xmrig | 2854eabc3ac770644f659ddb56a744b14bb476aab6de876942405af0aead7fa1

Analysis

max time kernel
61s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01-05-2024 03:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
Size

1.5MB
MD5

0b077559db64be4256ea6038200ffd4a
SHA1

7e8740a0e680480b16c08904297ce08f43624e9b
SHA256

2854eabc3ac770644f659ddb56a744b14bb476aab6de876942405af0aead7fa1
SHA512

c89ad691039c277d13b55f115ea0d4442a9e343662280081d6388c2ec2e789e87987de36b7f39068880d45df79dab5eb8138d66efb4df826708e705371b3be6b
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYsfLGrAvWWXkCV+1MKTbcMfHhGH:Lz071uv4BPMkibTIA5sf6r+WVc2HhG8Y

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 43 IoCs

miner

resource	yara_rule
behavioral2/memory/4072-122-0x00007FF642890000-0x00007FF642C82000-memory.dmp	xmrig
behavioral2/memory/1812-203-0x00007FF656930000-0x00007FF656D22000-memory.dmp	xmrig
behavioral2/memory/2896-285-0x00007FF78F3A0000-0x00007FF78F792000-memory.dmp	xmrig
behavioral2/memory/4280-325-0x00007FF6049C0000-0x00007FF604DB2000-memory.dmp	xmrig
behavioral2/memory/1032-329-0x00007FF63CCA0000-0x00007FF63D092000-memory.dmp	xmrig
behavioral2/memory/3120-328-0x00007FF6E2620000-0x00007FF6E2A12000-memory.dmp	xmrig
behavioral2/memory/1444-327-0x00007FF72B910000-0x00007FF72BD02000-memory.dmp	xmrig
behavioral2/memory/2020-326-0x00007FF7C93C0000-0x00007FF7C97B2000-memory.dmp	xmrig
behavioral2/memory/5108-324-0x00007FF6A7B60000-0x00007FF6A7F52000-memory.dmp	xmrig
behavioral2/memory/3444-322-0x00007FF7D8330000-0x00007FF7D8722000-memory.dmp	xmrig
behavioral2/memory/1356-319-0x00007FF78DA60000-0x00007FF78DE52000-memory.dmp	xmrig
behavioral2/memory/3024-263-0x00007FF670470000-0x00007FF670862000-memory.dmp	xmrig
behavioral2/memory/4024-260-0x00007FF67EEF0000-0x00007FF67F2E2000-memory.dmp	xmrig
behavioral2/memory/2156-259-0x00007FF603A20000-0x00007FF603E12000-memory.dmp	xmrig
behavioral2/memory/452-258-0x00007FF6CEF20000-0x00007FF6CF312000-memory.dmp	xmrig
behavioral2/memory/4640-257-0x00007FF737360000-0x00007FF737752000-memory.dmp	xmrig
behavioral2/memory/4980-255-0x00007FF6F4040000-0x00007FF6F4432000-memory.dmp	xmrig
behavioral2/memory/3764-254-0x00007FF6F6720000-0x00007FF6F6B12000-memory.dmp	xmrig
behavioral2/memory/4140-244-0x00007FF7C7640000-0x00007FF7C7A32000-memory.dmp	xmrig
behavioral2/memory/4616-165-0x00007FF657290000-0x00007FF657682000-memory.dmp	xmrig
behavioral2/memory/2072-79-0x00007FF6AF550000-0x00007FF6AF942000-memory.dmp	xmrig
behavioral2/memory/4072-3490-0x00007FF642890000-0x00007FF642C82000-memory.dmp	xmrig
behavioral2/memory/2020-3524-0x00007FF7C93C0000-0x00007FF7C97B2000-memory.dmp	xmrig
behavioral2/memory/1444-3526-0x00007FF72B910000-0x00007FF72BD02000-memory.dmp	xmrig
behavioral2/memory/2072-3528-0x00007FF6AF550000-0x00007FF6AF942000-memory.dmp	xmrig
behavioral2/memory/1812-3530-0x00007FF656930000-0x00007FF656D22000-memory.dmp	xmrig
behavioral2/memory/4980-3536-0x00007FF6F4040000-0x00007FF6F4432000-memory.dmp	xmrig
behavioral2/memory/4140-3542-0x00007FF7C7640000-0x00007FF7C7A32000-memory.dmp	xmrig
behavioral2/memory/2156-3546-0x00007FF603A20000-0x00007FF603E12000-memory.dmp	xmrig
behavioral2/memory/4072-3552-0x00007FF642890000-0x00007FF642C82000-memory.dmp	xmrig
behavioral2/memory/4024-3551-0x00007FF67EEF0000-0x00007FF67F2E2000-memory.dmp	xmrig
behavioral2/memory/3120-3555-0x00007FF6E2620000-0x00007FF6E2A12000-memory.dmp	xmrig
behavioral2/memory/3024-3548-0x00007FF670470000-0x00007FF670862000-memory.dmp	xmrig
behavioral2/memory/2896-3544-0x00007FF78F3A0000-0x00007FF78F792000-memory.dmp	xmrig
behavioral2/memory/3764-3539-0x00007FF6F6720000-0x00007FF6F6B12000-memory.dmp	xmrig
behavioral2/memory/4616-3541-0x00007FF657290000-0x00007FF657682000-memory.dmp	xmrig
behavioral2/memory/452-3535-0x00007FF6CEF20000-0x00007FF6CF312000-memory.dmp	xmrig
behavioral2/memory/4640-3533-0x00007FF737360000-0x00007FF737752000-memory.dmp	xmrig
behavioral2/memory/1032-3577-0x00007FF63CCA0000-0x00007FF63D092000-memory.dmp	xmrig
behavioral2/memory/4280-3580-0x00007FF6049C0000-0x00007FF604DB2000-memory.dmp	xmrig
behavioral2/memory/1356-3588-0x00007FF78DA60000-0x00007FF78DE52000-memory.dmp	xmrig
behavioral2/memory/5108-3564-0x00007FF6A7B60000-0x00007FF6A7F52000-memory.dmp	xmrig
behavioral2/memory/3444-3573-0x00007FF7D8330000-0x00007FF7D8722000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2020	uJthVSo.exe
1444	lyhWisc.exe
2072	cCExjhy.exe
4072	cCyqWCD.exe
4616	fZPMYph.exe
1812	TYBIAqy.exe
4140	jsWUcln.exe
3764	iXzUyOo.exe
4980	nfoCuRq.exe
4640	dBDgJCX.exe
452	sSWYzgd.exe
2156	ZRjhLfF.exe
4024	FQHLOaw.exe
3024	zYmtMzp.exe
3120	LOyNCWX.exe
2896	QktfsEv.exe
1356	aaBfKfE.exe
3444	NfQECOR.exe
5108	pVPlIno.exe
4280	aXMMmOg.exe
1032	WRbnoJp.exe
3716	kDPyjNW.exe
5060	KjncqPN.exe
1940	OdgwcEB.exe
4128	ysQbhJq.exe
2280	ftpxTuJ.exe
2620	eFKSdEY.exe
2268	grUsxPG.exe
1716	nvwAySB.exe
3728	shpHnes.exe
556	qhVqtUY.exe
2120	RvGkvkz.exe
2428	blqXKPH.exe
4488	IrTzCnT.exe
3712	SUGuZvG.exe
2748	HiQvyrU.exe
3188	ylSHefo.exe
3556	aUkcoZN.exe
3968	SAgabHp.exe
3964	MYkBXzd.exe
2784	rgGIJjC.exe
3144	yrwMqTl.exe
1860	kBXAcoi.exe
1052	cbpUDHi.exe
1216	mHcUNFV.exe
3464	pWRYnXH.exe
2848	JYKpZvT.exe
3620	tdipwrv.exe
2536	LuvUsim.exe
3412	NZFrbSN.exe
3992	LCnpWvW.exe
4352	KRydGhf.exe
1560	Qmtvetf.exe
1364	KcCarqu.exe
3212	RoxzhVg.exe
4580	daYSbsc.exe
3204	OltYIAf.exe
1632	IHJimfh.exe
3708	uGiTIEW.exe
2276	GtDwWxj.exe
1900	TpdiBKR.exe
3240	dXXLUBZ.exe
2572	cvSMUAl.exe
3616	YhzvKbR.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4376-0-0x00007FF6A7100000-0x00007FF6A74F2000-memory.dmp	upx
behavioral2/files/0x000b000000023b86-5.dat	upx
behavioral2/files/0x000a000000023b8b-8.dat	upx
behavioral2/files/0x000a000000023b8a-11.dat	upx
behavioral2/files/0x000a000000023b93-55.dat	upx
behavioral2/files/0x000a000000023b91-51.dat	upx
behavioral2/files/0x000a000000023b8f-30.dat	upx
behavioral2/files/0x000a000000023b8e-29.dat	upx
behavioral2/files/0x000a000000023b8d-42.dat	upx
behavioral2/files/0x000a000000023b8c-19.dat	upx
behavioral2/files/0x000a000000023ba0-123.dat	upx
behavioral2/memory/4072-122-0x00007FF642890000-0x00007FF642C82000-memory.dmp	upx
behavioral2/files/0x000a000000023baa-167.dat	upx
behavioral2/files/0x000a000000023baf-187.dat	upx
behavioral2/files/0x000a000000023bb2-195.dat	upx
behavioral2/memory/1812-203-0x00007FF656930000-0x00007FF656D22000-memory.dmp	upx
behavioral2/memory/2896-285-0x00007FF78F3A0000-0x00007FF78F792000-memory.dmp	upx
behavioral2/memory/4280-325-0x00007FF6049C0000-0x00007FF604DB2000-memory.dmp	upx
behavioral2/memory/1032-329-0x00007FF63CCA0000-0x00007FF63D092000-memory.dmp	upx
behavioral2/memory/3120-328-0x00007FF6E2620000-0x00007FF6E2A12000-memory.dmp	upx
behavioral2/memory/1444-327-0x00007FF72B910000-0x00007FF72BD02000-memory.dmp	upx
behavioral2/memory/2020-326-0x00007FF7C93C0000-0x00007FF7C97B2000-memory.dmp	upx
behavioral2/memory/5108-324-0x00007FF6A7B60000-0x00007FF6A7F52000-memory.dmp	upx
behavioral2/memory/3444-322-0x00007FF7D8330000-0x00007FF7D8722000-memory.dmp	upx
behavioral2/memory/1356-319-0x00007FF78DA60000-0x00007FF78DE52000-memory.dmp	upx
behavioral2/memory/3024-263-0x00007FF670470000-0x00007FF670862000-memory.dmp	upx
behavioral2/memory/4024-260-0x00007FF67EEF0000-0x00007FF67F2E2000-memory.dmp	upx
behavioral2/memory/2156-259-0x00007FF603A20000-0x00007FF603E12000-memory.dmp	upx
behavioral2/memory/452-258-0x00007FF6CEF20000-0x00007FF6CF312000-memory.dmp	upx
behavioral2/memory/4640-257-0x00007FF737360000-0x00007FF737752000-memory.dmp	upx
behavioral2/memory/4980-255-0x00007FF6F4040000-0x00007FF6F4432000-memory.dmp	upx
behavioral2/memory/3764-254-0x00007FF6F6720000-0x00007FF6F6B12000-memory.dmp	upx
behavioral2/memory/4140-244-0x00007FF7C7640000-0x00007FF7C7A32000-memory.dmp	upx
behavioral2/files/0x000a000000023bac-194.dat	upx
behavioral2/files/0x0031000000023bb7-193.dat	upx
behavioral2/files/0x0031000000023bb6-192.dat	upx
behavioral2/files/0x000a000000023bb5-191.dat	upx
behavioral2/files/0x000a000000023bb4-190.dat	upx
behavioral2/files/0x000a000000023bb3-189.dat	upx
behavioral2/files/0x000b000000023b94-188.dat	upx
behavioral2/files/0x000a000000023bae-186.dat	upx
behavioral2/files/0x000a000000023bad-183.dat	upx
behavioral2/files/0x000a000000023ba1-177.dat	upx
behavioral2/files/0x000a000000023bab-173.dat	upx
behavioral2/memory/4616-165-0x00007FF657290000-0x00007FF657682000-memory.dmp	upx
behavioral2/files/0x000a000000023ba9-163.dat	upx
behavioral2/files/0x000a000000023ba8-161.dat	upx
behavioral2/files/0x000a000000023ba7-160.dat	upx
behavioral2/files/0x000a000000023b9e-159.dat	upx
behavioral2/files/0x000b000000023b95-158.dat	upx
behavioral2/files/0x000a000000023ba6-157.dat	upx
behavioral2/files/0x000a000000023b99-154.dat	upx
behavioral2/files/0x000a000000023ba5-153.dat	upx
behavioral2/files/0x000a000000023ba4-150.dat	upx
behavioral2/files/0x000a000000023ba3-145.dat	upx
behavioral2/files/0x000a000000023ba2-143.dat	upx
behavioral2/files/0x000a000000023b98-138.dat	upx
behavioral2/files/0x000a000000023b97-135.dat	upx
behavioral2/files/0x000a000000023b96-129.dat	upx
behavioral2/files/0x000a000000023b9a-124.dat	upx
behavioral2/files/0x000a000000023b92-114.dat	upx
behavioral2/files/0x000a000000023b9f-112.dat	upx
behavioral2/files/0x000a000000023b9d-109.dat	upx
behavioral2/files/0x000a000000023b9c-99.dat	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\uRxuPOD.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\mYGJyFC.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\NzBOJNH.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\IaPrsWd.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\urTkuTd.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\SMmyoZt.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\lgZPNdF.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\PXZuVPu.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\XdYwRcB.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\iFwPzrV.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\Zjgkkwg.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\fQtAOGw.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\ouhiUXc.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\KVWBJxt.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\GnkDnfo.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\KjncqPN.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\oKwViCZ.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\GidPeXM.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\gyQzwwk.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\ZUMwiUH.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\vwslHdJ.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\kgigVmh.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\tUQYGMh.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\mFuEwQr.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\DfnLVmY.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\GvXbzkB.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\dBDgJCX.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\BDISCdi.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\obuoivN.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\oRKwowL.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\sSLxcqO.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\FyMeuwx.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\GGYUeqQ.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\QfNbwUJ.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\bYrmjie.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\GiZrRzS.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\WdtKfIX.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\VbEWjFi.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\pIMQRsT.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\ZDPLEaU.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\aOHDtWF.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\LNBudAi.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\yxuwVsM.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\mbhIeTf.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\QuBTcmY.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\MQDWWTl.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\KcmDgvN.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\UiYnAjZ.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\fFVATbH.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\szKtZzF.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\gePLRbY.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\IVRkLhA.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\uGiTIEW.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\TmpfXoK.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\WzIFZMf.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\YauHcnB.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\hcVNYWA.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\GmAIxQi.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\JkYUnvD.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\nsxLbTG.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\JsMvRas.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\PPNqBEZ.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\ZneWYUx.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\ABmhbdP.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
440	powershell.exe
440	powershell.exe
440	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	440	powershell.exe
Token: SeLockMemoryPrivilege	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 440	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	84
PID 4376 wrote to memory of 440	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	84
PID 4376 wrote to memory of 2020	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	85
PID 4376 wrote to memory of 2020	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	85
PID 4376 wrote to memory of 1444	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	86
PID 4376 wrote to memory of 1444	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	86
PID 4376 wrote to memory of 2072	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	87
PID 4376 wrote to memory of 2072	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	87
PID 4376 wrote to memory of 4072	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	88
PID 4376 wrote to memory of 4072	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	88
PID 4376 wrote to memory of 4140	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	89
PID 4376 wrote to memory of 4140	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	89
PID 4376 wrote to memory of 4616	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	90
PID 4376 wrote to memory of 4616	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	90
PID 4376 wrote to memory of 1812	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	91
PID 4376 wrote to memory of 1812	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	91
PID 4376 wrote to memory of 3764	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	92
PID 4376 wrote to memory of 3764	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	92
PID 4376 wrote to memory of 4980	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	93
PID 4376 wrote to memory of 4980	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	93
PID 4376 wrote to memory of 4640	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	94
PID 4376 wrote to memory of 4640	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	94
PID 4376 wrote to memory of 452	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	95
PID 4376 wrote to memory of 452	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	95
PID 4376 wrote to memory of 2156	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	96
PID 4376 wrote to memory of 2156	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	96
PID 4376 wrote to memory of 4024	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	97
PID 4376 wrote to memory of 4024	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	97
PID 4376 wrote to memory of 3024	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	98
PID 4376 wrote to memory of 3024	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	98
PID 4376 wrote to memory of 3120	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	99
PID 4376 wrote to memory of 3120	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	99
PID 4376 wrote to memory of 2896	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	100
PID 4376 wrote to memory of 2896	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	100
PID 4376 wrote to memory of 1356	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	101
PID 4376 wrote to memory of 1356	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	101
PID 4376 wrote to memory of 3444	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	102
PID 4376 wrote to memory of 3444	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	102
PID 4376 wrote to memory of 5108	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	103
PID 4376 wrote to memory of 5108	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	103
PID 4376 wrote to memory of 1716	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	104
PID 4376 wrote to memory of 1716	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	104
PID 4376 wrote to memory of 4280	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	105
PID 4376 wrote to memory of 4280	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	105
PID 4376 wrote to memory of 1032	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	106
PID 4376 wrote to memory of 1032	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	106
PID 4376 wrote to memory of 3716	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	107
PID 4376 wrote to memory of 3716	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	107
PID 4376 wrote to memory of 5060	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	108
PID 4376 wrote to memory of 5060	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	108
PID 4376 wrote to memory of 1940	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	109
PID 4376 wrote to memory of 1940	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	109
PID 4376 wrote to memory of 4128	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	110
PID 4376 wrote to memory of 4128	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	110
PID 4376 wrote to memory of 2280	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	111
PID 4376 wrote to memory of 2280	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	111
PID 4376 wrote to memory of 2620	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	112
PID 4376 wrote to memory of 2620	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	112
PID 4376 wrote to memory of 2268	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	113
PID 4376 wrote to memory of 2268	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	113
PID 4376 wrote to memory of 3728	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	114
PID 4376 wrote to memory of 3728	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	114
PID 4376 wrote to memory of 556	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	115
PID 4376 wrote to memory of 556	4376	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:440
- C:\Windows\System\uJthVSo.exe
  C:\Windows\System\uJthVSo.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\lyhWisc.exe
  C:\Windows\System\lyhWisc.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\cCExjhy.exe
  C:\Windows\System\cCExjhy.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\cCyqWCD.exe
  C:\Windows\System\cCyqWCD.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\jsWUcln.exe
  C:\Windows\System\jsWUcln.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\fZPMYph.exe
  C:\Windows\System\fZPMYph.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\TYBIAqy.exe
  C:\Windows\System\TYBIAqy.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\iXzUyOo.exe
  C:\Windows\System\iXzUyOo.exe
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Windows\System\nfoCuRq.exe
  C:\Windows\System\nfoCuRq.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\dBDgJCX.exe
  C:\Windows\System\dBDgJCX.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\sSWYzgd.exe
  C:\Windows\System\sSWYzgd.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\ZRjhLfF.exe
  C:\Windows\System\ZRjhLfF.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\FQHLOaw.exe
  C:\Windows\System\FQHLOaw.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\zYmtMzp.exe
  C:\Windows\System\zYmtMzp.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\LOyNCWX.exe
  C:\Windows\System\LOyNCWX.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\QktfsEv.exe
  C:\Windows\System\QktfsEv.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\aaBfKfE.exe
  C:\Windows\System\aaBfKfE.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\NfQECOR.exe
  C:\Windows\System\NfQECOR.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\pVPlIno.exe
  C:\Windows\System\pVPlIno.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\nvwAySB.exe
  C:\Windows\System\nvwAySB.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\aXMMmOg.exe
  C:\Windows\System\aXMMmOg.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\WRbnoJp.exe
  C:\Windows\System\WRbnoJp.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\kDPyjNW.exe
  C:\Windows\System\kDPyjNW.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System\KjncqPN.exe
  C:\Windows\System\KjncqPN.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\OdgwcEB.exe
  C:\Windows\System\OdgwcEB.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\ysQbhJq.exe
  C:\Windows\System\ysQbhJq.exe
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\Windows\System\ftpxTuJ.exe
  C:\Windows\System\ftpxTuJ.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\eFKSdEY.exe
  C:\Windows\System\eFKSdEY.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\grUsxPG.exe
  C:\Windows\System\grUsxPG.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\shpHnes.exe
  C:\Windows\System\shpHnes.exe
  2⤵
  - Executes dropped EXE
  PID:3728
- C:\Windows\System\qhVqtUY.exe
  C:\Windows\System\qhVqtUY.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\RvGkvkz.exe
  C:\Windows\System\RvGkvkz.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\blqXKPH.exe
  C:\Windows\System\blqXKPH.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\IrTzCnT.exe
  C:\Windows\System\IrTzCnT.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\cbpUDHi.exe
  C:\Windows\System\cbpUDHi.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\SUGuZvG.exe
  C:\Windows\System\SUGuZvG.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\HiQvyrU.exe
  C:\Windows\System\HiQvyrU.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\ylSHefo.exe
  C:\Windows\System\ylSHefo.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System\pWRYnXH.exe
  C:\Windows\System\pWRYnXH.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\JYKpZvT.exe
  C:\Windows\System\JYKpZvT.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\mHcUNFV.exe
  C:\Windows\System\mHcUNFV.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\aUkcoZN.exe
  C:\Windows\System\aUkcoZN.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\SAgabHp.exe
  C:\Windows\System\SAgabHp.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\MYkBXzd.exe
  C:\Windows\System\MYkBXzd.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\rgGIJjC.exe
  C:\Windows\System\rgGIJjC.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\yrwMqTl.exe
  C:\Windows\System\yrwMqTl.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\kBXAcoi.exe
  C:\Windows\System\kBXAcoi.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\tdipwrv.exe
  C:\Windows\System\tdipwrv.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\LuvUsim.exe
  C:\Windows\System\LuvUsim.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\NZFrbSN.exe
  C:\Windows\System\NZFrbSN.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\LCnpWvW.exe
  C:\Windows\System\LCnpWvW.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\KRydGhf.exe
  C:\Windows\System\KRydGhf.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\Qmtvetf.exe
  C:\Windows\System\Qmtvetf.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\KcCarqu.exe
  C:\Windows\System\KcCarqu.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\RoxzhVg.exe
  C:\Windows\System\RoxzhVg.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\daYSbsc.exe
  C:\Windows\System\daYSbsc.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\OltYIAf.exe
  C:\Windows\System\OltYIAf.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\IHJimfh.exe
  C:\Windows\System\IHJimfh.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\uGiTIEW.exe
  C:\Windows\System\uGiTIEW.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\GtDwWxj.exe
  C:\Windows\System\GtDwWxj.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\TpdiBKR.exe
  C:\Windows\System\TpdiBKR.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\dXXLUBZ.exe
  C:\Windows\System\dXXLUBZ.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\cvSMUAl.exe
  C:\Windows\System\cvSMUAl.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\YhzvKbR.exe
  C:\Windows\System\YhzvKbR.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\SgNphxZ.exe
  C:\Windows\System\SgNphxZ.exe
  2⤵
  PID:2528
- C:\Windows\System\ScbwwMl.exe
  C:\Windows\System\ScbwwMl.exe
  2⤵
  PID:2576
- C:\Windows\System\bRXpakM.exe
  C:\Windows\System\bRXpakM.exe
  2⤵
  PID:4388
- C:\Windows\System\lhAXdMz.exe
  C:\Windows\System\lhAXdMz.exe
  2⤵
  PID:4556
- C:\Windows\System\hnKfaHD.exe
  C:\Windows\System\hnKfaHD.exe
  2⤵
  PID:1508
- C:\Windows\System\nQmHDnw.exe
  C:\Windows\System\nQmHDnw.exe
  2⤵
  PID:5132
- C:\Windows\System\zVicsEx.exe
  C:\Windows\System\zVicsEx.exe
  2⤵
  PID:5152
- C:\Windows\System\oTFvWVW.exe
  C:\Windows\System\oTFvWVW.exe
  2⤵
  PID:5172
- C:\Windows\System\YemkLXD.exe
  C:\Windows\System\YemkLXD.exe
  2⤵
  PID:5192
- C:\Windows\System\qlkjMIy.exe
  C:\Windows\System\qlkjMIy.exe
  2⤵
  PID:5208
- C:\Windows\System\JQWnFlT.exe
  C:\Windows\System\JQWnFlT.exe
  2⤵
  PID:5224
- C:\Windows\System\EgBwIXS.exe
  C:\Windows\System\EgBwIXS.exe
  2⤵
  PID:5240
- C:\Windows\System\VZvMmAi.exe
  C:\Windows\System\VZvMmAi.exe
  2⤵
  PID:5256
- C:\Windows\System\Hdpubmf.exe
  C:\Windows\System\Hdpubmf.exe
  2⤵
  PID:5272
- C:\Windows\System\dEuVgxN.exe
  C:\Windows\System\dEuVgxN.exe
  2⤵
  PID:5292
- C:\Windows\System\douzYOK.exe
  C:\Windows\System\douzYOK.exe
  2⤵
  PID:5308
- C:\Windows\System\JZEkqIT.exe
  C:\Windows\System\JZEkqIT.exe
  2⤵
  PID:5332
- C:\Windows\System\ZSRfZTV.exe
  C:\Windows\System\ZSRfZTV.exe
  2⤵
  PID:5348
- C:\Windows\System\ZtKPBEr.exe
  C:\Windows\System\ZtKPBEr.exe
  2⤵
  PID:5372
- C:\Windows\System\pcjsTDF.exe
  C:\Windows\System\pcjsTDF.exe
  2⤵
  PID:5388
- C:\Windows\System\rLNOrQq.exe
  C:\Windows\System\rLNOrQq.exe
  2⤵
  PID:5548
- C:\Windows\System\uHAUHhX.exe
  C:\Windows\System\uHAUHhX.exe
  2⤵
  PID:5572
- C:\Windows\System\AoaFHut.exe
  C:\Windows\System\AoaFHut.exe
  2⤵
  PID:5600
- C:\Windows\System\fpzfaWi.exe
  C:\Windows\System\fpzfaWi.exe
  2⤵
  PID:5676
- C:\Windows\System\aIqQtcB.exe
  C:\Windows\System\aIqQtcB.exe
  2⤵
  PID:5692
- C:\Windows\System\vqeCpot.exe
  C:\Windows\System\vqeCpot.exe
  2⤵
  PID:5712
- C:\Windows\System\pGpRtrL.exe
  C:\Windows\System\pGpRtrL.exe
  2⤵
  PID:5736
- C:\Windows\System\FYbsPDB.exe
  C:\Windows\System\FYbsPDB.exe
  2⤵
  PID:5760
- C:\Windows\System\jVymxCI.exe
  C:\Windows\System\jVymxCI.exe
  2⤵
  PID:5800
- C:\Windows\System\nGofHwG.exe
  C:\Windows\System\nGofHwG.exe
  2⤵
  PID:5816
- C:\Windows\System\vmsDOdM.exe
  C:\Windows\System\vmsDOdM.exe
  2⤵
  PID:5832
- C:\Windows\System\JssgCBg.exe
  C:\Windows\System\JssgCBg.exe
  2⤵
  PID:5848
- C:\Windows\System\bZBXPQP.exe
  C:\Windows\System\bZBXPQP.exe
  2⤵
  PID:5868
- C:\Windows\System\GGYUeqQ.exe
  C:\Windows\System\GGYUeqQ.exe
  2⤵
  PID:5888
- C:\Windows\System\cQnpost.exe
  C:\Windows\System\cQnpost.exe
  2⤵
  PID:5916
- C:\Windows\System\TBzMFqx.exe
  C:\Windows\System\TBzMFqx.exe
  2⤵
  PID:5932
- C:\Windows\System\dhsVkZy.exe
  C:\Windows\System\dhsVkZy.exe
  2⤵
  PID:5952
- C:\Windows\System\WknDKHT.exe
  C:\Windows\System\WknDKHT.exe
  2⤵
  PID:6076
- C:\Windows\System\vhyLlhY.exe
  C:\Windows\System\vhyLlhY.exe
  2⤵
  PID:6096
- C:\Windows\System\DZfmrgA.exe
  C:\Windows\System\DZfmrgA.exe
  2⤵
  PID:6124
- C:\Windows\System\owKlpOc.exe
  C:\Windows\System\owKlpOc.exe
  2⤵
  PID:4848
- C:\Windows\System\WETqrwS.exe
  C:\Windows\System\WETqrwS.exe
  2⤵
  PID:4692
- C:\Windows\System\WpFtAwZ.exe
  C:\Windows\System\WpFtAwZ.exe
  2⤵
  PID:4976
- C:\Windows\System\FteXHGM.exe
  C:\Windows\System\FteXHGM.exe
  2⤵
  PID:2532
- C:\Windows\System\MLdDOsR.exe
  C:\Windows\System\MLdDOsR.exe
  2⤵
  PID:3292
- C:\Windows\System\LWEwDDZ.exe
  C:\Windows\System\LWEwDDZ.exe
  2⤵
  PID:3768
- C:\Windows\System\mPNxjBX.exe
  C:\Windows\System\mPNxjBX.exe
  2⤵
  PID:2108
- C:\Windows\System\oZdVEOB.exe
  C:\Windows\System\oZdVEOB.exe
  2⤵
  PID:2524
- C:\Windows\System\XdweMtU.exe
  C:\Windows\System\XdweMtU.exe
  2⤵
  PID:212
- C:\Windows\System\OecsXtR.exe
  C:\Windows\System\OecsXtR.exe
  2⤵
  PID:5164
- C:\Windows\System\szKtZzF.exe
  C:\Windows\System\szKtZzF.exe
  2⤵
  PID:5204
- C:\Windows\System\EPqSEUn.exe
  C:\Windows\System\EPqSEUn.exe
  2⤵
  PID:5248
- C:\Windows\System\FCAFLvQ.exe
  C:\Windows\System\FCAFLvQ.exe
  2⤵
  PID:5384
- C:\Windows\System\FKBgiDA.exe
  C:\Windows\System\FKBgiDA.exe
  2⤵
  PID:5344
- C:\Windows\System\WfFEcWx.exe
  C:\Windows\System\WfFEcWx.exe
  2⤵
  PID:5304
- C:\Windows\System\PJgXBKp.exe
  C:\Windows\System\PJgXBKp.exe
  2⤵
  PID:1196
- C:\Windows\System\YPjYAQF.exe
  C:\Windows\System\YPjYAQF.exe
  2⤵
  PID:5480
- C:\Windows\System\sFPxKfj.exe
  C:\Windows\System\sFPxKfj.exe
  2⤵
  PID:5520
- C:\Windows\System\OXTfynn.exe
  C:\Windows\System\OXTfynn.exe
  2⤵
  PID:5528
- C:\Windows\System\fKgRGjR.exe
  C:\Windows\System\fKgRGjR.exe
  2⤵
  PID:5588
- C:\Windows\System\rpjOOjD.exe
  C:\Windows\System\rpjOOjD.exe
  2⤵
  PID:5620
- C:\Windows\System\yTyGaPM.exe
  C:\Windows\System\yTyGaPM.exe
  2⤵
  PID:4596
- C:\Windows\System\Fdvnqap.exe
  C:\Windows\System\Fdvnqap.exe
  2⤵
  PID:5768
- C:\Windows\System\HuTOFps.exe
  C:\Windows\System\HuTOFps.exe
  2⤵
  PID:5840
- C:\Windows\System\WBWWTvk.exe
  C:\Windows\System\WBWWTvk.exe
  2⤵
  PID:6020
- C:\Windows\System\QQjrCCK.exe
  C:\Windows\System\QQjrCCK.exe
  2⤵
  PID:6148
- C:\Windows\System\vMgxxQz.exe
  C:\Windows\System\vMgxxQz.exe
  2⤵
  PID:6164
- C:\Windows\System\KSDSGpl.exe
  C:\Windows\System\KSDSGpl.exe
  2⤵
  PID:6188
- C:\Windows\System\muUycqL.exe
  C:\Windows\System\muUycqL.exe
  2⤵
  PID:6204
- C:\Windows\System\bTRxsML.exe
  C:\Windows\System\bTRxsML.exe
  2⤵
  PID:6220
- C:\Windows\System\TDWFJOz.exe
  C:\Windows\System\TDWFJOz.exe
  2⤵
  PID:6300
- C:\Windows\System\mWRaeVP.exe
  C:\Windows\System\mWRaeVP.exe
  2⤵
  PID:6316
- C:\Windows\System\YdRcOcj.exe
  C:\Windows\System\YdRcOcj.exe
  2⤵
  PID:6340
- C:\Windows\System\tYFRbMp.exe
  C:\Windows\System\tYFRbMp.exe
  2⤵
  PID:6356
- C:\Windows\System\oqZSyit.exe
  C:\Windows\System\oqZSyit.exe
  2⤵
  PID:6380
- C:\Windows\System\DITdHeK.exe
  C:\Windows\System\DITdHeK.exe
  2⤵
  PID:6396
- C:\Windows\System\itNRlcC.exe
  C:\Windows\System\itNRlcC.exe
  2⤵
  PID:6420
- C:\Windows\System\yrhpDZx.exe
  C:\Windows\System\yrhpDZx.exe
  2⤵
  PID:6436
- C:\Windows\System\DPfrjLF.exe
  C:\Windows\System\DPfrjLF.exe
  2⤵
  PID:6460
- C:\Windows\System\wUekAJW.exe
  C:\Windows\System\wUekAJW.exe
  2⤵
  PID:6476
- C:\Windows\System\kdrLPAp.exe
  C:\Windows\System\kdrLPAp.exe
  2⤵
  PID:6504
- C:\Windows\System\vwslHdJ.exe
  C:\Windows\System\vwslHdJ.exe
  2⤵
  PID:6520
- C:\Windows\System\vMBFCan.exe
  C:\Windows\System\vMBFCan.exe
  2⤵
  PID:6556
- C:\Windows\System\bSyrhgp.exe
  C:\Windows\System\bSyrhgp.exe
  2⤵
  PID:6576
- C:\Windows\System\uvBEjaE.exe
  C:\Windows\System\uvBEjaE.exe
  2⤵
  PID:6592
- C:\Windows\System\ldZTjUY.exe
  C:\Windows\System\ldZTjUY.exe
  2⤵
  PID:6612
- C:\Windows\System\QiCNkbL.exe
  C:\Windows\System\QiCNkbL.exe
  2⤵
  PID:6760
- C:\Windows\System\BiyuKGz.exe
  C:\Windows\System\BiyuKGz.exe
  2⤵
  PID:6784
- C:\Windows\System\KQIzUIA.exe
  C:\Windows\System\KQIzUIA.exe
  2⤵
  PID:6800
- C:\Windows\System\zQyOpdx.exe
  C:\Windows\System\zQyOpdx.exe
  2⤵
  PID:6824
- C:\Windows\System\bRoxjOe.exe
  C:\Windows\System\bRoxjOe.exe
  2⤵
  PID:6840
- C:\Windows\System\Xgkvihk.exe
  C:\Windows\System\Xgkvihk.exe
  2⤵
  PID:6864
- C:\Windows\System\QXHrjqi.exe
  C:\Windows\System\QXHrjqi.exe
  2⤵
  PID:6880
- C:\Windows\System\ukbknKD.exe
  C:\Windows\System\ukbknKD.exe
  2⤵
  PID:6904
- C:\Windows\System\ExHndVn.exe
  C:\Windows\System\ExHndVn.exe
  2⤵
  PID:6924
- C:\Windows\System\aoyrRIe.exe
  C:\Windows\System\aoyrRIe.exe
  2⤵
  PID:6948
- C:\Windows\System\DucuiYO.exe
  C:\Windows\System\DucuiYO.exe
  2⤵
  PID:6968
- C:\Windows\System\pPAoCWG.exe
  C:\Windows\System\pPAoCWG.exe
  2⤵
  PID:6992
- C:\Windows\System\RRgvJyw.exe
  C:\Windows\System\RRgvJyw.exe
  2⤵
  PID:7012
- C:\Windows\System\bmwUSNP.exe
  C:\Windows\System\bmwUSNP.exe
  2⤵
  PID:7028
- C:\Windows\System\QPfMuZF.exe
  C:\Windows\System\QPfMuZF.exe
  2⤵
  PID:7052
- C:\Windows\System\yoZuoZg.exe
  C:\Windows\System\yoZuoZg.exe
  2⤵
  PID:7068
- C:\Windows\System\wuTUBOH.exe
  C:\Windows\System\wuTUBOH.exe
  2⤵
  PID:7092
- C:\Windows\System\mOinNzT.exe
  C:\Windows\System\mOinNzT.exe
  2⤵
  PID:7108
- C:\Windows\System\uaCIaPc.exe
  C:\Windows\System\uaCIaPc.exe
  2⤵
  PID:7128
- C:\Windows\System\kiFMCYE.exe
  C:\Windows\System\kiFMCYE.exe
  2⤵
  PID:7148
- C:\Windows\System\LOmUhie.exe
  C:\Windows\System\LOmUhie.exe
  2⤵
  PID:7164
- C:\Windows\System\iXEPkFR.exe
  C:\Windows\System\iXEPkFR.exe
  2⤵
  PID:5536
- C:\Windows\System\GBbSKfw.exe
  C:\Windows\System\GBbSKfw.exe
  2⤵
  PID:5644
- C:\Windows\System\MuNPOFg.exe
  C:\Windows\System\MuNPOFg.exe
  2⤵
  PID:3324
- C:\Windows\System\DvQYXwz.exe
  C:\Windows\System\DvQYXwz.exe
  2⤵
  PID:5780
- C:\Windows\System\aYWicpj.exe
  C:\Windows\System\aYWicpj.exe
  2⤵
  PID:5860
- C:\Windows\System\pBxiany.exe
  C:\Windows\System\pBxiany.exe
  2⤵
  PID:5924
- C:\Windows\System\smfAXdK.exe
  C:\Windows\System\smfAXdK.exe
  2⤵
  PID:6028
- C:\Windows\System\DfPFIPJ.exe
  C:\Windows\System\DfPFIPJ.exe
  2⤵
  PID:6172
- C:\Windows\System\OqgKDXC.exe
  C:\Windows\System\OqgKDXC.exe
  2⤵
  PID:6212
- C:\Windows\System\GyUDjuM.exe
  C:\Windows\System\GyUDjuM.exe
  2⤵
  PID:6264
- C:\Windows\System\QNRorHo.exe
  C:\Windows\System\QNRorHo.exe
  2⤵
  PID:6312
- C:\Windows\System\YMhLYxU.exe
  C:\Windows\System\YMhLYxU.exe
  2⤵
  PID:6348
- C:\Windows\System\GEyMehn.exe
  C:\Windows\System\GEyMehn.exe
  2⤵
  PID:6392
- C:\Windows\System\GShxOAV.exe
  C:\Windows\System\GShxOAV.exe
  2⤵
  PID:6428
- C:\Windows\System\qjVgRlB.exe
  C:\Windows\System\qjVgRlB.exe
  2⤵
  PID:6472
- C:\Windows\System\kqUTMeE.exe
  C:\Windows\System\kqUTMeE.exe
  2⤵
  PID:6516
- C:\Windows\System\HlOjExW.exe
  C:\Windows\System\HlOjExW.exe
  2⤵
  PID:6744
- C:\Windows\System\dMgBWSx.exe
  C:\Windows\System\dMgBWSx.exe
  2⤵
  PID:6780
- C:\Windows\System\zzFqGYf.exe
  C:\Windows\System\zzFqGYf.exe
  2⤵
  PID:6820
- C:\Windows\System\BQUAmcT.exe
  C:\Windows\System\BQUAmcT.exe
  2⤵
  PID:6860
- C:\Windows\System\PlJqcww.exe
  C:\Windows\System\PlJqcww.exe
  2⤵
  PID:7004
- C:\Windows\System\WqcKzNy.exe
  C:\Windows\System\WqcKzNy.exe
  2⤵
  PID:7036
- C:\Windows\System\AMepQgE.exe
  C:\Windows\System\AMepQgE.exe
  2⤵
  PID:7084
- C:\Windows\System\NidpIdq.exe
  C:\Windows\System\NidpIdq.exe
  2⤵
  PID:7116
- C:\Windows\System\zEajlpG.exe
  C:\Windows\System\zEajlpG.exe
  2⤵
  PID:7160
- C:\Windows\System\sIoBxHE.exe
  C:\Windows\System\sIoBxHE.exe
  2⤵
  PID:6284
- C:\Windows\System\DHRYqgH.exe
  C:\Windows\System\DHRYqgH.exe
  2⤵
  PID:6364
- C:\Windows\System\WawVbWU.exe
  C:\Windows\System\WawVbWU.exe
  2⤵
  PID:2696
- C:\Windows\System\LsYuJqG.exe
  C:\Windows\System\LsYuJqG.exe
  2⤵
  PID:1580
- C:\Windows\System\YXwWaIV.exe
  C:\Windows\System\YXwWaIV.exe
  2⤵
  PID:3016
- C:\Windows\System\aeEnRcB.exe
  C:\Windows\System\aeEnRcB.exe
  2⤵
  PID:7188
- C:\Windows\System\ASPNukk.exe
  C:\Windows\System\ASPNukk.exe
  2⤵
  PID:7208
- C:\Windows\System\ZsqwzYl.exe
  C:\Windows\System\ZsqwzYl.exe
  2⤵
  PID:7224
- C:\Windows\System\ZsSmvNN.exe
  C:\Windows\System\ZsSmvNN.exe
  2⤵
  PID:7248
- C:\Windows\System\BhGuZbN.exe
  C:\Windows\System\BhGuZbN.exe
  2⤵
  PID:7264
- C:\Windows\System\sYIwoow.exe
  C:\Windows\System\sYIwoow.exe
  2⤵
  PID:7284
- C:\Windows\System\ISUIkuS.exe
  C:\Windows\System\ISUIkuS.exe
  2⤵
  PID:7304
- C:\Windows\System\CqvgeYm.exe
  C:\Windows\System\CqvgeYm.exe
  2⤵
  PID:7392
- C:\Windows\System\imlUEnm.exe
  C:\Windows\System\imlUEnm.exe
  2⤵
  PID:7412
- C:\Windows\System\XyhbKSA.exe
  C:\Windows\System\XyhbKSA.exe
  2⤵
  PID:7428
- C:\Windows\System\MhlftIG.exe
  C:\Windows\System\MhlftIG.exe
  2⤵
  PID:7452
- C:\Windows\System\yiXGTmI.exe
  C:\Windows\System\yiXGTmI.exe
  2⤵
  PID:7472
- C:\Windows\System\PhPAxCj.exe
  C:\Windows\System\PhPAxCj.exe
  2⤵
  PID:7492
- C:\Windows\System\jRHvHez.exe
  C:\Windows\System\jRHvHez.exe
  2⤵
  PID:7516
- C:\Windows\System\tOfdNnQ.exe
  C:\Windows\System\tOfdNnQ.exe
  2⤵
  PID:7548
- C:\Windows\System\GdCgJPW.exe
  C:\Windows\System\GdCgJPW.exe
  2⤵
  PID:7608
- C:\Windows\System\fltdYPB.exe
  C:\Windows\System\fltdYPB.exe
  2⤵
  PID:7628
- C:\Windows\System\QsWhBeN.exe
  C:\Windows\System\QsWhBeN.exe
  2⤵
  PID:7644
- C:\Windows\System\yhipXqz.exe
  C:\Windows\System\yhipXqz.exe
  2⤵
  PID:7660
- C:\Windows\System\jwfsanp.exe
  C:\Windows\System\jwfsanp.exe
  2⤵
  PID:7680
- C:\Windows\System\hLnIxjb.exe
  C:\Windows\System\hLnIxjb.exe
  2⤵
  PID:7696
- C:\Windows\System\AZCJBcl.exe
  C:\Windows\System\AZCJBcl.exe
  2⤵
  PID:7720
- C:\Windows\System\hPKXwfY.exe
  C:\Windows\System\hPKXwfY.exe
  2⤵
  PID:7736
- C:\Windows\System\KkcWKrr.exe
  C:\Windows\System\KkcWKrr.exe
  2⤵
  PID:7760
- C:\Windows\System\itSFJPU.exe
  C:\Windows\System\itSFJPU.exe
  2⤵
  PID:7776
- C:\Windows\System\QBbBtSX.exe
  C:\Windows\System\QBbBtSX.exe
  2⤵
  PID:7800
- C:\Windows\System\QZaaByv.exe
  C:\Windows\System\QZaaByv.exe
  2⤵
  PID:7820
- C:\Windows\System\pNRUnaM.exe
  C:\Windows\System\pNRUnaM.exe
  2⤵
  PID:7840
- C:\Windows\System\VNnPbfM.exe
  C:\Windows\System\VNnPbfM.exe
  2⤵
  PID:7864
- C:\Windows\System\tHlrDmt.exe
  C:\Windows\System\tHlrDmt.exe
  2⤵
  PID:7880
- C:\Windows\System\oKwViCZ.exe
  C:\Windows\System\oKwViCZ.exe
  2⤵
  PID:7904
- C:\Windows\System\YKJKJiM.exe
  C:\Windows\System\YKJKJiM.exe
  2⤵
  PID:7928
- C:\Windows\System\TcBqwNG.exe
  C:\Windows\System\TcBqwNG.exe
  2⤵
  PID:7944
- C:\Windows\System\OGJUFVg.exe
  C:\Windows\System\OGJUFVg.exe
  2⤵
  PID:7968
- C:\Windows\System\avTVQbN.exe
  C:\Windows\System\avTVQbN.exe
  2⤵
  PID:7996
- C:\Windows\System\itvFHmQ.exe
  C:\Windows\System\itvFHmQ.exe
  2⤵
  PID:8016
- C:\Windows\System\ZICjDeF.exe
  C:\Windows\System\ZICjDeF.exe
  2⤵
  PID:8032
- C:\Windows\System\lUsiJXp.exe
  C:\Windows\System\lUsiJXp.exe
  2⤵
  PID:8048
- C:\Windows\System\FmdPYqt.exe
  C:\Windows\System\FmdPYqt.exe
  2⤵
  PID:8080
- C:\Windows\System\UDfZyLa.exe
  C:\Windows\System\UDfZyLa.exe
  2⤵
  PID:8100
- C:\Windows\System\UBspCPL.exe
  C:\Windows\System\UBspCPL.exe
  2⤵
  PID:8116
- C:\Windows\System\DDDxuBO.exe
  C:\Windows\System\DDDxuBO.exe
  2⤵
  PID:8136
- C:\Windows\System\ztWHAAn.exe
  C:\Windows\System\ztWHAAn.exe
  2⤵
  PID:8160
- C:\Windows\System\SIstnOu.exe
  C:\Windows\System\SIstnOu.exe
  2⤵
  PID:8176
- C:\Windows\System\CCprCnb.exe
  C:\Windows\System\CCprCnb.exe
  2⤵
  PID:2164
- C:\Windows\System\NiGhaMK.exe
  C:\Windows\System\NiGhaMK.exe
  2⤵
  PID:3504
- C:\Windows\System\KRXCnFk.exe
  C:\Windows\System\KRXCnFk.exe
  2⤵
  PID:5540
- C:\Windows\System\jSMFxGk.exe
  C:\Windows\System\jSMFxGk.exe
  2⤵
  PID:5704
- C:\Windows\System\SzBUcLX.exe
  C:\Windows\System\SzBUcLX.exe
  2⤵
  PID:5856
- C:\Windows\System\bBKcCqB.exe
  C:\Windows\System\bBKcCqB.exe
  2⤵
  PID:4936
- C:\Windows\System\fFIksde.exe
  C:\Windows\System\fFIksde.exe
  2⤵
  PID:6412
- C:\Windows\System\pPzgyRB.exe
  C:\Windows\System\pPzgyRB.exe
  2⤵
  PID:6552
- C:\Windows\System\ExuRvto.exe
  C:\Windows\System\ExuRvto.exe
  2⤵
  PID:7220
- C:\Windows\System\tkybzMY.exe
  C:\Windows\System\tkybzMY.exe
  2⤵
  PID:7280
- C:\Windows\System\kYnimNF.exe
  C:\Windows\System\kYnimNF.exe
  2⤵
  PID:6696
- C:\Windows\System\RxmAwOz.exe
  C:\Windows\System\RxmAwOz.exe
  2⤵
  PID:6848
- C:\Windows\System\GmAIxQi.exe
  C:\Windows\System\GmAIxQi.exe
  2⤵
  PID:7232
- C:\Windows\System\ZEzlaDa.exe
  C:\Windows\System\ZEzlaDa.exe
  2⤵
  PID:7536
- C:\Windows\System\rnmyZoC.exe
  C:\Windows\System\rnmyZoC.exe
  2⤵
  PID:6956
- C:\Windows\System\UVjcKUB.exe
  C:\Windows\System\UVjcKUB.exe
  2⤵
  PID:7020
- C:\Windows\System\uNKGGvf.exe
  C:\Windows\System\uNKGGvf.exe
  2⤵
  PID:7104
- C:\Windows\System\xqWEQOU.exe
  C:\Windows\System\xqWEQOU.exe
  2⤵
  PID:4396
- C:\Windows\System\hiZtYoh.exe
  C:\Windows\System\hiZtYoh.exe
  2⤵
  PID:6388
- C:\Windows\System\vdUXIzZ.exe
  C:\Windows\System\vdUXIzZ.exe
  2⤵
  PID:3600
- C:\Windows\System\gUiqDqG.exe
  C:\Windows\System\gUiqDqG.exe
  2⤵
  PID:7184
- C:\Windows\System\NNHgPQg.exe
  C:\Windows\System\NNHgPQg.exe
  2⤵
  PID:7260
- C:\Windows\System\rrVRxFO.exe
  C:\Windows\System\rrVRxFO.exe
  2⤵
  PID:7640
- C:\Windows\System\efuApTK.exe
  C:\Windows\System\efuApTK.exe
  2⤵
  PID:7832
- C:\Windows\System\rlzBxov.exe
  C:\Windows\System\rlzBxov.exe
  2⤵
  PID:7876
- C:\Windows\System\FVSePpm.exe
  C:\Windows\System\FVSePpm.exe
  2⤵
  PID:7328
- C:\Windows\System\KIZlnLf.exe
  C:\Windows\System\KIZlnLf.exe
  2⤵
  PID:3488
- C:\Windows\System\xQLIbKJ.exe
  C:\Windows\System\xQLIbKJ.exe
  2⤵
  PID:8064
- C:\Windows\System\raSzJzg.exe
  C:\Windows\System\raSzJzg.exe
  2⤵
  PID:7384
- C:\Windows\System\IvBVWad.exe
  C:\Windows\System\IvBVWad.exe
  2⤵
  PID:7440
- C:\Windows\System\FuBaqPv.exe
  C:\Windows\System\FuBaqPv.exe
  2⤵
  PID:7488
- C:\Windows\System\JkYUnvD.exe
  C:\Windows\System\JkYUnvD.exe
  2⤵
  PID:3484
- C:\Windows\System\BaGkcbK.exe
  C:\Windows\System\BaGkcbK.exe
  2⤵
  PID:8172
- C:\Windows\System\BKwwcYT.exe
  C:\Windows\System\BKwwcYT.exe
  2⤵
  PID:4300
- C:\Windows\System\yNXpUNj.exe
  C:\Windows\System\yNXpUNj.exe
  2⤵
  PID:5284
- C:\Windows\System\dPSibBe.exe
  C:\Windows\System\dPSibBe.exe
  2⤵
  PID:7704
- C:\Windows\System\WFypHyi.exe
  C:\Windows\System\WFypHyi.exe
  2⤵
  PID:6528
- C:\Windows\System\iDyySrZ.exe
  C:\Windows\System\iDyySrZ.exe
  2⤵
  PID:7200
- C:\Windows\System\PQoIhyM.exe
  C:\Windows\System\PQoIhyM.exe
  2⤵
  PID:7784
- C:\Windows\System\voCiYdM.exe
  C:\Windows\System\voCiYdM.exe
  2⤵
  PID:7816
- C:\Windows\System\UMEeFix.exe
  C:\Windows\System\UMEeFix.exe
  2⤵
  PID:8196
- C:\Windows\System\ElOFsKd.exe
  C:\Windows\System\ElOFsKd.exe
  2⤵
  PID:8212
- C:\Windows\System\BlsiWQv.exe
  C:\Windows\System\BlsiWQv.exe
  2⤵
  PID:8240
- C:\Windows\System\lURlVZL.exe
  C:\Windows\System\lURlVZL.exe
  2⤵
  PID:8260
- C:\Windows\System\wFLukhn.exe
  C:\Windows\System\wFLukhn.exe
  2⤵
  PID:8276
- C:\Windows\System\JkBEdDL.exe
  C:\Windows\System\JkBEdDL.exe
  2⤵
  PID:8296
- C:\Windows\System\MsMCqrC.exe
  C:\Windows\System\MsMCqrC.exe
  2⤵
  PID:8316
- C:\Windows\System\UuuzQRk.exe
  C:\Windows\System\UuuzQRk.exe
  2⤵
  PID:8336
- C:\Windows\System\pvqKMcz.exe
  C:\Windows\System\pvqKMcz.exe
  2⤵
  PID:8360
- C:\Windows\System\emXEKtO.exe
  C:\Windows\System\emXEKtO.exe
  2⤵
  PID:8380
- C:\Windows\System\GlRKXbJ.exe
  C:\Windows\System\GlRKXbJ.exe
  2⤵
  PID:8396
- C:\Windows\System\xfCtONy.exe
  C:\Windows\System\xfCtONy.exe
  2⤵
  PID:8420
- C:\Windows\System\QhAtujJ.exe
  C:\Windows\System\QhAtujJ.exe
  2⤵
  PID:8444
- C:\Windows\System\mBXHCBG.exe
  C:\Windows\System\mBXHCBG.exe
  2⤵
  PID:8468
- C:\Windows\System\ZLvdVMk.exe
  C:\Windows\System\ZLvdVMk.exe
  2⤵
  PID:8484
- C:\Windows\System\QVudbDh.exe
  C:\Windows\System\QVudbDh.exe
  2⤵
  PID:8504
- C:\Windows\System\NyLlePl.exe
  C:\Windows\System\NyLlePl.exe
  2⤵
  PID:8524
- C:\Windows\System\hucFBhS.exe
  C:\Windows\System\hucFBhS.exe
  2⤵
  PID:8544
- C:\Windows\System\iPkrXgc.exe
  C:\Windows\System\iPkrXgc.exe
  2⤵
  PID:8564
- C:\Windows\System\KBGhYbo.exe
  C:\Windows\System\KBGhYbo.exe
  2⤵
  PID:8584
- C:\Windows\System\aDvadxZ.exe
  C:\Windows\System\aDvadxZ.exe
  2⤵
  PID:8604
- C:\Windows\System\JluZwYM.exe
  C:\Windows\System\JluZwYM.exe
  2⤵
  PID:8628
- C:\Windows\System\kyYDKRn.exe
  C:\Windows\System\kyYDKRn.exe
  2⤵
  PID:8652
- C:\Windows\System\jNynLgE.exe
  C:\Windows\System\jNynLgE.exe
  2⤵
  PID:8676
- C:\Windows\System\UjiPeKo.exe
  C:\Windows\System\UjiPeKo.exe
  2⤵
  PID:8700
- C:\Windows\System\pRIhNSC.exe
  C:\Windows\System\pRIhNSC.exe
  2⤵
  PID:8720
- C:\Windows\System\xCyrkmb.exe
  C:\Windows\System\xCyrkmb.exe
  2⤵
  PID:8740
- C:\Windows\System\AnbjioC.exe
  C:\Windows\System\AnbjioC.exe
  2⤵
  PID:8756
- C:\Windows\System\PnMvzyW.exe
  C:\Windows\System\PnMvzyW.exe
  2⤵
  PID:8776
- C:\Windows\System\YKEwLLE.exe
  C:\Windows\System\YKEwLLE.exe
  2⤵
  PID:8796
- C:\Windows\System\ianaJxQ.exe
  C:\Windows\System\ianaJxQ.exe
  2⤵
  PID:8816
- C:\Windows\System\CgooGWY.exe
  C:\Windows\System\CgooGWY.exe
  2⤵
  PID:8840
- C:\Windows\System\cYKKlUD.exe
  C:\Windows\System\cYKKlUD.exe
  2⤵
  PID:8864
- C:\Windows\System\RFkESwQ.exe
  C:\Windows\System\RFkESwQ.exe
  2⤵
  PID:8880
- C:\Windows\System\sSLxcqO.exe
  C:\Windows\System\sSLxcqO.exe
  2⤵
  PID:8904
- C:\Windows\System\EdhzTZK.exe
  C:\Windows\System\EdhzTZK.exe
  2⤵
  PID:8924
- C:\Windows\System\VkUbGxl.exe
  C:\Windows\System\VkUbGxl.exe
  2⤵
  PID:8948
- C:\Windows\System\aIltASb.exe
  C:\Windows\System\aIltASb.exe
  2⤵
  PID:8964
- C:\Windows\System\SsnDOrw.exe
  C:\Windows\System\SsnDOrw.exe
  2⤵
  PID:8988
- C:\Windows\System\tWZoLbU.exe
  C:\Windows\System\tWZoLbU.exe
  2⤵
  PID:9008
- C:\Windows\System\tYzioWh.exe
  C:\Windows\System\tYzioWh.exe
  2⤵
  PID:9028
- C:\Windows\System\zjJkuxy.exe
  C:\Windows\System\zjJkuxy.exe
  2⤵
  PID:9048
- C:\Windows\System\EexlHjB.exe
  C:\Windows\System\EexlHjB.exe
  2⤵
  PID:9068
- C:\Windows\System\WAdFztR.exe
  C:\Windows\System\WAdFztR.exe
  2⤵
  PID:9084
- C:\Windows\System\jwaMBMA.exe
  C:\Windows\System\jwaMBMA.exe
  2⤵
  PID:9104
- C:\Windows\System\RAWMzJo.exe
  C:\Windows\System\RAWMzJo.exe
  2⤵
  PID:9128
- C:\Windows\System\oqtkZim.exe
  C:\Windows\System\oqtkZim.exe
  2⤵
  PID:9144
- C:\Windows\System\IsgtzCz.exe
  C:\Windows\System\IsgtzCz.exe
  2⤵
  PID:9172
- C:\Windows\System\aLhfmgF.exe
  C:\Windows\System\aLhfmgF.exe
  2⤵
  PID:9188
- C:\Windows\System\agFPXUO.exe
  C:\Windows\System\agFPXUO.exe
  2⤵
  PID:9212
- C:\Windows\System\egFKKqJ.exe
  C:\Windows\System\egFKKqJ.exe
  2⤵
  PID:3692
- C:\Windows\System\WzIFZMf.exe
  C:\Windows\System\WzIFZMf.exe
  2⤵
  PID:7960
- C:\Windows\System\WeMSSMe.exe
  C:\Windows\System\WeMSSMe.exe
  2⤵
  PID:7140
- C:\Windows\System\frnfeof.exe
  C:\Windows\System\frnfeof.exe
  2⤵
  PID:2916
- C:\Windows\System\SDevSBi.exe
  C:\Windows\System\SDevSBi.exe
  2⤵
  PID:8056
- C:\Windows\System\sBnurBQ.exe
  C:\Windows\System\sBnurBQ.exe
  2⤵
  PID:7600
- C:\Windows\System\zYxpdLa.exe
  C:\Windows\System\zYxpdLa.exe
  2⤵
  PID:7672
- C:\Windows\System\QvSDims.exe
  C:\Windows\System\QvSDims.exe
  2⤵
  PID:5812
- C:\Windows\System\RzKMDtm.exe
  C:\Windows\System\RzKMDtm.exe
  2⤵
  PID:7708
- C:\Windows\System\wnRjHOB.exe
  C:\Windows\System\wnRjHOB.exe
  2⤵
  PID:7916
- C:\Windows\System\mgSEZyc.exe
  C:\Windows\System\mgSEZyc.exe
  2⤵
  PID:8232
- C:\Windows\System\KsgSLti.exe
  C:\Windows\System\KsgSLti.exe
  2⤵
  PID:8268
- C:\Windows\System\dboGxyT.exe
  C:\Windows\System\dboGxyT.exe
  2⤵
  PID:8308
- C:\Windows\System\FjKnadF.exe
  C:\Windows\System\FjKnadF.exe
  2⤵
  PID:8428
- C:\Windows\System\aJVqTxu.exe
  C:\Windows\System\aJVqTxu.exe
  2⤵
  PID:8024
- C:\Windows\System\sjHgXnA.exe
  C:\Windows\System\sjHgXnA.exe
  2⤵
  PID:8520
- C:\Windows\System\LjpmgSP.exe
  C:\Windows\System\LjpmgSP.exe
  2⤵
  PID:8580
- C:\Windows\System\IUyOoKi.exe
  C:\Windows\System\IUyOoKi.exe
  2⤵
  PID:9232
- C:\Windows\System\oUrzvoq.exe
  C:\Windows\System\oUrzvoq.exe
  2⤵
  PID:9248
- C:\Windows\System\rlqGldc.exe
  C:\Windows\System\rlqGldc.exe
  2⤵
  PID:9268
- C:\Windows\System\bpXlFHE.exe
  C:\Windows\System\bpXlFHE.exe
  2⤵
  PID:9292
- C:\Windows\System\EJpucYU.exe
  C:\Windows\System\EJpucYU.exe
  2⤵
  PID:9328
- C:\Windows\System\XrVDqkN.exe
  C:\Windows\System\XrVDqkN.exe
  2⤵
  PID:9344
- C:\Windows\System\uWeTjsu.exe
  C:\Windows\System\uWeTjsu.exe
  2⤵
  PID:9360
- C:\Windows\System\zLskgJN.exe
  C:\Windows\System\zLskgJN.exe
  2⤵
  PID:9376
- C:\Windows\System\KsbSsPG.exe
  C:\Windows\System\KsbSsPG.exe
  2⤵
  PID:9396
- C:\Windows\System\GpeIHaF.exe
  C:\Windows\System\GpeIHaF.exe
  2⤵
  PID:9416
- C:\Windows\System\lnDXxKY.exe
  C:\Windows\System\lnDXxKY.exe
  2⤵
  PID:9432
- C:\Windows\System\RFgzvUZ.exe
  C:\Windows\System\RFgzvUZ.exe
  2⤵
  PID:9456
- C:\Windows\System\rsQwyFP.exe
  C:\Windows\System\rsQwyFP.exe
  2⤵
  PID:9480
- C:\Windows\System\lmyOxmP.exe
  C:\Windows\System\lmyOxmP.exe
  2⤵
  PID:9496
- C:\Windows\System\udJzOKt.exe
  C:\Windows\System\udJzOKt.exe
  2⤵
  PID:9516
- C:\Windows\System\ATkEdgQ.exe
  C:\Windows\System\ATkEdgQ.exe
  2⤵
  PID:9536
- C:\Windows\System\LVBrnHp.exe
  C:\Windows\System\LVBrnHp.exe
  2⤵
  PID:9560
- C:\Windows\System\WsFLUln.exe
  C:\Windows\System\WsFLUln.exe
  2⤵
  PID:9580
- C:\Windows\System\RToqdsC.exe
  C:\Windows\System\RToqdsC.exe
  2⤵
  PID:9600
- C:\Windows\System\MxgtKgF.exe
  C:\Windows\System\MxgtKgF.exe
  2⤵
  PID:9624
- C:\Windows\System\piHaOCf.exe
  C:\Windows\System\piHaOCf.exe
  2⤵
  PID:9648
- C:\Windows\System\WGQqADk.exe
  C:\Windows\System\WGQqADk.exe
  2⤵
  PID:9668
- C:\Windows\System\hBGuiXd.exe
  C:\Windows\System\hBGuiXd.exe
  2⤵
  PID:9692
- C:\Windows\System\VKUZtQu.exe
  C:\Windows\System\VKUZtQu.exe
  2⤵
  PID:9712
- C:\Windows\System\RtwrtBa.exe
  C:\Windows\System\RtwrtBa.exe
  2⤵
  PID:9728
- C:\Windows\System\qeNrNLu.exe
  C:\Windows\System\qeNrNLu.exe
  2⤵
  PID:9752
- C:\Windows\System\XDEJTSj.exe
  C:\Windows\System\XDEJTSj.exe
  2⤵
  PID:9776
- C:\Windows\System\yQzjMwt.exe
  C:\Windows\System\yQzjMwt.exe
  2⤵
  PID:9792
- C:\Windows\System\YFssGQx.exe
  C:\Windows\System\YFssGQx.exe
  2⤵
  PID:9812
- C:\Windows\System\sogJWiF.exe
  C:\Windows\System\sogJWiF.exe
  2⤵
  PID:9832
- C:\Windows\System\YsPALLm.exe
  C:\Windows\System\YsPALLm.exe
  2⤵
  PID:9860
- C:\Windows\System\UrxliQF.exe
  C:\Windows\System\UrxliQF.exe
  2⤵
  PID:9884
- C:\Windows\System\OGYpkEE.exe
  C:\Windows\System\OGYpkEE.exe
  2⤵
  PID:9900
- C:\Windows\System\OZvGfnd.exe
  C:\Windows\System\OZvGfnd.exe
  2⤵
  PID:9920
- C:\Windows\System\xIJeVzg.exe
  C:\Windows\System\xIJeVzg.exe
  2⤵
  PID:9940
- C:\Windows\System\WNBDuQV.exe
  C:\Windows\System\WNBDuQV.exe
  2⤵
  PID:9960
- C:\Windows\System\gJlfTjW.exe
  C:\Windows\System\gJlfTjW.exe
  2⤵
  PID:9980
- C:\Windows\System\UQdEPvW.exe
  C:\Windows\System\UQdEPvW.exe
  2⤵
  PID:9996
- C:\Windows\System\JyYShfu.exe
  C:\Windows\System\JyYShfu.exe
  2⤵
  PID:10016
- C:\Windows\System\GSgwtcN.exe
  C:\Windows\System\GSgwtcN.exe
  2⤵
  PID:10040
- C:\Windows\System\dIDBYnn.exe
  C:\Windows\System\dIDBYnn.exe
  2⤵
  PID:10068
- C:\Windows\System\pQhzeQG.exe
  C:\Windows\System\pQhzeQG.exe
  2⤵
  PID:10084
- C:\Windows\System\mpIsurp.exe
  C:\Windows\System\mpIsurp.exe
  2⤵
  PID:10108
- C:\Windows\System\OOSCuON.exe
  C:\Windows\System\OOSCuON.exe
  2⤵
  PID:10124
- C:\Windows\System\kpJfVKU.exe
  C:\Windows\System\kpJfVKU.exe
  2⤵
  PID:10148
- C:\Windows\System\LlsCBXQ.exe
  C:\Windows\System\LlsCBXQ.exe
  2⤵
  PID:10168
- C:\Windows\System\CckWBbE.exe
  C:\Windows\System\CckWBbE.exe
  2⤵
  PID:10196
- C:\Windows\System\HEzftKz.exe
  C:\Windows\System\HEzftKz.exe
  2⤵
  PID:10220
- C:\Windows\System\AfOcFcn.exe
  C:\Windows\System\AfOcFcn.exe
  2⤵
  PID:10236
- C:\Windows\System\KYahyPl.exe
  C:\Windows\System\KYahyPl.exe
  2⤵
  PID:2140
- C:\Windows\System\LaIdNGF.exe
  C:\Windows\System\LaIdNGF.exe
  2⤵
  PID:8112
- C:\Windows\System\eKEGiSU.exe
  C:\Windows\System\eKEGiSU.exe
  2⤵
  PID:8156
- C:\Windows\System\mVtRCst.exe
  C:\Windows\System\mVtRCst.exe
  2⤵
  PID:8184
- C:\Windows\System\NnRhoGe.exe
  C:\Windows\System\NnRhoGe.exe
  2⤵
  PID:7424
- C:\Windows\System\yiMoOTh.exe
  C:\Windows\System\yiMoOTh.exe
  2⤵
  PID:8732
- C:\Windows\System\WxfEdCd.exe
  C:\Windows\System\WxfEdCd.exe
  2⤵
  PID:1836
- C:\Windows\System\HISqozj.exe
  C:\Windows\System\HISqozj.exe
  2⤵
  PID:8852
- C:\Windows\System\IjMwzLS.exe
  C:\Windows\System\IjMwzLS.exe
  2⤵
  PID:8892
- C:\Windows\System\rkiPXkP.exe
  C:\Windows\System\rkiPXkP.exe
  2⤵
  PID:8944
- C:\Windows\System\KowSzAe.exe
  C:\Windows\System\KowSzAe.exe
  2⤵
  PID:9080
- C:\Windows\System\AOGdPph.exe
  C:\Windows\System\AOGdPph.exe
  2⤵
  PID:9136
- C:\Windows\System\DkLkynx.exe
  C:\Windows\System\DkLkynx.exe
  2⤵
  PID:9180
- C:\Windows\System\bSAUlDR.exe
  C:\Windows\System\bSAUlDR.exe
  2⤵
  PID:6940
- C:\Windows\System\HjhWeJr.exe
  C:\Windows\System\HjhWeJr.exe
  2⤵
  PID:8328
- C:\Windows\System\CmcFenz.exe
  C:\Windows\System\CmcFenz.exe
  2⤵
  PID:7636
- C:\Windows\System\GzdcRdm.exe
  C:\Windows\System\GzdcRdm.exe
  2⤵
  PID:8044
- C:\Windows\System\HCNsksC.exe
  C:\Windows\System\HCNsksC.exe
  2⤵
  PID:7300
- C:\Windows\System\qXnxRCA.exe
  C:\Windows\System\qXnxRCA.exe
  2⤵
  PID:8440
- C:\Windows\System\KUaywcO.exe
  C:\Windows\System\KUaywcO.exe
  2⤵
  PID:8292
- C:\Windows\System\GjqmvDZ.exe
  C:\Windows\System\GjqmvDZ.exe
  2⤵
  PID:7984
- C:\Windows\System\SXeltFA.exe
  C:\Windows\System\SXeltFA.exe
  2⤵
  PID:8516
- C:\Windows\System\pkKGAUG.exe
  C:\Windows\System\pkKGAUG.exe
  2⤵
  PID:8536
- C:\Windows\System\WzQuAIu.exe
  C:\Windows\System\WzQuAIu.exe
  2⤵
  PID:9264
- C:\Windows\System\KcmDgvN.exe
  C:\Windows\System\KcmDgvN.exe
  2⤵
  PID:10256
- C:\Windows\System\AIuiJBw.exe
  C:\Windows\System\AIuiJBw.exe
  2⤵
  PID:10284
- C:\Windows\System\fMdQfzF.exe
  C:\Windows\System\fMdQfzF.exe
  2⤵
  PID:10312
- C:\Windows\System\giEAmHB.exe
  C:\Windows\System\giEAmHB.exe
  2⤵
  PID:10328
- C:\Windows\System\JzJcTpQ.exe
  C:\Windows\System\JzJcTpQ.exe
  2⤵
  PID:10352
- C:\Windows\System\yiPbpyT.exe
  C:\Windows\System\yiPbpyT.exe
  2⤵
  PID:10388
- C:\Windows\System\IqExoYJ.exe
  C:\Windows\System\IqExoYJ.exe
  2⤵
  PID:10404
- C:\Windows\System\cOBkgxF.exe
  C:\Windows\System\cOBkgxF.exe
  2⤵
  PID:10420
- C:\Windows\System\nQeQSWr.exe
  C:\Windows\System\nQeQSWr.exe
  2⤵
  PID:10440
- C:\Windows\System\aQoeuys.exe
  C:\Windows\System\aQoeuys.exe
  2⤵
  PID:10460
- C:\Windows\System\QwrFvrW.exe
  C:\Windows\System\QwrFvrW.exe
  2⤵
  PID:10488
- C:\Windows\System\mimAhqa.exe
  C:\Windows\System\mimAhqa.exe
  2⤵
  PID:10516
- C:\Windows\System\LNiiIQT.exe
  C:\Windows\System\LNiiIQT.exe
  2⤵
  PID:10540
- C:\Windows\System\ZyZaRUP.exe
  C:\Windows\System\ZyZaRUP.exe
  2⤵
  PID:10560
- C:\Windows\System\OlUblbG.exe
  C:\Windows\System\OlUblbG.exe
  2⤵
  PID:10592
- C:\Windows\System\WUERdYh.exe
  C:\Windows\System\WUERdYh.exe
  2⤵
  PID:10608
- C:\Windows\System\PEZfbVz.exe
  C:\Windows\System\PEZfbVz.exe
  2⤵
  PID:10632
- C:\Windows\System\zTetMeq.exe
  C:\Windows\System\zTetMeq.exe
  2⤵
  PID:10648
- C:\Windows\System\oTLKdeN.exe
  C:\Windows\System\oTLKdeN.exe
  2⤵
  PID:10672
- C:\Windows\System\Exrbxnm.exe
  C:\Windows\System\Exrbxnm.exe
  2⤵
  PID:10692
- C:\Windows\System\jluWMMC.exe
  C:\Windows\System\jluWMMC.exe
  2⤵
  PID:10712
- C:\Windows\System\jDrFZBa.exe
  C:\Windows\System\jDrFZBa.exe
  2⤵
  PID:10736
- C:\Windows\System\nzepjcv.exe
  C:\Windows\System\nzepjcv.exe
  2⤵
  PID:10752
- C:\Windows\System\EoYNiek.exe
  C:\Windows\System\EoYNiek.exe
  2⤵
  PID:10772
- C:\Windows\System\QdABLSZ.exe
  C:\Windows\System\QdABLSZ.exe
  2⤵
  PID:10792
- C:\Windows\System\CasWmEy.exe
  C:\Windows\System\CasWmEy.exe
  2⤵
  PID:10820
- C:\Windows\System\xIPwntd.exe
  C:\Windows\System\xIPwntd.exe
  2⤵
  PID:10840
- C:\Windows\System\xkUjbgW.exe
  C:\Windows\System\xkUjbgW.exe
  2⤵
  PID:10864
- C:\Windows\System\GZjwUQd.exe
  C:\Windows\System\GZjwUQd.exe
  2⤵
  PID:10880
- C:\Windows\System\zxMXSIK.exe
  C:\Windows\System\zxMXSIK.exe
  2⤵
  PID:10908
- C:\Windows\System\dlFgPdO.exe
  C:\Windows\System\dlFgPdO.exe
  2⤵
  PID:10924
- C:\Windows\System\DGgwrIn.exe
  C:\Windows\System\DGgwrIn.exe
  2⤵
  PID:10944
- C:\Windows\System\oSOWflo.exe
  C:\Windows\System\oSOWflo.exe
  2⤵
  PID:10960
- C:\Windows\System\wecHBdj.exe
  C:\Windows\System\wecHBdj.exe
  2⤵
  PID:10984
- C:\Windows\System\KzrdVQO.exe
  C:\Windows\System\KzrdVQO.exe
  2⤵
  PID:11000
- C:\Windows\System\SAFxOkD.exe
  C:\Windows\System\SAFxOkD.exe
  2⤵
  PID:11028
- C:\Windows\System\FIrcpVP.exe
  C:\Windows\System\FIrcpVP.exe
  2⤵
  PID:11048
- C:\Windows\System\WEEDNMi.exe
  C:\Windows\System\WEEDNMi.exe
  2⤵
  PID:11068
- C:\Windows\System\KnAwbzq.exe
  C:\Windows\System\KnAwbzq.exe
  2⤵
  PID:11088
- C:\Windows\System\RxUajUf.exe
  C:\Windows\System\RxUajUf.exe
  2⤵
  PID:11108
- C:\Windows\System\sGaIrmY.exe
  C:\Windows\System\sGaIrmY.exe
  2⤵
  PID:11132
- C:\Windows\System\dpzUAGg.exe
  C:\Windows\System\dpzUAGg.exe
  2⤵
  PID:11148
- C:\Windows\System\qGyLlXw.exe
  C:\Windows\System\qGyLlXw.exe
  2⤵
  PID:11172
- C:\Windows\System\xcmjJoi.exe
  C:\Windows\System\xcmjJoi.exe
  2⤵
  PID:11196
- C:\Windows\System\egOuYVo.exe
  C:\Windows\System\egOuYVo.exe
  2⤵
  PID:11212
- C:\Windows\System\fmcLsjY.exe
  C:\Windows\System\fmcLsjY.exe
  2⤵
  PID:11236
- C:\Windows\System\Yhbsrrh.exe
  C:\Windows\System\Yhbsrrh.exe
  2⤵
  PID:11260
- C:\Windows\System\pNXfLmb.exe
  C:\Windows\System\pNXfLmb.exe
  2⤵
  PID:9368
- C:\Windows\System\LgmUtBJ.exe
  C:\Windows\System\LgmUtBJ.exe
  2⤵
  PID:2984
- C:\Windows\System\mAxsIwZ.exe
  C:\Windows\System\mAxsIwZ.exe
  2⤵
  PID:9508
- C:\Windows\System\CZUQCSj.exe
  C:\Windows\System\CZUQCSj.exe
  2⤵
  PID:9576
- C:\Windows\System\RDQXsff.exe
  C:\Windows\System\RDQXsff.exe
  2⤵
  PID:3308
- C:\Windows\System\BUdsnoE.exe
  C:\Windows\System\BUdsnoE.exe
  2⤵
  PID:9724
- C:\Windows\System\KbKqYfp.exe
  C:\Windows\System\KbKqYfp.exe
  2⤵
  PID:9804
- C:\Windows\System\EbIiHBA.exe
  C:\Windows\System\EbIiHBA.exe
  2⤵
  PID:9876
- C:\Windows\System\ssmmFmj.exe
  C:\Windows\System\ssmmFmj.exe
  2⤵
  PID:8984
- C:\Windows\System\FsiJHaz.exe
  C:\Windows\System\FsiJHaz.exe
  2⤵
  PID:9016
- C:\Windows\System\crvzjIA.exe
  C:\Windows\System\crvzjIA.exe
  2⤵
  PID:9992
- C:\Windows\System\pOnAzUH.exe
  C:\Windows\System\pOnAzUH.exe
  2⤵
  PID:9152
- C:\Windows\System\aaTBciP.exe
  C:\Windows\System\aaTBciP.exe
  2⤵
  PID:11268
- C:\Windows\System\AReHMin.exe
  C:\Windows\System\AReHMin.exe
  2⤵
  PID:11292
- C:\Windows\System\RZqolms.exe
  C:\Windows\System\RZqolms.exe
  2⤵
  PID:11308
- C:\Windows\System\pMPcMob.exe
  C:\Windows\System\pMPcMob.exe
  2⤵
  PID:11324
- C:\Windows\System\fHnQJNb.exe
  C:\Windows\System\fHnQJNb.exe
  2⤵
  PID:11356
- C:\Windows\System\AililUu.exe
  C:\Windows\System\AililUu.exe
  2⤵
  PID:11372
- C:\Windows\System\eEHSEYc.exe
  C:\Windows\System\eEHSEYc.exe
  2⤵
  PID:11392
- C:\Windows\System\isOupVI.exe
  C:\Windows\System\isOupVI.exe
  2⤵
  PID:11416
- C:\Windows\System\CDjcgfj.exe
  C:\Windows\System\CDjcgfj.exe
  2⤵
  PID:11440
- C:\Windows\System\YBcRqfQ.exe
  C:\Windows\System\YBcRqfQ.exe
  2⤵
  PID:11460
- C:\Windows\System\eDJRdVw.exe
  C:\Windows\System\eDJRdVw.exe
  2⤵
  PID:11476
- C:\Windows\System\eFSTKNK.exe
  C:\Windows\System\eFSTKNK.exe
  2⤵
  PID:11500
- C:\Windows\System\ZwOfeeI.exe
  C:\Windows\System\ZwOfeeI.exe
  2⤵
  PID:11516
- C:\Windows\System\GTaJkQm.exe
  C:\Windows\System\GTaJkQm.exe
  2⤵
  PID:11540
- C:\Windows\System\hEWjvow.exe
  C:\Windows\System\hEWjvow.exe
  2⤵
  PID:11556
- C:\Windows\System\UgoTrtN.exe
  C:\Windows\System\UgoTrtN.exe
  2⤵
  PID:11580
- C:\Windows\System\YZEvIvK.exe
  C:\Windows\System\YZEvIvK.exe
  2⤵
  PID:11600
- C:\Windows\System\kqxxdQw.exe
  C:\Windows\System\kqxxdQw.exe
  2⤵
  PID:11620
- C:\Windows\System\kAIwlvr.exe
  C:\Windows\System\kAIwlvr.exe
  2⤵
  PID:11640
- C:\Windows\System\tPYxhPb.exe
  C:\Windows\System\tPYxhPb.exe
  2⤵
  PID:11656
- C:\Windows\System\OoSVTDe.exe
  C:\Windows\System\OoSVTDe.exe
  2⤵
  PID:11672
- C:\Windows\System\dpbfNTI.exe
  C:\Windows\System\dpbfNTI.exe
  2⤵
  PID:11688
- C:\Windows\System\tuLWDiq.exe
  C:\Windows\System\tuLWDiq.exe
  2⤵
  PID:11704
- C:\Windows\System\LvAPLPv.exe
  C:\Windows\System\LvAPLPv.exe
  2⤵
  PID:11720
- C:\Windows\System\qABnoQM.exe
  C:\Windows\System\qABnoQM.exe
  2⤵
  PID:11740
- C:\Windows\System\LXVSrpS.exe
  C:\Windows\System\LXVSrpS.exe
  2⤵
  PID:11756
- C:\Windows\System\ucjZFCa.exe
  C:\Windows\System\ucjZFCa.exe
  2⤵
  PID:11772
- C:\Windows\System\vaGuURy.exe
  C:\Windows\System\vaGuURy.exe
  2⤵
  PID:11788
- C:\Windows\System\mbhIeTf.exe
  C:\Windows\System\mbhIeTf.exe
  2⤵
  PID:11804
- C:\Windows\System\wwcMneq.exe
  C:\Windows\System\wwcMneq.exe
  2⤵
  PID:11824
- C:\Windows\System\YMtjWrk.exe
  C:\Windows\System\YMtjWrk.exe
  2⤵
  PID:11848
- C:\Windows\System\rrRYddD.exe
  C:\Windows\System\rrRYddD.exe
  2⤵
  PID:11872
- C:\Windows\System\vpamiKG.exe
  C:\Windows\System\vpamiKG.exe
  2⤵
  PID:11888
- C:\Windows\System\HzSrnQv.exe
  C:\Windows\System\HzSrnQv.exe
  2⤵
  PID:11912
- C:\Windows\System\sWRFFUP.exe
  C:\Windows\System\sWRFFUP.exe
  2⤵
  PID:11932
- C:\Windows\System\NnhsBYU.exe
  C:\Windows\System\NnhsBYU.exe
  2⤵
  PID:11952
- C:\Windows\System\VgbpPPG.exe
  C:\Windows\System\VgbpPPG.exe
  2⤵
  PID:11972
- C:\Windows\System\coGFHzX.exe
  C:\Windows\System\coGFHzX.exe
  2⤵
  PID:11996
- C:\Windows\System\IaPrsWd.exe
  C:\Windows\System\IaPrsWd.exe
  2⤵
  PID:12016
- C:\Windows\System\zOdbqym.exe
  C:\Windows\System\zOdbqym.exe
  2⤵
  PID:12036
- C:\Windows\System\BLXjmWa.exe
  C:\Windows\System\BLXjmWa.exe
  2⤵
  PID:12056
- C:\Windows\System\uhfYDrM.exe
  C:\Windows\System\uhfYDrM.exe
  2⤵
  PID:12076
- C:\Windows\System\BqFquNi.exe
  C:\Windows\System\BqFquNi.exe
  2⤵
  PID:12104
- C:\Windows\System\KxjlxdZ.exe
  C:\Windows\System\KxjlxdZ.exe
  2⤵
  PID:12120
- C:\Windows\System\iPHemXg.exe
  C:\Windows\System\iPHemXg.exe
  2⤵
  PID:12144
- C:\Windows\System\AjJrOPo.exe
  C:\Windows\System\AjJrOPo.exe
  2⤵
  PID:7380
- C:\Windows\System\huFzPTH.exe
  C:\Windows\System\huFzPTH.exe
  2⤵
  PID:8836
- C:\Windows\System\ertKRqL.exe
  C:\Windows\System\ertKRqL.exe
  2⤵
  PID:9076
- C:\Windows\System\qLJSPWZ.exe
  C:\Windows\System\qLJSPWZ.exe
  2⤵
  PID:8388
- C:\Windows\System\udbqeLd.exe
  C:\Windows\System\udbqeLd.exe
  2⤵
  PID:5160
- C:\Windows\System\cvXIrOR.exe
  C:\Windows\System\cvXIrOR.exe
  2⤵
  PID:7980
- C:\Windows\System\cFaEVWa.exe
  C:\Windows\System\cFaEVWa.exe
  2⤵
  PID:8640
- C:\Windows\System\PQBnARm.exe
  C:\Windows\System\PQBnARm.exe
  2⤵
  PID:10304
- C:\Windows\System\shVcGoU.exe
  C:\Windows\System\shVcGoU.exe
  2⤵
  PID:8688
- C:\Windows\System\HHYVPtH.exe
  C:\Windows\System\HHYVPtH.exe
  2⤵
  PID:10396
- C:\Windows\System\KQFcrSO.exe
  C:\Windows\System\KQFcrSO.exe
  2⤵
  PID:10500
- C:\Windows\System\EUBpgmZ.exe
  C:\Windows\System\EUBpgmZ.exe
  2⤵
  PID:8752
- C:\Windows\System\NEIfhtk.exe
  C:\Windows\System\NEIfhtk.exe
  2⤵
  PID:12304
- C:\Windows\System\wEhjkpc.exe
  C:\Windows\System\wEhjkpc.exe
  2⤵
  PID:12328
- C:\Windows\System\vOBvHCi.exe
  C:\Windows\System\vOBvHCi.exe
  2⤵
  PID:12344
- C:\Windows\System\egduRZt.exe
  C:\Windows\System\egduRZt.exe
  2⤵
  PID:12364
- C:\Windows\System\KlBiVFc.exe
  C:\Windows\System\KlBiVFc.exe
  2⤵
  PID:12388
- C:\Windows\System\fesyBFP.exe
  C:\Windows\System\fesyBFP.exe
  2⤵
  PID:12412
- C:\Windows\System\keAAyuN.exe
  C:\Windows\System\keAAyuN.exe
  2⤵
  PID:12436
- C:\Windows\System\nQmZXFC.exe
  C:\Windows\System\nQmZXFC.exe
  2⤵
  PID:12456
- C:\Windows\System\JDcuIbV.exe
  C:\Windows\System\JDcuIbV.exe
  2⤵
  PID:12476
- C:\Windows\System\UEnqyyf.exe
  C:\Windows\System\UEnqyyf.exe
  2⤵
  PID:12504
- C:\Windows\System\SsWKTdZ.exe
  C:\Windows\System\SsWKTdZ.exe
  2⤵
  PID:12520
- C:\Windows\System\aBqToQA.exe
  C:\Windows\System\aBqToQA.exe
  2⤵
  PID:12540
- C:\Windows\System\wYvFlLU.exe
  C:\Windows\System\wYvFlLU.exe
  2⤵
  PID:12564
- C:\Windows\System\FITSaVU.exe
  C:\Windows\System\FITSaVU.exe
  2⤵
  PID:12584
- C:\Windows\System\shpvsjl.exe
  C:\Windows\System\shpvsjl.exe
  2⤵
  PID:12604
- C:\Windows\System\OwgYTgy.exe
  C:\Windows\System\OwgYTgy.exe
  2⤵
  PID:12624
- C:\Windows\System\WIsgzgn.exe
  C:\Windows\System\WIsgzgn.exe
  2⤵
  PID:12644
- C:\Windows\System\NSMVXID.exe
  C:\Windows\System\NSMVXID.exe
  2⤵
  PID:12668
- C:\Windows\System\tLvokkI.exe
  C:\Windows\System\tLvokkI.exe
  2⤵
  PID:12688
- C:\Windows\System\urTkuTd.exe
  C:\Windows\System\urTkuTd.exe
  2⤵
  PID:12708
- C:\Windows\System\yusGxbr.exe
  C:\Windows\System\yusGxbr.exe
  2⤵
  PID:12724
- C:\Windows\System\NXrsTsU.exe
  C:\Windows\System\NXrsTsU.exe
  2⤵
  PID:12748
- C:\Windows\System\fuJvnaY.exe
  C:\Windows\System\fuJvnaY.exe
  2⤵
  PID:12772
- C:\Windows\System\vHsiONS.exe
  C:\Windows\System\vHsiONS.exe
  2⤵
  PID:12792
- C:\Windows\System\RYwugfA.exe
  C:\Windows\System\RYwugfA.exe
  2⤵
  PID:12808
- C:\Windows\System\rARRHqe.exe
  C:\Windows\System\rARRHqe.exe
  2⤵
  PID:12824
- C:\Windows\System\actHstg.exe
  C:\Windows\System\actHstg.exe
  2⤵
  PID:12840
- C:\Windows\System\FWsIKGa.exe
  C:\Windows\System\FWsIKGa.exe
  2⤵
  PID:12864
- C:\Windows\System\thgDGbd.exe
  C:\Windows\System\thgDGbd.exe
  2⤵
  PID:12880
- C:\Windows\System\QtDLXQj.exe
  C:\Windows\System\QtDLXQj.exe
  2⤵
  PID:12896
- C:\Windows\System\hQZbLzY.exe
  C:\Windows\System\hQZbLzY.exe
  2⤵
  PID:12912
- C:\Windows\System\mKxDuFK.exe
  C:\Windows\System\mKxDuFK.exe
  2⤵
  PID:12932
- C:\Windows\System\FfgzRok.exe
  C:\Windows\System\FfgzRok.exe
  2⤵
  PID:12956
- C:\Windows\System\AiYOayA.exe
  C:\Windows\System\AiYOayA.exe
  2⤵
  PID:12996
- C:\Windows\System\RZMiBrC.exe
  C:\Windows\System\RZMiBrC.exe
  2⤵
  PID:13020
- C:\Windows\System\kTzkjAR.exe
  C:\Windows\System\kTzkjAR.exe
  2⤵
  PID:13040
- C:\Windows\System\WybnekU.exe
  C:\Windows\System\WybnekU.exe
  2⤵
  PID:13056
- C:\Windows\System\Qdlkbfr.exe
  C:\Windows\System\Qdlkbfr.exe
  2⤵
  PID:13080
- C:\Windows\System\qgsKWAo.exe
  C:\Windows\System\qgsKWAo.exe
  2⤵
  PID:13100
- C:\Windows\System\nayWFBr.exe
  C:\Windows\System\nayWFBr.exe
  2⤵
  PID:13120
- C:\Windows\System\lOCLfXw.exe
  C:\Windows\System\lOCLfXw.exe
  2⤵
  PID:13140
- C:\Windows\System\NYaKpHE.exe
  C:\Windows\System\NYaKpHE.exe
  2⤵
  PID:13160
- C:\Windows\System\HEfkyrW.exe
  C:\Windows\System\HEfkyrW.exe
  2⤵
  PID:13180
- C:\Windows\System\XgWIByg.exe
  C:\Windows\System\XgWIByg.exe
  2⤵
  PID:13196
- C:\Windows\System\ihNInXH.exe
  C:\Windows\System\ihNInXH.exe
  2⤵
  PID:13220
- C:\Windows\System\WFhDDvQ.exe
  C:\Windows\System\WFhDDvQ.exe
  2⤵
  PID:13236
- C:\Windows\System\HdQzMXA.exe
  C:\Windows\System\HdQzMXA.exe
  2⤵
  PID:13256
- C:\Windows\System\qBkVbqF.exe
  C:\Windows\System\qBkVbqF.exe
  2⤵
  PID:13284
- C:\Windows\System\grTjVVg.exe
  C:\Windows\System\grTjVVg.exe
  2⤵
  PID:11116
- C:\Windows\System\DDScIUf.exe
  C:\Windows\System\DDScIUf.exe
  2⤵
  PID:10008
- C:\Windows\System\erwGWez.exe
  C:\Windows\System\erwGWez.exe
  2⤵
  PID:10176
- C:\Windows\System\bVFPcDk.exe
  C:\Windows\System\bVFPcDk.exe
  2⤵
  PID:11524
- C:\Windows\System\LSliIww.exe
  C:\Windows\System\LSliIww.exe
  2⤵
  PID:11648
- C:\Windows\System\BVeuLQP.exe
  C:\Windows\System\BVeuLQP.exe
  2⤵
  PID:11964
- C:\Windows\System\SKYaxoj.exe
  C:\Windows\System\SKYaxoj.exe
  2⤵
  PID:12140
- C:\Windows\System\nsxLbTG.exe
  C:\Windows\System\nsxLbTG.exe
  2⤵
  PID:12208
- C:\Windows\System\QutgrPa.exe
  C:\Windows\System\QutgrPa.exe
  2⤵
  PID:9988
- C:\Windows\System\CNwQMVE.exe
  C:\Windows\System\CNwQMVE.exe
  2⤵
  PID:12236
- C:\Windows\System\jDUJiBa.exe
  C:\Windows\System\jDUJiBa.exe
  2⤵
  PID:12268
- C:\Windows\System\qtOLAqd.exe
  C:\Windows\System\qtOLAqd.exe
  2⤵
  PID:8108
- C:\Windows\System\CBLQsTg.exe
  C:\Windows\System\CBLQsTg.exe
  2⤵
  PID:10456
- C:\Windows\System\VcoVbru.exe
  C:\Windows\System\VcoVbru.exe
  2⤵
  PID:10556
- C:\Windows\System\fQtAOGw.exe
  C:\Windows\System\fQtAOGw.exe
  2⤵
  PID:12316
- C:\Windows\System\fRygpZE.exe
  C:\Windows\System\fRygpZE.exe
  2⤵
  PID:12428
- C:\Windows\System\qvuzEEf.exe
  C:\Windows\System\qvuzEEf.exe
  2⤵
  PID:12464
- C:\Windows\System\WwqrNLG.exe
  C:\Windows\System\WwqrNLG.exe
  2⤵
  PID:12500
- C:\Windows\System\kBgBDSb.exe
  C:\Windows\System\kBgBDSb.exe
  2⤵
  PID:12684
- C:\Windows\System\swcLnfY.exe
  C:\Windows\System\swcLnfY.exe
  2⤵
  PID:12720
- C:\Windows\System\aZGVEmt.exe
  C:\Windows\System\aZGVEmt.exe
  2⤵
  PID:12760
- C:\Windows\System\TXDmqhG.exe
  C:\Windows\System\TXDmqhG.exe
  2⤵
  PID:11168
- C:\Windows\System\euGNhHY.exe
  C:\Windows\System\euGNhHY.exe
  2⤵
  PID:9636
- C:\Windows\System\WqVoyxy.exe
  C:\Windows\System\WqVoyxy.exe
  2⤵
  PID:11256
- C:\Windows\System\frmXigy.exe
  C:\Windows\System\frmXigy.exe
  2⤵
  PID:10704
- C:\Windows\System\NjlNcvs.exe
  C:\Windows\System\NjlNcvs.exe
  2⤵
  PID:9632
- C:\Windows\System\FjqwWkO.exe
  C:\Windows\System\FjqwWkO.exe
  2⤵
  PID:9848
- C:\Windows\System\uNHKfVM.exe
  C:\Windows\System\uNHKfVM.exe
  2⤵
  PID:11300
- C:\Windows\System\ZFVjBvh.exe
  C:\Windows\System\ZFVjBvh.exe
  2⤵
  PID:13308
- C:\Windows\System\QVjAdDL.exe
  C:\Windows\System\QVjAdDL.exe
  2⤵
  PID:10916
- C:\Windows\System\YgliZNY.exe
  C:\Windows\System\YgliZNY.exe
  2⤵
  PID:11060
- C:\Windows\System\BmLZYFH.exe
  C:\Windows\System\BmLZYFH.exe
  2⤵
  PID:10120
- C:\Windows\System\OwYOQUl.exe
  C:\Windows\System\OwYOQUl.exe
  2⤵
  PID:11424
- C:\Windows\System\tOxJvsm.exe
  C:\Windows\System\tOxJvsm.exe
  2⤵
  PID:12924
- C:\Windows\System\qWiZKox.exe
  C:\Windows\System\qWiZKox.exe
  2⤵
  PID:13008
- C:\Windows\System\FJSVdbM.exe
  C:\Windows\System\FJSVdbM.exe
  2⤵
  PID:13064
- C:\Windows\System\qAIFVda.exe
  C:\Windows\System\qAIFVda.exe
  2⤵
  PID:13204
- C:\Windows\System\gAHlRvZ.exe
  C:\Windows\System\gAHlRvZ.exe
  2⤵
  PID:13232
- C:\Windows\System\zBIytHz.exe
  C:\Windows\System\zBIytHz.exe
  2⤵
  PID:10628
- C:\Windows\System\zZXArwJ.exe
  C:\Windows\System\zZXArwJ.exe
  2⤵
  PID:12136
- C:\Windows\System\GfVsDWV.exe
  C:\Windows\System\GfVsDWV.exe
  2⤵
  PID:11732
- C:\Windows\System\ufBgwUl.exe
  C:\Windows\System\ufBgwUl.exe
  2⤵
  PID:8480
- C:\Windows\System\kdlAOYK.exe
  C:\Windows\System\kdlAOYK.exe
  2⤵
  PID:9276
- C:\Windows\System\zYYzFwA.exe
  C:\Windows\System\zYYzFwA.exe
  2⤵
  PID:9300
- C:\Windows\System\ypGHXiO.exe
  C:\Windows\System\ypGHXiO.exe
  2⤵
  PID:9340
- C:\Windows\System\MawjGqt.exe
  C:\Windows\System\MawjGqt.exe
  2⤵
  PID:12028
- C:\Windows\System\njJKJuT.exe
  C:\Windows\System\njJKJuT.exe
  2⤵
  PID:10052
- C:\Windows\System\GBukPXx.exe
  C:\Windows\System\GBukPXx.exe
  2⤵
  PID:9244
- C:\Windows\System\swvElsY.exe
  C:\Windows\System\swvElsY.exe
  2⤵
  PID:9544
- C:\Windows\System\LhqiEOb.exe
  C:\Windows\System\LhqiEOb.exe
  2⤵
  PID:9280
- C:\Windows\System\iLGPQZJ.exe
  C:\Windows\System\iLGPQZJ.exe
  2⤵
  PID:9656
- C:\Windows\System\tvhZxmB.exe
  C:\Windows\System\tvhZxmB.exe
  2⤵
  PID:9372
- C:\Windows\System\lDoUgoy.exe
  C:\Windows\System\lDoUgoy.exe
  2⤵
  PID:10668
- C:\Windows\System\OGUvWgw.exe
  C:\Windows\System\OGUvWgw.exe
  2⤵
  PID:12652
- C:\Windows\System\pXuWlyb.exe
  C:\Windows\System\pXuWlyb.exe
  2⤵
  PID:11144
- C:\Windows\System\OuSJsSE.exe
  C:\Windows\System\OuSJsSE.exe
  2⤵
  PID:12396
- C:\Windows\System\yOHnRxu.exe
  C:\Windows\System\yOHnRxu.exe
  2⤵
  PID:9488
- C:\Windows\System\AFzltXv.exe
  C:\Windows\System\AFzltXv.exe
  2⤵
  PID:12196
- C:\Windows\System\nLrZdSG.exe
  C:\Windows\System\nLrZdSG.exe
  2⤵
  PID:8372
- C:\Windows\System\BRjhZJn.exe
  C:\Windows\System\BRjhZJn.exe
  2⤵
  PID:12444
- C:\Windows\System\EfqrgHs.exe
  C:\Windows\System\EfqrgHs.exe
  2⤵
  PID:12664
- C:\Windows\System\agGUwcF.exe
  C:\Windows\System\agGUwcF.exe
  2⤵
  PID:12756
- C:\Windows\System\qEwYgga.exe
  C:\Windows\System\qEwYgga.exe
  2⤵
  PID:9572
- C:\Windows\System\igYcHCt.exe
  C:\Windows\System\igYcHCt.exe
  2⤵
  PID:13296
- C:\Windows\System\oaTdYmY.exe
  C:\Windows\System\oaTdYmY.exe
  2⤵
  PID:10080
- C:\Windows\System\mJDSbea.exe
  C:\Windows\System\mJDSbea.exe
  2⤵
  PID:10536
- C:\Windows\System\oUojRjd.exe
  C:\Windows\System\oUojRjd.exe
  2⤵
  PID:12876
- C:\Windows\System\cCdfgBI.exe
  C:\Windows\System\cCdfgBI.exe
  2⤵
  PID:9660
- C:\Windows\System\RAZeArm.exe
  C:\Windows\System\RAZeArm.exe
  2⤵
  PID:11120
- C:\Windows\System\czuVxsh.exe
  C:\Windows\System\czuVxsh.exe
  2⤵
  PID:9772
- C:\Windows\System\BDISCdi.exe
  C:\Windows\System\BDISCdi.exe
  2⤵
  PID:9664
- C:\Windows\System\PsOLUlO.exe
  C:\Windows\System\PsOLUlO.exe
  2⤵
  PID:12836
- C:\Windows\System\CgZiJML.exe
  C:\Windows\System\CgZiJML.exe
  2⤵
  PID:11448
- C:\Windows\System\peuEaJs.exe
  C:\Windows\System\peuEaJs.exe
  2⤵
  PID:11492
- C:\Windows\System\lxkSrxo.exe
  C:\Windows\System\lxkSrxo.exe
  2⤵
  PID:8356
- C:\Windows\System\wrmnXxV.exe
  C:\Windows\System\wrmnXxV.exe
  2⤵
  PID:8960
- C:\Windows\System\FdsVrCn.exe
  C:\Windows\System\FdsVrCn.exe
  2⤵
  PID:12312
- C:\Windows\System\pfDeAWc.exe
  C:\Windows\System\pfDeAWc.exe
  2⤵
  PID:12856
- C:\Windows\System\JISTrDw.exe
  C:\Windows\System\JISTrDw.exe
  2⤵
  PID:13324
- C:\Windows\System\kxJxBUW.exe
  C:\Windows\System\kxJxBUW.exe
  2⤵
  PID:13344
- C:\Windows\System\dsdjeZv.exe
  C:\Windows\System\dsdjeZv.exe
  2⤵
  PID:13360
- C:\Windows\System\kCuCbMp.exe
  C:\Windows\System\kCuCbMp.exe
  2⤵
  PID:13380
- C:\Windows\System\jnpMgIM.exe
  C:\Windows\System\jnpMgIM.exe
  2⤵
  PID:13404
- C:\Windows\System\DKrXJnF.exe
  C:\Windows\System\DKrXJnF.exe
  2⤵
  PID:13480
- C:\Windows\System\MAtPNOs.exe
  C:\Windows\System\MAtPNOs.exe
  2⤵
  PID:13516
- C:\Windows\System\cLihypX.exe
  C:\Windows\System\cLihypX.exe
  2⤵
  PID:14064
- C:\Windows\System\cfUkDgj.exe
  C:\Windows\System\cfUkDgj.exe
  2⤵
  PID:14100
- C:\Windows\System\FvZKbVm.exe
  C:\Windows\System\FvZKbVm.exe
  2⤵
  PID:14116
- C:\Windows\System\WBxxOAr.exe
  C:\Windows\System\WBxxOAr.exe
  2⤵
  PID:14144
- C:\Windows\System\LOVHMjH.exe
  C:\Windows\System\LOVHMjH.exe
  2⤵
  PID:14172
- C:\Windows\System\iStwSFG.exe
  C:\Windows\System\iStwSFG.exe
  2⤵
  PID:14192
- C:\Windows\System\cEajFMt.exe
  C:\Windows\System\cEajFMt.exe
  2⤵
  PID:14220
- C:\Windows\System\aCSSQxh.exe
  C:\Windows\System\aCSSQxh.exe
  2⤵
  PID:14244
- C:\Windows\System\coVEYze.exe
  C:\Windows\System\coVEYze.exe
  2⤵
  PID:14260
- C:\Windows\System\zRkkvwV.exe
  C:\Windows\System\zRkkvwV.exe
  2⤵
  PID:14292
- C:\Windows\System\dbDNUti.exe
  C:\Windows\System\dbDNUti.exe
  2⤵
  PID:10144
- C:\Windows\System\HGRfzfh.exe
  C:\Windows\System\HGRfzfh.exe
  2⤵
  PID:11860
- C:\Windows\System\iprFhdD.exe
  C:\Windows\System\iprFhdD.exe
  2⤵
  PID:13512
- C:\Windows\System\YDCXFUN.exe
  C:\Windows\System\YDCXFUN.exe
  2⤵
  PID:13536
- C:\Windows\System\aRLkhCv.exe
  C:\Windows\System\aRLkhCv.exe
  2⤵
  PID:11948
- C:\Windows\System\aMycwxW.exe
  C:\Windows\System\aMycwxW.exe
  2⤵
  PID:5368
- C:\Windows\System\yCIicLt.exe
  C:\Windows\System\yCIicLt.exe
  2⤵
  PID:5440
- C:\Windows\System\qOkBNJt.exe
  C:\Windows\System\qOkBNJt.exe
  2⤵
  PID:13620
- C:\Windows\System\VTiUBuM.exe
  C:\Windows\System\VTiUBuM.exe
  2⤵
  PID:14124
- C:\Windows\System\NHAGivN.exe
  C:\Windows\System\NHAGivN.exe
  2⤵
  PID:14200
- C:\Windows\System\xTvNBOG.exe
  C:\Windows\System\xTvNBOG.exe
  2⤵
  PID:13076
- C:\Windows\System\ZogKKQW.exe
  C:\Windows\System\ZogKKQW.exe
  2⤵
  PID:6132
- C:\Windows\System\OrfxNxp.exe
  C:\Windows\System\OrfxNxp.exe
  2⤵
  PID:14184
- C:\Windows\System\dhRJrCd.exe
  C:\Windows\System\dhRJrCd.exe
  2⤵
  PID:11680
- C:\Windows\System\KTrbEBQ.exe
  C:\Windows\System\KTrbEBQ.exe
  2⤵
  PID:3900
- C:\Windows\System\sDZtGLA.exe
  C:\Windows\System\sDZtGLA.exe
  2⤵
  PID:12340
- C:\Windows\System\lRxUcvl.exe
  C:\Windows\System\lRxUcvl.exe
  2⤵
  PID:11884
- C:\Windows\System\STOiMrU.exe
  C:\Windows\System\STOiMrU.exe
  2⤵
  PID:9916
- C:\Windows\System\TCCnGFp.exe
  C:\Windows\System\TCCnGFp.exe
  2⤵
  PID:13576
- C:\Windows\System\qIViFIT.exe
  C:\Windows\System\qIViFIT.exe
  2⤵
  PID:12160
- C:\Windows\System\EoJygva.exe
  C:\Windows\System\EoJygva.exe
  2⤵
  PID:8972
- C:\Windows\System\hjNomcM.exe
  C:\Windows\System\hjNomcM.exe
  2⤵
  PID:12244
- C:\Windows\System\VfyUycs.exe
  C:\Windows\System\VfyUycs.exe
  2⤵
  PID:2884
- C:\Windows\System\IIsaZgD.exe
  C:\Windows\System\IIsaZgD.exe
  2⤵
  PID:13444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mjl5gfe1.zzn.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\FQHLOaw.exe

Filesize
1.5MB

MD5
86f3a60bcfb4c4c254cb917c2ea651f6

SHA1
d957bc79a4f748545a8fb528e200056088ca9793

SHA256
1e71037d93ba62362f09fb72b3edee878b088da7866dda41c2575059f7c8a8d6

SHA512
eaa47bd7aae7897ab152e780d291359049671198037cd90eea7fcdd4199503011e0fa1642ec5d32c2a8dce1da986592dcf79a4dd6ac789ffb9c4324897ebae52

Download Submit
C:\Windows\System\HiQvyrU.exe

Filesize
1.5MB

MD5
1c03f3ac340eda137c9947997224166b

SHA1
498cd3a2cf98c5481ed0fb609139140004ad6427

SHA256
d39ba9ecdc3d845a91fdc982c6bca9d82670c0f20e0f538324a26f31df83c9f2

SHA512
62385836210a9a476b330b81ea04d5ceaf4be54d4fbbdfe4c2420f95c794d6a9d32fe89d4c0c12818e59eed5b77a4fef2b2bfe4fc53c8dd640e16192685f0f3d

Download Submit
C:\Windows\System\IrTzCnT.exe

Filesize
1.5MB

MD5
cd1b2da3914db10b7980e73f6a990f15

SHA1
093231c9a2d3bd4679fe8a08f112bbd4c10e1d6a

SHA256
ad6c58f0878e216b29c3b7110b5929e6a2023c5d0aa3c02649e90def684d5d2c

SHA512
20456fed03662d703e2552968596a680727f7071c3e9b5e1d9c903b8c6b72b83b4e66b8d9209d741ca269d77c55b7232f95368853f6e5fb7cf4c0e3bcec03aa4

Download Submit
C:\Windows\System\KjncqPN.exe

Filesize
1.5MB

MD5
ec576ef22aeff1635a4c3f78d1073479

SHA1
4860f97505f46333083004ed74466d22b8699e1d

SHA256
2034a4847b39c84f1c97f853f92287c2053c5e05889cb358abf3cfc0105eb45a

SHA512
381d61eb2beef4370c68d26f5824efd4d99986e5a5787ecb30ab9537847cf00acadb686f1d9ccd871cad14db4808f4c4aa39c09017a383b87a2359505938e71b

Download Submit
C:\Windows\System\LOyNCWX.exe

Filesize
1.5MB

MD5
38961c3e463dfc6ab361e64bcd652428

SHA1
9fb6c4ee6ac17bc8b04177ed2ee9c03ba979214d

SHA256
2efec90d246160cb369ac15f33b410033dc0ace8c1b2c77c126f590bf47aafc3

SHA512
9b16908912ed6a9b0ee84caa544da53e865916a70220789bdfd21dabaebfb8fb27ceb7f88f4274c37e8868193d4a5c6e35c2b8fa54040581f6b5742272fa8909

Download Submit
C:\Windows\System\MYkBXzd.exe

Filesize
1.5MB

MD5
f5cc7967707fa7beca8837da21efd34c

SHA1
f72c68b22025509531d185a9ff86871690dc0831

SHA256
20a7bd2c078945226fbc373c601ee92900b610abb004b2e4708966b759f29def

SHA512
a2ab1884a827f4bba2354cf2cfe5306b2edc51c4daf7af9fb1b75c931f9b311d8d1f8914e4399a96a93ad5303b58e1df74fe4a99f2d05d7f1814608c470722af

Download Submit
C:\Windows\System\NfQECOR.exe

Filesize
1.5MB

MD5
11c1954af08d9f544618aa5d32a26919

SHA1
fe67cdbe4f8b3da01f94e49bb83bb262a1788822

SHA256
a295a36a7dd3e585764d30b906296b1f74e50ab4eb054024656e0dd24fa26216

SHA512
7e7ca0bb0213f475856b9af0fbe6135e92f6aa3ce4c491aac291b592a162528bd1182607d1f115e7713c589576a5fdf8b5cd6414a3b11785f6fa9dee5e5835e2

Download Submit
C:\Windows\System\OdgwcEB.exe

Filesize
1.5MB

MD5
34378428fdc4ddac0d7bd52500a918fe

SHA1
6dc7692fd7de90448b74b35dd3a8417879885bb9

SHA256
3ef717454b9dbbb96f5eedf6f337f58636117d51818308922ff6a71b0ab95d6a

SHA512
22184ea5807501ec97b1752b84aede0c856b2d435891c94c1eec685b460326df402ea7935ad02abd70ee4673ede819fcb5f78873adb98fcb4554f701a02772ff

Download Submit
C:\Windows\System\QktfsEv.exe

Filesize
1.5MB

MD5
83344bd3a5efa7286b6a8d7702dcb6aa

SHA1
338bf8b21cca9f46742cbbdf285cc74ff4f33284

SHA256
c30e112f378ed4a226d451bf8942d68573a46f958fa1392841c0ec3f367b4198

SHA512
b8d9f1d3d1bb75e33e5c2a93286492c295d765f03ca993a7c16539b15cb1526bbeb715bdba4d0d3cc9eb9d11ae45cd2d0ab9e27be2d5a30d0ae69e801ee004b2

Download Submit
C:\Windows\System\RvGkvkz.exe

Filesize
1.5MB

MD5
876255ae8855a0117a6ead43c7a012e6

SHA1
33621f8e4e1dede9b0d3fd20f4dde919bac8412b

SHA256
f04b23eb36b8835c019e7884fb59088efe3c205be19a8c9df2d71e9787ee5753

SHA512
728b2d5af9f2643ce35b6abf999a814ceddd4aac347c53d50c1f39ca34ba669790048740ee3eb70e5109adfd55114b9489e289a739b4ce944b255a10e6830e17

Download Submit
C:\Windows\System\SAgabHp.exe

Filesize
1.5MB

MD5
4445eae702d785ec2044731aa8e59be3

SHA1
c423c5e2a8329d319716f3eb3e4b84eeda656e6b

SHA256
0d21603d701ef806fb1fb927491345df34ff4661b1c594bfaa11ec4b7e212955

SHA512
ad886cf3bf220bcdcc44462d9d43d9cb13cbc32a6c52de0e8cb1b6a9328df19442c2e34dafd634cfd16091da5cee26c5a53f483463d650c406f20edcf8f645bb

Download Submit
C:\Windows\System\SUGuZvG.exe

Filesize
1.5MB

MD5
7be158c6349e68430610d81e9a848305

SHA1
89521055b8b52d294ce2f380fe2ff50c220e18bf

SHA256
e9324694cfae42ff20019d8d8d7cc3e7d7060c96780e447432987f813b6e5db7

SHA512
e2c54900e46216b9645ffea49c965131d9ea788674488c4763acf67dbb78ff2d63f2229dd127e9abac2bffdb7b30919b9dc27f98e085621b00c8fb2f9a23537e

Download Submit
C:\Windows\System\TYBIAqy.exe

Filesize
1.5MB

MD5
05809601d5eada48db2d2366b1d43ac6

SHA1
90fed4a62eb104ce8773dde10e6f5605a3afcda2

SHA256
46c298f713cf1af52d1d3af9155bdeeb419818587f3606519f4368eeb4b391a9

SHA512
df8ce4b9dadce23a0e3eb5b78352fbd239bfb2f502112ecc0ef8f5bd4585a2848397c7cce1534b55de1cb4f767303aa931f352a84bde8dbde37e47ecab3a78df

Download Submit
C:\Windows\System\WRbnoJp.exe

Filesize
1.5MB

MD5
e7b7bd2ff166ccd8dcd36d2fc666a546

SHA1
48b42a09c75169a0ba314480e0cd7d634d773c60

SHA256
72dd688ad37be015460404b211c97fe659cb9dd663eae21f9a0457fa28fade90

SHA512
fc9de6ecf189f79896571661e65f9998f09dd6578aa7ce99995dee29b3ccbe4a3befbc60803dbd95dcb9c814c51382506a50148ee8cea046edf4e41bfecaa994

Download Submit
C:\Windows\System\ZRjhLfF.exe

Filesize
1.5MB

MD5
c73888a40b77c7938cb602078e6cccf0

SHA1
8c89b784579fd8f47255841ed72cc94cf5a43745

SHA256
2b21b32dc403d5234336c735730b82cab521ce9b76bf0745403437d9256f3588

SHA512
84df31ee69d65464d1f10cc462bdbb0e3597cd9ba0468cfb81fefea8dbd1b7ea3b5ba6a3cd054f8d67d0f0931ccc898a27054e4d69c659d9180e1ab144d03915

Download Submit
C:\Windows\System\aUkcoZN.exe

Filesize
1.5MB

MD5
4b7837bf796040febef30fee1e497639

SHA1
25358f2c2c21c1764795bd20de7445b6d81d51f4

SHA256
8581898c0887aa4e5e4d09f9fc2b60aa44e27810448c3008b626673b892c6f19

SHA512
ed81401ede649d4c6cf00eebc065f2092587352bc2c4cc92fd33506104c3ec948deedf5e87c5003ccfc4d12fb5c5c55b57c3cd066cdc831c4b7deea09911407c

Download Submit
C:\Windows\System\aXMMmOg.exe

Filesize
1.5MB

MD5
5c2652e8615d63e49813741164c2a569

SHA1
706c13ab5fc22e7a191a4f847aa7feb4c2492629

SHA256
dc78f85470fe5b7272a8a14536716fd40b5ad40599450d36e275d33a3acdfa8c

SHA512
7bb6f049947baacb05eff6a711f528360d1606a915b44b13b2eed7f3d9ab97c5e15135d959b16c766e2946424b56331f6b476d0ac9bd0bbc9d060d647594e653

Download Submit
C:\Windows\System\aaBfKfE.exe

Filesize
1.5MB

MD5
84d0c005dcc71bcd7c635083c175a2cc

SHA1
283811207c12095f3c206ed1bfa07980833f3c92

SHA256
b92e27c4ec197092bebb6588009189553022e916cb20a4a93e4ef9174467ddde

SHA512
4afca71122e7b535f681033363c7e86ffcb3ba5b3980deee1a10af537622f6c18e9fb85df8a501788dfec9ec6c6d496c9f1b5944094e10a94e451cbe59da3096

Download Submit
C:\Windows\System\blqXKPH.exe

Filesize
1.5MB

MD5
979c8874c682475f1a61925d8679e5b4

SHA1
18f6023505c4c2320a5d077b1182c69dad6c6782

SHA256
487feb7bb4c442f5c4943c762a235ae807f501c3de48513257133d85a22d6890

SHA512
3944ab9f1541e29835f3a1ccd37d1c5c163357cee20e43d95b04e54ce916b70849f86e11374cc6405be8d35b3bf6a7b722966d6cc3b4f523b419931bdf7d6260

Download Submit
C:\Windows\System\cCExjhy.exe

Filesize
1.5MB

MD5
58ca7a7eb8225b13480652b2b54bd7cf

SHA1
44ee15ef420bf4fca4cc8e9c7f9475da0ce97bde

SHA256
00826af9d8e78e237e3bf8d7ce48e0866bbe78cd45a2db5365202bfd50d7b3a3

SHA512
8f154b0adf576d50f0dff5bdc68b6195b3471e661f99303c1829185b3950880ab8de5a6f7e380a83f8500014ee86b01795ede6f64b4f89723073fe6780e95ccf

Download Submit
C:\Windows\System\cCyqWCD.exe

Filesize
1.5MB

MD5
ff941e64e148c2736f5b03dce5eb52ed

SHA1
82de5fd824d789f819a279eaeb511902ae9acb2b

SHA256
5f331574d0e8a00ed543ea8e428b41f55a79a0d7283610b9f8727bfedcd440d1

SHA512
71428f34b94d060915aa487e9c578466c2b5d5bf5b37d1b525dd7ffbf98b73e2e4c98ad64e0c4f64d9b51ba80c32dd6895bcb75041398b0fa73eb97bf3fbc912

Download Submit
C:\Windows\System\cbpUDHi.exe

Filesize
1.5MB

MD5
9bbe19c253cad17c4d341d80111d4ff6

SHA1
fa5499a5b5aa8d7445134f13f85df4d5207ad9b6

SHA256
58dde303783d7dd9034bb1020e243bb521ae5345373a5b3c593430e22a10ec26

SHA512
7801616e077ff9419c1b0de4e61cab4bed5fb685270a99ed76ac0d23c2e89aa23d3323a9ba5395a7a14364241012f2019659120ac0aae47e6e01453b78af1ad5

Download Submit
C:\Windows\System\dBDgJCX.exe

Filesize
1.5MB

MD5
f4ac2ed58fb6fe61329644cbadf71dfe

SHA1
e5ff864b06dd3a840fe78243442ec4df3f3499c5

SHA256
f9bb213af7518be73f868fc3b9efef0c96715c8d98b1778a20ee7861fbd46eb9

SHA512
c015bcfe8890850a3e0cff3f1ce0ff0a93ad5b352dc1424b24369674a6ac64a9ece0a80036b3da4cc4961cef289ef9d25c4c5afbf8ba0affcd2f831bc9d6b344

Download Submit
C:\Windows\System\eFKSdEY.exe

Filesize
1.5MB

MD5
278f157a1284b14517c71d70ce136acc

SHA1
f01ac028a948d0f5c746d97ae0493b240bbdde5f

SHA256
42a73baeeaf828266ba65567ff85a593f025697a6b7706432a4dd0f484e89d12

SHA512
96785ae9730c50e26aa7f1a4a4ae1feeca7c69cd6532a8169385f4ba3f7e76b7e69aed62204fe72a0c43652f8d3a9dc210c525fc4153e722fa4bfcf690051880

Download Submit
C:\Windows\System\fZPMYph.exe

Filesize
1.5MB

MD5
0e29f9b64efbcd16428857e689f453c4

SHA1
f6657ff901c45efbb837c269eb219669d23ff788

SHA256
ab1623e668c1af31693d686e0acade577ae8f0e26379022820f8f4809bb4bef6

SHA512
a23fe82547d52623399a8cef75be5bf6267fbf2ba1b2af5b1c1c3b3c9712398a44228af3b9f2e48934ea1be0c4c0cf1c0d205213a6879d809d28b7768db794ea

Download Submit
C:\Windows\System\fgcTJRN.exe

Filesize
8B

MD5
d33d66ea64213a11220ff46e1066e8c4

SHA1
11df077d45cb6c18dde351720388ac43664403a2

SHA256
b2aac390d4a70eec771d01aa85ea606c2fcf5e3b2ec05338e195df492df26016

SHA512
4f6272cb17b1ae9b4ebb9b755a9d4f83dd7a010a29db67c7a6463d91c58d4250809d9f6f8bdb747b657363c9141bbd4db149efd469384e92e75f03d0396ea32b

Download Submit
C:\Windows\System\ftpxTuJ.exe

Filesize
1.5MB

MD5
543202c7f72c3353dd4c955e22cc0b50

SHA1
db45b9b2f5ef5719ec0ed465860780729ebe0fab

SHA256
479f7933bc3d53b1effe664cac275b2d87140b81e230cd04eccc7aad99036578

SHA512
99f0aacbfe182996c376ca3ad4d6a0a95d115abccf83f96160810265dc22c6ccb3ee98fd1b74638780c516fd3d394005690fedc1c083daf36de6e9c22f223974

Download Submit
C:\Windows\System\grUsxPG.exe

Filesize
1.5MB

MD5
6502cc48a2d6199bd891ab9811e26b44

SHA1
88a202668305a586f7c3091a897e9ff2e405ae13

SHA256
376e3d76a91e46b483211acea862e370eabb826428d3df9d203d440bdcd4fd5c

SHA512
a09d6e6bf56ea79c1850bdbee018e7b015381b3a80aed15bdee1162fa4f1f63169203b529214dbc9cde55f17e905e7febdd75b59fc9e0191cdabebbbf959f370

Download Submit
C:\Windows\System\iXzUyOo.exe

Filesize
1.5MB

MD5
ad0af385bbc16dd9a332100f779dfe28

SHA1
f87b45b8e6c69c41e24769d2975a5bc04b5fa6b3

SHA256
1238866c0bcd2901ff5508e12ed5ccfaa2c0a0a7b051c04219f8b634ed20f966

SHA512
1c84927e439d36824a9471012f6b98854af9aa41ec9079c68ae8edd78b8b24d1eba29a539fa55eab9245680c44c92dbf9f0a83c9154464fa23b9bc2a288ff938

Download Submit
C:\Windows\System\jsWUcln.exe

Filesize
1.5MB

MD5
f600050cb44b8affbfd305636e97c7fc

SHA1
96de67a5b47eaeef200764b085aae85f4a61c8bb

SHA256
741c7b75c9ee9bddafb7db8b254ae4f3e5454c4f291a644b5f786f5c530fb24e

SHA512
073bbb5d22c27a8defd0e90a9dd1bbd5c5b92058c11ead40970267251517cb968e0b47fe145e4df41ba88fe4150c9899385c17263d3c9a2d43917accbdc986de

Download Submit
C:\Windows\System\kBXAcoi.exe

Filesize
1.5MB

MD5
d45c6cc5b95e92d786cc2cacb00ca111

SHA1
0d6780c2291d2ac0d4c0b2efb3ab31fa201b28e1

SHA256
7d5a2fc05ce7ed01249cfc702d418775f7205fb08c5553d6bc79fe7681b3f24d

SHA512
984b3dc68599fd635af88e7da0458685ebaa25f908236ee452796ed70bef05025ba2bfdf08f940e80c40e3ae3a1b92b6ce76a38b38c51988ae3090fd1dc9b3f0

Download Submit
C:\Windows\System\kDPyjNW.exe

Filesize
1.5MB

MD5
778fefb9e30b96b9991ddd107b9fa8cc

SHA1
f84cf88a1d1d2b493f709957f8053664b8f93a03

SHA256
00c20ccc1dad4416c20116d3b5fbbf5375fcdb49e26f70779ef131224005464a

SHA512
b7b3319793720b9dc9aa764ab3419d878381371e77ce84db1164a60e1c95735c6a4b102652c08c8c150cb941d885784c13fe636b2ba17a45defca0021cbb26ec

Download Submit
C:\Windows\System\lyhWisc.exe

Filesize
1.5MB

MD5
70a244dc9106ed25873bbbd1821b0c8e

SHA1
eec3c9cb55d6e90b2489dcb575d1c8c12a2b5c95

SHA256
16d6128daf88c86b590b7a6edb72bb27c62be81a58fcaa82a926aa224f8cdb80

SHA512
205c9045aacbda97c4e4e1ba67ae25e03c609d15c155ab24c2c3428563296f90ab2ffe66679d576216a2e6ec8e0a6a4f9c8a3cf7d1766768324f1d371524aa37

Download Submit
C:\Windows\System\mHcUNFV.exe

Filesize
1.5MB

MD5
44297493f76376387b658cb71c032655

SHA1
c25380641c13c9827af98e4c3d410434ee6cfc59

SHA256
d1aae9ea374d9cb6e7ef5b104c5517f62cb05c264752e4ab17670087c17b618e

SHA512
ee3f4bb127ca42a35dea61272bf6a8f3a5188a51d8721d7276910c443b18410e09e093abe820d92fe5cc5ff8e44408fd024808e99acd22eee516cb64fe637d92

Download Submit
C:\Windows\System\nfoCuRq.exe

Filesize
1.5MB

MD5
f83167ad54ccdcfc7cb54b5d2b999b6c

SHA1
370a07f46791a5273773855c2fdde9e274bf62e1

SHA256
3019b7ef13632981c92e6c095b84ca53eedcec6b25570816b59b9b6354ebc1ec

SHA512
660a6d2c45d669335d895bf10a2b85f6b335d19218d0a953dd36a41ada2ff0a680829f44726755dfa5cf4c60f675c9c6540f412a94ea1389136d36e1d5c6f39f

Download Submit
C:\Windows\System\nvwAySB.exe

Filesize
1.5MB

MD5
711c7e8c4762922cce41f51bd3b1b2fb

SHA1
02897151967cf05509a92faf32ba454f5267d9d2

SHA256
08aa28f1d743180d3c5591a3158e99fab5cc532c800df170e079a29fdd56286e

SHA512
cc81091e988644ff528599c78f2f9f9131653d814980ca7b28f707bd93a5bfa5955dd57d560768b491caef7e6949025cb3feb007042ce24a4e5876a03a0b58db

Download Submit
C:\Windows\System\pVPlIno.exe

Filesize
1.5MB

MD5
39a0f4ad7eb846dfd28f481de09065d3

SHA1
9ea407e9b1d71148e4ef4f027b2719092f65bac7

SHA256
19ceed602e3f56139822105b687d31572825dfb0f3d9d7f87af266ecb3809b70

SHA512
e73a2847b2909b45664f2c87859395b291a172d3ce2176c523dca4063a8eff99a42e7957383c34c148cc9dbcca7c030e56170032b9f14f29e0a87bfbabd86253

Download Submit
C:\Windows\System\qhVqtUY.exe

Filesize
1.5MB

MD5
1fc0eba8e81ead8c39b151c27a3b16e4

SHA1
dd975568c89c147a44d90b1f6eefd838d2a81732

SHA256
ec6f8e7ab15bf3baab28ca76d65450bfc359b7261c941ce00ec9886e4535170d

SHA512
4d5cec1f6c75d1abe97dc8fff66c2daf0fd9ad881b7ffeb13325920c65578465e6648cca0c95eb6ebef0df43b3ac211d14d0803b4ba41d2661097ccc226098ca

Download Submit
C:\Windows\System\rgGIJjC.exe

Filesize
1.5MB

MD5
6b3e40fd30f46b5d78bd0bc36dbe52be

SHA1
fc244f31b72f734a95a6e89364f07804c227f65b

SHA256
460771ab804d8d05983c4b2a140720cb4f75f234edcd94229e6d396024c46765

SHA512
e2f093b5e04b6e9c71491985e316f6501521a02f669ad78a921f839943ea6c6331aab6a814c1296ed38758e097bd5d5a302a5623535ac45a66b3fa4672459a6a

Download Submit
C:\Windows\System\sSWYzgd.exe

Filesize
1.5MB

MD5
fc64994c4a92030258a503e3a811abb1

SHA1
f2703822da9e900ff5aefd954c0a4298f5131c32

SHA256
260197725980a890d43ae30b22c9b4068bc4789f9c6b1adbe0a82d080ca16eec

SHA512
bbf84a9ae31e2a3eac2464c878e03651016d6a7aecb70263bb2b589c313bc1a4a5e2396843b2479fceec463b44e0f0327743b57ce7e0a8ae7855fbe9a7e109f1

Download Submit
C:\Windows\System\shpHnes.exe

Filesize
1.5MB

MD5
74ea2a0121078fbb4c0597c2fa658a6d

SHA1
daab820162d66b928860773e0510244e9d2472d1

SHA256
beb834ec8edcc3dcd20d5ac01f1fcda64ef4bd88e7569428612f1448e229a3be

SHA512
3ed29cf38fe81f7bf3f7b60119046a3e9ec6bef3ed1c5bdcbc040d1dc6a949a66f2f4282b25014ee552dced0ad188aa964df0047cec52c073ce2b3adab64c8dd

Download Submit
C:\Windows\System\uJthVSo.exe

Filesize
1.5MB

MD5
4f0a5df016de896d7386dde68918d8b3

SHA1
4a431621a63c85a54f6efa40de4541f759170224

SHA256
6d877a6edc68ddfe0f8fd51ab8b8d95c3df9d5d22e0201ffed17711d42e9a272

SHA512
887a8c6db0322ab287849914f25dc34e49c1b3bf0ca6229db1126d052916cf7f14e44fca513e833cadf75ae5628769c7e8db61ac99d208d9ba24777625e77ac0

Download Submit
C:\Windows\System\ylSHefo.exe

Filesize
1.5MB

MD5
4cafc4390367074b998268cebe63981c

SHA1
85916d50b7c29bbbd1d45a7b10b8150a229e570d

SHA256
1afe59d958ac249e04c4101d1192a9021c40d041bb87aab6a36ffdd53eb17db3

SHA512
a03fc7b521a87a7242cc0cd74c2569477a3d0b1674405b249b45e68d43331610293aa5c27a97dabdd10506e72f13e2034ff8701125b9c9120ef1bf49bfb93f0d

Download Submit
C:\Windows\System\yrwMqTl.exe

Filesize
1.5MB

MD5
5c4cd41fe8a175677b7e3a2de9d02356

SHA1
ccf5db048c7d69b618d839c0159c1c3ab2b7d55e

SHA256
725364af90fe94784bedc4f873e6f29978f4ea7ad6b190b1ffb20221e34c84fb

SHA512
cbe431b55feee5d349108782d2df1e9b7aa56dbe00b78ffd99cbf9e3c9f84dc4e74e9d6083aafa7e52068aae3e75e46b5493c11a6965bdede4eaf576cb17f3d0

Download Submit
C:\Windows\System\ysQbhJq.exe

Filesize
1.5MB

MD5
b99b827e54cada29b49d06b3ef3c25c7

SHA1
f63f1b51912ec39ade85162f6774362780db0847

SHA256
0229c1808521741759fe66774e4b8c8acf903f26367df0f74708d54e6846458a

SHA512
c054eb7d762e871b4e81a6f10fe6257822abb177ac6be0a97138650d269ef423b8dfbbcdb66512648fe9d8f34b35cf57716576ca097e2abe98c78f1e5756013a

Download Submit
C:\Windows\System\zYmtMzp.exe

Filesize
1.5MB

MD5
43b3ad2f5419d18e6795a546aa0bffe8

SHA1
37baebb8cb191e0b45cad421e71a00d87bd89785

SHA256
0da06d52317d30da6f1cfbf051d8039d4170623a7b86aedf67cef4cec9de7094

SHA512
66f66e7ea5fb0538ec0f631aced70e85c97e03285d4eedf72400d1cecd4b833a6438159b5953ebeb9cb24353aea4c7d39f714dd6529674cac099e8fa0236981c

Download Submit
memory/440-67-0x000001FF27D30000-0x000001FF27D40000-memory.dmp

Filesize
64KB

Download
memory/440-108-0x000001FF42600000-0x000001FF42622000-memory.dmp

Filesize
136KB

Download
memory/440-3453-0x00007FFDA3320000-0x00007FFDA3DE1000-memory.dmp

Filesize
10.8MB

Download
memory/440-61-0x00007FFDA3320000-0x00007FFDA3DE1000-memory.dmp

Filesize
10.8MB

Download
memory/440-68-0x000001FF27D30000-0x000001FF27D40000-memory.dmp

Filesize
64KB

Download
memory/452-3535-0x00007FF6CEF20000-0x00007FF6CF312000-memory.dmp

Filesize
3.9MB

Download
memory/452-258-0x00007FF6CEF20000-0x00007FF6CF312000-memory.dmp

Filesize
3.9MB

Download
memory/1032-3577-0x00007FF63CCA0000-0x00007FF63D092000-memory.dmp

Filesize
3.9MB

Download
memory/1032-329-0x00007FF63CCA0000-0x00007FF63D092000-memory.dmp

Filesize
3.9MB

Download
memory/1356-319-0x00007FF78DA60000-0x00007FF78DE52000-memory.dmp

Filesize
3.9MB

Download
memory/1356-3588-0x00007FF78DA60000-0x00007FF78DE52000-memory.dmp

Filesize
3.9MB

Download
memory/1444-3526-0x00007FF72B910000-0x00007FF72BD02000-memory.dmp

Filesize
3.9MB

Download
memory/1444-327-0x00007FF72B910000-0x00007FF72BD02000-memory.dmp

Filesize
3.9MB

Download
memory/1812-3530-0x00007FF656930000-0x00007FF656D22000-memory.dmp

Filesize
3.9MB

Download
memory/1812-203-0x00007FF656930000-0x00007FF656D22000-memory.dmp

Filesize
3.9MB

Download
memory/2020-3524-0x00007FF7C93C0000-0x00007FF7C97B2000-memory.dmp

Filesize
3.9MB

Download
memory/2020-326-0x00007FF7C93C0000-0x00007FF7C97B2000-memory.dmp

Filesize
3.9MB

Download
memory/2072-79-0x00007FF6AF550000-0x00007FF6AF942000-memory.dmp

Filesize
3.9MB

Download
memory/2072-3528-0x00007FF6AF550000-0x00007FF6AF942000-memory.dmp

Filesize
3.9MB

Download
memory/2156-259-0x00007FF603A20000-0x00007FF603E12000-memory.dmp

Filesize
3.9MB

Download
memory/2156-3546-0x00007FF603A20000-0x00007FF603E12000-memory.dmp

Filesize
3.9MB

Download
memory/2896-285-0x00007FF78F3A0000-0x00007FF78F792000-memory.dmp

Filesize
3.9MB

Download
memory/2896-3544-0x00007FF78F3A0000-0x00007FF78F792000-memory.dmp

Filesize
3.9MB

Download
memory/3024-263-0x00007FF670470000-0x00007FF670862000-memory.dmp

Filesize
3.9MB

Download
memory/3024-3548-0x00007FF670470000-0x00007FF670862000-memory.dmp

Filesize
3.9MB

Download
memory/3120-328-0x00007FF6E2620000-0x00007FF6E2A12000-memory.dmp

Filesize
3.9MB

Download
memory/3120-3555-0x00007FF6E2620000-0x00007FF6E2A12000-memory.dmp

Filesize
3.9MB

Download
memory/3444-322-0x00007FF7D8330000-0x00007FF7D8722000-memory.dmp

Filesize
3.9MB

Download
memory/3444-3573-0x00007FF7D8330000-0x00007FF7D8722000-memory.dmp

Filesize
3.9MB

Download
memory/3764-254-0x00007FF6F6720000-0x00007FF6F6B12000-memory.dmp

Filesize
3.9MB

Download
memory/3764-3539-0x00007FF6F6720000-0x00007FF6F6B12000-memory.dmp

Filesize
3.9MB

Download
memory/4024-3551-0x00007FF67EEF0000-0x00007FF67F2E2000-memory.dmp

Filesize
3.9MB

Download
memory/4024-260-0x00007FF67EEF0000-0x00007FF67F2E2000-memory.dmp

Filesize
3.9MB

Download
memory/4072-122-0x00007FF642890000-0x00007FF642C82000-memory.dmp

Filesize
3.9MB

Download
memory/4072-3552-0x00007FF642890000-0x00007FF642C82000-memory.dmp

Filesize
3.9MB

Download
memory/4072-3490-0x00007FF642890000-0x00007FF642C82000-memory.dmp

Filesize
3.9MB

Download
memory/4140-244-0x00007FF7C7640000-0x00007FF7C7A32000-memory.dmp

Filesize
3.9MB

Download
memory/4140-3542-0x00007FF7C7640000-0x00007FF7C7A32000-memory.dmp

Filesize
3.9MB

Download
memory/4280-325-0x00007FF6049C0000-0x00007FF604DB2000-memory.dmp

Filesize
3.9MB

Download
memory/4280-3580-0x00007FF6049C0000-0x00007FF604DB2000-memory.dmp

Filesize
3.9MB

Download
memory/4376-0-0x00007FF6A7100000-0x00007FF6A74F2000-memory.dmp

Filesize
3.9MB

Download
memory/4376-1-0x0000024EB7210000-0x0000024EB7220000-memory.dmp

Filesize
64KB

Download
memory/4616-165-0x00007FF657290000-0x00007FF657682000-memory.dmp

Filesize
3.9MB

Download
memory/4616-3541-0x00007FF657290000-0x00007FF657682000-memory.dmp

Filesize
3.9MB

Download
memory/4640-3533-0x00007FF737360000-0x00007FF737752000-memory.dmp

Filesize
3.9MB

Download
memory/4640-257-0x00007FF737360000-0x00007FF737752000-memory.dmp

Filesize
3.9MB

Download
memory/4980-255-0x00007FF6F4040000-0x00007FF6F4432000-memory.dmp

Filesize
3.9MB

Download
memory/4980-3536-0x00007FF6F4040000-0x00007FF6F4432000-memory.dmp

Filesize
3.9MB

Download
memory/5108-324-0x00007FF6A7B60000-0x00007FF6A7F52000-memory.dmp

Filesize
3.9MB

Download
memory/5108-3564-0x00007FF6A7B60000-0x00007FF6A7F52000-memory.dmp

Filesize
3.9MB

Download