xmrig | 04dbd75e8c5f09efea166780f7f6a40c8b4586a16e9d1a4c2d397e2b720563e8

Analysis

max time kernel
89s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
Size

1.7MB
MD5

8ce28db0c864813aacf267a10e5b5110
SHA1

234ee736046ad844a700ea3210f529575cabd210
SHA256

04dbd75e8c5f09efea166780f7f6a40c8b4586a16e9d1a4c2d397e2b720563e8
SHA512

b3b1ed1cdb1041dbc2b06faa84e4825d60d09d91991ca113c7c38a47bf97b781f112fce8589ef4727dd0acbdb6361ac4ae4c186e2a0839f9d43189ec54cde4a1
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflD0K:NAB6

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/5008-386-0x00007FF629070000-0x00007FF629462000-memory.dmp	xmrig
behavioral2/memory/1436-393-0x00007FF707A50000-0x00007FF707E42000-memory.dmp	xmrig
behavioral2/memory/4468-399-0x00007FF6A50D0000-0x00007FF6A54C2000-memory.dmp	xmrig
behavioral2/memory/400-398-0x00007FF73B710000-0x00007FF73BB02000-memory.dmp	xmrig
behavioral2/memory/4188-397-0x00007FF6165A0000-0x00007FF616992000-memory.dmp	xmrig
behavioral2/memory/4988-395-0x00007FF7626D0000-0x00007FF762AC2000-memory.dmp	xmrig
behavioral2/memory/4804-394-0x00007FF6E9920000-0x00007FF6E9D12000-memory.dmp	xmrig
behavioral2/memory/1008-392-0x00007FF7D4BD0000-0x00007FF7D4FC2000-memory.dmp	xmrig
behavioral2/memory/3300-391-0x00007FF6E3EA0000-0x00007FF6E4292000-memory.dmp	xmrig
behavioral2/memory/2068-390-0x00007FF6A2F50000-0x00007FF6A3342000-memory.dmp	xmrig
behavioral2/memory/3356-389-0x00007FF641AE0000-0x00007FF641ED2000-memory.dmp	xmrig
behavioral2/memory/4820-388-0x00007FF6A0A30000-0x00007FF6A0E22000-memory.dmp	xmrig
behavioral2/memory/4492-387-0x00007FF782630000-0x00007FF782A22000-memory.dmp	xmrig
behavioral2/memory/4844-352-0x00007FF7B9E60000-0x00007FF7BA252000-memory.dmp	xmrig
behavioral2/memory/660-313-0x00007FF632340000-0x00007FF632732000-memory.dmp	xmrig
behavioral2/memory/1104-304-0x00007FF619630000-0x00007FF619A22000-memory.dmp	xmrig
behavioral2/memory/2308-268-0x00007FF73F550000-0x00007FF73F942000-memory.dmp	xmrig
behavioral2/memory/4552-241-0x00007FF6E3240000-0x00007FF6E3632000-memory.dmp	xmrig
behavioral2/memory/720-237-0x00007FF6EC720000-0x00007FF6ECB12000-memory.dmp	xmrig
behavioral2/memory/4852-201-0x00007FF754410000-0x00007FF754802000-memory.dmp	xmrig
behavioral2/memory/4056-163-0x00007FF64A2C0000-0x00007FF64A6B2000-memory.dmp	xmrig
behavioral2/memory/4752-157-0x00007FF712F00000-0x00007FF7132F2000-memory.dmp	xmrig
behavioral2/memory/852-117-0x00007FF7609C0000-0x00007FF760DB2000-memory.dmp	xmrig
behavioral2/memory/5004-4609-0x00007FF7172B0000-0x00007FF7176A2000-memory.dmp	xmrig
behavioral2/memory/5004-4628-0x00007FF7172B0000-0x00007FF7176A2000-memory.dmp	xmrig
behavioral2/memory/4188-4630-0x00007FF6165A0000-0x00007FF616992000-memory.dmp	xmrig
behavioral2/memory/852-4632-0x00007FF7609C0000-0x00007FF760DB2000-memory.dmp	xmrig
behavioral2/memory/4752-4634-0x00007FF712F00000-0x00007FF7132F2000-memory.dmp	xmrig
behavioral2/memory/4056-4636-0x00007FF64A2C0000-0x00007FF64A6B2000-memory.dmp	xmrig
behavioral2/memory/400-4638-0x00007FF73B710000-0x00007FF73BB02000-memory.dmp	xmrig
behavioral2/memory/660-4641-0x00007FF632340000-0x00007FF632732000-memory.dmp	xmrig
behavioral2/memory/4492-4644-0x00007FF782630000-0x00007FF782A22000-memory.dmp	xmrig
behavioral2/memory/4844-4643-0x00007FF7B9E60000-0x00007FF7BA252000-memory.dmp	xmrig
behavioral2/memory/4852-4646-0x00007FF754410000-0x00007FF754802000-memory.dmp	xmrig
behavioral2/memory/4552-4648-0x00007FF6E3240000-0x00007FF6E3632000-memory.dmp	xmrig
behavioral2/memory/2308-4655-0x00007FF73F550000-0x00007FF73F942000-memory.dmp	xmrig
behavioral2/memory/3356-4653-0x00007FF641AE0000-0x00007FF641ED2000-memory.dmp	xmrig
behavioral2/memory/720-4656-0x00007FF6EC720000-0x00007FF6ECB12000-memory.dmp	xmrig
behavioral2/memory/1008-4651-0x00007FF7D4BD0000-0x00007FF7D4FC2000-memory.dmp	xmrig
behavioral2/memory/5008-4658-0x00007FF629070000-0x00007FF629462000-memory.dmp	xmrig
behavioral2/memory/1436-4660-0x00007FF707A50000-0x00007FF707E42000-memory.dmp	xmrig
behavioral2/memory/1104-4664-0x00007FF619630000-0x00007FF619A22000-memory.dmp	xmrig
behavioral2/memory/3300-4663-0x00007FF6E3EA0000-0x00007FF6E4292000-memory.dmp	xmrig
behavioral2/memory/2068-4673-0x00007FF6A2F50000-0x00007FF6A3342000-memory.dmp	xmrig
behavioral2/memory/4468-4676-0x00007FF6A50D0000-0x00007FF6A54C2000-memory.dmp	xmrig
behavioral2/memory/4988-4679-0x00007FF7626D0000-0x00007FF762AC2000-memory.dmp	xmrig
behavioral2/memory/4804-4681-0x00007FF6E9920000-0x00007FF6E9D12000-memory.dmp	xmrig
behavioral2/memory/4820-4671-0x00007FF6A0A30000-0x00007FF6A0E22000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
404	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
5004	JMSTqJr.exe
4188	hapveDF.exe
852	HzNGuFf.exe
4752	AAVfXGS.exe
400	rSgeDkp.exe
4056	wOQXIeQ.exe
4852	FIiEYDQ.exe
720	MeZPykB.exe
4552	OFMkIww.exe
2308	FartTTx.exe
1104	ZPAdepO.exe
660	fFLieaE.exe
4844	LLkfQcb.exe
5008	BwQPxrN.exe
4492	fLDVIhD.exe
4468	BQwLTdY.exe
4820	UeAlyRf.exe
3356	OyrBxvs.exe
2068	qCDNduY.exe
3300	RaHppcO.exe
1008	WTqEAwj.exe
1436	zadeDpn.exe
4804	WNLvTvd.exe
4988	OJQrOKH.exe
3124	HqHipDK.exe
3732	inIbaiZ.exe
3280	GNxTWzb.exe
2376	poRlKfG.exe
116	CxGfbxX.exe
2772	rjCiWxl.exe
5092	QFXlhtN.exe
1784	qIhGjvC.exe
4556	efsxYDB.exe
844	WLSnthl.exe
3064	EAiqExG.exe
2456	JMasAwO.exe
4992	xIDLZNU.exe
1932	DuzQmXC.exe
3496	xDQiTJv.exe
4520	JRtOLWy.exe
3592	bjJmvaP.exe
3828	WJjbiPA.exe
1668	RMZroLC.exe
1512	WIaguBb.exe
2556	AFysOtM.exe
4392	glJepbe.exe
3484	YckYfWM.exe
2700	sGplwBQ.exe
1540	POKpgQp.exe
2840	gDHvzkW.exe
3304	yiZjcfI.exe
3032	mpRvslF.exe
4980	OUVLbsb.exe
2160	bAhhYxA.exe
5068	VjRMmtX.exe
3680	SormaTo.exe
3260	fypQMbu.exe
1340	NUHrBci.exe
4192	dRwLTjx.exe
4284	tNniEYM.exe
4300	zJMhqcz.exe
3288	onsvKNW.exe
2212	PgkfQfB.exe
5048	kVJaEWQ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/536-0-0x00007FF62CD80000-0x00007FF62D172000-memory.dmp	upx
behavioral2/files/0x000800000002340d-5.dat	upx
behavioral2/files/0x0007000000023414-7.dat	upx
behavioral2/files/0x0007000000023419-31.dat	upx
behavioral2/files/0x000700000002341a-122.dat	upx
behavioral2/files/0x000700000002343a-196.dat	upx
behavioral2/files/0x0007000000023439-192.dat	upx
behavioral2/memory/5008-386-0x00007FF629070000-0x00007FF629462000-memory.dmp	upx
behavioral2/memory/1436-393-0x00007FF707A50000-0x00007FF707E42000-memory.dmp	upx
behavioral2/memory/4468-399-0x00007FF6A50D0000-0x00007FF6A54C2000-memory.dmp	upx
behavioral2/memory/400-398-0x00007FF73B710000-0x00007FF73BB02000-memory.dmp	upx
behavioral2/memory/4188-397-0x00007FF6165A0000-0x00007FF616992000-memory.dmp	upx
behavioral2/memory/4988-395-0x00007FF7626D0000-0x00007FF762AC2000-memory.dmp	upx
behavioral2/memory/4804-394-0x00007FF6E9920000-0x00007FF6E9D12000-memory.dmp	upx
behavioral2/memory/1008-392-0x00007FF7D4BD0000-0x00007FF7D4FC2000-memory.dmp	upx
behavioral2/memory/3300-391-0x00007FF6E3EA0000-0x00007FF6E4292000-memory.dmp	upx
behavioral2/memory/2068-390-0x00007FF6A2F50000-0x00007FF6A3342000-memory.dmp	upx
behavioral2/memory/3356-389-0x00007FF641AE0000-0x00007FF641ED2000-memory.dmp	upx
behavioral2/memory/4820-388-0x00007FF6A0A30000-0x00007FF6A0E22000-memory.dmp	upx
behavioral2/memory/4492-387-0x00007FF782630000-0x00007FF782A22000-memory.dmp	upx
behavioral2/memory/4844-352-0x00007FF7B9E60000-0x00007FF7BA252000-memory.dmp	upx
behavioral2/memory/660-313-0x00007FF632340000-0x00007FF632732000-memory.dmp	upx
behavioral2/memory/1104-304-0x00007FF619630000-0x00007FF619A22000-memory.dmp	upx
behavioral2/memory/2308-268-0x00007FF73F550000-0x00007FF73F942000-memory.dmp	upx
behavioral2/memory/4552-241-0x00007FF6E3240000-0x00007FF6E3632000-memory.dmp	upx
behavioral2/memory/720-237-0x00007FF6EC720000-0x00007FF6ECB12000-memory.dmp	upx
behavioral2/memory/4852-201-0x00007FF754410000-0x00007FF754802000-memory.dmp	upx
behavioral2/files/0x0007000000023431-197.dat	upx
behavioral2/files/0x0007000000023438-190.dat	upx
behavioral2/files/0x0007000000023437-187.dat	upx
behavioral2/files/0x0007000000023436-184.dat	upx
behavioral2/files/0x0007000000023435-183.dat	upx
behavioral2/files/0x0007000000023427-178.dat	upx
behavioral2/files/0x0007000000023426-177.dat	upx
behavioral2/files/0x0007000000023422-176.dat	upx
behavioral2/files/0x0007000000023434-173.dat	upx
behavioral2/memory/4056-163-0x00007FF64A2C0000-0x00007FF64A6B2000-memory.dmp	upx
behavioral2/memory/4752-157-0x00007FF712F00000-0x00007FF7132F2000-memory.dmp	upx
behavioral2/files/0x0007000000023430-156.dat	upx
behavioral2/files/0x000700000002342f-153.dat	upx
behavioral2/files/0x0008000000023425-152.dat	upx
behavioral2/files/0x000700000002342e-148.dat	upx
behavioral2/files/0x0007000000023429-188.dat	upx
behavioral2/files/0x0007000000023428-145.dat	upx
behavioral2/files/0x0007000000023423-139.dat	upx
behavioral2/files/0x0007000000023433-172.dat	upx
behavioral2/files/0x0007000000023421-167.dat	upx
behavioral2/files/0x0007000000023432-165.dat	upx
behavioral2/files/0x000700000002342b-116.dat	upx
behavioral2/files/0x000700000002342a-115.dat	upx
behavioral2/files/0x000700000002341f-109.dat	upx
behavioral2/files/0x000700000002341c-138.dat	upx
behavioral2/files/0x000700000002342d-135.dat	upx
behavioral2/files/0x000700000002342c-131.dat	upx
behavioral2/files/0x000700000002341b-126.dat	upx
behavioral2/memory/852-117-0x00007FF7609C0000-0x00007FF760DB2000-memory.dmp	upx
behavioral2/files/0x000700000002341e-83.dat	upx
behavioral2/files/0x0007000000023420-82.dat	upx
behavioral2/files/0x000700000002341d-74.dat	upx
behavioral2/files/0x0007000000023417-101.dat	upx
behavioral2/files/0x0007000000023416-55.dat	upx
behavioral2/files/0x0007000000023418-49.dat	upx
behavioral2/files/0x0008000000023410-43.dat	upx
behavioral2/files/0x0007000000023415-40.dat	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\TcEuePA.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\dSCOYtA.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\khGZIbL.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\IFhpkDb.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\ngjkeVM.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\jiAdlOx.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\QRpKhJP.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\UoXFYkU.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\gEkWnDj.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\KfxrIbp.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\bwPqLAO.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\PQSoOjZ.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\vyYMlEu.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\QESFnGF.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\abAVxCA.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\HUItAJT.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\JOYvChG.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\MTTUyWm.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\lIeTamQ.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\qIqwBLs.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\uhpagJB.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\jelXVvz.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\CoDLaZh.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\wOhMcdI.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\DxxNadN.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\xgqAKKM.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\EwmHoCL.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\RfOHpOp.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\VIFdbZE.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\mmDSfZo.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\jXyLBMC.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\VcOtogl.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\MIuAYgl.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\ZLswspb.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\bLJDXJe.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\lVToAcf.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\lFNGuUt.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\mlNdjlL.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\hddbJaz.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\AgwCqCD.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\sHYbhBh.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\jrEMVUO.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\nrMFjaB.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\GcyopwJ.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\ddeJqNZ.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\SqRrbJs.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\EpHbppW.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\toHSNZf.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\sBqxlFx.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\Gvretcu.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\QnPfSGS.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\wjXkEiJ.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\LGKdNpb.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\aYMCWjm.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\vGolGlF.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\slpbJES.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\goaZpHP.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\PCwoSrB.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\oQbIJkU.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\SxlqUVj.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\iGwcatC.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\TSChYSt.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\QnHbgGC.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
File created	C:\Windows\System\fkUDbEg.exe	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
404	powershell.exe
404	powershell.exe
404	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	404	powershell.exe
Token: SeLockMemoryPrivilege	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 404	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	82
PID 536 wrote to memory of 404	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	82
PID 536 wrote to memory of 5004	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	83
PID 536 wrote to memory of 5004	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	83
PID 536 wrote to memory of 4752	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	84
PID 536 wrote to memory of 4752	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	84
PID 536 wrote to memory of 4188	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	85
PID 536 wrote to memory of 4188	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	85
PID 536 wrote to memory of 852	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	86
PID 536 wrote to memory of 852	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	86
PID 536 wrote to memory of 400	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	87
PID 536 wrote to memory of 400	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	87
PID 536 wrote to memory of 4552	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	88
PID 536 wrote to memory of 4552	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	88
PID 536 wrote to memory of 4056	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	89
PID 536 wrote to memory of 4056	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	89
PID 536 wrote to memory of 4852	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	90
PID 536 wrote to memory of 4852	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	90
PID 536 wrote to memory of 720	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	91
PID 536 wrote to memory of 720	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	91
PID 536 wrote to memory of 2308	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	92
PID 536 wrote to memory of 2308	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	92
PID 536 wrote to memory of 1104	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	93
PID 536 wrote to memory of 1104	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	93
PID 536 wrote to memory of 660	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	94
PID 536 wrote to memory of 660	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	94
PID 536 wrote to memory of 4844	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	95
PID 536 wrote to memory of 4844	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	95
PID 536 wrote to memory of 5008	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	96
PID 536 wrote to memory of 5008	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	96
PID 536 wrote to memory of 4492	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	97
PID 536 wrote to memory of 4492	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	97
PID 536 wrote to memory of 4468	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	98
PID 536 wrote to memory of 4468	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	98
PID 536 wrote to memory of 4820	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	99
PID 536 wrote to memory of 4820	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	99
PID 536 wrote to memory of 3356	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	100
PID 536 wrote to memory of 3356	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	100
PID 536 wrote to memory of 2068	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	101
PID 536 wrote to memory of 2068	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	101
PID 536 wrote to memory of 3300	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	102
PID 536 wrote to memory of 3300	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	102
PID 536 wrote to memory of 1008	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	103
PID 536 wrote to memory of 1008	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	103
PID 536 wrote to memory of 1436	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	104
PID 536 wrote to memory of 1436	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	104
PID 536 wrote to memory of 4804	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	105
PID 536 wrote to memory of 4804	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	105
PID 536 wrote to memory of 4988	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	106
PID 536 wrote to memory of 4988	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	106
PID 536 wrote to memory of 3124	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	107
PID 536 wrote to memory of 3124	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	107
PID 536 wrote to memory of 3732	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	108
PID 536 wrote to memory of 3732	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	108
PID 536 wrote to memory of 3280	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	109
PID 536 wrote to memory of 3280	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	109
PID 536 wrote to memory of 2376	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	110
PID 536 wrote to memory of 2376	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	110
PID 536 wrote to memory of 116	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	111
PID 536 wrote to memory of 116	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	111
PID 536 wrote to memory of 2772	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	112
PID 536 wrote to memory of 2772	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	112
PID 536 wrote to memory of 5092	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	113
PID 536 wrote to memory of 5092	536	8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe	113

C:\Users\Admin\AppData\Local\Temp\8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8ce28db0c864813aacf267a10e5b5110_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:404
- C:\Windows\System\JMSTqJr.exe
  C:\Windows\System\JMSTqJr.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\AAVfXGS.exe
  C:\Windows\System\AAVfXGS.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\hapveDF.exe
  C:\Windows\System\hapveDF.exe
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Windows\System\HzNGuFf.exe
  C:\Windows\System\HzNGuFf.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\rSgeDkp.exe
  C:\Windows\System\rSgeDkp.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\OFMkIww.exe
  C:\Windows\System\OFMkIww.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\wOQXIeQ.exe
  C:\Windows\System\wOQXIeQ.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\FIiEYDQ.exe
  C:\Windows\System\FIiEYDQ.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\MeZPykB.exe
  C:\Windows\System\MeZPykB.exe
  2⤵
  - Executes dropped EXE
  PID:720
- C:\Windows\System\FartTTx.exe
  C:\Windows\System\FartTTx.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\ZPAdepO.exe
  C:\Windows\System\ZPAdepO.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\fFLieaE.exe
  C:\Windows\System\fFLieaE.exe
  2⤵
  - Executes dropped EXE
  PID:660
- C:\Windows\System\LLkfQcb.exe
  C:\Windows\System\LLkfQcb.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\BwQPxrN.exe
  C:\Windows\System\BwQPxrN.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\fLDVIhD.exe
  C:\Windows\System\fLDVIhD.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\BQwLTdY.exe
  C:\Windows\System\BQwLTdY.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\UeAlyRf.exe
  C:\Windows\System\UeAlyRf.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\OyrBxvs.exe
  C:\Windows\System\OyrBxvs.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\qCDNduY.exe
  C:\Windows\System\qCDNduY.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\RaHppcO.exe
  C:\Windows\System\RaHppcO.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\WTqEAwj.exe
  C:\Windows\System\WTqEAwj.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\zadeDpn.exe
  C:\Windows\System\zadeDpn.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\WNLvTvd.exe
  C:\Windows\System\WNLvTvd.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\OJQrOKH.exe
  C:\Windows\System\OJQrOKH.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\HqHipDK.exe
  C:\Windows\System\HqHipDK.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\inIbaiZ.exe
  C:\Windows\System\inIbaiZ.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\GNxTWzb.exe
  C:\Windows\System\GNxTWzb.exe
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Windows\System\poRlKfG.exe
  C:\Windows\System\poRlKfG.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\CxGfbxX.exe
  C:\Windows\System\CxGfbxX.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\rjCiWxl.exe
  C:\Windows\System\rjCiWxl.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\QFXlhtN.exe
  C:\Windows\System\QFXlhtN.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\qIhGjvC.exe
  C:\Windows\System\qIhGjvC.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\efsxYDB.exe
  C:\Windows\System\efsxYDB.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\WLSnthl.exe
  C:\Windows\System\WLSnthl.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\EAiqExG.exe
  C:\Windows\System\EAiqExG.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\JMasAwO.exe
  C:\Windows\System\JMasAwO.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\xIDLZNU.exe
  C:\Windows\System\xIDLZNU.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\DuzQmXC.exe
  C:\Windows\System\DuzQmXC.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\xDQiTJv.exe
  C:\Windows\System\xDQiTJv.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\JRtOLWy.exe
  C:\Windows\System\JRtOLWy.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\bjJmvaP.exe
  C:\Windows\System\bjJmvaP.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\WJjbiPA.exe
  C:\Windows\System\WJjbiPA.exe
  2⤵
  - Executes dropped EXE
  PID:3828
- C:\Windows\System\RMZroLC.exe
  C:\Windows\System\RMZroLC.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\WIaguBb.exe
  C:\Windows\System\WIaguBb.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\AFysOtM.exe
  C:\Windows\System\AFysOtM.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\glJepbe.exe
  C:\Windows\System\glJepbe.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\YckYfWM.exe
  C:\Windows\System\YckYfWM.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\sGplwBQ.exe
  C:\Windows\System\sGplwBQ.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\POKpgQp.exe
  C:\Windows\System\POKpgQp.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\gDHvzkW.exe
  C:\Windows\System\gDHvzkW.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\yiZjcfI.exe
  C:\Windows\System\yiZjcfI.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System\mpRvslF.exe
  C:\Windows\System\mpRvslF.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\OUVLbsb.exe
  C:\Windows\System\OUVLbsb.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\bAhhYxA.exe
  C:\Windows\System\bAhhYxA.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\VjRMmtX.exe
  C:\Windows\System\VjRMmtX.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\SormaTo.exe
  C:\Windows\System\SormaTo.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System\fypQMbu.exe
  C:\Windows\System\fypQMbu.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\NUHrBci.exe
  C:\Windows\System\NUHrBci.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\dRwLTjx.exe
  C:\Windows\System\dRwLTjx.exe
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Windows\System\tNniEYM.exe
  C:\Windows\System\tNniEYM.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\zJMhqcz.exe
  C:\Windows\System\zJMhqcz.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\onsvKNW.exe
  C:\Windows\System\onsvKNW.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\PgkfQfB.exe
  C:\Windows\System\PgkfQfB.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\kVJaEWQ.exe
  C:\Windows\System\kVJaEWQ.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\EWsVHRY.exe
  C:\Windows\System\EWsVHRY.exe
  2⤵
  PID:4772
- C:\Windows\System\cGbvhBE.exe
  C:\Windows\System\cGbvhBE.exe
  2⤵
  PID:5056
- C:\Windows\System\neLBFQt.exe
  C:\Windows\System\neLBFQt.exe
  2⤵
  PID:4028
- C:\Windows\System\EwgaTbZ.exe
  C:\Windows\System\EwgaTbZ.exe
  2⤵
  PID:1920
- C:\Windows\System\BQymGxc.exe
  C:\Windows\System\BQymGxc.exe
  2⤵
  PID:3264
- C:\Windows\System\qutoQmw.exe
  C:\Windows\System\qutoQmw.exe
  2⤵
  PID:2616
- C:\Windows\System\mIuTlud.exe
  C:\Windows\System\mIuTlud.exe
  2⤵
  PID:1280
- C:\Windows\System\kdDVkwW.exe
  C:\Windows\System\kdDVkwW.exe
  2⤵
  PID:1600
- C:\Windows\System\ANIYBRX.exe
  C:\Windows\System\ANIYBRX.exe
  2⤵
  PID:2644
- C:\Windows\System\vdBZgUD.exe
  C:\Windows\System\vdBZgUD.exe
  2⤵
  PID:4580
- C:\Windows\System\xpWjLBQ.exe
  C:\Windows\System\xpWjLBQ.exe
  2⤵
  PID:2284
- C:\Windows\System\RJngFje.exe
  C:\Windows\System\RJngFje.exe
  2⤵
  PID:1492
- C:\Windows\System\BfFTSiw.exe
  C:\Windows\System\BfFTSiw.exe
  2⤵
  PID:1588
- C:\Windows\System\Othyukc.exe
  C:\Windows\System\Othyukc.exe
  2⤵
  PID:2304
- C:\Windows\System\MIYgdgC.exe
  C:\Windows\System\MIYgdgC.exe
  2⤵
  PID:2152
- C:\Windows\System\AVnLEao.exe
  C:\Windows\System\AVnLEao.exe
  2⤵
  PID:2720
- C:\Windows\System\ZAYekVa.exe
  C:\Windows\System\ZAYekVa.exe
  2⤵
  PID:2536
- C:\Windows\System\rFSCeTq.exe
  C:\Windows\System\rFSCeTq.exe
  2⤵
  PID:964
- C:\Windows\System\vwoCQax.exe
  C:\Windows\System\vwoCQax.exe
  2⤵
  PID:4372
- C:\Windows\System\vivytkv.exe
  C:\Windows\System\vivytkv.exe
  2⤵
  PID:5148
- C:\Windows\System\btVzpBc.exe
  C:\Windows\System\btVzpBc.exe
  2⤵
  PID:5172
- C:\Windows\System\OwlxsTI.exe
  C:\Windows\System\OwlxsTI.exe
  2⤵
  PID:5188
- C:\Windows\System\Hlxkyss.exe
  C:\Windows\System\Hlxkyss.exe
  2⤵
  PID:5208
- C:\Windows\System\qfLVeUF.exe
  C:\Windows\System\qfLVeUF.exe
  2⤵
  PID:5236
- C:\Windows\System\DDpcuqm.exe
  C:\Windows\System\DDpcuqm.exe
  2⤵
  PID:5260
- C:\Windows\System\qYBwppU.exe
  C:\Windows\System\qYBwppU.exe
  2⤵
  PID:5280
- C:\Windows\System\IqBzgFT.exe
  C:\Windows\System\IqBzgFT.exe
  2⤵
  PID:5320
- C:\Windows\System\PGsjPqm.exe
  C:\Windows\System\PGsjPqm.exe
  2⤵
  PID:5336
- C:\Windows\System\KWgTgRU.exe
  C:\Windows\System\KWgTgRU.exe
  2⤵
  PID:5372
- C:\Windows\System\rlbOtpm.exe
  C:\Windows\System\rlbOtpm.exe
  2⤵
  PID:5388
- C:\Windows\System\PXvbvth.exe
  C:\Windows\System\PXvbvth.exe
  2⤵
  PID:5416
- C:\Windows\System\BplFPlI.exe
  C:\Windows\System\BplFPlI.exe
  2⤵
  PID:5436
- C:\Windows\System\kkZbFrz.exe
  C:\Windows\System\kkZbFrz.exe
  2⤵
  PID:5452
- C:\Windows\System\eJEOwRx.exe
  C:\Windows\System\eJEOwRx.exe
  2⤵
  PID:5476
- C:\Windows\System\WvsbzmG.exe
  C:\Windows\System\WvsbzmG.exe
  2⤵
  PID:5504
- C:\Windows\System\lQxRmas.exe
  C:\Windows\System\lQxRmas.exe
  2⤵
  PID:5524
- C:\Windows\System\wEokYlG.exe
  C:\Windows\System\wEokYlG.exe
  2⤵
  PID:5548
- C:\Windows\System\GygWWcC.exe
  C:\Windows\System\GygWWcC.exe
  2⤵
  PID:5564
- C:\Windows\System\LqAZxbC.exe
  C:\Windows\System\LqAZxbC.exe
  2⤵
  PID:5584
- C:\Windows\System\MeTphrO.exe
  C:\Windows\System\MeTphrO.exe
  2⤵
  PID:5604
- C:\Windows\System\AzKXAxs.exe
  C:\Windows\System\AzKXAxs.exe
  2⤵
  PID:5624
- C:\Windows\System\aiAreWh.exe
  C:\Windows\System\aiAreWh.exe
  2⤵
  PID:5640
- C:\Windows\System\DBtmUdQ.exe
  C:\Windows\System\DBtmUdQ.exe
  2⤵
  PID:5664
- C:\Windows\System\ZIsRzjw.exe
  C:\Windows\System\ZIsRzjw.exe
  2⤵
  PID:5688
- C:\Windows\System\mMgiAEu.exe
  C:\Windows\System\mMgiAEu.exe
  2⤵
  PID:5708
- C:\Windows\System\ausZcnT.exe
  C:\Windows\System\ausZcnT.exe
  2⤵
  PID:5728
- C:\Windows\System\vQlUEhn.exe
  C:\Windows\System\vQlUEhn.exe
  2⤵
  PID:5748
- C:\Windows\System\Btbwkxn.exe
  C:\Windows\System\Btbwkxn.exe
  2⤵
  PID:5768
- C:\Windows\System\zEyvyAl.exe
  C:\Windows\System\zEyvyAl.exe
  2⤵
  PID:5788
- C:\Windows\System\wZPKGBK.exe
  C:\Windows\System\wZPKGBK.exe
  2⤵
  PID:5808
- C:\Windows\System\vgyWVDX.exe
  C:\Windows\System\vgyWVDX.exe
  2⤵
  PID:5832
- C:\Windows\System\fwVZcOD.exe
  C:\Windows\System\fwVZcOD.exe
  2⤵
  PID:5200
- C:\Windows\System\CIubgME.exe
  C:\Windows\System\CIubgME.exe
  2⤵
  PID:4524
- C:\Windows\System\lFsqVDB.exe
  C:\Windows\System\lFsqVDB.exe
  2⤵
  PID:3528
- C:\Windows\System\DXADPlp.exe
  C:\Windows\System\DXADPlp.exe
  2⤵
  PID:4828
- C:\Windows\System\adHuDmM.exe
  C:\Windows\System\adHuDmM.exe
  2⤵
  PID:2028
- C:\Windows\System\jnmWcEN.exe
  C:\Windows\System\jnmWcEN.exe
  2⤵
  PID:3216
- C:\Windows\System\zDiLemf.exe
  C:\Windows\System\zDiLemf.exe
  2⤵
  PID:1336
- C:\Windows\System\pvnzkkI.exe
  C:\Windows\System\pvnzkkI.exe
  2⤵
  PID:2572
- C:\Windows\System\bLJDXJe.exe
  C:\Windows\System\bLJDXJe.exe
  2⤵
  PID:2688
- C:\Windows\System\GJnHrcR.exe
  C:\Windows\System\GJnHrcR.exe
  2⤵
  PID:4164
- C:\Windows\System\Vmufjfe.exe
  C:\Windows\System\Vmufjfe.exe
  2⤵
  PID:5144
- C:\Windows\System\VEYCOji.exe
  C:\Windows\System\VEYCOji.exe
  2⤵
  PID:5272
- C:\Windows\System\xAIBXfy.exe
  C:\Windows\System\xAIBXfy.exe
  2⤵
  PID:5328
- C:\Windows\System\pCVskAL.exe
  C:\Windows\System\pCVskAL.exe
  2⤵
  PID:5368
- C:\Windows\System\cgaQtOB.exe
  C:\Windows\System\cgaQtOB.exe
  2⤵
  PID:5404
- C:\Windows\System\tRtspyX.exe
  C:\Windows\System\tRtspyX.exe
  2⤵
  PID:5448
- C:\Windows\System\YfjUsxH.exe
  C:\Windows\System\YfjUsxH.exe
  2⤵
  PID:5492
- C:\Windows\System\eypXvfp.exe
  C:\Windows\System\eypXvfp.exe
  2⤵
  PID:5540
- C:\Windows\System\QRMyEro.exe
  C:\Windows\System\QRMyEro.exe
  2⤵
  PID:5576
- C:\Windows\System\lbzZVKW.exe
  C:\Windows\System\lbzZVKW.exe
  2⤵
  PID:5620
- C:\Windows\System\TxCvyqb.exe
  C:\Windows\System\TxCvyqb.exe
  2⤵
  PID:5660
- C:\Windows\System\equRFtC.exe
  C:\Windows\System\equRFtC.exe
  2⤵
  PID:5684
- C:\Windows\System\yXotYab.exe
  C:\Windows\System\yXotYab.exe
  2⤵
  PID:5736
- C:\Windows\System\FzkiTCG.exe
  C:\Windows\System\FzkiTCG.exe
  2⤵
  PID:5776
- C:\Windows\System\daaUYTU.exe
  C:\Windows\System\daaUYTU.exe
  2⤵
  PID:5816
- C:\Windows\System\sCDnFyv.exe
  C:\Windows\System\sCDnFyv.exe
  2⤵
  PID:5852
- C:\Windows\System\ckNoEOs.exe
  C:\Windows\System\ckNoEOs.exe
  2⤵
  PID:3112
- C:\Windows\System\iyllKrn.exe
  C:\Windows\System\iyllKrn.exe
  2⤵
  PID:3504
- C:\Windows\System\HisTsVe.exe
  C:\Windows\System\HisTsVe.exe
  2⤵
  PID:4484
- C:\Windows\System\NhklSha.exe
  C:\Windows\System\NhklSha.exe
  2⤵
  PID:6140
- C:\Windows\System\IcujKqi.exe
  C:\Windows\System\IcujKqi.exe
  2⤵
  PID:1448
- C:\Windows\System\tGajOzK.exe
  C:\Windows\System\tGajOzK.exe
  2⤵
  PID:6160
- C:\Windows\System\nDGuBxN.exe
  C:\Windows\System\nDGuBxN.exe
  2⤵
  PID:6180
- C:\Windows\System\djkfpUY.exe
  C:\Windows\System\djkfpUY.exe
  2⤵
  PID:6204
- C:\Windows\System\jXnzFNp.exe
  C:\Windows\System\jXnzFNp.exe
  2⤵
  PID:6380
- C:\Windows\System\WKSLxSE.exe
  C:\Windows\System\WKSLxSE.exe
  2⤵
  PID:6400
- C:\Windows\System\ekDWYje.exe
  C:\Windows\System\ekDWYje.exe
  2⤵
  PID:6416
- C:\Windows\System\IdLBEgv.exe
  C:\Windows\System\IdLBEgv.exe
  2⤵
  PID:6432
- C:\Windows\System\blGNVGN.exe
  C:\Windows\System\blGNVGN.exe
  2⤵
  PID:6452
- C:\Windows\System\zmaPkYh.exe
  C:\Windows\System\zmaPkYh.exe
  2⤵
  PID:6468
- C:\Windows\System\ewvMsgD.exe
  C:\Windows\System\ewvMsgD.exe
  2⤵
  PID:6492
- C:\Windows\System\dLjcHrH.exe
  C:\Windows\System\dLjcHrH.exe
  2⤵
  PID:6508
- C:\Windows\System\oVStkwh.exe
  C:\Windows\System\oVStkwh.exe
  2⤵
  PID:6528
- C:\Windows\System\EyOYplb.exe
  C:\Windows\System\EyOYplb.exe
  2⤵
  PID:6544
- C:\Windows\System\cyKwJUJ.exe
  C:\Windows\System\cyKwJUJ.exe
  2⤵
  PID:6568
- C:\Windows\System\IzGYyay.exe
  C:\Windows\System\IzGYyay.exe
  2⤵
  PID:6588
- C:\Windows\System\KDgJVrn.exe
  C:\Windows\System\KDgJVrn.exe
  2⤵
  PID:6608
- C:\Windows\System\tuHABNC.exe
  C:\Windows\System\tuHABNC.exe
  2⤵
  PID:6632
- C:\Windows\System\sCPRbzn.exe
  C:\Windows\System\sCPRbzn.exe
  2⤵
  PID:6648
- C:\Windows\System\oDOdkGb.exe
  C:\Windows\System\oDOdkGb.exe
  2⤵
  PID:6672
- C:\Windows\System\srnNydr.exe
  C:\Windows\System\srnNydr.exe
  2⤵
  PID:6696
- C:\Windows\System\kTDnlkG.exe
  C:\Windows\System\kTDnlkG.exe
  2⤵
  PID:6712
- C:\Windows\System\YqrdQeB.exe
  C:\Windows\System\YqrdQeB.exe
  2⤵
  PID:6736
- C:\Windows\System\etRSGLB.exe
  C:\Windows\System\etRSGLB.exe
  2⤵
  PID:6760
- C:\Windows\System\yGpvBXB.exe
  C:\Windows\System\yGpvBXB.exe
  2⤵
  PID:6784
- C:\Windows\System\CUCpiRR.exe
  C:\Windows\System\CUCpiRR.exe
  2⤵
  PID:6804
- C:\Windows\System\CDJIlyJ.exe
  C:\Windows\System\CDJIlyJ.exe
  2⤵
  PID:6824
- C:\Windows\System\twqYdtD.exe
  C:\Windows\System\twqYdtD.exe
  2⤵
  PID:6844
- C:\Windows\System\tihCcWi.exe
  C:\Windows\System\tihCcWi.exe
  2⤵
  PID:6864
- C:\Windows\System\FCpmOHQ.exe
  C:\Windows\System\FCpmOHQ.exe
  2⤵
  PID:6888
- C:\Windows\System\CIGlPXx.exe
  C:\Windows\System\CIGlPXx.exe
  2⤵
  PID:6904
- C:\Windows\System\yPuUwkF.exe
  C:\Windows\System\yPuUwkF.exe
  2⤵
  PID:6928
- C:\Windows\System\SMPqnAI.exe
  C:\Windows\System\SMPqnAI.exe
  2⤵
  PID:6952
- C:\Windows\System\tacFIOZ.exe
  C:\Windows\System\tacFIOZ.exe
  2⤵
  PID:6976
- C:\Windows\System\aMUShqN.exe
  C:\Windows\System\aMUShqN.exe
  2⤵
  PID:6992
- C:\Windows\System\dPwMvhA.exe
  C:\Windows\System\dPwMvhA.exe
  2⤵
  PID:7008
- C:\Windows\System\FmKVPhc.exe
  C:\Windows\System\FmKVPhc.exe
  2⤵
  PID:7032
- C:\Windows\System\EJLaUIw.exe
  C:\Windows\System\EJLaUIw.exe
  2⤵
  PID:7048
- C:\Windows\System\GWnGqGf.exe
  C:\Windows\System\GWnGqGf.exe
  2⤵
  PID:7068
- C:\Windows\System\OyFijod.exe
  C:\Windows\System\OyFijod.exe
  2⤵
  PID:7088
- C:\Windows\System\VuaFxxY.exe
  C:\Windows\System\VuaFxxY.exe
  2⤵
  PID:7112
- C:\Windows\System\JNuHfqq.exe
  C:\Windows\System\JNuHfqq.exe
  2⤵
  PID:7136
- C:\Windows\System\ImxviBl.exe
  C:\Windows\System\ImxviBl.exe
  2⤵
  PID:7152
- C:\Windows\System\CKiGXHC.exe
  C:\Windows\System\CKiGXHC.exe
  2⤵
  PID:2228
- C:\Windows\System\wzzVtUf.exe
  C:\Windows\System\wzzVtUf.exe
  2⤵
  PID:2236
- C:\Windows\System\xeGQVuU.exe
  C:\Windows\System\xeGQVuU.exe
  2⤵
  PID:5276
- C:\Windows\System\uLbxAhv.exe
  C:\Windows\System\uLbxAhv.exe
  2⤵
  PID:1216
- C:\Windows\System\MTtXVXb.exe
  C:\Windows\System\MTtXVXb.exe
  2⤵
  PID:2100
- C:\Windows\System\kZaissZ.exe
  C:\Windows\System\kZaissZ.exe
  2⤵
  PID:5216
- C:\Windows\System\kUpnnxl.exe
  C:\Windows\System\kUpnnxl.exe
  2⤵
  PID:5384
- C:\Windows\System\VYMQuiP.exe
  C:\Windows\System\VYMQuiP.exe
  2⤵
  PID:5516
- C:\Windows\System\EjJRzvW.exe
  C:\Windows\System\EjJRzvW.exe
  2⤵
  PID:5656
- C:\Windows\System\xxXvtje.exe
  C:\Windows\System\xxXvtje.exe
  2⤵
  PID:5804
- C:\Windows\System\bxcfPZt.exe
  C:\Windows\System\bxcfPZt.exe
  2⤵
  PID:1644
- C:\Windows\System\CViljZU.exe
  C:\Windows\System\CViljZU.exe
  2⤵
  PID:6168
- C:\Windows\System\yMnQMda.exe
  C:\Windows\System\yMnQMda.exe
  2⤵
  PID:4836
- C:\Windows\System\sucVGSX.exe
  C:\Windows\System\sucVGSX.exe
  2⤵
  PID:1576
- C:\Windows\System\NJMWEwu.exe
  C:\Windows\System\NJMWEwu.exe
  2⤵
  PID:3776
- C:\Windows\System\flQewrQ.exe
  C:\Windows\System\flQewrQ.exe
  2⤵
  PID:6172
- C:\Windows\System\ORWYfwu.exe
  C:\Windows\System\ORWYfwu.exe
  2⤵
  PID:3608
- C:\Windows\System\AEkZNON.exe
  C:\Windows\System\AEkZNON.exe
  2⤵
  PID:5520
- C:\Windows\System\LXAxrNg.exe
  C:\Windows\System\LXAxrNg.exe
  2⤵
  PID:5220
- C:\Windows\System\SjSDNWA.exe
  C:\Windows\System\SjSDNWA.exe
  2⤵
  PID:2824
- C:\Windows\System\SmvvZFD.exe
  C:\Windows\System\SmvvZFD.exe
  2⤵
  PID:2800
- C:\Windows\System\pWTJQNS.exe
  C:\Windows\System\pWTJQNS.exe
  2⤵
  PID:2352
- C:\Windows\System\WsxIGmF.exe
  C:\Windows\System\WsxIGmF.exe
  2⤵
  PID:3672
- C:\Windows\System\tGBwahM.exe
  C:\Windows\System\tGBwahM.exe
  2⤵
  PID:6360
- C:\Windows\System\DgRwvEs.exe
  C:\Windows\System\DgRwvEs.exe
  2⤵
  PID:2056
- C:\Windows\System\ugpUyWA.exe
  C:\Windows\System\ugpUyWA.exe
  2⤵
  PID:1112
- C:\Windows\System\MdHtVLR.exe
  C:\Windows\System\MdHtVLR.exe
  2⤵
  PID:5064
- C:\Windows\System\CFIVswm.exe
  C:\Windows\System\CFIVswm.exe
  2⤵
  PID:2540
- C:\Windows\System\MJotdWu.exe
  C:\Windows\System\MJotdWu.exe
  2⤵
  PID:6364
- C:\Windows\System\PpZDnoq.exe
  C:\Windows\System\PpZDnoq.exe
  2⤵
  PID:2220
- C:\Windows\System\RZYElla.exe
  C:\Windows\System\RZYElla.exe
  2⤵
  PID:6628
- C:\Windows\System\wBNXFad.exe
  C:\Windows\System\wBNXFad.exe
  2⤵
  PID:6708
- C:\Windows\System\YvopcqO.exe
  C:\Windows\System\YvopcqO.exe
  2⤵
  PID:6872
- C:\Windows\System\knBKUzQ.exe
  C:\Windows\System\knBKUzQ.exe
  2⤵
  PID:6924
- C:\Windows\System\MmwHkot.exe
  C:\Windows\System\MmwHkot.exe
  2⤵
  PID:6972
- C:\Windows\System\fPEoJxe.exe
  C:\Windows\System\fPEoJxe.exe
  2⤵
  PID:6388
- C:\Windows\System\GrNAQNj.exe
  C:\Windows\System\GrNAQNj.exe
  2⤵
  PID:7124
- C:\Windows\System\CskhZiR.exe
  C:\Windows\System\CskhZiR.exe
  2⤵
  PID:7188
- C:\Windows\System\PZHGkaF.exe
  C:\Windows\System\PZHGkaF.exe
  2⤵
  PID:7208
- C:\Windows\System\xFIPlxM.exe
  C:\Windows\System\xFIPlxM.exe
  2⤵
  PID:7244
- C:\Windows\System\wuUDDIr.exe
  C:\Windows\System\wuUDDIr.exe
  2⤵
  PID:7264
- C:\Windows\System\vylgjyh.exe
  C:\Windows\System\vylgjyh.exe
  2⤵
  PID:7284
- C:\Windows\System\DVlQAJA.exe
  C:\Windows\System\DVlQAJA.exe
  2⤵
  PID:7308
- C:\Windows\System\XybWKbX.exe
  C:\Windows\System\XybWKbX.exe
  2⤵
  PID:7328
- C:\Windows\System\gckNrxw.exe
  C:\Windows\System\gckNrxw.exe
  2⤵
  PID:7344
- C:\Windows\System\nSUEGyl.exe
  C:\Windows\System\nSUEGyl.exe
  2⤵
  PID:7360
- C:\Windows\System\kwNtnnh.exe
  C:\Windows\System\kwNtnnh.exe
  2⤵
  PID:7380
- C:\Windows\System\JTgeavH.exe
  C:\Windows\System\JTgeavH.exe
  2⤵
  PID:7396
- C:\Windows\System\HDiUzoY.exe
  C:\Windows\System\HDiUzoY.exe
  2⤵
  PID:7424
- C:\Windows\System\ijNmUUJ.exe
  C:\Windows\System\ijNmUUJ.exe
  2⤵
  PID:7444
- C:\Windows\System\ZlEDzZi.exe
  C:\Windows\System\ZlEDzZi.exe
  2⤵
  PID:7464
- C:\Windows\System\vzKuQyS.exe
  C:\Windows\System\vzKuQyS.exe
  2⤵
  PID:7480
- C:\Windows\System\WwobjUP.exe
  C:\Windows\System\WwobjUP.exe
  2⤵
  PID:7504
- C:\Windows\System\nWVyCFZ.exe
  C:\Windows\System\nWVyCFZ.exe
  2⤵
  PID:7528
- C:\Windows\System\qsIdxZK.exe
  C:\Windows\System\qsIdxZK.exe
  2⤵
  PID:7548
- C:\Windows\System\zqeyVqp.exe
  C:\Windows\System\zqeyVqp.exe
  2⤵
  PID:7572
- C:\Windows\System\RmXpYhD.exe
  C:\Windows\System\RmXpYhD.exe
  2⤵
  PID:7592
- C:\Windows\System\neznkKH.exe
  C:\Windows\System\neznkKH.exe
  2⤵
  PID:7608
- C:\Windows\System\yBhzKrz.exe
  C:\Windows\System\yBhzKrz.exe
  2⤵
  PID:7632
- C:\Windows\System\qrlngwR.exe
  C:\Windows\System\qrlngwR.exe
  2⤵
  PID:7656
- C:\Windows\System\ObgxPwe.exe
  C:\Windows\System\ObgxPwe.exe
  2⤵
  PID:7676
- C:\Windows\System\McbDXyJ.exe
  C:\Windows\System\McbDXyJ.exe
  2⤵
  PID:7700
- C:\Windows\System\SCOccyL.exe
  C:\Windows\System\SCOccyL.exe
  2⤵
  PID:7720
- C:\Windows\System\HUdeJsC.exe
  C:\Windows\System\HUdeJsC.exe
  2⤵
  PID:7748
- C:\Windows\System\RyHpSfe.exe
  C:\Windows\System\RyHpSfe.exe
  2⤵
  PID:7764
- C:\Windows\System\xJgpuQM.exe
  C:\Windows\System\xJgpuQM.exe
  2⤵
  PID:7800
- C:\Windows\System\syshzJb.exe
  C:\Windows\System\syshzJb.exe
  2⤵
  PID:7824
- C:\Windows\System\TuXtnVb.exe
  C:\Windows\System\TuXtnVb.exe
  2⤵
  PID:7848
- C:\Windows\System\xaUQyeD.exe
  C:\Windows\System\xaUQyeD.exe
  2⤵
  PID:7868
- C:\Windows\System\cavoYMg.exe
  C:\Windows\System\cavoYMg.exe
  2⤵
  PID:7884
- C:\Windows\System\TGSXjzV.exe
  C:\Windows\System\TGSXjzV.exe
  2⤵
  PID:7908
- C:\Windows\System\dudADHI.exe
  C:\Windows\System\dudADHI.exe
  2⤵
  PID:7928
- C:\Windows\System\egPrklK.exe
  C:\Windows\System\egPrklK.exe
  2⤵
  PID:7948
- C:\Windows\System\DXJTFYl.exe
  C:\Windows\System\DXJTFYl.exe
  2⤵
  PID:7964
- C:\Windows\System\PEDSoQF.exe
  C:\Windows\System\PEDSoQF.exe
  2⤵
  PID:7988
- C:\Windows\System\asTMijQ.exe
  C:\Windows\System\asTMijQ.exe
  2⤵
  PID:8008
- C:\Windows\System\wUIJsZk.exe
  C:\Windows\System\wUIJsZk.exe
  2⤵
  PID:8032
- C:\Windows\System\iQiqGsG.exe
  C:\Windows\System\iQiqGsG.exe
  2⤵
  PID:8052
- C:\Windows\System\mOVDfly.exe
  C:\Windows\System\mOVDfly.exe
  2⤵
  PID:8072
- C:\Windows\System\sytkHTx.exe
  C:\Windows\System\sytkHTx.exe
  2⤵
  PID:8096
- C:\Windows\System\dkiyKsk.exe
  C:\Windows\System\dkiyKsk.exe
  2⤵
  PID:8116
- C:\Windows\System\TOOMDjP.exe
  C:\Windows\System\TOOMDjP.exe
  2⤵
  PID:8136
- C:\Windows\System\WZPHRPm.exe
  C:\Windows\System\WZPHRPm.exe
  2⤵
  PID:8156
- C:\Windows\System\dbYYhQt.exe
  C:\Windows\System\dbYYhQt.exe
  2⤵
  PID:8176
- C:\Windows\System\uulcjVp.exe
  C:\Windows\System\uulcjVp.exe
  2⤵
  PID:2680
- C:\Windows\System\OvqEwnJ.exe
  C:\Windows\System\OvqEwnJ.exe
  2⤵
  PID:5472
- C:\Windows\System\IOpSAHH.exe
  C:\Windows\System\IOpSAHH.exe
  2⤵
  PID:6616
- C:\Windows\System\ZDOFmBw.exe
  C:\Windows\System\ZDOFmBw.exe
  2⤵
  PID:6680
- C:\Windows\System\xtGeMKa.exe
  C:\Windows\System\xtGeMKa.exe
  2⤵
  PID:6136
- C:\Windows\System\ryZLsfI.exe
  C:\Windows\System\ryZLsfI.exe
  2⤵
  PID:4888
- C:\Windows\System\bFGZIkH.exe
  C:\Windows\System\bFGZIkH.exe
  2⤵
  PID:6880
- C:\Windows\System\aVKsKXC.exe
  C:\Windows\System\aVKsKXC.exe
  2⤵
  PID:5292
- C:\Windows\System\ZXQnLMB.exe
  C:\Windows\System\ZXQnLMB.exe
  2⤵
  PID:7004
- C:\Windows\System\kRhtccN.exe
  C:\Windows\System\kRhtccN.exe
  2⤵
  PID:6516
- C:\Windows\System\rQDFVcn.exe
  C:\Windows\System\rQDFVcn.exe
  2⤵
  PID:6812
- C:\Windows\System\YvvdCYs.exe
  C:\Windows\System\YvvdCYs.exe
  2⤵
  PID:6372
- C:\Windows\System\cGlTvzs.exe
  C:\Windows\System\cGlTvzs.exe
  2⤵
  PID:1504
- C:\Windows\System\ymHmotw.exe
  C:\Windows\System\ymHmotw.exe
  2⤵
  PID:4308
- C:\Windows\System\pdyVazZ.exe
  C:\Windows\System\pdyVazZ.exe
  2⤵
  PID:4100
- C:\Windows\System\yzPAPcy.exe
  C:\Windows\System\yzPAPcy.exe
  2⤵
  PID:5764
- C:\Windows\System\ihUCFXM.exe
  C:\Windows\System\ihUCFXM.exe
  2⤵
  PID:7340
- C:\Windows\System\mMaSuzC.exe
  C:\Windows\System\mMaSuzC.exe
  2⤵
  PID:6220
- C:\Windows\System\GLREVcw.exe
  C:\Windows\System\GLREVcw.exe
  2⤵
  PID:2040
- C:\Windows\System\XucXKFh.exe
  C:\Windows\System\XucXKFh.exe
  2⤵
  PID:7520
- C:\Windows\System\TpYFodS.exe
  C:\Windows\System\TpYFodS.exe
  2⤵
  PID:8212
- C:\Windows\System\lrXJfmQ.exe
  C:\Windows\System\lrXJfmQ.exe
  2⤵
  PID:8228
- C:\Windows\System\wRijzmO.exe
  C:\Windows\System\wRijzmO.exe
  2⤵
  PID:8248
- C:\Windows\System\OdYfmVR.exe
  C:\Windows\System\OdYfmVR.exe
  2⤵
  PID:8276
- C:\Windows\System\XRaKFCA.exe
  C:\Windows\System\XRaKFCA.exe
  2⤵
  PID:8292
- C:\Windows\System\LqoFpqv.exe
  C:\Windows\System\LqoFpqv.exe
  2⤵
  PID:8320
- C:\Windows\System\SnMyVGZ.exe
  C:\Windows\System\SnMyVGZ.exe
  2⤵
  PID:8340
- C:\Windows\System\XkfTfdS.exe
  C:\Windows\System\XkfTfdS.exe
  2⤵
  PID:8368
- C:\Windows\System\itzkgYb.exe
  C:\Windows\System\itzkgYb.exe
  2⤵
  PID:8388
- C:\Windows\System\CBBpTLe.exe
  C:\Windows\System\CBBpTLe.exe
  2⤵
  PID:8412
- C:\Windows\System\PKKblTt.exe
  C:\Windows\System\PKKblTt.exe
  2⤵
  PID:8432
- C:\Windows\System\gJIruPD.exe
  C:\Windows\System\gJIruPD.exe
  2⤵
  PID:8452
- C:\Windows\System\dKZRpzm.exe
  C:\Windows\System\dKZRpzm.exe
  2⤵
  PID:8476
- C:\Windows\System\ozsvzrK.exe
  C:\Windows\System\ozsvzrK.exe
  2⤵
  PID:8492
- C:\Windows\System\UVgxgPW.exe
  C:\Windows\System\UVgxgPW.exe
  2⤵
  PID:8508
- C:\Windows\System\bNPcKqO.exe
  C:\Windows\System\bNPcKqO.exe
  2⤵
  PID:8532
- C:\Windows\System\ZBnDDVZ.exe
  C:\Windows\System\ZBnDDVZ.exe
  2⤵
  PID:8552
- C:\Windows\System\HDXMqXU.exe
  C:\Windows\System\HDXMqXU.exe
  2⤵
  PID:8572
- C:\Windows\System\CqeDzRg.exe
  C:\Windows\System\CqeDzRg.exe
  2⤵
  PID:8592
- C:\Windows\System\frfQrji.exe
  C:\Windows\System\frfQrji.exe
  2⤵
  PID:8628
- C:\Windows\System\ldpreTE.exe
  C:\Windows\System\ldpreTE.exe
  2⤵
  PID:8644
- C:\Windows\System\GBpNGtU.exe
  C:\Windows\System\GBpNGtU.exe
  2⤵
  PID:8664
- C:\Windows\System\aDEuzPT.exe
  C:\Windows\System\aDEuzPT.exe
  2⤵
  PID:8688
- C:\Windows\System\EPzQdUM.exe
  C:\Windows\System\EPzQdUM.exe
  2⤵
  PID:8712
- C:\Windows\System\ZNWxCJK.exe
  C:\Windows\System\ZNWxCJK.exe
  2⤵
  PID:8736
- C:\Windows\System\YRrZAMX.exe
  C:\Windows\System\YRrZAMX.exe
  2⤵
  PID:8756
- C:\Windows\System\ADFAeoj.exe
  C:\Windows\System\ADFAeoj.exe
  2⤵
  PID:8776
- C:\Windows\System\cPhqdqe.exe
  C:\Windows\System\cPhqdqe.exe
  2⤵
  PID:8800
- C:\Windows\System\ETqoIUl.exe
  C:\Windows\System\ETqoIUl.exe
  2⤵
  PID:8816
- C:\Windows\System\EaZbLOS.exe
  C:\Windows\System\EaZbLOS.exe
  2⤵
  PID:8840
- C:\Windows\System\ZsgIySJ.exe
  C:\Windows\System\ZsgIySJ.exe
  2⤵
  PID:8856
- C:\Windows\System\nyteFDO.exe
  C:\Windows\System\nyteFDO.exe
  2⤵
  PID:8888
- C:\Windows\System\YNtaQIx.exe
  C:\Windows\System\YNtaQIx.exe
  2⤵
  PID:8912
- C:\Windows\System\ouWhiAI.exe
  C:\Windows\System\ouWhiAI.exe
  2⤵
  PID:8936
- C:\Windows\System\lIOVBuy.exe
  C:\Windows\System\lIOVBuy.exe
  2⤵
  PID:8956
- C:\Windows\System\hQxTHlT.exe
  C:\Windows\System\hQxTHlT.exe
  2⤵
  PID:8980
- C:\Windows\System\AKrCzQO.exe
  C:\Windows\System\AKrCzQO.exe
  2⤵
  PID:9000
- C:\Windows\System\FdgQgPM.exe
  C:\Windows\System\FdgQgPM.exe
  2⤵
  PID:9028
- C:\Windows\System\yzaQpyB.exe
  C:\Windows\System\yzaQpyB.exe
  2⤵
  PID:9048
- C:\Windows\System\eguwuGf.exe
  C:\Windows\System\eguwuGf.exe
  2⤵
  PID:9072
- C:\Windows\System\PqkUwFN.exe
  C:\Windows\System\PqkUwFN.exe
  2⤵
  PID:9092
- C:\Windows\System\UZPaRDG.exe
  C:\Windows\System\UZPaRDG.exe
  2⤵
  PID:9112
- C:\Windows\System\bAlMbhi.exe
  C:\Windows\System\bAlMbhi.exe
  2⤵
  PID:9136
- C:\Windows\System\sPMmPIp.exe
  C:\Windows\System\sPMmPIp.exe
  2⤵
  PID:9164
- C:\Windows\System\MHKHJUk.exe
  C:\Windows\System\MHKHJUk.exe
  2⤵
  PID:9184
- C:\Windows\System\ElBXiuT.exe
  C:\Windows\System\ElBXiuT.exe
  2⤵
  PID:9204
- C:\Windows\System\efaVEVJ.exe
  C:\Windows\System\efaVEVJ.exe
  2⤵
  PID:7648
- C:\Windows\System\glrkzUG.exe
  C:\Windows\System\glrkzUG.exe
  2⤵
  PID:7716
- C:\Windows\System\nmVIauU.exe
  C:\Windows\System\nmVIauU.exe
  2⤵
  PID:7056
- C:\Windows\System\amBJRIZ.exe
  C:\Windows\System\amBJRIZ.exe
  2⤵
  PID:7096
- C:\Windows\System\UTosnYD.exe
  C:\Windows\System\UTosnYD.exe
  2⤵
  PID:7816
- C:\Windows\System\XJRQyHZ.exe
  C:\Windows\System\XJRQyHZ.exe
  2⤵
  PID:7160
- C:\Windows\System\dODExVK.exe
  C:\Windows\System\dODExVK.exe
  2⤵
  PID:5248
- C:\Windows\System\sBRomeM.exe
  C:\Windows\System\sBRomeM.exe
  2⤵
  PID:8004
- C:\Windows\System\KLPXPUH.exe
  C:\Windows\System\KLPXPUH.exe
  2⤵
  PID:7276
- C:\Windows\System\yHzGgdU.exe
  C:\Windows\System\yHzGgdU.exe
  2⤵
  PID:8088
- C:\Windows\System\EysdlZE.exe
  C:\Windows\System\EysdlZE.exe
  2⤵
  PID:8172
- C:\Windows\System\bnoVoTS.exe
  C:\Windows\System\bnoVoTS.exe
  2⤵
  PID:6664
- C:\Windows\System\VBbelVW.exe
  C:\Windows\System\VBbelVW.exe
  2⤵
  PID:7452
- C:\Windows\System\lXjNUEY.exe
  C:\Windows\System\lXjNUEY.exe
  2⤵
  PID:2400
- C:\Windows\System\olePntT.exe
  C:\Windows\System\olePntT.exe
  2⤵
  PID:5432
- C:\Windows\System\jNNreeq.exe
  C:\Windows\System\jNNreeq.exe
  2⤵
  PID:7536
- C:\Windows\System\BJDPJUp.exe
  C:\Windows\System\BJDPJUp.exe
  2⤵
  PID:7584
- C:\Windows\System\ItwvsxU.exe
  C:\Windows\System\ItwvsxU.exe
  2⤵
  PID:7628
- C:\Windows\System\fYdJCvJ.exe
  C:\Windows\System\fYdJCvJ.exe
  2⤵
  PID:8244
- C:\Windows\System\cVzEctl.exe
  C:\Windows\System\cVzEctl.exe
  2⤵
  PID:7684
- C:\Windows\System\nSvcqiC.exe
  C:\Windows\System\nSvcqiC.exe
  2⤵
  PID:8328
- C:\Windows\System\mYzdUBB.exe
  C:\Windows\System\mYzdUBB.exe
  2⤵
  PID:9232
- C:\Windows\System\EfTFDwJ.exe
  C:\Windows\System\EfTFDwJ.exe
  2⤵
  PID:9260
- C:\Windows\System\MGtHOYF.exe
  C:\Windows\System\MGtHOYF.exe
  2⤵
  PID:9288
- C:\Windows\System\pWAfWyH.exe
  C:\Windows\System\pWAfWyH.exe
  2⤵
  PID:9312
- C:\Windows\System\eLhCBWv.exe
  C:\Windows\System\eLhCBWv.exe
  2⤵
  PID:9332
- C:\Windows\System\JTlUbOi.exe
  C:\Windows\System\JTlUbOi.exe
  2⤵
  PID:9352
- C:\Windows\System\kycavcM.exe
  C:\Windows\System\kycavcM.exe
  2⤵
  PID:9372
- C:\Windows\System\HIEpeRZ.exe
  C:\Windows\System\HIEpeRZ.exe
  2⤵
  PID:9400
- C:\Windows\System\timBbqS.exe
  C:\Windows\System\timBbqS.exe
  2⤵
  PID:9416
- C:\Windows\System\euCuYWd.exe
  C:\Windows\System\euCuYWd.exe
  2⤵
  PID:9448
- C:\Windows\System\GwoASLa.exe
  C:\Windows\System\GwoASLa.exe
  2⤵
  PID:9468
- C:\Windows\System\SmSqFid.exe
  C:\Windows\System\SmSqFid.exe
  2⤵
  PID:9488
- C:\Windows\System\YWjZzJY.exe
  C:\Windows\System\YWjZzJY.exe
  2⤵
  PID:9516
- C:\Windows\System\RbopQAe.exe
  C:\Windows\System\RbopQAe.exe
  2⤵
  PID:9536
- C:\Windows\System\NKjHPnh.exe
  C:\Windows\System\NKjHPnh.exe
  2⤵
  PID:9552
- C:\Windows\System\pVatksm.exe
  C:\Windows\System\pVatksm.exe
  2⤵
  PID:9568
- C:\Windows\System\nrPWsMe.exe
  C:\Windows\System\nrPWsMe.exe
  2⤵
  PID:9584
- C:\Windows\System\aZmXuKb.exe
  C:\Windows\System\aZmXuKb.exe
  2⤵
  PID:9604
- C:\Windows\System\dnxBMGS.exe
  C:\Windows\System\dnxBMGS.exe
  2⤵
  PID:9624
- C:\Windows\System\DkTBIeK.exe
  C:\Windows\System\DkTBIeK.exe
  2⤵
  PID:9652
- C:\Windows\System\LnVvEaa.exe
  C:\Windows\System\LnVvEaa.exe
  2⤵
  PID:9672
- C:\Windows\System\ZYJuMwk.exe
  C:\Windows\System\ZYJuMwk.exe
  2⤵
  PID:9692
- C:\Windows\System\KzWnOcf.exe
  C:\Windows\System\KzWnOcf.exe
  2⤵
  PID:9716
- C:\Windows\System\fWGiMfN.exe
  C:\Windows\System\fWGiMfN.exe
  2⤵
  PID:9740
- C:\Windows\System\NxEPwZA.exe
  C:\Windows\System\NxEPwZA.exe
  2⤵
  PID:9760
- C:\Windows\System\SpjmZGJ.exe
  C:\Windows\System\SpjmZGJ.exe
  2⤵
  PID:9784
- C:\Windows\System\FyUXPNg.exe
  C:\Windows\System\FyUXPNg.exe
  2⤵
  PID:9808
- C:\Windows\System\sGvVLek.exe
  C:\Windows\System\sGvVLek.exe
  2⤵
  PID:9832
- C:\Windows\System\XjcizDd.exe
  C:\Windows\System\XjcizDd.exe
  2⤵
  PID:9860
- C:\Windows\System\iJRGKlz.exe
  C:\Windows\System\iJRGKlz.exe
  2⤵
  PID:9876
- C:\Windows\System\DcaSKXx.exe
  C:\Windows\System\DcaSKXx.exe
  2⤵
  PID:9904
- C:\Windows\System\dnQOvoZ.exe
  C:\Windows\System\dnQOvoZ.exe
  2⤵
  PID:9920
- C:\Windows\System\FeUXaqF.exe
  C:\Windows\System\FeUXaqF.exe
  2⤵
  PID:9944
- C:\Windows\System\jNdUvnp.exe
  C:\Windows\System\jNdUvnp.exe
  2⤵
  PID:9964
- C:\Windows\System\sjUHogB.exe
  C:\Windows\System\sjUHogB.exe
  2⤵
  PID:9992
- C:\Windows\System\TTNZpWz.exe
  C:\Windows\System\TTNZpWz.exe
  2⤵
  PID:10212
- C:\Windows\System\ngmjmJm.exe
  C:\Windows\System\ngmjmJm.exe
  2⤵
  PID:10236
- C:\Windows\System\OcyPIEN.exe
  C:\Windows\System\OcyPIEN.exe
  2⤵
  PID:3408
- C:\Windows\System\aiTGzDD.exe
  C:\Windows\System\aiTGzDD.exe
  2⤵
  PID:6576
- C:\Windows\System\yhynAin.exe
  C:\Windows\System\yhynAin.exe
  2⤵
  PID:6688
- C:\Windows\System\zrlFbZY.exe
  C:\Windows\System\zrlFbZY.exe
  2⤵
  PID:8500
- C:\Windows\System\IGydQWN.exe
  C:\Windows\System\IGydQWN.exe
  2⤵
  PID:8560
- C:\Windows\System\hGqKGbJ.exe
  C:\Windows\System\hGqKGbJ.exe
  2⤵
  PID:7944
- C:\Windows\System\kjVtWxy.exe
  C:\Windows\System\kjVtWxy.exe
  2⤵
  PID:7980
- C:\Windows\System\kxvTMfU.exe
  C:\Windows\System\kxvTMfU.exe
  2⤵
  PID:8852
- C:\Windows\System\VGtbKjR.exe
  C:\Windows\System\VGtbKjR.exe
  2⤵
  PID:8896
- C:\Windows\System\gHAuDZs.exe
  C:\Windows\System\gHAuDZs.exe
  2⤵
  PID:8932
- C:\Windows\System\wTCiXgb.exe
  C:\Windows\System\wTCiXgb.exe
  2⤵
  PID:8992
- C:\Windows\System\rpaERFS.exe
  C:\Windows\System\rpaERFS.exe
  2⤵
  PID:1928
- C:\Windows\System\bqWIXmw.exe
  C:\Windows\System\bqWIXmw.exe
  2⤵
  PID:6580
- C:\Windows\System\VYDIzBm.exe
  C:\Windows\System\VYDIzBm.exe
  2⤵
  PID:2860
- C:\Windows\System\xyMWkaZ.exe
  C:\Windows\System\xyMWkaZ.exe
  2⤵
  PID:7420
- C:\Windows\System\GYaViVa.exe
  C:\Windows\System\GYaViVa.exe
  2⤵
  PID:3924
- C:\Windows\System\wMsEUpo.exe
  C:\Windows\System\wMsEUpo.exe
  2⤵
  PID:4036
- C:\Windows\System\RZImAgI.exe
  C:\Windows\System\RZImAgI.exe
  2⤵
  PID:5724
- C:\Windows\System\mueRAIo.exe
  C:\Windows\System\mueRAIo.exe
  2⤵
  PID:7476
- C:\Windows\System\Zacrqau.exe
  C:\Windows\System\Zacrqau.exe
  2⤵
  PID:7564
- C:\Windows\System\xmPvESX.exe
  C:\Windows\System\xmPvESX.exe
  2⤵
  PID:6984
- C:\Windows\System\TwkpoeF.exe
  C:\Windows\System\TwkpoeF.exe
  2⤵
  PID:8288
- C:\Windows\System\AvPyfpx.exe
  C:\Windows\System\AvPyfpx.exe
  2⤵
  PID:8240
- C:\Windows\System\TJOgmBU.exe
  C:\Windows\System\TJOgmBU.exe
  2⤵
  PID:7712
- C:\Windows\System\YuAhraG.exe
  C:\Windows\System\YuAhraG.exe
  2⤵
  PID:7772
- C:\Windows\System\eJvvZVW.exe
  C:\Windows\System\eJvvZVW.exe
  2⤵
  PID:8444
- C:\Windows\System\wteJeyL.exe
  C:\Windows\System\wteJeyL.exe
  2⤵
  PID:8520
- C:\Windows\System\FzPPIWt.exe
  C:\Windows\System\FzPPIWt.exe
  2⤵
  PID:7844
- C:\Windows\System\gnTzpwn.exe
  C:\Windows\System\gnTzpwn.exe
  2⤵
  PID:7900
- C:\Windows\System\ZFgKGAx.exe
  C:\Windows\System\ZFgKGAx.exe
  2⤵
  PID:9428
- C:\Windows\System\cEORJBR.exe
  C:\Windows\System\cEORJBR.exe
  2⤵
  PID:9532
- C:\Windows\System\IYfIGWJ.exe
  C:\Windows\System\IYfIGWJ.exe
  2⤵
  PID:9620
- C:\Windows\System\IdEdkqA.exe
  C:\Windows\System\IdEdkqA.exe
  2⤵
  PID:9684
- C:\Windows\System\cbuyfyb.exe
  C:\Windows\System\cbuyfyb.exe
  2⤵
  PID:9728
- C:\Windows\System\RIomYea.exe
  C:\Windows\System\RIomYea.exe
  2⤵
  PID:8144
- C:\Windows\System\jEKQCSJ.exe
  C:\Windows\System\jEKQCSJ.exe
  2⤵
  PID:8148
- C:\Windows\System\RPyxGVy.exe
  C:\Windows\System\RPyxGVy.exe
  2⤵
  PID:10256
- C:\Windows\System\PttKvZI.exe
  C:\Windows\System\PttKvZI.exe
  2⤵
  PID:10272
- C:\Windows\System\wHNsQjb.exe
  C:\Windows\System\wHNsQjb.exe
  2⤵
  PID:10296
- C:\Windows\System\AlCpLMH.exe
  C:\Windows\System\AlCpLMH.exe
  2⤵
  PID:10316
- C:\Windows\System\lVToAcf.exe
  C:\Windows\System\lVToAcf.exe
  2⤵
  PID:10340
- C:\Windows\System\aORFpkw.exe
  C:\Windows\System\aORFpkw.exe
  2⤵
  PID:10364
- C:\Windows\System\WZZiGht.exe
  C:\Windows\System\WZZiGht.exe
  2⤵
  PID:10384
- C:\Windows\System\YrUlwLB.exe
  C:\Windows\System\YrUlwLB.exe
  2⤵
  PID:10404
- C:\Windows\System\JSyyWtc.exe
  C:\Windows\System\JSyyWtc.exe
  2⤵
  PID:10428
- C:\Windows\System\AcxZYoA.exe
  C:\Windows\System\AcxZYoA.exe
  2⤵
  PID:10448
- C:\Windows\System\IUKQPzh.exe
  C:\Windows\System\IUKQPzh.exe
  2⤵
  PID:10472
- C:\Windows\System\sBqCAVy.exe
  C:\Windows\System\sBqCAVy.exe
  2⤵
  PID:10500
- C:\Windows\System\hXZrRlB.exe
  C:\Windows\System\hXZrRlB.exe
  2⤵
  PID:10516
- C:\Windows\System\tSTrkoF.exe
  C:\Windows\System\tSTrkoF.exe
  2⤵
  PID:10540
- C:\Windows\System\HeFXHdf.exe
  C:\Windows\System\HeFXHdf.exe
  2⤵
  PID:10564
- C:\Windows\System\vukxmiW.exe
  C:\Windows\System\vukxmiW.exe
  2⤵
  PID:10588
- C:\Windows\System\dRkXPjN.exe
  C:\Windows\System\dRkXPjN.exe
  2⤵
  PID:10608
- C:\Windows\System\BeBDWeE.exe
  C:\Windows\System\BeBDWeE.exe
  2⤵
  PID:10628
- C:\Windows\System\roXHlAC.exe
  C:\Windows\System\roXHlAC.exe
  2⤵
  PID:10652
- C:\Windows\System\JuSJNfW.exe
  C:\Windows\System\JuSJNfW.exe
  2⤵
  PID:10668
- C:\Windows\System\MpeyGHs.exe
  C:\Windows\System\MpeyGHs.exe
  2⤵
  PID:10692
- C:\Windows\System\oeCaLis.exe
  C:\Windows\System\oeCaLis.exe
  2⤵
  PID:10716
- C:\Windows\System\HmpFIuE.exe
  C:\Windows\System\HmpFIuE.exe
  2⤵
  PID:10736
- C:\Windows\System\YJYszMW.exe
  C:\Windows\System\YJYszMW.exe
  2⤵
  PID:10768
- C:\Windows\System\fyHyDmi.exe
  C:\Windows\System\fyHyDmi.exe
  2⤵
  PID:10788
- C:\Windows\System\DAVKSax.exe
  C:\Windows\System\DAVKSax.exe
  2⤵
  PID:10820
- C:\Windows\System\IrtbujQ.exe
  C:\Windows\System\IrtbujQ.exe
  2⤵
  PID:10840
- C:\Windows\System\RGEwGzK.exe
  C:\Windows\System\RGEwGzK.exe
  2⤵
  PID:10864
- C:\Windows\System\FCefOQZ.exe
  C:\Windows\System\FCefOQZ.exe
  2⤵
  PID:10892
- C:\Windows\System\XtvVpyA.exe
  C:\Windows\System\XtvVpyA.exe
  2⤵
  PID:10912
- C:\Windows\System\fkqaGng.exe
  C:\Windows\System\fkqaGng.exe
  2⤵
  PID:10940
- C:\Windows\System\XGXAJQK.exe
  C:\Windows\System\XGXAJQK.exe
  2⤵
  PID:10976
- C:\Windows\System\uaZyHBO.exe
  C:\Windows\System\uaZyHBO.exe
  2⤵
  PID:11004
- C:\Windows\System\nanfVFt.exe
  C:\Windows\System\nanfVFt.exe
  2⤵
  PID:11020
- C:\Windows\System\qYkNyLV.exe
  C:\Windows\System\qYkNyLV.exe
  2⤵
  PID:11044
- C:\Windows\System\frdAVmM.exe
  C:\Windows\System\frdAVmM.exe
  2⤵
  PID:11068
- C:\Windows\System\rWamFap.exe
  C:\Windows\System\rWamFap.exe
  2⤵
  PID:11088
- C:\Windows\System\LGKdNpb.exe
  C:\Windows\System\LGKdNpb.exe
  2⤵
  PID:11108
- C:\Windows\System\GgraKUt.exe
  C:\Windows\System\GgraKUt.exe
  2⤵
  PID:11132
- C:\Windows\System\cUzRWtL.exe
  C:\Windows\System\cUzRWtL.exe
  2⤵
  PID:11156
- C:\Windows\System\jpXWRjX.exe
  C:\Windows\System\jpXWRjX.exe
  2⤵
  PID:11172
- C:\Windows\System\GDbEuuP.exe
  C:\Windows\System\GDbEuuP.exe
  2⤵
  PID:11196
- C:\Windows\System\vkSiSSD.exe
  C:\Windows\System\vkSiSSD.exe
  2⤵
  PID:11224
- C:\Windows\System\knRfnCA.exe
  C:\Windows\System\knRfnCA.exe
  2⤵
  PID:11244
- C:\Windows\System\UjdYWrH.exe
  C:\Windows\System\UjdYWrH.exe
  2⤵
  PID:9044
- C:\Windows\System\FJPqQWI.exe
  C:\Windows\System\FJPqQWI.exe
  2⤵
  PID:9064
- C:\Windows\System\uZhzXhL.exe
  C:\Windows\System\uZhzXhL.exe
  2⤵
  PID:5760
- C:\Windows\System\kJmxXRn.exe
  C:\Windows\System\kJmxXRn.exe
  2⤵
  PID:4472
- C:\Windows\System\rxPJuoP.exe
  C:\Windows\System\rxPJuoP.exe
  2⤵
  PID:7220
- C:\Windows\System\IQZYXgP.exe
  C:\Windows\System\IQZYXgP.exe
  2⤵
  PID:7280
- C:\Windows\System\jIYLPgR.exe
  C:\Windows\System\jIYLPgR.exe
  2⤵
  PID:7460
- C:\Windows\System\BvYhEVs.exe
  C:\Windows\System\BvYhEVs.exe
  2⤵
  PID:8284
- C:\Windows\System\oMjlSoH.exe
  C:\Windows\System\oMjlSoH.exe
  2⤵
  PID:9244
- C:\Windows\System\CzSnxsx.exe
  C:\Windows\System\CzSnxsx.exe
  2⤵
  PID:11288
- C:\Windows\System\bqoECFh.exe
  C:\Windows\System\bqoECFh.exe
  2⤵
  PID:11308
- C:\Windows\System\JVzuSZn.exe
  C:\Windows\System\JVzuSZn.exe
  2⤵
  PID:11328
- C:\Windows\System\lNGsrdK.exe
  C:\Windows\System\lNGsrdK.exe
  2⤵
  PID:11348
- C:\Windows\System\mbzdzJt.exe
  C:\Windows\System\mbzdzJt.exe
  2⤵
  PID:11372
- C:\Windows\System\PqosSZN.exe
  C:\Windows\System\PqosSZN.exe
  2⤵
  PID:11396
- C:\Windows\System\PSTtYvL.exe
  C:\Windows\System\PSTtYvL.exe
  2⤵
  PID:11420
- C:\Windows\System\LDAjvHg.exe
  C:\Windows\System\LDAjvHg.exe
  2⤵
  PID:11440
- C:\Windows\System\uTPsDjX.exe
  C:\Windows\System\uTPsDjX.exe
  2⤵
  PID:11464
- C:\Windows\System\NmIWyTV.exe
  C:\Windows\System\NmIWyTV.exe
  2⤵
  PID:11480
- C:\Windows\System\UhiMogT.exe
  C:\Windows\System\UhiMogT.exe
  2⤵
  PID:11504
- C:\Windows\System\ujhLZXp.exe
  C:\Windows\System\ujhLZXp.exe
  2⤵
  PID:11524
- C:\Windows\System\ZhMNLgC.exe
  C:\Windows\System\ZhMNLgC.exe
  2⤵
  PID:11544
- C:\Windows\System\azZmZRY.exe
  C:\Windows\System\azZmZRY.exe
  2⤵
  PID:11568
- C:\Windows\System\KtFXAqf.exe
  C:\Windows\System\KtFXAqf.exe
  2⤵
  PID:11596
- C:\Windows\System\iPPkNxi.exe
  C:\Windows\System\iPPkNxi.exe
  2⤵
  PID:11616
- C:\Windows\System\QIXWfIk.exe
  C:\Windows\System\QIXWfIk.exe
  2⤵
  PID:11636
- C:\Windows\System\kXnOwve.exe
  C:\Windows\System\kXnOwve.exe
  2⤵
  PID:11652
- C:\Windows\System\lqOUyDI.exe
  C:\Windows\System\lqOUyDI.exe
  2⤵
  PID:11668
- C:\Windows\System\SSVrSbV.exe
  C:\Windows\System\SSVrSbV.exe
  2⤵
  PID:11688
- C:\Windows\System\rYDpibQ.exe
  C:\Windows\System\rYDpibQ.exe
  2⤵
  PID:11704
- C:\Windows\System\gcnHMqa.exe
  C:\Windows\System\gcnHMqa.exe
  2⤵
  PID:11720
- C:\Windows\System\DBmzYnz.exe
  C:\Windows\System\DBmzYnz.exe
  2⤵
  PID:11736
- C:\Windows\System\pBvBjkC.exe
  C:\Windows\System\pBvBjkC.exe
  2⤵
  PID:11756
- C:\Windows\System\jHUuyPD.exe
  C:\Windows\System\jHUuyPD.exe
  2⤵
  PID:11776
- C:\Windows\System\OEvyWOf.exe
  C:\Windows\System\OEvyWOf.exe
  2⤵
  PID:11796
- C:\Windows\System\QjpLJIu.exe
  C:\Windows\System\QjpLJIu.exe
  2⤵
  PID:11816
- C:\Windows\System\zDUOpUC.exe
  C:\Windows\System\zDUOpUC.exe
  2⤵
  PID:11840
- C:\Windows\System\OiOgXdI.exe
  C:\Windows\System\OiOgXdI.exe
  2⤵
  PID:11868
- C:\Windows\System\GBgWWkr.exe
  C:\Windows\System\GBgWWkr.exe
  2⤵
  PID:11888
- C:\Windows\System\NjTbnbX.exe
  C:\Windows\System\NjTbnbX.exe
  2⤵
  PID:11908
- C:\Windows\System\HRsuIrs.exe
  C:\Windows\System\HRsuIrs.exe
  2⤵
  PID:11928
- C:\Windows\System\zzckABf.exe
  C:\Windows\System\zzckABf.exe
  2⤵
  PID:11952
- C:\Windows\System\zMZYGfl.exe
  C:\Windows\System\zMZYGfl.exe
  2⤵
  PID:11972
- C:\Windows\System\wjBiiEm.exe
  C:\Windows\System\wjBiiEm.exe
  2⤵
  PID:11988
- C:\Windows\System\ylQSjUU.exe
  C:\Windows\System\ylQSjUU.exe
  2⤵
  PID:12012
- C:\Windows\System\ikDtXmB.exe
  C:\Windows\System\ikDtXmB.exe
  2⤵
  PID:12040
- C:\Windows\System\RzzWKyJ.exe
  C:\Windows\System\RzzWKyJ.exe
  2⤵
  PID:12060
- C:\Windows\System\GpukOtQ.exe
  C:\Windows\System\GpukOtQ.exe
  2⤵
  PID:12080
- C:\Windows\System\MTLXiGP.exe
  C:\Windows\System\MTLXiGP.exe
  2⤵
  PID:12108
- C:\Windows\System\GtVvXFv.exe
  C:\Windows\System\GtVvXFv.exe
  2⤵
  PID:12124
- C:\Windows\System\bhBrUsP.exe
  C:\Windows\System\bhBrUsP.exe
  2⤵
  PID:12144
- C:\Windows\System\ygLoWhM.exe
  C:\Windows\System\ygLoWhM.exe
  2⤵
  PID:12168
- C:\Windows\System\mUUNqXh.exe
  C:\Windows\System\mUUNqXh.exe
  2⤵
  PID:12196
- C:\Windows\System\xfOUJJB.exe
  C:\Windows\System\xfOUJJB.exe
  2⤵
  PID:12212
- C:\Windows\System\kgJNVmE.exe
  C:\Windows\System\kgJNVmE.exe
  2⤵
  PID:12236
- C:\Windows\System\wanzSUN.exe
  C:\Windows\System\wanzSUN.exe
  2⤵
  PID:12256
- C:\Windows\System\hBkWKyQ.exe
  C:\Windows\System\hBkWKyQ.exe
  2⤵
  PID:12280
- C:\Windows\System\hnjzzYA.exe
  C:\Windows\System\hnjzzYA.exe
  2⤵
  PID:8460
- C:\Windows\System\abjxujI.exe
  C:\Windows\System\abjxujI.exe
  2⤵
  PID:10208
- C:\Windows\System\lPeHUOT.exe
  C:\Windows\System\lPeHUOT.exe
  2⤵
  PID:8568
- C:\Windows\System\xFUbHXP.exe
  C:\Windows\System\xFUbHXP.exe
  2⤵
  PID:8696
- C:\Windows\System\DNXRjQT.exe
  C:\Windows\System\DNXRjQT.exe
  2⤵
  PID:8836
- C:\Windows\System\utaWurg.exe
  C:\Windows\System\utaWurg.exe
  2⤵
  PID:9408
- C:\Windows\System\McGnZiM.exe
  C:\Windows\System\McGnZiM.exe
  2⤵
  PID:8640
- C:\Windows\System\YdbIFrS.exe
  C:\Windows\System\YdbIFrS.exe
  2⤵
  PID:8680
- C:\Windows\System\gTCAwnd.exe
  C:\Windows\System\gTCAwnd.exe
  2⤵
  PID:9496
- C:\Windows\System\QWvXarL.exe
  C:\Windows\System\QWvXarL.exe
  2⤵
  PID:9548
- C:\Windows\System\QwesaOr.exe
  C:\Windows\System\QwesaOr.exe
  2⤵
  PID:9596
- C:\Windows\System\wpmCAtJ.exe
  C:\Windows\System\wpmCAtJ.exe
  2⤵
  PID:9708
- C:\Windows\System\BHkbiTo.exe
  C:\Windows\System\BHkbiTo.exe
  2⤵
  PID:8200
- C:\Windows\System\qBywQZU.exe
  C:\Windows\System\qBywQZU.exe
  2⤵
  PID:8348
- C:\Windows\System\gzhUqMW.exe
  C:\Windows\System\gzhUqMW.exe
  2⤵
  PID:9304
- C:\Windows\System\UNXeUvD.exe
  C:\Windows\System\UNXeUvD.exe
  2⤵
  PID:9828
- C:\Windows\System\cqQneuh.exe
  C:\Windows\System\cqQneuh.exe
  2⤵
  PID:10248
- C:\Windows\System\sMOBJpQ.exe
  C:\Windows\System\sMOBJpQ.exe
  2⤵
  PID:10288
- C:\Windows\System\FHlOqBB.exe
  C:\Windows\System\FHlOqBB.exe
  2⤵
  PID:9928
- C:\Windows\System\JhwINpj.exe
  C:\Windows\System\JhwINpj.exe
  2⤵
  PID:10444
- C:\Windows\System\nqMpTgI.exe
  C:\Windows\System\nqMpTgI.exe
  2⤵
  PID:9108
- C:\Windows\System\mXkDxCV.exe
  C:\Windows\System\mXkDxCV.exe
  2⤵
  PID:9152
- C:\Windows\System\VKSQqiz.exe
  C:\Windows\System\VKSQqiz.exe
  2⤵
  PID:12308
- C:\Windows\System\igWuASc.exe
  C:\Windows\System\igWuASc.exe
  2⤵
  PID:12332
- C:\Windows\System\mUXGkwY.exe
  C:\Windows\System\mUXGkwY.exe
  2⤵
  PID:12356
- C:\Windows\System\AxLkcvg.exe
  C:\Windows\System\AxLkcvg.exe
  2⤵
  PID:12376
- C:\Windows\System\WBUcLLk.exe
  C:\Windows\System\WBUcLLk.exe
  2⤵
  PID:12400
- C:\Windows\System\hDXUsIA.exe
  C:\Windows\System\hDXUsIA.exe
  2⤵
  PID:12420
- C:\Windows\System\PlHEoVb.exe
  C:\Windows\System\PlHEoVb.exe
  2⤵
  PID:12440
- C:\Windows\System\MPOtRVx.exe
  C:\Windows\System\MPOtRVx.exe
  2⤵
  PID:12464
- C:\Windows\System\JniEyQQ.exe
  C:\Windows\System\JniEyQQ.exe
  2⤵
  PID:12488
- C:\Windows\System\agvolBd.exe
  C:\Windows\System\agvolBd.exe
  2⤵
  PID:12520
- C:\Windows\System\tsYldbt.exe
  C:\Windows\System\tsYldbt.exe
  2⤵
  PID:12540
- C:\Windows\System\xzBgpYr.exe
  C:\Windows\System\xzBgpYr.exe
  2⤵
  PID:12564
- C:\Windows\System\CdNsKtV.exe
  C:\Windows\System\CdNsKtV.exe
  2⤵
  PID:12588
- C:\Windows\System\VOPQOFI.exe
  C:\Windows\System\VOPQOFI.exe
  2⤵
  PID:12624
- C:\Windows\System\GFKaOgc.exe
  C:\Windows\System\GFKaOgc.exe
  2⤵
  PID:12640
- C:\Windows\System\VzlEIlD.exe
  C:\Windows\System\VzlEIlD.exe
  2⤵
  PID:12656
- C:\Windows\System\kfBrUhK.exe
  C:\Windows\System\kfBrUhK.exe
  2⤵
  PID:12672
- C:\Windows\System\hzBQUAa.exe
  C:\Windows\System\hzBQUAa.exe
  2⤵
  PID:12688
- C:\Windows\System\ONoAsJH.exe
  C:\Windows\System\ONoAsJH.exe
  2⤵
  PID:12704
- C:\Windows\System\XIdoBLs.exe
  C:\Windows\System\XIdoBLs.exe
  2⤵
  PID:12732
- C:\Windows\System\mkrbrAG.exe
  C:\Windows\System\mkrbrAG.exe
  2⤵
  PID:12748
- C:\Windows\System\fqyVPhx.exe
  C:\Windows\System\fqyVPhx.exe
  2⤵
  PID:12772
- C:\Windows\System\TUZZiFf.exe
  C:\Windows\System\TUZZiFf.exe
  2⤵
  PID:12792
- C:\Windows\System\mdnBtpD.exe
  C:\Windows\System\mdnBtpD.exe
  2⤵
  PID:12812
- C:\Windows\System\wSMMlde.exe
  C:\Windows\System\wSMMlde.exe
  2⤵
  PID:12836
- C:\Windows\System\huqXkRB.exe
  C:\Windows\System\huqXkRB.exe
  2⤵
  PID:10172
- C:\Windows\System\MIxDqKO.exe
  C:\Windows\System\MIxDqKO.exe
  2⤵
  PID:10052
- C:\Windows\System\gbPgtfc.exe
  C:\Windows\System\gbPgtfc.exe
  2⤵
  PID:8236
- C:\Windows\System\NKABgyJ.exe
  C:\Windows\System\NKABgyJ.exe
  2⤵
  PID:9200
- C:\Windows\System\oEJLrlQ.exe
  C:\Windows\System\oEJLrlQ.exe
  2⤵
  PID:13064
- C:\Windows\System\KOENWRx.exe
  C:\Windows\System\KOENWRx.exe
  2⤵
  PID:11876
- C:\Windows\System\SazTNPS.exe
  C:\Windows\System\SazTNPS.exe
  2⤵
  PID:12964
- C:\Windows\System\IGAPnvD.exe
  C:\Windows\System\IGAPnvD.exe
  2⤵
  PID:12920
- C:\Windows\System\jrpTxwp.exe
  C:\Windows\System\jrpTxwp.exe
  2⤵
  PID:12820
- C:\Windows\System\tvhViAE.exe
  C:\Windows\System\tvhViAE.exe
  2⤵
  PID:12744
- C:\Windows\System\hlCaWZi.exe
  C:\Windows\System\hlCaWZi.exe
  2⤵
  PID:12604
- C:\Windows\System\JbhtRgJ.exe
  C:\Windows\System\JbhtRgJ.exe
  2⤵
  PID:12556
- C:\Windows\System\dmPFcgE.exe
  C:\Windows\System\dmPFcgE.exe
  2⤵
  PID:12528
- C:\Windows\System\mXNXxGD.exe
  C:\Windows\System\mXNXxGD.exe
  2⤵
  PID:8920
- C:\Windows\System\NGzCQDl.exe
  C:\Windows\System\NGzCQDl.exe
  2⤵
  PID:13044
- C:\Windows\System\ZPSYUSZ.exe
  C:\Windows\System\ZPSYUSZ.exe
  2⤵
  PID:9212
- C:\Windows\System\jfaUmFm.exe
  C:\Windows\System\jfaUmFm.exe
  2⤵
  PID:13168
- C:\Windows\System\HBvvaSa.exe
  C:\Windows\System\HBvvaSa.exe
  2⤵
  PID:10804
- C:\Windows\System\MiVDWMx.exe
  C:\Windows\System\MiVDWMx.exe
  2⤵
  PID:10732
- C:\Windows\System\rTqLnKT.exe
  C:\Windows\System\rTqLnKT.exe
  2⤵
  PID:5828
- C:\Windows\System\fwFsfCl.exe
  C:\Windows\System\fwFsfCl.exe
  2⤵
  PID:8308
- C:\Windows\System\ZmsWUwi.exe
  C:\Windows\System\ZmsWUwi.exe
  2⤵
  PID:11460
- C:\Windows\System\jzVSEVl.exe
  C:\Windows\System\jzVSEVl.exe
  2⤵
  PID:6536
- C:\Windows\System\wmFePya.exe
  C:\Windows\System\wmFePya.exe
  2⤵
  PID:6816
- C:\Windows\System\TSgLYrq.exe
  C:\Windows\System\TSgLYrq.exe
  2⤵
  PID:10812
- C:\Windows\System\jVKHJwZ.exe
  C:\Windows\System\jVKHJwZ.exe
  2⤵
  PID:7000
- C:\Windows\System\hBgDVSR.exe
  C:\Windows\System\hBgDVSR.exe
  2⤵
  PID:11040
- C:\Windows\System\cMgqOkI.exe
  C:\Windows\System\cMgqOkI.exe
  2⤵
  PID:9852
- C:\Windows\System\epqsCRd.exe
  C:\Windows\System\epqsCRd.exe
  2⤵
  PID:10000
- C:\Windows\System\MQJQNUD.exe
  C:\Windows\System\MQJQNUD.exe
  2⤵
  PID:9804
- C:\Windows\System\PFJDyHl.exe
  C:\Windows\System\PFJDyHl.exe
  2⤵
  PID:8360
- C:\Windows\System\bWduCPR.exe
  C:\Windows\System\bWduCPR.exe
  2⤵
  PID:11700
- C:\Windows\System\YQxTZfN.exe
  C:\Windows\System\YQxTZfN.exe
  2⤵
  PID:8968
- C:\Windows\System\xMMwnGH.exe
  C:\Windows\System\xMMwnGH.exe
  2⤵
  PID:7336
- C:\Windows\System\oAoyvPB.exe
  C:\Windows\System\oAoyvPB.exe
  2⤵
  PID:8380
- C:\Windows\System\TzrwNFt.exe
  C:\Windows\System\TzrwNFt.exe
  2⤵
  PID:9380
- C:\Windows\System\AfRIuIR.exe
  C:\Windows\System\AfRIuIR.exe
  2⤵
  PID:10712
- C:\Windows\System\CIQZOHB.exe
  C:\Windows\System\CIQZOHB.exe
  2⤵
  PID:11152
- C:\Windows\System\wLOUtfh.exe
  C:\Windows\System\wLOUtfh.exe
  2⤵
  PID:11536
- C:\Windows\System\iAFBOTg.exe
  C:\Windows\System\iAFBOTg.exe
  2⤵
  PID:11380
- C:\Windows\System\tBIQZta.exe
  C:\Windows\System\tBIQZta.exe
  2⤵
  PID:11488
- C:\Windows\System\pUMpEWd.exe
  C:\Windows\System\pUMpEWd.exe
  2⤵
  PID:5720
- C:\Windows\System\MJPpuZr.exe
  C:\Windows\System\MJPpuZr.exe
  2⤵
  PID:12684
- C:\Windows\System\TrYkKOd.exe
  C:\Windows\System\TrYkKOd.exe
  2⤵
  PID:12076
- C:\Windows\System\drSHpwK.exe
  C:\Windows\System\drSHpwK.exe
  2⤵
  PID:12552
- C:\Windows\System\ETIAAyE.exe
  C:\Windows\System\ETIAAyE.exe
  2⤵
  PID:12428
- C:\Windows\System\ckKxCVa.exe
  C:\Windows\System\ckKxCVa.exe
  2⤵
  PID:10708
- C:\Windows\System\VrovAKI.exe
  C:\Windows\System\VrovAKI.exe
  2⤵
  PID:11728
- C:\Windows\System\WrgGKjg.exe
  C:\Windows\System\WrgGKjg.exe
  2⤵
  PID:13012
- C:\Windows\System\zWCFJEz.exe
  C:\Windows\System\zWCFJEz.exe
  2⤵
  PID:11612
- C:\Windows\System\DftUuWd.exe
  C:\Windows\System\DftUuWd.exe
  2⤵
  PID:12832
- C:\Windows\System\JvTcDZf.exe
  C:\Windows\System\JvTcDZf.exe
  2⤵
  PID:11232
- C:\Windows\System\kCmYLfR.exe
  C:\Windows\System\kCmYLfR.exe
  2⤵
  PID:5600
- C:\Windows\System\lNpipJw.exe
  C:\Windows\System\lNpipJw.exe
  2⤵
  PID:11664
- C:\Windows\System\mjidqvP.exe
  C:\Windows\System\mjidqvP.exe
  2⤵
  PID:10136
- C:\Windows\System\jrkPVgc.exe
  C:\Windows\System\jrkPVgc.exe
  2⤵
  PID:11212
- C:\Windows\System\blnYhBk.exe
  C:\Windows\System\blnYhBk.exe
  2⤵
  PID:12232
- C:\Windows\System\gBHGMqw.exe
  C:\Windows\System\gBHGMqw.exe
  2⤵
  PID:4316
- C:\Windows\System\YyFjEKU.exe
  C:\Windows\System\YyFjEKU.exe
  2⤵
  PID:12952
- C:\Windows\System\dFFqkLL.exe
  C:\Windows\System\dFFqkLL.exe
  2⤵
  PID:12388
- C:\Windows\System\xgiOHjm.exe
  C:\Windows\System\xgiOHjm.exe
  2⤵
  PID:12272
- C:\Windows\System\PNDezTb.exe
  C:\Windows\System\PNDezTb.exe
  2⤵
  PID:10660
- C:\Windows\System\ShwmRKe.exe
  C:\Windows\System\ShwmRKe.exe
  2⤵
  PID:12052
- C:\Windows\System\RmMszeO.exe
  C:\Windows\System\RmMszeO.exe
  2⤵
  PID:10860
- C:\Windows\System\PPrieDu.exe
  C:\Windows\System\PPrieDu.exe
  2⤵
  PID:11448
- C:\Windows\System\lEeNSIb.exe
  C:\Windows\System\lEeNSIb.exe
  2⤵
  PID:6748
- C:\Windows\System\XTMNntC.exe
  C:\Windows\System\XTMNntC.exe
  2⤵
  PID:6600
- C:\Windows\System\LSEkXRt.exe
  C:\Windows\System\LSEkXRt.exe
  2⤵
  PID:13328
- C:\Windows\System\iEEBDWU.exe
  C:\Windows\System\iEEBDWU.exe
  2⤵
  PID:13636
- C:\Windows\System\IliWdId.exe
  C:\Windows\System\IliWdId.exe
  2⤵
  PID:13828
- C:\Windows\System\UOfxZNA.exe
  C:\Windows\System\UOfxZNA.exe
  2⤵
  PID:13848
- C:\Windows\System\erPEQxo.exe
  C:\Windows\System\erPEQxo.exe
  2⤵
  PID:13876
- C:\Windows\System\sORRnaN.exe
  C:\Windows\System\sORRnaN.exe
  2⤵
  PID:13900
- C:\Windows\System\MYjmYfo.exe
  C:\Windows\System\MYjmYfo.exe
  2⤵
  PID:13920
- C:\Windows\System\uphWNDA.exe
  C:\Windows\System\uphWNDA.exe
  2⤵
  PID:13944
- C:\Windows\System\hBipsEA.exe
  C:\Windows\System\hBipsEA.exe
  2⤵
  PID:13972
- C:\Windows\System\fWhUaET.exe
  C:\Windows\System\fWhUaET.exe
  2⤵
  PID:13992
- C:\Windows\System\mOZIsXk.exe
  C:\Windows\System\mOZIsXk.exe
  2⤵
  PID:14016
- C:\Windows\System\sxwYMoi.exe
  C:\Windows\System\sxwYMoi.exe
  2⤵
  PID:14032
- C:\Windows\System\SsnVzwc.exe
  C:\Windows\System\SsnVzwc.exe
  2⤵
  PID:14056
- C:\Windows\System\EvuUzXI.exe
  C:\Windows\System\EvuUzXI.exe
  2⤵
  PID:14076
- C:\Windows\System\SVADyeQ.exe
  C:\Windows\System\SVADyeQ.exe
  2⤵
  PID:14100
- C:\Windows\System\xgcFMDk.exe
  C:\Windows\System\xgcFMDk.exe
  2⤵
  PID:14120
- C:\Windows\System\MymWkhI.exe
  C:\Windows\System\MymWkhI.exe
  2⤵
  PID:14144
- C:\Windows\System\xFHeCPd.exe
  C:\Windows\System\xFHeCPd.exe
  2⤵
  PID:14168
- C:\Windows\System\pBhLdNp.exe
  C:\Windows\System\pBhLdNp.exe
  2⤵
  PID:14192
- C:\Windows\System\KNrXxjU.exe
  C:\Windows\System\KNrXxjU.exe
  2⤵
  PID:14216
- C:\Windows\System\WImGJED.exe
  C:\Windows\System\WImGJED.exe
  2⤵
  PID:14236
- C:\Windows\System\ZgXsSEq.exe
  C:\Windows\System\ZgXsSEq.exe
  2⤵
  PID:14260
- C:\Windows\System\RHhPKzr.exe
  C:\Windows\System\RHhPKzr.exe
  2⤵
  PID:14280
- C:\Windows\System\tfATnwG.exe
  C:\Windows\System\tfATnwG.exe
  2⤵
  PID:14300
- C:\Windows\System\IDMhblS.exe
  C:\Windows\System\IDMhblS.exe
  2⤵
  PID:14324
- C:\Windows\System\zkytRee.exe
  C:\Windows\System\zkytRee.exe
  2⤵
  PID:11084
- C:\Windows\System\Zcfzrlf.exe
  C:\Windows\System\Zcfzrlf.exe
  2⤵
  PID:9504
- C:\Windows\System\TrMoXXG.exe
  C:\Windows\System\TrMoXXG.exe
  2⤵
  PID:12900
- C:\Windows\System\tRketeL.exe
  C:\Windows\System\tRketeL.exe
  2⤵
  PID:11900
- C:\Windows\System\XuIXAJk.exe
  C:\Windows\System\XuIXAJk.exe
  2⤵
  PID:8264
- C:\Windows\System\azkJLZJ.exe
  C:\Windows\System\azkJLZJ.exe
  2⤵
  PID:12264
- C:\Windows\System\ciaqJlB.exe
  C:\Windows\System\ciaqJlB.exe
  2⤵
  PID:11492
- C:\Windows\System\rHqHKHV.exe
  C:\Windows\System\rHqHKHV.exe
  2⤵
  PID:13512
- C:\Windows\System\XHiXCwl.exe
  C:\Windows\System\XHiXCwl.exe
  2⤵
  PID:13544
- C:\Windows\System\selCGso.exe
  C:\Windows\System\selCGso.exe
  2⤵
  PID:13676
- C:\Windows\System\ipNcMdz.exe
  C:\Windows\System\ipNcMdz.exe
  2⤵
  PID:13644
- C:\Windows\System\qjCYrLz.exe
  C:\Windows\System\qjCYrLz.exe
  2⤵
  PID:13884
- C:\Windows\System\whvlwvf.exe
  C:\Windows\System\whvlwvf.exe
  2⤵
  PID:13836
- C:\Windows\System\ZbAdawf.exe
  C:\Windows\System\ZbAdawf.exe
  2⤵
  PID:13720
- C:\Windows\System\wwRHTFq.exe
  C:\Windows\System\wwRHTFq.exe
  2⤵
  PID:14024
- C:\Windows\System\gXnQmND.exe
  C:\Windows\System\gXnQmND.exe
  2⤵
  PID:14296
- C:\Windows\System\pVDFbGi.exe
  C:\Windows\System\pVDFbGi.exe
  2⤵
  PID:6060
- C:\Windows\System\COJqyQa.exe
  C:\Windows\System\COJqyQa.exe
  2⤵
  PID:10532
- C:\Windows\System\kCHamgH.exe
  C:\Windows\System\kCHamgH.exe
  2⤵
  PID:11752
- C:\Windows\System\aXeHOAo.exe
  C:\Windows\System\aXeHOAo.exe
  2⤵
  PID:13392
- C:\Windows\System\kmZOwnZ.exe
  C:\Windows\System\kmZOwnZ.exe
  2⤵
  PID:13452
- C:\Windows\System\lPFipaT.exe
  C:\Windows\System\lPFipaT.exe
  2⤵
  PID:13488
- C:\Windows\System\cGsLxUA.exe
  C:\Windows\System\cGsLxUA.exe
  2⤵
  PID:13508
- C:\Windows\System\SlmDaAU.exe
  C:\Windows\System\SlmDaAU.exe
  2⤵
  PID:13556
- C:\Windows\System\CGLooxG.exe
  C:\Windows\System\CGLooxG.exe
  2⤵
  PID:13612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lfsyoft3.k4f.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AAVfXGS.exe

Filesize
1.7MB

MD5
430dc6beba0a9c57acec6afeefd5f627

SHA1
d6bc7a902281dd903aefe54bc41adc05ad4918dc

SHA256
ac1f6366c62aaeb0cdaf54d5ff40f56f40cb0fbcb77ccd3a524243105fffc8cf

SHA512
8cca99faa277d48574fa7798f9b70df54739abc7029ccebfc63701185fd5269f1231743327447e134348631b22db5a6305b35c71ede67e1f6879eb32c16d7bd4

Download Submit
C:\Windows\System\BQwLTdY.exe

Filesize
1.7MB

MD5
933901f221aad3b8fb7290220d317652

SHA1
72f20960957a26a512b620a5dc4b6d67b7791959

SHA256
71c99fa8767e7b40c3eaf185e57250049b1b95d428f6244468fc1a12117c3bc6

SHA512
2e5348cc9190e96befe3f92c4d887e072f6e23ecdfa2125f671ec5b332ed541cb3fab605f84457e90059695977f54449e9d55dc7a5a22048a3230e13bb3e1a8b

Download Submit
C:\Windows\System\BwQPxrN.exe

Filesize
1.7MB

MD5
5230334ffabd2e9b4401ecfb91b5db6a

SHA1
1efcc0179bde162b8b5df539e0092e6a9c67218b

SHA256
384b2baf5bc315c2b05be50e227baa4371c31fb7515d394a029476ab054d434b

SHA512
6fd2f25023f53974ed95cdcc76dbe45c813abeaf4d70d4843f43dc5f8451c1ed53174ed2b0b3fb1be71cbd95bf4c27f7ea6dd14e306eeae4f0e294eb672c68c4

Download Submit
C:\Windows\System\CxGfbxX.exe

Filesize
1.7MB

MD5
80b0811b5d32ceb217d0424bdb0c5e0d

SHA1
ce559acf276c95f8b3464c997caf7633b346e412

SHA256
ac54e456b3cd0e96692faa00f4da54243be281ddd54f5e7b0b316fb2c8d85a60

SHA512
5aa08dd7a23ced24b7b3b9987273102578e2b3017edb4e203f0e7af57507c715ba0de4c7cfb16bf2bb2498845b145d5073d514e7e3f4d64ce35d5be7b941ea9c

Download Submit
C:\Windows\System\DuzQmXC.exe

Filesize
1.7MB

MD5
6b3efc438e98f6ac2eca1bf05a15314a

SHA1
135d1b0559e498033160e68738d0a1d728da900a

SHA256
57b796b3a5e7c46e6344cca1208f674d66690072f433d22d8b0eea41db6650a0

SHA512
6050326de672e9f64a51d84dd1c1b84694625c14e7dbe2195568475c0a1555c4b4718961db9e40a1751fb779367ea4fe7b7c68df4ef698b7d58c5cba9b8ef5ad

Download Submit
C:\Windows\System\EAiqExG.exe

Filesize
1.7MB

MD5
3a06e7046581437eb19f22783751fbc7

SHA1
9e6fba710ab7c832d8b5477ddfddbce5ab9ab469

SHA256
27e14d56081fbbc623d8ee5631944b055154431912dd15dfb670275712101d10

SHA512
470379cd1f2b39f68684eacaa68a5f5748604a7380dd4aa8f89cec060e97230d6d303aafdad4a0dab17ce5d86c2b03d0ddbd60bbf22737aa12172f28fbcd180d

Download Submit
C:\Windows\System\FIiEYDQ.exe

Filesize
1.7MB

MD5
222f8e2162b7276a165feed943f59489

SHA1
9d40fb35e79076f4781234adaa86d4211f22f238

SHA256
98ae44026365aac4b48632f8200e13a9a61b3ee41e8372a7fd4631487d8e6f84

SHA512
6c8f5c90ac852441a3210d50ca6f8dfc05a9d6784340c86784b178056986f667bbb12318a3af7d2417b6e0854ddb9a72abed1b51701310ec1931577602914856

Download Submit
C:\Windows\System\FartTTx.exe

Filesize
1.7MB

MD5
28bb11d9814c2896db30716c10ff210f

SHA1
9c8e41b5774326ab3ef9cc7294874273c31b16e8

SHA256
e94cefc549ffce4529696ba6d55678682ab006abb6e93a5706a31e2d726e8a1e

SHA512
b01e9f323a9e5be4fcd934634b141fbcbdadf2e887a74a9bbb57457c3906df80cda500668e1ae6fa436f69be8a678a9752356799ba08745648a8e2213a757f7f

Download Submit
C:\Windows\System\GNxTWzb.exe

Filesize
1.7MB

MD5
de8af577bc475ca119412bea26460b1a

SHA1
e095006abb161f728ed012f355e3734328a28d1e

SHA256
02358281c19aab26cba6c49e6bdc309d2a150dbbb81ac1ee9e360fbd4b8a8f50

SHA512
8a9b04e29c3bb15f7830636b8acbd95e420dadbd41840022e472dc6e3792630b50419fe4fb0b6d0a2313f2773f00e14da1acb68c4519e8104c317073d40fa80d

Download Submit
C:\Windows\System\HqHipDK.exe

Filesize
1.7MB

MD5
4fa9cead66be44a04bb4cad00826f5c5

SHA1
b4d7b56ef98cde05541dafc26f71af37e079bf73

SHA256
23cb14d42a4625265f11558ff0b360f5f176dfc204aa817bb6786d6749801761

SHA512
5ece76400f460e819e2c0e589017050ebc092402ee9287109cbd3697b0b8dd4836361ae6d066a1896c4f4717aed5afe3288e7e51b4b0426949187bc076bc3bd0

Download Submit
C:\Windows\System\HzNGuFf.exe

Filesize
1.7MB

MD5
df2bd9a3b5555ac31e4df2231f97f537

SHA1
c86472a131c066a920eafdc3c4a11a1bbcca7d91

SHA256
497c409af2ec91859925afc2051415dc22191aea10f806606875dd97d5ba620d

SHA512
07d25a5cee92ec06525111e4d532819dc5c8bf5216b036ce6ddcc42e452a7aada0471246a3e44919cca4d410f7856712fccc8fc940052f25585c09b6cbd8d704

Download Submit
C:\Windows\System\JMSTqJr.exe

Filesize
1.7MB

MD5
2a58569488fd5b78748e419dab7a315b

SHA1
780f570880515c35118f1f0b121e050d62704564

SHA256
2c94e48241c1b30795c2edac8d71dbbb272a710981970e6a1ceace612af6e5fb

SHA512
171ad2364e8bb7dfb23de89ca2961434552a7b7e995fb35413c031e67d8a524bcb0f2656b8e9aabc759883ac0bc5d6452a0e67c701a570c3158f99c88ec3268f

Download Submit
C:\Windows\System\JMasAwO.exe

Filesize
1.7MB

MD5
5179b7cc96e77e15e9cce5ba6eae0a22

SHA1
cbf2600219206963eb15afe38c9bb343af292719

SHA256
abfa713782fa58a53eb5227169c6d871d26a6eebb1401f4a4886a44907801330

SHA512
7cba949f55cd575914cb44f69b34d4bad2ed41be30bc5ab535d48b6e663020c27aebece8e57fdb49da1e61ef2c6871acec884f71aeea805af6b7b8c42950a2d3

Download Submit
C:\Windows\System\JRtOLWy.exe

Filesize
1.7MB

MD5
314cbd29ba02e49231ef3810334cc984

SHA1
93a8d3ac904738a66b64339715637c1fa0e9aa83

SHA256
b957c4ee6597b4159e88e264d4927df2ed6665075001d602f39267018f3d2061

SHA512
6761c409884f75853157686651926e36babf1ddc22f73ca9a3007a6f9c64f3cf2f31653fc440c57e34e4dd3b099229339a1514371fdabf4217b47699fd7cf5f6

Download Submit
C:\Windows\System\JezKAwb.exe

Filesize
8B

MD5
9eed4b82804b22673b9dfb873b8ab9ce

SHA1
f21d2bfa2371f1463e1292b73e9e08fa34f0575c

SHA256
5d32e2c5476ec99d6a8b9b32ce8fc3dcfc70c43e01cda6d539f1537b352bc821

SHA512
dca73626047a6804b6db7d36b94c16cbc3aa085940e12b1d982bf2f2f9d835da5216fd8f6b7487a1c5fafdc4aff759eb74fe90083f9b59b79152dd8179f2bc5b

Download Submit
C:\Windows\System\LLkfQcb.exe

Filesize
1.7MB

MD5
a618ebdbda954949930f87428181d3a0

SHA1
d4f355c56fc3c3e07783cf0ec5892ca30b0987d5

SHA256
bd0cca95d702dfa925aef11f9fa59ba72d1b5b1a4297bf81cca8654fbf13ff09

SHA512
190b43dd8423d0c661b6866cb786bd3078c11453ae67bf080fdfe52409779a2d33c055f5ffa4b16af4b8f861a2754f5b3bbbe49262f292bdfa28e8fc9695c431

Download Submit
C:\Windows\System\MeZPykB.exe

Filesize
1.7MB

MD5
a4092f2cd2d88d55188c3c997592747b

SHA1
c5c8fdacc39e1462c4367f924d79fd14c8622307

SHA256
d50891160152c8c5ebb2ed7bdd9de5821d81769057c496d0eef84508d7dd7137

SHA512
907c7e4e8c2d2d2ef2b1ec611693faf546ce04b4be21ce94e1356b26bc608e5d64f0ff5c12c79b5c6794558580baa99ee1e64feedaa2177324429ca6f2b581a7

Download Submit
C:\Windows\System\OFMkIww.exe

Filesize
1.7MB

MD5
484bb2934f9838cb188be24afd52ebad

SHA1
16b99b01b0b26d5bac62437985de78900c6b8fbb

SHA256
398978bf35a59b655d47ff72c05c1fdd2cfb93fe56c61ae74590e99f7d61881a

SHA512
2aebff4e60ae1526e34a48274798f319152354e91a5b5d96663a49735e65ad94b5cda492001bee948a4dea727e31b81868f1b08ef86112ba7ec6e02bb2727755

Download Submit
C:\Windows\System\OJQrOKH.exe

Filesize
1.7MB

MD5
fc061e7a04dbeff3ea7ce32e0ff6671a

SHA1
32f33cab84c0e869b5832fc185a6b8402b8d1161

SHA256
7884b8ed50eed6cb5e3bb833d6f5f2af9d7425fc5eacc575b5f75afc7b13d133

SHA512
1d22c8b9a8b1ec464509133ed4102e7aa1af43aa6993c13123ad6c96a34159ba998143893bd0a972a563982b320841ac237bb02c22b0f1e4c6b419476c0f1b90

Download Submit
C:\Windows\System\OyrBxvs.exe

Filesize
1.7MB

MD5
65f317818192d77321e986f179fb8eb4

SHA1
0e0a8dd088b05c69a7ea7ae0360184da6eccd0e4

SHA256
bb3b2a7f91985e4d30c6955fdd22f9ab3e54c21b08184729bc4726b11941cf48

SHA512
979f74d702131a65b16e9380e036052f920cf1b3bab6934533302784678e4c1fa425b9cc5846d7e4dd3ce45d847ebc1052c24d6d07a0b5fecc9f58bcec3e0cde

Download Submit
C:\Windows\System\QFXlhtN.exe

Filesize
1.7MB

MD5
88915733b5761fc9fbdea74667c7ad5e

SHA1
bf3b5032cb82de10db6a3cff154cbea198f9bf36

SHA256
d665eb1c8854da77e68fa4491a56ae5dbe66d3e71dd044903599c06a8acc0465

SHA512
aaf677fb0d06e2a77901a1d72d2199d9bbc016a2df8b00bc36a443480c612898bf74dfcebb83a17616d493cdc3b7e326290e671601db6de2cc1fc522a900201d

Download Submit
C:\Windows\System\RaHppcO.exe

Filesize
1.7MB

MD5
dd3385dff6bdf18af7ce607a85e206da

SHA1
848a459b502d20d38335b777942ca018739638eb

SHA256
f718b7b31a194de3d4aa81fd99ec7de74e1729b76aa2c05982513ca5ec6f10ec

SHA512
5bb358d98f9320457e7c8beb53292c5e24428e8d947babed3c10f2b857026374fe3fbab5a9fb7a1b9e366cb953924c100d95e84298d03f4dc511423d51ac6a35

Download Submit
C:\Windows\System\UeAlyRf.exe

Filesize
1.7MB

MD5
531859e964ac2e0ef86aeec1f0106555

SHA1
2359bbf942016a6d13dca870fd6d856edd6c55c1

SHA256
45b06ced4c00e99701d716b1a0586fe247c8db7fda3c2a9bd1bfc192253a1270

SHA512
7acff9fa5270c58e0475e4b62db182059ddac64e306682ce40cb25b9dd0a4de1ab429aa35bdf29fc7d2bb079568962065be9dd1e09d1e18fd6fc782cc2163433

Download Submit
C:\Windows\System\WLSnthl.exe

Filesize
1.7MB

MD5
b9d9ff8b6eac9b7fb2fb4d1f3bc2d5c3

SHA1
a0034632d8fca611efdd0a6d51ce73e3225bdd7e

SHA256
bb7bf177f65c1875353b546cff566a4916fa0fe163deb20e2a65848b3115dc2a

SHA512
db5d302646137a49c0906627deb122427ff6f4f0bec562bca2e39962d694b636790c253ac0c51ade924db658cbab2c5349ad4f3b62331d64130b2585f51e8cf8

Download Submit
C:\Windows\System\WNLvTvd.exe

Filesize
1.7MB

MD5
201b501ced85672cae52aa6fa083a779

SHA1
ebc4692636c627032e3c9ba1f07b105fd6eca6b1

SHA256
da415c11611ac91c45ddff6bbe3858bdbbcb7cc83e376fb689c52b1e278f9b94

SHA512
3881b1246c6cf366487ab5c9fd7c86cbefc7b6fee23107e33f32ac0f2ee5cbc7ca367096ce298e8dad4acd8737dc21f6c7a206faaf83dde919795ae1cfba853f

Download Submit
C:\Windows\System\WTqEAwj.exe

Filesize
1.7MB

MD5
46213a012ca6fe8640dbcc151e70fd8b

SHA1
28fb1853c1f5d294b1764524742ed804ed2881ff

SHA256
f30497607a20c838376a9be36d3f6381048a2e4d269872f806ab6941b1d3c2ab

SHA512
60cad6f55c38ff1647711c9ac55dc64b644ea7325fb30ec1a470dbe58a963846b60cdceebac1c9df962af1c170e962a6b00272543e2dfbe50af2fdf9f5a7d9be

Download Submit
C:\Windows\System\ZPAdepO.exe

Filesize
1.7MB

MD5
447e7c912c59713a07011e83b5d282c2

SHA1
3a85ea025da4f668175a357e3ee7f903bcecb21b

SHA256
fb567712c17bea01483011bf9f8dddd50d6322f996865072c3e45f82b63a42ed

SHA512
65615cb9b49319b94e0eba8054c834b4c33dee07b97cbdab657cea0e57bf569cb865a6da89b83a4dd3de305cbe59c658390fed25531634df2ee7174ee1ca8c9a

Download Submit
C:\Windows\System\efsxYDB.exe

Filesize
1.7MB

MD5
d69dbaf783be8e3a854175cc237ea223

SHA1
384f62dfbc2ddc27207de821c77ef65b40818ea8

SHA256
16e33b14e1a3058f6a2620230bd2c363a1eae1cb1e07747d5dfca284e58ac08e

SHA512
92097dbddd9aa8a2624d0c6ca557d84c1b0d1ead96bf711a975e06aa83e4d5de954a34bf92c9b780e021f9fe65926f0bafc3ba20794c60ecb967b3c5d73ef82f

Download Submit
C:\Windows\System\fFLieaE.exe

Filesize
1.7MB

MD5
79101ef9ed814eb1972c0699040183a7

SHA1
53967a05296358f345711315923ddf9971618cea

SHA256
98310ddc0f85f9804340e1721739f8d86de9a3dffd595b75253228f9c16d3d22

SHA512
d95226d7ff21a79c143441d3cc7e2f278423d697bb71e9927e5ff9472f3e44f205446bc5206cead22cafdc610493acbd8b3e332fba5d3b7e8d9370e931cd7f65

Download Submit
C:\Windows\System\fLDVIhD.exe

Filesize
1.7MB

MD5
4d5a647e0dae07e5d0da03163e1d70fa

SHA1
9f2447e21d10dac0d108e3b2489c25df2c1136ef

SHA256
2753e2334b944abf76db8535db4e2ca7ac8c114e630f8c43c184b05ccd2b8da3

SHA512
3b2be1814a42534852b5603e2bc12929939b561d0fb02e4c23d59ad466fb2dfadcad4c1bdfce3ff411a75c92281167167f07402e2c3603fb888ffb9f7a85303e

Download Submit
C:\Windows\System\hapveDF.exe

Filesize
1.7MB

MD5
e1a9c09245ec8f1761adc01932e49344

SHA1
61c8615489650255d9b0b16ebd2f489c19562ea3

SHA256
9a71dc62bfbabf6620360440a1bac65f98fe2a5f9e554d6f045b9ef84a8fbf0f

SHA512
1b8317ef4db6355079aa3045e8f59caa4e7901417f508af582cfefb22800e10d1b0a408936a342e778f0374326af05ecd51f70889d7db91cdb3f75ac54a1e060

Download Submit
C:\Windows\System\inIbaiZ.exe

Filesize
1.7MB

MD5
0a9f3642e4e2c1e3bec33d20e94b6133

SHA1
3d8d98220cfa07aa283a4260f266ad2eb39ce236

SHA256
9d519b77c5acd44ac9cc876bad7a71c972a64b2b8214b41a63061090994f2dff

SHA512
e4f49475f5090fa91a8870a9464a468c38b8a7427216569564b81779b708a42a7ce9babff4d20630ef2b4df91b2d8f0d8644ab4092fc0bd9bba2e4600eb0e092

Download Submit
C:\Windows\System\poRlKfG.exe

Filesize
1.7MB

MD5
ef36180547411ceabec8566ec5ccb01c

SHA1
8e41780d727fcabcda445010a81b59df4c4e0282

SHA256
c9885d50abf6d4a33adaba9baf3a980d14260eef8439197d2538eee00d7e882d

SHA512
cf1c9def277825f55d451fb6c5cc9600b7b506d0fcc05dfc4567bfdfcff7ed75c2a615a89c33992ecf08afee0fb3cf30379feaa02bc448eff4a24de931352d28

Download Submit
C:\Windows\System\qCDNduY.exe

Filesize
1.7MB

MD5
c121a0e655c1ec17623d4fda8ddad47e

SHA1
6e58aa21364b5542432e722de78572f1e1e66f49

SHA256
af0442f574cafa7cada292ec3436adeec264560b977d89e381a0ef0d5cd15e04

SHA512
79fe25a526df75312ba1caa3194f98e8b5d6ae33c5ed067401ff3a8e8414bf9c1ad2f42bed1d55781e1b80fb6250152cb15eac2e2eb73686d4045cba47edce3b

Download Submit
C:\Windows\System\qIhGjvC.exe

Filesize
1.7MB

MD5
c6cad9843333881b5ea88218b7ab7ab9

SHA1
37877354e626e0be629facb86ca007053da4080c

SHA256
b8540ecfd1f3d2523d0c42abac0765be7505dac91339a27065ec652c990f718e

SHA512
65b4750e56a9c0257143ba2b0669a81b6b898c8c75c0e1e26a0a2928699fc235148d4c29e27142ffa8230f842e337e430df11e9316b08e1185c90067d765946b

Download Submit
C:\Windows\System\rSgeDkp.exe

Filesize
1.7MB

MD5
cb762b352322dbea0ed27a717be70b8e

SHA1
aa8234c4ef41fffd1997f2fbb042ba05a9cd596c

SHA256
ad2cb8e6c213e5e9a4582d8dba5d788259a6684062020ba5adc7385c982be317

SHA512
862aa461cc9aaaf08be35adb161c4d03b6efb9dbb6053032651d8b274629c06c744bea64326603c8ce497762ea8944b9094e6da7712af2b1ed1e117f07adc826

Download Submit
C:\Windows\System\rjCiWxl.exe

Filesize
1.7MB

MD5
91b474f3147733b832741556f9c75136

SHA1
02b09569b4366cd3c32cfc4207f816d9bdc29527

SHA256
4eda7badee90dade85e75843ce4265bf641c2454d95d383d7832e244eebc3c17

SHA512
42dcffb53881035c75e91b90c61133032d1fe68dd9b96066ac0bb413bf1987bf69c6f185be8d1bdead72321c74ec2a7655f632032aaa35be3264785c7442be42

Download Submit
C:\Windows\System\wOQXIeQ.exe

Filesize
1.7MB

MD5
e3eced89c4ac9f92d391539b7ee2e0a1

SHA1
52a02b4c128485acbf6ad4807e77d3dd0806bbd2

SHA256
7ccb8748d6ba65f542c78f44f29577e104e5203b82fe9c9bbc300f7651485db6

SHA512
cd4e1d8a37abf7df3b3e026c99b21c149a290cac4651eeafe36838f7cbbd4ac2071fe3c9e041c95f2ebb5ff8adeedc1914ca9b59edaf87f68c78086e9ecdc3a7

Download Submit
C:\Windows\System\xDQiTJv.exe

Filesize
1.7MB

MD5
6f92c0c998bec8dc465a87b9eaa41954

SHA1
02c8ebe9126b5b75a6ce9bb848fde3ade6d75afc

SHA256
9c8588b483502b91a6641f8b7a4e7490beba85137e4706b707c42dd6c1dce6e6

SHA512
5a36e7dc33702c74e37505beff12c31667a56d605b17115585f3bbb533f6e0eb3288bc5a61e8cef62d4090b6085cb750bc812814f177b518933b36d39233c2a3

Download Submit
C:\Windows\System\xIDLZNU.exe

Filesize
1.7MB

MD5
c6aea6c6374f4149bbff514513bf6958

SHA1
4bb2f131974030e32b28eb8c26664903047ba208

SHA256
eaf7d597d075f1d061092c0db9785dda3e91dc7d6965436f28498a12476174ff

SHA512
302cbe52f64c2f266a7c8c09ae3d8b536432cdedb5786cd2ff17957d102b24562dfdac54341b42de6460b8e0afdb4bc080f2b94adcae7efb9062588309b18d72

Download Submit
C:\Windows\System\zadeDpn.exe

Filesize
1.7MB

MD5
108f8dfbc936ee7253b286117ad15084

SHA1
d56fad0ba65d097aff577a8126f3fc83d46a6e50

SHA256
4324064cd4695254255108d07289863ad44d94985759677304f3dea3f6401e35

SHA512
3063fbfa6b680bb7fd7929b64a4cf9fa6787b01175c3a7a794383a3ea749e993496bccd9a8a4a87743a8c9386a9807e3fdb8a3ad4b091f43e7f1845abafb0693

Download Submit
memory/400-4638-0x00007FF73B710000-0x00007FF73BB02000-memory.dmp

Filesize
3.9MB

Download
memory/400-398-0x00007FF73B710000-0x00007FF73BB02000-memory.dmp

Filesize
3.9MB

Download
memory/404-2190-0x00007FFD30850000-0x00007FFD31311000-memory.dmp

Filesize
10.8MB

Download
memory/404-249-0x0000026EA8850000-0x0000026EA8872000-memory.dmp

Filesize
136KB

Download
memory/404-25-0x00007FFD30853000-0x00007FFD30855000-memory.dmp

Filesize
8KB

Download
memory/404-396-0x00007FFD30850000-0x00007FFD31311000-memory.dmp

Filesize
10.8MB

Download
memory/404-90-0x00007FFD30850000-0x00007FFD31311000-memory.dmp

Filesize
10.8MB

Download
memory/536-0-0x00007FF62CD80000-0x00007FF62D172000-memory.dmp

Filesize
3.9MB

Download
memory/536-1-0x0000020276DA0000-0x0000020276DB0000-memory.dmp

Filesize
64KB

Download
memory/660-313-0x00007FF632340000-0x00007FF632732000-memory.dmp

Filesize
3.9MB

Download
memory/660-4641-0x00007FF632340000-0x00007FF632732000-memory.dmp

Filesize
3.9MB

Download
memory/720-237-0x00007FF6EC720000-0x00007FF6ECB12000-memory.dmp

Filesize
3.9MB

Download
memory/720-4656-0x00007FF6EC720000-0x00007FF6ECB12000-memory.dmp

Filesize
3.9MB

Download
memory/852-4632-0x00007FF7609C0000-0x00007FF760DB2000-memory.dmp

Filesize
3.9MB

Download
memory/852-117-0x00007FF7609C0000-0x00007FF760DB2000-memory.dmp

Filesize
3.9MB

Download
memory/1008-4651-0x00007FF7D4BD0000-0x00007FF7D4FC2000-memory.dmp

Filesize
3.9MB

Download
memory/1008-392-0x00007FF7D4BD0000-0x00007FF7D4FC2000-memory.dmp

Filesize
3.9MB

Download
memory/1104-4664-0x00007FF619630000-0x00007FF619A22000-memory.dmp

Filesize
3.9MB

Download
memory/1104-304-0x00007FF619630000-0x00007FF619A22000-memory.dmp

Filesize
3.9MB

Download
memory/1436-4660-0x00007FF707A50000-0x00007FF707E42000-memory.dmp

Filesize
3.9MB

Download
memory/1436-393-0x00007FF707A50000-0x00007FF707E42000-memory.dmp

Filesize
3.9MB

Download
memory/2068-390-0x00007FF6A2F50000-0x00007FF6A3342000-memory.dmp

Filesize
3.9MB

Download
memory/2068-4673-0x00007FF6A2F50000-0x00007FF6A3342000-memory.dmp

Filesize
3.9MB

Download
memory/2308-4655-0x00007FF73F550000-0x00007FF73F942000-memory.dmp

Filesize
3.9MB

Download
memory/2308-268-0x00007FF73F550000-0x00007FF73F942000-memory.dmp

Filesize
3.9MB

Download
memory/3300-391-0x00007FF6E3EA0000-0x00007FF6E4292000-memory.dmp

Filesize
3.9MB

Download
memory/3300-4663-0x00007FF6E3EA0000-0x00007FF6E4292000-memory.dmp

Filesize
3.9MB

Download
memory/3356-4653-0x00007FF641AE0000-0x00007FF641ED2000-memory.dmp

Filesize
3.9MB

Download
memory/3356-389-0x00007FF641AE0000-0x00007FF641ED2000-memory.dmp

Filesize
3.9MB

Download
memory/4056-4636-0x00007FF64A2C0000-0x00007FF64A6B2000-memory.dmp

Filesize
3.9MB

Download
memory/4056-163-0x00007FF64A2C0000-0x00007FF64A6B2000-memory.dmp

Filesize
3.9MB

Download
memory/4188-397-0x00007FF6165A0000-0x00007FF616992000-memory.dmp

Filesize
3.9MB

Download
memory/4188-4630-0x00007FF6165A0000-0x00007FF616992000-memory.dmp

Filesize
3.9MB

Download
memory/4468-4676-0x00007FF6A50D0000-0x00007FF6A54C2000-memory.dmp

Filesize
3.9MB

Download
memory/4468-399-0x00007FF6A50D0000-0x00007FF6A54C2000-memory.dmp

Filesize
3.9MB

Download
memory/4492-4644-0x00007FF782630000-0x00007FF782A22000-memory.dmp

Filesize
3.9MB

Download
memory/4492-387-0x00007FF782630000-0x00007FF782A22000-memory.dmp

Filesize
3.9MB

Download
memory/4552-4648-0x00007FF6E3240000-0x00007FF6E3632000-memory.dmp

Filesize
3.9MB

Download
memory/4552-241-0x00007FF6E3240000-0x00007FF6E3632000-memory.dmp

Filesize
3.9MB

Download
memory/4752-157-0x00007FF712F00000-0x00007FF7132F2000-memory.dmp

Filesize
3.9MB

Download
memory/4752-4634-0x00007FF712F00000-0x00007FF7132F2000-memory.dmp

Filesize
3.9MB

Download
memory/4804-394-0x00007FF6E9920000-0x00007FF6E9D12000-memory.dmp

Filesize
3.9MB

Download
memory/4804-4681-0x00007FF6E9920000-0x00007FF6E9D12000-memory.dmp

Filesize
3.9MB

Download
memory/4820-4671-0x00007FF6A0A30000-0x00007FF6A0E22000-memory.dmp

Filesize
3.9MB

Download
memory/4820-388-0x00007FF6A0A30000-0x00007FF6A0E22000-memory.dmp

Filesize
3.9MB

Download
memory/4844-352-0x00007FF7B9E60000-0x00007FF7BA252000-memory.dmp

Filesize
3.9MB

Download
memory/4844-4643-0x00007FF7B9E60000-0x00007FF7BA252000-memory.dmp

Filesize
3.9MB

Download
memory/4852-4646-0x00007FF754410000-0x00007FF754802000-memory.dmp

Filesize
3.9MB

Download
memory/4852-201-0x00007FF754410000-0x00007FF754802000-memory.dmp

Filesize
3.9MB

Download
memory/4988-395-0x00007FF7626D0000-0x00007FF762AC2000-memory.dmp

Filesize
3.9MB

Download
memory/4988-4679-0x00007FF7626D0000-0x00007FF762AC2000-memory.dmp

Filesize
3.9MB

Download
memory/5004-24-0x00007FF7172B0000-0x00007FF7176A2000-memory.dmp

Filesize
3.9MB

Download
memory/5004-4609-0x00007FF7172B0000-0x00007FF7176A2000-memory.dmp

Filesize
3.9MB

Download
memory/5004-4628-0x00007FF7172B0000-0x00007FF7176A2000-memory.dmp

Filesize
3.9MB

Download
memory/5008-4658-0x00007FF629070000-0x00007FF629462000-memory.dmp

Filesize
3.9MB

Download
memory/5008-386-0x00007FF629070000-0x00007FF629462000-memory.dmp

Filesize
3.9MB

Download