xmrig | a86e2c7d5f9f7d36241bd2e9fc66568e74f0aeb1592d8d4cc5e771dfdc40ce25

Analysis

max time kernel
3s
max time network
27s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 13:21

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
Size

1.8MB
MD5

0355cc43a9f793c004b93984d8cf6888
SHA1

02a0f04232661c8c028ac9cddc3af40039eda05d
SHA256

a86e2c7d5f9f7d36241bd2e9fc66568e74f0aeb1592d8d4cc5e771dfdc40ce25
SHA512

828a800823b37e1e45cb07152a6c6aa57c526da03ea451a716bfde066f26b726c9887fb5e3d247dd061d59fb1b45023a0dc9399e1836b5fffd96e62ebf2c6815
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlD:NABG

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 19 IoCs

miner

resource	yara_rule
behavioral2/memory/2368-149-0x00007FF729F60000-0x00007FF72A352000-memory.dmp	xmrig
behavioral2/memory/1636-277-0x00007FF7EE660000-0x00007FF7EEA52000-memory.dmp	xmrig
behavioral2/memory/3020-311-0x00007FF63C7D0000-0x00007FF63CBC2000-memory.dmp	xmrig
behavioral2/memory/4820-358-0x00007FF62C750000-0x00007FF62CB42000-memory.dmp	xmrig
behavioral2/memory/1260-381-0x00007FF7BA6B0000-0x00007FF7BAAA2000-memory.dmp	xmrig
behavioral2/memory/1808-432-0x00007FF645BE0000-0x00007FF645FD2000-memory.dmp	xmrig
behavioral2/memory/4876-431-0x00007FF796010000-0x00007FF796402000-memory.dmp	xmrig
behavioral2/memory/4024-430-0x00007FF7991A0000-0x00007FF799592000-memory.dmp	xmrig
behavioral2/memory/2372-429-0x00007FF64FF80000-0x00007FF650372000-memory.dmp	xmrig
behavioral2/memory/1892-428-0x00007FF7D0060000-0x00007FF7D0452000-memory.dmp	xmrig
behavioral2/memory/1008-427-0x00007FF709080000-0x00007FF709472000-memory.dmp	xmrig
behavioral2/memory/1840-425-0x00007FF786830000-0x00007FF786C22000-memory.dmp	xmrig
behavioral2/memory/5104-378-0x00007FF60F560000-0x00007FF60F952000-memory.dmp	xmrig
behavioral2/memory/3264-339-0x00007FF601A10000-0x00007FF601E02000-memory.dmp	xmrig
behavioral2/memory/4256-338-0x00007FF7EA200000-0x00007FF7EA5F2000-memory.dmp	xmrig
behavioral2/memory/4836-316-0x00007FF64D470000-0x00007FF64D862000-memory.dmp	xmrig
behavioral2/memory/2780-238-0x00007FF69F460000-0x00007FF69F852000-memory.dmp	xmrig
behavioral2/memory/116-217-0x00007FF685A70000-0x00007FF685E62000-memory.dmp	xmrig
behavioral2/memory/744-214-0x00007FF712490000-0x00007FF712882000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4124	HkyBEpi.exe
1808	ctJsKyj.exe
2828	IvnAOSy.exe
2368	WiSGfFu.exe
744	XrtMILS.exe
116	GuJZxuY.exe
2780	FgZMXlZ.exe
1636	zzvbDij.exe
3020	CzlTLKs.exe
4836	gLcPDkQ.exe
4256	YKQjbwT.exe
3264	WgELkah.exe
4820	iCFTzoP.exe
5104	dIyCmex.exe
1260	FVWrqpC.exe
1840	UpLgiYi.exe
1008	QZnmkfn.exe
1892	avteIMv.exe
2372	eiKRqVg.exe
4024	BQytPjc.exe
4876	BboyOkM.exe
5080	NSiNaXl.exe
1884	HzDPHAS.exe
2996	nmsmxOa.exe
4872	mGooBfW.exe
2952	krZaZKK.exe
1788	YMpwRMO.exe
3088	EQcCRbU.exe
956	XECbELq.exe
4152	IZAGEQY.exe
1628	qbCZXxk.exe
3492	WwGzxvO.exe
1244	hxANasl.exe
4192	FHGdzJk.exe
2292	ZilbSsx.exe
2320	Ahomjue.exe
1404	DCJzwvA.exe
3756	oRcRbCm.exe
3672	jqcFGXr.exe
1392	XvdmQHj.exe
3812	lltuuCY.exe
3032	maaVhmw.exe
3536	lpkAkhK.exe
3716	iQxHgIC.exe
4388	muRmGAv.exe
3100	NFtWgkE.exe
3156	LSUbwey.exe
2100	ZXMTgJX.exe
3556	YMFUjtF.exe
1352	LMEkeyf.exe
3876	NxXWVva.exe
544	TnsQIoT.exe
3608	xzmATtg.exe
4036	GvTbsmy.exe
1704	sftGLDq.exe
5092	cLpbjmz.exe
648	pKoZPDH.exe
1612	cvxGWiJ.exe
2796	tfuKcNi.exe
4140	WAZPAer.exe
2660	bDvgqwK.exe
4400	bfvzpNm.exe
4648	zzFMgxP.exe
4776	EmpqTPA.exe

UPX packed file 62 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1956-0-0x00007FF6D2360000-0x00007FF6D2752000-memory.dmp	upx
behavioral2/files/0x0007000000023305-5.dat	upx
behavioral2/files/0x000700000002349a-33.dat	upx
behavioral2/files/0x0008000000023492-45.dat	upx
behavioral2/memory/2368-149-0x00007FF729F60000-0x00007FF72A352000-memory.dmp	upx
behavioral2/memory/1636-277-0x00007FF7EE660000-0x00007FF7EEA52000-memory.dmp	upx
behavioral2/memory/3020-311-0x00007FF63C7D0000-0x00007FF63CBC2000-memory.dmp	upx
behavioral2/memory/4820-358-0x00007FF62C750000-0x00007FF62CB42000-memory.dmp	upx
behavioral2/memory/1260-381-0x00007FF7BA6B0000-0x00007FF7BAAA2000-memory.dmp	upx
behavioral2/memory/1808-432-0x00007FF645BE0000-0x00007FF645FD2000-memory.dmp	upx
behavioral2/memory/4876-431-0x00007FF796010000-0x00007FF796402000-memory.dmp	upx
behavioral2/memory/4024-430-0x00007FF7991A0000-0x00007FF799592000-memory.dmp	upx
behavioral2/memory/2372-429-0x00007FF64FF80000-0x00007FF650372000-memory.dmp	upx
behavioral2/memory/1892-428-0x00007FF7D0060000-0x00007FF7D0452000-memory.dmp	upx
behavioral2/memory/1008-427-0x00007FF709080000-0x00007FF709472000-memory.dmp	upx
behavioral2/memory/1840-425-0x00007FF786830000-0x00007FF786C22000-memory.dmp	upx
behavioral2/memory/5104-378-0x00007FF60F560000-0x00007FF60F952000-memory.dmp	upx
behavioral2/memory/3264-339-0x00007FF601A10000-0x00007FF601E02000-memory.dmp	upx
behavioral2/memory/4256-338-0x00007FF7EA200000-0x00007FF7EA5F2000-memory.dmp	upx
behavioral2/memory/4836-316-0x00007FF64D470000-0x00007FF64D862000-memory.dmp	upx
behavioral2/memory/2780-238-0x00007FF69F460000-0x00007FF69F852000-memory.dmp	upx
behavioral2/memory/116-217-0x00007FF685A70000-0x00007FF685E62000-memory.dmp	upx
behavioral2/memory/744-214-0x00007FF712490000-0x00007FF712882000-memory.dmp	upx
behavioral2/files/0x00070000000234a6-203.dat	upx
behavioral2/files/0x00070000000234ba-200.dat	upx
behavioral2/files/0x00070000000234a5-196.dat	upx
behavioral2/files/0x00070000000234a4-194.dat	upx
behavioral2/files/0x00070000000234a3-191.dat	upx
behavioral2/files/0x00070000000234b9-190.dat	upx
behavioral2/files/0x00070000000234b8-189.dat	upx
behavioral2/files/0x00070000000234b7-188.dat	upx
behavioral2/files/0x00070000000234b6-187.dat	upx
behavioral2/files/0x00070000000234b5-186.dat	upx
behavioral2/files/0x00070000000234b4-185.dat	upx
behavioral2/files/0x00070000000234b2-178.dat	upx
behavioral2/files/0x00070000000234aa-156.dat	upx
behavioral2/files/0x00070000000234b1-154.dat	upx
behavioral2/files/0x00070000000234a0-151.dat	upx
behavioral2/files/0x00070000000234b0-150.dat	upx
behavioral2/memory/2828-148-0x00007FF67DAC0000-0x00007FF67DEB2000-memory.dmp	upx
behavioral2/files/0x00070000000234af-147.dat	upx
behavioral2/files/0x00070000000234ae-146.dat	upx
behavioral2/files/0x00070000000234ad-145.dat	upx
behavioral2/files/0x000700000002349f-141.dat	upx
behavioral2/files/0x00070000000234ac-136.dat	upx
behavioral2/files/0x00070000000234a2-130.dat	upx
behavioral2/files/0x000700000002349d-123.dat	upx
behavioral2/files/0x00070000000234b3-181.dat	upx
behavioral2/files/0x00070000000234ab-114.dat	upx
behavioral2/files/0x00070000000234a1-172.dat	upx
behavioral2/files/0x0008000000023495-105.dat	upx
behavioral2/files/0x00070000000234a9-96.dat	upx
behavioral2/files/0x00070000000234a8-95.dat	upx
behavioral2/files/0x00070000000234a7-94.dat	upx
behavioral2/files/0x000700000002349e-120.dat	upx
behavioral2/files/0x000700000002349c-79.dat	upx
behavioral2/files/0x0007000000023497-69.dat	upx
behavioral2/files/0x0007000000023499-57.dat	upx
behavioral2/files/0x0007000000023498-53.dat	upx
behavioral2/files/0x000700000002349b-46.dat	upx
behavioral2/files/0x0007000000023496-38.dat	upx
behavioral2/memory/4124-12-0x00007FF6301D0000-0x00007FF6305C2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\dCLhKYs.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\oSDKyKM.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\nmsmxOa.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\qbCZXxk.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\lltuuCY.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\tfuKcNi.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\zzFMgxP.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\xGthICn.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\DReqppq.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\tCRepjl.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\dIyCmex.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\BboyOkM.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\iQxHgIC.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\EQcCRbU.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\FHGdzJk.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\NxXWVva.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\dvbsFPB.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\CSMZlrv.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\FgZMXlZ.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\UpLgiYi.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\NSiNaXl.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\pKoZPDH.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\WAZPAer.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\HkyBEpi.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\eiKRqVg.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\jqcFGXr.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\ZorWDAn.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\WwGzxvO.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\bDvgqwK.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\ORgDQRi.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\LMEkeyf.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\GvTbsmy.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\kyHxJkA.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\wCGlBvi.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\avteIMv.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\YMpwRMO.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\ZilbSsx.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\krZaZKK.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\lpkAkhK.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\sAABfXK.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\TnsQIoT.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\FnRgrvh.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\vntjDZd.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\uNnPBkn.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\nDEjmXi.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\XrtMILS.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\mGooBfW.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\ZXMTgJX.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\pbomCuQ.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\IvnAOSy.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\IZAGEQY.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\EmpqTPA.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\lWiOeRG.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\ctJsKyj.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\HzDPHAS.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\DCJzwvA.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\PqlztsB.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\gLcPDkQ.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\cLpbjmz.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\cvxGWiJ.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\hxANasl.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\oRcRbCm.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\XvdmQHj.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
File created	C:\Windows\System\maaVhmw.exe	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4548	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4548	powershell.exe
Token: SeLockMemoryPrivilege	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 4548	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	84
PID 1956 wrote to memory of 4548	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	84
PID 1956 wrote to memory of 4124	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	85
PID 1956 wrote to memory of 4124	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	85
PID 1956 wrote to memory of 1808	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	86
PID 1956 wrote to memory of 1808	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	86
PID 1956 wrote to memory of 2828	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	87
PID 1956 wrote to memory of 2828	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	87
PID 1956 wrote to memory of 2368	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	88
PID 1956 wrote to memory of 2368	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	88
PID 1956 wrote to memory of 744	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	89
PID 1956 wrote to memory of 744	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	89
PID 1956 wrote to memory of 116	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	90
PID 1956 wrote to memory of 116	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	90
PID 1956 wrote to memory of 2780	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	91
PID 1956 wrote to memory of 2780	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	91
PID 1956 wrote to memory of 1636	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	92
PID 1956 wrote to memory of 1636	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	92
PID 1956 wrote to memory of 3020	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	93
PID 1956 wrote to memory of 3020	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	93
PID 1956 wrote to memory of 4836	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	94
PID 1956 wrote to memory of 4836	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	94
PID 1956 wrote to memory of 4256	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	95
PID 1956 wrote to memory of 4256	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	95
PID 1956 wrote to memory of 3264	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	96
PID 1956 wrote to memory of 3264	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	96
PID 1956 wrote to memory of 4820	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	97
PID 1956 wrote to memory of 4820	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	97
PID 1956 wrote to memory of 5104	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	98
PID 1956 wrote to memory of 5104	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	98
PID 1956 wrote to memory of 1260	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	99
PID 1956 wrote to memory of 1260	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	99
PID 1956 wrote to memory of 1840	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	100
PID 1956 wrote to memory of 1840	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	100
PID 1956 wrote to memory of 1008	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	101
PID 1956 wrote to memory of 1008	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	101
PID 1956 wrote to memory of 1892	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	102
PID 1956 wrote to memory of 1892	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	102
PID 1956 wrote to memory of 2372	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	103
PID 1956 wrote to memory of 2372	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	103
PID 1956 wrote to memory of 4024	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	104
PID 1956 wrote to memory of 4024	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	104
PID 1956 wrote to memory of 4876	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	105
PID 1956 wrote to memory of 4876	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	105
PID 1956 wrote to memory of 5080	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	106
PID 1956 wrote to memory of 5080	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	106
PID 1956 wrote to memory of 1884	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	107
PID 1956 wrote to memory of 1884	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	107
PID 1956 wrote to memory of 2996	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	108
PID 1956 wrote to memory of 2996	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	108
PID 1956 wrote to memory of 4872	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	109
PID 1956 wrote to memory of 4872	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	109
PID 1956 wrote to memory of 2952	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	110
PID 1956 wrote to memory of 2952	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	110
PID 1956 wrote to memory of 1788	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	111
PID 1956 wrote to memory of 1788	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	111
PID 1956 wrote to memory of 3088	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	112
PID 1956 wrote to memory of 3088	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	112
PID 1956 wrote to memory of 956	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	113
PID 1956 wrote to memory of 956	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	113
PID 1956 wrote to memory of 4152	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	114
PID 1956 wrote to memory of 4152	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	114
PID 1956 wrote to memory of 1628	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	115
PID 1956 wrote to memory of 1628	1956	0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0355cc43a9f793c004b93984d8cf6888_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4548
- C:\Windows\System\HkyBEpi.exe
  C:\Windows\System\HkyBEpi.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\ctJsKyj.exe
  C:\Windows\System\ctJsKyj.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\IvnAOSy.exe
  C:\Windows\System\IvnAOSy.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\WiSGfFu.exe
  C:\Windows\System\WiSGfFu.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\XrtMILS.exe
  C:\Windows\System\XrtMILS.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\GuJZxuY.exe
  C:\Windows\System\GuJZxuY.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\FgZMXlZ.exe
  C:\Windows\System\FgZMXlZ.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\zzvbDij.exe
  C:\Windows\System\zzvbDij.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\CzlTLKs.exe
  C:\Windows\System\CzlTLKs.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\gLcPDkQ.exe
  C:\Windows\System\gLcPDkQ.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\YKQjbwT.exe
  C:\Windows\System\YKQjbwT.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\WgELkah.exe
  C:\Windows\System\WgELkah.exe
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Windows\System\iCFTzoP.exe
  C:\Windows\System\iCFTzoP.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\dIyCmex.exe
  C:\Windows\System\dIyCmex.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\FVWrqpC.exe
  C:\Windows\System\FVWrqpC.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\UpLgiYi.exe
  C:\Windows\System\UpLgiYi.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\QZnmkfn.exe
  C:\Windows\System\QZnmkfn.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\avteIMv.exe
  C:\Windows\System\avteIMv.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\eiKRqVg.exe
  C:\Windows\System\eiKRqVg.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\BQytPjc.exe
  C:\Windows\System\BQytPjc.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\BboyOkM.exe
  C:\Windows\System\BboyOkM.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\NSiNaXl.exe
  C:\Windows\System\NSiNaXl.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\HzDPHAS.exe
  C:\Windows\System\HzDPHAS.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\nmsmxOa.exe
  C:\Windows\System\nmsmxOa.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\mGooBfW.exe
  C:\Windows\System\mGooBfW.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\krZaZKK.exe
  C:\Windows\System\krZaZKK.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\YMpwRMO.exe
  C:\Windows\System\YMpwRMO.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\EQcCRbU.exe
  C:\Windows\System\EQcCRbU.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\XECbELq.exe
  C:\Windows\System\XECbELq.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\IZAGEQY.exe
  C:\Windows\System\IZAGEQY.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\qbCZXxk.exe
  C:\Windows\System\qbCZXxk.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\WwGzxvO.exe
  C:\Windows\System\WwGzxvO.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\hxANasl.exe
  C:\Windows\System\hxANasl.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\FHGdzJk.exe
  C:\Windows\System\FHGdzJk.exe
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Windows\System\ZilbSsx.exe
  C:\Windows\System\ZilbSsx.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\Ahomjue.exe
  C:\Windows\System\Ahomjue.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\DCJzwvA.exe
  C:\Windows\System\DCJzwvA.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\oRcRbCm.exe
  C:\Windows\System\oRcRbCm.exe
  2⤵
  - Executes dropped EXE
  PID:3756
- C:\Windows\System\jqcFGXr.exe
  C:\Windows\System\jqcFGXr.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\XvdmQHj.exe
  C:\Windows\System\XvdmQHj.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\lltuuCY.exe
  C:\Windows\System\lltuuCY.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\maaVhmw.exe
  C:\Windows\System\maaVhmw.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\lpkAkhK.exe
  C:\Windows\System\lpkAkhK.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\iQxHgIC.exe
  C:\Windows\System\iQxHgIC.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System\muRmGAv.exe
  C:\Windows\System\muRmGAv.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\NFtWgkE.exe
  C:\Windows\System\NFtWgkE.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\LSUbwey.exe
  C:\Windows\System\LSUbwey.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System\ZXMTgJX.exe
  C:\Windows\System\ZXMTgJX.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\YMFUjtF.exe
  C:\Windows\System\YMFUjtF.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\LMEkeyf.exe
  C:\Windows\System\LMEkeyf.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\NxXWVva.exe
  C:\Windows\System\NxXWVva.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\TnsQIoT.exe
  C:\Windows\System\TnsQIoT.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\xzmATtg.exe
  C:\Windows\System\xzmATtg.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\GvTbsmy.exe
  C:\Windows\System\GvTbsmy.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\sftGLDq.exe
  C:\Windows\System\sftGLDq.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\EmpqTPA.exe
  C:\Windows\System\EmpqTPA.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\cLpbjmz.exe
  C:\Windows\System\cLpbjmz.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\pKoZPDH.exe
  C:\Windows\System\pKoZPDH.exe
  2⤵
  - Executes dropped EXE
  PID:648
- C:\Windows\System\cvxGWiJ.exe
  C:\Windows\System\cvxGWiJ.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\tfuKcNi.exe
  C:\Windows\System\tfuKcNi.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\WAZPAer.exe
  C:\Windows\System\WAZPAer.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\bDvgqwK.exe
  C:\Windows\System\bDvgqwK.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\bfvzpNm.exe
  C:\Windows\System\bfvzpNm.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\zzFMgxP.exe
  C:\Windows\System\zzFMgxP.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\SJCbyOK.exe
  C:\Windows\System\SJCbyOK.exe
  2⤵
  PID:4212
- C:\Windows\System\sAABfXK.exe
  C:\Windows\System\sAABfXK.exe
  2⤵
  PID:4956
- C:\Windows\System\wUlkLvx.exe
  C:\Windows\System\wUlkLvx.exe
  2⤵
  PID:3484
- C:\Windows\System\uXBfVrn.exe
  C:\Windows\System\uXBfVrn.exe
  2⤵
  PID:4916
- C:\Windows\System\FnRgrvh.exe
  C:\Windows\System\FnRgrvh.exe
  2⤵
  PID:3428
- C:\Windows\System\lWiOeRG.exe
  C:\Windows\System\lWiOeRG.exe
  2⤵
  PID:888
- C:\Windows\System\HPcUOzt.exe
  C:\Windows\System\HPcUOzt.exe
  2⤵
  PID:3880
- C:\Windows\System\sZOGXDl.exe
  C:\Windows\System\sZOGXDl.exe
  2⤵
  PID:2260
- C:\Windows\System\xGthICn.exe
  C:\Windows\System\xGthICn.exe
  2⤵
  PID:2716
- C:\Windows\System\DReqppq.exe
  C:\Windows\System\DReqppq.exe
  2⤵
  PID:4900
- C:\Windows\System\vntjDZd.exe
  C:\Windows\System\vntjDZd.exe
  2⤵
  PID:4564
- C:\Windows\System\kyHxJkA.exe
  C:\Windows\System\kyHxJkA.exe
  2⤵
  PID:1240
- C:\Windows\System\uNnPBkn.exe
  C:\Windows\System\uNnPBkn.exe
  2⤵
  PID:4508
- C:\Windows\System\tCRepjl.exe
  C:\Windows\System\tCRepjl.exe
  2⤵
  PID:2892
- C:\Windows\System\uxUWisu.exe
  C:\Windows\System\uxUWisu.exe
  2⤵
  PID:820
- C:\Windows\System\dCLhKYs.exe
  C:\Windows\System\dCLhKYs.exe
  2⤵
  PID:4964
- C:\Windows\System\ORgDQRi.exe
  C:\Windows\System\ORgDQRi.exe
  2⤵
  PID:1980
- C:\Windows\System\oSDKyKM.exe
  C:\Windows\System\oSDKyKM.exe
  2⤵
  PID:5140
- C:\Windows\System\nVprqci.exe
  C:\Windows\System\nVprqci.exe
  2⤵
  PID:5160
- C:\Windows\System\nDEjmXi.exe
  C:\Windows\System\nDEjmXi.exe
  2⤵
  PID:5180
- C:\Windows\System\YrCpCog.exe
  C:\Windows\System\YrCpCog.exe
  2⤵
  PID:5212
- C:\Windows\System\wCGlBvi.exe
  C:\Windows\System\wCGlBvi.exe
  2⤵
  PID:5228
- C:\Windows\System\dvbsFPB.exe
  C:\Windows\System\dvbsFPB.exe
  2⤵
  PID:5244
- C:\Windows\System\jFDslHl.exe
  C:\Windows\System\jFDslHl.exe
  2⤵
  PID:5264
- C:\Windows\System\PqlztsB.exe
  C:\Windows\System\PqlztsB.exe
  2⤵
  PID:5284
- C:\Windows\System\CrPepEr.exe
  C:\Windows\System\CrPepEr.exe
  2⤵
  PID:5308
- C:\Windows\System\mXloobl.exe
  C:\Windows\System\mXloobl.exe
  2⤵
  PID:5324
- C:\Windows\System\CSMZlrv.exe
  C:\Windows\System\CSMZlrv.exe
  2⤵
  PID:5348
- C:\Windows\System\ZorWDAn.exe
  C:\Windows\System\ZorWDAn.exe
  2⤵
  PID:5364
- C:\Windows\System\pbomCuQ.exe
  C:\Windows\System\pbomCuQ.exe
  2⤵
  PID:5580
- C:\Windows\System\jjnDhUT.exe
  C:\Windows\System\jjnDhUT.exe
  2⤵
  PID:5600
- C:\Windows\System\lcYeemc.exe
  C:\Windows\System\lcYeemc.exe
  2⤵
  PID:5616
- C:\Windows\System\xbnbXAV.exe
  C:\Windows\System\xbnbXAV.exe
  2⤵
  PID:5632
- C:\Windows\System\cJkXQaZ.exe
  C:\Windows\System\cJkXQaZ.exe
  2⤵
  PID:5784
- C:\Windows\System\hevQjdx.exe
  C:\Windows\System\hevQjdx.exe
  2⤵
  PID:5804
- C:\Windows\System\SEiClLK.exe
  C:\Windows\System\SEiClLK.exe
  2⤵
  PID:5828
- C:\Windows\System\rfjrNRS.exe
  C:\Windows\System\rfjrNRS.exe
  2⤵
  PID:5844
- C:\Windows\System\GujiLYg.exe
  C:\Windows\System\GujiLYg.exe
  2⤵
  PID:5864
- C:\Windows\System\YdAkWeX.exe
  C:\Windows\System\YdAkWeX.exe
  2⤵
  PID:5884
- C:\Windows\System\fxIKroq.exe
  C:\Windows\System\fxIKroq.exe
  2⤵
  PID:5900
- C:\Windows\System\FANDsLh.exe
  C:\Windows\System\FANDsLh.exe
  2⤵
  PID:5920
- C:\Windows\System\OxizFIN.exe
  C:\Windows\System\OxizFIN.exe
  2⤵
  PID:5940
- C:\Windows\System\drCvyQC.exe
  C:\Windows\System\drCvyQC.exe
  2⤵
  PID:5960
- C:\Windows\System\fegkCLv.exe
  C:\Windows\System\fegkCLv.exe
  2⤵
  PID:5976
- C:\Windows\System\IQLSQYv.exe
  C:\Windows\System\IQLSQYv.exe
  2⤵
  PID:6000
- C:\Windows\System\xTFpMKt.exe
  C:\Windows\System\xTFpMKt.exe
  2⤵
  PID:6016
- C:\Windows\System\ussSLfG.exe
  C:\Windows\System\ussSLfG.exe
  2⤵
  PID:6040
- C:\Windows\System\otqLGCz.exe
  C:\Windows\System\otqLGCz.exe
  2⤵
  PID:6064
- C:\Windows\System\YuAWGuz.exe
  C:\Windows\System\YuAWGuz.exe
  2⤵
  PID:6084
- C:\Windows\System\ImNOBAQ.exe
  C:\Windows\System\ImNOBAQ.exe
  2⤵
  PID:6104
- C:\Windows\System\xLaBFap.exe
  C:\Windows\System\xLaBFap.exe
  2⤵
  PID:6124
- C:\Windows\System\PIkGyUI.exe
  C:\Windows\System\PIkGyUI.exe
  2⤵
  PID:3768
- C:\Windows\System\GbiexwO.exe
  C:\Windows\System\GbiexwO.exe
  2⤵
  PID:4432
- C:\Windows\System\spyjWRu.exe
  C:\Windows\System\spyjWRu.exe
  2⤵
  PID:4744
- C:\Windows\System\SzqBijm.exe
  C:\Windows\System\SzqBijm.exe
  2⤵
  PID:4908
- C:\Windows\System\HwjmvAj.exe
  C:\Windows\System\HwjmvAj.exe
  2⤵
  PID:5724
- C:\Windows\System\lKLIgts.exe
  C:\Windows\System\lKLIgts.exe
  2⤵
  PID:5772
- C:\Windows\System\MWvYhkO.exe
  C:\Windows\System\MWvYhkO.exe
  2⤵
  PID:5812
- C:\Windows\System\MHMabif.exe
  C:\Windows\System\MHMabif.exe
  2⤵
  PID:5852
- C:\Windows\System\XhmvOiH.exe
  C:\Windows\System\XhmvOiH.exe
  2⤵
  PID:5896
- C:\Windows\System\TaWbgnC.exe
  C:\Windows\System\TaWbgnC.exe
  2⤵
  PID:2788
- C:\Windows\System\JlIOyvH.exe
  C:\Windows\System\JlIOyvH.exe
  2⤵
  PID:4608
- C:\Windows\System\OtLhfTB.exe
  C:\Windows\System\OtLhfTB.exe
  2⤵
  PID:5420
- C:\Windows\System\TUljmSE.exe
  C:\Windows\System\TUljmSE.exe
  2⤵
  PID:5496
- C:\Windows\System\AAPmmpi.exe
  C:\Windows\System\AAPmmpi.exe
  2⤵
  PID:5536
- C:\Windows\System\GxWQFsf.exe
  C:\Windows\System\GxWQFsf.exe
  2⤵
  PID:5640
- C:\Windows\System\XbWLHDl.exe
  C:\Windows\System\XbWLHDl.exe
  2⤵
  PID:4620
- C:\Windows\System\mkiIGHr.exe
  C:\Windows\System\mkiIGHr.exe
  2⤵
  PID:5740
- C:\Windows\System\tlRHzHq.exe
  C:\Windows\System\tlRHzHq.exe
  2⤵
  PID:5780
- C:\Windows\System\hebshqr.exe
  C:\Windows\System\hebshqr.exe
  2⤵
  PID:5648
- C:\Windows\System\IVZhjLr.exe
  C:\Windows\System\IVZhjLr.exe
  2⤵
  PID:4396
- C:\Windows\System\rKhjKrw.exe
  C:\Windows\System\rKhjKrw.exe
  2⤵
  PID:2520
- C:\Windows\System\xpKYDcB.exe
  C:\Windows\System\xpKYDcB.exe
  2⤵
  PID:4300
- C:\Windows\System\URIUOlJ.exe
  C:\Windows\System\URIUOlJ.exe
  2⤵
  PID:5400
- C:\Windows\System\welCklz.exe
  C:\Windows\System\welCklz.exe
  2⤵
  PID:5528
- C:\Windows\System\NrqgYkv.exe
  C:\Windows\System\NrqgYkv.exe
  2⤵
  PID:5608
- C:\Windows\System\oWJFTss.exe
  C:\Windows\System\oWJFTss.exe
  2⤵
  PID:5856
- C:\Windows\System\NHVrOCY.exe
  C:\Windows\System\NHVrOCY.exe
  2⤵
  PID:4468
- C:\Windows\System\vwqKUAR.exe
  C:\Windows\System\vwqKUAR.exe
  2⤵
  PID:3640
- C:\Windows\System\ZpHNPOz.exe
  C:\Windows\System\ZpHNPOz.exe
  2⤵
  PID:3076
- C:\Windows\System\EQBhDwY.exe
  C:\Windows\System\EQBhDwY.exe
  2⤵
  PID:4772
- C:\Windows\System\QTghZgq.exe
  C:\Windows\System\QTghZgq.exe
  2⤵
  PID:2240
- C:\Windows\System\iOTvGjO.exe
  C:\Windows\System\iOTvGjO.exe
  2⤵
  PID:4628
- C:\Windows\System\VWiVPJL.exe
  C:\Windows\System\VWiVPJL.exe
  2⤵
  PID:2824
- C:\Windows\System\aoUjhoV.exe
  C:\Windows\System\aoUjhoV.exe
  2⤵
  PID:5568
- C:\Windows\System\UJIJGYF.exe
  C:\Windows\System\UJIJGYF.exe
  2⤵
  PID:6160
- C:\Windows\System\LbNhuAj.exe
  C:\Windows\System\LbNhuAj.exe
  2⤵
  PID:6180
- C:\Windows\System\wicRtAe.exe
  C:\Windows\System\wicRtAe.exe
  2⤵
  PID:6212
- C:\Windows\System\IBTGMAz.exe
  C:\Windows\System\IBTGMAz.exe
  2⤵
  PID:6236
- C:\Windows\System\mDkhVeU.exe
  C:\Windows\System\mDkhVeU.exe
  2⤵
  PID:6256
- C:\Windows\System\fDhTGOO.exe
  C:\Windows\System\fDhTGOO.exe
  2⤵
  PID:6288
- C:\Windows\System\MEZccRG.exe
  C:\Windows\System\MEZccRG.exe
  2⤵
  PID:6304
- C:\Windows\System\ZmQkmQy.exe
  C:\Windows\System\ZmQkmQy.exe
  2⤵
  PID:6324
- C:\Windows\System\yJaXifz.exe
  C:\Windows\System\yJaXifz.exe
  2⤵
  PID:6344
- C:\Windows\System\kaWSuFd.exe
  C:\Windows\System\kaWSuFd.exe
  2⤵
  PID:6372
- C:\Windows\System\uWmMSQf.exe
  C:\Windows\System\uWmMSQf.exe
  2⤵
  PID:6388
- C:\Windows\System\llifySQ.exe
  C:\Windows\System\llifySQ.exe
  2⤵
  PID:6416
- C:\Windows\System\BUCgmiW.exe
  C:\Windows\System\BUCgmiW.exe
  2⤵
  PID:6440
- C:\Windows\System\qHvMosS.exe
  C:\Windows\System\qHvMosS.exe
  2⤵
  PID:6468
- C:\Windows\System\EfVngKC.exe
  C:\Windows\System\EfVngKC.exe
  2⤵
  PID:6492
- C:\Windows\System\URsVHzl.exe
  C:\Windows\System\URsVHzl.exe
  2⤵
  PID:6520
- C:\Windows\System\vULshTI.exe
  C:\Windows\System\vULshTI.exe
  2⤵
  PID:6540
- C:\Windows\System\ZAlAEKD.exe
  C:\Windows\System\ZAlAEKD.exe
  2⤵
  PID:6568
- C:\Windows\System\ysOZGkt.exe
  C:\Windows\System\ysOZGkt.exe
  2⤵
  PID:6600
- C:\Windows\System\BSHpAiV.exe
  C:\Windows\System\BSHpAiV.exe
  2⤵
  PID:6628
- C:\Windows\System\UNAUdKb.exe
  C:\Windows\System\UNAUdKb.exe
  2⤵
  PID:6652
- C:\Windows\System\onothiv.exe
  C:\Windows\System\onothiv.exe
  2⤵
  PID:6672
- C:\Windows\System\dTIxKUv.exe
  C:\Windows\System\dTIxKUv.exe
  2⤵
  PID:6696
- C:\Windows\System\RwEGvkK.exe
  C:\Windows\System\RwEGvkK.exe
  2⤵
  PID:6712
- C:\Windows\System\lXpUGuy.exe
  C:\Windows\System\lXpUGuy.exe
  2⤵
  PID:6736
- C:\Windows\System\JdlWByV.exe
  C:\Windows\System\JdlWByV.exe
  2⤵
  PID:6772
- C:\Windows\System\VZvClPF.exe
  C:\Windows\System\VZvClPF.exe
  2⤵
  PID:6792
- C:\Windows\System\xccMPkx.exe
  C:\Windows\System\xccMPkx.exe
  2⤵
  PID:6816
- C:\Windows\System\MuCOvmL.exe
  C:\Windows\System\MuCOvmL.exe
  2⤵
  PID:6836
- C:\Windows\System\nfQOxtp.exe
  C:\Windows\System\nfQOxtp.exe
  2⤵
  PID:6856
- C:\Windows\System\AVtsatp.exe
  C:\Windows\System\AVtsatp.exe
  2⤵
  PID:6884
- C:\Windows\System\tlVzrxt.exe
  C:\Windows\System\tlVzrxt.exe
  2⤵
  PID:6900
- C:\Windows\System\JGuYypN.exe
  C:\Windows\System\JGuYypN.exe
  2⤵
  PID:6920
- C:\Windows\System\wHdFAlC.exe
  C:\Windows\System\wHdFAlC.exe
  2⤵
  PID:6940
- C:\Windows\System\QTosTBo.exe
  C:\Windows\System\QTosTBo.exe
  2⤵
  PID:6964
- C:\Windows\System\mCamIhv.exe
  C:\Windows\System\mCamIhv.exe
  2⤵
  PID:6984
- C:\Windows\System\lvSabPu.exe
  C:\Windows\System\lvSabPu.exe
  2⤵
  PID:7008
- C:\Windows\System\FMJpTnS.exe
  C:\Windows\System\FMJpTnS.exe
  2⤵
  PID:7040
- C:\Windows\System\ujbkBsj.exe
  C:\Windows\System\ujbkBsj.exe
  2⤵
  PID:7060
- C:\Windows\System\DupSfvx.exe
  C:\Windows\System\DupSfvx.exe
  2⤵
  PID:7084
- C:\Windows\System\WfWeLcD.exe
  C:\Windows\System\WfWeLcD.exe
  2⤵
  PID:7116
- C:\Windows\System\NWkQOPj.exe
  C:\Windows\System\NWkQOPj.exe
  2⤵
  PID:7144
- C:\Windows\System\mfHkxey.exe
  C:\Windows\System\mfHkxey.exe
  2⤵
  PID:7160
- C:\Windows\System\OYdFQeA.exe
  C:\Windows\System\OYdFQeA.exe
  2⤵
  PID:4852
- C:\Windows\System\hXsuTdZ.exe
  C:\Windows\System\hXsuTdZ.exe
  2⤵
  PID:5516
- C:\Windows\System\IzjEQSH.exe
  C:\Windows\System\IzjEQSH.exe
  2⤵
  PID:2112
- C:\Windows\System\WBLdUMa.exe
  C:\Windows\System\WBLdUMa.exe
  2⤵
  PID:4252
- C:\Windows\System\wkglKmY.exe
  C:\Windows\System\wkglKmY.exe
  2⤵
  PID:4240
- C:\Windows\System\kxFCaYL.exe
  C:\Windows\System\kxFCaYL.exe
  2⤵
  PID:2836
- C:\Windows\System\tAenCEU.exe
  C:\Windows\System\tAenCEU.exe
  2⤵
  PID:6332
- C:\Windows\System\QAfDReR.exe
  C:\Windows\System\QAfDReR.exe
  2⤵
  PID:5700
- C:\Windows\System\SzkMwMD.exe
  C:\Windows\System\SzkMwMD.exe
  2⤵
  PID:4988
- C:\Windows\System\OKkNQka.exe
  C:\Windows\System\OKkNQka.exe
  2⤵
  PID:3940
- C:\Windows\System\gygfxWu.exe
  C:\Windows\System\gygfxWu.exe
  2⤵
  PID:6168
- C:\Windows\System\PELbBKt.exe
  C:\Windows\System\PELbBKt.exe
  2⤵
  PID:6220
- C:\Windows\System\Epxpuzb.exe
  C:\Windows\System\Epxpuzb.exe
  2⤵
  PID:6536
- C:\Windows\System\uIiAVKq.exe
  C:\Windows\System\uIiAVKq.exe
  2⤵
  PID:6384
- C:\Windows\System\MrReEKw.exe
  C:\Windows\System\MrReEKw.exe
  2⤵
  PID:6356
- C:\Windows\System\bFdjEVA.exe
  C:\Windows\System\bFdjEVA.exe
  2⤵
  PID:6476
- C:\Windows\System\CgMQvpG.exe
  C:\Windows\System\CgMQvpG.exe
  2⤵
  PID:6500
- C:\Windows\System\uSADcVm.exe
  C:\Windows\System\uSADcVm.exe
  2⤵
  PID:6948
- C:\Windows\System\YJQCKxz.exe
  C:\Windows\System\YJQCKxz.exe
  2⤵
  PID:3856
- C:\Windows\System\vJKQytv.exe
  C:\Windows\System\vJKQytv.exe
  2⤵
  PID:6640
- C:\Windows\System\eqtndTf.exe
  C:\Windows\System\eqtndTf.exe
  2⤵
  PID:4584
- C:\Windows\System\PkaTeHk.exe
  C:\Windows\System\PkaTeHk.exe
  2⤵
  PID:6668
- C:\Windows\System\yWobAyo.exe
  C:\Windows\System\yWobAyo.exe
  2⤵
  PID:6688
- C:\Windows\System\UghNhRP.exe
  C:\Windows\System\UghNhRP.exe
  2⤵
  PID:6728
- C:\Windows\System\tMbqcVY.exe
  C:\Windows\System\tMbqcVY.exe
  2⤵
  PID:7172
- C:\Windows\System\sakutEj.exe
  C:\Windows\System\sakutEj.exe
  2⤵
  PID:7196
- C:\Windows\System\SJAZdks.exe
  C:\Windows\System\SJAZdks.exe
  2⤵
  PID:7212
- C:\Windows\System\DKWHVUj.exe
  C:\Windows\System\DKWHVUj.exe
  2⤵
  PID:7236
- C:\Windows\System\UBDNygG.exe
  C:\Windows\System\UBDNygG.exe
  2⤵
  PID:7256
- C:\Windows\System\fDsNJVA.exe
  C:\Windows\System\fDsNJVA.exe
  2⤵
  PID:7276
- C:\Windows\System\FFGpoUq.exe
  C:\Windows\System\FFGpoUq.exe
  2⤵
  PID:7300
- C:\Windows\System\JWqtPPM.exe
  C:\Windows\System\JWqtPPM.exe
  2⤵
  PID:7324
- C:\Windows\System\WCXKLhi.exe
  C:\Windows\System\WCXKLhi.exe
  2⤵
  PID:7344
- C:\Windows\System\INTXzbR.exe
  C:\Windows\System\INTXzbR.exe
  2⤵
  PID:7368
- C:\Windows\System\qWMOVww.exe
  C:\Windows\System\qWMOVww.exe
  2⤵
  PID:7388
- C:\Windows\System\PmtximF.exe
  C:\Windows\System\PmtximF.exe
  2⤵
  PID:7408
- C:\Windows\System\odBiFpB.exe
  C:\Windows\System\odBiFpB.exe
  2⤵
  PID:7428
- C:\Windows\System\pUgqtNv.exe
  C:\Windows\System\pUgqtNv.exe
  2⤵
  PID:7448
- C:\Windows\System\zuLUwMi.exe
  C:\Windows\System\zuLUwMi.exe
  2⤵
  PID:7472
- C:\Windows\System\qpHCCbG.exe
  C:\Windows\System\qpHCCbG.exe
  2⤵
  PID:7492
- C:\Windows\System\SYmTGaQ.exe
  C:\Windows\System\SYmTGaQ.exe
  2⤵
  PID:7516
- C:\Windows\System\IfSMVQi.exe
  C:\Windows\System\IfSMVQi.exe
  2⤵
  PID:7536
- C:\Windows\System\gQceUAB.exe
  C:\Windows\System\gQceUAB.exe
  2⤵
  PID:7560
- C:\Windows\System\KvBOAbn.exe
  C:\Windows\System\KvBOAbn.exe
  2⤵
  PID:7580
- C:\Windows\System\MBAYtft.exe
  C:\Windows\System\MBAYtft.exe
  2⤵
  PID:7600
- C:\Windows\System\eAPEePN.exe
  C:\Windows\System\eAPEePN.exe
  2⤵
  PID:7624
- C:\Windows\System\EyXGETn.exe
  C:\Windows\System\EyXGETn.exe
  2⤵
  PID:7648
- C:\Windows\System\XKbfAPg.exe
  C:\Windows\System\XKbfAPg.exe
  2⤵
  PID:7668
- C:\Windows\System\JFFjvMW.exe
  C:\Windows\System\JFFjvMW.exe
  2⤵
  PID:7692
- C:\Windows\System\ZftFurr.exe
  C:\Windows\System\ZftFurr.exe
  2⤵
  PID:7716
- C:\Windows\System\Ycgfxvr.exe
  C:\Windows\System\Ycgfxvr.exe
  2⤵
  PID:7732
- C:\Windows\System\ItbLBbs.exe
  C:\Windows\System\ItbLBbs.exe
  2⤵
  PID:7756
- C:\Windows\System\GYXDkDm.exe
  C:\Windows\System\GYXDkDm.exe
  2⤵
  PID:7772
- C:\Windows\System\XzUGxuD.exe
  C:\Windows\System\XzUGxuD.exe
  2⤵
  PID:7796
- C:\Windows\System\HmUBTsB.exe
  C:\Windows\System\HmUBTsB.exe
  2⤵
  PID:7816
- C:\Windows\System\CsslHhD.exe
  C:\Windows\System\CsslHhD.exe
  2⤵
  PID:7836
- C:\Windows\System\bsiohTS.exe
  C:\Windows\System\bsiohTS.exe
  2⤵
  PID:7860
- C:\Windows\System\kXHHpTz.exe
  C:\Windows\System\kXHHpTz.exe
  2⤵
  PID:7880
- C:\Windows\System\Buluoje.exe
  C:\Windows\System\Buluoje.exe
  2⤵
  PID:7900
- C:\Windows\System\UNaKLsG.exe
  C:\Windows\System\UNaKLsG.exe
  2⤵
  PID:7920
- C:\Windows\System\IgMQSPF.exe
  C:\Windows\System\IgMQSPF.exe
  2⤵
  PID:7940
- C:\Windows\System\XUxyXrz.exe
  C:\Windows\System\XUxyXrz.exe
  2⤵
  PID:7972
- C:\Windows\System\sDDIAcw.exe
  C:\Windows\System\sDDIAcw.exe
  2⤵
  PID:7988
- C:\Windows\System\eIBgtKt.exe
  C:\Windows\System\eIBgtKt.exe
  2⤵
  PID:8008
- C:\Windows\System\FflVUwu.exe
  C:\Windows\System\FflVUwu.exe
  2⤵
  PID:8028
- C:\Windows\System\TKAvMdU.exe
  C:\Windows\System\TKAvMdU.exe
  2⤵
  PID:8052
- C:\Windows\System\fUmsBFW.exe
  C:\Windows\System\fUmsBFW.exe
  2⤵
  PID:8076
- C:\Windows\System\KlNwlXB.exe
  C:\Windows\System\KlNwlXB.exe
  2⤵
  PID:8096
- C:\Windows\System\MVCNGub.exe
  C:\Windows\System\MVCNGub.exe
  2⤵
  PID:8116
- C:\Windows\System\IrlBFlK.exe
  C:\Windows\System\IrlBFlK.exe
  2⤵
  PID:8132
- C:\Windows\System\fuhOfid.exe
  C:\Windows\System\fuhOfid.exe
  2⤵
  PID:8148
- C:\Windows\System\zfkqMmq.exe
  C:\Windows\System\zfkqMmq.exe
  2⤵
  PID:8172
- C:\Windows\System\GFsprBM.exe
  C:\Windows\System\GFsprBM.exe
  2⤵
  PID:6756
- C:\Windows\System\bcnQeQD.exe
  C:\Windows\System\bcnQeQD.exe
  2⤵
  PID:6800
- C:\Windows\System\hRWjyeT.exe
  C:\Windows\System\hRWjyeT.exe
  2⤵
  PID:6876
- C:\Windows\System\sZlroiO.exe
  C:\Windows\System\sZlroiO.exe
  2⤵
  PID:5468
- C:\Windows\System\mdxRIqP.exe
  C:\Windows\System\mdxRIqP.exe
  2⤵
  PID:6976
- C:\Windows\System\yghfOtP.exe
  C:\Windows\System\yghfOtP.exe
  2⤵
  PID:7016
- C:\Windows\System\aquiTuG.exe
  C:\Windows\System\aquiTuG.exe
  2⤵
  PID:2968
- C:\Windows\System\GbbkNfl.exe
  C:\Windows\System\GbbkNfl.exe
  2⤵
  PID:7080
- C:\Windows\System\hvfbyIG.exe
  C:\Windows\System\hvfbyIG.exe
  2⤵
  PID:7104
- C:\Windows\System\vqTHzeO.exe
  C:\Windows\System\vqTHzeO.exe
  2⤵
  PID:7140
- C:\Windows\System\DpocOPt.exe
  C:\Windows\System\DpocOPt.exe
  2⤵
  PID:7228
- C:\Windows\System\OHiLLLS.exe
  C:\Windows\System\OHiLLLS.exe
  2⤵
  PID:6408
- C:\Windows\System\IXgudLG.exe
  C:\Windows\System\IXgudLG.exe
  2⤵
  PID:7356
- C:\Windows\System\viWBUfS.exe
  C:\Windows\System\viWBUfS.exe
  2⤵
  PID:7424
- C:\Windows\System\cdoaNCM.exe
  C:\Windows\System\cdoaNCM.exe
  2⤵
  PID:6320
- C:\Windows\System\OUkgWdS.exe
  C:\Windows\System\OUkgWdS.exe
  2⤵
  PID:7632
- C:\Windows\System\LzbbzcJ.exe
  C:\Windows\System\LzbbzcJ.exe
  2⤵
  PID:6852
- C:\Windows\System\FaHuJdT.exe
  C:\Windows\System\FaHuJdT.exe
  2⤵
  PID:6708
- C:\Windows\System\fEqOsan.exe
  C:\Windows\System\fEqOsan.exe
  2⤵
  PID:5860
- C:\Windows\System\qwWsQpo.exe
  C:\Windows\System\qwWsQpo.exe
  2⤵
  PID:8204
- C:\Windows\System\EBJwdIX.exe
  C:\Windows\System\EBJwdIX.exe
  2⤵
  PID:8228
- C:\Windows\System\FgQTJYV.exe
  C:\Windows\System\FgQTJYV.exe
  2⤵
  PID:8248
- C:\Windows\System\KTTpBQf.exe
  C:\Windows\System\KTTpBQf.exe
  2⤵
  PID:8272
- C:\Windows\System\zUlZFFx.exe
  C:\Windows\System\zUlZFFx.exe
  2⤵
  PID:8288
- C:\Windows\System\mbxPeSr.exe
  C:\Windows\System\mbxPeSr.exe
  2⤵
  PID:8308
- C:\Windows\System\szzlRjg.exe
  C:\Windows\System\szzlRjg.exe
  2⤵
  PID:8328
- C:\Windows\System\IerEqTU.exe
  C:\Windows\System\IerEqTU.exe
  2⤵
  PID:8356
- C:\Windows\System\ZEWsicj.exe
  C:\Windows\System\ZEWsicj.exe
  2⤵
  PID:8380
- C:\Windows\System\pPUejGj.exe
  C:\Windows\System\pPUejGj.exe
  2⤵
  PID:8400
- C:\Windows\System\eNaWTAu.exe
  C:\Windows\System\eNaWTAu.exe
  2⤵
  PID:8416
- C:\Windows\System\VHaArLk.exe
  C:\Windows\System\VHaArLk.exe
  2⤵
  PID:8436
- C:\Windows\System\obgaNqA.exe
  C:\Windows\System\obgaNqA.exe
  2⤵
  PID:8456
- C:\Windows\System\GVGueYO.exe
  C:\Windows\System\GVGueYO.exe
  2⤵
  PID:8472
- C:\Windows\System\GKHnJda.exe
  C:\Windows\System\GKHnJda.exe
  2⤵
  PID:8492
- C:\Windows\System\vLkBbec.exe
  C:\Windows\System\vLkBbec.exe
  2⤵
  PID:8508
- C:\Windows\System\AsDxtHp.exe
  C:\Windows\System\AsDxtHp.exe
  2⤵
  PID:8528
- C:\Windows\System\VNQccCJ.exe
  C:\Windows\System\VNQccCJ.exe
  2⤵
  PID:8552
- C:\Windows\System\eYmgAqY.exe
  C:\Windows\System\eYmgAqY.exe
  2⤵
  PID:8572
- C:\Windows\System\kDWTdSc.exe
  C:\Windows\System\kDWTdSc.exe
  2⤵
  PID:8592
- C:\Windows\System\ktCTgLb.exe
  C:\Windows\System\ktCTgLb.exe
  2⤵
  PID:8612
- C:\Windows\System\WtnbMWO.exe
  C:\Windows\System\WtnbMWO.exe
  2⤵
  PID:8632
- C:\Windows\System\QyQSRYc.exe
  C:\Windows\System\QyQSRYc.exe
  2⤵
  PID:8652
- C:\Windows\System\yPgJNtl.exe
  C:\Windows\System\yPgJNtl.exe
  2⤵
  PID:8672
- C:\Windows\System\wBbvpQD.exe
  C:\Windows\System\wBbvpQD.exe
  2⤵
  PID:8692
- C:\Windows\System\tNQRGvE.exe
  C:\Windows\System\tNQRGvE.exe
  2⤵
  PID:8720
- C:\Windows\System\IHSYSGI.exe
  C:\Windows\System\IHSYSGI.exe
  2⤵
  PID:8740
- C:\Windows\System\lgsmJxm.exe
  C:\Windows\System\lgsmJxm.exe
  2⤵
  PID:8764
- C:\Windows\System\jrvVIZK.exe
  C:\Windows\System\jrvVIZK.exe
  2⤵
  PID:8788
- C:\Windows\System\kfzPNWA.exe
  C:\Windows\System\kfzPNWA.exe
  2⤵
  PID:8804
- C:\Windows\System\yIYWXeG.exe
  C:\Windows\System\yIYWXeG.exe
  2⤵
  PID:8828
- C:\Windows\System\jfhqhaY.exe
  C:\Windows\System\jfhqhaY.exe
  2⤵
  PID:8844
- C:\Windows\System\bemkHuh.exe
  C:\Windows\System\bemkHuh.exe
  2⤵
  PID:8860
- C:\Windows\System\kQmAeHr.exe
  C:\Windows\System\kQmAeHr.exe
  2⤵
  PID:8876
- C:\Windows\System\hRxGBnl.exe
  C:\Windows\System\hRxGBnl.exe
  2⤵
  PID:8896
- C:\Windows\System\XjyoQrI.exe
  C:\Windows\System\XjyoQrI.exe
  2⤵
  PID:8928
- C:\Windows\System\ASmXECF.exe
  C:\Windows\System\ASmXECF.exe
  2⤵
  PID:8956
- C:\Windows\System\nFFmmAO.exe
  C:\Windows\System\nFFmmAO.exe
  2⤵
  PID:8980
- C:\Windows\System\DAfuKwN.exe
  C:\Windows\System\DAfuKwN.exe
  2⤵
  PID:8996
- C:\Windows\System\sIJWHMK.exe
  C:\Windows\System\sIJWHMK.exe
  2⤵
  PID:9016
- C:\Windows\System\TJBuoIy.exe
  C:\Windows\System\TJBuoIy.exe
  2⤵
  PID:9036
- C:\Windows\System\rXbICJG.exe
  C:\Windows\System\rXbICJG.exe
  2⤵
  PID:9056
- C:\Windows\System\QtWQOKk.exe
  C:\Windows\System\QtWQOKk.exe
  2⤵
  PID:9080
- C:\Windows\System\oPBpTDo.exe
  C:\Windows\System\oPBpTDo.exe
  2⤵
  PID:9104
- C:\Windows\System\FcMrgJN.exe
  C:\Windows\System\FcMrgJN.exe
  2⤵
  PID:9120
- C:\Windows\System\WmQyoMg.exe
  C:\Windows\System\WmQyoMg.exe
  2⤵
  PID:9136
- C:\Windows\System\mNeBhfm.exe
  C:\Windows\System\mNeBhfm.exe
  2⤵
  PID:9156
- C:\Windows\System\lojpLZV.exe
  C:\Windows\System\lojpLZV.exe
  2⤵
  PID:9176
- C:\Windows\System\yRMIeTa.exe
  C:\Windows\System\yRMIeTa.exe
  2⤵
  PID:9196
- C:\Windows\System\SnQXvJw.exe
  C:\Windows\System\SnQXvJw.exe
  2⤵
  PID:7828
- C:\Windows\System\fEcxtUX.exe
  C:\Windows\System\fEcxtUX.exe
  2⤵
  PID:7204
- C:\Windows\System\jYsYvjC.exe
  C:\Windows\System\jYsYvjC.exe
  2⤵
  PID:7932
- C:\Windows\System\MfXfbxv.exe
  C:\Windows\System\MfXfbxv.exe
  2⤵
  PID:7444
- C:\Windows\System\cpMvLAO.exe
  C:\Windows\System\cpMvLAO.exe
  2⤵
  PID:7484
- C:\Windows\System\BzFCdfY.exe
  C:\Windows\System\BzFCdfY.exe
  2⤵
  PID:8188
- C:\Windows\System\VuEcmdk.exe
  C:\Windows\System\VuEcmdk.exe
  2⤵
  PID:7528
- C:\Windows\System\clwPvWw.exe
  C:\Windows\System\clwPvWw.exe
  2⤵
  PID:7588
- C:\Windows\System\dAfXpti.exe
  C:\Windows\System\dAfXpti.exe
  2⤵
  PID:7612
- C:\Windows\System\TBHbLGX.exe
  C:\Windows\System\TBHbLGX.exe
  2⤵
  PID:7664
- C:\Windows\System\vUdNgoA.exe
  C:\Windows\System\vUdNgoA.exe
  2⤵
  PID:7684
- C:\Windows\System\yGfNqpS.exe
  C:\Windows\System\yGfNqpS.exe
  2⤵
  PID:7708
- C:\Windows\System\IRRgssp.exe
  C:\Windows\System\IRRgssp.exe
  2⤵
  PID:6248
- C:\Windows\System\XUichqU.exe
  C:\Windows\System\XUichqU.exe
  2⤵
  PID:5764
- C:\Windows\System\WdHJDoL.exe
  C:\Windows\System\WdHJDoL.exe
  2⤵
  PID:7812
- C:\Windows\System\ctWItcM.exe
  C:\Windows\System\ctWItcM.exe
  2⤵
  PID:7892
- C:\Windows\System\DwrVpIh.exe
  C:\Windows\System\DwrVpIh.exe
  2⤵
  PID:8260
- C:\Windows\System\qZhqsZR.exe
  C:\Windows\System\qZhqsZR.exe
  2⤵
  PID:7296
- C:\Windows\System\kqBpktS.exe
  C:\Windows\System\kqBpktS.exe
  2⤵
  PID:7352
- C:\Windows\System\ivMfOOM.exe
  C:\Windows\System\ivMfOOM.exe
  2⤵
  PID:8364
- C:\Windows\System\HXlwDBg.exe
  C:\Windows\System\HXlwDBg.exe
  2⤵
  PID:8388
- C:\Windows\System\UYWSHat.exe
  C:\Windows\System\UYWSHat.exe
  2⤵
  PID:7404
- C:\Windows\System\NUhfLmE.exe
  C:\Windows\System\NUhfLmE.exe
  2⤵
  PID:8088
- C:\Windows\System\YygzcHo.exe
  C:\Windows\System\YygzcHo.exe
  2⤵
  PID:7416
- C:\Windows\System\RGHkUyV.exe
  C:\Windows\System\RGHkUyV.exe
  2⤵
  PID:8500
- C:\Windows\System\UVxdzwk.exe
  C:\Windows\System\UVxdzwk.exe
  2⤵
  PID:6848
- C:\Windows\System\eFuibEp.exe
  C:\Windows\System\eFuibEp.exe
  2⤵
  PID:8580
- C:\Windows\System\JPnxBxn.exe
  C:\Windows\System\JPnxBxn.exe
  2⤵
  PID:1280
- C:\Windows\System\aaDdkYs.exe
  C:\Windows\System\aaDdkYs.exe
  2⤵
  PID:8648
- C:\Windows\System\eTLMtWf.exe
  C:\Windows\System\eTLMtWf.exe
  2⤵
  PID:6680
- C:\Windows\System\jUbLqTh.exe
  C:\Windows\System\jUbLqTh.exe
  2⤵
  PID:1960
- C:\Windows\System\SIfELJX.exe
  C:\Windows\System\SIfELJX.exe
  2⤵
  PID:7556
- C:\Windows\System\thegmsG.exe
  C:\Windows\System\thegmsG.exe
  2⤵
  PID:9232
- C:\Windows\System\LYuBRzO.exe
  C:\Windows\System\LYuBRzO.exe
  2⤵
  PID:9248
- C:\Windows\System\XPvVJOQ.exe
  C:\Windows\System\XPvVJOQ.exe
  2⤵
  PID:9276
- C:\Windows\System\nJgSXvM.exe
  C:\Windows\System\nJgSXvM.exe
  2⤵
  PID:9296
- C:\Windows\System\iefbkFp.exe
  C:\Windows\System\iefbkFp.exe
  2⤵
  PID:9316
- C:\Windows\System\ueezoki.exe
  C:\Windows\System\ueezoki.exe
  2⤵
  PID:9340
- C:\Windows\System\TzHzZvV.exe
  C:\Windows\System\TzHzZvV.exe
  2⤵
  PID:9360
- C:\Windows\System\ttrcwGV.exe
  C:\Windows\System\ttrcwGV.exe
  2⤵
  PID:9380
- C:\Windows\System\nYZuIcS.exe
  C:\Windows\System\nYZuIcS.exe
  2⤵
  PID:9404
- C:\Windows\System\ebiXxLZ.exe
  C:\Windows\System\ebiXxLZ.exe
  2⤵
  PID:9428
- C:\Windows\System\sTCDRTf.exe
  C:\Windows\System\sTCDRTf.exe
  2⤵
  PID:9444
- C:\Windows\System\acNDYFa.exe
  C:\Windows\System\acNDYFa.exe
  2⤵
  PID:9468
- C:\Windows\System\KRJfDYG.exe
  C:\Windows\System\KRJfDYG.exe
  2⤵
  PID:9488
- C:\Windows\System\WiAoONJ.exe
  C:\Windows\System\WiAoONJ.exe
  2⤵
  PID:9504
- C:\Windows\System\MdwIumD.exe
  C:\Windows\System\MdwIumD.exe
  2⤵
  PID:9520
- C:\Windows\System\mjWQBtm.exe
  C:\Windows\System\mjWQBtm.exe
  2⤵
  PID:9544
- C:\Windows\System\CJonyiK.exe
  C:\Windows\System\CJonyiK.exe
  2⤵
  PID:9564
- C:\Windows\System\myXTkJn.exe
  C:\Windows\System\myXTkJn.exe
  2⤵
  PID:9588
- C:\Windows\System\bnPByLv.exe
  C:\Windows\System\bnPByLv.exe
  2⤵
  PID:9604
- C:\Windows\System\VymMTde.exe
  C:\Windows\System\VymMTde.exe
  2⤵
  PID:9628
- C:\Windows\System\usfYuKC.exe
  C:\Windows\System\usfYuKC.exe
  2⤵
  PID:9648
- C:\Windows\System\dTSAscS.exe
  C:\Windows\System\dTSAscS.exe
  2⤵
  PID:9668
- C:\Windows\System\LkvLkDX.exe
  C:\Windows\System\LkvLkDX.exe
  2⤵
  PID:9692
- C:\Windows\System\kRKKlWf.exe
  C:\Windows\System\kRKKlWf.exe
  2⤵
  PID:9716
- C:\Windows\System\EfgxejU.exe
  C:\Windows\System\EfgxejU.exe
  2⤵
  PID:9736
- C:\Windows\System\QTQoeal.exe
  C:\Windows\System\QTQoeal.exe
  2⤵
  PID:9756
- C:\Windows\System\qEysARH.exe
  C:\Windows\System\qEysARH.exe
  2⤵
  PID:9780
- C:\Windows\System\sXXHrDE.exe
  C:\Windows\System\sXXHrDE.exe
  2⤵
  PID:9800
- C:\Windows\System\bvODTNf.exe
  C:\Windows\System\bvODTNf.exe
  2⤵
  PID:9820
- C:\Windows\System\IfYKnFm.exe
  C:\Windows\System\IfYKnFm.exe
  2⤵
  PID:9844
- C:\Windows\System\OeIygkc.exe
  C:\Windows\System\OeIygkc.exe
  2⤵
  PID:9864
- C:\Windows\System\UJAlRCx.exe
  C:\Windows\System\UJAlRCx.exe
  2⤵
  PID:9888
- C:\Windows\System\dbePWDi.exe
  C:\Windows\System\dbePWDi.exe
  2⤵
  PID:9904
- C:\Windows\System\vodFnKP.exe
  C:\Windows\System\vodFnKP.exe
  2⤵
  PID:9928
- C:\Windows\System\JanKqCq.exe
  C:\Windows\System\JanKqCq.exe
  2⤵
  PID:9952
- C:\Windows\System\ZgDhEiX.exe
  C:\Windows\System\ZgDhEiX.exe
  2⤵
  PID:9968
- C:\Windows\System\aDucNCg.exe
  C:\Windows\System\aDucNCg.exe
  2⤵
  PID:9984
- C:\Windows\System\OXqQpHS.exe
  C:\Windows\System\OXqQpHS.exe
  2⤵
  PID:10004
- C:\Windows\System\ICWSPbs.exe
  C:\Windows\System\ICWSPbs.exe
  2⤵
  PID:10028
- C:\Windows\System\XizsgjV.exe
  C:\Windows\System\XizsgjV.exe
  2⤵
  PID:10044
- C:\Windows\System\vYZotYI.exe
  C:\Windows\System\vYZotYI.exe
  2⤵
  PID:10068
- C:\Windows\System\jKpSlRr.exe
  C:\Windows\System\jKpSlRr.exe
  2⤵
  PID:10092
- C:\Windows\System\WSnhpbe.exe
  C:\Windows\System\WSnhpbe.exe
  2⤵
  PID:10116
- C:\Windows\System\sFdMvUf.exe
  C:\Windows\System\sFdMvUf.exe
  2⤵
  PID:10136
- C:\Windows\System\CfkayWj.exe
  C:\Windows\System\CfkayWj.exe
  2⤵
  PID:10160
- C:\Windows\System\oTbVJya.exe
  C:\Windows\System\oTbVJya.exe
  2⤵
  PID:10180
- C:\Windows\System\DYfbmJI.exe
  C:\Windows\System\DYfbmJI.exe
  2⤵
  PID:10200
- C:\Windows\System\XSfeYIn.exe
  C:\Windows\System\XSfeYIn.exe
  2⤵
  PID:10220
- C:\Windows\System\wzMZJfQ.exe
  C:\Windows\System\wzMZJfQ.exe
  2⤵
  PID:8888
- C:\Windows\System\MxfSNYV.exe
  C:\Windows\System\MxfSNYV.exe
  2⤵
  PID:8200
- C:\Windows\System\pzcndtB.exe
  C:\Windows\System\pzcndtB.exe
  2⤵
  PID:7844
- C:\Windows\System\IXBrTLg.exe
  C:\Windows\System\IXBrTLg.exe
  2⤵
  PID:7916
- C:\Windows\System\kPxynmD.exe
  C:\Windows\System\kPxynmD.exe
  2⤵
  PID:7964
- C:\Windows\System\VtwxdRP.exe
  C:\Windows\System\VtwxdRP.exe
  2⤵
  PID:8300
- C:\Windows\System\bkmCpQq.exe
  C:\Windows\System\bkmCpQq.exe
  2⤵
  PID:4644
- C:\Windows\System\eDrrIIw.exe
  C:\Windows\System\eDrrIIw.exe
  2⤵
  PID:9048
- C:\Windows\System\LHJxbTR.exe
  C:\Windows\System\LHJxbTR.exe
  2⤵
  PID:9168
- C:\Windows\System\GthaijE.exe
  C:\Windows\System\GthaijE.exe
  2⤵
  PID:8112
- C:\Windows\System\YSIYivC.exe
  C:\Windows\System\YSIYivC.exe
  2⤵
  PID:8144
- C:\Windows\System\zJyWkoU.exe
  C:\Windows\System\zJyWkoU.exe
  2⤵
  PID:8464
- C:\Windows\System\rXZpBpg.exe
  C:\Windows\System\rXZpBpg.exe
  2⤵
  PID:7056
- C:\Windows\System\cerYiqt.exe
  C:\Windows\System\cerYiqt.exe
  2⤵
  PID:6512
- C:\Windows\System\aCVTJYa.exe
  C:\Windows\System\aCVTJYa.exe
  2⤵
  PID:2232
- C:\Windows\System\ULXjIxo.exe
  C:\Windows\System\ULXjIxo.exe
  2⤵
  PID:2496
- C:\Windows\System\qgcWhiZ.exe
  C:\Windows\System\qgcWhiZ.exe
  2⤵
  PID:8624
- C:\Windows\System\QHAfrtH.exe
  C:\Windows\System\QHAfrtH.exe
  2⤵
  PID:7152
- C:\Windows\System\rasjajE.exe
  C:\Windows\System\rasjajE.exe
  2⤵
  PID:10264
- C:\Windows\System\EnBfiWn.exe
  C:\Windows\System\EnBfiWn.exe
  2⤵
  PID:10280
- C:\Windows\System\ryjwepj.exe
  C:\Windows\System\ryjwepj.exe
  2⤵
  PID:10316
- C:\Windows\System\SVHdTcR.exe
  C:\Windows\System\SVHdTcR.exe
  2⤵
  PID:10336
- C:\Windows\System\aVFTeMi.exe
  C:\Windows\System\aVFTeMi.exe
  2⤵
  PID:10356
- C:\Windows\System\GEQcMxu.exe
  C:\Windows\System\GEQcMxu.exe
  2⤵
  PID:10376
- C:\Windows\System\egJtSwa.exe
  C:\Windows\System\egJtSwa.exe
  2⤵
  PID:10400
- C:\Windows\System\IfWKiJY.exe
  C:\Windows\System\IfWKiJY.exe
  2⤵
  PID:10420
- C:\Windows\System\DBpZrsQ.exe
  C:\Windows\System\DBpZrsQ.exe
  2⤵
  PID:10444
- C:\Windows\System\riXktkU.exe
  C:\Windows\System\riXktkU.exe
  2⤵
  PID:10460
- C:\Windows\System\zvFPLma.exe
  C:\Windows\System\zvFPLma.exe
  2⤵
  PID:10488
- C:\Windows\System\nqjwAnC.exe
  C:\Windows\System\nqjwAnC.exe
  2⤵
  PID:10504
- C:\Windows\System\OMZhTdq.exe
  C:\Windows\System\OMZhTdq.exe
  2⤵
  PID:10524
- C:\Windows\System\dUMLVyP.exe
  C:\Windows\System\dUMLVyP.exe
  2⤵
  PID:10548
- C:\Windows\System\uwsEeJi.exe
  C:\Windows\System\uwsEeJi.exe
  2⤵
  PID:10824
- C:\Windows\System\Madxaxz.exe
  C:\Windows\System\Madxaxz.exe
  2⤵
  PID:10840
- C:\Windows\System\fDoaGVh.exe
  C:\Windows\System\fDoaGVh.exe
  2⤵
  PID:10860
- C:\Windows\System\cfxYDcB.exe
  C:\Windows\System\cfxYDcB.exe
  2⤵
  PID:10884
- C:\Windows\System\JeWWJNB.exe
  C:\Windows\System\JeWWJNB.exe
  2⤵
  PID:10908
- C:\Windows\System\efAgGzk.exe
  C:\Windows\System\efAgGzk.exe
  2⤵
  PID:10924
- C:\Windows\System\cPUzZJd.exe
  C:\Windows\System\cPUzZJd.exe
  2⤵
  PID:10940
- C:\Windows\System\QQzOwCi.exe
  C:\Windows\System\QQzOwCi.exe
  2⤵
  PID:10960
- C:\Windows\System\zFfGmxy.exe
  C:\Windows\System\zFfGmxy.exe
  2⤵
  PID:10976
- C:\Windows\System\UJShLzF.exe
  C:\Windows\System\UJShLzF.exe
  2⤵
  PID:10996
- C:\Windows\System\ghYpgcB.exe
  C:\Windows\System\ghYpgcB.exe
  2⤵
  PID:11016
- C:\Windows\System\inhePWB.exe
  C:\Windows\System\inhePWB.exe
  2⤵
  PID:11040
- C:\Windows\System\rHEKZXx.exe
  C:\Windows\System\rHEKZXx.exe
  2⤵
  PID:11060
- C:\Windows\System\HGVVNIj.exe
  C:\Windows\System\HGVVNIj.exe
  2⤵
  PID:11080
- C:\Windows\System\GVzeNjs.exe
  C:\Windows\System\GVzeNjs.exe
  2⤵
  PID:11096
- C:\Windows\System\aMhvnej.exe
  C:\Windows\System\aMhvnej.exe
  2⤵
  PID:11112
- C:\Windows\System\xYvPNFp.exe
  C:\Windows\System\xYvPNFp.exe
  2⤵
  PID:11132
- C:\Windows\System\YDzNyRV.exe
  C:\Windows\System\YDzNyRV.exe
  2⤵
  PID:11152
- C:\Windows\System\OMfMyyZ.exe
  C:\Windows\System\OMfMyyZ.exe
  2⤵
  PID:11172
- C:\Windows\System\PLauqnY.exe
  C:\Windows\System\PLauqnY.exe
  2⤵
  PID:11192
- C:\Windows\System\xNhxqiG.exe
  C:\Windows\System\xNhxqiG.exe
  2⤵
  PID:11212
- C:\Windows\System\NwrgArm.exe
  C:\Windows\System\NwrgArm.exe
  2⤵
  PID:11236
- C:\Windows\System\CiQkvku.exe
  C:\Windows\System\CiQkvku.exe
  2⤵
  PID:11256
- C:\Windows\System\ezbpghW.exe
  C:\Windows\System\ezbpghW.exe
  2⤵
  PID:8068
- C:\Windows\System\bxLypiq.exe
  C:\Windows\System\bxLypiq.exe
  2⤵
  PID:2980
- C:\Windows\System\nIcmJbK.exe
  C:\Windows\System\nIcmJbK.exe
  2⤵
  PID:7456
- C:\Windows\System\hvXlUAA.exe
  C:\Windows\System\hvXlUAA.exe
  2⤵
  PID:6996
- C:\Windows\System\sqOuYwV.exe
  C:\Windows\System\sqOuYwV.exe
  2⤵
  PID:8840
- C:\Windows\System\LgUBTZd.exe
  C:\Windows\System\LgUBTZd.exe
  2⤵
  PID:3864
- C:\Windows\System\zYoxmad.exe
  C:\Windows\System\zYoxmad.exe
  2⤵
  PID:9460
- C:\Windows\System\bdSHVBC.exe
  C:\Windows\System\bdSHVBC.exe
  2⤵
  PID:5472
- C:\Windows\System\GWaMlOB.exe
  C:\Windows\System\GWaMlOB.exe
  2⤵
  PID:9612
- C:\Windows\System\PBMgFZt.exe
  C:\Windows\System\PBMgFZt.exe
  2⤵
  PID:10088
- C:\Windows\System\SJuqYEr.exe
  C:\Windows\System\SJuqYEr.exe
  2⤵
  PID:8468
- C:\Windows\System\zdMwYFz.exe
  C:\Windows\System\zdMwYFz.exe
  2⤵
  PID:7572
- C:\Windows\System\cNujxoF.exe
  C:\Windows\System\cNujxoF.exe
  2⤵
  PID:7184
- C:\Windows\System\lfKUYop.exe
  C:\Windows\System\lfKUYop.exe
  2⤵
  PID:8284
- C:\Windows\System\ExxGgMC.exe
  C:\Windows\System\ExxGgMC.exe
  2⤵
  PID:8660
- C:\Windows\System\zNrLaik.exe
  C:\Windows\System\zNrLaik.exe
  2⤵
  PID:8748
- C:\Windows\System\JIHbynH.exe
  C:\Windows\System\JIHbynH.exe
  2⤵
  PID:8800
- C:\Windows\System\jligxCu.exe
  C:\Windows\System\jligxCu.exe
  2⤵
  PID:8756
- C:\Windows\System\QoHrOKQ.exe
  C:\Windows\System\QoHrOKQ.exe
  2⤵
  PID:1048
- C:\Windows\System\qCSueXx.exe
  C:\Windows\System\qCSueXx.exe
  2⤵
  PID:9224
- C:\Windows\System\cQAGkCx.exe
  C:\Windows\System\cQAGkCx.exe
  2⤵
  PID:9304
- C:\Windows\System\EQAeLAs.exe
  C:\Windows\System\EQAeLAs.exe
  2⤵
  PID:9416
- C:\Windows\System\wHNuWeZ.exe
  C:\Windows\System\wHNuWeZ.exe
  2⤵
  PID:8940
- C:\Windows\System\TiOaIdZ.exe
  C:\Windows\System\TiOaIdZ.exe
  2⤵
  PID:8988
- C:\Windows\System\KjZczGz.exe
  C:\Windows\System\KjZczGz.exe
  2⤵
  PID:11548
- C:\Windows\System\yzEygEx.exe
  C:\Windows\System\yzEygEx.exe
  2⤵
  PID:11572
- C:\Windows\System\MaetElT.exe
  C:\Windows\System\MaetElT.exe
  2⤵
  PID:11600
- C:\Windows\System\numeCbP.exe
  C:\Windows\System\numeCbP.exe
  2⤵
  PID:11620
- C:\Windows\System\ILGfmdG.exe
  C:\Windows\System\ILGfmdG.exe
  2⤵
  PID:11644
- C:\Windows\System\EpZWqAg.exe
  C:\Windows\System\EpZWqAg.exe
  2⤵
  PID:11672
- C:\Windows\System\QkjnOEh.exe
  C:\Windows\System\QkjnOEh.exe
  2⤵
  PID:11696
- C:\Windows\System\alrxmBQ.exe
  C:\Windows\System\alrxmBQ.exe
  2⤵
  PID:11720
- C:\Windows\System\fPbCrKu.exe
  C:\Windows\System\fPbCrKu.exe
  2⤵
  PID:11744
- C:\Windows\System\becroAb.exe
  C:\Windows\System\becroAb.exe
  2⤵
  PID:11768
- C:\Windows\System\eysCJij.exe
  C:\Windows\System\eysCJij.exe
  2⤵
  PID:11788
- C:\Windows\System\GOVkUNr.exe
  C:\Windows\System\GOVkUNr.exe
  2⤵
  PID:11808
- C:\Windows\System\blgMyXG.exe
  C:\Windows\System\blgMyXG.exe
  2⤵
  PID:11836
- C:\Windows\System\BAVYJrV.exe
  C:\Windows\System\BAVYJrV.exe
  2⤵
  PID:11888
- C:\Windows\System\bEpzvxj.exe
  C:\Windows\System\bEpzvxj.exe
  2⤵
  PID:11944
- C:\Windows\System\udWlFrn.exe
  C:\Windows\System\udWlFrn.exe
  2⤵
  PID:11972
- C:\Windows\System\QovQbVy.exe
  C:\Windows\System\QovQbVy.exe
  2⤵
  PID:11988
- C:\Windows\System\YEPxisi.exe
  C:\Windows\System\YEPxisi.exe
  2⤵
  PID:12016
- C:\Windows\System\iKFIrWb.exe
  C:\Windows\System\iKFIrWb.exe
  2⤵
  PID:12068
- C:\Windows\System\CmDggJa.exe
  C:\Windows\System\CmDggJa.exe
  2⤵
  PID:12092
- C:\Windows\System\YqbzWDI.exe
  C:\Windows\System\YqbzWDI.exe
  2⤵
  PID:12148
- C:\Windows\System\MXiEFCD.exe
  C:\Windows\System\MXiEFCD.exe
  2⤵
  PID:12180
- C:\Windows\System\MykXtFM.exe
  C:\Windows\System\MykXtFM.exe
  2⤵
  PID:12200
- C:\Windows\System\ovQpDXI.exe
  C:\Windows\System\ovQpDXI.exe
  2⤵
  PID:12224
- C:\Windows\System\BrSnGUp.exe
  C:\Windows\System\BrSnGUp.exe
  2⤵
  PID:12248
- C:\Windows\System\oYuYabZ.exe
  C:\Windows\System\oYuYabZ.exe
  2⤵
  PID:12264
- C:\Windows\System\IWPmDdJ.exe
  C:\Windows\System\IWPmDdJ.exe
  2⤵
  PID:10880
- C:\Windows\System\SurhaRq.exe
  C:\Windows\System\SurhaRq.exe
  2⤵
  PID:11008
- C:\Windows\System\GVnvvrb.exe
  C:\Windows\System\GVnvvrb.exe
  2⤵
  PID:7660
- C:\Windows\System\YwoFUqW.exe
  C:\Windows\System\YwoFUqW.exe
  2⤵
  PID:8564
- C:\Windows\System\sHYrMFN.exe
  C:\Windows\System\sHYrMFN.exe
  2⤵
  PID:9640
- C:\Windows\System\IZeIiiR.exe
  C:\Windows\System\IZeIiiR.exe
  2⤵
  PID:10684
- C:\Windows\System\MzDePYp.exe
  C:\Windows\System\MzDePYp.exe
  2⤵
  PID:9096
- C:\Windows\System\kbTAEKd.exe
  C:\Windows\System\kbTAEKd.exe
  2⤵
  PID:10000
- C:\Windows\System\JCWFktX.exe
  C:\Windows\System\JCWFktX.exe
  2⤵
  PID:4156
- C:\Windows\System\YRIkFon.exe
  C:\Windows\System\YRIkFon.exe
  2⤵
  PID:7848
- C:\Windows\System\zHAZfbp.exe
  C:\Windows\System\zHAZfbp.exe
  2⤵
  PID:9148
- C:\Windows\System\APGrZzT.exe
  C:\Windows\System\APGrZzT.exe
  2⤵
  PID:2816
- C:\Windows\System\myaSnvX.exe
  C:\Windows\System\myaSnvX.exe
  2⤵
  PID:8428
- C:\Windows\System\KBBUMcM.exe
  C:\Windows\System\KBBUMcM.exe
  2⤵
  PID:11268
- C:\Windows\System\RMwbSll.exe
  C:\Windows\System\RMwbSll.exe
  2⤵
  PID:6684
- C:\Windows\System\GYHIdHG.exe
  C:\Windows\System\GYHIdHG.exe
  2⤵
  PID:10868
- C:\Windows\System\DttrXuY.exe
  C:\Windows\System\DttrXuY.exe
  2⤵
  PID:10936
- C:\Windows\System\INzimHV.exe
  C:\Windows\System\INzimHV.exe
  2⤵
  PID:4336
- C:\Windows\System\vobDFiw.exe
  C:\Windows\System\vobDFiw.exe
  2⤵
  PID:11076
- C:\Windows\System\BhtYfCa.exe
  C:\Windows\System\BhtYfCa.exe
  2⤵
  PID:11140
- C:\Windows\System\IvHTqyp.exe
  C:\Windows\System\IvHTqyp.exe
  2⤵
  PID:11204
- C:\Windows\System\wDhKVCO.exe
  C:\Windows\System\wDhKVCO.exe
  2⤵
  PID:10916
- C:\Windows\System\OuFTsBe.exe
  C:\Windows\System\OuFTsBe.exe
  2⤵
  PID:8708
- C:\Windows\System\QonCZYm.exe
  C:\Windows\System\QonCZYm.exe
  2⤵
  PID:7488
- C:\Windows\System\cJKrZmk.exe
  C:\Windows\System\cJKrZmk.exe
  2⤵
  PID:1700
- C:\Windows\System\NqhraEw.exe
  C:\Windows\System\NqhraEw.exe
  2⤵
  PID:9244
- C:\Windows\System\WBKhvVD.exe
  C:\Windows\System\WBKhvVD.exe
  2⤵
  PID:9556
- C:\Windows\System\yOlbszn.exe
  C:\Windows\System\yOlbszn.exe
  2⤵
  PID:9600
- C:\Windows\System\meRbCTO.exe
  C:\Windows\System\meRbCTO.exe
  2⤵
  PID:8196
- C:\Windows\System\uYeyAnA.exe
  C:\Windows\System\uYeyAnA.exe
  2⤵
  PID:7364
- C:\Windows\System\YdZAjYx.exe
  C:\Windows\System\YdZAjYx.exe
  2⤵
  PID:11492
- C:\Windows\System\NdKWvyA.exe
  C:\Windows\System\NdKWvyA.exe
  2⤵
  PID:12292
- C:\Windows\System\qztElAn.exe
  C:\Windows\System\qztElAn.exe
  2⤵
  PID:12308
- C:\Windows\System\gbmylRc.exe
  C:\Windows\System\gbmylRc.exe
  2⤵
  PID:12324
- C:\Windows\System\bdVsEvX.exe
  C:\Windows\System\bdVsEvX.exe
  2⤵
  PID:12348
- C:\Windows\System\lcNbcRH.exe
  C:\Windows\System\lcNbcRH.exe
  2⤵
  PID:12372
- C:\Windows\System\jZTjHiO.exe
  C:\Windows\System\jZTjHiO.exe
  2⤵
  PID:12392
- C:\Windows\System\GfzkXNk.exe
  C:\Windows\System\GfzkXNk.exe
  2⤵
  PID:12416
- C:\Windows\System\oqMlYhu.exe
  C:\Windows\System\oqMlYhu.exe
  2⤵
  PID:12440
- C:\Windows\System\LxghbJN.exe
  C:\Windows\System\LxghbJN.exe
  2⤵
  PID:12464
- C:\Windows\System\htaQyeK.exe
  C:\Windows\System\htaQyeK.exe
  2⤵
  PID:12484
- C:\Windows\System\GxuFQHk.exe
  C:\Windows\System\GxuFQHk.exe
  2⤵
  PID:12504
- C:\Windows\System\NoZaqjK.exe
  C:\Windows\System\NoZaqjK.exe
  2⤵
  PID:12528
- C:\Windows\System\BhwAcIZ.exe
  C:\Windows\System\BhwAcIZ.exe
  2⤵
  PID:12556
- C:\Windows\System\sGWrWrT.exe
  C:\Windows\System\sGWrWrT.exe
  2⤵
  PID:12576
- C:\Windows\System\WaHjjCn.exe
  C:\Windows\System\WaHjjCn.exe
  2⤵
  PID:12596
- C:\Windows\System\YizcMpN.exe
  C:\Windows\System\YizcMpN.exe
  2⤵
  PID:12620
- C:\Windows\System\XyZsLjS.exe
  C:\Windows\System\XyZsLjS.exe
  2⤵
  PID:12644
- C:\Windows\System\MFHrCYp.exe
  C:\Windows\System\MFHrCYp.exe
  2⤵
  PID:12660
- C:\Windows\System\hvSjuJh.exe
  C:\Windows\System\hvSjuJh.exe
  2⤵
  PID:12684
- C:\Windows\System\caHGTia.exe
  C:\Windows\System\caHGTia.exe
  2⤵
  PID:12708
- C:\Windows\System\rFbhphE.exe
  C:\Windows\System\rFbhphE.exe
  2⤵
  PID:12736
- C:\Windows\System\tsKlpKu.exe
  C:\Windows\System\tsKlpKu.exe
  2⤵
  PID:12756
- C:\Windows\System\RkWvSZV.exe
  C:\Windows\System\RkWvSZV.exe
  2⤵
  PID:12780
- C:\Windows\System\DITdoFt.exe
  C:\Windows\System\DITdoFt.exe
  2⤵
  PID:12800
- C:\Windows\System\IGSfWed.exe
  C:\Windows\System\IGSfWed.exe
  2⤵
  PID:12824
- C:\Windows\System\EqqDlRC.exe
  C:\Windows\System\EqqDlRC.exe
  2⤵
  PID:12840
- C:\Windows\System\aNTrVuf.exe
  C:\Windows\System\aNTrVuf.exe
  2⤵
  PID:12872
- C:\Windows\System\rHVQiZd.exe
  C:\Windows\System\rHVQiZd.exe
  2⤵
  PID:12892
- C:\Windows\System\fQjokMl.exe
  C:\Windows\System\fQjokMl.exe
  2⤵
  PID:12912
- C:\Windows\System\RtsdfMd.exe
  C:\Windows\System\RtsdfMd.exe
  2⤵
  PID:12928
- C:\Windows\System\pZnOFYd.exe
  C:\Windows\System\pZnOFYd.exe
  2⤵
  PID:12944
- C:\Windows\System\SpKUhjP.exe
  C:\Windows\System\SpKUhjP.exe
  2⤵
  PID:12968
- C:\Windows\System\rdnmDka.exe
  C:\Windows\System\rdnmDka.exe
  2⤵
  PID:12988
- C:\Windows\System\grksFik.exe
  C:\Windows\System\grksFik.exe
  2⤵
  PID:13004
- C:\Windows\System\kKkfhQq.exe
  C:\Windows\System\kKkfhQq.exe
  2⤵
  PID:13032
- C:\Windows\System\YpfXvxq.exe
  C:\Windows\System\YpfXvxq.exe
  2⤵
  PID:13060
- C:\Windows\System\Fsdgqcq.exe
  C:\Windows\System\Fsdgqcq.exe
  2⤵
  PID:13080
- C:\Windows\System\rrLLWhw.exe
  C:\Windows\System\rrLLWhw.exe
  2⤵
  PID:8780
- C:\Windows\System\SnkgfbP.exe
  C:\Windows\System\SnkgfbP.exe
  2⤵
  PID:13296
- C:\Windows\System\ViSoprq.exe
  C:\Windows\System\ViSoprq.exe
  2⤵
  PID:7512
- C:\Windows\System\wEEhQAc.exe
  C:\Windows\System\wEEhQAc.exe
  2⤵
  PID:8796
- C:\Windows\System\frxzFMY.exe
  C:\Windows\System\frxzFMY.exe
  2⤵
  PID:7220
- C:\Windows\System\QTQiFhY.exe
  C:\Windows\System\QTQiFhY.exe
  2⤵
  PID:8044
- C:\Windows\System\fKOKgAN.exe
  C:\Windows\System\fKOKgAN.exe
  2⤵
  PID:8140
- C:\Windows\System\cstPjIA.exe
  C:\Windows\System\cstPjIA.exe
  2⤵
  PID:11292
- C:\Windows\System\MNUQEzA.exe
  C:\Windows\System\MNUQEzA.exe
  2⤵
  PID:10952
- C:\Windows\System\MOeuqHc.exe
  C:\Windows\System\MOeuqHc.exe
  2⤵
  PID:11072
- C:\Windows\System\umMdASd.exe
  C:\Windows\System\umMdASd.exe
  2⤵
  PID:11220
- C:\Windows\System\jdUVLQA.exe
  C:\Windows\System\jdUVLQA.exe
  2⤵
  PID:10576
- C:\Windows\System\EVgkvUO.exe
  C:\Windows\System\EVgkvUO.exe
  2⤵
  PID:7592
- C:\Windows\System\ZlPZWjy.exe
  C:\Windows\System\ZlPZWjy.exe
  2⤵
  PID:13280
- C:\Windows\System\gUMreQy.exe
  C:\Windows\System\gUMreQy.exe
  2⤵
  PID:13116
- C:\Windows\System\NUfgTbg.exe
  C:\Windows\System\NUfgTbg.exe
  2⤵
  PID:9596
- C:\Windows\System\hmsaQSE.exe
  C:\Windows\System\hmsaQSE.exe
  2⤵
  PID:12612
- C:\Windows\System\laTosnV.exe
  C:\Windows\System\laTosnV.exe
  2⤵
  PID:11352
- C:\Windows\System\GxnSius.exe
  C:\Windows\System\GxnSius.exe
  2⤵
  PID:12384
- C:\Windows\System\jPTATtq.exe
  C:\Windows\System\jPTATtq.exe
  2⤵
  PID:12336
- C:\Windows\System\SpOxvQj.exe
  C:\Windows\System\SpOxvQj.exe
  2⤵
  PID:3624
- C:\Windows\System\MaQAxbo.exe
  C:\Windows\System\MaQAxbo.exe
  2⤵
  PID:12300
- C:\Windows\System\qfPGlyS.exe
  C:\Windows\System\qfPGlyS.exe
  2⤵
  PID:10820
- C:\Windows\System\yzIjyyu.exe
  C:\Windows\System\yzIjyyu.exe
  2⤵
  PID:12832
- C:\Windows\System\aGxSeFB.exe
  C:\Windows\System\aGxSeFB.exe
  2⤵
  PID:1604
- C:\Windows\System\MPFZOeL.exe
  C:\Windows\System\MPFZOeL.exe
  2⤵
  PID:12480
- C:\Windows\System\YHZYTku.exe
  C:\Windows\System\YHZYTku.exe
  2⤵
  PID:3700
- C:\Windows\System\olfqmWX.exe
  C:\Windows\System\olfqmWX.exe
  2⤵
  PID:13288
- C:\Windows\System\mydjawZ.exe
  C:\Windows\System\mydjawZ.exe
  2⤵
  PID:12792
- C:\Windows\System\rgFqSmQ.exe
  C:\Windows\System\rgFqSmQ.exe
  2⤵
  PID:12476
- C:\Windows\System\SNZTcuk.exe
  C:\Windows\System\SNZTcuk.exe
  2⤵
  PID:12552
- C:\Windows\System\EzGJBAq.exe
  C:\Windows\System\EzGJBAq.exe
  2⤵
  PID:11628
- C:\Windows\System\LZpeLAw.exe
  C:\Windows\System\LZpeLAw.exe
  2⤵
  PID:12272
- C:\Windows\System\OVkjqNS.exe
  C:\Windows\System\OVkjqNS.exe
  2⤵
  PID:11984
- C:\Windows\System\BJGsYlw.exe
  C:\Windows\System\BJGsYlw.exe
  2⤵
  PID:13264
- C:\Windows\System\fvEbKyT.exe
  C:\Windows\System\fvEbKyT.exe
  2⤵
  PID:9748
- C:\Windows\System\kgZZloJ.exe
  C:\Windows\System\kgZZloJ.exe
  2⤵
  PID:11800
- C:\Windows\System\qYTKsXk.exe
  C:\Windows\System\qYTKsXk.exe
  2⤵
  PID:11184
- C:\Windows\System\kPLmWgP.exe
  C:\Windows\System\kPLmWgP.exe
  2⤵
  PID:9900
- C:\Windows\System\UygIYuT.exe
  C:\Windows\System\UygIYuT.exe
  2⤵
  PID:11740
- C:\Windows\System\vDucIrm.exe
  C:\Windows\System\vDucIrm.exe
  2⤵
  PID:9816
- C:\Windows\System\hFuESGO.exe
  C:\Windows\System\hFuESGO.exe
  2⤵
  PID:12980
- C:\Windows\System\clQWbzK.exe
  C:\Windows\System\clQWbzK.exe
  2⤵
  PID:12432
- C:\Windows\System\qJWYvpO.exe
  C:\Windows\System\qJWYvpO.exe
  2⤵
  PID:13308
- C:\Windows\System\mWvYqoB.exe
  C:\Windows\System\mWvYqoB.exe
  2⤵
  PID:12368
- C:\Windows\System\NTUmEPP.exe
  C:\Windows\System\NTUmEPP.exe
  2⤵
  PID:12436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ji43alxi.qkx.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\Ahomjue.exe

Filesize
1.8MB

MD5
e61af8442b8ec28a78e2f39e19d8b574

SHA1
78182ef136efbec9eaa891de3f3234241abc822c

SHA256
c5c2b487c85b5142f19f81dee3ac51cb5085dcc0aef076669779a4eac707dff3

SHA512
4d844af08398419781bf650a66b5ffe26cf5d44d6df2d592fe7cb02fb70f2ef9551d276d0c6a36133372210d5fee6f5b978da11628ff3d35743b76d17d2151f2

Download Submit
C:\Windows\System\BQytPjc.exe

Filesize
1.8MB

MD5
952af9d7d239492aebf17ea09e1a4b3a

SHA1
cbcef142ece8ff1a174a41befbd7353124928c0f

SHA256
b9f607880ea9d56a5d3e3238ef23e55c166a34b830c02a9f12e8faa9fd32d7cd

SHA512
ad96d0af7912e2d4c0fae7735f05293e8adbc55db16eca41df24b5b2a6fbd10fa820b6a7caee71824a841963a359cc4f95f98f92c0610e8efc712ef5040917d0

Download Submit
C:\Windows\System\BboyOkM.exe

Filesize
1.8MB

MD5
511bf89d0956cc672ee22af77c94a492

SHA1
7f13d9d52b3121cb567d9c4326c3b5905bca7dc4

SHA256
0ff7a1b48c8584da732193175c718c56ebbea4ba903334ea8c7da235a720d9aa

SHA512
7e18b3dc57a847234a9b456103e65571b0f561a8f226356196293357191c8024b10f22c2540e229dabb7cdba4667018c5b92fdd745591317fdae416e4f52f1da

Download Submit
C:\Windows\System\CzlTLKs.exe

Filesize
1.8MB

MD5
c0543dc39d75700e68ad142aed490055

SHA1
49c4320698222ebf673270b72bcc00ebd723b090

SHA256
1559270a2473a80ddb9700528233f5144c28fe29d97aaab649f1d0eae761672e

SHA512
f9818ddb2807c5e3d9eb5769a127a0b3c38ab076ace849de2cde988b213ef2f7d4967a22a52cbd67db51d7ebb74f2b3394d12d269d39191f717292b9868231ae

Download Submit
C:\Windows\System\DCJzwvA.exe

Filesize
1.8MB

MD5
19037dd3bd3f1be652bc06c9a2d7fdec

SHA1
27f81c0b2d8c6dce1213126d264b04913963dda8

SHA256
1bee03946d0c5cdab71480b6023ab6eb95b2a5e7bfc9624015617c13dc57a1d4

SHA512
b8c64856de273329946f1795f321dcb7640dc51346bdb1c7924e066fc23a79d47d84a6b1832800cc776277666ff00b07df6581cf05f5272c64f7fa7687fa6e60

Download Submit
C:\Windows\System\EQcCRbU.exe

Filesize
1.8MB

MD5
6822849b73766e4b745ccc4415a5cdeb

SHA1
8a8e8043b8cda6049f3c3f4d2425cac8d27a61cf

SHA256
bcc069a07ae841482e2cbbf220acb000ec1ea658aed8c5b795409df2c55d0048

SHA512
7e48eda568fe96035c02e8d0926278fdda47e910228b20c78aac8bce978ef8cb2bf299c7d181bb0b45909b9289cc856b599604cf620b15e66f5eb53944b0a553

Download Submit
C:\Windows\System\FHGdzJk.exe

Filesize
1.8MB

MD5
fdc7aa7f23921573ec488249bf5f38ab

SHA1
15a068f323bead153a584de84525ca88e90796ab

SHA256
66ded330b70a3c73a001a5888e23de0edf4c5a699c4076086017cc9f1004a893

SHA512
4f76cc4dda1235d0bc1f92c94ea48e0ad0b555d24db98130da3e2b01c2867dd478874ef9d4f2afaad922b0d16c9242a47c5b4bb12c44d9c4a57fc5f5e09e2412

Download Submit
C:\Windows\System\FVWrqpC.exe

Filesize
1.8MB

MD5
010af5b7a84b569adcdebf45b01067dd

SHA1
5df233b84fa0a68223ba92c26df1ead8ade5ae70

SHA256
b51c3fd28fb017622942b37838ff68f8f362a06242e51fbd47de218cad598d13

SHA512
372cde08668d14bda0ef2a1c60c7d72859555b49c68d27e1d64ccdf6a56fd8852e09ec8d40d886d1828a9c98f311e112d7b59af7ff042c8190d542b85a904be6

Download Submit
C:\Windows\System\FgZMXlZ.exe

Filesize
1.8MB

MD5
c548fcc39a94844d1ef4e6d65aa6d75c

SHA1
f1bab127bcb85f03b5abffa8935337df696e18bf

SHA256
fae5dccd69752859fe060a2429c14d5e3ae299ef533a2d09424de0b91daefdd4

SHA512
dba33c0b0b30f6c52db3d0ca04238e52102857a7e552cd3b939a9658e9440748b12b2347800e2af0d56416aac8129a4552c63ef596c820251af119b7839c1845

Download Submit
C:\Windows\System\GuJZxuY.exe

Filesize
1.8MB

MD5
c345674938ff4796854771aa763359a7

SHA1
37318f9a4474c56dff6ac1e43619dcfebdfce189

SHA256
44bd6df001a916293ef4455bc63ae3e60d7453a8386a06b7547628cf93a8e188

SHA512
8c74472bb616285829f45500ebb181fe7a1cbeb7eebe4eea9ffb76acf062985fbf87c125bb1815e44af4214a92878907f7f8b76d5f741c26cf58f0507a1cff12

Download Submit
C:\Windows\System\HkyBEpi.exe

Filesize
1.8MB

MD5
7a9bb0934070c1410b17b35b0990f623

SHA1
f2ecef5ecd9130bf4e7342aabb9fe8f77618c02a

SHA256
7d6aef644e33b252f2f1e7f4b11ceafaddc9e0f88b3c8bf831c35625e89645fd

SHA512
7badf4a33f108422d8bdb467d3777b1a40fcca8d4dfcd565fc2862103511aa73f89546f297c811888af3ca7b67cb2be6773926900460dd797b3de201b6544d19

Download Submit
C:\Windows\System\HzDPHAS.exe

Filesize
1.8MB

MD5
3dc4e90f3e674ec57da58e6f7e4ec0eb

SHA1
faa9961b437ea500ac25c85fddffeb3b6b7bbd54

SHA256
2bc2057a7b1752e4cf200d1849e47b4d09bf7fa7d03205a240696373bc6e3a01

SHA512
c743b6bddcc57f3f9fdfaf022589191e9966af538958e5dac51bdafb9743145f01086f3b7f03c819f829368ba71e136b72a427e0af05315b609492ddfe213e1b

Download Submit
C:\Windows\System\IZAGEQY.exe

Filesize
1.8MB

MD5
a1270232c237f6a492db6da1dadb80a9

SHA1
a7fa5a180fd7a3aa90754e49913420675bc44273

SHA256
109fb9a35721ad088df48e10d9f740233fd7a978f80b347cf1c6b7d33c0d8389

SHA512
941bc28e54a81f87a46e3da0152fd352774a60b832c4668c631d7f08259839f310199ff3bc42da9cf3bdb1b920150e66203873d0c232936f5dba359ad88317bc

Download Submit
C:\Windows\System\IvnAOSy.exe

Filesize
1.8MB

MD5
70f58bd61b36e75d3a477cc73d7bc5d9

SHA1
08c440883f2f50c6a38de89ff5f195d591a59619

SHA256
ccb882237e581b46466fb97bd6f47f67ebd1367d31abb93204b9a8bb65f56712

SHA512
c7cc881ca8ce796b9d0b3d3b77c92cd7ed78631570affe569180705acaa8b4bade7a2a2f33f1f96abda10aa40501d1fe3d718501afc47fc44cc773e0095fac51

Download Submit
C:\Windows\System\IwZSHvx.exe

Filesize
8B

MD5
3277aa72bb7d7f1eb1043502fbd1c406

SHA1
8712dca2f3fbc82bf0cbbeecdc5d6a26c87f443c

SHA256
e94b62f30c9ce8b0b5cea14d4367a52fe08005d1bd56ca932a1fd7fc15c61bc9

SHA512
9fb0369549dba8937fb796cbc4ade6bacf540f10f98e02675f1b04c615cbb49e396cdbd25cd29de56c7bfb889c8464199939a84fa31434a75c020caeb4f9f503

Download Submit
C:\Windows\System\NSiNaXl.exe

Filesize
1.8MB

MD5
0e1434a77037b5ddf759fbcc5d59d8e9

SHA1
539ece8c83cd0caaad40d0efaa913e1b82ca1304

SHA256
06a9406e86463181bd3681a78722bbc8c7a8a6ae15744f5a7c6712ce5872911c

SHA512
656524ae818a79d218cdf096bc0c754d97b8dadd35c75114437e3d010119cbf1987474ef48c7328064d73812e1d4d133a8467c6fb15e42030fe7503b7c6e9c4e

Download Submit
C:\Windows\System\QZnmkfn.exe

Filesize
1.8MB

MD5
a4bfe45af0432b688a948ff94ec5f298

SHA1
135133c0457c3959123436781f5ae575b268248d

SHA256
175cd53f52bb2919ca3228ae0f455191d472eeed5d5309cff45bd32abfa961c0

SHA512
e2e3b5633a9737b3f76e2c26e00708e439659ddc74a913156c3c1f6b7fd28a403faa47ded41f287c7734473895934d510cc7310f7cdcb90e5b5e71c150428832

Download Submit
C:\Windows\System\UpLgiYi.exe

Filesize
1.8MB

MD5
4977a0d4f9d8235787034ac56b204f9f

SHA1
7e8c451deeaae01981522bfc4f414b21f9c6debf

SHA256
068ca61d02e9b03933422d79f4f09ca8414214f4a737a4b58d952319f406e7cf

SHA512
12fbf3087e5de4ecb27e04ee29ec7755627c6071f46b317a5070bbf07c25093d7298e6e2a0d7258dd05fd3ea4e77b09f944ebc8b66f6b64c3dc018cb9db22899

Download Submit
C:\Windows\System\WgELkah.exe

Filesize
1.8MB

MD5
b5ea7010bd3626ebde2c6fce9581331f

SHA1
f306c77ada35b263e0eb5287472e5f57d33e9f2e

SHA256
470c791cf3d948adbfaa1aad54a7012133f70f368a9178ec142d5a651928f4be

SHA512
284cc5ac276b8826d71da20847fd15a1f73d461a5fdb2532fb12bc21bf1270b73b6e4398bd7eba2b4a261c8cef6dda517556b6617bc1cc5085043c547472816c

Download Submit
C:\Windows\System\WiSGfFu.exe

Filesize
1.8MB

MD5
2789a87a8bbbea803611651e87a01c1b

SHA1
e42186e845f43bfb4020aa40b0c82babe3968366

SHA256
8f0c715be6ee2572123efab233ca06ba77ad98d7812238050704a33362d02bd5

SHA512
bc083212d9a056f9f83c608aca72df11c9870cc93fbce7a64e20a4c547a840035113f6c8e0155c8ce17bae3af6a57820b203244454c54f872b054c5febc240fa

Download Submit
C:\Windows\System\WwGzxvO.exe

Filesize
1.8MB

MD5
7ac27fa7ccd3f478c522b4cee48e7705

SHA1
2fe325611dad56e2db047046ab070b69887e48fc

SHA256
51c200be392f91c1f0cd31b260810926c3a96f1baf2640f343c4e1b78b68ec8f

SHA512
dfb6cc8ce7c91f24a6932c89fc22aadcb0a1d18e20dd5faf54ea231047bf4020fd240c4c9bbf21a04d764f728efc219b4bad3dcdb3913c26985c5a2d4870c70b

Download Submit
C:\Windows\System\XECbELq.exe

Filesize
1.8MB

MD5
3a3d90a1883487f711050869a96e661c

SHA1
38716bebb250295c59c420c385331389a7b40278

SHA256
d98d5528f24b05f2eb6f8148fc8d5e4f3bf5e299d025f9ff8a4965cabe46e2c3

SHA512
69ba7f6367357616a05db547858f777a234f29243a59c0a26117de75136aed76a8eb32be073eb19d9657e2e0ddc42e10c60f4a71995bd5e3064f23ec799af290

Download Submit
C:\Windows\System\XrtMILS.exe

Filesize
1.8MB

MD5
a5aaacd1e0d01d23be18d47d90c4ea4f

SHA1
3a75941ec6a240328e396663913899002508666c

SHA256
6bdea69069c62a83172f41c040f617acc554976f9575272ee3ae1185bb6c6531

SHA512
28304d96601960c7f4d7f4f365089caa02b8cf14f88b3faf075c8a1aec53c7f032a9d3680ea0d72527bca2f4e2cf84b889dd6f34ad74ae456a6000e719db3734

Download Submit
C:\Windows\System\XvdmQHj.exe

Filesize
1.8MB

MD5
bab2d645ae430c4ab735e6d467e9d965

SHA1
f0fba2aed38ebb3fed62281174213ae9fe9cb394

SHA256
4fdbfddb3dd845857e60027f773bbe42c8ce39b691681c5f072d09ac56bc1094

SHA512
83cfe894f58c2df1c881d0bbfa5cd94572e93ed2a66b501cc20cf19bc46cb5109ef7f4334d4a6522b2bd7e467aeaadef1978b076db07c4fd1b3d092b987fc23b

Download Submit
C:\Windows\System\YKQjbwT.exe

Filesize
1.8MB

MD5
74ce73eb8877ed1d9735127dceef32a9

SHA1
1ae459e4c09c18f71391d232b88d21dd5149b1f8

SHA256
d4888b5922b9c96ae2b214d64d244f10b2342862803e018246552636c1282fc9

SHA512
f894b58e21b1169b496c31d7e0478821cc53eb3089ba75e9d07206ecec19d28057be78e813fd0800cf7a0f6e3ff1a9f0758dd8deacd5e5fd5ec84c562d687298

Download Submit
C:\Windows\System\YMpwRMO.exe

Filesize
1.8MB

MD5
3245667461fc66e12045d6369a7c7459

SHA1
8aebb9c946fe22440663d9e0b8ebc56c4595cc9c

SHA256
e5a9491854361de748eb30cc61e6b6ecd97d12df80eb100ec363fb25a9ac872b

SHA512
58d5db68d0a601f589b91441c65e354dc2be196b35d4111514a48021e1fc255a071b37dea1e4eb1482ba8c4eab5b5284ccb79738ec83de8b1926c9b445c39295

Download Submit
C:\Windows\System\ZilbSsx.exe

Filesize
1.8MB

MD5
14cfa773edd6c5f8fb0a0cbadf7eb0f2

SHA1
6f72a87b4052e9b69a7aae3e3bd10818fd1afd74

SHA256
b19b96ee914fb3128cd72ea025a7633a84f9bfc05cdc631e236c4501998f1451

SHA512
915f4834f2b46d6f0677b2b22c13e6850fd7c29d97262a52e0ddeae58c7d24ef709d7a14d94ef6243e5358bb24b9dcf75b918a8bf9dd5043e19f28ab6c4b657b

Download Submit
C:\Windows\System\avteIMv.exe

Filesize
1.8MB

MD5
ef77feda31cfdb4f87752f12188030df

SHA1
ae71055224559fc5bec7912950ef2170d4fedadf

SHA256
7597a45e91fa6fbccec920cc2d9b89f1b50fbbd8d28a20e31f59ea4c089bd5fa

SHA512
fc924a635da4d6f4f965a44cf9643e9fb28ab8041fe417e0f053a7e52805b271c76c14d67d16a5593f878c3a2ad85d01baf3dc1c935f51c18e30d289cebc9539

Download Submit
C:\Windows\System\ctJsKyj.exe

Filesize
1.8MB

MD5
fd60d83a7311fa900d6294d0357e81f0

SHA1
09efe0c221f813b508c1224d0f4d2c946c07b6f4

SHA256
783fbd4e4d8ad91f5989aad45868bd3b0c37276315caadeded25f1f70d3d9eb8

SHA512
ba583c79bc071fd7660b2c150c70dc67b93424c252912328d2f135f9b8b6a7fb69f591becf396bbd6054b4614f9953dae4f504fc415d7a98bd3142cc0d7e420b

Download Submit
C:\Windows\System\dIyCmex.exe

Filesize
1.8MB

MD5
f731ea4d2177919c7e3e5e4b5e5daeb7

SHA1
408fc7efc77771c494aedae5b686f47961e2373f

SHA256
fd4b9c720fff028cb79b18d12e4d3cb157ba345dd1c3a924cf1f6cdae2f4ecc7

SHA512
c799c650b9a7addc367555238427c79661f358737b285cbbd5fb70285c3f837617f5639c937345276a1f32fa83e51dab11be2a3a0994afdd0d2d4f5b1b81856e

Download Submit
C:\Windows\System\eiKRqVg.exe

Filesize
1.8MB

MD5
05af6c81c9cda96aa212fe20b3adc28d

SHA1
c7dd99675b67b8307cf3dc71ad0a6f605ab35728

SHA256
b37aa52f9dce58332c6dd6f58a6b45c51a89493989ae7f7fcc89235c5afda1c2

SHA512
ba4fe772301c4a4fb0ceb193ab0c84e9bcf74a9256d868c6319a0e97b1eec745a62bbb90e0d8880ba73725c38a9cf38c68bc5b965ba056cd7f8d82e4bcf94b34

Download Submit
C:\Windows\System\gLcPDkQ.exe

Filesize
1.8MB

MD5
bac5a0f2f60a841ce605d526192dd89e

SHA1
d7c8a437f0fdd7d1fd4db0742762eaa875057fde

SHA256
fd9cf58389239aa7c025f9a717dbc7c5a7a855fb0d6057ee73017d46acdf2b1f

SHA512
b87ec8c3da61d2be6898a7c2758b66260abb2e1698b2db097784593cc9baf4f97602dde9f2a8819a3124c3496a2b49e5f5c19fa9b1504bda7ec123ef41c6960c

Download Submit
C:\Windows\System\hxANasl.exe

Filesize
1.8MB

MD5
e9537b3175144bc15f53ebebb06657be

SHA1
551944f56b3b173ce9bc5003049d869c8aed1b3b

SHA256
812795a6c59e938dc39c0b3fec0f785f50f30897e29af29e76fdefc7e34f603b

SHA512
b8b14a2f217c956c852f5b27ce4f32a44c7c2fa0917c837dd3442eb9cae52fe5f4ffbe0fb3cf50d37fbd18bd33543a85b82aa9d851c2fac0e5a53e09a96b3eab

Download Submit
C:\Windows\System\iCFTzoP.exe

Filesize
1.8MB

MD5
dbc8ff447317c9221c36c2bfd10fa6c0

SHA1
d81309a763fe47cc03a032b60800525ebb28a6fd

SHA256
5b0c3e2ae0d0ea76c5c3dd5718472d29a6ae81b443f5b105f56c3b2a2d9d0136

SHA512
86b60f3a7d7e0174d71f6bfed3a6d133367d926682644a18aeb50bd92c2d42e69adebe2b3f63de256e0356ccb681ce723f62b7d54bfae2169d9ff9d8a8397652

Download Submit
C:\Windows\System\jqcFGXr.exe

Filesize
1.8MB

MD5
5991a155ef30d327a7df611002cf611a

SHA1
626068fc18fd78b5f00456bd332267b9fa3c502f

SHA256
ba16f85382a78aab7788a488fdb2f9c43cc12f8a94aaf28c0ea9e7c3bfdc148e

SHA512
f4d432d057de304c8f5d856155a1f3c16059396ceb558763b200ecb9936dc9890d905d33ecd9a2d40f41e74d1800b8f8a045f500a864e977639cbfac492d8d94

Download Submit
C:\Windows\System\krZaZKK.exe

Filesize
1.8MB

MD5
3336b1e1d5a4c0f1e880b9f1fbe4fbef

SHA1
72bc336e034fc875a8bda3db376ab426f2ed8469

SHA256
f9b206ba589f28c10bc24b8f82de7eb2dcbf09a011b10c2ca1db3751ae8a09cc

SHA512
87c6eef0ad9dbd424a2d3f4967fce4b0d266d7cdcee28fb6ad13763ea36243597e53d7398ddedc6eb4cf581a83f27edba42ea4dd67df05e17458a0b910a110ae

Download Submit
C:\Windows\System\mGooBfW.exe

Filesize
1.8MB

MD5
ea89eb6c4e304880829fc955bcec878e

SHA1
6722f6dc496581317ea9c9e91092e53ad321e81b

SHA256
19957df360b637712f3905a5d82248919d3d609290e20186cab41bfd6f6075e9

SHA512
6c7049e162526401e5632c7e2c3505abac9fea949acc64533cee5c3e511dd3b3ee343070371344754e36ca2fcb5d22f588c753388351832294818d16e1470ae7

Download Submit
C:\Windows\System\nmsmxOa.exe

Filesize
1.8MB

MD5
6339bac85825c9e9c6a351a0ec99fcfc

SHA1
e47f32ae7359085de5a73bd25714f5b10b8f890e

SHA256
1add1723ac581fd4f34849de2af51bda4e24464b93068ace02ee7e58f01afb01

SHA512
f512699392ec9c1dd61cd2998243443c8da4794bfa9e5d78e6c253839b57f6c60b428673f511d5f2f3d7530513f26573797f7a9dd47582ba40585843e368a4b0

Download Submit
C:\Windows\System\oRcRbCm.exe

Filesize
1.8MB

MD5
429e0a081bd9eec23ab120a7770a49c5

SHA1
dbb68f10133b9709b9a9e07ee30c8c8eb0eeaec2

SHA256
3e2ea8ec394fb7a36f9d6a62edc577aa7d06af46b9d7dba1ff2d195c5ec29ad8

SHA512
ba12aa99d9dfac62a132531c3063e0e091103689a399dbb0d5b4ba1c96f2d2df3c98248a950181f7667ab1d77e16d1d98f6d79336dd80e55c194a2871fc75b2c

Download Submit
C:\Windows\System\qbCZXxk.exe

Filesize
1.8MB

MD5
6066354891bf037ac4500d4a86973fc8

SHA1
34716c037bcb0437b231a449aaadef3a2477f054

SHA256
95d67895f13729bb88c938656c91c9dea7fd1876a4bce9836a4417aa648cad6c

SHA512
fec2f85a794ad63abb89292deab4eca0bc71c05315dbcea5868277afd7a4d000d09d8ae4465fa415ce656f6390caa74c9887708eb3a6002ff78db2356865e5b6

Download Submit
C:\Windows\System\zzvbDij.exe

Filesize
1.8MB

MD5
30a3e426b2cddd7e00be5773907faea8

SHA1
f5c49d78d40abcd1591cd6df7a17f260a330493d

SHA256
fdb317b590ad21990d97d480fef8b1d1b9eb6f69d07d378f69537699687a62ea

SHA512
41326648308e7775590debd3b17074ab2b0ddc6a65c1abb8e5558fe4c930507cfb04093a86cbf8ea1a905a38dffdb501937d2dc3acac8d6f7a8764788eb4f10a

Download Submit
memory/116-217-0x00007FF685A70000-0x00007FF685E62000-memory.dmp

Filesize
3.9MB

Download
memory/744-214-0x00007FF712490000-0x00007FF712882000-memory.dmp

Filesize
3.9MB

Download
memory/1008-427-0x00007FF709080000-0x00007FF709472000-memory.dmp

Filesize
3.9MB

Download
memory/1260-381-0x00007FF7BA6B0000-0x00007FF7BAAA2000-memory.dmp

Filesize
3.9MB

Download
memory/1636-277-0x00007FF7EE660000-0x00007FF7EEA52000-memory.dmp

Filesize
3.9MB

Download
memory/1808-432-0x00007FF645BE0000-0x00007FF645FD2000-memory.dmp

Filesize
3.9MB

Download
memory/1840-425-0x00007FF786830000-0x00007FF786C22000-memory.dmp

Filesize
3.9MB

Download
memory/1892-428-0x00007FF7D0060000-0x00007FF7D0452000-memory.dmp

Filesize
3.9MB

Download
memory/1956-1-0x000002230B730000-0x000002230B740000-memory.dmp

Filesize
64KB

Download
memory/1956-0-0x00007FF6D2360000-0x00007FF6D2752000-memory.dmp

Filesize
3.9MB

Download
memory/2368-149-0x00007FF729F60000-0x00007FF72A352000-memory.dmp

Filesize
3.9MB

Download
memory/2372-429-0x00007FF64FF80000-0x00007FF650372000-memory.dmp

Filesize
3.9MB

Download
memory/2780-238-0x00007FF69F460000-0x00007FF69F852000-memory.dmp

Filesize
3.9MB

Download
memory/2828-148-0x00007FF67DAC0000-0x00007FF67DEB2000-memory.dmp

Filesize
3.9MB

Download
memory/3020-311-0x00007FF63C7D0000-0x00007FF63CBC2000-memory.dmp

Filesize
3.9MB

Download
memory/3264-339-0x00007FF601A10000-0x00007FF601E02000-memory.dmp

Filesize
3.9MB

Download
memory/4024-430-0x00007FF7991A0000-0x00007FF799592000-memory.dmp

Filesize
3.9MB

Download
memory/4124-12-0x00007FF6301D0000-0x00007FF6305C2000-memory.dmp

Filesize
3.9MB

Download
memory/4256-338-0x00007FF7EA200000-0x00007FF7EA5F2000-memory.dmp

Filesize
3.9MB

Download
memory/4548-489-0x00000213BBED0000-0x00000213BC676000-memory.dmp

Filesize
7.6MB

Download
memory/4548-97-0x00007FFE0D6A0000-0x00007FFE0E161000-memory.dmp

Filesize
10.8MB

Download
memory/4548-13-0x00000213B9220000-0x00000213B9230000-memory.dmp

Filesize
64KB

Download
memory/4548-14-0x00000213B9220000-0x00000213B9230000-memory.dmp

Filesize
64KB

Download
memory/4548-245-0x00000213BB3A0000-0x00000213BB3C2000-memory.dmp

Filesize
136KB

Download
memory/4820-358-0x00007FF62C750000-0x00007FF62CB42000-memory.dmp

Filesize
3.9MB

Download
memory/4836-316-0x00007FF64D470000-0x00007FF64D862000-memory.dmp

Filesize
3.9MB

Download
memory/4876-431-0x00007FF796010000-0x00007FF796402000-memory.dmp

Filesize
3.9MB

Download
memory/5104-378-0x00007FF60F560000-0x00007FF60F952000-memory.dmp

Filesize
3.9MB

Download