xmrig | 605ea6465985d6f5406104563313cb0a721b41ba7c1bd385cea93163f3887782

Analysis

max time kernel
70s
max time network
50s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 04:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
Size

2.2MB
MD5

06d3e20f43bb657bff3304a23ba4b746
SHA1

103975a35d34f7cb778f30cb92b2d68e7e61ee49
SHA256

605ea6465985d6f5406104563313cb0a721b41ba7c1bd385cea93163f3887782
SHA512

6316d941bed439e2cfdfff00b12b28d094ebc957b8bec27d5263936f178e8e97b1c044866d4a92977a6c5a3c7d7970c37422efb981a1efc363e5db6bad5b61de
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfWe:NABy

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 42 IoCs

miner

resource	yara_rule
behavioral2/memory/1720-276-0x00007FF73F0D0000-0x00007FF73F4C2000-memory.dmp	xmrig
behavioral2/memory/2064-297-0x00007FF77B750000-0x00007FF77BB42000-memory.dmp	xmrig
behavioral2/memory/32-300-0x00007FF7A84E0000-0x00007FF7A88D2000-memory.dmp	xmrig
behavioral2/memory/4812-299-0x00007FF74D9A0000-0x00007FF74DD92000-memory.dmp	xmrig
behavioral2/memory/2800-298-0x00007FF6B8A80000-0x00007FF6B8E72000-memory.dmp	xmrig
behavioral2/memory/1184-296-0x00007FF7198C0000-0x00007FF719CB2000-memory.dmp	xmrig
behavioral2/memory/4632-295-0x00007FF758120000-0x00007FF758512000-memory.dmp	xmrig
behavioral2/memory/3060-294-0x00007FF77DF20000-0x00007FF77E312000-memory.dmp	xmrig
behavioral2/memory/3480-293-0x00007FF740E10000-0x00007FF741202000-memory.dmp	xmrig
behavioral2/memory/2928-292-0x00007FF75F800000-0x00007FF75FBF2000-memory.dmp	xmrig
behavioral2/memory/1676-291-0x00007FF7CCFC0000-0x00007FF7CD3B2000-memory.dmp	xmrig
behavioral2/memory/2160-289-0x00007FF6EE080000-0x00007FF6EE472000-memory.dmp	xmrig
behavioral2/memory/1284-288-0x00007FF781F90000-0x00007FF782382000-memory.dmp	xmrig
behavioral2/memory/4792-287-0x00007FF6E7390000-0x00007FF6E7782000-memory.dmp	xmrig
behavioral2/memory/3416-286-0x00007FF659BD0000-0x00007FF659FC2000-memory.dmp	xmrig
behavioral2/memory/4344-226-0x00007FF725830000-0x00007FF725C22000-memory.dmp	xmrig
behavioral2/memory/1956-193-0x00007FF70E9A0000-0x00007FF70ED92000-memory.dmp	xmrig
behavioral2/memory/1288-150-0x00007FF6C68E0000-0x00007FF6C6CD2000-memory.dmp	xmrig
behavioral2/memory/4908-139-0x00007FF6AB810000-0x00007FF6ABC02000-memory.dmp	xmrig
behavioral2/memory/4504-95-0x00007FF63B650000-0x00007FF63BA42000-memory.dmp	xmrig
behavioral2/memory/3612-61-0x00007FF706890000-0x00007FF706C82000-memory.dmp	xmrig
behavioral2/memory/4504-3223-0x00007FF63B650000-0x00007FF63BA42000-memory.dmp	xmrig
behavioral2/memory/3612-3225-0x00007FF706890000-0x00007FF706C82000-memory.dmp	xmrig
behavioral2/memory/1288-3227-0x00007FF6C68E0000-0x00007FF6C6CD2000-memory.dmp	xmrig
behavioral2/memory/4908-3229-0x00007FF6AB810000-0x00007FF6ABC02000-memory.dmp	xmrig
behavioral2/memory/4344-3231-0x00007FF725830000-0x00007FF725C22000-memory.dmp	xmrig
behavioral2/memory/1956-3243-0x00007FF70E9A0000-0x00007FF70ED92000-memory.dmp	xmrig
behavioral2/memory/2064-3245-0x00007FF77B750000-0x00007FF77BB42000-memory.dmp	xmrig
behavioral2/memory/2800-3247-0x00007FF6B8A80000-0x00007FF6B8E72000-memory.dmp	xmrig
behavioral2/memory/4792-3241-0x00007FF6E7390000-0x00007FF6E7782000-memory.dmp	xmrig
behavioral2/memory/1720-3240-0x00007FF73F0D0000-0x00007FF73F4C2000-memory.dmp	xmrig
behavioral2/memory/1184-3237-0x00007FF7198C0000-0x00007FF719CB2000-memory.dmp	xmrig
behavioral2/memory/3416-3235-0x00007FF659BD0000-0x00007FF659FC2000-memory.dmp	xmrig
behavioral2/memory/4812-3234-0x00007FF74D9A0000-0x00007FF74DD92000-memory.dmp	xmrig
behavioral2/memory/1284-3271-0x00007FF781F90000-0x00007FF782382000-memory.dmp	xmrig
behavioral2/memory/1676-3265-0x00007FF7CCFC0000-0x00007FF7CD3B2000-memory.dmp	xmrig
behavioral2/memory/2928-3264-0x00007FF75F800000-0x00007FF75FBF2000-memory.dmp	xmrig
behavioral2/memory/3060-3260-0x00007FF77DF20000-0x00007FF77E312000-memory.dmp	xmrig
behavioral2/memory/32-3261-0x00007FF7A84E0000-0x00007FF7A88D2000-memory.dmp	xmrig
behavioral2/memory/2160-3258-0x00007FF6EE080000-0x00007FF6EE472000-memory.dmp	xmrig
behavioral2/memory/4632-3275-0x00007FF758120000-0x00007FF758512000-memory.dmp	xmrig
behavioral2/memory/3480-3274-0x00007FF740E10000-0x00007FF741202000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3612	MNoFCZR.exe
1184	OboZMed.exe
4504	wLpYlzu.exe
4908	cgtodus.exe
1288	BNkTZgR.exe
1956	xoSJUBm.exe
4344	wNLmEbg.exe
2064	vMtngdb.exe
1720	tEIcWMs.exe
3416	NPPyQjL.exe
4792	bkWGrXZ.exe
1284	wjzEmSg.exe
2160	uDahtrA.exe
2800	RfgefhJ.exe
4812	PxXqXOU.exe
1676	akICJsB.exe
2928	aySyLHy.exe
3480	POBKhiX.exe
32	EJlmJVY.exe
3060	skPsSYB.exe
4632	WJdHgII.exe
1528	VPpJSid.exe
3660	akjHoJT.exe
4976	gFpTfXE.exe
4916	QtOvqPH.exe
628	WUvrsyq.exe
1752	HmMomsP.exe
4548	uNxeTSC.exe
1328	HKrjlLm.exe
4600	CyOBFYY.exe
1268	iNrZwdX.exe
4260	kxvlnUS.exe
624	UgADtrZ.exe
1168	ZkJgNKX.exe
2416	YrblPCi.exe
4800	hjRJBdv.exe
4324	CgyJVkp.exe
4104	YyDjMuN.exe
4984	tHWFqFm.exe
2180	ptHhLSG.exe
3840	nwJksPt.exe
2248	DEDQxaY.exe
3392	MHklTWJ.exe
3568	AlcqJsd.exe
5004	FJnxzmR.exe
4384	RRMTtfs.exe
1248	oXPXONL.exe
4940	jWxkjuV.exe
2396	kQzQKTN.exe
3560	MnlgLzf.exe
400	DQymKrm.exe
536	SRjzZHA.exe
3704	ratYvVk.exe
3680	jPZvVQx.exe
3860	yXLiGWw.exe
548	kvmPByL.exe
4448	QjSzmja.exe
388	kJBkVuT.exe
2524	DRQEJQd.exe
3924	bbRgwgr.exe
2636	ILZHnTv.exe
3384	llJssYy.exe
1236	YjDiGAh.exe
4752	cEocLMO.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2516-0-0x00007FF6162A0000-0x00007FF616692000-memory.dmp	upx
behavioral2/files/0x000a000000023bca-7.dat	upx
behavioral2/files/0x000a000000023bc9-10.dat	upx
behavioral2/files/0x000c000000023bc2-5.dat	upx
behavioral2/files/0x000a000000023bcb-30.dat	upx
behavioral2/files/0x000a000000023bd0-48.dat	upx
behavioral2/files/0x000a000000023bd9-94.dat	upx
behavioral2/files/0x000a000000023be2-126.dat	upx
behavioral2/files/0x000a000000023bdb-178.dat	upx
behavioral2/memory/1720-276-0x00007FF73F0D0000-0x00007FF73F4C2000-memory.dmp	upx
behavioral2/memory/2064-297-0x00007FF77B750000-0x00007FF77BB42000-memory.dmp	upx
behavioral2/memory/32-300-0x00007FF7A84E0000-0x00007FF7A88D2000-memory.dmp	upx
behavioral2/memory/4812-299-0x00007FF74D9A0000-0x00007FF74DD92000-memory.dmp	upx
behavioral2/memory/2800-298-0x00007FF6B8A80000-0x00007FF6B8E72000-memory.dmp	upx
behavioral2/memory/1184-296-0x00007FF7198C0000-0x00007FF719CB2000-memory.dmp	upx
behavioral2/memory/4632-295-0x00007FF758120000-0x00007FF758512000-memory.dmp	upx
behavioral2/memory/3060-294-0x00007FF77DF20000-0x00007FF77E312000-memory.dmp	upx
behavioral2/memory/3480-293-0x00007FF740E10000-0x00007FF741202000-memory.dmp	upx
behavioral2/memory/2928-292-0x00007FF75F800000-0x00007FF75FBF2000-memory.dmp	upx
behavioral2/memory/1676-291-0x00007FF7CCFC0000-0x00007FF7CD3B2000-memory.dmp	upx
behavioral2/memory/2160-289-0x00007FF6EE080000-0x00007FF6EE472000-memory.dmp	upx
behavioral2/memory/1284-288-0x00007FF781F90000-0x00007FF782382000-memory.dmp	upx
behavioral2/memory/4792-287-0x00007FF6E7390000-0x00007FF6E7782000-memory.dmp	upx
behavioral2/memory/3416-286-0x00007FF659BD0000-0x00007FF659FC2000-memory.dmp	upx
behavioral2/memory/4344-226-0x00007FF725830000-0x00007FF725C22000-memory.dmp	upx
behavioral2/files/0x0008000000023c11-198.dat	upx
behavioral2/files/0x0008000000023c10-197.dat	upx
behavioral2/files/0x0008000000023c0d-194.dat	upx
behavioral2/memory/1956-193-0x00007FF70E9A0000-0x00007FF70ED92000-memory.dmp	upx
behavioral2/files/0x000e000000023c0b-188.dat	upx
behavioral2/files/0x0009000000023c07-187.dat	upx
behavioral2/files/0x0009000000023c06-184.dat	upx
behavioral2/files/0x000a000000023bdc-182.dat	upx
behavioral2/files/0x0009000000023c05-181.dat	upx
behavioral2/files/0x0008000000023c00-180.dat	upx
behavioral2/files/0x000e000000023bf7-177.dat	upx
behavioral2/files/0x000a000000023bf0-176.dat	upx
behavioral2/files/0x000b000000023be8-168.dat	upx
behavioral2/files/0x000b000000023be7-165.dat	upx
behavioral2/files/0x000a000000023bd8-158.dat	upx
behavioral2/files/0x000a000000023bdd-111.dat	upx
behavioral2/files/0x000a000000023bd3-154.dat	upx
behavioral2/memory/1288-150-0x00007FF6C68E0000-0x00007FF6C6CD2000-memory.dmp	upx
behavioral2/files/0x000a000000023be5-144.dat	upx
behavioral2/memory/4908-139-0x00007FF6AB810000-0x00007FF6ABC02000-memory.dmp	upx
behavioral2/files/0x000a000000023be4-137.dat	upx
behavioral2/files/0x000a000000023be3-132.dat	upx
behavioral2/files/0x000a000000023be1-125.dat	upx
behavioral2/files/0x000a000000023bd5-121.dat	upx
behavioral2/files/0x000a000000023be0-117.dat	upx
behavioral2/files/0x000a000000023bdf-116.dat	upx
behavioral2/files/0x000a000000023bde-114.dat	upx
behavioral2/files/0x000a000000023bd7-151.dat	upx
behavioral2/files/0x000a000000023bd6-96.dat	upx
behavioral2/memory/4504-95-0x00007FF63B650000-0x00007FF63BA42000-memory.dmp	upx
behavioral2/files/0x000a000000023bda-124.dat	upx
behavioral2/files/0x000a000000023bd2-75.dat	upx
behavioral2/files/0x000a000000023bcf-86.dat	upx
behavioral2/memory/3612-61-0x00007FF706890000-0x00007FF706C82000-memory.dmp	upx
behavioral2/files/0x000a000000023bcd-83.dat	upx
behavioral2/files/0x000a000000023bd4-60.dat	upx
behavioral2/files/0x000a000000023bd1-56.dat	upx
behavioral2/files/0x000a000000023bce-36.dat	upx
behavioral2/files/0x000a000000023bcc-27.dat	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\HDHAQqU.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\iiQbaOm.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\OboZMed.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\cEocLMO.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\XRTwtbL.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\fyRHJeN.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\kFPyWKS.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\lkIHSCE.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\mBayZql.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\oKJnaer.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\cmkukTc.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\eAjdHcm.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\bPIVLyO.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\ntoIwYs.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\GGQvVRy.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\NFxWpnS.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\WqHVEbs.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\QXdFrle.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\kdsGdMR.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\vAtjnNv.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\dyNiOsX.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\feecFAR.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\AzrDeJh.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\yEvgJRC.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\NydwKtO.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\oRpegCp.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\yXbgKAS.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\mFOokkZ.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\hxQMlKW.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\zDOeptA.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\vLcSKDA.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\tFyRByH.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\rgwtoDy.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\PKzUdre.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\wdbaFUS.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\LfrfxDS.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\ZDjrsEU.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\jGSVazA.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\tgMwbDr.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\WLvZiqe.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\dwENTAW.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\yGnWyDk.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\ZGiYwGW.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\nJhJGMQ.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\eHVoWZd.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\rQFLWKK.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\znhqspo.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\CHZecse.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\TDaWZCA.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\wCfPARK.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\BJjXnba.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\JneaCqO.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\KXRQlGJ.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\zOLCEAV.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\RWsXUxu.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\KsrKsnD.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\LKFXLtn.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\fciukYP.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\JYQntyu.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\skSptWg.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\OdqhnDQ.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\cOGRFUK.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\phHOTZO.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\NFmIDij.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4796	powershell.exe
4796	powershell.exe
4796	powershell.exe
4796	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4796	powershell.exe
Token: SeLockMemoryPrivilege	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 4796	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	84
PID 2516 wrote to memory of 4796	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	84
PID 2516 wrote to memory of 3612	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	85
PID 2516 wrote to memory of 3612	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	85
PID 2516 wrote to memory of 1184	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	86
PID 2516 wrote to memory of 1184	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	86
PID 2516 wrote to memory of 4504	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	87
PID 2516 wrote to memory of 4504	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	87
PID 2516 wrote to memory of 4908	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	88
PID 2516 wrote to memory of 4908	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	88
PID 2516 wrote to memory of 1288	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	89
PID 2516 wrote to memory of 1288	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	89
PID 2516 wrote to memory of 1956	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	90
PID 2516 wrote to memory of 1956	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	90
PID 2516 wrote to memory of 4344	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	91
PID 2516 wrote to memory of 4344	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	91
PID 2516 wrote to memory of 2064	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	92
PID 2516 wrote to memory of 2064	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	92
PID 2516 wrote to memory of 1720	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	93
PID 2516 wrote to memory of 1720	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	93
PID 2516 wrote to memory of 3416	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	94
PID 2516 wrote to memory of 3416	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	94
PID 2516 wrote to memory of 4792	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	95
PID 2516 wrote to memory of 4792	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	95
PID 2516 wrote to memory of 1284	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	96
PID 2516 wrote to memory of 1284	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	96
PID 2516 wrote to memory of 2160	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	97
PID 2516 wrote to memory of 2160	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	97
PID 2516 wrote to memory of 2800	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	98
PID 2516 wrote to memory of 2800	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	98
PID 2516 wrote to memory of 4812	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	99
PID 2516 wrote to memory of 4812	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	99
PID 2516 wrote to memory of 1676	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	100
PID 2516 wrote to memory of 1676	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	100
PID 2516 wrote to memory of 2928	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	101
PID 2516 wrote to memory of 2928	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	101
PID 2516 wrote to memory of 3480	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	102
PID 2516 wrote to memory of 3480	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	102
PID 2516 wrote to memory of 4916	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	103
PID 2516 wrote to memory of 4916	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	103
PID 2516 wrote to memory of 32	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	104
PID 2516 wrote to memory of 32	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	104
PID 2516 wrote to memory of 3060	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	105
PID 2516 wrote to memory of 3060	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	105
PID 2516 wrote to memory of 4632	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	106
PID 2516 wrote to memory of 4632	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	106
PID 2516 wrote to memory of 1528	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	107
PID 2516 wrote to memory of 1528	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	107
PID 2516 wrote to memory of 3660	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	108
PID 2516 wrote to memory of 3660	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	108
PID 2516 wrote to memory of 4976	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	109
PID 2516 wrote to memory of 4976	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	109
PID 2516 wrote to memory of 628	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	110
PID 2516 wrote to memory of 628	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	110
PID 2516 wrote to memory of 1752	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	111
PID 2516 wrote to memory of 1752	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	111
PID 2516 wrote to memory of 4548	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	112
PID 2516 wrote to memory of 4548	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	112
PID 2516 wrote to memory of 1328	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	113
PID 2516 wrote to memory of 1328	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	113
PID 2516 wrote to memory of 4600	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	114
PID 2516 wrote to memory of 4600	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	114
PID 2516 wrote to memory of 3392	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	115
PID 2516 wrote to memory of 3392	2516	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4796
- C:\Windows\System\MNoFCZR.exe
  C:\Windows\System\MNoFCZR.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\OboZMed.exe
  C:\Windows\System\OboZMed.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\wLpYlzu.exe
  C:\Windows\System\wLpYlzu.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\cgtodus.exe
  C:\Windows\System\cgtodus.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\BNkTZgR.exe
  C:\Windows\System\BNkTZgR.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\xoSJUBm.exe
  C:\Windows\System\xoSJUBm.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\wNLmEbg.exe
  C:\Windows\System\wNLmEbg.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\vMtngdb.exe
  C:\Windows\System\vMtngdb.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\tEIcWMs.exe
  C:\Windows\System\tEIcWMs.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\NPPyQjL.exe
  C:\Windows\System\NPPyQjL.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\bkWGrXZ.exe
  C:\Windows\System\bkWGrXZ.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\wjzEmSg.exe
  C:\Windows\System\wjzEmSg.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\uDahtrA.exe
  C:\Windows\System\uDahtrA.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\RfgefhJ.exe
  C:\Windows\System\RfgefhJ.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\PxXqXOU.exe
  C:\Windows\System\PxXqXOU.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\akICJsB.exe
  C:\Windows\System\akICJsB.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\aySyLHy.exe
  C:\Windows\System\aySyLHy.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\POBKhiX.exe
  C:\Windows\System\POBKhiX.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\QtOvqPH.exe
  C:\Windows\System\QtOvqPH.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\EJlmJVY.exe
  C:\Windows\System\EJlmJVY.exe
  2⤵
  - Executes dropped EXE
  PID:32
- C:\Windows\System\skPsSYB.exe
  C:\Windows\System\skPsSYB.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\WJdHgII.exe
  C:\Windows\System\WJdHgII.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\VPpJSid.exe
  C:\Windows\System\VPpJSid.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\akjHoJT.exe
  C:\Windows\System\akjHoJT.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\gFpTfXE.exe
  C:\Windows\System\gFpTfXE.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\WUvrsyq.exe
  C:\Windows\System\WUvrsyq.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\HmMomsP.exe
  C:\Windows\System\HmMomsP.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\uNxeTSC.exe
  C:\Windows\System\uNxeTSC.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\HKrjlLm.exe
  C:\Windows\System\HKrjlLm.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\CyOBFYY.exe
  C:\Windows\System\CyOBFYY.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\MHklTWJ.exe
  C:\Windows\System\MHklTWJ.exe
  2⤵
  - Executes dropped EXE
  PID:3392
- C:\Windows\System\iNrZwdX.exe
  C:\Windows\System\iNrZwdX.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\kxvlnUS.exe
  C:\Windows\System\kxvlnUS.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\UgADtrZ.exe
  C:\Windows\System\UgADtrZ.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\ZkJgNKX.exe
  C:\Windows\System\ZkJgNKX.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\YrblPCi.exe
  C:\Windows\System\YrblPCi.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\hjRJBdv.exe
  C:\Windows\System\hjRJBdv.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\CgyJVkp.exe
  C:\Windows\System\CgyJVkp.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\YyDjMuN.exe
  C:\Windows\System\YyDjMuN.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\tHWFqFm.exe
  C:\Windows\System\tHWFqFm.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\ptHhLSG.exe
  C:\Windows\System\ptHhLSG.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\nwJksPt.exe
  C:\Windows\System\nwJksPt.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\DEDQxaY.exe
  C:\Windows\System\DEDQxaY.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\ratYvVk.exe
  C:\Windows\System\ratYvVk.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\AlcqJsd.exe
  C:\Windows\System\AlcqJsd.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\FJnxzmR.exe
  C:\Windows\System\FJnxzmR.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\RRMTtfs.exe
  C:\Windows\System\RRMTtfs.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\oXPXONL.exe
  C:\Windows\System\oXPXONL.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\jWxkjuV.exe
  C:\Windows\System\jWxkjuV.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\kQzQKTN.exe
  C:\Windows\System\kQzQKTN.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\MnlgLzf.exe
  C:\Windows\System\MnlgLzf.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\DQymKrm.exe
  C:\Windows\System\DQymKrm.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\SRjzZHA.exe
  C:\Windows\System\SRjzZHA.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\cEocLMO.exe
  C:\Windows\System\cEocLMO.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\jPZvVQx.exe
  C:\Windows\System\jPZvVQx.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System\yXLiGWw.exe
  C:\Windows\System\yXLiGWw.exe
  2⤵
  - Executes dropped EXE
  PID:3860
- C:\Windows\System\kvmPByL.exe
  C:\Windows\System\kvmPByL.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\VitWyfs.exe
  C:\Windows\System\VitWyfs.exe
  2⤵
  PID:4460
- C:\Windows\System\QjSzmja.exe
  C:\Windows\System\QjSzmja.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\kJBkVuT.exe
  C:\Windows\System\kJBkVuT.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\DRQEJQd.exe
  C:\Windows\System\DRQEJQd.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\bbRgwgr.exe
  C:\Windows\System\bbRgwgr.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\ILZHnTv.exe
  C:\Windows\System\ILZHnTv.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\llJssYy.exe
  C:\Windows\System\llJssYy.exe
  2⤵
  - Executes dropped EXE
  PID:3384
- C:\Windows\System\YjDiGAh.exe
  C:\Windows\System\YjDiGAh.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\MkfubuS.exe
  C:\Windows\System\MkfubuS.exe
  2⤵
  PID:4296
- C:\Windows\System\IDuheMK.exe
  C:\Windows\System\IDuheMK.exe
  2⤵
  PID:3332
- C:\Windows\System\UGPjDxb.exe
  C:\Windows\System\UGPjDxb.exe
  2⤵
  PID:1652
- C:\Windows\System\VysLREo.exe
  C:\Windows\System\VysLREo.exe
  2⤵
  PID:1572
- C:\Windows\System\eQdqXmO.exe
  C:\Windows\System\eQdqXmO.exe
  2⤵
  PID:3880
- C:\Windows\System\UvpsprD.exe
  C:\Windows\System\UvpsprD.exe
  2⤵
  PID:772
- C:\Windows\System\CFbvruw.exe
  C:\Windows\System\CFbvruw.exe
  2⤵
  PID:3632
- C:\Windows\System\FmvlMTf.exe
  C:\Windows\System\FmvlMTf.exe
  2⤵
  PID:4068
- C:\Windows\System\tBJluWj.exe
  C:\Windows\System\tBJluWj.exe
  2⤵
  PID:2036
- C:\Windows\System\rllSWde.exe
  C:\Windows\System\rllSWde.exe
  2⤵
  PID:3808
- C:\Windows\System\gGFgNiS.exe
  C:\Windows\System\gGFgNiS.exe
  2⤵
  PID:5064
- C:\Windows\System\TplrKXY.exe
  C:\Windows\System\TplrKXY.exe
  2⤵
  PID:2576
- C:\Windows\System\punZvBY.exe
  C:\Windows\System\punZvBY.exe
  2⤵
  PID:808
- C:\Windows\System\JBoafXY.exe
  C:\Windows\System\JBoafXY.exe
  2⤵
  PID:1044
- C:\Windows\System\QgezcVb.exe
  C:\Windows\System\QgezcVb.exe
  2⤵
  PID:5364
- C:\Windows\System\HSOhiRZ.exe
  C:\Windows\System\HSOhiRZ.exe
  2⤵
  PID:5416
- C:\Windows\System\tSXmSpm.exe
  C:\Windows\System\tSXmSpm.exe
  2⤵
  PID:5492
- C:\Windows\System\UCsVyQW.exe
  C:\Windows\System\UCsVyQW.exe
  2⤵
  PID:5540
- C:\Windows\System\bHmNwlU.exe
  C:\Windows\System\bHmNwlU.exe
  2⤵
  PID:5560
- C:\Windows\System\GYONiWB.exe
  C:\Windows\System\GYONiWB.exe
  2⤵
  PID:5580
- C:\Windows\System\LvdZGcI.exe
  C:\Windows\System\LvdZGcI.exe
  2⤵
  PID:5604
- C:\Windows\System\bQGCvNc.exe
  C:\Windows\System\bQGCvNc.exe
  2⤵
  PID:5624
- C:\Windows\System\gYshJRe.exe
  C:\Windows\System\gYshJRe.exe
  2⤵
  PID:5644
- C:\Windows\System\euFCwqI.exe
  C:\Windows\System\euFCwqI.exe
  2⤵
  PID:5668
- C:\Windows\System\aGhBEmF.exe
  C:\Windows\System\aGhBEmF.exe
  2⤵
  PID:5688
- C:\Windows\System\wwUAPmk.exe
  C:\Windows\System\wwUAPmk.exe
  2⤵
  PID:5704
- C:\Windows\System\ePlEqGw.exe
  C:\Windows\System\ePlEqGw.exe
  2⤵
  PID:5724
- C:\Windows\System\yvJgHGn.exe
  C:\Windows\System\yvJgHGn.exe
  2⤵
  PID:5828
- C:\Windows\System\jdavkcH.exe
  C:\Windows\System\jdavkcH.exe
  2⤵
  PID:5848
- C:\Windows\System\vRWSGyA.exe
  C:\Windows\System\vRWSGyA.exe
  2⤵
  PID:5864
- C:\Windows\System\ZjsIIMZ.exe
  C:\Windows\System\ZjsIIMZ.exe
  2⤵
  PID:5884
- C:\Windows\System\TeaEjie.exe
  C:\Windows\System\TeaEjie.exe
  2⤵
  PID:5904
- C:\Windows\System\PKvmubc.exe
  C:\Windows\System\PKvmubc.exe
  2⤵
  PID:5924
- C:\Windows\System\IAisfvN.exe
  C:\Windows\System\IAisfvN.exe
  2⤵
  PID:5944
- C:\Windows\System\bnwFNdB.exe
  C:\Windows\System\bnwFNdB.exe
  2⤵
  PID:5964
- C:\Windows\System\HqVRkXB.exe
  C:\Windows\System\HqVRkXB.exe
  2⤵
  PID:5984
- C:\Windows\System\RWsXUxu.exe
  C:\Windows\System\RWsXUxu.exe
  2⤵
  PID:6000
- C:\Windows\System\KBbVXgy.exe
  C:\Windows\System\KBbVXgy.exe
  2⤵
  PID:6024
- C:\Windows\System\QHIgSjN.exe
  C:\Windows\System\QHIgSjN.exe
  2⤵
  PID:6040
- C:\Windows\System\iUYqLOU.exe
  C:\Windows\System\iUYqLOU.exe
  2⤵
  PID:6060
- C:\Windows\System\VohMhlY.exe
  C:\Windows\System\VohMhlY.exe
  2⤵
  PID:6080
- C:\Windows\System\dUlhGvt.exe
  C:\Windows\System\dUlhGvt.exe
  2⤵
  PID:6100
- C:\Windows\System\vqMbcEY.exe
  C:\Windows\System\vqMbcEY.exe
  2⤵
  PID:6116
- C:\Windows\System\EPQCDZL.exe
  C:\Windows\System\EPQCDZL.exe
  2⤵
  PID:3812
- C:\Windows\System\ZFjjRgm.exe
  C:\Windows\System\ZFjjRgm.exe
  2⤵
  PID:2156
- C:\Windows\System\jEVkVoc.exe
  C:\Windows\System\jEVkVoc.exe
  2⤵
  PID:3396
- C:\Windows\System\jpUFcdw.exe
  C:\Windows\System\jpUFcdw.exe
  2⤵
  PID:4396
- C:\Windows\System\vZIhyHh.exe
  C:\Windows\System\vZIhyHh.exe
  2⤵
  PID:2232
- C:\Windows\System\CdOyQvW.exe
  C:\Windows\System\CdOyQvW.exe
  2⤵
  PID:5012
- C:\Windows\System\EUPkQqY.exe
  C:\Windows\System\EUPkQqY.exe
  2⤵
  PID:3088
- C:\Windows\System\kFPyWKS.exe
  C:\Windows\System\kFPyWKS.exe
  2⤵
  PID:3864
- C:\Windows\System\uaoVgML.exe
  C:\Windows\System\uaoVgML.exe
  2⤵
  PID:3276
- C:\Windows\System\keToBze.exe
  C:\Windows\System\keToBze.exe
  2⤵
  PID:5052
- C:\Windows\System\OBjbcpK.exe
  C:\Windows\System\OBjbcpK.exe
  2⤵
  PID:1432
- C:\Windows\System\oaUSATt.exe
  C:\Windows\System\oaUSATt.exe
  2⤵
  PID:4208
- C:\Windows\System\DlsWMbR.exe
  C:\Windows\System\DlsWMbR.exe
  2⤵
  PID:2544
- C:\Windows\System\rumUWHC.exe
  C:\Windows\System\rumUWHC.exe
  2⤵
  PID:2028
- C:\Windows\System\CvRzqZH.exe
  C:\Windows\System\CvRzqZH.exe
  2⤵
  PID:2164
- C:\Windows\System\acySOZY.exe
  C:\Windows\System\acySOZY.exe
  2⤵
  PID:3564
- C:\Windows\System\SJLPgdQ.exe
  C:\Windows\System\SJLPgdQ.exe
  2⤵
  PID:1180
- C:\Windows\System\SmnRadU.exe
  C:\Windows\System\SmnRadU.exe
  2⤵
  PID:404
- C:\Windows\System\eIumbHv.exe
  C:\Windows\System\eIumbHv.exe
  2⤵
  PID:1072
- C:\Windows\System\bhBTDiQ.exe
  C:\Windows\System\bhBTDiQ.exe
  2⤵
  PID:3936
- C:\Windows\System\mepyOea.exe
  C:\Windows\System\mepyOea.exe
  2⤵
  PID:836
- C:\Windows\System\XRTwtbL.exe
  C:\Windows\System\XRTwtbL.exe
  2⤵
  PID:3572
- C:\Windows\System\bXzbRpB.exe
  C:\Windows\System\bXzbRpB.exe
  2⤵
  PID:2080
- C:\Windows\System\eahRxrP.exe
  C:\Windows\System\eahRxrP.exe
  2⤵
  PID:640
- C:\Windows\System\qbasupK.exe
  C:\Windows\System\qbasupK.exe
  2⤵
  PID:5156
- C:\Windows\System\EKDEezM.exe
  C:\Windows\System\EKDEezM.exe
  2⤵
  PID:5252
- C:\Windows\System\WLvZiqe.exe
  C:\Windows\System\WLvZiqe.exe
  2⤵
  PID:5280
- C:\Windows\System\ZxuoYEk.exe
  C:\Windows\System\ZxuoYEk.exe
  2⤵
  PID:3204
- C:\Windows\System\shSRpRE.exe
  C:\Windows\System\shSRpRE.exe
  2⤵
  PID:5620
- C:\Windows\System\dukBCMr.exe
  C:\Windows\System\dukBCMr.exe
  2⤵
  PID:5664
- C:\Windows\System\ArSvflP.exe
  C:\Windows\System\ArSvflP.exe
  2⤵
  PID:5716
- C:\Windows\System\dbyzIWt.exe
  C:\Windows\System\dbyzIWt.exe
  2⤵
  PID:5816
- C:\Windows\System\zrNDRpO.exe
  C:\Windows\System\zrNDRpO.exe
  2⤵
  PID:5512
- C:\Windows\System\iaMOeFo.exe
  C:\Windows\System\iaMOeFo.exe
  2⤵
  PID:5860
- C:\Windows\System\FOANPUV.exe
  C:\Windows\System\FOANPUV.exe
  2⤵
  PID:5900
- C:\Windows\System\CECVxTX.exe
  C:\Windows\System\CECVxTX.exe
  2⤵
  PID:5532
- C:\Windows\System\JYQntyu.exe
  C:\Windows\System\JYQntyu.exe
  2⤵
  PID:5940
- C:\Windows\System\zDOeptA.exe
  C:\Windows\System\zDOeptA.exe
  2⤵
  PID:5424
- C:\Windows\System\heCDAEl.exe
  C:\Windows\System\heCDAEl.exe
  2⤵
  PID:5556
- C:\Windows\System\nDmCPQt.exe
  C:\Windows\System\nDmCPQt.exe
  2⤵
  PID:5596
- C:\Windows\System\BSqXkhH.exe
  C:\Windows\System\BSqXkhH.exe
  2⤵
  PID:6008
- C:\Windows\System\OcIVwHd.exe
  C:\Windows\System\OcIVwHd.exe
  2⤵
  PID:6076
- C:\Windows\System\ejtWogM.exe
  C:\Windows\System\ejtWogM.exe
  2⤵
  PID:5960
- C:\Windows\System\GPiUPvM.exe
  C:\Windows\System\GPiUPvM.exe
  2⤵
  PID:3756
- C:\Windows\System\axtFRkV.exe
  C:\Windows\System\axtFRkV.exe
  2⤵
  PID:6128
- C:\Windows\System\mXZgnMv.exe
  C:\Windows\System\mXZgnMv.exe
  2⤵
  PID:3328
- C:\Windows\System\oZtYzyv.exe
  C:\Windows\System\oZtYzyv.exe
  2⤵
  PID:512
- C:\Windows\System\CkcqZqn.exe
  C:\Windows\System\CkcqZqn.exe
  2⤵
  PID:868
- C:\Windows\System\Sswtckg.exe
  C:\Windows\System\Sswtckg.exe
  2⤵
  PID:4588
- C:\Windows\System\elyHcsf.exe
  C:\Windows\System\elyHcsf.exe
  2⤵
  PID:3260
- C:\Windows\System\gBubZGg.exe
  C:\Windows\System\gBubZGg.exe
  2⤵
  PID:3856
- C:\Windows\System\tdGbBhi.exe
  C:\Windows\System\tdGbBhi.exe
  2⤵
  PID:3836
- C:\Windows\System\pIMlXQk.exe
  C:\Windows\System\pIMlXQk.exe
  2⤵
  PID:5508
- C:\Windows\System\KbMnYRa.exe
  C:\Windows\System\KbMnYRa.exe
  2⤵
  PID:5840
- C:\Windows\System\soQwvGJ.exe
  C:\Windows\System\soQwvGJ.exe
  2⤵
  PID:5528
- C:\Windows\System\EJBofTu.exe
  C:\Windows\System\EJBofTu.exe
  2⤵
  PID:3264
- C:\Windows\System\mVtzJPq.exe
  C:\Windows\System\mVtzJPq.exe
  2⤵
  PID:4464
- C:\Windows\System\bbuTTSI.exe
  C:\Windows\System\bbuTTSI.exe
  2⤵
  PID:5276
- C:\Windows\System\xVChmAs.exe
  C:\Windows\System\xVChmAs.exe
  2⤵
  PID:1272
- C:\Windows\System\XjcHEWS.exe
  C:\Windows\System\XjcHEWS.exe
  2⤵
  PID:652
- C:\Windows\System\yYgdaDP.exe
  C:\Windows\System\yYgdaDP.exe
  2⤵
  PID:5504
- C:\Windows\System\zHbQUGL.exe
  C:\Windows\System\zHbQUGL.exe
  2⤵
  PID:5568
- C:\Windows\System\jLciiVe.exe
  C:\Windows\System\jLciiVe.exe
  2⤵
  PID:6164
- C:\Windows\System\CYGVdqS.exe
  C:\Windows\System\CYGVdqS.exe
  2⤵
  PID:6188
- C:\Windows\System\gIQUbcP.exe
  C:\Windows\System\gIQUbcP.exe
  2⤵
  PID:6212
- C:\Windows\System\cuKzCeV.exe
  C:\Windows\System\cuKzCeV.exe
  2⤵
  PID:6236
- C:\Windows\System\uUcAyda.exe
  C:\Windows\System\uUcAyda.exe
  2⤵
  PID:6268
- C:\Windows\System\HDHAQqU.exe
  C:\Windows\System\HDHAQqU.exe
  2⤵
  PID:6284
- C:\Windows\System\NWXgBsf.exe
  C:\Windows\System\NWXgBsf.exe
  2⤵
  PID:6304
- C:\Windows\System\UVeFwsx.exe
  C:\Windows\System\UVeFwsx.exe
  2⤵
  PID:6324
- C:\Windows\System\NJGdvGp.exe
  C:\Windows\System\NJGdvGp.exe
  2⤵
  PID:6348
- C:\Windows\System\skSptWg.exe
  C:\Windows\System\skSptWg.exe
  2⤵
  PID:6368
- C:\Windows\System\XeHvqWp.exe
  C:\Windows\System\XeHvqWp.exe
  2⤵
  PID:6388
- C:\Windows\System\OdqhnDQ.exe
  C:\Windows\System\OdqhnDQ.exe
  2⤵
  PID:6412
- C:\Windows\System\rgoDXal.exe
  C:\Windows\System\rgoDXal.exe
  2⤵
  PID:6436
- C:\Windows\System\eRLEUJI.exe
  C:\Windows\System\eRLEUJI.exe
  2⤵
  PID:6456
- C:\Windows\System\LZWPorB.exe
  C:\Windows\System\LZWPorB.exe
  2⤵
  PID:6480
- C:\Windows\System\JhAMHnH.exe
  C:\Windows\System\JhAMHnH.exe
  2⤵
  PID:6504
- C:\Windows\System\dakLNAC.exe
  C:\Windows\System\dakLNAC.exe
  2⤵
  PID:6520
- C:\Windows\System\WBWHDzV.exe
  C:\Windows\System\WBWHDzV.exe
  2⤵
  PID:6544
- C:\Windows\System\tWirqHO.exe
  C:\Windows\System\tWirqHO.exe
  2⤵
  PID:6572
- C:\Windows\System\KXDobXf.exe
  C:\Windows\System\KXDobXf.exe
  2⤵
  PID:6592
- C:\Windows\System\KTyIujg.exe
  C:\Windows\System\KTyIujg.exe
  2⤵
  PID:6612
- C:\Windows\System\pBtHnNR.exe
  C:\Windows\System\pBtHnNR.exe
  2⤵
  PID:6636
- C:\Windows\System\rruROAJ.exe
  C:\Windows\System\rruROAJ.exe
  2⤵
  PID:6660
- C:\Windows\System\GGQvVRy.exe
  C:\Windows\System\GGQvVRy.exe
  2⤵
  PID:6676
- C:\Windows\System\fOuKSFH.exe
  C:\Windows\System\fOuKSFH.exe
  2⤵
  PID:6692
- C:\Windows\System\GvRJopI.exe
  C:\Windows\System\GvRJopI.exe
  2⤵
  PID:6720
- C:\Windows\System\afFdifz.exe
  C:\Windows\System\afFdifz.exe
  2⤵
  PID:6744
- C:\Windows\System\NFxWpnS.exe
  C:\Windows\System\NFxWpnS.exe
  2⤵
  PID:6768
- C:\Windows\System\GgAFkor.exe
  C:\Windows\System\GgAFkor.exe
  2⤵
  PID:6788
- C:\Windows\System\phmRrco.exe
  C:\Windows\System\phmRrco.exe
  2⤵
  PID:6812
- C:\Windows\System\QOrTqHO.exe
  C:\Windows\System\QOrTqHO.exe
  2⤵
  PID:6832
- C:\Windows\System\RbpFErt.exe
  C:\Windows\System\RbpFErt.exe
  2⤵
  PID:6860
- C:\Windows\System\gUzRaDE.exe
  C:\Windows\System\gUzRaDE.exe
  2⤵
  PID:6892
- C:\Windows\System\ZtWgzGR.exe
  C:\Windows\System\ZtWgzGR.exe
  2⤵
  PID:6912
- C:\Windows\System\TQyiiFt.exe
  C:\Windows\System\TQyiiFt.exe
  2⤵
  PID:6936
- C:\Windows\System\qNlCFBV.exe
  C:\Windows\System\qNlCFBV.exe
  2⤵
  PID:6952
- C:\Windows\System\oqDuchz.exe
  C:\Windows\System\oqDuchz.exe
  2⤵
  PID:6976
- C:\Windows\System\QMHIMna.exe
  C:\Windows\System\QMHIMna.exe
  2⤵
  PID:7000
- C:\Windows\System\qXrzsPA.exe
  C:\Windows\System\qXrzsPA.exe
  2⤵
  PID:7020
- C:\Windows\System\JuinqTG.exe
  C:\Windows\System\JuinqTG.exe
  2⤵
  PID:7044
- C:\Windows\System\xTiNZFj.exe
  C:\Windows\System\xTiNZFj.exe
  2⤵
  PID:7080
- C:\Windows\System\yoBCbTE.exe
  C:\Windows\System\yoBCbTE.exe
  2⤵
  PID:7108
- C:\Windows\System\kxLSJuZ.exe
  C:\Windows\System\kxLSJuZ.exe
  2⤵
  PID:7128
- C:\Windows\System\XtOkqyb.exe
  C:\Windows\System\XtOkqyb.exe
  2⤵
  PID:7152
- C:\Windows\System\sosFhSx.exe
  C:\Windows\System\sosFhSx.exe
  2⤵
  PID:6048
- C:\Windows\System\EtOkMyd.exe
  C:\Windows\System\EtOkMyd.exe
  2⤵
  PID:5656
- C:\Windows\System\ECFGHSr.exe
  C:\Windows\System\ECFGHSr.exe
  2⤵
  PID:4712
- C:\Windows\System\eslsPUM.exe
  C:\Windows\System\eslsPUM.exe
  2⤵
  PID:5356
- C:\Windows\System\FGWlgka.exe
  C:\Windows\System\FGWlgka.exe
  2⤵
  PID:4192
- C:\Windows\System\bNlyUWH.exe
  C:\Windows\System\bNlyUWH.exe
  2⤵
  PID:6156
- C:\Windows\System\lkIHSCE.exe
  C:\Windows\System\lkIHSCE.exe
  2⤵
  PID:6176
- C:\Windows\System\oiUGnTB.exe
  C:\Windows\System\oiUGnTB.exe
  2⤵
  PID:6204
- C:\Windows\System\nzauFqq.exe
  C:\Windows\System\nzauFqq.exe
  2⤵
  PID:6224
- C:\Windows\System\NihTNPn.exe
  C:\Windows\System\NihTNPn.exe
  2⤵
  PID:6252
- C:\Windows\System\wEUtXuX.exe
  C:\Windows\System\wEUtXuX.exe
  2⤵
  PID:6316
- C:\Windows\System\tfhkxsv.exe
  C:\Windows\System\tfhkxsv.exe
  2⤵
  PID:6408
- C:\Windows\System\gTrhVeN.exe
  C:\Windows\System\gTrhVeN.exe
  2⤵
  PID:6552
- C:\Windows\System\TVtWiZk.exe
  C:\Windows\System\TVtWiZk.exe
  2⤵
  PID:6604
- C:\Windows\System\ITHMoEb.exe
  C:\Windows\System\ITHMoEb.exe
  2⤵
  PID:6760
- C:\Windows\System\DpDyqKb.exe
  C:\Windows\System\DpDyqKb.exe
  2⤵
  PID:6800
- C:\Windows\System\WfVUqRY.exe
  C:\Windows\System\WfVUqRY.exe
  2⤵
  PID:6844
- C:\Windows\System\aXsDMXP.exe
  C:\Windows\System\aXsDMXP.exe
  2⤵
  PID:6296
- C:\Windows\System\DKrbSbg.exe
  C:\Windows\System\DKrbSbg.exe
  2⤵
  PID:6344
- C:\Windows\System\huuxZkF.exe
  C:\Windows\System\huuxZkF.exe
  2⤵
  PID:6992
- C:\Windows\System\SaEkgqp.exe
  C:\Windows\System\SaEkgqp.exe
  2⤵
  PID:7060
- C:\Windows\System\vLcSKDA.exe
  C:\Windows\System\vLcSKDA.exe
  2⤵
  PID:6512
- C:\Windows\System\VZVKJoz.exe
  C:\Windows\System\VZVKJoz.exe
  2⤵
  PID:7188
- C:\Windows\System\ltwbHbc.exe
  C:\Windows\System\ltwbHbc.exe
  2⤵
  PID:7208
- C:\Windows\System\bGXfGZx.exe
  C:\Windows\System\bGXfGZx.exe
  2⤵
  PID:7228
- C:\Windows\System\joenWRj.exe
  C:\Windows\System\joenWRj.exe
  2⤵
  PID:7252
- C:\Windows\System\NwsGkVp.exe
  C:\Windows\System\NwsGkVp.exe
  2⤵
  PID:7276
- C:\Windows\System\aMKkKDs.exe
  C:\Windows\System\aMKkKDs.exe
  2⤵
  PID:7304
- C:\Windows\System\mNvdtAM.exe
  C:\Windows\System\mNvdtAM.exe
  2⤵
  PID:7320
- C:\Windows\System\CwlCVwT.exe
  C:\Windows\System\CwlCVwT.exe
  2⤵
  PID:7344
- C:\Windows\System\nyLulyv.exe
  C:\Windows\System\nyLulyv.exe
  2⤵
  PID:7360
- C:\Windows\System\qxLCxGC.exe
  C:\Windows\System\qxLCxGC.exe
  2⤵
  PID:7388
- C:\Windows\System\CSsEuGt.exe
  C:\Windows\System\CSsEuGt.exe
  2⤵
  PID:7408
- C:\Windows\System\IgTiVRr.exe
  C:\Windows\System\IgTiVRr.exe
  2⤵
  PID:7432
- C:\Windows\System\LeOcXrC.exe
  C:\Windows\System\LeOcXrC.exe
  2⤵
  PID:7460
- C:\Windows\System\Ewbwrdo.exe
  C:\Windows\System\Ewbwrdo.exe
  2⤵
  PID:7484
- C:\Windows\System\TVwBxss.exe
  C:\Windows\System\TVwBxss.exe
  2⤵
  PID:7504
- C:\Windows\System\MMtuAME.exe
  C:\Windows\System\MMtuAME.exe
  2⤵
  PID:7528
- C:\Windows\System\pufDduM.exe
  C:\Windows\System\pufDduM.exe
  2⤵
  PID:7552
- C:\Windows\System\cCjeUYj.exe
  C:\Windows\System\cCjeUYj.exe
  2⤵
  PID:7568
- C:\Windows\System\wcKUmnq.exe
  C:\Windows\System\wcKUmnq.exe
  2⤵
  PID:7588
- C:\Windows\System\DsjrSPJ.exe
  C:\Windows\System\DsjrSPJ.exe
  2⤵
  PID:7612
- C:\Windows\System\lKmaPek.exe
  C:\Windows\System\lKmaPek.exe
  2⤵
  PID:7636
- C:\Windows\System\NbCWuaV.exe
  C:\Windows\System\NbCWuaV.exe
  2⤵
  PID:7656
- C:\Windows\System\bVKddyM.exe
  C:\Windows\System\bVKddyM.exe
  2⤵
  PID:7676
- C:\Windows\System\YZtgyXm.exe
  C:\Windows\System\YZtgyXm.exe
  2⤵
  PID:7696
- C:\Windows\System\LTJYRDn.exe
  C:\Windows\System\LTJYRDn.exe
  2⤵
  PID:7712
- C:\Windows\System\MWFyJre.exe
  C:\Windows\System\MWFyJre.exe
  2⤵
  PID:7736
- C:\Windows\System\xfkbpKV.exe
  C:\Windows\System\xfkbpKV.exe
  2⤵
  PID:7760
- C:\Windows\System\QYXIgeS.exe
  C:\Windows\System\QYXIgeS.exe
  2⤵
  PID:7780
- C:\Windows\System\DNYIUJJ.exe
  C:\Windows\System\DNYIUJJ.exe
  2⤵
  PID:7800
- C:\Windows\System\RsWCgMW.exe
  C:\Windows\System\RsWCgMW.exe
  2⤵
  PID:7824
- C:\Windows\System\xAecHGT.exe
  C:\Windows\System\xAecHGT.exe
  2⤵
  PID:7852
- C:\Windows\System\Ldtoiea.exe
  C:\Windows\System\Ldtoiea.exe
  2⤵
  PID:7876
- C:\Windows\System\QdMfdKG.exe
  C:\Windows\System\QdMfdKG.exe
  2⤵
  PID:7896
- C:\Windows\System\QVgpZYL.exe
  C:\Windows\System\QVgpZYL.exe
  2⤵
  PID:7916
- C:\Windows\System\VSFaBmv.exe
  C:\Windows\System\VSFaBmv.exe
  2⤵
  PID:7944
- C:\Windows\System\eHVoWZd.exe
  C:\Windows\System\eHVoWZd.exe
  2⤵
  PID:7968
- C:\Windows\System\yUouEHD.exe
  C:\Windows\System\yUouEHD.exe
  2⤵
  PID:7988
- C:\Windows\System\PKzUdre.exe
  C:\Windows\System\PKzUdre.exe
  2⤵
  PID:8012
- C:\Windows\System\WqHVEbs.exe
  C:\Windows\System\WqHVEbs.exe
  2⤵
  PID:8032
- C:\Windows\System\vTvZCOb.exe
  C:\Windows\System\vTvZCOb.exe
  2⤵
  PID:8056
- C:\Windows\System\ibuxYtW.exe
  C:\Windows\System\ibuxYtW.exe
  2⤵
  PID:8084
- C:\Windows\System\XZPaodq.exe
  C:\Windows\System\XZPaodq.exe
  2⤵
  PID:8100
- C:\Windows\System\YCmujpn.exe
  C:\Windows\System\YCmujpn.exe
  2⤵
  PID:8128
- C:\Windows\System\GoGMvfu.exe
  C:\Windows\System\GoGMvfu.exe
  2⤵
  PID:8148
- C:\Windows\System\EQHBckW.exe
  C:\Windows\System\EQHBckW.exe
  2⤵
  PID:8164
- C:\Windows\System\yBDoSlY.exe
  C:\Windows\System\yBDoSlY.exe
  2⤵
  PID:8184
- C:\Windows\System\lOdzckc.exe
  C:\Windows\System\lOdzckc.exe
  2⤵
  PID:6708
- C:\Windows\System\iNGVXJd.exe
  C:\Windows\System\iNGVXJd.exe
  2⤵
  PID:6736
- C:\Windows\System\xHSyvPL.exe
  C:\Windows\System\xHSyvPL.exe
  2⤵
  PID:5376
- C:\Windows\System\zSJzXGr.exe
  C:\Windows\System\zSJzXGr.exe
  2⤵
  PID:6256
- C:\Windows\System\QyxDdNh.exe
  C:\Windows\System\QyxDdNh.exe
  2⤵
  PID:6924
- C:\Windows\System\ynqznjO.exe
  C:\Windows\System\ynqznjO.exe
  2⤵
  PID:6824
- C:\Windows\System\KpAUQQM.exe
  C:\Windows\System\KpAUQQM.exe
  2⤵
  PID:7016
- C:\Windows\System\MUklMFM.exe
  C:\Windows\System\MUklMFM.exe
  2⤵
  PID:6528
- C:\Windows\System\cOXChkz.exe
  C:\Windows\System\cOXChkz.exe
  2⤵
  PID:7036
- C:\Windows\System\dzkqJzm.exe
  C:\Windows\System\dzkqJzm.exe
  2⤵
  PID:1928
- C:\Windows\System\TxtfRbq.exe
  C:\Windows\System\TxtfRbq.exe
  2⤵
  PID:6752
- C:\Windows\System\hdbjdiM.exe
  C:\Windows\System\hdbjdiM.exe
  2⤵
  PID:7292
- C:\Windows\System\uDimNNY.exe
  C:\Windows\System\uDimNNY.exe
  2⤵
  PID:7328
- C:\Windows\System\uCufXxn.exe
  C:\Windows\System\uCufXxn.exe
  2⤵
  PID:7440
- C:\Windows\System\fyRHJeN.exe
  C:\Windows\System\fyRHJeN.exe
  2⤵
  PID:6332
- C:\Windows\System\shOOxnC.exe
  C:\Windows\System\shOOxnC.exe
  2⤵
  PID:1096
- C:\Windows\System\FwhLVgg.exe
  C:\Windows\System\FwhLVgg.exe
  2⤵
  PID:5880
- C:\Windows\System\GwlWfNc.exe
  C:\Windows\System\GwlWfNc.exe
  2⤵
  PID:7672
- C:\Windows\System\luExZyR.exe
  C:\Windows\System\luExZyR.exe
  2⤵
  PID:7744
- C:\Windows\System\AaZRhMV.exe
  C:\Windows\System\AaZRhMV.exe
  2⤵
  PID:6476
- C:\Windows\System\LqtkLGV.exe
  C:\Windows\System\LqtkLGV.exe
  2⤵
  PID:7816
- C:\Windows\System\bxvinBJ.exe
  C:\Windows\System\bxvinBJ.exe
  2⤵
  PID:6564
- C:\Windows\System\LwZKTmo.exe
  C:\Windows\System\LwZKTmo.exe
  2⤵
  PID:7160
- C:\Windows\System\YzYnPfv.exe
  C:\Windows\System\YzYnPfv.exe
  2⤵
  PID:8212
- C:\Windows\System\rkcHBze.exe
  C:\Windows\System\rkcHBze.exe
  2⤵
  PID:8240
- C:\Windows\System\eWPSQLP.exe
  C:\Windows\System\eWPSQLP.exe
  2⤵
  PID:8264
- C:\Windows\System\omIGfbf.exe
  C:\Windows\System\omIGfbf.exe
  2⤵
  PID:8288
- C:\Windows\System\dwENTAW.exe
  C:\Windows\System\dwENTAW.exe
  2⤵
  PID:8308
- C:\Windows\System\rpglKmp.exe
  C:\Windows\System\rpglKmp.exe
  2⤵
  PID:8332
- C:\Windows\System\HSsghHR.exe
  C:\Windows\System\HSsghHR.exe
  2⤵
  PID:8360
- C:\Windows\System\UxqLnGQ.exe
  C:\Windows\System\UxqLnGQ.exe
  2⤵
  PID:8384
- C:\Windows\System\eacYZdE.exe
  C:\Windows\System\eacYZdE.exe
  2⤵
  PID:8404
- C:\Windows\System\ivubgXy.exe
  C:\Windows\System\ivubgXy.exe
  2⤵
  PID:8424
- C:\Windows\System\tAIQutc.exe
  C:\Windows\System\tAIQutc.exe
  2⤵
  PID:8452
- C:\Windows\System\wldErkA.exe
  C:\Windows\System\wldErkA.exe
  2⤵
  PID:8488
- C:\Windows\System\MOqXSFA.exe
  C:\Windows\System\MOqXSFA.exe
  2⤵
  PID:8508
- C:\Windows\System\oSojqWl.exe
  C:\Windows\System\oSojqWl.exe
  2⤵
  PID:8532
- C:\Windows\System\drGcDRX.exe
  C:\Windows\System\drGcDRX.exe
  2⤵
  PID:8552
- C:\Windows\System\eGOWnHB.exe
  C:\Windows\System\eGOWnHB.exe
  2⤵
  PID:8572
- C:\Windows\System\AvFqyDz.exe
  C:\Windows\System\AvFqyDz.exe
  2⤵
  PID:8596
- C:\Windows\System\nwXVqJk.exe
  C:\Windows\System\nwXVqJk.exe
  2⤵
  PID:8628
- C:\Windows\System\RaDJxoB.exe
  C:\Windows\System\RaDJxoB.exe
  2⤵
  PID:8648
- C:\Windows\System\wfLGJZe.exe
  C:\Windows\System\wfLGJZe.exe
  2⤵
  PID:8676
- C:\Windows\System\dtVxYCf.exe
  C:\Windows\System\dtVxYCf.exe
  2⤵
  PID:8700
- C:\Windows\System\CPTEfUM.exe
  C:\Windows\System\CPTEfUM.exe
  2⤵
  PID:8720
- C:\Windows\System\znhqspo.exe
  C:\Windows\System\znhqspo.exe
  2⤵
  PID:8740
- C:\Windows\System\PFPXCDh.exe
  C:\Windows\System\PFPXCDh.exe
  2⤵
  PID:8764
- C:\Windows\System\JIpwnuT.exe
  C:\Windows\System\JIpwnuT.exe
  2⤵
  PID:8788
- C:\Windows\System\ipWvGnV.exe
  C:\Windows\System\ipWvGnV.exe
  2⤵
  PID:8812
- C:\Windows\System\zbzzetc.exe
  C:\Windows\System\zbzzetc.exe
  2⤵
  PID:8840
- C:\Windows\System\xBvsWNO.exe
  C:\Windows\System\xBvsWNO.exe
  2⤵
  PID:9152
- C:\Windows\System\wODOUPy.exe
  C:\Windows\System\wODOUPy.exe
  2⤵
  PID:9184
- C:\Windows\System\HVyYaSj.exe
  C:\Windows\System\HVyYaSj.exe
  2⤵
  PID:9200
- C:\Windows\System\ICIstIz.exe
  C:\Windows\System\ICIstIz.exe
  2⤵
  PID:7220
- C:\Windows\System\XLAovEf.exe
  C:\Windows\System\XLAovEf.exe
  2⤵
  PID:5684
- C:\Windows\System\hBuSjkC.exe
  C:\Windows\System\hBuSjkC.exe
  2⤵
  PID:8028
- C:\Windows\System\fimdMXk.exe
  C:\Windows\System\fimdMXk.exe
  2⤵
  PID:7400
- C:\Windows\System\eoVCiwM.exe
  C:\Windows\System\eoVCiwM.exe
  2⤵
  PID:8072
- C:\Windows\System\xsppMNW.exe
  C:\Windows\System\xsppMNW.exe
  2⤵
  PID:8136
- C:\Windows\System\AuveSoS.exe
  C:\Windows\System\AuveSoS.exe
  2⤵
  PID:6588
- C:\Windows\System\PWvlsSn.exe
  C:\Windows\System\PWvlsSn.exe
  2⤵
  PID:7604
- C:\Windows\System\BGMFwaN.exe
  C:\Windows\System\BGMFwaN.exe
  2⤵
  PID:3160
- C:\Windows\System\uzsMWev.exe
  C:\Windows\System\uzsMWev.exe
  2⤵
  PID:7316
- C:\Windows\System\HxWRPTT.exe
  C:\Windows\System\HxWRPTT.exe
  2⤵
  PID:7196
- C:\Windows\System\qahJiFR.exe
  C:\Windows\System\qahJiFR.exe
  2⤵
  PID:7924
- C:\Windows\System\QWCGbcH.exe
  C:\Windows\System\QWCGbcH.exe
  2⤵
  PID:8000
- C:\Windows\System\sbchahh.exe
  C:\Windows\System\sbchahh.exe
  2⤵
  PID:8092
- C:\Windows\System\AbujipT.exe
  C:\Windows\System\AbujipT.exe
  2⤵
  PID:8140
- C:\Windows\System\XfjXVMA.exe
  C:\Windows\System\XfjXVMA.exe
  2⤵
  PID:7512
- C:\Windows\System\OMvFvNN.exe
  C:\Windows\System\OMvFvNN.exe
  2⤵
  PID:6804
- C:\Windows\System\WZnlotZ.exe
  C:\Windows\System\WZnlotZ.exe
  2⤵
  PID:8696
- C:\Windows\System\rkcPNkn.exe
  C:\Windows\System\rkcPNkn.exe
  2⤵
  PID:8748
- C:\Windows\System\QUZoXwZ.exe
  C:\Windows\System\QUZoXwZ.exe
  2⤵
  PID:4560
- C:\Windows\System\kqmNzYC.exe
  C:\Windows\System\kqmNzYC.exe
  2⤵
  PID:8296
- C:\Windows\System\GyJysUZ.exe
  C:\Windows\System\GyJysUZ.exe
  2⤵
  PID:8440
- C:\Windows\System\hGSDJBF.exe
  C:\Windows\System\hGSDJBF.exe
  2⤵
  PID:8584
- C:\Windows\System\wwvilcS.exe
  C:\Windows\System\wwvilcS.exe
  2⤵
  PID:8368
- C:\Windows\System\ZxpEnxj.exe
  C:\Windows\System\ZxpEnxj.exe
  2⤵
  PID:7288
- C:\Windows\System\hvKKNeI.exe
  C:\Windows\System\hvKKNeI.exe
  2⤵
  PID:7796
- C:\Windows\System\aDTACUq.exe
  C:\Windows\System\aDTACUq.exe
  2⤵
  PID:7884
- C:\Windows\System\XOUujfK.exe
  C:\Windows\System\XOUujfK.exe
  2⤵
  PID:7936
- C:\Windows\System\KXRQlGJ.exe
  C:\Windows\System\KXRQlGJ.exe
  2⤵
  PID:8020
- C:\Windows\System\CGcYYiL.exe
  C:\Windows\System\CGcYYiL.exe
  2⤵
  PID:8484
- C:\Windows\System\ZxVJWYH.exe
  C:\Windows\System\ZxVJWYH.exe
  2⤵
  PID:3248
- C:\Windows\System\VHBYohu.exe
  C:\Windows\System\VHBYohu.exe
  2⤵
  PID:5232
- C:\Windows\System\wBlrhza.exe
  C:\Windows\System\wBlrhza.exe
  2⤵
  PID:4876
- C:\Windows\System\UmNNvxF.exe
  C:\Windows\System\UmNNvxF.exe
  2⤵
  PID:8848
- C:\Windows\System\qCnkFhc.exe
  C:\Windows\System\qCnkFhc.exe
  2⤵
  PID:9228
- C:\Windows\System\QbTZHkI.exe
  C:\Windows\System\QbTZHkI.exe
  2⤵
  PID:9252
- C:\Windows\System\kpYZYZF.exe
  C:\Windows\System\kpYZYZF.exe
  2⤵
  PID:9276
- C:\Windows\System\FuGCHGe.exe
  C:\Windows\System\FuGCHGe.exe
  2⤵
  PID:9300
- C:\Windows\System\NDIbJHr.exe
  C:\Windows\System\NDIbJHr.exe
  2⤵
  PID:9324
- C:\Windows\System\jmmMutr.exe
  C:\Windows\System\jmmMutr.exe
  2⤵
  PID:9348
- C:\Windows\System\NkmnvbK.exe
  C:\Windows\System\NkmnvbK.exe
  2⤵
  PID:9380
- C:\Windows\System\PmlIDOf.exe
  C:\Windows\System\PmlIDOf.exe
  2⤵
  PID:9396
- C:\Windows\System\wMFtVbX.exe
  C:\Windows\System\wMFtVbX.exe
  2⤵
  PID:9424
- C:\Windows\System\dpMtNvf.exe
  C:\Windows\System\dpMtNvf.exe
  2⤵
  PID:9464
- C:\Windows\System\vuOlfKJ.exe
  C:\Windows\System\vuOlfKJ.exe
  2⤵
  PID:9496
- C:\Windows\System\YMIKHPM.exe
  C:\Windows\System\YMIKHPM.exe
  2⤵
  PID:9540
- C:\Windows\System\DoYqAWe.exe
  C:\Windows\System\DoYqAWe.exe
  2⤵
  PID:9564
- C:\Windows\System\GRyduhe.exe
  C:\Windows\System\GRyduhe.exe
  2⤵
  PID:9580
- C:\Windows\System\cmqNquC.exe
  C:\Windows\System\cmqNquC.exe
  2⤵
  PID:9600
- C:\Windows\System\FIFZjgv.exe
  C:\Windows\System\FIFZjgv.exe
  2⤵
  PID:9620
- C:\Windows\System\reJSAbU.exe
  C:\Windows\System\reJSAbU.exe
  2⤵
  PID:9648
- C:\Windows\System\vCtRVtP.exe
  C:\Windows\System\vCtRVtP.exe
  2⤵
  PID:9664
- C:\Windows\System\PjNmAtK.exe
  C:\Windows\System\PjNmAtK.exe
  2⤵
  PID:9680
- C:\Windows\System\JnVufYg.exe
  C:\Windows\System\JnVufYg.exe
  2⤵
  PID:9700
- C:\Windows\System\IhsSblF.exe
  C:\Windows\System\IhsSblF.exe
  2⤵
  PID:9728
- C:\Windows\System\RBeIMZB.exe
  C:\Windows\System\RBeIMZB.exe
  2⤵
  PID:9752
- C:\Windows\System\DWVaJOM.exe
  C:\Windows\System\DWVaJOM.exe
  2⤵
  PID:9776
- C:\Windows\System\OneSjEK.exe
  C:\Windows\System\OneSjEK.exe
  2⤵
  PID:9800
- C:\Windows\System\yUhSHiu.exe
  C:\Windows\System\yUhSHiu.exe
  2⤵
  PID:9820
- C:\Windows\System\WkLKbJf.exe
  C:\Windows\System\WkLKbJf.exe
  2⤵
  PID:9844
- C:\Windows\System\hvJwZnf.exe
  C:\Windows\System\hvJwZnf.exe
  2⤵
  PID:9872
- C:\Windows\System\lFfWalx.exe
  C:\Windows\System\lFfWalx.exe
  2⤵
  PID:9892
- C:\Windows\System\SJVSYRn.exe
  C:\Windows\System\SJVSYRn.exe
  2⤵
  PID:9920
- C:\Windows\System\IdHeHdh.exe
  C:\Windows\System\IdHeHdh.exe
  2⤵
  PID:9940
- C:\Windows\System\CQosXRY.exe
  C:\Windows\System\CQosXRY.exe
  2⤵
  PID:9968
- C:\Windows\System\mnjErPA.exe
  C:\Windows\System\mnjErPA.exe
  2⤵
  PID:9984
- C:\Windows\System\zLRJmbh.exe
  C:\Windows\System\zLRJmbh.exe
  2⤵
  PID:10008
- C:\Windows\System\RtpxnBL.exe
  C:\Windows\System\RtpxnBL.exe
  2⤵
  PID:10032
- C:\Windows\System\XihmaSO.exe
  C:\Windows\System\XihmaSO.exe
  2⤵
  PID:10052
- C:\Windows\System\UmKpfbB.exe
  C:\Windows\System\UmKpfbB.exe
  2⤵
  PID:10076
- C:\Windows\System\YBPiRyr.exe
  C:\Windows\System\YBPiRyr.exe
  2⤵
  PID:10104
- C:\Windows\System\TkzrWEP.exe
  C:\Windows\System\TkzrWEP.exe
  2⤵
  PID:10120
- C:\Windows\System\MTmnLqU.exe
  C:\Windows\System\MTmnLqU.exe
  2⤵
  PID:10136
- C:\Windows\System\zRZdkbo.exe
  C:\Windows\System\zRZdkbo.exe
  2⤵
  PID:10152
- C:\Windows\System\ftGOioG.exe
  C:\Windows\System\ftGOioG.exe
  2⤵
  PID:10172
- C:\Windows\System\HGvUuUm.exe
  C:\Windows\System\HGvUuUm.exe
  2⤵
  PID:10192
- C:\Windows\System\DxJWLbL.exe
  C:\Windows\System\DxJWLbL.exe
  2⤵
  PID:10216
- C:\Windows\System\YegRPpy.exe
  C:\Windows\System\YegRPpy.exe
  2⤵
  PID:9168
- C:\Windows\System\MhhZODH.exe
  C:\Windows\System\MhhZODH.exe
  2⤵
  PID:7200
- C:\Windows\System\EZJSljF.exe
  C:\Windows\System\EZJSljF.exe
  2⤵
  PID:6012
- C:\Windows\System\KgmOpwu.exe
  C:\Windows\System\KgmOpwu.exe
  2⤵
  PID:8116
- C:\Windows\System\cZiRRdP.exe
  C:\Windows\System\cZiRRdP.exe
  2⤵
  PID:7684
- C:\Windows\System\CHZecse.exe
  C:\Windows\System\CHZecse.exe
  2⤵
  PID:7100
- C:\Windows\System\wCfPARK.exe
  C:\Windows\System\wCfPARK.exe
  2⤵
  PID:8228
- C:\Windows\System\aToPeFn.exe
  C:\Windows\System\aToPeFn.exe
  2⤵
  PID:8316
- C:\Windows\System\JgmeCOD.exe
  C:\Windows\System\JgmeCOD.exe
  2⤵
  PID:1724
- C:\Windows\System\bGhuwIA.exe
  C:\Windows\System\bGhuwIA.exe
  2⤵
  PID:3952
- C:\Windows\System\kTHpdnd.exe
  C:\Windows\System\kTHpdnd.exe
  2⤵
  PID:9004
- C:\Windows\System\VbtaiPd.exe
  C:\Windows\System\VbtaiPd.exe
  2⤵
  PID:8588
- C:\Windows\System\IlLDdZg.exe
  C:\Windows\System\IlLDdZg.exe
  2⤵
  PID:8672
- C:\Windows\System\dQpzWfV.exe
  C:\Windows\System\dQpzWfV.exe
  2⤵
  PID:7732
- C:\Windows\System\eEjunIL.exe
  C:\Windows\System\eEjunIL.exe
  2⤵
  PID:6056
- C:\Windows\System\aTgITOP.exe
  C:\Windows\System\aTgITOP.exe
  2⤵
  PID:9332
- C:\Windows\System\beNQUbk.exe
  C:\Windows\System\beNQUbk.exe
  2⤵
  PID:10248
- C:\Windows\System\wZFtAte.exe
  C:\Windows\System\wZFtAte.exe
  2⤵
  PID:10276
- C:\Windows\System\JahGlZk.exe
  C:\Windows\System\JahGlZk.exe
  2⤵
  PID:10296
- C:\Windows\System\EizYynL.exe
  C:\Windows\System\EizYynL.exe
  2⤵
  PID:10320
- C:\Windows\System\uBoruhj.exe
  C:\Windows\System\uBoruhj.exe
  2⤵
  PID:10340
- C:\Windows\System\NlsZmZY.exe
  C:\Windows\System\NlsZmZY.exe
  2⤵
  PID:10360
- C:\Windows\System\Navczbh.exe
  C:\Windows\System\Navczbh.exe
  2⤵
  PID:10384
- C:\Windows\System\UWAiAjP.exe
  C:\Windows\System\UWAiAjP.exe
  2⤵
  PID:10408
- C:\Windows\System\adxLNLF.exe
  C:\Windows\System\adxLNLF.exe
  2⤵
  PID:10428
- C:\Windows\System\gdzzoBw.exe
  C:\Windows\System\gdzzoBw.exe
  2⤵
  PID:10448
- C:\Windows\System\cgsVBZm.exe
  C:\Windows\System\cgsVBZm.exe
  2⤵
  PID:10468
- C:\Windows\System\sVBLvcm.exe
  C:\Windows\System\sVBLvcm.exe
  2⤵
  PID:10488
- C:\Windows\System\JQDwqgT.exe
  C:\Windows\System\JQDwqgT.exe
  2⤵
  PID:10516
- C:\Windows\System\PuwrTOh.exe
  C:\Windows\System\PuwrTOh.exe
  2⤵
  PID:10540
- C:\Windows\System\ImQEkoT.exe
  C:\Windows\System\ImQEkoT.exe
  2⤵
  PID:10560
- C:\Windows\System\IaCcRvo.exe
  C:\Windows\System\IaCcRvo.exe
  2⤵
  PID:10588
- C:\Windows\System\oTwENHf.exe
  C:\Windows\System\oTwENHf.exe
  2⤵
  PID:10608
- C:\Windows\System\oHpMtme.exe
  C:\Windows\System\oHpMtme.exe
  2⤵
  PID:10640
- C:\Windows\System\uufxSzb.exe
  C:\Windows\System\uufxSzb.exe
  2⤵
  PID:10660
- C:\Windows\System\uYHAjIj.exe
  C:\Windows\System\uYHAjIj.exe
  2⤵
  PID:10688
- C:\Windows\System\ecOqUZG.exe
  C:\Windows\System\ecOqUZG.exe
  2⤵
  PID:10716
- C:\Windows\System\zaXLkgk.exe
  C:\Windows\System\zaXLkgk.exe
  2⤵
  PID:10736
- C:\Windows\System\LcwqTTm.exe
  C:\Windows\System\LcwqTTm.exe
  2⤵
  PID:10768
- C:\Windows\System\YvOdvaD.exe
  C:\Windows\System\YvOdvaD.exe
  2⤵
  PID:10784
- C:\Windows\System\iaNygNF.exe
  C:\Windows\System\iaNygNF.exe
  2⤵
  PID:10808
- C:\Windows\System\JrdyncM.exe
  C:\Windows\System\JrdyncM.exe
  2⤵
  PID:10828
- C:\Windows\System\tpzuqiW.exe
  C:\Windows\System\tpzuqiW.exe
  2⤵
  PID:10860
- C:\Windows\System\PsJdBww.exe
  C:\Windows\System\PsJdBww.exe
  2⤵
  PID:10884
- C:\Windows\System\vqoTlYd.exe
  C:\Windows\System\vqoTlYd.exe
  2⤵
  PID:10908
- C:\Windows\System\DMNFiAh.exe
  C:\Windows\System\DMNFiAh.exe
  2⤵
  PID:10932
- C:\Windows\System\vAtjnNv.exe
  C:\Windows\System\vAtjnNv.exe
  2⤵
  PID:10960
- C:\Windows\System\FUZwZOk.exe
  C:\Windows\System\FUZwZOk.exe
  2⤵
  PID:10996
- C:\Windows\System\qtIwbbM.exe
  C:\Windows\System\qtIwbbM.exe
  2⤵
  PID:11012
- C:\Windows\System\yGaZsro.exe
  C:\Windows\System\yGaZsro.exe
  2⤵
  PID:11028
- C:\Windows\System\TGaRgYE.exe
  C:\Windows\System\TGaRgYE.exe
  2⤵
  PID:11048
- C:\Windows\System\NyWtSsw.exe
  C:\Windows\System\NyWtSsw.exe
  2⤵
  PID:11068
- C:\Windows\System\UVCvKjS.exe
  C:\Windows\System\UVCvKjS.exe
  2⤵
  PID:11092
- C:\Windows\System\WeKcQQf.exe
  C:\Windows\System\WeKcQQf.exe
  2⤵
  PID:11108
- C:\Windows\System\CARiUAp.exe
  C:\Windows\System\CARiUAp.exe
  2⤵
  PID:11128
- C:\Windows\System\CmRASDZ.exe
  C:\Windows\System\CmRASDZ.exe
  2⤵
  PID:11144
- C:\Windows\System\MbnXgqT.exe
  C:\Windows\System\MbnXgqT.exe
  2⤵
  PID:11160
- C:\Windows\System\RdlXzjq.exe
  C:\Windows\System\RdlXzjq.exe
  2⤵
  PID:11176
- C:\Windows\System\SHysQxd.exe
  C:\Windows\System\SHysQxd.exe
  2⤵
  PID:11192
- C:\Windows\System\KZSBEkR.exe
  C:\Windows\System\KZSBEkR.exe
  2⤵
  PID:11212
- C:\Windows\System\lQNsuXn.exe
  C:\Windows\System\lQNsuXn.exe
  2⤵
  PID:11232
- C:\Windows\System\UEHUPKD.exe
  C:\Windows\System\UEHUPKD.exe
  2⤵
  PID:11256
- C:\Windows\System\QShboUx.exe
  C:\Windows\System\QShboUx.exe
  2⤵
  PID:7244
- C:\Windows\System\ZtMUKZY.exe
  C:\Windows\System\ZtMUKZY.exe
  2⤵
  PID:7576
- C:\Windows\System\IUoGOei.exe
  C:\Windows\System\IUoGOei.exe
  2⤵
  PID:7172
- C:\Windows\System\CiovyRd.exe
  C:\Windows\System\CiovyRd.exe
  2⤵
  PID:8412
- C:\Windows\System\ApJAxtn.exe
  C:\Windows\System\ApJAxtn.exe
  2⤵
  PID:9636
- C:\Windows\System\vEVZBxT.exe
  C:\Windows\System\vEVZBxT.exe
  2⤵
  PID:9724
- C:\Windows\System\UgTYuSP.exe
  C:\Windows\System\UgTYuSP.exe
  2⤵
  PID:9808
- C:\Windows\System\aWfmxSn.exe
  C:\Windows\System\aWfmxSn.exe
  2⤵
  PID:8044
- C:\Windows\System\kzLKCMi.exe
  C:\Windows\System\kzLKCMi.exe
  2⤵
  PID:9928
- C:\Windows\System\mRszpFe.exe
  C:\Windows\System\mRszpFe.exe
  2⤵
  PID:9976
- C:\Windows\System\sAQOdOI.exe
  C:\Windows\System\sAQOdOI.exe
  2⤵
  PID:8736
- C:\Windows\System\PSuDIuT.exe
  C:\Windows\System\PSuDIuT.exe
  2⤵
  PID:9040
- C:\Windows\System\OMSrtqR.exe
  C:\Windows\System\OMSrtqR.exe
  2⤵
  PID:9092
- C:\Windows\System\VBGofeC.exe
  C:\Windows\System\VBGofeC.exe
  2⤵
  PID:1500
- C:\Windows\System\PaGfBbV.exe
  C:\Windows\System\PaGfBbV.exe
  2⤵
  PID:7756
- C:\Windows\System\sqdCHXD.exe
  C:\Windows\System\sqdCHXD.exe
  2⤵
  PID:9024
- C:\Windows\System\NhIDOff.exe
  C:\Windows\System\NhIDOff.exe
  2⤵
  PID:8544
- C:\Windows\System\LRqPYGi.exe
  C:\Windows\System\LRqPYGi.exe
  2⤵
  PID:9164
- C:\Windows\System\YiHFHeI.exe
  C:\Windows\System\YiHFHeI.exe
  2⤵
  PID:9320
- C:\Windows\System\JGTiKka.exe
  C:\Windows\System\JGTiKka.exe
  2⤵
  PID:9388
- C:\Windows\System\nGtLScP.exe
  C:\Windows\System\nGtLScP.exe
  2⤵
  PID:10380
- C:\Windows\System\pJDdhIO.exe
  C:\Windows\System\pJDdhIO.exe
  2⤵
  PID:9480
- C:\Windows\System\jKqTKAm.exe
  C:\Windows\System\jKqTKAm.exe
  2⤵
  PID:7372
- C:\Windows\System\Lbladyw.exe
  C:\Windows\System\Lbladyw.exe
  2⤵
  PID:8120
- C:\Windows\System\CBMMhvE.exe
  C:\Windows\System\CBMMhvE.exe
  2⤵
  PID:6396
- C:\Windows\System\uljWQwy.exe
  C:\Windows\System\uljWQwy.exe
  2⤵
  PID:11268
- C:\Windows\System\YTpUJdT.exe
  C:\Windows\System\YTpUJdT.exe
  2⤵
  PID:11288
- C:\Windows\System\tUFeDKf.exe
  C:\Windows\System\tUFeDKf.exe
  2⤵
  PID:11312
- C:\Windows\System\UwdVpXn.exe
  C:\Windows\System\UwdVpXn.exe
  2⤵
  PID:11336
- C:\Windows\System\TehLCvJ.exe
  C:\Windows\System\TehLCvJ.exe
  2⤵
  PID:11368
- C:\Windows\System\UoVHGTE.exe
  C:\Windows\System\UoVHGTE.exe
  2⤵
  PID:11384
- C:\Windows\System\SjbCfXq.exe
  C:\Windows\System\SjbCfXq.exe
  2⤵
  PID:11404
- C:\Windows\System\LUNcBny.exe
  C:\Windows\System\LUNcBny.exe
  2⤵
  PID:11424
- C:\Windows\System\mrCCPDj.exe
  C:\Windows\System\mrCCPDj.exe
  2⤵
  PID:11448
- C:\Windows\System\caBbNqd.exe
  C:\Windows\System\caBbNqd.exe
  2⤵
  PID:11476
- C:\Windows\System\DsOBTZu.exe
  C:\Windows\System\DsOBTZu.exe
  2⤵
  PID:11500
- C:\Windows\System\dNjceFm.exe
  C:\Windows\System\dNjceFm.exe
  2⤵
  PID:11520
- C:\Windows\System\dyNiOsX.exe
  C:\Windows\System\dyNiOsX.exe
  2⤵
  PID:11548
- C:\Windows\System\FlHONdG.exe
  C:\Windows\System\FlHONdG.exe
  2⤵
  PID:11568
- C:\Windows\System\axRNLDc.exe
  C:\Windows\System\axRNLDc.exe
  2⤵
  PID:11596
- C:\Windows\System\MhYYvbj.exe
  C:\Windows\System\MhYYvbj.exe
  2⤵
  PID:11616
- C:\Windows\System\HcqWGqa.exe
  C:\Windows\System\HcqWGqa.exe
  2⤵
  PID:11636
- C:\Windows\System\wMZOeom.exe
  C:\Windows\System\wMZOeom.exe
  2⤵
  PID:11656
- C:\Windows\System\JripDbp.exe
  C:\Windows\System\JripDbp.exe
  2⤵
  PID:11676
- C:\Windows\System\dWMjEvh.exe
  C:\Windows\System\dWMjEvh.exe
  2⤵
  PID:11700
- C:\Windows\System\Xenyvpn.exe
  C:\Windows\System\Xenyvpn.exe
  2⤵
  PID:11724
- C:\Windows\System\WkxaXRE.exe
  C:\Windows\System\WkxaXRE.exe
  2⤵
  PID:11744
- C:\Windows\System\HnrxHzf.exe
  C:\Windows\System\HnrxHzf.exe
  2⤵
  PID:11760
- C:\Windows\System\tbAoZeL.exe
  C:\Windows\System\tbAoZeL.exe
  2⤵
  PID:11784
- C:\Windows\System\vuReBgq.exe
  C:\Windows\System\vuReBgq.exe
  2⤵
  PID:11808
- C:\Windows\System\LYDzfDV.exe
  C:\Windows\System\LYDzfDV.exe
  2⤵
  PID:11828
- C:\Windows\System\VxiSEZD.exe
  C:\Windows\System\VxiSEZD.exe
  2⤵
  PID:11844
- C:\Windows\System\cWRwBPE.exe
  C:\Windows\System\cWRwBPE.exe
  2⤵
  PID:11860
- C:\Windows\System\wQIHIcD.exe
  C:\Windows\System\wQIHIcD.exe
  2⤵
  PID:11876
- C:\Windows\System\rNDRuCl.exe
  C:\Windows\System\rNDRuCl.exe
  2⤵
  PID:11892
- C:\Windows\System\QDwkEys.exe
  C:\Windows\System\QDwkEys.exe
  2⤵
  PID:11912
- C:\Windows\System\DCLQkGD.exe
  C:\Windows\System\DCLQkGD.exe
  2⤵
  PID:11928
- C:\Windows\System\zYYaCBp.exe
  C:\Windows\System\zYYaCBp.exe
  2⤵
  PID:11948
- C:\Windows\System\HLOETbk.exe
  C:\Windows\System\HLOETbk.exe
  2⤵
  PID:11964
- C:\Windows\System\dHPTuBd.exe
  C:\Windows\System\dHPTuBd.exe
  2⤵
  PID:11984
- C:\Windows\System\CLMIKFk.exe
  C:\Windows\System\CLMIKFk.exe
  2⤵
  PID:12008
- C:\Windows\System\xqLzzMa.exe
  C:\Windows\System\xqLzzMa.exe
  2⤵
  PID:12032
- C:\Windows\System\ygjewTL.exe
  C:\Windows\System\ygjewTL.exe
  2⤵
  PID:12060
- C:\Windows\System\pTdHjlI.exe
  C:\Windows\System\pTdHjlI.exe
  2⤵
  PID:12080
- C:\Windows\System\tJcLAWY.exe
  C:\Windows\System\tJcLAWY.exe
  2⤵
  PID:12100
- C:\Windows\System\JXlGiDJ.exe
  C:\Windows\System\JXlGiDJ.exe
  2⤵
  PID:12124
- C:\Windows\System\gTeDPhK.exe
  C:\Windows\System\gTeDPhK.exe
  2⤵
  PID:12140
- C:\Windows\System\ucCuazQ.exe
  C:\Windows\System\ucCuazQ.exe
  2⤵
  PID:12156
- C:\Windows\System\urEMFfe.exe
  C:\Windows\System\urEMFfe.exe
  2⤵
  PID:12184
- C:\Windows\System\LwOwjQX.exe
  C:\Windows\System\LwOwjQX.exe
  2⤵
  PID:12204
- C:\Windows\System\OAPRyqo.exe
  C:\Windows\System\OAPRyqo.exe
  2⤵
  PID:12228
- C:\Windows\System\ZtiWwWQ.exe
  C:\Windows\System\ZtiWwWQ.exe
  2⤵
  PID:12248
- C:\Windows\System\NFoqbUx.exe
  C:\Windows\System\NFoqbUx.exe
  2⤵
  PID:12276
- C:\Windows\System\LpYaoNR.exe
  C:\Windows\System\LpYaoNR.exe
  2⤵
  PID:9612
- C:\Windows\System\gVHfjEs.exe
  C:\Windows\System\gVHfjEs.exe
  2⤵
  PID:10632
- C:\Windows\System\JBPLLFA.exe
  C:\Windows\System\JBPLLFA.exe
  2⤵
  PID:9716
- C:\Windows\System\WSATxRC.exe
  C:\Windows\System\WSATxRC.exe
  2⤵
  PID:10792
- C:\Windows\System\MXsbtfT.exe
  C:\Windows\System\MXsbtfT.exe
  2⤵
  PID:10868
- C:\Windows\System\zkliZBj.exe
  C:\Windows\System\zkliZBj.exe
  2⤵
  PID:9996
- C:\Windows\System\CrRefZd.exe
  C:\Windows\System\CrRefZd.exe
  2⤵
  PID:10024
- C:\Windows\System\VKyEzPr.exe
  C:\Windows\System\VKyEzPr.exe
  2⤵
  PID:10084
- C:\Windows\System\akrZmuK.exe
  C:\Windows\System\akrZmuK.exe
  2⤵
  PID:10128
- C:\Windows\System\lZCibOb.exe
  C:\Windows\System\lZCibOb.exe
  2⤵
  PID:10164
- C:\Windows\System\peBTUgr.exe
  C:\Windows\System\peBTUgr.exe
  2⤵
  PID:10188
- C:\Windows\System\PUzrMDE.exe
  C:\Windows\System\PUzrMDE.exe
  2⤵
  PID:8640
- C:\Windows\System\xBZsRbx.exe
  C:\Windows\System\xBZsRbx.exe
  2⤵
  PID:11100
- C:\Windows\System\VUjCWDK.exe
  C:\Windows\System\VUjCWDK.exe
  2⤵
  PID:11188
- C:\Windows\System\KgDJNlS.exe
  C:\Windows\System\KgDJNlS.exe
  2⤵
  PID:9180
- C:\Windows\System\cziYppH.exe
  C:\Windows\System\cziYppH.exe
  2⤵
  PID:2400
- C:\Windows\System\mqOgcxb.exe
  C:\Windows\System\mqOgcxb.exe
  2⤵
  PID:4708
- C:\Windows\System\NGvDrFQ.exe
  C:\Windows\System\NGvDrFQ.exe
  2⤵
  PID:7888
- C:\Windows\System\wljgRXQ.exe
  C:\Windows\System\wljgRXQ.exe
  2⤵
  PID:9840
- C:\Windows\System\xxpsBmE.exe
  C:\Windows\System\xxpsBmE.exe
  2⤵
  PID:7668
- C:\Windows\System\qfPBifc.exe
  C:\Windows\System\qfPBifc.exe
  2⤵
  PID:6700
- C:\Windows\System\eVpFrhS.exe
  C:\Windows\System\eVpFrhS.exe
  2⤵
  PID:9344
- C:\Windows\System\BMAlZVa.exe
  C:\Windows\System\BMAlZVa.exe
  2⤵
  PID:9316
- C:\Windows\System\OUfNIwg.exe
  C:\Windows\System\OUfNIwg.exe
  2⤵
  PID:10332
- C:\Windows\System\XmxfByL.exe
  C:\Windows\System\XmxfByL.exe
  2⤵
  PID:9432
- C:\Windows\System\QsAyvhC.exe
  C:\Windows\System\QsAyvhC.exe
  2⤵
  PID:10420
- C:\Windows\System\HTpEpJf.exe
  C:\Windows\System\HTpEpJf.exe
  2⤵
  PID:9556
- C:\Windows\System\SiqhKOF.exe
  C:\Windows\System\SiqhKOF.exe
  2⤵
  PID:7664
- C:\Windows\System\XDlekZz.exe
  C:\Windows\System\XDlekZz.exe
  2⤵
  PID:12308
- C:\Windows\System\icPheFb.exe
  C:\Windows\System\icPheFb.exe
  2⤵
  PID:12332
- C:\Windows\System\WTxXzne.exe
  C:\Windows\System\WTxXzne.exe
  2⤵
  PID:12360
- C:\Windows\System\wqmOwYo.exe
  C:\Windows\System\wqmOwYo.exe
  2⤵
  PID:12380
- C:\Windows\System\MjdWFKK.exe
  C:\Windows\System\MjdWFKK.exe
  2⤵
  PID:12408
- C:\Windows\System\JGHADIW.exe
  C:\Windows\System\JGHADIW.exe
  2⤵
  PID:12428
- C:\Windows\System\SUCGOJi.exe
  C:\Windows\System\SUCGOJi.exe
  2⤵
  PID:12456
- C:\Windows\System\epnLKnM.exe
  C:\Windows\System\epnLKnM.exe
  2⤵
  PID:12480
- C:\Windows\System\OoFrDqV.exe
  C:\Windows\System\OoFrDqV.exe
  2⤵
  PID:12496
- C:\Windows\System\AuVwGhB.exe
  C:\Windows\System\AuVwGhB.exe
  2⤵
  PID:12512
- C:\Windows\System\USPRiwQ.exe
  C:\Windows\System\USPRiwQ.exe
  2⤵
  PID:12532
- C:\Windows\System\CmINsCe.exe
  C:\Windows\System\CmINsCe.exe
  2⤵
  PID:12548
- C:\Windows\System\kegstlg.exe
  C:\Windows\System\kegstlg.exe
  2⤵
  PID:12568
- C:\Windows\System\FDjPZAe.exe
  C:\Windows\System\FDjPZAe.exe
  2⤵
  PID:12588
- C:\Windows\System\xpJOEaf.exe
  C:\Windows\System\xpJOEaf.exe
  2⤵
  PID:12620
- C:\Windows\System\bnHdayl.exe
  C:\Windows\System\bnHdayl.exe
  2⤵
  PID:12636
- C:\Windows\System\WNkygKZ.exe
  C:\Windows\System\WNkygKZ.exe
  2⤵
  PID:12656
- C:\Windows\System\ZOsJGgu.exe
  C:\Windows\System\ZOsJGgu.exe
  2⤵
  PID:12680
- C:\Windows\System\TBzQmic.exe
  C:\Windows\System\TBzQmic.exe
  2⤵
  PID:12708
- C:\Windows\System\pwaqZEP.exe
  C:\Windows\System\pwaqZEP.exe
  2⤵
  PID:12732
- C:\Windows\System\bHVVmZe.exe
  C:\Windows\System\bHVVmZe.exe
  2⤵
  PID:12760
- C:\Windows\System\Kjezpmt.exe
  C:\Windows\System\Kjezpmt.exe
  2⤵
  PID:12784
- C:\Windows\System\fqwmxSe.exe
  C:\Windows\System\fqwmxSe.exe
  2⤵
  PID:12808
- C:\Windows\System\lymuoxY.exe
  C:\Windows\System\lymuoxY.exe
  2⤵
  PID:12836
- C:\Windows\System\omVXVRi.exe
  C:\Windows\System\omVXVRi.exe
  2⤵
  PID:12864
- C:\Windows\System\KWqpgUx.exe
  C:\Windows\System\KWqpgUx.exe
  2⤵
  PID:9608
- C:\Windows\System\WTSNXdq.exe
  C:\Windows\System\WTSNXdq.exe
  2⤵
  PID:10824
- C:\Windows\System\xNxUJsu.exe
  C:\Windows\System\xNxUJsu.exe
  2⤵
  PID:10892
- C:\Windows\System\BwabcTJ.exe
  C:\Windows\System\BwabcTJ.exe
  2⤵
  PID:8728
- C:\Windows\System\IZZnDwW.exe
  C:\Windows\System\IZZnDwW.exe
  2⤵
  PID:8176
- C:\Windows\System\JcyUgQa.exe
  C:\Windows\System\JcyUgQa.exe
  2⤵
  PID:12404
- C:\Windows\System\eIbqvmV.exe
  C:\Windows\System\eIbqvmV.exe
  2⤵
  PID:12504
- C:\Windows\System\vobrgug.exe
  C:\Windows\System\vobrgug.exe
  2⤵
  PID:10596
- C:\Windows\System\vXRDLkm.exe
  C:\Windows\System\vXRDLkm.exe
  2⤵
  PID:11488
- C:\Windows\System\lBwocie.exe
  C:\Windows\System\lBwocie.exe
  2⤵
  PID:10728
- C:\Windows\System\ETqProm.exe
  C:\Windows\System\ETqProm.exe
  2⤵
  PID:10760
- C:\Windows\System\tOeLuDq.exe
  C:\Windows\System\tOeLuDq.exe
  2⤵
  PID:11632
- C:\Windows\System\aKOjSra.exe
  C:\Windows\System\aKOjSra.exe
  2⤵
  PID:11740
- C:\Windows\System\zSBPvQO.exe
  C:\Windows\System\zSBPvQO.exe
  2⤵
  PID:12964
- C:\Windows\System\uhcnqee.exe
  C:\Windows\System\uhcnqee.exe
  2⤵
  PID:11980
- C:\Windows\System\PWMifAq.exe
  C:\Windows\System\PWMifAq.exe
  2⤵
  PID:12152
- C:\Windows\System\RxMDcCF.exe
  C:\Windows\System\RxMDcCF.exe
  2⤵
  PID:11204
- C:\Windows\System\IWHriLH.exe
  C:\Windows\System\IWHriLH.exe
  2⤵
  PID:12200
- C:\Windows\System\pHZbzZF.exe
  C:\Windows\System\pHZbzZF.exe
  2⤵
  PID:9880
- C:\Windows\System\eixLHDu.exe
  C:\Windows\System\eixLHDu.exe
  2⤵
  PID:10048
- C:\Windows\System\dkqaJbV.exe
  C:\Windows\System\dkqaJbV.exe
  2⤵
  PID:11140
- C:\Windows\System\uSuxJbn.exe
  C:\Windows\System\uSuxJbn.exe
  2⤵
  PID:8540
- C:\Windows\System\lBmRMUB.exe
  C:\Windows\System\lBmRMUB.exe
  2⤵
  PID:7224
- C:\Windows\System\dubImOz.exe
  C:\Windows\System\dubImOz.exe
  2⤵
  PID:4016
- C:\Windows\System\BmvedyF.exe
  C:\Windows\System\BmvedyF.exe
  2⤵
  PID:8004
- C:\Windows\System\gXBuPkB.exe
  C:\Windows\System\gXBuPkB.exe
  2⤵
  PID:2332
- C:\Windows\System\YGMrZVp.exe
  C:\Windows\System\YGMrZVp.exe
  2⤵
  PID:10312
- C:\Windows\System\evlpRbU.exe
  C:\Windows\System\evlpRbU.exe
  2⤵
  PID:7368
- C:\Windows\System\fUZouyf.exe
  C:\Windows\System\fUZouyf.exe
  2⤵
  PID:11308
- C:\Windows\System\LZykyCi.exe
  C:\Windows\System\LZykyCi.exe
  2⤵
  PID:12520
- C:\Windows\System\OEgmNYz.exe
  C:\Windows\System\OEgmNYz.exe
  2⤵
  PID:11444
- C:\Windows\System\iaXOTKP.exe
  C:\Windows\System\iaXOTKP.exe
  2⤵
  PID:11516
- C:\Windows\System\WaYfpIR.exe
  C:\Windows\System\WaYfpIR.exe
  2⤵
  PID:13272
- C:\Windows\System\eVUpJLK.exe
  C:\Windows\System\eVUpJLK.exe
  2⤵
  PID:13128
- C:\Windows\System\cmkukTc.exe
  C:\Windows\System\cmkukTc.exe
  2⤵
  PID:3644
- C:\Windows\System\wPYOUAI.exe
  C:\Windows\System\wPYOUAI.exe
  2⤵
  PID:9772
- C:\Windows\System\mksMIju.exe
  C:\Windows\System\mksMIju.exe
  2⤵
  PID:9504
- C:\Windows\System\DOMDxvG.exe
  C:\Windows\System\DOMDxvG.exe
  2⤵
  PID:12324
- C:\Windows\System\XXOXxSt.exe
  C:\Windows\System\XXOXxSt.exe
  2⤵
  PID:12376
- C:\Windows\System\OQMqnkD.exe
  C:\Windows\System\OQMqnkD.exe
  2⤵
  PID:12544
- C:\Windows\System\XdTumoV.exe
  C:\Windows\System\XdTumoV.exe
  2⤵
  PID:12632
- C:\Windows\System\UmNzRsR.exe
  C:\Windows\System\UmNzRsR.exe
  2⤵
  PID:12704
- C:\Windows\System\lRgZccg.exe
  C:\Windows\System\lRgZccg.exe
  2⤵
  PID:3532
- C:\Windows\System\sPCUalB.exe
  C:\Windows\System\sPCUalB.exe
  2⤵
  PID:9908
- C:\Windows\System\hrEdWAb.exe
  C:\Windows\System\hrEdWAb.exe
  2⤵
  PID:12284
- C:\Windows\System\eAjdHcm.exe
  C:\Windows\System\eAjdHcm.exe
  2⤵
  PID:11920
- C:\Windows\System\oCSXRjJ.exe
  C:\Windows\System\oCSXRjJ.exe
  2⤵
  PID:11304
- C:\Windows\System\kRSiOKO.exe
  C:\Windows\System\kRSiOKO.exe
  2⤵
  PID:8260
- C:\Windows\System\aHqsIyA.exe
  C:\Windows\System\aHqsIyA.exe
  2⤵
  PID:9764
- C:\Windows\System\vbWMzbV.exe
  C:\Windows\System\vbWMzbV.exe
  2⤵
  PID:12352
- C:\Windows\System\WxtebBY.exe
  C:\Windows\System\WxtebBY.exe
  2⤵
  PID:13188
- C:\Windows\System\nIrRcqJ.exe
  C:\Windows\System\nIrRcqJ.exe
  2⤵
  PID:10904
- C:\Windows\System\uRdLGpJ.exe
  C:\Windows\System\uRdLGpJ.exe
  2⤵
  PID:12688
- C:\Windows\System\ogSurvJ.exe
  C:\Windows\System\ogSurvJ.exe
  2⤵
  PID:11576
- C:\Windows\System\YXcEfgF.exe
  C:\Windows\System\YXcEfgF.exe
  2⤵
  PID:13116
- C:\Windows\System\fdcHLmW.exe
  C:\Windows\System\fdcHLmW.exe
  2⤵
  PID:9788
- C:\Windows\System\jwHfQqF.exe
  C:\Windows\System\jwHfQqF.exe
  2⤵
  PID:12824
- C:\Windows\System\XTzzfeC.exe
  C:\Windows\System\XTzzfeC.exe
  2⤵
  PID:10732
- C:\Windows\System\dOmRBvz.exe
  C:\Windows\System\dOmRBvz.exe
  2⤵
  PID:12540
- C:\Windows\System\XPiIENZ.exe
  C:\Windows\System\XPiIENZ.exe
  2⤵
  PID:12256
- C:\Windows\System\hBWpfLx.exe
  C:\Windows\System\hBWpfLx.exe
  2⤵
  PID:2556
- C:\Windows\System\RlnaHCo.exe
  C:\Windows\System\RlnaHCo.exe
  2⤵
  PID:8564
- C:\Windows\System\PnTGOoy.exe
  C:\Windows\System\PnTGOoy.exe
  2⤵
  PID:704
- C:\Windows\System\CNrcKkI.exe
  C:\Windows\System\CNrcKkI.exe
  2⤵
  PID:11528
- C:\Windows\System\MkfoqFZ.exe
  C:\Windows\System\MkfoqFZ.exe
  2⤵
  PID:10284
- C:\Windows\System\OixbOhg.exe
  C:\Windows\System\OixbOhg.exe
  2⤵
  PID:12852
- C:\Windows\System\gDgreTp.exe
  C:\Windows\System\gDgreTp.exe
  2⤵
  PID:12796
- C:\Windows\System\zuduyEr.exe
  C:\Windows\System\zuduyEr.exe
  2⤵
  PID:1916
- C:\Windows\System\bsOdZLN.exe
  C:\Windows\System\bsOdZLN.exe
  2⤵
  PID:1764
- C:\Windows\System\hAGLLls.exe
  C:\Windows\System\hAGLLls.exe
  2⤵
  PID:12976
- C:\Windows\System\oALtDTK.exe
  C:\Windows\System\oALtDTK.exe
  2⤵
  PID:11840
- C:\Windows\System\UaBMBjY.exe
  C:\Windows\System\UaBMBjY.exe
  2⤵
  PID:11076
- C:\Windows\System\YBPNOlh.exe
  C:\Windows\System\YBPNOlh.exe
  2⤵
  PID:10000
- C:\Windows\System\IEznhQi.exe
  C:\Windows\System\IEznhQi.exe
  2⤵
  PID:12580
- C:\Windows\System\kMlFcbc.exe
  C:\Windows\System\kMlFcbc.exe
  2⤵
  PID:12396
- C:\Windows\System\tTUktTV.exe
  C:\Windows\System\tTUktTV.exe
  2⤵
  PID:10748
- C:\Windows\System\OPRziVG.exe
  C:\Windows\System\OPRziVG.exe
  2⤵
  PID:13328
- C:\Windows\System\HqlZeJX.exe
  C:\Windows\System\HqlZeJX.exe
  2⤵
  PID:13348
- C:\Windows\System\TVLnFzb.exe
  C:\Windows\System\TVLnFzb.exe
  2⤵
  PID:13368
- C:\Windows\System\vVetswZ.exe
  C:\Windows\System\vVetswZ.exe
  2⤵
  PID:13388
- C:\Windows\System\VpyujXK.exe
  C:\Windows\System\VpyujXK.exe
  2⤵
  PID:13408
- C:\Windows\System\Yfsjcvh.exe
  C:\Windows\System\Yfsjcvh.exe
  2⤵
  PID:13432
- C:\Windows\System\ywCzGra.exe
  C:\Windows\System\ywCzGra.exe
  2⤵
  PID:13452
- C:\Windows\System\yTfMYFM.exe
  C:\Windows\System\yTfMYFM.exe
  2⤵
  PID:13468
- C:\Windows\System\yfGpsmM.exe
  C:\Windows\System\yfGpsmM.exe
  2⤵
  PID:13488
- C:\Windows\System\jwesqbT.exe
  C:\Windows\System\jwesqbT.exe
  2⤵
  PID:13512
- C:\Windows\System\NREJnax.exe
  C:\Windows\System\NREJnax.exe
  2⤵
  PID:13528
- C:\Windows\System\EamMrzd.exe
  C:\Windows\System\EamMrzd.exe
  2⤵
  PID:13548
- C:\Windows\System\DOGEFXK.exe
  C:\Windows\System\DOGEFXK.exe
  2⤵
  PID:13568
- C:\Windows\System\atGvWVh.exe
  C:\Windows\System\atGvWVh.exe
  2⤵
  PID:13588
- C:\Windows\System\qUuGTTr.exe
  C:\Windows\System\qUuGTTr.exe
  2⤵
  PID:13920
- C:\Windows\System\MTVGzmP.exe
  C:\Windows\System\MTVGzmP.exe
  2⤵
  PID:14216
- C:\Windows\System\ELKiozI.exe
  C:\Windows\System\ELKiozI.exe
  2⤵
  PID:14236
- C:\Windows\System\ykFAjni.exe
  C:\Windows\System\ykFAjni.exe
  2⤵
  PID:14332
- C:\Windows\System\IdbMMrD.exe
  C:\Windows\System\IdbMMrD.exe
  2⤵
  PID:11540
- C:\Windows\System\hDqwILV.exe
  C:\Windows\System\hDqwILV.exe
  2⤵
  PID:10396
- C:\Windows\System\WxkpLAj.exe
  C:\Windows\System\WxkpLAj.exe
  2⤵
  PID:5296
- C:\Windows\System\HiBJHrY.exe
  C:\Windows\System\HiBJHrY.exe
  2⤵
  PID:13024
- C:\Windows\System\YmTfDlu.exe
  C:\Windows\System\YmTfDlu.exe
  2⤵
  PID:12728
- C:\Windows\System\mLgyfZS.exe
  C:\Windows\System\mLgyfZS.exe
  2⤵
  PID:13544
- C:\Windows\System\hFpknoq.exe
  C:\Windows\System\hFpknoq.exe
  2⤵
  PID:13616
- C:\Windows\System\CoakJPQ.exe
  C:\Windows\System\CoakJPQ.exe
  2⤵
  PID:5300
- C:\Windows\System\TIWXKLg.exe
  C:\Windows\System\TIWXKLg.exe
  2⤵
  PID:8820
- C:\Windows\System\YqBQqqX.exe
  C:\Windows\System\YqBQqqX.exe
  2⤵
  PID:13692
- C:\Windows\System\rQFLWKK.exe
  C:\Windows\System\rQFLWKK.exe
  2⤵
  PID:13636
- C:\Windows\System\asgwGNF.exe
  C:\Windows\System\asgwGNF.exe
  2⤵
  PID:13836
- C:\Windows\System\qLWDAGp.exe
  C:\Windows\System\qLWDAGp.exe
  2⤵
  PID:14032
- C:\Windows\System\uEOCbJq.exe
  C:\Windows\System\uEOCbJq.exe
  2⤵
  PID:14168
- C:\Windows\System\ajiAxxc.exe
  C:\Windows\System\ajiAxxc.exe
  2⤵
  PID:14208
- C:\Windows\System\ZiYvizs.exe
  C:\Windows\System\ZiYvizs.exe
  2⤵
  PID:14120
- C:\Windows\System\PivBxmO.exe
  C:\Windows\System\PivBxmO.exe
  2⤵
  PID:14224
- C:\Windows\System\QivQsBW.exe
  C:\Windows\System\QivQsBW.exe
  2⤵
  PID:14248
- C:\Windows\System\FAVrMlT.exe
  C:\Windows\System\FAVrMlT.exe
  2⤵
  PID:14312
- C:\Windows\System\bbAcOHu.exe
  C:\Windows\System\bbAcOHu.exe
  2⤵
  PID:10572
- C:\Windows\System\LxIHHTN.exe
  C:\Windows\System\LxIHHTN.exe
  2⤵
  PID:13464
- C:\Windows\System\WATgrnH.exe
  C:\Windows\System\WATgrnH.exe
  2⤵
  PID:13600
- C:\Windows\System\AYDhbSd.exe
  C:\Windows\System\AYDhbSd.exe
  2⤵
  PID:11392
- C:\Windows\System\ZUzOyox.exe
  C:\Windows\System\ZUzOyox.exe
  2⤵
  PID:11584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bxk3mf2p.ily.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BNkTZgR.exe

Filesize
2.2MB

MD5
98f9760d0656d33d979165a0b7cc3959

SHA1
24fef4d27036c78843ffd5c7d02251bf4c682140

SHA256
889651961e5d81cf05d71ac02fda342be82909ca92967c6304e21557d394b3da

SHA512
7a6bd922703c1046cdfa95bab849020d26940cb94c5453129f6f2ba473020e3fa838702e2e7d4cbbbdba695baed2841d524f421c8e29820171e9b6c149db9ad9

Download Submit
C:\Windows\System\CgyJVkp.exe

Filesize
2.2MB

MD5
4e5c1b3c547f9f550979fa4a26767274

SHA1
f62c36d95ea4e5308028c05a2ee21545bd8cb955

SHA256
bff147597cc492f406e30db1e0e39d9d77f6cf75ed8619baee38a676436bd016

SHA512
88c4c3a1317d31b9737b4ac089971fb490ec4d1486482738b2538b1316bf93b060d427195814bedfb73d5c33bf728281aa47e1379c4c1b5800c89b4b1dcbaec2

Download Submit
C:\Windows\System\CyOBFYY.exe

Filesize
2.2MB

MD5
aafe38f8f602d64f0e93489c20672b98

SHA1
562a5b3b12aa537584a5e29ac469d0df77e05f27

SHA256
cc51a35e45ef653403c8369eff0ea7d0b51544b84aec71eca026cd1e8bf8ba9c

SHA512
7c77a310b643b0f1ff67992d0a21cdfa25c9bdf0343904558a767da1dc2681282461a5b5fe959e7af977b970dc76c21ee6add2c6bd5a410dd55e442cb335ce0d

Download Submit
C:\Windows\System\DEDQxaY.exe

Filesize
2.2MB

MD5
34b3545db9d59f31758df707dd191fd2

SHA1
4e82ff9e1c866ac946adf1875d87d0af66d071e1

SHA256
8f3f270f24e307e259697e14debddf594bf0309335aeb42f6cbfbb42e2269407

SHA512
d92b8a05296e1e2da09bcbf7f5fd80e5804aa0cd4e9ca38c63eae46b818130d107b4ae027dba1e25ddb0024018d7c02040a7a0cdfb15e921d1729d3332b59b91

Download Submit
C:\Windows\System\EJlmJVY.exe

Filesize
2.2MB

MD5
bbc3ffe77f21bb9234221979b1ac6377

SHA1
e199620d27aeeeeb192c54641cc2bd9be7fa8151

SHA256
3f5619e19b67dcce67f580e2b433e6840e5a6ed48bdb72cbafde97b98290b286

SHA512
b0119ea9c962a35642fdbd0400e53360fa36b03093c264c00c0a8337ca5fcd1a178d59d5dd94000dc0241766701c12f625c67f5a755341e85b6352e47336a329

Download Submit
C:\Windows\System\HKrjlLm.exe

Filesize
2.2MB

MD5
5a7d7e417b28fa065b389481836905c1

SHA1
96beb8e9b43ccf0417e1f2b2b5b8148f30588c57

SHA256
4cb408c7793b622b7b2ba04fb57a91946af62c9ed04e5215ad79efa1992a0ac5

SHA512
cf55ff0e911e4043a7d55d05aaab8af1188571636bdb7dc67acbe0e3ed689e02ff3773f6b10521da6736d045ca78740f50d14918015fa1db62f4085304d3a0f6

Download Submit
C:\Windows\System\HmMomsP.exe

Filesize
2.2MB

MD5
f64c1778ac3dd96b42a27d493a300221

SHA1
628d6abaa4791d0a4b7789e8d663886db9ffb375

SHA256
cb6a653ae2a27f63b7f1c008af014a0810298552483fb1279fd453d87ea2dfc0

SHA512
a6d975fe1b9d375d05981d1752d943768b49f51ca0487ad7c0f6991e83b7893f48fc252c1c0762e6af327c1c8d081ab4bf56d4699f331beba47ac72ad5e387c3

Download Submit
C:\Windows\System\MNoFCZR.exe

Filesize
2.2MB

MD5
e3b3732d3c679d29d33999ed210bb8c9

SHA1
692dc9d957d15d39493b6c81cbe35eab7d8140b1

SHA256
47a6ed449a0707d8cdff1d6082d0302dfdc829c867031007f5f8d0e616d86a42

SHA512
1aaae3e87a98f39b9561f9814d122dbb991dc249fbbb1bedf81b0b8ca19d1e92a3ea6b4da919d45496a72e6b86c06ede86eea9efa4bb93479778103e9f047ee2

Download Submit
C:\Windows\System\NPPyQjL.exe

Filesize
2.2MB

MD5
f213bb42b7e9e69d83208760816fa8da

SHA1
24a532a632461b80c4f935aed0ecf574d6e4b1b9

SHA256
99e2ab120f65785bf183b6e471a4b064b78aaaa76ed46f2a4a8fe00f6708abc6

SHA512
ab967a2980c6fe407122be6f9dad4a0e18922703cbb0fbbaf5bc2b16d1cd6a512aca1553e91a4dac9ae8d1829fdc93aafe27f2f55bb11a38776b4fca3239424c

Download Submit
C:\Windows\System\OboZMed.exe

Filesize
2.2MB

MD5
6873c170c2440475db447fdf0c68153d

SHA1
30a1674fdc79d2a8b15dfd595e943818e3647d0b

SHA256
206145a66fdb760fac462fe0938f2b6c50c5e85cb73fe93da6ae56bd129bc19d

SHA512
945847b136ac9a2b15864e106bc4b6319705c6c4040daab52dda0eed35434a3b3b339463eb010fb71accba76e0e67dbb367fd0b2c6d1a3db8199769d51900df3

Download Submit
C:\Windows\System\POBKhiX.exe

Filesize
2.2MB

MD5
8a55c99e36f55134dea6a2ea8f5056a5

SHA1
b28645324956e3f5d67f889cf209dd4f890b7ef0

SHA256
07c851a4682e59635cbf6349f140c1b54fafaba5ecfebee4f17d6967006dd979

SHA512
dc3a031de0b08898498c40a5f82c3e704558a38c1c48660087bc6091833b12d51562c14df8b18741e79968224f2f018f44c7869b64198688f4945d6b6ba5b842

Download Submit
C:\Windows\System\PxXqXOU.exe

Filesize
2.2MB

MD5
db352b9664af388767408e5fb7eaebe3

SHA1
76a8204ef5a0b00476c55a300edbc99723ce1523

SHA256
c7fc1a61b58741a08c993f47880d6bd18a83a803c7026c7c6bb920a56c75f911

SHA512
1adb399d1fe45e086acae8452ac97cc74b66468465fe940f0bc83b8acbfd7e49d9dab8b50324972064cccab1cdaeae6a2e7e459b0c0a12c920abf699a38a7ff7

Download Submit
C:\Windows\System\QtOvqPH.exe

Filesize
2.2MB

MD5
f605f8d0712ba7f4eb6c57cf60000a2f

SHA1
ccd985a6984be3474cf5a313821b5400779f6525

SHA256
d86316501fe811c133221ac41960bc471e153771193079c315fa50bd6a5d80ef

SHA512
739d666d8286855722bc1f3139ca96d0c57911de462f48f4f63442006c11a5c1d3ec416300905a2b1e4028738a9b6c976b9e3b29969246f34ba6d82a1ec84755

Download Submit
C:\Windows\System\RfgefhJ.exe

Filesize
2.2MB

MD5
6307de68c2e1239040455a1261e1da87

SHA1
fb6c5295dc324859f5aa0c7ab318478a749e86f2

SHA256
d003d26bd884234213cefbe0b946671e23831fbb4fcab0412b2b8a4838545e98

SHA512
7c3b334ed32aaaaff282720663bcbddc8cbf73b99e6b6e645cc8c67080bfcf23da33076a1916bb95f1c0faa53ba97462d5136bf4275153c7087a5897a98596da

Download Submit
C:\Windows\System\UgADtrZ.exe

Filesize
2.2MB

MD5
a8fd478fd5909ce9142f80b597bd6980

SHA1
781e7253214e13bc2eacd25416478022ac592205

SHA256
87a09cc7c7ddb9226d4dcfe54e83a018dd88d8f9c123c29ca9c79a4dfcf7f3e6

SHA512
47f44db2111cec1aed419caaee0fa7ca6a47fd08e0d08eb07368be27ecc5dd6ac62dc3f03e0ac37d2180bb4b173b2932d5adbb5b652109b8badb1a54b2ea3f94

Download Submit
C:\Windows\System\VPpJSid.exe

Filesize
2.2MB

MD5
b7564688511d3bae3a5d77a30f16afd6

SHA1
b3079075253ad9652dbaf0769299880dec3a6fe8

SHA256
e740f48ea265a5ee5d26db8e29d210e26da645f6d691f2c0302d7e7ac83a626d

SHA512
86edb5115c08cf7f142822c384bb932978398b6999b4425853d4be32bf4a9340a27fc7177a39ec40f95f29b4bcaf2f0841594a42858b4c0bf9c9095f815192f7

Download Submit
C:\Windows\System\WJdHgII.exe

Filesize
2.2MB

MD5
3eef3cfb774a83d556b8d159a84118f6

SHA1
ed09b29ff1ba578ccc101183675a3638096a10ef

SHA256
7952b7aefd2bd20a36689fd9f9b0a207b66818b701945f2dd8123371cd1e83d4

SHA512
cac6c53a4c7b5640fc89551304f68b668bfc04279c03f95b507811c699d3095d9e5ef9cac40ee20974c2f2ba6104b8643d71dcd77b58d5e813e03d1265bfd98b

Download Submit
C:\Windows\System\WLzkNyu.exe

Filesize
8B

MD5
7844449f1717b2590e53c215fcf07352

SHA1
79d0c9d199e3401234813cacf5dd2de0f53d76f4

SHA256
d54f9b9a769720c875f9b7152a74884a4a9e5a4d80da35d3f847cb8b30b14f4d

SHA512
08987ef45e3b930599e24a17bad53cfff0dadf3651ece3e5b0469612e6c0a9a6cc61ef278c49c769a425e8c5349976b197865ce68d78055e84972e2fe8a0851c

Download Submit
C:\Windows\System\WUvrsyq.exe

Filesize
2.2MB

MD5
c3b369b7412ba60feac68c62e8322728

SHA1
2a81c8e55af2a4f6bda2c4de26fcbb1da88a78e8

SHA256
79c0cfc0122dc51e04aef0ddd4ed65448df0bf01dcc8bb4e9c7043929d833a5e

SHA512
03ade6c84d71545420cd585ecbbba7c2e5f3abb481966716f0da351891e56396f0d9f4cd711fe9770939cf4bfcd570f5b3ba1b48c2241222f7787ff6775d9d66

Download Submit
C:\Windows\System\YrblPCi.exe

Filesize
2.2MB

MD5
e397150c63609fd3af0ac2cd428d0a8e

SHA1
eff9685344d84a32c5ed3884ca2058f16e4a62b4

SHA256
d4b7f1e19ef422987d47a9583aefcaed239575863fb8bec2f0e7e5e224ae4321

SHA512
c4618014424169afe052a5500a51d8615e400af8ade1b40e80393beb0235ccfc388ca2833ad7d7f283711e18d116c4ee3dcc2093f7b9d4541da5ef7515de74e9

Download Submit
C:\Windows\System\YyDjMuN.exe

Filesize
2.2MB

MD5
d550781f75c574c2d7773bf79c265fa2

SHA1
f12b632c9b12f9072930694241c8d5ddacc58336

SHA256
5dcf35fe5506fbb21970619d67cb62a502d19ecc293451e17fed7865a75243e3

SHA512
28fcbf43950f7ceb0c4b41e813bbbc98d4a4b07760b83e094402d52a2d0dfbce4e5616bc39a52f3ffdd5a164cbbb86dd8d80151f8b6d023324ed025687d6e849

Download Submit
C:\Windows\System\ZkJgNKX.exe

Filesize
2.2MB

MD5
a2e5bf55b950d9a7089af47c930fcc7a

SHA1
433260ef681ab44a7be8c562700c6c0e22998947

SHA256
7780fbba4f34c635e1f2e31c67dd6504d753ab052e5926aae9ce6bf4324a8831

SHA512
edfd90ee86e1e1ed92965544c139f840f38f63b72abcf2b8cdfd6f39dbd1fc94034109f39d1e49a68645d6ad4e67c71b07e87b64053a9935f195845cd4a52a9b

Download Submit
C:\Windows\System\akICJsB.exe

Filesize
2.2MB

MD5
dcd5426ed743477d64d830b07fa7c6b9

SHA1
df399d7139e458ab01dbc490a0eb57c18f69e371

SHA256
c2fbe49f61c9a0895bbf7042029ba197a06b3c138e7813bb60a6e6b5d19bb41c

SHA512
aadbf689160dfe50fcbc7c02b362a1f0bb90e12d88b16aba5d38ebd9ec04322f840b014e6c64fbda84c1427b0d2038443aee27b6e77cbd9fd8afa40745bcf9d2

Download Submit
C:\Windows\System\akjHoJT.exe

Filesize
2.2MB

MD5
18536ef7109528fc1962c4d55b0164bf

SHA1
b013de3d92500197e0206484e1db6686d5c568f5

SHA256
6db835906f1c5f05d7038770ff2b799510469d2ce247a98b020526629d69362c

SHA512
8720b6b9b501383b7fa243e22ac0f4ad4e4c4f250469f953f1583c68cea50daab5f5d94d419cd2a4f364b3f58a87bbaac598ef83955ccb0b010a890e964a1c88

Download Submit
C:\Windows\System\aySyLHy.exe

Filesize
2.2MB

MD5
578d5ceedc468c788e754050dac54ae0

SHA1
0c9120f57c92c4d4f709f8cdf35ceeb33bd25ceb

SHA256
cc61ae59bee56d99feb4e90e76bb11344a89c0d4f49b39465528c0c02fee09f3

SHA512
cc26395774f6b051011ae90d3eaa39315949e7954115745cf8e8e5636f032e73a835da78bc9b288f404248a70e45bd641a03168e85f2d881c583db6612dce597

Download Submit
C:\Windows\System\bkWGrXZ.exe

Filesize
2.2MB

MD5
f37779a6beedd063f2af93a5e4a80265

SHA1
ba6184ea88ab6e1ad5fde3a8a143d87011d8579f

SHA256
6836fa8cbb9fa1d71944d6693eb2b725a52a1f076f6251a3c7c7dd921212e44f

SHA512
c1248ec0d389ed7aedcbe094336f30244123396cf5def081945c31cac139ecff1266aef776b86bbb283daa055fc040eccdfc4a611f480a094bc8ac710e4ebff1

Download Submit
C:\Windows\System\cgtodus.exe

Filesize
2.2MB

MD5
fc06b153e80dabe24efe40fa74e63a12

SHA1
f650af0a7f4ce4226faa5c910c64429c98a74082

SHA256
789af8529b1acad16c01a89fa6e3b186a9f55966c749014af418f2883a6afa05

SHA512
ec280a1480dae7d5e2569b69284eda4afc9869c0ee9b8775e0745c5c070d17dbae7f0de078aa8174f47acc50c8e24670b1597cbae6555761e5b11e7eff801f9c

Download Submit
C:\Windows\System\gFpTfXE.exe

Filesize
2.2MB

MD5
f9b5b3d972ab3c838adbd5dac8a391a6

SHA1
194cd88a9e72043746cd159bfce50d9ff38b2ad0

SHA256
634e0149135a39420a61d81e5b252e0ce31a773244a66ce89eab651b40bcae69

SHA512
912480cff7c8a70ca997180a10517bb2efe7a38f467e76c1a94e596bca9ddfcb6b59f77337620b2ac80fd55a4c8b21d7fc174fb7528f92ec193118e825e6d213

Download Submit
C:\Windows\System\hjRJBdv.exe

Filesize
2.2MB

MD5
90530c2ef6e44737644c4815acc14fbc

SHA1
61c40d1c148fbd3c017d439e6e93b4f69a5ca961

SHA256
24b45424e13b986daba2d2508b96dfd698671c8d3f127e54ae0e6423decaaa25

SHA512
bedece9133e762fcb5471a8fada55e20aa09836057e7a01058654575424ac7d9e5107d75ddf644b534da8485142cea7d30ed226f7fd39954a7091b477b557b56

Download Submit
C:\Windows\System\iNrZwdX.exe

Filesize
2.2MB

MD5
d506f52015dfd5222fa26ac9eaf715f9

SHA1
2892969eb31a67c7d61c022bf5b33f4bab35d693

SHA256
cb654e11fe4bf71eb445115379b18c4f9471350b5f04e1b7fe1acdd3482dda70

SHA512
24a3191352b786e681eafd932c6d36a78a5feeeafd558eb57e07cf095e727a37599e62bf75464048fc15240e15a3fec7d01420af9ee648e192452fe1b1661d0a

Download Submit
C:\Windows\System\kxvlnUS.exe

Filesize
2.2MB

MD5
ddbf12a084aee718613cf9e20bc38dfb

SHA1
234b4a48a8217b7b231e864878d4d68f7a49c1e8

SHA256
02698e338846540566c0c049cd0f5460aa8c41470ab9e0b7aa2dfee826a3c95e

SHA512
e29bd5e87a3793bae0a6f8dd4cfd64b6e98caa667b338b57461fd1340f5d0bd86c58a36961d14b44ba5c4d794d6729f9d3be829451e1b8b64f34dfd492220699

Download Submit
C:\Windows\System\nwJksPt.exe

Filesize
2.2MB

MD5
d64170d6f1bf6dae1ba6229c108f766e

SHA1
d4c7a716c76ee42a34407508c5f7a4f4af4d5f77

SHA256
ffe04690425accf72c575eeb61657ff8737804812c04f2c16a44581be255220a

SHA512
fc77434519aca9cbe6134ca94937290875f3bf6b66c637b7dc8c08285c72137ec34232eda140837f163a5a3d5e1da391520b8b21b469bed9a9b2be1adc67f96b

Download Submit
C:\Windows\System\ptHhLSG.exe

Filesize
2.2MB

MD5
1bd719b66efc03899b49d294f7fe2e41

SHA1
8a16ad1f309d17c2ad6a159f9c4e06990da384de

SHA256
d8832abaece1c0defe5766cd29cd2cd547cc06c4502263c9f18b688a37761b3e

SHA512
d5da914dcf6b8cc39054e35aa8c0cb0a7149f60f339c594f22e03d26a911d3ff37b181f6623f9f5752e75dc01fd9a2e71f46108b7eb5983cc6d1866565d27746

Download Submit
C:\Windows\System\skPsSYB.exe

Filesize
2.2MB

MD5
38aa32b641693dbed1e52f4d674dabd5

SHA1
ed0429c88bc4e412b41792ea99a6c7cae1d996de

SHA256
53ff19ed3f45f8f7b7200bd0cce924a0455bce74ca0d660d2218b5b56d6553a4

SHA512
1071ad41d613e35b8773d921016ebe7cdb8c6b6134bced5b8818992fb68526cc9c95ab158ca2d312e23810fbeba009bde480ec80dde633676914de371b2b8442

Download Submit
C:\Windows\System\tEIcWMs.exe

Filesize
2.2MB

MD5
f7efcdf09cdc12232792c5441713e0fe

SHA1
fcd860e03f675a58d4c320bbc310acee13da3520

SHA256
8d87edd09310b02f80e91cbd2b720f68f2f7521ee644c86cdc4d9dd2fe5bd6c7

SHA512
7b76fc5d97f1c9aaa2accd147250943be1f07f74a5832e8982c5d3d1026fc0df6a07c62f59b82ccfb2254bf00dd9d67dc2c7874ca2e97c9875cb9f5715cdc230

Download Submit
C:\Windows\System\tHWFqFm.exe

Filesize
2.2MB

MD5
7b7338d36c1596304ec095639083b647

SHA1
998524bcada69d1773eb1047731d8e03d539eb5d

SHA256
e296d83bb61b63aa3683863e631f22aeb313fad9ea338391306702ddc2e48ca4

SHA512
8b61af0339f4c27c2f659eeebfead7871d021717aaf481ac2740442e1d6286ad6860e08f5a7dcbeada19847cf9ab0afb6ed9254890d906eb6b81e7d0675295dd

Download Submit
C:\Windows\System\uDahtrA.exe

Filesize
2.2MB

MD5
76c93cab9ca6871c75a93b63259b93be

SHA1
df37dbb987240b646ab49cc2a34328c7c9a88d36

SHA256
3bf365ced3cc79e585ee21d976a10a4ee3ac68f7fcaf7c64b1054a56e6288e2f

SHA512
1a20d4488ddb7b253eeb1ddb767c23c009cee40ccd910bcc9bd48f79a5139115607286c3e8df9eef983f8d458ceddabf5c035e677ba55dbd9789e18af8647e20

Download Submit
C:\Windows\System\uNxeTSC.exe

Filesize
2.2MB

MD5
997dc7c51537be43c83f5ab281bce4e2

SHA1
9f4e806793b2ce94fc221bdf2806c1fc798d75b2

SHA256
7b4db9bb1b2d333b63280cb7d2b6a69aad2f6bd8307ce9ef0d090c3903bdba42

SHA512
4833a1e2b8f4c4752dd4b6944dea6d6223112bb25164ad0d909346ec6a4156ddd0e58571b1d14e67f59070888ec3a874e6d0c460b7442578bb00d64ecba78fbb

Download Submit
C:\Windows\System\vMtngdb.exe

Filesize
2.2MB

MD5
28988f10b3e4c2d9dedf912e773a1d27

SHA1
13594c6e97ba8e24831c8038475aa5b45de7b852

SHA256
802d6599b4e02130cffbfc7cf94612a0439c98ce517275af16fd845efaf7cc54

SHA512
81dd4b57f442d2b23a7fef2776167e217292f6d71a2abb72092f45f7853342eafdbf1b3489d96564f13737d1303266f22a0b0a0a313c42bf9d00b64f662c3a55

Download Submit
C:\Windows\System\wLpYlzu.exe

Filesize
2.2MB

MD5
c8e89889afc2777a89bfd642fe5823a4

SHA1
82bb5eb99a56a7ad3d59ed359fbd09f2bf3f57b2

SHA256
66dd5cf1b173d68a0100c10ab8b8acfd50e64357fc9d6432bfcdc938a2304776

SHA512
db34e83ea264e7f217d5bdd5792b89e89da73d7ece8bd5b8a7a1f9226b5ee46c17ae35be1920fe8dd3f8b3825656448641461ce3ba7612cd9543298da2322c2b

Download Submit
C:\Windows\System\wNLmEbg.exe

Filesize
2.2MB

MD5
1878c5c0e2143c37a3c84e4b4ee5925a

SHA1
2303d7393821beb397434f694e149c0a8b4f0f89

SHA256
004cc101255b02ddb1fc748109777188bbfe3b54553e71f2eedbce0fc61d87b7

SHA512
659bae91b63c181104916c0169c43ba74ad056a8dad03dba3c25288fcb65c4afccd71d4150b235d25fa30d96f69a5970ead6226c7a970468fdc953030de9233b

Download Submit
C:\Windows\System\wjzEmSg.exe

Filesize
2.2MB

MD5
74536ffc99125e7deed417b10cc266ad

SHA1
d46644d2716c2893968a17ce8f8754c8ee34bf17

SHA256
a317ecba0a9ad9da5bf2063443da9769a75f61605bb160a278c428abe53a7580

SHA512
ac66eaf2bd11d1257f0975c2914c564b1f0ec175dc226ac9c73baa99fce0b156e0bde2a5fca21e6d79b8a21544e3534785fbb42595b3259f8f556f4f222d5557

Download Submit
C:\Windows\System\xoSJUBm.exe

Filesize
2.2MB

MD5
88c6ef4f9a7d9645a4c50880ddaa2910

SHA1
e5295eb689e5d39272aff1df1874d7c5f58bd836

SHA256
35c6f0baa8545c08a1a5f03e8622c583a8df6d0e788d73665164b584f318c414

SHA512
94af9be81b4a46f1e4832abf4f63b60479e33be82585fa232b9abfbabcb99ae903a2b43de16948a096d1862b0b2f65c46de7f2848405f42a0c7068b6bb52cdd4

Download Submit
memory/32-3261-0x00007FF7A84E0000-0x00007FF7A88D2000-memory.dmp

Filesize
3.9MB

Download
memory/32-300-0x00007FF7A84E0000-0x00007FF7A88D2000-memory.dmp

Filesize
3.9MB

Download
memory/1184-296-0x00007FF7198C0000-0x00007FF719CB2000-memory.dmp

Filesize
3.9MB

Download
memory/1184-3237-0x00007FF7198C0000-0x00007FF719CB2000-memory.dmp

Filesize
3.9MB

Download
memory/1284-3271-0x00007FF781F90000-0x00007FF782382000-memory.dmp

Filesize
3.9MB

Download
memory/1284-288-0x00007FF781F90000-0x00007FF782382000-memory.dmp

Filesize
3.9MB

Download
memory/1288-150-0x00007FF6C68E0000-0x00007FF6C6CD2000-memory.dmp

Filesize
3.9MB

Download
memory/1288-3227-0x00007FF6C68E0000-0x00007FF6C6CD2000-memory.dmp

Filesize
3.9MB

Download
memory/1676-291-0x00007FF7CCFC0000-0x00007FF7CD3B2000-memory.dmp

Filesize
3.9MB

Download
memory/1676-3265-0x00007FF7CCFC0000-0x00007FF7CD3B2000-memory.dmp

Filesize
3.9MB

Download
memory/1720-3240-0x00007FF73F0D0000-0x00007FF73F4C2000-memory.dmp

Filesize
3.9MB

Download
memory/1720-276-0x00007FF73F0D0000-0x00007FF73F4C2000-memory.dmp

Filesize
3.9MB

Download
memory/1956-193-0x00007FF70E9A0000-0x00007FF70ED92000-memory.dmp

Filesize
3.9MB

Download
memory/1956-3243-0x00007FF70E9A0000-0x00007FF70ED92000-memory.dmp

Filesize
3.9MB

Download
memory/2064-297-0x00007FF77B750000-0x00007FF77BB42000-memory.dmp

Filesize
3.9MB

Download
memory/2064-3245-0x00007FF77B750000-0x00007FF77BB42000-memory.dmp

Filesize
3.9MB

Download
memory/2160-3258-0x00007FF6EE080000-0x00007FF6EE472000-memory.dmp

Filesize
3.9MB

Download
memory/2160-289-0x00007FF6EE080000-0x00007FF6EE472000-memory.dmp

Filesize
3.9MB

Download
memory/2516-0-0x00007FF6162A0000-0x00007FF616692000-memory.dmp

Filesize
3.9MB

Download
memory/2516-1-0x0000020895750000-0x0000020895760000-memory.dmp

Filesize
64KB

Download
memory/2800-298-0x00007FF6B8A80000-0x00007FF6B8E72000-memory.dmp

Filesize
3.9MB

Download
memory/2800-3247-0x00007FF6B8A80000-0x00007FF6B8E72000-memory.dmp

Filesize
3.9MB

Download
memory/2928-292-0x00007FF75F800000-0x00007FF75FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/2928-3264-0x00007FF75F800000-0x00007FF75FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/3060-294-0x00007FF77DF20000-0x00007FF77E312000-memory.dmp

Filesize
3.9MB

Download
memory/3060-3260-0x00007FF77DF20000-0x00007FF77E312000-memory.dmp

Filesize
3.9MB

Download
memory/3416-3235-0x00007FF659BD0000-0x00007FF659FC2000-memory.dmp

Filesize
3.9MB

Download
memory/3416-286-0x00007FF659BD0000-0x00007FF659FC2000-memory.dmp

Filesize
3.9MB

Download
memory/3480-293-0x00007FF740E10000-0x00007FF741202000-memory.dmp

Filesize
3.9MB

Download
memory/3480-3274-0x00007FF740E10000-0x00007FF741202000-memory.dmp

Filesize
3.9MB

Download
memory/3612-3225-0x00007FF706890000-0x00007FF706C82000-memory.dmp

Filesize
3.9MB

Download
memory/3612-61-0x00007FF706890000-0x00007FF706C82000-memory.dmp

Filesize
3.9MB

Download
memory/4344-3231-0x00007FF725830000-0x00007FF725C22000-memory.dmp

Filesize
3.9MB

Download
memory/4344-226-0x00007FF725830000-0x00007FF725C22000-memory.dmp

Filesize
3.9MB

Download
memory/4504-3223-0x00007FF63B650000-0x00007FF63BA42000-memory.dmp

Filesize
3.9MB

Download
memory/4504-95-0x00007FF63B650000-0x00007FF63BA42000-memory.dmp

Filesize
3.9MB

Download
memory/4632-295-0x00007FF758120000-0x00007FF758512000-memory.dmp

Filesize
3.9MB

Download
memory/4632-3275-0x00007FF758120000-0x00007FF758512000-memory.dmp

Filesize
3.9MB

Download
memory/4792-3241-0x00007FF6E7390000-0x00007FF6E7782000-memory.dmp

Filesize
3.9MB

Download
memory/4792-287-0x00007FF6E7390000-0x00007FF6E7782000-memory.dmp

Filesize
3.9MB

Download
memory/4796-66-0x000002A2BBF00000-0x000002A2BBF10000-memory.dmp

Filesize
64KB

Download
memory/4796-42-0x00007FFE62EF0000-0x00007FFE639B1000-memory.dmp

Filesize
10.8MB

Download
memory/4796-290-0x000002A2BBFB0000-0x000002A2BBFD2000-memory.dmp

Filesize
136KB

Download
memory/4796-64-0x000002A2BBF00000-0x000002A2BBF10000-memory.dmp

Filesize
64KB

Download
memory/4812-3234-0x00007FF74D9A0000-0x00007FF74DD92000-memory.dmp

Filesize
3.9MB

Download
memory/4812-299-0x00007FF74D9A0000-0x00007FF74DD92000-memory.dmp

Filesize
3.9MB

Download
memory/4908-3229-0x00007FF6AB810000-0x00007FF6ABC02000-memory.dmp

Filesize
3.9MB

Download
memory/4908-139-0x00007FF6AB810000-0x00007FF6ABC02000-memory.dmp

Filesize
3.9MB

Download