xmrig | c17f350978933feee628392a1fc3821871b5b49e3cfec9e74741f4ce51f29340

Analysis

max time kernel
150s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 01:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
Size

1.4MB
MD5

0d16ab84689e7c61079054b1c0f3e5e3
SHA1

5ac928daefac4845fea194e7bf84b959a3c06409
SHA256

c17f350978933feee628392a1fc3821871b5b49e3cfec9e74741f4ce51f29340
SHA512

7c1db50dd4876dbcb40d9d804c74abb87e455512efb813a8e022c623ecb99fd3fb3896233bdc73d7c1defc12b8f0639e8b813c956aa6bac88050640c421178b9
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYKpGncHBN/VPwlZCA:Lz071uv4BPMkibTIA5CJS

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 25 IoCs

miner

resource	yara_rule
behavioral2/memory/2040-181-0x00007FF721140000-0x00007FF721532000-memory.dmp	xmrig
behavioral2/memory/2592-184-0x00007FF6A8FF0000-0x00007FF6A93E2000-memory.dmp	xmrig
behavioral2/memory/4788-188-0x00007FF7D4910000-0x00007FF7D4D02000-memory.dmp	xmrig
behavioral2/memory/3956-192-0x00007FF6BF300000-0x00007FF6BF6F2000-memory.dmp	xmrig
behavioral2/memory/1016-194-0x00007FF70F220000-0x00007FF70F612000-memory.dmp	xmrig
behavioral2/memory/4336-199-0x00007FF6C3D40000-0x00007FF6C4132000-memory.dmp	xmrig
behavioral2/memory/3344-204-0x00007FF60A920000-0x00007FF60AD12000-memory.dmp	xmrig
behavioral2/memory/1468-203-0x00007FF602610000-0x00007FF602A02000-memory.dmp	xmrig
behavioral2/memory/2288-202-0x00007FF6D4F40000-0x00007FF6D5332000-memory.dmp	xmrig
behavioral2/memory/396-200-0x00007FF6D0790000-0x00007FF6D0B82000-memory.dmp	xmrig
behavioral2/memory/400-196-0x00007FF76B3B0000-0x00007FF76B7A2000-memory.dmp	xmrig
behavioral2/memory/812-191-0x00007FF7A6200000-0x00007FF7A65F2000-memory.dmp	xmrig
behavioral2/memory/1340-190-0x00007FF609760000-0x00007FF609B52000-memory.dmp	xmrig
behavioral2/memory/1644-187-0x00007FF699410000-0x00007FF699802000-memory.dmp	xmrig
behavioral2/memory/808-185-0x00007FF7CB300000-0x00007FF7CB6F2000-memory.dmp	xmrig
behavioral2/memory/3168-183-0x00007FF688550000-0x00007FF688942000-memory.dmp	xmrig
behavioral2/memory/2112-182-0x00007FF714310000-0x00007FF714702000-memory.dmp	xmrig
behavioral2/memory/4020-26-0x00007FF6E19F0000-0x00007FF6E1DE2000-memory.dmp	xmrig
behavioral2/memory/1112-4583-0x00007FF736F40000-0x00007FF737332000-memory.dmp	xmrig
behavioral2/memory/4236-4732-0x00007FF6E2D40000-0x00007FF6E3132000-memory.dmp	xmrig
behavioral2/memory/4968-4727-0x00007FF63A880000-0x00007FF63AC72000-memory.dmp	xmrig
behavioral2/memory/4284-4725-0x00007FF60DFE0000-0x00007FF60E3D2000-memory.dmp	xmrig
behavioral2/memory/2004-4718-0x00007FF7DEAD0000-0x00007FF7DEEC2000-memory.dmp	xmrig
behavioral2/memory/1104-4711-0x00007FF6CD4E0000-0x00007FF6CD8D2000-memory.dmp	xmrig
behavioral2/memory/2784-4594-0x00007FF69C550000-0x00007FF69C942000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4020	APqJSGd.exe
1468	OWausfX.exe
2040	VRYiUOv.exe
3344	XVIJpSI.exe
2112	lSYhnYA.exe
3168	GxgZmSK.exe
2592	GwNyBWv.exe
808	uwrckmf.exe
2004	spwanzr.exe
1644	fWHhFaA.exe
4788	qbawOXi.exe
2784	kURMJgg.exe
1340	DkYtTpf.exe
812	YkmKWLs.exe
3956	GvOdDnS.exe
1016	hVfYgPK.exe
4284	YATVlXk.exe
400	JHywxMA.exe
1104	PSUUTtD.exe
4968	KEItqHN.exe
4336	KOOZxkz.exe
396	uYSBXdt.exe
4236	pRPBXAY.exe
2288	gbiMtkM.exe
2644	aqvkOvX.exe
4064	LhubNSd.exe
1356	TArCfUw.exe
1460	nhoOWdd.exe
4320	soYFQPg.exe
2188	FhCnTxN.exe
4472	JOLXTee.exe
1660	axTEEOI.exe
936	sTXFUHy.exe
1576	WQsjSjU.exe
4812	WPXOdrJ.exe
2632	qRjcoFs.exe
3904	RSsRXmN.exe
4280	lkvRPvn.exe
1824	CmjxJLn.exe
3516	oauqBCk.exe
4672	qJxsAfm.exe
3816	jLKjawD.exe
4264	unebvyA.exe
2184	hnOwUcw.exe
4600	zZVtxOR.exe
716	bzjxXqe.exe
2596	PlQtrEY.exe
4492	NirtplF.exe
1992	AFbCvkm.exe
2252	mbzRREj.exe
3968	uFshogj.exe
3916	ytYUkVM.exe
4500	lZyfQXE.exe
2296	hvokUWN.exe
3052	MuhIRlN.exe
1484	hgfspaL.exe
3580	jBTeokl.exe
4344	iKtNwru.exe
3360	LyqypXp.exe
3024	UqBmsms.exe
2092	YYgFGXx.exe
3864	FAIqZzA.exe
4648	voZcpHC.exe
3652	UKwjAXB.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1112-0-0x00007FF736F40000-0x00007FF737332000-memory.dmp	upx
behavioral2/files/0x000c000000023b8d-5.dat	upx
behavioral2/files/0x000a000000023ba3-33.dat	upx
behavioral2/files/0x000a000000023ba9-133.dat	upx
behavioral2/memory/2040-181-0x00007FF721140000-0x00007FF721532000-memory.dmp	upx
behavioral2/memory/2592-184-0x00007FF6A8FF0000-0x00007FF6A93E2000-memory.dmp	upx
behavioral2/memory/4788-188-0x00007FF7D4910000-0x00007FF7D4D02000-memory.dmp	upx
behavioral2/memory/3956-192-0x00007FF6BF300000-0x00007FF6BF6F2000-memory.dmp	upx
behavioral2/memory/1016-194-0x00007FF70F220000-0x00007FF70F612000-memory.dmp	upx
behavioral2/memory/4336-199-0x00007FF6C3D40000-0x00007FF6C4132000-memory.dmp	upx
behavioral2/memory/3344-204-0x00007FF60A920000-0x00007FF60AD12000-memory.dmp	upx
behavioral2/files/0x000a000000023baa-220.dat	upx
behavioral2/files/0x000a000000023bbb-236.dat	upx
behavioral2/files/0x000a000000023bba-228.dat	upx
behavioral2/files/0x000a000000023baf-216.dat	upx
behavioral2/files/0x0031000000023bb7-213.dat	upx
behavioral2/files/0x0031000000023bb8-208.dat	upx
behavioral2/files/0x000a000000023bc8-207.dat	upx
behavioral2/memory/1468-203-0x00007FF602610000-0x00007FF602A02000-memory.dmp	upx
behavioral2/memory/2288-202-0x00007FF6D4F40000-0x00007FF6D5332000-memory.dmp	upx
behavioral2/memory/4236-201-0x00007FF6E2D40000-0x00007FF6E3132000-memory.dmp	upx
behavioral2/memory/396-200-0x00007FF6D0790000-0x00007FF6D0B82000-memory.dmp	upx
behavioral2/memory/4968-198-0x00007FF63A880000-0x00007FF63AC72000-memory.dmp	upx
behavioral2/memory/1104-197-0x00007FF6CD4E0000-0x00007FF6CD8D2000-memory.dmp	upx
behavioral2/memory/400-196-0x00007FF76B3B0000-0x00007FF76B7A2000-memory.dmp	upx
behavioral2/memory/4284-195-0x00007FF60DFE0000-0x00007FF60E3D2000-memory.dmp	upx
behavioral2/memory/812-191-0x00007FF7A6200000-0x00007FF7A65F2000-memory.dmp	upx
behavioral2/memory/1340-190-0x00007FF609760000-0x00007FF609B52000-memory.dmp	upx
behavioral2/memory/2784-189-0x00007FF69C550000-0x00007FF69C942000-memory.dmp	upx
behavioral2/memory/1644-187-0x00007FF699410000-0x00007FF699802000-memory.dmp	upx
behavioral2/memory/2004-186-0x00007FF7DEAD0000-0x00007FF7DEEC2000-memory.dmp	upx
behavioral2/memory/808-185-0x00007FF7CB300000-0x00007FF7CB6F2000-memory.dmp	upx
behavioral2/memory/3168-183-0x00007FF688550000-0x00007FF688942000-memory.dmp	upx
behavioral2/memory/2112-182-0x00007FF714310000-0x00007FF714702000-memory.dmp	upx
behavioral2/files/0x000a000000023bc7-175.dat	upx
behavioral2/files/0x000a000000023bc6-174.dat	upx
behavioral2/files/0x000a000000023bc5-173.dat	upx
behavioral2/files/0x000a000000023bc4-172.dat	upx
behavioral2/files/0x000a000000023bc3-171.dat	upx
behavioral2/files/0x000a000000023bc2-168.dat	upx
behavioral2/files/0x000a000000023bc0-167.dat	upx
behavioral2/files/0x000a000000023bbf-166.dat	upx
behavioral2/files/0x000a000000023bad-159.dat	upx
behavioral2/files/0x000a000000023bbe-158.dat	upx
behavioral2/files/0x000a000000023bbd-157.dat	upx
behavioral2/files/0x000a000000023bab-155.dat	upx
behavioral2/files/0x000a000000023ba7-153.dat	upx
behavioral2/files/0x000a000000023bbc-152.dat	upx
behavioral2/files/0x000a000000023bb0-146.dat	upx
behavioral2/files/0x000a000000023bb9-143.dat	upx
behavioral2/files/0x000a000000023bae-139.dat	upx
behavioral2/files/0x0031000000023bb6-127.dat	upx
behavioral2/files/0x000a000000023bb5-123.dat	upx
behavioral2/files/0x000a000000023bb4-116.dat	upx
behavioral2/files/0x000a000000023bb3-110.dat	upx
behavioral2/files/0x000a000000023bac-100.dat	upx
behavioral2/files/0x000a000000023ba6-98.dat	upx
behavioral2/files/0x000a000000023bb2-96.dat	upx
behavioral2/files/0x000a000000023bb1-94.dat	upx
behavioral2/files/0x000a000000023ba8-70.dat	upx
behavioral2/files/0x000a000000023ba1-108.dat	upx
behavioral2/files/0x000a000000023ba0-56.dat	upx
behavioral2/files/0x000a000000023ba5-55.dat	upx
behavioral2/files/0x000a000000023ba2-77.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\QpsoinV.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\unebvyA.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\ChEdSrP.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\JeZnQdg.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\ZQoHMHP.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\zhIvSHt.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\hwdHagK.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\sTTjkWI.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\zECtSrU.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\XEtawxT.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\YeoMBKB.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\CINiVug.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\uMkkscb.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\BhZsRft.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\lxazRmw.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\wBdqasH.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\wybKNaX.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\MxjIeil.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\XTmYGJL.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\XQkyMfX.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\raBebOp.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\TlEKQqS.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\emiNmZo.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\MhZDPeU.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\ubEuOWa.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\KXsRPSx.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\yZypXna.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\wbHZPbF.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\spMBTGH.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\kDstWSY.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\IgnKhBZ.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\ihFgBsU.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\CuMEGuK.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\DqHQbib.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\qkIVaxz.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\zNZAShX.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\TasVKzw.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\XUsDncn.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\oqXfRmm.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\rmVLoWo.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\EPkPdkc.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\RVhHwaB.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\coUUBTF.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\LGaTPFL.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\vogCBqO.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\yQVbLVi.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\atYZNfj.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\jGhYeRT.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\lutahrq.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\OxnEugC.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\mfTqvCc.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\aqVYDsR.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\fcmHCFi.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\SVPlAuJ.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\IZpJGRg.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\LOrEGjk.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\TCVqEMw.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\TKmFgXX.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\iYEoGCQ.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\CoaIjuT.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\CVhbeUU.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\NoWucdL.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\NebKBZo.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\gZVawRP.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1920	powershell.exe
1920	powershell.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
9976	Process not Found
10244	Process not Found
7600	Process not Found
8788	Process not Found
10596	Process not Found
7484	Process not Found
10720	Process not Found
8000	Process not Found
10752	Process not Found
4956	Process not Found
9596	Process not Found
9572	Process not Found
2656	Process not Found
8444	Process not Found
6488	Process not Found
8544	Process not Found
11276	Process not Found
12312	Process not Found
8524	Process not Found
10012	Process not Found
7308	Process not Found
12100	Process not Found
8292	Process not Found
11440	Process not Found
10000	Process not Found
12088	Process not Found
7332	Process not Found
12900	Process not Found
11628	Process not Found
12092	Process not Found
9784	Process not Found
8160	Process not Found
10508	Process not Found
12136	Process not Found
7692	Process not Found
7336	Process not Found
8772	Process not Found
12948	Process not Found
13016	Process not Found
9852	Process not Found
11392	Process not Found
10520	Process not Found
11912	Process not Found
7312	Process not Found
8720	Process not Found
9836	Process not Found
13084	Process not Found
9080	Process not Found
12596	Process not Found
8440	Process not Found
13056	Process not Found
5056	Process not Found
12652	Process not Found
4476	Process not Found
10556	Process not Found
8656	Process not Found
7992	Process not Found
11436	Process not Found
12728	Process not Found
7612	Process not Found
10944	Process not Found
6660	Process not Found
8740	Process not Found
6568	Process not Found

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
Token: SeDebugPrivilege	1920	powershell.exe
Token: SeLockMemoryPrivilege	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	1188	dwm.exe
Token: SeChangeNotifyPrivilege	1188	dwm.exe
Token: 33	1188	dwm.exe
Token: SeIncBasePriorityPrivilege	1188	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 1920	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	85
PID 1112 wrote to memory of 1920	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	85
PID 1112 wrote to memory of 4020	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	86
PID 1112 wrote to memory of 4020	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	86
PID 1112 wrote to memory of 1468	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	87
PID 1112 wrote to memory of 1468	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	87
PID 1112 wrote to memory of 2040	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	88
PID 1112 wrote to memory of 2040	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	88
PID 1112 wrote to memory of 3344	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	89
PID 1112 wrote to memory of 3344	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	89
PID 1112 wrote to memory of 2112	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	90
PID 1112 wrote to memory of 2112	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	90
PID 1112 wrote to memory of 3168	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	91
PID 1112 wrote to memory of 3168	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	91
PID 1112 wrote to memory of 2592	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	92
PID 1112 wrote to memory of 2592	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	92
PID 1112 wrote to memory of 808	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	93
PID 1112 wrote to memory of 808	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	93
PID 1112 wrote to memory of 2004	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	94
PID 1112 wrote to memory of 2004	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	94
PID 1112 wrote to memory of 1644	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	95
PID 1112 wrote to memory of 1644	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	95
PID 1112 wrote to memory of 4788	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	96
PID 1112 wrote to memory of 4788	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	96
PID 1112 wrote to memory of 2784	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	97
PID 1112 wrote to memory of 2784	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	97
PID 1112 wrote to memory of 1340	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	98
PID 1112 wrote to memory of 1340	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	98
PID 1112 wrote to memory of 812	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	99
PID 1112 wrote to memory of 812	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	99
PID 1112 wrote to memory of 3956	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	100
PID 1112 wrote to memory of 3956	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	100
PID 1112 wrote to memory of 1016	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	101
PID 1112 wrote to memory of 1016	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	101
PID 1112 wrote to memory of 4284	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	102
PID 1112 wrote to memory of 4284	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	102
PID 1112 wrote to memory of 400	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	103
PID 1112 wrote to memory of 400	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	103
PID 1112 wrote to memory of 1104	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	104
PID 1112 wrote to memory of 1104	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	104
PID 1112 wrote to memory of 4968	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	105
PID 1112 wrote to memory of 4968	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	105
PID 1112 wrote to memory of 4336	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	106
PID 1112 wrote to memory of 4336	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	106
PID 1112 wrote to memory of 396	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	107
PID 1112 wrote to memory of 396	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	107
PID 1112 wrote to memory of 4236	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	108
PID 1112 wrote to memory of 4236	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	108
PID 1112 wrote to memory of 2288	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	109
PID 1112 wrote to memory of 2288	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	109
PID 1112 wrote to memory of 4672	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	110
PID 1112 wrote to memory of 4672	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	110
PID 1112 wrote to memory of 3516	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	111
PID 1112 wrote to memory of 3516	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	111
PID 1112 wrote to memory of 2644	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	112
PID 1112 wrote to memory of 2644	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	112
PID 1112 wrote to memory of 4064	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	113
PID 1112 wrote to memory of 4064	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	113
PID 1112 wrote to memory of 1356	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	114
PID 1112 wrote to memory of 1356	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	114
PID 1112 wrote to memory of 1460	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	115
PID 1112 wrote to memory of 1460	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	115
PID 1112 wrote to memory of 4320	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	116
PID 1112 wrote to memory of 4320	1112	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1920
- C:\Windows\System\APqJSGd.exe
  C:\Windows\System\APqJSGd.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\OWausfX.exe
  C:\Windows\System\OWausfX.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\VRYiUOv.exe
  C:\Windows\System\VRYiUOv.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\XVIJpSI.exe
  C:\Windows\System\XVIJpSI.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System\lSYhnYA.exe
  C:\Windows\System\lSYhnYA.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\GxgZmSK.exe
  C:\Windows\System\GxgZmSK.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\GwNyBWv.exe
  C:\Windows\System\GwNyBWv.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\uwrckmf.exe
  C:\Windows\System\uwrckmf.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\spwanzr.exe
  C:\Windows\System\spwanzr.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\fWHhFaA.exe
  C:\Windows\System\fWHhFaA.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\qbawOXi.exe
  C:\Windows\System\qbawOXi.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\kURMJgg.exe
  C:\Windows\System\kURMJgg.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\DkYtTpf.exe
  C:\Windows\System\DkYtTpf.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\YkmKWLs.exe
  C:\Windows\System\YkmKWLs.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\GvOdDnS.exe
  C:\Windows\System\GvOdDnS.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\hVfYgPK.exe
  C:\Windows\System\hVfYgPK.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\YATVlXk.exe
  C:\Windows\System\YATVlXk.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\JHywxMA.exe
  C:\Windows\System\JHywxMA.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\PSUUTtD.exe
  C:\Windows\System\PSUUTtD.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\KEItqHN.exe
  C:\Windows\System\KEItqHN.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\KOOZxkz.exe
  C:\Windows\System\KOOZxkz.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\uYSBXdt.exe
  C:\Windows\System\uYSBXdt.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\pRPBXAY.exe
  C:\Windows\System\pRPBXAY.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System\gbiMtkM.exe
  C:\Windows\System\gbiMtkM.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\qJxsAfm.exe
  C:\Windows\System\qJxsAfm.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\oauqBCk.exe
  C:\Windows\System\oauqBCk.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\aqvkOvX.exe
  C:\Windows\System\aqvkOvX.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\LhubNSd.exe
  C:\Windows\System\LhubNSd.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\TArCfUw.exe
  C:\Windows\System\TArCfUw.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\nhoOWdd.exe
  C:\Windows\System\nhoOWdd.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\soYFQPg.exe
  C:\Windows\System\soYFQPg.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\FhCnTxN.exe
  C:\Windows\System\FhCnTxN.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\JOLXTee.exe
  C:\Windows\System\JOLXTee.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\axTEEOI.exe
  C:\Windows\System\axTEEOI.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\unebvyA.exe
  C:\Windows\System\unebvyA.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\sTXFUHy.exe
  C:\Windows\System\sTXFUHy.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\WQsjSjU.exe
  C:\Windows\System\WQsjSjU.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\WPXOdrJ.exe
  C:\Windows\System\WPXOdrJ.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\qRjcoFs.exe
  C:\Windows\System\qRjcoFs.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\RSsRXmN.exe
  C:\Windows\System\RSsRXmN.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\lkvRPvn.exe
  C:\Windows\System\lkvRPvn.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\CmjxJLn.exe
  C:\Windows\System\CmjxJLn.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\jLKjawD.exe
  C:\Windows\System\jLKjawD.exe
  2⤵
  - Executes dropped EXE
  PID:3816
- C:\Windows\System\hnOwUcw.exe
  C:\Windows\System\hnOwUcw.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\zZVtxOR.exe
  C:\Windows\System\zZVtxOR.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\bzjxXqe.exe
  C:\Windows\System\bzjxXqe.exe
  2⤵
  - Executes dropped EXE
  PID:716
- C:\Windows\System\PlQtrEY.exe
  C:\Windows\System\PlQtrEY.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\NirtplF.exe
  C:\Windows\System\NirtplF.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\AFbCvkm.exe
  C:\Windows\System\AFbCvkm.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\mbzRREj.exe
  C:\Windows\System\mbzRREj.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\uFshogj.exe
  C:\Windows\System\uFshogj.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\ytYUkVM.exe
  C:\Windows\System\ytYUkVM.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\lZyfQXE.exe
  C:\Windows\System\lZyfQXE.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\hvokUWN.exe
  C:\Windows\System\hvokUWN.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\MuhIRlN.exe
  C:\Windows\System\MuhIRlN.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\hgfspaL.exe
  C:\Windows\System\hgfspaL.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\jBTeokl.exe
  C:\Windows\System\jBTeokl.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\iKtNwru.exe
  C:\Windows\System\iKtNwru.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\LyqypXp.exe
  C:\Windows\System\LyqypXp.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\UqBmsms.exe
  C:\Windows\System\UqBmsms.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\YYgFGXx.exe
  C:\Windows\System\YYgFGXx.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\FAIqZzA.exe
  C:\Windows\System\FAIqZzA.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System\voZcpHC.exe
  C:\Windows\System\voZcpHC.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\eLKkQLR.exe
  C:\Windows\System\eLKkQLR.exe
  2⤵
  PID:4392
- C:\Windows\System\UKwjAXB.exe
  C:\Windows\System\UKwjAXB.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\pmegepZ.exe
  C:\Windows\System\pmegepZ.exe
  2⤵
  PID:3012
- C:\Windows\System\TGiyZrq.exe
  C:\Windows\System\TGiyZrq.exe
  2⤵
  PID:1388
- C:\Windows\System\SauvgFq.exe
  C:\Windows\System\SauvgFq.exe
  2⤵
  PID:2500
- C:\Windows\System\zeRSWjn.exe
  C:\Windows\System\zeRSWjn.exe
  2⤵
  PID:1132
- C:\Windows\System\gVZAQKC.exe
  C:\Windows\System\gVZAQKC.exe
  2⤵
  PID:1844
- C:\Windows\System\yZLDqHp.exe
  C:\Windows\System\yZLDqHp.exe
  2⤵
  PID:1916
- C:\Windows\System\LuULeSV.exe
  C:\Windows\System\LuULeSV.exe
  2⤵
  PID:1444
- C:\Windows\System\XzXGXaX.exe
  C:\Windows\System\XzXGXaX.exe
  2⤵
  PID:720
- C:\Windows\System\pfKxBfP.exe
  C:\Windows\System\pfKxBfP.exe
  2⤵
  PID:4904
- C:\Windows\System\WfLrElY.exe
  C:\Windows\System\WfLrElY.exe
  2⤵
  PID:4604
- C:\Windows\System\ehZlKfd.exe
  C:\Windows\System\ehZlKfd.exe
  2⤵
  PID:2232
- C:\Windows\System\CCDQqgh.exe
  C:\Windows\System\CCDQqgh.exe
  2⤵
  PID:4232
- C:\Windows\System\QGoyhnq.exe
  C:\Windows\System\QGoyhnq.exe
  2⤵
  PID:4080
- C:\Windows\System\rJMuloS.exe
  C:\Windows\System\rJMuloS.exe
  2⤵
  PID:2388
- C:\Windows\System\qstphum.exe
  C:\Windows\System\qstphum.exe
  2⤵
  PID:5128
- C:\Windows\System\mLFOcnj.exe
  C:\Windows\System\mLFOcnj.exe
  2⤵
  PID:5144
- C:\Windows\System\VtVJGET.exe
  C:\Windows\System\VtVJGET.exe
  2⤵
  PID:5164
- C:\Windows\System\zDrpNmB.exe
  C:\Windows\System\zDrpNmB.exe
  2⤵
  PID:5180
- C:\Windows\System\dMRucVk.exe
  C:\Windows\System\dMRucVk.exe
  2⤵
  PID:5200
- C:\Windows\System\szVoOsa.exe
  C:\Windows\System\szVoOsa.exe
  2⤵
  PID:5216
- C:\Windows\System\XZIbiyo.exe
  C:\Windows\System\XZIbiyo.exe
  2⤵
  PID:5240
- C:\Windows\System\VUPVbEB.exe
  C:\Windows\System\VUPVbEB.exe
  2⤵
  PID:5260
- C:\Windows\System\JTtivJv.exe
  C:\Windows\System\JTtivJv.exe
  2⤵
  PID:5280
- C:\Windows\System\NJGwKpV.exe
  C:\Windows\System\NJGwKpV.exe
  2⤵
  PID:5296
- C:\Windows\System\PilelTo.exe
  C:\Windows\System\PilelTo.exe
  2⤵
  PID:5312
- C:\Windows\System\UMcfQMI.exe
  C:\Windows\System\UMcfQMI.exe
  2⤵
  PID:5336
- C:\Windows\System\AZwfwTK.exe
  C:\Windows\System\AZwfwTK.exe
  2⤵
  PID:5356
- C:\Windows\System\HjUEZyM.exe
  C:\Windows\System\HjUEZyM.exe
  2⤵
  PID:5376
- C:\Windows\System\zFbqLMU.exe
  C:\Windows\System\zFbqLMU.exe
  2⤵
  PID:5396
- C:\Windows\System\AEiNrRP.exe
  C:\Windows\System\AEiNrRP.exe
  2⤵
  PID:5420
- C:\Windows\System\qlWJmtN.exe
  C:\Windows\System\qlWJmtN.exe
  2⤵
  PID:5488
- C:\Windows\System\wtskkdy.exe
  C:\Windows\System\wtskkdy.exe
  2⤵
  PID:5516
- C:\Windows\System\NODOXmT.exe
  C:\Windows\System\NODOXmT.exe
  2⤵
  PID:5540
- C:\Windows\System\PBcrsRc.exe
  C:\Windows\System\PBcrsRc.exe
  2⤵
  PID:5572
- C:\Windows\System\egBBDvo.exe
  C:\Windows\System\egBBDvo.exe
  2⤵
  PID:5592
- C:\Windows\System\yELWbTe.exe
  C:\Windows\System\yELWbTe.exe
  2⤵
  PID:5616
- C:\Windows\System\jTzsHpt.exe
  C:\Windows\System\jTzsHpt.exe
  2⤵
  PID:5640
- C:\Windows\System\HUiKHpj.exe
  C:\Windows\System\HUiKHpj.exe
  2⤵
  PID:5672
- C:\Windows\System\WlQURkI.exe
  C:\Windows\System\WlQURkI.exe
  2⤵
  PID:5688
- C:\Windows\System\oEYqkGR.exe
  C:\Windows\System\oEYqkGR.exe
  2⤵
  PID:5704
- C:\Windows\System\VCNvkNc.exe
  C:\Windows\System\VCNvkNc.exe
  2⤵
  PID:5760
- C:\Windows\System\wPFYmaF.exe
  C:\Windows\System\wPFYmaF.exe
  2⤵
  PID:5784
- C:\Windows\System\HabyLdj.exe
  C:\Windows\System\HabyLdj.exe
  2⤵
  PID:5804
- C:\Windows\System\twLpcAE.exe
  C:\Windows\System\twLpcAE.exe
  2⤵
  PID:5824
- C:\Windows\System\bjiyMaG.exe
  C:\Windows\System\bjiyMaG.exe
  2⤵
  PID:5840
- C:\Windows\System\vTxJtyv.exe
  C:\Windows\System\vTxJtyv.exe
  2⤵
  PID:5860
- C:\Windows\System\bMGoxYQ.exe
  C:\Windows\System\bMGoxYQ.exe
  2⤵
  PID:5888
- C:\Windows\System\UwAlCIR.exe
  C:\Windows\System\UwAlCIR.exe
  2⤵
  PID:5912
- C:\Windows\System\JhmBsWL.exe
  C:\Windows\System\JhmBsWL.exe
  2⤵
  PID:5932
- C:\Windows\System\KvTKuzq.exe
  C:\Windows\System\KvTKuzq.exe
  2⤵
  PID:5956
- C:\Windows\System\MJgMSlb.exe
  C:\Windows\System\MJgMSlb.exe
  2⤵
  PID:5972
- C:\Windows\System\EBOMjXa.exe
  C:\Windows\System\EBOMjXa.exe
  2⤵
  PID:5996
- C:\Windows\System\UspZaBs.exe
  C:\Windows\System\UspZaBs.exe
  2⤵
  PID:6012
- C:\Windows\System\Rnphmgh.exe
  C:\Windows\System\Rnphmgh.exe
  2⤵
  PID:6116
- C:\Windows\System\aaGyPyU.exe
  C:\Windows\System\aaGyPyU.exe
  2⤵
  PID:6132
- C:\Windows\System\urtarRu.exe
  C:\Windows\System\urtarRu.exe
  2⤵
  PID:3540
- C:\Windows\System\TmWHvYu.exe
  C:\Windows\System\TmWHvYu.exe
  2⤵
  PID:2728
- C:\Windows\System\iIZAmMN.exe
  C:\Windows\System\iIZAmMN.exe
  2⤵
  PID:4032
- C:\Windows\System\ecPHgWf.exe
  C:\Windows\System\ecPHgWf.exe
  2⤵
  PID:1284
- C:\Windows\System\jBVfoTB.exe
  C:\Windows\System\jBVfoTB.exe
  2⤵
  PID:3276
- C:\Windows\System\RCBaPFk.exe
  C:\Windows\System\RCBaPFk.exe
  2⤵
  PID:4840
- C:\Windows\System\CAHOkbJ.exe
  C:\Windows\System\CAHOkbJ.exe
  2⤵
  PID:3008
- C:\Windows\System\oyXsyXw.exe
  C:\Windows\System\oyXsyXw.exe
  2⤵
  PID:5456
- C:\Windows\System\RprXMLV.exe
  C:\Windows\System\RprXMLV.exe
  2⤵
  PID:3216
- C:\Windows\System\cgONqUd.exe
  C:\Windows\System\cgONqUd.exe
  2⤵
  PID:4608
- C:\Windows\System\kpEyKcG.exe
  C:\Windows\System\kpEyKcG.exe
  2⤵
  PID:1360
- C:\Windows\System\ePPZbbU.exe
  C:\Windows\System\ePPZbbU.exe
  2⤵
  PID:1300
- C:\Windows\System\AdqidzA.exe
  C:\Windows\System\AdqidzA.exe
  2⤵
  PID:4348
- C:\Windows\System\rRMVxwD.exe
  C:\Windows\System\rRMVxwD.exe
  2⤵
  PID:940
- C:\Windows\System\sGXBTyf.exe
  C:\Windows\System\sGXBTyf.exe
  2⤵
  PID:1972
- C:\Windows\System\nfpythd.exe
  C:\Windows\System\nfpythd.exe
  2⤵
  PID:3040
- C:\Windows\System\Dhhsyfi.exe
  C:\Windows\System\Dhhsyfi.exe
  2⤵
  PID:1052
- C:\Windows\System\ZXeUiGz.exe
  C:\Windows\System\ZXeUiGz.exe
  2⤵
  PID:1316
- C:\Windows\System\peUuaYh.exe
  C:\Windows\System\peUuaYh.exe
  2⤵
  PID:2332
- C:\Windows\System\QrIPXEW.exe
  C:\Windows\System\QrIPXEW.exe
  2⤵
  PID:5940
- C:\Windows\System\YrZfBNp.exe
  C:\Windows\System\YrZfBNp.exe
  2⤵
  PID:6156
- C:\Windows\System\NFsgzmR.exe
  C:\Windows\System\NFsgzmR.exe
  2⤵
  PID:6176
- C:\Windows\System\GkEEqvt.exe
  C:\Windows\System\GkEEqvt.exe
  2⤵
  PID:6192
- C:\Windows\System\CKiuLps.exe
  C:\Windows\System\CKiuLps.exe
  2⤵
  PID:6228
- C:\Windows\System\asVwxwm.exe
  C:\Windows\System\asVwxwm.exe
  2⤵
  PID:6244
- C:\Windows\System\YREtBst.exe
  C:\Windows\System\YREtBst.exe
  2⤵
  PID:6268
- C:\Windows\System\vOPWAgp.exe
  C:\Windows\System\vOPWAgp.exe
  2⤵
  PID:6284
- C:\Windows\System\JMRORbn.exe
  C:\Windows\System\JMRORbn.exe
  2⤵
  PID:6412
- C:\Windows\System\FqLOUlE.exe
  C:\Windows\System\FqLOUlE.exe
  2⤵
  PID:6436
- C:\Windows\System\QqjmIyo.exe
  C:\Windows\System\QqjmIyo.exe
  2⤵
  PID:6452
- C:\Windows\System\mwIfmKz.exe
  C:\Windows\System\mwIfmKz.exe
  2⤵
  PID:6476
- C:\Windows\System\aJxgljF.exe
  C:\Windows\System\aJxgljF.exe
  2⤵
  PID:6496
- C:\Windows\System\khNBetx.exe
  C:\Windows\System\khNBetx.exe
  2⤵
  PID:6516
- C:\Windows\System\dpcRqxz.exe
  C:\Windows\System\dpcRqxz.exe
  2⤵
  PID:6536
- C:\Windows\System\gRFHnyv.exe
  C:\Windows\System\gRFHnyv.exe
  2⤵
  PID:6556
- C:\Windows\System\SEwlqLz.exe
  C:\Windows\System\SEwlqLz.exe
  2⤵
  PID:6572
- C:\Windows\System\xSmivsp.exe
  C:\Windows\System\xSmivsp.exe
  2⤵
  PID:6596
- C:\Windows\System\HiNTKKu.exe
  C:\Windows\System\HiNTKKu.exe
  2⤵
  PID:6612
- C:\Windows\System\xIHWBJl.exe
  C:\Windows\System\xIHWBJl.exe
  2⤵
  PID:6636
- C:\Windows\System\CHKAzVD.exe
  C:\Windows\System\CHKAzVD.exe
  2⤵
  PID:6652
- C:\Windows\System\XAanUam.exe
  C:\Windows\System\XAanUam.exe
  2⤵
  PID:6680
- C:\Windows\System\rKznLXs.exe
  C:\Windows\System\rKznLXs.exe
  2⤵
  PID:6696
- C:\Windows\System\saCTPAt.exe
  C:\Windows\System\saCTPAt.exe
  2⤵
  PID:6720
- C:\Windows\System\YFljhvq.exe
  C:\Windows\System\YFljhvq.exe
  2⤵
  PID:6736
- C:\Windows\System\hROEhri.exe
  C:\Windows\System\hROEhri.exe
  2⤵
  PID:6760
- C:\Windows\System\BsNEMMy.exe
  C:\Windows\System\BsNEMMy.exe
  2⤵
  PID:6776
- C:\Windows\System\xoPxywX.exe
  C:\Windows\System\xoPxywX.exe
  2⤵
  PID:6800
- C:\Windows\System\SIZXdyx.exe
  C:\Windows\System\SIZXdyx.exe
  2⤵
  PID:6816
- C:\Windows\System\BITBpnq.exe
  C:\Windows\System\BITBpnq.exe
  2⤵
  PID:6844
- C:\Windows\System\faWUbgn.exe
  C:\Windows\System\faWUbgn.exe
  2⤵
  PID:6868
- C:\Windows\System\QcglDtY.exe
  C:\Windows\System\QcglDtY.exe
  2⤵
  PID:6888
- C:\Windows\System\eaHRhJe.exe
  C:\Windows\System\eaHRhJe.exe
  2⤵
  PID:6904
- C:\Windows\System\OaWzQWF.exe
  C:\Windows\System\OaWzQWF.exe
  2⤵
  PID:6924
- C:\Windows\System\dMyATAP.exe
  C:\Windows\System\dMyATAP.exe
  2⤵
  PID:6944
- C:\Windows\System\kyQupGC.exe
  C:\Windows\System\kyQupGC.exe
  2⤵
  PID:6972
- C:\Windows\System\tuWqRkl.exe
  C:\Windows\System\tuWqRkl.exe
  2⤵
  PID:6992
- C:\Windows\System\aNPWHrc.exe
  C:\Windows\System\aNPWHrc.exe
  2⤵
  PID:7008
- C:\Windows\System\oDtpHtJ.exe
  C:\Windows\System\oDtpHtJ.exe
  2⤵
  PID:7024
- C:\Windows\System\OTSimrH.exe
  C:\Windows\System\OTSimrH.exe
  2⤵
  PID:7052
- C:\Windows\System\PZnLTAi.exe
  C:\Windows\System\PZnLTAi.exe
  2⤵
  PID:7072
- C:\Windows\System\zkzAgxX.exe
  C:\Windows\System\zkzAgxX.exe
  2⤵
  PID:7092
- C:\Windows\System\kibPvKH.exe
  C:\Windows\System\kibPvKH.exe
  2⤵
  PID:7108
- C:\Windows\System\iFoseWR.exe
  C:\Windows\System\iFoseWR.exe
  2⤵
  PID:7128
- C:\Windows\System\jembeau.exe
  C:\Windows\System\jembeau.exe
  2⤵
  PID:7152
- C:\Windows\System\uOhQRJw.exe
  C:\Windows\System\uOhQRJw.exe
  2⤵
  PID:5964
- C:\Windows\System\KsUUPug.exe
  C:\Windows\System\KsUUPug.exe
  2⤵
  PID:6024
- C:\Windows\System\MsRhPSD.exe
  C:\Windows\System\MsRhPSD.exe
  2⤵
  PID:5172
- C:\Windows\System\IWQBcFO.exe
  C:\Windows\System\IWQBcFO.exe
  2⤵
  PID:5192
- C:\Windows\System\JRfdPYc.exe
  C:\Windows\System\JRfdPYc.exe
  2⤵
  PID:5252
- C:\Windows\System\hxroZON.exe
  C:\Windows\System\hxroZON.exe
  2⤵
  PID:5288
- C:\Windows\System\xICqFNT.exe
  C:\Windows\System\xICqFNT.exe
  2⤵
  PID:5324
- C:\Windows\System\RgJkRUC.exe
  C:\Windows\System\RgJkRUC.exe
  2⤵
  PID:5772
- C:\Windows\System\HwlgsCB.exe
  C:\Windows\System\HwlgsCB.exe
  2⤵
  PID:5364
- C:\Windows\System\JhLyjPD.exe
  C:\Windows\System\JhLyjPD.exe
  2⤵
  PID:5384
- C:\Windows\System\sbnNdat.exe
  C:\Windows\System\sbnNdat.exe
  2⤵
  PID:5440
- C:\Windows\System\ssyWcLL.exe
  C:\Windows\System\ssyWcLL.exe
  2⤵
  PID:5496
- C:\Windows\System\RibqOfL.exe
  C:\Windows\System\RibqOfL.exe
  2⤵
  PID:5880
- C:\Windows\System\jGhYeRT.exe
  C:\Windows\System\jGhYeRT.exe
  2⤵
  PID:5368
- C:\Windows\System\TcJGHYt.exe
  C:\Windows\System\TcJGHYt.exe
  2⤵
  PID:3404
- C:\Windows\System\WzykBmv.exe
  C:\Windows\System\WzykBmv.exe
  2⤵
  PID:6220
- C:\Windows\System\woFMEwu.exe
  C:\Windows\System\woFMEwu.exe
  2⤵
  PID:6020
- C:\Windows\System\NaJfAFp.exe
  C:\Windows\System\NaJfAFp.exe
  2⤵
  PID:5696
- C:\Windows\System\OHdBKfw.exe
  C:\Windows\System\OHdBKfw.exe
  2⤵
  PID:5732
- C:\Windows\System\UJIrSTr.exe
  C:\Windows\System\UJIrSTr.exe
  2⤵
  PID:1588
- C:\Windows\System\hyAyiVn.exe
  C:\Windows\System\hyAyiVn.exe
  2⤵
  PID:5868
- C:\Windows\System\fEqzoYQ.exe
  C:\Windows\System\fEqzoYQ.exe
  2⤵
  PID:6828
- C:\Windows\System\FXCAuho.exe
  C:\Windows\System\FXCAuho.exe
  2⤵
  PID:7180
- C:\Windows\System\RbYayZc.exe
  C:\Windows\System\RbYayZc.exe
  2⤵
  PID:7196
- C:\Windows\System\yEjUCdG.exe
  C:\Windows\System\yEjUCdG.exe
  2⤵
  PID:7216
- C:\Windows\System\GMvVtuc.exe
  C:\Windows\System\GMvVtuc.exe
  2⤵
  PID:7240
- C:\Windows\System\GwOGsez.exe
  C:\Windows\System\GwOGsez.exe
  2⤵
  PID:7256
- C:\Windows\System\vomTWDm.exe
  C:\Windows\System\vomTWDm.exe
  2⤵
  PID:7280
- C:\Windows\System\xkKwLPc.exe
  C:\Windows\System\xkKwLPc.exe
  2⤵
  PID:7300
- C:\Windows\System\CAFnBln.exe
  C:\Windows\System\CAFnBln.exe
  2⤵
  PID:7324
- C:\Windows\System\gMkfsnx.exe
  C:\Windows\System\gMkfsnx.exe
  2⤵
  PID:7340
- C:\Windows\System\TqZNBOU.exe
  C:\Windows\System\TqZNBOU.exe
  2⤵
  PID:7364
- C:\Windows\System\YSXEqYA.exe
  C:\Windows\System\YSXEqYA.exe
  2⤵
  PID:7384
- C:\Windows\System\iKEIBzA.exe
  C:\Windows\System\iKEIBzA.exe
  2⤵
  PID:7404
- C:\Windows\System\QxvpHJR.exe
  C:\Windows\System\QxvpHJR.exe
  2⤵
  PID:7420
- C:\Windows\System\RxaUjFc.exe
  C:\Windows\System\RxaUjFc.exe
  2⤵
  PID:7452
- C:\Windows\System\rqIbfXd.exe
  C:\Windows\System\rqIbfXd.exe
  2⤵
  PID:7472
- C:\Windows\System\wTwWauN.exe
  C:\Windows\System\wTwWauN.exe
  2⤵
  PID:7492
- C:\Windows\System\zQxsGJj.exe
  C:\Windows\System\zQxsGJj.exe
  2⤵
  PID:7508
- C:\Windows\System\EtxOwGo.exe
  C:\Windows\System\EtxOwGo.exe
  2⤵
  PID:7524
- C:\Windows\System\gAfXkyi.exe
  C:\Windows\System\gAfXkyi.exe
  2⤵
  PID:7544
- C:\Windows\System\AZAsYYH.exe
  C:\Windows\System\AZAsYYH.exe
  2⤵
  PID:7564
- C:\Windows\System\sxhaaZJ.exe
  C:\Windows\System\sxhaaZJ.exe
  2⤵
  PID:7580
- C:\Windows\System\EDbKHwJ.exe
  C:\Windows\System\EDbKHwJ.exe
  2⤵
  PID:7604
- C:\Windows\System\TCVqEMw.exe
  C:\Windows\System\TCVqEMw.exe
  2⤵
  PID:7620
- C:\Windows\System\TZJZXfu.exe
  C:\Windows\System\TZJZXfu.exe
  2⤵
  PID:7644
- C:\Windows\System\NoWucdL.exe
  C:\Windows\System\NoWucdL.exe
  2⤵
  PID:7660
- C:\Windows\System\xIeFqtc.exe
  C:\Windows\System\xIeFqtc.exe
  2⤵
  PID:7684
- C:\Windows\System\OKLpIys.exe
  C:\Windows\System\OKLpIys.exe
  2⤵
  PID:7704
- C:\Windows\System\YEYVkXZ.exe
  C:\Windows\System\YEYVkXZ.exe
  2⤵
  PID:7728
- C:\Windows\System\PVgmKBC.exe
  C:\Windows\System\PVgmKBC.exe
  2⤵
  PID:7744
- C:\Windows\System\CTcaqIx.exe
  C:\Windows\System\CTcaqIx.exe
  2⤵
  PID:7768
- C:\Windows\System\rvECNCJ.exe
  C:\Windows\System\rvECNCJ.exe
  2⤵
  PID:7784
- C:\Windows\System\HVWYSBc.exe
  C:\Windows\System\HVWYSBc.exe
  2⤵
  PID:7808
- C:\Windows\System\quaxxpq.exe
  C:\Windows\System\quaxxpq.exe
  2⤵
  PID:7824
- C:\Windows\System\FJGoDok.exe
  C:\Windows\System\FJGoDok.exe
  2⤵
  PID:7864
- C:\Windows\System\euJtbhg.exe
  C:\Windows\System\euJtbhg.exe
  2⤵
  PID:7880
- C:\Windows\System\OjVhwtG.exe
  C:\Windows\System\OjVhwtG.exe
  2⤵
  PID:7904
- C:\Windows\System\AaWKfkG.exe
  C:\Windows\System\AaWKfkG.exe
  2⤵
  PID:7920
- C:\Windows\System\zyjavFG.exe
  C:\Windows\System\zyjavFG.exe
  2⤵
  PID:7944
- C:\Windows\System\wxInJrm.exe
  C:\Windows\System\wxInJrm.exe
  2⤵
  PID:7964
- C:\Windows\System\xUIyUeH.exe
  C:\Windows\System\xUIyUeH.exe
  2⤵
  PID:8012
- C:\Windows\System\RApgGKx.exe
  C:\Windows\System\RApgGKx.exe
  2⤵
  PID:8032
- C:\Windows\System\CYvImDH.exe
  C:\Windows\System\CYvImDH.exe
  2⤵
  PID:8048
- C:\Windows\System\DRTkaHu.exe
  C:\Windows\System\DRTkaHu.exe
  2⤵
  PID:8072
- C:\Windows\System\BkVtQMs.exe
  C:\Windows\System\BkVtQMs.exe
  2⤵
  PID:8088
- C:\Windows\System\FDYhuhU.exe
  C:\Windows\System\FDYhuhU.exe
  2⤵
  PID:8112
- C:\Windows\System\IJQubrZ.exe
  C:\Windows\System\IJQubrZ.exe
  2⤵
  PID:8128
- C:\Windows\System\vzYunRR.exe
  C:\Windows\System\vzYunRR.exe
  2⤵
  PID:8152
- C:\Windows\System\jtEMFii.exe
  C:\Windows\System\jtEMFii.exe
  2⤵
  PID:8172
- C:\Windows\System\eVsvaGJ.exe
  C:\Windows\System\eVsvaGJ.exe
  2⤵
  PID:6864
- C:\Windows\System\GhfkBZd.exe
  C:\Windows\System\GhfkBZd.exe
  2⤵
  PID:5900
- C:\Windows\System\bwZQzjy.exe
  C:\Windows\System\bwZQzjy.exe
  2⤵
  PID:6940
- C:\Windows\System\ShXLAPr.exe
  C:\Windows\System\ShXLAPr.exe
  2⤵
  PID:1980
- C:\Windows\System\HktUZAu.exe
  C:\Windows\System\HktUZAu.exe
  2⤵
  PID:7004
- C:\Windows\System\iuPchGJ.exe
  C:\Windows\System\iuPchGJ.exe
  2⤵
  PID:5924
- C:\Windows\System\USgKMsk.exe
  C:\Windows\System\USgKMsk.exe
  2⤵
  PID:7104
- C:\Windows\System\VcIElpj.exe
  C:\Windows\System\VcIElpj.exe
  2⤵
  PID:5140
- C:\Windows\System\vbdTfxb.exe
  C:\Windows\System\vbdTfxb.exe
  2⤵
  PID:5268
- C:\Windows\System\NBzuPPH.exe
  C:\Windows\System\NBzuPPH.exe
  2⤵
  PID:6276
- C:\Windows\System\XcmVFmy.exe
  C:\Windows\System\XcmVFmy.exe
  2⤵
  PID:5816
- C:\Windows\System\AHdGvMm.exe
  C:\Windows\System\AHdGvMm.exe
  2⤵
  PID:6060
- C:\Windows\System\jTfcjbE.exe
  C:\Windows\System\jTfcjbE.exe
  2⤵
  PID:6096
- C:\Windows\System\pMfVMdI.exe
  C:\Windows\System\pMfVMdI.exe
  2⤵
  PID:4428
- C:\Windows\System\poLovHL.exe
  C:\Windows\System\poLovHL.exe
  2⤵
  PID:1320
- C:\Windows\System\GwSwFIK.exe
  C:\Windows\System\GwSwFIK.exe
  2⤵
  PID:6796
- C:\Windows\System\GbLuSpP.exe
  C:\Windows\System\GbLuSpP.exe
  2⤵
  PID:6772
- C:\Windows\System\vOWZHNC.exe
  C:\Windows\System\vOWZHNC.exe
  2⤵
  PID:7176
- C:\Windows\System\kGwRaoR.exe
  C:\Windows\System\kGwRaoR.exe
  2⤵
  PID:7276
- C:\Windows\System\TFykHYq.exe
  C:\Windows\System\TFykHYq.exe
  2⤵
  PID:8220
- C:\Windows\System\EYauBBE.exe
  C:\Windows\System\EYauBBE.exe
  2⤵
  PID:8236
- C:\Windows\System\uuWOdWe.exe
  C:\Windows\System\uuWOdWe.exe
  2⤵
  PID:8260
- C:\Windows\System\tQZOrFu.exe
  C:\Windows\System\tQZOrFu.exe
  2⤵
  PID:8276
- C:\Windows\System\KPERxeD.exe
  C:\Windows\System\KPERxeD.exe
  2⤵
  PID:8300
- C:\Windows\System\MtCoFbT.exe
  C:\Windows\System\MtCoFbT.exe
  2⤵
  PID:8324
- C:\Windows\System\eiqKONm.exe
  C:\Windows\System\eiqKONm.exe
  2⤵
  PID:8344
- C:\Windows\System\ekilNqo.exe
  C:\Windows\System\ekilNqo.exe
  2⤵
  PID:8368
- C:\Windows\System\TmfXEuH.exe
  C:\Windows\System\TmfXEuH.exe
  2⤵
  PID:8384
- C:\Windows\System\anUwUoY.exe
  C:\Windows\System\anUwUoY.exe
  2⤵
  PID:8408
- C:\Windows\System\RqadnWl.exe
  C:\Windows\System\RqadnWl.exe
  2⤵
  PID:8424
- C:\Windows\System\kSposDz.exe
  C:\Windows\System\kSposDz.exe
  2⤵
  PID:8448
- C:\Windows\System\LlyqotI.exe
  C:\Windows\System\LlyqotI.exe
  2⤵
  PID:8464
- C:\Windows\System\KxyMajZ.exe
  C:\Windows\System\KxyMajZ.exe
  2⤵
  PID:8488
- C:\Windows\System\akdzrMm.exe
  C:\Windows\System\akdzrMm.exe
  2⤵
  PID:8512
- C:\Windows\System\WJedzNP.exe
  C:\Windows\System\WJedzNP.exe
  2⤵
  PID:8528
- C:\Windows\System\UmMwbOM.exe
  C:\Windows\System\UmMwbOM.exe
  2⤵
  PID:8548
- C:\Windows\System\XzPEbRX.exe
  C:\Windows\System\XzPEbRX.exe
  2⤵
  PID:8572
- C:\Windows\System\xKLkTtT.exe
  C:\Windows\System\xKLkTtT.exe
  2⤵
  PID:8592
- C:\Windows\System\QhcLJhc.exe
  C:\Windows\System\QhcLJhc.exe
  2⤵
  PID:8616
- C:\Windows\System\PefEOUz.exe
  C:\Windows\System\PefEOUz.exe
  2⤵
  PID:8632
- C:\Windows\System\ZRjFpVg.exe
  C:\Windows\System\ZRjFpVg.exe
  2⤵
  PID:8664
- C:\Windows\System\bckXsUV.exe
  C:\Windows\System\bckXsUV.exe
  2⤵
  PID:8684
- C:\Windows\System\BTuTHsy.exe
  C:\Windows\System\BTuTHsy.exe
  2⤵
  PID:8708
- C:\Windows\System\kARKOTZ.exe
  C:\Windows\System\kARKOTZ.exe
  2⤵
  PID:8732
- C:\Windows\System\GEDLpxy.exe
  C:\Windows\System\GEDLpxy.exe
  2⤵
  PID:8752
- C:\Windows\System\okIQKek.exe
  C:\Windows\System\okIQKek.exe
  2⤵
  PID:8780
- C:\Windows\System\TSrgIhm.exe
  C:\Windows\System\TSrgIhm.exe
  2⤵
  PID:8800
- C:\Windows\System\PbrScRs.exe
  C:\Windows\System\PbrScRs.exe
  2⤵
  PID:8816
- C:\Windows\System\mvFaMjl.exe
  C:\Windows\System\mvFaMjl.exe
  2⤵
  PID:8856
- C:\Windows\System\loGyaZp.exe
  C:\Windows\System\loGyaZp.exe
  2⤵
  PID:8880
- C:\Windows\System\qkIVaxz.exe
  C:\Windows\System\qkIVaxz.exe
  2⤵
  PID:8896
- C:\Windows\System\DiggWNU.exe
  C:\Windows\System\DiggWNU.exe
  2⤵
  PID:8920
- C:\Windows\System\OkidQJU.exe
  C:\Windows\System\OkidQJU.exe
  2⤵
  PID:8936
- C:\Windows\System\YnywqJF.exe
  C:\Windows\System\YnywqJF.exe
  2⤵
  PID:8960
- C:\Windows\System\FJtXUxD.exe
  C:\Windows\System\FJtXUxD.exe
  2⤵
  PID:8996
- C:\Windows\System\PbCMbJW.exe
  C:\Windows\System\PbCMbJW.exe
  2⤵
  PID:9012
- C:\Windows\System\lHgSMFR.exe
  C:\Windows\System\lHgSMFR.exe
  2⤵
  PID:9028
- C:\Windows\System\pBLJnZx.exe
  C:\Windows\System\pBLJnZx.exe
  2⤵
  PID:9048
- C:\Windows\System\ZhTmHgQ.exe
  C:\Windows\System\ZhTmHgQ.exe
  2⤵
  PID:9068
- C:\Windows\System\LIHxWrG.exe
  C:\Windows\System\LIHxWrG.exe
  2⤵
  PID:9092
- C:\Windows\System\hRjtONa.exe
  C:\Windows\System\hRjtONa.exe
  2⤵
  PID:9112
- C:\Windows\System\soNTYXB.exe
  C:\Windows\System\soNTYXB.exe
  2⤵
  PID:9132
- C:\Windows\System\nsCrRXn.exe
  C:\Windows\System\nsCrRXn.exe
  2⤵
  PID:9148
- C:\Windows\System\aNfdBIz.exe
  C:\Windows\System\aNfdBIz.exe
  2⤵
  PID:9180
- C:\Windows\System\rSUmKpE.exe
  C:\Windows\System\rSUmKpE.exe
  2⤵
  PID:9200
- C:\Windows\System\tUhoWHn.exe
  C:\Windows\System\tUhoWHn.exe
  2⤵
  PID:7348
- C:\Windows\System\HlrwybS.exe
  C:\Windows\System\HlrwybS.exe
  2⤵
  PID:4664
- C:\Windows\System\RrjrDzB.exe
  C:\Windows\System\RrjrDzB.exe
  2⤵
  PID:7396
- C:\Windows\System\qzUGekp.exe
  C:\Windows\System\qzUGekp.exe
  2⤵
  PID:7468
- C:\Windows\System\GxeYtgn.exe
  C:\Windows\System\GxeYtgn.exe
  2⤵
  PID:7500
- C:\Windows\System\foxRLug.exe
  C:\Windows\System\foxRLug.exe
  2⤵
  PID:6172
- C:\Windows\System\LqhtLfg.exe
  C:\Windows\System\LqhtLfg.exe
  2⤵
  PID:7656
- C:\Windows\System\kOQvhZt.exe
  C:\Windows\System\kOQvhZt.exe
  2⤵
  PID:6252
- C:\Windows\System\ylwwpJp.exe
  C:\Windows\System\ylwwpJp.exe
  2⤵
  PID:7760
- C:\Windows\System\isejSIx.exe
  C:\Windows\System\isejSIx.exe
  2⤵
  PID:6296
- C:\Windows\System\lvdUIhF.exe
  C:\Windows\System\lvdUIhF.exe
  2⤵
  PID:4424
- C:\Windows\System\fhwatjj.exe
  C:\Windows\System\fhwatjj.exe
  2⤵
  PID:1688
- C:\Windows\System\jQIgWeu.exe
  C:\Windows\System\jQIgWeu.exe
  2⤵
  PID:6428
- C:\Windows\System\EMuSyFm.exe
  C:\Windows\System\EMuSyFm.exe
  2⤵
  PID:6472
- C:\Windows\System\LgwrIHN.exe
  C:\Windows\System\LgwrIHN.exe
  2⤵
  PID:6512
- C:\Windows\System\owlNkkL.exe
  C:\Windows\System\owlNkkL.exe
  2⤵
  PID:6552
- C:\Windows\System\ogcdkiu.exe
  C:\Windows\System\ogcdkiu.exe
  2⤵
  PID:6592
- C:\Windows\System\nMKlVtR.exe
  C:\Windows\System\nMKlVtR.exe
  2⤵
  PID:6632
- C:\Windows\System\wpqkxeS.exe
  C:\Windows\System\wpqkxeS.exe
  2⤵
  PID:6688
- C:\Windows\System\ZrWNksG.exe
  C:\Windows\System\ZrWNksG.exe
  2⤵
  PID:6716
- C:\Windows\System\yIsOsbF.exe
  C:\Windows\System\yIsOsbF.exe
  2⤵
  PID:8044
- C:\Windows\System\bLEPAoS.exe
  C:\Windows\System\bLEPAoS.exe
  2⤵
  PID:5680
- C:\Windows\System\vuuGweS.exe
  C:\Windows\System\vuuGweS.exe
  2⤵
  PID:8136
- C:\Windows\System\QqmjBtq.exe
  C:\Windows\System\QqmjBtq.exe
  2⤵
  PID:1464
- C:\Windows\System\QBSuzhe.exe
  C:\Windows\System\QBSuzhe.exe
  2⤵
  PID:3320
- C:\Windows\System\JaTfbmo.exe
  C:\Windows\System\JaTfbmo.exe
  2⤵
  PID:7068
- C:\Windows\System\jNPxZBd.exe
  C:\Windows\System\jNPxZBd.exe
  2⤵
  PID:7212
- C:\Windows\System\EpZeyrm.exe
  C:\Windows\System\EpZeyrm.exe
  2⤵
  PID:7252
- C:\Windows\System\ywUsaBz.exe
  C:\Windows\System\ywUsaBz.exe
  2⤵
  PID:9224
- C:\Windows\System\UcrFCjj.exe
  C:\Windows\System\UcrFCjj.exe
  2⤵
  PID:9252
- C:\Windows\System\OoqsleT.exe
  C:\Windows\System\OoqsleT.exe
  2⤵
  PID:9272
- C:\Windows\System\iLtyJkc.exe
  C:\Windows\System\iLtyJkc.exe
  2⤵
  PID:9292
- C:\Windows\System\PDBBSmX.exe
  C:\Windows\System\PDBBSmX.exe
  2⤵
  PID:9312
- C:\Windows\System\NebNQqM.exe
  C:\Windows\System\NebNQqM.exe
  2⤵
  PID:9336
- C:\Windows\System\zNZAShX.exe
  C:\Windows\System\zNZAShX.exe
  2⤵
  PID:9356
- C:\Windows\System\NUSTULX.exe
  C:\Windows\System\NUSTULX.exe
  2⤵
  PID:9376
- C:\Windows\System\PphCTYu.exe
  C:\Windows\System\PphCTYu.exe
  2⤵
  PID:9392
- C:\Windows\System\wbvUqrj.exe
  C:\Windows\System\wbvUqrj.exe
  2⤵
  PID:9416
- C:\Windows\System\YxDcorf.exe
  C:\Windows\System\YxDcorf.exe
  2⤵
  PID:9440
- C:\Windows\System\HHjZgMg.exe
  C:\Windows\System\HHjZgMg.exe
  2⤵
  PID:9456
- C:\Windows\System\ACVATZQ.exe
  C:\Windows\System\ACVATZQ.exe
  2⤵
  PID:9480
- C:\Windows\System\NebKBZo.exe
  C:\Windows\System\NebKBZo.exe
  2⤵
  PID:9504
- C:\Windows\System\LknOtMe.exe
  C:\Windows\System\LknOtMe.exe
  2⤵
  PID:9524
- C:\Windows\System\AyenaaA.exe
  C:\Windows\System\AyenaaA.exe
  2⤵
  PID:9556
- C:\Windows\System\auGQxic.exe
  C:\Windows\System\auGQxic.exe
  2⤵
  PID:9576
- C:\Windows\System\KQOuTSO.exe
  C:\Windows\System\KQOuTSO.exe
  2⤵
  PID:9600
- C:\Windows\System\YKuCJPp.exe
  C:\Windows\System\YKuCJPp.exe
  2⤵
  PID:9620
- C:\Windows\System\KEisOzR.exe
  C:\Windows\System\KEisOzR.exe
  2⤵
  PID:9640
- C:\Windows\System\MBSvWyU.exe
  C:\Windows\System\MBSvWyU.exe
  2⤵
  PID:9664
- C:\Windows\System\nWubNQv.exe
  C:\Windows\System\nWubNQv.exe
  2⤵
  PID:9684
- C:\Windows\System\jvYXcKB.exe
  C:\Windows\System\jvYXcKB.exe
  2⤵
  PID:9700
- C:\Windows\System\nYdJjaP.exe
  C:\Windows\System\nYdJjaP.exe
  2⤵
  PID:9724
- C:\Windows\System\OaPXokx.exe
  C:\Windows\System\OaPXokx.exe
  2⤵
  PID:9748
- C:\Windows\System\NXCGHAG.exe
  C:\Windows\System\NXCGHAG.exe
  2⤵
  PID:9764
- C:\Windows\System\uHHveOi.exe
  C:\Windows\System\uHHveOi.exe
  2⤵
  PID:9788
- C:\Windows\System\pzcWymt.exe
  C:\Windows\System\pzcWymt.exe
  2⤵
  PID:9804
- C:\Windows\System\jRzqWPe.exe
  C:\Windows\System\jRzqWPe.exe
  2⤵
  PID:9820
- C:\Windows\System\FGmsrYx.exe
  C:\Windows\System\FGmsrYx.exe
  2⤵
  PID:9840
- C:\Windows\System\lutahrq.exe
  C:\Windows\System\lutahrq.exe
  2⤵
  PID:9864
- C:\Windows\System\ohLpOkn.exe
  C:\Windows\System\ohLpOkn.exe
  2⤵
  PID:9880
- C:\Windows\System\yUMntpA.exe
  C:\Windows\System\yUMntpA.exe
  2⤵
  PID:9900
- C:\Windows\System\LPoMgCV.exe
  C:\Windows\System\LPoMgCV.exe
  2⤵
  PID:9924
- C:\Windows\System\jiEwUZA.exe
  C:\Windows\System\jiEwUZA.exe
  2⤵
  PID:9944
- C:\Windows\System\WdmnsLa.exe
  C:\Windows\System\WdmnsLa.exe
  2⤵
  PID:9960
- C:\Windows\System\QGTHkmL.exe
  C:\Windows\System\QGTHkmL.exe
  2⤵
  PID:9988
- C:\Windows\System\tTTrnOr.exe
  C:\Windows\System\tTTrnOr.exe
  2⤵
  PID:10016
- C:\Windows\System\cEYHQkV.exe
  C:\Windows\System\cEYHQkV.exe
  2⤵
  PID:10032
- C:\Windows\System\vFzddzS.exe
  C:\Windows\System\vFzddzS.exe
  2⤵
  PID:10056
- C:\Windows\System\uoEysUu.exe
  C:\Windows\System\uoEysUu.exe
  2⤵
  PID:10076
- C:\Windows\System\xJicvwF.exe
  C:\Windows\System\xJicvwF.exe
  2⤵
  PID:10096
- C:\Windows\System\PUBZVIZ.exe
  C:\Windows\System\PUBZVIZ.exe
  2⤵
  PID:10112
- C:\Windows\System\mOQgbbo.exe
  C:\Windows\System\mOQgbbo.exe
  2⤵
  PID:10128
- C:\Windows\System\HJWhpHO.exe
  C:\Windows\System\HJWhpHO.exe
  2⤵
  PID:10144
- C:\Windows\System\jZksFct.exe
  C:\Windows\System\jZksFct.exe
  2⤵
  PID:10164
- C:\Windows\System\OuQSBSi.exe
  C:\Windows\System\OuQSBSi.exe
  2⤵
  PID:10188
- C:\Windows\System\OCKYMJU.exe
  C:\Windows\System\OCKYMJU.exe
  2⤵
  PID:10204
- C:\Windows\System\msWhvNL.exe
  C:\Windows\System\msWhvNL.exe
  2⤵
  PID:10232
- C:\Windows\System\PYZjuDi.exe
  C:\Windows\System\PYZjuDi.exe
  2⤵
  PID:6748
- C:\Windows\System\UtBLbIs.exe
  C:\Windows\System\UtBLbIs.exe
  2⤵
  PID:8252
- C:\Windows\System\HVFaedS.exe
  C:\Windows\System\HVFaedS.exe
  2⤵
  PID:7020
- C:\Windows\System\kwaQDgQ.exe
  C:\Windows\System\kwaQDgQ.exe
  2⤵
  PID:7044
- C:\Windows\System\LCTpjip.exe
  C:\Windows\System\LCTpjip.exe
  2⤵
  PID:8392
- C:\Windows\System\cMeikGP.exe
  C:\Windows\System\cMeikGP.exe
  2⤵
  PID:7480
- C:\Windows\System\eIhMjkb.exe
  C:\Windows\System\eIhMjkb.exe
  2⤵
  PID:7536
- C:\Windows\System\jaTUubp.exe
  C:\Windows\System\jaTUubp.exe
  2⤵
  PID:8536
- C:\Windows\System\VtAHyfw.exe
  C:\Windows\System\VtAHyfw.exe
  2⤵
  PID:8604
- C:\Windows\System\pWyjGpm.exe
  C:\Windows\System\pWyjGpm.exe
  2⤵
  PID:5412
- C:\Windows\System\hRkjQFQ.exe
  C:\Windows\System\hRkjQFQ.exe
  2⤵
  PID:5472
- C:\Windows\System\GueDSiL.exe
  C:\Windows\System\GueDSiL.exe
  2⤵
  PID:1612
- C:\Windows\System\VpXjNxs.exe
  C:\Windows\System\VpXjNxs.exe
  2⤵
  PID:10248
- C:\Windows\System\FWLDnJQ.exe
  C:\Windows\System\FWLDnJQ.exe
  2⤵
  PID:10268
- C:\Windows\System\dUfEmsF.exe
  C:\Windows\System\dUfEmsF.exe
  2⤵
  PID:10288
- C:\Windows\System\RilEdDs.exe
  C:\Windows\System\RilEdDs.exe
  2⤵
  PID:10308
- C:\Windows\System\bdVShMp.exe
  C:\Windows\System\bdVShMp.exe
  2⤵
  PID:10332
- C:\Windows\System\nTYUiza.exe
  C:\Windows\System\nTYUiza.exe
  2⤵
  PID:10348
- C:\Windows\System\TKmFgXX.exe
  C:\Windows\System\TKmFgXX.exe
  2⤵
  PID:10364
- C:\Windows\System\rcSiXhy.exe
  C:\Windows\System\rcSiXhy.exe
  2⤵
  PID:10384
- C:\Windows\System\yYuKxek.exe
  C:\Windows\System\yYuKxek.exe
  2⤵
  PID:10408
- C:\Windows\System\tcpsDlk.exe
  C:\Windows\System\tcpsDlk.exe
  2⤵
  PID:10424
- C:\Windows\System\KPdAfVF.exe
  C:\Windows\System\KPdAfVF.exe
  2⤵
  PID:10444
- C:\Windows\System\TAOOpZE.exe
  C:\Windows\System\TAOOpZE.exe
  2⤵
  PID:10460
- C:\Windows\System\MnOdJqH.exe
  C:\Windows\System\MnOdJqH.exe
  2⤵
  PID:10480
- C:\Windows\System\uEaPZRs.exe
  C:\Windows\System\uEaPZRs.exe
  2⤵
  PID:10500
- C:\Windows\System\VNEzfNo.exe
  C:\Windows\System\VNEzfNo.exe
  2⤵
  PID:10524
- C:\Windows\System\cLbartW.exe
  C:\Windows\System\cLbartW.exe
  2⤵
  PID:10544
- C:\Windows\System\qNiPyVS.exe
  C:\Windows\System\qNiPyVS.exe
  2⤵
  PID:10560
- C:\Windows\System\SBZehJi.exe
  C:\Windows\System\SBZehJi.exe
  2⤵
  PID:10584
- C:\Windows\System\EyGOPLo.exe
  C:\Windows\System\EyGOPLo.exe
  2⤵
  PID:10604
- C:\Windows\System\CZiqLMv.exe
  C:\Windows\System\CZiqLMv.exe
  2⤵
  PID:10632
- C:\Windows\System\AYtPknL.exe
  C:\Windows\System\AYtPknL.exe
  2⤵
  PID:10660
- C:\Windows\System\OFknGcy.exe
  C:\Windows\System\OFknGcy.exe
  2⤵
  PID:10680
- C:\Windows\System\gBmQnWE.exe
  C:\Windows\System\gBmQnWE.exe
  2⤵
  PID:10704
- C:\Windows\System\yRusLEu.exe
  C:\Windows\System\yRusLEu.exe
  2⤵
  PID:10724
- C:\Windows\System\CtdLeeL.exe
  C:\Windows\System\CtdLeeL.exe
  2⤵
  PID:10756
- C:\Windows\System\ePrlQcI.exe
  C:\Windows\System\ePrlQcI.exe
  2⤵
  PID:10772
- C:\Windows\System\TLBvPZV.exe
  C:\Windows\System\TLBvPZV.exe
  2⤵
  PID:10796
- C:\Windows\System\GVWYqlt.exe
  C:\Windows\System\GVWYqlt.exe
  2⤵
  PID:10820
- C:\Windows\System\VMoAAgH.exe
  C:\Windows\System\VMoAAgH.exe
  2⤵
  PID:10844
- C:\Windows\System\TvOLwOi.exe
  C:\Windows\System\TvOLwOi.exe
  2⤵
  PID:10860
- C:\Windows\System\fLQTPGS.exe
  C:\Windows\System\fLQTPGS.exe
  2⤵
  PID:10880
- C:\Windows\System\kPMdded.exe
  C:\Windows\System\kPMdded.exe
  2⤵
  PID:10900
- C:\Windows\System\xHXpZyc.exe
  C:\Windows\System\xHXpZyc.exe
  2⤵
  PID:10916
- C:\Windows\System\ZmydRMF.exe
  C:\Windows\System\ZmydRMF.exe
  2⤵
  PID:10936
- C:\Windows\System\jMeNglZ.exe
  C:\Windows\System\jMeNglZ.exe
  2⤵
  PID:10960
- C:\Windows\System\RxxQZLU.exe
  C:\Windows\System\RxxQZLU.exe
  2⤵
  PID:10976
- C:\Windows\System\KxaEXJg.exe
  C:\Windows\System\KxaEXJg.exe
  2⤵
  PID:10996
- C:\Windows\System\AcrIaUt.exe
  C:\Windows\System\AcrIaUt.exe
  2⤵
  PID:11016
- C:\Windows\System\uPqFefl.exe
  C:\Windows\System\uPqFefl.exe
  2⤵
  PID:11040
- C:\Windows\System\CGVJMdl.exe
  C:\Windows\System\CGVJMdl.exe
  2⤵
  PID:11056
- C:\Windows\System\ENpDbDc.exe
  C:\Windows\System\ENpDbDc.exe
  2⤵
  PID:11080
- C:\Windows\System\CINiVug.exe
  C:\Windows\System\CINiVug.exe
  2⤵
  PID:11100
- C:\Windows\System\YOaGwMh.exe
  C:\Windows\System\YOaGwMh.exe
  2⤵
  PID:11120
- C:\Windows\System\gcndSPN.exe
  C:\Windows\System\gcndSPN.exe
  2⤵
  PID:11144
- C:\Windows\System\qRfWYvB.exe
  C:\Windows\System\qRfWYvB.exe
  2⤵
  PID:11164
- C:\Windows\System\vMKalgy.exe
  C:\Windows\System\vMKalgy.exe
  2⤵
  PID:11188
- C:\Windows\System\RfDOvjy.exe
  C:\Windows\System\RfDOvjy.exe
  2⤵
  PID:11208
- C:\Windows\System\LbDuqKw.exe
  C:\Windows\System\LbDuqKw.exe
  2⤵
  PID:11224
- C:\Windows\System\MqpyUfa.exe
  C:\Windows\System\MqpyUfa.exe
  2⤵
  PID:11240
- C:\Windows\System\WPoQEPg.exe
  C:\Windows\System\WPoQEPg.exe
  2⤵
  PID:9192
- C:\Windows\System\xhXZYWU.exe
  C:\Windows\System\xhXZYWU.exe
  2⤵
  PID:8108
- C:\Windows\System\iZPUzfB.exe
  C:\Windows\System\iZPUzfB.exe
  2⤵
  PID:8188
- C:\Windows\System\MlYkbLV.exe
  C:\Windows\System\MlYkbLV.exe
  2⤵
  PID:7628
- C:\Windows\System\bbHZZFQ.exe
  C:\Windows\System\bbHZZFQ.exe
  2⤵
  PID:7232
- C:\Windows\System\njQdPuG.exe
  C:\Windows\System\njQdPuG.exe
  2⤵
  PID:6348
- C:\Windows\System\kzZSnPl.exe
  C:\Windows\System\kzZSnPl.exe
  2⤵
  PID:7272
- C:\Windows\System\QiJQUQJ.exe
  C:\Windows\System\QiJQUQJ.exe
  2⤵
  PID:6400
- C:\Windows\System\SxNtttP.exe
  C:\Windows\System\SxNtttP.exe
  2⤵
  PID:6492
- C:\Windows\System\pxFnEYF.exe
  C:\Windows\System\pxFnEYF.exe
  2⤵
  PID:6704
- C:\Windows\System\tBZbXVh.exe
  C:\Windows\System\tBZbXVh.exe
  2⤵
  PID:9232
- C:\Windows\System\tVvYmzc.exe
  C:\Windows\System\tVvYmzc.exe
  2⤵
  PID:9268
- C:\Windows\System\gWATYCi.exe
  C:\Windows\System\gWATYCi.exe
  2⤵
  PID:9288
- C:\Windows\System\ovwBWZb.exe
  C:\Windows\System\ovwBWZb.exe
  2⤵
  PID:8320
- C:\Windows\System\OhTCffz.exe
  C:\Windows\System\OhTCffz.exe
  2⤵
  PID:8436
- C:\Windows\System\qJZcBuM.exe
  C:\Windows\System\qJZcBuM.exe
  2⤵
  PID:7504
- C:\Windows\System\PyXMyWZ.exe
  C:\Windows\System\PyXMyWZ.exe
  2⤵
  PID:9448
- C:\Windows\System\tGNJedn.exe
  C:\Windows\System\tGNJedn.exe
  2⤵
  PID:9512
- C:\Windows\System\sJXKTAa.exe
  C:\Windows\System\sJXKTAa.exe
  2⤵
  PID:9592
- C:\Windows\System\qZTimhx.exe
  C:\Windows\System\qZTimhx.exe
  2⤵
  PID:9680
- C:\Windows\System\lfgxRRN.exe
  C:\Windows\System\lfgxRRN.exe
  2⤵
  PID:8560
- C:\Windows\System\CdlmVpZ.exe
  C:\Windows\System\CdlmVpZ.exe
  2⤵
  PID:7616
- C:\Windows\System\jQKyhtv.exe
  C:\Windows\System\jQKyhtv.exe
  2⤵
  PID:7700
- C:\Windows\System\naPhZpt.exe
  C:\Windows\System\naPhZpt.exe
  2⤵
  PID:9956
- C:\Windows\System\jlWPNxw.exe
  C:\Windows\System\jlWPNxw.exe
  2⤵
  PID:10024
- C:\Windows\System\GJIiPwp.exe
  C:\Windows\System\GJIiPwp.exe
  2⤵
  PID:11268
- C:\Windows\System\DxwwLJX.exe
  C:\Windows\System\DxwwLJX.exe
  2⤵
  PID:11288
- C:\Windows\System\SyWdAxG.exe
  C:\Windows\System\SyWdAxG.exe
  2⤵
  PID:11304
- C:\Windows\System\CwuiNiB.exe
  C:\Windows\System\CwuiNiB.exe
  2⤵
  PID:11320
- C:\Windows\System\lMAKmNd.exe
  C:\Windows\System\lMAKmNd.exe
  2⤵
  PID:11348
- C:\Windows\System\UOoSZXB.exe
  C:\Windows\System\UOoSZXB.exe
  2⤵
  PID:11364
- C:\Windows\System\llgCqXA.exe
  C:\Windows\System\llgCqXA.exe
  2⤵
  PID:11396
- C:\Windows\System\YeHRqLA.exe
  C:\Windows\System\YeHRqLA.exe
  2⤵
  PID:11416
- C:\Windows\System\MtuNmpr.exe
  C:\Windows\System\MtuNmpr.exe
  2⤵
  PID:11444
- C:\Windows\System\Hggylaj.exe
  C:\Windows\System\Hggylaj.exe
  2⤵
  PID:11460
- C:\Windows\System\hLEwJsn.exe
  C:\Windows\System\hLEwJsn.exe
  2⤵
  PID:11484
- C:\Windows\System\FtDupPU.exe
  C:\Windows\System\FtDupPU.exe
  2⤵
  PID:11508
- C:\Windows\System\acEBUgQ.exe
  C:\Windows\System\acEBUgQ.exe
  2⤵
  PID:11524
- C:\Windows\System\zrKwRfB.exe
  C:\Windows\System\zrKwRfB.exe
  2⤵
  PID:11540
- C:\Windows\System\tVLAjSH.exe
  C:\Windows\System\tVLAjSH.exe
  2⤵
  PID:11560
- C:\Windows\System\gNPIqGt.exe
  C:\Windows\System\gNPIqGt.exe
  2⤵
  PID:11580
- C:\Windows\System\GRBulbt.exe
  C:\Windows\System\GRBulbt.exe
  2⤵
  PID:11600
- C:\Windows\System\jkTCGpl.exe
  C:\Windows\System\jkTCGpl.exe
  2⤵
  PID:11620
- C:\Windows\System\PMZGmVi.exe
  C:\Windows\System\PMZGmVi.exe
  2⤵
  PID:11644
- C:\Windows\System\EwXddhS.exe
  C:\Windows\System\EwXddhS.exe
  2⤵
  PID:11664
- C:\Windows\System\ntZOjln.exe
  C:\Windows\System\ntZOjln.exe
  2⤵
  PID:11688
- C:\Windows\System\YgMBiZy.exe
  C:\Windows\System\YgMBiZy.exe
  2⤵
  PID:11704
- C:\Windows\System\qVdnPPK.exe
  C:\Windows\System\qVdnPPK.exe
  2⤵
  PID:11728
- C:\Windows\System\EFdlPtN.exe
  C:\Windows\System\EFdlPtN.exe
  2⤵
  PID:11776
- C:\Windows\System\laSMvyy.exe
  C:\Windows\System\laSMvyy.exe
  2⤵
  PID:11800
- C:\Windows\System\haRvYfz.exe
  C:\Windows\System\haRvYfz.exe
  2⤵
  PID:11816
- C:\Windows\System\AqxsYAR.exe
  C:\Windows\System\AqxsYAR.exe
  2⤵
  PID:11836
- C:\Windows\System\iOIzHOy.exe
  C:\Windows\System\iOIzHOy.exe
  2⤵
  PID:11860
- C:\Windows\System\jPQpUXo.exe
  C:\Windows\System\jPQpUXo.exe
  2⤵
  PID:11880
- C:\Windows\System\ONkMARl.exe
  C:\Windows\System\ONkMARl.exe
  2⤵
  PID:11900
- C:\Windows\System\QMdUzLp.exe
  C:\Windows\System\QMdUzLp.exe
  2⤵
  PID:11924
- C:\Windows\System\zeZdvAA.exe
  C:\Windows\System\zeZdvAA.exe
  2⤵
  PID:11944
- C:\Windows\System\IdFEAVa.exe
  C:\Windows\System\IdFEAVa.exe
  2⤵
  PID:11964
- C:\Windows\System\rZlhspg.exe
  C:\Windows\System\rZlhspg.exe
  2⤵
  PID:11984
- C:\Windows\System\CLZgWbD.exe
  C:\Windows\System\CLZgWbD.exe
  2⤵
  PID:12004
- C:\Windows\System\dYewdmz.exe
  C:\Windows\System\dYewdmz.exe
  2⤵
  PID:12020
- C:\Windows\System\GcUbzHF.exe
  C:\Windows\System\GcUbzHF.exe
  2⤵
  PID:12036
- C:\Windows\System\uvhGEKt.exe
  C:\Windows\System\uvhGEKt.exe
  2⤵
  PID:12060
- C:\Windows\System\zAXlJgS.exe
  C:\Windows\System\zAXlJgS.exe
  2⤵
  PID:12080
- C:\Windows\System\iLsRkVO.exe
  C:\Windows\System\iLsRkVO.exe
  2⤵
  PID:12104
- C:\Windows\System\uENyyFF.exe
  C:\Windows\System\uENyyFF.exe
  2⤵
  PID:12124
- C:\Windows\System\PWDEaoa.exe
  C:\Windows\System\PWDEaoa.exe
  2⤵
  PID:12148
- C:\Windows\System\lKHRqLu.exe
  C:\Windows\System\lKHRqLu.exe
  2⤵
  PID:12168
- C:\Windows\System\ChEdSrP.exe
  C:\Windows\System\ChEdSrP.exe
  2⤵
  PID:12188
- C:\Windows\System\RKpZCVO.exe
  C:\Windows\System\RKpZCVO.exe
  2⤵
  PID:12204
- C:\Windows\System\LpjhrZr.exe
  C:\Windows\System\LpjhrZr.exe
  2⤵
  PID:12228
- C:\Windows\System\qmSIQWl.exe
  C:\Windows\System\qmSIQWl.exe
  2⤵
  PID:12248
- C:\Windows\System\MtpGnuG.exe
  C:\Windows\System\MtpGnuG.exe
  2⤵
  PID:12272
- C:\Windows\System\QXJZKqK.exe
  C:\Windows\System\QXJZKqK.exe
  2⤵
  PID:7792
- C:\Windows\System\oVOIrbh.exe
  C:\Windows\System\oVOIrbh.exe
  2⤵
  PID:7820
- C:\Windows\System\xUbISAu.exe
  C:\Windows\System\xUbISAu.exe
  2⤵
  PID:8336
- C:\Windows\System\gDUgsyy.exe
  C:\Windows\System\gDUgsyy.exe
  2⤵
  PID:7872
- C:\Windows\System\UrWxAzp.exe
  C:\Windows\System\UrWxAzp.exe
  2⤵
  PID:1020
- C:\Windows\System\mosuchK.exe
  C:\Windows\System\mosuchK.exe
  2⤵
  PID:7940
- C:\Windows\System\UVdDQLY.exe
  C:\Windows\System\UVdDQLY.exe
  2⤵
  PID:7972
- C:\Windows\System\cUjWWjh.exe
  C:\Windows\System\cUjWWjh.exe
  2⤵
  PID:8004
- C:\Windows\System\JDfuIWP.exe
  C:\Windows\System\JDfuIWP.exe
  2⤵
  PID:10328
- C:\Windows\System\RZsyTvI.exe
  C:\Windows\System\RZsyTvI.exe
  2⤵
  PID:12296
- C:\Windows\System\TTWpHfz.exe
  C:\Windows\System\TTWpHfz.exe
  2⤵
  PID:12316
- C:\Windows\System\kHmckfk.exe
  C:\Windows\System\kHmckfk.exe
  2⤵
  PID:12340
- C:\Windows\System\NNTFihU.exe
  C:\Windows\System\NNTFihU.exe
  2⤵
  PID:12360
- C:\Windows\System\JmGCcJe.exe
  C:\Windows\System\JmGCcJe.exe
  2⤵
  PID:12380
- C:\Windows\System\KlvlAyy.exe
  C:\Windows\System\KlvlAyy.exe
  2⤵
  PID:12400
- C:\Windows\System\UoLGwZp.exe
  C:\Windows\System\UoLGwZp.exe
  2⤵
  PID:12420
- C:\Windows\System\FBTrcDU.exe
  C:\Windows\System\FBTrcDU.exe
  2⤵
  PID:12440
- C:\Windows\System\ZipoIEC.exe
  C:\Windows\System\ZipoIEC.exe
  2⤵
  PID:12460
- C:\Windows\System\AkxNRtz.exe
  C:\Windows\System\AkxNRtz.exe
  2⤵
  PID:12484
- C:\Windows\System\ikxMFCi.exe
  C:\Windows\System\ikxMFCi.exe
  2⤵
  PID:12500
- C:\Windows\System\CcuvzYO.exe
  C:\Windows\System\CcuvzYO.exe
  2⤵
  PID:12520
- C:\Windows\System\CcavnUX.exe
  C:\Windows\System\CcavnUX.exe
  2⤵
  PID:12540
- C:\Windows\System\YJPDlMq.exe
  C:\Windows\System\YJPDlMq.exe
  2⤵
  PID:12560
- C:\Windows\System\opFIBtM.exe
  C:\Windows\System\opFIBtM.exe
  2⤵
  PID:12576
- C:\Windows\System\LmWgeoj.exe
  C:\Windows\System\LmWgeoj.exe
  2⤵
  PID:12604
- C:\Windows\System\NgwGduH.exe
  C:\Windows\System\NgwGduH.exe
  2⤵
  PID:12624
- C:\Windows\System\hBMlQmt.exe
  C:\Windows\System\hBMlQmt.exe
  2⤵
  PID:12640
- C:\Windows\System\SCtirld.exe
  C:\Windows\System\SCtirld.exe
  2⤵
  PID:12660
- C:\Windows\System\umTkHwM.exe
  C:\Windows\System\umTkHwM.exe
  2⤵
  PID:12684
- C:\Windows\System\fUDIByL.exe
  C:\Windows\System\fUDIByL.exe
  2⤵
  PID:12700
- C:\Windows\System\mdLbvFL.exe
  C:\Windows\System\mdLbvFL.exe
  2⤵
  PID:12716
- C:\Windows\System\KjrtMZw.exe
  C:\Windows\System\KjrtMZw.exe
  2⤵
  PID:12740
- C:\Windows\System\AtRcPXq.exe
  C:\Windows\System\AtRcPXq.exe
  2⤵
  PID:12760
- C:\Windows\System\IUeCWHd.exe
  C:\Windows\System\IUeCWHd.exe
  2⤵
  PID:12788
- C:\Windows\System\giHgeeg.exe
  C:\Windows\System\giHgeeg.exe
  2⤵
  PID:12812
- C:\Windows\System\HlHRxWK.exe
  C:\Windows\System\HlHRxWK.exe
  2⤵
  PID:12836
- C:\Windows\System\HecKuCn.exe
  C:\Windows\System\HecKuCn.exe
  2⤵
  PID:12856
- C:\Windows\System\cstgElJ.exe
  C:\Windows\System\cstgElJ.exe
  2⤵
  PID:12876
- C:\Windows\System\JoyLsiY.exe
  C:\Windows\System\JoyLsiY.exe
  2⤵
  PID:12904
- C:\Windows\System\HbfkaeE.exe
  C:\Windows\System\HbfkaeE.exe
  2⤵
  PID:12920
- C:\Windows\System\xqGXYkB.exe
  C:\Windows\System\xqGXYkB.exe
  2⤵
  PID:12940
- C:\Windows\System\GgnDPBH.exe
  C:\Windows\System\GgnDPBH.exe
  2⤵
  PID:12960
- C:\Windows\System\FOvXuNw.exe
  C:\Windows\System\FOvXuNw.exe
  2⤵
  PID:12984
- C:\Windows\System\WsXujfD.exe
  C:\Windows\System\WsXujfD.exe
  2⤵
  PID:13008
- C:\Windows\System\NTpicoz.exe
  C:\Windows\System\NTpicoz.exe
  2⤵
  PID:13028
- C:\Windows\System\SfaWqNz.exe
  C:\Windows\System\SfaWqNz.exe
  2⤵
  PID:13048
- C:\Windows\System\ZfwAxpW.exe
  C:\Windows\System\ZfwAxpW.exe
  2⤵
  PID:13068
- C:\Windows\System\EHGEHnP.exe
  C:\Windows\System\EHGEHnP.exe
  2⤵
  PID:13088
- C:\Windows\System\vTkFqji.exe
  C:\Windows\System\vTkFqji.exe
  2⤵
  PID:13112
- C:\Windows\System\rGgcgxj.exe
  C:\Windows\System\rGgcgxj.exe
  2⤵
  PID:13132
- C:\Windows\System\VUiiqXD.exe
  C:\Windows\System\VUiiqXD.exe
  2⤵
  PID:13152
- C:\Windows\System\QIsUsjs.exe
  C:\Windows\System\QIsUsjs.exe
  2⤵
  PID:13176
- C:\Windows\System\HmTwuRA.exe
  C:\Windows\System\HmTwuRA.exe
  2⤵
  PID:13192
- C:\Windows\System\AXXHzCP.exe
  C:\Windows\System\AXXHzCP.exe
  2⤵
  PID:13212
- C:\Windows\System\rnTrSwu.exe
  C:\Windows\System\rnTrSwu.exe
  2⤵
  PID:13236
- C:\Windows\System\gVhGBQV.exe
  C:\Windows\System\gVhGBQV.exe
  2⤵
  PID:13256
- C:\Windows\System\zFXbIQY.exe
  C:\Windows\System\zFXbIQY.exe
  2⤵
  PID:13272
- C:\Windows\System\uUoWAbU.exe
  C:\Windows\System\uUoWAbU.exe
  2⤵
  PID:13300
- C:\Windows\System\OgshjCh.exe
  C:\Windows\System\OgshjCh.exe
  2⤵
  PID:9164
- C:\Windows\System\YJRrwsr.exe
  C:\Windows\System\YJRrwsr.exe
  2⤵
  PID:9212
- C:\Windows\System\hxCBYxW.exe
  C:\Windows\System\hxCBYxW.exe
  2⤵
  PID:6580
- C:\Windows\System\auETFkQ.exe
  C:\Windows\System\auETFkQ.exe
  2⤵
  PID:5136
- C:\Windows\System\yGuKxIK.exe
  C:\Windows\System\yGuKxIK.exe
  2⤵
  PID:12868
- C:\Windows\System\XJcdqpU.exe
  C:\Windows\System\XJcdqpU.exe
  2⤵
  PID:10640
- C:\Windows\System\NuRTaPX.exe
  C:\Windows\System\NuRTaPX.exe
  2⤵
  PID:5444
- C:\Windows\System\teCgNxi.exe
  C:\Windows\System\teCgNxi.exe
  2⤵
  PID:11256
- C:\Windows\System\tXuAmNV.exe
  C:\Windows\System\tXuAmNV.exe
  2⤵
  PID:6300
- C:\Windows\System\GDQurCs.exe
  C:\Windows\System\GDQurCs.exe
  2⤵
  PID:8376
- C:\Windows\System\soIbVxC.exe
  C:\Windows\System\soIbVxC.exe
  2⤵
  PID:11972
- C:\Windows\System\frPdReV.exe
  C:\Windows\System\frPdReV.exe
  2⤵
  PID:11920
- C:\Windows\System\CIBpDGg.exe
  C:\Windows\System\CIBpDGg.exe
  2⤵
  PID:11876
- C:\Windows\System\bcfGOyZ.exe
  C:\Windows\System\bcfGOyZ.exe
  2⤵
  PID:6216
- C:\Windows\System\XQkyMfX.exe
  C:\Windows\System\XQkyMfX.exe
  2⤵
  PID:11792
- C:\Windows\System\WgHCuwC.exe
  C:\Windows\System\WgHCuwC.exe
  2⤵
  PID:11532
- C:\Windows\System\sMvMfyc.exe
  C:\Windows\System\sMvMfyc.exe
  2⤵
  PID:11380
- C:\Windows\System\JQSNxTJ.exe
  C:\Windows\System\JQSNxTJ.exe
  2⤵
  PID:8716
- C:\Windows\System\zGpUEhN.exe
  C:\Windows\System\zGpUEhN.exe
  2⤵
  PID:3220
- C:\Windows\System\sylmJBT.exe
  C:\Windows\System\sylmJBT.exe
  2⤵
  PID:11196
- C:\Windows\System\MORlDxY.exe
  C:\Windows\System\MORlDxY.exe
  2⤵
  PID:12884
- C:\Windows\System\ZISxAnx.exe
  C:\Windows\System\ZISxAnx.exe
  2⤵
  PID:13168
- C:\Windows\System\NvUHDsy.exe
  C:\Windows\System\NvUHDsy.exe
  2⤵
  PID:6548
- C:\Windows\System\NQkmkce.exe
  C:\Windows\System\NQkmkce.exe
  2⤵
  PID:12696
- C:\Windows\System\IgYWWEY.exe
  C:\Windows\System\IgYWWEY.exe
  2⤵
  PID:12804
- C:\Windows\System\RTAwwpz.exe
  C:\Windows\System\RTAwwpz.exe
  2⤵
  PID:12996
- C:\Windows\System\AdaYqCw.exe
  C:\Windows\System\AdaYqCw.exe
  2⤵
  PID:10472
- C:\Windows\System\pRoaRwH.exe
  C:\Windows\System\pRoaRwH.exe
  2⤵
  PID:772
- C:\Windows\System\MckRTGx.exe
  C:\Windows\System\MckRTGx.exe
  2⤵
  PID:11424
- C:\Windows\System\svugkGr.exe
  C:\Windows\System\svugkGr.exe
  2⤵
  PID:11496
- C:\Windows\System\AkeJAGm.exe
  C:\Windows\System\AkeJAGm.exe
  2⤵
  PID:1936
- C:\Windows\System\UbkuTxS.exe
  C:\Windows\System\UbkuTxS.exe
  2⤵
  PID:11612
- C:\Windows\System\NEszAMT.exe
  C:\Windows\System\NEszAMT.exe
  2⤵
  PID:12976
- C:\Windows\System\LuTytaI.exe
  C:\Windows\System\LuTytaI.exe
  2⤵
  PID:8872
- C:\Windows\System\UVVSULw.exe
  C:\Windows\System\UVVSULw.exe
  2⤵
  PID:8916
- C:\Windows\System\XNMlndk.exe
  C:\Windows\System\XNMlndk.exe
  2⤵
  PID:8972
- C:\Windows\System\zBqfyRG.exe
  C:\Windows\System\zBqfyRG.exe
  2⤵
  PID:3964
- C:\Windows\System\FjHCEYC.exe
  C:\Windows\System\FjHCEYC.exe
  2⤵
  PID:12848
- C:\Windows\System\ZzXKIrP.exe
  C:\Windows\System\ZzXKIrP.exe
  2⤵
  PID:10988
- C:\Windows\System\ckyAOSr.exe
  C:\Windows\System\ckyAOSr.exe
  2⤵
  PID:7804
- C:\Windows\System\oUIYzkE.exe
  C:\Windows\System\oUIYzkE.exe
  2⤵
  PID:12156
- C:\Windows\System\mLpIZTz.exe
  C:\Windows\System\mLpIZTz.exe
  2⤵
  PID:12436
- C:\Windows\System\gkoSrIG.exe
  C:\Windows\System\gkoSrIG.exe
  2⤵
  PID:12052
- C:\Windows\System\FxZMQAS.exe
  C:\Windows\System\FxZMQAS.exe
  2⤵
  PID:12012
- C:\Windows\System\CGxYfLX.exe
  C:\Windows\System\CGxYfLX.exe
  2⤵
  PID:11936
- C:\Windows\System\pjBwkNZ.exe
  C:\Windows\System\pjBwkNZ.exe
  2⤵
  PID:11892
- C:\Windows\System\JRXMlmc.exe
  C:\Windows\System\JRXMlmc.exe
  2⤵
  PID:9532
- C:\Windows\System\EfCogVA.exe
  C:\Windows\System\EfCogVA.exe
  2⤵
  PID:11384
- C:\Windows\System\kgerfoq.exe
  C:\Windows\System\kgerfoq.exe
  2⤵
  PID:11828
- C:\Windows\System\uAIKEDL.exe
  C:\Windows\System\uAIKEDL.exe
  2⤵
  PID:7320
- C:\Windows\System\LbNwbDA.exe
  C:\Windows\System\LbNwbDA.exe
  2⤵
  PID:6900
- C:\Windows\System\gSEmwrW.exe
  C:\Windows\System\gSEmwrW.exe
  2⤵
  PID:13096
- C:\Windows\System\VokUnbU.exe
  C:\Windows\System\VokUnbU.exe
  2⤵
  PID:8500
- C:\Windows\System\fQeampM.exe
  C:\Windows\System\fQeampM.exe
  2⤵
  PID:12492
- C:\Windows\System\TxbgqFD.exe
  C:\Windows\System\TxbgqFD.exe
  2⤵
  PID:1808
- C:\Windows\System\ICAAsqA.exe
  C:\Windows\System\ICAAsqA.exe
  2⤵
  PID:13292
- C:\Windows\System\xatOiQi.exe
  C:\Windows\System\xatOiQi.exe
  2⤵
  PID:1072
- C:\Windows\System\VAaFCQW.exe
  C:\Windows\System\VAaFCQW.exe
  2⤵
  PID:3380
- C:\Windows\System\KoRrdLd.exe
  C:\Windows\System\KoRrdLd.exe
  2⤵
  PID:13280
- C:\Windows\System\OOTUbWE.exe
  C:\Windows\System\OOTUbWE.exe
  2⤵
  PID:12536
- C:\Windows\System\dWnqxeI.exe
  C:\Windows\System\dWnqxeI.exe
  2⤵
  PID:9024
- C:\Windows\System\GRKdxca.exe
  C:\Windows\System\GRKdxca.exe
  2⤵
  PID:11476
- C:\Windows\System\OtGYDVa.exe
  C:\Windows\System\OtGYDVa.exe
  2⤵
  PID:11596
- C:\Windows\System\iZvyUGa.exe
  C:\Windows\System\iZvyUGa.exe
  2⤵
  PID:11700
- C:\Windows\System\sudmXwy.exe
  C:\Windows\System\sudmXwy.exe
  2⤵
  PID:9652
- C:\Windows\System\wGVkjnc.exe
  C:\Windows\System\wGVkjnc.exe
  2⤵
  PID:10908
- C:\Windows\System\obvEwfY.exe
  C:\Windows\System\obvEwfY.exe
  2⤵
  PID:12784
- C:\Windows\System\oGgUJbe.exe
  C:\Windows\System\oGgUJbe.exe
  2⤵
  PID:8912
- C:\Windows\System\vbpUUkO.exe
  C:\Windows\System\vbpUUkO.exe
  2⤵
  PID:10868
- C:\Windows\System\qrATMZW.exe
  C:\Windows\System\qrATMZW.exe
  2⤵
  PID:9108
- C:\Windows\System\yxSRQFO.exe
  C:\Windows\System\yxSRQFO.exe
  2⤵
  PID:9408
- C:\Windows\System\UrepQMI.exe
  C:\Windows\System\UrepQMI.exe
  2⤵
  PID:6468
- C:\Windows\System\DnasAgk.exe
  C:\Windows\System\DnasAgk.exe
  2⤵
  PID:9328
- C:\Windows\System\FdyZSsd.exe
  C:\Windows\System\FdyZSsd.exe
  2⤵
  PID:11220
- C:\Windows\System\yzJjGmK.exe
  C:\Windows\System\yzJjGmK.exe
  2⤵
  PID:9696
- C:\Windows\System\qicSCDZ.exe
  C:\Windows\System\qicSCDZ.exe
  2⤵
  PID:9872
- C:\Windows\System\oVRVxHN.exe
  C:\Windows\System\oVRVxHN.exe
  2⤵
  PID:12164
- C:\Windows\System\fQSUiLc.exe
  C:\Windows\System\fQSUiLc.exe
  2⤵
  PID:10176
- C:\Windows\System\MTRhifP.exe
  C:\Windows\System\MTRhifP.exe
  2⤵
  PID:972
- C:\Windows\System\oBtZnvE.exe
  C:\Windows\System\oBtZnvE.exe
  2⤵
  PID:1040
- C:\Windows\System\FbtMMpw.exe
  C:\Windows\System\FbtMMpw.exe
  2⤵
  PID:3764
- C:\Windows\System\rQwpGUb.exe
  C:\Windows\System\rQwpGUb.exe
  2⤵
  PID:11672
- C:\Windows\System\POoyWDp.exe
  C:\Windows\System\POoyWDp.exe
  2⤵
  PID:7936
- C:\Windows\System\kQZmIUf.exe
  C:\Windows\System\kQZmIUf.exe
  2⤵
  PID:11332
- C:\Windows\System\pqhjAlg.exe
  C:\Windows\System\pqhjAlg.exe
  2⤵
  PID:10184
- C:\Windows\System\AJdgfAM.exe
  C:\Windows\System\AJdgfAM.exe
  2⤵
  PID:7588
- C:\Windows\System\IwILjBw.exe
  C:\Windows\System\IwILjBw.exe
  2⤵
  PID:3284
- C:\Windows\System\SYyqYbo.exe
  C:\Windows\System\SYyqYbo.exe
  2⤵
  PID:11200
- C:\Windows\System\IhXOVUS.exe
  C:\Windows\System\IhXOVUS.exe
  2⤵
  PID:13220
- C:\Windows\System\wvfUIuB.exe
  C:\Windows\System\wvfUIuB.exe
  2⤵
  PID:12264
- C:\Windows\System\sXYbJrm.exe
  C:\Windows\System\sXYbJrm.exe
  2⤵
  PID:12928
- C:\Windows\System\WWkUOPL.exe
  C:\Windows\System\WWkUOPL.exe
  2⤵
  PID:10356
- C:\Windows\System\psPQRks.exe
  C:\Windows\System\psPQRks.exe
  2⤵
  PID:9980
- C:\Windows\System\NaZCYfX.exe
  C:\Windows\System\NaZCYfX.exe
  2⤵
  PID:8956
- C:\Windows\System\pDmLmVF.exe
  C:\Windows\System\pDmLmVF.exe
  2⤵
  PID:9472
- C:\Windows\System\jSnxtzh.exe
  C:\Windows\System\jSnxtzh.exe
  2⤵
  PID:4660
- C:\Windows\System\DvCuoRp.exe
  C:\Windows\System\DvCuoRp.exe
  2⤵
  PID:9348
- C:\Windows\System\mtXlcBs.exe
  C:\Windows\System\mtXlcBs.exe
  2⤵
  PID:2556
- C:\Windows\System\ssrizwt.exe
  C:\Windows\System\ssrizwt.exe
  2⤵
  PID:12220
- C:\Windows\System\JSMwpog.exe
  C:\Windows\System\JSMwpog.exe
  2⤵
  PID:10316
- C:\Windows\System\XdoBdkN.exe
  C:\Windows\System\XdoBdkN.exe
  2⤵
  PID:11932
- C:\Windows\System\HOWnvyW.exe
  C:\Windows\System\HOWnvyW.exe
  2⤵
  PID:10804
- C:\Windows\System\DsbVrkK.exe
  C:\Windows\System\DsbVrkK.exe
  2⤵
  PID:12428
- C:\Windows\System\vzjDzTf.exe
  C:\Windows\System\vzjDzTf.exe
  2⤵
  PID:4340
- C:\Windows\System\zlzGhxK.exe
  C:\Windows\System\zlzGhxK.exe
  2⤵
  PID:12076
- C:\Windows\System\MdkoMop.exe
  C:\Windows\System\MdkoMop.exe
  2⤵
  PID:3980
- C:\Windows\System\YCsFNrC.exe
  C:\Windows\System\YCsFNrC.exe
  2⤵
  PID:8432
- C:\Windows\System\FOIbuJT.exe
  C:\Windows\System\FOIbuJT.exe
  2⤵
  PID:5448
- C:\Windows\System\dCsuOqu.exe
  C:\Windows\System\dCsuOqu.exe
  2⤵
  PID:13364
- C:\Windows\System\RcYiXnI.exe
  C:\Windows\System\RcYiXnI.exe
  2⤵
  PID:13432
- C:\Windows\System\AAPtJMH.exe
  C:\Windows\System\AAPtJMH.exe
  2⤵
  PID:13520
- C:\Windows\System\GugsBfM.exe
  C:\Windows\System\GugsBfM.exe
  2⤵
  PID:13560
- C:\Windows\System\HHuWCfD.exe
  C:\Windows\System\HHuWCfD.exe
  2⤵
  PID:13756
- C:\Windows\System\gEyfCoE.exe
  C:\Windows\System\gEyfCoE.exe
  2⤵
  PID:13780
- C:\Windows\System\ecbbSfq.exe
  C:\Windows\System\ecbbSfq.exe
  2⤵
  PID:13824
- C:\Windows\System\JaMyFHi.exe
  C:\Windows\System\JaMyFHi.exe
  2⤵
  PID:13916
- C:\Windows\System\aeDaJUT.exe
  C:\Windows\System\aeDaJUT.exe
  2⤵
  PID:13948
- C:\Windows\System\zthsJoQ.exe
  C:\Windows\System\zthsJoQ.exe
  2⤵
  PID:13964
- C:\Windows\System\oAsFTWj.exe
  C:\Windows\System\oAsFTWj.exe
  2⤵
  PID:14000
- C:\Windows\System\PzhQITs.exe
  C:\Windows\System\PzhQITs.exe
  2⤵
  PID:14028
- C:\Windows\System\iHFLDpK.exe
  C:\Windows\System\iHFLDpK.exe
  2⤵
  PID:14048
- C:\Windows\System\mMuROak.exe
  C:\Windows\System\mMuROak.exe
  2⤵
  PID:14088
- C:\Windows\System\owbkLTf.exe
  C:\Windows\System\owbkLTf.exe
  2⤵
  PID:14108
- C:\Windows\System\BMQtizP.exe
  C:\Windows\System\BMQtizP.exe
  2⤵
  PID:14264
- C:\Windows\System\kqvlAKb.exe
  C:\Windows\System\kqvlAKb.exe
  2⤵
  PID:14292
- C:\Windows\System\zqKhwdp.exe
  C:\Windows\System\zqKhwdp.exe
  2⤵
  PID:14316
- C:\Windows\System\uKxTvHq.exe
  C:\Windows\System\uKxTvHq.exe
  2⤵
  PID:13484
- C:\Windows\System\nAtDmLr.exe
  C:\Windows\System\nAtDmLr.exe
  2⤵
  PID:13480
- C:\Windows\System\efURTIN.exe
  C:\Windows\System\efURTIN.exe
  2⤵
  PID:13536
- C:\Windows\System\AuOYiTx.exe
  C:\Windows\System\AuOYiTx.exe
  2⤵
  PID:13904
- C:\Windows\System\odhTUSa.exe
  C:\Windows\System\odhTUSa.exe
  2⤵
  PID:13708
- C:\Windows\System\bUKZquC.exe
  C:\Windows\System\bUKZquC.exe
  2⤵
  PID:1348
- C:\Windows\System\NqxPQCd.exe
  C:\Windows\System\NqxPQCd.exe
  2⤵
  PID:2732
- C:\Windows\System\vWHSUoJ.exe
  C:\Windows\System\vWHSUoJ.exe
  2⤵
  PID:14192
- C:\Windows\System\VdaEMFC.exe
  C:\Windows\System\VdaEMFC.exe
  2⤵
  PID:3712
- C:\Windows\System\oGUXwhI.exe
  C:\Windows\System\oGUXwhI.exe
  2⤵
  PID:12888
- C:\Windows\System\YzbDVyG.exe
  C:\Windows\System\YzbDVyG.exe
  2⤵
  PID:14308
- C:\Windows\System\KvbwrGX.exe
  C:\Windows\System\KvbwrGX.exe
  2⤵
  PID:14260
- C:\Windows\System\FEgGtQP.exe
  C:\Windows\System\FEgGtQP.exe
  2⤵
  PID:13500
- C:\Windows\System\GoQvfkB.exe
  C:\Windows\System\GoQvfkB.exe
  2⤵
  PID:13408
- C:\Windows\System\MfCMXeM.exe
  C:\Windows\System\MfCMXeM.exe
  2⤵
  PID:13816
- C:\Windows\System\kAhurMG.exe
  C:\Windows\System\kAhurMG.exe
  2⤵
  PID:13672
- C:\Windows\System\RalsSKk.exe
  C:\Windows\System\RalsSKk.exe
  2⤵
  PID:13680
- C:\Windows\System\ZpZWXZZ.exe
  C:\Windows\System\ZpZWXZZ.exe
  2⤵
  PID:13440
- C:\Windows\System\JkzYgJA.exe
  C:\Windows\System\JkzYgJA.exe
  2⤵
  PID:13744
- C:\Windows\System\XyNRBIw.exe
  C:\Windows\System\XyNRBIw.exe
  2⤵
  PID:14272
- C:\Windows\System\JoVkcla.exe
  C:\Windows\System\JoVkcla.exe
  2⤵
  PID:14328
- C:\Windows\System\MTbxxyy.exe
  C:\Windows\System\MTbxxyy.exe
  2⤵
  PID:2520
- C:\Windows\System\CrIgsQT.exe
  C:\Windows\System\CrIgsQT.exe
  2⤵
  PID:14152
- C:\Windows\System\GXJevIM.exe
  C:\Windows\System\GXJevIM.exe
  2⤵
  PID:13892
- C:\Windows\System\vRmjcHn.exe
  C:\Windows\System\vRmjcHn.exe
  2⤵
  PID:14096
- C:\Windows\System\emiNmZo.exe
  C:\Windows\System\emiNmZo.exe
  2⤵
  PID:13980
- C:\Windows\System\eLCANWo.exe
  C:\Windows\System\eLCANWo.exe
  2⤵
  PID:11008
- C:\Windows\System\gCnttAm.exe
  C:\Windows\System\gCnttAm.exe
  2⤵
  PID:4360
- C:\Windows\System\BTzHcyb.exe
  C:\Windows\System\BTzHcyb.exe
  2⤵
  PID:1492
- C:\Windows\System\CyEpisl.exe
  C:\Windows\System\CyEpisl.exe
  2⤵
  PID:1636
- C:\Windows\System\jjumQFE.exe
  C:\Windows\System\jjumQFE.exe
  2⤵
  PID:14120
- C:\Windows\System\iYLMBoc.exe
  C:\Windows\System\iYLMBoc.exe
  2⤵
  PID:14240
- C:\Windows\System\cNzrnqy.exe
  C:\Windows\System\cNzrnqy.exe
  2⤵
  PID:14076
- C:\Windows\System\quvVvtt.exe
  C:\Windows\System\quvVvtt.exe
  2⤵
  PID:14220
- C:\Windows\System\syvUrpl.exe
  C:\Windows\System\syvUrpl.exe
  2⤵
  PID:12932
- C:\Windows\System\rIuagms.exe
  C:\Windows\System\rIuagms.exe
  2⤵
  PID:14232
- C:\Windows\System\aOQSRTv.exe
  C:\Windows\System\aOQSRTv.exe
  2⤵
  PID:13060
- C:\Windows\System\pOrPqqo.exe
  C:\Windows\System\pOrPqqo.exe
  2⤵
  PID:780
- C:\Windows\System\SKrMKIl.exe
  C:\Windows\System\SKrMKIl.exe
  2⤵
  PID:4176
- C:\Windows\System\SJIUBno.exe
  C:\Windows\System\SJIUBno.exe
  2⤵
  PID:3572
- C:\Windows\System\kKvGRYu.exe
  C:\Windows\System\kKvGRYu.exe
  2⤵
  PID:1000
- C:\Windows\System\hAcefiv.exe
  C:\Windows\System\hAcefiv.exe
  2⤵
  PID:6236
- C:\Windows\System\EPkPdkc.exe
  C:\Windows\System\EPkPdkc.exe
  2⤵
  PID:12452
- C:\Windows\System\XoZGTDw.exe
  C:\Windows\System\XoZGTDw.exe
  2⤵
  PID:14136
- C:\Windows\System\dtXbwqr.exe
  C:\Windows\System\dtXbwqr.exe
  2⤵
  PID:12712
- C:\Windows\System\pqUMdkV.exe
  C:\Windows\System\pqUMdkV.exe
  2⤵
  PID:13496
- C:\Windows\System\aMpLKIa.exe
  C:\Windows\System\aMpLKIa.exe
  2⤵
  PID:4584
- C:\Windows\System\FPtawpz.exe
  C:\Windows\System\FPtawpz.exe
  2⤵
  PID:13472
- C:\Windows\System\menutXB.exe
  C:\Windows\System\menutXB.exe
  2⤵
  PID:4200
- C:\Windows\System\rwJUwNH.exe
  C:\Windows\System\rwJUwNH.exe
  2⤵
  PID:13588
- C:\Windows\System\PphQvDM.exe
  C:\Windows\System\PphQvDM.exe
  2⤵
  PID:13448
- C:\Windows\System\WvfQMsy.exe
  C:\Windows\System\WvfQMsy.exe
  2⤵
  PID:4560
- C:\Windows\System\oYqFVQs.exe
  C:\Windows\System\oYqFVQs.exe
  2⤵
  PID:14300
- C:\Windows\System\rhaivfc.exe
  C:\Windows\System\rhaivfc.exe
  2⤵
  PID:224
- C:\Windows\System\oWoBwOu.exe
  C:\Windows\System\oWoBwOu.exe
  2⤵
  PID:13412
- C:\Windows\System\CCNqYLA.exe
  C:\Windows\System\CCNqYLA.exe
  2⤵
  PID:4936

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 428 -p 5472 -ip 5472
1⤵
PID:12220

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:5608

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_a4y5s53n.02n.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\APqJSGd.exe

Filesize
1.4MB

MD5
8f2e58390984f64472e320e342299da9

SHA1
7ee93a0b2e7cb28c561611eb0aef2b3c1e2e6aa5

SHA256
c344db029309e450c6ca5343dd48208ef77d573d6e0d56306598260e1c460d74

SHA512
e016c82f65df1461a111ff6f3083ca2400f926a7e1e918710addd850614c338df0136de73a64b669a5184e913cd2c0485f05a5f81dfedbd7074c77a2abdc2123

Download Submit
C:\Windows\System\CmjxJLn.exe

Filesize
1.4MB

MD5
886d08199157efadb9da58ab2a663772

SHA1
ba662ebbbfe010097d75ec4e87af8f39e1aeb4a1

SHA256
67f16cc21fce78205a9d9ce2f9052091d2b15ec6b3f24ad863ea131e7994ef81

SHA512
4208f2fadc068d2f6a0fbb1b823b962cf2f69bee448314c7e00d42d628c6e00089bc02095665b93caa522a4668e38ee8e4705c26b0a0454c67c86784feec6611

Download Submit
C:\Windows\System\DkYtTpf.exe

Filesize
1.4MB

MD5
7d04d0eac244e0ba2b1de4bbeb4346c9

SHA1
c6c291c1b54e4e72f4cdf00f34d16aac64ca3731

SHA256
0c5543281924d953ff6b7309b84cb9adcaef765476f4985846b82db2a4e2d651

SHA512
0852e524daee170e935e85d1316ed7d5fdc7f1f2bdfcb7756061ce039c1a02ba510fd3ff1b1500adf4324eb282161166e91be47bd725e0faea56f805a9cee985

Download Submit
C:\Windows\System\FhCnTxN.exe

Filesize
1.4MB

MD5
9a9004e79682b2f41fd138d96d8ab43e

SHA1
702a0cc3cbd8b2d55b5a8fcca19dec538513f2b6

SHA256
1afd5172b878d7e6a702b698966f4accd9424e456998ac6c10f4310c0cd68f87

SHA512
9323a9773f6bd068bdbfaba79877adffd102db21f1a72f8f010dfcc531a4888b74d9d0c07fff9ac2a9fccf008ff4bc2c9bae144a5e565d6a6bf57b1cccc0a9ee

Download Submit
C:\Windows\System\GvOdDnS.exe

Filesize
1.4MB

MD5
1b461d98fd746cfbfa3a06396da552d7

SHA1
8297e1b13aead7bbdde6657f5a6f2011a5f6802c

SHA256
3ab2b9d89cfab22c0abd2884b3966b718b585a4a408c561b8933f341708b33a2

SHA512
c2b7a610d03ea973802a32a5259869fcd9d9fa39fd2f06373199673d79a7a9a2a6f934e657c510b772ec082974f316a48e816674f2294d6aad59d5e4d24e3aec

Download Submit
C:\Windows\System\GwNyBWv.exe

Filesize
1.4MB

MD5
31675f83f88f4c865ac8882676c3451e

SHA1
6e6b1b8296f699a1ea7a104a39b79c4ecb499a58

SHA256
49cada0be634079ac4a935bec7bc01c133a14018faf29b218ad5d4b18fb8a7e8

SHA512
00973facf24ac495c9ca06d01593b59a68d1c590863d3b677d6514b740a6765561eb646236317a8b4c904481d3457a9999dfbac0812e7f66b3d778927fba8eda

Download Submit
C:\Windows\System\GxgZmSK.exe

Filesize
1.4MB

MD5
d0c331a33d58b1361e82c8dcff43afef

SHA1
7534b39a8efa258c7332d2105a6570a06b2b5b3e

SHA256
3eda47d5ce74d9fbc42034e91a4011cecd311ca2136f2557c19e96bc60d80947

SHA512
f85302b8cbe58898ed1f08bbf74ab0e099be31eac22b24ca18b23e54be235b9a00ad886f6502bc9036ae051db0bdb2b705a224f30ae0f5ec828d3645a106dea0

Download Submit
C:\Windows\System\JHywxMA.exe

Filesize
1.4MB

MD5
712672dd388836d3ead90ae9bb613776

SHA1
9d90ff0688c6fb6c99e2271de7991929e9855bad

SHA256
34d03b10105f8ab532c7e54fecf5d4fd9c2643581724af465705075eb24397ec

SHA512
1cf5d6605a76fc300953ddada772036affe085e9cfcb55f39b98ddb25821b1eb893c53b459bb9683d910ff8be0bef12f146c35fbdb3a1da885a3c8e0bd916813

Download Submit
C:\Windows\System\JOLXTee.exe

Filesize
1.4MB

MD5
52b99e1102e9867f46a6bdffb3ae03dd

SHA1
bca10ee8b93ce014cfddb1c11010f86d5ab58a0d

SHA256
985ba91ea74b31e82d8c6fa7c9f52df18a3f36ad2749213a9b614f0e564a296a

SHA512
e53f273c99ff9a37dd07a34d1a83ff25dbf818de5607b3d12941f69ff99f4ce3a45ddde17d5adc755fbd00666e489d38f5b3ab145727771de3d8868bc8789f17

Download Submit
C:\Windows\System\KEItqHN.exe

Filesize
1.4MB

MD5
c5a238625d99481adf440852e9726269

SHA1
3f62bada9f87b5fd717d0946941efa32f8ca1a66

SHA256
45dea4ba50b773c0224d87587726658c66c6ec3c7b0717fa32dcf15d8966a655

SHA512
abeb2aeb3deefa943bbf9c685f71cb3b7f9e23a46680a7fa0a1774e9aae4c308110d114048ed778d32f3206cdb2a72fe5e68944f6a85592413f0887897f95ff0

Download Submit
C:\Windows\System\KOOZxkz.exe

Filesize
1.4MB

MD5
4fd0e3f8168e28d8a2a64ac53efd740d

SHA1
f8ff7744e86d7bbdc6185d5d90ec755c0d2bc3a3

SHA256
94271004708e4b430b1f1b752aecde8799e0b5ec1d7568314451f1135a2add08

SHA512
eaf55f19c68e0c7c36a8d1d03c82d96ea038527ba8d12755df44daab618ef2d1b76e8084d4b9c5a420b399fdc37cbd891ff0c963a9158ebd38212b9640ba65f3

Download Submit
C:\Windows\System\KghFuvu.exe

Filesize
8B

MD5
8a9416a5ba3f4513ce86ee25fcd9ed2c

SHA1
a36f3dd1333c8cfee404b646d4c6809d7e653313

SHA256
fb7dd3a16f87fe8b7e98987069f2b605508df1550402bd2a9bfdec4856b1a59a

SHA512
c747d417c3e282ae9ec82b691c8fea9cb7d0729d1dda54d2144fa9c71dd39f2ab11cee5a6768a89cb91fd4a7ae6e579302cb4e4de8d6384014994320074580a4

Download Submit
C:\Windows\System\LhubNSd.exe

Filesize
1.4MB

MD5
cc132111b4b0a295e04f42737e852aed

SHA1
a53d48cbc6e700811ec771490a0c9ddce4d26a08

SHA256
76d15cfd8b335684b5e9d3de5be35f17716a130d132a70d2c9214baed54bd6bb

SHA512
bbebadfe9f980d46bc5ff260e7c1279599cd09c582d9d9e7c45adedef85c271204e5e4b5b4e489a12c5393541b6799831b75bf0d301bbca03871505e109f46f0

Download Submit
C:\Windows\System\OWausfX.exe

Filesize
1.4MB

MD5
7551c932c4b3626b7642c602054a2488

SHA1
cdb99e1012c7456e1e27bb846c588a4fe1305c25

SHA256
9f8e58e3c98c7edcd0f121e110c0291a863384763cbf391434fc210e60e228b8

SHA512
3cce18ff2e0ac04a424ce9cdd9d3db58a407a55e2bf7315c73c2dcd811d7d41b27abf665709efb019680f25398ed7dbf98c45ba0310d081520eceb7720218ab6

Download Submit
C:\Windows\System\PSUUTtD.exe

Filesize
1.4MB

MD5
18cac3f41cfb59a4889229ad86061519

SHA1
769fc7c0886ea5d3c225e925ea9aa950ee316e40

SHA256
d8816597b7db8c71b44c76f07dfd85f0f0b1b3da65d356fe96604785af6b02b7

SHA512
6d8df2baf15039c5f7c0c2b9551d8083566282af3bd4b36a84c90005a8e2fc4f8a7462607d305a2cbaa6a8855d64a335366b314b72f2563651c7fd255f6afed5

Download Submit
C:\Windows\System\RSsRXmN.exe

Filesize
1.4MB

MD5
eeb1b6b300225d69a85ae34a7fc88e15

SHA1
c19fa4be28f4e8123c784d07a5eb20c33534251f

SHA256
935dc2de52f8c7ef53d2355e58c783ad7c65c4a0e4e9b0147784f5c4b515e00e

SHA512
2bc6da41a6859e64f057fb62b859aa7a72d00bdface66448bf5c74bdb1bda06fd9c020a542a706717560a31a445e1d2176078c832f037f64c622720f1aed1bec

Download Submit
C:\Windows\System\TArCfUw.exe

Filesize
1.4MB

MD5
e94f9f1f33e7e716a5225029dbb6dab4

SHA1
a9f41315f9a5d49815386bd9e36201e714f9a5a6

SHA256
11c3f34551d1f015569fcacb9b57aa524aab6e17a54685f998e9d073e17be13a

SHA512
6ad633168139944eeed0b30f128aaa86a25cab9d9eed5b40f9407bbe3f150ea74fe0e37fb3228fd5b97ee0b9e7cf28ca853f72abb3d55b57b96d15bf3e145c9b

Download Submit
C:\Windows\System\VRYiUOv.exe

Filesize
1.4MB

MD5
4ec781230a04fc5a4f394e2c6ac691b9

SHA1
777571849086ffef953e07fc4e7aab40c2b2bcdb

SHA256
0f6d6a74571b893be4a50aee7c0123ac790b98905cbf6e97dcbc04156e57517e

SHA512
93633ba7d179799ed45819ed6192683dcfa61f9d77728ac7c986e3c0fb650146f3306e26fa1484523d6fcd6c3f7e9528b61a1a665847586b97662929bc8d33b3

Download Submit
C:\Windows\System\WPXOdrJ.exe

Filesize
1.4MB

MD5
45a693132ddfaf9021875232bbeb6657

SHA1
dd7eb75016ded74f96b059ec65a4e664257f81ad

SHA256
6f20e70fbdb31b5c019c1e2b8d8133b939182024eb7ee251849d7d6da22acc5d

SHA512
3ac12d3ccdf664f6ce5fc93f3c13964c39fefc74d08de4f9cc1f9358cdc5dd5efd8e1254752b7e71602b61d2b36031648417a759318dfd3e7c6bd52ea19d6b6f

Download Submit
C:\Windows\System\WQsjSjU.exe

Filesize
1.4MB

MD5
db22d42cb5daa30d4d1d9d89a90068a1

SHA1
d7eadabbe37b25551a3a51ee8fff80a9afa1b713

SHA256
3d7eca77f4b1e1d7136bb3413ef161861645a29a26a84321063d813848d86bbb

SHA512
3836f8d864a05db5889b1127f4cafeb878ea34a0a8907558781cae7f872ac4f0aed2b9d2b842a8d101435900e9c4765cc6f2b72c7a4706d2d682a4265faf194a

Download Submit
C:\Windows\System\XVIJpSI.exe

Filesize
1.4MB

MD5
0ffd59202cb664e9688c9e6453bfeaac

SHA1
255394c3bd60ee815e165daee01829dfaae78e22

SHA256
efd6611ae0b61028afaf08159597540e77ef0ee89f98ce8b3f5f144038bb59ab

SHA512
ca89763e4f56b3d9efb4c8182f637a85b68f80cde11ef601bba7bc16dd057d3c5828159dc47e0a99035daf981734d722a871795676b42ef391b7700814967a58

Download Submit
C:\Windows\System\YATVlXk.exe

Filesize
1.4MB

MD5
12336e2440c290796933cdf381ed7ad5

SHA1
4f9d5a68b1c700ef1821c846d7f8dae108f15542

SHA256
81a0f5bfc3743b10682054b0543ac220c86be6cd584a10df0e8d3dcea6307b2b

SHA512
e0b380812edc81d4f1cc1ae11feb424eebff775d931ba282d5b7e29c17e16230bec7bd2c7f88f92b699f8761d65439c399a2fed851211d847a7ff3f324ef5035

Download Submit
C:\Windows\System\YkmKWLs.exe

Filesize
1.4MB

MD5
482e86c8a3f3f2ba7a1e97ff4ebb1fbf

SHA1
21b0ce2c5ab492397ad7f0b0684a6deb19775e05

SHA256
c1ba9377e658b9a5c6a7a1e4fa3ad8006b1b9d4a5ad08157e51b9ab9d14c2ae8

SHA512
b2057e657a80376c85665a372cc31335334ed17c778a9101cebf4105136013f597269d3156c0b58fcd4238a09b7d5aa8f6b308fa4eee8d764ac232194bffe488

Download Submit
C:\Windows\System\aqvkOvX.exe

Filesize
1.4MB

MD5
073ebacfd69d5a359d60cc62e7b8e379

SHA1
6ac5c585280f0a3d1a6b36e09f1dd533a6bd4a8e

SHA256
29be718811d885aa8ee44bd240cdf71a783050831217d97f82233d4955d2125a

SHA512
8bcfd4fc63f5519f32fc68aa59b763e6fee4568c3b4b149c674a978a29bad6e4d0886e921eac9a3851b5107f5d73c9fa1f79d5324d9e3f505f9364ae20da88d9

Download Submit
C:\Windows\System\axTEEOI.exe

Filesize
1.4MB

MD5
8cf67320a3ff2c0376cc3d72e667e0c8

SHA1
4803d5976a3326a37efa5be5cd85119dfd110a95

SHA256
afe25bb6d98367aeab70416f8626ea511ad24a12f93a79949684de502f73f811

SHA512
4d054dc6e3c26268e2c85e1e34ac87a51b88b63d8c2bd79c0292bf783e441a27fe9821b8e85471cfa6bace8bd7b1d244532c0258ee3840a81702177475e26658

Download Submit
C:\Windows\System\fWHhFaA.exe

Filesize
1.4MB

MD5
cd9c03691262c30fe860f7df2fcc7df0

SHA1
ececacd95a1c5370eaa8fa57358f7f679d7d0ced

SHA256
e98a716ac550ba5c7a3003c471f134d537b8febb2376cfcd3baad5b53eab129f

SHA512
af3818090b77b556ed0f3bd229dd552bb2a0e1de3bccf80a378e220058f0fac5fa27316a8ac54d3ded6125b0d2c2b54745f9530276555db10660d88d8e31241d

Download Submit
C:\Windows\System\gbiMtkM.exe

Filesize
1.4MB

MD5
afec99ad5c91e3c330fc1c4ed8d2c78e

SHA1
22a33bfd306c5ce4847b6367be8e6bc1451f563a

SHA256
919de8ac90d8814b1a851f2820b5aa8c35718aa480cf5da9614e45eddb06ec70

SHA512
3484f52da39e8ebfc6eb3d21ddb0d715f67f152276182f58b92f88bca599753f2234122d8ed15cbc5a0e9aa6a6d832f2813ebe5c182ca0b06d20d74ab204266a

Download Submit
C:\Windows\System\hVfYgPK.exe

Filesize
1.4MB

MD5
dd381a5c3e0629ce5422731e2e01d95e

SHA1
7fba3b1e8750a5c5ec59b7871c8651ae5f8d14d7

SHA256
19f1efb4a6c4c17ca785bf5ccd6a82eb080cde9e1eb8917cdb5e504d08ef94d1

SHA512
aec8959598937de6d05dea97db4e188e0073b1ae81f9742ba49371d14c7edadb7b1c9cbde3b5b8af95dc8d8c4c80ec17c93245a1b6794fd2f2f5a9cf2f44ffef

Download Submit
C:\Windows\System\kURMJgg.exe

Filesize
1.4MB

MD5
f371e81d3011cddb30faf0ccbcd1c656

SHA1
f091e5086d054da4e6b5ee1fd30dd81447891ca7

SHA256
64f29eedf713ad2b2f21d17b87eed1bdf8c65ea69ff86fbe06f001938079ab7e

SHA512
2fa5a87ffcdcb3c45efd152eb3fe292a1859ebbd4f943cd685de299fc904218551a0266bda755a3f0342939e7fdd1eedcbf6ec86a5c507ef35e6d2b1e4a2422a

Download Submit
C:\Windows\System\lSYhnYA.exe

Filesize
1.4MB

MD5
e2b2c220527605b862797343d25210f6

SHA1
4f4d2bd2d7d73f74743274c4ce557f897de0f279

SHA256
ec9655ee9639473c2df01abeb2009ac8599f93a9d45df620f05f9c8b5c7a8659

SHA512
09bd129134ef3b7bf16db13ec4ecea43476d11a24ec6ba6dbaa145128c0a0a117afed931bb359f801a4bc9a10798118fc47ba099b6541dd7cf88bd8326091cba

Download Submit
C:\Windows\System\lkvRPvn.exe

Filesize
1.4MB

MD5
4dae94de2ee41511079eab212674e715

SHA1
385020a7e5e5bac3a7cbbf7d5384a5e4c4860795

SHA256
317a33173685034a32c2a121b715e6be785f3bd06e13dc714427bb65456dd3e7

SHA512
634250db13a290b0d331c07d12b09661fb2f58875dc0aa0ac586899a0fffeba1ca3a43fd8e4499ef3c875d144b45f553bb532f66b7afb0d287dbada4d246bf68

Download Submit
C:\Windows\System\nhoOWdd.exe

Filesize
1.4MB

MD5
0caa395925d6a836f5bc8462bb1b1626

SHA1
8659a441dfc68f52681a5f1e4501bc4c7c03adc9

SHA256
07fe27694fde1bbed4b5c0f5947229a0d5d97ea327252d29a8e649ce9b603f55

SHA512
2210b236992d6fa8821b343c7a65db1286dee97f7f293847f1aacbdfa1065e3e010892216d5098c3a3d356ee44a4549de5fdb049046f11de4188c9aaaa245a6a

Download Submit
C:\Windows\System\oauqBCk.exe

Filesize
1.4MB

MD5
734fbfcabbb46e11fe6249d287c34908

SHA1
ec256bfea49dcda305549c95a16b061061715574

SHA256
467fa4e02175f967146e1bafa649ee49da950552304452125a1e87e827a9ebf5

SHA512
908b5ed31486253a10a856988717e2083ea164b02c30c51d206c4b8aa686e4550490f0bc5ce75457e32780809e39331c36151ceda453b877fd0539774c53c114

Download Submit
C:\Windows\System\pRPBXAY.exe

Filesize
1.4MB

MD5
56690ae5a2d76e3c2f83f0e3de0923d3

SHA1
798dae2f41006ae7c5731d93c724521da416e226

SHA256
0f115d124c79a366e399b0fc005002ea0f413d383859a308658edaa5bc3d1929

SHA512
7d667149105497f7d85667d68d901f7f7f8908acb27a775da0c6d8373f0f091f169558bca0edc2881a048850080c38d6c439098fcff3371bf37490e6ff228511

Download Submit
C:\Windows\System\qJxsAfm.exe

Filesize
1.4MB

MD5
d4b5a4abb189a64c71bab3be8df59b99

SHA1
9b738fd17ace694d75cc5509171835350f687f57

SHA256
d6d9bc83abdbeee06674653be8b6c3d5777b892dbd6e8ec7490fcd844769c1bb

SHA512
512f5dc5b4a41775214ba1970e0fe6a377ec628a56828daf7f0ae243ba6ab8d03b9c2d4ab2edccfaf0e0ea544d97614b1eff0589924bcd1aa853faf736d3ef26

Download Submit
C:\Windows\System\qRjcoFs.exe

Filesize
1.4MB

MD5
ece941a2f6affb4253d0782aa1090689

SHA1
7301100772cf456b7b276dfccce704ad10b0af79

SHA256
94c516d3487f06742b3f1cdcfb13a5e03606817f763f48a8cbf193533b78034c

SHA512
3ea96a090a2e5ec8f8a5f7879576b0100c946340a0753dc1485ad7690217d1ef70a3020514a2017132d8cf616bdcc8e7b7a87864cc56e3dd74fd5e7935ea7f41

Download Submit
C:\Windows\System\qbawOXi.exe

Filesize
1.4MB

MD5
86d39ba4aad6f38bcdcf32a96d8a060e

SHA1
6eb3d55ab00e4c976c2ef180168ea3c06e4a94b1

SHA256
044c74e9ef1642d34bb923c440ba4b9dfb22855c63295aafe6c8771acbdaccc5

SHA512
f5cf249850d09df0dfe0252e269ba7e4fec150bd8d77b853e0d536527536c28dd3ca38734014b32eb2fbf34e5be90a55794ee3bdccc990e3ba33112f1aca2fbd

Download Submit
C:\Windows\System\sTXFUHy.exe

Filesize
1.4MB

MD5
916c5f59674885652161b67217f9d208

SHA1
3d12b8092fa94346c6058035c18b5dc81d935280

SHA256
bae6b0c8cf8aaa164123db7859959f4c0dbbce4596ad899c5e5a756fc359ef50

SHA512
3f7479a0ce82056d2a375c83b59ce82fece2089e01e53254e4a4636e76365e704945edb750fe8b025c4a0c9ea3c45519883ddafc7aa1f9f702fb5b8474a21e82

Download Submit
C:\Windows\System\soYFQPg.exe

Filesize
1.4MB

MD5
dc5a5bce78ce921a934b60d9e5add0ce

SHA1
5d5371b3e8c65b8d7479042042faf037bc0c9302

SHA256
07c96bfdf5b3eb4120851e625ed334c1e4d14eb68de7a8fa064203ec3eb78152

SHA512
623b16da2e67c5b7f55fa267a1b6305df7a009f0989e92dbb03e3642e813ec5be71357d880f4e1930f0b354f6233d8513b9eb85289266936e5287c1812a89a40

Download Submit
C:\Windows\System\spwanzr.exe

Filesize
1.4MB

MD5
a74e2512d0d53c403f2641fc0e46b974

SHA1
30e32a0decf14bfdc1f9a6932480884294800f5b

SHA256
7f01d16b7b5984d9c2a231cfe5d9a03ebb76a7ff29ca3619d5ae2bf3b34023db

SHA512
092e281def4868e20acd43d5ea06bb1f984971d488bc3d5c39ff4595719f98afcfba4fd3ec9620c05eb8c727f46992b9c069a98f04bb1cc07b63eb7dede75730

Download Submit
C:\Windows\System\uYSBXdt.exe

Filesize
1.4MB

MD5
996cb63adf990108945264496aa655c0

SHA1
cfc271187608c6784281c3e8028c3590f65be325

SHA256
fca22e104fc04dd5d4a1c279962cc383912fbdf5cc1d489a1b3b6faa4e103617

SHA512
1763f6ae224bc16217dc73e417969d1e9fc370289d8d21268245b72c181fbe47bd48f2c2302350ac91cb0e4b6754ef63d0b6961ea8413c8de1a3b10a0db4848a

Download Submit
C:\Windows\System\uwrckmf.exe

Filesize
1.4MB

MD5
05cb1c081b37f966b2ab2d809a82b71b

SHA1
66382eb39739b33108ba37aec688f29b59282ebb

SHA256
4f8e9300bcf5b885eae24022c33a03656ae97316b29601c12a15cf8ac30b2934

SHA512
756c98c409761b984c5948c0fb6a1b68df0d89a975484921927c1e096fa641e16ea0ce7172ab5bd5d1265696841b86ab4c7014a45f6629101391276adcd4ee97

Download Submit
memory/396-200-0x00007FF6D0790000-0x00007FF6D0B82000-memory.dmp

Filesize
3.9MB

Download
memory/400-196-0x00007FF76B3B0000-0x00007FF76B7A2000-memory.dmp

Filesize
3.9MB

Download
memory/808-185-0x00007FF7CB300000-0x00007FF7CB6F2000-memory.dmp

Filesize
3.9MB

Download
memory/812-191-0x00007FF7A6200000-0x00007FF7A65F2000-memory.dmp

Filesize
3.9MB

Download
memory/1016-194-0x00007FF70F220000-0x00007FF70F612000-memory.dmp

Filesize
3.9MB

Download
memory/1104-4711-0x00007FF6CD4E0000-0x00007FF6CD8D2000-memory.dmp

Filesize
3.9MB

Download
memory/1104-197-0x00007FF6CD4E0000-0x00007FF6CD8D2000-memory.dmp

Filesize
3.9MB

Download
memory/1112-0-0x00007FF736F40000-0x00007FF737332000-memory.dmp

Filesize
3.9MB

Download
memory/1112-1-0x000001F730920000-0x000001F730930000-memory.dmp

Filesize
64KB

Download
memory/1112-4583-0x00007FF736F40000-0x00007FF737332000-memory.dmp

Filesize
3.9MB

Download
memory/1340-190-0x00007FF609760000-0x00007FF609B52000-memory.dmp

Filesize
3.9MB

Download
memory/1468-203-0x00007FF602610000-0x00007FF602A02000-memory.dmp

Filesize
3.9MB

Download
memory/1644-187-0x00007FF699410000-0x00007FF699802000-memory.dmp

Filesize
3.9MB

Download
memory/1920-606-0x000001969FEE0000-0x000001969FF02000-memory.dmp

Filesize
136KB

Download
memory/1920-193-0x00007FFA57FC0000-0x00007FFA58A81000-memory.dmp

Filesize
10.8MB

Download
memory/1920-177-0x00007FFA57FC0000-0x00007FFA58A81000-memory.dmp

Filesize
10.8MB

Download
memory/1920-27-0x00007FFA57FC3000-0x00007FFA57FC5000-memory.dmp

Filesize
8KB

Download
memory/1920-2272-0x00007FFA57FC0000-0x00007FFA58A81000-memory.dmp

Filesize
10.8MB

Download
memory/2004-4718-0x00007FF7DEAD0000-0x00007FF7DEEC2000-memory.dmp

Filesize
3.9MB

Download
memory/2004-186-0x00007FF7DEAD0000-0x00007FF7DEEC2000-memory.dmp

Filesize
3.9MB

Download
memory/2040-181-0x00007FF721140000-0x00007FF721532000-memory.dmp

Filesize
3.9MB

Download
memory/2112-182-0x00007FF714310000-0x00007FF714702000-memory.dmp

Filesize
3.9MB

Download
memory/2288-202-0x00007FF6D4F40000-0x00007FF6D5332000-memory.dmp

Filesize
3.9MB

Download
memory/2592-184-0x00007FF6A8FF0000-0x00007FF6A93E2000-memory.dmp

Filesize
3.9MB

Download
memory/2784-189-0x00007FF69C550000-0x00007FF69C942000-memory.dmp

Filesize
3.9MB

Download
memory/2784-4594-0x00007FF69C550000-0x00007FF69C942000-memory.dmp

Filesize
3.9MB

Download
memory/3168-183-0x00007FF688550000-0x00007FF688942000-memory.dmp

Filesize
3.9MB

Download
memory/3344-204-0x00007FF60A920000-0x00007FF60AD12000-memory.dmp

Filesize
3.9MB

Download
memory/3956-192-0x00007FF6BF300000-0x00007FF6BF6F2000-memory.dmp

Filesize
3.9MB

Download
memory/4020-26-0x00007FF6E19F0000-0x00007FF6E1DE2000-memory.dmp

Filesize
3.9MB

Download
memory/4236-201-0x00007FF6E2D40000-0x00007FF6E3132000-memory.dmp

Filesize
3.9MB

Download
memory/4236-4732-0x00007FF6E2D40000-0x00007FF6E3132000-memory.dmp

Filesize
3.9MB

Download
memory/4284-195-0x00007FF60DFE0000-0x00007FF60E3D2000-memory.dmp

Filesize
3.9MB

Download
memory/4284-4725-0x00007FF60DFE0000-0x00007FF60E3D2000-memory.dmp

Filesize
3.9MB

Download
memory/4336-199-0x00007FF6C3D40000-0x00007FF6C4132000-memory.dmp

Filesize
3.9MB

Download
memory/4788-188-0x00007FF7D4910000-0x00007FF7D4D02000-memory.dmp

Filesize
3.9MB

Download
memory/4968-198-0x00007FF63A880000-0x00007FF63AC72000-memory.dmp

Filesize
3.9MB

Download
memory/4968-4727-0x00007FF63A880000-0x00007FF63AC72000-memory.dmp

Filesize
3.9MB

Download