xmrig | b4baf991c7202c291c2416d75d4347b7cd2f0bc69a881f0520b5c739fe4c963d

Analysis

max time kernel
134s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 23:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
Size

1.8MB
MD5

065bf697e2be3b30502ac4a40e0a8eff
SHA1

bb4b76f5045c3b858de2b778fc115902bf3a2d16
SHA256

b4baf991c7202c291c2416d75d4347b7cd2f0bc69a881f0520b5c739fe4c963d
SHA512

d627aaabd6c5dbcfe32b482de19dc2eede3754593bf02585291be160b0f3e50deb85f969b1bd0e52012b23ee3947a15392ec2afbcc120c03290b34cecc64abf5
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlM:NABN

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/3564-15-0x00007FF684540000-0x00007FF684932000-memory.dmp	xmrig
behavioral2/memory/1348-97-0x00007FF7E1330000-0x00007FF7E1722000-memory.dmp	xmrig
behavioral2/memory/2944-98-0x00007FF61A240000-0x00007FF61A632000-memory.dmp	xmrig
behavioral2/memory/2888-101-0x00007FF7D4C80000-0x00007FF7D5072000-memory.dmp	xmrig
behavioral2/memory/2968-107-0x00007FF7257F0000-0x00007FF725BE2000-memory.dmp	xmrig
behavioral2/memory/4564-2023-0x00007FF6D9630000-0x00007FF6D9A22000-memory.dmp	xmrig
behavioral2/memory/3520-335-0x00007FF633840000-0x00007FF633C32000-memory.dmp	xmrig
behavioral2/memory/1808-273-0x00007FF6959E0000-0x00007FF695DD2000-memory.dmp	xmrig
behavioral2/memory/2328-232-0x00007FF712010000-0x00007FF712402000-memory.dmp	xmrig
behavioral2/memory/4684-71-0x00007FF611F90000-0x00007FF612382000-memory.dmp	xmrig
behavioral2/memory/3540-2095-0x00007FF6E54A0000-0x00007FF6E5892000-memory.dmp	xmrig
behavioral2/memory/4688-2120-0x00007FF651250000-0x00007FF651642000-memory.dmp	xmrig
behavioral2/memory/3132-2121-0x00007FF7FFA90000-0x00007FF7FFE82000-memory.dmp	xmrig
behavioral2/memory/2732-2122-0x00007FF7E9B40000-0x00007FF7E9F32000-memory.dmp	xmrig
behavioral2/memory/4108-2123-0x00007FF639980000-0x00007FF639D72000-memory.dmp	xmrig
behavioral2/memory/5008-2132-0x00007FF79E510000-0x00007FF79E902000-memory.dmp	xmrig
behavioral2/memory/1172-2133-0x00007FF739880000-0x00007FF739C72000-memory.dmp	xmrig
behavioral2/memory/1672-2134-0x00007FF685CE0000-0x00007FF6860D2000-memory.dmp	xmrig
behavioral2/memory/3256-2135-0x00007FF7F53A0000-0x00007FF7F5792000-memory.dmp	xmrig
behavioral2/memory/5032-2137-0x00007FF7806B0000-0x00007FF780AA2000-memory.dmp	xmrig
behavioral2/memory/2224-2136-0x00007FF7FDF40000-0x00007FF7FE332000-memory.dmp	xmrig
behavioral2/memory/3964-2138-0x00007FF71B3C0000-0x00007FF71B7B2000-memory.dmp	xmrig
behavioral2/memory/860-2164-0x00007FF795720000-0x00007FF795B12000-memory.dmp	xmrig
behavioral2/memory/1180-2165-0x00007FF713580000-0x00007FF713972000-memory.dmp	xmrig
behavioral2/memory/4656-2163-0x00007FF674120000-0x00007FF674512000-memory.dmp	xmrig
behavioral2/memory/3564-2167-0x00007FF684540000-0x00007FF684932000-memory.dmp	xmrig
behavioral2/memory/3540-2172-0x00007FF6E54A0000-0x00007FF6E5892000-memory.dmp	xmrig
behavioral2/memory/4688-2171-0x00007FF651250000-0x00007FF651642000-memory.dmp	xmrig
behavioral2/memory/3132-2177-0x00007FF7FFA90000-0x00007FF7FFE82000-memory.dmp	xmrig
behavioral2/memory/2944-2180-0x00007FF61A240000-0x00007FF61A632000-memory.dmp	xmrig
behavioral2/memory/1348-2182-0x00007FF7E1330000-0x00007FF7E1722000-memory.dmp	xmrig
behavioral2/memory/4684-2175-0x00007FF611F90000-0x00007FF612382000-memory.dmp	xmrig
behavioral2/memory/2732-2178-0x00007FF7E9B40000-0x00007FF7E9F32000-memory.dmp	xmrig
behavioral2/memory/2888-2186-0x00007FF7D4C80000-0x00007FF7D5072000-memory.dmp	xmrig
behavioral2/memory/2968-2185-0x00007FF7257F0000-0x00007FF725BE2000-memory.dmp	xmrig
behavioral2/memory/1672-2188-0x00007FF685CE0000-0x00007FF6860D2000-memory.dmp	xmrig
behavioral2/memory/3964-2190-0x00007FF71B3C0000-0x00007FF71B7B2000-memory.dmp	xmrig
behavioral2/memory/5008-2195-0x00007FF79E510000-0x00007FF79E902000-memory.dmp	xmrig
behavioral2/memory/2328-2198-0x00007FF712010000-0x00007FF712402000-memory.dmp	xmrig
behavioral2/memory/2224-2202-0x00007FF7FDF40000-0x00007FF7FE332000-memory.dmp	xmrig
behavioral2/memory/3256-2200-0x00007FF7F53A0000-0x00007FF7F5792000-memory.dmp	xmrig
behavioral2/memory/1172-2197-0x00007FF739880000-0x00007FF739C72000-memory.dmp	xmrig
behavioral2/memory/4108-2193-0x00007FF639980000-0x00007FF639D72000-memory.dmp	xmrig
behavioral2/memory/4656-2207-0x00007FF674120000-0x00007FF674512000-memory.dmp	xmrig
behavioral2/memory/5032-2209-0x00007FF7806B0000-0x00007FF780AA2000-memory.dmp	xmrig
behavioral2/memory/1180-2206-0x00007FF713580000-0x00007FF713972000-memory.dmp	xmrig
behavioral2/memory/1808-2212-0x00007FF6959E0000-0x00007FF695DD2000-memory.dmp	xmrig
behavioral2/memory/860-2217-0x00007FF795720000-0x00007FF795B12000-memory.dmp	xmrig
behavioral2/memory/3520-2228-0x00007FF633840000-0x00007FF633C32000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3564	WVgzDXT.exe
3540	ldeICaB.exe
4688	iZEDrNK.exe
3132	BBWSkJY.exe
2732	qzygjGL.exe
4684	xfvhSJR.exe
1348	sphBgQi.exe
4108	jfkrBml.exe
2944	MOwUkUl.exe
3964	zIrTchW.exe
5008	TdKZiwV.exe
1172	dqLyKGa.exe
2888	pDnuPzo.exe
2968	nkAAozz.exe
1672	ZlBIoxp.exe
3256	ZkacjPm.exe
2224	uJyIxMn.exe
5032	tsetmWu.exe
4656	haqxmND.exe
860	sZUGGfs.exe
1180	gkgsVgI.exe
2328	lIXIiZj.exe
1808	FNJUpwL.exe
3520	XAiwwjb.exe
4936	CzGsHHx.exe
4780	QRJqRVk.exe
1916	LHVbmFN.exe
4632	rzyriRQ.exe
4724	iNCdeDp.exe
1928	KsRUXWc.exe
4004	sGzWsyj.exe
1912	OrilNCU.exe
4592	kCjUnNK.exe
2852	zntmbEp.exe
732	FcDMvJB.exe
60	IANaRBs.exe
2568	cHNXYLl.exe
916	tOCGLuQ.exe
4204	jFFCsAf.exe
640	NfgcWre.exe
2312	vSkklFK.exe
4076	nrQprrD.exe
3248	gDbHUUp.exe
752	PeGlbdx.exe
3268	yKupSHR.exe
2884	llTGICL.exe
4348	CbJsXdF.exe
4444	WQnDALR.exe
4744	quShqsZ.exe
3500	OKaXJOI.exe
1496	YPIENdM.exe
844	ADwFpom.exe
4548	nBEwfln.exe
540	tiZwLiS.exe
3956	FYqOGcw.exe
1652	HmkrJcZ.exe
4404	yQeoLwK.exe
1152	xFGjIBa.exe
2244	OXiKsub.exe
1340	HKJeNjX.exe
4708	sLslMRL.exe
2904	bilAXmd.exe
1636	oUUNIZF.exe
5012	DDMhDeZ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4564-0-0x00007FF6D9630000-0x00007FF6D9A22000-memory.dmp	upx
behavioral2/files/0x000800000002343a-6.dat	upx
behavioral2/files/0x0008000000023440-8.dat	upx
behavioral2/memory/3564-15-0x00007FF684540000-0x00007FF684932000-memory.dmp	upx
behavioral2/memory/3540-17-0x00007FF6E54A0000-0x00007FF6E5892000-memory.dmp	upx
behavioral2/files/0x0007000000023441-28.dat	upx
behavioral2/memory/3132-32-0x00007FF7FFA90000-0x00007FF7FFE82000-memory.dmp	upx
behavioral2/files/0x0007000000023443-37.dat	upx
behavioral2/files/0x0007000000023444-62.dat	upx
behavioral2/files/0x0007000000023448-73.dat	upx
behavioral2/memory/1348-97-0x00007FF7E1330000-0x00007FF7E1722000-memory.dmp	upx
behavioral2/memory/2944-98-0x00007FF61A240000-0x00007FF61A632000-memory.dmp	upx
behavioral2/memory/1172-100-0x00007FF739880000-0x00007FF739C72000-memory.dmp	upx
behavioral2/memory/2888-101-0x00007FF7D4C80000-0x00007FF7D5072000-memory.dmp	upx
behavioral2/memory/1672-102-0x00007FF685CE0000-0x00007FF6860D2000-memory.dmp	upx
behavioral2/memory/5032-105-0x00007FF7806B0000-0x00007FF780AA2000-memory.dmp	upx
behavioral2/memory/2968-107-0x00007FF7257F0000-0x00007FF725BE2000-memory.dmp	upx
behavioral2/memory/3964-106-0x00007FF71B3C0000-0x00007FF71B7B2000-memory.dmp	upx
behavioral2/files/0x0007000000023450-141.dat	upx
behavioral2/files/0x0007000000023451-145.dat	upx
behavioral2/files/0x000800000002343e-171.dat	upx
behavioral2/files/0x0007000000023465-217.dat	upx
behavioral2/memory/4564-2023-0x00007FF6D9630000-0x00007FF6D9A22000-memory.dmp	upx
behavioral2/memory/3520-335-0x00007FF633840000-0x00007FF633C32000-memory.dmp	upx
behavioral2/memory/1808-273-0x00007FF6959E0000-0x00007FF695DD2000-memory.dmp	upx
behavioral2/memory/2328-232-0x00007FF712010000-0x00007FF712402000-memory.dmp	upx
behavioral2/memory/1180-226-0x00007FF713580000-0x00007FF713972000-memory.dmp	upx
behavioral2/files/0x0007000000023464-213.dat	upx
behavioral2/files/0x0007000000023455-208.dat	upx
behavioral2/files/0x0007000000023463-204.dat	upx
behavioral2/files/0x0007000000023459-201.dat	upx
behavioral2/files/0x0007000000023453-197.dat	upx
behavioral2/files/0x0007000000023462-196.dat	upx
behavioral2/files/0x0007000000023457-195.dat	upx
behavioral2/memory/860-190-0x00007FF795720000-0x00007FF795B12000-memory.dmp	upx
behavioral2/files/0x0007000000023452-188.dat	upx
behavioral2/files/0x0007000000023461-183.dat	upx
behavioral2/files/0x0007000000023460-180.dat	upx
behavioral2/files/0x000700000002345f-178.dat	upx
behavioral2/files/0x000700000002345e-170.dat	upx
behavioral2/files/0x000700000002345d-169.dat	upx
behavioral2/files/0x000700000002345c-166.dat	upx
behavioral2/files/0x000700000002345b-165.dat	upx
behavioral2/files/0x000700000002345a-164.dat	upx
behavioral2/memory/4656-155-0x00007FF674120000-0x00007FF674512000-memory.dmp	upx
behavioral2/files/0x0007000000023456-152.dat	upx
behavioral2/files/0x0007000000023454-125.dat	upx
behavioral2/files/0x000700000002344c-121.dat	upx
behavioral2/files/0x0007000000023458-157.dat	upx
behavioral2/files/0x0007000000023445-111.dat	upx
behavioral2/files/0x000700000002344f-137.dat	upx
behavioral2/files/0x000700000002344b-133.dat	upx
behavioral2/files/0x000700000002344a-129.dat	upx
behavioral2/files/0x0007000000023449-114.dat	upx
behavioral2/memory/2224-104-0x00007FF7FDF40000-0x00007FF7FE332000-memory.dmp	upx
behavioral2/memory/3256-103-0x00007FF7F53A0000-0x00007FF7F5792000-memory.dmp	upx
behavioral2/memory/5008-99-0x00007FF79E510000-0x00007FF79E902000-memory.dmp	upx
behavioral2/files/0x000700000002344e-96.dat	upx
behavioral2/files/0x0007000000023446-94.dat	upx
behavioral2/files/0x000700000002344d-84.dat	upx
behavioral2/memory/4684-71-0x00007FF611F90000-0x00007FF612382000-memory.dmp	upx
behavioral2/files/0x0007000000023447-54.dat	upx
behavioral2/memory/4108-44-0x00007FF639980000-0x00007FF639D72000-memory.dmp	upx
behavioral2/files/0x0007000000023442-41.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\TZJgmVd.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\RBfzIWn.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\XqVKfqH.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\xKmhXiy.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\PggDeeJ.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\kMMXQho.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\ztyoCqy.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\tBLkgbW.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\wxLDMxf.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\khvUfyE.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\xEBPbVy.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\zbIiLHg.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\rprogvV.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\JInmGDO.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\jMvafru.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\vBFYYVz.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\OqhWbgg.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\jFFCsAf.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\PXYFvfY.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\PxsOIKV.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\GOfQQUj.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\BKeefdG.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\MOjNRHB.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\AltwzuW.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\WmhIGBu.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\ONUjvWK.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\BOUqHNz.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\ODuShKT.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\rNGQsgZ.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\GwHKrOE.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\zJtdvOq.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\lIdnhfk.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\NHphPiP.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\cdKIrXT.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\YjwwPik.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\yKupSHR.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\oUUNIZF.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\cGBjJof.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\BbEVhFB.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\NkLIyhE.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\iZEDrNK.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\zDwPEWv.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\JcpJkYl.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\ZmlEPxB.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\JwPnzwq.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\bJooLpd.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\ZkacjPm.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\CzGsHHx.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\weAWhWE.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\VhVZxcH.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\yUralYj.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\QUllEFS.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\IIodkPU.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\OZQsltx.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\ryGFBON.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\ytHUXqO.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\tFRNiHm.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\RuLkpnB.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\QWicIFg.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\LlyzrXs.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\zBoeOgP.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\nrQprrD.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\kGXFiTF.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\KJKIrJE.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2176	powershell.exe
2176	powershell.exe
2176	powershell.exe
2176	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
Token: SeDebugPrivilege	2176	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 2176	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	85
PID 4564 wrote to memory of 2176	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	85
PID 4564 wrote to memory of 3564	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	86
PID 4564 wrote to memory of 3564	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	86
PID 4564 wrote to memory of 3540	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	87
PID 4564 wrote to memory of 3540	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	87
PID 4564 wrote to memory of 3132	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	88
PID 4564 wrote to memory of 3132	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	88
PID 4564 wrote to memory of 4688	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	89
PID 4564 wrote to memory of 4688	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	89
PID 4564 wrote to memory of 2732	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	90
PID 4564 wrote to memory of 2732	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	90
PID 4564 wrote to memory of 4684	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	91
PID 4564 wrote to memory of 4684	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	91
PID 4564 wrote to memory of 1348	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	92
PID 4564 wrote to memory of 1348	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	92
PID 4564 wrote to memory of 4108	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	93
PID 4564 wrote to memory of 4108	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	93
PID 4564 wrote to memory of 3964	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	94
PID 4564 wrote to memory of 3964	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	94
PID 4564 wrote to memory of 2944	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	95
PID 4564 wrote to memory of 2944	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	95
PID 4564 wrote to memory of 2888	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	96
PID 4564 wrote to memory of 2888	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	96
PID 4564 wrote to memory of 5008	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	97
PID 4564 wrote to memory of 5008	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	97
PID 4564 wrote to memory of 1172	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	98
PID 4564 wrote to memory of 1172	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	98
PID 4564 wrote to memory of 3256	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	99
PID 4564 wrote to memory of 3256	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	99
PID 4564 wrote to memory of 860	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	100
PID 4564 wrote to memory of 860	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	100
PID 4564 wrote to memory of 2968	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	101
PID 4564 wrote to memory of 2968	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	101
PID 4564 wrote to memory of 1672	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	102
PID 4564 wrote to memory of 1672	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	102
PID 4564 wrote to memory of 2224	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	103
PID 4564 wrote to memory of 2224	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	103
PID 4564 wrote to memory of 5032	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	104
PID 4564 wrote to memory of 5032	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	104
PID 4564 wrote to memory of 3520	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	105
PID 4564 wrote to memory of 3520	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	105
PID 4564 wrote to memory of 4656	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	106
PID 4564 wrote to memory of 4656	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	106
PID 4564 wrote to memory of 1180	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	107
PID 4564 wrote to memory of 1180	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	107
PID 4564 wrote to memory of 2328	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	108
PID 4564 wrote to memory of 2328	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	108
PID 4564 wrote to memory of 1808	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	109
PID 4564 wrote to memory of 1808	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	109
PID 4564 wrote to memory of 4936	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	110
PID 4564 wrote to memory of 4936	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	110
PID 4564 wrote to memory of 2568	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	111
PID 4564 wrote to memory of 2568	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	111
PID 4564 wrote to memory of 4780	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	112
PID 4564 wrote to memory of 4780	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	112
PID 4564 wrote to memory of 1916	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	113
PID 4564 wrote to memory of 1916	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	113
PID 4564 wrote to memory of 4632	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	114
PID 4564 wrote to memory of 4632	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	114
PID 4564 wrote to memory of 4724	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	115
PID 4564 wrote to memory of 4724	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	115
PID 4564 wrote to memory of 1928	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	116
PID 4564 wrote to memory of 1928	4564	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2176
- C:\Windows\System\WVgzDXT.exe
  C:\Windows\System\WVgzDXT.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\ldeICaB.exe
  C:\Windows\System\ldeICaB.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\BBWSkJY.exe
  C:\Windows\System\BBWSkJY.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\iZEDrNK.exe
  C:\Windows\System\iZEDrNK.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\qzygjGL.exe
  C:\Windows\System\qzygjGL.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\xfvhSJR.exe
  C:\Windows\System\xfvhSJR.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\sphBgQi.exe
  C:\Windows\System\sphBgQi.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\jfkrBml.exe
  C:\Windows\System\jfkrBml.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\zIrTchW.exe
  C:\Windows\System\zIrTchW.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\MOwUkUl.exe
  C:\Windows\System\MOwUkUl.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\pDnuPzo.exe
  C:\Windows\System\pDnuPzo.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\TdKZiwV.exe
  C:\Windows\System\TdKZiwV.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\dqLyKGa.exe
  C:\Windows\System\dqLyKGa.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\ZkacjPm.exe
  C:\Windows\System\ZkacjPm.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\sZUGGfs.exe
  C:\Windows\System\sZUGGfs.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\nkAAozz.exe
  C:\Windows\System\nkAAozz.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\ZlBIoxp.exe
  C:\Windows\System\ZlBIoxp.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\uJyIxMn.exe
  C:\Windows\System\uJyIxMn.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\tsetmWu.exe
  C:\Windows\System\tsetmWu.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\XAiwwjb.exe
  C:\Windows\System\XAiwwjb.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\haqxmND.exe
  C:\Windows\System\haqxmND.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\gkgsVgI.exe
  C:\Windows\System\gkgsVgI.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\lIXIiZj.exe
  C:\Windows\System\lIXIiZj.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\FNJUpwL.exe
  C:\Windows\System\FNJUpwL.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\CzGsHHx.exe
  C:\Windows\System\CzGsHHx.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\cHNXYLl.exe
  C:\Windows\System\cHNXYLl.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\QRJqRVk.exe
  C:\Windows\System\QRJqRVk.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\LHVbmFN.exe
  C:\Windows\System\LHVbmFN.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\rzyriRQ.exe
  C:\Windows\System\rzyriRQ.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\iNCdeDp.exe
  C:\Windows\System\iNCdeDp.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\KsRUXWc.exe
  C:\Windows\System\KsRUXWc.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\sGzWsyj.exe
  C:\Windows\System\sGzWsyj.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\OrilNCU.exe
  C:\Windows\System\OrilNCU.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\kCjUnNK.exe
  C:\Windows\System\kCjUnNK.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\zntmbEp.exe
  C:\Windows\System\zntmbEp.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\FcDMvJB.exe
  C:\Windows\System\FcDMvJB.exe
  2⤵
  - Executes dropped EXE
  PID:732
- C:\Windows\System\IANaRBs.exe
  C:\Windows\System\IANaRBs.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\tOCGLuQ.exe
  C:\Windows\System\tOCGLuQ.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\jFFCsAf.exe
  C:\Windows\System\jFFCsAf.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\NfgcWre.exe
  C:\Windows\System\NfgcWre.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\vSkklFK.exe
  C:\Windows\System\vSkklFK.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\nrQprrD.exe
  C:\Windows\System\nrQprrD.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\gDbHUUp.exe
  C:\Windows\System\gDbHUUp.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\PeGlbdx.exe
  C:\Windows\System\PeGlbdx.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\yKupSHR.exe
  C:\Windows\System\yKupSHR.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\llTGICL.exe
  C:\Windows\System\llTGICL.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\CbJsXdF.exe
  C:\Windows\System\CbJsXdF.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\WQnDALR.exe
  C:\Windows\System\WQnDALR.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\quShqsZ.exe
  C:\Windows\System\quShqsZ.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\OKaXJOI.exe
  C:\Windows\System\OKaXJOI.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\YPIENdM.exe
  C:\Windows\System\YPIENdM.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\ADwFpom.exe
  C:\Windows\System\ADwFpom.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\nBEwfln.exe
  C:\Windows\System\nBEwfln.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\tiZwLiS.exe
  C:\Windows\System\tiZwLiS.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\FYqOGcw.exe
  C:\Windows\System\FYqOGcw.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\HmkrJcZ.exe
  C:\Windows\System\HmkrJcZ.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\yQeoLwK.exe
  C:\Windows\System\yQeoLwK.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\xFGjIBa.exe
  C:\Windows\System\xFGjIBa.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\OXiKsub.exe
  C:\Windows\System\OXiKsub.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\HKJeNjX.exe
  C:\Windows\System\HKJeNjX.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\sLslMRL.exe
  C:\Windows\System\sLslMRL.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\bilAXmd.exe
  C:\Windows\System\bilAXmd.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\oUUNIZF.exe
  C:\Windows\System\oUUNIZF.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\DDMhDeZ.exe
  C:\Windows\System\DDMhDeZ.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\lnZOPnA.exe
  C:\Windows\System\lnZOPnA.exe
  2⤵
  PID:4700
- C:\Windows\System\wJwUDHh.exe
  C:\Windows\System\wJwUDHh.exe
  2⤵
  PID:1296
- C:\Windows\System\uTeBduU.exe
  C:\Windows\System\uTeBduU.exe
  2⤵
  PID:1256
- C:\Windows\System\HNqjAqX.exe
  C:\Windows\System\HNqjAqX.exe
  2⤵
  PID:4220
- C:\Windows\System\qNLqOtZ.exe
  C:\Windows\System\qNLqOtZ.exe
  2⤵
  PID:1464
- C:\Windows\System\vEjeCOV.exe
  C:\Windows\System\vEjeCOV.exe
  2⤵
  PID:2356
- C:\Windows\System\nJKYXQO.exe
  C:\Windows\System\nJKYXQO.exe
  2⤵
  PID:212
- C:\Windows\System\lvKuMlz.exe
  C:\Windows\System\lvKuMlz.exe
  2⤵
  PID:3800
- C:\Windows\System\nHNNkXd.exe
  C:\Windows\System\nHNNkXd.exe
  2⤵
  PID:2396
- C:\Windows\System\YjkCRtk.exe
  C:\Windows\System\YjkCRtk.exe
  2⤵
  PID:3200
- C:\Windows\System\zIlFAjW.exe
  C:\Windows\System\zIlFAjW.exe
  2⤵
  PID:2956
- C:\Windows\System\pjResAI.exe
  C:\Windows\System\pjResAI.exe
  2⤵
  PID:5144
- C:\Windows\System\krJPQfB.exe
  C:\Windows\System\krJPQfB.exe
  2⤵
  PID:5168
- C:\Windows\System\zMNXPxf.exe
  C:\Windows\System\zMNXPxf.exe
  2⤵
  PID:5208
- C:\Windows\System\zbIiLHg.exe
  C:\Windows\System\zbIiLHg.exe
  2⤵
  PID:5236
- C:\Windows\System\ryGFBON.exe
  C:\Windows\System\ryGFBON.exe
  2⤵
  PID:5260
- C:\Windows\System\bawamXi.exe
  C:\Windows\System\bawamXi.exe
  2⤵
  PID:5280
- C:\Windows\System\MXMUfcq.exe
  C:\Windows\System\MXMUfcq.exe
  2⤵
  PID:5308
- C:\Windows\System\ieYJmRW.exe
  C:\Windows\System\ieYJmRW.exe
  2⤵
  PID:5328
- C:\Windows\System\ZxxahtW.exe
  C:\Windows\System\ZxxahtW.exe
  2⤵
  PID:5352
- C:\Windows\System\iSqWxHm.exe
  C:\Windows\System\iSqWxHm.exe
  2⤵
  PID:5396
- C:\Windows\System\pXdpPLt.exe
  C:\Windows\System\pXdpPLt.exe
  2⤵
  PID:5412
- C:\Windows\System\oDiEzdo.exe
  C:\Windows\System\oDiEzdo.exe
  2⤵
  PID:5436
- C:\Windows\System\lQvqUGU.exe
  C:\Windows\System\lQvqUGU.exe
  2⤵
  PID:5456
- C:\Windows\System\XdqKOxx.exe
  C:\Windows\System\XdqKOxx.exe
  2⤵
  PID:5476
- C:\Windows\System\fUSmTkc.exe
  C:\Windows\System\fUSmTkc.exe
  2⤵
  PID:5496
- C:\Windows\System\FWDhcpm.exe
  C:\Windows\System\FWDhcpm.exe
  2⤵
  PID:5516
- C:\Windows\System\VgyguFU.exe
  C:\Windows\System\VgyguFU.exe
  2⤵
  PID:5540
- C:\Windows\System\kLnfEpB.exe
  C:\Windows\System\kLnfEpB.exe
  2⤵
  PID:5556
- C:\Windows\System\xIUMUpf.exe
  C:\Windows\System\xIUMUpf.exe
  2⤵
  PID:5580
- C:\Windows\System\AAObNBc.exe
  C:\Windows\System\AAObNBc.exe
  2⤵
  PID:5600
- C:\Windows\System\FFQWgDr.exe
  C:\Windows\System\FFQWgDr.exe
  2⤵
  PID:5616
- C:\Windows\System\mcIFSab.exe
  C:\Windows\System\mcIFSab.exe
  2⤵
  PID:5636
- C:\Windows\System\ZBHKTuC.exe
  C:\Windows\System\ZBHKTuC.exe
  2⤵
  PID:5660
- C:\Windows\System\GwHKrOE.exe
  C:\Windows\System\GwHKrOE.exe
  2⤵
  PID:5676
- C:\Windows\System\erbpKtg.exe
  C:\Windows\System\erbpKtg.exe
  2⤵
  PID:5696
- C:\Windows\System\IjLINLC.exe
  C:\Windows\System\IjLINLC.exe
  2⤵
  PID:5716
- C:\Windows\System\biosVfW.exe
  C:\Windows\System\biosVfW.exe
  2⤵
  PID:5740
- C:\Windows\System\JFtohZE.exe
  C:\Windows\System\JFtohZE.exe
  2⤵
  PID:5780
- C:\Windows\System\wPlAInn.exe
  C:\Windows\System\wPlAInn.exe
  2⤵
  PID:5800
- C:\Windows\System\WxUZNIV.exe
  C:\Windows\System\WxUZNIV.exe
  2⤵
  PID:5832
- C:\Windows\System\XpMTxSQ.exe
  C:\Windows\System\XpMTxSQ.exe
  2⤵
  PID:5852
- C:\Windows\System\WKMRiyg.exe
  C:\Windows\System\WKMRiyg.exe
  2⤵
  PID:5904
- C:\Windows\System\PMQQEnY.exe
  C:\Windows\System\PMQQEnY.exe
  2⤵
  PID:5924
- C:\Windows\System\rCGXOgC.exe
  C:\Windows\System\rCGXOgC.exe
  2⤵
  PID:5948
- C:\Windows\System\JxhLLGM.exe
  C:\Windows\System\JxhLLGM.exe
  2⤵
  PID:5968
- C:\Windows\System\lTdoxwr.exe
  C:\Windows\System\lTdoxwr.exe
  2⤵
  PID:5996
- C:\Windows\System\abcQKRI.exe
  C:\Windows\System\abcQKRI.exe
  2⤵
  PID:6012
- C:\Windows\System\JZhsBOc.exe
  C:\Windows\System\JZhsBOc.exe
  2⤵
  PID:6036
- C:\Windows\System\ofHkVLO.exe
  C:\Windows\System\ofHkVLO.exe
  2⤵
  PID:6052
- C:\Windows\System\HloWksk.exe
  C:\Windows\System\HloWksk.exe
  2⤵
  PID:6076
- C:\Windows\System\SFUXctr.exe
  C:\Windows\System\SFUXctr.exe
  2⤵
  PID:6100
- C:\Windows\System\HiNALtH.exe
  C:\Windows\System\HiNALtH.exe
  2⤵
  PID:6120
- C:\Windows\System\SogOOJI.exe
  C:\Windows\System\SogOOJI.exe
  2⤵
  PID:1856
- C:\Windows\System\vAQFaJt.exe
  C:\Windows\System\vAQFaJt.exe
  2⤵
  PID:4040
- C:\Windows\System\MMBsvOx.exe
  C:\Windows\System\MMBsvOx.exe
  2⤵
  PID:1972
- C:\Windows\System\VadFJuC.exe
  C:\Windows\System\VadFJuC.exe
  2⤵
  PID:2848
- C:\Windows\System\cPXewtK.exe
  C:\Windows\System\cPXewtK.exe
  2⤵
  PID:4664
- C:\Windows\System\GxcVPYG.exe
  C:\Windows\System\GxcVPYG.exe
  2⤵
  PID:2484
- C:\Windows\System\XPZhlJq.exe
  C:\Windows\System\XPZhlJq.exe
  2⤵
  PID:1720
- C:\Windows\System\TqMvtBP.exe
  C:\Windows\System\TqMvtBP.exe
  2⤵
  PID:3588
- C:\Windows\System\UaDKFln.exe
  C:\Windows\System\UaDKFln.exe
  2⤵
  PID:780
- C:\Windows\System\zqyVcnX.exe
  C:\Windows\System\zqyVcnX.exe
  2⤵
  PID:4728
- C:\Windows\System\rslRzGm.exe
  C:\Windows\System\rslRzGm.exe
  2⤵
  PID:668
- C:\Windows\System\dyAeiKy.exe
  C:\Windows\System\dyAeiKy.exe
  2⤵
  PID:4328
- C:\Windows\System\fGubqkQ.exe
  C:\Windows\System\fGubqkQ.exe
  2⤵
  PID:5220
- C:\Windows\System\DLvjoAF.exe
  C:\Windows\System\DLvjoAF.exe
  2⤵
  PID:5244
- C:\Windows\System\weAWhWE.exe
  C:\Windows\System\weAWhWE.exe
  2⤵
  PID:5272
- C:\Windows\System\GCJTneg.exe
  C:\Windows\System\GCJTneg.exe
  2⤵
  PID:5820
- C:\Windows\System\dNFRlmi.exe
  C:\Windows\System\dNFRlmi.exe
  2⤵
  PID:5344
- C:\Windows\System\IhNtUXP.exe
  C:\Windows\System\IhNtUXP.exe
  2⤵
  PID:3856
- C:\Windows\System\yacANdb.exe
  C:\Windows\System\yacANdb.exe
  2⤵
  PID:5536
- C:\Windows\System\kGhgTTw.exe
  C:\Windows\System\kGhgTTw.exe
  2⤵
  PID:5588
- C:\Windows\System\DLkgczy.exe
  C:\Windows\System\DLkgczy.exe
  2⤵
  PID:5132
- C:\Windows\System\MUaLKHP.exe
  C:\Windows\System\MUaLKHP.exe
  2⤵
  PID:5136
- C:\Windows\System\zhCMgjW.exe
  C:\Windows\System\zhCMgjW.exe
  2⤵
  PID:5164
- C:\Windows\System\uzHHDoG.exe
  C:\Windows\System\uzHHDoG.exe
  2⤵
  PID:6148
- C:\Windows\System\SlLrxKA.exe
  C:\Windows\System\SlLrxKA.exe
  2⤵
  PID:6184
- C:\Windows\System\ntBLCCc.exe
  C:\Windows\System\ntBLCCc.exe
  2⤵
  PID:6204
- C:\Windows\System\OPHKHqG.exe
  C:\Windows\System\OPHKHqG.exe
  2⤵
  PID:6224
- C:\Windows\System\enpSyIY.exe
  C:\Windows\System\enpSyIY.exe
  2⤵
  PID:6244
- C:\Windows\System\sEOeZVH.exe
  C:\Windows\System\sEOeZVH.exe
  2⤵
  PID:6264
- C:\Windows\System\LbmFbsk.exe
  C:\Windows\System\LbmFbsk.exe
  2⤵
  PID:6288
- C:\Windows\System\khtxOhB.exe
  C:\Windows\System\khtxOhB.exe
  2⤵
  PID:6312
- C:\Windows\System\mwfOhKT.exe
  C:\Windows\System\mwfOhKT.exe
  2⤵
  PID:6376
- C:\Windows\System\HjFnoGN.exe
  C:\Windows\System\HjFnoGN.exe
  2⤵
  PID:6392
- C:\Windows\System\BeMVrvm.exe
  C:\Windows\System\BeMVrvm.exe
  2⤵
  PID:6416
- C:\Windows\System\kqZQxJz.exe
  C:\Windows\System\kqZQxJz.exe
  2⤵
  PID:6440
- C:\Windows\System\wfgpkRZ.exe
  C:\Windows\System\wfgpkRZ.exe
  2⤵
  PID:6464
- C:\Windows\System\dPfUnXR.exe
  C:\Windows\System\dPfUnXR.exe
  2⤵
  PID:6488
- C:\Windows\System\ZmlEPxB.exe
  C:\Windows\System\ZmlEPxB.exe
  2⤵
  PID:6512
- C:\Windows\System\UBGeaTM.exe
  C:\Windows\System\UBGeaTM.exe
  2⤵
  PID:6528
- C:\Windows\System\QBlQTBt.exe
  C:\Windows\System\QBlQTBt.exe
  2⤵
  PID:6548
- C:\Windows\System\gnBdCFi.exe
  C:\Windows\System\gnBdCFi.exe
  2⤵
  PID:6564
- C:\Windows\System\EhSYvbk.exe
  C:\Windows\System\EhSYvbk.exe
  2⤵
  PID:6596
- C:\Windows\System\xnECZZh.exe
  C:\Windows\System\xnECZZh.exe
  2⤵
  PID:6620
- C:\Windows\System\yiduuTz.exe
  C:\Windows\System\yiduuTz.exe
  2⤵
  PID:6640
- C:\Windows\System\hSImEsA.exe
  C:\Windows\System\hSImEsA.exe
  2⤵
  PID:6960
- C:\Windows\System\pzZqoVg.exe
  C:\Windows\System\pzZqoVg.exe
  2⤵
  PID:6976
- C:\Windows\System\sCFEBQX.exe
  C:\Windows\System\sCFEBQX.exe
  2⤵
  PID:7016
- C:\Windows\System\zJtdvOq.exe
  C:\Windows\System\zJtdvOq.exe
  2⤵
  PID:7124
- C:\Windows\System\iOzoGWB.exe
  C:\Windows\System\iOzoGWB.exe
  2⤵
  PID:7160
- C:\Windows\System\YaQwOxQ.exe
  C:\Windows\System\YaQwOxQ.exe
  2⤵
  PID:5828
- C:\Windows\System\WZVcXbG.exe
  C:\Windows\System\WZVcXbG.exe
  2⤵
  PID:5860
- C:\Windows\System\CsTDQSY.exe
  C:\Windows\System\CsTDQSY.exe
  2⤵
  PID:5420
- C:\Windows\System\xHsxUnr.exe
  C:\Windows\System\xHsxUnr.exe
  2⤵
  PID:5464
- C:\Windows\System\iPWrJxe.exe
  C:\Windows\System\iPWrJxe.exe
  2⤵
  PID:5492
- C:\Windows\System\kmoRgna.exe
  C:\Windows\System\kmoRgna.exe
  2⤵
  PID:5592
- C:\Windows\System\vNWaUae.exe
  C:\Windows\System\vNWaUae.exe
  2⤵
  PID:5704
- C:\Windows\System\DiOuCMh.exe
  C:\Windows\System\DiOuCMh.exe
  2⤵
  PID:4952
- C:\Windows\System\mDUXTOx.exe
  C:\Windows\System\mDUXTOx.exe
  2⤵
  PID:5736
- C:\Windows\System\ctWYsDK.exe
  C:\Windows\System\ctWYsDK.exe
  2⤵
  PID:920
- C:\Windows\System\YcjJHqs.exe
  C:\Windows\System\YcjJHqs.exe
  2⤵
  PID:5884
- C:\Windows\System\SPbtjor.exe
  C:\Windows\System\SPbtjor.exe
  2⤵
  PID:5964
- C:\Windows\System\hNMMLYd.exe
  C:\Windows\System\hNMMLYd.exe
  2⤵
  PID:6008
- C:\Windows\System\eROEGMY.exe
  C:\Windows\System\eROEGMY.exe
  2⤵
  PID:6064
- C:\Windows\System\TGJQHmx.exe
  C:\Windows\System\TGJQHmx.exe
  2⤵
  PID:6128
- C:\Windows\System\kKlZlGT.exe
  C:\Windows\System\kKlZlGT.exe
  2⤵
  PID:6636
- C:\Windows\System\rnVJeAS.exe
  C:\Windows\System\rnVJeAS.exe
  2⤵
  PID:6088
- C:\Windows\System\AltwzuW.exe
  C:\Windows\System\AltwzuW.exe
  2⤵
  PID:6252
- C:\Windows\System\JwPnzwq.exe
  C:\Windows\System\JwPnzwq.exe
  2⤵
  PID:6408
- C:\Windows\System\VosckRc.exe
  C:\Windows\System\VosckRc.exe
  2⤵
  PID:6496
- C:\Windows\System\JJzsjOv.exe
  C:\Windows\System\JJzsjOv.exe
  2⤵
  PID:6648
- C:\Windows\System\YhMLwRh.exe
  C:\Windows\System\YhMLwRh.exe
  2⤵
  PID:3696
- C:\Windows\System\YjQdjqO.exe
  C:\Windows\System\YjQdjqO.exe
  2⤵
  PID:2512
- C:\Windows\System\xKmhXiy.exe
  C:\Windows\System\xKmhXiy.exe
  2⤵
  PID:5176
- C:\Windows\System\bViizYt.exe
  C:\Windows\System\bViizYt.exe
  2⤵
  PID:6680
- C:\Windows\System\CkaURqd.exe
  C:\Windows\System\CkaURqd.exe
  2⤵
  PID:6236
- C:\Windows\System\SuysEHT.exe
  C:\Windows\System\SuysEHT.exe
  2⤵
  PID:6280
- C:\Windows\System\MvEdOyZ.exe
  C:\Windows\System\MvEdOyZ.exe
  2⤵
  PID:6352
- C:\Windows\System\rprogvV.exe
  C:\Windows\System\rprogvV.exe
  2⤵
  PID:6436
- C:\Windows\System\LHXSREN.exe
  C:\Windows\System\LHXSREN.exe
  2⤵
  PID:6500
- C:\Windows\System\omDwRrh.exe
  C:\Windows\System\omDwRrh.exe
  2⤵
  PID:6544
- C:\Windows\System\VAlFnMC.exe
  C:\Windows\System\VAlFnMC.exe
  2⤵
  PID:6704
- C:\Windows\System\OHSIAUL.exe
  C:\Windows\System\OHSIAUL.exe
  2⤵
  PID:7188
- C:\Windows\System\qMXSWBd.exe
  C:\Windows\System\qMXSWBd.exe
  2⤵
  PID:7204
- C:\Windows\System\yJnJmuX.exe
  C:\Windows\System\yJnJmuX.exe
  2⤵
  PID:7224
- C:\Windows\System\NlElkpi.exe
  C:\Windows\System\NlElkpi.exe
  2⤵
  PID:7252
- C:\Windows\System\kuctSPd.exe
  C:\Windows\System\kuctSPd.exe
  2⤵
  PID:7272
- C:\Windows\System\XApgcZt.exe
  C:\Windows\System\XApgcZt.exe
  2⤵
  PID:7296
- C:\Windows\System\MtRHQuB.exe
  C:\Windows\System\MtRHQuB.exe
  2⤵
  PID:7316
- C:\Windows\System\imrFHVy.exe
  C:\Windows\System\imrFHVy.exe
  2⤵
  PID:7332
- C:\Windows\System\lIdnhfk.exe
  C:\Windows\System\lIdnhfk.exe
  2⤵
  PID:7356
- C:\Windows\System\Eiteauh.exe
  C:\Windows\System\Eiteauh.exe
  2⤵
  PID:7376
- C:\Windows\System\SZsAOQB.exe
  C:\Windows\System\SZsAOQB.exe
  2⤵
  PID:7400
- C:\Windows\System\vHZtRTi.exe
  C:\Windows\System\vHZtRTi.exe
  2⤵
  PID:7552
- C:\Windows\System\muIwBYJ.exe
  C:\Windows\System\muIwBYJ.exe
  2⤵
  PID:7572
- C:\Windows\System\gDcjJwU.exe
  C:\Windows\System\gDcjJwU.exe
  2⤵
  PID:7600
- C:\Windows\System\BeYiiBm.exe
  C:\Windows\System\BeYiiBm.exe
  2⤵
  PID:7624
- C:\Windows\System\KoLPgbC.exe
  C:\Windows\System\KoLPgbC.exe
  2⤵
  PID:7648
- C:\Windows\System\rLwQeQn.exe
  C:\Windows\System\rLwQeQn.exe
  2⤵
  PID:7828
- C:\Windows\System\BOUqHNz.exe
  C:\Windows\System\BOUqHNz.exe
  2⤵
  PID:7844
- C:\Windows\System\rSROdIN.exe
  C:\Windows\System\rSROdIN.exe
  2⤵
  PID:7860
- C:\Windows\System\OxIiXVQ.exe
  C:\Windows\System\OxIiXVQ.exe
  2⤵
  PID:7876
- C:\Windows\System\zDwPEWv.exe
  C:\Windows\System\zDwPEWv.exe
  2⤵
  PID:7896
- C:\Windows\System\YfzLYtz.exe
  C:\Windows\System\YfzLYtz.exe
  2⤵
  PID:7920
- C:\Windows\System\jCMQAGe.exe
  C:\Windows\System\jCMQAGe.exe
  2⤵
  PID:7940
- C:\Windows\System\wUPfDYM.exe
  C:\Windows\System\wUPfDYM.exe
  2⤵
  PID:7964
- C:\Windows\System\wmbfYrE.exe
  C:\Windows\System\wmbfYrE.exe
  2⤵
  PID:7988
- C:\Windows\System\wEtRQUK.exe
  C:\Windows\System\wEtRQUK.exe
  2⤵
  PID:8008
- C:\Windows\System\TkzteQS.exe
  C:\Windows\System\TkzteQS.exe
  2⤵
  PID:8028
- C:\Windows\System\cVcjDfj.exe
  C:\Windows\System\cVcjDfj.exe
  2⤵
  PID:8064
- C:\Windows\System\qFghXkD.exe
  C:\Windows\System\qFghXkD.exe
  2⤵
  PID:8084
- C:\Windows\System\MelBCde.exe
  C:\Windows\System\MelBCde.exe
  2⤵
  PID:8104
- C:\Windows\System\xmDtxlB.exe
  C:\Windows\System\xmDtxlB.exe
  2⤵
  PID:8128
- C:\Windows\System\WjElqsb.exe
  C:\Windows\System\WjElqsb.exe
  2⤵
  PID:8152
- C:\Windows\System\tbcOWgU.exe
  C:\Windows\System\tbcOWgU.exe
  2⤵
  PID:8172
- C:\Windows\System\QquQjYH.exe
  C:\Windows\System\QquQjYH.exe
  2⤵
  PID:6708
- C:\Windows\System\rMsmSeT.exe
  C:\Windows\System\rMsmSeT.exe
  2⤵
  PID:6864
- C:\Windows\System\PyMCEjk.exe
  C:\Windows\System\PyMCEjk.exe
  2⤵
  PID:6896
- C:\Windows\System\myQoFIh.exe
  C:\Windows\System\myQoFIh.exe
  2⤵
  PID:6984
- C:\Windows\System\eVWkkyh.exe
  C:\Windows\System\eVWkkyh.exe
  2⤵
  PID:7096
- C:\Windows\System\OKvkTIE.exe
  C:\Windows\System\OKvkTIE.exe
  2⤵
  PID:7140
- C:\Windows\System\pEBbvBe.exe
  C:\Windows\System\pEBbvBe.exe
  2⤵
  PID:5848
- C:\Windows\System\woJjvLg.exe
  C:\Windows\System\woJjvLg.exe
  2⤵
  PID:5572
- C:\Windows\System\GmwwkZC.exe
  C:\Windows\System\GmwwkZC.exe
  2⤵
  PID:5628
- C:\Windows\System\VVDfIpr.exe
  C:\Windows\System\VVDfIpr.exe
  2⤵
  PID:6004
- C:\Windows\System\befRNKd.exe
  C:\Windows\System\befRNKd.exe
  2⤵
  PID:4104
- C:\Windows\System\SwVpkAY.exe
  C:\Windows\System\SwVpkAY.exe
  2⤵
  PID:6232
- C:\Windows\System\KFtuHCS.exe
  C:\Windows\System\KFtuHCS.exe
  2⤵
  PID:5768
- C:\Windows\System\hMiEtjh.exe
  C:\Windows\System\hMiEtjh.exe
  2⤵
  PID:3420
- C:\Windows\System\olohufN.exe
  C:\Windows\System\olohufN.exe
  2⤵
  PID:5448
- C:\Windows\System\zsQTVbo.exe
  C:\Windows\System\zsQTVbo.exe
  2⤵
  PID:7152
- C:\Windows\System\vxejvam.exe
  C:\Windows\System\vxejvam.exe
  2⤵
  PID:6612
- C:\Windows\System\qDqPgIK.exe
  C:\Windows\System\qDqPgIK.exe
  2⤵
  PID:4092
- C:\Windows\System\KnxiluJ.exe
  C:\Windows\System\KnxiluJ.exe
  2⤵
  PID:8208
- C:\Windows\System\XkBCQFG.exe
  C:\Windows\System\XkBCQFG.exe
  2⤵
  PID:8232
- C:\Windows\System\PbZOyLt.exe
  C:\Windows\System\PbZOyLt.exe
  2⤵
  PID:8256
- C:\Windows\System\RLwLiPq.exe
  C:\Windows\System\RLwLiPq.exe
  2⤵
  PID:8284
- C:\Windows\System\cSQyHfI.exe
  C:\Windows\System\cSQyHfI.exe
  2⤵
  PID:8300
- C:\Windows\System\MUYyprv.exe
  C:\Windows\System\MUYyprv.exe
  2⤵
  PID:8436
- C:\Windows\System\ZeTPceb.exe
  C:\Windows\System\ZeTPceb.exe
  2⤵
  PID:8460
- C:\Windows\System\YaZUJyQ.exe
  C:\Windows\System\YaZUJyQ.exe
  2⤵
  PID:8480
- C:\Windows\System\VyfPLFo.exe
  C:\Windows\System\VyfPLFo.exe
  2⤵
  PID:8504
- C:\Windows\System\uLXBhDL.exe
  C:\Windows\System\uLXBhDL.exe
  2⤵
  PID:8528
- C:\Windows\System\zZYDkEa.exe
  C:\Windows\System\zZYDkEa.exe
  2⤵
  PID:8548
- C:\Windows\System\JcpJkYl.exe
  C:\Windows\System\JcpJkYl.exe
  2⤵
  PID:8572
- C:\Windows\System\WboTBJb.exe
  C:\Windows\System\WboTBJb.exe
  2⤵
  PID:8668
- C:\Windows\System\RAVwAYk.exe
  C:\Windows\System\RAVwAYk.exe
  2⤵
  PID:8684
- C:\Windows\System\VgCDlWx.exe
  C:\Windows\System\VgCDlWx.exe
  2⤵
  PID:8716
- C:\Windows\System\mtPPUgT.exe
  C:\Windows\System\mtPPUgT.exe
  2⤵
  PID:8740
- C:\Windows\System\zuMOMZM.exe
  C:\Windows\System\zuMOMZM.exe
  2⤵
  PID:8764
- C:\Windows\System\jzJWOxh.exe
  C:\Windows\System\jzJWOxh.exe
  2⤵
  PID:8784
- C:\Windows\System\PzHGHFD.exe
  C:\Windows\System\PzHGHFD.exe
  2⤵
  PID:8804
- C:\Windows\System\cxbbVYK.exe
  C:\Windows\System\cxbbVYK.exe
  2⤵
  PID:8864
- C:\Windows\System\QkhAJvr.exe
  C:\Windows\System\QkhAJvr.exe
  2⤵
  PID:8880
- C:\Windows\System\HMzjIDs.exe
  C:\Windows\System\HMzjIDs.exe
  2⤵
  PID:8904
- C:\Windows\System\JInmGDO.exe
  C:\Windows\System\JInmGDO.exe
  2⤵
  PID:8928
- C:\Windows\System\kXNzcmO.exe
  C:\Windows\System\kXNzcmO.exe
  2⤵
  PID:8952
- C:\Windows\System\yQPfLto.exe
  C:\Windows\System\yQPfLto.exe
  2⤵
  PID:8976
- C:\Windows\System\hgbvApP.exe
  C:\Windows\System\hgbvApP.exe
  2⤵
  PID:8996
- C:\Windows\System\plZWMxc.exe
  C:\Windows\System\plZWMxc.exe
  2⤵
  PID:9016
- C:\Windows\System\HRFtwZH.exe
  C:\Windows\System\HRFtwZH.exe
  2⤵
  PID:9040
- C:\Windows\System\ytHUXqO.exe
  C:\Windows\System\ytHUXqO.exe
  2⤵
  PID:9072
- C:\Windows\System\XIOFRYV.exe
  C:\Windows\System\XIOFRYV.exe
  2⤵
  PID:9092
- C:\Windows\System\qVnECta.exe
  C:\Windows\System\qVnECta.exe
  2⤵
  PID:9116
- C:\Windows\System\HRrpeJR.exe
  C:\Windows\System\HRrpeJR.exe
  2⤵
  PID:9136
- C:\Windows\System\WmhIGBu.exe
  C:\Windows\System\WmhIGBu.exe
  2⤵
  PID:9156
- C:\Windows\System\NAvlJMr.exe
  C:\Windows\System\NAvlJMr.exe
  2⤵
  PID:9180
- C:\Windows\System\huHxepH.exe
  C:\Windows\System\huHxepH.exe
  2⤵
  PID:9204
- C:\Windows\System\GVqrJcO.exe
  C:\Windows\System\GVqrJcO.exe
  2⤵
  PID:5336
- C:\Windows\System\ONUjvWK.exe
  C:\Windows\System\ONUjvWK.exe
  2⤵
  PID:6136
- C:\Windows\System\GDSnQyt.exe
  C:\Windows\System\GDSnQyt.exe
  2⤵
  PID:6220
- C:\Windows\System\CgKPrXA.exe
  C:\Windows\System\CgKPrXA.exe
  2⤵
  PID:3560
- C:\Windows\System\KGsKEDK.exe
  C:\Windows\System\KGsKEDK.exe
  2⤵
  PID:6472
- C:\Windows\System\PggDeeJ.exe
  C:\Windows\System\PggDeeJ.exe
  2⤵
  PID:6592
- C:\Windows\System\fGacOwE.exe
  C:\Windows\System\fGacOwE.exe
  2⤵
  PID:7212
- C:\Windows\System\keMfqJm.exe
  C:\Windows\System\keMfqJm.exe
  2⤵
  PID:7244
- C:\Windows\System\OGpusJa.exe
  C:\Windows\System\OGpusJa.exe
  2⤵
  PID:7292
- C:\Windows\System\HYAUNMq.exe
  C:\Windows\System\HYAUNMq.exe
  2⤵
  PID:7328
- C:\Windows\System\yJWVNBh.exe
  C:\Windows\System\yJWVNBh.exe
  2⤵
  PID:7372
- C:\Windows\System\heaEklX.exe
  C:\Windows\System\heaEklX.exe
  2⤵
  PID:7416
- C:\Windows\System\tBjbzZS.exe
  C:\Windows\System\tBjbzZS.exe
  2⤵
  PID:7116
- C:\Windows\System\IdIXBdX.exe
  C:\Windows\System\IdIXBdX.exe
  2⤵
  PID:5320
- C:\Windows\System\NFtqyfu.exe
  C:\Windows\System\NFtqyfu.exe
  2⤵
  PID:6096
- C:\Windows\System\CtOUbcQ.exe
  C:\Windows\System\CtOUbcQ.exe
  2⤵
  PID:7544
- C:\Windows\System\kGXFiTF.exe
  C:\Windows\System\kGXFiTF.exe
  2⤵
  PID:7588
- C:\Windows\System\JCSBoIA.exe
  C:\Windows\System\JCSBoIA.exe
  2⤵
  PID:7640
- C:\Windows\System\uWkkzXm.exe
  C:\Windows\System\uWkkzXm.exe
  2⤵
  PID:7696
- C:\Windows\System\bJeTJwg.exe
  C:\Windows\System\bJeTJwg.exe
  2⤵
  PID:2960
- C:\Windows\System\rxRrgXf.exe
  C:\Windows\System\rxRrgXf.exe
  2⤵
  PID:2900
- C:\Windows\System\sfgplMC.exe
  C:\Windows\System\sfgplMC.exe
  2⤵
  PID:5392
- C:\Windows\System\DtVyapK.exe
  C:\Windows\System\DtVyapK.exe
  2⤵
  PID:2472
- C:\Windows\System\EpHaLfv.exe
  C:\Windows\System\EpHaLfv.exe
  2⤵
  PID:5552
- C:\Windows\System\PFfrYJr.exe
  C:\Windows\System\PFfrYJr.exe
  2⤵
  PID:8248
- C:\Windows\System\dsdLjek.exe
  C:\Windows\System\dsdLjek.exe
  2⤵
  PID:8452
- C:\Windows\System\RhZzrgu.exe
  C:\Windows\System\RhZzrgu.exe
  2⤵
  PID:8240
- C:\Windows\System\inWbtCI.exe
  C:\Windows\System\inWbtCI.exe
  2⤵
  PID:7732
- C:\Windows\System\MjsQoLC.exe
  C:\Windows\System\MjsQoLC.exe
  2⤵
  PID:7816
- C:\Windows\System\aZTgQAj.exe
  C:\Windows\System\aZTgQAj.exe
  2⤵
  PID:7872
- C:\Windows\System\ZKwsCBn.exe
  C:\Windows\System\ZKwsCBn.exe
  2⤵
  PID:7908
- C:\Windows\System\OmoXoVt.exe
  C:\Windows\System\OmoXoVt.exe
  2⤵
  PID:7956
- C:\Windows\System\tKJdORx.exe
  C:\Windows\System\tKJdORx.exe
  2⤵
  PID:7976
- C:\Windows\System\wsHpqWC.exe
  C:\Windows\System\wsHpqWC.exe
  2⤵
  PID:8024
- C:\Windows\System\qMJfPBp.exe
  C:\Windows\System\qMJfPBp.exe
  2⤵
  PID:8072
- C:\Windows\System\ifgGsoi.exe
  C:\Windows\System\ifgGsoi.exe
  2⤵
  PID:8120
- C:\Windows\System\zHLKtBy.exe
  C:\Windows\System\zHLKtBy.exe
  2⤵
  PID:8140
- C:\Windows\System\dPhlllV.exe
  C:\Windows\System\dPhlllV.exe
  2⤵
  PID:7024
- C:\Windows\System\ALkWvjL.exe
  C:\Windows\System\ALkWvjL.exe
  2⤵
  PID:6944
- C:\Windows\System\MEYOSEA.exe
  C:\Windows\System\MEYOSEA.exe
  2⤵
  PID:4644
- C:\Windows\System\GwHZEvb.exe
  C:\Windows\System\GwHZEvb.exe
  2⤵
  PID:8696
- C:\Windows\System\UakvJwk.exe
  C:\Windows\System\UakvJwk.exe
  2⤵
  PID:8388
- C:\Windows\System\ZvLqqvA.exe
  C:\Windows\System\ZvLqqvA.exe
  2⤵
  PID:936
- C:\Windows\System\rXkNZAE.exe
  C:\Windows\System\rXkNZAE.exe
  2⤵
  PID:9112
- C:\Windows\System\OKdPgxW.exe
  C:\Windows\System\OKdPgxW.exe
  2⤵
  PID:5224
- C:\Windows\System\TOMXugY.exe
  C:\Windows\System\TOMXugY.exe
  2⤵
  PID:6328
- C:\Windows\System\WbPTnrc.exe
  C:\Windows\System\WbPTnrc.exe
  2⤵
  PID:7288
- C:\Windows\System\VXahqMK.exe
  C:\Windows\System\VXahqMK.exe
  2⤵
  PID:8472
- C:\Windows\System\wFqKvbd.exe
  C:\Windows\System\wFqKvbd.exe
  2⤵
  PID:8544
- C:\Windows\System\WKdyNgd.exe
  C:\Windows\System\WKdyNgd.exe
  2⤵
  PID:8612
- C:\Windows\System\iUvaZWd.exe
  C:\Windows\System\iUvaZWd.exe
  2⤵
  PID:9220
- C:\Windows\System\eMNtvdM.exe
  C:\Windows\System\eMNtvdM.exe
  2⤵
  PID:9244
- C:\Windows\System\OegkOXw.exe
  C:\Windows\System\OegkOXw.exe
  2⤵
  PID:9260
- C:\Windows\System\wdKddrH.exe
  C:\Windows\System\wdKddrH.exe
  2⤵
  PID:9276
- C:\Windows\System\vpJCRqg.exe
  C:\Windows\System\vpJCRqg.exe
  2⤵
  PID:9292
- C:\Windows\System\nQYaqdb.exe
  C:\Windows\System\nQYaqdb.exe
  2⤵
  PID:9308
- C:\Windows\System\FIKAzpK.exe
  C:\Windows\System\FIKAzpK.exe
  2⤵
  PID:9324
- C:\Windows\System\nvpXSZX.exe
  C:\Windows\System\nvpXSZX.exe
  2⤵
  PID:9344
- C:\Windows\System\ztyoCqy.exe
  C:\Windows\System\ztyoCqy.exe
  2⤵
  PID:9364
- C:\Windows\System\eSthDqD.exe
  C:\Windows\System\eSthDqD.exe
  2⤵
  PID:9384
- C:\Windows\System\zVgddlG.exe
  C:\Windows\System\zVgddlG.exe
  2⤵
  PID:9404
- C:\Windows\System\NlyOtZJ.exe
  C:\Windows\System\NlyOtZJ.exe
  2⤵
  PID:9428
- C:\Windows\System\evCvAut.exe
  C:\Windows\System\evCvAut.exe
  2⤵
  PID:9448
- C:\Windows\System\LldYnrn.exe
  C:\Windows\System\LldYnrn.exe
  2⤵
  PID:9468
- C:\Windows\System\HrALoGT.exe
  C:\Windows\System\HrALoGT.exe
  2⤵
  PID:9488
- C:\Windows\System\oaOUuOp.exe
  C:\Windows\System\oaOUuOp.exe
  2⤵
  PID:9508
- C:\Windows\System\pagJzbJ.exe
  C:\Windows\System\pagJzbJ.exe
  2⤵
  PID:9528
- C:\Windows\System\LOHyEWJ.exe
  C:\Windows\System\LOHyEWJ.exe
  2⤵
  PID:9552
- C:\Windows\System\aVWUGkx.exe
  C:\Windows\System\aVWUGkx.exe
  2⤵
  PID:9568
- C:\Windows\System\ABtSfye.exe
  C:\Windows\System\ABtSfye.exe
  2⤵
  PID:9588
- C:\Windows\System\DBpPzsv.exe
  C:\Windows\System\DBpPzsv.exe
  2⤵
  PID:9604
- C:\Windows\System\xbkbesZ.exe
  C:\Windows\System\xbkbesZ.exe
  2⤵
  PID:9632
- C:\Windows\System\qgfStqM.exe
  C:\Windows\System\qgfStqM.exe
  2⤵
  PID:9652
- C:\Windows\System\CmeIjvN.exe
  C:\Windows\System\CmeIjvN.exe
  2⤵
  PID:9680
- C:\Windows\System\tUTyvNC.exe
  C:\Windows\System\tUTyvNC.exe
  2⤵
  PID:9696
- C:\Windows\System\YIPvXLQ.exe
  C:\Windows\System\YIPvXLQ.exe
  2⤵
  PID:9716
- C:\Windows\System\UyFiDny.exe
  C:\Windows\System\UyFiDny.exe
  2⤵
  PID:9740
- C:\Windows\System\QmZTwnE.exe
  C:\Windows\System\QmZTwnE.exe
  2⤵
  PID:9784
- C:\Windows\System\DizuMrW.exe
  C:\Windows\System\DizuMrW.exe
  2⤵
  PID:9808
- C:\Windows\System\GRFyYYu.exe
  C:\Windows\System\GRFyYYu.exe
  2⤵
  PID:9828
- C:\Windows\System\xRrWbGP.exe
  C:\Windows\System\xRrWbGP.exe
  2⤵
  PID:9848
- C:\Windows\System\GRxRkGZ.exe
  C:\Windows\System\GRxRkGZ.exe
  2⤵
  PID:9872
- C:\Windows\System\OJNEeNM.exe
  C:\Windows\System\OJNEeNM.exe
  2⤵
  PID:9896
- C:\Windows\System\HLYPjMk.exe
  C:\Windows\System\HLYPjMk.exe
  2⤵
  PID:9920
- C:\Windows\System\WXqRDjP.exe
  C:\Windows\System\WXqRDjP.exe
  2⤵
  PID:9968
- C:\Windows\System\naMhejU.exe
  C:\Windows\System\naMhejU.exe
  2⤵
  PID:9996
- C:\Windows\System\ehuDxHF.exe
  C:\Windows\System\ehuDxHF.exe
  2⤵
  PID:10020
- C:\Windows\System\GeTnjyV.exe
  C:\Windows\System\GeTnjyV.exe
  2⤵
  PID:10040
- C:\Windows\System\sJhmnEU.exe
  C:\Windows\System\sJhmnEU.exe
  2⤵
  PID:10056
- C:\Windows\System\iEszrHn.exe
  C:\Windows\System\iEszrHn.exe
  2⤵
  PID:10080
- C:\Windows\System\wLwskPz.exe
  C:\Windows\System\wLwskPz.exe
  2⤵
  PID:10100
- C:\Windows\System\DMfGEHA.exe
  C:\Windows\System\DMfGEHA.exe
  2⤵
  PID:10124
- C:\Windows\System\MjszPAf.exe
  C:\Windows\System\MjszPAf.exe
  2⤵
  PID:10140
- C:\Windows\System\leIRYyA.exe
  C:\Windows\System\leIRYyA.exe
  2⤵
  PID:10160
- C:\Windows\System\KvbKyKy.exe
  C:\Windows\System\KvbKyKy.exe
  2⤵
  PID:10180
- C:\Windows\System\vidZocd.exe
  C:\Windows\System\vidZocd.exe
  2⤵
  PID:10204
- C:\Windows\System\MvduEoK.exe
  C:\Windows\System\MvduEoK.exe
  2⤵
  PID:10224
- C:\Windows\System\aplNNjN.exe
  C:\Windows\System\aplNNjN.exe
  2⤵
  PID:1588
- C:\Windows\System\dBjtTeA.exe
  C:\Windows\System\dBjtTeA.exe
  2⤵
  PID:6524
- C:\Windows\System\LiNwNCU.exe
  C:\Windows\System\LiNwNCU.exe
  2⤵
  PID:5808
- C:\Windows\System\HdjJQeo.exe
  C:\Windows\System\HdjJQeo.exe
  2⤵
  PID:8496
- C:\Windows\System\kMMXQho.exe
  C:\Windows\System\kMMXQho.exe
  2⤵
  PID:7200
- C:\Windows\System\qlVbCUV.exe
  C:\Windows\System\qlVbCUV.exe
  2⤵
  PID:7240
- C:\Windows\System\qLtLXqZ.exe
  C:\Windows\System\qLtLXqZ.exe
  2⤵
  PID:8168
- C:\Windows\System\igdBJKm.exe
  C:\Windows\System\igdBJKm.exe
  2⤵
  PID:4648
- C:\Windows\System\bvLIBfd.exe
  C:\Windows\System\bvLIBfd.exe
  2⤵
  PID:8736
- C:\Windows\System\eKXWwAV.exe
  C:\Windows\System\eKXWwAV.exe
  2⤵
  PID:8776
- C:\Windows\System\EdHFCys.exe
  C:\Windows\System\EdHFCys.exe
  2⤵
  PID:8840
- C:\Windows\System\IzxQgUl.exe
  C:\Windows\System\IzxQgUl.exe
  2⤵
  PID:8876
- C:\Windows\System\zMxHBdW.exe
  C:\Windows\System\zMxHBdW.exe
  2⤵
  PID:8924
- C:\Windows\System\TZJgmVd.exe
  C:\Windows\System\TZJgmVd.exe
  2⤵
  PID:8964
- C:\Windows\System\EsAZfhB.exe
  C:\Windows\System\EsAZfhB.exe
  2⤵
  PID:9004
- C:\Windows\System\fLoRnLm.exe
  C:\Windows\System\fLoRnLm.exe
  2⤵
  PID:9036
- C:\Windows\System\tBLkgbW.exe
  C:\Windows\System\tBLkgbW.exe
  2⤵
  PID:2580
- C:\Windows\System\vBJadPZ.exe
  C:\Windows\System\vBJadPZ.exe
  2⤵
  PID:932
- C:\Windows\System\lELUuju.exe
  C:\Windows\System\lELUuju.exe
  2⤵
  PID:2764
- C:\Windows\System\qWOWLDO.exe
  C:\Windows\System\qWOWLDO.exe
  2⤵
  PID:8520
- C:\Windows\System\NwwqEvp.exe
  C:\Windows\System\NwwqEvp.exe
  2⤵
  PID:8656
- C:\Windows\System\UAsMKIT.exe
  C:\Windows\System\UAsMKIT.exe
  2⤵
  PID:7692
- C:\Windows\System\WItYznv.exe
  C:\Windows\System\WItYznv.exe
  2⤵
  PID:9252
- C:\Windows\System\RBfzIWn.exe
  C:\Windows\System\RBfzIWn.exe
  2⤵
  PID:2108
- C:\Windows\System\KJKIrJE.exe
  C:\Windows\System\KJKIrJE.exe
  2⤵
  PID:6460
- C:\Windows\System\pXYIDfQ.exe
  C:\Windows\System\pXYIDfQ.exe
  2⤵
  PID:8272
- C:\Windows\System\NXwRETm.exe
  C:\Windows\System\NXwRETm.exe
  2⤵
  PID:7808
- C:\Windows\System\VtnbMQK.exe
  C:\Windows\System\VtnbMQK.exe
  2⤵
  PID:7368
- C:\Windows\System\wbMjVBL.exe
  C:\Windows\System\wbMjVBL.exe
  2⤵
  PID:10268
- C:\Windows\System\bZJJYEd.exe
  C:\Windows\System\bZJJYEd.exe
  2⤵
  PID:10284
- C:\Windows\System\mdBJfsj.exe
  C:\Windows\System\mdBJfsj.exe
  2⤵
  PID:10308
- C:\Windows\System\MEndApj.exe
  C:\Windows\System\MEndApj.exe
  2⤵
  PID:10328
- C:\Windows\System\wxLDMxf.exe
  C:\Windows\System\wxLDMxf.exe
  2⤵
  PID:10352
- C:\Windows\System\cRgMpLq.exe
  C:\Windows\System\cRgMpLq.exe
  2⤵
  PID:10376
- C:\Windows\System\fLwgJrv.exe
  C:\Windows\System\fLwgJrv.exe
  2⤵
  PID:10392
- C:\Windows\System\ThjMLxl.exe
  C:\Windows\System\ThjMLxl.exe
  2⤵
  PID:10416
- C:\Windows\System\dcaqAmk.exe
  C:\Windows\System\dcaqAmk.exe
  2⤵
  PID:10496
- C:\Windows\System\BbEVhFB.exe
  C:\Windows\System\BbEVhFB.exe
  2⤵
  PID:10524
- C:\Windows\System\ABjdllN.exe
  C:\Windows\System\ABjdllN.exe
  2⤵
  PID:10836
- C:\Windows\System\RZBZPrp.exe
  C:\Windows\System\RZBZPrp.exe
  2⤵
  PID:10852
- C:\Windows\System\CohmwwI.exe
  C:\Windows\System\CohmwwI.exe
  2⤵
  PID:10876
- C:\Windows\System\pHaMZki.exe
  C:\Windows\System\pHaMZki.exe
  2⤵
  PID:10892
- C:\Windows\System\XJgBvuo.exe
  C:\Windows\System\XJgBvuo.exe
  2⤵
  PID:10920
- C:\Windows\System\IfYmDDN.exe
  C:\Windows\System\IfYmDDN.exe
  2⤵
  PID:10940
- C:\Windows\System\ollXjiD.exe
  C:\Windows\System\ollXjiD.exe
  2⤵
  PID:10964
- C:\Windows\System\khFjTMY.exe
  C:\Windows\System\khFjTMY.exe
  2⤵
  PID:10988
- C:\Windows\System\oCmiZLV.exe
  C:\Windows\System\oCmiZLV.exe
  2⤵
  PID:11016
- C:\Windows\System\aisjyGL.exe
  C:\Windows\System\aisjyGL.exe
  2⤵
  PID:11036
- C:\Windows\System\IgnTLXn.exe
  C:\Windows\System\IgnTLXn.exe
  2⤵
  PID:11060
- C:\Windows\System\AoMAkJz.exe
  C:\Windows\System\AoMAkJz.exe
  2⤵
  PID:11076
- C:\Windows\System\yryFaZm.exe
  C:\Windows\System\yryFaZm.exe
  2⤵
  PID:11096
- C:\Windows\System\OVscCay.exe
  C:\Windows\System\OVscCay.exe
  2⤵
  PID:11112
- C:\Windows\System\VIZcsyp.exe
  C:\Windows\System\VIZcsyp.exe
  2⤵
  PID:11128
- C:\Windows\System\hLfXBBn.exe
  C:\Windows\System\hLfXBBn.exe
  2⤵
  PID:11144
- C:\Windows\System\moRupUG.exe
  C:\Windows\System\moRupUG.exe
  2⤵
  PID:11160
- C:\Windows\System\AHKEsnu.exe
  C:\Windows\System\AHKEsnu.exe
  2⤵
  PID:11176
- C:\Windows\System\tFRNiHm.exe
  C:\Windows\System\tFRNiHm.exe
  2⤵
  PID:11196
- C:\Windows\System\IxJzgSh.exe
  C:\Windows\System\IxJzgSh.exe
  2⤵
  PID:11212
- C:\Windows\System\cPMQTxO.exe
  C:\Windows\System\cPMQTxO.exe
  2⤵
  PID:11236
- C:\Windows\System\Aghkdwz.exe
  C:\Windows\System\Aghkdwz.exe
  2⤵
  PID:9676
- C:\Windows\System\vFmKVpr.exe
  C:\Windows\System\vFmKVpr.exe
  2⤵
  PID:4904
- C:\Windows\System\lSiDaTT.exe
  C:\Windows\System\lSiDaTT.exe
  2⤵
  PID:5724
- C:\Windows\System\VaUFwrJ.exe
  C:\Windows\System\VaUFwrJ.exe
  2⤵
  PID:6308
- C:\Windows\System\KvSSaDo.exe
  C:\Windows\System\KvSSaDo.exe
  2⤵
  PID:10072
- C:\Windows\System\YwtrTIM.exe
  C:\Windows\System\YwtrTIM.exe
  2⤵
  PID:8512
- C:\Windows\System\GesGnRD.exe
  C:\Windows\System\GesGnRD.exe
  2⤵
  PID:9164
- C:\Windows\System\TQmVsIf.exe
  C:\Windows\System\TQmVsIf.exe
  2⤵
  PID:4008
- C:\Windows\System\lHYGONu.exe
  C:\Windows\System\lHYGONu.exe
  2⤵
  PID:9356
- C:\Windows\System\CXTIkCt.exe
  C:\Windows\System\CXTIkCt.exe
  2⤵
  PID:6304
- C:\Windows\System\GTVzehq.exe
  C:\Windows\System\GTVzehq.exe
  2⤵
  PID:9380
- C:\Windows\System\NHphPiP.exe
  C:\Windows\System\NHphPiP.exe
  2⤵
  PID:9412
- C:\Windows\System\UikUXJM.exe
  C:\Windows\System\UikUXJM.exe
  2⤵
  PID:8812
- C:\Windows\System\LwknQTS.exe
  C:\Windows\System\LwknQTS.exe
  2⤵
  PID:9516
- C:\Windows\System\cJYvVkG.exe
  C:\Windows\System\cJYvVkG.exe
  2⤵
  PID:9540
- C:\Windows\System\xpuSgZj.exe
  C:\Windows\System\xpuSgZj.exe
  2⤵
  PID:9596
- C:\Windows\System\bJooLpd.exe
  C:\Windows\System\bJooLpd.exe
  2⤵
  PID:8052
- C:\Windows\System\eJJLFOq.exe
  C:\Windows\System\eJJLFOq.exe
  2⤵
  PID:8124
- C:\Windows\System\AefQmRY.exe
  C:\Windows\System\AefQmRY.exe
  2⤵
  PID:8296
- C:\Windows\System\khvUfyE.exe
  C:\Windows\System\khvUfyE.exe
  2⤵
  PID:9644
- C:\Windows\System\RnLwYXK.exe
  C:\Windows\System\RnLwYXK.exe
  2⤵
  PID:9712
- C:\Windows\System\mZItHVA.exe
  C:\Windows\System\mZItHVA.exe
  2⤵
  PID:10348
- C:\Windows\System\FeBAhzG.exe
  C:\Windows\System\FeBAhzG.exe
  2⤵
  PID:6988
- C:\Windows\System\IlFrpWh.exe
  C:\Windows\System\IlFrpWh.exe
  2⤵
  PID:8344
- C:\Windows\System\TrZKTJA.exe
  C:\Windows\System\TrZKTJA.exe
  2⤵
  PID:2608
- C:\Windows\System\RRfzBiJ.exe
  C:\Windows\System\RRfzBiJ.exe
  2⤵
  PID:10132
- C:\Windows\System\YCbSNbL.exe
  C:\Windows\System\YCbSNbL.exe
  2⤵
  PID:10200
- C:\Windows\System\TkAUPJX.exe
  C:\Windows\System\TkAUPJX.exe
  2⤵
  PID:9172
- C:\Windows\System\VhVZxcH.exe
  C:\Windows\System\VhVZxcH.exe
  2⤵
  PID:9372
- C:\Windows\System\RIIuwFd.exe
  C:\Windows\System\RIIuwFd.exe
  2⤵
  PID:9460
- C:\Windows\System\PewNiXi.exe
  C:\Windows\System\PewNiXi.exe
  2⤵
  PID:2036
- C:\Windows\System\TlfSaNv.exe
  C:\Windows\System\TlfSaNv.exe
  2⤵
  PID:9108
- C:\Windows\System\xiwzyRH.exe
  C:\Windows\System\xiwzyRH.exe
  2⤵
  PID:9420
- C:\Windows\System\OMVniCv.exe
  C:\Windows\System\OMVniCv.exe
  2⤵
  PID:10296
- C:\Windows\System\qqouVEg.exe
  C:\Windows\System\qqouVEg.exe
  2⤵
  PID:11284
- C:\Windows\System\CJcMnQr.exe
  C:\Windows\System\CJcMnQr.exe
  2⤵
  PID:11300
- C:\Windows\System\gXOslJZ.exe
  C:\Windows\System\gXOslJZ.exe
  2⤵
  PID:11324
- C:\Windows\System\JbqsBnS.exe
  C:\Windows\System\JbqsBnS.exe
  2⤵
  PID:11400
- C:\Windows\System\BMttKaa.exe
  C:\Windows\System\BMttKaa.exe
  2⤵
  PID:11424
- C:\Windows\System\qOqRsHA.exe
  C:\Windows\System\qOqRsHA.exe
  2⤵
  PID:11448
- C:\Windows\System\dKetWnx.exe
  C:\Windows\System\dKetWnx.exe
  2⤵
  PID:11472
- C:\Windows\System\tOXFjDc.exe
  C:\Windows\System\tOXFjDc.exe
  2⤵
  PID:11492
- C:\Windows\System\DQeTsPk.exe
  C:\Windows\System\DQeTsPk.exe
  2⤵
  PID:11512
- C:\Windows\System\EPfIXVR.exe
  C:\Windows\System\EPfIXVR.exe
  2⤵
  PID:11532
- C:\Windows\System\kogICRk.exe
  C:\Windows\System\kogICRk.exe
  2⤵
  PID:11552
- C:\Windows\System\yUralYj.exe
  C:\Windows\System\yUralYj.exe
  2⤵
  PID:11572
- C:\Windows\System\evGkBxz.exe
  C:\Windows\System\evGkBxz.exe
  2⤵
  PID:11592
- C:\Windows\System\xEBPbVy.exe
  C:\Windows\System\xEBPbVy.exe
  2⤵
  PID:11624
- C:\Windows\System\hqlohWh.exe
  C:\Windows\System\hqlohWh.exe
  2⤵
  PID:11640
- C:\Windows\System\SoSuYBA.exe
  C:\Windows\System\SoSuYBA.exe
  2⤵
  PID:11668
- C:\Windows\System\ofPTnSI.exe
  C:\Windows\System\ofPTnSI.exe
  2⤵
  PID:11688
- C:\Windows\System\eAYfxBM.exe
  C:\Windows\System\eAYfxBM.exe
  2⤵
  PID:11708
- C:\Windows\System\xKxzRHW.exe
  C:\Windows\System\xKxzRHW.exe
  2⤵
  PID:12096
- C:\Windows\System\PUKeRyR.exe
  C:\Windows\System\PUKeRyR.exe
  2⤵
  PID:12112
- C:\Windows\System\eotnFNK.exe
  C:\Windows\System\eotnFNK.exe
  2⤵
  PID:12128
- C:\Windows\System\EitguOK.exe
  C:\Windows\System\EitguOK.exe
  2⤵
  PID:12148
- C:\Windows\System\LjZtwfa.exe
  C:\Windows\System\LjZtwfa.exe
  2⤵
  PID:12172
- C:\Windows\System\LlyzrXs.exe
  C:\Windows\System\LlyzrXs.exe
  2⤵
  PID:12192
- C:\Windows\System\zBoeOgP.exe
  C:\Windows\System\zBoeOgP.exe
  2⤵
  PID:12212
- C:\Windows\System\zGujfdI.exe
  C:\Windows\System\zGujfdI.exe
  2⤵
  PID:12232
- C:\Windows\System\jMvafru.exe
  C:\Windows\System\jMvafru.exe
  2⤵
  PID:12252
- C:\Windows\System\dmNQVSZ.exe
  C:\Windows\System\dmNQVSZ.exe
  2⤵
  PID:12272
- C:\Windows\System\BIBLDOf.exe
  C:\Windows\System\BIBLDOf.exe
  2⤵
  PID:9792
- C:\Windows\System\wxteAbG.exe
  C:\Windows\System\wxteAbG.exe
  2⤵
  PID:9824
- C:\Windows\System\ChVTOjs.exe
  C:\Windows\System\ChVTOjs.exe
  2⤵
  PID:9868
- C:\Windows\System\srDrvxk.exe
  C:\Windows\System\srDrvxk.exe
  2⤵
  PID:9912
- C:\Windows\System\ogpwksv.exe
  C:\Windows\System\ogpwksv.exe
  2⤵
  PID:9976
- C:\Windows\System\TOdSTsJ.exe
  C:\Windows\System\TOdSTsJ.exe
  2⤵
  PID:10868
- C:\Windows\System\QOOLirW.exe
  C:\Windows\System\QOOLirW.exe
  2⤵
  PID:11084
- C:\Windows\System\HLzrALb.exe
  C:\Windows\System\HLzrALb.exe
  2⤵
  PID:10152
- C:\Windows\System\jInQiTZ.exe
  C:\Windows\System\jInQiTZ.exe
  2⤵
  PID:10604
- C:\Windows\System\ONwvXgF.exe
  C:\Windows\System\ONwvXgF.exe
  2⤵
  PID:10064
- C:\Windows\System\fOtkwPg.exe
  C:\Windows\System\fOtkwPg.exe
  2⤵
  PID:9564
- C:\Windows\System\kwaIJvt.exe
  C:\Windows\System\kwaIJvt.exe
  2⤵
  PID:10668
- C:\Windows\System\CmCCwDI.exe
  C:\Windows\System\CmCCwDI.exe
  2⤵
  PID:8988
- C:\Windows\System\NEDVvht.exe
  C:\Windows\System\NEDVvht.exe
  2⤵
  PID:10720
- C:\Windows\System\OryTXVE.exe
  C:\Windows\System\OryTXVE.exe
  2⤵
  PID:4308
- C:\Windows\System\QZXkGvr.exe
  C:\Windows\System\QZXkGvr.exe
  2⤵
  PID:848
- C:\Windows\System\AxgWhzz.exe
  C:\Windows\System\AxgWhzz.exe
  2⤵
  PID:3632
- C:\Windows\System\EwRacFg.exe
  C:\Windows\System\EwRacFg.exe
  2⤵
  PID:10864
- C:\Windows\System\vcEEVZt.exe
  C:\Windows\System\vcEEVZt.exe
  2⤵
  PID:692
- C:\Windows\System\gReOPwR.exe
  C:\Windows\System\gReOPwR.exe
  2⤵
  PID:10488
- C:\Windows\System\bZZUzkJ.exe
  C:\Windows\System\bZZUzkJ.exe
  2⤵
  PID:10424
- C:\Windows\System\GvJEnUr.exe
  C:\Windows\System\GvJEnUr.exe
  2⤵
  PID:11544
- C:\Windows\System\SfWeZAL.exe
  C:\Windows\System\SfWeZAL.exe
  2⤵
  PID:10908
- C:\Windows\System\ohWLopC.exe
  C:\Windows\System\ohWLopC.exe
  2⤵
  PID:11600
- C:\Windows\System\LsEzjiX.exe
  C:\Windows\System\LsEzjiX.exe
  2⤵
  PID:11024
- C:\Windows\System\hGghuBG.exe
  C:\Windows\System\hGghuBG.exe
  2⤵
  PID:448
- C:\Windows\System\YXHELSO.exe
  C:\Windows\System\YXHELSO.exe
  2⤵
  PID:11124
- C:\Windows\System\cdKIrXT.exe
  C:\Windows\System\cdKIrXT.exe
  2⤵
  PID:11136
- C:\Windows\System\QTqsZuq.exe
  C:\Windows\System\QTqsZuq.exe
  2⤵
  PID:11188
- C:\Windows\System\YkOOaNj.exe
  C:\Windows\System\YkOOaNj.exe
  2⤵
  PID:11232
- C:\Windows\System\fnOTUKR.exe
  C:\Windows\System\fnOTUKR.exe
  2⤵
  PID:11744
- C:\Windows\System\mcYewPK.exe
  C:\Windows\System\mcYewPK.exe
  2⤵
  PID:10028
- C:\Windows\System\nRvgFFg.exe
  C:\Windows\System\nRvgFFg.exe
  2⤵
  PID:11776
- C:\Windows\System\FPDOacL.exe
  C:\Windows\System\FPDOacL.exe
  2⤵
  PID:9236
- C:\Windows\System\NkLIyhE.exe
  C:\Windows\System\NkLIyhE.exe
  2⤵
  PID:1748
- C:\Windows\System\SPLUFQt.exe
  C:\Windows\System\SPLUFQt.exe
  2⤵
  PID:6424
- C:\Windows\System\wxHLrMI.exe
  C:\Windows\System\wxHLrMI.exe
  2⤵
  PID:3592
- C:\Windows\System\sikYhzD.exe
  C:\Windows\System\sikYhzD.exe
  2⤵
  PID:10644
- C:\Windows\System\OhgyTNF.exe
  C:\Windows\System\OhgyTNF.exe
  2⤵
  PID:11924
- C:\Windows\System\vfnCGXd.exe
  C:\Windows\System\vfnCGXd.exe
  2⤵
  PID:6884
- C:\Windows\System\gcRYzvH.exe
  C:\Windows\System\gcRYzvH.exe
  2⤵
  PID:7308
- C:\Windows\System\dUTSUZT.exe
  C:\Windows\System\dUTSUZT.exe
  2⤵
  PID:12304
- C:\Windows\System\AnvBJRN.exe
  C:\Windows\System\AnvBJRN.exe
  2⤵
  PID:12324
- C:\Windows\System\UrsPrpX.exe
  C:\Windows\System\UrsPrpX.exe
  2⤵
  PID:12344
- C:\Windows\System\EftkQle.exe
  C:\Windows\System\EftkQle.exe
  2⤵
  PID:12364
- C:\Windows\System\BuKlssF.exe
  C:\Windows\System\BuKlssF.exe
  2⤵
  PID:12388
- C:\Windows\System\ZamDGPR.exe
  C:\Windows\System\ZamDGPR.exe
  2⤵
  PID:12408
- C:\Windows\System\ArXTYPS.exe
  C:\Windows\System\ArXTYPS.exe
  2⤵
  PID:12436
- C:\Windows\System\UcJKxNQ.exe
  C:\Windows\System\UcJKxNQ.exe
  2⤵
  PID:12468
- C:\Windows\System\qPetBRt.exe
  C:\Windows\System\qPetBRt.exe
  2⤵
  PID:12488
- C:\Windows\System\wdVIjYl.exe
  C:\Windows\System\wdVIjYl.exe
  2⤵
  PID:12536
- C:\Windows\System\sxzmGFA.exe
  C:\Windows\System\sxzmGFA.exe
  2⤵
  PID:12556
- C:\Windows\System\fMaXRUa.exe
  C:\Windows\System\fMaXRUa.exe
  2⤵
  PID:12576
- C:\Windows\System\KKtiYNM.exe
  C:\Windows\System\KKtiYNM.exe
  2⤵
  PID:12596
- C:\Windows\System\QdlHJQy.exe
  C:\Windows\System\QdlHJQy.exe
  2⤵
  PID:12620
- C:\Windows\System\TBIvSMr.exe
  C:\Windows\System\TBIvSMr.exe
  2⤵
  PID:12640
- C:\Windows\System\toJLdip.exe
  C:\Windows\System\toJLdip.exe
  2⤵
  PID:12664
- C:\Windows\System\RILSrXV.exe
  C:\Windows\System\RILSrXV.exe
  2⤵
  PID:12688
- C:\Windows\System\KnvUgwa.exe
  C:\Windows\System\KnvUgwa.exe
  2⤵
  PID:12708
- C:\Windows\System\flPxPjh.exe
  C:\Windows\System\flPxPjh.exe
  2⤵
  PID:12732
- C:\Windows\System\gcFOIgJ.exe
  C:\Windows\System\gcFOIgJ.exe
  2⤵
  PID:12752
- C:\Windows\System\qdgxMQS.exe
  C:\Windows\System\qdgxMQS.exe
  2⤵
  PID:12772
- C:\Windows\System\CMFEWQl.exe
  C:\Windows\System\CMFEWQl.exe
  2⤵
  PID:12796
- C:\Windows\System\OULYWQM.exe
  C:\Windows\System\OULYWQM.exe
  2⤵
  PID:12820
- C:\Windows\System\kMWxVCJ.exe
  C:\Windows\System\kMWxVCJ.exe
  2⤵
  PID:12852
- C:\Windows\System\HebcbiV.exe
  C:\Windows\System\HebcbiV.exe
  2⤵
  PID:12868
- C:\Windows\System\xnUHTUt.exe
  C:\Windows\System\xnUHTUt.exe
  2⤵
  PID:12892
- C:\Windows\System\wMRPqxv.exe
  C:\Windows\System\wMRPqxv.exe
  2⤵
  PID:12908
- C:\Windows\System\GgBhnjw.exe
  C:\Windows\System\GgBhnjw.exe
  2⤵
  PID:12932
- C:\Windows\System\QYBulcZ.exe
  C:\Windows\System\QYBulcZ.exe
  2⤵
  PID:12956
- C:\Windows\System\AXPjqPR.exe
  C:\Windows\System\AXPjqPR.exe
  2⤵
  PID:12984
- C:\Windows\System\cvjwsIC.exe
  C:\Windows\System\cvjwsIC.exe
  2⤵
  PID:13000
- C:\Windows\System\aOQfcMo.exe
  C:\Windows\System\aOQfcMo.exe
  2⤵
  PID:13024
- C:\Windows\System\GmpqAci.exe
  C:\Windows\System\GmpqAci.exe
  2⤵
  PID:12140
- C:\Windows\System\atTnLXl.exe
  C:\Windows\System\atTnLXl.exe
  2⤵
  PID:9904
- C:\Windows\System\wUitJXh.exe
  C:\Windows\System\wUitJXh.exe
  2⤵
  PID:10092
- C:\Windows\System\kKLBzwV.exe
  C:\Windows\System\kKLBzwV.exe
  2⤵
  PID:9024
- C:\Windows\System\NktKesJ.exe
  C:\Windows\System\NktKesJ.exe
  2⤵
  PID:10572
- C:\Windows\System\xepYbMg.exe
  C:\Windows\System\xepYbMg.exe
  2⤵
  PID:10504
- C:\Windows\System\ODuShKT.exe
  C:\Windows\System\ODuShKT.exe
  2⤵
  PID:3608
- C:\Windows\System\QmcxxmS.exe
  C:\Windows\System\QmcxxmS.exe
  2⤵
  PID:12320
- C:\Windows\System\lhdGSQB.exe
  C:\Windows\System\lhdGSQB.exe
  2⤵
  PID:12504
- C:\Windows\System\NJhCNcj.exe
  C:\Windows\System\NJhCNcj.exe
  2⤵
  PID:10872
- C:\Windows\System\qvpMiFo.exe
  C:\Windows\System\qvpMiFo.exe
  2⤵
  PID:12520
- C:\Windows\System\DMCpxPM.exe
  C:\Windows\System\DMCpxPM.exe
  2⤵
  PID:11608
- C:\Windows\System\WAapRVp.exe
  C:\Windows\System\WAapRVp.exe
  2⤵
  PID:12588
- C:\Windows\System\cGBjJof.exe
  C:\Windows\System\cGBjJof.exe
  2⤵
  PID:12616
- C:\Windows\System\RfrDdpc.exe
  C:\Windows\System\RfrDdpc.exe
  2⤵
  PID:12652
- C:\Windows\System\JSxSQQf.exe
  C:\Windows\System\JSxSQQf.exe
  2⤵
  PID:12720
- C:\Windows\System\zdegOeC.exe
  C:\Windows\System\zdegOeC.exe
  2⤵
  PID:12764
- C:\Windows\System\UsQmxpd.exe
  C:\Windows\System\UsQmxpd.exe
  2⤵
  PID:12792
- C:\Windows\System\rcKAURG.exe
  C:\Windows\System\rcKAURG.exe
  2⤵
  PID:12828
- C:\Windows\System\JFjqQBZ.exe
  C:\Windows\System\JFjqQBZ.exe
  2⤵
  PID:12876
- C:\Windows\System\MdHjaCJ.exe
  C:\Windows\System\MdHjaCJ.exe
  2⤵
  PID:12924
- C:\Windows\System\CaZqUhQ.exe
  C:\Windows\System\CaZqUhQ.exe
  2⤵
  PID:12952
- C:\Windows\System\wdSUbUi.exe
  C:\Windows\System\wdSUbUi.exe
  2⤵
  PID:12996
- C:\Windows\System\TtlPTPy.exe
  C:\Windows\System\TtlPTPy.exe
  2⤵
  PID:13052
- C:\Windows\System\ivKECXO.exe
  C:\Windows\System\ivKECXO.exe
  2⤵
  PID:13116

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:11128

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:12924

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:12868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_domw1pnk.c4f.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BBWSkJY.exe

Filesize
1.8MB

MD5
a3641fdccce85223d0608c34882f1349

SHA1
40297b2bfc8fd0f597fba857fcd3d3a4c33437f8

SHA256
d4fb5433079eaa06670246a4cc8b0cf692b68bdbd2f92a2ec2cbcd1f658aaaa0

SHA512
8e478b2be23d12f6af543de2c31323a415ebe00dc6c6ef32631397fef4b0de51c7ef473a7d9e61a96caa038ab6d2f86008a98fe7478ac8bb64c755a304054632

Download Submit
C:\Windows\System\CzGsHHx.exe

Filesize
1.9MB

MD5
2bd2080bf467fd9abe94876bc6a05deb

SHA1
d4232724e4baf023309ee6e9210284f4ce61080a

SHA256
6d52ea880cc8b6011dfdaa8f7781982ee09dea27c0ae02bf28bf063570dbb153

SHA512
bd02f5d1b7891af25b4541704e448a56f2dcc61c8d002812e46af067f600f406b459b4b5f7e8a051166cf2da44b0054bd7308765a8ab0ad24e74943b2cd750c3

Download Submit
C:\Windows\System\FNJUpwL.exe

Filesize
1.9MB

MD5
cef2ea9313e4e1e690290085d5c5eea0

SHA1
3ecaa219d3cdbeed1aaeabe3bac455cb80346e26

SHA256
3a8a651bffc6aee41283446a4cba2bfd6610c3ca627f80af45bab67eaf584b93

SHA512
7aebde65a7d2e7bd0f96f168b1013998f77163921e3bca3d3f83d62d1bf8502596eb16123c3420aa3e4dad053c352c018be8b0ce5e02d56576731d4ff6098dcf

Download Submit
C:\Windows\System\FcDMvJB.exe

Filesize
1.9MB

MD5
edc945568d4f3b6fcfb20d6b6a8bc3a1

SHA1
a0c971aee825cf9bb6bfb53d81131989fa03eb1b

SHA256
7a535d265d8eaee0bcc7f424b7135a940b32471dd83eb8435f5358fa72717bfa

SHA512
2e4f213f6ac8f01e87bcb0503b62811740a5519c44c53bc64c3c5a6de17c7d7e637f71ef101d4cab43720df0910dc7275019b2b9c3c93ad55e9754536137ba8d

Download Submit
C:\Windows\System\IANaRBs.exe

Filesize
1.9MB

MD5
ef98a7210a0711d8fcb3085ca1f0491b

SHA1
f0acbd54d1f7fad155ac7de311af24634d036954

SHA256
4df450e2b0ceb9bd34bc80950eee6248f2027a47115a70e033dd109da26dfe80

SHA512
b0c09dd64777821c4cf3077297d9016a1a765eb13b515246c3e99c48eafbdb280e92c5f8514f48558342a1161ba9d1e847c9804198d11025e722dea5fc4b2007

Download Submit
C:\Windows\System\KsRUXWc.exe

Filesize
1.9MB

MD5
c48b1dd9623b6c88ff40dca34e1e333f

SHA1
6452c2dbe189f4b3f88c92732b14ce0145a58f09

SHA256
08bb7d2e66c3ef7f8b1a317f6fc9d4820b6d31ce2c6d3a607ed2153e2f546f6f

SHA512
2b3d842c80c0c3135c7a35bd6e34266dc36b770468f0802398757872370a12a308ed1968ec31f083111b9f758757385d103526b05b6720ec15182f525f2732ab

Download Submit
C:\Windows\System\LHVbmFN.exe

Filesize
1.9MB

MD5
597c1a1acb4784a7a452a0a5bd6dc39f

SHA1
28dd47401d952a2fc270e1eb9c8dd6fdcbcec67e

SHA256
1df02f9d229e59105437a8f7170d2928e65d7b44828ac8696d48eb7dcab5e2f9

SHA512
1ddc82fe90818d22f2d1f2dd27b69ceed3b84f92f0f409ce85844d88c406951e83bc6fd63f40be4eeee70f844dced6ae333f7c5cb9359ad35a67cdead58da73f

Download Submit
C:\Windows\System\MOwUkUl.exe

Filesize
1.8MB

MD5
ccf42c5d97ad97609af9b6ceb3bd6b0a

SHA1
fd3bfa26dac609b14c70ce5908f2c29b2428705d

SHA256
fff833c4daa0b109b9b892fbf35675e81ed568dd5c5ed1145a59185c3cbe476d

SHA512
5f892f97fd8bd36b161d92fc1dd69ee7b6959da7e70e651aa41d7488eb28038e1f6a8c4c258af2d1556b5a3acecb623bd6ca3e924f31d8d1f273d92780f3551d

Download Submit
C:\Windows\System\NfgcWre.exe

Filesize
1.9MB

MD5
4af79b75b7397086008166af0cb66029

SHA1
0b8f561ba5a899f81da4a3bb60dfa18c4bed2385

SHA256
dcf322043c757bd634612128b9ab27b8dd800d4a4ef348eb42b3058bf581fdbc

SHA512
34d92d089be589b5816959d24edbd4c9cc89a4c998f0cd3319a7a209e77db31403a9da1125dab6f5205fc63467c022c5c699f64cb53cbaca22b8b2a4f19daca8

Download Submit
C:\Windows\System\OrilNCU.exe

Filesize
1.9MB

MD5
f2225f4194e58538415bc773d2e62033

SHA1
42290db26c45ffe52f9d41b23f2dac02056db918

SHA256
5842a11f711048ddc35ab88e3432af3f0a67192dfd87101de0830e5d2004b37d

SHA512
59ae630fde18d980d76883371c3ee0b3f99a1b768c8f1a088a0894fabbfa90f91adf453f5a795b7a8410ff2ed6815cf757159571395d38a33bbf8ca4fffd4f81

Download Submit
C:\Windows\System\QRJqRVk.exe

Filesize
1.9MB

MD5
dc411cca7f207304a14b6c4514815639

SHA1
d85133ca4b37b4a4d95bc538df167d2b7fda2b2a

SHA256
cb41c7a97f75c2d360be951339bc0fa97f4d66cc1a501a980a619c1b4fff76c3

SHA512
81d63fe0c77ae3fb7c8bc7b50dd73073b7b290392e116e3cb15defff8f1195fbdf51b792830e6ed99254d289a8d6ee0b5068b17b942c0d4913add903d06fd97e

Download Submit
C:\Windows\System\TdKZiwV.exe

Filesize
1.8MB

MD5
04de5e16af2facdf92f46d5460c9bd77

SHA1
cb4b06163efe603caf2f5386cfa64b62289a4394

SHA256
d1eb71449f9f840e6f2962504cfe9d0245b8c1f7e8c30ae3da0310e061f392a1

SHA512
8345e4c205825a559beb7756cb150502e35b5682ba2f41e226bc42f5940a6a8519ce42fc3409ef641a2d2a565fa035e589be8141112227fe13b98bcc96c19c99

Download Submit
C:\Windows\System\WVgzDXT.exe

Filesize
1.8MB

MD5
f0355cc9127c091d048ae0d92fe4a5e8

SHA1
34ae25e62785c73789f7d31d70314a8b0a87c059

SHA256
f2e49eda3f41b8241e83406d8eec72ea94eb9fc444411b8a40c6e12b1ca1b97f

SHA512
0654d12798a1ec22f9c34cb16384be1bab2aca09ea174431f44362b46b7728fb371e462eba1401b88569a537225b09e5b424b2985ab6dc07d99bcce9b0f5fc16

Download Submit
C:\Windows\System\XAiwwjb.exe

Filesize
1.9MB

MD5
33cc3bdea07c6c3ab4f2f3f1587bdcee

SHA1
aa97bf08975c6540f7cac54e32ee46c8e9aac035

SHA256
21c4003600b7bc4c842bf9d8b1713fe0bf3e00b9072fb67f628d22731b36c9e1

SHA512
8b6ad0b7bd0577ebd4f300a2421f7f4f353f474a84286d0bc5d31620d3b6357e2aed82731d831777e46d99ffa290118f9e70decf1d30285037f876760ca17da9

Download Submit
C:\Windows\System\ZkacjPm.exe

Filesize
1.8MB

MD5
0affe9e5071f5d03162c14a5ef4e4455

SHA1
bbbbbfab5171439ea5f7699cd5a7f9fc8117b80f

SHA256
7d772de0276a4b58c50ade8c916a2da0bd3871a94c1245e9ac8adfa6a795fc0b

SHA512
a76be9c3c026c337d41547bd73d5d120ea04fdb74e84289cdbcf213b3de1ca676bcd4e44fc898e9d5aba82a08b10e4da9eef8d19d9d6d5e5e5ddb622057f39ce

Download Submit
C:\Windows\System\ZlBIoxp.exe

Filesize
1.8MB

MD5
f51070568d3b6cd52951e78abcd426a8

SHA1
f067b2029a799589605d67daa0f946c3d98bb232

SHA256
1bf5203e7df0c60e385ae3adeb969601f467bd6535d3ce68dbc4e1ec16bee4a6

SHA512
b3a18eb38621427d50c1181716261f227eab3bfc62a5a8c7169fc3a0f9400ea3657cf164779b358ace6ff195c02584762cc2e7423f3d0b9f726b639143284812

Download Submit
C:\Windows\System\cHNXYLl.exe

Filesize
1.9MB

MD5
dbe2f6f065945fbf694f5c9484e6ec3e

SHA1
4b28eb2138b8fdad5282246ad1919121b149b322

SHA256
559abbccc36cbf9797a1cd6c6e48e321034360da68cac3ff7e57284d8330e161

SHA512
c7218898add755a1c547227845c6ddefc05a5c94696cb63f27e476440ef9723b479aa45efd6137afcce453fc5bb2aabb288da197c353d9e69909863652f40013

Download Submit
C:\Windows\System\dqLyKGa.exe

Filesize
1.8MB

MD5
0d87224a4813e5edbdbf5a8618a1efc8

SHA1
325dd97ebe9536fe2196d075e329ebc77f4448f7

SHA256
0a8fe2b911410463c98b0c67f9d0f1744017df93e2534dc12b3a89f2f9e6495c

SHA512
62937db2dbd082d2d7c2e21cfd9f2389897a5ce2fbb29f6bc4a2f632cf87508c87496728d7dd82f7f49854e27c697b8b021bc6f3c361debddef3c47c88ace3ef

Download Submit
C:\Windows\System\gkgsVgI.exe

Filesize
1.9MB

MD5
82ec6def6afef03f20e2c5301c295c27

SHA1
28aa92f63e94f9b428e807a603776cde9a0bedaf

SHA256
52a14da5f5a01bfbac963cab4054c67848395b74005575c5fb1bcc939c71e8f0

SHA512
31bb5a5ba3923260e0519f573190df002f9b6739cd0afe53aec938d9de02d10a0d6c08ce4d976861a8c2f7534ca2f3c6d861bf3c9ac66503b8e92e627d50d801

Download Submit
C:\Windows\System\haqxmND.exe

Filesize
1.9MB

MD5
0447e659b272fdfe2fac79c2751268f8

SHA1
00df4175aecaec56de4010f61be208f4d4a56e01

SHA256
bda484ff74047d1c20aa8e96bae5233252c3d80bc4df5e6482e090ab8f579459

SHA512
1d0339be59e0ab02f95274f8b31a3e6b0934535bf6495e1c58e6c35f1e94015ec09b964f3744c65f9d68964b39f96e77e7795f3a6c45a88ae480a6d13d8237fa

Download Submit
C:\Windows\System\iNCdeDp.exe

Filesize
1.9MB

MD5
c85a101e079b12d68f6ba35bb64814b3

SHA1
8008bb44c9c1160a6602702243fc98edc8df143e

SHA256
058e1838698ae25c357db029f76d99a20e448f55e9af13961e8c81668d49a034

SHA512
f377014f1886b445028307f9e3dc380d46062fb9233c9ec587f9e5f3ef9663778c7d91bce32f8a8101818ebe80f028ad1697ce792a0ad425f1a4a0f383926b3d

Download Submit
C:\Windows\System\iZEDrNK.exe

Filesize
1.8MB

MD5
a1f24d8035cce4e92d0baeb09e0481ac

SHA1
341ec45f901c92df1c1f5ca2a07310d77eb697b5

SHA256
d17e64a5c6f75e69a31eb98ada6ce0281a23f871461df1c2b93ffb136ce2a3f9

SHA512
7eaba506639d73079602c17c3a1957c877b7ebb32ea94ec6ceed8d306a9f96a880c2171cd885344fce26ec2031e2c331165a6fae8822c4d2239425c875d6a5d0

Download Submit
C:\Windows\System\jFFCsAf.exe

Filesize
1.9MB

MD5
4926f2c3875e419c3955e5bab4773058

SHA1
0f5ce8d928b62352fc1e6cc802599549f7deff0e

SHA256
2eee97ad53089b1481deaa1be625e6dc764c9c5907dd944cd39b6680ba15f75b

SHA512
e1cc447e1e0acbb270925f3b87ec86452976e3856ac37e3dc1b8d2912d7719e5eab426826cc4016ae68b169817274095040a7c98f60a6ceb152ff7f2d60640b1

Download Submit
C:\Windows\System\jfkrBml.exe

Filesize
1.8MB

MD5
a46b2fa865979deef9167070d78ad591

SHA1
2bcadf824d97d9a387ab19d938ce5c92a1bb832c

SHA256
ac154a20670676f79c9785e04c07cdc559ea10854bdceb6eaaf1bbb505c0aaed

SHA512
31c471f6c4ffe928895fe675101c7aab7c64f14269d53d1946797abad41f551c21ab2a90081cc4f0ed49df5fa1a83cba9243b237412113dfe8c80346ddc3edcd

Download Submit
C:\Windows\System\kCjUnNK.exe

Filesize
1.9MB

MD5
74ba31dd5ba5031a13f8bd25d03e5017

SHA1
e626a14c8de2fa171681a96908555228560e86ce

SHA256
ba4723765a61d37967706c92a7e836348e303e5f586bcb2391eebd9a4864f369

SHA512
baf715b907fde09c2314e9c73a28fa32c6bc61b33902b32f3207eb65e0627ab471a88236f232966025fc1db714eb8259fa96d7535e3e78d70758e094bf9889fb

Download Submit
C:\Windows\System\lIXIiZj.exe

Filesize
1.9MB

MD5
7c0373d0093fe96d4c745d298b2bcd04

SHA1
96de23fe92c50200f91dde776989ab44a404e96d

SHA256
7e49fc5819f142989ea50f7def606802cdb2fede60877d3557fe15b5165b564b

SHA512
e691e1f1ba2525d6bbde2a391f2f48e999874c62ca9eba2449571342410d0775e8196b922585737413f0db3bbdb99c8798b15176d9725661c3ff74692b91f0dc

Download Submit
C:\Windows\System\ldeICaB.exe

Filesize
1.8MB

MD5
ca399583831a805ee7ca7969f09d0710

SHA1
9ba9d73eeafeee7026470cd8dfa164a5b2c29906

SHA256
d086a7fd8e2691e982a43c356d7be00ca91e31235e86de3059aaf5ea1bc93253

SHA512
608f0e27951090b09dffab79ea3d8df3c9587926729378784372fbd8f6b8b731c1259d12ab8b797e50b900748230ec15ec09bb8a26ed2ec36891ee6329ec7d9f

Download Submit
C:\Windows\System\nkAAozz.exe

Filesize
1.8MB

MD5
3aa0d8f3347a751e0eb33cdec816b974

SHA1
d83e15b4f415f39cd9aecd318998cbe1626c966b

SHA256
d72c712506ad7633e714920d0592f4ec4d8435a59cf27298d14710f3ed3ddcac

SHA512
716518b19265e1cf54718d305c75d8420610cbe77daa495e0482e1771095a0d9324a0fb608e5dfa725dc0a2507b405e458f0a205cfa6a7a81bfd2fb1aed1b231

Download Submit
C:\Windows\System\pDnuPzo.exe

Filesize
1.8MB

MD5
b9d880634b1d35999ea1752286d1e1ff

SHA1
cf5b96ed5cee61a37561e9a8f6b998ff0313b11b

SHA256
0b3b3ccf257d2e5d7f65e6a005d1a49e8c50889f48e8d69744d617702c254d2e

SHA512
1b94d0e2818e75948ea07de01ff6489aa4feb95c05985e517463a2d9889b84ca930da267d5fc8da03e3e3e80948ff03572f6c6307fc17f5a3ebb61b42dfb25c3

Download Submit
C:\Windows\System\qzygjGL.exe

Filesize
1.8MB

MD5
db51edc96e8ec765f6a64f861eefadff

SHA1
42020403876677b2b340eed5d37ed52aede757a1

SHA256
8c1e5629f89925f5e767c3b690a4351e3d788d4f5054d381092d1ebf0be97e0d

SHA512
9d3696154a1f7c925b2fda9daeec44a02a058655f64576d954551b0a9ec638c5a0d0eff6a7cb5d3f9cfadad512c2a486323fa36de586f91e22d2d9afdd08eef3

Download Submit
C:\Windows\System\rzyriRQ.exe

Filesize
1.9MB

MD5
65cadcdc74709e965ca1696232560e07

SHA1
4c815ec076290ff97c87e96e5a0934a54d47d4fe

SHA256
d608b9f71006e2f68937669cdd491aafed153235d4f48903e3e539b6be520047

SHA512
eb98b68f917b1040ed4955b2d0f54c8561487d680fed4c0f7ace250d738425ea77f2c7ffceeeed925b4f08af176c5ce1404b84cd3a1d04b87236a7f31b65b72f

Download Submit
C:\Windows\System\sGzWsyj.exe

Filesize
1.9MB

MD5
56eeac8973f425dfdf558e137f00dea2

SHA1
0ea6585611286129b307728427b3999c5118c926

SHA256
7be35109c23183d6594f01a595f12d11855e8167a8656f455a1863241b119c43

SHA512
c78fe22d70157780a5b3dae7750af914cc1da5f923ca55a44838db47117b545c7ebf04df63d99b99e706d8ca9ef32aabc7d25b6c6913f9c8d2c99615ea0d4a36

Download Submit
C:\Windows\System\sZUGGfs.exe

Filesize
1.8MB

MD5
a20d2d312eafdfbc605849947f152fa8

SHA1
9218cd231bd6d15de140ea907192a8efbbb5ec17

SHA256
92186aa36a1fd1bb6b96c786f3db283293710e35ee05b55dc44ba7baa1951132

SHA512
ccf78c0e3c7dc24c37a6c744ef013c2faaecfe9964a12155eab3eda5ae9dc6a27af173538f607fe82542ba7c00cf77315782683ea94f94e01cee07a3696d0051

Download Submit
C:\Windows\System\sphBgQi.exe

Filesize
1.8MB

MD5
03f7d259d1860eae751ad8dd17bba321

SHA1
c298c1d6ac9da0b6d0579b489af280e4bfb73a6a

SHA256
5f0125d5ba2656ef80862a4f06dea70deb3316ef2661be9d13dad8679f94d145

SHA512
4e44711bc6f13be6f6402b01216b367dc8cb4c591cd08062e7917f05b523e4d42ecd03be71b9880a8b5c5d69f74cc88e8684fae2e4b241655796ca37e79a9951

Download Submit
C:\Windows\System\tOCGLuQ.exe

Filesize
1.9MB

MD5
2af91990c49e57b7486ab59d3dd1d961

SHA1
c62767ab16598db49600e330ff0274babc4f69ad

SHA256
c22481675689dce701452d0afdd749b2084c893313ca4f8573887e77c555df36

SHA512
ca963ee5fd3714410e0b1e83b11d90746d419f95c18dc0f24423a32817b80dab5057900ea694dbdd352e462c3e9dab337d1bc14de6fd4caa57ae2eb3038b8c10

Download Submit
C:\Windows\System\tsetmWu.exe

Filesize
1.9MB

MD5
3df0b20153fd5f01a7bd21fcb9f883a7

SHA1
d9cdfc6b0dfb1f5d8eba654128dbaa2184276f0e

SHA256
9d1e775ae7d38c5e7e91b54fc0c6c263885155908a2b9e590068f683a9dc6464

SHA512
94de940f36ee6c38c665c6e232028d62bc8de96716ae38fba72fd91ee3d81477e01313361dde15fecbb4a130649702612f43541cee61d1cfa8a6647b7934fae6

Download Submit
C:\Windows\System\uJyIxMn.exe

Filesize
1.9MB

MD5
6844adb12cb166188b344a0ffc01157a

SHA1
18f5ad65b7c5365e8c167eb288cb3d9d3087aba4

SHA256
b77aa94d1b8a15b4aaee828e2c1cfaa665ff9f9e76c0aca5d9505d5411465c78

SHA512
d0d03e755381e1d358e7fd58e858647f66ffb96247685ad62900418a0c41f18bdd9a5e2e9333a5a41e3afe52103fd7116a5732def1202a81ee662fe3644f5445

Download Submit
C:\Windows\System\vSkklFK.exe

Filesize
1.9MB

MD5
3560350ed0c65206c873aa5e00bdd9cd

SHA1
c1e22ea683d8a44cb500dc6f9dcd6bd85295bd0c

SHA256
db844f124330048c219b3755771f69bb60329e6b812b2b4219fcd5efc4bf61fb

SHA512
e67af5db510b4581ddb7abaab6d16a1b2901c9709e6cff8284c479fbd18a60ee8a2fa21ad9f5dd390776553f8f928b421a90ebf8010377aa931ed95f550e4943

Download Submit
C:\Windows\System\xfvhSJR.exe

Filesize
1.8MB

MD5
6381d06ce7130f2528981267d56da1da

SHA1
58c2f225e7a99594a33b30585bedd014313c381c

SHA256
608c32bdc4cf168a867fb50d9aab3b413487ab8e4ee014d2495f8da2436da130

SHA512
3b37d72779f9c689061bec2ed12c962ea416f76204242f636a9b3a4a2fdaca30de637e1e99e7c7fb7920c7514574158096aeb7d528992513b00f8ea125f8e180

Download Submit
C:\Windows\System\zIrTchW.exe

Filesize
1.8MB

MD5
1ffa4ca4199301a0e59dfe9da287be21

SHA1
3e222b5b22dcc24492a31c498ae4c8b9a5a752b5

SHA256
49070f857053d45df55d1fb52e89f244dc6e16b245ca167aaddecf5e0fc07ef6

SHA512
b83f4394bb91f1384c7aa3ad454dcea8188a4834ada15ff7707781cd17907ce2ed9218e030748532a4521320c3cd97ff3f256d3ced24030b90991ed98751a594

Download Submit
C:\Windows\System\zntmbEp.exe

Filesize
1.9MB

MD5
cdfbcb71901b254980794b5534e23b7f

SHA1
9fa05689f393c6361723094aea09c256f475bcf4

SHA256
202dccdf13a3a28589678aef50bdb4b67134444f7e53c861530c775ad7505258

SHA512
808f2d094623363d97d463ef4924c8f49e0b388a2b46a9c10a2f9f21a706e3fdc70a872ff926a404ee348349fe578d8f32f6ada9f63d0d1f1c92f15b337a1c35

Download Submit
memory/860-190-0x00007FF795720000-0x00007FF795B12000-memory.dmp

Filesize
3.9MB

Download
memory/860-2217-0x00007FF795720000-0x00007FF795B12000-memory.dmp

Filesize
3.9MB

Download
memory/860-2164-0x00007FF795720000-0x00007FF795B12000-memory.dmp

Filesize
3.9MB

Download
memory/1172-2133-0x00007FF739880000-0x00007FF739C72000-memory.dmp

Filesize
3.9MB

Download
memory/1172-2197-0x00007FF739880000-0x00007FF739C72000-memory.dmp

Filesize
3.9MB

Download
memory/1172-100-0x00007FF739880000-0x00007FF739C72000-memory.dmp

Filesize
3.9MB

Download
memory/1180-226-0x00007FF713580000-0x00007FF713972000-memory.dmp

Filesize
3.9MB

Download
memory/1180-2165-0x00007FF713580000-0x00007FF713972000-memory.dmp

Filesize
3.9MB

Download
memory/1180-2206-0x00007FF713580000-0x00007FF713972000-memory.dmp

Filesize
3.9MB

Download
memory/1348-2182-0x00007FF7E1330000-0x00007FF7E1722000-memory.dmp

Filesize
3.9MB

Download
memory/1348-97-0x00007FF7E1330000-0x00007FF7E1722000-memory.dmp

Filesize
3.9MB

Download
memory/1672-2134-0x00007FF685CE0000-0x00007FF6860D2000-memory.dmp

Filesize
3.9MB

Download
memory/1672-102-0x00007FF685CE0000-0x00007FF6860D2000-memory.dmp

Filesize
3.9MB

Download
memory/1672-2188-0x00007FF685CE0000-0x00007FF6860D2000-memory.dmp

Filesize
3.9MB

Download
memory/1808-273-0x00007FF6959E0000-0x00007FF695DD2000-memory.dmp

Filesize
3.9MB

Download
memory/1808-2212-0x00007FF6959E0000-0x00007FF695DD2000-memory.dmp

Filesize
3.9MB

Download
memory/2176-613-0x0000019D9BE30000-0x0000019D9BE52000-memory.dmp

Filesize
136KB

Download
memory/2224-2136-0x00007FF7FDF40000-0x00007FF7FE332000-memory.dmp

Filesize
3.9MB

Download
memory/2224-104-0x00007FF7FDF40000-0x00007FF7FE332000-memory.dmp

Filesize
3.9MB

Download
memory/2224-2202-0x00007FF7FDF40000-0x00007FF7FE332000-memory.dmp

Filesize
3.9MB

Download
memory/2328-2198-0x00007FF712010000-0x00007FF712402000-memory.dmp

Filesize
3.9MB

Download
memory/2328-232-0x00007FF712010000-0x00007FF712402000-memory.dmp

Filesize
3.9MB

Download
memory/2732-2122-0x00007FF7E9B40000-0x00007FF7E9F32000-memory.dmp

Filesize
3.9MB

Download
memory/2732-2178-0x00007FF7E9B40000-0x00007FF7E9F32000-memory.dmp

Filesize
3.9MB

Download
memory/2732-38-0x00007FF7E9B40000-0x00007FF7E9F32000-memory.dmp

Filesize
3.9MB

Download
memory/2888-101-0x00007FF7D4C80000-0x00007FF7D5072000-memory.dmp

Filesize
3.9MB

Download
memory/2888-2186-0x00007FF7D4C80000-0x00007FF7D5072000-memory.dmp

Filesize
3.9MB

Download
memory/2944-2180-0x00007FF61A240000-0x00007FF61A632000-memory.dmp

Filesize
3.9MB

Download
memory/2944-98-0x00007FF61A240000-0x00007FF61A632000-memory.dmp

Filesize
3.9MB

Download
memory/2968-107-0x00007FF7257F0000-0x00007FF725BE2000-memory.dmp

Filesize
3.9MB

Download
memory/2968-2185-0x00007FF7257F0000-0x00007FF725BE2000-memory.dmp

Filesize
3.9MB

Download
memory/3132-2121-0x00007FF7FFA90000-0x00007FF7FFE82000-memory.dmp

Filesize
3.9MB

Download
memory/3132-32-0x00007FF7FFA90000-0x00007FF7FFE82000-memory.dmp

Filesize
3.9MB

Download
memory/3132-2177-0x00007FF7FFA90000-0x00007FF7FFE82000-memory.dmp

Filesize
3.9MB

Download
memory/3256-2200-0x00007FF7F53A0000-0x00007FF7F5792000-memory.dmp

Filesize
3.9MB

Download
memory/3256-2135-0x00007FF7F53A0000-0x00007FF7F5792000-memory.dmp

Filesize
3.9MB

Download
memory/3256-103-0x00007FF7F53A0000-0x00007FF7F5792000-memory.dmp

Filesize
3.9MB

Download
memory/3520-335-0x00007FF633840000-0x00007FF633C32000-memory.dmp

Filesize
3.9MB

Download
memory/3520-2228-0x00007FF633840000-0x00007FF633C32000-memory.dmp

Filesize
3.9MB

Download
memory/3540-2172-0x00007FF6E54A0000-0x00007FF6E5892000-memory.dmp

Filesize
3.9MB

Download
memory/3540-2095-0x00007FF6E54A0000-0x00007FF6E5892000-memory.dmp

Filesize
3.9MB

Download
memory/3540-17-0x00007FF6E54A0000-0x00007FF6E5892000-memory.dmp

Filesize
3.9MB

Download
memory/3564-15-0x00007FF684540000-0x00007FF684932000-memory.dmp

Filesize
3.9MB

Download
memory/3564-2167-0x00007FF684540000-0x00007FF684932000-memory.dmp

Filesize
3.9MB

Download
memory/3964-2190-0x00007FF71B3C0000-0x00007FF71B7B2000-memory.dmp

Filesize
3.9MB

Download
memory/3964-106-0x00007FF71B3C0000-0x00007FF71B7B2000-memory.dmp

Filesize
3.9MB

Download
memory/3964-2138-0x00007FF71B3C0000-0x00007FF71B7B2000-memory.dmp

Filesize
3.9MB

Download
memory/4108-44-0x00007FF639980000-0x00007FF639D72000-memory.dmp

Filesize
3.9MB

Download
memory/4108-2193-0x00007FF639980000-0x00007FF639D72000-memory.dmp

Filesize
3.9MB

Download
memory/4108-2123-0x00007FF639980000-0x00007FF639D72000-memory.dmp

Filesize
3.9MB

Download
memory/4564-0-0x00007FF6D9630000-0x00007FF6D9A22000-memory.dmp

Filesize
3.9MB

Download
memory/4564-2023-0x00007FF6D9630000-0x00007FF6D9A22000-memory.dmp

Filesize
3.9MB

Download
memory/4564-1-0x00000169A1E30000-0x00000169A1E40000-memory.dmp

Filesize
64KB

Download
memory/4656-2207-0x00007FF674120000-0x00007FF674512000-memory.dmp

Filesize
3.9MB

Download
memory/4656-155-0x00007FF674120000-0x00007FF674512000-memory.dmp

Filesize
3.9MB

Download
memory/4656-2163-0x00007FF674120000-0x00007FF674512000-memory.dmp

Filesize
3.9MB

Download
memory/4684-71-0x00007FF611F90000-0x00007FF612382000-memory.dmp

Filesize
3.9MB

Download
memory/4684-2175-0x00007FF611F90000-0x00007FF612382000-memory.dmp

Filesize
3.9MB

Download
memory/4688-19-0x00007FF651250000-0x00007FF651642000-memory.dmp

Filesize
3.9MB

Download
memory/4688-2120-0x00007FF651250000-0x00007FF651642000-memory.dmp

Filesize
3.9MB

Download
memory/4688-2171-0x00007FF651250000-0x00007FF651642000-memory.dmp

Filesize
3.9MB

Download
memory/5008-2132-0x00007FF79E510000-0x00007FF79E902000-memory.dmp

Filesize
3.9MB

Download
memory/5008-2195-0x00007FF79E510000-0x00007FF79E902000-memory.dmp

Filesize
3.9MB

Download
memory/5008-99-0x00007FF79E510000-0x00007FF79E902000-memory.dmp

Filesize
3.9MB

Download
memory/5032-2137-0x00007FF7806B0000-0x00007FF780AA2000-memory.dmp

Filesize
3.9MB

Download
memory/5032-105-0x00007FF7806B0000-0x00007FF780AA2000-memory.dmp

Filesize
3.9MB

Download
memory/5032-2209-0x00007FF7806B0000-0x00007FF780AA2000-memory.dmp

Filesize
3.9MB

Download