xmrig | 33a2dd41e13f06b54579974742fb5dd9b2387591fe7731d0e45b9fcd0e1ca31d

Analysis

max time kernel
33s
max time network
25s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 07:06

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
Size

2.1MB
MD5

1fd3cffbe69e2292b6300680de38a990
SHA1

f99a680e26b78a8c5aba1f873e0e60e727069a14
SHA256

33a2dd41e13f06b54579974742fb5dd9b2387591fe7731d0e45b9fcd0e1ca31d
SHA512

8ce5e85445c868c3303355b90eb4a804ddbc14f7b18ae18e376749c317b65f5c8d79f612521d9e8d3aa882b49960a88524c2f6be530f72844fab5a9383cf93f5
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafM4R:NABo

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 22 IoCs

miner

resource	yara_rule
behavioral2/memory/3116-183-0x00007FF6C5000000-0x00007FF6C53F2000-memory.dmp	xmrig
behavioral2/memory/1216-137-0x00007FF6B6510000-0x00007FF6B6902000-memory.dmp	xmrig
behavioral2/memory/1992-106-0x00007FF6091A0000-0x00007FF609592000-memory.dmp	xmrig
behavioral2/memory/4100-210-0x00007FF7C1510000-0x00007FF7C1902000-memory.dmp	xmrig
behavioral2/memory/4728-251-0x00007FF6108D0000-0x00007FF610CC2000-memory.dmp	xmrig
behavioral2/memory/3824-252-0x00007FF658450000-0x00007FF658842000-memory.dmp	xmrig
behavioral2/memory/1200-250-0x00007FF7CE0D0000-0x00007FF7CE4C2000-memory.dmp	xmrig
behavioral2/memory/2032-467-0x00007FF7E7840000-0x00007FF7E7C32000-memory.dmp	xmrig
behavioral2/memory/668-22-0x00007FF66EE10000-0x00007FF66F202000-memory.dmp	xmrig
behavioral2/memory/3264-1307-0x00007FF611590000-0x00007FF611982000-memory.dmp	xmrig
behavioral2/memory/1064-1121-0x00007FF65D200000-0x00007FF65D5F2000-memory.dmp	xmrig
behavioral2/memory/1760-1304-0x00007FF607480000-0x00007FF607872000-memory.dmp	xmrig
behavioral2/memory/5044-1669-0x00007FF668C10000-0x00007FF669002000-memory.dmp	xmrig
behavioral2/memory/1628-1672-0x00007FF7A8970000-0x00007FF7A8D62000-memory.dmp	xmrig
behavioral2/memory/4280-1671-0x00007FF7BA780000-0x00007FF7BAB72000-memory.dmp	xmrig
behavioral2/memory/2760-1522-0x00007FF7AE520000-0x00007FF7AE912000-memory.dmp	xmrig
behavioral2/memory/2016-1519-0x00007FF73DB50000-0x00007FF73DF42000-memory.dmp	xmrig
behavioral2/memory/4464-1516-0x00007FF760DC0000-0x00007FF7611B2000-memory.dmp	xmrig
behavioral2/memory/3936-1124-0x00007FF726710000-0x00007FF726B02000-memory.dmp	xmrig
behavioral2/memory/1828-649-0x00007FF652860000-0x00007FF652C52000-memory.dmp	xmrig
behavioral2/memory/4932-555-0x00007FF773DA0000-0x00007FF774192000-memory.dmp	xmrig
behavioral2/memory/5020-474-0x00007FF7C2210000-0x00007FF7C2602000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4440	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
668	spRMvUC.exe
4280	uiVCznP.exe
1628	OeYefXL.exe
1992	cQxXdQu.exe
1216	cHNNbSG.exe
3116	rlGaaWv.exe
4100	Naglqsx.exe
1200	mryNIWS.exe
4728	vsITGfB.exe
3824	YFimSJw.exe
2032	JQgXoVE.exe
5020	rlXFCNx.exe
4932	KylxTBN.exe
1828	wzXYtWY.exe
4916	UqBMcmv.exe
1064	HsLvEwK.exe
3936	SiiOObB.exe
1760	BchXVND.exe
3264	ngfJiXK.exe
4464	eLGtLMK.exe
4296	GpfTOgX.exe
2016	NapXIzK.exe
2760	hZGZRKE.exe
5044	oTkEzBF.exe
3464	qOTOOfX.exe
2056	hXAcnps.exe
1460	HGSoebT.exe
2948	zVOPwMF.exe
3212	IMWVjwH.exe
4420	TeHkisy.exe
2224	JEDwAJP.exe
2724	lHYVHFB.exe
4768	GZTaqJK.exe
4652	NZjXnjo.exe
1820	sIUYVOg.exe
4804	inHWjfU.exe
5048	arfACFf.exe
2556	KrDgrdB.exe
2604	OEQFVwV.exe
3096	PKhESTw.exe
2868	DMAYMMh.exe
2080	XbBRRtY.exe
3940	ZvMeFqx.exe
4724	hjCPWbD.exe
4024	zUPpxha.exe
3056	CZOmyDu.exe
4644	sKbMFEu.exe
3556	DroJGlH.exe
2560	TAieBRw.exe
2520	OqiMlmG.exe
4944	nyDeawv.exe
636	pyqUuEM.exe
3032	CaLHpRx.exe
4380	bIMMqiL.exe
1824	noOrldB.exe
4504	xZnYTCP.exe
4720	jMLNIpY.exe
1928	HvQZsVF.exe
2696	SVEgBNf.exe
2236	WheCyUL.exe
4340	FtOTmRl.exe
5012	bqHdDnu.exe
4896	OFxjqBR.exe
1072	VoDzQaH.exe

UPX packed file 62 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1620-0-0x00007FF65F280000-0x00007FF65F672000-memory.dmp	upx
behavioral2/files/0x000c000000023bbe-5.dat	upx
behavioral2/files/0x000a000000023bc3-8.dat	upx
behavioral2/files/0x000a000000023bc2-15.dat	upx
behavioral2/files/0x000a000000023bc6-35.dat	upx
behavioral2/files/0x000a000000023bcb-48.dat	upx
behavioral2/files/0x000a000000023bc9-97.dat	upx
behavioral2/files/0x000a000000023bd9-122.dat	upx
behavioral2/files/0x000a000000023bdb-124.dat	upx
behavioral2/memory/3116-183-0x00007FF6C5000000-0x00007FF6C53F2000-memory.dmp	upx
behavioral2/files/0x0009000000023bff-180.dat	upx
behavioral2/files/0x000a000000023bde-173.dat	upx
behavioral2/files/0x0008000000023bf9-172.dat	upx
behavioral2/files/0x000a000000023bd4-167.dat	upx
behavioral2/files/0x000a000000023bd3-163.dat	upx
behavioral2/files/0x000a000000023bd2-154.dat	upx
behavioral2/files/0x000b000000023be1-151.dat	upx
behavioral2/files/0x000b000000023be0-150.dat	upx
behavioral2/files/0x000a000000023bd1-144.dat	upx
behavioral2/files/0x000a000000023bd0-141.dat	upx
behavioral2/files/0x000b000000023bdf-140.dat	upx
behavioral2/memory/1216-137-0x00007FF6B6510000-0x00007FF6B6902000-memory.dmp	upx
behavioral2/files/0x000a000000023bce-130.dat	upx
behavioral2/files/0x000a000000023bdd-129.dat	upx
behavioral2/files/0x000a000000023bdc-128.dat	upx
behavioral2/files/0x000a000000023bcd-125.dat	upx
behavioral2/files/0x000a000000023bda-123.dat	upx
behavioral2/files/0x000a000000023be9-157.dat	upx
behavioral2/files/0x000a000000023bd8-119.dat	upx
behavioral2/files/0x000a000000023bd7-113.dat	upx
behavioral2/files/0x000a000000023bd6-112.dat	upx
behavioral2/files/0x000a000000023bcf-109.dat	upx
behavioral2/memory/1992-106-0x00007FF6091A0000-0x00007FF609592000-memory.dmp	upx
behavioral2/files/0x000a000000023bd5-133.dat	upx
behavioral2/files/0x000a000000023bcc-114.dat	upx
behavioral2/files/0x0009000000023c00-190.dat	upx
behavioral2/memory/4100-210-0x00007FF7C1510000-0x00007FF7C1902000-memory.dmp	upx
behavioral2/files/0x0008000000023c06-200.dat	upx
behavioral2/memory/4728-251-0x00007FF6108D0000-0x00007FF610CC2000-memory.dmp	upx
behavioral2/memory/3824-252-0x00007FF658450000-0x00007FF658842000-memory.dmp	upx
behavioral2/memory/1200-250-0x00007FF7CE0D0000-0x00007FF7CE4C2000-memory.dmp	upx
behavioral2/files/0x000e000000023c04-199.dat	upx
behavioral2/memory/2032-467-0x00007FF7E7840000-0x00007FF7E7C32000-memory.dmp	upx
behavioral2/files/0x000a000000023bca-65.dat	upx
behavioral2/files/0x000a000000023bc5-43.dat	upx
behavioral2/files/0x000a000000023bc8-58.dat	upx
behavioral2/files/0x000a000000023bc7-54.dat	upx
behavioral2/files/0x000a000000023bc4-39.dat	upx
behavioral2/memory/668-22-0x00007FF66EE10000-0x00007FF66F202000-memory.dmp	upx
behavioral2/memory/3264-1307-0x00007FF611590000-0x00007FF611982000-memory.dmp	upx
behavioral2/memory/1064-1121-0x00007FF65D200000-0x00007FF65D5F2000-memory.dmp	upx
behavioral2/memory/1760-1304-0x00007FF607480000-0x00007FF607872000-memory.dmp	upx
behavioral2/memory/5044-1669-0x00007FF668C10000-0x00007FF669002000-memory.dmp	upx
behavioral2/memory/1628-1672-0x00007FF7A8970000-0x00007FF7A8D62000-memory.dmp	upx
behavioral2/memory/4280-1671-0x00007FF7BA780000-0x00007FF7BAB72000-memory.dmp	upx
behavioral2/memory/2760-1522-0x00007FF7AE520000-0x00007FF7AE912000-memory.dmp	upx
behavioral2/memory/2016-1519-0x00007FF73DB50000-0x00007FF73DF42000-memory.dmp	upx
behavioral2/memory/4464-1516-0x00007FF760DC0000-0x00007FF7611B2000-memory.dmp	upx
behavioral2/memory/3936-1124-0x00007FF726710000-0x00007FF726B02000-memory.dmp	upx
behavioral2/memory/1828-649-0x00007FF652860000-0x00007FF652C52000-memory.dmp	upx
behavioral2/memory/4932-555-0x00007FF773DA0000-0x00007FF774192000-memory.dmp	upx
behavioral2/memory/5020-474-0x00007FF7C2210000-0x00007FF7C2602000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\NapXIzK.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\OTmHLuF.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\nROoGwO.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\BAVFjsC.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\JRlJTIB.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\foFEqjQ.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\CcEIFFP.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\pAHptkR.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\OrVihcQ.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\AnVJqPE.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\vNTqYhs.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\bdpLyOb.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\JcPXwmX.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\KIuZAbl.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\iHzoAAc.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\XspYUkJ.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\BSHWyaO.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\exSBRIE.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\ATjVrty.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\oEaezeM.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\xSUDzLw.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\LsNtsAm.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\bqHdDnu.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\yrGZUGi.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\TzlfjMV.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\vlrniim.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\HVMsCdG.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\vuQzSvV.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\ZDNxlRH.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\vlmhrXx.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\vJxhoii.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\DLkFQmf.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\UAwlBut.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\GsyYeMW.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\wPljKHu.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\NpPRFeB.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\ATkulyH.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\eeopKHe.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\qzflkwb.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\AfSqTrF.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\qTZBTto.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\mvGpGES.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\JNvKPXn.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\MPzXJIj.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\GhXKfUz.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\SkuDcBY.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\FvqZAbD.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\zPGmyPm.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\qWmjZNG.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\BRXhHIk.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\vyRzQnA.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\gncaSXG.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\yYOumQI.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\qhJOXZz.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\ouPuLxr.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\gJHGAEz.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\nkVLcdQ.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\xTddMvV.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\mriClSn.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\nPfIppo.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\WypICbM.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\UFkhZKK.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\fxQGaQz.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\rjdGiyy.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4440	powershell.exe
4440	powershell.exe
4440	powershell.exe
4440	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
Token: SeDebugPrivilege	4440	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 4440	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	85
PID 1620 wrote to memory of 4440	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	85
PID 1620 wrote to memory of 668	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	86
PID 1620 wrote to memory of 668	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	86
PID 1620 wrote to memory of 4280	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	87
PID 1620 wrote to memory of 4280	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	87
PID 1620 wrote to memory of 1628	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	88
PID 1620 wrote to memory of 1628	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	88
PID 1620 wrote to memory of 1992	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	89
PID 1620 wrote to memory of 1992	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	89
PID 1620 wrote to memory of 1216	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	90
PID 1620 wrote to memory of 1216	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	90
PID 1620 wrote to memory of 3116	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	91
PID 1620 wrote to memory of 3116	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	91
PID 1620 wrote to memory of 4100	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	92
PID 1620 wrote to memory of 4100	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	92
PID 1620 wrote to memory of 1200	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	93
PID 1620 wrote to memory of 1200	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	93
PID 1620 wrote to memory of 4728	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	94
PID 1620 wrote to memory of 4728	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	94
PID 1620 wrote to memory of 3824	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	95
PID 1620 wrote to memory of 3824	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	95
PID 1620 wrote to memory of 2032	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	96
PID 1620 wrote to memory of 2032	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	96
PID 1620 wrote to memory of 5020	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	97
PID 1620 wrote to memory of 5020	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	97
PID 1620 wrote to memory of 4932	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	98
PID 1620 wrote to memory of 4932	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	98
PID 1620 wrote to memory of 1828	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	99
PID 1620 wrote to memory of 1828	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	99
PID 1620 wrote to memory of 4916	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	100
PID 1620 wrote to memory of 4916	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	100
PID 1620 wrote to memory of 1064	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	101
PID 1620 wrote to memory of 1064	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	101
PID 1620 wrote to memory of 3936	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	102
PID 1620 wrote to memory of 3936	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	102
PID 1620 wrote to memory of 1760	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	103
PID 1620 wrote to memory of 1760	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	103
PID 1620 wrote to memory of 3264	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	104
PID 1620 wrote to memory of 3264	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	104
PID 1620 wrote to memory of 4464	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	105
PID 1620 wrote to memory of 4464	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	105
PID 1620 wrote to memory of 3212	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	106
PID 1620 wrote to memory of 3212	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	106
PID 1620 wrote to memory of 4296	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	107
PID 1620 wrote to memory of 4296	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	107
PID 1620 wrote to memory of 2016	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	108
PID 1620 wrote to memory of 2016	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	108
PID 1620 wrote to memory of 2760	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	109
PID 1620 wrote to memory of 2760	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	109
PID 1620 wrote to memory of 5044	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	110
PID 1620 wrote to memory of 5044	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	110
PID 1620 wrote to memory of 3464	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	111
PID 1620 wrote to memory of 3464	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	111
PID 1620 wrote to memory of 2056	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	112
PID 1620 wrote to memory of 2056	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	112
PID 1620 wrote to memory of 1460	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	113
PID 1620 wrote to memory of 1460	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	113
PID 1620 wrote to memory of 2948	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	114
PID 1620 wrote to memory of 2948	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	114
PID 1620 wrote to memory of 4420	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	115
PID 1620 wrote to memory of 4420	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	115
PID 1620 wrote to memory of 2224	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	116
PID 1620 wrote to memory of 2224	1620	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4440
- C:\Windows\System\spRMvUC.exe
  C:\Windows\System\spRMvUC.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\uiVCznP.exe
  C:\Windows\System\uiVCznP.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\OeYefXL.exe
  C:\Windows\System\OeYefXL.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\cQxXdQu.exe
  C:\Windows\System\cQxXdQu.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\cHNNbSG.exe
  C:\Windows\System\cHNNbSG.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\rlGaaWv.exe
  C:\Windows\System\rlGaaWv.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\Naglqsx.exe
  C:\Windows\System\Naglqsx.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\mryNIWS.exe
  C:\Windows\System\mryNIWS.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\vsITGfB.exe
  C:\Windows\System\vsITGfB.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\YFimSJw.exe
  C:\Windows\System\YFimSJw.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\JQgXoVE.exe
  C:\Windows\System\JQgXoVE.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\rlXFCNx.exe
  C:\Windows\System\rlXFCNx.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\KylxTBN.exe
  C:\Windows\System\KylxTBN.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\wzXYtWY.exe
  C:\Windows\System\wzXYtWY.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\UqBMcmv.exe
  C:\Windows\System\UqBMcmv.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\HsLvEwK.exe
  C:\Windows\System\HsLvEwK.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\SiiOObB.exe
  C:\Windows\System\SiiOObB.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System\BchXVND.exe
  C:\Windows\System\BchXVND.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\ngfJiXK.exe
  C:\Windows\System\ngfJiXK.exe
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Windows\System\eLGtLMK.exe
  C:\Windows\System\eLGtLMK.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\IMWVjwH.exe
  C:\Windows\System\IMWVjwH.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\GpfTOgX.exe
  C:\Windows\System\GpfTOgX.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\NapXIzK.exe
  C:\Windows\System\NapXIzK.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\hZGZRKE.exe
  C:\Windows\System\hZGZRKE.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\oTkEzBF.exe
  C:\Windows\System\oTkEzBF.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\qOTOOfX.exe
  C:\Windows\System\qOTOOfX.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\hXAcnps.exe
  C:\Windows\System\hXAcnps.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\HGSoebT.exe
  C:\Windows\System\HGSoebT.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\zVOPwMF.exe
  C:\Windows\System\zVOPwMF.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\TeHkisy.exe
  C:\Windows\System\TeHkisy.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\JEDwAJP.exe
  C:\Windows\System\JEDwAJP.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\lHYVHFB.exe
  C:\Windows\System\lHYVHFB.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\GZTaqJK.exe
  C:\Windows\System\GZTaqJK.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\NZjXnjo.exe
  C:\Windows\System\NZjXnjo.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\ZvMeFqx.exe
  C:\Windows\System\ZvMeFqx.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\sIUYVOg.exe
  C:\Windows\System\sIUYVOg.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\CZOmyDu.exe
  C:\Windows\System\CZOmyDu.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\inHWjfU.exe
  C:\Windows\System\inHWjfU.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\arfACFf.exe
  C:\Windows\System\arfACFf.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\nyDeawv.exe
  C:\Windows\System\nyDeawv.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\KrDgrdB.exe
  C:\Windows\System\KrDgrdB.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\OEQFVwV.exe
  C:\Windows\System\OEQFVwV.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\PKhESTw.exe
  C:\Windows\System\PKhESTw.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\DMAYMMh.exe
  C:\Windows\System\DMAYMMh.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\XbBRRtY.exe
  C:\Windows\System\XbBRRtY.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\hjCPWbD.exe
  C:\Windows\System\hjCPWbD.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\zUPpxha.exe
  C:\Windows\System\zUPpxha.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\sKbMFEu.exe
  C:\Windows\System\sKbMFEu.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\DroJGlH.exe
  C:\Windows\System\DroJGlH.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\TAieBRw.exe
  C:\Windows\System\TAieBRw.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\OqiMlmG.exe
  C:\Windows\System\OqiMlmG.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\pyqUuEM.exe
  C:\Windows\System\pyqUuEM.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\CaLHpRx.exe
  C:\Windows\System\CaLHpRx.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\bIMMqiL.exe
  C:\Windows\System\bIMMqiL.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\noOrldB.exe
  C:\Windows\System\noOrldB.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\FtOTmRl.exe
  C:\Windows\System\FtOTmRl.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\xZnYTCP.exe
  C:\Windows\System\xZnYTCP.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\jMLNIpY.exe
  C:\Windows\System\jMLNIpY.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\RAkRvLK.exe
  C:\Windows\System\RAkRvLK.exe
  2⤵
  PID:4372
- C:\Windows\System\KabNDRt.exe
  C:\Windows\System\KabNDRt.exe
  2⤵
  PID:1424
- C:\Windows\System\bzzBsMs.exe
  C:\Windows\System\bzzBsMs.exe
  2⤵
  PID:2324
- C:\Windows\System\JAEzFvJ.exe
  C:\Windows\System\JAEzFvJ.exe
  2⤵
  PID:4948
- C:\Windows\System\HvQZsVF.exe
  C:\Windows\System\HvQZsVF.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\SVEgBNf.exe
  C:\Windows\System\SVEgBNf.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\WheCyUL.exe
  C:\Windows\System\WheCyUL.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\bqHdDnu.exe
  C:\Windows\System\bqHdDnu.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\OFxjqBR.exe
  C:\Windows\System\OFxjqBR.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\VoDzQaH.exe
  C:\Windows\System\VoDzQaH.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\VQkamoP.exe
  C:\Windows\System\VQkamoP.exe
  2⤵
  PID:4016
- C:\Windows\System\uQZsnnT.exe
  C:\Windows\System\uQZsnnT.exe
  2⤵
  PID:3716
- C:\Windows\System\rzNxsTR.exe
  C:\Windows\System\rzNxsTR.exe
  2⤵
  PID:3548
- C:\Windows\System\AaYIgmz.exe
  C:\Windows\System\AaYIgmz.exe
  2⤵
  PID:4936
- C:\Windows\System\wCYxHpi.exe
  C:\Windows\System\wCYxHpi.exe
  2⤵
  PID:2312
- C:\Windows\System\HGIioRA.exe
  C:\Windows\System\HGIioRA.exe
  2⤵
  PID:664
- C:\Windows\System\iUDAomu.exe
  C:\Windows\System\iUDAomu.exe
  2⤵
  PID:1612
- C:\Windows\System\XPFUQBQ.exe
  C:\Windows\System\XPFUQBQ.exe
  2⤵
  PID:1832
- C:\Windows\System\uvliFKo.exe
  C:\Windows\System\uvliFKo.exe
  2⤵
  PID:4852
- C:\Windows\System\UgXMrkE.exe
  C:\Windows\System\UgXMrkE.exe
  2⤵
  PID:4636
- C:\Windows\System\BTeRill.exe
  C:\Windows\System\BTeRill.exe
  2⤵
  PID:2284
- C:\Windows\System\ffdECad.exe
  C:\Windows\System\ffdECad.exe
  2⤵
  PID:3616
- C:\Windows\System\DjBAHXM.exe
  C:\Windows\System\DjBAHXM.exe
  2⤵
  PID:4520
- C:\Windows\System\pXxIUHw.exe
  C:\Windows\System\pXxIUHw.exe
  2⤵
  PID:2844
- C:\Windows\System\wUtOoEh.exe
  C:\Windows\System\wUtOoEh.exe
  2⤵
  PID:3828
- C:\Windows\System\HfhaOYo.exe
  C:\Windows\System\HfhaOYo.exe
  2⤵
  PID:4396
- C:\Windows\System\rsbDrjt.exe
  C:\Windows\System\rsbDrjt.exe
  2⤵
  PID:3352
- C:\Windows\System\HVMsCdG.exe
  C:\Windows\System\HVMsCdG.exe
  2⤵
  PID:716
- C:\Windows\System\yclnFfu.exe
  C:\Windows\System\yclnFfu.exe
  2⤵
  PID:3304
- C:\Windows\System\bobGNQs.exe
  C:\Windows\System\bobGNQs.exe
  2⤵
  PID:4640
- C:\Windows\System\wTmGcXx.exe
  C:\Windows\System\wTmGcXx.exe
  2⤵
  PID:964
- C:\Windows\System\hrYccKD.exe
  C:\Windows\System\hrYccKD.exe
  2⤵
  PID:3524
- C:\Windows\System\VbqcjqS.exe
  C:\Windows\System\VbqcjqS.exe
  2⤵
  PID:3440
- C:\Windows\System\HbeycPJ.exe
  C:\Windows\System\HbeycPJ.exe
  2⤵
  PID:1140
- C:\Windows\System\OpIRAPv.exe
  C:\Windows\System\OpIRAPv.exe
  2⤵
  PID:3288
- C:\Windows\System\uRaEgWw.exe
  C:\Windows\System\uRaEgWw.exe
  2⤵
  PID:3712
- C:\Windows\System\hpJMtLA.exe
  C:\Windows\System\hpJMtLA.exe
  2⤵
  PID:4824
- C:\Windows\System\vojOwIG.exe
  C:\Windows\System\vojOwIG.exe
  2⤵
  PID:5136
- C:\Windows\System\sRSVwGV.exe
  C:\Windows\System\sRSVwGV.exe
  2⤵
  PID:5156
- C:\Windows\System\OZHDkQJ.exe
  C:\Windows\System\OZHDkQJ.exe
  2⤵
  PID:5180
- C:\Windows\System\pCbomFb.exe
  C:\Windows\System\pCbomFb.exe
  2⤵
  PID:5200
- C:\Windows\System\sRQsgZM.exe
  C:\Windows\System\sRQsgZM.exe
  2⤵
  PID:5220
- C:\Windows\System\ZkCensQ.exe
  C:\Windows\System\ZkCensQ.exe
  2⤵
  PID:5324
- C:\Windows\System\PyQjUSP.exe
  C:\Windows\System\PyQjUSP.exe
  2⤵
  PID:5344
- C:\Windows\System\IlUPCWE.exe
  C:\Windows\System\IlUPCWE.exe
  2⤵
  PID:5368
- C:\Windows\System\pydeTuo.exe
  C:\Windows\System\pydeTuo.exe
  2⤵
  PID:5396
- C:\Windows\System\svmcpFW.exe
  C:\Windows\System\svmcpFW.exe
  2⤵
  PID:5420
- C:\Windows\System\vwZMHgz.exe
  C:\Windows\System\vwZMHgz.exe
  2⤵
  PID:5456
- C:\Windows\System\hcsQQdT.exe
  C:\Windows\System\hcsQQdT.exe
  2⤵
  PID:5516
- C:\Windows\System\kdxctLc.exe
  C:\Windows\System\kdxctLc.exe
  2⤵
  PID:5536
- C:\Windows\System\DVnDLPa.exe
  C:\Windows\System\DVnDLPa.exe
  2⤵
  PID:5560
- C:\Windows\System\FttsiEa.exe
  C:\Windows\System\FttsiEa.exe
  2⤵
  PID:5580
- C:\Windows\System\LERymMn.exe
  C:\Windows\System\LERymMn.exe
  2⤵
  PID:5600
- C:\Windows\System\CPxxmdO.exe
  C:\Windows\System\CPxxmdO.exe
  2⤵
  PID:5628
- C:\Windows\System\jMxfIBd.exe
  C:\Windows\System\jMxfIBd.exe
  2⤵
  PID:5648
- C:\Windows\System\TLfAxoE.exe
  C:\Windows\System\TLfAxoE.exe
  2⤵
  PID:5676
- C:\Windows\System\TjeKrNQ.exe
  C:\Windows\System\TjeKrNQ.exe
  2⤵
  PID:5692
- C:\Windows\System\FRWUiRM.exe
  C:\Windows\System\FRWUiRM.exe
  2⤵
  PID:5716
- C:\Windows\System\TMwUFfh.exe
  C:\Windows\System\TMwUFfh.exe
  2⤵
  PID:5732
- C:\Windows\System\PIaAtEo.exe
  C:\Windows\System\PIaAtEo.exe
  2⤵
  PID:5752
- C:\Windows\System\IYdSFXl.exe
  C:\Windows\System\IYdSFXl.exe
  2⤵
  PID:5776
- C:\Windows\System\HUhxaMl.exe
  C:\Windows\System\HUhxaMl.exe
  2⤵
  PID:5796
- C:\Windows\System\WPZAWKj.exe
  C:\Windows\System\WPZAWKj.exe
  2⤵
  PID:5816
- C:\Windows\System\wEMuKvm.exe
  C:\Windows\System\wEMuKvm.exe
  2⤵
  PID:5844
- C:\Windows\System\bvmgmWU.exe
  C:\Windows\System\bvmgmWU.exe
  2⤵
  PID:5864
- C:\Windows\System\zIHqswT.exe
  C:\Windows\System\zIHqswT.exe
  2⤵
  PID:5888
- C:\Windows\System\igAApBq.exe
  C:\Windows\System\igAApBq.exe
  2⤵
  PID:5912
- C:\Windows\System\NoCRsMX.exe
  C:\Windows\System\NoCRsMX.exe
  2⤵
  PID:5928
- C:\Windows\System\tvYRhXc.exe
  C:\Windows\System\tvYRhXc.exe
  2⤵
  PID:5952
- C:\Windows\System\qknFMHF.exe
  C:\Windows\System\qknFMHF.exe
  2⤵
  PID:5976
- C:\Windows\System\XMzxcqB.exe
  C:\Windows\System\XMzxcqB.exe
  2⤵
  PID:5992
- C:\Windows\System\gPtSQiz.exe
  C:\Windows\System\gPtSQiz.exe
  2⤵
  PID:6020
- C:\Windows\System\SFDegZG.exe
  C:\Windows\System\SFDegZG.exe
  2⤵
  PID:6036
- C:\Windows\System\HZBXmud.exe
  C:\Windows\System\HZBXmud.exe
  2⤵
  PID:6060
- C:\Windows\System\iOhqxpr.exe
  C:\Windows\System\iOhqxpr.exe
  2⤵
  PID:6084
- C:\Windows\System\enrlbOg.exe
  C:\Windows\System\enrlbOg.exe
  2⤵
  PID:6104
- C:\Windows\System\aaFWpfW.exe
  C:\Windows\System\aaFWpfW.exe
  2⤵
  PID:6124
- C:\Windows\System\WzcCeBI.exe
  C:\Windows\System\WzcCeBI.exe
  2⤵
  PID:4348
- C:\Windows\System\yEOPvUI.exe
  C:\Windows\System\yEOPvUI.exe
  2⤵
  PID:4108
- C:\Windows\System\GdxwkJX.exe
  C:\Windows\System\GdxwkJX.exe
  2⤵
  PID:4484
- C:\Windows\System\lWaXVzy.exe
  C:\Windows\System\lWaXVzy.exe
  2⤵
  PID:5168
- C:\Windows\System\dVZKaiP.exe
  C:\Windows\System\dVZKaiP.exe
  2⤵
  PID:5188
- C:\Windows\System\ulmYvmG.exe
  C:\Windows\System\ulmYvmG.exe
  2⤵
  PID:5000
- C:\Windows\System\hwZcozT.exe
  C:\Windows\System\hwZcozT.exe
  2⤵
  PID:2292
- C:\Windows\System\EKqjTUo.exe
  C:\Windows\System\EKqjTUo.exe
  2⤵
  PID:3164
- C:\Windows\System\fiMrlDz.exe
  C:\Windows\System\fiMrlDz.exe
  2⤵
  PID:4120
- C:\Windows\System\yjbhkUo.exe
  C:\Windows\System\yjbhkUo.exe
  2⤵
  PID:2752
- C:\Windows\System\ogBnVLc.exe
  C:\Windows\System\ogBnVLc.exe
  2⤵
  PID:4432
- C:\Windows\System\RSDsSZT.exe
  C:\Windows\System\RSDsSZT.exe
  2⤵
  PID:3444
- C:\Windows\System\SiWjyNS.exe
  C:\Windows\System\SiWjyNS.exe
  2⤵
  PID:5656
- C:\Windows\System\mEUjptz.exe
  C:\Windows\System\mEUjptz.exe
  2⤵
  PID:5196
- C:\Windows\System\ShvBFTh.exe
  C:\Windows\System\ShvBFTh.exe
  2⤵
  PID:5316
- C:\Windows\System\RZMUPLa.exe
  C:\Windows\System\RZMUPLa.exe
  2⤵
  PID:5356
- C:\Windows\System\QsUZGRP.exe
  C:\Windows\System\QsUZGRP.exe
  2⤵
  PID:5388
- C:\Windows\System\dyjcoja.exe
  C:\Windows\System\dyjcoja.exe
  2⤵
  PID:6068
- C:\Windows\System\QKNUJBi.exe
  C:\Windows\System\QKNUJBi.exe
  2⤵
  PID:3836
- C:\Windows\System\BZsNsNy.exe
  C:\Windows\System\BZsNsNy.exe
  2⤵
  PID:5568
- C:\Windows\System\luZNywz.exe
  C:\Windows\System\luZNywz.exe
  2⤵
  PID:5588
- C:\Windows\System\FKPZahA.exe
  C:\Windows\System\FKPZahA.exe
  2⤵
  PID:5784
- C:\Windows\System\naHcZyr.exe
  C:\Windows\System\naHcZyr.exe
  2⤵
  PID:2296
- C:\Windows\System\zKzpOah.exe
  C:\Windows\System\zKzpOah.exe
  2⤵
  PID:5920
- C:\Windows\System\BSHWyaO.exe
  C:\Windows\System\BSHWyaO.exe
  2⤵
  PID:6116
- C:\Windows\System\XYEEuQF.exe
  C:\Windows\System\XYEEuQF.exe
  2⤵
  PID:5812
- C:\Windows\System\DjTyfUm.exe
  C:\Windows\System\DjTyfUm.exe
  2⤵
  PID:6000
- C:\Windows\System\xXTwMvr.exe
  C:\Windows\System\xXTwMvr.exe
  2⤵
  PID:6164
- C:\Windows\System\RQarqCw.exe
  C:\Windows\System\RQarqCw.exe
  2⤵
  PID:6188
- C:\Windows\System\cxThJFB.exe
  C:\Windows\System\cxThJFB.exe
  2⤵
  PID:6204
- C:\Windows\System\eszRkJy.exe
  C:\Windows\System\eszRkJy.exe
  2⤵
  PID:6224
- C:\Windows\System\wOvlVRx.exe
  C:\Windows\System\wOvlVRx.exe
  2⤵
  PID:6248
- C:\Windows\System\ToOAhzv.exe
  C:\Windows\System\ToOAhzv.exe
  2⤵
  PID:6264
- C:\Windows\System\neTIoWY.exe
  C:\Windows\System\neTIoWY.exe
  2⤵
  PID:6288
- C:\Windows\System\IlAhJnD.exe
  C:\Windows\System\IlAhJnD.exe
  2⤵
  PID:6316
- C:\Windows\System\rEXKwdh.exe
  C:\Windows\System\rEXKwdh.exe
  2⤵
  PID:6332
- C:\Windows\System\rkxRxKP.exe
  C:\Windows\System\rkxRxKP.exe
  2⤵
  PID:6356
- C:\Windows\System\SXaOuVM.exe
  C:\Windows\System\SXaOuVM.exe
  2⤵
  PID:6380
- C:\Windows\System\PLDzxGy.exe
  C:\Windows\System\PLDzxGy.exe
  2⤵
  PID:6396
- C:\Windows\System\RHygEpQ.exe
  C:\Windows\System\RHygEpQ.exe
  2⤵
  PID:6420
- C:\Windows\System\cJgXISK.exe
  C:\Windows\System\cJgXISK.exe
  2⤵
  PID:6440
- C:\Windows\System\pEwUlfn.exe
  C:\Windows\System\pEwUlfn.exe
  2⤵
  PID:6460
- C:\Windows\System\GkeciaT.exe
  C:\Windows\System\GkeciaT.exe
  2⤵
  PID:6480
- C:\Windows\System\QpqpSfN.exe
  C:\Windows\System\QpqpSfN.exe
  2⤵
  PID:6504
- C:\Windows\System\ugUhdiQ.exe
  C:\Windows\System\ugUhdiQ.exe
  2⤵
  PID:6524
- C:\Windows\System\oPOzyMv.exe
  C:\Windows\System\oPOzyMv.exe
  2⤵
  PID:6548
- C:\Windows\System\gznRobh.exe
  C:\Windows\System\gznRobh.exe
  2⤵
  PID:6568
- C:\Windows\System\DPTsQrS.exe
  C:\Windows\System\DPTsQrS.exe
  2⤵
  PID:6584
- C:\Windows\System\whRtIvX.exe
  C:\Windows\System\whRtIvX.exe
  2⤵
  PID:6604
- C:\Windows\System\JAZAYAA.exe
  C:\Windows\System\JAZAYAA.exe
  2⤵
  PID:6624
- C:\Windows\System\tadaBNK.exe
  C:\Windows\System\tadaBNK.exe
  2⤵
  PID:6652
- C:\Windows\System\ZHBQGya.exe
  C:\Windows\System\ZHBQGya.exe
  2⤵
  PID:6672
- C:\Windows\System\BhROAbu.exe
  C:\Windows\System\BhROAbu.exe
  2⤵
  PID:6692
- C:\Windows\System\AZtJkMS.exe
  C:\Windows\System\AZtJkMS.exe
  2⤵
  PID:6708
- C:\Windows\System\OvPrvWP.exe
  C:\Windows\System\OvPrvWP.exe
  2⤵
  PID:6736
- C:\Windows\System\ZTmaJLz.exe
  C:\Windows\System\ZTmaJLz.exe
  2⤵
  PID:6768
- C:\Windows\System\mlbPFdu.exe
  C:\Windows\System\mlbPFdu.exe
  2⤵
  PID:6792
- C:\Windows\System\lDOMewv.exe
  C:\Windows\System\lDOMewv.exe
  2⤵
  PID:6812
- C:\Windows\System\sVDinMO.exe
  C:\Windows\System\sVDinMO.exe
  2⤵
  PID:6832
- C:\Windows\System\GndrDFu.exe
  C:\Windows\System\GndrDFu.exe
  2⤵
  PID:6860
- C:\Windows\System\UIFWEbo.exe
  C:\Windows\System\UIFWEbo.exe
  2⤵
  PID:6884
- C:\Windows\System\TpWQPph.exe
  C:\Windows\System\TpWQPph.exe
  2⤵
  PID:6904
- C:\Windows\System\sNYHLCe.exe
  C:\Windows\System\sNYHLCe.exe
  2⤵
  PID:6928
- C:\Windows\System\adsyClw.exe
  C:\Windows\System\adsyClw.exe
  2⤵
  PID:6952
- C:\Windows\System\QdElRvK.exe
  C:\Windows\System\QdElRvK.exe
  2⤵
  PID:6980
- C:\Windows\System\GMfRvwS.exe
  C:\Windows\System\GMfRvwS.exe
  2⤵
  PID:7012
- C:\Windows\System\BUYECrR.exe
  C:\Windows\System\BUYECrR.exe
  2⤵
  PID:7028
- C:\Windows\System\ZsBEAjd.exe
  C:\Windows\System\ZsBEAjd.exe
  2⤵
  PID:7044
- C:\Windows\System\laotwrv.exe
  C:\Windows\System\laotwrv.exe
  2⤵
  PID:7068
- C:\Windows\System\FkjNgRz.exe
  C:\Windows\System\FkjNgRz.exe
  2⤵
  PID:7100
- C:\Windows\System\caCQxoE.exe
  C:\Windows\System\caCQxoE.exe
  2⤵
  PID:7120
- C:\Windows\System\NVAFkVo.exe
  C:\Windows\System\NVAFkVo.exe
  2⤵
  PID:7144
- C:\Windows\System\bTjtSrD.exe
  C:\Windows\System\bTjtSrD.exe
  2⤵
  PID:7160
- C:\Windows\System\TKAHtGt.exe
  C:\Windows\System\TKAHtGt.exe
  2⤵
  PID:5688
- C:\Windows\System\sxKscXK.exe
  C:\Windows\System\sxKscXK.exe
  2⤵
  PID:2276
- C:\Windows\System\iAFVbcb.exe
  C:\Windows\System\iAFVbcb.exe
  2⤵
  PID:5772
- C:\Windows\System\CYNbNMF.exe
  C:\Windows\System\CYNbNMF.exe
  2⤵
  PID:5668
- C:\Windows\System\wVCFtVL.exe
  C:\Windows\System\wVCFtVL.exe
  2⤵
  PID:1660
- C:\Windows\System\yziGUSZ.exe
  C:\Windows\System\yziGUSZ.exe
  2⤵
  PID:5872
- C:\Windows\System\BOtEgJX.exe
  C:\Windows\System\BOtEgJX.exe
  2⤵
  PID:5936
- C:\Windows\System\BNbCgZB.exe
  C:\Windows\System\BNbCgZB.exe
  2⤵
  PID:5984
- C:\Windows\System\hoPCMDf.exe
  C:\Windows\System\hoPCMDf.exe
  2⤵
  PID:5964
- C:\Windows\System\WeObLGz.exe
  C:\Windows\System\WeObLGz.exe
  2⤵
  PID:6176
- C:\Windows\System\kHjZsQY.exe
  C:\Windows\System\kHjZsQY.exe
  2⤵
  PID:6080
- C:\Windows\System\jJHLUaO.exe
  C:\Windows\System\jJHLUaO.exe
  2⤵
  PID:6236
- C:\Windows\System\vJuMOmM.exe
  C:\Windows\System\vJuMOmM.exe
  2⤵
  PID:6284
- C:\Windows\System\NLiUanf.exe
  C:\Windows\System\NLiUanf.exe
  2⤵
  PID:6348
- C:\Windows\System\mhnKuKX.exe
  C:\Windows\System\mhnKuKX.exe
  2⤵
  PID:6488
- C:\Windows\System\XtMwtHk.exe
  C:\Windows\System\XtMwtHk.exe
  2⤵
  PID:6544
- C:\Windows\System\gWVHcnu.exe
  C:\Windows\System\gWVHcnu.exe
  2⤵
  PID:6616
- C:\Windows\System\vOAqTUt.exe
  C:\Windows\System\vOAqTUt.exe
  2⤵
  PID:4416
- C:\Windows\System\tdUuwQq.exe
  C:\Windows\System\tdUuwQq.exe
  2⤵
  PID:7180
- C:\Windows\System\oHbLsjB.exe
  C:\Windows\System\oHbLsjB.exe
  2⤵
  PID:7200
- C:\Windows\System\SfwCCBh.exe
  C:\Windows\System\SfwCCBh.exe
  2⤵
  PID:7220
- C:\Windows\System\DlVHgaK.exe
  C:\Windows\System\DlVHgaK.exe
  2⤵
  PID:7248
- C:\Windows\System\JyFkgtT.exe
  C:\Windows\System\JyFkgtT.exe
  2⤵
  PID:7268
- C:\Windows\System\luVxJyR.exe
  C:\Windows\System\luVxJyR.exe
  2⤵
  PID:7296
- C:\Windows\System\EIXVuBa.exe
  C:\Windows\System\EIXVuBa.exe
  2⤵
  PID:7316
- C:\Windows\System\QPGMGlG.exe
  C:\Windows\System\QPGMGlG.exe
  2⤵
  PID:7336
- C:\Windows\System\gpYmqsq.exe
  C:\Windows\System\gpYmqsq.exe
  2⤵
  PID:7356
- C:\Windows\System\DyPxhaQ.exe
  C:\Windows\System\DyPxhaQ.exe
  2⤵
  PID:7380
- C:\Windows\System\lbuQEiw.exe
  C:\Windows\System\lbuQEiw.exe
  2⤵
  PID:7416
- C:\Windows\System\vHXNIBH.exe
  C:\Windows\System\vHXNIBH.exe
  2⤵
  PID:7436
- C:\Windows\System\EtVaVSG.exe
  C:\Windows\System\EtVaVSG.exe
  2⤵
  PID:7456
- C:\Windows\System\xwUYYmv.exe
  C:\Windows\System\xwUYYmv.exe
  2⤵
  PID:7480
- C:\Windows\System\EijqaZO.exe
  C:\Windows\System\EijqaZO.exe
  2⤵
  PID:7500
- C:\Windows\System\FzdWaPJ.exe
  C:\Windows\System\FzdWaPJ.exe
  2⤵
  PID:7520
- C:\Windows\System\MYnjXws.exe
  C:\Windows\System\MYnjXws.exe
  2⤵
  PID:7544
- C:\Windows\System\mxluwVh.exe
  C:\Windows\System\mxluwVh.exe
  2⤵
  PID:7576
- C:\Windows\System\cfswkls.exe
  C:\Windows\System\cfswkls.exe
  2⤵
  PID:7600
- C:\Windows\System\TVnmXeT.exe
  C:\Windows\System\TVnmXeT.exe
  2⤵
  PID:7616
- C:\Windows\System\QRoXqvv.exe
  C:\Windows\System\QRoXqvv.exe
  2⤵
  PID:7640
- C:\Windows\System\EjNjnAY.exe
  C:\Windows\System\EjNjnAY.exe
  2⤵
  PID:7660
- C:\Windows\System\lUANunS.exe
  C:\Windows\System\lUANunS.exe
  2⤵
  PID:7680
- C:\Windows\System\pcTPmiR.exe
  C:\Windows\System\pcTPmiR.exe
  2⤵
  PID:7704
- C:\Windows\System\yEcHMAO.exe
  C:\Windows\System\yEcHMAO.exe
  2⤵
  PID:7724
- C:\Windows\System\pJSHngp.exe
  C:\Windows\System\pJSHngp.exe
  2⤵
  PID:7748
- C:\Windows\System\SkbERzx.exe
  C:\Windows\System\SkbERzx.exe
  2⤵
  PID:7768
- C:\Windows\System\VxyZWlD.exe
  C:\Windows\System\VxyZWlD.exe
  2⤵
  PID:7796
- C:\Windows\System\XnMTZQL.exe
  C:\Windows\System\XnMTZQL.exe
  2⤵
  PID:7816
- C:\Windows\System\VSAZLJu.exe
  C:\Windows\System\VSAZLJu.exe
  2⤵
  PID:7840
- C:\Windows\System\hccHsMG.exe
  C:\Windows\System\hccHsMG.exe
  2⤵
  PID:7860
- C:\Windows\System\QsbPkxt.exe
  C:\Windows\System\QsbPkxt.exe
  2⤵
  PID:7888
- C:\Windows\System\FpwezYg.exe
  C:\Windows\System\FpwezYg.exe
  2⤵
  PID:7904
- C:\Windows\System\ZCbuSZb.exe
  C:\Windows\System\ZCbuSZb.exe
  2⤵
  PID:7932
- C:\Windows\System\ntbYqke.exe
  C:\Windows\System\ntbYqke.exe
  2⤵
  PID:7952
- C:\Windows\System\oZLhiXc.exe
  C:\Windows\System\oZLhiXc.exe
  2⤵
  PID:7972
- C:\Windows\System\FXhTrzX.exe
  C:\Windows\System\FXhTrzX.exe
  2⤵
  PID:8000
- C:\Windows\System\uoEnNQI.exe
  C:\Windows\System\uoEnNQI.exe
  2⤵
  PID:8024
- C:\Windows\System\IASLjRJ.exe
  C:\Windows\System\IASLjRJ.exe
  2⤵
  PID:8040
- C:\Windows\System\TRDGxJG.exe
  C:\Windows\System\TRDGxJG.exe
  2⤵
  PID:8068
- C:\Windows\System\UvmIZmX.exe
  C:\Windows\System\UvmIZmX.exe
  2⤵
  PID:8084
- C:\Windows\System\GmKDySo.exe
  C:\Windows\System\GmKDySo.exe
  2⤵
  PID:8108
- C:\Windows\System\UMdkGLv.exe
  C:\Windows\System\UMdkGLv.exe
  2⤵
  PID:8124
- C:\Windows\System\YYSsmRZ.exe
  C:\Windows\System\YYSsmRZ.exe
  2⤵
  PID:8144
- C:\Windows\System\DTtzVrQ.exe
  C:\Windows\System\DTtzVrQ.exe
  2⤵
  PID:8164
- C:\Windows\System\mNTcJbO.exe
  C:\Windows\System\mNTcJbO.exe
  2⤵
  PID:8184
- C:\Windows\System\pQQROVu.exe
  C:\Windows\System\pQQROVu.exe
  2⤵
  PID:6880
- C:\Windows\System\HMfHYeL.exe
  C:\Windows\System\HMfHYeL.exe
  2⤵
  PID:6924
- C:\Windows\System\CQNUNzy.exe
  C:\Windows\System\CQNUNzy.exe
  2⤵
  PID:6240
- C:\Windows\System\sxLsUHZ.exe
  C:\Windows\System\sxLsUHZ.exe
  2⤵
  PID:7128
- C:\Windows\System\yUBBjBt.exe
  C:\Windows\System\yUBBjBt.exe
  2⤵
  PID:5704
- C:\Windows\System\YtGzqfl.exe
  C:\Windows\System\YtGzqfl.exe
  2⤵
  PID:6456
- C:\Windows\System\mpVBYEB.exe
  C:\Windows\System\mpVBYEB.exe
  2⤵
  PID:5908
- C:\Windows\System\VfRloYR.exe
  C:\Windows\System\VfRloYR.exe
  2⤵
  PID:6172
- C:\Windows\System\OuxgsUB.exe
  C:\Windows\System\OuxgsUB.exe
  2⤵
  PID:6660
- C:\Windows\System\kLhvCOn.exe
  C:\Windows\System\kLhvCOn.exe
  2⤵
  PID:5352
- C:\Windows\System\DPvPVFa.exe
  C:\Windows\System\DPvPVFa.exe
  2⤵
  PID:5404
- C:\Windows\System\sPnuCFa.exe
  C:\Windows\System\sPnuCFa.exe
  2⤵
  PID:6576
- C:\Windows\System\EIWQIWy.exe
  C:\Windows\System\EIWQIWy.exe
  2⤵
  PID:5572
- C:\Windows\System\VGpAnUr.exe
  C:\Windows\System\VGpAnUr.exe
  2⤵
  PID:3624
- C:\Windows\System\WUBWeLF.exe
  C:\Windows\System\WUBWeLF.exe
  2⤵
  PID:7192
- C:\Windows\System\kVJkmfs.exe
  C:\Windows\System\kVJkmfs.exe
  2⤵
  PID:7228
- C:\Windows\System\yPYGGEI.exe
  C:\Windows\System\yPYGGEI.exe
  2⤵
  PID:7264
- C:\Windows\System\DmyhIXe.exe
  C:\Windows\System\DmyhIXe.exe
  2⤵
  PID:6948
- C:\Windows\System\sUCHtYb.exe
  C:\Windows\System\sUCHtYb.exe
  2⤵
  PID:7332
- C:\Windows\System\Exjjiqv.exe
  C:\Windows\System\Exjjiqv.exe
  2⤵
  PID:7448
- C:\Windows\System\cyONkfb.exe
  C:\Windows\System\cyONkfb.exe
  2⤵
  PID:7496
- C:\Windows\System\lRNNLjL.exe
  C:\Windows\System\lRNNLjL.exe
  2⤵
  PID:7060
- C:\Windows\System\AWirave.exe
  C:\Windows\System\AWirave.exe
  2⤵
  PID:6404
- C:\Windows\System\WOwrqdG.exe
  C:\Windows\System\WOwrqdG.exe
  2⤵
  PID:7156
- C:\Windows\System\uFuhLty.exe
  C:\Windows\System\uFuhLty.exe
  2⤵
  PID:6436
- C:\Windows\System\IDKNkjE.exe
  C:\Windows\System\IDKNkjE.exe
  2⤵
  PID:8212
- C:\Windows\System\VDsxZzF.exe
  C:\Windows\System\VDsxZzF.exe
  2⤵
  PID:8236
- C:\Windows\System\FkEaIAF.exe
  C:\Windows\System\FkEaIAF.exe
  2⤵
  PID:8256
- C:\Windows\System\IUWMLOn.exe
  C:\Windows\System\IUWMLOn.exe
  2⤵
  PID:8276
- C:\Windows\System\YCqjmJV.exe
  C:\Windows\System\YCqjmJV.exe
  2⤵
  PID:8304
- C:\Windows\System\xLjQBBZ.exe
  C:\Windows\System\xLjQBBZ.exe
  2⤵
  PID:8328
- C:\Windows\System\uFkaRVY.exe
  C:\Windows\System\uFkaRVY.exe
  2⤵
  PID:8348
- C:\Windows\System\xYDQeJp.exe
  C:\Windows\System\xYDQeJp.exe
  2⤵
  PID:8372
- C:\Windows\System\wWBSbXt.exe
  C:\Windows\System\wWBSbXt.exe
  2⤵
  PID:8392
- C:\Windows\System\gMJXqEC.exe
  C:\Windows\System\gMJXqEC.exe
  2⤵
  PID:8416
- C:\Windows\System\DCMbfJz.exe
  C:\Windows\System\DCMbfJz.exe
  2⤵
  PID:8432
- C:\Windows\System\IIzgFcQ.exe
  C:\Windows\System\IIzgFcQ.exe
  2⤵
  PID:8448
- C:\Windows\System\MuJXpbm.exe
  C:\Windows\System\MuJXpbm.exe
  2⤵
  PID:8468
- C:\Windows\System\HGviZVJ.exe
  C:\Windows\System\HGviZVJ.exe
  2⤵
  PID:8488
- C:\Windows\System\EZXDUtj.exe
  C:\Windows\System\EZXDUtj.exe
  2⤵
  PID:8504
- C:\Windows\System\HjFVHXl.exe
  C:\Windows\System\HjFVHXl.exe
  2⤵
  PID:8524
- C:\Windows\System\xAyLoSG.exe
  C:\Windows\System\xAyLoSG.exe
  2⤵
  PID:8576
- C:\Windows\System\jSQcItI.exe
  C:\Windows\System\jSQcItI.exe
  2⤵
  PID:8628
- C:\Windows\System\yNmQvup.exe
  C:\Windows\System\yNmQvup.exe
  2⤵
  PID:8660
- C:\Windows\System\TUFOTUf.exe
  C:\Windows\System\TUFOTUf.exe
  2⤵
  PID:8684
- C:\Windows\System\yWskdFb.exe
  C:\Windows\System\yWskdFb.exe
  2⤵
  PID:8708
- C:\Windows\System\ThXkUhQ.exe
  C:\Windows\System\ThXkUhQ.exe
  2⤵
  PID:8736
- C:\Windows\System\gducrhE.exe
  C:\Windows\System\gducrhE.exe
  2⤵
  PID:8760
- C:\Windows\System\altiJlK.exe
  C:\Windows\System\altiJlK.exe
  2⤵
  PID:8784
- C:\Windows\System\UlHXrJG.exe
  C:\Windows\System\UlHXrJG.exe
  2⤵
  PID:8804
- C:\Windows\System\wtwIlmQ.exe
  C:\Windows\System\wtwIlmQ.exe
  2⤵
  PID:8832
- C:\Windows\System\dwMGUkD.exe
  C:\Windows\System\dwMGUkD.exe
  2⤵
  PID:8856
- C:\Windows\System\iHxVnCB.exe
  C:\Windows\System\iHxVnCB.exe
  2⤵
  PID:8880
- C:\Windows\System\xBVzNJH.exe
  C:\Windows\System\xBVzNJH.exe
  2⤵
  PID:8904
- C:\Windows\System\JEtnDTS.exe
  C:\Windows\System\JEtnDTS.exe
  2⤵
  PID:8920
- C:\Windows\System\DYGrIVs.exe
  C:\Windows\System\DYGrIVs.exe
  2⤵
  PID:8940
- C:\Windows\System\fzQKGkF.exe
  C:\Windows\System\fzQKGkF.exe
  2⤵
  PID:8960
- C:\Windows\System\RPzaied.exe
  C:\Windows\System\RPzaied.exe
  2⤵
  PID:8988
- C:\Windows\System\CITBjYH.exe
  C:\Windows\System\CITBjYH.exe
  2⤵
  PID:9004
- C:\Windows\System\dliyrep.exe
  C:\Windows\System\dliyrep.exe
  2⤵
  PID:9028
- C:\Windows\System\eZoRGxR.exe
  C:\Windows\System\eZoRGxR.exe
  2⤵
  PID:9048
- C:\Windows\System\PtUlugz.exe
  C:\Windows\System\PtUlugz.exe
  2⤵
  PID:9072
- C:\Windows\System\nwBpSTx.exe
  C:\Windows\System\nwBpSTx.exe
  2⤵
  PID:9100
- C:\Windows\System\VQsWtJs.exe
  C:\Windows\System\VQsWtJs.exe
  2⤵
  PID:9120
- C:\Windows\System\AWCzeJI.exe
  C:\Windows\System\AWCzeJI.exe
  2⤵
  PID:9136
- C:\Windows\System\BYOQyYv.exe
  C:\Windows\System\BYOQyYv.exe
  2⤵
  PID:9156
- C:\Windows\System\mdcBgYj.exe
  C:\Windows\System\mdcBgYj.exe
  2⤵
  PID:9176
- C:\Windows\System\UBUhiPN.exe
  C:\Windows\System\UBUhiPN.exe
  2⤵
  PID:9200
- C:\Windows\System\sgwIWhG.exe
  C:\Windows\System\sgwIWhG.exe
  2⤵
  PID:7636
- C:\Windows\System\oNCoYQK.exe
  C:\Windows\System\oNCoYQK.exe
  2⤵
  PID:7676
- C:\Windows\System\BoDBokf.exe
  C:\Windows\System\BoDBokf.exe
  2⤵
  PID:6556
- C:\Windows\System\FOByCCw.exe
  C:\Windows\System\FOByCCw.exe
  2⤵
  PID:7764
- C:\Windows\System\QCRzDDc.exe
  C:\Windows\System\QCRzDDc.exe
  2⤵
  PID:6004
- C:\Windows\System\uNjCoSO.exe
  C:\Windows\System\uNjCoSO.exe
  2⤵
  PID:4448
- C:\Windows\System\JUXLbeS.exe
  C:\Windows\System\JUXLbeS.exe
  2⤵
  PID:6308
- C:\Windows\System\ysSdvyf.exe
  C:\Windows\System\ysSdvyf.exe
  2⤵
  PID:8032
- C:\Windows\System\KdfKvBb.exe
  C:\Windows\System\KdfKvBb.exe
  2⤵
  PID:5008
- C:\Windows\System\TFqhXrQ.exe
  C:\Windows\System\TFqhXrQ.exe
  2⤵
  PID:8116
- C:\Windows\System\QWqEJaU.exe
  C:\Windows\System\QWqEJaU.exe
  2⤵
  PID:2144
- C:\Windows\System\FqPrhfo.exe
  C:\Windows\System\FqPrhfo.exe
  2⤵
  PID:2288
- C:\Windows\System\HPmhTFe.exe
  C:\Windows\System\HPmhTFe.exe
  2⤵
  PID:8180
- C:\Windows\System\TfcmnYK.exe
  C:\Windows\System\TfcmnYK.exe
  2⤵
  PID:6232
- C:\Windows\System\rAEFEUn.exe
  C:\Windows\System\rAEFEUn.exe
  2⤵
  PID:5768
- C:\Windows\System\SWOjbBp.exe
  C:\Windows\System\SWOjbBp.exe
  2⤵
  PID:5148
- C:\Windows\System\uGtOjpE.exe
  C:\Windows\System\uGtOjpE.exe
  2⤵
  PID:6532
- C:\Windows\System\NhhLCeY.exe
  C:\Windows\System\NhhLCeY.exe
  2⤵
  PID:5496
- C:\Windows\System\JARxMNV.exe
  C:\Windows\System\JARxMNV.exe
  2⤵
  PID:6936
- C:\Windows\System\TevISLe.exe
  C:\Windows\System\TevISLe.exe
  2⤵
  PID:7084
- C:\Windows\System\qlfZkqy.exe
  C:\Windows\System\qlfZkqy.exe
  2⤵
  PID:7560
- C:\Windows\System\UXaEAfM.exe
  C:\Windows\System\UXaEAfM.exe
  2⤵
  PID:8248
- C:\Windows\System\pSKVOAW.exe
  C:\Windows\System\pSKVOAW.exe
  2⤵
  PID:9224
- C:\Windows\System\hArTHqq.exe
  C:\Windows\System\hArTHqq.exe
  2⤵
  PID:9244
- C:\Windows\System\adTCfdE.exe
  C:\Windows\System\adTCfdE.exe
  2⤵
  PID:9268
- C:\Windows\System\bJcadCz.exe
  C:\Windows\System\bJcadCz.exe
  2⤵
  PID:9288
- C:\Windows\System\MvkWGZI.exe
  C:\Windows\System\MvkWGZI.exe
  2⤵
  PID:9312
- C:\Windows\System\XWBrhLL.exe
  C:\Windows\System\XWBrhLL.exe
  2⤵
  PID:9340
- C:\Windows\System\rRzremi.exe
  C:\Windows\System\rRzremi.exe
  2⤵
  PID:9360
- C:\Windows\System\WypICbM.exe
  C:\Windows\System\WypICbM.exe
  2⤵
  PID:9380
- C:\Windows\System\QKPRnHf.exe
  C:\Windows\System\QKPRnHf.exe
  2⤵
  PID:9396
- C:\Windows\System\BCvkpWN.exe
  C:\Windows\System\BCvkpWN.exe
  2⤵
  PID:9416
- C:\Windows\System\zvvljfj.exe
  C:\Windows\System\zvvljfj.exe
  2⤵
  PID:9440
- C:\Windows\System\nqhhflF.exe
  C:\Windows\System\nqhhflF.exe
  2⤵
  PID:9464
- C:\Windows\System\TClAXfk.exe
  C:\Windows\System\TClAXfk.exe
  2⤵
  PID:9480
- C:\Windows\System\AtUWede.exe
  C:\Windows\System\AtUWede.exe
  2⤵
  PID:9496
- C:\Windows\System\uRpWMEE.exe
  C:\Windows\System\uRpWMEE.exe
  2⤵
  PID:9512
- C:\Windows\System\IkZFMFe.exe
  C:\Windows\System\IkZFMFe.exe
  2⤵
  PID:9528
- C:\Windows\System\TFIHBlq.exe
  C:\Windows\System\TFIHBlq.exe
  2⤵
  PID:9544
- C:\Windows\System\pnoxNhK.exe
  C:\Windows\System\pnoxNhK.exe
  2⤵
  PID:9560
- C:\Windows\System\oSsFTVT.exe
  C:\Windows\System\oSsFTVT.exe
  2⤵
  PID:9576
- C:\Windows\System\gjoKHnM.exe
  C:\Windows\System\gjoKHnM.exe
  2⤵
  PID:9592
- C:\Windows\System\UOKhHYd.exe
  C:\Windows\System\UOKhHYd.exe
  2⤵
  PID:9608
- C:\Windows\System\mFwFQIR.exe
  C:\Windows\System\mFwFQIR.exe
  2⤵
  PID:9624
- C:\Windows\System\ZBwdybi.exe
  C:\Windows\System\ZBwdybi.exe
  2⤵
  PID:9640
- C:\Windows\System\bnDtPAx.exe
  C:\Windows\System\bnDtPAx.exe
  2⤵
  PID:9656
- C:\Windows\System\zqkXFPc.exe
  C:\Windows\System\zqkXFPc.exe
  2⤵
  PID:9672
- C:\Windows\System\KkEuNxw.exe
  C:\Windows\System\KkEuNxw.exe
  2⤵
  PID:9688
- C:\Windows\System\GFwRNAv.exe
  C:\Windows\System\GFwRNAv.exe
  2⤵
  PID:9708
- C:\Windows\System\sIFaEFK.exe
  C:\Windows\System\sIFaEFK.exe
  2⤵
  PID:9732
- C:\Windows\System\aAcIzEV.exe
  C:\Windows\System\aAcIzEV.exe
  2⤵
  PID:9760
- C:\Windows\System\kBwQIEj.exe
  C:\Windows\System\kBwQIEj.exe
  2⤵
  PID:9784
- C:\Windows\System\ABBwlDZ.exe
  C:\Windows\System\ABBwlDZ.exe
  2⤵
  PID:9804
- C:\Windows\System\WePAdKq.exe
  C:\Windows\System\WePAdKq.exe
  2⤵
  PID:9828
- C:\Windows\System\hdsNblO.exe
  C:\Windows\System\hdsNblO.exe
  2⤵
  PID:9852
- C:\Windows\System\tPtpkQD.exe
  C:\Windows\System\tPtpkQD.exe
  2⤵
  PID:9876
- C:\Windows\System\IcTUHNW.exe
  C:\Windows\System\IcTUHNW.exe
  2⤵
  PID:9900
- C:\Windows\System\KVNxast.exe
  C:\Windows\System\KVNxast.exe
  2⤵
  PID:9920
- C:\Windows\System\sUjjijz.exe
  C:\Windows\System\sUjjijz.exe
  2⤵
  PID:9936
- C:\Windows\System\jgluXTA.exe
  C:\Windows\System\jgluXTA.exe
  2⤵
  PID:9952
- C:\Windows\System\SWzqumy.exe
  C:\Windows\System\SWzqumy.exe
  2⤵
  PID:9980
- C:\Windows\System\ztQbdZF.exe
  C:\Windows\System\ztQbdZF.exe
  2⤵
  PID:10008
- C:\Windows\System\tXxcJRb.exe
  C:\Windows\System\tXxcJRb.exe
  2⤵
  PID:10032
- C:\Windows\System\SYwSMth.exe
  C:\Windows\System\SYwSMth.exe
  2⤵
  PID:10060
- C:\Windows\System\dBwAbnm.exe
  C:\Windows\System\dBwAbnm.exe
  2⤵
  PID:10076
- C:\Windows\System\RRgNGLQ.exe
  C:\Windows\System\RRgNGLQ.exe
  2⤵
  PID:10096
- C:\Windows\System\GCZKYWK.exe
  C:\Windows\System\GCZKYWK.exe
  2⤵
  PID:10124
- C:\Windows\System\ZfRGBMd.exe
  C:\Windows\System\ZfRGBMd.exe
  2⤵
  PID:10148
- C:\Windows\System\tCJpWrb.exe
  C:\Windows\System\tCJpWrb.exe
  2⤵
  PID:10168
- C:\Windows\System\MNbjntT.exe
  C:\Windows\System\MNbjntT.exe
  2⤵
  PID:10192
- C:\Windows\System\EOMFLSY.exe
  C:\Windows\System\EOMFLSY.exe
  2⤵
  PID:10216
- C:\Windows\System\mXvgzjE.exe
  C:\Windows\System\mXvgzjE.exe
  2⤵
  PID:10236
- C:\Windows\System\vbgTXEu.exe
  C:\Windows\System\vbgTXEu.exe
  2⤵
  PID:8344
- C:\Windows\System\GXidLXB.exe
  C:\Windows\System\GXidLXB.exe
  2⤵
  PID:8404
- C:\Windows\System\oKKBodA.exe
  C:\Windows\System\oKKBodA.exe
  2⤵
  PID:5896
- C:\Windows\System\htNvdJi.exe
  C:\Windows\System\htNvdJi.exe
  2⤵
  PID:8476
- C:\Windows\System\gSGozAA.exe
  C:\Windows\System\gSGozAA.exe
  2⤵
  PID:8616
- C:\Windows\System\CVLkIVt.exe
  C:\Windows\System\CVLkIVt.exe
  2⤵
  PID:8716
- C:\Windows\System\RtiupyW.exe
  C:\Windows\System\RtiupyW.exe
  2⤵
  PID:4580
- C:\Windows\System\WWLgQOU.exe
  C:\Windows\System\WWLgQOU.exe
  2⤵
  PID:7948
- C:\Windows\System\DLkFQmf.exe
  C:\Windows\System\DLkFQmf.exe
  2⤵
  PID:8852
- C:\Windows\System\vICyYaK.exe
  C:\Windows\System\vICyYaK.exe
  2⤵
  PID:6452
- C:\Windows\System\nqbgaNZ.exe
  C:\Windows\System\nqbgaNZ.exe
  2⤵
  PID:8980
- C:\Windows\System\EIrTaQc.exe
  C:\Windows\System\EIrTaQc.exe
  2⤵
  PID:9040
- C:\Windows\System\kJPKJAq.exe
  C:\Windows\System\kJPKJAq.exe
  2⤵
  PID:9108
- C:\Windows\System\vhneZnD.exe
  C:\Windows\System\vhneZnD.exe
  2⤵
  PID:6212
- C:\Windows\System\BGYMVNm.exe
  C:\Windows\System\BGYMVNm.exe
  2⤵
  PID:6028
- C:\Windows\System\qEWgeio.exe
  C:\Windows\System\qEWgeio.exe
  2⤵
  PID:6700
- C:\Windows\System\ccQSZfl.exe
  C:\Windows\System\ccQSZfl.exe
  2⤵
  PID:10260
- C:\Windows\System\YbEYWwx.exe
  C:\Windows\System\YbEYWwx.exe
  2⤵
  PID:10284
- C:\Windows\System\wbQgatI.exe
  C:\Windows\System\wbQgatI.exe
  2⤵
  PID:10312
- C:\Windows\System\PZvqhkh.exe
  C:\Windows\System\PZvqhkh.exe
  2⤵
  PID:10336
- C:\Windows\System\vdVpJIO.exe
  C:\Windows\System\vdVpJIO.exe
  2⤵
  PID:10356
- C:\Windows\System\MQmJGuZ.exe
  C:\Windows\System\MQmJGuZ.exe
  2⤵
  PID:10380
- C:\Windows\System\vgmJRWO.exe
  C:\Windows\System\vgmJRWO.exe
  2⤵
  PID:10412
- C:\Windows\System\BRXhHIk.exe
  C:\Windows\System\BRXhHIk.exe
  2⤵
  PID:10436
- C:\Windows\System\GSjxyFs.exe
  C:\Windows\System\GSjxyFs.exe
  2⤵
  PID:10460
- C:\Windows\System\fmdOoJF.exe
  C:\Windows\System\fmdOoJF.exe
  2⤵
  PID:10488
- C:\Windows\System\wWmHUzL.exe
  C:\Windows\System\wWmHUzL.exe
  2⤵
  PID:10512
- C:\Windows\System\caDGbUa.exe
  C:\Windows\System\caDGbUa.exe
  2⤵
  PID:10532
- C:\Windows\System\jGEitTD.exe
  C:\Windows\System\jGEitTD.exe
  2⤵
  PID:10556
- C:\Windows\System\cuxpGod.exe
  C:\Windows\System\cuxpGod.exe
  2⤵
  PID:10592
- C:\Windows\System\XehAoha.exe
  C:\Windows\System\XehAoha.exe
  2⤵
  PID:10624
- C:\Windows\System\WBZyUVP.exe
  C:\Windows\System\WBZyUVP.exe
  2⤵
  PID:10640
- C:\Windows\System\VMIHQtt.exe
  C:\Windows\System\VMIHQtt.exe
  2⤵
  PID:10672
- C:\Windows\System\UyTtIFa.exe
  C:\Windows\System\UyTtIFa.exe
  2⤵
  PID:10696
- C:\Windows\System\iDzmWRn.exe
  C:\Windows\System\iDzmWRn.exe
  2⤵
  PID:10720
- C:\Windows\System\RumNjSM.exe
  C:\Windows\System\RumNjSM.exe
  2⤵
  PID:10748
- C:\Windows\System\xIBtiiz.exe
  C:\Windows\System\xIBtiiz.exe
  2⤵
  PID:10776
- C:\Windows\System\OhwJQvX.exe
  C:\Windows\System\OhwJQvX.exe
  2⤵
  PID:10800
- C:\Windows\System\drllXvO.exe
  C:\Windows\System\drllXvO.exe
  2⤵
  PID:10824
- C:\Windows\System\wACTVyF.exe
  C:\Windows\System\wACTVyF.exe
  2⤵
  PID:10852
- C:\Windows\System\tFUwZEU.exe
  C:\Windows\System\tFUwZEU.exe
  2⤵
  PID:10876
- C:\Windows\System\EjgsaxK.exe
  C:\Windows\System\EjgsaxK.exe
  2⤵
  PID:10892
- C:\Windows\System\JflZCae.exe
  C:\Windows\System\JflZCae.exe
  2⤵
  PID:10908
- C:\Windows\System\oPqgFTw.exe
  C:\Windows\System\oPqgFTw.exe
  2⤵
  PID:10928
- C:\Windows\System\yeITIMt.exe
  C:\Windows\System\yeITIMt.exe
  2⤵
  PID:10948
- C:\Windows\System\bmwdlJa.exe
  C:\Windows\System\bmwdlJa.exe
  2⤵
  PID:10976
- C:\Windows\System\nIbGkNf.exe
  C:\Windows\System\nIbGkNf.exe
  2⤵
  PID:11004
- C:\Windows\System\PgysUGO.exe
  C:\Windows\System\PgysUGO.exe
  2⤵
  PID:11020
- C:\Windows\System\eLTNSlt.exe
  C:\Windows\System\eLTNSlt.exe
  2⤵
  PID:11040
- C:\Windows\System\oNhCRkE.exe
  C:\Windows\System\oNhCRkE.exe
  2⤵
  PID:11056
- C:\Windows\System\HTHtREh.exe
  C:\Windows\System\HTHtREh.exe
  2⤵
  PID:11084
- C:\Windows\System\RBfsjkv.exe
  C:\Windows\System\RBfsjkv.exe
  2⤵
  PID:11116
- C:\Windows\System\oeKMpVF.exe
  C:\Windows\System\oeKMpVF.exe
  2⤵
  PID:11136
- C:\Windows\System\xTYVnNq.exe
  C:\Windows\System\xTYVnNq.exe
  2⤵
  PID:11160
- C:\Windows\System\VKuxcBK.exe
  C:\Windows\System\VKuxcBK.exe
  2⤵
  PID:11196
- C:\Windows\System\xvikCAD.exe
  C:\Windows\System\xvikCAD.exe
  2⤵
  PID:11212
- C:\Windows\System\CDlzpAR.exe
  C:\Windows\System\CDlzpAR.exe
  2⤵
  PID:11232
- C:\Windows\System\YIdDLXe.exe
  C:\Windows\System\YIdDLXe.exe
  2⤵
  PID:11252
- C:\Windows\System\NmcrPom.exe
  C:\Windows\System\NmcrPom.exe
  2⤵
  PID:6828
- C:\Windows\System\EYCXGIt.exe
  C:\Windows\System\EYCXGIt.exe
  2⤵
  PID:7428
- C:\Windows\System\bZvQBYr.exe
  C:\Windows\System\bZvQBYr.exe
  2⤵
  PID:7512
- C:\Windows\System\JNvKPXn.exe
  C:\Windows\System\JNvKPXn.exe
  2⤵
  PID:5028
- C:\Windows\System\pBdxJNS.exe
  C:\Windows\System\pBdxJNS.exe
  2⤵
  PID:7608
- C:\Windows\System\EnMjESZ.exe
  C:\Windows\System\EnMjESZ.exe
  2⤵
  PID:8272
- C:\Windows\System\rdOqmlY.exe
  C:\Windows\System\rdOqmlY.exe
  2⤵
  PID:9320
- C:\Windows\System\LggiyEn.exe
  C:\Windows\System\LggiyEn.exe
  2⤵
  PID:7788
- C:\Windows\System\mSBOKGM.exe
  C:\Windows\System\mSBOKGM.exe
  2⤵
  PID:8676
- C:\Windows\System\VMImLDP.exe
  C:\Windows\System\VMImLDP.exe
  2⤵
  PID:7828
- C:\Windows\System\UltzjXv.exe
  C:\Windows\System\UltzjXv.exe
  2⤵
  PID:7924
- C:\Windows\System\oYXxrNH.exe
  C:\Windows\System\oYXxrNH.exe
  2⤵
  PID:10140
- C:\Windows\System\XAplrkr.exe
  C:\Windows\System\XAplrkr.exe
  2⤵
  PID:9012
- C:\Windows\System\ARnwxAz.exe
  C:\Windows\System\ARnwxAz.exe
  2⤵
  PID:4980
- C:\Windows\System\XtQevmG.exe
  C:\Windows\System\XtQevmG.exe
  2⤵
  PID:9172
- C:\Windows\System\adHoWLE.exe
  C:\Windows\System\adHoWLE.exe
  2⤵
  PID:8672
- C:\Windows\System\TGrXPxy.exe
  C:\Windows\System\TGrXPxy.exe
  2⤵
  PID:5640
- C:\Windows\System\sTsgdJN.exe
  C:\Windows\System\sTsgdJN.exe
  2⤵
  PID:6564
- C:\Windows\System\vQyuCzX.exe
  C:\Windows\System\vQyuCzX.exe
  2⤵
  PID:7988
- C:\Windows\System\GzMJUds.exe
  C:\Windows\System\GzMJUds.exe
  2⤵
  PID:11284
- C:\Windows\System\FfKZtdh.exe
  C:\Windows\System\FfKZtdh.exe
  2⤵
  PID:11328
- C:\Windows\System\FvqZAbD.exe
  C:\Windows\System\FvqZAbD.exe
  2⤵
  PID:11348
- C:\Windows\System\utGYFMn.exe
  C:\Windows\System\utGYFMn.exe
  2⤵
  PID:11380
- C:\Windows\System\iMznEgl.exe
  C:\Windows\System\iMznEgl.exe
  2⤵
  PID:11404
- C:\Windows\System\auGmBsx.exe
  C:\Windows\System\auGmBsx.exe
  2⤵
  PID:11432
- C:\Windows\System\PNNTAdd.exe
  C:\Windows\System\PNNTAdd.exe
  2⤵
  PID:11464
- C:\Windows\System\dtajgDw.exe
  C:\Windows\System\dtajgDw.exe
  2⤵
  PID:11484
- C:\Windows\System\CysHQTV.exe
  C:\Windows\System\CysHQTV.exe
  2⤵
  PID:11504
- C:\Windows\System\iUNrkfk.exe
  C:\Windows\System\iUNrkfk.exe
  2⤵
  PID:11524
- C:\Windows\System\zfPSYkQ.exe
  C:\Windows\System\zfPSYkQ.exe
  2⤵
  PID:11556
- C:\Windows\System\dOYLzJA.exe
  C:\Windows\System\dOYLzJA.exe
  2⤵
  PID:11584
- C:\Windows\System\AYDXpBi.exe
  C:\Windows\System\AYDXpBi.exe
  2⤵
  PID:11604
- C:\Windows\System\MclTBQH.exe
  C:\Windows\System\MclTBQH.exe
  2⤵
  PID:11624
- C:\Windows\System\DBmdQOu.exe
  C:\Windows\System\DBmdQOu.exe
  2⤵
  PID:11648
- C:\Windows\System\uSlfZGP.exe
  C:\Windows\System\uSlfZGP.exe
  2⤵
  PID:11676
- C:\Windows\System\ehJfCBm.exe
  C:\Windows\System\ehJfCBm.exe
  2⤵
  PID:11700
- C:\Windows\System\brPUNMM.exe
  C:\Windows\System\brPUNMM.exe
  2⤵
  PID:11724
- C:\Windows\System\AZwDCCJ.exe
  C:\Windows\System\AZwDCCJ.exe
  2⤵
  PID:11748
- C:\Windows\System\tbsXkMP.exe
  C:\Windows\System\tbsXkMP.exe
  2⤵
  PID:11768
- C:\Windows\System\GFQMCFU.exe
  C:\Windows\System\GFQMCFU.exe
  2⤵
  PID:11796
- C:\Windows\System\TGHoRaC.exe
  C:\Windows\System\TGHoRaC.exe
  2⤵
  PID:11816
- C:\Windows\System\SEKGMXe.exe
  C:\Windows\System\SEKGMXe.exe
  2⤵
  PID:11840
- C:\Windows\System\TyiserR.exe
  C:\Windows\System\TyiserR.exe
  2⤵
  PID:11868
- C:\Windows\System\ppmnMMU.exe
  C:\Windows\System\ppmnMMU.exe
  2⤵
  PID:11888
- C:\Windows\System\neHRyem.exe
  C:\Windows\System\neHRyem.exe
  2⤵
  PID:11908
- C:\Windows\System\IPnzeNv.exe
  C:\Windows\System\IPnzeNv.exe
  2⤵
  PID:11948
- C:\Windows\System\riAAvQA.exe
  C:\Windows\System\riAAvQA.exe
  2⤵
  PID:11972
- C:\Windows\System\qYuqYbj.exe
  C:\Windows\System\qYuqYbj.exe
  2⤵
  PID:11996
- C:\Windows\System\aJFKBxz.exe
  C:\Windows\System\aJFKBxz.exe
  2⤵
  PID:12020
- C:\Windows\System\ovZjRlY.exe
  C:\Windows\System\ovZjRlY.exe
  2⤵
  PID:12048
- C:\Windows\System\aSmtapP.exe
  C:\Windows\System\aSmtapP.exe
  2⤵
  PID:12068
- C:\Windows\System\kAqjbfh.exe
  C:\Windows\System\kAqjbfh.exe
  2⤵
  PID:12088
- C:\Windows\System\wAGyblw.exe
  C:\Windows\System\wAGyblw.exe
  2⤵
  PID:12116
- C:\Windows\System\ndyvAFd.exe
  C:\Windows\System\ndyvAFd.exe
  2⤵
  PID:12144
- C:\Windows\System\vQnIagP.exe
  C:\Windows\System\vQnIagP.exe
  2⤵
  PID:12160
- C:\Windows\System\DrfbBKf.exe
  C:\Windows\System\DrfbBKf.exe
  2⤵
  PID:12180
- C:\Windows\System\AqTIFLM.exe
  C:\Windows\System\AqTIFLM.exe
  2⤵
  PID:12204
- C:\Windows\System\XYtcIkN.exe
  C:\Windows\System\XYtcIkN.exe
  2⤵
  PID:12232
- C:\Windows\System\xRMbIph.exe
  C:\Windows\System\xRMbIph.exe
  2⤵
  PID:12264
- C:\Windows\System\vqUclxt.exe
  C:\Windows\System\vqUclxt.exe
  2⤵
  PID:12284
- C:\Windows\System\HGQMVEv.exe
  C:\Windows\System\HGQMVEv.exe
  2⤵
  PID:6600
- C:\Windows\System\ZgKNHAZ.exe
  C:\Windows\System\ZgKNHAZ.exe
  2⤵
  PID:6800
- C:\Windows\System\viCIVhm.exe
  C:\Windows\System\viCIVhm.exe
  2⤵
  PID:10468
- C:\Windows\System\gioscPp.exe
  C:\Windows\System\gioscPp.exe
  2⤵
  PID:10520
- C:\Windows\System\pqXhCDK.exe
  C:\Windows\System\pqXhCDK.exe
  2⤵
  PID:7588
- C:\Windows\System\DLPPdkc.exe
  C:\Windows\System\DLPPdkc.exe
  2⤵
  PID:9256
- C:\Windows\System\ybPLXeQ.exe
  C:\Windows\System\ybPLXeQ.exe
  2⤵
  PID:9348
- C:\Windows\System\pnozpUN.exe
  C:\Windows\System\pnozpUN.exe
  2⤵
  PID:8424
- C:\Windows\System\DFDcVkp.exe
  C:\Windows\System\DFDcVkp.exe
  2⤵
  PID:10832
- C:\Windows\System\vtKivNA.exe
  C:\Windows\System\vtKivNA.exe
  2⤵
  PID:9424
- C:\Windows\System\PNNreCl.exe
  C:\Windows\System\PNNreCl.exe
  2⤵
  PID:9460
- C:\Windows\System\ZlhrSfK.exe
  C:\Windows\System\ZlhrSfK.exe
  2⤵
  PID:9488
- C:\Windows\System\NySbVgZ.exe
  C:\Windows\System\NySbVgZ.exe
  2⤵
  PID:9520
- C:\Windows\System\hNnmTAS.exe
  C:\Windows\System\hNnmTAS.exe
  2⤵
  PID:8560
- C:\Windows\System\trjLvYv.exe
  C:\Windows\System\trjLvYv.exe
  2⤵
  PID:8572
- C:\Windows\System\DxLlXMH.exe
  C:\Windows\System\DxLlXMH.exe
  2⤵
  PID:9600
- C:\Windows\System\Vfxdjdf.exe
  C:\Windows\System\Vfxdjdf.exe
  2⤵
  PID:8600
- C:\Windows\System\jsVcJjv.exe
  C:\Windows\System\jsVcJjv.exe
  2⤵
  PID:9648
- C:\Windows\System\UEQdUii.exe
  C:\Windows\System\UEQdUii.exe
  2⤵
  PID:9684
- C:\Windows\System\zSOTAhT.exe
  C:\Windows\System\zSOTAhT.exe
  2⤵
  PID:10960
- C:\Windows\System\ZqSnAPz.exe
  C:\Windows\System\ZqSnAPz.exe
  2⤵
  PID:9820
- C:\Windows\System\YjCLBsI.exe
  C:\Windows\System\YjCLBsI.exe
  2⤵
  PID:9928
- C:\Windows\System\MNvjKXx.exe
  C:\Windows\System\MNvjKXx.exe
  2⤵
  PID:9988
- C:\Windows\System\ZzSbdLh.exe
  C:\Windows\System\ZzSbdLh.exe
  2⤵
  PID:8840
- C:\Windows\System\UmhzfAv.exe
  C:\Windows\System\UmhzfAv.exe
  2⤵
  PID:10024
- C:\Windows\System\dJaWKpf.exe
  C:\Windows\System\dJaWKpf.exe
  2⤵
  PID:8928
- C:\Windows\System\DaRFGUp.exe
  C:\Windows\System\DaRFGUp.exe
  2⤵
  PID:5852
- C:\Windows\System\CwNmJQc.exe
  C:\Windows\System\CwNmJQc.exe
  2⤵
  PID:10228
- C:\Windows\System\ZAaRcrC.exe
  C:\Windows\System\ZAaRcrC.exe
  2⤵
  PID:9328
- C:\Windows\System\eOUmosk.exe
  C:\Windows\System\eOUmosk.exe
  2⤵
  PID:8656
- C:\Windows\System\UDRibXa.exe
  C:\Windows\System\UDRibXa.exe
  2⤵
  PID:12292
- C:\Windows\System\zuSIjIo.exe
  C:\Windows\System\zuSIjIo.exe
  2⤵
  PID:12324
- C:\Windows\System\BdRoqMR.exe
  C:\Windows\System\BdRoqMR.exe
  2⤵
  PID:12356
- C:\Windows\System\vMFgZkw.exe
  C:\Windows\System\vMFgZkw.exe
  2⤵
  PID:12388
- C:\Windows\System\XMiDKRq.exe
  C:\Windows\System\XMiDKRq.exe
  2⤵
  PID:12404
- C:\Windows\System\MSbZGuD.exe
  C:\Windows\System\MSbZGuD.exe
  2⤵
  PID:12428
- C:\Windows\System\RSDuKqf.exe
  C:\Windows\System\RSDuKqf.exe
  2⤵
  PID:12448
- C:\Windows\System\CophoDs.exe
  C:\Windows\System\CophoDs.exe
  2⤵
  PID:12464
- C:\Windows\System\qaRYVuQ.exe
  C:\Windows\System\qaRYVuQ.exe
  2⤵
  PID:12504
- C:\Windows\System\FhDfzaa.exe
  C:\Windows\System\FhDfzaa.exe
  2⤵
  PID:12528
- C:\Windows\System\aChFvZJ.exe
  C:\Windows\System\aChFvZJ.exe
  2⤵
  PID:12548
- C:\Windows\System\ghukMMM.exe
  C:\Windows\System\ghukMMM.exe
  2⤵
  PID:12572
- C:\Windows\System\xopFUKr.exe
  C:\Windows\System\xopFUKr.exe
  2⤵
  PID:12596
- C:\Windows\System\BPhDmGU.exe
  C:\Windows\System\BPhDmGU.exe
  2⤵
  PID:12624
- C:\Windows\System\JRlJTIB.exe
  C:\Windows\System\JRlJTIB.exe
  2⤵
  PID:12644
- C:\Windows\System\QfaaXYm.exe
  C:\Windows\System\QfaaXYm.exe
  2⤵
  PID:12680
- C:\Windows\System\DPNUGsv.exe
  C:\Windows\System\DPNUGsv.exe
  2⤵
  PID:12700
- C:\Windows\System\PihXxVb.exe
  C:\Windows\System\PihXxVb.exe
  2⤵
  PID:12728
- C:\Windows\System\UDpfqtq.exe
  C:\Windows\System\UDpfqtq.exe
  2⤵
  PID:12756
- C:\Windows\System\KtrYyMF.exe
  C:\Windows\System\KtrYyMF.exe
  2⤵
  PID:12780
- C:\Windows\System\rQluquM.exe
  C:\Windows\System\rQluquM.exe
  2⤵
  PID:8384
- C:\Windows\System\wQbLUXS.exe
  C:\Windows\System\wQbLUXS.exe
  2⤵
  PID:8556
- C:\Windows\System\nDhtBXB.exe
  C:\Windows\System\nDhtBXB.exe
  2⤵
  PID:10160
- C:\Windows\System\bcCgApz.exe
  C:\Windows\System\bcCgApz.exe
  2⤵
  PID:12336
- C:\Windows\System\ebLIEMX.exe
  C:\Windows\System\ebLIEMX.exe
  2⤵
  PID:12412
- C:\Windows\System\KRtgIts.exe
  C:\Windows\System\KRtgIts.exe
  2⤵
  PID:10208
- C:\Windows\System\RCnYdsl.exe
  C:\Windows\System\RCnYdsl.exe
  2⤵
  PID:8896
- C:\Windows\System\LZfoScY.exe
  C:\Windows\System\LZfoScY.exe
  2⤵
  PID:2904
- C:\Windows\System\jaYyJFD.exe
  C:\Windows\System\jaYyJFD.exe
  2⤵
  PID:12592
- C:\Windows\System\sMLBNez.exe
  C:\Windows\System\sMLBNez.exe
  2⤵
  PID:9036
- C:\Windows\System\oqgfclR.exe
  C:\Windows\System\oqgfclR.exe
  2⤵
  PID:7880
- C:\Windows\System\YEkKuTa.exe
  C:\Windows\System\YEkKuTa.exe
  2⤵
  PID:10276
- C:\Windows\System\oHbzLNC.exe
  C:\Windows\System\oHbzLNC.exe
  2⤵
  PID:10376
- C:\Windows\System\dRmKUek.exe
  C:\Windows\System\dRmKUek.exe
  2⤵
  PID:11476
- C:\Windows\System\voRXihG.exe
  C:\Windows\System\voRXihG.exe
  2⤵
  PID:11492
- C:\Windows\System\FcCWUeB.exe
  C:\Windows\System\FcCWUeB.exe
  2⤵
  PID:10444
- C:\Windows\System\xRaXpiP.exe
  C:\Windows\System\xRaXpiP.exe
  2⤵
  PID:11764
- C:\Windows\System\EqVrSZn.exe
  C:\Windows\System\EqVrSZn.exe
  2⤵
  PID:10580
- C:\Windows\System\lfZSuog.exe
  C:\Windows\System\lfZSuog.exe
  2⤵
  PID:13004
- C:\Windows\System\CWwDvpi.exe
  C:\Windows\System\CWwDvpi.exe
  2⤵
  PID:10808
- C:\Windows\System\HBdRIXb.exe
  C:\Windows\System\HBdRIXb.exe
  2⤵
  PID:10732
- C:\Windows\System\CHzuAWB.exe
  C:\Windows\System\CHzuAWB.exe
  2⤵
  PID:13184
- C:\Windows\System\zlZMOcj.exe
  C:\Windows\System\zlZMOcj.exe
  2⤵
  PID:7324
- C:\Windows\System\gNwvoLv.exe
  C:\Windows\System\gNwvoLv.exe
  2⤵
  PID:11028
- C:\Windows\System\ovtXqPw.exe
  C:\Windows\System\ovtXqPw.exe
  2⤵
  PID:11104
- C:\Windows\System\MIVXFoN.exe
  C:\Windows\System\MIVXFoN.exe
  2⤵
  PID:9476
- C:\Windows\System\pBTEWEd.exe
  C:\Windows\System\pBTEWEd.exe
  2⤵
  PID:8552
- C:\Windows\System\JJuKXFr.exe
  C:\Windows\System\JJuKXFr.exe
  2⤵
  PID:11228
- C:\Windows\System\vPayxhP.exe
  C:\Windows\System\vPayxhP.exe
  2⤵
  PID:7216
- C:\Windows\System\JtEaecc.exe
  C:\Windows\System\JtEaecc.exe
  2⤵
  PID:7744
- C:\Windows\System\NWTaRFQ.exe
  C:\Windows\System\NWTaRFQ.exe
  2⤵
  PID:7472
- C:\Windows\System\HwgqLXG.exe
  C:\Windows\System\HwgqLXG.exe
  2⤵
  PID:8060
- C:\Windows\System\RQHXXib.exe
  C:\Windows\System\RQHXXib.exe
  2⤵
  PID:12348
- C:\Windows\System\QhppGUx.exe
  C:\Windows\System\QhppGUx.exe
  2⤵
  PID:12444
- C:\Windows\System\MRjqMzz.exe
  C:\Windows\System\MRjqMzz.exe
  2⤵
  PID:12556
- C:\Windows\System\cfKawLh.exe
  C:\Windows\System\cfKawLh.exe
  2⤵
  PID:7832
- C:\Windows\System\YAtnOIW.exe
  C:\Windows\System\YAtnOIW.exe
  2⤵
  PID:8080
- C:\Windows\System\JPcoyUP.exe
  C:\Windows\System\JPcoyUP.exe
  2⤵
  PID:11336
- C:\Windows\System\EJdkxhZ.exe
  C:\Windows\System\EJdkxhZ.exe
  2⤵
  PID:12672
- C:\Windows\System\uXTiAqo.exe
  C:\Windows\System\uXTiAqo.exe
  2⤵
  PID:12764
- C:\Windows\System\mdwkNBX.exe
  C:\Windows\System\mdwkNBX.exe
  2⤵
  PID:11420
- C:\Windows\System\vidwbSr.exe
  C:\Windows\System\vidwbSr.exe
  2⤵
  PID:11532
- C:\Windows\System\TitqfUi.exe
  C:\Windows\System\TitqfUi.exe
  2⤵
  PID:11596
- C:\Windows\System\pkHqqVf.exe
  C:\Windows\System\pkHqqVf.exe
  2⤵
  PID:11640
- C:\Windows\System\exSBRIE.exe
  C:\Windows\System\exSBRIE.exe
  2⤵
  PID:11684
- C:\Windows\System\KAMtrLD.exe
  C:\Windows\System\KAMtrLD.exe
  2⤵
  PID:11784
- C:\Windows\System\OhDQCWL.exe
  C:\Windows\System\OhDQCWL.exe
  2⤵
  PID:11832
- C:\Windows\System\ghDQpEJ.exe
  C:\Windows\System\ghDQpEJ.exe
  2⤵
  PID:11992
- C:\Windows\System\nltXwGm.exe
  C:\Windows\System\nltXwGm.exe
  2⤵
  PID:12044
- C:\Windows\System\OukboZm.exe
  C:\Windows\System\OukboZm.exe
  2⤵
  PID:12084
- C:\Windows\System\csZSrVn.exe
  C:\Windows\System\csZSrVn.exe
  2⤵
  PID:12124
- C:\Windows\System\vLnUNBC.exe
  C:\Windows\System\vLnUNBC.exe
  2⤵
  PID:12196
- C:\Windows\System\RdNxouI.exe
  C:\Windows\System\RdNxouI.exe
  2⤵
  PID:12224
- C:\Windows\System\ShruFqt.exe
  C:\Windows\System\ShruFqt.exe
  2⤵
  PID:12156
- C:\Windows\System\IgnqUWZ.exe
  C:\Windows\System\IgnqUWZ.exe
  2⤵
  PID:10900
- C:\Windows\System\KjzoqqB.exe
  C:\Windows\System\KjzoqqB.exe
  2⤵
  PID:8368
- C:\Windows\System\IKrDBeZ.exe
  C:\Windows\System\IKrDBeZ.exe
  2⤵
  PID:10860
- C:\Windows\System\HxJTZfT.exe
  C:\Windows\System\HxJTZfT.exe
  2⤵
  PID:8588
- C:\Windows\System\mqSJlZH.exe
  C:\Windows\System\mqSJlZH.exe
  2⤵
  PID:9616
- C:\Windows\System\eFccRrb.exe
  C:\Windows\System\eFccRrb.exe
  2⤵
  PID:8608
- C:\Windows\System\pWsGRIP.exe
  C:\Windows\System\pWsGRIP.exe
  2⤵
  PID:6412
- C:\Windows\System\jLHaQbC.exe
  C:\Windows\System\jLHaQbC.exe
  2⤵
  PID:12372
- C:\Windows\System\QDUSCnq.exe
  C:\Windows\System\QDUSCnq.exe
  2⤵
  PID:12516
- C:\Windows\System\oijMSaP.exe
  C:\Windows\System\oijMSaP.exe
  2⤵
  PID:12692
- C:\Windows\System\bTZmOJF.exe
  C:\Windows\System\bTZmOJF.exe
  2⤵
  PID:12724
- C:\Windows\System\gMMBwbP.exe
  C:\Windows\System\gMMBwbP.exe
  2⤵
  PID:10620
- C:\Windows\System\OrVihcQ.exe
  C:\Windows\System\OrVihcQ.exe
  2⤵
  PID:12952
- C:\Windows\System\vyRzQnA.exe
  C:\Windows\System\vyRzQnA.exe
  2⤵
  PID:7648
- C:\Windows\System\RTXzfeP.exe
  C:\Windows\System\RTXzfeP.exe
  2⤵
  PID:13132
- C:\Windows\System\RpRUMMe.exe
  C:\Windows\System\RpRUMMe.exe
  2⤵
  PID:13048
- C:\Windows\System\vpMUCgH.exe
  C:\Windows\System\vpMUCgH.exe
  2⤵
  PID:13212
- C:\Windows\System\kqedLKN.exe
  C:\Windows\System\kqedLKN.exe
  2⤵
  PID:8016
- C:\Windows\System\TeKCteU.exe
  C:\Windows\System\TeKCteU.exe
  2⤵
  PID:10092
- C:\Windows\System\NlOpXwK.exe
  C:\Windows\System\NlOpXwK.exe
  2⤵
  PID:10188
- C:\Windows\System\AXcayAz.exe
  C:\Windows\System\AXcayAz.exe
  2⤵
  PID:12280
- C:\Windows\System\RZFDPsD.exe
  C:\Windows\System\RZFDPsD.exe
  2⤵
  PID:3696
- C:\Windows\System\WEdGFXY.exe
  C:\Windows\System\WEdGFXY.exe
  2⤵
  PID:9912
- C:\Windows\System\gvvWNwI.exe
  C:\Windows\System\gvvWNwI.exe
  2⤵
  PID:10084
- C:\Windows\System\eEWWeKn.exe
  C:\Windows\System\eEWWeKn.exe
  2⤵
  PID:10044
- C:\Windows\System\rWcBzFY.exe
  C:\Windows\System\rWcBzFY.exe
  2⤵
  PID:10940
- C:\Windows\System\LmlUqTo.exe
  C:\Windows\System\LmlUqTo.exe
  2⤵
  PID:1680
- C:\Windows\System\XXOKzKr.exe
  C:\Windows\System\XXOKzKr.exe
  2⤵
  PID:4536
- C:\Windows\System\YcjnNbH.exe
  C:\Windows\System\YcjnNbH.exe
  2⤵
  PID:12564
- C:\Windows\System\laPDRRF.exe
  C:\Windows\System\laPDRRF.exe
  2⤵
  PID:12856
- C:\Windows\System\lNXogVV.exe
  C:\Windows\System\lNXogVV.exe
  2⤵
  PID:10600
- C:\Windows\System\NjiITia.exe
  C:\Windows\System\NjiITia.exe
  2⤵
  PID:12796
- C:\Windows\System\KbbaXrM.exe
  C:\Windows\System\KbbaXrM.exe
  2⤵
  PID:11052
- C:\Windows\System\gKHazdV.exe
  C:\Windows\System\gKHazdV.exe
  2⤵
  PID:11248
- C:\Windows\System\ItpTimN.exe
  C:\Windows\System\ItpTimN.exe
  2⤵
  PID:10372
- C:\Windows\System\USTXdiJ.exe
  C:\Windows\System\USTXdiJ.exe
  2⤵
  PID:10000
- C:\Windows\System\ajZRelf.exe
  C:\Windows\System\ajZRelf.exe
  2⤵
  PID:7920
- C:\Windows\System\yMHIDtv.exe
  C:\Windows\System\yMHIDtv.exe
  2⤵
  PID:11344
- C:\Windows\System\TrnYoHW.exe
  C:\Windows\System\TrnYoHW.exe
  2⤵
  PID:12804
- C:\Windows\System\PqInRIl.exe
  C:\Windows\System\PqInRIl.exe
  2⤵
  PID:8948
- C:\Windows\System\FdSAdqC.exe
  C:\Windows\System\FdSAdqC.exe
  2⤵
  PID:9796
- C:\Windows\System\GSLbpGQ.exe
  C:\Windows\System\GSLbpGQ.exe
  2⤵
  PID:11828
- C:\Windows\System\YBDzMFt.exe
  C:\Windows\System\YBDzMFt.exe
  2⤵
  PID:9192
- C:\Windows\System\dcqpCGg.exe
  C:\Windows\System\dcqpCGg.exe
  2⤵
  PID:11144
- C:\Windows\System\cczBeFq.exe
  C:\Windows\System\cczBeFq.exe
  2⤵
  PID:8544
- C:\Windows\System\hOaOqWS.exe
  C:\Windows\System\hOaOqWS.exe
  2⤵
  PID:9372
- C:\Windows\System\vCLqKPv.exe
  C:\Windows\System\vCLqKPv.exe
  2⤵
  PID:8200
- C:\Windows\System\mbiRPvq.exe
  C:\Windows\System\mbiRPvq.exe
  2⤵
  PID:13428
- C:\Windows\System\SOFqcsJ.exe
  C:\Windows\System\SOFqcsJ.exe
  2⤵
  PID:13488
- C:\Windows\System\ZkFsJee.exe
  C:\Windows\System\ZkFsJee.exe
  2⤵
  PID:13504
- C:\Windows\System\eApDSMq.exe
  C:\Windows\System\eApDSMq.exe
  2⤵
  PID:13520
- C:\Windows\System\PJHbZok.exe
  C:\Windows\System\PJHbZok.exe
  2⤵
  PID:13540
- C:\Windows\System\aPKSiBP.exe
  C:\Windows\System\aPKSiBP.exe
  2⤵
  PID:13560
- C:\Windows\System\bQQtZFd.exe
  C:\Windows\System\bQQtZFd.exe
  2⤵
  PID:13580
- C:\Windows\System\zgFYiFs.exe
  C:\Windows\System\zgFYiFs.exe
  2⤵
  PID:13608
- C:\Windows\System\sCZxKMw.exe
  C:\Windows\System\sCZxKMw.exe
  2⤵
  PID:13908
- C:\Windows\System\sxZgqgQ.exe
  C:\Windows\System\sxZgqgQ.exe
  2⤵
  PID:14172
- C:\Windows\System\WzcoNrQ.exe
  C:\Windows\System\WzcoNrQ.exe
  2⤵
  PID:14200
- C:\Windows\System\sDGnhOA.exe
  C:\Windows\System\sDGnhOA.exe
  2⤵
  PID:12848
- C:\Windows\System\fWVbhgL.exe
  C:\Windows\System\fWVbhgL.exe
  2⤵
  PID:12836
- C:\Windows\System\LVySsRu.exe
  C:\Windows\System\LVySsRu.exe
  2⤵
  PID:13552
- C:\Windows\System\XvuJIYa.exe
  C:\Windows\System\XvuJIYa.exe
  2⤵
  PID:13604
- C:\Windows\System\EYhHNQs.exe
  C:\Windows\System\EYhHNQs.exe
  2⤵
  PID:11984
- C:\Windows\System\YEnLcWe.exe
  C:\Windows\System\YEnLcWe.exe
  2⤵
  PID:4844
- C:\Windows\System\MgNeVbh.exe
  C:\Windows\System\MgNeVbh.exe
  2⤵
  PID:13988
- C:\Windows\System\fIHsStw.exe
  C:\Windows\System\fIHsStw.exe
  2⤵
  PID:13692
- C:\Windows\System\txQfAJY.exe
  C:\Windows\System\txQfAJY.exe
  2⤵
  PID:14028
- C:\Windows\System\yDxsMar.exe
  C:\Windows\System\yDxsMar.exe
  2⤵
  PID:14088
- C:\Windows\System\nInYLOB.exe
  C:\Windows\System\nInYLOB.exe
  2⤵
  PID:14124
- C:\Windows\System\hIQbVCP.exe
  C:\Windows\System\hIQbVCP.exe
  2⤵
  PID:3988
- C:\Windows\System\YZkPkQx.exe
  C:\Windows\System\YZkPkQx.exe
  2⤵
  PID:5132
- C:\Windows\System\RPNAIwf.exe
  C:\Windows\System\RPNAIwf.exe
  2⤵
  PID:13452
- C:\Windows\System\PYueirg.exe
  C:\Windows\System\PYueirg.exe
  2⤵
  PID:14164
- C:\Windows\System\YqiUTbQ.exe
  C:\Windows\System\YqiUTbQ.exe
  2⤵
  PID:13512
- C:\Windows\System\zcmadYM.exe
  C:\Windows\System\zcmadYM.exe
  2⤵
  PID:13556
- C:\Windows\System\vMHlcCZ.exe
  C:\Windows\System\vMHlcCZ.exe
  2⤵
  PID:13964
- C:\Windows\System\woQHAgR.exe
  C:\Windows\System\woQHAgR.exe
  2⤵
  PID:13080
- C:\Windows\System\OizWZgJ.exe
  C:\Windows\System\OizWZgJ.exe
  2⤵
  PID:13744
- C:\Windows\System\eyhQmuH.exe
  C:\Windows\System\eyhQmuH.exe
  2⤵
  PID:13788
- C:\Windows\System\WFQyCVs.exe
  C:\Windows\System\WFQyCVs.exe
  2⤵
  PID:13820
- C:\Windows\System\UFkhZKK.exe
  C:\Windows\System\UFkhZKK.exe
  2⤵
  PID:14120
- C:\Windows\System\XKewOel.exe
  C:\Windows\System\XKewOel.exe
  2⤵
  PID:4240
- C:\Windows\System\eSvLirR.exe
  C:\Windows\System\eSvLirR.exe
  2⤵
  PID:10072
- C:\Windows\System\BbEmjvU.exe
  C:\Windows\System\BbEmjvU.exe
  2⤵
  PID:13248
- C:\Windows\System\eeskgFz.exe
  C:\Windows\System\eeskgFz.exe
  2⤵
  PID:13808
- C:\Windows\System\ywQkcxr.exe
  C:\Windows\System\ywQkcxr.exe
  2⤵
  PID:13844
- C:\Windows\System\gQSigbM.exe
  C:\Windows\System\gQSigbM.exe
  2⤵
  PID:2476
- C:\Windows\System\nhaQLjT.exe
  C:\Windows\System\nhaQLjT.exe
  2⤵
  PID:14232
- C:\Windows\System\ZyPGCvh.exe
  C:\Windows\System\ZyPGCvh.exe
  2⤵
  PID:12036
- C:\Windows\System\moPjBDL.exe
  C:\Windows\System\moPjBDL.exe
  2⤵
  PID:14236
- C:\Windows\System\JmqfeLI.exe
  C:\Windows\System\JmqfeLI.exe
  2⤵
  PID:14192
- C:\Windows\System\yqwwirV.exe
  C:\Windows\System\yqwwirV.exe
  2⤵
  PID:2644
- C:\Windows\System\xvUlmAn.exe
  C:\Windows\System\xvUlmAn.exe
  2⤵
  PID:7624
- C:\Windows\System\LbxTiTn.exe
  C:\Windows\System\LbxTiTn.exe
  2⤵
  PID:6636
- C:\Windows\System\IlCxLOZ.exe
  C:\Windows\System\IlCxLOZ.exe
  2⤵
  PID:4608
- C:\Windows\System\rFifGoR.exe
  C:\Windows\System\rFifGoR.exe
  2⤵
  PID:12744
- C:\Windows\System\NKusBoW.exe
  C:\Windows\System\NKusBoW.exe
  2⤵
  PID:13364
- C:\Windows\System\taVnINw.exe
  C:\Windows\System\taVnINw.exe
  2⤵
  PID:6340
- C:\Windows\System\TjRqDXi.exe
  C:\Windows\System\TjRqDXi.exe
  2⤵
  PID:14252
- C:\Windows\System\HtjvVBR.exe
  C:\Windows\System\HtjvVBR.exe
  2⤵
  PID:13756
- C:\Windows\System\hCDaCtL.exe
  C:\Windows\System\hCDaCtL.exe
  2⤵
  PID:14140
- C:\Windows\System\jilzSJh.exe
  C:\Windows\System\jilzSJh.exe
  2⤵
  PID:4476
- C:\Windows\System\mSJYYbp.exe
  C:\Windows\System\mSJYYbp.exe
  2⤵
  PID:14076
- C:\Windows\System\zYSvfyu.exe
  C:\Windows\System\zYSvfyu.exe
  2⤵
  PID:10884
- C:\Windows\System\CmYVjpr.exe
  C:\Windows\System\CmYVjpr.exe
  2⤵
  PID:10292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_viu1ry0g.lwi.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BchXVND.exe

Filesize
2.1MB

MD5
6cd30704e00a2dd94e48c8caab632b55

SHA1
57a5f094da8c898ef9019a9e9ba6d5b26452bcce

SHA256
6003a7ed313e98ca3b2717e8e6ecfe3f6796d25e081854ba37e965ef0e86117f

SHA512
13895ed58d64ef8ae505a51a93b4f0624986f6c1b362c1c97391af06ea67f0aea229baaeacbc54cc78d157962f16f0e6f232fa02b17415d7361cc52d62f55962

Download Submit
C:\Windows\System\GZTaqJK.exe

Filesize
2.1MB

MD5
31c62c5c31d44e5c7366ceeeb9550855

SHA1
28457275e846f2ef90fee303ec4b1327003e4bbf

SHA256
8b5081daec4beef70342398b00e9cdba649b22ad0ea02e4badb7d39bdc2597db

SHA512
d307139cfcb76c94fa6f46b842fd9553af02b79773d6a250d93b13ba05f861c1539d7a8e914e985ee06cce01d674e8c5cfd1c0fe1ed9518c9fec170b5510596f

Download Submit
C:\Windows\System\GpfTOgX.exe

Filesize
2.1MB

MD5
dfcb4e5bcaf7188cd161a0d9c2f442cb

SHA1
95ad827eb694f2b6d41cecc64a1b6bb8219745ce

SHA256
24d578ca3b56d16870b9bd4d0a08fd945b61c26b30d16a01e4ceffa855f99b49

SHA512
acc4325899469a418596d2512c043c661da6c91124ad6a38861b2f19c8340a128ceb3443e9a5b90c7782263093c5482b68a28433b388866ca58560716885e54c

Download Submit
C:\Windows\System\HGSoebT.exe

Filesize
2.1MB

MD5
b7bd851c453bf89be2aa277a18e508da

SHA1
a9430149a63c1accd320b72d16e0687f49268dcb

SHA256
f7a2554fbb6de1c698821648965893a46e52b00c0af4ddee5f6dd654017acefc

SHA512
188d69b5c688354d38a456508ba7c471571487e7c2af64f4fd01fbd5eaa755888354e6ba38df69545124975f46bf5392c129e387d7d287d18deed26e445efda2

Download Submit
C:\Windows\System\HsLvEwK.exe

Filesize
2.1MB

MD5
aff15e9bc678855f3f179ae76cd210b2

SHA1
f9458985ac105b6a7252409f53f8ad36ef828bac

SHA256
ccac8a0b46332a050d47638d6b46371ecffc0bd3b3da20d8429cc0c675575ae0

SHA512
3b2326aeeb0979d36576b22ae0b1c68742af44bd804bd7f61e9fa1f36a9c8d45d373908b7171799a1b390919c9994c29de608b70a41b7fdaf86345773c3a86f0

Download Submit
C:\Windows\System\IMWVjwH.exe

Filesize
2.1MB

MD5
53f3609ab5d0815485da8c8aac3f38be

SHA1
d136e561447af636af1d0d1411df0b26ee381d01

SHA256
7ee4123131dd5a133002f4741a9a9a30085179ba1b42eca13ddeafe7fcb67b87

SHA512
517339fbf5c3ac478b19e7fe0d404cd8006dcd3196993e5fe2b7151d75b22d3fbdf9ff364039c86b7646fc5709ac6fe05d46a715f718771e62761476d95fc0c3

Download Submit
C:\Windows\System\JEDwAJP.exe

Filesize
2.1MB

MD5
e7fec0990a9f1d9efacd51bdca8a264a

SHA1
67e9c1dbbce05e1afa9a287d5fd1c133bea9534b

SHA256
c30c00f35fb5dcbf3ae9b33293046400006988beed823ffa502e96162e0267a0

SHA512
8b6c0e9cb0b2cf71756baed02d656dd2940a6dd6231f0b79a76be2538d38b8f9cee1d6160f81f000da47ee4b6da852beff590280a1828cd0b902ea7d0fc7aa1a

Download Submit
C:\Windows\System\JQgXoVE.exe

Filesize
2.1MB

MD5
ea6d8d446c6356ff8e48fa610dc50245

SHA1
59e980c6eebfbe62511e8ed06b28bd3666b25d9e

SHA256
3c8e6d51e9d223d0d736ee7cc11984bc2002964f357a20ce3326e12b1b691fa5

SHA512
4a560718bf516aa091bd10eb0b764162c4a11e1c063ca76529e9820ab3f0f43b23d11bb69615bfcf8891497da184359288c97f6587ecf3ac9f5a3a90a5a88492

Download Submit
C:\Windows\System\KrDgrdB.exe

Filesize
2.1MB

MD5
d5ece68c3abf8974cd7add486357f741

SHA1
e4934296dd5f1a462ee20ccd191262b16389278e

SHA256
5c9bd527b22f93214c73d3de5f77df626cc1103ce219f09c6b77f22d10111276

SHA512
78af84eb4b6329b52ee4e1c0dba8a36bc9dc75d31f7cb385607b2d0922f748695e8898a19203b3257b95a3cf607ee8ef0f0b8118bf57f6e62a95e63263a7a424

Download Submit
C:\Windows\System\KylxTBN.exe

Filesize
2.1MB

MD5
072095e5b2a3bd5c3894ea3b80ebd777

SHA1
6bdbcd48599a81d32820bd72e1118532a4f33589

SHA256
8f59bf4028713965a7f6a4561b7f398ce8a3182d530befa523476dadfc566446

SHA512
b2429c4a337e4cd96d79de90839d271a0d13d2f685f348c6ba21d40c1acc6d16f0e0ec7964dc4b4217890f0f2cfec4449d402936bb21c118f72ccb89ac06264d

Download Submit
C:\Windows\System\NZjXnjo.exe

Filesize
2.1MB

MD5
79a95bc52be16ece8fa2666939d43b62

SHA1
4f9d37cca44693efa3b4fce2eba53160b1e99993

SHA256
b79e337672fbf7382e9f2acf96046613ee07d6ef88fc94f853bb8cfe155ff774

SHA512
48094dda80bbd9bcae6131622dd8144fd8a473afc17dc333cd56fd9ebde4535b5a65f636e685410dbc6e64e5d4a88105e23b966dd2572ee1efe1c16a4b14df43

Download Submit
C:\Windows\System\Naglqsx.exe

Filesize
2.1MB

MD5
8fe0b4ec661c92a0fab94b4274aa6f32

SHA1
85f21b2ed71082f28f2b7eddaa8480dd45b2cd1b

SHA256
6c2740b7b6b08cfb7263da9bcdb84e670e9a1a515f5b6194c9f063dd468eb910

SHA512
0e1cea1573b28c432d5154cadcbc6b3cb72f59917e30be023543a68980b941c5a86e8e0cda3445d83040f0488cca78431483703d27a27423f5f7b365b753ffb4

Download Submit
C:\Windows\System\NapXIzK.exe

Filesize
2.1MB

MD5
e6a92a90a293f73ec046dc3398751c79

SHA1
ac13fe00dd4450efb89fec5427ba7effb06c42ed

SHA256
f9ec8144e75d5be965f60409ec93c74d13bd997eea8995a30c1f923455b249e0

SHA512
2561d998a9481a690397d9a86b638a58f07b5b3de9d2b8ee0951b390f887600eed4fedd9826bc1d2dfe9b00e55be913f1ac7de67cd4531463a8bf81468004143

Download Submit
C:\Windows\System\OEQFVwV.exe

Filesize
2.1MB

MD5
0489b06478e0707802638d00da35f181

SHA1
affb8110230a175e0ab2172efb0b1d4612b0fdda

SHA256
5c26fbc81bf04c9090b34dd432f3e69aa798ea06f76338c2e733e3723411fc72

SHA512
3191e1ae48dd6e8dbe35dbfc3d2e71d408b9cbd034ab1cf2dc5612da893276a59362d28cb7d37cce12dab70f8cc59203eaf023b9f08b4af2fb2436bf27ddb768

Download Submit
C:\Windows\System\OeYefXL.exe

Filesize
2.1MB

MD5
6bd6054bb35f8f56bec4821ce64a2cc3

SHA1
2839bbb38c3e48f2bffd0c18c27a36ffd920215d

SHA256
eabbdd0bd0e056eda83d0b0f4271eda88119620b359374e77daff0ba94efac49

SHA512
b2ffa82c66906a5fd6247323d0680ad8921257421ac23858b911d36257a648eae47efc48995ab7973a7f8c4352bb9e8f597c89faf401c742c7d9e20e01b1d247

Download Submit
C:\Windows\System\SMYNdgN.exe

Filesize
8B

MD5
6e243c8b38e3d92f12c1f3eed40a3381

SHA1
9cddf51e5ed1489561f7f07e24dbb0373375660c

SHA256
3b6442d24e80d27600c9f4b799385788d98c70d600c89b99f83b72de8a2d37b2

SHA512
1198fd093d8b9db02c218d5c2855535582ecbe96e17ed1d7c0e3e5f22338aecda2fcb8f90f131612a5aa5269b550a96f2f4d4d31468134ed76bcb198b6885ad2

Download Submit
C:\Windows\System\SiiOObB.exe

Filesize
2.1MB

MD5
d13c29dcd267e17dd08eb15076287645

SHA1
314f859b4e57143beba2f93949c8c4076af3511c

SHA256
bbf559bf7797b32c22a7a082ad0ef687a0bdf97cb7ec77af6574380cd815d307

SHA512
be21a7f0804d3eae602297a7f7297a129384f6d66fd95376d36f14b3aa88e8ab8a56bc28391c6d072317f41a4a611faff67ba39be6135b1f2345929fd0b76ce4

Download Submit
C:\Windows\System\TeHkisy.exe

Filesize
2.1MB

MD5
32fcced0ab1be598df1a5236d7d57241

SHA1
650a7f51cad7c97e13db25434738b1f618484259

SHA256
0f530b90da59d0afd5c583e5f70c8b14e254c593591d59cd02f0d760a1cabf4a

SHA512
b7267590fa92f2ada6db48f532ded78ec30d43561f4deb4e6f7862fe3cc18e1aeb6bcf2593742e00058fa6371e1e69bd9f03b2010c7a7066ad5d10310d18c03b

Download Submit
C:\Windows\System\UqBMcmv.exe

Filesize
2.1MB

MD5
579a8dfdda24bba27dcbbc40f446bcb1

SHA1
674ea36e6aa3964e5cb0ecda87fca37e15a08dbf

SHA256
8462cf2b920f8abb3bb870d37fdb1e03fa7ed370d55ce2475540adfb3e2272c0

SHA512
5d8b608b07b95f4ff2aa56692a1f96c1064a42137aba22db54108000979f0e7e41d9295a80a242364f21518e80f83d274b28405f21b1ff00c3cfa9e3536cb407

Download Submit
C:\Windows\System\YFimSJw.exe

Filesize
2.1MB

MD5
f393ea19d25eff381b9caa76ed222a38

SHA1
be76004cb075db351f3c429bd5ff91434bc1741c

SHA256
54bd52d7296b632ad3ec8daf4151feea922536024b39556093f44bdcf9992ab9

SHA512
4dc741a3b0dca2a85765642ad3cc4ba420d75a673380a4fccc1be463c2a428b5631ecbb753ec4534eff9c20f53a129f40b83599bb7acdf9df50d4c4b301fd196

Download Submit
C:\Windows\System\arfACFf.exe

Filesize
2.1MB

MD5
fdd68f03eed3b5881f1430e703f40ce4

SHA1
578521cb838dfb71135b49f241018d0212fa4cdc

SHA256
6f60679295b12dbee4e886d428f486d25cb53bacec2dcb4c488988cf57529a2c

SHA512
3395ac2f5651ada3bee970c84f6cb56a6e7052521f963fc5cadfa0c1abf1a807cc78eff99d7bdf2bc566910b8e596274d8bd4ad5410af79d1e0471b54ed2a0b6

Download Submit
C:\Windows\System\cHNNbSG.exe

Filesize
2.1MB

MD5
cbc808ba78e0760928df69b4810e507a

SHA1
48f9fb9dad8d4ee27bfaa94afb6bf350d6d17d6f

SHA256
9724f2e646855c3ad8ee64e0bec71c7f1fc1189f50758f3962042f61ce1524c1

SHA512
ee22403adaa6bcd950166a7f965793254c90507ab2a11e388e7f503484d287104afae955b935e3a04614822542663660d678cef18a3612b152607ffbd2c887af

Download Submit
C:\Windows\System\cQxXdQu.exe

Filesize
2.1MB

MD5
6469dd20e8f9280f03826178c77e8143

SHA1
be930b630cbcbd2470eec0d891c8ad461c73f7a7

SHA256
670320e93337dc2eb627d0c9c932228d6b05dfc043da7100d24fb67583131112

SHA512
177bb09504144e8de0dc43ad38ec64b18051f2157b99908d6d7cac47297a410b9582fdfb0d7d4dccf1245023f1f0414184496778cf92b14248988656d5c17772

Download Submit
C:\Windows\System\eLGtLMK.exe

Filesize
2.1MB

MD5
0cf5b5c964858f39eb420390b84dc548

SHA1
aec394f8f622746f4c2a71cef1a84cf0d9268ae3

SHA256
e658728f6d72a515303d3430ad17c662fb20fded8152565a39c4771ef1e214e6

SHA512
50edf348a10dca5b6f7c105ac380e8362cc127f2fc1090e1e2dc59c95f36648e2e28a42739cd292f076ec54e8b9fe438c31da3d9292c954a23eff7610ffc72ee

Download Submit
C:\Windows\System\hXAcnps.exe

Filesize
2.1MB

MD5
d90d357213d411d9386f3fc6f7a47b2c

SHA1
ef88aa90cf1a7b6bd68be5d7b284fd251e2fb725

SHA256
43a6e4c4f5c36c2ae8ba330b810ea6e38c36403d65c5738cb759dee3036ff90d

SHA512
50af7252c45d4768da5884b9cf9944578fbb4d482e8bc7efdc8889a70846a1ec74e9aa5852f073a49ed3c7977bf552423a5192339af4497617ae8b027439842d

Download Submit
C:\Windows\System\hZGZRKE.exe

Filesize
2.1MB

MD5
5c618af67e524224c8025bb6dcb79685

SHA1
c527c30f23a7ed0b95fc52254c09b86cf69646ff

SHA256
cbcd6804881f489b85126c48db7fb32a422f10071ad41ef088532617a4e0a1cc

SHA512
1a89e2caed3a0b63dd6f8805e597da60cc90a59799452313af184f9e0b658ff1588985b75bc645183183475372e9aeef86c085709cd92fcf4e4e42b0f3924574

Download Submit
C:\Windows\System\inHWjfU.exe

Filesize
2.1MB

MD5
b6ec8ab496ec29a5becc867fd5217ada

SHA1
74e07f5b8e705a7715390f2c9866901bb41ee04e

SHA256
93d1cd76994bb9f02dc890a16c55d5dea6c8d512b51483dd22fed67ebe23be58

SHA512
825816b677b8716c3358f64f2b704867acc9094872f12160363292c6f827a497b7d687172be6f9090cc62ec79f6c3e0b718859f28ad4b307d58845f27f2e7432

Download Submit
C:\Windows\System\lHYVHFB.exe

Filesize
2.1MB

MD5
a650d674b5288356646f8e2099e32776

SHA1
781821633cf625f7c3ea15cd38324d2b136b353a

SHA256
ca3a68bd253d7a94b37f98c06c59560137fd4a2670d96cc1b8e898a0818efbe1

SHA512
8b99ac83625847885bbb3d02f7cb3cd7f1ddd46630c9f3c476fea5c7cef39686705fe70458f8871608409088075d40b43ad796491b064f667f67e8c7d30818fa

Download Submit
C:\Windows\System\mryNIWS.exe

Filesize
2.1MB

MD5
9976719ea838e0e21bb26fc48cc98e25

SHA1
bb0a3615822d89d5344ab511f9e38756ff4c16ea

SHA256
152212819ff2950db8869783a1407abaa22f5e16dc6ad766b9272a67c09145c8

SHA512
cc6eb319eccd9249916ecb6dbcaabad951789209110107ce45bce2a57e87a8634a742f445d3c8d0863a55b2c98ebb40cdfa91d7da0ed397f0cb20934c7694bc2

Download Submit
C:\Windows\System\ngfJiXK.exe

Filesize
2.1MB

MD5
66a200784aa8ef5c77259ebb5d51af83

SHA1
7d650e9ac2d9e225470aaa62a69a2ffc9cd6ee79

SHA256
d2d38bd61d744aa8847f64502457e3d8b1aae49fc5358ea48105a11a9f67f9ca

SHA512
b4141ccbb1f6dabd6d368280983b11568004574f72755d91b2b0702b50e9024c438dff12b95230b4d9f077998f3072b614d568e4b762500223411e541d988277

Download Submit
C:\Windows\System\oTkEzBF.exe

Filesize
2.1MB

MD5
b0c09d774f5bfc397659edbd68420284

SHA1
7e432bb1ccca36c3aaad5d53fccc09c2804a193e

SHA256
37e41a1d99f836c92d654f4a7b9aec4e8914ee8e624e3efc682d9c5edd134528

SHA512
bd64289805735496bf7b2507e1c16cb17cc277586d8c2cbb7f92cc7e391bbbc6c8d0972d78a4b38872485e6a16c6022ad523f89eb226e2c6a4dd16c5774546e3

Download Submit
C:\Windows\System\qOTOOfX.exe

Filesize
2.1MB

MD5
89e0a5d02ce64ffdf1cb2a3469cad827

SHA1
5a06ea0a21107e2c0367f5ae4874c2c29eddf876

SHA256
bee4f312b384a0235f1e8c0dd7697714cfcb4c9d6c592ea120e60384a345703d

SHA512
5c6f34b8d7e9cb5da6c42a42c8c15d3a46104b6ae19040815fa49803cb2dad9721c5626ee45238f34535bcb636c8ee0e004bb3fa47494cd1b297a7d6b7c33d5e

Download Submit
C:\Windows\System\rlGaaWv.exe

Filesize
2.1MB

MD5
ed6cebbb214cb9f3f1e5bb3c07b745eb

SHA1
4916a8b95c392632aee631a8d338eeca4f71f2c5

SHA256
5b11b16e995a88cff3cefc09921c4e4880adf762c14ba09a2729eb2fab47673d

SHA512
9179a673dc359d2ad75b78d717ffa81110413855cb142a21d83d82fb9370908907b3ba3b7051deddd680d6d8ecd75797e9ac5e3f639cc562e8c9176b8f93d039

Download Submit
C:\Windows\System\rlXFCNx.exe

Filesize
2.1MB

MD5
a09d4c29aa3c64dfee4b4db944029484

SHA1
5b28d9a188501c8a4b924b1e953b112aa6ffb1fa

SHA256
49dd57b17e38d678833ad4037d78007c402e6a192ada7998ccbbcdbd73b9115c

SHA512
8f27e7a2bfd1e0f7cb62194d234adbd021ad4bf81fdf7398acd1763f79c24d84f2b6c42b7ba866b6c4a98b567a077cef4089a8902c4d5472afc5768e89b3e591

Download Submit
C:\Windows\System\sIUYVOg.exe

Filesize
2.1MB

MD5
fa9aca9e104aac9def2394312017f133

SHA1
63b3ad4f5874e0e145751e72cfece2d634654638

SHA256
3245aac56376ce3e36d678646a6ba025f312166b3d6e3b47f7b3815a90c6c934

SHA512
258926d865a058aea96656e2dbab29ed8eb658885fb0e09aaa9064d41cf6642a3e283f4e4f6adf8d8d3ba420b9adcffc59c204f137be9802fe53102e9e27e86f

Download Submit
C:\Windows\System\spRMvUC.exe

Filesize
2.1MB

MD5
2d3a86496b94b1068e425f3e271b3e42

SHA1
26877ad812488b337eb3afa9d6ac997b9cacf268

SHA256
0a66c6f5eb03f423c2ea5d765157646313f9f4c3147e7300345f3b5cfbd7bc69

SHA512
738a9ff9693e0b425b0f611f9ec88f6021d9e2122df418471ffe397764bd40324a9d171b2cd54cba1e0d75fe3d61fda44ea95618dd18d413872fae39bb453461

Download Submit
C:\Windows\System\uiVCznP.exe

Filesize
2.1MB

MD5
d2010ec01fa29ff81dcb8e2b02a0a92c

SHA1
9d7ebc14fe8966e5bdda8cc443be007aec7efc2f

SHA256
7a2c1968a467160667c47566608db4ac23730d5d0e9b4e8576f3c509d68411bd

SHA512
b869451b2e66634721ca7c0ac2ff170328db25119acea3d21a58ee292112d5f1190e739bb62bfd2ccdbb46e50321611aba79f37b552ab2936d608aa415396a70

Download Submit
C:\Windows\System\vsITGfB.exe

Filesize
2.1MB

MD5
2b7ddb73065e2ce3193ae824b9e7aba4

SHA1
5c96d81c5b3f9bf00340a566be7fe85b866169dc

SHA256
49d9bc319137e18b4f7169210f94471702782c45dc5e6ef168618c35136aae7b

SHA512
43eef85efb74b7d0d78d2e135ba618f0dcbaf2b5729aaa0f61511a2b17e30a4ed0fbb024655f9ae9ef504c596e428c21e2e7526f11cfbe553b05944d49abd8d8

Download Submit
C:\Windows\System\wzXYtWY.exe

Filesize
2.1MB

MD5
48bc3e79ca2c875508edff947e61e72a

SHA1
5124f70a95ab6406790588697894b94fc0eb2ebd

SHA256
29102721ba1f96711157332b7ef5852f20730e21a28c3d3c5c37f5f1dc39ba68

SHA512
b99ea834306fe51f3b5b3df439803341e640e3d46e7730bf737f7e749c237e2ad39c639aa8b8d2c69b24ac2e8e26a5ad25c620ba0696047247807fb1fb8ab167

Download Submit
C:\Windows\System\zVOPwMF.exe

Filesize
2.1MB

MD5
8b64e48b298a0c9b12a12a0072ce5349

SHA1
35eccc674db735fc2bf443799e759201d6bd1f09

SHA256
870c7d5a3c3fbfe6ae2b8192665cd40a069ae9e63396038a3abe595e66aac571

SHA512
f5bb158647658ba57a391cdd97676344281f4bc9536029ae46c89fd6a0dfdd4ba5740d5b9e2cfc7a428d026520fd45914ce3f4745421a829565cf6fb5583dbbc

Download Submit
memory/668-22-0x00007FF66EE10000-0x00007FF66F202000-memory.dmp

Filesize
3.9MB

Download
memory/1064-1121-0x00007FF65D200000-0x00007FF65D5F2000-memory.dmp

Filesize
3.9MB

Download
memory/1200-250-0x00007FF7CE0D0000-0x00007FF7CE4C2000-memory.dmp

Filesize
3.9MB

Download
memory/1216-137-0x00007FF6B6510000-0x00007FF6B6902000-memory.dmp

Filesize
3.9MB

Download
memory/1620-0-0x00007FF65F280000-0x00007FF65F672000-memory.dmp

Filesize
3.9MB

Download
memory/1620-1-0x00000202DCFF0000-0x00000202DD000000-memory.dmp

Filesize
64KB

Download
memory/1628-1672-0x00007FF7A8970000-0x00007FF7A8D62000-memory.dmp

Filesize
3.9MB

Download
memory/1760-1304-0x00007FF607480000-0x00007FF607872000-memory.dmp

Filesize
3.9MB

Download
memory/1828-649-0x00007FF652860000-0x00007FF652C52000-memory.dmp

Filesize
3.9MB

Download
memory/1992-106-0x00007FF6091A0000-0x00007FF609592000-memory.dmp

Filesize
3.9MB

Download
memory/2016-1519-0x00007FF73DB50000-0x00007FF73DF42000-memory.dmp

Filesize
3.9MB

Download
memory/2032-467-0x00007FF7E7840000-0x00007FF7E7C32000-memory.dmp

Filesize
3.9MB

Download
memory/2760-1522-0x00007FF7AE520000-0x00007FF7AE912000-memory.dmp

Filesize
3.9MB

Download
memory/3116-183-0x00007FF6C5000000-0x00007FF6C53F2000-memory.dmp

Filesize
3.9MB

Download
memory/3264-1307-0x00007FF611590000-0x00007FF611982000-memory.dmp

Filesize
3.9MB

Download
memory/3824-252-0x00007FF658450000-0x00007FF658842000-memory.dmp

Filesize
3.9MB

Download
memory/3936-1124-0x00007FF726710000-0x00007FF726B02000-memory.dmp

Filesize
3.9MB

Download
memory/4100-210-0x00007FF7C1510000-0x00007FF7C1902000-memory.dmp

Filesize
3.9MB

Download
memory/4280-1671-0x00007FF7BA780000-0x00007FF7BAB72000-memory.dmp

Filesize
3.9MB

Download
memory/4440-75-0x00007FFEBE1D0000-0x00007FFEBEC91000-memory.dmp

Filesize
10.8MB

Download
memory/4440-304-0x000001D0B37C0000-0x000001D0B37E2000-memory.dmp

Filesize
136KB

Download
memory/4440-23-0x00007FFEBE1D3000-0x00007FFEBE1D5000-memory.dmp

Filesize
8KB

Download
memory/4440-392-0x00007FFEBE1D0000-0x00007FFEBEC91000-memory.dmp

Filesize
10.8MB

Download
memory/4464-1516-0x00007FF760DC0000-0x00007FF7611B2000-memory.dmp

Filesize
3.9MB

Download
memory/4728-251-0x00007FF6108D0000-0x00007FF610CC2000-memory.dmp

Filesize
3.9MB

Download
memory/4932-555-0x00007FF773DA0000-0x00007FF774192000-memory.dmp

Filesize
3.9MB

Download
memory/5020-474-0x00007FF7C2210000-0x00007FF7C2602000-memory.dmp

Filesize
3.9MB

Download
memory/5044-1669-0x00007FF668C10000-0x00007FF669002000-memory.dmp

Filesize
3.9MB

Download