd334773d202afd29b668627

SHA256
3a86dd5cda112eba31ec921de4b8b6d2f9b44506e55a882c814d38be97cc43d8

SHA512
9becd191cba077364233a41d25223358c3605b6f64144fdaef4918bc89fa5110148af356705f8b9adcb85726f914b8dbb136abfb5c08f2de6152959ea3579e3d

Download Submit
C:\Windows\System\mQvmEDe.exe

Filesize
1.4MB

MD5
94dcb48947aa8cace3bdf14f7e9d88d1

SHA1
c67a93fe6e5428d9bb74c8962a173ce1077c77fb

SHA256
ac4087d0d48f60a9ac5a4419496cc870a84742ba013bf198f20b51edb3e51668

SHA512
d8159c7cdf6852bc2433907fb744f5ccfcbe19d405c6d23451eda2e221d5452fb1c2f3e293d40ac70d5a6bd9f8f52ed20132aa21b3cb28e9cb8828496270c88a

Download Submit
C:\Windows\System\nnqcVSM.exe

Filesize
1.4MB

MD5
48ea0e279b791d58d3eedf0c8ea82316

SHA1
397b8ccf87079982ffb8784de21eed3b2f5a6906

SHA256
85b0c9ec2e9dc2c8c1a2634f02288213c037235d5f97b7d9778577c39513484a

SHA512
888e457945503e8ed1341952c826a3c5373b5d349c77ddacc310d0e5f90673ceb36c016f696b8f2d0bfcb5eee7688917639cb6b5f4e5063f7bb5741d49637494

Download Submit
C:\Windows\System\oNYOZns.exe

Filesize
1.4MB

MD5
1a8ff0c9f374e3eab7a95a112ce89d2c

SHA1
fab631247ab52868a7791c4a775317c194be60dc

SHA256
70fee5e8cb4e67bd5978df32e10b5bf7a31057a2725e82b02183f87cc177c78e

SHA512
5fd7bf77314fac3a71e44c49ebfe2b979e065825c9cebd781686f0faabccfe203317a9ce789e2f80ba96c2e2fb976b5d8e3ffd8ec0a77a289866a45413282a79

Download Submit
C:\Windows\System\oNaEeWT.exe

Filesize
1.4MB

MD5
7d3530111a270db8dcd096370c91e4ce

SHA1
a5977fd3019f7db760e54d3051d40fa35108517f

SHA256
e79b9c531afbe6229eca274467d410886d7947411e40ae45cad49b54229709fe

SHA512
3757971336b957843ffd43c4a29b4bdc59d39b35ce30561e6f9db00ac0cfe91fa0cf41587a623f683313ed25aec0c5844bcd4396eedfe1163ff7695ac7394481

Download Submit
C:\Windows\System\pPKrKAL.exe

Filesize
1.4MB

MD5
fad61c6c4f8820d7e3c4ce5eb85a4ca5

SHA1
ae6e7c38fe29afecd3534971692d0ef1c5094f66

SHA256
e6f9ae8491fa2a1bba4b113c59e5268dc81317d5529936209c5615e2244f9b9c

SHA512
aadfa8f418329696b745fe183353d91e8eb18d06f5c930f4a2f3ab61883219f523a2f1aa74508e5d7689dca7db71cd102e3feb1ec445fa42f6ce76ce1078a100

Download Submit
C:\Windows\System\qRXLrds.exe

Filesize
1.4MB

MD5
9ec7b3135c38ead9a612d43554f7add3

SHA1
2efe8aabefea85dec2a1dac4375dd17c4937996c

SHA256
0b58810b4d41830a4c977ed4218c75a594fdabc702daba8f0d56e1b8d9b3ea5d

SHA512
bb6f10e1b1d39ca266f4a7be2b994f62be427fb5f88079dff072928d867c182539f39f0acb63cbb183d24949d39aca9ae2c8c51d1d9e321de2a19ca69ec2588d

Download Submit
C:\Windows\System\rsIYZHf.exe

Filesize
1.4MB

MD5
4695ba08da8e77f2c8142987dd54c427

SHA1
19508ee0aba5a8b129c0146d9305f6e1644c7567

SHA256
907c8a7bbec2fd373d099d005ad252a7001e57bf9fbc295e0d61b7c0f76f0227

SHA512
28c99bc3775d66d0f02794b68b0dc90b5ffb4941e59620266e342ce3126fa0c4452f156d2aba8f272e34a4b621cb6e94392010675bb357233b956b22ee8ce259

Download Submit
C:\Windows\System\tuJtdcm.exe

Filesize
1.4MB

MD5
4cd5c12cdec332a086346c52d81544ea

SHA1
f95db10ad2eb2305c58bceb07c427102e6a17d03

SHA256
8a215add48add04920919e48b5af74e292480a88ab85651131e282a33bb158f0

SHA512
88285b990680ca30743f70cabfa6dfcb17d43a2cce94b47c4b53cdb843755536961be2b7ee93078582fe895595810350d4c6403f48c8a723e5bcb09e2c36fc16

Download Submit
C:\Windows\System\uAVXCbK.exe

Filesize
1.4MB

MD5
f118a66031863cf74efb9feac6ef51ad

SHA1
7843542d264c58c910ee6ebd239368f044146c7c

SHA256
fb6a30b1cd1275b8be6791e98c5c2538ce6bde54bf504f48d12dd0b9b0cc57bd

SHA512
1c7a6f3e23952144848763779989e82d3f178b175c1bff15491ebd26fe4abbb65be998f096c3b9864cea72142ced390c94fbb7f50a255a5ec006b4ee1776bcf0

Download Submit
C:\Windows\System\wejsIMM.exe

Filesize
1.4MB

MD5
366c089c9045b3e8b0f6ccee3f0a9105

SHA1
00669de8f6a3a5e298058ea899e071c374c479f1

SHA256
10b28d2c745cd80224c3c219c2539e90101de3dc69f35d161197268244cb9350

SHA512
6371ef5eadf042bbb82c77a73041da2b402c3250518d8cb571e141204ef5df2c02b79efd7e5b131b9ba20c4305084973e579a7b07c7e2c0c6776970033b20cd3

Download Submit
C:\Windows\System\xOLYdoO.exe

Filesize
1.4MB

MD5
7e25329eb81462ac33df1fcefc323204

SHA1
71b7c073241c2f5fbd00f34d99045fb93e426fc4

SHA256
4df130d4e005b09a2a3fc5810e802aae18f5d6fbd54d5d1c74d55832af4d079a

SHA512
7d7fb943cfa183e0489543009499477ee2b1bd7e0341696e6fae80aa56db6babfd00ce69b6fcc61e352b24da8dec79470ed156ff03f21bcc7cf0a01ee2223e4f

Download Submit
memory/32-1-0x00000126707E0000-0x00000126707F0000-memory.dmp

Filesize
64KB

Download
memory/32-0-0x00007FF6A25F0000-0x00007FF6A29E2000-memory.dmp

Filesize
3.9MB

Download
memory/768-3235-0x00007FF7B4BB0000-0x00007FF7B4FA2000-memory.dmp

Filesize
3.9MB

Download
memory/768-578-0x00007FF7B4BB0000-0x00007FF7B4FA2000-memory.dmp

Filesize
3.9MB

Download
memory/1268-672-0x00007FF6A8210000-0x00007FF6A8602000-memory.dmp

Filesize
3.9MB

Download
memory/1268-3257-0x00007FF6A8210000-0x00007FF6A8602000-memory.dmp

Filesize
3.9MB

Download
memory/1272-3277-0x00007FF75BE10000-0x00007FF75C202000-memory.dmp

Filesize
3.9MB

Download
memory/1272-668-0x00007FF75BE10000-0x00007FF75C202000-memory.dmp

Filesize
3.9MB

Download
memory/1284-3241-0x00007FF7410A0000-0x00007FF741492000-memory.dmp

Filesize
3.9MB

Download
memory/1284-677-0x00007FF7410A0000-0x00007FF741492000-memory.dmp

Filesize
3.9MB

Download
memory/1416-28-0x00007FF77D880000-0x00007FF77DC72000-memory.dmp

Filesize
3.9MB

Download
memory/1416-3216-0x00007FF77D880000-0x00007FF77DC72000-memory.dmp

Filesize
3.9MB

Download
memory/1416-3211-0x00007FF77D880000-0x00007FF77DC72000-memory.dmp

Filesize
3.9MB

Download
memory/1572-3228-0x00007FF675910000-0x00007FF675D02000-memory.dmp

Filesize
3.9MB

Download
memory/1572-673-0x00007FF675910000-0x00007FF675D02000-memory.dmp

Filesize
3.9MB

Download
memory/2016-3249-0x00007FF6561F0000-0x00007FF6565E2000-memory.dmp

Filesize
3.9MB

Download
memory/2016-670-0x00007FF6561F0000-0x00007FF6565E2000-memory.dmp

Filesize
3.9MB

Download
memory/2356-3227-0x00007FF6095C0000-0x00007FF6099B2000-memory.dmp

Filesize
3.9MB

Download
memory/2356-662-0x00007FF6095C0000-0x00007FF6099B2000-memory.dmp

Filesize
3.9MB

Download
memory/2420-676-0x00007FF76AC70000-0x00007FF76B062000-memory.dmp

Filesize
3.9MB

Download
memory/2420-3243-0x00007FF76AC70000-0x00007FF76B062000-memory.dmp

Filesize
3.9MB

Download
memory/2484-3230-0x00007FF628440000-0x00007FF628832000-memory.dmp

Filesize
3.9MB

Download
memory/2484-302-0x00007FF628440000-0x00007FF628832000-memory.dmp

Filesize
3.9MB

Download
memory/2656-3258-0x00007FF6351F0000-0x00007FF6355E2000-memory.dmp

Filesize
3.9MB

Download
memory/2656-363-0x00007FF6351F0000-0x00007FF6355E2000-memory.dmp

Filesize
3.9MB

Download
memory/3252-669-0x00007FF604E60000-0x00007FF605252000-memory.dmp

Filesize
3.9MB

Download
memory/3252-3245-0x00007FF604E60000-0x00007FF605252000-memory.dmp

Filesize
3.9MB

Download
memory/3464-674-0x00007FF7CA7B0000-0x00007FF7CABA2000-memory.dmp

Filesize
3.9MB

Download
memory/3464-3214-0x00007FF7CA7B0000-0x00007FF7CABA2000-memory.dmp

Filesize
3.9MB

Download
memory/3656-392-0x00007FF6286D0000-0x00007FF628AC2000-memory.dmp

Filesize
3.9MB

Download
memory/3656-3255-0x00007FF6286D0000-0x00007FF628AC2000-memory.dmp

Filesize
3.9MB

Download
memory/4128-576-0x00007FF7AAF10000-0x00007FF7AB302000-memory.dmp

Filesize
3.9MB

Download
memory/4128-3237-0x00007FF7AAF10000-0x00007FF7AB302000-memory.dmp

Filesize
3.9MB

Download
memory/4488-51-0x00007FF73ED60000-0x00007FF73F152000-memory.dmp

Filesize
3.9MB

Download
memory/4488-3221-0x00007FF73ED60000-0x00007FF73F152000-memory.dmp

Filesize
3.9MB

Download
memory/4504-675-0x00007FF611100000-0x00007FF6114F2000-memory.dmp

Filesize
3.9MB

Download
memory/4504-3222-0x00007FF611100000-0x00007FF6114F2000-memory.dmp

Filesize
3.9MB

Download
memory/4608-3239-0x00007FF78C640000-0x00007FF78CA32000-memory.dmp

Filesize
3.9MB

Download
memory/4608-671-0x00007FF78C640000-0x00007FF78CA32000-memory.dmp

Filesize
3.9MB

Download
memory/4848-3212-0x00007FF718020000-0x00007FF718412000-memory.dmp

Filesize
3.9MB

Download
memory/4848-3224-0x00007FF718020000-0x00007FF718412000-memory.dmp

Filesize
3.9MB

Download
memory/4848-46-0x00007FF718020000-0x00007FF718412000-memory.dmp

Filesize
3.9MB

Download
memory/4904-3218-0x00007FF70CE50000-0x00007FF70D242000-memory.dmp

Filesize
3.9MB

Download
memory/4904-33-0x00007FF70CE50000-0x00007FF70D242000-memory.dmp

Filesize
3.9MB

Download
memory/5012-667-0x00007FF702250000-0x00007FF702642000-memory.dmp

Filesize
3.9MB

Download
memory/5012-3232-0x00007FF702250000-0x00007FF702642000-memory.dmp

Filesize
3.9MB

Download
memory/5016-229-0x0000020F9D710000-0x0000020F9D720000-memory.dmp

Filesize
64KB

Download
memory/5016-221-0x00007FFE009D0000-0x00007FFE01491000-memory.dmp

Filesize
10.8MB

Download
memory/5016-230-0x0000020F9D710000-0x0000020F9D720000-memory.dmp

Filesize
64KB

Download
memory/5016-1066-0x0000020F9DAC0000-0x0000020F9DAE2000-memory.dmp

Filesize
136KB

Download
memory/5016-2435-0x00007FFE009D0000-0x00007FFE01491000-memory.dmp

Filesize
10.8MB

Download