xmrig | e197bdabdf4b7a4b3aae7763dae87b4d5a835bb45dd3ace7e03fd50c51002d94

Analysis

max time kernel
63s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 01:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
Size

2.2MB
MD5

08be58b43d5253fdc67a1334f5b98f59
SHA1

1e166a225441ccb3495a030fd428137f219a2e13
SHA256

e197bdabdf4b7a4b3aae7763dae87b4d5a835bb45dd3ace7e03fd50c51002d94
SHA512

5f2de45c869e2eca32ff549d054e643eb00b9d0e7028bb37914955e6d6d6e11b5f81e8624027e1676d4ca5f6097544246950bc0ba8eb97edf77b5507d17f5835
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfA:NABn

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 41 IoCs

miner

resource	yara_rule
behavioral2/memory/3864-435-0x00007FF647080000-0x00007FF647472000-memory.dmp	xmrig
behavioral2/memory/4948-467-0x00007FF7BB6F0000-0x00007FF7BBAE2000-memory.dmp	xmrig
behavioral2/memory/2500-504-0x00007FF772B70000-0x00007FF772F62000-memory.dmp	xmrig
behavioral2/memory/692-503-0x00007FF7CD560000-0x00007FF7CD952000-memory.dmp	xmrig
behavioral2/memory/5028-502-0x00007FF611DE0000-0x00007FF6121D2000-memory.dmp	xmrig
behavioral2/memory/2192-501-0x00007FF65C9C0000-0x00007FF65CDB2000-memory.dmp	xmrig
behavioral2/memory/1140-500-0x00007FF69B8A0000-0x00007FF69BC92000-memory.dmp	xmrig
behavioral2/memory/3848-499-0x00007FF6951B0000-0x00007FF6955A2000-memory.dmp	xmrig
behavioral2/memory/3212-498-0x00007FF7C8860000-0x00007FF7C8C52000-memory.dmp	xmrig
behavioral2/memory/3808-497-0x00007FF6A4980000-0x00007FF6A4D72000-memory.dmp	xmrig
behavioral2/memory/400-381-0x00007FF69C1C0000-0x00007FF69C5B2000-memory.dmp	xmrig
behavioral2/memory/4676-379-0x00007FF6B8140000-0x00007FF6B8532000-memory.dmp	xmrig
behavioral2/memory/1180-302-0x00007FF6CAFC0000-0x00007FF6CB3B2000-memory.dmp	xmrig
behavioral2/memory/4712-329-0x00007FF753FE0000-0x00007FF7543D2000-memory.dmp	xmrig
behavioral2/memory/1720-269-0x00007FF656B70000-0x00007FF656F62000-memory.dmp	xmrig
behavioral2/memory/3388-265-0x00007FF6AF0B0000-0x00007FF6AF4A2000-memory.dmp	xmrig
behavioral2/memory/948-237-0x00007FF7A8BD0000-0x00007FF7A8FC2000-memory.dmp	xmrig
behavioral2/memory/4072-199-0x00007FF68FD60000-0x00007FF690152000-memory.dmp	xmrig
behavioral2/memory/704-153-0x00007FF7BD830000-0x00007FF7BDC22000-memory.dmp	xmrig
behavioral2/memory/4016-114-0x00007FF60DC80000-0x00007FF60E072000-memory.dmp	xmrig
behavioral2/memory/1760-4225-0x00007FF642710000-0x00007FF642B02000-memory.dmp	xmrig
behavioral2/memory/4016-4227-0x00007FF60DC80000-0x00007FF60E072000-memory.dmp	xmrig
behavioral2/memory/948-4229-0x00007FF7A8BD0000-0x00007FF7A8FC2000-memory.dmp	xmrig
behavioral2/memory/704-4231-0x00007FF7BD830000-0x00007FF7BDC22000-memory.dmp	xmrig
behavioral2/memory/4712-4233-0x00007FF753FE0000-0x00007FF7543D2000-memory.dmp	xmrig
behavioral2/memory/4676-4243-0x00007FF6B8140000-0x00007FF6B8532000-memory.dmp	xmrig
behavioral2/memory/400-4246-0x00007FF69C1C0000-0x00007FF69C5B2000-memory.dmp	xmrig
behavioral2/memory/1140-4247-0x00007FF69B8A0000-0x00007FF69BC92000-memory.dmp	xmrig
behavioral2/memory/3864-4251-0x00007FF647080000-0x00007FF647472000-memory.dmp	xmrig
behavioral2/memory/4948-4249-0x00007FF7BB6F0000-0x00007FF7BBAE2000-memory.dmp	xmrig
behavioral2/memory/4072-4241-0x00007FF68FD60000-0x00007FF690152000-memory.dmp	xmrig
behavioral2/memory/1180-4240-0x00007FF6CAFC0000-0x00007FF6CB3B2000-memory.dmp	xmrig
behavioral2/memory/3388-4237-0x00007FF6AF0B0000-0x00007FF6AF4A2000-memory.dmp	xmrig
behavioral2/memory/1720-4236-0x00007FF656B70000-0x00007FF656F62000-memory.dmp	xmrig
behavioral2/memory/3212-4270-0x00007FF7C8860000-0x00007FF7C8C52000-memory.dmp	xmrig
behavioral2/memory/692-4263-0x00007FF7CD560000-0x00007FF7CD952000-memory.dmp	xmrig
behavioral2/memory/2500-4260-0x00007FF772B70000-0x00007FF772F62000-memory.dmp	xmrig
behavioral2/memory/3808-4258-0x00007FF6A4980000-0x00007FF6A4D72000-memory.dmp	xmrig
behavioral2/memory/5028-4280-0x00007FF611DE0000-0x00007FF6121D2000-memory.dmp	xmrig
behavioral2/memory/2192-4265-0x00007FF65C9C0000-0x00007FF65CDB2000-memory.dmp	xmrig
behavioral2/memory/3848-4256-0x00007FF6951B0000-0x00007FF6955A2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1760	BmnMBBe.exe
4016	cTHyxfH.exe
704	OuIoOrm.exe
4072	eDEzrdQ.exe
948	XNDCncj.exe
3388	aTOsJmR.exe
1720	NxZaXgg.exe
1180	vsrlmSO.exe
4712	kmiLEzH.exe
4676	DdQusDP.exe
400	BYsCtUj.exe
3864	VoFcxQA.exe
4948	hxhlImy.exe
3808	rcGStNT.exe
3212	IsAhxwX.exe
3848	MDLQRUg.exe
1140	mNhMpsn.exe
2192	BmAGVlz.exe
5028	AHOahIQ.exe
692	kfRLhTj.exe
2500	AQDXxrc.exe
5044	KPOkepz.exe
4608	KbPVWQf.exe
4332	VRreCqb.exe
4220	rEMQXUo.exe
2344	VmFnmKQ.exe
3420	LZxRlYe.exe
2640	UYqHvgn.exe
3272	rHUFUqA.exe
4944	HTkVbww.exe
3376	vneDNPX.exe
4356	YrCUhoj.exe
2868	BuOhroP.exe
2232	yrkXyab.exe
1496	VnJSmLR.exe
3704	NFvfIsN.exe
3444	XJMzChf.exe
332	GbIsvFK.exe
1724	TzAyqQS.exe
2964	ZmAnJTq.exe
3544	eXFwciW.exe
444	MuLtmGC.exe
3820	SKrWNAL.exe
2812	kaucxdc.exe
2624	adjbGFB.exe
1012	ySlYtHd.exe
1612	EpUbosn.exe
4176	JlhIJgl.exe
2840	IseBMfj.exe
2368	IlfjdfA.exe
5012	VXzUIHR.exe
1992	AXzJguT.exe
3560	dIiAxyo.exe
3776	qtCQKYz.exe
4004	DXvCBfg.exe
2320	DtsHPzc.exe
3708	wYbwolF.exe
764	RRePkmC.exe
4560	TYgIEor.exe
4064	OefJULl.exe
4528	CJEhqfT.exe
1344	rSMOaaD.exe
2088	TxZRhbO.exe
2700	mwMnfFl.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4144-0-0x00007FF62AC00000-0x00007FF62AFF2000-memory.dmp	upx
behavioral2/files/0x000d000000023b87-5.dat	upx
behavioral2/files/0x000a000000023b9b-7.dat	upx
behavioral2/files/0x000a000000023bb4-132.dat	upx
behavioral2/files/0x000a000000023baa-163.dat	upx
behavioral2/memory/3864-435-0x00007FF647080000-0x00007FF647472000-memory.dmp	upx
behavioral2/memory/4948-467-0x00007FF7BB6F0000-0x00007FF7BBAE2000-memory.dmp	upx
behavioral2/memory/2500-504-0x00007FF772B70000-0x00007FF772F62000-memory.dmp	upx
behavioral2/memory/692-503-0x00007FF7CD560000-0x00007FF7CD952000-memory.dmp	upx
behavioral2/memory/5028-502-0x00007FF611DE0000-0x00007FF6121D2000-memory.dmp	upx
behavioral2/memory/2192-501-0x00007FF65C9C0000-0x00007FF65CDB2000-memory.dmp	upx
behavioral2/memory/1140-500-0x00007FF69B8A0000-0x00007FF69BC92000-memory.dmp	upx
behavioral2/memory/3848-499-0x00007FF6951B0000-0x00007FF6955A2000-memory.dmp	upx
behavioral2/memory/3212-498-0x00007FF7C8860000-0x00007FF7C8C52000-memory.dmp	upx
behavioral2/memory/3808-497-0x00007FF6A4980000-0x00007FF6A4D72000-memory.dmp	upx
behavioral2/memory/400-381-0x00007FF69C1C0000-0x00007FF69C5B2000-memory.dmp	upx
behavioral2/memory/4676-379-0x00007FF6B8140000-0x00007FF6B8532000-memory.dmp	upx
behavioral2/memory/1180-302-0x00007FF6CAFC0000-0x00007FF6CB3B2000-memory.dmp	upx
behavioral2/memory/4712-329-0x00007FF753FE0000-0x00007FF7543D2000-memory.dmp	upx
behavioral2/memory/1720-269-0x00007FF656B70000-0x00007FF656F62000-memory.dmp	upx
behavioral2/memory/3388-265-0x00007FF6AF0B0000-0x00007FF6AF4A2000-memory.dmp	upx
behavioral2/memory/948-237-0x00007FF7A8BD0000-0x00007FF7A8FC2000-memory.dmp	upx
behavioral2/files/0x000a000000023bba-190.dat	upx
behavioral2/files/0x000a000000023bc1-187.dat	upx
behavioral2/files/0x000a000000023bc0-186.dat	upx
behavioral2/files/0x000a000000023bb8-185.dat	upx
behavioral2/files/0x000a000000023bbf-184.dat	upx
behavioral2/files/0x000a000000023bac-175.dat	upx
behavioral2/files/0x0031000000023bbe-174.dat	upx
behavioral2/files/0x000a000000023bbb-168.dat	upx
behavioral2/files/0x0031000000023bbd-162.dat	upx
behavioral2/files/0x0031000000023bbc-161.dat	upx
behavioral2/files/0x000a000000023bb3-159.dat	upx
behavioral2/memory/4072-199-0x00007FF68FD60000-0x00007FF690152000-memory.dmp	upx
behavioral2/files/0x000a000000023ba8-156.dat	upx
behavioral2/files/0x000a000000023ba7-149.dat	upx
behavioral2/files/0x000a000000023ba6-148.dat	upx
behavioral2/files/0x000a000000023bb9-145.dat	upx
behavioral2/files/0x000a000000023bb6-183.dat	upx
behavioral2/files/0x000a000000023bad-178.dat	upx
behavioral2/files/0x000a000000023bb5-137.dat	upx
behavioral2/files/0x000a000000023ba5-128.dat	upx
behavioral2/files/0x000a000000023ba4-125.dat	upx
behavioral2/files/0x000a000000023bb2-123.dat	upx
behavioral2/files/0x000a000000023ba3-121.dat	upx
behavioral2/files/0x000a000000023bb1-120.dat	upx
behavioral2/files/0x000a000000023bb0-119.dat	upx
behavioral2/memory/704-153-0x00007FF7BD830000-0x00007FF7BDC22000-memory.dmp	upx
behavioral2/memory/4016-114-0x00007FF60DC80000-0x00007FF60E072000-memory.dmp	upx
behavioral2/files/0x000a000000023b9f-102.dat	upx
behavioral2/files/0x000a000000023bb7-140.dat	upx
behavioral2/files/0x000a000000023bae-100.dat	upx
behavioral2/files/0x000a000000023bab-95.dat	upx
behavioral2/files/0x000a000000023ba9-86.dat	upx
behavioral2/files/0x000a000000023ba2-75.dat	upx
behavioral2/files/0x000a000000023baf-118.dat	upx
behavioral2/files/0x000a000000023ba1-108.dat	upx
behavioral2/files/0x000a000000023b9e-62.dat	upx
behavioral2/files/0x000a000000023ba0-56.dat	upx
behavioral2/files/0x000a000000023b9d-48.dat	upx
behavioral2/files/0x000a000000023b9c-47.dat	upx
behavioral2/files/0x000b000000023b95-25.dat	upx
behavioral2/memory/1760-13-0x00007FF642710000-0x00007FF642B02000-memory.dmp	upx
behavioral2/memory/1760-4225-0x00007FF642710000-0x00007FF642B02000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\geSXCJe.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\CbUCbkF.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\FbAUmLO.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\DmTpKOK.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\mssrMed.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\LiYDmlr.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\SxjUZeK.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\oDzoLZF.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\ARSMlXR.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\DBzbSpc.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\ueHJFue.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\peSjJrC.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\ZjqOJMG.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\UiQYUpe.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\QCyalGY.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\dGuOBui.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\ZvNnjVc.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\ZImnpvr.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\JdjjJBS.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\XkWfeAA.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\BEwOTfU.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\ztavkRy.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\XhHDAtV.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\fDLFhrU.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\XxKGhyd.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\IMLVnLo.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\rorVyoi.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\vbUfCAE.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\TcgtMzP.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\AsUcVjl.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\rEIKjjO.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\jwRtSmh.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\TxZRhbO.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\wwXrlFC.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\NUUBULw.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\pOmCvWD.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\LFOZeHA.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\hRayQUQ.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\XNpPXYx.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\SzRrhVy.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\fhOghrA.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\vsSdXiT.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\EYaIyMf.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\hHevCVl.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\nXjutuV.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\CrbCVLS.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\OWKfqMW.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\jHFVfDR.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\HMIHtYK.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\zoUMLUR.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\pJZUDKC.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\mTEsaRa.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\oJNrLGH.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\SzMBysy.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\gDTDBUr.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\Gxprftj.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\wGaZZAh.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\YdLHGGD.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\uBgBtoj.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\aTJxFhi.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\RvhFiqw.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\UtVxQHL.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\UzPTFuf.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\cbKffRK.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4796	powershell.exe
4796	powershell.exe
4796	powershell.exe
4796	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4796	powershell.exe
Token: SeLockMemoryPrivilege	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 4796	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	84
PID 4144 wrote to memory of 4796	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	84
PID 4144 wrote to memory of 1760	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	85
PID 4144 wrote to memory of 1760	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	85
PID 4144 wrote to memory of 4016	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	86
PID 4144 wrote to memory of 4016	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	86
PID 4144 wrote to memory of 3388	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	87
PID 4144 wrote to memory of 3388	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	87
PID 4144 wrote to memory of 704	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	88
PID 4144 wrote to memory of 704	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	88
PID 4144 wrote to memory of 4072	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	89
PID 4144 wrote to memory of 4072	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	89
PID 4144 wrote to memory of 948	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	90
PID 4144 wrote to memory of 948	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	90
PID 4144 wrote to memory of 1720	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	91
PID 4144 wrote to memory of 1720	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	91
PID 4144 wrote to memory of 1180	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	92
PID 4144 wrote to memory of 1180	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	92
PID 4144 wrote to memory of 4712	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	93
PID 4144 wrote to memory of 4712	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	93
PID 4144 wrote to memory of 4676	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	94
PID 4144 wrote to memory of 4676	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	94
PID 4144 wrote to memory of 400	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	95
PID 4144 wrote to memory of 400	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	95
PID 4144 wrote to memory of 3864	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	96
PID 4144 wrote to memory of 3864	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	96
PID 4144 wrote to memory of 4948	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	97
PID 4144 wrote to memory of 4948	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	97
PID 4144 wrote to memory of 3808	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	98
PID 4144 wrote to memory of 3808	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	98
PID 4144 wrote to memory of 3212	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	99
PID 4144 wrote to memory of 3212	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	99
PID 4144 wrote to memory of 3848	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	100
PID 4144 wrote to memory of 3848	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	100
PID 4144 wrote to memory of 1140	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	101
PID 4144 wrote to memory of 1140	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	101
PID 4144 wrote to memory of 2192	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	102
PID 4144 wrote to memory of 2192	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	102
PID 4144 wrote to memory of 5028	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	103
PID 4144 wrote to memory of 5028	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	103
PID 4144 wrote to memory of 692	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	104
PID 4144 wrote to memory of 692	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	104
PID 4144 wrote to memory of 2500	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	105
PID 4144 wrote to memory of 2500	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	105
PID 4144 wrote to memory of 5044	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	106
PID 4144 wrote to memory of 5044	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	106
PID 4144 wrote to memory of 4608	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	107
PID 4144 wrote to memory of 4608	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	107
PID 4144 wrote to memory of 4332	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	108
PID 4144 wrote to memory of 4332	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	108
PID 4144 wrote to memory of 4220	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	109
PID 4144 wrote to memory of 4220	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	109
PID 4144 wrote to memory of 2344	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	110
PID 4144 wrote to memory of 2344	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	110
PID 4144 wrote to memory of 3376	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	111
PID 4144 wrote to memory of 3376	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	111
PID 4144 wrote to memory of 3420	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	112
PID 4144 wrote to memory of 3420	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	112
PID 4144 wrote to memory of 2640	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	113
PID 4144 wrote to memory of 2640	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	113
PID 4144 wrote to memory of 3704	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	114
PID 4144 wrote to memory of 3704	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	114
PID 4144 wrote to memory of 3272	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	115
PID 4144 wrote to memory of 3272	4144	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4796
- C:\Windows\System\BmnMBBe.exe
  C:\Windows\System\BmnMBBe.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\cTHyxfH.exe
  C:\Windows\System\cTHyxfH.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\aTOsJmR.exe
  C:\Windows\System\aTOsJmR.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\OuIoOrm.exe
  C:\Windows\System\OuIoOrm.exe
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Windows\System\eDEzrdQ.exe
  C:\Windows\System\eDEzrdQ.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\XNDCncj.exe
  C:\Windows\System\XNDCncj.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\NxZaXgg.exe
  C:\Windows\System\NxZaXgg.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\vsrlmSO.exe
  C:\Windows\System\vsrlmSO.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\kmiLEzH.exe
  C:\Windows\System\kmiLEzH.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\DdQusDP.exe
  C:\Windows\System\DdQusDP.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\BYsCtUj.exe
  C:\Windows\System\BYsCtUj.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\VoFcxQA.exe
  C:\Windows\System\VoFcxQA.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System\hxhlImy.exe
  C:\Windows\System\hxhlImy.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\rcGStNT.exe
  C:\Windows\System\rcGStNT.exe
  2⤵
  - Executes dropped EXE
  PID:3808
- C:\Windows\System\IsAhxwX.exe
  C:\Windows\System\IsAhxwX.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\MDLQRUg.exe
  C:\Windows\System\MDLQRUg.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System\mNhMpsn.exe
  C:\Windows\System\mNhMpsn.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\BmAGVlz.exe
  C:\Windows\System\BmAGVlz.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\AHOahIQ.exe
  C:\Windows\System\AHOahIQ.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\kfRLhTj.exe
  C:\Windows\System\kfRLhTj.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\AQDXxrc.exe
  C:\Windows\System\AQDXxrc.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\KPOkepz.exe
  C:\Windows\System\KPOkepz.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\KbPVWQf.exe
  C:\Windows\System\KbPVWQf.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\VRreCqb.exe
  C:\Windows\System\VRreCqb.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\rEMQXUo.exe
  C:\Windows\System\rEMQXUo.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\VmFnmKQ.exe
  C:\Windows\System\VmFnmKQ.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\vneDNPX.exe
  C:\Windows\System\vneDNPX.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\LZxRlYe.exe
  C:\Windows\System\LZxRlYe.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\UYqHvgn.exe
  C:\Windows\System\UYqHvgn.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\NFvfIsN.exe
  C:\Windows\System\NFvfIsN.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\rHUFUqA.exe
  C:\Windows\System\rHUFUqA.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\GbIsvFK.exe
  C:\Windows\System\GbIsvFK.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\HTkVbww.exe
  C:\Windows\System\HTkVbww.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\eXFwciW.exe
  C:\Windows\System\eXFwciW.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\YrCUhoj.exe
  C:\Windows\System\YrCUhoj.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\BuOhroP.exe
  C:\Windows\System\BuOhroP.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\yrkXyab.exe
  C:\Windows\System\yrkXyab.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\VnJSmLR.exe
  C:\Windows\System\VnJSmLR.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\XJMzChf.exe
  C:\Windows\System\XJMzChf.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\TzAyqQS.exe
  C:\Windows\System\TzAyqQS.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\ZmAnJTq.exe
  C:\Windows\System\ZmAnJTq.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\MuLtmGC.exe
  C:\Windows\System\MuLtmGC.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System\SKrWNAL.exe
  C:\Windows\System\SKrWNAL.exe
  2⤵
  - Executes dropped EXE
  PID:3820
- C:\Windows\System\kaucxdc.exe
  C:\Windows\System\kaucxdc.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\adjbGFB.exe
  C:\Windows\System\adjbGFB.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\DXvCBfg.exe
  C:\Windows\System\DXvCBfg.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\ySlYtHd.exe
  C:\Windows\System\ySlYtHd.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\EpUbosn.exe
  C:\Windows\System\EpUbosn.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\JlhIJgl.exe
  C:\Windows\System\JlhIJgl.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\IseBMfj.exe
  C:\Windows\System\IseBMfj.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\IlfjdfA.exe
  C:\Windows\System\IlfjdfA.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\VXzUIHR.exe
  C:\Windows\System\VXzUIHR.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\AXzJguT.exe
  C:\Windows\System\AXzJguT.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\dIiAxyo.exe
  C:\Windows\System\dIiAxyo.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\qtCQKYz.exe
  C:\Windows\System\qtCQKYz.exe
  2⤵
  - Executes dropped EXE
  PID:3776
- C:\Windows\System\DtsHPzc.exe
  C:\Windows\System\DtsHPzc.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\wYbwolF.exe
  C:\Windows\System\wYbwolF.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\RRePkmC.exe
  C:\Windows\System\RRePkmC.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\TYgIEor.exe
  C:\Windows\System\TYgIEor.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\OefJULl.exe
  C:\Windows\System\OefJULl.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\CJEhqfT.exe
  C:\Windows\System\CJEhqfT.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\rSMOaaD.exe
  C:\Windows\System\rSMOaaD.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\rkVDAHq.exe
  C:\Windows\System\rkVDAHq.exe
  2⤵
  PID:2564
- C:\Windows\System\TxZRhbO.exe
  C:\Windows\System\TxZRhbO.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\KaVixTv.exe
  C:\Windows\System\KaVixTv.exe
  2⤵
  PID:1700
- C:\Windows\System\mwMnfFl.exe
  C:\Windows\System\mwMnfFl.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\UHvwybU.exe
  C:\Windows\System\UHvwybU.exe
  2⤵
  PID:4432
- C:\Windows\System\oVLWieQ.exe
  C:\Windows\System\oVLWieQ.exe
  2⤵
  PID:1516
- C:\Windows\System\DDgYlXz.exe
  C:\Windows\System\DDgYlXz.exe
  2⤵
  PID:2300
- C:\Windows\System\OcJSLSj.exe
  C:\Windows\System\OcJSLSj.exe
  2⤵
  PID:4268
- C:\Windows\System\sEhfzwu.exe
  C:\Windows\System\sEhfzwu.exe
  2⤵
  PID:2704
- C:\Windows\System\tQIiLsj.exe
  C:\Windows\System\tQIiLsj.exe
  2⤵
  PID:4784
- C:\Windows\System\jDpMuUq.exe
  C:\Windows\System\jDpMuUq.exe
  2⤵
  PID:4400
- C:\Windows\System\URYjvTV.exe
  C:\Windows\System\URYjvTV.exe
  2⤵
  PID:1924
- C:\Windows\System\gAvjqPN.exe
  C:\Windows\System\gAvjqPN.exe
  2⤵
  PID:3508
- C:\Windows\System\JGUTzwg.exe
  C:\Windows\System\JGUTzwg.exe
  2⤵
  PID:1740
- C:\Windows\System\StDSuhb.exe
  C:\Windows\System\StDSuhb.exe
  2⤵
  PID:2452
- C:\Windows\System\QjooBqQ.exe
  C:\Windows\System\QjooBqQ.exe
  2⤵
  PID:4148
- C:\Windows\System\rRMwZIy.exe
  C:\Windows\System\rRMwZIy.exe
  2⤵
  PID:5136
- C:\Windows\System\pRoENGP.exe
  C:\Windows\System\pRoENGP.exe
  2⤵
  PID:5156
- C:\Windows\System\IZWThmJ.exe
  C:\Windows\System\IZWThmJ.exe
  2⤵
  PID:5172
- C:\Windows\System\UoXSGUc.exe
  C:\Windows\System\UoXSGUc.exe
  2⤵
  PID:5188
- C:\Windows\System\MNzuSge.exe
  C:\Windows\System\MNzuSge.exe
  2⤵
  PID:5208
- C:\Windows\System\xxZogNh.exe
  C:\Windows\System\xxZogNh.exe
  2⤵
  PID:5224
- C:\Windows\System\cbwgJVq.exe
  C:\Windows\System\cbwgJVq.exe
  2⤵
  PID:5292
- C:\Windows\System\fbPypRY.exe
  C:\Windows\System\fbPypRY.exe
  2⤵
  PID:5320
- C:\Windows\System\zzgBilE.exe
  C:\Windows\System\zzgBilE.exe
  2⤵
  PID:5344
- C:\Windows\System\vBFcONl.exe
  C:\Windows\System\vBFcONl.exe
  2⤵
  PID:5364
- C:\Windows\System\gCXwmCC.exe
  C:\Windows\System\gCXwmCC.exe
  2⤵
  PID:5384
- C:\Windows\System\SHUnVEK.exe
  C:\Windows\System\SHUnVEK.exe
  2⤵
  PID:5408
- C:\Windows\System\zdAvGtj.exe
  C:\Windows\System\zdAvGtj.exe
  2⤵
  PID:5432
- C:\Windows\System\yrlfEKV.exe
  C:\Windows\System\yrlfEKV.exe
  2⤵
  PID:5452
- C:\Windows\System\hcuqUlB.exe
  C:\Windows\System\hcuqUlB.exe
  2⤵
  PID:5476
- C:\Windows\System\ARSMlXR.exe
  C:\Windows\System\ARSMlXR.exe
  2⤵
  PID:5500
- C:\Windows\System\XlguDfh.exe
  C:\Windows\System\XlguDfh.exe
  2⤵
  PID:5516
- C:\Windows\System\OZmtEMF.exe
  C:\Windows\System\OZmtEMF.exe
  2⤵
  PID:5664
- C:\Windows\System\JdjjJBS.exe
  C:\Windows\System\JdjjJBS.exe
  2⤵
  PID:5680
- C:\Windows\System\KjAIlMe.exe
  C:\Windows\System\KjAIlMe.exe
  2⤵
  PID:5732
- C:\Windows\System\oilCYVV.exe
  C:\Windows\System\oilCYVV.exe
  2⤵
  PID:5768
- C:\Windows\System\EfSgVPH.exe
  C:\Windows\System\EfSgVPH.exe
  2⤵
  PID:5792
- C:\Windows\System\WRJkVSy.exe
  C:\Windows\System\WRJkVSy.exe
  2⤵
  PID:5820
- C:\Windows\System\hQAHzBy.exe
  C:\Windows\System\hQAHzBy.exe
  2⤵
  PID:5840
- C:\Windows\System\cAAnJWF.exe
  C:\Windows\System\cAAnJWF.exe
  2⤵
  PID:5856
- C:\Windows\System\HayRyii.exe
  C:\Windows\System\HayRyii.exe
  2⤵
  PID:5880
- C:\Windows\System\XjuGWBA.exe
  C:\Windows\System\XjuGWBA.exe
  2⤵
  PID:5900
- C:\Windows\System\YTLLiAA.exe
  C:\Windows\System\YTLLiAA.exe
  2⤵
  PID:5928
- C:\Windows\System\MUWHHKG.exe
  C:\Windows\System\MUWHHKG.exe
  2⤵
  PID:5948
- C:\Windows\System\KoYmWKE.exe
  C:\Windows\System\KoYmWKE.exe
  2⤵
  PID:5964
- C:\Windows\System\tYjynRR.exe
  C:\Windows\System\tYjynRR.exe
  2⤵
  PID:5992
- C:\Windows\System\SzRrhVy.exe
  C:\Windows\System\SzRrhVy.exe
  2⤵
  PID:6016
- C:\Windows\System\duiXiLi.exe
  C:\Windows\System\duiXiLi.exe
  2⤵
  PID:6036
- C:\Windows\System\xxJjsez.exe
  C:\Windows\System\xxJjsez.exe
  2⤵
  PID:6052
- C:\Windows\System\oXkAKaJ.exe
  C:\Windows\System\oXkAKaJ.exe
  2⤵
  PID:6080
- C:\Windows\System\xZXCXzj.exe
  C:\Windows\System\xZXCXzj.exe
  2⤵
  PID:6100
- C:\Windows\System\JrKQhDp.exe
  C:\Windows\System\JrKQhDp.exe
  2⤵
  PID:6116
- C:\Windows\System\zzcLEcd.exe
  C:\Windows\System\zzcLEcd.exe
  2⤵
  PID:1512
- C:\Windows\System\XUsGluy.exe
  C:\Windows\System\XUsGluy.exe
  2⤵
  PID:5080
- C:\Windows\System\LqVmmlX.exe
  C:\Windows\System\LqVmmlX.exe
  2⤵
  PID:2096
- C:\Windows\System\tBaPKaA.exe
  C:\Windows\System\tBaPKaA.exe
  2⤵
  PID:4904
- C:\Windows\System\CFYXNbR.exe
  C:\Windows\System\CFYXNbR.exe
  2⤵
  PID:2740
- C:\Windows\System\siOyelL.exe
  C:\Windows\System\siOyelL.exe
  2⤵
  PID:1176
- C:\Windows\System\WstHjty.exe
  C:\Windows\System\WstHjty.exe
  2⤵
  PID:3400
- C:\Windows\System\DnmchTE.exe
  C:\Windows\System\DnmchTE.exe
  2⤵
  PID:4392
- C:\Windows\System\XReWLJU.exe
  C:\Windows\System\XReWLJU.exe
  2⤵
  PID:544
- C:\Windows\System\UVKmNoU.exe
  C:\Windows\System\UVKmNoU.exe
  2⤵
  PID:1372
- C:\Windows\System\MTWqiGI.exe
  C:\Windows\System\MTWqiGI.exe
  2⤵
  PID:1164
- C:\Windows\System\AwdRBIx.exe
  C:\Windows\System\AwdRBIx.exe
  2⤵
  PID:4876
- C:\Windows\System\rorVyoi.exe
  C:\Windows\System\rorVyoi.exe
  2⤵
  PID:432
- C:\Windows\System\ACQhhTz.exe
  C:\Windows\System\ACQhhTz.exe
  2⤵
  PID:4568
- C:\Windows\System\ErpJbXo.exe
  C:\Windows\System\ErpJbXo.exe
  2⤵
  PID:4684
- C:\Windows\System\mikUosB.exe
  C:\Windows\System\mikUosB.exe
  2⤵
  PID:5164
- C:\Windows\System\spfOOYC.exe
  C:\Windows\System\spfOOYC.exe
  2⤵
  PID:5760
- C:\Windows\System\rxpIJFE.exe
  C:\Windows\System\rxpIJFE.exe
  2⤵
  PID:5828
- C:\Windows\System\jQlcGAj.exe
  C:\Windows\System\jQlcGAj.exe
  2⤵
  PID:5864
- C:\Windows\System\AvUTeOM.exe
  C:\Windows\System\AvUTeOM.exe
  2⤵
  PID:5956
- C:\Windows\System\OCwfZzH.exe
  C:\Windows\System\OCwfZzH.exe
  2⤵
  PID:5280
- C:\Windows\System\gAzCTLR.exe
  C:\Windows\System\gAzCTLR.exe
  2⤵
  PID:5336
- C:\Windows\System\szEUrDw.exe
  C:\Windows\System\szEUrDw.exe
  2⤵
  PID:5380
- C:\Windows\System\LPaHIDi.exe
  C:\Windows\System\LPaHIDi.exe
  2⤵
  PID:5468
- C:\Windows\System\PsyoAaF.exe
  C:\Windows\System\PsyoAaF.exe
  2⤵
  PID:848
- C:\Windows\System\qHRLNSb.exe
  C:\Windows\System\qHRLNSb.exe
  2⤵
  PID:4552
- C:\Windows\System\yTJwMFt.exe
  C:\Windows\System\yTJwMFt.exe
  2⤵
  PID:5564
- C:\Windows\System\HsudzoZ.exe
  C:\Windows\System\HsudzoZ.exe
  2⤵
  PID:5588
- C:\Windows\System\JykoxKM.exe
  C:\Windows\System\JykoxKM.exe
  2⤵
  PID:4648
- C:\Windows\System\jmyvMbs.exe
  C:\Windows\System\jmyvMbs.exe
  2⤵
  PID:1216
- C:\Windows\System\CsDhAUE.exe
  C:\Windows\System\CsDhAUE.exe
  2⤵
  PID:6032
- C:\Windows\System\fDEmckx.exe
  C:\Windows\System\fDEmckx.exe
  2⤵
  PID:6152
- C:\Windows\System\cGfIqJv.exe
  C:\Windows\System\cGfIqJv.exe
  2⤵
  PID:6168
- C:\Windows\System\XFWxWgT.exe
  C:\Windows\System\XFWxWgT.exe
  2⤵
  PID:6200
- C:\Windows\System\BDnxojO.exe
  C:\Windows\System\BDnxojO.exe
  2⤵
  PID:6216
- C:\Windows\System\xErGCtN.exe
  C:\Windows\System\xErGCtN.exe
  2⤵
  PID:6236
- C:\Windows\System\kYEHuNV.exe
  C:\Windows\System\kYEHuNV.exe
  2⤵
  PID:6252
- C:\Windows\System\jkFRcPw.exe
  C:\Windows\System\jkFRcPw.exe
  2⤵
  PID:6268
- C:\Windows\System\bnfLVOH.exe
  C:\Windows\System\bnfLVOH.exe
  2⤵
  PID:6288
- C:\Windows\System\zaOrHXp.exe
  C:\Windows\System\zaOrHXp.exe
  2⤵
  PID:6408
- C:\Windows\System\lyvWVid.exe
  C:\Windows\System\lyvWVid.exe
  2⤵
  PID:6424
- C:\Windows\System\VDicaOR.exe
  C:\Windows\System\VDicaOR.exe
  2⤵
  PID:6440
- C:\Windows\System\QeTPJAC.exe
  C:\Windows\System\QeTPJAC.exe
  2⤵
  PID:6456
- C:\Windows\System\EXFgBfm.exe
  C:\Windows\System\EXFgBfm.exe
  2⤵
  PID:6472
- C:\Windows\System\FWoeSbh.exe
  C:\Windows\System\FWoeSbh.exe
  2⤵
  PID:6488
- C:\Windows\System\LbsTywo.exe
  C:\Windows\System\LbsTywo.exe
  2⤵
  PID:6504
- C:\Windows\System\WycTrrh.exe
  C:\Windows\System\WycTrrh.exe
  2⤵
  PID:6520
- C:\Windows\System\KwkzYjB.exe
  C:\Windows\System\KwkzYjB.exe
  2⤵
  PID:6536
- C:\Windows\System\kZPNmoL.exe
  C:\Windows\System\kZPNmoL.exe
  2⤵
  PID:6552
- C:\Windows\System\CligqbQ.exe
  C:\Windows\System\CligqbQ.exe
  2⤵
  PID:6568
- C:\Windows\System\CXpxHCU.exe
  C:\Windows\System\CXpxHCU.exe
  2⤵
  PID:6584
- C:\Windows\System\nsRFctj.exe
  C:\Windows\System\nsRFctj.exe
  2⤵
  PID:6728
- C:\Windows\System\tsJXPlB.exe
  C:\Windows\System\tsJXPlB.exe
  2⤵
  PID:6744
- C:\Windows\System\OAbQfSI.exe
  C:\Windows\System\OAbQfSI.exe
  2⤵
  PID:6760
- C:\Windows\System\TTvrTaY.exe
  C:\Windows\System\TTvrTaY.exe
  2⤵
  PID:6776
- C:\Windows\System\qBiUOoQ.exe
  C:\Windows\System\qBiUOoQ.exe
  2⤵
  PID:6800
- C:\Windows\System\mullPdx.exe
  C:\Windows\System\mullPdx.exe
  2⤵
  PID:6864
- C:\Windows\System\KtzwZCg.exe
  C:\Windows\System\KtzwZCg.exe
  2⤵
  PID:6904
- C:\Windows\System\DrcCYOD.exe
  C:\Windows\System\DrcCYOD.exe
  2⤵
  PID:6932
- C:\Windows\System\WitZWmX.exe
  C:\Windows\System\WitZWmX.exe
  2⤵
  PID:6952
- C:\Windows\System\tLmiBfW.exe
  C:\Windows\System\tLmiBfW.exe
  2⤵
  PID:6968
- C:\Windows\System\MlQFDqJ.exe
  C:\Windows\System\MlQFDqJ.exe
  2⤵
  PID:6988
- C:\Windows\System\oIZDAXu.exe
  C:\Windows\System\oIZDAXu.exe
  2⤵
  PID:7008
- C:\Windows\System\OohGOQP.exe
  C:\Windows\System\OohGOQP.exe
  2⤵
  PID:7028
- C:\Windows\System\TTnHAwx.exe
  C:\Windows\System\TTnHAwx.exe
  2⤵
  PID:7048
- C:\Windows\System\ODqvGXs.exe
  C:\Windows\System\ODqvGXs.exe
  2⤵
  PID:7064
- C:\Windows\System\hwlKCKj.exe
  C:\Windows\System\hwlKCKj.exe
  2⤵
  PID:7084
- C:\Windows\System\KSkzVTd.exe
  C:\Windows\System\KSkzVTd.exe
  2⤵
  PID:7104
- C:\Windows\System\EHcndfw.exe
  C:\Windows\System\EHcndfw.exe
  2⤵
  PID:7120
- C:\Windows\System\JULaYvt.exe
  C:\Windows\System\JULaYvt.exe
  2⤵
  PID:7136
- C:\Windows\System\GRdPHqE.exe
  C:\Windows\System\GRdPHqE.exe
  2⤵
  PID:7152
- C:\Windows\System\SRQsvoX.exe
  C:\Windows\System\SRQsvoX.exe
  2⤵
  PID:5196
- C:\Windows\System\dsngkDs.exe
  C:\Windows\System\dsngkDs.exe
  2⤵
  PID:5640
- C:\Windows\System\WfAGRaf.exe
  C:\Windows\System\WfAGRaf.exe
  2⤵
  PID:2216
- C:\Windows\System\XkWfeAA.exe
  C:\Windows\System\XkWfeAA.exe
  2⤵
  PID:5692
- C:\Windows\System\FhYURXs.exe
  C:\Windows\System\FhYURXs.exe
  2⤵
  PID:5848
- C:\Windows\System\ZuEKhez.exe
  C:\Windows\System\ZuEKhez.exe
  2⤵
  PID:5908
- C:\Windows\System\PfOdnpz.exe
  C:\Windows\System\PfOdnpz.exe
  2⤵
  PID:6044
- C:\Windows\System\apPyYrx.exe
  C:\Windows\System\apPyYrx.exe
  2⤵
  PID:6072
- C:\Windows\System\mXVLGmQ.exe
  C:\Windows\System\mXVLGmQ.exe
  2⤵
  PID:6132
- C:\Windows\System\cBCoxoU.exe
  C:\Windows\System\cBCoxoU.exe
  2⤵
  PID:4304
- C:\Windows\System\GjekDEH.exe
  C:\Windows\System\GjekDEH.exe
  2⤵
  PID:1840
- C:\Windows\System\xgnjzUm.exe
  C:\Windows\System\xgnjzUm.exe
  2⤵
  PID:364
- C:\Windows\System\NTEXTDf.exe
  C:\Windows\System\NTEXTDf.exe
  2⤵
  PID:5496
- C:\Windows\System\yTsDIiQ.exe
  C:\Windows\System\yTsDIiQ.exe
  2⤵
  PID:5216
- C:\Windows\System\pVuuHFk.exe
  C:\Windows\System\pVuuHFk.exe
  2⤵
  PID:5304
- C:\Windows\System\qkUVBLa.exe
  C:\Windows\System\qkUVBLa.exe
  2⤵
  PID:5596
- C:\Windows\System\MJpkTAJ.exe
  C:\Windows\System\MJpkTAJ.exe
  2⤵
  PID:3892
- C:\Windows\System\BeiasrZ.exe
  C:\Windows\System\BeiasrZ.exe
  2⤵
  PID:6028
- C:\Windows\System\JLHzqTI.exe
  C:\Windows\System\JLHzqTI.exe
  2⤵
  PID:1412
- C:\Windows\System\FLvyvTT.exe
  C:\Windows\System\FLvyvTT.exe
  2⤵
  PID:5572
- C:\Windows\System\IKOHBqA.exe
  C:\Windows\System\IKOHBqA.exe
  2⤵
  PID:1424
- C:\Windows\System\oJNrLGH.exe
  C:\Windows\System\oJNrLGH.exe
  2⤵
  PID:6148
- C:\Windows\System\MTXhXye.exe
  C:\Windows\System\MTXhXye.exe
  2⤵
  PID:6212
- C:\Windows\System\nCaErIi.exe
  C:\Windows\System\nCaErIi.exe
  2⤵
  PID:6264
- C:\Windows\System\CiJBbpf.exe
  C:\Windows\System\CiJBbpf.exe
  2⤵
  PID:6276
- C:\Windows\System\DlfcyVl.exe
  C:\Windows\System\DlfcyVl.exe
  2⤵
  PID:6512
- C:\Windows\System\JyoORrR.exe
  C:\Windows\System\JyoORrR.exe
  2⤵
  PID:6560
- C:\Windows\System\YDsRlDI.exe
  C:\Windows\System\YDsRlDI.exe
  2⤵
  PID:7176
- C:\Windows\System\gNEywri.exe
  C:\Windows\System\gNEywri.exe
  2⤵
  PID:7200
- C:\Windows\System\cquRkpj.exe
  C:\Windows\System\cquRkpj.exe
  2⤵
  PID:7216
- C:\Windows\System\zXNbdeS.exe
  C:\Windows\System\zXNbdeS.exe
  2⤵
  PID:7232
- C:\Windows\System\KGqDqpq.exe
  C:\Windows\System\KGqDqpq.exe
  2⤵
  PID:7264
- C:\Windows\System\VpNOyuB.exe
  C:\Windows\System\VpNOyuB.exe
  2⤵
  PID:7292
- C:\Windows\System\qiDjyIY.exe
  C:\Windows\System\qiDjyIY.exe
  2⤵
  PID:7308
- C:\Windows\System\gYOiEwL.exe
  C:\Windows\System\gYOiEwL.exe
  2⤵
  PID:7340
- C:\Windows\System\GQiXxzG.exe
  C:\Windows\System\GQiXxzG.exe
  2⤵
  PID:7368
- C:\Windows\System\jepIvGz.exe
  C:\Windows\System\jepIvGz.exe
  2⤵
  PID:7392
- C:\Windows\System\bdlSFEs.exe
  C:\Windows\System\bdlSFEs.exe
  2⤵
  PID:7408
- C:\Windows\System\nijUzab.exe
  C:\Windows\System\nijUzab.exe
  2⤵
  PID:7432
- C:\Windows\System\kvDROHt.exe
  C:\Windows\System\kvDROHt.exe
  2⤵
  PID:7456
- C:\Windows\System\sNjkaFv.exe
  C:\Windows\System\sNjkaFv.exe
  2⤵
  PID:7476
- C:\Windows\System\xATbvEX.exe
  C:\Windows\System\xATbvEX.exe
  2⤵
  PID:7500
- C:\Windows\System\MPLTzRg.exe
  C:\Windows\System\MPLTzRg.exe
  2⤵
  PID:7520
- C:\Windows\System\ElYhHZe.exe
  C:\Windows\System\ElYhHZe.exe
  2⤵
  PID:7540
- C:\Windows\System\yMVlFTG.exe
  C:\Windows\System\yMVlFTG.exe
  2⤵
  PID:7568
- C:\Windows\System\TwPlhxt.exe
  C:\Windows\System\TwPlhxt.exe
  2⤵
  PID:7584
- C:\Windows\System\CKtHHVX.exe
  C:\Windows\System\CKtHHVX.exe
  2⤵
  PID:7608
- C:\Windows\System\qCjsRhP.exe
  C:\Windows\System\qCjsRhP.exe
  2⤵
  PID:7632
- C:\Windows\System\IUxwxHA.exe
  C:\Windows\System\IUxwxHA.exe
  2⤵
  PID:7652
- C:\Windows\System\LtoDLwV.exe
  C:\Windows\System\LtoDLwV.exe
  2⤵
  PID:7676
- C:\Windows\System\nBsGEns.exe
  C:\Windows\System\nBsGEns.exe
  2⤵
  PID:7696
- C:\Windows\System\InGbSpF.exe
  C:\Windows\System\InGbSpF.exe
  2⤵
  PID:7712
- C:\Windows\System\EgSMFTc.exe
  C:\Windows\System\EgSMFTc.exe
  2⤵
  PID:7736
- C:\Windows\System\LMLJbWW.exe
  C:\Windows\System\LMLJbWW.exe
  2⤵
  PID:7764
- C:\Windows\System\tdrEjUC.exe
  C:\Windows\System\tdrEjUC.exe
  2⤵
  PID:7784
- C:\Windows\System\fOfgNQw.exe
  C:\Windows\System\fOfgNQw.exe
  2⤵
  PID:7808
- C:\Windows\System\KXpDLdI.exe
  C:\Windows\System\KXpDLdI.exe
  2⤵
  PID:7824
- C:\Windows\System\zIwoWvZ.exe
  C:\Windows\System\zIwoWvZ.exe
  2⤵
  PID:7840
- C:\Windows\System\reIXZtr.exe
  C:\Windows\System\reIXZtr.exe
  2⤵
  PID:7864
- C:\Windows\System\QTkztWH.exe
  C:\Windows\System\QTkztWH.exe
  2⤵
  PID:7888
- C:\Windows\System\kMkhrTm.exe
  C:\Windows\System\kMkhrTm.exe
  2⤵
  PID:7916
- C:\Windows\System\OYpLRUZ.exe
  C:\Windows\System\OYpLRUZ.exe
  2⤵
  PID:7932
- C:\Windows\System\QfSPEMb.exe
  C:\Windows\System\QfSPEMb.exe
  2⤵
  PID:7964
- C:\Windows\System\JZAmBHQ.exe
  C:\Windows\System\JZAmBHQ.exe
  2⤵
  PID:7980
- C:\Windows\System\UWLDKNs.exe
  C:\Windows\System\UWLDKNs.exe
  2⤵
  PID:8000
- C:\Windows\System\AQjnoPn.exe
  C:\Windows\System\AQjnoPn.exe
  2⤵
  PID:8020
- C:\Windows\System\yHbyHFI.exe
  C:\Windows\System\yHbyHFI.exe
  2⤵
  PID:8076
- C:\Windows\System\HqMSRBp.exe
  C:\Windows\System\HqMSRBp.exe
  2⤵
  PID:8092
- C:\Windows\System\NOkkohb.exe
  C:\Windows\System\NOkkohb.exe
  2⤵
  PID:8108
- C:\Windows\System\rLSORwn.exe
  C:\Windows\System\rLSORwn.exe
  2⤵
  PID:8132
- C:\Windows\System\bdyMBnA.exe
  C:\Windows\System\bdyMBnA.exe
  2⤵
  PID:8172
- C:\Windows\System\yihSWvt.exe
  C:\Windows\System\yihSWvt.exe
  2⤵
  PID:6752
- C:\Windows\System\aaGajUR.exe
  C:\Windows\System\aaGajUR.exe
  2⤵
  PID:6856
- C:\Windows\System\GmXLbfn.exe
  C:\Windows\System\GmXLbfn.exe
  2⤵
  PID:6696
- C:\Windows\System\wmXPZQc.exe
  C:\Windows\System\wmXPZQc.exe
  2⤵
  PID:8200
- C:\Windows\System\sRnEIKi.exe
  C:\Windows\System\sRnEIKi.exe
  2⤵
  PID:8220
- C:\Windows\System\nXjutuV.exe
  C:\Windows\System\nXjutuV.exe
  2⤵
  PID:8240
- C:\Windows\System\lrJOJSA.exe
  C:\Windows\System\lrJOJSA.exe
  2⤵
  PID:8256
- C:\Windows\System\EAsMSND.exe
  C:\Windows\System\EAsMSND.exe
  2⤵
  PID:8272
- C:\Windows\System\EYVhYhZ.exe
  C:\Windows\System\EYVhYhZ.exe
  2⤵
  PID:8288
- C:\Windows\System\tZVQQlV.exe
  C:\Windows\System\tZVQQlV.exe
  2⤵
  PID:8340
- C:\Windows\System\sdveDPO.exe
  C:\Windows\System\sdveDPO.exe
  2⤵
  PID:8364
- C:\Windows\System\sXdSrgs.exe
  C:\Windows\System\sXdSrgs.exe
  2⤵
  PID:8388
- C:\Windows\System\pYAlJop.exe
  C:\Windows\System\pYAlJop.exe
  2⤵
  PID:8420
- C:\Windows\System\uKcfluP.exe
  C:\Windows\System\uKcfluP.exe
  2⤵
  PID:8448
- C:\Windows\System\bQSumjd.exe
  C:\Windows\System\bQSumjd.exe
  2⤵
  PID:8464
- C:\Windows\System\VcnVoIt.exe
  C:\Windows\System\VcnVoIt.exe
  2⤵
  PID:8480
- C:\Windows\System\zAqbXtS.exe
  C:\Windows\System\zAqbXtS.exe
  2⤵
  PID:8500
- C:\Windows\System\TRTjrje.exe
  C:\Windows\System\TRTjrje.exe
  2⤵
  PID:8520
- C:\Windows\System\IsaPuCU.exe
  C:\Windows\System\IsaPuCU.exe
  2⤵
  PID:8544
- C:\Windows\System\qeSnozO.exe
  C:\Windows\System\qeSnozO.exe
  2⤵
  PID:8568
- C:\Windows\System\EokkOOl.exe
  C:\Windows\System\EokkOOl.exe
  2⤵
  PID:8584
- C:\Windows\System\YLvCiAw.exe
  C:\Windows\System\YLvCiAw.exe
  2⤵
  PID:8604
- C:\Windows\System\rOVWvmf.exe
  C:\Windows\System\rOVWvmf.exe
  2⤵
  PID:8624
- C:\Windows\System\kWDvpks.exe
  C:\Windows\System\kWDvpks.exe
  2⤵
  PID:8640
- C:\Windows\System\pDWOcYs.exe
  C:\Windows\System\pDWOcYs.exe
  2⤵
  PID:8664
- C:\Windows\System\CrTZBVb.exe
  C:\Windows\System\CrTZBVb.exe
  2⤵
  PID:8688
- C:\Windows\System\cORFiiU.exe
  C:\Windows\System\cORFiiU.exe
  2⤵
  PID:8708
- C:\Windows\System\GEWgYHf.exe
  C:\Windows\System\GEWgYHf.exe
  2⤵
  PID:8732
- C:\Windows\System\AOkMbav.exe
  C:\Windows\System\AOkMbav.exe
  2⤵
  PID:8756
- C:\Windows\System\WqiRXvY.exe
  C:\Windows\System\WqiRXvY.exe
  2⤵
  PID:8780
- C:\Windows\System\UrPKpwl.exe
  C:\Windows\System\UrPKpwl.exe
  2⤵
  PID:8796
- C:\Windows\System\gaUTivy.exe
  C:\Windows\System\gaUTivy.exe
  2⤵
  PID:8820
- C:\Windows\System\uPnwqzM.exe
  C:\Windows\System\uPnwqzM.exe
  2⤵
  PID:8844
- C:\Windows\System\SEytULP.exe
  C:\Windows\System\SEytULP.exe
  2⤵
  PID:8868
- C:\Windows\System\Tndfbus.exe
  C:\Windows\System\Tndfbus.exe
  2⤵
  PID:8888
- C:\Windows\System\egMHmPW.exe
  C:\Windows\System\egMHmPW.exe
  2⤵
  PID:8908
- C:\Windows\System\jNtnJjo.exe
  C:\Windows\System\jNtnJjo.exe
  2⤵
  PID:8932
- C:\Windows\System\ORfeyoU.exe
  C:\Windows\System\ORfeyoU.exe
  2⤵
  PID:8956
- C:\Windows\System\cneqgZw.exe
  C:\Windows\System\cneqgZw.exe
  2⤵
  PID:8980
- C:\Windows\System\jZCrKWW.exe
  C:\Windows\System\jZCrKWW.exe
  2⤵
  PID:9000
- C:\Windows\System\XTcMdVM.exe
  C:\Windows\System\XTcMdVM.exe
  2⤵
  PID:9024
- C:\Windows\System\IlFIWbR.exe
  C:\Windows\System\IlFIWbR.exe
  2⤵
  PID:9044
- C:\Windows\System\JsdKlhS.exe
  C:\Windows\System\JsdKlhS.exe
  2⤵
  PID:9068
- C:\Windows\System\vAYjcxT.exe
  C:\Windows\System\vAYjcxT.exe
  2⤵
  PID:9092
- C:\Windows\System\TgaVPbu.exe
  C:\Windows\System\TgaVPbu.exe
  2⤵
  PID:9120
- C:\Windows\System\TJiNXvh.exe
  C:\Windows\System\TJiNXvh.exe
  2⤵
  PID:9140
- C:\Windows\System\lAQwbFc.exe
  C:\Windows\System\lAQwbFc.exe
  2⤵
  PID:9164
- C:\Windows\System\XFnZamb.exe
  C:\Windows\System\XFnZamb.exe
  2⤵
  PID:9188
- C:\Windows\System\cjsIklX.exe
  C:\Windows\System\cjsIklX.exe
  2⤵
  PID:9212
- C:\Windows\System\RREbGvX.exe
  C:\Windows\System\RREbGvX.exe
  2⤵
  PID:6996
- C:\Windows\System\ghQQEci.exe
  C:\Windows\System\ghQQEci.exe
  2⤵
  PID:6420
- C:\Windows\System\MWuYRTx.exe
  C:\Windows\System\MWuYRTx.exe
  2⤵
  PID:6452
- C:\Windows\System\dfxucgv.exe
  C:\Windows\System\dfxucgv.exe
  2⤵
  PID:6484
- C:\Windows\System\mKahpmr.exe
  C:\Windows\System\mKahpmr.exe
  2⤵
  PID:6792
- C:\Windows\System\mESGSxt.exe
  C:\Windows\System\mESGSxt.exe
  2⤵
  PID:7576
- C:\Windows\System\zLzaAHO.exe
  C:\Windows\System\zLzaAHO.exe
  2⤵
  PID:7704
- C:\Windows\System\DkYBvxa.exe
  C:\Windows\System\DkYBvxa.exe
  2⤵
  PID:6928
- C:\Windows\System\dNlhjPD.exe
  C:\Windows\System\dNlhjPD.exe
  2⤵
  PID:6948
- C:\Windows\System\sBUtkFD.exe
  C:\Windows\System\sBUtkFD.exe
  2⤵
  PID:7000
- C:\Windows\System\KrdtpcD.exe
  C:\Windows\System\KrdtpcD.exe
  2⤵
  PID:7036
- C:\Windows\System\YEVODxh.exe
  C:\Windows\System\YEVODxh.exe
  2⤵
  PID:7080
- C:\Windows\System\xErKKxy.exe
  C:\Windows\System\xErKKxy.exe
  2⤵
  PID:5636
- C:\Windows\System\EuclFMZ.exe
  C:\Windows\System\EuclFMZ.exe
  2⤵
  PID:7132
- C:\Windows\System\lfJnyXk.exe
  C:\Windows\System\lfJnyXk.exe
  2⤵
  PID:5852
- C:\Windows\System\tpCapLH.exe
  C:\Windows\System\tpCapLH.exe
  2⤵
  PID:6064
- C:\Windows\System\sNvMkbp.exe
  C:\Windows\System\sNvMkbp.exe
  2⤵
  PID:4988
- C:\Windows\System\gjCzdBl.exe
  C:\Windows\System\gjCzdBl.exe
  2⤵
  PID:9240
- C:\Windows\System\KdcqkFT.exe
  C:\Windows\System\KdcqkFT.exe
  2⤵
  PID:9260
- C:\Windows\System\PDVapTG.exe
  C:\Windows\System\PDVapTG.exe
  2⤵
  PID:9280
- C:\Windows\System\GhASpIL.exe
  C:\Windows\System\GhASpIL.exe
  2⤵
  PID:9304
- C:\Windows\System\MReWrWO.exe
  C:\Windows\System\MReWrWO.exe
  2⤵
  PID:9320
- C:\Windows\System\gDTDBUr.exe
  C:\Windows\System\gDTDBUr.exe
  2⤵
  PID:9336
- C:\Windows\System\RWFJIKn.exe
  C:\Windows\System\RWFJIKn.exe
  2⤵
  PID:9356
- C:\Windows\System\hodwRbY.exe
  C:\Windows\System\hodwRbY.exe
  2⤵
  PID:9376
- C:\Windows\System\xJXkCVK.exe
  C:\Windows\System\xJXkCVK.exe
  2⤵
  PID:9400
- C:\Windows\System\xZIxeXa.exe
  C:\Windows\System\xZIxeXa.exe
  2⤵
  PID:9428
- C:\Windows\System\GVzSRLK.exe
  C:\Windows\System\GVzSRLK.exe
  2⤵
  PID:9448
- C:\Windows\System\aSQVxFW.exe
  C:\Windows\System\aSQVxFW.exe
  2⤵
  PID:9476
- C:\Windows\System\YtvIGIk.exe
  C:\Windows\System\YtvIGIk.exe
  2⤵
  PID:9496
- C:\Windows\System\smoCxZb.exe
  C:\Windows\System\smoCxZb.exe
  2⤵
  PID:9520
- C:\Windows\System\mAOJEjB.exe
  C:\Windows\System\mAOJEjB.exe
  2⤵
  PID:9544
- C:\Windows\System\QuIOkdI.exe
  C:\Windows\System\QuIOkdI.exe
  2⤵
  PID:9572
- C:\Windows\System\ezmLBPa.exe
  C:\Windows\System\ezmLBPa.exe
  2⤵
  PID:9592
- C:\Windows\System\aYEOpwI.exe
  C:\Windows\System\aYEOpwI.exe
  2⤵
  PID:9616
- C:\Windows\System\pCGbWcT.exe
  C:\Windows\System\pCGbWcT.exe
  2⤵
  PID:9636
- C:\Windows\System\qNNRjIR.exe
  C:\Windows\System\qNNRjIR.exe
  2⤵
  PID:9656
- C:\Windows\System\JpgfzAO.exe
  C:\Windows\System\JpgfzAO.exe
  2⤵
  PID:9676
- C:\Windows\System\qyoFolD.exe
  C:\Windows\System\qyoFolD.exe
  2⤵
  PID:9700
- C:\Windows\System\DrFRnIr.exe
  C:\Windows\System\DrFRnIr.exe
  2⤵
  PID:9724
- C:\Windows\System\TcyomNI.exe
  C:\Windows\System\TcyomNI.exe
  2⤵
  PID:9748
- C:\Windows\System\KLGReao.exe
  C:\Windows\System\KLGReao.exe
  2⤵
  PID:9772
- C:\Windows\System\HzzJJXt.exe
  C:\Windows\System\HzzJJXt.exe
  2⤵
  PID:9800
- C:\Windows\System\kpDExyw.exe
  C:\Windows\System\kpDExyw.exe
  2⤵
  PID:9824
- C:\Windows\System\LCOcTHR.exe
  C:\Windows\System\LCOcTHR.exe
  2⤵
  PID:9844
- C:\Windows\System\RvhFiqw.exe
  C:\Windows\System\RvhFiqw.exe
  2⤵
  PID:9864
- C:\Windows\System\qKrIYmU.exe
  C:\Windows\System\qKrIYmU.exe
  2⤵
  PID:9888
- C:\Windows\System\vWDmgEp.exe
  C:\Windows\System\vWDmgEp.exe
  2⤵
  PID:9912
- C:\Windows\System\aRChoXK.exe
  C:\Windows\System\aRChoXK.exe
  2⤵
  PID:9940
- C:\Windows\System\erxUBzI.exe
  C:\Windows\System\erxUBzI.exe
  2⤵
  PID:9960
- C:\Windows\System\bYhpmRz.exe
  C:\Windows\System\bYhpmRz.exe
  2⤵
  PID:9988
- C:\Windows\System\EJsirre.exe
  C:\Windows\System\EJsirre.exe
  2⤵
  PID:10016
- C:\Windows\System\ULiNtrv.exe
  C:\Windows\System\ULiNtrv.exe
  2⤵
  PID:10036
- C:\Windows\System\sAVoweZ.exe
  C:\Windows\System\sAVoweZ.exe
  2⤵
  PID:10068
- C:\Windows\System\GElBoPK.exe
  C:\Windows\System\GElBoPK.exe
  2⤵
  PID:10092
- C:\Windows\System\oKFwdJv.exe
  C:\Windows\System\oKFwdJv.exe
  2⤵
  PID:10116
- C:\Windows\System\zCYLpPJ.exe
  C:\Windows\System\zCYLpPJ.exe
  2⤵
  PID:10136
- C:\Windows\System\coEeLcL.exe
  C:\Windows\System\coEeLcL.exe
  2⤵
  PID:10156
- C:\Windows\System\OFUERgI.exe
  C:\Windows\System\OFUERgI.exe
  2⤵
  PID:10180
- C:\Windows\System\XCsUvoE.exe
  C:\Windows\System\XCsUvoE.exe
  2⤵
  PID:10204
- C:\Windows\System\XQjLIBG.exe
  C:\Windows\System\XQjLIBG.exe
  2⤵
  PID:10232
- C:\Windows\System\fuRKvBJ.exe
  C:\Windows\System\fuRKvBJ.exe
  2⤵
  PID:1448
- C:\Windows\System\XpWjANv.exe
  C:\Windows\System\XpWjANv.exe
  2⤵
  PID:5352
- C:\Windows\System\BmywYjQ.exe
  C:\Windows\System\BmywYjQ.exe
  2⤵
  PID:5332
- C:\Windows\System\DBzbSpc.exe
  C:\Windows\System\DBzbSpc.exe
  2⤵
  PID:4896
- C:\Windows\System\fXJNYTi.exe
  C:\Windows\System\fXJNYTi.exe
  2⤵
  PID:6260
- C:\Windows\System\AKRfzul.exe
  C:\Windows\System\AKRfzul.exe
  2⤵
  PID:6332
- C:\Windows\System\HzQLpaP.exe
  C:\Windows\System\HzQLpaP.exe
  2⤵
  PID:6532
- C:\Windows\System\uRrmlft.exe
  C:\Windows\System\uRrmlft.exe
  2⤵
  PID:7192
- C:\Windows\System\GamNZLK.exe
  C:\Windows\System\GamNZLK.exe
  2⤵
  PID:7256
- C:\Windows\System\AvyjDRE.exe
  C:\Windows\System\AvyjDRE.exe
  2⤵
  PID:7304
- C:\Windows\System\IRLATrS.exe
  C:\Windows\System\IRLATrS.exe
  2⤵
  PID:7404
- C:\Windows\System\FDwYMJZ.exe
  C:\Windows\System\FDwYMJZ.exe
  2⤵
  PID:7444
- C:\Windows\System\SuXsDvX.exe
  C:\Windows\System\SuXsDvX.exe
  2⤵
  PID:8492
- C:\Windows\System\ZhrwFLY.exe
  C:\Windows\System\ZhrwFLY.exe
  2⤵
  PID:8564
- C:\Windows\System\CzzoYPi.exe
  C:\Windows\System\CzzoYPi.exe
  2⤵
  PID:7592
- C:\Windows\System\CbUCbkF.exe
  C:\Windows\System\CbUCbkF.exe
  2⤵
  PID:8208
- C:\Windows\System\LwmobLB.exe
  C:\Windows\System\LwmobLB.exe
  2⤵
  PID:7688
- C:\Windows\System\rBVlytt.exe
  C:\Windows\System\rBVlytt.exe
  2⤵
  PID:7756
- C:\Windows\System\AvMaZYf.exe
  C:\Windows\System\AvMaZYf.exe
  2⤵
  PID:8916
- C:\Windows\System\iKhKmTq.exe
  C:\Windows\System\iKhKmTq.exe
  2⤵
  PID:9052
- C:\Windows\System\AyPuVdE.exe
  C:\Windows\System\AyPuVdE.exe
  2⤵
  PID:9100
- C:\Windows\System\muupByt.exe
  C:\Windows\System\muupByt.exe
  2⤵
  PID:9172
- C:\Windows\System\sRGOoPa.exe
  C:\Windows\System\sRGOoPa.exe
  2⤵
  PID:7728
- C:\Windows\System\qXfUkRW.exe
  C:\Windows\System\qXfUkRW.exe
  2⤵
  PID:2916
- C:\Windows\System\NCzoBAK.exe
  C:\Windows\System\NCzoBAK.exe
  2⤵
  PID:6940
- C:\Windows\System\xCZoOSG.exe
  C:\Windows\System\xCZoOSG.exe
  2⤵
  PID:9536
- C:\Windows\System\WPOgBdz.exe
  C:\Windows\System\WPOgBdz.exe
  2⤵
  PID:8184
- C:\Windows\System\ImgLEWl.exe
  C:\Windows\System\ImgLEWl.exe
  2⤵
  PID:8124
- C:\Windows\System\POVfHSX.exe
  C:\Windows\System\POVfHSX.exe
  2⤵
  PID:8084
- C:\Windows\System\OOqEKZJ.exe
  C:\Windows\System\OOqEKZJ.exe
  2⤵
  PID:9652
- C:\Windows\System\pHQUBNc.exe
  C:\Windows\System\pHQUBNc.exe
  2⤵
  PID:8228
- C:\Windows\System\OPjAoPp.exe
  C:\Windows\System\OPjAoPp.exe
  2⤵
  PID:9792
- C:\Windows\System\NwsCnGq.exe
  C:\Windows\System\NwsCnGq.exe
  2⤵
  PID:10252
- C:\Windows\System\sdEJJwm.exe
  C:\Windows\System\sdEJJwm.exe
  2⤵
  PID:10268
- C:\Windows\System\xiaeTmJ.exe
  C:\Windows\System\xiaeTmJ.exe
  2⤵
  PID:10288
- C:\Windows\System\nWOMfEs.exe
  C:\Windows\System\nWOMfEs.exe
  2⤵
  PID:10308
- C:\Windows\System\ZEJdkCV.exe
  C:\Windows\System\ZEJdkCV.exe
  2⤵
  PID:10332
- C:\Windows\System\ZdLqPJN.exe
  C:\Windows\System\ZdLqPJN.exe
  2⤵
  PID:10356
- C:\Windows\System\bhyFtRi.exe
  C:\Windows\System\bhyFtRi.exe
  2⤵
  PID:10376
- C:\Windows\System\kgcBfyH.exe
  C:\Windows\System\kgcBfyH.exe
  2⤵
  PID:10396
- C:\Windows\System\yLCMACW.exe
  C:\Windows\System\yLCMACW.exe
  2⤵
  PID:10420
- C:\Windows\System\tbScvIJ.exe
  C:\Windows\System\tbScvIJ.exe
  2⤵
  PID:10444
- C:\Windows\System\YaJnjdA.exe
  C:\Windows\System\YaJnjdA.exe
  2⤵
  PID:10464
- C:\Windows\System\DHMuIia.exe
  C:\Windows\System\DHMuIia.exe
  2⤵
  PID:10484
- C:\Windows\System\aZVvYEc.exe
  C:\Windows\System\aZVvYEc.exe
  2⤵
  PID:10508
- C:\Windows\System\DUXWjvh.exe
  C:\Windows\System\DUXWjvh.exe
  2⤵
  PID:10528
- C:\Windows\System\kQJtZCF.exe
  C:\Windows\System\kQJtZCF.exe
  2⤵
  PID:10552
- C:\Windows\System\BHcBKFf.exe
  C:\Windows\System\BHcBKFf.exe
  2⤵
  PID:10568
- C:\Windows\System\kTXAJMZ.exe
  C:\Windows\System\kTXAJMZ.exe
  2⤵
  PID:10588
- C:\Windows\System\ZoxquwD.exe
  C:\Windows\System\ZoxquwD.exe
  2⤵
  PID:10604
- C:\Windows\System\jvvzDhE.exe
  C:\Windows\System\jvvzDhE.exe
  2⤵
  PID:10620
- C:\Windows\System\NupVxHm.exe
  C:\Windows\System\NupVxHm.exe
  2⤵
  PID:10652
- C:\Windows\System\aXLknzx.exe
  C:\Windows\System\aXLknzx.exe
  2⤵
  PID:10668
- C:\Windows\System\HWigfxB.exe
  C:\Windows\System\HWigfxB.exe
  2⤵
  PID:10692
- C:\Windows\System\FtKvMrA.exe
  C:\Windows\System\FtKvMrA.exe
  2⤵
  PID:10724
- C:\Windows\System\XtoOMVl.exe
  C:\Windows\System\XtoOMVl.exe
  2⤵
  PID:10756
- C:\Windows\System\DpAYmHE.exe
  C:\Windows\System\DpAYmHE.exe
  2⤵
  PID:10780
- C:\Windows\System\FsZlBGF.exe
  C:\Windows\System\FsZlBGF.exe
  2⤵
  PID:10800
- C:\Windows\System\nNpfHyk.exe
  C:\Windows\System\nNpfHyk.exe
  2⤵
  PID:10820
- C:\Windows\System\CkQqYkf.exe
  C:\Windows\System\CkQqYkf.exe
  2⤵
  PID:10860
- C:\Windows\System\UVFoxyE.exe
  C:\Windows\System\UVFoxyE.exe
  2⤵
  PID:10884
- C:\Windows\System\UtVxQHL.exe
  C:\Windows\System\UtVxQHL.exe
  2⤵
  PID:10908
- C:\Windows\System\AlUSPnG.exe
  C:\Windows\System\AlUSPnG.exe
  2⤵
  PID:10936
- C:\Windows\System\UzPTFuf.exe
  C:\Windows\System\UzPTFuf.exe
  2⤵
  PID:10960
- C:\Windows\System\LjqElBT.exe
  C:\Windows\System\LjqElBT.exe
  2⤵
  PID:10984
- C:\Windows\System\PnvGiMI.exe
  C:\Windows\System\PnvGiMI.exe
  2⤵
  PID:11004
- C:\Windows\System\xsgUhSU.exe
  C:\Windows\System\xsgUhSU.exe
  2⤵
  PID:11032
- C:\Windows\System\skfHPRH.exe
  C:\Windows\System\skfHPRH.exe
  2⤵
  PID:11060
- C:\Windows\System\KaZbAWP.exe
  C:\Windows\System\KaZbAWP.exe
  2⤵
  PID:11080
- C:\Windows\System\OYHLpVb.exe
  C:\Windows\System\OYHLpVb.exe
  2⤵
  PID:11104
- C:\Windows\System\ecBVmhP.exe
  C:\Windows\System\ecBVmhP.exe
  2⤵
  PID:11120
- C:\Windows\System\XAlRlev.exe
  C:\Windows\System\XAlRlev.exe
  2⤵
  PID:11140
- C:\Windows\System\VbrkIKK.exe
  C:\Windows\System\VbrkIKK.exe
  2⤵
  PID:11164
- C:\Windows\System\OVYdZaf.exe
  C:\Windows\System\OVYdZaf.exe
  2⤵
  PID:11192
- C:\Windows\System\VpXmoGZ.exe
  C:\Windows\System\VpXmoGZ.exe
  2⤵
  PID:11208
- C:\Windows\System\QYDiroo.exe
  C:\Windows\System\QYDiroo.exe
  2⤵
  PID:11232
- C:\Windows\System\MIZApaT.exe
  C:\Windows\System\MIZApaT.exe
  2⤵
  PID:11252
- C:\Windows\System\zNejtwM.exe
  C:\Windows\System\zNejtwM.exe
  2⤵
  PID:8264
- C:\Windows\System\qnIEYcf.exe
  C:\Windows\System\qnIEYcf.exe
  2⤵
  PID:8748
- C:\Windows\System\BqjzjOd.exe
  C:\Windows\System\BqjzjOd.exe
  2⤵
  PID:10124
- C:\Windows\System\SMVXaMD.exe
  C:\Windows\System\SMVXaMD.exe
  2⤵
  PID:10108
- C:\Windows\System\fRrAVCK.exe
  C:\Windows\System\fRrAVCK.exe
  2⤵
  PID:7184
- C:\Windows\System\qDKKiKh.exe
  C:\Windows\System\qDKKiKh.exe
  2⤵
  PID:7280
- C:\Windows\System\bVWMlPm.exe
  C:\Windows\System\bVWMlPm.exe
  2⤵
  PID:7832
- C:\Windows\System\BMeCZcz.exe
  C:\Windows\System\BMeCZcz.exe
  2⤵
  PID:6416
- C:\Windows\System\CmXrKrw.exe
  C:\Windows\System\CmXrKrw.exe
  2⤵
  PID:8324
- C:\Windows\System\bwZcSWW.exe
  C:\Windows\System\bwZcSWW.exe
  2⤵
  PID:8360
- C:\Windows\System\TRMTyQZ.exe
  C:\Windows\System\TRMTyQZ.exe
  2⤵
  PID:8404
- C:\Windows\System\CZgzhhM.exe
  C:\Windows\System\CZgzhhM.exe
  2⤵
  PID:9368
- C:\Windows\System\vudHHWC.exe
  C:\Windows\System\vudHHWC.exe
  2⤵
  PID:8456
- C:\Windows\System\hnjvjIp.exe
  C:\Windows\System\hnjvjIp.exe
  2⤵
  PID:9604
- C:\Windows\System\meQGMlI.exe
  C:\Windows\System\meQGMlI.exe
  2⤵
  PID:8540
- C:\Windows\System\lPRgYeY.exe
  C:\Windows\System\lPRgYeY.exe
  2⤵
  PID:8600
- C:\Windows\System\Gxprftj.exe
  C:\Windows\System\Gxprftj.exe
  2⤵
  PID:9132
- C:\Windows\System\oaPlYxS.exe
  C:\Windows\System\oaPlYxS.exe
  2⤵
  PID:9768
- C:\Windows\System\QMzlGjF.exe
  C:\Windows\System\QMzlGjF.exe
  2⤵
  PID:10244
- C:\Windows\System\pGxkNZF.exe
  C:\Windows\System\pGxkNZF.exe
  2⤵
  PID:10264
- C:\Windows\System\lFWGsat.exe
  C:\Windows\System\lFWGsat.exe
  2⤵
  PID:10008
- C:\Windows\System\SPucWlg.exe
  C:\Windows\System\SPucWlg.exe
  2⤵
  PID:8788
- C:\Windows\System\mYzFvzj.exe
  C:\Windows\System\mYzFvzj.exe
  2⤵
  PID:10372
- C:\Windows\System\StNwZLc.exe
  C:\Windows\System\StNwZLc.exe
  2⤵
  PID:10148
- C:\Windows\System\XQZtijU.exe
  C:\Windows\System\XQZtijU.exe
  2⤵
  PID:2872
- C:\Windows\System\rUAwvkA.exe
  C:\Windows\System\rUAwvkA.exe
  2⤵
  PID:8952
- C:\Windows\System\UIavqfE.exe
  C:\Windows\System\UIavqfE.exe
  2⤵
  PID:3660
- C:\Windows\System\DDNNGVt.exe
  C:\Windows\System\DDNNGVt.exe
  2⤵
  PID:6208
- C:\Windows\System\eQXhkKs.exe
  C:\Windows\System\eQXhkKs.exe
  2⤵
  PID:7428
- C:\Windows\System\UfFBNuw.exe
  C:\Windows\System\UfFBNuw.exe
  2⤵
  PID:11280
- C:\Windows\System\uVfsfrb.exe
  C:\Windows\System\uVfsfrb.exe
  2⤵
  PID:11304
- C:\Windows\System\fbNuxdk.exe
  C:\Windows\System\fbNuxdk.exe
  2⤵
  PID:11328
- C:\Windows\System\bIMSLzA.exe
  C:\Windows\System\bIMSLzA.exe
  2⤵
  PID:11348
- C:\Windows\System\KcwHpAe.exe
  C:\Windows\System\KcwHpAe.exe
  2⤵
  PID:11364
- C:\Windows\System\YkgXDqQ.exe
  C:\Windows\System\YkgXDqQ.exe
  2⤵
  PID:11380
- C:\Windows\System\PwejMHo.exe
  C:\Windows\System\PwejMHo.exe
  2⤵
  PID:11396
- C:\Windows\System\JNkGusq.exe
  C:\Windows\System\JNkGusq.exe
  2⤵
  PID:11412
- C:\Windows\System\nDTZCTF.exe
  C:\Windows\System\nDTZCTF.exe
  2⤵
  PID:11432
- C:\Windows\System\cRhQfLN.exe
  C:\Windows\System\cRhQfLN.exe
  2⤵
  PID:11452
- C:\Windows\System\EgHIJFa.exe
  C:\Windows\System\EgHIJFa.exe
  2⤵
  PID:11476
- C:\Windows\System\WLoytZi.exe
  C:\Windows\System\WLoytZi.exe
  2⤵
  PID:11528
- C:\Windows\System\YvCmjkO.exe
  C:\Windows\System\YvCmjkO.exe
  2⤵
  PID:11556
- C:\Windows\System\fwRICyk.exe
  C:\Windows\System\fwRICyk.exe
  2⤵
  PID:11596
- C:\Windows\System\RDPVcBe.exe
  C:\Windows\System\RDPVcBe.exe
  2⤵
  PID:11612
- C:\Windows\System\OFwOhTp.exe
  C:\Windows\System\OFwOhTp.exe
  2⤵
  PID:11628
- C:\Windows\System\GJCmdrz.exe
  C:\Windows\System\GJCmdrz.exe
  2⤵
  PID:11648
- C:\Windows\System\TqwhshU.exe
  C:\Windows\System\TqwhshU.exe
  2⤵
  PID:11664
- C:\Windows\System\ifYkFTd.exe
  C:\Windows\System\ifYkFTd.exe
  2⤵
  PID:11684
- C:\Windows\System\eUehXHE.exe
  C:\Windows\System\eUehXHE.exe
  2⤵
  PID:11716
- C:\Windows\System\OoSZZhU.exe
  C:\Windows\System\OoSZZhU.exe
  2⤵
  PID:11736
- C:\Windows\System\yyYxMKF.exe
  C:\Windows\System\yyYxMKF.exe
  2⤵
  PID:11756
- C:\Windows\System\aSPKsGM.exe
  C:\Windows\System\aSPKsGM.exe
  2⤵
  PID:11772
- C:\Windows\System\JIKsWBh.exe
  C:\Windows\System\JIKsWBh.exe
  2⤵
  PID:11796
- C:\Windows\System\gMOXHdV.exe
  C:\Windows\System\gMOXHdV.exe
  2⤵
  PID:11816
- C:\Windows\System\kZPCNwc.exe
  C:\Windows\System\kZPCNwc.exe
  2⤵
  PID:11840
- C:\Windows\System\vRLInyQ.exe
  C:\Windows\System\vRLInyQ.exe
  2⤵
  PID:11864
- C:\Windows\System\oVJuoiv.exe
  C:\Windows\System\oVJuoiv.exe
  2⤵
  PID:11888
- C:\Windows\System\WpkRlwz.exe
  C:\Windows\System\WpkRlwz.exe
  2⤵
  PID:11912
- C:\Windows\System\uAaKQAU.exe
  C:\Windows\System\uAaKQAU.exe
  2⤵
  PID:11940
- C:\Windows\System\vOBGNNU.exe
  C:\Windows\System\vOBGNNU.exe
  2⤵
  PID:11964
- C:\Windows\System\FGrRihh.exe
  C:\Windows\System\FGrRihh.exe
  2⤵
  PID:11980
- C:\Windows\System\FsvEOmK.exe
  C:\Windows\System\FsvEOmK.exe
  2⤵
  PID:12024
- C:\Windows\System\nbSvGMG.exe
  C:\Windows\System\nbSvGMG.exe
  2⤵
  PID:12040
- C:\Windows\System\gDlSSNT.exe
  C:\Windows\System\gDlSSNT.exe
  2⤵
  PID:12064
- C:\Windows\System\oZZpfhJ.exe
  C:\Windows\System\oZZpfhJ.exe
  2⤵
  PID:12112
- C:\Windows\System\yjWGkDY.exe
  C:\Windows\System\yjWGkDY.exe
  2⤵
  PID:12128
- C:\Windows\System\Yicumas.exe
  C:\Windows\System\Yicumas.exe
  2⤵
  PID:12144
- C:\Windows\System\RXPmORH.exe
  C:\Windows\System\RXPmORH.exe
  2⤵
  PID:12160
- C:\Windows\System\sVspTWr.exe
  C:\Windows\System\sVspTWr.exe
  2⤵
  PID:12184
- C:\Windows\System\qqUZsRV.exe
  C:\Windows\System\qqUZsRV.exe
  2⤵
  PID:12204
- C:\Windows\System\nQwhyEH.exe
  C:\Windows\System\nQwhyEH.exe
  2⤵
  PID:12228
- C:\Windows\System\XcvPzxZ.exe
  C:\Windows\System\XcvPzxZ.exe
  2⤵
  PID:12252
- C:\Windows\System\wYplNKa.exe
  C:\Windows\System\wYplNKa.exe
  2⤵
  PID:12268
- C:\Windows\System\GwJfwHD.exe
  C:\Windows\System\GwJfwHD.exe
  2⤵
  PID:12284
- C:\Windows\System\SUTAgOD.exe
  C:\Windows\System\SUTAgOD.exe
  2⤵
  PID:6448
- C:\Windows\System\CvVVWEJ.exe
  C:\Windows\System\CvVVWEJ.exe
  2⤵
  PID:6736
- C:\Windows\System\CHPzPVe.exe
  C:\Windows\System\CHPzPVe.exe
  2⤵
  PID:7556
- C:\Windows\System\XRkCyYF.exe
  C:\Windows\System\XRkCyYF.exe
  2⤵
  PID:6844
- C:\Windows\System\DlgARMq.exe
  C:\Windows\System\DlgARMq.exe
  2⤵
  PID:6944
- C:\Windows\System\FdEPUsN.exe
  C:\Windows\System\FdEPUsN.exe
  2⤵
  PID:7060
- C:\Windows\System\obcdpto.exe
  C:\Windows\System\obcdpto.exe
  2⤵
  PID:5688
- C:\Windows\System\dOQaKcQ.exe
  C:\Windows\System\dOQaKcQ.exe
  2⤵
  PID:2936
- C:\Windows\System\bayrLio.exe
  C:\Windows\System\bayrLio.exe
  2⤵
  PID:9248
- C:\Windows\System\MzbGdkT.exe
  C:\Windows\System\MzbGdkT.exe
  2⤵
  PID:4156
- C:\Windows\System\nJCcCGM.exe
  C:\Windows\System\nJCcCGM.exe
  2⤵
  PID:9332
- C:\Windows\System\rDqdjgo.exe
  C:\Windows\System\rDqdjgo.exe
  2⤵
  PID:1072
- C:\Windows\System\EFpLInD.exe
  C:\Windows\System\EFpLInD.exe
  2⤵
  PID:9444
- C:\Windows\System\HSEJVTn.exe
  C:\Windows\System\HSEJVTn.exe
  2⤵
  PID:9492
- C:\Windows\System\BWcIydh.exe
  C:\Windows\System\BWcIydh.exe
  2⤵
  PID:9552
- C:\Windows\System\LoUxIpy.exe
  C:\Windows\System\LoUxIpy.exe
  2⤵
  PID:4260
- C:\Windows\System\VMtutfq.exe
  C:\Windows\System\VMtutfq.exe
  2⤵
  PID:11240
- C:\Windows\System\iOphNZC.exe
  C:\Windows\System\iOphNZC.exe
  2⤵
  PID:9872
- C:\Windows\System\fmtQNrr.exe
  C:\Windows\System\fmtQNrr.exe
  2⤵
  PID:10080
- C:\Windows\System\vnpTfsO.exe
  C:\Windows\System\vnpTfsO.exe
  2⤵
  PID:6528
- C:\Windows\System\gNeVfVW.exe
  C:\Windows\System\gNeVfVW.exe
  2⤵
  PID:10296
- C:\Windows\System\CGUvaNQ.exe
  C:\Windows\System\CGUvaNQ.exe
  2⤵
  PID:9980
- C:\Windows\System\SztafUd.exe
  C:\Windows\System\SztafUd.exe
  2⤵
  PID:10348
- C:\Windows\System\hUqbERL.exe
  C:\Windows\System\hUqbERL.exe
  2⤵
  PID:8380
- C:\Windows\System\QyDngmy.exe
  C:\Windows\System\QyDngmy.exe
  2⤵
  PID:12304
- C:\Windows\System\ApMhlaJ.exe
  C:\Windows\System\ApMhlaJ.exe
  2⤵
  PID:12328
- C:\Windows\System\XXmoqMd.exe
  C:\Windows\System\XXmoqMd.exe
  2⤵
  PID:12348
- C:\Windows\System\hlzNvKI.exe
  C:\Windows\System\hlzNvKI.exe
  2⤵
  PID:12372
- C:\Windows\System\BixXipG.exe
  C:\Windows\System\BixXipG.exe
  2⤵
  PID:12396
- C:\Windows\System\mSWDVua.exe
  C:\Windows\System\mSWDVua.exe
  2⤵
  PID:12420
- C:\Windows\System\gntklRg.exe
  C:\Windows\System\gntklRg.exe
  2⤵
  PID:12448
- C:\Windows\System\wBLurBQ.exe
  C:\Windows\System\wBLurBQ.exe
  2⤵
  PID:12472
- C:\Windows\System\wTbsXJb.exe
  C:\Windows\System\wTbsXJb.exe
  2⤵
  PID:12496
- C:\Windows\System\HtCNcwZ.exe
  C:\Windows\System\HtCNcwZ.exe
  2⤵
  PID:12528
- C:\Windows\System\wGaZZAh.exe
  C:\Windows\System\wGaZZAh.exe
  2⤵
  PID:12560
- C:\Windows\System\YVDANSE.exe
  C:\Windows\System\YVDANSE.exe
  2⤵
  PID:12584
- C:\Windows\System\AugvCvm.exe
  C:\Windows\System\AugvCvm.exe
  2⤵
  PID:12608
- C:\Windows\System\wlhpgzW.exe
  C:\Windows\System\wlhpgzW.exe
  2⤵
  PID:12652
- C:\Windows\System\CxjlYvn.exe
  C:\Windows\System\CxjlYvn.exe
  2⤵
  PID:12684
- C:\Windows\System\xgehTZO.exe
  C:\Windows\System\xgehTZO.exe
  2⤵
  PID:12704
- C:\Windows\System\mHAQbwr.exe
  C:\Windows\System\mHAQbwr.exe
  2⤵
  PID:12736
- C:\Windows\System\tYZTkDb.exe
  C:\Windows\System\tYZTkDb.exe
  2⤵
  PID:12756
- C:\Windows\System\DvLDaRO.exe
  C:\Windows\System\DvLDaRO.exe
  2⤵
  PID:12784
- C:\Windows\System\ezcFylJ.exe
  C:\Windows\System\ezcFylJ.exe
  2⤵
  PID:12800
- C:\Windows\System\AuuJFNL.exe
  C:\Windows\System\AuuJFNL.exe
  2⤵
  PID:12844
- C:\Windows\System\dZGFFaB.exe
  C:\Windows\System\dZGFFaB.exe
  2⤵
  PID:12864
- C:\Windows\System\RUIcRSF.exe
  C:\Windows\System\RUIcRSF.exe
  2⤵
  PID:12884
- C:\Windows\System\TXJPopA.exe
  C:\Windows\System\TXJPopA.exe
  2⤵
  PID:12908
- C:\Windows\System\FkBwJJS.exe
  C:\Windows\System\FkBwJJS.exe
  2⤵
  PID:12948
- C:\Windows\System\YRaMvJY.exe
  C:\Windows\System\YRaMvJY.exe
  2⤵
  PID:12972
- C:\Windows\System\NUFqiDA.exe
  C:\Windows\System\NUFqiDA.exe
  2⤵
  PID:13000
- C:\Windows\System\vlrhJaA.exe
  C:\Windows\System\vlrhJaA.exe
  2⤵
  PID:13020
- C:\Windows\System\otpFrUq.exe
  C:\Windows\System\otpFrUq.exe
  2⤵
  PID:13036
- C:\Windows\System\xmfqSWf.exe
  C:\Windows\System\xmfqSWf.exe
  2⤵
  PID:13052
- C:\Windows\System\kWofGmd.exe
  C:\Windows\System\kWofGmd.exe
  2⤵
  PID:13068
- C:\Windows\System\MUDxaBZ.exe
  C:\Windows\System\MUDxaBZ.exe
  2⤵
  PID:13084
- C:\Windows\System\JGbDlZc.exe
  C:\Windows\System\JGbDlZc.exe
  2⤵
  PID:13100
- C:\Windows\System\mFBUYna.exe
  C:\Windows\System\mFBUYna.exe
  2⤵
  PID:13116
- C:\Windows\System\GhXDwxY.exe
  C:\Windows\System\GhXDwxY.exe
  2⤵
  PID:13132
- C:\Windows\System\yoXvIUj.exe
  C:\Windows\System\yoXvIUj.exe
  2⤵
  PID:13148
- C:\Windows\System\KpeyIxP.exe
  C:\Windows\System\KpeyIxP.exe
  2⤵
  PID:13192
- C:\Windows\System\mATXtuI.exe
  C:\Windows\System\mATXtuI.exe
  2⤵
  PID:13216
- C:\Windows\System\eteKxsR.exe
  C:\Windows\System\eteKxsR.exe
  2⤵
  PID:13244
- C:\Windows\System\mggYgen.exe
  C:\Windows\System\mggYgen.exe
  2⤵
  PID:13276
- C:\Windows\System\dwUDFze.exe
  C:\Windows\System\dwUDFze.exe
  2⤵
  PID:8512
- C:\Windows\System\RgOHETf.exe
  C:\Windows\System\RgOHETf.exe
  2⤵
  PID:10216
- C:\Windows\System\vZftOLa.exe
  C:\Windows\System\vZftOLa.exe
  2⤵
  PID:5256
- C:\Windows\System\NWBMyoj.exe
  C:\Windows\System\NWBMyoj.exe
  2⤵
  PID:10260
- C:\Windows\System\nKQSHlN.exe
  C:\Windows\System\nKQSHlN.exe
  2⤵
  PID:8772
- C:\Windows\System\GXkraEz.exe
  C:\Windows\System\GXkraEz.exe
  2⤵
  PID:7400
- C:\Windows\System\OvPHMaC.exe
  C:\Windows\System\OvPHMaC.exe
  2⤵
  PID:8992
- C:\Windows\System\vWYSviu.exe
  C:\Windows\System\vWYSviu.exe
  2⤵
  PID:11288
- C:\Windows\System\vIvTwIA.exe
  C:\Windows\System\vIvTwIA.exe
  2⤵
  PID:11336
- C:\Windows\System\iuYDxQj.exe
  C:\Windows\System\iuYDxQj.exe
  2⤵
  PID:11464
- C:\Windows\System\KIJsscB.exe
  C:\Windows\System\KIJsscB.exe
  2⤵
  PID:9416
- C:\Windows\System\NSsHxEf.exe
  C:\Windows\System\NSsHxEf.exe
  2⤵
  PID:12296
- C:\Windows\System\eIRsaHX.exe
  C:\Windows\System\eIRsaHX.exe
  2⤵
  PID:9300
- C:\Windows\System\ImKdJZA.exe
  C:\Windows\System\ImKdJZA.exe
  2⤵
  PID:8752
- C:\Windows\System\DaDDrBo.exe
  C:\Windows\System\DaDDrBo.exe
  2⤵
  PID:9528
- C:\Windows\System\xBmXCET.exe
  C:\Windows\System\xBmXCET.exe
  2⤵
  PID:12056
- C:\Windows\System\getnBZc.exe
  C:\Windows\System\getnBZc.exe
  2⤵
  PID:12120
- C:\Windows\System\pILepyK.exe
  C:\Windows\System\pILepyK.exe
  2⤵
  PID:12168
- C:\Windows\System\BSduKgs.exe
  C:\Windows\System\BSduKgs.exe
  2⤵
  PID:12196
- C:\Windows\System\kUafmKr.exe
  C:\Windows\System\kUafmKr.exe
  2⤵
  PID:9256
- C:\Windows\System\tSgEhXj.exe
  C:\Windows\System\tSgEhXj.exe
  2⤵
  PID:8116
- C:\Windows\System\xOWQJRG.exe
  C:\Windows\System\xOWQJRG.exe
  2⤵
  PID:10200
- C:\Windows\System\ESLfvEa.exe
  C:\Windows\System\ESLfvEa.exe
  2⤵
  PID:12316
- C:\Windows\System\nROpqHK.exe
  C:\Windows\System\nROpqHK.exe
  2⤵
  PID:12364
- C:\Windows\System\igOlVdp.exe
  C:\Windows\System\igOlVdp.exe
  2⤵
  PID:9668
- C:\Windows\System\yOCNnOB.exe
  C:\Windows\System\yOCNnOB.exe
  2⤵
  PID:12576
- C:\Windows\System\kXwZktc.exe
  C:\Windows\System\kXwZktc.exe
  2⤵
  PID:12644
- C:\Windows\System\jNErTfg.exe
  C:\Windows\System\jNErTfg.exe
  2⤵
  PID:3452
- C:\Windows\System\mDhWwyR.exe
  C:\Windows\System\mDhWwyR.exe
  2⤵
  PID:12776
- C:\Windows\System\IAhBSAP.exe
  C:\Windows\System\IAhBSAP.exe
  2⤵
  PID:8236
- C:\Windows\System\TFbzGcM.exe
  C:\Windows\System\TFbzGcM.exe
  2⤵
  PID:12840
- C:\Windows\System\LqbMJIr.exe
  C:\Windows\System\LqbMJIr.exe
  2⤵
  PID:12892
- C:\Windows\System\TRwQrJc.exe
  C:\Windows\System\TRwQrJc.exe
  2⤵
  PID:12980
- C:\Windows\System\jzvfbuv.exe
  C:\Windows\System\jzvfbuv.exe
  2⤵
  PID:13044
- C:\Windows\System\ABqsGdp.exe
  C:\Windows\System\ABqsGdp.exe
  2⤵
  PID:9860
- C:\Windows\System\upCrWVc.exe
  C:\Windows\System\upCrWVc.exe
  2⤵
  PID:6400
- C:\Windows\System\ErVzgfX.exe
  C:\Windows\System\ErVzgfX.exe
  2⤵
  PID:4012
- C:\Windows\System\pXviQaU.exe
  C:\Windows\System\pXviQaU.exe
  2⤵
  PID:11484
- C:\Windows\System\WQigMua.exe
  C:\Windows\System\WQigMua.exe
  2⤵
  PID:7640
- C:\Windows\System\tXCyWwv.exe
  C:\Windows\System\tXCyWwv.exe
  2⤵
  PID:11768
- C:\Windows\System\nXHBXgd.exe
  C:\Windows\System\nXHBXgd.exe
  2⤵
  PID:10580
- C:\Windows\System\sKOPnpu.exe
  C:\Windows\System\sKOPnpu.exe
  2⤵
  PID:13288
- C:\Windows\System\xJpCfwL.exe
  C:\Windows\System\xJpCfwL.exe
  2⤵
  PID:10976
- C:\Windows\System\wsaFDfe.exe
  C:\Windows\System\wsaFDfe.exe
  2⤵
  PID:10536
- C:\Windows\System\ETRVhdm.exe
  C:\Windows\System\ETRVhdm.exe
  2⤵
  PID:11388
- C:\Windows\System\OmXzYcx.exe
  C:\Windows\System\OmXzYcx.exe
  2⤵
  PID:10660
- C:\Windows\System\dKxuxVi.exe
  C:\Windows\System\dKxuxVi.exe
  2⤵
  PID:11340
- C:\Windows\System\CoBMqXe.exe
  C:\Windows\System\CoBMqXe.exe
  2⤵
  PID:11856
- C:\Windows\System\iLDhAwI.exe
  C:\Windows\System\iLDhAwI.exe
  2⤵
  PID:8308
- C:\Windows\System\AhUILzT.exe
  C:\Windows\System\AhUILzT.exe
  2⤵
  PID:12428
- C:\Windows\System\AHOCVyG.exe
  C:\Windows\System\AHOCVyG.exe
  2⤵
  PID:12220
- C:\Windows\System\BTkIbbX.exe
  C:\Windows\System\BTkIbbX.exe
  2⤵
  PID:7956
- C:\Windows\System\eTmvDsA.exe
  C:\Windows\System\eTmvDsA.exe
  2⤵
  PID:4892
- C:\Windows\System\IEbzORd.exe
  C:\Windows\System\IEbzORd.exe
  2⤵
  PID:8280
- C:\Windows\System\sDOIyAd.exe
  C:\Windows\System\sDOIyAd.exe
  2⤵
  PID:1596
- C:\Windows\System\pIKTQLn.exe
  C:\Windows\System\pIKTQLn.exe
  2⤵
  PID:12772
- C:\Windows\System\sObNaVX.exe
  C:\Windows\System\sObNaVX.exe
  2⤵
  PID:12828
- C:\Windows\System\VyMBUvT.exe
  C:\Windows\System\VyMBUvT.exe
  2⤵
  PID:12960
- C:\Windows\System\iciFfxW.exe
  C:\Windows\System\iciFfxW.exe
  2⤵
  PID:11424
- C:\Windows\System\ZBfSDaX.exe
  C:\Windows\System\ZBfSDaX.exe
  2⤵
  PID:7780
- C:\Windows\System\oeWvLSb.exe
  C:\Windows\System\oeWvLSb.exe
  2⤵
  PID:10876
- C:\Windows\System\TCWipvR.exe
  C:\Windows\System\TCWipvR.exe
  2⤵
  PID:13340
- C:\Windows\System\nzYByXS.exe
  C:\Windows\System\nzYByXS.exe
  2⤵
  PID:13364
- C:\Windows\System\CQdZfRy.exe
  C:\Windows\System\CQdZfRy.exe
  2⤵
  PID:13392
- C:\Windows\System\hqGTuxg.exe
  C:\Windows\System\hqGTuxg.exe
  2⤵
  PID:13416
- C:\Windows\System\RVQGzuG.exe
  C:\Windows\System\RVQGzuG.exe
  2⤵
  PID:13436
- C:\Windows\System\pJwASMS.exe
  C:\Windows\System\pJwASMS.exe
  2⤵
  PID:13456
- C:\Windows\System\IwsAUKZ.exe
  C:\Windows\System\IwsAUKZ.exe
  2⤵
  PID:13576
- C:\Windows\System\HsZiXFc.exe
  C:\Windows\System\HsZiXFc.exe
  2⤵
  PID:13608
- C:\Windows\System\pgMcpYM.exe
  C:\Windows\System\pgMcpYM.exe
  2⤵
  PID:13624
- C:\Windows\System\xUwuOqy.exe
  C:\Windows\System\xUwuOqy.exe
  2⤵
  PID:13932
- C:\Windows\System\pYKvdFz.exe
  C:\Windows\System\pYKvdFz.exe
  2⤵
  PID:14176
- C:\Windows\System\tsAwVYB.exe
  C:\Windows\System\tsAwVYB.exe
  2⤵
  PID:14276
- C:\Windows\System\uWOyAcc.exe
  C:\Windows\System\uWOyAcc.exe
  2⤵
  PID:14320
- C:\Windows\System\zUJVxmZ.exe
  C:\Windows\System\zUJVxmZ.exe
  2⤵
  PID:11068
- C:\Windows\System\LxYAwAa.exe
  C:\Windows\System\LxYAwAa.exe
  2⤵
  PID:9920
- C:\Windows\System\qcSYvRn.exe
  C:\Windows\System\qcSYvRn.exe
  2⤵
  PID:1744
- C:\Windows\System\TFeOMId.exe
  C:\Windows\System\TFeOMId.exe
  2⤵
  PID:13348
- C:\Windows\System\lxcjcFW.exe
  C:\Windows\System\lxcjcFW.exe
  2⤵
  PID:13356
- C:\Windows\System\ydDFGHN.exe
  C:\Windows\System\ydDFGHN.exe
  2⤵
  PID:3764
- C:\Windows\System\fhOghrA.exe
  C:\Windows\System\fhOghrA.exe
  2⤵
  PID:10412
- C:\Windows\System\NosdRND.exe
  C:\Windows\System\NosdRND.exe
  2⤵
  PID:2880
- C:\Windows\System\DkenkFw.exe
  C:\Windows\System\DkenkFw.exe
  2⤵
  PID:13404
- C:\Windows\System\BWiblOU.exe
  C:\Windows\System\BWiblOU.exe
  2⤵
  PID:7972
- C:\Windows\System\ctIZqIC.exe
  C:\Windows\System\ctIZqIC.exe
  2⤵
  PID:10980
- C:\Windows\System\LqbaWfz.exe
  C:\Windows\System\LqbaWfz.exe
  2⤵
  PID:13748
- C:\Windows\System\DjCmtod.exe
  C:\Windows\System\DjCmtod.exe
  2⤵
  PID:13724
- C:\Windows\System\SrcRkvI.exe
  C:\Windows\System\SrcRkvI.exe
  2⤵
  PID:1796
- C:\Windows\System\qDnORtk.exe
  C:\Windows\System\qDnORtk.exe
  2⤵
  PID:14136
- C:\Windows\System\yemgWFf.exe
  C:\Windows\System\yemgWFf.exe
  2⤵
  PID:13844
- C:\Windows\System\QSQeUks.exe
  C:\Windows\System\QSQeUks.exe
  2⤵
  PID:13868
- C:\Windows\System\OFTMmlI.exe
  C:\Windows\System\OFTMmlI.exe
  2⤵
  PID:14200
- C:\Windows\System\BEwOTfU.exe
  C:\Windows\System\BEwOTfU.exe
  2⤵
  PID:14224
- C:\Windows\System\FBUCNKZ.exe
  C:\Windows\System\FBUCNKZ.exe
  2⤵
  PID:11428
- C:\Windows\System\KynjpIS.exe
  C:\Windows\System\KynjpIS.exe
  2⤵
  PID:14032
- C:\Windows\System\KosPimo.exe
  C:\Windows\System\KosPimo.exe
  2⤵
  PID:14060
- C:\Windows\System\UGZjBSe.exe
  C:\Windows\System\UGZjBSe.exe
  2⤵
  PID:14124
- C:\Windows\System\icNrhyV.exe
  C:\Windows\System\icNrhyV.exe
  2⤵
  PID:14192
- C:\Windows\System\gSrcePw.exe
  C:\Windows\System\gSrcePw.exe
  2⤵
  PID:5052
- C:\Windows\System\eJGSYor.exe
  C:\Windows\System\eJGSYor.exe
  2⤵
  PID:13808
- C:\Windows\System\DuVnFpa.exe
  C:\Windows\System\DuVnFpa.exe
  2⤵
  PID:14300
- C:\Windows\System\PSJNMOE.exe
  C:\Windows\System\PSJNMOE.exe
  2⤵
  PID:11112
- C:\Windows\System\wwXrlFC.exe
  C:\Windows\System\wwXrlFC.exe
  2⤵
  PID:11680
- C:\Windows\System\uZNZxsW.exe
  C:\Windows\System\uZNZxsW.exe
  2⤵
  PID:12156
- C:\Windows\System\wpdacOs.exe
  C:\Windows\System\wpdacOs.exe
  2⤵
  PID:12312
- C:\Windows\System\EczrBYv.exe
  C:\Windows\System\EczrBYv.exe
  2⤵
  PID:12640
- C:\Windows\System\MLLLuJk.exe
  C:\Windows\System\MLLLuJk.exe
  2⤵
  PID:6356
- C:\Windows\System\ARrDBQe.exe
  C:\Windows\System\ARrDBQe.exe
  2⤵
  PID:7776
- C:\Windows\System\IgsaWRe.exe
  C:\Windows\System\IgsaWRe.exe
  2⤵
  PID:5800
- C:\Windows\System\WQXCoAV.exe
  C:\Windows\System\WQXCoAV.exe
  2⤵
  PID:1032
- C:\Windows\System\BVLykRB.exe
  C:\Windows\System\BVLykRB.exe
  2⤵
  PID:11908
- C:\Windows\System\thHnOnU.exe
  C:\Windows\System\thHnOnU.exe
  2⤵
  PID:2248
- C:\Windows\System\ZfbOzwZ.exe
  C:\Windows\System\ZfbOzwZ.exe
  2⤵
  PID:9220
- C:\Windows\System\BDpOodm.exe
  C:\Windows\System\BDpOodm.exe
  2⤵
  PID:13552
- C:\Windows\System\OYodeZp.exe
  C:\Windows\System\OYodeZp.exe
  2⤵
  PID:12700
- C:\Windows\System\ztavkRy.exe
  C:\Windows\System\ztavkRy.exe
  2⤵
  PID:10480
- C:\Windows\System\FByEFYr.exe
  C:\Windows\System\FByEFYr.exe
  2⤵
  PID:13692
- C:\Windows\System\qKosuEb.exe
  C:\Windows\System\qKosuEb.exe
  2⤵
  PID:13960
- C:\Windows\System\RAdwYeF.exe
  C:\Windows\System\RAdwYeF.exe
  2⤵
  PID:13948
- C:\Windows\System\gsqgeft.exe
  C:\Windows\System\gsqgeft.exe
  2⤵
  PID:13996
- C:\Windows\System\SiHbkOo.exe
  C:\Windows\System\SiHbkOo.exe
  2⤵
  PID:14260
- C:\Windows\System\KLETzGa.exe
  C:\Windows\System\KLETzGa.exe
  2⤵
  PID:2184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zjjm1stk.efd.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AHOahIQ.exe

Filesize
2.2MB

MD5
c8206c4061c6122e9fc8f1c53727a29d

SHA1
688aadb2901b67333d2c752baa901993c1a7a117

SHA256
34c999f9155e9a9463c93d77d1a0eed1bf50fd335121fb3e498c47d1a6ea6135

SHA512
ffce09dc1f0e38fe249f0ce11a7bd2140c734629c68426fa2ae9a1b607a5d9ae4a9f3b536f9af23ab2edffcabc34eab15c6154b7911243e8e54585cf5e3ff743

Download Submit
C:\Windows\System\AQDXxrc.exe

Filesize
2.2MB

MD5
e439c5be143bb8ddb7375377ec76a4ef

SHA1
dca20eae10cc7549b74d0a8a30594e5e9bdde6bc

SHA256
84926db2e88aba99b940a3713946916796a3dcd48234b2444db685f8ec0732a8

SHA512
dff9a7c2629e425a4b60667a282c55fa9442106246eb720f92af35769bca3da1fbf513a179673e85d6b8ce544299d799d64ad9176ee288c3a2ad9adf9afd4960

Download Submit
C:\Windows\System\BYsCtUj.exe

Filesize
2.2MB

MD5
ef914f98052e55d5baf728d383659240

SHA1
6510003dd647abc7c196093478646591f7bf2016

SHA256
cd56d3457f9587f17548161825f9dbe79cef73af08ad2dce8ab73a8db91a1ca4

SHA512
42051cbe024880d52ebad5c1253e27c3b4f18a1ea4939fd1da29806369102148718b6ec3cfd5cea8bb6633ccf20f31c25f49db13af3dc55263b1824d2f204641

Download Submit
C:\Windows\System\BmAGVlz.exe

Filesize
2.2MB

MD5
1dd326c58ebbfaaf4005bad8983ca113

SHA1
028aa190a7bc11e1d336a7f371bd98975b96d9b8

SHA256
6d849a907c7de60ec9ca6c61e02b312be4e147b73e9583af5772ab912188ca18

SHA512
ab990baaa94160ad5a718bec5c9a60a573e50b5be203d24ed3ecc476f6a26af5a126053caa452bfef36784cfea6b7ab19817dc758309150edc1d2ca834658d24

Download Submit
C:\Windows\System\BmnMBBe.exe

Filesize
2.2MB

MD5
f862f51696d0c3ad0341fd6310855203

SHA1
51dbfd4428a24854cc0127ae8019223f05356bef

SHA256
4be45392f673eeb91f9efd8b48c820c5db706fa59ad4c23251c65d3ceadac86c

SHA512
93d06436184e46d44bec0648316d30bfaa4f2486c0b8946d90aa463d7b57ecd7efa90324c89400028676a7d667d606ecf63590c50197aeb0a057aaf0427c6599

Download Submit
C:\Windows\System\BuOhroP.exe

Filesize
2.2MB

MD5
bfa98c0f15d53923b0ba59c92c2d0683

SHA1
f94da5e33996c2feb9c340dfd2108910766fc8b4

SHA256
b13d06b505e208b607d5d9a73283f23aa0fe707af0e58f5b335531a676260a89

SHA512
9da309103f73315595fd5954cb69f862c160913858d53b874d3b41e43f4d8c767ce76e388f8ba726cf3f9c90250dd61f9679657ffd8cb88929bc270e0bcc38a7

Download Submit
C:\Windows\System\DdQusDP.exe

Filesize
2.2MB

MD5
97bd2f8c8d87300cf1fce93c84ede43f

SHA1
045dc8eee364eb52d299924bbe48dfe6075f420d

SHA256
717d0d07b8b48646f5554c96518e601105bb8001ca0bbbefe6a298cb52d288ba

SHA512
aee0789122fb8962e5330b89640f9ddc03d74f2db35d9ada76a6bb8d5fc685b2e033bf26d60c4062b7e951cef4eab6cf1416e9d05f30a605fd2adfca29236f8b

Download Submit
C:\Windows\System\GbIsvFK.exe

Filesize
2.2MB

MD5
96c72e07b41070e177faecc8d80dfdc0

SHA1
c1ab2f2e6f6bc19c503518244e0c29c8f0f9d033

SHA256
489b55ee77e773c4baf467fe9fb72382ce5bc909f301943636ecbbc87dd622c7

SHA512
70d127961a3f1c4670f40fd7e6e7a5d707313095131cfbfe192abfa7f42196ded03a1933603edad2aa6c68c981dde4b131e58a365645e0df272b46de49fce1b3

Download Submit
C:\Windows\System\HTkVbww.exe

Filesize
2.2MB

MD5
e22b233319f3429e8351e7cea2890caf

SHA1
6f31331a83231196c4ca0e6246ba57e80eea5ec6

SHA256
da531c96765d07c3d51499de85be618d01e3ca61af1f4e2f1e440e92e47f8fa5

SHA512
314df4847fc00a73b8ff0b9ef2038cab5ff4ffb2592b606d8420d9fe19e3bf446b70c9c0546e9ee07525c915bc01fc58aea28d029bf25f6d8e41336c4fb99e8f

Download Submit
C:\Windows\System\IsAhxwX.exe

Filesize
2.2MB

MD5
a78d7bb6a0e7284bc4a6d3681ce71610

SHA1
09d839abc16d5cfc2eafbed61d495863a697fc7b

SHA256
43489eab11dbdd303ac6f9d966ce14eb548b247646864161ceedff9bf84098d7

SHA512
c7e012f9bd764e521a572b85891672e255728a410bbe9c103ee9af5750add1528cc9264ef6a4851b0c23e2396646e19f7de905980195fc28840d43f6f226408c

Download Submit
C:\Windows\System\KPOkepz.exe

Filesize
2.2MB

MD5
fd8260a378ce1e7049f370b6b7015d9a

SHA1
22a83af78abbae202a67c2b0506d1f2bc1a5f1ca

SHA256
8da5e6cf5e56f5f75f9299aaa8dcd4a4bd2633ed71dfd6de6d2d5e630b57658d

SHA512
dc21a3278802832d7e992323c739681970473d26e0f3f08365db08bc4a9f961f7ddfe350b606be8b9a348488ae59495f9edd50b97b787246365025702de14a41

Download Submit
C:\Windows\System\KbPVWQf.exe

Filesize
2.2MB

MD5
307f08ff01331b8b1a99cc43472c8508

SHA1
f0dd0e3337cbf17fad212d569638b7e45abc73ca

SHA256
48e822926e643a5af2662aad02e4e7593b2913163cbd1c04cde785a6f61d7958

SHA512
938461386bda15d4c0583dbe1ccea3bbf4e5420e91ccf6075d4b3d507ea180a53f65edcc4d52f9a7072d1855ffb9f07ffb0cfcf7b45aeda6a6249f867c8326e0

Download Submit
C:\Windows\System\LZxRlYe.exe

Filesize
2.2MB

MD5
446a9a97863b4b7eacc135ab8081d4fb

SHA1
7ec84a4026302dabc1d3dcd68f89214ce225bd9a

SHA256
7254bcdb4b02fe0f6cc5fc66ffc4573c5408aecd6875d58b858b52e54b28053e

SHA512
90d8f91958b39ee84f405f21dc8a180ecc3afa8812980192db959953fa76c7b7342850d05dd8fd6be7aac7591384edf40e3ab4f1170ce8ae0593f3868a5254d6

Download Submit
C:\Windows\System\MDLQRUg.exe

Filesize
2.2MB

MD5
eb4d2340edd818a5383a95886d285ce7

SHA1
e361e47ef27879dcd8d5c89b35b23af1d5f96a1f

SHA256
513def927c82aff01b2aafb0391aad2edcf12334b6beb40ab6255f2eca36a82f

SHA512
4a3b08a11328d80f5644ac8b1f6c799108738588573e878bc3e3d8fd664b7ab4c76a9b5d720d40a7345538be89f08778451d0d87c4dee777fa3666a0be060d45

Download Submit
C:\Windows\System\NFvfIsN.exe

Filesize
2.2MB

MD5
c793c7868f719a1278bd0130c8603132

SHA1
7b14c2b7a5952440dc6612924cba9ed2e551a987

SHA256
273712234ab22c3d872039913a66a48523c2cae5e6fa8b448bd37a6ffec9c824

SHA512
195a2478d8aadccde8d19742f57636c5933b3d483cb804bcb50d5e03fec00e818f58e6621153c3e68f9ee18c04cdb71716d2ddd118a1b02fa705ac1a5711cbbd

Download Submit
C:\Windows\System\NxZaXgg.exe

Filesize
2.2MB

MD5
d22c1e489f65b0b3c4b0ec15f8b04122

SHA1
7f36df0451bbf43dfa17d48ca0ed78646995de01

SHA256
09ea41ca7f8deb93355e921b520f43b4a83079bdfc39cee6cd4c09d7a4b1d851

SHA512
71dd832ce5549893f6a85a72786dd28379912a707926a312e3dd22219ccbc66ec7f03514ca0d25e6377519c41f6321465c8943d35acbb6cfa44e8aa51a37f06c

Download Submit
C:\Windows\System\OuIoOrm.exe

Filesize
2.2MB

MD5
2c1d553d0ac73f5971f34f9df6b070aa

SHA1
59c860d770b95f8e9c4e44113254b7d98ce0f086

SHA256
8e3908f5f83b6bcf4bf0da2369117b31b91f50a1c3fbfe96f6f7f6df0af80766

SHA512
e4e239604612198a21cc8a7ee25d6a32141939f3c1cd4fe7aab8190374685c9cd981b97db99478f87bc0a1ce3014ee3851a4d0656309a6c15b158055a7750be9

Download Submit
C:\Windows\System\TRSjbil.exe

Filesize
8B

MD5
0b02220145771e90ebe4310a5742c9eb

SHA1
9bd568d96b03bd5446f96a7b59c08196eb5a57c3

SHA256
6135f164d0697be47c97ab606a7a1adcbc1eb3846ae4debecafb1a6ccfd23e4e

SHA512
cb08dee7f4e4dd1bb8de836a2364c078d9de5aef5dcb329e7e0b8e1cc2bfaa06c42f8b8ddf04bdb30392074759beef091a761854b0812b9a726b3c820c99a5a8

Download Submit
C:\Windows\System\TzAyqQS.exe

Filesize
2.2MB

MD5
c5a7ed214af9e0cad5985cd00ef1da7f

SHA1
f3caf47e460b9cb1c9f8d0963ff2eb3a9838d85b

SHA256
14986c8d383e422ca4e68046dc084d2980968322efed59f05934d93f30aa35eb

SHA512
646d8120f971e633b00cee6fe2f7598a61ce149652679587a3277b2be766446102752be4d66daeb8cfc16b3da7af772bb6d1dd9c8b34533ac035c5bbc861fef4

Download Submit
C:\Windows\System\UYqHvgn.exe

Filesize
2.2MB

MD5
7824aba870f32b142ac87b938766c5a4

SHA1
7d9d6c3107cca4144e459f8932a50a74302bedf2

SHA256
6f3e36ff6b89688450e3561dcbc3db430a468483590399183275dc69308b653a

SHA512
792c225d9f99647f7fd17cfa93a83a874250d40af505e1ca028bcfd55f4b3d216fb6db2b73c37559250ae416030b210bc5fe3ec31dd086ba469f87dcb148f77a

Download Submit
C:\Windows\System\VRreCqb.exe

Filesize
2.2MB

MD5
fc13c7dbcb2aafe27ef6fe4e97c4f2dd

SHA1
e386b94f873f7c5f334af6a27ac676147796ead9

SHA256
915d59b1632879425b82c95002ef096f7599363c71320a673a9dc705f8bc7a86

SHA512
10e46a6299dd9d3ea151a630126f3381c704d2888535fa5018df8652508dfe0ae6635d0345d6d7ec652ee6fed987a148edd19ad4a38be200dee13abca3f5802a

Download Submit
C:\Windows\System\VmFnmKQ.exe

Filesize
2.2MB

MD5
5822cbc17de3e8e8c1e7e56520a70c64

SHA1
4f19ba810d1ddc82ac2f439935652fc08cf864f6

SHA256
d4747088d7852a9982d714ae45e2ba44e2e5e2d05ac8f078ec40444781408c81

SHA512
9995d17c8c85f053f61b240c34c89f94ff10ac0582a0e139a5a8b6bc7a05442c0994ffb2c5d6403b0186f7370f7a9b3cd59b35aa3b6090ea48668e3a4e59e394

Download Submit
C:\Windows\System\VnJSmLR.exe

Filesize
2.2MB

MD5
09f9afc61aa56700cf36c84db478d24b

SHA1
76036ae835c6ef636838b8db1a7eebbd610af84d

SHA256
cf47a0948c3d5df54739f1292293dde1e2edf8e53beeb95c09de0abcfeefec0e

SHA512
981581adc89b232223321a2e007a955167da7f0e735007fed84fd710558660f4e1943ea75d429402cded0c6e01a9a9e9411bb0073b38899cd0696988ddff25c7

Download Submit
C:\Windows\System\VoFcxQA.exe

Filesize
2.2MB

MD5
27474b83aef1ca97685c9c72616b6e21

SHA1
01d2bdd17b5f2fdbb20b9e6df362cdbfc36205e3

SHA256
2b575a6eb497620ecdfd59f95a50659b27f9bfa006f6a087bf1a96e6d402127a

SHA512
7d8e71c6456bbbbadfacbed895b15215ce26b9b71302333793c0f3d0bc2a0b4fce2e0ca9e7a88ba441b77b5ed834eca8386b9fea6713b95d536bf6a57e568cb7

Download Submit
C:\Windows\System\XJMzChf.exe

Filesize
2.2MB

MD5
be761e13249120c281711ee74910027e

SHA1
b3327a158d65f7a512c1a7539f315327d83be3a6

SHA256
dec97c4c6b0ff85a7db3bf2ed3697e5558747030d44f26791c46a1ecf8a5dd61

SHA512
9c5aa8384186754f10c633ad6faf35c18acf57cea5db1ecefa1ef8e53a1540cb91055e80e9b6c18ddd560f5352a5a8db223716309f6e109fcfa55ff7c93d0ccc

Download Submit
C:\Windows\System\XNDCncj.exe

Filesize
2.2MB

MD5
87a08e26aeeaa0885ecc70a689310ddf

SHA1
21b2faf1002394b95702cf9f266a0abeb0599fcd

SHA256
95a55062295b47a9dbcfa9ced8a20d9c46045f1756e7f0580143ecf7ed29831b

SHA512
e4fcbe947a18144f6b494ef86f4d62de3a8d42942c9fa32d8ea03ccc04ed8badd83e98a16835c934098e029d255910714051159a7c3873b5fe4932c6fd0850db

Download Submit
C:\Windows\System\YrCUhoj.exe

Filesize
2.2MB

MD5
4e26ed7ccacdc80bae406dda5360abd4

SHA1
d8cb9914cb81a4078d38dfc3d6f5277b332a10c3

SHA256
151487d536c285339b20a8ca9fda6ac3ee437f1e36142dd399c37622fda034b7

SHA512
f2d134d2e86e75927a2da4a2fb4a112dfd287c4035db322b6e18b8c024c1f90b3a982b7f5576a63db7d47bc7d574be65418b223937807bb40fe8c54c495b219e

Download Submit
C:\Windows\System\ZmAnJTq.exe

Filesize
2.2MB

MD5
f90244d37e4e7d6502d029f6b8d1445e

SHA1
ff652a0a611aadb669d02493412cecbb108a6985

SHA256
5c732e00edc9ac302655141aff4a2b454c9fc019d6990fe2b850cc2bf0635d2e

SHA512
96d70b49e02454bf1fa090fbae1739d7042da5bd2bf284aad2501dce6f10b1de3dec79c815e49a8453a8b03f8d88bb108f63aff05898461ae48a900e687c03a6

Download Submit
C:\Windows\System\aTOsJmR.exe

Filesize
2.2MB

MD5
d091d4dfdf01558524f5fc1aff9be0dc

SHA1
540f5671b6a4ad3fbdeaabe5a5279f79ce6a4fad

SHA256
889e877fe8d41559900920f3150b409ab8ad87c848a43dc0f6e9137c21459750

SHA512
e5dc7400a3a32ecf1b9a3d781fd5f70ff7f3814a47e86db1df0ab190e7bf812006e13d2f9f4d31caf4450451999b81f4c1754546cd551098d394b43d6155778d

Download Submit
C:\Windows\System\cTHyxfH.exe

Filesize
2.2MB

MD5
4c1bdf567e45381b9026dddcead367cb

SHA1
b3633226bb39a27649ed8ef41c2f86417301423f

SHA256
8a3cdaa759b641562817f99f8ee8abf65cba5d75906d3522e730ce38e44f5255

SHA512
3256eccfda94d155cf46673e602996173d498a4ab295625d82a51ce2252021f40d12e03f4ce2720ce212ee88137ab950ef03efe502023b5c7f0553c8733ff935

Download Submit
C:\Windows\System\eDEzrdQ.exe

Filesize
2.2MB

MD5
14d0ba9872b50bbb09e0c533e6dd884b

SHA1
c551a1978535154586ad7c390cc0a6448e0f678a

SHA256
9463fbecba2f29f2a8b0f35efba277cb96028b22233467edeb64209006d85a78

SHA512
b8a7a1573a9a19a54c0830acbdf7bf63fdb21bf046568075bfde829706a956fa1a29a695bf89ee8a0895aa8dcb040f9c75db65cc151a8d4797a140d19af96e06

Download Submit
C:\Windows\System\eXFwciW.exe

Filesize
2.2MB

MD5
dea962f365cf39c3af6406a6d1d74918

SHA1
09e9290e57f1a3124a61e11d71162759fe5e96fe

SHA256
8632001bf01e6d6f449925eddfb3e3b31ed9ee3aa993b6415605135f1bee609d

SHA512
916eb82f553e50b37907a35c66a8be49110e1079e298035a5260491dff3dcd88f884156fdd452c08002da2a2191ae846ba03bbe6de6bdf5abd155d2e835f49ae

Download Submit
C:\Windows\System\hxhlImy.exe

Filesize
2.2MB

MD5
5e845bbc62d8277d41575bbb17c30200

SHA1
8017fa0282d2bfe7618ebe3034309d722c48b18c

SHA256
d463ba397f3ce363b99539101f31953f4ae0506fdcaa0995ba220570215d04d0

SHA512
bf1e505042373d5cfa7c194cf665ff350d0a171f6df6eed53202b38cc1522ee2fc49d300383571f515e79109b9d5f83078525b36b2cec1f75b3c8a2a5ff2b20a

Download Submit
C:\Windows\System\kfRLhTj.exe

Filesize
2.2MB

MD5
88edefce052cce3e325c5061df7e1c09

SHA1
43558d50d878ea9e349733401bba5a1c0390a7fc

SHA256
8470113660ad63ffdd3e4151493a3e86b9b02db919018b2931f9f5cd08e8a6f4

SHA512
228885d6baeb39ab9e3ae0222a4f9c2f8e87962d379d55d7aaa454f712a424ad4692f34019973f4a6b776dab693f207b675b81de6ad9c9496844fe7aac9f13bc

Download Submit
C:\Windows\System\kmiLEzH.exe

Filesize
2.2MB

MD5
44c758a23fa206468d9b3e6a9e968dc5

SHA1
151815d4ff06296bfce4fc019ea3fcf32c9dbc10

SHA256
c6403b9ecc28a6d1980c97c9129d494be70cf1cae17669b42550fd6d2c33824f

SHA512
3055e8ad70d4b7aaa8e1f53a1e198d7bcc6514afb185b3bc55e63c398f449374ad1bee782a1c0ddc9d4ba5c2396bffd9cd9512f73a45dbc993578708ef763ef3

Download Submit
C:\Windows\System\mNhMpsn.exe

Filesize
2.2MB

MD5
a6ef531d190ed5a2bd04ee64be69994b

SHA1
47d2dec89770e96b2a71a974c90f4c69ada0c3b6

SHA256
0277ccd33eef1fd84816c0a668d7cdd8cc3ecabb5150c0c5a9cb8502053f4b5f

SHA512
7cba2de981ab51e207be9eeab435ee7231dff327605e67a8efb1f8ec044fc3d10554e1df2d60f02eb651bc8e11effaaee45782bfebd29ca31475ea8443b5a6b3

Download Submit
C:\Windows\System\rEMQXUo.exe

Filesize
2.2MB

MD5
196d75ddae67314f0609fca743b2167a

SHA1
b54f9fb1d3db3ba7bac6f4df95910a3072ebd952

SHA256
4348bb4cbbb15285076945c71615fcd006429bd7e24f5b51bf12dc9c6832156c

SHA512
ecea198f601b196698a534977fb35d890282f350207c5ae9a9c6f82e919f99527b0879a96fa763051211813ac2098c9e1685503fbe34021903d97baf8dde6478

Download Submit
C:\Windows\System\rHUFUqA.exe

Filesize
2.2MB

MD5
00fc6bd63144763b0b6dd0203fee492f

SHA1
9d75721ea8a40a3b7afc29da3c4ff8c636af99a3

SHA256
ccd56aeb8f0650924a03eaea3d0e66bb307158bae1c6d43d017a56b76d2116a2

SHA512
12964ed6c26da4ffee289e979c87d0b58b7c666d57cf3fef956b3a9010d01e20327f34104bdd4107747a769649f78b3c1b1014063821d70cfb3569ebbd4391fd

Download Submit
C:\Windows\System\rcGStNT.exe

Filesize
2.2MB

MD5
e97323cddac22c817e126fc64e6b823d

SHA1
56c16c197836c39795d959a334a4e3335529ea3c

SHA256
5f559892c5ecab9ed44203483cbb7975a7c67f6f718499ad3d9eef5f45484c37

SHA512
55fc5de4c5670189d3bab3273962208448a2bcdab2f4b07d9d2a2ffc7bbf581eb57b4dd997e0f38d58faa2784d593695f7c0dde86b78f54a5f409033dd7b49ca

Download Submit
C:\Windows\System\vneDNPX.exe

Filesize
2.2MB

MD5
3921556b6fafda1d9e438e9cc0e3dcfd

SHA1
e1b84d438b8273cc05b99cecff43136dff44ea83

SHA256
c23c1c808cd018ae42b4b3f9b68dac8af741fefb593fb99826c7d6da7215baf4

SHA512
6b6a83b0d416700ee12e4e258980a37a3636efaac7bb85f2b3fe8c4e341a322c82aef53bc329828d2fbb83714ccacd235e270bee9c20dd1caa75b2f8b525a06d

Download Submit
C:\Windows\System\vsrlmSO.exe

Filesize
2.2MB

MD5
338d04255c04e112fd629f3767e2a12b

SHA1
67a67321a67377541f0a046edbf9da026e4921b6

SHA256
538b707c266f581cc8edb7c7a75d3b3d8c9ea6040d59e278465a9a45affe4e3a

SHA512
0e1e40dc9eff2296fb09cdde01b72adf5a064699be45a89d99ab2c4886cdcd15013d41c51ab456206e00e63e687985b98c80dab7cc37a85b9bcb63f9253df901

Download Submit
C:\Windows\System\yrkXyab.exe

Filesize
2.2MB

MD5
07a934511d1267e7ea0db7432f9d2412

SHA1
78da3e4dfeeb405d8d9abe27ed193280541b76df

SHA256
adaa1b8997a73a2c5939bed9605a8f14114a423a9ee397217099c7c94086ed8e

SHA512
d9ea311f1d3164511ecc44e3ec5d0d051600bbada4e4732ddd6acd0407dfe77addfbd568c0b526f0e44a6e44050a323a2dd0e384a422aa98e7e0c8af8161be14

Download Submit
memory/400-381-0x00007FF69C1C0000-0x00007FF69C5B2000-memory.dmp

Filesize
3.9MB

Download
memory/400-4246-0x00007FF69C1C0000-0x00007FF69C5B2000-memory.dmp

Filesize
3.9MB

Download
memory/692-503-0x00007FF7CD560000-0x00007FF7CD952000-memory.dmp

Filesize
3.9MB

Download
memory/692-4263-0x00007FF7CD560000-0x00007FF7CD952000-memory.dmp

Filesize
3.9MB

Download
memory/704-4231-0x00007FF7BD830000-0x00007FF7BDC22000-memory.dmp

Filesize
3.9MB

Download
memory/704-153-0x00007FF7BD830000-0x00007FF7BDC22000-memory.dmp

Filesize
3.9MB

Download
memory/948-4229-0x00007FF7A8BD0000-0x00007FF7A8FC2000-memory.dmp

Filesize
3.9MB

Download
memory/948-237-0x00007FF7A8BD0000-0x00007FF7A8FC2000-memory.dmp

Filesize
3.9MB

Download
memory/1140-500-0x00007FF69B8A0000-0x00007FF69BC92000-memory.dmp

Filesize
3.9MB

Download
memory/1140-4247-0x00007FF69B8A0000-0x00007FF69BC92000-memory.dmp

Filesize
3.9MB

Download
memory/1180-302-0x00007FF6CAFC0000-0x00007FF6CB3B2000-memory.dmp

Filesize
3.9MB

Download
memory/1180-4240-0x00007FF6CAFC0000-0x00007FF6CB3B2000-memory.dmp

Filesize
3.9MB

Download
memory/1720-4236-0x00007FF656B70000-0x00007FF656F62000-memory.dmp

Filesize
3.9MB

Download
memory/1720-269-0x00007FF656B70000-0x00007FF656F62000-memory.dmp

Filesize
3.9MB

Download
memory/1760-13-0x00007FF642710000-0x00007FF642B02000-memory.dmp

Filesize
3.9MB

Download
memory/1760-4225-0x00007FF642710000-0x00007FF642B02000-memory.dmp

Filesize
3.9MB

Download
memory/2192-4265-0x00007FF65C9C0000-0x00007FF65CDB2000-memory.dmp

Filesize
3.9MB

Download
memory/2192-501-0x00007FF65C9C0000-0x00007FF65CDB2000-memory.dmp

Filesize
3.9MB

Download
memory/2500-504-0x00007FF772B70000-0x00007FF772F62000-memory.dmp

Filesize
3.9MB

Download
memory/2500-4260-0x00007FF772B70000-0x00007FF772F62000-memory.dmp

Filesize
3.9MB

Download
memory/3212-498-0x00007FF7C8860000-0x00007FF7C8C52000-memory.dmp

Filesize
3.9MB

Download
memory/3212-4270-0x00007FF7C8860000-0x00007FF7C8C52000-memory.dmp

Filesize
3.9MB

Download
memory/3388-265-0x00007FF6AF0B0000-0x00007FF6AF4A2000-memory.dmp

Filesize
3.9MB

Download
memory/3388-4237-0x00007FF6AF0B0000-0x00007FF6AF4A2000-memory.dmp

Filesize
3.9MB

Download
memory/3808-4258-0x00007FF6A4980000-0x00007FF6A4D72000-memory.dmp

Filesize
3.9MB

Download
memory/3808-497-0x00007FF6A4980000-0x00007FF6A4D72000-memory.dmp

Filesize
3.9MB

Download
memory/3848-499-0x00007FF6951B0000-0x00007FF6955A2000-memory.dmp

Filesize
3.9MB

Download
memory/3848-4256-0x00007FF6951B0000-0x00007FF6955A2000-memory.dmp

Filesize
3.9MB

Download
memory/3864-4251-0x00007FF647080000-0x00007FF647472000-memory.dmp

Filesize
3.9MB

Download
memory/3864-435-0x00007FF647080000-0x00007FF647472000-memory.dmp

Filesize
3.9MB

Download
memory/4016-4227-0x00007FF60DC80000-0x00007FF60E072000-memory.dmp

Filesize
3.9MB

Download
memory/4016-114-0x00007FF60DC80000-0x00007FF60E072000-memory.dmp

Filesize
3.9MB

Download
memory/4072-4241-0x00007FF68FD60000-0x00007FF690152000-memory.dmp

Filesize
3.9MB

Download
memory/4072-199-0x00007FF68FD60000-0x00007FF690152000-memory.dmp

Filesize
3.9MB

Download
memory/4144-0-0x00007FF62AC00000-0x00007FF62AFF2000-memory.dmp

Filesize
3.9MB

Download
memory/4144-1-0x0000017737D00000-0x0000017737D10000-memory.dmp

Filesize
64KB

Download
memory/4676-4243-0x00007FF6B8140000-0x00007FF6B8532000-memory.dmp

Filesize
3.9MB

Download
memory/4676-379-0x00007FF6B8140000-0x00007FF6B8532000-memory.dmp

Filesize
3.9MB

Download
memory/4712-4233-0x00007FF753FE0000-0x00007FF7543D2000-memory.dmp

Filesize
3.9MB

Download
memory/4712-329-0x00007FF753FE0000-0x00007FF7543D2000-memory.dmp

Filesize
3.9MB

Download
memory/4796-105-0x00007FFBB33A0000-0x00007FFBB3E61000-memory.dmp

Filesize
10.8MB

Download
memory/4796-16-0x00000235C9C20000-0x00000235C9C30000-memory.dmp

Filesize
64KB

Download
memory/4796-328-0x00000235CA140000-0x00000235CA162000-memory.dmp

Filesize
136KB

Download
memory/4948-467-0x00007FF7BB6F0000-0x00007FF7BBAE2000-memory.dmp

Filesize
3.9MB

Download
memory/4948-4249-0x00007FF7BB6F0000-0x00007FF7BBAE2000-memory.dmp

Filesize
3.9MB

Download
memory/5028-502-0x00007FF611DE0000-0x00007FF6121D2000-memory.dmp

Filesize
3.9MB

Download
memory/5028-4280-0x00007FF611DE0000-0x00007FF6121D2000-memory.dmp

Filesize
3.9MB

Download