xmrig | 7fd541bf177027acb08b75bfb607d9c66b939727a2248f3f6fd36abe6234d21e

Analysis

max time kernel
64s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 20:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
Size

2.0MB
MD5

01a1fd33628089f84a08fc8e58e170a6
SHA1

ad5e49dde69895e3ad5f0b0989ec986bbd78da36
SHA256

7fd541bf177027acb08b75bfb607d9c66b939727a2248f3f6fd36abe6234d21e
SHA512

081f643fa1accfe80222dd8b56ba48c969e4724d7972c2658cd9df91fc2fa4c41251be8927a18058174c36262631325c5fe39037f1583522b24dfb3dedc48282
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1nfl:NABs

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 41 IoCs

miner

resource	yara_rule
behavioral2/memory/3272-328-0x00007FF6C2A60000-0x00007FF6C2E52000-memory.dmp	xmrig
behavioral2/memory/1564-383-0x00007FF6CE800000-0x00007FF6CEBF2000-memory.dmp	xmrig
behavioral2/memory/2316-435-0x00007FF697830000-0x00007FF697C22000-memory.dmp	xmrig
behavioral2/memory/2976-539-0x00007FF613DA0000-0x00007FF614192000-memory.dmp	xmrig
behavioral2/memory/2312-540-0x00007FF7B7E20000-0x00007FF7B8212000-memory.dmp	xmrig
behavioral2/memory/2020-538-0x00007FF7FC2C0000-0x00007FF7FC6B2000-memory.dmp	xmrig
behavioral2/memory/2200-537-0x00007FF6CE680000-0x00007FF6CEA72000-memory.dmp	xmrig
behavioral2/memory/2088-536-0x00007FF6B8E30000-0x00007FF6B9222000-memory.dmp	xmrig
behavioral2/memory/816-535-0x00007FF669D20000-0x00007FF66A112000-memory.dmp	xmrig
behavioral2/memory/3784-534-0x00007FF7DE930000-0x00007FF7DED22000-memory.dmp	xmrig
behavioral2/memory/1240-497-0x00007FF6363D0000-0x00007FF6367C2000-memory.dmp	xmrig
behavioral2/memory/468-282-0x00007FF7FA060000-0x00007FF7FA452000-memory.dmp	xmrig
behavioral2/memory/3344-288-0x00007FF79D540000-0x00007FF79D932000-memory.dmp	xmrig
behavioral2/memory/3616-240-0x00007FF6085B0000-0x00007FF6089A2000-memory.dmp	xmrig
behavioral2/memory/1088-205-0x00007FF68CAD0000-0x00007FF68CEC2000-memory.dmp	xmrig
behavioral2/memory/3868-177-0x00007FF6183A0000-0x00007FF618792000-memory.dmp	xmrig
behavioral2/memory/212-141-0x00007FF71BCB0000-0x00007FF71C0A2000-memory.dmp	xmrig
behavioral2/memory/4536-102-0x00007FF74D6D0000-0x00007FF74DAC2000-memory.dmp	xmrig
behavioral2/memory/4336-92-0x00007FF7AA710000-0x00007FF7AAB02000-memory.dmp	xmrig
behavioral2/memory/4028-70-0x00007FF6FDC00000-0x00007FF6FDFF2000-memory.dmp	xmrig
behavioral2/memory/3104-3876-0x00007FF64CA10000-0x00007FF64CE02000-memory.dmp	xmrig
behavioral2/memory/4336-3878-0x00007FF7AA710000-0x00007FF7AAB02000-memory.dmp	xmrig
behavioral2/memory/212-3883-0x00007FF71BCB0000-0x00007FF71C0A2000-memory.dmp	xmrig
behavioral2/memory/2088-3881-0x00007FF6B8E30000-0x00007FF6B9222000-memory.dmp	xmrig
behavioral2/memory/4028-3884-0x00007FF6FDC00000-0x00007FF6FDFF2000-memory.dmp	xmrig
behavioral2/memory/3868-3886-0x00007FF6183A0000-0x00007FF618792000-memory.dmp	xmrig
behavioral2/memory/1088-3888-0x00007FF68CAD0000-0x00007FF68CEC2000-memory.dmp	xmrig
behavioral2/memory/2316-3908-0x00007FF697830000-0x00007FF697C22000-memory.dmp	xmrig
behavioral2/memory/2312-3912-0x00007FF7B7E20000-0x00007FF7B8212000-memory.dmp	xmrig
behavioral2/memory/3784-3914-0x00007FF7DE930000-0x00007FF7DED22000-memory.dmp	xmrig
behavioral2/memory/1240-3910-0x00007FF6363D0000-0x00007FF6367C2000-memory.dmp	xmrig
behavioral2/memory/2020-3906-0x00007FF7FC2C0000-0x00007FF7FC6B2000-memory.dmp	xmrig
behavioral2/memory/3616-3903-0x00007FF6085B0000-0x00007FF6089A2000-memory.dmp	xmrig
behavioral2/memory/2976-3900-0x00007FF613DA0000-0x00007FF614192000-memory.dmp	xmrig
behavioral2/memory/3344-3899-0x00007FF79D540000-0x00007FF79D932000-memory.dmp	xmrig
behavioral2/memory/2200-3897-0x00007FF6CE680000-0x00007FF6CEA72000-memory.dmp	xmrig
behavioral2/memory/3272-3895-0x00007FF6C2A60000-0x00007FF6C2E52000-memory.dmp	xmrig
behavioral2/memory/1564-3893-0x00007FF6CE800000-0x00007FF6CEBF2000-memory.dmp	xmrig
behavioral2/memory/468-3891-0x00007FF7FA060000-0x00007FF7FA452000-memory.dmp	xmrig
behavioral2/memory/4536-3905-0x00007FF74D6D0000-0x00007FF74DAC2000-memory.dmp	xmrig
behavioral2/memory/816-3943-0x00007FF669D20000-0x00007FF66A112000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3104	WlLYuVQ.exe
2088	Oczgqds.exe
4028	TAIqSYe.exe
4336	lTvVNIs.exe
4536	oLBmJfl.exe
212	MGdvWLT.exe
3868	ttXNMcV.exe
1088	rSsjSuT.exe
3616	hxJeDOU.exe
468	VAWuFJC.exe
2200	MOHvtIg.exe
3344	TZjMfOW.exe
3272	fpIwoQw.exe
1564	nrVlSQs.exe
2316	QNyLLNm.exe
2020	FoFgyZE.exe
2976	ZuQERzM.exe
2312	BIEYTXf.exe
1240	cARosHM.exe
3784	qBYTrVu.exe
816	xLTAHjM.exe
916	sGcsEVe.exe
2556	eNDYyBw.exe
3780	HUPbjps.exe
4244	cwcnLld.exe
3876	zOIzNeV.exe
4500	RdFTPKs.exe
2756	zFMMJqM.exe
2688	oGVMMxs.exe
4644	ZzeGLet.exe
2852	RdZSbBU.exe
1132	fjxqwjF.exe
1312	dZPKSuf.exe
4224	CRtPMkR.exe
1816	TMiasbQ.exe
4600	dRyjWjz.exe
3692	cpiwsjB.exe
4496	toWzmJw.exe
848	ISKfUgo.exe
3124	slZldWP.exe
1640	YrYQqHR.exe
1948	xWxqvPv.exe
1676	IwykGsZ.exe
4512	VfGUPQH.exe
4004	BeNSxIW.exe
2476	KRFlAlU.exe
736	SStTbzY.exe
456	ClDUYui.exe
4700	iyEZgHm.exe
3268	bbpecEc.exe
376	ZEiiyGZ.exe
440	fsXhnkV.exe
3948	ZAsmGti.exe
640	MwqvinB.exe
3560	KOIEaWU.exe
4304	zjnVVMR.exe
3280	qOszjli.exe
4296	AiscjWx.exe
520	wkUzbLi.exe
3808	WyxrhNu.exe
3608	KmqOpfp.exe
3300	KWUtiHt.exe
5084	WFRrFvR.exe
2328	DnhYWxy.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2944-0-0x00007FF6925E0000-0x00007FF6929D2000-memory.dmp	upx
behavioral2/files/0x000c000000023b52-5.dat	upx
behavioral2/files/0x000b000000023bac-15.dat	upx
behavioral2/files/0x000a000000023bb2-22.dat	upx
behavioral2/files/0x000a000000023bb4-31.dat	upx
behavioral2/files/0x0031000000023bb7-68.dat	upx
behavioral2/files/0x000a000000023bbc-69.dat	upx
behavioral2/files/0x000a000000023bc5-195.dat	upx
behavioral2/memory/3272-328-0x00007FF6C2A60000-0x00007FF6C2E52000-memory.dmp	upx
behavioral2/memory/1564-383-0x00007FF6CE800000-0x00007FF6CEBF2000-memory.dmp	upx
behavioral2/memory/2316-435-0x00007FF697830000-0x00007FF697C22000-memory.dmp	upx
behavioral2/memory/2976-539-0x00007FF613DA0000-0x00007FF614192000-memory.dmp	upx
behavioral2/memory/2312-540-0x00007FF7B7E20000-0x00007FF7B8212000-memory.dmp	upx
behavioral2/memory/2020-538-0x00007FF7FC2C0000-0x00007FF7FC6B2000-memory.dmp	upx
behavioral2/memory/2200-537-0x00007FF6CE680000-0x00007FF6CEA72000-memory.dmp	upx
behavioral2/memory/2088-536-0x00007FF6B8E30000-0x00007FF6B9222000-memory.dmp	upx
behavioral2/memory/816-535-0x00007FF669D20000-0x00007FF66A112000-memory.dmp	upx
behavioral2/memory/3784-534-0x00007FF7DE930000-0x00007FF7DED22000-memory.dmp	upx
behavioral2/memory/1240-497-0x00007FF6363D0000-0x00007FF6367C2000-memory.dmp	upx
behavioral2/memory/468-282-0x00007FF7FA060000-0x00007FF7FA452000-memory.dmp	upx
behavioral2/memory/3344-288-0x00007FF79D540000-0x00007FF79D932000-memory.dmp	upx
behavioral2/memory/3616-240-0x00007FF6085B0000-0x00007FF6089A2000-memory.dmp	upx
behavioral2/memory/1088-205-0x00007FF68CAD0000-0x00007FF68CEC2000-memory.dmp	upx
behavioral2/files/0x000a000000023bd3-200.dat	upx
behavioral2/files/0x000b000000023bad-189.dat	upx
behavioral2/files/0x000a000000023bc0-179.dat	upx
behavioral2/memory/3868-177-0x00007FF6183A0000-0x00007FF618792000-memory.dmp	upx
behavioral2/files/0x000a000000023bbf-172.dat	upx
behavioral2/files/0x000a000000023bd1-171.dat	upx
behavioral2/files/0x000a000000023bd0-168.dat	upx
behavioral2/files/0x000a000000023bcf-165.dat	upx
behavioral2/files/0x000a000000023bce-164.dat	upx
behavioral2/files/0x000a000000023bcd-163.dat	upx
behavioral2/files/0x000a000000023bd4-201.dat	upx
behavioral2/files/0x000a000000023bc7-196.dat	upx
behavioral2/files/0x000a000000023bc4-194.dat	upx
behavioral2/files/0x000b000000023bc2-158.dat	upx
behavioral2/files/0x000b000000023bc3-156.dat	upx
behavioral2/files/0x000a000000023bcb-153.dat	upx
behavioral2/files/0x000a000000023bd2-186.dat	upx
behavioral2/files/0x000a000000023bc1-184.dat	upx
behavioral2/files/0x000a000000023bca-152.dat	upx
behavioral2/files/0x000a000000023bc8-150.dat	upx
behavioral2/files/0x000a000000023bc9-147.dat	upx
behavioral2/files/0x000a000000023bbd-144.dat	upx
behavioral2/memory/212-141-0x00007FF71BCB0000-0x00007FF71C0A2000-memory.dmp	upx
behavioral2/files/0x000a000000023bc6-133.dat	upx
behavioral2/files/0x000a000000023bcc-162.dat	upx
behavioral2/files/0x0031000000023bb8-123.dat	upx
behavioral2/files/0x000a000000023bbb-114.dat	upx
behavioral2/files/0x000a000000023bb9-108.dat	upx
behavioral2/files/0x000a000000023bba-105.dat	upx
behavioral2/memory/4536-102-0x00007FF74D6D0000-0x00007FF74DAC2000-memory.dmp	upx
behavioral2/files/0x000a000000023bbe-98.dat	upx
behavioral2/memory/4336-92-0x00007FF7AA710000-0x00007FF7AAB02000-memory.dmp	upx
behavioral2/files/0x0031000000023bb6-74.dat	upx
behavioral2/memory/4028-70-0x00007FF6FDC00000-0x00007FF6FDFF2000-memory.dmp	upx
behavioral2/files/0x000a000000023bb5-52.dat	upx
behavioral2/files/0x000a000000023bb3-34.dat	upx
behavioral2/files/0x000a000000023bb0-38.dat	upx
behavioral2/files/0x000a000000023bb1-25.dat	upx
behavioral2/memory/3104-14-0x00007FF64CA10000-0x00007FF64CE02000-memory.dmp	upx
behavioral2/memory/3104-3876-0x00007FF64CA10000-0x00007FF64CE02000-memory.dmp	upx
behavioral2/memory/4336-3878-0x00007FF7AA710000-0x00007FF7AAB02000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\VFjkVrZ.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\tbjjaIU.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\PentCqZ.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\mFnxxlz.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\gsrJBuH.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\uxOZGTy.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\IiWWlll.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\iDiiiXs.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\xaSREVd.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\ltWVCXZ.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\AhVhjKR.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\SNZlrGQ.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\DfHTfXC.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\HXMVIEV.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\kKMnruS.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\qbUaQoi.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\axHiOXF.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\uxTgFDL.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\pgSxFAS.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\nAbqDoX.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\YgxDxbi.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\WySHVaF.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\eLQuTEf.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\pnblCSA.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\VusqKHz.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\RgtdVrp.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\NtHnIWH.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\rnboIQN.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\yjHcSAJ.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\KyKTNbK.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\zVCsdMl.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\XEkEykR.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\ufcCfnF.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\EQBdGTK.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\XBYDQbI.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\HJkXDzq.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\llxTdOc.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\fAilKdI.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\EOIVvhu.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\yDPPIrl.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\ABHnlws.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\YylljaQ.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\ECzldVd.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\DfaspQy.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\qSXPHUL.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\RjmGogh.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\gTZIbQK.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\CQPyild.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\sYrdysW.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\cPbLRbY.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\PrbYNfA.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\wJojISA.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\AonVBoZ.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\KVQquoh.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\VYSZVwH.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\tnjQwAL.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\YFrgYcP.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\uDrwqeb.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\BoSWzTq.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\OKoNmlG.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\dXoCsVS.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\HmnbPxt.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\wwJKBRZ.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
File created	C:\Windows\System\VYYOGyg.exe	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
408	powershell.exe
408	powershell.exe
408	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	408	powershell.exe
Token: SeLockMemoryPrivilege	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 408	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	84
PID 2944 wrote to memory of 408	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	84
PID 2944 wrote to memory of 3104	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	85
PID 2944 wrote to memory of 3104	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	85
PID 2944 wrote to memory of 2088	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	86
PID 2944 wrote to memory of 2088	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	86
PID 2944 wrote to memory of 4028	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	87
PID 2944 wrote to memory of 4028	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	87
PID 2944 wrote to memory of 4336	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	88
PID 2944 wrote to memory of 4336	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	88
PID 2944 wrote to memory of 4536	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	89
PID 2944 wrote to memory of 4536	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	89
PID 2944 wrote to memory of 212	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	90
PID 2944 wrote to memory of 212	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	90
PID 2944 wrote to memory of 3868	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	91
PID 2944 wrote to memory of 3868	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	91
PID 2944 wrote to memory of 1088	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	92
PID 2944 wrote to memory of 1088	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	92
PID 2944 wrote to memory of 3616	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	93
PID 2944 wrote to memory of 3616	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	93
PID 2944 wrote to memory of 1564	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	94
PID 2944 wrote to memory of 1564	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	94
PID 2944 wrote to memory of 468	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	95
PID 2944 wrote to memory of 468	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	95
PID 2944 wrote to memory of 2200	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	96
PID 2944 wrote to memory of 2200	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	96
PID 2944 wrote to memory of 3344	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	97
PID 2944 wrote to memory of 3344	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	97
PID 2944 wrote to memory of 3272	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	98
PID 2944 wrote to memory of 3272	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	98
PID 2944 wrote to memory of 2316	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	99
PID 2944 wrote to memory of 2316	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	99
PID 2944 wrote to memory of 2020	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	100
PID 2944 wrote to memory of 2020	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	100
PID 2944 wrote to memory of 2976	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	101
PID 2944 wrote to memory of 2976	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	101
PID 2944 wrote to memory of 2312	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	102
PID 2944 wrote to memory of 2312	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	102
PID 2944 wrote to memory of 1240	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	103
PID 2944 wrote to memory of 1240	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	103
PID 2944 wrote to memory of 3784	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	104
PID 2944 wrote to memory of 3784	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	104
PID 2944 wrote to memory of 816	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	105
PID 2944 wrote to memory of 816	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	105
PID 2944 wrote to memory of 916	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	106
PID 2944 wrote to memory of 916	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	106
PID 2944 wrote to memory of 2556	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	107
PID 2944 wrote to memory of 2556	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	107
PID 2944 wrote to memory of 3780	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	108
PID 2944 wrote to memory of 3780	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	108
PID 2944 wrote to memory of 3876	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	109
PID 2944 wrote to memory of 3876	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	109
PID 2944 wrote to memory of 4244	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	110
PID 2944 wrote to memory of 4244	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	110
PID 2944 wrote to memory of 4500	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	111
PID 2944 wrote to memory of 4500	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	111
PID 2944 wrote to memory of 2756	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	112
PID 2944 wrote to memory of 2756	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	112
PID 2944 wrote to memory of 2688	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	113
PID 2944 wrote to memory of 2688	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	113
PID 2944 wrote to memory of 4644	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	114
PID 2944 wrote to memory of 4644	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	114
PID 2944 wrote to memory of 2852	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	115
PID 2944 wrote to memory of 2852	2944	01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\01a1fd33628089f84a08fc8e58e170a6_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:408
- C:\Windows\System\WlLYuVQ.exe
  C:\Windows\System\WlLYuVQ.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\Oczgqds.exe
  C:\Windows\System\Oczgqds.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\TAIqSYe.exe
  C:\Windows\System\TAIqSYe.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\lTvVNIs.exe
  C:\Windows\System\lTvVNIs.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\oLBmJfl.exe
  C:\Windows\System\oLBmJfl.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\MGdvWLT.exe
  C:\Windows\System\MGdvWLT.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\ttXNMcV.exe
  C:\Windows\System\ttXNMcV.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\rSsjSuT.exe
  C:\Windows\System\rSsjSuT.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\hxJeDOU.exe
  C:\Windows\System\hxJeDOU.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\nrVlSQs.exe
  C:\Windows\System\nrVlSQs.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\VAWuFJC.exe
  C:\Windows\System\VAWuFJC.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\MOHvtIg.exe
  C:\Windows\System\MOHvtIg.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\TZjMfOW.exe
  C:\Windows\System\TZjMfOW.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System\fpIwoQw.exe
  C:\Windows\System\fpIwoQw.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\QNyLLNm.exe
  C:\Windows\System\QNyLLNm.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\FoFgyZE.exe
  C:\Windows\System\FoFgyZE.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\ZuQERzM.exe
  C:\Windows\System\ZuQERzM.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\BIEYTXf.exe
  C:\Windows\System\BIEYTXf.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\cARosHM.exe
  C:\Windows\System\cARosHM.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\qBYTrVu.exe
  C:\Windows\System\qBYTrVu.exe
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\System\xLTAHjM.exe
  C:\Windows\System\xLTAHjM.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\sGcsEVe.exe
  C:\Windows\System\sGcsEVe.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\eNDYyBw.exe
  C:\Windows\System\eNDYyBw.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\HUPbjps.exe
  C:\Windows\System\HUPbjps.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System\zOIzNeV.exe
  C:\Windows\System\zOIzNeV.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\cwcnLld.exe
  C:\Windows\System\cwcnLld.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\RdFTPKs.exe
  C:\Windows\System\RdFTPKs.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\zFMMJqM.exe
  C:\Windows\System\zFMMJqM.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\oGVMMxs.exe
  C:\Windows\System\oGVMMxs.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\ZzeGLet.exe
  C:\Windows\System\ZzeGLet.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\RdZSbBU.exe
  C:\Windows\System\RdZSbBU.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\fjxqwjF.exe
  C:\Windows\System\fjxqwjF.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\dZPKSuf.exe
  C:\Windows\System\dZPKSuf.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\CRtPMkR.exe
  C:\Windows\System\CRtPMkR.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\TMiasbQ.exe
  C:\Windows\System\TMiasbQ.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\dRyjWjz.exe
  C:\Windows\System\dRyjWjz.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\cpiwsjB.exe
  C:\Windows\System\cpiwsjB.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\toWzmJw.exe
  C:\Windows\System\toWzmJw.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\ISKfUgo.exe
  C:\Windows\System\ISKfUgo.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\slZldWP.exe
  C:\Windows\System\slZldWP.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\YrYQqHR.exe
  C:\Windows\System\YrYQqHR.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\xWxqvPv.exe
  C:\Windows\System\xWxqvPv.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\IwykGsZ.exe
  C:\Windows\System\IwykGsZ.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\VfGUPQH.exe
  C:\Windows\System\VfGUPQH.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\BeNSxIW.exe
  C:\Windows\System\BeNSxIW.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\KRFlAlU.exe
  C:\Windows\System\KRFlAlU.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\SStTbzY.exe
  C:\Windows\System\SStTbzY.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\ClDUYui.exe
  C:\Windows\System\ClDUYui.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\iyEZgHm.exe
  C:\Windows\System\iyEZgHm.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\bbpecEc.exe
  C:\Windows\System\bbpecEc.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\ZEiiyGZ.exe
  C:\Windows\System\ZEiiyGZ.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\fsXhnkV.exe
  C:\Windows\System\fsXhnkV.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\ZAsmGti.exe
  C:\Windows\System\ZAsmGti.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\MwqvinB.exe
  C:\Windows\System\MwqvinB.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\KOIEaWU.exe
  C:\Windows\System\KOIEaWU.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\zjnVVMR.exe
  C:\Windows\System\zjnVVMR.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\qOszjli.exe
  C:\Windows\System\qOszjli.exe
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Windows\System\CmavLsW.exe
  C:\Windows\System\CmavLsW.exe
  2⤵
  PID:4316
- C:\Windows\System\AiscjWx.exe
  C:\Windows\System\AiscjWx.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\wkUzbLi.exe
  C:\Windows\System\wkUzbLi.exe
  2⤵
  - Executes dropped EXE
  PID:520
- C:\Windows\System\WyxrhNu.exe
  C:\Windows\System\WyxrhNu.exe
  2⤵
  - Executes dropped EXE
  PID:3808
- C:\Windows\System\KmqOpfp.exe
  C:\Windows\System\KmqOpfp.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\KWUtiHt.exe
  C:\Windows\System\KWUtiHt.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\MnXWvGR.exe
  C:\Windows\System\MnXWvGR.exe
  2⤵
  PID:2040
- C:\Windows\System\WFRrFvR.exe
  C:\Windows\System\WFRrFvR.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\cAZKiVU.exe
  C:\Windows\System\cAZKiVU.exe
  2⤵
  PID:4460
- C:\Windows\System\DnhYWxy.exe
  C:\Windows\System\DnhYWxy.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\InGcNFt.exe
  C:\Windows\System\InGcNFt.exe
  2⤵
  PID:412
- C:\Windows\System\dBpbNAK.exe
  C:\Windows\System\dBpbNAK.exe
  2⤵
  PID:4436
- C:\Windows\System\ZeNOZmq.exe
  C:\Windows\System\ZeNOZmq.exe
  2⤵
  PID:4560
- C:\Windows\System\NnFOJDw.exe
  C:\Windows\System\NnFOJDw.exe
  2⤵
  PID:2008
- C:\Windows\System\nyTOVWU.exe
  C:\Windows\System\nyTOVWU.exe
  2⤵
  PID:1332
- C:\Windows\System\PmJOsId.exe
  C:\Windows\System\PmJOsId.exe
  2⤵
  PID:1740
- C:\Windows\System\GSXehcv.exe
  C:\Windows\System\GSXehcv.exe
  2⤵
  PID:4668
- C:\Windows\System\mLoDtMq.exe
  C:\Windows\System\mLoDtMq.exe
  2⤵
  PID:1644
- C:\Windows\System\UXCPAtb.exe
  C:\Windows\System\UXCPAtb.exe
  2⤵
  PID:924
- C:\Windows\System\HFUGfQG.exe
  C:\Windows\System\HFUGfQG.exe
  2⤵
  PID:988
- C:\Windows\System\tqJJQyS.exe
  C:\Windows\System\tqJJQyS.exe
  2⤵
  PID:1696
- C:\Windows\System\YlbcAaD.exe
  C:\Windows\System\YlbcAaD.exe
  2⤵
  PID:1192
- C:\Windows\System\HWMzjOQ.exe
  C:\Windows\System\HWMzjOQ.exe
  2⤵
  PID:4524
- C:\Windows\System\sYZHTFo.exe
  C:\Windows\System\sYZHTFo.exe
  2⤵
  PID:1956
- C:\Windows\System\OYxEPCP.exe
  C:\Windows\System\OYxEPCP.exe
  2⤵
  PID:4848
- C:\Windows\System\rZjvKEe.exe
  C:\Windows\System\rZjvKEe.exe
  2⤵
  PID:1352
- C:\Windows\System\vOfYwds.exe
  C:\Windows\System\vOfYwds.exe
  2⤵
  PID:1952
- C:\Windows\System\FgtyyNs.exe
  C:\Windows\System\FgtyyNs.exe
  2⤵
  PID:5128
- C:\Windows\System\oNnvKlo.exe
  C:\Windows\System\oNnvKlo.exe
  2⤵
  PID:5160
- C:\Windows\System\uNAdXfb.exe
  C:\Windows\System\uNAdXfb.exe
  2⤵
  PID:5176
- C:\Windows\System\SRxYmcF.exe
  C:\Windows\System\SRxYmcF.exe
  2⤵
  PID:5192
- C:\Windows\System\KlIEzxf.exe
  C:\Windows\System\KlIEzxf.exe
  2⤵
  PID:5208
- C:\Windows\System\NhCXTEd.exe
  C:\Windows\System\NhCXTEd.exe
  2⤵
  PID:5228
- C:\Windows\System\PIDgsVV.exe
  C:\Windows\System\PIDgsVV.exe
  2⤵
  PID:5244
- C:\Windows\System\vJWJhAj.exe
  C:\Windows\System\vJWJhAj.exe
  2⤵
  PID:5260
- C:\Windows\System\QLBhkKU.exe
  C:\Windows\System\QLBhkKU.exe
  2⤵
  PID:5288
- C:\Windows\System\EZmgUyr.exe
  C:\Windows\System\EZmgUyr.exe
  2⤵
  PID:5308
- C:\Windows\System\sflmIfw.exe
  C:\Windows\System\sflmIfw.exe
  2⤵
  PID:5328
- C:\Windows\System\sNHvkGH.exe
  C:\Windows\System\sNHvkGH.exe
  2⤵
  PID:5348
- C:\Windows\System\OLxzqyd.exe
  C:\Windows\System\OLxzqyd.exe
  2⤵
  PID:5368
- C:\Windows\System\xrTgvYv.exe
  C:\Windows\System\xrTgvYv.exe
  2⤵
  PID:5384
- C:\Windows\System\KmvzfYy.exe
  C:\Windows\System\KmvzfYy.exe
  2⤵
  PID:5404
- C:\Windows\System\NHAkLjV.exe
  C:\Windows\System\NHAkLjV.exe
  2⤵
  PID:5424
- C:\Windows\System\wwJKBRZ.exe
  C:\Windows\System\wwJKBRZ.exe
  2⤵
  PID:5472
- C:\Windows\System\TelZfPn.exe
  C:\Windows\System\TelZfPn.exe
  2⤵
  PID:5492
- C:\Windows\System\HrMosxh.exe
  C:\Windows\System\HrMosxh.exe
  2⤵
  PID:5516
- C:\Windows\System\eZlaGxS.exe
  C:\Windows\System\eZlaGxS.exe
  2⤵
  PID:5532
- C:\Windows\System\WXRBTNp.exe
  C:\Windows\System\WXRBTNp.exe
  2⤵
  PID:5556
- C:\Windows\System\wDNgvse.exe
  C:\Windows\System\wDNgvse.exe
  2⤵
  PID:5580
- C:\Windows\System\pTnSDds.exe
  C:\Windows\System\pTnSDds.exe
  2⤵
  PID:5596
- C:\Windows\System\QDORTJI.exe
  C:\Windows\System\QDORTJI.exe
  2⤵
  PID:5624
- C:\Windows\System\jtaXouM.exe
  C:\Windows\System\jtaXouM.exe
  2⤵
  PID:5644
- C:\Windows\System\zgLpYAw.exe
  C:\Windows\System\zgLpYAw.exe
  2⤵
  PID:5668
- C:\Windows\System\jYxSenN.exe
  C:\Windows\System\jYxSenN.exe
  2⤵
  PID:5684
- C:\Windows\System\rAAoqUR.exe
  C:\Windows\System\rAAoqUR.exe
  2⤵
  PID:5704
- C:\Windows\System\bdoRsoT.exe
  C:\Windows\System\bdoRsoT.exe
  2⤵
  PID:5720
- C:\Windows\System\qGeenXa.exe
  C:\Windows\System\qGeenXa.exe
  2⤵
  PID:5744
- C:\Windows\System\VAJYbvI.exe
  C:\Windows\System\VAJYbvI.exe
  2⤵
  PID:5768
- C:\Windows\System\sSuASzw.exe
  C:\Windows\System\sSuASzw.exe
  2⤵
  PID:5816
- C:\Windows\System\NCRluhK.exe
  C:\Windows\System\NCRluhK.exe
  2⤵
  PID:5848
- C:\Windows\System\dAIhrdj.exe
  C:\Windows\System\dAIhrdj.exe
  2⤵
  PID:5876
- C:\Windows\System\RiiKPsV.exe
  C:\Windows\System\RiiKPsV.exe
  2⤵
  PID:5892
- C:\Windows\System\EnFNTWM.exe
  C:\Windows\System\EnFNTWM.exe
  2⤵
  PID:5916
- C:\Windows\System\wBdwNYG.exe
  C:\Windows\System\wBdwNYG.exe
  2⤵
  PID:5944
- C:\Windows\System\CjfRspV.exe
  C:\Windows\System\CjfRspV.exe
  2⤵
  PID:5960
- C:\Windows\System\ZfVRyjB.exe
  C:\Windows\System\ZfVRyjB.exe
  2⤵
  PID:5980
- C:\Windows\System\iHHUvCE.exe
  C:\Windows\System\iHHUvCE.exe
  2⤵
  PID:6008
- C:\Windows\System\PdNfQOX.exe
  C:\Windows\System\PdNfQOX.exe
  2⤵
  PID:6032
- C:\Windows\System\IFkrmLW.exe
  C:\Windows\System\IFkrmLW.exe
  2⤵
  PID:6064
- C:\Windows\System\aJnPhjx.exe
  C:\Windows\System\aJnPhjx.exe
  2⤵
  PID:6080
- C:\Windows\System\pNzYkKL.exe
  C:\Windows\System\pNzYkKL.exe
  2⤵
  PID:6116
- C:\Windows\System\wxKibeX.exe
  C:\Windows\System\wxKibeX.exe
  2⤵
  PID:3872
- C:\Windows\System\RZgargv.exe
  C:\Windows\System\RZgargv.exe
  2⤵
  PID:1508
- C:\Windows\System\XEHMntU.exe
  C:\Windows\System\XEHMntU.exe
  2⤵
  PID:2160
- C:\Windows\System\VsDAYUP.exe
  C:\Windows\System\VsDAYUP.exe
  2⤵
  PID:1792
- C:\Windows\System\iphOzvS.exe
  C:\Windows\System\iphOzvS.exe
  2⤵
  PID:1140
- C:\Windows\System\wSbqnjJ.exe
  C:\Windows\System\wSbqnjJ.exe
  2⤵
  PID:348
- C:\Windows\System\iIcTIRH.exe
  C:\Windows\System\iIcTIRH.exe
  2⤵
  PID:540
- C:\Windows\System\GgyqJtR.exe
  C:\Windows\System\GgyqJtR.exe
  2⤵
  PID:4184
- C:\Windows\System\DegPBPE.exe
  C:\Windows\System\DegPBPE.exe
  2⤵
  PID:332
- C:\Windows\System\aHaRJyN.exe
  C:\Windows\System\aHaRJyN.exe
  2⤵
  PID:3328
- C:\Windows\System\uGLiTnJ.exe
  C:\Windows\System\uGLiTnJ.exe
  2⤵
  PID:2764
- C:\Windows\System\lnLEfvP.exe
  C:\Windows\System\lnLEfvP.exe
  2⤵
  PID:1660
- C:\Windows\System\KvRaUxt.exe
  C:\Windows\System\KvRaUxt.exe
  2⤵
  PID:1924
- C:\Windows\System\pVoVQyZ.exe
  C:\Windows\System\pVoVQyZ.exe
  2⤵
  PID:5592
- C:\Windows\System\mRXBRNc.exe
  C:\Windows\System\mRXBRNc.exe
  2⤵
  PID:5184
- C:\Windows\System\oVbAGNu.exe
  C:\Windows\System\oVbAGNu.exe
  2⤵
  PID:6160
- C:\Windows\System\BFEZZQx.exe
  C:\Windows\System\BFEZZQx.exe
  2⤵
  PID:6176
- C:\Windows\System\PpzvVsi.exe
  C:\Windows\System\PpzvVsi.exe
  2⤵
  PID:6204
- C:\Windows\System\dUSASRm.exe
  C:\Windows\System\dUSASRm.exe
  2⤵
  PID:6224
- C:\Windows\System\mSFGhSL.exe
  C:\Windows\System\mSFGhSL.exe
  2⤵
  PID:6244
- C:\Windows\System\onPLTzH.exe
  C:\Windows\System\onPLTzH.exe
  2⤵
  PID:6264
- C:\Windows\System\KOMnsaS.exe
  C:\Windows\System\KOMnsaS.exe
  2⤵
  PID:6284
- C:\Windows\System\olDDrNz.exe
  C:\Windows\System\olDDrNz.exe
  2⤵
  PID:6312
- C:\Windows\System\ljYHzaJ.exe
  C:\Windows\System\ljYHzaJ.exe
  2⤵
  PID:6328
- C:\Windows\System\TsmGxNW.exe
  C:\Windows\System\TsmGxNW.exe
  2⤵
  PID:6344
- C:\Windows\System\uDBKICb.exe
  C:\Windows\System\uDBKICb.exe
  2⤵
  PID:6360
- C:\Windows\System\QBrmYYR.exe
  C:\Windows\System\QBrmYYR.exe
  2⤵
  PID:6420
- C:\Windows\System\dcXvlIX.exe
  C:\Windows\System\dcXvlIX.exe
  2⤵
  PID:6448
- C:\Windows\System\IhawhyD.exe
  C:\Windows\System\IhawhyD.exe
  2⤵
  PID:6464
- C:\Windows\System\MsmphnK.exe
  C:\Windows\System\MsmphnK.exe
  2⤵
  PID:6488
- C:\Windows\System\msUTdLZ.exe
  C:\Windows\System\msUTdLZ.exe
  2⤵
  PID:6504
- C:\Windows\System\gbEpqjx.exe
  C:\Windows\System\gbEpqjx.exe
  2⤵
  PID:6528
- C:\Windows\System\tgZAOIr.exe
  C:\Windows\System\tgZAOIr.exe
  2⤵
  PID:6544
- C:\Windows\System\nTWbPbn.exe
  C:\Windows\System\nTWbPbn.exe
  2⤵
  PID:6568
- C:\Windows\System\HJkXDzq.exe
  C:\Windows\System\HJkXDzq.exe
  2⤵
  PID:6592
- C:\Windows\System\bNgeYAz.exe
  C:\Windows\System\bNgeYAz.exe
  2⤵
  PID:6612
- C:\Windows\System\pAnyviB.exe
  C:\Windows\System\pAnyviB.exe
  2⤵
  PID:6636
- C:\Windows\System\CfHyniS.exe
  C:\Windows\System\CfHyniS.exe
  2⤵
  PID:6656
- C:\Windows\System\TAJdrbL.exe
  C:\Windows\System\TAJdrbL.exe
  2⤵
  PID:6680
- C:\Windows\System\HhNqRcU.exe
  C:\Windows\System\HhNqRcU.exe
  2⤵
  PID:6700
- C:\Windows\System\hbZNLkO.exe
  C:\Windows\System\hbZNLkO.exe
  2⤵
  PID:6716
- C:\Windows\System\MYSosoH.exe
  C:\Windows\System\MYSosoH.exe
  2⤵
  PID:6876
- C:\Windows\System\FkdWiJi.exe
  C:\Windows\System\FkdWiJi.exe
  2⤵
  PID:6892
- C:\Windows\System\kXEduzy.exe
  C:\Windows\System\kXEduzy.exe
  2⤵
  PID:6908
- C:\Windows\System\UlfzcOF.exe
  C:\Windows\System\UlfzcOF.exe
  2⤵
  PID:6924
- C:\Windows\System\WnIuYUZ.exe
  C:\Windows\System\WnIuYUZ.exe
  2⤵
  PID:6940
- C:\Windows\System\BBMQQFL.exe
  C:\Windows\System\BBMQQFL.exe
  2⤵
  PID:6956
- C:\Windows\System\UUumZtz.exe
  C:\Windows\System\UUumZtz.exe
  2⤵
  PID:6972
- C:\Windows\System\hgzerZk.exe
  C:\Windows\System\hgzerZk.exe
  2⤵
  PID:6988
- C:\Windows\System\JGQbMJm.exe
  C:\Windows\System\JGQbMJm.exe
  2⤵
  PID:7004
- C:\Windows\System\ZJzQazl.exe
  C:\Windows\System\ZJzQazl.exe
  2⤵
  PID:7020
- C:\Windows\System\MAjANaX.exe
  C:\Windows\System\MAjANaX.exe
  2⤵
  PID:7036
- C:\Windows\System\QZuzIHo.exe
  C:\Windows\System\QZuzIHo.exe
  2⤵
  PID:7052
- C:\Windows\System\QHUSPZy.exe
  C:\Windows\System\QHUSPZy.exe
  2⤵
  PID:7076
- C:\Windows\System\GiDAQDz.exe
  C:\Windows\System\GiDAQDz.exe
  2⤵
  PID:7096
- C:\Windows\System\VLkXOUJ.exe
  C:\Windows\System\VLkXOUJ.exe
  2⤵
  PID:7120
- C:\Windows\System\vfQGmNv.exe
  C:\Windows\System\vfQGmNv.exe
  2⤵
  PID:7140
- C:\Windows\System\jaEMrwP.exe
  C:\Windows\System\jaEMrwP.exe
  2⤵
  PID:7156
- C:\Windows\System\ikrRKjE.exe
  C:\Windows\System\ikrRKjE.exe
  2⤵
  PID:5256
- C:\Windows\System\TmVuTWu.exe
  C:\Windows\System\TmVuTWu.exe
  2⤵
  PID:5216
- C:\Windows\System\paSlAFz.exe
  C:\Windows\System\paSlAFz.exe
  2⤵
  PID:5296
- C:\Windows\System\fGclGJn.exe
  C:\Windows\System\fGclGJn.exe
  2⤵
  PID:5336
- C:\Windows\System\AkJCvxn.exe
  C:\Windows\System\AkJCvxn.exe
  2⤵
  PID:5376
- C:\Windows\System\BwTrPpY.exe
  C:\Windows\System\BwTrPpY.exe
  2⤵
  PID:5436
- C:\Windows\System\TjdhEFq.exe
  C:\Windows\System\TjdhEFq.exe
  2⤵
  PID:5508
- C:\Windows\System\JLTVyzV.exe
  C:\Windows\System\JLTVyzV.exe
  2⤵
  PID:5540
- C:\Windows\System\XdJrrYm.exe
  C:\Windows\System\XdJrrYm.exe
  2⤵
  PID:5604
- C:\Windows\System\sHLrOzZ.exe
  C:\Windows\System\sHLrOzZ.exe
  2⤵
  PID:6072
- C:\Windows\System\KVmbmGZ.exe
  C:\Windows\System\KVmbmGZ.exe
  2⤵
  PID:5636
- C:\Windows\System\sJwedlt.exe
  C:\Windows\System\sJwedlt.exe
  2⤵
  PID:5680
- C:\Windows\System\BMbcsDP.exe
  C:\Windows\System\BMbcsDP.exe
  2⤵
  PID:5728
- C:\Windows\System\lvLhLXg.exe
  C:\Windows\System\lvLhLXg.exe
  2⤵
  PID:5760
- C:\Windows\System\RpRwpaj.exe
  C:\Windows\System\RpRwpaj.exe
  2⤵
  PID:5784
- C:\Windows\System\dxeajQh.exe
  C:\Windows\System\dxeajQh.exe
  2⤵
  PID:5856
- C:\Windows\System\GjHLjEm.exe
  C:\Windows\System\GjHLjEm.exe
  2⤵
  PID:5908
- C:\Windows\System\ILSBiyT.exe
  C:\Windows\System\ILSBiyT.exe
  2⤵
  PID:5932
- C:\Windows\System\lOntnZD.exe
  C:\Windows\System\lOntnZD.exe
  2⤵
  PID:5992
- C:\Windows\System\PPnSsPE.exe
  C:\Windows\System\PPnSsPE.exe
  2⤵
  PID:6052
- C:\Windows\System\RkaJVmq.exe
  C:\Windows\System\RkaJVmq.exe
  2⤵
  PID:6136
- C:\Windows\System\pWfbqsr.exe
  C:\Windows\System\pWfbqsr.exe
  2⤵
  PID:4452
- C:\Windows\System\kNSsDcH.exe
  C:\Windows\System\kNSsDcH.exe
  2⤵
  PID:4492
- C:\Windows\System\DEhTQJD.exe
  C:\Windows\System\DEhTQJD.exe
  2⤵
  PID:2716
- C:\Windows\System\acVzzlZ.exe
  C:\Windows\System\acVzzlZ.exe
  2⤵
  PID:3540
- C:\Windows\System\qdajKMz.exe
  C:\Windows\System\qdajKMz.exe
  2⤵
  PID:6296
- C:\Windows\System\zzjdSXp.exe
  C:\Windows\System\zzjdSXp.exe
  2⤵
  PID:6512
- C:\Windows\System\ivIHawu.exe
  C:\Windows\System\ivIHawu.exe
  2⤵
  PID:6736
- C:\Windows\System\XAxVcAH.exe
  C:\Windows\System\XAxVcAH.exe
  2⤵
  PID:4604
- C:\Windows\System\gvXcVvg.exe
  C:\Windows\System\gvXcVvg.exe
  2⤵
  PID:6216
- C:\Windows\System\ZCnYiOV.exe
  C:\Windows\System\ZCnYiOV.exe
  2⤵
  PID:6280
- C:\Windows\System\SzlXwIU.exe
  C:\Windows\System\SzlXwIU.exe
  2⤵
  PID:6340
- C:\Windows\System\VczixVb.exe
  C:\Windows\System\VczixVb.exe
  2⤵
  PID:6372
- C:\Windows\System\YCidVAM.exe
  C:\Windows\System\YCidVAM.exe
  2⤵
  PID:6520
- C:\Windows\System\nMfVsNs.exe
  C:\Windows\System\nMfVsNs.exe
  2⤵
  PID:7212
- C:\Windows\System\zdcTGRp.exe
  C:\Windows\System\zdcTGRp.exe
  2⤵
  PID:7232
- C:\Windows\System\oBBwxTO.exe
  C:\Windows\System\oBBwxTO.exe
  2⤵
  PID:7248
- C:\Windows\System\wjmaOwk.exe
  C:\Windows\System\wjmaOwk.exe
  2⤵
  PID:7272
- C:\Windows\System\RonNNay.exe
  C:\Windows\System\RonNNay.exe
  2⤵
  PID:7292
- C:\Windows\System\qfCAMZS.exe
  C:\Windows\System\qfCAMZS.exe
  2⤵
  PID:7324
- C:\Windows\System\ZVvMhKo.exe
  C:\Windows\System\ZVvMhKo.exe
  2⤵
  PID:7348
- C:\Windows\System\fhccsqG.exe
  C:\Windows\System\fhccsqG.exe
  2⤵
  PID:7368
- C:\Windows\System\wpDYEKf.exe
  C:\Windows\System\wpDYEKf.exe
  2⤵
  PID:7388
- C:\Windows\System\IHrgKGL.exe
  C:\Windows\System\IHrgKGL.exe
  2⤵
  PID:7416
- C:\Windows\System\crViDZR.exe
  C:\Windows\System\crViDZR.exe
  2⤵
  PID:7436
- C:\Windows\System\HvRbyWg.exe
  C:\Windows\System\HvRbyWg.exe
  2⤵
  PID:7464
- C:\Windows\System\xmEmvNf.exe
  C:\Windows\System\xmEmvNf.exe
  2⤵
  PID:7492
- C:\Windows\System\TzQLfjf.exe
  C:\Windows\System\TzQLfjf.exe
  2⤵
  PID:7508
- C:\Windows\System\VZjkGkT.exe
  C:\Windows\System\VZjkGkT.exe
  2⤵
  PID:7536
- C:\Windows\System\xOVOcTV.exe
  C:\Windows\System\xOVOcTV.exe
  2⤵
  PID:7556
- C:\Windows\System\RCiZFyI.exe
  C:\Windows\System\RCiZFyI.exe
  2⤵
  PID:7580
- C:\Windows\System\HdoCQFf.exe
  C:\Windows\System\HdoCQFf.exe
  2⤵
  PID:7604
- C:\Windows\System\NtqPiLi.exe
  C:\Windows\System\NtqPiLi.exe
  2⤵
  PID:7624
- C:\Windows\System\VBEiaOP.exe
  C:\Windows\System\VBEiaOP.exe
  2⤵
  PID:7644
- C:\Windows\System\kiMLnEO.exe
  C:\Windows\System\kiMLnEO.exe
  2⤵
  PID:7668
- C:\Windows\System\bDPDqOl.exe
  C:\Windows\System\bDPDqOl.exe
  2⤵
  PID:7696
- C:\Windows\System\woDyaWJ.exe
  C:\Windows\System\woDyaWJ.exe
  2⤵
  PID:7720
- C:\Windows\System\NAHozCj.exe
  C:\Windows\System\NAHozCj.exe
  2⤵
  PID:7748
- C:\Windows\System\OtfTENN.exe
  C:\Windows\System\OtfTENN.exe
  2⤵
  PID:7780
- C:\Windows\System\pVHoapx.exe
  C:\Windows\System\pVHoapx.exe
  2⤵
  PID:7800
- C:\Windows\System\QwiSIPm.exe
  C:\Windows\System\QwiSIPm.exe
  2⤵
  PID:7904
- C:\Windows\System\SxkTDQB.exe
  C:\Windows\System\SxkTDQB.exe
  2⤵
  PID:7928
- C:\Windows\System\UdiQrug.exe
  C:\Windows\System\UdiQrug.exe
  2⤵
  PID:7952
- C:\Windows\System\TiqaXfH.exe
  C:\Windows\System\TiqaXfH.exe
  2⤵
  PID:7968
- C:\Windows\System\LfhSUyB.exe
  C:\Windows\System\LfhSUyB.exe
  2⤵
  PID:7992
- C:\Windows\System\tHlkDLt.exe
  C:\Windows\System\tHlkDLt.exe
  2⤵
  PID:8016
- C:\Windows\System\iIcdmMe.exe
  C:\Windows\System\iIcdmMe.exe
  2⤵
  PID:8040
- C:\Windows\System\sLoPvvx.exe
  C:\Windows\System\sLoPvvx.exe
  2⤵
  PID:8060
- C:\Windows\System\feqNJEk.exe
  C:\Windows\System\feqNJEk.exe
  2⤵
  PID:8080
- C:\Windows\System\JkPVzHH.exe
  C:\Windows\System\JkPVzHH.exe
  2⤵
  PID:8100
- C:\Windows\System\gpjUFfV.exe
  C:\Windows\System\gpjUFfV.exe
  2⤵
  PID:8128
- C:\Windows\System\NrXBPZG.exe
  C:\Windows\System\NrXBPZG.exe
  2⤵
  PID:8144
- C:\Windows\System\KUHfbii.exe
  C:\Windows\System\KUHfbii.exe
  2⤵
  PID:8164
- C:\Windows\System\cdKnRUI.exe
  C:\Windows\System\cdKnRUI.exe
  2⤵
  PID:8184
- C:\Windows\System\FPgyvje.exe
  C:\Windows\System\FPgyvje.exe
  2⤵
  PID:6560
- C:\Windows\System\mHwafkW.exe
  C:\Windows\System\mHwafkW.exe
  2⤵
  PID:3200
- C:\Windows\System\tPMJbak.exe
  C:\Windows\System\tPMJbak.exe
  2⤵
  PID:5676
- C:\Windows\System\PgUliIF.exe
  C:\Windows\System\PgUliIF.exe
  2⤵
  PID:5776
- C:\Windows\System\lMhNFLe.exe
  C:\Windows\System\lMhNFLe.exe
  2⤵
  PID:6608
- C:\Windows\System\wgyxHxM.exe
  C:\Windows\System\wgyxHxM.exe
  2⤵
  PID:5988
- C:\Windows\System\FJwmQly.exe
  C:\Windows\System\FJwmQly.exe
  2⤵
  PID:6676
- C:\Windows\System\cpgiluc.exe
  C:\Windows\System\cpgiluc.exe
  2⤵
  PID:2624
- C:\Windows\System\YiyanBg.exe
  C:\Windows\System\YiyanBg.exe
  2⤵
  PID:6220
- C:\Windows\System\iZgnrkQ.exe
  C:\Windows\System\iZgnrkQ.exe
  2⤵
  PID:524
- C:\Windows\System\KNbGJPl.exe
  C:\Windows\System\KNbGJPl.exe
  2⤵
  PID:6048
- C:\Windows\System\ODogoCT.exe
  C:\Windows\System\ODogoCT.exe
  2⤵
  PID:6484
- C:\Windows\System\UNKMYOC.exe
  C:\Windows\System\UNKMYOC.exe
  2⤵
  PID:7244
- C:\Windows\System\zvUOleT.exe
  C:\Windows\System\zvUOleT.exe
  2⤵
  PID:6648
- C:\Windows\System\TtZwGAn.exe
  C:\Windows\System\TtZwGAn.exe
  2⤵
  PID:7480
- C:\Windows\System\kvRxCrH.exe
  C:\Windows\System\kvRxCrH.exe
  2⤵
  PID:7552
- C:\Windows\System\WYLKCKR.exe
  C:\Windows\System\WYLKCKR.exe
  2⤵
  PID:7632
- C:\Windows\System\DmmjogZ.exe
  C:\Windows\System\DmmjogZ.exe
  2⤵
  PID:7732
- C:\Windows\System\MyasgRv.exe
  C:\Windows\System\MyasgRv.exe
  2⤵
  PID:7808
- C:\Windows\System\WTnjJPB.exe
  C:\Windows\System\WTnjJPB.exe
  2⤵
  PID:6904
- C:\Windows\System\FjvOjhJ.exe
  C:\Windows\System\FjvOjhJ.exe
  2⤵
  PID:8196
- C:\Windows\System\pztWdYw.exe
  C:\Windows\System\pztWdYw.exe
  2⤵
  PID:8212
- C:\Windows\System\pPrZvev.exe
  C:\Windows\System\pPrZvev.exe
  2⤵
  PID:8236
- C:\Windows\System\VvovkKt.exe
  C:\Windows\System\VvovkKt.exe
  2⤵
  PID:8260
- C:\Windows\System\RgtdVrp.exe
  C:\Windows\System\RgtdVrp.exe
  2⤵
  PID:8280
- C:\Windows\System\WJEtqUO.exe
  C:\Windows\System\WJEtqUO.exe
  2⤵
  PID:8300
- C:\Windows\System\RoxJAdI.exe
  C:\Windows\System\RoxJAdI.exe
  2⤵
  PID:8324
- C:\Windows\System\vEplbgD.exe
  C:\Windows\System\vEplbgD.exe
  2⤵
  PID:8348
- C:\Windows\System\bDMyAeu.exe
  C:\Windows\System\bDMyAeu.exe
  2⤵
  PID:8372
- C:\Windows\System\rVujcuQ.exe
  C:\Windows\System\rVujcuQ.exe
  2⤵
  PID:8392
- C:\Windows\System\qKmMNci.exe
  C:\Windows\System\qKmMNci.exe
  2⤵
  PID:8420
- C:\Windows\System\MhmtoVZ.exe
  C:\Windows\System\MhmtoVZ.exe
  2⤵
  PID:8436
- C:\Windows\System\UXbVBBw.exe
  C:\Windows\System\UXbVBBw.exe
  2⤵
  PID:8460
- C:\Windows\System\CbnaGkc.exe
  C:\Windows\System\CbnaGkc.exe
  2⤵
  PID:8548
- C:\Windows\System\fGEzVJY.exe
  C:\Windows\System\fGEzVJY.exe
  2⤵
  PID:8568
- C:\Windows\System\suGfUSb.exe
  C:\Windows\System\suGfUSb.exe
  2⤵
  PID:8596
- C:\Windows\System\nvlDfSF.exe
  C:\Windows\System\nvlDfSF.exe
  2⤵
  PID:8616
- C:\Windows\System\JGKrnWd.exe
  C:\Windows\System\JGKrnWd.exe
  2⤵
  PID:8640
- C:\Windows\System\EYecEDW.exe
  C:\Windows\System\EYecEDW.exe
  2⤵
  PID:8660
- C:\Windows\System\cscjnMA.exe
  C:\Windows\System\cscjnMA.exe
  2⤵
  PID:8680
- C:\Windows\System\GlYIYhq.exe
  C:\Windows\System\GlYIYhq.exe
  2⤵
  PID:8704
- C:\Windows\System\laODHYV.exe
  C:\Windows\System\laODHYV.exe
  2⤵
  PID:8732
- C:\Windows\System\jszOcrR.exe
  C:\Windows\System\jszOcrR.exe
  2⤵
  PID:8752
- C:\Windows\System\SrbwlFC.exe
  C:\Windows\System\SrbwlFC.exe
  2⤵
  PID:8772
- C:\Windows\System\RnQBNAN.exe
  C:\Windows\System\RnQBNAN.exe
  2⤵
  PID:8796
- C:\Windows\System\MZGFmqm.exe
  C:\Windows\System\MZGFmqm.exe
  2⤵
  PID:8824
- C:\Windows\System\vfHGcZM.exe
  C:\Windows\System\vfHGcZM.exe
  2⤵
  PID:8844
- C:\Windows\System\zQiEpEL.exe
  C:\Windows\System\zQiEpEL.exe
  2⤵
  PID:8864
- C:\Windows\System\NzBsxCM.exe
  C:\Windows\System\NzBsxCM.exe
  2⤵
  PID:8892
- C:\Windows\System\PKxOyPC.exe
  C:\Windows\System\PKxOyPC.exe
  2⤵
  PID:8924
- C:\Windows\System\jhIZsEl.exe
  C:\Windows\System\jhIZsEl.exe
  2⤵
  PID:8940
- C:\Windows\System\mcFZycX.exe
  C:\Windows\System\mcFZycX.exe
  2⤵
  PID:9024
- C:\Windows\System\jFnaYpO.exe
  C:\Windows\System\jFnaYpO.exe
  2⤵
  PID:9044
- C:\Windows\System\aHxONaW.exe
  C:\Windows\System\aHxONaW.exe
  2⤵
  PID:9068
- C:\Windows\System\nfomfgZ.exe
  C:\Windows\System\nfomfgZ.exe
  2⤵
  PID:9084
- C:\Windows\System\AYEGSpw.exe
  C:\Windows\System\AYEGSpw.exe
  2⤵
  PID:9104
- C:\Windows\System\GSKMilM.exe
  C:\Windows\System\GSKMilM.exe
  2⤵
  PID:9120
- C:\Windows\System\mLpZXjD.exe
  C:\Windows\System\mLpZXjD.exe
  2⤵
  PID:9144
- C:\Windows\System\UDVobwL.exe
  C:\Windows\System\UDVobwL.exe
  2⤵
  PID:9164
- C:\Windows\System\YGVBVFM.exe
  C:\Windows\System\YGVBVFM.exe
  2⤵
  PID:9180
- C:\Windows\System\DNDHGNt.exe
  C:\Windows\System\DNDHGNt.exe
  2⤵
  PID:9204
- C:\Windows\System\Nfrzpxd.exe
  C:\Windows\System\Nfrzpxd.exe
  2⤵
  PID:6948
- C:\Windows\System\JTOeCPQ.exe
  C:\Windows\System\JTOeCPQ.exe
  2⤵
  PID:7000
- C:\Windows\System\iKLbfOQ.exe
  C:\Windows\System\iKLbfOQ.exe
  2⤵
  PID:7116
- C:\Windows\System\plLkawK.exe
  C:\Windows\System\plLkawK.exe
  2⤵
  PID:5112
- C:\Windows\System\lEveAMv.exe
  C:\Windows\System\lEveAMv.exe
  2⤵
  PID:5220
- C:\Windows\System\HFMfKTV.exe
  C:\Windows\System\HFMfKTV.exe
  2⤵
  PID:5396
- C:\Windows\System\NtxwrxJ.exe
  C:\Windows\System\NtxwrxJ.exe
  2⤵
  PID:5524
- C:\Windows\System\SdYGEFL.exe
  C:\Windows\System\SdYGEFL.exe
  2⤵
  PID:5528
- C:\Windows\System\GlSPoRS.exe
  C:\Windows\System\GlSPoRS.exe
  2⤵
  PID:5888
- C:\Windows\System\oQhrTZJ.exe
  C:\Windows\System\oQhrTZJ.exe
  2⤵
  PID:7432
- C:\Windows\System\ObZPTEK.exe
  C:\Windows\System\ObZPTEK.exe
  2⤵
  PID:7516
- C:\Windows\System\DfFlhbb.exe
  C:\Windows\System\DfFlhbb.exe
  2⤵
  PID:7500
- C:\Windows\System\jdzMaXx.exe
  C:\Windows\System\jdzMaXx.exe
  2⤵
  PID:7712
- C:\Windows\System\UWjXEpl.exe
  C:\Windows\System\UWjXEpl.exe
  2⤵
  PID:6256
- C:\Windows\System\eulbHLF.exe
  C:\Windows\System\eulbHLF.exe
  2⤵
  PID:7504
- C:\Windows\System\evZzAUx.exe
  C:\Windows\System\evZzAUx.exe
  2⤵
  PID:8432
- C:\Windows\System\vQcHohi.exe
  C:\Windows\System\vQcHohi.exe
  2⤵
  PID:8472
- C:\Windows\System\YjhrPqP.exe
  C:\Windows\System\YjhrPqP.exe
  2⤵
  PID:7176
- C:\Windows\System\zMvHKfY.exe
  C:\Windows\System\zMvHKfY.exe
  2⤵
  PID:7224
- C:\Windows\System\MWrpotT.exe
  C:\Windows\System\MWrpotT.exe
  2⤵
  PID:9236
- C:\Windows\System\iNIThYq.exe
  C:\Windows\System\iNIThYq.exe
  2⤵
  PID:9260
- C:\Windows\System\CLpeXrJ.exe
  C:\Windows\System\CLpeXrJ.exe
  2⤵
  PID:9280
- C:\Windows\System\IVEdWOt.exe
  C:\Windows\System\IVEdWOt.exe
  2⤵
  PID:9296
- C:\Windows\System\OHRwHoJ.exe
  C:\Windows\System\OHRwHoJ.exe
  2⤵
  PID:9312
- C:\Windows\System\tpeTvgu.exe
  C:\Windows\System\tpeTvgu.exe
  2⤵
  PID:9336
- C:\Windows\System\ZzdughW.exe
  C:\Windows\System\ZzdughW.exe
  2⤵
  PID:9360
- C:\Windows\System\jTMRbQa.exe
  C:\Windows\System\jTMRbQa.exe
  2⤵
  PID:9380
- C:\Windows\System\YKzScMX.exe
  C:\Windows\System\YKzScMX.exe
  2⤵
  PID:9408
- C:\Windows\System\YADvtMq.exe
  C:\Windows\System\YADvtMq.exe
  2⤵
  PID:9428
- C:\Windows\System\KXbOknn.exe
  C:\Windows\System\KXbOknn.exe
  2⤵
  PID:9448
- C:\Windows\System\LCFNaqs.exe
  C:\Windows\System\LCFNaqs.exe
  2⤵
  PID:9472
- C:\Windows\System\KVksTPu.exe
  C:\Windows\System\KVksTPu.exe
  2⤵
  PID:9492
- C:\Windows\System\dEyBlOo.exe
  C:\Windows\System\dEyBlOo.exe
  2⤵
  PID:9516
- C:\Windows\System\TkVeGkC.exe
  C:\Windows\System\TkVeGkC.exe
  2⤵
  PID:9540
- C:\Windows\System\PoKjAad.exe
  C:\Windows\System\PoKjAad.exe
  2⤵
  PID:9560
- C:\Windows\System\PucjFsD.exe
  C:\Windows\System\PucjFsD.exe
  2⤵
  PID:9584
- C:\Windows\System\jRUkJHh.exe
  C:\Windows\System\jRUkJHh.exe
  2⤵
  PID:9604
- C:\Windows\System\YglsIaX.exe
  C:\Windows\System\YglsIaX.exe
  2⤵
  PID:9628
- C:\Windows\System\nxYxIeN.exe
  C:\Windows\System\nxYxIeN.exe
  2⤵
  PID:9648
- C:\Windows\System\rwBQOZb.exe
  C:\Windows\System\rwBQOZb.exe
  2⤵
  PID:9668
- C:\Windows\System\fzxBBLK.exe
  C:\Windows\System\fzxBBLK.exe
  2⤵
  PID:9692
- C:\Windows\System\XzFSQII.exe
  C:\Windows\System\XzFSQII.exe
  2⤵
  PID:9716
- C:\Windows\System\ptHJpCk.exe
  C:\Windows\System\ptHJpCk.exe
  2⤵
  PID:9740
- C:\Windows\System\yhEGVXG.exe
  C:\Windows\System\yhEGVXG.exe
  2⤵
  PID:9764
- C:\Windows\System\hKjwhPQ.exe
  C:\Windows\System\hKjwhPQ.exe
  2⤵
  PID:9784
- C:\Windows\System\GPaJdod.exe
  C:\Windows\System\GPaJdod.exe
  2⤵
  PID:9808
- C:\Windows\System\qqTplsc.exe
  C:\Windows\System\qqTplsc.exe
  2⤵
  PID:9832
- C:\Windows\System\QzyawJw.exe
  C:\Windows\System\QzyawJw.exe
  2⤵
  PID:9872
- C:\Windows\System\qsqJjVW.exe
  C:\Windows\System\qsqJjVW.exe
  2⤵
  PID:9892
- C:\Windows\System\SoIQErm.exe
  C:\Windows\System\SoIQErm.exe
  2⤵
  PID:9924
- C:\Windows\System\frPwHDt.exe
  C:\Windows\System\frPwHDt.exe
  2⤵
  PID:9956
- C:\Windows\System\DJAIMba.exe
  C:\Windows\System\DJAIMba.exe
  2⤵
  PID:9976
- C:\Windows\System\iTWRpSa.exe
  C:\Windows\System\iTWRpSa.exe
  2⤵
  PID:9996
- C:\Windows\System\lGBHLOc.exe
  C:\Windows\System\lGBHLOc.exe
  2⤵
  PID:10020
- C:\Windows\System\mAqCizF.exe
  C:\Windows\System\mAqCizF.exe
  2⤵
  PID:10044
- C:\Windows\System\XZLsgZN.exe
  C:\Windows\System\XZLsgZN.exe
  2⤵
  PID:10064
- C:\Windows\System\FZIAcrw.exe
  C:\Windows\System\FZIAcrw.exe
  2⤵
  PID:10088
- C:\Windows\System\bcgMkFc.exe
  C:\Windows\System\bcgMkFc.exe
  2⤵
  PID:10108
- C:\Windows\System\dEqFQsg.exe
  C:\Windows\System\dEqFQsg.exe
  2⤵
  PID:10132
- C:\Windows\System\uSdwTuw.exe
  C:\Windows\System\uSdwTuw.exe
  2⤵
  PID:10156
- C:\Windows\System\OWuDKcH.exe
  C:\Windows\System\OWuDKcH.exe
  2⤵
  PID:10172
- C:\Windows\System\zTTLIVd.exe
  C:\Windows\System\zTTLIVd.exe
  2⤵
  PID:10192
- C:\Windows\System\vEiThdo.exe
  C:\Windows\System\vEiThdo.exe
  2⤵
  PID:10224
- C:\Windows\System\XNWbKAO.exe
  C:\Windows\System\XNWbKAO.exe
  2⤵
  PID:8672
- C:\Windows\System\IgMUdBy.exe
  C:\Windows\System\IgMUdBy.exe
  2⤵
  PID:8744
- C:\Windows\System\TIGLyEx.exe
  C:\Windows\System\TIGLyEx.exe
  2⤵
  PID:7264
- C:\Windows\System\KjrjYpM.exe
  C:\Windows\System\KjrjYpM.exe
  2⤵
  PID:8156
- C:\Windows\System\fFiLqEp.exe
  C:\Windows\System\fFiLqEp.exe
  2⤵
  PID:8872
- C:\Windows\System\assKRFl.exe
  C:\Windows\System\assKRFl.exe
  2⤵
  PID:7340
- C:\Windows\System\nuOwsoP.exe
  C:\Windows\System\nuOwsoP.exe
  2⤵
  PID:7572
- C:\Windows\System\XfzxSYY.exe
  C:\Windows\System\XfzxSYY.exe
  2⤵
  PID:7676
- C:\Windows\System\gZVPIVb.exe
  C:\Windows\System\gZVPIVb.exe
  2⤵
  PID:7728
- C:\Windows\System\gqoqfYG.exe
  C:\Windows\System\gqoqfYG.exe
  2⤵
  PID:7772
- C:\Windows\System\rtTOLgi.exe
  C:\Windows\System\rtTOLgi.exe
  2⤵
  PID:6932
- C:\Windows\System\OoBQwKk.exe
  C:\Windows\System\OoBQwKk.exe
  2⤵
  PID:7616
- C:\Windows\System\lFdaFhQ.exe
  C:\Windows\System\lFdaFhQ.exe
  2⤵
  PID:8316
- C:\Windows\System\iRVJgva.exe
  C:\Windows\System\iRVJgva.exe
  2⤵
  PID:5836
- C:\Windows\System\keptvNJ.exe
  C:\Windows\System\keptvNJ.exe
  2⤵
  PID:10244
- C:\Windows\System\uKLhkTC.exe
  C:\Windows\System\uKLhkTC.exe
  2⤵
  PID:10272
- C:\Windows\System\OdDGVMQ.exe
  C:\Windows\System\OdDGVMQ.exe
  2⤵
  PID:10296
- C:\Windows\System\uSwKsAX.exe
  C:\Windows\System\uSwKsAX.exe
  2⤵
  PID:10316
- C:\Windows\System\ZySNarm.exe
  C:\Windows\System\ZySNarm.exe
  2⤵
  PID:10332
- C:\Windows\System\sUrdlAC.exe
  C:\Windows\System\sUrdlAC.exe
  2⤵
  PID:10580
- C:\Windows\System\adUKobw.exe
  C:\Windows\System\adUKobw.exe
  2⤵
  PID:10604
- C:\Windows\System\bbHXlBH.exe
  C:\Windows\System\bbHXlBH.exe
  2⤵
  PID:10628
- C:\Windows\System\uDrwqeb.exe
  C:\Windows\System\uDrwqeb.exe
  2⤵
  PID:10656
- C:\Windows\System\GDBcNVT.exe
  C:\Windows\System\GDBcNVT.exe
  2⤵
  PID:10676
- C:\Windows\System\JaxWDsa.exe
  C:\Windows\System\JaxWDsa.exe
  2⤵
  PID:10700
- C:\Windows\System\EHfyozv.exe
  C:\Windows\System\EHfyozv.exe
  2⤵
  PID:10724
- C:\Windows\System\VBGdZss.exe
  C:\Windows\System\VBGdZss.exe
  2⤵
  PID:10756
- C:\Windows\System\rjDgiAF.exe
  C:\Windows\System\rjDgiAF.exe
  2⤵
  PID:10780
- C:\Windows\System\qsOxUEZ.exe
  C:\Windows\System\qsOxUEZ.exe
  2⤵
  PID:10800
- C:\Windows\System\LLVZBZM.exe
  C:\Windows\System\LLVZBZM.exe
  2⤵
  PID:10824
- C:\Windows\System\OhwDLnm.exe
  C:\Windows\System\OhwDLnm.exe
  2⤵
  PID:10840
- C:\Windows\System\thFkesf.exe
  C:\Windows\System\thFkesf.exe
  2⤵
  PID:10860
- C:\Windows\System\rCupZlj.exe
  C:\Windows\System\rCupZlj.exe
  2⤵
  PID:10884
- C:\Windows\System\eEkcUyD.exe
  C:\Windows\System\eEkcUyD.exe
  2⤵
  PID:10908
- C:\Windows\System\zgStVwc.exe
  C:\Windows\System\zgStVwc.exe
  2⤵
  PID:10928
- C:\Windows\System\PCtxTwq.exe
  C:\Windows\System\PCtxTwq.exe
  2⤵
  PID:10948
- C:\Windows\System\maBsepZ.exe
  C:\Windows\System\maBsepZ.exe
  2⤵
  PID:10976
- C:\Windows\System\EjlLDKo.exe
  C:\Windows\System\EjlLDKo.exe
  2⤵
  PID:10996
- C:\Windows\System\TlQqCkP.exe
  C:\Windows\System\TlQqCkP.exe
  2⤵
  PID:11016
- C:\Windows\System\vWPJFWB.exe
  C:\Windows\System\vWPJFWB.exe
  2⤵
  PID:11036
- C:\Windows\System\RYbFRxz.exe
  C:\Windows\System\RYbFRxz.exe
  2⤵
  PID:11060
- C:\Windows\System\pBByBsZ.exe
  C:\Windows\System\pBByBsZ.exe
  2⤵
  PID:11080
- C:\Windows\System\dsdPFll.exe
  C:\Windows\System\dsdPFll.exe
  2⤵
  PID:11100
- C:\Windows\System\LmbqaFp.exe
  C:\Windows\System\LmbqaFp.exe
  2⤵
  PID:11144
- C:\Windows\System\OZMWsgx.exe
  C:\Windows\System\OZMWsgx.exe
  2⤵
  PID:11168
- C:\Windows\System\CmuJkUY.exe
  C:\Windows\System\CmuJkUY.exe
  2⤵
  PID:11188
- C:\Windows\System\HwUZKiF.exe
  C:\Windows\System\HwUZKiF.exe
  2⤵
  PID:11208
- C:\Windows\System\CuXzXKg.exe
  C:\Windows\System\CuXzXKg.exe
  2⤵
  PID:11232
- C:\Windows\System\tOPIufM.exe
  C:\Windows\System\tOPIufM.exe
  2⤵
  PID:11252
- C:\Windows\System\nISzODh.exe
  C:\Windows\System\nISzODh.exe
  2⤵
  PID:7884
- C:\Windows\System\EldlhHu.exe
  C:\Windows\System\EldlhHu.exe
  2⤵
  PID:7936
- C:\Windows\System\NRDEIHi.exe
  C:\Windows\System\NRDEIHi.exe
  2⤵
  PID:7964
- C:\Windows\System\EFAGQWf.exe
  C:\Windows\System\EFAGQWf.exe
  2⤵
  PID:8004
- C:\Windows\System\wSpnPKE.exe
  C:\Windows\System\wSpnPKE.exe
  2⤵
  PID:8108
- C:\Windows\System\cegSWKA.exe
  C:\Windows\System\cegSWKA.exe
  2⤵
  PID:8880
- C:\Windows\System\haHQIgc.exe
  C:\Windows\System\haHQIgc.exe
  2⤵
  PID:6692
- C:\Windows\System\hoZSsCs.exe
  C:\Windows\System\hoZSsCs.exe
  2⤵
  PID:9992
- C:\Windows\System\UYIwdvM.exe
  C:\Windows\System\UYIwdvM.exe
  2⤵
  PID:6324
- C:\Windows\System\HKEwPOh.exe
  C:\Windows\System\HKEwPOh.exe
  2⤵
  PID:9064
- C:\Windows\System\sLbfrox.exe
  C:\Windows\System\sLbfrox.exe
  2⤵
  PID:5716
- C:\Windows\System\GzgnGiW.exe
  C:\Windows\System\GzgnGiW.exe
  2⤵
  PID:8296
- C:\Windows\System\QgtVNZm.exe
  C:\Windows\System\QgtVNZm.exe
  2⤵
  PID:7828
- C:\Windows\System\XbfKsQl.exe
  C:\Windows\System\XbfKsQl.exe
  2⤵
  PID:5792
- C:\Windows\System\SApjCpj.exe
  C:\Windows\System\SApjCpj.exe
  2⤵
  PID:9052
- C:\Windows\System\ZYMeqpr.exe
  C:\Windows\System\ZYMeqpr.exe
  2⤵
  PID:8576
- C:\Windows\System\DzCfeIX.exe
  C:\Windows\System\DzCfeIX.exe
  2⤵
  PID:8652
- C:\Windows\System\GKXOPfF.exe
  C:\Windows\System\GKXOPfF.exe
  2⤵
  PID:8780
- C:\Windows\System\LvdblRl.exe
  C:\Windows\System\LvdblRl.exe
  2⤵
  PID:8884
- C:\Windows\System\eWhZYri.exe
  C:\Windows\System\eWhZYri.exe
  2⤵
  PID:6356
- C:\Windows\System\VfzyNLg.exe
  C:\Windows\System\VfzyNLg.exe
  2⤵
  PID:11268
- C:\Windows\System\oDnlavN.exe
  C:\Windows\System\oDnlavN.exe
  2⤵
  PID:11288
- C:\Windows\System\kTeQeTO.exe
  C:\Windows\System\kTeQeTO.exe
  2⤵
  PID:11308
- C:\Windows\System\ZdQgSRl.exe
  C:\Windows\System\ZdQgSRl.exe
  2⤵
  PID:11332
- C:\Windows\System\qFeobmd.exe
  C:\Windows\System\qFeobmd.exe
  2⤵
  PID:11356
- C:\Windows\System\mOBIRmW.exe
  C:\Windows\System\mOBIRmW.exe
  2⤵
  PID:11380
- C:\Windows\System\TTPmyav.exe
  C:\Windows\System\TTPmyav.exe
  2⤵
  PID:11396
- C:\Windows\System\OdqtORx.exe
  C:\Windows\System\OdqtORx.exe
  2⤵
  PID:11424
- C:\Windows\System\uICyrpg.exe
  C:\Windows\System\uICyrpg.exe
  2⤵
  PID:11440
- C:\Windows\System\mlmWGVW.exe
  C:\Windows\System\mlmWGVW.exe
  2⤵
  PID:11456
- C:\Windows\System\JDmcbHl.exe
  C:\Windows\System\JDmcbHl.exe
  2⤵
  PID:11504
- C:\Windows\System\ruLeIEN.exe
  C:\Windows\System\ruLeIEN.exe
  2⤵
  PID:11524
- C:\Windows\System\hwBXGCb.exe
  C:\Windows\System\hwBXGCb.exe
  2⤵
  PID:11548
- C:\Windows\System\dqUgSPL.exe
  C:\Windows\System\dqUgSPL.exe
  2⤵
  PID:11572
- C:\Windows\System\jMKXMDw.exe
  C:\Windows\System\jMKXMDw.exe
  2⤵
  PID:11596
- C:\Windows\System\rpepFgc.exe
  C:\Windows\System\rpepFgc.exe
  2⤵
  PID:11656
- C:\Windows\System\VwmcuAF.exe
  C:\Windows\System\VwmcuAF.exe
  2⤵
  PID:11724
- C:\Windows\System\cCMfhGZ.exe
  C:\Windows\System\cCMfhGZ.exe
  2⤵
  PID:11756
- C:\Windows\System\DDfimyg.exe
  C:\Windows\System\DDfimyg.exe
  2⤵
  PID:11772
- C:\Windows\System\allcjSU.exe
  C:\Windows\System\allcjSU.exe
  2⤵
  PID:11792
- C:\Windows\System\CrNbpFX.exe
  C:\Windows\System\CrNbpFX.exe
  2⤵
  PID:11816
- C:\Windows\System\MIVyhaZ.exe
  C:\Windows\System\MIVyhaZ.exe
  2⤵
  PID:11836
- C:\Windows\System\xtZywNU.exe
  C:\Windows\System\xtZywNU.exe
  2⤵
  PID:11860
- C:\Windows\System\jcCTxod.exe
  C:\Windows\System\jcCTxod.exe
  2⤵
  PID:11888
- C:\Windows\System\DlKHooW.exe
  C:\Windows\System\DlKHooW.exe
  2⤵
  PID:11908
- C:\Windows\System\veEZREm.exe
  C:\Windows\System\veEZREm.exe
  2⤵
  PID:11924
- C:\Windows\System\IlGeRxp.exe
  C:\Windows\System\IlGeRxp.exe
  2⤵
  PID:11944
- C:\Windows\System\GfjLHQQ.exe
  C:\Windows\System\GfjLHQQ.exe
  2⤵
  PID:11964
- C:\Windows\System\XhmagFR.exe
  C:\Windows\System\XhmagFR.exe
  2⤵
  PID:11980
- C:\Windows\System\DAGLZcZ.exe
  C:\Windows\System\DAGLZcZ.exe
  2⤵
  PID:11996
- C:\Windows\System\CIrYeaH.exe
  C:\Windows\System\CIrYeaH.exe
  2⤵
  PID:12024
- C:\Windows\System\gwfqUmB.exe
  C:\Windows\System\gwfqUmB.exe
  2⤵
  PID:12044
- C:\Windows\System\EMwNKfe.exe
  C:\Windows\System\EMwNKfe.exe
  2⤵
  PID:12064
- C:\Windows\System\vFrLAQc.exe
  C:\Windows\System\vFrLAQc.exe
  2⤵
  PID:12088
- C:\Windows\System\OVKvcgn.exe
  C:\Windows\System\OVKvcgn.exe
  2⤵
  PID:12112
- C:\Windows\System\ofgTDuy.exe
  C:\Windows\System\ofgTDuy.exe
  2⤵
  PID:12140
- C:\Windows\System\TEJhiHQ.exe
  C:\Windows\System\TEJhiHQ.exe
  2⤵
  PID:12160
- C:\Windows\System\QuahENE.exe
  C:\Windows\System\QuahENE.exe
  2⤵
  PID:12188
- C:\Windows\System\PFzHHla.exe
  C:\Windows\System\PFzHHla.exe
  2⤵
  PID:12208
- C:\Windows\System\ufNAkgH.exe
  C:\Windows\System\ufNAkgH.exe
  2⤵
  PID:12236
- C:\Windows\System\VYYOGyg.exe
  C:\Windows\System\VYYOGyg.exe
  2⤵
  PID:12264
- C:\Windows\System\etEQmFi.exe
  C:\Windows\System\etEQmFi.exe
  2⤵
  PID:10080
- C:\Windows\System\VgcozOD.exe
  C:\Windows\System\VgcozOD.exe
  2⤵
  PID:10168
- C:\Windows\System\TUrZInx.exe
  C:\Windows\System\TUrZInx.exe
  2⤵
  PID:10188
- C:\Windows\System\MqvjLti.exe
  C:\Windows\System\MqvjLti.exe
  2⤵
  PID:9152
- C:\Windows\System\uQzDkLN.exe
  C:\Windows\System\uQzDkLN.exe
  2⤵
  PID:9196
- C:\Windows\System\lWxoxgZ.exe
  C:\Windows\System\lWxoxgZ.exe
  2⤵
  PID:6980
- C:\Windows\System\yyQGeIe.exe
  C:\Windows\System\yyQGeIe.exe
  2⤵
  PID:4564
- C:\Windows\System\vZSFRze.exe
  C:\Windows\System\vZSFRze.exe
  2⤵
  PID:5236
- C:\Windows\System\YFyYJeN.exe
  C:\Windows\System\YFyYJeN.exe
  2⤵
  PID:6436
- C:\Windows\System\ccOFwFD.exe
  C:\Windows\System\ccOFwFD.exe
  2⤵
  PID:7524
- C:\Windows\System\dmOsTkk.exe
  C:\Windows\System\dmOsTkk.exe
  2⤵
  PID:7792
- C:\Windows\System\KEgyQvr.exe
  C:\Windows\System\KEgyQvr.exe
  2⤵
  PID:10752
- C:\Windows\System\iJxSLJN.exe
  C:\Windows\System\iJxSLJN.exe
  2⤵
  PID:10832
- C:\Windows\System\dhOdlqu.exe
  C:\Windows\System\dhOdlqu.exe
  2⤵
  PID:10872
- C:\Windows\System\GBUPylU.exe
  C:\Windows\System\GBUPylU.exe
  2⤵
  PID:11008
- C:\Windows\System\MdznEVn.exe
  C:\Windows\System\MdznEVn.exe
  2⤵
  PID:11184
- C:\Windows\System\FhKWtzp.exe
  C:\Windows\System\FhKWtzp.exe
  2⤵
  PID:7944
- C:\Windows\System\kJUhhrF.exe
  C:\Windows\System\kJUhhrF.exe
  2⤵
  PID:5652
- C:\Windows\System\tmEaaSU.exe
  C:\Windows\System\tmEaaSU.exe
  2⤵
  PID:12300
- C:\Windows\System\qroHZCC.exe
  C:\Windows\System\qroHZCC.exe
  2⤵
  PID:12328
- C:\Windows\System\DJQrTKQ.exe
  C:\Windows\System\DJQrTKQ.exe
  2⤵
  PID:12348
- C:\Windows\System\CaCPSvz.exe
  C:\Windows\System\CaCPSvz.exe
  2⤵
  PID:12368
- C:\Windows\System\AoOcbFK.exe
  C:\Windows\System\AoOcbFK.exe
  2⤵
  PID:12388
- C:\Windows\System\xFKTRXz.exe
  C:\Windows\System\xFKTRXz.exe
  2⤵
  PID:12452
- C:\Windows\System\jPXXjjA.exe
  C:\Windows\System\jPXXjjA.exe
  2⤵
  PID:12480
- C:\Windows\System\hweloRq.exe
  C:\Windows\System\hweloRq.exe
  2⤵
  PID:12508
- C:\Windows\System\DAvVtGb.exe
  C:\Windows\System\DAvVtGb.exe
  2⤵
  PID:12536
- C:\Windows\System\rwYcVoa.exe
  C:\Windows\System\rwYcVoa.exe
  2⤵
  PID:12552
- C:\Windows\System\ANkzxsg.exe
  C:\Windows\System\ANkzxsg.exe
  2⤵
  PID:12580
- C:\Windows\System\WmHnLSW.exe
  C:\Windows\System\WmHnLSW.exe
  2⤵
  PID:12600
- C:\Windows\System\opzihxk.exe
  C:\Windows\System\opzihxk.exe
  2⤵
  PID:12620
- C:\Windows\System\ceFnsbb.exe
  C:\Windows\System\ceFnsbb.exe
  2⤵
  PID:12648
- C:\Windows\System\GICvIDj.exe
  C:\Windows\System\GICvIDj.exe
  2⤵
  PID:12672
- C:\Windows\System\MpxazZg.exe
  C:\Windows\System\MpxazZg.exe
  2⤵
  PID:12692
- C:\Windows\System\CtuBgWF.exe
  C:\Windows\System\CtuBgWF.exe
  2⤵
  PID:12720
- C:\Windows\System\nxSTZry.exe
  C:\Windows\System\nxSTZry.exe
  2⤵
  PID:12764
- C:\Windows\System\ojCuzzT.exe
  C:\Windows\System\ojCuzzT.exe
  2⤵
  PID:12780
- C:\Windows\System\LyEhfKG.exe
  C:\Windows\System\LyEhfKG.exe
  2⤵
  PID:12804
- C:\Windows\System\wyJGQwz.exe
  C:\Windows\System\wyJGQwz.exe
  2⤵
  PID:12820
- C:\Windows\System\NQLYGcL.exe
  C:\Windows\System\NQLYGcL.exe
  2⤵
  PID:12836
- C:\Windows\System\kNjicPU.exe
  C:\Windows\System\kNjicPU.exe
  2⤵
  PID:12852
- C:\Windows\System\wYiycTw.exe
  C:\Windows\System\wYiycTw.exe
  2⤵
  PID:12868
- C:\Windows\System\IazHmNi.exe
  C:\Windows\System\IazHmNi.exe
  2⤵
  PID:12884
- C:\Windows\System\IcYaJWp.exe
  C:\Windows\System\IcYaJWp.exe
  2⤵
  PID:12900
- C:\Windows\System\fbMdCXw.exe
  C:\Windows\System\fbMdCXw.exe
  2⤵
  PID:12916
- C:\Windows\System\QvldWbv.exe
  C:\Windows\System\QvldWbv.exe
  2⤵
  PID:12956
- C:\Windows\System\ldSPlnn.exe
  C:\Windows\System\ldSPlnn.exe
  2⤵
  PID:12976
- C:\Windows\System\tmJhyfc.exe
  C:\Windows\System\tmJhyfc.exe
  2⤵
  PID:12996
- C:\Windows\System\ySiyzyP.exe
  C:\Windows\System\ySiyzyP.exe
  2⤵
  PID:13020
- C:\Windows\System\uCrFkqm.exe
  C:\Windows\System\uCrFkqm.exe
  2⤵
  PID:13044
- C:\Windows\System\yyXAoIz.exe
  C:\Windows\System\yyXAoIz.exe
  2⤵
  PID:13064
- C:\Windows\System\fsICCKN.exe
  C:\Windows\System\fsICCKN.exe
  2⤵
  PID:13084
- C:\Windows\System\PKAkLqZ.exe
  C:\Windows\System\PKAkLqZ.exe
  2⤵
  PID:13108
- C:\Windows\System\hYPCVaF.exe
  C:\Windows\System\hYPCVaF.exe
  2⤵
  PID:13136
- C:\Windows\System\irhTpih.exe
  C:\Windows\System\irhTpih.exe
  2⤵
  PID:13180
- C:\Windows\System\VshELtK.exe
  C:\Windows\System\VshELtK.exe
  2⤵
  PID:13200
- C:\Windows\System\dgENhIK.exe
  C:\Windows\System\dgENhIK.exe
  2⤵
  PID:13228
- C:\Windows\System\pACfNZh.exe
  C:\Windows\System\pACfNZh.exe
  2⤵
  PID:13248
- C:\Windows\System\xCQEiYL.exe
  C:\Windows\System\xCQEiYL.exe
  2⤵
  PID:13276
- C:\Windows\System\kMuidiZ.exe
  C:\Windows\System\kMuidiZ.exe
  2⤵
  PID:13300
- C:\Windows\System\lpDSMMG.exe
  C:\Windows\System\lpDSMMG.exe
  2⤵
  PID:8996
- C:\Windows\System\hTZZYKc.exe
  C:\Windows\System\hTZZYKc.exe
  2⤵
  PID:11828
- C:\Windows\System\xqGpFEf.exe
  C:\Windows\System\xqGpFEf.exe
  2⤵
  PID:10340
- C:\Windows\System\WGRkHFh.exe
  C:\Windows\System\WGRkHFh.exe
  2⤵
  PID:12096
- C:\Windows\System\yhXfqSA.exe
  C:\Windows\System\yhXfqSA.exe
  2⤵
  PID:12216
- C:\Windows\System\oPOnsKg.exe
  C:\Windows\System\oPOnsKg.exe
  2⤵
  PID:9456
- C:\Windows\System\yGdbFnu.exe
  C:\Windows\System\yGdbFnu.exe
  2⤵
  PID:9096
- C:\Windows\System\QURuptK.exe
  C:\Windows\System\QURuptK.exe
  2⤵
  PID:7148
- C:\Windows\System\YgmIYaC.exe
  C:\Windows\System\YgmIYaC.exe
  2⤵
  PID:10816
- C:\Windows\System\eeeoFSs.exe
  C:\Windows\System\eeeoFSs.exe
  2⤵
  PID:6412
- C:\Windows\System\GvZVmSM.exe
  C:\Windows\System\GvZVmSM.exe
  2⤵
  PID:12472
- C:\Windows\System\PrDAvCM.exe
  C:\Windows\System\PrDAvCM.exe
  2⤵
  PID:12560
- C:\Windows\System\qSXPHUL.exe
  C:\Windows\System\qSXPHUL.exe
  2⤵
  PID:12792
- C:\Windows\System\CXpvKcl.exe
  C:\Windows\System\CXpvKcl.exe
  2⤵
  PID:12496
- C:\Windows\System\YCpHkms.exe
  C:\Windows\System\YCpHkms.exe
  2⤵
  PID:10944
- C:\Windows\System\MCyKhQr.exe
  C:\Windows\System\MCyKhQr.exe
  2⤵
  PID:11096
- C:\Windows\System\nPXUvIE.exe
  C:\Windows\System\nPXUvIE.exe
  2⤵
  PID:9000
- C:\Windows\System\pJoioAg.exe
  C:\Windows\System\pJoioAg.exe
  2⤵
  PID:11604
- C:\Windows\System\BqvdHtg.exe
  C:\Windows\System\BqvdHtg.exe
  2⤵
  PID:12788
- C:\Windows\System\dLoppQW.exe
  C:\Windows\System\dLoppQW.exe
  2⤵
  PID:13192
- C:\Windows\System\erERehJ.exe
  C:\Windows\System\erERehJ.exe
  2⤵
  PID:9212
- C:\Windows\System\SvnKRRz.exe
  C:\Windows\System\SvnKRRz.exe
  2⤵
  PID:12224
- C:\Windows\System\YkjaGgj.exe
  C:\Windows\System\YkjaGgj.exe
  2⤵
  PID:10856
- C:\Windows\System\VCiekUp.exe
  C:\Windows\System\VCiekUp.exe
  2⤵
  PID:10648
- C:\Windows\System\bnmYCld.exe
  C:\Windows\System\bnmYCld.exe
  2⤵
  PID:1768
- C:\Windows\System\izqKUnR.exe
  C:\Windows\System\izqKUnR.exe
  2⤵
  PID:2692
- C:\Windows\System\rXToxXH.exe
  C:\Windows\System\rXToxXH.exe
  2⤵
  PID:8252
- C:\Windows\System\EBVVNIA.exe
  C:\Windows\System\EBVVNIA.exe
  2⤵
  PID:11388
- C:\Windows\System\KhqdnaB.exe
  C:\Windows\System\KhqdnaB.exe
  2⤵
  PID:11520
- C:\Windows\System\uRQbjlC.exe
  C:\Windows\System\uRQbjlC.exe
  2⤵
  PID:11644
- C:\Windows\System\MRBaCZq.exe
  C:\Windows\System\MRBaCZq.exe
  2⤵
  PID:10540
- C:\Windows\System\cjyiVAO.exe
  C:\Windows\System\cjyiVAO.exe
  2⤵
  PID:12776
- C:\Windows\System\ECznetP.exe
  C:\Windows\System\ECznetP.exe
  2⤵
  PID:1476
- C:\Windows\System\YxJTQcm.exe
  C:\Windows\System\YxJTQcm.exe
  2⤵
  PID:3724
- C:\Windows\System\EyoDpGi.exe
  C:\Windows\System\EyoDpGi.exe
  2⤵
  PID:4040
- C:\Windows\System\UHlpQpO.exe
  C:\Windows\System\UHlpQpO.exe
  2⤵
  PID:3520
- C:\Windows\System\DlWPkBK.exe
  C:\Windows\System\DlWPkBK.exe
  2⤵
  PID:6792
- C:\Windows\System\fJWsBqt.exe
  C:\Windows\System\fJWsBqt.exe
  2⤵
  PID:2332
- C:\Windows\System\OQUxMFY.exe
  C:\Windows\System\OQUxMFY.exe
  2⤵
  PID:1672
- C:\Windows\System\bGEAYqk.exe
  C:\Windows\System\bGEAYqk.exe
  2⤵
  PID:5032
- C:\Windows\System\ocxaEJK.exe
  C:\Windows\System\ocxaEJK.exe
  2⤵
  PID:3912
- C:\Windows\System\WaqrwIA.exe
  C:\Windows\System\WaqrwIA.exe
  2⤵
  PID:13052
- C:\Windows\System\aTEDmVY.exe
  C:\Windows\System\aTEDmVY.exe
  2⤵
  PID:10508
- C:\Windows\System\nkAKDLK.exe
  C:\Windows\System\nkAKDLK.exe
  2⤵
  PID:12280
- C:\Windows\System\fIKMIdH.exe
  C:\Windows\System\fIKMIdH.exe
  2⤵
  PID:12148
- C:\Windows\System\eviHVuo.exe
  C:\Windows\System\eviHVuo.exe
  2⤵
  PID:12876
- C:\Windows\System\WsCuIOC.exe
  C:\Windows\System\WsCuIOC.exe
  2⤵
  PID:13076
- C:\Windows\System\vazxUtZ.exe
  C:\Windows\System\vazxUtZ.exe
  2⤵
  PID:10100
- C:\Windows\System\Bbvuywl.exe
  C:\Windows\System\Bbvuywl.exe
  2⤵
  PID:12132
- C:\Windows\System\SdoBxMx.exe
  C:\Windows\System\SdoBxMx.exe
  2⤵
  PID:11620
- C:\Windows\System\kiEjXfv.exe
  C:\Windows\System\kiEjXfv.exe
  2⤵
  PID:11896
- C:\Windows\System\FcRgTwr.exe
  C:\Windows\System\FcRgTwr.exe
  2⤵
  PID:4896
- C:\Windows\System\ZgDZXQN.exe
  C:\Windows\System\ZgDZXQN.exe
  2⤵
  PID:7288
- C:\Windows\System\BAAOwJd.exe
  C:\Windows\System\BAAOwJd.exe
  2⤵
  PID:3484
- C:\Windows\System\YWJxRpz.exe
  C:\Windows\System\YWJxRpz.exe
  2⤵
  PID:2212
- C:\Windows\System\MsroJjM.exe
  C:\Windows\System\MsroJjM.exe
  2⤵
  PID:2004
- C:\Windows\System\ZZfCyOX.exe
  C:\Windows\System\ZZfCyOX.exe
  2⤵
  PID:8948
- C:\Windows\System\IFXKIxu.exe
  C:\Windows\System\IFXKIxu.exe
  2⤵
  PID:8840
- C:\Windows\System\XCyBpSy.exe
  C:\Windows\System\XCyBpSy.exe
  2⤵
  PID:10988
- C:\Windows\System\XlzYtxs.exe
  C:\Windows\System\XlzYtxs.exe
  2⤵
  PID:9948
- C:\Windows\System\jDgczHy.exe
  C:\Windows\System\jDgczHy.exe
  2⤵
  PID:4708
- C:\Windows\System\QvytcMv.exe
  C:\Windows\System\QvytcMv.exe
  2⤵
  PID:12060
- C:\Windows\System\UiDufIt.exe
  C:\Windows\System\UiDufIt.exe
  2⤵
  PID:1980
- C:\Windows\System\GwRkJDB.exe
  C:\Windows\System\GwRkJDB.exe
  2⤵
  PID:888
- C:\Windows\System\LAvGqUG.exe
  C:\Windows\System\LAvGqUG.exe
  2⤵
  PID:5000
- C:\Windows\System\HjEPcqY.exe
  C:\Windows\System\HjEPcqY.exe
  2⤵
  PID:4932
- C:\Windows\System\WsbKAeg.exe
  C:\Windows\System\WsbKAeg.exe
  2⤵
  PID:13292
- C:\Windows\System\dQVFHnQ.exe
  C:\Windows\System\dQVFHnQ.exe
  2⤵
  PID:9548
- C:\Windows\System\WfuQLtF.exe
  C:\Windows\System\WfuQLtF.exe
  2⤵
  PID:9884
- C:\Windows\System\oDOyzGu.exe
  C:\Windows\System\oDOyzGu.exe
  2⤵
  PID:13296
- C:\Windows\System\ZAnUVKj.exe
  C:\Windows\System\ZAnUVKj.exe
  2⤵
  PID:3632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zcz1adz4.5z2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BIEYTXf.exe

Filesize
2.0MB

MD5
cdafa7dfb325603d53c4550636fc1b97

SHA1
6ab1eda7275a06cd15555fd086036fafbc781a8f

SHA256
b7dd591c1e332ab739bdf466d035a070130794e9f7966a5bd787b89dba6f6e63

SHA512
425954623d2b88af08d492446a2fddbc6f779b5f11771b61eb424f979697c7f6c53857baabecda636aa4e4719b27d0bab1d28f068fd119a8cd9dba9c2fc925fe

Download Submit
C:\Windows\System\CRtPMkR.exe

Filesize
2.0MB

MD5
349b69dcf1e20d0686e5ce10c7b0ef56

SHA1
b874dad2b4e615018f3bd9ec4566e388cae88f1c

SHA256
0f71ce9a1745f4c2d9cc87952e30414a20cabca5b661757d324bb765d7f0c526

SHA512
c6231dbf3ff015e6a1636c87f1d4891a051bfc4b6e29618ec33799f94e7622cd9d37bea2376ece2f6b8fdf2dd2c35e308216855beca2682ee0cf3791c2f95a14

Download Submit
C:\Windows\System\FoFgyZE.exe

Filesize
2.0MB

MD5
fefd263fe84206d9da47def1835a89df

SHA1
16d85814fc9f79cf0d9ab3ee6b579554816c203c

SHA256
3b8a79bdf94ed85202a8ea4d7b22084c18337f0810fc4375bb2c080f247df27f

SHA512
a432afdeefeac841716569a8e58fd5e960a71e12eab1d8bda891dae183ef86f3db2dfacedb576e585a366a6c3515a82b2492aff4eddf2c1e289186b4bce13ba6

Download Submit
C:\Windows\System\HUPbjps.exe

Filesize
2.0MB

MD5
a0ff6c9e3486d1c186c3228e6a90d926

SHA1
479a1de6f2a79bab5b5880ed8548f8c25693494c

SHA256
2982bbad56bedfab4e0e0e9876d1d77f13b37e454c838dbf649628443cb2a56f

SHA512
8dcbdbe59a6c36c111b570896e6aa2a13516501120f319d85da864681bdec1ba791e8397ec8433f54cf05b6557356c445869fce124d68efdaed5f1babcf55eb6

Download Submit
C:\Windows\System\ISKfUgo.exe

Filesize
2.0MB

MD5
c283ccdb598a66e37bf006f3c7bf57b5

SHA1
a31aa7db4564a7afa3478afe49168bb61ae108e0

SHA256
182afe35e2db5d85367bffabf455e74c48d4540e78628988ee881543347a2ff8

SHA512
b266c30e0fd3c09e828e6105ad5b23fe9de4458a3dcf3b18fc8318763728e7bab15685b3ebb154a3ce271eccdd4525fab94f5de73c652402bf3488e37310d0c2

Download Submit
C:\Windows\System\MGdvWLT.exe

Filesize
2.0MB

MD5
fe0a7e44ca7b1c1a1ae91fa621561000

SHA1
77168786951409f0b9d916ac36e6a1f13564df50

SHA256
ad3cf64038e9da38ebbc8530d0c6f29dc9702f95a9b911f1214c56d6d66ad235

SHA512
63558743f8461ad693c0038d06b28a0238907fcb8ac6e93bf78fad0b8a7837f439ff3acaca1db668654ee6b6295c65eda5e3ba089d467885a7c04f4eb3ba585e

Download Submit
C:\Windows\System\MOHvtIg.exe

Filesize
2.0MB

MD5
1f732a7ed265840845e1e8be9e15d22d

SHA1
fb8b9528d85a001c240a68f10890e5f439d0f3f7

SHA256
8bf65604123d43814123cf02f8adb9aabf492a5b02a20a38762cbad30a1adfb3

SHA512
c70e7c00061c052daf4d67ae999cd3e13fc8ab6ddcb6983dd93ec077617a52a68644526e8a59ff522311725932b133ead1449f95305310fcc51c282d456e40af

Download Submit
C:\Windows\System\Oczgqds.exe

Filesize
2.0MB

MD5
2d88145f5261d4ab02077abee5ee9d93

SHA1
b599cef9c9b64ac5cbeb850e60bae521b48e2064

SHA256
ff4d6142a2ac1d2e84b9b5f7ff9659b7cb191a5305fed1bda08575cd92a4baaf

SHA512
6b9614d511d54a9c6a7c4ae27c1b48810f177b9a4025bcb76c059991ff326eac44171bb671e381a66277c665c018ecf2ff22cce18bed6ebbac1cfe4ed1bf747a

Download Submit
C:\Windows\System\QNyLLNm.exe

Filesize
2.0MB

MD5
033d2fdf52dcfe008a9208c80d862749

SHA1
ba173321b4e0aec71cbad16f836a737b4cab0e9c

SHA256
7842bdd1f03102794368f813b655c707d2e724e5e03b00417e45bf10a7f18bdf

SHA512
6c4e8f691117203e0c22f85d77c91512e1e37630c5ada8cfef36bb9b0761b40809d6b4f7bec0a73c3affd615cd14317f0dcdfd524144877288f4b65b9f177263

Download Submit
C:\Windows\System\RdFTPKs.exe

Filesize
2.0MB

MD5
acc2373f87725ced98cce6ab9ba6ff78

SHA1
5ec066a838a2a74c2db9b9c3704d063c79262ac1

SHA256
da0967bb569f5242712e6d7248b878299d5cc89a56c8e6c8bcccdbc0cff0c6d7

SHA512
af16909ec86c2ea342984f638cc531501fe34ed513ddac2b2f10a493a247e0bdd46c19140598ceb2b0ccc414ad5dc9afb7ba5ebd5e32301939930ac23676ba76

Download Submit
C:\Windows\System\RdZSbBU.exe

Filesize
2.0MB

MD5
3cf0b4bde0c4fc18c737628db1d281d4

SHA1
8e841def376196f8ca9a5bba6bc950927ff3efbf

SHA256
66b6fdacf1dd3b0a2c361030883b38462c1135c6f758309daf42751d561d0f74

SHA512
dd9a4b42d9417d1f510c728f68daa77b209ae888d694377fb8b32ef90516f551e62f09a55f668ec5adb45c714e0eac98df9fd0454f11a39b29908a8c7ac8867d

Download Submit
C:\Windows\System\TAIqSYe.exe

Filesize
2.0MB

MD5
7fe162eba4a2891db6f62c0b2697ab9f

SHA1
668408c79cc68224a7ec401e6e4c44f66cd769d4

SHA256
32acf757e4b529f66240d16c6aa821a18bc5d9cc0864bd54450b6671c4574094

SHA512
b62244c30941198fdda389bc7b72af506452a554edc4561c54c53a9a93135edf97f1cc991818c46e92fdc24014f80d9749629bfaa8e9f40dd0155a30aa88732c

Download Submit
C:\Windows\System\TMiasbQ.exe

Filesize
2.0MB

MD5
7f7c8dfa91ec45dc3a2b6e7f877f3308

SHA1
6f98305db8a58523515547721ee83f90ee23aa0b

SHA256
c98b1d1a34ba3af6170f1c85269580f6fdd125ae76cbb265a690d6371994923f

SHA512
66729420249c4e2ae8e33cab9109faac4fc8c057cfacb63dbb6b13579c95001e1a7a5e8de3469d683423f78dab3f104ab3567f0d2d9f6fb8addf674054dad6d9

Download Submit
C:\Windows\System\TZjMfOW.exe

Filesize
2.0MB

MD5
d9d7cf9e7205ef20911fcb767fc7fd0c

SHA1
2087b0894ef41e2cc5cc374e7e4bf83dcd057b22

SHA256
7c75db37507c9d4996e77f049d6d8ff53edd165a747030277ac20d53337d778f

SHA512
052862614465ffe9e384aa1f6c1528c328b195cdaef9d39d16ec143e188acd2d46e9efc5942179d89b72916ea0e438b10a479392f6832b26446c9ac3ef978326

Download Submit
C:\Windows\System\VAWuFJC.exe

Filesize
2.0MB

MD5
c63fd5322d463e4584fa3bec1cee074d

SHA1
601a592ede3355708de5c3d31c7e5ec38d225366

SHA256
06e389d779312281ab4ddf8885e44597d13f5c079305ff4a4770fb28668b0013

SHA512
f28fd9bd77c0eef26018581121bd92f370465c049c1209b19c76b31925e1533a3dedc3ffd49bf1cc1dd8eeb756634ea53965e5807a63d6040d507a5f9e98224c

Download Submit
C:\Windows\System\WlLYuVQ.exe

Filesize
2.0MB

MD5
de853e8e86e3c509dc82f757613ef53a

SHA1
ecebd9b800a737fef2759fe845b70367eb04796b

SHA256
e6806a79ff383cd47d394be1590e4ff7f91346ef5ac93b2ccdc2022947742ed7

SHA512
4eab62ad39f63cb0ac0b04bc7511949fb18c6c03bd78d3021bbc55cc68623be8a2c530e1a2e9b68bb56634d044c65c0627406e30f9d7b19c5433e4c9eff5c38d

Download Submit
C:\Windows\System\ZuQERzM.exe

Filesize
2.0MB

MD5
d0300a9f7c3c936b8bc0f5db6947ddc5

SHA1
32786c11888915c55029244fc382a42a12203263

SHA256
939cc9ebdb0ec1638d2cf86fef69d38b6b1c69f303ee6c6239b05c5b7681510c

SHA512
59015305ec808dd199e3be30fb67a8af0e9dd3902b1268ea3a13b67b6d1abd65804259d0ab3a2491b3450e8655b70c6a622de00a1721bc9a581bfbf8c11cc5f7

Download Submit
C:\Windows\System\ZzeGLet.exe

Filesize
2.0MB

MD5
7686f3620a42dea15e9831203093c3a8

SHA1
51a1adccd4daf850f27bbb22b2ae07d2d7ca88c6

SHA256
4212071cb6f1911f43ad2fcdab7cef50911e094198ea6cfb3bae2fb7e10adbbf

SHA512
6eced2ecd0420d45fe57594fa4493833dffbe3427f0d810b9773cd0fc84b45ac807ae4f701aa133b966d6b083b4f64d8ca7e0bac7e36ca51e59f277e21c7c124

Download Submit
C:\Windows\System\cARosHM.exe

Filesize
2.0MB

MD5
8ee7c18aa5e5f0da29fa8117e1c30dff

SHA1
a3eabcbab337e395ba483b72b84e49b1384cac8b

SHA256
242282b87a58e5541ffdabcff5bb90d0a9e84e625c1a96bbedf40bb4cce7ab1f

SHA512
4140ce7a2cd20c49775d693a90f463c26709d0ffb3b3af536fac806d8c3c34daaf1210bdec4d94a9c71a0d8117ec1cb8c5d3e84ccb595e870b8de13d6c3e2d3f

Download Submit
C:\Windows\System\cpiwsjB.exe

Filesize
2.0MB

MD5
11ac0ec3e211e8c96f88234dbeab4be8

SHA1
d56f53073a6b09c924921a54d2e60825564351e4

SHA256
6729e4fa2acd1a1c1d5c98e6ad1ec29a3742414dcffe444089422b60edcafb32

SHA512
2e18c13b563cafbdb922aa8d904c7c9f368578ff63801846db645a325662f8aa52f8da083ede5518a69254ec1b5798bf4d7d5508b9d3fdb774b27f0117c5fe47

Download Submit
C:\Windows\System\cwcnLld.exe

Filesize
2.0MB

MD5
f42f479cefc52d68c031bb20dd7d3eae

SHA1
2b2e00d6406f08f51d4ca8a390d408f465eeb239

SHA256
517626bcec380b5e9252182a2045b430441d7aac0ca0a1785f507e5fb12b6c86

SHA512
c8ccaf32346317b52caff39ab50b57e47476c8298d97f061533e740080bab704548a53ed519f98e924ddecf1854f133977a3b7705baa44c3fe59aa6c2852e8b8

Download Submit
C:\Windows\System\dRyjWjz.exe

Filesize
2.0MB

MD5
8707226cac1c607c1cb875c83cf32bb9

SHA1
a8ecf038a07c941748f9a54620b342c1d5bd646d

SHA256
d938c8e1633ce69a1edfe73d6df3c47043288d4161e5c85b9f66ee8bb387b7a3

SHA512
127a1b8ffad0d306e156ffaa80804b3edd05660893d2a9912981b7a2b8b4051cf9f9c468aa21a6b6c162033255bd521a3d138bffb31a026fea5f3db927186255

Download Submit
C:\Windows\System\dZPKSuf.exe

Filesize
2.0MB

MD5
d2337a1bb11a58f66e5a4151aea6461c

SHA1
1c14972ca648b54adf324a6498b6242bd2ed6603

SHA256
e7275f29eb8c09995eae56bf7a77c21a7097be7b10c0370305f2ff0462cc577b

SHA512
6645790751c979dce5e0ebaaf2dfc96f34512d245b1c4d2acb1e887cbb59e455558cf004d0f9749c67d1432626baec47a1ddafc432868239da1e644f16f10a59

Download Submit
C:\Windows\System\eNDYyBw.exe

Filesize
2.0MB

MD5
da7dbd9f4cb9dfe037211978625ae887

SHA1
994c6e40d651c8d210a31c096cdd098c73f49806

SHA256
bcedd60727d5c402ae9d04ecb48456972a6c1b5d305978e778367da526df5198

SHA512
1d7e5233bf9ea9df17366c711153c9c3bafe7bfa9c12ea93fb1ce50e6c08f3a8e0834df199db85b189723e93f7565da73ea2ef7d07a55533fb902d3e89bc490f

Download Submit
C:\Windows\System\fjxqwjF.exe

Filesize
2.0MB

MD5
316730bc83ef22268f9a9b6966979c9b

SHA1
c2476c69a7f563442969ba33eef42d5ed2149320

SHA256
b78ceca907de1e443af9bd3a25f8fdbfdc21daaf67084cac91593f9e45fd533e

SHA512
2bc3ee067442664bfb0cb865f22e6b3c4edc2b1e3dff24d77c6e0e0455d92b85b347930cba345e7b2f819811c1df6042fce9a0e71ab2c7a0cf2d025f6cda65df

Download Submit
C:\Windows\System\fpIwoQw.exe

Filesize
2.0MB

MD5
20d57c668b6739ba449847b864b2400d

SHA1
850c3480af2f883b4917a75e48b9503fbbe701f5

SHA256
9de93af1a362299c16f0da21129ff986bc6309719dd7d18a77360a0beab11384

SHA512
7aff64da787d84868a287e5a4f39bfa21fb0fb9b83554ad5bf0dba289e4000825f130494b048c2e9dfadc11052b1f2ce2082741ff8287136f021bc10232b3864

Download Submit
C:\Windows\System\hxJeDOU.exe

Filesize
2.0MB

MD5
f2a06bb19b84298e24ecc16a78b70cc7

SHA1
d2f189265b9308de6f0f5eb02bf387ef5dc6f528

SHA256
b2971264d647102378bc24506c6979f46a389796912eb33d05302b21c6a9f365

SHA512
d9ea2407886d05708280acf5b33ef2d82dfc83f1f59f108f5750674f5f23a6d8bfa08d62b08db53e7254aad3a7408639a842b47b68d7619168d62ba035335b9f

Download Submit
C:\Windows\System\lTvVNIs.exe

Filesize
2.0MB

MD5
c938f73841a7b205fef4464ffcc663e4

SHA1
1d80f104ea490a2bd6cbfdb32bbe387aee4dcccc

SHA256
17b9a38675c6e0f9b4060b9a6d89ce30937cbab70b6dedcff2ecb63bf43fbc81

SHA512
aa2a3f4a0c461372f6dfe66bad230ee862d52d97f2810c9022c84fdb6ce60cd098b3b887108cff944b125acdf26dfefc02f3d276fcce67475b944bd02b6f391c

Download Submit
C:\Windows\System\nrVlSQs.exe

Filesize
2.0MB

MD5
a84f07ebc0589d6318c889085877768e

SHA1
8791afaa6337cadef65087413222f060b404b4f6

SHA256
5c36797fc26edaf0256fa60036afade7416f5bb0878bd611a4e9776633db7d5e

SHA512
2f0ad8fea230e088ab5eeffc7e423f7d18fc7f0f2ac0af39b16d828218898346357562cfa176f08ea4b8fa77e5960a14fc35e61bcaa5e21a8c05c31265641d02

Download Submit
C:\Windows\System\oGVMMxs.exe

Filesize
2.0MB

MD5
3314e6516a186f0e85a59e95c65f3543

SHA1
72a7168f87840dae9b54ebfb5dbdb95e360ea1c4

SHA256
4cdf082993255a25dc778571fb4f85203a043d72651c1797069bce171ba0cadf

SHA512
6575b43dfb7e0fe55383a47f45dde0031c48766b0f989107f90b16dc733c8bc82329e732f0e8f18a7a81aeb3c0eca4c9ad1cc34bd5318f966e5413cc54cc3623

Download Submit
C:\Windows\System\oLBmJfl.exe

Filesize
2.0MB

MD5
c23b1e66341a13e5f60a779a5a78216a

SHA1
bbab4ce3012d829c4e10dcec49c680a06c94dfc1

SHA256
0d922b2976cf3b9c883c6e0b2a25a5900b628c27580b989aef49efbd3af08c70

SHA512
d9cef516b700e4c6f0503a5945a583ae641b951cf54727b52a9717816a1055d22f47eaff6d3efc77c9b98bfa0fda863af9b90be355fbcaa372af3d6561bc2184

Download Submit
C:\Windows\System\qBYTrVu.exe

Filesize
2.0MB

MD5
b255849cb2581ebe2c81aa31b0139d84

SHA1
e9cea59a31df6f45f23c1dcb09c942d8d827398e

SHA256
a5420a2d198d9b14bdaa30ad1842e7e65c0fa7530be4caaa799008fabcfe98d5

SHA512
133bf3031d600e1b0dd497312e23d2638b93804992c5791710e650e4327077f48e637ac4576bb7a5d8c4dee7390ad20b76d54922bc6c4be1c5e21801cd0edd14

Download Submit
C:\Windows\System\rSsjSuT.exe

Filesize
2.0MB

MD5
07b65750d5971aa60327a5a9f2532285

SHA1
46f47e50c3791b1a50da99a192d9178ee21aca4f

SHA256
07900365a1e8a69e48f6650bc30a3bb9a60a7b9ae8c7a9ad0e5456e1c9e98591

SHA512
0d633b1f9353dba05d34cfbb8549104fa625292b0b0f3cbbd1f8045ed855d0dbb7a85f0d382d00240e45ac125374dad00703c1b690cbc4776016d98dadab2270

Download Submit
C:\Windows\System\sGcsEVe.exe

Filesize
2.0MB

MD5
e2860832c56f0a7f48bccad6bf11ba4a

SHA1
deada7004331dbf0760e9830949714a1c0afed4b

SHA256
c22cb9170fff61d0e43eea32f758b3e73edd28ddb1604cb851ef0e78a55e4023

SHA512
ee6ba24c0286c4c3ac58c4a507821c614b2f54d113a92b518275ea0ca2873b71b21d868fddd9d38d6df6cf4dc45f1d05805965546dc8a4c92cd000294eb87d1f

Download Submit
C:\Windows\System\slZldWP.exe

Filesize
2.0MB

MD5
747af7c70ad9e1f202cb69d38598284f

SHA1
c4f88b969bb14b36e836483aac46d26ed2f27145

SHA256
4a94b5b1b29d5d154137d81c1ea4de81061250d939d9c6d480279f3464e3e027

SHA512
db1a304c15612a9de8ace71864151c2e90f2ae9f3b4a193b56d239ab6c0cc305dcfc6a82b851aa31f62d2bba1956fbc79322b59983a41ab578e6400d7f7e023a

Download Submit
C:\Windows\System\toWzmJw.exe

Filesize
2.0MB

MD5
08b333a32857a95230dfaaa14bf51d6f

SHA1
de3067bef1f00bb905f794308b4802d59d4c4e56

SHA256
22dbdcad1ed5e43c4be0368b9c790d94f558cb3bfbfd65ab2963a2523fea5501

SHA512
5fa91d19d8d7649a5eec10f4662dd38a2c227886897de60cdc5c0059fb1de05018c37239762629c63c243305922f6f147a8a183cfc43e31517d66dce7827748b

Download Submit
C:\Windows\System\ttXNMcV.exe

Filesize
2.0MB

MD5
ca7df7388cd063b028a9dc584bae029a

SHA1
b260cbf68ea0a301c9d8250ee784677664b08899

SHA256
5905db3f23b6562d00c946cbc67e1108736ac0b0f078359e9012314afae59b23

SHA512
1e3626e574985c8fe225e4d1bab4e71f9a965cd8f8cfeddd1450b71d4aad3d3d00fcbe757bef85fc54016a4648fe741e8853267add24e2ccf4b484993e67fc1b

Download Submit
C:\Windows\System\xLTAHjM.exe

Filesize
2.0MB

MD5
ca1080c3571867ee60eca9ac0ba586c8

SHA1
9bc733d7f4486117731511ed278269240bf5155f

SHA256
261d04fffda520e71a2a0f903c82562b232ec27b9a6b59803391ff58a05b7541

SHA512
826e4e7f7a68ab5d5ad0efa249a70155d2ca0466951b94e36f754629dcb74701275e476a87b1d6ceb1eeb70b6f6a59a770b93dcbd5ddb88e425c1eaf26aec694

Download Submit
C:\Windows\System\zFMMJqM.exe

Filesize
2.0MB

MD5
ae71ab1d01640dfb4376e8f03ce3c409

SHA1
b58fd0b21dabdb56ef8c2ff70c542f2632272bea

SHA256
d6963703124f4f82e107a02f2db28a8344c0493b914121b4f650ae7c7f28202f

SHA512
d74d4788396b4917c67daeaf4f80a44f900fecfacfeb6c73c76f59e47c4076d2a70a186085005ca978cf5da01a9a9a56949c01a8bcc44421ff52676454d28504

Download Submit
C:\Windows\System\zOIzNeV.exe

Filesize
2.0MB

MD5
d5ef9efa5ef844af02faf219ee9287c6

SHA1
f6eae5f62253535f1f2451eaad261a3f723c746e

SHA256
ed46ac48af1acba3a5d77b16adb8b8646dd2826eff4e879b8a49f2cdf6d2d21c

SHA512
1ae21583b3f51d5b22353c3fe05226802dcf6723400a75bd3ccc51adb7e809f8a21488b26f91315dab67bf7db18ee0321b07d33675834544791b4f2d6ed9e68c

Download Submit
memory/212-3883-0x00007FF71BCB0000-0x00007FF71C0A2000-memory.dmp

Filesize
3.9MB

Download
memory/212-141-0x00007FF71BCB0000-0x00007FF71C0A2000-memory.dmp

Filesize
3.9MB

Download
memory/408-85-0x000001923E6F0000-0x000001923E712000-memory.dmp

Filesize
136KB

Download
memory/408-61-0x000001923DC80000-0x000001923DC90000-memory.dmp

Filesize
64KB

Download
memory/408-60-0x000001923DC80000-0x000001923DC90000-memory.dmp

Filesize
64KB

Download
memory/408-59-0x00007FFAE6EB0000-0x00007FFAE7971000-memory.dmp

Filesize
10.8MB

Download
memory/468-3891-0x00007FF7FA060000-0x00007FF7FA452000-memory.dmp

Filesize
3.9MB

Download
memory/468-282-0x00007FF7FA060000-0x00007FF7FA452000-memory.dmp

Filesize
3.9MB

Download
memory/816-3943-0x00007FF669D20000-0x00007FF66A112000-memory.dmp

Filesize
3.9MB

Download
memory/816-535-0x00007FF669D20000-0x00007FF66A112000-memory.dmp

Filesize
3.9MB

Download
memory/1088-3888-0x00007FF68CAD0000-0x00007FF68CEC2000-memory.dmp

Filesize
3.9MB

Download
memory/1088-205-0x00007FF68CAD0000-0x00007FF68CEC2000-memory.dmp

Filesize
3.9MB

Download
memory/1240-3910-0x00007FF6363D0000-0x00007FF6367C2000-memory.dmp

Filesize
3.9MB

Download
memory/1240-497-0x00007FF6363D0000-0x00007FF6367C2000-memory.dmp

Filesize
3.9MB

Download
memory/1564-383-0x00007FF6CE800000-0x00007FF6CEBF2000-memory.dmp

Filesize
3.9MB

Download
memory/1564-3893-0x00007FF6CE800000-0x00007FF6CEBF2000-memory.dmp

Filesize
3.9MB

Download
memory/2020-538-0x00007FF7FC2C0000-0x00007FF7FC6B2000-memory.dmp

Filesize
3.9MB

Download
memory/2020-3906-0x00007FF7FC2C0000-0x00007FF7FC6B2000-memory.dmp

Filesize
3.9MB

Download
memory/2088-536-0x00007FF6B8E30000-0x00007FF6B9222000-memory.dmp

Filesize
3.9MB

Download
memory/2088-3881-0x00007FF6B8E30000-0x00007FF6B9222000-memory.dmp

Filesize
3.9MB

Download
memory/2200-3897-0x00007FF6CE680000-0x00007FF6CEA72000-memory.dmp

Filesize
3.9MB

Download
memory/2200-537-0x00007FF6CE680000-0x00007FF6CEA72000-memory.dmp

Filesize
3.9MB

Download
memory/2312-3912-0x00007FF7B7E20000-0x00007FF7B8212000-memory.dmp

Filesize
3.9MB

Download
memory/2312-540-0x00007FF7B7E20000-0x00007FF7B8212000-memory.dmp

Filesize
3.9MB

Download
memory/2316-435-0x00007FF697830000-0x00007FF697C22000-memory.dmp

Filesize
3.9MB

Download
memory/2316-3908-0x00007FF697830000-0x00007FF697C22000-memory.dmp

Filesize
3.9MB

Download
memory/2944-1-0x0000021710F80000-0x0000021710F90000-memory.dmp

Filesize
64KB

Download
memory/2944-0-0x00007FF6925E0000-0x00007FF6929D2000-memory.dmp

Filesize
3.9MB

Download
memory/2976-3900-0x00007FF613DA0000-0x00007FF614192000-memory.dmp

Filesize
3.9MB

Download
memory/2976-539-0x00007FF613DA0000-0x00007FF614192000-memory.dmp

Filesize
3.9MB

Download
memory/3104-14-0x00007FF64CA10000-0x00007FF64CE02000-memory.dmp

Filesize
3.9MB

Download
memory/3104-3876-0x00007FF64CA10000-0x00007FF64CE02000-memory.dmp

Filesize
3.9MB

Download
memory/3272-3895-0x00007FF6C2A60000-0x00007FF6C2E52000-memory.dmp

Filesize
3.9MB

Download
memory/3272-328-0x00007FF6C2A60000-0x00007FF6C2E52000-memory.dmp

Filesize
3.9MB

Download
memory/3344-3899-0x00007FF79D540000-0x00007FF79D932000-memory.dmp

Filesize
3.9MB

Download
memory/3344-288-0x00007FF79D540000-0x00007FF79D932000-memory.dmp

Filesize
3.9MB

Download
memory/3616-240-0x00007FF6085B0000-0x00007FF6089A2000-memory.dmp

Filesize
3.9MB

Download
memory/3616-3903-0x00007FF6085B0000-0x00007FF6089A2000-memory.dmp

Filesize
3.9MB

Download
memory/3784-534-0x00007FF7DE930000-0x00007FF7DED22000-memory.dmp

Filesize
3.9MB

Download
memory/3784-3914-0x00007FF7DE930000-0x00007FF7DED22000-memory.dmp

Filesize
3.9MB

Download
memory/3868-177-0x00007FF6183A0000-0x00007FF618792000-memory.dmp

Filesize
3.9MB

Download
memory/3868-3886-0x00007FF6183A0000-0x00007FF618792000-memory.dmp

Filesize
3.9MB

Download
memory/4028-3884-0x00007FF6FDC00000-0x00007FF6FDFF2000-memory.dmp

Filesize
3.9MB

Download
memory/4028-70-0x00007FF6FDC00000-0x00007FF6FDFF2000-memory.dmp

Filesize
3.9MB

Download
memory/4336-92-0x00007FF7AA710000-0x00007FF7AAB02000-memory.dmp

Filesize
3.9MB

Download
memory/4336-3878-0x00007FF7AA710000-0x00007FF7AAB02000-memory.dmp

Filesize
3.9MB

Download
memory/4536-3905-0x00007FF74D6D0000-0x00007FF74DAC2000-memory.dmp

Filesize
3.9MB

Download
memory/4536-102-0x00007FF74D6D0000-0x00007FF74DAC2000-memory.dmp

Filesize
3.9MB

Download