xmrig | b0cb8ea560ab5b1bbbb7c4966ffa18a3d96b5f4bfe89bbe24f426631059954fa

Analysis

max time kernel
13s
max time network
28s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 19:22

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
Size

2.2MB
MD5

05e656606a2cf2719313ac868b0312ca
SHA1

1c27f58f7ecc9bd3c99d20e9dd6fb3814077c961
SHA256

b0cb8ea560ab5b1bbbb7c4966ffa18a3d96b5f4bfe89bbe24f426631059954fa
SHA512

f624a228cad7679d0a9019d720f5550ae7d45657ba79fc0bbb9ee4589a20028d0eb381f6f224c28494b5c5463d269acb10f3852cc2d00ea2840b6dd6973bf509
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfr:NABs

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 20 IoCs

miner

resource	yara_rule
behavioral2/memory/452-246-0x00007FF75EAD0000-0x00007FF75EEC2000-memory.dmp	xmrig
behavioral2/memory/4400-258-0x00007FF69D9E0000-0x00007FF69DDD2000-memory.dmp	xmrig
behavioral2/memory/2332-329-0x00007FF7DEE10000-0x00007FF7DF202000-memory.dmp	xmrig
behavioral2/memory/4688-358-0x00007FF73B370000-0x00007FF73B762000-memory.dmp	xmrig
behavioral2/memory/1964-389-0x00007FF7A4290000-0x00007FF7A4682000-memory.dmp	xmrig
behavioral2/memory/5112-411-0x00007FF655840000-0x00007FF655C32000-memory.dmp	xmrig
behavioral2/memory/1136-412-0x00007FF6DA480000-0x00007FF6DA872000-memory.dmp	xmrig
behavioral2/memory/3488-410-0x00007FF7F8350000-0x00007FF7F8742000-memory.dmp	xmrig
behavioral2/memory/1348-407-0x00007FF7902B0000-0x00007FF7906A2000-memory.dmp	xmrig
behavioral2/memory/1748-406-0x00007FF7FE2C0000-0x00007FF7FE6B2000-memory.dmp	xmrig
behavioral2/memory/4832-363-0x00007FF600B80000-0x00007FF600F72000-memory.dmp	xmrig
behavioral2/memory/4772-334-0x00007FF7CECF0000-0x00007FF7CF0E2000-memory.dmp	xmrig
behavioral2/memory/860-300-0x00007FF791540000-0x00007FF791932000-memory.dmp	xmrig
behavioral2/memory/1516-224-0x00007FF7AF990000-0x00007FF7AFD82000-memory.dmp	xmrig
behavioral2/memory/1360-191-0x00007FF795710000-0x00007FF795B02000-memory.dmp	xmrig
behavioral2/memory/4216-148-0x00007FF7363B0000-0x00007FF7367A2000-memory.dmp	xmrig
behavioral2/memory/3148-140-0x00007FF7056E0000-0x00007FF705AD2000-memory.dmp	xmrig
behavioral2/memory/3272-108-0x00007FF7287F0000-0x00007FF728BE2000-memory.dmp	xmrig
behavioral2/memory/1484-79-0x00007FF6292F0000-0x00007FF6296E2000-memory.dmp	xmrig
behavioral2/memory/4332-61-0x00007FF780E30000-0x00007FF781222000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4108	Qoixqrq.exe
1748	nUiadFE.exe
1348	nbSHhAO.exe
4332	ieWJpOx.exe
1484	qLARYwm.exe
3272	lKRhzyq.exe
3148	sZLwBmy.exe
4216	oNFuWuE.exe
1360	ZNkqYLd.exe
3488	dQUekod.exe
1516	qPJzSzi.exe
452	VzstQxx.exe
5112	pABJeJR.exe
4400	xDThalv.exe
860	GQeUOha.exe
1136	KbxpmlO.exe
2332	vSdVZAb.exe
4772	ZYLspMP.exe
4688	XYVOzJn.exe
4832	kLACNLv.exe
1964	QXSuUWs.exe
1488	JTNEGMj.exe
2404	BotMINS.exe
800	nvlHsXf.exe
864	MZtgsJH.exe
3660	kIWkxjI.exe
4092	dgmqLAM.exe
4396	gdIdqui.exe
3724	LtSVzjH.exe
2500	fsUPQMj.exe
2516	naggtqm.exe
2140	xYQUzAG.exe
4992	qkLkkES.exe
4824	dKlRGGC.exe
2004	oxWAwBH.exe
1228	gUkNSRU.exe
3244	UVCJBgn.exe
1796	WiEmCCI.exe
1696	jochNpo.exe
3208	jBGqebI.exe
4648	XKQquon.exe
4584	qmsrkJq.exe
2716	uhRVUww.exe
4088	TcCdUlb.exe
2556	jVbpvev.exe
3980	kgGZutE.exe
4428	urSrHhF.exe
1216	YUrQmUS.exe
516	cuRLmuL.exe
4768	qmLGWnO.exe
4484	eAQObzf.exe
4840	szQkEfw.exe
1036	urpJqTB.exe
4368	cHHzHnv.exe
872	cuKxMdo.exe
4908	IqzfvZv.exe
1148	BRNsoHd.exe
1976	vGYbBBM.exe
1896	cEIxmNw.exe
1208	KLJzOZK.exe
3780	JtlpqGR.exe
2228	bzDpAWc.exe
2492	UVqbwBl.exe
1584	sABSgTK.exe

UPX packed file 61 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5072-0-0x00007FF6BB9F0000-0x00007FF6BBDE2000-memory.dmp	upx
behavioral2/files/0x000a000000023bb8-17.dat	upx
behavioral2/files/0x000a000000023bb9-38.dat	upx
behavioral2/files/0x000a000000023bbf-50.dat	upx
behavioral2/files/0x000a000000023bbc-31.dat	upx
behavioral2/files/0x000a000000023bbb-30.dat	upx
behavioral2/files/0x000a000000023bba-23.dat	upx
behavioral2/files/0x000a000000023bb7-27.dat	upx
behavioral2/files/0x000c000000023ba4-8.dat	upx
behavioral2/memory/4108-14-0x00007FF7C9480000-0x00007FF7C9872000-memory.dmp	upx
behavioral2/files/0x000a000000023bbd-66.dat	upx
behavioral2/files/0x000a000000023bc6-82.dat	upx
behavioral2/files/0x000a000000023bc9-105.dat	upx
behavioral2/files/0x000a000000023bd7-174.dat	upx
behavioral2/memory/452-246-0x00007FF75EAD0000-0x00007FF75EEC2000-memory.dmp	upx
behavioral2/memory/4400-258-0x00007FF69D9E0000-0x00007FF69DDD2000-memory.dmp	upx
behavioral2/memory/2332-329-0x00007FF7DEE10000-0x00007FF7DF202000-memory.dmp	upx
behavioral2/memory/4688-358-0x00007FF73B370000-0x00007FF73B762000-memory.dmp	upx
behavioral2/memory/1964-389-0x00007FF7A4290000-0x00007FF7A4682000-memory.dmp	upx
behavioral2/memory/5112-411-0x00007FF655840000-0x00007FF655C32000-memory.dmp	upx
behavioral2/memory/1136-412-0x00007FF6DA480000-0x00007FF6DA872000-memory.dmp	upx
behavioral2/memory/3488-410-0x00007FF7F8350000-0x00007FF7F8742000-memory.dmp	upx
behavioral2/memory/1348-407-0x00007FF7902B0000-0x00007FF7906A2000-memory.dmp	upx
behavioral2/memory/1748-406-0x00007FF7FE2C0000-0x00007FF7FE6B2000-memory.dmp	upx
behavioral2/memory/4832-363-0x00007FF600B80000-0x00007FF600F72000-memory.dmp	upx
behavioral2/memory/4772-334-0x00007FF7CECF0000-0x00007FF7CF0E2000-memory.dmp	upx
behavioral2/memory/860-300-0x00007FF791540000-0x00007FF791932000-memory.dmp	upx
behavioral2/memory/1516-224-0x00007FF7AF990000-0x00007FF7AFD82000-memory.dmp	upx
behavioral2/files/0x000a000000023bdb-186.dat	upx
behavioral2/files/0x000a000000023bda-185.dat	upx
behavioral2/files/0x000a000000023bd9-184.dat	upx
behavioral2/files/0x000a000000023bd8-177.dat	upx
behavioral2/files/0x000a000000023bcb-173.dat	upx
behavioral2/files/0x000a000000023bca-172.dat	upx
behavioral2/files/0x000a000000023bc8-167.dat	upx
behavioral2/files/0x000a000000023bc5-165.dat	upx
behavioral2/files/0x000c000000023ba5-164.dat	upx
behavioral2/files/0x000a000000023bd6-163.dat	upx
behavioral2/files/0x000a000000023bd5-162.dat	upx
behavioral2/files/0x000a000000023bd4-161.dat	upx
behavioral2/files/0x000a000000023bc7-158.dat	upx
behavioral2/memory/1360-191-0x00007FF795710000-0x00007FF795B02000-memory.dmp	upx
behavioral2/memory/4216-148-0x00007FF7363B0000-0x00007FF7367A2000-memory.dmp	upx
behavioral2/files/0x000a000000023bd3-144.dat	upx
behavioral2/files/0x000a000000023bd2-136.dat	upx
behavioral2/files/0x000a000000023bd1-133.dat	upx
behavioral2/files/0x000a000000023bd0-129.dat	upx
behavioral2/files/0x000a000000023bcf-126.dat	upx
behavioral2/files/0x000a000000023bce-125.dat	upx
behavioral2/files/0x000a000000023bc4-118.dat	upx
behavioral2/files/0x000a000000023bc3-117.dat	upx
behavioral2/files/0x000a000000023bcd-157.dat	upx
behavioral2/files/0x000a000000023bcc-115.dat	upx
behavioral2/memory/3148-140-0x00007FF7056E0000-0x00007FF705AD2000-memory.dmp	upx
behavioral2/memory/3272-108-0x00007FF7287F0000-0x00007FF728BE2000-memory.dmp	upx
behavioral2/files/0x000a000000023bc2-116.dat	upx
behavioral2/memory/1484-79-0x00007FF6292F0000-0x00007FF6296E2000-memory.dmp	upx
behavioral2/files/0x000a000000023bc1-75.dat	upx
behavioral2/files/0x000a000000023bc0-91.dat	upx
behavioral2/files/0x000a000000023bbe-71.dat	upx
behavioral2/memory/4332-61-0x00007FF780E30000-0x00007FF781222000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\fdTXReg.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\HrUnams.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\opcuAEp.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\ZYLspMP.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\iUxzRsA.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\cuKxMdo.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\VnlQMZB.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\sZLwBmy.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\gUkNSRU.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\jBGqebI.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\TcCdUlb.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\cuRLmuL.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\nUiadFE.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\qkLkkES.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\IqzfvZv.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\PYNdXYu.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\aIndSed.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\BotMINS.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\urpJqTB.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\TcwkEmk.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\XYVOzJn.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\feOQHKK.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\BRNsoHd.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\HrmRWJh.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\OLjQXvi.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\xDThalv.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\QXSuUWs.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\muNdkys.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\ATzKvJZ.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\ayquYNY.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\AchmPCg.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\KbxpmlO.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\XKQquon.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\qmLGWnO.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\QzHxvkp.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\DBokxnp.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\nbSHhAO.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\GQeUOha.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\hIKIBQa.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\oxWAwBH.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\iDaqXEW.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\upcBcDX.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\yAsCsmD.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\kNVXEyY.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\wAOkXMP.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\LNuFYbE.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\ieWJpOx.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\VzstQxx.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\YUrQmUS.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\KrGvIdl.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\YuFgURS.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\gHLeaCn.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\oNFuWuE.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\MZtgsJH.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\xYQUzAG.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\dyJZykH.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\XBgwCbz.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\XdsZmBS.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\qPJzSzi.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\UVCJBgn.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\vGYbBBM.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\xjEpUKn.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\RiPJqPT.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\chRziDn.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4476	powershell.exe
4476	powershell.exe
4476	powershell.exe
4476	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
Token: SeDebugPrivilege	4476	powershell.exe
Token: SeLockMemoryPrivilege	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 4476	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	86
PID 5072 wrote to memory of 4476	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	86
PID 5072 wrote to memory of 4108	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	87
PID 5072 wrote to memory of 4108	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	87
PID 5072 wrote to memory of 1748	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	88
PID 5072 wrote to memory of 1748	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	88
PID 5072 wrote to memory of 1348	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	89
PID 5072 wrote to memory of 1348	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	89
PID 5072 wrote to memory of 4332	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	90
PID 5072 wrote to memory of 4332	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	90
PID 5072 wrote to memory of 1484	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	91
PID 5072 wrote to memory of 1484	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	91
PID 5072 wrote to memory of 3272	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	92
PID 5072 wrote to memory of 3272	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	92
PID 5072 wrote to memory of 3148	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	93
PID 5072 wrote to memory of 3148	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	93
PID 5072 wrote to memory of 4216	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	94
PID 5072 wrote to memory of 4216	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	94
PID 5072 wrote to memory of 1360	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	95
PID 5072 wrote to memory of 1360	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	95
PID 5072 wrote to memory of 3488	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	96
PID 5072 wrote to memory of 3488	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	96
PID 5072 wrote to memory of 1516	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	97
PID 5072 wrote to memory of 1516	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	97
PID 5072 wrote to memory of 452	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	98
PID 5072 wrote to memory of 452	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	98
PID 5072 wrote to memory of 5112	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	99
PID 5072 wrote to memory of 5112	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	99
PID 5072 wrote to memory of 4400	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	100
PID 5072 wrote to memory of 4400	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	100
PID 5072 wrote to memory of 860	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	101
PID 5072 wrote to memory of 860	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	101
PID 5072 wrote to memory of 4772	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	102
PID 5072 wrote to memory of 4772	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	102
PID 5072 wrote to memory of 1136	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	103
PID 5072 wrote to memory of 1136	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	103
PID 5072 wrote to memory of 2332	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	104
PID 5072 wrote to memory of 2332	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	104
PID 5072 wrote to memory of 4688	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	105
PID 5072 wrote to memory of 4688	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	105
PID 5072 wrote to memory of 4832	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	106
PID 5072 wrote to memory of 4832	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	106
PID 5072 wrote to memory of 1964	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	107
PID 5072 wrote to memory of 1964	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	107
PID 5072 wrote to memory of 1488	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	108
PID 5072 wrote to memory of 1488	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	108
PID 5072 wrote to memory of 2404	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	109
PID 5072 wrote to memory of 2404	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	109
PID 5072 wrote to memory of 2500	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	110
PID 5072 wrote to memory of 2500	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	110
PID 5072 wrote to memory of 800	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	111
PID 5072 wrote to memory of 800	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	111
PID 5072 wrote to memory of 864	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	112
PID 5072 wrote to memory of 864	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	112
PID 5072 wrote to memory of 3660	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	113
PID 5072 wrote to memory of 3660	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	113
PID 5072 wrote to memory of 4092	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	114
PID 5072 wrote to memory of 4092	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	114
PID 5072 wrote to memory of 4396	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	115
PID 5072 wrote to memory of 4396	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	115
PID 5072 wrote to memory of 3724	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	116
PID 5072 wrote to memory of 3724	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	116
PID 5072 wrote to memory of 2516	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	117
PID 5072 wrote to memory of 2516	5072	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	117

C:\Users\Admin\AppData\Local\Temp\05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4476
- C:\Windows\System\Qoixqrq.exe
  C:\Windows\System\Qoixqrq.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\nUiadFE.exe
  C:\Windows\System\nUiadFE.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\nbSHhAO.exe
  C:\Windows\System\nbSHhAO.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\ieWJpOx.exe
  C:\Windows\System\ieWJpOx.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\qLARYwm.exe
  C:\Windows\System\qLARYwm.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\lKRhzyq.exe
  C:\Windows\System\lKRhzyq.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\sZLwBmy.exe
  C:\Windows\System\sZLwBmy.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\oNFuWuE.exe
  C:\Windows\System\oNFuWuE.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System\ZNkqYLd.exe
  C:\Windows\System\ZNkqYLd.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\dQUekod.exe
  C:\Windows\System\dQUekod.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\qPJzSzi.exe
  C:\Windows\System\qPJzSzi.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\VzstQxx.exe
  C:\Windows\System\VzstQxx.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\pABJeJR.exe
  C:\Windows\System\pABJeJR.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\xDThalv.exe
  C:\Windows\System\xDThalv.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\GQeUOha.exe
  C:\Windows\System\GQeUOha.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\ZYLspMP.exe
  C:\Windows\System\ZYLspMP.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\KbxpmlO.exe
  C:\Windows\System\KbxpmlO.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\vSdVZAb.exe
  C:\Windows\System\vSdVZAb.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\XYVOzJn.exe
  C:\Windows\System\XYVOzJn.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\kLACNLv.exe
  C:\Windows\System\kLACNLv.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\QXSuUWs.exe
  C:\Windows\System\QXSuUWs.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\JTNEGMj.exe
  C:\Windows\System\JTNEGMj.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\BotMINS.exe
  C:\Windows\System\BotMINS.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\fsUPQMj.exe
  C:\Windows\System\fsUPQMj.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\nvlHsXf.exe
  C:\Windows\System\nvlHsXf.exe
  2⤵
  - Executes dropped EXE
  PID:800
- C:\Windows\System\MZtgsJH.exe
  C:\Windows\System\MZtgsJH.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\kIWkxjI.exe
  C:\Windows\System\kIWkxjI.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\dgmqLAM.exe
  C:\Windows\System\dgmqLAM.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\gdIdqui.exe
  C:\Windows\System\gdIdqui.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\LtSVzjH.exe
  C:\Windows\System\LtSVzjH.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\naggtqm.exe
  C:\Windows\System\naggtqm.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\xYQUzAG.exe
  C:\Windows\System\xYQUzAG.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\qkLkkES.exe
  C:\Windows\System\qkLkkES.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\dKlRGGC.exe
  C:\Windows\System\dKlRGGC.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\oxWAwBH.exe
  C:\Windows\System\oxWAwBH.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\gUkNSRU.exe
  C:\Windows\System\gUkNSRU.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\UVCJBgn.exe
  C:\Windows\System\UVCJBgn.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\WiEmCCI.exe
  C:\Windows\System\WiEmCCI.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\jochNpo.exe
  C:\Windows\System\jochNpo.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\jBGqebI.exe
  C:\Windows\System\jBGqebI.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\XKQquon.exe
  C:\Windows\System\XKQquon.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\qmsrkJq.exe
  C:\Windows\System\qmsrkJq.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\uhRVUww.exe
  C:\Windows\System\uhRVUww.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\TcCdUlb.exe
  C:\Windows\System\TcCdUlb.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\jVbpvev.exe
  C:\Windows\System\jVbpvev.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\kgGZutE.exe
  C:\Windows\System\kgGZutE.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\IqzfvZv.exe
  C:\Windows\System\IqzfvZv.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\vGYbBBM.exe
  C:\Windows\System\vGYbBBM.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\urSrHhF.exe
  C:\Windows\System\urSrHhF.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\YUrQmUS.exe
  C:\Windows\System\YUrQmUS.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\cuRLmuL.exe
  C:\Windows\System\cuRLmuL.exe
  2⤵
  - Executes dropped EXE
  PID:516
- C:\Windows\System\qmLGWnO.exe
  C:\Windows\System\qmLGWnO.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\eAQObzf.exe
  C:\Windows\System\eAQObzf.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\szQkEfw.exe
  C:\Windows\System\szQkEfw.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\urpJqTB.exe
  C:\Windows\System\urpJqTB.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\cHHzHnv.exe
  C:\Windows\System\cHHzHnv.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\cuKxMdo.exe
  C:\Windows\System\cuKxMdo.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\BRNsoHd.exe
  C:\Windows\System\BRNsoHd.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\cEIxmNw.exe
  C:\Windows\System\cEIxmNw.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\KLJzOZK.exe
  C:\Windows\System\KLJzOZK.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\JtlpqGR.exe
  C:\Windows\System\JtlpqGR.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System\bzDpAWc.exe
  C:\Windows\System\bzDpAWc.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\UVqbwBl.exe
  C:\Windows\System\UVqbwBl.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\sABSgTK.exe
  C:\Windows\System\sABSgTK.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\iUxzRsA.exe
  C:\Windows\System\iUxzRsA.exe
  2⤵
  PID:1588
- C:\Windows\System\qIyVzRP.exe
  C:\Windows\System\qIyVzRP.exe
  2⤵
  PID:4444
- C:\Windows\System\dyJZykH.exe
  C:\Windows\System\dyJZykH.exe
  2⤵
  PID:2804
- C:\Windows\System\QzHxvkp.exe
  C:\Windows\System\QzHxvkp.exe
  2⤵
  PID:5104
- C:\Windows\System\oZlGdUF.exe
  C:\Windows\System\oZlGdUF.exe
  2⤵
  PID:3420
- C:\Windows\System\xjEpUKn.exe
  C:\Windows\System\xjEpUKn.exe
  2⤵
  PID:1468
- C:\Windows\System\xbNYHBG.exe
  C:\Windows\System\xbNYHBG.exe
  2⤵
  PID:1576
- C:\Windows\System\HybljnI.exe
  C:\Windows\System\HybljnI.exe
  2⤵
  PID:4196
- C:\Windows\System\JNiOncE.exe
  C:\Windows\System\JNiOncE.exe
  2⤵
  PID:5172
- C:\Windows\System\TdsjdAr.exe
  C:\Windows\System\TdsjdAr.exe
  2⤵
  PID:5192
- C:\Windows\System\kNVXEyY.exe
  C:\Windows\System\kNVXEyY.exe
  2⤵
  PID:5208
- C:\Windows\System\zdRDqri.exe
  C:\Windows\System\zdRDqri.exe
  2⤵
  PID:5224
- C:\Windows\System\bEMjjij.exe
  C:\Windows\System\bEMjjij.exe
  2⤵
  PID:5240
- C:\Windows\System\OvzytoI.exe
  C:\Windows\System\OvzytoI.exe
  2⤵
  PID:5256
- C:\Windows\System\TcwkEmk.exe
  C:\Windows\System\TcwkEmk.exe
  2⤵
  PID:5276
- C:\Windows\System\VnlQMZB.exe
  C:\Windows\System\VnlQMZB.exe
  2⤵
  PID:5296
- C:\Windows\System\fdTXReg.exe
  C:\Windows\System\fdTXReg.exe
  2⤵
  PID:5316
- C:\Windows\System\qHhecne.exe
  C:\Windows\System\qHhecne.exe
  2⤵
  PID:5332
- C:\Windows\System\XBgwCbz.exe
  C:\Windows\System\XBgwCbz.exe
  2⤵
  PID:5356
- C:\Windows\System\gEeQRYI.exe
  C:\Windows\System\gEeQRYI.exe
  2⤵
  PID:5376
- C:\Windows\System\hIKIBQa.exe
  C:\Windows\System\hIKIBQa.exe
  2⤵
  PID:5396
- C:\Windows\System\UuugzoY.exe
  C:\Windows\System\UuugzoY.exe
  2⤵
  PID:5424
- C:\Windows\System\bwcJvSr.exe
  C:\Windows\System\bwcJvSr.exe
  2⤵
  PID:5444
- C:\Windows\System\ppJgxsL.exe
  C:\Windows\System\ppJgxsL.exe
  2⤵
  PID:5464
- C:\Windows\System\feOQHKK.exe
  C:\Windows\System\feOQHKK.exe
  2⤵
  PID:5484
- C:\Windows\System\HrmRWJh.exe
  C:\Windows\System\HrmRWJh.exe
  2⤵
  PID:5692
- C:\Windows\System\fsawYqL.exe
  C:\Windows\System\fsawYqL.exe
  2⤵
  PID:5708
- C:\Windows\System\zIPwWiu.exe
  C:\Windows\System\zIPwWiu.exe
  2⤵
  PID:5728
- C:\Windows\System\muNdkys.exe
  C:\Windows\System\muNdkys.exe
  2⤵
  PID:5752
- C:\Windows\System\chRziDn.exe
  C:\Windows\System\chRziDn.exe
  2⤵
  PID:5776
- C:\Windows\System\wAOkXMP.exe
  C:\Windows\System\wAOkXMP.exe
  2⤵
  PID:5792
- C:\Windows\System\RiPJqPT.exe
  C:\Windows\System\RiPJqPT.exe
  2⤵
  PID:5816
- C:\Windows\System\sxmNyIN.exe
  C:\Windows\System\sxmNyIN.exe
  2⤵
  PID:5836
- C:\Windows\System\fZZyTyK.exe
  C:\Windows\System\fZZyTyK.exe
  2⤵
  PID:5860
- C:\Windows\System\YuFgURS.exe
  C:\Windows\System\YuFgURS.exe
  2⤵
  PID:5880
- C:\Windows\System\HrUnams.exe
  C:\Windows\System\HrUnams.exe
  2⤵
  PID:5904
- C:\Windows\System\KrGvIdl.exe
  C:\Windows\System\KrGvIdl.exe
  2⤵
  PID:5924
- C:\Windows\System\WIRgFtp.exe
  C:\Windows\System\WIRgFtp.exe
  2⤵
  PID:5944
- C:\Windows\System\XdsZmBS.exe
  C:\Windows\System\XdsZmBS.exe
  2⤵
  PID:5964
- C:\Windows\System\DBokxnp.exe
  C:\Windows\System\DBokxnp.exe
  2⤵
  PID:5988
- C:\Windows\System\ayquYNY.exe
  C:\Windows\System\ayquYNY.exe
  2⤵
  PID:6008
- C:\Windows\System\gHLeaCn.exe
  C:\Windows\System\gHLeaCn.exe
  2⤵
  PID:6024
- C:\Windows\System\ATzKvJZ.exe
  C:\Windows\System\ATzKvJZ.exe
  2⤵
  PID:6132
- C:\Windows\System\IhsCezb.exe
  C:\Windows\System\IhsCezb.exe
  2⤵
  PID:2356
- C:\Windows\System\iDaqXEW.exe
  C:\Windows\System\iDaqXEW.exe
  2⤵
  PID:2976
- C:\Windows\System\ncjecgL.exe
  C:\Windows\System\ncjecgL.exe
  2⤵
  PID:3212
- C:\Windows\System\PYNdXYu.exe
  C:\Windows\System\PYNdXYu.exe
  2⤵
  PID:4364
- C:\Windows\System\PNkbJQa.exe
  C:\Windows\System\PNkbJQa.exe
  2⤵
  PID:4928
- C:\Windows\System\ACUkhhL.exe
  C:\Windows\System\ACUkhhL.exe
  2⤵
  PID:5268
- C:\Windows\System\OLjQXvi.exe
  C:\Windows\System\OLjQXvi.exe
  2⤵
  PID:5456
- C:\Windows\System\upcBcDX.exe
  C:\Windows\System\upcBcDX.exe
  2⤵
  PID:5984
- C:\Windows\System\yAsCsmD.exe
  C:\Windows\System\yAsCsmD.exe
  2⤵
  PID:5736
- C:\Windows\System\LNuFYbE.exe
  C:\Windows\System\LNuFYbE.exe
  2⤵
  PID:5788
- C:\Windows\System\AchmPCg.exe
  C:\Windows\System\AchmPCg.exe
  2⤵
  PID:5832
- C:\Windows\System\WHtCcUc.exe
  C:\Windows\System\WHtCcUc.exe
  2⤵
  PID:5872
- C:\Windows\System\kPkjPyQ.exe
  C:\Windows\System\kPkjPyQ.exe
  2⤵
  PID:5916
- C:\Windows\System\opcuAEp.exe
  C:\Windows\System\opcuAEp.exe
  2⤵
  PID:6000
- C:\Windows\System\IXsGXID.exe
  C:\Windows\System\IXsGXID.exe
  2⤵
  PID:6036
- C:\Windows\System\aIndSed.exe
  C:\Windows\System\aIndSed.exe
  2⤵
  PID:1752
- C:\Windows\System\cvHZpkm.exe
  C:\Windows\System\cvHZpkm.exe
  2⤵
  PID:3328
- C:\Windows\System\AkCtqSw.exe
  C:\Windows\System\AkCtqSw.exe
  2⤵
  PID:6124
- C:\Windows\System\PuofPTv.exe
  C:\Windows\System\PuofPTv.exe
  2⤵
  PID:4748
- C:\Windows\System\uQrVkNr.exe
  C:\Windows\System\uQrVkNr.exe
  2⤵
  PID:4276
- C:\Windows\System\vqrcTUm.exe
  C:\Windows\System\vqrcTUm.exe
  2⤵
  PID:4412
- C:\Windows\System\pTrNpXI.exe
  C:\Windows\System\pTrNpXI.exe
  2⤵
  PID:2184
- C:\Windows\System\qRfZTxo.exe
  C:\Windows\System\qRfZTxo.exe
  2⤵
  PID:4532
- C:\Windows\System\OSsdRkn.exe
  C:\Windows\System\OSsdRkn.exe
  2⤵
  PID:2440
- C:\Windows\System\EIPFwrt.exe
  C:\Windows\System\EIPFwrt.exe
  2⤵
  PID:5136
- C:\Windows\System\GALwwPj.exe
  C:\Windows\System\GALwwPj.exe
  2⤵
  PID:5436
- C:\Windows\System\mHBxZHl.exe
  C:\Windows\System\mHBxZHl.exe
  2⤵
  PID:5624
- C:\Windows\System\DnLxkub.exe
  C:\Windows\System\DnLxkub.exe
  2⤵
  PID:5664
- C:\Windows\System\wtRelyf.exe
  C:\Windows\System\wtRelyf.exe
  2⤵
  PID:1900
- C:\Windows\System\fguCFvE.exe
  C:\Windows\System\fguCFvE.exe
  2⤵
  PID:3304
- C:\Windows\System\lqSLobj.exe
  C:\Windows\System\lqSLobj.exe
  2⤵
  PID:3532
- C:\Windows\System\pMWVIIk.exe
  C:\Windows\System\pMWVIIk.exe
  2⤵
  PID:4432
- C:\Windows\System\DigIABw.exe
  C:\Windows\System\DigIABw.exe
  2⤵
  PID:4336
- C:\Windows\System\QZfDWzs.exe
  C:\Windows\System\QZfDWzs.exe
  2⤵
  PID:3316
- C:\Windows\System\sTJPTgF.exe
  C:\Windows\System\sTJPTgF.exe
  2⤵
  PID:3880
- C:\Windows\System\iHqUmQL.exe
  C:\Windows\System\iHqUmQL.exe
  2⤵
  PID:4788
- C:\Windows\System\lDPJWFa.exe
  C:\Windows\System\lDPJWFa.exe
  2⤵
  PID:4136
- C:\Windows\System\llcylNm.exe
  C:\Windows\System\llcylNm.exe
  2⤵
  PID:1060
- C:\Windows\System\apJCASf.exe
  C:\Windows\System\apJCASf.exe
  2⤵
  PID:3348
- C:\Windows\System\yLUdMrM.exe
  C:\Windows\System\yLUdMrM.exe
  2⤵
  PID:5812
- C:\Windows\System\xwmWEFK.exe
  C:\Windows\System\xwmWEFK.exe
  2⤵
  PID:5092
- C:\Windows\System\aCyUYcy.exe
  C:\Windows\System\aCyUYcy.exe
  2⤵
  PID:5764
- C:\Windows\System\wouxXlJ.exe
  C:\Windows\System\wouxXlJ.exe
  2⤵
  PID:6084
- C:\Windows\System\ePVnRLE.exe
  C:\Windows\System\ePVnRLE.exe
  2⤵
  PID:2632
- C:\Windows\System\qciQcqd.exe
  C:\Windows\System\qciQcqd.exe
  2⤵
  PID:5648
- C:\Windows\System\hUuuiFu.exe
  C:\Windows\System\hUuuiFu.exe
  2⤵
  PID:3684
- C:\Windows\System\WFrMLYe.exe
  C:\Windows\System\WFrMLYe.exe
  2⤵
  PID:5540
- C:\Windows\System\KgfyJws.exe
  C:\Windows\System\KgfyJws.exe
  2⤵
  PID:3824
- C:\Windows\System\jEeKkqE.exe
  C:\Windows\System\jEeKkqE.exe
  2⤵
  PID:6100
- C:\Windows\System\DHnITFc.exe
  C:\Windows\System\DHnITFc.exe
  2⤵
  PID:3636
- C:\Windows\System\LzntmwV.exe
  C:\Windows\System\LzntmwV.exe
  2⤵
  PID:4460
- C:\Windows\System\fZCEJvm.exe
  C:\Windows\System\fZCEJvm.exe
  2⤵
  PID:5804
- C:\Windows\System\jZjwLVy.exe
  C:\Windows\System\jZjwLVy.exe
  2⤵
  PID:2564
- C:\Windows\System\IVvtzZx.exe
  C:\Windows\System\IVvtzZx.exe
  2⤵
  PID:6152
- C:\Windows\System\QFneuSd.exe
  C:\Windows\System\QFneuSd.exe
  2⤵
  PID:6180
- C:\Windows\System\vVUnWQk.exe
  C:\Windows\System\vVUnWQk.exe
  2⤵
  PID:6200
- C:\Windows\System\XVfxdnN.exe
  C:\Windows\System\XVfxdnN.exe
  2⤵
  PID:6228
- C:\Windows\System\wPmGclS.exe
  C:\Windows\System\wPmGclS.exe
  2⤵
  PID:6252
- C:\Windows\System\wqeeHIE.exe
  C:\Windows\System\wqeeHIE.exe
  2⤵
  PID:6276
- C:\Windows\System\tRaeUmN.exe
  C:\Windows\System\tRaeUmN.exe
  2⤵
  PID:6304
- C:\Windows\System\KSzwPeq.exe
  C:\Windows\System\KSzwPeq.exe
  2⤵
  PID:6320
- C:\Windows\System\TFkmOwG.exe
  C:\Windows\System\TFkmOwG.exe
  2⤵
  PID:6344
- C:\Windows\System\iBXOGfa.exe
  C:\Windows\System\iBXOGfa.exe
  2⤵
  PID:6376
- C:\Windows\System\xvOVPIF.exe
  C:\Windows\System\xvOVPIF.exe
  2⤵
  PID:6404
- C:\Windows\System\TqhnkWv.exe
  C:\Windows\System\TqhnkWv.exe
  2⤵
  PID:6424
- C:\Windows\System\xbJtlUA.exe
  C:\Windows\System\xbJtlUA.exe
  2⤵
  PID:6452
- C:\Windows\System\BMqXrtX.exe
  C:\Windows\System\BMqXrtX.exe
  2⤵
  PID:6468
- C:\Windows\System\PAqknpV.exe
  C:\Windows\System\PAqknpV.exe
  2⤵
  PID:6496
- C:\Windows\System\zxkyvpC.exe
  C:\Windows\System\zxkyvpC.exe
  2⤵
  PID:6512
- C:\Windows\System\LIsUiiW.exe
  C:\Windows\System\LIsUiiW.exe
  2⤵
  PID:6540
- C:\Windows\System\DDryeRp.exe
  C:\Windows\System\DDryeRp.exe
  2⤵
  PID:6560
- C:\Windows\System\biVYtzS.exe
  C:\Windows\System\biVYtzS.exe
  2⤵
  PID:6588
- C:\Windows\System\IqIrdxB.exe
  C:\Windows\System\IqIrdxB.exe
  2⤵
  PID:6612
- C:\Windows\System\wYhywxs.exe
  C:\Windows\System\wYhywxs.exe
  2⤵
  PID:6640
- C:\Windows\System\hLsApOW.exe
  C:\Windows\System\hLsApOW.exe
  2⤵
  PID:6660
- C:\Windows\System\Mtjfarn.exe
  C:\Windows\System\Mtjfarn.exe
  2⤵
  PID:6696
- C:\Windows\System\kAWWFAk.exe
  C:\Windows\System\kAWWFAk.exe
  2⤵
  PID:6716
- C:\Windows\System\tDJnKoU.exe
  C:\Windows\System\tDJnKoU.exe
  2⤵
  PID:6740
- C:\Windows\System\POUGgQH.exe
  C:\Windows\System\POUGgQH.exe
  2⤵
  PID:6760
- C:\Windows\System\BBKwkBC.exe
  C:\Windows\System\BBKwkBC.exe
  2⤵
  PID:6780
- C:\Windows\System\OmfDMEi.exe
  C:\Windows\System\OmfDMEi.exe
  2⤵
  PID:6804
- C:\Windows\System\XkZCwJx.exe
  C:\Windows\System\XkZCwJx.exe
  2⤵
  PID:6828
- C:\Windows\System\tkzFOob.exe
  C:\Windows\System\tkzFOob.exe
  2⤵
  PID:6848
- C:\Windows\System\ijiPcre.exe
  C:\Windows\System\ijiPcre.exe
  2⤵
  PID:6868
- C:\Windows\System\KyJINrh.exe
  C:\Windows\System\KyJINrh.exe
  2⤵
  PID:6888
- C:\Windows\System\SBwYoOM.exe
  C:\Windows\System\SBwYoOM.exe
  2⤵
  PID:6908
- C:\Windows\System\VIkYQkx.exe
  C:\Windows\System\VIkYQkx.exe
  2⤵
  PID:6928
- C:\Windows\System\XPvnuiO.exe
  C:\Windows\System\XPvnuiO.exe
  2⤵
  PID:6956
- C:\Windows\System\hzZVFrm.exe
  C:\Windows\System\hzZVFrm.exe
  2⤵
  PID:6972
- C:\Windows\System\PUahZFD.exe
  C:\Windows\System\PUahZFD.exe
  2⤵
  PID:7000
- C:\Windows\System\dasSdZg.exe
  C:\Windows\System\dasSdZg.exe
  2⤵
  PID:7024
- C:\Windows\System\YCbtRcc.exe
  C:\Windows\System\YCbtRcc.exe
  2⤵
  PID:7048
- C:\Windows\System\qwEhOpl.exe
  C:\Windows\System\qwEhOpl.exe
  2⤵
  PID:7080
- C:\Windows\System\GTdWDiI.exe
  C:\Windows\System\GTdWDiI.exe
  2⤵
  PID:7100
- C:\Windows\System\XdABkZm.exe
  C:\Windows\System\XdABkZm.exe
  2⤵
  PID:7128
- C:\Windows\System\DtPeJxr.exe
  C:\Windows\System\DtPeJxr.exe
  2⤵
  PID:7148
- C:\Windows\System\EeOFBdD.exe
  C:\Windows\System\EeOFBdD.exe
  2⤵
  PID:2316
- C:\Windows\System\JECpOGb.exe
  C:\Windows\System\JECpOGb.exe
  2⤵
  PID:1028
- C:\Windows\System\gGWYGWr.exe
  C:\Windows\System\gGWYGWr.exe
  2⤵
  PID:3480
- C:\Windows\System\LlOIIYr.exe
  C:\Windows\System\LlOIIYr.exe
  2⤵
  PID:3972
- C:\Windows\System\IEtBshe.exe
  C:\Windows\System\IEtBshe.exe
  2⤵
  PID:6160
- C:\Windows\System\OpTcsxK.exe
  C:\Windows\System\OpTcsxK.exe
  2⤵
  PID:6220
- C:\Windows\System\FUpDawX.exe
  C:\Windows\System\FUpDawX.exe
  2⤵
  PID:3192
- C:\Windows\System\pOpDDah.exe
  C:\Windows\System\pOpDDah.exe
  2⤵
  PID:5724
- C:\Windows\System\kEtwvns.exe
  C:\Windows\System\kEtwvns.exe
  2⤵
  PID:5432
- C:\Windows\System\OijeMwN.exe
  C:\Windows\System\OijeMwN.exe
  2⤵
  PID:6488
- C:\Windows\System\LdlVsML.exe
  C:\Windows\System\LdlVsML.exe
  2⤵
  PID:6328
- C:\Windows\System\qdAEzuF.exe
  C:\Windows\System\qdAEzuF.exe
  2⤵
  PID:6392
- C:\Windows\System\okYCxvG.exe
  C:\Windows\System\okYCxvG.exe
  2⤵
  PID:6732
- C:\Windows\System\ltVLdqb.exe
  C:\Windows\System\ltVLdqb.exe
  2⤵
  PID:6216
- C:\Windows\System\lFFpImS.exe
  C:\Windows\System\lFFpImS.exe
  2⤵
  PID:6800
- C:\Windows\System\gWIefNz.exe
  C:\Windows\System\gWIefNz.exe
  2⤵
  PID:6504
- C:\Windows\System\JDHRjLL.exe
  C:\Windows\System\JDHRjLL.exe
  2⤵
  PID:6904
- C:\Windows\System\TayEPQv.exe
  C:\Windows\System\TayEPQv.exe
  2⤵
  PID:6364
- C:\Windows\System\sJQnRrn.exe
  C:\Windows\System\sJQnRrn.exe
  2⤵
  PID:6624
- C:\Windows\System\DhgtmqM.exe
  C:\Windows\System\DhgtmqM.exe
  2⤵
  PID:6676
- C:\Windows\System\mVEpZKR.exe
  C:\Windows\System\mVEpZKR.exe
  2⤵
  PID:7020
- C:\Windows\System\mZfmAnl.exe
  C:\Windows\System\mZfmAnl.exe
  2⤵
  PID:7092
- C:\Windows\System\lCRPqVf.exe
  C:\Windows\System\lCRPqVf.exe
  2⤵
  PID:6860
- C:\Windows\System\SIkoNCE.exe
  C:\Windows\System\SIkoNCE.exe
  2⤵
  PID:7180
- C:\Windows\System\xGlwMuG.exe
  C:\Windows\System\xGlwMuG.exe
  2⤵
  PID:7208
- C:\Windows\System\FrrUdNq.exe
  C:\Windows\System\FrrUdNq.exe
  2⤵
  PID:7228
- C:\Windows\System\QXpRCpW.exe
  C:\Windows\System\QXpRCpW.exe
  2⤵
  PID:7252
- C:\Windows\System\QcoWUoJ.exe
  C:\Windows\System\QcoWUoJ.exe
  2⤵
  PID:7276
- C:\Windows\System\usGeSUU.exe
  C:\Windows\System\usGeSUU.exe
  2⤵
  PID:7296
- C:\Windows\System\BXwmbMl.exe
  C:\Windows\System\BXwmbMl.exe
  2⤵
  PID:7320
- C:\Windows\System\PcvtbPd.exe
  C:\Windows\System\PcvtbPd.exe
  2⤵
  PID:7340
- C:\Windows\System\SIiHNfb.exe
  C:\Windows\System\SIiHNfb.exe
  2⤵
  PID:7364
- C:\Windows\System\jJUVNiU.exe
  C:\Windows\System\jJUVNiU.exe
  2⤵
  PID:7392
- C:\Windows\System\HsZLUzp.exe
  C:\Windows\System\HsZLUzp.exe
  2⤵
  PID:7408
- C:\Windows\System\EikhlPX.exe
  C:\Windows\System\EikhlPX.exe
  2⤵
  PID:7432
- C:\Windows\System\QsBOmkZ.exe
  C:\Windows\System\QsBOmkZ.exe
  2⤵
  PID:7452
- C:\Windows\System\GbJCeWN.exe
  C:\Windows\System\GbJCeWN.exe
  2⤵
  PID:7476
- C:\Windows\System\MVmprQW.exe
  C:\Windows\System\MVmprQW.exe
  2⤵
  PID:7496
- C:\Windows\System\vFgTPjC.exe
  C:\Windows\System\vFgTPjC.exe
  2⤵
  PID:7516
- C:\Windows\System\cwqyWuY.exe
  C:\Windows\System\cwqyWuY.exe
  2⤵
  PID:7544
- C:\Windows\System\EDWnOCH.exe
  C:\Windows\System\EDWnOCH.exe
  2⤵
  PID:7572
- C:\Windows\System\QQYltOe.exe
  C:\Windows\System\QQYltOe.exe
  2⤵
  PID:7600
- C:\Windows\System\oWtTDvM.exe
  C:\Windows\System\oWtTDvM.exe
  2⤵
  PID:7620
- C:\Windows\System\MvstsCH.exe
  C:\Windows\System\MvstsCH.exe
  2⤵
  PID:7644
- C:\Windows\System\nfgzQFD.exe
  C:\Windows\System\nfgzQFD.exe
  2⤵
  PID:7664
- C:\Windows\System\nMFINRv.exe
  C:\Windows\System\nMFINRv.exe
  2⤵
  PID:7688
- C:\Windows\System\lmsdDgm.exe
  C:\Windows\System\lmsdDgm.exe
  2⤵
  PID:7708
- C:\Windows\System\fPKBDAk.exe
  C:\Windows\System\fPKBDAk.exe
  2⤵
  PID:7732
- C:\Windows\System\fVyOmao.exe
  C:\Windows\System\fVyOmao.exe
  2⤵
  PID:7752
- C:\Windows\System\FNHuQfa.exe
  C:\Windows\System\FNHuQfa.exe
  2⤵
  PID:7776
- C:\Windows\System\MNFzJIk.exe
  C:\Windows\System\MNFzJIk.exe
  2⤵
  PID:7796
- C:\Windows\System\DMQirNd.exe
  C:\Windows\System\DMQirNd.exe
  2⤵
  PID:7812
- C:\Windows\System\YTgKkia.exe
  C:\Windows\System\YTgKkia.exe
  2⤵
  PID:7832
- C:\Windows\System\QifSvXd.exe
  C:\Windows\System\QifSvXd.exe
  2⤵
  PID:7856
- C:\Windows\System\vMzhDnY.exe
  C:\Windows\System\vMzhDnY.exe
  2⤵
  PID:7884
- C:\Windows\System\gFnfAwc.exe
  C:\Windows\System\gFnfAwc.exe
  2⤵
  PID:7904
- C:\Windows\System\omKdCso.exe
  C:\Windows\System\omKdCso.exe
  2⤵
  PID:7932
- C:\Windows\System\MJNXwCG.exe
  C:\Windows\System\MJNXwCG.exe
  2⤵
  PID:7952
- C:\Windows\System\dBveZVf.exe
  C:\Windows\System\dBveZVf.exe
  2⤵
  PID:7980
- C:\Windows\System\StpiJvS.exe
  C:\Windows\System\StpiJvS.exe
  2⤵
  PID:7996
- C:\Windows\System\ydTuQTh.exe
  C:\Windows\System\ydTuQTh.exe
  2⤵
  PID:8020
- C:\Windows\System\bJqaEqd.exe
  C:\Windows\System\bJqaEqd.exe
  2⤵
  PID:8048
- C:\Windows\System\YwywarP.exe
  C:\Windows\System\YwywarP.exe
  2⤵
  PID:8072
- C:\Windows\System\gmlwIqR.exe
  C:\Windows\System\gmlwIqR.exe
  2⤵
  PID:8092
- C:\Windows\System\bIXHOxz.exe
  C:\Windows\System\bIXHOxz.exe
  2⤵
  PID:8120
- C:\Windows\System\dzSRYJZ.exe
  C:\Windows\System\dzSRYJZ.exe
  2⤵
  PID:8140
- C:\Windows\System\CItFPEK.exe
  C:\Windows\System\CItFPEK.exe
  2⤵
  PID:8160
- C:\Windows\System\ymdFNdc.exe
  C:\Windows\System\ymdFNdc.exe
  2⤵
  PID:8188
- C:\Windows\System\jWpSNDY.exe
  C:\Windows\System\jWpSNDY.exe
  2⤵
  PID:5588
- C:\Windows\System\foNjiGq.exe
  C:\Windows\System\foNjiGq.exe
  2⤵
  PID:6656
- C:\Windows\System\jMrelBa.exe
  C:\Windows\System\jMrelBa.exe
  2⤵
  PID:6312
- C:\Windows\System\YXmckhM.exe
  C:\Windows\System\YXmckhM.exe
  2⤵
  PID:6580
- C:\Windows\System\EirOyDX.exe
  C:\Windows\System\EirOyDX.exe
  2⤵
  PID:7116
- C:\Windows\System\OOsearX.exe
  C:\Windows\System\OOsearX.exe
  2⤵
  PID:7144
- C:\Windows\System\eleSwoV.exe
  C:\Windows\System\eleSwoV.exe
  2⤵
  PID:6636
- C:\Windows\System\BnLmxir.exe
  C:\Windows\System\BnLmxir.exe
  2⤵
  PID:6844
- C:\Windows\System\JZfFHIq.exe
  C:\Windows\System\JZfFHIq.exe
  2⤵
  PID:6244
- C:\Windows\System\iOSwnDc.exe
  C:\Windows\System\iOSwnDc.exe
  2⤵
  PID:6992
- C:\Windows\System\POYVcvU.exe
  C:\Windows\System\POYVcvU.exe
  2⤵
  PID:7312
- C:\Windows\System\GBakUxd.exe
  C:\Windows\System\GBakUxd.exe
  2⤵
  PID:6440
- C:\Windows\System\cQkDspP.exe
  C:\Windows\System\cQkDspP.exe
  2⤵
  PID:7400
- C:\Windows\System\gdBbmJp.exe
  C:\Windows\System\gdBbmJp.exe
  2⤵
  PID:6756
- C:\Windows\System\OmLBXOd.exe
  C:\Windows\System\OmLBXOd.exe
  2⤵
  PID:7628
- C:\Windows\System\ZISVLrc.exe
  C:\Windows\System\ZISVLrc.exe
  2⤵
  PID:7656
- C:\Windows\System\wqqQxzB.exe
  C:\Windows\System\wqqQxzB.exe
  2⤵
  PID:6192
- C:\Windows\System\VcGeMuv.exe
  C:\Windows\System\VcGeMuv.exe
  2⤵
  PID:7804
- C:\Windows\System\dlDXoyD.exe
  C:\Windows\System\dlDXoyD.exe
  2⤵
  PID:7900
- C:\Windows\System\NhdTirW.exe
  C:\Windows\System\NhdTirW.exe
  2⤵
  PID:7352
- C:\Windows\System\VHdODyI.exe
  C:\Windows\System\VHdODyI.exe
  2⤵
  PID:8128
- C:\Windows\System\uRlEogo.exe
  C:\Windows\System\uRlEogo.exe
  2⤵
  PID:7508
- C:\Windows\System\xjuLvLG.exe
  C:\Windows\System\xjuLvLG.exe
  2⤵
  PID:4328
- C:\Windows\System\laMHtnt.exe
  C:\Windows\System\laMHtnt.exe
  2⤵
  PID:8216
- C:\Windows\System\YjJeLiK.exe
  C:\Windows\System\YjJeLiK.exe
  2⤵
  PID:8240
- C:\Windows\System\ssHjshd.exe
  C:\Windows\System\ssHjshd.exe
  2⤵
  PID:8260
- C:\Windows\System\MUMWaFS.exe
  C:\Windows\System\MUMWaFS.exe
  2⤵
  PID:8292
- C:\Windows\System\PiGfpBE.exe
  C:\Windows\System\PiGfpBE.exe
  2⤵
  PID:8308
- C:\Windows\System\coeLaXq.exe
  C:\Windows\System\coeLaXq.exe
  2⤵
  PID:8328
- C:\Windows\System\mCdSoNQ.exe
  C:\Windows\System\mCdSoNQ.exe
  2⤵
  PID:8352
- C:\Windows\System\sQVmKmM.exe
  C:\Windows\System\sQVmKmM.exe
  2⤵
  PID:8376
- C:\Windows\System\LHDAJHa.exe
  C:\Windows\System\LHDAJHa.exe
  2⤵
  PID:8400
- C:\Windows\System\tBvBbmK.exe
  C:\Windows\System\tBvBbmK.exe
  2⤵
  PID:8420
- C:\Windows\System\ztjajUC.exe
  C:\Windows\System\ztjajUC.exe
  2⤵
  PID:8444
- C:\Windows\System\MUiNJzu.exe
  C:\Windows\System\MUiNJzu.exe
  2⤵
  PID:8464
- C:\Windows\System\NXjlGsh.exe
  C:\Windows\System\NXjlGsh.exe
  2⤵
  PID:8492
- C:\Windows\System\ZInnuZC.exe
  C:\Windows\System\ZInnuZC.exe
  2⤵
  PID:8512
- C:\Windows\System\gdTKgnL.exe
  C:\Windows\System\gdTKgnL.exe
  2⤵
  PID:8536
- C:\Windows\System\lUGJdeW.exe
  C:\Windows\System\lUGJdeW.exe
  2⤵
  PID:8556
- C:\Windows\System\BUovlPD.exe
  C:\Windows\System\BUovlPD.exe
  2⤵
  PID:8580
- C:\Windows\System\tSrdaVw.exe
  C:\Windows\System\tSrdaVw.exe
  2⤵
  PID:8604
- C:\Windows\System\XcHyDYm.exe
  C:\Windows\System\XcHyDYm.exe
  2⤵
  PID:8628
- C:\Windows\System\rsNdzDn.exe
  C:\Windows\System\rsNdzDn.exe
  2⤵
  PID:8648
- C:\Windows\System\tWqRMlS.exe
  C:\Windows\System\tWqRMlS.exe
  2⤵
  PID:8672
- C:\Windows\System\JGUwrYG.exe
  C:\Windows\System\JGUwrYG.exe
  2⤵
  PID:8700
- C:\Windows\System\bTvgFAl.exe
  C:\Windows\System\bTvgFAl.exe
  2⤵
  PID:8720
- C:\Windows\System\VOVKocR.exe
  C:\Windows\System\VOVKocR.exe
  2⤵
  PID:8740
- C:\Windows\System\BxdAiJl.exe
  C:\Windows\System\BxdAiJl.exe
  2⤵
  PID:8760
- C:\Windows\System\OloaIAi.exe
  C:\Windows\System\OloaIAi.exe
  2⤵
  PID:8784
- C:\Windows\System\oWFBdIe.exe
  C:\Windows\System\oWFBdIe.exe
  2⤵
  PID:8804
- C:\Windows\System\llWoogd.exe
  C:\Windows\System\llWoogd.exe
  2⤵
  PID:8824
- C:\Windows\System\lIgNUxM.exe
  C:\Windows\System\lIgNUxM.exe
  2⤵
  PID:8844
- C:\Windows\System\pYiSmnG.exe
  C:\Windows\System\pYiSmnG.exe
  2⤵
  PID:8864
- C:\Windows\System\JjNEMWc.exe
  C:\Windows\System\JjNEMWc.exe
  2⤵
  PID:8888
- C:\Windows\System\DCkjVBz.exe
  C:\Windows\System\DCkjVBz.exe
  2⤵
  PID:8904
- C:\Windows\System\pzuDWzB.exe
  C:\Windows\System\pzuDWzB.exe
  2⤵
  PID:8932
- C:\Windows\System\TXEBPYn.exe
  C:\Windows\System\TXEBPYn.exe
  2⤵
  PID:8956
- C:\Windows\System\ptWPhgr.exe
  C:\Windows\System\ptWPhgr.exe
  2⤵
  PID:8976
- C:\Windows\System\BRFOeHb.exe
  C:\Windows\System\BRFOeHb.exe
  2⤵
  PID:9004
- C:\Windows\System\wFoxsdZ.exe
  C:\Windows\System\wFoxsdZ.exe
  2⤵
  PID:9028
- C:\Windows\System\PPusbvv.exe
  C:\Windows\System\PPusbvv.exe
  2⤵
  PID:9048
- C:\Windows\System\VobsMHu.exe
  C:\Windows\System\VobsMHu.exe
  2⤵
  PID:9072
- C:\Windows\System\uFjrtjx.exe
  C:\Windows\System\uFjrtjx.exe
  2⤵
  PID:9100
- C:\Windows\System\qeepaOZ.exe
  C:\Windows\System\qeepaOZ.exe
  2⤵
  PID:9116
- C:\Windows\System\GRMODhp.exe
  C:\Windows\System\GRMODhp.exe
  2⤵
  PID:9148
- C:\Windows\System\bqmVgUm.exe
  C:\Windows\System\bqmVgUm.exe
  2⤵
  PID:9180
- C:\Windows\System\dhVsidH.exe
  C:\Windows\System\dhVsidH.exe
  2⤵
  PID:9204
- C:\Windows\System\eIAiSqS.exe
  C:\Windows\System\eIAiSqS.exe
  2⤵
  PID:6284
- C:\Windows\System\mcnBMYW.exe
  C:\Windows\System\mcnBMYW.exe
  2⤵
  PID:7580
- C:\Windows\System\ijyNBtX.exe
  C:\Windows\System\ijyNBtX.exe
  2⤵
  PID:7584
- C:\Windows\System\AlRmjdA.exe
  C:\Windows\System\AlRmjdA.exe
  2⤵
  PID:7008
- C:\Windows\System\hzLoGIO.exe
  C:\Windows\System\hzLoGIO.exe
  2⤵
  PID:6260
- C:\Windows\System\JDWDnIo.exe
  C:\Windows\System\JDWDnIo.exe
  2⤵
  PID:7200
- C:\Windows\System\FGRqtCO.exe
  C:\Windows\System\FGRqtCO.exe
  2⤵
  PID:7728
- C:\Windows\System\hIzyBXg.exe
  C:\Windows\System\hIzyBXg.exe
  2⤵
  PID:7444
- C:\Windows\System\rUpAlsa.exe
  C:\Windows\System\rUpAlsa.exe
  2⤵
  PID:7864
- C:\Windows\System\xVTOisf.exe
  C:\Windows\System\xVTOisf.exe
  2⤵
  PID:7304
- C:\Windows\System\YutgKWF.exe
  C:\Windows\System\YutgKWF.exe
  2⤵
  PID:6968
- C:\Windows\System\iyAYGfV.exe
  C:\Windows\System\iyAYGfV.exe
  2⤵
  PID:8112
- C:\Windows\System\cSWeAVc.exe
  C:\Windows\System\cSWeAVc.exe
  2⤵
  PID:8156
- C:\Windows\System\etMRaGx.exe
  C:\Windows\System\etMRaGx.exe
  2⤵
  PID:8232
- C:\Windows\System\GRTfsGM.exe
  C:\Windows\System\GRTfsGM.exe
  2⤵
  PID:8316
- C:\Windows\System\dkqpHfy.exe
  C:\Windows\System\dkqpHfy.exe
  2⤵
  PID:8360
- C:\Windows\System\rPKlBcM.exe
  C:\Windows\System\rPKlBcM.exe
  2⤵
  PID:8408
- C:\Windows\System\qGoohHj.exe
  C:\Windows\System\qGoohHj.exe
  2⤵
  PID:7700
- C:\Windows\System\WcneZaR.exe
  C:\Windows\System\WcneZaR.exe
  2⤵
  PID:8548
- C:\Windows\System\gOnKRme.exe
  C:\Windows\System\gOnKRme.exe
  2⤵
  PID:7784
- C:\Windows\System\PPystgu.exe
  C:\Windows\System\PPystgu.exe
  2⤵
  PID:8656
- C:\Windows\System\LkKkleK.exe
  C:\Windows\System\LkKkleK.exe
  2⤵
  PID:9228
- C:\Windows\System\iJEnpvd.exe
  C:\Windows\System\iJEnpvd.exe
  2⤵
  PID:9256
- C:\Windows\System\tiaROPB.exe
  C:\Windows\System\tiaROPB.exe
  2⤵
  PID:9280
- C:\Windows\System\MxHQOev.exe
  C:\Windows\System\MxHQOev.exe
  2⤵
  PID:9304
- C:\Windows\System\QFjsuGo.exe
  C:\Windows\System\QFjsuGo.exe
  2⤵
  PID:9328
- C:\Windows\System\vtODLzK.exe
  C:\Windows\System\vtODLzK.exe
  2⤵
  PID:9348
- C:\Windows\System\bhEnPaB.exe
  C:\Windows\System\bhEnPaB.exe
  2⤵
  PID:9368
- C:\Windows\System\IRcHsrH.exe
  C:\Windows\System\IRcHsrH.exe
  2⤵
  PID:9392
- C:\Windows\System\HZROKRL.exe
  C:\Windows\System\HZROKRL.exe
  2⤵
  PID:9416
- C:\Windows\System\npPSfIf.exe
  C:\Windows\System\npPSfIf.exe
  2⤵
  PID:9436
- C:\Windows\System\YTouNvp.exe
  C:\Windows\System\YTouNvp.exe
  2⤵
  PID:9464
- C:\Windows\System\VzhXbdk.exe
  C:\Windows\System\VzhXbdk.exe
  2⤵
  PID:9484
- C:\Windows\System\jbjcScK.exe
  C:\Windows\System\jbjcScK.exe
  2⤵
  PID:9512
- C:\Windows\System\MfgOovK.exe
  C:\Windows\System\MfgOovK.exe
  2⤵
  PID:9536
- C:\Windows\System\fEQgeZi.exe
  C:\Windows\System\fEQgeZi.exe
  2⤵
  PID:9552
- C:\Windows\System\EoChOdk.exe
  C:\Windows\System\EoChOdk.exe
  2⤵
  PID:9580
- C:\Windows\System\EPPqAAL.exe
  C:\Windows\System\EPPqAAL.exe
  2⤵
  PID:9604
- C:\Windows\System\xLwghTe.exe
  C:\Windows\System\xLwghTe.exe
  2⤵
  PID:9624
- C:\Windows\System\hjPwtcj.exe
  C:\Windows\System\hjPwtcj.exe
  2⤵
  PID:9660
- C:\Windows\System\SzzWLSW.exe
  C:\Windows\System\SzzWLSW.exe
  2⤵
  PID:9680
- C:\Windows\System\xyIPAcU.exe
  C:\Windows\System\xyIPAcU.exe
  2⤵
  PID:9696
- C:\Windows\System\VHbQocW.exe
  C:\Windows\System\VHbQocW.exe
  2⤵
  PID:9724
- C:\Windows\System\ctIIGRW.exe
  C:\Windows\System\ctIIGRW.exe
  2⤵
  PID:9744
- C:\Windows\System\RYMHVth.exe
  C:\Windows\System\RYMHVth.exe
  2⤵
  PID:9764
- C:\Windows\System\XYohCRp.exe
  C:\Windows\System\XYohCRp.exe
  2⤵
  PID:9792
- C:\Windows\System\SRWMrTM.exe
  C:\Windows\System\SRWMrTM.exe
  2⤵
  PID:9812
- C:\Windows\System\zHlhSMi.exe
  C:\Windows\System\zHlhSMi.exe
  2⤵
  PID:9836
- C:\Windows\System\ddBuxpK.exe
  C:\Windows\System\ddBuxpK.exe
  2⤵
  PID:9856
- C:\Windows\System\jxUOeiN.exe
  C:\Windows\System\jxUOeiN.exe
  2⤵
  PID:9880
- C:\Windows\System\aOiXdag.exe
  C:\Windows\System\aOiXdag.exe
  2⤵
  PID:9896
- C:\Windows\System\DXTQkXv.exe
  C:\Windows\System\DXTQkXv.exe
  2⤵
  PID:9920
- C:\Windows\System\uYevtYk.exe
  C:\Windows\System\uYevtYk.exe
  2⤵
  PID:9944
- C:\Windows\System\HisDsoV.exe
  C:\Windows\System\HisDsoV.exe
  2⤵
  PID:9968
- C:\Windows\System\SJRbGfx.exe
  C:\Windows\System\SJRbGfx.exe
  2⤵
  PID:10000
- C:\Windows\System\tTNaffm.exe
  C:\Windows\System\tTNaffm.exe
  2⤵
  PID:10020
- C:\Windows\System\BITcqQo.exe
  C:\Windows\System\BITcqQo.exe
  2⤵
  PID:10044
- C:\Windows\System\ZgMSnqL.exe
  C:\Windows\System\ZgMSnqL.exe
  2⤵
  PID:10064
- C:\Windows\System\xmgYVwF.exe
  C:\Windows\System\xmgYVwF.exe
  2⤵
  PID:10084
- C:\Windows\System\PucImYo.exe
  C:\Windows\System\PucImYo.exe
  2⤵
  PID:10116
- C:\Windows\System\rqWirFS.exe
  C:\Windows\System\rqWirFS.exe
  2⤵
  PID:10132
- C:\Windows\System\JehsCRc.exe
  C:\Windows\System\JehsCRc.exe
  2⤵
  PID:10156
- C:\Windows\System\kvhomLf.exe
  C:\Windows\System\kvhomLf.exe
  2⤵
  PID:10184
- C:\Windows\System\TjsTtcf.exe
  C:\Windows\System\TjsTtcf.exe
  2⤵
  PID:10208
- C:\Windows\System\czLXKvu.exe
  C:\Windows\System\czLXKvu.exe
  2⤵
  PID:10228
- C:\Windows\System\xVWHyNu.exe
  C:\Windows\System\xVWHyNu.exe
  2⤵
  PID:8756
- C:\Windows\System\tKZVXPN.exe
  C:\Windows\System\tKZVXPN.exe
  2⤵
  PID:7988
- C:\Windows\System\bvvjmrk.exe
  C:\Windows\System\bvvjmrk.exe
  2⤵
  PID:8028
- C:\Windows\System\ODvSmeu.exe
  C:\Windows\System\ODvSmeu.exe
  2⤵
  PID:8876
- C:\Windows\System\xauvdHd.exe
  C:\Windows\System\xauvdHd.exe
  2⤵
  PID:8920
- C:\Windows\System\aIszmSw.exe
  C:\Windows\System\aIszmSw.exe
  2⤵
  PID:7428
- C:\Windows\System\ezPicSk.exe
  C:\Windows\System\ezPicSk.exe
  2⤵
  PID:8184
- C:\Windows\System\diBSNDV.exe
  C:\Windows\System\diBSNDV.exe
  2⤵
  PID:9060
- C:\Windows\System\oNYFLAw.exe
  C:\Windows\System\oNYFLAw.exe
  2⤵
  PID:8276
- C:\Windows\System\foeTLiI.exe
  C:\Windows\System\foeTLiI.exe
  2⤵
  PID:6556
- C:\Windows\System\bBZCAVN.exe
  C:\Windows\System\bBZCAVN.exe
  2⤵
  PID:7680
- C:\Windows\System\FrsLBJp.exe
  C:\Windows\System\FrsLBJp.exe
  2⤵
  PID:7332
- C:\Windows\System\vhyddwX.exe
  C:\Windows\System\vhyddwX.exe
  2⤵
  PID:8456
- C:\Windows\System\AGHUcLz.exe
  C:\Windows\System\AGHUcLz.exe
  2⤵
  PID:8576
- C:\Windows\System\hRGtlfo.exe
  C:\Windows\System\hRGtlfo.exe
  2⤵
  PID:8336
- C:\Windows\System\NqrkZLM.exe
  C:\Windows\System\NqrkZLM.exe
  2⤵
  PID:8668
- C:\Windows\System\dpifHxO.exe
  C:\Windows\System\dpifHxO.exe
  2⤵
  PID:9244
- C:\Windows\System\rIuyAjo.exe
  C:\Windows\System\rIuyAjo.exe
  2⤵
  PID:2996
- C:\Windows\System\cIiNGXn.exe
  C:\Windows\System\cIiNGXn.exe
  2⤵
  PID:9376
- C:\Windows\System\zIHVYOc.exe
  C:\Windows\System\zIHVYOc.exe
  2⤵
  PID:8812
- C:\Windows\System\FtLlViw.exe
  C:\Windows\System\FtLlViw.exe
  2⤵
  PID:9452
- C:\Windows\System\VoIQmCh.exe
  C:\Windows\System\VoIQmCh.exe
  2⤵
  PID:9548
- C:\Windows\System\ugIWhZX.exe
  C:\Windows\System\ugIWhZX.exe
  2⤵
  PID:9592
- C:\Windows\System\MiVQdeJ.exe
  C:\Windows\System\MiVQdeJ.exe
  2⤵
  PID:9668
- C:\Windows\System\JuCGWVn.exe
  C:\Windows\System\JuCGWVn.exe
  2⤵
  PID:9732
- C:\Windows\System\FtMnfEn.exe
  C:\Windows\System\FtMnfEn.exe
  2⤵
  PID:8996
- C:\Windows\System\SkSFkDP.exe
  C:\Windows\System\SkSFkDP.exe
  2⤵
  PID:10256
- C:\Windows\System\jmnyCFh.exe
  C:\Windows\System\jmnyCFh.exe
  2⤵
  PID:10276
- C:\Windows\System\mSAlbop.exe
  C:\Windows\System\mSAlbop.exe
  2⤵
  PID:10300
- C:\Windows\System\FwyruWI.exe
  C:\Windows\System\FwyruWI.exe
  2⤵
  PID:10324
- C:\Windows\System\zMPUPNm.exe
  C:\Windows\System\zMPUPNm.exe
  2⤵
  PID:10344
- C:\Windows\System\tQgXKtB.exe
  C:\Windows\System\tQgXKtB.exe
  2⤵
  PID:10368
- C:\Windows\System\sFtkSsy.exe
  C:\Windows\System\sFtkSsy.exe
  2⤵
  PID:10636
- C:\Windows\System\PuNfepU.exe
  C:\Windows\System\PuNfepU.exe
  2⤵
  PID:10660
- C:\Windows\System\PkeHHRy.exe
  C:\Windows\System\PkeHHRy.exe
  2⤵
  PID:10680
- C:\Windows\System\cADvbQO.exe
  C:\Windows\System\cADvbQO.exe
  2⤵
  PID:10700
- C:\Windows\System\pkPRBny.exe
  C:\Windows\System\pkPRBny.exe
  2⤵
  PID:10728
- C:\Windows\System\AJMxqQf.exe
  C:\Windows\System\AJMxqQf.exe
  2⤵
  PID:10752
- C:\Windows\System\aOpcxlG.exe
  C:\Windows\System\aOpcxlG.exe
  2⤵
  PID:10768
- C:\Windows\System\TAxVnCB.exe
  C:\Windows\System\TAxVnCB.exe
  2⤵
  PID:10792
- C:\Windows\System\CSnStFH.exe
  C:\Windows\System\CSnStFH.exe
  2⤵
  PID:10816
- C:\Windows\System\mbYCcIW.exe
  C:\Windows\System\mbYCcIW.exe
  2⤵
  PID:10840
- C:\Windows\System\IAaXzDo.exe
  C:\Windows\System\IAaXzDo.exe
  2⤵
  PID:10860
- C:\Windows\System\vbihrXO.exe
  C:\Windows\System\vbihrXO.exe
  2⤵
  PID:10880
- C:\Windows\System\AQJxeZG.exe
  C:\Windows\System\AQJxeZG.exe
  2⤵
  PID:10904
- C:\Windows\System\RctvszD.exe
  C:\Windows\System\RctvszD.exe
  2⤵
  PID:10924
- C:\Windows\System\xGNoywo.exe
  C:\Windows\System\xGNoywo.exe
  2⤵
  PID:10948
- C:\Windows\System\YevUVkc.exe
  C:\Windows\System\YevUVkc.exe
  2⤵
  PID:10968
- C:\Windows\System\SpNrKzp.exe
  C:\Windows\System\SpNrKzp.exe
  2⤵
  PID:10996
- C:\Windows\System\KzXwtpi.exe
  C:\Windows\System\KzXwtpi.exe
  2⤵
  PID:11016
- C:\Windows\System\UqlxLec.exe
  C:\Windows\System\UqlxLec.exe
  2⤵
  PID:11044
- C:\Windows\System\VsNgVGs.exe
  C:\Windows\System\VsNgVGs.exe
  2⤵
  PID:11068
- C:\Windows\System\zuSaDDB.exe
  C:\Windows\System\zuSaDDB.exe
  2⤵
  PID:11092
- C:\Windows\System\DoCwWrE.exe
  C:\Windows\System\DoCwWrE.exe
  2⤵
  PID:11112
- C:\Windows\System\yKGtqNo.exe
  C:\Windows\System\yKGtqNo.exe
  2⤵
  PID:11144
- C:\Windows\System\INfpaxB.exe
  C:\Windows\System\INfpaxB.exe
  2⤵
  PID:11172
- C:\Windows\System\FkIwrKF.exe
  C:\Windows\System\FkIwrKF.exe
  2⤵
  PID:11196
- C:\Windows\System\soWDsNL.exe
  C:\Windows\System\soWDsNL.exe
  2⤵
  PID:11224
- C:\Windows\System\WdfSSeJ.exe
  C:\Windows\System\WdfSSeJ.exe
  2⤵
  PID:11252
- C:\Windows\System\TNkLTaY.exe
  C:\Windows\System\TNkLTaY.exe
  2⤵
  PID:9036
- C:\Windows\System\HvyIHFO.exe
  C:\Windows\System\HvyIHFO.exe
  2⤵
  PID:9084
- C:\Windows\System\rLfjELR.exe
  C:\Windows\System\rLfjELR.exe
  2⤵
  PID:8268
- C:\Windows\System\wyHBSrx.exe
  C:\Windows\System\wyHBSrx.exe
  2⤵
  PID:9928
- C:\Windows\System\aPGCzrB.exe
  C:\Windows\System\aPGCzrB.exe
  2⤵
  PID:9976
- C:\Windows\System\zFYCnoL.exe
  C:\Windows\System\zFYCnoL.exe
  2⤵
  PID:10108
- C:\Windows\System\QWYYNLH.exe
  C:\Windows\System\QWYYNLH.exe
  2⤵
  PID:10172
- C:\Windows\System\DVIEpWU.exe
  C:\Windows\System\DVIEpWU.exe
  2⤵
  PID:7356
- C:\Windows\System\GCBQfaK.exe
  C:\Windows\System\GCBQfaK.exe
  2⤵
  PID:8552
- C:\Windows\System\FyiBodF.exe
  C:\Windows\System\FyiBodF.exe
  2⤵
  PID:8388
- C:\Windows\System\Uawdfzv.exe
  C:\Windows\System\Uawdfzv.exe
  2⤵
  PID:8012
- C:\Windows\System\fMIPQdu.exe
  C:\Windows\System\fMIPQdu.exe
  2⤵
  PID:8680
- C:\Windows\System\xkJDuIw.exe
  C:\Windows\System\xkJDuIw.exe
  2⤵
  PID:3860
- C:\Windows\System\UEMMsVC.exe
  C:\Windows\System\UEMMsVC.exe
  2⤵
  PID:9364
- C:\Windows\System\SvrwOVZ.exe
  C:\Windows\System\SvrwOVZ.exe
  2⤵
  PID:9576
- C:\Windows\System\DzIJFgh.exe
  C:\Windows\System\DzIJFgh.exe
  2⤵
  PID:9632
- C:\Windows\System\skuLRZu.exe
  C:\Windows\System\skuLRZu.exe
  2⤵
  PID:9716
- C:\Windows\System\QxaTiSI.exe
  C:\Windows\System\QxaTiSI.exe
  2⤵
  PID:8964
- C:\Windows\System\FiFpTOi.exe
  C:\Windows\System\FiFpTOi.exe
  2⤵
  PID:7964
- C:\Windows\System\AyaojyQ.exe
  C:\Windows\System\AyaojyQ.exe
  2⤵
  PID:9704
- C:\Windows\System\XGOqPSe.exe
  C:\Windows\System\XGOqPSe.exe
  2⤵
  PID:10248
- C:\Windows\System\eHeSoEm.exe
  C:\Windows\System\eHeSoEm.exe
  2⤵
  PID:10292
- C:\Windows\System\rpdQUTy.exe
  C:\Windows\System\rpdQUTy.exe
  2⤵
  PID:10340
- C:\Windows\System\atPwzkg.exe
  C:\Windows\System\atPwzkg.exe
  2⤵
  PID:9904
- C:\Windows\System\NnjuPcC.exe
  C:\Windows\System\NnjuPcC.exe
  2⤵
  PID:3580
- C:\Windows\System\OYcLnoC.exe
  C:\Windows\System\OYcLnoC.exe
  2⤵
  PID:6476
- C:\Windows\System\xLmVOTL.exe
  C:\Windows\System\xLmVOTL.exe
  2⤵
  PID:7896
- C:\Windows\System\uQHBoho.exe
  C:\Windows\System\uQHBoho.exe
  2⤵
  PID:8436
- C:\Windows\System\PnvudFK.exe
  C:\Windows\System\PnvudFK.exe
  2⤵
  PID:9300
- C:\Windows\System\DqwkCSH.exe
  C:\Windows\System\DqwkCSH.exe
  2⤵
  PID:9472
- C:\Windows\System\yrKAYja.exe
  C:\Windows\System\yrKAYja.exe
  2⤵
  PID:8500
- C:\Windows\System\kDLbEhi.exe
  C:\Windows\System\kDLbEhi.exe
  2⤵
  PID:11268
- C:\Windows\System\PuBhUAU.exe
  C:\Windows\System\PuBhUAU.exe
  2⤵
  PID:11292
- C:\Windows\System\PgrWVJL.exe
  C:\Windows\System\PgrWVJL.exe
  2⤵
  PID:11316
- C:\Windows\System\NRDAeRi.exe
  C:\Windows\System\NRDAeRi.exe
  2⤵
  PID:11340
- C:\Windows\System\GSDhqfu.exe
  C:\Windows\System\GSDhqfu.exe
  2⤵
  PID:11372
- C:\Windows\System\czoRWUt.exe
  C:\Windows\System\czoRWUt.exe
  2⤵
  PID:11388
- C:\Windows\System\mjaFGOD.exe
  C:\Windows\System\mjaFGOD.exe
  2⤵
  PID:11416
- C:\Windows\System\hiOfVrl.exe
  C:\Windows\System\hiOfVrl.exe
  2⤵
  PID:11440
- C:\Windows\System\gsSiczi.exe
  C:\Windows\System\gsSiczi.exe
  2⤵
  PID:11460
- C:\Windows\System\CWqNzIp.exe
  C:\Windows\System\CWqNzIp.exe
  2⤵
  PID:11480
- C:\Windows\System\zzknzcz.exe
  C:\Windows\System\zzknzcz.exe
  2⤵
  PID:11504
- C:\Windows\System\xbGzLZd.exe
  C:\Windows\System\xbGzLZd.exe
  2⤵
  PID:11524
- C:\Windows\System\PrQjCVb.exe
  C:\Windows\System\PrQjCVb.exe
  2⤵
  PID:11548
- C:\Windows\System\IrXrVlO.exe
  C:\Windows\System\IrXrVlO.exe
  2⤵
  PID:11576
- C:\Windows\System\JAclqTj.exe
  C:\Windows\System\JAclqTj.exe
  2⤵
  PID:11596
- C:\Windows\System\jBOeiiR.exe
  C:\Windows\System\jBOeiiR.exe
  2⤵
  PID:11616
- C:\Windows\System\yWKVBDD.exe
  C:\Windows\System\yWKVBDD.exe
  2⤵
  PID:11644
- C:\Windows\System\DNTMtGY.exe
  C:\Windows\System\DNTMtGY.exe
  2⤵
  PID:11664
- C:\Windows\System\ldnIYEi.exe
  C:\Windows\System\ldnIYEi.exe
  2⤵
  PID:11688
- C:\Windows\System\yVDKpgm.exe
  C:\Windows\System\yVDKpgm.exe
  2⤵
  PID:11716
- C:\Windows\System\GyelEKC.exe
  C:\Windows\System\GyelEKC.exe
  2⤵
  PID:11736
- C:\Windows\System\IxCtRaw.exe
  C:\Windows\System\IxCtRaw.exe
  2⤵
  PID:11752
- C:\Windows\System\IhNMtlp.exe
  C:\Windows\System\IhNMtlp.exe
  2⤵
  PID:11776
- C:\Windows\System\tlNQuiE.exe
  C:\Windows\System\tlNQuiE.exe
  2⤵
  PID:11800
- C:\Windows\System\npCuRye.exe
  C:\Windows\System\npCuRye.exe
  2⤵
  PID:11816
- C:\Windows\System\GzSyANZ.exe
  C:\Windows\System\GzSyANZ.exe
  2⤵
  PID:11836
- C:\Windows\System\inrwflz.exe
  C:\Windows\System\inrwflz.exe
  2⤵
  PID:11860
- C:\Windows\System\PnWxCUA.exe
  C:\Windows\System\PnWxCUA.exe
  2⤵
  PID:11884
- C:\Windows\System\lKDlfDY.exe
  C:\Windows\System\lKDlfDY.exe
  2⤵
  PID:11904
- C:\Windows\System\wvEMHSV.exe
  C:\Windows\System\wvEMHSV.exe
  2⤵
  PID:11932
- C:\Windows\System\jDwiazj.exe
  C:\Windows\System\jDwiazj.exe
  2⤵
  PID:11952
- C:\Windows\System\HEFXIUL.exe
  C:\Windows\System\HEFXIUL.exe
  2⤵
  PID:11980
- C:\Windows\System\mkNsiti.exe
  C:\Windows\System\mkNsiti.exe
  2⤵
  PID:12004
- C:\Windows\System\XCKwvTv.exe
  C:\Windows\System\XCKwvTv.exe
  2⤵
  PID:12024
- C:\Windows\System\YqMymgP.exe
  C:\Windows\System\YqMymgP.exe
  2⤵
  PID:12044
- C:\Windows\System\THDHNMI.exe
  C:\Windows\System\THDHNMI.exe
  2⤵
  PID:12072
- C:\Windows\System\BjHVIYH.exe
  C:\Windows\System\BjHVIYH.exe
  2⤵
  PID:12100
- C:\Windows\System\rcubmSL.exe
  C:\Windows\System\rcubmSL.exe
  2⤵
  PID:12120
- C:\Windows\System\lQUlhsE.exe
  C:\Windows\System\lQUlhsE.exe
  2⤵
  PID:12152
- C:\Windows\System\LLAwumP.exe
  C:\Windows\System\LLAwumP.exe
  2⤵
  PID:12168
- C:\Windows\System\WBshzSp.exe
  C:\Windows\System\WBshzSp.exe
  2⤵
  PID:12188
- C:\Windows\System\PYGuPmi.exe
  C:\Windows\System\PYGuPmi.exe
  2⤵
  PID:12208
- C:\Windows\System\sEnxpqb.exe
  C:\Windows\System\sEnxpqb.exe
  2⤵
  PID:12236
- C:\Windows\System\ALALEOn.exe
  C:\Windows\System\ALALEOn.exe
  2⤵
  PID:12260
- C:\Windows\System\EltbOjj.exe
  C:\Windows\System\EltbOjj.exe
  2⤵
  PID:12280
- C:\Windows\System\ibplolQ.exe
  C:\Windows\System\ibplolQ.exe
  2⤵
  PID:10668
- C:\Windows\System\pifjYcY.exe
  C:\Windows\System\pifjYcY.exe
  2⤵
  PID:10692
- C:\Windows\System\JIIrjjh.exe
  C:\Windows\System\JIIrjjh.exe
  2⤵
  PID:9360
- C:\Windows\System\XERoqQm.exe
  C:\Windows\System\XERoqQm.exe
  2⤵
  PID:10808
- C:\Windows\System\QHJMkvM.exe
  C:\Windows\System\QHJMkvM.exe
  2⤵
  PID:10848
- C:\Windows\System\InCywbT.exe
  C:\Windows\System\InCywbT.exe
  2⤵
  PID:10888
- C:\Windows\System\GlyGimF.exe
  C:\Windows\System\GlyGimF.exe
  2⤵
  PID:10940
- C:\Windows\System\HdTgMFm.exe
  C:\Windows\System\HdTgMFm.exe
  2⤵
  PID:10268
- C:\Windows\System\UbllfEw.exe
  C:\Windows\System\UbllfEw.exe
  2⤵
  PID:10352
- C:\Windows\System\kbpIhVe.exe
  C:\Windows\System\kbpIhVe.exe
  2⤵
  PID:10380
- C:\Windows\System\OzRkmuH.exe
  C:\Windows\System\OzRkmuH.exe
  2⤵
  PID:9908
- C:\Windows\System\GWHrzCG.exe
  C:\Windows\System\GWHrzCG.exe
  2⤵
  PID:11244
- C:\Windows\System\IGeXOQd.exe
  C:\Windows\System\IGeXOQd.exe
  2⤵
  PID:9876
- C:\Windows\System\knLcayq.exe
  C:\Windows\System\knLcayq.exe
  2⤵
  PID:10040
- C:\Windows\System\osICdsN.exe
  C:\Windows\System\osICdsN.exe
  2⤵
  PID:10080
- C:\Windows\System\lpenmQj.exe
  C:\Windows\System\lpenmQj.exe
  2⤵
  PID:10164
- C:\Windows\System\LiayHwZ.exe
  C:\Windows\System\LiayHwZ.exe
  2⤵
  PID:7948
- C:\Windows\System\PFQmhDP.exe
  C:\Windows\System\PFQmhDP.exe
  2⤵
  PID:9288
- C:\Windows\System\ypdoLKc.exe
  C:\Windows\System\ypdoLKc.exe
  2⤵
  PID:12296
- C:\Windows\System\jVOIAgx.exe
  C:\Windows\System\jVOIAgx.exe
  2⤵
  PID:12316
- C:\Windows\System\tBCEKPP.exe
  C:\Windows\System\tBCEKPP.exe
  2⤵
  PID:12332
- C:\Windows\System\dfPtsqv.exe
  C:\Windows\System\dfPtsqv.exe
  2⤵
  PID:12356
- C:\Windows\System\aaXatth.exe
  C:\Windows\System\aaXatth.exe
  2⤵
  PID:12380
- C:\Windows\System\pJvUzME.exe
  C:\Windows\System\pJvUzME.exe
  2⤵
  PID:12408
- C:\Windows\System\ractgfo.exe
  C:\Windows\System\ractgfo.exe
  2⤵
  PID:12428
- C:\Windows\System\xTCucwB.exe
  C:\Windows\System\xTCucwB.exe
  2⤵
  PID:12448
- C:\Windows\System\MLFhGgo.exe
  C:\Windows\System\MLFhGgo.exe
  2⤵
  PID:12472
- C:\Windows\System\PWdxQez.exe
  C:\Windows\System\PWdxQez.exe
  2⤵
  PID:12492
- C:\Windows\System\WXcPTBs.exe
  C:\Windows\System\WXcPTBs.exe
  2⤵
  PID:12516
- C:\Windows\System\kftSaxC.exe
  C:\Windows\System\kftSaxC.exe
  2⤵
  PID:12540
- C:\Windows\System\YzfxfsL.exe
  C:\Windows\System\YzfxfsL.exe
  2⤵
  PID:12564
- C:\Windows\System\nlLANlD.exe
  C:\Windows\System\nlLANlD.exe
  2⤵
  PID:12596
- C:\Windows\System\kPGTgrq.exe
  C:\Windows\System\kPGTgrq.exe
  2⤵
  PID:12616
- C:\Windows\System\duoMmWn.exe
  C:\Windows\System\duoMmWn.exe
  2⤵
  PID:12636
- C:\Windows\System\YgAkysy.exe
  C:\Windows\System\YgAkysy.exe
  2⤵
  PID:12660
- C:\Windows\System\iiVUaov.exe
  C:\Windows\System\iiVUaov.exe
  2⤵
  PID:12680
- C:\Windows\System\UOijfuP.exe
  C:\Windows\System\UOijfuP.exe
  2⤵
  PID:12700
- C:\Windows\System\JfxRPSd.exe
  C:\Windows\System\JfxRPSd.exe
  2⤵
  PID:12724
- C:\Windows\System\ByvJWKO.exe
  C:\Windows\System\ByvJWKO.exe
  2⤵
  PID:12748
- C:\Windows\System\nDvxbIK.exe
  C:\Windows\System\nDvxbIK.exe
  2⤵
  PID:12768
- C:\Windows\System\nkZzYDW.exe
  C:\Windows\System\nkZzYDW.exe
  2⤵
  PID:12804
- C:\Windows\System\LDPgAEF.exe
  C:\Windows\System\LDPgAEF.exe
  2⤵
  PID:12832
- C:\Windows\System\tfbZITo.exe
  C:\Windows\System\tfbZITo.exe
  2⤵
  PID:12856
- C:\Windows\System\zPyjXnI.exe
  C:\Windows\System\zPyjXnI.exe
  2⤵
  PID:12876
- C:\Windows\System\YBODDWC.exe
  C:\Windows\System\YBODDWC.exe
  2⤵
  PID:12892
- C:\Windows\System\qpmcKTw.exe
  C:\Windows\System\qpmcKTw.exe
  2⤵
  PID:12912
- C:\Windows\System\MYYOZag.exe
  C:\Windows\System\MYYOZag.exe
  2⤵
  PID:12936
- C:\Windows\System\xXYnBAi.exe
  C:\Windows\System\xXYnBAi.exe
  2⤵
  PID:12960
- C:\Windows\System\fattuuY.exe
  C:\Windows\System\fattuuY.exe
  2⤵
  PID:12984
- C:\Windows\System\FqhUNed.exe
  C:\Windows\System\FqhUNed.exe
  2⤵
  PID:13004
- C:\Windows\System\NVsaGKH.exe
  C:\Windows\System\NVsaGKH.exe
  2⤵
  PID:13024
- C:\Windows\System\EdKRyFT.exe
  C:\Windows\System\EdKRyFT.exe
  2⤵
  PID:13056
- C:\Windows\System\GHJZOxr.exe
  C:\Windows\System\GHJZOxr.exe
  2⤵
  PID:13076
- C:\Windows\System\WBKLbiK.exe
  C:\Windows\System\WBKLbiK.exe
  2⤵
  PID:13100
- C:\Windows\System\hZOeNfv.exe
  C:\Windows\System\hZOeNfv.exe
  2⤵
  PID:13124
- C:\Windows\System\KJbrzhC.exe
  C:\Windows\System\KJbrzhC.exe
  2⤵
  PID:13148
- C:\Windows\System\UmGjvQn.exe
  C:\Windows\System\UmGjvQn.exe
  2⤵
  PID:13164
- C:\Windows\System\KGvwhqi.exe
  C:\Windows\System\KGvwhqi.exe
  2⤵
  PID:13180
- C:\Windows\System\NBMLYte.exe
  C:\Windows\System\NBMLYte.exe
  2⤵
  PID:13196
- C:\Windows\System\CFSCKLK.exe
  C:\Windows\System\CFSCKLK.exe
  2⤵
  PID:13212
- C:\Windows\System\FBhMeYc.exe
  C:\Windows\System\FBhMeYc.exe
  2⤵
  PID:13228
- C:\Windows\System\XipMvuc.exe
  C:\Windows\System\XipMvuc.exe
  2⤵
  PID:13248
- C:\Windows\System\inudRto.exe
  C:\Windows\System\inudRto.exe
  2⤵
  PID:13264
- C:\Windows\System\elKYbNn.exe
  C:\Windows\System\elKYbNn.exe
  2⤵
  PID:10052
- C:\Windows\System\zcqirQy.exe
  C:\Windows\System\zcqirQy.exe
  2⤵
  PID:11640
- C:\Windows\System\aDTpYjo.exe
  C:\Windows\System\aDTpYjo.exe
  2⤵
  PID:11808
- C:\Windows\System\UijmdsN.exe
  C:\Windows\System\UijmdsN.exe
  2⤵
  PID:11944
- C:\Windows\System\iCnWHDS.exe
  C:\Windows\System\iCnWHDS.exe
  2⤵
  PID:12060
- C:\Windows\System\QDnIBzZ.exe
  C:\Windows\System\QDnIBzZ.exe
  2⤵
  PID:12180
- C:\Windows\System\lhDItti.exe
  C:\Windows\System\lhDItti.exe
  2⤵
  PID:12648
- C:\Windows\System\FWaGgBs.exe
  C:\Windows\System\FWaGgBs.exe
  2⤵
  PID:12780
- C:\Windows\System\zslJZHq.exe
  C:\Windows\System\zslJZHq.exe
  2⤵
  PID:12924
- C:\Windows\System\lhjqBGc.exe
  C:\Windows\System\lhjqBGc.exe
  2⤵
  PID:13300
- C:\Windows\System\SpaJmgJ.exe
  C:\Windows\System\SpaJmgJ.exe
  2⤵
  PID:9144
- C:\Windows\System\CwykGYi.exe
  C:\Windows\System\CwykGYi.exe
  2⤵
  PID:9772
- C:\Windows\System\MIrCfSZ.exe
  C:\Windows\System\MIrCfSZ.exe
  2⤵
  PID:11496
- C:\Windows\System\aUUZBQF.exe
  C:\Windows\System\aUUZBQF.exe
  2⤵
  PID:10960
- C:\Windows\System\rWMKoSK.exe
  C:\Windows\System\rWMKoSK.exe
  2⤵
  PID:12020
- C:\Windows\System\isvmmBy.exe
  C:\Windows\System\isvmmBy.exe
  2⤵
  PID:12348
- C:\Windows\System\lEGzJiT.exe
  C:\Windows\System\lEGzJiT.exe
  2⤵
  PID:11624
- C:\Windows\System\gXVBdKH.exe
  C:\Windows\System\gXVBdKH.exe
  2⤵
  PID:12204
- C:\Windows\System\vKshMiE.exe
  C:\Windows\System\vKshMiE.exe
  2⤵
  PID:11476
- C:\Windows\System\zBrcQhK.exe
  C:\Windows\System\zBrcQhK.exe
  2⤵
  PID:11108
- C:\Windows\System\ZecUmer.exe
  C:\Windows\System\ZecUmer.exe
  2⤵
  PID:10388
- C:\Windows\System\ItbORxe.exe
  C:\Windows\System\ItbORxe.exe
  2⤵
  PID:12272
- C:\Windows\System\xqrufCN.exe
  C:\Windows\System\xqrufCN.exe
  2⤵
  PID:1404
- C:\Windows\System\CBQtISN.exe
  C:\Windows\System\CBQtISN.exe
  2⤵
  PID:12504
- C:\Windows\System\AzDjVXC.exe
  C:\Windows\System\AzDjVXC.exe
  2⤵
  PID:11724
- C:\Windows\System\FQFVgSg.exe
  C:\Windows\System\FQFVgSg.exe
  2⤵
  PID:9164
- C:\Windows\System\CfnsxTI.exe
  C:\Windows\System\CfnsxTI.exe
  2⤵
  PID:13116
- C:\Windows\System\mwxpWBC.exe
  C:\Windows\System\mwxpWBC.exe
  2⤵
  PID:10008
- C:\Windows\System\OLAzRtm.exe
  C:\Windows\System\OLAzRtm.exe
  2⤵
  PID:11332
- C:\Windows\System\ZySmiAF.exe
  C:\Windows\System\ZySmiAF.exe
  2⤵
  PID:11768
- C:\Windows\System\khHWOPL.exe
  C:\Windows\System\khHWOPL.exe
  2⤵
  PID:11300
- C:\Windows\System\uuTTsOI.exe
  C:\Windows\System\uuTTsOI.exe
  2⤵
  PID:11828
- C:\Windows\System\UIoIFBY.exe
  C:\Windows\System\UIoIFBY.exe
  2⤵
  PID:12488
- C:\Windows\System\KJgWeGY.exe
  C:\Windows\System\KJgWeGY.exe
  2⤵
  PID:11940
- C:\Windows\System\lwcnCJu.exe
  C:\Windows\System\lwcnCJu.exe
  2⤵
  PID:12556
- C:\Windows\System\bRyPURI.exe
  C:\Windows\System\bRyPURI.exe
  2⤵
  PID:10900
- C:\Windows\System\jQfKMXe.exe
  C:\Windows\System\jQfKMXe.exe
  2⤵
  PID:7072
- C:\Windows\System\lBBSoCb.exe
  C:\Windows\System\lBBSoCb.exe
  2⤵
  PID:12088
- C:\Windows\System\XtXDQHy.exe
  C:\Windows\System\XtXDQHy.exe
  2⤵
  PID:13132
- C:\Windows\System\uOTgPyp.exe
  C:\Windows\System\uOTgPyp.exe
  2⤵
  PID:12160
- C:\Windows\System\RxitSUt.exe
  C:\Windows\System\RxitSUt.exe
  2⤵
  PID:10800
- C:\Windows\System\aDuWswy.exe
  C:\Windows\System\aDuWswy.exe
  2⤵
  PID:13032
- C:\Windows\System\KzfvbVI.exe
  C:\Windows\System\KzfvbVI.exe
  2⤵
  PID:12352
- C:\Windows\System\cgzOuge.exe
  C:\Windows\System\cgzOuge.exe
  2⤵
  PID:9044
- C:\Windows\System\UjtcyEh.exe
  C:\Windows\System\UjtcyEh.exe
  2⤵
  PID:11152
- C:\Windows\System\EQUuvQQ.exe
  C:\Windows\System\EQUuvQQ.exe
  2⤵
  PID:11988
- C:\Windows\System\YJvWsHD.exe
  C:\Windows\System\YJvWsHD.exe
  2⤵
  PID:13192
- C:\Windows\System\LndrJGG.exe
  C:\Windows\System\LndrJGG.exe
  2⤵
  PID:13440
- C:\Windows\System\Wevarfe.exe
  C:\Windows\System\Wevarfe.exe
  2⤵
  PID:13468
- C:\Windows\System\TEXfoEO.exe
  C:\Windows\System\TEXfoEO.exe
  2⤵
  PID:13508
- C:\Windows\System\BFxaSrx.exe
  C:\Windows\System\BFxaSrx.exe
  2⤵
  PID:13524
- C:\Windows\System\ngaldtd.exe
  C:\Windows\System\ngaldtd.exe
  2⤵
  PID:13544
- C:\Windows\System\oIGVKyV.exe
  C:\Windows\System\oIGVKyV.exe
  2⤵
  PID:13628
- C:\Windows\System\paYwmkV.exe
  C:\Windows\System\paYwmkV.exe
  2⤵
  PID:13648
- C:\Windows\System\nPMtCkW.exe
  C:\Windows\System\nPMtCkW.exe
  2⤵
  PID:13844
- C:\Windows\System\VQCxHCl.exe
  C:\Windows\System\VQCxHCl.exe
  2⤵
  PID:13860
- C:\Windows\System\NeFtyko.exe
  C:\Windows\System\NeFtyko.exe
  2⤵
  PID:13880
- C:\Windows\System\PwQDvUa.exe
  C:\Windows\System\PwQDvUa.exe
  2⤵
  PID:13912
- C:\Windows\System\NzJzCcL.exe
  C:\Windows\System\NzJzCcL.exe
  2⤵
  PID:14016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3rv30wsy.osl.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BotMINS.exe

Filesize
2.2MB

MD5
437cfe5c7a9dcbf034f569ef1c2ac538

SHA1
9391af2c84fe78f4d89ab735931c6462e9a021c9

SHA256
b734a257750bb7523535e8ff6b9509f2bd544dfb7b137b6f7fa2fbe6e3e20053

SHA512
14b1ec24e9de7b19422abd0fc7da58410f51bdba955f840462213145781fe5cb2b01fd783263557f730a7ce702da6ea6f8ad09539a8673ebc67714bafaa59a32

Download Submit
C:\Windows\System\GQeUOha.exe

Filesize
2.2MB

MD5
7cc3137917cfa0326199dd5c1907b402

SHA1
702f44d7c352653b744199ee979813939ccef96e

SHA256
57a4a5e4b8b9aa1397642a6a7def3ffa7728c5414e3a7a72c994df4ccf965585

SHA512
0df8b182baf81e68ec2c371941cb8584814fac330b326bcc3b372387e4cc1a2a63a0b68d825ce89c7c83cb75d72bfbb32023c82284e7027c793801700d799987

Download Submit
C:\Windows\System\JTNEGMj.exe

Filesize
2.2MB

MD5
72aecab04107f114f5ecdf9a63e9cd9a

SHA1
2a81c784e4fc94def96bf3f9137c4959f9e04d81

SHA256
3db8ca84a4e1bb0ec57625b0249c0088a1d95ace53aae0e1641d41b72c773ab1

SHA512
8dbc88ce7d4f4096cd3fe35a4e4d318dce0a1cf88f2886e6dded24549fbfc765d2c30d6aee8c4dc9fc6a576f01faa4d176127ff25120ee16d19d7f287377229f

Download Submit
C:\Windows\System\KbxpmlO.exe

Filesize
2.2MB

MD5
a05dfeba2970575c86ddada37c840778

SHA1
bce01b6efac2483dc99a6a47132e77b1fb3bff0e

SHA256
529d97c2317032b9477df9d9a7b220d92c69117a3e27b1e56f54affbf6921029

SHA512
afc361d38ee7af375bd1a353d647d5f9d882486deb303e39d1ff82f4f933d50af82906e828b9860dbe90986ba176e8d2355319fcf7bcd3baa5f65866364784b4

Download Submit
C:\Windows\System\LtSVzjH.exe

Filesize
2.2MB

MD5
8cdea88b47bc8b914cb681776441525a

SHA1
b46ca7dfcf43c02589861c8c83eea34fe9c01019

SHA256
6291925bd5dd090b3bbe826f7f65f2d03373f5a00226373a554ee6df5c875148

SHA512
03e05651fb159159b54fb5ec9094ac59280285904bdb154bfe2052f4e7deb9d2777e2b90406e778adc555e289e611c9f09cfeed6ce1f6bf5952cebba2ef3de42

Download Submit
C:\Windows\System\MZtgsJH.exe

Filesize
2.2MB

MD5
5dca4d44d39fd6ad44e458f172fbfeb6

SHA1
1002e1b9372db9e695f555b0670bb564f3a81576

SHA256
9488bd247e169d7fe989c405a109351081266bb6c3665100e185fcd6699b0e5d

SHA512
cfdf0473d659594e2e3e79b380f8fdb58a3ae5cbb3e34b57b1fc1d3213aa65f03ba8a2bdc959769482bc7e68d11d809f4adcde5e6799bf309bcfcfe88fef92ef

Download Submit
C:\Windows\System\QXSuUWs.exe

Filesize
2.2MB

MD5
4c1b0c359921e69b4a4c567b4928e3f8

SHA1
f67ade149f8a54bb5c9f80bb5a0da92357aadc13

SHA256
d3f4b758a26910dcd01c1b02d39acb6b556a6c3c4c30235d5d6b4823982b61cc

SHA512
9d38d06dd58ca8fcecc0fe3832112c29da677becb20c2f12a9118735fe18c6b86d8fa84b2d82f76a263641f31ab18ab020d59f4fd43f0a178c391935837c38f4

Download Submit
C:\Windows\System\Qoixqrq.exe

Filesize
2.2MB

MD5
a9b9098531a64bb028c51c6ce77fd4be

SHA1
698718db701ef63b114610b6386d7aba27a1729f

SHA256
4890bb8cb47d6321caf8e49da33aaed36f2e7406d1ff19e5293aab815e152ed9

SHA512
c6b331755f48d2eb8c2fdb675442b3d9672789d5e7ae82917cc25b56ed3eda71ce1cf2585d272062a4f71cdb47a19a818053f36237d5e5fa31521735e9f8b415

Download Submit
C:\Windows\System\UVCJBgn.exe

Filesize
2.2MB

MD5
8f52011e2738ab050f6ecc7071716245

SHA1
57056ff063fccea2883f2b88aaa305da4d4f0ded

SHA256
d2756e0424599d6c3d5e089f0ddb2af11ce7c64110bb38132df54dc8a9b8479c

SHA512
2367d4d857834f2446278b5743956ddad9afb588390f2b39dab36fde862db2395f6bc4678ef6563c2422e70df57a077240a39da57058ee01d8c0cc249d8a1253

Download Submit
C:\Windows\System\VzstQxx.exe

Filesize
2.2MB

MD5
3e67765e1f45f13703f2eb43049d317c

SHA1
8b24d7f08369b55a0259dba9f3706103fc3dee26

SHA256
371618d8bcc3fdaac60995fa925e20d6768376808dc6eb756e3d2a52fa5c81cd

SHA512
74ec922a431fd8ebe5ae99b28f2dbeaaf542c664692cec467302b1189f48e5a31487ac0777fc54f71bc12aab264ef3b4dc9bc75931f15f318171abfa0775ce73

Download Submit
C:\Windows\System\WiEmCCI.exe

Filesize
2.2MB

MD5
2e60718264b6e16aa33a685c660d8bf3

SHA1
ec37d7c1a43b56970196b93b8a38436f00fa6cc5

SHA256
9df5afe75c92ee37f8f89bd672ac03db980b8f6bb54fa02d795aa76ff385697c

SHA512
a00648ffdc09da4983e705c0370046d85d2489f0f7589e6fa02bd8bd7f9acda76b3075adf875a59f5a84d488459320e6cde206432db55ad340867a1eaa1c2a21

Download Submit
C:\Windows\System\XYVOzJn.exe

Filesize
2.2MB

MD5
5f81d23d555bf0cc04c5b1d3d68d877f

SHA1
d8080501c34594be78346451233f422463ffa392

SHA256
4f382893c7e892740dfe0f91fa447065db31d36809dba246da5a13ff54129650

SHA512
49dd8554e830fdf612f6faae4c5a5264fb2ab5900339fa73daf5a1412ce5c05fa2148317cb7da429a25613afc854d8b0a094c7a9751f1b44d69b0c3ec67d795e

Download Submit
C:\Windows\System\ZNkqYLd.exe

Filesize
2.2MB

MD5
667305b17096dbe31ec1d1dd26843fce

SHA1
f7d2b26c9072aef84f4ba3fb6742bee749833378

SHA256
93e60e67d1570454e80b3734bd9c79545642154e94592b1704b15a6ef9caf5eb

SHA512
857c3a80f418c1a1fb885d663053aba1ef32754ebd89d6f2cfbfdf7d51980a63a0a2d4e9943a0bc9150ebbfce1e8d61aa3668cbdcca72e636dcdd9992888f75f

Download Submit
C:\Windows\System\ZYLspMP.exe

Filesize
2.2MB

MD5
7b441a106410d62b5c7aef3417b822b0

SHA1
ed528e39c7757ba18b02e91a35fc2bf983235f2d

SHA256
58fd10e5671fe735788de0663ef73f70593b8c9991addc8c53789579f08e4a3b

SHA512
212cb566bb623f5652641393fd3c6b4048b4f0c4f62469dc9cd48f61d6091ea11c8d1ab3eecdf363a6a46423d3349d03d165283d424a6fe476dd8c847983aa3a

Download Submit
C:\Windows\System\dKlRGGC.exe

Filesize
2.2MB

MD5
93508d1f367da26ead02296d5a30f86a

SHA1
650b8b284903907541a152ac461a7f19796e198b

SHA256
5f52127bcc5337c934d944d8c8941db5b5727de9ee6b2833b94b1ecbebec06bf

SHA512
34903674f75d5e810c2273bb795dcddc02d82dd1e12a7a7440432d5bb299dde9915258597931f4c8cd66302ff4e29278379f59ef82b71070bae9859f10d12494

Download Submit
C:\Windows\System\dQUekod.exe

Filesize
2.2MB

MD5
ae86ea7667bbad7522cbcdb28a5406d7

SHA1
2d10f3ef5205afc6f31bf97fc4cd2d8b5fdcd1f9

SHA256
764325d92c625f94c80de0c3c93e6be606653eca0d54f9d201c080c70bb12271

SHA512
a3a88f6da3efab56feb090e686acde4f95903fa3ba8bcc4fa47b46972c9dc3f0689a3e4551ab177a2cb376c792cbe749d174c836c75f11aa3a7a7fa26181364d

Download Submit
C:\Windows\System\dgmqLAM.exe

Filesize
2.2MB

MD5
f48e399cd3fb7b9d6996694fbc3ce8c9

SHA1
05a6b1f13e1001b20aebd898f17b6d80bd8e5d74

SHA256
339d8ae21f96282ece73f492edc70ccd3c1dfbd59e144319ea6f94abd72a0072

SHA512
abb5625bb1dab011496487e5f553f9a0ab5137b13d4123d5ce3b142e06e451675c03f475b839c781fc47ee24d067a5a29ad2d1abbe0b3cf3f5cacd8cf8984d93

Download Submit
C:\Windows\System\fsUPQMj.exe

Filesize
2.2MB

MD5
3958a268c160d8af3ab5aef069dca1de

SHA1
fb96606ac12f66db69803db7cac8ef0a632039b3

SHA256
800608c4a8831fc64323f6d04029643b159fd6e37993ebf3fd6f89a037166c35

SHA512
28e920d93bee40ba95a2a2a4c7ef338ad7045f6002d22ede00d6fb0e4af58402a1899fb4025b2aadffd95115442482e64121ab54fadb7db63f02a7e5ec633279

Download Submit
C:\Windows\System\gUkNSRU.exe

Filesize
2.2MB

MD5
b6d89066d57e434a41066e1aa80c246c

SHA1
bff4fea085acedeb6f7340b49a7ea1fc849364ed

SHA256
205dba280c82cfa1c5e2bdbef5714d2f9ae1df7c9765c4c2c19b7688b987eecf

SHA512
2756cfde183c48f052e0f1466ae8cc608cd9573f460b61b1ba0701195acf7becc561e3536eb3ab849ec77238e9430c7ac979714cfbe533d06b8f18033272a920

Download Submit
C:\Windows\System\gdIdqui.exe

Filesize
2.2MB

MD5
234536f7fc2658ca0fd7223d802d8eef

SHA1
7101d8c436ffda771f4c567ee3845274b86bf184

SHA256
9b614af41e379ed1b3cd218b33f61f78781fe22509b671a74535f4faee7e84fe

SHA512
eb887c54df08dfa407f3abdef82ec249407765e0fe17dc2884c8e8a46b9155d3d3eff47307e264a020f409dbd94c81496522b579f3d90130c68f0768a567c7fd

Download Submit
C:\Windows\System\ieWJpOx.exe

Filesize
2.2MB

MD5
d6266531eb830f9995124cc2b71c04a4

SHA1
9090a7675201ce5f00e52cd9300e8f0ea474bf5a

SHA256
4991d31a0755a89a3bfbeb593d68bb4d75331ae959ab3dcbda7927063541aa69

SHA512
0fb9772b494baa08e9b79c5323940502c58102c74cc57f9599ff9aec5ee36a2b4d6d88825fb5d29f9b6353533414a3d1ca18893917d60c1dab3ce77ac6cdf7ff

Download Submit
C:\Windows\System\jochNpo.exe

Filesize
2.2MB

MD5
624c00c254dbd2b1390b76045f104e8f

SHA1
7603a3a22025edffa74c7852f122c922eab63dfa

SHA256
4e5cc9c2e5f5fc4223044ef659e34670401cf006af3a9a3b6b26a34728c41591

SHA512
1eef9582585fb9725c65ec34cc0fa9a1283e0990da53b1dfe89c3a779e5fbaa5d30fc5f99d71db81e8c8c224edd7027f5576a57ee553cc087af3b9067604eb08

Download Submit
C:\Windows\System\kIWkxjI.exe

Filesize
2.2MB

MD5
5c039268febce187c53199f73e8cbf89

SHA1
e711934cecd71e6e089c6815fa37a8cb731e10fa

SHA256
1ffbd8ea52fe248de773fdebb95bc666a4ba88a7ddd96461dfd93852aa9397f2

SHA512
0cdec897f4880018ca8ed85feab957bf88643cdf8771aaf6713c13ec27854f28a30fa50269f5c0c28860e447195a5b581e4010cb60d3ae596346629e53778ad4

Download Submit
C:\Windows\System\kLACNLv.exe

Filesize
2.2MB

MD5
41f6a6b9060223b77c2694f1c14cdd63

SHA1
9634ed7364f1ed1b52bbf02b09ec025d4955b3d4

SHA256
1d977e62dd9925727d52d74eae57ae11ed83c659d098d60eaff4d6c68fb0bf69

SHA512
375c1223b72b1d379ae9db966d4d678137af68857ec55b330dc21f4c96ce0e74482801f93dd2106c081e9d2acf479ca6b7a02cd6761ec6874de0474314500e2a

Download Submit
C:\Windows\System\lKRhzyq.exe

Filesize
2.2MB

MD5
d38376681373bb3212ae586c141e0d21

SHA1
0fd56d5723791944311bacc18307fed3bfddfc81

SHA256
82fe63a4dedf7cc704ba974779880eb152dcfcb5016a6cd9edcd752e5589ea95

SHA512
c062c30486d1e158a5efcfad65bde5a605164daba77a01f0ccd9402d4a9c66bdaf84d02d90bd50a5e2342aac5b01add9bda2f3e6fddf513262078099eeb24e22

Download Submit
C:\Windows\System\nUiadFE.exe

Filesize
2.2MB

MD5
a02e48fa9ffe8fb62581618f6a82199e

SHA1
fd313481feb80ba893d9980b0d393025b09b9cf0

SHA256
0659862b25966b6cc17b0970b84f691e2d63b31228d89b32f9986c0f190740fa

SHA512
9980bc28d975faa2c9b28e891a93b3ee3e1b09c8d7a993320593996b7f9d5c4fe866c0461366e2fdfd2c2ba43d13ac277f0e13ea699a17e5bc2a92b8004e900c

Download Submit
C:\Windows\System\naggtqm.exe

Filesize
2.2MB

MD5
129f092ebe90e36f267e0cdae70e4603

SHA1
405124c19e9f0ca11eec1d52669e5f17890a8209

SHA256
deeaa1ae8c63a7cc0619f3416abb21393da18700dbb1e8251feaa93382f4cca6

SHA512
b9909bc1c1356b93b236008fcd5275db2ac2b7a6b9a7502936d740c1643fe6009bed0393bd0f3f87cf5e2ac1beba3d12c281b6eea6072d68cd8403e729e6c755

Download Submit
C:\Windows\System\nbSHhAO.exe

Filesize
2.2MB

MD5
7a71ef1fd902fd2e8dd27c606c944bbb

SHA1
e07d63e7e9f3e8fea59cb3425cab0b9595a56083

SHA256
d1655cca8ee11ff4b60dfa1b00e59957e1551ac5207334422f7e88f65dd2510d

SHA512
388fbdbd85812cef21eea731809cbf068a021fa4d939d5c487932e89cd3cb0840361ae77b49e836b2156f1d8fcf72d5c5236fea627ff46296216ae655d1a659d

Download Submit
C:\Windows\System\nvlHsXf.exe

Filesize
2.2MB

MD5
4b7775cb18ca1b9832309b560482ef63

SHA1
074ced6b093b313584bcb3bc034addc2ba80e07e

SHA256
e1a1ce3c75e4fa8e9bdfca688617422e43a31d4315eca4eb7b222781a6dfeb79

SHA512
821159ab1a95c318aaf7b227015b65fab7519cf2fc5267bca6340363567dc28b30feb429d32cc780bfe64e287fe5fda9a7880f7a698382be976caf252cec6ca6

Download Submit
C:\Windows\System\oNFuWuE.exe

Filesize
2.2MB

MD5
64769df1be3e4a59d1505a03dd54c194

SHA1
f4973847c6396a992f3d6fac07dc5b7f1b33b4f9

SHA256
c6eff0b6a3fbfc74b254e867f23cb8c2e8212b0d08b82ed3ca095d94f133badb

SHA512
d65882b3c0f7eff48be311b929755d1553901f1cefe0d14d084581035dc28bf77de2f5119a74d950ecfd04881ea1e404281bf10a4c6bdeae32d52be99d9f1639

Download Submit
C:\Windows\System\oxWAwBH.exe

Filesize
2.2MB

MD5
e7ec45074a37af36c5a2e402485cebb3

SHA1
4379e4e7a638773400cfffd3e0ca46ac9d013f77

SHA256
5358efb2b644d7d612cf68a2682f07be28c191338fd1c67cc16ac92b79a70f26

SHA512
01e1f2be82e6591fb5cacd8babea29ef2b6fa722cbf19460ddb5e3f351742946befd1d138d1efc6999715ab7012d219561909db5d8723933893f7343cf9830bf

Download Submit
C:\Windows\System\pABJeJR.exe

Filesize
2.2MB

MD5
0c149ed1a9284873b3fee59a85e6e814

SHA1
1ee2009766a5848b1bb63ccae2a67013636a7ed9

SHA256
4611818c4536be66c8bfd3cbd3edb2c2a066d1d9027370ba610e3550004c5de8

SHA512
6147c6558518c40295ef8493bd6c066e17dcd309869dc1290dbf615b4787a34a1a6476a522e653e1dffa8e103c41c345a7017eb31f2bf09deb95481b1ade8368

Download Submit
C:\Windows\System\qLARYwm.exe

Filesize
2.2MB

MD5
da14a255c5e117f4a2be68e8f4d2322a

SHA1
e9d59ad3bf0164085fd5f9ace03dfbe6168523cf

SHA256
79e2cec6de9421ba31a109e51855f4129763a44962e630f781428e21a6c5c0b6

SHA512
e7ac02eb12588c7473710859a706b05c3b023bbe8f781fc22b45463eff28b636804a03acee15171dfde6a9ac27517a73f3a85641d5ef7858e4357622044a57aa

Download Submit
C:\Windows\System\qPJzSzi.exe

Filesize
2.2MB

MD5
4694575207622e649c7aca4a11876918

SHA1
8dc699634c8d82fbd8f2f8f8d512700741c1a5cb

SHA256
797e75ba96caab561d03e5000a799930d64c1c38406c1c0966cfe3eec4d26274

SHA512
9302409202945d621f3b3629bbf9ac6a23d221e44ceaceca5fe4a791eaa62bc34e025e4ceddb2752721e1ff7efe7a3d3301dc6461048c4e15d876a03e238d951

Download Submit
C:\Windows\System\qkLkkES.exe

Filesize
2.2MB

MD5
0fd7fa2f14a9cc7e3f9af153893b3b67

SHA1
64a9922d0929f16dc042efb274dd7551cc63c831

SHA256
04a478ad05065a382ad09c73033dff40f5f7dd56c0f72f6552b9abf9e0d9af22

SHA512
6b1c471f6f21b96d50a4972af90485c16a9cb0bfa400ff57935c4fa0cc9f0867f7374de06ca9ce8a1db06476f9cdfd985123eb995974b8f331b8d2aa5125d1f9

Download Submit
C:\Windows\System\sZLwBmy.exe

Filesize
2.2MB

MD5
737a5693852fa49878764b06e076c0bb

SHA1
2b2b20fa0712529277ccb8a872ae37bd75cf1800

SHA256
0f67f07d86e1411b09b870c9cc53a0deafe3a03ca0f7381fa143f4d7965a8bc1

SHA512
8836c381c2a22dd5f4641ab4292d62dde8e348b1d73cb64f6ddb66b2a1e70f0a7713ad23e276111aa23fc7ca3c1019f903468a798879f26f659a602c9dfe917c

Download Submit
C:\Windows\System\vSdVZAb.exe

Filesize
2.2MB

MD5
c7689ac7d9b8ec14e5de5f8305f56dc3

SHA1
9bb285ff163279557db9033cfe9a9621df535da6

SHA256
f609cbc686a16ddd45df4c816673170e763021db50061e7e16da4ed0623ecf31

SHA512
a27800aabaffa45baaaa6678effb487124f46ce5e68d18476157a7f49a84e7d6e9e71c4a6ce6e7c753a045b25f9859e32f62669a1cc9265ec0c8fb42d29d75a7

Download Submit
C:\Windows\System\xDThalv.exe

Filesize
2.2MB

MD5
887e3ae53fae3ad0e7560f200d11fa10

SHA1
5411b8f8a832813ab97b9932e0019f1430b0d359

SHA256
11ddb0cfcdb4024fb501da1ea754a9dd7043646a453e18bbfde840abd5ccdfd0

SHA512
935edc7d75420d0f07d472517a14b3b17d0490ff6b4d5b8bf3342efe84fed7f069f2e2cfca57d8f949e19d66280675ef3061e0bfbcf1a87a7794f4015a111b97

Download Submit
C:\Windows\System\xYQUzAG.exe

Filesize
2.2MB

MD5
78deb2e286f2abe14e4251b0b18a2de5

SHA1
bf42ddd4a91205ddd22ffbd709cf90c8edbedce0

SHA256
b467982ce32727b878d4eee9df0d9427ae8cf2ae3937918943556c3f4d6c508c

SHA512
bea15c09abf0160d803f159f7157da211237ddf2407c0a914c617302bac4687c7b6a6b5cd6dcc1ed7e832088e9cf1bd5a2abc63820365c460efe1d84b87f412b

Download Submit
memory/452-246-0x00007FF75EAD0000-0x00007FF75EEC2000-memory.dmp

Filesize
3.9MB

Download
memory/860-300-0x00007FF791540000-0x00007FF791932000-memory.dmp

Filesize
3.9MB

Download
memory/1136-412-0x00007FF6DA480000-0x00007FF6DA872000-memory.dmp

Filesize
3.9MB

Download
memory/1348-407-0x00007FF7902B0000-0x00007FF7906A2000-memory.dmp

Filesize
3.9MB

Download
memory/1360-191-0x00007FF795710000-0x00007FF795B02000-memory.dmp

Filesize
3.9MB

Download
memory/1484-79-0x00007FF6292F0000-0x00007FF6296E2000-memory.dmp

Filesize
3.9MB

Download
memory/1516-224-0x00007FF7AF990000-0x00007FF7AFD82000-memory.dmp

Filesize
3.9MB

Download
memory/1748-406-0x00007FF7FE2C0000-0x00007FF7FE6B2000-memory.dmp

Filesize
3.9MB

Download
memory/1964-389-0x00007FF7A4290000-0x00007FF7A4682000-memory.dmp

Filesize
3.9MB

Download
memory/2332-329-0x00007FF7DEE10000-0x00007FF7DF202000-memory.dmp

Filesize
3.9MB

Download
memory/3148-140-0x00007FF7056E0000-0x00007FF705AD2000-memory.dmp

Filesize
3.9MB

Download
memory/3272-108-0x00007FF7287F0000-0x00007FF728BE2000-memory.dmp

Filesize
3.9MB

Download
memory/3488-410-0x00007FF7F8350000-0x00007FF7F8742000-memory.dmp

Filesize
3.9MB

Download
memory/4108-14-0x00007FF7C9480000-0x00007FF7C9872000-memory.dmp

Filesize
3.9MB

Download
memory/4216-148-0x00007FF7363B0000-0x00007FF7367A2000-memory.dmp

Filesize
3.9MB

Download
memory/4332-61-0x00007FF780E30000-0x00007FF781222000-memory.dmp

Filesize
3.9MB

Download
memory/4400-258-0x00007FF69D9E0000-0x00007FF69DDD2000-memory.dmp

Filesize
3.9MB

Download
memory/4476-151-0x000001EABB240000-0x000001EABB262000-memory.dmp

Filesize
136KB

Download
memory/4476-47-0x00007FFF3DDC0000-0x00007FFF3E881000-memory.dmp

Filesize
10.8MB

Download
memory/4476-48-0x000001EAD3370000-0x000001EAD3380000-memory.dmp

Filesize
64KB

Download
memory/4688-358-0x00007FF73B370000-0x00007FF73B762000-memory.dmp

Filesize
3.9MB

Download
memory/4772-334-0x00007FF7CECF0000-0x00007FF7CF0E2000-memory.dmp

Filesize
3.9MB

Download
memory/4832-363-0x00007FF600B80000-0x00007FF600F72000-memory.dmp

Filesize
3.9MB

Download
memory/5072-1-0x0000025454550000-0x0000025454560000-memory.dmp

Filesize
64KB

Download
memory/5072-0-0x00007FF6BB9F0000-0x00007FF6BBDE2000-memory.dmp

Filesize
3.9MB

Download
memory/5112-411-0x00007FF655840000-0x00007FF655C32000-memory.dmp

Filesize
3.9MB

Download