xmrig | a937524b9e317fbd93a85084c8d506fac0089d8392b191631e9288ee8c892319

Analysis

max time kernel
91s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 15:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
Size

2.1MB
MD5

75f4437eee389bd5b0135954296ee7ef
SHA1

fa0b7cece0ed340c44f3a15091ae8f88825e89b2
SHA256

a937524b9e317fbd93a85084c8d506fac0089d8392b191631e9288ee8c892319
SHA512

4b3ae7035765feb0bf613cf40425680bc8add21d61bada80de56b2dcfd4455a7d40f6fd8831f11688767830d0d330d68effaf0fb8c934531ab726038f1154d18
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMN3:NABl

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/4516-273-0x00007FF6D7750000-0x00007FF6D7B42000-memory.dmp	xmrig
behavioral2/memory/408-449-0x00007FF7653B0000-0x00007FF7657A2000-memory.dmp	xmrig
behavioral2/memory/748-503-0x00007FF7F41A0000-0x00007FF7F4592000-memory.dmp	xmrig
behavioral2/memory/3232-567-0x00007FF6586F0000-0x00007FF658AE2000-memory.dmp	xmrig
behavioral2/memory/2528-570-0x00007FF772FE0000-0x00007FF7733D2000-memory.dmp	xmrig
behavioral2/memory/4464-572-0x00007FF78F2A0000-0x00007FF78F692000-memory.dmp	xmrig
behavioral2/memory/1420-571-0x00007FF70A530000-0x00007FF70A922000-memory.dmp	xmrig
behavioral2/memory/1480-569-0x00007FF723650000-0x00007FF723A42000-memory.dmp	xmrig
behavioral2/memory/3252-568-0x00007FF64F690000-0x00007FF64FA82000-memory.dmp	xmrig
behavioral2/memory/3644-566-0x00007FF691E70000-0x00007FF692262000-memory.dmp	xmrig
behavioral2/memory/3008-565-0x00007FF7DC030000-0x00007FF7DC422000-memory.dmp	xmrig
behavioral2/memory/2284-445-0x00007FF6A2710000-0x00007FF6A2B02000-memory.dmp	xmrig
behavioral2/memory/1300-380-0x00007FF67ED00000-0x00007FF67F0F2000-memory.dmp	xmrig
behavioral2/memory/3540-344-0x00007FF6194E0000-0x00007FF6198D2000-memory.dmp	xmrig
behavioral2/memory/3340-317-0x00007FF61F5D0000-0x00007FF61F9C2000-memory.dmp	xmrig
behavioral2/memory/912-343-0x00007FF6CA050000-0x00007FF6CA442000-memory.dmp	xmrig
behavioral2/memory/4332-268-0x00007FF645DC0000-0x00007FF6461B2000-memory.dmp	xmrig
behavioral2/memory/4568-229-0x00007FF758870000-0x00007FF758C62000-memory.dmp	xmrig
behavioral2/memory/2712-204-0x00007FF6A81B0000-0x00007FF6A85A2000-memory.dmp	xmrig
behavioral2/memory/1116-158-0x00007FF6B4530000-0x00007FF6B4922000-memory.dmp	xmrig
behavioral2/memory/4756-129-0x00007FF623050000-0x00007FF623442000-memory.dmp	xmrig
behavioral2/memory/4244-122-0x00007FF756540000-0x00007FF756932000-memory.dmp	xmrig
behavioral2/memory/1044-104-0x00007FF675880000-0x00007FF675C72000-memory.dmp	xmrig
behavioral2/memory/5100-83-0x00007FF660BE0000-0x00007FF660FD2000-memory.dmp	xmrig
behavioral2/memory/5100-3266-0x00007FF660BE0000-0x00007FF660FD2000-memory.dmp	xmrig
behavioral2/memory/1480-3268-0x00007FF723650000-0x00007FF723A42000-memory.dmp	xmrig
behavioral2/memory/4244-3270-0x00007FF756540000-0x00007FF756932000-memory.dmp	xmrig
behavioral2/memory/1044-3272-0x00007FF675880000-0x00007FF675C72000-memory.dmp	xmrig
behavioral2/memory/4756-3274-0x00007FF623050000-0x00007FF623442000-memory.dmp	xmrig
behavioral2/memory/2712-3276-0x00007FF6A81B0000-0x00007FF6A85A2000-memory.dmp	xmrig
behavioral2/memory/4568-3280-0x00007FF758870000-0x00007FF758C62000-memory.dmp	xmrig
behavioral2/memory/1116-3279-0x00007FF6B4530000-0x00007FF6B4922000-memory.dmp	xmrig
behavioral2/memory/4332-3282-0x00007FF645DC0000-0x00007FF6461B2000-memory.dmp	xmrig
behavioral2/memory/2528-3284-0x00007FF772FE0000-0x00007FF7733D2000-memory.dmp	xmrig
behavioral2/memory/3540-3286-0x00007FF6194E0000-0x00007FF6198D2000-memory.dmp	xmrig
behavioral2/memory/1300-3289-0x00007FF67ED00000-0x00007FF67F0F2000-memory.dmp	xmrig
behavioral2/memory/4516-3291-0x00007FF6D7750000-0x00007FF6D7B42000-memory.dmp	xmrig
behavioral2/memory/2284-3295-0x00007FF6A2710000-0x00007FF6A2B02000-memory.dmp	xmrig
behavioral2/memory/3644-3303-0x00007FF691E70000-0x00007FF692262000-memory.dmp	xmrig
behavioral2/memory/1420-3309-0x00007FF70A530000-0x00007FF70A922000-memory.dmp	xmrig
behavioral2/memory/3232-3308-0x00007FF6586F0000-0x00007FF658AE2000-memory.dmp	xmrig
behavioral2/memory/3340-3305-0x00007FF61F5D0000-0x00007FF61F9C2000-memory.dmp	xmrig
behavioral2/memory/912-3302-0x00007FF6CA050000-0x00007FF6CA442000-memory.dmp	xmrig
behavioral2/memory/4464-3299-0x00007FF78F2A0000-0x00007FF78F692000-memory.dmp	xmrig
behavioral2/memory/748-3297-0x00007FF7F41A0000-0x00007FF7F4592000-memory.dmp	xmrig
behavioral2/memory/3252-3319-0x00007FF64F690000-0x00007FF64FA82000-memory.dmp	xmrig
behavioral2/memory/408-3318-0x00007FF7653B0000-0x00007FF7657A2000-memory.dmp	xmrig
behavioral2/memory/3008-3315-0x00007FF7DC030000-0x00007FF7DC422000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4876	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1480	EgpGJYF.exe
5100	VYsliFk.exe
1044	HlYRykH.exe
4244	esSxJsZ.exe
4756	GiAxKnh.exe
1116	lrnKSpW.exe
2712	xHPqFJv.exe
2528	BuZYgzt.exe
4568	tQFaKqV.exe
4332	nAvueXB.exe
4516	VxxsLYg.exe
3340	UoJndih.exe
912	QshMwNj.exe
3540	GJtChit.exe
1420	IQkfQln.exe
1300	avjZgUW.exe
2284	JYWKwbY.exe
408	mKFaMma.exe
748	DdjBqeo.exe
3008	raGghCw.exe
4464	lQMukFV.exe
3644	DQOXUvj.exe
3232	RyJnoTo.exe
3252	MoWOnVF.exe
1376	OWIwQnp.exe
2244	VjZudGJ.exe
4860	MoFAFNm.exe
4924	VkhBVao.exe
1032	ilRFJVu.exe
4436	ZZAhPII.exe
1980	oUTlpIp.exe
2156	WECrCLP.exe
2072	ZTQTXXh.exe
4036	xFamteV.exe
3876	IWlqkFy.exe
1984	ggIyEzL.exe
4192	vrzyHPQ.exe
1400	eiEbgry.exe
1040	okuJocY.exe
3624	bsHPDfT.exe
3568	qfAUkpu.exe
1372	qUYZXMR.exe
3652	TOggQzG.exe
4420	ZxpOvJm.exe
1508	PRDBRHe.exe
4388	XRdyexF.exe
3380	GKATCwj.exe
4204	VUVHZfn.exe
1516	LcMxqUr.exe
2356	PftkYKY.exe
3348	JoVhiev.exe
632	iZIQgUw.exe
3776	OcjOEjb.exe
4440	pdjnSoy.exe
5028	UxEFZCU.exe
3880	GIyLzkY.exe
736	XRoZzck.exe
2884	lneAPhp.exe
2004	ogihCZa.exe
3764	zWWbqdA.exe
4892	iSsrpNP.exe
4480	BXCKQku.exe
3292	lviaVJo.exe
3276	sHdirno.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1460-0-0x00007FF6F0E00000-0x00007FF6F11F2000-memory.dmp	upx
behavioral2/files/0x000700000002342e-8.dat	upx
behavioral2/files/0x000700000002342d-11.dat	upx
behavioral2/files/0x000a000000023421-10.dat	upx
behavioral2/files/0x0007000000023431-34.dat	upx
behavioral2/files/0x0007000000023430-42.dat	upx
behavioral2/files/0x0007000000023444-116.dat	upx
behavioral2/files/0x0007000000023445-188.dat	upx
behavioral2/memory/4516-273-0x00007FF6D7750000-0x00007FF6D7B42000-memory.dmp	upx
behavioral2/memory/408-449-0x00007FF7653B0000-0x00007FF7657A2000-memory.dmp	upx
behavioral2/memory/748-503-0x00007FF7F41A0000-0x00007FF7F4592000-memory.dmp	upx
behavioral2/memory/3232-567-0x00007FF6586F0000-0x00007FF658AE2000-memory.dmp	upx
behavioral2/memory/2528-570-0x00007FF772FE0000-0x00007FF7733D2000-memory.dmp	upx
behavioral2/memory/4464-572-0x00007FF78F2A0000-0x00007FF78F692000-memory.dmp	upx
behavioral2/memory/1420-571-0x00007FF70A530000-0x00007FF70A922000-memory.dmp	upx
behavioral2/memory/1480-569-0x00007FF723650000-0x00007FF723A42000-memory.dmp	upx
behavioral2/memory/3252-568-0x00007FF64F690000-0x00007FF64FA82000-memory.dmp	upx
behavioral2/memory/3644-566-0x00007FF691E70000-0x00007FF692262000-memory.dmp	upx
behavioral2/memory/3008-565-0x00007FF7DC030000-0x00007FF7DC422000-memory.dmp	upx
behavioral2/memory/2284-445-0x00007FF6A2710000-0x00007FF6A2B02000-memory.dmp	upx
behavioral2/memory/1300-380-0x00007FF67ED00000-0x00007FF67F0F2000-memory.dmp	upx
behavioral2/memory/3540-344-0x00007FF6194E0000-0x00007FF6198D2000-memory.dmp	upx
behavioral2/memory/3340-317-0x00007FF61F5D0000-0x00007FF61F9C2000-memory.dmp	upx
behavioral2/memory/912-343-0x00007FF6CA050000-0x00007FF6CA442000-memory.dmp	upx
behavioral2/memory/4332-268-0x00007FF645DC0000-0x00007FF6461B2000-memory.dmp	upx
behavioral2/memory/4568-229-0x00007FF758870000-0x00007FF758C62000-memory.dmp	upx
behavioral2/files/0x000700000002343a-207.dat	upx
behavioral2/memory/2712-204-0x00007FF6A81B0000-0x00007FF6A85A2000-memory.dmp	upx
behavioral2/files/0x000900000002342a-203.dat	upx
behavioral2/files/0x000800000002343d-202.dat	upx
behavioral2/files/0x000700000002344e-200.dat	upx
behavioral2/files/0x0007000000023449-198.dat	upx
behavioral2/files/0x0007000000023448-184.dat	upx
behavioral2/files/0x000700000002344d-180.dat	upx
behavioral2/files/0x000700000002344c-176.dat	upx
behavioral2/files/0x000700000002343f-175.dat	upx
behavioral2/files/0x000700000002344b-170.dat	upx
behavioral2/files/0x0007000000023443-166.dat	upx
behavioral2/files/0x000700000002343c-159.dat	upx
behavioral2/memory/1116-158-0x00007FF6B4530000-0x00007FF6B4922000-memory.dmp	upx
behavioral2/files/0x000700000002344a-152.dat	upx
behavioral2/files/0x0007000000023446-146.dat	upx
behavioral2/files/0x0007000000023442-191.dat	upx
behavioral2/files/0x0007000000023440-144.dat	upx
behavioral2/files/0x000800000002343e-142.dat	upx
behavioral2/files/0x0007000000023439-136.dat	upx
behavioral2/files/0x0007000000023433-134.dat	upx
behavioral2/files/0x0007000000023437-133.dat	upx
behavioral2/files/0x0007000000023436-131.dat	upx
behavioral2/files/0x0007000000023441-162.dat	upx
behavioral2/memory/4756-129-0x00007FF623050000-0x00007FF623442000-memory.dmp	upx
behavioral2/files/0x0007000000023447-126.dat	upx
behavioral2/memory/4244-122-0x00007FF756540000-0x00007FF756932000-memory.dmp	upx
behavioral2/files/0x000700000002343b-119.dat	upx
behavioral2/files/0x0007000000023438-106.dat	upx
behavioral2/memory/1044-104-0x00007FF675880000-0x00007FF675C72000-memory.dmp	upx
behavioral2/files/0x0007000000023435-97.dat	upx
behavioral2/files/0x0007000000023434-89.dat	upx
behavioral2/memory/5100-83-0x00007FF660BE0000-0x00007FF660FD2000-memory.dmp	upx
behavioral2/files/0x0007000000023432-56.dat	upx
behavioral2/files/0x000700000002342f-30.dat	upx
behavioral2/memory/5100-3266-0x00007FF660BE0000-0x00007FF660FD2000-memory.dmp	upx
behavioral2/memory/1480-3268-0x00007FF723650000-0x00007FF723A42000-memory.dmp	upx
behavioral2/memory/4244-3270-0x00007FF756540000-0x00007FF756932000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\JSCnYkW.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\AoeNfQT.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\GNIMlmf.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\JIClcMA.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\VZioQac.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\oqXMISv.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\kFyOmsF.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\AOBzSSu.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\ZNXAukx.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\oVMHuaL.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\CNTYOXd.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\ObAEhxt.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\MRyShtt.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\iGulGnw.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\xJsHfLA.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\DQOXUvj.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\cXjPhVG.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\tBKNAjB.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\nYLJMdM.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\hzZhkiu.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\qvQDewb.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\tPtcSCG.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\vzOEgOC.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\vQKrZtG.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\BtSahBD.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\uNJLeqj.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\KqtmsDW.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\wwVsqRU.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\pyyRSEg.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\EhPKNCb.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\mFeTOgS.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\qCtivyy.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\fWcvSAk.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\BNQYMgg.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\HyEhDMW.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\sBHzfeX.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\GiNMZou.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\tkmOofg.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\MIEjWMh.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\bARFQxO.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\ahDfsib.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\RyJnoTo.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\bCRFEox.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\EUcKFyM.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\NWXvAoP.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\DdXSJvX.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\tygNDPE.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\cgqSLGS.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\CbPojRc.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\FSZnllO.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\xRqLyGS.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\NxjeURx.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\wARrFIH.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\LambuqV.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\RrvObZH.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\iYvUoGY.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\cZjXuFv.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\XqgFUWU.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\aDtewRk.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\GJtChit.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\SzeipXt.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\OrWtRAG.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\EvCyucq.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
File created	C:\Windows\System\ufnoAuz.exe	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4876	powershell.exe
4876	powershell.exe
4876	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
Token: SeDebugPrivilege	4876	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 4876	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	83
PID 1460 wrote to memory of 4876	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	83
PID 1460 wrote to memory of 1480	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	84
PID 1460 wrote to memory of 1480	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	84
PID 1460 wrote to memory of 5100	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	85
PID 1460 wrote to memory of 5100	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	85
PID 1460 wrote to memory of 1044	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	86
PID 1460 wrote to memory of 1044	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	86
PID 1460 wrote to memory of 4244	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	87
PID 1460 wrote to memory of 4244	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	87
PID 1460 wrote to memory of 4756	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	88
PID 1460 wrote to memory of 4756	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	88
PID 1460 wrote to memory of 1116	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	89
PID 1460 wrote to memory of 1116	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	89
PID 1460 wrote to memory of 2712	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	90
PID 1460 wrote to memory of 2712	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	90
PID 1460 wrote to memory of 912	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	91
PID 1460 wrote to memory of 912	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	91
PID 1460 wrote to memory of 2528	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	92
PID 1460 wrote to memory of 2528	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	92
PID 1460 wrote to memory of 4568	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	93
PID 1460 wrote to memory of 4568	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	93
PID 1460 wrote to memory of 4516	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	94
PID 1460 wrote to memory of 4516	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	94
PID 1460 wrote to memory of 3340	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	95
PID 1460 wrote to memory of 3340	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	95
PID 1460 wrote to memory of 4332	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	96
PID 1460 wrote to memory of 4332	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	96
PID 1460 wrote to memory of 1300	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	97
PID 1460 wrote to memory of 1300	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	97
PID 1460 wrote to memory of 408	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	98
PID 1460 wrote to memory of 408	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	98
PID 1460 wrote to memory of 3540	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	99
PID 1460 wrote to memory of 3540	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	99
PID 1460 wrote to memory of 4464	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	100
PID 1460 wrote to memory of 4464	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	100
PID 1460 wrote to memory of 1420	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	101
PID 1460 wrote to memory of 1420	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	101
PID 1460 wrote to memory of 2284	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	102
PID 1460 wrote to memory of 2284	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	102
PID 1460 wrote to memory of 748	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	103
PID 1460 wrote to memory of 748	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	103
PID 1460 wrote to memory of 3008	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	104
PID 1460 wrote to memory of 3008	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	104
PID 1460 wrote to memory of 3644	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	105
PID 1460 wrote to memory of 3644	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	105
PID 1460 wrote to memory of 3232	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	106
PID 1460 wrote to memory of 3232	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	106
PID 1460 wrote to memory of 3252	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	107
PID 1460 wrote to memory of 3252	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	107
PID 1460 wrote to memory of 1376	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	108
PID 1460 wrote to memory of 1376	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	108
PID 1460 wrote to memory of 2244	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	109
PID 1460 wrote to memory of 2244	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	109
PID 1460 wrote to memory of 4860	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	110
PID 1460 wrote to memory of 4860	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	110
PID 1460 wrote to memory of 2072	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	111
PID 1460 wrote to memory of 2072	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	111
PID 1460 wrote to memory of 4924	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	112
PID 1460 wrote to memory of 4924	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	112
PID 1460 wrote to memory of 1032	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	113
PID 1460 wrote to memory of 1032	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	113
PID 1460 wrote to memory of 4436	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	114
PID 1460 wrote to memory of 4436	1460	75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe	114

C:\Users\Admin\AppData\Local\Temp\75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\75f4437eee389bd5b0135954296ee7ef_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4876
- C:\Windows\System\EgpGJYF.exe
  C:\Windows\System\EgpGJYF.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\VYsliFk.exe
  C:\Windows\System\VYsliFk.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\HlYRykH.exe
  C:\Windows\System\HlYRykH.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\esSxJsZ.exe
  C:\Windows\System\esSxJsZ.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\GiAxKnh.exe
  C:\Windows\System\GiAxKnh.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\lrnKSpW.exe
  C:\Windows\System\lrnKSpW.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\xHPqFJv.exe
  C:\Windows\System\xHPqFJv.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\QshMwNj.exe
  C:\Windows\System\QshMwNj.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\BuZYgzt.exe
  C:\Windows\System\BuZYgzt.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\tQFaKqV.exe
  C:\Windows\System\tQFaKqV.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\VxxsLYg.exe
  C:\Windows\System\VxxsLYg.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\UoJndih.exe
  C:\Windows\System\UoJndih.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\nAvueXB.exe
  C:\Windows\System\nAvueXB.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\avjZgUW.exe
  C:\Windows\System\avjZgUW.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\mKFaMma.exe
  C:\Windows\System\mKFaMma.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\GJtChit.exe
  C:\Windows\System\GJtChit.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\lQMukFV.exe
  C:\Windows\System\lQMukFV.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\IQkfQln.exe
  C:\Windows\System\IQkfQln.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\JYWKwbY.exe
  C:\Windows\System\JYWKwbY.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\DdjBqeo.exe
  C:\Windows\System\DdjBqeo.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\raGghCw.exe
  C:\Windows\System\raGghCw.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\DQOXUvj.exe
  C:\Windows\System\DQOXUvj.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\RyJnoTo.exe
  C:\Windows\System\RyJnoTo.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\MoWOnVF.exe
  C:\Windows\System\MoWOnVF.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\System\OWIwQnp.exe
  C:\Windows\System\OWIwQnp.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\VjZudGJ.exe
  C:\Windows\System\VjZudGJ.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\MoFAFNm.exe
  C:\Windows\System\MoFAFNm.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\ZTQTXXh.exe
  C:\Windows\System\ZTQTXXh.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\VkhBVao.exe
  C:\Windows\System\VkhBVao.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\ilRFJVu.exe
  C:\Windows\System\ilRFJVu.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\ZZAhPII.exe
  C:\Windows\System\ZZAhPII.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\oUTlpIp.exe
  C:\Windows\System\oUTlpIp.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\WECrCLP.exe
  C:\Windows\System\WECrCLP.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\xFamteV.exe
  C:\Windows\System\xFamteV.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\IWlqkFy.exe
  C:\Windows\System\IWlqkFy.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\ggIyEzL.exe
  C:\Windows\System\ggIyEzL.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\vrzyHPQ.exe
  C:\Windows\System\vrzyHPQ.exe
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Windows\System\okuJocY.exe
  C:\Windows\System\okuJocY.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\PftkYKY.exe
  C:\Windows\System\PftkYKY.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\eiEbgry.exe
  C:\Windows\System\eiEbgry.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\bsHPDfT.exe
  C:\Windows\System\bsHPDfT.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\qfAUkpu.exe
  C:\Windows\System\qfAUkpu.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\qUYZXMR.exe
  C:\Windows\System\qUYZXMR.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\TOggQzG.exe
  C:\Windows\System\TOggQzG.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\ZxpOvJm.exe
  C:\Windows\System\ZxpOvJm.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\PRDBRHe.exe
  C:\Windows\System\PRDBRHe.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\XRdyexF.exe
  C:\Windows\System\XRdyexF.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\GKATCwj.exe
  C:\Windows\System\GKATCwj.exe
  2⤵
  - Executes dropped EXE
  PID:3380
- C:\Windows\System\VUVHZfn.exe
  C:\Windows\System\VUVHZfn.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\LcMxqUr.exe
  C:\Windows\System\LcMxqUr.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\JoVhiev.exe
  C:\Windows\System\JoVhiev.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\iZIQgUw.exe
  C:\Windows\System\iZIQgUw.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\OcjOEjb.exe
  C:\Windows\System\OcjOEjb.exe
  2⤵
  - Executes dropped EXE
  PID:3776
- C:\Windows\System\pdjnSoy.exe
  C:\Windows\System\pdjnSoy.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\UxEFZCU.exe
  C:\Windows\System\UxEFZCU.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\GIyLzkY.exe
  C:\Windows\System\GIyLzkY.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\XRoZzck.exe
  C:\Windows\System\XRoZzck.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\lneAPhp.exe
  C:\Windows\System\lneAPhp.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\ogihCZa.exe
  C:\Windows\System\ogihCZa.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\zWWbqdA.exe
  C:\Windows\System\zWWbqdA.exe
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Windows\System\iSsrpNP.exe
  C:\Windows\System\iSsrpNP.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\BXCKQku.exe
  C:\Windows\System\BXCKQku.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\lviaVJo.exe
  C:\Windows\System\lviaVJo.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\sHdirno.exe
  C:\Windows\System\sHdirno.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\GguuEYD.exe
  C:\Windows\System\GguuEYD.exe
  2⤵
  PID:4776
- C:\Windows\System\RUDnMnJ.exe
  C:\Windows\System\RUDnMnJ.exe
  2⤵
  PID:1160
- C:\Windows\System\XBJKOet.exe
  C:\Windows\System\XBJKOet.exe
  2⤵
  PID:4720
- C:\Windows\System\yPIxysB.exe
  C:\Windows\System\yPIxysB.exe
  2⤵
  PID:1596
- C:\Windows\System\HbQCLaw.exe
  C:\Windows\System\HbQCLaw.exe
  2⤵
  PID:3316
- C:\Windows\System\aRDqWVt.exe
  C:\Windows\System\aRDqWVt.exe
  2⤵
  PID:3856
- C:\Windows\System\vpRpqHm.exe
  C:\Windows\System\vpRpqHm.exe
  2⤵
  PID:2388
- C:\Windows\System\OLkEnDz.exe
  C:\Windows\System\OLkEnDz.exe
  2⤵
  PID:464
- C:\Windows\System\turPeap.exe
  C:\Windows\System\turPeap.exe
  2⤵
  PID:4812
- C:\Windows\System\IcjXnqf.exe
  C:\Windows\System\IcjXnqf.exe
  2⤵
  PID:1856
- C:\Windows\System\tYKdnjw.exe
  C:\Windows\System\tYKdnjw.exe
  2⤵
  PID:936
- C:\Windows\System\AfweihM.exe
  C:\Windows\System\AfweihM.exe
  2⤵
  PID:3728
- C:\Windows\System\sPOuLoK.exe
  C:\Windows\System\sPOuLoK.exe
  2⤵
  PID:1696
- C:\Windows\System\MoiryFL.exe
  C:\Windows\System\MoiryFL.exe
  2⤵
  PID:3172
- C:\Windows\System\laRiiNd.exe
  C:\Windows\System\laRiiNd.exe
  2⤵
  PID:4496
- C:\Windows\System\ilOtHgy.exe
  C:\Windows\System\ilOtHgy.exe
  2⤵
  PID:5140
- C:\Windows\System\uJBMUEO.exe
  C:\Windows\System\uJBMUEO.exe
  2⤵
  PID:5156
- C:\Windows\System\YfPCzcZ.exe
  C:\Windows\System\YfPCzcZ.exe
  2⤵
  PID:5180
- C:\Windows\System\XlpuHwU.exe
  C:\Windows\System\XlpuHwU.exe
  2⤵
  PID:5200
- C:\Windows\System\VmhipXN.exe
  C:\Windows\System\VmhipXN.exe
  2⤵
  PID:5232
- C:\Windows\System\AYIVzuz.exe
  C:\Windows\System\AYIVzuz.exe
  2⤵
  PID:5264
- C:\Windows\System\XrhWtJa.exe
  C:\Windows\System\XrhWtJa.exe
  2⤵
  PID:5284
- C:\Windows\System\okXyCED.exe
  C:\Windows\System\okXyCED.exe
  2⤵
  PID:5300
- C:\Windows\System\CeNMvwm.exe
  C:\Windows\System\CeNMvwm.exe
  2⤵
  PID:5324
- C:\Windows\System\nDemLmt.exe
  C:\Windows\System\nDemLmt.exe
  2⤵
  PID:5348
- C:\Windows\System\tTwBYcc.exe
  C:\Windows\System\tTwBYcc.exe
  2⤵
  PID:5364
- C:\Windows\System\aiOXoTT.exe
  C:\Windows\System\aiOXoTT.exe
  2⤵
  PID:5388
- C:\Windows\System\Cqjluaa.exe
  C:\Windows\System\Cqjluaa.exe
  2⤵
  PID:5404
- C:\Windows\System\mBfeLPg.exe
  C:\Windows\System\mBfeLPg.exe
  2⤵
  PID:5428
- C:\Windows\System\FjEjRzM.exe
  C:\Windows\System\FjEjRzM.exe
  2⤵
  PID:5448
- C:\Windows\System\sQPgqhP.exe
  C:\Windows\System\sQPgqhP.exe
  2⤵
  PID:5468
- C:\Windows\System\vaoDjGF.exe
  C:\Windows\System\vaoDjGF.exe
  2⤵
  PID:5488
- C:\Windows\System\lvguULx.exe
  C:\Windows\System\lvguULx.exe
  2⤵
  PID:5516
- C:\Windows\System\YlTPHwY.exe
  C:\Windows\System\YlTPHwY.exe
  2⤵
  PID:5532
- C:\Windows\System\PiQPjvG.exe
  C:\Windows\System\PiQPjvG.exe
  2⤵
  PID:5708
- C:\Windows\System\SCJJvUs.exe
  C:\Windows\System\SCJJvUs.exe
  2⤵
  PID:5740
- C:\Windows\System\hJyKStH.exe
  C:\Windows\System\hJyKStH.exe
  2⤵
  PID:5760
- C:\Windows\System\uVeJvft.exe
  C:\Windows\System\uVeJvft.exe
  2⤵
  PID:5784
- C:\Windows\System\ZtioSVt.exe
  C:\Windows\System\ZtioSVt.exe
  2⤵
  PID:5816
- C:\Windows\System\LJpMHJd.exe
  C:\Windows\System\LJpMHJd.exe
  2⤵
  PID:5836
- C:\Windows\System\zBvDZMy.exe
  C:\Windows\System\zBvDZMy.exe
  2⤵
  PID:5856
- C:\Windows\System\momzzgA.exe
  C:\Windows\System\momzzgA.exe
  2⤵
  PID:5876
- C:\Windows\System\DRFkqCB.exe
  C:\Windows\System\DRFkqCB.exe
  2⤵
  PID:5904
- C:\Windows\System\rVNYuoZ.exe
  C:\Windows\System\rVNYuoZ.exe
  2⤵
  PID:5936
- C:\Windows\System\FTlmkDJ.exe
  C:\Windows\System\FTlmkDJ.exe
  2⤵
  PID:5952
- C:\Windows\System\ljcIMeL.exe
  C:\Windows\System\ljcIMeL.exe
  2⤵
  PID:5976
- C:\Windows\System\gvKRrUV.exe
  C:\Windows\System\gvKRrUV.exe
  2⤵
  PID:5996
- C:\Windows\System\HzRDxEs.exe
  C:\Windows\System\HzRDxEs.exe
  2⤵
  PID:6024
- C:\Windows\System\kLyNbRq.exe
  C:\Windows\System\kLyNbRq.exe
  2⤵
  PID:6040
- C:\Windows\System\WjMglrP.exe
  C:\Windows\System\WjMglrP.exe
  2⤵
  PID:6076
- C:\Windows\System\vVeVdUG.exe
  C:\Windows\System\vVeVdUG.exe
  2⤵
  PID:6092
- C:\Windows\System\KdyHXpX.exe
  C:\Windows\System\KdyHXpX.exe
  2⤵
  PID:6108
- C:\Windows\System\nohmjCC.exe
  C:\Windows\System\nohmjCC.exe
  2⤵
  PID:6132
- C:\Windows\System\TubZleK.exe
  C:\Windows\System\TubZleK.exe
  2⤵
  PID:3592
- C:\Windows\System\bARFQxO.exe
  C:\Windows\System\bARFQxO.exe
  2⤵
  PID:2236
- C:\Windows\System\GJTRjwr.exe
  C:\Windows\System\GJTRjwr.exe
  2⤵
  PID:4076
- C:\Windows\System\EDhUGJQ.exe
  C:\Windows\System\EDhUGJQ.exe
  2⤵
  PID:552
- C:\Windows\System\GIQukex.exe
  C:\Windows\System\GIQukex.exe
  2⤵
  PID:528
- C:\Windows\System\HYTeuhU.exe
  C:\Windows\System\HYTeuhU.exe
  2⤵
  PID:1944
- C:\Windows\System\pmjSeKP.exe
  C:\Windows\System\pmjSeKP.exe
  2⤵
  PID:4716
- C:\Windows\System\CzrwTcb.exe
  C:\Windows\System\CzrwTcb.exe
  2⤵
  PID:2496
- C:\Windows\System\YCTZgXD.exe
  C:\Windows\System\YCTZgXD.exe
  2⤵
  PID:1792
- C:\Windows\System\WhyYWWw.exe
  C:\Windows\System\WhyYWWw.exe
  2⤵
  PID:5508
- C:\Windows\System\EewLqog.exe
  C:\Windows\System\EewLqog.exe
  2⤵
  PID:5620
- C:\Windows\System\PpsUIom.exe
  C:\Windows\System\PpsUIom.exe
  2⤵
  PID:2148
- C:\Windows\System\KgRwRuX.exe
  C:\Windows\System\KgRwRuX.exe
  2⤵
  PID:3220
- C:\Windows\System\dhhzxlL.exe
  C:\Windows\System\dhhzxlL.exe
  2⤵
  PID:884
- C:\Windows\System\OrBzggv.exe
  C:\Windows\System\OrBzggv.exe
  2⤵
  PID:4848
- C:\Windows\System\aHuYUPc.exe
  C:\Windows\System\aHuYUPc.exe
  2⤵
  PID:2424
- C:\Windows\System\CwjNUPf.exe
  C:\Windows\System\CwjNUPf.exe
  2⤵
  PID:5172
- C:\Windows\System\FsbzwDr.exe
  C:\Windows\System\FsbzwDr.exe
  2⤵
  PID:5884
- C:\Windows\System\JyWNKBv.exe
  C:\Windows\System\JyWNKBv.exe
  2⤵
  PID:5924
- C:\Windows\System\xYmMNhX.exe
  C:\Windows\System\xYmMNhX.exe
  2⤵
  PID:5272
- C:\Windows\System\UTUlcTl.exe
  C:\Windows\System\UTUlcTl.exe
  2⤵
  PID:5360
- C:\Windows\System\fjqKnAt.exe
  C:\Windows\System\fjqKnAt.exe
  2⤵
  PID:5456
- C:\Windows\System\EWzrlLz.exe
  C:\Windows\System\EWzrlLz.exe
  2⤵
  PID:6140
- C:\Windows\System\ahDfsib.exe
  C:\Windows\System\ahDfsib.exe
  2⤵
  PID:6168
- C:\Windows\System\aaGseqO.exe
  C:\Windows\System\aaGseqO.exe
  2⤵
  PID:6184
- C:\Windows\System\fCmYCqK.exe
  C:\Windows\System\fCmYCqK.exe
  2⤵
  PID:6200
- C:\Windows\System\QgfPler.exe
  C:\Windows\System\QgfPler.exe
  2⤵
  PID:6228
- C:\Windows\System\fPiNkDS.exe
  C:\Windows\System\fPiNkDS.exe
  2⤵
  PID:6248
- C:\Windows\System\GiNMZou.exe
  C:\Windows\System\GiNMZou.exe
  2⤵
  PID:6280
- C:\Windows\System\DpDOJSY.exe
  C:\Windows\System\DpDOJSY.exe
  2⤵
  PID:6304
- C:\Windows\System\bsgVyop.exe
  C:\Windows\System\bsgVyop.exe
  2⤵
  PID:6324
- C:\Windows\System\yaxbcvO.exe
  C:\Windows\System\yaxbcvO.exe
  2⤵
  PID:6344
- C:\Windows\System\HKEPzqn.exe
  C:\Windows\System\HKEPzqn.exe
  2⤵
  PID:6364
- C:\Windows\System\jgRzKdV.exe
  C:\Windows\System\jgRzKdV.exe
  2⤵
  PID:6392
- C:\Windows\System\OXPufgL.exe
  C:\Windows\System\OXPufgL.exe
  2⤵
  PID:6416
- C:\Windows\System\MSdvkBc.exe
  C:\Windows\System\MSdvkBc.exe
  2⤵
  PID:6432
- C:\Windows\System\mOtdPXI.exe
  C:\Windows\System\mOtdPXI.exe
  2⤵
  PID:6460
- C:\Windows\System\lEfqClJ.exe
  C:\Windows\System\lEfqClJ.exe
  2⤵
  PID:6488
- C:\Windows\System\zbHGCYY.exe
  C:\Windows\System\zbHGCYY.exe
  2⤵
  PID:6504
- C:\Windows\System\YyQQJui.exe
  C:\Windows\System\YyQQJui.exe
  2⤵
  PID:6528
- C:\Windows\System\YiMDyHo.exe
  C:\Windows\System\YiMDyHo.exe
  2⤵
  PID:6556
- C:\Windows\System\jFPheRA.exe
  C:\Windows\System\jFPheRA.exe
  2⤵
  PID:6572
- C:\Windows\System\MLzucJp.exe
  C:\Windows\System\MLzucJp.exe
  2⤵
  PID:6588
- C:\Windows\System\YPbfPiW.exe
  C:\Windows\System\YPbfPiW.exe
  2⤵
  PID:6604
- C:\Windows\System\kZykUPg.exe
  C:\Windows\System\kZykUPg.exe
  2⤵
  PID:6624
- C:\Windows\System\jtVMqDP.exe
  C:\Windows\System\jtVMqDP.exe
  2⤵
  PID:6644
- C:\Windows\System\EwDvJzc.exe
  C:\Windows\System\EwDvJzc.exe
  2⤵
  PID:6664
- C:\Windows\System\drUKxAo.exe
  C:\Windows\System\drUKxAo.exe
  2⤵
  PID:6708
- C:\Windows\System\YWDzgxY.exe
  C:\Windows\System\YWDzgxY.exe
  2⤵
  PID:6728
- C:\Windows\System\nUqOBXF.exe
  C:\Windows\System\nUqOBXF.exe
  2⤵
  PID:6752
- C:\Windows\System\wLZVqwY.exe
  C:\Windows\System\wLZVqwY.exe
  2⤵
  PID:6776
- C:\Windows\System\nfoJhFE.exe
  C:\Windows\System\nfoJhFE.exe
  2⤵
  PID:6796
- C:\Windows\System\jRejpnP.exe
  C:\Windows\System\jRejpnP.exe
  2⤵
  PID:6824
- C:\Windows\System\yZMevRe.exe
  C:\Windows\System\yZMevRe.exe
  2⤵
  PID:6852
- C:\Windows\System\vVPOCcK.exe
  C:\Windows\System\vVPOCcK.exe
  2⤵
  PID:6872
- C:\Windows\System\CQcjlhs.exe
  C:\Windows\System\CQcjlhs.exe
  2⤵
  PID:6896
- C:\Windows\System\rZWaskZ.exe
  C:\Windows\System\rZWaskZ.exe
  2⤵
  PID:6912
- C:\Windows\System\oHvXeBE.exe
  C:\Windows\System\oHvXeBE.exe
  2⤵
  PID:6936
- C:\Windows\System\xMUMhqW.exe
  C:\Windows\System\xMUMhqW.exe
  2⤵
  PID:6960
- C:\Windows\System\nvPQbDW.exe
  C:\Windows\System\nvPQbDW.exe
  2⤵
  PID:6976
- C:\Windows\System\vRvKTrP.exe
  C:\Windows\System\vRvKTrP.exe
  2⤵
  PID:7004
- C:\Windows\System\dxAZryc.exe
  C:\Windows\System\dxAZryc.exe
  2⤵
  PID:7024
- C:\Windows\System\tldRGaU.exe
  C:\Windows\System\tldRGaU.exe
  2⤵
  PID:7048
- C:\Windows\System\eTRiOSO.exe
  C:\Windows\System\eTRiOSO.exe
  2⤵
  PID:5548
- C:\Windows\System\xUmBuKN.exe
  C:\Windows\System\xUmBuKN.exe
  2⤵
  PID:5560
- C:\Windows\System\yFVXRzT.exe
  C:\Windows\System\yFVXRzT.exe
  2⤵
  PID:4372
- C:\Windows\System\MiOHbUG.exe
  C:\Windows\System\MiOHbUG.exe
  2⤵
  PID:5828
- C:\Windows\System\dHWeQZG.exe
  C:\Windows\System\dHWeQZG.exe
  2⤵
  PID:1884
- C:\Windows\System\tQQDpwF.exe
  C:\Windows\System\tQQDpwF.exe
  2⤵
  PID:5844
- C:\Windows\System\TAzDGfC.exe
  C:\Windows\System\TAzDGfC.exe
  2⤵
  PID:4384
- C:\Windows\System\BYxgzlJ.exe
  C:\Windows\System\BYxgzlJ.exe
  2⤵
  PID:3784
- C:\Windows\System\ITKOdva.exe
  C:\Windows\System\ITKOdva.exe
  2⤵
  PID:4840
- C:\Windows\System\qNJeqYP.exe
  C:\Windows\System\qNJeqYP.exe
  2⤵
  PID:5992
- C:\Windows\System\jQmotSC.exe
  C:\Windows\System\jQmotSC.exe
  2⤵
  PID:5248
- C:\Windows\System\SIHYJio.exe
  C:\Windows\System\SIHYJio.exe
  2⤵
  PID:6244
- C:\Windows\System\owvgWCB.exe
  C:\Windows\System\owvgWCB.exe
  2⤵
  PID:6116
- C:\Windows\System\dXmBPlZ.exe
  C:\Windows\System\dXmBPlZ.exe
  2⤵
  PID:6084
- C:\Windows\System\wcPQIde.exe
  C:\Windows\System\wcPQIde.exe
  2⤵
  PID:1616
- C:\Windows\System\ZEkcBfT.exe
  C:\Windows\System\ZEkcBfT.exe
  2⤵
  PID:4564
- C:\Windows\System\yTneZZZ.exe
  C:\Windows\System\yTneZZZ.exe
  2⤵
  PID:6484
- C:\Windows\System\ukMyzBA.exe
  C:\Windows\System\ukMyzBA.exe
  2⤵
  PID:5372
- C:\Windows\System\freipnK.exe
  C:\Windows\System\freipnK.exe
  2⤵
  PID:6192
- C:\Windows\System\BfniMWl.exe
  C:\Windows\System\BfniMWl.exe
  2⤵
  PID:6264
- C:\Windows\System\AihcGbQ.exe
  C:\Windows\System\AihcGbQ.exe
  2⤵
  PID:6332
- C:\Windows\System\SBLGshg.exe
  C:\Windows\System\SBLGshg.exe
  2⤵
  PID:6736
- C:\Windows\System\HEAKnuC.exe
  C:\Windows\System\HEAKnuC.exe
  2⤵
  PID:6944
- C:\Windows\System\MmPmSJP.exe
  C:\Windows\System\MmPmSJP.exe
  2⤵
  PID:6616
- C:\Windows\System\mmvLxwp.exe
  C:\Windows\System\mmvLxwp.exe
  2⤵
  PID:6696
- C:\Windows\System\TpizDSw.exe
  C:\Windows\System\TpizDSw.exe
  2⤵
  PID:6552
- C:\Windows\System\qccxLDO.exe
  C:\Windows\System\qccxLDO.exe
  2⤵
  PID:6584
- C:\Windows\System\vmGWOmA.exe
  C:\Windows\System\vmGWOmA.exe
  2⤵
  PID:6788
- C:\Windows\System\wFMIPYk.exe
  C:\Windows\System\wFMIPYk.exe
  2⤵
  PID:6884
- C:\Windows\System\VIyicNl.exe
  C:\Windows\System\VIyicNl.exe
  2⤵
  PID:6932
- C:\Windows\System\BJfuzlt.exe
  C:\Windows\System\BJfuzlt.exe
  2⤵
  PID:7016
- C:\Windows\System\hALRczQ.exe
  C:\Windows\System\hALRczQ.exe
  2⤵
  PID:7176
- C:\Windows\System\yvthNJu.exe
  C:\Windows\System\yvthNJu.exe
  2⤵
  PID:7196
- C:\Windows\System\PGknTbU.exe
  C:\Windows\System\PGknTbU.exe
  2⤵
  PID:7216
- C:\Windows\System\JChGIAZ.exe
  C:\Windows\System\JChGIAZ.exe
  2⤵
  PID:7236
- C:\Windows\System\nXcMKho.exe
  C:\Windows\System\nXcMKho.exe
  2⤵
  PID:7256
- C:\Windows\System\wWYWCSu.exe
  C:\Windows\System\wWYWCSu.exe
  2⤵
  PID:7276
- C:\Windows\System\NohNBcs.exe
  C:\Windows\System\NohNBcs.exe
  2⤵
  PID:7292
- C:\Windows\System\CeeZfav.exe
  C:\Windows\System\CeeZfav.exe
  2⤵
  PID:7316
- C:\Windows\System\cBbcMeC.exe
  C:\Windows\System\cBbcMeC.exe
  2⤵
  PID:7336
- C:\Windows\System\wBIGGLw.exe
  C:\Windows\System\wBIGGLw.exe
  2⤵
  PID:7356
- C:\Windows\System\PXYOgbz.exe
  C:\Windows\System\PXYOgbz.exe
  2⤵
  PID:7376
- C:\Windows\System\xrTMztQ.exe
  C:\Windows\System\xrTMztQ.exe
  2⤵
  PID:7396
- C:\Windows\System\KbcNpJy.exe
  C:\Windows\System\KbcNpJy.exe
  2⤵
  PID:7416
- C:\Windows\System\uIWrEsG.exe
  C:\Windows\System\uIWrEsG.exe
  2⤵
  PID:7436
- C:\Windows\System\JLoaVcR.exe
  C:\Windows\System\JLoaVcR.exe
  2⤵
  PID:7456
- C:\Windows\System\ZgMZVDc.exe
  C:\Windows\System\ZgMZVDc.exe
  2⤵
  PID:7476
- C:\Windows\System\lEyyUJu.exe
  C:\Windows\System\lEyyUJu.exe
  2⤵
  PID:7500
- C:\Windows\System\WHomoVg.exe
  C:\Windows\System\WHomoVg.exe
  2⤵
  PID:7676
- C:\Windows\System\SRQWWSW.exe
  C:\Windows\System\SRQWWSW.exe
  2⤵
  PID:7692
- C:\Windows\System\wxcHPUM.exe
  C:\Windows\System\wxcHPUM.exe
  2⤵
  PID:7712
- C:\Windows\System\QErSQdP.exe
  C:\Windows\System\QErSQdP.exe
  2⤵
  PID:7728
- C:\Windows\System\GexBnQY.exe
  C:\Windows\System\GexBnQY.exe
  2⤵
  PID:7752
- C:\Windows\System\RkUnUoi.exe
  C:\Windows\System\RkUnUoi.exe
  2⤵
  PID:7772
- C:\Windows\System\LQqqZGc.exe
  C:\Windows\System\LQqqZGc.exe
  2⤵
  PID:7792
- C:\Windows\System\KqtmsDW.exe
  C:\Windows\System\KqtmsDW.exe
  2⤵
  PID:7812
- C:\Windows\System\dNNIFAw.exe
  C:\Windows\System\dNNIFAw.exe
  2⤵
  PID:7832
- C:\Windows\System\gtxGaqz.exe
  C:\Windows\System\gtxGaqz.exe
  2⤵
  PID:7848
- C:\Windows\System\YboyudV.exe
  C:\Windows\System\YboyudV.exe
  2⤵
  PID:7872
- C:\Windows\System\JIClcMA.exe
  C:\Windows\System\JIClcMA.exe
  2⤵
  PID:7892
- C:\Windows\System\tFiqoAi.exe
  C:\Windows\System\tFiqoAi.exe
  2⤵
  PID:7936
- C:\Windows\System\BCVNxRU.exe
  C:\Windows\System\BCVNxRU.exe
  2⤵
  PID:7960
- C:\Windows\System\ecChkmw.exe
  C:\Windows\System\ecChkmw.exe
  2⤵
  PID:8004
- C:\Windows\System\BvVRgBw.exe
  C:\Windows\System\BvVRgBw.exe
  2⤵
  PID:8048
- C:\Windows\System\PuQisGm.exe
  C:\Windows\System\PuQisGm.exe
  2⤵
  PID:8088
- C:\Windows\System\SDToVmr.exe
  C:\Windows\System\SDToVmr.exe
  2⤵
  PID:8112
- C:\Windows\System\gvPDgAf.exe
  C:\Windows\System\gvPDgAf.exe
  2⤵
  PID:8128
- C:\Windows\System\kegxCyG.exe
  C:\Windows\System\kegxCyG.exe
  2⤵
  PID:8168
- C:\Windows\System\ZvnSfUT.exe
  C:\Windows\System\ZvnSfUT.exe
  2⤵
  PID:8188
- C:\Windows\System\FwnZxnB.exe
  C:\Windows\System\FwnZxnB.exe
  2⤵
  PID:6156
- C:\Windows\System\FaBYdJR.exe
  C:\Windows\System\FaBYdJR.exe
  2⤵
  PID:6760
- C:\Windows\System\aeofGUu.exe
  C:\Windows\System\aeofGUu.exe
  2⤵
  PID:6908
- C:\Windows\System\TTTYCcv.exe
  C:\Windows\System\TTTYCcv.exe
  2⤵
  PID:7332
- C:\Windows\System\tGQNxml.exe
  C:\Windows\System\tGQNxml.exe
  2⤵
  PID:7364
- C:\Windows\System\GFDiRFP.exe
  C:\Windows\System\GFDiRFP.exe
  2⤵
  PID:6812
- C:\Windows\System\FmMNckh.exe
  C:\Windows\System\FmMNckh.exe
  2⤵
  PID:8196
- C:\Windows\System\UwvTdUa.exe
  C:\Windows\System\UwvTdUa.exe
  2⤵
  PID:8212
- C:\Windows\System\RdZzzuY.exe
  C:\Windows\System\RdZzzuY.exe
  2⤵
  PID:8236
- C:\Windows\System\dxoGWuZ.exe
  C:\Windows\System\dxoGWuZ.exe
  2⤵
  PID:8260
- C:\Windows\System\kqXOixr.exe
  C:\Windows\System\kqXOixr.exe
  2⤵
  PID:8284
- C:\Windows\System\YNWMuEG.exe
  C:\Windows\System\YNWMuEG.exe
  2⤵
  PID:8308
- C:\Windows\System\ltGpkVT.exe
  C:\Windows\System\ltGpkVT.exe
  2⤵
  PID:8328
- C:\Windows\System\AYGIbWA.exe
  C:\Windows\System\AYGIbWA.exe
  2⤵
  PID:8344
- C:\Windows\System\QwHvevT.exe
  C:\Windows\System\QwHvevT.exe
  2⤵
  PID:8360
- C:\Windows\System\jutJsYg.exe
  C:\Windows\System\jutJsYg.exe
  2⤵
  PID:8388
- C:\Windows\System\BetIQAI.exe
  C:\Windows\System\BetIQAI.exe
  2⤵
  PID:8412
- C:\Windows\System\wwVsqRU.exe
  C:\Windows\System\wwVsqRU.exe
  2⤵
  PID:8436
- C:\Windows\System\PkMfUyb.exe
  C:\Windows\System\PkMfUyb.exe
  2⤵
  PID:8456
- C:\Windows\System\HuOIZUz.exe
  C:\Windows\System\HuOIZUz.exe
  2⤵
  PID:8476
- C:\Windows\System\JFTDutN.exe
  C:\Windows\System\JFTDutN.exe
  2⤵
  PID:8500
- C:\Windows\System\krmnuLd.exe
  C:\Windows\System\krmnuLd.exe
  2⤵
  PID:8524
- C:\Windows\System\vsbBzrD.exe
  C:\Windows\System\vsbBzrD.exe
  2⤵
  PID:8548
- C:\Windows\System\ohHwzhs.exe
  C:\Windows\System\ohHwzhs.exe
  2⤵
  PID:8572
- C:\Windows\System\GsBlJjY.exe
  C:\Windows\System\GsBlJjY.exe
  2⤵
  PID:8600
- C:\Windows\System\EDhustH.exe
  C:\Windows\System\EDhustH.exe
  2⤵
  PID:8624
- C:\Windows\System\GMDRROp.exe
  C:\Windows\System\GMDRROp.exe
  2⤵
  PID:8648
- C:\Windows\System\cXjPhVG.exe
  C:\Windows\System\cXjPhVG.exe
  2⤵
  PID:8668
- C:\Windows\System\moBkoOj.exe
  C:\Windows\System\moBkoOj.exe
  2⤵
  PID:8692
- C:\Windows\System\rAcDjPM.exe
  C:\Windows\System\rAcDjPM.exe
  2⤵
  PID:8716
- C:\Windows\System\NDbeNMm.exe
  C:\Windows\System\NDbeNMm.exe
  2⤵
  PID:8736
- C:\Windows\System\YWQDGrm.exe
  C:\Windows\System\YWQDGrm.exe
  2⤵
  PID:8752
- C:\Windows\System\CRkJDdJ.exe
  C:\Windows\System\CRkJDdJ.exe
  2⤵
  PID:8772
- C:\Windows\System\VCoAknS.exe
  C:\Windows\System\VCoAknS.exe
  2⤵
  PID:8796
- C:\Windows\System\kLQpQuO.exe
  C:\Windows\System\kLQpQuO.exe
  2⤵
  PID:8816
- C:\Windows\System\eUiYDMn.exe
  C:\Windows\System\eUiYDMn.exe
  2⤵
  PID:8836
- C:\Windows\System\NcZGNBU.exe
  C:\Windows\System\NcZGNBU.exe
  2⤵
  PID:8860
- C:\Windows\System\bOIJDYK.exe
  C:\Windows\System\bOIJDYK.exe
  2⤵
  PID:8884
- C:\Windows\System\DSsfOvf.exe
  C:\Windows\System\DSsfOvf.exe
  2⤵
  PID:8904
- C:\Windows\System\QPRUiqM.exe
  C:\Windows\System\QPRUiqM.exe
  2⤵
  PID:8924
- C:\Windows\System\FRZIeBW.exe
  C:\Windows\System\FRZIeBW.exe
  2⤵
  PID:8956
- C:\Windows\System\hhLDXBO.exe
  C:\Windows\System\hhLDXBO.exe
  2⤵
  PID:7384
- C:\Windows\System\qoBggDS.exe
  C:\Windows\System\qoBggDS.exe
  2⤵
  PID:7288
- C:\Windows\System\hfbGOru.exe
  C:\Windows\System\hfbGOru.exe
  2⤵
  PID:7248
- C:\Windows\System\npOEKfb.exe
  C:\Windows\System\npOEKfb.exe
  2⤵
  PID:7204
- C:\Windows\System\dWKxxQW.exe
  C:\Windows\System\dWKxxQW.exe
  2⤵
  PID:7020
- C:\Windows\System\lUDzyXE.exe
  C:\Windows\System\lUDzyXE.exe
  2⤵
  PID:6516
- C:\Windows\System\VOPvWaL.exe
  C:\Windows\System\VOPvWaL.exe
  2⤵
  PID:6640
- C:\Windows\System\mzCrSuW.exe
  C:\Windows\System\mzCrSuW.exe
  2⤵
  PID:6208
- C:\Windows\System\damtKLW.exe
  C:\Windows\System\damtKLW.exe
  2⤵
  PID:6220
- C:\Windows\System\GcgQDZx.exe
  C:\Windows\System\GcgQDZx.exe
  2⤵
  PID:5168
- C:\Windows\System\JwRcRZN.exe
  C:\Windows\System\JwRcRZN.exe
  2⤵
  PID:3260
- C:\Windows\System\RCooySP.exe
  C:\Windows\System\RCooySP.exe
  2⤵
  PID:6100
- C:\Windows\System\EUTQDRh.exe
  C:\Windows\System\EUTQDRh.exe
  2⤵
  PID:5148
- C:\Windows\System\GCrKeEW.exe
  C:\Windows\System\GCrKeEW.exe
  2⤵
  PID:7512
- C:\Windows\System\zXkWzdU.exe
  C:\Windows\System\zXkWzdU.exe
  2⤵
  PID:7748
- C:\Windows\System\MOdLrgV.exe
  C:\Windows\System\MOdLrgV.exe
  2⤵
  PID:7700
- C:\Windows\System\UWGyqXL.exe
  C:\Windows\System\UWGyqXL.exe
  2⤵
  PID:7428
- C:\Windows\System\XSmDLHy.exe
  C:\Windows\System\XSmDLHy.exe
  2⤵
  PID:7704
- C:\Windows\System\lwmCDsS.exe
  C:\Windows\System\lwmCDsS.exe
  2⤵
  PID:7824
- C:\Windows\System\XDoYFFT.exe
  C:\Windows\System\XDoYFFT.exe
  2⤵
  PID:7920
- C:\Windows\System\yVxVosN.exe
  C:\Windows\System\yVxVosN.exe
  2⤵
  PID:8072
- C:\Windows\System\SVwfxNO.exe
  C:\Windows\System\SVwfxNO.exe
  2⤵
  PID:8096
- C:\Windows\System\QYlwQjC.exe
  C:\Windows\System\QYlwQjC.exe
  2⤵
  PID:7944
- C:\Windows\System\eaFDxbK.exe
  C:\Windows\System\eaFDxbK.exe
  2⤵
  PID:7856
- C:\Windows\System\BMmpctg.exe
  C:\Windows\System\BMmpctg.exe
  2⤵
  PID:5524
- C:\Windows\System\CdTleGS.exe
  C:\Windows\System\CdTleGS.exe
  2⤵
  PID:8228
- C:\Windows\System\bluxHqk.exe
  C:\Windows\System\bluxHqk.exe
  2⤵
  PID:8268
- C:\Windows\System\uUTrzGq.exe
  C:\Windows\System\uUTrzGq.exe
  2⤵
  PID:8320
- C:\Windows\System\qvwWHsP.exe
  C:\Windows\System\qvwWHsP.exe
  2⤵
  PID:8356
- C:\Windows\System\uPXGzIH.exe
  C:\Windows\System\uPXGzIH.exe
  2⤵
  PID:8408
- C:\Windows\System\UVzXatZ.exe
  C:\Windows\System\UVzXatZ.exe
  2⤵
  PID:8452
- C:\Windows\System\TKLIgcb.exe
  C:\Windows\System\TKLIgcb.exe
  2⤵
  PID:8508
- C:\Windows\System\gSMfowl.exe
  C:\Windows\System\gSMfowl.exe
  2⤵
  PID:8540
- C:\Windows\System\LambuqV.exe
  C:\Windows\System\LambuqV.exe
  2⤵
  PID:8588
- C:\Windows\System\cSkqGQM.exe
  C:\Windows\System\cSkqGQM.exe
  2⤵
  PID:8636
- C:\Windows\System\oooqWpN.exe
  C:\Windows\System\oooqWpN.exe
  2⤵
  PID:8688
- C:\Windows\System\FuyTWYx.exe
  C:\Windows\System\FuyTWYx.exe
  2⤵
  PID:8732
- C:\Windows\System\MIVRsVl.exe
  C:\Windows\System\MIVRsVl.exe
  2⤵
  PID:8768
- C:\Windows\System\KmpEJwe.exe
  C:\Windows\System\KmpEJwe.exe
  2⤵
  PID:8804
- C:\Windows\System\mnCmoNs.exe
  C:\Windows\System\mnCmoNs.exe
  2⤵
  PID:8844
- C:\Windows\System\DcNRZVC.exe
  C:\Windows\System\DcNRZVC.exe
  2⤵
  PID:8900
- C:\Windows\System\iXSCwtd.exe
  C:\Windows\System\iXSCwtd.exe
  2⤵
  PID:8920
- C:\Windows\System\axbZdOS.exe
  C:\Windows\System\axbZdOS.exe
  2⤵
  PID:5016
- C:\Windows\System\ZvkSjPx.exe
  C:\Windows\System\ZvkSjPx.exe
  2⤵
  PID:4704
- C:\Windows\System\ZDUUWiX.exe
  C:\Windows\System\ZDUUWiX.exe
  2⤵
  PID:4988
- C:\Windows\System\OYDcbme.exe
  C:\Windows\System\OYDcbme.exe
  2⤵
  PID:684
- C:\Windows\System\kLujIcU.exe
  C:\Windows\System\kLujIcU.exe
  2⤵
  PID:4552
- C:\Windows\System\cUiYHjc.exe
  C:\Windows\System\cUiYHjc.exe
  2⤵
  PID:2184
- C:\Windows\System\xlXnNTx.exe
  C:\Windows\System\xlXnNTx.exe
  2⤵
  PID:1436
- C:\Windows\System\yqEyzQE.exe
  C:\Windows\System\yqEyzQE.exe
  2⤵
  PID:1680
- C:\Windows\System\rPclNZb.exe
  C:\Windows\System\rPclNZb.exe
  2⤵
  PID:3952
- C:\Windows\System\RXbwjVU.exe
  C:\Windows\System\RXbwjVU.exe
  2⤵
  PID:7884
- C:\Windows\System\JfVKMUC.exe
  C:\Windows\System\JfVKMUC.exe
  2⤵
  PID:1828
- C:\Windows\System\uRcxwLN.exe
  C:\Windows\System\uRcxwLN.exe
  2⤵
  PID:7324
- C:\Windows\System\rMEKsvx.exe
  C:\Windows\System\rMEKsvx.exe
  2⤵
  PID:7044
- C:\Windows\System\ZpJdFUy.exe
  C:\Windows\System\ZpJdFUy.exe
  2⤵
  PID:5336
- C:\Windows\System\xhUTBpi.exe
  C:\Windows\System\xhUTBpi.exe
  2⤵
  PID:6032
- C:\Windows\System\IbNcBCl.exe
  C:\Windows\System\IbNcBCl.exe
  2⤵
  PID:4940
- C:\Windows\System\aWzFImq.exe
  C:\Windows\System\aWzFImq.exe
  2⤵
  PID:7368
- C:\Windows\System\uTTcfvB.exe
  C:\Windows\System\uTTcfvB.exe
  2⤵
  PID:9228
- C:\Windows\System\wCugIpT.exe
  C:\Windows\System\wCugIpT.exe
  2⤵
  PID:9252
- C:\Windows\System\skDnPlF.exe
  C:\Windows\System\skDnPlF.exe
  2⤵
  PID:9272
- C:\Windows\System\eyOkqip.exe
  C:\Windows\System\eyOkqip.exe
  2⤵
  PID:9296
- C:\Windows\System\adwxaUw.exe
  C:\Windows\System\adwxaUw.exe
  2⤵
  PID:9312
- C:\Windows\System\GNUUdLc.exe
  C:\Windows\System\GNUUdLc.exe
  2⤵
  PID:9328
- C:\Windows\System\fiBcLUK.exe
  C:\Windows\System\fiBcLUK.exe
  2⤵
  PID:9452
- C:\Windows\System\tOMychM.exe
  C:\Windows\System\tOMychM.exe
  2⤵
  PID:9476
- C:\Windows\System\wqgkPSW.exe
  C:\Windows\System\wqgkPSW.exe
  2⤵
  PID:9496
- C:\Windows\System\KFguSMO.exe
  C:\Windows\System\KFguSMO.exe
  2⤵
  PID:9524
- C:\Windows\System\YPboMms.exe
  C:\Windows\System\YPboMms.exe
  2⤵
  PID:9544
- C:\Windows\System\rbOcbcB.exe
  C:\Windows\System\rbOcbcB.exe
  2⤵
  PID:9572
- C:\Windows\System\EFJjndb.exe
  C:\Windows\System\EFJjndb.exe
  2⤵
  PID:9592
- C:\Windows\System\kHpIWGo.exe
  C:\Windows\System\kHpIWGo.exe
  2⤵
  PID:9608
- C:\Windows\System\kzQVTOr.exe
  C:\Windows\System\kzQVTOr.exe
  2⤵
  PID:9628
- C:\Windows\System\TTbhpqf.exe
  C:\Windows\System\TTbhpqf.exe
  2⤵
  PID:9652
- C:\Windows\System\hskATGi.exe
  C:\Windows\System\hskATGi.exe
  2⤵
  PID:9684
- C:\Windows\System\bDGofDg.exe
  C:\Windows\System\bDGofDg.exe
  2⤵
  PID:9704
- C:\Windows\System\usbLBZN.exe
  C:\Windows\System\usbLBZN.exe
  2⤵
  PID:9724
- C:\Windows\System\tPIYDYM.exe
  C:\Windows\System\tPIYDYM.exe
  2⤵
  PID:9748
- C:\Windows\System\GKUeIoX.exe
  C:\Windows\System\GKUeIoX.exe
  2⤵
  PID:9772
- C:\Windows\System\oDMySFc.exe
  C:\Windows\System\oDMySFc.exe
  2⤵
  PID:9792
- C:\Windows\System\yrXAgxv.exe
  C:\Windows\System\yrXAgxv.exe
  2⤵
  PID:9820
- C:\Windows\System\tkmOofg.exe
  C:\Windows\System\tkmOofg.exe
  2⤵
  PID:9836
- C:\Windows\System\MIZPTsG.exe
  C:\Windows\System\MIZPTsG.exe
  2⤵
  PID:9868
- C:\Windows\System\YNIZNje.exe
  C:\Windows\System\YNIZNje.exe
  2⤵
  PID:9888
- C:\Windows\System\RrvObZH.exe
  C:\Windows\System\RrvObZH.exe
  2⤵
  PID:9916
- C:\Windows\System\wXkIWEB.exe
  C:\Windows\System\wXkIWEB.exe
  2⤵
  PID:9936
- C:\Windows\System\ScaZAEE.exe
  C:\Windows\System\ScaZAEE.exe
  2⤵
  PID:9960
- C:\Windows\System\GNiKPyY.exe
  C:\Windows\System\GNiKPyY.exe
  2⤵
  PID:9980
- C:\Windows\System\BGDxgcU.exe
  C:\Windows\System\BGDxgcU.exe
  2⤵
  PID:10004
- C:\Windows\System\iGQTXBV.exe
  C:\Windows\System\iGQTXBV.exe
  2⤵
  PID:10028
- C:\Windows\System\ckfzhBd.exe
  C:\Windows\System\ckfzhBd.exe
  2⤵
  PID:10048
- C:\Windows\System\FqqEvZu.exe
  C:\Windows\System\FqqEvZu.exe
  2⤵
  PID:10068
- C:\Windows\System\FSZnllO.exe
  C:\Windows\System\FSZnllO.exe
  2⤵
  PID:10096
- C:\Windows\System\DjPKdVU.exe
  C:\Windows\System\DjPKdVU.exe
  2⤵
  PID:10128
- C:\Windows\System\rSAGwvM.exe
  C:\Windows\System\rSAGwvM.exe
  2⤵
  PID:10176
- C:\Windows\System\YuihGna.exe
  C:\Windows\System\YuihGna.exe
  2⤵
  PID:10200
- C:\Windows\System\JWaizvF.exe
  C:\Windows\System\JWaizvF.exe
  2⤵
  PID:10224
- C:\Windows\System\tPtcSCG.exe
  C:\Windows\System\tPtcSCG.exe
  2⤵
  PID:7988
- C:\Windows\System\HTHZbgh.exe
  C:\Windows\System\HTHZbgh.exe
  2⤵
  PID:7820
- C:\Windows\System\JeXFbBB.exe
  C:\Windows\System\JeXFbBB.exe
  2⤵
  PID:3004
- C:\Windows\System\dfpihYd.exe
  C:\Windows\System\dfpihYd.exe
  2⤵
  PID:2964
- C:\Windows\System\wYaGKvD.exe
  C:\Windows\System\wYaGKvD.exe
  2⤵
  PID:2420
- C:\Windows\System\RKdgjiF.exe
  C:\Windows\System\RKdgjiF.exe
  2⤵
  PID:7372
- C:\Windows\System\sXzqDWh.exe
  C:\Windows\System\sXzqDWh.exe
  2⤵
  PID:3700
- C:\Windows\System\pyoDdUa.exe
  C:\Windows\System\pyoDdUa.exe
  2⤵
  PID:1488
- C:\Windows\System\DvDyUQi.exe
  C:\Windows\System\DvDyUQi.exe
  2⤵
  PID:7184
- C:\Windows\System\iFmIdUT.exe
  C:\Windows\System\iFmIdUT.exe
  2⤵
  PID:7736
- C:\Windows\System\OAjXUMT.exe
  C:\Windows\System\OAjXUMT.exe
  2⤵
  PID:9244
- C:\Windows\System\CMKfbBd.exe
  C:\Windows\System\CMKfbBd.exe
  2⤵
  PID:8124
- C:\Windows\System\LhqwXDl.exe
  C:\Windows\System\LhqwXDl.exe
  2⤵
  PID:8208
- C:\Windows\System\AXKCAjY.exe
  C:\Windows\System\AXKCAjY.exe
  2⤵
  PID:8376
- C:\Windows\System\MODwKxk.exe
  C:\Windows\System\MODwKxk.exe
  2⤵
  PID:8484
- C:\Windows\System\DIGhKNj.exe
  C:\Windows\System\DIGhKNj.exe
  2⤵
  PID:8556
- C:\Windows\System\PRHgNHJ.exe
  C:\Windows\System\PRHgNHJ.exe
  2⤵
  PID:8616
- C:\Windows\System\wTcFkak.exe
  C:\Windows\System\wTcFkak.exe
  2⤵
  PID:8676
- C:\Windows\System\ucWjfxS.exe
  C:\Windows\System\ucWjfxS.exe
  2⤵
  PID:8744
- C:\Windows\System\kPpzSkc.exe
  C:\Windows\System\kPpzSkc.exe
  2⤵
  PID:8784
- C:\Windows\System\esNfjSq.exe
  C:\Windows\System\esNfjSq.exe
  2⤵
  PID:9444
- C:\Windows\System\lkFNKsg.exe
  C:\Windows\System\lkFNKsg.exe
  2⤵
  PID:9532
- C:\Windows\System\PwjLZgW.exe
  C:\Windows\System\PwjLZgW.exe
  2⤵
  PID:7352
- C:\Windows\System\zlYMIoC.exe
  C:\Windows\System\zlYMIoC.exe
  2⤵
  PID:1600
- C:\Windows\System\vzOEgOC.exe
  C:\Windows\System\vzOEgOC.exe
  2⤵
  PID:3216
- C:\Windows\System\HLNJekD.exe
  C:\Windows\System\HLNJekD.exe
  2⤵
  PID:3616
- C:\Windows\System\lclFamr.exe
  C:\Windows\System\lclFamr.exe
  2⤵
  PID:10260
- C:\Windows\System\oRJGyxc.exe
  C:\Windows\System\oRJGyxc.exe
  2⤵
  PID:10284
- C:\Windows\System\vqHdcWF.exe
  C:\Windows\System\vqHdcWF.exe
  2⤵
  PID:10304
- C:\Windows\System\Mxqrefi.exe
  C:\Windows\System\Mxqrefi.exe
  2⤵
  PID:10320
- C:\Windows\System\lJrOrLX.exe
  C:\Windows\System\lJrOrLX.exe
  2⤵
  PID:10336
- C:\Windows\System\jtChqMo.exe
  C:\Windows\System\jtChqMo.exe
  2⤵
  PID:10356
- C:\Windows\System\sBYOaJP.exe
  C:\Windows\System\sBYOaJP.exe
  2⤵
  PID:10380
- C:\Windows\System\MArfGZo.exe
  C:\Windows\System\MArfGZo.exe
  2⤵
  PID:10400
- C:\Windows\System\apnJQGZ.exe
  C:\Windows\System\apnJQGZ.exe
  2⤵
  PID:10424
- C:\Windows\System\kGJuJaW.exe
  C:\Windows\System\kGJuJaW.exe
  2⤵
  PID:10452
- C:\Windows\System\JCJDWdt.exe
  C:\Windows\System\JCJDWdt.exe
  2⤵
  PID:10476
- C:\Windows\System\DKMrYhE.exe
  C:\Windows\System\DKMrYhE.exe
  2⤵
  PID:10500
- C:\Windows\System\ObnzDFA.exe
  C:\Windows\System\ObnzDFA.exe
  2⤵
  PID:10520
- C:\Windows\System\XoQPCfX.exe
  C:\Windows\System\XoQPCfX.exe
  2⤵
  PID:10540
- C:\Windows\System\zRMbcBl.exe
  C:\Windows\System\zRMbcBl.exe
  2⤵
  PID:10564
- C:\Windows\System\aXMKCRb.exe
  C:\Windows\System\aXMKCRb.exe
  2⤵
  PID:10584
- C:\Windows\System\CWVRwtO.exe
  C:\Windows\System\CWVRwtO.exe
  2⤵
  PID:10604
- C:\Windows\System\qeVQbTF.exe
  C:\Windows\System\qeVQbTF.exe
  2⤵
  PID:10624
- C:\Windows\System\agIAZqn.exe
  C:\Windows\System\agIAZqn.exe
  2⤵
  PID:10648
- C:\Windows\System\ZRNVBJm.exe
  C:\Windows\System\ZRNVBJm.exe
  2⤵
  PID:10676
- C:\Windows\System\Bgerbcl.exe
  C:\Windows\System\Bgerbcl.exe
  2⤵
  PID:10700
- C:\Windows\System\QENCCJH.exe
  C:\Windows\System\QENCCJH.exe
  2⤵
  PID:10728
- C:\Windows\System\aUUaecC.exe
  C:\Windows\System\aUUaecC.exe
  2⤵
  PID:10744
- C:\Windows\System\NOgvWxj.exe
  C:\Windows\System\NOgvWxj.exe
  2⤵
  PID:10772
- C:\Windows\System\luPUlWF.exe
  C:\Windows\System\luPUlWF.exe
  2⤵
  PID:10796
- C:\Windows\System\ORJYVPp.exe
  C:\Windows\System\ORJYVPp.exe
  2⤵
  PID:10820
- C:\Windows\System\LnEGupJ.exe
  C:\Windows\System\LnEGupJ.exe
  2⤵
  PID:10864
- C:\Windows\System\iBpffqP.exe
  C:\Windows\System\iBpffqP.exe
  2⤵
  PID:10880
- C:\Windows\System\xtsQxIw.exe
  C:\Windows\System\xtsQxIw.exe
  2⤵
  PID:10900
- C:\Windows\System\NUATocs.exe
  C:\Windows\System\NUATocs.exe
  2⤵
  PID:10932
- C:\Windows\System\SvxCvNk.exe
  C:\Windows\System\SvxCvNk.exe
  2⤵
  PID:10952
- C:\Windows\System\pUQEugH.exe
  C:\Windows\System\pUQEugH.exe
  2⤵
  PID:10976
- C:\Windows\System\kJVswFj.exe
  C:\Windows\System\kJVswFj.exe
  2⤵
  PID:10992
- C:\Windows\System\tFKkfQd.exe
  C:\Windows\System\tFKkfQd.exe
  2⤵
  PID:11008
- C:\Windows\System\WSEGexc.exe
  C:\Windows\System\WSEGexc.exe
  2⤵
  PID:11032
- C:\Windows\System\dKPAofc.exe
  C:\Windows\System\dKPAofc.exe
  2⤵
  PID:11056
- C:\Windows\System\WqDLPrg.exe
  C:\Windows\System\WqDLPrg.exe
  2⤵
  PID:11080
- C:\Windows\System\borzKut.exe
  C:\Windows\System\borzKut.exe
  2⤵
  PID:11108
- C:\Windows\System\oXZrtIS.exe
  C:\Windows\System\oXZrtIS.exe
  2⤵
  PID:11128
- C:\Windows\System\RgaiUGY.exe
  C:\Windows\System\RgaiUGY.exe
  2⤵
  PID:11152
- C:\Windows\System\dWxRiNP.exe
  C:\Windows\System\dWxRiNP.exe
  2⤵
  PID:11176
- C:\Windows\System\QJxwKtJ.exe
  C:\Windows\System\QJxwKtJ.exe
  2⤵
  PID:11204
- C:\Windows\System\KbzCWNC.exe
  C:\Windows\System\KbzCWNC.exe
  2⤵
  PID:11224
- C:\Windows\System\pdzimZP.exe
  C:\Windows\System\pdzimZP.exe
  2⤵
  PID:11252
- C:\Windows\System\uJUQFkR.exe
  C:\Windows\System\uJUQFkR.exe
  2⤵
  PID:3200
- C:\Windows\System\zzqXQSt.exe
  C:\Windows\System\zzqXQSt.exe
  2⤵
  PID:9236
- C:\Windows\System\ZABbTXD.exe
  C:\Windows\System\ZABbTXD.exe
  2⤵
  PID:8296
- C:\Windows\System\yFhnsso.exe
  C:\Windows\System\yFhnsso.exe
  2⤵
  PID:10104
- C:\Windows\System\zuLIsFB.exe
  C:\Windows\System\zuLIsFB.exe
  2⤵
  PID:9424
- C:\Windows\System\nanivNV.exe
  C:\Windows\System\nanivNV.exe
  2⤵
  PID:8832
- C:\Windows\System\GwCYABK.exe
  C:\Windows\System\GwCYABK.exe
  2⤵
  PID:9464
- C:\Windows\System\SGlRAMZ.exe
  C:\Windows\System\SGlRAMZ.exe
  2⤵
  PID:9180
- C:\Windows\System\QWdgOFo.exe
  C:\Windows\System\QWdgOFo.exe
  2⤵
  PID:3932
- C:\Windows\System\eUszfhP.exe
  C:\Windows\System\eUszfhP.exe
  2⤵
  PID:6476
- C:\Windows\System\myVmMqb.exe
  C:\Windows\System\myVmMqb.exe
  2⤵
  PID:9308
- C:\Windows\System\ugPZGrD.exe
  C:\Windows\System\ugPZGrD.exe
  2⤵
  PID:9740
- C:\Windows\System\DhgjvBc.exe
  C:\Windows\System\DhgjvBc.exe
  2⤵
  PID:2744
- C:\Windows\System\jkolYSM.exe
  C:\Windows\System\jkolYSM.exe
  2⤵
  PID:5020
- C:\Windows\System\RonaoQG.exe
  C:\Windows\System\RonaoQG.exe
  2⤵
  PID:10296
- C:\Windows\System\zSfNnlL.exe
  C:\Windows\System\zSfNnlL.exe
  2⤵
  PID:10316
- C:\Windows\System\PxdGRhr.exe
  C:\Windows\System\PxdGRhr.exe
  2⤵
  PID:9828
- C:\Windows\System\ijXXMme.exe
  C:\Windows\System\ijXXMme.exe
  2⤵
  PID:10348
- C:\Windows\System\aHhGMOL.exe
  C:\Windows\System\aHhGMOL.exe
  2⤵
  PID:9932
- C:\Windows\System\kLgUrkd.exe
  C:\Windows\System\kLgUrkd.exe
  2⤵
  PID:10472
- C:\Windows\System\eWcdamh.exe
  C:\Windows\System\eWcdamh.exe
  2⤵
  PID:9324
- C:\Windows\System\ZiVBeyv.exe
  C:\Windows\System\ZiVBeyv.exe
  2⤵
  PID:10600
- C:\Windows\System\wAsxLhn.exe
  C:\Windows\System\wAsxLhn.exe
  2⤵
  PID:10136
- C:\Windows\System\UIrBiMK.exe
  C:\Windows\System\UIrBiMK.exe
  2⤵
  PID:10740
- C:\Windows\System\GYaDAEX.exe
  C:\Windows\System\GYaDAEX.exe
  2⤵
  PID:11284
- C:\Windows\System\vlXZkSM.exe
  C:\Windows\System\vlXZkSM.exe
  2⤵
  PID:11304
- C:\Windows\System\zCvTrqi.exe
  C:\Windows\System\zCvTrqi.exe
  2⤵
  PID:11324
- C:\Windows\System\gHfPCqw.exe
  C:\Windows\System\gHfPCqw.exe
  2⤵
  PID:11352
- C:\Windows\System\eSPejgi.exe
  C:\Windows\System\eSPejgi.exe
  2⤵
  PID:11376
- C:\Windows\System\irVfCDw.exe
  C:\Windows\System\irVfCDw.exe
  2⤵
  PID:11404
- C:\Windows\System\XZFTudw.exe
  C:\Windows\System\XZFTudw.exe
  2⤵
  PID:11424
- C:\Windows\System\oqtzdSW.exe
  C:\Windows\System\oqtzdSW.exe
  2⤵
  PID:11448
- C:\Windows\System\hjvjqCA.exe
  C:\Windows\System\hjvjqCA.exe
  2⤵
  PID:11468
- C:\Windows\System\lpBDyfZ.exe
  C:\Windows\System\lpBDyfZ.exe
  2⤵
  PID:11488
- C:\Windows\System\MakgXlI.exe
  C:\Windows\System\MakgXlI.exe
  2⤵
  PID:11512
- C:\Windows\System\VXtyHaz.exe
  C:\Windows\System\VXtyHaz.exe
  2⤵
  PID:11540
- C:\Windows\System\VvVNCyV.exe
  C:\Windows\System\VvVNCyV.exe
  2⤵
  PID:11560
- C:\Windows\System\ZGueMuy.exe
  C:\Windows\System\ZGueMuy.exe
  2⤵
  PID:11576
- C:\Windows\System\XyhLpEh.exe
  C:\Windows\System\XyhLpEh.exe
  2⤵
  PID:11600
- C:\Windows\System\dWCEOrh.exe
  C:\Windows\System\dWCEOrh.exe
  2⤵
  PID:11628
- C:\Windows\System\wXqkTUr.exe
  C:\Windows\System\wXqkTUr.exe
  2⤵
  PID:11648
- C:\Windows\System\uuXniZh.exe
  C:\Windows\System\uuXniZh.exe
  2⤵
  PID:11664
- C:\Windows\System\dTaDjds.exe
  C:\Windows\System\dTaDjds.exe
  2⤵
  PID:11692
- C:\Windows\System\tGjyrdA.exe
  C:\Windows\System\tGjyrdA.exe
  2⤵
  PID:11716
- C:\Windows\System\BszcOHn.exe
  C:\Windows\System\BszcOHn.exe
  2⤵
  PID:11736
- C:\Windows\System\wptLLlb.exe
  C:\Windows\System\wptLLlb.exe
  2⤵
  PID:11760
- C:\Windows\System\hzIqYUJ.exe
  C:\Windows\System\hzIqYUJ.exe
  2⤵
  PID:11780
- C:\Windows\System\dRHliCy.exe
  C:\Windows\System\dRHliCy.exe
  2⤵
  PID:11800
- C:\Windows\System\RgFJXLV.exe
  C:\Windows\System\RgFJXLV.exe
  2⤵
  PID:11824
- C:\Windows\System\cuxbZfM.exe
  C:\Windows\System\cuxbZfM.exe
  2⤵
  PID:11848
- C:\Windows\System\bfpEvar.exe
  C:\Windows\System\bfpEvar.exe
  2⤵
  PID:11868
- C:\Windows\System\qttIIlM.exe
  C:\Windows\System\qttIIlM.exe
  2⤵
  PID:11892
- C:\Windows\System\rvITTNC.exe
  C:\Windows\System\rvITTNC.exe
  2⤵
  PID:11916
- C:\Windows\System\LXJBgXM.exe
  C:\Windows\System\LXJBgXM.exe
  2⤵
  PID:11940
- C:\Windows\System\leWdgLk.exe
  C:\Windows\System\leWdgLk.exe
  2⤵
  PID:11964
- C:\Windows\System\UodOnFC.exe
  C:\Windows\System\UodOnFC.exe
  2⤵
  PID:11984
- C:\Windows\System\dsXYMtx.exe
  C:\Windows\System\dsXYMtx.exe
  2⤵
  PID:12004
- C:\Windows\System\RqdOWpn.exe
  C:\Windows\System\RqdOWpn.exe
  2⤵
  PID:12028
- C:\Windows\System\tWXdYMp.exe
  C:\Windows\System\tWXdYMp.exe
  2⤵
  PID:12056
- C:\Windows\System\zOatEUm.exe
  C:\Windows\System\zOatEUm.exe
  2⤵
  PID:12084
- C:\Windows\System\tjffbon.exe
  C:\Windows\System\tjffbon.exe
  2⤵
  PID:12100
- C:\Windows\System\RKjNDrV.exe
  C:\Windows\System\RKjNDrV.exe
  2⤵
  PID:12116
- C:\Windows\System\jbWEvzI.exe
  C:\Windows\System\jbWEvzI.exe
  2⤵
  PID:12132
- C:\Windows\System\rOTdFxh.exe
  C:\Windows\System\rOTdFxh.exe
  2⤵
  PID:12152
- C:\Windows\System\KtodnIV.exe
  C:\Windows\System\KtodnIV.exe
  2⤵
  PID:12168
- C:\Windows\System\hReUVEr.exe
  C:\Windows\System\hReUVEr.exe
  2⤵
  PID:12184
- C:\Windows\System\hVWgaQE.exe
  C:\Windows\System\hVWgaQE.exe
  2⤵
  PID:12200
- C:\Windows\System\VVJEeLD.exe
  C:\Windows\System\VVJEeLD.exe
  2⤵
  PID:12224
- C:\Windows\System\TysfCKO.exe
  C:\Windows\System\TysfCKO.exe
  2⤵
  PID:12256
- C:\Windows\System\PYHuevC.exe
  C:\Windows\System\PYHuevC.exe
  2⤵
  PID:12280
- C:\Windows\System\VhjpLGt.exe
  C:\Windows\System\VhjpLGt.exe
  2⤵
  PID:9492
- C:\Windows\System\CzLEpHS.exe
  C:\Windows\System\CzLEpHS.exe
  2⤵
  PID:10832
- C:\Windows\System\iNndmCU.exe
  C:\Windows\System\iNndmCU.exe
  2⤵
  PID:9640
- C:\Windows\System\CpWKKRD.exe
  C:\Windows\System\CpWKKRD.exe
  2⤵
  PID:7744
- C:\Windows\System\CziRzCO.exe
  C:\Windows\System\CziRzCO.exe
  2⤵
  PID:8304
- C:\Windows\System\omGbyvJ.exe
  C:\Windows\System\omGbyvJ.exe
  2⤵
  PID:10960
- C:\Windows\System\EcuUZcy.exe
  C:\Windows\System\EcuUZcy.exe
  2⤵
  PID:11020
- C:\Windows\System\kMNcKph.exe
  C:\Windows\System\kMNcKph.exe
  2⤵
  PID:9788
- C:\Windows\System\LthLCNx.exe
  C:\Windows\System\LthLCNx.exe
  2⤵
  PID:11124
- C:\Windows\System\GMUtcHz.exe
  C:\Windows\System\GMUtcHz.exe
  2⤵
  PID:9952
- C:\Windows\System\MCNaJPs.exe
  C:\Windows\System\MCNaJPs.exe
  2⤵
  PID:10396
- C:\Windows\System\tuSIbbp.exe
  C:\Windows\System\tuSIbbp.exe
  2⤵
  PID:4348
- C:\Windows\System\OeZEkYs.exe
  C:\Windows\System\OeZEkYs.exe
  2⤵
  PID:636
- C:\Windows\System\JZAlyvF.exe
  C:\Windows\System\JZAlyvF.exe
  2⤵
  PID:9428
- C:\Windows\System\muLOEOi.exe
  C:\Windows\System\muLOEOi.exe
  2⤵
  PID:3084
- C:\Windows\System\vOLoRvD.exe
  C:\Windows\System\vOLoRvD.exe
  2⤵
  PID:10640
- C:\Windows\System\RzrboPk.exe
  C:\Windows\System\RzrboPk.exe
  2⤵
  PID:10688
- C:\Windows\System\iySTFCJ.exe
  C:\Windows\System\iySTFCJ.exe
  2⤵
  PID:9320
- C:\Windows\System\oWGZtOX.exe
  C:\Windows\System\oWGZtOX.exe
  2⤵
  PID:10184
- C:\Windows\System\iLNkHFf.exe
  C:\Windows\System\iLNkHFf.exe
  2⤵
  PID:10220
- C:\Windows\System\NusLkle.exe
  C:\Windows\System\NusLkle.exe
  2⤵
  PID:12308
- C:\Windows\System\AYLlJPL.exe
  C:\Windows\System\AYLlJPL.exe
  2⤵
  PID:12344
- C:\Windows\System\icANQRC.exe
  C:\Windows\System\icANQRC.exe
  2⤵
  PID:12364
- C:\Windows\System\Folxitf.exe
  C:\Windows\System\Folxitf.exe
  2⤵
  PID:12384
- C:\Windows\System\QeOawEx.exe
  C:\Windows\System\QeOawEx.exe
  2⤵
  PID:12408
- C:\Windows\System\vtJztQt.exe
  C:\Windows\System\vtJztQt.exe
  2⤵
  PID:12424
- C:\Windows\System\qpurWkI.exe
  C:\Windows\System\qpurWkI.exe
  2⤵
  PID:12448
- C:\Windows\System\CknmrNO.exe
  C:\Windows\System\CknmrNO.exe
  2⤵
  PID:12472
- C:\Windows\System\LSTtheH.exe
  C:\Windows\System\LSTtheH.exe
  2⤵
  PID:12492
- C:\Windows\System\JgzZprS.exe
  C:\Windows\System\JgzZprS.exe
  2⤵
  PID:12516
- C:\Windows\System\btSIOKs.exe
  C:\Windows\System\btSIOKs.exe
  2⤵
  PID:12540
- C:\Windows\System\RJtbJqT.exe
  C:\Windows\System\RJtbJqT.exe
  2⤵
  PID:12560
- C:\Windows\System\QJazSJC.exe
  C:\Windows\System\QJazSJC.exe
  2⤵
  PID:12584
- C:\Windows\System\TjwPieF.exe
  C:\Windows\System\TjwPieF.exe
  2⤵
  PID:12612
- C:\Windows\System\JKoRnGN.exe
  C:\Windows\System\JKoRnGN.exe
  2⤵
  PID:12636
- C:\Windows\System\LuSJXYm.exe
  C:\Windows\System\LuSJXYm.exe
  2⤵
  PID:12656
- C:\Windows\System\OiCncbb.exe
  C:\Windows\System\OiCncbb.exe
  2⤵
  PID:12680
- C:\Windows\System\gTWvSZS.exe
  C:\Windows\System\gTWvSZS.exe
  2⤵
  PID:12704
- C:\Windows\System\OcgzEMM.exe
  C:\Windows\System\OcgzEMM.exe
  2⤵
  PID:12724
- C:\Windows\System\ksMCgxC.exe
  C:\Windows\System\ksMCgxC.exe
  2⤵
  PID:12752
- C:\Windows\System\DpMlzDT.exe
  C:\Windows\System\DpMlzDT.exe
  2⤵
  PID:12776
- C:\Windows\System\BMLYQvF.exe
  C:\Windows\System\BMLYQvF.exe
  2⤵
  PID:12796
- C:\Windows\System\bkLGrot.exe
  C:\Windows\System\bkLGrot.exe
  2⤵
  PID:11024
- C:\Windows\System\nhbfEDY.exe
  C:\Windows\System\nhbfEDY.exe
  2⤵
  PID:9648
- C:\Windows\System\khvyKfV.exe
  C:\Windows\System\khvyKfV.exe
  2⤵
  PID:10268
- C:\Windows\System\bDTNlCF.exe
  C:\Windows\System\bDTNlCF.exe
  2⤵
  PID:12160
- C:\Windows\System\VkvlNVp.exe
  C:\Windows\System\VkvlNVp.exe
  2⤵
  PID:12220
- C:\Windows\System\uzhCdtP.exe
  C:\Windows\System\uzhCdtP.exe
  2⤵
  PID:11244
- C:\Windows\System\nMPCcSO.exe
  C:\Windows\System\nMPCcSO.exe
  2⤵
  PID:10408
- C:\Windows\System\ybSpZvt.exe
  C:\Windows\System\ybSpZvt.exe
  2⤵
  PID:9716
- C:\Windows\System\byPJrZd.exe
  C:\Windows\System\byPJrZd.exe
  2⤵
  PID:10432
- C:\Windows\System\OEUtmgu.exe
  C:\Windows\System\OEUtmgu.exe
  2⤵
  PID:10488
- C:\Windows\System\tHJJphn.exe
  C:\Windows\System\tHJJphn.exe
  2⤵
  PID:10516
- C:\Windows\System\fLfetKc.exe
  C:\Windows\System\fLfetKc.exe
  2⤵
  PID:10368
- C:\Windows\System\ZeesIoE.exe
  C:\Windows\System\ZeesIoE.exe
  2⤵
  PID:8808
- C:\Windows\System\qeNgqiI.exe
  C:\Windows\System\qeNgqiI.exe
  2⤵
  PID:10592
- C:\Windows\System\NqXpIgi.exe
  C:\Windows\System\NqXpIgi.exe
  2⤵
  PID:10440
- C:\Windows\System\mxZKtYQ.exe
  C:\Windows\System\mxZKtYQ.exe
  2⤵
  PID:10056
- C:\Windows\System\wrdixbH.exe
  C:\Windows\System\wrdixbH.exe
  2⤵
  PID:9432
- C:\Windows\System\aouSmKi.exe
  C:\Windows\System\aouSmKi.exe
  2⤵
  PID:10208
- C:\Windows\System\empkWKr.exe
  C:\Windows\System\empkWKr.exe
  2⤵
  PID:12320
- C:\Windows\System\vOpHgdV.exe
  C:\Windows\System\vOpHgdV.exe
  2⤵
  PID:12376
- C:\Windows\System\TwyuQTG.exe
  C:\Windows\System\TwyuQTG.exe
  2⤵
  PID:10812
- C:\Windows\System\hdXkMkJ.exe
  C:\Windows\System\hdXkMkJ.exe
  2⤵
  PID:11432
- C:\Windows\System\KfsGlOz.exe
  C:\Windows\System\KfsGlOz.exe
  2⤵
  PID:12480
- C:\Windows\System\RdjGoEl.exe
  C:\Windows\System\RdjGoEl.exe
  2⤵
  PID:12528
- C:\Windows\System\GNoaMfk.exe
  C:\Windows\System\GNoaMfk.exe
  2⤵
  PID:13056
- C:\Windows\System\YOFtxoJ.exe
  C:\Windows\System\YOFtxoJ.exe
  2⤵
  PID:12644
- C:\Windows\System\pvxdRRK.exe
  C:\Windows\System\pvxdRRK.exe
  2⤵
  PID:12672
- C:\Windows\System\uwvMMhi.exe
  C:\Windows\System\uwvMMhi.exe
  2⤵
  PID:12720
- C:\Windows\System\FAclqcS.exe
  C:\Windows\System\FAclqcS.exe
  2⤵
  PID:11048
- C:\Windows\System\UcgnvAk.exe
  C:\Windows\System\UcgnvAk.exe
  2⤵
  PID:12884
- C:\Windows\System\iYKmmbI.exe
  C:\Windows\System\iYKmmbI.exe
  2⤵
  PID:12044
- C:\Windows\System\jOrfZPo.exe
  C:\Windows\System\jOrfZPo.exe
  2⤵
  PID:11440
- C:\Windows\System\OMOadQU.exe
  C:\Windows\System\OMOadQU.exe
  2⤵
  PID:11496
- C:\Windows\System\ZqlicsY.exe
  C:\Windows\System\ZqlicsY.exe
  2⤵
  PID:11732
- C:\Windows\System\dCkTXtj.exe
  C:\Windows\System\dCkTXtj.exe
  2⤵
  PID:11900
- C:\Windows\System\zptTapO.exe
  C:\Windows\System\zptTapO.exe
  2⤵
  PID:11976
- C:\Windows\System\nKHdrHU.exe
  C:\Windows\System\nKHdrHU.exe
  2⤵
  PID:12072
- C:\Windows\System\uDpENrz.exe
  C:\Windows\System\uDpENrz.exe
  2⤵
  PID:12144
- C:\Windows\System\qWszBZi.exe
  C:\Windows\System\qWszBZi.exe
  2⤵
  PID:12276
- C:\Windows\System\NpHGXXh.exe
  C:\Windows\System\NpHGXXh.exe
  2⤵
  PID:7312
- C:\Windows\System\HlWxcUj.exe
  C:\Windows\System\HlWxcUj.exe
  2⤵
  PID:10420
- C:\Windows\System\cflncty.exe
  C:\Windows\System\cflncty.exe
  2⤵
  PID:9996
- C:\Windows\System\LOBXusJ.exe
  C:\Windows\System\LOBXusJ.exe
  2⤵
  PID:10196
- C:\Windows\System\VBbfbJv.exe
  C:\Windows\System\VBbfbJv.exe
  2⤵
  PID:12372
- C:\Windows\System\fNdSGAb.exe
  C:\Windows\System\fNdSGAb.exe
  2⤵
  PID:12420
- C:\Windows\System\tZqCGDE.exe
  C:\Windows\System\tZqCGDE.exe
  2⤵
  PID:12592
- C:\Windows\System\ZDEeMqn.exe
  C:\Windows\System\ZDEeMqn.exe
  2⤵
  PID:12760
- C:\Windows\System\fjBPhxl.exe
  C:\Windows\System\fjBPhxl.exe
  2⤵
  PID:12804
- C:\Windows\System\KLyFkNd.exe
  C:\Windows\System\KLyFkNd.exe
  2⤵
  PID:12832
- C:\Windows\System\BNlaoaJ.exe
  C:\Windows\System\BNlaoaJ.exe
  2⤵
  PID:12900
- C:\Windows\System\gWjswqO.exe
  C:\Windows\System\gWjswqO.exe
  2⤵
  PID:12940
- C:\Windows\System\sDMmvlM.exe
  C:\Windows\System\sDMmvlM.exe
  2⤵
  PID:12984
- C:\Windows\System\Covlmes.exe
  C:\Windows\System\Covlmes.exe
  2⤵
  PID:13084
- C:\Windows\System\NtKlExN.exe
  C:\Windows\System\NtKlExN.exe
  2⤵
  PID:13116
- C:\Windows\System\YoBSDFU.exe
  C:\Windows\System\YoBSDFU.exe
  2⤵
  PID:13160
- C:\Windows\System\imDLYRX.exe
  C:\Windows\System\imDLYRX.exe
  2⤵
  PID:13196
- C:\Windows\System\WwThAhy.exe
  C:\Windows\System\WwThAhy.exe
  2⤵
  PID:13208
- C:\Windows\System\VgypxIT.exe
  C:\Windows\System\VgypxIT.exe
  2⤵
  PID:13176
- C:\Windows\System\IJqwkQr.exe
  C:\Windows\System\IJqwkQr.exe
  2⤵
  PID:11640
- C:\Windows\System\cJBctWs.exe
  C:\Windows\System\cJBctWs.exe
  2⤵
  PID:12880
- C:\Windows\System\OlfqhfW.exe
  C:\Windows\System\OlfqhfW.exe
  2⤵
  PID:11196
- C:\Windows\System\QKKgYpM.exe
  C:\Windows\System\QKKgYpM.exe
  2⤵
  PID:11836
- C:\Windows\System\pQeexVE.exe
  C:\Windows\System\pQeexVE.exe
  2⤵
  PID:12828
- C:\Windows\System\qxjAVxt.exe
  C:\Windows\System\qxjAVxt.exe
  2⤵
  PID:9668
- C:\Windows\System\fdXZHzL.exe
  C:\Windows\System\fdXZHzL.exe
  2⤵
  PID:11816
- C:\Windows\System\kYyHhRk.exe
  C:\Windows\System\kYyHhRk.exe
  2⤵
  PID:12872
- C:\Windows\System\HlHrcWg.exe
  C:\Windows\System\HlHrcWg.exe
  2⤵
  PID:12772
- C:\Windows\System\TTnamsI.exe
  C:\Windows\System\TTnamsI.exe
  2⤵
  PID:12812
- C:\Windows\System\rZPukko.exe
  C:\Windows\System\rZPukko.exe
  2⤵
  PID:11884
- C:\Windows\System\wBHIjDH.exe
  C:\Windows\System\wBHIjDH.exe
  2⤵
  PID:12416
- C:\Windows\System\KpQqAvT.exe
  C:\Windows\System\KpQqAvT.exe
  2⤵
  PID:9696
- C:\Windows\System\UuvgKuK.exe
  C:\Windows\System\UuvgKuK.exe
  2⤵
  PID:11100
- C:\Windows\System\dviMiPL.exe
  C:\Windows\System\dviMiPL.exe
  2⤵
  PID:12896
- C:\Windows\System\wjrYATE.exe
  C:\Windows\System\wjrYATE.exe
  2⤵
  PID:12936
- C:\Windows\System\HiUheti.exe
  C:\Windows\System\HiUheti.exe
  2⤵
  PID:11840
- C:\Windows\System\DfzPSEl.exe
  C:\Windows\System\DfzPSEl.exe
  2⤵
  PID:11608
- C:\Windows\System\dYJGtrq.exe
  C:\Windows\System\dYJGtrq.exe
  2⤵
  PID:11768
- C:\Windows\System\PFvoNQj.exe
  C:\Windows\System\PFvoNQj.exe
  2⤵
  PID:12356
- C:\Windows\System\JssUJLB.exe
  C:\Windows\System\JssUJLB.exe
  2⤵
  PID:13376
- C:\Windows\System\pwMfjlx.exe
  C:\Windows\System\pwMfjlx.exe
  2⤵
  PID:13472
- C:\Windows\System\fMmEmgg.exe
  C:\Windows\System\fMmEmgg.exe
  2⤵
  PID:13544
- C:\Windows\System\eoAGAPr.exe
  C:\Windows\System\eoAGAPr.exe
  2⤵
  PID:13572
- C:\Windows\System\uPXFMHy.exe
  C:\Windows\System\uPXFMHy.exe
  2⤵
  PID:13596
- C:\Windows\System\sgBwgEt.exe
  C:\Windows\System\sgBwgEt.exe
  2⤵
  PID:13652
- C:\Windows\System\RLJgUmH.exe
  C:\Windows\System\RLJgUmH.exe
  2⤵
  PID:13676
- C:\Windows\System\OajUQjZ.exe
  C:\Windows\System\OajUQjZ.exe
  2⤵
  PID:13696
- C:\Windows\System\WSODdmx.exe
  C:\Windows\System\WSODdmx.exe
  2⤵
  PID:13884
- C:\Windows\System\pUlMBxx.exe
  C:\Windows\System\pUlMBxx.exe
  2⤵
  PID:13916
- C:\Windows\System\mckcOqr.exe
  C:\Windows\System\mckcOqr.exe
  2⤵
  PID:14008
- C:\Windows\System\GSlkpAw.exe
  C:\Windows\System\GSlkpAw.exe
  2⤵
  PID:14028
- C:\Windows\System\ObAEhxt.exe
  C:\Windows\System\ObAEhxt.exe
  2⤵
  PID:14052
- C:\Windows\System\AiBTtKM.exe
  C:\Windows\System\AiBTtKM.exe
  2⤵
  PID:14072
- C:\Windows\System\TzbQjdf.exe
  C:\Windows\System\TzbQjdf.exe
  2⤵
  PID:14096
- C:\Windows\System\EvCyucq.exe
  C:\Windows\System\EvCyucq.exe
  2⤵
  PID:14112
- C:\Windows\System\HdDdCQu.exe
  C:\Windows\System\HdDdCQu.exe
  2⤵
  PID:14132
- C:\Windows\System\SzeipXt.exe
  C:\Windows\System\SzeipXt.exe
  2⤵
  PID:14152
- C:\Windows\System\cGgGVBp.exe
  C:\Windows\System\cGgGVBp.exe
  2⤵
  PID:14172
- C:\Windows\System\joPlQpl.exe
  C:\Windows\System\joPlQpl.exe
  2⤵
  PID:14188
- C:\Windows\System\kRLDAYB.exe
  C:\Windows\System\kRLDAYB.exe
  2⤵
  PID:14332
- C:\Windows\System\qCxVVLE.exe
  C:\Windows\System\qCxVVLE.exe
  2⤵
  PID:10920
- C:\Windows\System\iYvUoGY.exe
  C:\Windows\System\iYvUoGY.exe
  2⤵
  PID:10708
- C:\Windows\System\nYLJMdM.exe
  C:\Windows\System\nYLJMdM.exe
  2⤵
  PID:8712
- C:\Windows\System\okYsCGp.exe
  C:\Windows\System\okYsCGp.exe
  2⤵
  PID:12932
- C:\Windows\System\pwWCxtw.exe
  C:\Windows\System\pwWCxtw.exe
  2⤵
  PID:6176
- C:\Windows\System\mDoIVmY.exe
  C:\Windows\System\mDoIVmY.exe
  2⤵
  PID:13280
- C:\Windows\System\ZnyhQxo.exe
  C:\Windows\System\ZnyhQxo.exe
  2⤵
  PID:2280
- C:\Windows\System\nPVxIJH.exe
  C:\Windows\System\nPVxIJH.exe
  2⤵
  PID:13356
- C:\Windows\System\DinCNOe.exe
  C:\Windows\System\DinCNOe.exe
  2⤵
  PID:13372
- C:\Windows\System\siKRJYu.exe
  C:\Windows\System\siKRJYu.exe
  2⤵
  PID:8340
- C:\Windows\System\MKyiUTA.exe
  C:\Windows\System\MKyiUTA.exe
  2⤵
  PID:13436
- C:\Windows\System\GdeQgyJ.exe
  C:\Windows\System\GdeQgyJ.exe
  2⤵
  PID:10792
- C:\Windows\System\JZscJOA.exe
  C:\Windows\System\JZscJOA.exe
  2⤵
  PID:13320
- C:\Windows\System\siSOaLD.exe
  C:\Windows\System\siSOaLD.exe
  2⤵
  PID:13340
- C:\Windows\System\BorSdNf.exe
  C:\Windows\System\BorSdNf.exe
  2⤵
  PID:13496
- C:\Windows\System\CSTPKob.exe
  C:\Windows\System\CSTPKob.exe
  2⤵
  PID:13516
- C:\Windows\System\HfSJCMH.exe
  C:\Windows\System\HfSJCMH.exe
  2⤵
  PID:12176
- C:\Windows\System\VxmlJbp.exe
  C:\Windows\System\VxmlJbp.exe
  2⤵
  PID:4008
- C:\Windows\System\cEjwnis.exe
  C:\Windows\System\cEjwnis.exe
  2⤵
  PID:5628
- C:\Windows\System\HTrNxWB.exe
  C:\Windows\System\HTrNxWB.exe
  2⤵
  PID:5376
- C:\Windows\System\uGYdOPH.exe
  C:\Windows\System\uGYdOPH.exe
  2⤵
  PID:13712
- C:\Windows\System\fRctyiM.exe
  C:\Windows\System\fRctyiM.exe
  2⤵
  PID:13648
- C:\Windows\System\XQolIXw.exe
  C:\Windows\System\XQolIXw.exe
  2⤵
  PID:13668
- C:\Windows\System\gnOguwM.exe
  C:\Windows\System\gnOguwM.exe
  2⤵
  PID:13612
- C:\Windows\System\ZNXAukx.exe
  C:\Windows\System\ZNXAukx.exe
  2⤵
  PID:7064
- C:\Windows\System\vscIXRi.exe
  C:\Windows\System\vscIXRi.exe
  2⤵
  PID:13692
- C:\Windows\System\VGqzPmf.exe
  C:\Windows\System\VGqzPmf.exe
  2⤵
  PID:13772
- C:\Windows\System\NKzyiOk.exe
  C:\Windows\System\NKzyiOk.exe
  2⤵
  PID:13720
- C:\Windows\System\vQytKed.exe
  C:\Windows\System\vQytKed.exe
  2⤵
  PID:13816
- C:\Windows\System\TrflsJX.exe
  C:\Windows\System\TrflsJX.exe
  2⤵
  PID:13824
- C:\Windows\System\pBiIeMs.exe
  C:\Windows\System\pBiIeMs.exe
  2⤵
  PID:13996
- C:\Windows\System\zFwLSNj.exe
  C:\Windows\System\zFwLSNj.exe
  2⤵
  PID:14068
- C:\Windows\System\chYzkOj.exe
  C:\Windows\System\chYzkOj.exe
  2⤵
  PID:14128
- C:\Windows\System\BWpBjQA.exe
  C:\Windows\System\BWpBjQA.exe
  2⤵
  PID:5944
- C:\Windows\System\QxzRaAh.exe
  C:\Windows\System\QxzRaAh.exe
  2⤵
  PID:13904
- C:\Windows\System\jzgxcCq.exe
  C:\Windows\System\jzgxcCq.exe
  2⤵
  PID:13724
- C:\Windows\System\OUXqjPy.exe
  C:\Windows\System\OUXqjPy.exe
  2⤵
  PID:14040
- C:\Windows\System\NxjeURx.exe
  C:\Windows\System\NxjeURx.exe
  2⤵
  PID:672
- C:\Windows\System\lFsuwXa.exe
  C:\Windows\System\lFsuwXa.exe
  2⤵
  PID:14088
- C:\Windows\System\PwGOHIA.exe
  C:\Windows\System\PwGOHIA.exe
  2⤵
  PID:14280
- C:\Windows\System\qNhTdhh.exe
  C:\Windows\System\qNhTdhh.exe
  2⤵
  PID:14272
- C:\Windows\System\CpXsQTO.exe
  C:\Windows\System\CpXsQTO.exe
  2⤵
  PID:14200
- C:\Windows\System\eaXhskc.exe
  C:\Windows\System\eaXhskc.exe
  2⤵
  PID:1240
- C:\Windows\System\SQsXZIp.exe
  C:\Windows\System\SQsXZIp.exe
  2⤵
  PID:13444
- C:\Windows\System\vFgRAdE.exe
  C:\Windows\System\vFgRAdE.exe
  2⤵
  PID:1156
- C:\Windows\System\Ogqgpzw.exe
  C:\Windows\System\Ogqgpzw.exe
  2⤵
  PID:11280
- C:\Windows\System\wcAmNAb.exe
  C:\Windows\System\wcAmNAb.exe
  2⤵
  PID:13536

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 548 -p 11008 -ip 11008
1⤵
PID:12416

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:14104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3esjlfgx.rqb.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BuZYgzt.exe

Filesize
2.1MB

MD5
795c675f83131a012faa14823c760d06

SHA1
9bb26f0e865e240a04fda59f9158ab64e161664f

SHA256
4709c6536846770f6f9322769564ddf45da6de2125ed038a2bffaf85a324333c

SHA512
4c35f1cc29e376ae4eed57b6e36278613e08254a52e32e692f7137b42c7f1408e7718fa070d4bfc2bd90185ab7308f4a512ca6c301bbca8c58ed281ff549fe14

Download Submit
C:\Windows\System\DQOXUvj.exe

Filesize
2.1MB

MD5
6f3d8e38654f5259f0b44228c3e88e4e

SHA1
c526cf0945abac26f20f7e951b1c6cfb66678584

SHA256
4bfc8bf8f2e85c30fe1b63423f72b7630f3ad353914057b5ddb99100442599ea

SHA512
aefad188982f4e03edb9135417e001b12ae2b88b111b9eb76c6427f303890696e97a0c58f3d300ced6b0503351085a6c755043ca06c1ba60b191c3a495c97be5

Download Submit
C:\Windows\System\DdjBqeo.exe

Filesize
2.1MB

MD5
151869bfe2c0a8191e97752615823f7a

SHA1
1a1fb6fa034430627fbd37f98674cd48fcfaba80

SHA256
9050d1227c0b4efda0d8a8762346a4eaf9822f9eee8713e87c8257ca11616e48

SHA512
fce173c90404ba4598e79e6607b85b87946f7bedde638bf19246f363153e609beb5fddd28ed7a001303b3817f943ecd47c13554b5cdd68f814cda97fee1a78fc

Download Submit
C:\Windows\System\EgpGJYF.exe

Filesize
2.1MB

MD5
61eb537a9ae2901d95479fca32ad7492

SHA1
63d9c07f4331d7a97dcbd1a4fae75a0b574b6849

SHA256
481656483c06c8e4f5d3533dc1bdffc4850071e9f4889540f4969dc8bfcc5a6e

SHA512
9106e3fb5429cf1f1a62bedb886a448555bcb8e540ed2660beb47aed29ba3deb090d8d78e226b39216dd85ca0e456510ff7a900cc9afbbedfd89c19f64af50a6

Download Submit
C:\Windows\System\GJtChit.exe

Filesize
2.1MB

MD5
feb901d3987f107026e1598fa163c037

SHA1
45ddfbd86e4471d55e4e4cd3fb7e148e48171803

SHA256
23c796056b1f3e9b658b937716b96d6a9c2993e5dc0a50a6e67ea8bcb4b3535f

SHA512
44507c10d087f7134a8de5cd793fd8f8159cda596274ae99a276cc3df8c3284666db97c73b59cfd0f8874bf4c6b3295b9e38faaa83214f21f8d24859caf0aab2

Download Submit
C:\Windows\System\GiAxKnh.exe

Filesize
2.1MB

MD5
10b42c2c7485f5c2b16a23b81622c19f

SHA1
f731e1561fdd7c1d7896476c4fb818f9df7d2703

SHA256
34a3d69a7e7c09230e60582e8a61d574807c2d4043dd0f5c42fd5d59ffe520cd

SHA512
edcfff18dfb4e528091f0dd0e6828d616b96583f6e7dc53f4ea0f43d3cd95d932b2ac723c4d318b71fd7a82f433a6d3fc5a54c6db7053033029533b9998eac0b

Download Submit
C:\Windows\System\HlYRykH.exe

Filesize
2.1MB

MD5
d0cfa241556932f142b2848cf057c660

SHA1
30f5d34c00d7d27d4d107d564ef8c676628f4b68

SHA256
1366856bc6e965c7393b161afcdf0b21f200717ae97a58f29b8aa4e09de782ce

SHA512
d041cc8e96db1688723cc1b9dd0650ad95cf965eafa2b6bb1248c679ab1ea5d3c0eaae9048077b92ce0adc385589b02775f2a0f680343b6cebbcb38f4880311e

Download Submit
C:\Windows\System\IQkfQln.exe

Filesize
2.1MB

MD5
d40b9b2fae0f3caca7a42b8434dbea98

SHA1
da7ff17396b9eba21e8d52d8e0eb788cfde9b268

SHA256
9b049fe75a1cf441e6784d2d46ff8c5e23ea5ae0e25bb47a2835dbf3f51a26b3

SHA512
ee30ec039b70dd494f290023934c9d8ef461f70eb4c041a686416b48cb24402aea52dcc3f8997567b1c59712dfd97ef3d2e0bfe8ddf4e37df04437304b895283

Download Submit
C:\Windows\System\IWlqkFy.exe

Filesize
2.1MB

MD5
96d2cb16d761ba1164fa5f22aa454709

SHA1
8b54bed1b96256700212d07196aabd69ae698dbb

SHA256
8ea45a432900b93bacab50b9d95db314f1a136acd02238d1aa59fa340baaa915

SHA512
40f3423b332ee1e9e22fcf8d795f6a959bab1554e4bd37426c346cdf9c0dbdb4dbb3e390c323c9296c41dc21bc770fbe90aef57f1d1e7143c07ddb53bd2f62ea

Download Submit
C:\Windows\System\JYWKwbY.exe

Filesize
2.1MB

MD5
bff4094b355596b1c0b303afd3eb9201

SHA1
fa885837fd4a78aaece60b607794210565e7316c

SHA256
97f7c83961968abfc8645ce160dda471408c7ff9508cd210b91c20499cc5caf8

SHA512
a1a69f18e812f98fdc6d5cdca7490ba4744cf845e1473ea5009bd29e0caa1c478980885fd812976b76d3b84edff4b3f605363ebfa509cf5e59cffd8c4c2009ea

Download Submit
C:\Windows\System\KMYpCaT.exe

Filesize
8B

MD5
3f9cfe8a165fbe5ed357bf4fb6550d1a

SHA1
d1f76cef8b11f404ce3021901f1968e523167625

SHA256
fe7331c05f745b95f5509c04136ec2be8073cae1c2054bbe90290f3a5e3a1c01

SHA512
7c297d93de1529b68ba232f55d08c5bdfcf13a5c3741f810e605eeec9da08911d3d07e6bd5c21436fbf2be3db2070f19515d3ae2f1e7604c2ff2f34139c616ce

Download Submit
C:\Windows\System\MoFAFNm.exe

Filesize
2.1MB

MD5
5b8059f3f0912f7ccc1d0707701c26a8

SHA1
c191a4f15953acc81102cbeff2ce2b8f79954a7a

SHA256
cb0b1697a26ed6087dbb11e865779c43af943b67e653bdcbe7b768fc87dfc902

SHA512
b7c3f6008df19697592655cae2e360009d67a663061d225830db1b7b39a9c9ff1af4f838bd0607f1b6e408b7b2f284a1f795f1591c7b7479daf962e27c510eed

Download Submit
C:\Windows\System\MoWOnVF.exe

Filesize
2.1MB

MD5
f898243b72b6f0a1ae693629c9b2c76a

SHA1
7bf23a75c7be16cf4afe85c80dd11c0c48bd57be

SHA256
52924c05e6251182882d07e25611a1fcfab78a88ed117339c7195d0d66534a8b

SHA512
e170f0ac129dbca99b2ddd60672278a8b92c76c3256847f39189d54af6151e8bb87421f737b0575b054fefa144d846d9cbfc5708c4dde183b151cd6f442f3e78

Download Submit
C:\Windows\System\OWIwQnp.exe

Filesize
2.1MB

MD5
afd3c4b8250950aa4e330cf6ee8643ae

SHA1
c5227818a37936895ca89973387da99434232284

SHA256
ba9aad5dd31e34dbc5dbc9afd6730e4c043706b468ef9e461f3d4c64da3a6c12

SHA512
a415f6ebe2ee524588483fe7eff6cddb3667f05e9be28557e02b26d2bacd6f426cc9b54ef9ebe04267e899660b12e574ea728915fdcaa6feeee5cd8ea245ebd0

Download Submit
C:\Windows\System\QshMwNj.exe

Filesize
2.1MB

MD5
28e497e2fa34c553b89160badd78b162

SHA1
fa5570d966e082d69bc4e68bb102ea91072cfbe3

SHA256
0aaf5445b75f7136b78fd9de2d70c4bd9f173a42f2b297eea8dc39355ff0850f

SHA512
fa4dd163306a031e08be2f407734977b668ecdc8426f7f9594dc1c2dd310d1b8d62f868ebd26b918ad45970aa5e2f4aaa34c1a20da98253c7b0f5d9d8861a58c

Download Submit
C:\Windows\System\RyJnoTo.exe

Filesize
2.1MB

MD5
cc097de50f350a559d186f6abdf07d10

SHA1
f90ed4d47af4ff77d62c3aa7c27c9e9823cbd6ec

SHA256
35bfc2efa5d96ae48b852d5e8806904796b72bccfdbd2b13731504e14067a503

SHA512
4992926651c528bbf2c3c3804caa8bc5e4ce0c30267a4eb0ab2472ec7ef9bd266997c099ebbee2029c2fb5d8446415a5b18d9b37fda2eb115ea3402230a4654e

Download Submit
C:\Windows\System\UoJndih.exe

Filesize
2.1MB

MD5
1124881e2a77eaffc0f3fdf36050c081

SHA1
2255e310fc995d7cf245c09b22a9f5d65d4029c2

SHA256
3c93a9366ecd4325c032abfc1d395f3103eb82ee37c41703f3bc166ea17f670d

SHA512
e81698d48f901570d5d9dbe38c315557f00e13ebeae187887ff5ca3f85557ff96ab5077e523329ffa9426a8b27701c09a9dddbea77452306ec1936e3023f96c2

Download Submit
C:\Windows\System\VYsliFk.exe

Filesize
2.1MB

MD5
8517894504ea2200eb443461d82b6cf7

SHA1
5155c0155f149d8888ea07237984cc1355fb8a19

SHA256
40364d3b1cdf7c9deff5c5ab4d0970e25eb7d0b8046f256f1abc016cff55c94e

SHA512
c0ebd7510e924dcf62c189be1d1cf9805e635bf9eb0a91805fc4dec769f39228383854b5588f449b14581b276f153a5fd3d8f7973eb6c10a4ad49af85fb6000f

Download Submit
C:\Windows\System\VjZudGJ.exe

Filesize
2.1MB

MD5
db53adcf751c7940e35b0e1a91237139

SHA1
0c0c9b426b1fc5de9e2595d05175755d78b28f88

SHA256
1600550384195a8744ec48f9d58f133920292580392f35d8a2ffedb6b4d00a77

SHA512
94c48abd26cafbdd72017a6b6aaeb5c5a57b33b4fed1dc95ab10755f0d473cce663e94a65285f657dae081e5a2c0f236ce7722f7ac09727a12fc2000bcf3aa6d

Download Submit
C:\Windows\System\VkhBVao.exe

Filesize
2.1MB

MD5
615a03aec89b4317129cfaf42fb47fec

SHA1
d0b7ce76806f575bd49028753b8a88bb41c9c770

SHA256
39977b4673c97bef43c87af7455e55e152d713e6ff635371cd97ea41c63e112e

SHA512
c62ea0f6f6d98be9dd66d99cb636a7a7fce9b0c815244473e5298e8c02afcfe0dc2a7004c9b6e641bf5cc1a380b19411afd548d4d27b1c3e2f1c5fbcdb4009ac

Download Submit
C:\Windows\System\VxxsLYg.exe

Filesize
2.1MB

MD5
f841fccf9487bf0003d655b98c4e0dce

SHA1
ad4aa1f75689e9778d8ba7367f0503373f8198d3

SHA256
bcd206d5b504ab2954bf7620b8c23bc4df7221f0f58df49c8900783f56a6d21e

SHA512
07de73ad53474d899d07e586a22cc746a5270eade2580891805a45143264cee4a0d40ce30d55d45e4faac5266a6ad127ad0c4d616318a79b5d469dfaa541f4e5

Download Submit
C:\Windows\System\WECrCLP.exe

Filesize
2.1MB

MD5
7c2e41511a27666c504abf5d8efcdd27

SHA1
fd118c12c6acfa5c4d464286b009a7786d63cf17

SHA256
c0c155f5987ffec80e779fc6edba89095d156007c26cc2ae93a207c12a60a5dc

SHA512
9cb1cd230bd58cbcf396315c1905d576acdd187fc32bec154f1790e29dc352eb3cdf3f8aa28492f29be5ecffbe48a004bd1b4187a333fc1467e1482accc838c1

Download Submit
C:\Windows\System\ZTQTXXh.exe

Filesize
2.1MB

MD5
b4644d3c4329a5faf66e48e5d1046381

SHA1
b7ead1e6fdc8bd4bdcde162c472204763c290ce8

SHA256
74dbf815cae6121654b5a3f7ed1a9d75a57e413198212d5ce7b6463798e47fb6

SHA512
fd6bb9a917a4b24277c15dee045de91f7618db576527018bbcc2165d3b58dcff8f2552def545bcf7c6e6a58c99a9287254d292b16309cad0908d40a925920779

Download Submit
C:\Windows\System\ZZAhPII.exe

Filesize
2.1MB

MD5
9cbf6e08db613837dd108b2b3d426194

SHA1
0c5c33d2bad2169e0a7f780b340437cadde99a17

SHA256
2b3655e9180ddebebff765eed1cd2bfb1cfba44fff29034277be3ce22a6d9b8c

SHA512
4edb15ef10cff4e6ba96b2d19214c79fea1aa3d3a8e9a496a21431d88f07b824f11a3af76c2dd673ec61fe1c13929763652307f009ce23eb068d0e8ef478334c

Download Submit
C:\Windows\System\avjZgUW.exe

Filesize
2.1MB

MD5
a8b1d2188aa4032b1f37649557a3414e

SHA1
475dc831b7d85e8e6db25e7ef7cd4d83c003b91d

SHA256
45cee10c0f2493ef14af21756b6d9b2647bb326dcd435f9548acd4c05b2f7d87

SHA512
3c04530eafa4f1c2f463b142dd3c2e2498c3c54cd13681a8d37a0ad249f365b72e5f85d7e8d6ce0395ffd56db6c8de9c787a82e2ad442d59766460beada02684

Download Submit
C:\Windows\System\esSxJsZ.exe

Filesize
2.1MB

MD5
776a052d532dd3bc9311680f9653ffe4

SHA1
ebef55ba8f06054bf0da1262da4433de6736e3e4

SHA256
eb6e0edfc8ce6abd0152e7621eea6abe3de7f441460680d5d3e8a5dee6010c51

SHA512
1758685b1fcc00fef861dd53eefbafd8cef53cd4ee1ad88b9d23b43f928a805442055cb4c9d4ede824e273b45ab3b4654de689491918d151d28ebc7a95f01525

Download Submit
C:\Windows\System\ggIyEzL.exe

Filesize
2.1MB

MD5
0d91e13f86cdca5fe015478dd4771f6f

SHA1
88614b53d48211b42b2d161ad2bb5da6ca58536b

SHA256
21ea7143efe5d4ef0873abe59a602277cd6694df4d99b5292101257750e85e75

SHA512
4a96d0d9ce85f85ec3227671d0f3c9763d587da352d0217811941b258f4ae7b9ec51b03c6d58f512594ef52728f318477572cb455bf3f2fed8ed7eb2b352e333

Download Submit
C:\Windows\System\ilRFJVu.exe

Filesize
2.1MB

MD5
14fcaa934b9a55855c9fc7f9cc592ba1

SHA1
35d5158765fef4ed9f87a052e1d40bad5f4dd32e

SHA256
6ec9c67ec6d1876e3f5cf3941608531d31114c24ef57d743a101c5f5c9678a53

SHA512
655399a553095cc3adcce4fb536affd0810fb5d84c81070a5c088470ce2e15d5c6db531d2eb48b95a4c17c9b61bfc9e309c7bf05893fd04af8892ae4c1160593

Download Submit
C:\Windows\System\lQMukFV.exe

Filesize
2.1MB

MD5
d58a55271907ed4467776252a353befc

SHA1
7f949872995b4340df5e5d594afb5a0ef6142e9b

SHA256
13a638c89dbb352361b8a7d44a9c4b1168f1fc3eabd9dce41ecd33a4a53e0832

SHA512
4a38091b83055ed729abdc7bd4685fa7a8d86add1ae0548c9d9bcebc60b5a43b8f15d8cb173a3913b2362a29bcb06e89d4f4eab7b4e5e7a365544b345e8ef9c3

Download Submit
C:\Windows\System\lrnKSpW.exe

Filesize
2.1MB

MD5
2233ce9e1c0a74b06d5ca3e8c8355062

SHA1
c9236ad19ebf8eb7beaf0e0c21dc77a38bebb277

SHA256
b203172315adb5999b649670898425788cdadf516683a48a78ce2fa886ee57b0

SHA512
6b8f1e4e28d5603fa7407aaf334c90f0c949cfdd0ccb5ec297a58581aea9fa5ba6b979d29ec499100416c8195c49aa4cbbc2c119eaa38c07059a77b275958ef6

Download Submit
C:\Windows\System\mKFaMma.exe

Filesize
2.1MB

MD5
2d16ab2d13d7b5ec33afee3a646a8fcc

SHA1
6e7ed5d4a228c64521cd6ec18bc0a7930b628841

SHA256
b10cc8860839b45f27ef19c1bc03b06a65a46d896383416e2c6ebc28ecd77d9f

SHA512
f6b6833c6011aebb583d843f038927fa52a9482c741ff04143e6fafba15f89b2da01b882c4ade67a243ab98a7f474a63f27cdb6ae9deae150dd64d90852281db

Download Submit
C:\Windows\System\nAvueXB.exe

Filesize
2.1MB

MD5
150a62c39621a5cb37a1f6b1e582a409

SHA1
37c8483409fe5c8da76d19467135174c7f7bf33e

SHA256
5974b575887236ca84e07d6d24f97fe444e202538f52fee3fedc644e288a7943

SHA512
43a2f1891f9bbd109042e199fe1f9f22bc5c130f71f0a947215004e8bb3dfaa8938c39fc2f8db314509e826c2915f62822733eaa4f2cac212f8fbb760400947b

Download Submit
C:\Windows\System\oUTlpIp.exe

Filesize
2.1MB

MD5
bb276a7a3d629e7120b3c3dd6fd36862

SHA1
641d94bb05e8c99b86e962053a7d2f4968ca1127

SHA256
4687cd5149c3036090786d80c349f271de3947ae2e6ecb33e017ecf8a9b1f3b0

SHA512
62d9d76809da5ae8805dade1e6619164b7951a510b8a90a3b1e9ca18369be9095cde7c76e323f54d58094a33ae667f0d0078f3288717719e42a6ac251f3df90a

Download Submit
C:\Windows\System\raGghCw.exe

Filesize
2.1MB

MD5
b7421351cbd3a278f1e594264920359f

SHA1
09e7069167019bcd154f7a9e5643b8d36ade40fd

SHA256
3e5390278718fce9ee1b0e6e2d1281707f0e0a1f4b2390a821d7cd665f71cc3d

SHA512
c8048ab4468d85c3a231301d5034d306ad3283b36744e8538280c4644fc16c1a1874ea8c0487bb04bf355c0e8303cb94248889d9d2339bd14ee6a07c65caa6c2

Download Submit
C:\Windows\System\tQFaKqV.exe

Filesize
2.1MB

MD5
564eecd568859e67b61f47dbc3fe5c5e

SHA1
5f010f624e36279662e0ac23f4c715550a79a9c8

SHA256
a07125c54bead01d366310caabb921ac3c2623761d625e65cd580eb14a4a92f7

SHA512
387b9c522d49e1cfa67de6880e613152ccd45ce7e99b05f92f24afa885865c7a7e5aeb19cf16654585d21e2533cb2a1511abf2e9b74c26252c233e414d24ba84

Download Submit
C:\Windows\System\xFamteV.exe

Filesize
2.1MB

MD5
20f47197bab9c20d30ecf1d90cde1683

SHA1
1c5a6fee1940162481f3cee7232cc08345fbe86c

SHA256
442761ac2f09e923fcc64a0ad533bf726362db72615ecb161de03a884e172e19

SHA512
871443db2ec70e0e4c60e6c73cdc2a8d2261d0b6a03f11c772c389d291e9ce2007590c8c523ceccd13ef0fce4722457a65315fe0398eaa901c832be6650e5619

Download Submit
C:\Windows\System\xHPqFJv.exe

Filesize
2.1MB

MD5
62c3f2a4c754a61ffed9795adcd95477

SHA1
e404fe0f4d1988592fcef1bc05b721f4ab90649a

SHA256
f68da928884c77d95c7e66a816f96bd78722868e365e3526fb34f3f7d9d49ade

SHA512
c5b8eaaa03d47ab48439a8781d9aa187c02531ec752b2fe1d23a32d17fec2525bcf5f0e4468b8fc9a23f3cfa7efc7ab9ff560c59022c080397f543751ac69eb0

Download Submit
memory/408-3318-0x00007FF7653B0000-0x00007FF7657A2000-memory.dmp

Filesize
3.9MB

Download
memory/408-449-0x00007FF7653B0000-0x00007FF7657A2000-memory.dmp

Filesize
3.9MB

Download
memory/748-3297-0x00007FF7F41A0000-0x00007FF7F4592000-memory.dmp

Filesize
3.9MB

Download
memory/748-503-0x00007FF7F41A0000-0x00007FF7F4592000-memory.dmp

Filesize
3.9MB

Download
memory/912-3302-0x00007FF6CA050000-0x00007FF6CA442000-memory.dmp

Filesize
3.9MB

Download
memory/912-343-0x00007FF6CA050000-0x00007FF6CA442000-memory.dmp

Filesize
3.9MB

Download
memory/1044-104-0x00007FF675880000-0x00007FF675C72000-memory.dmp

Filesize
3.9MB

Download
memory/1044-3272-0x00007FF675880000-0x00007FF675C72000-memory.dmp

Filesize
3.9MB

Download
memory/1116-3279-0x00007FF6B4530000-0x00007FF6B4922000-memory.dmp

Filesize
3.9MB

Download
memory/1116-158-0x00007FF6B4530000-0x00007FF6B4922000-memory.dmp

Filesize
3.9MB

Download
memory/1300-3289-0x00007FF67ED00000-0x00007FF67F0F2000-memory.dmp

Filesize
3.9MB

Download
memory/1300-380-0x00007FF67ED00000-0x00007FF67F0F2000-memory.dmp

Filesize
3.9MB

Download
memory/1420-3309-0x00007FF70A530000-0x00007FF70A922000-memory.dmp

Filesize
3.9MB

Download
memory/1420-571-0x00007FF70A530000-0x00007FF70A922000-memory.dmp

Filesize
3.9MB

Download
memory/1460-0-0x00007FF6F0E00000-0x00007FF6F11F2000-memory.dmp

Filesize
3.9MB

Download
memory/1460-1-0x0000022E1ABA0000-0x0000022E1ABB0000-memory.dmp

Filesize
64KB

Download
memory/1480-3268-0x00007FF723650000-0x00007FF723A42000-memory.dmp

Filesize
3.9MB

Download
memory/1480-569-0x00007FF723650000-0x00007FF723A42000-memory.dmp

Filesize
3.9MB

Download
memory/2284-445-0x00007FF6A2710000-0x00007FF6A2B02000-memory.dmp

Filesize
3.9MB

Download
memory/2284-3295-0x00007FF6A2710000-0x00007FF6A2B02000-memory.dmp

Filesize
3.9MB

Download
memory/2528-3284-0x00007FF772FE0000-0x00007FF7733D2000-memory.dmp

Filesize
3.9MB

Download
memory/2528-570-0x00007FF772FE0000-0x00007FF7733D2000-memory.dmp

Filesize
3.9MB

Download
memory/2712-204-0x00007FF6A81B0000-0x00007FF6A85A2000-memory.dmp

Filesize
3.9MB

Download
memory/2712-3276-0x00007FF6A81B0000-0x00007FF6A85A2000-memory.dmp

Filesize
3.9MB

Download
memory/3008-3315-0x00007FF7DC030000-0x00007FF7DC422000-memory.dmp

Filesize
3.9MB

Download
memory/3008-565-0x00007FF7DC030000-0x00007FF7DC422000-memory.dmp

Filesize
3.9MB

Download
memory/3232-3308-0x00007FF6586F0000-0x00007FF658AE2000-memory.dmp

Filesize
3.9MB

Download
memory/3232-567-0x00007FF6586F0000-0x00007FF658AE2000-memory.dmp

Filesize
3.9MB

Download
memory/3252-3319-0x00007FF64F690000-0x00007FF64FA82000-memory.dmp

Filesize
3.9MB

Download
memory/3252-568-0x00007FF64F690000-0x00007FF64FA82000-memory.dmp

Filesize
3.9MB

Download
memory/3340-3305-0x00007FF61F5D0000-0x00007FF61F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/3340-317-0x00007FF61F5D0000-0x00007FF61F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/3540-344-0x00007FF6194E0000-0x00007FF6198D2000-memory.dmp

Filesize
3.9MB

Download
memory/3540-3286-0x00007FF6194E0000-0x00007FF6198D2000-memory.dmp

Filesize
3.9MB

Download
memory/3644-3303-0x00007FF691E70000-0x00007FF692262000-memory.dmp

Filesize
3.9MB

Download
memory/3644-566-0x00007FF691E70000-0x00007FF692262000-memory.dmp

Filesize
3.9MB

Download
memory/4244-122-0x00007FF756540000-0x00007FF756932000-memory.dmp

Filesize
3.9MB

Download
memory/4244-3270-0x00007FF756540000-0x00007FF756932000-memory.dmp

Filesize
3.9MB

Download
memory/4332-3282-0x00007FF645DC0000-0x00007FF6461B2000-memory.dmp

Filesize
3.9MB

Download
memory/4332-268-0x00007FF645DC0000-0x00007FF6461B2000-memory.dmp

Filesize
3.9MB

Download
memory/4464-572-0x00007FF78F2A0000-0x00007FF78F692000-memory.dmp

Filesize
3.9MB

Download
memory/4464-3299-0x00007FF78F2A0000-0x00007FF78F692000-memory.dmp

Filesize
3.9MB

Download
memory/4516-273-0x00007FF6D7750000-0x00007FF6D7B42000-memory.dmp

Filesize
3.9MB

Download
memory/4516-3291-0x00007FF6D7750000-0x00007FF6D7B42000-memory.dmp

Filesize
3.9MB

Download
memory/4568-3280-0x00007FF758870000-0x00007FF758C62000-memory.dmp

Filesize
3.9MB

Download
memory/4568-229-0x00007FF758870000-0x00007FF758C62000-memory.dmp

Filesize
3.9MB

Download
memory/4756-3274-0x00007FF623050000-0x00007FF623442000-memory.dmp

Filesize
3.9MB

Download
memory/4756-129-0x00007FF623050000-0x00007FF623442000-memory.dmp

Filesize
3.9MB

Download
memory/4876-39-0x00007FFFE0890000-0x00007FFFE1351000-memory.dmp

Filesize
10.8MB

Download
memory/4876-69-0x000001F83A240000-0x000001F83A262000-memory.dmp

Filesize
136KB

Download
memory/4876-54-0x00007FFFE0890000-0x00007FFFE1351000-memory.dmp

Filesize
10.8MB

Download
memory/4876-2371-0x00007FFFE0890000-0x00007FFFE1351000-memory.dmp

Filesize
10.8MB

Download
memory/4876-5-0x00007FFFE0893000-0x00007FFFE0895000-memory.dmp

Filesize
8KB

Download
memory/5100-3266-0x00007FF660BE0000-0x00007FF660FD2000-memory.dmp

Filesize
3.9MB

Download
memory/5100-83-0x00007FF660BE0000-0x00007FF660FD2000-memory.dmp

Filesize
3.9MB

Download