xmrig | 00790883900dfd22bba15fc5d68b76f1f02c66cdc643973927577c866cfa1f8a

Analysis

max time kernel
64s
max time network
58s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 02:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
Size

2.0MB
MD5

04282f22fc632efba75f689e2f368b66
SHA1

a3be2ddfcb598342c2ce25547909f0ebfa9461d2
SHA256

00790883900dfd22bba15fc5d68b76f1f02c66cdc643973927577c866cfa1f8a
SHA512

7040fd7e5684c8a181116dfbea0a0d98240632956d34ae668c600bd543abdb9e3bfa64a7719edb58eb933c3f6e662095910738332bc8d0398fc0066e9822b0d3
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafxhZ:NABO

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 41 IoCs

miner

resource	yara_rule
behavioral2/memory/2796-218-0x00007FF6EF960000-0x00007FF6EFD52000-memory.dmp	xmrig
behavioral2/memory/1316-225-0x00007FF657C10000-0x00007FF658002000-memory.dmp	xmrig
behavioral2/memory/2700-307-0x00007FF669D90000-0x00007FF66A182000-memory.dmp	xmrig
behavioral2/memory/3644-253-0x00007FF7F1970000-0x00007FF7F1D62000-memory.dmp	xmrig
behavioral2/memory/1912-345-0x00007FF6E2F30000-0x00007FF6E3322000-memory.dmp	xmrig
behavioral2/memory/3288-597-0x00007FF6810C0000-0x00007FF6814B2000-memory.dmp	xmrig
behavioral2/memory/1392-600-0x00007FF66FCE0000-0x00007FF6700D2000-memory.dmp	xmrig
behavioral2/memory/3268-599-0x00007FF752FE0000-0x00007FF7533D2000-memory.dmp	xmrig
behavioral2/memory/2456-596-0x00007FF79A970000-0x00007FF79AD62000-memory.dmp	xmrig
behavioral2/memory/1540-526-0x00007FF77AAC0000-0x00007FF77AEB2000-memory.dmp	xmrig
behavioral2/memory/3080-434-0x00007FF787850000-0x00007FF787C42000-memory.dmp	xmrig
behavioral2/memory/1556-428-0x00007FF6D7540000-0x00007FF6D7932000-memory.dmp	xmrig
behavioral2/memory/2396-226-0x00007FF645370000-0x00007FF645762000-memory.dmp	xmrig
behavioral2/memory/3672-173-0x00007FF670880000-0x00007FF670C72000-memory.dmp	xmrig
behavioral2/memory/4556-153-0x00007FF7030F0000-0x00007FF7034E2000-memory.dmp	xmrig
behavioral2/memory/1936-115-0x00007FF7EF990000-0x00007FF7EFD82000-memory.dmp	xmrig
behavioral2/memory/3648-2477-0x00007FF7B33C0000-0x00007FF7B37B2000-memory.dmp	xmrig
behavioral2/memory/1080-2510-0x00007FF64D3A0000-0x00007FF64D792000-memory.dmp	xmrig
behavioral2/memory/4536-2511-0x00007FF62A9A0000-0x00007FF62AD92000-memory.dmp	xmrig
behavioral2/memory/4020-2512-0x00007FF72B9B0000-0x00007FF72BDA2000-memory.dmp	xmrig
behavioral2/memory/3648-2514-0x00007FF7B33C0000-0x00007FF7B37B2000-memory.dmp	xmrig
behavioral2/memory/3288-2520-0x00007FF6810C0000-0x00007FF6814B2000-memory.dmp	xmrig
behavioral2/memory/1080-2522-0x00007FF64D3A0000-0x00007FF64D792000-memory.dmp	xmrig
behavioral2/memory/3672-2524-0x00007FF670880000-0x00007FF670C72000-memory.dmp	xmrig
behavioral2/memory/1104-2517-0x00007FF707E70000-0x00007FF708262000-memory.dmp	xmrig
behavioral2/memory/4556-2519-0x00007FF7030F0000-0x00007FF7034E2000-memory.dmp	xmrig
behavioral2/memory/1912-2562-0x00007FF6E2F30000-0x00007FF6E3322000-memory.dmp	xmrig
behavioral2/memory/2396-2555-0x00007FF645370000-0x00007FF645762000-memory.dmp	xmrig
behavioral2/memory/3644-2553-0x00007FF7F1970000-0x00007FF7F1D62000-memory.dmp	xmrig
behavioral2/memory/1392-2548-0x00007FF66FCE0000-0x00007FF6700D2000-memory.dmp	xmrig
behavioral2/memory/2456-2560-0x00007FF79A970000-0x00007FF79AD62000-memory.dmp	xmrig
behavioral2/memory/1556-2541-0x00007FF6D7540000-0x00007FF6D7932000-memory.dmp	xmrig
behavioral2/memory/1540-2550-0x00007FF77AAC0000-0x00007FF77AEB2000-memory.dmp	xmrig
behavioral2/memory/3268-2537-0x00007FF752FE0000-0x00007FF7533D2000-memory.dmp	xmrig
behavioral2/memory/2796-2535-0x00007FF6EF960000-0x00007FF6EFD52000-memory.dmp	xmrig
behavioral2/memory/4536-2531-0x00007FF62A9A0000-0x00007FF62AD92000-memory.dmp	xmrig
behavioral2/memory/1316-2529-0x00007FF657C10000-0x00007FF658002000-memory.dmp	xmrig
behavioral2/memory/1936-2528-0x00007FF7EF990000-0x00007FF7EFD82000-memory.dmp	xmrig
behavioral2/memory/2700-2547-0x00007FF669D90000-0x00007FF66A182000-memory.dmp	xmrig
behavioral2/memory/3080-2539-0x00007FF787850000-0x00007FF787C42000-memory.dmp	xmrig
behavioral2/memory/4020-2533-0x00007FF72B9B0000-0x00007FF72BDA2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3648	XJwdeqH.exe
1080	AWzSgVp.exe
1104	JznieXO.exe
4536	PbgncOx.exe
4020	VGmCKBc.exe
1936	urKWDsx.exe
3288	JMZwtuf.exe
4556	VYFYdYp.exe
3672	zmTvVQo.exe
2796	YpQAcko.exe
1316	GjKKNZl.exe
2396	psxXowY.exe
3644	NCCosJS.exe
3268	teqmzsT.exe
2700	SeYlzuL.exe
1912	MZRdbND.exe
1556	yuXfpdN.exe
3080	oVShYKY.exe
1540	yrkiNCI.exe
1392	gDARjmo.exe
2456	FtnPVDQ.exe
3540	nqzGbqo.exe
2844	DVAeaIm.exe
3792	VwMRMCT.exe
740	wrmABJh.exe
3984	vAjloBU.exe
3584	MfmIpvi.exe
4720	hDSQlYG.exe
3876	ScpKgJP.exe
2400	yMQFDQW.exe
1472	XtUJSQU.exe
840	UQAawyT.exe
4924	zrsEWKR.exe
2244	CsipGBG.exe
4728	mubEoyt.exe
3968	jjzuRrU.exe
1716	ttORnAE.exe
1204	zkmYqPc.exe
5100	FRNxIfC.exe
1840	zkMrByv.exe
1948	dQXMzEs.exe
3580	qOHaZkM.exe
1252	leRgYcn.exe
3188	vWNVvrI.exe
3960	LfrWaPV.exe
3528	yzQyMNk.exe
2140	lQEamUy.exe
4348	bdItgOR.exe
4276	VUZowjZ.exe
4732	eVyVDGB.exe
2072	Ikufnpb.exe
4684	ntEONeq.exe
3596	jsmqObE.exe
4796	ZsydabH.exe
4432	DFALYWU.exe
2172	poqgoWD.exe
4488	FWDUjTT.exe
2720	TOcUFgR.exe
4292	ILwTHNQ.exe
516	MeSEJpO.exe
3972	kYdCKQU.exe
4144	UTHRfJt.exe
528	QVuqClX.exe
1284	hKXsEit.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4104-0-0x00007FF784EA0000-0x00007FF785292000-memory.dmp	upx
behavioral2/files/0x000b000000023b6d-5.dat	upx
behavioral2/files/0x000a000000023b72-7.dat	upx
behavioral2/memory/3648-15-0x00007FF7B33C0000-0x00007FF7B37B2000-memory.dmp	upx
behavioral2/files/0x000a000000023b77-33.dat	upx
behavioral2/memory/4536-66-0x00007FF62A9A0000-0x00007FF62AD92000-memory.dmp	upx
behavioral2/files/0x000a000000023b79-98.dat	upx
behavioral2/files/0x000a000000023b81-136.dat	upx
behavioral2/files/0x000a000000023b8e-168.dat	upx
behavioral2/memory/2796-218-0x00007FF6EF960000-0x00007FF6EFD52000-memory.dmp	upx
behavioral2/memory/1316-225-0x00007FF657C10000-0x00007FF658002000-memory.dmp	upx
behavioral2/memory/2700-307-0x00007FF669D90000-0x00007FF66A182000-memory.dmp	upx
behavioral2/memory/3644-253-0x00007FF7F1970000-0x00007FF7F1D62000-memory.dmp	upx
behavioral2/memory/1912-345-0x00007FF6E2F30000-0x00007FF6E3322000-memory.dmp	upx
behavioral2/memory/3288-597-0x00007FF6810C0000-0x00007FF6814B2000-memory.dmp	upx
behavioral2/memory/1392-600-0x00007FF66FCE0000-0x00007FF6700D2000-memory.dmp	upx
behavioral2/memory/3268-599-0x00007FF752FE0000-0x00007FF7533D2000-memory.dmp	upx
behavioral2/memory/2456-596-0x00007FF79A970000-0x00007FF79AD62000-memory.dmp	upx
behavioral2/memory/1540-526-0x00007FF77AAC0000-0x00007FF77AEB2000-memory.dmp	upx
behavioral2/memory/3080-434-0x00007FF787850000-0x00007FF787C42000-memory.dmp	upx
behavioral2/memory/1556-428-0x00007FF6D7540000-0x00007FF6D7932000-memory.dmp	upx
behavioral2/memory/2396-226-0x00007FF645370000-0x00007FF645762000-memory.dmp	upx
behavioral2/files/0x000a000000023b84-184.dat	upx
behavioral2/files/0x000a000000023b7f-180.dat	upx
behavioral2/files/0x000a000000023b97-178.dat	upx
behavioral2/files/0x000a000000023b90-175.dat	upx
behavioral2/memory/3672-173-0x00007FF670880000-0x00007FF670C72000-memory.dmp	upx
behavioral2/files/0x000a000000023b96-171.dat	upx
behavioral2/files/0x000a000000023b95-170.dat	upx
behavioral2/files/0x000a000000023b8d-166.dat	upx
behavioral2/files/0x000a000000023b94-165.dat	upx
behavioral2/files/0x000a000000023b93-164.dat	upx
behavioral2/files/0x000a000000023b92-163.dat	upx
behavioral2/files/0x000a000000023b8c-161.dat	upx
behavioral2/files/0x000a000000023b91-160.dat	upx
behavioral2/files/0x000a000000023b7e-156.dat	upx
behavioral2/memory/4556-153-0x00007FF7030F0000-0x00007FF7034E2000-memory.dmp	upx
behavioral2/files/0x000a000000023b8f-150.dat	upx
behavioral2/files/0x000a000000023b82-139.dat	upx
behavioral2/files/0x000a000000023b7c-131.dat	upx
behavioral2/files/0x000a000000023b7b-129.dat	upx
behavioral2/files/0x000a000000023b8b-128.dat	upx
behavioral2/files/0x000a000000023b8a-127.dat	upx
behavioral2/files/0x000a000000023b80-126.dat	upx
behavioral2/files/0x000a000000023b89-125.dat	upx
behavioral2/files/0x000a000000023b88-124.dat	upx
behavioral2/files/0x000a000000023b87-123.dat	upx
behavioral2/files/0x000a000000023b86-122.dat	upx
behavioral2/files/0x000a000000023b85-121.dat	upx
behavioral2/files/0x000a000000023b7d-116.dat	upx
behavioral2/memory/1936-115-0x00007FF7EF990000-0x00007FF7EFD82000-memory.dmp	upx
behavioral2/files/0x000a000000023b83-106.dat	upx
behavioral2/memory/4020-105-0x00007FF72B9B0000-0x00007FF72BDA2000-memory.dmp	upx
behavioral2/files/0x000a000000023b7a-93.dat	upx
behavioral2/files/0x000a000000023b75-84.dat	upx
behavioral2/files/0x000a000000023b74-77.dat	upx
behavioral2/files/0x000a000000023b78-74.dat	upx
behavioral2/files/0x000a000000023b71-57.dat	upx
behavioral2/files/0x000a000000023b73-56.dat	upx
behavioral2/memory/1104-43-0x00007FF707E70000-0x00007FF708262000-memory.dmp	upx
behavioral2/memory/1080-40-0x00007FF64D3A0000-0x00007FF64D792000-memory.dmp	upx
behavioral2/files/0x000a000000023b76-35.dat	upx
behavioral2/memory/3648-2477-0x00007FF7B33C0000-0x00007FF7B37B2000-memory.dmp	upx
behavioral2/memory/1080-2510-0x00007FF64D3A0000-0x00007FF64D792000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\EqFunmH.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\dWMObAG.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\MZCENFQ.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\WVPqinV.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\CudhTzv.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\mJNQmch.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\BgXjqRg.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\IsbFths.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\wrmABJh.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\JYSPYPz.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\QASiflZ.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\PGCdAcp.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\rKMozVQ.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\WxtcPbW.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\wGamuMX.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\xvoSCnQ.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\uBsdQIX.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\jaJbMfF.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\xypTfcb.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\VHrWexF.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\ErTFGfI.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\NlNbTvt.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\YYOcIdj.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\XYuJsIU.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\ygPcuOA.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\AkRzzcI.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\AHdDiET.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\hBzYSaN.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\BuJzGVM.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\oFcITOu.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\PPSHXLY.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\ouZXTFB.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\jKxHHFd.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\zdfJpjE.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\rwyqzhM.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\XtUJSQU.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\ymdmwNV.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\pvGaqcb.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\VEFrPFX.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\gcBCNRq.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\lYwInHI.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\wTGzvEO.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\mNUSEiJ.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\wUCYVhh.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\yVSFzne.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\AosKixV.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\ornxWhm.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\psxXowY.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\NOaSzVN.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\uZulUys.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\DNfiylt.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\tdIIKME.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\QTJOnzr.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\TqGbTPb.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\brIyTpN.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\FZvltsy.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\VEQblQw.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\xSWAGYq.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\CoddKKE.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\gOmWMmN.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\FqsztGC.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\SFyryPs.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\XaJZSnO.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
File created	C:\Windows\System\NIhkaoT.exe	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3476	powershell.exe
3476	powershell.exe
3476	powershell.exe
3476	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
Token: SeDebugPrivilege	3476	powershell.exe
Token: SeLockMemoryPrivilege	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4104 wrote to memory of 3476	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	84
PID 4104 wrote to memory of 3476	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	84
PID 4104 wrote to memory of 3648	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	85
PID 4104 wrote to memory of 3648	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	85
PID 4104 wrote to memory of 1936	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	86
PID 4104 wrote to memory of 1936	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	86
PID 4104 wrote to memory of 1080	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	87
PID 4104 wrote to memory of 1080	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	87
PID 4104 wrote to memory of 1104	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	88
PID 4104 wrote to memory of 1104	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	88
PID 4104 wrote to memory of 4536	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	89
PID 4104 wrote to memory of 4536	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	89
PID 4104 wrote to memory of 4020	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	90
PID 4104 wrote to memory of 4020	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	90
PID 4104 wrote to memory of 3288	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	91
PID 4104 wrote to memory of 3288	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	91
PID 4104 wrote to memory of 4556	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	92
PID 4104 wrote to memory of 4556	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	92
PID 4104 wrote to memory of 3672	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	93
PID 4104 wrote to memory of 3672	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	93
PID 4104 wrote to memory of 2796	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	94
PID 4104 wrote to memory of 2796	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	94
PID 4104 wrote to memory of 1316	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	95
PID 4104 wrote to memory of 1316	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	95
PID 4104 wrote to memory of 2396	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	96
PID 4104 wrote to memory of 2396	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	96
PID 4104 wrote to memory of 3644	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	97
PID 4104 wrote to memory of 3644	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	97
PID 4104 wrote to memory of 3268	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	98
PID 4104 wrote to memory of 3268	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	98
PID 4104 wrote to memory of 2700	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	99
PID 4104 wrote to memory of 2700	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	99
PID 4104 wrote to memory of 1912	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	100
PID 4104 wrote to memory of 1912	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	100
PID 4104 wrote to memory of 3984	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	101
PID 4104 wrote to memory of 3984	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	101
PID 4104 wrote to memory of 1556	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	102
PID 4104 wrote to memory of 1556	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	102
PID 4104 wrote to memory of 3080	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	103
PID 4104 wrote to memory of 3080	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	103
PID 4104 wrote to memory of 1540	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	104
PID 4104 wrote to memory of 1540	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	104
PID 4104 wrote to memory of 1392	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	105
PID 4104 wrote to memory of 1392	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	105
PID 4104 wrote to memory of 2456	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	106
PID 4104 wrote to memory of 2456	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	106
PID 4104 wrote to memory of 3540	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	107
PID 4104 wrote to memory of 3540	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	107
PID 4104 wrote to memory of 2844	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	108
PID 4104 wrote to memory of 2844	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	108
PID 4104 wrote to memory of 3792	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	109
PID 4104 wrote to memory of 3792	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	109
PID 4104 wrote to memory of 740	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	110
PID 4104 wrote to memory of 740	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	110
PID 4104 wrote to memory of 3584	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	111
PID 4104 wrote to memory of 3584	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	111
PID 4104 wrote to memory of 4720	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	112
PID 4104 wrote to memory of 4720	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	112
PID 4104 wrote to memory of 3876	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	113
PID 4104 wrote to memory of 3876	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	113
PID 4104 wrote to memory of 2400	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	114
PID 4104 wrote to memory of 2400	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	114
PID 4104 wrote to memory of 1472	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	115
PID 4104 wrote to memory of 1472	4104	04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\04282f22fc632efba75f689e2f368b66_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3476
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "3476" "1928" "1864" "1932" "0" "0" "1936" "0" "0" "0" "0" "0"
    3⤵
    PID:13280
- C:\Windows\System\XJwdeqH.exe
  C:\Windows\System\XJwdeqH.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\urKWDsx.exe
  C:\Windows\System\urKWDsx.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\AWzSgVp.exe
  C:\Windows\System\AWzSgVp.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\JznieXO.exe
  C:\Windows\System\JznieXO.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\PbgncOx.exe
  C:\Windows\System\PbgncOx.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\VGmCKBc.exe
  C:\Windows\System\VGmCKBc.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\JMZwtuf.exe
  C:\Windows\System\JMZwtuf.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\VYFYdYp.exe
  C:\Windows\System\VYFYdYp.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\zmTvVQo.exe
  C:\Windows\System\zmTvVQo.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\YpQAcko.exe
  C:\Windows\System\YpQAcko.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\GjKKNZl.exe
  C:\Windows\System\GjKKNZl.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\psxXowY.exe
  C:\Windows\System\psxXowY.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\NCCosJS.exe
  C:\Windows\System\NCCosJS.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\teqmzsT.exe
  C:\Windows\System\teqmzsT.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\SeYlzuL.exe
  C:\Windows\System\SeYlzuL.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\MZRdbND.exe
  C:\Windows\System\MZRdbND.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\vAjloBU.exe
  C:\Windows\System\vAjloBU.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\yuXfpdN.exe
  C:\Windows\System\yuXfpdN.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\oVShYKY.exe
  C:\Windows\System\oVShYKY.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\yrkiNCI.exe
  C:\Windows\System\yrkiNCI.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\gDARjmo.exe
  C:\Windows\System\gDARjmo.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\FtnPVDQ.exe
  C:\Windows\System\FtnPVDQ.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\nqzGbqo.exe
  C:\Windows\System\nqzGbqo.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\DVAeaIm.exe
  C:\Windows\System\DVAeaIm.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\VwMRMCT.exe
  C:\Windows\System\VwMRMCT.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System\wrmABJh.exe
  C:\Windows\System\wrmABJh.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\MfmIpvi.exe
  C:\Windows\System\MfmIpvi.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\hDSQlYG.exe
  C:\Windows\System\hDSQlYG.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\ScpKgJP.exe
  C:\Windows\System\ScpKgJP.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\yMQFDQW.exe
  C:\Windows\System\yMQFDQW.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\XtUJSQU.exe
  C:\Windows\System\XtUJSQU.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\UQAawyT.exe
  C:\Windows\System\UQAawyT.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\zrsEWKR.exe
  C:\Windows\System\zrsEWKR.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\CsipGBG.exe
  C:\Windows\System\CsipGBG.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\mubEoyt.exe
  C:\Windows\System\mubEoyt.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\jjzuRrU.exe
  C:\Windows\System\jjzuRrU.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\ttORnAE.exe
  C:\Windows\System\ttORnAE.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\zkmYqPc.exe
  C:\Windows\System\zkmYqPc.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\FRNxIfC.exe
  C:\Windows\System\FRNxIfC.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\zkMrByv.exe
  C:\Windows\System\zkMrByv.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\dQXMzEs.exe
  C:\Windows\System\dQXMzEs.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\qOHaZkM.exe
  C:\Windows\System\qOHaZkM.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\leRgYcn.exe
  C:\Windows\System\leRgYcn.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\vWNVvrI.exe
  C:\Windows\System\vWNVvrI.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System\LfrWaPV.exe
  C:\Windows\System\LfrWaPV.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\yzQyMNk.exe
  C:\Windows\System\yzQyMNk.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\lQEamUy.exe
  C:\Windows\System\lQEamUy.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\bdItgOR.exe
  C:\Windows\System\bdItgOR.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\VUZowjZ.exe
  C:\Windows\System\VUZowjZ.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\eVyVDGB.exe
  C:\Windows\System\eVyVDGB.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\Ikufnpb.exe
  C:\Windows\System\Ikufnpb.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\ntEONeq.exe
  C:\Windows\System\ntEONeq.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\jsmqObE.exe
  C:\Windows\System\jsmqObE.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\ZsydabH.exe
  C:\Windows\System\ZsydabH.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\DFALYWU.exe
  C:\Windows\System\DFALYWU.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\poqgoWD.exe
  C:\Windows\System\poqgoWD.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\FWDUjTT.exe
  C:\Windows\System\FWDUjTT.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\TOcUFgR.exe
  C:\Windows\System\TOcUFgR.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\ILwTHNQ.exe
  C:\Windows\System\ILwTHNQ.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\MeSEJpO.exe
  C:\Windows\System\MeSEJpO.exe
  2⤵
  - Executes dropped EXE
  PID:516
- C:\Windows\System\kYdCKQU.exe
  C:\Windows\System\kYdCKQU.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\UTHRfJt.exe
  C:\Windows\System\UTHRfJt.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\QVuqClX.exe
  C:\Windows\System\QVuqClX.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\hKXsEit.exe
  C:\Windows\System\hKXsEit.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\cqBTrJG.exe
  C:\Windows\System\cqBTrJG.exe
  2⤵
  PID:536
- C:\Windows\System\njlfAYy.exe
  C:\Windows\System\njlfAYy.exe
  2⤵
  PID:3688
- C:\Windows\System\TcaBNJw.exe
  C:\Windows\System\TcaBNJw.exe
  2⤵
  PID:1568
- C:\Windows\System\OnNSeSc.exe
  C:\Windows\System\OnNSeSc.exe
  2⤵
  PID:1660
- C:\Windows\System\nyVzPul.exe
  C:\Windows\System\nyVzPul.exe
  2⤵
  PID:4512
- C:\Windows\System\WuszdjE.exe
  C:\Windows\System\WuszdjE.exe
  2⤵
  PID:1720
- C:\Windows\System\xSjNLde.exe
  C:\Windows\System\xSjNLde.exe
  2⤵
  PID:5076
- C:\Windows\System\hJojGTH.exe
  C:\Windows\System\hJojGTH.exe
  2⤵
  PID:932
- C:\Windows\System\UrLKgkJ.exe
  C:\Windows\System\UrLKgkJ.exe
  2⤵
  PID:5132
- C:\Windows\System\HbFUpPY.exe
  C:\Windows\System\HbFUpPY.exe
  2⤵
  PID:5156
- C:\Windows\System\VTGosYU.exe
  C:\Windows\System\VTGosYU.exe
  2⤵
  PID:5180
- C:\Windows\System\QEjmLUv.exe
  C:\Windows\System\QEjmLUv.exe
  2⤵
  PID:5200
- C:\Windows\System\OWrOjvj.exe
  C:\Windows\System\OWrOjvj.exe
  2⤵
  PID:5224
- C:\Windows\System\NlNbTvt.exe
  C:\Windows\System\NlNbTvt.exe
  2⤵
  PID:5244
- C:\Windows\System\vmzhtcO.exe
  C:\Windows\System\vmzhtcO.exe
  2⤵
  PID:5260
- C:\Windows\System\BZOxsdL.exe
  C:\Windows\System\BZOxsdL.exe
  2⤵
  PID:5276
- C:\Windows\System\eqrNMjn.exe
  C:\Windows\System\eqrNMjn.exe
  2⤵
  PID:5292
- C:\Windows\System\qqyHVLj.exe
  C:\Windows\System\qqyHVLj.exe
  2⤵
  PID:5324
- C:\Windows\System\sNPurXN.exe
  C:\Windows\System\sNPurXN.exe
  2⤵
  PID:5340
- C:\Windows\System\EaoFxPg.exe
  C:\Windows\System\EaoFxPg.exe
  2⤵
  PID:5360
- C:\Windows\System\RFQwkYo.exe
  C:\Windows\System\RFQwkYo.exe
  2⤵
  PID:5380
- C:\Windows\System\IGlhnVf.exe
  C:\Windows\System\IGlhnVf.exe
  2⤵
  PID:5400
- C:\Windows\System\lxFiYaY.exe
  C:\Windows\System\lxFiYaY.exe
  2⤵
  PID:5416
- C:\Windows\System\NyjyVxc.exe
  C:\Windows\System\NyjyVxc.exe
  2⤵
  PID:5436
- C:\Windows\System\BfoLCnt.exe
  C:\Windows\System\BfoLCnt.exe
  2⤵
  PID:5452
- C:\Windows\System\fuoenIb.exe
  C:\Windows\System\fuoenIb.exe
  2⤵
  PID:5476
- C:\Windows\System\nEfflta.exe
  C:\Windows\System\nEfflta.exe
  2⤵
  PID:5500
- C:\Windows\System\mxFuUyG.exe
  C:\Windows\System\mxFuUyG.exe
  2⤵
  PID:5524
- C:\Windows\System\WIiozqI.exe
  C:\Windows\System\WIiozqI.exe
  2⤵
  PID:5552
- C:\Windows\System\uxcFnUt.exe
  C:\Windows\System\uxcFnUt.exe
  2⤵
  PID:5568
- C:\Windows\System\rWCnvyY.exe
  C:\Windows\System\rWCnvyY.exe
  2⤵
  PID:5584
- C:\Windows\System\iPodCHi.exe
  C:\Windows\System\iPodCHi.exe
  2⤵
  PID:5604
- C:\Windows\System\SFFHuLB.exe
  C:\Windows\System\SFFHuLB.exe
  2⤵
  PID:5632
- C:\Windows\System\uJKkAxi.exe
  C:\Windows\System\uJKkAxi.exe
  2⤵
  PID:5652
- C:\Windows\System\JyAWNJz.exe
  C:\Windows\System\JyAWNJz.exe
  2⤵
  PID:5672
- C:\Windows\System\yPaGANM.exe
  C:\Windows\System\yPaGANM.exe
  2⤵
  PID:5688
- C:\Windows\System\twHyYNx.exe
  C:\Windows\System\twHyYNx.exe
  2⤵
  PID:5704
- C:\Windows\System\PIVPJDK.exe
  C:\Windows\System\PIVPJDK.exe
  2⤵
  PID:5720
- C:\Windows\System\NOaSzVN.exe
  C:\Windows\System\NOaSzVN.exe
  2⤵
  PID:5736
- C:\Windows\System\ODdpePw.exe
  C:\Windows\System\ODdpePw.exe
  2⤵
  PID:5752
- C:\Windows\System\yYFCIwa.exe
  C:\Windows\System\yYFCIwa.exe
  2⤵
  PID:5772
- C:\Windows\System\jXAmZAg.exe
  C:\Windows\System\jXAmZAg.exe
  2⤵
  PID:5792
- C:\Windows\System\lGgLakL.exe
  C:\Windows\System\lGgLakL.exe
  2⤵
  PID:5812
- C:\Windows\System\iJvrcUX.exe
  C:\Windows\System\iJvrcUX.exe
  2⤵
  PID:5832
- C:\Windows\System\gUWXCoo.exe
  C:\Windows\System\gUWXCoo.exe
  2⤵
  PID:5852
- C:\Windows\System\SRqeGoW.exe
  C:\Windows\System\SRqeGoW.exe
  2⤵
  PID:5876
- C:\Windows\System\RZDIgRn.exe
  C:\Windows\System\RZDIgRn.exe
  2⤵
  PID:5892
- C:\Windows\System\FhISKSG.exe
  C:\Windows\System\FhISKSG.exe
  2⤵
  PID:5912
- C:\Windows\System\rPKVPYy.exe
  C:\Windows\System\rPKVPYy.exe
  2⤵
  PID:5936
- C:\Windows\System\GHSwvoa.exe
  C:\Windows\System\GHSwvoa.exe
  2⤵
  PID:5952
- C:\Windows\System\AHdDiET.exe
  C:\Windows\System\AHdDiET.exe
  2⤵
  PID:5968
- C:\Windows\System\fyJqVSE.exe
  C:\Windows\System\fyJqVSE.exe
  2⤵
  PID:5988
- C:\Windows\System\ZuKWhyF.exe
  C:\Windows\System\ZuKWhyF.exe
  2⤵
  PID:6004
- C:\Windows\System\fzcJbvl.exe
  C:\Windows\System\fzcJbvl.exe
  2⤵
  PID:6024
- C:\Windows\System\igWfXho.exe
  C:\Windows\System\igWfXho.exe
  2⤵
  PID:6048
- C:\Windows\System\TXCKYew.exe
  C:\Windows\System\TXCKYew.exe
  2⤵
  PID:6064
- C:\Windows\System\SYeJKde.exe
  C:\Windows\System\SYeJKde.exe
  2⤵
  PID:6084
- C:\Windows\System\gECmZML.exe
  C:\Windows\System\gECmZML.exe
  2⤵
  PID:6104
- C:\Windows\System\kclkRox.exe
  C:\Windows\System\kclkRox.exe
  2⤵
  PID:6128
- C:\Windows\System\nTbiVXe.exe
  C:\Windows\System\nTbiVXe.exe
  2⤵
  PID:1324
- C:\Windows\System\YJjkhYk.exe
  C:\Windows\System\YJjkhYk.exe
  2⤵
  PID:3600
- C:\Windows\System\YYOcIdj.exe
  C:\Windows\System\YYOcIdj.exe
  2⤵
  PID:1752
- C:\Windows\System\CoddKKE.exe
  C:\Windows\System\CoddKKE.exe
  2⤵
  PID:2548
- C:\Windows\System\FZvltsy.exe
  C:\Windows\System\FZvltsy.exe
  2⤵
  PID:1960
- C:\Windows\System\eVgYOng.exe
  C:\Windows\System\eVgYOng.exe
  2⤵
  PID:3428
- C:\Windows\System\HrvIimd.exe
  C:\Windows\System\HrvIimd.exe
  2⤵
  PID:2964
- C:\Windows\System\ZnAxzHk.exe
  C:\Windows\System\ZnAxzHk.exe
  2⤵
  PID:4876
- C:\Windows\System\MZecwSK.exe
  C:\Windows\System\MZecwSK.exe
  2⤵
  PID:4856
- C:\Windows\System\UBfcClY.exe
  C:\Windows\System\UBfcClY.exe
  2⤵
  PID:3628
- C:\Windows\System\Ywwbfdf.exe
  C:\Windows\System\Ywwbfdf.exe
  2⤵
  PID:5124
- C:\Windows\System\lJjaUMl.exe
  C:\Windows\System\lJjaUMl.exe
  2⤵
  PID:5536
- C:\Windows\System\DCPwLYi.exe
  C:\Windows\System\DCPwLYi.exe
  2⤵
  PID:1552
- C:\Windows\System\myPMqgH.exe
  C:\Windows\System\myPMqgH.exe
  2⤵
  PID:4864
- C:\Windows\System\pgudTYh.exe
  C:\Windows\System\pgudTYh.exe
  2⤵
  PID:3332
- C:\Windows\System\SbpQQMh.exe
  C:\Windows\System\SbpQQMh.exe
  2⤵
  PID:4508
- C:\Windows\System\nGkVNRl.exe
  C:\Windows\System\nGkVNRl.exe
  2⤵
  PID:3548
- C:\Windows\System\HNnmTfc.exe
  C:\Windows\System\HNnmTfc.exe
  2⤵
  PID:1872
- C:\Windows\System\GfXSyNm.exe
  C:\Windows\System\GfXSyNm.exe
  2⤵
  PID:2712
- C:\Windows\System\ecwxuKS.exe
  C:\Windows\System\ecwxuKS.exe
  2⤵
  PID:5868
- C:\Windows\System\JNXboqx.exe
  C:\Windows\System\JNXboqx.exe
  2⤵
  PID:5532
- C:\Windows\System\qmJIyeO.exe
  C:\Windows\System\qmJIyeO.exe
  2⤵
  PID:6156
- C:\Windows\System\tlQVSYu.exe
  C:\Windows\System\tlQVSYu.exe
  2⤵
  PID:6180
- C:\Windows\System\DuYxKNH.exe
  C:\Windows\System\DuYxKNH.exe
  2⤵
  PID:6200
- C:\Windows\System\ykCnENp.exe
  C:\Windows\System\ykCnENp.exe
  2⤵
  PID:6216
- C:\Windows\System\Ercddwi.exe
  C:\Windows\System\Ercddwi.exe
  2⤵
  PID:6244
- C:\Windows\System\omEfXjL.exe
  C:\Windows\System\omEfXjL.exe
  2⤵
  PID:6272
- C:\Windows\System\lgeZsVs.exe
  C:\Windows\System\lgeZsVs.exe
  2⤵
  PID:6300
- C:\Windows\System\OXdSJRk.exe
  C:\Windows\System\OXdSJRk.exe
  2⤵
  PID:6320
- C:\Windows\System\OVZPTos.exe
  C:\Windows\System\OVZPTos.exe
  2⤵
  PID:6348
- C:\Windows\System\tsOMJJa.exe
  C:\Windows\System\tsOMJJa.exe
  2⤵
  PID:6392
- C:\Windows\System\MZCENFQ.exe
  C:\Windows\System\MZCENFQ.exe
  2⤵
  PID:6428
- C:\Windows\System\ZSOzqIN.exe
  C:\Windows\System\ZSOzqIN.exe
  2⤵
  PID:6444
- C:\Windows\System\JXaIyBO.exe
  C:\Windows\System\JXaIyBO.exe
  2⤵
  PID:6468
- C:\Windows\System\ellftcv.exe
  C:\Windows\System\ellftcv.exe
  2⤵
  PID:6520
- C:\Windows\System\zSuMSgX.exe
  C:\Windows\System\zSuMSgX.exe
  2⤵
  PID:6540
- C:\Windows\System\AGciVtk.exe
  C:\Windows\System\AGciVtk.exe
  2⤵
  PID:6576
- C:\Windows\System\bpdCIja.exe
  C:\Windows\System\bpdCIja.exe
  2⤵
  PID:6600
- C:\Windows\System\VPWXqin.exe
  C:\Windows\System\VPWXqin.exe
  2⤵
  PID:6616
- C:\Windows\System\ObAwwrW.exe
  C:\Windows\System\ObAwwrW.exe
  2⤵
  PID:6640
- C:\Windows\System\DKAmWiE.exe
  C:\Windows\System\DKAmWiE.exe
  2⤵
  PID:6656
- C:\Windows\System\YgAwqdJ.exe
  C:\Windows\System\YgAwqdJ.exe
  2⤵
  PID:6696
- C:\Windows\System\bLRMKbL.exe
  C:\Windows\System\bLRMKbL.exe
  2⤵
  PID:6724
- C:\Windows\System\ZwhCVYf.exe
  C:\Windows\System\ZwhCVYf.exe
  2⤵
  PID:6740
- C:\Windows\System\LSZcXnm.exe
  C:\Windows\System\LSZcXnm.exe
  2⤵
  PID:6760
- C:\Windows\System\EKhPmBL.exe
  C:\Windows\System\EKhPmBL.exe
  2⤵
  PID:6776
- C:\Windows\System\aBoYBrj.exe
  C:\Windows\System\aBoYBrj.exe
  2⤵
  PID:6796
- C:\Windows\System\UZDHsJt.exe
  C:\Windows\System\UZDHsJt.exe
  2⤵
  PID:6816
- C:\Windows\System\lKahctp.exe
  C:\Windows\System\lKahctp.exe
  2⤵
  PID:6840
- C:\Windows\System\XBEdafR.exe
  C:\Windows\System\XBEdafR.exe
  2⤵
  PID:6856
- C:\Windows\System\zuaxenb.exe
  C:\Windows\System\zuaxenb.exe
  2⤵
  PID:6880
- C:\Windows\System\JYhBAhx.exe
  C:\Windows\System\JYhBAhx.exe
  2⤵
  PID:6904
- C:\Windows\System\mJNQmch.exe
  C:\Windows\System\mJNQmch.exe
  2⤵
  PID:6924
- C:\Windows\System\NQBGIBD.exe
  C:\Windows\System\NQBGIBD.exe
  2⤵
  PID:6944
- C:\Windows\System\MFqIgEz.exe
  C:\Windows\System\MFqIgEz.exe
  2⤵
  PID:6968
- C:\Windows\System\eejkGet.exe
  C:\Windows\System\eejkGet.exe
  2⤵
  PID:6988
- C:\Windows\System\YEkWUey.exe
  C:\Windows\System\YEkWUey.exe
  2⤵
  PID:7004
- C:\Windows\System\qgiLpgc.exe
  C:\Windows\System\qgiLpgc.exe
  2⤵
  PID:7024
- C:\Windows\System\RXwsHLy.exe
  C:\Windows\System\RXwsHLy.exe
  2⤵
  PID:7056
- C:\Windows\System\atpGdhz.exe
  C:\Windows\System\atpGdhz.exe
  2⤵
  PID:7076
- C:\Windows\System\TfzRwpX.exe
  C:\Windows\System\TfzRwpX.exe
  2⤵
  PID:7096
- C:\Windows\System\PRiFtyA.exe
  C:\Windows\System\PRiFtyA.exe
  2⤵
  PID:7112
- C:\Windows\System\LPIxyab.exe
  C:\Windows\System\LPIxyab.exe
  2⤵
  PID:7140
- C:\Windows\System\PRURYpk.exe
  C:\Windows\System\PRURYpk.exe
  2⤵
  PID:7156
- C:\Windows\System\BWfzxRJ.exe
  C:\Windows\System\BWfzxRJ.exe
  2⤵
  PID:5620
- C:\Windows\System\ymdmwNV.exe
  C:\Windows\System\ymdmwNV.exe
  2⤵
  PID:6116
- C:\Windows\System\kjuOEFp.exe
  C:\Windows\System\kjuOEFp.exe
  2⤵
  PID:2248
- C:\Windows\System\lhiYVOl.exe
  C:\Windows\System\lhiYVOl.exe
  2⤵
  PID:5316
- C:\Windows\System\wZKmakE.exe
  C:\Windows\System\wZKmakE.exe
  2⤵
  PID:5356
- C:\Windows\System\AhEUwCK.exe
  C:\Windows\System\AhEUwCK.exe
  2⤵
  PID:2784
- C:\Windows\System\GTNmgfF.exe
  C:\Windows\System\GTNmgfF.exe
  2⤵
  PID:5424
- C:\Windows\System\qCDiGnK.exe
  C:\Windows\System\qCDiGnK.exe
  2⤵
  PID:5072
- C:\Windows\System\yUIlmOc.exe
  C:\Windows\System\yUIlmOc.exe
  2⤵
  PID:5560
- C:\Windows\System\VEDquaA.exe
  C:\Windows\System\VEDquaA.exe
  2⤵
  PID:5252
- C:\Windows\System\HcBafzK.exe
  C:\Windows\System\HcBafzK.exe
  2⤵
  PID:6164
- C:\Windows\System\izpmfyj.exe
  C:\Windows\System\izpmfyj.exe
  2⤵
  PID:5712
- C:\Windows\System\cPRVAyz.exe
  C:\Windows\System\cPRVAyz.exe
  2⤵
  PID:5764
- C:\Windows\System\tTyFuZE.exe
  C:\Windows\System\tTyFuZE.exe
  2⤵
  PID:5900
- C:\Windows\System\tKevCcF.exe
  C:\Windows\System\tKevCcF.exe
  2⤵
  PID:5964
- C:\Windows\System\yCbZNHn.exe
  C:\Windows\System\yCbZNHn.exe
  2⤵
  PID:6012
- C:\Windows\System\vGaaiXz.exe
  C:\Windows\System\vGaaiXz.exe
  2⤵
  PID:2544
- C:\Windows\System\CNnCwhs.exe
  C:\Windows\System\CNnCwhs.exe
  2⤵
  PID:1448
- C:\Windows\System\TGStYUX.exe
  C:\Windows\System\TGStYUX.exe
  2⤵
  PID:2692
- C:\Windows\System\YMOzlZc.exe
  C:\Windows\System\YMOzlZc.exe
  2⤵
  PID:5192
- C:\Windows\System\nijuKZl.exe
  C:\Windows\System\nijuKZl.exe
  2⤵
  PID:5648
- C:\Windows\System\bRRiqRs.exe
  C:\Windows\System\bRRiqRs.exe
  2⤵
  PID:1460
- C:\Windows\System\WxtcPbW.exe
  C:\Windows\System\WxtcPbW.exe
  2⤵
  PID:2788
- C:\Windows\System\IzsceaI.exe
  C:\Windows\System\IzsceaI.exe
  2⤵
  PID:6208
- C:\Windows\System\EzeQGrg.exe
  C:\Windows\System\EzeQGrg.exe
  2⤵
  PID:6284
- C:\Windows\System\ilQSjKa.exe
  C:\Windows\System\ilQSjKa.exe
  2⤵
  PID:6404
- C:\Windows\System\hHJwvtq.exe
  C:\Windows\System\hHJwvtq.exe
  2⤵
  PID:6452
- C:\Windows\System\VEUEzhT.exe
  C:\Windows\System\VEUEzhT.exe
  2⤵
  PID:6572
- C:\Windows\System\hBzYSaN.exe
  C:\Windows\System\hBzYSaN.exe
  2⤵
  PID:6804
- C:\Windows\System\sxgTrma.exe
  C:\Windows\System\sxgTrma.exe
  2⤵
  PID:7072
- C:\Windows\System\djLIoYG.exe
  C:\Windows\System\djLIoYG.exe
  2⤵
  PID:5212
- C:\Windows\System\wFaCqHk.exe
  C:\Windows\System\wFaCqHk.exe
  2⤵
  PID:3204
- C:\Windows\System\YwQweyw.exe
  C:\Windows\System\YwQweyw.exe
  2⤵
  PID:5800
- C:\Windows\System\PXCxOKi.exe
  C:\Windows\System\PXCxOKi.exe
  2⤵
  PID:5660
- C:\Windows\System\yLpErsZ.exe
  C:\Windows\System\yLpErsZ.exe
  2⤵
  PID:3396
- C:\Windows\System\QYIcQni.exe
  C:\Windows\System\QYIcQni.exe
  2⤵
  PID:3156
- C:\Windows\System\wCbQsOr.exe
  C:\Windows\System\wCbQsOr.exe
  2⤵
  PID:1208
- C:\Windows\System\frlDJUC.exe
  C:\Windows\System\frlDJUC.exe
  2⤵
  PID:6612
- C:\Windows\System\XJWQhVK.exe
  C:\Windows\System\XJWQhVK.exe
  2⤵
  PID:4680
- C:\Windows\System\mEQUbKq.exe
  C:\Windows\System\mEQUbKq.exe
  2⤵
  PID:1056
- C:\Windows\System\zruNvEk.exe
  C:\Windows\System\zruNvEk.exe
  2⤵
  PID:7020
- C:\Windows\System\yLZKIjC.exe
  C:\Windows\System\yLZKIjC.exe
  2⤵
  PID:6672
- C:\Windows\System\kcsdyfk.exe
  C:\Windows\System\kcsdyfk.exe
  2⤵
  PID:6812
- C:\Windows\System\XJyNBTd.exe
  C:\Windows\System\XJyNBTd.exe
  2⤵
  PID:7052
- C:\Windows\System\kpljRRC.exe
  C:\Windows\System\kpljRRC.exe
  2⤵
  PID:5272
- C:\Windows\System\TCqgsNY.exe
  C:\Windows\System\TCqgsNY.exe
  2⤵
  PID:5696
- C:\Windows\System\ILFvGjP.exe
  C:\Windows\System\ILFvGjP.exe
  2⤵
  PID:5580
- C:\Windows\System\diCEDlA.exe
  C:\Windows\System\diCEDlA.exe
  2⤵
  PID:4604
- C:\Windows\System\FNLvqSr.exe
  C:\Windows\System\FNLvqSr.exe
  2⤵
  PID:2952
- C:\Windows\System\eDCowVz.exe
  C:\Windows\System\eDCowVz.exe
  2⤵
  PID:4736
- C:\Windows\System\lkEHtqD.exe
  C:\Windows\System\lkEHtqD.exe
  2⤵
  PID:1352
- C:\Windows\System\GKHkuOp.exe
  C:\Windows\System\GKHkuOp.exe
  2⤵
  PID:2328
- C:\Windows\System\SOBrhZh.exe
  C:\Windows\System\SOBrhZh.exe
  2⤵
  PID:7184
- C:\Windows\System\gcVRYWr.exe
  C:\Windows\System\gcVRYWr.exe
  2⤵
  PID:7208
- C:\Windows\System\sztBWmv.exe
  C:\Windows\System\sztBWmv.exe
  2⤵
  PID:7236
- C:\Windows\System\ewemGGA.exe
  C:\Windows\System\ewemGGA.exe
  2⤵
  PID:7256
- C:\Windows\System\xwElBaw.exe
  C:\Windows\System\xwElBaw.exe
  2⤵
  PID:7280
- C:\Windows\System\xfqpdTQ.exe
  C:\Windows\System\xfqpdTQ.exe
  2⤵
  PID:7300
- C:\Windows\System\wGamuMX.exe
  C:\Windows\System\wGamuMX.exe
  2⤵
  PID:7324
- C:\Windows\System\CIiMhhy.exe
  C:\Windows\System\CIiMhhy.exe
  2⤵
  PID:7348
- C:\Windows\System\ySSpWtf.exe
  C:\Windows\System\ySSpWtf.exe
  2⤵
  PID:7368
- C:\Windows\System\lMQgegx.exe
  C:\Windows\System\lMQgegx.exe
  2⤵
  PID:7388
- C:\Windows\System\IqVdnag.exe
  C:\Windows\System\IqVdnag.exe
  2⤵
  PID:7408
- C:\Windows\System\ACgHzcw.exe
  C:\Windows\System\ACgHzcw.exe
  2⤵
  PID:7432
- C:\Windows\System\xvoSCnQ.exe
  C:\Windows\System\xvoSCnQ.exe
  2⤵
  PID:7460
- C:\Windows\System\TADBglg.exe
  C:\Windows\System\TADBglg.exe
  2⤵
  PID:7480
- C:\Windows\System\QQEXqVb.exe
  C:\Windows\System\QQEXqVb.exe
  2⤵
  PID:7500
- C:\Windows\System\UDYBmDq.exe
  C:\Windows\System\UDYBmDq.exe
  2⤵
  PID:7524
- C:\Windows\System\hIRxgyI.exe
  C:\Windows\System\hIRxgyI.exe
  2⤵
  PID:7544
- C:\Windows\System\QsibYlc.exe
  C:\Windows\System\QsibYlc.exe
  2⤵
  PID:7564
- C:\Windows\System\HzGuPFD.exe
  C:\Windows\System\HzGuPFD.exe
  2⤵
  PID:7588
- C:\Windows\System\FVtdWae.exe
  C:\Windows\System\FVtdWae.exe
  2⤵
  PID:7612
- C:\Windows\System\uSHCyCO.exe
  C:\Windows\System\uSHCyCO.exe
  2⤵
  PID:7628
- C:\Windows\System\QkINflO.exe
  C:\Windows\System\QkINflO.exe
  2⤵
  PID:7680
- C:\Windows\System\yOlMGih.exe
  C:\Windows\System\yOlMGih.exe
  2⤵
  PID:7700
- C:\Windows\System\ILABdFV.exe
  C:\Windows\System\ILABdFV.exe
  2⤵
  PID:7724
- C:\Windows\System\rYmXKru.exe
  C:\Windows\System\rYmXKru.exe
  2⤵
  PID:7752
- C:\Windows\System\YLCVEGk.exe
  C:\Windows\System\YLCVEGk.exe
  2⤵
  PID:7780
- C:\Windows\System\doDjJdl.exe
  C:\Windows\System\doDjJdl.exe
  2⤵
  PID:7800
- C:\Windows\System\pvGaqcb.exe
  C:\Windows\System\pvGaqcb.exe
  2⤵
  PID:7844
- C:\Windows\System\UIRzaIJ.exe
  C:\Windows\System\UIRzaIJ.exe
  2⤵
  PID:7872
- C:\Windows\System\DwbgBWN.exe
  C:\Windows\System\DwbgBWN.exe
  2⤵
  PID:7896
- C:\Windows\System\JYSPYPz.exe
  C:\Windows\System\JYSPYPz.exe
  2⤵
  PID:7916
- C:\Windows\System\sWZRPcf.exe
  C:\Windows\System\sWZRPcf.exe
  2⤵
  PID:7940
- C:\Windows\System\kqHmQvW.exe
  C:\Windows\System\kqHmQvW.exe
  2⤵
  PID:8000
- C:\Windows\System\gJmrNza.exe
  C:\Windows\System\gJmrNza.exe
  2⤵
  PID:8036
- C:\Windows\System\KFyLZUp.exe
  C:\Windows\System\KFyLZUp.exe
  2⤵
  PID:8060
- C:\Windows\System\oPotzpq.exe
  C:\Windows\System\oPotzpq.exe
  2⤵
  PID:8084
- C:\Windows\System\cQjUzVk.exe
  C:\Windows\System\cQjUzVk.exe
  2⤵
  PID:8104
- C:\Windows\System\vUjtCLT.exe
  C:\Windows\System\vUjtCLT.exe
  2⤵
  PID:8120
- C:\Windows\System\iTIsMrh.exe
  C:\Windows\System\iTIsMrh.exe
  2⤵
  PID:8140
- C:\Windows\System\mmDRxxB.exe
  C:\Windows\System\mmDRxxB.exe
  2⤵
  PID:8164
- C:\Windows\System\radeHOI.exe
  C:\Windows\System\radeHOI.exe
  2⤵
  PID:3500
- C:\Windows\System\mLpdRsb.exe
  C:\Windows\System\mLpdRsb.exe
  2⤵
  PID:5884
- C:\Windows\System\UWUULJF.exe
  C:\Windows\System\UWUULJF.exe
  2⤵
  PID:5616
- C:\Windows\System\mXptnIR.exe
  C:\Windows\System\mXptnIR.exe
  2⤵
  PID:2288
- C:\Windows\System\wREHZMv.exe
  C:\Windows\System\wREHZMv.exe
  2⤵
  PID:6560
- C:\Windows\System\LGdzrVH.exe
  C:\Windows\System\LGdzrVH.exe
  2⤵
  PID:2968
- C:\Windows\System\fUGRXYy.exe
  C:\Windows\System\fUGRXYy.exe
  2⤵
  PID:8212
- C:\Windows\System\xjnPJKc.exe
  C:\Windows\System\xjnPJKc.exe
  2⤵
  PID:8344
- C:\Windows\System\jharJFH.exe
  C:\Windows\System\jharJFH.exe
  2⤵
  PID:8364
- C:\Windows\System\VDwkRpq.exe
  C:\Windows\System\VDwkRpq.exe
  2⤵
  PID:8384
- C:\Windows\System\AntmUnb.exe
  C:\Windows\System\AntmUnb.exe
  2⤵
  PID:8404
- C:\Windows\System\FsAhLTl.exe
  C:\Windows\System\FsAhLTl.exe
  2⤵
  PID:8428
- C:\Windows\System\RevXiLb.exe
  C:\Windows\System\RevXiLb.exe
  2⤵
  PID:8448
- C:\Windows\System\OKpCLvY.exe
  C:\Windows\System\OKpCLvY.exe
  2⤵
  PID:8468
- C:\Windows\System\tcEYInl.exe
  C:\Windows\System\tcEYInl.exe
  2⤵
  PID:8492
- C:\Windows\System\ZUgUFyP.exe
  C:\Windows\System\ZUgUFyP.exe
  2⤵
  PID:8512
- C:\Windows\System\aodEwBr.exe
  C:\Windows\System\aodEwBr.exe
  2⤵
  PID:8536
- C:\Windows\System\CpNDzuY.exe
  C:\Windows\System\CpNDzuY.exe
  2⤵
  PID:8552
- C:\Windows\System\wdszoCQ.exe
  C:\Windows\System\wdszoCQ.exe
  2⤵
  PID:8576
- C:\Windows\System\qqsrTXt.exe
  C:\Windows\System\qqsrTXt.exe
  2⤵
  PID:8604
- C:\Windows\System\yetbmss.exe
  C:\Windows\System\yetbmss.exe
  2⤵
  PID:8620
- C:\Windows\System\rBHAJIj.exe
  C:\Windows\System\rBHAJIj.exe
  2⤵
  PID:8644
- C:\Windows\System\jBUUORQ.exe
  C:\Windows\System\jBUUORQ.exe
  2⤵
  PID:8660
- C:\Windows\System\oFcITOu.exe
  C:\Windows\System\oFcITOu.exe
  2⤵
  PID:8684
- C:\Windows\System\UrBoqHL.exe
  C:\Windows\System\UrBoqHL.exe
  2⤵
  PID:8708
- C:\Windows\System\IpTEmKS.exe
  C:\Windows\System\IpTEmKS.exe
  2⤵
  PID:8728
- C:\Windows\System\nRQbdeo.exe
  C:\Windows\System\nRQbdeo.exe
  2⤵
  PID:8748
- C:\Windows\System\dDPpbQd.exe
  C:\Windows\System\dDPpbQd.exe
  2⤵
  PID:8772
- C:\Windows\System\OPaLIyd.exe
  C:\Windows\System\OPaLIyd.exe
  2⤵
  PID:8796
- C:\Windows\System\PJxsuZq.exe
  C:\Windows\System\PJxsuZq.exe
  2⤵
  PID:8824
- C:\Windows\System\TzJYTwT.exe
  C:\Windows\System\TzJYTwT.exe
  2⤵
  PID:8844
- C:\Windows\System\TFsRQhF.exe
  C:\Windows\System\TFsRQhF.exe
  2⤵
  PID:8864
- C:\Windows\System\TFiXjsV.exe
  C:\Windows\System\TFiXjsV.exe
  2⤵
  PID:8900
- C:\Windows\System\zhfuNpH.exe
  C:\Windows\System\zhfuNpH.exe
  2⤵
  PID:8916
- C:\Windows\System\AkqipYz.exe
  C:\Windows\System\AkqipYz.exe
  2⤵
  PID:8936
- C:\Windows\System\EXDTKOT.exe
  C:\Windows\System\EXDTKOT.exe
  2⤵
  PID:8960
- C:\Windows\System\hvjWjFO.exe
  C:\Windows\System\hvjWjFO.exe
  2⤵
  PID:8980
- C:\Windows\System\DyoGJXU.exe
  C:\Windows\System\DyoGJXU.exe
  2⤵
  PID:9004
- C:\Windows\System\aDwrfZk.exe
  C:\Windows\System\aDwrfZk.exe
  2⤵
  PID:9020
- C:\Windows\System\gsAemHq.exe
  C:\Windows\System\gsAemHq.exe
  2⤵
  PID:9040
- C:\Windows\System\lMYoemB.exe
  C:\Windows\System\lMYoemB.exe
  2⤵
  PID:9060
- C:\Windows\System\TFRqsEq.exe
  C:\Windows\System\TFRqsEq.exe
  2⤵
  PID:9084
- C:\Windows\System\OjjiHqS.exe
  C:\Windows\System\OjjiHqS.exe
  2⤵
  PID:9104
- C:\Windows\System\bvPEuWv.exe
  C:\Windows\System\bvPEuWv.exe
  2⤵
  PID:9132
- C:\Windows\System\ZWhJgKP.exe
  C:\Windows\System\ZWhJgKP.exe
  2⤵
  PID:9152
- C:\Windows\System\tvkWkit.exe
  C:\Windows\System\tvkWkit.exe
  2⤵
  PID:9168
- C:\Windows\System\OClBgYA.exe
  C:\Windows\System\OClBgYA.exe
  2⤵
  PID:9196
- C:\Windows\System\uIpbZIO.exe
  C:\Windows\System\uIpbZIO.exe
  2⤵
  PID:5348
- C:\Windows\System\FqsztGC.exe
  C:\Windows\System\FqsztGC.exe
  2⤵
  PID:1880
- C:\Windows\System\zUgMNeE.exe
  C:\Windows\System\zUgMNeE.exe
  2⤵
  PID:6552
- C:\Windows\System\juWrdxA.exe
  C:\Windows\System\juWrdxA.exe
  2⤵
  PID:6632
- C:\Windows\System\bXLJIjh.exe
  C:\Windows\System\bXLJIjh.exe
  2⤵
  PID:6808
- C:\Windows\System\tMTfQty.exe
  C:\Windows\System\tMTfQty.exe
  2⤵
  PID:6976
- C:\Windows\System\UcmvXIM.exe
  C:\Windows\System\UcmvXIM.exe
  2⤵
  PID:7064
- C:\Windows\System\YsQAbac.exe
  C:\Windows\System\YsQAbac.exe
  2⤵
  PID:6072
- C:\Windows\System\kGHNkmZ.exe
  C:\Windows\System\kGHNkmZ.exe
  2⤵
  PID:5408
- C:\Windows\System\zfOTmKY.exe
  C:\Windows\System\zfOTmKY.exe
  2⤵
  PID:2116
- C:\Windows\System\qAwDfuf.exe
  C:\Windows\System\qAwDfuf.exe
  2⤵
  PID:2808
- C:\Windows\System\cybMQDJ.exe
  C:\Windows\System\cybMQDJ.exe
  2⤵
  PID:1264
- C:\Windows\System\CYEHEOV.exe
  C:\Windows\System\CYEHEOV.exe
  2⤵
  PID:668
- C:\Windows\System\cIBMuHv.exe
  C:\Windows\System\cIBMuHv.exe
  2⤵
  PID:6056
- C:\Windows\System\Cqmwhlh.exe
  C:\Windows\System\Cqmwhlh.exe
  2⤵
  PID:7716
- C:\Windows\System\MpADdKL.exe
  C:\Windows\System\MpADdKL.exe
  2⤵
  PID:5516
- C:\Windows\System\bSRqtRA.exe
  C:\Windows\System\bSRqtRA.exe
  2⤵
  PID:6952
- C:\Windows\System\QXKilbx.exe
  C:\Windows\System\QXKilbx.exe
  2⤵
  PID:8092
- C:\Windows\System\VrrTyFg.exe
  C:\Windows\System\VrrTyFg.exe
  2⤵
  PID:4408
- C:\Windows\System\tRpCjoY.exe
  C:\Windows\System\tRpCjoY.exe
  2⤵
  PID:1444
- C:\Windows\System\wcIZBmc.exe
  C:\Windows\System\wcIZBmc.exe
  2⤵
  PID:812
- C:\Windows\System\MLqGXXJ.exe
  C:\Windows\System\MLqGXXJ.exe
  2⤵
  PID:7180
- C:\Windows\System\yaMugKS.exe
  C:\Windows\System\yaMugKS.exe
  2⤵
  PID:7224
- C:\Windows\System\NSYVREP.exe
  C:\Windows\System\NSYVREP.exe
  2⤵
  PID:7364
- C:\Windows\System\QRnuwIO.exe
  C:\Windows\System\QRnuwIO.exe
  2⤵
  PID:7400
- C:\Windows\System\cBYYxyp.exe
  C:\Windows\System\cBYYxyp.exe
  2⤵
  PID:7512
- C:\Windows\System\HNQgQaB.exe
  C:\Windows\System\HNQgQaB.exe
  2⤵
  PID:8372
- C:\Windows\System\fGsWkTZ.exe
  C:\Windows\System\fGsWkTZ.exe
  2⤵
  PID:7620
- C:\Windows\System\eBcnPPl.exe
  C:\Windows\System\eBcnPPl.exe
  2⤵
  PID:4620
- C:\Windows\System\DDxUotG.exe
  C:\Windows\System\DDxUotG.exe
  2⤵
  PID:7772
- C:\Windows\System\BuJzGVM.exe
  C:\Windows\System\BuJzGVM.exe
  2⤵
  PID:3700
- C:\Windows\System\nxBjtkB.exe
  C:\Windows\System\nxBjtkB.exe
  2⤵
  PID:6400
- C:\Windows\System\TBfluZg.exe
  C:\Windows\System\TBfluZg.exe
  2⤵
  PID:7948
- C:\Windows\System\YUgvbju.exe
  C:\Windows\System\YUgvbju.exe
  2⤵
  PID:7164
- C:\Windows\System\qhiGuTQ.exe
  C:\Windows\System\qhiGuTQ.exe
  2⤵
  PID:2792
- C:\Windows\System\rTMciDM.exe
  C:\Windows\System\rTMciDM.exe
  2⤵
  PID:6380
- C:\Windows\System\YatijHv.exe
  C:\Windows\System\YatijHv.exe
  2⤵
  PID:8668
- C:\Windows\System\ohdOKNG.exe
  C:\Windows\System\ohdOKNG.exe
  2⤵
  PID:8724
- C:\Windows\System\qyUNDSw.exe
  C:\Windows\System\qyUNDSw.exe
  2⤵
  PID:2840
- C:\Windows\System\GkZVeUH.exe
  C:\Windows\System\GkZVeUH.exe
  2⤵
  PID:7000
- C:\Windows\System\TmmmfjB.exe
  C:\Windows\System\TmmmfjB.exe
  2⤵
  PID:5060
- C:\Windows\System\VXwRmAu.exe
  C:\Windows\System\VXwRmAu.exe
  2⤵
  PID:5460
- C:\Windows\System\kROisIZ.exe
  C:\Windows\System\kROisIZ.exe
  2⤵
  PID:2708
- C:\Windows\System\VfjbcEj.exe
  C:\Windows\System\VfjbcEj.exe
  2⤵
  PID:7176
- C:\Windows\System\fytJJoD.exe
  C:\Windows\System\fytJJoD.exe
  2⤵
  PID:7264
- C:\Windows\System\AcREXmy.exe
  C:\Windows\System\AcREXmy.exe
  2⤵
  PID:7316
- C:\Windows\System\EQMBEcd.exe
  C:\Windows\System\EQMBEcd.exe
  2⤵
  PID:7448
- C:\Windows\System\whChOIH.exe
  C:\Windows\System\whChOIH.exe
  2⤵
  PID:7492
- C:\Windows\System\xpoppRP.exe
  C:\Windows\System\xpoppRP.exe
  2⤵
  PID:7560
- C:\Windows\System\TtFttUp.exe
  C:\Windows\System\TtFttUp.exe
  2⤵
  PID:7604
- C:\Windows\System\agYUgjE.exe
  C:\Windows\System\agYUgjE.exe
  2⤵
  PID:9076
- C:\Windows\System\Hrucrhs.exe
  C:\Windows\System\Hrucrhs.exe
  2⤵
  PID:9148
- C:\Windows\System\OpJoPhu.exe
  C:\Windows\System\OpJoPhu.exe
  2⤵
  PID:9212
- C:\Windows\System\tdIIKME.exe
  C:\Windows\System\tdIIKME.exe
  2⤵
  PID:9240
- C:\Windows\System\hYJsfQW.exe
  C:\Windows\System\hYJsfQW.exe
  2⤵
  PID:9268
- C:\Windows\System\QASiflZ.exe
  C:\Windows\System\QASiflZ.exe
  2⤵
  PID:9300
- C:\Windows\System\QzxWQce.exe
  C:\Windows\System\QzxWQce.exe
  2⤵
  PID:9328
- C:\Windows\System\XsqNpQs.exe
  C:\Windows\System\XsqNpQs.exe
  2⤵
  PID:9352
- C:\Windows\System\QlyPpjX.exe
  C:\Windows\System\QlyPpjX.exe
  2⤵
  PID:9368
- C:\Windows\System\tPYcvBH.exe
  C:\Windows\System\tPYcvBH.exe
  2⤵
  PID:9388
- C:\Windows\System\bbwFyxu.exe
  C:\Windows\System\bbwFyxu.exe
  2⤵
  PID:9408
- C:\Windows\System\yRcQJKE.exe
  C:\Windows\System\yRcQJKE.exe
  2⤵
  PID:9428
- C:\Windows\System\eHfXmhK.exe
  C:\Windows\System\eHfXmhK.exe
  2⤵
  PID:9448
- C:\Windows\System\GIYyICC.exe
  C:\Windows\System\GIYyICC.exe
  2⤵
  PID:9472
- C:\Windows\System\xxrwgLD.exe
  C:\Windows\System\xxrwgLD.exe
  2⤵
  PID:9488
- C:\Windows\System\KLdkRQA.exe
  C:\Windows\System\KLdkRQA.exe
  2⤵
  PID:9516
- C:\Windows\System\LorKVnA.exe
  C:\Windows\System\LorKVnA.exe
  2⤵
  PID:9540
- C:\Windows\System\TAdVqLk.exe
  C:\Windows\System\TAdVqLk.exe
  2⤵
  PID:9560
- C:\Windows\System\TbpRfUU.exe
  C:\Windows\System\TbpRfUU.exe
  2⤵
  PID:9584
- C:\Windows\System\DqdOEvn.exe
  C:\Windows\System\DqdOEvn.exe
  2⤵
  PID:9608
- C:\Windows\System\bglzixc.exe
  C:\Windows\System\bglzixc.exe
  2⤵
  PID:9632
- C:\Windows\System\faQAMaf.exe
  C:\Windows\System\faQAMaf.exe
  2⤵
  PID:9652
- C:\Windows\System\wlKVjtX.exe
  C:\Windows\System\wlKVjtX.exe
  2⤵
  PID:9680
- C:\Windows\System\ucCRakV.exe
  C:\Windows\System\ucCRakV.exe
  2⤵
  PID:9708
- C:\Windows\System\xwBHEGE.exe
  C:\Windows\System\xwBHEGE.exe
  2⤵
  PID:9728
- C:\Windows\System\RKUCsRK.exe
  C:\Windows\System\RKUCsRK.exe
  2⤵
  PID:9752
- C:\Windows\System\QtDFeJm.exe
  C:\Windows\System\QtDFeJm.exe
  2⤵
  PID:9776
- C:\Windows\System\gOmWMmN.exe
  C:\Windows\System\gOmWMmN.exe
  2⤵
  PID:9796
- C:\Windows\System\kJRhViS.exe
  C:\Windows\System\kJRhViS.exe
  2⤵
  PID:9824
- C:\Windows\System\ylClsMh.exe
  C:\Windows\System\ylClsMh.exe
  2⤵
  PID:9852
- C:\Windows\System\NNbCUBO.exe
  C:\Windows\System\NNbCUBO.exe
  2⤵
  PID:9876
- C:\Windows\System\PVHzwLX.exe
  C:\Windows\System\PVHzwLX.exe
  2⤵
  PID:9892
- C:\Windows\System\gRzgenl.exe
  C:\Windows\System\gRzgenl.exe
  2⤵
  PID:9912
- C:\Windows\System\OUlxkui.exe
  C:\Windows\System\OUlxkui.exe
  2⤵
  PID:9932
- C:\Windows\System\LheSsrd.exe
  C:\Windows\System\LheSsrd.exe
  2⤵
  PID:9956
- C:\Windows\System\VEFrPFX.exe
  C:\Windows\System\VEFrPFX.exe
  2⤵
  PID:9976
- C:\Windows\System\EOPuaZD.exe
  C:\Windows\System\EOPuaZD.exe
  2⤵
  PID:10000
- C:\Windows\System\HypbCoE.exe
  C:\Windows\System\HypbCoE.exe
  2⤵
  PID:10020
- C:\Windows\System\SFyryPs.exe
  C:\Windows\System\SFyryPs.exe
  2⤵
  PID:10036
- C:\Windows\System\UpGBDiF.exe
  C:\Windows\System\UpGBDiF.exe
  2⤵
  PID:10052
- C:\Windows\System\KpGPNLY.exe
  C:\Windows\System\KpGPNLY.exe
  2⤵
  PID:10072
- C:\Windows\System\hgeOQdh.exe
  C:\Windows\System\hgeOQdh.exe
  2⤵
  PID:10088
- C:\Windows\System\WfrSEgm.exe
  C:\Windows\System\WfrSEgm.exe
  2⤵
  PID:10112
- C:\Windows\System\KKZlozk.exe
  C:\Windows\System\KKZlozk.exe
  2⤵
  PID:10136
- C:\Windows\System\LFYhCZK.exe
  C:\Windows\System\LFYhCZK.exe
  2⤵
  PID:10160
- C:\Windows\System\GgARZYF.exe
  C:\Windows\System\GgARZYF.exe
  2⤵
  PID:10184
- C:\Windows\System\SMxOTkl.exe
  C:\Windows\System\SMxOTkl.exe
  2⤵
  PID:10212
- C:\Windows\System\AraanAH.exe
  C:\Windows\System\AraanAH.exe
  2⤵
  PID:10232
- C:\Windows\System\bwEkHEA.exe
  C:\Windows\System\bwEkHEA.exe
  2⤵
  PID:8444
- C:\Windows\System\dprGpqd.exe
  C:\Windows\System\dprGpqd.exe
  2⤵
  PID:8460
- C:\Windows\System\ymzPUtn.exe
  C:\Windows\System\ymzPUtn.exe
  2⤵
  PID:8524
- C:\Windows\System\eSfhIHi.exe
  C:\Windows\System\eSfhIHi.exe
  2⤵
  PID:7856
- C:\Windows\System\IQFAmqo.exe
  C:\Windows\System\IQFAmqo.exe
  2⤵
  PID:7884
- C:\Windows\System\SdvAhfL.exe
  C:\Windows\System\SdvAhfL.exe
  2⤵
  PID:7868
- C:\Windows\System\RKazSsZ.exe
  C:\Windows\System\RKazSsZ.exe
  2⤵
  PID:5008
- C:\Windows\System\pwfEwnU.exe
  C:\Windows\System\pwfEwnU.exe
  2⤵
  PID:4212
- C:\Windows\System\NjounpE.exe
  C:\Windows\System\NjounpE.exe
  2⤵
  PID:7952
- C:\Windows\System\VyFnIBH.exe
  C:\Windows\System\VyFnIBH.exe
  2⤵
  PID:8100
- C:\Windows\System\wyKPPmz.exe
  C:\Windows\System\wyKPPmz.exe
  2⤵
  PID:6984
- C:\Windows\System\rGKIQiS.exe
  C:\Windows\System\rGKIQiS.exe
  2⤵
  PID:8692
- C:\Windows\System\XKmaOCv.exe
  C:\Windows\System\XKmaOCv.exe
  2⤵
  PID:8736
- C:\Windows\System\UmJYplr.exe
  C:\Windows\System\UmJYplr.exe
  2⤵
  PID:3952
- C:\Windows\System\bPqhdxQ.exe
  C:\Windows\System\bPqhdxQ.exe
  2⤵
  PID:5996
- C:\Windows\System\OsLhMTi.exe
  C:\Windows\System\OsLhMTi.exe
  2⤵
  PID:6652
- C:\Windows\System\WCXoQNM.exe
  C:\Windows\System\WCXoQNM.exe
  2⤵
  PID:8208
- C:\Windows\System\xDiEaHa.exe
  C:\Windows\System\xDiEaHa.exe
  2⤵
  PID:8928
- C:\Windows\System\beLKwrU.exe
  C:\Windows\System\beLKwrU.exe
  2⤵
  PID:8988
- C:\Windows\System\epmlXLq.exe
  C:\Windows\System\epmlXLq.exe
  2⤵
  PID:2220
- C:\Windows\System\OCKGFWu.exe
  C:\Windows\System\OCKGFWu.exe
  2⤵
  PID:7488
- C:\Windows\System\PYFZClN.exe
  C:\Windows\System\PYFZClN.exe
  2⤵
  PID:9056
- C:\Windows\System\lARJCZF.exe
  C:\Windows\System\lARJCZF.exe
  2⤵
  PID:8416
- C:\Windows\System\VEQblQw.exe
  C:\Windows\System\VEQblQw.exe
  2⤵
  PID:9232
- C:\Windows\System\FeQEWiU.exe
  C:\Windows\System\FeQEWiU.exe
  2⤵
  PID:10244
- C:\Windows\System\SwQTMuK.exe
  C:\Windows\System\SwQTMuK.exe
  2⤵
  PID:10276
- C:\Windows\System\OeRHktO.exe
  C:\Windows\System\OeRHktO.exe
  2⤵
  PID:10300
- C:\Windows\System\nZsqlnI.exe
  C:\Windows\System\nZsqlnI.exe
  2⤵
  PID:10320
- C:\Windows\System\xObeIaw.exe
  C:\Windows\System\xObeIaw.exe
  2⤵
  PID:10340
- C:\Windows\System\zZkNnFT.exe
  C:\Windows\System\zZkNnFT.exe
  2⤵
  PID:10364
- C:\Windows\System\AHHAmfk.exe
  C:\Windows\System\AHHAmfk.exe
  2⤵
  PID:10388
- C:\Windows\System\txpZdPD.exe
  C:\Windows\System\txpZdPD.exe
  2⤵
  PID:10412
- C:\Windows\System\MGtfAMQ.exe
  C:\Windows\System\MGtfAMQ.exe
  2⤵
  PID:10436
- C:\Windows\System\amQYrTq.exe
  C:\Windows\System\amQYrTq.exe
  2⤵
  PID:10452
- C:\Windows\System\dQKaqzh.exe
  C:\Windows\System\dQKaqzh.exe
  2⤵
  PID:10476
- C:\Windows\System\FeuQAYs.exe
  C:\Windows\System\FeuQAYs.exe
  2⤵
  PID:10500
- C:\Windows\System\cwLAJkO.exe
  C:\Windows\System\cwLAJkO.exe
  2⤵
  PID:10520
- C:\Windows\System\TemPsVD.exe
  C:\Windows\System\TemPsVD.exe
  2⤵
  PID:10560
- C:\Windows\System\OGSkRMI.exe
  C:\Windows\System\OGSkRMI.exe
  2⤵
  PID:10580
- C:\Windows\System\fZgoqMb.exe
  C:\Windows\System\fZgoqMb.exe
  2⤵
  PID:10600
- C:\Windows\System\QDHFvRF.exe
  C:\Windows\System\QDHFvRF.exe
  2⤵
  PID:10620
- C:\Windows\System\xbQJIwh.exe
  C:\Windows\System\xbQJIwh.exe
  2⤵
  PID:10636
- C:\Windows\System\rDqFImx.exe
  C:\Windows\System\rDqFImx.exe
  2⤵
  PID:10652
- C:\Windows\System\yaEoIsY.exe
  C:\Windows\System\yaEoIsY.exe
  2⤵
  PID:10672
- C:\Windows\System\BgXjqRg.exe
  C:\Windows\System\BgXjqRg.exe
  2⤵
  PID:10692
- C:\Windows\System\yfpGljG.exe
  C:\Windows\System\yfpGljG.exe
  2⤵
  PID:10712
- C:\Windows\System\YqwJRij.exe
  C:\Windows\System\YqwJRij.exe
  2⤵
  PID:10728
- C:\Windows\System\lDLhzhr.exe
  C:\Windows\System\lDLhzhr.exe
  2⤵
  PID:10752
- C:\Windows\System\oKIYIZx.exe
  C:\Windows\System\oKIYIZx.exe
  2⤵
  PID:10780
- C:\Windows\System\wXBhxll.exe
  C:\Windows\System\wXBhxll.exe
  2⤵
  PID:10804
- C:\Windows\System\WncJHar.exe
  C:\Windows\System\WncJHar.exe
  2⤵
  PID:10828
- C:\Windows\System\WPGYecZ.exe
  C:\Windows\System\WPGYecZ.exe
  2⤵
  PID:10848
- C:\Windows\System\QqhgcKa.exe
  C:\Windows\System\QqhgcKa.exe
  2⤵
  PID:10868
- C:\Windows\System\mZqtaBE.exe
  C:\Windows\System\mZqtaBE.exe
  2⤵
  PID:10892
- C:\Windows\System\KMyQPuN.exe
  C:\Windows\System\KMyQPuN.exe
  2⤵
  PID:10908
- C:\Windows\System\GVEoVXa.exe
  C:\Windows\System\GVEoVXa.exe
  2⤵
  PID:10932
- C:\Windows\System\dHxGZtH.exe
  C:\Windows\System\dHxGZtH.exe
  2⤵
  PID:10948
- C:\Windows\System\ZPADlhz.exe
  C:\Windows\System\ZPADlhz.exe
  2⤵
  PID:10964
- C:\Windows\System\sgKeVUF.exe
  C:\Windows\System\sgKeVUF.exe
  2⤵
  PID:10988
- C:\Windows\System\hIKIHdX.exe
  C:\Windows\System\hIKIHdX.exe
  2⤵
  PID:11004
- C:\Windows\System\TBjtLIJ.exe
  C:\Windows\System\TBjtLIJ.exe
  2⤵
  PID:11028
- C:\Windows\System\RyVCflk.exe
  C:\Windows\System\RyVCflk.exe
  2⤵
  PID:11048
- C:\Windows\System\WVPqinV.exe
  C:\Windows\System\WVPqinV.exe
  2⤵
  PID:11072
- C:\Windows\System\qnhKjSp.exe
  C:\Windows\System\qnhKjSp.exe
  2⤵
  PID:11096
- C:\Windows\System\YtIwDBT.exe
  C:\Windows\System\YtIwDBT.exe
  2⤵
  PID:11116
- C:\Windows\System\GfaZcLX.exe
  C:\Windows\System\GfaZcLX.exe
  2⤵
  PID:11140
- C:\Windows\System\arUoxml.exe
  C:\Windows\System\arUoxml.exe
  2⤵
  PID:11164
- C:\Windows\System\oKGSEEj.exe
  C:\Windows\System\oKGSEEj.exe
  2⤵
  PID:11192
- C:\Windows\System\FGRoOUY.exe
  C:\Windows\System\FGRoOUY.exe
  2⤵
  PID:11212
- C:\Windows\System\OUnzabG.exe
  C:\Windows\System\OUnzabG.exe
  2⤵
  PID:11232
- C:\Windows\System\xMPMPtE.exe
  C:\Windows\System\xMPMPtE.exe
  2⤵
  PID:11248
- C:\Windows\System\zligSjG.exe
  C:\Windows\System\zligSjG.exe
  2⤵
  PID:8508
- C:\Windows\System\OeqbGOv.exe
  C:\Windows\System\OeqbGOv.exe
  2⤵
  PID:9364
- C:\Windows\System\MorlgXp.exe
  C:\Windows\System\MorlgXp.exe
  2⤵
  PID:9444
- C:\Windows\System\vpqllmt.exe
  C:\Windows\System\vpqllmt.exe
  2⤵
  PID:9484
- C:\Windows\System\DXNjILu.exe
  C:\Windows\System\DXNjILu.exe
  2⤵
  PID:9552
- C:\Windows\System\FpkhNmF.exe
  C:\Windows\System\FpkhNmF.exe
  2⤵
  PID:8572
- C:\Windows\System\WxRrGCa.exe
  C:\Windows\System\WxRrGCa.exe
  2⤵
  PID:8600
- C:\Windows\System\OuJzsiO.exe
  C:\Windows\System\OuJzsiO.exe
  2⤵
  PID:1064
- C:\Windows\System\XYuJsIU.exe
  C:\Windows\System\XYuJsIU.exe
  2⤵
  PID:7640
- C:\Windows\System\KxTMcDQ.exe
  C:\Windows\System\KxTMcDQ.exe
  2⤵
  PID:9772
- C:\Windows\System\ZiuRWQu.exe
  C:\Windows\System\ZiuRWQu.exe
  2⤵
  PID:9832
- C:\Windows\System\fsZJNPP.exe
  C:\Windows\System\fsZJNPP.exe
  2⤵
  PID:7200
- C:\Windows\System\QOlFItv.exe
  C:\Windows\System\QOlFItv.exe
  2⤵
  PID:10028
- C:\Windows\System\ZMaiXiv.exe
  C:\Windows\System\ZMaiXiv.exe
  2⤵
  PID:10104
- C:\Windows\System\aNpWvqt.exe
  C:\Windows\System\aNpWvqt.exe
  2⤵
  PID:10152
- C:\Windows\System\fcRURfc.exe
  C:\Windows\System\fcRURfc.exe
  2⤵
  PID:10200
- C:\Windows\System\AwZOKLL.exe
  C:\Windows\System\AwZOKLL.exe
  2⤵
  PID:7660
- C:\Windows\System\ndJodyk.exe
  C:\Windows\System\ndJodyk.exe
  2⤵
  PID:8812
- C:\Windows\System\SQITVJb.exe
  C:\Windows\System\SQITVJb.exe
  2⤵
  PID:3260
- C:\Windows\System\wNxitMo.exe
  C:\Windows\System\wNxitMo.exe
  2⤵
  PID:8856
- C:\Windows\System\pnGbHrw.exe
  C:\Windows\System\pnGbHrw.exe
  2⤵
  PID:7820
- C:\Windows\System\KGyqzmN.exe
  C:\Windows\System\KGyqzmN.exe
  2⤵
  PID:6792
- C:\Windows\System\ZwJoZkJ.exe
  C:\Windows\System\ZwJoZkJ.exe
  2⤵
  PID:2020
- C:\Windows\System\kLNTCyw.exe
  C:\Windows\System\kLNTCyw.exe
  2⤵
  PID:2476
- C:\Windows\System\nfxwhMd.exe
  C:\Windows\System\nfxwhMd.exe
  2⤵
  PID:11288
- C:\Windows\System\WynEpdL.exe
  C:\Windows\System\WynEpdL.exe
  2⤵
  PID:11308
- C:\Windows\System\gsLPFtx.exe
  C:\Windows\System\gsLPFtx.exe
  2⤵
  PID:11324
- C:\Windows\System\bMvJppb.exe
  C:\Windows\System\bMvJppb.exe
  2⤵
  PID:11344
- C:\Windows\System\YJwRqWU.exe
  C:\Windows\System\YJwRqWU.exe
  2⤵
  PID:11368
- C:\Windows\System\gcBCNRq.exe
  C:\Windows\System\gcBCNRq.exe
  2⤵
  PID:11396
- C:\Windows\System\HYhhbxW.exe
  C:\Windows\System\HYhhbxW.exe
  2⤵
  PID:11416
- C:\Windows\System\IQIKxDB.exe
  C:\Windows\System\IQIKxDB.exe
  2⤵
  PID:11440
- C:\Windows\System\yanoeiq.exe
  C:\Windows\System\yanoeiq.exe
  2⤵
  PID:11460
- C:\Windows\System\UsPnogR.exe
  C:\Windows\System\UsPnogR.exe
  2⤵
  PID:11484
- C:\Windows\System\fnIeAWi.exe
  C:\Windows\System\fnIeAWi.exe
  2⤵
  PID:11508
- C:\Windows\System\ikobDqi.exe
  C:\Windows\System\ikobDqi.exe
  2⤵
  PID:11552
- C:\Windows\System\HYDtzmW.exe
  C:\Windows\System\HYDtzmW.exe
  2⤵
  PID:11568
- C:\Windows\System\EjVyrSL.exe
  C:\Windows\System\EjVyrSL.exe
  2⤵
  PID:11588
- C:\Windows\System\hbOvuWX.exe
  C:\Windows\System\hbOvuWX.exe
  2⤵
  PID:11612
- C:\Windows\System\fwmjhiE.exe
  C:\Windows\System\fwmjhiE.exe
  2⤵
  PID:11632
- C:\Windows\System\mQPJTVd.exe
  C:\Windows\System\mQPJTVd.exe
  2⤵
  PID:11660
- C:\Windows\System\FoDoBLJ.exe
  C:\Windows\System\FoDoBLJ.exe
  2⤵
  PID:11680
- C:\Windows\System\GXAuzjm.exe
  C:\Windows\System\GXAuzjm.exe
  2⤵
  PID:11708
- C:\Windows\System\HsCkjeH.exe
  C:\Windows\System\HsCkjeH.exe
  2⤵
  PID:11732
- C:\Windows\System\xsEsoHm.exe
  C:\Windows\System\xsEsoHm.exe
  2⤵
  PID:11756
- C:\Windows\System\yizyDGC.exe
  C:\Windows\System\yizyDGC.exe
  2⤵
  PID:6688
- C:\Windows\System\OKKWohw.exe
  C:\Windows\System\OKKWohw.exe
  2⤵
  PID:11380
- C:\Windows\System\aITYaCK.exe
  C:\Windows\System\aITYaCK.exe
  2⤵
  PID:11492
- C:\Windows\System\bRpLvrN.exe
  C:\Windows\System\bRpLvrN.exe
  2⤵
  PID:756
- C:\Windows\System\NkODnqV.exe
  C:\Windows\System\NkODnqV.exe
  2⤵
  PID:7048
- C:\Windows\System\kFCiLjK.exe
  C:\Windows\System\kFCiLjK.exe
  2⤵
  PID:8784
- C:\Windows\System\plMkQmC.exe
  C:\Windows\System\plMkQmC.exe
  2⤵
  PID:10596
- C:\Windows\System\RzRLBUY.exe
  C:\Windows\System\RzRLBUY.exe
  2⤵
  PID:12016
- C:\Windows\System\yRexMUK.exe
  C:\Windows\System\yRexMUK.exe
  2⤵
  PID:12064
- C:\Windows\System\lmMeYGQ.exe
  C:\Windows\System\lmMeYGQ.exe
  2⤵
  PID:11868
- C:\Windows\System\qYUNcDN.exe
  C:\Windows\System\qYUNcDN.exe
  2⤵
  PID:9996
- C:\Windows\System\rDjoMWd.exe
  C:\Windows\System\rDjoMWd.exe
  2⤵
  PID:12768
- C:\Windows\System\GYmRlGK.exe
  C:\Windows\System\GYmRlGK.exe
  2⤵
  PID:12184
- C:\Windows\System\BBsqYOH.exe
  C:\Windows\System\BBsqYOH.exe
  2⤵
  PID:12920
- C:\Windows\System\QcwXXcE.exe
  C:\Windows\System\QcwXXcE.exe
  2⤵
  PID:12948
- C:\Windows\System\ofDfoij.exe
  C:\Windows\System\ofDfoij.exe
  2⤵
  PID:12336
- C:\Windows\System\BRBIeEj.exe
  C:\Windows\System\BRBIeEj.exe
  2⤵
  PID:12384
- C:\Windows\System\vZNxWap.exe
  C:\Windows\System\vZNxWap.exe
  2⤵
  PID:10284
- C:\Windows\System\BMmnDnn.exe
  C:\Windows\System\BMmnDnn.exe
  2⤵
  PID:12448
- C:\Windows\System\kOApdSn.exe
  C:\Windows\System\kOApdSn.exe
  2⤵
  PID:13136
- C:\Windows\System\lYzarAF.exe
  C:\Windows\System\lYzarAF.exe
  2⤵
  PID:13176
- C:\Windows\System\uzBEVEJ.exe
  C:\Windows\System\uzBEVEJ.exe
  2⤵
  PID:13236
- C:\Windows\System\IsbFths.exe
  C:\Windows\System\IsbFths.exe
  2⤵
  PID:13308
- C:\Windows\System\XaJZSnO.exe
  C:\Windows\System\XaJZSnO.exe
  2⤵
  PID:6224
- C:\Windows\System\FkpgowG.exe
  C:\Windows\System\FkpgowG.exe
  2⤵
  PID:12564
- C:\Windows\System\cLPVVrF.exe
  C:\Windows\System\cLPVVrF.exe
  2⤵
  PID:12600
- C:\Windows\System\qAyZhOf.exe
  C:\Windows\System\qAyZhOf.exe
  2⤵
  PID:8480
- C:\Windows\System\zEMfkPl.exe
  C:\Windows\System\zEMfkPl.exe
  2⤵
  PID:6664
- C:\Windows\System\XDdfCWA.exe
  C:\Windows\System\XDdfCWA.exe
  2⤵
  PID:6772
- C:\Windows\System\HNduCuA.exe
  C:\Windows\System\HNduCuA.exe
  2⤵
  PID:9028
- C:\Windows\System\plvZjpQ.exe
  C:\Windows\System\plvZjpQ.exe
  2⤵
  PID:12820
- C:\Windows\System\njXJCkk.exe
  C:\Windows\System\njXJCkk.exe
  2⤵
  PID:12904
- C:\Windows\System\DWiLjlO.exe
  C:\Windows\System\DWiLjlO.exe
  2⤵
  PID:12368
- C:\Windows\System\SZEzyal.exe
  C:\Windows\System\SZEzyal.exe
  2⤵
  PID:13076
- C:\Windows\System\uBsdQIX.exe
  C:\Windows\System\uBsdQIX.exe
  2⤵
  PID:10928
- C:\Windows\System\vQLaOPu.exe
  C:\Windows\System\vQLaOPu.exe
  2⤵
  PID:11136
- C:\Windows\System\VXvHLlc.exe
  C:\Windows\System\VXvHLlc.exe
  2⤵
  PID:6232
- C:\Windows\System\kBzAvGl.exe
  C:\Windows\System\kBzAvGl.exe
  2⤵
  PID:11628
- C:\Windows\System\IcKqchk.exe
  C:\Windows\System\IcKqchk.exe
  2⤵
  PID:11720
- C:\Windows\System\HIGjQss.exe
  C:\Windows\System\HIGjQss.exe
  2⤵
  PID:11672
- C:\Windows\System\aWgnfjO.exe
  C:\Windows\System\aWgnfjO.exe
  2⤵
  PID:13084
- C:\Windows\System\XoVSBXJ.exe
  C:\Windows\System\XoVSBXJ.exe
  2⤵
  PID:11524
- C:\Windows\System\dVseBec.exe
  C:\Windows\System\dVseBec.exe
  2⤵
  PID:11408
- C:\Windows\System\TEJgLwT.exe
  C:\Windows\System\TEJgLwT.exe
  2⤵
  PID:7332
- C:\Windows\System\goHnBTS.exe
  C:\Windows\System\goHnBTS.exe
  2⤵
  PID:10608
- C:\Windows\System\UfNEvZG.exe
  C:\Windows\System\UfNEvZG.exe
  2⤵
  PID:11284
- C:\Windows\System\zNHgGAP.exe
  C:\Windows\System\zNHgGAP.exe
  2⤵
  PID:7708
- C:\Windows\System\jCszSRA.exe
  C:\Windows\System\jCszSRA.exe
  2⤵
  PID:8200
- C:\Windows\System\qQTowua.exe
  C:\Windows\System\qQTowua.exe
  2⤵
  PID:12508
- C:\Windows\System\mebiSYd.exe
  C:\Windows\System\mebiSYd.exe
  2⤵
  PID:13116
- C:\Windows\System\qFIfQqu.exe
  C:\Windows\System\qFIfQqu.exe
  2⤵
  PID:9788
- C:\Windows\System\AvrEzgA.exe
  C:\Windows\System\AvrEzgA.exe
  2⤵
  PID:11316
- C:\Windows\System\wUCYVhh.exe
  C:\Windows\System\wUCYVhh.exe
  2⤵
  PID:11280
- C:\Windows\System\nfXtSyl.exe
  C:\Windows\System\nfXtSyl.exe
  2⤵
  PID:10980
- C:\Windows\System\YDvkAwF.exe
  C:\Windows\System\YDvkAwF.exe
  2⤵
  PID:10016
- C:\Windows\System\oIBzZLH.exe
  C:\Windows\System\oIBzZLH.exe
  2⤵
  PID:13124
- C:\Windows\System\TWTLwSI.exe
  C:\Windows\System\TWTLwSI.exe
  2⤵
  PID:11596
- C:\Windows\System\QcJupjm.exe
  C:\Windows\System\QcJupjm.exe
  2⤵
  PID:10508
- C:\Windows\System\NIhkaoT.exe
  C:\Windows\System\NIhkaoT.exe
  2⤵
  PID:12412
- C:\Windows\System\MSLBuja.exe
  C:\Windows\System\MSLBuja.exe
  2⤵
  PID:12500
- C:\Windows\System\UiFBDZW.exe
  C:\Windows\System\UiFBDZW.exe
  2⤵
  PID:8392
- C:\Windows\System\erFZaLA.exe
  C:\Windows\System\erFZaLA.exe
  2⤵
  PID:10224
- C:\Windows\System\jgXVmwk.exe
  C:\Windows\System\jgXVmwk.exe
  2⤵
  PID:12588
- C:\Windows\System\mhGmEqI.exe
  C:\Windows\System\mhGmEqI.exe
  2⤵
  PID:10444
- C:\Windows\System\McGsQLk.exe
  C:\Windows\System\McGsQLk.exe
  2⤵
  PID:8852
- C:\Windows\System\uGBEFNQ.exe
  C:\Windows\System\uGBEFNQ.exe
  2⤵
  PID:9576
- C:\Windows\System\RvlpegB.exe
  C:\Windows\System\RvlpegB.exe
  2⤵
  PID:7296
- C:\Windows\System\GxYRcMn.exe
  C:\Windows\System\GxYRcMn.exe
  2⤵
  PID:12300
- C:\Windows\System\NktviRQ.exe
  C:\Windows\System\NktviRQ.exe
  2⤵
  PID:9792
- C:\Windows\System\NEqEGuw.exe
  C:\Windows\System\NEqEGuw.exe
  2⤵
  PID:8072
- C:\Windows\System\pMroWho.exe
  C:\Windows\System\pMroWho.exe
  2⤵
  PID:11452
- C:\Windows\System\qEYuTYM.exe
  C:\Windows\System\qEYuTYM.exe
  2⤵
  PID:10664
- C:\Windows\System\RzowepU.exe
  C:\Windows\System\RzowepU.exe
  2⤵
  PID:10132
- C:\Windows\System\EVaoUeD.exe
  C:\Windows\System\EVaoUeD.exe
  2⤵
  PID:11108
- C:\Windows\System\WWpPAgk.exe
  C:\Windows\System\WWpPAgk.exe
  2⤵
  PID:1464
- C:\Windows\System\KwitafI.exe
  C:\Windows\System\KwitafI.exe
  2⤵
  PID:10360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_elvoldje.o3a.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AWzSgVp.exe

Filesize
2.0MB

MD5
58707afa504c48dd2dc12583941b1e1b

SHA1
845b2cdaadfd5884ef97395be007437b6084e7b7

SHA256
64eb13d51ce6318b66ab02c6a7687251428ff928d361983bc1571fb12b2c97f4

SHA512
7c8317981e0c5008e1bc0c84600bece9a21036acf6f242fcdb6dbf0e0c147045c76cca8651e0e28fa292f42f334611aa5fbfc9beac68949c3a5abd3dc933de1f

Download Submit
C:\Windows\System\CsipGBG.exe

Filesize
2.0MB

MD5
dcfaa5d4909638d85d040f102fcf12b7

SHA1
213fc2ffa9bd123159b2168375eae8654b3d2bd7

SHA256
e84ac209eee8fe9795e003e227fbe7d3c149769f4db7e443ffbe6d65fb45b7bf

SHA512
30bee5c7563b736606cf12dc8192efa043ef26da10a6204091cc91e1f59c1681a3da20d345e20cea732e4385c4806b9e8d054b696881e4191b026f505bfef70a

Download Submit
C:\Windows\System\DVAeaIm.exe

Filesize
2.0MB

MD5
fe4756e0d9da62fdb75535ed73dc8fcf

SHA1
132f24c96d7bf292c3f5ffa736864b31c9ed6ff6

SHA256
1a7845c88cce9631d64cf5891b14798b04286c37c0ce097cf0a765232c18eaa4

SHA512
43888895b9aa229f74d7bbed8bc5bc5cdcd05f89b3bb2514a6ef6c7645e969c41932c864439974ae5b5305dcd10bd841eaac7d1c860ba57262c4ac633991e1f6

Download Submit
C:\Windows\System\FRNxIfC.exe

Filesize
2.0MB

MD5
02eea988526dc75a87f385ddc33f234b

SHA1
bd127b3293a496d9c7088263a9312f122d6bf55f

SHA256
0b3784bd5e459d6cadc7bdd9e86a935a54d307e7b33793b238c75b37a7e0b222

SHA512
d8d0cde010807f919b2e9249a622a45377a33da4b1bda63bb623103b9f715d6db0af4b65bca95cff7447b38d31a88836e43974ee5c5e1e4bc5ed7ae58944384d

Download Submit
C:\Windows\System\FtnPVDQ.exe

Filesize
2.0MB

MD5
6967c3d2018798c893e9060fca46b389

SHA1
aa379734ec257a9558f01ef764f7f5c9855447b0

SHA256
a31d24285694bfce001418c70891a7b8bb8a0feae542d561ad7fc1a5bdf1dc38

SHA512
d924fdc81dca1e748a2e9b892c4cfeba73148a58d0dabc168a608dfe78a8eae0d8daa7cffe7a4a85797724f28083583fb9920600b4aba97705e6847134653864

Download Submit
C:\Windows\System\GjKKNZl.exe

Filesize
2.0MB

MD5
34e62b6da636c785caf23e3fdc9c7278

SHA1
2247404723da2682b12040d50c1e77f91fb84356

SHA256
bbe7d4cdce4e01c20ab9a2d75ef99226516ca42bbb47951307053b089e6ed2d7

SHA512
ff8f6ef38c1961b1c53f0f776595d3dbaac172b9ccdf49a567d9f76dffe7e2520e5fda1cdc385950812ea70008fdde60dbd9b51f0d0a9e6397b311dd88088740

Download Submit
C:\Windows\System\JMZwtuf.exe

Filesize
2.0MB

MD5
edfda028030a29c1a921017e3d12f967

SHA1
eb67b4d906ec0b5106e5aa115a2c89a6b8c90aac

SHA256
e2fe4034c7f2af68a0d09a0afb072dabe26b9fa6b26b3c2d97c41d789d636745

SHA512
a52bb2a0dd03db7165d018df7d92e0494f2f1791636c4a501e6671712a45231729835c15130b351bef78e8d07549e69b2214f07c25f984266f5e6878f469c5dd

Download Submit
C:\Windows\System\JznieXO.exe

Filesize
2.0MB

MD5
c0e4e7bf42a1a15d40421875258337a6

SHA1
2d43d16861d9fad52669a998f4f073c87facc2e6

SHA256
2f81debfb9eec491bd0d8064b453450afe3467c8fe4f9274c18fadd04ff58e1c

SHA512
0ea3ece497f4ac73fad6d2e0e294658281cc8891ad36e7a3550f17534a5d1d44586f8368b1b5368ecb2bbcdfb160c3d66cac2292a421ea3c904ef67584dff67b

Download Submit
C:\Windows\System\MZRdbND.exe

Filesize
2.0MB

MD5
24da62559381b122af1da76ea3ee6446

SHA1
30c8f810f603b5bbdaa39bdd49063e30761e4eef

SHA256
0879613bb2f2472d8b2775b88316f37ed88dd7d1dfcaecb849c7425d321ea75e

SHA512
c2aca73cc8ef1b168c02230151ec58c1ee52e382dfdab59eed8136f2a42b1d4928f25c620e6d78ed5363e382253d0d7e885e3c5235213acf88a79ee9f7546879

Download Submit
C:\Windows\System\MfmIpvi.exe

Filesize
2.0MB

MD5
6127394e404c72b6735518cdd510e7b2

SHA1
14264e65e806cb535ee7585847e2b9997ed71f3c

SHA256
41f159588ac4d149bb380e701a4c011bd2d130f5ae6a0ed469216f548c6262d7

SHA512
48244939f8ef3624f0e905bdd4c8377deaeb61c5ea648ccf1f7020fb5feaa82edf427a2659a22e9c1dfe94132554a9492f33b0eb40176ccd505304d9b6f464b5

Download Submit
C:\Windows\System\NCCosJS.exe

Filesize
2.0MB

MD5
dfc4bf3bcafb202f9d047335d4465609

SHA1
ee74c5918aca9615f67eb50a0d12613803c4bbab

SHA256
4c308f8314a80220d248ce1e95c06595b14bad7354f8dab0c5a0d04ece0ae50c

SHA512
5487879906266856cff29837d0775bb54de3da6d03d082a9a0f63e679c87479c729df647bc93e88b9ac2a13d981f15da8b310caf8d7c6a5300c02624f7fed502

Download Submit
C:\Windows\System\PbgncOx.exe

Filesize
2.0MB

MD5
6593cd46ef9dba3f0a3d1c6dc26a1dc5

SHA1
0f385c3b6ec2ca38dd726cd21620dcf6fd950590

SHA256
591d9b821506e39c723a43b2ff84e174eec6c4f0c3d6860631f2401e753907f0

SHA512
99ce1224e52dd573a42b73aaf510416cec5a878468cbc8c81bb6e1e19af75b21b9b8553a6a0f3332c99a0b4915c069490e82660656204e56559315b6a304b788

Download Submit
C:\Windows\System\ScpKgJP.exe

Filesize
2.0MB

MD5
a1f0f9056cf2b437a2349992b8c899ad

SHA1
ba2bfb671467446cf951ae6019bcab898244ee23

SHA256
2d964bc995d6816ae24e6c04531795285f0cfdec75baffa2d487d97a1b92d5b9

SHA512
c526487a703a85eee320174d25f9addf1df44ab8e74f455106442898cba9ddc29dc1d68946cd95ff7fb4c47f88cfdc18ecbd83393ca4d7ce89566e9004bd05f6

Download Submit
C:\Windows\System\SeYlzuL.exe

Filesize
2.0MB

MD5
07be7c8a2b6a218531428a7a32b8cd70

SHA1
5f9f3921090c243a5ab259039bbe407cd4f0f369

SHA256
a028d92368bca2fda12f86a7d6a0ee9779592686bf270351faace62514c8a5b2

SHA512
2fd49a3cca92e55e1b8ab983c32cabe1052b054a32a6e09995db63711488aa2a86283f16e22124466b16366b65e5335a702fea98e48da35fc8e9f76ac88e5cd9

Download Submit
C:\Windows\System\UQAawyT.exe

Filesize
2.0MB

MD5
32bbd4f52465c33ab72671f2398e27cc

SHA1
c11662c068a35c0fc409aa427876a0797d8321c6

SHA256
f1bd75d26dcdeff4b0f84d06f2a541ace309f61b4dc943cd2c614a1138d9ab6c

SHA512
c57253d310905064856ec03dc94874df2a451b8c03aed36027f9e1d3815d218d5b28c87d2662040c3faada8ae59045ce963ab93382e5e5c7f0782eb78dad93b9

Download Submit
C:\Windows\System\VGmCKBc.exe

Filesize
2.0MB

MD5
a567e9cbebc6da4c8e6caf0b871a00a5

SHA1
9934ba3d726dbee48e931177926caf8fabd5b33d

SHA256
4d304b1430def6046acc884386860ecbd1ea73d60c86eda34825ac597e8aa80a

SHA512
81824917a289af12c005226c30e9210605c40d8e3c491b94c99eb4d36df48a5b5c7b3eb69542c91e5f857c7e07a08ea3c3972fb1dcd0b184a8de7d6b2a31369a

Download Submit
C:\Windows\System\VYFYdYp.exe

Filesize
2.0MB

MD5
f86c995bac7aa6e52829e59ce306cb45

SHA1
71be78c1365834258f4ec63e26453d79743cfbc0

SHA256
fa319be884c9f4563be8548d7857130665e08fdb1b3326b311b6121425cbc235

SHA512
c928cf371af93e6df1590a4e55d195f9cb70d25d3fa7845d56aa80eb7674f27718b3203a63c01eabab77a271aab3f9376da4a236e9b8874b85e0922304110882

Download Submit
C:\Windows\System\VwMRMCT.exe

Filesize
2.0MB

MD5
b908f84d7212d59f1bf88723afcdf7a0

SHA1
91ac1b468fd1132289d39607a1cb745a03b970e6

SHA256
969ca31d2090d9dc1bd749c6eb4d9fbbf73906de04ab0ebe21d30ffaf3d55391

SHA512
4b9a4bca0f07b9e87f271054f41e3216aa5fe030c4c1eede2e926b37cf3f9b7f7925d8f5240d8be6565c4d114f94c012dc0dbbbd0a4aa66ec718b7e552a1ce7d

Download Submit
C:\Windows\System\XJwdeqH.exe

Filesize
2.0MB

MD5
7b6b3ec385c82cdec44fdaa4c65f585d

SHA1
0f67eeb867aa01854a304745cbb66d4c1b3022e7

SHA256
2e206d74733c8019c0917571929b4e1b1790441e066892412f95d122f8845758

SHA512
e143b9aad05152d8c8945bb2d119b15a6d1e83a14ad9d9f71aae73bad25ceabbf67927d0a503ef6d4c5dad1381ca239937f4638bd25128dc84d89e80996cd6b3

Download Submit
C:\Windows\System\XtUJSQU.exe

Filesize
2.0MB

MD5
23a7fb789b27e3708e751edcf4a134b7

SHA1
dd68a4efdfb6cca0d7a8ebbc1e0cea26e10db352

SHA256
a7addc04661d148212b1b50e04fda930e6cf0f0e6750fda829a9f283b43c29c9

SHA512
5bc4cb861a8a2c7641900e1b5e5321860bf7b7350b646e19f034e8a1233453709068090686313c9e40acae8fb18b001f0fa6b1e507b0acd6b9822c481732bd1a

Download Submit
C:\Windows\System\YpQAcko.exe

Filesize
2.0MB

MD5
b8b6ffb499f22b2e9c5251768978ba44

SHA1
23b5835c7e3150f70331f989feb409a22af4469b

SHA256
4d4317f118c80422b9ce17eeb2f43d448424aa6e4aac5df41c75c31fb8bc58e4

SHA512
1e22d42607eeb4c91fab470c380bae776d3dfe23db6b99de780e6e6f96259c00eccf1faea049a25757310dbd0cba908b0ea2740f23854aeeb1813636c49dfa3a

Download Submit
C:\Windows\System\gDARjmo.exe

Filesize
2.0MB

MD5
ad56e818975c807427f6079eee3202ad

SHA1
a1a43340c68d33123ec8473f83459f2726fc526e

SHA256
9ceec5440f0eb8dfd999f800e1ce2fb28e28489970bcfcc7ca88d45cfe52ece2

SHA512
1bed8196e45ebb40c292e603fa0217d42e318edae901eb9f76a6f71dab786699b42eda99bdac8feb872b4f58b8c3aac4d72547a0dcc2286a5e968967d8c741a2

Download Submit
C:\Windows\System\hDSQlYG.exe

Filesize
2.0MB

MD5
6ee2c5bee01cbdaf583022364be53935

SHA1
80730f532071a2c100af7000be25aa1f76ee048c

SHA256
af241ce5faf365a9278d26d59a63768656be1281c4e9525be7b9f106d5971721

SHA512
16c974552d371175cb8e68b0f79c1ae64e743eca972a6c1b91dba0c3003a1c356a6ffdb9fff5350376b45fa862c45ddf86615ed07bfba31c0bc85aeae92f2c16

Download Submit
C:\Windows\System\jjzuRrU.exe

Filesize
2.0MB

MD5
cff4b3890cb4f4dc43a34a8516bcf2b2

SHA1
d43de447820d5a12450beaddf724bf5d27f9f758

SHA256
463c61b5e1d13e3c212ab120486d8b476d918e3bac602ad4907f30b30d9188fc

SHA512
4d07b81b12170cee93186a2506a20631bd1ec6105667d55b8661a385ca18506b3e4d7d509b16f34d66ba23284d82c2c9e86eccf410869a1011e9b7f97bccbaf6

Download Submit
C:\Windows\System\mubEoyt.exe

Filesize
2.0MB

MD5
088adb490cf4a6ee438b78bb86f8cc9b

SHA1
72c1f6f20d093dcf0cb7d90333e8c0323a577add

SHA256
a645091ad4f838fd71877ada8e02118d7c219038ed2e689979950b11d104547c

SHA512
f5e6da8d10f3087401d619da2ee97309b9dfc50009308cc4ee015d007027a36d16ae8b443044e01e834e48929345a0bc715cc26e70c0cf08d2f79c28d5debfb4

Download Submit
C:\Windows\System\nqzGbqo.exe

Filesize
2.0MB

MD5
a87aa92d05fced138301acdb9ece40e8

SHA1
0a28de36ffd759f31604e3e961db4f4598128315

SHA256
c012ad718602c3c85a4a7ba451299ab7b9ece677b470ab3e287739aea21c7f38

SHA512
a2025d71d8eb7dda396ba99d2b46aca8a3538ddf118a114d8bba927710abab2279eedcfa07c76a092094263c55ceac422f36314f3bb14186d36b647923da09a8

Download Submit
C:\Windows\System\oVShYKY.exe

Filesize
2.0MB

MD5
9867625e47e556dae69fc0da59953a57

SHA1
a2408f716a934fd9a6c361de2bfd9e9f9b427ec1

SHA256
22ae7e886bea302bb10e5a88e401534c9c685451625200c59bf9cdccc5f009ee

SHA512
c2ef2124192bb1b65981e2178c3c5c22e717046fbf9ffc15185a303ccb5f23d63b6c098da42b9176bc7f0812bc23e86211a36e2710de07b317fc609e4f672409

Download Submit
C:\Windows\System\psxXowY.exe

Filesize
2.0MB

MD5
d4680b0eafc53dd1a673dbd4389fd9c0

SHA1
8a148c4e3c2705a1f906770aee67225ff64753d7

SHA256
ef9cd0cc0b613a8cef45f7d01368c3b11a65e8130ed58345c198c5494e07a73f

SHA512
a583de80d486e68cccbbc7bfd2d60840db089a9fc0583a5c180ea2af7490c21f0aa6398a5b7d7b6cecb52a6b5b7124f7ffbde41400be5cf22e590ba81f084b59

Download Submit
C:\Windows\System\teqmzsT.exe

Filesize
2.0MB

MD5
2d94467cba1d3a18ec95a4819a0b303d

SHA1
8593b456221fcc659243ecc143c7ec405e0f3194

SHA256
220afbba73d5dcf811b0acef9e3782e3398b37ec38f5a88371439b1453e6a4ec

SHA512
dd88967c3c6248474b6260a0fd39d91c64cc706026248467ff293c8a3acd396ded8909d284d5a69a94a451af7dc74dcc544e388e870956e18225e59aeef4e2ee

Download Submit
C:\Windows\System\ttORnAE.exe

Filesize
2.0MB

MD5
4d781f802c3fc6a7f800552dd104bafa

SHA1
5d84aba1fe60a9be6139b275a0897bc2d2b108fb

SHA256
eae709516a611e4d0437ec6287448a257334ac6470c5a52fdd66d7a890a2060d

SHA512
7262b7cd3666b2ddf751d0969d019869dca003610bc55b5e9bcac35eb63d1d703048f84f4baa27b2db00af419844cce658e954d2f9659e7c7a8a7277b4e7f422

Download Submit
C:\Windows\System\urKWDsx.exe

Filesize
2.0MB

MD5
a4d572f224aa6a9e2e7fd6944cbaca8e

SHA1
2545ff6cc7b772d26ac14a0bd4ed4e84ea795877

SHA256
1234dc9cf68fb9b0d6932e52be5df651ca7d85d5c4f20912d1de647488465959

SHA512
df9144684705f37af8939f9f7c4b517664dc656de87fb891ab035b33e3003a7a74bf9749ed01f5e36e5a59e6917a7f18e167743fb53f115bc2f7b9bf84e7c27c

Download Submit
C:\Windows\System\vAjloBU.exe

Filesize
2.0MB

MD5
7320dc66c3993c4f985e1cd118fe595c

SHA1
c835dbbf4ca370ebc220b5d74c88bb491554dbdf

SHA256
09ca995c8c1dbd8b5eda4a55085403d54bb42c744edd506ab4cdee50b7b09a53

SHA512
68ef049abc59e8890ea891edfc7d469cfac1379f771762b16e5bfe0cd2d6ef19db1cb50265e911196517e6a99ad2f7c01c8019d803665272f079b8e42efc7e59

Download Submit
C:\Windows\System\wrmABJh.exe

Filesize
2.0MB

MD5
64a649f35ed6a80a395830d55adcb676

SHA1
7a57e2f63b7d952c06c4d61f168b7e56122940d5

SHA256
0b8263d231fb56bd7cd7d5b35cf7538201dcfe9079b5ec9f1c8081e0ed87bd52

SHA512
5ad89d742124b6922463fe987b7d9f52e4a1c03822e9a530a5f4c9cb50ccc384c41df73c167cc7725179d7579d2e18829873f2978f35bb8be3600a0fefa7ed47

Download Submit
C:\Windows\System\yMQFDQW.exe

Filesize
2.0MB

MD5
52f4544b219e61b1ad3e447ed5529bae

SHA1
ebe4bc8a1db3b74f79db5d0586fda7f5d351b3d1

SHA256
a61a163a4feb6da34fa1dd19e13edf9d7dab1d18c29dc54ecf2ddfa90a2ac46b

SHA512
3edd26c0b51e8fbd2a6acfe6e3bb11429d7687357583dc7e89c1ea2d81acd32a79a2727cf7dfb5723d78c71657aef0de2144519306fc380d1623f7ebabcecb5b

Download Submit
C:\Windows\System\yrkiNCI.exe

Filesize
2.0MB

MD5
6e75b825d08139d053937dee121982e0

SHA1
28f4cb288282350c2e6331e75606ecba95f7d0b9

SHA256
21e4dfdfc1d9638970c629d26a27b101c29159023976d433f901c37bea2bd998

SHA512
2809bba52fc09bfaa32e6ee811b95b4afee675ff4da2210986f0183150a340e607f0ddae7575757bedd8b2b4ac9c519b5066d4cd241c69119585bb0afa8de60b

Download Submit
C:\Windows\System\yuXfpdN.exe

Filesize
2.0MB

MD5
27b6256651443970f68986c477a426a1

SHA1
1e1eec17195415cbd8adc0be8d6e6653c7c2d118

SHA256
26e207a6d333f1694cb20ced84ff8a0ce838451995ee51d7b379e0da158e9f2d

SHA512
afd6d10b7699e7f3f901add324aec9ad57f7e91992685fc4f7a02c74eb77185eae7d2249d401a33ff76c5e5dad8c5cc296b3a410bafc22671d3ba324181d51c9

Download Submit
C:\Windows\System\zkMrByv.exe

Filesize
2.0MB

MD5
b740ceb8eb29459c22431b633215a522

SHA1
d3b8511de024f9f761819e238497058388b5c47a

SHA256
66ae7e27e8ab430a27a3f0797911f65c295127c50c7dcf9bdec6db4f65df657f

SHA512
f7f41ba46f66139aa85dd79cbd7a4d77860b7487968cb0b6eeec96f1c110973b9bc3a1cec27702470d70b490b95946e6922c44e2c6f0de3a7e13b973170704bc

Download Submit
C:\Windows\System\zkmYqPc.exe

Filesize
2.0MB

MD5
30e916178e5cb1075d8bfa890feac659

SHA1
b241da2ba62090b2732de8cb5dda77e9542b52da

SHA256
2de67c72c01f26a49ffb3031f1c9cb2daea38d2e476da15a0e82301f4fa5c05b

SHA512
f454f969e0924e1c7b6b699785f5f2bdcbcb099cc68aea2fc112fa26003ebecac43045d4a3f77b0e0f6f9f0e9453acb413c36c8c9c3194e737b76b657c7e706f

Download Submit
C:\Windows\System\zmTvVQo.exe

Filesize
2.0MB

MD5
1fe2ad5d7e3d3a3f2c482f3d479243c7

SHA1
788584e1bd4ba83b25de5680f9f5de8daac31b01

SHA256
3273090e50b0ea82b1c0a6afb340a7981d51b2596b9d6e95b132994f397d130e

SHA512
1bf6686ef924bcf7e0f3227581c35dd84c6f4a95bc9e7f530e96973e163800f74c1e05a71a326ab7e1e31402b1a88b6a7c0dbe90d4b9e875e5d6053bea548fe3

Download Submit
C:\Windows\System\zrsEWKR.exe

Filesize
2.0MB

MD5
5693a1cad57e7208964d25c8ecc89450

SHA1
ff844b8c57a66369e0f18fc32378529134ee2c44

SHA256
95f1f617b65a6c373a1abed10b3771f99a786837762a0ea45f6a86ff98170865

SHA512
02f3e6740fa1e24d517ed225ce1a7f9ef6051836da8095293a4f6cd78c0b6c64e1756e55a0cde7dc1a8184ae1d2fd25447e30e5b562256c12d82951d7a4a66fd

Download Submit
memory/1080-40-0x00007FF64D3A0000-0x00007FF64D792000-memory.dmp

Filesize
3.9MB

Download
memory/1080-2510-0x00007FF64D3A0000-0x00007FF64D792000-memory.dmp

Filesize
3.9MB

Download
memory/1080-2522-0x00007FF64D3A0000-0x00007FF64D792000-memory.dmp

Filesize
3.9MB

Download
memory/1104-2517-0x00007FF707E70000-0x00007FF708262000-memory.dmp

Filesize
3.9MB

Download
memory/1104-43-0x00007FF707E70000-0x00007FF708262000-memory.dmp

Filesize
3.9MB

Download
memory/1316-225-0x00007FF657C10000-0x00007FF658002000-memory.dmp

Filesize
3.9MB

Download
memory/1316-2529-0x00007FF657C10000-0x00007FF658002000-memory.dmp

Filesize
3.9MB

Download
memory/1392-2548-0x00007FF66FCE0000-0x00007FF6700D2000-memory.dmp

Filesize
3.9MB

Download
memory/1392-600-0x00007FF66FCE0000-0x00007FF6700D2000-memory.dmp

Filesize
3.9MB

Download
memory/1540-2550-0x00007FF77AAC0000-0x00007FF77AEB2000-memory.dmp

Filesize
3.9MB

Download
memory/1540-526-0x00007FF77AAC0000-0x00007FF77AEB2000-memory.dmp

Filesize
3.9MB

Download
memory/1556-428-0x00007FF6D7540000-0x00007FF6D7932000-memory.dmp

Filesize
3.9MB

Download
memory/1556-2541-0x00007FF6D7540000-0x00007FF6D7932000-memory.dmp

Filesize
3.9MB

Download
memory/1912-345-0x00007FF6E2F30000-0x00007FF6E3322000-memory.dmp

Filesize
3.9MB

Download
memory/1912-2562-0x00007FF6E2F30000-0x00007FF6E3322000-memory.dmp

Filesize
3.9MB

Download
memory/1936-115-0x00007FF7EF990000-0x00007FF7EFD82000-memory.dmp

Filesize
3.9MB

Download
memory/1936-2528-0x00007FF7EF990000-0x00007FF7EFD82000-memory.dmp

Filesize
3.9MB

Download
memory/2396-2555-0x00007FF645370000-0x00007FF645762000-memory.dmp

Filesize
3.9MB

Download
memory/2396-226-0x00007FF645370000-0x00007FF645762000-memory.dmp

Filesize
3.9MB

Download
memory/2456-2560-0x00007FF79A970000-0x00007FF79AD62000-memory.dmp

Filesize
3.9MB

Download
memory/2456-596-0x00007FF79A970000-0x00007FF79AD62000-memory.dmp

Filesize
3.9MB

Download
memory/2700-307-0x00007FF669D90000-0x00007FF66A182000-memory.dmp

Filesize
3.9MB

Download
memory/2700-2547-0x00007FF669D90000-0x00007FF66A182000-memory.dmp

Filesize
3.9MB

Download
memory/2796-218-0x00007FF6EF960000-0x00007FF6EFD52000-memory.dmp

Filesize
3.9MB

Download
memory/2796-2535-0x00007FF6EF960000-0x00007FF6EFD52000-memory.dmp

Filesize
3.9MB

Download
memory/3080-2539-0x00007FF787850000-0x00007FF787C42000-memory.dmp

Filesize
3.9MB

Download
memory/3080-434-0x00007FF787850000-0x00007FF787C42000-memory.dmp

Filesize
3.9MB

Download
memory/3268-2537-0x00007FF752FE0000-0x00007FF7533D2000-memory.dmp

Filesize
3.9MB

Download
memory/3268-599-0x00007FF752FE0000-0x00007FF7533D2000-memory.dmp

Filesize
3.9MB

Download
memory/3288-597-0x00007FF6810C0000-0x00007FF6814B2000-memory.dmp

Filesize
3.9MB

Download
memory/3288-2520-0x00007FF6810C0000-0x00007FF6814B2000-memory.dmp

Filesize
3.9MB

Download
memory/3476-480-0x0000013E4FD20000-0x0000013E4FD42000-memory.dmp

Filesize
136KB

Download
memory/3476-598-0x00007FFE63E00000-0x00007FFE648C1000-memory.dmp

Filesize
10.8MB

Download
memory/3476-154-0x0000013E4FD50000-0x0000013E4FD60000-memory.dmp

Filesize
64KB

Download
memory/3644-253-0x00007FF7F1970000-0x00007FF7F1D62000-memory.dmp

Filesize
3.9MB

Download
memory/3644-2553-0x00007FF7F1970000-0x00007FF7F1D62000-memory.dmp

Filesize
3.9MB

Download
memory/3648-2514-0x00007FF7B33C0000-0x00007FF7B37B2000-memory.dmp

Filesize
3.9MB

Download
memory/3648-15-0x00007FF7B33C0000-0x00007FF7B37B2000-memory.dmp

Filesize
3.9MB

Download
memory/3648-2477-0x00007FF7B33C0000-0x00007FF7B37B2000-memory.dmp

Filesize
3.9MB

Download
memory/3672-2524-0x00007FF670880000-0x00007FF670C72000-memory.dmp

Filesize
3.9MB

Download
memory/3672-173-0x00007FF670880000-0x00007FF670C72000-memory.dmp

Filesize
3.9MB

Download
memory/4020-2533-0x00007FF72B9B0000-0x00007FF72BDA2000-memory.dmp

Filesize
3.9MB

Download
memory/4020-2512-0x00007FF72B9B0000-0x00007FF72BDA2000-memory.dmp

Filesize
3.9MB

Download
memory/4020-105-0x00007FF72B9B0000-0x00007FF72BDA2000-memory.dmp

Filesize
3.9MB

Download
memory/4104-1-0x000001BCB85A0000-0x000001BCB85B0000-memory.dmp

Filesize
64KB

Download
memory/4104-0-0x00007FF784EA0000-0x00007FF785292000-memory.dmp

Filesize
3.9MB

Download
memory/4536-2511-0x00007FF62A9A0000-0x00007FF62AD92000-memory.dmp

Filesize
3.9MB

Download
memory/4536-2531-0x00007FF62A9A0000-0x00007FF62AD92000-memory.dmp

Filesize
3.9MB

Download
memory/4536-66-0x00007FF62A9A0000-0x00007FF62AD92000-memory.dmp

Filesize
3.9MB

Download
memory/4556-2519-0x00007FF7030F0000-0x00007FF7034E2000-memory.dmp

Filesize
3.9MB

Download
memory/4556-153-0x00007FF7030F0000-0x00007FF7034E2000-memory.dmp

Filesize
3.9MB

Download