xmrig | 788a7d11dbef31b9648dc00ca9fb7c36681de0bab7e60c7916c60e91a1e5ceec

Analysis

max time kernel
68s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29-04-2024 10:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
Size

2.2MB
MD5

0764332d6adc0f1ffe16caa8d5ad60ab
SHA1

fa8f5ad68a79478b678090656a0b1839415bda7b
SHA256

788a7d11dbef31b9648dc00ca9fb7c36681de0bab7e60c7916c60e91a1e5ceec
SHA512

fbae9b1ebf14d065b2de299432110d31919a56ba26b1f6b38209fa9dfe1d128062c06c5c1f7f56ee8f1a01b39dd1392d47d9c1754ce7e8614de412b1df3ea0b0
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfh:NAB2

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 39 IoCs

miner

resource	yara_rule
behavioral2/memory/540-235-0x00007FF6CB940000-0x00007FF6CBD32000-memory.dmp	xmrig
behavioral2/memory/3388-287-0x00007FF686F30000-0x00007FF687322000-memory.dmp	xmrig
behavioral2/memory/1572-361-0x00007FF639520000-0x00007FF639912000-memory.dmp	xmrig
behavioral2/memory/4280-418-0x00007FF7B5240000-0x00007FF7B5632000-memory.dmp	xmrig
behavioral2/memory/3536-424-0x00007FF63BB10000-0x00007FF63BF02000-memory.dmp	xmrig
behavioral2/memory/1440-423-0x00007FF6125A0000-0x00007FF612992000-memory.dmp	xmrig
behavioral2/memory/4856-386-0x00007FF625FC0000-0x00007FF6263B2000-memory.dmp	xmrig
behavioral2/memory/1640-385-0x00007FF6A30D0000-0x00007FF6A34C2000-memory.dmp	xmrig
behavioral2/memory/2824-323-0x00007FF626C40000-0x00007FF627032000-memory.dmp	xmrig
behavioral2/memory/3356-295-0x00007FF6667D0000-0x00007FF666BC2000-memory.dmp	xmrig
behavioral2/memory/4348-294-0x00007FF72A580000-0x00007FF72A972000-memory.dmp	xmrig
behavioral2/memory/1252-261-0x00007FF7F99B0000-0x00007FF7F9DA2000-memory.dmp	xmrig
behavioral2/memory/2000-226-0x00007FF6942B0000-0x00007FF6946A2000-memory.dmp	xmrig
behavioral2/memory/5112-225-0x00007FF6BEE20000-0x00007FF6BF212000-memory.dmp	xmrig
behavioral2/memory/1264-164-0x00007FF6B60B0000-0x00007FF6B64A2000-memory.dmp	xmrig
behavioral2/memory/1096-142-0x00007FF60CEE0000-0x00007FF60D2D2000-memory.dmp	xmrig
behavioral2/memory/2232-95-0x00007FF658510000-0x00007FF658902000-memory.dmp	xmrig
behavioral2/memory/3260-53-0x00007FF7E8BC0000-0x00007FF7E8FB2000-memory.dmp	xmrig
behavioral2/memory/1640-2905-0x00007FF6A30D0000-0x00007FF6A34C2000-memory.dmp	xmrig
behavioral2/memory/3260-2907-0x00007FF7E8BC0000-0x00007FF7E8FB2000-memory.dmp	xmrig
behavioral2/memory/3164-2909-0x00007FF619130000-0x00007FF619522000-memory.dmp	xmrig
behavioral2/memory/2232-2911-0x00007FF658510000-0x00007FF658902000-memory.dmp	xmrig
behavioral2/memory/2000-2915-0x00007FF6942B0000-0x00007FF6946A2000-memory.dmp	xmrig
behavioral2/memory/1096-2914-0x00007FF60CEE0000-0x00007FF60D2D2000-memory.dmp	xmrig
behavioral2/memory/5112-2917-0x00007FF6BEE20000-0x00007FF6BF212000-memory.dmp	xmrig
behavioral2/memory/1264-2934-0x00007FF6B60B0000-0x00007FF6B64A2000-memory.dmp	xmrig
behavioral2/memory/4704-2941-0x00007FF7CF4F0000-0x00007FF7CF8E2000-memory.dmp	xmrig
behavioral2/memory/1440-2940-0x00007FF6125A0000-0x00007FF612992000-memory.dmp	xmrig
behavioral2/memory/4348-2947-0x00007FF72A580000-0x00007FF72A972000-memory.dmp	xmrig
behavioral2/memory/3536-2946-0x00007FF63BB10000-0x00007FF63BF02000-memory.dmp	xmrig
behavioral2/memory/3356-2937-0x00007FF6667D0000-0x00007FF666BC2000-memory.dmp	xmrig
behavioral2/memory/4856-2933-0x00007FF625FC0000-0x00007FF6263B2000-memory.dmp	xmrig
behavioral2/memory/4280-2931-0x00007FF7B5240000-0x00007FF7B5632000-memory.dmp	xmrig
behavioral2/memory/540-2929-0x00007FF6CB940000-0x00007FF6CBD32000-memory.dmp	xmrig
behavioral2/memory/3388-2925-0x00007FF686F30000-0x00007FF687322000-memory.dmp	xmrig
behavioral2/memory/1572-2921-0x00007FF639520000-0x00007FF639912000-memory.dmp	xmrig
behavioral2/memory/1252-2927-0x00007FF7F99B0000-0x00007FF7F9DA2000-memory.dmp	xmrig
behavioral2/memory/4836-2923-0x00007FF7380F0000-0x00007FF7384E2000-memory.dmp	xmrig
behavioral2/memory/2824-2971-0x00007FF626C40000-0x00007FF627032000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1640	ocFfxBQ.exe
3260	jbxIjzV.exe
3164	lNZjIAy.exe
4836	WSrkRtb.exe
2232	hZerHrK.exe
1096	IaGjaTO.exe
1264	COrWAzM.exe
4856	QKCGCOd.exe
4704	rUtxIkt.exe
5112	UNMosJR.exe
2000	eLGfSzA.exe
540	AVvLqag.exe
4280	qbVTOHO.exe
1252	jTvkfmQ.exe
3388	zyRxiLu.exe
1440	AAFjdnr.exe
4348	rnMyYHv.exe
3356	dmwNVoo.exe
3536	PzDsMyD.exe
2824	amXmhLn.exe
1572	lZjvsaz.exe
4548	vDXdDdS.exe
3528	jtPhMUR.exe
1396	JEVuunl.exe
2016	lYQVPEt.exe
2732	vwMOEvU.exe
212	VVVAzWU.exe
2848	UYbDoeW.exe
1000	sqRzxoA.exe
1592	EqDCHNH.exe
216	fAQqLDb.exe
1132	IqVzVPf.exe
4308	ylGdiIL.exe
4392	afjDNUF.exe
2772	KoCBhxf.exe
1060	zGqofav.exe
708	QDCtDoP.exe
1208	ADCOsnM.exe
884	KPEQeLq.exe
1644	iulNntJ.exe
4120	jToiSmI.exe
1876	MFqnbof.exe
3240	ipKRfNc.exe
4244	oHqeoqL.exe
3672	MofRONy.exe
3832	zIZGHxK.exe
4784	GdmvPxv.exe
4776	TBgXkhB.exe
1468	ibwCRcV.exe
1700	kdZnmhU.exe
4428	hlbSMFN.exe
3768	dFfEQjM.exe
2412	VgEMGPJ.exe
4536	dWkvbCM.exe
4564	wkGKzob.exe
732	aDitLyN.exe
2456	bhlEoxH.exe
8	kPNuDTl.exe
2940	bpsQbXf.exe
1600	bnWAfcx.exe
2756	gpWvwWD.exe
4264	IOliVfo.exe
2684	ScPmkIH.exe
988	MJPakwM.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1792-0-0x00007FF7B11E0000-0x00007FF7B15D2000-memory.dmp	upx
behavioral2/files/0x000a000000023b7e-7.dat	upx
behavioral2/files/0x000b000000023b79-5.dat	upx
behavioral2/files/0x000a000000023b7d-8.dat	upx
behavioral2/files/0x000a000000023b82-34.dat	upx
behavioral2/files/0x000a000000023b87-50.dat	upx
behavioral2/files/0x000a000000023b8c-68.dat	upx
behavioral2/files/0x000a000000023b8f-89.dat	upx
behavioral2/files/0x000a000000023ba0-161.dat	upx
behavioral2/files/0x000a000000023b92-186.dat	upx
behavioral2/memory/540-235-0x00007FF6CB940000-0x00007FF6CBD32000-memory.dmp	upx
behavioral2/memory/3388-287-0x00007FF686F30000-0x00007FF687322000-memory.dmp	upx
behavioral2/memory/1572-361-0x00007FF639520000-0x00007FF639912000-memory.dmp	upx
behavioral2/memory/4280-418-0x00007FF7B5240000-0x00007FF7B5632000-memory.dmp	upx
behavioral2/memory/3536-424-0x00007FF63BB10000-0x00007FF63BF02000-memory.dmp	upx
behavioral2/memory/1440-423-0x00007FF6125A0000-0x00007FF612992000-memory.dmp	upx
behavioral2/memory/4856-386-0x00007FF625FC0000-0x00007FF6263B2000-memory.dmp	upx
behavioral2/memory/1640-385-0x00007FF6A30D0000-0x00007FF6A34C2000-memory.dmp	upx
behavioral2/memory/2824-323-0x00007FF626C40000-0x00007FF627032000-memory.dmp	upx
behavioral2/memory/3356-295-0x00007FF6667D0000-0x00007FF666BC2000-memory.dmp	upx
behavioral2/memory/4348-294-0x00007FF72A580000-0x00007FF72A972000-memory.dmp	upx
behavioral2/memory/1252-261-0x00007FF7F99B0000-0x00007FF7F9DA2000-memory.dmp	upx
behavioral2/memory/2000-226-0x00007FF6942B0000-0x00007FF6946A2000-memory.dmp	upx
behavioral2/memory/5112-225-0x00007FF6BEE20000-0x00007FF6BF212000-memory.dmp	upx
behavioral2/memory/4704-205-0x00007FF7CF4F0000-0x00007FF7CF8E2000-memory.dmp	upx
behavioral2/files/0x000a000000023b89-183.dat	upx
behavioral2/files/0x000a000000023b91-181.dat	upx
behavioral2/files/0x000a000000023ba3-179.dat	upx
behavioral2/files/0x000a000000023b8d-170.dat	upx
behavioral2/files/0x000a000000023b88-167.dat	upx
behavioral2/files/0x000a000000023b96-165.dat	upx
behavioral2/memory/1264-164-0x00007FF6B60B0000-0x00007FF6B64A2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba1-162.dat	upx
behavioral2/files/0x000a000000023b9f-160.dat	upx
behavioral2/files/0x000a000000023b9e-159.dat	upx
behavioral2/files/0x000a000000023b9d-158.dat	upx
behavioral2/files/0x000a000000023b9c-155.dat	upx
behavioral2/files/0x000a000000023b9b-154.dat	upx
behavioral2/files/0x000a000000023b9a-153.dat	upx
behavioral2/files/0x000a000000023b99-152.dat	upx
behavioral2/files/0x000a000000023b90-148.dat	upx
behavioral2/files/0x000a000000023b98-147.dat	upx
behavioral2/files/0x000a000000023b97-145.dat	upx
behavioral2/memory/1096-142-0x00007FF60CEE0000-0x00007FF60D2D2000-memory.dmp	upx
behavioral2/files/0x000a000000023b95-136.dat	upx
behavioral2/files/0x000a000000023ba2-163.dat	upx
behavioral2/files/0x000a000000023b94-126.dat	upx
behavioral2/files/0x000a000000023b8b-119.dat	upx
behavioral2/files/0x000a000000023b93-117.dat	upx
behavioral2/files/0x000a000000023b8a-109.dat	upx
behavioral2/files/0x000a000000023b85-107.dat	upx
behavioral2/files/0x000a000000023b8e-106.dat	upx
behavioral2/memory/2232-95-0x00007FF658510000-0x00007FF658902000-memory.dmp	upx
behavioral2/memory/4836-92-0x00007FF7380F0000-0x00007FF7384E2000-memory.dmp	upx
behavioral2/files/0x000a000000023b86-78.dat	upx
behavioral2/files/0x000a000000023b81-74.dat	upx
behavioral2/files/0x000a000000023b84-100.dat	upx
behavioral2/files/0x000a000000023b83-71.dat	upx
behavioral2/memory/3164-69-0x00007FF619130000-0x00007FF619522000-memory.dmp	upx
behavioral2/files/0x000a000000023b7f-66.dat	upx
behavioral2/files/0x000a000000023b80-59.dat	upx
behavioral2/memory/3260-53-0x00007FF7E8BC0000-0x00007FF7E8FB2000-memory.dmp	upx
behavioral2/memory/1640-2905-0x00007FF6A30D0000-0x00007FF6A34C2000-memory.dmp	upx
behavioral2/memory/3260-2907-0x00007FF7E8BC0000-0x00007FF7E8FB2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\bPkmABu.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\fSZGYTs.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\GKkwagx.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\ZCCCLoD.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\uqcpjij.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\TPewsxj.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\xsBZPvD.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\lPmcaNq.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\LQuvZmi.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\snrLisf.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\VToGxXY.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\KEmCZDM.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\BXbJPzq.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\sdpmcuj.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\oaeyIss.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\GGgaZWv.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\TbKuEzt.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\vGWMTUZ.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\gJpuFAl.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\Lskwxtc.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\TMULmsF.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\pDgQNnk.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\YDXvSES.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\lkdtoft.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\JuQBWbA.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\dIMxWGd.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\kZYAoKC.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\XicGFnk.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\qKnakID.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\SqrUFxR.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\YmXRBiH.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\IRzkFHi.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\PaTJVCZ.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\DocMkcY.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\VVVAzWU.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\NpQqKzW.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\ePWsiFR.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\nVQodHj.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\KBanQFE.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\UmbbQOh.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\bBSCBbC.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\JzbCfLX.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\AjVhIux.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\mFpgLTp.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\XdKzEVA.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\ugegkft.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\iqqpmzh.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\zQoSAHj.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\xBxygfE.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\IaGjaTO.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\gysOoIY.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\uGkEdHO.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\qiPGpXc.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\lzzAlCI.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\elcmXFO.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\WxnDUVH.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\zGqofav.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\puGIaPg.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\LaxOXth.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\NEwoFba.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\guvlsba.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\CtSnTPX.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\jJAgEHK.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\lUQOjvN.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3172	powershell.exe
Token: SeLockMemoryPrivilege	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 3172	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	84
PID 1792 wrote to memory of 3172	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	84
PID 1792 wrote to memory of 1640	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	85
PID 1792 wrote to memory of 1640	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	85
PID 1792 wrote to memory of 3260	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	86
PID 1792 wrote to memory of 3260	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	86
PID 1792 wrote to memory of 3164	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	87
PID 1792 wrote to memory of 3164	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	87
PID 1792 wrote to memory of 4836	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	88
PID 1792 wrote to memory of 4836	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	88
PID 1792 wrote to memory of 2232	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	89
PID 1792 wrote to memory of 2232	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	89
PID 1792 wrote to memory of 5112	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	90
PID 1792 wrote to memory of 5112	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	90
PID 1792 wrote to memory of 1096	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	91
PID 1792 wrote to memory of 1096	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	91
PID 1792 wrote to memory of 1264	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	92
PID 1792 wrote to memory of 1264	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	92
PID 1792 wrote to memory of 4856	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	93
PID 1792 wrote to memory of 4856	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	93
PID 1792 wrote to memory of 4704	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	94
PID 1792 wrote to memory of 4704	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	94
PID 1792 wrote to memory of 2000	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	95
PID 1792 wrote to memory of 2000	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	95
PID 1792 wrote to memory of 540	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	96
PID 1792 wrote to memory of 540	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	96
PID 1792 wrote to memory of 1440	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	97
PID 1792 wrote to memory of 1440	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	97
PID 1792 wrote to memory of 4348	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	98
PID 1792 wrote to memory of 4348	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	98
PID 1792 wrote to memory of 4280	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	99
PID 1792 wrote to memory of 4280	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	99
PID 1792 wrote to memory of 1252	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	100
PID 1792 wrote to memory of 1252	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	100
PID 1792 wrote to memory of 3388	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	101
PID 1792 wrote to memory of 3388	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	101
PID 1792 wrote to memory of 3536	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	102
PID 1792 wrote to memory of 3536	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	102
PID 1792 wrote to memory of 2824	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	103
PID 1792 wrote to memory of 2824	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	103
PID 1792 wrote to memory of 3356	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	104
PID 1792 wrote to memory of 3356	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	104
PID 1792 wrote to memory of 1572	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	105
PID 1792 wrote to memory of 1572	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	105
PID 1792 wrote to memory of 4548	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	106
PID 1792 wrote to memory of 4548	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	106
PID 1792 wrote to memory of 3528	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	107
PID 1792 wrote to memory of 3528	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	107
PID 1792 wrote to memory of 1396	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	108
PID 1792 wrote to memory of 1396	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	108
PID 1792 wrote to memory of 2016	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	109
PID 1792 wrote to memory of 2016	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	109
PID 1792 wrote to memory of 2732	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	110
PID 1792 wrote to memory of 2732	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	110
PID 1792 wrote to memory of 212	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	111
PID 1792 wrote to memory of 212	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	111
PID 1792 wrote to memory of 2848	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	112
PID 1792 wrote to memory of 2848	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	112
PID 1792 wrote to memory of 1000	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	113
PID 1792 wrote to memory of 1000	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	113
PID 1792 wrote to memory of 1592	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	114
PID 1792 wrote to memory of 1592	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	114
PID 1792 wrote to memory of 216	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	115
PID 1792 wrote to memory of 216	1792	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3172
- C:\Windows\System\ocFfxBQ.exe
  C:\Windows\System\ocFfxBQ.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\jbxIjzV.exe
  C:\Windows\System\jbxIjzV.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\lNZjIAy.exe
  C:\Windows\System\lNZjIAy.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\WSrkRtb.exe
  C:\Windows\System\WSrkRtb.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\hZerHrK.exe
  C:\Windows\System\hZerHrK.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\UNMosJR.exe
  C:\Windows\System\UNMosJR.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\IaGjaTO.exe
  C:\Windows\System\IaGjaTO.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\COrWAzM.exe
  C:\Windows\System\COrWAzM.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\QKCGCOd.exe
  C:\Windows\System\QKCGCOd.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\rUtxIkt.exe
  C:\Windows\System\rUtxIkt.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\eLGfSzA.exe
  C:\Windows\System\eLGfSzA.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\AVvLqag.exe
  C:\Windows\System\AVvLqag.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\AAFjdnr.exe
  C:\Windows\System\AAFjdnr.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\rnMyYHv.exe
  C:\Windows\System\rnMyYHv.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\qbVTOHO.exe
  C:\Windows\System\qbVTOHO.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\jTvkfmQ.exe
  C:\Windows\System\jTvkfmQ.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\zyRxiLu.exe
  C:\Windows\System\zyRxiLu.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\PzDsMyD.exe
  C:\Windows\System\PzDsMyD.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\amXmhLn.exe
  C:\Windows\System\amXmhLn.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\dmwNVoo.exe
  C:\Windows\System\dmwNVoo.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\lZjvsaz.exe
  C:\Windows\System\lZjvsaz.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\vDXdDdS.exe
  C:\Windows\System\vDXdDdS.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\jtPhMUR.exe
  C:\Windows\System\jtPhMUR.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\JEVuunl.exe
  C:\Windows\System\JEVuunl.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\lYQVPEt.exe
  C:\Windows\System\lYQVPEt.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\vwMOEvU.exe
  C:\Windows\System\vwMOEvU.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\VVVAzWU.exe
  C:\Windows\System\VVVAzWU.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\UYbDoeW.exe
  C:\Windows\System\UYbDoeW.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\sqRzxoA.exe
  C:\Windows\System\sqRzxoA.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\EqDCHNH.exe
  C:\Windows\System\EqDCHNH.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\fAQqLDb.exe
  C:\Windows\System\fAQqLDb.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\IqVzVPf.exe
  C:\Windows\System\IqVzVPf.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\ylGdiIL.exe
  C:\Windows\System\ylGdiIL.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\afjDNUF.exe
  C:\Windows\System\afjDNUF.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\KoCBhxf.exe
  C:\Windows\System\KoCBhxf.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\zGqofav.exe
  C:\Windows\System\zGqofav.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\QDCtDoP.exe
  C:\Windows\System\QDCtDoP.exe
  2⤵
  - Executes dropped EXE
  PID:708
- C:\Windows\System\ADCOsnM.exe
  C:\Windows\System\ADCOsnM.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\KPEQeLq.exe
  C:\Windows\System\KPEQeLq.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\iulNntJ.exe
  C:\Windows\System\iulNntJ.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\jToiSmI.exe
  C:\Windows\System\jToiSmI.exe
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\System\MFqnbof.exe
  C:\Windows\System\MFqnbof.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\ipKRfNc.exe
  C:\Windows\System\ipKRfNc.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\oHqeoqL.exe
  C:\Windows\System\oHqeoqL.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\MofRONy.exe
  C:\Windows\System\MofRONy.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\zIZGHxK.exe
  C:\Windows\System\zIZGHxK.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System\GdmvPxv.exe
  C:\Windows\System\GdmvPxv.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\VgEMGPJ.exe
  C:\Windows\System\VgEMGPJ.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\TBgXkhB.exe
  C:\Windows\System\TBgXkhB.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\ibwCRcV.exe
  C:\Windows\System\ibwCRcV.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\kdZnmhU.exe
  C:\Windows\System\kdZnmhU.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\hlbSMFN.exe
  C:\Windows\System\hlbSMFN.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\dFfEQjM.exe
  C:\Windows\System\dFfEQjM.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\dWkvbCM.exe
  C:\Windows\System\dWkvbCM.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\wkGKzob.exe
  C:\Windows\System\wkGKzob.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\aDitLyN.exe
  C:\Windows\System\aDitLyN.exe
  2⤵
  - Executes dropped EXE
  PID:732
- C:\Windows\System\bhlEoxH.exe
  C:\Windows\System\bhlEoxH.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\kPNuDTl.exe
  C:\Windows\System\kPNuDTl.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\bpsQbXf.exe
  C:\Windows\System\bpsQbXf.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\bnWAfcx.exe
  C:\Windows\System\bnWAfcx.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\gpWvwWD.exe
  C:\Windows\System\gpWvwWD.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\IOliVfo.exe
  C:\Windows\System\IOliVfo.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\ScPmkIH.exe
  C:\Windows\System\ScPmkIH.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\MJPakwM.exe
  C:\Windows\System\MJPakwM.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\VjtLduC.exe
  C:\Windows\System\VjtLduC.exe
  2⤵
  PID:2268
- C:\Windows\System\iLIBtwz.exe
  C:\Windows\System\iLIBtwz.exe
  2⤵
  PID:4892
- C:\Windows\System\MPPdxfb.exe
  C:\Windows\System\MPPdxfb.exe
  2⤵
  PID:2240
- C:\Windows\System\pGDECCm.exe
  C:\Windows\System\pGDECCm.exe
  2⤵
  PID:2128
- C:\Windows\System\obLWcSS.exe
  C:\Windows\System\obLWcSS.exe
  2⤵
  PID:1172
- C:\Windows\System\KenWBYO.exe
  C:\Windows\System\KenWBYO.exe
  2⤵
  PID:1664
- C:\Windows\System\rzkoHlY.exe
  C:\Windows\System\rzkoHlY.exe
  2⤵
  PID:1988
- C:\Windows\System\OAXeaLD.exe
  C:\Windows\System\OAXeaLD.exe
  2⤵
  PID:3780
- C:\Windows\System\RuRnkZG.exe
  C:\Windows\System\RuRnkZG.exe
  2⤵
  PID:5124
- C:\Windows\System\nKTOmUa.exe
  C:\Windows\System\nKTOmUa.exe
  2⤵
  PID:5148
- C:\Windows\System\USMJIEv.exe
  C:\Windows\System\USMJIEv.exe
  2⤵
  PID:5336
- C:\Windows\System\ryrsesA.exe
  C:\Windows\System\ryrsesA.exe
  2⤵
  PID:5360
- C:\Windows\System\BCRhUEO.exe
  C:\Windows\System\BCRhUEO.exe
  2⤵
  PID:5380
- C:\Windows\System\tvdQpal.exe
  C:\Windows\System\tvdQpal.exe
  2⤵
  PID:5408
- C:\Windows\System\uCnSkcZ.exe
  C:\Windows\System\uCnSkcZ.exe
  2⤵
  PID:5428
- C:\Windows\System\lkdtoft.exe
  C:\Windows\System\lkdtoft.exe
  2⤵
  PID:5444
- C:\Windows\System\CvIflUA.exe
  C:\Windows\System\CvIflUA.exe
  2⤵
  PID:5460
- C:\Windows\System\YoyOyFN.exe
  C:\Windows\System\YoyOyFN.exe
  2⤵
  PID:5476
- C:\Windows\System\hNLqjKv.exe
  C:\Windows\System\hNLqjKv.exe
  2⤵
  PID:5500
- C:\Windows\System\QiVRvDC.exe
  C:\Windows\System\QiVRvDC.exe
  2⤵
  PID:5520
- C:\Windows\System\guvlsba.exe
  C:\Windows\System\guvlsba.exe
  2⤵
  PID:5536
- C:\Windows\System\bllsSgr.exe
  C:\Windows\System\bllsSgr.exe
  2⤵
  PID:5560
- C:\Windows\System\UslcBfQ.exe
  C:\Windows\System\UslcBfQ.exe
  2⤵
  PID:5592
- C:\Windows\System\QuVvGeY.exe
  C:\Windows\System\QuVvGeY.exe
  2⤵
  PID:5620
- C:\Windows\System\wKbeFQf.exe
  C:\Windows\System\wKbeFQf.exe
  2⤵
  PID:5636
- C:\Windows\System\TfTMHHS.exe
  C:\Windows\System\TfTMHHS.exe
  2⤵
  PID:5664
- C:\Windows\System\fZAjtzT.exe
  C:\Windows\System\fZAjtzT.exe
  2⤵
  PID:5716
- C:\Windows\System\HnzSYFD.exe
  C:\Windows\System\HnzSYFD.exe
  2⤵
  PID:5732
- C:\Windows\System\LAkMDbA.exe
  C:\Windows\System\LAkMDbA.exe
  2⤵
  PID:5748
- C:\Windows\System\sdpmcuj.exe
  C:\Windows\System\sdpmcuj.exe
  2⤵
  PID:5764
- C:\Windows\System\uEJzCIN.exe
  C:\Windows\System\uEJzCIN.exe
  2⤵
  PID:5780
- C:\Windows\System\AamIYdM.exe
  C:\Windows\System\AamIYdM.exe
  2⤵
  PID:5796
- C:\Windows\System\xCPDRzv.exe
  C:\Windows\System\xCPDRzv.exe
  2⤵
  PID:5816
- C:\Windows\System\PGsyQNl.exe
  C:\Windows\System\PGsyQNl.exe
  2⤵
  PID:5836
- C:\Windows\System\bsqpOrX.exe
  C:\Windows\System\bsqpOrX.exe
  2⤵
  PID:5860
- C:\Windows\System\MTDVvUB.exe
  C:\Windows\System\MTDVvUB.exe
  2⤵
  PID:5884
- C:\Windows\System\chapbhY.exe
  C:\Windows\System\chapbhY.exe
  2⤵
  PID:5904
- C:\Windows\System\ptGSnUH.exe
  C:\Windows\System\ptGSnUH.exe
  2⤵
  PID:5924
- C:\Windows\System\hGUoZAE.exe
  C:\Windows\System\hGUoZAE.exe
  2⤵
  PID:5952
- C:\Windows\System\ayfAtAn.exe
  C:\Windows\System\ayfAtAn.exe
  2⤵
  PID:5968
- C:\Windows\System\oCNzVpI.exe
  C:\Windows\System\oCNzVpI.exe
  2⤵
  PID:6000
- C:\Windows\System\pnwRMSZ.exe
  C:\Windows\System\pnwRMSZ.exe
  2⤵
  PID:6016
- C:\Windows\System\qokvjQb.exe
  C:\Windows\System\qokvjQb.exe
  2⤵
  PID:6032
- C:\Windows\System\MnZqRMX.exe
  C:\Windows\System\MnZqRMX.exe
  2⤵
  PID:6076
- C:\Windows\System\kYxQoRx.exe
  C:\Windows\System\kYxQoRx.exe
  2⤵
  PID:6096
- C:\Windows\System\EXMPFIp.exe
  C:\Windows\System\EXMPFIp.exe
  2⤵
  PID:6116
- C:\Windows\System\dJBoEZY.exe
  C:\Windows\System\dJBoEZY.exe
  2⤵
  PID:6136
- C:\Windows\System\cdaKyEv.exe
  C:\Windows\System\cdaKyEv.exe
  2⤵
  PID:3316
- C:\Windows\System\kUkPFkx.exe
  C:\Windows\System\kUkPFkx.exe
  2⤵
  PID:868
- C:\Windows\System\yudKyKT.exe
  C:\Windows\System\yudKyKT.exe
  2⤵
  PID:4292
- C:\Windows\System\CWiysTH.exe
  C:\Windows\System\CWiysTH.exe
  2⤵
  PID:3808
- C:\Windows\System\aadoZiA.exe
  C:\Windows\System\aadoZiA.exe
  2⤵
  PID:3144
- C:\Windows\System\mCafCNg.exe
  C:\Windows\System\mCafCNg.exe
  2⤵
  PID:5164
- C:\Windows\System\UKLgBrm.exe
  C:\Windows\System\UKLgBrm.exe
  2⤵
  PID:3824
- C:\Windows\System\TyLFxCl.exe
  C:\Windows\System\TyLFxCl.exe
  2⤵
  PID:5292
- C:\Windows\System\ETbQUHj.exe
  C:\Windows\System\ETbQUHj.exe
  2⤵
  PID:5484
- C:\Windows\System\uHeguZc.exe
  C:\Windows\System\uHeguZc.exe
  2⤵
  PID:5628
- C:\Windows\System\SmkxYkB.exe
  C:\Windows\System\SmkxYkB.exe
  2⤵
  PID:5744
- C:\Windows\System\lMvTfew.exe
  C:\Windows\System\lMvTfew.exe
  2⤵
  PID:5788
- C:\Windows\System\mtlOIfF.exe
  C:\Windows\System\mtlOIfF.exe
  2⤵
  PID:5844
- C:\Windows\System\DpbDeAV.exe
  C:\Windows\System\DpbDeAV.exe
  2⤵
  PID:5872
- C:\Windows\System\pgRKfTb.exe
  C:\Windows\System\pgRKfTb.exe
  2⤵
  PID:5980
- C:\Windows\System\jJRxvXn.exe
  C:\Windows\System\jJRxvXn.exe
  2⤵
  PID:6008
- C:\Windows\System\pFTbBuu.exe
  C:\Windows\System\pFTbBuu.exe
  2⤵
  PID:6052
- C:\Windows\System\uFTgPcj.exe
  C:\Windows\System\uFTgPcj.exe
  2⤵
  PID:6124
- C:\Windows\System\voPHsHz.exe
  C:\Windows\System\voPHsHz.exe
  2⤵
  PID:1932
- C:\Windows\System\NwREmIP.exe
  C:\Windows\System\NwREmIP.exe
  2⤵
  PID:3380
- C:\Windows\System\YBRfuqm.exe
  C:\Windows\System\YBRfuqm.exe
  2⤵
  PID:2148
- C:\Windows\System\cFjOncU.exe
  C:\Windows\System\cFjOncU.exe
  2⤵
  PID:4812
- C:\Windows\System\hhIzgjW.exe
  C:\Windows\System\hhIzgjW.exe
  2⤵
  PID:3660
- C:\Windows\System\aJjYDWl.exe
  C:\Windows\System\aJjYDWl.exe
  2⤵
  PID:5308
- C:\Windows\System\uKTbkYs.exe
  C:\Windows\System\uKTbkYs.exe
  2⤵
  PID:5352
- C:\Windows\System\ZUlEsNK.exe
  C:\Windows\System\ZUlEsNK.exe
  2⤵
  PID:3712
- C:\Windows\System\CVJUBmw.exe
  C:\Windows\System\CVJUBmw.exe
  2⤵
  PID:3180
- C:\Windows\System\IJKnfIu.exe
  C:\Windows\System\IJKnfIu.exe
  2⤵
  PID:5252
- C:\Windows\System\oQojFmk.exe
  C:\Windows\System\oQojFmk.exe
  2⤵
  PID:2260
- C:\Windows\System\YFMTzQH.exe
  C:\Windows\System\YFMTzQH.exe
  2⤵
  PID:3252
- C:\Windows\System\WlXgdCE.exe
  C:\Windows\System\WlXgdCE.exe
  2⤵
  PID:3100
- C:\Windows\System\fXjwveP.exe
  C:\Windows\System\fXjwveP.exe
  2⤵
  PID:3376
- C:\Windows\System\apWMOhA.exe
  C:\Windows\System\apWMOhA.exe
  2⤵
  PID:3136
- C:\Windows\System\RKRtuWm.exe
  C:\Windows\System\RKRtuWm.exe
  2⤵
  PID:2980
- C:\Windows\System\sJRsQjt.exe
  C:\Windows\System\sJRsQjt.exe
  2⤵
  PID:3096
- C:\Windows\System\ntrPtoY.exe
  C:\Windows\System\ntrPtoY.exe
  2⤵
  PID:3112
- C:\Windows\System\TgMQjiP.exe
  C:\Windows\System\TgMQjiP.exe
  2⤵
  PID:3952
- C:\Windows\System\HzClcST.exe
  C:\Windows\System\HzClcST.exe
  2⤵
  PID:640
- C:\Windows\System\ExVHAvL.exe
  C:\Windows\System\ExVHAvL.exe
  2⤵
  PID:2308
- C:\Windows\System\DFQjgCr.exe
  C:\Windows\System\DFQjgCr.exe
  2⤵
  PID:636
- C:\Windows\System\KYIgYCl.exe
  C:\Windows\System\KYIgYCl.exe
  2⤵
  PID:5992
- C:\Windows\System\wfbptos.exe
  C:\Windows\System\wfbptos.exe
  2⤵
  PID:1092
- C:\Windows\System\lPmcaNq.exe
  C:\Windows\System\lPmcaNq.exe
  2⤵
  PID:5728
- C:\Windows\System\rgLbpCY.exe
  C:\Windows\System\rgLbpCY.exe
  2⤵
  PID:3320
- C:\Windows\System\fIdwXQk.exe
  C:\Windows\System\fIdwXQk.exe
  2⤵
  PID:1540
- C:\Windows\System\NTbvFVB.exe
  C:\Windows\System\NTbvFVB.exe
  2⤵
  PID:4996
- C:\Windows\System\lCDNzTe.exe
  C:\Windows\System\lCDNzTe.exe
  2⤵
  PID:5760
- C:\Windows\System\VrYjdiY.exe
  C:\Windows\System\VrYjdiY.exe
  2⤵
  PID:5976
- C:\Windows\System\KyHdMlq.exe
  C:\Windows\System\KyHdMlq.exe
  2⤵
  PID:4260
- C:\Windows\System\ANttnjn.exe
  C:\Windows\System\ANttnjn.exe
  2⤵
  PID:5600
- C:\Windows\System\cpVfbrY.exe
  C:\Windows\System\cpVfbrY.exe
  2⤵
  PID:6160
- C:\Windows\System\gMqXIvJ.exe
  C:\Windows\System\gMqXIvJ.exe
  2⤵
  PID:6180
- C:\Windows\System\lLhCmrS.exe
  C:\Windows\System\lLhCmrS.exe
  2⤵
  PID:6212
- C:\Windows\System\yvuOwzK.exe
  C:\Windows\System\yvuOwzK.exe
  2⤵
  PID:6232
- C:\Windows\System\OVcIVNF.exe
  C:\Windows\System\OVcIVNF.exe
  2⤵
  PID:6252
- C:\Windows\System\QcSbWyV.exe
  C:\Windows\System\QcSbWyV.exe
  2⤵
  PID:6288
- C:\Windows\System\tWkQPxe.exe
  C:\Windows\System\tWkQPxe.exe
  2⤵
  PID:6316
- C:\Windows\System\ZEQTyMc.exe
  C:\Windows\System\ZEQTyMc.exe
  2⤵
  PID:6340
- C:\Windows\System\OyGctZQ.exe
  C:\Windows\System\OyGctZQ.exe
  2⤵
  PID:6368
- C:\Windows\System\DjOKtko.exe
  C:\Windows\System\DjOKtko.exe
  2⤵
  PID:6384
- C:\Windows\System\QZlVWii.exe
  C:\Windows\System\QZlVWii.exe
  2⤵
  PID:6416
- C:\Windows\System\CVmxQbo.exe
  C:\Windows\System\CVmxQbo.exe
  2⤵
  PID:6436
- C:\Windows\System\iluHvAn.exe
  C:\Windows\System\iluHvAn.exe
  2⤵
  PID:6460
- C:\Windows\System\xrRMDsI.exe
  C:\Windows\System\xrRMDsI.exe
  2⤵
  PID:6480
- C:\Windows\System\yyjaWMi.exe
  C:\Windows\System\yyjaWMi.exe
  2⤵
  PID:6500
- C:\Windows\System\VwueuIw.exe
  C:\Windows\System\VwueuIw.exe
  2⤵
  PID:6520
- C:\Windows\System\dxmkRDF.exe
  C:\Windows\System\dxmkRDF.exe
  2⤵
  PID:6544
- C:\Windows\System\zgoyrsX.exe
  C:\Windows\System\zgoyrsX.exe
  2⤵
  PID:6564
- C:\Windows\System\nVQodHj.exe
  C:\Windows\System\nVQodHj.exe
  2⤵
  PID:6588
- C:\Windows\System\yrVXNeW.exe
  C:\Windows\System\yrVXNeW.exe
  2⤵
  PID:6608
- C:\Windows\System\cLcpqIV.exe
  C:\Windows\System\cLcpqIV.exe
  2⤵
  PID:6628
- C:\Windows\System\FexuWFY.exe
  C:\Windows\System\FexuWFY.exe
  2⤵
  PID:6648
- C:\Windows\System\trgAVGW.exe
  C:\Windows\System\trgAVGW.exe
  2⤵
  PID:6668
- C:\Windows\System\yzxHgJF.exe
  C:\Windows\System\yzxHgJF.exe
  2⤵
  PID:6696
- C:\Windows\System\iqqpmzh.exe
  C:\Windows\System\iqqpmzh.exe
  2⤵
  PID:6720
- C:\Windows\System\LQuvZmi.exe
  C:\Windows\System\LQuvZmi.exe
  2⤵
  PID:6740
- C:\Windows\System\qtdEMCm.exe
  C:\Windows\System\qtdEMCm.exe
  2⤵
  PID:6764
- C:\Windows\System\MNIFcxy.exe
  C:\Windows\System\MNIFcxy.exe
  2⤵
  PID:6792
- C:\Windows\System\mwvMQMi.exe
  C:\Windows\System\mwvMQMi.exe
  2⤵
  PID:6812
- C:\Windows\System\dRBWEfn.exe
  C:\Windows\System\dRBWEfn.exe
  2⤵
  PID:6836
- C:\Windows\System\RqMyrrZ.exe
  C:\Windows\System\RqMyrrZ.exe
  2⤵
  PID:6860
- C:\Windows\System\DRGHsOF.exe
  C:\Windows\System\DRGHsOF.exe
  2⤵
  PID:6880
- C:\Windows\System\SVyqMkY.exe
  C:\Windows\System\SVyqMkY.exe
  2⤵
  PID:6904
- C:\Windows\System\MCeNIHf.exe
  C:\Windows\System\MCeNIHf.exe
  2⤵
  PID:6924
- C:\Windows\System\TWEWEDx.exe
  C:\Windows\System\TWEWEDx.exe
  2⤵
  PID:6948
- C:\Windows\System\snrLisf.exe
  C:\Windows\System\snrLisf.exe
  2⤵
  PID:6968
- C:\Windows\System\JWzXFqC.exe
  C:\Windows\System\JWzXFqC.exe
  2⤵
  PID:6988
- C:\Windows\System\auTGRIe.exe
  C:\Windows\System\auTGRIe.exe
  2⤵
  PID:7020
- C:\Windows\System\DUOaesC.exe
  C:\Windows\System\DUOaesC.exe
  2⤵
  PID:7040
- C:\Windows\System\TxaAHoG.exe
  C:\Windows\System\TxaAHoG.exe
  2⤵
  PID:7060
- C:\Windows\System\ADerNag.exe
  C:\Windows\System\ADerNag.exe
  2⤵
  PID:7084
- C:\Windows\System\DIsLzqs.exe
  C:\Windows\System\DIsLzqs.exe
  2⤵
  PID:7104
- C:\Windows\System\NRPyPkv.exe
  C:\Windows\System\NRPyPkv.exe
  2⤵
  PID:7128
- C:\Windows\System\KjfjjZx.exe
  C:\Windows\System\KjfjjZx.exe
  2⤵
  PID:2960
- C:\Windows\System\ZyfcfaG.exe
  C:\Windows\System\ZyfcfaG.exe
  2⤵
  PID:4864
- C:\Windows\System\NqYiqrd.exe
  C:\Windows\System\NqYiqrd.exe
  2⤵
  PID:1356
- C:\Windows\System\NjUjoJh.exe
  C:\Windows\System\NjUjoJh.exe
  2⤵
  PID:6088
- C:\Windows\System\hkfGJoz.exe
  C:\Windows\System\hkfGJoz.exe
  2⤵
  PID:5740
- C:\Windows\System\OScManX.exe
  C:\Windows\System\OScManX.exe
  2⤵
  PID:5172
- C:\Windows\System\nlyGEYE.exe
  C:\Windows\System\nlyGEYE.exe
  2⤵
  PID:6332
- C:\Windows\System\TphPKJk.exe
  C:\Windows\System\TphPKJk.exe
  2⤵
  PID:2244
- C:\Windows\System\kckBtUR.exe
  C:\Windows\System\kckBtUR.exe
  2⤵
  PID:372
- C:\Windows\System\mMHBMun.exe
  C:\Windows\System\mMHBMun.exe
  2⤵
  PID:2972
- C:\Windows\System\ixpgKwR.exe
  C:\Windows\System\ixpgKwR.exe
  2⤵
  PID:6248
- C:\Windows\System\KazfNon.exe
  C:\Windows\System\KazfNon.exe
  2⤵
  PID:3360
- C:\Windows\System\NelsDFV.exe
  C:\Windows\System\NelsDFV.exe
  2⤵
  PID:6156
- C:\Windows\System\rvYIaFz.exe
  C:\Windows\System\rvYIaFz.exe
  2⤵
  PID:6644
- C:\Windows\System\asNsUIP.exe
  C:\Windows\System\asNsUIP.exe
  2⤵
  PID:6432
- C:\Windows\System\bclOAQs.exe
  C:\Windows\System\bclOAQs.exe
  2⤵
  PID:6808
- C:\Windows\System\KBanQFE.exe
  C:\Windows\System\KBanQFE.exe
  2⤵
  PID:7032
- C:\Windows\System\PxIYVEN.exe
  C:\Windows\System\PxIYVEN.exe
  2⤵
  PID:6600
- C:\Windows\System\lvUaSHN.exe
  C:\Windows\System\lvUaSHN.exe
  2⤵
  PID:6448
- C:\Windows\System\XfboUie.exe
  C:\Windows\System\XfboUie.exe
  2⤵
  PID:6876
- C:\Windows\System\oxFOjPK.exe
  C:\Windows\System\oxFOjPK.exe
  2⤵
  PID:6540
- C:\Windows\System\KwytrLM.exe
  C:\Windows\System\KwytrLM.exe
  2⤵
  PID:6996
- C:\Windows\System\irReChl.exe
  C:\Windows\System\irReChl.exe
  2⤵
  PID:7188
- C:\Windows\System\rxlucyG.exe
  C:\Windows\System\rxlucyG.exe
  2⤵
  PID:7208
- C:\Windows\System\PJqXFIy.exe
  C:\Windows\System\PJqXFIy.exe
  2⤵
  PID:7224
- C:\Windows\System\IjvaWOD.exe
  C:\Windows\System\IjvaWOD.exe
  2⤵
  PID:7248
- C:\Windows\System\kMOZlsW.exe
  C:\Windows\System\kMOZlsW.exe
  2⤵
  PID:7268
- C:\Windows\System\ebdhurj.exe
  C:\Windows\System\ebdhurj.exe
  2⤵
  PID:7292
- C:\Windows\System\fzsnfkI.exe
  C:\Windows\System\fzsnfkI.exe
  2⤵
  PID:7320
- C:\Windows\System\wpjofKB.exe
  C:\Windows\System\wpjofKB.exe
  2⤵
  PID:7352
- C:\Windows\System\AWQWKfm.exe
  C:\Windows\System\AWQWKfm.exe
  2⤵
  PID:7376
- C:\Windows\System\lxrHNAh.exe
  C:\Windows\System\lxrHNAh.exe
  2⤵
  PID:7396
- C:\Windows\System\oVTUsYO.exe
  C:\Windows\System\oVTUsYO.exe
  2⤵
  PID:7424
- C:\Windows\System\FIMeDoI.exe
  C:\Windows\System\FIMeDoI.exe
  2⤵
  PID:7448
- C:\Windows\System\xXnuUQr.exe
  C:\Windows\System\xXnuUQr.exe
  2⤵
  PID:7476
- C:\Windows\System\nwcaiJE.exe
  C:\Windows\System\nwcaiJE.exe
  2⤵
  PID:7496
- C:\Windows\System\fuFpwoL.exe
  C:\Windows\System\fuFpwoL.exe
  2⤵
  PID:7524
- C:\Windows\System\icGWwGu.exe
  C:\Windows\System\icGWwGu.exe
  2⤵
  PID:7548
- C:\Windows\System\LaNrKLB.exe
  C:\Windows\System\LaNrKLB.exe
  2⤵
  PID:7572
- C:\Windows\System\RXFkHwC.exe
  C:\Windows\System\RXFkHwC.exe
  2⤵
  PID:7596
- C:\Windows\System\MtrEZMt.exe
  C:\Windows\System\MtrEZMt.exe
  2⤵
  PID:7616
- C:\Windows\System\DzLclZm.exe
  C:\Windows\System\DzLclZm.exe
  2⤵
  PID:7640
- C:\Windows\System\ZRBMNIG.exe
  C:\Windows\System\ZRBMNIG.exe
  2⤵
  PID:7660
- C:\Windows\System\tHdlboT.exe
  C:\Windows\System\tHdlboT.exe
  2⤵
  PID:7684
- C:\Windows\System\jlSFkKG.exe
  C:\Windows\System\jlSFkKG.exe
  2⤵
  PID:7700
- C:\Windows\System\gysOoIY.exe
  C:\Windows\System\gysOoIY.exe
  2⤵
  PID:7724
- C:\Windows\System\LIUhPkt.exe
  C:\Windows\System\LIUhPkt.exe
  2⤵
  PID:7740
- C:\Windows\System\eELtPJt.exe
  C:\Windows\System\eELtPJt.exe
  2⤵
  PID:7764
- C:\Windows\System\AutPnUf.exe
  C:\Windows\System\AutPnUf.exe
  2⤵
  PID:7784
- C:\Windows\System\ESyeHxR.exe
  C:\Windows\System\ESyeHxR.exe
  2⤵
  PID:7804
- C:\Windows\System\DTiTJGn.exe
  C:\Windows\System\DTiTJGn.exe
  2⤵
  PID:7824
- C:\Windows\System\vOkheSV.exe
  C:\Windows\System\vOkheSV.exe
  2⤵
  PID:7844
- C:\Windows\System\lruJUDS.exe
  C:\Windows\System\lruJUDS.exe
  2⤵
  PID:7868
- C:\Windows\System\wakfUkD.exe
  C:\Windows\System\wakfUkD.exe
  2⤵
  PID:7888
- C:\Windows\System\ywrGiAa.exe
  C:\Windows\System\ywrGiAa.exe
  2⤵
  PID:7912
- C:\Windows\System\DRIjZcD.exe
  C:\Windows\System\DRIjZcD.exe
  2⤵
  PID:7936
- C:\Windows\System\SBSWtuf.exe
  C:\Windows\System\SBSWtuf.exe
  2⤵
  PID:7960
- C:\Windows\System\ZhXqtdK.exe
  C:\Windows\System\ZhXqtdK.exe
  2⤵
  PID:7976
- C:\Windows\System\DBFsqKX.exe
  C:\Windows\System\DBFsqKX.exe
  2⤵
  PID:7996
- C:\Windows\System\EysZBWt.exe
  C:\Windows\System\EysZBWt.exe
  2⤵
  PID:8016
- C:\Windows\System\pjNfxMm.exe
  C:\Windows\System\pjNfxMm.exe
  2⤵
  PID:8040
- C:\Windows\System\wmnkZZy.exe
  C:\Windows\System\wmnkZZy.exe
  2⤵
  PID:8064
- C:\Windows\System\RjdnXFb.exe
  C:\Windows\System\RjdnXFb.exe
  2⤵
  PID:8092
- C:\Windows\System\SMQYUSx.exe
  C:\Windows\System\SMQYUSx.exe
  2⤵
  PID:8116
- C:\Windows\System\jaGozQl.exe
  C:\Windows\System\jaGozQl.exe
  2⤵
  PID:8136
- C:\Windows\System\IYtPUmz.exe
  C:\Windows\System\IYtPUmz.exe
  2⤵
  PID:8156
- C:\Windows\System\DLyKHRP.exe
  C:\Windows\System\DLyKHRP.exe
  2⤵
  PID:8180
- C:\Windows\System\XIdgjsT.exe
  C:\Windows\System\XIdgjsT.exe
  2⤵
  PID:7072
- C:\Windows\System\tbPenZg.exe
  C:\Windows\System\tbPenZg.exe
  2⤵
  PID:6788
- C:\Windows\System\nvWhFRW.exe
  C:\Windows\System\nvWhFRW.exe
  2⤵
  PID:6844
- C:\Windows\System\qMNOYtE.exe
  C:\Windows\System\qMNOYtE.exe
  2⤵
  PID:6348
- C:\Windows\System\LbnYTQo.exe
  C:\Windows\System\LbnYTQo.exe
  2⤵
  PID:6228
- C:\Windows\System\QdrLHTR.exe
  C:\Windows\System\QdrLHTR.exe
  2⤵
  PID:6576
- C:\Windows\System\EcnCKxP.exe
  C:\Windows\System\EcnCKxP.exe
  2⤵
  PID:4896
- C:\Windows\System\GmABznG.exe
  C:\Windows\System\GmABznG.exe
  2⤵
  PID:6920
- C:\Windows\System\xsSGgBr.exe
  C:\Windows\System\xsSGgBr.exe
  2⤵
  PID:7240
- C:\Windows\System\uzdCZZd.exe
  C:\Windows\System\uzdCZZd.exe
  2⤵
  PID:7004
- C:\Windows\System\SbiSHjn.exe
  C:\Windows\System\SbiSHjn.exe
  2⤵
  PID:6868
- C:\Windows\System\rwQSpfc.exe
  C:\Windows\System\rwQSpfc.exe
  2⤵
  PID:6756
- C:\Windows\System\zhWywfH.exe
  C:\Windows\System\zhWywfH.exe
  2⤵
  PID:5656
- C:\Windows\System\xApQvrs.exe
  C:\Windows\System\xApQvrs.exe
  2⤵
  PID:4612
- C:\Windows\System\NKyNqBf.exe
  C:\Windows\System\NKyNqBf.exe
  2⤵
  PID:6352
- C:\Windows\System\yWCFxZP.exe
  C:\Windows\System\yWCFxZP.exe
  2⤵
  PID:6240
- C:\Windows\System\rzHoRSv.exe
  C:\Windows\System\rzHoRSv.exe
  2⤵
  PID:7260
- C:\Windows\System\sIuVizM.exe
  C:\Windows\System\sIuVizM.exe
  2⤵
  PID:1044
- C:\Windows\System\IHiUHym.exe
  C:\Windows\System\IHiUHym.exe
  2⤵
  PID:7720
- C:\Windows\System\UToCFpW.exe
  C:\Windows\System\UToCFpW.exe
  2⤵
  PID:7756
- C:\Windows\System\pNGlUBT.exe
  C:\Windows\System\pNGlUBT.exe
  2⤵
  PID:7812
- C:\Windows\System\uoZyXnL.exe
  C:\Windows\System\uoZyXnL.exe
  2⤵
  PID:7864
- C:\Windows\System\inEuqvo.exe
  C:\Windows\System\inEuqvo.exe
  2⤵
  PID:7464
- C:\Windows\System\ZVHbnSz.exe
  C:\Windows\System\ZVHbnSz.exe
  2⤵
  PID:7504
- C:\Windows\System\ZnZrJcB.exe
  C:\Windows\System\ZnZrJcB.exe
  2⤵
  PID:7180
- C:\Windows\System\RVSJScj.exe
  C:\Windows\System\RVSJScj.exe
  2⤵
  PID:7220
- C:\Windows\System\OwkheaI.exe
  C:\Windows\System\OwkheaI.exe
  2⤵
  PID:8212
- C:\Windows\System\XNFjNsy.exe
  C:\Windows\System\XNFjNsy.exe
  2⤵
  PID:8240
- C:\Windows\System\nTiMDeU.exe
  C:\Windows\System\nTiMDeU.exe
  2⤵
  PID:8260
- C:\Windows\System\UmbbQOh.exe
  C:\Windows\System\UmbbQOh.exe
  2⤵
  PID:8280
- C:\Windows\System\setBVIG.exe
  C:\Windows\System\setBVIG.exe
  2⤵
  PID:8304
- C:\Windows\System\JiKlQXL.exe
  C:\Windows\System\JiKlQXL.exe
  2⤵
  PID:8328
- C:\Windows\System\SRhTANL.exe
  C:\Windows\System\SRhTANL.exe
  2⤵
  PID:8348
- C:\Windows\System\iXCDqUW.exe
  C:\Windows\System\iXCDqUW.exe
  2⤵
  PID:8372
- C:\Windows\System\mDKdHDU.exe
  C:\Windows\System\mDKdHDU.exe
  2⤵
  PID:8400
- C:\Windows\System\FYChGwh.exe
  C:\Windows\System\FYChGwh.exe
  2⤵
  PID:8420
- C:\Windows\System\YCEbvdM.exe
  C:\Windows\System\YCEbvdM.exe
  2⤵
  PID:8440
- C:\Windows\System\FSGSxZK.exe
  C:\Windows\System\FSGSxZK.exe
  2⤵
  PID:8460
- C:\Windows\System\IBPSTOs.exe
  C:\Windows\System\IBPSTOs.exe
  2⤵
  PID:8484
- C:\Windows\System\tByYnLn.exe
  C:\Windows\System\tByYnLn.exe
  2⤵
  PID:8508
- C:\Windows\System\nQyHaDq.exe
  C:\Windows\System\nQyHaDq.exe
  2⤵
  PID:8536
- C:\Windows\System\NpQqKzW.exe
  C:\Windows\System\NpQqKzW.exe
  2⤵
  PID:8556
- C:\Windows\System\puGIaPg.exe
  C:\Windows\System\puGIaPg.exe
  2⤵
  PID:8576
- C:\Windows\System\qtyDase.exe
  C:\Windows\System\qtyDase.exe
  2⤵
  PID:8596
- C:\Windows\System\LcXFMFl.exe
  C:\Windows\System\LcXFMFl.exe
  2⤵
  PID:8620
- C:\Windows\System\urFnrpf.exe
  C:\Windows\System\urFnrpf.exe
  2⤵
  PID:8648
- C:\Windows\System\ymHAaab.exe
  C:\Windows\System\ymHAaab.exe
  2⤵
  PID:8668
- C:\Windows\System\mCFXASC.exe
  C:\Windows\System\mCFXASC.exe
  2⤵
  PID:8688
- C:\Windows\System\QLTKyjU.exe
  C:\Windows\System\QLTKyjU.exe
  2⤵
  PID:8708
- C:\Windows\System\ojJrSFS.exe
  C:\Windows\System\ojJrSFS.exe
  2⤵
  PID:8732
- C:\Windows\System\Vvqtoqs.exe
  C:\Windows\System\Vvqtoqs.exe
  2⤵
  PID:8756
- C:\Windows\System\vSMRdsu.exe
  C:\Windows\System\vSMRdsu.exe
  2⤵
  PID:8780
- C:\Windows\System\MSPMMFl.exe
  C:\Windows\System\MSPMMFl.exe
  2⤵
  PID:8800
- C:\Windows\System\zANVNyS.exe
  C:\Windows\System\zANVNyS.exe
  2⤵
  PID:8816
- C:\Windows\System\tCgsUJi.exe
  C:\Windows\System\tCgsUJi.exe
  2⤵
  PID:8832
- C:\Windows\System\AWBRNME.exe
  C:\Windows\System\AWBRNME.exe
  2⤵
  PID:8856
- C:\Windows\System\vRveFGO.exe
  C:\Windows\System\vRveFGO.exe
  2⤵
  PID:8880
- C:\Windows\System\TcCRFcF.exe
  C:\Windows\System\TcCRFcF.exe
  2⤵
  PID:8900
- C:\Windows\System\jFsNSuy.exe
  C:\Windows\System\jFsNSuy.exe
  2⤵
  PID:8932
- C:\Windows\System\qqmtgXn.exe
  C:\Windows\System\qqmtgXn.exe
  2⤵
  PID:8956
- C:\Windows\System\YlWEfFc.exe
  C:\Windows\System\YlWEfFc.exe
  2⤵
  PID:8976
- C:\Windows\System\SxgNkuf.exe
  C:\Windows\System\SxgNkuf.exe
  2⤵
  PID:8996
- C:\Windows\System\LNYEoGk.exe
  C:\Windows\System\LNYEoGk.exe
  2⤵
  PID:9020
- C:\Windows\System\mKTmWXI.exe
  C:\Windows\System\mKTmWXI.exe
  2⤵
  PID:9036
- C:\Windows\System\UONaXgf.exe
  C:\Windows\System\UONaXgf.exe
  2⤵
  PID:9064
- C:\Windows\System\udFSEwQ.exe
  C:\Windows\System\udFSEwQ.exe
  2⤵
  PID:9092
- C:\Windows\System\yoUHRdT.exe
  C:\Windows\System\yoUHRdT.exe
  2⤵
  PID:9112
- C:\Windows\System\cMMycRb.exe
  C:\Windows\System\cMMycRb.exe
  2⤵
  PID:9132
- C:\Windows\System\AsOYXLY.exe
  C:\Windows\System\AsOYXLY.exe
  2⤵
  PID:9160
- C:\Windows\System\KbgyJND.exe
  C:\Windows\System\KbgyJND.exe
  2⤵
  PID:9180
- C:\Windows\System\bPkmABu.exe
  C:\Windows\System\bPkmABu.exe
  2⤵
  PID:9200
- C:\Windows\System\qNYdyiM.exe
  C:\Windows\System\qNYdyiM.exe
  2⤵
  PID:8076
- C:\Windows\System\nLQXzjh.exe
  C:\Windows\System\nLQXzjh.exe
  2⤵
  PID:8104
- C:\Windows\System\YeCigOl.exe
  C:\Windows\System\YeCigOl.exe
  2⤵
  PID:8132
- C:\Windows\System\tLkBEPz.exe
  C:\Windows\System\tLkBEPz.exe
  2⤵
  PID:8148
- C:\Windows\System\npVhSsi.exe
  C:\Windows\System\npVhSsi.exe
  2⤵
  PID:6736
- C:\Windows\System\NtoKXqu.exe
  C:\Windows\System\NtoKXqu.exe
  2⤵
  PID:4852
- C:\Windows\System\TzrSvjG.exe
  C:\Windows\System\TzrSvjG.exe
  2⤵
  PID:7140
- C:\Windows\System\MGluqKl.exe
  C:\Windows\System\MGluqKl.exe
  2⤵
  PID:7100
- C:\Windows\System\bjKyMvU.exe
  C:\Windows\System\bjKyMvU.exe
  2⤵
  PID:7028
- C:\Windows\System\ZMSyLdj.exe
  C:\Windows\System\ZMSyLdj.exe
  2⤵
  PID:6892
- C:\Windows\System\RapgLbP.exe
  C:\Windows\System\RapgLbP.exe
  2⤵
  PID:6704
- C:\Windows\System\wiGcEnV.exe
  C:\Windows\System\wiGcEnV.exe
  2⤵
  PID:6276
- C:\Windows\System\IjXDgYp.exe
  C:\Windows\System\IjXDgYp.exe
  2⤵
  PID:7752
- C:\Windows\System\oXpoSID.exe
  C:\Windows\System\oXpoSID.exe
  2⤵
  PID:7512
- C:\Windows\System\UGQqVES.exe
  C:\Windows\System\UGQqVES.exe
  2⤵
  PID:1924
- C:\Windows\System\aWLCYlS.exe
  C:\Windows\System\aWLCYlS.exe
  2⤵
  PID:6516
- C:\Windows\System\HBFXssT.exe
  C:\Windows\System\HBFXssT.exe
  2⤵
  PID:6984
- C:\Windows\System\ULxCpEV.exe
  C:\Windows\System\ULxCpEV.exe
  2⤵
  PID:8012
- C:\Windows\System\MsaPbTu.exe
  C:\Windows\System\MsaPbTu.exe
  2⤵
  PID:7636
- C:\Windows\System\qTIHZsY.exe
  C:\Windows\System\qTIHZsY.exe
  2⤵
  PID:8412
- C:\Windows\System\hdBGEbH.exe
  C:\Windows\System\hdBGEbH.exe
  2⤵
  PID:8500
- C:\Windows\System\mTPQjtW.exe
  C:\Windows\System\mTPQjtW.exe
  2⤵
  PID:8548
- C:\Windows\System\inLLizN.exe
  C:\Windows\System\inLLizN.exe
  2⤵
  PID:8572
- C:\Windows\System\YWHGCEj.exe
  C:\Windows\System\YWHGCEj.exe
  2⤵
  PID:7852
- C:\Windows\System\DqfujXG.exe
  C:\Windows\System\DqfujXG.exe
  2⤵
  PID:8680
- C:\Windows\System\QrZmaef.exe
  C:\Windows\System\QrZmaef.exe
  2⤵
  PID:5724
- C:\Windows\System\NRxTKoA.exe
  C:\Windows\System\NRxTKoA.exe
  2⤵
  PID:8728
- C:\Windows\System\dyaqDbc.exe
  C:\Windows\System\dyaqDbc.exe
  2⤵
  PID:8824
- C:\Windows\System\CqyNGny.exe
  C:\Windows\System\CqyNGny.exe
  2⤵
  PID:9228
- C:\Windows\System\TwhxjOy.exe
  C:\Windows\System\TwhxjOy.exe
  2⤵
  PID:9248
- C:\Windows\System\pcrlxvF.exe
  C:\Windows\System\pcrlxvF.exe
  2⤵
  PID:9268
- C:\Windows\System\tUtIAwV.exe
  C:\Windows\System\tUtIAwV.exe
  2⤵
  PID:9296
- C:\Windows\System\ebRzfyY.exe
  C:\Windows\System\ebRzfyY.exe
  2⤵
  PID:9324
- C:\Windows\System\AkuDZtb.exe
  C:\Windows\System\AkuDZtb.exe
  2⤵
  PID:9344
- C:\Windows\System\LzRXbEW.exe
  C:\Windows\System\LzRXbEW.exe
  2⤵
  PID:9372
- C:\Windows\System\liAMuMh.exe
  C:\Windows\System\liAMuMh.exe
  2⤵
  PID:9396
- C:\Windows\System\DZErpDd.exe
  C:\Windows\System\DZErpDd.exe
  2⤵
  PID:9416
- C:\Windows\System\ZXpEYoU.exe
  C:\Windows\System\ZXpEYoU.exe
  2⤵
  PID:9440
- C:\Windows\System\cgZXwIg.exe
  C:\Windows\System\cgZXwIg.exe
  2⤵
  PID:9460
- C:\Windows\System\hBpkSIx.exe
  C:\Windows\System\hBpkSIx.exe
  2⤵
  PID:9480
- C:\Windows\System\RcSGBOZ.exe
  C:\Windows\System\RcSGBOZ.exe
  2⤵
  PID:9508
- C:\Windows\System\bYDQCyU.exe
  C:\Windows\System\bYDQCyU.exe
  2⤵
  PID:9532
- C:\Windows\System\QJZHjny.exe
  C:\Windows\System\QJZHjny.exe
  2⤵
  PID:9552
- C:\Windows\System\EFUnJti.exe
  C:\Windows\System\EFUnJti.exe
  2⤵
  PID:9568
- C:\Windows\System\DUMkJBo.exe
  C:\Windows\System\DUMkJBo.exe
  2⤵
  PID:9584
- C:\Windows\System\mZuEqvj.exe
  C:\Windows\System\mZuEqvj.exe
  2⤵
  PID:9608
- C:\Windows\System\umYiuMu.exe
  C:\Windows\System\umYiuMu.exe
  2⤵
  PID:9636
- C:\Windows\System\XOgRtwJ.exe
  C:\Windows\System\XOgRtwJ.exe
  2⤵
  PID:9660
- C:\Windows\System\OZztcKs.exe
  C:\Windows\System\OZztcKs.exe
  2⤵
  PID:9680
- C:\Windows\System\MLlfGcV.exe
  C:\Windows\System\MLlfGcV.exe
  2⤵
  PID:9704
- C:\Windows\System\fSZGYTs.exe
  C:\Windows\System\fSZGYTs.exe
  2⤵
  PID:9732
- C:\Windows\System\UYcUwdj.exe
  C:\Windows\System\UYcUwdj.exe
  2⤵
  PID:9752
- C:\Windows\System\ldHsJkJ.exe
  C:\Windows\System\ldHsJkJ.exe
  2⤵
  PID:9772
- C:\Windows\System\XkKYMDC.exe
  C:\Windows\System\XkKYMDC.exe
  2⤵
  PID:9796
- C:\Windows\System\gEWEGGi.exe
  C:\Windows\System\gEWEGGi.exe
  2⤵
  PID:9816
- C:\Windows\System\ToxFDex.exe
  C:\Windows\System\ToxFDex.exe
  2⤵
  PID:9840
- C:\Windows\System\agQtsxd.exe
  C:\Windows\System\agQtsxd.exe
  2⤵
  PID:9868
- C:\Windows\System\XkVtLrA.exe
  C:\Windows\System\XkVtLrA.exe
  2⤵
  PID:9888
- C:\Windows\System\UFoYUOs.exe
  C:\Windows\System\UFoYUOs.exe
  2⤵
  PID:9908
- C:\Windows\System\QaxCVMe.exe
  C:\Windows\System\QaxCVMe.exe
  2⤵
  PID:9928
- C:\Windows\System\MoSARwf.exe
  C:\Windows\System\MoSARwf.exe
  2⤵
  PID:9956
- C:\Windows\System\liQcqOo.exe
  C:\Windows\System\liQcqOo.exe
  2⤵
  PID:9980
- C:\Windows\System\rdyhwga.exe
  C:\Windows\System\rdyhwga.exe
  2⤵
  PID:10000
- C:\Windows\System\bwrFYUp.exe
  C:\Windows\System\bwrFYUp.exe
  2⤵
  PID:10024
- C:\Windows\System\rjWoEuh.exe
  C:\Windows\System\rjWoEuh.exe
  2⤵
  PID:10048
- C:\Windows\System\rNydCMk.exe
  C:\Windows\System\rNydCMk.exe
  2⤵
  PID:10068
- C:\Windows\System\enVevLp.exe
  C:\Windows\System\enVevLp.exe
  2⤵
  PID:10092
- C:\Windows\System\ezhBRmW.exe
  C:\Windows\System\ezhBRmW.exe
  2⤵
  PID:10112
- C:\Windows\System\KhPRrkt.exe
  C:\Windows\System\KhPRrkt.exe
  2⤵
  PID:10132
- C:\Windows\System\frVEEiZ.exe
  C:\Windows\System\frVEEiZ.exe
  2⤵
  PID:10156
- C:\Windows\System\sqVNAli.exe
  C:\Windows\System\sqVNAli.exe
  2⤵
  PID:10180
- C:\Windows\System\XbCWMTT.exe
  C:\Windows\System\XbCWMTT.exe
  2⤵
  PID:10200
- C:\Windows\System\NSfbkBB.exe
  C:\Windows\System\NSfbkBB.exe
  2⤵
  PID:10220
- C:\Windows\System\ehZYulP.exe
  C:\Windows\System\ehZYulP.exe
  2⤵
  PID:8852
- C:\Windows\System\nZafcfF.exe
  C:\Windows\System\nZafcfF.exe
  2⤵
  PID:9152
- C:\Windows\System\DCBuVmy.exe
  C:\Windows\System\DCBuVmy.exe
  2⤵
  PID:8032
- C:\Windows\System\LDVVwQK.exe
  C:\Windows\System\LDVVwQK.exe
  2⤵
  PID:8268
- C:\Windows\System\oXKZQYy.exe
  C:\Windows\System\oXKZQYy.exe
  2⤵
  PID:7656
- C:\Windows\System\YFqnsIf.exe
  C:\Windows\System\YFqnsIf.exe
  2⤵
  PID:7008
- C:\Windows\System\FiXFwCK.exe
  C:\Windows\System\FiXFwCK.exe
  2⤵
  PID:8392
- C:\Windows\System\tDJfEGX.exe
  C:\Windows\System\tDJfEGX.exe
  2⤵
  PID:8176
- C:\Windows\System\lklqupf.exe
  C:\Windows\System\lklqupf.exe
  2⤵
  PID:7488
- C:\Windows\System\AaTcHXx.exe
  C:\Windows\System\AaTcHXx.exe
  2⤵
  PID:8468
- C:\Windows\System\lesiBAS.exe
  C:\Windows\System\lesiBAS.exe
  2⤵
  PID:8340
- C:\Windows\System\xYOdoEi.exe
  C:\Windows\System\xYOdoEi.exe
  2⤵
  PID:8588
- C:\Windows\System\ltCAykk.exe
  C:\Windows\System\ltCAykk.exe
  2⤵
  PID:8744
- C:\Windows\System\vcDFcuH.exe
  C:\Windows\System\vcDFcuH.exe
  2⤵
  PID:10244
- C:\Windows\System\hwWvyBX.exe
  C:\Windows\System\hwWvyBX.exe
  2⤵
  PID:10264
- C:\Windows\System\lJuONrw.exe
  C:\Windows\System\lJuONrw.exe
  2⤵
  PID:10284
- C:\Windows\System\tJNVwSN.exe
  C:\Windows\System\tJNVwSN.exe
  2⤵
  PID:10304
- C:\Windows\System\dOlnVIS.exe
  C:\Windows\System\dOlnVIS.exe
  2⤵
  PID:10328
- C:\Windows\System\XmZvoMB.exe
  C:\Windows\System\XmZvoMB.exe
  2⤵
  PID:10352
- C:\Windows\System\NsOJDoZ.exe
  C:\Windows\System\NsOJDoZ.exe
  2⤵
  PID:10372
- C:\Windows\System\DUbqBXz.exe
  C:\Windows\System\DUbqBXz.exe
  2⤵
  PID:10396
- C:\Windows\System\PaZmSIl.exe
  C:\Windows\System\PaZmSIl.exe
  2⤵
  PID:10416
- C:\Windows\System\DOtJDZS.exe
  C:\Windows\System\DOtJDZS.exe
  2⤵
  PID:10436
- C:\Windows\System\TgiizhJ.exe
  C:\Windows\System\TgiizhJ.exe
  2⤵
  PID:10456
- C:\Windows\System\wtBzllV.exe
  C:\Windows\System\wtBzllV.exe
  2⤵
  PID:10480
- C:\Windows\System\efaGbNW.exe
  C:\Windows\System\efaGbNW.exe
  2⤵
  PID:10504
- C:\Windows\System\YmRAisd.exe
  C:\Windows\System\YmRAisd.exe
  2⤵
  PID:10520
- C:\Windows\System\fdNoZQq.exe
  C:\Windows\System\fdNoZQq.exe
  2⤵
  PID:10540
- C:\Windows\System\XkwibYy.exe
  C:\Windows\System\XkwibYy.exe
  2⤵
  PID:10560
- C:\Windows\System\DNxZNaa.exe
  C:\Windows\System\DNxZNaa.exe
  2⤵
  PID:10580
- C:\Windows\System\hhVbGpe.exe
  C:\Windows\System\hhVbGpe.exe
  2⤵
  PID:10596
- C:\Windows\System\NxEQxWT.exe
  C:\Windows\System\NxEQxWT.exe
  2⤵
  PID:10616
- C:\Windows\System\OcxfXIB.exe
  C:\Windows\System\OcxfXIB.exe
  2⤵
  PID:10640
- C:\Windows\System\QFuDmKW.exe
  C:\Windows\System\QFuDmKW.exe
  2⤵
  PID:10660
- C:\Windows\System\miVPLbl.exe
  C:\Windows\System\miVPLbl.exe
  2⤵
  PID:10684
- C:\Windows\System\tWcZRVn.exe
  C:\Windows\System\tWcZRVn.exe
  2⤵
  PID:10704
- C:\Windows\System\ISInroY.exe
  C:\Windows\System\ISInroY.exe
  2⤵
  PID:10724
- C:\Windows\System\whmvjsL.exe
  C:\Windows\System\whmvjsL.exe
  2⤵
  PID:10748
- C:\Windows\System\ZjRqJkL.exe
  C:\Windows\System\ZjRqJkL.exe
  2⤵
  PID:10772
- C:\Windows\System\kyixwcT.exe
  C:\Windows\System\kyixwcT.exe
  2⤵
  PID:10792
- C:\Windows\System\BCiSnRO.exe
  C:\Windows\System\BCiSnRO.exe
  2⤵
  PID:10816
- C:\Windows\System\rnNPhjy.exe
  C:\Windows\System\rnNPhjy.exe
  2⤵
  PID:10840
- C:\Windows\System\oPAAiRx.exe
  C:\Windows\System\oPAAiRx.exe
  2⤵
  PID:10864
- C:\Windows\System\exXoIyB.exe
  C:\Windows\System\exXoIyB.exe
  2⤵
  PID:10884
- C:\Windows\System\GezLRin.exe
  C:\Windows\System\GezLRin.exe
  2⤵
  PID:10908
- C:\Windows\System\czHdMLr.exe
  C:\Windows\System\czHdMLr.exe
  2⤵
  PID:10940
- C:\Windows\System\MRbaYrd.exe
  C:\Windows\System\MRbaYrd.exe
  2⤵
  PID:10964
- C:\Windows\System\mocSxPR.exe
  C:\Windows\System\mocSxPR.exe
  2⤵
  PID:10984
- C:\Windows\System\VyVuwYf.exe
  C:\Windows\System\VyVuwYf.exe
  2⤵
  PID:11008
- C:\Windows\System\iCptuEU.exe
  C:\Windows\System\iCptuEU.exe
  2⤵
  PID:11028
- C:\Windows\System\JnKmOwq.exe
  C:\Windows\System\JnKmOwq.exe
  2⤵
  PID:11056
- C:\Windows\System\vdsjCAB.exe
  C:\Windows\System\vdsjCAB.exe
  2⤵
  PID:11080
- C:\Windows\System\UrPzXZT.exe
  C:\Windows\System\UrPzXZT.exe
  2⤵
  PID:11108
- C:\Windows\System\SSjqsGj.exe
  C:\Windows\System\SSjqsGj.exe
  2⤵
  PID:11136
- C:\Windows\System\ffHnSgM.exe
  C:\Windows\System\ffHnSgM.exe
  2⤵
  PID:11156
- C:\Windows\System\NjVqsRB.exe
  C:\Windows\System\NjVqsRB.exe
  2⤵
  PID:11184
- C:\Windows\System\OMHcCXR.exe
  C:\Windows\System\OMHcCXR.exe
  2⤵
  PID:11204
- C:\Windows\System\hHNGYYF.exe
  C:\Windows\System\hHNGYYF.exe
  2⤵
  PID:11232
- C:\Windows\System\CzeCQKq.exe
  C:\Windows\System\CzeCQKq.exe
  2⤵
  PID:11252
- C:\Windows\System\visHSia.exe
  C:\Windows\System\visHSia.exe
  2⤵
  PID:9316
- C:\Windows\System\lvOiUOs.exe
  C:\Windows\System\lvOiUOs.exe
  2⤵
  PID:9340
- C:\Windows\System\XJCaWCU.exe
  C:\Windows\System\XJCaWCU.exe
  2⤵
  PID:9368
- C:\Windows\System\jbtAUBI.exe
  C:\Windows\System\jbtAUBI.exe
  2⤵
  PID:9100
- C:\Windows\System\TbKuEzt.exe
  C:\Windows\System\TbKuEzt.exe
  2⤵
  PID:9448
- C:\Windows\System\uGkEdHO.exe
  C:\Windows\System\uGkEdHO.exe
  2⤵
  PID:9496
- C:\Windows\System\yeZQuHS.exe
  C:\Windows\System\yeZQuHS.exe
  2⤵
  PID:9540
- C:\Windows\System\wpskXTc.exe
  C:\Windows\System\wpskXTc.exe
  2⤵
  PID:9576
- C:\Windows\System\YIqosTY.exe
  C:\Windows\System\YIqosTY.exe
  2⤵
  PID:7668
- C:\Windows\System\kmspMfl.exe
  C:\Windows\System\kmspMfl.exe
  2⤵
  PID:9624
- C:\Windows\System\scYKAFy.exe
  C:\Windows\System\scYKAFy.exe
  2⤵
  PID:6916
- C:\Windows\System\StZTkMz.exe
  C:\Windows\System\StZTkMz.exe
  2⤵
  PID:8368
- C:\Windows\System\sovWWIu.exe
  C:\Windows\System\sovWWIu.exe
  2⤵
  PID:9760
- C:\Windows\System\AVQHrcq.exe
  C:\Windows\System\AVQHrcq.exe
  2⤵
  PID:9860
- C:\Windows\System\wWebqfb.exe
  C:\Windows\System\wWebqfb.exe
  2⤵
  PID:8480
- C:\Windows\System\iBgOuSx.exe
  C:\Windows\System\iBgOuSx.exe
  2⤵
  PID:8248
- C:\Windows\System\gHeqwUL.exe
  C:\Windows\System\gHeqwUL.exe
  2⤵
  PID:10080
- C:\Windows\System\MCmnkiJ.exe
  C:\Windows\System\MCmnkiJ.exe
  2⤵
  PID:8516
- C:\Windows\System\rJajajf.exe
  C:\Windows\System\rJajajf.exe
  2⤵
  PID:8568
- C:\Windows\System\mQsioxD.exe
  C:\Windows\System\mQsioxD.exe
  2⤵
  PID:8272
- C:\Windows\System\bBSCBbC.exe
  C:\Windows\System\bBSCBbC.exe
  2⤵
  PID:7736
- C:\Windows\System\YzNKHUJ.exe
  C:\Windows\System\YzNKHUJ.exe
  2⤵
  PID:7748
- C:\Windows\System\mJTCuBL.exe
  C:\Windows\System\mJTCuBL.exe
  2⤵
  PID:6684
- C:\Windows\System\zFMSRQY.exe
  C:\Windows\System\zFMSRQY.exe
  2⤵
  PID:8840
- C:\Windows\System\jKKLRje.exe
  C:\Windows\System\jKKLRje.exe
  2⤵
  PID:9292
- C:\Windows\System\spvqCto.exe
  C:\Windows\System\spvqCto.exe
  2⤵
  PID:10276
- C:\Windows\System\YHebMra.exe
  C:\Windows\System\YHebMra.exe
  2⤵
  PID:9004
- C:\Windows\System\SSCpxPe.exe
  C:\Windows\System\SSCpxPe.exe
  2⤵
  PID:10392
- C:\Windows\System\NXsnMdZ.exe
  C:\Windows\System\NXsnMdZ.exe
  2⤵
  PID:9128
- C:\Windows\System\CSxNGPt.exe
  C:\Windows\System\CSxNGPt.exe
  2⤵
  PID:9412
- C:\Windows\System\xWxdaed.exe
  C:\Windows\System\xWxdaed.exe
  2⤵
  PID:9528
- C:\Windows\System\dGReHNW.exe
  C:\Windows\System\dGReHNW.exe
  2⤵
  PID:11272
- C:\Windows\System\KyaOVDg.exe
  C:\Windows\System\KyaOVDg.exe
  2⤵
  PID:11288
- C:\Windows\System\SrQIcjx.exe
  C:\Windows\System\SrQIcjx.exe
  2⤵
  PID:11304
- C:\Windows\System\uqIMWpu.exe
  C:\Windows\System\uqIMWpu.exe
  2⤵
  PID:11328
- C:\Windows\System\tQnKQOr.exe
  C:\Windows\System\tQnKQOr.exe
  2⤵
  PID:11348
- C:\Windows\System\OPrNUON.exe
  C:\Windows\System\OPrNUON.exe
  2⤵
  PID:11368
- C:\Windows\System\HBQPsTw.exe
  C:\Windows\System\HBQPsTw.exe
  2⤵
  PID:11388
- C:\Windows\System\gYuSEoh.exe
  C:\Windows\System\gYuSEoh.exe
  2⤵
  PID:11408
- C:\Windows\System\bcGcSTf.exe
  C:\Windows\System\bcGcSTf.exe
  2⤵
  PID:11432
- C:\Windows\System\SgYfKzc.exe
  C:\Windows\System\SgYfKzc.exe
  2⤵
  PID:11456
- C:\Windows\System\WaXxqlR.exe
  C:\Windows\System\WaXxqlR.exe
  2⤵
  PID:11484
- C:\Windows\System\AIYSRrC.exe
  C:\Windows\System\AIYSRrC.exe
  2⤵
  PID:11504
- C:\Windows\System\nbbiUbe.exe
  C:\Windows\System\nbbiUbe.exe
  2⤵
  PID:11528
- C:\Windows\System\ntCPAzX.exe
  C:\Windows\System\ntCPAzX.exe
  2⤵
  PID:11552
- C:\Windows\System\sNHSUDI.exe
  C:\Windows\System\sNHSUDI.exe
  2⤵
  PID:11576
- C:\Windows\System\HeeOWAc.exe
  C:\Windows\System\HeeOWAc.exe
  2⤵
  PID:11596
- C:\Windows\System\TbYlJte.exe
  C:\Windows\System\TbYlJte.exe
  2⤵
  PID:11620
- C:\Windows\System\LUzWaun.exe
  C:\Windows\System\LUzWaun.exe
  2⤵
  PID:11640
- C:\Windows\System\OxPqfls.exe
  C:\Windows\System\OxPqfls.exe
  2⤵
  PID:11664
- C:\Windows\System\QCcmjza.exe
  C:\Windows\System\QCcmjza.exe
  2⤵
  PID:11688
- C:\Windows\System\SoPlPjF.exe
  C:\Windows\System\SoPlPjF.exe
  2⤵
  PID:11708
- C:\Windows\System\TFlfldd.exe
  C:\Windows\System\TFlfldd.exe
  2⤵
  PID:11732
- C:\Windows\System\VYwfqLs.exe
  C:\Windows\System\VYwfqLs.exe
  2⤵
  PID:11756
- C:\Windows\System\RuAKOef.exe
  C:\Windows\System\RuAKOef.exe
  2⤵
  PID:11780
- C:\Windows\System\wdjfsTT.exe
  C:\Windows\System\wdjfsTT.exe
  2⤵
  PID:11800
- C:\Windows\System\cdtcMWA.exe
  C:\Windows\System\cdtcMWA.exe
  2⤵
  PID:11824
- C:\Windows\System\HODdrFK.exe
  C:\Windows\System\HODdrFK.exe
  2⤵
  PID:11844
- C:\Windows\System\JEUVESS.exe
  C:\Windows\System\JEUVESS.exe
  2⤵
  PID:11868
- C:\Windows\System\wsJJUgy.exe
  C:\Windows\System\wsJJUgy.exe
  2⤵
  PID:11892
- C:\Windows\System\jAazLsO.exe
  C:\Windows\System\jAazLsO.exe
  2⤵
  PID:10976
- C:\Windows\System\EjtMPoQ.exe
  C:\Windows\System\EjtMPoQ.exe
  2⤵
  PID:9904
- C:\Windows\System\JwnwopI.exe
  C:\Windows\System\JwnwopI.exe
  2⤵
  PID:11024
- C:\Windows\System\IjGkjxU.exe
  C:\Windows\System\IjGkjxU.exe
  2⤵
  PID:11072
- C:\Windows\System\TaoxoGR.exe
  C:\Windows\System\TaoxoGR.exe
  2⤵
  PID:10164
- C:\Windows\System\cNqDzBO.exe
  C:\Windows\System\cNqDzBO.exe
  2⤵
  PID:9436
- C:\Windows\System\JQzzQUH.exe
  C:\Windows\System\JQzzQUH.exe
  2⤵
  PID:8172
- C:\Windows\System\cUijkGl.exe
  C:\Windows\System\cUijkGl.exe
  2⤵
  PID:7612
- C:\Windows\System\erPdWJp.exe
  C:\Windows\System\erPdWJp.exe
  2⤵
  PID:9244
- C:\Windows\System\IreosYi.exe
  C:\Windows\System\IreosYi.exe
  2⤵
  PID:9724
- C:\Windows\System\NKBgUUn.exe
  C:\Windows\System\NKBgUUn.exe
  2⤵
  PID:10008
- C:\Windows\System\oVrsqud.exe
  C:\Windows\System\oVrsqud.exe
  2⤵
  PID:10348
- C:\Windows\System\IIYtOoA.exe
  C:\Windows\System\IIYtOoA.exe
  2⤵
  PID:7316
- C:\Windows\System\JuQBWbA.exe
  C:\Windows\System\JuQBWbA.exe
  2⤵
  PID:8868
- C:\Windows\System\GfWdwpu.exe
  C:\Windows\System\GfWdwpu.exe
  2⤵
  PID:10408
- C:\Windows\System\apIxFOH.exe
  C:\Windows\System\apIxFOH.exe
  2⤵
  PID:11280
- C:\Windows\System\HuzQiTd.exe
  C:\Windows\System\HuzQiTd.exe
  2⤵
  PID:10676
- C:\Windows\System\bFPGdmv.exe
  C:\Windows\System\bFPGdmv.exe
  2⤵
  PID:9716
- C:\Windows\System\xwyeYMl.exe
  C:\Windows\System\xwyeYMl.exe
  2⤵
  PID:10900
- C:\Windows\System\SMDsXWq.exe
  C:\Windows\System\SMDsXWq.exe
  2⤵
  PID:11036
- C:\Windows\System\ubpgZxd.exe
  C:\Windows\System\ubpgZxd.exe
  2⤵
  PID:10100
- C:\Windows\System\dwgAgRu.exe
  C:\Windows\System\dwgAgRu.exe
  2⤵
  PID:10236
- C:\Windows\System\SuFXRSN.exe
  C:\Windows\System\SuFXRSN.exe
  2⤵
  PID:9900
- C:\Windows\System\YmXRBiH.exe
  C:\Windows\System\YmXRBiH.exe
  2⤵
  PID:10076
- C:\Windows\System\acoYQks.exe
  C:\Windows\System\acoYQks.exe
  2⤵
  PID:8072
- C:\Windows\System\GVUYjcG.exe
  C:\Windows\System\GVUYjcG.exe
  2⤵
  PID:10272
- C:\Windows\System\rOGxWdE.exe
  C:\Windows\System\rOGxWdE.exe
  2⤵
  PID:8920
- C:\Windows\System\JhvyTFM.exe
  C:\Windows\System\JhvyTFM.exe
  2⤵
  PID:10496
- C:\Windows\System\MNpiIJU.exe
  C:\Windows\System\MNpiIJU.exe
  2⤵
  PID:10572
- C:\Windows\System\JRISNul.exe
  C:\Windows\System\JRISNul.exe
  2⤵
  PID:12300
- C:\Windows\System\UFiSLMG.exe
  C:\Windows\System\UFiSLMG.exe
  2⤵
  PID:12332
- C:\Windows\System\VBBIiBS.exe
  C:\Windows\System\VBBIiBS.exe
  2⤵
  PID:12356
- C:\Windows\System\HkQwNUK.exe
  C:\Windows\System\HkQwNUK.exe
  2⤵
  PID:12380
- C:\Windows\System\PLLEzje.exe
  C:\Windows\System\PLLEzje.exe
  2⤵
  PID:12412
- C:\Windows\System\pGevDTE.exe
  C:\Windows\System\pGevDTE.exe
  2⤵
  PID:12432
- C:\Windows\System\welkwNE.exe
  C:\Windows\System\welkwNE.exe
  2⤵
  PID:12460
- C:\Windows\System\XHvNHDj.exe
  C:\Windows\System\XHvNHDj.exe
  2⤵
  PID:12480
- C:\Windows\System\JozEIDX.exe
  C:\Windows\System\JozEIDX.exe
  2⤵
  PID:12504
- C:\Windows\System\DHjohfM.exe
  C:\Windows\System\DHjohfM.exe
  2⤵
  PID:12528
- C:\Windows\System\uEOPIYc.exe
  C:\Windows\System\uEOPIYc.exe
  2⤵
  PID:12552
- C:\Windows\System\PfBaNGP.exe
  C:\Windows\System\PfBaNGP.exe
  2⤵
  PID:12576
- C:\Windows\System\ePWsiFR.exe
  C:\Windows\System\ePWsiFR.exe
  2⤵
  PID:12600
- C:\Windows\System\eAGolLo.exe
  C:\Windows\System\eAGolLo.exe
  2⤵
  PID:12624
- C:\Windows\System\eNuGdiu.exe
  C:\Windows\System\eNuGdiu.exe
  2⤵
  PID:12648
- C:\Windows\System\JzbCfLX.exe
  C:\Windows\System\JzbCfLX.exe
  2⤵
  PID:12680
- C:\Windows\System\aDsKQHu.exe
  C:\Windows\System\aDsKQHu.exe
  2⤵
  PID:12700
- C:\Windows\System\fLSmczH.exe
  C:\Windows\System\fLSmczH.exe
  2⤵
  PID:12716
- C:\Windows\System\PNkARDb.exe
  C:\Windows\System\PNkARDb.exe
  2⤵
  PID:12732
- C:\Windows\System\HedQCdq.exe
  C:\Windows\System\HedQCdq.exe
  2⤵
  PID:12748
- C:\Windows\System\VfsDbMI.exe
  C:\Windows\System\VfsDbMI.exe
  2⤵
  PID:12764
- C:\Windows\System\kHGdkYa.exe
  C:\Windows\System\kHGdkYa.exe
  2⤵
  PID:12780
- C:\Windows\System\AivbwmM.exe
  C:\Windows\System\AivbwmM.exe
  2⤵
  PID:12804
- C:\Windows\System\xIGwqNW.exe
  C:\Windows\System\xIGwqNW.exe
  2⤵
  PID:12820
- C:\Windows\System\rTnbBQd.exe
  C:\Windows\System\rTnbBQd.exe
  2⤵
  PID:12836
- C:\Windows\System\tlZICKa.exe
  C:\Windows\System\tlZICKa.exe
  2⤵
  PID:12860
- C:\Windows\System\ktRraoF.exe
  C:\Windows\System\ktRraoF.exe
  2⤵
  PID:12884
- C:\Windows\System\pJMQLHZ.exe
  C:\Windows\System\pJMQLHZ.exe
  2⤵
  PID:12904
- C:\Windows\System\IerBcoa.exe
  C:\Windows\System\IerBcoa.exe
  2⤵
  PID:12928
- C:\Windows\System\QMYKeBO.exe
  C:\Windows\System\QMYKeBO.exe
  2⤵
  PID:12948
- C:\Windows\System\qSzquDL.exe
  C:\Windows\System\qSzquDL.exe
  2⤵
  PID:12976
- C:\Windows\System\IFSRPDp.exe
  C:\Windows\System\IFSRPDp.exe
  2⤵
  PID:13008
- C:\Windows\System\CTlempl.exe
  C:\Windows\System\CTlempl.exe
  2⤵
  PID:13040
- C:\Windows\System\BWkodQe.exe
  C:\Windows\System\BWkodQe.exe
  2⤵
  PID:13056
- C:\Windows\System\NQhlzzv.exe
  C:\Windows\System\NQhlzzv.exe
  2⤵
  PID:13080
- C:\Windows\System\jJAgEHK.exe
  C:\Windows\System\jJAgEHK.exe
  2⤵
  PID:12428
- C:\Windows\System\jRIFeVI.exe
  C:\Windows\System\jRIFeVI.exe
  2⤵
  PID:11628
- C:\Windows\System\UBerXXq.exe
  C:\Windows\System\UBerXXq.exe
  2⤵
  PID:7368
- C:\Windows\System\nxOMMzR.exe
  C:\Windows\System\nxOMMzR.exe
  2⤵
  PID:13248
- C:\Windows\System\McZRphG.exe
  C:\Windows\System\McZRphG.exe
  2⤵
  PID:13236
- C:\Windows\System\CNqREHo.exe
  C:\Windows\System\CNqREHo.exe
  2⤵
  PID:13292
- C:\Windows\System\fPuBiuK.exe
  C:\Windows\System\fPuBiuK.exe
  2⤵
  PID:11660
- C:\Windows\System\lzzAlCI.exe
  C:\Windows\System\lzzAlCI.exe
  2⤵
  PID:8896
- C:\Windows\System\tIUGFPn.exe
  C:\Windows\System\tIUGFPn.exe
  2⤵
  PID:8724
- C:\Windows\System\drxkkCp.exe
  C:\Windows\System\drxkkCp.exe
  2⤵
  PID:12352
- C:\Windows\System\gMGPBIm.exe
  C:\Windows\System\gMGPBIm.exe
  2⤵
  PID:10668
- C:\Windows\System\QbiTxDj.exe
  C:\Windows\System\QbiTxDj.exe
  2⤵
  PID:10764
- C:\Windows\System\RCsOekR.exe
  C:\Windows\System\RCsOekR.exe
  2⤵
  PID:11248
- C:\Windows\System\WNvPnOW.exe
  C:\Windows\System\WNvPnOW.exe
  2⤵
  PID:11000
- C:\Windows\System\oTiUeyp.exe
  C:\Windows\System\oTiUeyp.exe
  2⤵
  PID:10780
- C:\Windows\System\ZfEGKWt.exe
  C:\Windows\System\ZfEGKWt.exe
  2⤵
  PID:11176
- C:\Windows\System\jgdbDJc.exe
  C:\Windows\System\jgdbDJc.exe
  2⤵
  PID:9172
- C:\Windows\System\lWPSTQh.exe
  C:\Windows\System\lWPSTQh.exe
  2⤵
  PID:13200
- C:\Windows\System\lYXAjvM.exe
  C:\Windows\System\lYXAjvM.exe
  2⤵
  PID:8992
- C:\Windows\System\oMxVkEt.exe
  C:\Windows\System\oMxVkEt.exe
  2⤵
  PID:9544
- C:\Windows\System\tIdcViy.exe
  C:\Windows\System\tIdcViy.exe
  2⤵
  PID:9360
- C:\Windows\System\pDAEsGy.exe
  C:\Windows\System\pDAEsGy.exe
  2⤵
  PID:10472
- C:\Windows\System\FaasLsl.exe
  C:\Windows\System\FaasLsl.exe
  2⤵
  PID:8948
- C:\Windows\System\vGWMTUZ.exe
  C:\Windows\System\vGWMTUZ.exe
  2⤵
  PID:12812
- C:\Windows\System\HcnJsqS.exe
  C:\Windows\System\HcnJsqS.exe
  2⤵
  PID:12944
- C:\Windows\System\aPaUoGA.exe
  C:\Windows\System\aPaUoGA.exe
  2⤵
  PID:9592
- C:\Windows\System\gJpuFAl.exe
  C:\Windows\System\gJpuFAl.exe
  2⤵
  PID:13136
- C:\Windows\System\xBlzecl.exe
  C:\Windows\System\xBlzecl.exe
  2⤵
  PID:10612
- C:\Windows\System\nlFrEIC.exe
  C:\Windows\System\nlFrEIC.exe
  2⤵
  PID:11656
- C:\Windows\System\KDrOSxe.exe
  C:\Windows\System\KDrOSxe.exe
  2⤵
  PID:10556
- C:\Windows\System\tXLXDMw.exe
  C:\Windows\System\tXLXDMw.exe
  2⤵
  PID:12544
- C:\Windows\System\ZYPSetQ.exe
  C:\Windows\System\ZYPSetQ.exe
  2⤵
  PID:3468
- C:\Windows\System\JRNzAaQ.exe
  C:\Windows\System\JRNzAaQ.exe
  2⤵
  PID:13120
- C:\Windows\System\qLDKtDa.exe
  C:\Windows\System\qLDKtDa.exe
  2⤵
  PID:12020
- C:\Windows\System\gnewkBD.exe
  C:\Windows\System\gnewkBD.exe
  2⤵
  PID:13244
- C:\Windows\System\ncSHhRy.exe
  C:\Windows\System\ncSHhRy.exe
  2⤵
  PID:9936
- C:\Windows\System\tDSWEnx.exe
  C:\Windows\System\tDSWEnx.exe
  2⤵
  PID:10636
- C:\Windows\System\vxpCNDZ.exe
  C:\Windows\System\vxpCNDZ.exe
  2⤵
  PID:4928
- C:\Windows\System\kloYYsD.exe
  C:\Windows\System\kloYYsD.exe
  2⤵
  PID:12420
- C:\Windows\System\ZCCCLoD.exe
  C:\Windows\System\ZCCCLoD.exe
  2⤵
  PID:12536
- C:\Windows\System\eeTjNaw.exe
  C:\Windows\System\eeTjNaw.exe
  2⤵
  PID:12728
- C:\Windows\System\SPXwkgs.exe
  C:\Windows\System\SPXwkgs.exe
  2⤵
  PID:13196
- C:\Windows\System\SUoflCc.exe
  C:\Windows\System\SUoflCc.exe
  2⤵
  PID:12964
- C:\Windows\System\EKWVPKO.exe
  C:\Windows\System\EKWVPKO.exe
  2⤵
  PID:7052
- C:\Windows\System\AWgjBEm.exe
  C:\Windows\System\AWgjBEm.exe
  2⤵
  PID:11840
- C:\Windows\System\edxcEdt.exe
  C:\Windows\System\edxcEdt.exe
  2⤵
  PID:11548
- C:\Windows\System\tqhmBBt.exe
  C:\Windows\System\tqhmBBt.exe
  2⤵
  PID:13184
- C:\Windows\System\axcvmBd.exe
  C:\Windows\System\axcvmBd.exe
  2⤵
  PID:9044
- C:\Windows\System\vUofrCm.exe
  C:\Windows\System\vUofrCm.exe
  2⤵
  PID:11092
- C:\Windows\System\pWzIZnj.exe
  C:\Windows\System\pWzIZnj.exe
  2⤵
  PID:13260
- C:\Windows\System\hIhBbDy.exe
  C:\Windows\System\hIhBbDy.exe
  2⤵
  PID:12132
- C:\Windows\System\aPFqFpP.exe
  C:\Windows\System\aPFqFpP.exe
  2⤵
  PID:11324
- C:\Windows\System\eJagYJT.exe
  C:\Windows\System\eJagYJT.exe
  2⤵
  PID:12448
- C:\Windows\System\SqrUFxR.exe
  C:\Windows\System\SqrUFxR.exe
  2⤵
  PID:10800
- C:\Windows\System\WNdDgFl.exe
  C:\Windows\System\WNdDgFl.exe
  2⤵
  PID:12404
- C:\Windows\System\FmfmeQM.exe
  C:\Windows\System\FmfmeQM.exe
  2⤵
  PID:12984
- C:\Windows\System\rQeYtZV.exe
  C:\Windows\System\rQeYtZV.exe
  2⤵
  PID:13180
- C:\Windows\System\aRmmppH.exe
  C:\Windows\System\aRmmppH.exe
  2⤵
  PID:12956
- C:\Windows\System\VFwQuZZ.exe
  C:\Windows\System\VFwQuZZ.exe
  2⤵
  PID:12476
- C:\Windows\System\SONypNs.exe
  C:\Windows\System\SONypNs.exe
  2⤵
  PID:12596
- C:\Windows\System\qAAJvOB.exe
  C:\Windows\System\qAAJvOB.exe
  2⤵
  PID:11832
- C:\Windows\System\nfBzCfk.exe
  C:\Windows\System\nfBzCfk.exe
  2⤵
  PID:2520
- C:\Windows\System\RvShSMy.exe
  C:\Windows\System\RvShSMy.exe
  2⤵
  PID:7648
- C:\Windows\System\ZNLAJyi.exe
  C:\Windows\System\ZNLAJyi.exe
  2⤵
  PID:11860
- C:\Windows\System\jFxvTup.exe
  C:\Windows\System\jFxvTup.exe
  2⤵
  PID:12644
- C:\Windows\System\nHMOhRB.exe
  C:\Windows\System\nHMOhRB.exe
  2⤵
  PID:4444
- C:\Windows\System\ALrmVIb.exe
  C:\Windows\System\ALrmVIb.exe
  2⤵
  PID:12760
- C:\Windows\System\fgMQbZc.exe
  C:\Windows\System\fgMQbZc.exe
  2⤵
  PID:13172
- C:\Windows\System\kGPpNfM.exe
  C:\Windows\System\kGPpNfM.exe
  2⤵
  PID:11888
- C:\Windows\System\WBlcvvW.exe
  C:\Windows\System\WBlcvvW.exe
  2⤵
  PID:8776
- C:\Windows\System\DkWMkmf.exe
  C:\Windows\System\DkWMkmf.exe
  2⤵
  PID:9424
- C:\Windows\System\eJXGauH.exe
  C:\Windows\System\eJXGauH.exe
  2⤵
  PID:11748
- C:\Windows\System\ZBzuzvx.exe
  C:\Windows\System\ZBzuzvx.exe
  2⤵
  PID:13328
- C:\Windows\System\YpurWRr.exe
  C:\Windows\System\YpurWRr.exe
  2⤵
  PID:13348
- C:\Windows\System\mFpgLTp.exe
  C:\Windows\System\mFpgLTp.exe
  2⤵
  PID:13420
- C:\Windows\System\BIXbvqM.exe
  C:\Windows\System\BIXbvqM.exe
  2⤵
  PID:13628
- C:\Windows\System\jITUlJf.exe
  C:\Windows\System\jITUlJf.exe
  2⤵
  PID:13668
- C:\Windows\System\AsdQfkw.exe
  C:\Windows\System\AsdQfkw.exe
  2⤵
  PID:13688
- C:\Windows\System\GGgaZWv.exe
  C:\Windows\System\GGgaZWv.exe
  2⤵
  PID:13716
- C:\Windows\System\JRBQiTl.exe
  C:\Windows\System\JRBQiTl.exe
  2⤵
  PID:13736
- C:\Windows\System\QpFNihf.exe
  C:\Windows\System\QpFNihf.exe
  2⤵
  PID:13856
- C:\Windows\System\pXVmLov.exe
  C:\Windows\System\pXVmLov.exe
  2⤵
  PID:13980
- C:\Windows\System\wVXBgRO.exe
  C:\Windows\System\wVXBgRO.exe
  2⤵
  PID:14004
- C:\Windows\System\dZatblC.exe
  C:\Windows\System\dZatblC.exe
  2⤵
  PID:14036
- C:\Windows\System\OQTnTvi.exe
  C:\Windows\System\OQTnTvi.exe
  2⤵
  PID:14056
- C:\Windows\System\pTrWLGT.exe
  C:\Windows\System\pTrWLGT.exe
  2⤵
  PID:14072
- C:\Windows\System\TBSPWEE.exe
  C:\Windows\System\TBSPWEE.exe
  2⤵
  PID:14088
- C:\Windows\System\TwfJXTJ.exe
  C:\Windows\System\TwfJXTJ.exe
  2⤵
  PID:14104
- C:\Windows\System\PPqSITg.exe
  C:\Windows\System\PPqSITg.exe
  2⤵
  PID:14120
- C:\Windows\System\zxqPRSM.exe
  C:\Windows\System\zxqPRSM.exe
  2⤵
  PID:14136
- C:\Windows\System\iMWHqRW.exe
  C:\Windows\System\iMWHqRW.exe
  2⤵
  PID:14152
- C:\Windows\System\vmgKKFZ.exe
  C:\Windows\System\vmgKKFZ.exe
  2⤵
  PID:14168
- C:\Windows\System\xsBZPvD.exe
  C:\Windows\System\xsBZPvD.exe
  2⤵
  PID:14184
- C:\Windows\System\ObbCgFI.exe
  C:\Windows\System\ObbCgFI.exe
  2⤵
  PID:14204
- C:\Windows\System\IVxLVXa.exe
  C:\Windows\System\IVxLVXa.exe
  2⤵
  PID:14228
- C:\Windows\System\iqBpwzZ.exe
  C:\Windows\System\iqBpwzZ.exe
  2⤵
  PID:13472
- C:\Windows\System\AXlDIFr.exe
  C:\Windows\System\AXlDIFr.exe
  2⤵
  PID:11536
- C:\Windows\System\bmjTees.exe
  C:\Windows\System\bmjTees.exe
  2⤵
  PID:13516
- C:\Windows\System\BWDQari.exe
  C:\Windows\System\BWDQari.exe
  2⤵
  PID:7124
- C:\Windows\System\hTzWqMp.exe
  C:\Windows\System\hTzWqMp.exe
  2⤵
  PID:13912
- C:\Windows\System\XdKzEVA.exe
  C:\Windows\System\XdKzEVA.exe
  2⤵
  PID:14064
- C:\Windows\System\CIVEAUm.exe
  C:\Windows\System\CIVEAUm.exe
  2⤵
  PID:14012
- C:\Windows\System\OepjOLF.exe
  C:\Windows\System\OepjOLF.exe
  2⤵
  PID:14268
- C:\Windows\System\OMggiwJ.exe
  C:\Windows\System\OMggiwJ.exe
  2⤵
  PID:14296
- C:\Windows\System\KwdIXUk.exe
  C:\Windows\System\KwdIXUk.exe
  2⤵
  PID:14240
- C:\Windows\System\AcfkEIo.exe
  C:\Windows\System\AcfkEIo.exe
  2⤵
  PID:13028
- C:\Windows\System\bFILyJw.exe
  C:\Windows\System\bFILyJw.exe
  2⤵
  PID:13108
- C:\Windows\System\XmKOXuE.exe
  C:\Windows\System\XmKOXuE.exe
  2⤵
  PID:7364
- C:\Windows\System\QeYYwHt.exe
  C:\Windows\System\QeYYwHt.exe
  2⤵
  PID:13496
- C:\Windows\System\yMaCNUG.exe
  C:\Windows\System\yMaCNUG.exe
  2⤵
  PID:13480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3c2fetoh.n3q.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AAFjdnr.exe

Filesize
2.2MB

MD5
992aee1ac0e3c5482d5ee42d1d5d1e3a

SHA1
5d33779c7b37f09499188ca1e349cdbddfce5f25

SHA256
3b1d2bb3c72d947249253c6a7da1ffaa665c5e14af0fdb084a7078d73fdc673b

SHA512
18c9c8649395ecdb08ada4b726e2aa3f682c003c8ca6934338ceac288359d2c4388159e493406ed5c288076aa9087c7adcd48967022d818f4180b6c59e984ac8

Download Submit
C:\Windows\System\ADCOsnM.exe

Filesize
2.2MB

MD5
6b409d6846402015714dd795dffaff32

SHA1
2332dfa84548cd4afb8fd2fd51049eb5cc40e7f8

SHA256
92f39f41130190fc7a8610873834e08794aba89e84c6ac42b9873290fe150e2f

SHA512
f310e2d149e4410e84c9831e5b7052f6eeb0cadfc6e491b50b40c1c5405491315f81b7931723e072a7685bf4bb3216861ef5ff8a382a972223b0403f6c507f16

Download Submit
C:\Windows\System\AVvLqag.exe

Filesize
2.2MB

MD5
4a5a94d61c39386a8d1aca724a65c394

SHA1
f49ea2f8190aff28878487be34d365997ef5a480

SHA256
432b331be93a97855218209c7017550dc7bcd4a5ce0a32558091ea0946d67da4

SHA512
77130b0f0cb2e9a03a125e2b8b3d5aa2315951fcadde4ab5c32d5df363c6105e850b4057df65d7bb480af27bb3562858acbceb9d7121ae3cfdde0881f5a7564e

Download Submit
C:\Windows\System\COrWAzM.exe

Filesize
2.2MB

MD5
564271699243573cbe0d86c2849c349e

SHA1
cb19aa20a9eabcb97d7f86d2b154d2ab000555d9

SHA256
7a446e35078e8d4234ec57dc0ce989601c84b434ac365a956b27b73078ae2396

SHA512
8f7d425403b0e8ee8b0b36b98f3817a214e0951eb427094f3d222e329e7a23737313c5a22b4fa471001efec1cfe53762de3ef34ab4d355844d6e92dcfac6a4ff

Download Submit
C:\Windows\System\EqDCHNH.exe

Filesize
2.2MB

MD5
683bffa3e7fc7fc909b19d3ab69aa7e5

SHA1
1e7a5cdeb6533a3b8e76225355257037cfe4afce

SHA256
95a15530192ee1c796dc6b1a88b3cf50a347dda074704135d1341daabbd030a0

SHA512
427a287c2da122322f4fe0e843e2a83683f26bd43a5a1b5450e4c18b3b1939a7b3c48f8dc271681495bfd1808529c4787f11f3d995a19baebf4bbe76098cd853

Download Submit
C:\Windows\System\IaGjaTO.exe

Filesize
2.2MB

MD5
03431f7e8bc831e1f40cae3c52db8b15

SHA1
422352a0b65a5a354fd38eb57e3e38ced416e206

SHA256
6b0cfca9aa0157ec4c402d1e7077a69bd8d17eab3c835258feba0d0a04a4c231

SHA512
7e83a4b52249b1b6adb30fb5702f47aafee2728c3eb9ef793fcb001ee7d29944cf950d212e7b54f7e53d987c5ee03bfae92da6c6d825a50032edb00626cce561

Download Submit
C:\Windows\System\IqVzVPf.exe

Filesize
2.2MB

MD5
54fe6c33c65357259bdffb7d582c97a3

SHA1
0387cf06c69be82b4afc43c42ea74a382e52dae0

SHA256
5a2e383947bc73a6466dbf5ed854cd0858ad91b95666b3872a1a979df2689076

SHA512
844311db0d3246b2f35f3f4960d59cc03707a1ae1b7e920c899d7e97c171c001852d8dcfa9aed4c76cc345c81ee65e4ec5f2a991a7cde9d233e86d031605cfa3

Download Submit
C:\Windows\System\JEVuunl.exe

Filesize
2.2MB

MD5
922493fe82799c051568e6c4cfd75802

SHA1
5ce1ffd0b1ce23df9633932d6e9475a041720fb4

SHA256
80cea19fd15c225c47dc33bf8168c115688e4574f5c2ae2487eb29df9f0bd5ae

SHA512
8c74e980de0dfc637de17a2bc3183847d33e335c68aa81e7c30acc702616bac9931502b558026ee9efca5bb821d5cd9d7ba06f254414d2bd763fb692912085fe

Download Submit
C:\Windows\System\KPEQeLq.exe

Filesize
2.2MB

MD5
45ca35041b26cd11a8d320a369627bb7

SHA1
c7a7a22af27941aa5d5736abc2d0fa40292333d6

SHA256
a2f6c9eb078d557b98e26eea12a436699d0516b5c936892c307c02c058e96046

SHA512
c4d1e01b9e0f0302352450789b9370a0400d1fe2a77166986d997ce1ca75e3ec9a38ec9816a30f956ef06076a316da37854eb153b02b669f09d5b39a2ca3dae7

Download Submit
C:\Windows\System\KoCBhxf.exe

Filesize
2.2MB

MD5
c9903d08aead86a1672a022f1f12e71d

SHA1
77013d957a6656c4309bc9010b1d4bc2f7c21a6a

SHA256
5b67a333f8e2f2a7cf80a2e381308efa6cc256c53d2942769a4ca66f14605ff2

SHA512
a3b16403ca6d3f81e1bd8f0f9dd374e9a0ef1f2d72690e7e1328b8320a5937cb07b7cc90f9171d357066edf2685258bce45af1ea25ff35bd52b7d6c8c555801b

Download Submit
C:\Windows\System\PzDsMyD.exe

Filesize
2.2MB

MD5
b5075d612741f56035d93a50292c81e4

SHA1
c03567aad1c6d624a835e03506d1f1eef98f1e8f

SHA256
557eecc86b34c654923f33b88a5a2e5a2c1cada3dd9daed59c08bd9454759733

SHA512
ae339212aa36de7fad5a15b7d76db34b01849cbb04659d4687ef150f4a8a6676639a7c99f3786e9d108a7aeeb3bd1b5027174809c5e3a9a9ba494a70a9ad0bca

Download Submit
C:\Windows\System\QDCtDoP.exe

Filesize
2.2MB

MD5
8599223ad366fa74b687e25c02d5931c

SHA1
2db505e21b6ab7adabd8d24aae1dac21f862672a

SHA256
8571923b48120456df9fbb099bca7799d94a1917b681807697b6eeb1099828c7

SHA512
b0b3c919c63e48844fc85f8253cbdc97df75f6e808c2fd047782bb269c1f48bc704e07992c7dfe5401eb216f0327f1aae4986e00f44837710efbb0783accb500

Download Submit
C:\Windows\System\QKCGCOd.exe

Filesize
2.2MB

MD5
5eb2f2653a74c967d0b8bb6ff6caace6

SHA1
8433ace25f00e7ffda3241029725a9bbe95b7346

SHA256
bc33d1869754e00cae34702c9bd42352fd0a1167f0545f20d9457686f6ab19f5

SHA512
9890bd7d1ae818ae14b39062d491450d0b1d6785a0cd328e68f28968e94a5852df307e617e2cceb77a4ce9310ba4bcb5db45560a37b7024ae1ff9c9765dad0c9

Download Submit
C:\Windows\System\UNMosJR.exe

Filesize
2.2MB

MD5
b14eea7177eecd25a45e7348c8fb9f9d

SHA1
f76211a6a8ca292698cbe27d71f6f2c7a0c16051

SHA256
439a729b9c225a43845527ef58d844114be5d0a8cc20cf6a017ec2a6c333a89b

SHA512
4f7c2d236902e3bbfb93b66f4d4d6e227f900f3061c66e9d4d7b1e452773f06ac04bbb4ff9fa7afc1e7d515ade0bb70e6f51c7f86e1d2d00d2c889a02c88aed6

Download Submit
C:\Windows\System\UYbDoeW.exe

Filesize
2.2MB

MD5
4c133e012447325555f0a84b1c649c41

SHA1
c4691944340c2ec54eecbb985caba78231561987

SHA256
90fd3d863e2a8e87d104c27815d18c5021add7ac195ec13e0b65dd5764af9fe6

SHA512
7fd3a2dc50e9ff4c84eb7630f86d33ea70e0fa8def4003ba3e3914c1eff024db09db92053f9aca3f45d0b7189defeec6d4a23c65e0669fea4c91cb0b592803e4

Download Submit
C:\Windows\System\VVVAzWU.exe

Filesize
2.2MB

MD5
ba5d8a76e8beda6d3b68314827da4a16

SHA1
37c05e62931a6330070d6cf2f7e32286aed4b708

SHA256
ea27c2770b5ca3dcc17efffb54d01bc9e1c049cae806316362f3ecc360d7e7a5

SHA512
554c0a0cb1b7d7f095350f290e0a2507a4679b90cd7478ecb19c32819ec074bccdf8ca859c847d3cc8ed3980137a38102845f8552389c0b4d9ca3594b88d5863

Download Submit
C:\Windows\System\WSrkRtb.exe

Filesize
2.2MB

MD5
cfb2958ce1135a20de028b5dcb5b0b5b

SHA1
36ea389e2af03ed2e46cd6d399367c3ef33d6e90

SHA256
2c5eac6c9e0b9fff08ba76512d5c90b53ca7a85052cea7b5a571943413630e23

SHA512
49dd4dbebe57527b61e7e4793ce1bf18880774ae63b9b551d7f6df50cff6196a7b74e1443678cf61c8910c13411c1e87c68bd82be0289335f43f5b966dd60b0f

Download Submit
C:\Windows\System\afjDNUF.exe

Filesize
2.2MB

MD5
eae07744af71822d9b2d1bdb11d4ea7d

SHA1
bbd13b387b18ee1a0bed1bbfe01906a8a2b4342d

SHA256
d5966bf8517256da5695902f47e6031fb4944dc0895a47c240eaaaaaa5a31a26

SHA512
3dc7464bb63ffe15fc0bc9f30cda1af73d9bb0e1e4a49ea2c6dbaaadedc95efab8e460d99c7a9f25406f77f7ea66ca3801309d8faac48ca298e16a7e697d78c9

Download Submit
C:\Windows\System\amXmhLn.exe

Filesize
2.2MB

MD5
f646fdcb75889ff1980c990fbbdd8ca5

SHA1
30179cbe15260f4f4d147fb6a0282bb2a20c83b7

SHA256
d4ea134fdb14e1b836968684bfb48e0987f9c31f6235b5ce84843788dd6687bd

SHA512
fe88a68a328fa29e34851fe38188fbfc0282374492bfde27d93ce974741c94f186efc26eb0936fabed7782670bee31b252581a03ff099279a5c4d57ab17b7399

Download Submit
C:\Windows\System\dmwNVoo.exe

Filesize
2.2MB

MD5
7a9cc95b4788879e62964887b4b7f279

SHA1
55068cde51969fce496cc1dd3a2a5647771f4510

SHA256
54f10d447f63693c1e034eb998179f8291f5a59bfb39c8b989aa94ebc0b84648

SHA512
7c7c2cf0f7eeae1c5a448a7ba6b0c43b6cc4f1a2b041f1a977a11143d2e138db402c54abf1f5788493752d3f1c657c704bb34989a97495d18c979acd061ae99d

Download Submit
C:\Windows\System\eLGfSzA.exe

Filesize
2.2MB

MD5
441b7fdf036f2debce9c8984589dda90

SHA1
d1811a91d70249217a22d3b6115ef7851d6f1fdb

SHA256
47b39bdeb9ce9fa86a7e4d3bf037a34ccf0726c23289cc2f0a55b47b8888a49d

SHA512
d4bb59c7b9a8ca3f400b7a2945e46a1d026e20fb870e9d0e5c5f58667bb1e7e968da8e6e9070d3661c320a9f7532b09a490257e85e2eff96516aba16e2988a84

Download Submit
C:\Windows\System\fAQqLDb.exe

Filesize
2.2MB

MD5
dc15fde830e7fd1e4af813f9fa08a2e2

SHA1
606680f9c7edee1a912b04f163995c27ca96b940

SHA256
e603c268eed31e5480775620e1d720411a8efbbd066542bde2ba18e12f5be33f

SHA512
8e3f867e63f1e3e962a21bc478ca03952c2b1ddb6a49d952a4e943e25eb2c5c776146ac0e3f78fae618681cb849c57bd80f50f16f50807bbead95d5d4ba92f4a

Download Submit
C:\Windows\System\hZerHrK.exe

Filesize
2.2MB

MD5
d34de32f7590eaaaa99dfa6b6aba1d25

SHA1
cd9517236f29e54de651a571a31f60fe0fa5c22a

SHA256
c024e17f2a6cd45d59622b47fade865e2a6266fb41624a9ef4ef7ec2977c38be

SHA512
1d3506c14fd0f6f24c19b6979c9bde0e49b7a72c032fe4b5bccdb310b7262e93e3ef9a8f0ad5fdc0bfda79bd1db7dff12bc3c72d089f09ee77ea2cf844ebda12

Download Submit
C:\Windows\System\iulNntJ.exe

Filesize
2.2MB

MD5
389bf0ae51e7247be4cda644cca5beac

SHA1
77252e300948ba642848daa0e790ac0e6f0a6858

SHA256
233df6b8d0b045249f084c9a2d3c1849a1e0e82bedaf4bc1b8e3dabdf5aaff7c

SHA512
1e42b745adf57a0646e895aa2a828d7d873a9235ab6f6649faacb51e9e04220eca533dd7767f22cba8ceed0a17eb6029d6c473b8c7a00fa00b0231189a719939

Download Submit
C:\Windows\System\jTvkfmQ.exe

Filesize
2.2MB

MD5
9d3170ff6e89e0d2ba7739087bb3dd11

SHA1
da724ea690980a5831a6df3236d32cef015179b7

SHA256
d4c0e1fe4f65d227f364c902bfb5ffe73ab5ac53f5ee79a664d10bd40044ee65

SHA512
b291dff00d28f6e588c2af12a25d7bf86fac1532f08606c475f4fbe0819976bca7736a757d4a07ed44a57c954322e9674af1012fabbba19fad574a31394431cf

Download Submit
C:\Windows\System\jbxIjzV.exe

Filesize
2.2MB

MD5
7577e5fd1b8431f4c01abbc2e0790f2f

SHA1
19ff2e4fe07a838ddad0c3dd746a369274ddcda8

SHA256
c8201a03937b257f92871a498c780ff7423fd208af5a92795dd148c0a400cc5c

SHA512
431f56b7f2c186dd368c897b3d68461d9936858a60dbbad4185ccdb83f67152cab50ad4f6aa3ed904a7fc6284547f2563067933cf46e474de994caf5e1e5d669

Download Submit
C:\Windows\System\jtPhMUR.exe

Filesize
2.2MB

MD5
016de9c0d0fcfcf9a08fd30cff0b5a21

SHA1
a045c13438db55fdf7883195b0436e8ba1c6672d

SHA256
8f621e6cfc51bab9d5d46fd0dd33ea03101cbaa86649d795830d733f21c0417a

SHA512
733bf57050ba81dfdbb353ce15b162d2cc891a7f73a016bf7bd32836235126b710bc2e0008aced8064f2ac602e9d23479e0375ac7fae8c8fff56e293a4925858

Download Submit
C:\Windows\System\lNZjIAy.exe

Filesize
2.2MB

MD5
9ffca1538419b0d4bbd820381b7153a1

SHA1
f16bd9429fbcfe84b4713e849fae870f3fbe160f

SHA256
9bb66028ada53ea789255a68ef4afc3660bebda17e226077913f5168333df253

SHA512
04e614d870f5d1a9944bfca04ca9f6ad62b0df70edd08c31db04e5aade0146bfaeddb8afab4cc6affe4c4cce328f881bb0b7627776f63e55d82532026ab68633

Download Submit
C:\Windows\System\lYQVPEt.exe

Filesize
2.2MB

MD5
dd246597e54675398099b4c963c13d48

SHA1
955474e5eed637358081d9b4cfbf20f6787353ec

SHA256
9e9188647d89883e740487f73cc80217113b9c33be2f88e8162cd2514fcedf62

SHA512
851148fb18e22eaa65f6c9f9f943c8063215bcf2b29d58f6d6f84d7c3fae481f2bc86ee5c0b4661b1ca6567d30fda5f301873d390ef2d0d691ceb772d6c19f5d

Download Submit
C:\Windows\System\lZjvsaz.exe

Filesize
2.2MB

MD5
f33bb736c697d05763bed5edcf50f47a

SHA1
8da71833a5d5cb4024c72674c6e7167e34494177

SHA256
3e45028f43c3da788f8456242bd633f6e540dc78f430b2f8f72983d92ac1ab42

SHA512
56c0a4f16b5f6ed16d4811b54f5e8576c060b4e0112f5f6c34e4dd2eae62a3b9b9d15b52e808cacf811eb6d86f0271cb1ec0d392b863ed6009e48571bd9e6307

Download Submit
C:\Windows\System\ocFfxBQ.exe

Filesize
2.2MB

MD5
c8144925a3418ffd92000a933ed6a94b

SHA1
2bb6fae5450791831e5d8aad7dce39a092ba1f4d

SHA256
9fd3bf1d33fde6d7919300747e83e98d81aa0f088ba1ced59fe5b3c7940b0ff6

SHA512
42d12b9400bc232bccfd3a348f552ce5782826bfde18e512ab14a34ab993fd871ae6e03f6f192381c12016126097c1aeb0d17c5a304f87cd1fdf7ae69a68056f

Download Submit
C:\Windows\System\qbVTOHO.exe

Filesize
2.2MB

MD5
3164c9c82372af54a342765ace11fcd2

SHA1
5797de92cd6517f91edb4518529e8d8771680ea3

SHA256
f6fbc61e27db328c4efcb6154db6322b324f080b5bed99e19763e2efbbd295fa

SHA512
d92571c02d7978e7e9fcd92a6659b9df863d6c48c543e4de9d75e49c38c7b404053a348b1475e112c72bf2d1c1c461aabaccf8f87281a5adb02a2079c0bb6775

Download Submit
C:\Windows\System\rUtxIkt.exe

Filesize
2.2MB

MD5
cf80e393d37f05f123ba5266e958cd19

SHA1
baab967b9fb690d61465dea24bc4e1e9392aed19

SHA256
db5f0afeba36712dc97cdf05b17c841a4e9db52e44c3bc6dd97259b672e93dbe

SHA512
9b2085b6bc2c60ee3929382a52c27987b18619b3ebfe54f350a2d65c5bdcf1a4d6b1fb8e06ee88f3fe7651c3128ecb7a07803d8e0d59ce956d4ca6d4098b8929

Download Submit
C:\Windows\System\rnMyYHv.exe

Filesize
2.2MB

MD5
79f9320ce1e552df908799c22ed8d761

SHA1
467832fca7a4bed6c54f417c2168de1667b696fb

SHA256
26f9022291f20dc947ec14e121223d9dca6ee22ec55db1b9ad658103a7acbb35

SHA512
43d75568e12e674daf86eebc0fd00a949caa3ce32c7d6b305c4d4a375421e33843e005c767be202bd8ab34c398112ee426a926797fb1e4944393578d43bd0750

Download Submit
C:\Windows\System\sqRzxoA.exe

Filesize
2.2MB

MD5
3e3a12e167d5c5a7e1bb95cc2eabc09b

SHA1
5b4044a63c18d0f0b05b66cb203eae7c8e8ea5b9

SHA256
99e72fc224add30334937292cba8add5a47d748e2f9390f800778c3b3dd95ac6

SHA512
94a2149a82be32b03cb11cd97366c01bcd9785b3cd260650e8fd5b166f2e98f2acded8666b1980faf85b5b51572e1e412996aa4ff7128f91d5a8725e94bc3fd3

Download Submit
C:\Windows\System\vDXdDdS.exe

Filesize
2.2MB

MD5
aba50071afa7e66c7e6ba4193e3eae57

SHA1
128b09bcad816923a517719a95d1ecf3cc0304a7

SHA256
be1b992527a198e8c30ed604931b2e4a3167804f5f2131b7c1a4267011fc227c

SHA512
df5e2f0a06e15378b2a3b648407f469d90b24a40b525a7678939c6923b18f036c0bf5ead80de1aea57767d9f88869246b380dba40eb16f1c62ac75efa104ab95

Download Submit
C:\Windows\System\vwMOEvU.exe

Filesize
2.2MB

MD5
3131ac8d2f31f0bf0481858a0d36bbd3

SHA1
9595ae9f8cdaa37c85d1adb5a66b572b7b5f7fec

SHA256
85d6bd90e8126492d2849a305d104557e4aa719045eb80de3224a17fca7d2cd6

SHA512
cab89161ee238ea427300520efcd7f1501040f7323aca7a2ad3c2cd1fd889387573eedebf76265c1ed3248e0b69fe6dbe74dc82fe485105a0b2da1b7c20ce467

Download Submit
C:\Windows\System\ylGdiIL.exe

Filesize
2.2MB

MD5
0cea499d29da596d1f264cf24ca98a78

SHA1
9883e04eba14fe43296c2695c3c4162e5d245895

SHA256
ce09b0e95926c984b195e566c594c226b76192b218ab8fc3cbb24066d6acea4d

SHA512
d25b793f3f127d8b447b187dbefcb1d8cb1a0b5b65f1075b8778de088e1d88d0178d06c845b37ee20b3f1d1d0d4ab77351612f2cd5e21c3884eddccba811d7ed

Download Submit
C:\Windows\System\zGqofav.exe

Filesize
2.2MB

MD5
3011fc30f9433775cc1a0c6ad3e8498a

SHA1
da36b19f667520a8699dc8bd9c32c3d3fd0a5fdb

SHA256
02c7e3f06a31190c7647fa080096eba3895665ea0106148746f8e3e761131285

SHA512
314fe318a5cbbbbcfb48bcb4ef30ffc670640f611008dd6e8b9584a2dae554d591153a01e3d40facfcb3fbdf4741a7acf504a2e285ac2d29efb3b16796e516c9

Download Submit
C:\Windows\System\zyRxiLu.exe

Filesize
2.2MB

MD5
03f327f32339964bc3e7a05ee8ad508f

SHA1
d8f3e156c42d635a032b5ddc28e28b2fbed3656c

SHA256
3d977914c01afe07c2116253ae94c50a8968742406091712d861a68888dee65f

SHA512
8c3fd4db46acb3c8b052729fd84b0c2ad4f957fb7ad0fd9ab9744ce4a05f21bec81c5825660a32810bd963f72ced6676e58148ba27a0563f59dcf7938fd5bdd2

Download Submit
memory/540-2929-0x00007FF6CB940000-0x00007FF6CBD32000-memory.dmp

Filesize
3.9MB

Download
memory/540-235-0x00007FF6CB940000-0x00007FF6CBD32000-memory.dmp

Filesize
3.9MB

Download
memory/1096-142-0x00007FF60CEE0000-0x00007FF60D2D2000-memory.dmp

Filesize
3.9MB

Download
memory/1096-2914-0x00007FF60CEE0000-0x00007FF60D2D2000-memory.dmp

Filesize
3.9MB

Download
memory/1252-261-0x00007FF7F99B0000-0x00007FF7F9DA2000-memory.dmp

Filesize
3.9MB

Download
memory/1252-2927-0x00007FF7F99B0000-0x00007FF7F9DA2000-memory.dmp

Filesize
3.9MB

Download
memory/1264-2934-0x00007FF6B60B0000-0x00007FF6B64A2000-memory.dmp

Filesize
3.9MB

Download
memory/1264-164-0x00007FF6B60B0000-0x00007FF6B64A2000-memory.dmp

Filesize
3.9MB

Download
memory/1440-423-0x00007FF6125A0000-0x00007FF612992000-memory.dmp

Filesize
3.9MB

Download
memory/1440-2940-0x00007FF6125A0000-0x00007FF612992000-memory.dmp

Filesize
3.9MB

Download
memory/1572-2921-0x00007FF639520000-0x00007FF639912000-memory.dmp

Filesize
3.9MB

Download
memory/1572-361-0x00007FF639520000-0x00007FF639912000-memory.dmp

Filesize
3.9MB

Download
memory/1640-2905-0x00007FF6A30D0000-0x00007FF6A34C2000-memory.dmp

Filesize
3.9MB

Download
memory/1640-385-0x00007FF6A30D0000-0x00007FF6A34C2000-memory.dmp

Filesize
3.9MB

Download
memory/1792-0-0x00007FF7B11E0000-0x00007FF7B15D2000-memory.dmp

Filesize
3.9MB

Download
memory/1792-1-0x00000216D3550000-0x00000216D3560000-memory.dmp

Filesize
64KB

Download
memory/2000-226-0x00007FF6942B0000-0x00007FF6946A2000-memory.dmp

Filesize
3.9MB

Download
memory/2000-2915-0x00007FF6942B0000-0x00007FF6946A2000-memory.dmp

Filesize
3.9MB

Download
memory/2232-2911-0x00007FF658510000-0x00007FF658902000-memory.dmp

Filesize
3.9MB

Download
memory/2232-95-0x00007FF658510000-0x00007FF658902000-memory.dmp

Filesize
3.9MB

Download
memory/2824-323-0x00007FF626C40000-0x00007FF627032000-memory.dmp

Filesize
3.9MB

Download
memory/2824-2971-0x00007FF626C40000-0x00007FF627032000-memory.dmp

Filesize
3.9MB

Download
memory/3164-69-0x00007FF619130000-0x00007FF619522000-memory.dmp

Filesize
3.9MB

Download
memory/3164-2909-0x00007FF619130000-0x00007FF619522000-memory.dmp

Filesize
3.9MB

Download
memory/3172-39-0x0000017AD2810000-0x0000017AD2820000-memory.dmp

Filesize
64KB

Download
memory/3172-217-0x0000017AD2880000-0x0000017AD28A2000-memory.dmp

Filesize
136KB

Download
memory/3172-35-0x00007FFA4C570000-0x00007FFA4D031000-memory.dmp

Filesize
10.8MB

Download
memory/3260-53-0x00007FF7E8BC0000-0x00007FF7E8FB2000-memory.dmp

Filesize
3.9MB

Download
memory/3260-2907-0x00007FF7E8BC0000-0x00007FF7E8FB2000-memory.dmp

Filesize
3.9MB

Download
memory/3356-295-0x00007FF6667D0000-0x00007FF666BC2000-memory.dmp

Filesize
3.9MB

Download
memory/3356-2937-0x00007FF6667D0000-0x00007FF666BC2000-memory.dmp

Filesize
3.9MB

Download
memory/3388-2925-0x00007FF686F30000-0x00007FF687322000-memory.dmp

Filesize
3.9MB

Download
memory/3388-287-0x00007FF686F30000-0x00007FF687322000-memory.dmp

Filesize
3.9MB

Download
memory/3536-424-0x00007FF63BB10000-0x00007FF63BF02000-memory.dmp

Filesize
3.9MB

Download
memory/3536-2946-0x00007FF63BB10000-0x00007FF63BF02000-memory.dmp

Filesize
3.9MB

Download
memory/4280-2931-0x00007FF7B5240000-0x00007FF7B5632000-memory.dmp

Filesize
3.9MB

Download
memory/4280-418-0x00007FF7B5240000-0x00007FF7B5632000-memory.dmp

Filesize
3.9MB

Download
memory/4348-294-0x00007FF72A580000-0x00007FF72A972000-memory.dmp

Filesize
3.9MB

Download
memory/4348-2947-0x00007FF72A580000-0x00007FF72A972000-memory.dmp

Filesize
3.9MB

Download
memory/4704-2941-0x00007FF7CF4F0000-0x00007FF7CF8E2000-memory.dmp

Filesize
3.9MB

Download
memory/4704-205-0x00007FF7CF4F0000-0x00007FF7CF8E2000-memory.dmp

Filesize
3.9MB

Download
memory/4836-2923-0x00007FF7380F0000-0x00007FF7384E2000-memory.dmp

Filesize
3.9MB

Download
memory/4836-92-0x00007FF7380F0000-0x00007FF7384E2000-memory.dmp

Filesize
3.9MB

Download
memory/4856-2933-0x00007FF625FC0000-0x00007FF6263B2000-memory.dmp

Filesize
3.9MB

Download
memory/4856-386-0x00007FF625FC0000-0x00007FF6263B2000-memory.dmp

Filesize
3.9MB

Download
memory/5112-2917-0x00007FF6BEE20000-0x00007FF6BF212000-memory.dmp

Filesize
3.9MB

Download
memory/5112-225-0x00007FF6BEE20000-0x00007FF6BF212000-memory.dmp

Filesize
3.9MB

Download