xmrig | eca920ef11cbff283d9ff07d3b32fa7e3a74209ec2f1548507077cfa5e08ead7

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 00:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
Size

1.9MB
MD5

0660ccd741e6feb6514a1c8e10144b4c
SHA1

783c062622466acbb379cb3bb0280a59fa4b7f77
SHA256

eca920ef11cbff283d9ff07d3b32fa7e3a74209ec2f1548507077cfa5e08ead7
SHA512

46025317fbf9ff9476e868313f465ef68a631423fedd039bfcfe5022570ae410a8dcc9df412f56243782712ab1d406dfb38cfc1e31c1919dc0acddb676919ee4
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+Uh:NABy

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 41 IoCs

miner

resource	yara_rule
behavioral2/memory/4852-16-0x00007FF664F40000-0x00007FF665332000-memory.dmp	xmrig
behavioral2/memory/3860-460-0x00007FF77D260000-0x00007FF77D652000-memory.dmp	xmrig
behavioral2/memory/2016-539-0x00007FF6D19F0000-0x00007FF6D1DE2000-memory.dmp	xmrig
behavioral2/memory/5052-543-0x00007FF657310000-0x00007FF657702000-memory.dmp	xmrig
behavioral2/memory/2924-546-0x00007FF6606F0000-0x00007FF660AE2000-memory.dmp	xmrig
behavioral2/memory/4444-548-0x00007FF680390000-0x00007FF680782000-memory.dmp	xmrig
behavioral2/memory/3140-547-0x00007FF6F5E30000-0x00007FF6F6222000-memory.dmp	xmrig
behavioral2/memory/400-545-0x00007FF79C750000-0x00007FF79CB42000-memory.dmp	xmrig
behavioral2/memory/2068-544-0x00007FF63CBC0000-0x00007FF63CFB2000-memory.dmp	xmrig
behavioral2/memory/2080-542-0x00007FF7BA590000-0x00007FF7BA982000-memory.dmp	xmrig
behavioral2/memory/352-541-0x00007FF6630A0000-0x00007FF663492000-memory.dmp	xmrig
behavioral2/memory/4940-540-0x00007FF64C2A0000-0x00007FF64C692000-memory.dmp	xmrig
behavioral2/memory/4088-527-0x00007FF75BFC0000-0x00007FF75C3B2000-memory.dmp	xmrig
behavioral2/memory/1940-400-0x00007FF633A60000-0x00007FF633E52000-memory.dmp	xmrig
behavioral2/memory/3600-399-0x00007FF6607B0000-0x00007FF660BA2000-memory.dmp	xmrig
behavioral2/memory/912-330-0x00007FF6E4380000-0x00007FF6E4772000-memory.dmp	xmrig
behavioral2/memory/4740-302-0x00007FF766930000-0x00007FF766D22000-memory.dmp	xmrig
behavioral2/memory/4172-267-0x00007FF637140000-0x00007FF637532000-memory.dmp	xmrig
behavioral2/memory/2828-253-0x00007FF76BE80000-0x00007FF76C272000-memory.dmp	xmrig
behavioral2/memory/4856-201-0x00007FF709140000-0x00007FF709532000-memory.dmp	xmrig
behavioral2/memory/4852-3082-0x00007FF664F40000-0x00007FF665332000-memory.dmp	xmrig
behavioral2/memory/3140-3084-0x00007FF6F5E30000-0x00007FF6F6222000-memory.dmp	xmrig
behavioral2/memory/4172-3086-0x00007FF637140000-0x00007FF637532000-memory.dmp	xmrig
behavioral2/memory/3756-3088-0x00007FF736600000-0x00007FF7369F2000-memory.dmp	xmrig
behavioral2/memory/4740-3090-0x00007FF766930000-0x00007FF766D22000-memory.dmp	xmrig
behavioral2/memory/1940-3094-0x00007FF633A60000-0x00007FF633E52000-memory.dmp	xmrig
behavioral2/memory/2016-3098-0x00007FF6D19F0000-0x00007FF6D1DE2000-memory.dmp	xmrig
behavioral2/memory/4088-3103-0x00007FF75BFC0000-0x00007FF75C3B2000-memory.dmp	xmrig
behavioral2/memory/2828-3102-0x00007FF76BE80000-0x00007FF76C272000-memory.dmp	xmrig
behavioral2/memory/3860-3105-0x00007FF77D260000-0x00007FF77D652000-memory.dmp	xmrig
behavioral2/memory/912-3099-0x00007FF6E4380000-0x00007FF6E4772000-memory.dmp	xmrig
behavioral2/memory/4856-3096-0x00007FF709140000-0x00007FF709532000-memory.dmp	xmrig
behavioral2/memory/4444-3114-0x00007FF680390000-0x00007FF680782000-memory.dmp	xmrig
behavioral2/memory/3600-3113-0x00007FF6607B0000-0x00007FF660BA2000-memory.dmp	xmrig
behavioral2/memory/400-3112-0x00007FF79C750000-0x00007FF79CB42000-memory.dmp	xmrig
behavioral2/memory/352-3111-0x00007FF6630A0000-0x00007FF663492000-memory.dmp	xmrig
behavioral2/memory/5052-3125-0x00007FF657310000-0x00007FF657702000-memory.dmp	xmrig
behavioral2/memory/2080-3132-0x00007FF7BA590000-0x00007FF7BA982000-memory.dmp	xmrig
behavioral2/memory/2924-3136-0x00007FF6606F0000-0x00007FF660AE2000-memory.dmp	xmrig
behavioral2/memory/2068-3120-0x00007FF63CBC0000-0x00007FF63CFB2000-memory.dmp	xmrig
behavioral2/memory/4940-3119-0x00007FF64C2A0000-0x00007FF64C692000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4852	YFbWzQv.exe
3756	tyJTdkg.exe
3140	yxoraQG.exe
4856	uEvoSsc.exe
2828	CpIvuyT.exe
4172	rwlrUIb.exe
4740	ryQyQRl.exe
4444	IUPogfN.exe
912	qoFGWMX.exe
3600	WQevWNj.exe
1940	iSXKOOo.exe
3860	ITIYmDi.exe
4088	WUoRwje.exe
2016	Snsyead.exe
4940	rqriwwM.exe
352	sXAzzbm.exe
2080	qvGqilo.exe
5052	JMItaFe.exe
2068	pxjZAXe.exe
400	yJEustk.exe
2924	JQlUWgo.exe
1508	eGPADwA.exe
1944	MPBfFqJ.exe
868	mpgbzna.exe
1408	PURTjYI.exe
4460	FVReNWR.exe
3256	kcdfeAd.exe
5088	gZYqAeb.exe
816	ivuIzKf.exe
3224	ZbYBbbk.exe
5040	MTauBwo.exe
4564	NhjtQGd.exe
3664	kfJTBoG.exe
1316	hHxdcwf.exe
2052	BBxQZfA.exe
2176	smsyqqW.exe
1780	QhbGWCm.exe
3204	fiIpVDZ.exe
2524	RhptFmc.exe
424	BykFUCN.exe
3540	jQIFgro.exe
3468	joRrvHr.exe
1672	VDwaBEV.exe
1484	apiDoWk.exe
3524	MTFGplB.exe
3148	RmRWGFm.exe
3532	dIMcCeF.exe
4340	ISHTrJb.exe
652	AqLYZGU.exe
2404	yccIrsU.exe
5056	bIeCjFZ.exe
1604	VMcEGUH.exe
3164	TWGCLMx.exe
4356	WdZRiwS.exe
2952	yotZikH.exe
896	eNyihTI.exe
1344	EPoJxcl.exe
1556	xLbBEml.exe
1336	YwlZakv.exe
1548	RXyBjJf.exe
1660	dapTMzO.exe
4572	rpjfBFc.exe
3044	mPAduQG.exe
4300	JqRlrPq.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3512-0-0x00007FF7B9F00000-0x00007FF7BA2F2000-memory.dmp	upx
behavioral2/files/0x000a000000023b89-7.dat	upx
behavioral2/memory/4852-16-0x00007FF664F40000-0x00007FF665332000-memory.dmp	upx
behavioral2/files/0x000a000000023b88-11.dat	upx
behavioral2/files/0x000c000000023b80-8.dat	upx
behavioral2/files/0x000a000000023b90-62.dat	upx
behavioral2/files/0x000a000000023b9a-82.dat	upx
behavioral2/files/0x000a000000023ba0-112.dat	upx
behavioral2/files/0x000a000000023b9b-207.dat	upx
behavioral2/memory/3860-460-0x00007FF77D260000-0x00007FF77D652000-memory.dmp	upx
behavioral2/memory/2016-539-0x00007FF6D19F0000-0x00007FF6D1DE2000-memory.dmp	upx
behavioral2/memory/5052-543-0x00007FF657310000-0x00007FF657702000-memory.dmp	upx
behavioral2/memory/2924-546-0x00007FF6606F0000-0x00007FF660AE2000-memory.dmp	upx
behavioral2/memory/4444-548-0x00007FF680390000-0x00007FF680782000-memory.dmp	upx
behavioral2/memory/3140-547-0x00007FF6F5E30000-0x00007FF6F6222000-memory.dmp	upx
behavioral2/memory/400-545-0x00007FF79C750000-0x00007FF79CB42000-memory.dmp	upx
behavioral2/memory/2068-544-0x00007FF63CBC0000-0x00007FF63CFB2000-memory.dmp	upx
behavioral2/memory/2080-542-0x00007FF7BA590000-0x00007FF7BA982000-memory.dmp	upx
behavioral2/memory/352-541-0x00007FF6630A0000-0x00007FF663492000-memory.dmp	upx
behavioral2/memory/4940-540-0x00007FF64C2A0000-0x00007FF64C692000-memory.dmp	upx
behavioral2/memory/4088-527-0x00007FF75BFC0000-0x00007FF75C3B2000-memory.dmp	upx
behavioral2/memory/1940-400-0x00007FF633A60000-0x00007FF633E52000-memory.dmp	upx
behavioral2/memory/3600-399-0x00007FF6607B0000-0x00007FF660BA2000-memory.dmp	upx
behavioral2/memory/912-330-0x00007FF6E4380000-0x00007FF6E4772000-memory.dmp	upx
behavioral2/memory/4740-302-0x00007FF766930000-0x00007FF766D22000-memory.dmp	upx
behavioral2/memory/4172-267-0x00007FF637140000-0x00007FF637532000-memory.dmp	upx
behavioral2/memory/2828-253-0x00007FF76BE80000-0x00007FF76C272000-memory.dmp	upx
behavioral2/files/0x000a000000023bb1-206.dat	upx
behavioral2/files/0x000a000000023bb0-203.dat	upx
behavioral2/files/0x000a000000023baf-202.dat	upx
behavioral2/memory/4856-201-0x00007FF709140000-0x00007FF709532000-memory.dmp	upx
behavioral2/files/0x000a000000023bad-196.dat	upx
behavioral2/files/0x000a000000023bab-188.dat	upx
behavioral2/files/0x000a000000023bac-187.dat	upx
behavioral2/files/0x000a000000023baa-183.dat	upx
behavioral2/files/0x000a000000023ba7-170.dat	upx
behavioral2/files/0x000a000000023b97-161.dat	upx
behavioral2/files/0x000a000000023ba6-160.dat	upx
behavioral2/files/0x000a000000023ba5-148.dat	upx
behavioral2/files/0x000a000000023b94-141.dat	upx
behavioral2/files/0x000a000000023b8e-138.dat	upx
behavioral2/files/0x000a000000023bae-197.dat	upx
behavioral2/files/0x000a000000023ba4-132.dat	upx
behavioral2/files/0x000a000000023ba3-131.dat	upx
behavioral2/files/0x000a000000023ba2-130.dat	upx
behavioral2/files/0x000a000000023b91-192.dat	upx
behavioral2/files/0x000a000000023ba9-180.dat	upx
behavioral2/files/0x000a000000023b9f-111.dat	upx
behavioral2/files/0x000a000000023b99-171.dat	upx
behavioral2/files/0x000a000000023b9e-106.dat	upx
behavioral2/files/0x000a000000023b8c-103.dat	upx
behavioral2/files/0x000a000000023b9d-102.dat	upx
behavioral2/files/0x000a000000023b96-152.dat	upx
behavioral2/files/0x000a000000023b9c-101.dat	upx
behavioral2/files/0x000a000000023b93-91.dat	upx
behavioral2/files/0x000a000000023ba1-129.dat	upx
behavioral2/files/0x000a000000023b92-122.dat	upx
behavioral2/files/0x000a000000023b8d-85.dat	upx
behavioral2/files/0x000a000000023b8f-108.dat	upx
behavioral2/files/0x000a000000023b98-78.dat	upx
behavioral2/files/0x000a000000023b95-73.dat	upx
behavioral2/memory/3756-54-0x00007FF736600000-0x00007FF7369F2000-memory.dmp	upx
behavioral2/files/0x000a000000023b8b-51.dat	upx
behavioral2/files/0x000a000000023b8a-42.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\noHNxpP.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\nDwNjSs.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\ouaDeOH.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\znjihGz.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\jbkVZJo.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\JQzYlaW.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\smVsUfJ.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\SEyUppO.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\YhWwQuf.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\NoKPDnD.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\kcdfeAd.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\NsbORbC.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\oqNooPq.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\tlHFjNs.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\hSjJviJ.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\rtOwbct.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\VdNcTWI.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\gEHokvX.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\jbfZNQa.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\WHSSmZx.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\IUPogfN.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\smsyqqW.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\uLrqFiA.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\DebTLxA.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\QuRmcBw.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\KIwcBoH.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\iRguScZ.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\vDHRpVa.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\cPkjtIM.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\tQQKQSb.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\pihKBgI.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\icnlRlC.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\vPjQVYR.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\LHbyiOQ.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\UTZyXEp.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\ObBQbbS.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\imNIsAJ.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\uKECFZQ.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\lAQEVvR.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\hSmdujY.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\UqoZNVg.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\hncmclz.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\HTDGblp.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\PSQlhcd.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\riHYFyM.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\TCzKvHA.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\UAuXEvd.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\iqALLXS.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\ITIYmDi.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\syvaCYo.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\TuCcMQS.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\HNMRbqm.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\LakXnxs.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\uNcOIkw.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\BBxQZfA.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\PKHgDwF.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\elokfmD.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\lFXfgnX.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\RhptFmc.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\KQvHtLY.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\AtqZTBH.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\crwKMgl.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\qSkctYq.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
File created	C:\Windows\System\EbtJuFl.exe	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3028	powershell.exe
3028	powershell.exe
3028	powershell.exe
3028	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3028	powershell.exe
Token: SeLockMemoryPrivilege	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3512 wrote to memory of 3028	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	85
PID 3512 wrote to memory of 3028	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	85
PID 3512 wrote to memory of 4852	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	86
PID 3512 wrote to memory of 4852	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	86
PID 3512 wrote to memory of 3756	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	87
PID 3512 wrote to memory of 3756	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	87
PID 3512 wrote to memory of 3140	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	88
PID 3512 wrote to memory of 3140	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	88
PID 3512 wrote to memory of 4172	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	89
PID 3512 wrote to memory of 4172	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	89
PID 3512 wrote to memory of 4740	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	90
PID 3512 wrote to memory of 4740	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	90
PID 3512 wrote to memory of 4444	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	91
PID 3512 wrote to memory of 4444	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	91
PID 3512 wrote to memory of 4856	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	92
PID 3512 wrote to memory of 4856	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	92
PID 3512 wrote to memory of 2828	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	93
PID 3512 wrote to memory of 2828	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	93
PID 3512 wrote to memory of 912	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	94
PID 3512 wrote to memory of 912	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	94
PID 3512 wrote to memory of 3600	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	95
PID 3512 wrote to memory of 3600	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	95
PID 3512 wrote to memory of 400	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	96
PID 3512 wrote to memory of 400	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	96
PID 3512 wrote to memory of 1940	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	97
PID 3512 wrote to memory of 1940	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	97
PID 3512 wrote to memory of 3860	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	98
PID 3512 wrote to memory of 3860	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	98
PID 3512 wrote to memory of 4088	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	99
PID 3512 wrote to memory of 4088	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	99
PID 3512 wrote to memory of 2016	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	100
PID 3512 wrote to memory of 2016	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	100
PID 3512 wrote to memory of 4940	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	101
PID 3512 wrote to memory of 4940	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	101
PID 3512 wrote to memory of 352	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	102
PID 3512 wrote to memory of 352	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	102
PID 3512 wrote to memory of 2080	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	103
PID 3512 wrote to memory of 2080	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	103
PID 3512 wrote to memory of 5052	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	104
PID 3512 wrote to memory of 5052	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	104
PID 3512 wrote to memory of 2068	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	105
PID 3512 wrote to memory of 2068	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	105
PID 3512 wrote to memory of 2924	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	106
PID 3512 wrote to memory of 2924	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	106
PID 3512 wrote to memory of 1508	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	107
PID 3512 wrote to memory of 1508	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	107
PID 3512 wrote to memory of 1944	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	108
PID 3512 wrote to memory of 1944	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	108
PID 3512 wrote to memory of 868	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	109
PID 3512 wrote to memory of 868	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	109
PID 3512 wrote to memory of 1408	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	110
PID 3512 wrote to memory of 1408	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	110
PID 3512 wrote to memory of 4460	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	111
PID 3512 wrote to memory of 4460	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	111
PID 3512 wrote to memory of 3256	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	112
PID 3512 wrote to memory of 3256	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	112
PID 3512 wrote to memory of 5088	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	113
PID 3512 wrote to memory of 5088	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	113
PID 3512 wrote to memory of 816	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	114
PID 3512 wrote to memory of 816	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	114
PID 3512 wrote to memory of 3224	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	115
PID 3512 wrote to memory of 3224	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	115
PID 3512 wrote to memory of 5040	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	116
PID 3512 wrote to memory of 5040	3512	0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0660ccd741e6feb6514a1c8e10144b4c_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3028
- C:\Windows\System\YFbWzQv.exe
  C:\Windows\System\YFbWzQv.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\tyJTdkg.exe
  C:\Windows\System\tyJTdkg.exe
  2⤵
  - Executes dropped EXE
  PID:3756
- C:\Windows\System\yxoraQG.exe
  C:\Windows\System\yxoraQG.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\rwlrUIb.exe
  C:\Windows\System\rwlrUIb.exe
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Windows\System\ryQyQRl.exe
  C:\Windows\System\ryQyQRl.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\IUPogfN.exe
  C:\Windows\System\IUPogfN.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\uEvoSsc.exe
  C:\Windows\System\uEvoSsc.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\CpIvuyT.exe
  C:\Windows\System\CpIvuyT.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\qoFGWMX.exe
  C:\Windows\System\qoFGWMX.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\WQevWNj.exe
  C:\Windows\System\WQevWNj.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\yJEustk.exe
  C:\Windows\System\yJEustk.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\iSXKOOo.exe
  C:\Windows\System\iSXKOOo.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\ITIYmDi.exe
  C:\Windows\System\ITIYmDi.exe
  2⤵
  - Executes dropped EXE
  PID:3860
- C:\Windows\System\WUoRwje.exe
  C:\Windows\System\WUoRwje.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\Snsyead.exe
  C:\Windows\System\Snsyead.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\rqriwwM.exe
  C:\Windows\System\rqriwwM.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\sXAzzbm.exe
  C:\Windows\System\sXAzzbm.exe
  2⤵
  - Executes dropped EXE
  PID:352
- C:\Windows\System\qvGqilo.exe
  C:\Windows\System\qvGqilo.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\JMItaFe.exe
  C:\Windows\System\JMItaFe.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\pxjZAXe.exe
  C:\Windows\System\pxjZAXe.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\JQlUWgo.exe
  C:\Windows\System\JQlUWgo.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\eGPADwA.exe
  C:\Windows\System\eGPADwA.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\MPBfFqJ.exe
  C:\Windows\System\MPBfFqJ.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\mpgbzna.exe
  C:\Windows\System\mpgbzna.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\PURTjYI.exe
  C:\Windows\System\PURTjYI.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\FVReNWR.exe
  C:\Windows\System\FVReNWR.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\kcdfeAd.exe
  C:\Windows\System\kcdfeAd.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\gZYqAeb.exe
  C:\Windows\System\gZYqAeb.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\ivuIzKf.exe
  C:\Windows\System\ivuIzKf.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\ZbYBbbk.exe
  C:\Windows\System\ZbYBbbk.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\MTauBwo.exe
  C:\Windows\System\MTauBwo.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\NhjtQGd.exe
  C:\Windows\System\NhjtQGd.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\kfJTBoG.exe
  C:\Windows\System\kfJTBoG.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\VMcEGUH.exe
  C:\Windows\System\VMcEGUH.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\hHxdcwf.exe
  C:\Windows\System\hHxdcwf.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\BBxQZfA.exe
  C:\Windows\System\BBxQZfA.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\smsyqqW.exe
  C:\Windows\System\smsyqqW.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\QhbGWCm.exe
  C:\Windows\System\QhbGWCm.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\fiIpVDZ.exe
  C:\Windows\System\fiIpVDZ.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\RhptFmc.exe
  C:\Windows\System\RhptFmc.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\BykFUCN.exe
  C:\Windows\System\BykFUCN.exe
  2⤵
  - Executes dropped EXE
  PID:424
- C:\Windows\System\jQIFgro.exe
  C:\Windows\System\jQIFgro.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\joRrvHr.exe
  C:\Windows\System\joRrvHr.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\VDwaBEV.exe
  C:\Windows\System\VDwaBEV.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\apiDoWk.exe
  C:\Windows\System\apiDoWk.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\MTFGplB.exe
  C:\Windows\System\MTFGplB.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\RmRWGFm.exe
  C:\Windows\System\RmRWGFm.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\dIMcCeF.exe
  C:\Windows\System\dIMcCeF.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\ISHTrJb.exe
  C:\Windows\System\ISHTrJb.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\AqLYZGU.exe
  C:\Windows\System\AqLYZGU.exe
  2⤵
  - Executes dropped EXE
  PID:652
- C:\Windows\System\yccIrsU.exe
  C:\Windows\System\yccIrsU.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\bIeCjFZ.exe
  C:\Windows\System\bIeCjFZ.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\TWGCLMx.exe
  C:\Windows\System\TWGCLMx.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\WdZRiwS.exe
  C:\Windows\System\WdZRiwS.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\yotZikH.exe
  C:\Windows\System\yotZikH.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\eNyihTI.exe
  C:\Windows\System\eNyihTI.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\EPoJxcl.exe
  C:\Windows\System\EPoJxcl.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\xLbBEml.exe
  C:\Windows\System\xLbBEml.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\YwlZakv.exe
  C:\Windows\System\YwlZakv.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\RXyBjJf.exe
  C:\Windows\System\RXyBjJf.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\dapTMzO.exe
  C:\Windows\System\dapTMzO.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\rpjfBFc.exe
  C:\Windows\System\rpjfBFc.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\mPAduQG.exe
  C:\Windows\System\mPAduQG.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\JqRlrPq.exe
  C:\Windows\System\JqRlrPq.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\QzAuLDQ.exe
  C:\Windows\System\QzAuLDQ.exe
  2⤵
  PID:4368
- C:\Windows\System\ZVLfADX.exe
  C:\Windows\System\ZVLfADX.exe
  2⤵
  PID:5104
- C:\Windows\System\EgVtERQ.exe
  C:\Windows\System\EgVtERQ.exe
  2⤵
  PID:4548
- C:\Windows\System\fNpfhKY.exe
  C:\Windows\System\fNpfhKY.exe
  2⤵
  PID:2700
- C:\Windows\System\MAOzmms.exe
  C:\Windows\System\MAOzmms.exe
  2⤵
  PID:1284
- C:\Windows\System\wysxrPq.exe
  C:\Windows\System\wysxrPq.exe
  2⤵
  PID:1340
- C:\Windows\System\dlOOKYR.exe
  C:\Windows\System\dlOOKYR.exe
  2⤵
  PID:1928
- C:\Windows\System\KFrcNKy.exe
  C:\Windows\System\KFrcNKy.exe
  2⤵
  PID:3952
- C:\Windows\System\hXdCGYG.exe
  C:\Windows\System\hXdCGYG.exe
  2⤵
  PID:1700
- C:\Windows\System\TcqChho.exe
  C:\Windows\System\TcqChho.exe
  2⤵
  PID:1424
- C:\Windows\System\LhrQmYm.exe
  C:\Windows\System\LhrQmYm.exe
  2⤵
  PID:3000
- C:\Windows\System\QtJgaPX.exe
  C:\Windows\System\QtJgaPX.exe
  2⤵
  PID:2436
- C:\Windows\System\IrXoshU.exe
  C:\Windows\System\IrXoshU.exe
  2⤵
  PID:4588
- C:\Windows\System\syvaCYo.exe
  C:\Windows\System\syvaCYo.exe
  2⤵
  PID:1840
- C:\Windows\System\GicmjxN.exe
  C:\Windows\System\GicmjxN.exe
  2⤵
  PID:4268
- C:\Windows\System\EKKsWJy.exe
  C:\Windows\System\EKKsWJy.exe
  2⤵
  PID:5132
- C:\Windows\System\qliWAzQ.exe
  C:\Windows\System\qliWAzQ.exe
  2⤵
  PID:5372
- C:\Windows\System\PCwOzUa.exe
  C:\Windows\System\PCwOzUa.exe
  2⤵
  PID:5416
- C:\Windows\System\NgkkkgV.exe
  C:\Windows\System\NgkkkgV.exe
  2⤵
  PID:5444
- C:\Windows\System\ZHjqPvq.exe
  C:\Windows\System\ZHjqPvq.exe
  2⤵
  PID:5460
- C:\Windows\System\VBuziQZ.exe
  C:\Windows\System\VBuziQZ.exe
  2⤵
  PID:5476
- C:\Windows\System\ooiRqVp.exe
  C:\Windows\System\ooiRqVp.exe
  2⤵
  PID:5524
- C:\Windows\System\WsTlqDa.exe
  C:\Windows\System\WsTlqDa.exe
  2⤵
  PID:5540
- C:\Windows\System\GNTSxnk.exe
  C:\Windows\System\GNTSxnk.exe
  2⤵
  PID:5560
- C:\Windows\System\APbXFxN.exe
  C:\Windows\System\APbXFxN.exe
  2⤵
  PID:5576
- C:\Windows\System\OymtMfN.exe
  C:\Windows\System\OymtMfN.exe
  2⤵
  PID:5592
- C:\Windows\System\pFFmsxQ.exe
  C:\Windows\System\pFFmsxQ.exe
  2⤵
  PID:5612
- C:\Windows\System\VNJUOfU.exe
  C:\Windows\System\VNJUOfU.exe
  2⤵
  PID:5632
- C:\Windows\System\VrJicUV.exe
  C:\Windows\System\VrJicUV.exe
  2⤵
  PID:5656
- C:\Windows\System\hhaOVBb.exe
  C:\Windows\System\hhaOVBb.exe
  2⤵
  PID:5680
- C:\Windows\System\lBgVOrk.exe
  C:\Windows\System\lBgVOrk.exe
  2⤵
  PID:5704
- C:\Windows\System\OkVGLeh.exe
  C:\Windows\System\OkVGLeh.exe
  2⤵
  PID:5724
- C:\Windows\System\ZajmQNm.exe
  C:\Windows\System\ZajmQNm.exe
  2⤵
  PID:5744
- C:\Windows\System\ghARHSt.exe
  C:\Windows\System\ghARHSt.exe
  2⤵
  PID:5788
- C:\Windows\System\JjhPZoM.exe
  C:\Windows\System\JjhPZoM.exe
  2⤵
  PID:5804
- C:\Windows\System\OHPIAbc.exe
  C:\Windows\System\OHPIAbc.exe
  2⤵
  PID:5888
- C:\Windows\System\OkiRhvX.exe
  C:\Windows\System\OkiRhvX.exe
  2⤵
  PID:5908
- C:\Windows\System\MsefTIC.exe
  C:\Windows\System\MsefTIC.exe
  2⤵
  PID:5932
- C:\Windows\System\mxnwIjG.exe
  C:\Windows\System\mxnwIjG.exe
  2⤵
  PID:5960
- C:\Windows\System\EXPegsz.exe
  C:\Windows\System\EXPegsz.exe
  2⤵
  PID:5984
- C:\Windows\System\uLrqFiA.exe
  C:\Windows\System\uLrqFiA.exe
  2⤵
  PID:6008
- C:\Windows\System\rYQKBze.exe
  C:\Windows\System\rYQKBze.exe
  2⤵
  PID:6044
- C:\Windows\System\MtsjeXL.exe
  C:\Windows\System\MtsjeXL.exe
  2⤵
  PID:6064
- C:\Windows\System\exWmSkQ.exe
  C:\Windows\System\exWmSkQ.exe
  2⤵
  PID:6080
- C:\Windows\System\gPLDpTW.exe
  C:\Windows\System\gPLDpTW.exe
  2⤵
  PID:6104
- C:\Windows\System\RMroKaQ.exe
  C:\Windows\System\RMroKaQ.exe
  2⤵
  PID:6124
- C:\Windows\System\WiWNdZZ.exe
  C:\Windows\System\WiWNdZZ.exe
  2⤵
  PID:4708
- C:\Windows\System\PETkFsd.exe
  C:\Windows\System\PETkFsd.exe
  2⤵
  PID:2188
- C:\Windows\System\OxEdCOD.exe
  C:\Windows\System\OxEdCOD.exe
  2⤵
  PID:4032
- C:\Windows\System\vPjQVYR.exe
  C:\Windows\System\vPjQVYR.exe
  2⤵
  PID:1220
- C:\Windows\System\MmaIdqG.exe
  C:\Windows\System\MmaIdqG.exe
  2⤵
  PID:2012
- C:\Windows\System\kDbXMiE.exe
  C:\Windows\System\kDbXMiE.exe
  2⤵
  PID:2768
- C:\Windows\System\UvLHXhI.exe
  C:\Windows\System\UvLHXhI.exe
  2⤵
  PID:3564
- C:\Windows\System\IjCsvaS.exe
  C:\Windows\System\IjCsvaS.exe
  2⤵
  PID:3440
- C:\Windows\System\vkuXiNZ.exe
  C:\Windows\System\vkuXiNZ.exe
  2⤵
  PID:5384
- C:\Windows\System\dLQNCWx.exe
  C:\Windows\System\dLQNCWx.exe
  2⤵
  PID:4848
- C:\Windows\System\QJqqzla.exe
  C:\Windows\System\QJqqzla.exe
  2⤵
  PID:668
- C:\Windows\System\iroKQUO.exe
  C:\Windows\System\iroKQUO.exe
  2⤵
  PID:1996
- C:\Windows\System\CCulZOr.exe
  C:\Windows\System\CCulZOr.exe
  2⤵
  PID:3212
- C:\Windows\System\lurpJVs.exe
  C:\Windows\System\lurpJVs.exe
  2⤵
  PID:2032
- C:\Windows\System\fkWCbQr.exe
  C:\Windows\System\fkWCbQr.exe
  2⤵
  PID:1472
- C:\Windows\System\umRBout.exe
  C:\Windows\System\umRBout.exe
  2⤵
  PID:5128
- C:\Windows\System\VurzRwt.exe
  C:\Windows\System\VurzRwt.exe
  2⤵
  PID:5668
- C:\Windows\System\hVvbIII.exe
  C:\Windows\System\hVvbIII.exe
  2⤵
  PID:5152
- C:\Windows\System\SUckBvf.exe
  C:\Windows\System\SUckBvf.exe
  2⤵
  PID:6112
- C:\Windows\System\OoRkgIB.exe
  C:\Windows\System\OoRkgIB.exe
  2⤵
  PID:3180
- C:\Windows\System\huMsETm.exe
  C:\Windows\System\huMsETm.exe
  2⤵
  PID:4012
- C:\Windows\System\ywBPyzj.exe
  C:\Windows\System\ywBPyzj.exe
  2⤵
  PID:6176
- C:\Windows\System\yidhWwW.exe
  C:\Windows\System\yidhWwW.exe
  2⤵
  PID:6220
- C:\Windows\System\iRguScZ.exe
  C:\Windows\System\iRguScZ.exe
  2⤵
  PID:6240
- C:\Windows\System\mXMKBwu.exe
  C:\Windows\System\mXMKBwu.exe
  2⤵
  PID:6264
- C:\Windows\System\vtDIyoE.exe
  C:\Windows\System\vtDIyoE.exe
  2⤵
  PID:6280
- C:\Windows\System\drfkXcz.exe
  C:\Windows\System\drfkXcz.exe
  2⤵
  PID:6304
- C:\Windows\System\cPXGOej.exe
  C:\Windows\System\cPXGOej.exe
  2⤵
  PID:6328
- C:\Windows\System\DebTLxA.exe
  C:\Windows\System\DebTLxA.exe
  2⤵
  PID:6352
- C:\Windows\System\gCvtzOY.exe
  C:\Windows\System\gCvtzOY.exe
  2⤵
  PID:6372
- C:\Windows\System\TuCcMQS.exe
  C:\Windows\System\TuCcMQS.exe
  2⤵
  PID:6400
- C:\Windows\System\PBZhfUU.exe
  C:\Windows\System\PBZhfUU.exe
  2⤵
  PID:6416
- C:\Windows\System\IeisAnm.exe
  C:\Windows\System\IeisAnm.exe
  2⤵
  PID:6432
- C:\Windows\System\CyZHqTH.exe
  C:\Windows\System\CyZHqTH.exe
  2⤵
  PID:6452
- C:\Windows\System\mxAjByP.exe
  C:\Windows\System\mxAjByP.exe
  2⤵
  PID:6500
- C:\Windows\System\oNfyahj.exe
  C:\Windows\System\oNfyahj.exe
  2⤵
  PID:6524
- C:\Windows\System\UEdAdpb.exe
  C:\Windows\System\UEdAdpb.exe
  2⤵
  PID:6544
- C:\Windows\System\GTurSTn.exe
  C:\Windows\System\GTurSTn.exe
  2⤵
  PID:6564
- C:\Windows\System\WZxyzxN.exe
  C:\Windows\System\WZxyzxN.exe
  2⤵
  PID:6584
- C:\Windows\System\TzozBNw.exe
  C:\Windows\System\TzozBNw.exe
  2⤵
  PID:6604
- C:\Windows\System\avUZrrd.exe
  C:\Windows\System\avUZrrd.exe
  2⤵
  PID:6620
- C:\Windows\System\HEUWBBN.exe
  C:\Windows\System\HEUWBBN.exe
  2⤵
  PID:6640
- C:\Windows\System\HNMRbqm.exe
  C:\Windows\System\HNMRbqm.exe
  2⤵
  PID:6656
- C:\Windows\System\IqEAZSc.exe
  C:\Windows\System\IqEAZSc.exe
  2⤵
  PID:6680
- C:\Windows\System\vavQofZ.exe
  C:\Windows\System\vavQofZ.exe
  2⤵
  PID:6704
- C:\Windows\System\rWuUcEp.exe
  C:\Windows\System\rWuUcEp.exe
  2⤵
  PID:6728
- C:\Windows\System\RppqCMx.exe
  C:\Windows\System\RppqCMx.exe
  2⤵
  PID:6748
- C:\Windows\System\jgvFIGY.exe
  C:\Windows\System\jgvFIGY.exe
  2⤵
  PID:6764
- C:\Windows\System\VRQWIhx.exe
  C:\Windows\System\VRQWIhx.exe
  2⤵
  PID:6780
- C:\Windows\System\rvMeYML.exe
  C:\Windows\System\rvMeYML.exe
  2⤵
  PID:6804
- C:\Windows\System\sTNgYrn.exe
  C:\Windows\System\sTNgYrn.exe
  2⤵
  PID:6820
- C:\Windows\System\jWCiuRn.exe
  C:\Windows\System\jWCiuRn.exe
  2⤵
  PID:6844
- C:\Windows\System\gvmbstp.exe
  C:\Windows\System\gvmbstp.exe
  2⤵
  PID:6868
- C:\Windows\System\KXgfQuK.exe
  C:\Windows\System\KXgfQuK.exe
  2⤵
  PID:6892
- C:\Windows\System\rWWxyWz.exe
  C:\Windows\System\rWWxyWz.exe
  2⤵
  PID:6912
- C:\Windows\System\rdAWgeT.exe
  C:\Windows\System\rdAWgeT.exe
  2⤵
  PID:6936
- C:\Windows\System\megBMHw.exe
  C:\Windows\System\megBMHw.exe
  2⤵
  PID:6960
- C:\Windows\System\bImjoxx.exe
  C:\Windows\System\bImjoxx.exe
  2⤵
  PID:6984
- C:\Windows\System\OLhKGat.exe
  C:\Windows\System\OLhKGat.exe
  2⤵
  PID:7000
- C:\Windows\System\cnhUDWD.exe
  C:\Windows\System\cnhUDWD.exe
  2⤵
  PID:7024
- C:\Windows\System\hNoAMdm.exe
  C:\Windows\System\hNoAMdm.exe
  2⤵
  PID:7048
- C:\Windows\System\uojMKXZ.exe
  C:\Windows\System\uojMKXZ.exe
  2⤵
  PID:3544
- C:\Windows\System\yQpsMto.exe
  C:\Windows\System\yQpsMto.exe
  2⤵
  PID:5344
- C:\Windows\System\LJNIAdE.exe
  C:\Windows\System\LJNIAdE.exe
  2⤵
  PID:2764
- C:\Windows\System\VjSjpmt.exe
  C:\Windows\System\VjSjpmt.exe
  2⤵
  PID:5624
- C:\Windows\System\tkAVxXz.exe
  C:\Windows\System\tkAVxXz.exe
  2⤵
  PID:5572
- C:\Windows\System\nBjRlzo.exe
  C:\Windows\System\nBjRlzo.exe
  2⤵
  PID:5620
- C:\Windows\System\ObBQbbS.exe
  C:\Windows\System\ObBQbbS.exe
  2⤵
  PID:5548
- C:\Windows\System\WXBoQqT.exe
  C:\Windows\System\WXBoQqT.exe
  2⤵
  PID:5452
- C:\Windows\System\HQcSGcj.exe
  C:\Windows\System\HQcSGcj.exe
  2⤵
  PID:6020
- C:\Windows\System\sQydqnp.exe
  C:\Windows\System\sQydqnp.exe
  2⤵
  PID:6132
- C:\Windows\System\drmqAoT.exe
  C:\Windows\System\drmqAoT.exe
  2⤵
  PID:5712
- C:\Windows\System\uNPtnJN.exe
  C:\Windows\System\uNPtnJN.exe
  2⤵
  PID:5800
- C:\Windows\System\MBviFvS.exe
  C:\Windows\System\MBviFvS.exe
  2⤵
  PID:5776
- C:\Windows\System\yBLxxeR.exe
  C:\Windows\System\yBLxxeR.exe
  2⤵
  PID:6212
- C:\Windows\System\cYrMCzT.exe
  C:\Windows\System\cYrMCzT.exe
  2⤵
  PID:6276
- C:\Windows\System\IeUXSJO.exe
  C:\Windows\System\IeUXSJO.exe
  2⤵
  PID:6316
- C:\Windows\System\TyafCmn.exe
  C:\Windows\System\TyafCmn.exe
  2⤵
  PID:3972
- C:\Windows\System\lskqIPf.exe
  C:\Windows\System\lskqIPf.exe
  2⤵
  PID:5880
- C:\Windows\System\rUBtTXa.exe
  C:\Windows\System\rUBtTXa.exe
  2⤵
  PID:5928
- C:\Windows\System\NfdDZod.exe
  C:\Windows\System\NfdDZod.exe
  2⤵
  PID:5972
- C:\Windows\System\yfHSSGA.exe
  C:\Windows\System\yfHSSGA.exe
  2⤵
  PID:6052
- C:\Windows\System\PBPFGuj.exe
  C:\Windows\System\PBPFGuj.exe
  2⤵
  PID:6100
- C:\Windows\System\nXBGiWD.exe
  C:\Windows\System\nXBGiWD.exe
  2⤵
  PID:3508
- C:\Windows\System\TLfziXi.exe
  C:\Windows\System\TLfziXi.exe
  2⤵
  PID:4068
- C:\Windows\System\iILBwIb.exe
  C:\Windows\System\iILBwIb.exe
  2⤵
  PID:3160
- C:\Windows\System\voFPUTE.exe
  C:\Windows\System\voFPUTE.exe
  2⤵
  PID:2936
- C:\Windows\System\mTkQlsU.exe
  C:\Windows\System\mTkQlsU.exe
  2⤵
  PID:3464
- C:\Windows\System\WfRJVXk.exe
  C:\Windows\System\WfRJVXk.exe
  2⤵
  PID:4920
- C:\Windows\System\XQJSBPq.exe
  C:\Windows\System\XQJSBPq.exe
  2⤵
  PID:2212
- C:\Windows\System\kKxOoQw.exe
  C:\Windows\System\kKxOoQw.exe
  2⤵
  PID:2096
- C:\Windows\System\QnQuWpZ.exe
  C:\Windows\System\QnQuWpZ.exe
  2⤵
  PID:464
- C:\Windows\System\ktkOlwh.exe
  C:\Windows\System\ktkOlwh.exe
  2⤵
  PID:6272
- C:\Windows\System\fQLgMOd.exe
  C:\Windows\System\fQLgMOd.exe
  2⤵
  PID:6512
- C:\Windows\System\noHNxpP.exe
  C:\Windows\System\noHNxpP.exe
  2⤵
  PID:6696
- C:\Windows\System\heKvRDs.exe
  C:\Windows\System\heKvRDs.exe
  2⤵
  PID:7008
- C:\Windows\System\oNUlGZw.exe
  C:\Windows\System\oNUlGZw.exe
  2⤵
  PID:6424
- C:\Windows\System\YhOagzr.exe
  C:\Windows\System\YhOagzr.exe
  2⤵
  PID:6908
- C:\Windows\System\nGlrSpz.exe
  C:\Windows\System\nGlrSpz.exe
  2⤵
  PID:6968
- C:\Windows\System\lzojnLk.exe
  C:\Windows\System\lzojnLk.exe
  2⤵
  PID:7020
- C:\Windows\System\QMLlvrU.exe
  C:\Windows\System\QMLlvrU.exe
  2⤵
  PID:4824
- C:\Windows\System\CRVBamF.exe
  C:\Windows\System\CRVBamF.exe
  2⤵
  PID:7180
- C:\Windows\System\LakXnxs.exe
  C:\Windows\System\LakXnxs.exe
  2⤵
  PID:7196
- C:\Windows\System\pMydoBs.exe
  C:\Windows\System\pMydoBs.exe
  2⤵
  PID:7216
- C:\Windows\System\wjALrgA.exe
  C:\Windows\System\wjALrgA.exe
  2⤵
  PID:7236
- C:\Windows\System\kAFjDRF.exe
  C:\Windows\System\kAFjDRF.exe
  2⤵
  PID:7260
- C:\Windows\System\wTNSNLR.exe
  C:\Windows\System\wTNSNLR.exe
  2⤵
  PID:7288
- C:\Windows\System\SDbEIrP.exe
  C:\Windows\System\SDbEIrP.exe
  2⤵
  PID:7312
- C:\Windows\System\JvhceTi.exe
  C:\Windows\System\JvhceTi.exe
  2⤵
  PID:7336
- C:\Windows\System\YVlwVAg.exe
  C:\Windows\System\YVlwVAg.exe
  2⤵
  PID:7360
- C:\Windows\System\FAmWyOd.exe
  C:\Windows\System\FAmWyOd.exe
  2⤵
  PID:7376
- C:\Windows\System\buDuLaC.exe
  C:\Windows\System\buDuLaC.exe
  2⤵
  PID:7400
- C:\Windows\System\ObAWRbg.exe
  C:\Windows\System\ObAWRbg.exe
  2⤵
  PID:7480
- C:\Windows\System\otIsEzd.exe
  C:\Windows\System\otIsEzd.exe
  2⤵
  PID:7496
- C:\Windows\System\CiKYzHh.exe
  C:\Windows\System\CiKYzHh.exe
  2⤵
  PID:7512
- C:\Windows\System\uCIUoio.exe
  C:\Windows\System\uCIUoio.exe
  2⤵
  PID:7528
- C:\Windows\System\wCEmxgx.exe
  C:\Windows\System\wCEmxgx.exe
  2⤵
  PID:7548
- C:\Windows\System\vckATdc.exe
  C:\Windows\System\vckATdc.exe
  2⤵
  PID:7568
- C:\Windows\System\FripGHB.exe
  C:\Windows\System\FripGHB.exe
  2⤵
  PID:7592
- C:\Windows\System\RbFUasB.exe
  C:\Windows\System\RbFUasB.exe
  2⤵
  PID:7608
- C:\Windows\System\VVpGAOv.exe
  C:\Windows\System\VVpGAOv.exe
  2⤵
  PID:7632
- C:\Windows\System\paRlaTa.exe
  C:\Windows\System\paRlaTa.exe
  2⤵
  PID:7656
- C:\Windows\System\IEvsTFc.exe
  C:\Windows\System\IEvsTFc.exe
  2⤵
  PID:7672
- C:\Windows\System\JmsCgNv.exe
  C:\Windows\System\JmsCgNv.exe
  2⤵
  PID:7696
- C:\Windows\System\CoSpcMt.exe
  C:\Windows\System\CoSpcMt.exe
  2⤵
  PID:7720
- C:\Windows\System\XRfdbef.exe
  C:\Windows\System\XRfdbef.exe
  2⤵
  PID:7740
- C:\Windows\System\QsolxJY.exe
  C:\Windows\System\QsolxJY.exe
  2⤵
  PID:7760
- C:\Windows\System\kxqsmJt.exe
  C:\Windows\System\kxqsmJt.exe
  2⤵
  PID:7784
- C:\Windows\System\GmZbERp.exe
  C:\Windows\System\GmZbERp.exe
  2⤵
  PID:7804
- C:\Windows\System\zDFikTJ.exe
  C:\Windows\System\zDFikTJ.exe
  2⤵
  PID:7824
- C:\Windows\System\qXeIwwr.exe
  C:\Windows\System\qXeIwwr.exe
  2⤵
  PID:7848
- C:\Windows\System\pQQxHYp.exe
  C:\Windows\System\pQQxHYp.exe
  2⤵
  PID:7868
- C:\Windows\System\vFChyHY.exe
  C:\Windows\System\vFChyHY.exe
  2⤵
  PID:7888
- C:\Windows\System\UXYcDFk.exe
  C:\Windows\System\UXYcDFk.exe
  2⤵
  PID:7908
- C:\Windows\System\VQSIfba.exe
  C:\Windows\System\VQSIfba.exe
  2⤵
  PID:7948
- C:\Windows\System\PloLxOC.exe
  C:\Windows\System\PloLxOC.exe
  2⤵
  PID:7976
- C:\Windows\System\PAuMwuR.exe
  C:\Windows\System\PAuMwuR.exe
  2⤵
  PID:7996
- C:\Windows\System\CaPueae.exe
  C:\Windows\System\CaPueae.exe
  2⤵
  PID:8016
- C:\Windows\System\enfPraw.exe
  C:\Windows\System\enfPraw.exe
  2⤵
  PID:8040
- C:\Windows\System\SbSySYz.exe
  C:\Windows\System\SbSySYz.exe
  2⤵
  PID:8068
- C:\Windows\System\yPfUBFl.exe
  C:\Windows\System\yPfUBFl.exe
  2⤵
  PID:8092
- C:\Windows\System\XThjYyu.exe
  C:\Windows\System\XThjYyu.exe
  2⤵
  PID:8112
- C:\Windows\System\zJAKrzT.exe
  C:\Windows\System\zJAKrzT.exe
  2⤵
  PID:8140
- C:\Windows\System\CAZwaLE.exe
  C:\Windows\System\CAZwaLE.exe
  2⤵
  PID:6596
- C:\Windows\System\YGjWYke.exe
  C:\Windows\System\YGjWYke.exe
  2⤵
  PID:6776
- C:\Windows\System\nOfCyGX.exe
  C:\Windows\System\nOfCyGX.exe
  2⤵
  PID:6996
- C:\Windows\System\VNZJjYr.exe
  C:\Windows\System\VNZJjYr.exe
  2⤵
  PID:7300
- C:\Windows\System\oZWAjdT.exe
  C:\Windows\System\oZWAjdT.exe
  2⤵
  PID:7164
- C:\Windows\System\VYobyhJ.exe
  C:\Windows\System\VYobyhJ.exe
  2⤵
  PID:5644
- C:\Windows\System\VmdOFZY.exe
  C:\Windows\System\VmdOFZY.exe
  2⤵
  PID:8216
- C:\Windows\System\lZWtItg.exe
  C:\Windows\System\lZWtItg.exe
  2⤵
  PID:8232
- C:\Windows\System\wVXOtPd.exe
  C:\Windows\System\wVXOtPd.exe
  2⤵
  PID:8252
- C:\Windows\System\IAlDdyI.exe
  C:\Windows\System\IAlDdyI.exe
  2⤵
  PID:8272
- C:\Windows\System\sHfoHci.exe
  C:\Windows\System\sHfoHci.exe
  2⤵
  PID:8288
- C:\Windows\System\puaJNrD.exe
  C:\Windows\System\puaJNrD.exe
  2⤵
  PID:8312
- C:\Windows\System\VhTSAmb.exe
  C:\Windows\System\VhTSAmb.exe
  2⤵
  PID:8340
- C:\Windows\System\BNeyCEl.exe
  C:\Windows\System\BNeyCEl.exe
  2⤵
  PID:8356
- C:\Windows\System\rcvnUJD.exe
  C:\Windows\System\rcvnUJD.exe
  2⤵
  PID:8388
- C:\Windows\System\MTYvRcX.exe
  C:\Windows\System\MTYvRcX.exe
  2⤵
  PID:8416
- C:\Windows\System\dQrLXiO.exe
  C:\Windows\System\dQrLXiO.exe
  2⤵
  PID:8436
- C:\Windows\System\KoZxfrw.exe
  C:\Windows\System\KoZxfrw.exe
  2⤵
  PID:8452
- C:\Windows\System\GxkeoYC.exe
  C:\Windows\System\GxkeoYC.exe
  2⤵
  PID:8476
- C:\Windows\System\jxJdrbU.exe
  C:\Windows\System\jxJdrbU.exe
  2⤵
  PID:8508
- C:\Windows\System\ChpsuzX.exe
  C:\Windows\System\ChpsuzX.exe
  2⤵
  PID:8544
- C:\Windows\System\QXSeggk.exe
  C:\Windows\System\QXSeggk.exe
  2⤵
  PID:8560
- C:\Windows\System\AwyyxIx.exe
  C:\Windows\System\AwyyxIx.exe
  2⤵
  PID:8580
- C:\Windows\System\IGRIxRO.exe
  C:\Windows\System\IGRIxRO.exe
  2⤵
  PID:8604
- C:\Windows\System\dGqRHcR.exe
  C:\Windows\System\dGqRHcR.exe
  2⤵
  PID:8624
- C:\Windows\System\IBLccLB.exe
  C:\Windows\System\IBLccLB.exe
  2⤵
  PID:8644
- C:\Windows\System\MXYQfOR.exe
  C:\Windows\System\MXYQfOR.exe
  2⤵
  PID:8672
- C:\Windows\System\MjBJHTB.exe
  C:\Windows\System\MjBJHTB.exe
  2⤵
  PID:8692
- C:\Windows\System\UqoZNVg.exe
  C:\Windows\System\UqoZNVg.exe
  2⤵
  PID:8712
- C:\Windows\System\vLBUXUC.exe
  C:\Windows\System\vLBUXUC.exe
  2⤵
  PID:8740
- C:\Windows\System\vpspPEE.exe
  C:\Windows\System\vpspPEE.exe
  2⤵
  PID:8760
- C:\Windows\System\heLXENA.exe
  C:\Windows\System\heLXENA.exe
  2⤵
  PID:8792
- C:\Windows\System\ZEGqyWl.exe
  C:\Windows\System\ZEGqyWl.exe
  2⤵
  PID:8816
- C:\Windows\System\KCCQPps.exe
  C:\Windows\System\KCCQPps.exe
  2⤵
  PID:8836
- C:\Windows\System\pcdiVEi.exe
  C:\Windows\System\pcdiVEi.exe
  2⤵
  PID:8856
- C:\Windows\System\BKFnuQB.exe
  C:\Windows\System\BKFnuQB.exe
  2⤵
  PID:8880
- C:\Windows\System\ResjYEs.exe
  C:\Windows\System\ResjYEs.exe
  2⤵
  PID:8900
- C:\Windows\System\QNjnEJw.exe
  C:\Windows\System\QNjnEJw.exe
  2⤵
  PID:8920
- C:\Windows\System\jLPEPIk.exe
  C:\Windows\System\jLPEPIk.exe
  2⤵
  PID:8948
- C:\Windows\System\fIcXPxj.exe
  C:\Windows\System\fIcXPxj.exe
  2⤵
  PID:8968
- C:\Windows\System\InhFjtI.exe
  C:\Windows\System\InhFjtI.exe
  2⤵
  PID:8992
- C:\Windows\System\WdNdMFL.exe
  C:\Windows\System\WdNdMFL.exe
  2⤵
  PID:9016
- C:\Windows\System\EGXvXPG.exe
  C:\Windows\System\EGXvXPG.exe
  2⤵
  PID:9036
- C:\Windows\System\QjHNcMz.exe
  C:\Windows\System\QjHNcMz.exe
  2⤵
  PID:9056
- C:\Windows\System\WlrNOPS.exe
  C:\Windows\System\WlrNOPS.exe
  2⤵
  PID:9076
- C:\Windows\System\jjJUhhu.exe
  C:\Windows\System\jjJUhhu.exe
  2⤵
  PID:9100
- C:\Windows\System\jMjlAJK.exe
  C:\Windows\System\jMjlAJK.exe
  2⤵
  PID:9120
- C:\Windows\System\eYYLXjM.exe
  C:\Windows\System\eYYLXjM.exe
  2⤵
  PID:9144
- C:\Windows\System\vSqFQkr.exe
  C:\Windows\System\vSqFQkr.exe
  2⤵
  PID:9168
- C:\Windows\System\hncmclz.exe
  C:\Windows\System\hncmclz.exe
  2⤵
  PID:9188
- C:\Windows\System\ZqXZVtS.exe
  C:\Windows\System\ZqXZVtS.exe
  2⤵
  PID:9208
- C:\Windows\System\nXLSswm.exe
  C:\Windows\System\nXLSswm.exe
  2⤵
  PID:5380
- C:\Windows\System\gXIHVjs.exe
  C:\Windows\System\gXIHVjs.exe
  2⤵
  PID:6024
- C:\Windows\System\pSAbaSo.exe
  C:\Windows\System\pSAbaSo.exe
  2⤵
  PID:1844
- C:\Windows\System\vDHRpVa.exe
  C:\Windows\System\vDHRpVa.exe
  2⤵
  PID:5784
- C:\Windows\System\qkPHyoa.exe
  C:\Windows\System\qkPHyoa.exe
  2⤵
  PID:5756
- C:\Windows\System\scDGWrV.exe
  C:\Windows\System\scDGWrV.exe
  2⤵
  PID:6380
- C:\Windows\System\uRVnxFi.exe
  C:\Windows\System\uRVnxFi.exe
  2⤵
  PID:5900
- C:\Windows\System\hOwgVuR.exe
  C:\Windows\System\hOwgVuR.exe
  2⤵
  PID:6032
- C:\Windows\System\hymgdmM.exe
  C:\Windows\System\hymgdmM.exe
  2⤵
  PID:4400
- C:\Windows\System\gDnBobm.exe
  C:\Windows\System\gDnBobm.exe
  2⤵
  PID:1808
- C:\Windows\System\EXvrOAy.exe
  C:\Windows\System\EXvrOAy.exe
  2⤵
  PID:6392
- C:\Windows\System\laDuSSm.exe
  C:\Windows\System\laDuSSm.exe
  2⤵
  PID:7064
- C:\Windows\System\pVorFpR.exe
  C:\Windows\System\pVorFpR.exe
  2⤵
  PID:7604
- C:\Windows\System\YGzlVTA.exe
  C:\Windows\System\YGzlVTA.exe
  2⤵
  PID:7692
- C:\Windows\System\NOvfcAM.exe
  C:\Windows\System\NOvfcAM.exe
  2⤵
  PID:7768
- C:\Windows\System\hblGlsC.exe
  C:\Windows\System\hblGlsC.exe
  2⤵
  PID:7172
- C:\Windows\System\eObvIid.exe
  C:\Windows\System\eObvIid.exe
  2⤵
  PID:7192
- C:\Windows\System\SPpLKDX.exe
  C:\Windows\System\SPpLKDX.exe
  2⤵
  PID:8124
- C:\Windows\System\CFmkwYU.exe
  C:\Windows\System\CFmkwYU.exe
  2⤵
  PID:7372
- C:\Windows\System\xiWxvaf.exe
  C:\Windows\System\xiWxvaf.exe
  2⤵
  PID:6536
- C:\Windows\System\jNIdXYM.exe
  C:\Windows\System\jNIdXYM.exe
  2⤵
  PID:6636
- C:\Windows\System\kudCEPn.exe
  C:\Windows\System\kudCEPn.exe
  2⤵
  PID:8324
- C:\Windows\System\TblPZVQ.exe
  C:\Windows\System\TblPZVQ.exe
  2⤵
  PID:6880
- C:\Windows\System\FaTKHXe.exe
  C:\Windows\System\FaTKHXe.exe
  2⤵
  PID:8408
- C:\Windows\System\ovKkGOz.exe
  C:\Windows\System\ovKkGOz.exe
  2⤵
  PID:7564
- C:\Windows\System\iAbrjgg.exe
  C:\Windows\System\iAbrjgg.exe
  2⤵
  PID:9228
- C:\Windows\System\yAKTdlA.exe
  C:\Windows\System\yAKTdlA.exe
  2⤵
  PID:9248
- C:\Windows\System\KhmcdnP.exe
  C:\Windows\System\KhmcdnP.exe
  2⤵
  PID:9276
- C:\Windows\System\MoXVzBy.exe
  C:\Windows\System\MoXVzBy.exe
  2⤵
  PID:9308
- C:\Windows\System\aEiWmhl.exe
  C:\Windows\System\aEiWmhl.exe
  2⤵
  PID:9340
- C:\Windows\System\LelnhYM.exe
  C:\Windows\System\LelnhYM.exe
  2⤵
  PID:9360
- C:\Windows\System\YXzqSvc.exe
  C:\Windows\System\YXzqSvc.exe
  2⤵
  PID:9384
- C:\Windows\System\JBwWhxK.exe
  C:\Windows\System\JBwWhxK.exe
  2⤵
  PID:9408
- C:\Windows\System\HTDGblp.exe
  C:\Windows\System\HTDGblp.exe
  2⤵
  PID:9432
- C:\Windows\System\sCKMzRr.exe
  C:\Windows\System\sCKMzRr.exe
  2⤵
  PID:9452
- C:\Windows\System\AxTStDh.exe
  C:\Windows\System\AxTStDh.exe
  2⤵
  PID:9472
- C:\Windows\System\otKxtIA.exe
  C:\Windows\System\otKxtIA.exe
  2⤵
  PID:9500
- C:\Windows\System\yGyszLf.exe
  C:\Windows\System\yGyszLf.exe
  2⤵
  PID:9520
- C:\Windows\System\estQVTD.exe
  C:\Windows\System\estQVTD.exe
  2⤵
  PID:9548
- C:\Windows\System\NJYKRFj.exe
  C:\Windows\System\NJYKRFj.exe
  2⤵
  PID:9568
- C:\Windows\System\FNPfRvS.exe
  C:\Windows\System\FNPfRvS.exe
  2⤵
  PID:9592
- C:\Windows\System\qKdOkMN.exe
  C:\Windows\System\qKdOkMN.exe
  2⤵
  PID:9616
- C:\Windows\System\BHZtZMF.exe
  C:\Windows\System\BHZtZMF.exe
  2⤵
  PID:9640
- C:\Windows\System\NnVehLd.exe
  C:\Windows\System\NnVehLd.exe
  2⤵
  PID:9660
- C:\Windows\System\JQzYlaW.exe
  C:\Windows\System\JQzYlaW.exe
  2⤵
  PID:9680
- C:\Windows\System\GJUpZGZ.exe
  C:\Windows\System\GJUpZGZ.exe
  2⤵
  PID:9704
- C:\Windows\System\UrgNAOg.exe
  C:\Windows\System\UrgNAOg.exe
  2⤵
  PID:9724
- C:\Windows\System\WNPIJCv.exe
  C:\Windows\System\WNPIJCv.exe
  2⤵
  PID:9740
- C:\Windows\System\nUYNeEB.exe
  C:\Windows\System\nUYNeEB.exe
  2⤵
  PID:9756
- C:\Windows\System\VuNSxYP.exe
  C:\Windows\System\VuNSxYP.exe
  2⤵
  PID:9784
- C:\Windows\System\gYQwSDC.exe
  C:\Windows\System\gYQwSDC.exe
  2⤵
  PID:9808
- C:\Windows\System\gHBzmeF.exe
  C:\Windows\System\gHBzmeF.exe
  2⤵
  PID:9828
- C:\Windows\System\tFzgLFo.exe
  C:\Windows\System\tFzgLFo.exe
  2⤵
  PID:9856
- C:\Windows\System\RANIEmB.exe
  C:\Windows\System\RANIEmB.exe
  2⤵
  PID:9880
- C:\Windows\System\hfwKofY.exe
  C:\Windows\System\hfwKofY.exe
  2⤵
  PID:9896
- C:\Windows\System\DbNuCsu.exe
  C:\Windows\System\DbNuCsu.exe
  2⤵
  PID:9928
- C:\Windows\System\WvzhVnn.exe
  C:\Windows\System\WvzhVnn.exe
  2⤵
  PID:9948
- C:\Windows\System\nDwNjSs.exe
  C:\Windows\System\nDwNjSs.exe
  2⤵
  PID:9972
- C:\Windows\System\oyVPdkn.exe
  C:\Windows\System\oyVPdkn.exe
  2⤵
  PID:9992
- C:\Windows\System\VIZXNUa.exe
  C:\Windows\System\VIZXNUa.exe
  2⤵
  PID:10012
- C:\Windows\System\MgppJKq.exe
  C:\Windows\System\MgppJKq.exe
  2⤵
  PID:10036
- C:\Windows\System\wNJKvTf.exe
  C:\Windows\System\wNJKvTf.exe
  2⤵
  PID:10056
- C:\Windows\System\XJRsUUq.exe
  C:\Windows\System\XJRsUUq.exe
  2⤵
  PID:10072
- C:\Windows\System\gpfXtBy.exe
  C:\Windows\System\gpfXtBy.exe
  2⤵
  PID:10116
- C:\Windows\System\qgEOLkj.exe
  C:\Windows\System\qgEOLkj.exe
  2⤵
  PID:10132
- C:\Windows\System\DvVBpsi.exe
  C:\Windows\System\DvVBpsi.exe
  2⤵
  PID:10148
- C:\Windows\System\vqmdkCK.exe
  C:\Windows\System\vqmdkCK.exe
  2⤵
  PID:10164
- C:\Windows\System\oRFMvhJ.exe
  C:\Windows\System\oRFMvhJ.exe
  2⤵
  PID:10180
- C:\Windows\System\LnZHDUh.exe
  C:\Windows\System\LnZHDUh.exe
  2⤵
  PID:10196
- C:\Windows\System\rlkwwAC.exe
  C:\Windows\System\rlkwwAC.exe
  2⤵
  PID:10212
- C:\Windows\System\IXPgWZN.exe
  C:\Windows\System\IXPgWZN.exe
  2⤵
  PID:10232
- C:\Windows\System\YPTSmkj.exe
  C:\Windows\System\YPTSmkj.exe
  2⤵
  PID:7640
- C:\Windows\System\ZiwLreC.exe
  C:\Windows\System\ZiwLreC.exe
  2⤵
  PID:8600
- C:\Windows\System\SKZFBgM.exe
  C:\Windows\System\SKZFBgM.exe
  2⤵
  PID:8664
- C:\Windows\System\ezQayMG.exe
  C:\Windows\System\ezQayMG.exe
  2⤵
  PID:7800
- C:\Windows\System\tHxMMZg.exe
  C:\Windows\System\tHxMMZg.exe
  2⤵
  PID:8852
- C:\Windows\System\DIOBRtG.exe
  C:\Windows\System\DIOBRtG.exe
  2⤵
  PID:8964
- C:\Windows\System\TptlkDg.exe
  C:\Windows\System\TptlkDg.exe
  2⤵
  PID:9044
- C:\Windows\System\kXiMYTc.exe
  C:\Windows\System\kXiMYTc.exe
  2⤵
  PID:9096
- C:\Windows\System\CtojqzM.exe
  C:\Windows\System\CtojqzM.exe
  2⤵
  PID:9160
- C:\Windows\System\ERvYOkI.exe
  C:\Windows\System\ERvYOkI.exe
  2⤵
  PID:7252
- C:\Windows\System\DIkvrym.exe
  C:\Windows\System\DIkvrym.exe
  2⤵
  PID:7304
- C:\Windows\System\MiRVhVV.exe
  C:\Windows\System\MiRVhVV.exe
  2⤵
  PID:5760
- C:\Windows\System\sfaPhWS.exe
  C:\Windows\System\sfaPhWS.exe
  2⤵
  PID:5868
- C:\Windows\System\NmIdfsW.exe
  C:\Windows\System\NmIdfsW.exe
  2⤵
  PID:3520
- C:\Windows\System\PARQElC.exe
  C:\Windows\System\PARQElC.exe
  2⤵
  PID:7452
- C:\Windows\System\NsbORbC.exe
  C:\Windows\System\NsbORbC.exe
  2⤵
  PID:8368
- C:\Windows\System\CsEqUjp.exe
  C:\Windows\System\CsEqUjp.exe
  2⤵
  PID:7508
- C:\Windows\System\xGFlcgI.exe
  C:\Windows\System\xGFlcgI.exe
  2⤵
  PID:8444
- C:\Windows\System\rGpRRwI.exe
  C:\Windows\System\rGpRRwI.exe
  2⤵
  PID:6944
- C:\Windows\System\UracaVa.exe
  C:\Windows\System\UracaVa.exe
  2⤵
  PID:9244
- C:\Windows\System\rdAfumc.exe
  C:\Windows\System\rdAfumc.exe
  2⤵
  PID:8556
- C:\Windows\System\MircLHo.exe
  C:\Windows\System\MircLHo.exe
  2⤵
  PID:8632
- C:\Windows\System\imNIsAJ.exe
  C:\Windows\System\imNIsAJ.exe
  2⤵
  PID:7716
- C:\Windows\System\xZIIDZu.exe
  C:\Windows\System\xZIIDZu.exe
  2⤵
  PID:9372
- C:\Windows\System\zaXvOsK.exe
  C:\Windows\System\zaXvOsK.exe
  2⤵
  PID:8752
- C:\Windows\System\trKuPTV.exe
  C:\Windows\System\trKuPTV.exe
  2⤵
  PID:8800
- C:\Windows\System\UUDxXgP.exe
  C:\Windows\System\UUDxXgP.exe
  2⤵
  PID:9468
- C:\Windows\System\sEUqodO.exe
  C:\Windows\System\sEUqodO.exe
  2⤵
  PID:10248
- C:\Windows\System\roCpRpP.exe
  C:\Windows\System\roCpRpP.exe
  2⤵
  PID:10276
- C:\Windows\System\axhDLUk.exe
  C:\Windows\System\axhDLUk.exe
  2⤵
  PID:10296
- C:\Windows\System\CMoxyma.exe
  C:\Windows\System\CMoxyma.exe
  2⤵
  PID:10316
- C:\Windows\System\PlmHeCC.exe
  C:\Windows\System\PlmHeCC.exe
  2⤵
  PID:10340
- C:\Windows\System\DHBApSF.exe
  C:\Windows\System\DHBApSF.exe
  2⤵
  PID:10360
- C:\Windows\System\VdNcTWI.exe
  C:\Windows\System\VdNcTWI.exe
  2⤵
  PID:10384
- C:\Windows\System\gJbVOGM.exe
  C:\Windows\System\gJbVOGM.exe
  2⤵
  PID:10400
- C:\Windows\System\QPDiScj.exe
  C:\Windows\System\QPDiScj.exe
  2⤵
  PID:10420
- C:\Windows\System\oSGlrXP.exe
  C:\Windows\System\oSGlrXP.exe
  2⤵
  PID:10436
- C:\Windows\System\iNfaAFf.exe
  C:\Windows\System\iNfaAFf.exe
  2⤵
  PID:10464
- C:\Windows\System\YTaqxaW.exe
  C:\Windows\System\YTaqxaW.exe
  2⤵
  PID:10484
- C:\Windows\System\QKtIure.exe
  C:\Windows\System\QKtIure.exe
  2⤵
  PID:10500
- C:\Windows\System\wnzvPuO.exe
  C:\Windows\System\wnzvPuO.exe
  2⤵
  PID:10516
- C:\Windows\System\ubOZBPz.exe
  C:\Windows\System\ubOZBPz.exe
  2⤵
  PID:10540
- C:\Windows\System\oBfOdmO.exe
  C:\Windows\System\oBfOdmO.exe
  2⤵
  PID:10560
- C:\Windows\System\siOBFzf.exe
  C:\Windows\System\siOBFzf.exe
  2⤵
  PID:10588
- C:\Windows\System\kVjsiUb.exe
  C:\Windows\System\kVjsiUb.exe
  2⤵
  PID:10612
- C:\Windows\System\HhHaVeV.exe
  C:\Windows\System\HhHaVeV.exe
  2⤵
  PID:10640
- C:\Windows\System\FPnmKbS.exe
  C:\Windows\System\FPnmKbS.exe
  2⤵
  PID:10796
- C:\Windows\System\aSmqIJe.exe
  C:\Windows\System\aSmqIJe.exe
  2⤵
  PID:10816
- C:\Windows\System\mHoJvrY.exe
  C:\Windows\System\mHoJvrY.exe
  2⤵
  PID:10836
- C:\Windows\System\GFRbSZV.exe
  C:\Windows\System\GFRbSZV.exe
  2⤵
  PID:10920
- C:\Windows\System\gpqxuTW.exe
  C:\Windows\System\gpqxuTW.exe
  2⤵
  PID:10940
- C:\Windows\System\BdWaTET.exe
  C:\Windows\System\BdWaTET.exe
  2⤵
  PID:10956
- C:\Windows\System\kabciug.exe
  C:\Windows\System\kabciug.exe
  2⤵
  PID:10972
- C:\Windows\System\fvgEQno.exe
  C:\Windows\System\fvgEQno.exe
  2⤵
  PID:10992
- C:\Windows\System\rCXFRFD.exe
  C:\Windows\System\rCXFRFD.exe
  2⤵
  PID:11012
- C:\Windows\System\Shqgnnf.exe
  C:\Windows\System\Shqgnnf.exe
  2⤵
  PID:11036
- C:\Windows\System\CbILyTF.exe
  C:\Windows\System\CbILyTF.exe
  2⤵
  PID:11056
- C:\Windows\System\rjIJvrJ.exe
  C:\Windows\System\rjIJvrJ.exe
  2⤵
  PID:11076
- C:\Windows\System\vuHEcSH.exe
  C:\Windows\System\vuHEcSH.exe
  2⤵
  PID:11100
- C:\Windows\System\VKacQQo.exe
  C:\Windows\System\VKacQQo.exe
  2⤵
  PID:11120
- C:\Windows\System\YwuiwZp.exe
  C:\Windows\System\YwuiwZp.exe
  2⤵
  PID:11148
- C:\Windows\System\MulXegO.exe
  C:\Windows\System\MulXegO.exe
  2⤵
  PID:11172
- C:\Windows\System\ofANuBY.exe
  C:\Windows\System\ofANuBY.exe
  2⤵
  PID:11192
- C:\Windows\System\fXAIvwE.exe
  C:\Windows\System\fXAIvwE.exe
  2⤵
  PID:11212
- C:\Windows\System\cneZKjA.exe
  C:\Windows\System\cneZKjA.exe
  2⤵
  PID:11240
- C:\Windows\System\YpaZmBZ.exe
  C:\Windows\System\YpaZmBZ.exe
  2⤵
  PID:9488
- C:\Windows\System\kRsRTGB.exe
  C:\Windows\System\kRsRTGB.exe
  2⤵
  PID:9528
- C:\Windows\System\dSqJgdi.exe
  C:\Windows\System\dSqJgdi.exe
  2⤵
  PID:9540
- C:\Windows\System\sNxBKMS.exe
  C:\Windows\System\sNxBKMS.exe
  2⤵
  PID:9624
- C:\Windows\System\dApXmSr.exe
  C:\Windows\System\dApXmSr.exe
  2⤵
  PID:3136
- C:\Windows\System\RyKIbOO.exe
  C:\Windows\System\RyKIbOO.exe
  2⤵
  PID:9000
- C:\Windows\System\hTJbMpc.exe
  C:\Windows\System\hTJbMpc.exe
  2⤵
  PID:9068
- C:\Windows\System\PSQlhcd.exe
  C:\Windows\System\PSQlhcd.exe
  2⤵
  PID:7928
- C:\Windows\System\BVfIYKg.exe
  C:\Windows\System\BVfIYKg.exe
  2⤵
  PID:9800
- C:\Windows\System\khQvCeY.exe
  C:\Windows\System\khQvCeY.exe
  2⤵
  PID:7992
- C:\Windows\System\LWZPfIq.exe
  C:\Windows\System\LWZPfIq.exe
  2⤵
  PID:8028
- C:\Windows\System\VCZrTdL.exe
  C:\Windows\System\VCZrTdL.exe
  2⤵
  PID:8056
- C:\Windows\System\vOVFKDU.exe
  C:\Windows\System\vOVFKDU.exe
  2⤵
  PID:6152
- C:\Windows\System\DIeGnUq.exe
  C:\Windows\System\DIeGnUq.exe
  2⤵
  PID:8104
- C:\Windows\System\aiFPtpZ.exe
  C:\Windows\System\aiFPtpZ.exe
  2⤵
  PID:6508
- C:\Windows\System\cqGFIxn.exe
  C:\Windows\System\cqGFIxn.exe
  2⤵
  PID:6980
- C:\Windows\System\EXzFNzS.exe
  C:\Windows\System\EXzFNzS.exe
  2⤵
  PID:7396
- C:\Windows\System\lATkFef.exe
  C:\Windows\System\lATkFef.exe
  2⤵
  PID:8228
- C:\Windows\System\xtgxJGY.exe
  C:\Windows\System\xtgxJGY.exe
  2⤵
  PID:8284
- C:\Windows\System\WpBJQfy.exe
  C:\Windows\System\WpBJQfy.exe
  2⤵
  PID:8432
- C:\Windows\System\sfkHSWC.exe
  C:\Windows\System\sfkHSWC.exe
  2⤵
  PID:8484
- C:\Windows\System\cRjwSei.exe
  C:\Windows\System\cRjwSei.exe
  2⤵
  PID:8468
- C:\Windows\System\ymrUZGR.exe
  C:\Windows\System\ymrUZGR.exe
  2⤵
  PID:5032
- C:\Windows\System\NIsFAyf.exe
  C:\Windows\System\NIsFAyf.exe
  2⤵
  PID:7472
- C:\Windows\System\QnwcoBO.exe
  C:\Windows\System\QnwcoBO.exe
  2⤵
  PID:4764
- C:\Windows\System\ytwgcJH.exe
  C:\Windows\System\ytwgcJH.exe
  2⤵
  PID:9400
- C:\Windows\System\kmmqLCz.exe
  C:\Windows\System\kmmqLCz.exe
  2⤵
  PID:9424
- C:\Windows\System\rwZuJSp.exe
  C:\Windows\System\rwZuJSp.exe
  2⤵
  PID:8808
- C:\Windows\System\TYlWHhk.exe
  C:\Windows\System\TYlWHhk.exe
  2⤵
  PID:10304
- C:\Windows\System\IfGlCQv.exe
  C:\Windows\System\IfGlCQv.exe
  2⤵
  PID:9608
- C:\Windows\System\VUPcXZC.exe
  C:\Windows\System\VUPcXZC.exe
  2⤵
  PID:10412
- C:\Windows\System\wljTMAm.exe
  C:\Windows\System\wljTMAm.exe
  2⤵
  PID:10496
- C:\Windows\System\nWKDGBs.exe
  C:\Windows\System\nWKDGBs.exe
  2⤵
  PID:9176
- C:\Windows\System\OLLvRID.exe
  C:\Windows\System\OLLvRID.exe
  2⤵
  PID:10576
- C:\Windows\System\eKWYEPs.exe
  C:\Windows\System\eKWYEPs.exe
  2⤵
  PID:5404
- C:\Windows\System\lcyrdla.exe
  C:\Windows\System\lcyrdla.exe
  2⤵
  PID:9988
- C:\Windows\System\qzooclD.exe
  C:\Windows\System\qzooclD.exe
  2⤵
  PID:3772
- C:\Windows\System\lfaiApY.exe
  C:\Windows\System\lfaiApY.exe
  2⤵
  PID:11276
- C:\Windows\System\imtekHZ.exe
  C:\Windows\System\imtekHZ.exe
  2⤵
  PID:11292
- C:\Windows\System\pQXzPMU.exe
  C:\Windows\System\pQXzPMU.exe
  2⤵
  PID:11316
- C:\Windows\System\UpsIBTl.exe
  C:\Windows\System\UpsIBTl.exe
  2⤵
  PID:11344
- C:\Windows\System\YkiOTOr.exe
  C:\Windows\System\YkiOTOr.exe
  2⤵
  PID:11368
- C:\Windows\System\QYckvsb.exe
  C:\Windows\System\QYckvsb.exe
  2⤵
  PID:11384
- C:\Windows\System\mZToepG.exe
  C:\Windows\System\mZToepG.exe
  2⤵
  PID:11400
- C:\Windows\System\pUgpwNo.exe
  C:\Windows\System\pUgpwNo.exe
  2⤵
  PID:11416
- C:\Windows\System\CodXUzJ.exe
  C:\Windows\System\CodXUzJ.exe
  2⤵
  PID:11524
- C:\Windows\System\RTLNQjq.exe
  C:\Windows\System\RTLNQjq.exe
  2⤵
  PID:11548
- C:\Windows\System\iLESKIy.exe
  C:\Windows\System\iLESKIy.exe
  2⤵
  PID:11572
- C:\Windows\System\gEHokvX.exe
  C:\Windows\System\gEHokvX.exe
  2⤵
  PID:11596
- C:\Windows\System\NydGPdG.exe
  C:\Windows\System\NydGPdG.exe
  2⤵
  PID:11612
- C:\Windows\System\fHsWIem.exe
  C:\Windows\System\fHsWIem.exe
  2⤵
  PID:11636
- C:\Windows\System\WmnvjXe.exe
  C:\Windows\System\WmnvjXe.exe
  2⤵
  PID:11660
- C:\Windows\System\FerYxxN.exe
  C:\Windows\System\FerYxxN.exe
  2⤵
  PID:11688
- C:\Windows\System\wMADUrR.exe
  C:\Windows\System\wMADUrR.exe
  2⤵
  PID:11708
- C:\Windows\System\YXWXMtw.exe
  C:\Windows\System\YXWXMtw.exe
  2⤵
  PID:11724
- C:\Windows\System\tRhfZCv.exe
  C:\Windows\System\tRhfZCv.exe
  2⤵
  PID:11748
- C:\Windows\System\vIfvTTo.exe
  C:\Windows\System\vIfvTTo.exe
  2⤵
  PID:11768
- C:\Windows\System\SJyYAev.exe
  C:\Windows\System\SJyYAev.exe
  2⤵
  PID:11792
- C:\Windows\System\nynPeIa.exe
  C:\Windows\System\nynPeIa.exe
  2⤵
  PID:11808
- C:\Windows\System\tZnWCAH.exe
  C:\Windows\System\tZnWCAH.exe
  2⤵
  PID:11824
- C:\Windows\System\lhRITPA.exe
  C:\Windows\System\lhRITPA.exe
  2⤵
  PID:11840
- C:\Windows\System\XrDwrFH.exe
  C:\Windows\System\XrDwrFH.exe
  2⤵
  PID:11860
- C:\Windows\System\JUYyomZ.exe
  C:\Windows\System\JUYyomZ.exe
  2⤵
  PID:11876
- C:\Windows\System\PKHgDwF.exe
  C:\Windows\System\PKHgDwF.exe
  2⤵
  PID:11892
- C:\Windows\System\pNeiYQR.exe
  C:\Windows\System\pNeiYQR.exe
  2⤵
  PID:11912
- C:\Windows\System\OgweYaa.exe
  C:\Windows\System\OgweYaa.exe
  2⤵
  PID:11932
- C:\Windows\System\jJaSbNd.exe
  C:\Windows\System\jJaSbNd.exe
  2⤵
  PID:11960
- C:\Windows\System\ANpQhrO.exe
  C:\Windows\System\ANpQhrO.exe
  2⤵
  PID:11984
- C:\Windows\System\UWFCWtf.exe
  C:\Windows\System\UWFCWtf.exe
  2⤵
  PID:12004
- C:\Windows\System\UkKZHtF.exe
  C:\Windows\System\UkKZHtF.exe
  2⤵
  PID:12028
- C:\Windows\System\EMfgUcC.exe
  C:\Windows\System\EMfgUcC.exe
  2⤵
  PID:12052
- C:\Windows\System\tLJDOXJ.exe
  C:\Windows\System\tLJDOXJ.exe
  2⤵
  PID:12076
- C:\Windows\System\kThCyHG.exe
  C:\Windows\System\kThCyHG.exe
  2⤵
  PID:12096
- C:\Windows\System\quCgvAl.exe
  C:\Windows\System\quCgvAl.exe
  2⤵
  PID:12116
- C:\Windows\System\harOcAi.exe
  C:\Windows\System\harOcAi.exe
  2⤵
  PID:12144
- C:\Windows\System\sePmNFg.exe
  C:\Windows\System\sePmNFg.exe
  2⤵
  PID:12164
- C:\Windows\System\aVODXLJ.exe
  C:\Windows\System\aVODXLJ.exe
  2⤵
  PID:12188
- C:\Windows\System\uFtqfun.exe
  C:\Windows\System\uFtqfun.exe
  2⤵
  PID:12216
- C:\Windows\System\kSGXtzN.exe
  C:\Windows\System\kSGXtzN.exe
  2⤵
  PID:12232
- C:\Windows\System\xwpuqcs.exe
  C:\Windows\System\xwpuqcs.exe
  2⤵
  PID:12256
- C:\Windows\System\KhRzPwt.exe
  C:\Windows\System\KhRzPwt.exe
  2⤵
  PID:12276
- C:\Windows\System\KhCnvtF.exe
  C:\Windows\System\KhCnvtF.exe
  2⤵
  PID:3932
- C:\Windows\System\rTyMfxw.exe
  C:\Windows\System\rTyMfxw.exe
  2⤵
  PID:6664
- C:\Windows\System\HoxSRtV.exe
  C:\Windows\System\HoxSRtV.exe
  2⤵
  PID:7648
- C:\Windows\System\FASXKYa.exe
  C:\Windows\System\FASXKYa.exe
  2⤵
  PID:7968
- C:\Windows\System\NmDLBUY.exe
  C:\Windows\System\NmDLBUY.exe
  2⤵
  PID:6532
- C:\Windows\System\IscOTmt.exe
  C:\Windows\System\IscOTmt.exe
  2⤵
  PID:10912
- C:\Windows\System\IyLjZWO.exe
  C:\Windows\System\IyLjZWO.exe
  2⤵
  PID:9092
- C:\Windows\System\gAQJSqf.exe
  C:\Windows\System\gAQJSqf.exe
  2⤵
  PID:5584
- C:\Windows\System\AdeAsgL.exe
  C:\Windows\System\AdeAsgL.exe
  2⤵
  PID:11092
- C:\Windows\System\EoSRlYE.exe
  C:\Windows\System\EoSRlYE.exe
  2⤵
  PID:11136
- C:\Windows\System\imzeBfF.exe
  C:\Windows\System\imzeBfF.exe
  2⤵
  PID:6904
- C:\Windows\System\oCOBCla.exe
  C:\Windows\System\oCOBCla.exe
  2⤵
  PID:11252
- C:\Windows\System\pUrPSKM.exe
  C:\Windows\System\pUrPSKM.exe
  2⤵
  PID:8932
- C:\Windows\System\qwCzFbo.exe
  C:\Windows\System\qwCzFbo.exe
  2⤵
  PID:9632
- C:\Windows\System\lmKvscp.exe
  C:\Windows\System\lmKvscp.exe
  2⤵
  PID:9748
- C:\Windows\System\jdOJoog.exe
  C:\Windows\System\jdOJoog.exe
  2⤵
  PID:10348
- C:\Windows\System\lSkentV.exe
  C:\Windows\System\lSkentV.exe
  2⤵
  PID:7256
- C:\Windows\System\dRSqNfc.exe
  C:\Windows\System\dRSqNfc.exe
  2⤵
  PID:12296
- C:\Windows\System\pOhrUsq.exe
  C:\Windows\System\pOhrUsq.exe
  2⤵
  PID:12316
- C:\Windows\System\fPqwDKe.exe
  C:\Windows\System\fPqwDKe.exe
  2⤵
  PID:12332
- C:\Windows\System\boGtEgY.exe
  C:\Windows\System\boGtEgY.exe
  2⤵
  PID:12360
- C:\Windows\System\qgdPenm.exe
  C:\Windows\System\qgdPenm.exe
  2⤵
  PID:12380
- C:\Windows\System\HERcNby.exe
  C:\Windows\System\HERcNby.exe
  2⤵
  PID:12400
- C:\Windows\System\gbAWVmd.exe
  C:\Windows\System\gbAWVmd.exe
  2⤵
  PID:12424
- C:\Windows\System\vSevQjg.exe
  C:\Windows\System\vSevQjg.exe
  2⤵
  PID:12448
- C:\Windows\System\xmMrDjf.exe
  C:\Windows\System\xmMrDjf.exe
  2⤵
  PID:12468
- C:\Windows\System\SafqyXa.exe
  C:\Windows\System\SafqyXa.exe
  2⤵
  PID:12488
- C:\Windows\System\osHNKmj.exe
  C:\Windows\System\osHNKmj.exe
  2⤵
  PID:12512
- C:\Windows\System\COqyKnJ.exe
  C:\Windows\System\COqyKnJ.exe
  2⤵
  PID:12528
- C:\Windows\System\iuMGUIq.exe
  C:\Windows\System\iuMGUIq.exe
  2⤵
  PID:12556
- C:\Windows\System\JyuqLSu.exe
  C:\Windows\System\JyuqLSu.exe
  2⤵
  PID:12580
- C:\Windows\System\NyccqhH.exe
  C:\Windows\System\NyccqhH.exe
  2⤵
  PID:12600
- C:\Windows\System\vYZjulm.exe
  C:\Windows\System\vYZjulm.exe
  2⤵
  PID:12624
- C:\Windows\System\wJHvOdU.exe
  C:\Windows\System\wJHvOdU.exe
  2⤵
  PID:12644
- C:\Windows\System\CrjdVdS.exe
  C:\Windows\System\CrjdVdS.exe
  2⤵
  PID:12668
- C:\Windows\System\wBIIRdp.exe
  C:\Windows\System\wBIIRdp.exe
  2⤵
  PID:12692
- C:\Windows\System\XLAniZD.exe
  C:\Windows\System\XLAniZD.exe
  2⤵
  PID:12724
- C:\Windows\System\TmdgsrX.exe
  C:\Windows\System\TmdgsrX.exe
  2⤵
  PID:12748
- C:\Windows\System\HiMbnTI.exe
  C:\Windows\System\HiMbnTI.exe
  2⤵
  PID:12776
- C:\Windows\System\kaVnHNk.exe
  C:\Windows\System\kaVnHNk.exe
  2⤵
  PID:12796
- C:\Windows\System\GzuIvfz.exe
  C:\Windows\System\GzuIvfz.exe
  2⤵
  PID:12820
- C:\Windows\System\CapPTyG.exe
  C:\Windows\System\CapPTyG.exe
  2⤵
  PID:12836
- C:\Windows\System\tYClZbN.exe
  C:\Windows\System\tYClZbN.exe
  2⤵
  PID:12852
- C:\Windows\System\zjzSHXc.exe
  C:\Windows\System\zjzSHXc.exe
  2⤵
  PID:12872
- C:\Windows\System\Rpqqdpb.exe
  C:\Windows\System\Rpqqdpb.exe
  2⤵
  PID:12888
- C:\Windows\System\RDTvaUT.exe
  C:\Windows\System\RDTvaUT.exe
  2⤵
  PID:12904
- C:\Windows\System\WplgbHQ.exe
  C:\Windows\System\WplgbHQ.exe
  2⤵
  PID:12920
- C:\Windows\System\YmSlrue.exe
  C:\Windows\System\YmSlrue.exe
  2⤵
  PID:12944
- C:\Windows\System\BOiUCjx.exe
  C:\Windows\System\BOiUCjx.exe
  2⤵
  PID:12968
- C:\Windows\System\OYqWZWL.exe
  C:\Windows\System\OYqWZWL.exe
  2⤵
  PID:13000
- C:\Windows\System\jvPBrJD.exe
  C:\Windows\System\jvPBrJD.exe
  2⤵
  PID:13020
- C:\Windows\System\zZCxYRS.exe
  C:\Windows\System\zZCxYRS.exe
  2⤵
  PID:13040
- C:\Windows\System\KpVZPkt.exe
  C:\Windows\System\KpVZPkt.exe
  2⤵
  PID:13060
- C:\Windows\System\ZWDgkWl.exe
  C:\Windows\System\ZWDgkWl.exe
  2⤵
  PID:13084
- C:\Windows\System\fHfapPQ.exe
  C:\Windows\System\fHfapPQ.exe
  2⤵
  PID:13100
- C:\Windows\System\tOHTDvQ.exe
  C:\Windows\System\tOHTDvQ.exe
  2⤵
  PID:13124
- C:\Windows\System\oqptiwp.exe
  C:\Windows\System\oqptiwp.exe
  2⤵
  PID:13140
- C:\Windows\System\bJBpDKF.exe
  C:\Windows\System\bJBpDKF.exe
  2⤵
  PID:13160
- C:\Windows\System\RYgALDn.exe
  C:\Windows\System\RYgALDn.exe
  2⤵
  PID:13180
- C:\Windows\System\IIxUOEp.exe
  C:\Windows\System\IIxUOEp.exe
  2⤵
  PID:13196
- C:\Windows\System\nxfcfIK.exe
  C:\Windows\System\nxfcfIK.exe
  2⤵
  PID:13212
- C:\Windows\System\AImCCMy.exe
  C:\Windows\System\AImCCMy.exe
  2⤵
  PID:13248
- C:\Windows\System\qlZnWGM.exe
  C:\Windows\System\qlZnWGM.exe
  2⤵
  PID:13268
- C:\Windows\System\BNtkUSl.exe
  C:\Windows\System\BNtkUSl.exe
  2⤵
  PID:13292
- C:\Windows\System\ImzLcVe.exe
  C:\Windows\System\ImzLcVe.exe
  2⤵
  PID:10452
- C:\Windows\System\wIOraBg.exe
  C:\Windows\System\wIOraBg.exe
  2⤵
  PID:8396
- C:\Windows\System\CExFCat.exe
  C:\Windows\System\CExFCat.exe
  2⤵
  PID:9824
- C:\Windows\System\GkBMFbu.exe
  C:\Windows\System\GkBMFbu.exe
  2⤵
  PID:9936
- C:\Windows\System\fsfNkNb.exe
  C:\Windows\System\fsfNkNb.exe
  2⤵
  PID:1404
- C:\Windows\System\wEElxOn.exe
  C:\Windows\System\wEElxOn.exe
  2⤵
  PID:9776
- C:\Windows\System\vrRvnfI.exe
  C:\Windows\System\vrRvnfI.exe
  2⤵
  PID:11544
- C:\Windows\System\mNZFjZd.exe
  C:\Windows\System\mNZFjZd.exe
  2⤵
  PID:11680
- C:\Windows\System\OXFrmkI.exe
  C:\Windows\System\OXFrmkI.exe
  2⤵
  PID:11740
- C:\Windows\System\kuSxFcs.exe
  C:\Windows\System\kuSxFcs.exe
  2⤵
  PID:11908
- C:\Windows\System\zbxHqfT.exe
  C:\Windows\System\zbxHqfT.exe
  2⤵
  PID:11972
- C:\Windows\System\NHlXiMH.exe
  C:\Windows\System\NHlXiMH.exe
  2⤵
  PID:12204
- C:\Windows\System\KavvIzT.exe
  C:\Windows\System\KavvIzT.exe
  2⤵
  PID:9224
- C:\Windows\System\HlzXcLC.exe
  C:\Windows\System\HlzXcLC.exe
  2⤵
  PID:12792
- C:\Windows\System\DMmZdvp.exe
  C:\Windows\System\DMmZdvp.exe
  2⤵
  PID:13156
- C:\Windows\System\fwuRCWD.exe
  C:\Windows\System\fwuRCWD.exe
  2⤵
  PID:9656
- C:\Windows\System\QuRmcBw.exe
  C:\Windows\System\QuRmcBw.exe
  2⤵
  PID:10632
- C:\Windows\System\dEHqIHj.exe
  C:\Windows\System\dEHqIHj.exe
  2⤵
  PID:10028
- C:\Windows\System\DQLjuGK.exe
  C:\Windows\System\DQLjuGK.exe
  2⤵
  PID:7796
- C:\Windows\System\XhtalqY.exe
  C:\Windows\System\XhtalqY.exe
  2⤵
  PID:8588
- C:\Windows\System\VOwDSaG.exe
  C:\Windows\System\VOwDSaG.exe
  2⤵
  PID:10160
- C:\Windows\System\JzoZutc.exe
  C:\Windows\System\JzoZutc.exe
  2⤵
  PID:10124
- C:\Windows\System\fKfSZEt.exe
  C:\Windows\System\fKfSZEt.exe
  2⤵
  PID:11408
- C:\Windows\System\kGTgiBj.exe
  C:\Windows\System\kGTgiBj.exe
  2⤵
  PID:3624
- C:\Windows\System\qmLfcvy.exe
  C:\Windows\System\qmLfcvy.exe
  2⤵
  PID:5468
- C:\Windows\System\wcIkAJz.exe
  C:\Windows\System\wcIkAJz.exe
  2⤵
  PID:10048
- C:\Windows\System\RjUlaAM.exe
  C:\Windows\System\RjUlaAM.exe
  2⤵
  PID:8280
- C:\Windows\System\SxVHUvG.exe
  C:\Windows\System\SxVHUvG.exe
  2⤵
  PID:13204
- C:\Windows\System\ypddhcG.exe
  C:\Windows\System\ypddhcG.exe
  2⤵
  PID:13112
- C:\Windows\System\KBIUZjW.exe
  C:\Windows\System\KBIUZjW.exe
  2⤵
  PID:12980
- C:\Windows\System\kzPIsHq.exe
  C:\Windows\System\kzPIsHq.exe
  2⤵
  PID:12860
- C:\Windows\System\LXvmLYi.exe
  C:\Windows\System\LXvmLYi.exe
  2⤵
  PID:12756
- C:\Windows\System\VAcRHWF.exe
  C:\Windows\System\VAcRHWF.exe
  2⤵
  PID:12660
- C:\Windows\System\aogLPbO.exe
  C:\Windows\System\aogLPbO.exe
  2⤵
  PID:12520
- C:\Windows\System\uSiNlas.exe
  C:\Windows\System\uSiNlas.exe
  2⤵
  PID:12088
- C:\Windows\System\HKVEWxC.exe
  C:\Windows\System\HKVEWxC.exe
  2⤵
  PID:8084
- C:\Windows\System\WofuxOb.exe
  C:\Windows\System\WofuxOb.exe
  2⤵
  PID:12224
- C:\Windows\System\lOonPQy.exe
  C:\Windows\System\lOonPQy.exe
  2⤵
  PID:12348
- C:\Windows\System\RBfmhEZ.exe
  C:\Windows\System\RBfmhEZ.exe
  2⤵
  PID:8404
- C:\Windows\System\svUMOKs.exe
  C:\Windows\System\svUMOKs.exe
  2⤵
  PID:7984
- C:\Windows\System\fYOpmGX.exe
  C:\Windows\System\fYOpmGX.exe
  2⤵
  PID:6156
- C:\Windows\System\UTZyXEp.exe
  C:\Windows\System\UTZyXEp.exe
  2⤵
  PID:5360
- C:\Windows\System\kBvzlvC.exe
  C:\Windows\System\kBvzlvC.exe
  2⤵
  PID:8076
- C:\Windows\System\elokfmD.exe
  C:\Windows\System\elokfmD.exe
  2⤵
  PID:212
- C:\Windows\System\gzVyVht.exe
  C:\Windows\System\gzVyVht.exe
  2⤵
  PID:2612
- C:\Windows\System\pOwVQyI.exe
  C:\Windows\System\pOwVQyI.exe
  2⤵
  PID:1572
- C:\Windows\System\altraLP.exe
  C:\Windows\System\altraLP.exe
  2⤵
  PID:3452
- C:\Windows\System\QwbTMbo.exe
  C:\Windows\System\QwbTMbo.exe
  2⤵
  PID:1876
- C:\Windows\System\JtBDAiz.exe
  C:\Windows\System\JtBDAiz.exe
  2⤵
  PID:10008
- C:\Windows\System\dcOLhto.exe
  C:\Windows\System\dcOLhto.exe
  2⤵
  PID:13172
- C:\Windows\System\lHujDuM.exe
  C:\Windows\System\lHujDuM.exe
  2⤵
  PID:12896
- C:\Windows\System\GDzjvTf.exe
  C:\Windows\System\GDzjvTf.exe
  2⤵
  PID:10596
- C:\Windows\System\PbxVepA.exe
  C:\Windows\System\PbxVepA.exe
  2⤵
  PID:7712
- C:\Windows\System\mCWbhIV.exe
  C:\Windows\System\mCWbhIV.exe
  2⤵
  PID:4556
- C:\Windows\System\uLmbUUG.exe
  C:\Windows\System\uLmbUUG.exe
  2⤵
  PID:3152
- C:\Windows\System\OJUGdvP.exe
  C:\Windows\System\OJUGdvP.exe
  2⤵
  PID:4464
- C:\Windows\System\jbfZNQa.exe
  C:\Windows\System\jbfZNQa.exe
  2⤵
  PID:11764
- C:\Windows\System\mrkqApA.exe
  C:\Windows\System\mrkqApA.exe
  2⤵
  PID:13336
- C:\Windows\System\kKHgMKL.exe
  C:\Windows\System\kKHgMKL.exe
  2⤵
  PID:13356
- C:\Windows\System\qBAxeGd.exe
  C:\Windows\System\qBAxeGd.exe
  2⤵
  PID:13380
- C:\Windows\System\qTztBQD.exe
  C:\Windows\System\qTztBQD.exe
  2⤵
  PID:13432
- C:\Windows\System\ZWEFUAM.exe
  C:\Windows\System\ZWEFUAM.exe
  2⤵
  PID:13452
- C:\Windows\System\AZJyTdO.exe
  C:\Windows\System\AZJyTdO.exe
  2⤵
  PID:13468
- C:\Windows\System\EKRZzik.exe
  C:\Windows\System\EKRZzik.exe
  2⤵
  PID:13492
- C:\Windows\System\SVEwMUo.exe
  C:\Windows\System\SVEwMUo.exe
  2⤵
  PID:13520
- C:\Windows\System\VCOKqQq.exe
  C:\Windows\System\VCOKqQq.exe
  2⤵
  PID:13548
- C:\Windows\System\HshRXSq.exe
  C:\Windows\System\HshRXSq.exe
  2⤵
  PID:13572
- C:\Windows\System\PPzbftc.exe
  C:\Windows\System\PPzbftc.exe
  2⤵
  PID:13596
- C:\Windows\System\aCIzlVa.exe
  C:\Windows\System\aCIzlVa.exe
  2⤵
  PID:13636
- C:\Windows\System\rKkWQPZ.exe
  C:\Windows\System\rKkWQPZ.exe
  2⤵
  PID:13672
- C:\Windows\System\GJBTbWV.exe
  C:\Windows\System\GJBTbWV.exe
  2⤵
  PID:4184
- C:\Windows\System\LiBDydh.exe
  C:\Windows\System\LiBDydh.exe
  2⤵
  PID:9944
- C:\Windows\System\CuRUXmk.exe
  C:\Windows\System\CuRUXmk.exe
  2⤵
  PID:10112
- C:\Windows\System\wipaKNw.exe
  C:\Windows\System\wipaKNw.exe
  2⤵
  PID:11324
- C:\Windows\System\UWrQyGJ.exe
  C:\Windows\System\UWrQyGJ.exe
  2⤵
  PID:1848
- C:\Windows\System\tHOsbJR.exe
  C:\Windows\System\tHOsbJR.exe
  2⤵
  PID:13428
- C:\Windows\System\IIiEcwV.exe
  C:\Windows\System\IIiEcwV.exe
  2⤵
  PID:1084
- C:\Windows\System\qYzAjJK.exe
  C:\Windows\System\qYzAjJK.exe
  2⤵
  PID:13724
- C:\Windows\System\MJQPwGG.exe
  C:\Windows\System\MJQPwGG.exe
  2⤵
  PID:472
- C:\Windows\System\DjQchXL.exe
  C:\Windows\System\DjQchXL.exe
  2⤵
  PID:11340
- C:\Windows\System\SITfigR.exe
  C:\Windows\System\SITfigR.exe
  2⤵
  PID:13284
- C:\Windows\System\LLDEOvU.exe
  C:\Windows\System\LLDEOvU.exe
  2⤵
  PID:13896
- C:\Windows\System\qrtZQkf.exe
  C:\Windows\System\qrtZQkf.exe
  2⤵
  PID:13416
- C:\Windows\System\LYChwqp.exe
  C:\Windows\System\LYChwqp.exe
  2⤵
  PID:13604
- C:\Windows\System\xNZZUyK.exe
  C:\Windows\System\xNZZUyK.exe
  2⤵
  PID:14056
- C:\Windows\System\yMlWNzy.exe
  C:\Windows\System\yMlWNzy.exe
  2⤵
  PID:13792
- C:\Windows\System\aJsnyWR.exe
  C:\Windows\System\aJsnyWR.exe
  2⤵
  PID:13856
- C:\Windows\System\rPqOjyP.exe
  C:\Windows\System\rPqOjyP.exe
  2⤵
  PID:14104
- C:\Windows\System\uNcOIkw.exe
  C:\Windows\System\uNcOIkw.exe
  2⤵
  PID:13968
- C:\Windows\System\uKECFZQ.exe
  C:\Windows\System\uKECFZQ.exe
  2⤵
  PID:14000
- C:\Windows\System\dPvlTcT.exe
  C:\Windows\System\dPvlTcT.exe
  2⤵
  PID:14052
- C:\Windows\System\afraQYJ.exe
  C:\Windows\System\afraQYJ.exe
  2⤵
  PID:14148
- C:\Windows\System\smVsUfJ.exe
  C:\Windows\System\smVsUfJ.exe
  2⤵
  PID:14168
- C:\Windows\System\fQjBeRg.exe
  C:\Windows\System\fQjBeRg.exe
  2⤵
  PID:14176
- C:\Windows\System\rNTbGSB.exe
  C:\Windows\System\rNTbGSB.exe
  2⤵
  PID:14216
- C:\Windows\System\bygFXIC.exe
  C:\Windows\System\bygFXIC.exe
  2⤵
  PID:14248
- C:\Windows\System\mFmHtvS.exe
  C:\Windows\System\mFmHtvS.exe
  2⤵
  PID:14076
- C:\Windows\System\xREMzls.exe
  C:\Windows\System\xREMzls.exe
  2⤵
  PID:10104
- C:\Windows\System\dDrnrrQ.exe
  C:\Windows\System\dDrnrrQ.exe
  2⤵
  PID:12740
- C:\Windows\System\EVEXEjr.exe
  C:\Windows\System\EVEXEjr.exe
  2⤵
  PID:12000
- C:\Windows\System\BkDsNAV.exe
  C:\Windows\System\BkDsNAV.exe
  2⤵
  PID:13772
- C:\Windows\System\vSeBrXJ.exe
  C:\Windows\System\vSeBrXJ.exe
  2⤵
  PID:900
- C:\Windows\System\mPeSwUF.exe
  C:\Windows\System\mPeSwUF.exe
  2⤵
  PID:13848
- C:\Windows\System\ULCgaRA.exe
  C:\Windows\System\ULCgaRA.exe
  2⤵
  PID:1032
- C:\Windows\System\HWUvQrN.exe
  C:\Windows\System\HWUvQrN.exe
  2⤵
  PID:13616
- C:\Windows\System\rtOwbct.exe
  C:\Windows\System\rtOwbct.exe
  2⤵
  PID:13712
- C:\Windows\System\YSAKHKs.exe
  C:\Windows\System\YSAKHKs.exe
  2⤵
  PID:13424
- C:\Windows\System\YjXoLuD.exe
  C:\Windows\System\YjXoLuD.exe
  2⤵
  PID:13708
- C:\Windows\System\ndcTekY.exe
  C:\Windows\System\ndcTekY.exe
  2⤵
  PID:13096
- C:\Windows\System\cccQhVN.exe
  C:\Windows\System\cccQhVN.exe
  2⤵
  PID:13408
- C:\Windows\System\FaXTpbQ.exe
  C:\Windows\System\FaXTpbQ.exe
  2⤵
  PID:13768
- C:\Windows\System\BUDfhMn.exe
  C:\Windows\System\BUDfhMn.exe
  2⤵
  PID:5036
- C:\Windows\System\DleYWIj.exe
  C:\Windows\System\DleYWIj.exe
  2⤵
  PID:14064
- C:\Windows\System\rbqiiaZ.exe
  C:\Windows\System\rbqiiaZ.exe
  2⤵
  PID:14260
- C:\Windows\System\rVdnzCl.exe
  C:\Windows\System\rVdnzCl.exe
  2⤵
  PID:13068
- C:\Windows\System\FmWMaIm.exe
  C:\Windows\System\FmWMaIm.exe
  2⤵
  PID:13948
- C:\Windows\System\WSYBbtH.exe
  C:\Windows\System\WSYBbtH.exe
  2⤵
  PID:13288
- C:\Windows\System\RiiMYrf.exe
  C:\Windows\System\RiiMYrf.exe
  2⤵
  PID:12912
- C:\Windows\System\wqUzPJs.exe
  C:\Windows\System\wqUzPJs.exe
  2⤵
  PID:628
- C:\Windows\System\XFCcfik.exe
  C:\Windows\System\XFCcfik.exe
  2⤵
  PID:14292
- C:\Windows\System\sdmUWoV.exe
  C:\Windows\System\sdmUWoV.exe
  2⤵
  PID:9912
- C:\Windows\System\KJQbQhR.exe
  C:\Windows\System\KJQbQhR.exe
  2⤵
  PID:4056
- C:\Windows\System\prnyofe.exe
  C:\Windows\System\prnyofe.exe
  2⤵
  PID:11968
- C:\Windows\System\hMdaKeJ.exe
  C:\Windows\System\hMdaKeJ.exe
  2⤵
  PID:11268
- C:\Windows\System\uHgPEot.exe
  C:\Windows\System\uHgPEot.exe
  2⤵
  PID:7628
- C:\Windows\System\HthYBRb.exe
  C:\Windows\System\HthYBRb.exe
  2⤵
  PID:13256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dgbc20ni.jy4.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BBxQZfA.exe

Filesize
1.9MB

MD5
77b2fee2c06f8a308d49c4b55398105e

SHA1
1cec1f68e04a4e141cabfda5b3880f9747b80dd5

SHA256
f404723f1c1189475bc724d04ba2ee3de470a452b7b45d0c21cc7c873ea60495

SHA512
c599a62eb747397f0ea62df10360de30b6f78853f8dfd1f06a212e352a83ecaaac8b276adc1148f184e6149508a5c222103720a0a95a6d10d33b9848b093b732

Download Submit
C:\Windows\System\BykFUCN.exe

Filesize
1.9MB

MD5
e7d33bde924aa1f58eab68477894a90c

SHA1
74b60e24b58b904232a0f1cd02573e29e5f4a6f4

SHA256
7540cf735d0b674a9aa500cd1e6d3dd3c262afcc78e539cd5bdedf447e0a319e

SHA512
10338e99d1168762c26ddb85822551c3bf16d93a193658e36a434bcd2fc09d0bfe2d329773c9bfb5792e66375aab301e7f9574121128a45278317cbfc9b349d6

Download Submit
C:\Windows\System\CpIvuyT.exe

Filesize
1.9MB

MD5
e166af2fa0011219d1bcd20df9b151fb

SHA1
f118e483555162528ba1738f2b8a499e90024dac

SHA256
ddd82c217fef0dcdbb63e1295fe4778b71e8f002701cb491c0a96dd0e9207272

SHA512
dc37be8169fa1e05183f6c0890bfabc4aeaea0264d2acba76ff14b23997c46443b8159db78f4a56105251b56435c593715d8df94cb6e0258afc801a4def87271

Download Submit
C:\Windows\System\FVReNWR.exe

Filesize
1.9MB

MD5
d266a9ecfcfb761fcdbd9a389eb3c8a4

SHA1
e1f4a93d9f03c6787c81088c93c40abe2ca68660

SHA256
60078ce0e3fae38df3474e88be5db6c0c43c9b5c698f74c5c6286eb5d67ee8a1

SHA512
e8825cfb55e32dcfbf67b16d11b0a9843d686c00d44839238eeaeb241c7f7809225c93b77188c82e7c20379f27a206a0f209ca83708b70451181cb1d5600d13d

Download Submit
C:\Windows\System\ITIYmDi.exe

Filesize
1.9MB

MD5
f430ef60c6df3036cb6d726d25ca2ca1

SHA1
9771fc536309f89e402f97bb6b6512a4af1cbfb5

SHA256
20a45875eaeb9ded320c5dc18a3cad2306c8fbd57106babe25819a4a616a0701

SHA512
529a4ea154f6366a416ba3292ca3ce40291d606f56ef5b06a3b8f9db7c283ca25f8cd9237a8e6ad040442565176bdcc03833a780f2a4c0d7d7d65a4cf4609837

Download Submit
C:\Windows\System\IUPogfN.exe

Filesize
1.9MB

MD5
5a99c9886382fbf6fef12dd9feaf0154

SHA1
348ad76b0d3cf90957ce9a92dfbc816e479a799b

SHA256
0c6ad3330f0cace9f6523d676c63e6446a01cc030cb9a2c39e0c35daa2b2cbf6

SHA512
b775e0cd852deda266b098270d51cd2dd207cbd79f0397ae9a55466a476bac0ce000f214a2ef79e4b3962b51f1d592fbc654da2ac0cd4436c258f894d0206d69

Download Submit
C:\Windows\System\JMItaFe.exe

Filesize
1.9MB

MD5
69ae22024ed551ae3636e47fc21e98e1

SHA1
ae56185959e07761325e7ebe5777d52eb3763ebe

SHA256
739855e648cdd16463474b35c2d2ba76b8daaf2d98257fcf5f217b7dc42bafb6

SHA512
f9b408f0bfacc230f2d8a4b9b42468a9cd41d10cdbb62d63f375eb1b060cb37ea8361b9c0d627c3de87f28126e15a2fc11f1f1a940df80fe2064b577277181de

Download Submit
C:\Windows\System\JQlUWgo.exe

Filesize
1.9MB

MD5
dbee8d58376dc5a3b6a6656c9c961061

SHA1
501c0c382cf4982221dea7d9ff6c2503e4d1875d

SHA256
05f78fd6a8ed68a85731cf1ef510fc7304bea3cb5fec3e0340d142343fa385cd

SHA512
e08bdf2cc12af070ac7f36c816738d67eae0aeef67022798c0b4dfe8add8a0045b5d103ef87b3861aa12e6845e237f692aac5aaac8c729acbfb777e03d30294e

Download Submit
C:\Windows\System\MPBfFqJ.exe

Filesize
1.9MB

MD5
6de8b5486ce4019ba7f91bbd380e079f

SHA1
5c01084340fa8664ed761a264f7f0fe60b7d35f3

SHA256
47054563c78f02dfa0e5ec91d63605add624c733a785fac2f311f9b7f988e9d8

SHA512
d83150c9e4b1f2c43fc4c6bf8d944ec0da30a6ef0563cbac123e3f672b053aaf20394a4485e2fb060f7727c6ac3ce9d28ba069ac5a9dffa6690ea1d58768d38a

Download Submit
C:\Windows\System\MTauBwo.exe

Filesize
1.9MB

MD5
33ac8587ebf46408a0465fd50b100130

SHA1
2fa8992ae4687de06a658a1d136dff2f81f47be1

SHA256
5ee89e6f0f192437ec66c06d3f3b19014293b5b60e84f54738155c815d29e4b8

SHA512
6406f013484eb9cebaa0dd806f550228733ba2930d41bdfdbdfab3eb8ead3220438f6f075dda0d853254c6f8878c9481d9bc672bcf45928d3942fe32e9a37b17

Download Submit
C:\Windows\System\NhjtQGd.exe

Filesize
1.9MB

MD5
16c2a12c3eaf24cfe1ab768eed07ab54

SHA1
3b38b491ae2a6ce021ee6b96a18f7f9437f62c69

SHA256
808ea53bdcb1e349746059563455103e198a6fc2ee469fc5bc75ade8708ecccd

SHA512
e0b3e7870f5dee25629ab833f5918b403213969b6f110c04835ddad4f05d0fac2c1ed49eb85b3fb4c47295fba5c91c8a5eed7fb822acddd571691d8edb696979

Download Submit
C:\Windows\System\PURTjYI.exe

Filesize
1.9MB

MD5
715cdda5bfea87d3e51c36e66c222f29

SHA1
311f8ebe2aa88b6851df00918814f9c59f05923f

SHA256
1d1334e19282d2400407cfef7d328da367f07194e471331a5118ea174516f5f0

SHA512
a2a6d16237731e92141584a7463655b9d13e82f028aa99b75e5b534a1c977ea0738aae80461b86e53092cdcffddc6df8ddd1287d39a1b8f3990e75bbf1252374

Download Submit
C:\Windows\System\QhbGWCm.exe

Filesize
1.9MB

MD5
23a6522a5d39ba7d552ea05cc2e959d7

SHA1
1e1ce510f08fc6b17b9479cece601eca3ddad4a4

SHA256
16f4aeeaee851a19f13084e52d5375b608d6c7dd4a91b26045ccd9c611b17fb4

SHA512
77cecad6ef6897f3c8e77633a45d10da08023ee2c84f7fe41fed6b9a08ee4e043418357fc5dc9443676a9efe78e5fddd55f5cdbe4577312056c8b9a24f0a5ce0

Download Submit
C:\Windows\System\RhptFmc.exe

Filesize
1.9MB

MD5
1a506cd82d13c59d5b125230122180fa

SHA1
8e99334ccde9d16c12d7f67608a418e1f6a0d2cd

SHA256
68e0b027408529a407651713dc03aabe62486e84479d8c8d4a7c06489010a728

SHA512
9ef3494de87696652f8e88afd06b13f03db634e502722a93d8a4438df3389b7abb9304bfacde60cbf7c517c458a6911d7a118fa7920001628ae7f464094e62b0

Download Submit
C:\Windows\System\Snsyead.exe

Filesize
1.9MB

MD5
2cc792f8f0f6fcc3ad59cc6c3e19b3d8

SHA1
7ff116344f9e3200fa8661c45487ca57d1405b5e

SHA256
c8385af19cf398aeaff0b8bf7dc5bfc7285c59675898c031eccebf4f129aefe3

SHA512
d9b900ac6f4c6ed66dc236b1da7c31cdcce6e381a271cadbabfe7c092428cd60d7a206a58165fbaf327ae59ae8af2367f04957a23e9063608e1dcb173db2266e

Download Submit
C:\Windows\System\WQevWNj.exe

Filesize
1.9MB

MD5
5f40720156baf5c260e9467afccb0377

SHA1
79232d8a55638cf678833ecbe9f3bd1484721c4e

SHA256
48a710c24907dcd3e795aedec934c9bac98e4357b38444dc3158464997da32e1

SHA512
1c1326812cb7c3a2174eab0a36cf883d741bbf478d82cfb4b7f975c562289b4feee93350e12cd7dd9a83d79eb11bf317764b1857d19f3ef98792c7f45d21f65f

Download Submit
C:\Windows\System\WUoRwje.exe

Filesize
1.9MB

MD5
e9e5ccb3f5c2b98249f50cd10c10844f

SHA1
3d788760041f33c02edc1dd0017d94a00974cde9

SHA256
84e9dffa63d3f7b9ff6c2ace76227b4e845663345dcacabcedb58d2059e04975

SHA512
65b497c17c9c8b25a4086b2ae65d572e465b8da29e214f50f0712f6d783ff8da03414bad56a393ae7fcff65dc7c7fff3e4ddc3be6e3459aefdf06c95b9d1384a

Download Submit
C:\Windows\System\YFbWzQv.exe

Filesize
1.9MB

MD5
5dd4149274572db09601ffd0a9e6aee5

SHA1
375eac5250fe751d1d34123a69560682e04e6f18

SHA256
dacfa22473fbe17f9105d3a4bd010174ccace7ccf234fa03d111aa8a5d7f3f68

SHA512
5d82a04caf6c84b5e8eae37ede0346d6bf0178a418ea2567e70c8c16878dc489abd15ccbeee45dd129a0635020f625246701c1c37c6b821bfd1bc21dea2c9ed7

Download Submit
C:\Windows\System\ZbYBbbk.exe

Filesize
1.9MB

MD5
ae7214db4f44aac3ae63ac97f9311705

SHA1
bc404af0aa6d30613492b5e6fdc1f34eb58e3b2f

SHA256
18351b418aba6f636092a2b4046ddf6356b6d90e1c66a7ea6147d429434496a3

SHA512
1f4f88262d63f501f321d5afcd75389dcc0466bce39c7e1bffa4869d73bc31263d97df7811a37eea3c19b2f791c1de25ec0209b2939d1ae70cadeef6bb00f532

Download Submit
C:\Windows\System\eGPADwA.exe

Filesize
1.9MB

MD5
8f1dedabe7718427b3963fbce448773a

SHA1
7a4fb1774cf0f159c7751f1270a8d1920fa66827

SHA256
30a3127ae2d46a9dfd46612e3bea0cccf6c98752ef797befeef40ef29d78416e

SHA512
801be77f091a83dfb918ede47a2b0f50e5ab6d2e8576c1bd494a81c86233064ab2d891c925856d4f5b0c0adfc95c020b2623581d95797f7257778b61fe4eec9c

Download Submit
C:\Windows\System\fiIpVDZ.exe

Filesize
1.9MB

MD5
651dc57d30a4918bf58918c4133d86ee

SHA1
8abe0d7669e82dd87a4739b7f6e17850815472a5

SHA256
3a655a760b657d4b85ff8fc964cf22cd10f7d47d0b3335b8a74a7e6f221384a4

SHA512
fcc86ba3bdb5362ad218d312e4d5af1f7ef49a1c4fe0b8205a75b1151237817c8199d50a7b516cde83e5398c684882f71fd40acfe7baeeaada1edcebd0ed3764

Download Submit
C:\Windows\System\gZYqAeb.exe

Filesize
1.9MB

MD5
a016de0b1ebe407e8e3da66bfdf6cc2e

SHA1
ccaa06d301581332f55588d888d1ef53b4fcb5ec

SHA256
08b5570f95c5e96ae6e886772ea1664e5f9c6a276e345ceca6307bab0ed81a62

SHA512
e337fca86785d91a8f8ee7aae387e3577e5bd449fa8733076c83bdb6ffbe66266dc15472d778232889c7bcd07b05f803236108b189b32d6d6de77eb14958e99d

Download Submit
C:\Windows\System\hHxdcwf.exe

Filesize
1.9MB

MD5
59ca956fda7d73e8077ba83d7e75389b

SHA1
15a89c270956603e9825d30b973c3b7e5f6dc749

SHA256
9aa8bd77b54a1ae3c25a93e2b64457e1a020473ae7b47057e7f1ab2be3b5fffc

SHA512
2a7e0c22dc51db3042b816044c195fd7096b72cd94bb5d063ef8e68024f68bbdd296c5a51ad9afe3d3856522a4e28ed7879497ca921f2f621ac87fdb2e37e3bb

Download Submit
C:\Windows\System\iSXKOOo.exe

Filesize
1.9MB

MD5
1cf1cbf64bc9f06641f45e20c9343989

SHA1
102f7f763c8db0871ac317fcb4a3aebe300024c0

SHA256
12a3e92e16a1a71034a6fe9e6190f23dd4a6400f662689bca01cc42410387e7a

SHA512
7db3f455e6218dee6845f994bc825dd08544c896698b11dc5edf7708456f678366daf24b6765912bb849277f80354fe14c0eb5748539909861c1a37fc1551254

Download Submit
C:\Windows\System\ivuIzKf.exe

Filesize
1.9MB

MD5
77b9ed4e656c214d85ca7979f4350ae0

SHA1
6014238869f2e6d8201c3b2efbdce213c31cb33f

SHA256
30f21b4512d9a3c595b96d4b3e20693bcb74ae6850d30f56ed260d42f3bda252

SHA512
0fc761f3bb0f26ab100829c9de84ce21c8278d4edd5ff4370959d1b96b8dcc8770219ba0a2c9aacc98e1c89942a09adbbce2ebb1b3bb29c469fa1ca48dc061c0

Download Submit
C:\Windows\System\jQIFgro.exe

Filesize
1.9MB

MD5
56f45b81ac8e80f17e4238ce0ad81436

SHA1
0616c16204b641a6cca8584590343a82152e0c48

SHA256
1ed3e16ae6682061ed47f22d75c133d4952c65b2fb3e4e9d299eaa762452518f

SHA512
ec0b0b98ad44294eaca69de0f876ea6ed1414919c43b2919fa28e78f3d2e449bd86a9f4be8a5a2788cd1a6ecff2d558a3744d49bdde4d91513a7a1da5a168663

Download Submit
C:\Windows\System\joRrvHr.exe

Filesize
1.9MB

MD5
6659ca768caa75209e5c95cc012e25dc

SHA1
969cc115412ae2eab6ca85f6aa9b86a71857c535

SHA256
59525d83d8b7c4dff3e5f1c5326f30dbaa70f55684bbbf8ee61f77e11e8c650e

SHA512
a1f2f30ce04e8feb55ea7ad1c949b068f9e29eaa291003f8cb2a351e465bd5c1586de63de2d5b120964b0155e963350d366da89957744dd84b33e81e63178857

Download Submit
C:\Windows\System\kcdfeAd.exe

Filesize
1.9MB

MD5
02504a4aa12aaf66325d18704206303d

SHA1
2d5fa3c569a6e86294c802d6f87511996def2381

SHA256
09d163d4fdc298d46b71b105d14dd5c00de83f3d071c70c7b76eab9bd70a51d6

SHA512
ca8499ac3fc76221d548f42c4b192561f79c8f909b9d7367348dfd247755a3081672d745568f5c1408b9cfec8f6cb549aef9bdb29623efb2e54b16154ef7f22f

Download Submit
C:\Windows\System\kfJTBoG.exe

Filesize
1.9MB

MD5
17fbd0aa39d2eae3de79c7d43b98e6d0

SHA1
14d3422757e23cf3ce2de484ed3f95dd9158de15

SHA256
ccdfc65cc0be7b89a22ed23582133cc0b2a09505036c5a4e06a264c2a7d58126

SHA512
5cf29e74d1c5bf0efcce3dfb6d73edc5dc031a16d83acac2367865bb884dc17b9a92ad1af118db67787ab5690a03658571f6114b4d3d7dab4a3909086fda904e

Download Submit
C:\Windows\System\mpgbzna.exe

Filesize
1.9MB

MD5
612ac1da4f9aaf936694cd34fb19f9fb

SHA1
27a422a1cec3314dc3463ca9a1ac5ccb4802c86e

SHA256
40e1dba1b1aa3120d5fa10eb10c0d2919a7e78338c2dab5c3384f6f32bb050b5

SHA512
69ed953d49ee401fe01857c759b16b65f6e6707aacd12271f523387e082f233c1454e7596e858ae702231129513a1c04dbe8a3e3dea2765e3613528bd0a7d5bf

Download Submit
C:\Windows\System\pxjZAXe.exe

Filesize
1.9MB

MD5
8f13b51b4999baf9125773588bbe19da

SHA1
ba858ba10f4682c67074dd7cb7aa3f8824e564af

SHA256
ffc01c18022a90f1356a8de3216968d4f290ac9b7ff869edf1f8a8c337200d3f

SHA512
35cf8fa6b69340949b1155c60075e2d7df3a1fd1d6b6c5b766e6f582d8bb28fc230b969a2a5690e74f205652d28f7408629a6f8951bc805e6542a43574fe55a8

Download Submit
C:\Windows\System\qoFGWMX.exe

Filesize
1.9MB

MD5
ee84a35e0b0c39fa7c7cc21cd251323f

SHA1
457c08995f4100a067bd758e6f4533405f6aee35

SHA256
06cfedc8445333752eca2d681d796e0ccdb15523fb15b05ebaec234d3e0bbe67

SHA512
aa4ab45bb6f334f7eac27761129e0fd9e07d191e87c05b5342e68bb6e834826304dfb10cb29c2551cf2d40bd64cb77c11ef0ece87ece33995bbc5e1b9b118da2

Download Submit
C:\Windows\System\qvGqilo.exe

Filesize
1.9MB

MD5
912c324f7cbdd913aaf7415384a69b6f

SHA1
22621c1e32af74a7b2c4a543dc7428aaddeda0a2

SHA256
509f2b0ac8c18d20fe513360a42bccc88ad66e062b37fe529ab5f31a96ba9216

SHA512
8aa976c32668fb2c1043cf2feb793ddcf6c757dd8797c9ccd39b7e86af83d448f4b5be4df13a3c0c5fa8911c739f80395eb77d2f808ede938393e1e89707dd25

Download Submit
C:\Windows\System\rqriwwM.exe

Filesize
1.9MB

MD5
d8cbbecb5cba32311e5dbf27839fd954

SHA1
2c2f284020bf3dfcdd7c1312511601cffac4fa55

SHA256
6e69baad3ef5fea7b81a54428b8a633e8074eae8857823dc2268770e459c1f63

SHA512
dc1f016a26d84891f38538c2f1e47bd494e571f1bbf49915ff58727fc449c7567928f6f576f75b63128bf62a818cd12484a0fb03334dd5467a8a3d020a5f9ffb

Download Submit
C:\Windows\System\rwlrUIb.exe

Filesize
1.9MB

MD5
58e3e44ec27ed1c46c83f69a2146f5ec

SHA1
69fdae420c4242701c27b3ba3c6eb9a4bc22ddf0

SHA256
ce9e5d9295c6564a1fda1986238181f26c52d33fa8c723cf623b0def4e478ba3

SHA512
114c114f46c9a163777e0d6602d921d8aa5730c5a472a6c943de16d8bbc4d3cb8dda3f8965975339c0e9eb4ab206237f3ff541ab03dd99144308b05ba16f758d

Download Submit
C:\Windows\System\ryQyQRl.exe

Filesize
1.9MB

MD5
5f6d71548c385d4aaa1f68b5f73cbe60

SHA1
bf6b80e27a935e543ee85cb2eda64ff9b312c25b

SHA256
ab7e206e3496d8c49f351449c35c6deb55256ebbb5d5122001a0ff5f75febbdd

SHA512
c1acc448b3b997c162d76524f472f63648bb62a8f93884a959981d7ff93453dde444891f2bcfb381171c97ce84fdf81b001b3d1063e4912146268054aefa52c8

Download Submit
C:\Windows\System\sXAzzbm.exe

Filesize
1.9MB

MD5
65dac2d0e150790111e049591bb468b3

SHA1
f4b89498bae8c7fc7bc02d8eb484ff87a4e43c93

SHA256
0c17ddcc950a81b093fe12e8cbace5d6d97de3523c68f804ee0bc8774e3b951a

SHA512
de38b2f5889d9fdf881cdc40f755361e07fac33a0785dcde0e81fa8fec5d4368d575bf9a2323103a71042df551c43f9f540d2130d63fb6e1143d1b39b6017d06

Download Submit
C:\Windows\System\smsyqqW.exe

Filesize
1.9MB

MD5
414a00e69e18a0337099e32b4c982291

SHA1
13f273e1684aecfe438c3b17f275f88f7a748770

SHA256
aefb6ade1b57eb82fbba3686fc181ef37fca3fd86dee0d12abce8b5b8f1d3ebf

SHA512
4cce60063ddf717d16878fc2fd5b746d20285fb2c9b4bd87b6cee00081c3258cc3f29767be9ae35988c1f4fd2bf568bdf567f14dfc5158e9c99150106afbc62d

Download Submit
C:\Windows\System\tyJTdkg.exe

Filesize
1.9MB

MD5
3a1c4ff4289c5748baaf7ed62aa2fbda

SHA1
0fe239d0935a40566f07c4f905fa0630c52d26b5

SHA256
d48a395f33827188b8fd103384c61e2a37cc1fbde295259113fbf74591de2bd5

SHA512
87239f77076e39e037f56e41eee4c8e2236855e04ca2c8174c17d1ec1227e6a9b5564f6591be4e338a031b625b13938ef92891fc7e741602f6320df2af2ef7b6

Download Submit
C:\Windows\System\uEvoSsc.exe

Filesize
1.9MB

MD5
f3ddf9455e459da138eb6e2dc3d812bb

SHA1
527cb6ea429bd8b5d2bf61fefbd2d3ee54e61f64

SHA256
267bf5ff6230ee51b8c503b6c585a14dac4c49d34aa3165c7882b0211516a2a9

SHA512
918d53e69588d2afbd6a7816506d8a1868e1ed13405dbe9fa46e301d52582ad4bd760a8c7ddd036c6e8cdf110c019ebed76aa23fc2361431722ca0f4b94f5b8a

Download Submit
C:\Windows\System\yJEustk.exe

Filesize
1.9MB

MD5
27b9c96ab4b2f9a2f97b1255a8f029bd

SHA1
3d64883ff5e43a1798b6f36e8d48bded0ffd42d5

SHA256
b01cd9586482fb4ba032f09bc90bb3f3a0156c880c7f9cf3dbfdffca7f22b639

SHA512
770f670864a86870678cf1216bf0726f1b6fe0a1817a2b6acb2723dc024f50a4c5f207e677ab81d35759c6deccb4eaccd8e8a97f0fefa5937b6fcde7ba187ecb

Download Submit
C:\Windows\System\yxoraQG.exe

Filesize
1.9MB

MD5
101bbb98d916f135c308a1cbf9e42dbc

SHA1
a7bdc622bb707880f7afbf0e61ab846527089122

SHA256
7cdc0f77ee063dc219e64045b546dd36be49a35cbaac75ccf5546e37c967666d

SHA512
1cda1835ce66a8818e53991698902b14f71ff270a6b1ca2898dd37860676dc82dd345e126216f0564fa665f66911f86996c03142f69e4058db4253eb7e41a970

Download Submit
memory/352-541-0x00007FF6630A0000-0x00007FF663492000-memory.dmp

Filesize
3.9MB

Download
memory/352-3111-0x00007FF6630A0000-0x00007FF663492000-memory.dmp

Filesize
3.9MB

Download
memory/400-3112-0x00007FF79C750000-0x00007FF79CB42000-memory.dmp

Filesize
3.9MB

Download
memory/400-545-0x00007FF79C750000-0x00007FF79CB42000-memory.dmp

Filesize
3.9MB

Download
memory/912-330-0x00007FF6E4380000-0x00007FF6E4772000-memory.dmp

Filesize
3.9MB

Download
memory/912-3099-0x00007FF6E4380000-0x00007FF6E4772000-memory.dmp

Filesize
3.9MB

Download
memory/1940-3094-0x00007FF633A60000-0x00007FF633E52000-memory.dmp

Filesize
3.9MB

Download
memory/1940-400-0x00007FF633A60000-0x00007FF633E52000-memory.dmp

Filesize
3.9MB

Download
memory/2016-3098-0x00007FF6D19F0000-0x00007FF6D1DE2000-memory.dmp

Filesize
3.9MB

Download
memory/2016-539-0x00007FF6D19F0000-0x00007FF6D1DE2000-memory.dmp

Filesize
3.9MB

Download
memory/2068-544-0x00007FF63CBC0000-0x00007FF63CFB2000-memory.dmp

Filesize
3.9MB

Download
memory/2068-3120-0x00007FF63CBC0000-0x00007FF63CFB2000-memory.dmp

Filesize
3.9MB

Download
memory/2080-3132-0x00007FF7BA590000-0x00007FF7BA982000-memory.dmp

Filesize
3.9MB

Download
memory/2080-542-0x00007FF7BA590000-0x00007FF7BA982000-memory.dmp

Filesize
3.9MB

Download
memory/2828-3102-0x00007FF76BE80000-0x00007FF76C272000-memory.dmp

Filesize
3.9MB

Download
memory/2828-253-0x00007FF76BE80000-0x00007FF76C272000-memory.dmp

Filesize
3.9MB

Download
memory/2924-3136-0x00007FF6606F0000-0x00007FF660AE2000-memory.dmp

Filesize
3.9MB

Download
memory/2924-546-0x00007FF6606F0000-0x00007FF660AE2000-memory.dmp

Filesize
3.9MB

Download
memory/3028-198-0x000001757F7C0000-0x000001757F7D0000-memory.dmp

Filesize
64KB

Download
memory/3028-136-0x00007FFE009D0000-0x00007FFE01491000-memory.dmp

Filesize
10.8MB

Download
memory/3028-391-0x000001757F740000-0x000001757F762000-memory.dmp

Filesize
136KB

Download
memory/3140-547-0x00007FF6F5E30000-0x00007FF6F6222000-memory.dmp

Filesize
3.9MB

Download
memory/3140-3084-0x00007FF6F5E30000-0x00007FF6F6222000-memory.dmp

Filesize
3.9MB

Download
memory/3512-1-0x0000025C16F20000-0x0000025C16F30000-memory.dmp

Filesize
64KB

Download
memory/3512-0-0x00007FF7B9F00000-0x00007FF7BA2F2000-memory.dmp

Filesize
3.9MB

Download
memory/3600-3113-0x00007FF6607B0000-0x00007FF660BA2000-memory.dmp

Filesize
3.9MB

Download
memory/3600-399-0x00007FF6607B0000-0x00007FF660BA2000-memory.dmp

Filesize
3.9MB

Download
memory/3756-3088-0x00007FF736600000-0x00007FF7369F2000-memory.dmp

Filesize
3.9MB

Download
memory/3756-54-0x00007FF736600000-0x00007FF7369F2000-memory.dmp

Filesize
3.9MB

Download
memory/3860-460-0x00007FF77D260000-0x00007FF77D652000-memory.dmp

Filesize
3.9MB

Download
memory/3860-3105-0x00007FF77D260000-0x00007FF77D652000-memory.dmp

Filesize
3.9MB

Download
memory/4088-527-0x00007FF75BFC0000-0x00007FF75C3B2000-memory.dmp

Filesize
3.9MB

Download
memory/4088-3103-0x00007FF75BFC0000-0x00007FF75C3B2000-memory.dmp

Filesize
3.9MB

Download
memory/4172-267-0x00007FF637140000-0x00007FF637532000-memory.dmp

Filesize
3.9MB

Download
memory/4172-3086-0x00007FF637140000-0x00007FF637532000-memory.dmp

Filesize
3.9MB

Download
memory/4444-548-0x00007FF680390000-0x00007FF680782000-memory.dmp

Filesize
3.9MB

Download
memory/4444-3114-0x00007FF680390000-0x00007FF680782000-memory.dmp

Filesize
3.9MB

Download
memory/4740-3090-0x00007FF766930000-0x00007FF766D22000-memory.dmp

Filesize
3.9MB

Download
memory/4740-302-0x00007FF766930000-0x00007FF766D22000-memory.dmp

Filesize
3.9MB

Download
memory/4852-16-0x00007FF664F40000-0x00007FF665332000-memory.dmp

Filesize
3.9MB

Download
memory/4852-3082-0x00007FF664F40000-0x00007FF665332000-memory.dmp

Filesize
3.9MB

Download
memory/4856-201-0x00007FF709140000-0x00007FF709532000-memory.dmp

Filesize
3.9MB

Download
memory/4856-3096-0x00007FF709140000-0x00007FF709532000-memory.dmp

Filesize
3.9MB

Download
memory/4940-540-0x00007FF64C2A0000-0x00007FF64C692000-memory.dmp

Filesize
3.9MB

Download
memory/4940-3119-0x00007FF64C2A0000-0x00007FF64C692000-memory.dmp

Filesize
3.9MB

Download
memory/5052-3125-0x00007FF657310000-0x00007FF657702000-memory.dmp

Filesize
3.9MB

Download
memory/5052-543-0x00007FF657310000-0x00007FF657702000-memory.dmp

Filesize
3.9MB

Download