xmrig | 8623e567f9894f94996e415de1e6630c6742699bfa33af0814ba64a61a3a32c2

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 23:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
Size

1.9MB
MD5

064f8d6478e00cf0ed5157012d2fe2e5
SHA1

1fea1604589f04d23fd872f73f4226e60cb6f888
SHA256

8623e567f9894f94996e415de1e6630c6742699bfa33af0814ba64a61a3a32c2
SHA512

78f05cad0436af0fd0657cf105ae3a723a3a244d022523e5f59024ed57c12ef7fc47007540904b2789c0209705c95f94905c153d618305642ee4e18c00ed56ea
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+US:NABx

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 42 IoCs

miner

resource	yara_rule
behavioral2/memory/3184-131-0x00007FF6513F0000-0x00007FF6517E2000-memory.dmp	xmrig
behavioral2/memory/5048-188-0x00007FF7BA910000-0x00007FF7BAD02000-memory.dmp	xmrig
behavioral2/memory/5060-199-0x00007FF7917C0000-0x00007FF791BB2000-memory.dmp	xmrig
behavioral2/memory/3136-206-0x00007FF70B520000-0x00007FF70B912000-memory.dmp	xmrig
behavioral2/memory/3256-208-0x00007FF6F1190000-0x00007FF6F1582000-memory.dmp	xmrig
behavioral2/memory/1332-207-0x00007FF769DF0000-0x00007FF76A1E2000-memory.dmp	xmrig
behavioral2/memory/2028-205-0x00007FF634120000-0x00007FF634512000-memory.dmp	xmrig
behavioral2/memory/3988-204-0x00007FF77F300000-0x00007FF77F6F2000-memory.dmp	xmrig
behavioral2/memory/1452-203-0x00007FF79AA80000-0x00007FF79AE72000-memory.dmp	xmrig
behavioral2/memory/3284-202-0x00007FF60F370000-0x00007FF60F762000-memory.dmp	xmrig
behavioral2/memory/3160-201-0x00007FF765000000-0x00007FF7653F2000-memory.dmp	xmrig
behavioral2/memory/4788-200-0x00007FF6D72C0000-0x00007FF6D76B2000-memory.dmp	xmrig
behavioral2/memory/3000-197-0x00007FF74B570000-0x00007FF74B962000-memory.dmp	xmrig
behavioral2/memory/4752-194-0x00007FF71E090000-0x00007FF71E482000-memory.dmp	xmrig
behavioral2/memory/1596-193-0x00007FF7D3C50000-0x00007FF7D4042000-memory.dmp	xmrig
behavioral2/memory/4744-176-0x00007FF79CDA0000-0x00007FF79D192000-memory.dmp	xmrig
behavioral2/memory/4708-158-0x00007FF682730000-0x00007FF682B22000-memory.dmp	xmrig
behavioral2/memory/2960-148-0x00007FF7E8130000-0x00007FF7E8522000-memory.dmp	xmrig
behavioral2/memory/4260-124-0x00007FF7ED6A0000-0x00007FF7EDA92000-memory.dmp	xmrig
behavioral2/memory/3584-89-0x00007FF6B4090000-0x00007FF6B4482000-memory.dmp	xmrig
behavioral2/memory/1852-2496-0x00007FF7B5A40000-0x00007FF7B5E32000-memory.dmp	xmrig
behavioral2/memory/3136-2499-0x00007FF70B520000-0x00007FF70B912000-memory.dmp	xmrig
behavioral2/memory/4260-2503-0x00007FF7ED6A0000-0x00007FF7EDA92000-memory.dmp	xmrig
behavioral2/memory/1852-2502-0x00007FF7B5A40000-0x00007FF7B5E32000-memory.dmp	xmrig
behavioral2/memory/1596-2505-0x00007FF7D3C50000-0x00007FF7D4042000-memory.dmp	xmrig
behavioral2/memory/3584-2513-0x00007FF6B4090000-0x00007FF6B4482000-memory.dmp	xmrig
behavioral2/memory/3184-2519-0x00007FF6513F0000-0x00007FF6517E2000-memory.dmp	xmrig
behavioral2/memory/3988-2522-0x00007FF77F300000-0x00007FF77F6F2000-memory.dmp	xmrig
behavioral2/memory/5060-2523-0x00007FF7917C0000-0x00007FF791BB2000-memory.dmp	xmrig
behavioral2/memory/4752-2527-0x00007FF71E090000-0x00007FF71E482000-memory.dmp	xmrig
behavioral2/memory/4744-2525-0x00007FF79CDA0000-0x00007FF79D192000-memory.dmp	xmrig
behavioral2/memory/1452-2518-0x00007FF79AA80000-0x00007FF79AE72000-memory.dmp	xmrig
behavioral2/memory/4788-2516-0x00007FF6D72C0000-0x00007FF6D76B2000-memory.dmp	xmrig
behavioral2/memory/5048-2507-0x00007FF7BA910000-0x00007FF7BAD02000-memory.dmp	xmrig
behavioral2/memory/4708-2512-0x00007FF682730000-0x00007FF682B22000-memory.dmp	xmrig
behavioral2/memory/2960-2510-0x00007FF7E8130000-0x00007FF7E8522000-memory.dmp	xmrig
behavioral2/memory/3000-2542-0x00007FF74B570000-0x00007FF74B962000-memory.dmp	xmrig
behavioral2/memory/3256-2540-0x00007FF6F1190000-0x00007FF6F1582000-memory.dmp	xmrig
behavioral2/memory/2028-2538-0x00007FF634120000-0x00007FF634512000-memory.dmp	xmrig
behavioral2/memory/3284-2548-0x00007FF60F370000-0x00007FF60F762000-memory.dmp	xmrig
behavioral2/memory/3160-2546-0x00007FF765000000-0x00007FF7653F2000-memory.dmp	xmrig
behavioral2/memory/1332-2544-0x00007FF769DF0000-0x00007FF76A1E2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1852	gHiLHIR.exe
3136	xwdBcAT.exe
3584	WdgcCcQ.exe
4260	QcOJccE.exe
3184	teaaEQc.exe
2960	mwjAawp.exe
4708	nddxSWg.exe
4744	wIwgvUl.exe
5048	OMjjUBH.exe
1596	FIovnym.exe
4752	BxVyFLz.exe
3000	wrFNzFG.exe
5060	VbxzdQF.exe
4788	brgViCP.exe
1332	gRDJpMs.exe
3160	bAryaPX.exe
3284	sawwuaI.exe
1452	TuaRlfo.exe
3988	GikrGEr.exe
3256	xTHXCeC.exe
2028	eCWppIT.exe
2952	dbLXzsg.exe
4484	xgFSGGk.exe
780	qjrsuUN.exe
3212	aVCfEFn.exe
1432	KJiuSEp.exe
4840	BhYmteX.exe
3600	pTjtKiy.exe
4176	jsANnxe.exe
1436	FbbnLBo.exe
2740	PmZmoWv.exe
3472	VKYEJaZ.exe
4444	rcOTYdc.exe
3340	bfApztj.exe
2656	NcByeWj.exe
2240	KlUiPRd.exe
3936	lPCSgJE.exe
2160	ZNPKeYk.exe
4024	XCipOaD.exe
5016	FciZTuJ.exe
2652	KypmkTl.exe
3028	xwOQpJe.exe
4728	dAeuDIf.exe
708	xzQuACv.exe
2072	lBHhZYa.exe
1412	aOKpFLw.exe
3776	FIkWBCM.exe
5068	OthexhC.exe
3932	yJiWiNo.exe
4440	MwCBgGJ.exe
2688	xFfRPac.exe
2360	Kzxneei.exe
4188	YDjCNtU.exe
4820	CvFfWBg.exe
3192	bVcWJam.exe
1568	aRWxGFa.exe
116	exRkZCl.exe
3008	EYsTDrM.exe
3780	fzsKWaP.exe
4712	mNOhVKf.exe
4232	itfzITf.exe
2680	KDwONgr.exe
3492	jfFZzed.exe
3188	sbXJUgw.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1612-0-0x00007FF6C58A0000-0x00007FF6C5C92000-memory.dmp	upx
behavioral2/files/0x000c000000023ba0-5.dat	upx
behavioral2/files/0x000a000000023ba6-7.dat	upx
behavioral2/files/0x000a000000023bae-59.dat	upx
behavioral2/files/0x000a000000023bad-55.dat	upx
behavioral2/files/0x000a000000023baa-49.dat	upx
behavioral2/files/0x000a000000023bac-48.dat	upx
behavioral2/files/0x000a000000023ba9-47.dat	upx
behavioral2/files/0x000a000000023ba8-58.dat	upx
behavioral2/files/0x000a000000023bab-41.dat	upx
behavioral2/files/0x000a000000023ba5-23.dat	upx
behavioral2/files/0x000a000000023ba7-18.dat	upx
behavioral2/memory/1852-10-0x00007FF7B5A40000-0x00007FF7B5E32000-memory.dmp	upx
behavioral2/files/0x000a000000023bb1-70.dat	upx
behavioral2/files/0x000a000000023bb0-65.dat	upx
behavioral2/files/0x0031000000023bb4-79.dat	upx
behavioral2/files/0x000a000000023baf-60.dat	upx
behavioral2/memory/3184-131-0x00007FF6513F0000-0x00007FF6517E2000-memory.dmp	upx
behavioral2/files/0x000a000000023bb2-149.dat	upx
behavioral2/files/0x000a000000023bbe-161.dat	upx
behavioral2/files/0x000a000000023bc3-182.dat	upx
behavioral2/memory/5048-188-0x00007FF7BA910000-0x00007FF7BAD02000-memory.dmp	upx
behavioral2/memory/5060-199-0x00007FF7917C0000-0x00007FF791BB2000-memory.dmp	upx
behavioral2/memory/3136-206-0x00007FF70B520000-0x00007FF70B912000-memory.dmp	upx
behavioral2/memory/3256-208-0x00007FF6F1190000-0x00007FF6F1582000-memory.dmp	upx
behavioral2/memory/1332-207-0x00007FF769DF0000-0x00007FF76A1E2000-memory.dmp	upx
behavioral2/memory/2028-205-0x00007FF634120000-0x00007FF634512000-memory.dmp	upx
behavioral2/memory/3988-204-0x00007FF77F300000-0x00007FF77F6F2000-memory.dmp	upx
behavioral2/memory/1452-203-0x00007FF79AA80000-0x00007FF79AE72000-memory.dmp	upx
behavioral2/memory/3284-202-0x00007FF60F370000-0x00007FF60F762000-memory.dmp	upx
behavioral2/memory/3160-201-0x00007FF765000000-0x00007FF7653F2000-memory.dmp	upx
behavioral2/memory/4788-200-0x00007FF6D72C0000-0x00007FF6D76B2000-memory.dmp	upx
behavioral2/memory/3000-197-0x00007FF74B570000-0x00007FF74B962000-memory.dmp	upx
behavioral2/memory/4752-194-0x00007FF71E090000-0x00007FF71E482000-memory.dmp	upx
behavioral2/memory/1596-193-0x00007FF7D3C50000-0x00007FF7D4042000-memory.dmp	upx
behavioral2/files/0x000a000000023bc0-185.dat	upx
behavioral2/files/0x000a000000023bc6-184.dat	upx
behavioral2/files/0x000a000000023bc5-181.dat	upx
behavioral2/files/0x000a000000023bba-177.dat	upx
behavioral2/memory/4744-176-0x00007FF79CDA0000-0x00007FF79D192000-memory.dmp	upx
behavioral2/files/0x000a000000023bc4-175.dat	upx
behavioral2/files/0x000a000000023bb8-174.dat	upx
behavioral2/files/0x000a000000023bbf-170.dat	upx
behavioral2/files/0x000a000000023bb9-168.dat	upx
behavioral2/files/0x000a000000023bc2-166.dat	upx
behavioral2/files/0x000b000000023ba2-165.dat	upx
behavioral2/memory/4708-158-0x00007FF682730000-0x00007FF682B22000-memory.dmp	upx
behavioral2/files/0x000a000000023bb7-156.dat	upx
behavioral2/memory/2960-148-0x00007FF7E8130000-0x00007FF7E8522000-memory.dmp	upx
behavioral2/files/0x000a000000023bc1-147.dat	upx
behavioral2/files/0x000b000000023bbc-145.dat	upx
behavioral2/files/0x000a000000023bb3-136.dat	upx
behavioral2/files/0x000a000000023bbd-125.dat	upx
behavioral2/memory/4260-124-0x00007FF7ED6A0000-0x00007FF7EDA92000-memory.dmp	upx
behavioral2/files/0x0031000000023bb6-114.dat	upx
behavioral2/memory/3584-89-0x00007FF6B4090000-0x00007FF6B4482000-memory.dmp	upx
behavioral2/files/0x0031000000023bb5-86.dat	upx
behavioral2/memory/1852-2496-0x00007FF7B5A40000-0x00007FF7B5E32000-memory.dmp	upx
behavioral2/memory/3136-2499-0x00007FF70B520000-0x00007FF70B912000-memory.dmp	upx
behavioral2/memory/4260-2503-0x00007FF7ED6A0000-0x00007FF7EDA92000-memory.dmp	upx
behavioral2/memory/1852-2502-0x00007FF7B5A40000-0x00007FF7B5E32000-memory.dmp	upx
behavioral2/memory/1596-2505-0x00007FF7D3C50000-0x00007FF7D4042000-memory.dmp	upx
behavioral2/memory/3584-2513-0x00007FF6B4090000-0x00007FF6B4482000-memory.dmp	upx
behavioral2/memory/3184-2519-0x00007FF6513F0000-0x00007FF6517E2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\btbZnSP.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\JmcTaVP.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\NofyAgb.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\qIMOECt.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\ZHVFFHc.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\SdsQunm.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\oXxwjPr.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\VKYEJaZ.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\OpTWmtJ.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\xBOxYDv.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\LMMRTZJ.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\kyxSaGg.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\NklnNZV.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\fzsKWaP.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\GhKLSAH.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\VUxDIVr.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\GpqifEF.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\GZNCojC.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\drwhSVl.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\gvZGIwC.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\PmZmoWv.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\Kzxneei.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\FJtzbzA.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\zzjosrx.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\sawwuaI.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\yohhawV.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\XzGPaks.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\cmsTEmU.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\KgySuHO.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\NEFQEyr.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\wEMkPvP.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\VjnmuaP.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\LVWCHgS.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\GikrGEr.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\AcOaemC.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\BYZfXMZ.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\OajQAvu.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\ZfouQox.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\dCsRlmG.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\yheCLNV.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\nhtAjGf.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\wycCkMJ.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\yByYjdo.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\BKMsEZw.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\tOOawsl.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\OeaHHOG.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\RSJBWBQ.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\VocJdCc.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\BwNiyuB.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\zVsgxew.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\BeaZIfx.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\KIVfVed.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\dFBJqVU.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\gUnoEpb.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\tIzxuLp.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\YHLXpBU.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\YQjdaTR.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\szzUEMb.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\GFYlcZA.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\SvBpyTt.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\ywAueKw.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\AZOmcly.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\ZhgcnuK.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
File created	C:\Windows\System\dQYRNMf.exe	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4568	powershell.exe
4568	powershell.exe
4568	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
Token: SeDebugPrivilege	4568	powershell.exe
Token: SeLockMemoryPrivilege	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 4568	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	84
PID 1612 wrote to memory of 4568	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	84
PID 1612 wrote to memory of 1852	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	85
PID 1612 wrote to memory of 1852	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	85
PID 1612 wrote to memory of 3136	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	86
PID 1612 wrote to memory of 3136	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	86
PID 1612 wrote to memory of 3584	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	87
PID 1612 wrote to memory of 3584	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	87
PID 1612 wrote to memory of 4260	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	88
PID 1612 wrote to memory of 4260	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	88
PID 1612 wrote to memory of 3184	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	89
PID 1612 wrote to memory of 3184	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	89
PID 1612 wrote to memory of 2960	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	90
PID 1612 wrote to memory of 2960	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	90
PID 1612 wrote to memory of 4708	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	91
PID 1612 wrote to memory of 4708	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	91
PID 1612 wrote to memory of 4744	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	92
PID 1612 wrote to memory of 4744	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	92
PID 1612 wrote to memory of 5048	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	93
PID 1612 wrote to memory of 5048	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	93
PID 1612 wrote to memory of 1596	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	94
PID 1612 wrote to memory of 1596	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	94
PID 1612 wrote to memory of 4752	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	95
PID 1612 wrote to memory of 4752	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	95
PID 1612 wrote to memory of 3000	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	96
PID 1612 wrote to memory of 3000	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	96
PID 1612 wrote to memory of 5060	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	97
PID 1612 wrote to memory of 5060	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	97
PID 1612 wrote to memory of 4788	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	98
PID 1612 wrote to memory of 4788	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	98
PID 1612 wrote to memory of 1332	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	99
PID 1612 wrote to memory of 1332	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	99
PID 1612 wrote to memory of 3160	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	100
PID 1612 wrote to memory of 3160	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	100
PID 1612 wrote to memory of 3284	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	101
PID 1612 wrote to memory of 3284	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	101
PID 1612 wrote to memory of 1452	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	102
PID 1612 wrote to memory of 1452	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	102
PID 1612 wrote to memory of 3988	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	103
PID 1612 wrote to memory of 3988	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	103
PID 1612 wrote to memory of 3256	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	104
PID 1612 wrote to memory of 3256	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	104
PID 1612 wrote to memory of 2028	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	105
PID 1612 wrote to memory of 2028	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	105
PID 1612 wrote to memory of 2952	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	106
PID 1612 wrote to memory of 2952	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	106
PID 1612 wrote to memory of 4484	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	107
PID 1612 wrote to memory of 4484	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	107
PID 1612 wrote to memory of 780	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	108
PID 1612 wrote to memory of 780	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	108
PID 1612 wrote to memory of 3212	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	109
PID 1612 wrote to memory of 3212	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	109
PID 1612 wrote to memory of 1432	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	110
PID 1612 wrote to memory of 1432	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	110
PID 1612 wrote to memory of 4840	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	111
PID 1612 wrote to memory of 4840	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	111
PID 1612 wrote to memory of 3600	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	112
PID 1612 wrote to memory of 3600	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	112
PID 1612 wrote to memory of 4176	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	113
PID 1612 wrote to memory of 4176	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	113
PID 1612 wrote to memory of 1436	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	114
PID 1612 wrote to memory of 1436	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	114
PID 1612 wrote to memory of 2740	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	115
PID 1612 wrote to memory of 2740	1612	064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\064f8d6478e00cf0ed5157012d2fe2e5_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4568
- C:\Windows\System\gHiLHIR.exe
  C:\Windows\System\gHiLHIR.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\xwdBcAT.exe
  C:\Windows\System\xwdBcAT.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\WdgcCcQ.exe
  C:\Windows\System\WdgcCcQ.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\QcOJccE.exe
  C:\Windows\System\QcOJccE.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\teaaEQc.exe
  C:\Windows\System\teaaEQc.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\mwjAawp.exe
  C:\Windows\System\mwjAawp.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\nddxSWg.exe
  C:\Windows\System\nddxSWg.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\wIwgvUl.exe
  C:\Windows\System\wIwgvUl.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\OMjjUBH.exe
  C:\Windows\System\OMjjUBH.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\FIovnym.exe
  C:\Windows\System\FIovnym.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\BxVyFLz.exe
  C:\Windows\System\BxVyFLz.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\wrFNzFG.exe
  C:\Windows\System\wrFNzFG.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\VbxzdQF.exe
  C:\Windows\System\VbxzdQF.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\brgViCP.exe
  C:\Windows\System\brgViCP.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\gRDJpMs.exe
  C:\Windows\System\gRDJpMs.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\bAryaPX.exe
  C:\Windows\System\bAryaPX.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\sawwuaI.exe
  C:\Windows\System\sawwuaI.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System\TuaRlfo.exe
  C:\Windows\System\TuaRlfo.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\GikrGEr.exe
  C:\Windows\System\GikrGEr.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\xTHXCeC.exe
  C:\Windows\System\xTHXCeC.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\eCWppIT.exe
  C:\Windows\System\eCWppIT.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\dbLXzsg.exe
  C:\Windows\System\dbLXzsg.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\xgFSGGk.exe
  C:\Windows\System\xgFSGGk.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\qjrsuUN.exe
  C:\Windows\System\qjrsuUN.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\aVCfEFn.exe
  C:\Windows\System\aVCfEFn.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\KJiuSEp.exe
  C:\Windows\System\KJiuSEp.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\BhYmteX.exe
  C:\Windows\System\BhYmteX.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\pTjtKiy.exe
  C:\Windows\System\pTjtKiy.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\jsANnxe.exe
  C:\Windows\System\jsANnxe.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\FbbnLBo.exe
  C:\Windows\System\FbbnLBo.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\PmZmoWv.exe
  C:\Windows\System\PmZmoWv.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\VKYEJaZ.exe
  C:\Windows\System\VKYEJaZ.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System\rcOTYdc.exe
  C:\Windows\System\rcOTYdc.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\bfApztj.exe
  C:\Windows\System\bfApztj.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\NcByeWj.exe
  C:\Windows\System\NcByeWj.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\KlUiPRd.exe
  C:\Windows\System\KlUiPRd.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\lPCSgJE.exe
  C:\Windows\System\lPCSgJE.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System\ZNPKeYk.exe
  C:\Windows\System\ZNPKeYk.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\XCipOaD.exe
  C:\Windows\System\XCipOaD.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\FciZTuJ.exe
  C:\Windows\System\FciZTuJ.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\KypmkTl.exe
  C:\Windows\System\KypmkTl.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\xwOQpJe.exe
  C:\Windows\System\xwOQpJe.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\dAeuDIf.exe
  C:\Windows\System\dAeuDIf.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\xzQuACv.exe
  C:\Windows\System\xzQuACv.exe
  2⤵
  - Executes dropped EXE
  PID:708
- C:\Windows\System\lBHhZYa.exe
  C:\Windows\System\lBHhZYa.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\aOKpFLw.exe
  C:\Windows\System\aOKpFLw.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\FIkWBCM.exe
  C:\Windows\System\FIkWBCM.exe
  2⤵
  - Executes dropped EXE
  PID:3776
- C:\Windows\System\OthexhC.exe
  C:\Windows\System\OthexhC.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\yJiWiNo.exe
  C:\Windows\System\yJiWiNo.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\MwCBgGJ.exe
  C:\Windows\System\MwCBgGJ.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\xFfRPac.exe
  C:\Windows\System\xFfRPac.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\Kzxneei.exe
  C:\Windows\System\Kzxneei.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\YDjCNtU.exe
  C:\Windows\System\YDjCNtU.exe
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Windows\System\CvFfWBg.exe
  C:\Windows\System\CvFfWBg.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\bVcWJam.exe
  C:\Windows\System\bVcWJam.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\aRWxGFa.exe
  C:\Windows\System\aRWxGFa.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\exRkZCl.exe
  C:\Windows\System\exRkZCl.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\EYsTDrM.exe
  C:\Windows\System\EYsTDrM.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\fzsKWaP.exe
  C:\Windows\System\fzsKWaP.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System\mNOhVKf.exe
  C:\Windows\System\mNOhVKf.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\itfzITf.exe
  C:\Windows\System\itfzITf.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\KDwONgr.exe
  C:\Windows\System\KDwONgr.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\jfFZzed.exe
  C:\Windows\System\jfFZzed.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\sbXJUgw.exe
  C:\Windows\System\sbXJUgw.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System\cHbYVIP.exe
  C:\Windows\System\cHbYVIP.exe
  2⤵
  PID:2132
- C:\Windows\System\sEMmEXp.exe
  C:\Windows\System\sEMmEXp.exe
  2⤵
  PID:3924
- C:\Windows\System\TFuUlCp.exe
  C:\Windows\System\TFuUlCp.exe
  2⤵
  PID:2144
- C:\Windows\System\qGkXyjD.exe
  C:\Windows\System\qGkXyjD.exe
  2⤵
  PID:2536
- C:\Windows\System\XxhFVbi.exe
  C:\Windows\System\XxhFVbi.exe
  2⤵
  PID:2816
- C:\Windows\System\WIMpCZr.exe
  C:\Windows\System\WIMpCZr.exe
  2⤵
  PID:3612
- C:\Windows\System\fSmwBeO.exe
  C:\Windows\System\fSmwBeO.exe
  2⤵
  PID:3708
- C:\Windows\System\QGBwsoa.exe
  C:\Windows\System\QGBwsoa.exe
  2⤵
  PID:2916
- C:\Windows\System\wiefUjv.exe
  C:\Windows\System\wiefUjv.exe
  2⤵
  PID:368
- C:\Windows\System\mjNGibx.exe
  C:\Windows\System\mjNGibx.exe
  2⤵
  PID:1832
- C:\Windows\System\vQZdqFV.exe
  C:\Windows\System\vQZdqFV.exe
  2⤵
  PID:2276
- C:\Windows\System\FfqjDDz.exe
  C:\Windows\System\FfqjDDz.exe
  2⤵
  PID:1608
- C:\Windows\System\csczcuw.exe
  C:\Windows\System\csczcuw.exe
  2⤵
  PID:2328
- C:\Windows\System\rcLBHHR.exe
  C:\Windows\System\rcLBHHR.exe
  2⤵
  PID:2980
- C:\Windows\System\uyUdfEW.exe
  C:\Windows\System\uyUdfEW.exe
  2⤵
  PID:3872
- C:\Windows\System\eocTDKE.exe
  C:\Windows\System\eocTDKE.exe
  2⤵
  PID:436
- C:\Windows\System\XYDGwNe.exe
  C:\Windows\System\XYDGwNe.exe
  2⤵
  PID:4968
- C:\Windows\System\WdNgrJS.exe
  C:\Windows\System\WdNgrJS.exe
  2⤵
  PID:4000
- C:\Windows\System\iiZytYZ.exe
  C:\Windows\System\iiZytYZ.exe
  2⤵
  PID:2020
- C:\Windows\System\yByYjdo.exe
  C:\Windows\System\yByYjdo.exe
  2⤵
  PID:1844
- C:\Windows\System\XjBAEBE.exe
  C:\Windows\System\XjBAEBE.exe
  2⤵
  PID:4688
- C:\Windows\System\PqnhQHq.exe
  C:\Windows\System\PqnhQHq.exe
  2⤵
  PID:1972
- C:\Windows\System\nIyLKFc.exe
  C:\Windows\System\nIyLKFc.exe
  2⤵
  PID:4560
- C:\Windows\System\GYZKpgO.exe
  C:\Windows\System\GYZKpgO.exe
  2⤵
  PID:3960
- C:\Windows\System\LittFvx.exe
  C:\Windows\System\LittFvx.exe
  2⤵
  PID:4424
- C:\Windows\System\lXlIJSN.exe
  C:\Windows\System\lXlIJSN.exe
  2⤵
  PID:1644
- C:\Windows\System\BYZfXMZ.exe
  C:\Windows\System\BYZfXMZ.exe
  2⤵
  PID:640
- C:\Windows\System\aizGHwJ.exe
  C:\Windows\System\aizGHwJ.exe
  2⤵
  PID:3068
- C:\Windows\System\OwIPZVU.exe
  C:\Windows\System\OwIPZVU.exe
  2⤵
  PID:3280
- C:\Windows\System\QfdJGGZ.exe
  C:\Windows\System\QfdJGGZ.exe
  2⤵
  PID:4320
- C:\Windows\System\vNtwLfC.exe
  C:\Windows\System\vNtwLfC.exe
  2⤵
  PID:3304
- C:\Windows\System\UYwlMKU.exe
  C:\Windows\System\UYwlMKU.exe
  2⤵
  PID:4884
- C:\Windows\System\aetpdVm.exe
  C:\Windows\System\aetpdVm.exe
  2⤵
  PID:5148
- C:\Windows\System\ByXUPYK.exe
  C:\Windows\System\ByXUPYK.exe
  2⤵
  PID:5164
- C:\Windows\System\pqbidQB.exe
  C:\Windows\System\pqbidQB.exe
  2⤵
  PID:5188
- C:\Windows\System\OIOENGI.exe
  C:\Windows\System\OIOENGI.exe
  2⤵
  PID:5212
- C:\Windows\System\wrKkTOu.exe
  C:\Windows\System\wrKkTOu.exe
  2⤵
  PID:5228
- C:\Windows\System\gEPbeXN.exe
  C:\Windows\System\gEPbeXN.exe
  2⤵
  PID:5248
- C:\Windows\System\WnfbWin.exe
  C:\Windows\System\WnfbWin.exe
  2⤵
  PID:5272
- C:\Windows\System\kNCOUmf.exe
  C:\Windows\System\kNCOUmf.exe
  2⤵
  PID:5296
- C:\Windows\System\sEtVdqv.exe
  C:\Windows\System\sEtVdqv.exe
  2⤵
  PID:5312
- C:\Windows\System\XvxOWwQ.exe
  C:\Windows\System\XvxOWwQ.exe
  2⤵
  PID:5336
- C:\Windows\System\pEszDUE.exe
  C:\Windows\System\pEszDUE.exe
  2⤵
  PID:5356
- C:\Windows\System\yktzdFx.exe
  C:\Windows\System\yktzdFx.exe
  2⤵
  PID:5376
- C:\Windows\System\zFdGMuh.exe
  C:\Windows\System\zFdGMuh.exe
  2⤵
  PID:5400
- C:\Windows\System\yEiKTaM.exe
  C:\Windows\System\yEiKTaM.exe
  2⤵
  PID:5416
- C:\Windows\System\RzcrTxy.exe
  C:\Windows\System\RzcrTxy.exe
  2⤵
  PID:5444
- C:\Windows\System\bJHuwht.exe
  C:\Windows\System\bJHuwht.exe
  2⤵
  PID:5464
- C:\Windows\System\HZjRYjn.exe
  C:\Windows\System\HZjRYjn.exe
  2⤵
  PID:5496
- C:\Windows\System\mJFZvwb.exe
  C:\Windows\System\mJFZvwb.exe
  2⤵
  PID:5524
- C:\Windows\System\gfMSjhn.exe
  C:\Windows\System\gfMSjhn.exe
  2⤵
  PID:5544
- C:\Windows\System\pWWISwT.exe
  C:\Windows\System\pWWISwT.exe
  2⤵
  PID:5568
- C:\Windows\System\XYjAWwD.exe
  C:\Windows\System\XYjAWwD.exe
  2⤵
  PID:5584
- C:\Windows\System\jnHhSjK.exe
  C:\Windows\System\jnHhSjK.exe
  2⤵
  PID:5608
- C:\Windows\System\hBNiWSo.exe
  C:\Windows\System\hBNiWSo.exe
  2⤵
  PID:5628
- C:\Windows\System\SMXruMs.exe
  C:\Windows\System\SMXruMs.exe
  2⤵
  PID:5648
- C:\Windows\System\zGAxUNI.exe
  C:\Windows\System\zGAxUNI.exe
  2⤵
  PID:5672
- C:\Windows\System\kyYksin.exe
  C:\Windows\System\kyYksin.exe
  2⤵
  PID:5692
- C:\Windows\System\cSzmWGz.exe
  C:\Windows\System\cSzmWGz.exe
  2⤵
  PID:5712
- C:\Windows\System\TJbIfMX.exe
  C:\Windows\System\TJbIfMX.exe
  2⤵
  PID:5732
- C:\Windows\System\ownOOUp.exe
  C:\Windows\System\ownOOUp.exe
  2⤵
  PID:5756
- C:\Windows\System\ZrPStRB.exe
  C:\Windows\System\ZrPStRB.exe
  2⤵
  PID:5772
- C:\Windows\System\Fgzbxmw.exe
  C:\Windows\System\Fgzbxmw.exe
  2⤵
  PID:5800
- C:\Windows\System\rNJmFuN.exe
  C:\Windows\System\rNJmFuN.exe
  2⤵
  PID:5820
- C:\Windows\System\FKFlhzR.exe
  C:\Windows\System\FKFlhzR.exe
  2⤵
  PID:5840
- C:\Windows\System\eKeOwCA.exe
  C:\Windows\System\eKeOwCA.exe
  2⤵
  PID:5868
- C:\Windows\System\mSkazYb.exe
  C:\Windows\System\mSkazYb.exe
  2⤵
  PID:5896
- C:\Windows\System\jXYBKDN.exe
  C:\Windows\System\jXYBKDN.exe
  2⤵
  PID:5928
- C:\Windows\System\gmmWWmH.exe
  C:\Windows\System\gmmWWmH.exe
  2⤵
  PID:5944
- C:\Windows\System\OkXOcLr.exe
  C:\Windows\System\OkXOcLr.exe
  2⤵
  PID:5972
- C:\Windows\System\SDBoZzL.exe
  C:\Windows\System\SDBoZzL.exe
  2⤵
  PID:5988
- C:\Windows\System\ZSBmkAt.exe
  C:\Windows\System\ZSBmkAt.exe
  2⤵
  PID:6012
- C:\Windows\System\KHPQOkf.exe
  C:\Windows\System\KHPQOkf.exe
  2⤵
  PID:6036
- C:\Windows\System\VOREAAy.exe
  C:\Windows\System\VOREAAy.exe
  2⤵
  PID:6056
- C:\Windows\System\gwlmoTQ.exe
  C:\Windows\System\gwlmoTQ.exe
  2⤵
  PID:6080
- C:\Windows\System\fMYqtrO.exe
  C:\Windows\System\fMYqtrO.exe
  2⤵
  PID:6104
- C:\Windows\System\pUruzXM.exe
  C:\Windows\System\pUruzXM.exe
  2⤵
  PID:6128
- C:\Windows\System\btbZnSP.exe
  C:\Windows\System\btbZnSP.exe
  2⤵
  PID:4988
- C:\Windows\System\UDsDAdY.exe
  C:\Windows\System\UDsDAdY.exe
  2⤵
  PID:4856
- C:\Windows\System\YdPjkcl.exe
  C:\Windows\System\YdPjkcl.exe
  2⤵
  PID:5128
- C:\Windows\System\qdndVeR.exe
  C:\Windows\System\qdndVeR.exe
  2⤵
  PID:5264
- C:\Windows\System\kJcdOzo.exe
  C:\Windows\System\kJcdOzo.exe
  2⤵
  PID:5292
- C:\Windows\System\IcNYZvF.exe
  C:\Windows\System\IcNYZvF.exe
  2⤵
  PID:5352
- C:\Windows\System\nuCemeI.exe
  C:\Windows\System\nuCemeI.exe
  2⤵
  PID:5244
- C:\Windows\System\AZOmcly.exe
  C:\Windows\System\AZOmcly.exe
  2⤵
  PID:5560
- C:\Windows\System\NUnEzzE.exe
  C:\Windows\System\NUnEzzE.exe
  2⤵
  PID:5388
- C:\Windows\System\dcvFIBU.exe
  C:\Windows\System\dcvFIBU.exe
  2⤵
  PID:5512
- C:\Windows\System\tOJKMXc.exe
  C:\Windows\System\tOJKMXc.exe
  2⤵
  PID:5656
- C:\Windows\System\PWkQtTi.exe
  C:\Windows\System\PWkQtTi.exe
  2⤵
  PID:5684
- C:\Windows\System\OajQAvu.exe
  C:\Windows\System\OajQAvu.exe
  2⤵
  PID:5728
- C:\Windows\System\svmXQax.exe
  C:\Windows\System\svmXQax.exe
  2⤵
  PID:5552
- C:\Windows\System\yiVbLDW.exe
  C:\Windows\System\yiVbLDW.exe
  2⤵
  PID:5860
- C:\Windows\System\QazQryj.exe
  C:\Windows\System\QazQryj.exe
  2⤵
  PID:5708
- C:\Windows\System\fnlbXlk.exe
  C:\Windows\System\fnlbXlk.exe
  2⤵
  PID:5768
- C:\Windows\System\PTnSUDB.exe
  C:\Windows\System\PTnSUDB.exe
  2⤵
  PID:5808
- C:\Windows\System\RWDhreg.exe
  C:\Windows\System\RWDhreg.exe
  2⤵
  PID:5184
- C:\Windows\System\JAtOoST.exe
  C:\Windows\System\JAtOoST.exe
  2⤵
  PID:6152
- C:\Windows\System\KPgJWih.exe
  C:\Windows\System\KPgJWih.exe
  2⤵
  PID:6180
- C:\Windows\System\XiUCkeU.exe
  C:\Windows\System\XiUCkeU.exe
  2⤵
  PID:6204
- C:\Windows\System\JvMXcyu.exe
  C:\Windows\System\JvMXcyu.exe
  2⤵
  PID:6220
- C:\Windows\System\GtxQinV.exe
  C:\Windows\System\GtxQinV.exe
  2⤵
  PID:6248
- C:\Windows\System\eyMdfJp.exe
  C:\Windows\System\eyMdfJp.exe
  2⤵
  PID:6268
- C:\Windows\System\JnCVrUK.exe
  C:\Windows\System\JnCVrUK.exe
  2⤵
  PID:6292
- C:\Windows\System\xvBxUOX.exe
  C:\Windows\System\xvBxUOX.exe
  2⤵
  PID:6316
- C:\Windows\System\lZaAosw.exe
  C:\Windows\System\lZaAosw.exe
  2⤵
  PID:6336
- C:\Windows\System\vgyrCLj.exe
  C:\Windows\System\vgyrCLj.exe
  2⤵
  PID:6364
- C:\Windows\System\mZkEaTN.exe
  C:\Windows\System\mZkEaTN.exe
  2⤵
  PID:6380
- C:\Windows\System\wIcJEGu.exe
  C:\Windows\System\wIcJEGu.exe
  2⤵
  PID:6400
- C:\Windows\System\nkjPDjd.exe
  C:\Windows\System\nkjPDjd.exe
  2⤵
  PID:6420
- C:\Windows\System\WIbdrqn.exe
  C:\Windows\System\WIbdrqn.exe
  2⤵
  PID:6440
- C:\Windows\System\VZuMuMU.exe
  C:\Windows\System\VZuMuMU.exe
  2⤵
  PID:6464
- C:\Windows\System\NcgRctJ.exe
  C:\Windows\System\NcgRctJ.exe
  2⤵
  PID:6480
- C:\Windows\System\IUmwzjQ.exe
  C:\Windows\System\IUmwzjQ.exe
  2⤵
  PID:6508
- C:\Windows\System\ztwMdSW.exe
  C:\Windows\System\ztwMdSW.exe
  2⤵
  PID:6528
- C:\Windows\System\VnIxngj.exe
  C:\Windows\System\VnIxngj.exe
  2⤵
  PID:6552
- C:\Windows\System\dBxugII.exe
  C:\Windows\System\dBxugII.exe
  2⤵
  PID:6572
- C:\Windows\System\AgSVMig.exe
  C:\Windows\System\AgSVMig.exe
  2⤵
  PID:6592
- C:\Windows\System\zXrUAHD.exe
  C:\Windows\System\zXrUAHD.exe
  2⤵
  PID:6620
- C:\Windows\System\QhrqOzJ.exe
  C:\Windows\System\QhrqOzJ.exe
  2⤵
  PID:6644
- C:\Windows\System\nZrlJzi.exe
  C:\Windows\System\nZrlJzi.exe
  2⤵
  PID:6668
- C:\Windows\System\kuleNtf.exe
  C:\Windows\System\kuleNtf.exe
  2⤵
  PID:6688
- C:\Windows\System\KqYPpwS.exe
  C:\Windows\System\KqYPpwS.exe
  2⤵
  PID:6708
- C:\Windows\System\sDSBuFd.exe
  C:\Windows\System\sDSBuFd.exe
  2⤵
  PID:6728
- C:\Windows\System\ckhQPAa.exe
  C:\Windows\System\ckhQPAa.exe
  2⤵
  PID:6752
- C:\Windows\System\RcCEsYt.exe
  C:\Windows\System\RcCEsYt.exe
  2⤵
  PID:6772
- C:\Windows\System\IfsTrJy.exe
  C:\Windows\System\IfsTrJy.exe
  2⤵
  PID:6792
- C:\Windows\System\TMfROBC.exe
  C:\Windows\System\TMfROBC.exe
  2⤵
  PID:6816
- C:\Windows\System\JYptLTr.exe
  C:\Windows\System\JYptLTr.exe
  2⤵
  PID:6836
- C:\Windows\System\qSDQzPl.exe
  C:\Windows\System\qSDQzPl.exe
  2⤵
  PID:6856
- C:\Windows\System\pNrZjgh.exe
  C:\Windows\System\pNrZjgh.exe
  2⤵
  PID:6880
- C:\Windows\System\EkYCaOS.exe
  C:\Windows\System\EkYCaOS.exe
  2⤵
  PID:6900
- C:\Windows\System\RspItBe.exe
  C:\Windows\System\RspItBe.exe
  2⤵
  PID:6924
- C:\Windows\System\ClbWfIA.exe
  C:\Windows\System\ClbWfIA.exe
  2⤵
  PID:6948
- C:\Windows\System\LMKZFnD.exe
  C:\Windows\System\LMKZFnD.exe
  2⤵
  PID:6968
- C:\Windows\System\ZbARABo.exe
  C:\Windows\System\ZbARABo.exe
  2⤵
  PID:6992
- C:\Windows\System\VokzUkx.exe
  C:\Windows\System\VokzUkx.exe
  2⤵
  PID:7008
- C:\Windows\System\zEkpLGh.exe
  C:\Windows\System\zEkpLGh.exe
  2⤵
  PID:7032
- C:\Windows\System\eUUYDJT.exe
  C:\Windows\System\eUUYDJT.exe
  2⤵
  PID:7052
- C:\Windows\System\buXJaVI.exe
  C:\Windows\System\buXJaVI.exe
  2⤵
  PID:7072
- C:\Windows\System\tMkulxp.exe
  C:\Windows\System\tMkulxp.exe
  2⤵
  PID:7096
- C:\Windows\System\cREYGNZ.exe
  C:\Windows\System\cREYGNZ.exe
  2⤵
  PID:7116
- C:\Windows\System\UilWITg.exe
  C:\Windows\System\UilWITg.exe
  2⤵
  PID:7136
- C:\Windows\System\qzMFTbB.exe
  C:\Windows\System\qzMFTbB.exe
  2⤵
  PID:7160
- C:\Windows\System\jMxNmVs.exe
  C:\Windows\System\jMxNmVs.exe
  2⤵
  PID:5520
- C:\Windows\System\BmcoTYe.exe
  C:\Windows\System\BmcoTYe.exe
  2⤵
  PID:6092
- C:\Windows\System\IfxCxUA.exe
  C:\Windows\System\IfxCxUA.exe
  2⤵
  PID:5936
- C:\Windows\System\jnxUpxt.exe
  C:\Windows\System\jnxUpxt.exe
  2⤵
  PID:5592
- C:\Windows\System\ZzrIHBY.exe
  C:\Windows\System\ZzrIHBY.exe
  2⤵
  PID:6004
- C:\Windows\System\Cdvmfqi.exe
  C:\Windows\System\Cdvmfqi.exe
  2⤵
  PID:5160
- C:\Windows\System\kWpnIKQ.exe
  C:\Windows\System\kWpnIKQ.exe
  2⤵
  PID:5984
- C:\Windows\System\gTGAofO.exe
  C:\Windows\System\gTGAofO.exe
  2⤵
  PID:6212
- C:\Windows\System\pClccCv.exe
  C:\Windows\System\pClccCv.exe
  2⤵
  PID:6256
- C:\Windows\System\EulzzUz.exe
  C:\Windows\System\EulzzUz.exe
  2⤵
  PID:5348
- C:\Windows\System\NjwLTjU.exe
  C:\Windows\System\NjwLTjU.exe
  2⤵
  PID:6288
- C:\Windows\System\YVWxinp.exe
  C:\Windows\System\YVWxinp.exe
  2⤵
  PID:6304
- C:\Windows\System\PpzVsoj.exe
  C:\Windows\System\PpzVsoj.exe
  2⤵
  PID:6376
- C:\Windows\System\IyiHVaQ.exe
  C:\Windows\System\IyiHVaQ.exe
  2⤵
  PID:6416
- C:\Windows\System\uKauSFr.exe
  C:\Windows\System\uKauSFr.exe
  2⤵
  PID:6448
- C:\Windows\System\jFdhvIC.exe
  C:\Windows\System\jFdhvIC.exe
  2⤵
  PID:6428
- C:\Windows\System\UviYzuh.exe
  C:\Windows\System\UviYzuh.exe
  2⤵
  PID:5180
- C:\Windows\System\BVXJpFr.exe
  C:\Windows\System\BVXJpFr.exe
  2⤵
  PID:5856
- C:\Windows\System\chxhOoG.exe
  C:\Windows\System\chxhOoG.exe
  2⤵
  PID:5320
- C:\Windows\System\EkEzTgM.exe
  C:\Windows\System\EkEzTgM.exe
  2⤵
  PID:5384
- C:\Windows\System\pejqRre.exe
  C:\Windows\System\pejqRre.exe
  2⤵
  PID:6640
- C:\Windows\System\xBMHlnI.exe
  C:\Windows\System\xBMHlnI.exe
  2⤵
  PID:6764
- C:\Windows\System\lwKkXfY.exe
  C:\Windows\System\lwKkXfY.exe
  2⤵
  PID:6828
- C:\Windows\System\JcGgDnI.exe
  C:\Windows\System\JcGgDnI.exe
  2⤵
  PID:6584
- C:\Windows\System\csQMRyb.exe
  C:\Windows\System\csQMRyb.exe
  2⤵
  PID:7040
- C:\Windows\System\zVsgxew.exe
  C:\Windows\System\zVsgxew.exe
  2⤵
  PID:7080
- C:\Windows\System\eKzaLCb.exe
  C:\Windows\System\eKzaLCb.exe
  2⤵
  PID:5884
- C:\Windows\System\WIQbOXQ.exe
  C:\Windows\System\WIQbOXQ.exe
  2⤵
  PID:5964
- C:\Windows\System\qwUvtUL.exe
  C:\Windows\System\qwUvtUL.exe
  2⤵
  PID:7192
- C:\Windows\System\ZDFqucH.exe
  C:\Windows\System\ZDFqucH.exe
  2⤵
  PID:7208
- C:\Windows\System\DRhMWjF.exe
  C:\Windows\System\DRhMWjF.exe
  2⤵
  PID:7224
- C:\Windows\System\pnlTAWg.exe
  C:\Windows\System\pnlTAWg.exe
  2⤵
  PID:7244
- C:\Windows\System\CvEijgC.exe
  C:\Windows\System\CvEijgC.exe
  2⤵
  PID:7264
- C:\Windows\System\NHBntMp.exe
  C:\Windows\System\NHBntMp.exe
  2⤵
  PID:7288
- C:\Windows\System\GZNCojC.exe
  C:\Windows\System\GZNCojC.exe
  2⤵
  PID:7304
- C:\Windows\System\UVXGHHo.exe
  C:\Windows\System\UVXGHHo.exe
  2⤵
  PID:7328
- C:\Windows\System\EThokZz.exe
  C:\Windows\System\EThokZz.exe
  2⤵
  PID:7356
- C:\Windows\System\YApdlcG.exe
  C:\Windows\System\YApdlcG.exe
  2⤵
  PID:7372
- C:\Windows\System\szzUEMb.exe
  C:\Windows\System\szzUEMb.exe
  2⤵
  PID:7396
- C:\Windows\System\WgSrDGt.exe
  C:\Windows\System\WgSrDGt.exe
  2⤵
  PID:7420
- C:\Windows\System\nMilxqC.exe
  C:\Windows\System\nMilxqC.exe
  2⤵
  PID:7436
- C:\Windows\System\FGaofnF.exe
  C:\Windows\System\FGaofnF.exe
  2⤵
  PID:7460
- C:\Windows\System\KgySuHO.exe
  C:\Windows\System\KgySuHO.exe
  2⤵
  PID:7484
- C:\Windows\System\JpwvFUd.exe
  C:\Windows\System\JpwvFUd.exe
  2⤵
  PID:7508
- C:\Windows\System\tjogCqc.exe
  C:\Windows\System\tjogCqc.exe
  2⤵
  PID:7528
- C:\Windows\System\gKvRLcK.exe
  C:\Windows\System\gKvRLcK.exe
  2⤵
  PID:7552
- C:\Windows\System\cCJAfWu.exe
  C:\Windows\System\cCJAfWu.exe
  2⤵
  PID:7580
- C:\Windows\System\hQkhsAD.exe
  C:\Windows\System\hQkhsAD.exe
  2⤵
  PID:7596
- C:\Windows\System\tytDwVf.exe
  C:\Windows\System\tytDwVf.exe
  2⤵
  PID:7620
- C:\Windows\System\kxXSbYp.exe
  C:\Windows\System\kxXSbYp.exe
  2⤵
  PID:7652
- C:\Windows\System\KOvKXGK.exe
  C:\Windows\System\KOvKXGK.exe
  2⤵
  PID:7676
- C:\Windows\System\TBcdtHT.exe
  C:\Windows\System\TBcdtHT.exe
  2⤵
  PID:7696
- C:\Windows\System\mlbESVW.exe
  C:\Windows\System\mlbESVW.exe
  2⤵
  PID:7720
- C:\Windows\System\XFfspKq.exe
  C:\Windows\System\XFfspKq.exe
  2⤵
  PID:7736
- C:\Windows\System\YgPkAJC.exe
  C:\Windows\System\YgPkAJC.exe
  2⤵
  PID:7756
- C:\Windows\System\ZXwKdqM.exe
  C:\Windows\System\ZXwKdqM.exe
  2⤵
  PID:7780
- C:\Windows\System\svSPBgO.exe
  C:\Windows\System\svSPBgO.exe
  2⤵
  PID:7796
- C:\Windows\System\tVTTVdb.exe
  C:\Windows\System\tVTTVdb.exe
  2⤵
  PID:7816
- C:\Windows\System\efSjKdO.exe
  C:\Windows\System\efSjKdO.exe
  2⤵
  PID:7832
- C:\Windows\System\kuoIAui.exe
  C:\Windows\System\kuoIAui.exe
  2⤵
  PID:7852
- C:\Windows\System\bIInbgj.exe
  C:\Windows\System\bIInbgj.exe
  2⤵
  PID:7872
- C:\Windows\System\KLVRdpv.exe
  C:\Windows\System\KLVRdpv.exe
  2⤵
  PID:7888
- C:\Windows\System\cmsTEmU.exe
  C:\Windows\System\cmsTEmU.exe
  2⤵
  PID:7912
- C:\Windows\System\MqtXfLh.exe
  C:\Windows\System\MqtXfLh.exe
  2⤵
  PID:7936
- C:\Windows\System\ZFnWHac.exe
  C:\Windows\System\ZFnWHac.exe
  2⤵
  PID:7952
- C:\Windows\System\EHywIom.exe
  C:\Windows\System\EHywIom.exe
  2⤵
  PID:7976
- C:\Windows\System\WXqdEBw.exe
  C:\Windows\System\WXqdEBw.exe
  2⤵
  PID:7996
- C:\Windows\System\pTHThwv.exe
  C:\Windows\System\pTHThwv.exe
  2⤵
  PID:8020
- C:\Windows\System\nrBbWFo.exe
  C:\Windows\System\nrBbWFo.exe
  2⤵
  PID:8040
- C:\Windows\System\CCbdPai.exe
  C:\Windows\System\CCbdPai.exe
  2⤵
  PID:8060
- C:\Windows\System\DvlXryM.exe
  C:\Windows\System\DvlXryM.exe
  2⤵
  PID:8080
- C:\Windows\System\KOdgSbA.exe
  C:\Windows\System\KOdgSbA.exe
  2⤵
  PID:8100
- C:\Windows\System\AgfaQAr.exe
  C:\Windows\System\AgfaQAr.exe
  2⤵
  PID:8124
- C:\Windows\System\ZFTIfXi.exe
  C:\Windows\System\ZFTIfXi.exe
  2⤵
  PID:8140
- C:\Windows\System\KtMAWjj.exe
  C:\Windows\System\KtMAWjj.exe
  2⤵
  PID:8164
- C:\Windows\System\aUayMQr.exe
  C:\Windows\System\aUayMQr.exe
  2⤵
  PID:8188
- C:\Windows\System\gfHkwHr.exe
  C:\Windows\System\gfHkwHr.exe
  2⤵
  PID:6488
- C:\Windows\System\JHvtUFd.exe
  C:\Windows\System\JHvtUFd.exe
  2⤵
  PID:6564
- C:\Windows\System\iVwlvfN.exe
  C:\Windows\System\iVwlvfN.exe
  2⤵
  PID:6896
- C:\Windows\System\IHVBEOj.exe
  C:\Windows\System\IHVBEOj.exe
  2⤵
  PID:6960
- C:\Windows\System\xZvBGxL.exe
  C:\Windows\System\xZvBGxL.exe
  2⤵
  PID:6636
- C:\Windows\System\YFVwxda.exe
  C:\Windows\System\YFVwxda.exe
  2⤵
  PID:5724
- C:\Windows\System\VBccGmw.exe
  C:\Windows\System\VBccGmw.exe
  2⤵
  PID:6168
- C:\Windows\System\qPIsuVN.exe
  C:\Windows\System\qPIsuVN.exe
  2⤵
  PID:6740
- C:\Windows\System\dgICFFW.exe
  C:\Windows\System\dgICFFW.exe
  2⤵
  PID:8200
- C:\Windows\System\zpCZpvJ.exe
  C:\Windows\System\zpCZpvJ.exe
  2⤵
  PID:8228
- C:\Windows\System\LZOnMQv.exe
  C:\Windows\System\LZOnMQv.exe
  2⤵
  PID:8248
- C:\Windows\System\EjzLJAy.exe
  C:\Windows\System\EjzLJAy.exe
  2⤵
  PID:8268
- C:\Windows\System\RSJBWBQ.exe
  C:\Windows\System\RSJBWBQ.exe
  2⤵
  PID:8292
- C:\Windows\System\taUwpHb.exe
  C:\Windows\System\taUwpHb.exe
  2⤵
  PID:8328
- C:\Windows\System\WGLsJQE.exe
  C:\Windows\System\WGLsJQE.exe
  2⤵
  PID:8348
- C:\Windows\System\okTcaeg.exe
  C:\Windows\System\okTcaeg.exe
  2⤵
  PID:8372
- C:\Windows\System\gvZGIwC.exe
  C:\Windows\System\gvZGIwC.exe
  2⤵
  PID:8400
- C:\Windows\System\iJhoSBO.exe
  C:\Windows\System\iJhoSBO.exe
  2⤵
  PID:8420
- C:\Windows\System\jRtvHrT.exe
  C:\Windows\System\jRtvHrT.exe
  2⤵
  PID:8440
- C:\Windows\System\uJhSIxf.exe
  C:\Windows\System\uJhSIxf.exe
  2⤵
  PID:8468
- C:\Windows\System\opjaerB.exe
  C:\Windows\System\opjaerB.exe
  2⤵
  PID:8492
- C:\Windows\System\DqyzZfh.exe
  C:\Windows\System\DqyzZfh.exe
  2⤵
  PID:8508
- C:\Windows\System\nopSrcX.exe
  C:\Windows\System\nopSrcX.exe
  2⤵
  PID:8536
- C:\Windows\System\dJFOnFn.exe
  C:\Windows\System\dJFOnFn.exe
  2⤵
  PID:8556
- C:\Windows\System\YSJziku.exe
  C:\Windows\System\YSJziku.exe
  2⤵
  PID:8576
- C:\Windows\System\prWrPKV.exe
  C:\Windows\System\prWrPKV.exe
  2⤵
  PID:8604
- C:\Windows\System\ZaRoPrK.exe
  C:\Windows\System\ZaRoPrK.exe
  2⤵
  PID:8624
- C:\Windows\System\JjDNuOU.exe
  C:\Windows\System\JjDNuOU.exe
  2⤵
  PID:8648
- C:\Windows\System\AFwrQQj.exe
  C:\Windows\System\AFwrQQj.exe
  2⤵
  PID:8672
- C:\Windows\System\aVhyYjW.exe
  C:\Windows\System\aVhyYjW.exe
  2⤵
  PID:8692
- C:\Windows\System\YvMiPJI.exe
  C:\Windows\System\YvMiPJI.exe
  2⤵
  PID:8716
- C:\Windows\System\whMTtrV.exe
  C:\Windows\System\whMTtrV.exe
  2⤵
  PID:8736
- C:\Windows\System\mRMxrKS.exe
  C:\Windows\System\mRMxrKS.exe
  2⤵
  PID:8768
- C:\Windows\System\FipkhrY.exe
  C:\Windows\System\FipkhrY.exe
  2⤵
  PID:8788
- C:\Windows\System\vtUuRVa.exe
  C:\Windows\System\vtUuRVa.exe
  2⤵
  PID:8816
- C:\Windows\System\HTKJMCv.exe
  C:\Windows\System\HTKJMCv.exe
  2⤵
  PID:8836
- C:\Windows\System\gogkBmw.exe
  C:\Windows\System\gogkBmw.exe
  2⤵
  PID:8868
- C:\Windows\System\pnwiqAz.exe
  C:\Windows\System\pnwiqAz.exe
  2⤵
  PID:8888
- C:\Windows\System\GpqifEF.exe
  C:\Windows\System\GpqifEF.exe
  2⤵
  PID:8912
- C:\Windows\System\xKPvRkB.exe
  C:\Windows\System\xKPvRkB.exe
  2⤵
  PID:8932
- C:\Windows\System\IFuwMzW.exe
  C:\Windows\System\IFuwMzW.exe
  2⤵
  PID:8956
- C:\Windows\System\KXLlOUh.exe
  C:\Windows\System\KXLlOUh.exe
  2⤵
  PID:8976
- C:\Windows\System\sLdXEEg.exe
  C:\Windows\System\sLdXEEg.exe
  2⤵
  PID:8996
- C:\Windows\System\ULKosUr.exe
  C:\Windows\System\ULKosUr.exe
  2⤵
  PID:9020
- C:\Windows\System\kYXtqzs.exe
  C:\Windows\System\kYXtqzs.exe
  2⤵
  PID:9044
- C:\Windows\System\XdTitvc.exe
  C:\Windows\System\XdTitvc.exe
  2⤵
  PID:9068
- C:\Windows\System\XAMEWZC.exe
  C:\Windows\System\XAMEWZC.exe
  2⤵
  PID:9092
- C:\Windows\System\zTlslSc.exe
  C:\Windows\System\zTlslSc.exe
  2⤵
  PID:9116
- C:\Windows\System\dfJMrhU.exe
  C:\Windows\System\dfJMrhU.exe
  2⤵
  PID:9136
- C:\Windows\System\NEFQEyr.exe
  C:\Windows\System\NEFQEyr.exe
  2⤵
  PID:9160
- C:\Windows\System\NiAhGOz.exe
  C:\Windows\System\NiAhGOz.exe
  2⤵
  PID:9184
- C:\Windows\System\iqbOuRs.exe
  C:\Windows\System\iqbOuRs.exe
  2⤵
  PID:9212
- C:\Windows\System\pnAZFrN.exe
  C:\Windows\System\pnAZFrN.exe
  2⤵
  PID:7260
- C:\Windows\System\gPxJjGC.exe
  C:\Windows\System\gPxJjGC.exe
  2⤵
  PID:7324
- C:\Windows\System\GMiiCyO.exe
  C:\Windows\System\GMiiCyO.exe
  2⤵
  PID:7496
- C:\Windows\System\pVVAJCi.exe
  C:\Windows\System\pVVAJCi.exe
  2⤵
  PID:7544
- C:\Windows\System\cnhGLPi.exe
  C:\Windows\System\cnhGLPi.exe
  2⤵
  PID:7604
- C:\Windows\System\syyveZY.exe
  C:\Windows\System\syyveZY.exe
  2⤵
  PID:7640
- C:\Windows\System\ZkZkwXy.exe
  C:\Windows\System\ZkZkwXy.exe
  2⤵
  PID:7732
- C:\Windows\System\JluwHIU.exe
  C:\Windows\System\JluwHIU.exe
  2⤵
  PID:7812
- C:\Windows\System\wbRRHGl.exe
  C:\Windows\System\wbRRHGl.exe
  2⤵
  PID:6916
- C:\Windows\System\DsbZZEh.exe
  C:\Windows\System\DsbZZEh.exe
  2⤵
  PID:6976
- C:\Windows\System\NGfchDD.exe
  C:\Windows\System\NGfchDD.exe
  2⤵
  PID:6848
- C:\Windows\System\nNwSiVa.exe
  C:\Windows\System\nNwSiVa.exe
  2⤵
  PID:7112
- C:\Windows\System\BJYfufh.exe
  C:\Windows\System\BJYfufh.exe
  2⤵
  PID:7028
- C:\Windows\System\xBoWuZs.exe
  C:\Windows\System\xBoWuZs.exe
  2⤵
  PID:6136
- C:\Windows\System\tIzxuLp.exe
  C:\Windows\System\tIzxuLp.exe
  2⤵
  PID:5284
- C:\Windows\System\kARZQHn.exe
  C:\Windows\System\kARZQHn.exe
  2⤵
  PID:6052
- C:\Windows\System\tcAtqoS.exe
  C:\Windows\System\tcAtqoS.exe
  2⤵
  PID:7004
- C:\Windows\System\DSRQWvQ.exe
  C:\Windows\System\DSRQWvQ.exe
  2⤵
  PID:7220
- C:\Windows\System\vvXRWAD.exe
  C:\Windows\System\vvXRWAD.exe
  2⤵
  PID:8236
- C:\Windows\System\XfybVuj.exe
  C:\Windows\System\XfybVuj.exe
  2⤵
  PID:7344
- C:\Windows\System\IWBHzVx.exe
  C:\Windows\System\IWBHzVx.exe
  2⤵
  PID:7364
- C:\Windows\System\nwGtxyr.exe
  C:\Windows\System\nwGtxyr.exe
  2⤵
  PID:7416
- C:\Windows\System\KmWbEOQ.exe
  C:\Windows\System\KmWbEOQ.exe
  2⤵
  PID:7476
- C:\Windows\System\IbVERvq.exe
  C:\Windows\System\IbVERvq.exe
  2⤵
  PID:7588
- C:\Windows\System\IZmoGAj.exe
  C:\Windows\System\IZmoGAj.exe
  2⤵
  PID:5916
- C:\Windows\System\Muopuxt.exe
  C:\Windows\System\Muopuxt.exe
  2⤵
  PID:8568
- C:\Windows\System\ZUeFStH.exe
  C:\Windows\System\ZUeFStH.exe
  2⤵
  PID:8620
- C:\Windows\System\cnpMawh.exe
  C:\Windows\System\cnpMawh.exe
  2⤵
  PID:6516
- C:\Windows\System\mXfBVyt.exe
  C:\Windows\System\mXfBVyt.exe
  2⤵
  PID:8724
- C:\Windows\System\kMogJVS.exe
  C:\Windows\System\kMogJVS.exe
  2⤵
  PID:9224
- C:\Windows\System\chZTRoM.exe
  C:\Windows\System\chZTRoM.exe
  2⤵
  PID:9248
- C:\Windows\System\uielSFG.exe
  C:\Windows\System\uielSFG.exe
  2⤵
  PID:9272
- C:\Windows\System\lwNVSWk.exe
  C:\Windows\System\lwNVSWk.exe
  2⤵
  PID:9296
- C:\Windows\System\gcgEfUs.exe
  C:\Windows\System\gcgEfUs.exe
  2⤵
  PID:9324
- C:\Windows\System\yohhawV.exe
  C:\Windows\System\yohhawV.exe
  2⤵
  PID:9344
- C:\Windows\System\weaFzCa.exe
  C:\Windows\System\weaFzCa.exe
  2⤵
  PID:9368
- C:\Windows\System\sgXXaps.exe
  C:\Windows\System\sgXXaps.exe
  2⤵
  PID:9392
- C:\Windows\System\lDCglbm.exe
  C:\Windows\System\lDCglbm.exe
  2⤵
  PID:9412
- C:\Windows\System\pBYiLXg.exe
  C:\Windows\System\pBYiLXg.exe
  2⤵
  PID:9432
- C:\Windows\System\DRErgAO.exe
  C:\Windows\System\DRErgAO.exe
  2⤵
  PID:9452
- C:\Windows\System\EPmIoeh.exe
  C:\Windows\System\EPmIoeh.exe
  2⤵
  PID:9480
- C:\Windows\System\HMBOLFS.exe
  C:\Windows\System\HMBOLFS.exe
  2⤵
  PID:9500
- C:\Windows\System\MIRGoCH.exe
  C:\Windows\System\MIRGoCH.exe
  2⤵
  PID:9524
- C:\Windows\System\OPwqNtW.exe
  C:\Windows\System\OPwqNtW.exe
  2⤵
  PID:9544
- C:\Windows\System\vfevdTi.exe
  C:\Windows\System\vfevdTi.exe
  2⤵
  PID:9568
- C:\Windows\System\wQxeHKn.exe
  C:\Windows\System\wQxeHKn.exe
  2⤵
  PID:9588
- C:\Windows\System\rfrsOpw.exe
  C:\Windows\System\rfrsOpw.exe
  2⤵
  PID:9616
- C:\Windows\System\qGiirli.exe
  C:\Windows\System\qGiirli.exe
  2⤵
  PID:9640
- C:\Windows\System\oROHfuy.exe
  C:\Windows\System\oROHfuy.exe
  2⤵
  PID:9660
- C:\Windows\System\OpTWmtJ.exe
  C:\Windows\System\OpTWmtJ.exe
  2⤵
  PID:9680
- C:\Windows\System\QqMUHxY.exe
  C:\Windows\System\QqMUHxY.exe
  2⤵
  PID:9704
- C:\Windows\System\sqZPURH.exe
  C:\Windows\System\sqZPURH.exe
  2⤵
  PID:9740
- C:\Windows\System\OtGlZKQ.exe
  C:\Windows\System\OtGlZKQ.exe
  2⤵
  PID:9756
- C:\Windows\System\rmZFwJm.exe
  C:\Windows\System\rmZFwJm.exe
  2⤵
  PID:9784
- C:\Windows\System\NWsDPFx.exe
  C:\Windows\System\NWsDPFx.exe
  2⤵
  PID:9804
- C:\Windows\System\YCxSFjp.exe
  C:\Windows\System\YCxSFjp.exe
  2⤵
  PID:9828
- C:\Windows\System\eWrOLiv.exe
  C:\Windows\System\eWrOLiv.exe
  2⤵
  PID:9844
- C:\Windows\System\GFYlcZA.exe
  C:\Windows\System\GFYlcZA.exe
  2⤵
  PID:9860
- C:\Windows\System\XusEtIb.exe
  C:\Windows\System\XusEtIb.exe
  2⤵
  PID:9876
- C:\Windows\System\smwUILY.exe
  C:\Windows\System\smwUILY.exe
  2⤵
  PID:9896
- C:\Windows\System\XeQGejw.exe
  C:\Windows\System\XeQGejw.exe
  2⤵
  PID:9916
- C:\Windows\System\rRoRISz.exe
  C:\Windows\System\rRoRISz.exe
  2⤵
  PID:9940
- C:\Windows\System\dplneUp.exe
  C:\Windows\System\dplneUp.exe
  2⤵
  PID:9960
- C:\Windows\System\FlPKvxO.exe
  C:\Windows\System\FlPKvxO.exe
  2⤵
  PID:9984
- C:\Windows\System\ifIbWUn.exe
  C:\Windows\System\ifIbWUn.exe
  2⤵
  PID:10008
- C:\Windows\System\XXuGwxU.exe
  C:\Windows\System\XXuGwxU.exe
  2⤵
  PID:10028
- C:\Windows\System\YPFeCql.exe
  C:\Windows\System\YPFeCql.exe
  2⤵
  PID:10048
- C:\Windows\System\kpygCPq.exe
  C:\Windows\System\kpygCPq.exe
  2⤵
  PID:10076
- C:\Windows\System\SLJmDyD.exe
  C:\Windows\System\SLJmDyD.exe
  2⤵
  PID:10096
- C:\Windows\System\JmcTaVP.exe
  C:\Windows\System\JmcTaVP.exe
  2⤵
  PID:10116
- C:\Windows\System\MxmxDfc.exe
  C:\Windows\System\MxmxDfc.exe
  2⤵
  PID:10136
- C:\Windows\System\wzIsJvI.exe
  C:\Windows\System\wzIsJvI.exe
  2⤵
  PID:10156
- C:\Windows\System\LEWUDgr.exe
  C:\Windows\System\LEWUDgr.exe
  2⤵
  PID:10180
- C:\Windows\System\czPGBib.exe
  C:\Windows\System\czPGBib.exe
  2⤵
  PID:10204
- C:\Windows\System\mXVbpaE.exe
  C:\Windows\System\mXVbpaE.exe
  2⤵
  PID:10228
- C:\Windows\System\mHFYYJa.exe
  C:\Windows\System\mHFYYJa.exe
  2⤵
  PID:7884
- C:\Windows\System\SrCTGtn.exe
  C:\Windows\System\SrCTGtn.exe
  2⤵
  PID:7932
- C:\Windows\System\TFjhFIf.exe
  C:\Windows\System\TFjhFIf.exe
  2⤵
  PID:6800
- C:\Windows\System\ZfouQox.exe
  C:\Windows\System\ZfouQox.exe
  2⤵
  PID:8924
- C:\Windows\System\tNDGphe.exe
  C:\Windows\System\tNDGphe.exe
  2⤵
  PID:8172
- C:\Windows\System\aqHgSqq.exe
  C:\Windows\System\aqHgSqq.exe
  2⤵
  PID:9132
- C:\Windows\System\PumAOri.exe
  C:\Windows\System\PumAOri.exe
  2⤵
  PID:5172
- C:\Windows\System\IytJWBg.exe
  C:\Windows\System\IytJWBg.exe
  2⤵
  PID:6600
- C:\Windows\System\dCsRlmG.exe
  C:\Windows\System\dCsRlmG.exe
  2⤵
  PID:9208
- C:\Windows\System\wEMkPvP.exe
  C:\Windows\System\wEMkPvP.exe
  2⤵
  PID:7176
- C:\Windows\System\RkKUwhq.exe
  C:\Windows\System\RkKUwhq.exe
  2⤵
  PID:7564
- C:\Windows\System\pTksKlF.exe
  C:\Windows\System\pTksKlF.exe
  2⤵
  PID:7716
- C:\Windows\System\AigwTbO.exe
  C:\Windows\System\AigwTbO.exe
  2⤵
  PID:7860
- C:\Windows\System\WjGCbfD.exe
  C:\Windows\System\WjGCbfD.exe
  2⤵
  PID:8384
- C:\Windows\System\GhKLSAH.exe
  C:\Windows\System\GhKLSAH.exe
  2⤵
  PID:7156
- C:\Windows\System\CXUZDTb.exe
  C:\Windows\System\CXUZDTb.exe
  2⤵
  PID:8500
- C:\Windows\System\PWCzauj.exe
  C:\Windows\System\PWCzauj.exe
  2⤵
  PID:8264
- C:\Windows\System\AZaJlNT.exe
  C:\Windows\System\AZaJlNT.exe
  2⤵
  PID:8600
- C:\Windows\System\RgnLtBr.exe
  C:\Windows\System\RgnLtBr.exe
  2⤵
  PID:8640
- C:\Windows\System\xkfgGCT.exe
  C:\Windows\System\xkfgGCT.exe
  2⤵
  PID:8436
- C:\Windows\System\HHgxiEk.exe
  C:\Windows\System\HHgxiEk.exe
  2⤵
  PID:7664
- C:\Windows\System\glrOWEp.exe
  C:\Windows\System\glrOWEp.exe
  2⤵
  PID:9220
- C:\Windows\System\GKLGPWW.exe
  C:\Windows\System\GKLGPWW.exe
  2⤵
  PID:8832
- C:\Windows\System\IZcSBgx.exe
  C:\Windows\System\IZcSBgx.exe
  2⤵
  PID:9364
- C:\Windows\System\NofyAgb.exe
  C:\Windows\System\NofyAgb.exe
  2⤵
  PID:10260
- C:\Windows\System\gpGwBPM.exe
  C:\Windows\System\gpGwBPM.exe
  2⤵
  PID:10280
- C:\Windows\System\CoawuNX.exe
  C:\Windows\System\CoawuNX.exe
  2⤵
  PID:10300
- C:\Windows\System\iEkzKZC.exe
  C:\Windows\System\iEkzKZC.exe
  2⤵
  PID:10324
- C:\Windows\System\ubPyDUr.exe
  C:\Windows\System\ubPyDUr.exe
  2⤵
  PID:10344
- C:\Windows\System\iCmgQHY.exe
  C:\Windows\System\iCmgQHY.exe
  2⤵
  PID:10364
- C:\Windows\System\IWmtAAi.exe
  C:\Windows\System\IWmtAAi.exe
  2⤵
  PID:10384
- C:\Windows\System\unwMOrP.exe
  C:\Windows\System\unwMOrP.exe
  2⤵
  PID:10408
- C:\Windows\System\qSHnqLB.exe
  C:\Windows\System\qSHnqLB.exe
  2⤵
  PID:10432
- C:\Windows\System\QRoxypy.exe
  C:\Windows\System\QRoxypy.exe
  2⤵
  PID:10456
- C:\Windows\System\VjYnepY.exe
  C:\Windows\System\VjYnepY.exe
  2⤵
  PID:10476
- C:\Windows\System\DikDIfZ.exe
  C:\Windows\System\DikDIfZ.exe
  2⤵
  PID:10500
- C:\Windows\System\opCTLml.exe
  C:\Windows\System\opCTLml.exe
  2⤵
  PID:10520
- C:\Windows\System\uXfVdGw.exe
  C:\Windows\System\uXfVdGw.exe
  2⤵
  PID:10548
- C:\Windows\System\onyClXa.exe
  C:\Windows\System\onyClXa.exe
  2⤵
  PID:10568
- C:\Windows\System\cUyiDyh.exe
  C:\Windows\System\cUyiDyh.exe
  2⤵
  PID:10588
- C:\Windows\System\ufWHDBH.exe
  C:\Windows\System\ufWHDBH.exe
  2⤵
  PID:10616
- C:\Windows\System\IAPTECu.exe
  C:\Windows\System\IAPTECu.exe
  2⤵
  PID:10636
- C:\Windows\System\WHaDmuc.exe
  C:\Windows\System\WHaDmuc.exe
  2⤵
  PID:10656
- C:\Windows\System\OYZgcjp.exe
  C:\Windows\System\OYZgcjp.exe
  2⤵
  PID:10684
- C:\Windows\System\sZIJYYa.exe
  C:\Windows\System\sZIJYYa.exe
  2⤵
  PID:10708
- C:\Windows\System\zOqhsYH.exe
  C:\Windows\System\zOqhsYH.exe
  2⤵
  PID:10736
- C:\Windows\System\QEmxFqD.exe
  C:\Windows\System\QEmxFqD.exe
  2⤵
  PID:10756
- C:\Windows\System\NKAnQot.exe
  C:\Windows\System\NKAnQot.exe
  2⤵
  PID:10784
- C:\Windows\System\ffjiibM.exe
  C:\Windows\System\ffjiibM.exe
  2⤵
  PID:10804
- C:\Windows\System\lZksOXQ.exe
  C:\Windows\System\lZksOXQ.exe
  2⤵
  PID:10820
- C:\Windows\System\yheCLNV.exe
  C:\Windows\System\yheCLNV.exe
  2⤵
  PID:10836
- C:\Windows\System\aczeIPy.exe
  C:\Windows\System\aczeIPy.exe
  2⤵
  PID:10852
- C:\Windows\System\PfUDWGL.exe
  C:\Windows\System\PfUDWGL.exe
  2⤵
  PID:10868
- C:\Windows\System\CdLfsMC.exe
  C:\Windows\System\CdLfsMC.exe
  2⤵
  PID:10892
- C:\Windows\System\DfbIbyu.exe
  C:\Windows\System\DfbIbyu.exe
  2⤵
  PID:10916
- C:\Windows\System\JzgdJSd.exe
  C:\Windows\System\JzgdJSd.exe
  2⤵
  PID:10932
- C:\Windows\System\MbWjOoP.exe
  C:\Windows\System\MbWjOoP.exe
  2⤵
  PID:10956
- C:\Windows\System\kWbnwbg.exe
  C:\Windows\System\kWbnwbg.exe
  2⤵
  PID:10980
- C:\Windows\System\sJZqujP.exe
  C:\Windows\System\sJZqujP.exe
  2⤵
  PID:11000
- C:\Windows\System\TBFfxrB.exe
  C:\Windows\System\TBFfxrB.exe
  2⤵
  PID:11020
- C:\Windows\System\vNndazn.exe
  C:\Windows\System\vNndazn.exe
  2⤵
  PID:11044
- C:\Windows\System\gumVDJP.exe
  C:\Windows\System\gumVDJP.exe
  2⤵
  PID:11064
- C:\Windows\System\hJUsrav.exe
  C:\Windows\System\hJUsrav.exe
  2⤵
  PID:11084
- C:\Windows\System\VPeYURr.exe
  C:\Windows\System\VPeYURr.exe
  2⤵
  PID:11112
- C:\Windows\System\rHGBSVD.exe
  C:\Windows\System\rHGBSVD.exe
  2⤵
  PID:11132
- C:\Windows\System\MVZQoQh.exe
  C:\Windows\System\MVZQoQh.exe
  2⤵
  PID:11156
- C:\Windows\System\cHSnjuo.exe
  C:\Windows\System\cHSnjuo.exe
  2⤵
  PID:11176
- C:\Windows\System\FJtzbzA.exe
  C:\Windows\System\FJtzbzA.exe
  2⤵
  PID:11200
- C:\Windows\System\VymwVIE.exe
  C:\Windows\System\VymwVIE.exe
  2⤵
  PID:11220
- C:\Windows\System\FFSNFkI.exe
  C:\Windows\System\FFSNFkI.exe
  2⤵
  PID:11244
- C:\Windows\System\SJPNjVG.exe
  C:\Windows\System\SJPNjVG.exe
  2⤵
  PID:7992
- C:\Windows\System\DrOTSFJ.exe
  C:\Windows\System\DrOTSFJ.exe
  2⤵
  PID:8908
- C:\Windows\System\mWxVAuW.exe
  C:\Windows\System\mWxVAuW.exe
  2⤵
  PID:9496
- C:\Windows\System\xlAStzl.exe
  C:\Windows\System\xlAStzl.exe
  2⤵
  PID:8092
- C:\Windows\System\yOdRcYK.exe
  C:\Windows\System\yOdRcYK.exe
  2⤵
  PID:8968
- C:\Windows\System\cPbRmLx.exe
  C:\Windows\System\cPbRmLx.exe
  2⤵
  PID:9552
- C:\Windows\System\gxtSbRQ.exe
  C:\Windows\System\gxtSbRQ.exe
  2⤵
  PID:9056
- C:\Windows\System\hVNLEFs.exe
  C:\Windows\System\hVNLEFs.exe
  2⤵
  PID:9672
- C:\Windows\System\ElRpYmY.exe
  C:\Windows\System\ElRpYmY.exe
  2⤵
  PID:9776
- C:\Windows\System\JkJvFYf.exe
  C:\Windows\System\JkJvFYf.exe
  2⤵
  PID:7456
- C:\Windows\System\jUbVWYP.exe
  C:\Windows\System\jUbVWYP.exe
  2⤵
  PID:7536
- C:\Windows\System\jsGeCis.exe
  C:\Windows\System\jsGeCis.exe
  2⤵
  PID:7572
- C:\Windows\System\zLIhswN.exe
  C:\Windows\System\zLIhswN.exe
  2⤵
  PID:7728
- C:\Windows\System\BrxGqfG.exe
  C:\Windows\System\BrxGqfG.exe
  2⤵
  PID:6908
- C:\Windows\System\PTXqkIA.exe
  C:\Windows\System\PTXqkIA.exe
  2⤵
  PID:10128
- C:\Windows\System\VjnmuaP.exe
  C:\Windows\System\VjnmuaP.exe
  2⤵
  PID:8460
- C:\Windows\System\fjTIBVL.exe
  C:\Windows\System\fjTIBVL.exe
  2⤵
  PID:6032
- C:\Windows\System\HURSgsd.exe
  C:\Windows\System\HURSgsd.exe
  2⤵
  PID:5156
- C:\Windows\System\QRqyoRQ.exe
  C:\Windows\System\QRqyoRQ.exe
  2⤵
  PID:9032
- C:\Windows\System\YKfFtrg.exe
  C:\Windows\System\YKfFtrg.exe
  2⤵
  PID:9128
- C:\Windows\System\iolmgBK.exe
  C:\Windows\System\iolmgBK.exe
  2⤵
  PID:9204
- C:\Windows\System\naVWmZW.exe
  C:\Windows\System\naVWmZW.exe
  2⤵
  PID:7392
- C:\Windows\System\FhWGJpM.exe
  C:\Windows\System\FhWGJpM.exe
  2⤵
  PID:11268
- C:\Windows\System\yUevNco.exe
  C:\Windows\System\yUevNco.exe
  2⤵
  PID:11288
- C:\Windows\System\aoUagYY.exe
  C:\Windows\System\aoUagYY.exe
  2⤵
  PID:11308
- C:\Windows\System\XbvkPMU.exe
  C:\Windows\System\XbvkPMU.exe
  2⤵
  PID:11332
- C:\Windows\System\QTlnKJw.exe
  C:\Windows\System\QTlnKJw.exe
  2⤵
  PID:11356
- C:\Windows\System\VKUQFac.exe
  C:\Windows\System\VKUQFac.exe
  2⤵
  PID:11380
- C:\Windows\System\cvKuFvR.exe
  C:\Windows\System\cvKuFvR.exe
  2⤵
  PID:11408
- C:\Windows\System\vMyvJbG.exe
  C:\Windows\System\vMyvJbG.exe
  2⤵
  PID:11424
- C:\Windows\System\nnUlWcC.exe
  C:\Windows\System\nnUlWcC.exe
  2⤵
  PID:11448
- C:\Windows\System\DXAZbmB.exe
  C:\Windows\System\DXAZbmB.exe
  2⤵
  PID:11472
- C:\Windows\System\GUWTJTi.exe
  C:\Windows\System\GUWTJTi.exe
  2⤵
  PID:11492
- C:\Windows\System\KTWhInT.exe
  C:\Windows\System\KTWhInT.exe
  2⤵
  PID:11520
- C:\Windows\System\myboTJY.exe
  C:\Windows\System\myboTJY.exe
  2⤵
  PID:11540
- C:\Windows\System\KXihNYn.exe
  C:\Windows\System\KXihNYn.exe
  2⤵
  PID:11564
- C:\Windows\System\LWXYEXf.exe
  C:\Windows\System\LWXYEXf.exe
  2⤵
  PID:11588
- C:\Windows\System\TWuGTHE.exe
  C:\Windows\System\TWuGTHE.exe
  2⤵
  PID:11608
- C:\Windows\System\EYhVxTW.exe
  C:\Windows\System\EYhVxTW.exe
  2⤵
  PID:11628
- C:\Windows\System\JEpzZCh.exe
  C:\Windows\System\JEpzZCh.exe
  2⤵
  PID:11648
- C:\Windows\System\HryCPsV.exe
  C:\Windows\System\HryCPsV.exe
  2⤵
  PID:11668
- C:\Windows\System\lwHAcKl.exe
  C:\Windows\System\lwHAcKl.exe
  2⤵
  PID:11688
- C:\Windows\System\RtFfYiy.exe
  C:\Windows\System\RtFfYiy.exe
  2⤵
  PID:11708
- C:\Windows\System\ATdrFNS.exe
  C:\Windows\System\ATdrFNS.exe
  2⤵
  PID:11732
- C:\Windows\System\wCzMnFz.exe
  C:\Windows\System\wCzMnFz.exe
  2⤵
  PID:11748
- C:\Windows\System\nPGKYEH.exe
  C:\Windows\System\nPGKYEH.exe
  2⤵
  PID:11764
- C:\Windows\System\uOqIwFn.exe
  C:\Windows\System\uOqIwFn.exe
  2⤵
  PID:11780
- C:\Windows\System\lohnCQv.exe
  C:\Windows\System\lohnCQv.exe
  2⤵
  PID:11796
- C:\Windows\System\zmqaJMP.exe
  C:\Windows\System\zmqaJMP.exe
  2⤵
  PID:11816
- C:\Windows\System\LJlyEdO.exe
  C:\Windows\System\LJlyEdO.exe
  2⤵
  PID:11836
- C:\Windows\System\iKxIXRm.exe
  C:\Windows\System\iKxIXRm.exe
  2⤵
  PID:11860
- C:\Windows\System\DZukMef.exe
  C:\Windows\System\DZukMef.exe
  2⤵
  PID:11876
- C:\Windows\System\VxxvWOU.exe
  C:\Windows\System\VxxvWOU.exe
  2⤵
  PID:11900
- C:\Windows\System\npEyxKJ.exe
  C:\Windows\System\npEyxKJ.exe
  2⤵
  PID:11924
- C:\Windows\System\yqTjFqZ.exe
  C:\Windows\System\yqTjFqZ.exe
  2⤵
  PID:11952
- C:\Windows\System\ImqhgqD.exe
  C:\Windows\System\ImqhgqD.exe
  2⤵
  PID:11976
- C:\Windows\System\bnbHXXH.exe
  C:\Windows\System\bnbHXXH.exe
  2⤵
  PID:11996
- C:\Windows\System\TcPwkom.exe
  C:\Windows\System\TcPwkom.exe
  2⤵
  PID:12016
- C:\Windows\System\KxywREh.exe
  C:\Windows\System\KxywREh.exe
  2⤵
  PID:12040
- C:\Windows\System\ZyNVMNd.exe
  C:\Windows\System\ZyNVMNd.exe
  2⤵
  PID:12060
- C:\Windows\System\iLMkiAa.exe
  C:\Windows\System\iLMkiAa.exe
  2⤵
  PID:12080
- C:\Windows\System\tCINJjT.exe
  C:\Windows\System\tCINJjT.exe
  2⤵
  PID:12100
- C:\Windows\System\qiqiPRB.exe
  C:\Windows\System\qiqiPRB.exe
  2⤵
  PID:12124
- C:\Windows\System\vBMRxqz.exe
  C:\Windows\System\vBMRxqz.exe
  2⤵
  PID:12148
- C:\Windows\System\OYySTDq.exe
  C:\Windows\System\OYySTDq.exe
  2⤵
  PID:12172
- C:\Windows\System\QdywDen.exe
  C:\Windows\System\QdywDen.exe
  2⤵
  PID:12192
- C:\Windows\System\ZjQEcmA.exe
  C:\Windows\System\ZjQEcmA.exe
  2⤵
  PID:12212
- C:\Windows\System\ZKNYtkl.exe
  C:\Windows\System\ZKNYtkl.exe
  2⤵
  PID:12232
- C:\Windows\System\smvmcXk.exe
  C:\Windows\System\smvmcXk.exe
  2⤵
  PID:12252
- C:\Windows\System\knjTwxH.exe
  C:\Windows\System\knjTwxH.exe
  2⤵
  PID:12276
- C:\Windows\System\EbGExFq.exe
  C:\Windows\System\EbGExFq.exe
  2⤵
  PID:8712
- C:\Windows\System\LmHeOzK.exe
  C:\Windows\System\LmHeOzK.exe
  2⤵
  PID:8288
- C:\Windows\System\DEtoYtj.exe
  C:\Windows\System\DEtoYtj.exe
  2⤵
  PID:8796
- C:\Windows\System\yeJXqYJ.exe
  C:\Windows\System\yeJXqYJ.exe
  2⤵
  PID:8544
- C:\Windows\System\lXeNPBD.exe
  C:\Windows\System\lXeNPBD.exe
  2⤵
  PID:7944
- C:\Windows\System\dOvjSks.exe
  C:\Windows\System\dOvjSks.exe
  2⤵
  PID:10272
- C:\Windows\System\cXppILo.exe
  C:\Windows\System\cXppILo.exe
  2⤵
  PID:9448
- C:\Windows\System\CJVMnow.exe
  C:\Windows\System\CJVMnow.exe
  2⤵
  PID:9512
- C:\Windows\System\YHLXpBU.exe
  C:\Windows\System\YHLXpBU.exe
  2⤵
  PID:10492
- C:\Windows\System\krvZCIm.exe
  C:\Windows\System\krvZCIm.exe
  2⤵
  PID:9612
- C:\Windows\System\pYIDerM.exe
  C:\Windows\System\pYIDerM.exe
  2⤵
  PID:9648
- C:\Windows\System\xBOxYDv.exe
  C:\Windows\System\xBOxYDv.exe
  2⤵
  PID:10604
- C:\Windows\System\SLdRpJX.exe
  C:\Windows\System\SLdRpJX.exe
  2⤵
  PID:9700
- C:\Windows\System\QDUaAsk.exe
  C:\Windows\System\QDUaAsk.exe
  2⤵
  PID:9732
- C:\Windows\System\okLHSBZ.exe
  C:\Windows\System\okLHSBZ.exe
  2⤵
  PID:9520
- C:\Windows\System\lkrohaG.exe
  C:\Windows\System\lkrohaG.exe
  2⤵
  PID:7152
- C:\Windows\System\UmPSFQT.exe
  C:\Windows\System\UmPSFQT.exe
  2⤵
  PID:11340
- C:\Windows\System\cGxcVNF.exe
  C:\Windows\System\cGxcVNF.exe
  2⤵
  PID:11584
- C:\Windows\System\HCnHBze.exe
  C:\Windows\System\HCnHBze.exe
  2⤵
  PID:8732
- C:\Windows\System\Rltoltm.exe
  C:\Windows\System\Rltoltm.exe
  2⤵
  PID:11316
- C:\Windows\System\shHuuGZ.exe
  C:\Windows\System\shHuuGZ.exe
  2⤵
  PID:8688
- C:\Windows\System\HrobLTC.exe
  C:\Windows\System\HrobLTC.exe
  2⤵
  PID:10360
- C:\Windows\System\BKMsEZw.exe
  C:\Windows\System\BKMsEZw.exe
  2⤵
  PID:11908
- C:\Windows\System\DNNbcMC.exe
  C:\Windows\System\DNNbcMC.exe
  2⤵
  PID:11968
- C:\Windows\System\iFWrrkr.exe
  C:\Windows\System\iFWrrkr.exe
  2⤵
  PID:12048
- C:\Windows\System\ignhpuG.exe
  C:\Windows\System\ignhpuG.exe
  2⤵
  PID:12072
- C:\Windows\System\otkdUpZ.exe
  C:\Windows\System\otkdUpZ.exe
  2⤵
  PID:12160
- C:\Windows\System\OsKQQDm.exe
  C:\Windows\System\OsKQQDm.exe
  2⤵
  PID:12204
- C:\Windows\System\MSGQSoG.exe
  C:\Windows\System\MSGQSoG.exe
  2⤵
  PID:10744
- C:\Windows\System\ISpEkED.exe
  C:\Windows\System\ISpEkED.exe
  2⤵
  PID:744
- C:\Windows\System\zivryLC.exe
  C:\Windows\System\zivryLC.exe
  2⤵
  PID:10964
- C:\Windows\System\FMQYJhK.exe
  C:\Windows\System\FMQYJhK.exe
  2⤵
  PID:9968
- C:\Windows\System\UCXigrl.exe
  C:\Windows\System\UCXigrl.exe
  2⤵
  PID:8992
- C:\Windows\System\ivKMesn.exe
  C:\Windows\System\ivKMesn.exe
  2⤵
  PID:7048
- C:\Windows\System\SLkEYrU.exe
  C:\Windows\System\SLkEYrU.exe
  2⤵
  PID:12732
- C:\Windows\System\ltUJQGL.exe
  C:\Windows\System\ltUJQGL.exe
  2⤵
  PID:2316
- C:\Windows\System\jxULmzq.exe
  C:\Windows\System\jxULmzq.exe
  2⤵
  PID:11716
- C:\Windows\System\ljgazXU.exe
  C:\Windows\System\ljgazXU.exe
  2⤵
  PID:12480
- C:\Windows\System\bFYoqxb.exe
  C:\Windows\System\bFYoqxb.exe
  2⤵
  PID:11304
- C:\Windows\System\PwLUrqF.exe
  C:\Windows\System\PwLUrqF.exe
  2⤵
  PID:11444
- C:\Windows\System\LKYOQMT.exe
  C:\Windows\System\LKYOQMT.exe
  2⤵
  PID:6076
- C:\Windows\System\CJIHOfM.exe
  C:\Windows\System\CJIHOfM.exe
  2⤵
  PID:2888
- C:\Windows\System\CaYcaJw.exe
  C:\Windows\System\CaYcaJw.exe
  2⤵
  PID:10424
- C:\Windows\System\SCjgcaQ.exe
  C:\Windows\System\SCjgcaQ.exe
  2⤵
  PID:10628
- C:\Windows\System\KJCaoQI.exe
  C:\Windows\System\KJCaoQI.exe
  2⤵
  PID:9380
- C:\Windows\System\RKLlPQS.exe
  C:\Windows\System\RKLlPQS.exe
  2⤵
  PID:12864
- C:\Windows\System\QCUJyFs.exe
  C:\Windows\System\QCUJyFs.exe
  2⤵
  PID:12320
- C:\Windows\System\jhuhEzi.exe
  C:\Windows\System\jhuhEzi.exe
  2⤵
  PID:13304
- C:\Windows\System\wwWtjQM.exe
  C:\Windows\System\wwWtjQM.exe
  2⤵
  PID:9180
- C:\Windows\System\XYVRevu.exe
  C:\Windows\System\XYVRevu.exe
  2⤵
  PID:10288
- C:\Windows\System\DRBdyiz.exe
  C:\Windows\System\DRBdyiz.exe
  2⤵
  PID:11012
- C:\Windows\System\ofvAzRn.exe
  C:\Windows\System\ofvAzRn.exe
  2⤵
  PID:11636
- C:\Windows\System\ISyvpEo.exe
  C:\Windows\System\ISyvpEo.exe
  2⤵
  PID:11684
- C:\Windows\System\bnUVxvi.exe
  C:\Windows\System\bnUVxvi.exe
  2⤵
  PID:12788
- C:\Windows\System\ahzcIYm.exe
  C:\Windows\System\ahzcIYm.exe
  2⤵
  PID:12228
- C:\Windows\System\ZETBWkJ.exe
  C:\Windows\System\ZETBWkJ.exe
  2⤵
  PID:10816
- C:\Windows\System\hrxCxFD.exe
  C:\Windows\System\hrxCxFD.exe
  2⤵
  PID:6724
- C:\Windows\System\OCuQFBj.exe
  C:\Windows\System\OCuQFBj.exe
  2⤵
  PID:11348
- C:\Windows\System\KsoEEWJ.exe
  C:\Windows\System\KsoEEWJ.exe
  2⤵
  PID:10440
- C:\Windows\System\ebjFZTG.exe
  C:\Windows\System\ebjFZTG.exe
  2⤵
  PID:13056
- C:\Windows\System\IClbKJs.exe
  C:\Windows\System\IClbKJs.exe
  2⤵
  PID:11844
- C:\Windows\System\EvZlTnz.exe
  C:\Windows\System\EvZlTnz.exe
  2⤵
  PID:7320
- C:\Windows\System\GVETiGx.exe
  C:\Windows\System\GVETiGx.exe
  2⤵
  PID:11280
- C:\Windows\System\aknePTP.exe
  C:\Windows\System\aknePTP.exe
  2⤵
  PID:12400
- C:\Windows\System\vSOiAyG.exe
  C:\Windows\System\vSOiAyG.exe
  2⤵
  PID:12672
- C:\Windows\System\yWTXBav.exe
  C:\Windows\System\yWTXBav.exe
  2⤵
  PID:4088
- C:\Windows\System\lkBaNuF.exe
  C:\Windows\System\lkBaNuF.exe
  2⤵
  PID:2784
- C:\Windows\System\enhjaiu.exe
  C:\Windows\System\enhjaiu.exe
  2⤵
  PID:11884
- C:\Windows\System\pNoRkFI.exe
  C:\Windows\System\pNoRkFI.exe
  2⤵
  PID:12264
- C:\Windows\System\lNLgmwt.exe
  C:\Windows\System\lNLgmwt.exe
  2⤵
  PID:12640
- C:\Windows\System\lGPgqYd.exe
  C:\Windows\System\lGPgqYd.exe
  2⤵
  PID:12772
- C:\Windows\System\gGBGTdI.exe
  C:\Windows\System\gGBGTdI.exe
  2⤵
  PID:2272
- C:\Windows\System\jMHPPYL.exe
  C:\Windows\System\jMHPPYL.exe
  2⤵
  PID:12340
- C:\Windows\System\NAmiNxj.exe
  C:\Windows\System\NAmiNxj.exe
  2⤵
  PID:11420
- C:\Windows\System\KVFZlLl.exe
  C:\Windows\System\KVFZlLl.exe
  2⤵
  PID:6736
- C:\Windows\System\WeGaptX.exe
  C:\Windows\System\WeGaptX.exe
  2⤵
  PID:10596
- C:\Windows\System\gjdTKKn.exe
  C:\Windows\System\gjdTKKn.exe
  2⤵
  PID:10336
- C:\Windows\System\HnEgYlS.exe
  C:\Windows\System\HnEgYlS.exe
  2⤵
  PID:13020
- C:\Windows\System\bdGUtRP.exe
  C:\Windows\System\bdGUtRP.exe
  2⤵
  PID:12372
- C:\Windows\System\qeeKZjL.exe
  C:\Windows\System\qeeKZjL.exe
  2⤵
  PID:11740
- C:\Windows\System\bGUUBsF.exe
  C:\Windows\System\bGUUBsF.exe
  2⤵
  PID:12852
- C:\Windows\System\QxMZQpn.exe
  C:\Windows\System\QxMZQpn.exe
  2⤵
  PID:11016
- C:\Windows\System\gvkZFds.exe
  C:\Windows\System\gvkZFds.exe
  2⤵
  PID:12636
- C:\Windows\System\OFhFNaS.exe
  C:\Windows\System\OFhFNaS.exe
  2⤵
  PID:11680
- C:\Windows\System\FNgQTct.exe
  C:\Windows\System\FNgQTct.exe
  2⤵
  PID:2196
- C:\Windows\System\KvrMZCB.exe
  C:\Windows\System\KvrMZCB.exe
  2⤵
  PID:12660
- C:\Windows\System\WOaXUAO.exe
  C:\Windows\System\WOaXUAO.exe
  2⤵
  PID:4276
- C:\Windows\System\ByonPjf.exe
  C:\Windows\System\ByonPjf.exe
  2⤵
  PID:2312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_44zr5pnl.i2i.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BhYmteX.exe

Filesize
1.9MB

MD5
baf7dcfe38a729f0ee1acdfc3ded3b5c

SHA1
1150b1d53edd1d8b4c054303d3dce00acce758e8

SHA256
7ae3dfb28017dcbed5b95f2f503a3afdba285c644b78d6e94fb8581bcdddc27f

SHA512
c0a367711c5d65681aa34940a7a02b3600d9347d12294487b1f760f18a38bea656514287c9345d063f50e6da4a31dbd9d36aacb56102e3fd0a1aa5e2a7307e1f

Download Submit
C:\Windows\System\BxVyFLz.exe

Filesize
1.9MB

MD5
3fc0c5ad631da107d77d1978ebd74474

SHA1
808cfdc6edc6f728e8846d77b9091a7572b7ea27

SHA256
82e5478eb03761b3887aa3d22a4cf09823adf373bf2cc0d07e6fc11ef05368e0

SHA512
824f316735fa9a4202aa79985c0b3a3d58bcd2690685b141b91dc860c5ce5ba6e8e3f24bbb249a42be7490a216ee3f12d761f65d05d857f47e48067d60455b50

Download Submit
C:\Windows\System\FIovnym.exe

Filesize
1.9MB

MD5
be196ff11ff30ba75eebdc5d7694ca96

SHA1
8498b30ef30d3785401c444c754e8c76fec35fab

SHA256
dea4384ecb23e62dc32c1ca5e5c5d661af3fff116d63c48e82140d37d3b31a52

SHA512
fa1f6abc8110b661a5a902edc4b83a96632f366ac6516c990e868c18e2f237ba87b9c1585014027b5ec2b988602c3ff1d7c5817799730ca1d5adb2ed043f861e

Download Submit
C:\Windows\System\FbbnLBo.exe

Filesize
2.0MB

MD5
6c80ca8d5e44fb9ed855158d8eadb31d

SHA1
1ce8fcd4abf2e8d40ac2fb9cdb844de5877c60c9

SHA256
d5f7b1d486e9fb4a842ae8958b1bf8860c5b47834927f63b52c766791be26b84

SHA512
77a9ac74518d6cb4dc7b3f63888c6b9f709ebc30ec61bac42ffc327225f3ebb18aaaf86f903b90ca5256a75829b29e98f05a6f75aa649d8a9fad2413fb8764a8

Download Submit
C:\Windows\System\GikrGEr.exe

Filesize
1.9MB

MD5
282b2796be7fbfbb59dddb1f58afba02

SHA1
9dbce19be19cc6c1f65eff48bf6c8522be77e1b9

SHA256
63f34fe814387d257aa1b4b7efffe3b9385c0b278b41f597800e9ca76d8e3ab3

SHA512
2ddc13c01df31592ea228b84f6c19cc57fa2eccd5a1411912a0512030e7b7355e3aea9ed5735650e2dcf3eeaff2538c3c99de12eaa947361bb46f4fc1cf405b8

Download Submit
C:\Windows\System\KJiuSEp.exe

Filesize
1.9MB

MD5
d637987e28f3592fcf3ca74f961f6d15

SHA1
63c889fc823079e6baabe34ef613bec95446a86c

SHA256
aec43949aca0ed08be95be50bfe5f65377f76e36f4803b6fa83dd3ce7022508c

SHA512
bbfbac80cbdf9b3784c08f07bbfdf6b1333361e0af57bf6f54986eee7869648eab04b9f6970048ae9705206507618fffaba8fde2112ca6687048d6192d20f226

Download Submit
C:\Windows\System\NcByeWj.exe

Filesize
2.0MB

MD5
4b6a7561d024366d2c03fbcae59c0bbe

SHA1
26532b8f8feb2f733760387c31b7dc69b47b0123

SHA256
90a07a376de659fd8b37c00500e0c3c37f9e4cd2b9f0f183171fdee3a284d37b

SHA512
24154764c58c723dd9fde277ef8e48b5d4990ffbdef9abbda1bdeefb0e39284ad8df1956ad2ac3b6a18b7f4897edfe45fcdb1f869ea8a01c438c1db021f3cb17

Download Submit
C:\Windows\System\OMjjUBH.exe

Filesize
1.9MB

MD5
5de6e2134a44bdbcf7701b613560c85d

SHA1
782f86129ef7fb4cf091e94923eb48955bbc87fe

SHA256
6772b46850501871eda5fb2e66dcc704aeeaa40140151828971edceddce44298

SHA512
0a3cd617534519c0f8fe3053a01cbaa8018e745a21a0525e8d9bf9e3cda314bb850a8e8e03955001249543f66908c9a1dee93dabe47a5385f49edad052f2e5c5

Download Submit
C:\Windows\System\PmZmoWv.exe

Filesize
2.0MB

MD5
159eb4c95f6bd2c9dd353af853414c35

SHA1
c47c67e473541caee188522833ede51d88dd101c

SHA256
c91602189b5b4a8bcf87acf2c80ced284484cef888fb3f081415210fb24c59a9

SHA512
5a8abb3f5b36522691a52a6ee0488824e9bda245a80fed300571d25c8c98dcc63492c84dcfed2d9c0dcaa1f8588c703bb19b4973edc450ca5d504a021397b9a0

Download Submit
C:\Windows\System\QcOJccE.exe

Filesize
1.9MB

MD5
a68ce3d6bb5b6780bf997d77014397e2

SHA1
973e655662fe31f80294031faa098cd7ba0d95a4

SHA256
577efdb0e581b6621a38c5c84304ca43aaeeb0c74e4d123090c5066bcf3d10b8

SHA512
81729be9de1f87de2e713985145f4f34316b71981f9bb6ffc44f5ca5f9420eb5a8e2476bd5695e00c3601edfeee87c6b99b4f350756f130df16bad81109aee16

Download Submit
C:\Windows\System\TuaRlfo.exe

Filesize
1.9MB

MD5
54711f9ee423dd2c1b41d184cc43ced8

SHA1
cae93edf66a1d1d7abbdc25452ec5bc2e20f63bd

SHA256
8fa37e2fc2c81c5ac3a39bb22cd6f4938d1287425651ad3d7b961ddd140c1752

SHA512
a8dcbb1d2be65b862fef19280874cd6274cb6ca1e8f1cd313edccb895934f0aef8eba1c26e226b522edf0e424a9bfffd9e9291b131836e5298e10dd4d3ac1502

Download Submit
C:\Windows\System\VKYEJaZ.exe

Filesize
2.0MB

MD5
95efed82f23a607c1f5e94152a655bbf

SHA1
180c61f2146b9298c819ccf8598525cd10871925

SHA256
657ce26ffba24e1e6e148f53f09778756ff05cdaf5a008bc2a220bad8335de32

SHA512
f2c56d1d1711ff9fa79df19f627df0892d450f5c24e200153e16bf34ac8c3b12316dc395fb18252cf631c52bd6ef5840f841eb1784396bee82524e104ffc9285

Download Submit
C:\Windows\System\VbxzdQF.exe

Filesize
1.9MB

MD5
91b82f91022c84128d4d3c47c3ec7e29

SHA1
d82f57b423a27698f32253f63b94925ae5da8612

SHA256
d8f012eb7c9970ac72dfa588b435bd222da05ccecb2b66a77672c9ccbe1b1f93

SHA512
b3cf11aa36b4700044f9795ebdf168e25a2169c5bc9c2c1188627dd52b20ada7e5d87effafe1be00fcbb09417cb440fbd0147beb23999b3dd604f35f2da3485b

Download Submit
C:\Windows\System\WdgcCcQ.exe

Filesize
1.9MB

MD5
03ee245a29f7aca6309ec5328dca12f6

SHA1
6916dec8b4fe13eb4c6e09cda41c2363213f408b

SHA256
1cd1211b7523d2eee1a0f77f89868712e581b795def38c7b3a266baab91921a6

SHA512
9026b01fc287f098d21f3110789b9bc1a2145237644f535e53ebe60ff0cab9e578ae200ad26c72dba0745b7825b7944de5fb3ecd527629b83b75b8f02fb573c3

Download Submit
C:\Windows\System\aVCfEFn.exe

Filesize
1.9MB

MD5
e288fb6834ffa1ff80e2e7ea8e906039

SHA1
f14289a3880c5694d2f82c78fe6a59835cdcc0ba

SHA256
8cb9ea25434ee011cd22264b15deaa43a2af38546dc55c8923b5a4f7943bba9a

SHA512
f7ad9d1c56db523ee74a027636509af4126dad907ba376b7f956509da5438956e6a7bbde1e251064953b500ed1253288c680e837fa97ea156935f5272136787f

Download Submit
C:\Windows\System\bAryaPX.exe

Filesize
1.9MB

MD5
c064b44be07ad2c322cead6163467ced

SHA1
f553d8e8893249c5a0cc5153a9ce7ca0cc1c8d2f

SHA256
6388c2afd7842558f56c386885e47a00817c3aa4a103fb36fbcd67665749caa0

SHA512
13ee7d95596a64eab4009c3ffc14faa16b2e68cde1608b65357c37317b23e0149342cdd9e06d7bc733f9a17edd10fee6efebecd3ad4c5d4d77a654dd458a82ec

Download Submit
C:\Windows\System\bfApztj.exe

Filesize
2.0MB

MD5
250c0f7af44d5f0175b95e1d840e7451

SHA1
9261d983b51a81fdca2cc938194dedb555657e3e

SHA256
dc3854d9fe0d88b3ffb9465504cb4d1a4aa95570fbba03c7355ec20b69b33631

SHA512
8c2ad8fe7af43d5f2f5ffbc925e8953ff4bd1f6f2b6641d0f56ffac88625695012b862797276f838ae8852f1cb5006dfde182d757e76fcad2b1b54a57ddfaca3

Download Submit
C:\Windows\System\brgViCP.exe

Filesize
1.9MB

MD5
4529f5f9ba06890c3e792287abc3f6fd

SHA1
98cdcac6ad98ba74f3dd84330cbe47f9eb3a223c

SHA256
117aef22215a98932fda44be5ca80d2d422885adef61fe027484c535b3d17b8e

SHA512
b0d01b072c97d53339127a035bb0d1ffc57f20d58f1889cbd7ad560a9bc0b3b4f6bc0e61a0cb9c7467e6c4612dec6b02d2f88d54844073af2771b502f285425a

Download Submit
C:\Windows\System\dbLXzsg.exe

Filesize
1.9MB

MD5
70052d97ee8e4b940e7d76c171a9bff0

SHA1
9974a48f842f8ea1bd41600a9e0c69e5ed735bb6

SHA256
24e83e223001c9e90fb6c5e65e1c847f6f9d7227d8b3320cdf9179dcdc432e52

SHA512
cf433788583fda74e955b664791b2883f4c5b326bbbc66b1fe31dec9ee69cb0b66d0477d27f2a75e92d65fe65c9cde7e30695be4e935be53a759d304c8f39306

Download Submit
C:\Windows\System\eCWppIT.exe

Filesize
1.9MB

MD5
7857891b43e352ba656eb82c8e4ae0a2

SHA1
babf50dd81b02b77618005f26a36560b9f5d52ec

SHA256
53c78e3bcdf07909b641855f40c4b3467498ed71cf67df4a3937b4b116fa1f3b

SHA512
d77af515c69eae5d2a1ad57859bfeb8e84a821355140f4dbb43118221f543060dbb01854aaa592787afe4f1288e56140f8fdcc31922aced8cf414e56b61c6dad

Download Submit
C:\Windows\System\gHiLHIR.exe

Filesize
1.9MB

MD5
469edee3c3f971057fe4bdfad6cd460c

SHA1
616fbe0697b89b200b865604350366eba2163e71

SHA256
aa7db3017b00df3c2f8280e58c5fb290a7a0615a428fa91389d4b5a21635f360

SHA512
03f5d1d2e02f6d34ebc3081428f41933f0bbcd04494f1835636b07802a20b9f7d14a09466f4b713f45edd1d0082e8418a4bf5e388c9892b7e0749a281ac4ea67

Download Submit
C:\Windows\System\gRDJpMs.exe

Filesize
1.9MB

MD5
2f4bd0491beeb172c0748d8d3773d1e7

SHA1
e25deb22a89e1ee8c11ca6ae9f733ee8a62b10c1

SHA256
a23bd3ab6e708e4647c42f3668a46add5966ac651f18e87bde9a45cb8a7949a5

SHA512
a42112d4533f4db06eeb56a06653ac21a21cce55623862b7c38d326aeda77a7733b1c388b699d72856e3b63bd6ca2fef207d3996692f81ddf54ec3146cc499fa

Download Submit
C:\Windows\System\jsANnxe.exe

Filesize
2.0MB

MD5
ffb2990dab4c04255b04b9fb310b6224

SHA1
523bf74acdecca36b2fa478106a58c37675eb754

SHA256
a38353ccf637c8f549954cf6b91fed1202abb886227c1137aaee547316a77aec

SHA512
08bcda8c099794f994467fd9ca8e1e00c5dc7e5807f1b19bb0a5bcb50820cfc35d0796ba04c12a38f48cbd4bb47db1cdadcdedf4990e44df98a8f19c155d76e9

Download Submit
C:\Windows\System\mwjAawp.exe

Filesize
1.9MB

MD5
d705001346dc314b05e4d5b028942eeb

SHA1
f78b5c8afcceb7e45dba7d64c782a443bd1a735d

SHA256
294d6c9048f93aaf4221f64a929b3c17693a91f8087eb9b7cf67ec5ea8c934b8

SHA512
896f283a970ea891190b881220921f67347a8c0d4d830c351fa71baf3136c7ee0275261fb4bc7070825f6ed132d02e016f05027f12b419a3c3372264b1801534

Download Submit
C:\Windows\System\nddxSWg.exe

Filesize
1.9MB

MD5
ce432897f9b3a42ff8e8986e60e13d4a

SHA1
1770a4d0626db174b388c49137287ac294d3c25d

SHA256
da8c48a86253465091fcff4ba5961ed872430650369511366089bc1046a3957a

SHA512
1bdb60dafe2b88b607bf92f8b9488bf65a912b23bb96994bd64f041e0ea42b1ecde2ecebd25870c9fa69cad5bfa31269b8d8ad882a764a213c4413f643a27a8e

Download Submit
C:\Windows\System\pTjtKiy.exe

Filesize
1.9MB

MD5
1affb654cca93dff146766233d168e0f

SHA1
b4538379c54d3ba1a43cdb20bc71211a2cd05d54

SHA256
dad55c604f8e3a0cbaaec36e3850036f42dfc366072f82d52dd85870931a37c3

SHA512
34116b38192112b124491138489a33f5d550be3b2ecaab82857fdd374fc778852f1398117e0a414546da5133de4419446e8fe9bf038532ac17dc2f8789e8e6a1

Download Submit
C:\Windows\System\qjrsuUN.exe

Filesize
1.9MB

MD5
77e5e15660279832ebfaed4193fa8a27

SHA1
d437483160e5efd1fe149ccb3d2ae093e2d61a25

SHA256
c48a3f189bbc95486ccf599fded82fc14072ca3186766e39dddc4b319108267e

SHA512
a988517040a33345438d2fa36d19057993365afe2b9adadcb3dfd757fa5ae4f5f8e7e71963d8eaf4e501dc64860f92d25fdfc5c1e3ea1f78d0a8094a6d5f3259

Download Submit
C:\Windows\System\rcOTYdc.exe

Filesize
2.0MB

MD5
f86a24049aa9b01e48f6977a1f3e5d04

SHA1
bb40fb27a99e0520ee32d3bcbddd6c24ac483ecc

SHA256
f4a880c390b184ded06e23ed7a0b83d2a17a9dbcb2a33b1afe7f3bab6440d000

SHA512
d8bb4d3432487c5abce1df51f46193f1ee609df6400fde11b2e00dca8fc7b7d358b02643b1da8d531f66b6944919a69b29c0d29e0478ca7040fda6bff62cd225

Download Submit
C:\Windows\System\sawwuaI.exe

Filesize
1.9MB

MD5
b48e6e511a52e1f006a33cfde8310bd5

SHA1
4eeb4faa5ca662dcb174eaa80a978ee221503939

SHA256
acd79169e2410e3d3712c74591a0f9b3eeea98c1dcd5c6a7a9eccacb85590418

SHA512
d6cf32391e3bb60a6b649f7c202a1993a67bbd1baf1d62b9c45831d260352e0d444a6c7f0898e88c50322006503e5863f2f23469141694124886b0943555fd7d

Download Submit
C:\Windows\System\teaaEQc.exe

Filesize
1.9MB

MD5
e9aa99fc8e33f9e5f9c9e42f89f70c00

SHA1
d81874545ff3c94245a81f0ae5846fe58dd8f384

SHA256
626f790f8f4101598d1286bcf691ffd8fce691dbf924bc663eec52b6bf815cfc

SHA512
a8aa7c10b1a5859ee62374ab61ddc6d2cb4ff1a8210b17c2afb1970f0d6aed660a716dadd47e68324c140eeb57c0b54cdf099cfe47c54ebf510e9a24c8387800

Download Submit
C:\Windows\System\wIwgvUl.exe

Filesize
1.9MB

MD5
c566e379682b81e1824fff94d2f2b000

SHA1
6a786d04fbeea9c2eb3ab5f37d1ce5cbbd619433

SHA256
ec923e39459b711ba93fd9c0399a155c291d8b3aedb163f4ad2800f9c9cf3064

SHA512
6e81e5943390f270e4e33b4514008f6fb385db05f109f0081c8bfcf39227fb21fe5e8f12c7800194ea3e856e6b8b2d17f89412cd2696e8fa4814ef2228dd3738

Download Submit
C:\Windows\System\wrFNzFG.exe

Filesize
1.9MB

MD5
bb6750ed6d7954c9a1d77d8471cdcc5b

SHA1
6cdea4f24d651ad47628dcd518a44a4f91c6a75e

SHA256
d55897a0e9d40f5d28c03a64906f7e08b6f8f5b29a8ef39a10948796c851b22d

SHA512
c612be4ac359e55ffcbabf86cea36a6022aa3c9cca2fa67dbaec922fb263ace03b6e7edd16c7a83ff57603180845f3c5c7e4d748abe1459b072e06f2ad05eafe

Download Submit
C:\Windows\System\xTHXCeC.exe

Filesize
1.9MB

MD5
fd3f44d0acd6d1a56c4f5bdb73d2ea9e

SHA1
0a4b3ea4b819b58be9fa710b82411aad14e719fa

SHA256
1141ab25c5580b800eacde4224916e3b9899e4dbbc544f2a608fa4e8128e703d

SHA512
90dea3fb74339711398693deaa985b07d65fda4de4cd16190a7b46a120b3feaea740a488a7e0858959af4050c16ecba078c7d42a064e6c9700bca8944a8e0014

Download Submit
C:\Windows\System\xgFSGGk.exe

Filesize
1.9MB

MD5
46b2564c88d888a0e0631cc88bdb2788

SHA1
b3de4f4c13211db45c532924a4cd6b3c9edf57a1

SHA256
3148cb5742bad9414064c0a8eeddd2f57534cc2534f639163119b2f09fe0f4dd

SHA512
3e5519de6f0237d87830c15088bdde3a8777e98ba062470f46e4b00ab52a218dc2fa4c4048603f5071037d5b62762fce864d6470e837819b6f622f493f3e6d50

Download Submit
C:\Windows\System\xwdBcAT.exe

Filesize
1.9MB

MD5
9fc58dbd0eb50d18cabce470eabaafe1

SHA1
8e47f84b590f2e9fc82950780d5012c3fab41aaf

SHA256
02fd45793249121563e3142389b1e5a8eff7b35c3cb9b055ad07457c3b34266f

SHA512
ac7eb25e16902f38ea6b046ff60b805d85e0581952f670a135dfdd0f7c2d996f7644b79688a1766a21116b1afbbda365de812e10588137f06fad77151f160347

Download Submit
C:\Windows\System\zRRBMLL.exe

Filesize
8B

MD5
a8f2921c80c15a3d426e5fdff8a56196

SHA1
4dc21bf95e22427a9dafcd4930e81b62e77d5fda

SHA256
7e9bbeeba45dae16f8c444596ee4180d7313e899e46fa6263fde6904f32d92a1

SHA512
996666f646b1878ee129a778184f9520541ee458797b8bfaefed6e1f152a5436e0ff19d28744463b706ffe3e24e429f5af102aa1e7733dbeeb6210754c828802

Download Submit
memory/1332-207-0x00007FF769DF0000-0x00007FF76A1E2000-memory.dmp

Filesize
3.9MB

Download
memory/1332-2544-0x00007FF769DF0000-0x00007FF76A1E2000-memory.dmp

Filesize
3.9MB

Download
memory/1452-2518-0x00007FF79AA80000-0x00007FF79AE72000-memory.dmp

Filesize
3.9MB

Download
memory/1452-203-0x00007FF79AA80000-0x00007FF79AE72000-memory.dmp

Filesize
3.9MB

Download
memory/1596-193-0x00007FF7D3C50000-0x00007FF7D4042000-memory.dmp

Filesize
3.9MB

Download
memory/1596-2505-0x00007FF7D3C50000-0x00007FF7D4042000-memory.dmp

Filesize
3.9MB

Download
memory/1612-0-0x00007FF6C58A0000-0x00007FF6C5C92000-memory.dmp

Filesize
3.9MB

Download
memory/1612-1-0x00000217150B0000-0x00000217150C0000-memory.dmp

Filesize
64KB

Download
memory/1852-2496-0x00007FF7B5A40000-0x00007FF7B5E32000-memory.dmp

Filesize
3.9MB

Download
memory/1852-2502-0x00007FF7B5A40000-0x00007FF7B5E32000-memory.dmp

Filesize
3.9MB

Download
memory/1852-10-0x00007FF7B5A40000-0x00007FF7B5E32000-memory.dmp

Filesize
3.9MB

Download
memory/2028-2538-0x00007FF634120000-0x00007FF634512000-memory.dmp

Filesize
3.9MB

Download
memory/2028-205-0x00007FF634120000-0x00007FF634512000-memory.dmp

Filesize
3.9MB

Download
memory/2960-148-0x00007FF7E8130000-0x00007FF7E8522000-memory.dmp

Filesize
3.9MB

Download
memory/2960-2510-0x00007FF7E8130000-0x00007FF7E8522000-memory.dmp

Filesize
3.9MB

Download
memory/3000-197-0x00007FF74B570000-0x00007FF74B962000-memory.dmp

Filesize
3.9MB

Download
memory/3000-2542-0x00007FF74B570000-0x00007FF74B962000-memory.dmp

Filesize
3.9MB

Download
memory/3136-206-0x00007FF70B520000-0x00007FF70B912000-memory.dmp

Filesize
3.9MB

Download
memory/3136-2499-0x00007FF70B520000-0x00007FF70B912000-memory.dmp

Filesize
3.9MB

Download
memory/3160-201-0x00007FF765000000-0x00007FF7653F2000-memory.dmp

Filesize
3.9MB

Download
memory/3160-2546-0x00007FF765000000-0x00007FF7653F2000-memory.dmp

Filesize
3.9MB

Download
memory/3184-2519-0x00007FF6513F0000-0x00007FF6517E2000-memory.dmp

Filesize
3.9MB

Download
memory/3184-131-0x00007FF6513F0000-0x00007FF6517E2000-memory.dmp

Filesize
3.9MB

Download
memory/3256-208-0x00007FF6F1190000-0x00007FF6F1582000-memory.dmp

Filesize
3.9MB

Download
memory/3256-2540-0x00007FF6F1190000-0x00007FF6F1582000-memory.dmp

Filesize
3.9MB

Download
memory/3284-202-0x00007FF60F370000-0x00007FF60F762000-memory.dmp

Filesize
3.9MB

Download
memory/3284-2548-0x00007FF60F370000-0x00007FF60F762000-memory.dmp

Filesize
3.9MB

Download
memory/3584-2513-0x00007FF6B4090000-0x00007FF6B4482000-memory.dmp

Filesize
3.9MB

Download
memory/3584-89-0x00007FF6B4090000-0x00007FF6B4482000-memory.dmp

Filesize
3.9MB

Download
memory/3988-2522-0x00007FF77F300000-0x00007FF77F6F2000-memory.dmp

Filesize
3.9MB

Download
memory/3988-204-0x00007FF77F300000-0x00007FF77F6F2000-memory.dmp

Filesize
3.9MB

Download
memory/4260-2503-0x00007FF7ED6A0000-0x00007FF7EDA92000-memory.dmp

Filesize
3.9MB

Download
memory/4260-124-0x00007FF7ED6A0000-0x00007FF7EDA92000-memory.dmp

Filesize
3.9MB

Download
memory/4568-11-0x0000025FBA6B0000-0x0000025FBA6C0000-memory.dmp

Filesize
64KB

Download
memory/4568-103-0x0000025FBC050000-0x0000025FBC072000-memory.dmp

Filesize
136KB

Download
memory/4568-12-0x0000025FBA6B0000-0x0000025FBA6C0000-memory.dmp

Filesize
64KB

Download
memory/4568-73-0x00007FF825A10000-0x00007FF8264D1000-memory.dmp

Filesize
10.8MB

Download
memory/4708-2512-0x00007FF682730000-0x00007FF682B22000-memory.dmp

Filesize
3.9MB

Download
memory/4708-158-0x00007FF682730000-0x00007FF682B22000-memory.dmp

Filesize
3.9MB

Download
memory/4744-176-0x00007FF79CDA0000-0x00007FF79D192000-memory.dmp

Filesize
3.9MB

Download
memory/4744-2525-0x00007FF79CDA0000-0x00007FF79D192000-memory.dmp

Filesize
3.9MB

Download
memory/4752-2527-0x00007FF71E090000-0x00007FF71E482000-memory.dmp

Filesize
3.9MB

Download
memory/4752-194-0x00007FF71E090000-0x00007FF71E482000-memory.dmp

Filesize
3.9MB

Download
memory/4788-2516-0x00007FF6D72C0000-0x00007FF6D76B2000-memory.dmp

Filesize
3.9MB

Download
memory/4788-200-0x00007FF6D72C0000-0x00007FF6D76B2000-memory.dmp

Filesize
3.9MB

Download
memory/5048-2507-0x00007FF7BA910000-0x00007FF7BAD02000-memory.dmp

Filesize
3.9MB

Download
memory/5048-188-0x00007FF7BA910000-0x00007FF7BAD02000-memory.dmp

Filesize
3.9MB

Download
memory/5060-2523-0x00007FF7917C0000-0x00007FF791BB2000-memory.dmp

Filesize
3.9MB

Download
memory/5060-199-0x00007FF7917C0000-0x00007FF791BB2000-memory.dmp

Filesize
3.9MB

Download