xmrig | a5aeb62dd2b93d44649c3ad327ad9adb418f9a44980bc84d766898c606f9db9d

Analysis

max time kernel
49s
max time network
50s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 09:54

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

04ed85966c54220644921589ddba4156_JaffaCakes118.exe
Size

1.9MB
MD5

04ed85966c54220644921589ddba4156
SHA1

d41c830cc068cc668c19e546e0052cd9ecc5a980
SHA256

a5aeb62dd2b93d44649c3ad327ad9adb418f9a44980bc84d766898c606f9db9d
SHA512

56240728e219933abe949fc9af06a74432f54df8b22960306623189bab60d948fc1e091c4fe95ca2be159fba1a2f12371aaaea7ed15878dd785ad2c86a89da1e
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1FUQ:NABa

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 42 IoCs

miner

resource	yara_rule
behavioral2/memory/1464-242-0x00007FF74E690000-0x00007FF74EA82000-memory.dmp	xmrig
behavioral2/memory/4248-296-0x00007FF79B830000-0x00007FF79BC22000-memory.dmp	xmrig
behavioral2/memory/2104-340-0x00007FF6209F0000-0x00007FF620DE2000-memory.dmp	xmrig
behavioral2/memory/3224-362-0x00007FF6D09D0000-0x00007FF6D0DC2000-memory.dmp	xmrig
behavioral2/memory/3944-366-0x00007FF7F5A10000-0x00007FF7F5E02000-memory.dmp	xmrig
behavioral2/memory/4812-365-0x00007FF7C2C20000-0x00007FF7C3012000-memory.dmp	xmrig
behavioral2/memory/5072-364-0x00007FF699320000-0x00007FF699712000-memory.dmp	xmrig
behavioral2/memory/4636-363-0x00007FF60FF70000-0x00007FF610362000-memory.dmp	xmrig
behavioral2/memory/4984-361-0x00007FF676AD0000-0x00007FF676EC2000-memory.dmp	xmrig
behavioral2/memory/3016-358-0x00007FF6174B0000-0x00007FF6178A2000-memory.dmp	xmrig
behavioral2/memory/408-286-0x00007FF7929D0000-0x00007FF792DC2000-memory.dmp	xmrig
behavioral2/memory/3152-285-0x00007FF6F78B0000-0x00007FF6F7CA2000-memory.dmp	xmrig
behavioral2/memory/1980-263-0x00007FF7ADE80000-0x00007FF7AE272000-memory.dmp	xmrig
behavioral2/memory/980-221-0x00007FF6630B0000-0x00007FF6634A2000-memory.dmp	xmrig
behavioral2/memory/2156-220-0x00007FF737570000-0x00007FF737962000-memory.dmp	xmrig
behavioral2/memory/3912-201-0x00007FF637410000-0x00007FF637802000-memory.dmp	xmrig
behavioral2/memory/4612-180-0x00007FF75D2B0000-0x00007FF75D6A2000-memory.dmp	xmrig
behavioral2/memory/4836-139-0x00007FF7E63A0000-0x00007FF7E6792000-memory.dmp	xmrig
behavioral2/memory/4988-110-0x00007FF645350000-0x00007FF645742000-memory.dmp	xmrig
behavioral2/memory/4856-108-0x00007FF71B4F0000-0x00007FF71B8E2000-memory.dmp	xmrig
behavioral2/memory/2464-18-0x00007FF67BFC0000-0x00007FF67C3B2000-memory.dmp	xmrig
behavioral2/memory/1328-4674-0x00007FF612F50000-0x00007FF613342000-memory.dmp	xmrig
behavioral2/memory/1516-4680-0x00007FF756B30000-0x00007FF756F22000-memory.dmp	xmrig
behavioral2/memory/4636-4705-0x00007FF60FF70000-0x00007FF610362000-memory.dmp	xmrig
behavioral2/memory/4836-4725-0x00007FF7E63A0000-0x00007FF7E6792000-memory.dmp	xmrig
behavioral2/memory/5072-4729-0x00007FF699320000-0x00007FF699712000-memory.dmp	xmrig
behavioral2/memory/1328-4739-0x00007FF612F50000-0x00007FF613342000-memory.dmp	xmrig
behavioral2/memory/1516-4752-0x00007FF756B30000-0x00007FF756F22000-memory.dmp	xmrig
behavioral2/memory/408-4844-0x00007FF7929D0000-0x00007FF792DC2000-memory.dmp	xmrig
behavioral2/memory/4248-4831-0x00007FF79B830000-0x00007FF79BC22000-memory.dmp	xmrig
behavioral2/memory/3016-4817-0x00007FF6174B0000-0x00007FF6178A2000-memory.dmp	xmrig
behavioral2/memory/4984-4828-0x00007FF676AD0000-0x00007FF676EC2000-memory.dmp	xmrig
behavioral2/memory/2104-4813-0x00007FF6209F0000-0x00007FF620DE2000-memory.dmp	xmrig
behavioral2/memory/1464-4807-0x00007FF74E690000-0x00007FF74EA82000-memory.dmp	xmrig
behavioral2/memory/3944-4819-0x00007FF7F5A10000-0x00007FF7F5E02000-memory.dmp	xmrig
behavioral2/memory/3912-4805-0x00007FF637410000-0x00007FF637802000-memory.dmp	xmrig
behavioral2/memory/1980-4794-0x00007FF7ADE80000-0x00007FF7AE272000-memory.dmp	xmrig
behavioral2/memory/3152-4791-0x00007FF6F78B0000-0x00007FF6F7CA2000-memory.dmp	xmrig
behavioral2/memory/980-4786-0x00007FF6630B0000-0x00007FF6634A2000-memory.dmp	xmrig
behavioral2/memory/4812-4778-0x00007FF7C2C20000-0x00007FF7C3012000-memory.dmp	xmrig
behavioral2/memory/4612-4779-0x00007FF75D2B0000-0x00007FF75D6A2000-memory.dmp	xmrig
behavioral2/memory/2156-4766-0x00007FF737570000-0x00007FF737962000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2464	WvmNiyO.exe
1952	HlUPmEY.exe
3224	iIgWCXe.exe
1328	KQvDeTa.exe
4636	BHeEUVK.exe
1516	XxPwRFI.exe
4856	iBXFSIO.exe
5072	QlXvdqH.exe
4988	HnkydMk.exe
4836	YZoNlYX.exe
4812	aVyDufh.exe
4612	VSQKKqv.exe
3912	PrqNcVK.exe
2156	COBCETt.exe
980	qFACTCS.exe
1464	QuKWCYZ.exe
1980	KLBbNho.exe
3152	gusQYVC.exe
3944	ntbXIjx.exe
408	cffQYph.exe
4248	tSvDVgW.exe
2104	aClltrX.exe
3016	WRuVpVK.exe
4984	msIOgcd.exe
1248	bAencSX.exe
1336	CnaeJGP.exe
4796	XBnjbsZ.exe
1628	xlkNpRn.exe
4620	uwnnBoH.exe
4056	zaknwXx.exe
768	PJyJNOm.exe
4288	xJFARli.exe
1624	OnokzHq.exe
3168	nSRthey.exe
3148	sYzAdqu.exe
4596	brhZkHH.exe
2956	hpBGNpf.exe
4840	suUqOyN.exe
1924	oIqWnUV.exe
3628	ChGBkfj.exe
3828	yzyIDbP.exe
2992	AnAcwAj.exe
2220	xOSmkRi.exe
4016	lhIjZlg.exe
4168	RDpkcXh.exe
1900	ZMXCKAf.exe
3316	XXYkesG.exe
2508	BCvWTGc.exe
2844	vhBHCRR.exe
1864	ieeMITf.exe
4000	XxzQHNV.exe
4332	zdGtCZz.exe
536	xDMWVLt.exe
2444	nsmQhjI.exe
4552	jSzckcL.exe
4360	XePNIdR.exe
2728	IIwRODW.exe
888	ZmmExYL.exe
4408	FkbcWNm.exe
4772	mFxLINc.exe
4660	AKtvaWa.exe
1632	atrbxmS.exe
1816	xuMDTQN.exe
2784	gEPLeHB.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/632-0-0x00007FF7A9E80000-0x00007FF7AA272000-memory.dmp	upx
behavioral2/files/0x000b000000023b78-11.dat	upx
behavioral2/files/0x000a000000023b7c-8.dat	upx
behavioral2/files/0x000a000000023b7d-7.dat	upx
behavioral2/files/0x000a000000023b7f-23.dat	upx
behavioral2/files/0x000a000000023b84-49.dat	upx
behavioral2/files/0x000a000000023b81-69.dat	upx
behavioral2/files/0x000a000000023b8a-82.dat	upx
behavioral2/files/0x000a000000023b8f-103.dat	upx
behavioral2/files/0x000a000000023b9c-159.dat	upx
behavioral2/memory/1464-242-0x00007FF74E690000-0x00007FF74EA82000-memory.dmp	upx
behavioral2/memory/4248-296-0x00007FF79B830000-0x00007FF79BC22000-memory.dmp	upx
behavioral2/memory/2104-340-0x00007FF6209F0000-0x00007FF620DE2000-memory.dmp	upx
behavioral2/memory/3224-362-0x00007FF6D09D0000-0x00007FF6D0DC2000-memory.dmp	upx
behavioral2/memory/3944-366-0x00007FF7F5A10000-0x00007FF7F5E02000-memory.dmp	upx
behavioral2/memory/4812-365-0x00007FF7C2C20000-0x00007FF7C3012000-memory.dmp	upx
behavioral2/memory/5072-364-0x00007FF699320000-0x00007FF699712000-memory.dmp	upx
behavioral2/memory/4636-363-0x00007FF60FF70000-0x00007FF610362000-memory.dmp	upx
behavioral2/memory/4984-361-0x00007FF676AD0000-0x00007FF676EC2000-memory.dmp	upx
behavioral2/memory/3016-358-0x00007FF6174B0000-0x00007FF6178A2000-memory.dmp	upx
behavioral2/memory/408-286-0x00007FF7929D0000-0x00007FF792DC2000-memory.dmp	upx
behavioral2/memory/3152-285-0x00007FF6F78B0000-0x00007FF6F7CA2000-memory.dmp	upx
behavioral2/memory/1980-263-0x00007FF7ADE80000-0x00007FF7AE272000-memory.dmp	upx
behavioral2/memory/980-221-0x00007FF6630B0000-0x00007FF6634A2000-memory.dmp	upx
behavioral2/memory/2156-220-0x00007FF737570000-0x00007FF737962000-memory.dmp	upx
behavioral2/memory/3912-201-0x00007FF637410000-0x00007FF637802000-memory.dmp	upx
behavioral2/files/0x000a000000023b94-191.dat	upx
behavioral2/files/0x000a000000023ba0-189.dat	upx
behavioral2/files/0x000a000000023b8e-182.dat	upx
behavioral2/memory/4612-180-0x00007FF75D2B0000-0x00007FF75D6A2000-memory.dmp	upx
behavioral2/files/0x000a000000023b93-175.dat	upx
behavioral2/files/0x000a000000023b9f-174.dat	upx
behavioral2/files/0x000a000000023b9e-173.dat	upx
behavioral2/files/0x000a000000023b98-172.dat	upx
behavioral2/files/0x000a000000023b9d-169.dat	upx
behavioral2/files/0x000a000000023b92-164.dat	upx
behavioral2/files/0x000a000000023b91-162.dat	upx
behavioral2/files/0x000a000000023b90-160.dat	upx
behavioral2/files/0x000a000000023b9b-158.dat	upx
behavioral2/files/0x000a000000023b9a-153.dat	upx
behavioral2/files/0x000a000000023b99-149.dat	upx
behavioral2/files/0x000a000000023b8b-144.dat	upx
behavioral2/memory/4836-139-0x00007FF7E63A0000-0x00007FF7E6792000-memory.dmp	upx
behavioral2/files/0x000a000000023b96-136.dat	upx
behavioral2/files/0x000a000000023b8d-127.dat	upx
behavioral2/files/0x000a000000023b8c-121.dat	upx
behavioral2/files/0x000a000000023b87-117.dat	upx
behavioral2/files/0x000a000000023b97-140.dat	upx
behavioral2/files/0x000a000000023b86-112.dat	upx
behavioral2/memory/4988-110-0x00007FF645350000-0x00007FF645742000-memory.dmp	upx
behavioral2/memory/4856-108-0x00007FF71B4F0000-0x00007FF71B8E2000-memory.dmp	upx
behavioral2/files/0x000a000000023b95-131.dat	upx
behavioral2/files/0x000a000000023b89-99.dat	upx
behavioral2/files/0x000a000000023b88-97.dat	upx
behavioral2/files/0x000a000000023b85-92.dat	upx
behavioral2/memory/1516-90-0x00007FF756B30000-0x00007FF756F22000-memory.dmp	upx
behavioral2/files/0x000a000000023b80-77.dat	upx
behavioral2/files/0x000a000000023b7e-64.dat	upx
behavioral2/memory/1328-55-0x00007FF612F50000-0x00007FF613342000-memory.dmp	upx
behavioral2/files/0x000a000000023b83-51.dat	upx
behavioral2/files/0x000a000000023b82-44.dat	upx
behavioral2/memory/1952-36-0x00007FF7174B0000-0x00007FF7178A2000-memory.dmp	upx
behavioral2/memory/2464-18-0x00007FF67BFC0000-0x00007FF67C3B2000-memory.dmp	upx
behavioral2/memory/1328-4674-0x00007FF612F50000-0x00007FF613342000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\dpUkfdp.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\KjmOQuk.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\TsJCsbL.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\jKuKgzR.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\bktMPJv.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\HocAELc.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\TklMRkP.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\oGZUsZx.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\psoqWKh.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\HlqnObS.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\WCVwGAK.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\ebqknYl.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\tMjhcQf.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\FEtvdJP.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\XGSpKMM.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\mtwPXwv.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\IAPuywx.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\msxsrxA.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\vDafyVz.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\lifrgjx.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\BmakmZf.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\wfTTUEq.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\HTdsNGI.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\YvYJOCd.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\DnJraUs.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\orLAmBa.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\nLtSHEQ.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\UFHXUZZ.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\yMCMhbD.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\DQHwXHK.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\AAgbiwV.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\nVZFyPU.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\UjWQBzn.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\RkEKYtU.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\DUXTsAM.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\TjgUwLu.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\kQcNwHf.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\VpRmjxy.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\MuhbsPV.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\NQGipfP.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\fqMyJrE.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\tBPTzyY.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\QRURoVV.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\HOMySar.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\jzJTiav.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\gAtxCUT.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\yBhbckl.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\JoMAQKm.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\ktSyqWQ.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\tMaOfKa.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\XtnuCRq.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\TEzUmUL.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\BHeEUVK.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\moLbfpH.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\EujzIzF.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\ASTdjwF.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\SqFdUIQ.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\iujOgMt.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\BlZueGK.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\zLtsHug.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\kkHKtgB.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\brgzyjn.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\erFbnGB.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\sacuHOq.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5088	powershell.exe
5088	powershell.exe
5088	powershell.exe
5088	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
Token: SeDebugPrivilege	5088	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 5088	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	85
PID 632 wrote to memory of 5088	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	85
PID 632 wrote to memory of 2464	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	86
PID 632 wrote to memory of 2464	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	86
PID 632 wrote to memory of 1952	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	87
PID 632 wrote to memory of 1952	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	87
PID 632 wrote to memory of 3224	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	88
PID 632 wrote to memory of 3224	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	88
PID 632 wrote to memory of 1328	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	89
PID 632 wrote to memory of 1328	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	89
PID 632 wrote to memory of 4636	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	90
PID 632 wrote to memory of 4636	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	90
PID 632 wrote to memory of 1516	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	91
PID 632 wrote to memory of 1516	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	91
PID 632 wrote to memory of 4856	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	92
PID 632 wrote to memory of 4856	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	92
PID 632 wrote to memory of 5072	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	93
PID 632 wrote to memory of 5072	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	93
PID 632 wrote to memory of 4988	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	94
PID 632 wrote to memory of 4988	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	94
PID 632 wrote to memory of 4836	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	95
PID 632 wrote to memory of 4836	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	95
PID 632 wrote to memory of 4812	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	96
PID 632 wrote to memory of 4812	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	96
PID 632 wrote to memory of 4612	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	97
PID 632 wrote to memory of 4612	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	97
PID 632 wrote to memory of 3912	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	98
PID 632 wrote to memory of 3912	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	98
PID 632 wrote to memory of 2156	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	99
PID 632 wrote to memory of 2156	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	99
PID 632 wrote to memory of 980	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	100
PID 632 wrote to memory of 980	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	100
PID 632 wrote to memory of 3152	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	101
PID 632 wrote to memory of 3152	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	101
PID 632 wrote to memory of 3944	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	102
PID 632 wrote to memory of 3944	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	102
PID 632 wrote to memory of 1464	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	103
PID 632 wrote to memory of 1464	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	103
PID 632 wrote to memory of 1980	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	104
PID 632 wrote to memory of 1980	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	104
PID 632 wrote to memory of 408	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	105
PID 632 wrote to memory of 408	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	105
PID 632 wrote to memory of 4248	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	106
PID 632 wrote to memory of 4248	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	106
PID 632 wrote to memory of 2104	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	107
PID 632 wrote to memory of 2104	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	107
PID 632 wrote to memory of 3016	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	108
PID 632 wrote to memory of 3016	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	108
PID 632 wrote to memory of 4984	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	109
PID 632 wrote to memory of 4984	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	109
PID 632 wrote to memory of 1248	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	110
PID 632 wrote to memory of 1248	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	110
PID 632 wrote to memory of 1336	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	111
PID 632 wrote to memory of 1336	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	111
PID 632 wrote to memory of 4796	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	112
PID 632 wrote to memory of 4796	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	112
PID 632 wrote to memory of 1628	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	113
PID 632 wrote to memory of 1628	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	113
PID 632 wrote to memory of 4620	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	114
PID 632 wrote to memory of 4620	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	114
PID 632 wrote to memory of 3148	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	115
PID 632 wrote to memory of 3148	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	115
PID 632 wrote to memory of 4056	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	116
PID 632 wrote to memory of 4056	632	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\04ed85966c54220644921589ddba4156_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\04ed85966c54220644921589ddba4156_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5088
- C:\Windows\System\WvmNiyO.exe
  C:\Windows\System\WvmNiyO.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\HlUPmEY.exe
  C:\Windows\System\HlUPmEY.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\iIgWCXe.exe
  C:\Windows\System\iIgWCXe.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\KQvDeTa.exe
  C:\Windows\System\KQvDeTa.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\BHeEUVK.exe
  C:\Windows\System\BHeEUVK.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\XxPwRFI.exe
  C:\Windows\System\XxPwRFI.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\iBXFSIO.exe
  C:\Windows\System\iBXFSIO.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\QlXvdqH.exe
  C:\Windows\System\QlXvdqH.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\HnkydMk.exe
  C:\Windows\System\HnkydMk.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\YZoNlYX.exe
  C:\Windows\System\YZoNlYX.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\aVyDufh.exe
  C:\Windows\System\aVyDufh.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\VSQKKqv.exe
  C:\Windows\System\VSQKKqv.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\PrqNcVK.exe
  C:\Windows\System\PrqNcVK.exe
  2⤵
  - Executes dropped EXE
  PID:3912
- C:\Windows\System\COBCETt.exe
  C:\Windows\System\COBCETt.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\qFACTCS.exe
  C:\Windows\System\qFACTCS.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\gusQYVC.exe
  C:\Windows\System\gusQYVC.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\ntbXIjx.exe
  C:\Windows\System\ntbXIjx.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\QuKWCYZ.exe
  C:\Windows\System\QuKWCYZ.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\KLBbNho.exe
  C:\Windows\System\KLBbNho.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\cffQYph.exe
  C:\Windows\System\cffQYph.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\tSvDVgW.exe
  C:\Windows\System\tSvDVgW.exe
  2⤵
  - Executes dropped EXE
  PID:4248
- C:\Windows\System\aClltrX.exe
  C:\Windows\System\aClltrX.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\WRuVpVK.exe
  C:\Windows\System\WRuVpVK.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\msIOgcd.exe
  C:\Windows\System\msIOgcd.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\bAencSX.exe
  C:\Windows\System\bAencSX.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\CnaeJGP.exe
  C:\Windows\System\CnaeJGP.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\XBnjbsZ.exe
  C:\Windows\System\XBnjbsZ.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\xlkNpRn.exe
  C:\Windows\System\xlkNpRn.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\uwnnBoH.exe
  C:\Windows\System\uwnnBoH.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\sYzAdqu.exe
  C:\Windows\System\sYzAdqu.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\zaknwXx.exe
  C:\Windows\System\zaknwXx.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\PJyJNOm.exe
  C:\Windows\System\PJyJNOm.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\xJFARli.exe
  C:\Windows\System\xJFARli.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\OnokzHq.exe
  C:\Windows\System\OnokzHq.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\nSRthey.exe
  C:\Windows\System\nSRthey.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\brhZkHH.exe
  C:\Windows\System\brhZkHH.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\hpBGNpf.exe
  C:\Windows\System\hpBGNpf.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\suUqOyN.exe
  C:\Windows\System\suUqOyN.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\oIqWnUV.exe
  C:\Windows\System\oIqWnUV.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\ChGBkfj.exe
  C:\Windows\System\ChGBkfj.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\yzyIDbP.exe
  C:\Windows\System\yzyIDbP.exe
  2⤵
  - Executes dropped EXE
  PID:3828
- C:\Windows\System\AnAcwAj.exe
  C:\Windows\System\AnAcwAj.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\xOSmkRi.exe
  C:\Windows\System\xOSmkRi.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\lhIjZlg.exe
  C:\Windows\System\lhIjZlg.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\RDpkcXh.exe
  C:\Windows\System\RDpkcXh.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\ZMXCKAf.exe
  C:\Windows\System\ZMXCKAf.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\XXYkesG.exe
  C:\Windows\System\XXYkesG.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System\BCvWTGc.exe
  C:\Windows\System\BCvWTGc.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\vhBHCRR.exe
  C:\Windows\System\vhBHCRR.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\ieeMITf.exe
  C:\Windows\System\ieeMITf.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\XxzQHNV.exe
  C:\Windows\System\XxzQHNV.exe
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Windows\System\zdGtCZz.exe
  C:\Windows\System\zdGtCZz.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\xDMWVLt.exe
  C:\Windows\System\xDMWVLt.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\nsmQhjI.exe
  C:\Windows\System\nsmQhjI.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\jSzckcL.exe
  C:\Windows\System\jSzckcL.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\XePNIdR.exe
  C:\Windows\System\XePNIdR.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\IIwRODW.exe
  C:\Windows\System\IIwRODW.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\ZmmExYL.exe
  C:\Windows\System\ZmmExYL.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\FkbcWNm.exe
  C:\Windows\System\FkbcWNm.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\mFxLINc.exe
  C:\Windows\System\mFxLINc.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\AKtvaWa.exe
  C:\Windows\System\AKtvaWa.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\atrbxmS.exe
  C:\Windows\System\atrbxmS.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\xuMDTQN.exe
  C:\Windows\System\xuMDTQN.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\gEPLeHB.exe
  C:\Windows\System\gEPLeHB.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\izwMWru.exe
  C:\Windows\System\izwMWru.exe
  2⤵
  PID:3992
- C:\Windows\System\RLNHcwR.exe
  C:\Windows\System\RLNHcwR.exe
  2⤵
  PID:3476
- C:\Windows\System\HvLfYlP.exe
  C:\Windows\System\HvLfYlP.exe
  2⤵
  PID:548
- C:\Windows\System\mGXkNei.exe
  C:\Windows\System\mGXkNei.exe
  2⤵
  PID:4816
- C:\Windows\System\XJoOZZV.exe
  C:\Windows\System\XJoOZZV.exe
  2⤵
  PID:616
- C:\Windows\System\AnOYCtb.exe
  C:\Windows\System\AnOYCtb.exe
  2⤵
  PID:712
- C:\Windows\System\UCcWzqM.exe
  C:\Windows\System\UCcWzqM.exe
  2⤵
  PID:1668
- C:\Windows\System\FJkEMHy.exe
  C:\Windows\System\FJkEMHy.exe
  2⤵
  PID:2440
- C:\Windows\System\pIRniiL.exe
  C:\Windows\System\pIRniiL.exe
  2⤵
  PID:1796
- C:\Windows\System\vIFjXLg.exe
  C:\Windows\System\vIFjXLg.exe
  2⤵
  PID:3032
- C:\Windows\System\FFpGgLj.exe
  C:\Windows\System\FFpGgLj.exe
  2⤵
  PID:5128
- C:\Windows\System\WkAwbmU.exe
  C:\Windows\System\WkAwbmU.exe
  2⤵
  PID:5200
- C:\Windows\System\ihIbAWJ.exe
  C:\Windows\System\ihIbAWJ.exe
  2⤵
  PID:5272
- C:\Windows\System\cQicZMz.exe
  C:\Windows\System\cQicZMz.exe
  2⤵
  PID:5288
- C:\Windows\System\UTSgGPx.exe
  C:\Windows\System\UTSgGPx.exe
  2⤵
  PID:5356
- C:\Windows\System\ehQIOes.exe
  C:\Windows\System\ehQIOes.exe
  2⤵
  PID:5376
- C:\Windows\System\TPOGIXu.exe
  C:\Windows\System\TPOGIXu.exe
  2⤵
  PID:5400
- C:\Windows\System\Gvoqtqk.exe
  C:\Windows\System\Gvoqtqk.exe
  2⤵
  PID:5420
- C:\Windows\System\VXLmCLJ.exe
  C:\Windows\System\VXLmCLJ.exe
  2⤵
  PID:5436
- C:\Windows\System\TgaAxKs.exe
  C:\Windows\System\TgaAxKs.exe
  2⤵
  PID:5468
- C:\Windows\System\ySSUdNe.exe
  C:\Windows\System\ySSUdNe.exe
  2⤵
  PID:5484
- C:\Windows\System\GxYGuHA.exe
  C:\Windows\System\GxYGuHA.exe
  2⤵
  PID:5500
- C:\Windows\System\gkFBHPa.exe
  C:\Windows\System\gkFBHPa.exe
  2⤵
  PID:5516
- C:\Windows\System\LHLHAzu.exe
  C:\Windows\System\LHLHAzu.exe
  2⤵
  PID:5540
- C:\Windows\System\KPJeixc.exe
  C:\Windows\System\KPJeixc.exe
  2⤵
  PID:5564
- C:\Windows\System\WGpMoTf.exe
  C:\Windows\System\WGpMoTf.exe
  2⤵
  PID:5584
- C:\Windows\System\fShaLAJ.exe
  C:\Windows\System\fShaLAJ.exe
  2⤵
  PID:5608
- C:\Windows\System\aRuubmm.exe
  C:\Windows\System\aRuubmm.exe
  2⤵
  PID:5624
- C:\Windows\System\mBKhxHj.exe
  C:\Windows\System\mBKhxHj.exe
  2⤵
  PID:5648
- C:\Windows\System\yUhgfMy.exe
  C:\Windows\System\yUhgfMy.exe
  2⤵
  PID:5672
- C:\Windows\System\hmDKEjF.exe
  C:\Windows\System\hmDKEjF.exe
  2⤵
  PID:5704
- C:\Windows\System\srbsqwA.exe
  C:\Windows\System\srbsqwA.exe
  2⤵
  PID:5720
- C:\Windows\System\KZLrDne.exe
  C:\Windows\System\KZLrDne.exe
  2⤵
  PID:5736
- C:\Windows\System\TBOphKN.exe
  C:\Windows\System\TBOphKN.exe
  2⤵
  PID:5756
- C:\Windows\System\auwILGA.exe
  C:\Windows\System\auwILGA.exe
  2⤵
  PID:5812
- C:\Windows\System\dBsbdEk.exe
  C:\Windows\System\dBsbdEk.exe
  2⤵
  PID:5828
- C:\Windows\System\DWSzbRW.exe
  C:\Windows\System\DWSzbRW.exe
  2⤵
  PID:6020
- C:\Windows\System\mpLCtfi.exe
  C:\Windows\System\mpLCtfi.exe
  2⤵
  PID:6040
- C:\Windows\System\RLVmcNu.exe
  C:\Windows\System\RLVmcNu.exe
  2⤵
  PID:6056
- C:\Windows\System\VWQPvaH.exe
  C:\Windows\System\VWQPvaH.exe
  2⤵
  PID:6076
- C:\Windows\System\ENpbEdp.exe
  C:\Windows\System\ENpbEdp.exe
  2⤵
  PID:6100
- C:\Windows\System\HxbRXzU.exe
  C:\Windows\System\HxbRXzU.exe
  2⤵
  PID:1748
- C:\Windows\System\QNMsoOn.exe
  C:\Windows\System\QNMsoOn.exe
  2⤵
  PID:376
- C:\Windows\System\lZKNbIE.exe
  C:\Windows\System\lZKNbIE.exe
  2⤵
  PID:4488
- C:\Windows\System\jFgMrDO.exe
  C:\Windows\System\jFgMrDO.exe
  2⤵
  PID:4736
- C:\Windows\System\eMVyIgk.exe
  C:\Windows\System\eMVyIgk.exe
  2⤵
  PID:4644
- C:\Windows\System\GqCfcye.exe
  C:\Windows\System\GqCfcye.exe
  2⤵
  PID:1576
- C:\Windows\System\jImtOnC.exe
  C:\Windows\System\jImtOnC.exe
  2⤵
  PID:1500
- C:\Windows\System\omMnkmH.exe
  C:\Windows\System\omMnkmH.exe
  2⤵
  PID:4040
- C:\Windows\System\XgtJrnY.exe
  C:\Windows\System\XgtJrnY.exe
  2⤵
  PID:4820
- C:\Windows\System\AeBlvVP.exe
  C:\Windows\System\AeBlvVP.exe
  2⤵
  PID:4512
- C:\Windows\System\vuoeFfr.exe
  C:\Windows\System\vuoeFfr.exe
  2⤵
  PID:512
- C:\Windows\System\XydCOQB.exe
  C:\Windows\System\XydCOQB.exe
  2⤵
  PID:1432
- C:\Windows\System\pUNGIgG.exe
  C:\Windows\System\pUNGIgG.exe
  2⤵
  PID:3212
- C:\Windows\System\FrcHyRX.exe
  C:\Windows\System\FrcHyRX.exe
  2⤵
  PID:5140
- C:\Windows\System\LbaPIef.exe
  C:\Windows\System\LbaPIef.exe
  2⤵
  PID:5664
- C:\Windows\System\ewRPgRC.exe
  C:\Windows\System\ewRPgRC.exe
  2⤵
  PID:5712
- C:\Windows\System\BFYeeWW.exe
  C:\Windows\System\BFYeeWW.exe
  2⤵
  PID:5748
- C:\Windows\System\VnwbYdK.exe
  C:\Windows\System\VnwbYdK.exe
  2⤵
  PID:5792
- C:\Windows\System\TflHThS.exe
  C:\Windows\System\TflHThS.exe
  2⤵
  PID:5872
- C:\Windows\System\SAOHqrg.exe
  C:\Windows\System\SAOHqrg.exe
  2⤵
  PID:6156
- C:\Windows\System\syjZPnW.exe
  C:\Windows\System\syjZPnW.exe
  2⤵
  PID:6172
- C:\Windows\System\IKyfBdi.exe
  C:\Windows\System\IKyfBdi.exe
  2⤵
  PID:6196
- C:\Windows\System\BACqZBI.exe
  C:\Windows\System\BACqZBI.exe
  2⤵
  PID:6236
- C:\Windows\System\ZnqffWb.exe
  C:\Windows\System\ZnqffWb.exe
  2⤵
  PID:6252
- C:\Windows\System\QGwulgq.exe
  C:\Windows\System\QGwulgq.exe
  2⤵
  PID:6268
- C:\Windows\System\kwLApju.exe
  C:\Windows\System\kwLApju.exe
  2⤵
  PID:6288
- C:\Windows\System\iYaqMnX.exe
  C:\Windows\System\iYaqMnX.exe
  2⤵
  PID:6468
- C:\Windows\System\moLbfpH.exe
  C:\Windows\System\moLbfpH.exe
  2⤵
  PID:6484
- C:\Windows\System\jegBUMp.exe
  C:\Windows\System\jegBUMp.exe
  2⤵
  PID:6500
- C:\Windows\System\EqZVgln.exe
  C:\Windows\System\EqZVgln.exe
  2⤵
  PID:6524
- C:\Windows\System\vnKEbEQ.exe
  C:\Windows\System\vnKEbEQ.exe
  2⤵
  PID:6548
- C:\Windows\System\jYahbfQ.exe
  C:\Windows\System\jYahbfQ.exe
  2⤵
  PID:6568
- C:\Windows\System\DVXvnid.exe
  C:\Windows\System\DVXvnid.exe
  2⤵
  PID:6760
- C:\Windows\System\tzGgyss.exe
  C:\Windows\System\tzGgyss.exe
  2⤵
  PID:6780
- C:\Windows\System\FVsMFgj.exe
  C:\Windows\System\FVsMFgj.exe
  2⤵
  PID:6796
- C:\Windows\System\jIwoGIk.exe
  C:\Windows\System\jIwoGIk.exe
  2⤵
  PID:6812
- C:\Windows\System\pRqOaTj.exe
  C:\Windows\System\pRqOaTj.exe
  2⤵
  PID:6832
- C:\Windows\System\RGIoHOG.exe
  C:\Windows\System\RGIoHOG.exe
  2⤵
  PID:6864
- C:\Windows\System\oydernF.exe
  C:\Windows\System\oydernF.exe
  2⤵
  PID:6880
- C:\Windows\System\NIQvRSN.exe
  C:\Windows\System\NIQvRSN.exe
  2⤵
  PID:6908
- C:\Windows\System\BelcnQT.exe
  C:\Windows\System\BelcnQT.exe
  2⤵
  PID:6924
- C:\Windows\System\ImWwypI.exe
  C:\Windows\System\ImWwypI.exe
  2⤵
  PID:6952
- C:\Windows\System\HOEKuNh.exe
  C:\Windows\System\HOEKuNh.exe
  2⤵
  PID:6972
- C:\Windows\System\EtScsqx.exe
  C:\Windows\System\EtScsqx.exe
  2⤵
  PID:7000
- C:\Windows\System\wRnBAdu.exe
  C:\Windows\System\wRnBAdu.exe
  2⤵
  PID:7020
- C:\Windows\System\JzfSivY.exe
  C:\Windows\System\JzfSivY.exe
  2⤵
  PID:7044
- C:\Windows\System\lZTqTee.exe
  C:\Windows\System\lZTqTee.exe
  2⤵
  PID:7064
- C:\Windows\System\sVEWIuo.exe
  C:\Windows\System\sVEWIuo.exe
  2⤵
  PID:7080
- C:\Windows\System\moudGdK.exe
  C:\Windows\System\moudGdK.exe
  2⤵
  PID:7104
- C:\Windows\System\kYoMurV.exe
  C:\Windows\System\kYoMurV.exe
  2⤵
  PID:7124
- C:\Windows\System\axkRaYr.exe
  C:\Windows\System\axkRaYr.exe
  2⤵
  PID:7148
- C:\Windows\System\zQvicCU.exe
  C:\Windows\System\zQvicCU.exe
  2⤵
  PID:5836
- C:\Windows\System\ssLlSXM.exe
  C:\Windows\System\ssLlSXM.exe
  2⤵
  PID:5972
- C:\Windows\System\BSCnByk.exe
  C:\Windows\System\BSCnByk.exe
  2⤵
  PID:6012
- C:\Windows\System\ZjpVjPf.exe
  C:\Windows\System\ZjpVjPf.exe
  2⤵
  PID:6052
- C:\Windows\System\PthXezo.exe
  C:\Windows\System\PthXezo.exe
  2⤵
  PID:6096
- C:\Windows\System\AqWptgo.exe
  C:\Windows\System\AqWptgo.exe
  2⤵
  PID:6136
- C:\Windows\System\NEtirqS.exe
  C:\Windows\System\NEtirqS.exe
  2⤵
  PID:2276
- C:\Windows\System\pXfhiyr.exe
  C:\Windows\System\pXfhiyr.exe
  2⤵
  PID:3776
- C:\Windows\System\jZIAvtg.exe
  C:\Windows\System\jZIAvtg.exe
  2⤵
  PID:4024
- C:\Windows\System\qLlgdnY.exe
  C:\Windows\System\qLlgdnY.exe
  2⤵
  PID:3552
- C:\Windows\System\UxDsGAY.exe
  C:\Windows\System\UxDsGAY.exe
  2⤵
  PID:2836
- C:\Windows\System\JxPlcVL.exe
  C:\Windows\System\JxPlcVL.exe
  2⤵
  PID:4504
- C:\Windows\System\JwEQmIM.exe
  C:\Windows\System\JwEQmIM.exe
  2⤵
  PID:5444
- C:\Windows\System\TNllcOw.exe
  C:\Windows\System\TNllcOw.exe
  2⤵
  PID:6300
- C:\Windows\System\EOElmmQ.exe
  C:\Windows\System\EOElmmQ.exe
  2⤵
  PID:6168
- C:\Windows\System\XtQTBWl.exe
  C:\Windows\System\XtQTBWl.exe
  2⤵
  PID:5496
- C:\Windows\System\WKAbhSy.exe
  C:\Windows\System\WKAbhSy.exe
  2⤵
  PID:5580
- C:\Windows\System\igIEtyX.exe
  C:\Windows\System\igIEtyX.exe
  2⤵
  PID:5688
- C:\Windows\System\MVQHHyo.exe
  C:\Windows\System\MVQHHyo.exe
  2⤵
  PID:5744
- C:\Windows\System\hoWwsVL.exe
  C:\Windows\System\hoWwsVL.exe
  2⤵
  PID:5192
- C:\Windows\System\zcqYnSC.exe
  C:\Windows\System\zcqYnSC.exe
  2⤵
  PID:6244
- C:\Windows\System\IkeFoIN.exe
  C:\Windows\System\IkeFoIN.exe
  2⤵
  PID:6276
- C:\Windows\System\BOVhehQ.exe
  C:\Windows\System\BOVhehQ.exe
  2⤵
  PID:6396
- C:\Windows\System\BXOkxTB.exe
  C:\Windows\System\BXOkxTB.exe
  2⤵
  PID:6436
- C:\Windows\System\OjouKJY.exe
  C:\Windows\System\OjouKJY.exe
  2⤵
  PID:5092
- C:\Windows\System\drACgTx.exe
  C:\Windows\System\drACgTx.exe
  2⤵
  PID:6476
- C:\Windows\System\JsszNRH.exe
  C:\Windows\System\JsszNRH.exe
  2⤵
  PID:6520
- C:\Windows\System\DCXUSrF.exe
  C:\Windows\System\DCXUSrF.exe
  2⤵
  PID:6560
- C:\Windows\System\YhOFfVY.exe
  C:\Windows\System\YhOFfVY.exe
  2⤵
  PID:6656
- C:\Windows\System\OpjaxIK.exe
  C:\Windows\System\OpjaxIK.exe
  2⤵
  PID:2496
- C:\Windows\System\OlWVMYa.exe
  C:\Windows\System\OlWVMYa.exe
  2⤵
  PID:2548
- C:\Windows\System\KlQwOfi.exe
  C:\Windows\System\KlQwOfi.exe
  2⤵
  PID:2020
- C:\Windows\System\dMAiAJT.exe
  C:\Windows\System\dMAiAJT.exe
  2⤵
  PID:3272
- C:\Windows\System\hALVuCv.exe
  C:\Windows\System\hALVuCv.exe
  2⤵
  PID:3760
- C:\Windows\System\RWxYwpi.exe
  C:\Windows\System\RWxYwpi.exe
  2⤵
  PID:2024
- C:\Windows\System\fDjPXUK.exe
  C:\Windows\System\fDjPXUK.exe
  2⤵
  PID:4728
- C:\Windows\System\vDDvQfi.exe
  C:\Windows\System\vDDvQfi.exe
  2⤵
  PID:2376
- C:\Windows\System\TklMRkP.exe
  C:\Windows\System\TklMRkP.exe
  2⤵
  PID:624
- C:\Windows\System\WvUgoui.exe
  C:\Windows\System\WvUgoui.exe
  2⤵
  PID:3436
- C:\Windows\System\zqdtgjO.exe
  C:\Windows\System\zqdtgjO.exe
  2⤵
  PID:2516
- C:\Windows\System\CaVHBNx.exe
  C:\Windows\System\CaVHBNx.exe
  2⤵
  PID:4428
- C:\Windows\System\AwlICto.exe
  C:\Windows\System\AwlICto.exe
  2⤵
  PID:760
- C:\Windows\System\WnlpHTx.exe
  C:\Windows\System\WnlpHTx.exe
  2⤵
  PID:5904
- C:\Windows\System\hAaaHVS.exe
  C:\Windows\System\hAaaHVS.exe
  2⤵
  PID:5916
- C:\Windows\System\TlvkZRO.exe
  C:\Windows\System\TlvkZRO.exe
  2⤵
  PID:6744
- C:\Windows\System\ftfHeFB.exe
  C:\Windows\System\ftfHeFB.exe
  2⤵
  PID:6788
- C:\Windows\System\tvBcqtI.exe
  C:\Windows\System\tvBcqtI.exe
  2⤵
  PID:6852
- C:\Windows\System\nTnhvNH.exe
  C:\Windows\System\nTnhvNH.exe
  2⤵
  PID:6916
- C:\Windows\System\gOxxDRK.exe
  C:\Windows\System\gOxxDRK.exe
  2⤵
  PID:6892
- C:\Windows\System\wvqicRA.exe
  C:\Windows\System\wvqicRA.exe
  2⤵
  PID:6920
- C:\Windows\System\oxlgQbk.exe
  C:\Windows\System\oxlgQbk.exe
  2⤵
  PID:6964
- C:\Windows\System\CalVyVK.exe
  C:\Windows\System\CalVyVK.exe
  2⤵
  PID:7112
- C:\Windows\System\SVKgWSB.exe
  C:\Windows\System\SVKgWSB.exe
  2⤵
  PID:7120
- C:\Windows\System\czbijCh.exe
  C:\Windows\System\czbijCh.exe
  2⤵
  PID:2888
- C:\Windows\System\ISPGwEU.exe
  C:\Windows\System\ISPGwEU.exe
  2⤵
  PID:4480
- C:\Windows\System\HTdsNGI.exe
  C:\Windows\System\HTdsNGI.exe
  2⤵
  PID:5996
- C:\Windows\System\PFoDFnQ.exe
  C:\Windows\System\PFoDFnQ.exe
  2⤵
  PID:7132
- C:\Windows\System\KQyRWev.exe
  C:\Windows\System\KQyRWev.exe
  2⤵
  PID:6208
- C:\Windows\System\EhuBdZk.exe
  C:\Windows\System\EhuBdZk.exe
  2⤵
  PID:5632
- C:\Windows\System\QRURoVV.exe
  C:\Windows\System\QRURoVV.exe
  2⤵
  PID:5764
- C:\Windows\System\lUSTTiQ.exe
  C:\Windows\System\lUSTTiQ.exe
  2⤵
  PID:6260
- C:\Windows\System\AQwaajy.exe
  C:\Windows\System\AQwaajy.exe
  2⤵
  PID:3292
- C:\Windows\System\ZNxaQPt.exe
  C:\Windows\System\ZNxaQPt.exe
  2⤵
  PID:2028
- C:\Windows\System\dlWgWBi.exe
  C:\Windows\System\dlWgWBi.exe
  2⤵
  PID:1000
- C:\Windows\System\ktSyqWQ.exe
  C:\Windows\System\ktSyqWQ.exe
  2⤵
  PID:3932
- C:\Windows\System\wQlrBpQ.exe
  C:\Windows\System\wQlrBpQ.exe
  2⤵
  PID:3756
- C:\Windows\System\kOgVejo.exe
  C:\Windows\System\kOgVejo.exe
  2⤵
  PID:2112
- C:\Windows\System\PdMCGVN.exe
  C:\Windows\System\PdMCGVN.exe
  2⤵
  PID:6648
- C:\Windows\System\ViiwJxU.exe
  C:\Windows\System\ViiwJxU.exe
  2⤵
  PID:2036
- C:\Windows\System\JZnxcCT.exe
  C:\Windows\System\JZnxcCT.exe
  2⤵
  PID:932
- C:\Windows\System\doIkBXj.exe
  C:\Windows\System\doIkBXj.exe
  2⤵
  PID:1612
- C:\Windows\System\UtGRVqf.exe
  C:\Windows\System\UtGRVqf.exe
  2⤵
  PID:7060
- C:\Windows\System\ThNAqdW.exe
  C:\Windows\System\ThNAqdW.exe
  2⤵
  PID:1856
- C:\Windows\System\NSGvuNo.exe
  C:\Windows\System\NSGvuNo.exe
  2⤵
  PID:6640
- C:\Windows\System\mAlmxcE.exe
  C:\Windows\System\mAlmxcE.exe
  2⤵
  PID:7188
- C:\Windows\System\ObcZIwL.exe
  C:\Windows\System\ObcZIwL.exe
  2⤵
  PID:7204
- C:\Windows\System\AjKhcWl.exe
  C:\Windows\System\AjKhcWl.exe
  2⤵
  PID:7228
- C:\Windows\System\HLvwIZZ.exe
  C:\Windows\System\HLvwIZZ.exe
  2⤵
  PID:7252
- C:\Windows\System\ExFakXl.exe
  C:\Windows\System\ExFakXl.exe
  2⤵
  PID:7272
- C:\Windows\System\MlNbwdI.exe
  C:\Windows\System\MlNbwdI.exe
  2⤵
  PID:7292
- C:\Windows\System\tNnVdpi.exe
  C:\Windows\System\tNnVdpi.exe
  2⤵
  PID:7312
- C:\Windows\System\VQtqwTn.exe
  C:\Windows\System\VQtqwTn.exe
  2⤵
  PID:7336
- C:\Windows\System\wIloyNH.exe
  C:\Windows\System\wIloyNH.exe
  2⤵
  PID:7356
- C:\Windows\System\EvMlhGs.exe
  C:\Windows\System\EvMlhGs.exe
  2⤵
  PID:7376
- C:\Windows\System\CVwzGkH.exe
  C:\Windows\System\CVwzGkH.exe
  2⤵
  PID:7400
- C:\Windows\System\BuRkoEV.exe
  C:\Windows\System\BuRkoEV.exe
  2⤵
  PID:7420
- C:\Windows\System\UfXYzuC.exe
  C:\Windows\System\UfXYzuC.exe
  2⤵
  PID:7444
- C:\Windows\System\xJPDhZx.exe
  C:\Windows\System\xJPDhZx.exe
  2⤵
  PID:7468
- C:\Windows\System\FGZkkKT.exe
  C:\Windows\System\FGZkkKT.exe
  2⤵
  PID:7492
- C:\Windows\System\fHuqRNb.exe
  C:\Windows\System\fHuqRNb.exe
  2⤵
  PID:7520
- C:\Windows\System\rsYEtSi.exe
  C:\Windows\System\rsYEtSi.exe
  2⤵
  PID:7540
- C:\Windows\System\wTOAmUu.exe
  C:\Windows\System\wTOAmUu.exe
  2⤵
  PID:7560
- C:\Windows\System\XGSpKMM.exe
  C:\Windows\System\XGSpKMM.exe
  2⤵
  PID:7580
- C:\Windows\System\AcgmjHd.exe
  C:\Windows\System\AcgmjHd.exe
  2⤵
  PID:7604
- C:\Windows\System\UgyXLEl.exe
  C:\Windows\System\UgyXLEl.exe
  2⤵
  PID:7620
- C:\Windows\System\IzoJGvz.exe
  C:\Windows\System\IzoJGvz.exe
  2⤵
  PID:7652
- C:\Windows\System\ULnodax.exe
  C:\Windows\System\ULnodax.exe
  2⤵
  PID:7668
- C:\Windows\System\AWiBWrN.exe
  C:\Windows\System\AWiBWrN.exe
  2⤵
  PID:7696
- C:\Windows\System\ZOrOnTC.exe
  C:\Windows\System\ZOrOnTC.exe
  2⤵
  PID:7716
- C:\Windows\System\VwFLXKr.exe
  C:\Windows\System\VwFLXKr.exe
  2⤵
  PID:7740
- C:\Windows\System\LAgNlGq.exe
  C:\Windows\System\LAgNlGq.exe
  2⤵
  PID:7756
- C:\Windows\System\jwLFrBn.exe
  C:\Windows\System\jwLFrBn.exe
  2⤵
  PID:7788
- C:\Windows\System\kQrWCgd.exe
  C:\Windows\System\kQrWCgd.exe
  2⤵
  PID:7808
- C:\Windows\System\Ykftpkb.exe
  C:\Windows\System\Ykftpkb.exe
  2⤵
  PID:7828
- C:\Windows\System\uCUvpdP.exe
  C:\Windows\System\uCUvpdP.exe
  2⤵
  PID:7844
- C:\Windows\System\ZfHbFgI.exe
  C:\Windows\System\ZfHbFgI.exe
  2⤵
  PID:7868
- C:\Windows\System\nQVrNPb.exe
  C:\Windows\System\nQVrNPb.exe
  2⤵
  PID:7896
- C:\Windows\System\gGYdvXr.exe
  C:\Windows\System\gGYdvXr.exe
  2⤵
  PID:7912
- C:\Windows\System\xyXAfmi.exe
  C:\Windows\System\xyXAfmi.exe
  2⤵
  PID:7944
- C:\Windows\System\bGxBHgd.exe
  C:\Windows\System\bGxBHgd.exe
  2⤵
  PID:7960
- C:\Windows\System\WBBkoxB.exe
  C:\Windows\System\WBBkoxB.exe
  2⤵
  PID:7984
- C:\Windows\System\kCCLyHR.exe
  C:\Windows\System\kCCLyHR.exe
  2⤵
  PID:8008
- C:\Windows\System\hOoYnPg.exe
  C:\Windows\System\hOoYnPg.exe
  2⤵
  PID:8028
- C:\Windows\System\ChRTnsD.exe
  C:\Windows\System\ChRTnsD.exe
  2⤵
  PID:8048
- C:\Windows\System\SciySjF.exe
  C:\Windows\System\SciySjF.exe
  2⤵
  PID:8068
- C:\Windows\System\yDNOESz.exe
  C:\Windows\System\yDNOESz.exe
  2⤵
  PID:8088
- C:\Windows\System\CnszEVP.exe
  C:\Windows\System\CnszEVP.exe
  2⤵
  PID:8124
- C:\Windows\System\EKSrChQ.exe
  C:\Windows\System\EKSrChQ.exe
  2⤵
  PID:8148
- C:\Windows\System\VxaDkKr.exe
  C:\Windows\System\VxaDkKr.exe
  2⤵
  PID:8164
- C:\Windows\System\tIvknVo.exe
  C:\Windows\System\tIvknVo.exe
  2⤵
  PID:8188
- C:\Windows\System\mPbxUED.exe
  C:\Windows\System\mPbxUED.exe
  2⤵
  PID:6624
- C:\Windows\System\CocNRAh.exe
  C:\Windows\System\CocNRAh.exe
  2⤵
  PID:4236
- C:\Windows\System\qkTMhiR.exe
  C:\Windows\System\qkTMhiR.exe
  2⤵
  PID:1936
- C:\Windows\System\njbrUdp.exe
  C:\Windows\System\njbrUdp.exe
  2⤵
  PID:6772
- C:\Windows\System\YvQabPj.exe
  C:\Windows\System\YvQabPj.exe
  2⤵
  PID:7012
- C:\Windows\System\eaIZdSw.exe
  C:\Windows\System\eaIZdSw.exe
  2⤵
  PID:4896
- C:\Windows\System\XzUrQfc.exe
  C:\Windows\System\XzUrQfc.exe
  2⤵
  PID:6116
- C:\Windows\System\uNfAehC.exe
  C:\Windows\System\uNfAehC.exe
  2⤵
  PID:7368
- C:\Windows\System\BhnaSCs.exe
  C:\Windows\System\BhnaSCs.exe
  2⤵
  PID:7032
- C:\Windows\System\WMPGpVa.exe
  C:\Windows\System\WMPGpVa.exe
  2⤵
  PID:6152
- C:\Windows\System\FmqYASh.exe
  C:\Windows\System\FmqYASh.exe
  2⤵
  PID:3260
- C:\Windows\System\NRFCjUe.exe
  C:\Windows\System\NRFCjUe.exe
  2⤵
  PID:5988
- C:\Windows\System\zaHiZip.exe
  C:\Windows\System\zaHiZip.exe
  2⤵
  PID:7552
- C:\Windows\System\MKWzSlZ.exe
  C:\Windows\System\MKWzSlZ.exe
  2⤵
  PID:7328
- C:\Windows\System\SecYjTY.exe
  C:\Windows\System\SecYjTY.exe
  2⤵
  PID:7924
- C:\Windows\System\OYImYBE.exe
  C:\Windows\System\OYImYBE.exe
  2⤵
  PID:7480
- C:\Windows\System\HYiXjlD.exe
  C:\Windows\System\HYiXjlD.exe
  2⤵
  PID:7504
- C:\Windows\System\rtHDrJt.exe
  C:\Windows\System\rtHDrJt.exe
  2⤵
  PID:2436
- C:\Windows\System\irneETa.exe
  C:\Windows\System\irneETa.exe
  2⤵
  PID:8204
- C:\Windows\System\LWfFHMC.exe
  C:\Windows\System\LWfFHMC.exe
  2⤵
  PID:8224
- C:\Windows\System\iGgTrSU.exe
  C:\Windows\System\iGgTrSU.exe
  2⤵
  PID:8244
- C:\Windows\System\Mskyjkw.exe
  C:\Windows\System\Mskyjkw.exe
  2⤵
  PID:8268
- C:\Windows\System\lqYREEd.exe
  C:\Windows\System\lqYREEd.exe
  2⤵
  PID:8292
- C:\Windows\System\kRujffN.exe
  C:\Windows\System\kRujffN.exe
  2⤵
  PID:8312
- C:\Windows\System\lKmiYdO.exe
  C:\Windows\System\lKmiYdO.exe
  2⤵
  PID:8336
- C:\Windows\System\OojWTZt.exe
  C:\Windows\System\OojWTZt.exe
  2⤵
  PID:8364
- C:\Windows\System\XjeeGxo.exe
  C:\Windows\System\XjeeGxo.exe
  2⤵
  PID:8380
- C:\Windows\System\PrkKkIs.exe
  C:\Windows\System\PrkKkIs.exe
  2⤵
  PID:8404
- C:\Windows\System\LbOqvMi.exe
  C:\Windows\System\LbOqvMi.exe
  2⤵
  PID:8432
- C:\Windows\System\wviSOBZ.exe
  C:\Windows\System\wviSOBZ.exe
  2⤵
  PID:8452
- C:\Windows\System\fjLyTKe.exe
  C:\Windows\System\fjLyTKe.exe
  2⤵
  PID:8476
- C:\Windows\System\RWkTPFG.exe
  C:\Windows\System\RWkTPFG.exe
  2⤵
  PID:8492
- C:\Windows\System\kkHKtgB.exe
  C:\Windows\System\kkHKtgB.exe
  2⤵
  PID:8516
- C:\Windows\System\dnkHGgR.exe
  C:\Windows\System\dnkHGgR.exe
  2⤵
  PID:8536
- C:\Windows\System\UVXmVpO.exe
  C:\Windows\System\UVXmVpO.exe
  2⤵
  PID:8560
- C:\Windows\System\xuyoGCU.exe
  C:\Windows\System\xuyoGCU.exe
  2⤵
  PID:8580
- C:\Windows\System\OHWaOYV.exe
  C:\Windows\System\OHWaOYV.exe
  2⤵
  PID:8600
- C:\Windows\System\iZTRTxI.exe
  C:\Windows\System\iZTRTxI.exe
  2⤵
  PID:8624
- C:\Windows\System\GCLTdgU.exe
  C:\Windows\System\GCLTdgU.exe
  2⤵
  PID:8644
- C:\Windows\System\QdOwyFy.exe
  C:\Windows\System\QdOwyFy.exe
  2⤵
  PID:8664
- C:\Windows\System\AXkBJYK.exe
  C:\Windows\System\AXkBJYK.exe
  2⤵
  PID:8688
- C:\Windows\System\eginSmx.exe
  C:\Windows\System\eginSmx.exe
  2⤵
  PID:8708
- C:\Windows\System\UWpKAvV.exe
  C:\Windows\System\UWpKAvV.exe
  2⤵
  PID:8728
- C:\Windows\System\kXVnmpx.exe
  C:\Windows\System\kXVnmpx.exe
  2⤵
  PID:8752
- C:\Windows\System\RdpkwcU.exe
  C:\Windows\System\RdpkwcU.exe
  2⤵
  PID:8776
- C:\Windows\System\vaeFABn.exe
  C:\Windows\System\vaeFABn.exe
  2⤵
  PID:8792
- C:\Windows\System\fXskTvU.exe
  C:\Windows\System\fXskTvU.exe
  2⤵
  PID:8812
- C:\Windows\System\nPtHuga.exe
  C:\Windows\System\nPtHuga.exe
  2⤵
  PID:8840
- C:\Windows\System\vEUxEaY.exe
  C:\Windows\System\vEUxEaY.exe
  2⤵
  PID:8860
- C:\Windows\System\QuMIMFa.exe
  C:\Windows\System\QuMIMFa.exe
  2⤵
  PID:8880
- C:\Windows\System\XZAtddI.exe
  C:\Windows\System\XZAtddI.exe
  2⤵
  PID:8904
- C:\Windows\System\MbkiZgc.exe
  C:\Windows\System\MbkiZgc.exe
  2⤵
  PID:8924
- C:\Windows\System\aCfRzFU.exe
  C:\Windows\System\aCfRzFU.exe
  2⤵
  PID:8944
- C:\Windows\System\NdgbTHZ.exe
  C:\Windows\System\NdgbTHZ.exe
  2⤵
  PID:8964
- C:\Windows\System\Phfkayx.exe
  C:\Windows\System\Phfkayx.exe
  2⤵
  PID:8988
- C:\Windows\System\rwFbuwU.exe
  C:\Windows\System\rwFbuwU.exe
  2⤵
  PID:9008
- C:\Windows\System\HkBXxIJ.exe
  C:\Windows\System\HkBXxIJ.exe
  2⤵
  PID:9024
- C:\Windows\System\Obltaeg.exe
  C:\Windows\System\Obltaeg.exe
  2⤵
  PID:9040
- C:\Windows\System\WQPAskG.exe
  C:\Windows\System\WQPAskG.exe
  2⤵
  PID:9056
- C:\Windows\System\GzEShoX.exe
  C:\Windows\System\GzEShoX.exe
  2⤵
  PID:9072
- C:\Windows\System\QpGTHaT.exe
  C:\Windows\System\QpGTHaT.exe
  2⤵
  PID:9096
- C:\Windows\System\REHrkfa.exe
  C:\Windows\System\REHrkfa.exe
  2⤵
  PID:9120
- C:\Windows\System\OBiaghN.exe
  C:\Windows\System\OBiaghN.exe
  2⤵
  PID:9144
- C:\Windows\System\RiMEzyO.exe
  C:\Windows\System\RiMEzyO.exe
  2⤵
  PID:9164
- C:\Windows\System\ycUXjyl.exe
  C:\Windows\System\ycUXjyl.exe
  2⤵
  PID:9184
- C:\Windows\System\UgejZpc.exe
  C:\Windows\System\UgejZpc.exe
  2⤵
  PID:9208
- C:\Windows\System\SUwlGEk.exe
  C:\Windows\System\SUwlGEk.exe
  2⤵
  PID:6824
- C:\Windows\System\nHQITow.exe
  C:\Windows\System\nHQITow.exe
  2⤵
  PID:6508
- C:\Windows\System\Giitjqj.exe
  C:\Windows\System\Giitjqj.exe
  2⤵
  PID:7676
- C:\Windows\System\IuecnIT.exe
  C:\Windows\System\IuecnIT.exe
  2⤵
  PID:8184
- C:\Windows\System\KIUvDPj.exe
  C:\Windows\System\KIUvDPj.exe
  2⤵
  PID:8180
- C:\Windows\System\mWPmfeU.exe
  C:\Windows\System\mWPmfeU.exe
  2⤵
  PID:7284
- C:\Windows\System\siJUxpr.exe
  C:\Windows\System\siJUxpr.exe
  2⤵
  PID:7308
- C:\Windows\System\rcwnVMF.exe
  C:\Windows\System\rcwnVMF.exe
  2⤵
  PID:7352
- C:\Windows\System\hWHkyHN.exe
  C:\Windows\System\hWHkyHN.exe
  2⤵
  PID:7412
- C:\Windows\System\wDgdgHr.exe
  C:\Windows\System\wDgdgHr.exe
  2⤵
  PID:7476
- C:\Windows\System\ynrVWIw.exe
  C:\Windows\System\ynrVWIw.exe
  2⤵
  PID:7384
- C:\Windows\System\iFrFirH.exe
  C:\Windows\System\iFrFirH.exe
  2⤵
  PID:7980
- C:\Windows\System\AGtvPAM.exe
  C:\Windows\System\AGtvPAM.exe
  2⤵
  PID:8220
- C:\Windows\System\aamcjOQ.exe
  C:\Windows\System\aamcjOQ.exe
  2⤵
  PID:7616
- C:\Windows\System\kRGdjaU.exe
  C:\Windows\System\kRGdjaU.exe
  2⤵
  PID:8388
- C:\Windows\System\LbkNxzU.exe
  C:\Windows\System\LbkNxzU.exe
  2⤵
  PID:7688
- C:\Windows\System\ayczcJR.exe
  C:\Windows\System\ayczcJR.exe
  2⤵
  PID:8532
- C:\Windows\System\dkzXwvp.exe
  C:\Windows\System\dkzXwvp.exe
  2⤵
  PID:5364
- C:\Windows\System\yQabucx.exe
  C:\Windows\System\yQabucx.exe
  2⤵
  PID:4472
- C:\Windows\System\OmyslQA.exe
  C:\Windows\System\OmyslQA.exe
  2⤵
  PID:6068
- C:\Windows\System\bOxIipM.exe
  C:\Windows\System\bOxIipM.exe
  2⤵
  PID:7880
- C:\Windows\System\DSfRfeD.exe
  C:\Windows\System\DSfRfeD.exe
  2⤵
  PID:7056
- C:\Windows\System\lFcrepZ.exe
  C:\Windows\System\lFcrepZ.exe
  2⤵
  PID:9232
- C:\Windows\System\qcQOmWc.exe
  C:\Windows\System\qcQOmWc.exe
  2⤵
  PID:9256
- C:\Windows\System\hyKhXEz.exe
  C:\Windows\System\hyKhXEz.exe
  2⤵
  PID:9276
- C:\Windows\System\UWFaaGg.exe
  C:\Windows\System\UWFaaGg.exe
  2⤵
  PID:9300
- C:\Windows\System\ewPToKe.exe
  C:\Windows\System\ewPToKe.exe
  2⤵
  PID:9320
- C:\Windows\System\DVIUDNp.exe
  C:\Windows\System\DVIUDNp.exe
  2⤵
  PID:9340
- C:\Windows\System\KlcXWfL.exe
  C:\Windows\System\KlcXWfL.exe
  2⤵
  PID:9360
- C:\Windows\System\TcFsUXt.exe
  C:\Windows\System\TcFsUXt.exe
  2⤵
  PID:9380
- C:\Windows\System\lzPztRb.exe
  C:\Windows\System\lzPztRb.exe
  2⤵
  PID:9404
- C:\Windows\System\wTSuQOq.exe
  C:\Windows\System\wTSuQOq.exe
  2⤵
  PID:9424
- C:\Windows\System\EfudCzz.exe
  C:\Windows\System\EfudCzz.exe
  2⤵
  PID:9448
- C:\Windows\System\HTXiwkM.exe
  C:\Windows\System\HTXiwkM.exe
  2⤵
  PID:9468
- C:\Windows\System\vMBofXY.exe
  C:\Windows\System\vMBofXY.exe
  2⤵
  PID:9488
- C:\Windows\System\twswaTe.exe
  C:\Windows\System\twswaTe.exe
  2⤵
  PID:9516
- C:\Windows\System\JaquNMH.exe
  C:\Windows\System\JaquNMH.exe
  2⤵
  PID:9532
- C:\Windows\System\bjhJrOn.exe
  C:\Windows\System\bjhJrOn.exe
  2⤵
  PID:9560
- C:\Windows\System\ZGftvqz.exe
  C:\Windows\System\ZGftvqz.exe
  2⤵
  PID:9580
- C:\Windows\System\KyVqDXX.exe
  C:\Windows\System\KyVqDXX.exe
  2⤵
  PID:9596
- C:\Windows\System\lSSOklV.exe
  C:\Windows\System\lSSOklV.exe
  2⤵
  PID:9620
- C:\Windows\System\HtXxEkG.exe
  C:\Windows\System\HtXxEkG.exe
  2⤵
  PID:9640
- C:\Windows\System\CZVIrXA.exe
  C:\Windows\System\CZVIrXA.exe
  2⤵
  PID:9664
- C:\Windows\System\NCYEIKP.exe
  C:\Windows\System\NCYEIKP.exe
  2⤵
  PID:9688
- C:\Windows\System\LUrlmiO.exe
  C:\Windows\System\LUrlmiO.exe
  2⤵
  PID:9708
- C:\Windows\System\QiPRoqK.exe
  C:\Windows\System\QiPRoqK.exe
  2⤵
  PID:9732
- C:\Windows\System\UAXvdOl.exe
  C:\Windows\System\UAXvdOl.exe
  2⤵
  PID:9752
- C:\Windows\System\ZRwiwgC.exe
  C:\Windows\System\ZRwiwgC.exe
  2⤵
  PID:9772
- C:\Windows\System\qiLohxW.exe
  C:\Windows\System\qiLohxW.exe
  2⤵
  PID:9796
- C:\Windows\System\kGxaNyt.exe
  C:\Windows\System\kGxaNyt.exe
  2⤵
  PID:9816
- C:\Windows\System\CnunGan.exe
  C:\Windows\System\CnunGan.exe
  2⤵
  PID:9840
- C:\Windows\System\PvJEKbQ.exe
  C:\Windows\System\PvJEKbQ.exe
  2⤵
  PID:9860
- C:\Windows\System\hsGKdTI.exe
  C:\Windows\System\hsGKdTI.exe
  2⤵
  PID:9888
- C:\Windows\System\UaHHWrZ.exe
  C:\Windows\System\UaHHWrZ.exe
  2⤵
  PID:9904
- C:\Windows\System\mkPBaGW.exe
  C:\Windows\System\mkPBaGW.exe
  2⤵
  PID:9928
- C:\Windows\System\dyXoyJe.exe
  C:\Windows\System\dyXoyJe.exe
  2⤵
  PID:9944
- C:\Windows\System\pjfQLYK.exe
  C:\Windows\System\pjfQLYK.exe
  2⤵
  PID:9968
- C:\Windows\System\KxQJoSD.exe
  C:\Windows\System\KxQJoSD.exe
  2⤵
  PID:9992
- C:\Windows\System\BCrQyFM.exe
  C:\Windows\System\BCrQyFM.exe
  2⤵
  PID:10012
- C:\Windows\System\afuisqz.exe
  C:\Windows\System\afuisqz.exe
  2⤵
  PID:10032
- C:\Windows\System\QksJyAv.exe
  C:\Windows\System\QksJyAv.exe
  2⤵
  PID:10056
- C:\Windows\System\JfwWvNx.exe
  C:\Windows\System\JfwWvNx.exe
  2⤵
  PID:10080
- C:\Windows\System\LWnjgbX.exe
  C:\Windows\System\LWnjgbX.exe
  2⤵
  PID:10108
- C:\Windows\System\FgjelkG.exe
  C:\Windows\System\FgjelkG.exe
  2⤵
  PID:10132
- C:\Windows\System\mPlHPZo.exe
  C:\Windows\System\mPlHPZo.exe
  2⤵
  PID:10152
- C:\Windows\System\rWXIQkG.exe
  C:\Windows\System\rWXIQkG.exe
  2⤵
  PID:10172
- C:\Windows\System\qtXqcQM.exe
  C:\Windows\System\qtXqcQM.exe
  2⤵
  PID:10196
- C:\Windows\System\PAFtUaJ.exe
  C:\Windows\System\PAFtUaJ.exe
  2⤵
  PID:10220
- C:\Windows\System\BrCKsbN.exe
  C:\Windows\System\BrCKsbN.exe
  2⤵
  PID:8764
- C:\Windows\System\wistMxX.exe
  C:\Windows\System\wistMxX.exe
  2⤵
  PID:8800
- C:\Windows\System\DeoyHBm.exe
  C:\Windows\System\DeoyHBm.exe
  2⤵
  PID:8852
- C:\Windows\System\DIIguAd.exe
  C:\Windows\System\DIIguAd.exe
  2⤵
  PID:8888
- C:\Windows\System\YvYJOCd.exe
  C:\Windows\System\YvYJOCd.exe
  2⤵
  PID:7800
- C:\Windows\System\EgonLVs.exe
  C:\Windows\System\EgonLVs.exe
  2⤵
  PID:8484
- C:\Windows\System\lYLGbZF.exe
  C:\Windows\System\lYLGbZF.exe
  2⤵
  PID:7416
- C:\Windows\System\iiNyBWY.exe
  C:\Windows\System\iiNyBWY.exe
  2⤵
  PID:8572
- C:\Windows\System\OhpSxQB.exe
  C:\Windows\System\OhpSxQB.exe
  2⤵
  PID:6420
- C:\Windows\System\ZtDnbhx.exe
  C:\Windows\System\ZtDnbhx.exe
  2⤵
  PID:8548
- C:\Windows\System\ioXbuvd.exe
  C:\Windows\System\ioXbuvd.exe
  2⤵
  PID:8212
- C:\Windows\System\mrAvDjh.exe
  C:\Windows\System\mrAvDjh.exe
  2⤵
  PID:8656
- C:\Windows\System\TZlJUIC.exe
  C:\Windows\System\TZlJUIC.exe
  2⤵
  PID:5864
- C:\Windows\System\wYllczs.exe
  C:\Windows\System\wYllczs.exe
  2⤵
  PID:8736
- C:\Windows\System\agTgbsX.exe
  C:\Windows\System\agTgbsX.exe
  2⤵
  PID:9268
- C:\Windows\System\UjWQBzn.exe
  C:\Windows\System\UjWQBzn.exe
  2⤵
  PID:5560
- C:\Windows\System\mfTWnaw.exe
  C:\Windows\System\mfTWnaw.exe
  2⤵
  PID:8996
- C:\Windows\System\curILMT.exe
  C:\Windows\System\curILMT.exe
  2⤵
  PID:9016
- C:\Windows\System\iOHKihk.exe
  C:\Windows\System\iOHKihk.exe
  2⤵
  PID:9064
- C:\Windows\System\QAUMjpN.exe
  C:\Windows\System\QAUMjpN.exe
  2⤵
  PID:9200
- C:\Windows\System\dOWqItD.exe
  C:\Windows\System\dOWqItD.exe
  2⤵
  PID:8416
- C:\Windows\System\NboNnwk.exe
  C:\Windows\System\NboNnwk.exe
  2⤵
  PID:9720
- C:\Windows\System\ligQVmg.exe
  C:\Windows\System\ligQVmg.exe
  2⤵
  PID:9748
- C:\Windows\System\qeLhHCc.exe
  C:\Windows\System\qeLhHCc.exe
  2⤵
  PID:9784
- C:\Windows\System\mdaYbon.exe
  C:\Windows\System\mdaYbon.exe
  2⤵
  PID:7840
- C:\Windows\System\ntpDHkB.exe
  C:\Windows\System\ntpDHkB.exe
  2⤵
  PID:7392
- C:\Windows\System\ixIXbXx.exe
  C:\Windows\System\ixIXbXx.exe
  2⤵
  PID:9880
- C:\Windows\System\vLPRHiI.exe
  C:\Windows\System\vLPRHiI.exe
  2⤵
  PID:9936
- C:\Windows\System\XktpMLy.exe
  C:\Windows\System\XktpMLy.exe
  2⤵
  PID:9964
- C:\Windows\System\GDjYApZ.exe
  C:\Windows\System\GDjYApZ.exe
  2⤵
  PID:10008
- C:\Windows\System\zlwXwjc.exe
  C:\Windows\System\zlwXwjc.exe
  2⤵
  PID:10048
- C:\Windows\System\wxOZwyI.exe
  C:\Windows\System\wxOZwyI.exe
  2⤵
  PID:10088
- C:\Windows\System\hQflQwh.exe
  C:\Windows\System\hQflQwh.exe
  2⤵
  PID:7572
- C:\Windows\System\hKbCBgd.exe
  C:\Windows\System\hKbCBgd.exe
  2⤵
  PID:10168
- C:\Windows\System\umMEMzo.exe
  C:\Windows\System\umMEMzo.exe
  2⤵
  PID:10216
- C:\Windows\System\JpTakan.exe
  C:\Windows\System\JpTakan.exe
  2⤵
  PID:9500
- C:\Windows\System\VTDoCJG.exe
  C:\Windows\System\VTDoCJG.exe
  2⤵
  PID:9576
- C:\Windows\System\ncCrgnG.exe
  C:\Windows\System\ncCrgnG.exe
  2⤵
  PID:9600
- C:\Windows\System\CSNdGFR.exe
  C:\Windows\System\CSNdGFR.exe
  2⤵
  PID:8596
- C:\Windows\System\SITPefG.exe
  C:\Windows\System\SITPefG.exe
  2⤵
  PID:7456
- C:\Windows\System\fUniwok.exe
  C:\Windows\System\fUniwok.exe
  2⤵
  PID:9676
- C:\Windows\System\xocZCWk.exe
  C:\Windows\System\xocZCWk.exe
  2⤵
  PID:9868
- C:\Windows\System\mKbYZrN.exe
  C:\Windows\System\mKbYZrN.exe
  2⤵
  PID:8592
- C:\Windows\System\NAQptdI.exe
  C:\Windows\System\NAQptdI.exe
  2⤵
  PID:10252
- C:\Windows\System\vYSluAx.exe
  C:\Windows\System\vYSluAx.exe
  2⤵
  PID:10276
- C:\Windows\System\JrXdtwh.exe
  C:\Windows\System\JrXdtwh.exe
  2⤵
  PID:10300
- C:\Windows\System\dhduLyY.exe
  C:\Windows\System\dhduLyY.exe
  2⤵
  PID:10324
- C:\Windows\System\tqQcwOD.exe
  C:\Windows\System\tqQcwOD.exe
  2⤵
  PID:10344
- C:\Windows\System\okvXgEv.exe
  C:\Windows\System\okvXgEv.exe
  2⤵
  PID:10364
- C:\Windows\System\xlZRzIk.exe
  C:\Windows\System\xlZRzIk.exe
  2⤵
  PID:10388
- C:\Windows\System\eqTqqIb.exe
  C:\Windows\System\eqTqqIb.exe
  2⤵
  PID:10412
- C:\Windows\System\PcWJvve.exe
  C:\Windows\System\PcWJvve.exe
  2⤵
  PID:10436
- C:\Windows\System\brnluej.exe
  C:\Windows\System\brnluej.exe
  2⤵
  PID:10456
- C:\Windows\System\DxloCwv.exe
  C:\Windows\System\DxloCwv.exe
  2⤵
  PID:10476
- C:\Windows\System\FkoLtDH.exe
  C:\Windows\System\FkoLtDH.exe
  2⤵
  PID:10492
- C:\Windows\System\sxbAvFY.exe
  C:\Windows\System\sxbAvFY.exe
  2⤵
  PID:10684
- C:\Windows\System\uVbPKrN.exe
  C:\Windows\System\uVbPKrN.exe
  2⤵
  PID:10712
- C:\Windows\System\rlMxUHT.exe
  C:\Windows\System\rlMxUHT.exe
  2⤵
  PID:10732
- C:\Windows\System\wDPPvZk.exe
  C:\Windows\System\wDPPvZk.exe
  2⤵
  PID:10752
- C:\Windows\System\xIJPqcQ.exe
  C:\Windows\System\xIJPqcQ.exe
  2⤵
  PID:10776
- C:\Windows\System\XempNIO.exe
  C:\Windows\System\XempNIO.exe
  2⤵
  PID:10808
- C:\Windows\System\gabTAwc.exe
  C:\Windows\System\gabTAwc.exe
  2⤵
  PID:10828
- C:\Windows\System\RMQTGgI.exe
  C:\Windows\System\RMQTGgI.exe
  2⤵
  PID:10844
- C:\Windows\System\LseGXhX.exe
  C:\Windows\System\LseGXhX.exe
  2⤵
  PID:10872
- C:\Windows\System\NMJsMXL.exe
  C:\Windows\System\NMJsMXL.exe
  2⤵
  PID:10892
- C:\Windows\System\pSvQCfV.exe
  C:\Windows\System\pSvQCfV.exe
  2⤵
  PID:10920
- C:\Windows\System\OAVLXRt.exe
  C:\Windows\System\OAVLXRt.exe
  2⤵
  PID:10944
- C:\Windows\System\xMlrsmw.exe
  C:\Windows\System\xMlrsmw.exe
  2⤵
  PID:10964
- C:\Windows\System\ZDRXNPM.exe
  C:\Windows\System\ZDRXNPM.exe
  2⤵
  PID:11008
- C:\Windows\System\ACnRIAY.exe
  C:\Windows\System\ACnRIAY.exe
  2⤵
  PID:11032
- C:\Windows\System\ipzjRUj.exe
  C:\Windows\System\ipzjRUj.exe
  2⤵
  PID:11052
- C:\Windows\System\eFZSbpB.exe
  C:\Windows\System\eFZSbpB.exe
  2⤵
  PID:11076
- C:\Windows\System\wZaILZI.exe
  C:\Windows\System\wZaILZI.exe
  2⤵
  PID:11104
- C:\Windows\System\DkETwaf.exe
  C:\Windows\System\DkETwaf.exe
  2⤵
  PID:11128
- C:\Windows\System\gCybLXC.exe
  C:\Windows\System\gCybLXC.exe
  2⤵
  PID:11148
- C:\Windows\System\LOIWGan.exe
  C:\Windows\System\LOIWGan.exe
  2⤵
  PID:11172
- C:\Windows\System\YlJMRpE.exe
  C:\Windows\System\YlJMRpE.exe
  2⤵
  PID:11196
- C:\Windows\System\PeEiTXS.exe
  C:\Windows\System\PeEiTXS.exe
  2⤵
  PID:11216
- C:\Windows\System\rDsaveC.exe
  C:\Windows\System\rDsaveC.exe
  2⤵
  PID:11236
- C:\Windows\System\DeTILvW.exe
  C:\Windows\System\DeTILvW.exe
  2⤵
  PID:11256
- C:\Windows\System\dPjGrjr.exe
  C:\Windows\System\dPjGrjr.exe
  2⤵
  PID:8832
- C:\Windows\System\zHvAhQA.exe
  C:\Windows\System\zHvAhQA.exe
  2⤵
  PID:9680
- C:\Windows\System\MhbRlFb.exe
  C:\Windows\System\MhbRlFb.exe
  2⤵
  PID:7908
- C:\Windows\System\tRkfTFo.exe
  C:\Windows\System\tRkfTFo.exe
  2⤵
  PID:11276
- C:\Windows\System\wSeLyfR.exe
  C:\Windows\System\wSeLyfR.exe
  2⤵
  PID:11296
- C:\Windows\System\CyQraKL.exe
  C:\Windows\System\CyQraKL.exe
  2⤵
  PID:11320
- C:\Windows\System\FYZXXwU.exe
  C:\Windows\System\FYZXXwU.exe
  2⤵
  PID:11340
- C:\Windows\System\PIAgFPv.exe
  C:\Windows\System\PIAgFPv.exe
  2⤵
  PID:11364
- C:\Windows\System\fLbnvJH.exe
  C:\Windows\System\fLbnvJH.exe
  2⤵
  PID:11400
- C:\Windows\System\TfRKqWz.exe
  C:\Windows\System\TfRKqWz.exe
  2⤵
  PID:11416
- C:\Windows\System\fZnCody.exe
  C:\Windows\System\fZnCody.exe
  2⤵
  PID:11440
- C:\Windows\System\knsyeIg.exe
  C:\Windows\System\knsyeIg.exe
  2⤵
  PID:11464
- C:\Windows\System\UNIzalD.exe
  C:\Windows\System\UNIzalD.exe
  2⤵
  PID:11488
- C:\Windows\System\RkPtgrt.exe
  C:\Windows\System\RkPtgrt.exe
  2⤵
  PID:11512
- C:\Windows\System\dyPLSSe.exe
  C:\Windows\System\dyPLSSe.exe
  2⤵
  PID:11556
- C:\Windows\System\IghFwca.exe
  C:\Windows\System\IghFwca.exe
  2⤵
  PID:11580
- C:\Windows\System\lElPVIv.exe
  C:\Windows\System\lElPVIv.exe
  2⤵
  PID:11612
- C:\Windows\System\xAhUjhR.exe
  C:\Windows\System\xAhUjhR.exe
  2⤵
  PID:11636
- C:\Windows\System\MtqyISR.exe
  C:\Windows\System\MtqyISR.exe
  2⤵
  PID:11664
- C:\Windows\System\DnJraUs.exe
  C:\Windows\System\DnJraUs.exe
  2⤵
  PID:11692
- C:\Windows\System\ksXTMcy.exe
  C:\Windows\System\ksXTMcy.exe
  2⤵
  PID:11720
- C:\Windows\System\ImjQfiK.exe
  C:\Windows\System\ImjQfiK.exe
  2⤵
  PID:11740
- C:\Windows\System\Jnxbrpg.exe
  C:\Windows\System\Jnxbrpg.exe
  2⤵
  PID:11764
- C:\Windows\System\xUoIfYN.exe
  C:\Windows\System\xUoIfYN.exe
  2⤵
  PID:11780
- C:\Windows\System\MNVVpzK.exe
  C:\Windows\System\MNVVpzK.exe
  2⤵
  PID:11800
- C:\Windows\System\cXZyxcf.exe
  C:\Windows\System\cXZyxcf.exe
  2⤵
  PID:11816
- C:\Windows\System\JfwMAgi.exe
  C:\Windows\System\JfwMAgi.exe
  2⤵
  PID:11832
- C:\Windows\System\ILgpKBD.exe
  C:\Windows\System\ILgpKBD.exe
  2⤵
  PID:11848
- C:\Windows\System\mtwPXwv.exe
  C:\Windows\System\mtwPXwv.exe
  2⤵
  PID:11868
- C:\Windows\System\aeoMGBl.exe
  C:\Windows\System\aeoMGBl.exe
  2⤵
  PID:11884
- C:\Windows\System\iOMLUre.exe
  C:\Windows\System\iOMLUre.exe
  2⤵
  PID:11900
- C:\Windows\System\dwMzXKq.exe
  C:\Windows\System\dwMzXKq.exe
  2⤵
  PID:11916
- C:\Windows\System\zDKMhCG.exe
  C:\Windows\System\zDKMhCG.exe
  2⤵
  PID:11932
- C:\Windows\System\Yrrjwzg.exe
  C:\Windows\System\Yrrjwzg.exe
  2⤵
  PID:11948
- C:\Windows\System\SXwyYGv.exe
  C:\Windows\System\SXwyYGv.exe
  2⤵
  PID:11968
- C:\Windows\System\TmsOIvw.exe
  C:\Windows\System\TmsOIvw.exe
  2⤵
  PID:11992
- C:\Windows\System\vyeTPSi.exe
  C:\Windows\System\vyeTPSi.exe
  2⤵
  PID:12012
- C:\Windows\System\JbFSKuC.exe
  C:\Windows\System\JbFSKuC.exe
  2⤵
  PID:12032
- C:\Windows\System\HOMySar.exe
  C:\Windows\System\HOMySar.exe
  2⤵
  PID:12056
- C:\Windows\System\XJdpwMN.exe
  C:\Windows\System\XJdpwMN.exe
  2⤵
  PID:12088
- C:\Windows\System\VApoZSr.exe
  C:\Windows\System\VApoZSr.exe
  2⤵
  PID:12108
- C:\Windows\System\jXABJeN.exe
  C:\Windows\System\jXABJeN.exe
  2⤵
  PID:12128
- C:\Windows\System\iuJGCjN.exe
  C:\Windows\System\iuJGCjN.exe
  2⤵
  PID:12152
- C:\Windows\System\QopsHoh.exe
  C:\Windows\System\QopsHoh.exe
  2⤵
  PID:12180
- C:\Windows\System\kZihsVS.exe
  C:\Windows\System\kZihsVS.exe
  2⤵
  PID:12208
- C:\Windows\System\GFthPoq.exe
  C:\Windows\System\GFthPoq.exe
  2⤵
  PID:12232
- C:\Windows\System\njpCISM.exe
  C:\Windows\System\njpCISM.exe
  2⤵
  PID:12252
- C:\Windows\System\zKgGMkY.exe
  C:\Windows\System\zKgGMkY.exe
  2⤵
  PID:12272
- C:\Windows\System\lDmFLzN.exe
  C:\Windows\System\lDmFLzN.exe
  2⤵
  PID:10144
- C:\Windows\System\pzfdlen.exe
  C:\Windows\System\pzfdlen.exe
  2⤵
  PID:10072
- C:\Windows\System\SbsOCJX.exe
  C:\Windows\System\SbsOCJX.exe
  2⤵
  PID:9988
- C:\Windows\System\eJFnibA.exe
  C:\Windows\System\eJFnibA.exe
  2⤵
  PID:10260
- C:\Windows\System\tEqLmTM.exe
  C:\Windows\System\tEqLmTM.exe
  2⤵
  PID:10372
- C:\Windows\System\NXGNkUA.exe
  C:\Windows\System\NXGNkUA.exe
  2⤵
  PID:10448
- C:\Windows\System\CqKeHcn.exe
  C:\Windows\System\CqKeHcn.exe
  2⤵
  PID:12300
- C:\Windows\System\HiidTMG.exe
  C:\Windows\System\HiidTMG.exe
  2⤵
  PID:12340
- C:\Windows\System\wkgdyOc.exe
  C:\Windows\System\wkgdyOc.exe
  2⤵
  PID:12360
- C:\Windows\System\bbpgqpv.exe
  C:\Windows\System\bbpgqpv.exe
  2⤵
  PID:12392
- C:\Windows\System\rJWejIu.exe
  C:\Windows\System\rJWejIu.exe
  2⤵
  PID:12476
- C:\Windows\System\rxoDqCv.exe
  C:\Windows\System\rxoDqCv.exe
  2⤵
  PID:12492
- C:\Windows\System\XYBJHFo.exe
  C:\Windows\System\XYBJHFo.exe
  2⤵
  PID:12516
- C:\Windows\System\DuBOAHX.exe
  C:\Windows\System\DuBOAHX.exe
  2⤵
  PID:12536
- C:\Windows\System\giFdZXf.exe
  C:\Windows\System\giFdZXf.exe
  2⤵
  PID:12564
- C:\Windows\System\XGaCwjo.exe
  C:\Windows\System\XGaCwjo.exe
  2⤵
  PID:12584
- C:\Windows\System\MwMbBAp.exe
  C:\Windows\System\MwMbBAp.exe
  2⤵
  PID:12612
- C:\Windows\System\WDCuuSM.exe
  C:\Windows\System\WDCuuSM.exe
  2⤵
  PID:12632
- C:\Windows\System\ajaKyBN.exe
  C:\Windows\System\ajaKyBN.exe
  2⤵
  PID:13080
- C:\Windows\System\hZcjRhV.exe
  C:\Windows\System\hZcjRhV.exe
  2⤵
  PID:13096
- C:\Windows\System\aBZCggF.exe
  C:\Windows\System\aBZCggF.exe
  2⤵
  PID:13124
- C:\Windows\System\sXHIMcq.exe
  C:\Windows\System\sXHIMcq.exe
  2⤵
  PID:13160
- C:\Windows\System\xCFPSYh.exe
  C:\Windows\System\xCFPSYh.exe
  2⤵
  PID:13184
- C:\Windows\System\cxnjqIp.exe
  C:\Windows\System\cxnjqIp.exe
  2⤵
  PID:13208
- C:\Windows\System\lHJqReC.exe
  C:\Windows\System\lHJqReC.exe
  2⤵
  PID:13244
- C:\Windows\System\YZhLBbS.exe
  C:\Windows\System\YZhLBbS.exe
  2⤵
  PID:13284
- C:\Windows\System\JvMdEXf.exe
  C:\Windows\System\JvMdEXf.exe
  2⤵
  PID:10600
- C:\Windows\System\QshsusN.exe
  C:\Windows\System\QshsusN.exe
  2⤵
  PID:7612
- C:\Windows\System\XbSpZVq.exe
  C:\Windows\System\XbSpZVq.exe
  2⤵
  PID:9744
- C:\Windows\System\pECJBVA.exe
  C:\Windows\System\pECJBVA.exe
  2⤵
  PID:10772
- C:\Windows\System\eHaYkjK.exe
  C:\Windows\System\eHaYkjK.exe
  2⤵
  PID:10852
- C:\Windows\System\lqblbrP.exe
  C:\Windows\System\lqblbrP.exe
  2⤵
  PID:10972
- C:\Windows\System\SWdnVAJ.exe
  C:\Windows\System\SWdnVAJ.exe
  2⤵
  PID:11016
- C:\Windows\System\crmgujD.exe
  C:\Windows\System\crmgujD.exe
  2⤵
  PID:11060
- C:\Windows\System\CuRYuQt.exe
  C:\Windows\System\CuRYuQt.exe
  2⤵
  PID:11112
- C:\Windows\System\HGPVRDn.exe
  C:\Windows\System\HGPVRDn.exe
  2⤵
  PID:11164
- C:\Windows\System\BAoDzoz.exe
  C:\Windows\System\BAoDzoz.exe
  2⤵
  PID:11224
- C:\Windows\System\pRNwEpe.exe
  C:\Windows\System\pRNwEpe.exe
  2⤵
  PID:11252
- C:\Windows\System\OwQiDnp.exe
  C:\Windows\System\OwQiDnp.exe
  2⤵
  PID:9656
- C:\Windows\System\ErCtTxP.exe
  C:\Windows\System\ErCtTxP.exe
  2⤵
  PID:11412
- C:\Windows\System\uJYDYzT.exe
  C:\Windows\System\uJYDYzT.exe
  2⤵
  PID:10000
- C:\Windows\System\RadodQw.exe
  C:\Windows\System\RadodQw.exe
  2⤵
  PID:8156
- C:\Windows\System\sNnfFlJ.exe
  C:\Windows\System\sNnfFlJ.exe
  2⤵
  PID:11844
- C:\Windows\System\VjQCQWj.exe
  C:\Windows\System\VjQCQWj.exe
  2⤵
  PID:11896
- C:\Windows\System\FXiWljl.exe
  C:\Windows\System\FXiWljl.exe
  2⤵
  PID:11956
- C:\Windows\System\grminfl.exe
  C:\Windows\System\grminfl.exe
  2⤵
  PID:12000
- C:\Windows\System\FDWAeam.exe
  C:\Windows\System\FDWAeam.exe
  2⤵
  PID:12028
- C:\Windows\System\xkpuOmU.exe
  C:\Windows\System\xkpuOmU.exe
  2⤵
  PID:12052
- C:\Windows\System\zfyLpDA.exe
  C:\Windows\System\zfyLpDA.exe
  2⤵
  PID:12072
- C:\Windows\System\VqMzWYe.exe
  C:\Windows\System\VqMzWYe.exe
  2⤵
  PID:12124
- C:\Windows\System\ixrppAD.exe
  C:\Windows\System\ixrppAD.exe
  2⤵
  PID:10396
- C:\Windows\System\WyJJAbi.exe
  C:\Windows\System\WyJJAbi.exe
  2⤵
  PID:11248
- C:\Windows\System\GIfgdlz.exe
  C:\Windows\System\GIfgdlz.exe
  2⤵
  PID:12048
- C:\Windows\System\aGMgjei.exe
  C:\Windows\System\aGMgjei.exe
  2⤵
  PID:13296
- C:\Windows\System\nQFSlRH.exe
  C:\Windows\System\nQFSlRH.exe
  2⤵
  PID:9416
- C:\Windows\System\FYVwCPV.exe
  C:\Windows\System\FYVwCPV.exe
  2⤵
  PID:12996
- C:\Windows\System\AiuCnDv.exe
  C:\Windows\System\AiuCnDv.exe
  2⤵
  PID:10956
- C:\Windows\System\BzPWVMn.exe
  C:\Windows\System\BzPWVMn.exe
  2⤵
  PID:7952
- C:\Windows\System\gcCSrRq.exe
  C:\Windows\System\gcCSrRq.exe
  2⤵
  PID:10904
- C:\Windows\System\hKNdaAR.exe
  C:\Windows\System\hKNdaAR.exe
  2⤵
  PID:10464
- C:\Windows\System\pgVQuIo.exe
  C:\Windows\System\pgVQuIo.exe
  2⤵
  PID:10340
- C:\Windows\System\yseJOHq.exe
  C:\Windows\System\yseJOHq.exe
  2⤵
  PID:10244
- C:\Windows\System\xfCszwf.exe
  C:\Windows\System\xfCszwf.exe
  2⤵
  PID:11748
- C:\Windows\System\egKaIks.exe
  C:\Windows\System\egKaIks.exe
  2⤵
  PID:11044
- C:\Windows\System\AKCGIsJ.exe
  C:\Windows\System\AKCGIsJ.exe
  2⤵
  PID:3736
- C:\Windows\System\hCXYsle.exe
  C:\Windows\System\hCXYsle.exe
  2⤵
  PID:2268
- C:\Windows\System\qTKblDe.exe
  C:\Windows\System\qTKblDe.exe
  2⤵
  PID:10188
- C:\Windows\System\dnDOuqU.exe
  C:\Windows\System\dnDOuqU.exe
  2⤵
  PID:8332
- C:\Windows\System\FVAvdAD.exe
  C:\Windows\System\FVAvdAD.exe
  2⤵
  PID:13120
- C:\Windows\System\EujzIzF.exe
  C:\Windows\System\EujzIzF.exe
  2⤵
  PID:13176
- C:\Windows\System\dqRzJGY.exe
  C:\Windows\System\dqRzJGY.exe
  2⤵
  PID:11088
- C:\Windows\System\dpUkfdp.exe
  C:\Windows\System\dpUkfdp.exe
  2⤵
  PID:13220
- C:\Windows\System\laZwxgf.exe
  C:\Windows\System\laZwxgf.exe
  2⤵
  PID:13020
- C:\Windows\System\uyvjffF.exe
  C:\Windows\System\uyvjffF.exe
  2⤵
  PID:12264
- C:\Windows\System\RxtunZS.exe
  C:\Windows\System\RxtunZS.exe
  2⤵
  PID:11424
- C:\Windows\System\OZIgKGP.exe
  C:\Windows\System\OZIgKGP.exe
  2⤵
  PID:4252
- C:\Windows\System\NQGipfP.exe
  C:\Windows\System\NQGipfP.exe
  2⤵
  PID:11532
- C:\Windows\System\vCpzBVe.exe
  C:\Windows\System\vCpzBVe.exe
  2⤵
  PID:4208
- C:\Windows\System\ECtqGsi.exe
  C:\Windows\System\ECtqGsi.exe
  2⤵
  PID:10724
- C:\Windows\System\lJFpibL.exe
  C:\Windows\System\lJFpibL.exe
  2⤵
  PID:12596
- C:\Windows\System\AMcjUpu.exe
  C:\Windows\System\AMcjUpu.exe
  2⤵
  PID:11268
- C:\Windows\System\iYhPoST.exe
  C:\Windows\System\iYhPoST.exe
  2⤵
  PID:9152
- C:\Windows\System\PaQhfsf.exe
  C:\Windows\System\PaQhfsf.exe
  2⤵
  PID:12348
- C:\Windows\System\MwRbQTy.exe
  C:\Windows\System\MwRbQTy.exe
  2⤵
  PID:11520
- C:\Windows\System\cNwowWw.exe
  C:\Windows\System\cNwowWw.exe
  2⤵
  PID:10980
- C:\Windows\System\cmkaDNb.exe
  C:\Windows\System\cmkaDNb.exe
  2⤵
  PID:7708
- C:\Windows\System\NDEnkjz.exe
  C:\Windows\System\NDEnkjz.exe
  2⤵
  PID:10272
- C:\Windows\System\zsrgpcu.exe
  C:\Windows\System\zsrgpcu.exe
  2⤵
  PID:12628
- C:\Windows\System\RAjDkoD.exe
  C:\Windows\System\RAjDkoD.exe
  2⤵
  PID:12240
- C:\Windows\System\RBfvSPn.exe
  C:\Windows\System\RBfvSPn.exe
  2⤵
  PID:11624
- C:\Windows\System\wPTZeYg.exe
  C:\Windows\System\wPTZeYg.exe
  2⤵
  PID:11788
- C:\Windows\System\nLtSHEQ.exe
  C:\Windows\System\nLtSHEQ.exe
  2⤵
  PID:9496
- C:\Windows\System\SoyTPvB.exe
  C:\Windows\System\SoyTPvB.exe
  2⤵
  PID:10576
- C:\Windows\System\LdQQSji.exe
  C:\Windows\System\LdQQSji.exe
  2⤵
  PID:11328
- C:\Windows\System\mazSyHA.exe
  C:\Windows\System\mazSyHA.exe
  2⤵
  PID:4388
- C:\Windows\System\rMMxQNg.exe
  C:\Windows\System\rMMxQNg.exe
  2⤵
  PID:13112
- C:\Windows\System\ziUFmfN.exe
  C:\Windows\System\ziUFmfN.exe
  2⤵
  PID:11120
- C:\Windows\System\aNhOvdC.exe
  C:\Windows\System\aNhOvdC.exe
  2⤵
  PID:10552
- C:\Windows\System\LANgkXZ.exe
  C:\Windows\System\LANgkXZ.exe
  2⤵
  PID:10768
- C:\Windows\System\kBExWpW.exe
  C:\Windows\System\kBExWpW.exe
  2⤵
  PID:8000
- C:\Windows\System\aeAnRFF.exe
  C:\Windows\System\aeAnRFF.exe
  2⤵
  PID:10708
- C:\Windows\System\oUURWeu.exe
  C:\Windows\System\oUURWeu.exe
  2⤵
  PID:12780
- C:\Windows\System\mqxwLgv.exe
  C:\Windows\System\mqxwLgv.exe
  2⤵
  PID:2860
- C:\Windows\System\QemmWal.exe
  C:\Windows\System\QemmWal.exe
  2⤵
  PID:3380
- C:\Windows\System\QIIjXeN.exe
  C:\Windows\System\QIIjXeN.exe
  2⤵
  PID:11448
- C:\Windows\System\lMtYHzh.exe
  C:\Windows\System\lMtYHzh.exe
  2⤵
  PID:11964
- C:\Windows\System\GHjsfis.exe
  C:\Windows\System\GHjsfis.exe
  2⤵
  PID:13076
- C:\Windows\System\NBcGnoH.exe
  C:\Windows\System\NBcGnoH.exe
  2⤵
  PID:11700
- C:\Windows\System\xxystte.exe
  C:\Windows\System\xxystte.exe
  2⤵
  PID:11680
- C:\Windows\System\rXIRUzH.exe
  C:\Windows\System\rXIRUzH.exe
  2⤵
  PID:12452
- C:\Windows\System\qnwxgmy.exe
  C:\Windows\System\qnwxgmy.exe
  2⤵
  PID:4708
- C:\Windows\System\PSVpRhW.exe
  C:\Windows\System\PSVpRhW.exe
  2⤵
  PID:6708
- C:\Windows\System\DQHwXHK.exe
  C:\Windows\System\DQHwXHK.exe
  2⤵
  PID:10860
- C:\Windows\System\hGSksPg.exe
  C:\Windows\System\hGSksPg.exe
  2⤵
  PID:9464
- C:\Windows\System\UchUEWp.exe
  C:\Windows\System\UchUEWp.exe
  2⤵
  PID:1260
- C:\Windows\System\QniWWKI.exe
  C:\Windows\System\QniWWKI.exe
  2⤵
  PID:5116
- C:\Windows\System\TVvWnTv.exe
  C:\Windows\System\TVvWnTv.exe
  2⤵
  PID:3356
- C:\Windows\System\aLWCbsS.exe
  C:\Windows\System\aLWCbsS.exe
  2⤵
  PID:5104
- C:\Windows\System\fIvJjIn.exe
  C:\Windows\System\fIvJjIn.exe
  2⤵
  PID:12024
- C:\Windows\System\VHVglES.exe
  C:\Windows\System\VHVglES.exe
  2⤵
  PID:12760
- C:\Windows\System\UabRfSF.exe
  C:\Windows\System\UabRfSF.exe
  2⤵
  PID:1968
- C:\Windows\System\ngZCuuP.exe
  C:\Windows\System\ngZCuuP.exe
  2⤵
  PID:11704
- C:\Windows\System\vtOeuDN.exe
  C:\Windows\System\vtOeuDN.exe
  2⤵
  PID:4824
- C:\Windows\System\uOACtfE.exe
  C:\Windows\System\uOACtfE.exe
  2⤵
  PID:3608
- C:\Windows\System\mgmfKco.exe
  C:\Windows\System\mgmfKco.exe
  2⤵
  PID:6712
- C:\Windows\System\AAgbiwV.exe
  C:\Windows\System\AAgbiwV.exe
  2⤵
  PID:5160
- C:\Windows\System\mXFNlxK.exe
  C:\Windows\System\mXFNlxK.exe
  2⤵
  PID:2336
- C:\Windows\System\XLiWeio.exe
  C:\Windows\System\XLiWeio.exe
  2⤵
  PID:3592
- C:\Windows\System\QJJOvTn.exe
  C:\Windows\System\QJJOvTn.exe
  2⤵
  PID:892
- C:\Windows\System\iXZczfK.exe
  C:\Windows\System\iXZczfK.exe
  2⤵
  PID:10692
- C:\Windows\System\oeggvos.exe
  C:\Windows\System\oeggvos.exe
  2⤵
  PID:3360
- C:\Windows\System\zpqvwlC.exe
  C:\Windows\System\zpqvwlC.exe
  2⤵
  PID:168
- C:\Windows\System\JxuRLxv.exe
  C:\Windows\System\JxuRLxv.exe
  2⤵
  PID:3104
- C:\Windows\System\zoqkuwi.exe
  C:\Windows\System\zoqkuwi.exe
  2⤵
  PID:4188
- C:\Windows\System\uHlagEC.exe
  C:\Windows\System\uHlagEC.exe
  2⤵
  PID:10504
- C:\Windows\System\dpjpFJj.exe
  C:\Windows\System\dpjpFJj.exe
  2⤵
  PID:12556
- C:\Windows\System\xNMmNba.exe
  C:\Windows\System\xNMmNba.exe
  2⤵
  PID:3744
- C:\Windows\System\fQqQZQU.exe
  C:\Windows\System\fQqQZQU.exe
  2⤵
  PID:3752
- C:\Windows\System\KHQKRgF.exe
  C:\Windows\System\KHQKRgF.exe
  2⤵
  PID:4788
- C:\Windows\System\TEzUmUL.exe
  C:\Windows\System\TEzUmUL.exe
  2⤵
  PID:2864
- C:\Windows\System\ElqIWHJ.exe
  C:\Windows\System\ElqIWHJ.exe
  2⤵
  PID:3740
- C:\Windows\System\xmuOPEc.exe
  C:\Windows\System\xmuOPEc.exe
  2⤵
  PID:11812
- C:\Windows\System\HyCDiuq.exe
  C:\Windows\System\HyCDiuq.exe
  2⤵
  PID:2264
- C:\Windows\System\JFNuOrS.exe
  C:\Windows\System\JFNuOrS.exe
  2⤵
  PID:4844
- C:\Windows\System\OkOLHZA.exe
  C:\Windows\System\OkOLHZA.exe
  2⤵
  PID:3732
- C:\Windows\System\fnbxbZM.exe
  C:\Windows\System\fnbxbZM.exe
  2⤵
  PID:2480
- C:\Windows\System\MsNxwJB.exe
  C:\Windows\System\MsNxwJB.exe
  2⤵
  PID:4368
- C:\Windows\System\PQdsvjW.exe
  C:\Windows\System\PQdsvjW.exe
  2⤵
  PID:1032
- C:\Windows\System\kIfUqma.exe
  C:\Windows\System\kIfUqma.exe
  2⤵
  PID:13260
- C:\Windows\System\drJnuYR.exe
  C:\Windows\System\drJnuYR.exe
  2⤵
  PID:2988
- C:\Windows\System\zRSLUrf.exe
  C:\Windows\System\zRSLUrf.exe
  2⤵
  PID:11880
- C:\Windows\System\zDvEAoJ.exe
  C:\Windows\System\zDvEAoJ.exe
  2⤵
  PID:4548
- C:\Windows\System\pMtnIHT.exe
  C:\Windows\System\pMtnIHT.exe
  2⤵
  PID:3676
- C:\Windows\System\aswrkMP.exe
  C:\Windows\System\aswrkMP.exe
  2⤵
  PID:5240
- C:\Windows\System\kQgRHBo.exe
  C:\Windows\System\kQgRHBo.exe
  2⤵
  PID:620
- C:\Windows\System\wVChhYX.exe
  C:\Windows\System\wVChhYX.exe
  2⤵
  PID:6700
- C:\Windows\System\ntZKxzo.exe
  C:\Windows\System\ntZKxzo.exe
  2⤵
  PID:5260
- C:\Windows\System\QmskQcM.exe
  C:\Windows\System\QmskQcM.exe
  2⤵
  PID:528
- C:\Windows\System\KXJjNJT.exe
  C:\Windows\System\KXJjNJT.exe
  2⤵
  PID:4072
- C:\Windows\System\WFYZicK.exe
  C:\Windows\System\WFYZicK.exe
  2⤵
  PID:1452
- C:\Windows\System\JoAzQVe.exe
  C:\Windows\System\JoAzQVe.exe
  2⤵
  PID:3312
- C:\Windows\System\wcDcdEZ.exe
  C:\Windows\System\wcDcdEZ.exe
  2⤵
  PID:5324
- C:\Windows\System\scFFgmq.exe
  C:\Windows\System\scFFgmq.exe
  2⤵
  PID:5152
- C:\Windows\System\dRpGRaH.exe
  C:\Windows\System\dRpGRaH.exe
  2⤵
  PID:2088
- C:\Windows\System\ueaEkAz.exe
  C:\Windows\System\ueaEkAz.exe
  2⤵
  PID:5304
- C:\Windows\System\XONpcYq.exe
  C:\Windows\System\XONpcYq.exe
  2⤵
  PID:1072
- C:\Windows\System\BOcTxBp.exe
  C:\Windows\System\BOcTxBp.exe
  2⤵
  PID:13336
- C:\Windows\System\qqqkftF.exe
  C:\Windows\System\qqqkftF.exe
  2⤵
  PID:13356
- C:\Windows\System\NbwHIIP.exe
  C:\Windows\System\NbwHIIP.exe
  2⤵
  PID:13376
- C:\Windows\System\FojKqTn.exe
  C:\Windows\System\FojKqTn.exe
  2⤵
  PID:13408
- C:\Windows\System\TLUxTBq.exe
  C:\Windows\System\TLUxTBq.exe
  2⤵
  PID:13448
- C:\Windows\System\hpFlyVa.exe
  C:\Windows\System\hpFlyVa.exe
  2⤵
  PID:13472
- C:\Windows\System\FJOEQLS.exe
  C:\Windows\System\FJOEQLS.exe
  2⤵
  PID:13500
- C:\Windows\System\sJwHVli.exe
  C:\Windows\System\sJwHVli.exe
  2⤵
  PID:13540
- C:\Windows\System\UOluhPt.exe
  C:\Windows\System\UOluhPt.exe
  2⤵
  PID:13664
- C:\Windows\System\BJfPMHw.exe
  C:\Windows\System\BJfPMHw.exe
  2⤵
  PID:13708
- C:\Windows\System\MbkxnBW.exe
  C:\Windows\System\MbkxnBW.exe
  2⤵
  PID:13776
- C:\Windows\System\vFywrGw.exe
  C:\Windows\System\vFywrGw.exe
  2⤵
  PID:13796
- C:\Windows\System\wjwlROx.exe
  C:\Windows\System\wjwlROx.exe
  2⤵
  PID:13812
- C:\Windows\System\EnLMPeW.exe
  C:\Windows\System\EnLMPeW.exe
  2⤵
  PID:13828
- C:\Windows\System\kBAamQf.exe
  C:\Windows\System\kBAamQf.exe
  2⤵
  PID:13844
- C:\Windows\System\yiUjpPc.exe
  C:\Windows\System\yiUjpPc.exe
  2⤵
  PID:13860
- C:\Windows\System\ILJeaeO.exe
  C:\Windows\System\ILJeaeO.exe
  2⤵
  PID:13880
- C:\Windows\System\OztBsSg.exe
  C:\Windows\System\OztBsSg.exe
  2⤵
  PID:13904
- C:\Windows\System\GfgSQvZ.exe
  C:\Windows\System\GfgSQvZ.exe
  2⤵
  PID:14136
- C:\Windows\System\ipdMSgT.exe
  C:\Windows\System\ipdMSgT.exe
  2⤵
  PID:14180
- C:\Windows\System\mFjCCYK.exe
  C:\Windows\System\mFjCCYK.exe
  2⤵
  PID:14208
- C:\Windows\System\cvteoDk.exe
  C:\Windows\System\cvteoDk.exe
  2⤵
  PID:14224
- C:\Windows\System\XfiWSci.exe
  C:\Windows\System\XfiWSci.exe
  2⤵
  PID:14288
- C:\Windows\System\arLUCNC.exe
  C:\Windows\System\arLUCNC.exe
  2⤵
  PID:14312
- C:\Windows\System\KbizPeA.exe
  C:\Windows\System\KbizPeA.exe
  2⤵
  PID:5460
- C:\Windows\System\gKwlizH.exe
  C:\Windows\System\gKwlizH.exe
  2⤵
  PID:1380
- C:\Windows\System\andKYtU.exe
  C:\Windows\System\andKYtU.exe
  2⤵
  PID:4276
- C:\Windows\System\upUtige.exe
  C:\Windows\System\upUtige.exe
  2⤵
  PID:5848
- C:\Windows\System\GvqqxHa.exe
  C:\Windows\System\GvqqxHa.exe
  2⤵
  PID:13372
- C:\Windows\System\xGwjuUD.exe
  C:\Windows\System\xGwjuUD.exe
  2⤵
  PID:5884
- C:\Windows\System\QaRhDhS.exe
  C:\Windows\System\QaRhDhS.exe
  2⤵
  PID:13484
- C:\Windows\System\TOlCfIk.exe
  C:\Windows\System\TOlCfIk.exe
  2⤵
  PID:13532
- C:\Windows\System\nolVjwz.exe
  C:\Windows\System\nolVjwz.exe
  2⤵
  PID:13488
- C:\Windows\System\NTdgvhH.exe
  C:\Windows\System\NTdgvhH.exe
  2⤵
  PID:13396
- C:\Windows\System\QDyebsc.exe
  C:\Windows\System\QDyebsc.exe
  2⤵
  PID:13468
- C:\Windows\System\FVEkZXl.exe
  C:\Windows\System\FVEkZXl.exe
  2⤵
  PID:6128
- C:\Windows\System\wHEpjMO.exe
  C:\Windows\System\wHEpjMO.exe
  2⤵
  PID:13672
- C:\Windows\System\SNcPOyn.exe
  C:\Windows\System\SNcPOyn.exe
  2⤵
  PID:13716
- C:\Windows\System\UGIlKZZ.exe
  C:\Windows\System\UGIlKZZ.exe
  2⤵
  PID:5248
- C:\Windows\System\MsmhZIK.exe
  C:\Windows\System\MsmhZIK.exe
  2⤵
  PID:3664
- C:\Windows\System\zmGrOPc.exe
  C:\Windows\System\zmGrOPc.exe
  2⤵
  PID:13748
- C:\Windows\System\MnviRYu.exe
  C:\Windows\System\MnviRYu.exe
  2⤵
  PID:5232
- C:\Windows\System\exnilvP.exe
  C:\Windows\System\exnilvP.exe
  2⤵
  PID:14072
- C:\Windows\System\kwEonWQ.exe
  C:\Windows\System\kwEonWQ.exe
  2⤵
  PID:6000
- C:\Windows\System\aKTatjr.exe
  C:\Windows\System\aKTatjr.exe
  2⤵
  PID:14032
- C:\Windows\System\LZRzgeN.exe
  C:\Windows\System\LZRzgeN.exe
  2⤵
  PID:3820
- C:\Windows\System\uLZTkpn.exe
  C:\Windows\System\uLZTkpn.exe
  2⤵
  PID:5412
- C:\Windows\System\HYXZMcv.exe
  C:\Windows\System\HYXZMcv.exe
  2⤵
  PID:14148
- C:\Windows\System\wcTKbbM.exe
  C:\Windows\System\wcTKbbM.exe
  2⤵
  PID:5344
- C:\Windows\System\aWKOFjm.exe
  C:\Windows\System\aWKOFjm.exe
  2⤵
  PID:6036
- C:\Windows\System\JVRHVkY.exe
  C:\Windows\System\JVRHVkY.exe
  2⤵
  PID:14188
- C:\Windows\System\NyBheWy.exe
  C:\Windows\System\NyBheWy.exe
  2⤵
  PID:6224
- C:\Windows\System\fWgkfkf.exe
  C:\Windows\System\fWgkfkf.exe
  2⤵
  PID:14276
- C:\Windows\System\ijDkQbW.exe
  C:\Windows\System\ijDkQbW.exe
  2⤵
  PID:14304
- C:\Windows\System\kQWPSoX.exe
  C:\Windows\System\kQWPSoX.exe
  2⤵
  PID:5548
- C:\Windows\System\hRbHbZH.exe
  C:\Windows\System\hRbHbZH.exe
  2⤵
  PID:2224
- C:\Windows\System\ZniEwLT.exe
  C:\Windows\System\ZniEwLT.exe
  2⤵
  PID:5852
- C:\Windows\System\dqIRoqS.exe
  C:\Windows\System\dqIRoqS.exe
  2⤵
  PID:5856
- C:\Windows\System\AtMRfdD.exe
  C:\Windows\System\AtMRfdD.exe
  2⤵
  PID:5680
- C:\Windows\System\TFKkbjj.exe
  C:\Windows\System\TFKkbjj.exe
  2⤵
  PID:6328
- C:\Windows\System\KNIRjBS.exe
  C:\Windows\System\KNIRjBS.exe
  2⤵
  PID:6324
- C:\Windows\System\TqIofUN.exe
  C:\Windows\System\TqIofUN.exe
  2⤵
  PID:5388
- C:\Windows\System\XBgfBOG.exe
  C:\Windows\System\XBgfBOG.exe
  2⤵
  PID:6348
- C:\Windows\System\DcSvPBJ.exe
  C:\Windows\System\DcSvPBJ.exe
  2⤵
  PID:13600
- C:\Windows\System\wZMlWcI.exe
  C:\Windows\System\wZMlWcI.exe
  2⤵
  PID:13580
- C:\Windows\System\MVQzBNF.exe
  C:\Windows\System\MVQzBNF.exe
  2⤵
  PID:6372
- C:\Windows\System\LgLvkHS.exe
  C:\Windows\System\LgLvkHS.exe
  2⤵
  PID:13344
- C:\Windows\System\LQObOsz.exe
  C:\Windows\System\LQObOsz.exe
  2⤵
  PID:6356
- C:\Windows\System\hhFGiXb.exe
  C:\Windows\System\hhFGiXb.exe
  2⤵
  PID:6408
- C:\Windows\System\fXeQGdA.exe
  C:\Windows\System\fXeQGdA.exe
  2⤵
  PID:6588
- C:\Windows\System\XxdpXps.exe
  C:\Windows\System\XxdpXps.exe
  2⤵
  PID:13636
- C:\Windows\System\fZTbQwc.exe
  C:\Windows\System\fZTbQwc.exe
  2⤵
  PID:6440
- C:\Windows\System\AHzJTzf.exe
  C:\Windows\System\AHzJTzf.exe
  2⤵
  PID:13836
- C:\Windows\System\rUQfvZm.exe
  C:\Windows\System\rUQfvZm.exe
  2⤵
  PID:12952
- C:\Windows\System\gfXXeIi.exe
  C:\Windows\System\gfXXeIi.exe
  2⤵
  PID:12204
- C:\Windows\System\PwIGDdY.exe
  C:\Windows\System\PwIGDdY.exe
  2⤵
  PID:14176
- C:\Windows\System\wFXYzjZ.exe
  C:\Windows\System\wFXYzjZ.exe
  2⤵
  PID:14192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jwttqb3w.rkg.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BHeEUVK.exe

Filesize
1.9MB

MD5
4f8d846a1efbfbc30a7fc669c3475759

SHA1
6c4d8d216ddc553fe5444bf68d5b8888b71fc4eb

SHA256
78034dfa7900392c5a0dee78f58139e6c99468c41d0e8bccb8f491e2c088e53a

SHA512
1c34e39dd60ac10efbb3234fd1a9f1250beb3421dc557274a0c15d223fa22237331faaf49cc2df47eac417d66a8e8a3d58820fc382c7fc232712f6e52407dbd7

Download Submit
C:\Windows\System\COBCETt.exe

Filesize
1.9MB

MD5
35005d23b91e174ad8926fe03ca1cbd1

SHA1
a1ecacc7296534278707da5ffbf9bda79233e72c

SHA256
4e338ad158dcf280641d0dc0a69f10bd4c72476d2eec3872b6ece3a85843fd27

SHA512
c6b9ca751aff8f44fa7e07888d1739bf520426c6eaf7a1b5e75a0c0116a5e6c7e14b14072b053a81d31e89b95138ced5b13b0472f4b78553d267949ed8c78d8a

Download Submit
C:\Windows\System\CnaeJGP.exe

Filesize
1.9MB

MD5
5322327c4d812d0e22d3312d8f23d5ee

SHA1
34c4c729276db3d66fb5a980ec61278b54be878b

SHA256
1fab6271e6c4cebf39ed08b9be27706343d3f1d7f3007cb4f81f9f9b98627265

SHA512
e3c6ba91bf3b92dddc6e17495bc284ed1dac173a2f946f0141bf49f5727c02c2214dedbd754c7d52b859255333d913b22788d4cdd21ec0265edf006d8a90814c

Download Submit
C:\Windows\System\HlUPmEY.exe

Filesize
1.9MB

MD5
dad466eab4c9a027a916d0958df4dfa5

SHA1
df7c2b64980f6ca17757a890e1d9c3c4b17f8298

SHA256
886437357bfa6999299061d0a53226945c0d542bf8e58d65067854490bfdff60

SHA512
104da8b6d564822a5dabc216091d748ffd0cb2a85ba2134fa002e04dc2b824bab009d75ea3ce93cd3bc76e7038ae020a6b66caff91f5901e57615e40d55c0f9d

Download Submit
C:\Windows\System\HnkydMk.exe

Filesize
1.9MB

MD5
c213492f0d22a495ba02375f17149cd2

SHA1
8dd88bd5f07306e98e2ffa62e20343f2d368d2ad

SHA256
ea06f9f215ab88526dd13212aaed7c420a8750d1c84432ea376b021049f549e6

SHA512
744a5c1026bf64503c76fd510b0d9c064b3291972ddb3263cc4f84335bb6242c607ea51e7fd9a07a9f76186384b5b9df9086527657cec4c55b233d30bc698fd2

Download Submit
C:\Windows\System\KLBbNho.exe

Filesize
1.9MB

MD5
08b6f7043b7b80d45887f5920aeec98e

SHA1
cdd4b57ac64685e5c32f3b3dcc945ad281a4e6f0

SHA256
8180685bcae30f624a5bf376f755a733b857f96fc409db1d98ceaa4317091996

SHA512
ed31e115b2165fb0b93f7b1cdabbd4c5ef058f601236066972d1bebb3b7c4b0c508c42b14fac49ca2af8d89fc5b572d50373574466f8db3b9127822c03c586b2

Download Submit
C:\Windows\System\KQvDeTa.exe

Filesize
1.9MB

MD5
2ca2299d11e1b78a3ffea77ace543344

SHA1
4ef1eff7ebc463a5c1c8a70df7536eb0c23fc3c9

SHA256
045d12931b38ca290c465215bba4c0fd815804cb94696a72bf0c431679ed04c7

SHA512
5fec1be51f18555cfec5628b78ba1922bf640cddb95e860724ac0ffdc1d90424353ed1c9f6f5c5a4f94c82ff02128c96d26341e898f1f0d8c2008a18ea7f8b00

Download Submit
C:\Windows\System\OnokzHq.exe

Filesize
1.9MB

MD5
c72f994b01b30921d733d8a6092d8540

SHA1
20df25756ef97a6d2426dfb08ffcb9ceb5dd4409

SHA256
6dbb13ea51ec2b1ff1cdac67226ddc519ba12f4bb67f49c28b59794bf598285e

SHA512
13d4eafe7d367e364731a6d2b2f242aa2ce1ded403e93518a458a127099d9b64eaf44a3a0e0aa6f6b6dae0ae5dbb0630c74251632a1feda8889235d770db5378

Download Submit
C:\Windows\System\PJyJNOm.exe

Filesize
1.9MB

MD5
e800f2605d983c29c71c58744767efdb

SHA1
a1f77c140a16946bbd9c67f71703a9f10dde95fc

SHA256
259b5b9b11de91a70bb1a64a3c65468327627f17fabcf684379854535854fbfa

SHA512
e95659fe39c2f3754916e1c2e990157a3dc5827014c4dc52aa7127767101b77931083de7a91d655b2fea0a7937b51a4bf1b6686b9c111e7c666be73c715b9ddb

Download Submit
C:\Windows\System\PrqNcVK.exe

Filesize
1.9MB

MD5
906348b272baeee098de000b46fbdcaf

SHA1
2e469207bd73e96e19589e6d19eb0a0226d48ba1

SHA256
36517c7e2b7433d722788c82aea8bf00332e5215ac842516a3f1ebe9926544c2

SHA512
681274c2c8d761ca6edbb24fc113dfb6de5e5329b2d2744f70da3e269edd26f3f5164d04167ccd9b0f2e55ed5434f557b694a0a838c44484181e8a5157022ef9

Download Submit
C:\Windows\System\QlXvdqH.exe

Filesize
1.9MB

MD5
f0a95f57597798702755a819606f258b

SHA1
95008b4c52e89ed8cf34c73bc405505bad0480e3

SHA256
d0c43cc1374c058602defd058ca22209d1aa540913d99624c6a2481e4b2c21df

SHA512
14ff1ac92b0af47b8f12a0e4b42fd3abef09e95bca0dc93efa1bab09f438eb77462cbe9dedb81180e6de653370dd48fc7f891dd44b99fa8231a404584cbe17e5

Download Submit
C:\Windows\System\QuKWCYZ.exe

Filesize
1.9MB

MD5
d6b86d6f8117889da4e65afc30d5c387

SHA1
8f4d0c07c05e3839faae257b8117bb8fd7eaa654

SHA256
ef5eafa2034a17f8494c7b9fbd19177cd3d575f437a9401428da4d761af715fd

SHA512
f3623ed4ef441e750e7d5e86fb6fb48f28e2d2151cb6252985a635bd1824ec31c0c3831693394f955e05cab7dc55d1777068d1ab32b317fa428c8673cbb4b1c4

Download Submit
C:\Windows\System\VSQKKqv.exe

Filesize
1.9MB

MD5
88754d5aaee9e0cdc3737240bc511a7a

SHA1
37dafadfeb9a7f1d10cbb7deb576385e2025831e

SHA256
109dc1fe9cb5987fa8d9a397d8aae313ed685cb8d62fa9408b5225e23882578d

SHA512
6ab258cfa2b017d4b17771ba38a18e40a4ca7f996f3a4fa81c9a0f679b3bc23b9df8669c0e0d248af5a6e85b9c008eb0ebc6bde5369838577782a6e9ae92d733

Download Submit
C:\Windows\System\WRuVpVK.exe

Filesize
1.9MB

MD5
04114172cb037ded644d4a02c79ed7cf

SHA1
b7271d92728131be82eff6dd571cd777ea1a66b9

SHA256
36370c72fdf820ffc7a77afabdcbad6042adb506eeb3c8f8f57fcf435a5f77c5

SHA512
fe589c9732c304453d7ccab880e615e7afdaede40c6db35085586e569398c9e3bddace88625b6a73a9ff503edd9cae605b7687bb4ee04cba039d881845afe24a

Download Submit
C:\Windows\System\WvmNiyO.exe

Filesize
1.9MB

MD5
83cba4dd361e7004ef01ce15fb0ced47

SHA1
8e591214de8a83b8bdead3384ed38d810c38db39

SHA256
c08be0b1d119c7b64621972841ad074ce68f5ec51dff4e3e7fa22b7e184eb404

SHA512
ca288fd154f00b97f108ddd4fbca4aacafcd618dae527e05d8d6dece77df0bbd94394f651774de5c13e6f40028d3a9f79fce3362d5987e4a29a7c9b928751a11

Download Submit
C:\Windows\System\XBnjbsZ.exe

Filesize
1.9MB

MD5
37d1a1a58cc44e58b351459f42ba200e

SHA1
338daa360bc83ab50834b9cc72549b0d67a8bd17

SHA256
02f1dfa775ff0faf618d495d62e94c2c32faf13df9177ee623e028442739b44d

SHA512
1ed66197d588a21c380325a2deaee56d1559366a1b674a666d0a088c2fe97b5103757113fef3c34d1868dce0aa85233213ba157ff4acfaead447413144675694

Download Submit
C:\Windows\System\XxPwRFI.exe

Filesize
1.9MB

MD5
35f210f554907b0df0e6ad5bafb538cf

SHA1
4fd9e4d79833cb9d88c1802114f9820d6de8ed72

SHA256
bf53da2887c8a90d17611603ef7e2e422ec1d967172f19e487dc29f84bc04d77

SHA512
11fc4d10ce46b154c243048d1c1a6fbb5d89feadadb83b4bfa8cc1701ea638a690f19ba58fb9aeb4c9e729fab7db9d1f257ca6e788124ab25dbd3e718705d4d1

Download Submit
C:\Windows\System\YZoNlYX.exe

Filesize
1.9MB

MD5
bfddc4783a086ab5192790ecabea0452

SHA1
272b3d4ff52080e8436b3ee3e946f43525385874

SHA256
c3391475878559529555c2eb4e169242c7f6224430d8721c2150f59f98dd3bd7

SHA512
7ceecf95612cd0121086c5d6fddd5c2218ead94942bc33cd00269ea3991a553f76ece2ec97678c87f6743822422f714d5a13d4d9f06212023c576021694225dc

Download Submit
C:\Windows\System\aClltrX.exe

Filesize
1.9MB

MD5
d89305b2fc5f7ec1a6ea678aed2fb627

SHA1
00b3d623e3bfee171a35a2058467e3969bce28ca

SHA256
94c4cbc526c6684ec6f52f3c5dfd02c5afce52b364a107093cdd86b8aeb2d0e2

SHA512
7ae733aab1d62f8ebcd6bdbceb00acd969c00fa210924b39898bcdc4473678af14987b479130b61273f67a867cb755fd0c4ab4f82ec76c52d1a789a17a660ca4

Download Submit
C:\Windows\System\aVyDufh.exe

Filesize
1.9MB

MD5
4bfeba13553d6bff6b9924e35937ea55

SHA1
c4a95369ba64f178bd9554024f23ee457bfaec0d

SHA256
c998b12a8d384637b4f50340a3e86be1ff3ef810fe4703043d1370bb020a3bda

SHA512
95704e03f923c57c706cd1127c67b1066005a0ddee90a98df066a31b571bac05144b9f8c9f3837f5a5de8a0ce3187b4872729119337b4e7bbf4842450640d5e6

Download Submit
C:\Windows\System\bAencSX.exe

Filesize
1.9MB

MD5
fb39218ead7e645341d39dfab4f2ee5c

SHA1
48c8e9a9544b525adb509ff7515d13f3197a76af

SHA256
6e819c5e0d45f1a07fdae2132320a0488d709fce089d8bd42e6acf88b4be69f2

SHA512
11fd222b5f32df849e3eaba84d54a3997892b1b5118af76b2163333e1371811f032bc2e3200c62560e08113625903a1dc1b7273556ca1c6571145f62415bf5a0

Download Submit
C:\Windows\System\brhZkHH.exe

Filesize
1.9MB

MD5
b831f042c817aed7fd18e6eb1b7249d4

SHA1
74689d9ecadbb36686853b9d33243a1ece5225fa

SHA256
53ee46311aff074d1e93def833dcd3f3d68ec6bc1107abca2ec3fff0293cde7a

SHA512
2bee01be3222bd87d967e6e4f76650cc439af3b7af21c1686d4cd9baa5ba9e2ac9653210be4ef0b7b6fe08704b25cc0e963bfd7ce9d6f5b9d52df78d36cb2789

Download Submit
C:\Windows\System\cffQYph.exe

Filesize
1.9MB

MD5
8fea08c83f8bfc364f348f7bf1d1954c

SHA1
55ca353070f3c3970cdf3a1642ed4d24075e6671

SHA256
caf453301b802fe007617eb194967aa1fdd930cd939c164fadb3fea2a0542872

SHA512
4f595fda7737c80ccf0ee6d77212764d0bb28058057a6d3460a9fe3eb22ea66d9a3344aeff682308962fb60721f204546b5058f0c1ea9f95777b882b540c7a70

Download Submit
C:\Windows\System\gusQYVC.exe

Filesize
1.9MB

MD5
db765afe3b70a0302a0443d641b64547

SHA1
30d1157f0bdb9fb7e25fd13b9dfb1b8871085ef3

SHA256
ec0a9933db63bec772d754c4b97e8e915910451df81d9790ad55a9e3b0dacdc0

SHA512
ee758bd95683f5eb520f9dc2cae1a98a9df5858d5094201cc5db394fa1432a50600d84649d42b28006ed3f583f22e416325a0881fb11bb133906dc1864c6dd81

Download Submit
C:\Windows\System\hpBGNpf.exe

Filesize
1.9MB

MD5
2650b455fda8f1c033551ef9e2d2f5ad

SHA1
e346adeb48f7d2ad9c2e2c6a00ba6306e06b51b8

SHA256
cd14061d7786aaca2c18aaeb31959dfbf85611978585cfd0d814d9429955c8e2

SHA512
a3da3b9b11f781c2193fa2cd9844e0c58a19fdd0289453ef1cb8bdf1da1f9ee894833ef2ba3add6648e3b419ffb9f49373fd93d6224a69688f22645ccf33b9bf

Download Submit
C:\Windows\System\iBXFSIO.exe

Filesize
1.9MB

MD5
a6a578ea71c779738d2a4514d4738502

SHA1
7b1d2b6deb5070d99d3d578ab8f5a4aa5ac25bec

SHA256
1cf11f41fc05090a8bee133447e8460b0a196f6a6a3e21ad6b9e50c160025784

SHA512
be4911d46306ae5d3864078c407ea5ff6b4fe4d3bd87815ac0305a971e2b86212567eca96935200275cdc642fbf7cd0f29e9dbd8b165712f69c3d1d940124874

Download Submit
C:\Windows\System\iIgWCXe.exe

Filesize
1.9MB

MD5
941711444ed847ef534a3ca22fa1f4d0

SHA1
4578255ed37c00cef296ea0747d686e43adeedc9

SHA256
bef0d23e204ea5de82aa27ff9ee10a84e63252516e95c4306ed4c57a5da3a8ba

SHA512
37dbba4baca9de230cf0f4bc36272ec59b476354bb8677cea7f544680260c90aafb755c0fd630bc322f415a1f9acb8540aae4b98038536946c16998b475bca42

Download Submit
C:\Windows\System\ibsMzVp.exe

Filesize
8B

MD5
9e16362b7eef9ff59cf4576b688fec20

SHA1
58714a79316bdda8b345ca47c2a7e8087e024871

SHA256
cb157cd47cb9ddacb8fa194262e9cc1364ca68490d93ad041938e77ef90ead7c

SHA512
53056e2e9a952538e1c61538c2bad2166adaf2d4a03d0e97e211329cd7f80967988343aa21690b08c2f1ad6d3fabfdc6095392f57b127d575de79d724d1a09de

Download Submit
C:\Windows\System\msIOgcd.exe

Filesize
1.9MB

MD5
72b666b005e7213c9fbc641b638c66d1

SHA1
71a6744af10a9ec19ec92ab52e184966c9af25f4

SHA256
34063ee2cbb6dc5cc207acda8b973ca5d03504c9842b79defeefd1d14fa82e56

SHA512
e8772acb1644bca1e2403bb1d5e24c655ed871285e1339d18b38413d7d20ea6db9565bb9b9c856c2c03745b1a9396a4039f37618fcc0c60b9025a23ef1758407

Download Submit
C:\Windows\System\nSRthey.exe

Filesize
1.9MB

MD5
31fbd71a771a0c848770500c0c4b59b9

SHA1
eb4fb31a32d9a7a8fb12621b5184535bdaff288c

SHA256
a826b7dbe06fda8637edbcd919bab15844c7dab61a091906f31dce4a52b19a92

SHA512
264edbd8ae1f0a46746c984fbfacec92b8c869fdb6dfc672bf0a12910b1661cc2a24cf27ad8f71e24b48256e3dd4b9b99a3b9fd8a9f21e8f2d388724530b9d49

Download Submit
C:\Windows\System\ntbXIjx.exe

Filesize
1.9MB

MD5
929d01985fc1a7b4e7813e89c9f67892

SHA1
b40158e7bbba0c136e78463a211bf2c6ac6fa0cc

SHA256
7ff62937e708566770a452bb7a93475b132f035d7ae3f8bc907fe87efc90aff5

SHA512
28b559f0594e44d59711cf10196806690be10d1cd2acda817bd140689936a0ad6b4ed8b0458f326d52e07085dea760f4479a86205ef84a30ea762f154e809a25

Download Submit
C:\Windows\System\qFACTCS.exe

Filesize
1.9MB

MD5
58ed25a779fb95fa8a9944f8bd8831e0

SHA1
42a2b365072be7e8d8359529e381544510f89e2d

SHA256
276fa970e641b8b95732d27ad5a7a60adfa8db1df98331ed6f55b02a2d670c3f

SHA512
0d44d9884491cbd6b751fce8896d3bd15020d51c39d011b7c68a17e6d4e45ad65fe969d84e8352830aeebb41ec6c93a71f9a9ef2c30ee8b2bf860b341fd145d5

Download Submit
C:\Windows\System\sYzAdqu.exe

Filesize
1.9MB

MD5
2a12144993d2261004a23500ed24d58a

SHA1
f4e03ae62b62b0bf2d079df10213a9741cdcf8c5

SHA256
86ae24fe3d89a88411c5e84989b8788ef07a5a5bcc21fd4fa6ad3fd741361fa4

SHA512
71e43bdb2b3b3385e8a59c7435b476b9e834f10e19233a6aba9a1e4afcd23e0660db41b01bd0f9b96797bfdc8739d99b0e09456cc7ed42bc5e0dbd90adb3caef

Download Submit
C:\Windows\System\suUqOyN.exe

Filesize
1.9MB

MD5
0cb1e3f1e9b6dbaaf476534eb7118ac3

SHA1
2994f31c27f5f464867e775c06e2b3510df63376

SHA256
cf87f13f97f475bd58f9d5e346d91ee35e50028128c582a9e373c20e5daa4e8f

SHA512
95d03f85776276cbb74a3ce1740595eac261a56688a47012c0329fe44dbbccc152eb9168d8342336e6c916cdff9452f265349c08eabed3c773aa10f7ce097765

Download Submit
C:\Windows\System\tSvDVgW.exe

Filesize
1.9MB

MD5
a85182ee2e788e0dc4d9ca139358084a

SHA1
a6c47ae39bdbd10871ae86a7692ce0c3e4330d13

SHA256
b955a599a95ca46eb59f4441d07ad5ee895ad10e1d0beccdcb7731b70e2057a9

SHA512
bec23def47f8bf4d4905334d68b4a78771ee24da6782442292c3edcbe42509b434fad9ccb23bcfeba265b5d75b53ef693fa825fa0c78c1bb5a4fcdac4ab81881

Download Submit
C:\Windows\System\uwnnBoH.exe

Filesize
1.9MB

MD5
261d610743e6b4c319c446f2f057b539

SHA1
fe752c111d56348894ac7f8b8621372f1e0de0b8

SHA256
1a322badb524ba80726ade9f154be4c4fd4ab33f28c9d3cf437c84cee36c5e67

SHA512
3594e46d00bf0968178e6d1ef783a39a6811e94385c7f11b7ff9faabcaad2df602c039babc17da704d48ca1b654d5cd1adb6fc7c9f5b2514befffb08a7ff6b1f

Download Submit
C:\Windows\System\xJFARli.exe

Filesize
1.9MB

MD5
38b83f702788c5b981b8a84cb33e424f

SHA1
fad3e1c9634211ffdb36612f340b3f8bc811cf05

SHA256
4b8e100de46c1c6f478deba36c1e2d7081a7d4cb78b1ae12576f4b828f316ee7

SHA512
d8749beef34b9824b45f194f718877fa748c9e36cfb6d9df7f998401e0477f1bdc59fc7789d9a8038f609a3d98d86a1e7236990166ddff12ef2334f73868889f

Download Submit
C:\Windows\System\xlkNpRn.exe

Filesize
1.9MB

MD5
81260c02d394c23294f21c20199e33c0

SHA1
846d6645c6c53f75829d97f8beffae5baf8d088a

SHA256
88ae80d8bb7039cbb2f6ca976af5f867822fc328acff92487310d257c84386b2

SHA512
c0a330cc8b2254ed0ba75c2d6101d50341bf0a07cd74ec24e4affc75fe3dd8ade8559702df8e3c3707568d8084da28f03c7c61a645f21784d468ef8428c1c65f

Download Submit
C:\Windows\System\zaknwXx.exe

Filesize
1.9MB

MD5
4aac20966aca783bfe72f25c1571b8cc

SHA1
417e6bd31289cd800f352d8172916b84a34829c3

SHA256
e8b0e1ad4e65fce470855f66c67cc98190bcf262d9122d5c6b895c4d5286144e

SHA512
ffd02238deb63ae83e273fc009a518171d3f2b286d956ffa199e918cffcaa681a29d9e61ed3b6593e22d984e5054ac49325f8b314e10c0cbd51e70cf7d6a9ab5

Download Submit
memory/408-286-0x00007FF7929D0000-0x00007FF792DC2000-memory.dmp

Filesize
3.9MB

Download
memory/408-4844-0x00007FF7929D0000-0x00007FF792DC2000-memory.dmp

Filesize
3.9MB

Download
memory/632-0-0x00007FF7A9E80000-0x00007FF7AA272000-memory.dmp

Filesize
3.9MB

Download
memory/632-1-0x000001B1A7FE0000-0x000001B1A7FF0000-memory.dmp

Filesize
64KB

Download
memory/980-4786-0x00007FF6630B0000-0x00007FF6634A2000-memory.dmp

Filesize
3.9MB

Download
memory/980-221-0x00007FF6630B0000-0x00007FF6634A2000-memory.dmp

Filesize
3.9MB

Download
memory/1328-4674-0x00007FF612F50000-0x00007FF613342000-memory.dmp

Filesize
3.9MB

Download
memory/1328-4739-0x00007FF612F50000-0x00007FF613342000-memory.dmp

Filesize
3.9MB

Download
memory/1328-55-0x00007FF612F50000-0x00007FF613342000-memory.dmp

Filesize
3.9MB

Download
memory/1464-242-0x00007FF74E690000-0x00007FF74EA82000-memory.dmp

Filesize
3.9MB

Download
memory/1464-4807-0x00007FF74E690000-0x00007FF74EA82000-memory.dmp

Filesize
3.9MB

Download
memory/1516-4680-0x00007FF756B30000-0x00007FF756F22000-memory.dmp

Filesize
3.9MB

Download
memory/1516-4752-0x00007FF756B30000-0x00007FF756F22000-memory.dmp

Filesize
3.9MB

Download
memory/1516-90-0x00007FF756B30000-0x00007FF756F22000-memory.dmp

Filesize
3.9MB

Download
memory/1952-36-0x00007FF7174B0000-0x00007FF7178A2000-memory.dmp

Filesize
3.9MB

Download
memory/1980-263-0x00007FF7ADE80000-0x00007FF7AE272000-memory.dmp

Filesize
3.9MB

Download
memory/1980-4794-0x00007FF7ADE80000-0x00007FF7AE272000-memory.dmp

Filesize
3.9MB

Download
memory/2104-4813-0x00007FF6209F0000-0x00007FF620DE2000-memory.dmp

Filesize
3.9MB

Download
memory/2104-340-0x00007FF6209F0000-0x00007FF620DE2000-memory.dmp

Filesize
3.9MB

Download
memory/2156-4766-0x00007FF737570000-0x00007FF737962000-memory.dmp

Filesize
3.9MB

Download
memory/2156-220-0x00007FF737570000-0x00007FF737962000-memory.dmp

Filesize
3.9MB

Download
memory/2464-18-0x00007FF67BFC0000-0x00007FF67C3B2000-memory.dmp

Filesize
3.9MB

Download
memory/3016-4817-0x00007FF6174B0000-0x00007FF6178A2000-memory.dmp

Filesize
3.9MB

Download
memory/3016-358-0x00007FF6174B0000-0x00007FF6178A2000-memory.dmp

Filesize
3.9MB

Download
memory/3152-4791-0x00007FF6F78B0000-0x00007FF6F7CA2000-memory.dmp

Filesize
3.9MB

Download
memory/3152-285-0x00007FF6F78B0000-0x00007FF6F7CA2000-memory.dmp

Filesize
3.9MB

Download
memory/3224-362-0x00007FF6D09D0000-0x00007FF6D0DC2000-memory.dmp

Filesize
3.9MB

Download
memory/3912-201-0x00007FF637410000-0x00007FF637802000-memory.dmp

Filesize
3.9MB

Download
memory/3912-4805-0x00007FF637410000-0x00007FF637802000-memory.dmp

Filesize
3.9MB

Download
memory/3944-366-0x00007FF7F5A10000-0x00007FF7F5E02000-memory.dmp

Filesize
3.9MB

Download
memory/3944-4819-0x00007FF7F5A10000-0x00007FF7F5E02000-memory.dmp

Filesize
3.9MB

Download
memory/4248-4831-0x00007FF79B830000-0x00007FF79BC22000-memory.dmp

Filesize
3.9MB

Download
memory/4248-296-0x00007FF79B830000-0x00007FF79BC22000-memory.dmp

Filesize
3.9MB

Download
memory/4612-180-0x00007FF75D2B0000-0x00007FF75D6A2000-memory.dmp

Filesize
3.9MB

Download
memory/4612-4779-0x00007FF75D2B0000-0x00007FF75D6A2000-memory.dmp

Filesize
3.9MB

Download
memory/4636-363-0x00007FF60FF70000-0x00007FF610362000-memory.dmp

Filesize
3.9MB

Download
memory/4636-4705-0x00007FF60FF70000-0x00007FF610362000-memory.dmp

Filesize
3.9MB

Download
memory/4812-365-0x00007FF7C2C20000-0x00007FF7C3012000-memory.dmp

Filesize
3.9MB

Download
memory/4812-4778-0x00007FF7C2C20000-0x00007FF7C3012000-memory.dmp

Filesize
3.9MB

Download
memory/4836-4725-0x00007FF7E63A0000-0x00007FF7E6792000-memory.dmp

Filesize
3.9MB

Download
memory/4836-139-0x00007FF7E63A0000-0x00007FF7E6792000-memory.dmp

Filesize
3.9MB

Download
memory/4856-108-0x00007FF71B4F0000-0x00007FF71B8E2000-memory.dmp

Filesize
3.9MB

Download
memory/4984-4828-0x00007FF676AD0000-0x00007FF676EC2000-memory.dmp

Filesize
3.9MB

Download
memory/4984-361-0x00007FF676AD0000-0x00007FF676EC2000-memory.dmp

Filesize
3.9MB

Download
memory/4988-110-0x00007FF645350000-0x00007FF645742000-memory.dmp

Filesize
3.9MB

Download
memory/5072-4729-0x00007FF699320000-0x00007FF699712000-memory.dmp

Filesize
3.9MB

Download
memory/5072-364-0x00007FF699320000-0x00007FF699712000-memory.dmp

Filesize
3.9MB

Download
memory/5088-396-0x00000245EB3F0000-0x00000245EB412000-memory.dmp

Filesize
136KB

Download