xmrig | 12699238a279b14efc4aa3f1df29e0d6baf14670379ce2c391bd1451ad1c684c

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01/05/2024, 12:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
Size

1.4MB
MD5

0bda63546ed8e2722779790a1a897bbd
SHA1

2d43842721f9668afcf8641afbe72c18b8e54b67
SHA256

12699238a279b14efc4aa3f1df29e0d6baf14670379ce2c391bd1451ad1c684c
SHA512

49602e6b3b4a6b500de6672c6aea897b5ce6da8271f5bea6eb72aa22402fe5e1ad2000fc5571fb8d2be476092776d3ff02d7f4140bcb1680e53fb8abd5bf27da
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYKpGncHBN/Vx+wp:Lz071uv4BPMkibTIA5CJQwp

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 43 IoCs

miner

resource	yara_rule
behavioral2/memory/1992-371-0x00007FF613BC0000-0x00007FF613FB2000-memory.dmp	xmrig
behavioral2/memory/2768-442-0x00007FF6ABD80000-0x00007FF6AC172000-memory.dmp	xmrig
behavioral2/memory/5080-485-0x00007FF717710000-0x00007FF717B02000-memory.dmp	xmrig
behavioral2/memory/3532-489-0x00007FF7B0930000-0x00007FF7B0D22000-memory.dmp	xmrig
behavioral2/memory/1344-490-0x00007FF60D6B0000-0x00007FF60DAA2000-memory.dmp	xmrig
behavioral2/memory/412-488-0x00007FF72F200000-0x00007FF72F5F2000-memory.dmp	xmrig
behavioral2/memory/3864-487-0x00007FF7B7B80000-0x00007FF7B7F72000-memory.dmp	xmrig
behavioral2/memory/4512-486-0x00007FF601C90000-0x00007FF602082000-memory.dmp	xmrig
behavioral2/memory/4808-484-0x00007FF656890000-0x00007FF656C82000-memory.dmp	xmrig
behavioral2/memory/3060-483-0x00007FF7D6E20000-0x00007FF7D7212000-memory.dmp	xmrig
behavioral2/memory/1920-482-0x00007FF619A20000-0x00007FF619E12000-memory.dmp	xmrig
behavioral2/memory/2716-481-0x00007FF7DF450000-0x00007FF7DF842000-memory.dmp	xmrig
behavioral2/memory/1884-480-0x00007FF654710000-0x00007FF654B02000-memory.dmp	xmrig
behavioral2/memory/3608-479-0x00007FF762290000-0x00007FF762682000-memory.dmp	xmrig
behavioral2/memory/3824-476-0x00007FF797390000-0x00007FF797782000-memory.dmp	xmrig
behavioral2/memory/2444-292-0x00007FF71A250000-0x00007FF71A642000-memory.dmp	xmrig
behavioral2/memory/592-287-0x00007FF7C2E10000-0x00007FF7C3202000-memory.dmp	xmrig
behavioral2/memory/1256-247-0x00007FF694FB0000-0x00007FF6953A2000-memory.dmp	xmrig
behavioral2/memory/3024-197-0x00007FF61AE60000-0x00007FF61B252000-memory.dmp	xmrig
behavioral2/memory/2328-143-0x00007FF7CD830000-0x00007FF7CDC22000-memory.dmp	xmrig
behavioral2/memory/3536-17-0x00007FF7D8D00000-0x00007FF7D90F2000-memory.dmp	xmrig
behavioral2/memory/4084-2950-0x00007FF7902E0000-0x00007FF7906D2000-memory.dmp	xmrig
behavioral2/memory/3536-3048-0x00007FF7D8D00000-0x00007FF7D90F2000-memory.dmp	xmrig
behavioral2/memory/3532-3050-0x00007FF7B0930000-0x00007FF7B0D22000-memory.dmp	xmrig
behavioral2/memory/3024-3052-0x00007FF61AE60000-0x00007FF61B252000-memory.dmp	xmrig
behavioral2/memory/2328-3054-0x00007FF7CD830000-0x00007FF7CDC22000-memory.dmp	xmrig
behavioral2/memory/1256-3056-0x00007FF694FB0000-0x00007FF6953A2000-memory.dmp	xmrig
behavioral2/memory/2768-3077-0x00007FF6ABD80000-0x00007FF6AC172000-memory.dmp	xmrig
behavioral2/memory/3060-3082-0x00007FF7D6E20000-0x00007FF7D7212000-memory.dmp	xmrig
behavioral2/memory/3864-3083-0x00007FF7B7B80000-0x00007FF7B7F72000-memory.dmp	xmrig
behavioral2/memory/4512-3080-0x00007FF601C90000-0x00007FF602082000-memory.dmp	xmrig
behavioral2/memory/2716-3075-0x00007FF7DF450000-0x00007FF7DF842000-memory.dmp	xmrig
behavioral2/memory/2444-3074-0x00007FF71A250000-0x00007FF71A642000-memory.dmp	xmrig
behavioral2/memory/1992-3072-0x00007FF613BC0000-0x00007FF613FB2000-memory.dmp	xmrig
behavioral2/memory/3608-3070-0x00007FF762290000-0x00007FF762682000-memory.dmp	xmrig
behavioral2/memory/1884-3068-0x00007FF654710000-0x00007FF654B02000-memory.dmp	xmrig
behavioral2/memory/3824-3064-0x00007FF797390000-0x00007FF797782000-memory.dmp	xmrig
behavioral2/memory/412-3059-0x00007FF72F200000-0x00007FF72F5F2000-memory.dmp	xmrig
behavioral2/memory/1920-3066-0x00007FF619A20000-0x00007FF619E12000-memory.dmp	xmrig
behavioral2/memory/592-3061-0x00007FF7C2E10000-0x00007FF7C3202000-memory.dmp	xmrig
behavioral2/memory/5080-3115-0x00007FF717710000-0x00007FF717B02000-memory.dmp	xmrig
behavioral2/memory/4808-3111-0x00007FF656890000-0x00007FF656C82000-memory.dmp	xmrig
behavioral2/memory/1344-3093-0x00007FF60D6B0000-0x00007FF60DAA2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3536	ATKPwMe.exe
412	QiMMvyD.exe
3532	ClOMbVZ.exe
2328	vLgYmcK.exe
3024	zQFoliZ.exe
1256	xpgJqjT.exe
592	PHcZTLC.exe
2444	BxqwXEL.exe
1992	GhzCfpp.exe
2768	SoIDEpO.exe
3824	dfDEkGu.exe
3608	QsJnTCw.exe
1884	ENticNg.exe
2716	jzMOirL.exe
1920	myhYVSx.exe
3060	cPotjsu.exe
4808	UmXIMOG.exe
5080	mkCColT.exe
4512	huxSXIl.exe
3864	wZXtCkv.exe
1344	kbBYUqg.exe
4404	eCVFvwn.exe
3412	ldBCeDL.exe
2520	cPTylXR.exe
3012	xUeilrY.exe
544	hrTEdFA.exe
644	VodrMrL.exe
4876	xJEFVzl.exe
1392	aThvUum.exe
3172	SHHEthI.exe
1020	KDLitdv.exe
4432	YjoEihG.exe
524	PPehdBi.exe
2724	nPqqXWa.exe
632	vIZCmcl.exe
224	WWdphYj.exe
1252	VAVFOxu.exe
1712	RcBnIfg.exe
4944	ThvHcVP.exe
4688	MxcGLLn.exe
4800	oHlhywP.exe
3032	IzdIHPw.exe
3516	wrozRzU.exe
4712	wfGLVSw.exe
2244	JMStwxt.exe
2032	aoFiPhl.exe
3668	dllHPSg.exe
3220	nTOCltD.exe
4424	AMhpCEN.exe
3124	VZTqlDP.exe
2304	sPZqZOU.exe
396	PsImdZH.exe
3244	BqEzEPI.exe
2916	ENcGEub.exe
4644	orZeAWJ.exe
4896	FhLoxve.exe
1804	eHLjMpU.exe
4184	NGOVFWk.exe
4460	TZvUqGR.exe
2260	PuwJIEs.exe
4568	vanMxqL.exe
4032	NydmZqX.exe
628	Cbhdasy.exe
3652	xMxGnqc.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4084-0-0x00007FF7902E0000-0x00007FF7906D2000-memory.dmp	upx
behavioral2/files/0x000c000000023b9d-8.dat	upx
behavioral2/files/0x000a000000023bb1-12.dat	upx
behavioral2/files/0x000a000000023bb2-25.dat	upx
behavioral2/files/0x000a000000023bca-133.dat	upx
behavioral2/files/0x000a000000023bd4-181.dat	upx
behavioral2/memory/1992-371-0x00007FF613BC0000-0x00007FF613FB2000-memory.dmp	upx
behavioral2/memory/2768-442-0x00007FF6ABD80000-0x00007FF6AC172000-memory.dmp	upx
behavioral2/memory/5080-485-0x00007FF717710000-0x00007FF717B02000-memory.dmp	upx
behavioral2/memory/3532-489-0x00007FF7B0930000-0x00007FF7B0D22000-memory.dmp	upx
behavioral2/memory/1344-490-0x00007FF60D6B0000-0x00007FF60DAA2000-memory.dmp	upx
behavioral2/memory/412-488-0x00007FF72F200000-0x00007FF72F5F2000-memory.dmp	upx
behavioral2/memory/3864-487-0x00007FF7B7B80000-0x00007FF7B7F72000-memory.dmp	upx
behavioral2/memory/4512-486-0x00007FF601C90000-0x00007FF602082000-memory.dmp	upx
behavioral2/memory/4808-484-0x00007FF656890000-0x00007FF656C82000-memory.dmp	upx
behavioral2/memory/3060-483-0x00007FF7D6E20000-0x00007FF7D7212000-memory.dmp	upx
behavioral2/memory/1920-482-0x00007FF619A20000-0x00007FF619E12000-memory.dmp	upx
behavioral2/memory/2716-481-0x00007FF7DF450000-0x00007FF7DF842000-memory.dmp	upx
behavioral2/memory/1884-480-0x00007FF654710000-0x00007FF654B02000-memory.dmp	upx
behavioral2/memory/3608-479-0x00007FF762290000-0x00007FF762682000-memory.dmp	upx
behavioral2/memory/3824-476-0x00007FF797390000-0x00007FF797782000-memory.dmp	upx
behavioral2/memory/2444-292-0x00007FF71A250000-0x00007FF71A642000-memory.dmp	upx
behavioral2/memory/592-287-0x00007FF7C2E10000-0x00007FF7C3202000-memory.dmp	upx
behavioral2/memory/1256-247-0x00007FF694FB0000-0x00007FF6953A2000-memory.dmp	upx
behavioral2/files/0x000a000000023bda-209.dat	upx
behavioral2/files/0x000a000000023bc4-204.dat	upx
behavioral2/files/0x000a000000023bd9-202.dat	upx
behavioral2/memory/3024-197-0x00007FF61AE60000-0x00007FF61B252000-memory.dmp	upx
behavioral2/files/0x000a000000023bd6-192.dat	upx
behavioral2/files/0x000a000000023bd5-191.dat	upx
behavioral2/files/0x000a000000023bc3-184.dat	upx
behavioral2/files/0x000a000000023bc2-175.dat	upx
behavioral2/files/0x000a000000023bd2-169.dat	upx
behavioral2/files/0x000a000000023bc0-168.dat	upx
behavioral2/files/0x000a000000023bbf-162.dat	upx
behavioral2/files/0x0031000000023bb8-152.dat	upx
behavioral2/files/0x000a000000023bd8-201.dat	upx
behavioral2/files/0x000a000000023bce-147.dat	upx
behavioral2/files/0x000a000000023bd7-194.dat	upx
behavioral2/memory/2328-143-0x00007FF7CD830000-0x00007FF7CDC22000-memory.dmp	upx
behavioral2/files/0x000a000000023bcd-140.dat	upx
behavioral2/files/0x000a000000023bbd-136.dat	upx
behavioral2/files/0x000a000000023bcc-135.dat	upx
behavioral2/files/0x000a000000023bcb-134.dat	upx
behavioral2/files/0x000a000000023bc9-132.dat	upx
behavioral2/files/0x000a000000023bc8-131.dat	upx
behavioral2/files/0x000a000000023bba-123.dat	upx
behavioral2/files/0x000a000000023bc7-120.dat	upx
behavioral2/files/0x000a000000023bc6-119.dat	upx
behavioral2/files/0x000a000000023bc5-118.dat	upx
behavioral2/files/0x000a000000023bd1-161.dat	upx
behavioral2/files/0x000a000000023bd0-158.dat	upx
behavioral2/files/0x000a000000023bbe-114.dat	upx
behavioral2/files/0x000a000000023bcf-151.dat	upx
behavioral2/files/0x000a000000023bbc-95.dat	upx
behavioral2/files/0x000a000000023bc1-89.dat	upx
behavioral2/files/0x000a000000023bbb-127.dat	upx
behavioral2/files/0x0031000000023bb6-83.dat	upx
behavioral2/files/0x000a000000023bb9-75.dat	upx
behavioral2/files/0x000a000000023bb5-74.dat	upx
behavioral2/files/0x000a000000023bb0-53.dat	upx
behavioral2/files/0x0031000000023bb7-72.dat	upx
behavioral2/files/0x000a000000023bb3-38.dat	upx
behavioral2/files/0x000a000000023bb4-45.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\DpUTFzL.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\FfjECHM.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\rsdWLaJ.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\QHBwaku.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\UNkXASB.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\ZwgXOgc.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\qynOhVv.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\yxDiAff.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\rRDOcsJ.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\wihcSyv.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\ipxEPGI.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\kwRPLrJ.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\PxgieNw.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\KjAaghZ.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\NllhkES.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\JdqtyXp.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\mLajHcn.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\AMLzxna.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\eUxxubz.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\XAjXOtQ.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\VpXbzGY.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\WqxqHmE.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\eSslxDk.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\SulpSzY.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\YgFoyon.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\BdVrgyQ.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\KlUWeEY.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\rrSOnzx.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\jMncWtG.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\PloFGlF.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\USZocFQ.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\RFWqMOG.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\vXIdHFl.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\zstHKdl.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\RFEbMOE.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\dOUDdIk.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\AZMnXaR.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\eRwOqEn.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\tzGJJmd.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\bQZaRiL.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\oHlhywP.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\IYITXRi.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\ZHjtBxO.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\TlffGZX.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\CrZGnwM.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\WOyTnoG.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\xMnKOWt.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\PHBvpRt.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\cxcfolB.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\zinhLex.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\vSWuGBh.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\LCfOwBM.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\CZqgGBU.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\xOfSHex.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\jHZaygv.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\VnHweYa.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\ClOMbVZ.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\Bzplfuw.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\SmWBeVT.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\OddGdZe.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\ZZOUiwI.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\PZSETTy.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\eTQlmWd.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\TYiSjtW.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4772	powershell.exe
4772	powershell.exe
4772	powershell.exe
4772	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
Token: SeDebugPrivilege	4772	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 4772	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	84
PID 4084 wrote to memory of 4772	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	84
PID 4084 wrote to memory of 3536	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	85
PID 4084 wrote to memory of 3536	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	85
PID 4084 wrote to memory of 412	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	86
PID 4084 wrote to memory of 412	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	86
PID 4084 wrote to memory of 3532	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	87
PID 4084 wrote to memory of 3532	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	87
PID 4084 wrote to memory of 2328	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	88
PID 4084 wrote to memory of 2328	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	88
PID 4084 wrote to memory of 3024	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	89
PID 4084 wrote to memory of 3024	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	89
PID 4084 wrote to memory of 1256	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	90
PID 4084 wrote to memory of 1256	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	90
PID 4084 wrote to memory of 592	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	91
PID 4084 wrote to memory of 592	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	91
PID 4084 wrote to memory of 2444	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	92
PID 4084 wrote to memory of 2444	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	92
PID 4084 wrote to memory of 1992	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	93
PID 4084 wrote to memory of 1992	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	93
PID 4084 wrote to memory of 2768	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	94
PID 4084 wrote to memory of 2768	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	94
PID 4084 wrote to memory of 3824	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	95
PID 4084 wrote to memory of 3824	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	95
PID 4084 wrote to memory of 3608	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	96
PID 4084 wrote to memory of 3608	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	96
PID 4084 wrote to memory of 1884	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	97
PID 4084 wrote to memory of 1884	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	97
PID 4084 wrote to memory of 2716	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	98
PID 4084 wrote to memory of 2716	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	98
PID 4084 wrote to memory of 1920	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	99
PID 4084 wrote to memory of 1920	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	99
PID 4084 wrote to memory of 1344	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	100
PID 4084 wrote to memory of 1344	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	100
PID 4084 wrote to memory of 3060	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	101
PID 4084 wrote to memory of 3060	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	101
PID 4084 wrote to memory of 4808	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	102
PID 4084 wrote to memory of 4808	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	102
PID 4084 wrote to memory of 5080	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	103
PID 4084 wrote to memory of 5080	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	103
PID 4084 wrote to memory of 4512	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	104
PID 4084 wrote to memory of 4512	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	104
PID 4084 wrote to memory of 3864	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	105
PID 4084 wrote to memory of 3864	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	105
PID 4084 wrote to memory of 4404	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	106
PID 4084 wrote to memory of 4404	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	106
PID 4084 wrote to memory of 3412	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	107
PID 4084 wrote to memory of 3412	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	107
PID 4084 wrote to memory of 2520	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	108
PID 4084 wrote to memory of 2520	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	108
PID 4084 wrote to memory of 3012	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	109
PID 4084 wrote to memory of 3012	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	109
PID 4084 wrote to memory of 544	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	110
PID 4084 wrote to memory of 544	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	110
PID 4084 wrote to memory of 644	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	111
PID 4084 wrote to memory of 644	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	111
PID 4084 wrote to memory of 4876	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	112
PID 4084 wrote to memory of 4876	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	112
PID 4084 wrote to memory of 1392	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	113
PID 4084 wrote to memory of 1392	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	113
PID 4084 wrote to memory of 3172	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	114
PID 4084 wrote to memory of 3172	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	114
PID 4084 wrote to memory of 1020	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	115
PID 4084 wrote to memory of 1020	4084	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4772
- C:\Windows\System\ATKPwMe.exe
  C:\Windows\System\ATKPwMe.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\QiMMvyD.exe
  C:\Windows\System\QiMMvyD.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\ClOMbVZ.exe
  C:\Windows\System\ClOMbVZ.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\vLgYmcK.exe
  C:\Windows\System\vLgYmcK.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\zQFoliZ.exe
  C:\Windows\System\zQFoliZ.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\xpgJqjT.exe
  C:\Windows\System\xpgJqjT.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\PHcZTLC.exe
  C:\Windows\System\PHcZTLC.exe
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Windows\System\BxqwXEL.exe
  C:\Windows\System\BxqwXEL.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\GhzCfpp.exe
  C:\Windows\System\GhzCfpp.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\SoIDEpO.exe
  C:\Windows\System\SoIDEpO.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\dfDEkGu.exe
  C:\Windows\System\dfDEkGu.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\QsJnTCw.exe
  C:\Windows\System\QsJnTCw.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\ENticNg.exe
  C:\Windows\System\ENticNg.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\jzMOirL.exe
  C:\Windows\System\jzMOirL.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\myhYVSx.exe
  C:\Windows\System\myhYVSx.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\kbBYUqg.exe
  C:\Windows\System\kbBYUqg.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\cPotjsu.exe
  C:\Windows\System\cPotjsu.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\UmXIMOG.exe
  C:\Windows\System\UmXIMOG.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\mkCColT.exe
  C:\Windows\System\mkCColT.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\huxSXIl.exe
  C:\Windows\System\huxSXIl.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\wZXtCkv.exe
  C:\Windows\System\wZXtCkv.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System\eCVFvwn.exe
  C:\Windows\System\eCVFvwn.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\ldBCeDL.exe
  C:\Windows\System\ldBCeDL.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\cPTylXR.exe
  C:\Windows\System\cPTylXR.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\xUeilrY.exe
  C:\Windows\System\xUeilrY.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\hrTEdFA.exe
  C:\Windows\System\hrTEdFA.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\VodrMrL.exe
  C:\Windows\System\VodrMrL.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\xJEFVzl.exe
  C:\Windows\System\xJEFVzl.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\aThvUum.exe
  C:\Windows\System\aThvUum.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\SHHEthI.exe
  C:\Windows\System\SHHEthI.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\KDLitdv.exe
  C:\Windows\System\KDLitdv.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\YjoEihG.exe
  C:\Windows\System\YjoEihG.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\PPehdBi.exe
  C:\Windows\System\PPehdBi.exe
  2⤵
  - Executes dropped EXE
  PID:524
- C:\Windows\System\nPqqXWa.exe
  C:\Windows\System\nPqqXWa.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\vIZCmcl.exe
  C:\Windows\System\vIZCmcl.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\WWdphYj.exe
  C:\Windows\System\WWdphYj.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\aoFiPhl.exe
  C:\Windows\System\aoFiPhl.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\VAVFOxu.exe
  C:\Windows\System\VAVFOxu.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\RcBnIfg.exe
  C:\Windows\System\RcBnIfg.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\ThvHcVP.exe
  C:\Windows\System\ThvHcVP.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\MxcGLLn.exe
  C:\Windows\System\MxcGLLn.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\oHlhywP.exe
  C:\Windows\System\oHlhywP.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\IzdIHPw.exe
  C:\Windows\System\IzdIHPw.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\wrozRzU.exe
  C:\Windows\System\wrozRzU.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\wfGLVSw.exe
  C:\Windows\System\wfGLVSw.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\JMStwxt.exe
  C:\Windows\System\JMStwxt.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\xMxGnqc.exe
  C:\Windows\System\xMxGnqc.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\dllHPSg.exe
  C:\Windows\System\dllHPSg.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\nTOCltD.exe
  C:\Windows\System\nTOCltD.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\AMhpCEN.exe
  C:\Windows\System\AMhpCEN.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\VZTqlDP.exe
  C:\Windows\System\VZTqlDP.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\sPZqZOU.exe
  C:\Windows\System\sPZqZOU.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\PsImdZH.exe
  C:\Windows\System\PsImdZH.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\BqEzEPI.exe
  C:\Windows\System\BqEzEPI.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\ENcGEub.exe
  C:\Windows\System\ENcGEub.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\orZeAWJ.exe
  C:\Windows\System\orZeAWJ.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\FhLoxve.exe
  C:\Windows\System\FhLoxve.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\eHLjMpU.exe
  C:\Windows\System\eHLjMpU.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\NGOVFWk.exe
  C:\Windows\System\NGOVFWk.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\TZvUqGR.exe
  C:\Windows\System\TZvUqGR.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\PuwJIEs.exe
  C:\Windows\System\PuwJIEs.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\vanMxqL.exe
  C:\Windows\System\vanMxqL.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\NydmZqX.exe
  C:\Windows\System\NydmZqX.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\Cbhdasy.exe
  C:\Windows\System\Cbhdasy.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\HCXtAwh.exe
  C:\Windows\System\HCXtAwh.exe
  2⤵
  PID:4356
- C:\Windows\System\oTPlhjb.exe
  C:\Windows\System\oTPlhjb.exe
  2⤵
  PID:4520
- C:\Windows\System\ENLqCLW.exe
  C:\Windows\System\ENLqCLW.exe
  2⤵
  PID:2796
- C:\Windows\System\pUwDEbj.exe
  C:\Windows\System\pUwDEbj.exe
  2⤵
  PID:4212
- C:\Windows\System\fNACqiR.exe
  C:\Windows\System\fNACqiR.exe
  2⤵
  PID:3812
- C:\Windows\System\lNLHkyl.exe
  C:\Windows\System\lNLHkyl.exe
  2⤵
  PID:1828
- C:\Windows\System\jheCHtZ.exe
  C:\Windows\System\jheCHtZ.exe
  2⤵
  PID:976
- C:\Windows\System\jSQCfAm.exe
  C:\Windows\System\jSQCfAm.exe
  2⤵
  PID:1292
- C:\Windows\System\IgLAHtl.exe
  C:\Windows\System\IgLAHtl.exe
  2⤵
  PID:4592
- C:\Windows\System\OOJuarr.exe
  C:\Windows\System\OOJuarr.exe
  2⤵
  PID:4456
- C:\Windows\System\eCdGTzD.exe
  C:\Windows\System\eCdGTzD.exe
  2⤵
  PID:2204
- C:\Windows\System\MgrAgay.exe
  C:\Windows\System\MgrAgay.exe
  2⤵
  PID:3344
- C:\Windows\System\GUMHAjH.exe
  C:\Windows\System\GUMHAjH.exe
  2⤵
  PID:2892
- C:\Windows\System\kDhjjOf.exe
  C:\Windows\System\kDhjjOf.exe
  2⤵
  PID:1808
- C:\Windows\System\GeEoTjE.exe
  C:\Windows\System\GeEoTjE.exe
  2⤵
  PID:1068
- C:\Windows\System\DQOVrTS.exe
  C:\Windows\System\DQOVrTS.exe
  2⤵
  PID:2020
- C:\Windows\System\MUbKPjY.exe
  C:\Windows\System\MUbKPjY.exe
  2⤵
  PID:1756
- C:\Windows\System\wLOTgEp.exe
  C:\Windows\System\wLOTgEp.exe
  2⤵
  PID:3324
- C:\Windows\System\aeYBzmM.exe
  C:\Windows\System\aeYBzmM.exe
  2⤵
  PID:4816
- C:\Windows\System\aZIezso.exe
  C:\Windows\System\aZIezso.exe
  2⤵
  PID:836
- C:\Windows\System\fCBhMHN.exe
  C:\Windows\System\fCBhMHN.exe
  2⤵
  PID:5132
- C:\Windows\System\qCFRWzu.exe
  C:\Windows\System\qCFRWzu.exe
  2⤵
  PID:5164
- C:\Windows\System\EYtYzin.exe
  C:\Windows\System\EYtYzin.exe
  2⤵
  PID:5180
- C:\Windows\System\WHizQgn.exe
  C:\Windows\System\WHizQgn.exe
  2⤵
  PID:5200
- C:\Windows\System\BMdzuYa.exe
  C:\Windows\System\BMdzuYa.exe
  2⤵
  PID:5220
- C:\Windows\System\iCBPPgF.exe
  C:\Windows\System\iCBPPgF.exe
  2⤵
  PID:5240
- C:\Windows\System\AUcFPVA.exe
  C:\Windows\System\AUcFPVA.exe
  2⤵
  PID:5276
- C:\Windows\System\XJgRfZd.exe
  C:\Windows\System\XJgRfZd.exe
  2⤵
  PID:5292
- C:\Windows\System\lOILTUx.exe
  C:\Windows\System\lOILTUx.exe
  2⤵
  PID:5316
- C:\Windows\System\pnesjFB.exe
  C:\Windows\System\pnesjFB.exe
  2⤵
  PID:5340
- C:\Windows\System\EsPsXNW.exe
  C:\Windows\System\EsPsXNW.exe
  2⤵
  PID:5364
- C:\Windows\System\ayhGTpd.exe
  C:\Windows\System\ayhGTpd.exe
  2⤵
  PID:5380
- C:\Windows\System\ryJGimf.exe
  C:\Windows\System\ryJGimf.exe
  2⤵
  PID:5404
- C:\Windows\System\lCvnkWa.exe
  C:\Windows\System\lCvnkWa.exe
  2⤵
  PID:5424
- C:\Windows\System\PlMAcWt.exe
  C:\Windows\System\PlMAcWt.exe
  2⤵
  PID:5440
- C:\Windows\System\cgXrOkf.exe
  C:\Windows\System\cgXrOkf.exe
  2⤵
  PID:5460
- C:\Windows\System\ahBvpCy.exe
  C:\Windows\System\ahBvpCy.exe
  2⤵
  PID:5484
- C:\Windows\System\hBJWeeL.exe
  C:\Windows\System\hBJWeeL.exe
  2⤵
  PID:5512
- C:\Windows\System\gpTWYMg.exe
  C:\Windows\System\gpTWYMg.exe
  2⤵
  PID:5528
- C:\Windows\System\vXIdHFl.exe
  C:\Windows\System\vXIdHFl.exe
  2⤵
  PID:5556
- C:\Windows\System\RuolKzU.exe
  C:\Windows\System\RuolKzU.exe
  2⤵
  PID:5572
- C:\Windows\System\blGnpvO.exe
  C:\Windows\System\blGnpvO.exe
  2⤵
  PID:5588
- C:\Windows\System\imLocNn.exe
  C:\Windows\System\imLocNn.exe
  2⤵
  PID:5612
- C:\Windows\System\TdqBafn.exe
  C:\Windows\System\TdqBafn.exe
  2⤵
  PID:5628
- C:\Windows\System\MAoBgPP.exe
  C:\Windows\System\MAoBgPP.exe
  2⤵
  PID:5652
- C:\Windows\System\RyZolzx.exe
  C:\Windows\System\RyZolzx.exe
  2⤵
  PID:5672
- C:\Windows\System\SNpxroF.exe
  C:\Windows\System\SNpxroF.exe
  2⤵
  PID:5688
- C:\Windows\System\taMZqMe.exe
  C:\Windows\System\taMZqMe.exe
  2⤵
  PID:5704
- C:\Windows\System\EuvNumw.exe
  C:\Windows\System\EuvNumw.exe
  2⤵
  PID:5720
- C:\Windows\System\mTLtRhU.exe
  C:\Windows\System\mTLtRhU.exe
  2⤵
  PID:5756
- C:\Windows\System\oMkhsbM.exe
  C:\Windows\System\oMkhsbM.exe
  2⤵
  PID:5780
- C:\Windows\System\enSJnUC.exe
  C:\Windows\System\enSJnUC.exe
  2⤵
  PID:5804
- C:\Windows\System\PcSVxCe.exe
  C:\Windows\System\PcSVxCe.exe
  2⤵
  PID:5820
- C:\Windows\System\OXljwvx.exe
  C:\Windows\System\OXljwvx.exe
  2⤵
  PID:5836
- C:\Windows\System\VqAYSRw.exe
  C:\Windows\System\VqAYSRw.exe
  2⤵
  PID:5852
- C:\Windows\System\giOvymy.exe
  C:\Windows\System\giOvymy.exe
  2⤵
  PID:5880
- C:\Windows\System\gjmnpAY.exe
  C:\Windows\System\gjmnpAY.exe
  2⤵
  PID:5900
- C:\Windows\System\TuJILxL.exe
  C:\Windows\System\TuJILxL.exe
  2⤵
  PID:5916
- C:\Windows\System\rhlJAlP.exe
  C:\Windows\System\rhlJAlP.exe
  2⤵
  PID:5932
- C:\Windows\System\kgjthTN.exe
  C:\Windows\System\kgjthTN.exe
  2⤵
  PID:5964
- C:\Windows\System\PvqyqJh.exe
  C:\Windows\System\PvqyqJh.exe
  2⤵
  PID:5988
- C:\Windows\System\qFFmXqR.exe
  C:\Windows\System\qFFmXqR.exe
  2⤵
  PID:6008
- C:\Windows\System\kbqjBEM.exe
  C:\Windows\System\kbqjBEM.exe
  2⤵
  PID:6028
- C:\Windows\System\APvtsty.exe
  C:\Windows\System\APvtsty.exe
  2⤵
  PID:6052
- C:\Windows\System\oaYFkPI.exe
  C:\Windows\System\oaYFkPI.exe
  2⤵
  PID:6116
- C:\Windows\System\gQnGYpD.exe
  C:\Windows\System\gQnGYpD.exe
  2⤵
  PID:6132
- C:\Windows\System\idgdfEC.exe
  C:\Windows\System\idgdfEC.exe
  2⤵
  PID:3376
- C:\Windows\System\kDeBXct.exe
  C:\Windows\System\kDeBXct.exe
  2⤵
  PID:2004
- C:\Windows\System\XvIWhwA.exe
  C:\Windows\System\XvIWhwA.exe
  2⤵
  PID:2956
- C:\Windows\System\aXknfAp.exe
  C:\Windows\System\aXknfAp.exe
  2⤵
  PID:2516
- C:\Windows\System\JJDesOp.exe
  C:\Windows\System\JJDesOp.exe
  2⤵
  PID:2888
- C:\Windows\System\JqENWmY.exe
  C:\Windows\System\JqENWmY.exe
  2⤵
  PID:1996
- C:\Windows\System\jMncWtG.exe
  C:\Windows\System\jMncWtG.exe
  2⤵
  PID:1108
- C:\Windows\System\lUveLvk.exe
  C:\Windows\System\lUveLvk.exe
  2⤵
  PID:3692
- C:\Windows\System\zADEVus.exe
  C:\Windows\System\zADEVus.exe
  2⤵
  PID:3048
- C:\Windows\System\VpQnCCe.exe
  C:\Windows\System\VpQnCCe.exe
  2⤵
  PID:1644
- C:\Windows\System\BHwdCet.exe
  C:\Windows\System\BHwdCet.exe
  2⤵
  PID:4612
- C:\Windows\System\bRoHMIf.exe
  C:\Windows\System\bRoHMIf.exe
  2⤵
  PID:4384
- C:\Windows\System\thhypLg.exe
  C:\Windows\System\thhypLg.exe
  2⤵
  PID:2456
- C:\Windows\System\uIVpgxW.exe
  C:\Windows\System\uIVpgxW.exe
  2⤵
  PID:888
- C:\Windows\System\nwewTGQ.exe
  C:\Windows\System\nwewTGQ.exe
  2⤵
  PID:3156
- C:\Windows\System\wcaECff.exe
  C:\Windows\System\wcaECff.exe
  2⤵
  PID:2388
- C:\Windows\System\KkYdUxh.exe
  C:\Windows\System\KkYdUxh.exe
  2⤵
  PID:5212
- C:\Windows\System\dFfgIkp.exe
  C:\Windows\System\dFfgIkp.exe
  2⤵
  PID:6152
- C:\Windows\System\eaIbQNC.exe
  C:\Windows\System\eaIbQNC.exe
  2⤵
  PID:6180
- C:\Windows\System\VXdwMdO.exe
  C:\Windows\System\VXdwMdO.exe
  2⤵
  PID:6196
- C:\Windows\System\QExHYoF.exe
  C:\Windows\System\QExHYoF.exe
  2⤵
  PID:6212
- C:\Windows\System\MneGlyv.exe
  C:\Windows\System\MneGlyv.exe
  2⤵
  PID:6228
- C:\Windows\System\XAjXOtQ.exe
  C:\Windows\System\XAjXOtQ.exe
  2⤵
  PID:6244
- C:\Windows\System\vwYPjRO.exe
  C:\Windows\System\vwYPjRO.exe
  2⤵
  PID:6264
- C:\Windows\System\WeoIMlF.exe
  C:\Windows\System\WeoIMlF.exe
  2⤵
  PID:6288
- C:\Windows\System\rKwcaKF.exe
  C:\Windows\System\rKwcaKF.exe
  2⤵
  PID:6304
- C:\Windows\System\PZJIgsC.exe
  C:\Windows\System\PZJIgsC.exe
  2⤵
  PID:6328
- C:\Windows\System\CZIbBkj.exe
  C:\Windows\System\CZIbBkj.exe
  2⤵
  PID:6344
- C:\Windows\System\YdCtJZe.exe
  C:\Windows\System\YdCtJZe.exe
  2⤵
  PID:6460
- C:\Windows\System\kBTdljz.exe
  C:\Windows\System\kBTdljz.exe
  2⤵
  PID:6840
- C:\Windows\System\JbUuIfk.exe
  C:\Windows\System\JbUuIfk.exe
  2⤵
  PID:6860
- C:\Windows\System\LNaQmwd.exe
  C:\Windows\System\LNaQmwd.exe
  2⤵
  PID:6876
- C:\Windows\System\cHELvpw.exe
  C:\Windows\System\cHELvpw.exe
  2⤵
  PID:6896
- C:\Windows\System\ZcvQOcP.exe
  C:\Windows\System\ZcvQOcP.exe
  2⤵
  PID:6912
- C:\Windows\System\CjlRJge.exe
  C:\Windows\System\CjlRJge.exe
  2⤵
  PID:6936
- C:\Windows\System\LogCSKq.exe
  C:\Windows\System\LogCSKq.exe
  2⤵
  PID:6952
- C:\Windows\System\pTbHlKc.exe
  C:\Windows\System\pTbHlKc.exe
  2⤵
  PID:6972
- C:\Windows\System\zZOBxNe.exe
  C:\Windows\System\zZOBxNe.exe
  2⤵
  PID:6992
- C:\Windows\System\TyTOOrt.exe
  C:\Windows\System\TyTOOrt.exe
  2⤵
  PID:7008
- C:\Windows\System\fXhJfvk.exe
  C:\Windows\System\fXhJfvk.exe
  2⤵
  PID:7028
- C:\Windows\System\HDmBKdR.exe
  C:\Windows\System\HDmBKdR.exe
  2⤵
  PID:7048
- C:\Windows\System\fNGOArP.exe
  C:\Windows\System\fNGOArP.exe
  2⤵
  PID:7064
- C:\Windows\System\BtnAKpV.exe
  C:\Windows\System\BtnAKpV.exe
  2⤵
  PID:7104
- C:\Windows\System\SqMoexK.exe
  C:\Windows\System\SqMoexK.exe
  2⤵
  PID:7120
- C:\Windows\System\yRcXgqQ.exe
  C:\Windows\System\yRcXgqQ.exe
  2⤵
  PID:7136
- C:\Windows\System\QSrBlnA.exe
  C:\Windows\System\QSrBlnA.exe
  2⤵
  PID:7152
- C:\Windows\System\wyPHgfG.exe
  C:\Windows\System\wyPHgfG.exe
  2⤵
  PID:4992
- C:\Windows\System\kaqyeSu.exe
  C:\Windows\System\kaqyeSu.exe
  2⤵
  PID:4616
- C:\Windows\System\ecuVwwZ.exe
  C:\Windows\System\ecuVwwZ.exe
  2⤵
  PID:3676
- C:\Windows\System\SwqnmRJ.exe
  C:\Windows\System\SwqnmRJ.exe
  2⤵
  PID:3580
- C:\Windows\System\exKUqAY.exe
  C:\Windows\System\exKUqAY.exe
  2⤵
  PID:2088
- C:\Windows\System\CtHdFAI.exe
  C:\Windows\System\CtHdFAI.exe
  2⤵
  PID:4964
- C:\Windows\System\RyLFzbu.exe
  C:\Windows\System\RyLFzbu.exe
  2⤵
  PID:4336
- C:\Windows\System\jLFmqnO.exe
  C:\Windows\System\jLFmqnO.exe
  2⤵
  PID:5140
- C:\Windows\System\pTksWYT.exe
  C:\Windows\System\pTksWYT.exe
  2⤵
  PID:5172
- C:\Windows\System\AhxuUXB.exe
  C:\Windows\System\AhxuUXB.exe
  2⤵
  PID:5268
- C:\Windows\System\Kwmyuup.exe
  C:\Windows\System\Kwmyuup.exe
  2⤵
  PID:5304
- C:\Windows\System\vEmJMAS.exe
  C:\Windows\System\vEmJMAS.exe
  2⤵
  PID:5332
- C:\Windows\System\owxPuAW.exe
  C:\Windows\System\owxPuAW.exe
  2⤵
  PID:5432
- C:\Windows\System\qynOhVv.exe
  C:\Windows\System\qynOhVv.exe
  2⤵
  PID:5472
- C:\Windows\System\RmvrJmb.exe
  C:\Windows\System\RmvrJmb.exe
  2⤵
  PID:5536
- C:\Windows\System\qiyfnEq.exe
  C:\Windows\System\qiyfnEq.exe
  2⤵
  PID:5580
- C:\Windows\System\rfkIAac.exe
  C:\Windows\System\rfkIAac.exe
  2⤵
  PID:5604
- C:\Windows\System\IdQAOKd.exe
  C:\Windows\System\IdQAOKd.exe
  2⤵
  PID:5664
- C:\Windows\System\coqgWtN.exe
  C:\Windows\System\coqgWtN.exe
  2⤵
  PID:5700
- C:\Windows\System\ibcVdyp.exe
  C:\Windows\System\ibcVdyp.exe
  2⤵
  PID:5744
- C:\Windows\System\cAlRWbC.exe
  C:\Windows\System\cAlRWbC.exe
  2⤵
  PID:5776
- C:\Windows\System\hzFuxHy.exe
  C:\Windows\System\hzFuxHy.exe
  2⤵
  PID:5812
- C:\Windows\System\lbvxMnq.exe
  C:\Windows\System\lbvxMnq.exe
  2⤵
  PID:5844
- C:\Windows\System\npBhTSU.exe
  C:\Windows\System\npBhTSU.exe
  2⤵
  PID:5928
- C:\Windows\System\YqdvykJ.exe
  C:\Windows\System\YqdvykJ.exe
  2⤵
  PID:5976
- C:\Windows\System\BROiCgs.exe
  C:\Windows\System\BROiCgs.exe
  2⤵
  PID:6036
- C:\Windows\System\RJbPAiH.exe
  C:\Windows\System\RJbPAiH.exe
  2⤵
  PID:6064
- C:\Windows\System\hnohEOX.exe
  C:\Windows\System\hnohEOX.exe
  2⤵
  PID:6124
- C:\Windows\System\opBobvL.exe
  C:\Windows\System\opBobvL.exe
  2⤵
  PID:3484
- C:\Windows\System\DAmlVux.exe
  C:\Windows\System\DAmlVux.exe
  2⤵
  PID:4280
- C:\Windows\System\uBOjXfV.exe
  C:\Windows\System\uBOjXfV.exe
  2⤵
  PID:1728
- C:\Windows\System\tktXDxt.exe
  C:\Windows\System\tktXDxt.exe
  2⤵
  PID:2632
- C:\Windows\System\PxTGHFJ.exe
  C:\Windows\System\PxTGHFJ.exe
  2⤵
  PID:5412
- C:\Windows\System\pFkFWjA.exe
  C:\Windows\System\pFkFWjA.exe
  2⤵
  PID:4316
- C:\Windows\System\XtNJfho.exe
  C:\Windows\System\XtNJfho.exe
  2⤵
  PID:5620
- C:\Windows\System\SbUpJrC.exe
  C:\Windows\System\SbUpJrC.exe
  2⤵
  PID:1368
- C:\Windows\System\SfApbAG.exe
  C:\Windows\System\SfApbAG.exe
  2⤵
  PID:6148
- C:\Windows\System\eyzaaXf.exe
  C:\Windows\System\eyzaaXf.exe
  2⤵
  PID:6204
- C:\Windows\System\PCsKySj.exe
  C:\Windows\System\PCsKySj.exe
  2⤵
  PID:6236
- C:\Windows\System\iKbwkuj.exe
  C:\Windows\System\iKbwkuj.exe
  2⤵
  PID:6284
- C:\Windows\System\THoGfNI.exe
  C:\Windows\System\THoGfNI.exe
  2⤵
  PID:6324
- C:\Windows\System\EjgLRgZ.exe
  C:\Windows\System\EjgLRgZ.exe
  2⤵
  PID:6400
- C:\Windows\System\pRBvbLM.exe
  C:\Windows\System\pRBvbLM.exe
  2⤵
  PID:3640
- C:\Windows\System\dNKupCr.exe
  C:\Windows\System\dNKupCr.exe
  2⤵
  PID:4304
- C:\Windows\System\WLmKzJG.exe
  C:\Windows\System\WLmKzJG.exe
  2⤵
  PID:2652
- C:\Windows\System\FoJNIDu.exe
  C:\Windows\System\FoJNIDu.exe
  2⤵
  PID:3188
- C:\Windows\System\uNxEEZj.exe
  C:\Windows\System\uNxEEZj.exe
  2⤵
  PID:2856
- C:\Windows\System\qEDdSfB.exe
  C:\Windows\System\qEDdSfB.exe
  2⤵
  PID:1556
- C:\Windows\System\JJtYiLb.exe
  C:\Windows\System\JJtYiLb.exe
  2⤵
  PID:4908
- C:\Windows\System\ZYtCLHX.exe
  C:\Windows\System\ZYtCLHX.exe
  2⤵
  PID:1340
- C:\Windows\System\IUFrNNT.exe
  C:\Windows\System\IUFrNNT.exe
  2⤵
  PID:3728
- C:\Windows\System\PJqcnXh.exe
  C:\Windows\System\PJqcnXh.exe
  2⤵
  PID:2288
- C:\Windows\System\vkaHLxa.exe
  C:\Windows\System\vkaHLxa.exe
  2⤵
  PID:3320
- C:\Windows\System\PwzUzGB.exe
  C:\Windows\System\PwzUzGB.exe
  2⤵
  PID:2764
- C:\Windows\System\VcfHBTK.exe
  C:\Windows\System\VcfHBTK.exe
  2⤵
  PID:4312
- C:\Windows\System\rStdgcS.exe
  C:\Windows\System\rStdgcS.exe
  2⤵
  PID:4504
- C:\Windows\System\ASZbOCI.exe
  C:\Windows\System\ASZbOCI.exe
  2⤵
  PID:5196
- C:\Windows\System\IYITXRi.exe
  C:\Windows\System\IYITXRi.exe
  2⤵
  PID:6480
- C:\Windows\System\RxmjeKa.exe
  C:\Windows\System\RxmjeKa.exe
  2⤵
  PID:6744
- C:\Windows\System\SulpSzY.exe
  C:\Windows\System\SulpSzY.exe
  2⤵
  PID:2124
- C:\Windows\System\yZTvltX.exe
  C:\Windows\System\yZTvltX.exe
  2⤵
  PID:6964
- C:\Windows\System\GIqUIHU.exe
  C:\Windows\System\GIqUIHU.exe
  2⤵
  PID:6988
- C:\Windows\System\kdSTQUQ.exe
  C:\Windows\System\kdSTQUQ.exe
  2⤵
  PID:7072
- C:\Windows\System\bxIoVId.exe
  C:\Windows\System\bxIoVId.exe
  2⤵
  PID:7144
- C:\Windows\System\lUqwuAV.exe
  C:\Windows\System\lUqwuAV.exe
  2⤵
  PID:5948
- C:\Windows\System\qZWgdin.exe
  C:\Windows\System\qZWgdin.exe
  2⤵
  PID:5104
- C:\Windows\System\ATFqnzE.exe
  C:\Windows\System\ATFqnzE.exe
  2⤵
  PID:5188
- C:\Windows\System\hfhvMCV.exe
  C:\Windows\System\hfhvMCV.exe
  2⤵
  PID:5284
- C:\Windows\System\mgWpWsS.exe
  C:\Windows\System\mgWpWsS.exe
  2⤵
  PID:5544
- C:\Windows\System\oNXORIf.exe
  C:\Windows\System\oNXORIf.exe
  2⤵
  PID:7184
- C:\Windows\System\XGyZxZd.exe
  C:\Windows\System\XGyZxZd.exe
  2⤵
  PID:7204
- C:\Windows\System\bhUBMGN.exe
  C:\Windows\System\bhUBMGN.exe
  2⤵
  PID:7228
- C:\Windows\System\UcxADEX.exe
  C:\Windows\System\UcxADEX.exe
  2⤵
  PID:7248
- C:\Windows\System\xDWxfzO.exe
  C:\Windows\System\xDWxfzO.exe
  2⤵
  PID:7264
- C:\Windows\System\keEvGcu.exe
  C:\Windows\System\keEvGcu.exe
  2⤵
  PID:7284
- C:\Windows\System\MFQobgB.exe
  C:\Windows\System\MFQobgB.exe
  2⤵
  PID:7304
- C:\Windows\System\lAhRAkm.exe
  C:\Windows\System\lAhRAkm.exe
  2⤵
  PID:7332
- C:\Windows\System\ccIlYPj.exe
  C:\Windows\System\ccIlYPj.exe
  2⤵
  PID:7348
- C:\Windows\System\UaDSdbL.exe
  C:\Windows\System\UaDSdbL.exe
  2⤵
  PID:7372
- C:\Windows\System\JUSodoQ.exe
  C:\Windows\System\JUSodoQ.exe
  2⤵
  PID:7388
- C:\Windows\System\AOfRkoS.exe
  C:\Windows\System\AOfRkoS.exe
  2⤵
  PID:7408
- C:\Windows\System\ZaeXiPb.exe
  C:\Windows\System\ZaeXiPb.exe
  2⤵
  PID:7428
- C:\Windows\System\rTGInZj.exe
  C:\Windows\System\rTGInZj.exe
  2⤵
  PID:7444
- C:\Windows\System\NatYAjV.exe
  C:\Windows\System\NatYAjV.exe
  2⤵
  PID:7468
- C:\Windows\System\UhPihZD.exe
  C:\Windows\System\UhPihZD.exe
  2⤵
  PID:7484
- C:\Windows\System\OQBAggQ.exe
  C:\Windows\System\OQBAggQ.exe
  2⤵
  PID:7504
- C:\Windows\System\gmCuRIM.exe
  C:\Windows\System\gmCuRIM.exe
  2⤵
  PID:7524
- C:\Windows\System\pFyRZjA.exe
  C:\Windows\System\pFyRZjA.exe
  2⤵
  PID:7540
- C:\Windows\System\gaHhyTk.exe
  C:\Windows\System\gaHhyTk.exe
  2⤵
  PID:7560
- C:\Windows\System\yyeLPbj.exe
  C:\Windows\System\yyeLPbj.exe
  2⤵
  PID:7584
- C:\Windows\System\PKgvBwG.exe
  C:\Windows\System\PKgvBwG.exe
  2⤵
  PID:7604
- C:\Windows\System\fHfdOZo.exe
  C:\Windows\System\fHfdOZo.exe
  2⤵
  PID:7628
- C:\Windows\System\LYvTxmg.exe
  C:\Windows\System\LYvTxmg.exe
  2⤵
  PID:7648
- C:\Windows\System\isgGKso.exe
  C:\Windows\System\isgGKso.exe
  2⤵
  PID:7672
- C:\Windows\System\hihyuOX.exe
  C:\Windows\System\hihyuOX.exe
  2⤵
  PID:7692
- C:\Windows\System\tbuBJnw.exe
  C:\Windows\System\tbuBJnw.exe
  2⤵
  PID:7712
- C:\Windows\System\WDcKTnW.exe
  C:\Windows\System\WDcKTnW.exe
  2⤵
  PID:7728
- C:\Windows\System\hZWHcGd.exe
  C:\Windows\System\hZWHcGd.exe
  2⤵
  PID:7748
- C:\Windows\System\nWfulvX.exe
  C:\Windows\System\nWfulvX.exe
  2⤵
  PID:7768
- C:\Windows\System\VfNcZKB.exe
  C:\Windows\System\VfNcZKB.exe
  2⤵
  PID:7788
- C:\Windows\System\ZeVjLsc.exe
  C:\Windows\System\ZeVjLsc.exe
  2⤵
  PID:7808
- C:\Windows\System\JHFONVV.exe
  C:\Windows\System\JHFONVV.exe
  2⤵
  PID:7832
- C:\Windows\System\MqBHfYn.exe
  C:\Windows\System\MqBHfYn.exe
  2⤵
  PID:7848
- C:\Windows\System\MmZsCcR.exe
  C:\Windows\System\MmZsCcR.exe
  2⤵
  PID:7868
- C:\Windows\System\tbNngpg.exe
  C:\Windows\System\tbNngpg.exe
  2⤵
  PID:7892
- C:\Windows\System\ZZOUiwI.exe
  C:\Windows\System\ZZOUiwI.exe
  2⤵
  PID:7916
- C:\Windows\System\YnnnEyX.exe
  C:\Windows\System\YnnnEyX.exe
  2⤵
  PID:7948
- C:\Windows\System\JJsioiS.exe
  C:\Windows\System\JJsioiS.exe
  2⤵
  PID:7964
- C:\Windows\System\NllhkES.exe
  C:\Windows\System\NllhkES.exe
  2⤵
  PID:7988
- C:\Windows\System\LxmOaRW.exe
  C:\Windows\System\LxmOaRW.exe
  2⤵
  PID:8012
- C:\Windows\System\zeeaqIa.exe
  C:\Windows\System\zeeaqIa.exe
  2⤵
  PID:8032
- C:\Windows\System\ZWbFtUd.exe
  C:\Windows\System\ZWbFtUd.exe
  2⤵
  PID:8052
- C:\Windows\System\LtKNMof.exe
  C:\Windows\System\LtKNMof.exe
  2⤵
  PID:8080
- C:\Windows\System\kaeleoR.exe
  C:\Windows\System\kaeleoR.exe
  2⤵
  PID:8096
- C:\Windows\System\htDHpEZ.exe
  C:\Windows\System\htDHpEZ.exe
  2⤵
  PID:8116
- C:\Windows\System\QEIOkeY.exe
  C:\Windows\System\QEIOkeY.exe
  2⤵
  PID:8140
- C:\Windows\System\UQhaTPl.exe
  C:\Windows\System\UQhaTPl.exe
  2⤵
  PID:8156
- C:\Windows\System\OmodEaG.exe
  C:\Windows\System\OmodEaG.exe
  2⤵
  PID:8184
- C:\Windows\System\iuhWOjx.exe
  C:\Windows\System\iuhWOjx.exe
  2⤵
  PID:6920
- C:\Windows\System\TzttCkG.exe
  C:\Windows\System\TzttCkG.exe
  2⤵
  PID:5796
- C:\Windows\System\ClGxyRI.exe
  C:\Windows\System\ClGxyRI.exe
  2⤵
  PID:6020
- C:\Windows\System\MJNSdBG.exe
  C:\Windows\System\MJNSdBG.exe
  2⤵
  PID:964
- C:\Windows\System\LqgwhVL.exe
  C:\Windows\System\LqgwhVL.exe
  2⤵
  PID:7116
- C:\Windows\System\ftILYuf.exe
  C:\Windows\System\ftILYuf.exe
  2⤵
  PID:7132
- C:\Windows\System\CxASjyr.exe
  C:\Windows\System\CxASjyr.exe
  2⤵
  PID:4684
- C:\Windows\System\sYnGVsw.exe
  C:\Windows\System\sYnGVsw.exe
  2⤵
  PID:1064
- C:\Windows\System\ckzdENU.exe
  C:\Windows\System\ckzdENU.exe
  2⤵
  PID:6188
- C:\Windows\System\WJRlvml.exe
  C:\Windows\System\WJRlvml.exe
  2⤵
  PID:6340
- C:\Windows\System\lPRQgst.exe
  C:\Windows\System\lPRQgst.exe
  2⤵
  PID:6452
- C:\Windows\System\tDXabrT.exe
  C:\Windows\System\tDXabrT.exe
  2⤵
  PID:436
- C:\Windows\System\LqtTbAT.exe
  C:\Windows\System\LqtTbAT.exe
  2⤵
  PID:1360
- C:\Windows\System\FPfavDu.exe
  C:\Windows\System\FPfavDu.exe
  2⤵
  PID:2448
- C:\Windows\System\VIElIBS.exe
  C:\Windows\System\VIElIBS.exe
  2⤵
  PID:6780
- C:\Windows\System\QKWyeHQ.exe
  C:\Windows\System\QKWyeHQ.exe
  2⤵
  PID:7080
- C:\Windows\System\XhHzCKF.exe
  C:\Windows\System\XhHzCKF.exe
  2⤵
  PID:5888
- C:\Windows\System\sWtRMmj.exe
  C:\Windows\System\sWtRMmj.exe
  2⤵
  PID:7200
- C:\Windows\System\xvtXTsU.exe
  C:\Windows\System\xvtXTsU.exe
  2⤵
  PID:7272
- C:\Windows\System\TZwchQG.exe
  C:\Windows\System\TZwchQG.exe
  2⤵
  PID:6832
- C:\Windows\System\nketIkC.exe
  C:\Windows\System\nketIkC.exe
  2⤵
  PID:7300
- C:\Windows\System\cdqOacw.exe
  C:\Windows\System\cdqOacw.exe
  2⤵
  PID:7360
- C:\Windows\System\mjWMglt.exe
  C:\Windows\System\mjWMglt.exe
  2⤵
  PID:6852
- C:\Windows\System\tAkbKVo.exe
  C:\Windows\System\tAkbKVo.exe
  2⤵
  PID:6868
- C:\Windows\System\KgGUqtM.exe
  C:\Windows\System\KgGUqtM.exe
  2⤵
  PID:5792
- C:\Windows\System\XejnJOO.exe
  C:\Windows\System\XejnJOO.exe
  2⤵
  PID:7476
- C:\Windows\System\fPhOgSE.exe
  C:\Windows\System\fPhOgSE.exe
  2⤵
  PID:5912
- C:\Windows\System\ZmSScbo.exe
  C:\Windows\System\ZmSScbo.exe
  2⤵
  PID:7516
- C:\Windows\System\uufQWiI.exe
  C:\Windows\System\uufQWiI.exe
  2⤵
  PID:7548
- C:\Windows\System\LJtJTwG.exe
  C:\Windows\System\LJtJTwG.exe
  2⤵
  PID:6048
- C:\Windows\System\dCeXmvX.exe
  C:\Windows\System\dCeXmvX.exe
  2⤵
  PID:7600
- C:\Windows\System\KvEwGaT.exe
  C:\Windows\System\KvEwGaT.exe
  2⤵
  PID:7636
- C:\Windows\System\cnIqRQs.exe
  C:\Windows\System\cnIqRQs.exe
  2⤵
  PID:8196
- C:\Windows\System\DftaOuP.exe
  C:\Windows\System\DftaOuP.exe
  2⤵
  PID:8212
- C:\Windows\System\eTQlmWd.exe
  C:\Windows\System\eTQlmWd.exe
  2⤵
  PID:8236
- C:\Windows\System\WLMZWvN.exe
  C:\Windows\System\WLMZWvN.exe
  2⤵
  PID:8256
- C:\Windows\System\tnunpng.exe
  C:\Windows\System\tnunpng.exe
  2⤵
  PID:8272
- C:\Windows\System\DNpoYEH.exe
  C:\Windows\System\DNpoYEH.exe
  2⤵
  PID:8288
- C:\Windows\System\tlbbueQ.exe
  C:\Windows\System\tlbbueQ.exe
  2⤵
  PID:8304
- C:\Windows\System\IiVNQVE.exe
  C:\Windows\System\IiVNQVE.exe
  2⤵
  PID:8324
- C:\Windows\System\iSgYQBb.exe
  C:\Windows\System\iSgYQBb.exe
  2⤵
  PID:8344
- C:\Windows\System\UKpEEiN.exe
  C:\Windows\System\UKpEEiN.exe
  2⤵
  PID:8360
- C:\Windows\System\DzMFPFd.exe
  C:\Windows\System\DzMFPFd.exe
  2⤵
  PID:8384
- C:\Windows\System\SpuVFWR.exe
  C:\Windows\System\SpuVFWR.exe
  2⤵
  PID:8404
- C:\Windows\System\UmqExXF.exe
  C:\Windows\System\UmqExXF.exe
  2⤵
  PID:8420
- C:\Windows\System\zstHKdl.exe
  C:\Windows\System\zstHKdl.exe
  2⤵
  PID:8436
- C:\Windows\System\pGUXSWm.exe
  C:\Windows\System\pGUXSWm.exe
  2⤵
  PID:8452
- C:\Windows\System\uRelcuR.exe
  C:\Windows\System\uRelcuR.exe
  2⤵
  PID:8468
- C:\Windows\System\XjeCVtj.exe
  C:\Windows\System\XjeCVtj.exe
  2⤵
  PID:8484
- C:\Windows\System\SAMUJvP.exe
  C:\Windows\System\SAMUJvP.exe
  2⤵
  PID:8504
- C:\Windows\System\pQoLdZi.exe
  C:\Windows\System\pQoLdZi.exe
  2⤵
  PID:8520
- C:\Windows\System\mLMGICu.exe
  C:\Windows\System\mLMGICu.exe
  2⤵
  PID:8544
- C:\Windows\System\HZSHPPc.exe
  C:\Windows\System\HZSHPPc.exe
  2⤵
  PID:8560
- C:\Windows\System\AwZEICj.exe
  C:\Windows\System\AwZEICj.exe
  2⤵
  PID:8576
- C:\Windows\System\wjBAYwh.exe
  C:\Windows\System\wjBAYwh.exe
  2⤵
  PID:8596
- C:\Windows\System\zIBdErH.exe
  C:\Windows\System\zIBdErH.exe
  2⤵
  PID:8612
- C:\Windows\System\uUnThnN.exe
  C:\Windows\System\uUnThnN.exe
  2⤵
  PID:8632
- C:\Windows\System\HMJWuyw.exe
  C:\Windows\System\HMJWuyw.exe
  2⤵
  PID:8648
- C:\Windows\System\AnVETvJ.exe
  C:\Windows\System\AnVETvJ.exe
  2⤵
  PID:8664
- C:\Windows\System\GYkVDud.exe
  C:\Windows\System\GYkVDud.exe
  2⤵
  PID:8680
- C:\Windows\System\dVyAsMi.exe
  C:\Windows\System\dVyAsMi.exe
  2⤵
  PID:8696
- C:\Windows\System\ftaXBYY.exe
  C:\Windows\System\ftaXBYY.exe
  2⤵
  PID:8712
- C:\Windows\System\MtFVeqG.exe
  C:\Windows\System\MtFVeqG.exe
  2⤵
  PID:8728
- C:\Windows\System\LmJdQRv.exe
  C:\Windows\System\LmJdQRv.exe
  2⤵
  PID:8744
- C:\Windows\System\mZbLbDJ.exe
  C:\Windows\System\mZbLbDJ.exe
  2⤵
  PID:8760
- C:\Windows\System\sYnqeVI.exe
  C:\Windows\System\sYnqeVI.exe
  2⤵
  PID:8776
- C:\Windows\System\PJXvKvR.exe
  C:\Windows\System\PJXvKvR.exe
  2⤵
  PID:8792
- C:\Windows\System\MBXOhui.exe
  C:\Windows\System\MBXOhui.exe
  2⤵
  PID:8808
- C:\Windows\System\NWffmBW.exe
  C:\Windows\System\NWffmBW.exe
  2⤵
  PID:8824
- C:\Windows\System\WOyTnoG.exe
  C:\Windows\System\WOyTnoG.exe
  2⤵
  PID:8840
- C:\Windows\System\TYiSjtW.exe
  C:\Windows\System\TYiSjtW.exe
  2⤵
  PID:8864
- C:\Windows\System\kZEzWdA.exe
  C:\Windows\System\kZEzWdA.exe
  2⤵
  PID:8880
- C:\Windows\System\uMcrFmS.exe
  C:\Windows\System\uMcrFmS.exe
  2⤵
  PID:8896
- C:\Windows\System\KokqwSk.exe
  C:\Windows\System\KokqwSk.exe
  2⤵
  PID:8912
- C:\Windows\System\DMuOrnP.exe
  C:\Windows\System\DMuOrnP.exe
  2⤵
  PID:8928
- C:\Windows\System\jNyAOiq.exe
  C:\Windows\System\jNyAOiq.exe
  2⤵
  PID:8944
- C:\Windows\System\GMzpyiY.exe
  C:\Windows\System\GMzpyiY.exe
  2⤵
  PID:8960
- C:\Windows\System\vFZbWvo.exe
  C:\Windows\System\vFZbWvo.exe
  2⤵
  PID:8976
- C:\Windows\System\BTDLngm.exe
  C:\Windows\System\BTDLngm.exe
  2⤵
  PID:8992
- C:\Windows\System\CBIMLem.exe
  C:\Windows\System\CBIMLem.exe
  2⤵
  PID:9008
- C:\Windows\System\txswsTO.exe
  C:\Windows\System\txswsTO.exe
  2⤵
  PID:9024
- C:\Windows\System\AWqVDQV.exe
  C:\Windows\System\AWqVDQV.exe
  2⤵
  PID:9040
- C:\Windows\System\oLAIgPm.exe
  C:\Windows\System\oLAIgPm.exe
  2⤵
  PID:9056
- C:\Windows\System\IezwEyy.exe
  C:\Windows\System\IezwEyy.exe
  2⤵
  PID:9072
- C:\Windows\System\SdysJql.exe
  C:\Windows\System\SdysJql.exe
  2⤵
  PID:9088
- C:\Windows\System\VWquxQJ.exe
  C:\Windows\System\VWquxQJ.exe
  2⤵
  PID:9104
- C:\Windows\System\bjYEKBU.exe
  C:\Windows\System\bjYEKBU.exe
  2⤵
  PID:9120
- C:\Windows\System\IpvLNzx.exe
  C:\Windows\System\IpvLNzx.exe
  2⤵
  PID:9136
- C:\Windows\System\ejMgWJq.exe
  C:\Windows\System\ejMgWJq.exe
  2⤵
  PID:9152
- C:\Windows\System\aEJinZL.exe
  C:\Windows\System\aEJinZL.exe
  2⤵
  PID:9168
- C:\Windows\System\AROQMMA.exe
  C:\Windows\System\AROQMMA.exe
  2⤵
  PID:9184
- C:\Windows\System\mhqqIIc.exe
  C:\Windows\System\mhqqIIc.exe
  2⤵
  PID:9200
- C:\Windows\System\kwsFfxp.exe
  C:\Windows\System\kwsFfxp.exe
  2⤵
  PID:7688
- C:\Windows\System\zDYCmcx.exe
  C:\Windows\System\zDYCmcx.exe
  2⤵
  PID:1052
- C:\Windows\System\WSKJiYj.exe
  C:\Windows\System\WSKJiYj.exe
  2⤵
  PID:7780
- C:\Windows\System\QvjzxvP.exe
  C:\Windows\System\QvjzxvP.exe
  2⤵
  PID:5456
- C:\Windows\System\fJGJCME.exe
  C:\Windows\System\fJGJCME.exe
  2⤵
  PID:7816
- C:\Windows\System\RuNLJed.exe
  C:\Windows\System\RuNLJed.exe
  2⤵
  PID:6220
- C:\Windows\System\WSwQKYG.exe
  C:\Windows\System\WSwQKYG.exe
  2⤵
  PID:7908
- C:\Windows\System\yfOTTRm.exe
  C:\Windows\System\yfOTTRm.exe
  2⤵
  PID:2880
- C:\Windows\System\zHxkfxd.exe
  C:\Windows\System\zHxkfxd.exe
  2⤵
  PID:3064
- C:\Windows\System\VgOynOf.exe
  C:\Windows\System\VgOynOf.exe
  2⤵
  PID:8044
- C:\Windows\System\ReEodgP.exe
  C:\Windows\System\ReEodgP.exe
  2⤵
  PID:8112
- C:\Windows\System\fuxrhSh.exe
  C:\Windows\System\fuxrhSh.exe
  2⤵
  PID:3308
- C:\Windows\System\RSSNbIT.exe
  C:\Windows\System\RSSNbIT.exe
  2⤵
  PID:8152
- C:\Windows\System\sFoDizi.exe
  C:\Windows\System\sFoDizi.exe
  2⤵
  PID:6472
- C:\Windows\System\lFDCbKh.exe
  C:\Windows\System\lFDCbKh.exe
  2⤵
  PID:6944
- C:\Windows\System\iJfooLD.exe
  C:\Windows\System\iJfooLD.exe
  2⤵
  PID:7056
- C:\Windows\System\hrGOHQP.exe
  C:\Windows\System\hrGOHQP.exe
  2⤵
  PID:2712
- C:\Windows\System\eDnXQvd.exe
  C:\Windows\System\eDnXQvd.exe
  2⤵
  PID:1972
- C:\Windows\System\VpXbzGY.exe
  C:\Windows\System\VpXbzGY.exe
  2⤵
  PID:3492
- C:\Windows\System\Zhmvjbp.exe
  C:\Windows\System\Zhmvjbp.exe
  2⤵
  PID:5372
- C:\Windows\System\NiCQHSZ.exe
  C:\Windows\System\NiCQHSZ.exe
  2⤵
  PID:6272
- C:\Windows\System\dLwkngk.exe
  C:\Windows\System\dLwkngk.exe
  2⤵
  PID:5160
- C:\Windows\System\LEfReMl.exe
  C:\Windows\System\LEfReMl.exe
  2⤵
  PID:6856
- C:\Windows\System\EwwEBFi.exe
  C:\Windows\System\EwwEBFi.exe
  2⤵
  PID:5596
- C:\Windows\System\yKTQcWB.exe
  C:\Windows\System\yKTQcWB.exe
  2⤵
  PID:6824
- C:\Windows\System\MvZyvWM.exe
  C:\Windows\System\MvZyvWM.exe
  2⤵
  PID:5716
- C:\Windows\System\fMSDhnj.exe
  C:\Windows\System\fMSDhnj.exe
  2⤵
  PID:7420
- C:\Windows\System\MkoCPlW.exe
  C:\Windows\System\MkoCPlW.exe
  2⤵
  PID:7344
- C:\Windows\System\yFHSjCS.exe
  C:\Windows\System\yFHSjCS.exe
  2⤵
  PID:5892
- C:\Windows\System\WWbzVPD.exe
  C:\Windows\System\WWbzVPD.exe
  2⤵
  PID:1476
- C:\Windows\System\WiEWhnP.exe
  C:\Windows\System\WiEWhnP.exe
  2⤵
  PID:7684
- C:\Windows\System\VRjBuCx.exe
  C:\Windows\System\VRjBuCx.exe
  2⤵
  PID:7960
- C:\Windows\System\CFCVUFx.exe
  C:\Windows\System\CFCVUFx.exe
  2⤵
  PID:8024
- C:\Windows\System\ArLWOuJ.exe
  C:\Windows\System\ArLWOuJ.exe
  2⤵
  PID:8060
- C:\Windows\System\pdiFqHn.exe
  C:\Windows\System\pdiFqHn.exe
  2⤵
  PID:8088
- C:\Windows\System\NHZHVYu.exe
  C:\Windows\System\NHZHVYu.exe
  2⤵
  PID:8432
- C:\Windows\System\gqELEzu.exe
  C:\Windows\System\gqELEzu.exe
  2⤵
  PID:8464
- C:\Windows\System\coNIoxO.exe
  C:\Windows\System\coNIoxO.exe
  2⤵
  PID:5264
- C:\Windows\System\OzGjGFX.exe
  C:\Windows\System\OzGjGFX.exe
  2⤵
  PID:4420
- C:\Windows\System\cqKHrZI.exe
  C:\Windows\System\cqKHrZI.exe
  2⤵
  PID:5740
- C:\Windows\System\nryWtjJ.exe
  C:\Windows\System\nryWtjJ.exe
  2⤵
  PID:7492
- C:\Windows\System\jwaypXL.exe
  C:\Windows\System\jwaypXL.exe
  2⤵
  PID:7592
- C:\Windows\System\pnxzlql.exe
  C:\Windows\System\pnxzlql.exe
  2⤵
  PID:8724
- C:\Windows\System\bzvKAyi.exe
  C:\Windows\System\bzvKAyi.exe
  2⤵
  PID:7724
- C:\Windows\System\jlbrezV.exe
  C:\Windows\System\jlbrezV.exe
  2⤵
  PID:8244
- C:\Windows\System\eSwPeor.exe
  C:\Windows\System\eSwPeor.exe
  2⤵
  PID:7844
- C:\Windows\System\rPfWFPN.exe
  C:\Windows\System\rPfWFPN.exe
  2⤵
  PID:2936
- C:\Windows\System\qaFckWE.exe
  C:\Windows\System\qaFckWE.exe
  2⤵
  PID:8768
- C:\Windows\System\pOmInyZ.exe
  C:\Windows\System\pOmInyZ.exe
  2⤵
  PID:1184
- C:\Windows\System\IhdXGME.exe
  C:\Windows\System\IhdXGME.exe
  2⤵
  PID:8856
- C:\Windows\System\xOvtJsY.exe
  C:\Windows\System\xOvtJsY.exe
  2⤵
  PID:8888
- C:\Windows\System\fCChnhp.exe
  C:\Windows\System\fCChnhp.exe
  2⤵
  PID:8476
- C:\Windows\System\CCnDycA.exe
  C:\Windows\System\CCnDycA.exe
  2⤵
  PID:8516
- C:\Windows\System\EyZOEMJ.exe
  C:\Windows\System\EyZOEMJ.exe
  2⤵
  PID:4452
- C:\Windows\System\OpezKKK.exe
  C:\Windows\System\OpezKKK.exe
  2⤵
  PID:7216
- C:\Windows\System\djktKPU.exe
  C:\Windows\System\djktKPU.exe
  2⤵
  PID:5660
- C:\Windows\System\hPrcDWQ.exe
  C:\Windows\System\hPrcDWQ.exe
  2⤵
  PID:8940
- C:\Windows\System\lYeAdzr.exe
  C:\Windows\System\lYeAdzr.exe
  2⤵
  PID:8988
- C:\Windows\System\EesQnyd.exe
  C:\Windows\System\EesQnyd.exe
  2⤵
  PID:9020
- C:\Windows\System\IoZGrFI.exe
  C:\Windows\System\IoZGrFI.exe
  2⤵
  PID:9068
- C:\Windows\System\wICSbeh.exe
  C:\Windows\System\wICSbeh.exe
  2⤵
  PID:8848
- C:\Windows\System\UVIefbP.exe
  C:\Windows\System\UVIefbP.exe
  2⤵
  PID:8872
- C:\Windows\System\cxTCFFB.exe
  C:\Windows\System\cxTCFFB.exe
  2⤵
  PID:9148
- C:\Windows\System\DtUeCPH.exe
  C:\Windows\System\DtUeCPH.exe
  2⤵
  PID:8592
- C:\Windows\System\fmDLexI.exe
  C:\Windows\System\fmDLexI.exe
  2⤵
  PID:9192
- C:\Windows\System\FqGINwN.exe
  C:\Windows\System\FqGINwN.exe
  2⤵
  PID:9064
- C:\Windows\System\TdLjTmx.exe
  C:\Windows\System\TdLjTmx.exe
  2⤵
  PID:8952
- C:\Windows\System\YZIVMkd.exe
  C:\Windows\System\YZIVMkd.exe
  2⤵
  PID:4484
- C:\Windows\System\MpuKnIK.exe
  C:\Windows\System\MpuKnIK.exe
  2⤵
  PID:5848
- C:\Windows\System\coWxqUK.exe
  C:\Windows\System\coWxqUK.exe
  2⤵
  PID:3740
- C:\Windows\System\sXrJKiF.exe
  C:\Windows\System\sXrJKiF.exe
  2⤵
  PID:7860
- C:\Windows\System\PnKySha.exe
  C:\Windows\System\PnKySha.exe
  2⤵
  PID:7936
- C:\Windows\System\NwqWjTF.exe
  C:\Windows\System\NwqWjTF.exe
  2⤵
  PID:6980
- C:\Windows\System\FCnHFFc.exe
  C:\Windows\System\FCnHFFc.exe
  2⤵
  PID:5324
- C:\Windows\System\ofBJKHZ.exe
  C:\Windows\System\ofBJKHZ.exe
  2⤵
  PID:3928
- C:\Windows\System\YQzXjuj.exe
  C:\Windows\System\YQzXjuj.exe
  2⤵
  PID:7044
- C:\Windows\System\HZnQJic.exe
  C:\Windows\System\HZnQJic.exe
  2⤵
  PID:9228
- C:\Windows\System\nTlXVSy.exe
  C:\Windows\System\nTlXVSy.exe
  2⤵
  PID:9248
- C:\Windows\System\uttmAMz.exe
  C:\Windows\System\uttmAMz.exe
  2⤵
  PID:9276
- C:\Windows\System\rkhzsnZ.exe
  C:\Windows\System\rkhzsnZ.exe
  2⤵
  PID:9300
- C:\Windows\System\aendOCf.exe
  C:\Windows\System\aendOCf.exe
  2⤵
  PID:9320
- C:\Windows\System\kkRjdZH.exe
  C:\Windows\System\kkRjdZH.exe
  2⤵
  PID:9344
- C:\Windows\System\ZHYPmHE.exe
  C:\Windows\System\ZHYPmHE.exe
  2⤵
  PID:9372
- C:\Windows\System\fPJrpYn.exe
  C:\Windows\System\fPJrpYn.exe
  2⤵
  PID:9388
- C:\Windows\System\kCOlVaQ.exe
  C:\Windows\System\kCOlVaQ.exe
  2⤵
  PID:9404
- C:\Windows\System\nZCyCno.exe
  C:\Windows\System\nZCyCno.exe
  2⤵
  PID:9428
- C:\Windows\System\cdxODjF.exe
  C:\Windows\System\cdxODjF.exe
  2⤵
  PID:9448
- C:\Windows\System\tRFPcvv.exe
  C:\Windows\System\tRFPcvv.exe
  2⤵
  PID:9472
- C:\Windows\System\VLoeIuJ.exe
  C:\Windows\System\VLoeIuJ.exe
  2⤵
  PID:9496
- C:\Windows\System\DlQOONC.exe
  C:\Windows\System\DlQOONC.exe
  2⤵
  PID:9512
- C:\Windows\System\qtIQIPL.exe
  C:\Windows\System\qtIQIPL.exe
  2⤵
  PID:9532
- C:\Windows\System\cWGXeil.exe
  C:\Windows\System\cWGXeil.exe
  2⤵
  PID:9560
- C:\Windows\System\JKWMqYo.exe
  C:\Windows\System\JKWMqYo.exe
  2⤵
  PID:9576
- C:\Windows\System\hnLimlx.exe
  C:\Windows\System\hnLimlx.exe
  2⤵
  PID:9596
- C:\Windows\System\DLGvLOS.exe
  C:\Windows\System\DLGvLOS.exe
  2⤵
  PID:9624
- C:\Windows\System\onMSDzv.exe
  C:\Windows\System\onMSDzv.exe
  2⤵
  PID:9640
- C:\Windows\System\XREDSMl.exe
  C:\Windows\System\XREDSMl.exe
  2⤵
  PID:9664
- C:\Windows\System\XbyUDAI.exe
  C:\Windows\System\XbyUDAI.exe
  2⤵
  PID:9684
- C:\Windows\System\uoXKliw.exe
  C:\Windows\System\uoXKliw.exe
  2⤵
  PID:9700
- C:\Windows\System\GuYQyua.exe
  C:\Windows\System\GuYQyua.exe
  2⤵
  PID:9724
- C:\Windows\System\URwJxLc.exe
  C:\Windows\System\URwJxLc.exe
  2⤵
  PID:9748
- C:\Windows\System\cglvAeX.exe
  C:\Windows\System\cglvAeX.exe
  2⤵
  PID:9772
- C:\Windows\System\PuBKWvr.exe
  C:\Windows\System\PuBKWvr.exe
  2⤵
  PID:9792
- C:\Windows\System\Rpqoneq.exe
  C:\Windows\System\Rpqoneq.exe
  2⤵
  PID:9812
- C:\Windows\System\NefCuKb.exe
  C:\Windows\System\NefCuKb.exe
  2⤵
  PID:9832
- C:\Windows\System\OsCIsls.exe
  C:\Windows\System\OsCIsls.exe
  2⤵
  PID:9852
- C:\Windows\System\aqBtxQD.exe
  C:\Windows\System\aqBtxQD.exe
  2⤵
  PID:9876
- C:\Windows\System\jICoyCJ.exe
  C:\Windows\System\jICoyCJ.exe
  2⤵
  PID:9896
- C:\Windows\System\JdqtyXp.exe
  C:\Windows\System\JdqtyXp.exe
  2⤵
  PID:9916
- C:\Windows\System\dIRGPvA.exe
  C:\Windows\System\dIRGPvA.exe
  2⤵
  PID:9940
- C:\Windows\System\BnqWIhV.exe
  C:\Windows\System\BnqWIhV.exe
  2⤵
  PID:9956
- C:\Windows\System\VLWHUgm.exe
  C:\Windows\System\VLWHUgm.exe
  2⤵
  PID:9980
- C:\Windows\System\oohzKAB.exe
  C:\Windows\System\oohzKAB.exe
  2⤵
  PID:10004
- C:\Windows\System\zmRaRzo.exe
  C:\Windows\System\zmRaRzo.exe
  2⤵
  PID:10020
- C:\Windows\System\FYNYJfK.exe
  C:\Windows\System\FYNYJfK.exe
  2⤵
  PID:10044
- C:\Windows\System\hwLhdoV.exe
  C:\Windows\System\hwLhdoV.exe
  2⤵
  PID:10068
- C:\Windows\System\MyCmkds.exe
  C:\Windows\System\MyCmkds.exe
  2⤵
  PID:10088
- C:\Windows\System\ZiJoqxV.exe
  C:\Windows\System\ZiJoqxV.exe
  2⤵
  PID:10108
- C:\Windows\System\dJrWrtH.exe
  C:\Windows\System\dJrWrtH.exe
  2⤵
  PID:10132
- C:\Windows\System\PsZGapW.exe
  C:\Windows\System\PsZGapW.exe
  2⤵
  PID:10152
- C:\Windows\System\drKYDzt.exe
  C:\Windows\System\drKYDzt.exe
  2⤵
  PID:10176
- C:\Windows\System\CZcSwmy.exe
  C:\Windows\System\CZcSwmy.exe
  2⤵
  PID:10196
- C:\Windows\System\FslEmxK.exe
  C:\Windows\System\FslEmxK.exe
  2⤵
  PID:10220
- C:\Windows\System\fpuYOip.exe
  C:\Windows\System\fpuYOip.exe
  2⤵
  PID:10244
- C:\Windows\System\TTWbsiC.exe
  C:\Windows\System\TTWbsiC.exe
  2⤵
  PID:10264
- C:\Windows\System\TDsGttD.exe
  C:\Windows\System\TDsGttD.exe
  2⤵
  PID:10284
- C:\Windows\System\OXKyRuT.exe
  C:\Windows\System\OXKyRuT.exe
  2⤵
  PID:10308
- C:\Windows\System\EHTPKDd.exe
  C:\Windows\System\EHTPKDd.exe
  2⤵
  PID:10328
- C:\Windows\System\uXnhYvP.exe
  C:\Windows\System\uXnhYvP.exe
  2⤵
  PID:10348
- C:\Windows\System\erAyBPO.exe
  C:\Windows\System\erAyBPO.exe
  2⤵
  PID:10372
- C:\Windows\System\IRGSLVP.exe
  C:\Windows\System\IRGSLVP.exe
  2⤵
  PID:10396
- C:\Windows\System\tpcZTUv.exe
  C:\Windows\System\tpcZTUv.exe
  2⤵
  PID:10420
- C:\Windows\System\XnOCkvl.exe
  C:\Windows\System\XnOCkvl.exe
  2⤵
  PID:10440
- C:\Windows\System\GexcKkj.exe
  C:\Windows\System\GexcKkj.exe
  2⤵
  PID:10460
- C:\Windows\System\EBlVykl.exe
  C:\Windows\System\EBlVykl.exe
  2⤵
  PID:10484
- C:\Windows\System\jvitDvp.exe
  C:\Windows\System\jvitDvp.exe
  2⤵
  PID:10504
- C:\Windows\System\vvHYFMV.exe
  C:\Windows\System\vvHYFMV.exe
  2⤵
  PID:10524
- C:\Windows\System\LoWmQSf.exe
  C:\Windows\System\LoWmQSf.exe
  2⤵
  PID:10548
- C:\Windows\System\fMgnBom.exe
  C:\Windows\System\fMgnBom.exe
  2⤵
  PID:10564
- C:\Windows\System\oLSTxqf.exe
  C:\Windows\System\oLSTxqf.exe
  2⤵
  PID:10588
- C:\Windows\System\ulnWckX.exe
  C:\Windows\System\ulnWckX.exe
  2⤵
  PID:10604
- C:\Windows\System\DZSXLOR.exe
  C:\Windows\System\DZSXLOR.exe
  2⤵
  PID:10628
- C:\Windows\System\qeqBBQR.exe
  C:\Windows\System\qeqBBQR.exe
  2⤵
  PID:10648
- C:\Windows\System\obIgzPy.exe
  C:\Windows\System\obIgzPy.exe
  2⤵
  PID:10664
- C:\Windows\System\nStRsPi.exe
  C:\Windows\System\nStRsPi.exe
  2⤵
  PID:10684
- C:\Windows\System\IyHZyCn.exe
  C:\Windows\System\IyHZyCn.exe
  2⤵
  PID:10732
- C:\Windows\System\RtaITin.exe
  C:\Windows\System\RtaITin.exe
  2⤵
  PID:10776
- C:\Windows\System\WSHeJIm.exe
  C:\Windows\System\WSHeJIm.exe
  2⤵
  PID:10792
- C:\Windows\System\ecUZLrw.exe
  C:\Windows\System\ecUZLrw.exe
  2⤵
  PID:10820
- C:\Windows\System\KvMMMbj.exe
  C:\Windows\System\KvMMMbj.exe
  2⤵
  PID:10836
- C:\Windows\System\bLCqBhW.exe
  C:\Windows\System\bLCqBhW.exe
  2⤵
  PID:10860
- C:\Windows\System\jJfeZFi.exe
  C:\Windows\System\jJfeZFi.exe
  2⤵
  PID:10876
- C:\Windows\System\UMfkVok.exe
  C:\Windows\System\UMfkVok.exe
  2⤵
  PID:10900
- C:\Windows\System\UcnAOjy.exe
  C:\Windows\System\UcnAOjy.exe
  2⤵
  PID:10924
- C:\Windows\System\WZzNGIA.exe
  C:\Windows\System\WZzNGIA.exe
  2⤵
  PID:10944
- C:\Windows\System\SCSRNbS.exe
  C:\Windows\System\SCSRNbS.exe
  2⤵
  PID:10964
- C:\Windows\System\iqgcNyr.exe
  C:\Windows\System\iqgcNyr.exe
  2⤵
  PID:10988
- C:\Windows\System\gEwwJwt.exe
  C:\Windows\System\gEwwJwt.exe
  2⤵
  PID:11012
- C:\Windows\System\hCXmuQz.exe
  C:\Windows\System\hCXmuQz.exe
  2⤵
  PID:11028
- C:\Windows\System\fTVrfHB.exe
  C:\Windows\System\fTVrfHB.exe
  2⤵
  PID:11052
- C:\Windows\System\gASijlP.exe
  C:\Windows\System\gASijlP.exe
  2⤵
  PID:11076
- C:\Windows\System\hllBFSX.exe
  C:\Windows\System\hllBFSX.exe
  2⤵
  PID:11096
- C:\Windows\System\zDzTVnX.exe
  C:\Windows\System\zDzTVnX.exe
  2⤵
  PID:11124
- C:\Windows\System\duKbHQb.exe
  C:\Windows\System\duKbHQb.exe
  2⤵
  PID:11144
- C:\Windows\System\iiriCCn.exe
  C:\Windows\System\iiriCCn.exe
  2⤵
  PID:11160
- C:\Windows\System\JgeCToH.exe
  C:\Windows\System\JgeCToH.exe
  2⤵
  PID:11176
- C:\Windows\System\mLajHcn.exe
  C:\Windows\System\mLajHcn.exe
  2⤵
  PID:11200
- C:\Windows\System\mpjBCUX.exe
  C:\Windows\System\mpjBCUX.exe
  2⤵
  PID:11216
- C:\Windows\System\zOdDVwf.exe
  C:\Windows\System\zOdDVwf.exe
  2⤵
  PID:11240
- C:\Windows\System\wihcSyv.exe
  C:\Windows\System\wihcSyv.exe
  2⤵
  PID:11260
- C:\Windows\System\XVbzjMo.exe
  C:\Windows\System\XVbzjMo.exe
  2⤵
  PID:7340
- C:\Windows\System\iebYAqB.exe
  C:\Windows\System\iebYAqB.exe
  2⤵
  PID:5684
- C:\Windows\System\qGcSXHa.exe
  C:\Windows\System\qGcSXHa.exe
  2⤵
  PID:11432
- C:\Windows\System\RuPMmIN.exe
  C:\Windows\System\RuPMmIN.exe
  2⤵
  PID:11460
- C:\Windows\System\FJJQWYC.exe
  C:\Windows\System\FJJQWYC.exe
  2⤵
  PID:11480
- C:\Windows\System\EsrEyEr.exe
  C:\Windows\System\EsrEyEr.exe
  2⤵
  PID:11500
- C:\Windows\System\DdaLvDM.exe
  C:\Windows\System\DdaLvDM.exe
  2⤵
  PID:11520
- C:\Windows\System\IhDfMmm.exe
  C:\Windows\System\IhDfMmm.exe
  2⤵
  PID:11544
- C:\Windows\System\lePbcjD.exe
  C:\Windows\System\lePbcjD.exe
  2⤵
  PID:11560
- C:\Windows\System\uAanmGP.exe
  C:\Windows\System\uAanmGP.exe
  2⤵
  PID:11584
- C:\Windows\System\dSASeYg.exe
  C:\Windows\System\dSASeYg.exe
  2⤵
  PID:11612
- C:\Windows\System\yWqqLwj.exe
  C:\Windows\System\yWqqLwj.exe
  2⤵
  PID:11632
- C:\Windows\System\XOkbErg.exe
  C:\Windows\System\XOkbErg.exe
  2⤵
  PID:11652
- C:\Windows\System\JMEgsYu.exe
  C:\Windows\System\JMEgsYu.exe
  2⤵
  PID:11676
- C:\Windows\System\IIdAuVW.exe
  C:\Windows\System\IIdAuVW.exe
  2⤵
  PID:11696
- C:\Windows\System\azSCYca.exe
  C:\Windows\System\azSCYca.exe
  2⤵
  PID:11720
- C:\Windows\System\XnypyFd.exe
  C:\Windows\System\XnypyFd.exe
  2⤵
  PID:11744
- C:\Windows\System\IsnMNPi.exe
  C:\Windows\System\IsnMNPi.exe
  2⤵
  PID:11764
- C:\Windows\System\GfqXplH.exe
  C:\Windows\System\GfqXplH.exe
  2⤵
  PID:11788
- C:\Windows\System\qfGXemh.exe
  C:\Windows\System\qfGXemh.exe
  2⤵
  PID:11808
- C:\Windows\System\RGhkaKy.exe
  C:\Windows\System\RGhkaKy.exe
  2⤵
  PID:11832
- C:\Windows\System\xqfdxVL.exe
  C:\Windows\System\xqfdxVL.exe
  2⤵
  PID:11852
- C:\Windows\System\hQlgYyV.exe
  C:\Windows\System\hQlgYyV.exe
  2⤵
  PID:11876
- C:\Windows\System\odUaAjU.exe
  C:\Windows\System\odUaAjU.exe
  2⤵
  PID:11892
- C:\Windows\System\JcqiRCo.exe
  C:\Windows\System\JcqiRCo.exe
  2⤵
  PID:11916
- C:\Windows\System\aiQYGsX.exe
  C:\Windows\System\aiQYGsX.exe
  2⤵
  PID:11940
- C:\Windows\System\YiIwyeh.exe
  C:\Windows\System\YiIwyeh.exe
  2⤵
  PID:11960
- C:\Windows\System\lnwTfKm.exe
  C:\Windows\System\lnwTfKm.exe
  2⤵
  PID:11980
- C:\Windows\System\aIGUvRK.exe
  C:\Windows\System\aIGUvRK.exe
  2⤵
  PID:12004
- C:\Windows\System\oigtbGo.exe
  C:\Windows\System\oigtbGo.exe
  2⤵
  PID:12028
- C:\Windows\System\qLmLdeL.exe
  C:\Windows\System\qLmLdeL.exe
  2⤵
  PID:12048
- C:\Windows\System\EUFjvIq.exe
  C:\Windows\System\EUFjvIq.exe
  2⤵
  PID:12072
- C:\Windows\System\vEAZqnr.exe
  C:\Windows\System\vEAZqnr.exe
  2⤵
  PID:12092
- C:\Windows\System\doDJjuD.exe
  C:\Windows\System\doDJjuD.exe
  2⤵
  PID:12112
- C:\Windows\System\AbnebeT.exe
  C:\Windows\System\AbnebeT.exe
  2⤵
  PID:12136
- C:\Windows\System\HvVtXIX.exe
  C:\Windows\System\HvVtXIX.exe
  2⤵
  PID:12160
- C:\Windows\System\nQnSJdk.exe
  C:\Windows\System\nQnSJdk.exe
  2⤵
  PID:12180
- C:\Windows\System\hxsUwyy.exe
  C:\Windows\System\hxsUwyy.exe
  2⤵
  PID:12204
- C:\Windows\System\gdBZxdB.exe
  C:\Windows\System\gdBZxdB.exe
  2⤵
  PID:12232
- C:\Windows\System\yxDiAff.exe
  C:\Windows\System\yxDiAff.exe
  2⤵
  PID:12256
- C:\Windows\System\pzVejrC.exe
  C:\Windows\System\pzVejrC.exe
  2⤵
  PID:12276
- C:\Windows\System\UesrMYN.exe
  C:\Windows\System\UesrMYN.exe
  2⤵
  PID:12296
- C:\Windows\System\BIBnheF.exe
  C:\Windows\System\BIBnheF.exe
  2⤵
  PID:12312
- C:\Windows\System\hkAOYgt.exe
  C:\Windows\System\hkAOYgt.exe
  2⤵
  PID:12336
- C:\Windows\System\bnysSbt.exe
  C:\Windows\System\bnysSbt.exe
  2⤵
  PID:12356
- C:\Windows\System\xlOboio.exe
  C:\Windows\System\xlOboio.exe
  2⤵
  PID:12376
- C:\Windows\System\AMLzxna.exe
  C:\Windows\System\AMLzxna.exe
  2⤵
  PID:12400
- C:\Windows\System\vlUSiGy.exe
  C:\Windows\System\vlUSiGy.exe
  2⤵
  PID:12420
- C:\Windows\System\FBPymXz.exe
  C:\Windows\System\FBPymXz.exe
  2⤵
  PID:12440
- C:\Windows\System\ybefbIU.exe
  C:\Windows\System\ybefbIU.exe
  2⤵
  PID:12464
- C:\Windows\System\NPJwQcH.exe
  C:\Windows\System\NPJwQcH.exe
  2⤵
  PID:12484
- C:\Windows\System\rEGQXFt.exe
  C:\Windows\System\rEGQXFt.exe
  2⤵
  PID:12504
- C:\Windows\System\eiHQJzN.exe
  C:\Windows\System\eiHQJzN.exe
  2⤵
  PID:12528
- C:\Windows\System\mkkFEoK.exe
  C:\Windows\System\mkkFEoK.exe
  2⤵
  PID:12552
- C:\Windows\System\ljGlCvE.exe
  C:\Windows\System\ljGlCvE.exe
  2⤵
  PID:12572
- C:\Windows\System\IszMayP.exe
  C:\Windows\System\IszMayP.exe
  2⤵
  PID:12588
- C:\Windows\System\xunBoFZ.exe
  C:\Windows\System\xunBoFZ.exe
  2⤵
  PID:12608
- C:\Windows\System\SNLKQyh.exe
  C:\Windows\System\SNLKQyh.exe
  2⤵
  PID:12624
- C:\Windows\System\GwBGPog.exe
  C:\Windows\System\GwBGPog.exe
  2⤵
  PID:12640
- C:\Windows\System\ubkJvIC.exe
  C:\Windows\System\ubkJvIC.exe
  2⤵
  PID:12656
- C:\Windows\System\oJPrfhV.exe
  C:\Windows\System\oJPrfhV.exe
  2⤵
  PID:12672
- C:\Windows\System\rQWICUr.exe
  C:\Windows\System\rQWICUr.exe
  2⤵
  PID:12688
- C:\Windows\System\oAwpBAI.exe
  C:\Windows\System\oAwpBAI.exe
  2⤵
  PID:10128
- C:\Windows\System\sCEiJeG.exe
  C:\Windows\System\sCEiJeG.exe
  2⤵
  PID:10172
- C:\Windows\System\yxTFhEA.exe
  C:\Windows\System\yxTFhEA.exe
  2⤵
  PID:10868
- C:\Windows\System\sMnxxsQ.exe
  C:\Windows\System\sMnxxsQ.exe
  2⤵
  PID:10920
- C:\Windows\System\VpYeDCF.exe
  C:\Windows\System\VpYeDCF.exe
  2⤵
  PID:10980
- C:\Windows\System\mJyDqLx.exe
  C:\Windows\System\mJyDqLx.exe
  2⤵
  PID:11020
- C:\Windows\System\hyRFBrO.exe
  C:\Windows\System\hyRFBrO.exe
  2⤵
  PID:3976
- C:\Windows\System\omsHtyI.exe
  C:\Windows\System\omsHtyI.exe
  2⤵
  PID:11192
- C:\Windows\System\OpLbOGf.exe
  C:\Windows\System\OpLbOGf.exe
  2⤵
  PID:8660
- C:\Windows\System\qVbkXcr.exe
  C:\Windows\System\qVbkXcr.exe
  2⤵
  PID:11284
- C:\Windows\System\cNQVUFS.exe
  C:\Windows\System\cNQVUFS.exe
  2⤵
  PID:11448
- C:\Windows\System\eZKkUed.exe
  C:\Windows\System\eZKkUed.exe
  2⤵
  PID:11528
- C:\Windows\System\PJSXfyq.exe
  C:\Windows\System\PJSXfyq.exe
  2⤵
  PID:11596
- C:\Windows\System\dlQUEGy.exe
  C:\Windows\System\dlQUEGy.exe
  2⤵
  PID:11688
- C:\Windows\System\Waqzqnq.exe
  C:\Windows\System\Waqzqnq.exe
  2⤵
  PID:11772
- C:\Windows\System\zCIuUiV.exe
  C:\Windows\System\zCIuUiV.exe
  2⤵
  PID:11900
- C:\Windows\System\gViRpMQ.exe
  C:\Windows\System\gViRpMQ.exe
  2⤵
  PID:9888
- C:\Windows\System\WGgxPRk.exe
  C:\Windows\System\WGgxPRk.exe
  2⤵
  PID:9936
- C:\Windows\System\enKGmrv.exe
  C:\Windows\System\enKGmrv.exe
  2⤵
  PID:9988
- C:\Windows\System\NQNDCCg.exe
  C:\Windows\System\NQNDCCg.exe
  2⤵
  PID:12520
- C:\Windows\System\HxkAnFf.exe
  C:\Windows\System\HxkAnFf.exe
  2⤵
  PID:6816
- C:\Windows\System\KtfvMHH.exe
  C:\Windows\System\KtfvMHH.exe
  2⤵
  PID:12968
- C:\Windows\System\XNcHQzB.exe
  C:\Windows\System\XNcHQzB.exe
  2⤵
  PID:7532
- C:\Windows\System\bpxgEgp.exe
  C:\Windows\System\bpxgEgp.exe
  2⤵
  PID:9720
- C:\Windows\System\OVUNXCw.exe
  C:\Windows\System\OVUNXCw.exe
  2⤵
  PID:11924
- C:\Windows\System\tGhWyrP.exe
  C:\Windows\System\tGhWyrP.exe
  2⤵
  PID:9924
- C:\Windows\System\eLoYTga.exe
  C:\Windows\System\eLoYTga.exe
  2⤵
  PID:12480
- C:\Windows\System\ZRxQMSG.exe
  C:\Windows\System\ZRxQMSG.exe
  2⤵
  PID:12580
- C:\Windows\System\plehUIW.exe
  C:\Windows\System\plehUIW.exe
  2⤵
  PID:12648
- C:\Windows\System\tOPzzZy.exe
  C:\Windows\System\tOPzzZy.exe
  2⤵
  PID:12892
- C:\Windows\System\gyDULPS.exe
  C:\Windows\System\gyDULPS.exe
  2⤵
  PID:12196
- C:\Windows\System\VBfdkId.exe
  C:\Windows\System\VBfdkId.exe
  2⤵
  PID:13140
- C:\Windows\System\qjLWmcb.exe
  C:\Windows\System\qjLWmcb.exe
  2⤵
  PID:10600
- C:\Windows\System\njCbsmB.exe
  C:\Windows\System\njCbsmB.exe
  2⤵
  PID:13212
- C:\Windows\System\DprlluV.exe
  C:\Windows\System\DprlluV.exe
  2⤵
  PID:10540
- C:\Windows\System\nGfAWWh.exe
  C:\Windows\System\nGfAWWh.exe
  2⤵
  PID:8920
- C:\Windows\System\aQVJHxd.exe
  C:\Windows\System\aQVJHxd.exe
  2⤵
  PID:11248
- C:\Windows\System\aWoFkmu.exe
  C:\Windows\System\aWoFkmu.exe
  2⤵
  PID:9144
- C:\Windows\System\FHgNLTp.exe
  C:\Windows\System\FHgNLTp.exe
  2⤵
  PID:11092
- C:\Windows\System\bWlsLLE.exe
  C:\Windows\System\bWlsLLE.exe
  2⤵
  PID:11156
- C:\Windows\System\AGCWJWt.exe
  C:\Windows\System\AGCWJWt.exe
  2⤵
  PID:6384
- C:\Windows\System\Ajznsaa.exe
  C:\Windows\System\Ajznsaa.exe
  2⤵
  PID:13280
- C:\Windows\System\WyvrOmd.exe
  C:\Windows\System\WyvrOmd.exe
  2⤵
  PID:12700
- C:\Windows\System\mBPTvKZ.exe
  C:\Windows\System\mBPTvKZ.exe
  2⤵
  PID:9732
- C:\Windows\System\qsBTReH.exe
  C:\Windows\System\qsBTReH.exe
  2⤵
  PID:9272
- C:\Windows\System\hqbQefK.exe
  C:\Windows\System\hqbQefK.exe
  2⤵
  PID:13132
- C:\Windows\System\SMgfkGD.exe
  C:\Windows\System\SMgfkGD.exe
  2⤵
  PID:9660
- C:\Windows\System\gvToQOP.exe
  C:\Windows\System\gvToQOP.exe
  2⤵
  PID:11988
- C:\Windows\System\PYUTBQE.exe
  C:\Windows\System\PYUTBQE.exe
  2⤵
  PID:12268
- C:\Windows\System\ApRtrxn.exe
  C:\Windows\System\ApRtrxn.exe
  2⤵
  PID:7704
- C:\Windows\System\XXCsHoY.exe
  C:\Windows\System\XXCsHoY.exe
  2⤵
  PID:11496
- C:\Windows\System\pXQaFWZ.exe
  C:\Windows\System\pXQaFWZ.exe
  2⤵
  PID:13148
- C:\Windows\System\BdVrgyQ.exe
  C:\Windows\System\BdVrgyQ.exe
  2⤵
  PID:13180
- C:\Windows\System\wqBrFWk.exe
  C:\Windows\System\wqBrFWk.exe
  2⤵
  PID:12728
- C:\Windows\System\uYpYJej.exe
  C:\Windows\System\uYpYJej.exe
  2⤵
  PID:12996
- C:\Windows\System\ALPlYuB.exe
  C:\Windows\System\ALPlYuB.exe
  2⤵
  PID:12696
- C:\Windows\System\ztSLIrn.exe
  C:\Windows\System\ztSLIrn.exe
  2⤵
  PID:12732
- C:\Windows\System\mfsKMAu.exe
  C:\Windows\System\mfsKMAu.exe
  2⤵
  PID:12720
- C:\Windows\System\KlUWeEY.exe
  C:\Windows\System\KlUWeEY.exe
  2⤵
  PID:12396
- C:\Windows\System\LoByrEN.exe
  C:\Windows\System\LoByrEN.exe
  2⤵
  PID:11208
- C:\Windows\System\wdfTYmB.exe
  C:\Windows\System\wdfTYmB.exe
  2⤵
  PID:9464
- C:\Windows\System\HPZAuvC.exe
  C:\Windows\System\HPZAuvC.exe
  2⤵
  PID:13252
- C:\Windows\System\yNZdYGg.exe
  C:\Windows\System\yNZdYGg.exe
  2⤵
  PID:10304
- C:\Windows\System\ChLRnSw.exe
  C:\Windows\System\ChLRnSw.exe
  2⤵
  PID:11316
- C:\Windows\System\zQSEXTm.exe
  C:\Windows\System\zQSEXTm.exe
  2⤵
  PID:10160
- C:\Windows\System\dUrLLqT.exe
  C:\Windows\System\dUrLLqT.exe
  2⤵
  PID:9260
- C:\Windows\System\RYrkQDj.exe
  C:\Windows\System\RYrkQDj.exe
  2⤵
  PID:11420
- C:\Windows\System\MxeklDn.exe
  C:\Windows\System\MxeklDn.exe
  2⤵
  PID:13224
- C:\Windows\System\RZdQvrF.exe
  C:\Windows\System\RZdQvrF.exe
  2⤵
  PID:10908
- C:\Windows\System\xyPwxle.exe
  C:\Windows\System\xyPwxle.exe
  2⤵
  PID:4120
- C:\Windows\System\AUaOmFi.exe
  C:\Windows\System\AUaOmFi.exe
  2⤵
  PID:1268
- C:\Windows\System\hgyvxcP.exe
  C:\Windows\System\hgyvxcP.exe
  2⤵
  PID:8936
- C:\Windows\System\nrhTQaI.exe
  C:\Windows\System\nrhTQaI.exe
  2⤵
  PID:11628
- C:\Windows\System\YLnJYzO.exe
  C:\Windows\System\YLnJYzO.exe
  2⤵
  PID:8720
- C:\Windows\System\diQQLzJ.exe
  C:\Windows\System\diQQLzJ.exe
  2⤵
  PID:9868
- C:\Windows\System\mdNworW.exe
  C:\Windows\System\mdNworW.exe
  2⤵
  PID:11348
- C:\Windows\System\rrSOnzx.exe
  C:\Windows\System\rrSOnzx.exe
  2⤵
  PID:10520
- C:\Windows\System\FvOqKII.exe
  C:\Windows\System\FvOqKII.exe
  2⤵
  PID:10116
- C:\Windows\System\bVGZfwd.exe
  C:\Windows\System\bVGZfwd.exe
  2⤵
  PID:2036
- C:\Windows\System\GkgUMUP.exe
  C:\Windows\System\GkgUMUP.exe
  2⤵
  PID:13024
- C:\Windows\System\JpufSJQ.exe
  C:\Windows\System\JpufSJQ.exe
  2⤵
  PID:13060
- C:\Windows\System\RNdtKiE.exe
  C:\Windows\System\RNdtKiE.exe
  2⤵
  PID:4540
- C:\Windows\System\WkMbezx.exe
  C:\Windows\System\WkMbezx.exe
  2⤵
  PID:9316
- C:\Windows\System\hExijeV.exe
  C:\Windows\System\hExijeV.exe
  2⤵
  PID:3352
- C:\Windows\System\REDMwRK.exe
  C:\Windows\System\REDMwRK.exe
  2⤵
  PID:11172
- C:\Windows\System\GHAsjPc.exe
  C:\Windows\System\GHAsjPc.exe
  2⤵
  PID:10532
- C:\Windows\System\RFWqMOG.exe
  C:\Windows\System\RFWqMOG.exe
  2⤵
  PID:13324
- C:\Windows\System\glAHEnm.exe
  C:\Windows\System\glAHEnm.exe
  2⤵
  PID:13344
- C:\Windows\System\XMcfXft.exe
  C:\Windows\System\XMcfXft.exe
  2⤵
  PID:13608
- C:\Windows\System\hqtUUmR.exe
  C:\Windows\System\hqtUUmR.exe
  2⤵
  PID:13780
- C:\Windows\System\xtZMhPQ.exe
  C:\Windows\System\xtZMhPQ.exe
  2⤵
  PID:13812
- C:\Windows\System\CYOpAZQ.exe
  C:\Windows\System\CYOpAZQ.exe
  2⤵
  PID:13880
- C:\Windows\System\XLpkxMK.exe
  C:\Windows\System\XLpkxMK.exe
  2⤵
  PID:13908
- C:\Windows\System\UdxZxaw.exe
  C:\Windows\System\UdxZxaw.exe
  2⤵
  PID:13928
- C:\Windows\System\qGIiEST.exe
  C:\Windows\System\qGIiEST.exe
  2⤵
  PID:13944
- C:\Windows\System\GsGOYBQ.exe
  C:\Windows\System\GsGOYBQ.exe
  2⤵
  PID:14068
- C:\Windows\System\CjSxPWm.exe
  C:\Windows\System\CjSxPWm.exe
  2⤵
  PID:14108
- C:\Windows\System\qglgrCC.exe
  C:\Windows\System\qglgrCC.exe
  2⤵
  PID:14216
- C:\Windows\System\BTQqNWv.exe
  C:\Windows\System\BTQqNWv.exe
  2⤵
  PID:14240
- C:\Windows\System\QWJXayT.exe
  C:\Windows\System\QWJXayT.exe
  2⤵
  PID:14264
- C:\Windows\System\ReXMTlm.exe
  C:\Windows\System\ReXMTlm.exe
  2⤵
  PID:14300
- C:\Windows\System\wNyYvRR.exe
  C:\Windows\System\wNyYvRR.exe
  2⤵
  PID:14328
- C:\Windows\System\FnKBPTH.exe
  C:\Windows\System\FnKBPTH.exe
  2⤵
  PID:12904
- C:\Windows\System\VnYSbfu.exe
  C:\Windows\System\VnYSbfu.exe
  2⤵
  PID:13488
- C:\Windows\System\rRDOcsJ.exe
  C:\Windows\System\rRDOcsJ.exe
  2⤵
  PID:13568
- C:\Windows\System\BTsnHZk.exe
  C:\Windows\System\BTsnHZk.exe
  2⤵
  PID:13696
- C:\Windows\System\NPCguEq.exe
  C:\Windows\System\NPCguEq.exe
  2⤵
  PID:13684
- C:\Windows\System\FYdTYEI.exe
  C:\Windows\System\FYdTYEI.exe
  2⤵
  PID:13876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mrcwaapp.zb5.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ATKPwMe.exe

Filesize
1.4MB

MD5
cd8536f0383b90d01fb0df36d2c63bad

SHA1
aace918a7515f67dc1784a0feebc7719a90294c9

SHA256
91e606a2dd506eac52acf81289f9795a6b39b2c04f8e455a268af5ce6ec5998c

SHA512
48794c1a5f9d483e19a359bafc7a68155137c4717e95bbfad8c8e3c5a8373be1a2da9b617ed2b4f36c9b2bb4daf60aed63fb91802b0959f486cf17b3c4dca417

Download Submit
C:\Windows\System\BxqwXEL.exe

Filesize
1.4MB

MD5
a4b37573bc5fddebcb0c52d8a338a663

SHA1
81dc871105aa9b6cfe6c01ea26e0a9c47007168a

SHA256
3a37f54244f327fa772d9369efd729e402c27cdfcbe2a23dbe489907e8bdc036

SHA512
05010f0669997030db328f175ef87eab473afa6a6000f8f7206b9a2e38bb154ffa1f46c0fd6018545620f12303d75425cb07b73602b34c990255439c358a8dd3

Download Submit
C:\Windows\System\CixCusP.exe

Filesize
8B

MD5
2d0c2c2eeafda1eefbc846623106a651

SHA1
ebe1d12cc7355840b98bff551fa1e9b6ea05149b

SHA256
315fe12e8506c9a5679018a241c22762f38597a85e3d6906984d2cd8e0eb0749

SHA512
4747f2fca75d2722dc6b7850f1cf2e05f5ebac7e64d54a9f03247ac705b6e7fd5e4086e67fbc0da577c026e6cfc06192b9232b3f0c023c488535fb6f948376dc

Download Submit
C:\Windows\System\ClOMbVZ.exe

Filesize
1.4MB

MD5
124c8a1b7747f0ef2766142d79da75aa

SHA1
f4d8af054a868731460b515f54d05232e8e193ad

SHA256
3e0d89db6448e1928a4e9946c995de822202853839d303a252e7558577934156

SHA512
725d1a8503a44e23e55a68b59db6cc48b8268921c2caf12d256b9482524243a2f6bf9f1be1b61f7f08ecf74485f8575fc81a88254a03ad7572954e27d878e2a0

Download Submit
C:\Windows\System\ENticNg.exe

Filesize
1.4MB

MD5
59c22c19fcddb7257cf204d6250d4119

SHA1
1647e4572d59fa899c4676e43b08a93d365a8898

SHA256
804fb7b3db009f66bde2db8e3816d1698495d5d244ecd3271c8aa7d08b80cef9

SHA512
8788b6d6bd80bd057035711e027c3b41d7434cf6a35fc77dd06a9e29a8b3239b03a616d1ba4238dcd925b6bb008f0f3a125cfeedc9477b752d714c0d0a7590d0

Download Submit
C:\Windows\System\GhzCfpp.exe

Filesize
1.4MB

MD5
ef6f11f6ad8ff0918af16c8800c6efcb

SHA1
5dcdbb82d77f21459b5c24c82a7de49e8b76855d

SHA256
9a40995995bda2087de5d6307bd5dcb7495a0642405c1fbc4bb67e3a34a60a3b

SHA512
f1c87448a23f77f6ab0ebb2ea515814940af28e7e0fd2ff47ff1a8248ad2c875dea3377e0ee0ae299426e3bbfce8035d7aaca2b3f7095ba2a437c3637baaba39

Download Submit
C:\Windows\System\IzdIHPw.exe

Filesize
1.4MB

MD5
4fc605bd39b0ab0a843275223db12924

SHA1
5768e0c4f972c0f81635f630c2891b104941ac1d

SHA256
86c2a1826090159f33abe76b2f03e6b425aaf08d4b96178c8a0af8a817808dc2

SHA512
73cef807d107dee617bf9087022a819bc3cb95b84fa9d2bb641d7978869f261bd081b8839b2497fe8beaa23bdf3a9bb31427a017179089996765110553c10ed0

Download Submit
C:\Windows\System\KDLitdv.exe

Filesize
1.4MB

MD5
9de7ee196129522aeee3d7284b854edf

SHA1
5b6fe14ac7541007decb4b4b48e04b622459c20d

SHA256
0bad6d47df3a10a759291e19fe7ff26b05f7d16b5955c8e1a11876ea7a92c39d

SHA512
63fea2966498acc2b9864f9032de293e1a8b0cd1f46dea7dd7ff43b9a7e8349aedf415595a9d822831591a25d2bb3ad134e36240f9d05f109b65ce7c52e4e15c

Download Submit
C:\Windows\System\MxcGLLn.exe

Filesize
1.4MB

MD5
9a052f34acd24768654223c8606c23ae

SHA1
acf9b4707b2c56b4f17275080afb8343a75b6695

SHA256
3589388429a28529feabd9e75fc72524090e53c1cdf7beff64939d1fc16dc23c

SHA512
91a6081d7387e55e0e1c84424f88f1fa6985bbfa54cca0e151da1cd2ae29956793e4d1f07b0baf0ff83719355326628c1672051da44f10f8c92df2c09be0ecd0

Download Submit
C:\Windows\System\PHcZTLC.exe

Filesize
1.4MB

MD5
c46069734b93b5a603cb6f7a69997fef

SHA1
903b0133d2aa4790578c223342b38e69f9e1eea9

SHA256
6f4ff6c603adcf6427a3f08679fce350b099aa75159d9f0be0027f8dae2b9d9c

SHA512
566d173024a727c907580510f0ae83c3ff2b71c15ceea4cfc5a4b6db6f59cc434582c1745a7e0dfa8f997b4fd2e290ced4fb8959cc27a5db7e11b022165d704c

Download Submit
C:\Windows\System\PPehdBi.exe

Filesize
1.4MB

MD5
d5423693360db1b55e2f028d410a0456

SHA1
7a041f29d4fdaadebe721db0427917b972e8f9c7

SHA256
024eb5ccf21df8d32637136c1eec91f28b1579e649babfcd8717b43a317bf436

SHA512
003a250c881af8bfbc7fae84ec64b32e6c1bb06c77d3968dc71f3538b83bca4758afeae46179a883478b59757faab65c22b61f33f4d5f23e818c4763dd3652f4

Download Submit
C:\Windows\System\QiMMvyD.exe

Filesize
1.4MB

MD5
662c96451e9fd85e32be2cc18be98a70

SHA1
52580801c2bbc440737ab59060f825a3c727c0cf

SHA256
49913b8b679a30c1b8fa735cef2ca06451424340bf34affa1b9760df5983e223

SHA512
4e0565f706e0041364793ede03a55333eaeb147c3cf98c2897b89cf6af788d7e2b7d4a8f6a79ac9489c69ce474646df23e4a363579a7fa104d488a8ac5c00fce

Download Submit
C:\Windows\System\QsJnTCw.exe

Filesize
1.4MB

MD5
f528848ef5a6f7b8646900cc6517b902

SHA1
be81a96a899a312afc65411969f60321b50b8fd4

SHA256
bedd1f2db7c217162e7f73e12061183de01ee4c38043b048d6801c36ae0685e7

SHA512
0dd2846123be2a1c9ce6a0418b9b318858cdc0107eb33d1cb43d2006a38ca95fd78bab7ce4cb7a6c2133a01ad085da7b8514ffacde75d6ecc8985397e0b67b0c

Download Submit
C:\Windows\System\RcBnIfg.exe

Filesize
1.4MB

MD5
97d6686a4d81e53db969e3074e63c20b

SHA1
0f49d37bebcf0fd22d1620595596ce20af29b9bf

SHA256
81b0f10df9d5e08d5e2b5c7b269af5468eaf6eb27e9d1a8c70fad9a103a1ef5e

SHA512
8195fb37618d08c03dbb05aa7f813c3c32d440f6410af5925f3a329fa70fbe115b5090cd8583a28dccbfce160bde26c4adb6b8bf858e73b73e83d6239dd32af7

Download Submit
C:\Windows\System\SHHEthI.exe

Filesize
1.4MB

MD5
c4fe623bc2d49cbf99aff832bb1761c6

SHA1
24a9efc2eb7c757b4e273aba586b2c12735357d7

SHA256
f31c8e8e1d58efd631773c19dd4940128aae7f47c52c3d8dc711f16699b8800b

SHA512
9ee45d00bf51c545e4727e9542a1c02ea364068d711668a28cedc2983c12d6214dcbd21b6b8258f4cbb79c84af66e1b69748e7c7d2d8faebca90eabed0bf8ab3

Download Submit
C:\Windows\System\SoIDEpO.exe

Filesize
1.4MB

MD5
a1c1af34206a33fb698bb57c06c5f655

SHA1
a4ee6baa751764ac2e9fa363ad23c8a3eb96b170

SHA256
4abf3b1a32e1735d1215e8f5882b44140f9eb3a5ddf7a49e089f0cddf5244c8c

SHA512
d9dfdab44356f0f390e90127207c31c58f4559b67bf91a1cc778c243d6cc2310b9e754f1f2291ea26c506cfc13a06f5d62b0498d783c16ac7841b2bd24158bdf

Download Submit
C:\Windows\System\ThvHcVP.exe

Filesize
1.4MB

MD5
664c82ea5a9be8a008750b69ecb59432

SHA1
1f04d6e4f85bb587c3dbbfa1a7daf0446f6b4f7a

SHA256
53eb930b7e20a60bdd04783a061bb05be0b922d39122566e82b2620b5d3b4955

SHA512
ee6ea6498c70e7f3d98cb7b443616c60e58161a74fa30b42f5eb79a6fc47fea444961053cff26c0291db6bfbd1a30cf24169b8a9c77ed8c4a6073fed25b17152

Download Submit
C:\Windows\System\UmXIMOG.exe

Filesize
1.4MB

MD5
023e251138a5dc5c8370c7a8013ab28b

SHA1
f75f1934d772c6cc961494d6f61558e9e3e03485

SHA256
ee5bcc73a47bdfec9d3b846d2011417498a1356da672c8e142e7d4d44f309c5e

SHA512
a2df3aff358c636b872edf1de3c81ac7dff941ebc558c2413754fdb33aa19e5cae2950ae8b7a3a0bf99b116c06edbafd65e08270d9b11fc87cde4674140a6190

Download Submit
C:\Windows\System\VAVFOxu.exe

Filesize
1.4MB

MD5
690b7f4284bfaaf6e0e4c4f9d0b3c1d1

SHA1
3a7c88d93dcf04002cd77b02b68cdb6a267cf6b0

SHA256
93ff20b194b53277f74e7cce3112efc42680efc3af7a1d9c42e2b058b0faf570

SHA512
8fc8f524d5bf4a28e161bbb784233112a380702ac45fe8193c9f36ab0d82dcd573c634551d16b99199293de1e48139f0e2dc0553d2c86e3cafe37ed75ff9521e

Download Submit
C:\Windows\System\VodrMrL.exe

Filesize
1.4MB

MD5
731c95dc4931785d0bd331c763d712ed

SHA1
a19ef944fe194694f3d2b989713d79f0dedc1d50

SHA256
f09a93e9a14ae17c4e9b54d7a2a7adbc0bf2da3262e73ed06f0c22d74ba755e0

SHA512
ea9060876e39bfd38a8b2c8bfa72d80b3a7382e227d12fba45b8d30a047dfe1c5680bac4a04cb041ce5bde486cd70b6c8f617dc1c5e1a72e472681517f144e71

Download Submit
C:\Windows\System\WWdphYj.exe

Filesize
1.4MB

MD5
eb6a1395324ef7899520780926d303ae

SHA1
86c0fc930f438f4ea72949c022dfb1e9f808ab7c

SHA256
297ecf556fcd7227c5c73391e2de6a1a4d84c15fa9d26370e0ec5b4a407ba2bd

SHA512
cfc7a8177bfd91348f9e8916b53e0cffd3b5a7fbbe60ea61b9a73b58b5505a3217315fb2ddeaa92250f79af4e7dd215058e21910f168f5269918933d377cafe9

Download Submit
C:\Windows\System\YjoEihG.exe

Filesize
1.4MB

MD5
ec7c821d3b299907fa7acf7cee3ea537

SHA1
47b2e64d51c9376643b5dd18ea06d9f4e723a2a8

SHA256
d23baf12caf681069894771b0fd248e1d912b226679c8f784884d21cc27a27e8

SHA512
b8a1536747ae3305ffd516d92205131e08ecbd6e77dd161278b7ed19e8e9eab6e44e09e0a90269bd1b9620b2f9ff8095aec801ecb28e643ce56400d89abc7a90

Download Submit
C:\Windows\System\aThvUum.exe

Filesize
1.4MB

MD5
b58465672d446b56e64c79f340abcbee

SHA1
f2146dfc8d91ed6262b0bbf2114bc41304451a7e

SHA256
35b7cb6fb337d2918192c52c29b643ff56ee42c36076e1aa7a31592b01c9217c

SHA512
9dcd69b260d3c4e54a7e8bd87aae92b1c77e054eef1e68df3e299139635b38d1f5dbe54228372adf7d1df5576d8c86eab88954fba7de1d810b1975d99d53326c

Download Submit
C:\Windows\System\cPTylXR.exe

Filesize
1.4MB

MD5
2c07ea029ffbf3dd184600b83bc98d5c

SHA1
56828f2765227511e0ecb7faf9b0a80fb69b0e2e

SHA256
343980dba9977bb8b93f9a9463e0774267e117997b90f0e1627729ce0a32086d

SHA512
59f170402118541938503461ee6ff879e35bd05b2a89e6e2c8d86a67a4dd993af1a50af75fdfd38a993c9d781da538ff01adacd112c93772ca7600f00a492190

Download Submit
C:\Windows\System\cPotjsu.exe

Filesize
1.4MB

MD5
448fec800642d3eda23f2e7d1556acec

SHA1
aa90436682def3064d98d81b0bdfd7db3b271f73

SHA256
400a25608e20fff20e83b9ecd6d8b1889d60f4e50f6714571e3f3374bb3567d4

SHA512
31ee2980c13a018eb7e1ba245075293bcdf088659d128bd104393b56651952ca958040aa386be70283e64f025f7e2f91fbb60c890ddeeb9eb6a9e6e22e157b28

Download Submit
C:\Windows\System\dfDEkGu.exe

Filesize
1.4MB

MD5
9028c64f5262dfb3c72126d5f93401bf

SHA1
a58c3b06062e55d82e9597ebf3208294cd8610fc

SHA256
068088fb2542e0677aec0e73674bc38fedeb6cd6fae13ddafa5759041ce9ef06

SHA512
a91fc1455a870c46c72096be2bf1c6d1e63c5ca1ded90459d87db086d3c1dca3045ca618d077ecdcf186fd40949811d185e4968d7dcb8bf3dcf15a0e349ce20c

Download Submit
C:\Windows\System\eCVFvwn.exe

Filesize
1.4MB

MD5
6089ff3115790103dd088d654d94a159

SHA1
2e3fbffe87f4b6ae5d1f6318ba27bc8d5d53abeb

SHA256
468ea8f1447340dfea1db5a278a39e7b036d33fd128e1b99861f600a5a63cfaf

SHA512
26e7f64c5b4076478286c724657d05f09c0fbcd2ec826a67377ea9d205cbb60b0521da85a2a6e52b082a084b2b891d09caf1f0817f19a8d24737b14ee30ed070

Download Submit
C:\Windows\System\hrTEdFA.exe

Filesize
1.4MB

MD5
27d91d9178dd62d109f3ef7fc5b3ea3c

SHA1
88545f1f02aa3155ff8e092f43cecef43ee71294

SHA256
b1d2a1a6356b24f480fa02bffd594e13ed37713e1dc70f85390fedd5088146d5

SHA512
81b6877f40e8964efcd61a0c87f7be3d3012dd0d0bec7cf1661d15d571eb6b1113ca6657cc404d7c433ff1b2aee61f00481d51fb40f8c495aae9c11fe0645d62

Download Submit
C:\Windows\System\huxSXIl.exe

Filesize
1.4MB

MD5
bdd4e91cf7bac09fa9a58cbcd3f6db19

SHA1
34457b50f2f0155993180dc4df339e55a290f34c

SHA256
fcb598ac516891e9e1d51e0351bb83efadbf4228aaaeb878e812b59940600fbf

SHA512
c47ac0b1f61a56cb26e1285ffbbeedcaded4f21eb45af85e2a827cbff4a0a4388def743ccd3f138410651552277dcdb7428980a485f6b4663b93a1edfc07ca27

Download Submit
C:\Windows\System\jzMOirL.exe

Filesize
1.4MB

MD5
b6ba224b77d3865a5fbdc213c170d335

SHA1
a155740ea1fd8db0779df94fb41bf06359ad1b21

SHA256
e0b5d9ec72a78ce6e1cf5494421ff6b70419ca2b872342273865d0f467d6f4d5

SHA512
820c6d33817cb4ac6a8a7e7a9c21fe860eae17426001ea90e99af02bc24c37abbb81ebe2c6ab5664cfbaecda6d146b6d4c4d5ba6acefd4b91c070d97a97a05e9

Download Submit
C:\Windows\System\kbBYUqg.exe

Filesize
1.4MB

MD5
825ecfc0fb8f513086c8ea7893e025c4

SHA1
578bee76671a55271d105a27f74a9f8909b641de

SHA256
0b56b56c6db08f6c05001a4f4965f90140012038d8f984640734879fcb66f108

SHA512
e49be33310e893f4a49168caaeffd9973aab4ed27394e1ebf506df783598e53d4f7e14cc4334d96ab23fb392b8fd6a70830072d1e75289293eaae6d68c9e4159

Download Submit
C:\Windows\System\ldBCeDL.exe

Filesize
1.4MB

MD5
dcd319834bdc94187062b37af7ed8e09

SHA1
246c9b5ceaa3ce873acfbc986659d32fca0936fc

SHA256
103ae411bf54164125113d1802fee7a76c79fdf2aeacd965cb8a0328c47a1d3f

SHA512
af72906ffb6a22dee814ef8580307641b313e26192945c5171f9ce63607d9506979b27799d0e6cf882a51493ea93dfa416900e72c12e3a14b95f9f5b69373a03

Download Submit
C:\Windows\System\mkCColT.exe

Filesize
1.4MB

MD5
e2448c196302cc893c427e500b0e702b

SHA1
00e476f7483c769562c6f095e106315be7989705

SHA256
4978c043ecd477595c106dfebeeb46dbaa249798c657e25c21a771d957afb3a4

SHA512
ef42e4ac6c5fe70622971ea47f6c33ba62a8b5311feb13a7f057c4385c69d045b053160a72f23cd3e1fe0ed07534464b11e40d4f54c86482ddaa833388d59b5e

Download Submit
C:\Windows\System\myhYVSx.exe

Filesize
1.4MB

MD5
f0e05042a092dc56592a4b7344941fb9

SHA1
1375c7a543c45304e7db043f373fc1ba7da182d5

SHA256
517f13e57ac48311288d1a6ec96021b5f7c7123a9c0916cbdbd001d613be15d4

SHA512
55bef1c693dade7ca58893ba08ee2a2036be39f6b693f77516eae69eaa7f43c516221475b1586b0ad47469bff37595063583a3b38308e43e273bfeb2591a6f0b

Download Submit
C:\Windows\System\nPqqXWa.exe

Filesize
1.4MB

MD5
fab520a73d72d8fc47e38643d73c3293

SHA1
e265180380825bad01dab683faccac808bb304b2

SHA256
7bf6a73fd1bc23579f6f28a2d99fa2488126c027f65da05209203f08fb5122e2

SHA512
8baa6705a1f19014b9ca3cddd366f312e7247e5088ff87c7a16a75e0bffcbd186f147fdd86f7e86209c53c9a036e79bacfef297a8d674bf7f068feda8a997950

Download Submit
C:\Windows\System\oHlhywP.exe

Filesize
1.4MB

MD5
f66f695471c4f2cc12a6bd39e7849c90

SHA1
0ea4e53f43c22ab84683a3dc2fbd26ed515fa868

SHA256
23e4a0822315c47c9b0eb835cc0227f19c281ffa4582f6baae3623112007c029

SHA512
58e6fb42d691b32d4d24c34f22bfccea62d10cac550f92e787fdbfc57f075273f4eac761cfc8114d12cf03f5f94faf4a1cdfe15dc9a91c1c60c73ccc77ba55bf

Download Submit
C:\Windows\System\vIZCmcl.exe

Filesize
1.4MB

MD5
7e4f0501a0c0524eec6a3d5e040b7bff

SHA1
46c88af20f9715f26f797c8b4735f77c80a5ab1a

SHA256
6ada82fc92c233386d8d8db1e424ea802905a670e2a45dcf19f0341dacbcfed7

SHA512
39a44b0fbe2697a5699147a91d7dd301152e4569c74ff4693b5d1ff586d129e74311b1ac5655cda256812cac05442ee188cf3f82e8e1b9fe40adb62bd6c93c82

Download Submit
C:\Windows\System\vLgYmcK.exe

Filesize
1.4MB

MD5
04a05a00750741c1a004560a171dd23a

SHA1
419f7d31e1ef5253fdc3135dcd7ea3644280e3f1

SHA256
453b330157e28c84a58e659d0d24cc10a6c953107873d551e205b277ee633d3a

SHA512
1898a9eb1b1704fcd24045ae2c3d883f0b776dd52870d29956887d9ccbf6df259c911f894fafe065cf7528fa185c5acddfecb861c7deb8525cc9a32bdc7d869c

Download Submit
C:\Windows\System\wZXtCkv.exe

Filesize
1.4MB

MD5
7fa1c606aa33f4e4c250eae2fd495cbc

SHA1
64c9d1e36ad67d343a44e49788d9b868299aabe1

SHA256
c8bc3a72b31382e03539c472eaf68ce978ea1c39eddbd66144650e60661ba5b4

SHA512
8c0006ca8a3abb589566a949f5e7f5da9a99190a146e2baca5be247084bcd4bf4802857630871d0c6b83ff01d3936169986a046c0d964cb5b9a41972dd0321cb

Download Submit
C:\Windows\System\wrozRzU.exe

Filesize
1.4MB

MD5
915ed68937289bb867c4639392a517cd

SHA1
739d74278c92c7c102a6f7837554d8f5d20d0a47

SHA256
b7644de7f66e3a8ab8c3de2fb63522ee1e3c432bdc74d562d7236be9f6b04d21

SHA512
4b4f6a4aaa11226a37673157800bbd337d12e273e220304b974fce817c3a6069f9f05a41141f97a404c151184aed6076c15898b02a3b2fbd40ceb122198f2730

Download Submit
C:\Windows\System\xJEFVzl.exe

Filesize
1.4MB

MD5
a8d35753e47762fd7bae329cdf3b4f77

SHA1
563f8e7c8ef804c6042ba9210ce26b238d9f17a7

SHA256
893739762120f3cd00576be5a330dd82a53c4b0a4e8c988085c725503de03bf5

SHA512
7e42a8d54ff448e58db9155a75b2151c0badf5bb1e09e2f138dcba75a118d08c9f50df4609dbd90b29e0ab8bf62fa2706786a95c0de6cdf414f15f1cc97cf376

Download Submit
C:\Windows\System\xUeilrY.exe

Filesize
1.4MB

MD5
b65c73cb966bb1a9b882f1404e4d5b02

SHA1
3cfae5728bc17389b3a5e6438583a395a36a1478

SHA256
9bdc4a3a1fcbe838aaf9a259f6557d8436e286e30de1445046b6d54fab32854a

SHA512
28fe3b2dee834cada89c8b4622aea06f83873833268a73bc8b0d27ea1d4cd51b2f14beac54f545f7a8c263c34395ef694ec24df66e55d356de1f48af9b244c62

Download Submit
C:\Windows\System\xpgJqjT.exe

Filesize
1.4MB

MD5
5fe5f2d93b0aeeb2733dff5d24fe94e1

SHA1
611c3beed8d411caa056b9bb50dce25a3541122d

SHA256
5cd2e3f1cf3edf4a1b5aac766b1181d596c5c2b057812c850ba85399991c7154

SHA512
3f7467fc0bfc6f4da822d06a35321bb680abcb41142702fdf73c4246d0fb8e213078867e252b48296472b5cf7028c688d205eacea918efc909ee20a18457fa8c

Download Submit
C:\Windows\System\zQFoliZ.exe

Filesize
1.4MB

MD5
546ea0ffe3ffad926980a591c7241f7d

SHA1
e557e3edcb150e7317237f0e27ae541210fb87e7

SHA256
1a47eb55eda6d37606e3df4382c516e9946cb316cf4471f2b0ace77de502850b

SHA512
ccdd162ec107d3b892e9777f872d8fac4831a76a71a4183f174e0fe62e60d6d55afacc1f6a7ef16ee6b5c96133565ed1d05d5321ec7db41e727fde8fa2a3f4f4

Download Submit
memory/412-488-0x00007FF72F200000-0x00007FF72F5F2000-memory.dmp

Filesize
3.9MB

Download
memory/412-3059-0x00007FF72F200000-0x00007FF72F5F2000-memory.dmp

Filesize
3.9MB

Download
memory/592-3061-0x00007FF7C2E10000-0x00007FF7C3202000-memory.dmp

Filesize
3.9MB

Download
memory/592-287-0x00007FF7C2E10000-0x00007FF7C3202000-memory.dmp

Filesize
3.9MB

Download
memory/1256-247-0x00007FF694FB0000-0x00007FF6953A2000-memory.dmp

Filesize
3.9MB

Download
memory/1256-3056-0x00007FF694FB0000-0x00007FF6953A2000-memory.dmp

Filesize
3.9MB

Download
memory/1344-3093-0x00007FF60D6B0000-0x00007FF60DAA2000-memory.dmp

Filesize
3.9MB

Download
memory/1344-490-0x00007FF60D6B0000-0x00007FF60DAA2000-memory.dmp

Filesize
3.9MB

Download
memory/1884-480-0x00007FF654710000-0x00007FF654B02000-memory.dmp

Filesize
3.9MB

Download
memory/1884-3068-0x00007FF654710000-0x00007FF654B02000-memory.dmp

Filesize
3.9MB

Download
memory/1920-482-0x00007FF619A20000-0x00007FF619E12000-memory.dmp

Filesize
3.9MB

Download
memory/1920-3066-0x00007FF619A20000-0x00007FF619E12000-memory.dmp

Filesize
3.9MB

Download
memory/1992-371-0x00007FF613BC0000-0x00007FF613FB2000-memory.dmp

Filesize
3.9MB

Download
memory/1992-3072-0x00007FF613BC0000-0x00007FF613FB2000-memory.dmp

Filesize
3.9MB

Download
memory/2328-3054-0x00007FF7CD830000-0x00007FF7CDC22000-memory.dmp

Filesize
3.9MB

Download
memory/2328-143-0x00007FF7CD830000-0x00007FF7CDC22000-memory.dmp

Filesize
3.9MB

Download
memory/2444-3074-0x00007FF71A250000-0x00007FF71A642000-memory.dmp

Filesize
3.9MB

Download
memory/2444-292-0x00007FF71A250000-0x00007FF71A642000-memory.dmp

Filesize
3.9MB

Download
memory/2716-481-0x00007FF7DF450000-0x00007FF7DF842000-memory.dmp

Filesize
3.9MB

Download
memory/2716-3075-0x00007FF7DF450000-0x00007FF7DF842000-memory.dmp

Filesize
3.9MB

Download
memory/2768-3077-0x00007FF6ABD80000-0x00007FF6AC172000-memory.dmp

Filesize
3.9MB

Download
memory/2768-442-0x00007FF6ABD80000-0x00007FF6AC172000-memory.dmp

Filesize
3.9MB

Download
memory/3024-3052-0x00007FF61AE60000-0x00007FF61B252000-memory.dmp

Filesize
3.9MB

Download
memory/3024-197-0x00007FF61AE60000-0x00007FF61B252000-memory.dmp

Filesize
3.9MB

Download
memory/3060-3082-0x00007FF7D6E20000-0x00007FF7D7212000-memory.dmp

Filesize
3.9MB

Download
memory/3060-483-0x00007FF7D6E20000-0x00007FF7D7212000-memory.dmp

Filesize
3.9MB

Download
memory/3532-489-0x00007FF7B0930000-0x00007FF7B0D22000-memory.dmp

Filesize
3.9MB

Download
memory/3532-3050-0x00007FF7B0930000-0x00007FF7B0D22000-memory.dmp

Filesize
3.9MB

Download
memory/3536-3048-0x00007FF7D8D00000-0x00007FF7D90F2000-memory.dmp

Filesize
3.9MB

Download
memory/3536-17-0x00007FF7D8D00000-0x00007FF7D90F2000-memory.dmp

Filesize
3.9MB

Download
memory/3608-3070-0x00007FF762290000-0x00007FF762682000-memory.dmp

Filesize
3.9MB

Download
memory/3608-479-0x00007FF762290000-0x00007FF762682000-memory.dmp

Filesize
3.9MB

Download
memory/3824-3064-0x00007FF797390000-0x00007FF797782000-memory.dmp

Filesize
3.9MB

Download
memory/3824-476-0x00007FF797390000-0x00007FF797782000-memory.dmp

Filesize
3.9MB

Download
memory/3864-487-0x00007FF7B7B80000-0x00007FF7B7F72000-memory.dmp

Filesize
3.9MB

Download
memory/3864-3083-0x00007FF7B7B80000-0x00007FF7B7F72000-memory.dmp

Filesize
3.9MB

Download
memory/4084-0-0x00007FF7902E0000-0x00007FF7906D2000-memory.dmp

Filesize
3.9MB

Download
memory/4084-2950-0x00007FF7902E0000-0x00007FF7906D2000-memory.dmp

Filesize
3.9MB

Download
memory/4084-1-0x000001E47D320000-0x000001E47D330000-memory.dmp

Filesize
64KB

Download
memory/4512-486-0x00007FF601C90000-0x00007FF602082000-memory.dmp

Filesize
3.9MB

Download
memory/4512-3080-0x00007FF601C90000-0x00007FF602082000-memory.dmp

Filesize
3.9MB

Download
memory/4772-327-0x0000019A1D5C0000-0x0000019A1D5E2000-memory.dmp

Filesize
136KB

Download
memory/4772-105-0x00007FF896300000-0x00007FF896DC1000-memory.dmp

Filesize
10.8MB

Download
memory/4772-108-0x0000019A1D640000-0x0000019A1D650000-memory.dmp

Filesize
64KB

Download
memory/4808-3111-0x00007FF656890000-0x00007FF656C82000-memory.dmp

Filesize
3.9MB

Download
memory/4808-484-0x00007FF656890000-0x00007FF656C82000-memory.dmp

Filesize
3.9MB

Download
memory/5080-485-0x00007FF717710000-0x00007FF717B02000-memory.dmp

Filesize
3.9MB

Download
memory/5080-3115-0x00007FF717710000-0x00007FF717B02000-memory.dmp

Filesize
3.9MB

Download