xmrig | e550c1a0b1d98284d2d501bc1bb1231aebafc7903c5b3b5d3ba7fc03a3fbe82f

Analysis

max time kernel
65s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 16:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
Size

2.0MB
MD5

059e8d5a37d3e7ef73efa0588f16b59a
SHA1

e8a7b3b01b756ce5bbc350a85d312c2f9c042f0d
SHA256

e550c1a0b1d98284d2d501bc1bb1231aebafc7903c5b3b5d3ba7fc03a3fbe82f
SHA512

49670df5f7f3944d9923bfc927d48d922c9a097a54a6cbe3667ba2639e19400f066c3f378b3160e63386f838ab7c604aaf2c52cfa7c28b9bdc21a621b157769d
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDbD:NABK

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 43 IoCs

miner

resource	yara_rule
behavioral2/memory/3804-47-0x00007FF61F8A0000-0x00007FF61FC92000-memory.dmp	xmrig
behavioral2/memory/3036-110-0x00007FF7E9C40000-0x00007FF7EA032000-memory.dmp	xmrig
behavioral2/memory/4056-125-0x00007FF64E2C0000-0x00007FF64E6B2000-memory.dmp	xmrig
behavioral2/memory/1940-166-0x00007FF66A7C0000-0x00007FF66ABB2000-memory.dmp	xmrig
behavioral2/memory/648-179-0x00007FF7B76B0000-0x00007FF7B7AA2000-memory.dmp	xmrig
behavioral2/memory/2688-173-0x00007FF60A690000-0x00007FF60AA82000-memory.dmp	xmrig
behavioral2/memory/4596-167-0x00007FF6A65D0000-0x00007FF6A69C2000-memory.dmp	xmrig
behavioral2/memory/4888-158-0x00007FF758EA0000-0x00007FF759292000-memory.dmp	xmrig
behavioral2/memory/3024-153-0x00007FF618D20000-0x00007FF619112000-memory.dmp	xmrig
behavioral2/memory/3816-146-0x00007FF6158D0000-0x00007FF615CC2000-memory.dmp	xmrig
behavioral2/memory/4380-145-0x00007FF606450000-0x00007FF606842000-memory.dmp	xmrig
behavioral2/memory/3880-142-0x00007FF747840000-0x00007FF747C32000-memory.dmp	xmrig
behavioral2/memory/3336-111-0x00007FF644CD0000-0x00007FF6450C2000-memory.dmp	xmrig
behavioral2/memory/2588-97-0x00007FF6A0D60000-0x00007FF6A1152000-memory.dmp	xmrig
behavioral2/memory/876-81-0x00007FF700620000-0x00007FF700A12000-memory.dmp	xmrig
behavioral2/memory/2124-63-0x00007FF759830000-0x00007FF759C22000-memory.dmp	xmrig
behavioral2/memory/2536-2548-0x00007FF74A0F0000-0x00007FF74A4E2000-memory.dmp	xmrig
behavioral2/memory/4076-2549-0x00007FF775410000-0x00007FF775802000-memory.dmp	xmrig
behavioral2/memory/3804-2550-0x00007FF61F8A0000-0x00007FF61FC92000-memory.dmp	xmrig
behavioral2/memory/4916-2551-0x00007FF702D50000-0x00007FF703142000-memory.dmp	xmrig
behavioral2/memory/4324-2552-0x00007FF639C50000-0x00007FF63A042000-memory.dmp	xmrig
behavioral2/memory/2568-2553-0x00007FF7D2640000-0x00007FF7D2A32000-memory.dmp	xmrig
behavioral2/memory/2536-2555-0x00007FF74A0F0000-0x00007FF74A4E2000-memory.dmp	xmrig
behavioral2/memory/4076-2557-0x00007FF775410000-0x00007FF775802000-memory.dmp	xmrig
behavioral2/memory/2124-2559-0x00007FF759830000-0x00007FF759C22000-memory.dmp	xmrig
behavioral2/memory/3804-2561-0x00007FF61F8A0000-0x00007FF61FC92000-memory.dmp	xmrig
behavioral2/memory/3024-2565-0x00007FF618D20000-0x00007FF619112000-memory.dmp	xmrig
behavioral2/memory/4888-2567-0x00007FF758EA0000-0x00007FF759292000-memory.dmp	xmrig
behavioral2/memory/4916-2564-0x00007FF702D50000-0x00007FF703142000-memory.dmp	xmrig
behavioral2/memory/876-2574-0x00007FF700620000-0x00007FF700A12000-memory.dmp	xmrig
behavioral2/memory/1940-2577-0x00007FF66A7C0000-0x00007FF66ABB2000-memory.dmp	xmrig
behavioral2/memory/4596-2579-0x00007FF6A65D0000-0x00007FF6A69C2000-memory.dmp	xmrig
behavioral2/memory/3336-2583-0x00007FF644CD0000-0x00007FF6450C2000-memory.dmp	xmrig
behavioral2/memory/2688-2581-0x00007FF60A690000-0x00007FF60AA82000-memory.dmp	xmrig
behavioral2/memory/4324-2576-0x00007FF639C50000-0x00007FF63A042000-memory.dmp	xmrig
behavioral2/memory/3036-2571-0x00007FF7E9C40000-0x00007FF7EA032000-memory.dmp	xmrig
behavioral2/memory/2588-2570-0x00007FF6A0D60000-0x00007FF6A1152000-memory.dmp	xmrig
behavioral2/memory/4380-2599-0x00007FF606450000-0x00007FF606842000-memory.dmp	xmrig
behavioral2/memory/3816-2598-0x00007FF6158D0000-0x00007FF615CC2000-memory.dmp	xmrig
behavioral2/memory/648-2590-0x00007FF7B76B0000-0x00007FF7B7AA2000-memory.dmp	xmrig
behavioral2/memory/3880-2586-0x00007FF747840000-0x00007FF747C32000-memory.dmp	xmrig
behavioral2/memory/4056-2593-0x00007FF64E2C0000-0x00007FF64E6B2000-memory.dmp	xmrig
behavioral2/memory/2568-2588-0x00007FF7D2640000-0x00007FF7D2A32000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2536	SGspJlP.exe
4076	GUGuICx.exe
3804	JMmEDoA.exe
4916	BxxZwck.exe
2124	jPxcjqM.exe
3024	TuHsncS.exe
4324	FfHwvvK.exe
4888	vhQiabx.exe
1940	jsKziev.exe
876	Rqikiwv.exe
2588	PECTmYf.exe
3036	awTLLHQ.exe
4596	jjWPmsT.exe
2688	njeWLpm.exe
3336	JtYUmfy.exe
4056	zARhjIY.exe
648	aAFbBIW.exe
2568	quswHXN.exe
3880	AMurxQm.exe
4380	vbWCIva.exe
3816	TsseAwR.exe
3500	NSFCfDa.exe
1704	RWmTVUt.exe
3672	uptmSqJ.exe
2416	KjzRphY.exe
2344	ZxtQIzs.exe
724	uaLHbLN.exe
1636	XeDCHgT.exe
1504	shmRveR.exe
3140	xcVnkWd.exe
3956	oHPATzn.exe
2628	QbylpgZ.exe
3596	RjMFXSm.exe
3288	sgrcvIs.exe
1968	QHpYCkI.exe
1544	oSMuhxK.exe
4524	EwYKjpD.exe
3052	erdDvMf.exe
4100	ImsOFcp.exe
4564	gccSDpS.exe
4688	EsfkGBC.exe
2084	PtUUrno.exe
3300	WxqMFte.exe
408	WjDPwPM.exe
4480	DTpSRoQ.exe
2984	iCHgdkI.exe
3092	SGifcak.exe
4748	rrehwjK.exe
1220	gbfKNCA.exe
4840	XVvBvHc.exe
3648	DWcQuRw.exe
4212	FvXeCgC.exe
2372	gUEucnk.exe
4588	ZZpOShp.exe
4316	jWSpThv.exe
620	HCuqkzW.exe
4852	XZtgmnv.exe
2296	xmQsHVN.exe
4228	OCbjKnX.exe
3364	kzHVJPD.exe
4308	eGXXOgu.exe
3004	zeycorQ.exe
116	hAhTLWO.exe
968	YEeXMIu.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3780-0-0x00007FF79E9C0000-0x00007FF79EDB2000-memory.dmp	upx
behavioral2/files/0x000b000000023b85-5.dat	upx
behavioral2/files/0x000a000000023b89-21.dat	upx
behavioral2/files/0x000a000000023b8c-26.dat	upx
behavioral2/files/0x000a000000023b8a-28.dat	upx
behavioral2/files/0x000a000000023b8e-33.dat	upx
behavioral2/files/0x000a000000023b8f-39.dat	upx
behavioral2/memory/3804-47-0x00007FF61F8A0000-0x00007FF61FC92000-memory.dmp	upx
behavioral2/files/0x000a000000023b93-78.dat	upx
behavioral2/files/0x000a000000023b94-87.dat	upx
behavioral2/memory/3036-110-0x00007FF7E9C40000-0x00007FF7EA032000-memory.dmp	upx
behavioral2/memory/4056-125-0x00007FF64E2C0000-0x00007FF64E6B2000-memory.dmp	upx
behavioral2/memory/2568-135-0x00007FF7D2640000-0x00007FF7D2A32000-memory.dmp	upx
behavioral2/memory/1940-166-0x00007FF66A7C0000-0x00007FF66ABB2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba7-197.dat	upx
behavioral2/files/0x000a000000023ba5-195.dat	upx
behavioral2/files/0x000a000000023ba6-192.dat	upx
behavioral2/files/0x000a000000023ba4-190.dat	upx
behavioral2/files/0x000a000000023ba3-185.dat	upx
behavioral2/files/0x000a000000023ba2-180.dat	upx
behavioral2/memory/648-179-0x00007FF7B76B0000-0x00007FF7B7AA2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba1-174.dat	upx
behavioral2/memory/2688-173-0x00007FF60A690000-0x00007FF60AA82000-memory.dmp	upx
behavioral2/files/0x000b000000023b9f-168.dat	upx
behavioral2/memory/4596-167-0x00007FF6A65D0000-0x00007FF6A69C2000-memory.dmp	upx
behavioral2/files/0x000b000000023ba0-161.dat	upx
behavioral2/files/0x000b000000023b86-159.dat	upx
behavioral2/memory/4888-158-0x00007FF758EA0000-0x00007FF759292000-memory.dmp	upx
behavioral2/memory/3024-153-0x00007FF618D20000-0x00007FF619112000-memory.dmp	upx
behavioral2/files/0x000a000000023b9e-147.dat	upx
behavioral2/memory/3816-146-0x00007FF6158D0000-0x00007FF615CC2000-memory.dmp	upx
behavioral2/memory/4380-145-0x00007FF606450000-0x00007FF606842000-memory.dmp	upx
behavioral2/memory/3880-142-0x00007FF747840000-0x00007FF747C32000-memory.dmp	upx
behavioral2/files/0x000a000000023b9d-140.dat	upx
behavioral2/files/0x000a000000023b9c-138.dat	upx
behavioral2/files/0x000a000000023b9b-136.dat	upx
behavioral2/files/0x000a000000023b9a-131.dat	upx
behavioral2/files/0x000a000000023b99-129.dat	upx
behavioral2/files/0x000a000000023b95-126.dat	upx
behavioral2/files/0x000a000000023b98-112.dat	upx
behavioral2/memory/3336-111-0x00007FF644CD0000-0x00007FF6450C2000-memory.dmp	upx
behavioral2/files/0x000a000000023b97-107.dat	upx
behavioral2/files/0x000a000000023b96-105.dat	upx
behavioral2/memory/2588-97-0x00007FF6A0D60000-0x00007FF6A1152000-memory.dmp	upx
behavioral2/memory/876-81-0x00007FF700620000-0x00007FF700A12000-memory.dmp	upx
behavioral2/files/0x000a000000023b92-74.dat	upx
behavioral2/files/0x000a000000023b91-70.dat	upx
behavioral2/files/0x000a000000023b90-65.dat	upx
behavioral2/memory/4324-64-0x00007FF639C50000-0x00007FF63A042000-memory.dmp	upx
behavioral2/memory/2124-63-0x00007FF759830000-0x00007FF759C22000-memory.dmp	upx
behavioral2/memory/4916-57-0x00007FF702D50000-0x00007FF703142000-memory.dmp	upx
behavioral2/files/0x000a000000023b8d-38.dat	upx
behavioral2/files/0x000a000000023b8b-32.dat	upx
behavioral2/memory/4076-16-0x00007FF775410000-0x00007FF775802000-memory.dmp	upx
behavioral2/memory/2536-8-0x00007FF74A0F0000-0x00007FF74A4E2000-memory.dmp	upx
behavioral2/memory/2536-2548-0x00007FF74A0F0000-0x00007FF74A4E2000-memory.dmp	upx
behavioral2/memory/4076-2549-0x00007FF775410000-0x00007FF775802000-memory.dmp	upx
behavioral2/memory/3804-2550-0x00007FF61F8A0000-0x00007FF61FC92000-memory.dmp	upx
behavioral2/memory/4916-2551-0x00007FF702D50000-0x00007FF703142000-memory.dmp	upx
behavioral2/memory/4324-2552-0x00007FF639C50000-0x00007FF63A042000-memory.dmp	upx
behavioral2/memory/2568-2553-0x00007FF7D2640000-0x00007FF7D2A32000-memory.dmp	upx
behavioral2/memory/2536-2555-0x00007FF74A0F0000-0x00007FF74A4E2000-memory.dmp	upx
behavioral2/memory/4076-2557-0x00007FF775410000-0x00007FF775802000-memory.dmp	upx
behavioral2/memory/2124-2559-0x00007FF759830000-0x00007FF759C22000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\zshzmfo.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\tQgojdB.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\agOeOax.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\VwvKdip.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\vLKpdyr.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\ZOoZeqJ.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\FHbVpGh.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\uYNTuLg.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\pjLylyI.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\vCzwCLh.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\cNgwntz.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\IeHhOqY.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\uEuHOOt.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\etYZOYt.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\xAXfbvj.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\rznrByO.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\PqfNmgW.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\LnuUYYd.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\pcrnuVb.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\jiDgQsA.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\KBtPQkd.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\HMuZwbK.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\LefcBCn.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\hOtStXP.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\KZEgXxX.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\SnxDFVH.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\LfKwMVj.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\SRaoZKD.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\kzHVJPD.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\xqkJvwM.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\sfyJQpI.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\LaLWYtq.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\AGHCRRf.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\gibIyeT.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\GvhjcCK.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\JdjBqIV.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\VdIxVaE.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\HlQCHqz.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\xtISGor.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\hlADSUC.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\pjLDByU.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\ghoMRIE.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\kahdegY.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\geiPZwr.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\WkCmifP.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\UqCOHRW.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\wHqgtrn.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\KlrCvJc.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\ojXgceP.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\CUAhLCJ.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\CQRmFyN.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\VOpmVIV.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\yBvjxXQ.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\xbiwHzA.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\tMKeORE.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\VIWPaJd.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\SlMzeRw.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\NyJwIrM.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\awTLLHQ.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\GDUVSvp.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\KmtrNla.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\DnqNtgL.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\xXaYCXu.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\UmrdSJX.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3232	powershell.exe
3232	powershell.exe
3232	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
Token: SeDebugPrivilege	3232	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3780 wrote to memory of 3232	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	84
PID 3780 wrote to memory of 3232	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	84
PID 3780 wrote to memory of 2536	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	85
PID 3780 wrote to memory of 2536	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	85
PID 3780 wrote to memory of 4076	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	86
PID 3780 wrote to memory of 4076	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	86
PID 3780 wrote to memory of 3804	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	87
PID 3780 wrote to memory of 3804	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	87
PID 3780 wrote to memory of 4916	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	88
PID 3780 wrote to memory of 4916	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	88
PID 3780 wrote to memory of 2124	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	89
PID 3780 wrote to memory of 2124	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	89
PID 3780 wrote to memory of 3024	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	90
PID 3780 wrote to memory of 3024	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	90
PID 3780 wrote to memory of 4324	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	91
PID 3780 wrote to memory of 4324	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	91
PID 3780 wrote to memory of 4888	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	92
PID 3780 wrote to memory of 4888	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	92
PID 3780 wrote to memory of 1940	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	93
PID 3780 wrote to memory of 1940	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	93
PID 3780 wrote to memory of 876	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	94
PID 3780 wrote to memory of 876	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	94
PID 3780 wrote to memory of 2588	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	95
PID 3780 wrote to memory of 2588	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	95
PID 3780 wrote to memory of 3036	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	96
PID 3780 wrote to memory of 3036	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	96
PID 3780 wrote to memory of 4596	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	97
PID 3780 wrote to memory of 4596	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	97
PID 3780 wrote to memory of 648	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	98
PID 3780 wrote to memory of 648	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	98
PID 3780 wrote to memory of 2688	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	99
PID 3780 wrote to memory of 2688	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	99
PID 3780 wrote to memory of 3336	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	100
PID 3780 wrote to memory of 3336	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	100
PID 3780 wrote to memory of 4056	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	101
PID 3780 wrote to memory of 4056	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	101
PID 3780 wrote to memory of 2568	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	102
PID 3780 wrote to memory of 2568	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	102
PID 3780 wrote to memory of 3880	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	103
PID 3780 wrote to memory of 3880	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	103
PID 3780 wrote to memory of 4380	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	104
PID 3780 wrote to memory of 4380	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	104
PID 3780 wrote to memory of 3816	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	105
PID 3780 wrote to memory of 3816	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	105
PID 3780 wrote to memory of 3500	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	106
PID 3780 wrote to memory of 3500	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	106
PID 3780 wrote to memory of 1704	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	107
PID 3780 wrote to memory of 1704	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	107
PID 3780 wrote to memory of 3672	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	108
PID 3780 wrote to memory of 3672	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	108
PID 3780 wrote to memory of 2416	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	109
PID 3780 wrote to memory of 2416	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	109
PID 3780 wrote to memory of 2344	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	110
PID 3780 wrote to memory of 2344	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	110
PID 3780 wrote to memory of 724	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	111
PID 3780 wrote to memory of 724	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	111
PID 3780 wrote to memory of 1636	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	112
PID 3780 wrote to memory of 1636	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	112
PID 3780 wrote to memory of 1504	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	113
PID 3780 wrote to memory of 1504	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	113
PID 3780 wrote to memory of 3140	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	114
PID 3780 wrote to memory of 3140	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	114
PID 3780 wrote to memory of 3956	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	115
PID 3780 wrote to memory of 3956	3780	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3232
- C:\Windows\System\SGspJlP.exe
  C:\Windows\System\SGspJlP.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\GUGuICx.exe
  C:\Windows\System\GUGuICx.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\JMmEDoA.exe
  C:\Windows\System\JMmEDoA.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\BxxZwck.exe
  C:\Windows\System\BxxZwck.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\jPxcjqM.exe
  C:\Windows\System\jPxcjqM.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\TuHsncS.exe
  C:\Windows\System\TuHsncS.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\FfHwvvK.exe
  C:\Windows\System\FfHwvvK.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\vhQiabx.exe
  C:\Windows\System\vhQiabx.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\jsKziev.exe
  C:\Windows\System\jsKziev.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\Rqikiwv.exe
  C:\Windows\System\Rqikiwv.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\PECTmYf.exe
  C:\Windows\System\PECTmYf.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\awTLLHQ.exe
  C:\Windows\System\awTLLHQ.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\jjWPmsT.exe
  C:\Windows\System\jjWPmsT.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\aAFbBIW.exe
  C:\Windows\System\aAFbBIW.exe
  2⤵
  - Executes dropped EXE
  PID:648
- C:\Windows\System\njeWLpm.exe
  C:\Windows\System\njeWLpm.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\JtYUmfy.exe
  C:\Windows\System\JtYUmfy.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\zARhjIY.exe
  C:\Windows\System\zARhjIY.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\quswHXN.exe
  C:\Windows\System\quswHXN.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\AMurxQm.exe
  C:\Windows\System\AMurxQm.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\vbWCIva.exe
  C:\Windows\System\vbWCIva.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\TsseAwR.exe
  C:\Windows\System\TsseAwR.exe
  2⤵
  - Executes dropped EXE
  PID:3816
- C:\Windows\System\NSFCfDa.exe
  C:\Windows\System\NSFCfDa.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\RWmTVUt.exe
  C:\Windows\System\RWmTVUt.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\uptmSqJ.exe
  C:\Windows\System\uptmSqJ.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\KjzRphY.exe
  C:\Windows\System\KjzRphY.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\ZxtQIzs.exe
  C:\Windows\System\ZxtQIzs.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\uaLHbLN.exe
  C:\Windows\System\uaLHbLN.exe
  2⤵
  - Executes dropped EXE
  PID:724
- C:\Windows\System\XeDCHgT.exe
  C:\Windows\System\XeDCHgT.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\shmRveR.exe
  C:\Windows\System\shmRveR.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\xcVnkWd.exe
  C:\Windows\System\xcVnkWd.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\oHPATzn.exe
  C:\Windows\System\oHPATzn.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\QbylpgZ.exe
  C:\Windows\System\QbylpgZ.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\RjMFXSm.exe
  C:\Windows\System\RjMFXSm.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\sgrcvIs.exe
  C:\Windows\System\sgrcvIs.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\QHpYCkI.exe
  C:\Windows\System\QHpYCkI.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\oSMuhxK.exe
  C:\Windows\System\oSMuhxK.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\EwYKjpD.exe
  C:\Windows\System\EwYKjpD.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\erdDvMf.exe
  C:\Windows\System\erdDvMf.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\ImsOFcp.exe
  C:\Windows\System\ImsOFcp.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\gccSDpS.exe
  C:\Windows\System\gccSDpS.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\EsfkGBC.exe
  C:\Windows\System\EsfkGBC.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\PtUUrno.exe
  C:\Windows\System\PtUUrno.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\WxqMFte.exe
  C:\Windows\System\WxqMFte.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\WjDPwPM.exe
  C:\Windows\System\WjDPwPM.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\DTpSRoQ.exe
  C:\Windows\System\DTpSRoQ.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\iCHgdkI.exe
  C:\Windows\System\iCHgdkI.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\SGifcak.exe
  C:\Windows\System\SGifcak.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\rrehwjK.exe
  C:\Windows\System\rrehwjK.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\gbfKNCA.exe
  C:\Windows\System\gbfKNCA.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\XVvBvHc.exe
  C:\Windows\System\XVvBvHc.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\DWcQuRw.exe
  C:\Windows\System\DWcQuRw.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\FvXeCgC.exe
  C:\Windows\System\FvXeCgC.exe
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Windows\System\gUEucnk.exe
  C:\Windows\System\gUEucnk.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\ZZpOShp.exe
  C:\Windows\System\ZZpOShp.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\jWSpThv.exe
  C:\Windows\System\jWSpThv.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\HCuqkzW.exe
  C:\Windows\System\HCuqkzW.exe
  2⤵
  - Executes dropped EXE
  PID:620
- C:\Windows\System\XZtgmnv.exe
  C:\Windows\System\XZtgmnv.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\xmQsHVN.exe
  C:\Windows\System\xmQsHVN.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\OCbjKnX.exe
  C:\Windows\System\OCbjKnX.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\kzHVJPD.exe
  C:\Windows\System\kzHVJPD.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System\eGXXOgu.exe
  C:\Windows\System\eGXXOgu.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\zeycorQ.exe
  C:\Windows\System\zeycorQ.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\hAhTLWO.exe
  C:\Windows\System\hAhTLWO.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\YEeXMIu.exe
  C:\Windows\System\YEeXMIu.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\kahdegY.exe
  C:\Windows\System\kahdegY.exe
  2⤵
  PID:3652
- C:\Windows\System\NmFqNAS.exe
  C:\Windows\System\NmFqNAS.exe
  2⤵
  PID:4036
- C:\Windows\System\iyMVoDm.exe
  C:\Windows\System\iyMVoDm.exe
  2⤵
  PID:532
- C:\Windows\System\lfcgDNF.exe
  C:\Windows\System\lfcgDNF.exe
  2⤵
  PID:2752
- C:\Windows\System\owqDpRE.exe
  C:\Windows\System\owqDpRE.exe
  2⤵
  PID:3528
- C:\Windows\System\ttkhXmc.exe
  C:\Windows\System\ttkhXmc.exe
  2⤵
  PID:4456
- C:\Windows\System\nFVjGFg.exe
  C:\Windows\System\nFVjGFg.exe
  2⤵
  PID:2304
- C:\Windows\System\HWeslQz.exe
  C:\Windows\System\HWeslQz.exe
  2⤵
  PID:4008
- C:\Windows\System\umSeyum.exe
  C:\Windows\System\umSeyum.exe
  2⤵
  PID:396
- C:\Windows\System\etYZOYt.exe
  C:\Windows\System\etYZOYt.exe
  2⤵
  PID:5140
- C:\Windows\System\ySVnZDC.exe
  C:\Windows\System\ySVnZDC.exe
  2⤵
  PID:5168
- C:\Windows\System\WpTbrjD.exe
  C:\Windows\System\WpTbrjD.exe
  2⤵
  PID:5196
- C:\Windows\System\yzPZiim.exe
  C:\Windows\System\yzPZiim.exe
  2⤵
  PID:5228
- C:\Windows\System\cRzOiHG.exe
  C:\Windows\System\cRzOiHG.exe
  2⤵
  PID:5256
- C:\Windows\System\zshzmfo.exe
  C:\Windows\System\zshzmfo.exe
  2⤵
  PID:5284
- C:\Windows\System\NDScKmm.exe
  C:\Windows\System\NDScKmm.exe
  2⤵
  PID:5312
- C:\Windows\System\zCASZVC.exe
  C:\Windows\System\zCASZVC.exe
  2⤵
  PID:5340
- C:\Windows\System\FawdrQl.exe
  C:\Windows\System\FawdrQl.exe
  2⤵
  PID:5368
- C:\Windows\System\QjzkLpC.exe
  C:\Windows\System\QjzkLpC.exe
  2⤵
  PID:5396
- C:\Windows\System\DxgcWQN.exe
  C:\Windows\System\DxgcWQN.exe
  2⤵
  PID:5424
- C:\Windows\System\BiJqIhv.exe
  C:\Windows\System\BiJqIhv.exe
  2⤵
  PID:5452
- C:\Windows\System\FEQBrHt.exe
  C:\Windows\System\FEQBrHt.exe
  2⤵
  PID:5480
- C:\Windows\System\eHwAhpN.exe
  C:\Windows\System\eHwAhpN.exe
  2⤵
  PID:5508
- C:\Windows\System\XsobIiB.exe
  C:\Windows\System\XsobIiB.exe
  2⤵
  PID:5536
- C:\Windows\System\BnbSaVV.exe
  C:\Windows\System\BnbSaVV.exe
  2⤵
  PID:5564
- C:\Windows\System\TgRoIDO.exe
  C:\Windows\System\TgRoIDO.exe
  2⤵
  PID:5592
- C:\Windows\System\iAQqXNt.exe
  C:\Windows\System\iAQqXNt.exe
  2⤵
  PID:5620
- C:\Windows\System\vCucMUj.exe
  C:\Windows\System\vCucMUj.exe
  2⤵
  PID:5648
- C:\Windows\System\jvRMabX.exe
  C:\Windows\System\jvRMabX.exe
  2⤵
  PID:5676
- C:\Windows\System\SfToqYq.exe
  C:\Windows\System\SfToqYq.exe
  2⤵
  PID:5704
- C:\Windows\System\iKcCKze.exe
  C:\Windows\System\iKcCKze.exe
  2⤵
  PID:5732
- C:\Windows\System\LuYVXRo.exe
  C:\Windows\System\LuYVXRo.exe
  2⤵
  PID:5760
- C:\Windows\System\tRktcHi.exe
  C:\Windows\System\tRktcHi.exe
  2⤵
  PID:5788
- C:\Windows\System\ypiAwKO.exe
  C:\Windows\System\ypiAwKO.exe
  2⤵
  PID:5816
- C:\Windows\System\EErGMbv.exe
  C:\Windows\System\EErGMbv.exe
  2⤵
  PID:5864
- C:\Windows\System\ipdafFz.exe
  C:\Windows\System\ipdafFz.exe
  2⤵
  PID:5884
- C:\Windows\System\zSLgcSh.exe
  C:\Windows\System\zSLgcSh.exe
  2⤵
  PID:5912
- C:\Windows\System\mBQUqRs.exe
  C:\Windows\System\mBQUqRs.exe
  2⤵
  PID:5928
- C:\Windows\System\lYvEpXd.exe
  C:\Windows\System\lYvEpXd.exe
  2⤵
  PID:5956
- C:\Windows\System\MjSGSmI.exe
  C:\Windows\System\MjSGSmI.exe
  2⤵
  PID:5984
- C:\Windows\System\zxbxyqy.exe
  C:\Windows\System\zxbxyqy.exe
  2⤵
  PID:6012
- C:\Windows\System\BRrsJtJ.exe
  C:\Windows\System\BRrsJtJ.exe
  2⤵
  PID:6040
- C:\Windows\System\uQHHnuM.exe
  C:\Windows\System\uQHHnuM.exe
  2⤵
  PID:6068
- C:\Windows\System\qcEalUQ.exe
  C:\Windows\System\qcEalUQ.exe
  2⤵
  PID:6096
- C:\Windows\System\YJGohCX.exe
  C:\Windows\System\YJGohCX.exe
  2⤵
  PID:6120
- C:\Windows\System\oCWKnos.exe
  C:\Windows\System\oCWKnos.exe
  2⤵
  PID:3996
- C:\Windows\System\giIAyPR.exe
  C:\Windows\System\giIAyPR.exe
  2⤵
  PID:4924
- C:\Windows\System\odqsmLt.exe
  C:\Windows\System\odqsmLt.exe
  2⤵
  PID:636
- C:\Windows\System\uzgXiap.exe
  C:\Windows\System\uzgXiap.exe
  2⤵
  PID:1344
- C:\Windows\System\VrjfcMp.exe
  C:\Windows\System\VrjfcMp.exe
  2⤵
  PID:5124
- C:\Windows\System\OzMScVQ.exe
  C:\Windows\System\OzMScVQ.exe
  2⤵
  PID:5188
- C:\Windows\System\neQlrgR.exe
  C:\Windows\System\neQlrgR.exe
  2⤵
  PID:5248
- C:\Windows\System\iPzRrWl.exe
  C:\Windows\System\iPzRrWl.exe
  2⤵
  PID:5324
- C:\Windows\System\fFCNKYf.exe
  C:\Windows\System\fFCNKYf.exe
  2⤵
  PID:5384
- C:\Windows\System\TDoZwEY.exe
  C:\Windows\System\TDoZwEY.exe
  2⤵
  PID:5464
- C:\Windows\System\vbZYaLn.exe
  C:\Windows\System\vbZYaLn.exe
  2⤵
  PID:5524
- C:\Windows\System\KBtPQkd.exe
  C:\Windows\System\KBtPQkd.exe
  2⤵
  PID:5580
- C:\Windows\System\AikzCfS.exe
  C:\Windows\System\AikzCfS.exe
  2⤵
  PID:5636
- C:\Windows\System\HMuZwbK.exe
  C:\Windows\System\HMuZwbK.exe
  2⤵
  PID:5696
- C:\Windows\System\XHwhYUc.exe
  C:\Windows\System\XHwhYUc.exe
  2⤵
  PID:5752
- C:\Windows\System\cntHmNB.exe
  C:\Windows\System\cntHmNB.exe
  2⤵
  PID:5828
- C:\Windows\System\sFAIviz.exe
  C:\Windows\System\sFAIviz.exe
  2⤵
  PID:5876
- C:\Windows\System\NlBplWV.exe
  C:\Windows\System\NlBplWV.exe
  2⤵
  PID:5940
- C:\Windows\System\xodncOv.exe
  C:\Windows\System\xodncOv.exe
  2⤵
  PID:5996
- C:\Windows\System\bdjxVoY.exe
  C:\Windows\System\bdjxVoY.exe
  2⤵
  PID:6056
- C:\Windows\System\mdXAeiM.exe
  C:\Windows\System\mdXAeiM.exe
  2⤵
  PID:2660
- C:\Windows\System\CuBdxWK.exe
  C:\Windows\System\CuBdxWK.exe
  2⤵
  PID:1936
- C:\Windows\System\VtDXkfU.exe
  C:\Windows\System\VtDXkfU.exe
  2⤵
  PID:2016
- C:\Windows\System\AjSJYgM.exe
  C:\Windows\System\AjSJYgM.exe
  2⤵
  PID:5156
- C:\Windows\System\LJtzthp.exe
  C:\Windows\System\LJtzthp.exe
  2⤵
  PID:5300
- C:\Windows\System\kftXrNk.exe
  C:\Windows\System\kftXrNk.exe
  2⤵
  PID:5436
- C:\Windows\System\SsPGMgZ.exe
  C:\Windows\System\SsPGMgZ.exe
  2⤵
  PID:5576
- C:\Windows\System\prHODRH.exe
  C:\Windows\System\prHODRH.exe
  2⤵
  PID:5688
- C:\Windows\System\xqkJvwM.exe
  C:\Windows\System\xqkJvwM.exe
  2⤵
  PID:2652
- C:\Windows\System\zdAmJyq.exe
  C:\Windows\System\zdAmJyq.exe
  2⤵
  PID:1772
- C:\Windows\System\iOtjlVo.exe
  C:\Windows\System\iOtjlVo.exe
  2⤵
  PID:6028
- C:\Windows\System\icYdesn.exe
  C:\Windows\System\icYdesn.exe
  2⤵
  PID:4460
- C:\Windows\System\yBvjxXQ.exe
  C:\Windows\System\yBvjxXQ.exe
  2⤵
  PID:2500
- C:\Windows\System\cuhojHJ.exe
  C:\Windows\System\cuhojHJ.exe
  2⤵
  PID:5416
- C:\Windows\System\XSDKRQL.exe
  C:\Windows\System\XSDKRQL.exe
  2⤵
  PID:3264
- C:\Windows\System\YLsDlfG.exe
  C:\Windows\System\YLsDlfG.exe
  2⤵
  PID:6156
- C:\Windows\System\jsIYQtu.exe
  C:\Windows\System\jsIYQtu.exe
  2⤵
  PID:6184
- C:\Windows\System\aLKXykr.exe
  C:\Windows\System\aLKXykr.exe
  2⤵
  PID:6212
- C:\Windows\System\DSULFDD.exe
  C:\Windows\System\DSULFDD.exe
  2⤵
  PID:6240
- C:\Windows\System\smZJRhm.exe
  C:\Windows\System\smZJRhm.exe
  2⤵
  PID:6264
- C:\Windows\System\BZTcKBP.exe
  C:\Windows\System\BZTcKBP.exe
  2⤵
  PID:6292
- C:\Windows\System\WseGDxs.exe
  C:\Windows\System\WseGDxs.exe
  2⤵
  PID:6320
- C:\Windows\System\SkGiiJD.exe
  C:\Windows\System\SkGiiJD.exe
  2⤵
  PID:6352
- C:\Windows\System\LjXwZfV.exe
  C:\Windows\System\LjXwZfV.exe
  2⤵
  PID:6380
- C:\Windows\System\HALasXu.exe
  C:\Windows\System\HALasXu.exe
  2⤵
  PID:6408
- C:\Windows\System\BSJLnUS.exe
  C:\Windows\System\BSJLnUS.exe
  2⤵
  PID:6436
- C:\Windows\System\CGTPEWu.exe
  C:\Windows\System\CGTPEWu.exe
  2⤵
  PID:6464
- C:\Windows\System\QiSxhbT.exe
  C:\Windows\System\QiSxhbT.exe
  2⤵
  PID:6492
- C:\Windows\System\fHtDHAS.exe
  C:\Windows\System\fHtDHAS.exe
  2⤵
  PID:6520
- C:\Windows\System\xmLkQaD.exe
  C:\Windows\System\xmLkQaD.exe
  2⤵
  PID:6548
- C:\Windows\System\VLpNNRP.exe
  C:\Windows\System\VLpNNRP.exe
  2⤵
  PID:6576
- C:\Windows\System\ZOoZeqJ.exe
  C:\Windows\System\ZOoZeqJ.exe
  2⤵
  PID:6604
- C:\Windows\System\heQQxUU.exe
  C:\Windows\System\heQQxUU.exe
  2⤵
  PID:6632
- C:\Windows\System\LefcBCn.exe
  C:\Windows\System\LefcBCn.exe
  2⤵
  PID:6660
- C:\Windows\System\xxTxDbS.exe
  C:\Windows\System\xxTxDbS.exe
  2⤵
  PID:6688
- C:\Windows\System\ktFewGw.exe
  C:\Windows\System\ktFewGw.exe
  2⤵
  PID:6716
- C:\Windows\System\CiXizLR.exe
  C:\Windows\System\CiXizLR.exe
  2⤵
  PID:6744
- C:\Windows\System\XJbyzLH.exe
  C:\Windows\System\XJbyzLH.exe
  2⤵
  PID:6772
- C:\Windows\System\RwGFdiy.exe
  C:\Windows\System\RwGFdiy.exe
  2⤵
  PID:6800
- C:\Windows\System\miFvRVh.exe
  C:\Windows\System\miFvRVh.exe
  2⤵
  PID:6844
- C:\Windows\System\BWCbQjv.exe
  C:\Windows\System\BWCbQjv.exe
  2⤵
  PID:6888
- C:\Windows\System\UMLlZrT.exe
  C:\Windows\System\UMLlZrT.exe
  2⤵
  PID:6908
- C:\Windows\System\ugKgZTP.exe
  C:\Windows\System\ugKgZTP.exe
  2⤵
  PID:6932
- C:\Windows\System\zpCOtfk.exe
  C:\Windows\System\zpCOtfk.exe
  2⤵
  PID:6960
- C:\Windows\System\uCuszBU.exe
  C:\Windows\System\uCuszBU.exe
  2⤵
  PID:6980
- C:\Windows\System\alrSOKW.exe
  C:\Windows\System\alrSOKW.exe
  2⤵
  PID:7020
- C:\Windows\System\TuwOYnl.exe
  C:\Windows\System\TuwOYnl.exe
  2⤵
  PID:7040
- C:\Windows\System\YubJJUx.exe
  C:\Windows\System\YubJJUx.exe
  2⤵
  PID:7072
- C:\Windows\System\efKEUBH.exe
  C:\Windows\System\efKEUBH.exe
  2⤵
  PID:7096
- C:\Windows\System\AOXDjMC.exe
  C:\Windows\System\AOXDjMC.exe
  2⤵
  PID:7112
- C:\Windows\System\VlHwlab.exe
  C:\Windows\System\VlHwlab.exe
  2⤵
  PID:7132
- C:\Windows\System\PUILuYq.exe
  C:\Windows\System\PUILuYq.exe
  2⤵
  PID:5800
- C:\Windows\System\tQgojdB.exe
  C:\Windows\System\tQgojdB.exe
  2⤵
  PID:2400
- C:\Windows\System\EfrJLIY.exe
  C:\Windows\System\EfrJLIY.exe
  2⤵
  PID:2552
- C:\Windows\System\tnTVAmB.exe
  C:\Windows\System\tnTVAmB.exe
  2⤵
  PID:2272
- C:\Windows\System\QhRvwOz.exe
  C:\Windows\System\QhRvwOz.exe
  2⤵
  PID:2312
- C:\Windows\System\JrUFgVw.exe
  C:\Windows\System\JrUFgVw.exe
  2⤵
  PID:6172
- C:\Windows\System\DroiGIB.exe
  C:\Windows\System\DroiGIB.exe
  2⤵
  PID:6232
- C:\Windows\System\XKBWNGV.exe
  C:\Windows\System\XKBWNGV.exe
  2⤵
  PID:6288
- C:\Windows\System\YlamVJh.exe
  C:\Windows\System\YlamVJh.exe
  2⤵
  PID:4728
- C:\Windows\System\JErURrA.exe
  C:\Windows\System\JErURrA.exe
  2⤵
  PID:6372
- C:\Windows\System\SjeIGbi.exe
  C:\Windows\System\SjeIGbi.exe
  2⤵
  PID:6400
- C:\Windows\System\DGHOTkx.exe
  C:\Windows\System\DGHOTkx.exe
  2⤵
  PID:6448
- C:\Windows\System\ZwemXKL.exe
  C:\Windows\System\ZwemXKL.exe
  2⤵
  PID:4716
- C:\Windows\System\lBJpvXK.exe
  C:\Windows\System\lBJpvXK.exe
  2⤵
  PID:6564
- C:\Windows\System\coNDfYm.exe
  C:\Windows\System\coNDfYm.exe
  2⤵
  PID:6592
- C:\Windows\System\ROnojfT.exe
  C:\Windows\System\ROnojfT.exe
  2⤵
  PID:2336
- C:\Windows\System\agOeOax.exe
  C:\Windows\System\agOeOax.exe
  2⤵
  PID:6700
- C:\Windows\System\VwvKdip.exe
  C:\Windows\System\VwvKdip.exe
  2⤵
  PID:6756
- C:\Windows\System\WApgayI.exe
  C:\Windows\System\WApgayI.exe
  2⤵
  PID:936
- C:\Windows\System\rkwurQQ.exe
  C:\Windows\System\rkwurQQ.exe
  2⤵
  PID:6788
- C:\Windows\System\FsFavMc.exe
  C:\Windows\System\FsFavMc.exe
  2⤵
  PID:2032
- C:\Windows\System\ShUvDUp.exe
  C:\Windows\System\ShUvDUp.exe
  2⤵
  PID:2112
- C:\Windows\System\zKKcBYw.exe
  C:\Windows\System\zKKcBYw.exe
  2⤵
  PID:888
- C:\Windows\System\nmcgelQ.exe
  C:\Windows\System\nmcgelQ.exe
  2⤵
  PID:212
- C:\Windows\System\ZLkDLpI.exe
  C:\Windows\System\ZLkDLpI.exe
  2⤵
  PID:6816
- C:\Windows\System\kFnvKFh.exe
  C:\Windows\System\kFnvKFh.exe
  2⤵
  PID:6928
- C:\Windows\System\Qbzaigd.exe
  C:\Windows\System\Qbzaigd.exe
  2⤵
  PID:7012
- C:\Windows\System\rznrByO.exe
  C:\Windows\System\rznrByO.exe
  2⤵
  PID:7064
- C:\Windows\System\YomhLcu.exe
  C:\Windows\System\YomhLcu.exe
  2⤵
  PID:7124
- C:\Windows\System\GnWrwNg.exe
  C:\Windows\System\GnWrwNg.exe
  2⤵
  PID:7164
- C:\Windows\System\CtJNoIR.exe
  C:\Windows\System\CtJNoIR.exe
  2⤵
  PID:2164
- C:\Windows\System\fzVOTEd.exe
  C:\Windows\System\fzVOTEd.exe
  2⤵
  PID:3244
- C:\Windows\System\awMuVht.exe
  C:\Windows\System\awMuVht.exe
  2⤵
  PID:1212
- C:\Windows\System\JSIDnEo.exe
  C:\Windows\System\JSIDnEo.exe
  2⤵
  PID:6504
- C:\Windows\System\TsyVISF.exe
  C:\Windows\System\TsyVISF.exe
  2⤵
  PID:6484
- C:\Windows\System\DGLcswi.exe
  C:\Windows\System\DGLcswi.exe
  2⤵
  PID:6508
- C:\Windows\System\dvkeOmz.exe
  C:\Windows\System\dvkeOmz.exe
  2⤵
  PID:6620
- C:\Windows\System\aedztjG.exe
  C:\Windows\System\aedztjG.exe
  2⤵
  PID:6736
- C:\Windows\System\arsvPio.exe
  C:\Windows\System\arsvPio.exe
  2⤵
  PID:3496
- C:\Windows\System\pZWyzFQ.exe
  C:\Windows\System\pZWyzFQ.exe
  2⤵
  PID:2692
- C:\Windows\System\fXXqFrM.exe
  C:\Windows\System\fXXqFrM.exe
  2⤵
  PID:6900
- C:\Windows\System\URFVNil.exe
  C:\Windows\System\URFVNil.exe
  2⤵
  PID:7080
- C:\Windows\System\jEzPrdA.exe
  C:\Windows\System\jEzPrdA.exe
  2⤵
  PID:7156
- C:\Windows\System\UpFKnUY.exe
  C:\Windows\System\UpFKnUY.exe
  2⤵
  PID:4452
- C:\Windows\System\qnyfnTA.exe
  C:\Windows\System\qnyfnTA.exe
  2⤵
  PID:5112
- C:\Windows\System\nmhSzpf.exe
  C:\Windows\System\nmhSzpf.exe
  2⤵
  PID:1528
- C:\Windows\System\ErXzqBk.exe
  C:\Windows\System\ErXzqBk.exe
  2⤵
  PID:1004
- C:\Windows\System\rEuades.exe
  C:\Windows\System\rEuades.exe
  2⤵
  PID:5028
- C:\Windows\System\TuZddDw.exe
  C:\Windows\System\TuZddDw.exe
  2⤵
  PID:3372
- C:\Windows\System\GDUVSvp.exe
  C:\Windows\System\GDUVSvp.exe
  2⤵
  PID:6904
- C:\Windows\System\RfMhfad.exe
  C:\Windows\System\RfMhfad.exe
  2⤵
  PID:7180
- C:\Windows\System\JGzahmK.exe
  C:\Windows\System\JGzahmK.exe
  2⤵
  PID:7204
- C:\Windows\System\pjLylyI.exe
  C:\Windows\System\pjLylyI.exe
  2⤵
  PID:7256
- C:\Windows\System\PqfNmgW.exe
  C:\Windows\System\PqfNmgW.exe
  2⤵
  PID:7280
- C:\Windows\System\YZfCbHT.exe
  C:\Windows\System\YZfCbHT.exe
  2⤵
  PID:7320
- C:\Windows\System\nQCjSjB.exe
  C:\Windows\System\nQCjSjB.exe
  2⤵
  PID:7340
- C:\Windows\System\dHqyWAi.exe
  C:\Windows\System\dHqyWAi.exe
  2⤵
  PID:7376
- C:\Windows\System\geiPZwr.exe
  C:\Windows\System\geiPZwr.exe
  2⤵
  PID:7396
- C:\Windows\System\lLLcwKi.exe
  C:\Windows\System\lLLcwKi.exe
  2⤵
  PID:7416
- C:\Windows\System\cYSamHC.exe
  C:\Windows\System\cYSamHC.exe
  2⤵
  PID:7460
- C:\Windows\System\TVrcmHU.exe
  C:\Windows\System\TVrcmHU.exe
  2⤵
  PID:7480
- C:\Windows\System\UVMAEFl.exe
  C:\Windows\System\UVMAEFl.exe
  2⤵
  PID:7500
- C:\Windows\System\XbRqVUw.exe
  C:\Windows\System\XbRqVUw.exe
  2⤵
  PID:7520
- C:\Windows\System\EQeDeCY.exe
  C:\Windows\System\EQeDeCY.exe
  2⤵
  PID:7536
- C:\Windows\System\xjZHUik.exe
  C:\Windows\System\xjZHUik.exe
  2⤵
  PID:7568
- C:\Windows\System\QnbcXLF.exe
  C:\Windows\System\QnbcXLF.exe
  2⤵
  PID:7592
- C:\Windows\System\FHIiBqT.exe
  C:\Windows\System\FHIiBqT.exe
  2⤵
  PID:7616
- C:\Windows\System\drXgKdA.exe
  C:\Windows\System\drXgKdA.exe
  2⤵
  PID:7680
- C:\Windows\System\yZPMOSr.exe
  C:\Windows\System\yZPMOSr.exe
  2⤵
  PID:7704
- C:\Windows\System\FaAhvmr.exe
  C:\Windows\System\FaAhvmr.exe
  2⤵
  PID:7752
- C:\Windows\System\xUBuQoV.exe
  C:\Windows\System\xUBuQoV.exe
  2⤵
  PID:7768
- C:\Windows\System\ytIjsaN.exe
  C:\Windows\System\ytIjsaN.exe
  2⤵
  PID:7796
- C:\Windows\System\WNGAdhP.exe
  C:\Windows\System\WNGAdhP.exe
  2⤵
  PID:7836
- C:\Windows\System\CirONxV.exe
  C:\Windows\System\CirONxV.exe
  2⤵
  PID:7856
- C:\Windows\System\GvhjcCK.exe
  C:\Windows\System\GvhjcCK.exe
  2⤵
  PID:7880
- C:\Windows\System\wNdzbVk.exe
  C:\Windows\System\wNdzbVk.exe
  2⤵
  PID:7920
- C:\Windows\System\cXrTCuY.exe
  C:\Windows\System\cXrTCuY.exe
  2⤵
  PID:7940
- C:\Windows\System\aEiQNhe.exe
  C:\Windows\System\aEiQNhe.exe
  2⤵
  PID:7976
- C:\Windows\System\bzgssHk.exe
  C:\Windows\System\bzgssHk.exe
  2⤵
  PID:7996
- C:\Windows\System\ludQEJZ.exe
  C:\Windows\System\ludQEJZ.exe
  2⤵
  PID:8032
- C:\Windows\System\WWghBUk.exe
  C:\Windows\System\WWghBUk.exe
  2⤵
  PID:8052
- C:\Windows\System\kfjRXJk.exe
  C:\Windows\System\kfjRXJk.exe
  2⤵
  PID:8080
- C:\Windows\System\gtzRjJs.exe
  C:\Windows\System\gtzRjJs.exe
  2⤵
  PID:8096
- C:\Windows\System\JdjBqIV.exe
  C:\Windows\System\JdjBqIV.exe
  2⤵
  PID:8116
- C:\Windows\System\oYEDICk.exe
  C:\Windows\System\oYEDICk.exe
  2⤵
  PID:8156
- C:\Windows\System\lFnsoAa.exe
  C:\Windows\System\lFnsoAa.exe
  2⤵
  PID:8180
- C:\Windows\System\sRyoWeP.exe
  C:\Windows\System\sRyoWeP.exe
  2⤵
  PID:3256
- C:\Windows\System\zqoWtKk.exe
  C:\Windows\System\zqoWtKk.exe
  2⤵
  PID:7200
- C:\Windows\System\lsjFnxz.exe
  C:\Windows\System\lsjFnxz.exe
  2⤵
  PID:7308
- C:\Windows\System\SAgtddy.exe
  C:\Windows\System\SAgtddy.exe
  2⤵
  PID:7360
- C:\Windows\System\xbiwHzA.exe
  C:\Windows\System\xbiwHzA.exe
  2⤵
  PID:7492
- C:\Windows\System\BqenhDh.exe
  C:\Windows\System\BqenhDh.exe
  2⤵
  PID:7600
- C:\Windows\System\pRgcnKB.exe
  C:\Windows\System\pRgcnKB.exe
  2⤵
  PID:7580
- C:\Windows\System\UnboVdz.exe
  C:\Windows\System\UnboVdz.exe
  2⤵
  PID:7664
- C:\Windows\System\JEnWSrk.exe
  C:\Windows\System\JEnWSrk.exe
  2⤵
  PID:7728
- C:\Windows\System\roKefyC.exe
  C:\Windows\System\roKefyC.exe
  2⤵
  PID:7760
- C:\Windows\System\lkaWChK.exe
  C:\Windows\System\lkaWChK.exe
  2⤵
  PID:7864
- C:\Windows\System\RXGzZtA.exe
  C:\Windows\System\RXGzZtA.exe
  2⤵
  PID:7932
- C:\Windows\System\cAnwPwa.exe
  C:\Windows\System\cAnwPwa.exe
  2⤵
  PID:7972
- C:\Windows\System\vCzwCLh.exe
  C:\Windows\System\vCzwCLh.exe
  2⤵
  PID:8092
- C:\Windows\System\PzDJJfd.exe
  C:\Windows\System\PzDJJfd.exe
  2⤵
  PID:8144
- C:\Windows\System\eKdaauM.exe
  C:\Windows\System\eKdaauM.exe
  2⤵
  PID:7232
- C:\Windows\System\VNTGEwn.exe
  C:\Windows\System\VNTGEwn.exe
  2⤵
  PID:7296
- C:\Windows\System\dURJHtW.exe
  C:\Windows\System\dURJHtW.exe
  2⤵
  PID:7476
- C:\Windows\System\cmzZgGG.exe
  C:\Windows\System\cmzZgGG.exe
  2⤵
  PID:7516
- C:\Windows\System\pfZhmBw.exe
  C:\Windows\System\pfZhmBw.exe
  2⤵
  PID:7712
- C:\Windows\System\KToPhPQ.exe
  C:\Windows\System\KToPhPQ.exe
  2⤵
  PID:7968
- C:\Windows\System\GyAzZfC.exe
  C:\Windows\System\GyAzZfC.exe
  2⤵
  PID:8108
- C:\Windows\System\nUdViJN.exe
  C:\Windows\System\nUdViJN.exe
  2⤵
  PID:7440
- C:\Windows\System\MLebMGs.exe
  C:\Windows\System\MLebMGs.exe
  2⤵
  PID:7252
- C:\Windows\System\bsOqkzz.exe
  C:\Windows\System\bsOqkzz.exe
  2⤵
  PID:7652
- C:\Windows\System\hCuvmCC.exe
  C:\Windows\System\hCuvmCC.exe
  2⤵
  PID:7992
- C:\Windows\System\sVBUOCV.exe
  C:\Windows\System\sVBUOCV.exe
  2⤵
  PID:7496
- C:\Windows\System\GDqxcAY.exe
  C:\Windows\System\GDqxcAY.exe
  2⤵
  PID:8232
- C:\Windows\System\nHukVuF.exe
  C:\Windows\System\nHukVuF.exe
  2⤵
  PID:8248
- C:\Windows\System\PPeasdQ.exe
  C:\Windows\System\PPeasdQ.exe
  2⤵
  PID:8268
- C:\Windows\System\JLTNIIW.exe
  C:\Windows\System\JLTNIIW.exe
  2⤵
  PID:8296
- C:\Windows\System\zbjBxOW.exe
  C:\Windows\System\zbjBxOW.exe
  2⤵
  PID:8324
- C:\Windows\System\GphtVvI.exe
  C:\Windows\System\GphtVvI.exe
  2⤵
  PID:8356
- C:\Windows\System\voCPydi.exe
  C:\Windows\System\voCPydi.exe
  2⤵
  PID:8376
- C:\Windows\System\FeUUbkN.exe
  C:\Windows\System\FeUUbkN.exe
  2⤵
  PID:8400
- C:\Windows\System\edErKgJ.exe
  C:\Windows\System\edErKgJ.exe
  2⤵
  PID:8416
- C:\Windows\System\YyYfEQI.exe
  C:\Windows\System\YyYfEQI.exe
  2⤵
  PID:8436
- C:\Windows\System\nPvOAyw.exe
  C:\Windows\System\nPvOAyw.exe
  2⤵
  PID:8460
- C:\Windows\System\avVHiQv.exe
  C:\Windows\System\avVHiQv.exe
  2⤵
  PID:8508
- C:\Windows\System\NlNONld.exe
  C:\Windows\System\NlNONld.exe
  2⤵
  PID:8552
- C:\Windows\System\ctfkczM.exe
  C:\Windows\System\ctfkczM.exe
  2⤵
  PID:8588
- C:\Windows\System\aKmktbd.exe
  C:\Windows\System\aKmktbd.exe
  2⤵
  PID:8620
- C:\Windows\System\OfcXDMc.exe
  C:\Windows\System\OfcXDMc.exe
  2⤵
  PID:8636
- C:\Windows\System\KJLJRvx.exe
  C:\Windows\System\KJLJRvx.exe
  2⤵
  PID:8660
- C:\Windows\System\yvpsxNq.exe
  C:\Windows\System\yvpsxNq.exe
  2⤵
  PID:8680
- C:\Windows\System\UaHpUzF.exe
  C:\Windows\System\UaHpUzF.exe
  2⤵
  PID:8704
- C:\Windows\System\hwWROoK.exe
  C:\Windows\System\hwWROoK.exe
  2⤵
  PID:8728
- C:\Windows\System\PqKEqPz.exe
  C:\Windows\System\PqKEqPz.exe
  2⤵
  PID:8748
- C:\Windows\System\BLNEqDz.exe
  C:\Windows\System\BLNEqDz.exe
  2⤵
  PID:8768
- C:\Windows\System\ywApOvM.exe
  C:\Windows\System\ywApOvM.exe
  2⤵
  PID:8800
- C:\Windows\System\LnuUYYd.exe
  C:\Windows\System\LnuUYYd.exe
  2⤵
  PID:8820
- C:\Windows\System\DAUQqhJ.exe
  C:\Windows\System\DAUQqhJ.exe
  2⤵
  PID:8848
- C:\Windows\System\rsorFqC.exe
  C:\Windows\System\rsorFqC.exe
  2⤵
  PID:8876
- C:\Windows\System\fqVjYeV.exe
  C:\Windows\System\fqVjYeV.exe
  2⤵
  PID:8932
- C:\Windows\System\DZcOknJ.exe
  C:\Windows\System\DZcOknJ.exe
  2⤵
  PID:8976
- C:\Windows\System\tMKeORE.exe
  C:\Windows\System\tMKeORE.exe
  2⤵
  PID:9016
- C:\Windows\System\tsvQhUL.exe
  C:\Windows\System\tsvQhUL.exe
  2⤵
  PID:9044
- C:\Windows\System\KLUqvxK.exe
  C:\Windows\System\KLUqvxK.exe
  2⤵
  PID:9064
- C:\Windows\System\pVObQCc.exe
  C:\Windows\System\pVObQCc.exe
  2⤵
  PID:9084
- C:\Windows\System\qtHEsFr.exe
  C:\Windows\System\qtHEsFr.exe
  2⤵
  PID:9104
- C:\Windows\System\CxaLeKa.exe
  C:\Windows\System\CxaLeKa.exe
  2⤵
  PID:9136
- C:\Windows\System\WkCmifP.exe
  C:\Windows\System\WkCmifP.exe
  2⤵
  PID:9156
- C:\Windows\System\DIoRItU.exe
  C:\Windows\System\DIoRItU.exe
  2⤵
  PID:8204
- C:\Windows\System\WDdkRSp.exe
  C:\Windows\System\WDdkRSp.exe
  2⤵
  PID:8244
- C:\Windows\System\rxSbCgj.exe
  C:\Windows\System\rxSbCgj.exe
  2⤵
  PID:8264
- C:\Windows\System\gxNYitX.exe
  C:\Windows\System\gxNYitX.exe
  2⤵
  PID:8384
- C:\Windows\System\EKBhYhq.exe
  C:\Windows\System\EKBhYhq.exe
  2⤵
  PID:8392
- C:\Windows\System\EnjfHix.exe
  C:\Windows\System\EnjfHix.exe
  2⤵
  PID:8452
- C:\Windows\System\FTpPyAf.exe
  C:\Windows\System\FTpPyAf.exe
  2⤵
  PID:8580
- C:\Windows\System\qrcaCsK.exe
  C:\Windows\System\qrcaCsK.exe
  2⤵
  PID:8668
- C:\Windows\System\aJEseFK.exe
  C:\Windows\System\aJEseFK.exe
  2⤵
  PID:8688
- C:\Windows\System\AegQlZQ.exe
  C:\Windows\System\AegQlZQ.exe
  2⤵
  PID:8828
- C:\Windows\System\VdIxVaE.exe
  C:\Windows\System\VdIxVaE.exe
  2⤵
  PID:8792
- C:\Windows\System\QABroeG.exe
  C:\Windows\System\QABroeG.exe
  2⤵
  PID:3992
- C:\Windows\System\jZQZjxo.exe
  C:\Windows\System\jZQZjxo.exe
  2⤵
  PID:8968
- C:\Windows\System\ODUQGQo.exe
  C:\Windows\System\ODUQGQo.exe
  2⤵
  PID:9080
- C:\Windows\System\JfOEjgO.exe
  C:\Windows\System\JfOEjgO.exe
  2⤵
  PID:9076
- C:\Windows\System\IjXjpJy.exe
  C:\Windows\System\IjXjpJy.exe
  2⤵
  PID:9148
- C:\Windows\System\mNGteaS.exe
  C:\Windows\System\mNGteaS.exe
  2⤵
  PID:8316
- C:\Windows\System\BHdlrJr.exe
  C:\Windows\System\BHdlrJr.exe
  2⤵
  PID:8364
- C:\Windows\System\uUcDUqr.exe
  C:\Windows\System\uUcDUqr.exe
  2⤵
  PID:8520
- C:\Windows\System\xOtWdgK.exe
  C:\Windows\System\xOtWdgK.exe
  2⤵
  PID:8696
- C:\Windows\System\zzOuAVt.exe
  C:\Windows\System\zzOuAVt.exe
  2⤵
  PID:8764
- C:\Windows\System\qljNptN.exe
  C:\Windows\System\qljNptN.exe
  2⤵
  PID:9024
- C:\Windows\System\BpuTZWc.exe
  C:\Windows\System\BpuTZWc.exe
  2⤵
  PID:9120
- C:\Windows\System\yPaCzaF.exe
  C:\Windows\System\yPaCzaF.exe
  2⤵
  PID:8412
- C:\Windows\System\PIlHWBS.exe
  C:\Windows\System\PIlHWBS.exe
  2⤵
  PID:8712
- C:\Windows\System\ieNmaje.exe
  C:\Windows\System\ieNmaje.exe
  2⤵
  PID:8760
- C:\Windows\System\MMzrpca.exe
  C:\Windows\System\MMzrpca.exe
  2⤵
  PID:8964
- C:\Windows\System\IoXJYNG.exe
  C:\Windows\System\IoXJYNG.exe
  2⤵
  PID:8652
- C:\Windows\System\QexBfaw.exe
  C:\Windows\System\QexBfaw.exe
  2⤵
  PID:9236
- C:\Windows\System\HjJxjbC.exe
  C:\Windows\System\HjJxjbC.exe
  2⤵
  PID:9292
- C:\Windows\System\JkqUyrN.exe
  C:\Windows\System\JkqUyrN.exe
  2⤵
  PID:9312
- C:\Windows\System\fkkNjFC.exe
  C:\Windows\System\fkkNjFC.exe
  2⤵
  PID:9336
- C:\Windows\System\AfQxdMC.exe
  C:\Windows\System\AfQxdMC.exe
  2⤵
  PID:9424
- C:\Windows\System\dCjkUmH.exe
  C:\Windows\System\dCjkUmH.exe
  2⤵
  PID:9484
- C:\Windows\System\PWbrQqn.exe
  C:\Windows\System\PWbrQqn.exe
  2⤵
  PID:9548
- C:\Windows\System\QHcwQpW.exe
  C:\Windows\System\QHcwQpW.exe
  2⤵
  PID:9572
- C:\Windows\System\TruqTIy.exe
  C:\Windows\System\TruqTIy.exe
  2⤵
  PID:9588
- C:\Windows\System\QMLroyy.exe
  C:\Windows\System\QMLroyy.exe
  2⤵
  PID:9604
- C:\Windows\System\CcmWGTe.exe
  C:\Windows\System\CcmWGTe.exe
  2⤵
  PID:9640
- C:\Windows\System\pcrnuVb.exe
  C:\Windows\System\pcrnuVb.exe
  2⤵
  PID:9676
- C:\Windows\System\cJDDrOw.exe
  C:\Windows\System\cJDDrOw.exe
  2⤵
  PID:9700
- C:\Windows\System\cCxrFRm.exe
  C:\Windows\System\cCxrFRm.exe
  2⤵
  PID:9720
- C:\Windows\System\IVHhqVN.exe
  C:\Windows\System\IVHhqVN.exe
  2⤵
  PID:9780
- C:\Windows\System\dsIEORs.exe
  C:\Windows\System\dsIEORs.exe
  2⤵
  PID:9796
- C:\Windows\System\lNnQGlA.exe
  C:\Windows\System\lNnQGlA.exe
  2⤵
  PID:9824
- C:\Windows\System\YnRatgc.exe
  C:\Windows\System\YnRatgc.exe
  2⤵
  PID:9844
- C:\Windows\System\vaAujWI.exe
  C:\Windows\System\vaAujWI.exe
  2⤵
  PID:9872
- C:\Windows\System\UqCOHRW.exe
  C:\Windows\System\UqCOHRW.exe
  2⤵
  PID:9904
- C:\Windows\System\PvGohXZ.exe
  C:\Windows\System\PvGohXZ.exe
  2⤵
  PID:9936
- C:\Windows\System\OcLllcs.exe
  C:\Windows\System\OcLllcs.exe
  2⤵
  PID:9976
- C:\Windows\System\rcohdny.exe
  C:\Windows\System\rcohdny.exe
  2⤵
  PID:10020
- C:\Windows\System\WShghii.exe
  C:\Windows\System\WShghii.exe
  2⤵
  PID:10036
- C:\Windows\System\dmMvEHl.exe
  C:\Windows\System\dmMvEHl.exe
  2⤵
  PID:10052
- C:\Windows\System\MGiaKaM.exe
  C:\Windows\System\MGiaKaM.exe
  2⤵
  PID:10080
- C:\Windows\System\oMFUckp.exe
  C:\Windows\System\oMFUckp.exe
  2⤵
  PID:10108
- C:\Windows\System\QdZFgPm.exe
  C:\Windows\System\QdZFgPm.exe
  2⤵
  PID:10124
- C:\Windows\System\hTvFQVy.exe
  C:\Windows\System\hTvFQVy.exe
  2⤵
  PID:10164
- C:\Windows\System\CVNWYam.exe
  C:\Windows\System\CVNWYam.exe
  2⤵
  PID:10184
- C:\Windows\System\BmkKvKr.exe
  C:\Windows\System\BmkKvKr.exe
  2⤵
  PID:10212
- C:\Windows\System\WmswZmq.exe
  C:\Windows\System\WmswZmq.exe
  2⤵
  PID:10236
- C:\Windows\System\VmGDfnh.exe
  C:\Windows\System\VmGDfnh.exe
  2⤵
  PID:9220
- C:\Windows\System\pfpVOzx.exe
  C:\Windows\System\pfpVOzx.exe
  2⤵
  PID:9300
- C:\Windows\System\IKWVAYn.exe
  C:\Windows\System\IKWVAYn.exe
  2⤵
  PID:9320
- C:\Windows\System\Bwwahud.exe
  C:\Windows\System\Bwwahud.exe
  2⤵
  PID:9396
- C:\Windows\System\jcmbeea.exe
  C:\Windows\System\jcmbeea.exe
  2⤵
  PID:9452
- C:\Windows\System\ZyGOiZc.exe
  C:\Windows\System\ZyGOiZc.exe
  2⤵
  PID:9524
- C:\Windows\System\pPVESpo.exe
  C:\Windows\System\pPVESpo.exe
  2⤵
  PID:9372
- C:\Windows\System\xdTDVNc.exe
  C:\Windows\System\xdTDVNc.exe
  2⤵
  PID:9468
- C:\Windows\System\NBzbVZL.exe
  C:\Windows\System\NBzbVZL.exe
  2⤵
  PID:9584
- C:\Windows\System\OKepqdg.exe
  C:\Windows\System\OKepqdg.exe
  2⤵
  PID:9648
- C:\Windows\System\CjuvEmQ.exe
  C:\Windows\System\CjuvEmQ.exe
  2⤵
  PID:9620
- C:\Windows\System\YpirWJT.exe
  C:\Windows\System\YpirWJT.exe
  2⤵
  PID:9756
- C:\Windows\System\mlxgWuz.exe
  C:\Windows\System\mlxgWuz.exe
  2⤵
  PID:9916
- C:\Windows\System\SOwOagd.exe
  C:\Windows\System\SOwOagd.exe
  2⤵
  PID:9956
- C:\Windows\System\ggQrwse.exe
  C:\Windows\System\ggQrwse.exe
  2⤵
  PID:10028
- C:\Windows\System\sMGgkIp.exe
  C:\Windows\System\sMGgkIp.exe
  2⤵
  PID:10068
- C:\Windows\System\rTkOwQQ.exe
  C:\Windows\System\rTkOwQQ.exe
  2⤵
  PID:10104
- C:\Windows\System\qTcylYi.exe
  C:\Windows\System\qTcylYi.exe
  2⤵
  PID:10156
- C:\Windows\System\KSphaaZ.exe
  C:\Windows\System\KSphaaZ.exe
  2⤵
  PID:10228
- C:\Windows\System\smaRDXZ.exe
  C:\Windows\System\smaRDXZ.exe
  2⤵
  PID:8076
- C:\Windows\System\EEDVSGm.exe
  C:\Windows\System\EEDVSGm.exe
  2⤵
  PID:9348
- C:\Windows\System\eykdMUL.exe
  C:\Windows\System\eykdMUL.exe
  2⤵
  PID:9364
- C:\Windows\System\lFRjIzk.exe
  C:\Windows\System\lFRjIzk.exe
  2⤵
  PID:9520
- C:\Windows\System\RALvCkG.exe
  C:\Windows\System\RALvCkG.exe
  2⤵
  PID:9656
- C:\Windows\System\pFcykIN.exe
  C:\Windows\System\pFcykIN.exe
  2⤵
  PID:9896
- C:\Windows\System\PDmmCcq.exe
  C:\Windows\System\PDmmCcq.exe
  2⤵
  PID:9988
- C:\Windows\System\MPtQzfa.exe
  C:\Windows\System\MPtQzfa.exe
  2⤵
  PID:8216
- C:\Windows\System\cDDAixx.exe
  C:\Windows\System\cDDAixx.exe
  2⤵
  PID:9100
- C:\Windows\System\cIWiNLx.exe
  C:\Windows\System\cIWiNLx.exe
  2⤵
  PID:9492
- C:\Windows\System\WikgYzQ.exe
  C:\Windows\System\WikgYzQ.exe
  2⤵
  PID:9716
- C:\Windows\System\HlQCHqz.exe
  C:\Windows\System\HlQCHqz.exe
  2⤵
  PID:9272
- C:\Windows\System\KmtrNla.exe
  C:\Windows\System\KmtrNla.exe
  2⤵
  PID:10260
- C:\Windows\System\NALJgVD.exe
  C:\Windows\System\NALJgVD.exe
  2⤵
  PID:10284
- C:\Windows\System\DnqNtgL.exe
  C:\Windows\System\DnqNtgL.exe
  2⤵
  PID:10308
- C:\Windows\System\nEOBoqE.exe
  C:\Windows\System\nEOBoqE.exe
  2⤵
  PID:10336
- C:\Windows\System\ZQtyPrd.exe
  C:\Windows\System\ZQtyPrd.exe
  2⤵
  PID:10360
- C:\Windows\System\AqKqgay.exe
  C:\Windows\System\AqKqgay.exe
  2⤵
  PID:10384
- C:\Windows\System\OGSyzHl.exe
  C:\Windows\System\OGSyzHl.exe
  2⤵
  PID:10408
- C:\Windows\System\VEDUapy.exe
  C:\Windows\System\VEDUapy.exe
  2⤵
  PID:10428
- C:\Windows\System\haHhsSS.exe
  C:\Windows\System\haHhsSS.exe
  2⤵
  PID:10448
- C:\Windows\System\HlXJogb.exe
  C:\Windows\System\HlXJogb.exe
  2⤵
  PID:10476
- C:\Windows\System\mSYghyr.exe
  C:\Windows\System\mSYghyr.exe
  2⤵
  PID:10536
- C:\Windows\System\ZyGujFr.exe
  C:\Windows\System\ZyGujFr.exe
  2⤵
  PID:10560
- C:\Windows\System\wHqgtrn.exe
  C:\Windows\System\wHqgtrn.exe
  2⤵
  PID:10620
- C:\Windows\System\PLKjHSE.exe
  C:\Windows\System\PLKjHSE.exe
  2⤵
  PID:10644
- C:\Windows\System\NlMPask.exe
  C:\Windows\System\NlMPask.exe
  2⤵
  PID:10676
- C:\Windows\System\FrfchjH.exe
  C:\Windows\System\FrfchjH.exe
  2⤵
  PID:10696
- C:\Windows\System\jCvmFen.exe
  C:\Windows\System\jCvmFen.exe
  2⤵
  PID:10720
- C:\Windows\System\WcdBOGG.exe
  C:\Windows\System\WcdBOGG.exe
  2⤵
  PID:10740
- C:\Windows\System\npTsTUe.exe
  C:\Windows\System\npTsTUe.exe
  2⤵
  PID:10760
- C:\Windows\System\EBQBzxE.exe
  C:\Windows\System\EBQBzxE.exe
  2⤵
  PID:10820
- C:\Windows\System\jMFZGjV.exe
  C:\Windows\System\jMFZGjV.exe
  2⤵
  PID:10840
- C:\Windows\System\edwCxUu.exe
  C:\Windows\System\edwCxUu.exe
  2⤵
  PID:10864
- C:\Windows\System\UkzlskX.exe
  C:\Windows\System\UkzlskX.exe
  2⤵
  PID:10884
- C:\Windows\System\TSXYHBW.exe
  C:\Windows\System\TSXYHBW.exe
  2⤵
  PID:10916
- C:\Windows\System\xAXfbvj.exe
  C:\Windows\System\xAXfbvj.exe
  2⤵
  PID:10932
- C:\Windows\System\GbChcGB.exe
  C:\Windows\System\GbChcGB.exe
  2⤵
  PID:10952
- C:\Windows\System\GAyhhlK.exe
  C:\Windows\System\GAyhhlK.exe
  2⤵
  PID:10984
- C:\Windows\System\hHihJLj.exe
  C:\Windows\System\hHihJLj.exe
  2⤵
  PID:11012
- C:\Windows\System\zBEGYXR.exe
  C:\Windows\System\zBEGYXR.exe
  2⤵
  PID:11040
- C:\Windows\System\kVukCeF.exe
  C:\Windows\System\kVukCeF.exe
  2⤵
  PID:11068
- C:\Windows\System\OADueql.exe
  C:\Windows\System\OADueql.exe
  2⤵
  PID:11116
- C:\Windows\System\XaVXtLB.exe
  C:\Windows\System\XaVXtLB.exe
  2⤵
  PID:11136
- C:\Windows\System\Xmlioxa.exe
  C:\Windows\System\Xmlioxa.exe
  2⤵
  PID:11164
- C:\Windows\System\ARWiLgn.exe
  C:\Windows\System\ARWiLgn.exe
  2⤵
  PID:11192
- C:\Windows\System\zoMyrXF.exe
  C:\Windows\System\zoMyrXF.exe
  2⤵
  PID:11216
- C:\Windows\System\yJvcXIk.exe
  C:\Windows\System\yJvcXIk.exe
  2⤵
  PID:11240
- C:\Windows\System\iGhZxcp.exe
  C:\Windows\System\iGhZxcp.exe
  2⤵
  PID:11260
- C:\Windows\System\jjIiWMb.exe
  C:\Windows\System\jjIiWMb.exe
  2⤵
  PID:10244
- C:\Windows\System\vkaPjjx.exe
  C:\Windows\System\vkaPjjx.exe
  2⤵
  PID:10372
- C:\Windows\System\lCowzmG.exe
  C:\Windows\System\lCowzmG.exe
  2⤵
  PID:10424
- C:\Windows\System\tbLSuQN.exe
  C:\Windows\System\tbLSuQN.exe
  2⤵
  PID:10488
- C:\Windows\System\oXPkSBh.exe
  C:\Windows\System\oXPkSBh.exe
  2⤵
  PID:10520
- C:\Windows\System\UYzFYqe.exe
  C:\Windows\System\UYzFYqe.exe
  2⤵
  PID:10612
- C:\Windows\System\LnAzDaB.exe
  C:\Windows\System\LnAzDaB.exe
  2⤵
  PID:10732
- C:\Windows\System\ZgPuCJe.exe
  C:\Windows\System\ZgPuCJe.exe
  2⤵
  PID:10756
- C:\Windows\System\ncfUFtv.exe
  C:\Windows\System\ncfUFtv.exe
  2⤵
  PID:10800
- C:\Windows\System\mTLLTrA.exe
  C:\Windows\System\mTLLTrA.exe
  2⤵
  PID:10852
- C:\Windows\System\wpEoiSo.exe
  C:\Windows\System\wpEoiSo.exe
  2⤵
  PID:10928
- C:\Windows\System\dTbeTPT.exe
  C:\Windows\System\dTbeTPT.exe
  2⤵
  PID:10996
- C:\Windows\System\Roceyzc.exe
  C:\Windows\System\Roceyzc.exe
  2⤵
  PID:11008
- C:\Windows\System\DyaweWM.exe
  C:\Windows\System\DyaweWM.exe
  2⤵
  PID:11096
- C:\Windows\System\QxNynJI.exe
  C:\Windows\System\QxNynJI.exe
  2⤵
  PID:11188
- C:\Windows\System\FbzhWUg.exe
  C:\Windows\System\FbzhWUg.exe
  2⤵
  PID:11184
- C:\Windows\System\TeZurLh.exe
  C:\Windows\System\TeZurLh.exe
  2⤵
  PID:10292
- C:\Windows\System\ZjKVVWw.exe
  C:\Windows\System\ZjKVVWw.exe
  2⤵
  PID:10300
- C:\Windows\System\GktKpnq.exe
  C:\Windows\System\GktKpnq.exe
  2⤵
  PID:10616
- C:\Windows\System\syZkUlt.exe
  C:\Windows\System\syZkUlt.exe
  2⤵
  PID:10692
- C:\Windows\System\IZhFAPy.exe
  C:\Windows\System\IZhFAPy.exe
  2⤵
  PID:10796
- C:\Windows\System\JEafRPR.exe
  C:\Windows\System\JEafRPR.exe
  2⤵
  PID:10980
- C:\Windows\System\HYxJrdT.exe
  C:\Windows\System\HYxJrdT.exe
  2⤵
  PID:11144
- C:\Windows\System\EwLMsTy.exe
  C:\Windows\System\EwLMsTy.exe
  2⤵
  PID:10464
- C:\Windows\System\BPsOqyY.exe
  C:\Windows\System\BPsOqyY.exe
  2⤵
  PID:11228
- C:\Windows\System\NkhwGbQ.exe
  C:\Windows\System\NkhwGbQ.exe
  2⤵
  PID:11160
- C:\Windows\System\csEQZCF.exe
  C:\Windows\System\csEQZCF.exe
  2⤵
  PID:10976
- C:\Windows\System\lnxaraF.exe
  C:\Windows\System\lnxaraF.exe
  2⤵
  PID:11296
- C:\Windows\System\dnEnCvE.exe
  C:\Windows\System\dnEnCvE.exe
  2⤵
  PID:11316
- C:\Windows\System\EGvOAzX.exe
  C:\Windows\System\EGvOAzX.exe
  2⤵
  PID:11344
- C:\Windows\System\BrUiJjq.exe
  C:\Windows\System\BrUiJjq.exe
  2⤵
  PID:11388
- C:\Windows\System\lZeGjKi.exe
  C:\Windows\System\lZeGjKi.exe
  2⤵
  PID:11412
- C:\Windows\System\IGhDVxZ.exe
  C:\Windows\System\IGhDVxZ.exe
  2⤵
  PID:11444
- C:\Windows\System\IEbKynY.exe
  C:\Windows\System\IEbKynY.exe
  2⤵
  PID:11464
- C:\Windows\System\upjzpcn.exe
  C:\Windows\System\upjzpcn.exe
  2⤵
  PID:11484
- C:\Windows\System\CYrPGFY.exe
  C:\Windows\System\CYrPGFY.exe
  2⤵
  PID:11524
- C:\Windows\System\lmTchPq.exe
  C:\Windows\System\lmTchPq.exe
  2⤵
  PID:11544
- C:\Windows\System\RsBGkXa.exe
  C:\Windows\System\RsBGkXa.exe
  2⤵
  PID:11572
- C:\Windows\System\IzaXBrI.exe
  C:\Windows\System\IzaXBrI.exe
  2⤵
  PID:11616
- C:\Windows\System\aIYjnZh.exe
  C:\Windows\System\aIYjnZh.exe
  2⤵
  PID:11636
- C:\Windows\System\ysLsQUs.exe
  C:\Windows\System\ysLsQUs.exe
  2⤵
  PID:11656
- C:\Windows\System\kpndXXY.exe
  C:\Windows\System\kpndXXY.exe
  2⤵
  PID:11676
- C:\Windows\System\JuSKcVy.exe
  C:\Windows\System\JuSKcVy.exe
  2⤵
  PID:11696
- C:\Windows\System\OHCcWUQ.exe
  C:\Windows\System\OHCcWUQ.exe
  2⤵
  PID:11736
- C:\Windows\System\dJLUVeF.exe
  C:\Windows\System\dJLUVeF.exe
  2⤵
  PID:11760
- C:\Windows\System\uefeHAb.exe
  C:\Windows\System\uefeHAb.exe
  2⤵
  PID:11780
- C:\Windows\System\ZntoZlQ.exe
  C:\Windows\System\ZntoZlQ.exe
  2⤵
  PID:11816
- C:\Windows\System\zHmiAUB.exe
  C:\Windows\System\zHmiAUB.exe
  2⤵
  PID:11836
- C:\Windows\System\BPuZgfT.exe
  C:\Windows\System\BPuZgfT.exe
  2⤵
  PID:11860
- C:\Windows\System\wlDELMq.exe
  C:\Windows\System\wlDELMq.exe
  2⤵
  PID:11892
- C:\Windows\System\xtISGor.exe
  C:\Windows\System\xtISGor.exe
  2⤵
  PID:11928
- C:\Windows\System\dhaDuCr.exe
  C:\Windows\System\dhaDuCr.exe
  2⤵
  PID:11956
- C:\Windows\System\YefBYIX.exe
  C:\Windows\System\YefBYIX.exe
  2⤵
  PID:12000
- C:\Windows\System\HIudVmX.exe
  C:\Windows\System\HIudVmX.exe
  2⤵
  PID:12032
- C:\Windows\System\SKZKUwo.exe
  C:\Windows\System\SKZKUwo.exe
  2⤵
  PID:12056
- C:\Windows\System\MvyGtfs.exe
  C:\Windows\System\MvyGtfs.exe
  2⤵
  PID:12080
- C:\Windows\System\LyTcqgv.exe
  C:\Windows\System\LyTcqgv.exe
  2⤵
  PID:12112
- C:\Windows\System\bZMIcZC.exe
  C:\Windows\System\bZMIcZC.exe
  2⤵
  PID:12136
- C:\Windows\System\MUUybMv.exe
  C:\Windows\System\MUUybMv.exe
  2⤵
  PID:12152
- C:\Windows\System\YpXiyBM.exe
  C:\Windows\System\YpXiyBM.exe
  2⤵
  PID:12168
- C:\Windows\System\EOxwOAC.exe
  C:\Windows\System\EOxwOAC.exe
  2⤵
  PID:12236
- C:\Windows\System\ShcLqUl.exe
  C:\Windows\System\ShcLqUl.exe
  2⤵
  PID:12272
- C:\Windows\System\NlpIZmz.exe
  C:\Windows\System\NlpIZmz.exe
  2⤵
  PID:10816
- C:\Windows\System\RexulfG.exe
  C:\Windows\System\RexulfG.exe
  2⤵
  PID:11288
- C:\Windows\System\fyQBEQw.exe
  C:\Windows\System\fyQBEQw.exe
  2⤵
  PID:11340
- C:\Windows\System\GKxywhT.exe
  C:\Windows\System\GKxywhT.exe
  2⤵
  PID:11396
- C:\Windows\System\CrxjcKJ.exe
  C:\Windows\System\CrxjcKJ.exe
  2⤵
  PID:11424
- C:\Windows\System\PKzqNzF.exe
  C:\Windows\System\PKzqNzF.exe
  2⤵
  PID:11460
- C:\Windows\System\RGngLYI.exe
  C:\Windows\System\RGngLYI.exe
  2⤵
  PID:11584
- C:\Windows\System\fGpBoUv.exe
  C:\Windows\System\fGpBoUv.exe
  2⤵
  PID:11668
- C:\Windows\System\YuMcZwY.exe
  C:\Windows\System\YuMcZwY.exe
  2⤵
  PID:11692
- C:\Windows\System\AVeVHhG.exe
  C:\Windows\System\AVeVHhG.exe
  2⤵
  PID:11752
- C:\Windows\System\VPOCJeL.exe
  C:\Windows\System\VPOCJeL.exe
  2⤵
  PID:11844
- C:\Windows\System\YihGcWM.exe
  C:\Windows\System\YihGcWM.exe
  2⤵
  PID:11808
- C:\Windows\System\zDqfNMk.exe
  C:\Windows\System\zDqfNMk.exe
  2⤵
  PID:11924
- C:\Windows\System\WmRwLAs.exe
  C:\Windows\System\WmRwLAs.exe
  2⤵
  PID:11988
- C:\Windows\System\RaOwvRu.exe
  C:\Windows\System\RaOwvRu.exe
  2⤵
  PID:12128
- C:\Windows\System\wdUHWqk.exe
  C:\Windows\System\wdUHWqk.exe
  2⤵
  PID:12148
- C:\Windows\System\ZvvETXN.exe
  C:\Windows\System\ZvvETXN.exe
  2⤵
  PID:3116
- C:\Windows\System\hRUoVVM.exe
  C:\Windows\System\hRUoVVM.exe
  2⤵
  PID:12216
- C:\Windows\System\ascUfPA.exe
  C:\Windows\System\ascUfPA.exe
  2⤵
  PID:12284
- C:\Windows\System\WhjvSsu.exe
  C:\Windows\System\WhjvSsu.exe
  2⤵
  PID:11360
- C:\Windows\System\hlADSUC.exe
  C:\Windows\System\hlADSUC.exe
  2⤵
  PID:11568
- C:\Windows\System\pntrVsP.exe
  C:\Windows\System\pntrVsP.exe
  2⤵
  PID:11688
- C:\Windows\System\qqizMlQ.exe
  C:\Windows\System\qqizMlQ.exe
  2⤵
  PID:11876
- C:\Windows\System\KlrCvJc.exe
  C:\Windows\System\KlrCvJc.exe
  2⤵
  PID:12024
- C:\Windows\System\eVHgNhg.exe
  C:\Windows\System\eVHgNhg.exe
  2⤵
  PID:4340
- C:\Windows\System\CXHjTVA.exe
  C:\Windows\System\CXHjTVA.exe
  2⤵
  PID:11312
- C:\Windows\System\aWjOebG.exe
  C:\Windows\System\aWjOebG.exe
  2⤵
  PID:11032
- C:\Windows\System\NLCXgKB.exe
  C:\Windows\System\NLCXgKB.exe
  2⤵
  PID:12296
- C:\Windows\System\HEgZvTf.exe
  C:\Windows\System\HEgZvTf.exe
  2⤵
  PID:12312
- C:\Windows\System\EwGpMxH.exe
  C:\Windows\System\EwGpMxH.exe
  2⤵
  PID:12352
- C:\Windows\System\mNNwfiO.exe
  C:\Windows\System\mNNwfiO.exe
  2⤵
  PID:12372
- C:\Windows\System\VBusGXT.exe
  C:\Windows\System\VBusGXT.exe
  2⤵
  PID:12412
- C:\Windows\System\oaTYPuX.exe
  C:\Windows\System\oaTYPuX.exe
  2⤵
  PID:12448
- C:\Windows\System\DPCBrgH.exe
  C:\Windows\System\DPCBrgH.exe
  2⤵
  PID:12472
- C:\Windows\System\swhwIaD.exe
  C:\Windows\System\swhwIaD.exe
  2⤵
  PID:12508
- C:\Windows\System\NbMxRSJ.exe
  C:\Windows\System\NbMxRSJ.exe
  2⤵
  PID:12532
- C:\Windows\System\VnqxUad.exe
  C:\Windows\System\VnqxUad.exe
  2⤵
  PID:12552
- C:\Windows\System\DDgVeia.exe
  C:\Windows\System\DDgVeia.exe
  2⤵
  PID:12572
- C:\Windows\System\lvipvud.exe
  C:\Windows\System\lvipvud.exe
  2⤵
  PID:12600
- C:\Windows\System\vSTQEqx.exe
  C:\Windows\System\vSTQEqx.exe
  2⤵
  PID:12620
- C:\Windows\System\UYQgeQD.exe
  C:\Windows\System\UYQgeQD.exe
  2⤵
  PID:12652
- C:\Windows\System\qyRQuDn.exe
  C:\Windows\System\qyRQuDn.exe
  2⤵
  PID:12700
- C:\Windows\System\ClgdonT.exe
  C:\Windows\System\ClgdonT.exe
  2⤵
  PID:12716
- C:\Windows\System\RXQywJM.exe
  C:\Windows\System\RXQywJM.exe
  2⤵
  PID:12736
- C:\Windows\System\rXgTzna.exe
  C:\Windows\System\rXgTzna.exe
  2⤵
  PID:12752
- C:\Windows\System\pEbvVfR.exe
  C:\Windows\System\pEbvVfR.exe
  2⤵
  PID:12800
- C:\Windows\System\GIrWoCp.exe
  C:\Windows\System\GIrWoCp.exe
  2⤵
  PID:12852
- C:\Windows\System\dzIleLP.exe
  C:\Windows\System\dzIleLP.exe
  2⤵
  PID:12876
- C:\Windows\System\LhPwBDP.exe
  C:\Windows\System\LhPwBDP.exe
  2⤵
  PID:12916
- C:\Windows\System\OMuvLBK.exe
  C:\Windows\System\OMuvLBK.exe
  2⤵
  PID:12932
- C:\Windows\System\gROlxrj.exe
  C:\Windows\System\gROlxrj.exe
  2⤵
  PID:12956
- C:\Windows\System\bIGiGMf.exe
  C:\Windows\System\bIGiGMf.exe
  2⤵
  PID:12988
- C:\Windows\System\KrVKJud.exe
  C:\Windows\System\KrVKJud.exe
  2⤵
  PID:13004
- C:\Windows\System\emuMAiP.exe
  C:\Windows\System\emuMAiP.exe
  2⤵
  PID:13024
- C:\Windows\System\xqODAGG.exe
  C:\Windows\System\xqODAGG.exe
  2⤵
  PID:13048
- C:\Windows\System\hZktjUA.exe
  C:\Windows\System\hZktjUA.exe
  2⤵
  PID:13084
- C:\Windows\System\bJdpxTM.exe
  C:\Windows\System\bJdpxTM.exe
  2⤵
  PID:13132
- C:\Windows\System\jCzUFXp.exe
  C:\Windows\System\jCzUFXp.exe
  2⤵
  PID:13160
- C:\Windows\System\PbJNhAt.exe
  C:\Windows\System\PbJNhAt.exe
  2⤵
  PID:13184
- C:\Windows\System\zLMMuhf.exe
  C:\Windows\System\zLMMuhf.exe
  2⤵
  PID:13200
- C:\Windows\System\eDzNBYK.exe
  C:\Windows\System\eDzNBYK.exe
  2⤵
  PID:13216
- C:\Windows\System\hgSqWPm.exe
  C:\Windows\System\hgSqWPm.exe
  2⤵
  PID:13236
- C:\Windows\System\VcHMjdN.exe
  C:\Windows\System\VcHMjdN.exe
  2⤵
  PID:12344
- C:\Windows\System\PfyLHYv.exe
  C:\Windows\System\PfyLHYv.exe
  2⤵
  PID:12408
- C:\Windows\System\ThXewvz.exe
  C:\Windows\System\ThXewvz.exe
  2⤵
  PID:12712
- C:\Windows\System\hFyxAqq.exe
  C:\Windows\System\hFyxAqq.exe
  2⤵
  PID:12768
- C:\Windows\System\IMlsVnA.exe
  C:\Windows\System\IMlsVnA.exe
  2⤵
  PID:12868
- C:\Windows\System\ZNxNLsP.exe
  C:\Windows\System\ZNxNLsP.exe
  2⤵
  PID:12912
- C:\Windows\System\xxVxtjC.exe
  C:\Windows\System\xxVxtjC.exe
  2⤵
  PID:12984
- C:\Windows\System\WSVmSuz.exe
  C:\Windows\System\WSVmSuz.exe
  2⤵
  PID:12996
- C:\Windows\System\XijHMFx.exe
  C:\Windows\System\XijHMFx.exe
  2⤵
  PID:13064
- C:\Windows\System\DaFMjXr.exe
  C:\Windows\System\DaFMjXr.exe
  2⤵
  PID:13172
- C:\Windows\System\JYXTDuF.exe
  C:\Windows\System\JYXTDuF.exe
  2⤵
  PID:13212
- C:\Windows\System\vvsdhIq.exe
  C:\Windows\System\vvsdhIq.exe
  2⤵
  PID:13296
- C:\Windows\System\bKiITNW.exe
  C:\Windows\System\bKiITNW.exe
  2⤵
  PID:11480
- C:\Windows\System\ArNGMbz.exe
  C:\Windows\System\ArNGMbz.exe
  2⤵
  PID:12292
- C:\Windows\System\zmLchEl.exe
  C:\Windows\System\zmLchEl.exe
  2⤵
  PID:2556
- C:\Windows\System\tVRkjBJ.exe
  C:\Windows\System\tVRkjBJ.exe
  2⤵
  PID:13140
- C:\Windows\System\iwjzltj.exe
  C:\Windows\System\iwjzltj.exe
  2⤵
  PID:11664
- C:\Windows\System\mpyVoOU.exe
  C:\Windows\System\mpyVoOU.exe
  2⤵
  PID:2308
- C:\Windows\System\KGixQrX.exe
  C:\Windows\System\KGixQrX.exe
  2⤵
  PID:13268
- C:\Windows\System\kvVsgmA.exe
  C:\Windows\System\kvVsgmA.exe
  2⤵
  PID:12404
- C:\Windows\System\zQvTdnN.exe
  C:\Windows\System\zQvTdnN.exe
  2⤵
  PID:12520
- C:\Windows\System\dvbFCzN.exe
  C:\Windows\System\dvbFCzN.exe
  2⤵
  PID:12564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3uiz0pfv.01l.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AMurxQm.exe

Filesize
2.0MB

MD5
cab6d8dbd9c588859509fb1fb194b867

SHA1
4a6e1dad8f7324e17daa80b4fff1e7bef4bf59b6

SHA256
e515967badbb45ca752671b3ffc2e7e2831cd3f0ef6aca8e3240e0cef40dfb80

SHA512
c554bc52d5d0e4fef45bf720d81d44e4b2d4f98d7c831a0e4d8eb2988a248e7ba0960f428c3c3f837a42bb771983426b07222a89196c189376bf41dc8603115f

Download Submit
C:\Windows\System\BxxZwck.exe

Filesize
2.0MB

MD5
c4221f4e07d0539bec2142592b898992

SHA1
4e097a80368bc47076f5cc9fc56c1345b6d57460

SHA256
162c77ef8a70220ff76f7b239ad57f8d8fcc5ec1a0cdf6fe96c405bfa6248a2f

SHA512
83ac89d7525ff933c5212d434cafe917d4b605a64a3619d045518774558f3e765db411409cb00cc189088561142569e9fd9291d7977dc4e2f5a39502ae03b8b3

Download Submit
C:\Windows\System\FfHwvvK.exe

Filesize
2.0MB

MD5
473335c65b5dc4495892821cc414c5a5

SHA1
7b69919b21f2ce2bad45c0f4bd65fb7230daeffb

SHA256
ed0ca596ba6827ddacf1f2b4910e82b993b4a964a79f14869649405a97aa6a55

SHA512
494cc9f93c131afd405850be96c3795fa6d41f673b24550328f89c0940b5627a6ee1a33dbd1e29916e0b9350883a0889a36e500e24d215cc7d81320cef3ccfee

Download Submit
C:\Windows\System\GUGuICx.exe

Filesize
2.0MB

MD5
d0bd5a24980a142ecdc63f955af9449e

SHA1
807cf1349f7cc0ea14995e8e13174a2f19c576f7

SHA256
301ac0086871d0639f95e0e3fe125022a70e489ceafd5d3f10a5aefe15a467ec

SHA512
ff286393a28555abdef999aa1cfdd19dd4cb0ecfa0011275e0fca4dc9eb6870c57b4be62f260b720e192e612d1197f7ac712727617fdbf4c1eff2ce88fc811c0

Download Submit
C:\Windows\System\JMmEDoA.exe

Filesize
2.0MB

MD5
184b2a371cee8a2354d0c439b0b2c777

SHA1
b648944ef874e7c4ee2a578f47023f815ad71db1

SHA256
7ab1d90498b1a1892969ecca078d383ebc702390ddd76b4e5b91e9284eaa98bf

SHA512
bb2b848a345e63436e169e1c87422470140a09d275a2911e9055d3cb9e7bf1f968611b4291c4bbfa3f3a9bacf2eac8c076cba06ac2dfb30d9ffaa1b860512de4

Download Submit
C:\Windows\System\JtYUmfy.exe

Filesize
2.0MB

MD5
0a361ce46ba8f304d6c2c37524a4ac67

SHA1
aac3f76ef7362dafb0fe105f07cc232a8b0eb683

SHA256
c473d84e67f577b69aeeb66797f1e3beeb8d55f904e46cfaf32e1162c23fcc3c

SHA512
439448f99f405ea1450d38f10b6e3f399aff60244dc7979733b93e88b2890306e550b41b6e829b3072cf6bbacc1f4af0b6b3918bfa7eb08b9117b5c2afbf9dbf

Download Submit
C:\Windows\System\KjzRphY.exe

Filesize
2.0MB

MD5
4644a433594eb8bca2af512beaa2db32

SHA1
15f00f1e9fb1715318694fe28fb3a497557ddc41

SHA256
f17b8c9dd7b52cf6d1bafe45a0d21f68a64c133bc69f0bc642890a1c58a14d49

SHA512
6943c565368de86138f23c53d623e1cc56c05c8dd82ad952799c8ea6a48cd1304efbb3b080bccea66c921630a1977ded8d9222579a0a13a6443b9d575756002d

Download Submit
C:\Windows\System\NSFCfDa.exe

Filesize
2.0MB

MD5
e93d9438de9e0bd0cba32c2398f9f2db

SHA1
a0314f8a3d6df9ab4f3263f45fa9710074baa82c

SHA256
4d8c35685abb23128d57b149e9386190598a8cdf5b2d55fad04c987f05b715e7

SHA512
f7049650df2bdf6bd857c33eaebde9ccd7468b14a8cecc445b278914ce8022b557fd1499bdd5e593bdd06717d373f1ba24906a40c511111d1694b3cd87fb7b18

Download Submit
C:\Windows\System\PECTmYf.exe

Filesize
2.0MB

MD5
4faa0223ab757debf37478073a41dba4

SHA1
0b4a5c2858dc7325de6793f724ee456b6617a5af

SHA256
b0f2160161037adf8e0439c1c77fb0feab2585553a55401af43ee1ed1c40347a

SHA512
30957b728313e7bb120c998895ced060eed63ec4c75988841929faaf2f408429bc9caaaa6a1ff582255cb9f4f9b45cd5522803f9c3889c4aea0556706b1f6076

Download Submit
C:\Windows\System\QbylpgZ.exe

Filesize
2.0MB

MD5
728ad6718519a7d74fcdd9038b59b37b

SHA1
dc0d5921b88e7167e2b2933076221660f1e58cd1

SHA256
cbca32a2aff1bb6ed454d527f0e2a12ea4b4be3323b9a1cbb380a3ca12a89f6c

SHA512
395b684ff2fde609641c8a5633a536feb1df7dc8445c0bbfc319f0631f3e9ea8547b73214030707f759b246ed057780e8e7bbf0571648b1861bde6446d04be9a

Download Submit
C:\Windows\System\RWmTVUt.exe

Filesize
2.0MB

MD5
72b2a0dd1b9d94754b10008d2712d9f1

SHA1
5f1d280ddeb8a4efdb9b7031151c0101376ee32a

SHA256
92c446d4fef43bf9251148d31b36bfe02f3d09c9af1defab2bff8c8733b89097

SHA512
931b51574a6e4c4d976695edd44838129879a8c524bde42dc2ee69801db19a9518ea581e0e6007f01e71264b2e827984423b668b812300d00945d055f18a468d

Download Submit
C:\Windows\System\RjMFXSm.exe

Filesize
2.0MB

MD5
4454dd411de296473cbead73b1f10064

SHA1
db5d0764c6af7e4af62b8bd15c28b2b1ac79e1dc

SHA256
b6319f4ec6051109125673fe88d26fed84367035adfbbfbaad13f902b22087c6

SHA512
5da1794a17c2debbf764cdde476c71c2c7e8331e511ead550cc04a54d9ed63370251d64714c1b4b1dc531d5c9629f592a8f425769fb4c0e9966249270a46a66e

Download Submit
C:\Windows\System\Rqikiwv.exe

Filesize
2.0MB

MD5
954477510ceec43e1d70ac6dc0636d34

SHA1
d620e781a828d349920d6bfec783d4e71fe1e26a

SHA256
90d020db099942cd08274ee294ca2ab986731bbf917de40281c443dc9d655309

SHA512
2ea5ec5bc3aead7a3bb2c3962d3bc228ce79c771e192a42105ad795aaa12c28db7612b21542f70c9f525ccbd10a33947cd97bc7ade9ab994af1738087828ab4a

Download Submit
C:\Windows\System\SGspJlP.exe

Filesize
2.0MB

MD5
36ffe4bca2a9755bb6a3eb4a94dffa14

SHA1
6c8407b5e474835684c17aa6a0a429d76a76324e

SHA256
de5e4ac87473d1cea0e0d828a33e1d2df630c61488622bff5fd7363a5cb2e9cd

SHA512
2254a64c161cbf93258ae16741db8bc5faf6b797661bc0535465ebe30f9bd271a8ba040bbb1de1fa134eec743da516e28eca60d26cf21572fdd95e882fc9cbdf

Download Submit
C:\Windows\System\TsseAwR.exe

Filesize
2.0MB

MD5
42f2053b9f35f1b4fce41031beb010d0

SHA1
e939b10763e75c9e86f2542d0f46285f2ba51e3c

SHA256
9800d15d6b4340da80f35f7640a4c12819257e755ace477457ec57f191b5c864

SHA512
26ff137ad420d4c382d9ed18b9b8ae1f4c0cd25c82e1497279ccb6772efa2c40b3f65f59b1f7a441f26ef69353f81acc8c96e1181c16017f8188c7d4aa00be14

Download Submit
C:\Windows\System\TuHsncS.exe

Filesize
2.0MB

MD5
d6b04642bd9b7fddc96fac4021e5ac66

SHA1
eeea477d01c2161765c442b27a5fc35145a5330b

SHA256
173e2929f803fd50b4677a78b83be61c28daa1141bf733ba713aaf4276143249

SHA512
76d2497f3908ab96767cf7b05b53b800ef2acdd58098b4bb711c2c6663386e2812aefc47c1dc8a2b510a39c778adeda5a8e0e6030ee9baacff061d3a068d2634

Download Submit
C:\Windows\System\VPYisiF.exe

Filesize
8B

MD5
66d7e297b90fe34ca06f598960896d19

SHA1
0433321fa0d916440f15cdee91c3e93318197dee

SHA256
62c8848e8576ee6bb1b62b04fa3898ea9c1bff1c6df8e2421efa77ab49fa4456

SHA512
4abb742b6807bc5e9c1f07c9bd2c9a15b441e3a0f7a9715e62b9a71c659b66c03f5bdd4961bd675100bab1c61778e8b524a13e9a54f36d441aeb74ce1a0b5e73

Download Submit
C:\Windows\System\XeDCHgT.exe

Filesize
2.0MB

MD5
550e9cc096bcbb90eba96f2cd6771dc7

SHA1
4a09021628774257d2baa2b44c2b4135ae704aa3

SHA256
fc910855c81c7c8a8acc7161e47addc6b8afa4e2b24c88f3e66b223cdcb6e598

SHA512
3ffdc1b6432456e30097a27663d214ff622e0adf08fe4cbe0b1422dd57248d1fa109d6be3f2881a0ac1842623744b52005bfe26bf8dbacbf8995839ce8da1f7e

Download Submit
C:\Windows\System\ZxtQIzs.exe

Filesize
2.0MB

MD5
5286d100c27f2d678b2b519d95cdd48b

SHA1
4dd8a31dedc91dc762fb1eb4a79ecddd08d92d3d

SHA256
0f91066bf38129bf3770d91d5fb136ead9a893b87ba6fad6bfe24460e9146184

SHA512
5a58347f8f059d1f19b2ca2f849a6f7643aa3256fa55dc5d91d4f65e48e7148a13ec3e527e76cdd8ccb16e6a02035a5bc0947fbf114e967a81c7deeca1003075

Download Submit
C:\Windows\System\aAFbBIW.exe

Filesize
2.0MB

MD5
86bde2df1b9775287a17dbdfa93737dd

SHA1
2afaf0c116ed274e20466f325b857c908564a8cd

SHA256
723866d65dbc5d0bbc5053d3a2b720ac3436f17692c6a7af57c8dc667f37e61a

SHA512
74dbe4cf1082ecb7a520bb545ad4ab50a7c979e5ed969e7887bd33e9a2fb0c8e36f489b0f01b8c563df71520669eb657796c7b22575cde983367bfc292b0d903

Download Submit
C:\Windows\System\awTLLHQ.exe

Filesize
2.0MB

MD5
fdca242a6145df9d4ef20b2c747d61a2

SHA1
7579905747a3c9d2bc9e890c56d7c8d04750bf0d

SHA256
b84d8ad4c3c1231aae0f83acfce05fcfe0a5534ceaf323861fba3da2f27675f6

SHA512
adb5b34deed8ce7e8546dc012b1885d36f795455e1b5b1650ea3f5ce7074c2f4775782b4ef7cd7198c0c0de1281734dc5de6f7ce98cee82de3f0aa5662f29787

Download Submit
C:\Windows\System\jPxcjqM.exe

Filesize
2.0MB

MD5
70f4b916488696beb7387fc14598b6f4

SHA1
f543dc7f58e0c2a0743e896111f0a5c2f4ec4940

SHA256
05218be20a12daeb8b1d7146af87cbd14e75153aa839071af0715864430a66d8

SHA512
a60afb28d50c85a81b2e72827ad03a9cd36b96cf8218234cd85502f0c2f22940e69b49b34fab171d2bb304b55325f8a2294dfb03109cc656cba8d26ca47d4564

Download Submit
C:\Windows\System\jjWPmsT.exe

Filesize
2.0MB

MD5
499f60a977ce906a693b91cf2909e2f5

SHA1
cc462642158ab33d70c16fdbc2909d01a152f09b

SHA256
13fbd10cc96fa6b9370455eff31b2f86dca5d5b001ee5ce9650b9bc69cb836a9

SHA512
cd0855b05dc880439f76be57353e0f5256d6848a079e0912a117ee6a507813566fb8ac597d69336ffa9c63da0ab322ad7c4387df66d1278db6bcd31ffe4339e4

Download Submit
C:\Windows\System\jsKziev.exe

Filesize
2.0MB

MD5
ad6b05ef7784be1cd19ebb6012287983

SHA1
223d5498f89ab9e185384225879dd08a8571a70a

SHA256
aeaba6de84d954559fb4271f616ad7aacc0c5802ad066a7d27f5bfcd851d85a5

SHA512
fc1a896e0f80e1c5959f5387ab0f24c057f9d751e5977e4053dd0f05fb71eeda8ece439be9fc624fe8dd9eae059d8db312cdfd82532cb209ab3c3a023645d9ad

Download Submit
C:\Windows\System\njeWLpm.exe

Filesize
2.0MB

MD5
f6803bae95b3b755e57b040fcecd33a2

SHA1
50a369dba2e3328c234b1475da651da0ae083ac7

SHA256
308f7e5da89ade5ad7b041e95d58b84c0d190939a0e07fab97f0e446c33e7487

SHA512
bc88206521c4254dd0fe988572c2c9c41a1fcf7ac8a9b77f1a80339b6053695c908cb902ef210540736586144ac89ad0024ef36cbe8b89dc32371a0eb91b5033

Download Submit
C:\Windows\System\oHPATzn.exe

Filesize
2.0MB

MD5
abf889e1e4ad08e1a1064e2d35067296

SHA1
0e360d207f79ed200082caec228dfbdfb316ac78

SHA256
01bf106a8779730588178bd185ad98df85648a05a0125dfdd76a593d20f95d87

SHA512
425ad1d1c71fa683ea3d4e4b3fab0578cdcae69ac6ac42b12d81cde1f2191b6f428681f3dcb7f5dc6682069b7ec3f183ab57da2f8cfdadc89da4b283ae9203d9

Download Submit
C:\Windows\System\quswHXN.exe

Filesize
2.0MB

MD5
0b80107e77e2c8125a1fb11363373c64

SHA1
023c7f3019e506bdb1ae1f23907b5a4991942fee

SHA256
efc057f7d6e8cfad4866b19a1085df879ba41f25a0bd9e75ce1eb5ece90eb867

SHA512
d77826c9d566ac7056026b47ca1fae7bb43e9c263718fe76a93fb14c75b609f30a84194eed296b5d3e9f83246d6bcf1319c071ff4f82371a1aeb142443b57831

Download Submit
C:\Windows\System\shmRveR.exe

Filesize
2.0MB

MD5
b549b323fb35bc46eac56d842b0b025d

SHA1
2e8087a305f9b66fcf8ec99294e7a0301e83ead9

SHA256
050ec6f6ad851f5daf0c5c7af972f666f6e0747796f432442bf834c4e9043a3a

SHA512
31b1d9c659b378e01760046f10ff89fda094c7811b328dabad61e61e555b2ea08ca98c584bd5d582170a7998ec9563d15a3e0b7c242c73caf069f83c21329f07

Download Submit
C:\Windows\System\uaLHbLN.exe

Filesize
2.0MB

MD5
adc7a2ec0e8f8cf3a605b569478741aa

SHA1
33b4d57088399b3dff643a978cd80ef7445a3538

SHA256
b9770744ff659001218b2a9d98d659d2dd6b1b025375099a5a7de7755fd74617

SHA512
7f8859c8c30124df793cbff0c62d4c787ac2ec334488d717dc1b91afb6bffeac385d2c39d9cfe1cc7943b81dda2b36d3734f674b5e2e8e8a5a62e93bdfbc7e42

Download Submit
C:\Windows\System\uptmSqJ.exe

Filesize
2.0MB

MD5
ca09b184183c569998adfb283e4359d3

SHA1
6012f6ad9e239cef5b0e897cb75cb57b85f48584

SHA256
9f75d1f3a904b0a712ea9087260b1d3583d5db1257682f42d0c51a2ccb445b33

SHA512
c696360a5c15e34b2c4b78a5438e4d21e29a2f4e49f7b14aaf5d8458da57a4f6c10a9193993c6c27b3859a4e8742b241f0c92c2d0d87bbb077a17e57242dbbd6

Download Submit
C:\Windows\System\vbWCIva.exe

Filesize
2.0MB

MD5
28e5998e5b3923343a49f108e9a5c388

SHA1
2f1e14a4bab3e749d89411cb18341b3db80e1789

SHA256
fa49322317c1aff1e6c7baea11af6e7f9ebb0bdf9bb5f147ee09c68871b3c088

SHA512
9112e7b76336c43c7c75c8f89fb068c86ae25de73485a283f238d4ec74585835a16f7b563eb99c44460e20bb5f70f8301ee629647905cc3880c7ddf7bb552e50

Download Submit
C:\Windows\System\vhQiabx.exe

Filesize
2.0MB

MD5
df2a460474adb4e69c51ba65e9cd0ee7

SHA1
0c5763a45eae44cd87d35d10985c11c7ae2d7025

SHA256
661545842adcef4d167e0627bc2a61087c378e0d4361a34c374626c3111f163c

SHA512
9626b2cdf304e482fe878d15894b12d526bf71932314fd3ab73b62be7b0186b521be98c11f2bfb9a6a2df76c9aac24964d335e9e8170bd52186ab3047bfbd006

Download Submit
C:\Windows\System\xcVnkWd.exe

Filesize
2.0MB

MD5
02b2c5b063e17e33c12eb836dc0083bf

SHA1
302683c7ca72c14c987eb5db6e1e7108bd56df68

SHA256
1ff52efa442ff253057904d51a06360430fc5945e9169166e6e0773ba61dc53a

SHA512
a5e22b3b4cb8f39aee807c0ef6630025d7e2f638fd262afb367ae04cde5f98c861fa3a49950256d9132ac53cd6b77c4d8ad087fa37ba0a243fe9d8b042708030

Download Submit
C:\Windows\System\zARhjIY.exe

Filesize
2.0MB

MD5
779f5828d9e79da174493adccbb14ef6

SHA1
8b2ddbc23b1451a1a8ec8b3ebe336ca9cca705ba

SHA256
427a9288022875200fd52892c45e930fd30296228aef1ee5a60927a07f4184f3

SHA512
9e7cad9cac3a4d0b972444c2550475f0ae47d03d8e2ac1daf9ae5953f3c3020fb7be4b6ad77c3ed3e3bc5344517cfc5bf31bdf8ffef851c7e9e81973e9f712ac

Download Submit
memory/648-2590-0x00007FF7B76B0000-0x00007FF7B7AA2000-memory.dmp

Filesize
3.9MB

Download
memory/648-179-0x00007FF7B76B0000-0x00007FF7B7AA2000-memory.dmp

Filesize
3.9MB

Download
memory/876-81-0x00007FF700620000-0x00007FF700A12000-memory.dmp

Filesize
3.9MB

Download
memory/876-2574-0x00007FF700620000-0x00007FF700A12000-memory.dmp

Filesize
3.9MB

Download
memory/1940-166-0x00007FF66A7C0000-0x00007FF66ABB2000-memory.dmp

Filesize
3.9MB

Download
memory/1940-2577-0x00007FF66A7C0000-0x00007FF66ABB2000-memory.dmp

Filesize
3.9MB

Download
memory/2124-2559-0x00007FF759830000-0x00007FF759C22000-memory.dmp

Filesize
3.9MB

Download
memory/2124-63-0x00007FF759830000-0x00007FF759C22000-memory.dmp

Filesize
3.9MB

Download
memory/2536-2548-0x00007FF74A0F0000-0x00007FF74A4E2000-memory.dmp

Filesize
3.9MB

Download
memory/2536-2555-0x00007FF74A0F0000-0x00007FF74A4E2000-memory.dmp

Filesize
3.9MB

Download
memory/2536-8-0x00007FF74A0F0000-0x00007FF74A4E2000-memory.dmp

Filesize
3.9MB

Download
memory/2568-135-0x00007FF7D2640000-0x00007FF7D2A32000-memory.dmp

Filesize
3.9MB

Download
memory/2568-2553-0x00007FF7D2640000-0x00007FF7D2A32000-memory.dmp

Filesize
3.9MB

Download
memory/2568-2588-0x00007FF7D2640000-0x00007FF7D2A32000-memory.dmp

Filesize
3.9MB

Download
memory/2588-97-0x00007FF6A0D60000-0x00007FF6A1152000-memory.dmp

Filesize
3.9MB

Download
memory/2588-2570-0x00007FF6A0D60000-0x00007FF6A1152000-memory.dmp

Filesize
3.9MB

Download
memory/2688-173-0x00007FF60A690000-0x00007FF60AA82000-memory.dmp

Filesize
3.9MB

Download
memory/2688-2581-0x00007FF60A690000-0x00007FF60AA82000-memory.dmp

Filesize
3.9MB

Download
memory/3024-153-0x00007FF618D20000-0x00007FF619112000-memory.dmp

Filesize
3.9MB

Download
memory/3024-2565-0x00007FF618D20000-0x00007FF619112000-memory.dmp

Filesize
3.9MB

Download
memory/3036-110-0x00007FF7E9C40000-0x00007FF7EA032000-memory.dmp

Filesize
3.9MB

Download
memory/3036-2571-0x00007FF7E9C40000-0x00007FF7EA032000-memory.dmp

Filesize
3.9MB

Download
memory/3232-36-0x00007FF892140000-0x00007FF892C01000-memory.dmp

Filesize
10.8MB

Download
memory/3232-59-0x0000012FBBFB0000-0x0000012FBBFC0000-memory.dmp

Filesize
64KB

Download
memory/3232-58-0x0000012FBBFB0000-0x0000012FBBFC0000-memory.dmp

Filesize
64KB

Download
memory/3232-154-0x0000012FBE2A0000-0x0000012FBE2C2000-memory.dmp

Filesize
136KB

Download
memory/3336-2583-0x00007FF644CD0000-0x00007FF6450C2000-memory.dmp

Filesize
3.9MB

Download
memory/3336-111-0x00007FF644CD0000-0x00007FF6450C2000-memory.dmp

Filesize
3.9MB

Download
memory/3780-0-0x00007FF79E9C0000-0x00007FF79EDB2000-memory.dmp

Filesize
3.9MB

Download
memory/3780-1-0x000002B6822D0000-0x000002B6822E0000-memory.dmp

Filesize
64KB

Download
memory/3804-2550-0x00007FF61F8A0000-0x00007FF61FC92000-memory.dmp

Filesize
3.9MB

Download
memory/3804-47-0x00007FF61F8A0000-0x00007FF61FC92000-memory.dmp

Filesize
3.9MB

Download
memory/3804-2561-0x00007FF61F8A0000-0x00007FF61FC92000-memory.dmp

Filesize
3.9MB

Download
memory/3816-146-0x00007FF6158D0000-0x00007FF615CC2000-memory.dmp

Filesize
3.9MB

Download
memory/3816-2598-0x00007FF6158D0000-0x00007FF615CC2000-memory.dmp

Filesize
3.9MB

Download
memory/3880-2586-0x00007FF747840000-0x00007FF747C32000-memory.dmp

Filesize
3.9MB

Download
memory/3880-142-0x00007FF747840000-0x00007FF747C32000-memory.dmp

Filesize
3.9MB

Download
memory/4056-125-0x00007FF64E2C0000-0x00007FF64E6B2000-memory.dmp

Filesize
3.9MB

Download
memory/4056-2593-0x00007FF64E2C0000-0x00007FF64E6B2000-memory.dmp

Filesize
3.9MB

Download
memory/4076-2549-0x00007FF775410000-0x00007FF775802000-memory.dmp

Filesize
3.9MB

Download
memory/4076-16-0x00007FF775410000-0x00007FF775802000-memory.dmp

Filesize
3.9MB

Download
memory/4076-2557-0x00007FF775410000-0x00007FF775802000-memory.dmp

Filesize
3.9MB

Download
memory/4324-2552-0x00007FF639C50000-0x00007FF63A042000-memory.dmp

Filesize
3.9MB

Download
memory/4324-2576-0x00007FF639C50000-0x00007FF63A042000-memory.dmp

Filesize
3.9MB

Download
memory/4324-64-0x00007FF639C50000-0x00007FF63A042000-memory.dmp

Filesize
3.9MB

Download
memory/4380-145-0x00007FF606450000-0x00007FF606842000-memory.dmp

Filesize
3.9MB

Download
memory/4380-2599-0x00007FF606450000-0x00007FF606842000-memory.dmp

Filesize
3.9MB

Download
memory/4596-167-0x00007FF6A65D0000-0x00007FF6A69C2000-memory.dmp

Filesize
3.9MB

Download
memory/4596-2579-0x00007FF6A65D0000-0x00007FF6A69C2000-memory.dmp

Filesize
3.9MB

Download
memory/4888-2567-0x00007FF758EA0000-0x00007FF759292000-memory.dmp

Filesize
3.9MB

Download
memory/4888-158-0x00007FF758EA0000-0x00007FF759292000-memory.dmp

Filesize
3.9MB

Download
memory/4916-2564-0x00007FF702D50000-0x00007FF703142000-memory.dmp

Filesize
3.9MB

Download
memory/4916-2551-0x00007FF702D50000-0x00007FF703142000-memory.dmp

Filesize
3.9MB

Download
memory/4916-57-0x00007FF702D50000-0x00007FF703142000-memory.dmp

Filesize
3.9MB

Download