xmrig | 710e2014fc07101be085973fc0ca70f3b6bde084a67f6b9dd5a08e0bbcdf653b

Analysis

max time kernel
72s
max time network
48s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27-04-2024 09:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
Size

2.4MB
MD5

02f2c58086d1482b92a24da68b6b0deb
SHA1

a1c8d080bea49a70f6e375e3599856d951a35efc
SHA256

710e2014fc07101be085973fc0ca70f3b6bde084a67f6b9dd5a08e0bbcdf653b
SHA512

10f8e448c478550fe8cb95e70ffa3812666379863c076518563da76e654bf8bdaa2b07301fc8a6f02c9c35f7934187542ba78639261db9aff7e16d92d3b4f009
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9cRbsl:NABk

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 43 IoCs

miner

resource	yara_rule
behavioral2/memory/4188-44-0x00007FF7E1C30000-0x00007FF7E2022000-memory.dmp	xmrig
behavioral2/memory/4780-49-0x00007FF62AC00000-0x00007FF62AFF2000-memory.dmp	xmrig
behavioral2/memory/1972-75-0x00007FF79E9F0000-0x00007FF79EDE2000-memory.dmp	xmrig
behavioral2/memory/1860-78-0x00007FF673F80000-0x00007FF674372000-memory.dmp	xmrig
behavioral2/memory/2812-77-0x00007FF73CB40000-0x00007FF73CF32000-memory.dmp	xmrig
behavioral2/memory/1536-76-0x00007FF609E50000-0x00007FF60A242000-memory.dmp	xmrig
behavioral2/memory/3052-52-0x00007FF7BDBE0000-0x00007FF7BDFD2000-memory.dmp	xmrig
behavioral2/memory/3076-45-0x00007FF666480000-0x00007FF666872000-memory.dmp	xmrig
behavioral2/memory/4432-177-0x00007FF630880000-0x00007FF630C72000-memory.dmp	xmrig
behavioral2/memory/832-183-0x00007FF6E2CA0000-0x00007FF6E3092000-memory.dmp	xmrig
behavioral2/memory/4260-184-0x00007FF6F14A0000-0x00007FF6F1892000-memory.dmp	xmrig
behavioral2/memory/4436-98-0x00007FF7EE0A0000-0x00007FF7EE492000-memory.dmp	xmrig
behavioral2/memory/1364-1782-0x00007FF7F34D0000-0x00007FF7F38C2000-memory.dmp	xmrig
behavioral2/memory/3260-1786-0x00007FF7479E0000-0x00007FF747DD2000-memory.dmp	xmrig
behavioral2/memory/884-1777-0x00007FF660060000-0x00007FF660452000-memory.dmp	xmrig
behavioral2/memory/808-2060-0x00007FF74FA10000-0x00007FF74FE02000-memory.dmp	xmrig
behavioral2/memory/2088-2061-0x00007FF7391E0000-0x00007FF7395D2000-memory.dmp	xmrig
behavioral2/memory/1184-2082-0x00007FF64D610000-0x00007FF64DA02000-memory.dmp	xmrig
behavioral2/memory/1604-2085-0x00007FF71AC50000-0x00007FF71B042000-memory.dmp	xmrig
behavioral2/memory/4616-2084-0x00007FF690ED0000-0x00007FF6912C2000-memory.dmp	xmrig
behavioral2/memory/2032-2083-0x00007FF72FB20000-0x00007FF72FF12000-memory.dmp	xmrig
behavioral2/memory/3544-2097-0x00007FF6DA170000-0x00007FF6DA562000-memory.dmp	xmrig
behavioral2/memory/1364-2099-0x00007FF7F34D0000-0x00007FF7F38C2000-memory.dmp	xmrig
behavioral2/memory/4188-2101-0x00007FF7E1C30000-0x00007FF7E2022000-memory.dmp	xmrig
behavioral2/memory/3076-2103-0x00007FF666480000-0x00007FF666872000-memory.dmp	xmrig
behavioral2/memory/4780-2106-0x00007FF62AC00000-0x00007FF62AFF2000-memory.dmp	xmrig
behavioral2/memory/3260-2107-0x00007FF7479E0000-0x00007FF747DD2000-memory.dmp	xmrig
behavioral2/memory/3052-2109-0x00007FF7BDBE0000-0x00007FF7BDFD2000-memory.dmp	xmrig
behavioral2/memory/1536-2113-0x00007FF609E50000-0x00007FF60A242000-memory.dmp	xmrig
behavioral2/memory/2812-2112-0x00007FF73CB40000-0x00007FF73CF32000-memory.dmp	xmrig
behavioral2/memory/1972-2115-0x00007FF79E9F0000-0x00007FF79EDE2000-memory.dmp	xmrig
behavioral2/memory/1860-2117-0x00007FF673F80000-0x00007FF674372000-memory.dmp	xmrig
behavioral2/memory/808-2119-0x00007FF74FA10000-0x00007FF74FE02000-memory.dmp	xmrig
behavioral2/memory/2088-2155-0x00007FF7391E0000-0x00007FF7395D2000-memory.dmp	xmrig
behavioral2/memory/4436-2157-0x00007FF7EE0A0000-0x00007FF7EE492000-memory.dmp	xmrig
behavioral2/memory/2032-2159-0x00007FF72FB20000-0x00007FF72FF12000-memory.dmp	xmrig
behavioral2/memory/1184-2161-0x00007FF64D610000-0x00007FF64DA02000-memory.dmp	xmrig
behavioral2/memory/4432-2163-0x00007FF630880000-0x00007FF630C72000-memory.dmp	xmrig
behavioral2/memory/4616-2165-0x00007FF690ED0000-0x00007FF6912C2000-memory.dmp	xmrig
behavioral2/memory/1604-2171-0x00007FF71AC50000-0x00007FF71B042000-memory.dmp	xmrig
behavioral2/memory/832-2172-0x00007FF6E2CA0000-0x00007FF6E3092000-memory.dmp	xmrig
behavioral2/memory/4260-2177-0x00007FF6F14A0000-0x00007FF6F1892000-memory.dmp	xmrig
behavioral2/memory/3544-2175-0x00007FF6DA170000-0x00007FF6DA562000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1364	rAhvChB.exe
3260	ghUAeGv.exe
4188	kjSmjdL.exe
3076	xSYVYnj.exe
4780	aJQDiGs.exe
3052	IXVHjWz.exe
808	QZslroM.exe
1972	fkbgTRd.exe
1536	zaXiRHZ.exe
2812	UUHYgsp.exe
1860	HhxPDFP.exe
2088	IRSzKFy.exe
4436	ePdGiEl.exe
2032	vslEyWg.exe
1184	OZYVPsl.exe
4616	YSxkEaT.exe
4432	OXxAhPK.exe
1604	onQnkUe.exe
832	WsFaqgF.exe
3544	ypdbHfe.exe
4260	nQPCIRl.exe
4824	KJpGbEO.exe
924	kgDQqhr.exe
4012	INaJFGk.exe
3192	IbWwvKK.exe
4456	QvAAlsb.exe
456	Azirqrj.exe
3940	twtRUqj.exe
2476	pwkuPKL.exe
2160	zOROyYN.exe
2988	iQxDIhb.exe
2220	BklJeDR.exe
4952	UyhVElt.exe
2352	XqaNUZT.exe
3464	romKXGD.exe
4212	pcWDQwy.exe
1468	ygcInZY.exe
224	mRIVuMh.exe
4408	YFVnmsi.exe
2664	lcahZMp.exe
4236	TRJOMTS.exe
3272	VYnMGAj.exe
4128	JtCifRF.exe
4504	oeIMdMK.exe
5056	FveoEsh.exe
2708	gKGccAU.exe
1652	zHvIxSC.exe
3644	mqVcTCb.exe
748	QtILlpg.exe
3800	FuaUnWh.exe
3788	ojiDveF.exe
4908	jwbmmbR.exe
668	WZfSLCq.exe
2200	wTWhwQG.exe
4840	jslAFLa.exe
1440	YrzNPBj.exe
3684	gEmHxHG.exe
2844	fIStXxR.exe
3900	VreMrxN.exe
3156	KUOgGGq.exe
3384	LOEkqBm.exe
1644	beHMgwu.exe
1600	LnDWYAP.exe
2120	TtVQvNB.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/884-0-0x00007FF660060000-0x00007FF660452000-memory.dmp	upx
behavioral2/files/0x000b000000023b8e-5.dat	upx
behavioral2/memory/1364-8-0x00007FF7F34D0000-0x00007FF7F38C2000-memory.dmp	upx
behavioral2/files/0x000a000000023b92-30.dat	upx
behavioral2/files/0x000a000000023b8f-29.dat	upx
behavioral2/files/0x000b000000023b91-37.dat	upx
behavioral2/memory/4188-44-0x00007FF7E1C30000-0x00007FF7E2022000-memory.dmp	upx
behavioral2/files/0x000a000000023b94-47.dat	upx
behavioral2/memory/4780-49-0x00007FF62AC00000-0x00007FF62AFF2000-memory.dmp	upx
behavioral2/files/0x000a000000023b96-61.dat	upx
behavioral2/files/0x000a000000023b98-69.dat	upx
behavioral2/files/0x000a000000023b97-70.dat	upx
behavioral2/memory/1972-75-0x00007FF79E9F0000-0x00007FF79EDE2000-memory.dmp	upx
behavioral2/files/0x000b000000023b90-79.dat	upx
behavioral2/memory/1860-78-0x00007FF673F80000-0x00007FF674372000-memory.dmp	upx
behavioral2/memory/2812-77-0x00007FF73CB40000-0x00007FF73CF32000-memory.dmp	upx
behavioral2/memory/1536-76-0x00007FF609E50000-0x00007FF60A242000-memory.dmp	upx
behavioral2/memory/808-72-0x00007FF74FA10000-0x00007FF74FE02000-memory.dmp	upx
behavioral2/files/0x000a000000023b95-57.dat	upx
behavioral2/memory/3052-52-0x00007FF7BDBE0000-0x00007FF7BDFD2000-memory.dmp	upx
behavioral2/memory/3076-45-0x00007FF666480000-0x00007FF666872000-memory.dmp	upx
behavioral2/memory/3260-38-0x00007FF7479E0000-0x00007FF747DD2000-memory.dmp	upx
behavioral2/files/0x000a000000023b93-34.dat	upx
behavioral2/files/0x000a000000023b99-83.dat	upx
behavioral2/files/0x000a000000023b9d-111.dat	upx
behavioral2/files/0x000a000000023b9f-119.dat	upx
behavioral2/files/0x000a000000023ba4-142.dat	upx
behavioral2/files/0x000a000000023ba8-158.dat	upx
behavioral2/memory/4432-177-0x00007FF630880000-0x00007FF630C72000-memory.dmp	upx
behavioral2/memory/832-183-0x00007FF6E2CA0000-0x00007FF6E3092000-memory.dmp	upx
behavioral2/files/0x000a000000023ba5-194.dat	upx
behavioral2/files/0x000a000000023bab-196.dat	upx
behavioral2/files/0x000a000000023baa-193.dat	upx
behavioral2/files/0x000a000000023ba9-189.dat	upx
behavioral2/files/0x000a000000023ba7-185.dat	upx
behavioral2/memory/4260-184-0x00007FF6F14A0000-0x00007FF6F1892000-memory.dmp	upx
behavioral2/files/0x000a000000023ba6-181.dat	upx
behavioral2/files/0x000a000000023bad-180.dat	upx
behavioral2/files/0x000a000000023bac-179.dat	upx
behavioral2/files/0x000a000000023ba3-164.dat	upx
behavioral2/files/0x000a000000023ba2-161.dat	upx
behavioral2/files/0x000a000000023ba1-151.dat	upx
behavioral2/files/0x000a000000023ba0-150.dat	upx
behavioral2/memory/3544-147-0x00007FF6DA170000-0x00007FF6DA562000-memory.dmp	upx
behavioral2/memory/1604-145-0x00007FF71AC50000-0x00007FF71B042000-memory.dmp	upx
behavioral2/files/0x000a000000023b9e-134.dat	upx
behavioral2/memory/4616-123-0x00007FF690ED0000-0x00007FF6912C2000-memory.dmp	upx
behavioral2/files/0x000a000000023b9c-118.dat	upx
behavioral2/memory/2032-110-0x00007FF72FB20000-0x00007FF72FF12000-memory.dmp	upx
behavioral2/files/0x000a000000023b9b-108.dat	upx
behavioral2/files/0x000a000000023b9a-105.dat	upx
behavioral2/memory/1184-101-0x00007FF64D610000-0x00007FF64DA02000-memory.dmp	upx
behavioral2/memory/4436-98-0x00007FF7EE0A0000-0x00007FF7EE492000-memory.dmp	upx
behavioral2/memory/2088-95-0x00007FF7391E0000-0x00007FF7395D2000-memory.dmp	upx
behavioral2/files/0x000b000000023b8c-88.dat	upx
behavioral2/memory/1364-1782-0x00007FF7F34D0000-0x00007FF7F38C2000-memory.dmp	upx
behavioral2/memory/3260-1786-0x00007FF7479E0000-0x00007FF747DD2000-memory.dmp	upx
behavioral2/memory/884-1777-0x00007FF660060000-0x00007FF660452000-memory.dmp	upx
behavioral2/memory/808-2060-0x00007FF74FA10000-0x00007FF74FE02000-memory.dmp	upx
behavioral2/memory/2088-2061-0x00007FF7391E0000-0x00007FF7395D2000-memory.dmp	upx
behavioral2/memory/1184-2082-0x00007FF64D610000-0x00007FF64DA02000-memory.dmp	upx
behavioral2/memory/1604-2085-0x00007FF71AC50000-0x00007FF71B042000-memory.dmp	upx
behavioral2/memory/4616-2084-0x00007FF690ED0000-0x00007FF6912C2000-memory.dmp	upx
behavioral2/memory/2032-2083-0x00007FF72FB20000-0x00007FF72FF12000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\IibUehu.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\vKaplVu.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\JHcPtMJ.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\eFBSdhM.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\lcahZMp.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\dXyFYMR.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\BVsqunk.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\tCtCStQ.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\oljiYlh.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\BDLhKfG.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\HwmHWRz.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\rDxxOHc.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\HlJZypz.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\okIKMoi.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\yuZkMOE.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\ZGOuXWQ.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\WlFzQGK.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\vzTPjST.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\ijQrNPn.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\sSacKMT.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\HLzhwEj.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\JBFsIrZ.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\YlTrpRc.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\TOtNztb.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\ZGsZgTK.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\JNutfbc.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\lJoYeLx.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\SNzsUZr.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\IHawQvn.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\OQZMONi.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\uhTrudt.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\RxPNsoz.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\wsWjQta.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\wdZuamE.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\MRZxZTb.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\KilWcty.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\SVjqlzW.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\JFlXTgh.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\FuVFhVh.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\FeTqaCt.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\pnbjqeS.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\gEmHxHG.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\TkmpcFT.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\xFqyFYC.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\yCJzXuC.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\JRINPxv.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\rPkyxNj.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\xfNRVST.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\kfZVblB.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\hsrNTJW.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\UZYwcSH.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\vBBgBII.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\cxShHcq.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\ZsEbiME.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\KRmfjEt.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\oWplGlS.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\AjDRgFE.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\eFIGsii.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\XsQAIvh.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\yVRfIIR.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\BFypInD.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\ZxFFwyl.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\TuzDKGX.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\zOROyYN.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3444	powershell.exe
3444	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
Token: SeDebugPrivilege	3444	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 3444	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	84
PID 884 wrote to memory of 3444	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	84
PID 884 wrote to memory of 1364	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	85
PID 884 wrote to memory of 1364	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	85
PID 884 wrote to memory of 3260	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	86
PID 884 wrote to memory of 3260	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	86
PID 884 wrote to memory of 4188	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	87
PID 884 wrote to memory of 4188	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	87
PID 884 wrote to memory of 3076	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	88
PID 884 wrote to memory of 3076	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	88
PID 884 wrote to memory of 4780	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	89
PID 884 wrote to memory of 4780	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	89
PID 884 wrote to memory of 3052	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	90
PID 884 wrote to memory of 3052	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	90
PID 884 wrote to memory of 808	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	91
PID 884 wrote to memory of 808	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	91
PID 884 wrote to memory of 1972	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	92
PID 884 wrote to memory of 1972	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	92
PID 884 wrote to memory of 1536	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	93
PID 884 wrote to memory of 1536	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	93
PID 884 wrote to memory of 2812	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	94
PID 884 wrote to memory of 2812	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	94
PID 884 wrote to memory of 1860	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	95
PID 884 wrote to memory of 1860	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	95
PID 884 wrote to memory of 2088	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	96
PID 884 wrote to memory of 2088	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	96
PID 884 wrote to memory of 4436	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	97
PID 884 wrote to memory of 4436	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	97
PID 884 wrote to memory of 2032	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	98
PID 884 wrote to memory of 2032	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	98
PID 884 wrote to memory of 1184	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	99
PID 884 wrote to memory of 1184	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	99
PID 884 wrote to memory of 4616	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	100
PID 884 wrote to memory of 4616	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	100
PID 884 wrote to memory of 4432	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	101
PID 884 wrote to memory of 4432	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	101
PID 884 wrote to memory of 1604	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	102
PID 884 wrote to memory of 1604	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	102
PID 884 wrote to memory of 832	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	103
PID 884 wrote to memory of 832	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	103
PID 884 wrote to memory of 3544	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	104
PID 884 wrote to memory of 3544	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	104
PID 884 wrote to memory of 4260	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	105
PID 884 wrote to memory of 4260	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	105
PID 884 wrote to memory of 4824	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	106
PID 884 wrote to memory of 4824	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	106
PID 884 wrote to memory of 924	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	107
PID 884 wrote to memory of 924	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	107
PID 884 wrote to memory of 4012	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	108
PID 884 wrote to memory of 4012	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	108
PID 884 wrote to memory of 3192	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	109
PID 884 wrote to memory of 3192	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	109
PID 884 wrote to memory of 4456	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	110
PID 884 wrote to memory of 4456	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	110
PID 884 wrote to memory of 456	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	111
PID 884 wrote to memory of 456	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	111
PID 884 wrote to memory of 3940	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	112
PID 884 wrote to memory of 3940	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	112
PID 884 wrote to memory of 2476	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	113
PID 884 wrote to memory of 2476	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	113
PID 884 wrote to memory of 2160	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	114
PID 884 wrote to memory of 2160	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	114
PID 884 wrote to memory of 2988	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	115
PID 884 wrote to memory of 2988	884	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:884
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3444
- C:\Windows\System\rAhvChB.exe
  C:\Windows\System\rAhvChB.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\ghUAeGv.exe
  C:\Windows\System\ghUAeGv.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\kjSmjdL.exe
  C:\Windows\System\kjSmjdL.exe
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Windows\System\xSYVYnj.exe
  C:\Windows\System\xSYVYnj.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\aJQDiGs.exe
  C:\Windows\System\aJQDiGs.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\IXVHjWz.exe
  C:\Windows\System\IXVHjWz.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\QZslroM.exe
  C:\Windows\System\QZslroM.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\fkbgTRd.exe
  C:\Windows\System\fkbgTRd.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\zaXiRHZ.exe
  C:\Windows\System\zaXiRHZ.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\UUHYgsp.exe
  C:\Windows\System\UUHYgsp.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\HhxPDFP.exe
  C:\Windows\System\HhxPDFP.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\IRSzKFy.exe
  C:\Windows\System\IRSzKFy.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\ePdGiEl.exe
  C:\Windows\System\ePdGiEl.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\vslEyWg.exe
  C:\Windows\System\vslEyWg.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\OZYVPsl.exe
  C:\Windows\System\OZYVPsl.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\YSxkEaT.exe
  C:\Windows\System\YSxkEaT.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\OXxAhPK.exe
  C:\Windows\System\OXxAhPK.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\onQnkUe.exe
  C:\Windows\System\onQnkUe.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\WsFaqgF.exe
  C:\Windows\System\WsFaqgF.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\ypdbHfe.exe
  C:\Windows\System\ypdbHfe.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\nQPCIRl.exe
  C:\Windows\System\nQPCIRl.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\KJpGbEO.exe
  C:\Windows\System\KJpGbEO.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\kgDQqhr.exe
  C:\Windows\System\kgDQqhr.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\INaJFGk.exe
  C:\Windows\System\INaJFGk.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\IbWwvKK.exe
  C:\Windows\System\IbWwvKK.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\QvAAlsb.exe
  C:\Windows\System\QvAAlsb.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\Azirqrj.exe
  C:\Windows\System\Azirqrj.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\twtRUqj.exe
  C:\Windows\System\twtRUqj.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\pwkuPKL.exe
  C:\Windows\System\pwkuPKL.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\zOROyYN.exe
  C:\Windows\System\zOROyYN.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\iQxDIhb.exe
  C:\Windows\System\iQxDIhb.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\BklJeDR.exe
  C:\Windows\System\BklJeDR.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\UyhVElt.exe
  C:\Windows\System\UyhVElt.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\XqaNUZT.exe
  C:\Windows\System\XqaNUZT.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\romKXGD.exe
  C:\Windows\System\romKXGD.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\pcWDQwy.exe
  C:\Windows\System\pcWDQwy.exe
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Windows\System\ygcInZY.exe
  C:\Windows\System\ygcInZY.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\mRIVuMh.exe
  C:\Windows\System\mRIVuMh.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\YFVnmsi.exe
  C:\Windows\System\YFVnmsi.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\lcahZMp.exe
  C:\Windows\System\lcahZMp.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\TRJOMTS.exe
  C:\Windows\System\TRJOMTS.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System\VYnMGAj.exe
  C:\Windows\System\VYnMGAj.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\JtCifRF.exe
  C:\Windows\System\JtCifRF.exe
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\Windows\System\oeIMdMK.exe
  C:\Windows\System\oeIMdMK.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\FveoEsh.exe
  C:\Windows\System\FveoEsh.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\gKGccAU.exe
  C:\Windows\System\gKGccAU.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\zHvIxSC.exe
  C:\Windows\System\zHvIxSC.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\mqVcTCb.exe
  C:\Windows\System\mqVcTCb.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\QtILlpg.exe
  C:\Windows\System\QtILlpg.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\FuaUnWh.exe
  C:\Windows\System\FuaUnWh.exe
  2⤵
  - Executes dropped EXE
  PID:3800
- C:\Windows\System\ojiDveF.exe
  C:\Windows\System\ojiDveF.exe
  2⤵
  - Executes dropped EXE
  PID:3788
- C:\Windows\System\jwbmmbR.exe
  C:\Windows\System\jwbmmbR.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\WZfSLCq.exe
  C:\Windows\System\WZfSLCq.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\wTWhwQG.exe
  C:\Windows\System\wTWhwQG.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\jslAFLa.exe
  C:\Windows\System\jslAFLa.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\YrzNPBj.exe
  C:\Windows\System\YrzNPBj.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\gEmHxHG.exe
  C:\Windows\System\gEmHxHG.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\fIStXxR.exe
  C:\Windows\System\fIStXxR.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\VreMrxN.exe
  C:\Windows\System\VreMrxN.exe
  2⤵
  - Executes dropped EXE
  PID:3900
- C:\Windows\System\KUOgGGq.exe
  C:\Windows\System\KUOgGGq.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System\LOEkqBm.exe
  C:\Windows\System\LOEkqBm.exe
  2⤵
  - Executes dropped EXE
  PID:3384
- C:\Windows\System\beHMgwu.exe
  C:\Windows\System\beHMgwu.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\LnDWYAP.exe
  C:\Windows\System\LnDWYAP.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\TtVQvNB.exe
  C:\Windows\System\TtVQvNB.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\mhMFnqP.exe
  C:\Windows\System\mhMFnqP.exe
  2⤵
  PID:4420
- C:\Windows\System\sjsDRjO.exe
  C:\Windows\System\sjsDRjO.exe
  2⤵
  PID:5076
- C:\Windows\System\WlFzQGK.exe
  C:\Windows\System\WlFzQGK.exe
  2⤵
  PID:2796
- C:\Windows\System\SPqzWpQ.exe
  C:\Windows\System\SPqzWpQ.exe
  2⤵
  PID:4748
- C:\Windows\System\JKFMpiP.exe
  C:\Windows\System\JKFMpiP.exe
  2⤵
  PID:3248
- C:\Windows\System\olUGire.exe
  C:\Windows\System\olUGire.exe
  2⤵
  PID:4596
- C:\Windows\System\IdnDNkC.exe
  C:\Windows\System\IdnDNkC.exe
  2⤵
  PID:5096
- C:\Windows\System\aHAgLRm.exe
  C:\Windows\System\aHAgLRm.exe
  2⤵
  PID:4488
- C:\Windows\System\oWplGlS.exe
  C:\Windows\System\oWplGlS.exe
  2⤵
  PID:4836
- C:\Windows\System\ImGsSHK.exe
  C:\Windows\System\ImGsSHK.exe
  2⤵
  PID:4500
- C:\Windows\System\GswxcHO.exe
  C:\Windows\System\GswxcHO.exe
  2⤵
  PID:4920
- C:\Windows\System\ApQilfP.exe
  C:\Windows\System\ApQilfP.exe
  2⤵
  PID:5092
- C:\Windows\System\mIhLosz.exe
  C:\Windows\System\mIhLosz.exe
  2⤵
  PID:4036
- C:\Windows\System\EoxMoXs.exe
  C:\Windows\System\EoxMoXs.exe
  2⤵
  PID:2084
- C:\Windows\System\uiHOHGb.exe
  C:\Windows\System\uiHOHGb.exe
  2⤵
  PID:3336
- C:\Windows\System\GvoWhiT.exe
  C:\Windows\System\GvoWhiT.exe
  2⤵
  PID:2424
- C:\Windows\System\AjDRgFE.exe
  C:\Windows\System\AjDRgFE.exe
  2⤵
  PID:4140
- C:\Windows\System\aubUWpV.exe
  C:\Windows\System\aubUWpV.exe
  2⤵
  PID:3000
- C:\Windows\System\sOCjsYS.exe
  C:\Windows\System\sOCjsYS.exe
  2⤵
  PID:5148
- C:\Windows\System\aUEtNCQ.exe
  C:\Windows\System\aUEtNCQ.exe
  2⤵
  PID:5180
- C:\Windows\System\IHawQvn.exe
  C:\Windows\System\IHawQvn.exe
  2⤵
  PID:5208
- C:\Windows\System\ISnNJuP.exe
  C:\Windows\System\ISnNJuP.exe
  2⤵
  PID:5236
- C:\Windows\System\LUzyXsh.exe
  C:\Windows\System\LUzyXsh.exe
  2⤵
  PID:5264
- C:\Windows\System\xRGLPWx.exe
  C:\Windows\System\xRGLPWx.exe
  2⤵
  PID:5292
- C:\Windows\System\sPXUvnA.exe
  C:\Windows\System\sPXUvnA.exe
  2⤵
  PID:5320
- C:\Windows\System\LELyqwd.exe
  C:\Windows\System\LELyqwd.exe
  2⤵
  PID:5344
- C:\Windows\System\PMeUvbX.exe
  C:\Windows\System\PMeUvbX.exe
  2⤵
  PID:5376
- C:\Windows\System\cUmPCgk.exe
  C:\Windows\System\cUmPCgk.exe
  2⤵
  PID:5452
- C:\Windows\System\jSbYrGW.exe
  C:\Windows\System\jSbYrGW.exe
  2⤵
  PID:5480
- C:\Windows\System\nXBqzvV.exe
  C:\Windows\System\nXBqzvV.exe
  2⤵
  PID:5500
- C:\Windows\System\YsrLxlF.exe
  C:\Windows\System\YsrLxlF.exe
  2⤵
  PID:5524
- C:\Windows\System\JdqgpNT.exe
  C:\Windows\System\JdqgpNT.exe
  2⤵
  PID:5552
- C:\Windows\System\dvBLXPs.exe
  C:\Windows\System\dvBLXPs.exe
  2⤵
  PID:5584
- C:\Windows\System\GJDqLsc.exe
  C:\Windows\System\GJDqLsc.exe
  2⤵
  PID:5608
- C:\Windows\System\vTnJXxI.exe
  C:\Windows\System\vTnJXxI.exe
  2⤵
  PID:5628
- C:\Windows\System\nZkRowU.exe
  C:\Windows\System\nZkRowU.exe
  2⤵
  PID:5684
- C:\Windows\System\JRINPxv.exe
  C:\Windows\System\JRINPxv.exe
  2⤵
  PID:5700
- C:\Windows\System\oYeVAzo.exe
  C:\Windows\System\oYeVAzo.exe
  2⤵
  PID:5716
- C:\Windows\System\PCPrcnT.exe
  C:\Windows\System\PCPrcnT.exe
  2⤵
  PID:5768
- C:\Windows\System\aUnvgjg.exe
  C:\Windows\System\aUnvgjg.exe
  2⤵
  PID:5788
- C:\Windows\System\TbITZoe.exe
  C:\Windows\System\TbITZoe.exe
  2⤵
  PID:5852
- C:\Windows\System\aWwPhKx.exe
  C:\Windows\System\aWwPhKx.exe
  2⤵
  PID:5872
- C:\Windows\System\ECEAZQc.exe
  C:\Windows\System\ECEAZQc.exe
  2⤵
  PID:5896
- C:\Windows\System\bEEtsyq.exe
  C:\Windows\System\bEEtsyq.exe
  2⤵
  PID:5916
- C:\Windows\System\ztzeNep.exe
  C:\Windows\System\ztzeNep.exe
  2⤵
  PID:5940
- C:\Windows\System\dxTuiHD.exe
  C:\Windows\System\dxTuiHD.exe
  2⤵
  PID:5960
- C:\Windows\System\AULZXNJ.exe
  C:\Windows\System\AULZXNJ.exe
  2⤵
  PID:6000
- C:\Windows\System\tCuWSda.exe
  C:\Windows\System\tCuWSda.exe
  2⤵
  PID:6020
- C:\Windows\System\qJLEnNn.exe
  C:\Windows\System\qJLEnNn.exe
  2⤵
  PID:6040
- C:\Windows\System\CSmHYdd.exe
  C:\Windows\System\CSmHYdd.exe
  2⤵
  PID:6072
- C:\Windows\System\wyLawrD.exe
  C:\Windows\System\wyLawrD.exe
  2⤵
  PID:6116
- C:\Windows\System\ljSFizs.exe
  C:\Windows\System\ljSFizs.exe
  2⤵
  PID:6132
- C:\Windows\System\XidQBJs.exe
  C:\Windows\System\XidQBJs.exe
  2⤵
  PID:1392
- C:\Windows\System\DJLlIjl.exe
  C:\Windows\System\DJLlIjl.exe
  2⤵
  PID:2672
- C:\Windows\System\BSLEmpE.exe
  C:\Windows\System\BSLEmpE.exe
  2⤵
  PID:5168
- C:\Windows\System\gQIxZDi.exe
  C:\Windows\System\gQIxZDi.exe
  2⤵
  PID:5252
- C:\Windows\System\MTaVCST.exe
  C:\Windows\System\MTaVCST.exe
  2⤵
  PID:5276
- C:\Windows\System\voszuwr.exe
  C:\Windows\System\voszuwr.exe
  2⤵
  PID:5308
- C:\Windows\System\MWtVRto.exe
  C:\Windows\System\MWtVRto.exe
  2⤵
  PID:2528
- C:\Windows\System\giKplje.exe
  C:\Windows\System\giKplje.exe
  2⤵
  PID:4968
- C:\Windows\System\XdgDBvy.exe
  C:\Windows\System\XdgDBvy.exe
  2⤵
  PID:776
- C:\Windows\System\KtMuuiC.exe
  C:\Windows\System\KtMuuiC.exe
  2⤵
  PID:1768
- C:\Windows\System\JHePMeO.exe
  C:\Windows\System\JHePMeO.exe
  2⤵
  PID:2564
- C:\Windows\System\fFdjEzD.exe
  C:\Windows\System\fFdjEzD.exe
  2⤵
  PID:5112
- C:\Windows\System\tLHUJtP.exe
  C:\Windows\System\tLHUJtP.exe
  2⤵
  PID:2124
- C:\Windows\System\hHtRLcQ.exe
  C:\Windows\System\hHtRLcQ.exe
  2⤵
  PID:4064
- C:\Windows\System\lqmkQQB.exe
  C:\Windows\System\lqmkQQB.exe
  2⤵
  PID:5516
- C:\Windows\System\FwsRkuG.exe
  C:\Windows\System\FwsRkuG.exe
  2⤵
  PID:5580
- C:\Windows\System\WuEJSea.exe
  C:\Windows\System\WuEJSea.exe
  2⤵
  PID:5600
- C:\Windows\System\LcmWfCi.exe
  C:\Windows\System\LcmWfCi.exe
  2⤵
  PID:5672
- C:\Windows\System\LRHpXKO.exe
  C:\Windows\System\LRHpXKO.exe
  2⤵
  PID:5736
- C:\Windows\System\GUzsJlS.exe
  C:\Windows\System\GUzsJlS.exe
  2⤵
  PID:5912
- C:\Windows\System\AvWVvFl.exe
  C:\Windows\System\AvWVvFl.exe
  2⤵
  PID:5976
- C:\Windows\System\drevWyX.exe
  C:\Windows\System\drevWyX.exe
  2⤵
  PID:6016
- C:\Windows\System\CMlqvel.exe
  C:\Windows\System\CMlqvel.exe
  2⤵
  PID:6060
- C:\Windows\System\epdBwoi.exe
  C:\Windows\System\epdBwoi.exe
  2⤵
  PID:6096
- C:\Windows\System\eLnmsYy.exe
  C:\Windows\System\eLnmsYy.exe
  2⤵
  PID:1136
- C:\Windows\System\zhRUvZx.exe
  C:\Windows\System\zhRUvZx.exe
  2⤵
  PID:5196
- C:\Windows\System\MDnZuHL.exe
  C:\Windows\System\MDnZuHL.exe
  2⤵
  PID:1176
- C:\Windows\System\VagUVtt.exe
  C:\Windows\System\VagUVtt.exe
  2⤵
  PID:5284
- C:\Windows\System\sHqvwKj.exe
  C:\Windows\System\sHqvwKj.exe
  2⤵
  PID:4756
- C:\Windows\System\GkBFWWb.exe
  C:\Windows\System\GkBFWWb.exe
  2⤵
  PID:2440
- C:\Windows\System\DqRgYbq.exe
  C:\Windows\System\DqRgYbq.exe
  2⤵
  PID:3480
- C:\Windows\System\FiDBPqg.exe
  C:\Windows\System\FiDBPqg.exe
  2⤵
  PID:5804
- C:\Windows\System\xfAlAWh.exe
  C:\Windows\System\xfAlAWh.exe
  2⤵
  PID:5908
- C:\Windows\System\tPQFbfj.exe
  C:\Windows\System\tPQFbfj.exe
  2⤵
  PID:6012
- C:\Windows\System\dXyFYMR.exe
  C:\Windows\System\dXyFYMR.exe
  2⤵
  PID:5144
- C:\Windows\System\XsQAIvh.exe
  C:\Windows\System\XsQAIvh.exe
  2⤵
  PID:4508
- C:\Windows\System\jvpYoNT.exe
  C:\Windows\System\jvpYoNT.exe
  2⤵
  PID:5544
- C:\Windows\System\HnzoKXL.exe
  C:\Windows\System\HnzoKXL.exe
  2⤵
  PID:5712
- C:\Windows\System\CXLwebS.exe
  C:\Windows\System\CXLwebS.exe
  2⤵
  PID:6064
- C:\Windows\System\lUcLpLn.exe
  C:\Windows\System\lUcLpLn.exe
  2⤵
  PID:4516
- C:\Windows\System\GrNpeWc.exe
  C:\Windows\System\GrNpeWc.exe
  2⤵
  PID:6180
- C:\Windows\System\FEZDBkf.exe
  C:\Windows\System\FEZDBkf.exe
  2⤵
  PID:6220
- C:\Windows\System\oUGFrDV.exe
  C:\Windows\System\oUGFrDV.exe
  2⤵
  PID:6252
- C:\Windows\System\JFlXTgh.exe
  C:\Windows\System\JFlXTgh.exe
  2⤵
  PID:6272
- C:\Windows\System\VUQvTkB.exe
  C:\Windows\System\VUQvTkB.exe
  2⤵
  PID:6292
- C:\Windows\System\mSqixXI.exe
  C:\Windows\System\mSqixXI.exe
  2⤵
  PID:6332
- C:\Windows\System\IxRAWpZ.exe
  C:\Windows\System\IxRAWpZ.exe
  2⤵
  PID:6356
- C:\Windows\System\cehItij.exe
  C:\Windows\System\cehItij.exe
  2⤵
  PID:6376
- C:\Windows\System\OQZMONi.exe
  C:\Windows\System\OQZMONi.exe
  2⤵
  PID:6412
- C:\Windows\System\kOJiOHh.exe
  C:\Windows\System\kOJiOHh.exe
  2⤵
  PID:6432
- C:\Windows\System\iIAtmhO.exe
  C:\Windows\System\iIAtmhO.exe
  2⤵
  PID:6452
- C:\Windows\System\IibUehu.exe
  C:\Windows\System\IibUehu.exe
  2⤵
  PID:6496
- C:\Windows\System\nlHujHD.exe
  C:\Windows\System\nlHujHD.exe
  2⤵
  PID:6516
- C:\Windows\System\TVfSqVl.exe
  C:\Windows\System\TVfSqVl.exe
  2⤵
  PID:6556
- C:\Windows\System\JeYUqWD.exe
  C:\Windows\System\JeYUqWD.exe
  2⤵
  PID:6572
- C:\Windows\System\tarroKj.exe
  C:\Windows\System\tarroKj.exe
  2⤵
  PID:6600
- C:\Windows\System\yVRfIIR.exe
  C:\Windows\System\yVRfIIR.exe
  2⤵
  PID:6624
- C:\Windows\System\owxmixT.exe
  C:\Windows\System\owxmixT.exe
  2⤵
  PID:6644
- C:\Windows\System\gpWcVnK.exe
  C:\Windows\System\gpWcVnK.exe
  2⤵
  PID:6660
- C:\Windows\System\gcycndF.exe
  C:\Windows\System\gcycndF.exe
  2⤵
  PID:6688
- C:\Windows\System\QVIztPI.exe
  C:\Windows\System\QVIztPI.exe
  2⤵
  PID:6712
- C:\Windows\System\MwIdQoZ.exe
  C:\Windows\System\MwIdQoZ.exe
  2⤵
  PID:6732
- C:\Windows\System\xXvMkMC.exe
  C:\Windows\System\xXvMkMC.exe
  2⤵
  PID:6812
- C:\Windows\System\ddcFPUd.exe
  C:\Windows\System\ddcFPUd.exe
  2⤵
  PID:6828
- C:\Windows\System\FSZUNkG.exe
  C:\Windows\System\FSZUNkG.exe
  2⤵
  PID:6848
- C:\Windows\System\FuVFhVh.exe
  C:\Windows\System\FuVFhVh.exe
  2⤵
  PID:6876
- C:\Windows\System\CsYyctT.exe
  C:\Windows\System\CsYyctT.exe
  2⤵
  PID:6892
- C:\Windows\System\UcfMRRM.exe
  C:\Windows\System\UcfMRRM.exe
  2⤵
  PID:6912
- C:\Windows\System\ahRcbIJ.exe
  C:\Windows\System\ahRcbIJ.exe
  2⤵
  PID:6936
- C:\Windows\System\IqURrId.exe
  C:\Windows\System\IqURrId.exe
  2⤵
  PID:6956
- C:\Windows\System\vBBgBII.exe
  C:\Windows\System\vBBgBII.exe
  2⤵
  PID:7016
- C:\Windows\System\QMhswRU.exe
  C:\Windows\System\QMhswRU.exe
  2⤵
  PID:7036
- C:\Windows\System\EPqiHia.exe
  C:\Windows\System\EPqiHia.exe
  2⤵
  PID:7052
- C:\Windows\System\kzeSBOK.exe
  C:\Windows\System\kzeSBOK.exe
  2⤵
  PID:7068
- C:\Windows\System\DXgZwpm.exe
  C:\Windows\System\DXgZwpm.exe
  2⤵
  PID:7096
- C:\Windows\System\fYjimON.exe
  C:\Windows\System\fYjimON.exe
  2⤵
  PID:7140
- C:\Windows\System\yYmcLPx.exe
  C:\Windows\System\yYmcLPx.exe
  2⤵
  PID:3536
- C:\Windows\System\bBhbMum.exe
  C:\Windows\System\bBhbMum.exe
  2⤵
  PID:5660
- C:\Windows\System\kAdgKZD.exe
  C:\Windows\System\kAdgKZD.exe
  2⤵
  PID:6176
- C:\Windows\System\TOtNztb.exe
  C:\Windows\System\TOtNztb.exe
  2⤵
  PID:6352
- C:\Windows\System\KAQIGao.exe
  C:\Windows\System\KAQIGao.exe
  2⤵
  PID:6348
- C:\Windows\System\lSoYzIr.exe
  C:\Windows\System\lSoYzIr.exe
  2⤵
  PID:6428
- C:\Windows\System\cdmRhPX.exe
  C:\Windows\System\cdmRhPX.exe
  2⤵
  PID:6448
- C:\Windows\System\mrvHKin.exe
  C:\Windows\System\mrvHKin.exe
  2⤵
  PID:6528
- C:\Windows\System\XPXfRvh.exe
  C:\Windows\System\XPXfRvh.exe
  2⤵
  PID:6552
- C:\Windows\System\XhweFJc.exe
  C:\Windows\System\XhweFJc.exe
  2⤵
  PID:6640
- C:\Windows\System\rPkyxNj.exe
  C:\Windows\System\rPkyxNj.exe
  2⤵
  PID:6680
- C:\Windows\System\fhqtcsi.exe
  C:\Windows\System\fhqtcsi.exe
  2⤵
  PID:6776
- C:\Windows\System\TwGJTsn.exe
  C:\Windows\System\TwGJTsn.exe
  2⤵
  PID:6800
- C:\Windows\System\WicKbyl.exe
  C:\Windows\System\WicKbyl.exe
  2⤵
  PID:6952
- C:\Windows\System\pwGYbKJ.exe
  C:\Windows\System\pwGYbKJ.exe
  2⤵
  PID:6980
- C:\Windows\System\hTzRcVs.exe
  C:\Windows\System\hTzRcVs.exe
  2⤵
  PID:7148
- C:\Windows\System\yUbHFBs.exe
  C:\Windows\System\yUbHFBs.exe
  2⤵
  PID:5472
- C:\Windows\System\ScXsqkd.exe
  C:\Windows\System\ScXsqkd.exe
  2⤵
  PID:6372
- C:\Windows\System\TYtYTuO.exe
  C:\Windows\System\TYtYTuO.exe
  2⤵
  PID:6404
- C:\Windows\System\vIlyqBK.exe
  C:\Windows\System\vIlyqBK.exe
  2⤵
  PID:6512
- C:\Windows\System\vKaplVu.exe
  C:\Windows\System\vKaplVu.exe
  2⤵
  PID:6592
- C:\Windows\System\wdZuamE.exe
  C:\Windows\System\wdZuamE.exe
  2⤵
  PID:6856
- C:\Windows\System\FHZdinr.exe
  C:\Windows\System\FHZdinr.exe
  2⤵
  PID:7104
- C:\Windows\System\NwYRAPS.exe
  C:\Windows\System\NwYRAPS.exe
  2⤵
  PID:7088
- C:\Windows\System\AceCFCY.exe
  C:\Windows\System\AceCFCY.exe
  2⤵
  PID:6608
- C:\Windows\System\wEdNgHV.exe
  C:\Windows\System\wEdNgHV.exe
  2⤵
  PID:6708
- C:\Windows\System\uoGeHSW.exe
  C:\Windows\System\uoGeHSW.exe
  2⤵
  PID:6928
- C:\Windows\System\lUJcQdM.exe
  C:\Windows\System\lUJcQdM.exe
  2⤵
  PID:7084
- C:\Windows\System\hmHiAKZ.exe
  C:\Windows\System\hmHiAKZ.exe
  2⤵
  PID:6884
- C:\Windows\System\GEMGEPH.exe
  C:\Windows\System\GEMGEPH.exe
  2⤵
  PID:7188
- C:\Windows\System\XxsjGXe.exe
  C:\Windows\System\XxsjGXe.exe
  2⤵
  PID:7220
- C:\Windows\System\VCmQTOy.exe
  C:\Windows\System\VCmQTOy.exe
  2⤵
  PID:7240
- C:\Windows\System\UxqcMuk.exe
  C:\Windows\System\UxqcMuk.exe
  2⤵
  PID:7264
- C:\Windows\System\SZedZTM.exe
  C:\Windows\System\SZedZTM.exe
  2⤵
  PID:7292
- C:\Windows\System\mtYGAwk.exe
  C:\Windows\System\mtYGAwk.exe
  2⤵
  PID:7308
- C:\Windows\System\DASQmaU.exe
  C:\Windows\System\DASQmaU.exe
  2⤵
  PID:7340
- C:\Windows\System\bJoHPxE.exe
  C:\Windows\System\bJoHPxE.exe
  2⤵
  PID:7360
- C:\Windows\System\vtmAFZY.exe
  C:\Windows\System\vtmAFZY.exe
  2⤵
  PID:7408
- C:\Windows\System\jCwPtMm.exe
  C:\Windows\System\jCwPtMm.exe
  2⤵
  PID:7440
- C:\Windows\System\iSswmXc.exe
  C:\Windows\System\iSswmXc.exe
  2⤵
  PID:7456
- C:\Windows\System\NAWeqUy.exe
  C:\Windows\System\NAWeqUy.exe
  2⤵
  PID:7508
- C:\Windows\System\xbEnnoG.exe
  C:\Windows\System\xbEnnoG.exe
  2⤵
  PID:7524
- C:\Windows\System\ybSkBlF.exe
  C:\Windows\System\ybSkBlF.exe
  2⤵
  PID:7548
- C:\Windows\System\xFqyFYC.exe
  C:\Windows\System\xFqyFYC.exe
  2⤵
  PID:7576
- C:\Windows\System\inxnbvU.exe
  C:\Windows\System\inxnbvU.exe
  2⤵
  PID:7596
- C:\Windows\System\VvWuylV.exe
  C:\Windows\System\VvWuylV.exe
  2⤵
  PID:7624
- C:\Windows\System\ubNYYbF.exe
  C:\Windows\System\ubNYYbF.exe
  2⤵
  PID:7640
- C:\Windows\System\EUjsXJX.exe
  C:\Windows\System\EUjsXJX.exe
  2⤵
  PID:7676
- C:\Windows\System\AWuHEDK.exe
  C:\Windows\System\AWuHEDK.exe
  2⤵
  PID:7700
- C:\Windows\System\OpjuHcB.exe
  C:\Windows\System\OpjuHcB.exe
  2⤵
  PID:7748
- C:\Windows\System\fycOyqM.exe
  C:\Windows\System\fycOyqM.exe
  2⤵
  PID:7764
- C:\Windows\System\YvyLQsj.exe
  C:\Windows\System\YvyLQsj.exe
  2⤵
  PID:7788
- C:\Windows\System\fjnkAvb.exe
  C:\Windows\System\fjnkAvb.exe
  2⤵
  PID:7808
- C:\Windows\System\WsxuidT.exe
  C:\Windows\System\WsxuidT.exe
  2⤵
  PID:7832
- C:\Windows\System\JasMCPX.exe
  C:\Windows\System\JasMCPX.exe
  2⤵
  PID:7856
- C:\Windows\System\wmvKoQy.exe
  C:\Windows\System\wmvKoQy.exe
  2⤵
  PID:7892
- C:\Windows\System\yYnBMjI.exe
  C:\Windows\System\yYnBMjI.exe
  2⤵
  PID:7912
- C:\Windows\System\xSxtDYq.exe
  C:\Windows\System\xSxtDYq.exe
  2⤵
  PID:7932
- C:\Windows\System\HNvLUcD.exe
  C:\Windows\System\HNvLUcD.exe
  2⤵
  PID:7960
- C:\Windows\System\vzTPjST.exe
  C:\Windows\System\vzTPjST.exe
  2⤵
  PID:7984
- C:\Windows\System\ivRsEYF.exe
  C:\Windows\System\ivRsEYF.exe
  2⤵
  PID:8044
- C:\Windows\System\gWvnIIt.exe
  C:\Windows\System\gWvnIIt.exe
  2⤵
  PID:8068
- C:\Windows\System\rQOsVzo.exe
  C:\Windows\System\rQOsVzo.exe
  2⤵
  PID:8096
- C:\Windows\System\UNuHMBy.exe
  C:\Windows\System\UNuHMBy.exe
  2⤵
  PID:8148
- C:\Windows\System\mxNhWfp.exe
  C:\Windows\System\mxNhWfp.exe
  2⤵
  PID:8184
- C:\Windows\System\eRKELHA.exe
  C:\Windows\System\eRKELHA.exe
  2⤵
  PID:7184
- C:\Windows\System\ctygjvt.exe
  C:\Windows\System\ctygjvt.exe
  2⤵
  PID:7284
- C:\Windows\System\YneBmrl.exe
  C:\Windows\System\YneBmrl.exe
  2⤵
  PID:7304
- C:\Windows\System\QYaXteK.exe
  C:\Windows\System\QYaXteK.exe
  2⤵
  PID:7356
- C:\Windows\System\FJSDRfX.exe
  C:\Windows\System\FJSDRfX.exe
  2⤵
  PID:7464
- C:\Windows\System\ABIqBhi.exe
  C:\Windows\System\ABIqBhi.exe
  2⤵
  PID:7492
- C:\Windows\System\mkFFyeH.exe
  C:\Windows\System\mkFFyeH.exe
  2⤵
  PID:7532
- C:\Windows\System\QcsFQDD.exe
  C:\Windows\System\QcsFQDD.exe
  2⤵
  PID:7612
- C:\Windows\System\hqvrncE.exe
  C:\Windows\System\hqvrncE.exe
  2⤵
  PID:7636
- C:\Windows\System\oXQuOrB.exe
  C:\Windows\System\oXQuOrB.exe
  2⤵
  PID:7692
- C:\Windows\System\bxPrVZQ.exe
  C:\Windows\System\bxPrVZQ.exe
  2⤵
  PID:7760
- C:\Windows\System\tHXLIIB.exe
  C:\Windows\System\tHXLIIB.exe
  2⤵
  PID:7824
- C:\Windows\System\CePWjNl.exe
  C:\Windows\System\CePWjNl.exe
  2⤵
  PID:7920
- C:\Windows\System\JBFsIrZ.exe
  C:\Windows\System\JBFsIrZ.exe
  2⤵
  PID:7976
- C:\Windows\System\heuhtRK.exe
  C:\Windows\System\heuhtRK.exe
  2⤵
  PID:8064
- C:\Windows\System\AcRTePz.exe
  C:\Windows\System\AcRTePz.exe
  2⤵
  PID:8108
- C:\Windows\System\qVsXIpW.exe
  C:\Windows\System\qVsXIpW.exe
  2⤵
  PID:8144
- C:\Windows\System\rMDfFGe.exe
  C:\Windows\System\rMDfFGe.exe
  2⤵
  PID:7300
- C:\Windows\System\LLrkhFd.exe
  C:\Windows\System\LLrkhFd.exe
  2⤵
  PID:7592
- C:\Windows\System\mSXZWpT.exe
  C:\Windows\System\mSXZWpT.exe
  2⤵
  PID:7728
- C:\Windows\System\KDRAaKX.exe
  C:\Windows\System\KDRAaKX.exe
  2⤵
  PID:8052
- C:\Windows\System\cPPTIAu.exe
  C:\Windows\System\cPPTIAu.exe
  2⤵
  PID:8220
- C:\Windows\System\MnxdScO.exe
  C:\Windows\System\MnxdScO.exe
  2⤵
  PID:8244
- C:\Windows\System\cxShHcq.exe
  C:\Windows\System\cxShHcq.exe
  2⤵
  PID:8312
- C:\Windows\System\lrVRlrq.exe
  C:\Windows\System\lrVRlrq.exe
  2⤵
  PID:8328
- C:\Windows\System\OjXZvWs.exe
  C:\Windows\System\OjXZvWs.exe
  2⤵
  PID:8348
- C:\Windows\System\nQFtwJu.exe
  C:\Windows\System\nQFtwJu.exe
  2⤵
  PID:8380
- C:\Windows\System\ZGsZgTK.exe
  C:\Windows\System\ZGsZgTK.exe
  2⤵
  PID:8400
- C:\Windows\System\pRGlflI.exe
  C:\Windows\System\pRGlflI.exe
  2⤵
  PID:8476
- C:\Windows\System\EBdPJmZ.exe
  C:\Windows\System\EBdPJmZ.exe
  2⤵
  PID:8504
- C:\Windows\System\TmIJiFj.exe
  C:\Windows\System\TmIJiFj.exe
  2⤵
  PID:8528
- C:\Windows\System\FPNldbU.exe
  C:\Windows\System\FPNldbU.exe
  2⤵
  PID:8560
- C:\Windows\System\bKkHgWj.exe
  C:\Windows\System\bKkHgWj.exe
  2⤵
  PID:8624
- C:\Windows\System\oypSYsI.exe
  C:\Windows\System\oypSYsI.exe
  2⤵
  PID:8644
- C:\Windows\System\RxPNsoz.exe
  C:\Windows\System\RxPNsoz.exe
  2⤵
  PID:8660
- C:\Windows\System\pkJezVS.exe
  C:\Windows\System\pkJezVS.exe
  2⤵
  PID:8688
- C:\Windows\System\AzgXJRY.exe
  C:\Windows\System\AzgXJRY.exe
  2⤵
  PID:8716
- C:\Windows\System\uAxbVus.exe
  C:\Windows\System\uAxbVus.exe
  2⤵
  PID:8736
- C:\Windows\System\WofwdWq.exe
  C:\Windows\System\WofwdWq.exe
  2⤵
  PID:8756
- C:\Windows\System\VTtvtob.exe
  C:\Windows\System\VTtvtob.exe
  2⤵
  PID:8776
- C:\Windows\System\sfOgZwW.exe
  C:\Windows\System\sfOgZwW.exe
  2⤵
  PID:8808
- C:\Windows\System\rnZHnIL.exe
  C:\Windows\System\rnZHnIL.exe
  2⤵
  PID:8844
- C:\Windows\System\FXgiSVj.exe
  C:\Windows\System\FXgiSVj.exe
  2⤵
  PID:8876
- C:\Windows\System\izfnPdg.exe
  C:\Windows\System\izfnPdg.exe
  2⤵
  PID:8908
- C:\Windows\System\thecGPR.exe
  C:\Windows\System\thecGPR.exe
  2⤵
  PID:8932
- C:\Windows\System\vocJPFJ.exe
  C:\Windows\System\vocJPFJ.exe
  2⤵
  PID:8956
- C:\Windows\System\UapYqMl.exe
  C:\Windows\System\UapYqMl.exe
  2⤵
  PID:8976
- C:\Windows\System\nGDwbpF.exe
  C:\Windows\System\nGDwbpF.exe
  2⤵
  PID:9004
- C:\Windows\System\FgICgXA.exe
  C:\Windows\System\FgICgXA.exe
  2⤵
  PID:9024
- C:\Windows\System\aADavPh.exe
  C:\Windows\System\aADavPh.exe
  2⤵
  PID:9048
- C:\Windows\System\OaQFmmg.exe
  C:\Windows\System\OaQFmmg.exe
  2⤵
  PID:9068
- C:\Windows\System\WHWDCOI.exe
  C:\Windows\System\WHWDCOI.exe
  2⤵
  PID:9112
- C:\Windows\System\BFypInD.exe
  C:\Windows\System\BFypInD.exe
  2⤵
  PID:9132
- C:\Windows\System\zkwYVHp.exe
  C:\Windows\System\zkwYVHp.exe
  2⤵
  PID:9156
- C:\Windows\System\qFlcOCU.exe
  C:\Windows\System\qFlcOCU.exe
  2⤵
  PID:9200
- C:\Windows\System\iyKmbZp.exe
  C:\Windows\System\iyKmbZp.exe
  2⤵
  PID:8092
- C:\Windows\System\KczpRBH.exe
  C:\Windows\System\KczpRBH.exe
  2⤵
  PID:8204
- C:\Windows\System\YzPYNky.exe
  C:\Windows\System\YzPYNky.exe
  2⤵
  PID:7400
- C:\Windows\System\RZWzLBE.exe
  C:\Windows\System\RZWzLBE.exe
  2⤵
  PID:8216
- C:\Windows\System\YEmVzGY.exe
  C:\Windows\System\YEmVzGY.exe
  2⤵
  PID:7804
- C:\Windows\System\DJrVrpB.exe
  C:\Windows\System\DJrVrpB.exe
  2⤵
  PID:7876
- C:\Windows\System\KQvAXyY.exe
  C:\Windows\System\KQvAXyY.exe
  2⤵
  PID:8304
- C:\Windows\System\BLzPUIf.exe
  C:\Windows\System\BLzPUIf.exe
  2⤵
  PID:8368
- C:\Windows\System\sPHAqoS.exe
  C:\Windows\System\sPHAqoS.exe
  2⤵
  PID:8448
- C:\Windows\System\JHcPtMJ.exe
  C:\Windows\System\JHcPtMJ.exe
  2⤵
  PID:8556
- C:\Windows\System\VUwiHMa.exe
  C:\Windows\System\VUwiHMa.exe
  2⤵
  PID:8636
- C:\Windows\System\PVSXmmA.exe
  C:\Windows\System\PVSXmmA.exe
  2⤵
  PID:8704
- C:\Windows\System\SDqseOk.exe
  C:\Windows\System\SDqseOk.exe
  2⤵
  PID:8732
- C:\Windows\System\QcfLzdQ.exe
  C:\Windows\System\QcfLzdQ.exe
  2⤵
  PID:8804
- C:\Windows\System\LNSdZSz.exe
  C:\Windows\System\LNSdZSz.exe
  2⤵
  PID:8872
- C:\Windows\System\MvIWczu.exe
  C:\Windows\System\MvIWczu.exe
  2⤵
  PID:8952
- C:\Windows\System\sBARLer.exe
  C:\Windows\System\sBARLer.exe
  2⤵
  PID:9012
- C:\Windows\System\kFwcPjg.exe
  C:\Windows\System\kFwcPjg.exe
  2⤵
  PID:9084
- C:\Windows\System\KaOURGj.exe
  C:\Windows\System\KaOURGj.exe
  2⤵
  PID:9176
- C:\Windows\System\ymXazoz.exe
  C:\Windows\System\ymXazoz.exe
  2⤵
  PID:9152
- C:\Windows\System\wsWjQta.exe
  C:\Windows\System\wsWjQta.exe
  2⤵
  PID:7844
- C:\Windows\System\avFmMiY.exe
  C:\Windows\System\avFmMiY.exe
  2⤵
  PID:7448
- C:\Windows\System\sbTWCGu.exe
  C:\Windows\System\sbTWCGu.exe
  2⤵
  PID:8232
- C:\Windows\System\KLQhJMo.exe
  C:\Windows\System\KLQhJMo.exe
  2⤵
  PID:8524
- C:\Windows\System\kRalkeU.exe
  C:\Windows\System\kRalkeU.exe
  2⤵
  PID:8596
- C:\Windows\System\HZmQNCP.exe
  C:\Windows\System\HZmQNCP.exe
  2⤵
  PID:8816
- C:\Windows\System\YmSxJut.exe
  C:\Windows\System\YmSxJut.exe
  2⤵
  PID:8900
- C:\Windows\System\GRNTGIS.exe
  C:\Windows\System\GRNTGIS.exe
  2⤵
  PID:8940
- C:\Windows\System\ppJPVMk.exe
  C:\Windows\System\ppJPVMk.exe
  2⤵
  PID:9196
- C:\Windows\System\HwmHWRz.exe
  C:\Windows\System\HwmHWRz.exe
  2⤵
  PID:8464
- C:\Windows\System\FABxfrr.exe
  C:\Windows\System\FABxfrr.exe
  2⤵
  PID:8520
- C:\Windows\System\gYgAfEV.exe
  C:\Windows\System\gYgAfEV.exe
  2⤵
  PID:8868
- C:\Windows\System\PhmpGpS.exe
  C:\Windows\System\PhmpGpS.exe
  2⤵
  PID:9192
- C:\Windows\System\whXhxQj.exe
  C:\Windows\System\whXhxQj.exe
  2⤵
  PID:8748
- C:\Windows\System\TMOaeuj.exe
  C:\Windows\System\TMOaeuj.exe
  2⤵
  PID:9232
- C:\Windows\System\wRRApqK.exe
  C:\Windows\System\wRRApqK.exe
  2⤵
  PID:9256
- C:\Windows\System\ipWMirD.exe
  C:\Windows\System\ipWMirD.exe
  2⤵
  PID:9280
- C:\Windows\System\waVmXQb.exe
  C:\Windows\System\waVmXQb.exe
  2⤵
  PID:9304
- C:\Windows\System\ktLMRPN.exe
  C:\Windows\System\ktLMRPN.exe
  2⤵
  PID:9324
- C:\Windows\System\kgwFfwM.exe
  C:\Windows\System\kgwFfwM.exe
  2⤵
  PID:9344
- C:\Windows\System\YgrMjWC.exe
  C:\Windows\System\YgrMjWC.exe
  2⤵
  PID:9368
- C:\Windows\System\sxbFxiC.exe
  C:\Windows\System\sxbFxiC.exe
  2⤵
  PID:9436
- C:\Windows\System\HOIyXQL.exe
  C:\Windows\System\HOIyXQL.exe
  2⤵
  PID:9460
- C:\Windows\System\ufYPOIX.exe
  C:\Windows\System\ufYPOIX.exe
  2⤵
  PID:9508
- C:\Windows\System\Phcnmdw.exe
  C:\Windows\System\Phcnmdw.exe
  2⤵
  PID:9528
- C:\Windows\System\FqRQVUm.exe
  C:\Windows\System\FqRQVUm.exe
  2⤵
  PID:9560
- C:\Windows\System\QeVEBVb.exe
  C:\Windows\System\QeVEBVb.exe
  2⤵
  PID:9596
- C:\Windows\System\lpnTDtD.exe
  C:\Windows\System\lpnTDtD.exe
  2⤵
  PID:9612
- C:\Windows\System\oljiYlh.exe
  C:\Windows\System\oljiYlh.exe
  2⤵
  PID:9632
- C:\Windows\System\rhCMPvW.exe
  C:\Windows\System\rhCMPvW.exe
  2⤵
  PID:9672
- C:\Windows\System\JNutfbc.exe
  C:\Windows\System\JNutfbc.exe
  2⤵
  PID:9696
- C:\Windows\System\aiufgTd.exe
  C:\Windows\System\aiufgTd.exe
  2⤵
  PID:9728
- C:\Windows\System\TKLRrQS.exe
  C:\Windows\System\TKLRrQS.exe
  2⤵
  PID:9764
- C:\Windows\System\IBnHXvu.exe
  C:\Windows\System\IBnHXvu.exe
  2⤵
  PID:9784
- C:\Windows\System\XhinUxH.exe
  C:\Windows\System\XhinUxH.exe
  2⤵
  PID:9800
- C:\Windows\System\dquvfYj.exe
  C:\Windows\System\dquvfYj.exe
  2⤵
  PID:9820
- C:\Windows\System\UDoOHJD.exe
  C:\Windows\System\UDoOHJD.exe
  2⤵
  PID:9848
- C:\Windows\System\tBDBQvf.exe
  C:\Windows\System\tBDBQvf.exe
  2⤵
  PID:9872
- C:\Windows\System\xzfmzha.exe
  C:\Windows\System\xzfmzha.exe
  2⤵
  PID:9920
- C:\Windows\System\qBBhJiZ.exe
  C:\Windows\System\qBBhJiZ.exe
  2⤵
  PID:9940
- C:\Windows\System\edbFCpU.exe
  C:\Windows\System\edbFCpU.exe
  2⤵
  PID:9964
- C:\Windows\System\rDxxOHc.exe
  C:\Windows\System\rDxxOHc.exe
  2⤵
  PID:9988
- C:\Windows\System\EKUBAtt.exe
  C:\Windows\System\EKUBAtt.exe
  2⤵
  PID:10036
- C:\Windows\System\LXFIith.exe
  C:\Windows\System\LXFIith.exe
  2⤵
  PID:10056
- C:\Windows\System\sVwBxVY.exe
  C:\Windows\System\sVwBxVY.exe
  2⤵
  PID:10104
- C:\Windows\System\dNTIqdc.exe
  C:\Windows\System\dNTIqdc.exe
  2⤵
  PID:10128
- C:\Windows\System\pDUhioM.exe
  C:\Windows\System\pDUhioM.exe
  2⤵
  PID:10148
- C:\Windows\System\VQQRUOf.exe
  C:\Windows\System\VQQRUOf.exe
  2⤵
  PID:10168
- C:\Windows\System\rsZVBNr.exe
  C:\Windows\System\rsZVBNr.exe
  2⤵
  PID:10192
- C:\Windows\System\gIjogXS.exe
  C:\Windows\System\gIjogXS.exe
  2⤵
  PID:9128
- C:\Windows\System\rlgWlcV.exe
  C:\Windows\System\rlgWlcV.exe
  2⤵
  PID:9240
- C:\Windows\System\IcuDHPj.exe
  C:\Windows\System\IcuDHPj.exe
  2⤵
  PID:9248
- C:\Windows\System\ZsEbiME.exe
  C:\Windows\System\ZsEbiME.exe
  2⤵
  PID:9276
- C:\Windows\System\wMQeuWm.exe
  C:\Windows\System\wMQeuWm.exe
  2⤵
  PID:9292
- C:\Windows\System\yBjLpij.exe
  C:\Windows\System\yBjLpij.exe
  2⤵
  PID:9356
- C:\Windows\System\FTraDLx.exe
  C:\Windows\System\FTraDLx.exe
  2⤵
  PID:9496
- C:\Windows\System\BDLhKfG.exe
  C:\Windows\System\BDLhKfG.exe
  2⤵
  PID:9548
- C:\Windows\System\SvEjNMu.exe
  C:\Windows\System\SvEjNMu.exe
  2⤵
  PID:9680
- C:\Windows\System\tZQIBlZ.exe
  C:\Windows\System\tZQIBlZ.exe
  2⤵
  PID:9708
- C:\Windows\System\qViWBkV.exe
  C:\Windows\System\qViWBkV.exe
  2⤵
  PID:9776
- C:\Windows\System\TJsiwSY.exe
  C:\Windows\System\TJsiwSY.exe
  2⤵
  PID:9828
- C:\Windows\System\YmXnhif.exe
  C:\Windows\System\YmXnhif.exe
  2⤵
  PID:9996
- C:\Windows\System\dreumdQ.exe
  C:\Windows\System\dreumdQ.exe
  2⤵
  PID:9952
- C:\Windows\System\PmHKtWg.exe
  C:\Windows\System\PmHKtWg.exe
  2⤵
  PID:10080
- C:\Windows\System\vUazfVW.exe
  C:\Windows\System\vUazfVW.exe
  2⤵
  PID:10144
- C:\Windows\System\YlTrpRc.exe
  C:\Windows\System\YlTrpRc.exe
  2⤵
  PID:10188
- C:\Windows\System\VoRlsbY.exe
  C:\Windows\System\VoRlsbY.exe
  2⤵
  PID:9300
- C:\Windows\System\fnDbLwN.exe
  C:\Windows\System\fnDbLwN.exe
  2⤵
  PID:5040
- C:\Windows\System\WVeEKHS.exe
  C:\Windows\System\WVeEKHS.exe
  2⤵
  PID:9404
- C:\Windows\System\xjxZkow.exe
  C:\Windows\System\xjxZkow.exe
  2⤵
  PID:9644
- C:\Windows\System\BvAqkaA.exe
  C:\Windows\System\BvAqkaA.exe
  2⤵
  PID:9744
- C:\Windows\System\kkabzJd.exe
  C:\Windows\System\kkabzJd.exe
  2⤵
  PID:9948
- C:\Windows\System\lykNDjI.exe
  C:\Windows\System\lykNDjI.exe
  2⤵
  PID:10136
- C:\Windows\System\OeVXSzp.exe
  C:\Windows\System\OeVXSzp.exe
  2⤵
  PID:10164
- C:\Windows\System\hsrNTJW.exe
  C:\Windows\System\hsrNTJW.exe
  2⤵
  PID:9428
- C:\Windows\System\YvguLdE.exe
  C:\Windows\System\YvguLdE.exe
  2⤵
  PID:9792
- C:\Windows\System\sWKutEL.exe
  C:\Windows\System\sWKutEL.exe
  2⤵
  PID:1980
- C:\Windows\System\KAyrosL.exe
  C:\Windows\System\KAyrosL.exe
  2⤵
  PID:3504
- C:\Windows\System\hsmiQux.exe
  C:\Windows\System\hsmiQux.exe
  2⤵
  PID:10264
- C:\Windows\System\EZxFyub.exe
  C:\Windows\System\EZxFyub.exe
  2⤵
  PID:10288
- C:\Windows\System\HyFmYMM.exe
  C:\Windows\System\HyFmYMM.exe
  2⤵
  PID:10320
- C:\Windows\System\QUfjouL.exe
  C:\Windows\System\QUfjouL.exe
  2⤵
  PID:10340
- C:\Windows\System\farmiuf.exe
  C:\Windows\System\farmiuf.exe
  2⤵
  PID:10388
- C:\Windows\System\jIFAzXk.exe
  C:\Windows\System\jIFAzXk.exe
  2⤵
  PID:10404
- C:\Windows\System\vqscCLF.exe
  C:\Windows\System\vqscCLF.exe
  2⤵
  PID:10432
- C:\Windows\System\eXcZFZN.exe
  C:\Windows\System\eXcZFZN.exe
  2⤵
  PID:10480
- C:\Windows\System\icldxAm.exe
  C:\Windows\System\icldxAm.exe
  2⤵
  PID:10496
- C:\Windows\System\RdwfxbZ.exe
  C:\Windows\System\RdwfxbZ.exe
  2⤵
  PID:10516
- C:\Windows\System\SJgHPqV.exe
  C:\Windows\System\SJgHPqV.exe
  2⤵
  PID:10564
- C:\Windows\System\oltZSlJ.exe
  C:\Windows\System\oltZSlJ.exe
  2⤵
  PID:10584
- C:\Windows\System\BVsqunk.exe
  C:\Windows\System\BVsqunk.exe
  2⤵
  PID:10616
- C:\Windows\System\uLZAffQ.exe
  C:\Windows\System\uLZAffQ.exe
  2⤵
  PID:10644
- C:\Windows\System\aMYxVoR.exe
  C:\Windows\System\aMYxVoR.exe
  2⤵
  PID:10668
- C:\Windows\System\bFHQnGN.exe
  C:\Windows\System\bFHQnGN.exe
  2⤵
  PID:10688
- C:\Windows\System\MZQKumR.exe
  C:\Windows\System\MZQKumR.exe
  2⤵
  PID:10720
- C:\Windows\System\OIkBKMN.exe
  C:\Windows\System\OIkBKMN.exe
  2⤵
  PID:10740
- C:\Windows\System\AGYKAOt.exe
  C:\Windows\System\AGYKAOt.exe
  2⤵
  PID:10760
- C:\Windows\System\CwSvtBN.exe
  C:\Windows\System\CwSvtBN.exe
  2⤵
  PID:10780
- C:\Windows\System\dzYuoci.exe
  C:\Windows\System\dzYuoci.exe
  2⤵
  PID:10796
- C:\Windows\System\LFgpzdU.exe
  C:\Windows\System\LFgpzdU.exe
  2⤵
  PID:10840
- C:\Windows\System\ssINsAe.exe
  C:\Windows\System\ssINsAe.exe
  2⤵
  PID:10860
- C:\Windows\System\RoEbnOa.exe
  C:\Windows\System\RoEbnOa.exe
  2⤵
  PID:10884
- C:\Windows\System\MRZxZTb.exe
  C:\Windows\System\MRZxZTb.exe
  2⤵
  PID:10912
- C:\Windows\System\lEOaUIJ.exe
  C:\Windows\System\lEOaUIJ.exe
  2⤵
  PID:10972
- C:\Windows\System\eFBSdhM.exe
  C:\Windows\System\eFBSdhM.exe
  2⤵
  PID:11024
- C:\Windows\System\HlJZypz.exe
  C:\Windows\System\HlJZypz.exe
  2⤵
  PID:11056
- C:\Windows\System\UZYwcSH.exe
  C:\Windows\System\UZYwcSH.exe
  2⤵
  PID:11076
- C:\Windows\System\ajWYBcK.exe
  C:\Windows\System\ajWYBcK.exe
  2⤵
  PID:11096
- C:\Windows\System\IoFAZrU.exe
  C:\Windows\System\IoFAZrU.exe
  2⤵
  PID:11144
- C:\Windows\System\YDVWGBE.exe
  C:\Windows\System\YDVWGBE.exe
  2⤵
  PID:11164
- C:\Windows\System\jOzJUMS.exe
  C:\Windows\System\jOzJUMS.exe
  2⤵
  PID:11188
- C:\Windows\System\AeFUCFv.exe
  C:\Windows\System\AeFUCFv.exe
  2⤵
  PID:11208
- C:\Windows\System\yKChqwZ.exe
  C:\Windows\System\yKChqwZ.exe
  2⤵
  PID:11232
- C:\Windows\System\MInEdMu.exe
  C:\Windows\System\MInEdMu.exe
  2⤵
  PID:11248
- C:\Windows\System\HtJYsYk.exe
  C:\Windows\System\HtJYsYk.exe
  2⤵
  PID:10064
- C:\Windows\System\eTyWxKb.exe
  C:\Windows\System\eTyWxKb.exe
  2⤵
  PID:10308
- C:\Windows\System\dyaUfqJ.exe
  C:\Windows\System\dyaUfqJ.exe
  2⤵
  PID:10368
- C:\Windows\System\xGakRUe.exe
  C:\Windows\System\xGakRUe.exe
  2⤵
  PID:10412
- C:\Windows\System\MMFwugk.exe
  C:\Windows\System\MMFwugk.exe
  2⤵
  PID:10464
- C:\Windows\System\NJiawHo.exe
  C:\Windows\System\NJiawHo.exe
  2⤵
  PID:10572
- C:\Windows\System\kGqJpjP.exe
  C:\Windows\System\kGqJpjP.exe
  2⤵
  PID:10660
- C:\Windows\System\aepeNWn.exe
  C:\Windows\System\aepeNWn.exe
  2⤵
  PID:10664
- C:\Windows\System\VRZkONx.exe
  C:\Windows\System\VRZkONx.exe
  2⤵
  PID:10708
- C:\Windows\System\kEgZxkI.exe
  C:\Windows\System\kEgZxkI.exe
  2⤵
  PID:10824
- C:\Windows\System\kOcgUxv.exe
  C:\Windows\System\kOcgUxv.exe
  2⤵
  PID:2112
- C:\Windows\System\QVTqnKH.exe
  C:\Windows\System\QVTqnKH.exe
  2⤵
  PID:3992
- C:\Windows\System\sqXajdN.exe
  C:\Windows\System\sqXajdN.exe
  2⤵
  PID:3420
- C:\Windows\System\ebmTXJL.exe
  C:\Windows\System\ebmTXJL.exe
  2⤵
  PID:10876
- C:\Windows\System\eFIGsii.exe
  C:\Windows\System\eFIGsii.exe
  2⤵
  PID:10896
- C:\Windows\System\FKZuvKy.exe
  C:\Windows\System\FKZuvKy.exe
  2⤵
  PID:11008
- C:\Windows\System\UuSVTft.exe
  C:\Windows\System\UuSVTft.exe
  2⤵
  PID:11120
- C:\Windows\System\BFIIlJq.exe
  C:\Windows\System\BFIIlJq.exe
  2⤵
  PID:11172
- C:\Windows\System\ouajhzO.exe
  C:\Windows\System\ouajhzO.exe
  2⤵
  PID:11184
- C:\Windows\System\MnWByeJ.exe
  C:\Windows\System\MnWByeJ.exe
  2⤵
  PID:11240
- C:\Windows\System\bxymmer.exe
  C:\Windows\System\bxymmer.exe
  2⤵
  PID:10252
- C:\Windows\System\oLSAIwd.exe
  C:\Windows\System\oLSAIwd.exe
  2⤵
  PID:10468
- C:\Windows\System\hVaGnDI.exe
  C:\Windows\System\hVaGnDI.exe
  2⤵
  PID:10632
- C:\Windows\System\wMFkwuZ.exe
  C:\Windows\System\wMFkwuZ.exe
  2⤵
  PID:3688
- C:\Windows\System\okIKMoi.exe
  C:\Windows\System\okIKMoi.exe
  2⤵
  PID:3572
- C:\Windows\System\ZwvDteD.exe
  C:\Windows\System\ZwvDteD.exe
  2⤵
  PID:10960
- C:\Windows\System\AryIlFX.exe
  C:\Windows\System\AryIlFX.exe
  2⤵
  PID:10904
- C:\Windows\System\yieQRBD.exe
  C:\Windows\System\yieQRBD.exe
  2⤵
  PID:11224
- C:\Windows\System\DCXKoTD.exe
  C:\Windows\System\DCXKoTD.exe
  2⤵
  PID:11220
- C:\Windows\System\KilWcty.exe
  C:\Windows\System\KilWcty.exe
  2⤵
  PID:10316
- C:\Windows\System\tFuesRk.exe
  C:\Windows\System\tFuesRk.exe
  2⤵
  PID:10544
- C:\Windows\System\YNwuxWp.exe
  C:\Windows\System\YNwuxWp.exe
  2⤵
  PID:10868
- C:\Windows\System\QvUBzqL.exe
  C:\Windows\System\QvUBzqL.exe
  2⤵
  PID:10284
- C:\Windows\System\KKMryCY.exe
  C:\Windows\System\KKMryCY.exe
  2⤵
  PID:4544
- C:\Windows\System\TQRFdGP.exe
  C:\Windows\System\TQRFdGP.exe
  2⤵
  PID:11160
- C:\Windows\System\ZDrFLlb.exe
  C:\Windows\System\ZDrFLlb.exe
  2⤵
  PID:11280
- C:\Windows\System\LUrzFIx.exe
  C:\Windows\System\LUrzFIx.exe
  2⤵
  PID:11304
- C:\Windows\System\XrPYtMd.exe
  C:\Windows\System\XrPYtMd.exe
  2⤵
  PID:11356
- C:\Windows\System\yCJzXuC.exe
  C:\Windows\System\yCJzXuC.exe
  2⤵
  PID:11384
- C:\Windows\System\hQqEYYm.exe
  C:\Windows\System\hQqEYYm.exe
  2⤵
  PID:11412
- C:\Windows\System\ADLtLLP.exe
  C:\Windows\System\ADLtLLP.exe
  2⤵
  PID:11436
- C:\Windows\System\PEktiil.exe
  C:\Windows\System\PEktiil.exe
  2⤵
  PID:11468
- C:\Windows\System\vDyGKqH.exe
  C:\Windows\System\vDyGKqH.exe
  2⤵
  PID:11492
- C:\Windows\System\DfWupWc.exe
  C:\Windows\System\DfWupWc.exe
  2⤵
  PID:11508
- C:\Windows\System\EDAKoJO.exe
  C:\Windows\System\EDAKoJO.exe
  2⤵
  PID:11528
- C:\Windows\System\xfNRVST.exe
  C:\Windows\System\xfNRVST.exe
  2⤵
  PID:11556
- C:\Windows\System\CVKbxhr.exe
  C:\Windows\System\CVKbxhr.exe
  2⤵
  PID:11580
- C:\Windows\System\aPWwbhe.exe
  C:\Windows\System\aPWwbhe.exe
  2⤵
  PID:11604
- C:\Windows\System\eZBXywf.exe
  C:\Windows\System\eZBXywf.exe
  2⤵
  PID:11648
- C:\Windows\System\NyHqZBV.exe
  C:\Windows\System\NyHqZBV.exe
  2⤵
  PID:11692
- C:\Windows\System\esEqJFC.exe
  C:\Windows\System\esEqJFC.exe
  2⤵
  PID:11716
- C:\Windows\System\SNaJYec.exe
  C:\Windows\System\SNaJYec.exe
  2⤵
  PID:11744
- C:\Windows\System\lMcLOJX.exe
  C:\Windows\System\lMcLOJX.exe
  2⤵
  PID:11772
- C:\Windows\System\mLXbnMm.exe
  C:\Windows\System\mLXbnMm.exe
  2⤵
  PID:11804
- C:\Windows\System\vPVPLhs.exe
  C:\Windows\System\vPVPLhs.exe
  2⤵
  PID:11832
- C:\Windows\System\XfcTtpv.exe
  C:\Windows\System\XfcTtpv.exe
  2⤵
  PID:11868
- C:\Windows\System\SDbfNou.exe
  C:\Windows\System\SDbfNou.exe
  2⤵
  PID:11884
- C:\Windows\System\ZedCzLH.exe
  C:\Windows\System\ZedCzLH.exe
  2⤵
  PID:11908
- C:\Windows\System\jzjRZHm.exe
  C:\Windows\System\jzjRZHm.exe
  2⤵
  PID:11952
- C:\Windows\System\DoZfUaw.exe
  C:\Windows\System\DoZfUaw.exe
  2⤵
  PID:11968
- C:\Windows\System\uTHkKRc.exe
  C:\Windows\System\uTHkKRc.exe
  2⤵
  PID:11988
- C:\Windows\System\GlrjoGt.exe
  C:\Windows\System\GlrjoGt.exe
  2⤵
  PID:12008
- C:\Windows\System\ijQrNPn.exe
  C:\Windows\System\ijQrNPn.exe
  2⤵
  PID:12032
- C:\Windows\System\vHSlSDP.exe
  C:\Windows\System\vHSlSDP.exe
  2⤵
  PID:12056
- C:\Windows\System\iyhkvOh.exe
  C:\Windows\System\iyhkvOh.exe
  2⤵
  PID:12080
- C:\Windows\System\mtEzpJn.exe
  C:\Windows\System\mtEzpJn.exe
  2⤵
  PID:12100
- C:\Windows\System\bkrJcXz.exe
  C:\Windows\System\bkrJcXz.exe
  2⤵
  PID:12136
- C:\Windows\System\yjmyvFm.exe
  C:\Windows\System\yjmyvFm.exe
  2⤵
  PID:12184
- C:\Windows\System\eNwISuM.exe
  C:\Windows\System\eNwISuM.exe
  2⤵
  PID:12212
- C:\Windows\System\prWXapw.exe
  C:\Windows\System\prWXapw.exe
  2⤵
  PID:12240
- C:\Windows\System\sSacKMT.exe
  C:\Windows\System\sSacKMT.exe
  2⤵
  PID:12268
- C:\Windows\System\ZxFFwyl.exe
  C:\Windows\System\ZxFFwyl.exe
  2⤵
  PID:10712
- C:\Windows\System\LqKmEUG.exe
  C:\Windows\System\LqKmEUG.exe
  2⤵
  PID:11276
- C:\Windows\System\YedwztP.exe
  C:\Windows\System\YedwztP.exe
  2⤵
  PID:11348
- C:\Windows\System\fQvPxxH.exe
  C:\Windows\System\fQvPxxH.exe
  2⤵
  PID:11380
- C:\Windows\System\hqJUDVh.exe
  C:\Windows\System\hqJUDVh.exe
  2⤵
  PID:11484
- C:\Windows\System\MgCeWgJ.exe
  C:\Windows\System\MgCeWgJ.exe
  2⤵
  PID:11524
- C:\Windows\System\AcdJzPP.exe
  C:\Windows\System\AcdJzPP.exe
  2⤵
  PID:11576
- C:\Windows\System\HtfBYnu.exe
  C:\Windows\System\HtfBYnu.exe
  2⤵
  PID:11632
- C:\Windows\System\gbaJCCt.exe
  C:\Windows\System\gbaJCCt.exe
  2⤵
  PID:11732
- C:\Windows\System\msApHsa.exe
  C:\Windows\System\msApHsa.exe
  2⤵
  PID:11860
- C:\Windows\System\TkmpcFT.exe
  C:\Windows\System\TkmpcFT.exe
  2⤵
  PID:11932
- C:\Windows\System\AnuAcZf.exe
  C:\Windows\System\AnuAcZf.exe
  2⤵
  PID:11964
- C:\Windows\System\XFJcCjh.exe
  C:\Windows\System\XFJcCjh.exe
  2⤵
  PID:11976
- C:\Windows\System\FeTqaCt.exe
  C:\Windows\System\FeTqaCt.exe
  2⤵
  PID:12044
- C:\Windows\System\TuzDKGX.exe
  C:\Windows\System\TuzDKGX.exe
  2⤵
  PID:12120
- C:\Windows\System\qHIBiWo.exe
  C:\Windows\System\qHIBiWo.exe
  2⤵
  PID:12224
- C:\Windows\System\YDUrKjG.exe
  C:\Windows\System\YDUrKjG.exe
  2⤵
  PID:12248
- C:\Windows\System\BpJfdiA.exe
  C:\Windows\System\BpJfdiA.exe
  2⤵
  PID:9520
- C:\Windows\System\KDSfqXV.exe
  C:\Windows\System\KDSfqXV.exe
  2⤵
  PID:11408
- C:\Windows\System\qAVzNBg.exe
  C:\Windows\System\qAVzNBg.exe
  2⤵
  PID:11708
- C:\Windows\System\VeZlwRn.exe
  C:\Windows\System\VeZlwRn.exe
  2⤵
  PID:11848
- C:\Windows\System\aFPAibw.exe
  C:\Windows\System\aFPAibw.exe
  2⤵
  PID:4364
- C:\Windows\System\nHIAKpz.exe
  C:\Windows\System\nHIAKpz.exe
  2⤵
  PID:3476
- C:\Windows\System\PGpSCWM.exe
  C:\Windows\System\PGpSCWM.exe
  2⤵
  PID:12088
- C:\Windows\System\uihyPYx.exe
  C:\Windows\System\uihyPYx.exe
  2⤵
  PID:12116
- C:\Windows\System\IzgxVKY.exe
  C:\Windows\System\IzgxVKY.exe
  2⤵
  PID:11340
- C:\Windows\System\yuZkMOE.exe
  C:\Windows\System\yuZkMOE.exe
  2⤵
  PID:11372
- C:\Windows\System\fyiwRXh.exe
  C:\Windows\System\fyiwRXh.exe
  2⤵
  PID:12292
- C:\Windows\System\AobnplZ.exe
  C:\Windows\System\AobnplZ.exe
  2⤵
  PID:12316
- C:\Windows\System\HLzhwEj.exe
  C:\Windows\System\HLzhwEj.exe
  2⤵
  PID:12332
- C:\Windows\System\HJmttyy.exe
  C:\Windows\System\HJmttyy.exe
  2⤵
  PID:12364
- C:\Windows\System\SGhNmnK.exe
  C:\Windows\System\SGhNmnK.exe
  2⤵
  PID:12384
- C:\Windows\System\BDigWhB.exe
  C:\Windows\System\BDigWhB.exe
  2⤵
  PID:12412
- C:\Windows\System\uquBJhv.exe
  C:\Windows\System\uquBJhv.exe
  2⤵
  PID:12428
- C:\Windows\System\kfZVblB.exe
  C:\Windows\System\kfZVblB.exe
  2⤵
  PID:12476
- C:\Windows\System\uLbHLKy.exe
  C:\Windows\System\uLbHLKy.exe
  2⤵
  PID:12544
- C:\Windows\System\ETDXvhr.exe
  C:\Windows\System\ETDXvhr.exe
  2⤵
  PID:12564
- C:\Windows\System\gTmSUVW.exe
  C:\Windows\System\gTmSUVW.exe
  2⤵
  PID:12588
- C:\Windows\System\zOmWkXS.exe
  C:\Windows\System\zOmWkXS.exe
  2⤵
  PID:12604
- C:\Windows\System\IqWzIMk.exe
  C:\Windows\System\IqWzIMk.exe
  2⤵
  PID:12624
- C:\Windows\System\ArVCSIs.exe
  C:\Windows\System\ArVCSIs.exe
  2⤵
  PID:12648
- C:\Windows\System\ODmssLS.exe
  C:\Windows\System\ODmssLS.exe
  2⤵
  PID:12672
- C:\Windows\System\UsEOmNV.exe
  C:\Windows\System\UsEOmNV.exe
  2⤵
  PID:12712
- C:\Windows\System\zdgbzng.exe
  C:\Windows\System\zdgbzng.exe
  2⤵
  PID:12740
- C:\Windows\System\bsVNUGG.exe
  C:\Windows\System\bsVNUGG.exe
  2⤵
  PID:12768
- C:\Windows\System\JuFQZLr.exe
  C:\Windows\System\JuFQZLr.exe
  2⤵
  PID:12796
- C:\Windows\System\GCfykWg.exe
  C:\Windows\System\GCfykWg.exe
  2⤵
  PID:12820
- C:\Windows\System\sHnGzgr.exe
  C:\Windows\System\sHnGzgr.exe
  2⤵
  PID:12884
- C:\Windows\System\UyHiqAS.exe
  C:\Windows\System\UyHiqAS.exe
  2⤵
  PID:12900
- C:\Windows\System\mmSrqxy.exe
  C:\Windows\System\mmSrqxy.exe
  2⤵
  PID:12928
- C:\Windows\System\FmyQTSb.exe
  C:\Windows\System\FmyQTSb.exe
  2⤵
  PID:12948
- C:\Windows\System\pnbjqeS.exe
  C:\Windows\System\pnbjqeS.exe
  2⤵
  PID:12968
- C:\Windows\System\AnuvhGj.exe
  C:\Windows\System\AnuvhGj.exe
  2⤵
  PID:13024
- C:\Windows\System\RlJGeFp.exe
  C:\Windows\System\RlJGeFp.exe
  2⤵
  PID:13044
- C:\Windows\System\asPILJd.exe
  C:\Windows\System\asPILJd.exe
  2⤵
  PID:13080
- C:\Windows\System\DxjJDqV.exe
  C:\Windows\System\DxjJDqV.exe
  2⤵
  PID:13104
- C:\Windows\System\kDZUoMx.exe
  C:\Windows\System\kDZUoMx.exe
  2⤵
  PID:13136
- C:\Windows\System\PzZxbSz.exe
  C:\Windows\System\PzZxbSz.exe
  2⤵
  PID:13164
- C:\Windows\System\KILQnsO.exe
  C:\Windows\System\KILQnsO.exe
  2⤵
  PID:13184
- C:\Windows\System\ECvwKpG.exe
  C:\Windows\System\ECvwKpG.exe
  2⤵
  PID:13200
- C:\Windows\System\fuLCsvy.exe
  C:\Windows\System\fuLCsvy.exe
  2⤵
  PID:13240
- C:\Windows\System\tgsGUsY.exe
  C:\Windows\System\tgsGUsY.exe
  2⤵
  PID:13260
- C:\Windows\System\qllSpcO.exe
  C:\Windows\System\qllSpcO.exe
  2⤵
  PID:13288
- C:\Windows\System\YFsqiMX.exe
  C:\Windows\System\YFsqiMX.exe
  2⤵
  PID:11684
- C:\Windows\System\eEUpxcg.exe
  C:\Windows\System\eEUpxcg.exe
  2⤵
  PID:12160
- C:\Windows\System\ZGXFfOZ.exe
  C:\Windows\System\ZGXFfOZ.exe
  2⤵
  PID:12000
- C:\Windows\System\UaPhvDl.exe
  C:\Windows\System\UaPhvDl.exe
  2⤵
  PID:11328
- C:\Windows\System\KRmfjEt.exe
  C:\Windows\System\KRmfjEt.exe
  2⤵
  PID:12356
- C:\Windows\System\adYlZJE.exe
  C:\Windows\System\adYlZJE.exe
  2⤵
  PID:12420
- C:\Windows\System\MbzRkYN.exe
  C:\Windows\System\MbzRkYN.exe
  2⤵
  PID:12464
- C:\Windows\System\lJoYeLx.exe
  C:\Windows\System\lJoYeLx.exe
  2⤵
  PID:12528
- C:\Windows\System\vLEKCcm.exe
  C:\Windows\System\vLEKCcm.exe
  2⤵
  PID:12596
- C:\Windows\System\SVjqlzW.exe
  C:\Windows\System\SVjqlzW.exe
  2⤵
  PID:12696
- C:\Windows\System\jSQEnYC.exe
  C:\Windows\System\jSQEnYC.exe
  2⤵
  PID:12776
- C:\Windows\System\HCeFjJj.exe
  C:\Windows\System\HCeFjJj.exe
  2⤵
  PID:12812
- C:\Windows\System\OoezxYi.exe
  C:\Windows\System\OoezxYi.exe
  2⤵
  PID:12912
- C:\Windows\System\fmiCWhs.exe
  C:\Windows\System\fmiCWhs.exe
  2⤵
  PID:12956
- C:\Windows\System\pxBIxyz.exe
  C:\Windows\System\pxBIxyz.exe
  2⤵
  PID:13064
- C:\Windows\System\ohnSpZK.exe
  C:\Windows\System\ohnSpZK.exe
  2⤵
  PID:13120
- C:\Windows\System\IipoXOz.exe
  C:\Windows\System\IipoXOz.exe
  2⤵
  PID:13180
- C:\Windows\System\vtKuJDB.exe
  C:\Windows\System\vtKuJDB.exe
  2⤵
  PID:13216
- C:\Windows\System\tCtCStQ.exe
  C:\Windows\System\tCtCStQ.exe
  2⤵
  PID:13280
- C:\Windows\System\cBcSpIT.exe
  C:\Windows\System\cBcSpIT.exe
  2⤵
  PID:11876
- C:\Windows\System\HSTIGCa.exe
  C:\Windows\System\HSTIGCa.exe
  2⤵
  PID:12404
- C:\Windows\System\yMEBeaW.exe
  C:\Windows\System\yMEBeaW.exe
  2⤵
  PID:12724
- C:\Windows\System\yTAOMfF.exe
  C:\Windows\System\yTAOMfF.exe
  2⤵
  PID:12764
- C:\Windows\System\aoyIxjO.exe
  C:\Windows\System\aoyIxjO.exe
  2⤵
  PID:12916
- C:\Windows\System\mkazmoL.exe
  C:\Windows\System\mkazmoL.exe
  2⤵
  PID:13220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fdzx0hbv.0in.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\Azirqrj.exe

Filesize
2.4MB

MD5
ac4c0b72299319d6e0b2313602162257

SHA1
4629bc973aebcde531a82e7355fd19f9f4c5a75b

SHA256
55b6a1f837a29a27ef03bee55d2871984ba6fcfa987189f0f7e304289c0b1798

SHA512
605a05701e47277dcc9115da41a6c38cb7bb43f706052be1885278b583acee6b7cbe3418692edf826fa4190db5b1fdd9ca04f97a22fa7a45c44c050cb4f7c80f

Download Submit
C:\Windows\System\BklJeDR.exe

Filesize
2.4MB

MD5
61b38002e98f4f91a6f340f699f29a3a

SHA1
aba8ad1f05c71328afb253e8faadb00ee72eb251

SHA256
c84430317f96f038c95c6d2885016685e3f50fca8cd05370bf25c9563077bab4

SHA512
ba4ba325c540e282ebaed3fc66fb11630b630ecaba7fb4c62938e1fef7a74cf060f6033d1a5f90d2b91ea6d924565118eb1dec7cdc3cf844b21c8461b919e4a1

Download Submit
C:\Windows\System\HhxPDFP.exe

Filesize
2.4MB

MD5
8ed057ef2e228c32db985da9789f4762

SHA1
c6236f5676b48ba7a4d58a9c199d2b82ffee15b1

SHA256
d678abb6415c31fb0a0c86b244f46cff4a13f85da1f3cbb8d493d7929bedfc94

SHA512
946fb0290f05c3d11bdf9c7782fe20b0f919edc141da866e485f3fe30544df176ca08e1d4981ce92868a51806c61c927b30ac66d3e1301ca1a5d9ac67e753e59

Download Submit
C:\Windows\System\INaJFGk.exe

Filesize
2.4MB

MD5
a1305528a33a54e04b3779dbcb3569e3

SHA1
fd2f5613b2b9afb40218336b674ba13045cff62d

SHA256
0151dbc43374c55e4687948456a58e4375aa65a451497b5345e0a90e6d75b229

SHA512
4c4d151042b7c892d2ad747f74f91ea258cd4f3d621bd6cc6f1372dde789104b43c276fbe56ba739057457651538b3f869b9e931f8bc9895bb133139fa2ae646

Download Submit
C:\Windows\System\IRSzKFy.exe

Filesize
2.4MB

MD5
65bf59a8afb6c15ce16e4eb9c208068a

SHA1
2e897830c6e7e84ef8742653fea7f4138cca5115

SHA256
089d3e544dbe4e6f43dde6fc79021ccc039d35a9be3a011b61a1e3d6aaf59664

SHA512
70be3d313d3af165ba1674f7537be30a2ca1198c13842fda5b805f43b8048ca8a64c39b50a80fbe4e81c4bcb907b10238835ee24af495b0ad48435ebf956a936

Download Submit
C:\Windows\System\IXVHjWz.exe

Filesize
2.4MB

MD5
01e38650d949b75756106c121ec0ab79

SHA1
a4aae02d3b4dda297a88af96c524810d00a95f16

SHA256
4878380e206d944dc844d8d6ae10e2a547dba335e701fcd899762b1344b65ea7

SHA512
d3cdd7ff2d5fcc8dc29b38a745ce7845e55d9de77ef1deef03aab37c485ef1fd46cc2b946d2faade661477bec32470058dd54249ac0a839ec89926df37f02121

Download Submit
C:\Windows\System\IbWwvKK.exe

Filesize
2.4MB

MD5
acb5145a36a9f63de16fce76e61f1961

SHA1
0fab61d1f0b5896792c76103c9e4dec51eb338e1

SHA256
d056bb77a68fe91e0a229ea912e4099cf31a0b9d12e4e1655f89b293c09bf7fc

SHA512
4a56cdc4746dbc348d9f1dc1a551f885638986acdebf75c5f1124804fce2bf2dca2b50c576cffec61ad7a09e1a90820399077d2a30d02c5d06df60e93fddcb41

Download Submit
C:\Windows\System\KJpGbEO.exe

Filesize
2.4MB

MD5
32ccea354e6bb85426a00fbd15d4e071

SHA1
26de77885557e4e0235b165cc4baaf8163decd4a

SHA256
cdc57b26f8ae324ea949bd25f081738408eb900cfb8abe117d83dad5a3633909

SHA512
c7b85879ad4fce4624234f66967d9fe898e620f6f0dd1a2022343af092ff4564a38852da9a8e0035896b0b6b73d8682d5a812e8de39f6ec6d432e66b5eb19faa

Download Submit
C:\Windows\System\OXxAhPK.exe

Filesize
2.4MB

MD5
c55cbf06c3a34055cfe2ca17eecbd746

SHA1
0536af2c2d2b6d1db5058ef65fcd799064f9b948

SHA256
60f3130d999b510e18d14875f331602ec82a348d85343719cb7552b6931fa26c

SHA512
a0f6719792defc7014d1c5af2d93499e640a7430ecddfb9a21afa21664fd312ea48cd9219438814dbc0d4ba0fc6a863f2f3694ecce62f3bbcaa789f3fb46f224

Download Submit
C:\Windows\System\OZYVPsl.exe

Filesize
2.4MB

MD5
ea1858966342eb57861fdb30b5421913

SHA1
c4b2f119df48107a711fcc0389076f3b1d5368e3

SHA256
88ba5fb198c54935079b1985622bb2a3fd5f4249560b275af74267baf58a9229

SHA512
4091e1d2188e81df76ddfc084b8e12205c6cf12278059fee399d046a3ba274f5ecebd81f76e195e090af594c88b3376335597c39e0b49efd27ca77a580318275

Download Submit
C:\Windows\System\QZslroM.exe

Filesize
2.4MB

MD5
650ccd59cfd10737d6a024ec681e98a4

SHA1
9d65b520837d1c30e3e520fc2759ca5ff7acb9b1

SHA256
723cb00a9ff0dc8f3e27dbd575ed905fe60b98254c89d94d0fd53e036f4e5e6e

SHA512
f790a4aa7d3872ec87e459693cb8984fb1a98ca782f58979342e137e09eba5563b263a1870654fd6f4a72c5a7d6ac00a0cfa8f2de674cdce5a3f3810117ff66e

Download Submit
C:\Windows\System\QvAAlsb.exe

Filesize
2.4MB

MD5
9ebd87632bb9c045f06b43a922c5776b

SHA1
39a299bfd91be7ac9255f90ecac22b41658d4f73

SHA256
96c356c9cd9cc4da77880b4a157af131fd25452aebd633b3d522ee56dcd9f479

SHA512
14fc82dc61947dd8430d68a6f52481d373ede18ca32e32e565f5f2336da4508c3f7c9e60993e9dacba929da3bba8243c46dae6d797b5666426f5a65802a8fc90

Download Submit
C:\Windows\System\UUHYgsp.exe

Filesize
2.4MB

MD5
b25db970d9aa7fdf1db9e24e0a2128bc

SHA1
ab81cab873c5b457a77d1595f5d3a7b745057917

SHA256
fdc120fe0717ad30adcdb4da1d22a1874c53188fb0ec8eb9deb3bdeee1a7d6c0

SHA512
dda804e9cd8c623171949fc77b88f5aa7d9c0b8decab222d22bc3bee16ac7d8751d5e5198e4f792e8391d51e95bff6e20671487066154002d87257fbb970f87a

Download Submit
C:\Windows\System\UyhVElt.exe

Filesize
2.4MB

MD5
e70b9d10477877b68e785433b1a48f4d

SHA1
8cf360847b35373dfe9dc535965a7a02c7f6b533

SHA256
a4c741ce698b5653981cb1051f3c0022f6009aa9c4afb93d895e34359ad92082

SHA512
e04b82b4e060175facf85262f6bcd3900c935f2bdcf2093de5949f5704d55ae63df958768f80887d54915d0e7e88c88c9e958a32d0ede20d637ff0f942d018f7

Download Submit
C:\Windows\System\WsFaqgF.exe

Filesize
2.4MB

MD5
dbdeb017a7757774f60c89b633700277

SHA1
c33db87499a95f0b074e63b64a423efd98115d06

SHA256
8abf1f19cd743ace0cc1e9281016b3b69dfaf728f02756f0021a2e505a9cee78

SHA512
d7c7b0e663720edefbd609a6c19e1d8e1f74372389fc1468a7c927abe7e88dc0b217e2307454eefbe24bb88bd00a5afb1e97f51082f49244b1fdcd527e9cf6c7

Download Submit
C:\Windows\System\YSxkEaT.exe

Filesize
2.4MB

MD5
8edc0fc8e94041a90cf4c0eedde70e93

SHA1
74846cbccff3ba6e39da7a0935a0978fc137d175

SHA256
3e6a5e8868f3df9efbe8f7bcb30d9968c1a20fb8f662faa9aba2c954bb7d494d

SHA512
44bc6cb814c7e3ef65212ca62a8c62c02944a24bdd348470473b72f0a0a7d494554ad549c301eab1566ed0ed1128020caf420c6ce14213abc105648ccf8df68f

Download Submit
C:\Windows\System\aJQDiGs.exe

Filesize
2.4MB

MD5
a92715209e8c947de259970242ec1596

SHA1
1dd6f19e96ed50eb72ad11727e895063c7b3dc56

SHA256
de231e01d9cfe5af5049827714d9e7c22430394ae7977136708915921a64189a

SHA512
b61171fbbb920bc39d56d7d7e976eaf81de2167a5856020a305f64fd0e44f05bf89b513a286be996a99d7bf62dddeb41f74ed23115d309478c8e8ae6b0c63c15

Download Submit
C:\Windows\System\ePdGiEl.exe

Filesize
2.4MB

MD5
8e7cb0148e39871cf0ea4f1a4c9d058a

SHA1
4e96e3b416a74244e113dc35b9fb1a64e5421a09

SHA256
39e9d542169269d8a462d671524288e004e182ad4551f903ec4afe356e4a4c59

SHA512
a3845f1813e4cad4cc96520f5dec43eedaebe6aa0cdad134b7b6a03aa462d5fdfba2bd0ca80e6c62f9294bd44d6cbdd3ea644adeddaf1faca419ecc53fd2c6c9

Download Submit
C:\Windows\System\fkbgTRd.exe

Filesize
2.4MB

MD5
8489e6f1a1c5c8fe1d96d27bfffd66c8

SHA1
f9fd2a1a69eaf759afe447782f5c5c15a0a766e1

SHA256
6ed3e7b25b9ad98d53dcc13f144eb68f9b5b6c7975db2bba978d598787f86935

SHA512
21af864263fef32721075a30ffeba4414cfd5d95776018636ddca5d38abb9195948a7e4b0613a6b8ca916652eb975b58c2c538cd48f4ec953a37d09a030cca93

Download Submit
C:\Windows\System\ghUAeGv.exe

Filesize
2.4MB

MD5
3a3dc768556a66ffc111c54290596df4

SHA1
7aeb3f3c6afb187011764fb1e1b8a213a2718587

SHA256
91e060150841897302894cb28f79fb26c441afeb5e5a44315f452bac6c4aba24

SHA512
b960d7f0a5c6253a5c01988bbd3c95e579df83cc27a159a54916b6d249e0d1fa1457d02d0e77511e4d4fb2eecc033acbbc74218e6e8174184a19521dc6d5dd74

Download Submit
C:\Windows\System\iQxDIhb.exe

Filesize
2.4MB

MD5
907af3cac7c22125327b3c3f4abab36e

SHA1
a301333ae8442b3a24d6c9e80cf7863d37c65aca

SHA256
feb8863549c0a5d1615f4f7bc55e5e4ad89ed709e9ddb7a160c51862a1d1bfe2

SHA512
883065b89ad64d85e9556c2645fa3883b92fcb8ff03a5a677db5637385e557ebe80a21ff17c1b2aa66eb04fd430699958cdab2028d943ff2da1afd250aa428a9

Download Submit
C:\Windows\System\kgDQqhr.exe

Filesize
2.4MB

MD5
d0f3bfecb6ce33cf65d5ee0a63576c0a

SHA1
7f38c52f23adb1e56cebca539ed5f0852f7be207

SHA256
5446c1eb76a6057ac76cb3ddc22ae489e9c389f8c2edc388175d610e9a44dc32

SHA512
9e74a520040b2af52fd27cb290ed04fe0290403ffed59272c6df8f5a0c6c0d260f3ef257ff878dc100e74365606362073af00f0db61b928216293dca64e148ce

Download Submit
C:\Windows\System\kjSmjdL.exe

Filesize
2.4MB

MD5
84f25fb80eaa5a33fd12e99eb11774bf

SHA1
447da4a42cc1bb3f4faa96eaca85ed67ddf23cde

SHA256
4cb76e09183d2df53e0c436f56b8432a58735858cb3bfdbb0e7a986764b3d59c

SHA512
cf718c1efd62a8157d0adf5cbd25a86b25ecb658c6f1ad92aa9eddec520677724637bb1e34540840f2e2f67dc56e8b971c82d5bb3af095a70d7c8b83673f301b

Download Submit
C:\Windows\System\nQPCIRl.exe

Filesize
2.4MB

MD5
7e141a93b3a51db51b70d9c1ee537f14

SHA1
660ef4ec0de2d6f6c607ef5748321d8121896e21

SHA256
713ac1478d4a92dcce4701b1bdffd2b58ac616b97cb9a8aaffef2e2fc82aa250

SHA512
13b2649218022b5924e6497bf29433ae6212884521a844804b888092b439590f5e83dd90231a5ae0a30b8d6d60e5ae61b2572b3752f89bc085cbb62443b6131d

Download Submit
C:\Windows\System\onQnkUe.exe

Filesize
2.4MB

MD5
086a3a446db1e02ba48d48823e4cb6db

SHA1
a257041c2b44f10762107f8f5b2a60c6ad78829f

SHA256
77e9db776e4ea64c3d1b7331994d7c88c53688d14058724e67ba0d43f33263c9

SHA512
3ba3ccac888ae38a8881113378cb4d2f8ffb6135b940be9be18fee0481dfa36dae67443e6286608b2f5e84f7b47b75cd39c5e4d4f84cd8909220b2893172fbf5

Download Submit
C:\Windows\System\pwkuPKL.exe

Filesize
2.4MB

MD5
8446575473d99fa1806bdd368ac00690

SHA1
65b34db6a1a01431263780ab13a1d14753a72663

SHA256
2b78aca72b872b7a82a66c10fd111bef18cbc8c09f223038c1b769e8a34faa28

SHA512
5735cdb430c4ecc3ed518421fbf2fc2141ef0c3a53cf0e19d4ddc237f9eac43e0947bfa2319b8428e45b642173fe3c38e2dd31a668305f99d7b3bae218a96b61

Download Submit
C:\Windows\System\rAhvChB.exe

Filesize
2.4MB

MD5
a842a0cadaeb9438675eac778a803f48

SHA1
9d28ff73955fb92223eb8a5977d0e1383b2d7c45

SHA256
c33469c057c844eed5f05c805402eaf36e193b710263d964c963b184090a3276

SHA512
cd8b82522565a030021fec733cf196cb246be1244ae226e5fc66dbc35656ce4d63724713d718ff3f3b872839a7b8664fe258d2046116cf792d201d1023952d51

Download Submit
C:\Windows\System\twtRUqj.exe

Filesize
2.4MB

MD5
3aec93b19fadb7d12d3cb1633a71ac0f

SHA1
6fcc319ca259739fad8b6a2761f7e3bd3614958c

SHA256
8fca80021d51300bb36657e06ed9c7314c07870f2fdd6c548e473be53a0b1ddf

SHA512
df563930da0742603d519585e4cd7965e9c354e307683129e50794d3e2af1e8be913f0d9febccb7ac9b4fbab52d395f67279dcf0376561bc3b912482bfdf6d9b

Download Submit
C:\Windows\System\vslEyWg.exe

Filesize
2.4MB

MD5
ba61e0e72543a3f65f20588a5121ad31

SHA1
e3ad15df7dfe815dc74b0acc02c3050a9807dc5a

SHA256
76a7cdef8c7d8560e32400a047f668e96af4fe29d16433f43ed12c46cd0fc8e2

SHA512
3a671e52d53d9fb17ba4293f89a68298cecb818b90c13855270bcc8456528489f6eda56721f4a5e98682301020fd3723a1b5f068b42a06de614992e2ffdb899e

Download Submit
C:\Windows\System\xSYVYnj.exe

Filesize
2.4MB

MD5
b6a9911fe9135f0d5c188bf8e2c795c9

SHA1
8b0eede1726e8845375ac8c71f62e44f184b1023

SHA256
4e0d66f45ba8e476037702723e8684968a47402c6058782818e6bdeaac191b6c

SHA512
818dfd558c62f990b46a21351c6c3f443432eeb4a19dbe541f23b4f6d9fd714d8aee9628421ee71669e19e52ef2d916d769cdd3e9704ecf4d827c3dbe6079466

Download Submit
C:\Windows\System\ypdbHfe.exe

Filesize
2.4MB

MD5
34f8505a3cefed7f84701441fd21ac0a

SHA1
c81dc01232f8bdb8a4c0c72758ff0c7b6fc4395f

SHA256
ae813bf273294be7372dd4415811e5a670d5c706a537e69ce39640d59860d8fa

SHA512
e6b924029324fa4dea5930cbd737bf0e388de096afc4329de6cec86ae3ae6bdc07b293a83b839017711e6a87c723d1c256e0387b444d565fe852952e9a975e74

Download Submit
C:\Windows\System\zOROyYN.exe

Filesize
2.4MB

MD5
fd3364e92592a8ad9fd6ad3321435fe0

SHA1
a9f698758c17a759a33312531b8868fa59528cd5

SHA256
9093d717e8183351df3170bcd54a1448912cdd8cc98f41ded3b5ad22692b9554

SHA512
edbfcfef746dba56e5699acbf84cf2b42ae4927bd5e701a967b9d4fb6f112335f62d1089ec0a9ade73dfa68a09f6fb70c8f264e2e349941073a28e30072b4f34

Download Submit
C:\Windows\System\zaXiRHZ.exe

Filesize
2.4MB

MD5
ff993368fe6164d95941a7ac9bea62ea

SHA1
7922c5dd93273dc4d1e03dc0993636ffd1820a58

SHA256
6ba53c61cf0cfdf82b2e997c1a58304ef5ec3a75f85d55dbfe55beffdbc8a99c

SHA512
b98f263748e0f9a3c170b7fb51eaad2564c507cdce9eab675b5c04b4cedda26bd6d359d140a5f9d5ce967f5cc7ffefb2c5bc5a550a77282017e9baa13b7d65f9

Download Submit
memory/808-2119-0x00007FF74FA10000-0x00007FF74FE02000-memory.dmp

Filesize
3.9MB

Download
memory/808-72-0x00007FF74FA10000-0x00007FF74FE02000-memory.dmp

Filesize
3.9MB

Download
memory/808-2060-0x00007FF74FA10000-0x00007FF74FE02000-memory.dmp

Filesize
3.9MB

Download
memory/832-2172-0x00007FF6E2CA0000-0x00007FF6E3092000-memory.dmp

Filesize
3.9MB

Download
memory/832-183-0x00007FF6E2CA0000-0x00007FF6E3092000-memory.dmp

Filesize
3.9MB

Download
memory/884-1-0x0000021B65D80000-0x0000021B65D90000-memory.dmp

Filesize
64KB

Download
memory/884-1777-0x00007FF660060000-0x00007FF660452000-memory.dmp

Filesize
3.9MB

Download
memory/884-0-0x00007FF660060000-0x00007FF660452000-memory.dmp

Filesize
3.9MB

Download
memory/1184-101-0x00007FF64D610000-0x00007FF64DA02000-memory.dmp

Filesize
3.9MB

Download
memory/1184-2161-0x00007FF64D610000-0x00007FF64DA02000-memory.dmp

Filesize
3.9MB

Download
memory/1184-2082-0x00007FF64D610000-0x00007FF64DA02000-memory.dmp

Filesize
3.9MB

Download
memory/1364-2099-0x00007FF7F34D0000-0x00007FF7F38C2000-memory.dmp

Filesize
3.9MB

Download
memory/1364-1782-0x00007FF7F34D0000-0x00007FF7F38C2000-memory.dmp

Filesize
3.9MB

Download
memory/1364-8-0x00007FF7F34D0000-0x00007FF7F38C2000-memory.dmp

Filesize
3.9MB

Download
memory/1536-76-0x00007FF609E50000-0x00007FF60A242000-memory.dmp

Filesize
3.9MB

Download
memory/1536-2113-0x00007FF609E50000-0x00007FF60A242000-memory.dmp

Filesize
3.9MB

Download
memory/1604-145-0x00007FF71AC50000-0x00007FF71B042000-memory.dmp

Filesize
3.9MB

Download
memory/1604-2171-0x00007FF71AC50000-0x00007FF71B042000-memory.dmp

Filesize
3.9MB

Download
memory/1604-2085-0x00007FF71AC50000-0x00007FF71B042000-memory.dmp

Filesize
3.9MB

Download
memory/1860-2117-0x00007FF673F80000-0x00007FF674372000-memory.dmp

Filesize
3.9MB

Download
memory/1860-78-0x00007FF673F80000-0x00007FF674372000-memory.dmp

Filesize
3.9MB

Download
memory/1972-75-0x00007FF79E9F0000-0x00007FF79EDE2000-memory.dmp

Filesize
3.9MB

Download
memory/1972-2115-0x00007FF79E9F0000-0x00007FF79EDE2000-memory.dmp

Filesize
3.9MB

Download
memory/2032-110-0x00007FF72FB20000-0x00007FF72FF12000-memory.dmp

Filesize
3.9MB

Download
memory/2032-2159-0x00007FF72FB20000-0x00007FF72FF12000-memory.dmp

Filesize
3.9MB

Download
memory/2032-2083-0x00007FF72FB20000-0x00007FF72FF12000-memory.dmp

Filesize
3.9MB

Download
memory/2088-95-0x00007FF7391E0000-0x00007FF7395D2000-memory.dmp

Filesize
3.9MB

Download
memory/2088-2155-0x00007FF7391E0000-0x00007FF7395D2000-memory.dmp

Filesize
3.9MB

Download
memory/2088-2061-0x00007FF7391E0000-0x00007FF7395D2000-memory.dmp

Filesize
3.9MB

Download
memory/2812-2112-0x00007FF73CB40000-0x00007FF73CF32000-memory.dmp

Filesize
3.9MB

Download
memory/2812-77-0x00007FF73CB40000-0x00007FF73CF32000-memory.dmp

Filesize
3.9MB

Download
memory/3052-2109-0x00007FF7BDBE0000-0x00007FF7BDFD2000-memory.dmp

Filesize
3.9MB

Download
memory/3052-52-0x00007FF7BDBE0000-0x00007FF7BDFD2000-memory.dmp

Filesize
3.9MB

Download
memory/3076-2103-0x00007FF666480000-0x00007FF666872000-memory.dmp

Filesize
3.9MB

Download
memory/3076-45-0x00007FF666480000-0x00007FF666872000-memory.dmp

Filesize
3.9MB

Download
memory/3260-38-0x00007FF7479E0000-0x00007FF747DD2000-memory.dmp

Filesize
3.9MB

Download
memory/3260-1786-0x00007FF7479E0000-0x00007FF747DD2000-memory.dmp

Filesize
3.9MB

Download
memory/3260-2107-0x00007FF7479E0000-0x00007FF747DD2000-memory.dmp

Filesize
3.9MB

Download
memory/3444-46-0x000001469B0E0000-0x000001469B0F0000-memory.dmp

Filesize
64KB

Download
memory/3444-28-0x00007FF93FD80000-0x00007FF940841000-memory.dmp

Filesize
10.8MB

Download
memory/3444-1416-0x00007FF93FD80000-0x00007FF940841000-memory.dmp

Filesize
10.8MB

Download
memory/3444-22-0x000001469BC70000-0x000001469BC92000-memory.dmp

Filesize
136KB

Download
memory/3544-2175-0x00007FF6DA170000-0x00007FF6DA562000-memory.dmp

Filesize
3.9MB

Download
memory/3544-2097-0x00007FF6DA170000-0x00007FF6DA562000-memory.dmp

Filesize
3.9MB

Download
memory/3544-147-0x00007FF6DA170000-0x00007FF6DA562000-memory.dmp

Filesize
3.9MB

Download
memory/4188-44-0x00007FF7E1C30000-0x00007FF7E2022000-memory.dmp

Filesize
3.9MB

Download
memory/4188-2101-0x00007FF7E1C30000-0x00007FF7E2022000-memory.dmp

Filesize
3.9MB

Download
memory/4260-2177-0x00007FF6F14A0000-0x00007FF6F1892000-memory.dmp

Filesize
3.9MB

Download
memory/4260-184-0x00007FF6F14A0000-0x00007FF6F1892000-memory.dmp

Filesize
3.9MB

Download
memory/4432-177-0x00007FF630880000-0x00007FF630C72000-memory.dmp

Filesize
3.9MB

Download
memory/4432-2163-0x00007FF630880000-0x00007FF630C72000-memory.dmp

Filesize
3.9MB

Download
memory/4436-2157-0x00007FF7EE0A0000-0x00007FF7EE492000-memory.dmp

Filesize
3.9MB

Download
memory/4436-98-0x00007FF7EE0A0000-0x00007FF7EE492000-memory.dmp

Filesize
3.9MB

Download
memory/4616-123-0x00007FF690ED0000-0x00007FF6912C2000-memory.dmp

Filesize
3.9MB

Download
memory/4616-2165-0x00007FF690ED0000-0x00007FF6912C2000-memory.dmp

Filesize
3.9MB

Download
memory/4616-2084-0x00007FF690ED0000-0x00007FF6912C2000-memory.dmp

Filesize
3.9MB

Download
memory/4780-49-0x00007FF62AC00000-0x00007FF62AFF2000-memory.dmp

Filesize
3.9MB

Download
memory/4780-2106-0x00007FF62AC00000-0x00007FF62AFF2000-memory.dmp

Filesize
3.9MB

Download