xmrig | e537c089fe705808306bc63a2a62ac4be5e9297a4124ccf80f3ea0e4dd46571e

Analysis

max time kernel
63s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 04:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
Size

1.4MB
MD5

0454463fb51b881a49aa3bdf0232d0e6
SHA1

949a4a7ac79118435243687bc9a204b01f14f7f1
SHA256

e537c089fe705808306bc63a2a62ac4be5e9297a4124ccf80f3ea0e4dd46571e
SHA512

407de3a2574becaabc6fc65ad76ab2c8dd594584a79355ec7eb4538732802e65464d286d11e91be375dea19b7d0a2d30af7d06d3182557727ecbf8e8cb0c20d4
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYKpGncHBN/VPwlZCJ:Lz071uv4BPMkibTIA5CJ/

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 42 IoCs

miner

resource	yara_rule
behavioral2/memory/1516-248-0x00007FF6D67B0000-0x00007FF6D6BA2000-memory.dmp	xmrig
behavioral2/memory/64-244-0x00007FF70C7E0000-0x00007FF70CBD2000-memory.dmp	xmrig
behavioral2/memory/1936-178-0x00007FF7BF5B0000-0x00007FF7BF9A2000-memory.dmp	xmrig
behavioral2/memory/5060-314-0x00007FF66A600000-0x00007FF66A9F2000-memory.dmp	xmrig
behavioral2/memory/1924-394-0x00007FF68C820000-0x00007FF68CC12000-memory.dmp	xmrig
behavioral2/memory/1012-441-0x00007FF6998E0000-0x00007FF699CD2000-memory.dmp	xmrig
behavioral2/memory/2968-586-0x00007FF691010000-0x00007FF691402000-memory.dmp	xmrig
behavioral2/memory/4940-597-0x00007FF7EB7E0000-0x00007FF7EBBD2000-memory.dmp	xmrig
behavioral2/memory/1192-596-0x00007FF71CC10000-0x00007FF71D002000-memory.dmp	xmrig
behavioral2/memory/3356-440-0x00007FF6BC570000-0x00007FF6BC962000-memory.dmp	xmrig
behavioral2/memory/2744-439-0x00007FF777C40000-0x00007FF778032000-memory.dmp	xmrig
behavioral2/memory/2328-438-0x00007FF70B580000-0x00007FF70B972000-memory.dmp	xmrig
behavioral2/memory/2352-437-0x00007FF61C970000-0x00007FF61CD62000-memory.dmp	xmrig
behavioral2/memory/860-436-0x00007FF77C630000-0x00007FF77CA22000-memory.dmp	xmrig
behavioral2/memory/3948-435-0x00007FF6708F0000-0x00007FF670CE2000-memory.dmp	xmrig
behavioral2/memory/2200-434-0x00007FF6DDF10000-0x00007FF6DE302000-memory.dmp	xmrig
behavioral2/memory/4616-433-0x00007FF7C0990000-0x00007FF7C0D82000-memory.dmp	xmrig
behavioral2/memory/3428-432-0x00007FF7DA6F0000-0x00007FF7DAAE2000-memory.dmp	xmrig
behavioral2/memory/3448-429-0x00007FF6C8680000-0x00007FF6C8A72000-memory.dmp	xmrig
behavioral2/memory/1848-389-0x00007FF68B3B0000-0x00007FF68B7A2000-memory.dmp	xmrig
behavioral2/memory/4420-109-0x00007FF784C90000-0x00007FF785082000-memory.dmp	xmrig
behavioral2/memory/4420-4633-0x00007FF784C90000-0x00007FF785082000-memory.dmp	xmrig
behavioral2/memory/1936-4635-0x00007FF7BF5B0000-0x00007FF7BF9A2000-memory.dmp	xmrig
behavioral2/memory/1192-4641-0x00007FF71CC10000-0x00007FF71D002000-memory.dmp	xmrig
behavioral2/memory/1516-4643-0x00007FF6D67B0000-0x00007FF6D6BA2000-memory.dmp	xmrig
behavioral2/memory/3428-4639-0x00007FF7DA6F0000-0x00007FF7DAAE2000-memory.dmp	xmrig
behavioral2/memory/64-4637-0x00007FF70C7E0000-0x00007FF70CBD2000-memory.dmp	xmrig
behavioral2/memory/1012-4661-0x00007FF6998E0000-0x00007FF699CD2000-memory.dmp	xmrig
behavioral2/memory/3356-4657-0x00007FF6BC570000-0x00007FF6BC962000-memory.dmp	xmrig
behavioral2/memory/860-4654-0x00007FF77C630000-0x00007FF77CA22000-memory.dmp	xmrig
behavioral2/memory/1848-4652-0x00007FF68B3B0000-0x00007FF68B7A2000-memory.dmp	xmrig
behavioral2/memory/1924-4649-0x00007FF68C820000-0x00007FF68CC12000-memory.dmp	xmrig
behavioral2/memory/2200-4668-0x00007FF6DDF10000-0x00007FF6DE302000-memory.dmp	xmrig
behavioral2/memory/3448-4665-0x00007FF6C8680000-0x00007FF6C8A72000-memory.dmp	xmrig
behavioral2/memory/4616-4660-0x00007FF7C0990000-0x00007FF7C0D82000-memory.dmp	xmrig
behavioral2/memory/2744-4656-0x00007FF777C40000-0x00007FF778032000-memory.dmp	xmrig
behavioral2/memory/4940-4648-0x00007FF7EB7E0000-0x00007FF7EBBD2000-memory.dmp	xmrig
behavioral2/memory/2352-4672-0x00007FF61C970000-0x00007FF61CD62000-memory.dmp	xmrig
behavioral2/memory/2968-4679-0x00007FF691010000-0x00007FF691402000-memory.dmp	xmrig
behavioral2/memory/2328-4675-0x00007FF70B580000-0x00007FF70B972000-memory.dmp	xmrig
behavioral2/memory/5060-4667-0x00007FF66A600000-0x00007FF66A9F2000-memory.dmp	xmrig
behavioral2/memory/3948-4664-0x00007FF6708F0000-0x00007FF670CE2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4420	gMrcVQw.exe
1192	SJkDphy.exe
1936	OgMQKMY.exe
64	mbEZiUC.exe
1516	eQLozJq.exe
5060	PfHpJBq.exe
1848	bIjfpll.exe
1924	bkeuQzP.exe
3448	vBwvvDr.exe
3428	DIgcSRP.exe
4616	jSkZPUV.exe
2200	HJzFFnd.exe
4940	hLFBxJf.exe
3948	ZYsneWv.exe
860	LAfHJCQ.exe
2352	nkGaKYx.exe
2328	ezhjFya.exe
2744	LezLVUK.exe
3356	GtcCowM.exe
1012	wLGPXnL.exe
2968	ackGzNS.exe
1884	beGWrlx.exe
836	opWaIxL.exe
2016	acdOOse.exe
688	iSFlLtD.exe
1008	dTaAeAP.exe
4384	qflaYiR.exe
2980	dYabVcL.exe
4444	GezsFyT.exe
2604	QWeUBQk.exe
3052	BnxZucz.exe
3408	xuDoXcJ.exe
5088	TjPPbeE.exe
3848	HOKauoj.exe
3804	mqwovmR.exe
1140	RCInpVP.exe
2252	kKVZgIp.exe
4788	vGXBbqJ.exe
4824	sffZmiQ.exe
208	PuJJYmZ.exe
5064	nWeDvSL.exe
2472	iagziKH.exe
2068	loJVxNW.exe
2052	PMTaiHV.exe
1412	FlExQyB.exe
1992	IlpNuhA.exe
4140	tAzCBQf.exe
3188	MBzQBip.exe
3880	Vzwszbz.exe
1956	dybZmdy.exe
4916	AfMWQTX.exe
4712	uMKlWog.exe
3036	xtAapEW.exe
1188	cOgUcYL.exe
1288	DNfdeul.exe
2184	cwbDFEV.exe
3008	gCSeptQ.exe
3296	XCqPUiq.exe
4928	hXSUKee.exe
624	YAtRlfP.exe
3680	ACgqBZN.exe
3884	PDbMpBY.exe
2788	FvkLEeG.exe
224	gMuTSzC.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2616-0-0x00007FF7BC4B0000-0x00007FF7BC8A2000-memory.dmp	upx
behavioral2/files/0x0031000000023bbd-29.dat	upx
behavioral2/files/0x000a000000023bcb-137.dat	upx
behavioral2/memory/1516-248-0x00007FF6D67B0000-0x00007FF6D6BA2000-memory.dmp	upx
behavioral2/memory/64-244-0x00007FF70C7E0000-0x00007FF70CBD2000-memory.dmp	upx
behavioral2/files/0x000a000000023bc5-217.dat	upx
behavioral2/files/0x000a000000023bd4-139.dat	upx
behavioral2/files/0x000a000000023be3-216.dat	upx
behavioral2/files/0x000a000000023be2-206.dat	upx
behavioral2/files/0x000a000000023be1-203.dat	upx
behavioral2/files/0x000a000000023be0-202.dat	upx
behavioral2/files/0x000a000000023bca-198.dat	upx
behavioral2/files/0x000a000000023bdf-193.dat	upx
behavioral2/files/0x000a000000023bc3-190.dat	upx
behavioral2/files/0x000a000000023bdd-182.dat	upx
behavioral2/memory/1936-178-0x00007FF7BF5B0000-0x00007FF7BF9A2000-memory.dmp	upx
behavioral2/files/0x000a000000023bdc-174.dat	upx
behavioral2/files/0x000a000000023bc9-169.dat	upx
behavioral2/files/0x000a000000023bda-162.dat	upx
behavioral2/files/0x000a000000023bcf-159.dat	upx
behavioral2/files/0x000a000000023bd8-150.dat	upx
behavioral2/files/0x000a000000023bce-144.dat	upx
behavioral2/files/0x000a000000023bd7-143.dat	upx
behavioral2/files/0x000a000000023bd6-142.dat	upx
behavioral2/files/0x000a000000023bcc-141.dat	upx
behavioral2/files/0x000a000000023bd5-140.dat	upx
behavioral2/files/0x000a000000023bd3-127.dat	upx
behavioral2/files/0x000a000000023bd2-126.dat	upx
behavioral2/files/0x0031000000023bbe-122.dat	upx
behavioral2/memory/5060-314-0x00007FF66A600000-0x00007FF66A9F2000-memory.dmp	upx
behavioral2/memory/1924-394-0x00007FF68C820000-0x00007FF68CC12000-memory.dmp	upx
behavioral2/memory/1012-441-0x00007FF6998E0000-0x00007FF699CD2000-memory.dmp	upx
behavioral2/memory/2968-586-0x00007FF691010000-0x00007FF691402000-memory.dmp	upx
behavioral2/memory/4940-597-0x00007FF7EB7E0000-0x00007FF7EBBD2000-memory.dmp	upx
behavioral2/memory/1192-596-0x00007FF71CC10000-0x00007FF71D002000-memory.dmp	upx
behavioral2/memory/3356-440-0x00007FF6BC570000-0x00007FF6BC962000-memory.dmp	upx
behavioral2/memory/2744-439-0x00007FF777C40000-0x00007FF778032000-memory.dmp	upx
behavioral2/memory/2328-438-0x00007FF70B580000-0x00007FF70B972000-memory.dmp	upx
behavioral2/memory/2352-437-0x00007FF61C970000-0x00007FF61CD62000-memory.dmp	upx
behavioral2/memory/860-436-0x00007FF77C630000-0x00007FF77CA22000-memory.dmp	upx
behavioral2/memory/3948-435-0x00007FF6708F0000-0x00007FF670CE2000-memory.dmp	upx
behavioral2/memory/2200-434-0x00007FF6DDF10000-0x00007FF6DE302000-memory.dmp	upx
behavioral2/memory/4616-433-0x00007FF7C0990000-0x00007FF7C0D82000-memory.dmp	upx
behavioral2/memory/3428-432-0x00007FF7DA6F0000-0x00007FF7DAAE2000-memory.dmp	upx
behavioral2/memory/3448-429-0x00007FF6C8680000-0x00007FF6C8A72000-memory.dmp	upx
behavioral2/memory/1848-389-0x00007FF68B3B0000-0x00007FF68B7A2000-memory.dmp	upx
behavioral2/files/0x000a000000023bde-189.dat	upx
behavioral2/memory/4420-109-0x00007FF784C90000-0x00007FF785082000-memory.dmp	upx
behavioral2/files/0x000a000000023bdb-167.dat	upx
behavioral2/files/0x000a000000023bd1-105.dat	upx
behavioral2/files/0x000a000000023bd9-157.dat	upx
behavioral2/files/0x000a000000023bc8-153.dat	upx
behavioral2/files/0x000a000000023bc7-94.dat	upx
behavioral2/files/0x000a000000023bc6-89.dat	upx
behavioral2/files/0x000a000000023bcd-86.dat	upx
behavioral2/files/0x000a000000023bc2-116.dat	upx
behavioral2/files/0x000a000000023bc1-108.dat	upx
behavioral2/files/0x000a000000023bd0-104.dat	upx
behavioral2/files/0x000a000000023bc0-59.dat	upx
behavioral2/files/0x000a000000023bc4-50.dat	upx
behavioral2/files/0x000a000000023bbf-47.dat	upx
behavioral2/files/0x0031000000023bbc-34.dat	upx
behavioral2/files/0x000b000000023bbb-6.dat	upx
behavioral2/memory/4420-4633-0x00007FF784C90000-0x00007FF785082000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\fhzMGfv.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\lMqktXR.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\IUnfXex.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\aaEaQFO.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\DTAYdGA.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\doiRJpM.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\byWqQnJ.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\UoSZeks.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\kgorOyo.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\ppmkOTM.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\TSDwrxa.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\pcTrGSu.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\sSfqzVR.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\NEzijnC.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\cIvejaf.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\xluLegY.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\Qbybxdy.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\MqXRsxV.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\zLNFrYA.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\qaJDCLD.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\sEUavEa.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\REwyGwz.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\dPgnEck.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\DmwwiiQ.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\HENiGLj.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\mipHljP.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\rqCXizs.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\XqTEwyS.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\CuryRBo.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\hEmbkDD.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\pEvZgrZ.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\XjTpqxG.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\mKvIKGC.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\uwffKNJ.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\vBgmmLz.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\LbjTyTZ.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\ubYFIao.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\lGgxhRt.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\tzuwdQy.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\kKVZgIp.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\QqbUrdw.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\jEeAOoU.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\jLozYbc.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\lpDAYmr.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\zMuXTCa.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\iTatanK.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\mNBewLp.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\xgYbsYF.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\QTqKLjP.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\YOsHunF.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\PViXNcG.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\puTvaMJ.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\MzDCAVm.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\JvgKXyt.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\opPUXNh.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\acdOOse.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\YdPskxc.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\JHGFeBQ.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\pVEhCDO.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\SZXkOsU.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\MMAoDJh.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\dYMQzOo.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\OgezVJA.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\KQOWwdv.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4956	powershell.exe
4956	powershell.exe
4956	powershell.exe
4956	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4956	powershell.exe
Token: SeLockMemoryPrivilege	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 4956	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	85
PID 2616 wrote to memory of 4956	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	85
PID 2616 wrote to memory of 4420	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	86
PID 2616 wrote to memory of 4420	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	86
PID 2616 wrote to memory of 1936	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	87
PID 2616 wrote to memory of 1936	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	87
PID 2616 wrote to memory of 1192	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	88
PID 2616 wrote to memory of 1192	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	88
PID 2616 wrote to memory of 1848	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	89
PID 2616 wrote to memory of 1848	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	89
PID 2616 wrote to memory of 64	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	90
PID 2616 wrote to memory of 64	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	90
PID 2616 wrote to memory of 1516	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	91
PID 2616 wrote to memory of 1516	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	91
PID 2616 wrote to memory of 5060	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	92
PID 2616 wrote to memory of 5060	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	92
PID 2616 wrote to memory of 1924	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	93
PID 2616 wrote to memory of 1924	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	93
PID 2616 wrote to memory of 3448	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	94
PID 2616 wrote to memory of 3448	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	94
PID 2616 wrote to memory of 3428	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	95
PID 2616 wrote to memory of 3428	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	95
PID 2616 wrote to memory of 2352	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	96
PID 2616 wrote to memory of 2352	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	96
PID 2616 wrote to memory of 4616	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	97
PID 2616 wrote to memory of 4616	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	97
PID 2616 wrote to memory of 2200	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	98
PID 2616 wrote to memory of 2200	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	98
PID 2616 wrote to memory of 3356	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	99
PID 2616 wrote to memory of 3356	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	99
PID 2616 wrote to memory of 4940	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	100
PID 2616 wrote to memory of 4940	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	100
PID 2616 wrote to memory of 3948	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	101
PID 2616 wrote to memory of 3948	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	101
PID 2616 wrote to memory of 860	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	102
PID 2616 wrote to memory of 860	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	102
PID 2616 wrote to memory of 4384	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	103
PID 2616 wrote to memory of 4384	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	103
PID 2616 wrote to memory of 2328	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	104
PID 2616 wrote to memory of 2328	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	104
PID 2616 wrote to memory of 2744	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	105
PID 2616 wrote to memory of 2744	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	105
PID 2616 wrote to memory of 1012	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	106
PID 2616 wrote to memory of 1012	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	106
PID 2616 wrote to memory of 2968	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	107
PID 2616 wrote to memory of 2968	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	107
PID 2616 wrote to memory of 1884	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	108
PID 2616 wrote to memory of 1884	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	108
PID 2616 wrote to memory of 836	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	109
PID 2616 wrote to memory of 836	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	109
PID 2616 wrote to memory of 2016	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	110
PID 2616 wrote to memory of 2016	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	110
PID 2616 wrote to memory of 688	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	111
PID 2616 wrote to memory of 688	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	111
PID 2616 wrote to memory of 1008	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	112
PID 2616 wrote to memory of 1008	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	112
PID 2616 wrote to memory of 2980	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	113
PID 2616 wrote to memory of 2980	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	113
PID 2616 wrote to memory of 4444	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	114
PID 2616 wrote to memory of 4444	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	114
PID 2616 wrote to memory of 2604	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	115
PID 2616 wrote to memory of 2604	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	115
PID 2616 wrote to memory of 3052	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	116
PID 2616 wrote to memory of 3052	2616	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4956
- C:\Windows\System\gMrcVQw.exe
  C:\Windows\System\gMrcVQw.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\OgMQKMY.exe
  C:\Windows\System\OgMQKMY.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\SJkDphy.exe
  C:\Windows\System\SJkDphy.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\bIjfpll.exe
  C:\Windows\System\bIjfpll.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\mbEZiUC.exe
  C:\Windows\System\mbEZiUC.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\eQLozJq.exe
  C:\Windows\System\eQLozJq.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\PfHpJBq.exe
  C:\Windows\System\PfHpJBq.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\bkeuQzP.exe
  C:\Windows\System\bkeuQzP.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\vBwvvDr.exe
  C:\Windows\System\vBwvvDr.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\DIgcSRP.exe
  C:\Windows\System\DIgcSRP.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\nkGaKYx.exe
  C:\Windows\System\nkGaKYx.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\jSkZPUV.exe
  C:\Windows\System\jSkZPUV.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\HJzFFnd.exe
  C:\Windows\System\HJzFFnd.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\GtcCowM.exe
  C:\Windows\System\GtcCowM.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\hLFBxJf.exe
  C:\Windows\System\hLFBxJf.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\ZYsneWv.exe
  C:\Windows\System\ZYsneWv.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\LAfHJCQ.exe
  C:\Windows\System\LAfHJCQ.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\qflaYiR.exe
  C:\Windows\System\qflaYiR.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\ezhjFya.exe
  C:\Windows\System\ezhjFya.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\LezLVUK.exe
  C:\Windows\System\LezLVUK.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\wLGPXnL.exe
  C:\Windows\System\wLGPXnL.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\ackGzNS.exe
  C:\Windows\System\ackGzNS.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\beGWrlx.exe
  C:\Windows\System\beGWrlx.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\opWaIxL.exe
  C:\Windows\System\opWaIxL.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\acdOOse.exe
  C:\Windows\System\acdOOse.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\iSFlLtD.exe
  C:\Windows\System\iSFlLtD.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\dTaAeAP.exe
  C:\Windows\System\dTaAeAP.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\dYabVcL.exe
  C:\Windows\System\dYabVcL.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\GezsFyT.exe
  C:\Windows\System\GezsFyT.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\QWeUBQk.exe
  C:\Windows\System\QWeUBQk.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\BnxZucz.exe
  C:\Windows\System\BnxZucz.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\xuDoXcJ.exe
  C:\Windows\System\xuDoXcJ.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\TjPPbeE.exe
  C:\Windows\System\TjPPbeE.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\HOKauoj.exe
  C:\Windows\System\HOKauoj.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System\mqwovmR.exe
  C:\Windows\System\mqwovmR.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\RCInpVP.exe
  C:\Windows\System\RCInpVP.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\kKVZgIp.exe
  C:\Windows\System\kKVZgIp.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\vGXBbqJ.exe
  C:\Windows\System\vGXBbqJ.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\sffZmiQ.exe
  C:\Windows\System\sffZmiQ.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\PuJJYmZ.exe
  C:\Windows\System\PuJJYmZ.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\nWeDvSL.exe
  C:\Windows\System\nWeDvSL.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\PDbMpBY.exe
  C:\Windows\System\PDbMpBY.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System\iagziKH.exe
  C:\Windows\System\iagziKH.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\loJVxNW.exe
  C:\Windows\System\loJVxNW.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\PMTaiHV.exe
  C:\Windows\System\PMTaiHV.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\FlExQyB.exe
  C:\Windows\System\FlExQyB.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\IlpNuhA.exe
  C:\Windows\System\IlpNuhA.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\tAzCBQf.exe
  C:\Windows\System\tAzCBQf.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\MBzQBip.exe
  C:\Windows\System\MBzQBip.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System\Vzwszbz.exe
  C:\Windows\System\Vzwszbz.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\dybZmdy.exe
  C:\Windows\System\dybZmdy.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\AfMWQTX.exe
  C:\Windows\System\AfMWQTX.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\uMKlWog.exe
  C:\Windows\System\uMKlWog.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\xtAapEW.exe
  C:\Windows\System\xtAapEW.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\cOgUcYL.exe
  C:\Windows\System\cOgUcYL.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\DNfdeul.exe
  C:\Windows\System\DNfdeul.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\cwbDFEV.exe
  C:\Windows\System\cwbDFEV.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\gCSeptQ.exe
  C:\Windows\System\gCSeptQ.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\XCqPUiq.exe
  C:\Windows\System\XCqPUiq.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\hXSUKee.exe
  C:\Windows\System\hXSUKee.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\YAtRlfP.exe
  C:\Windows\System\YAtRlfP.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\ACgqBZN.exe
  C:\Windows\System\ACgqBZN.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System\FvkLEeG.exe
  C:\Windows\System\FvkLEeG.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\gMuTSzC.exe
  C:\Windows\System\gMuTSzC.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\LQSuCur.exe
  C:\Windows\System\LQSuCur.exe
  2⤵
  PID:4488
- C:\Windows\System\eJzJsoL.exe
  C:\Windows\System\eJzJsoL.exe
  2⤵
  PID:4636
- C:\Windows\System\cYXmyHk.exe
  C:\Windows\System\cYXmyHk.exe
  2⤵
  PID:5072
- C:\Windows\System\LGYDuFV.exe
  C:\Windows\System\LGYDuFV.exe
  2⤵
  PID:4440
- C:\Windows\System\iqdHcLY.exe
  C:\Windows\System\iqdHcLY.exe
  2⤵
  PID:516
- C:\Windows\System\VzkgERD.exe
  C:\Windows\System\VzkgERD.exe
  2⤵
  PID:1560
- C:\Windows\System\ESioKze.exe
  C:\Windows\System\ESioKze.exe
  2⤵
  PID:4380
- C:\Windows\System\rDjiTvj.exe
  C:\Windows\System\rDjiTvj.exe
  2⤵
  PID:3236
- C:\Windows\System\coRaBMp.exe
  C:\Windows\System\coRaBMp.exe
  2⤵
  PID:3916
- C:\Windows\System\cwHTqKP.exe
  C:\Windows\System\cwHTqKP.exe
  2⤵
  PID:2680
- C:\Windows\System\hNmryDh.exe
  C:\Windows\System\hNmryDh.exe
  2⤵
  PID:1040
- C:\Windows\System\TXUGPnu.exe
  C:\Windows\System\TXUGPnu.exe
  2⤵
  PID:3048
- C:\Windows\System\JlwTJGB.exe
  C:\Windows\System\JlwTJGB.exe
  2⤵
  PID:468
- C:\Windows\System\BOtRCjT.exe
  C:\Windows\System\BOtRCjT.exe
  2⤵
  PID:2916
- C:\Windows\System\VPLkxoc.exe
  C:\Windows\System\VPLkxoc.exe
  2⤵
  PID:2932
- C:\Windows\System\LfrzbmU.exe
  C:\Windows\System\LfrzbmU.exe
  2⤵
  PID:4644
- C:\Windows\System\jLozYbc.exe
  C:\Windows\System\jLozYbc.exe
  2⤵
  PID:5148
- C:\Windows\System\XeiMtep.exe
  C:\Windows\System\XeiMtep.exe
  2⤵
  PID:5172
- C:\Windows\System\QVTZyiI.exe
  C:\Windows\System\QVTZyiI.exe
  2⤵
  PID:5204
- C:\Windows\System\jhSjuZq.exe
  C:\Windows\System\jhSjuZq.exe
  2⤵
  PID:5228
- C:\Windows\System\obzQDKa.exe
  C:\Windows\System\obzQDKa.exe
  2⤵
  PID:5252
- C:\Windows\System\DDyViXQ.exe
  C:\Windows\System\DDyViXQ.exe
  2⤵
  PID:5276
- C:\Windows\System\PhWwzuj.exe
  C:\Windows\System\PhWwzuj.exe
  2⤵
  PID:5304
- C:\Windows\System\mmcjSXF.exe
  C:\Windows\System\mmcjSXF.exe
  2⤵
  PID:5328
- C:\Windows\System\hcbMbUu.exe
  C:\Windows\System\hcbMbUu.exe
  2⤵
  PID:5356
- C:\Windows\System\yFqlnxS.exe
  C:\Windows\System\yFqlnxS.exe
  2⤵
  PID:5372
- C:\Windows\System\OjsaxRv.exe
  C:\Windows\System\OjsaxRv.exe
  2⤵
  PID:5396
- C:\Windows\System\rivrIDq.exe
  C:\Windows\System\rivrIDq.exe
  2⤵
  PID:5420
- C:\Windows\System\FxpXgmB.exe
  C:\Windows\System\FxpXgmB.exe
  2⤵
  PID:5436
- C:\Windows\System\ycJbOCV.exe
  C:\Windows\System\ycJbOCV.exe
  2⤵
  PID:5456
- C:\Windows\System\CbUhMlZ.exe
  C:\Windows\System\CbUhMlZ.exe
  2⤵
  PID:5480
- C:\Windows\System\IHjwdwn.exe
  C:\Windows\System\IHjwdwn.exe
  2⤵
  PID:5496
- C:\Windows\System\DQFXmUq.exe
  C:\Windows\System\DQFXmUq.exe
  2⤵
  PID:5512
- C:\Windows\System\dNxvsLP.exe
  C:\Windows\System\dNxvsLP.exe
  2⤵
  PID:5540
- C:\Windows\System\mrrLfLk.exe
  C:\Windows\System\mrrLfLk.exe
  2⤵
  PID:5556
- C:\Windows\System\CJMNIIX.exe
  C:\Windows\System\CJMNIIX.exe
  2⤵
  PID:5576
- C:\Windows\System\rKUzTAu.exe
  C:\Windows\System\rKUzTAu.exe
  2⤵
  PID:5624
- C:\Windows\System\DHcnqZh.exe
  C:\Windows\System\DHcnqZh.exe
  2⤵
  PID:5640
- C:\Windows\System\LdoIXZr.exe
  C:\Windows\System\LdoIXZr.exe
  2⤵
  PID:5656
- C:\Windows\System\ZcGdSSP.exe
  C:\Windows\System\ZcGdSSP.exe
  2⤵
  PID:5680
- C:\Windows\System\ulIWRhT.exe
  C:\Windows\System\ulIWRhT.exe
  2⤵
  PID:5696
- C:\Windows\System\obEMCkP.exe
  C:\Windows\System\obEMCkP.exe
  2⤵
  PID:5728
- C:\Windows\System\LsitTDn.exe
  C:\Windows\System\LsitTDn.exe
  2⤵
  PID:5764
- C:\Windows\System\Pouaphm.exe
  C:\Windows\System\Pouaphm.exe
  2⤵
  PID:5788
- C:\Windows\System\PTcPiai.exe
  C:\Windows\System\PTcPiai.exe
  2⤵
  PID:5816
- C:\Windows\System\DCrMSNi.exe
  C:\Windows\System\DCrMSNi.exe
  2⤵
  PID:5840
- C:\Windows\System\RzqpEam.exe
  C:\Windows\System\RzqpEam.exe
  2⤵
  PID:5856
- C:\Windows\System\GUpkvGr.exe
  C:\Windows\System\GUpkvGr.exe
  2⤵
  PID:5876
- C:\Windows\System\xCaGSCF.exe
  C:\Windows\System\xCaGSCF.exe
  2⤵
  PID:5900
- C:\Windows\System\VdRlzbN.exe
  C:\Windows\System\VdRlzbN.exe
  2⤵
  PID:5920
- C:\Windows\System\VMReeJd.exe
  C:\Windows\System\VMReeJd.exe
  2⤵
  PID:5944
- C:\Windows\System\tgrAumP.exe
  C:\Windows\System\tgrAumP.exe
  2⤵
  PID:5972
- C:\Windows\System\dZxfOkC.exe
  C:\Windows\System\dZxfOkC.exe
  2⤵
  PID:5996
- C:\Windows\System\OdJGeFM.exe
  C:\Windows\System\OdJGeFM.exe
  2⤵
  PID:6020
- C:\Windows\System\mkGSEyQ.exe
  C:\Windows\System\mkGSEyQ.exe
  2⤵
  PID:6040
- C:\Windows\System\fpxNrbo.exe
  C:\Windows\System\fpxNrbo.exe
  2⤵
  PID:6068
- C:\Windows\System\SriBmRT.exe
  C:\Windows\System\SriBmRT.exe
  2⤵
  PID:6092
- C:\Windows\System\MlRfaHn.exe
  C:\Windows\System\MlRfaHn.exe
  2⤵
  PID:6132
- C:\Windows\System\XGzaxYJ.exe
  C:\Windows\System\XGzaxYJ.exe
  2⤵
  PID:3120
- C:\Windows\System\SMxzxVT.exe
  C:\Windows\System\SMxzxVT.exe
  2⤵
  PID:3108
- C:\Windows\System\FibCGPC.exe
  C:\Windows\System\FibCGPC.exe
  2⤵
  PID:4944
- C:\Windows\System\UEYFOHI.exe
  C:\Windows\System\UEYFOHI.exe
  2⤵
  PID:3940
- C:\Windows\System\AlSlJyp.exe
  C:\Windows\System\AlSlJyp.exe
  2⤵
  PID:4180
- C:\Windows\System\vpUEFUw.exe
  C:\Windows\System\vpUEFUw.exe
  2⤵
  PID:2508
- C:\Windows\System\zvYEKye.exe
  C:\Windows\System\zvYEKye.exe
  2⤵
  PID:4736
- C:\Windows\System\NScQAXw.exe
  C:\Windows\System\NScQAXw.exe
  2⤵
  PID:3920
- C:\Windows\System\BfHDBro.exe
  C:\Windows\System\BfHDBro.exe
  2⤵
  PID:4772
- C:\Windows\System\CqQEHTm.exe
  C:\Windows\System\CqQEHTm.exe
  2⤵
  PID:5588
- C:\Windows\System\sSfqzVR.exe
  C:\Windows\System\sSfqzVR.exe
  2⤵
  PID:3084
- C:\Windows\System\NlDQhrc.exe
  C:\Windows\System\NlDQhrc.exe
  2⤵
  PID:2812
- C:\Windows\System\mLkMjnf.exe
  C:\Windows\System\mLkMjnf.exe
  2⤵
  PID:1552
- C:\Windows\System\PXERBTB.exe
  C:\Windows\System\PXERBTB.exe
  2⤵
  PID:1984
- C:\Windows\System\GaMEDbH.exe
  C:\Windows\System\GaMEDbH.exe
  2⤵
  PID:4608
- C:\Windows\System\xQHsBzO.exe
  C:\Windows\System\xQHsBzO.exe
  2⤵
  PID:6160
- C:\Windows\System\VfieQBZ.exe
  C:\Windows\System\VfieQBZ.exe
  2⤵
  PID:6304
- C:\Windows\System\wSmubfI.exe
  C:\Windows\System\wSmubfI.exe
  2⤵
  PID:6324
- C:\Windows\System\Vvlvnxg.exe
  C:\Windows\System\Vvlvnxg.exe
  2⤵
  PID:6340
- C:\Windows\System\eXhyXyb.exe
  C:\Windows\System\eXhyXyb.exe
  2⤵
  PID:6356
- C:\Windows\System\TfEOhgG.exe
  C:\Windows\System\TfEOhgG.exe
  2⤵
  PID:6372
- C:\Windows\System\wTERuyY.exe
  C:\Windows\System\wTERuyY.exe
  2⤵
  PID:6388
- C:\Windows\System\ROyraVw.exe
  C:\Windows\System\ROyraVw.exe
  2⤵
  PID:6404
- C:\Windows\System\diPQgeY.exe
  C:\Windows\System\diPQgeY.exe
  2⤵
  PID:6420
- C:\Windows\System\lJehdFA.exe
  C:\Windows\System\lJehdFA.exe
  2⤵
  PID:6440
- C:\Windows\System\VDNEaue.exe
  C:\Windows\System\VDNEaue.exe
  2⤵
  PID:6456
- C:\Windows\System\kRZjjAv.exe
  C:\Windows\System\kRZjjAv.exe
  2⤵
  PID:6472
- C:\Windows\System\JBCzgHi.exe
  C:\Windows\System\JBCzgHi.exe
  2⤵
  PID:6488
- C:\Windows\System\jzaaWha.exe
  C:\Windows\System\jzaaWha.exe
  2⤵
  PID:6504
- C:\Windows\System\UtPmOvx.exe
  C:\Windows\System\UtPmOvx.exe
  2⤵
  PID:6520
- C:\Windows\System\NwECkWH.exe
  C:\Windows\System\NwECkWH.exe
  2⤵
  PID:6536
- C:\Windows\System\SNDQFTv.exe
  C:\Windows\System\SNDQFTv.exe
  2⤵
  PID:6560
- C:\Windows\System\poPbvdd.exe
  C:\Windows\System\poPbvdd.exe
  2⤵
  PID:6576
- C:\Windows\System\mybanaK.exe
  C:\Windows\System\mybanaK.exe
  2⤵
  PID:6600
- C:\Windows\System\MVfDISd.exe
  C:\Windows\System\MVfDISd.exe
  2⤵
  PID:6620
- C:\Windows\System\ZtSyCUn.exe
  C:\Windows\System\ZtSyCUn.exe
  2⤵
  PID:6640
- C:\Windows\System\ReRtuDA.exe
  C:\Windows\System\ReRtuDA.exe
  2⤵
  PID:6660
- C:\Windows\System\WMQyFzU.exe
  C:\Windows\System\WMQyFzU.exe
  2⤵
  PID:6684
- C:\Windows\System\kkTjUKG.exe
  C:\Windows\System\kkTjUKG.exe
  2⤵
  PID:6700
- C:\Windows\System\SpapfCm.exe
  C:\Windows\System\SpapfCm.exe
  2⤵
  PID:6724
- C:\Windows\System\CZfPMDC.exe
  C:\Windows\System\CZfPMDC.exe
  2⤵
  PID:6740
- C:\Windows\System\dLbDOsM.exe
  C:\Windows\System\dLbDOsM.exe
  2⤵
  PID:6760
- C:\Windows\System\JPskPoi.exe
  C:\Windows\System\JPskPoi.exe
  2⤵
  PID:6780
- C:\Windows\System\kePOJVD.exe
  C:\Windows\System\kePOJVD.exe
  2⤵
  PID:6796
- C:\Windows\System\JbvTzlC.exe
  C:\Windows\System\JbvTzlC.exe
  2⤵
  PID:6820
- C:\Windows\System\DWAnydX.exe
  C:\Windows\System\DWAnydX.exe
  2⤵
  PID:6836
- C:\Windows\System\zLNFrYA.exe
  C:\Windows\System\zLNFrYA.exe
  2⤵
  PID:6856
- C:\Windows\System\lUOSNDO.exe
  C:\Windows\System\lUOSNDO.exe
  2⤵
  PID:6876
- C:\Windows\System\cahNqKG.exe
  C:\Windows\System\cahNqKG.exe
  2⤵
  PID:6896
- C:\Windows\System\IjGjBFe.exe
  C:\Windows\System\IjGjBFe.exe
  2⤵
  PID:6916
- C:\Windows\System\tQeqOEa.exe
  C:\Windows\System\tQeqOEa.exe
  2⤵
  PID:6932
- C:\Windows\System\vGwFvtE.exe
  C:\Windows\System\vGwFvtE.exe
  2⤵
  PID:6948
- C:\Windows\System\vbOFaNA.exe
  C:\Windows\System\vbOFaNA.exe
  2⤵
  PID:6964
- C:\Windows\System\rFgbDOC.exe
  C:\Windows\System\rFgbDOC.exe
  2⤵
  PID:6988
- C:\Windows\System\gSgUizh.exe
  C:\Windows\System\gSgUizh.exe
  2⤵
  PID:7004
- C:\Windows\System\cfvIkqx.exe
  C:\Windows\System\cfvIkqx.exe
  2⤵
  PID:7020
- C:\Windows\System\cKpRQYq.exe
  C:\Windows\System\cKpRQYq.exe
  2⤵
  PID:7044
- C:\Windows\System\wMRKpKn.exe
  C:\Windows\System\wMRKpKn.exe
  2⤵
  PID:7060
- C:\Windows\System\JPprswC.exe
  C:\Windows\System\JPprswC.exe
  2⤵
  PID:7080
- C:\Windows\System\ZNhPuUm.exe
  C:\Windows\System\ZNhPuUm.exe
  2⤵
  PID:7100
- C:\Windows\System\OqyQDlt.exe
  C:\Windows\System\OqyQDlt.exe
  2⤵
  PID:7116
- C:\Windows\System\iWobGjW.exe
  C:\Windows\System\iWobGjW.exe
  2⤵
  PID:7132
- C:\Windows\System\ZyxPzgW.exe
  C:\Windows\System\ZyxPzgW.exe
  2⤵
  PID:7152
- C:\Windows\System\YWFfIvg.exe
  C:\Windows\System\YWFfIvg.exe
  2⤵
  PID:5808
- C:\Windows\System\WEwMrSv.exe
  C:\Windows\System\WEwMrSv.exe
  2⤵
  PID:4492
- C:\Windows\System\EcGDTFp.exe
  C:\Windows\System\EcGDTFp.exe
  2⤵
  PID:736
- C:\Windows\System\KEemCCc.exe
  C:\Windows\System\KEemCCc.exe
  2⤵
  PID:4980
- C:\Windows\System\utTgayc.exe
  C:\Windows\System\utTgayc.exe
  2⤵
  PID:2964
- C:\Windows\System\LJDXczA.exe
  C:\Windows\System\LJDXczA.exe
  2⤵
  PID:668
- C:\Windows\System\gjDOKZf.exe
  C:\Windows\System\gjDOKZf.exe
  2⤵
  PID:3856
- C:\Windows\System\ShRDOnW.exe
  C:\Windows\System\ShRDOnW.exe
  2⤵
  PID:5128
- C:\Windows\System\YlchWIA.exe
  C:\Windows\System\YlchWIA.exe
  2⤵
  PID:5160
- C:\Windows\System\HMwShjs.exe
  C:\Windows\System\HMwShjs.exe
  2⤵
  PID:5236
- C:\Windows\System\JCOYPqj.exe
  C:\Windows\System\JCOYPqj.exe
  2⤵
  PID:5296
- C:\Windows\System\vMREQSw.exe
  C:\Windows\System\vMREQSw.exe
  2⤵
  PID:5344
- C:\Windows\System\suuoBhS.exe
  C:\Windows\System\suuoBhS.exe
  2⤵
  PID:5388
- C:\Windows\System\aMsLvTs.exe
  C:\Windows\System\aMsLvTs.exe
  2⤵
  PID:5432
- C:\Windows\System\KQOWwdv.exe
  C:\Windows\System\KQOWwdv.exe
  2⤵
  PID:5476
- C:\Windows\System\tAyzpjO.exe
  C:\Windows\System\tAyzpjO.exe
  2⤵
  PID:5508
- C:\Windows\System\iCjksfz.exe
  C:\Windows\System\iCjksfz.exe
  2⤵
  PID:5548
- C:\Windows\System\qeHXYqf.exe
  C:\Windows\System\qeHXYqf.exe
  2⤵
  PID:5620
- C:\Windows\System\PJjHHIC.exe
  C:\Windows\System\PJjHHIC.exe
  2⤵
  PID:7220
- C:\Windows\System\myTFfLp.exe
  C:\Windows\System\myTFfLp.exe
  2⤵
  PID:7240
- C:\Windows\System\BeAKEqb.exe
  C:\Windows\System\BeAKEqb.exe
  2⤵
  PID:7256
- C:\Windows\System\ixHotJE.exe
  C:\Windows\System\ixHotJE.exe
  2⤵
  PID:7272
- C:\Windows\System\JBZpysy.exe
  C:\Windows\System\JBZpysy.exe
  2⤵
  PID:7296
- C:\Windows\System\RgcAwgl.exe
  C:\Windows\System\RgcAwgl.exe
  2⤵
  PID:7312
- C:\Windows\System\tohNUoW.exe
  C:\Windows\System\tohNUoW.exe
  2⤵
  PID:7328
- C:\Windows\System\qixjikP.exe
  C:\Windows\System\qixjikP.exe
  2⤵
  PID:7352
- C:\Windows\System\gtaICNa.exe
  C:\Windows\System\gtaICNa.exe
  2⤵
  PID:7368
- C:\Windows\System\HwfUWcP.exe
  C:\Windows\System\HwfUWcP.exe
  2⤵
  PID:7388
- C:\Windows\System\QJVpXMx.exe
  C:\Windows\System\QJVpXMx.exe
  2⤵
  PID:7404
- C:\Windows\System\KhQtVER.exe
  C:\Windows\System\KhQtVER.exe
  2⤵
  PID:7424
- C:\Windows\System\ZwCcXuM.exe
  C:\Windows\System\ZwCcXuM.exe
  2⤵
  PID:7448
- C:\Windows\System\MycEBZE.exe
  C:\Windows\System\MycEBZE.exe
  2⤵
  PID:7472
- C:\Windows\System\dGeFohP.exe
  C:\Windows\System\dGeFohP.exe
  2⤵
  PID:7488
- C:\Windows\System\pqahGUm.exe
  C:\Windows\System\pqahGUm.exe
  2⤵
  PID:7504
- C:\Windows\System\AuOWxeW.exe
  C:\Windows\System\AuOWxeW.exe
  2⤵
  PID:7520
- C:\Windows\System\OSHyKgk.exe
  C:\Windows\System\OSHyKgk.exe
  2⤵
  PID:7540
- C:\Windows\System\LaCRiIp.exe
  C:\Windows\System\LaCRiIp.exe
  2⤵
  PID:7564
- C:\Windows\System\yIBCsrQ.exe
  C:\Windows\System\yIBCsrQ.exe
  2⤵
  PID:7580
- C:\Windows\System\TLdKjZX.exe
  C:\Windows\System\TLdKjZX.exe
  2⤵
  PID:7604
- C:\Windows\System\DwXbxda.exe
  C:\Windows\System\DwXbxda.exe
  2⤵
  PID:7620
- C:\Windows\System\HLLlnjP.exe
  C:\Windows\System\HLLlnjP.exe
  2⤵
  PID:7644
- C:\Windows\System\dIURvDe.exe
  C:\Windows\System\dIURvDe.exe
  2⤵
  PID:7660
- C:\Windows\System\iIBakpa.exe
  C:\Windows\System\iIBakpa.exe
  2⤵
  PID:7684
- C:\Windows\System\kJtzBmV.exe
  C:\Windows\System\kJtzBmV.exe
  2⤵
  PID:7704
- C:\Windows\System\fFcEzCB.exe
  C:\Windows\System\fFcEzCB.exe
  2⤵
  PID:7844
- C:\Windows\System\nDYvXqV.exe
  C:\Windows\System\nDYvXqV.exe
  2⤵
  PID:7860
- C:\Windows\System\YuzTwTN.exe
  C:\Windows\System\YuzTwTN.exe
  2⤵
  PID:7876
- C:\Windows\System\lIgwtsW.exe
  C:\Windows\System\lIgwtsW.exe
  2⤵
  PID:7892
- C:\Windows\System\lapiyon.exe
  C:\Windows\System\lapiyon.exe
  2⤵
  PID:7908
- C:\Windows\System\kulvrVM.exe
  C:\Windows\System\kulvrVM.exe
  2⤵
  PID:7924
- C:\Windows\System\FNUnoDu.exe
  C:\Windows\System\FNUnoDu.exe
  2⤵
  PID:7948
- C:\Windows\System\UpgEVRJ.exe
  C:\Windows\System\UpgEVRJ.exe
  2⤵
  PID:7968
- C:\Windows\System\MaYRIum.exe
  C:\Windows\System\MaYRIum.exe
  2⤵
  PID:7992
- C:\Windows\System\HXFyjZH.exe
  C:\Windows\System\HXFyjZH.exe
  2⤵
  PID:8012
- C:\Windows\System\oTzEcGo.exe
  C:\Windows\System\oTzEcGo.exe
  2⤵
  PID:8028
- C:\Windows\System\UilCtwj.exe
  C:\Windows\System\UilCtwj.exe
  2⤵
  PID:8052
- C:\Windows\System\SrhsDMM.exe
  C:\Windows\System\SrhsDMM.exe
  2⤵
  PID:8068
- C:\Windows\System\XKcevam.exe
  C:\Windows\System\XKcevam.exe
  2⤵
  PID:8092
- C:\Windows\System\cTRNLUQ.exe
  C:\Windows\System\cTRNLUQ.exe
  2⤵
  PID:8116
- C:\Windows\System\cyaGvKa.exe
  C:\Windows\System\cyaGvKa.exe
  2⤵
  PID:8132
- C:\Windows\System\FnPbWXC.exe
  C:\Windows\System\FnPbWXC.exe
  2⤵
  PID:8148
- C:\Windows\System\vvmbGVH.exe
  C:\Windows\System\vvmbGVH.exe
  2⤵
  PID:8164
- C:\Windows\System\aYAsSKf.exe
  C:\Windows\System\aYAsSKf.exe
  2⤵
  PID:8184
- C:\Windows\System\OYhhvjF.exe
  C:\Windows\System\OYhhvjF.exe
  2⤵
  PID:5832
- C:\Windows\System\XzylwmX.exe
  C:\Windows\System\XzylwmX.exe
  2⤵
  PID:5908
- C:\Windows\System\NnFPTnP.exe
  C:\Windows\System\NnFPTnP.exe
  2⤵
  PID:6064
- C:\Windows\System\RTqbFeA.exe
  C:\Windows\System\RTqbFeA.exe
  2⤵
  PID:2688
- C:\Windows\System\qUVUPAo.exe
  C:\Windows\System\qUVUPAo.exe
  2⤵
  PID:2564
- C:\Windows\System\iRETqOp.exe
  C:\Windows\System\iRETqOp.exe
  2⤵
  PID:4232
- C:\Windows\System\NRjBcBE.exe
  C:\Windows\System\NRjBcBE.exe
  2⤵
  PID:6316
- C:\Windows\System\qLyXlkm.exe
  C:\Windows\System\qLyXlkm.exe
  2⤵
  PID:6364
- C:\Windows\System\diARSpa.exe
  C:\Windows\System\diARSpa.exe
  2⤵
  PID:6400
- C:\Windows\System\OtmkyVT.exe
  C:\Windows\System\OtmkyVT.exe
  2⤵
  PID:6448
- C:\Windows\System\MiRoXWt.exe
  C:\Windows\System\MiRoXWt.exe
  2⤵
  PID:6480
- C:\Windows\System\ztPBTWF.exe
  C:\Windows\System\ztPBTWF.exe
  2⤵
  PID:6528
- C:\Windows\System\xeosHuW.exe
  C:\Windows\System\xeosHuW.exe
  2⤵
  PID:6556
- C:\Windows\System\TKnJJdg.exe
  C:\Windows\System\TKnJJdg.exe
  2⤵
  PID:6612
- C:\Windows\System\YQPTmVe.exe
  C:\Windows\System\YQPTmVe.exe
  2⤵
  PID:6652
- C:\Windows\System\hLZRwHv.exe
  C:\Windows\System\hLZRwHv.exe
  2⤵
  PID:6692
- C:\Windows\System\zZWXygu.exe
  C:\Windows\System\zZWXygu.exe
  2⤵
  PID:6748
- C:\Windows\System\GRLtSab.exe
  C:\Windows\System\GRLtSab.exe
  2⤵
  PID:6788
- C:\Windows\System\qGRWBTs.exe
  C:\Windows\System\qGRWBTs.exe
  2⤵
  PID:6832
- C:\Windows\System\Djncyel.exe
  C:\Windows\System\Djncyel.exe
  2⤵
  PID:6872
- C:\Windows\System\CCuuwbV.exe
  C:\Windows\System\CCuuwbV.exe
  2⤵
  PID:6912
- C:\Windows\System\pdlWJcf.exe
  C:\Windows\System\pdlWJcf.exe
  2⤵
  PID:6944
- C:\Windows\System\HbFmQEs.exe
  C:\Windows\System\HbFmQEs.exe
  2⤵
  PID:6996
- C:\Windows\System\xULocFz.exe
  C:\Windows\System\xULocFz.exe
  2⤵
  PID:7028
- C:\Windows\System\qkUIVEH.exe
  C:\Windows\System\qkUIVEH.exe
  2⤵
  PID:7072
- C:\Windows\System\WqjFuCu.exe
  C:\Windows\System\WqjFuCu.exe
  2⤵
  PID:7124
- C:\Windows\System\zomnwaM.exe
  C:\Windows\System\zomnwaM.exe
  2⤵
  PID:7164
- C:\Windows\System\xCWRKKb.exe
  C:\Windows\System\xCWRKKb.exe
  2⤵
  PID:2652
- C:\Windows\System\SvCAaAK.exe
  C:\Windows\System\SvCAaAK.exe
  2⤵
  PID:3752
- C:\Windows\System\hRHAoGQ.exe
  C:\Windows\System\hRHAoGQ.exe
  2⤵
  PID:380
- C:\Windows\System\mCovIJt.exe
  C:\Windows\System\mCovIJt.exe
  2⤵
  PID:5124
- C:\Windows\System\egmPuda.exe
  C:\Windows\System\egmPuda.exe
  2⤵
  PID:5324
- C:\Windows\System\fXCydWS.exe
  C:\Windows\System\fXCydWS.exe
  2⤵
  PID:5428
- C:\Windows\System\IEtXlSu.exe
  C:\Windows\System\IEtXlSu.exe
  2⤵
  PID:5532
- C:\Windows\System\wKKyrCl.exe
  C:\Windows\System\wKKyrCl.exe
  2⤵
  PID:5688
- C:\Windows\System\PlDuvkn.exe
  C:\Windows\System\PlDuvkn.exe
  2⤵
  PID:8204
- C:\Windows\System\ZNGDOmC.exe
  C:\Windows\System\ZNGDOmC.exe
  2⤵
  PID:8232
- C:\Windows\System\NhVRNlw.exe
  C:\Windows\System\NhVRNlw.exe
  2⤵
  PID:8252
- C:\Windows\System\tRoSdUF.exe
  C:\Windows\System\tRoSdUF.exe
  2⤵
  PID:8272
- C:\Windows\System\MrPEHWE.exe
  C:\Windows\System\MrPEHWE.exe
  2⤵
  PID:8288
- C:\Windows\System\Yaasjuz.exe
  C:\Windows\System\Yaasjuz.exe
  2⤵
  PID:8312
- C:\Windows\System\PBpvmHz.exe
  C:\Windows\System\PBpvmHz.exe
  2⤵
  PID:8332
- C:\Windows\System\HRlGQRV.exe
  C:\Windows\System\HRlGQRV.exe
  2⤵
  PID:8360
- C:\Windows\System\IsBgCjU.exe
  C:\Windows\System\IsBgCjU.exe
  2⤵
  PID:8376
- C:\Windows\System\VgeoJQq.exe
  C:\Windows\System\VgeoJQq.exe
  2⤵
  PID:8400
- C:\Windows\System\wnlzIRD.exe
  C:\Windows\System\wnlzIRD.exe
  2⤵
  PID:8416
- C:\Windows\System\MOlTCkh.exe
  C:\Windows\System\MOlTCkh.exe
  2⤵
  PID:8444
- C:\Windows\System\pjydQVX.exe
  C:\Windows\System\pjydQVX.exe
  2⤵
  PID:8460
- C:\Windows\System\thaTmak.exe
  C:\Windows\System\thaTmak.exe
  2⤵
  PID:8480
- C:\Windows\System\hSgNYpa.exe
  C:\Windows\System\hSgNYpa.exe
  2⤵
  PID:8496
- C:\Windows\System\MnNvlrw.exe
  C:\Windows\System\MnNvlrw.exe
  2⤵
  PID:8520
- C:\Windows\System\xXFkXCv.exe
  C:\Windows\System\xXFkXCv.exe
  2⤵
  PID:8544
- C:\Windows\System\ubvLRSW.exe
  C:\Windows\System\ubvLRSW.exe
  2⤵
  PID:8564
- C:\Windows\System\rQuBUkR.exe
  C:\Windows\System\rQuBUkR.exe
  2⤵
  PID:8588
- C:\Windows\System\hGXahOu.exe
  C:\Windows\System\hGXahOu.exe
  2⤵
  PID:8604
- C:\Windows\System\QqbUrdw.exe
  C:\Windows\System\QqbUrdw.exe
  2⤵
  PID:8628
- C:\Windows\System\iswNYHl.exe
  C:\Windows\System\iswNYHl.exe
  2⤵
  PID:8644
- C:\Windows\System\AoszYKO.exe
  C:\Windows\System\AoszYKO.exe
  2⤵
  PID:8668
- C:\Windows\System\SmtZgvp.exe
  C:\Windows\System\SmtZgvp.exe
  2⤵
  PID:8696
- C:\Windows\System\CFcjYml.exe
  C:\Windows\System\CFcjYml.exe
  2⤵
  PID:8712
- C:\Windows\System\HvDyADQ.exe
  C:\Windows\System\HvDyADQ.exe
  2⤵
  PID:8736
- C:\Windows\System\bFAwmUZ.exe
  C:\Windows\System\bFAwmUZ.exe
  2⤵
  PID:8752
- C:\Windows\System\GQsuwvd.exe
  C:\Windows\System\GQsuwvd.exe
  2⤵
  PID:8776
- C:\Windows\System\gHUagkd.exe
  C:\Windows\System\gHUagkd.exe
  2⤵
  PID:8800
- C:\Windows\System\kFdLHIW.exe
  C:\Windows\System\kFdLHIW.exe
  2⤵
  PID:8824
- C:\Windows\System\yirNuNh.exe
  C:\Windows\System\yirNuNh.exe
  2⤵
  PID:8840
- C:\Windows\System\ATQtNbi.exe
  C:\Windows\System\ATQtNbi.exe
  2⤵
  PID:8856
- C:\Windows\System\mSNbzAP.exe
  C:\Windows\System\mSNbzAP.exe
  2⤵
  PID:8876
- C:\Windows\System\KVishFz.exe
  C:\Windows\System\KVishFz.exe
  2⤵
  PID:8900
- C:\Windows\System\sIAKVcu.exe
  C:\Windows\System\sIAKVcu.exe
  2⤵
  PID:8920
- C:\Windows\System\YgpQHgF.exe
  C:\Windows\System\YgpQHgF.exe
  2⤵
  PID:8940
- C:\Windows\System\vXvmBPf.exe
  C:\Windows\System\vXvmBPf.exe
  2⤵
  PID:8960
- C:\Windows\System\rOOjNQz.exe
  C:\Windows\System\rOOjNQz.exe
  2⤵
  PID:8980
- C:\Windows\System\kHIujlE.exe
  C:\Windows\System\kHIujlE.exe
  2⤵
  PID:9008
- C:\Windows\System\gFSUiEK.exe
  C:\Windows\System\gFSUiEK.exe
  2⤵
  PID:9024
- C:\Windows\System\yDnFmuY.exe
  C:\Windows\System\yDnFmuY.exe
  2⤵
  PID:9048
- C:\Windows\System\yibKjxa.exe
  C:\Windows\System\yibKjxa.exe
  2⤵
  PID:9068
- C:\Windows\System\NGKaRiH.exe
  C:\Windows\System\NGKaRiH.exe
  2⤵
  PID:9088
- C:\Windows\System\bbZiiHg.exe
  C:\Windows\System\bbZiiHg.exe
  2⤵
  PID:9116
- C:\Windows\System\cepOKQZ.exe
  C:\Windows\System\cepOKQZ.exe
  2⤵
  PID:9132
- C:\Windows\System\OkKeHiW.exe
  C:\Windows\System\OkKeHiW.exe
  2⤵
  PID:9156
- C:\Windows\System\WZFBFFq.exe
  C:\Windows\System\WZFBFFq.exe
  2⤵
  PID:9176
- C:\Windows\System\yzQjgfw.exe
  C:\Windows\System\yzQjgfw.exe
  2⤵
  PID:9200
- C:\Windows\System\xYxFVip.exe
  C:\Windows\System\xYxFVip.exe
  2⤵
  PID:7840
- C:\Windows\System\OLBAzXA.exe
  C:\Windows\System\OLBAzXA.exe
  2⤵
  PID:7920
- C:\Windows\System\bTQmFnh.exe
  C:\Windows\System\bTQmFnh.exe
  2⤵
  PID:8020
- C:\Windows\System\ivGxjjr.exe
  C:\Windows\System\ivGxjjr.exe
  2⤵
  PID:8084
- C:\Windows\System\lThNsKz.exe
  C:\Windows\System\lThNsKz.exe
  2⤵
  PID:9228
- C:\Windows\System\tkuQCOJ.exe
  C:\Windows\System\tkuQCOJ.exe
  2⤵
  PID:9244
- C:\Windows\System\qhXzRzp.exe
  C:\Windows\System\qhXzRzp.exe
  2⤵
  PID:9260
- C:\Windows\System\osyZsjE.exe
  C:\Windows\System\osyZsjE.exe
  2⤵
  PID:9276
- C:\Windows\System\kFgdKrV.exe
  C:\Windows\System\kFgdKrV.exe
  2⤵
  PID:9292
- C:\Windows\System\lAWlYfb.exe
  C:\Windows\System\lAWlYfb.exe
  2⤵
  PID:9308
- C:\Windows\System\YlbHKRt.exe
  C:\Windows\System\YlbHKRt.exe
  2⤵
  PID:9324
- C:\Windows\System\XhEGWzu.exe
  C:\Windows\System\XhEGWzu.exe
  2⤵
  PID:9348
- C:\Windows\System\jWbFnby.exe
  C:\Windows\System\jWbFnby.exe
  2⤵
  PID:9368
- C:\Windows\System\BUqwJnI.exe
  C:\Windows\System\BUqwJnI.exe
  2⤵
  PID:9392
- C:\Windows\System\XwgYAmw.exe
  C:\Windows\System\XwgYAmw.exe
  2⤵
  PID:9416
- C:\Windows\System\arnldQk.exe
  C:\Windows\System\arnldQk.exe
  2⤵
  PID:9436
- C:\Windows\System\nXXWJaB.exe
  C:\Windows\System\nXXWJaB.exe
  2⤵
  PID:9456
- C:\Windows\System\SITOfLm.exe
  C:\Windows\System\SITOfLm.exe
  2⤵
  PID:9476
- C:\Windows\System\pAKYBDD.exe
  C:\Windows\System\pAKYBDD.exe
  2⤵
  PID:9500
- C:\Windows\System\pipPCWO.exe
  C:\Windows\System\pipPCWO.exe
  2⤵
  PID:9524
- C:\Windows\System\VYlgsfJ.exe
  C:\Windows\System\VYlgsfJ.exe
  2⤵
  PID:9544
- C:\Windows\System\ekrkgMI.exe
  C:\Windows\System\ekrkgMI.exe
  2⤵
  PID:9572
- C:\Windows\System\PBXcqri.exe
  C:\Windows\System\PBXcqri.exe
  2⤵
  PID:9600
- C:\Windows\System\OWXlann.exe
  C:\Windows\System\OWXlann.exe
  2⤵
  PID:9620
- C:\Windows\System\oIQfPbb.exe
  C:\Windows\System\oIQfPbb.exe
  2⤵
  PID:9640
- C:\Windows\System\nskHGFO.exe
  C:\Windows\System\nskHGFO.exe
  2⤵
  PID:9672
- C:\Windows\System\yoQdiQT.exe
  C:\Windows\System\yoQdiQT.exe
  2⤵
  PID:9696
- C:\Windows\System\CFgGlXu.exe
  C:\Windows\System\CFgGlXu.exe
  2⤵
  PID:9716
- C:\Windows\System\ehmpZZf.exe
  C:\Windows\System\ehmpZZf.exe
  2⤵
  PID:9732
- C:\Windows\System\LMOyqwK.exe
  C:\Windows\System\LMOyqwK.exe
  2⤵
  PID:9760
- C:\Windows\System\xLjhIlQ.exe
  C:\Windows\System\xLjhIlQ.exe
  2⤵
  PID:9776
- C:\Windows\System\vMqpQlf.exe
  C:\Windows\System\vMqpQlf.exe
  2⤵
  PID:9800
- C:\Windows\System\NscJyWZ.exe
  C:\Windows\System\NscJyWZ.exe
  2⤵
  PID:9816
- C:\Windows\System\XjTpqxG.exe
  C:\Windows\System\XjTpqxG.exe
  2⤵
  PID:9844
- C:\Windows\System\QePOQQJ.exe
  C:\Windows\System\QePOQQJ.exe
  2⤵
  PID:9860
- C:\Windows\System\RFuPdsP.exe
  C:\Windows\System\RFuPdsP.exe
  2⤵
  PID:9876
- C:\Windows\System\sbkinnb.exe
  C:\Windows\System\sbkinnb.exe
  2⤵
  PID:9892
- C:\Windows\System\aSufPvD.exe
  C:\Windows\System\aSufPvD.exe
  2⤵
  PID:10020
- C:\Windows\System\mKvIKGC.exe
  C:\Windows\System\mKvIKGC.exe
  2⤵
  PID:10036
- C:\Windows\System\AwiyXkq.exe
  C:\Windows\System\AwiyXkq.exe
  2⤵
  PID:10052
- C:\Windows\System\xuZWueL.exe
  C:\Windows\System\xuZWueL.exe
  2⤵
  PID:10068
- C:\Windows\System\VMJpGAM.exe
  C:\Windows\System\VMJpGAM.exe
  2⤵
  PID:10084
- C:\Windows\System\jlMQJBC.exe
  C:\Windows\System\jlMQJBC.exe
  2⤵
  PID:10104
- C:\Windows\System\KLcFaZw.exe
  C:\Windows\System\KLcFaZw.exe
  2⤵
  PID:10124
- C:\Windows\System\TPpbfdL.exe
  C:\Windows\System\TPpbfdL.exe
  2⤵
  PID:10144
- C:\Windows\System\ktnRSiy.exe
  C:\Windows\System\ktnRSiy.exe
  2⤵
  PID:10168
- C:\Windows\System\AuBrtCm.exe
  C:\Windows\System\AuBrtCm.exe
  2⤵
  PID:10192
- C:\Windows\System\TMzdQSz.exe
  C:\Windows\System\TMzdQSz.exe
  2⤵
  PID:10208
- C:\Windows\System\CHOHFHf.exe
  C:\Windows\System\CHOHFHf.exe
  2⤵
  PID:10228
- C:\Windows\System\SfOyVmF.exe
  C:\Windows\System\SfOyVmF.exe
  2⤵
  PID:6108
- C:\Windows\System\XKPKcrD.exe
  C:\Windows\System\XKPKcrD.exe
  2⤵
  PID:6332
- C:\Windows\System\BqpqioS.exe
  C:\Windows\System\BqpqioS.exe
  2⤵
  PID:6468
- C:\Windows\System\TNrIXde.exe
  C:\Windows\System\TNrIXde.exe
  2⤵
  PID:6636
- C:\Windows\System\KxrazdR.exe
  C:\Windows\System\KxrazdR.exe
  2⤵
  PID:6852
- C:\Windows\System\aJahyJE.exe
  C:\Windows\System\aJahyJE.exe
  2⤵
  PID:6904
- C:\Windows\System\MZUVYlh.exe
  C:\Windows\System\MZUVYlh.exe
  2⤵
  PID:7112
- C:\Windows\System\TcpKBFT.exe
  C:\Windows\System\TcpKBFT.exe
  2⤵
  PID:3016
- C:\Windows\System\nzLuRMq.exe
  C:\Windows\System\nzLuRMq.exe
  2⤵
  PID:7228
- C:\Windows\System\cEdaEQv.exe
  C:\Windows\System\cEdaEQv.exe
  2⤵
  PID:7252
- C:\Windows\System\gVFaBnn.exe
  C:\Windows\System\gVFaBnn.exe
  2⤵
  PID:7304
- C:\Windows\System\maRZaMD.exe
  C:\Windows\System\maRZaMD.exe
  2⤵
  PID:7360
- C:\Windows\System\ifnJbdD.exe
  C:\Windows\System\ifnJbdD.exe
  2⤵
  PID:7384
- C:\Windows\System\daLequg.exe
  C:\Windows\System\daLequg.exe
  2⤵
  PID:7436
- C:\Windows\System\xuDyVia.exe
  C:\Windows\System\xuDyVia.exe
  2⤵
  PID:7480
- C:\Windows\System\BJWKviR.exe
  C:\Windows\System\BJWKviR.exe
  2⤵
  PID:7516
- C:\Windows\System\pJVNfXt.exe
  C:\Windows\System\pJVNfXt.exe
  2⤵
  PID:3416
- C:\Windows\System\ygfXZjL.exe
  C:\Windows\System\ygfXZjL.exe
  2⤵
  PID:7600
- C:\Windows\System\undjacg.exe
  C:\Windows\System\undjacg.exe
  2⤵
  PID:7652
- C:\Windows\System\MccfVSp.exe
  C:\Windows\System\MccfVSp.exe
  2⤵
  PID:7692
- C:\Windows\System\NoYtHEz.exe
  C:\Windows\System\NoYtHEz.exe
  2⤵
  PID:1512
- C:\Windows\System\VqerfTC.exe
  C:\Windows\System\VqerfTC.exe
  2⤵
  PID:5568
- C:\Windows\System\MUwhxCf.exe
  C:\Windows\System\MUwhxCf.exe
  2⤵
  PID:8304
- C:\Windows\System\wwtWZZk.exe
  C:\Windows\System\wwtWZZk.exe
  2⤵
  PID:8388
- C:\Windows\System\vqKFXCP.exe
  C:\Windows\System\vqKFXCP.exe
  2⤵
  PID:8572
- C:\Windows\System\xzixntl.exe
  C:\Windows\System\xzixntl.exe
  2⤵
  PID:8620
- C:\Windows\System\qkhJIuD.exe
  C:\Windows\System\qkhJIuD.exe
  2⤵
  PID:8664
- C:\Windows\System\nBMJpwx.exe
  C:\Windows\System\nBMJpwx.exe
  2⤵
  PID:8732
- C:\Windows\System\PUyHUJL.exe
  C:\Windows\System\PUyHUJL.exe
  2⤵
  PID:8820
- C:\Windows\System\iowYMlo.exe
  C:\Windows\System\iowYMlo.exe
  2⤵
  PID:8936
- C:\Windows\System\psslFsg.exe
  C:\Windows\System\psslFsg.exe
  2⤵
  PID:9096
- C:\Windows\System\dMWiiGv.exe
  C:\Windows\System\dMWiiGv.exe
  2⤵
  PID:10244
- C:\Windows\System\EMMEaKJ.exe
  C:\Windows\System\EMMEaKJ.exe
  2⤵
  PID:10268
- C:\Windows\System\jeGUnSf.exe
  C:\Windows\System\jeGUnSf.exe
  2⤵
  PID:10288
- C:\Windows\System\SNxHGFD.exe
  C:\Windows\System\SNxHGFD.exe
  2⤵
  PID:10304
- C:\Windows\System\eeYaGSE.exe
  C:\Windows\System\eeYaGSE.exe
  2⤵
  PID:10320
- C:\Windows\System\CdDNEji.exe
  C:\Windows\System\CdDNEji.exe
  2⤵
  PID:10356
- C:\Windows\System\aSWmnSX.exe
  C:\Windows\System\aSWmnSX.exe
  2⤵
  PID:10392
- C:\Windows\System\gtyaKLb.exe
  C:\Windows\System\gtyaKLb.exe
  2⤵
  PID:10408
- C:\Windows\System\ynqCssr.exe
  C:\Windows\System\ynqCssr.exe
  2⤵
  PID:10428
- C:\Windows\System\kKWkdtN.exe
  C:\Windows\System\kKWkdtN.exe
  2⤵
  PID:10444
- C:\Windows\System\eANcLtP.exe
  C:\Windows\System\eANcLtP.exe
  2⤵
  PID:10460
- C:\Windows\System\VbFWMwc.exe
  C:\Windows\System\VbFWMwc.exe
  2⤵
  PID:10476
- C:\Windows\System\aUOnXFB.exe
  C:\Windows\System\aUOnXFB.exe
  2⤵
  PID:10492
- C:\Windows\System\HnpKCcZ.exe
  C:\Windows\System\HnpKCcZ.exe
  2⤵
  PID:10512
- C:\Windows\System\YgrAuEx.exe
  C:\Windows\System\YgrAuEx.exe
  2⤵
  PID:10540
- C:\Windows\System\PvnWqFE.exe
  C:\Windows\System\PvnWqFE.exe
  2⤵
  PID:10556
- C:\Windows\System\wnCignv.exe
  C:\Windows\System\wnCignv.exe
  2⤵
  PID:10580
- C:\Windows\System\hwzZiUh.exe
  C:\Windows\System\hwzZiUh.exe
  2⤵
  PID:10600
- C:\Windows\System\GKTmMAR.exe
  C:\Windows\System\GKTmMAR.exe
  2⤵
  PID:10616
- C:\Windows\System\qaJDCLD.exe
  C:\Windows\System\qaJDCLD.exe
  2⤵
  PID:10636
- C:\Windows\System\LoldeRF.exe
  C:\Windows\System\LoldeRF.exe
  2⤵
  PID:10652
- C:\Windows\System\DKDieAu.exe
  C:\Windows\System\DKDieAu.exe
  2⤵
  PID:10668
- C:\Windows\System\MxsQqaN.exe
  C:\Windows\System\MxsQqaN.exe
  2⤵
  PID:10688
- C:\Windows\System\SvAyHDi.exe
  C:\Windows\System\SvAyHDi.exe
  2⤵
  PID:10708
- C:\Windows\System\iTatanK.exe
  C:\Windows\System\iTatanK.exe
  2⤵
  PID:10732
- C:\Windows\System\PngiPcH.exe
  C:\Windows\System\PngiPcH.exe
  2⤵
  PID:10748
- C:\Windows\System\oVSVAsn.exe
  C:\Windows\System\oVSVAsn.exe
  2⤵
  PID:10772
- C:\Windows\System\YdPskxc.exe
  C:\Windows\System\YdPskxc.exe
  2⤵
  PID:10788
- C:\Windows\System\lAfKsGf.exe
  C:\Windows\System\lAfKsGf.exe
  2⤵
  PID:10812
- C:\Windows\System\KMfAhRU.exe
  C:\Windows\System\KMfAhRU.exe
  2⤵
  PID:10832
- C:\Windows\System\LbjTyTZ.exe
  C:\Windows\System\LbjTyTZ.exe
  2⤵
  PID:10852
- C:\Windows\System\NbWPxUP.exe
  C:\Windows\System\NbWPxUP.exe
  2⤵
  PID:10884
- C:\Windows\System\jEuDKrA.exe
  C:\Windows\System\jEuDKrA.exe
  2⤵
  PID:10900
- C:\Windows\System\NaIWzxV.exe
  C:\Windows\System\NaIWzxV.exe
  2⤵
  PID:10920
- C:\Windows\System\XnYRjSS.exe
  C:\Windows\System\XnYRjSS.exe
  2⤵
  PID:10936
- C:\Windows\System\IHZJgqo.exe
  C:\Windows\System\IHZJgqo.exe
  2⤵
  PID:10952
- C:\Windows\System\IsBbGOp.exe
  C:\Windows\System\IsBbGOp.exe
  2⤵
  PID:10968
- C:\Windows\System\PUiFaOf.exe
  C:\Windows\System\PUiFaOf.exe
  2⤵
  PID:10988
- C:\Windows\System\MomPWLP.exe
  C:\Windows\System\MomPWLP.exe
  2⤵
  PID:11004
- C:\Windows\System\EyzdCVK.exe
  C:\Windows\System\EyzdCVK.exe
  2⤵
  PID:11020
- C:\Windows\System\poWjUkD.exe
  C:\Windows\System\poWjUkD.exe
  2⤵
  PID:11036
- C:\Windows\System\kRUkpRf.exe
  C:\Windows\System\kRUkpRf.exe
  2⤵
  PID:11052
- C:\Windows\System\QumrTTT.exe
  C:\Windows\System\QumrTTT.exe
  2⤵
  PID:11080
- C:\Windows\System\aiQirIr.exe
  C:\Windows\System\aiQirIr.exe
  2⤵
  PID:11120
- C:\Windows\System\EQxmwra.exe
  C:\Windows\System\EQxmwra.exe
  2⤵
  PID:11140
- C:\Windows\System\ghQFnZt.exe
  C:\Windows\System\ghQFnZt.exe
  2⤵
  PID:11160
- C:\Windows\System\YpVyEuc.exe
  C:\Windows\System\YpVyEuc.exe
  2⤵
  PID:11180
- C:\Windows\System\stKMPDq.exe
  C:\Windows\System\stKMPDq.exe
  2⤵
  PID:11196
- C:\Windows\System\mMFrRoN.exe
  C:\Windows\System\mMFrRoN.exe
  2⤵
  PID:11244
- C:\Windows\System\RkuEOlR.exe
  C:\Windows\System\RkuEOlR.exe
  2⤵
  PID:9172
- C:\Windows\System\XwoMVcR.exe
  C:\Windows\System\XwoMVcR.exe
  2⤵
  PID:8004
- C:\Windows\System\cenSsiB.exe
  C:\Windows\System\cenSsiB.exe
  2⤵
  PID:7752
- C:\Windows\System\XqLEEBq.exe
  C:\Windows\System\XqLEEBq.exe
  2⤵
  PID:6432
- C:\Windows\System\ruMqjsL.exe
  C:\Windows\System\ruMqjsL.exe
  2⤵
  PID:6588
- C:\Windows\System\twzlVmO.exe
  C:\Windows\System\twzlVmO.exe
  2⤵
  PID:6672
- C:\Windows\System\nhKYdmc.exe
  C:\Windows\System\nhKYdmc.exe
  2⤵
  PID:9612
- C:\Windows\System\uKcXLJv.exe
  C:\Windows\System\uKcXLJv.exe
  2⤵
  PID:6980
- C:\Windows\System\NunLoTJ.exe
  C:\Windows\System\NunLoTJ.exe
  2⤵
  PID:7820
- C:\Windows\System\LIUwALr.exe
  C:\Windows\System\LIUwALr.exe
  2⤵
  PID:10224
- C:\Windows\System\reSAxud.exe
  C:\Windows\System\reSAxud.exe
  2⤵
  PID:8784
- C:\Windows\System\PViXNcG.exe
  C:\Windows\System\PViXNcG.exe
  2⤵
  PID:5864
- C:\Windows\System\kXQZPhj.exe
  C:\Windows\System\kXQZPhj.exe
  2⤵
  PID:7884
- C:\Windows\System\DSRVZvb.exe
  C:\Windows\System\DSRVZvb.exe
  2⤵
  PID:3364
- C:\Windows\System\ujWQzUc.exe
  C:\Windows\System\ujWQzUc.exe
  2⤵
  PID:8976
- C:\Windows\System\NEzijnC.exe
  C:\Windows\System\NEzijnC.exe
  2⤵
  PID:9060
- C:\Windows\System\hWODzZP.exe
  C:\Windows\System\hWODzZP.exe
  2⤵
  PID:8816
- C:\Windows\System\DzFLSCA.exe
  C:\Windows\System\DzFLSCA.exe
  2⤵
  PID:10264
- C:\Windows\System\RYIIqtF.exe
  C:\Windows\System\RYIIqtF.exe
  2⤵
  PID:9192
- C:\Windows\System\SdAufZN.exe
  C:\Windows\System\SdAufZN.exe
  2⤵
  PID:11276
- C:\Windows\System\gBNyoHs.exe
  C:\Windows\System\gBNyoHs.exe
  2⤵
  PID:11296
- C:\Windows\System\qAqHuAv.exe
  C:\Windows\System\qAqHuAv.exe
  2⤵
  PID:11316
- C:\Windows\System\ZdpJcLa.exe
  C:\Windows\System\ZdpJcLa.exe
  2⤵
  PID:11336
- C:\Windows\System\BACppJj.exe
  C:\Windows\System\BACppJj.exe
  2⤵
  PID:11356
- C:\Windows\System\dsNDRom.exe
  C:\Windows\System\dsNDRom.exe
  2⤵
  PID:11380
- C:\Windows\System\vfNrfir.exe
  C:\Windows\System\vfNrfir.exe
  2⤵
  PID:11396
- C:\Windows\System\ibJmKpu.exe
  C:\Windows\System\ibJmKpu.exe
  2⤵
  PID:11472
- C:\Windows\System\egznLoW.exe
  C:\Windows\System\egznLoW.exe
  2⤵
  PID:11492
- C:\Windows\System\sobNelt.exe
  C:\Windows\System\sobNelt.exe
  2⤵
  PID:11512
- C:\Windows\System\DTAYdGA.exe
  C:\Windows\System\DTAYdGA.exe
  2⤵
  PID:11528
- C:\Windows\System\ZkRElBY.exe
  C:\Windows\System\ZkRElBY.exe
  2⤵
  PID:11548
- C:\Windows\System\IqjkqxS.exe
  C:\Windows\System\IqjkqxS.exe
  2⤵
  PID:11568
- C:\Windows\System\VGQybBe.exe
  C:\Windows\System\VGQybBe.exe
  2⤵
  PID:11588
- C:\Windows\System\WyZrjVG.exe
  C:\Windows\System\WyZrjVG.exe
  2⤵
  PID:11612
- C:\Windows\System\cyCAWMx.exe
  C:\Windows\System\cyCAWMx.exe
  2⤵
  PID:11628
- C:\Windows\System\CjjLtxl.exe
  C:\Windows\System\CjjLtxl.exe
  2⤵
  PID:11648
- C:\Windows\System\SSiBgny.exe
  C:\Windows\System\SSiBgny.exe
  2⤵
  PID:11664
- C:\Windows\System\dtIZYUW.exe
  C:\Windows\System\dtIZYUW.exe
  2⤵
  PID:11684
- C:\Windows\System\jbqrdGR.exe
  C:\Windows\System\jbqrdGR.exe
  2⤵
  PID:11700
- C:\Windows\System\ZOIgzlp.exe
  C:\Windows\System\ZOIgzlp.exe
  2⤵
  PID:11716
- C:\Windows\System\QfrxFjF.exe
  C:\Windows\System\QfrxFjF.exe
  2⤵
  PID:11736
- C:\Windows\System\nUzGWAN.exe
  C:\Windows\System\nUzGWAN.exe
  2⤵
  PID:11756
- C:\Windows\System\ELtnJSA.exe
  C:\Windows\System\ELtnJSA.exe
  2⤵
  PID:11780
- C:\Windows\System\frdDHNK.exe
  C:\Windows\System\frdDHNK.exe
  2⤵
  PID:11804
- C:\Windows\System\JDHawpC.exe
  C:\Windows\System\JDHawpC.exe
  2⤵
  PID:11828
- C:\Windows\System\MxGdVPH.exe
  C:\Windows\System\MxGdVPH.exe
  2⤵
  PID:11848
- C:\Windows\System\CGqXzFe.exe
  C:\Windows\System\CGqXzFe.exe
  2⤵
  PID:11868
- C:\Windows\System\hzcvGdR.exe
  C:\Windows\System\hzcvGdR.exe
  2⤵
  PID:11888
- C:\Windows\System\beeZusQ.exe
  C:\Windows\System\beeZusQ.exe
  2⤵
  PID:11908
- C:\Windows\System\eYUhtHJ.exe
  C:\Windows\System\eYUhtHJ.exe
  2⤵
  PID:11928
- C:\Windows\System\cPuUCZD.exe
  C:\Windows\System\cPuUCZD.exe
  2⤵
  PID:11948
- C:\Windows\System\EfLcjfS.exe
  C:\Windows\System\EfLcjfS.exe
  2⤵
  PID:11968
- C:\Windows\System\NlwkEdK.exe
  C:\Windows\System\NlwkEdK.exe
  2⤵
  PID:11984
- C:\Windows\System\hNufgUA.exe
  C:\Windows\System\hNufgUA.exe
  2⤵
  PID:12004
- C:\Windows\System\DwbrXtX.exe
  C:\Windows\System\DwbrXtX.exe
  2⤵
  PID:12028
- C:\Windows\System\pLVcbEL.exe
  C:\Windows\System\pLVcbEL.exe
  2⤵
  PID:12060
- C:\Windows\System\BcVNSig.exe
  C:\Windows\System\BcVNSig.exe
  2⤵
  PID:12080
- C:\Windows\System\TCJIprE.exe
  C:\Windows\System\TCJIprE.exe
  2⤵
  PID:12100
- C:\Windows\System\iehGpWP.exe
  C:\Windows\System\iehGpWP.exe
  2⤵
  PID:12124
- C:\Windows\System\CnfybyR.exe
  C:\Windows\System\CnfybyR.exe
  2⤵
  PID:12140
- C:\Windows\System\AfHErvL.exe
  C:\Windows\System\AfHErvL.exe
  2⤵
  PID:12164
- C:\Windows\System\zgtcIOK.exe
  C:\Windows\System\zgtcIOK.exe
  2⤵
  PID:12180
- C:\Windows\System\bunHroe.exe
  C:\Windows\System\bunHroe.exe
  2⤵
  PID:12204
- C:\Windows\System\NGogvyn.exe
  C:\Windows\System\NGogvyn.exe
  2⤵
  PID:12228
- C:\Windows\System\zZTFVmg.exe
  C:\Windows\System\zZTFVmg.exe
  2⤵
  PID:12248
- C:\Windows\System\GrHQgSI.exe
  C:\Windows\System\GrHQgSI.exe
  2⤵
  PID:12268
- C:\Windows\System\rEXlGBX.exe
  C:\Windows\System\rEXlGBX.exe
  2⤵
  PID:7868
- C:\Windows\System\KVMvJHa.exe
  C:\Windows\System\KVMvJHa.exe
  2⤵
  PID:8036
- C:\Windows\System\HDaDvtf.exe
  C:\Windows\System\HDaDvtf.exe
  2⤵
  PID:5872
- C:\Windows\System\MWkCSQN.exe
  C:\Windows\System\MWkCSQN.exe
  2⤵
  PID:4972
- C:\Windows\System\Hosglss.exe
  C:\Windows\System\Hosglss.exe
  2⤵
  PID:10400
- C:\Windows\System\WzSsitK.exe
  C:\Windows\System\WzSsitK.exe
  2⤵
  PID:9540
- C:\Windows\System\KaQHLzH.exe
  C:\Windows\System\KaQHLzH.exe
  2⤵
  PID:10628
- C:\Windows\System\qkYXkpl.exe
  C:\Windows\System\qkYXkpl.exe
  2⤵
  PID:10756
- C:\Windows\System\iHhLeIo.exe
  C:\Windows\System\iHhLeIo.exe
  2⤵
  PID:7040
- C:\Windows\System\bGUranv.exe
  C:\Windows\System\bGUranv.exe
  2⤵
  PID:9748
- C:\Windows\System\yVkIBqk.exe
  C:\Windows\System\yVkIBqk.exe
  2⤵
  PID:9784
- C:\Windows\System\ZdmwFlE.exe
  C:\Windows\System\ZdmwFlE.exe
  2⤵
  PID:4548
- C:\Windows\System\obspiLW.exe
  C:\Windows\System\obspiLW.exe
  2⤵
  PID:5284
- C:\Windows\System\PbCeopR.exe
  C:\Windows\System\PbCeopR.exe
  2⤵
  PID:5468
- C:\Windows\System\FdosxTT.exe
  C:\Windows\System\FdosxTT.exe
  2⤵
  PID:8224
- C:\Windows\System\QraLgEJ.exe
  C:\Windows\System\QraLgEJ.exe
  2⤵
  PID:8308
- C:\Windows\System\uJFNiqg.exe
  C:\Windows\System\uJFNiqg.exe
  2⤵
  PID:8384
- C:\Windows\System\BeNZtvu.exe
  C:\Windows\System\BeNZtvu.exe
  2⤵
  PID:8440
- C:\Windows\System\jsrjwcz.exe
  C:\Windows\System\jsrjwcz.exe
  2⤵
  PID:8532
- C:\Windows\System\UfiGrBV.exe
  C:\Windows\System\UfiGrBV.exe
  2⤵
  PID:8676
- C:\Windows\System\GaBKLWQ.exe
  C:\Windows\System\GaBKLWQ.exe
  2⤵
  PID:12304
- C:\Windows\System\iRlQFEo.exe
  C:\Windows\System\iRlQFEo.exe
  2⤵
  PID:12328
- C:\Windows\System\xAtBwmq.exe
  C:\Windows\System\xAtBwmq.exe
  2⤵
  PID:12348
- C:\Windows\System\qtgCQJM.exe
  C:\Windows\System\qtgCQJM.exe
  2⤵
  PID:12368
- C:\Windows\System\dPgnEck.exe
  C:\Windows\System\dPgnEck.exe
  2⤵
  PID:12396
- C:\Windows\System\dZZSNyu.exe
  C:\Windows\System\dZZSNyu.exe
  2⤵
  PID:12420
- C:\Windows\System\GxvJybq.exe
  C:\Windows\System\GxvJybq.exe
  2⤵
  PID:12440
- C:\Windows\System\VDOzSXq.exe
  C:\Windows\System\VDOzSXq.exe
  2⤵
  PID:12460
- C:\Windows\System\EBgNtPX.exe
  C:\Windows\System\EBgNtPX.exe
  2⤵
  PID:12480
- C:\Windows\System\WIbdnEu.exe
  C:\Windows\System\WIbdnEu.exe
  2⤵
  PID:12504
- C:\Windows\System\yRySxqG.exe
  C:\Windows\System\yRySxqG.exe
  2⤵
  PID:12524
- C:\Windows\System\cdugSYI.exe
  C:\Windows\System\cdugSYI.exe
  2⤵
  PID:12548
- C:\Windows\System\BGCppZD.exe
  C:\Windows\System\BGCppZD.exe
  2⤵
  PID:12564
- C:\Windows\System\xulrrVk.exe
  C:\Windows\System\xulrrVk.exe
  2⤵
  PID:12584
- C:\Windows\System\ylUwVWS.exe
  C:\Windows\System\ylUwVWS.exe
  2⤵
  PID:12612
- C:\Windows\System\NXGcDuX.exe
  C:\Windows\System\NXGcDuX.exe
  2⤵
  PID:12632
- C:\Windows\System\pAtPRkK.exe
  C:\Windows\System\pAtPRkK.exe
  2⤵
  PID:12660
- C:\Windows\System\VpGvPIR.exe
  C:\Windows\System\VpGvPIR.exe
  2⤵
  PID:12676
- C:\Windows\System\Kcbeopu.exe
  C:\Windows\System\Kcbeopu.exe
  2⤵
  PID:12692
- C:\Windows\System\USKvVlf.exe
  C:\Windows\System\USKvVlf.exe
  2⤵
  PID:12712
- C:\Windows\System\tAWySwR.exe
  C:\Windows\System\tAWySwR.exe
  2⤵
  PID:12728
- C:\Windows\System\EikOfYA.exe
  C:\Windows\System\EikOfYA.exe
  2⤵
  PID:12744
- C:\Windows\System\mYRFvDQ.exe
  C:\Windows\System\mYRFvDQ.exe
  2⤵
  PID:12764
- C:\Windows\System\WoaGFWg.exe
  C:\Windows\System\WoaGFWg.exe
  2⤵
  PID:12784
- C:\Windows\System\UzPlTdb.exe
  C:\Windows\System\UzPlTdb.exe
  2⤵
  PID:12800
- C:\Windows\System\ZWBMPHX.exe
  C:\Windows\System\ZWBMPHX.exe
  2⤵
  PID:12824
- C:\Windows\System\GLIpzBl.exe
  C:\Windows\System\GLIpzBl.exe
  2⤵
  PID:12844
- C:\Windows\System\iMHRnBc.exe
  C:\Windows\System\iMHRnBc.exe
  2⤵
  PID:12864
- C:\Windows\System\dzTrfsG.exe
  C:\Windows\System\dzTrfsG.exe
  2⤵
  PID:12888
- C:\Windows\System\bQlESGx.exe
  C:\Windows\System\bQlESGx.exe
  2⤵
  PID:12904
- C:\Windows\System\hiNPVAp.exe
  C:\Windows\System\hiNPVAp.exe
  2⤵
  PID:12924
- C:\Windows\System\FWCFcNz.exe
  C:\Windows\System\FWCFcNz.exe
  2⤵
  PID:12948
- C:\Windows\System\egDUVvK.exe
  C:\Windows\System\egDUVvK.exe
  2⤵
  PID:12972
- C:\Windows\System\nCcBJiU.exe
  C:\Windows\System\nCcBJiU.exe
  2⤵
  PID:12992
- C:\Windows\System\dEfzRif.exe
  C:\Windows\System\dEfzRif.exe
  2⤵
  PID:13016
- C:\Windows\System\nGjdjQh.exe
  C:\Windows\System\nGjdjQh.exe
  2⤵
  PID:13036
- C:\Windows\System\kqNnPxc.exe
  C:\Windows\System\kqNnPxc.exe
  2⤵
  PID:13060
- C:\Windows\System\DrlEHbK.exe
  C:\Windows\System\DrlEHbK.exe
  2⤵
  PID:13080
- C:\Windows\System\JfAcipa.exe
  C:\Windows\System\JfAcipa.exe
  2⤵
  PID:13100
- C:\Windows\System\tRsYSFg.exe
  C:\Windows\System\tRsYSFg.exe
  2⤵
  PID:13128
- C:\Windows\System\dgsNgxk.exe
  C:\Windows\System\dgsNgxk.exe
  2⤵
  PID:13148
- C:\Windows\System\isomceZ.exe
  C:\Windows\System\isomceZ.exe
  2⤵
  PID:13164
- C:\Windows\System\WypgHOZ.exe
  C:\Windows\System\WypgHOZ.exe
  2⤵
  PID:13196
- C:\Windows\System\yuFBeNM.exe
  C:\Windows\System\yuFBeNM.exe
  2⤵
  PID:13216
- C:\Windows\System\QFrccld.exe
  C:\Windows\System\QFrccld.exe
  2⤵
  PID:13236
- C:\Windows\System\JpYQXss.exe
  C:\Windows\System\JpYQXss.exe
  2⤵
  PID:13264
- C:\Windows\System\orDYXXs.exe
  C:\Windows\System\orDYXXs.exe
  2⤵
  PID:13284
- C:\Windows\System\qeeYsWP.exe
  C:\Windows\System\qeeYsWP.exe
  2⤵
  PID:13308
- C:\Windows\System\loczgdz.exe
  C:\Windows\System\loczgdz.exe
  2⤵
  PID:11064
- C:\Windows\System\TzXRbfD.exe
  C:\Windows\System\TzXRbfD.exe
  2⤵
  PID:6632
- C:\Windows\System\kSVvTMy.exe
  C:\Windows\System\kSVvTMy.exe
  2⤵
  PID:12456
- C:\Windows\System\sIWcwOt.exe
  C:\Windows\System\sIWcwOt.exe
  2⤵
  PID:12520
- C:\Windows\System\DApiFqW.exe
  C:\Windows\System\DApiFqW.exe
  2⤵
  PID:12580
- C:\Windows\System\SaSvgun.exe
  C:\Windows\System\SaSvgun.exe
  2⤵
  PID:12672
- C:\Windows\System\eEmUUDL.exe
  C:\Windows\System\eEmUUDL.exe
  2⤵
  PID:12796
- C:\Windows\System\lWlSBNP.exe
  C:\Windows\System\lWlSBNP.exe
  2⤵
  PID:12860
- C:\Windows\System\sHyRoDn.exe
  C:\Windows\System\sHyRoDn.exe
  2⤵
  PID:12968
- C:\Windows\System\wADFglX.exe
  C:\Windows\System\wADFglX.exe
  2⤵
  PID:13044
- C:\Windows\System\NZUMANQ.exe
  C:\Windows\System\NZUMANQ.exe
  2⤵
  PID:13092
- C:\Windows\System\ApHqKGY.exe
  C:\Windows\System\ApHqKGY.exe
  2⤵
  PID:13140
- C:\Windows\System\QtkxBrZ.exe
  C:\Windows\System\QtkxBrZ.exe
  2⤵
  PID:13204
- C:\Windows\System\bwvZTCO.exe
  C:\Windows\System\bwvZTCO.exe
  2⤵
  PID:13256
- C:\Windows\System\tHTNxUQ.exe
  C:\Windows\System\tHTNxUQ.exe
  2⤵
  PID:11060
- C:\Windows\System\bZhhYAy.exe
  C:\Windows\System\bZhhYAy.exe
  2⤵
  PID:4512
- C:\Windows\System\JfLCVGp.exe
  C:\Windows\System\JfLCVGp.exe
  2⤵
  PID:7216
- C:\Windows\System\MlvvhQK.exe
  C:\Windows\System\MlvvhQK.exe
  2⤵
  PID:11236
- C:\Windows\System\pVEhCDO.exe
  C:\Windows\System\pVEhCDO.exe
  2⤵
  PID:7740
- C:\Windows\System\mMToaMg.exe
  C:\Windows\System\mMToaMg.exe
  2⤵
  PID:11776
- C:\Windows\System\TZYdVAm.exe
  C:\Windows\System\TZYdVAm.exe
  2⤵
  PID:10508
- C:\Windows\System\FRZgksX.exe
  C:\Windows\System\FRZgksX.exe
  2⤵
  PID:12072
- C:\Windows\System\wdksdcR.exe
  C:\Windows\System\wdksdcR.exe
  2⤵
  PID:9728
- C:\Windows\System\nyWLdub.exe
  C:\Windows\System\nyWLdub.exe
  2⤵
  PID:9824
- C:\Windows\System\gGNGqSk.exe
  C:\Windows\System\gGNGqSk.exe
  2⤵
  PID:4496
- C:\Windows\System\QvKaieh.exe
  C:\Windows\System\QvKaieh.exe
  2⤵
  PID:10120
- C:\Windows\System\pYBnhsS.exe
  C:\Windows\System\pYBnhsS.exe
  2⤵
  PID:10768
- C:\Windows\System\TiOuUPT.exe
  C:\Windows\System\TiOuUPT.exe
  2⤵
  PID:5504
- C:\Windows\System\RTPoZSm.exe
  C:\Windows\System\RTPoZSm.exe
  2⤵
  PID:3388
- C:\Windows\System\ogBBOfn.exe
  C:\Windows\System\ogBBOfn.exe
  2⤵
  PID:10796
- C:\Windows\System\hCtcYMx.exe
  C:\Windows\System\hCtcYMx.exe
  2⤵
  PID:1032
- C:\Windows\System\BBtyIsJ.exe
  C:\Windows\System\BBtyIsJ.exe
  2⤵
  PID:8852
- C:\Windows\System\nrxyMcD.exe
  C:\Windows\System\nrxyMcD.exe
  2⤵
  PID:11596
- C:\Windows\System\BPnrSFb.exe
  C:\Windows\System\BPnrSFb.exe
  2⤵
  PID:3860
- C:\Windows\System\UXkAVkI.exe
  C:\Windows\System\UXkAVkI.exe
  2⤵
  PID:7460
- C:\Windows\System\vldzjeG.exe
  C:\Windows\System\vldzjeG.exe
  2⤵
  PID:6628
- C:\Windows\System\WssjMfr.exe
  C:\Windows\System\WssjMfr.exe
  2⤵
  PID:7980
- C:\Windows\System\nuBfhWB.exe
  C:\Windows\System\nuBfhWB.exe
  2⤵
  PID:11956
- C:\Windows\System\EgRynOO.exe
  C:\Windows\System\EgRynOO.exe
  2⤵
  PID:10384
- C:\Windows\System\rljjBaf.exe
  C:\Windows\System\rljjBaf.exe
  2⤵
  PID:9812
- C:\Windows\System\QnSxNtI.exe
  C:\Windows\System\QnSxNtI.exe
  2⤵
  PID:2284
- C:\Windows\System\XIuIXVy.exe
  C:\Windows\System\XIuIXVy.exe
  2⤵
  PID:7856
- C:\Windows\System\rlBcNsI.exe
  C:\Windows\System\rlBcNsI.exe
  2⤵
  PID:10700
- C:\Windows\System\yTynjcx.exe
  C:\Windows\System\yTynjcx.exe
  2⤵
  PID:10820
- C:\Windows\System\hVgSOWo.exe
  C:\Windows\System\hVgSOWo.exe
  2⤵
  PID:7900
- C:\Windows\System\ypigDQQ.exe
  C:\Windows\System\ypigDQQ.exe
  2⤵
  PID:7268
- C:\Windows\System\IBdSlGM.exe
  C:\Windows\System\IBdSlGM.exe
  2⤵
  PID:10252
- C:\Windows\System\oVcVAsa.exe
  C:\Windows\System\oVcVAsa.exe
  2⤵
  PID:4764
- C:\Windows\System\rgaUOSd.exe
  C:\Windows\System\rgaUOSd.exe
  2⤵
  PID:10300
- C:\Windows\System\WOhSzDu.exe
  C:\Windows\System\WOhSzDu.exe
  2⤵
  PID:3292
- C:\Windows\System\PoikJVW.exe
  C:\Windows\System\PoikJVW.exe
  2⤵
  PID:10912
- C:\Windows\System\uxTKjMa.exe
  C:\Windows\System\uxTKjMa.exe
  2⤵
  PID:10928
- C:\Windows\System\BhYQYZX.exe
  C:\Windows\System\BhYQYZX.exe
  2⤵
  PID:10596
- C:\Windows\System\pGzxjtI.exe
  C:\Windows\System\pGzxjtI.exe
  2⤵
  PID:10348
- C:\Windows\System\dMwKBSE.exe
  C:\Windows\System\dMwKBSE.exe
  2⤵
  PID:4992
- C:\Windows\System\hAZqqKA.exe
  C:\Windows\System\hAZqqKA.exe
  2⤵
  PID:12516
- C:\Windows\System\JnezlqO.exe
  C:\Windows\System\JnezlqO.exe
  2⤵
  PID:1700
- C:\Windows\System\iWGxawa.exe
  C:\Windows\System\iWGxawa.exe
  2⤵
  PID:2948
- C:\Windows\System\oXjhnzu.exe
  C:\Windows\System\oXjhnzu.exe
  2⤵
  PID:11048
- C:\Windows\System\otAYHVU.exe
  C:\Windows\System\otAYHVU.exe
  2⤵
  PID:4336
- C:\Windows\System\sGYSaJp.exe
  C:\Windows\System\sGYSaJp.exe
  2⤵
  PID:2596
- C:\Windows\System\Vgoekkl.exe
  C:\Windows\System\Vgoekkl.exe
  2⤵
  PID:7380
- C:\Windows\System\SKVbcbE.exe
  C:\Windows\System\SKVbcbE.exe
  2⤵
  PID:4960
- C:\Windows\System\onMpWGA.exe
  C:\Windows\System\onMpWGA.exe
  2⤵
  PID:11580
- C:\Windows\System\qAjdoou.exe
  C:\Windows\System\qAjdoou.exe
  2⤵
  PID:13316
- C:\Windows\System\FSYCZGn.exe
  C:\Windows\System\FSYCZGn.exe
  2⤵
  PID:13332
- C:\Windows\System\rAZcaDV.exe
  C:\Windows\System\rAZcaDV.exe
  2⤵
  PID:13352
- C:\Windows\System\irzjsiK.exe
  C:\Windows\System\irzjsiK.exe
  2⤵
  PID:13368
- C:\Windows\System\Ahytpte.exe
  C:\Windows\System\Ahytpte.exe
  2⤵
  PID:13384
- C:\Windows\System\xRWPOCY.exe
  C:\Windows\System\xRWPOCY.exe
  2⤵
  PID:13408
- C:\Windows\System\MGbGUxx.exe
  C:\Windows\System\MGbGUxx.exe
  2⤵
  PID:13428
- C:\Windows\System\sViZIqv.exe
  C:\Windows\System\sViZIqv.exe
  2⤵
  PID:13444
- C:\Windows\System\GTUhkCb.exe
  C:\Windows\System\GTUhkCb.exe
  2⤵
  PID:13460
- C:\Windows\System\tqCNVPh.exe
  C:\Windows\System\tqCNVPh.exe
  2⤵
  PID:13476
- C:\Windows\System\LsUoqQF.exe
  C:\Windows\System\LsUoqQF.exe
  2⤵
  PID:13500
- C:\Windows\System\OWoTLfn.exe
  C:\Windows\System\OWoTLfn.exe
  2⤵
  PID:13524
- C:\Windows\System\YOznnaS.exe
  C:\Windows\System\YOznnaS.exe
  2⤵
  PID:13544
- C:\Windows\System\OsIFdHX.exe
  C:\Windows\System\OsIFdHX.exe
  2⤵
  PID:13644
- C:\Windows\System\kFpuExY.exe
  C:\Windows\System\kFpuExY.exe
  2⤵
  PID:13660
- C:\Windows\System\RqzahTB.exe
  C:\Windows\System\RqzahTB.exe
  2⤵
  PID:13676
- C:\Windows\System\fEcbTcv.exe
  C:\Windows\System\fEcbTcv.exe
  2⤵
  PID:13924
- C:\Windows\System\ubYFIao.exe
  C:\Windows\System\ubYFIao.exe
  2⤵
  PID:13948
- C:\Windows\System\pzNBRNb.exe
  C:\Windows\System\pzNBRNb.exe
  2⤵
  PID:13972
- C:\Windows\System\jSovKbR.exe
  C:\Windows\System\jSovKbR.exe
  2⤵
  PID:13996
- C:\Windows\System\SAKBCbI.exe
  C:\Windows\System\SAKBCbI.exe
  2⤵
  PID:14016
- C:\Windows\System\aelbOjO.exe
  C:\Windows\System\aelbOjO.exe
  2⤵
  PID:14040
- C:\Windows\System\wrqHlRm.exe
  C:\Windows\System\wrqHlRm.exe
  2⤵
  PID:14072
- C:\Windows\System\dEoYxlt.exe
  C:\Windows\System\dEoYxlt.exe
  2⤵
  PID:14092
- C:\Windows\System\MyvfpjU.exe
  C:\Windows\System\MyvfpjU.exe
  2⤵
  PID:14116
- C:\Windows\System\xGcFjnP.exe
  C:\Windows\System\xGcFjnP.exe
  2⤵
  PID:14136
- C:\Windows\System\CPskagb.exe
  C:\Windows\System\CPskagb.exe
  2⤵
  PID:14160
- C:\Windows\System\UTUCiSi.exe
  C:\Windows\System\UTUCiSi.exe
  2⤵
  PID:14184
- C:\Windows\System\rrNSKue.exe
  C:\Windows\System\rrNSKue.exe
  2⤵
  PID:14200
- C:\Windows\System\qNpTLEL.exe
  C:\Windows\System\qNpTLEL.exe
  2⤵
  PID:14224
- C:\Windows\System\UnmDSBQ.exe
  C:\Windows\System\UnmDSBQ.exe
  2⤵
  PID:14252
- C:\Windows\System\guqWnBQ.exe
  C:\Windows\System\guqWnBQ.exe
  2⤵
  PID:14272
- C:\Windows\System\lpDAYmr.exe
  C:\Windows\System\lpDAYmr.exe
  2⤵
  PID:10960
- C:\Windows\System\lFDWtLW.exe
  C:\Windows\System\lFDWtLW.exe
  2⤵
  PID:10456
- C:\Windows\System\bpfGwuJ.exe
  C:\Windows\System\bpfGwuJ.exe
  2⤵
  PID:12756
- C:\Windows\System\SZXkOsU.exe
  C:\Windows\System\SZXkOsU.exe
  2⤵
  PID:10060
- C:\Windows\System\DZLiuzy.exe
  C:\Windows\System\DZLiuzy.exe
  2⤵
  PID:12436
- C:\Windows\System\AFRMKpF.exe
  C:\Windows\System\AFRMKpF.exe
  2⤵
  PID:9636
- C:\Windows\System\rjwEmxn.exe
  C:\Windows\System\rjwEmxn.exe
  2⤵
  PID:12116
- C:\Windows\System\kjClycZ.exe
  C:\Windows\System\kjClycZ.exe
  2⤵
  PID:7676
- C:\Windows\System\xcbMSSM.exe
  C:\Windows\System\xcbMSSM.exe
  2⤵
  PID:13244
- C:\Windows\System\SlpubJe.exe
  C:\Windows\System\SlpubJe.exe
  2⤵
  PID:13720
- C:\Windows\System\fpyTFzZ.exe
  C:\Windows\System\fpyTFzZ.exe
  2⤵
  PID:14036
- C:\Windows\System\BlWEXzb.exe
  C:\Windows\System\BlWEXzb.exe
  2⤵
  PID:14220
- C:\Windows\System\OBlWhaL.exe
  C:\Windows\System\OBlWhaL.exe
  2⤵
  PID:9648
- C:\Windows\System\QXXhyIz.exe
  C:\Windows\System\QXXhyIz.exe
  2⤵
  PID:11540
- C:\Windows\System\eOgktBm.exe
  C:\Windows\System\eOgktBm.exe
  2⤵
  PID:12408
- C:\Windows\System\urUcbhN.exe
  C:\Windows\System\urUcbhN.exe
  2⤵
  PID:14320
- C:\Windows\System\HRvRGmn.exe
  C:\Windows\System\HRvRGmn.exe
  2⤵
  PID:12472
- C:\Windows\System\rurxOvV.exe
  C:\Windows\System\rurxOvV.exe
  2⤵
  PID:12488
- C:\Windows\System\gxxOCyg.exe
  C:\Windows\System\gxxOCyg.exe
  2⤵
  PID:12960
- C:\Windows\System\GaAlcYw.exe
  C:\Windows\System\GaAlcYw.exe
  2⤵
  PID:2392
- C:\Windows\System\OgjcDoa.exe
  C:\Windows\System\OgjcDoa.exe
  2⤵
  PID:2548
- C:\Windows\System\yqMYZUL.exe
  C:\Windows\System\yqMYZUL.exe
  2⤵
  PID:11996
- C:\Windows\System\SvLBmCs.exe
  C:\Windows\System\SvLBmCs.exe
  2⤵
  PID:13744
- C:\Windows\System\DAdElmT.exe
  C:\Windows\System\DAdElmT.exe
  2⤵
  PID:12604
- C:\Windows\System\iyWHhSR.exe
  C:\Windows\System\iyWHhSR.exe
  2⤵
  PID:4012
- C:\Windows\System\XkSdtuW.exe
  C:\Windows\System\XkSdtuW.exe
  2⤵
  PID:13772
- C:\Windows\System\WtPYsqF.exe
  C:\Windows\System\WtPYsqF.exe
  2⤵
  PID:12492
- C:\Windows\System\irZKUuu.exe
  C:\Windows\System\irZKUuu.exe
  2⤵
  PID:4976
- C:\Windows\System\FHQUdNt.exe
  C:\Windows\System\FHQUdNt.exe
  2⤵
  PID:9032
- C:\Windows\System\Gdzehrr.exe
  C:\Windows\System\Gdzehrr.exe
  2⤵
  PID:14208
- C:\Windows\System\ZNnakLO.exe
  C:\Windows\System\ZNnakLO.exe
  2⤵
  PID:14332
- C:\Windows\System\EogYjHn.exe
  C:\Windows\System\EogYjHn.exe
  2⤵
  PID:11364
- C:\Windows\System\rkGAyHA.exe
  C:\Windows\System\rkGAyHA.exe
  2⤵
  PID:13652
- C:\Windows\System\tVKnreB.exe
  C:\Windows\System\tVKnreB.exe
  2⤵
  PID:8836
- C:\Windows\System\wmUaczg.exe
  C:\Windows\System\wmUaczg.exe
  2⤵
  PID:532
- C:\Windows\System\fxMAzHr.exe
  C:\Windows\System\fxMAzHr.exe
  2⤵
  PID:11172
- C:\Windows\System\HwrScPU.exe
  C:\Windows\System\HwrScPU.exe
  2⤵
  PID:13880
- C:\Windows\System\zAgofVw.exe
  C:\Windows\System\zAgofVw.exe
  2⤵
  PID:9872
- C:\Windows\System\zlEIqyX.exe
  C:\Windows\System\zlEIqyX.exe
  2⤵
  PID:14236
- C:\Windows\System\KqDGQuG.exe
  C:\Windows\System\KqDGQuG.exe
  2⤵
  PID:4792
- C:\Windows\System\MvVzMHK.exe
  C:\Windows\System\MvVzMHK.exe
  2⤵
  PID:13792
- C:\Windows\System\gbWDMgx.exe
  C:\Windows\System\gbWDMgx.exe
  2⤵
  PID:1880
- C:\Windows\System\oqysmqn.exe
  C:\Windows\System\oqysmqn.exe
  2⤵
  PID:232
- C:\Windows\System\luFBBUg.exe
  C:\Windows\System\luFBBUg.exe
  2⤵
  PID:13932
- C:\Windows\System\PgUgsTo.exe
  C:\Windows\System\PgUgsTo.exe
  2⤵
  PID:14008
- C:\Windows\System\nsCyymA.exe
  C:\Windows\System\nsCyymA.exe
  2⤵
  PID:14148
- C:\Windows\System\KFFjrZZ.exe
  C:\Windows\System\KFFjrZZ.exe
  2⤵
  PID:4472
- C:\Windows\System\zpisZZx.exe
  C:\Windows\System\zpisZZx.exe
  2⤵
  PID:13796
- C:\Windows\System\yLUFFwX.exe
  C:\Windows\System\yLUFFwX.exe
  2⤵
  PID:4080
- C:\Windows\System\ECXotfY.exe
  C:\Windows\System\ECXotfY.exe
  2⤵
  PID:13304
- C:\Windows\System\PskFjRh.exe
  C:\Windows\System\PskFjRh.exe
  2⤵
  PID:12840
- C:\Windows\System\hHyZlXQ.exe
  C:\Windows\System\hHyZlXQ.exe
  2⤵
  PID:13564
- C:\Windows\System\ZkHnxPx.exe
  C:\Windows\System\ZkHnxPx.exe
  2⤵
  PID:5452
- C:\Windows\System\GgydoFr.exe
  C:\Windows\System\GgydoFr.exe
  2⤵
  PID:6276
- C:\Windows\System\IzXqcqu.exe
  C:\Windows\System\IzXqcqu.exe
  2⤵
  PID:13456
- C:\Windows\System\TpbrLcJ.exe
  C:\Windows\System\TpbrLcJ.exe
  2⤵
  PID:10160
- C:\Windows\System\VLZtMzS.exe
  C:\Windows\System\VLZtMzS.exe
  2⤵
  PID:6736
- C:\Windows\System\MrSMSnX.exe
  C:\Windows\System\MrSMSnX.exe
  2⤵
  PID:13400
- C:\Windows\System\nUtpnaJ.exe
  C:\Windows\System\nUtpnaJ.exe
  2⤵
  PID:3688
- C:\Windows\System\BoZGaQW.exe
  C:\Windows\System\BoZGaQW.exe
  2⤵
  PID:13344
- C:\Windows\System\khklAWK.exe
  C:\Windows\System\khklAWK.exe
  2⤵
  PID:3240
- C:\Windows\System\gfyHOIU.exe
  C:\Windows\System\gfyHOIU.exe
  2⤵
  PID:4628
- C:\Windows\System\jScLXkC.exe
  C:\Windows\System\jScLXkC.exe
  2⤵
  PID:13868
- C:\Windows\System\nTnyphi.exe
  C:\Windows\System\nTnyphi.exe
  2⤵
  PID:14280
- C:\Windows\System\RCPTGry.exe
  C:\Windows\System\RCPTGry.exe
  2⤵
  PID:11844
- C:\Windows\System\BziAltp.exe
  C:\Windows\System\BziAltp.exe
  2⤵
  PID:14316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1bh4rmwr.vvb.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BnxZucz.exe

Filesize
1.4MB

MD5
80b921458e52706928c9cc36544741ac

SHA1
703c15b22bf37c0a2b62d80d6601d9e5893aa462

SHA256
2398c91dd6665faabd7eba89e0f7c681228fba08fc1658a7cfd4e9d1b4c62045

SHA512
e1afd9d0e22f9be8ed05ed2303ef8d5257d72d0f92e0d5ae772a4db47af51121aca5e667af01515e6f5d141e0991a0146d3fb9c200aa6b218747de92cd1767b9

Download Submit
C:\Windows\System\DIgcSRP.exe

Filesize
1.4MB

MD5
2320127ee1a54b4b4373957e71907c30

SHA1
55b0b4a5a79949e3e60fa4abd3ab419001c0637d

SHA256
518393086e41c37ad8602100ac78bc62fcb47dee7c1855d6bc3f0a65f85ae850

SHA512
5b1a06fb5d35536b372437902a92c6e46c6adfb4dc5c50b63b727fdb44134f2a6f79f9429ea7d2cc12618778a072983a6d2abb716f52c75d120108ec60a8b2e1

Download Submit
C:\Windows\System\GezsFyT.exe

Filesize
1.4MB

MD5
d077e05c12a77d9dfb3520898c9c6754

SHA1
ca6ae1d90fb8d4063b42ebbc89bf985ce95b67c3

SHA256
037cdd9d37b174fb2a6e0b8985f62d8da5bea22def78fbbdf445938b77d47f7a

SHA512
2c8bbd8b436a6c582967b58d32f094ab29c2aa9be1cfd0bba5e0a8bc7e7f683fd61939d2800bab8ef56041e6f881d7d81762a2e26192015a9e5cf2f924259786

Download Submit
C:\Windows\System\GtcCowM.exe

Filesize
1.4MB

MD5
3702e0bd28d0f226a509e082c173ed79

SHA1
e0356b25e04e6ee29ed217956c569b47aea53a4a

SHA256
e912c013c9e19d237f70854a2ea942537342756249d0f0a8faeba16804a177a1

SHA512
163e4da43d82e93a06b39bab9e2c8d97f0794c438aaf5235dafd3cde7def08a9ffb8938a5b66455744b00d9e9ccad1a86fbe6b9b55bb96c3f8c05dacbdd56eb8

Download Submit
C:\Windows\System\HJzFFnd.exe

Filesize
1.4MB

MD5
8f4ad929bece8e823156e4e2d56f5bd7

SHA1
b82366c19102c1565b1cfd53815a8b06715182c3

SHA256
72e02ca53c3f22cf5937c1884e5776e233493a4073bdb3678f9609ec456959b7

SHA512
1856a7b8e0e82c79e7b9fb098dd4b7d1bf015e3a6e70fa62d58918e346f12a8fa105936f5b2a3fdc7c0934e043ae206ec6aadbb9196fd80406fda7154dc08d52

Download Submit
C:\Windows\System\HOKauoj.exe

Filesize
1.4MB

MD5
9bb67cdb3a169391497b78bb02e0b2bf

SHA1
90c839f368e1de33124b5d292cf004317f6cb933

SHA256
e7c9e91f6bc0e2c7b49e89358539add7b706dd0b7a0af3f40e2ac9b042c60806

SHA512
0371b6d45e183d774e9116eb5b4ad3a02c923234485db716f754f883a34d37488de27869d2f5687e4fb44868be635eb30a1c5a54f9834685889992b744b29bb0

Download Submit
C:\Windows\System\LAfHJCQ.exe

Filesize
1.4MB

MD5
baa6d788beded63cbbcb02903b3bff16

SHA1
f8ca06fd96cb664ca3bca543b384ae73138570d5

SHA256
3335ee5b03874217460d88c74d8d4bb34e38ebb371a2a85e25bc84c81d1bfb3f

SHA512
55d34cca2dbf2998f8811a9d8aaddabb2731e1c9407a97bfaf09d03033572bb0f5f73211db678c43bc6fe6042970c89bc99fbe4b32b5419716bc2c57563346e1

Download Submit
C:\Windows\System\LezLVUK.exe

Filesize
1.4MB

MD5
b6fdf75eef134a867cafb17a936f378e

SHA1
c5a95671e4bc4891baae62af5e38ec7a48a9d9a9

SHA256
e3fb5fdcf0e77309194598a5f068d5957bb21f31f76af9d1f73b22ae7c57b0c7

SHA512
0273288550a02d532067fb4cf3f71a2b286bfe4fdc601660bc4a98f21bc6877db0dd57374fd5bb8462195794cd99392fe383aa3c18d014a0ebc88244ee79c859

Download Submit
C:\Windows\System\OgMQKMY.exe

Filesize
1.4MB

MD5
c8bf1ae60dc9f8ae27907f8f4a00e53c

SHA1
d197084c78d3ddcc6c431e7b4dd313170436cc9f

SHA256
3a9e8215518391044ed678d8416282c0603dc2a35f86237e7b661cfbc6e0916f

SHA512
c60b096fff4480a79db5d8087d9d4f81182b787781d00eae0cf50255af38d73114e083f346d9511707f8d53b2446661a23d89c3502d63bb3169e9b8ceb9522bc

Download Submit
C:\Windows\System\PfHpJBq.exe

Filesize
1.4MB

MD5
f257f0372c0873f61f2b5e405d5861de

SHA1
d37426f5730a7b0b9bbe25864038e0dece64f50b

SHA256
8b6aa696c7783572960fa7cf00222f9d67e5ca1f4f358866d5dccc3508d2af7c

SHA512
9d5633f5c61008a3f5173b334be539ff8abc8d424b3f480d2de9f3a7cc4a896af32f6d7fc46cbfb033feb3e9138f56ada58aec81adefe3b143ece7f0efe08ef8

Download Submit
C:\Windows\System\PuJJYmZ.exe

Filesize
1.4MB

MD5
54869d28e0fab3f4b07d03ba1ef81d1e

SHA1
ff5a970888cf5323689b51e46f3db9eaee0e6fbe

SHA256
ce135c361e3f33090aec32a488a856513593e89bdda3b7ad0b24b78c21b79aa4

SHA512
93bf2028d4a729b83c6cb6afd48781d3fae96e8de7e686331b0f70c9b70e99f52b333bc2584491253c290bfa8ffd6ed7632867128803b12d1428e906096c3786

Download Submit
C:\Windows\System\QWeUBQk.exe

Filesize
1.4MB

MD5
e2a7525b6dded50d1c58d84adca09e20

SHA1
1597a939181f1b21f700c7822f3f4dd44e2d6d9f

SHA256
6ed8816079113558a96ce42de2e9184b5348e74fef0aced25c2bc63d072c65d8

SHA512
8a0e4e35dace0bfb02917941a726853b82439d786489a11166069b0bf5c7074b4cee03c0536586a5980158d0341729e3600bfd9384b1f7dc221f0f41063f3dac

Download Submit
C:\Windows\System\RCInpVP.exe

Filesize
1.4MB

MD5
503960f414d707485236c976cc57e96f

SHA1
0c480c90170092e99856454674681da9a2106d2b

SHA256
9bc811753dae0a073249c48f98bca4883196687a96ab6d129348678ec203ad3c

SHA512
5324b020df33c21c88e19bf2513c89855aac8ef643a97767eb99a9972b50833ca61dd30b540fe480a0c886028b261439b4166486ef552747d6a0157fd8abf70c

Download Submit
C:\Windows\System\SJkDphy.exe

Filesize
1.4MB

MD5
c91cefef70f8196c9d2f564629bf9492

SHA1
4554ae6bfd1bda146d25a4517c7a1a36965d588a

SHA256
dcf5f1c96a30cb8c276ee28fb3e253a544302933083ab58c994d12d32da82762

SHA512
d09e038053b4032c557c764f2c71b688a25f551603075d0b004965dc212be4d97a2fa1b3e0d996d906e597b79b21820a453633dd73b94570a6d43de8acb0b676

Download Submit
C:\Windows\System\TjPPbeE.exe

Filesize
1.4MB

MD5
a1c7c9bdf367d2a2ade30622f89ea1f4

SHA1
05db8e8c1192f5bbaa06eea69393bef461c56821

SHA256
1fd112212c6e5aa90989a2ce98d6667727ba51ab079edafbf62c38ea3d56aacd

SHA512
feeb87f48a294a3fb817b33a0cafc504ebe36abfc98754ff60196313b733b9171767373e1d263240355b841967a02749340128598f75606ea8738ae116145ec7

Download Submit
C:\Windows\System\ZYsneWv.exe

Filesize
1.4MB

MD5
8bacb334a981b02689617417e72f772b

SHA1
0b98fca2c08c6ac42161fa5f413db1974869386f

SHA256
6bf5fc091915a9c0a8f2000c9c01b70a619d94fca8d5c4ee8c630cb6d98fcf55

SHA512
1d7e2cbb871914a5162d16634aa45ce3675419a087cc4d3b5e85773e4923c21ffcf6a26914359d6781f087ea5d569ce2a3fc78bc213e0bba5466a5fc33745cb5

Download Submit
C:\Windows\System\acdOOse.exe

Filesize
1.4MB

MD5
3646d95a534d0404cc694ad0c09b485a

SHA1
96c4739e2546bab105c150132067fbdda4051462

SHA256
8b3b7dc65facb21b9e3877cd82b78728e81be9f3d0df92031885f4d729fb80e1

SHA512
f4bcfc87dcf8f3d4076c70e9cbc79136714d96f91e3e4d357eeb5f7f961cafc838ef3a9bbec174b88be2fa37b69ca2d755ffb5a984b26faa6b81e8e36c8953e9

Download Submit
C:\Windows\System\ackGzNS.exe

Filesize
1.4MB

MD5
86652c64dfa8d8bcd0a58aa81b71e32a

SHA1
f90a3f329523c9ef9051bbb7fa50f4f28c812c16

SHA256
8fd9294401e3551d74582caaf6ae8af3689cce91fe13d146ead4337089e3273b

SHA512
0562974fcad7c652735559f5549db3f842529c0312d39365fc8687229c3b1418f3e2389b1dfccd4de9e04c64ab93fd2c2b9feec589a2252be58ee99707374cd5

Download Submit
C:\Windows\System\bIjfpll.exe

Filesize
1.4MB

MD5
b4943f865663a36ea2319d140d764a30

SHA1
12115a771d1a495d4804ad3b1368f116e77cd04f

SHA256
4e8f0cc5c98027bcabac12022d12a49925f66dae05478c13a183113aa0ca6ffd

SHA512
b0d63e3f3f6a15da481a52dcaee4d711551493279e09a27ce83238a04beec130faab2b146f59069cd1e1b4db8ed30617d2f87dd4d71568040edb588dae76b79b

Download Submit
C:\Windows\System\beGWrlx.exe

Filesize
1.4MB

MD5
08d1093eef45aaf73ed8e37217571171

SHA1
a577a4e1d33380bb586ec751ad180b977382cac6

SHA256
3232e24ed921739279729697be22846c0e54d1dc2feb6ac14e5e305615db1afa

SHA512
393b562cda825b71b57d7c99b979cca9fb798ed173ee512c0e0ea88c1f71f74ebbf826495c62c5454c7c17174f76487d3dce4ddde1ccc10bf3b376094b2f5afd

Download Submit
C:\Windows\System\bkeuQzP.exe

Filesize
1.4MB

MD5
246e0f01ba69a83362428bccaccb33e8

SHA1
cc153553a517602e48ac794cc508600a90878785

SHA256
0e86d3d5c337b48816842db7aacd34f892e867fb1b47cb762343ef1ba5c85b99

SHA512
f6a7da9b3fa7929bf38415c0c851464be8a3f19d6d51db3ad4195ac324ef2111f2e0c653649470607de72ae67a0cc552fbb9510b63652dae6c0972b5a8228059

Download Submit
C:\Windows\System\dTaAeAP.exe

Filesize
1.4MB

MD5
5554e97c59a019ad93801ac53801de65

SHA1
05002a47c918907ad53530313c88d86335e2ee44

SHA256
819a409b2170b37b5ec0c740fc252689e610a3152325bee40fb778eb3965901c

SHA512
b95c483bb135cf31d2ba7097b1a700f4cfd02efb38d52feedf5ff446209600919f7ae4582e44e764fe01f5a1a592efe8a74364a4b4dfc9a5cfd01353128a749e

Download Submit
C:\Windows\System\dYabVcL.exe

Filesize
1.4MB

MD5
d93e3162dafe90b79eafe014dd301f45

SHA1
608f6876a2006c59a028f1c4bcf88cd3b7cb8f58

SHA256
16abf56826959e827dc438f5c55c590ec3332d5f8ed0b94e148cc0bc0a325cff

SHA512
cd1e8b857faaeb6857cdaf769f3d047457f9f756aa7c9443e719e5776ff8a1079c5aca6bf2bce6be77ea3c7acd63ad2ac64055db482ca88abf42adaa80948111

Download Submit
C:\Windows\System\eQLozJq.exe

Filesize
1.4MB

MD5
27a42a003a39fad13b0949d29764b3ca

SHA1
92d251e32362822d314fcb7353783fa0c9e9985e

SHA256
4ebb458ab3e21bae9a7f39c673fef6e191de06c1319805d9b7e39787e035709b

SHA512
dbc0326d10bd494ca67473db51c391f073ffe740375a5019dff9c6f1d7a865f0891b25c9565829a221d336147bab11bb0b672e4dc60338e8ae8332e0b81dc22e

Download Submit
C:\Windows\System\ezhjFya.exe

Filesize
1.4MB

MD5
3cbe642ebf1d721cf32b559a839e5b2b

SHA1
41b7e9724cb05ec02bc2ae034a841d3007741ffc

SHA256
bb04fdbddd650c35837c631ef33a314b397da88711cabc21b0acd66a92f1d2a5

SHA512
dec880997ec84609e8042655f2e6c65a91a96690e0c38b69af4ca6f846a63a39956af28db9a6b8c992b31197dc1459a61d596850d404f76a0711e5b479733a23

Download Submit
C:\Windows\System\gMrcVQw.exe

Filesize
1.4MB

MD5
d03ad8dea6403ed0f7b792fcf15aec53

SHA1
bdcfe01de55a81fbf10790db68e0d180a5d5310c

SHA256
d2220d993546d39f4157e2c66140ff1a7fb1645170841c0fbcdb6f6bd63f5e05

SHA512
5d6937e84f979e8dda543d2af40f78440b55f83627141e46be91377f7e09469991ade5ebe034d37be61afae068f5bcfb3adf77572bdc56b07ba02fbdd4067ec4

Download Submit
C:\Windows\System\hLFBxJf.exe

Filesize
1.4MB

MD5
b2a36ff25ba13ddc449602f9c1015b96

SHA1
d73a0d20eb5d48e52f36d6479eedae4365955e0d

SHA256
d5c871d2f41f54fc6b0810f25a29973e2fdfe490e90af3dcbebe7f05d0679e4e

SHA512
56768dc993579284fb23f7d856963ebe6889f0585b8a869d9b34fd8278d49994ad6508666076f1238c02ec762b82c520a28a334c75ebb4fa36f8d6670e6e55ec

Download Submit
C:\Windows\System\iSFlLtD.exe

Filesize
1.4MB

MD5
13d11945d31fcc09b2686bbcf6c922d9

SHA1
8c895addaea02fd3899b26ce15ccb6b60d81d582

SHA256
434d002ea07a77757d5d952f942694f5ab3eda9cadb5e556a871210e7f4a32c8

SHA512
caa3f86aadfd4c173c77585ccb5146770b84431058b6f41b7dde5976b93ea5b1cd5876f09645ab7c321ee42f66f0505a6f9ba43bcaf26f75a3c7b6308eb1e9e9

Download Submit
C:\Windows\System\jSkZPUV.exe

Filesize
1.4MB

MD5
d48c6ecf53095f6d7e1178ff77493611

SHA1
7c05b4b5872fc5fb11bd0c34d728bef00d2aa088

SHA256
19ca770a94d6b3b4932a17da3f70ae94f9f08d97db99d08c2717f9200f0beb2b

SHA512
850f2a26bebea3c185255889d78e0ce4de42c574338bdfb5845b4d08ff3470d39cf6c307a2f43ce5a89fd886a226148e5ce71a21064ad51d04a891a4dd059acf

Download Submit
C:\Windows\System\kKVZgIp.exe

Filesize
1.4MB

MD5
0944003437b53f576d9dd8089b112266

SHA1
07187b0afef3923e5080e4c4fa6dd349c674b392

SHA256
6e05a0ada461e4956091cea15f6bfecb77864d1a5be13341b4403fa8bbd77b68

SHA512
c6b819c8d428d5d7efb90b3febf7556fbfb99444d9f0f9b730bc248dcac69c5c6226da05fc62f83d4511fcae962a4b5e17460717f39f12613fe453f3b91f2703

Download Submit
C:\Windows\System\ltDmAUU.exe

Filesize
8B

MD5
8a9416a5ba3f4513ce86ee25fcd9ed2c

SHA1
a36f3dd1333c8cfee404b646d4c6809d7e653313

SHA256
fb7dd3a16f87fe8b7e98987069f2b605508df1550402bd2a9bfdec4856b1a59a

SHA512
c747d417c3e282ae9ec82b691c8fea9cb7d0729d1dda54d2144fa9c71dd39f2ab11cee5a6768a89cb91fd4a7ae6e579302cb4e4de8d6384014994320074580a4

Download Submit
C:\Windows\System\mbEZiUC.exe

Filesize
1.4MB

MD5
de8909e81e0b1d574136bb0d1b9bb913

SHA1
e4419b06b8d8740782bfef8d7c17d270603bec7c

SHA256
bfe73220bae17d84115efc9c854c55b13747153d0303f15a2c190e5aac42caa8

SHA512
9c8b960edf8a5d642f02152009bd1584a18599726a22dbd265b267b4e89bc129ec6936f45a7320076c50d935e4cbdaa4b531603cd429836a6aff92dfed6db0ae

Download Submit
C:\Windows\System\mqwovmR.exe

Filesize
1.4MB

MD5
d829bb4cc348f28728f576f41008e78f

SHA1
2e8b903eb622071f8f0fd73a99f6dd4e6be90ce1

SHA256
72631d5ed49f3a54ae97140d08de660d877af2538af28b195a57a18d3a2af5af

SHA512
af1bb99347b8ac3aaba74cbad691a978c6eb40fe01710435b40df8fdc8eef3b52c96bb13435cef310b94455b51ba0abc6fde5c9486bd13f1868dfdc8e7b4e837

Download Submit
C:\Windows\System\nWeDvSL.exe

Filesize
1.4MB

MD5
03c1588c814f4083622e0c1a0dd6a9d3

SHA1
185f8e315cafedc7c2e97842d7541f5a0b7bbfaf

SHA256
087efe6d048051f22b1bbc30085a71e651b1980c396f95d5390ff20857a8f363

SHA512
fe0e964fbcbae7c07f7f0053eb1318e01bd43512b11cf2a6878de1c4d2f9d96ec01d9de70f23ca5a71d8663883b2739cc4413a4dd042ac7008927978adeb0773

Download Submit
C:\Windows\System\nkGaKYx.exe

Filesize
1.4MB

MD5
ea60bec44f5000aee91f8420556e095e

SHA1
21ff7bcb26643be8f552719b34b576282ca17cc6

SHA256
c69cab75c00e980d73e3281a5aa16228afe61d90f2341eac1efe8075f42654dc

SHA512
9e146593c83ba335f63bec6b1b056bbd458003ee14eceaca90dd841bf913416e25fe33e03a4c6e06a515d3e76c6366509af8b59238da40520edeb4728a88ecb3

Download Submit
C:\Windows\System\opWaIxL.exe

Filesize
1.4MB

MD5
da8958c16e86a86203c8a40776aac19d

SHA1
83f201a91f89aa62fe2f93f6bc32bfdb53ffb255

SHA256
11741d8d2e5d228a080c188ae5e330897954f6c652bdc75db8db143a19844aca

SHA512
fab5c4da8f44f49ba7d65fac0529f14fa7252c7cf6fa14ff81383005fa68205a575fcef979c1f683f80e85f069b2e00e05ef7204390681b2b4457188e6a82571

Download Submit
C:\Windows\System\qflaYiR.exe

Filesize
1.4MB

MD5
f30c3c627e63e77d0bee6cd28ff01a09

SHA1
1dcb70045e2151684f62b02523e9a0899949f34e

SHA256
158a9d17d288345070288bebef270a54e239482f1f31d4ed40ceb4d9d78be26c

SHA512
9f18c2c6fa0b059ee0d538e8e3192f3131e81467c0a98e86e936da261d00beff338ef4478f235007a93e1780347a9257889c1e20c4a6ea7ca5b6489ada92f5b0

Download Submit
C:\Windows\System\sffZmiQ.exe

Filesize
1.4MB

MD5
5b8e591b9cee495617434d13b0d0b24c

SHA1
e551b8215065530056a6448196cfc2d925e6c1fe

SHA256
09e61795210bc68a5522723a8ccfa4f2698bbdc188fe9488e1a54a503781b32c

SHA512
0795a591ed4bd5fd2f82848c2dc73d27d9ecae0af5f18aded28472188f95473281558c532ca8698f2683d3ff4b0e637bd623410735877496d1f7947aa6b69734

Download Submit
C:\Windows\System\vBwvvDr.exe

Filesize
1.4MB

MD5
98e29426d108f2c6d0947503a591b6f0

SHA1
e54da1d7db44239024698269139835059b7c6ef9

SHA256
d09739211111cf566bd8fadbb40b30169c0a7b17084d9d7a15f5586172c923f6

SHA512
0b9057c36b7ba369f4f14a9d2a96b1bce735c6d3503707fe579f80698fcabda9dac6a78a14f08d219818dbdae181ff7d922880b3bd8aff8ee333a08294737b81

Download Submit
C:\Windows\System\vGXBbqJ.exe

Filesize
1.4MB

MD5
90e396923045130169d912b9ea8cdd8e

SHA1
c894eaadbf5257b3f4856e21f9f14e9d1d0fa0ce

SHA256
76eb3df2c1ab38ca99264763fb503d68fa016a3a534a4475ed65e3b88873499e

SHA512
1c656e1a4ae2cafa4260308bd6cf39b98cebcfc16571c365564bc74e13af0c19cca8d175b1d6fbfff2c74b95d08c17abbe531fe65c1a6b009734dd6f69c8e1cc

Download Submit
C:\Windows\System\wLGPXnL.exe

Filesize
1.4MB

MD5
0d64bce13598ef6d2344a5583ec34201

SHA1
7e9d50f61ae9e726c9559e5b11915bb9358007f2

SHA256
548072619a46dcbe1e840d5933e60679688d49d2454706e449efda619ee33204

SHA512
c03d78f410627bc2d049d9bc6142323b935a52080850bad6535a098e11536c0acfb315aed241f241825282fdcf9760c0443eabaa0e6088e5e08d5cdc0b2af0e4

Download Submit
C:\Windows\System\xuDoXcJ.exe

Filesize
1.4MB

MD5
2f57aafd4afed30a294a727d094262d6

SHA1
00572450a6574725c27e4ad7c451161547804217

SHA256
76f4574d83b886277319664ed3572f5063aec354d7dd773d7a501949ce3c171f

SHA512
09116f69f2d4bb3b59e21d9b5158d30da1debd691f50d8392a8bf011c841c0d7781aecc3879bc1a761378cc38c2ff1d2bcfdfc1dc24ca4e4546830ccee20c6d9

Download Submit
memory/64-244-0x00007FF70C7E0000-0x00007FF70CBD2000-memory.dmp

Filesize
3.9MB

Download
memory/64-4637-0x00007FF70C7E0000-0x00007FF70CBD2000-memory.dmp

Filesize
3.9MB

Download
memory/860-436-0x00007FF77C630000-0x00007FF77CA22000-memory.dmp

Filesize
3.9MB

Download
memory/860-4654-0x00007FF77C630000-0x00007FF77CA22000-memory.dmp

Filesize
3.9MB

Download
memory/1012-4661-0x00007FF6998E0000-0x00007FF699CD2000-memory.dmp

Filesize
3.9MB

Download
memory/1012-441-0x00007FF6998E0000-0x00007FF699CD2000-memory.dmp

Filesize
3.9MB

Download
memory/1192-596-0x00007FF71CC10000-0x00007FF71D002000-memory.dmp

Filesize
3.9MB

Download
memory/1192-4641-0x00007FF71CC10000-0x00007FF71D002000-memory.dmp

Filesize
3.9MB

Download
memory/1516-4643-0x00007FF6D67B0000-0x00007FF6D6BA2000-memory.dmp

Filesize
3.9MB

Download
memory/1516-248-0x00007FF6D67B0000-0x00007FF6D6BA2000-memory.dmp

Filesize
3.9MB

Download
memory/1848-4652-0x00007FF68B3B0000-0x00007FF68B7A2000-memory.dmp

Filesize
3.9MB

Download
memory/1848-389-0x00007FF68B3B0000-0x00007FF68B7A2000-memory.dmp

Filesize
3.9MB

Download
memory/1924-394-0x00007FF68C820000-0x00007FF68CC12000-memory.dmp

Filesize
3.9MB

Download
memory/1924-4649-0x00007FF68C820000-0x00007FF68CC12000-memory.dmp

Filesize
3.9MB

Download
memory/1936-178-0x00007FF7BF5B0000-0x00007FF7BF9A2000-memory.dmp

Filesize
3.9MB

Download
memory/1936-4635-0x00007FF7BF5B0000-0x00007FF7BF9A2000-memory.dmp

Filesize
3.9MB

Download
memory/2200-434-0x00007FF6DDF10000-0x00007FF6DE302000-memory.dmp

Filesize
3.9MB

Download
memory/2200-4668-0x00007FF6DDF10000-0x00007FF6DE302000-memory.dmp

Filesize
3.9MB

Download
memory/2328-438-0x00007FF70B580000-0x00007FF70B972000-memory.dmp

Filesize
3.9MB

Download
memory/2328-4675-0x00007FF70B580000-0x00007FF70B972000-memory.dmp

Filesize
3.9MB

Download
memory/2352-4672-0x00007FF61C970000-0x00007FF61CD62000-memory.dmp

Filesize
3.9MB

Download
memory/2352-437-0x00007FF61C970000-0x00007FF61CD62000-memory.dmp

Filesize
3.9MB

Download
memory/2616-0-0x00007FF7BC4B0000-0x00007FF7BC8A2000-memory.dmp

Filesize
3.9MB

Download
memory/2616-1-0x0000027E68F60000-0x0000027E68F70000-memory.dmp

Filesize
64KB

Download
memory/2744-439-0x00007FF777C40000-0x00007FF778032000-memory.dmp

Filesize
3.9MB

Download
memory/2744-4656-0x00007FF777C40000-0x00007FF778032000-memory.dmp

Filesize
3.9MB

Download
memory/2968-586-0x00007FF691010000-0x00007FF691402000-memory.dmp

Filesize
3.9MB

Download
memory/2968-4679-0x00007FF691010000-0x00007FF691402000-memory.dmp

Filesize
3.9MB

Download
memory/3356-440-0x00007FF6BC570000-0x00007FF6BC962000-memory.dmp

Filesize
3.9MB

Download
memory/3356-4657-0x00007FF6BC570000-0x00007FF6BC962000-memory.dmp

Filesize
3.9MB

Download
memory/3428-432-0x00007FF7DA6F0000-0x00007FF7DAAE2000-memory.dmp

Filesize
3.9MB

Download
memory/3428-4639-0x00007FF7DA6F0000-0x00007FF7DAAE2000-memory.dmp

Filesize
3.9MB

Download
memory/3448-4665-0x00007FF6C8680000-0x00007FF6C8A72000-memory.dmp

Filesize
3.9MB

Download
memory/3448-429-0x00007FF6C8680000-0x00007FF6C8A72000-memory.dmp

Filesize
3.9MB

Download
memory/3948-4664-0x00007FF6708F0000-0x00007FF670CE2000-memory.dmp

Filesize
3.9MB

Download
memory/3948-435-0x00007FF6708F0000-0x00007FF670CE2000-memory.dmp

Filesize
3.9MB

Download
memory/4420-109-0x00007FF784C90000-0x00007FF785082000-memory.dmp

Filesize
3.9MB

Download
memory/4420-4633-0x00007FF784C90000-0x00007FF785082000-memory.dmp

Filesize
3.9MB

Download
memory/4616-4660-0x00007FF7C0990000-0x00007FF7C0D82000-memory.dmp

Filesize
3.9MB

Download
memory/4616-433-0x00007FF7C0990000-0x00007FF7C0D82000-memory.dmp

Filesize
3.9MB

Download
memory/4940-4648-0x00007FF7EB7E0000-0x00007FF7EBBD2000-memory.dmp

Filesize
3.9MB

Download
memory/4940-597-0x00007FF7EB7E0000-0x00007FF7EBBD2000-memory.dmp

Filesize
3.9MB

Download
memory/4956-346-0x0000022D73CA0000-0x0000022D73CC2000-memory.dmp

Filesize
136KB

Download
memory/4956-111-0x0000022D73D30000-0x0000022D73D40000-memory.dmp

Filesize
64KB

Download
memory/4956-69-0x00007FFA085D0000-0x00007FFA09091000-memory.dmp

Filesize
10.8MB

Download
memory/4956-110-0x0000022D73D30000-0x0000022D73D40000-memory.dmp

Filesize
64KB

Download
memory/5060-4667-0x00007FF66A600000-0x00007FF66A9F2000-memory.dmp

Filesize
3.9MB

Download
memory/5060-314-0x00007FF66A600000-0x00007FF66A9F2000-memory.dmp

Filesize
3.9MB

Download