xmrig | 2406f606500bb728a02d22858a8793cf8320622f006b0d972ae5f17990bf9169

Analysis

max time kernel
127s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07-05-2024 06:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
Size

2.1MB
MD5

1fb23cb1cd6a177df26d7cd7a9cf1860
SHA1

9d868d872b56073c59be2ad458b0f0779cf60954
SHA256

2406f606500bb728a02d22858a8793cf8320622f006b0d972ae5f17990bf9169
SHA512

df5cd088a25a01e33ed43a22874142f40fc67eb10e4f10b8448bfff54ef01d8f865609cc1006b7975b2dc5c85d5b5ff76b6b108b03cb36da7e5b28b50b4d8b00
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafM4U7:NABR

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 47 IoCs

miner

resource	yara_rule
behavioral2/memory/1860-436-0x00007FF76F410000-0x00007FF76F802000-memory.dmp	xmrig
behavioral2/memory/396-474-0x00007FF7DAA30000-0x00007FF7DAE22000-memory.dmp	xmrig
behavioral2/memory/2260-488-0x00007FF7B16E0000-0x00007FF7B1AD2000-memory.dmp	xmrig
behavioral2/memory/412-644-0x00007FF6A2950000-0x00007FF6A2D42000-memory.dmp	xmrig
behavioral2/memory/1996-951-0x00007FF6E9F40000-0x00007FF6EA332000-memory.dmp	xmrig
behavioral2/memory/3148-886-0x00007FF742960000-0x00007FF742D52000-memory.dmp	xmrig
behavioral2/memory/1528-897-0x00007FF7F8CB0000-0x00007FF7F90A2000-memory.dmp	xmrig
behavioral2/memory/4596-892-0x00007FF6AE720000-0x00007FF6AEB12000-memory.dmp	xmrig
behavioral2/memory/5004-826-0x00007FF67F380000-0x00007FF67F772000-memory.dmp	xmrig
behavioral2/memory/4968-823-0x00007FF7FC6A0000-0x00007FF7FCA92000-memory.dmp	xmrig
behavioral2/memory/4468-776-0x00007FF783060000-0x00007FF783452000-memory.dmp	xmrig
behavioral2/memory/892-775-0x00007FF7427E0000-0x00007FF742BD2000-memory.dmp	xmrig
behavioral2/memory/4872-707-0x00007FF718ED0000-0x00007FF7192C2000-memory.dmp	xmrig
behavioral2/memory/2464-439-0x00007FF67D840000-0x00007FF67DC32000-memory.dmp	xmrig
behavioral2/memory/1780-383-0x00007FF792B70000-0x00007FF792F62000-memory.dmp	xmrig
behavioral2/memory/5060-339-0x00007FF72BD90000-0x00007FF72C182000-memory.dmp	xmrig
behavioral2/memory/4780-305-0x00007FF65FA80000-0x00007FF65FE72000-memory.dmp	xmrig
behavioral2/memory/2192-272-0x00007FF7B6550000-0x00007FF7B6942000-memory.dmp	xmrig
behavioral2/memory/5048-213-0x00007FF627B90000-0x00007FF627F82000-memory.dmp	xmrig
behavioral2/memory/3760-212-0x00007FF7902E0000-0x00007FF7906D2000-memory.dmp	xmrig
behavioral2/memory/1304-193-0x00007FF7AB850000-0x00007FF7ABC42000-memory.dmp	xmrig
behavioral2/memory/1848-3665-0x00007FF6BEC90000-0x00007FF6BF082000-memory.dmp	xmrig
behavioral2/memory/2760-3666-0x00007FF745DC0000-0x00007FF7461B2000-memory.dmp	xmrig
behavioral2/memory/1848-3700-0x00007FF6BEC90000-0x00007FF6BF082000-memory.dmp	xmrig
behavioral2/memory/2760-3702-0x00007FF745DC0000-0x00007FF7461B2000-memory.dmp	xmrig
behavioral2/memory/3760-3704-0x00007FF7902E0000-0x00007FF7906D2000-memory.dmp	xmrig
behavioral2/memory/2192-3707-0x00007FF7B6550000-0x00007FF7B6942000-memory.dmp	xmrig
behavioral2/memory/1304-3709-0x00007FF7AB850000-0x00007FF7ABC42000-memory.dmp	xmrig
behavioral2/memory/2092-3710-0x00007FF75EC00000-0x00007FF75EFF2000-memory.dmp	xmrig
behavioral2/memory/396-3723-0x00007FF7DAA30000-0x00007FF7DAE22000-memory.dmp	xmrig
behavioral2/memory/5060-3725-0x00007FF72BD90000-0x00007FF72C182000-memory.dmp	xmrig
behavioral2/memory/4968-3741-0x00007FF7FC6A0000-0x00007FF7FCA92000-memory.dmp	xmrig
behavioral2/memory/892-3745-0x00007FF7427E0000-0x00007FF742BD2000-memory.dmp	xmrig
behavioral2/memory/412-3743-0x00007FF6A2950000-0x00007FF6A2D42000-memory.dmp	xmrig
behavioral2/memory/1860-3736-0x00007FF76F410000-0x00007FF76F802000-memory.dmp	xmrig
behavioral2/memory/2464-3735-0x00007FF67D840000-0x00007FF67DC32000-memory.dmp	xmrig
behavioral2/memory/3148-3733-0x00007FF742960000-0x00007FF742D52000-memory.dmp	xmrig
behavioral2/memory/2260-3731-0x00007FF7B16E0000-0x00007FF7B1AD2000-memory.dmp	xmrig
behavioral2/memory/4596-3729-0x00007FF6AE720000-0x00007FF6AEB12000-memory.dmp	xmrig
behavioral2/memory/5048-3721-0x00007FF627B90000-0x00007FF627F82000-memory.dmp	xmrig
behavioral2/memory/4872-3719-0x00007FF718ED0000-0x00007FF7192C2000-memory.dmp	xmrig
behavioral2/memory/4468-3717-0x00007FF783060000-0x00007FF783452000-memory.dmp	xmrig
behavioral2/memory/1780-3738-0x00007FF792B70000-0x00007FF792F62000-memory.dmp	xmrig
behavioral2/memory/1528-3713-0x00007FF7F8CB0000-0x00007FF7F90A2000-memory.dmp	xmrig
behavioral2/memory/4780-3727-0x00007FF65FA80000-0x00007FF65FE72000-memory.dmp	xmrig
behavioral2/memory/5004-3715-0x00007FF67F380000-0x00007FF67F772000-memory.dmp	xmrig
behavioral2/memory/1996-3779-0x00007FF6E9F40000-0x00007FF6EA332000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
10	3116	powershell.exe
12	3116	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3116	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1848	DUWamjU.exe
2760	IuwFJXo.exe
2092	DNSSRvM.exe
1304	hHPHgSk.exe
3760	JiiVfhi.exe
5048	wHcZrRj.exe
2192	NVqhTlx.exe
4780	ZupktkM.exe
1996	bnuVGcQ.exe
5060	AtiIbtN.exe
1780	SZnJHIY.exe
1860	SRmcgHF.exe
2464	PPTpyPk.exe
396	jWPGIUA.exe
2260	BhMNwTf.exe
412	AkXBCZC.exe
4872	QzcbACR.exe
892	zsHXWGO.exe
4468	jSwCpcT.exe
4968	maJeKnx.exe
5004	vTDtlZf.exe
3148	etbqOGJ.exe
4596	asyrHyG.exe
1528	GFZgUmD.exe
4268	tYYPbdO.exe
3644	KyzsGZR.exe
3252	QRZJCQL.exe
3168	dgKUWrw.exe
5016	jCHRfZr.exe
1896	zkpVNrj.exe
1140	TOQhmjo.exe
3800	VNYKHIy.exe
448	PSBGgGG.exe
4088	omUTWKL.exe
2136	XYdQmwW.exe
4032	ausUzDD.exe
1056	TKjavth.exe
4796	NouUktL.exe
2868	JfxPvCn.exe
4876	ErHRghz.exe
4156	qamaqaK.exe
2252	yRZjHCK.exe
2112	HIexeOu.exe
2940	qlLHFYU.exe
4444	fyhLAGu.exe
1828	OALSShG.exe
4568	lMErvKG.exe
3500	qwQIKyu.exe
2632	WoRXMGC.exe
2884	RfYnITn.exe
3156	bAOQsCd.exe
3492	OxhzgyD.exe
4384	sdPeoUh.exe
3740	EjocRZt.exe
3732	FLWwoHF.exe
4664	gMBDxIS.exe
4784	mLSvYaU.exe
1276	TzSULHL.exe
1620	UsVDtWj.exe
3084	ekCtWDV.exe
4412	xsNxinD.exe
2808	eWxBdzb.exe
5036	gUBvvTI.exe
3464	clKZNzy.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/944-0-0x00007FF678560000-0x00007FF678952000-memory.dmp	upx
behavioral2/files/0x000a000000023bb7-25.dat	upx
behavioral2/files/0x000b000000023bb2-16.dat	upx
behavioral2/files/0x000a000000023bba-30.dat	upx
behavioral2/files/0x000a000000023bb9-29.dat	upx
behavioral2/memory/1848-13-0x00007FF6BEC90000-0x00007FF6BF082000-memory.dmp	upx
behavioral2/files/0x000a000000023bb8-28.dat	upx
behavioral2/memory/2760-22-0x00007FF745DC0000-0x00007FF7461B2000-memory.dmp	upx
behavioral2/files/0x000a000000023bb6-8.dat	upx
behavioral2/files/0x000a000000023bc2-74.dat	upx
behavioral2/files/0x0031000000023bbc-34.dat	upx
behavioral2/files/0x0031000000023bbd-59.dat	upx
behavioral2/files/0x000a000000023bbb-31.dat	upx
behavioral2/memory/2092-56-0x00007FF75EC00000-0x00007FF75EFF2000-memory.dmp	upx
behavioral2/files/0x000a000000023bc6-82.dat	upx
behavioral2/files/0x000a000000023bc5-79.dat	upx
behavioral2/files/0x000a000000023bc4-78.dat	upx
behavioral2/files/0x000a000000023bc1-73.dat	upx
behavioral2/files/0x000a000000023bc9-97.dat	upx
behavioral2/files/0x0031000000023bbe-94.dat	upx
behavioral2/files/0x000a000000023bc0-69.dat	upx
behavioral2/files/0x000a000000023bbf-68.dat	upx
behavioral2/files/0x000a000000023bcc-111.dat	upx
behavioral2/files/0x000a000000023bcd-156.dat	upx
behavioral2/memory/1860-436-0x00007FF76F410000-0x00007FF76F802000-memory.dmp	upx
behavioral2/memory/396-474-0x00007FF7DAA30000-0x00007FF7DAE22000-memory.dmp	upx
behavioral2/memory/2260-488-0x00007FF7B16E0000-0x00007FF7B1AD2000-memory.dmp	upx
behavioral2/memory/412-644-0x00007FF6A2950000-0x00007FF6A2D42000-memory.dmp	upx
behavioral2/memory/1996-951-0x00007FF6E9F40000-0x00007FF6EA332000-memory.dmp	upx
behavioral2/memory/3148-886-0x00007FF742960000-0x00007FF742D52000-memory.dmp	upx
behavioral2/memory/1528-897-0x00007FF7F8CB0000-0x00007FF7F90A2000-memory.dmp	upx
behavioral2/memory/4596-892-0x00007FF6AE720000-0x00007FF6AEB12000-memory.dmp	upx
behavioral2/memory/5004-826-0x00007FF67F380000-0x00007FF67F772000-memory.dmp	upx
behavioral2/memory/4968-823-0x00007FF7FC6A0000-0x00007FF7FCA92000-memory.dmp	upx
behavioral2/memory/4468-776-0x00007FF783060000-0x00007FF783452000-memory.dmp	upx
behavioral2/memory/892-775-0x00007FF7427E0000-0x00007FF742BD2000-memory.dmp	upx
behavioral2/memory/4872-707-0x00007FF718ED0000-0x00007FF7192C2000-memory.dmp	upx
behavioral2/memory/2464-439-0x00007FF67D840000-0x00007FF67DC32000-memory.dmp	upx
behavioral2/memory/1780-383-0x00007FF792B70000-0x00007FF792F62000-memory.dmp	upx
behavioral2/memory/5060-339-0x00007FF72BD90000-0x00007FF72C182000-memory.dmp	upx
behavioral2/memory/4780-305-0x00007FF65FA80000-0x00007FF65FE72000-memory.dmp	upx
behavioral2/memory/2192-272-0x00007FF7B6550000-0x00007FF7B6942000-memory.dmp	upx
behavioral2/memory/5048-213-0x00007FF627B90000-0x00007FF627F82000-memory.dmp	upx
behavioral2/memory/3760-212-0x00007FF7902E0000-0x00007FF7906D2000-memory.dmp	upx
behavioral2/memory/1304-193-0x00007FF7AB850000-0x00007FF7ABC42000-memory.dmp	upx
behavioral2/files/0x000a000000023bdb-187.dat	upx
behavioral2/files/0x000a000000023bda-185.dat	upx
behavioral2/files/0x000a000000023bd9-184.dat	upx
behavioral2/files/0x000a000000023bd8-183.dat	upx
behavioral2/files/0x000a000000023bd7-182.dat	upx
behavioral2/files/0x000a000000023bd0-181.dat	upx
behavioral2/files/0x000a000000023bd6-178.dat	upx
behavioral2/files/0x000a000000023bd5-176.dat	upx
behavioral2/files/0x000a000000023bcf-170.dat	upx
behavioral2/files/0x000a000000023bd4-169.dat	upx
behavioral2/files/0x000a000000023bd3-166.dat	upx
behavioral2/files/0x000a000000023bd2-163.dat	upx
behavioral2/files/0x000a000000023bd1-151.dat	upx
behavioral2/files/0x000a000000023bcb-149.dat	upx
behavioral2/files/0x000a000000023bc3-137.dat	upx
behavioral2/files/0x000a000000023bca-132.dat	upx
behavioral2/files/0x000a000000023bc8-122.dat	upx
behavioral2/files/0x000a000000023bce-114.dat	upx
behavioral2/files/0x000a000000023bc7-89.dat	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
10	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\SRbFCqn.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\LOdysby.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\BLdwqaB.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\XSrykhs.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\HsBMCsM.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\ppRHypZ.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\btrMQRr.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\jycjYZA.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\imkaoju.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\pRDdCbK.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\UTqxKAE.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\wkxGuXN.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\MLqJKSR.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\WUonSpL.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\uAJnuBf.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\RaEloLq.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\XCSMuBB.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\zToJwZY.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\REYhXLO.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\lQtFgKs.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\gjTlQjf.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\nqxynOy.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\LlaknHv.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\BJzZLrw.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\IsQfFUw.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\NJNMyNM.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\RaZbRVi.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\yPvIGRj.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\zWNwOhY.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\CuIkhXD.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\nsbgDaH.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\pnrzeBX.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\pgIXOFV.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\UUBHUXy.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\wFyoXgU.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\VzSLhKE.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\cSCXiDH.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\NWGJZSV.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\ScpMhmh.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\ZCiIjok.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\UDJrqBb.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\iuWkrQy.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\PVghcJq.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\zkdjHEm.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\yRoJgBu.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\baXsRWt.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\OpUCVOw.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\IepKuzH.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\oQDyUcQ.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\vmYdvLt.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\drjdWwB.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\UeITsRJ.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\dsEWsRZ.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\yxSCVvI.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\vTDtlZf.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\sWkMqeZ.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\EsaaulQ.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\EIlZigp.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\kuwKrDU.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\PlXmjry.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\JzSNYKD.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\FBgSSWS.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\SAhAsYG.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
File created	C:\Windows\System\KuZCylR.exe	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3116	powershell.exe
3116	powershell.exe
3116	powershell.exe
3116	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
Token: SeDebugPrivilege	3116	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 944 wrote to memory of 3116	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	85
PID 944 wrote to memory of 3116	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	85
PID 944 wrote to memory of 1848	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	86
PID 944 wrote to memory of 1848	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	86
PID 944 wrote to memory of 2760	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	87
PID 944 wrote to memory of 2760	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	87
PID 944 wrote to memory of 2092	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	88
PID 944 wrote to memory of 2092	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	88
PID 944 wrote to memory of 1304	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	89
PID 944 wrote to memory of 1304	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	89
PID 944 wrote to memory of 3760	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	90
PID 944 wrote to memory of 3760	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	90
PID 944 wrote to memory of 5048	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	91
PID 944 wrote to memory of 5048	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	91
PID 944 wrote to memory of 2192	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	92
PID 944 wrote to memory of 2192	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	92
PID 944 wrote to memory of 4780	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	93
PID 944 wrote to memory of 4780	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	93
PID 944 wrote to memory of 1996	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	94
PID 944 wrote to memory of 1996	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	94
PID 944 wrote to memory of 5060	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	95
PID 944 wrote to memory of 5060	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	95
PID 944 wrote to memory of 1780	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	96
PID 944 wrote to memory of 1780	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	96
PID 944 wrote to memory of 1860	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	97
PID 944 wrote to memory of 1860	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	97
PID 944 wrote to memory of 2464	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	98
PID 944 wrote to memory of 2464	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	98
PID 944 wrote to memory of 396	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	99
PID 944 wrote to memory of 396	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	99
PID 944 wrote to memory of 3148	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	100
PID 944 wrote to memory of 3148	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	100
PID 944 wrote to memory of 2260	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	101
PID 944 wrote to memory of 2260	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	101
PID 944 wrote to memory of 412	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	102
PID 944 wrote to memory of 412	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	102
PID 944 wrote to memory of 4872	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	103
PID 944 wrote to memory of 4872	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	103
PID 944 wrote to memory of 892	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	104
PID 944 wrote to memory of 892	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	104
PID 944 wrote to memory of 4468	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	105
PID 944 wrote to memory of 4468	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	105
PID 944 wrote to memory of 4968	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	106
PID 944 wrote to memory of 4968	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	106
PID 944 wrote to memory of 5004	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	107
PID 944 wrote to memory of 5004	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	107
PID 944 wrote to memory of 4596	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	108
PID 944 wrote to memory of 4596	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	108
PID 944 wrote to memory of 1528	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	109
PID 944 wrote to memory of 1528	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	109
PID 944 wrote to memory of 3168	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	110
PID 944 wrote to memory of 3168	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	110
PID 944 wrote to memory of 4268	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	111
PID 944 wrote to memory of 4268	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	111
PID 944 wrote to memory of 3644	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	112
PID 944 wrote to memory of 3644	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	112
PID 944 wrote to memory of 4088	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	113
PID 944 wrote to memory of 4088	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	113
PID 944 wrote to memory of 3252	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	114
PID 944 wrote to memory of 3252	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	114
PID 944 wrote to memory of 5016	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	115
PID 944 wrote to memory of 5016	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	115
PID 944 wrote to memory of 1896	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	116
PID 944 wrote to memory of 1896	944	1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1fb23cb1cd6a177df26d7cd7a9cf1860_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3116
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "3116" "2992" "2924" "2996" "0" "0" "3000" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:13988
- C:\Windows\System\DUWamjU.exe
  C:\Windows\System\DUWamjU.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\IuwFJXo.exe
  C:\Windows\System\IuwFJXo.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\DNSSRvM.exe
  C:\Windows\System\DNSSRvM.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\hHPHgSk.exe
  C:\Windows\System\hHPHgSk.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\JiiVfhi.exe
  C:\Windows\System\JiiVfhi.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\wHcZrRj.exe
  C:\Windows\System\wHcZrRj.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\NVqhTlx.exe
  C:\Windows\System\NVqhTlx.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\ZupktkM.exe
  C:\Windows\System\ZupktkM.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\bnuVGcQ.exe
  C:\Windows\System\bnuVGcQ.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\AtiIbtN.exe
  C:\Windows\System\AtiIbtN.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\SZnJHIY.exe
  C:\Windows\System\SZnJHIY.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\SRmcgHF.exe
  C:\Windows\System\SRmcgHF.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\PPTpyPk.exe
  C:\Windows\System\PPTpyPk.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\jWPGIUA.exe
  C:\Windows\System\jWPGIUA.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\etbqOGJ.exe
  C:\Windows\System\etbqOGJ.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\BhMNwTf.exe
  C:\Windows\System\BhMNwTf.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\AkXBCZC.exe
  C:\Windows\System\AkXBCZC.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\QzcbACR.exe
  C:\Windows\System\QzcbACR.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\zsHXWGO.exe
  C:\Windows\System\zsHXWGO.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\jSwCpcT.exe
  C:\Windows\System\jSwCpcT.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\maJeKnx.exe
  C:\Windows\System\maJeKnx.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\vTDtlZf.exe
  C:\Windows\System\vTDtlZf.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\asyrHyG.exe
  C:\Windows\System\asyrHyG.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\GFZgUmD.exe
  C:\Windows\System\GFZgUmD.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\dgKUWrw.exe
  C:\Windows\System\dgKUWrw.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\tYYPbdO.exe
  C:\Windows\System\tYYPbdO.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\KyzsGZR.exe
  C:\Windows\System\KyzsGZR.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\omUTWKL.exe
  C:\Windows\System\omUTWKL.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\QRZJCQL.exe
  C:\Windows\System\QRZJCQL.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\System\jCHRfZr.exe
  C:\Windows\System\jCHRfZr.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\zkpVNrj.exe
  C:\Windows\System\zkpVNrj.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\TOQhmjo.exe
  C:\Windows\System\TOQhmjo.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\VNYKHIy.exe
  C:\Windows\System\VNYKHIy.exe
  2⤵
  - Executes dropped EXE
  PID:3800
- C:\Windows\System\PSBGgGG.exe
  C:\Windows\System\PSBGgGG.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\XYdQmwW.exe
  C:\Windows\System\XYdQmwW.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\ausUzDD.exe
  C:\Windows\System\ausUzDD.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\TKjavth.exe
  C:\Windows\System\TKjavth.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\NouUktL.exe
  C:\Windows\System\NouUktL.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\JfxPvCn.exe
  C:\Windows\System\JfxPvCn.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\ErHRghz.exe
  C:\Windows\System\ErHRghz.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\qamaqaK.exe
  C:\Windows\System\qamaqaK.exe
  2⤵
  - Executes dropped EXE
  PID:4156
- C:\Windows\System\yRZjHCK.exe
  C:\Windows\System\yRZjHCK.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\HIexeOu.exe
  C:\Windows\System\HIexeOu.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\qlLHFYU.exe
  C:\Windows\System\qlLHFYU.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\fyhLAGu.exe
  C:\Windows\System\fyhLAGu.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\OALSShG.exe
  C:\Windows\System\OALSShG.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\lMErvKG.exe
  C:\Windows\System\lMErvKG.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\qwQIKyu.exe
  C:\Windows\System\qwQIKyu.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\WoRXMGC.exe
  C:\Windows\System\WoRXMGC.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\RfYnITn.exe
  C:\Windows\System\RfYnITn.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\bAOQsCd.exe
  C:\Windows\System\bAOQsCd.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System\OxhzgyD.exe
  C:\Windows\System\OxhzgyD.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\sdPeoUh.exe
  C:\Windows\System\sdPeoUh.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\EjocRZt.exe
  C:\Windows\System\EjocRZt.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\FLWwoHF.exe
  C:\Windows\System\FLWwoHF.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\LjTDQYd.exe
  C:\Windows\System\LjTDQYd.exe
  2⤵
  PID:1156
- C:\Windows\System\gMBDxIS.exe
  C:\Windows\System\gMBDxIS.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\mLSvYaU.exe
  C:\Windows\System\mLSvYaU.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\TzSULHL.exe
  C:\Windows\System\TzSULHL.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\UsVDtWj.exe
  C:\Windows\System\UsVDtWj.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\ekCtWDV.exe
  C:\Windows\System\ekCtWDV.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\xsNxinD.exe
  C:\Windows\System\xsNxinD.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\eWxBdzb.exe
  C:\Windows\System\eWxBdzb.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\gUBvvTI.exe
  C:\Windows\System\gUBvvTI.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\clKZNzy.exe
  C:\Windows\System\clKZNzy.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\HLmdVqs.exe
  C:\Windows\System\HLmdVqs.exe
  2⤵
  PID:4956
- C:\Windows\System\KgELKCF.exe
  C:\Windows\System\KgELKCF.exe
  2⤵
  PID:2356
- C:\Windows\System\cwMkoKy.exe
  C:\Windows\System\cwMkoKy.exe
  2⤵
  PID:4964
- C:\Windows\System\GKyUcbr.exe
  C:\Windows\System\GKyUcbr.exe
  2⤵
  PID:4324
- C:\Windows\System\ssfHDXq.exe
  C:\Windows\System\ssfHDXq.exe
  2⤵
  PID:5112
- C:\Windows\System\eAqLEXQ.exe
  C:\Windows\System\eAqLEXQ.exe
  2⤵
  PID:1152
- C:\Windows\System\LALCnFs.exe
  C:\Windows\System\LALCnFs.exe
  2⤵
  PID:2700
- C:\Windows\System\jSNoFfV.exe
  C:\Windows\System\jSNoFfV.exe
  2⤵
  PID:4564
- C:\Windows\System\fVrAKll.exe
  C:\Windows\System\fVrAKll.exe
  2⤵
  PID:5148
- C:\Windows\System\jHYVXLi.exe
  C:\Windows\System\jHYVXLi.exe
  2⤵
  PID:5164
- C:\Windows\System\ZPbYepH.exe
  C:\Windows\System\ZPbYepH.exe
  2⤵
  PID:5180
- C:\Windows\System\hebWOAE.exe
  C:\Windows\System\hebWOAE.exe
  2⤵
  PID:5196
- C:\Windows\System\cTYvYks.exe
  C:\Windows\System\cTYvYks.exe
  2⤵
  PID:5264
- C:\Windows\System\YkvthhE.exe
  C:\Windows\System\YkvthhE.exe
  2⤵
  PID:5288
- C:\Windows\System\PwhGEKm.exe
  C:\Windows\System\PwhGEKm.exe
  2⤵
  PID:5304
- C:\Windows\System\XVDHTHI.exe
  C:\Windows\System\XVDHTHI.exe
  2⤵
  PID:5328
- C:\Windows\System\nruiUmz.exe
  C:\Windows\System\nruiUmz.exe
  2⤵
  PID:5344
- C:\Windows\System\HQLBMcS.exe
  C:\Windows\System\HQLBMcS.exe
  2⤵
  PID:5360
- C:\Windows\System\vKaRmgj.exe
  C:\Windows\System\vKaRmgj.exe
  2⤵
  PID:5384
- C:\Windows\System\twFLBFJ.exe
  C:\Windows\System\twFLBFJ.exe
  2⤵
  PID:5400
- C:\Windows\System\VIyXtZm.exe
  C:\Windows\System\VIyXtZm.exe
  2⤵
  PID:5424
- C:\Windows\System\fBDGBnd.exe
  C:\Windows\System\fBDGBnd.exe
  2⤵
  PID:5448
- C:\Windows\System\rGUDmnY.exe
  C:\Windows\System\rGUDmnY.exe
  2⤵
  PID:5472
- C:\Windows\System\UryIdma.exe
  C:\Windows\System\UryIdma.exe
  2⤵
  PID:5508
- C:\Windows\System\ZrXzjSE.exe
  C:\Windows\System\ZrXzjSE.exe
  2⤵
  PID:5524
- C:\Windows\System\TLCLril.exe
  C:\Windows\System\TLCLril.exe
  2⤵
  PID:5540
- C:\Windows\System\rOiowcv.exe
  C:\Windows\System\rOiowcv.exe
  2⤵
  PID:5600
- C:\Windows\System\tSBZWNo.exe
  C:\Windows\System\tSBZWNo.exe
  2⤵
  PID:5624
- C:\Windows\System\LUZvDBe.exe
  C:\Windows\System\LUZvDBe.exe
  2⤵
  PID:5676
- C:\Windows\System\TbJprQj.exe
  C:\Windows\System\TbJprQj.exe
  2⤵
  PID:5696
- C:\Windows\System\eSIhRdf.exe
  C:\Windows\System\eSIhRdf.exe
  2⤵
  PID:5716
- C:\Windows\System\BUnzyLm.exe
  C:\Windows\System\BUnzyLm.exe
  2⤵
  PID:5744
- C:\Windows\System\mSzCqBi.exe
  C:\Windows\System\mSzCqBi.exe
  2⤵
  PID:5792
- C:\Windows\System\HGpYYXf.exe
  C:\Windows\System\HGpYYXf.exe
  2⤵
  PID:5808
- C:\Windows\System\shDjvCA.exe
  C:\Windows\System\shDjvCA.exe
  2⤵
  PID:5832
- C:\Windows\System\ykcXPts.exe
  C:\Windows\System\ykcXPts.exe
  2⤵
  PID:5848
- C:\Windows\System\ILjIZLh.exe
  C:\Windows\System\ILjIZLh.exe
  2⤵
  PID:5872
- C:\Windows\System\MLICeYm.exe
  C:\Windows\System\MLICeYm.exe
  2⤵
  PID:5896
- C:\Windows\System\yBoaomv.exe
  C:\Windows\System\yBoaomv.exe
  2⤵
  PID:5920
- C:\Windows\System\GxxJoqY.exe
  C:\Windows\System\GxxJoqY.exe
  2⤵
  PID:5940
- C:\Windows\System\QTzERwE.exe
  C:\Windows\System\QTzERwE.exe
  2⤵
  PID:5964
- C:\Windows\System\zSRKOHx.exe
  C:\Windows\System\zSRKOHx.exe
  2⤵
  PID:5980
- C:\Windows\System\SkQLhLz.exe
  C:\Windows\System\SkQLhLz.exe
  2⤵
  PID:6004
- C:\Windows\System\lTwHiqq.exe
  C:\Windows\System\lTwHiqq.exe
  2⤵
  PID:6068
- C:\Windows\System\omQoMeb.exe
  C:\Windows\System\omQoMeb.exe
  2⤵
  PID:6088
- C:\Windows\System\GpulXro.exe
  C:\Windows\System\GpulXro.exe
  2⤵
  PID:6108
- C:\Windows\System\OkuLyKy.exe
  C:\Windows\System\OkuLyKy.exe
  2⤵
  PID:6124
- C:\Windows\System\tzbVbor.exe
  C:\Windows\System\tzbVbor.exe
  2⤵
  PID:4692
- C:\Windows\System\EWyKVDp.exe
  C:\Windows\System\EWyKVDp.exe
  2⤵
  PID:2064
- C:\Windows\System\nzFpsMd.exe
  C:\Windows\System\nzFpsMd.exe
  2⤵
  PID:3372
- C:\Windows\System\ZPxNhmV.exe
  C:\Windows\System\ZPxNhmV.exe
  2⤵
  PID:8
- C:\Windows\System\yxQQqsv.exe
  C:\Windows\System\yxQQqsv.exe
  2⤵
  PID:1012
- C:\Windows\System\SaRcFVw.exe
  C:\Windows\System\SaRcFVw.exe
  2⤵
  PID:2712
- C:\Windows\System\sjjoExm.exe
  C:\Windows\System\sjjoExm.exe
  2⤵
  PID:3376
- C:\Windows\System\UvsGDGy.exe
  C:\Windows\System\UvsGDGy.exe
  2⤵
  PID:4060
- C:\Windows\System\wUhrHQR.exe
  C:\Windows\System\wUhrHQR.exe
  2⤵
  PID:4948
- C:\Windows\System\wsOzjVj.exe
  C:\Windows\System\wsOzjVj.exe
  2⤵
  PID:2368
- C:\Windows\System\PtGkDGM.exe
  C:\Windows\System\PtGkDGM.exe
  2⤵
  PID:1252
- C:\Windows\System\AULlWRf.exe
  C:\Windows\System\AULlWRf.exe
  2⤵
  PID:2396
- C:\Windows\System\oUxUaZG.exe
  C:\Windows\System\oUxUaZG.exe
  2⤵
  PID:3704
- C:\Windows\System\yfrnAcq.exe
  C:\Windows\System\yfrnAcq.exe
  2⤵
  PID:3060
- C:\Windows\System\CQHgELC.exe
  C:\Windows\System\CQHgELC.exe
  2⤵
  PID:5440
- C:\Windows\System\iFuoJbk.exe
  C:\Windows\System\iFuoJbk.exe
  2⤵
  PID:5188
- C:\Windows\System\YOaZNpC.exe
  C:\Windows\System\YOaZNpC.exe
  2⤵
  PID:5928
- C:\Windows\System\Xyadolx.exe
  C:\Windows\System\Xyadolx.exe
  2⤵
  PID:5240
- C:\Windows\System\OCCPlhZ.exe
  C:\Windows\System\OCCPlhZ.exe
  2⤵
  PID:5312
- C:\Windows\System\yuYBhUV.exe
  C:\Windows\System\yuYBhUV.exe
  2⤵
  PID:5352
- C:\Windows\System\MpAisZU.exe
  C:\Windows\System\MpAisZU.exe
  2⤵
  PID:6100
- C:\Windows\System\SdKFoTj.exe
  C:\Windows\System\SdKFoTj.exe
  2⤵
  PID:6152
- C:\Windows\System\LkZiVaQ.exe
  C:\Windows\System\LkZiVaQ.exe
  2⤵
  PID:6172
- C:\Windows\System\xNjaslQ.exe
  C:\Windows\System\xNjaslQ.exe
  2⤵
  PID:6192
- C:\Windows\System\dIErJoT.exe
  C:\Windows\System\dIErJoT.exe
  2⤵
  PID:6220
- C:\Windows\System\szOycQc.exe
  C:\Windows\System\szOycQc.exe
  2⤵
  PID:6244
- C:\Windows\System\sGAzKyj.exe
  C:\Windows\System\sGAzKyj.exe
  2⤵
  PID:6272
- C:\Windows\System\biMlYKr.exe
  C:\Windows\System\biMlYKr.exe
  2⤵
  PID:6288
- C:\Windows\System\smBaMFU.exe
  C:\Windows\System\smBaMFU.exe
  2⤵
  PID:6412
- C:\Windows\System\vlYhUfL.exe
  C:\Windows\System\vlYhUfL.exe
  2⤵
  PID:6436
- C:\Windows\System\gEHiRBF.exe
  C:\Windows\System\gEHiRBF.exe
  2⤵
  PID:6456
- C:\Windows\System\VRrPToQ.exe
  C:\Windows\System\VRrPToQ.exe
  2⤵
  PID:6480
- C:\Windows\System\uOMDqoI.exe
  C:\Windows\System\uOMDqoI.exe
  2⤵
  PID:6500
- C:\Windows\System\uwjRyOU.exe
  C:\Windows\System\uwjRyOU.exe
  2⤵
  PID:6532
- C:\Windows\System\sOQpECq.exe
  C:\Windows\System\sOQpECq.exe
  2⤵
  PID:6652
- C:\Windows\System\WBRlcvt.exe
  C:\Windows\System\WBRlcvt.exe
  2⤵
  PID:6668
- C:\Windows\System\BMDUTPu.exe
  C:\Windows\System\BMDUTPu.exe
  2⤵
  PID:6684
- C:\Windows\System\KxpuFID.exe
  C:\Windows\System\KxpuFID.exe
  2⤵
  PID:6700
- C:\Windows\System\jibOemX.exe
  C:\Windows\System\jibOemX.exe
  2⤵
  PID:6716
- C:\Windows\System\wxoePZg.exe
  C:\Windows\System\wxoePZg.exe
  2⤵
  PID:6732
- C:\Windows\System\uDmNVrm.exe
  C:\Windows\System\uDmNVrm.exe
  2⤵
  PID:6748
- C:\Windows\System\xNfNpIm.exe
  C:\Windows\System\xNfNpIm.exe
  2⤵
  PID:6764
- C:\Windows\System\FObFHrA.exe
  C:\Windows\System\FObFHrA.exe
  2⤵
  PID:6780
- C:\Windows\System\AeISKcM.exe
  C:\Windows\System\AeISKcM.exe
  2⤵
  PID:6796
- C:\Windows\System\PVXsYrG.exe
  C:\Windows\System\PVXsYrG.exe
  2⤵
  PID:6812
- C:\Windows\System\WXeSLvB.exe
  C:\Windows\System\WXeSLvB.exe
  2⤵
  PID:6828
- C:\Windows\System\yPNyXfE.exe
  C:\Windows\System\yPNyXfE.exe
  2⤵
  PID:6900
- C:\Windows\System\XBKTPYF.exe
  C:\Windows\System\XBKTPYF.exe
  2⤵
  PID:7004
- C:\Windows\System\ZbdlNFF.exe
  C:\Windows\System\ZbdlNFF.exe
  2⤵
  PID:7020
- C:\Windows\System\zohlKML.exe
  C:\Windows\System\zohlKML.exe
  2⤵
  PID:7084
- C:\Windows\System\TKDHwHb.exe
  C:\Windows\System\TKDHwHb.exe
  2⤵
  PID:7104
- C:\Windows\System\iZVvwfG.exe
  C:\Windows\System\iZVvwfG.exe
  2⤵
  PID:7136
- C:\Windows\System\vjbnWNC.exe
  C:\Windows\System\vjbnWNC.exe
  2⤵
  PID:5456
- C:\Windows\System\aucaeek.exe
  C:\Windows\System\aucaeek.exe
  2⤵
  PID:5488
- C:\Windows\System\iDjFepb.exe
  C:\Windows\System\iDjFepb.exe
  2⤵
  PID:5520
- C:\Windows\System\pRDdCbK.exe
  C:\Windows\System\pRDdCbK.exe
  2⤵
  PID:5584
- C:\Windows\System\WIEFWlP.exe
  C:\Windows\System\WIEFWlP.exe
  2⤵
  PID:5620
- C:\Windows\System\XCSMuBB.exe
  C:\Windows\System\XCSMuBB.exe
  2⤵
  PID:5652
- C:\Windows\System\jfdyAow.exe
  C:\Windows\System\jfdyAow.exe
  2⤵
  PID:5692
- C:\Windows\System\xjNVZdI.exe
  C:\Windows\System\xjNVZdI.exe
  2⤵
  PID:5376
- C:\Windows\System\wysrGLO.exe
  C:\Windows\System\wysrGLO.exe
  2⤵
  PID:6200
- C:\Windows\System\AwxObSy.exe
  C:\Windows\System\AwxObSy.exe
  2⤵
  PID:5800
- C:\Windows\System\SLUQzDj.exe
  C:\Windows\System\SLUQzDj.exe
  2⤵
  PID:5844
- C:\Windows\System\LOdysby.exe
  C:\Windows\System\LOdysby.exe
  2⤵
  PID:5884
- C:\Windows\System\PmRXaMK.exe
  C:\Windows\System\PmRXaMK.exe
  2⤵
  PID:4264
- C:\Windows\System\sOBYlzC.exe
  C:\Windows\System\sOBYlzC.exe
  2⤵
  PID:1312
- C:\Windows\System\QUBJueg.exe
  C:\Windows\System\QUBJueg.exe
  2⤵
  PID:1576
- C:\Windows\System\vdiDvLi.exe
  C:\Windows\System\vdiDvLi.exe
  2⤵
  PID:2888
- C:\Windows\System\cWOWMsp.exe
  C:\Windows\System\cWOWMsp.exe
  2⤵
  PID:5172
- C:\Windows\System\ixCWRPb.exe
  C:\Windows\System\ixCWRPb.exe
  2⤵
  PID:5936
- C:\Windows\System\lsXpYpk.exe
  C:\Windows\System\lsXpYpk.exe
  2⤵
  PID:6120
- C:\Windows\System\KhHNxES.exe
  C:\Windows\System\KhHNxES.exe
  2⤵
  PID:6236
- C:\Windows\System\XzRhFqq.exe
  C:\Windows\System\XzRhFqq.exe
  2⤵
  PID:6264
- C:\Windows\System\rPzgIhH.exe
  C:\Windows\System\rPzgIhH.exe
  2⤵
  PID:6316
- C:\Windows\System\PdAAfRt.exe
  C:\Windows\System\PdAAfRt.exe
  2⤵
  PID:6472
- C:\Windows\System\DcpsemV.exe
  C:\Windows\System\DcpsemV.exe
  2⤵
  PID:6540
- C:\Windows\System\CheTeHX.exe
  C:\Windows\System\CheTeHX.exe
  2⤵
  PID:6420
- C:\Windows\System\PlkfTDn.exe
  C:\Windows\System\PlkfTDn.exe
  2⤵
  PID:6452
- C:\Windows\System\QxlXPtu.exe
  C:\Windows\System\QxlXPtu.exe
  2⤵
  PID:7064
- C:\Windows\System\MlEUGLM.exe
  C:\Windows\System\MlEUGLM.exe
  2⤵
  PID:7176
- C:\Windows\System\TDeKlmr.exe
  C:\Windows\System\TDeKlmr.exe
  2⤵
  PID:7196
- C:\Windows\System\AgQQOsx.exe
  C:\Windows\System\AgQQOsx.exe
  2⤵
  PID:7212
- C:\Windows\System\aVjqWxx.exe
  C:\Windows\System\aVjqWxx.exe
  2⤵
  PID:7232
- C:\Windows\System\vIEIigG.exe
  C:\Windows\System\vIEIigG.exe
  2⤵
  PID:7292
- C:\Windows\System\GWgYePQ.exe
  C:\Windows\System\GWgYePQ.exe
  2⤵
  PID:7312
- C:\Windows\System\fyFVSqx.exe
  C:\Windows\System\fyFVSqx.exe
  2⤵
  PID:7332
- C:\Windows\System\hkAWQQh.exe
  C:\Windows\System\hkAWQQh.exe
  2⤵
  PID:7348
- C:\Windows\System\IAMlIWD.exe
  C:\Windows\System\IAMlIWD.exe
  2⤵
  PID:7364
- C:\Windows\System\hzLwVMo.exe
  C:\Windows\System\hzLwVMo.exe
  2⤵
  PID:7380
- C:\Windows\System\ZfbEovI.exe
  C:\Windows\System\ZfbEovI.exe
  2⤵
  PID:7408
- C:\Windows\System\GkpVcFQ.exe
  C:\Windows\System\GkpVcFQ.exe
  2⤵
  PID:7424
- C:\Windows\System\rVUzHYU.exe
  C:\Windows\System\rVUzHYU.exe
  2⤵
  PID:7448
- C:\Windows\System\vAEpmCc.exe
  C:\Windows\System\vAEpmCc.exe
  2⤵
  PID:7476
- C:\Windows\System\tfRLhXf.exe
  C:\Windows\System\tfRLhXf.exe
  2⤵
  PID:7492
- C:\Windows\System\TvqwaUz.exe
  C:\Windows\System\TvqwaUz.exe
  2⤵
  PID:7520
- C:\Windows\System\kpfjJHq.exe
  C:\Windows\System\kpfjJHq.exe
  2⤵
  PID:7536
- C:\Windows\System\jGLRZjW.exe
  C:\Windows\System\jGLRZjW.exe
  2⤵
  PID:7560
- C:\Windows\System\GEFywKR.exe
  C:\Windows\System\GEFywKR.exe
  2⤵
  PID:7608
- C:\Windows\System\lRTJQdh.exe
  C:\Windows\System\lRTJQdh.exe
  2⤵
  PID:7640
- C:\Windows\System\XxzKmME.exe
  C:\Windows\System\XxzKmME.exe
  2⤵
  PID:7656
- C:\Windows\System\inKPcFC.exe
  C:\Windows\System\inKPcFC.exe
  2⤵
  PID:7676
- C:\Windows\System\RWoHGNF.exe
  C:\Windows\System\RWoHGNF.exe
  2⤵
  PID:7696
- C:\Windows\System\avOrNPu.exe
  C:\Windows\System\avOrNPu.exe
  2⤵
  PID:7720
- C:\Windows\System\eWuQyPA.exe
  C:\Windows\System\eWuQyPA.exe
  2⤵
  PID:7736
- C:\Windows\System\KGhTeuk.exe
  C:\Windows\System\KGhTeuk.exe
  2⤵
  PID:7760
- C:\Windows\System\qFVzGZP.exe
  C:\Windows\System\qFVzGZP.exe
  2⤵
  PID:7780
- C:\Windows\System\vfxqSQf.exe
  C:\Windows\System\vfxqSQf.exe
  2⤵
  PID:7800
- C:\Windows\System\wuBGZzP.exe
  C:\Windows\System\wuBGZzP.exe
  2⤵
  PID:7824
- C:\Windows\System\hOGWFBq.exe
  C:\Windows\System\hOGWFBq.exe
  2⤵
  PID:7848
- C:\Windows\System\EaTiUTL.exe
  C:\Windows\System\EaTiUTL.exe
  2⤵
  PID:7864
- C:\Windows\System\sDMAqBr.exe
  C:\Windows\System\sDMAqBr.exe
  2⤵
  PID:7884
- C:\Windows\System\MipxLCD.exe
  C:\Windows\System\MipxLCD.exe
  2⤵
  PID:7904
- C:\Windows\System\TOnNaUx.exe
  C:\Windows\System\TOnNaUx.exe
  2⤵
  PID:7928
- C:\Windows\System\gUKoArz.exe
  C:\Windows\System\gUKoArz.exe
  2⤵
  PID:7944
- C:\Windows\System\Epeifun.exe
  C:\Windows\System\Epeifun.exe
  2⤵
  PID:7972
- C:\Windows\System\iZPZpaC.exe
  C:\Windows\System\iZPZpaC.exe
  2⤵
  PID:7996
- C:\Windows\System\bJXCTNY.exe
  C:\Windows\System\bJXCTNY.exe
  2⤵
  PID:8020
- C:\Windows\System\CNwUETR.exe
  C:\Windows\System\CNwUETR.exe
  2⤵
  PID:8052
- C:\Windows\System\KLqKfQp.exe
  C:\Windows\System\KLqKfQp.exe
  2⤵
  PID:8076
- C:\Windows\System\ASXYLry.exe
  C:\Windows\System\ASXYLry.exe
  2⤵
  PID:8104
- C:\Windows\System\QWqDUpk.exe
  C:\Windows\System\QWqDUpk.exe
  2⤵
  PID:8128
- C:\Windows\System\uvEnlfi.exe
  C:\Windows\System\uvEnlfi.exe
  2⤵
  PID:8148
- C:\Windows\System\vSDZZar.exe
  C:\Windows\System\vSDZZar.exe
  2⤵
  PID:8168
- C:\Windows\System\yKNsKNC.exe
  C:\Windows\System\yKNsKNC.exe
  2⤵
  PID:5480
- C:\Windows\System\QoeSQgS.exe
  C:\Windows\System\QoeSQgS.exe
  2⤵
  PID:5908
- C:\Windows\System\geBJCvX.exe
  C:\Windows\System\geBJCvX.exe
  2⤵
  PID:1720
- C:\Windows\System\IRJNMhV.exe
  C:\Windows\System\IRJNMhV.exe
  2⤵
  PID:6648
- C:\Windows\System\kWmzVjW.exe
  C:\Windows\System\kWmzVjW.exe
  2⤵
  PID:6692
- C:\Windows\System\HQjrJKT.exe
  C:\Windows\System\HQjrJKT.exe
  2⤵
  PID:6740
- C:\Windows\System\UNeBrEf.exe
  C:\Windows\System\UNeBrEf.exe
  2⤵
  PID:6788
- C:\Windows\System\ybLMKFj.exe
  C:\Windows\System\ybLMKFj.exe
  2⤵
  PID:6824
- C:\Windows\System\bPyfZjo.exe
  C:\Windows\System\bPyfZjo.exe
  2⤵
  PID:7000
- C:\Windows\System\zayTAwT.exe
  C:\Windows\System\zayTAwT.exe
  2⤵
  PID:6256
- C:\Windows\System\cYixWnw.exe
  C:\Windows\System\cYixWnw.exe
  2⤵
  PID:6372
- C:\Windows\System\dxevNzI.exe
  C:\Windows\System\dxevNzI.exe
  2⤵
  PID:5688
- C:\Windows\System\IZkKSmK.exe
  C:\Windows\System\IZkKSmK.exe
  2⤵
  PID:6572
- C:\Windows\System\RXEXMCg.exe
  C:\Windows\System\RXEXMCg.exe
  2⤵
  PID:7228
- C:\Windows\System\LHmTIsK.exe
  C:\Windows\System\LHmTIsK.exe
  2⤵
  PID:7796
- C:\Windows\System\PQjbMFt.exe
  C:\Windows\System\PQjbMFt.exe
  2⤵
  PID:4660
- C:\Windows\System\YwisUCF.exe
  C:\Windows\System\YwisUCF.exe
  2⤵
  PID:7264
- C:\Windows\System\tacsAdz.exe
  C:\Windows\System\tacsAdz.exe
  2⤵
  PID:7344
- C:\Windows\System\lcljjQB.exe
  C:\Windows\System\lcljjQB.exe
  2⤵
  PID:5612
- C:\Windows\System\hDWovFQ.exe
  C:\Windows\System\hDWovFQ.exe
  2⤵
  PID:8064
- C:\Windows\System\IXYbKUA.exe
  C:\Windows\System\IXYbKUA.exe
  2⤵
  PID:7936
- C:\Windows\System\oAKgdwi.exe
  C:\Windows\System\oAKgdwi.exe
  2⤵
  PID:7396
- C:\Windows\System\GnrNuvA.exe
  C:\Windows\System\GnrNuvA.exe
  2⤵
  PID:7940
- C:\Windows\System\rilonEZ.exe
  C:\Windows\System\rilonEZ.exe
  2⤵
  PID:7460
- C:\Windows\System\aNwYTaF.exe
  C:\Windows\System\aNwYTaF.exe
  2⤵
  PID:8216
- C:\Windows\System\qFpQDOv.exe
  C:\Windows\System\qFpQDOv.exe
  2⤵
  PID:8244
- C:\Windows\System\aXnqUTQ.exe
  C:\Windows\System\aXnqUTQ.exe
  2⤵
  PID:8276
- C:\Windows\System\bwuXXwM.exe
  C:\Windows\System\bwuXXwM.exe
  2⤵
  PID:8300
- C:\Windows\System\YxXLSvS.exe
  C:\Windows\System\YxXLSvS.exe
  2⤵
  PID:8324
- C:\Windows\System\kaBCiBR.exe
  C:\Windows\System\kaBCiBR.exe
  2⤵
  PID:8348
- C:\Windows\System\rehZinu.exe
  C:\Windows\System\rehZinu.exe
  2⤵
  PID:8376
- C:\Windows\System\NELxQhM.exe
  C:\Windows\System\NELxQhM.exe
  2⤵
  PID:8392
- C:\Windows\System\ygESvln.exe
  C:\Windows\System\ygESvln.exe
  2⤵
  PID:8408
- C:\Windows\System\nBEsNzM.exe
  C:\Windows\System\nBEsNzM.exe
  2⤵
  PID:8428
- C:\Windows\System\dVNDbKk.exe
  C:\Windows\System\dVNDbKk.exe
  2⤵
  PID:8448
- C:\Windows\System\prNfTRU.exe
  C:\Windows\System\prNfTRU.exe
  2⤵
  PID:8468
- C:\Windows\System\zapqFFr.exe
  C:\Windows\System\zapqFFr.exe
  2⤵
  PID:8484
- C:\Windows\System\jvfzdwt.exe
  C:\Windows\System\jvfzdwt.exe
  2⤵
  PID:8504
- C:\Windows\System\vaIvvby.exe
  C:\Windows\System\vaIvvby.exe
  2⤵
  PID:8628
- C:\Windows\System\THvQKjn.exe
  C:\Windows\System\THvQKjn.exe
  2⤵
  PID:8652
- C:\Windows\System\LpRElKt.exe
  C:\Windows\System\LpRElKt.exe
  2⤵
  PID:8676
- C:\Windows\System\nDGpcIh.exe
  C:\Windows\System\nDGpcIh.exe
  2⤵
  PID:8700
- C:\Windows\System\LjiETot.exe
  C:\Windows\System\LjiETot.exe
  2⤵
  PID:8720
- C:\Windows\System\fUySYKe.exe
  C:\Windows\System\fUySYKe.exe
  2⤵
  PID:8748
- C:\Windows\System\JyViMVE.exe
  C:\Windows\System\JyViMVE.exe
  2⤵
  PID:8768
- C:\Windows\System\hycObfH.exe
  C:\Windows\System\hycObfH.exe
  2⤵
  PID:8784
- C:\Windows\System\YndHRTv.exe
  C:\Windows\System\YndHRTv.exe
  2⤵
  PID:8816
- C:\Windows\System\qbJbvmJ.exe
  C:\Windows\System\qbJbvmJ.exe
  2⤵
  PID:8844
- C:\Windows\System\qaKitjr.exe
  C:\Windows\System\qaKitjr.exe
  2⤵
  PID:8860
- C:\Windows\System\UtonYLz.exe
  C:\Windows\System\UtonYLz.exe
  2⤵
  PID:8880
- C:\Windows\System\MdIPiBW.exe
  C:\Windows\System\MdIPiBW.exe
  2⤵
  PID:8904
- C:\Windows\System\AynXLMM.exe
  C:\Windows\System\AynXLMM.exe
  2⤵
  PID:8932
- C:\Windows\System\JZGKOBE.exe
  C:\Windows\System\JZGKOBE.exe
  2⤵
  PID:8956
- C:\Windows\System\XRANfKe.exe
  C:\Windows\System\XRANfKe.exe
  2⤵
  PID:8984
- C:\Windows\System\yzIpKnu.exe
  C:\Windows\System\yzIpKnu.exe
  2⤵
  PID:9008
- C:\Windows\System\RFLIpiL.exe
  C:\Windows\System\RFLIpiL.exe
  2⤵
  PID:9028
- C:\Windows\System\MBhLnEn.exe
  C:\Windows\System\MBhLnEn.exe
  2⤵
  PID:9048
- C:\Windows\System\RShcHli.exe
  C:\Windows\System\RShcHli.exe
  2⤵
  PID:9072
- C:\Windows\System\AAIgjvH.exe
  C:\Windows\System\AAIgjvH.exe
  2⤵
  PID:9112
- C:\Windows\System\tHgAQVZ.exe
  C:\Windows\System\tHgAQVZ.exe
  2⤵
  PID:9132
- C:\Windows\System\QOdSOUU.exe
  C:\Windows\System\QOdSOUU.exe
  2⤵
  PID:9156
- C:\Windows\System\cVEdYgT.exe
  C:\Windows\System\cVEdYgT.exe
  2⤵
  PID:9176
- C:\Windows\System\CLLOfQL.exe
  C:\Windows\System\CLLOfQL.exe
  2⤵
  PID:9200
- C:\Windows\System\kTibBHJ.exe
  C:\Windows\System\kTibBHJ.exe
  2⤵
  PID:7500
- C:\Windows\System\WlxjIqK.exe
  C:\Windows\System\WlxjIqK.exe
  2⤵
  PID:7744
- C:\Windows\System\wYujxtl.exe
  C:\Windows\System\wYujxtl.exe
  2⤵
  PID:7836
- C:\Windows\System\GgkaujK.exe
  C:\Windows\System\GgkaujK.exe
  2⤵
  PID:7892
- C:\Windows\System\FSOfyco.exe
  C:\Windows\System\FSOfyco.exe
  2⤵
  PID:7960
- C:\Windows\System\twwMpQK.exe
  C:\Windows\System\twwMpQK.exe
  2⤵
  PID:8208
- C:\Windows\System\aAkoJqx.exe
  C:\Windows\System\aAkoJqx.exe
  2⤵
  PID:7440
- C:\Windows\System\ZCkVsUL.exe
  C:\Windows\System\ZCkVsUL.exe
  2⤵
  PID:8180
- C:\Windows\System\tYKPKgp.exe
  C:\Windows\System\tYKPKgp.exe
  2⤵
  PID:7072
- C:\Windows\System\zxhrlVI.exe
  C:\Windows\System\zxhrlVI.exe
  2⤵
  PID:6724
- C:\Windows\System\nPrbjgJ.exe
  C:\Windows\System\nPrbjgJ.exe
  2⤵
  PID:8512
- C:\Windows\System\CnOZMZP.exe
  C:\Windows\System\CnOZMZP.exe
  2⤵
  PID:7068
- C:\Windows\System\nuhuuwh.exe
  C:\Windows\System\nuhuuwh.exe
  2⤵
  PID:5668
- C:\Windows\System\zoWjRIG.exe
  C:\Windows\System\zoWjRIG.exe
  2⤵
  PID:7016
- C:\Windows\System\JDXPbIg.exe
  C:\Windows\System\JDXPbIg.exe
  2⤵
  PID:6712
- C:\Windows\System\LuClDMU.exe
  C:\Windows\System\LuClDMU.exe
  2⤵
  PID:7792
- C:\Windows\System\pEYthQZ.exe
  C:\Windows\System\pEYthQZ.exe
  2⤵
  PID:8916
- C:\Windows\System\nMDheLK.exe
  C:\Windows\System\nMDheLK.exe
  2⤵
  PID:8332
- C:\Windows\System\koYVlPQ.exe
  C:\Windows\System\koYVlPQ.exe
  2⤵
  PID:9004
- C:\Windows\System\LXNdXjh.exe
  C:\Windows\System\LXNdXjh.exe
  2⤵
  PID:9208
- C:\Windows\System\QlLWAQH.exe
  C:\Windows\System\QlLWAQH.exe
  2⤵
  PID:5340
- C:\Windows\System\sjCWUhP.exe
  C:\Windows\System\sjCWUhP.exe
  2⤵
  PID:9224
- C:\Windows\System\cVZXCti.exe
  C:\Windows\System\cVZXCti.exe
  2⤵
  PID:9252
- C:\Windows\System\EZkegTU.exe
  C:\Windows\System\EZkegTU.exe
  2⤵
  PID:9276
- C:\Windows\System\BidtCEY.exe
  C:\Windows\System\BidtCEY.exe
  2⤵
  PID:9340
- C:\Windows\System\cLcZCmJ.exe
  C:\Windows\System\cLcZCmJ.exe
  2⤵
  PID:9360
- C:\Windows\System\hqAIGIr.exe
  C:\Windows\System\hqAIGIr.exe
  2⤵
  PID:9384
- C:\Windows\System\oQYxzBa.exe
  C:\Windows\System\oQYxzBa.exe
  2⤵
  PID:9400
- C:\Windows\System\vMAaWiZ.exe
  C:\Windows\System\vMAaWiZ.exe
  2⤵
  PID:9424
- C:\Windows\System\wXAZDsU.exe
  C:\Windows\System\wXAZDsU.exe
  2⤵
  PID:9444
- C:\Windows\System\ysHJgBd.exe
  C:\Windows\System\ysHJgBd.exe
  2⤵
  PID:9464
- C:\Windows\System\ZyJpzbt.exe
  C:\Windows\System\ZyJpzbt.exe
  2⤵
  PID:9480
- C:\Windows\System\leYlLsE.exe
  C:\Windows\System\leYlLsE.exe
  2⤵
  PID:9500
- C:\Windows\System\vIYvbwM.exe
  C:\Windows\System\vIYvbwM.exe
  2⤵
  PID:9528
- C:\Windows\System\scnFIwz.exe
  C:\Windows\System\scnFIwz.exe
  2⤵
  PID:9544
- C:\Windows\System\ULEUdHo.exe
  C:\Windows\System\ULEUdHo.exe
  2⤵
  PID:9568
- C:\Windows\System\Bjwnxct.exe
  C:\Windows\System\Bjwnxct.exe
  2⤵
  PID:9592
- C:\Windows\System\TpoggEh.exe
  C:\Windows\System\TpoggEh.exe
  2⤵
  PID:9612
- C:\Windows\System\uRWGpLq.exe
  C:\Windows\System\uRWGpLq.exe
  2⤵
  PID:9668
- C:\Windows\System\QSqTyju.exe
  C:\Windows\System\QSqTyju.exe
  2⤵
  PID:9688
- C:\Windows\System\yoCaKGJ.exe
  C:\Windows\System\yoCaKGJ.exe
  2⤵
  PID:9704
- C:\Windows\System\WpCEwjQ.exe
  C:\Windows\System\WpCEwjQ.exe
  2⤵
  PID:9724
- C:\Windows\System\VSxHWep.exe
  C:\Windows\System\VSxHWep.exe
  2⤵
  PID:9744
- C:\Windows\System\gsLPlGv.exe
  C:\Windows\System\gsLPlGv.exe
  2⤵
  PID:9780
- C:\Windows\System\fBJWYgE.exe
  C:\Windows\System\fBJWYgE.exe
  2⤵
  PID:9800
- C:\Windows\System\onKeYfD.exe
  C:\Windows\System\onKeYfD.exe
  2⤵
  PID:9820
- C:\Windows\System\yyLuZmU.exe
  C:\Windows\System\yyLuZmU.exe
  2⤵
  PID:9932
- C:\Windows\System\PLKTbEc.exe
  C:\Windows\System\PLKTbEc.exe
  2⤵
  PID:9960
- C:\Windows\System\aUHOOPj.exe
  C:\Windows\System\aUHOOPj.exe
  2⤵
  PID:9976
- C:\Windows\System\baXsRWt.exe
  C:\Windows\System\baXsRWt.exe
  2⤵
  PID:9992
- C:\Windows\System\MyCzqNz.exe
  C:\Windows\System\MyCzqNz.exe
  2⤵
  PID:10008
- C:\Windows\System\bkletBK.exe
  C:\Windows\System\bkletBK.exe
  2⤵
  PID:10028
- C:\Windows\System\vKmIEZC.exe
  C:\Windows\System\vKmIEZC.exe
  2⤵
  PID:10048
- C:\Windows\System\bCYKsMV.exe
  C:\Windows\System\bCYKsMV.exe
  2⤵
  PID:10072
- C:\Windows\System\yAxPoqe.exe
  C:\Windows\System\yAxPoqe.exe
  2⤵
  PID:10096
- C:\Windows\System\QEUiaiR.exe
  C:\Windows\System\QEUiaiR.exe
  2⤵
  PID:10112
- C:\Windows\System\vsKshyO.exe
  C:\Windows\System\vsKshyO.exe
  2⤵
  PID:10140
- C:\Windows\System\VBeLqDq.exe
  C:\Windows\System\VBeLqDq.exe
  2⤵
  PID:10168
- C:\Windows\System\fklNOmH.exe
  C:\Windows\System\fklNOmH.exe
  2⤵
  PID:10184
- C:\Windows\System\ejsNGBf.exe
  C:\Windows\System\ejsNGBf.exe
  2⤵
  PID:10204
- C:\Windows\System\ObeGyQr.exe
  C:\Windows\System\ObeGyQr.exe
  2⤵
  PID:10224
- C:\Windows\System\EkgzwNv.exe
  C:\Windows\System\EkgzwNv.exe
  2⤵
  PID:6432
- C:\Windows\System\rUSFsRL.exe
  C:\Windows\System\rUSFsRL.exe
  2⤵
  PID:7208
- C:\Windows\System\XEvYQCj.exe
  C:\Windows\System\XEvYQCj.exe
  2⤵
  PID:6808
- C:\Windows\System\WeHEPgj.exe
  C:\Windows\System\WeHEPgj.exe
  2⤵
  PID:7340
- C:\Windows\System\RoREDec.exe
  C:\Windows\System\RoREDec.exe
  2⤵
  PID:7896
- C:\Windows\System\htrwVOU.exe
  C:\Windows\System\htrwVOU.exe
  2⤵
  PID:7900
- C:\Windows\System\OqgPnle.exe
  C:\Windows\System\OqgPnle.exe
  2⤵
  PID:8252
- C:\Windows\System\hozBkaA.exe
  C:\Windows\System\hozBkaA.exe
  2⤵
  PID:8296
- C:\Windows\System\oVAAzRV.exe
  C:\Windows\System\oVAAzRV.exe
  2⤵
  PID:8120
- C:\Windows\System\YDNKOoE.exe
  C:\Windows\System\YDNKOoE.exe
  2⤵
  PID:5880
- C:\Windows\System\uZAskoj.exe
  C:\Windows\System\uZAskoj.exe
  2⤵
  PID:9068
- C:\Windows\System\QXHIwDX.exe
  C:\Windows\System\QXHIwDX.exe
  2⤵
  PID:8416
- C:\Windows\System\IvkpkZd.exe
  C:\Windows\System\IvkpkZd.exe
  2⤵
  PID:9184
- C:\Windows\System\rfOaIJK.exe
  C:\Windows\System\rfOaIJK.exe
  2⤵
  PID:8320
- C:\Windows\System\unaeqeU.exe
  C:\Windows\System\unaeqeU.exe
  2⤵
  PID:4160
- C:\Windows\System\JkQOcSs.exe
  C:\Windows\System\JkQOcSs.exe
  2⤵
  PID:8660
- C:\Windows\System\joOHTOZ.exe
  C:\Windows\System\joOHTOZ.exe
  2⤵
  PID:8728
- C:\Windows\System\EDtQPVO.exe
  C:\Windows\System\EDtQPVO.exe
  2⤵
  PID:8088
- C:\Windows\System\ggAKEMC.exe
  C:\Windows\System\ggAKEMC.exe
  2⤵
  PID:8868
- C:\Windows\System\jLuuwUB.exe
  C:\Windows\System\jLuuwUB.exe
  2⤵
  PID:8156
- C:\Windows\System\iNHPETR.exe
  C:\Windows\System\iNHPETR.exe
  2⤵
  PID:9488
- C:\Windows\System\gAWostn.exe
  C:\Windows\System\gAWostn.exe
  2⤵
  PID:9120
- C:\Windows\System\PKuwIwW.exe
  C:\Windows\System\PKuwIwW.exe
  2⤵
  PID:5828
- C:\Windows\System\nTjdFco.exe
  C:\Windows\System\nTjdFco.exe
  2⤵
  PID:8360
- C:\Windows\System\kZdbZWO.exe
  C:\Windows\System\kZdbZWO.exe
  2⤵
  PID:7508
- C:\Windows\System\OCsvUEE.exe
  C:\Windows\System\OCsvUEE.exe
  2⤵
  PID:1164
- C:\Windows\System\uYniKym.exe
  C:\Windows\System\uYniKym.exe
  2⤵
  PID:9860
- C:\Windows\System\jwiBLsf.exe
  C:\Windows\System\jwiBLsf.exe
  2⤵
  PID:7716
- C:\Windows\System\gOzfZJX.exe
  C:\Windows\System\gOzfZJX.exe
  2⤵
  PID:8176
- C:\Windows\System\WytTIGy.exe
  C:\Windows\System\WytTIGy.exe
  2⤵
  PID:9372
- C:\Windows\System\JdmQXil.exe
  C:\Windows\System\JdmQXil.exe
  2⤵
  PID:9420
- C:\Windows\System\GYediCP.exe
  C:\Windows\System\GYediCP.exe
  2⤵
  PID:9456
- C:\Windows\System\xhSefZL.exe
  C:\Windows\System\xhSefZL.exe
  2⤵
  PID:8388
- C:\Windows\System\zgcJuHq.exe
  C:\Windows\System\zgcJuHq.exe
  2⤵
  PID:10256
- C:\Windows\System\glexTSX.exe
  C:\Windows\System\glexTSX.exe
  2⤵
  PID:10276
- C:\Windows\System\VSloVAM.exe
  C:\Windows\System\VSloVAM.exe
  2⤵
  PID:10296
- C:\Windows\System\PvTkElC.exe
  C:\Windows\System\PvTkElC.exe
  2⤵
  PID:10324
- C:\Windows\System\tRbxdtN.exe
  C:\Windows\System\tRbxdtN.exe
  2⤵
  PID:10344
- C:\Windows\System\uBDbYaI.exe
  C:\Windows\System\uBDbYaI.exe
  2⤵
  PID:10368
- C:\Windows\System\AzbVXNh.exe
  C:\Windows\System\AzbVXNh.exe
  2⤵
  PID:10396
- C:\Windows\System\QXsSxnV.exe
  C:\Windows\System\QXsSxnV.exe
  2⤵
  PID:10412
- C:\Windows\System\nqBjWZE.exe
  C:\Windows\System\nqBjWZE.exe
  2⤵
  PID:10428
- C:\Windows\System\pIlFvYi.exe
  C:\Windows\System\pIlFvYi.exe
  2⤵
  PID:10444
- C:\Windows\System\amFrKdj.exe
  C:\Windows\System\amFrKdj.exe
  2⤵
  PID:10472
- C:\Windows\System\DZfIdGk.exe
  C:\Windows\System\DZfIdGk.exe
  2⤵
  PID:10496
- C:\Windows\System\UDJrqBb.exe
  C:\Windows\System\UDJrqBb.exe
  2⤵
  PID:10520
- C:\Windows\System\nGdeQRW.exe
  C:\Windows\System\nGdeQRW.exe
  2⤵
  PID:10540
- C:\Windows\System\tKTacvw.exe
  C:\Windows\System\tKTacvw.exe
  2⤵
  PID:10564
- C:\Windows\System\cLlRwxC.exe
  C:\Windows\System\cLlRwxC.exe
  2⤵
  PID:10584
- C:\Windows\System\OuOQzkq.exe
  C:\Windows\System\OuOQzkq.exe
  2⤵
  PID:10620
- C:\Windows\System\qZlyvWs.exe
  C:\Windows\System\qZlyvWs.exe
  2⤵
  PID:10640
- C:\Windows\System\SYqdhVp.exe
  C:\Windows\System\SYqdhVp.exe
  2⤵
  PID:10656
- C:\Windows\System\DvvjuWx.exe
  C:\Windows\System\DvvjuWx.exe
  2⤵
  PID:10688
- C:\Windows\System\MtXCLMi.exe
  C:\Windows\System\MtXCLMi.exe
  2⤵
  PID:10708
- C:\Windows\System\AbBlwwl.exe
  C:\Windows\System\AbBlwwl.exe
  2⤵
  PID:10740
- C:\Windows\System\UaYeRVe.exe
  C:\Windows\System\UaYeRVe.exe
  2⤵
  PID:10756
- C:\Windows\System\WFhZsDW.exe
  C:\Windows\System\WFhZsDW.exe
  2⤵
  PID:10780
- C:\Windows\System\QjmuvAy.exe
  C:\Windows\System\QjmuvAy.exe
  2⤵
  PID:10804
- C:\Windows\System\bKpFseY.exe
  C:\Windows\System\bKpFseY.exe
  2⤵
  PID:10824
- C:\Windows\System\NJuUIad.exe
  C:\Windows\System\NJuUIad.exe
  2⤵
  PID:10844
- C:\Windows\System\JlrHhJb.exe
  C:\Windows\System\JlrHhJb.exe
  2⤵
  PID:10912
- C:\Windows\System\mwfVjqb.exe
  C:\Windows\System\mwfVjqb.exe
  2⤵
  PID:10936
- C:\Windows\System\ynrzyxJ.exe
  C:\Windows\System\ynrzyxJ.exe
  2⤵
  PID:10960
- C:\Windows\System\OvACcRe.exe
  C:\Windows\System\OvACcRe.exe
  2⤵
  PID:10976
- C:\Windows\System\xglExHg.exe
  C:\Windows\System\xglExHg.exe
  2⤵
  PID:11004
- C:\Windows\System\trHlEQd.exe
  C:\Windows\System\trHlEQd.exe
  2⤵
  PID:11020
- C:\Windows\System\IsGcPwP.exe
  C:\Windows\System\IsGcPwP.exe
  2⤵
  PID:11048
- C:\Windows\System\pjulsuc.exe
  C:\Windows\System\pjulsuc.exe
  2⤵
  PID:11068
- C:\Windows\System\WUonSpL.exe
  C:\Windows\System\WUonSpL.exe
  2⤵
  PID:11092
- C:\Windows\System\zVqgXci.exe
  C:\Windows\System\zVqgXci.exe
  2⤵
  PID:11116
- C:\Windows\System\JADawBH.exe
  C:\Windows\System\JADawBH.exe
  2⤵
  PID:11140
- C:\Windows\System\HnPFXWi.exe
  C:\Windows\System\HnPFXWi.exe
  2⤵
  PID:11164
- C:\Windows\System\XgVDwur.exe
  C:\Windows\System\XgVDwur.exe
  2⤵
  PID:11184
- C:\Windows\System\tGFBrxu.exe
  C:\Windows\System\tGFBrxu.exe
  2⤵
  PID:11216
- C:\Windows\System\VnWiqFz.exe
  C:\Windows\System\VnWiqFz.exe
  2⤵
  PID:11244
- C:\Windows\System\YApZQJl.exe
  C:\Windows\System\YApZQJl.exe
  2⤵
  PID:11260
- C:\Windows\System\RJbQFvs.exe
  C:\Windows\System\RJbQFvs.exe
  2⤵
  PID:7876
- C:\Windows\System\QFrUgGm.exe
  C:\Windows\System\QFrUgGm.exe
  2⤵
  PID:8968
- C:\Windows\System\NCFcBgS.exe
  C:\Windows\System\NCFcBgS.exe
  2⤵
  PID:8464
- C:\Windows\System\kByvbXB.exe
  C:\Windows\System\kByvbXB.exe
  2⤵
  PID:2324
- C:\Windows\System\jjnOHks.exe
  C:\Windows\System\jjnOHks.exe
  2⤵
  PID:9244
- C:\Windows\System\FHkCIXt.exe
  C:\Windows\System\FHkCIXt.exe
  2⤵
  PID:4360
- C:\Windows\System\FzQnIwc.exe
  C:\Windows\System\FzQnIwc.exe
  2⤵
  PID:2228
- C:\Windows\System\FAyrFjd.exe
  C:\Windows\System\FAyrFjd.exe
  2⤵
  PID:468
- C:\Windows\System\XBfvIgh.exe
  C:\Windows\System\XBfvIgh.exe
  2⤵
  PID:9520
- C:\Windows\System\deFLqsT.exe
  C:\Windows\System\deFLqsT.exe
  2⤵
  PID:9356
- C:\Windows\System\mOhEtMN.exe
  C:\Windows\System\mOhEtMN.exe
  2⤵
  PID:9408
- C:\Windows\System\nlIZrrX.exe
  C:\Windows\System\nlIZrrX.exe
  2⤵
  PID:10056
- C:\Windows\System\ppGwELl.exe
  C:\Windows\System\ppGwELl.exe
  2⤵
  PID:9904
- C:\Windows\System\fXKcXBs.exe
  C:\Windows\System\fXKcXBs.exe
  2⤵
  PID:10156
- C:\Windows\System\tezWGql.exe
  C:\Windows\System\tezWGql.exe
  2⤵
  PID:4832
- C:\Windows\System\mvFdTQy.exe
  C:\Windows\System\mvFdTQy.exe
  2⤵
  PID:6400
- C:\Windows\System\XEOLQSK.exe
  C:\Windows\System\XEOLQSK.exe
  2⤵
  PID:10452
- C:\Windows\System\PbnlpRk.exe
  C:\Windows\System\PbnlpRk.exe
  2⤵
  PID:9624
- C:\Windows\System\MfTYjlZ.exe
  C:\Windows\System\MfTYjlZ.exe
  2⤵
  PID:8160
- C:\Windows\System\LNHCPQn.exe
  C:\Windows\System\LNHCPQn.exe
  2⤵
  PID:10592
- C:\Windows\System\SkGpRKg.exe
  C:\Windows\System\SkGpRKg.exe
  2⤵
  PID:11276
- C:\Windows\System\mvquVvQ.exe
  C:\Windows\System\mvquVvQ.exe
  2⤵
  PID:11296
- C:\Windows\System\TaNXOuN.exe
  C:\Windows\System\TaNXOuN.exe
  2⤵
  PID:11312
- C:\Windows\System\ZtlyFAP.exe
  C:\Windows\System\ZtlyFAP.exe
  2⤵
  PID:11328
- C:\Windows\System\mXmjFEe.exe
  C:\Windows\System\mXmjFEe.exe
  2⤵
  PID:11352
- C:\Windows\System\DjAVBic.exe
  C:\Windows\System\DjAVBic.exe
  2⤵
  PID:11376
- C:\Windows\System\zbOefbP.exe
  C:\Windows\System\zbOefbP.exe
  2⤵
  PID:11396
- C:\Windows\System\NLRbPMG.exe
  C:\Windows\System\NLRbPMG.exe
  2⤵
  PID:11420
- C:\Windows\System\ZDjWCiC.exe
  C:\Windows\System\ZDjWCiC.exe
  2⤵
  PID:11480
- C:\Windows\System\SvDkkMg.exe
  C:\Windows\System\SvDkkMg.exe
  2⤵
  PID:11500
- C:\Windows\System\AtZPGEl.exe
  C:\Windows\System\AtZPGEl.exe
  2⤵
  PID:11524
- C:\Windows\System\WufDHAh.exe
  C:\Windows\System\WufDHAh.exe
  2⤵
  PID:11552
- C:\Windows\System\uaIChwu.exe
  C:\Windows\System\uaIChwu.exe
  2⤵
  PID:11580
- C:\Windows\System\bKajdPO.exe
  C:\Windows\System\bKajdPO.exe
  2⤵
  PID:11596
- C:\Windows\System\FLqXbfr.exe
  C:\Windows\System\FLqXbfr.exe
  2⤵
  PID:11620
- C:\Windows\System\egucZBS.exe
  C:\Windows\System\egucZBS.exe
  2⤵
  PID:11640
- C:\Windows\System\JVVYBDt.exe
  C:\Windows\System\JVVYBDt.exe
  2⤵
  PID:11664
- C:\Windows\System\NGMGunK.exe
  C:\Windows\System\NGMGunK.exe
  2⤵
  PID:11684
- C:\Windows\System\qZxoHYn.exe
  C:\Windows\System\qZxoHYn.exe
  2⤵
  PID:11700
- C:\Windows\System\vebbyny.exe
  C:\Windows\System\vebbyny.exe
  2⤵
  PID:11728
- C:\Windows\System\dfrrIJi.exe
  C:\Windows\System\dfrrIJi.exe
  2⤵
  PID:11752
- C:\Windows\System\BLdwqaB.exe
  C:\Windows\System\BLdwqaB.exe
  2⤵
  PID:11772
- C:\Windows\System\cuMOjIZ.exe
  C:\Windows\System\cuMOjIZ.exe
  2⤵
  PID:11796
- C:\Windows\System\wbeAQrr.exe
  C:\Windows\System\wbeAQrr.exe
  2⤵
  PID:11816
- C:\Windows\System\luybXuO.exe
  C:\Windows\System\luybXuO.exe
  2⤵
  PID:11852
- C:\Windows\System\gLCGxoN.exe
  C:\Windows\System\gLCGxoN.exe
  2⤵
  PID:11876
- C:\Windows\System\ubUoeai.exe
  C:\Windows\System\ubUoeai.exe
  2⤵
  PID:11896
- C:\Windows\System\BMUfSuP.exe
  C:\Windows\System\BMUfSuP.exe
  2⤵
  PID:11916
- C:\Windows\System\HezxJIR.exe
  C:\Windows\System\HezxJIR.exe
  2⤵
  PID:11936
- C:\Windows\System\ZnitbvI.exe
  C:\Windows\System\ZnitbvI.exe
  2⤵
  PID:11964
- C:\Windows\System\BKOSqHQ.exe
  C:\Windows\System\BKOSqHQ.exe
  2⤵
  PID:11980
- C:\Windows\System\BYJAbAr.exe
  C:\Windows\System\BYJAbAr.exe
  2⤵
  PID:12000
- C:\Windows\System\nTADZEm.exe
  C:\Windows\System\nTADZEm.exe
  2⤵
  PID:12020
- C:\Windows\System\iWkLJlw.exe
  C:\Windows\System\iWkLJlw.exe
  2⤵
  PID:12036
- C:\Windows\System\OOiABCv.exe
  C:\Windows\System\OOiABCv.exe
  2⤵
  PID:12052
- C:\Windows\System\AbKJMQR.exe
  C:\Windows\System\AbKJMQR.exe
  2⤵
  PID:12072
- C:\Windows\System\ifviidn.exe
  C:\Windows\System\ifviidn.exe
  2⤵
  PID:12088
- C:\Windows\System\tXicERR.exe
  C:\Windows\System\tXicERR.exe
  2⤵
  PID:12108
- C:\Windows\System\HOJqOXj.exe
  C:\Windows\System\HOJqOXj.exe
  2⤵
  PID:12140
- C:\Windows\System\ohLWuZq.exe
  C:\Windows\System\ohLWuZq.exe
  2⤵
  PID:12168
- C:\Windows\System\SsENTXd.exe
  C:\Windows\System\SsENTXd.exe
  2⤵
  PID:12192
- C:\Windows\System\katJdjU.exe
  C:\Windows\System\katJdjU.exe
  2⤵
  PID:12224
- C:\Windows\System\HeFkzqS.exe
  C:\Windows\System\HeFkzqS.exe
  2⤵
  PID:12248
- C:\Windows\System\QYKtXUn.exe
  C:\Windows\System\QYKtXUn.exe
  2⤵
  PID:12268
- C:\Windows\System\AHuoyYV.exe
  C:\Windows\System\AHuoyYV.exe
  2⤵
  PID:3532
- C:\Windows\System\FxiRvKX.exe
  C:\Windows\System\FxiRvKX.exe
  2⤵
  PID:9712
- C:\Windows\System\eabjZhi.exe
  C:\Windows\System\eabjZhi.exe
  2⤵
  PID:9772
- C:\Windows\System\njkySub.exe
  C:\Windows\System\njkySub.exe
  2⤵
  PID:9808
- C:\Windows\System\wguEmSC.exe
  C:\Windows\System\wguEmSC.exe
  2⤵
  PID:6308
- C:\Windows\System\OLFJRMq.exe
  C:\Windows\System\OLFJRMq.exe
  2⤵
  PID:10820
- C:\Windows\System\HcNjDUu.exe
  C:\Windows\System\HcNjDUu.exe
  2⤵
  PID:9908
- C:\Windows\System\kbEWRTM.exe
  C:\Windows\System\kbEWRTM.exe
  2⤵
  PID:9988
- C:\Windows\System\eSTvggj.exe
  C:\Windows\System\eSTvggj.exe
  2⤵
  PID:9608
- C:\Windows\System\qDSZjGe.exe
  C:\Windows\System\qDSZjGe.exe
  2⤵
  PID:8228
- C:\Windows\System\vBphDpa.exe
  C:\Windows\System\vBphDpa.exe
  2⤵
  PID:2392
- C:\Windows\System\XHLHusL.exe
  C:\Windows\System\XHLHusL.exe
  2⤵
  PID:7116
- C:\Windows\System\frhYSYj.exe
  C:\Windows\System\frhYSYj.exe
  2⤵
  PID:10136
- C:\Windows\System\nNAfiwp.exe
  C:\Windows\System\nNAfiwp.exe
  2⤵
  PID:10352
- C:\Windows\System\tqosEOH.exe
  C:\Windows\System\tqosEOH.exe
  2⤵
  PID:540
- C:\Windows\System\JNCHOsU.exe
  C:\Windows\System\JNCHOsU.exe
  2⤵
  PID:10608
- C:\Windows\System\leMLtVH.exe
  C:\Windows\System\leMLtVH.exe
  2⤵
  PID:8028
- C:\Windows\System\gnLOkwC.exe
  C:\Windows\System\gnLOkwC.exe
  2⤵
  PID:10700
- C:\Windows\System\WATekqD.exe
  C:\Windows\System\WATekqD.exe
  2⤵
  PID:8440
- C:\Windows\System\vtoctYR.exe
  C:\Windows\System\vtoctYR.exe
  2⤵
  PID:11412
- C:\Windows\System\IdDMZwe.exe
  C:\Windows\System\IdDMZwe.exe
  2⤵
  PID:4052
- C:\Windows\System\UqisFpV.exe
  C:\Windows\System\UqisFpV.exe
  2⤵
  PID:8668
- C:\Windows\System\wJacHCa.exe
  C:\Windows\System\wJacHCa.exe
  2⤵
  PID:8780
- C:\Windows\System\PhazsbS.exe
  C:\Windows\System\PhazsbS.exe
  2⤵
  PID:9104
- C:\Windows\System\PKBPHSz.exe
  C:\Windows\System\PKBPHSz.exe
  2⤵
  PID:11112
- C:\Windows\System\BxAsHsl.exe
  C:\Windows\System\BxAsHsl.exe
  2⤵
  PID:11768
- C:\Windows\System\ahESrSv.exe
  C:\Windows\System\ahESrSv.exe
  2⤵
  PID:11808
- C:\Windows\System\lbCPaBQ.exe
  C:\Windows\System\lbCPaBQ.exe
  2⤵
  PID:8204
- C:\Windows\System\PpzGAli.exe
  C:\Windows\System\PpzGAli.exe
  2⤵
  PID:11868
- C:\Windows\System\hpprWGu.exe
  C:\Windows\System\hpprWGu.exe
  2⤵
  PID:9124
- C:\Windows\System\LvjQQFY.exe
  C:\Windows\System\LvjQQFY.exe
  2⤵
  PID:9260
- C:\Windows\System\OVuKwDa.exe
  C:\Windows\System\OVuKwDa.exe
  2⤵
  PID:11952
- C:\Windows\System\NSEMXbx.exe
  C:\Windows\System\NSEMXbx.exe
  2⤵
  PID:10304
- C:\Windows\System\DfxSDmA.exe
  C:\Windows\System\DfxSDmA.exe
  2⤵
  PID:10404
- C:\Windows\System\epmJTWS.exe
  C:\Windows\System\epmJTWS.exe
  2⤵
  PID:10460
- C:\Windows\System\yVzveNt.exe
  C:\Windows\System\yVzveNt.exe
  2⤵
  PID:10580
- C:\Windows\System\eMruSer.exe
  C:\Windows\System\eMruSer.exe
  2⤵
  PID:10632
- C:\Windows\System\nqZqaZs.exe
  C:\Windows\System\nqZqaZs.exe
  2⤵
  PID:12292
- C:\Windows\System\SAPmMej.exe
  C:\Windows\System\SAPmMej.exe
  2⤵
  PID:12312
- C:\Windows\System\NmOcNYv.exe
  C:\Windows\System\NmOcNYv.exe
  2⤵
  PID:12332
- C:\Windows\System\qYGICKR.exe
  C:\Windows\System\qYGICKR.exe
  2⤵
  PID:12352
- C:\Windows\System\XXgWQRs.exe
  C:\Windows\System\XXgWQRs.exe
  2⤵
  PID:12368
- C:\Windows\System\DKrnoDu.exe
  C:\Windows\System\DKrnoDu.exe
  2⤵
  PID:12384
- C:\Windows\System\vTUsfyO.exe
  C:\Windows\System\vTUsfyO.exe
  2⤵
  PID:12400
- C:\Windows\System\JBeJQpy.exe
  C:\Windows\System\JBeJQpy.exe
  2⤵
  PID:12436
- C:\Windows\System\LqqbFuF.exe
  C:\Windows\System\LqqbFuF.exe
  2⤵
  PID:12452
- C:\Windows\System\GSoaOJo.exe
  C:\Windows\System\GSoaOJo.exe
  2⤵
  PID:12468
- C:\Windows\System\gNvJCWh.exe
  C:\Windows\System\gNvJCWh.exe
  2⤵
  PID:12584
- C:\Windows\System\Uykkmeh.exe
  C:\Windows\System\Uykkmeh.exe
  2⤵
  PID:12608
- C:\Windows\System\BbeUqMw.exe
  C:\Windows\System\BbeUqMw.exe
  2⤵
  PID:12632
- C:\Windows\System\yOIqvnt.exe
  C:\Windows\System\yOIqvnt.exe
  2⤵
  PID:12652
- C:\Windows\System\KRVandS.exe
  C:\Windows\System\KRVandS.exe
  2⤵
  PID:12684
- C:\Windows\System\tXQabRH.exe
  C:\Windows\System\tXQabRH.exe
  2⤵
  PID:12700
- C:\Windows\System\hqhmXQl.exe
  C:\Windows\System\hqhmXQl.exe
  2⤵
  PID:12724
- C:\Windows\System\kWHrpIO.exe
  C:\Windows\System\kWHrpIO.exe
  2⤵
  PID:12744
- C:\Windows\System\PEYnymq.exe
  C:\Windows\System\PEYnymq.exe
  2⤵
  PID:12764
- C:\Windows\System\VXtaure.exe
  C:\Windows\System\VXtaure.exe
  2⤵
  PID:12784
- C:\Windows\System\gLcKsbe.exe
  C:\Windows\System\gLcKsbe.exe
  2⤵
  PID:12812
- C:\Windows\System\bdzvovc.exe
  C:\Windows\System\bdzvovc.exe
  2⤵
  PID:12836
- C:\Windows\System\fDWQuRU.exe
  C:\Windows\System\fDWQuRU.exe
  2⤵
  PID:12856
- C:\Windows\System\aXpSJIj.exe
  C:\Windows\System\aXpSJIj.exe
  2⤵
  PID:12884
- C:\Windows\System\NZNGQkh.exe
  C:\Windows\System\NZNGQkh.exe
  2⤵
  PID:12908
- C:\Windows\System\fEGJSTR.exe
  C:\Windows\System\fEGJSTR.exe
  2⤵
  PID:12928
- C:\Windows\System\dFwsxUQ.exe
  C:\Windows\System\dFwsxUQ.exe
  2⤵
  PID:12952
- C:\Windows\System\RSwusyP.exe
  C:\Windows\System\RSwusyP.exe
  2⤵
  PID:12976
- C:\Windows\System\DHmVojT.exe
  C:\Windows\System\DHmVojT.exe
  2⤵
  PID:12996
- C:\Windows\System\eBOglrX.exe
  C:\Windows\System\eBOglrX.exe
  2⤵
  PID:13028
- C:\Windows\System\MEuBSfX.exe
  C:\Windows\System\MEuBSfX.exe
  2⤵
  PID:13060
- C:\Windows\System\SXzpYlc.exe
  C:\Windows\System\SXzpYlc.exe
  2⤵
  PID:13084
- C:\Windows\System\cIDVLeI.exe
  C:\Windows\System\cIDVLeI.exe
  2⤵
  PID:13108
- C:\Windows\System\OgcxsYP.exe
  C:\Windows\System\OgcxsYP.exe
  2⤵
  PID:13128
- C:\Windows\System\gQDlQfq.exe
  C:\Windows\System\gQDlQfq.exe
  2⤵
  PID:13152
- C:\Windows\System\JzSNYKD.exe
  C:\Windows\System\JzSNYKD.exe
  2⤵
  PID:13180
- C:\Windows\System\EaQSmxA.exe
  C:\Windows\System\EaQSmxA.exe
  2⤵
  PID:812
- C:\Windows\System\HkUchdk.exe
  C:\Windows\System\HkUchdk.exe
  2⤵
  PID:1596
- C:\Windows\System\ROvlNjR.exe
  C:\Windows\System\ROvlNjR.exe
  2⤵
  PID:10920
- C:\Windows\System\pwNTLJl.exe
  C:\Windows\System\pwNTLJl.exe
  2⤵
  PID:10956
- C:\Windows\System\NyaGaNY.exe
  C:\Windows\System\NyaGaNY.exe
  2⤵
  PID:11012
- C:\Windows\System\eEYZSJZ.exe
  C:\Windows\System\eEYZSJZ.exe
  2⤵
  PID:11100
- C:\Windows\System\yxQJVvx.exe
  C:\Windows\System\yxQJVvx.exe
  2⤵
  PID:11812
- C:\Windows\System\qWsYmdw.exe
  C:\Windows\System\qWsYmdw.exe
  2⤵
  PID:13204
- C:\Windows\System\fXiDRES.exe
  C:\Windows\System\fXiDRES.exe
  2⤵
  PID:11908
- C:\Windows\System\HhbIluw.exe
  C:\Windows\System\HhbIluw.exe
  2⤵
  PID:12008
- C:\Windows\System\VsuxlNH.exe
  C:\Windows\System\VsuxlNH.exe
  2⤵
  PID:12184
- C:\Windows\System\DzQZxBg.exe
  C:\Windows\System\DzQZxBg.exe
  2⤵
  PID:10792
- C:\Windows\System\lrfSIdx.exe
  C:\Windows\System\lrfSIdx.exe
  2⤵
  PID:10840
- C:\Windows\System\YjBNcbz.exe
  C:\Windows\System\YjBNcbz.exe
  2⤵
  PID:8636
- C:\Windows\System\tbmhZjS.exe
  C:\Windows\System\tbmhZjS.exe
  2⤵
  PID:8776
- C:\Windows\System\BAiqOTg.exe
  C:\Windows\System\BAiqOTg.exe
  2⤵
  PID:11656
- C:\Windows\System\aaXNISH.exe
  C:\Windows\System\aaXNISH.exe
  2⤵
  PID:7808
- C:\Windows\System\ZjWbGRo.exe
  C:\Windows\System\ZjWbGRo.exe
  2⤵
  PID:13120
- C:\Windows\System\zzohFXg.exe
  C:\Windows\System\zzohFXg.exe
  2⤵
  PID:12940
- C:\Windows\System\LIBxFBk.exe
  C:\Windows\System\LIBxFBk.exe
  2⤵
  PID:12824
- C:\Windows\System\HPqDUUe.exe
  C:\Windows\System\HPqDUUe.exe
  2⤵
  PID:12640
- C:\Windows\System\AGECVuT.exe
  C:\Windows\System\AGECVuT.exe
  2⤵
  PID:12408
- C:\Windows\System\gyGNPsc.exe
  C:\Windows\System\gyGNPsc.exe
  2⤵
  PID:12324
- C:\Windows\System\XSZXAga.exe
  C:\Windows\System\XSZXAga.exe
  2⤵
  PID:12064
- C:\Windows\System\UBrtNSE.exe
  C:\Windows\System\UBrtNSE.exe
  2⤵
  PID:11060
- C:\Windows\System\QEEizPv.exe
  C:\Windows\System\QEEizPv.exe
  2⤵
  PID:12364
- C:\Windows\System\zVlrmir.exe
  C:\Windows\System\zVlrmir.exe
  2⤵
  PID:2916
- C:\Windows\System\wWpsByc.exe
  C:\Windows\System\wWpsByc.exe
  2⤵
  PID:9676
- C:\Windows\System\zWSgaJx.exe
  C:\Windows\System\zWSgaJx.exe
  2⤵
  PID:12560
- C:\Windows\System\GCvNfdA.exe
  C:\Windows\System\GCvNfdA.exe
  2⤵
  PID:13100
- C:\Windows\System\cXGYkmX.exe
  C:\Windows\System\cXGYkmX.exe
  2⤵
  PID:13160
- C:\Windows\System\DudMMrA.exe
  C:\Windows\System\DudMMrA.exe
  2⤵
  PID:12200
- C:\Windows\System\ZSAftAd.exe
  C:\Windows\System\ZSAftAd.exe
  2⤵
  PID:12532
- C:\Windows\System\CFZheLT.exe
  C:\Windows\System\CFZheLT.exe
  2⤵
  PID:10424
- C:\Windows\System\jBIdqVS.exe
  C:\Windows\System\jBIdqVS.exe
  2⤵
  PID:9516
- C:\Windows\System\uAJnuBf.exe
  C:\Windows\System\uAJnuBf.exe
  2⤵
  PID:13168
- C:\Windows\System\dwEEoSu.exe
  C:\Windows\System\dwEEoSu.exe
  2⤵
  PID:12964
- C:\Windows\System\gYXYkqr.exe
  C:\Windows\System\gYXYkqr.exe
  2⤵
  PID:12804
- C:\Windows\System\IIFIldV.exe
  C:\Windows\System\IIFIldV.exe
  2⤵
  PID:12968
- C:\Windows\System\EyTqTBE.exe
  C:\Windows\System\EyTqTBE.exe
  2⤵
  PID:1524
- C:\Windows\System\AEinixl.exe
  C:\Windows\System\AEinixl.exe
  2⤵
  PID:2504
- C:\Windows\System\gCcezWq.exe
  C:\Windows\System\gCcezWq.exe
  2⤵
  PID:11508
- C:\Windows\System\GUyYrOH.exe
  C:\Windows\System\GUyYrOH.exe
  2⤵
  PID:11608
- C:\Windows\System\cGhNsnC.exe
  C:\Windows\System\cGhNsnC.exe
  2⤵
  PID:11532
- C:\Windows\System\fQQyjrB.exe
  C:\Windows\System\fQQyjrB.exe
  2⤵
  PID:4236
- C:\Windows\System\ZVGCIqL.exe
  C:\Windows\System\ZVGCIqL.exe
  2⤵
  PID:12376
- C:\Windows\System\AjPUWaJ.exe
  C:\Windows\System\AjPUWaJ.exe
  2⤵
  PID:12828
- C:\Windows\System\RvoIIMx.exe
  C:\Windows\System\RvoIIMx.exe
  2⤵
  PID:11324
- C:\Windows\System\hFFpyGf.exe
  C:\Windows\System\hFFpyGf.exe
  2⤵
  PID:12644
- C:\Windows\System\fdvedsa.exe
  C:\Windows\System\fdvedsa.exe
  2⤵
  PID:5008
- C:\Windows\System\vTcNnUr.exe
  C:\Windows\System\vTcNnUr.exe
  2⤵
  PID:7912
- C:\Windows\System\TxdPjjD.exe
  C:\Windows\System\TxdPjjD.exe
  2⤵
  PID:12904
- C:\Windows\System\Vxoqqfl.exe
  C:\Windows\System\Vxoqqfl.exe
  2⤵
  PID:3048
- C:\Windows\System\ijVQGQH.exe
  C:\Windows\System\ijVQGQH.exe
  2⤵
  PID:3912
- C:\Windows\System\RuueoZv.exe
  C:\Windows\System\RuueoZv.exe
  2⤵
  PID:10988
- C:\Windows\System\BNURXqm.exe
  C:\Windows\System\BNURXqm.exe
  2⤵
  PID:2284
- C:\Windows\System\SyunVnH.exe
  C:\Windows\System\SyunVnH.exe
  2⤵
  PID:12396
- C:\Windows\System\RbJzTZP.exe
  C:\Windows\System\RbJzTZP.exe
  2⤵
  PID:8840
- C:\Windows\System\UcAZKqx.exe
  C:\Windows\System\UcAZKqx.exe
  2⤵
  PID:8876
- C:\Windows\System\LYudMmt.exe
  C:\Windows\System\LYudMmt.exe
  2⤵
  PID:756
- C:\Windows\System\jYFmjUh.exe
  C:\Windows\System\jYFmjUh.exe
  2⤵
  PID:11516
- C:\Windows\System\nQEIRmH.exe
  C:\Windows\System\nQEIRmH.exe
  2⤵
  PID:13300
- C:\Windows\System\YNRjBaX.exe
  C:\Windows\System\YNRjBaX.exe
  2⤵
  PID:6464
- C:\Windows\System\tMPqMJc.exe
  C:\Windows\System\tMPqMJc.exe
  2⤵
  PID:7616
- C:\Windows\System\dgIavpK.exe
  C:\Windows\System\dgIavpK.exe
  2⤵
  PID:8224
- C:\Windows\System\HxHgICJ.exe
  C:\Windows\System\HxHgICJ.exe
  2⤵
  PID:9880
- C:\Windows\System\HCkPQQz.exe
  C:\Windows\System\HCkPQQz.exe
  2⤵
  PID:3696
- C:\Windows\System\dVxzqvH.exe
  C:\Windows\System\dVxzqvH.exe
  2⤵
  PID:432
- C:\Windows\System\ajQKCyY.exe
  C:\Windows\System\ajQKCyY.exe
  2⤵
  PID:532
- C:\Windows\System\TdNWXEk.exe
  C:\Windows\System\TdNWXEk.exe
  2⤵
  PID:13460
- C:\Windows\System\HtUoZCL.exe
  C:\Windows\System\HtUoZCL.exe
  2⤵
  PID:13940
- C:\Windows\System\cCoCTWu.exe
  C:\Windows\System\cCoCTWu.exe
  2⤵
  PID:14280
- C:\Windows\System\YYMIjvx.exe
  C:\Windows\System\YYMIjvx.exe
  2⤵
  PID:10872
- C:\Windows\System\KlWcgvR.exe
  C:\Windows\System\KlWcgvR.exe
  2⤵
  PID:12732
- C:\Windows\System\RaAgglh.exe
  C:\Windows\System\RaAgglh.exe
  2⤵
  PID:9264
- C:\Windows\System\dmEJnON.exe
  C:\Windows\System\dmEJnON.exe
  2⤵
  PID:13452
- C:\Windows\System\snEyQfZ.exe
  C:\Windows\System\snEyQfZ.exe
  2⤵
  PID:13480
- C:\Windows\System\YhKuMCe.exe
  C:\Windows\System\YhKuMCe.exe
  2⤵
  PID:13504
- C:\Windows\System\SToImOm.exe
  C:\Windows\System\SToImOm.exe
  2⤵
  PID:13292
- C:\Windows\System\ycqsudQ.exe
  C:\Windows\System\ycqsudQ.exe
  2⤵
  PID:13532
- C:\Windows\System\rUuhrlo.exe
  C:\Windows\System\rUuhrlo.exe
  2⤵
  PID:13548
- C:\Windows\System\dFYOjkk.exe
  C:\Windows\System\dFYOjkk.exe
  2⤵
  PID:13564
- C:\Windows\System\mesrRhy.exe
  C:\Windows\System\mesrRhy.exe
  2⤵
  PID:13584
- C:\Windows\System\OuQLtwl.exe
  C:\Windows\System\OuQLtwl.exe
  2⤵
  PID:13592
- C:\Windows\System\nsbgDaH.exe
  C:\Windows\System\nsbgDaH.exe
  2⤵
  PID:13608
- C:\Windows\System\TXlghJF.exe
  C:\Windows\System\TXlghJF.exe
  2⤵
  PID:13628
- C:\Windows\System\LvRubxO.exe
  C:\Windows\System\LvRubxO.exe
  2⤵
  PID:13644
- C:\Windows\System\UwgGkDP.exe
  C:\Windows\System\UwgGkDP.exe
  2⤵
  PID:13660
- C:\Windows\System\FGUEBsU.exe
  C:\Windows\System\FGUEBsU.exe
  2⤵
  PID:3392
- C:\Windows\System\hXfjtgC.exe
  C:\Windows\System\hXfjtgC.exe
  2⤵
  PID:13696
- C:\Windows\System\XuTerMd.exe
  C:\Windows\System\XuTerMd.exe
  2⤵
  PID:13744
- C:\Windows\System\xaHNILA.exe
  C:\Windows\System\xaHNILA.exe
  2⤵
  PID:13768
- C:\Windows\System\ODkLFRF.exe
  C:\Windows\System\ODkLFRF.exe
  2⤵
  PID:13792
- C:\Windows\System\bOHIhnI.exe
  C:\Windows\System\bOHIhnI.exe
  2⤵
  PID:13808
- C:\Windows\System\xaVqOcL.exe
  C:\Windows\System\xaVqOcL.exe
  2⤵
  PID:13828
- C:\Windows\System\LlygQOj.exe
  C:\Windows\System\LlygQOj.exe
  2⤵
  PID:3812
- C:\Windows\System\vuXLsMk.exe
  C:\Windows\System\vuXLsMk.exe
  2⤵
  PID:720
- C:\Windows\System\jHoRYuB.exe
  C:\Windows\System\jHoRYuB.exe
  2⤵
  PID:13856
- C:\Windows\System\faVKGqz.exe
  C:\Windows\System\faVKGqz.exe
  2⤵
  PID:13880
- C:\Windows\System\nLIZfWl.exe
  C:\Windows\System\nLIZfWl.exe
  2⤵
  PID:13896
- C:\Windows\System\gjEsoBu.exe
  C:\Windows\System\gjEsoBu.exe
  2⤵
  PID:13916
- C:\Windows\System\nkbfpBq.exe
  C:\Windows\System\nkbfpBq.exe
  2⤵
  PID:13932
- C:\Windows\System\mUvqttO.exe
  C:\Windows\System\mUvqttO.exe
  2⤵
  PID:13960
- C:\Windows\System\ROVRFPe.exe
  C:\Windows\System\ROVRFPe.exe
  2⤵
  PID:13968
- C:\Windows\System\rXpnPPb.exe
  C:\Windows\System\rXpnPPb.exe
  2⤵
  PID:13972
- C:\Windows\System\DSuQlHJ.exe
  C:\Windows\System\DSuQlHJ.exe
  2⤵
  PID:14020
- C:\Windows\System\sllYdyD.exe
  C:\Windows\System\sllYdyD.exe
  2⤵
  PID:14036
- C:\Windows\System\piEyTUa.exe
  C:\Windows\System\piEyTUa.exe
  2⤵
  PID:14060
- C:\Windows\System\nAFgyxJ.exe
  C:\Windows\System\nAFgyxJ.exe
  2⤵
  PID:14076
- C:\Windows\System\wbfuoVv.exe
  C:\Windows\System\wbfuoVv.exe
  2⤵
  PID:14108
- C:\Windows\System\xKejdmF.exe
  C:\Windows\System\xKejdmF.exe
  2⤵
  PID:14116
- C:\Windows\System\jqOrifE.exe
  C:\Windows\System\jqOrifE.exe
  2⤵
  PID:14136
- C:\Windows\System\UhiwUVX.exe
  C:\Windows\System\UhiwUVX.exe
  2⤵
  PID:14156
- C:\Windows\System\gLDcgNY.exe
  C:\Windows\System\gLDcgNY.exe
  2⤵
  PID:14164
- C:\Windows\System\tboiIRi.exe
  C:\Windows\System\tboiIRi.exe
  2⤵
  PID:14144
- C:\Windows\System\DKrTCoT.exe
  C:\Windows\System\DKrTCoT.exe
  2⤵
  PID:14112
- C:\Windows\System\PGKfUpF.exe
  C:\Windows\System\PGKfUpF.exe
  2⤵
  PID:13988
- C:\Windows\System\otxvacv.exe
  C:\Windows\System\otxvacv.exe
  2⤵
  PID:14212
- C:\Windows\System\fjfOVNz.exe
  C:\Windows\System\fjfOVNz.exe
  2⤵
  PID:14216
- C:\Windows\System\PQYGLim.exe
  C:\Windows\System\PQYGLim.exe
  2⤵
  PID:14228
- C:\Windows\System\igmBJqB.exe
  C:\Windows\System\igmBJqB.exe
  2⤵
  PID:14272
- C:\Windows\System\zXFNigC.exe
  C:\Windows\System\zXFNigC.exe
  2⤵
  PID:14252
- C:\Windows\System\lMOWMYe.exe
  C:\Windows\System\lMOWMYe.exe
  2⤵
  PID:2676
- C:\Windows\System\rQwIwQJ.exe
  C:\Windows\System\rQwIwQJ.exe
  2⤵
  PID:3596
- C:\Windows\System\JzaMnMx.exe
  C:\Windows\System\JzaMnMx.exe
  2⤵
  PID:860
- C:\Windows\System\LvzTjXu.exe
  C:\Windows\System\LvzTjXu.exe
  2⤵
  PID:12776
- C:\Windows\System\iiEIzxm.exe
  C:\Windows\System\iiEIzxm.exe
  2⤵
  PID:920
- C:\Windows\System\QwRfzvi.exe
  C:\Windows\System\QwRfzvi.exe
  2⤵
  PID:14316
- C:\Windows\System\gjWCVLj.exe
  C:\Windows\System\gjWCVLj.exe
  2⤵
  PID:14304
- C:\Windows\System\iPvLmIZ.exe
  C:\Windows\System\iPvLmIZ.exe
  2⤵
  PID:7392
- C:\Windows\System\lJOlQUN.exe
  C:\Windows\System\lJOlQUN.exe
  2⤵
  PID:13360
- C:\Windows\System\NbaPDiQ.exe
  C:\Windows\System\NbaPDiQ.exe
  2⤵
  PID:13328
- C:\Windows\System\cKnUqcg.exe
  C:\Windows\System\cKnUqcg.exe
  2⤵
  PID:11652
- C:\Windows\System\gJkArBz.exe
  C:\Windows\System\gJkArBz.exe
  2⤵
  PID:14332
- C:\Windows\System\gWNWCQW.exe
  C:\Windows\System\gWNWCQW.exe
  2⤵
  PID:12760
- C:\Windows\System\FLQTVKk.exe
  C:\Windows\System\FLQTVKk.exe
  2⤵
  PID:13388
- C:\Windows\System\LSjoLvS.exe
  C:\Windows\System\LSjoLvS.exe
  2⤵
  PID:13420
- C:\Windows\System\kTvnoLz.exe
  C:\Windows\System\kTvnoLz.exe
  2⤵
  PID:13432
- C:\Windows\System\ChJpKzk.exe
  C:\Windows\System\ChJpKzk.exe
  2⤵
  PID:13436
- C:\Windows\System\ECqPLmh.exe
  C:\Windows\System\ECqPLmh.exe
  2⤵
  PID:3920
- C:\Windows\System\xuYPTuM.exe
  C:\Windows\System\xuYPTuM.exe
  2⤵
  PID:13524
- C:\Windows\System\UOKwiOj.exe
  C:\Windows\System\UOKwiOj.exe
  2⤵
  PID:13556
- C:\Windows\System\ExnusBA.exe
  C:\Windows\System\ExnusBA.exe
  2⤵
  PID:13576
- C:\Windows\System\qicFrLt.exe
  C:\Windows\System\qicFrLt.exe
  2⤵
  PID:13636
- C:\Windows\System\YeEnHeD.exe
  C:\Windows\System\YeEnHeD.exe
  2⤵
  PID:13656
- C:\Windows\System\gzhxQuh.exe
  C:\Windows\System\gzhxQuh.exe
  2⤵
  PID:13672
- C:\Windows\System\IgfeXFc.exe
  C:\Windows\System\IgfeXFc.exe
  2⤵
  PID:13764
- C:\Windows\System\nwsjVTL.exe
  C:\Windows\System\nwsjVTL.exe
  2⤵
  PID:13688
- C:\Windows\System\naHjeYd.exe
  C:\Windows\System\naHjeYd.exe
  2⤵
  PID:13720
- C:\Windows\System\syKZcLp.exe
  C:\Windows\System\syKZcLp.exe
  2⤵
  PID:13620
- C:\Windows\System\pyStHJq.exe
  C:\Windows\System\pyStHJq.exe
  2⤵
  PID:13668
- C:\Windows\System\wWNSord.exe
  C:\Windows\System\wWNSord.exe
  2⤵
  PID:13804
- C:\Windows\System\oTyGqdU.exe
  C:\Windows\System\oTyGqdU.exe
  2⤵
  PID:2904
- C:\Windows\System\QIYgZoX.exe
  C:\Windows\System\QIYgZoX.exe
  2⤵
  PID:13852
- C:\Windows\System\eaWbCmF.exe
  C:\Windows\System\eaWbCmF.exe
  2⤵
  PID:13892
- C:\Windows\System\RkFmxBS.exe
  C:\Windows\System\RkFmxBS.exe
  2⤵
  PID:13928
- C:\Windows\System\jqauoIF.exe
  C:\Windows\System\jqauoIF.exe
  2⤵
  PID:13964
- C:\Windows\System\vcihNiN.exe
  C:\Windows\System\vcihNiN.exe
  2⤵
  PID:14016
- C:\Windows\System\trIjiSM.exe
  C:\Windows\System\trIjiSM.exe
  2⤵
  PID:14052
- C:\Windows\System\nQszheC.exe
  C:\Windows\System\nQszheC.exe
  2⤵
  PID:14100
- C:\Windows\System\ELkSYTl.exe
  C:\Windows\System\ELkSYTl.exe
  2⤵
  PID:14128
- C:\Windows\System\dFZBpXh.exe
  C:\Windows\System\dFZBpXh.exe
  2⤵
  PID:14184
- C:\Windows\System\kvaZEgb.exe
  C:\Windows\System\kvaZEgb.exe
  2⤵
  PID:14012
- C:\Windows\System\gQgMzkL.exe
  C:\Windows\System\gQgMzkL.exe
  2⤵
  PID:13900
- C:\Windows\System\pbbVhlF.exe
  C:\Windows\System\pbbVhlF.exe
  2⤵
  PID:4552
- C:\Windows\System\RfxFrgw.exe
  C:\Windows\System\RfxFrgw.exe
  2⤵
  PID:3204
- C:\Windows\System\aWkLtvf.exe
  C:\Windows\System\aWkLtvf.exe
  2⤵
  PID:12988
- C:\Windows\System\leiCyDP.exe
  C:\Windows\System\leiCyDP.exe
  2⤵
  PID:14296
- C:\Windows\System\YagGjSU.exe
  C:\Windows\System\YagGjSU.exe
  2⤵
  PID:13336
- C:\Windows\System\jycjYZA.exe
  C:\Windows\System\jycjYZA.exe
  2⤵
  PID:10192
- C:\Windows\System\bTwWuls.exe
  C:\Windows\System\bTwWuls.exe
  2⤵
  PID:14276
- C:\Windows\System\uxBxXVv.exe
  C:\Windows\System\uxBxXVv.exe
  2⤵
  PID:13380
- C:\Windows\System\oNrECmF.exe
  C:\Windows\System\oNrECmF.exe
  2⤵
  PID:13708
- C:\Windows\System\ebPPyHh.exe
  C:\Windows\System\ebPPyHh.exe
  2⤵
  PID:13448
- C:\Windows\System\CMKvCzP.exe
  C:\Windows\System\CMKvCzP.exe
  2⤵
  PID:13544
- C:\Windows\System\AUwbMDQ.exe
  C:\Windows\System\AUwbMDQ.exe
  2⤵
  PID:13588
- C:\Windows\System\lLjJgvA.exe
  C:\Windows\System\lLjJgvA.exe
  2⤵
  PID:13752
- C:\Windows\System\qzzVCbg.exe
  C:\Windows\System\qzzVCbg.exe
  2⤵
  PID:13692
- C:\Windows\System\VWbJKvF.exe
  C:\Windows\System\VWbJKvF.exe
  2⤵
  PID:13724
- C:\Windows\System\anGjaPY.exe
  C:\Windows\System\anGjaPY.exe
  2⤵
  PID:13788
- C:\Windows\System\COhOubs.exe
  C:\Windows\System\COhOubs.exe
  2⤵
  PID:13844
- C:\Windows\System\YqtxeXj.exe
  C:\Windows\System\YqtxeXj.exe
  2⤵
  PID:13812
- C:\Windows\System\OpUCVOw.exe
  C:\Windows\System\OpUCVOw.exe
  2⤵
  PID:14004
- C:\Windows\System\iOzYoXe.exe
  C:\Windows\System\iOzYoXe.exe
  2⤵
  PID:14096
- C:\Windows\System\YICEqkj.exe
  C:\Windows\System\YICEqkj.exe
  2⤵
  PID:14152
- C:\Windows\System\cKNHbsy.exe
  C:\Windows\System\cKNHbsy.exe
  2⤵
  PID:10336
- C:\Windows\System\HUmrjfw.exe
  C:\Windows\System\HUmrjfw.exe
  2⤵
  PID:116
- C:\Windows\System\JZiTjaI.exe
  C:\Windows\System\JZiTjaI.exe
  2⤵
  PID:14236
- C:\Windows\System\ImxLJov.exe
  C:\Windows\System\ImxLJov.exe
  2⤵
  PID:14324
- C:\Windows\System\zrwIUBa.exe
  C:\Windows\System\zrwIUBa.exe
  2⤵
  PID:13540
- C:\Windows\System\aKprsgl.exe
  C:\Windows\System\aKprsgl.exe
  2⤵
  PID:13716
- C:\Windows\System\DXpLMre.exe
  C:\Windows\System\DXpLMre.exe
  2⤵
  PID:2776
- C:\Windows\System\XOTBwqm.exe
  C:\Windows\System\XOTBwqm.exe
  2⤵
  PID:14048
- C:\Windows\System\AJAcErS.exe
  C:\Windows\System\AJAcErS.exe
  2⤵
  PID:14256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_aqhjihos.dxu.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AkXBCZC.exe

Filesize
2.1MB

MD5
06bdbc98858d78a62e408dc727fc01bc

SHA1
75179b3bd12c99b95bc19538baacc5b3e909739c

SHA256
ad927436d795675f6789f28f34f21784c66d4ab876e37c4dceb4c47953ea1ef1

SHA512
6e6d61814b6bb342ea1ff013a55764d81f830fd373590a0c2cf8e076d6c3e1dac03993caa47f4bc5f787fb2b4d6a32c7da3dcdf3ae3682a9a779959d1eb88917

Download Submit
C:\Windows\System\AtiIbtN.exe

Filesize
2.1MB

MD5
316f3b7725d816c68c7a5642aa92c21c

SHA1
c4d483c3d9431081a22b8dc9e8c2ebed05e011f2

SHA256
0b20ea94f65926baee6b4fe505335432a3651caf97cbf46847aff564f192c35e

SHA512
f097b2abafc14696a28c6f53a58564ca0f008769e8cf8e69d3ae5a0e5786408baebad9e8e3c7f3945fc30974a06447126c9f1495954ab1a34c8fd0a1ed12e1d5

Download Submit
C:\Windows\System\BhMNwTf.exe

Filesize
2.1MB

MD5
9535d44b60daa79c0212541383f98e47

SHA1
56fd207433e3355040d185fba13599cda7b5b30e

SHA256
39f1ee8350146340591a30601d9605452d1432d67322368085db2055bbbefe55

SHA512
2c9e15f7ed914497e36934f21e3b234d7fe2fe4c5d0c267e04937dc9e667f40d77c649924b3aff28e5013bbabab6bcacddb74b9023d2632e124eb60b3d14c4a2

Download Submit
C:\Windows\System\DNSSRvM.exe

Filesize
2.1MB

MD5
ffeeac99dad08be792923d7f483c3e9b

SHA1
e13c9e29c4692e54bfa369f4b842b3aef908479f

SHA256
fca1788153010c41c2f30a9b664756287b70a80bc23c3fa68a2e4b86ecd4e424

SHA512
e4a87f22746036c5b72a018265428b5e2f1319f1507c2d166133e6bd29f0af1770dd0a86ad0b4cea6acf39c836706347656aa520c4d88092f3dfe9e16e780918

Download Submit
C:\Windows\System\DUWamjU.exe

Filesize
2.1MB

MD5
4f61d05f908b51f7ee4dcbbc2b1ee50a

SHA1
0568c8fb188939ca1e75ee2e3f55262d45b60847

SHA256
56b25d4d1e8f95bd9db3da76ffd5a0096f8aa4d5e91f79cdde39603bfabda9dd

SHA512
d84c0d4869d53f3ad584873e61f7b5e1da05253ba6b152a00ed4332dde8c552c781909bb539bd538663254c78a23318f940667fa327075ed0cbe8f0ef855f17e

Download Submit
C:\Windows\System\GFZgUmD.exe

Filesize
2.1MB

MD5
6e80d31105217c74b920324520ccb610

SHA1
6c622155cb6c1593440e6d03e90afc48b0497750

SHA256
b71ab6c1564dd91a6417c2434030359ff5e41906ee84f5c43112a6755e969a18

SHA512
724d3ca05aceddc04a711963c12d584d4d0198430bfa12f8a3c766e721bdec07d58e5caab0d6b63d8dc6155c5e4b0e8ec056c65d394937699586f6d01fb0c004

Download Submit
C:\Windows\System\IuwFJXo.exe

Filesize
2.1MB

MD5
daff6b119dc457f73a29c403dd9e6eba

SHA1
54d5a78cf28f5a12711aae2d8f09aa3758a87f89

SHA256
8f91aca8458beab6c7e3895ed81ed8c3d70641ea9385be11df16926fa7dd0f25

SHA512
473fed74ccf44f04d892b52ce5d032cdaceb6af91a335559d424aaff733ab98f4fb8822145eed345ca6d1803c59c580c797c137cb1bc1457b55e9354db9719e7

Download Submit
C:\Windows\System\JfLUEgO.exe

Filesize
8B

MD5
56dfc2f514c29abc0f7637c9a955b7d2

SHA1
ae4f9772e45bb1dee2f545529ca3e5d6bdd4dd65

SHA256
d458636957a00bb0d8a9759a3052bcc3b71650d32d60b24077d53884f0b19279

SHA512
cb24ecc705f756ecdc58fd78c8b8a6aa84beaf9becae76712e53e91e62d5881964bb4ebaee88647166240726139e4de421aa46f8ca7ebc7aaa10589a7d82f3d7

Download Submit
C:\Windows\System\JfxPvCn.exe

Filesize
2.1MB

MD5
a6b93ef84c59ea8e5414723b6b9d025d

SHA1
353ecd6719c1fb0283b6d3263050faceb79c72f4

SHA256
c7a2b1e61e950cece6d92931ffdcad4adccbac2b2a7f9b83bcc8221a9073265f

SHA512
157501886bf9a0db896bbf3872cac25700579de4fffffc7f54ed14f892673a55c0cd519b7b0e32b8457f6f160ee431730f482ca1166e5f9eb3a1c4146a440db5

Download Submit
C:\Windows\System\JiiVfhi.exe

Filesize
2.1MB

MD5
edaf2150f85bbda8dc0ac0d3c42ea200

SHA1
44452d3dbb47de246abc23d484827facb7f89250

SHA256
3c73d3f1bdcbfc5bfd0155c1cf7c5b5448ec9b69678ecae25678d596992dc47c

SHA512
19dacb490b2ab1a9869ca2bdc07deef6bfdc5ac8b38b92a154c25096238a30ede9709c5403825e880a33ef79ea563d5a268f8c263b53d9b5f8f271d41713d863

Download Submit
C:\Windows\System\KyzsGZR.exe

Filesize
2.1MB

MD5
2f510f05d97ec7de7e6a9d94e433468d

SHA1
8c7ac1e8e8b85e3f61ce47f8b820a7038bebd642

SHA256
0d9d8504334d6ff4732dba4390430e65fad90842341f7becff2b4dcd9890a462

SHA512
0b9acb8d18e1bd2ec0bf4e535168421bd9c5d79639b83d8d2270a59fea5bb9a781b4b366ecb0bd548c329430a55d08ea6cbb3a72b9d1e36352ae254b223c4f94

Download Submit
C:\Windows\System\NVqhTlx.exe

Filesize
2.1MB

MD5
863f899475772140bacae8fa9bddf24b

SHA1
edbfd2a57ea871b88b062e95bb1274e3dd3dcfd9

SHA256
52c85afde8756de5340cbbfcade83f431afe5ce601406aaf972bb7613e9a4f20

SHA512
8f69803e7d3f641385469da57006854e07595c2650ea2c3afb76c18d42803958d627ab468d218e2e07eb355b4d97a87b0d46da926b3eb70b7bb9a65767c3813a

Download Submit
C:\Windows\System\NouUktL.exe

Filesize
2.1MB

MD5
5811bae8b8960f1e95cafaf46db5c8c9

SHA1
4fc63849e526e85a3f08243cc199a9d4a32da8a1

SHA256
99dff42977c06d1f5159c1d02a3cdc2d147ab7168352971ebc89f85871314267

SHA512
bf311557f2aa2be05f09c3c3f1a86c468bd0a89e483a2ed2c342f1b922dde3b5ed89b2eb502f966d04047249592770ab05c38dfb133efbc65828b50771ef9ef7

Download Submit
C:\Windows\System\PPTpyPk.exe

Filesize
2.1MB

MD5
6db791c6d9af84ede992b5363f694c96

SHA1
3bca42c0d1b6151e6ade980feaaf2bbc893bcc41

SHA256
99a732a2ba56ecb7d67f2dbc80b90a6d31563ac99479c851c30d2c89fe14cb1e

SHA512
04d977fbba5fb2440f0294c64c733b95defe018dd3f6314324eaf211313152d56bc7dca1276c40806227261fc2c66a5d2e96d01b2e26b5b280ee63c7bb64d716

Download Submit
C:\Windows\System\PSBGgGG.exe

Filesize
2.1MB

MD5
93d99b13bcb87fb30e9b1581a9534d5c

SHA1
80ef3a7db980265d3fab3341ca3850b44f0f39b3

SHA256
4e19a0cdf668d3031eef9e564f4761491bc17c5fda42ac4f361976d2eb40ddbf

SHA512
928021676bf36051df40de5a9b551690e98b2b6d0e33148eea8f497ae19942f9a4a441d1ec8f6b377c836111bc96a19a496b8d21917ba4482fcb7f211f8036a9

Download Submit
C:\Windows\System\QRZJCQL.exe

Filesize
2.1MB

MD5
11386178f892c6b8e586d00db8660ce1

SHA1
88ea64a619ef4905f3fc83fe0bcee89aa712ba2f

SHA256
c50ae8fb17d96c25357199aaa4e820b457cfa5109405348f493bfeb45992777a

SHA512
49725a94cd31cbeba7df352d6424bf1adb9dafb1ec2b10894312d6d37ade332bdb4b3e92429d4df34fd6ec61a6f9953279cc837b85ac6247421b62c586a40d94

Download Submit
C:\Windows\System\QzcbACR.exe

Filesize
2.1MB

MD5
767a15ccccc12b5ee2c0a5fdbece2ec8

SHA1
0394f92f24f6786714d02a1a073feb7208eb71fa

SHA256
f04978cd8099189b1297d953b690cc6f36f4e16164a3f9a4f2195d5ca4e08a91

SHA512
1b7c08aacea829bc5a1483235ff1ad51bc97de89a333b20333bf75ba5a599d57dccfb30c7b6cb0a55031376a8ed10e478076b5ab1ed349f86e49976a7a6d989b

Download Submit
C:\Windows\System\SRmcgHF.exe

Filesize
2.1MB

MD5
82f80cc35f9f118cac95376bbdfcd728

SHA1
9df68bf5b172caf0cdb95600941bfce28c51b9f0

SHA256
01f413acc38eb413789295d2a97fefae84b19d5b25135a7bbcd391433a937bb3

SHA512
eac125bdc32dd01db508e6acd311d924faaa3cfed9bbac45341c4b444f4f52d2bea31b1d054962a9bea83c32316956b6e394401a4c620e8a3db664ecf1f8b41e

Download Submit
C:\Windows\System\SZnJHIY.exe

Filesize
2.1MB

MD5
a8920c987036377cb2fc89078532f36e

SHA1
6b107b396115547599a9f117175c68af1cf46759

SHA256
9427b58c6d7a39f9179bbee61fd856c8e56a2ba2455a3d0a56f4407df6d51403

SHA512
06d064bb7682953ba660aeb1889f2edfb2a446af5d3774189c6d52cf148cea16750671cf035877422966e9eb853719242b0a165fb1048667e6bb9ddab843db20

Download Submit
C:\Windows\System\TKjavth.exe

Filesize
2.1MB

MD5
c972857144055a13ebfb75398d3de092

SHA1
532b0dd20ac7088a0d3ee9bfd8247bdbd8dffa71

SHA256
5bf6135920060fd2ff172a547ca2d2ee5e6cbfc7f8889569313533eff56ad182

SHA512
b1ef5b3d50b27785dab046ca21bb4505825a0496582219620177a446cbea9f91195fa26bf8e287a89fff4b7e0b4b0ec98a0e585f2e775908d840f3dd179fdfa9

Download Submit
C:\Windows\System\TOQhmjo.exe

Filesize
2.1MB

MD5
aeb18a5a58c3bda543ff164491cad97b

SHA1
fadc15a3dcf1ff5476498aeaf4c7f0d836e02ea4

SHA256
b94b45391a65820d8faff32991207719a39b24d88e19b635d5a2ffc2c04604ff

SHA512
27c5dbcb0208e443ebc12f139fa237ccefeb029827cc7dd8f5a1cae21c344539d2704afe9b14a03a7b23e2c2ba1b68ba8edaeae02e524eb7c0eb8f950ab14e74

Download Submit
C:\Windows\System\VNYKHIy.exe

Filesize
2.1MB

MD5
e43bf6b872b70cd9cd560ecdcb858674

SHA1
ef5dc22d2f8a2dc97e81f3433db761e56fe00716

SHA256
eeb433a48038e53487e34bc12cc8bf224373e11ec6283b2eff6996873d9e1d10

SHA512
5b07b144685b8c6a79276b6bbe12d1bbb31e0b19df49da0ffc37ea00d4e605b78c56187c5e51d3f090d0a56cba657bcd323196c698783ca9968da4617c2d8de6

Download Submit
C:\Windows\System\XYdQmwW.exe

Filesize
2.1MB

MD5
5851ffad18257aea99aaf25153f61d0e

SHA1
ac919e811ee46ebb399e07312430283ad3e369c4

SHA256
80ea043181025643f15c68fc98de2c58159cbfcc2ef22bb0b492e4d382f0aeca

SHA512
5789bd39dc7f10eb0ff5bbf93f29f084a6c2d87a318de3e4ab2797a340c7bd3bd1264ef57fed5354efc3703fd5ddd063ec4db90d43554e0853e1774db6a26dbd

Download Submit
C:\Windows\System\ZupktkM.exe

Filesize
2.1MB

MD5
484e046d8c41d837f9e48fbc2ca62688

SHA1
1fe7e5c3745d7a947bc8e200a0e49efde9a88b32

SHA256
2047b3edd66eef0650f164ddec231b1368217918125779a29ab82aa2def0b67a

SHA512
8a0477aee9aa760cece091637d3bc0cf43d3756cb2d375955d10cd60b9da9eeb1f21565ef8701c950d731986ce6ec31e6f7e7317a8f1fa0026f8cf0dd6ed71ff

Download Submit
C:\Windows\System\asyrHyG.exe

Filesize
2.1MB

MD5
429d1563e65fa1756ac7891d73325021

SHA1
26e10b6a3a97fe0f8409d6bf8623512e346b4cc1

SHA256
4be4c3089aa9ec20562ab4c5d1b754e66593d453487ea3e24a7ec6a8bdb80802

SHA512
a8bb6d87f183aabb559391766c869bc0e742f7ed4a073f01760c2460b10664f05ec36252c759bebcfebf1eae2f60b6c760564977178fced42dc73773e47fab07

Download Submit
C:\Windows\System\ausUzDD.exe

Filesize
2.1MB

MD5
7221bf4f4479b23498b60b6df9871531

SHA1
61b3ab1ddf0b51d4904a6b87bbae366afb0ca19c

SHA256
ad8b5f69a1a0e6db56dd5286e24c7963ce60f29942c6d5fec2acb1f56cfe24a2

SHA512
98e19393cf2ea2e9e0f56e33e431e8114d10273b2c94687bb32a50c295298c1fe6e6190a926957b567d9dbf84ba50dd8ad755b08949c6074304d8fdd5ec5e4a4

Download Submit
C:\Windows\System\bnuVGcQ.exe

Filesize
2.1MB

MD5
da555e064008d4ee129ca6d52e05e559

SHA1
0100cb21e01424d959da826574c3991057ae5130

SHA256
2df5cfdfffb6cd2ce1555f346b723f48c06752baedf44369a274d70edee5fb30

SHA512
13c04b79391a183d3dd3c52ce60a4ccf28be06802befc88dd36293a659b58da31a76765bef9756c28e96fb07fcc0cbb5477c57f46022d3d6a9e0f0ba6d26483d

Download Submit
C:\Windows\System\dgKUWrw.exe

Filesize
2.1MB

MD5
a4d31072afdea37d94b39d33738bed36

SHA1
beca9585e6f5f58cc5bee4896843317c760f3df1

SHA256
0e76118926dbd85383067846e23e583d8e9ee7458cc1a72a4df0bb003b3ae269

SHA512
f54fac321904a588bfbaaf832c0c764df8aa95f36f17d2f97f649a9b49a5271041b49778711817a662649e048caca99d64e29a9ad26bc0a98293845709dd7af3

Download Submit
C:\Windows\System\etbqOGJ.exe

Filesize
2.1MB

MD5
ee8ba2037ed4e4261fc3225bf35521a6

SHA1
99a5321095de9aff6c83763cf1cde8224075dcb2

SHA256
da58e1ee74459cf439aec4747c345c72a954b62ada43a15d3564a30820177818

SHA512
f3a5eab0017af0b5434976c8e7ab566444c9f7a26d503ee077502850c73fea1aaf11b6118cf58da1b72dce067845a06f14784b296aac3b6cec4134fec647117a

Download Submit
C:\Windows\System\hHPHgSk.exe

Filesize
2.1MB

MD5
47c0badb586804deb0d67483fa6fc3f0

SHA1
74db5ae3414969dbc7085f303b179112ee2ee2e6

SHA256
481357fe5be391d6b2fdd31da37add7e9356956203113d8899563789a936271d

SHA512
2fc64332ea39afdc4cb466ec1140b29918de7ef8b482e25b8e44bd40015e48c0c3f9a93fdf490533ffe6d8e442a303d73e47eec038897a6c88f5d6f71dd4c8f3

Download Submit
C:\Windows\System\jCHRfZr.exe

Filesize
2.1MB

MD5
49f9448d7dac05630702bae37c640074

SHA1
3a1d8bd7c350b483c402f033abe96360059053ff

SHA256
e7d983a8dd29a5bcb4f41d8173c4cf107355752f45298b1210b72cf242bf6f7a

SHA512
c353b92278c18835fc6ad232577a2172154e824532b9a465de34ad5dfa7a59ad3deb6d66380177aac43cce15f0afdd76615b7a00394f979d398ff91e64a59c6b

Download Submit
C:\Windows\System\jSwCpcT.exe

Filesize
2.1MB

MD5
a56cfc5ee136272c0df746b54114db92

SHA1
9e9d4bd1d8868e2e205dc404ac7a6ba5975c0763

SHA256
c0e9c8c90e976f03899e05843c5f157e59b170c29f79695c0a4c2db3f8cac929

SHA512
d4dfb731325c68680d1bd948efc80448d21c12ddda5914a604fda673db56b3c95e4c4ba9b244cdc22b798636cb7bfa230689dc3dd9543115350f3bd9ed7998be

Download Submit
C:\Windows\System\jWPGIUA.exe

Filesize
2.1MB

MD5
1834615be73f046a5144d776f3858924

SHA1
d480e748b86ca0f89d6cbba65d148015fb18f2a0

SHA256
0acef045aeee2aa4926586b4b86d6719273c4ad8aed58a4701c7c1158830dd8c

SHA512
bd27620878d8f6780cdb29cdc025cbeabd5ce15e1f42f276588a8248275ff7f32d9c281615a3eae8c2019b11e24c15d05cc869aa25a16dc9f95e39e5e749e0b3

Download Submit
C:\Windows\System\maJeKnx.exe

Filesize
2.1MB

MD5
e7897dba893b269ec3b201c948f3c86e

SHA1
a50e7824fcf7d6ce7c711f3281f1a5cbc0d93d63

SHA256
035dc21c561e3c5307a61286ad444000c661bd9b73fb861ae777645f6b1837e9

SHA512
52f46cb1344d94e1d266b045c0ae7b562f3c020dfe950e13aba03f70c7d8180488e0180e124ba4b78eebbf535ed8a445203d740f0d3a3c1faed3c7dab5fb7a71

Download Submit
C:\Windows\System\omUTWKL.exe

Filesize
2.1MB

MD5
bfbb79b705fad558c6ea82c38ec03dd8

SHA1
775a7ee72ed8af30cd4c0a6e3a6876dc206e2400

SHA256
41795a6575b93d7fa4130af374c73a8dc5228498d2c8b4f7d87a239854ddd9aa

SHA512
b6e938bdd4531339cf5111e5ce3a42d02816b614114ada1cc4762907f6fc5c83989f616fe6cb42ea88401c9ec4e33da5827c5cfc6b5ab41a195951b40dc4b109

Download Submit
C:\Windows\System\tYYPbdO.exe

Filesize
2.1MB

MD5
7b11747f2bfbee0ebe2864e599c8d4e9

SHA1
71f5fd439b251818bac75698f9b5d3220c16b73a

SHA256
c8098a1efe65a7098b82c0e1c9b92f66fef8778329d8adf00195a567fc6f82ce

SHA512
9230f3611b6bb3a09893e58a155338f81be00d426c7c1cfbccefc6302e2eae101292eacb16daea512a981ba318616968193a763075b94f2c7b2d40d578182bf1

Download Submit
C:\Windows\System\vTDtlZf.exe

Filesize
2.1MB

MD5
4216d0d67254ff0b93525d200d0d22ee

SHA1
b862d3eac0ef28f72dbc19a747cd539eac6982ac

SHA256
129ae43b1b72e94d781a4eabdf54f58908b35162b9e22bcbe163293263febdc9

SHA512
bcc1b3eee846d596a9758b484c469a79f9269bd14edad28ded207714263002f5e9eee5ed63e4eae9da4394ee91a5c47836292ad7e328262f0253aa2bdc0e7cad

Download Submit
C:\Windows\System\wHcZrRj.exe

Filesize
2.1MB

MD5
6501d2419e18f74408c53d9a795f608a

SHA1
da7c10ffcc7efbeed303ddf8e5acb02543d79656

SHA256
fcbcb6f85d2d2d41f15b2a77e6d9aa944a315c907878f4f3e703496b69ead4a1

SHA512
795113fb84ba98ef6d827e890f259f30eb89626c27ad9c0cd8994b383868c18fb9b4bbdb2f116c94415387059742f7b719e2880c80fe16451552e2274d15c197

Download Submit
C:\Windows\System\zkpVNrj.exe

Filesize
2.1MB

MD5
f50bdf2f73f1a8d41a07ab87d02afc39

SHA1
b6ae2f4fd8cd43d3059ac77056d572b21b27ccd9

SHA256
41e2b6904b92ac404572d0846bf35dc24cf0b820a0cb55ae2f22453ce6a95182

SHA512
13e6290e07027f09e680a4d9f341d1f5d9cc0382bf38d82365216d57b1d352f29fe84ae8665641d487e9cf83ee08566304f203e83bf7ed0da646917f4d16713c

Download Submit
C:\Windows\System\zsHXWGO.exe

Filesize
2.1MB

MD5
668628c3d268bd47e3b8c3cf0ba557a3

SHA1
1836cab54d8d99c1197e30d1ebdf4b9a84ee5389

SHA256
6d0160f1b1c80718febf65309b7014682755772d64f66d8cfc493cf15f9ba7d2

SHA512
186912ac6db80a07f01b4b037091593d2a9ed11640ff816bb7c3001bbd0632f798678df65d9acd71f15d51c10b9d2ba19b80bd8efb47d0bdf4dc1ceb87bdb5a9

Download Submit
memory/396-474-0x00007FF7DAA30000-0x00007FF7DAE22000-memory.dmp

Filesize
3.9MB

Download
memory/396-3723-0x00007FF7DAA30000-0x00007FF7DAE22000-memory.dmp

Filesize
3.9MB

Download
memory/412-3743-0x00007FF6A2950000-0x00007FF6A2D42000-memory.dmp

Filesize
3.9MB

Download
memory/412-644-0x00007FF6A2950000-0x00007FF6A2D42000-memory.dmp

Filesize
3.9MB

Download
memory/892-775-0x00007FF7427E0000-0x00007FF742BD2000-memory.dmp

Filesize
3.9MB

Download
memory/892-3745-0x00007FF7427E0000-0x00007FF742BD2000-memory.dmp

Filesize
3.9MB

Download
memory/944-0-0x00007FF678560000-0x00007FF678952000-memory.dmp

Filesize
3.9MB

Download
memory/944-1-0x00000144107F0000-0x0000014410800000-memory.dmp

Filesize
64KB

Download
memory/1304-193-0x00007FF7AB850000-0x00007FF7ABC42000-memory.dmp

Filesize
3.9MB

Download
memory/1304-3709-0x00007FF7AB850000-0x00007FF7ABC42000-memory.dmp

Filesize
3.9MB

Download
memory/1528-897-0x00007FF7F8CB0000-0x00007FF7F90A2000-memory.dmp

Filesize
3.9MB

Download
memory/1528-3713-0x00007FF7F8CB0000-0x00007FF7F90A2000-memory.dmp

Filesize
3.9MB

Download
memory/1780-383-0x00007FF792B70000-0x00007FF792F62000-memory.dmp

Filesize
3.9MB

Download
memory/1780-3738-0x00007FF792B70000-0x00007FF792F62000-memory.dmp

Filesize
3.9MB

Download
memory/1848-3665-0x00007FF6BEC90000-0x00007FF6BF082000-memory.dmp

Filesize
3.9MB

Download
memory/1848-13-0x00007FF6BEC90000-0x00007FF6BF082000-memory.dmp

Filesize
3.9MB

Download
memory/1848-3700-0x00007FF6BEC90000-0x00007FF6BF082000-memory.dmp

Filesize
3.9MB

Download
memory/1860-436-0x00007FF76F410000-0x00007FF76F802000-memory.dmp

Filesize
3.9MB

Download
memory/1860-3736-0x00007FF76F410000-0x00007FF76F802000-memory.dmp

Filesize
3.9MB

Download
memory/1996-3779-0x00007FF6E9F40000-0x00007FF6EA332000-memory.dmp

Filesize
3.9MB

Download
memory/1996-951-0x00007FF6E9F40000-0x00007FF6EA332000-memory.dmp

Filesize
3.9MB

Download
memory/2092-3710-0x00007FF75EC00000-0x00007FF75EFF2000-memory.dmp

Filesize
3.9MB

Download
memory/2092-56-0x00007FF75EC00000-0x00007FF75EFF2000-memory.dmp

Filesize
3.9MB

Download
memory/2192-272-0x00007FF7B6550000-0x00007FF7B6942000-memory.dmp

Filesize
3.9MB

Download
memory/2192-3707-0x00007FF7B6550000-0x00007FF7B6942000-memory.dmp

Filesize
3.9MB

Download
memory/2260-3731-0x00007FF7B16E0000-0x00007FF7B1AD2000-memory.dmp

Filesize
3.9MB

Download
memory/2260-488-0x00007FF7B16E0000-0x00007FF7B1AD2000-memory.dmp

Filesize
3.9MB

Download
memory/2464-439-0x00007FF67D840000-0x00007FF67DC32000-memory.dmp

Filesize
3.9MB

Download
memory/2464-3735-0x00007FF67D840000-0x00007FF67DC32000-memory.dmp

Filesize
3.9MB

Download
memory/2760-22-0x00007FF745DC0000-0x00007FF7461B2000-memory.dmp

Filesize
3.9MB

Download
memory/2760-3666-0x00007FF745DC0000-0x00007FF7461B2000-memory.dmp

Filesize
3.9MB

Download
memory/2760-3702-0x00007FF745DC0000-0x00007FF7461B2000-memory.dmp

Filesize
3.9MB

Download
memory/3116-2053-0x0000023D6CDD0000-0x0000023D6D576000-memory.dmp

Filesize
7.6MB

Download
memory/3116-115-0x00007FFE3E830000-0x00007FFE3F2F1000-memory.dmp

Filesize
10.8MB

Download
memory/3116-23-0x0000023D6B700000-0x0000023D6B710000-memory.dmp

Filesize
64KB

Download
memory/3116-244-0x0000023D6BC20000-0x0000023D6BC42000-memory.dmp

Filesize
136KB

Download
memory/3116-24-0x00007FFE3E833000-0x00007FFE3E835000-memory.dmp

Filesize
8KB

Download
memory/3148-3733-0x00007FF742960000-0x00007FF742D52000-memory.dmp

Filesize
3.9MB

Download
memory/3148-886-0x00007FF742960000-0x00007FF742D52000-memory.dmp

Filesize
3.9MB

Download
memory/3760-3704-0x00007FF7902E0000-0x00007FF7906D2000-memory.dmp

Filesize
3.9MB

Download
memory/3760-212-0x00007FF7902E0000-0x00007FF7906D2000-memory.dmp

Filesize
3.9MB

Download
memory/4468-3717-0x00007FF783060000-0x00007FF783452000-memory.dmp

Filesize
3.9MB

Download
memory/4468-776-0x00007FF783060000-0x00007FF783452000-memory.dmp

Filesize
3.9MB

Download
memory/4596-892-0x00007FF6AE720000-0x00007FF6AEB12000-memory.dmp

Filesize
3.9MB

Download
memory/4596-3729-0x00007FF6AE720000-0x00007FF6AEB12000-memory.dmp

Filesize
3.9MB

Download
memory/4780-3727-0x00007FF65FA80000-0x00007FF65FE72000-memory.dmp

Filesize
3.9MB

Download
memory/4780-305-0x00007FF65FA80000-0x00007FF65FE72000-memory.dmp

Filesize
3.9MB

Download
memory/4872-707-0x00007FF718ED0000-0x00007FF7192C2000-memory.dmp

Filesize
3.9MB

Download
memory/4872-3719-0x00007FF718ED0000-0x00007FF7192C2000-memory.dmp

Filesize
3.9MB

Download
memory/4968-3741-0x00007FF7FC6A0000-0x00007FF7FCA92000-memory.dmp

Filesize
3.9MB

Download
memory/4968-823-0x00007FF7FC6A0000-0x00007FF7FCA92000-memory.dmp

Filesize
3.9MB

Download
memory/5004-826-0x00007FF67F380000-0x00007FF67F772000-memory.dmp

Filesize
3.9MB

Download
memory/5004-3715-0x00007FF67F380000-0x00007FF67F772000-memory.dmp

Filesize
3.9MB

Download
memory/5048-3721-0x00007FF627B90000-0x00007FF627F82000-memory.dmp

Filesize
3.9MB

Download
memory/5048-213-0x00007FF627B90000-0x00007FF627F82000-memory.dmp

Filesize
3.9MB

Download
memory/5060-339-0x00007FF72BD90000-0x00007FF72C182000-memory.dmp

Filesize
3.9MB

Download
memory/5060-3725-0x00007FF72BD90000-0x00007FF72C182000-memory.dmp

Filesize
3.9MB

Download