xmrig | b68910d2154cb57d6a256e83fe15c3200e3b607cb3c4875f32fe3b869674c944

Analysis

max time kernel
66s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 16:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
Size

1.8MB
MD5

0812a5b9ea383074f62dabec74497b5e
SHA1

f8d5ff29a62f6e42f08fe5f44ac9cd12c082be64
SHA256

b68910d2154cb57d6a256e83fe15c3200e3b607cb3c4875f32fe3b869674c944
SHA512

c79a6c85082b24276cb8aa0bfa5e06f69c010412e9fd51ff6e6867fc5e81e4a425bff267b2c27028772bad5db60169ce3fc5b178f341cd0b750acb71e5c2ae1a
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYlZ3pBjqlx7TovQmVV4dThen9z1:Lz071uv4BPMkibTIA5lCx7kvRWa4puak

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 41 IoCs

miner

resource	yara_rule
behavioral2/memory/3012-243-0x00007FF65B560000-0x00007FF65B952000-memory.dmp	xmrig
behavioral2/memory/3852-242-0x00007FF785810000-0x00007FF785C02000-memory.dmp	xmrig
behavioral2/memory/3212-241-0x00007FF6BF4B0000-0x00007FF6BF8A2000-memory.dmp	xmrig
behavioral2/memory/2088-218-0x00007FF706B00000-0x00007FF706EF2000-memory.dmp	xmrig
behavioral2/memory/4836-169-0x00007FF68F900000-0x00007FF68FCF2000-memory.dmp	xmrig
behavioral2/memory/2504-292-0x00007FF714460000-0x00007FF714852000-memory.dmp	xmrig
behavioral2/memory/3664-463-0x00007FF6E2910000-0x00007FF6E2D02000-memory.dmp	xmrig
behavioral2/memory/2096-415-0x00007FF623240000-0x00007FF623632000-memory.dmp	xmrig
behavioral2/memory/2708-803-0x00007FF6C9020000-0x00007FF6C9412000-memory.dmp	xmrig
behavioral2/memory/1480-671-0x00007FF7563C0000-0x00007FF7567B2000-memory.dmp	xmrig
behavioral2/memory/4768-567-0x00007FF72B320000-0x00007FF72B712000-memory.dmp	xmrig
behavioral2/memory/4508-375-0x00007FF797FC0000-0x00007FF7983B2000-memory.dmp	xmrig
behavioral2/memory/3268-123-0x00007FF789320000-0x00007FF789712000-memory.dmp	xmrig
behavioral2/memory/1204-120-0x00007FF62E7F0000-0x00007FF62EBE2000-memory.dmp	xmrig
behavioral2/memory/2536-84-0x00007FF6535D0000-0x00007FF6539C2000-memory.dmp	xmrig
behavioral2/memory/1560-62-0x00007FF6235E0000-0x00007FF6239D2000-memory.dmp	xmrig
behavioral2/memory/1920-1986-0x00007FF6FFDB0000-0x00007FF7001A2000-memory.dmp	xmrig
behavioral2/memory/2932-1993-0x00007FF67E670000-0x00007FF67EA62000-memory.dmp	xmrig
behavioral2/memory/2176-2009-0x00007FF7884F0000-0x00007FF7888E2000-memory.dmp	xmrig
behavioral2/memory/516-1991-0x00007FF67F6A0000-0x00007FF67FA92000-memory.dmp	xmrig
behavioral2/memory/432-3102-0x00007FF670DA0000-0x00007FF671192000-memory.dmp	xmrig
behavioral2/memory/2708-3104-0x00007FF6C9020000-0x00007FF6C9412000-memory.dmp	xmrig
behavioral2/memory/1560-3106-0x00007FF6235E0000-0x00007FF6239D2000-memory.dmp	xmrig
behavioral2/memory/2536-3118-0x00007FF6535D0000-0x00007FF6539C2000-memory.dmp	xmrig
behavioral2/memory/4836-3117-0x00007FF68F900000-0x00007FF68FCF2000-memory.dmp	xmrig
behavioral2/memory/3268-3113-0x00007FF789320000-0x00007FF789712000-memory.dmp	xmrig
behavioral2/memory/3852-3111-0x00007FF785810000-0x00007FF785C02000-memory.dmp	xmrig
behavioral2/memory/1204-3115-0x00007FF62E7F0000-0x00007FF62EBE2000-memory.dmp	xmrig
behavioral2/memory/1920-3109-0x00007FF6FFDB0000-0x00007FF7001A2000-memory.dmp	xmrig
behavioral2/memory/2176-3134-0x00007FF7884F0000-0x00007FF7888E2000-memory.dmp	xmrig
behavioral2/memory/1480-3133-0x00007FF7563C0000-0x00007FF7567B2000-memory.dmp	xmrig
behavioral2/memory/2504-3131-0x00007FF714460000-0x00007FF714852000-memory.dmp	xmrig
behavioral2/memory/4768-3122-0x00007FF72B320000-0x00007FF72B712000-memory.dmp	xmrig
behavioral2/memory/2096-3121-0x00007FF623240000-0x00007FF623632000-memory.dmp	xmrig
behavioral2/memory/3012-3136-0x00007FF65B560000-0x00007FF65B952000-memory.dmp	xmrig
behavioral2/memory/2932-3129-0x00007FF67E670000-0x00007FF67EA62000-memory.dmp	xmrig
behavioral2/memory/4508-3141-0x00007FF797FC0000-0x00007FF7983B2000-memory.dmp	xmrig
behavioral2/memory/2088-3146-0x00007FF706B00000-0x00007FF706EF2000-memory.dmp	xmrig
behavioral2/memory/3212-3144-0x00007FF6BF4B0000-0x00007FF6BF8A2000-memory.dmp	xmrig
behavioral2/memory/516-3150-0x00007FF67F6A0000-0x00007FF67FA92000-memory.dmp	xmrig
behavioral2/memory/3664-3152-0x00007FF6E2910000-0x00007FF6E2D02000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
432	oMNBpDH.exe
2708	uewYIGI.exe
1560	kEWbIWh.exe
2536	PmrLDdD.exe
1204	bnMeLrI.exe
3268	qqmiGfx.exe
4836	GcpXVwp.exe
1920	VOuJVSo.exe
2088	YeVtfiO.exe
3212	xPxEOXp.exe
3852	EfLlxOF.exe
516	jGAJIBT.exe
3012	AMTHwXn.exe
2504	JhzQBLF.exe
4508	hYdDhBE.exe
2096	NPohBUX.exe
3664	bFuDOhh.exe
2932	lYVzUMT.exe
2176	qsJQabJ.exe
4768	SncJdqb.exe
1480	yvMILIO.exe
2752	tCGCELb.exe
856	McxBXdZ.exe
1816	hRRcxnZ.exe
3712	QOEaoND.exe
1520	KbPSZrt.exe
4544	yJeyCgU.exe
4032	JSzIrYn.exe
3632	xugoVis.exe
1720	ekdLpMG.exe
980	obbEKjf.exe
2812	uZCaNcL.exe
4104	argOLmv.exe
3228	jZZQPRp.exe
3728	XVBPhMf.exe
3080	TzOgfHn.exe
4756	sTIhded.exe
2532	MYyWSjM.exe
1608	znJbXWc.exe
2688	AVoWlZj.exe
1648	fptptCx.exe
3932	FhzkmNe.exe
3976	wTFAAkx.exe
4708	cbOSpvm.exe
456	VcUKbcJ.exe
2528	lglMkEI.exe
2888	RqGqUWj.exe
2336	kKQtUKm.exe
4072	IudlwkP.exe
5056	dKFChQh.exe
2748	OoVICER.exe
4440	CckxLya.exe
4576	OUPthTC.exe
4884	LZeLRtv.exe
3968	aJfsHuP.exe
2208	iENjYfu.exe
4064	Otuafkc.exe
4092	pTXQFOK.exe
1332	dGCUeuv.exe
2824	AdfOpty.exe
1180	UbCSbuZ.exe
3136	gSvoqgi.exe
4860	pqqyHHO.exe
5048	BeQQhMb.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4516-0-0x00007FF7B6D10000-0x00007FF7B7102000-memory.dmp	upx
behavioral2/files/0x000a000000023b97-7.dat	upx
behavioral2/files/0x000b000000023b95-5.dat	upx
behavioral2/files/0x000a000000023b96-12.dat	upx
behavioral2/files/0x000a000000023b9b-32.dat	upx
behavioral2/files/0x000a000000023ba0-88.dat	upx
behavioral2/files/0x000a000000023bac-116.dat	upx
behavioral2/files/0x000a000000023bb4-155.dat	upx
behavioral2/files/0x000a000000023bb9-185.dat	upx
behavioral2/files/0x000a000000023ba5-183.dat	upx
behavioral2/files/0x000a000000023bb3-151.dat	upx
behavioral2/files/0x000a000000023bab-146.dat	upx
behavioral2/files/0x000a000000023bad-172.dat	upx
behavioral2/files/0x000a000000023bb0-144.dat	upx
behavioral2/files/0x000a000000023ba3-141.dat	upx
behavioral2/files/0x000a000000023ba7-139.dat	upx
behavioral2/files/0x000a000000023ba2-134.dat	upx
behavioral2/files/0x000a000000023baa-130.dat	upx
behavioral2/files/0x000a000000023baf-129.dat	upx
behavioral2/files/0x000a000000023bae-128.dat	upx
behavioral2/memory/3012-243-0x00007FF65B560000-0x00007FF65B952000-memory.dmp	upx
behavioral2/memory/3852-242-0x00007FF785810000-0x00007FF785C02000-memory.dmp	upx
behavioral2/memory/3212-241-0x00007FF6BF4B0000-0x00007FF6BF8A2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba9-180.dat	upx
behavioral2/files/0x000a000000023bb2-179.dat	upx
behavioral2/files/0x000b000000023b93-178.dat	upx
behavioral2/files/0x0031000000023bb8-176.dat	upx
behavioral2/memory/2088-218-0x00007FF706B00000-0x00007FF706EF2000-memory.dmp	upx
behavioral2/memory/4836-169-0x00007FF68F900000-0x00007FF68FCF2000-memory.dmp	upx
behavioral2/memory/2504-292-0x00007FF714460000-0x00007FF714852000-memory.dmp	upx
behavioral2/memory/3664-463-0x00007FF6E2910000-0x00007FF6E2D02000-memory.dmp	upx
behavioral2/memory/2096-415-0x00007FF623240000-0x00007FF623632000-memory.dmp	upx
behavioral2/memory/2708-803-0x00007FF6C9020000-0x00007FF6C9412000-memory.dmp	upx
behavioral2/memory/1480-671-0x00007FF7563C0000-0x00007FF7567B2000-memory.dmp	upx
behavioral2/memory/4768-567-0x00007FF72B320000-0x00007FF72B712000-memory.dmp	upx
behavioral2/memory/4508-375-0x00007FF797FC0000-0x00007FF7983B2000-memory.dmp	upx
behavioral2/files/0x0031000000023bb6-159.dat	upx
behavioral2/files/0x000a000000023bb5-158.dat	upx
behavioral2/files/0x000a000000023ba8-125.dat	upx
behavioral2/memory/3268-123-0x00007FF789320000-0x00007FF789712000-memory.dmp	upx
behavioral2/memory/1204-120-0x00007FF62E7F0000-0x00007FF62EBE2000-memory.dmp	upx
behavioral2/files/0x000a000000023bb1-145.dat	upx
behavioral2/files/0x000a000000023ba4-112.dat	upx
behavioral2/files/0x000a000000023ba6-108.dat	upx
behavioral2/files/0x000a000000023b9f-99.dat	upx
behavioral2/files/0x000a000000023b9e-97.dat	upx
behavioral2/memory/2536-84-0x00007FF6535D0000-0x00007FF6539C2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba1-83.dat	upx
behavioral2/files/0x000a000000023b9d-66.dat	upx
behavioral2/memory/1560-62-0x00007FF6235E0000-0x00007FF6239D2000-memory.dmp	upx
behavioral2/files/0x000a000000023b9c-57.dat	upx
behavioral2/files/0x000a000000023b99-41.dat	upx
behavioral2/files/0x000a000000023b9a-37.dat	upx
behavioral2/files/0x000a000000023b98-38.dat	upx
behavioral2/memory/432-11-0x00007FF670DA0000-0x00007FF671192000-memory.dmp	upx
behavioral2/memory/1920-1986-0x00007FF6FFDB0000-0x00007FF7001A2000-memory.dmp	upx
behavioral2/memory/2932-1993-0x00007FF67E670000-0x00007FF67EA62000-memory.dmp	upx
behavioral2/memory/2176-2009-0x00007FF7884F0000-0x00007FF7888E2000-memory.dmp	upx
behavioral2/memory/516-1991-0x00007FF67F6A0000-0x00007FF67FA92000-memory.dmp	upx
behavioral2/memory/432-3102-0x00007FF670DA0000-0x00007FF671192000-memory.dmp	upx
behavioral2/memory/2708-3104-0x00007FF6C9020000-0x00007FF6C9412000-memory.dmp	upx
behavioral2/memory/1560-3106-0x00007FF6235E0000-0x00007FF6239D2000-memory.dmp	upx
behavioral2/memory/2536-3118-0x00007FF6535D0000-0x00007FF6539C2000-memory.dmp	upx
behavioral2/memory/4836-3117-0x00007FF68F900000-0x00007FF68FCF2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\YOVQgcJ.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\UHaEsOH.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\FuGtcWm.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\zVTafqu.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\lOtuUCC.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\mxcFzwH.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\KXdWvYT.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\bHqGLkg.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\YOnGJZk.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\vCeVfuC.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\ftoLukh.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\jqprSxq.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\dmAfgmT.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\RevsghL.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\GBZUwVm.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\odonLaW.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\NWvsJSi.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\oNTKwwV.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\JhzQBLF.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\TGFYfjU.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\kyqqGDc.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\gwWtAdY.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\uhWGZfV.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\KxalBoO.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\Siagiin.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\uLhthUg.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\GCjMhUN.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\knECeDv.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\nynSPAb.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\UBJSfaX.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\DiYHjxw.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\ptbqOGK.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\voJEUdX.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\Msrhifb.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\WkPxHoZ.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\BlfYjDC.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\yWjTfxz.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\eQAUMdv.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\lwQTlNa.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\iFnmFqJ.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\xclYqSA.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\mHAKSun.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\AWUBrMo.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\wRIbaVe.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\gCGyOzP.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\DZPhFHB.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\jHriCqb.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\EKDRImW.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\HQXsdBF.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\UVfTpxb.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\iENjYfu.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\tNPNfHQ.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\vsUbRFR.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\qrSTaip.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\cLLpxEY.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\cVSrzSb.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\BYxqmBh.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\JWNLqZI.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\UKgSJfC.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\sYEsxiM.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\JcGjDBj.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\PmTbVsI.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\bEPEqkK.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
File created	C:\Windows\System\NMZvCMb.exe	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1188	powershell.exe
1188	powershell.exe
1188	powershell.exe
1188	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
Token: SeDebugPrivilege	1188	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 1188	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	84
PID 4516 wrote to memory of 1188	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	84
PID 4516 wrote to memory of 432	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	85
PID 4516 wrote to memory of 432	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	85
PID 4516 wrote to memory of 2708	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	86
PID 4516 wrote to memory of 2708	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	86
PID 4516 wrote to memory of 1560	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	87
PID 4516 wrote to memory of 1560	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	87
PID 4516 wrote to memory of 2536	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	88
PID 4516 wrote to memory of 2536	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	88
PID 4516 wrote to memory of 1204	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	89
PID 4516 wrote to memory of 1204	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	89
PID 4516 wrote to memory of 3268	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	90
PID 4516 wrote to memory of 3268	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	90
PID 4516 wrote to memory of 4836	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	91
PID 4516 wrote to memory of 4836	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	91
PID 4516 wrote to memory of 3852	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	92
PID 4516 wrote to memory of 3852	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	92
PID 4516 wrote to memory of 1920	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	93
PID 4516 wrote to memory of 1920	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	93
PID 4516 wrote to memory of 2088	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	94
PID 4516 wrote to memory of 2088	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	94
PID 4516 wrote to memory of 3212	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	95
PID 4516 wrote to memory of 3212	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	95
PID 4516 wrote to memory of 516	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	96
PID 4516 wrote to memory of 516	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	96
PID 4516 wrote to memory of 3012	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	97
PID 4516 wrote to memory of 3012	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	97
PID 4516 wrote to memory of 2504	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	98
PID 4516 wrote to memory of 2504	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	98
PID 4516 wrote to memory of 4508	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	99
PID 4516 wrote to memory of 4508	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	99
PID 4516 wrote to memory of 2096	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	100
PID 4516 wrote to memory of 2096	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	100
PID 4516 wrote to memory of 3664	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	101
PID 4516 wrote to memory of 3664	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	101
PID 4516 wrote to memory of 2752	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	102
PID 4516 wrote to memory of 2752	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	102
PID 4516 wrote to memory of 2932	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	103
PID 4516 wrote to memory of 2932	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	103
PID 4516 wrote to memory of 2176	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	104
PID 4516 wrote to memory of 2176	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	104
PID 4516 wrote to memory of 4768	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	105
PID 4516 wrote to memory of 4768	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	105
PID 4516 wrote to memory of 1480	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	106
PID 4516 wrote to memory of 1480	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	106
PID 4516 wrote to memory of 856	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	107
PID 4516 wrote to memory of 856	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	107
PID 4516 wrote to memory of 1816	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	108
PID 4516 wrote to memory of 1816	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	108
PID 4516 wrote to memory of 3712	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	109
PID 4516 wrote to memory of 3712	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	109
PID 4516 wrote to memory of 1520	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	110
PID 4516 wrote to memory of 1520	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	110
PID 4516 wrote to memory of 4544	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	111
PID 4516 wrote to memory of 4544	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	111
PID 4516 wrote to memory of 4032	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	112
PID 4516 wrote to memory of 4032	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	112
PID 4516 wrote to memory of 3632	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	113
PID 4516 wrote to memory of 3632	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	113
PID 4516 wrote to memory of 3080	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	114
PID 4516 wrote to memory of 3080	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	114
PID 4516 wrote to memory of 1720	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	115
PID 4516 wrote to memory of 1720	4516	0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0812a5b9ea383074f62dabec74497b5e_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1188
- C:\Windows\System\oMNBpDH.exe
  C:\Windows\System\oMNBpDH.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\uewYIGI.exe
  C:\Windows\System\uewYIGI.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\kEWbIWh.exe
  C:\Windows\System\kEWbIWh.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\PmrLDdD.exe
  C:\Windows\System\PmrLDdD.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\bnMeLrI.exe
  C:\Windows\System\bnMeLrI.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\qqmiGfx.exe
  C:\Windows\System\qqmiGfx.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\GcpXVwp.exe
  C:\Windows\System\GcpXVwp.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\EfLlxOF.exe
  C:\Windows\System\EfLlxOF.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\VOuJVSo.exe
  C:\Windows\System\VOuJVSo.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\YeVtfiO.exe
  C:\Windows\System\YeVtfiO.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\xPxEOXp.exe
  C:\Windows\System\xPxEOXp.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\jGAJIBT.exe
  C:\Windows\System\jGAJIBT.exe
  2⤵
  - Executes dropped EXE
  PID:516
- C:\Windows\System\AMTHwXn.exe
  C:\Windows\System\AMTHwXn.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\JhzQBLF.exe
  C:\Windows\System\JhzQBLF.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\hYdDhBE.exe
  C:\Windows\System\hYdDhBE.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\NPohBUX.exe
  C:\Windows\System\NPohBUX.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\bFuDOhh.exe
  C:\Windows\System\bFuDOhh.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\tCGCELb.exe
  C:\Windows\System\tCGCELb.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\lYVzUMT.exe
  C:\Windows\System\lYVzUMT.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\qsJQabJ.exe
  C:\Windows\System\qsJQabJ.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\SncJdqb.exe
  C:\Windows\System\SncJdqb.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\yvMILIO.exe
  C:\Windows\System\yvMILIO.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\McxBXdZ.exe
  C:\Windows\System\McxBXdZ.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\hRRcxnZ.exe
  C:\Windows\System\hRRcxnZ.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\QOEaoND.exe
  C:\Windows\System\QOEaoND.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\KbPSZrt.exe
  C:\Windows\System\KbPSZrt.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\yJeyCgU.exe
  C:\Windows\System\yJeyCgU.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\JSzIrYn.exe
  C:\Windows\System\JSzIrYn.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\xugoVis.exe
  C:\Windows\System\xugoVis.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\TzOgfHn.exe
  C:\Windows\System\TzOgfHn.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\ekdLpMG.exe
  C:\Windows\System\ekdLpMG.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\obbEKjf.exe
  C:\Windows\System\obbEKjf.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\uZCaNcL.exe
  C:\Windows\System\uZCaNcL.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\argOLmv.exe
  C:\Windows\System\argOLmv.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\fptptCx.exe
  C:\Windows\System\fptptCx.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\jZZQPRp.exe
  C:\Windows\System\jZZQPRp.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\XVBPhMf.exe
  C:\Windows\System\XVBPhMf.exe
  2⤵
  - Executes dropped EXE
  PID:3728
- C:\Windows\System\sTIhded.exe
  C:\Windows\System\sTIhded.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\MYyWSjM.exe
  C:\Windows\System\MYyWSjM.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\znJbXWc.exe
  C:\Windows\System\znJbXWc.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\AVoWlZj.exe
  C:\Windows\System\AVoWlZj.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\FhzkmNe.exe
  C:\Windows\System\FhzkmNe.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\dKFChQh.exe
  C:\Windows\System\dKFChQh.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\wTFAAkx.exe
  C:\Windows\System\wTFAAkx.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\cbOSpvm.exe
  C:\Windows\System\cbOSpvm.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\VcUKbcJ.exe
  C:\Windows\System\VcUKbcJ.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\lglMkEI.exe
  C:\Windows\System\lglMkEI.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\RqGqUWj.exe
  C:\Windows\System\RqGqUWj.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\kKQtUKm.exe
  C:\Windows\System\kKQtUKm.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\UbCSbuZ.exe
  C:\Windows\System\UbCSbuZ.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\IudlwkP.exe
  C:\Windows\System\IudlwkP.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\OoVICER.exe
  C:\Windows\System\OoVICER.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\CckxLya.exe
  C:\Windows\System\CckxLya.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\OUPthTC.exe
  C:\Windows\System\OUPthTC.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\LZeLRtv.exe
  C:\Windows\System\LZeLRtv.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\aJfsHuP.exe
  C:\Windows\System\aJfsHuP.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\iENjYfu.exe
  C:\Windows\System\iENjYfu.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\Otuafkc.exe
  C:\Windows\System\Otuafkc.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\pTXQFOK.exe
  C:\Windows\System\pTXQFOK.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\dGCUeuv.exe
  C:\Windows\System\dGCUeuv.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\AdfOpty.exe
  C:\Windows\System\AdfOpty.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\gSvoqgi.exe
  C:\Windows\System\gSvoqgi.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\pqqyHHO.exe
  C:\Windows\System\pqqyHHO.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\BeQQhMb.exe
  C:\Windows\System\BeQQhMb.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\uccjXGF.exe
  C:\Windows\System\uccjXGF.exe
  2⤵
  PID:5068
- C:\Windows\System\VxNndFY.exe
  C:\Windows\System\VxNndFY.exe
  2⤵
  PID:884
- C:\Windows\System\ROSSwej.exe
  C:\Windows\System\ROSSwej.exe
  2⤵
  PID:464
- C:\Windows\System\CVAGFfS.exe
  C:\Windows\System\CVAGFfS.exe
  2⤵
  PID:4156
- C:\Windows\System\wmMyBYL.exe
  C:\Windows\System\wmMyBYL.exe
  2⤵
  PID:3984
- C:\Windows\System\wpbtzSD.exe
  C:\Windows\System\wpbtzSD.exe
  2⤵
  PID:2044
- C:\Windows\System\TJCdwGY.exe
  C:\Windows\System\TJCdwGY.exe
  2⤵
  PID:4788
- C:\Windows\System\mtKVrUM.exe
  C:\Windows\System\mtKVrUM.exe
  2⤵
  PID:1468
- C:\Windows\System\yXArZic.exe
  C:\Windows\System\yXArZic.exe
  2⤵
  PID:2948
- C:\Windows\System\uaPWAha.exe
  C:\Windows\System\uaPWAha.exe
  2⤵
  PID:1280
- C:\Windows\System\WdJtKnG.exe
  C:\Windows\System\WdJtKnG.exe
  2⤵
  PID:1472
- C:\Windows\System\xuqPGPd.exe
  C:\Windows\System\xuqPGPd.exe
  2⤵
  PID:4988
- C:\Windows\System\HryQKas.exe
  C:\Windows\System\HryQKas.exe
  2⤵
  PID:3412
- C:\Windows\System\sNOOQas.exe
  C:\Windows\System\sNOOQas.exe
  2⤵
  PID:4436
- C:\Windows\System\yNMwUmj.exe
  C:\Windows\System\yNMwUmj.exe
  2⤵
  PID:4420
- C:\Windows\System\UUwYZTu.exe
  C:\Windows\System\UUwYZTu.exe
  2⤵
  PID:3116
- C:\Windows\System\RsGWbGu.exe
  C:\Windows\System\RsGWbGu.exe
  2⤵
  PID:264
- C:\Windows\System\bnZAynT.exe
  C:\Windows\System\bnZAynT.exe
  2⤵
  PID:4464
- C:\Windows\System\ryaAWOL.exe
  C:\Windows\System\ryaAWOL.exe
  2⤵
  PID:4232
- C:\Windows\System\BYxqmBh.exe
  C:\Windows\System\BYxqmBh.exe
  2⤵
  PID:5064
- C:\Windows\System\pjyMibg.exe
  C:\Windows\System\pjyMibg.exe
  2⤵
  PID:5028
- C:\Windows\System\CFiQUxb.exe
  C:\Windows\System\CFiQUxb.exe
  2⤵
  PID:548
- C:\Windows\System\FKNajSf.exe
  C:\Windows\System\FKNajSf.exe
  2⤵
  PID:1768
- C:\Windows\System\GpyADhX.exe
  C:\Windows\System\GpyADhX.exe
  2⤵
  PID:3708
- C:\Windows\System\JkVLZcy.exe
  C:\Windows\System\JkVLZcy.exe
  2⤵
  PID:4572
- C:\Windows\System\fqlgObl.exe
  C:\Windows\System\fqlgObl.exe
  2⤵
  PID:1324
- C:\Windows\System\viGXXJs.exe
  C:\Windows\System\viGXXJs.exe
  2⤵
  PID:2036
- C:\Windows\System\nigxNyF.exe
  C:\Windows\System\nigxNyF.exe
  2⤵
  PID:2020
- C:\Windows\System\DbWlXBM.exe
  C:\Windows\System\DbWlXBM.exe
  2⤵
  PID:2652
- C:\Windows\System\inVNKZh.exe
  C:\Windows\System\inVNKZh.exe
  2⤵
  PID:3736
- C:\Windows\System\alJScfE.exe
  C:\Windows\System\alJScfE.exe
  2⤵
  PID:5128
- C:\Windows\System\LNBahOY.exe
  C:\Windows\System\LNBahOY.exe
  2⤵
  PID:5164
- C:\Windows\System\VWSgjtU.exe
  C:\Windows\System\VWSgjtU.exe
  2⤵
  PID:5180
- C:\Windows\System\GcvveMb.exe
  C:\Windows\System\GcvveMb.exe
  2⤵
  PID:5208
- C:\Windows\System\RAxvXlQ.exe
  C:\Windows\System\RAxvXlQ.exe
  2⤵
  PID:5244
- C:\Windows\System\qgjAttA.exe
  C:\Windows\System\qgjAttA.exe
  2⤵
  PID:5260
- C:\Windows\System\iszPjKV.exe
  C:\Windows\System\iszPjKV.exe
  2⤵
  PID:5296
- C:\Windows\System\JeuRTzm.exe
  C:\Windows\System\JeuRTzm.exe
  2⤵
  PID:5316
- C:\Windows\System\zcbYkBB.exe
  C:\Windows\System\zcbYkBB.exe
  2⤵
  PID:5344
- C:\Windows\System\OLzBbjk.exe
  C:\Windows\System\OLzBbjk.exe
  2⤵
  PID:5368
- C:\Windows\System\rFXjIIQ.exe
  C:\Windows\System\rFXjIIQ.exe
  2⤵
  PID:5400
- C:\Windows\System\lxGMCVt.exe
  C:\Windows\System\lxGMCVt.exe
  2⤵
  PID:5440
- C:\Windows\System\ZsafRoE.exe
  C:\Windows\System\ZsafRoE.exe
  2⤵
  PID:5456
- C:\Windows\System\QWvmpSh.exe
  C:\Windows\System\QWvmpSh.exe
  2⤵
  PID:5472
- C:\Windows\System\wTQktRz.exe
  C:\Windows\System\wTQktRz.exe
  2⤵
  PID:5488
- C:\Windows\System\eiLvNbK.exe
  C:\Windows\System\eiLvNbK.exe
  2⤵
  PID:5508
- C:\Windows\System\WmiOBHS.exe
  C:\Windows\System\WmiOBHS.exe
  2⤵
  PID:5524
- C:\Windows\System\PnIOnGk.exe
  C:\Windows\System\PnIOnGk.exe
  2⤵
  PID:5544
- C:\Windows\System\dineSId.exe
  C:\Windows\System\dineSId.exe
  2⤵
  PID:5568
- C:\Windows\System\ftoLukh.exe
  C:\Windows\System\ftoLukh.exe
  2⤵
  PID:5588
- C:\Windows\System\jNyVINn.exe
  C:\Windows\System\jNyVINn.exe
  2⤵
  PID:5612
- C:\Windows\System\lJMXWEw.exe
  C:\Windows\System\lJMXWEw.exe
  2⤵
  PID:5636
- C:\Windows\System\HQHcJXW.exe
  C:\Windows\System\HQHcJXW.exe
  2⤵
  PID:5660
- C:\Windows\System\mHAKSun.exe
  C:\Windows\System\mHAKSun.exe
  2⤵
  PID:5676
- C:\Windows\System\JyCnURr.exe
  C:\Windows\System\JyCnURr.exe
  2⤵
  PID:5704
- C:\Windows\System\MurCqri.exe
  C:\Windows\System\MurCqri.exe
  2⤵
  PID:5720
- C:\Windows\System\JcGjDBj.exe
  C:\Windows\System\JcGjDBj.exe
  2⤵
  PID:5740
- C:\Windows\System\WLRYMZv.exe
  C:\Windows\System\WLRYMZv.exe
  2⤵
  PID:5764
- C:\Windows\System\JTwCGYx.exe
  C:\Windows\System\JTwCGYx.exe
  2⤵
  PID:5784
- C:\Windows\System\BlfYjDC.exe
  C:\Windows\System\BlfYjDC.exe
  2⤵
  PID:5804
- C:\Windows\System\XrkQZjO.exe
  C:\Windows\System\XrkQZjO.exe
  2⤵
  PID:5824
- C:\Windows\System\gsWkEeu.exe
  C:\Windows\System\gsWkEeu.exe
  2⤵
  PID:5844
- C:\Windows\System\JzRyfnv.exe
  C:\Windows\System\JzRyfnv.exe
  2⤵
  PID:5864
- C:\Windows\System\mzTDDjq.exe
  C:\Windows\System\mzTDDjq.exe
  2⤵
  PID:5884
- C:\Windows\System\JyTuCUR.exe
  C:\Windows\System\JyTuCUR.exe
  2⤵
  PID:5900
- C:\Windows\System\NvPqeVR.exe
  C:\Windows\System\NvPqeVR.exe
  2⤵
  PID:5920
- C:\Windows\System\vHNOYfr.exe
  C:\Windows\System\vHNOYfr.exe
  2⤵
  PID:5940
- C:\Windows\System\YmZeMML.exe
  C:\Windows\System\YmZeMML.exe
  2⤵
  PID:5960
- C:\Windows\System\SRHmfag.exe
  C:\Windows\System\SRHmfag.exe
  2⤵
  PID:5980
- C:\Windows\System\pZvqqZE.exe
  C:\Windows\System\pZvqqZE.exe
  2⤵
  PID:6004
- C:\Windows\System\ItDaBgy.exe
  C:\Windows\System\ItDaBgy.exe
  2⤵
  PID:6024
- C:\Windows\System\tPrRkLs.exe
  C:\Windows\System\tPrRkLs.exe
  2⤵
  PID:6048
- C:\Windows\System\zuDczBv.exe
  C:\Windows\System\zuDczBv.exe
  2⤵
  PID:6072
- C:\Windows\System\dZESHNf.exe
  C:\Windows\System\dZESHNf.exe
  2⤵
  PID:6088
- C:\Windows\System\knECeDv.exe
  C:\Windows\System\knECeDv.exe
  2⤵
  PID:6104
- C:\Windows\System\wzQQNQK.exe
  C:\Windows\System\wzQQNQK.exe
  2⤵
  PID:6132
- C:\Windows\System\sUfUjXh.exe
  C:\Windows\System\sUfUjXh.exe
  2⤵
  PID:336
- C:\Windows\System\WNCGQRW.exe
  C:\Windows\System\WNCGQRW.exe
  2⤵
  PID:1620
- C:\Windows\System\CITzyil.exe
  C:\Windows\System\CITzyil.exe
  2⤵
  PID:3312
- C:\Windows\System\CfLvpca.exe
  C:\Windows\System\CfLvpca.exe
  2⤵
  PID:1792
- C:\Windows\System\ikfXSqd.exe
  C:\Windows\System\ikfXSqd.exe
  2⤵
  PID:3348
- C:\Windows\System\HXbTzbX.exe
  C:\Windows\System\HXbTzbX.exe
  2⤵
  PID:5148
- C:\Windows\System\vntujpH.exe
  C:\Windows\System\vntujpH.exe
  2⤵
  PID:208
- C:\Windows\System\xuKiaCr.exe
  C:\Windows\System\xuKiaCr.exe
  2⤵
  PID:3468
- C:\Windows\System\JGbsHMX.exe
  C:\Windows\System\JGbsHMX.exe
  2⤵
  PID:1192
- C:\Windows\System\yJBSCKW.exe
  C:\Windows\System\yJBSCKW.exe
  2⤵
  PID:1216
- C:\Windows\System\FRWhMmp.exe
  C:\Windows\System\FRWhMmp.exe
  2⤵
  PID:404
- C:\Windows\System\RQqkYQO.exe
  C:\Windows\System\RQqkYQO.exe
  2⤵
  PID:5556
- C:\Windows\System\yuPyXdF.exe
  C:\Windows\System\yuPyXdF.exe
  2⤵
  PID:5188
- C:\Windows\System\HPmlDlC.exe
  C:\Windows\System\HPmlDlC.exe
  2⤵
  PID:5228
- C:\Windows\System\yGclwDR.exe
  C:\Windows\System\yGclwDR.exe
  2⤵
  PID:5360
- C:\Windows\System\lblFxOG.exe
  C:\Windows\System\lblFxOG.exe
  2⤵
  PID:5356
- C:\Windows\System\QCSVYuY.exe
  C:\Windows\System\QCSVYuY.exe
  2⤵
  PID:5776
- C:\Windows\System\IbbsTCz.exe
  C:\Windows\System\IbbsTCz.exe
  2⤵
  PID:5484
- C:\Windows\System\qXvmFxI.exe
  C:\Windows\System\qXvmFxI.exe
  2⤵
  PID:4944
- C:\Windows\System\KpWdwOC.exe
  C:\Windows\System\KpWdwOC.exe
  2⤵
  PID:1780
- C:\Windows\System\Twwpwxf.exe
  C:\Windows\System\Twwpwxf.exe
  2⤵
  PID:4212
- C:\Windows\System\bAFYlbE.exe
  C:\Windows\System\bAFYlbE.exe
  2⤵
  PID:5948
- C:\Windows\System\AvDwoQz.exe
  C:\Windows\System\AvDwoQz.exe
  2⤵
  PID:6160
- C:\Windows\System\EpzOusB.exe
  C:\Windows\System\EpzOusB.exe
  2⤵
  PID:6180
- C:\Windows\System\PmTbVsI.exe
  C:\Windows\System\PmTbVsI.exe
  2⤵
  PID:6204
- C:\Windows\System\mHKvvor.exe
  C:\Windows\System\mHKvvor.exe
  2⤵
  PID:6220
- C:\Windows\System\xiwPAKE.exe
  C:\Windows\System\xiwPAKE.exe
  2⤵
  PID:6244
- C:\Windows\System\KyXbaNE.exe
  C:\Windows\System\KyXbaNE.exe
  2⤵
  PID:6268
- C:\Windows\System\JCiaRPA.exe
  C:\Windows\System\JCiaRPA.exe
  2⤵
  PID:6288
- C:\Windows\System\PPlBtJE.exe
  C:\Windows\System\PPlBtJE.exe
  2⤵
  PID:6308
- C:\Windows\System\SBOndhX.exe
  C:\Windows\System\SBOndhX.exe
  2⤵
  PID:6332
- C:\Windows\System\EuFqXnc.exe
  C:\Windows\System\EuFqXnc.exe
  2⤵
  PID:6352
- C:\Windows\System\KaADMoJ.exe
  C:\Windows\System\KaADMoJ.exe
  2⤵
  PID:6368
- C:\Windows\System\aJXrIld.exe
  C:\Windows\System\aJXrIld.exe
  2⤵
  PID:6396
- C:\Windows\System\ThbqfFL.exe
  C:\Windows\System\ThbqfFL.exe
  2⤵
  PID:6412
- C:\Windows\System\nektbHC.exe
  C:\Windows\System\nektbHC.exe
  2⤵
  PID:6436
- C:\Windows\System\SLfEqCw.exe
  C:\Windows\System\SLfEqCw.exe
  2⤵
  PID:6460
- C:\Windows\System\MTNkZwV.exe
  C:\Windows\System\MTNkZwV.exe
  2⤵
  PID:6476
- C:\Windows\System\ovVQsjs.exe
  C:\Windows\System\ovVQsjs.exe
  2⤵
  PID:6496
- C:\Windows\System\UHYYfei.exe
  C:\Windows\System\UHYYfei.exe
  2⤵
  PID:6520
- C:\Windows\System\nbBbmxb.exe
  C:\Windows\System\nbBbmxb.exe
  2⤵
  PID:6544
- C:\Windows\System\ivlNORB.exe
  C:\Windows\System\ivlNORB.exe
  2⤵
  PID:6568
- C:\Windows\System\YcftEFp.exe
  C:\Windows\System\YcftEFp.exe
  2⤵
  PID:6584
- C:\Windows\System\ArmAVph.exe
  C:\Windows\System\ArmAVph.exe
  2⤵
  PID:6600
- C:\Windows\System\oWgUIGf.exe
  C:\Windows\System\oWgUIGf.exe
  2⤵
  PID:6620
- C:\Windows\System\lMzlADr.exe
  C:\Windows\System\lMzlADr.exe
  2⤵
  PID:6640
- C:\Windows\System\OvDEjyR.exe
  C:\Windows\System\OvDEjyR.exe
  2⤵
  PID:6660
- C:\Windows\System\pdxyiPx.exe
  C:\Windows\System\pdxyiPx.exe
  2⤵
  PID:6684
- C:\Windows\System\YAzfMWq.exe
  C:\Windows\System\YAzfMWq.exe
  2⤵
  PID:6700
- C:\Windows\System\AAtinfJ.exe
  C:\Windows\System\AAtinfJ.exe
  2⤵
  PID:6716
- C:\Windows\System\cpVoFPr.exe
  C:\Windows\System\cpVoFPr.exe
  2⤵
  PID:6732
- C:\Windows\System\YXhFCjW.exe
  C:\Windows\System\YXhFCjW.exe
  2⤵
  PID:6760
- C:\Windows\System\TQuMreA.exe
  C:\Windows\System\TQuMreA.exe
  2⤵
  PID:6784
- C:\Windows\System\zptlzLi.exe
  C:\Windows\System\zptlzLi.exe
  2⤵
  PID:6808
- C:\Windows\System\bMnWnRa.exe
  C:\Windows\System\bMnWnRa.exe
  2⤵
  PID:6840
- C:\Windows\System\qbKtxhw.exe
  C:\Windows\System\qbKtxhw.exe
  2⤵
  PID:6856
- C:\Windows\System\NvMWRZt.exe
  C:\Windows\System\NvMWRZt.exe
  2⤵
  PID:6880
- C:\Windows\System\qTVxOHP.exe
  C:\Windows\System\qTVxOHP.exe
  2⤵
  PID:6900
- C:\Windows\System\QBZZIRK.exe
  C:\Windows\System\QBZZIRK.exe
  2⤵
  PID:6924
- C:\Windows\System\WfbJNHU.exe
  C:\Windows\System\WfbJNHU.exe
  2⤵
  PID:6940
- C:\Windows\System\zCmanjw.exe
  C:\Windows\System\zCmanjw.exe
  2⤵
  PID:6968
- C:\Windows\System\FTwXrSR.exe
  C:\Windows\System\FTwXrSR.exe
  2⤵
  PID:6992
- C:\Windows\System\MHJLWVQ.exe
  C:\Windows\System\MHJLWVQ.exe
  2⤵
  PID:7012
- C:\Windows\System\BNXTGBu.exe
  C:\Windows\System\BNXTGBu.exe
  2⤵
  PID:7036
- C:\Windows\System\XpjoYsW.exe
  C:\Windows\System\XpjoYsW.exe
  2⤵
  PID:7056
- C:\Windows\System\sLShmPj.exe
  C:\Windows\System\sLShmPj.exe
  2⤵
  PID:7076
- C:\Windows\System\jbXYZKl.exe
  C:\Windows\System\jbXYZKl.exe
  2⤵
  PID:7100
- C:\Windows\System\Uysrgiy.exe
  C:\Windows\System\Uysrgiy.exe
  2⤵
  PID:7124
- C:\Windows\System\jqprSxq.exe
  C:\Windows\System\jqprSxq.exe
  2⤵
  PID:7144
- C:\Windows\System\RuDGLJf.exe
  C:\Windows\System\RuDGLJf.exe
  2⤵
  PID:5268
- C:\Windows\System\JngoJeI.exe
  C:\Windows\System\JngoJeI.exe
  2⤵
  PID:5308
- C:\Windows\System\sYEsxiM.exe
  C:\Windows\System\sYEsxiM.exe
  2⤵
  PID:5604
- C:\Windows\System\bNSXwem.exe
  C:\Windows\System\bNSXwem.exe
  2⤵
  PID:5412
- C:\Windows\System\iVJnqiM.exe
  C:\Windows\System\iVJnqiM.exe
  2⤵
  PID:6020
- C:\Windows\System\NePnraZ.exe
  C:\Windows\System\NePnraZ.exe
  2⤵
  PID:5468
- C:\Windows\System\FXwohRa.exe
  C:\Windows\System\FXwohRa.exe
  2⤵
  PID:4896
- C:\Windows\System\maWbfyB.exe
  C:\Windows\System\maWbfyB.exe
  2⤵
  PID:5520
- C:\Windows\System\EglXrLs.exe
  C:\Windows\System\EglXrLs.exe
  2⤵
  PID:4564
- C:\Windows\System\ephnBeT.exe
  C:\Windows\System\ephnBeT.exe
  2⤵
  PID:3656
- C:\Windows\System\DqLeSBO.exe
  C:\Windows\System\DqLeSBO.exe
  2⤵
  PID:6192
- C:\Windows\System\uphSZsp.exe
  C:\Windows\System\uphSZsp.exe
  2⤵
  PID:5996
- C:\Windows\System\iBHNZzj.exe
  C:\Windows\System\iBHNZzj.exe
  2⤵
  PID:6300
- C:\Windows\System\ZqNhLur.exe
  C:\Windows\System\ZqNhLur.exe
  2⤵
  PID:5628
- C:\Windows\System\sgNXivA.exe
  C:\Windows\System\sgNXivA.exe
  2⤵
  PID:5652
- C:\Windows\System\BqCoCDq.exe
  C:\Windows\System\BqCoCDq.exe
  2⤵
  PID:5712
- C:\Windows\System\KSSFsai.exe
  C:\Windows\System\KSSFsai.exe
  2⤵
  PID:6488
- C:\Windows\System\tlgGRZX.exe
  C:\Windows\System\tlgGRZX.exe
  2⤵
  PID:6508
- C:\Windows\System\ijnBniY.exe
  C:\Windows\System\ijnBniY.exe
  2⤵
  PID:5820
- C:\Windows\System\ZjCnXEj.exe
  C:\Windows\System\ZjCnXEj.exe
  2⤵
  PID:7172
- C:\Windows\System\XhBbIbt.exe
  C:\Windows\System\XhBbIbt.exe
  2⤵
  PID:7192
- C:\Windows\System\DZPhFHB.exe
  C:\Windows\System\DZPhFHB.exe
  2⤵
  PID:7216
- C:\Windows\System\vculpMl.exe
  C:\Windows\System\vculpMl.exe
  2⤵
  PID:7232
- C:\Windows\System\HwJfIMy.exe
  C:\Windows\System\HwJfIMy.exe
  2⤵
  PID:7264
- C:\Windows\System\vBCGszU.exe
  C:\Windows\System\vBCGszU.exe
  2⤵
  PID:7288
- C:\Windows\System\NJUgBnz.exe
  C:\Windows\System\NJUgBnz.exe
  2⤵
  PID:7304
- C:\Windows\System\kakrHzd.exe
  C:\Windows\System\kakrHzd.exe
  2⤵
  PID:7332
- C:\Windows\System\mxcFzwH.exe
  C:\Windows\System\mxcFzwH.exe
  2⤵
  PID:7348
- C:\Windows\System\mlgIwCb.exe
  C:\Windows\System\mlgIwCb.exe
  2⤵
  PID:7372
- C:\Windows\System\HeugTuv.exe
  C:\Windows\System\HeugTuv.exe
  2⤵
  PID:7388
- C:\Windows\System\VMHsuBR.exe
  C:\Windows\System\VMHsuBR.exe
  2⤵
  PID:7408
- C:\Windows\System\XJvILWJ.exe
  C:\Windows\System\XJvILWJ.exe
  2⤵
  PID:7428
- C:\Windows\System\GHdJrQS.exe
  C:\Windows\System\GHdJrQS.exe
  2⤵
  PID:7460
- C:\Windows\System\qZecXKN.exe
  C:\Windows\System\qZecXKN.exe
  2⤵
  PID:7476
- C:\Windows\System\LmAfLQC.exe
  C:\Windows\System\LmAfLQC.exe
  2⤵
  PID:7492
- C:\Windows\System\jtRfeco.exe
  C:\Windows\System\jtRfeco.exe
  2⤵
  PID:7520
- C:\Windows\System\RsrTeyn.exe
  C:\Windows\System\RsrTeyn.exe
  2⤵
  PID:7540
- C:\Windows\System\xDtSOML.exe
  C:\Windows\System\xDtSOML.exe
  2⤵
  PID:7564
- C:\Windows\System\tzQvUAh.exe
  C:\Windows\System\tzQvUAh.exe
  2⤵
  PID:7580
- C:\Windows\System\KMjUnCE.exe
  C:\Windows\System\KMjUnCE.exe
  2⤵
  PID:7604
- C:\Windows\System\sgcDQWj.exe
  C:\Windows\System\sgcDQWj.exe
  2⤵
  PID:7624
- C:\Windows\System\taNmbph.exe
  C:\Windows\System\taNmbph.exe
  2⤵
  PID:7648
- C:\Windows\System\cOonmJJ.exe
  C:\Windows\System\cOonmJJ.exe
  2⤵
  PID:7664
- C:\Windows\System\bkRxmPU.exe
  C:\Windows\System\bkRxmPU.exe
  2⤵
  PID:7684
- C:\Windows\System\YcxOoXG.exe
  C:\Windows\System\YcxOoXG.exe
  2⤵
  PID:7700
- C:\Windows\System\LQxngeF.exe
  C:\Windows\System\LQxngeF.exe
  2⤵
  PID:7728
- C:\Windows\System\YORnUpr.exe
  C:\Windows\System\YORnUpr.exe
  2⤵
  PID:7744
- C:\Windows\System\ZPmIKex.exe
  C:\Windows\System\ZPmIKex.exe
  2⤵
  PID:7768
- C:\Windows\System\PNJsrRc.exe
  C:\Windows\System\PNJsrRc.exe
  2⤵
  PID:7784
- C:\Windows\System\hfHNClD.exe
  C:\Windows\System\hfHNClD.exe
  2⤵
  PID:7804
- C:\Windows\System\IJciUEG.exe
  C:\Windows\System\IJciUEG.exe
  2⤵
  PID:7824
- C:\Windows\System\OQoXCtG.exe
  C:\Windows\System\OQoXCtG.exe
  2⤵
  PID:7840
- C:\Windows\System\CJbiQQV.exe
  C:\Windows\System\CJbiQQV.exe
  2⤵
  PID:7864
- C:\Windows\System\bmMxQpB.exe
  C:\Windows\System\bmMxQpB.exe
  2⤵
  PID:7880
- C:\Windows\System\xjJKKJG.exe
  C:\Windows\System\xjJKKJG.exe
  2⤵
  PID:7900
- C:\Windows\System\TqCCwMr.exe
  C:\Windows\System\TqCCwMr.exe
  2⤵
  PID:7924
- C:\Windows\System\DkyUetv.exe
  C:\Windows\System\DkyUetv.exe
  2⤵
  PID:7944
- C:\Windows\System\mHJgpkG.exe
  C:\Windows\System\mHJgpkG.exe
  2⤵
  PID:7964
- C:\Windows\System\XFGcppk.exe
  C:\Windows\System\XFGcppk.exe
  2⤵
  PID:7992
- C:\Windows\System\DJGJwPh.exe
  C:\Windows\System\DJGJwPh.exe
  2⤵
  PID:8008
- C:\Windows\System\eyDxWfC.exe
  C:\Windows\System\eyDxWfC.exe
  2⤵
  PID:8028
- C:\Windows\System\XobryIY.exe
  C:\Windows\System\XobryIY.exe
  2⤵
  PID:8056
- C:\Windows\System\hgYKXUr.exe
  C:\Windows\System\hgYKXUr.exe
  2⤵
  PID:8072
- C:\Windows\System\bhLAtni.exe
  C:\Windows\System\bhLAtni.exe
  2⤵
  PID:8096
- C:\Windows\System\YMGJIow.exe
  C:\Windows\System\YMGJIow.exe
  2⤵
  PID:8116
- C:\Windows\System\UWlFagy.exe
  C:\Windows\System\UWlFagy.exe
  2⤵
  PID:8132
- C:\Windows\System\WAixRpf.exe
  C:\Windows\System\WAixRpf.exe
  2⤵
  PID:8156
- C:\Windows\System\Hmnioiq.exe
  C:\Windows\System\Hmnioiq.exe
  2⤵
  PID:8180
- C:\Windows\System\VztajlN.exe
  C:\Windows\System\VztajlN.exe
  2⤵
  PID:6740
- C:\Windows\System\xzwuQVn.exe
  C:\Windows\System\xzwuQVn.exe
  2⤵
  PID:3516
- C:\Windows\System\LgdwurK.exe
  C:\Windows\System\LgdwurK.exe
  2⤵
  PID:5176
- C:\Windows\System\GYpmduk.exe
  C:\Windows\System\GYpmduk.exe
  2⤵
  PID:4180
- C:\Windows\System\qwbtbPz.exe
  C:\Windows\System\qwbtbPz.exe
  2⤵
  PID:3356
- C:\Windows\System\ssoZlyJ.exe
  C:\Windows\System\ssoZlyJ.exe
  2⤵
  PID:6832
- C:\Windows\System\ACKtRUI.exe
  C:\Windows\System\ACKtRUI.exe
  2⤵
  PID:5536
- C:\Windows\System\hiCSRfH.exe
  C:\Windows\System\hiCSRfH.exe
  2⤵
  PID:6148
- C:\Windows\System\vNLMhKm.exe
  C:\Windows\System\vNLMhKm.exe
  2⤵
  PID:6936
- C:\Windows\System\IKbGPSg.exe
  C:\Windows\System\IKbGPSg.exe
  2⤵
  PID:6976
- C:\Windows\System\TXWyUZf.exe
  C:\Windows\System\TXWyUZf.exe
  2⤵
  PID:7008
- C:\Windows\System\GiQdhdb.exe
  C:\Windows\System\GiQdhdb.exe
  2⤵
  PID:7064
- C:\Windows\System\jACuakI.exe
  C:\Windows\System\jACuakI.exe
  2⤵
  PID:6348
- C:\Windows\System\QSQAavA.exe
  C:\Windows\System\QSQAavA.exe
  2⤵
  PID:6408
- C:\Windows\System\wyLbvvO.exe
  C:\Windows\System\wyLbvvO.exe
  2⤵
  PID:6064
- C:\Windows\System\JMbAkpD.exe
  C:\Windows\System\JMbAkpD.exe
  2⤵
  PID:5376
- C:\Windows\System\LIKVnyn.exe
  C:\Windows\System\LIKVnyn.exe
  2⤵
  PID:6120
- C:\Windows\System\hBiBgqN.exe
  C:\Windows\System\hBiBgqN.exe
  2⤵
  PID:2076
- C:\Windows\System\Tpkjssq.exe
  C:\Windows\System\Tpkjssq.exe
  2⤵
  PID:6632
- C:\Windows\System\hYGXwhf.exe
  C:\Windows\System\hYGXwhf.exe
  2⤵
  PID:7184
- C:\Windows\System\jNFSvWh.exe
  C:\Windows\System\jNFSvWh.exe
  2⤵
  PID:6696
- C:\Windows\System\JoGGAmL.exe
  C:\Windows\System\JoGGAmL.exe
  2⤵
  PID:7316
- C:\Windows\System\zocMcyx.exe
  C:\Windows\System\zocMcyx.exe
  2⤵
  PID:7360
- C:\Windows\System\LOGUxlF.exe
  C:\Windows\System\LOGUxlF.exe
  2⤵
  PID:8212
- C:\Windows\System\xiBAzuD.exe
  C:\Windows\System\xiBAzuD.exe
  2⤵
  PID:8232
- C:\Windows\System\abQBMOZ.exe
  C:\Windows\System\abQBMOZ.exe
  2⤵
  PID:8256
- C:\Windows\System\cVoAxgc.exe
  C:\Windows\System\cVoAxgc.exe
  2⤵
  PID:8272
- C:\Windows\System\IBvzeSk.exe
  C:\Windows\System\IBvzeSk.exe
  2⤵
  PID:8296
- C:\Windows\System\CDXilJj.exe
  C:\Windows\System\CDXilJj.exe
  2⤵
  PID:8324
- C:\Windows\System\SemwCWP.exe
  C:\Windows\System\SemwCWP.exe
  2⤵
  PID:8348
- C:\Windows\System\ZuwpENV.exe
  C:\Windows\System\ZuwpENV.exe
  2⤵
  PID:8640
- C:\Windows\System\eGgyCoy.exe
  C:\Windows\System\eGgyCoy.exe
  2⤵
  PID:8664
- C:\Windows\System\cmSvdGb.exe
  C:\Windows\System\cmSvdGb.exe
  2⤵
  PID:8680
- C:\Windows\System\HbvQhby.exe
  C:\Windows\System\HbvQhby.exe
  2⤵
  PID:8700
- C:\Windows\System\kOwFaBW.exe
  C:\Windows\System\kOwFaBW.exe
  2⤵
  PID:8720
- C:\Windows\System\nsTyvVd.exe
  C:\Windows\System\nsTyvVd.exe
  2⤵
  PID:8740
- C:\Windows\System\usrdgSE.exe
  C:\Windows\System\usrdgSE.exe
  2⤵
  PID:8760
- C:\Windows\System\iLWwLSt.exe
  C:\Windows\System\iLWwLSt.exe
  2⤵
  PID:8776
- C:\Windows\System\jgTRMEl.exe
  C:\Windows\System\jgTRMEl.exe
  2⤵
  PID:8800
- C:\Windows\System\MgGMRgB.exe
  C:\Windows\System\MgGMRgB.exe
  2⤵
  PID:8824
- C:\Windows\System\juRFTmq.exe
  C:\Windows\System\juRFTmq.exe
  2⤵
  PID:8840
- C:\Windows\System\KxalBoO.exe
  C:\Windows\System\KxalBoO.exe
  2⤵
  PID:8872
- C:\Windows\System\OcUeVEl.exe
  C:\Windows\System\OcUeVEl.exe
  2⤵
  PID:8892
- C:\Windows\System\uozmypx.exe
  C:\Windows\System\uozmypx.exe
  2⤵
  PID:8912
- C:\Windows\System\UdcLnlf.exe
  C:\Windows\System\UdcLnlf.exe
  2⤵
  PID:8932
- C:\Windows\System\QKKVBRw.exe
  C:\Windows\System\QKKVBRw.exe
  2⤵
  PID:8956
- C:\Windows\System\ZVDBwPI.exe
  C:\Windows\System\ZVDBwPI.exe
  2⤵
  PID:8980
- C:\Windows\System\RvzrDLc.exe
  C:\Windows\System\RvzrDLc.exe
  2⤵
  PID:8996
- C:\Windows\System\WBeBYhe.exe
  C:\Windows\System\WBeBYhe.exe
  2⤵
  PID:9020
- C:\Windows\System\bEPEqkK.exe
  C:\Windows\System\bEPEqkK.exe
  2⤵
  PID:9044
- C:\Windows\System\FqOeGTT.exe
  C:\Windows\System\FqOeGTT.exe
  2⤵
  PID:9064
- C:\Windows\System\WkPxHoZ.exe
  C:\Windows\System\WkPxHoZ.exe
  2⤵
  PID:9088
- C:\Windows\System\vwTlIEG.exe
  C:\Windows\System\vwTlIEG.exe
  2⤵
  PID:9108
- C:\Windows\System\ZZnhUsJ.exe
  C:\Windows\System\ZZnhUsJ.exe
  2⤵
  PID:9132
- C:\Windows\System\kRmblDR.exe
  C:\Windows\System\kRmblDR.exe
  2⤵
  PID:9152
- C:\Windows\System\FovqFvQ.exe
  C:\Windows\System\FovqFvQ.exe
  2⤵
  PID:9172
- C:\Windows\System\TGFYfjU.exe
  C:\Windows\System\TGFYfjU.exe
  2⤵
  PID:9188
- C:\Windows\System\WKYdUei.exe
  C:\Windows\System\WKYdUei.exe
  2⤵
  PID:9204
- C:\Windows\System\vxLCWMV.exe
  C:\Windows\System\vxLCWMV.exe
  2⤵
  PID:5876
- C:\Windows\System\YRyckYt.exe
  C:\Windows\System\YRyckYt.exe
  2⤵
  PID:6228
- C:\Windows\System\dtDYbcq.exe
  C:\Windows\System\dtDYbcq.exe
  2⤵
  PID:7508
- C:\Windows\System\xowjCWc.exe
  C:\Windows\System\xowjCWc.exe
  2⤵
  PID:7156
- C:\Windows\System\hlRwTcJ.exe
  C:\Windows\System\hlRwTcJ.exe
  2⤵
  PID:5328
- C:\Windows\System\QfkSEXi.exe
  C:\Windows\System\QfkSEXi.exe
  2⤵
  PID:6596
- C:\Windows\System\kyqqGDc.exe
  C:\Windows\System\kyqqGDc.exe
  2⤵
  PID:5172
- C:\Windows\System\sGvHCqg.exe
  C:\Windows\System\sGvHCqg.exe
  2⤵
  PID:2968
- C:\Windows\System\XNNBWKr.exe
  C:\Windows\System\XNNBWKr.exe
  2⤵
  PID:6776
- C:\Windows\System\puBTIoS.exe
  C:\Windows\System\puBTIoS.exe
  2⤵
  PID:6380
- C:\Windows\System\SfjLzse.exe
  C:\Windows\System\SfjLzse.exe
  2⤵
  PID:8208
- C:\Windows\System\ExCkFXs.exe
  C:\Windows\System\ExCkFXs.exe
  2⤵
  PID:7444
- C:\Windows\System\heBrGxA.exe
  C:\Windows\System\heBrGxA.exe
  2⤵
  PID:7504
- C:\Windows\System\OzeHhvF.exe
  C:\Windows\System\OzeHhvF.exe
  2⤵
  PID:8104
- C:\Windows\System\EpEFfRo.exe
  C:\Windows\System\EpEFfRo.exe
  2⤵
  PID:7932
- C:\Windows\System\yryhFWt.exe
  C:\Windows\System\yryhFWt.exe
  2⤵
  PID:7832
- C:\Windows\System\nBfARUz.exe
  C:\Windows\System\nBfARUz.exe
  2⤵
  PID:7676
- C:\Windows\System\rQromeG.exe
  C:\Windows\System\rQromeG.exe
  2⤵
  PID:7556
- C:\Windows\System\dmAfgmT.exe
  C:\Windows\System\dmAfgmT.exe
  2⤵
  PID:7536
- C:\Windows\System\EyaWXGF.exe
  C:\Windows\System\EyaWXGF.exe
  2⤵
  PID:7072
- C:\Windows\System\pmkEcrr.exe
  C:\Windows\System\pmkEcrr.exe
  2⤵
  PID:7740
- C:\Windows\System\frHktrD.exe
  C:\Windows\System\frHktrD.exe
  2⤵
  PID:5336
- C:\Windows\System\zMjBUgL.exe
  C:\Windows\System\zMjBUgL.exe
  2⤵
  PID:5448
- C:\Windows\System\WCxvVho.exe
  C:\Windows\System\WCxvVho.exe
  2⤵
  PID:5516
- C:\Windows\System\IxEaylJ.exe
  C:\Windows\System\IxEaylJ.exe
  2⤵
  PID:808
- C:\Windows\System\rIzchEu.exe
  C:\Windows\System\rIzchEu.exe
  2⤵
  PID:1476
- C:\Windows\System\ONDfKiq.exe
  C:\Windows\System\ONDfKiq.exe
  2⤵
  PID:6284
- C:\Windows\System\nKFDmLw.exe
  C:\Windows\System\nKFDmLw.exe
  2⤵
  PID:6424
- C:\Windows\System\KXdWvYT.exe
  C:\Windows\System\KXdWvYT.exe
  2⤵
  PID:5732
- C:\Windows\System\hbqHHIl.exe
  C:\Windows\System\hbqHHIl.exe
  2⤵
  PID:9240
- C:\Windows\System\kdvSrqf.exe
  C:\Windows\System\kdvSrqf.exe
  2⤵
  PID:9272
- C:\Windows\System\OhMzQhy.exe
  C:\Windows\System\OhMzQhy.exe
  2⤵
  PID:9300
- C:\Windows\System\JKIETto.exe
  C:\Windows\System\JKIETto.exe
  2⤵
  PID:9324
- C:\Windows\System\gtRfPxC.exe
  C:\Windows\System\gtRfPxC.exe
  2⤵
  PID:9340
- C:\Windows\System\jSMPTEh.exe
  C:\Windows\System\jSMPTEh.exe
  2⤵
  PID:9364
- C:\Windows\System\YOVQgcJ.exe
  C:\Windows\System\YOVQgcJ.exe
  2⤵
  PID:9388
- C:\Windows\System\vUZVelu.exe
  C:\Windows\System\vUZVelu.exe
  2⤵
  PID:9408
- C:\Windows\System\COGuOGt.exe
  C:\Windows\System\COGuOGt.exe
  2⤵
  PID:9424
- C:\Windows\System\XSRxFuu.exe
  C:\Windows\System\XSRxFuu.exe
  2⤵
  PID:9448
- C:\Windows\System\YsJIegZ.exe
  C:\Windows\System\YsJIegZ.exe
  2⤵
  PID:9468
- C:\Windows\System\YUbXAez.exe
  C:\Windows\System\YUbXAez.exe
  2⤵
  PID:9492
- C:\Windows\System\khbvNEE.exe
  C:\Windows\System\khbvNEE.exe
  2⤵
  PID:9508
- C:\Windows\System\FaFDHQx.exe
  C:\Windows\System\FaFDHQx.exe
  2⤵
  PID:9536
- C:\Windows\System\NMZvCMb.exe
  C:\Windows\System\NMZvCMb.exe
  2⤵
  PID:9564
- C:\Windows\System\ioaWPFD.exe
  C:\Windows\System\ioaWPFD.exe
  2⤵
  PID:9584
- C:\Windows\System\qKxHvHQ.exe
  C:\Windows\System\qKxHvHQ.exe
  2⤵
  PID:9604
- C:\Windows\System\udOBYAV.exe
  C:\Windows\System\udOBYAV.exe
  2⤵
  PID:9628
- C:\Windows\System\obAZXBN.exe
  C:\Windows\System\obAZXBN.exe
  2⤵
  PID:9644
- C:\Windows\System\BVqdLnP.exe
  C:\Windows\System\BVqdLnP.exe
  2⤵
  PID:9664
- C:\Windows\System\bGlGsQg.exe
  C:\Windows\System\bGlGsQg.exe
  2⤵
  PID:9680
- C:\Windows\System\zzlyzqe.exe
  C:\Windows\System\zzlyzqe.exe
  2⤵
  PID:9704
- C:\Windows\System\lbwxHTV.exe
  C:\Windows\System\lbwxHTV.exe
  2⤵
  PID:9720
- C:\Windows\System\SODqCVQ.exe
  C:\Windows\System\SODqCVQ.exe
  2⤵
  PID:9744
- C:\Windows\System\iPsAsZL.exe
  C:\Windows\System\iPsAsZL.exe
  2⤵
  PID:9768
- C:\Windows\System\lthKast.exe
  C:\Windows\System\lthKast.exe
  2⤵
  PID:9788
- C:\Windows\System\aEfFZCe.exe
  C:\Windows\System\aEfFZCe.exe
  2⤵
  PID:9808
- C:\Windows\System\LcSXiXi.exe
  C:\Windows\System\LcSXiXi.exe
  2⤵
  PID:9828
- C:\Windows\System\CIMCHnm.exe
  C:\Windows\System\CIMCHnm.exe
  2⤵
  PID:9852
- C:\Windows\System\AEGmztu.exe
  C:\Windows\System\AEGmztu.exe
  2⤵
  PID:9876
- C:\Windows\System\eTQrzdp.exe
  C:\Windows\System\eTQrzdp.exe
  2⤵
  PID:9892
- C:\Windows\System\cTzUXhZ.exe
  C:\Windows\System\cTzUXhZ.exe
  2⤵
  PID:9916
- C:\Windows\System\YvvDFEX.exe
  C:\Windows\System\YvvDFEX.exe
  2⤵
  PID:9940
- C:\Windows\System\cXHNqSI.exe
  C:\Windows\System\cXHNqSI.exe
  2⤵
  PID:9964
- C:\Windows\System\pxScYLW.exe
  C:\Windows\System\pxScYLW.exe
  2⤵
  PID:9984
- C:\Windows\System\jNQuoer.exe
  C:\Windows\System\jNQuoer.exe
  2⤵
  PID:10000
- C:\Windows\System\EmKlaIL.exe
  C:\Windows\System\EmKlaIL.exe
  2⤵
  PID:10024
- C:\Windows\System\jefMThY.exe
  C:\Windows\System\jefMThY.exe
  2⤵
  PID:10044
- C:\Windows\System\rCemeif.exe
  C:\Windows\System\rCemeif.exe
  2⤵
  PID:10064
- C:\Windows\System\uDhcyha.exe
  C:\Windows\System\uDhcyha.exe
  2⤵
  PID:10088
- C:\Windows\System\HLvpUBD.exe
  C:\Windows\System\HLvpUBD.exe
  2⤵
  PID:10116
- C:\Windows\System\yWIZrkq.exe
  C:\Windows\System\yWIZrkq.exe
  2⤵
  PID:10136
- C:\Windows\System\baqjmXA.exe
  C:\Windows\System\baqjmXA.exe
  2⤵
  PID:10152
- C:\Windows\System\IRzNSWF.exe
  C:\Windows\System\IRzNSWF.exe
  2⤵
  PID:10172
- C:\Windows\System\IVlGxij.exe
  C:\Windows\System\IVlGxij.exe
  2⤵
  PID:10188
- C:\Windows\System\odfZquS.exe
  C:\Windows\System\odfZquS.exe
  2⤵
  PID:10208
- C:\Windows\System\BKDuARg.exe
  C:\Windows\System\BKDuARg.exe
  2⤵
  PID:10228
- C:\Windows\System\yIVnYmU.exe
  C:\Windows\System\yIVnYmU.exe
  2⤵
  PID:7212
- C:\Windows\System\VLocRIv.exe
  C:\Windows\System\VLocRIv.exe
  2⤵
  PID:7248
- C:\Windows\System\xWNseTg.exe
  C:\Windows\System\xWNseTg.exe
  2⤵
  PID:8560
- C:\Windows\System\gBmuUwY.exe
  C:\Windows\System\gBmuUwY.exe
  2⤵
  PID:7340
- C:\Windows\System\JWNLqZI.exe
  C:\Windows\System\JWNLqZI.exe
  2⤵
  PID:7368
- C:\Windows\System\kGPxlyw.exe
  C:\Windows\System\kGPxlyw.exe
  2⤵
  PID:7420
- C:\Windows\System\wiowtlf.exe
  C:\Windows\System\wiowtlf.exe
  2⤵
  PID:8308
- C:\Windows\System\lFHkbWf.exe
  C:\Windows\System\lFHkbWf.exe
  2⤵
  PID:8360
- C:\Windows\System\eLCuzLi.exe
  C:\Windows\System\eLCuzLi.exe
  2⤵
  PID:8716
- C:\Windows\System\OCCtRyU.exe
  C:\Windows\System\OCCtRyU.exe
  2⤵
  PID:8772
- C:\Windows\System\aVxcKhx.exe
  C:\Windows\System\aVxcKhx.exe
  2⤵
  PID:8832
- C:\Windows\System\nQFXHSx.exe
  C:\Windows\System\nQFXHSx.exe
  2⤵
  PID:8920
- C:\Windows\System\rlLUTvn.exe
  C:\Windows\System\rlLUTvn.exe
  2⤵
  PID:9028
- C:\Windows\System\TOwEMTB.exe
  C:\Windows\System\TOwEMTB.exe
  2⤵
  PID:9164
- C:\Windows\System\igoZQEg.exe
  C:\Windows\System\igoZQEg.exe
  2⤵
  PID:10252
- C:\Windows\System\rMoQNda.exe
  C:\Windows\System\rMoQNda.exe
  2⤵
  PID:10276
- C:\Windows\System\orSacGI.exe
  C:\Windows\System\orSacGI.exe
  2⤵
  PID:10300
- C:\Windows\System\hzxWBro.exe
  C:\Windows\System\hzxWBro.exe
  2⤵
  PID:10324
- C:\Windows\System\CNVmswY.exe
  C:\Windows\System\CNVmswY.exe
  2⤵
  PID:10340
- C:\Windows\System\lVEIQrG.exe
  C:\Windows\System\lVEIQrG.exe
  2⤵
  PID:10364
- C:\Windows\System\cyasZWp.exe
  C:\Windows\System\cyasZWp.exe
  2⤵
  PID:10388
- C:\Windows\System\DXOepDb.exe
  C:\Windows\System\DXOepDb.exe
  2⤵
  PID:10404
- C:\Windows\System\jQjVUDY.exe
  C:\Windows\System\jQjVUDY.exe
  2⤵
  PID:10428
- C:\Windows\System\rxjIyKw.exe
  C:\Windows\System\rxjIyKw.exe
  2⤵
  PID:10452
- C:\Windows\System\lGrCiwW.exe
  C:\Windows\System\lGrCiwW.exe
  2⤵
  PID:10484
- C:\Windows\System\QaqNREs.exe
  C:\Windows\System\QaqNREs.exe
  2⤵
  PID:10500
- C:\Windows\System\JSppOJH.exe
  C:\Windows\System\JSppOJH.exe
  2⤵
  PID:10524
- C:\Windows\System\VzZrZcu.exe
  C:\Windows\System\VzZrZcu.exe
  2⤵
  PID:10552
- C:\Windows\System\iyNaGwt.exe
  C:\Windows\System\iyNaGwt.exe
  2⤵
  PID:10572
- C:\Windows\System\FrAhpRy.exe
  C:\Windows\System\FrAhpRy.exe
  2⤵
  PID:10592
- C:\Windows\System\BklVuyD.exe
  C:\Windows\System\BklVuyD.exe
  2⤵
  PID:10616
- C:\Windows\System\BdTBWPV.exe
  C:\Windows\System\BdTBWPV.exe
  2⤵
  PID:10636
- C:\Windows\System\JIGNIVf.exe
  C:\Windows\System\JIGNIVf.exe
  2⤵
  PID:10660
- C:\Windows\System\xbHiMvn.exe
  C:\Windows\System\xbHiMvn.exe
  2⤵
  PID:10684
- C:\Windows\System\hlgTipP.exe
  C:\Windows\System\hlgTipP.exe
  2⤵
  PID:10700
- C:\Windows\System\qJqnXVf.exe
  C:\Windows\System\qJqnXVf.exe
  2⤵
  PID:10724
- C:\Windows\System\DSyMkoC.exe
  C:\Windows\System\DSyMkoC.exe
  2⤵
  PID:10748
- C:\Windows\System\bAXVMuS.exe
  C:\Windows\System\bAXVMuS.exe
  2⤵
  PID:10776
- C:\Windows\System\sVJuKgG.exe
  C:\Windows\System\sVJuKgG.exe
  2⤵
  PID:10792
- C:\Windows\System\oAoONtU.exe
  C:\Windows\System\oAoONtU.exe
  2⤵
  PID:10816
- C:\Windows\System\jHriCqb.exe
  C:\Windows\System\jHriCqb.exe
  2⤵
  PID:10844
- C:\Windows\System\MZMBYFu.exe
  C:\Windows\System\MZMBYFu.exe
  2⤵
  PID:10864
- C:\Windows\System\dPJCRbn.exe
  C:\Windows\System\dPJCRbn.exe
  2⤵
  PID:10892
- C:\Windows\System\slzgKXh.exe
  C:\Windows\System\slzgKXh.exe
  2⤵
  PID:10912
- C:\Windows\System\nRIruIR.exe
  C:\Windows\System\nRIruIR.exe
  2⤵
  PID:10936
- C:\Windows\System\UYqEphK.exe
  C:\Windows\System\UYqEphK.exe
  2⤵
  PID:10960
- C:\Windows\System\bawLBPq.exe
  C:\Windows\System\bawLBPq.exe
  2⤵
  PID:10980
- C:\Windows\System\ZQwYxTh.exe
  C:\Windows\System\ZQwYxTh.exe
  2⤵
  PID:11000
- C:\Windows\System\ZNBTKOf.exe
  C:\Windows\System\ZNBTKOf.exe
  2⤵
  PID:11020
- C:\Windows\System\BYtAkyM.exe
  C:\Windows\System\BYtAkyM.exe
  2⤵
  PID:11040
- C:\Windows\System\UtqQOoP.exe
  C:\Windows\System\UtqQOoP.exe
  2⤵
  PID:11060
- C:\Windows\System\IxcuJjB.exe
  C:\Windows\System\IxcuJjB.exe
  2⤵
  PID:11084
- C:\Windows\System\AQsNWcK.exe
  C:\Windows\System\AQsNWcK.exe
  2⤵
  PID:11108
- C:\Windows\System\TIKxBgL.exe
  C:\Windows\System\TIKxBgL.exe
  2⤵
  PID:11132
- C:\Windows\System\rhOHWfr.exe
  C:\Windows\System\rhOHWfr.exe
  2⤵
  PID:11156
- C:\Windows\System\XiboCXi.exe
  C:\Windows\System\XiboCXi.exe
  2⤵
  PID:11176
- C:\Windows\System\wytHfmm.exe
  C:\Windows\System\wytHfmm.exe
  2⤵
  PID:11192
- C:\Windows\System\AWUBrMo.exe
  C:\Windows\System\AWUBrMo.exe
  2⤵
  PID:11212
- C:\Windows\System\EDWSqwz.exe
  C:\Windows\System\EDWSqwz.exe
  2⤵
  PID:11236
- C:\Windows\System\tnJtXXX.exe
  C:\Windows\System\tnJtXXX.exe
  2⤵
  PID:11260
- C:\Windows\System\DvMaZfD.exe
  C:\Windows\System\DvMaZfD.exe
  2⤵
  PID:6260
- C:\Windows\System\bSOHTcq.exe
  C:\Windows\System\bSOHTcq.exe
  2⤵
  PID:7816
- C:\Windows\System\MGgrVpq.exe
  C:\Windows\System\MGgrVpq.exe
  2⤵
  PID:7896
- C:\Windows\System\stmoLQM.exe
  C:\Windows\System\stmoLQM.exe
  2⤵
  PID:8004
- C:\Windows\System\qjyBMmy.exe
  C:\Windows\System\qjyBMmy.exe
  2⤵
  PID:7940
- C:\Windows\System\qaNFYjz.exe
  C:\Windows\System\qaNFYjz.exe
  2⤵
  PID:6344
- C:\Windows\System\hdLODkm.exe
  C:\Windows\System\hdLODkm.exe
  2⤵
  PID:8316
- C:\Windows\System\OwfFpmV.exe
  C:\Windows\System\OwfFpmV.exe
  2⤵
  PID:8124
- C:\Windows\System\NOrCHqJ.exe
  C:\Windows\System\NOrCHqJ.exe
  2⤵
  PID:7776
- C:\Windows\System\ZhTVBeN.exe
  C:\Windows\System\ZhTVBeN.exe
  2⤵
  PID:7836
- C:\Windows\System\yRgemNn.exe
  C:\Windows\System\yRgemNn.exe
  2⤵
  PID:5420
- C:\Windows\System\NsmWfAq.exe
  C:\Windows\System\NsmWfAq.exe
  2⤵
  PID:5912
- C:\Windows\System\yqIGDZo.exe
  C:\Windows\System\yqIGDZo.exe
  2⤵
  PID:9264
- C:\Windows\System\vAXadmW.exe
  C:\Windows\System\vAXadmW.exe
  2⤵
  PID:9332
- C:\Windows\System\dIbQCZP.exe
  C:\Windows\System\dIbQCZP.exe
  2⤵
  PID:9484
- C:\Windows\System\nDWBzXa.exe
  C:\Windows\System\nDWBzXa.exe
  2⤵
  PID:9556
- C:\Windows\System\LzpPBuP.exe
  C:\Windows\System\LzpPBuP.exe
  2⤵
  PID:11284
- C:\Windows\System\wBqORxl.exe
  C:\Windows\System\wBqORxl.exe
  2⤵
  PID:11304
- C:\Windows\System\QivWGOf.exe
  C:\Windows\System\QivWGOf.exe
  2⤵
  PID:11324
- C:\Windows\System\AIBSfrV.exe
  C:\Windows\System\AIBSfrV.exe
  2⤵
  PID:11344
- C:\Windows\System\exXYWbg.exe
  C:\Windows\System\exXYWbg.exe
  2⤵
  PID:11372
- C:\Windows\System\zSLZSQB.exe
  C:\Windows\System\zSLZSQB.exe
  2⤵
  PID:11388
- C:\Windows\System\dBoMQmp.exe
  C:\Windows\System\dBoMQmp.exe
  2⤵
  PID:11408
- C:\Windows\System\PBwXnlg.exe
  C:\Windows\System\PBwXnlg.exe
  2⤵
  PID:11440
- C:\Windows\System\cQYfWFm.exe
  C:\Windows\System\cQYfWFm.exe
  2⤵
  PID:11456
- C:\Windows\System\XdFjVkm.exe
  C:\Windows\System\XdFjVkm.exe
  2⤵
  PID:11476
- C:\Windows\System\DxFClQv.exe
  C:\Windows\System\DxFClQv.exe
  2⤵
  PID:11500
- C:\Windows\System\vXfEwuw.exe
  C:\Windows\System\vXfEwuw.exe
  2⤵
  PID:11520
- C:\Windows\System\KWGqQnF.exe
  C:\Windows\System\KWGqQnF.exe
  2⤵
  PID:11544
- C:\Windows\System\vglBgAQ.exe
  C:\Windows\System\vglBgAQ.exe
  2⤵
  PID:11596
- C:\Windows\System\DIKXlrb.exe
  C:\Windows\System\DIKXlrb.exe
  2⤵
  PID:11616
- C:\Windows\System\xyogdYW.exe
  C:\Windows\System\xyogdYW.exe
  2⤵
  PID:11632
- C:\Windows\System\SaZZrsr.exe
  C:\Windows\System\SaZZrsr.exe
  2⤵
  PID:11652
- C:\Windows\System\OqFhuCD.exe
  C:\Windows\System\OqFhuCD.exe
  2⤵
  PID:11676
- C:\Windows\System\PhwvpmC.exe
  C:\Windows\System\PhwvpmC.exe
  2⤵
  PID:11696
- C:\Windows\System\HwsQhDL.exe
  C:\Windows\System\HwsQhDL.exe
  2⤵
  PID:11716
- C:\Windows\System\nynSPAb.exe
  C:\Windows\System\nynSPAb.exe
  2⤵
  PID:11740
- C:\Windows\System\bwLBlgH.exe
  C:\Windows\System\bwLBlgH.exe
  2⤵
  PID:11760
- C:\Windows\System\zqGQlGP.exe
  C:\Windows\System\zqGQlGP.exe
  2⤵
  PID:11780
- C:\Windows\System\QNVIlso.exe
  C:\Windows\System\QNVIlso.exe
  2⤵
  PID:11800
- C:\Windows\System\FZhHcKp.exe
  C:\Windows\System\FZhHcKp.exe
  2⤵
  PID:11820
- C:\Windows\System\QkhVFOq.exe
  C:\Windows\System\QkhVFOq.exe
  2⤵
  PID:11836
- C:\Windows\System\iKEBhLa.exe
  C:\Windows\System\iKEBhLa.exe
  2⤵
  PID:11856
- C:\Windows\System\IMWajZy.exe
  C:\Windows\System\IMWajZy.exe
  2⤵
  PID:11876
- C:\Windows\System\vqPnHSA.exe
  C:\Windows\System\vqPnHSA.exe
  2⤵
  PID:11892
- C:\Windows\System\EKDRImW.exe
  C:\Windows\System\EKDRImW.exe
  2⤵
  PID:11916
- C:\Windows\System\UCqgtIs.exe
  C:\Windows\System\UCqgtIs.exe
  2⤵
  PID:11936
- C:\Windows\System\rOFGhjn.exe
  C:\Windows\System\rOFGhjn.exe
  2⤵
  PID:11964
- C:\Windows\System\oNZcJSx.exe
  C:\Windows\System\oNZcJSx.exe
  2⤵
  PID:11980
- C:\Windows\System\HpdpBDg.exe
  C:\Windows\System\HpdpBDg.exe
  2⤵
  PID:12004
- C:\Windows\System\cIZoypb.exe
  C:\Windows\System\cIZoypb.exe
  2⤵
  PID:12024
- C:\Windows\System\xcyKuCm.exe
  C:\Windows\System\xcyKuCm.exe
  2⤵
  PID:12052
- C:\Windows\System\tNPNfHQ.exe
  C:\Windows\System\tNPNfHQ.exe
  2⤵
  PID:12080
- C:\Windows\System\oYPdrRM.exe
  C:\Windows\System\oYPdrRM.exe
  2⤵
  PID:12100
- C:\Windows\System\EFZZEmV.exe
  C:\Windows\System\EFZZEmV.exe
  2⤵
  PID:12128
- C:\Windows\System\jGHmoSu.exe
  C:\Windows\System\jGHmoSu.exe
  2⤵
  PID:12144
- C:\Windows\System\PWquLDd.exe
  C:\Windows\System\PWquLDd.exe
  2⤵
  PID:12160
- C:\Windows\System\uzXDhWe.exe
  C:\Windows\System\uzXDhWe.exe
  2⤵
  PID:12188
- C:\Windows\System\wYHjVqr.exe
  C:\Windows\System\wYHjVqr.exe
  2⤵
  PID:12216
- C:\Windows\System\oyuqmSy.exe
  C:\Windows\System\oyuqmSy.exe
  2⤵
  PID:12244
- C:\Windows\System\FmCANWA.exe
  C:\Windows\System\FmCANWA.exe
  2⤵
  PID:12284
- C:\Windows\System\eIclukS.exe
  C:\Windows\System\eIclukS.exe
  2⤵
  PID:3384
- C:\Windows\System\SdoGmkm.exe
  C:\Windows\System\SdoGmkm.exe
  2⤵
  PID:5040
- C:\Windows\System\YBSwWHs.exe
  C:\Windows\System\YBSwWHs.exe
  2⤵
  PID:8228
- C:\Windows\System\zJYrkNS.exe
  C:\Windows\System\zJYrkNS.exe
  2⤵
  PID:9764
- C:\Windows\System\BrMzfMw.exe
  C:\Windows\System\BrMzfMw.exe
  2⤵
  PID:9872
- C:\Windows\System\JrleThT.exe
  C:\Windows\System\JrleThT.exe
  2⤵
  PID:9912
- C:\Windows\System\BAcTWRZ.exe
  C:\Windows\System\BAcTWRZ.exe
  2⤵
  PID:8344
- C:\Windows\System\ybzppFC.exe
  C:\Windows\System\ybzppFC.exe
  2⤵
  PID:8264
- C:\Windows\System\UBJSfaX.exe
  C:\Windows\System\UBJSfaX.exe
  2⤵
  PID:6324
- C:\Windows\System\JcuGhoU.exe
  C:\Windows\System\JcuGhoU.exe
  2⤵
  PID:6576
- C:\Windows\System\fRUWwHh.exe
  C:\Windows\System\fRUWwHh.exe
  2⤵
  PID:6892
- C:\Windows\System\vZfxvNi.exe
  C:\Windows\System\vZfxvNi.exe
  2⤵
  PID:6800
- C:\Windows\System\ZyUiHMA.exe
  C:\Windows\System\ZyUiHMA.exe
  2⤵
  PID:7756
- C:\Windows\System\lcCjfTs.exe
  C:\Windows\System\lcCjfTs.exe
  2⤵
  PID:8552
- C:\Windows\System\SRwteKd.exe
  C:\Windows\System\SRwteKd.exe
  2⤵
  PID:7380
- C:\Windows\System\mNzltPp.exe
  C:\Windows\System\mNzltPp.exe
  2⤵
  PID:7468
- C:\Windows\System\GgHHtYE.exe
  C:\Windows\System\GgHHtYE.exe
  2⤵
  PID:8988
- C:\Windows\System\QfCzfMn.exe
  C:\Windows\System\QfCzfMn.exe
  2⤵
  PID:8880
- C:\Windows\System\frHWIzQ.exe
  C:\Windows\System\frHWIzQ.exe
  2⤵
  PID:9100
- C:\Windows\System\RRBqefT.exe
  C:\Windows\System\RRBqefT.exe
  2⤵
  PID:9168
- C:\Windows\System\EhlOoyx.exe
  C:\Windows\System\EhlOoyx.exe
  2⤵
  PID:9212
- C:\Windows\System\wnBrDlO.exe
  C:\Windows\System\wnBrDlO.exe
  2⤵
  PID:10260
- C:\Windows\System\bsUfgbk.exe
  C:\Windows\System\bsUfgbk.exe
  2⤵
  PID:10312
- C:\Windows\System\AvWNiqi.exe
  C:\Windows\System\AvWNiqi.exe
  2⤵
  PID:10356
- C:\Windows\System\DoUETCu.exe
  C:\Windows\System\DoUETCu.exe
  2⤵
  PID:10436
- C:\Windows\System\HrkIFrE.exe
  C:\Windows\System\HrkIFrE.exe
  2⤵
  PID:5000
- C:\Windows\System\KXpLLBM.exe
  C:\Windows\System\KXpLLBM.exe
  2⤵
  PID:10668
- C:\Windows\System\majAQVk.exe
  C:\Windows\System\majAQVk.exe
  2⤵
  PID:10720
- C:\Windows\System\dNkOSUY.exe
  C:\Windows\System\dNkOSUY.exe
  2⤵
  PID:7312
- C:\Windows\System\Siagiin.exe
  C:\Windows\System\Siagiin.exe
  2⤵
  PID:7956
- C:\Windows\System\OoFZxvV.exe
  C:\Windows\System\OoFZxvV.exe
  2⤵
  PID:7736
- C:\Windows\System\TDpADsO.exe
  C:\Windows\System\TDpADsO.exe
  2⤵
  PID:7644
- C:\Windows\System\kiexTok.exe
  C:\Windows\System\kiexTok.exe
  2⤵
  PID:11052
- C:\Windows\System\pLbjKkB.exe
  C:\Windows\System\pLbjKkB.exe
  2⤵
  PID:11100
- C:\Windows\System\NztDvzM.exe
  C:\Windows\System\NztDvzM.exe
  2⤵
  PID:11228
- C:\Windows\System\XSQgYVD.exe
  C:\Windows\System\XSQgYVD.exe
  2⤵
  PID:8024
- C:\Windows\System\mavwRCG.exe
  C:\Windows\System\mavwRCG.exe
  2⤵
  PID:8080
- C:\Windows\System\rhySjnB.exe
  C:\Windows\System\rhySjnB.exe
  2⤵
  PID:9404
- C:\Windows\System\yyLKfIy.exe
  C:\Windows\System\yyLKfIy.exe
  2⤵
  PID:9464
- C:\Windows\System\kQNRHfM.exe
  C:\Windows\System\kQNRHfM.exe
  2⤵
  PID:5432
- C:\Windows\System\pQroSuX.exe
  C:\Windows\System\pQroSuX.exe
  2⤵
  PID:9500
- C:\Windows\System\BgJnPOB.exe
  C:\Windows\System\BgJnPOB.exe
  2⤵
  PID:9544
- C:\Windows\System\hyAqpKs.exe
  C:\Windows\System\hyAqpKs.exe
  2⤵
  PID:12300
- C:\Windows\System\NIOaoSp.exe
  C:\Windows\System\NIOaoSp.exe
  2⤵
  PID:12320
- C:\Windows\System\DNZoYOs.exe
  C:\Windows\System\DNZoYOs.exe
  2⤵
  PID:12340
- C:\Windows\System\mqthzLL.exe
  C:\Windows\System\mqthzLL.exe
  2⤵
  PID:12364
- C:\Windows\System\aTMioiu.exe
  C:\Windows\System\aTMioiu.exe
  2⤵
  PID:12384
- C:\Windows\System\nadveVQ.exe
  C:\Windows\System\nadveVQ.exe
  2⤵
  PID:12404
- C:\Windows\System\ZfwKgYL.exe
  C:\Windows\System\ZfwKgYL.exe
  2⤵
  PID:12424
- C:\Windows\System\yWjTfxz.exe
  C:\Windows\System\yWjTfxz.exe
  2⤵
  PID:12448
- C:\Windows\System\YlGhZzL.exe
  C:\Windows\System\YlGhZzL.exe
  2⤵
  PID:12468
- C:\Windows\System\SYtRURx.exe
  C:\Windows\System\SYtRURx.exe
  2⤵
  PID:12488
- C:\Windows\System\NQYYmHN.exe
  C:\Windows\System\NQYYmHN.exe
  2⤵
  PID:12508
- C:\Windows\System\uIQyTNI.exe
  C:\Windows\System\uIQyTNI.exe
  2⤵
  PID:12528
- C:\Windows\System\HDbfwef.exe
  C:\Windows\System\HDbfwef.exe
  2⤵
  PID:12548
- C:\Windows\System\oetMaik.exe
  C:\Windows\System\oetMaik.exe
  2⤵
  PID:12568
- C:\Windows\System\AUiquRG.exe
  C:\Windows\System\AUiquRG.exe
  2⤵
  PID:12584
- C:\Windows\System\gxhkQGF.exe
  C:\Windows\System\gxhkQGF.exe
  2⤵
  PID:12612
- C:\Windows\System\pATQxEy.exe
  C:\Windows\System\pATQxEy.exe
  2⤵
  PID:12636
- C:\Windows\System\MMnqAYp.exe
  C:\Windows\System\MMnqAYp.exe
  2⤵
  PID:12656
- C:\Windows\System\NDAzwcX.exe
  C:\Windows\System\NDAzwcX.exe
  2⤵
  PID:12680
- C:\Windows\System\UGXyvXD.exe
  C:\Windows\System\UGXyvXD.exe
  2⤵
  PID:12696
- C:\Windows\System\YBkBdNL.exe
  C:\Windows\System\YBkBdNL.exe
  2⤵
  PID:12712
- C:\Windows\System\msLzCJw.exe
  C:\Windows\System\msLzCJw.exe
  2⤵
  PID:12732
- C:\Windows\System\tFztINR.exe
  C:\Windows\System\tFztINR.exe
  2⤵
  PID:12748
- C:\Windows\System\QNQTHCc.exe
  C:\Windows\System\QNQTHCc.exe
  2⤵
  PID:12764
- C:\Windows\System\tMjunVn.exe
  C:\Windows\System\tMjunVn.exe
  2⤵
  PID:12780
- C:\Windows\System\WfKYfYh.exe
  C:\Windows\System\WfKYfYh.exe
  2⤵
  PID:12804
- C:\Windows\System\DmOgBXw.exe
  C:\Windows\System\DmOgBXw.exe
  2⤵
  PID:12828
- C:\Windows\System\fmEohOl.exe
  C:\Windows\System\fmEohOl.exe
  2⤵
  PID:12844
- C:\Windows\System\LSNWErH.exe
  C:\Windows\System\LSNWErH.exe
  2⤵
  PID:12880
- C:\Windows\System\lpVPpLV.exe
  C:\Windows\System\lpVPpLV.exe
  2⤵
  PID:12896
- C:\Windows\System\reUkCzz.exe
  C:\Windows\System\reUkCzz.exe
  2⤵
  PID:12916
- C:\Windows\System\ddVvpDA.exe
  C:\Windows\System\ddVvpDA.exe
  2⤵
  PID:12932
- C:\Windows\System\IWBKMDs.exe
  C:\Windows\System\IWBKMDs.exe
  2⤵
  PID:12952
- C:\Windows\System\SLeNLNh.exe
  C:\Windows\System\SLeNLNh.exe
  2⤵
  PID:12980
- C:\Windows\System\MPymPZW.exe
  C:\Windows\System\MPymPZW.exe
  2⤵
  PID:13004
- C:\Windows\System\JtqBXyJ.exe
  C:\Windows\System\JtqBXyJ.exe
  2⤵
  PID:13028
- C:\Windows\System\trjgdcc.exe
  C:\Windows\System\trjgdcc.exe
  2⤵
  PID:5324
- C:\Windows\System\WIRUlnf.exe
  C:\Windows\System\WIRUlnf.exe
  2⤵
  PID:11404
- C:\Windows\System\akNwdnp.exe
  C:\Windows\System\akNwdnp.exe
  2⤵
  PID:9616
- C:\Windows\System\xyleDHF.exe
  C:\Windows\System\xyleDHF.exe
  2⤵
  PID:12892
- C:\Windows\System\VgMxZWN.exe
  C:\Windows\System\VgMxZWN.exe
  2⤵
  PID:11644
- C:\Windows\System\lXTrCUs.exe
  C:\Windows\System\lXTrCUs.exe
  2⤵
  PID:10244
- C:\Windows\System\SEgphiN.exe
  C:\Windows\System\SEgphiN.exe
  2⤵
  PID:12436
- C:\Windows\System\RhjqkOC.exe
  C:\Windows\System\RhjqkOC.exe
  2⤵
  PID:11116
- C:\Windows\System\katKvCe.exe
  C:\Windows\System\katKvCe.exe
  2⤵
  PID:8676
- C:\Windows\System\MOQYdoG.exe
  C:\Windows\System\MOQYdoG.exe
  2⤵
  PID:13072
- C:\Windows\System\fGtgIzu.exe
  C:\Windows\System\fGtgIzu.exe
  2⤵
  PID:13160
- C:\Windows\System\phMfwlc.exe
  C:\Windows\System\phMfwlc.exe
  2⤵
  PID:12064
- C:\Windows\System\BAcKOjS.exe
  C:\Windows\System\BAcKOjS.exe
  2⤵
  PID:10384
- C:\Windows\System\NVIHIyr.exe
  C:\Windows\System\NVIHIyr.exe
  2⤵
  PID:13196
- C:\Windows\System\wrVaQbG.exe
  C:\Windows\System\wrVaQbG.exe
  2⤵
  PID:12460
- C:\Windows\System\ZZddEJJ.exe
  C:\Windows\System\ZZddEJJ.exe
  2⤵
  PID:12604
- C:\Windows\System\JqTSzRn.exe
  C:\Windows\System\JqTSzRn.exe
  2⤵
  PID:13024
- C:\Windows\System\kQVeass.exe
  C:\Windows\System\kQVeass.exe
  2⤵
  PID:13104
- C:\Windows\System\KHerMRQ.exe
  C:\Windows\System\KHerMRQ.exe
  2⤵
  PID:13124
- C:\Windows\System\KRuIynV.exe
  C:\Windows\System\KRuIynV.exe
  2⤵
  PID:9652
- C:\Windows\System\euMDpKf.exe
  C:\Windows\System\euMDpKf.exe
  2⤵
  PID:10584
- C:\Windows\System\oQCSFSJ.exe
  C:\Windows\System\oQCSFSJ.exe
  2⤵
  PID:8904
- C:\Windows\System\SKTYuRU.exe
  C:\Windows\System\SKTYuRU.exe
  2⤵
  PID:5760
- C:\Windows\System\rmORxoc.exe
  C:\Windows\System\rmORxoc.exe
  2⤵
  PID:12524
- C:\Windows\System\Ifgvwdr.exe
  C:\Windows\System\Ifgvwdr.exe
  2⤵
  PID:12544
- C:\Windows\System\tdoCMpn.exe
  C:\Windows\System\tdoCMpn.exe
  2⤵
  PID:12744
- C:\Windows\System\BNogSZi.exe
  C:\Windows\System\BNogSZi.exe
  2⤵
  PID:12168
- C:\Windows\System\sfVxvbW.exe
  C:\Windows\System\sfVxvbW.exe
  2⤵
  PID:1044
- C:\Windows\System\prYFIUY.exe
  C:\Windows\System\prYFIUY.exe
  2⤵
  PID:9576
- C:\Windows\System\vsUbRFR.exe
  C:\Windows\System\vsUbRFR.exe
  2⤵
  PID:13256
- C:\Windows\System\sjBcZvD.exe
  C:\Windows\System\sjBcZvD.exe
  2⤵
  PID:1700
- C:\Windows\System\RddbiLR.exe
  C:\Windows\System\RddbiLR.exe
  2⤵
  PID:6016
- C:\Windows\System\hwhryet.exe
  C:\Windows\System\hwhryet.exe
  2⤵
  PID:9656
- C:\Windows\System\vXkulZN.exe
  C:\Windows\System\vXkulZN.exe
  2⤵
  PID:10148
- C:\Windows\System\hvguqSm.exe
  C:\Windows\System\hvguqSm.exe
  2⤵
  PID:7660
- C:\Windows\System\BSaXyMW.exe
  C:\Windows\System\BSaXyMW.exe
  2⤵
  PID:10972
- C:\Windows\System\mbrBFby.exe
  C:\Windows\System\mbrBFby.exe
  2⤵
  PID:11256
- C:\Windows\System\dEWMzLq.exe
  C:\Windows\System\dEWMzLq.exe
  2⤵
  PID:9760
- C:\Windows\System\LWEkvTd.exe
  C:\Windows\System\LWEkvTd.exe
  2⤵
  PID:10160
- C:\Windows\System\govxLOl.exe
  C:\Windows\System\govxLOl.exe
  2⤵
  PID:11016
- C:\Windows\System\fnsASBD.exe
  C:\Windows\System\fnsASBD.exe
  2⤵
  PID:11204
- C:\Windows\System\IfppKjB.exe
  C:\Windows\System\IfppKjB.exe
  2⤵
  PID:12944
- C:\Windows\System\SanYOZK.exe
  C:\Windows\System\SanYOZK.exe
  2⤵
  PID:11612
- C:\Windows\System\ezsFQaA.exe
  C:\Windows\System\ezsFQaA.exe
  2⤵
  PID:9296
- C:\Windows\System\RMQeoBd.exe
  C:\Windows\System\RMQeoBd.exe
  2⤵
  PID:8416
- C:\Windows\System\ZthKPha.exe
  C:\Windows\System\ZthKPha.exe
  2⤵
  PID:12664
- C:\Windows\System\pScgeca.exe
  C:\Windows\System\pScgeca.exe
  2⤵
  PID:13328
- C:\Windows\System\iyozxVh.exe
  C:\Windows\System\iyozxVh.exe
  2⤵
  PID:13348
- C:\Windows\System\BNxmokX.exe
  C:\Windows\System\BNxmokX.exe
  2⤵
  PID:13376
- C:\Windows\System\NgqznvM.exe
  C:\Windows\System\NgqznvM.exe
  2⤵
  PID:13400
- C:\Windows\System\iWHEFPi.exe
  C:\Windows\System\iWHEFPi.exe
  2⤵
  PID:13424
- C:\Windows\System\OmbFyvY.exe
  C:\Windows\System\OmbFyvY.exe
  2⤵
  PID:13444
- C:\Windows\System\PCSOFFt.exe
  C:\Windows\System\PCSOFFt.exe
  2⤵
  PID:13476
- C:\Windows\System\jjpoNun.exe
  C:\Windows\System\jjpoNun.exe
  2⤵
  PID:13504
- C:\Windows\System\MycaDjk.exe
  C:\Windows\System\MycaDjk.exe
  2⤵
  PID:13532
- C:\Windows\System\BUkDNOq.exe
  C:\Windows\System\BUkDNOq.exe
  2⤵
  PID:13552
- C:\Windows\System\DSEqrdl.exe
  C:\Windows\System\DSEqrdl.exe
  2⤵
  PID:13572
- C:\Windows\System\IVOJPob.exe
  C:\Windows\System\IVOJPob.exe
  2⤵
  PID:13596
- C:\Windows\System\YbclVoe.exe
  C:\Windows\System\YbclVoe.exe
  2⤵
  PID:13620
- C:\Windows\System\SyRxtku.exe
  C:\Windows\System\SyRxtku.exe
  2⤵
  PID:13636
- C:\Windows\System\EFfSixs.exe
  C:\Windows\System\EFfSixs.exe
  2⤵
  PID:13660
- C:\Windows\System\ifVITHP.exe
  C:\Windows\System\ifVITHP.exe
  2⤵
  PID:13680
- C:\Windows\System\wZIagbJ.exe
  C:\Windows\System\wZIagbJ.exe
  2⤵
  PID:13696
- C:\Windows\System\FOdZFXE.exe
  C:\Windows\System\FOdZFXE.exe
  2⤵
  PID:13716
- C:\Windows\System\DJnUyxI.exe
  C:\Windows\System\DJnUyxI.exe
  2⤵
  PID:13740
- C:\Windows\System\kzJLPHE.exe
  C:\Windows\System\kzJLPHE.exe
  2⤵
  PID:13776
- C:\Windows\System\alINgHh.exe
  C:\Windows\System\alINgHh.exe
  2⤵
  PID:13796
- C:\Windows\System\jbpexlw.exe
  C:\Windows\System\jbpexlw.exe
  2⤵
  PID:13868
- C:\Windows\System\TUuQhQp.exe
  C:\Windows\System\TUuQhQp.exe
  2⤵
  PID:14168
- C:\Windows\System\YUKkJlT.exe
  C:\Windows\System\YUKkJlT.exe
  2⤵
  PID:13788
- C:\Windows\System\NKBedTY.exe
  C:\Windows\System\NKBedTY.exe
  2⤵
  PID:13452
- C:\Windows\System\llLVRuz.exe
  C:\Windows\System\llLVRuz.exe
  2⤵
  PID:13824
- C:\Windows\System\Baifeha.exe
  C:\Windows\System\Baifeha.exe
  2⤵
  PID:14328
- C:\Windows\System\uBkTIzG.exe
  C:\Windows\System\uBkTIzG.exe
  2⤵
  PID:13364
- C:\Windows\System\jZArImG.exe
  C:\Windows\System\jZArImG.exe
  2⤵
  PID:5932
- C:\Windows\System\WmYzqDM.exe
  C:\Windows\System\WmYzqDM.exe
  2⤵
  PID:13172
- C:\Windows\System\jpHjaAA.exe
  C:\Windows\System\jpHjaAA.exe
  2⤵
  PID:10396
- C:\Windows\System\VxwRfTj.exe
  C:\Windows\System\VxwRfTj.exe
  2⤵
  PID:5956
- C:\Windows\System\qFJsIle.exe
  C:\Windows\System\qFJsIle.exe
  2⤵
  PID:10104
- C:\Windows\System\NWvsJSi.exe
  C:\Windows\System\NWvsJSi.exe
  2⤵
  PID:13632
- C:\Windows\System\EIrHEWU.exe
  C:\Windows\System\EIrHEWU.exe
  2⤵
  PID:10072
- C:\Windows\System\YZDqpuJ.exe
  C:\Windows\System\YZDqpuJ.exe
  2⤵
  PID:12864
- C:\Windows\System\UFsoPkQ.exe
  C:\Windows\System\UFsoPkQ.exe
  2⤵
  PID:4840
- C:\Windows\System\XyjDCay.exe
  C:\Windows\System\XyjDCay.exe
  2⤵
  PID:13652
- C:\Windows\System\twKzrsk.exe
  C:\Windows\System\twKzrsk.exe
  2⤵
  PID:10716
- C:\Windows\System\OqgTcNw.exe
  C:\Windows\System\OqgTcNw.exe
  2⤵
  PID:7068
- C:\Windows\System\Kkrhnza.exe
  C:\Windows\System\Kkrhnza.exe
  2⤵
  PID:1200
- C:\Windows\System\joBdVCc.exe
  C:\Windows\System\joBdVCc.exe
  2⤵
  PID:11604
- C:\Windows\System\QlvNOjl.exe
  C:\Windows\System\QlvNOjl.exe
  2⤵
  PID:13812
- C:\Windows\System\RjaVgWU.exe
  C:\Windows\System\RjaVgWU.exe
  2⤵
  PID:13608
- C:\Windows\System\udmVBZN.exe
  C:\Windows\System\udmVBZN.exe
  2⤵
  PID:13892
- C:\Windows\System\bgMewoX.exe
  C:\Windows\System\bgMewoX.exe
  2⤵
  PID:10976
- C:\Windows\System\ZFtkJIG.exe
  C:\Windows\System\ZFtkJIG.exe
  2⤵
  PID:14064
- C:\Windows\System\DiqNdPk.exe
  C:\Windows\System\DiqNdPk.exe
  2⤵
  PID:13848
- C:\Windows\System\JeHvIPO.exe
  C:\Windows\System\JeHvIPO.exe
  2⤵
  PID:14000
- C:\Windows\System\odcJhLm.exe
  C:\Windows\System\odcJhLm.exe
  2⤵
  PID:14056
- C:\Windows\System\jQChvgR.exe
  C:\Windows\System\jQChvgR.exe
  2⤵
  PID:13568
- C:\Windows\System\UIPiKwf.exe
  C:\Windows\System\UIPiKwf.exe
  2⤵
  PID:11996
- C:\Windows\System\QNDGBRt.exe
  C:\Windows\System\QNDGBRt.exe
  2⤵
  PID:14112
- C:\Windows\System\hLRssRx.exe
  C:\Windows\System\hLRssRx.exe
  2⤵
  PID:12228
- C:\Windows\System\upfggue.exe
  C:\Windows\System\upfggue.exe
  2⤵
  PID:13908
- C:\Windows\System\RXaiTSF.exe
  C:\Windows\System\RXaiTSF.exe
  2⤵
  PID:13772
- C:\Windows\System\rvXRaHf.exe
  C:\Windows\System\rvXRaHf.exe
  2⤵
  PID:13492
- C:\Windows\System\yQEdbLl.exe
  C:\Windows\System\yQEdbLl.exe
  2⤵
  PID:13372
- C:\Windows\System\IMgLytE.exe
  C:\Windows\System\IMgLytE.exe
  2⤵
  PID:13888
- C:\Windows\System\tfLPhvk.exe
  C:\Windows\System\tfLPhvk.exe
  2⤵
  PID:14036
- C:\Windows\System\fddfBDT.exe
  C:\Windows\System\fddfBDT.exe
  2⤵
  PID:13548
- C:\Windows\System\DNlKKRS.exe
  C:\Windows\System\DNlKKRS.exe
  2⤵
  PID:576
- C:\Windows\System\AbGnJOW.exe
  C:\Windows\System\AbGnJOW.exe
  2⤵
  PID:11828
- C:\Windows\System\AcYpWlm.exe
  C:\Windows\System\AcYpWlm.exe
  2⤵
  PID:14116
- C:\Windows\System\cxaHqfC.exe
  C:\Windows\System\cxaHqfC.exe
  2⤵
  PID:14068
- C:\Windows\System\ohShdoa.exe
  C:\Windows\System\ohShdoa.exe
  2⤵
  PID:13496
- C:\Windows\System\unpIkBU.exe
  C:\Windows\System\unpIkBU.exe
  2⤵
  PID:13456
- C:\Windows\System\JFeYKtG.exe
  C:\Windows\System\JFeYKtG.exe
  2⤵
  PID:13564
- C:\Windows\System\vcFfQni.exe
  C:\Windows\System\vcFfQni.exe
  2⤵
  PID:6236
- C:\Windows\System\KuajEcX.exe
  C:\Windows\System\KuajEcX.exe
  2⤵
  PID:12012
- C:\Windows\System\mhspXbZ.exe
  C:\Windows\System\mhspXbZ.exe
  2⤵
  PID:7136

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ermnlxsq.bgs.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AMTHwXn.exe

Filesize
1.8MB

MD5
c34980ed382a0cfe17a1b9220fe3e8e9

SHA1
e2c6f3a8d5673ef74ae74defb274b9d1d61735b1

SHA256
3b0829bfdc160741bf2f1d5e48b4c7272fa4543bea5aac22ec4e679fb5760abb

SHA512
e8bcae9c659d3c5e554c25e909a1c7563ebdc818ddb5171a83e29b0d4f13cabeccffae30773a9f38ab7c27e692e9dbec32c2ad2e9c7d363a9815133f3fbb948c

Download Submit
C:\Windows\System\EfLlxOF.exe

Filesize
1.8MB

MD5
46ebd735c6e3e411e1060c192cb8ef4b

SHA1
827635e0c59fb8b8ad7439998915511ab182645c

SHA256
aaf5295d2fadf44959045dc85da6f2a23bafcd5007258252971049e838d8a71b

SHA512
f55e9f67e13068dafdbdbfb14368ea62e9dff9c70a814558f0e3c5b7ba919257d432e98c6d5d8407dee818474c0a598e12192a1e1767dd9bab455c3a8dc91151

Download Submit
C:\Windows\System\GcpXVwp.exe

Filesize
1.8MB

MD5
5519d29f565390255760da4af8569519

SHA1
4bfd095ac5bc6349102bc4600c5216df7d739090

SHA256
f45487a49a6d0ff90fa010e583c7055c4bc31092dc3ed902373e91fa207183d7

SHA512
fb8a6d40dbaaeed25a7f4968cd516e73941bfbed4c101bff4b60912aaee37de23a6ec5c4a7fa7c8e5477682c74ee7155959e219bfaded21945ea8618f5148896

Download Submit
C:\Windows\System\JSzIrYn.exe

Filesize
1.8MB

MD5
f53d7b049987c7d18dc030810bb83508

SHA1
4b0b6513329b0b9959de84e2395f8827c8221ca0

SHA256
609fff1d350f5c4682042243f1f8b43b709267aef33029c4ed9a899475267281

SHA512
4813cec566db67dac1c20791ca86b6076ec84e30b749f7165800c664579af488b539d299b06459a3b4ff780bfed5885d521345a890af8908e69c4a129075939f

Download Submit
C:\Windows\System\JhzQBLF.exe

Filesize
1.8MB

MD5
f60c5bbe95a12604dc9ee4e20518b9ed

SHA1
e85854300b6f88af0630b62b92a6a88be5bce5fd

SHA256
58462f9eebe2e44998a704b99e2d9b4ac68b18d40f6bb5d8bbfa8e9ac1046d98

SHA512
b49a1a239c1ecea78f436abd3c914a3899c813f18e2e26096f9068598f68fd3eedf91e5111e82405e80cfef74d705ed55fc741910ed81b4edca34abae810f4f3

Download Submit
C:\Windows\System\KbPSZrt.exe

Filesize
1.8MB

MD5
d9086ccdd1d9aa80de77d1e3ab45b2e2

SHA1
7ee15fc293a2db32b18b1ee6e8e7e62c06439994

SHA256
8fe8c6f61898f8ee912c1b1ae16bebfdedbc356fb2a88aed847913b73bcd3793

SHA512
fc82e87e78f18969d202eecc7fff29a99d7faad509abf1df45d5d57dd0905e7501b9b7ce3ca052a5e3909bc3ba2aac81c912a48ba4024b0de26d2ffabe2009bf

Download Submit
C:\Windows\System\McxBXdZ.exe

Filesize
1.8MB

MD5
c97914199e7ad5ea94012d99024db8de

SHA1
c5a4e1dee908d22f0e1bf2efb39e098983edd1c9

SHA256
09b3fa2ef745b47f00ab122c88a9d4d2e389027f49f7715508e1a5e07c0f2b91

SHA512
860d3aa4a744fd657d287b7ab8f38b95a5c864b18df6bb481a065a6c6eb237d708c1815cf9cb63493b5b004c0fe14e023b14b561ced0926847b195d6f9942c50

Download Submit
C:\Windows\System\NPohBUX.exe

Filesize
1.8MB

MD5
597f4183956884847680e70027a0bd55

SHA1
746e5db7a1a0d189d287ecfa784350af0a45f60d

SHA256
c2189764e841f2c516cb0273c719ca727c2ae9c91d094e0ef3e598f9e54b8083

SHA512
6482ebc686b83d1fe52db70aae5e8304ccee0412cfa110813d1d3a8f39562c08bd30fbe69fe16e7fcdb30d33a11dee5b655f9f2ca845e1ab0590dab3a747f68f

Download Submit
C:\Windows\System\PmrLDdD.exe

Filesize
1.8MB

MD5
1263476c79662c8273db38b04a1133de

SHA1
e31a7940544e9c42120254633ac15f1804f7df24

SHA256
3f1bcd6a891598c496b849128559670d3c5bfbb569a6e0c65dc5446db7e34175

SHA512
e8b0c9d8706e7d952a9237b6b6d2c5bc64dddd9c9b1c5baf9f276632f1e8330a00ecf810ab526326592b351eadd741906fc50fc12f21de81ab6e0eeb50f7e3e8

Download Submit
C:\Windows\System\QOEaoND.exe

Filesize
1.8MB

MD5
73d00b3a49109a2ef8d19b6d3d590626

SHA1
5f0a002dd259bbb222a7994dbf616ef09f190944

SHA256
c72f40ce9451ec8c2a8d72477c9dd97695c5fa64a8244ac945679027ded1de6e

SHA512
98fcbf4e0c11bd7d53d388eb74b983a4a333170c784ebd8e924cf3fd81ebf29fbd0910a69bf9a5f1a9547bbd1bad9bff026a33f5771160d7e1e97e954b505517

Download Submit
C:\Windows\System\SncJdqb.exe

Filesize
1.8MB

MD5
9439f5a478dac2c51aff40caf70dedaa

SHA1
125fdf6f1cd34e52a05fe04a65dd9c1773b2bc49

SHA256
dcbb92371b68004339dcb89bac1080a97547816105a39f6c1c96174fd3f15f20

SHA512
a5e65348d1809a092ee24018069230fa048c4db3c9a3eb7c9fb2106e14fb37226df5acf6438d7437749132fff0b68da0ed381a56a1c228ff0e143969c2517f54

Download Submit
C:\Windows\System\TzOgfHn.exe

Filesize
1.8MB

MD5
78986f7f0fc4ea17518351536f815499

SHA1
49c5ceef4af20688304e3d86ec5a02d494364872

SHA256
f92b2f6a0a04818cb1c07e8f8a6c2951020c27d8cc5013bbe00c779930049093

SHA512
932c86f584f8ff23522259c3c4561605d124af8e7a4750e2b095ab43df6a4dd7f3db5b4879c470f2862edf9032e4686231c64a8bb7b23606b3c9c3e88a4be766

Download Submit
C:\Windows\System\VOuJVSo.exe

Filesize
1.8MB

MD5
b1675447302fce6ccbee07afd87ad832

SHA1
23e5e4ef4a06406601ba641d656d3276aad79bd9

SHA256
1631cc52102afda66f6416109a08bd048a7105b1c1a18fac134de5fa06c5cd5f

SHA512
0892d73c9c10654d68ed962ad5cc6663eb217bebe0399cf5ea8936ec658cbc5371674ce7071b20935bb8f0e4223432142551fc607aaea81e58c1eeea4ceafb93

Download Submit
C:\Windows\System\XVBPhMf.exe

Filesize
1.8MB

MD5
db92dfd04616b9511cd65e3af33974d5

SHA1
3178071f4d2b458e222cd28caa5f6302c2da72f7

SHA256
f0f8f934d9c4d7abd0b90388a6e160b0463ab7c86d5ea4fcbc1f0476695e555b

SHA512
9347e0438b318232adea58154a7b69d5eb0fba0f25e44e5c104d4880723a0a9b40cc4e9472fbc2c113edc0c26af1e196c7e03a3bc14564cd3b03d3513b36ca02

Download Submit
C:\Windows\System\YeVtfiO.exe

Filesize
1.8MB

MD5
42554e73c816df2ee59e3796703dea00

SHA1
dc85959777bb8aa35425d37b19e4814335c9bb60

SHA256
d5ab99e30bb1b61437065438604fa9bade37c28b4234ad5aa56ed0f137ab3aa5

SHA512
bd676117aee5c9eddb17a7704136db358aece16c2b8c320a2a1d6033b81ae401264a255157908be44571cde43f8a1cfc677d6661a3f73e24ba9db2a1f6e34080

Download Submit
C:\Windows\System\argOLmv.exe

Filesize
1.8MB

MD5
bf9495f0a7a1c0c6e4ae19ad1211691e

SHA1
d8305d347d70ffc8f7f24d86b44da017a167b7ed

SHA256
7787471ff5c8255fd52faa2ffb6a4c7c4b167a4e5efb2e93cb6ebc4fe5b6ccd6

SHA512
fc39fcaa299644b3e2b247ff7b87a8f4fd451c29171490559eb5fcb65a9415fbc3792d32dbec3a5dbc746c3f42c45e28dab87e5a3b9e04dbcc7b535781c971d5

Download Submit
C:\Windows\System\bFuDOhh.exe

Filesize
1.8MB

MD5
b7b8ba5ebed375aeeaa9468a0902aa91

SHA1
1f2d4385cca7b39f927e04622a0ce068ad340017

SHA256
97b60eeab0b67b50e9996b43e0e881925b707d013460debf9277057c8afc8277

SHA512
937d5d3a7750669e33fc79da63632fc08d0e009a63b3c5da43f3d7e33a1c76985e10a9cf5080c7ddfa3153ef5dcdd5eca3c637c82cc74ca620e470a0a8d5dbc3

Download Submit
C:\Windows\System\bnMeLrI.exe

Filesize
1.8MB

MD5
9032027573af11ad836dbb4983f7dcbc

SHA1
226c911283708fe142d65b8c1fe0550da841df11

SHA256
af3e4400df1d9305dd260800961d62f3bb20400782bfd193837c095f25782eef

SHA512
90da2be7e2b2919cc476bc5cd8f15992824de7672da3863af4ff8c0c1f4729767f1fb12771b60dfc94d8b18806d508cf366508f75d991fdd56c06ec74f709ca2

Download Submit
C:\Windows\System\ekdLpMG.exe

Filesize
1.8MB

MD5
9b0038f7370015f742984335e062016e

SHA1
d0389dda35844a30869d39dcb3aa0926da948445

SHA256
097d860fd6bd8c65215c5217a2e1b7b72f8a93b897fcc80bb78cd70fe55c4f63

SHA512
6e0b10676d342084536b026c14da62d3556b6e4ad1265a365f9db52fb928141df89594a019d6a4f5a08bdc0841dfb7859b7ded5036fe253f23a6be44600012df

Download Submit
C:\Windows\System\hRRcxnZ.exe

Filesize
1.8MB

MD5
59a1b23fd0f3a90820d4e0b7d9126e77

SHA1
e5adc91c7ced3047e2614dad57b6ec8ddd9e177c

SHA256
3edb2e86d27e496fba503e5e96aa883ed8fb396d5044053b1fd1fe1a6b97945a

SHA512
c469f2efba99c235c10b4ddcc6e5ee868679a6289963c4c3d2af37891d1fd96d4aa0fa8f5bed2be9eaebe1b1c7c0b7f6cb5c9d0842d93bbcc139f6da62d01659

Download Submit
C:\Windows\System\hYdDhBE.exe

Filesize
1.8MB

MD5
6a7c3cc7b2bcaba18554080b73010453

SHA1
03bc89d58b4930dbb083da03cc004e06ae344a09

SHA256
e4b4c325d96d77810a4add5c0e5a6394ecabff42ff8eac8b433659b9f3b47613

SHA512
7354aefe8afc0c3543e14f1db929fe54a15f38e6083df80fffec62010bcbc2c6bad3212e5cab907fcf8e304cdd019d607984859570c7c80fd2203282d64dfec5

Download Submit
C:\Windows\System\jGAJIBT.exe

Filesize
1.8MB

MD5
d6d0c57c42e6cdcbaf805841daababbf

SHA1
02ed99649332eacca6f19777a5b543302cfc1135

SHA256
0e19aae4e15ffa4eaf329c0539901cddfdf395a182f84e8763f6548560c9f0b9

SHA512
076470af715aaa28ff8aefdd2c28dcd12c2fed9009c26e2d3cc21c439232877d9345d9d986dcf1a915da0d9f613c1c2a1c3cc9f99806bebc2d197bc63bb37b0d

Download Submit
C:\Windows\System\jZZQPRp.exe

Filesize
1.8MB

MD5
ae3aee916ba8612efc8f8ab57995f097

SHA1
cfbd04242dd521c2813d6aea226971193b600a98

SHA256
15d99cf6a4de9f369a537604c3b438834f19d66b20b74be3d756215f82293e06

SHA512
74259c192670dfd1cb554cdbccb125b4ac1c1f8cb09e0c21c7ab189ce63a5cf48e21dda696c4545e6b56308c64c39b2da14f199a15e812ada3cd1271f5d7d87b

Download Submit
C:\Windows\System\kEWbIWh.exe

Filesize
1.8MB

MD5
226816a81e9cafda969367c9bacfd4a7

SHA1
798aa4fedf7095c86a695615041994d5d0cb29c9

SHA256
64638e339cba3abfdd925b99750089fb3faedcedc8e55c9cdecc9c4a8cda0e14

SHA512
126c4b02fac03be66166e1108f35cd341098a380f4aafcf35cad2fd5bd63a0e35c29e31654185cc2c65340bdf476c753a975fd7569e3179a04731a174d09be7a

Download Submit
C:\Windows\System\lYVzUMT.exe

Filesize
1.8MB

MD5
caba7a079b976ae40492eafbdce5f8ac

SHA1
590544a3353f6b117d3e690d1d6027bd61a56253

SHA256
af5c79372c931755b45242b0ee3b440630d304406e06d7c96807511f85df0f7f

SHA512
b60043fba1a71526195776f9df940e19c38646187bc82a75a283d2e2267038ae4b183acb4df3f42d4598d3e4cf859b8c260cc298acc845dadbdfebf85d466314

Download Submit
C:\Windows\System\oMNBpDH.exe

Filesize
1.8MB

MD5
6941d1dd88fbebf0a773d5c5e1a0813d

SHA1
c765ad7ab176307df8e282988c47c0eac8e53cfa

SHA256
0f62620c67e76e93d770293972193bd1407a5bb1ad34e086634d9e5e5e10fef7

SHA512
372da60ba3361ebdb162a086c2aa8f387c4c8fa7ebb083f84ffd1193a3c855987875de30183be607780949c56ec85045d4aa8fc6f4d2220bc142334c98e30841

Download Submit
C:\Windows\System\obbEKjf.exe

Filesize
1.8MB

MD5
41eb2dabe9bb21f77738dd413238de50

SHA1
97be4c7b30c4c78b64add1e32f14da7660c7114a

SHA256
5fd6d2456b10d8e6e3e7359f4ff53cdb993ba62dd9b782613f403cdabede5378

SHA512
7262301de1478e8805cc0d762e76693cffc186cae92afd4524a14b26b03304c2aec8f09eacd9172a5c2d04fb0f43ce7b096fefc5fa6a2b2be98dd7c29c840bd5

Download Submit
C:\Windows\System\qqmiGfx.exe

Filesize
1.8MB

MD5
754e41aa1ec1322fae1fac020a47c9bb

SHA1
ec3a4d143e53f64d58297e074221a7d483dfe3fe

SHA256
e1e104a6c39d99941e986b9ad3430423c51873314f1f5bebaf9fd3d0792406b2

SHA512
2d4a610306e1b9f894b48a7226f45fb28e2cf7e30ef9876a087fcdb8cdc0fb408949a21ac1376a46b73a460a2f628d3e4c7630274b9899f9e4fb9425f70267db

Download Submit
C:\Windows\System\qsJQabJ.exe

Filesize
1.8MB

MD5
203c8d500430f77d8c864670ac6a4009

SHA1
51abc68b0b67c8e3471cc59a7dcdd58015efafcb

SHA256
c4c04f58cf5d22d864a19fbe2caa29f5b3118d82ac9cd5eb10e1f2faa829d741

SHA512
c939baa048fb8369cc4fa631f05f04085af2fbf24bca6b893755752207156cc288c25776ab5531544aead7ee9c259ab75d6aecb1e7025315ed801dfe444adb55

Download Submit
C:\Windows\System\sTIhded.exe

Filesize
1.8MB

MD5
91de05c94ab5bfc4326e6ad2826a651d

SHA1
21a8b4a7413d9a2ab771362ed5d61dfcb924adb4

SHA256
9e3b2f6dadefb5a50f154ca17f0a450152b4d0942121c39559633615ffe57060

SHA512
04e9bae78b5f5f1fe0629da6b10b29b869a2bddee30733f8cf91b3080735dfd120ff08784e11b1e812ea28bad9decbc001ec46116283cf208d58855829feee4b

Download Submit
C:\Windows\System\tCGCELb.exe

Filesize
1.8MB

MD5
358308c09195bf611b88103ac7351209

SHA1
cfe81c8817ab8b275c9e589d42804354c9401e02

SHA256
e24a575938145865be0640161a6109e17a2ad3075620a7f4cf05fb1188c840a3

SHA512
26d05cda0ffe524c0a5ebe972b5739ed795c56bf99f5c8344193116643e79c04b7e74c34fa873541c461224d1c435602112b575d5828c39bff78498a49d6a05d

Download Submit
C:\Windows\System\uZCaNcL.exe

Filesize
1.8MB

MD5
94e70ddfbe11245d470632ffc62ccc36

SHA1
77791a6901bfe7359132416936296c339476d14a

SHA256
6a6c0531aaa813d9ff450da59a771c073a528693016d5ce56eaf50920b08948e

SHA512
334f5fe90a1023f4d5426ec5d5bb0b1f8c48ddc990aa0c99095da1e98e51733817f2460d913f421b81e3ae46c362f5de8dc9203b4405520ceb8a728fb5defc9a

Download Submit
C:\Windows\System\uewYIGI.exe

Filesize
1.8MB

MD5
f292dc21b6eb494b76402e8dcd198b4f

SHA1
8116b3b59b44a9e0ea84281cacb777e66299f176

SHA256
bb5ae6704ff8c5cb60ae2721c5dd4dbb36c06cccba00daffd1f7e6de550972d8

SHA512
c4434ae0774cf19d452bcb7a84f65d2af08de6aeab92bc1f92becddda9681f694bf67c6bc9bf57d0b3b004406542a4069c317e5952e74e6cf387f24c10c8f81a

Download Submit
C:\Windows\System\vZIeYAU.exe

Filesize
8B

MD5
3989110bf28e1752d8354fc44aee0a5a

SHA1
2d341ede84fcdf1393cbc1c69b98173c16076de5

SHA256
ebec1be56406b8ccda98c6ae40713b17ab0e77787c03fa110b421dcd4ed20236

SHA512
05d90fae41717bc7686b0f44550f09d1b8636af054b5f3ca56692a92791caee36e681dc16ad6673b593b02851b240971a152f999e8c1a1c5d0d92fad9fcf82a2

Download Submit
C:\Windows\System\xPxEOXp.exe

Filesize
1.8MB

MD5
addb0f54435b7324c3c55f44c4eccfb5

SHA1
84c662abc0a7ed79e519d33f6af413521a58bf9e

SHA256
2ab269298e7020fb5dc9ce943bbd1837d5882f1fc630088b2067a3a724489b18

SHA512
922c1db54a8cbe197a71ea8ce136448c427d18de4bab79bad9a63f6d8607c771f1c970c212473a09b6de008e8c7dcaae988a8f568ab229a747e03544b59996d6

Download Submit
C:\Windows\System\xugoVis.exe

Filesize
1.8MB

MD5
72cc72efd7f7faaabb44d6600b4ce4b3

SHA1
d3f86d2706e1ec461d13f7302021bbf1b8e988e1

SHA256
d844ba678b37398b9ef6f6c148a81f33ab7087fc4a800ed985b607b1a63e5735

SHA512
20680bf6798b361546df0c98bd22f5990c284d7f1b77c138b4eee783657b66e91cf3d9ae67497029dbeeeec21e95abbfac67e1c05e8af7e093d692d902bb524d

Download Submit
C:\Windows\System\yJeyCgU.exe

Filesize
1.8MB

MD5
3dfe5092f77153aefdd9b0670a8c40a5

SHA1
1eb1c8686aca2a47c56388c83842da43fd8bbd93

SHA256
1c6197506cf4a7d6dc92ddb1588d1f1618a136345b5ef1676ed7148388d33e55

SHA512
06f5657e4f49047a2c438179eaaf5f1a90b29df460b739b0d444b36d314b523709caa7071f11452413fdf9552b55722ddcfa90139d9c97444a63fe7b146e999e

Download Submit
C:\Windows\System\yvMILIO.exe

Filesize
1.8MB

MD5
e5111f441b76fd5fef4797e053e4f017

SHA1
813e21b71a026f923effabab964b7dac98c8c4ea

SHA256
36d360e6e2144342814959d31456ddee3f76c2ad13c48e3292e7d9dc0b2c97e5

SHA512
1464ce19d3cd79a1ea0f1871f99c642eb3f5f092970b7e7d519cda1060580c3dccb9df5d7361b2279a9891dc324b3ed494de1910c26c807555eae0617127cc71

Download Submit
memory/432-3102-0x00007FF670DA0000-0x00007FF671192000-memory.dmp

Filesize
3.9MB

Download
memory/432-11-0x00007FF670DA0000-0x00007FF671192000-memory.dmp

Filesize
3.9MB

Download
memory/516-3150-0x00007FF67F6A0000-0x00007FF67FA92000-memory.dmp

Filesize
3.9MB

Download
memory/516-1991-0x00007FF67F6A0000-0x00007FF67FA92000-memory.dmp

Filesize
3.9MB

Download
memory/1188-91-0x0000026FF3690000-0x0000026FF36A0000-memory.dmp

Filesize
64KB

Download
memory/1188-43-0x00007FF908620000-0x00007FF9090E1000-memory.dmp

Filesize
10.8MB

Download
memory/1188-200-0x0000026FF35A0000-0x0000026FF35C2000-memory.dmp

Filesize
136KB

Download
memory/1204-120-0x00007FF62E7F0000-0x00007FF62EBE2000-memory.dmp

Filesize
3.9MB

Download
memory/1204-3115-0x00007FF62E7F0000-0x00007FF62EBE2000-memory.dmp

Filesize
3.9MB

Download
memory/1480-3133-0x00007FF7563C0000-0x00007FF7567B2000-memory.dmp

Filesize
3.9MB

Download
memory/1480-671-0x00007FF7563C0000-0x00007FF7567B2000-memory.dmp

Filesize
3.9MB

Download
memory/1560-3106-0x00007FF6235E0000-0x00007FF6239D2000-memory.dmp

Filesize
3.9MB

Download
memory/1560-62-0x00007FF6235E0000-0x00007FF6239D2000-memory.dmp

Filesize
3.9MB

Download
memory/1920-3109-0x00007FF6FFDB0000-0x00007FF7001A2000-memory.dmp

Filesize
3.9MB

Download
memory/1920-1986-0x00007FF6FFDB0000-0x00007FF7001A2000-memory.dmp

Filesize
3.9MB

Download
memory/2088-218-0x00007FF706B00000-0x00007FF706EF2000-memory.dmp

Filesize
3.9MB

Download
memory/2088-3146-0x00007FF706B00000-0x00007FF706EF2000-memory.dmp

Filesize
3.9MB

Download
memory/2096-3121-0x00007FF623240000-0x00007FF623632000-memory.dmp

Filesize
3.9MB

Download
memory/2096-415-0x00007FF623240000-0x00007FF623632000-memory.dmp

Filesize
3.9MB

Download
memory/2176-2009-0x00007FF7884F0000-0x00007FF7888E2000-memory.dmp

Filesize
3.9MB

Download
memory/2176-3134-0x00007FF7884F0000-0x00007FF7888E2000-memory.dmp

Filesize
3.9MB

Download
memory/2504-3131-0x00007FF714460000-0x00007FF714852000-memory.dmp

Filesize
3.9MB

Download
memory/2504-292-0x00007FF714460000-0x00007FF714852000-memory.dmp

Filesize
3.9MB

Download
memory/2536-84-0x00007FF6535D0000-0x00007FF6539C2000-memory.dmp

Filesize
3.9MB

Download
memory/2536-3118-0x00007FF6535D0000-0x00007FF6539C2000-memory.dmp

Filesize
3.9MB

Download
memory/2708-803-0x00007FF6C9020000-0x00007FF6C9412000-memory.dmp

Filesize
3.9MB

Download
memory/2708-3104-0x00007FF6C9020000-0x00007FF6C9412000-memory.dmp

Filesize
3.9MB

Download
memory/2932-1993-0x00007FF67E670000-0x00007FF67EA62000-memory.dmp

Filesize
3.9MB

Download
memory/2932-3129-0x00007FF67E670000-0x00007FF67EA62000-memory.dmp

Filesize
3.9MB

Download
memory/3012-3136-0x00007FF65B560000-0x00007FF65B952000-memory.dmp

Filesize
3.9MB

Download
memory/3012-243-0x00007FF65B560000-0x00007FF65B952000-memory.dmp

Filesize
3.9MB

Download
memory/3212-3144-0x00007FF6BF4B0000-0x00007FF6BF8A2000-memory.dmp

Filesize
3.9MB

Download
memory/3212-241-0x00007FF6BF4B0000-0x00007FF6BF8A2000-memory.dmp

Filesize
3.9MB

Download
memory/3268-3113-0x00007FF789320000-0x00007FF789712000-memory.dmp

Filesize
3.9MB

Download
memory/3268-123-0x00007FF789320000-0x00007FF789712000-memory.dmp

Filesize
3.9MB

Download
memory/3664-3152-0x00007FF6E2910000-0x00007FF6E2D02000-memory.dmp

Filesize
3.9MB

Download
memory/3664-463-0x00007FF6E2910000-0x00007FF6E2D02000-memory.dmp

Filesize
3.9MB

Download
memory/3852-3111-0x00007FF785810000-0x00007FF785C02000-memory.dmp

Filesize
3.9MB

Download
memory/3852-242-0x00007FF785810000-0x00007FF785C02000-memory.dmp

Filesize
3.9MB

Download
memory/4508-3141-0x00007FF797FC0000-0x00007FF7983B2000-memory.dmp

Filesize
3.9MB

Download
memory/4508-375-0x00007FF797FC0000-0x00007FF7983B2000-memory.dmp

Filesize
3.9MB

Download
memory/4516-0-0x00007FF7B6D10000-0x00007FF7B7102000-memory.dmp

Filesize
3.9MB

Download
memory/4516-1-0x0000025A2A970000-0x0000025A2A980000-memory.dmp

Filesize
64KB

Download
memory/4768-3122-0x00007FF72B320000-0x00007FF72B712000-memory.dmp

Filesize
3.9MB

Download
memory/4768-567-0x00007FF72B320000-0x00007FF72B712000-memory.dmp

Filesize
3.9MB

Download
memory/4836-169-0x00007FF68F900000-0x00007FF68FCF2000-memory.dmp

Filesize
3.9MB

Download
memory/4836-3117-0x00007FF68F900000-0x00007FF68FCF2000-memory.dmp

Filesize
3.9MB

Download