xmrig | 36cd13f4d0ef6f741d1a40bcc036c5113d927edc3bceddf81f2b6aa561dba830

Analysis

max time kernel
66s
max time network
49s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 01:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
Size

2.3MB
MD5

0686e9327e1a0fbbe44087e1a4404151
SHA1

75c057b8d2b63cf9bfa16fdec25a31b1ebbed433
SHA256

36cd13f4d0ef6f741d1a40bcc036c5113d927edc3bceddf81f2b6aa561dba830
SHA512

e35d9e3ebb4bc45c9d147b00580a470a244ff32633a604ec8ece2f6a71112fb65781561f971f9471fa98f4540db55947b06b981e6fab9f801f35efbdbe59bd2a
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9okc:NAB1

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 42 IoCs

miner

resource	yara_rule
behavioral2/memory/2464-273-0x00007FF6E8B10000-0x00007FF6E8F02000-memory.dmp	xmrig
behavioral2/memory/3352-340-0x00007FF639170000-0x00007FF639562000-memory.dmp	xmrig
behavioral2/memory/3644-347-0x00007FF7494E0000-0x00007FF7498D2000-memory.dmp	xmrig
behavioral2/memory/2360-382-0x00007FF72DEB0000-0x00007FF72E2A2000-memory.dmp	xmrig
behavioral2/memory/1520-395-0x00007FF77F280000-0x00007FF77F672000-memory.dmp	xmrig
behavioral2/memory/2344-430-0x00007FF67C8A0000-0x00007FF67CC92000-memory.dmp	xmrig
behavioral2/memory/1752-422-0x00007FF78B860000-0x00007FF78BC52000-memory.dmp	xmrig
behavioral2/memory/1252-394-0x00007FF740240000-0x00007FF740632000-memory.dmp	xmrig
behavioral2/memory/2508-386-0x00007FF7B2110000-0x00007FF7B2502000-memory.dmp	xmrig
behavioral2/memory/1640-339-0x00007FF7259F0000-0x00007FF725DE2000-memory.dmp	xmrig
behavioral2/memory/3108-331-0x00007FF76A480000-0x00007FF76A872000-memory.dmp	xmrig
behavioral2/memory/5028-299-0x00007FF6CB720000-0x00007FF6CBB12000-memory.dmp	xmrig
behavioral2/memory/4904-296-0x00007FF605CC0000-0x00007FF6060B2000-memory.dmp	xmrig
behavioral2/memory/4956-261-0x00007FF6A9360000-0x00007FF6A9752000-memory.dmp	xmrig
behavioral2/memory/2592-260-0x00007FF7847E0000-0x00007FF784BD2000-memory.dmp	xmrig
behavioral2/memory/928-231-0x00007FF7A1E10000-0x00007FF7A2202000-memory.dmp	xmrig
behavioral2/memory/4460-197-0x00007FF6379C0000-0x00007FF637DB2000-memory.dmp	xmrig
behavioral2/memory/3112-168-0x00007FF759D60000-0x00007FF75A152000-memory.dmp	xmrig
behavioral2/memory/400-127-0x00007FF6D38B0000-0x00007FF6D3CA2000-memory.dmp	xmrig
behavioral2/memory/2888-94-0x00007FF77A670000-0x00007FF77AA62000-memory.dmp	xmrig
behavioral2/memory/2308-73-0x00007FF602C00000-0x00007FF602FF2000-memory.dmp	xmrig
behavioral2/memory/2508-2849-0x00007FF7B2110000-0x00007FF7B2502000-memory.dmp	xmrig
behavioral2/memory/2308-2851-0x00007FF602C00000-0x00007FF602FF2000-memory.dmp	xmrig
behavioral2/memory/1252-2853-0x00007FF740240000-0x00007FF740632000-memory.dmp	xmrig
behavioral2/memory/2888-2862-0x00007FF77A670000-0x00007FF77AA62000-memory.dmp	xmrig
behavioral2/memory/4460-2863-0x00007FF6379C0000-0x00007FF637DB2000-memory.dmp	xmrig
behavioral2/memory/3108-2865-0x00007FF76A480000-0x00007FF76A872000-memory.dmp	xmrig
behavioral2/memory/400-2867-0x00007FF6D38B0000-0x00007FF6D3CA2000-memory.dmp	xmrig
behavioral2/memory/3112-2860-0x00007FF759D60000-0x00007FF75A152000-memory.dmp	xmrig
behavioral2/memory/2464-2858-0x00007FF6E8B10000-0x00007FF6E8F02000-memory.dmp	xmrig
behavioral2/memory/4904-2856-0x00007FF605CC0000-0x00007FF6060B2000-memory.dmp	xmrig
behavioral2/memory/4956-2872-0x00007FF6A9360000-0x00007FF6A9752000-memory.dmp	xmrig
behavioral2/memory/3352-2900-0x00007FF639170000-0x00007FF639562000-memory.dmp	xmrig
behavioral2/memory/1640-2902-0x00007FF7259F0000-0x00007FF725DE2000-memory.dmp	xmrig
behavioral2/memory/5028-2898-0x00007FF6CB720000-0x00007FF6CBB12000-memory.dmp	xmrig
behavioral2/memory/1520-2877-0x00007FF77F280000-0x00007FF77F672000-memory.dmp	xmrig
behavioral2/memory/2360-2895-0x00007FF72DEB0000-0x00007FF72E2A2000-memory.dmp	xmrig
behavioral2/memory/2344-2892-0x00007FF67C8A0000-0x00007FF67CC92000-memory.dmp	xmrig
behavioral2/memory/2592-2887-0x00007FF7847E0000-0x00007FF784BD2000-memory.dmp	xmrig
behavioral2/memory/1752-2883-0x00007FF78B860000-0x00007FF78BC52000-memory.dmp	xmrig
behavioral2/memory/928-2879-0x00007FF7A1E10000-0x00007FF7A2202000-memory.dmp	xmrig
behavioral2/memory/3644-2873-0x00007FF7494E0000-0x00007FF7498D2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2508	BCYsRWv.exe
1252	mNvwCSH.exe
2308	gghdyFr.exe
2888	vVRRvtf.exe
400	bPCEAjU.exe
3112	ntVifQH.exe
4460	EUiIgol.exe
1520	zTCKqMj.exe
928	GiysNgS.exe
2592	CEphpwa.exe
4956	xAXRbKL.exe
2464	lmAgMfF.exe
4904	GCosOht.exe
5028	GVcbptw.exe
1752	gSeJvKg.exe
3108	gWKNSvE.exe
1640	LEiAsQr.exe
3352	ttPRaqf.exe
3644	ZdaaBMo.exe
2360	suNjgHL.exe
2344	UHAykgr.exe
4248	PGacVOq.exe
2240	fvvNqaO.exe
1472	tXkHlHe.exe
1532	jGOTmEK.exe
3960	OrwSjsW.exe
1744	KGPMmuS.exe
4704	gOKpSeA.exe
2968	zYMPFYp.exe
1636	TOmMzlQ.exe
2232	QdBXzJD.exe
1976	daGGrIs.exe
5000	DMErxUa.exe
1304	uytcTKi.exe
3916	gXYLGBk.exe
3088	JItMnjd.exe
4368	XPLRLpv.exe
4756	VhAfCzE.exe
3068	jprZXgS.exe
3212	dLvySHX.exe
4832	mIJRXCk.exe
1644	zmsjISp.exe
1248	YFiVoqB.exe
392	weMQRzT.exe
1632	CJsMRwp.exe
3432	RwPvfVh.exe
2640	FxhBfOt.exe
4580	tCMIHwp.exe
3648	fLFwxbq.exe
1596	ywgdXYo.exe
1332	aQUTSxR.exe
4400	jnYaHAx.exe
1588	gMrTRum.exe
3668	DAkkppD.exe
3980	ucrVxex.exe
4356	uUnlOeL.exe
64	lyyhcbf.exe
436	lXZDyJm.exe
2408	DlJHFvn.exe
4988	RrPqoBB.exe
2632	LuQDlUA.exe
3832	NgAetth.exe
3720	xumkRvb.exe
4448	zAxtgre.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/536-0-0x00007FF64B960000-0x00007FF64BD52000-memory.dmp	upx
behavioral2/files/0x000a000000023ba6-10.dat	upx
behavioral2/files/0x000a000000023ba9-23.dat	upx
behavioral2/files/0x000a000000023bb9-110.dat	upx
behavioral2/files/0x000a000000023bab-136.dat	upx
behavioral2/files/0x000a000000023bc3-185.dat	upx
behavioral2/memory/2464-273-0x00007FF6E8B10000-0x00007FF6E8F02000-memory.dmp	upx
behavioral2/memory/3352-340-0x00007FF639170000-0x00007FF639562000-memory.dmp	upx
behavioral2/memory/3644-347-0x00007FF7494E0000-0x00007FF7498D2000-memory.dmp	upx
behavioral2/memory/2360-382-0x00007FF72DEB0000-0x00007FF72E2A2000-memory.dmp	upx
behavioral2/memory/1520-395-0x00007FF77F280000-0x00007FF77F672000-memory.dmp	upx
behavioral2/memory/2344-430-0x00007FF67C8A0000-0x00007FF67CC92000-memory.dmp	upx
behavioral2/memory/1752-422-0x00007FF78B860000-0x00007FF78BC52000-memory.dmp	upx
behavioral2/memory/1252-394-0x00007FF740240000-0x00007FF740632000-memory.dmp	upx
behavioral2/memory/2508-386-0x00007FF7B2110000-0x00007FF7B2502000-memory.dmp	upx
behavioral2/memory/1640-339-0x00007FF7259F0000-0x00007FF725DE2000-memory.dmp	upx
behavioral2/memory/3108-331-0x00007FF76A480000-0x00007FF76A872000-memory.dmp	upx
behavioral2/memory/5028-299-0x00007FF6CB720000-0x00007FF6CBB12000-memory.dmp	upx
behavioral2/memory/4904-296-0x00007FF605CC0000-0x00007FF6060B2000-memory.dmp	upx
behavioral2/memory/4956-261-0x00007FF6A9360000-0x00007FF6A9752000-memory.dmp	upx
behavioral2/memory/2592-260-0x00007FF7847E0000-0x00007FF784BD2000-memory.dmp	upx
behavioral2/memory/928-231-0x00007FF7A1E10000-0x00007FF7A2202000-memory.dmp	upx
behavioral2/files/0x000a000000023bca-184.dat	upx
behavioral2/files/0x000a000000023bc9-183.dat	upx
behavioral2/files/0x000a000000023bc8-182.dat	upx
behavioral2/memory/4460-197-0x00007FF6379C0000-0x00007FF637DB2000-memory.dmp	upx
behavioral2/files/0x000a000000023bc6-172.dat	upx
behavioral2/files/0x000a000000023bc5-170.dat	upx
behavioral2/memory/3112-168-0x00007FF759D60000-0x00007FF75A152000-memory.dmp	upx
behavioral2/files/0x000a000000023bc4-167.dat	upx
behavioral2/files/0x000a000000023bbc-166.dat	upx
behavioral2/files/0x000a000000023bc2-159.dat	upx
behavioral2/files/0x000a000000023bc1-155.dat	upx
behavioral2/files/0x0031000000023bb7-151.dat	upx
behavioral2/files/0x0031000000023bb6-147.dat	upx
behavioral2/files/0x000a000000023bc0-142.dat	upx
behavioral2/files/0x000a000000023bbf-135.dat	upx
behavioral2/files/0x000a000000023bbe-134.dat	upx
behavioral2/files/0x000a000000023bbd-133.dat	upx
behavioral2/memory/400-127-0x00007FF6D38B0000-0x00007FF6D3CA2000-memory.dmp	upx
behavioral2/files/0x000a000000023bbb-119.dat	upx
behavioral2/files/0x000a000000023bba-118.dat	upx
behavioral2/files/0x000a000000023bb8-115.dat	upx
behavioral2/files/0x000a000000023baf-146.dat	upx
behavioral2/files/0x0031000000023bb5-106.dat	upx
behavioral2/files/0x000a000000023bae-103.dat	upx
behavioral2/files/0x000a000000023bb3-98.dat	upx
behavioral2/memory/2888-94-0x00007FF77A670000-0x00007FF77AA62000-memory.dmp	upx
behavioral2/files/0x000a000000023bb2-89.dat	upx
behavioral2/files/0x000a000000023bb4-81.dat	upx
behavioral2/files/0x000a000000023bad-96.dat	upx
behavioral2/memory/2308-73-0x00007FF602C00000-0x00007FF602FF2000-memory.dmp	upx
behavioral2/files/0x000a000000023bb1-68.dat	upx
behavioral2/files/0x000a000000023bb0-67.dat	upx
behavioral2/files/0x000a000000023baa-49.dat	upx
behavioral2/files/0x000a000000023bac-38.dat	upx
behavioral2/files/0x000a000000023ba8-46.dat	upx
behavioral2/files/0x000a000000023ba7-16.dat	upx
behavioral2/files/0x000c000000023b48-11.dat	upx
behavioral2/memory/2508-2849-0x00007FF7B2110000-0x00007FF7B2502000-memory.dmp	upx
behavioral2/memory/2308-2851-0x00007FF602C00000-0x00007FF602FF2000-memory.dmp	upx
behavioral2/memory/1252-2853-0x00007FF740240000-0x00007FF740632000-memory.dmp	upx
behavioral2/memory/2888-2862-0x00007FF77A670000-0x00007FF77AA62000-memory.dmp	upx
behavioral2/memory/4460-2863-0x00007FF6379C0000-0x00007FF637DB2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\DMErxUa.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\ldNTwqv.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\wzCrpTB.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\SHRqmFx.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\jdgtkzH.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\shVHQDk.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\qpBKxOr.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\lXnufsU.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\hlVfvaZ.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\DvNccHW.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\tBoIRUe.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\Itdxmvf.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\BIbUwns.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\ttPRaqf.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\Eoybzta.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\TUNeAhY.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\AlPkEUL.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\jnRTGCA.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\NdJWZjz.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\IdCKbGt.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\oprkqTF.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\THhObWA.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\yPWRAcV.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\eGzPNPC.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\uUnlOeL.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\DcjudwU.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\ALwPcud.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\zNPWzEz.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\qBfDPhT.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\ueDiOsH.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\JwrRNjM.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\JrXDBeT.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\DzPKQAk.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\KRFJHoN.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\UMxXrmN.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\qRjhRYh.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\ezhZvqm.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\zaHawLo.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\FAiIoNj.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\jglLlWG.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\SDANoqi.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\lGPiLWD.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\Iofuqxy.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\vbDacyi.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\wzvDZql.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\XUeUSaA.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\RfosXCz.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\JJawOnk.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\WQMRaMM.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\LrzJtAt.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\NmqZwzU.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\HwqhETx.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\lBYAjXc.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\fxmJCwL.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\FsqhyWP.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\xByIFgK.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\TkWJTsM.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\RIrndEC.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\bOuBmeN.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\bpjoMjG.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\WoKaXhx.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\vUCqiGN.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\MxrXuyh.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\Jqildoe.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2776	powershell.exe
2776	powershell.exe
2776	powershell.exe
2776	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
Token: SeDebugPrivilege	2776	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 2776	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	84
PID 536 wrote to memory of 2776	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	84
PID 536 wrote to memory of 2508	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	85
PID 536 wrote to memory of 2508	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	85
PID 536 wrote to memory of 1252	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	86
PID 536 wrote to memory of 1252	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	86
PID 536 wrote to memory of 2308	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	87
PID 536 wrote to memory of 2308	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	87
PID 536 wrote to memory of 2888	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	88
PID 536 wrote to memory of 2888	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	88
PID 536 wrote to memory of 400	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	89
PID 536 wrote to memory of 400	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	89
PID 536 wrote to memory of 3112	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	90
PID 536 wrote to memory of 3112	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	90
PID 536 wrote to memory of 2592	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	91
PID 536 wrote to memory of 2592	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	91
PID 536 wrote to memory of 4460	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	92
PID 536 wrote to memory of 4460	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	92
PID 536 wrote to memory of 1520	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	93
PID 536 wrote to memory of 1520	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	93
PID 536 wrote to memory of 928	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	94
PID 536 wrote to memory of 928	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	94
PID 536 wrote to memory of 4956	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	95
PID 536 wrote to memory of 4956	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	95
PID 536 wrote to memory of 2464	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	96
PID 536 wrote to memory of 2464	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	96
PID 536 wrote to memory of 4904	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	97
PID 536 wrote to memory of 4904	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	97
PID 536 wrote to memory of 5028	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	98
PID 536 wrote to memory of 5028	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	98
PID 536 wrote to memory of 1752	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	99
PID 536 wrote to memory of 1752	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	99
PID 536 wrote to memory of 3108	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	100
PID 536 wrote to memory of 3108	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	100
PID 536 wrote to memory of 1640	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	101
PID 536 wrote to memory of 1640	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	101
PID 536 wrote to memory of 3352	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	102
PID 536 wrote to memory of 3352	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	102
PID 536 wrote to memory of 3644	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	103
PID 536 wrote to memory of 3644	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	103
PID 536 wrote to memory of 2360	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	104
PID 536 wrote to memory of 2360	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	104
PID 536 wrote to memory of 2344	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	105
PID 536 wrote to memory of 2344	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	105
PID 536 wrote to memory of 4248	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	106
PID 536 wrote to memory of 4248	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	106
PID 536 wrote to memory of 2240	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	107
PID 536 wrote to memory of 2240	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	107
PID 536 wrote to memory of 1472	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	108
PID 536 wrote to memory of 1472	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	108
PID 536 wrote to memory of 1532	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	109
PID 536 wrote to memory of 1532	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	109
PID 536 wrote to memory of 3960	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	110
PID 536 wrote to memory of 3960	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	110
PID 536 wrote to memory of 1744	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	111
PID 536 wrote to memory of 1744	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	111
PID 536 wrote to memory of 4704	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	112
PID 536 wrote to memory of 4704	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	112
PID 536 wrote to memory of 2968	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	113
PID 536 wrote to memory of 2968	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	113
PID 536 wrote to memory of 1636	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	114
PID 536 wrote to memory of 1636	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	114
PID 536 wrote to memory of 2232	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	115
PID 536 wrote to memory of 2232	536	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2776
- C:\Windows\System\BCYsRWv.exe
  C:\Windows\System\BCYsRWv.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\mNvwCSH.exe
  C:\Windows\System\mNvwCSH.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\gghdyFr.exe
  C:\Windows\System\gghdyFr.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\vVRRvtf.exe
  C:\Windows\System\vVRRvtf.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\bPCEAjU.exe
  C:\Windows\System\bPCEAjU.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\ntVifQH.exe
  C:\Windows\System\ntVifQH.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\CEphpwa.exe
  C:\Windows\System\CEphpwa.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\EUiIgol.exe
  C:\Windows\System\EUiIgol.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\zTCKqMj.exe
  C:\Windows\System\zTCKqMj.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\GiysNgS.exe
  C:\Windows\System\GiysNgS.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\xAXRbKL.exe
  C:\Windows\System\xAXRbKL.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\lmAgMfF.exe
  C:\Windows\System\lmAgMfF.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\GCosOht.exe
  C:\Windows\System\GCosOht.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\GVcbptw.exe
  C:\Windows\System\GVcbptw.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\gSeJvKg.exe
  C:\Windows\System\gSeJvKg.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\gWKNSvE.exe
  C:\Windows\System\gWKNSvE.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\LEiAsQr.exe
  C:\Windows\System\LEiAsQr.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\ttPRaqf.exe
  C:\Windows\System\ttPRaqf.exe
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Windows\System\ZdaaBMo.exe
  C:\Windows\System\ZdaaBMo.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\suNjgHL.exe
  C:\Windows\System\suNjgHL.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\UHAykgr.exe
  C:\Windows\System\UHAykgr.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\PGacVOq.exe
  C:\Windows\System\PGacVOq.exe
  2⤵
  - Executes dropped EXE
  PID:4248
- C:\Windows\System\fvvNqaO.exe
  C:\Windows\System\fvvNqaO.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\tXkHlHe.exe
  C:\Windows\System\tXkHlHe.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\jGOTmEK.exe
  C:\Windows\System\jGOTmEK.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\OrwSjsW.exe
  C:\Windows\System\OrwSjsW.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\KGPMmuS.exe
  C:\Windows\System\KGPMmuS.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\gOKpSeA.exe
  C:\Windows\System\gOKpSeA.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\zYMPFYp.exe
  C:\Windows\System\zYMPFYp.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\TOmMzlQ.exe
  C:\Windows\System\TOmMzlQ.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\QdBXzJD.exe
  C:\Windows\System\QdBXzJD.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\daGGrIs.exe
  C:\Windows\System\daGGrIs.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\DMErxUa.exe
  C:\Windows\System\DMErxUa.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\uytcTKi.exe
  C:\Windows\System\uytcTKi.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\zmsjISp.exe
  C:\Windows\System\zmsjISp.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\gXYLGBk.exe
  C:\Windows\System\gXYLGBk.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\JItMnjd.exe
  C:\Windows\System\JItMnjd.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\XPLRLpv.exe
  C:\Windows\System\XPLRLpv.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\VhAfCzE.exe
  C:\Windows\System\VhAfCzE.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\jprZXgS.exe
  C:\Windows\System\jprZXgS.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\dLvySHX.exe
  C:\Windows\System\dLvySHX.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\mIJRXCk.exe
  C:\Windows\System\mIJRXCk.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\YFiVoqB.exe
  C:\Windows\System\YFiVoqB.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\weMQRzT.exe
  C:\Windows\System\weMQRzT.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\CJsMRwp.exe
  C:\Windows\System\CJsMRwp.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\DlJHFvn.exe
  C:\Windows\System\DlJHFvn.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\RwPvfVh.exe
  C:\Windows\System\RwPvfVh.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\NgAetth.exe
  C:\Windows\System\NgAetth.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System\FxhBfOt.exe
  C:\Windows\System\FxhBfOt.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\tCMIHwp.exe
  C:\Windows\System\tCMIHwp.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\fLFwxbq.exe
  C:\Windows\System\fLFwxbq.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\ywgdXYo.exe
  C:\Windows\System\ywgdXYo.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\aQUTSxR.exe
  C:\Windows\System\aQUTSxR.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\jnYaHAx.exe
  C:\Windows\System\jnYaHAx.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\gMrTRum.exe
  C:\Windows\System\gMrTRum.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\DAkkppD.exe
  C:\Windows\System\DAkkppD.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\ucrVxex.exe
  C:\Windows\System\ucrVxex.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\uUnlOeL.exe
  C:\Windows\System\uUnlOeL.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\lyyhcbf.exe
  C:\Windows\System\lyyhcbf.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\lXZDyJm.exe
  C:\Windows\System\lXZDyJm.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\RrPqoBB.exe
  C:\Windows\System\RrPqoBB.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\LuQDlUA.exe
  C:\Windows\System\LuQDlUA.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\xumkRvb.exe
  C:\Windows\System\xumkRvb.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\zAxtgre.exe
  C:\Windows\System\zAxtgre.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\ikQMMEs.exe
  C:\Windows\System\ikQMMEs.exe
  2⤵
  PID:2900
- C:\Windows\System\qViCaLY.exe
  C:\Windows\System\qViCaLY.exe
  2⤵
  PID:4968
- C:\Windows\System\nZynWKk.exe
  C:\Windows\System\nZynWKk.exe
  2⤵
  PID:2052
- C:\Windows\System\HBuMLbB.exe
  C:\Windows\System\HBuMLbB.exe
  2⤵
  PID:1156
- C:\Windows\System\kJmdkDh.exe
  C:\Windows\System\kJmdkDh.exe
  2⤵
  PID:4972
- C:\Windows\System\fNRKUgC.exe
  C:\Windows\System\fNRKUgC.exe
  2⤵
  PID:516
- C:\Windows\System\XNAEVPg.exe
  C:\Windows\System\XNAEVPg.exe
  2⤵
  PID:2904
- C:\Windows\System\bpVrzTp.exe
  C:\Windows\System\bpVrzTp.exe
  2⤵
  PID:5132
- C:\Windows\System\yfsOxFb.exe
  C:\Windows\System\yfsOxFb.exe
  2⤵
  PID:5160
- C:\Windows\System\SxEyxNT.exe
  C:\Windows\System\SxEyxNT.exe
  2⤵
  PID:5176
- C:\Windows\System\NvEOjmd.exe
  C:\Windows\System\NvEOjmd.exe
  2⤵
  PID:5192
- C:\Windows\System\scGuqgb.exe
  C:\Windows\System\scGuqgb.exe
  2⤵
  PID:5216
- C:\Windows\System\QOLmyQl.exe
  C:\Windows\System\QOLmyQl.exe
  2⤵
  PID:5240
- C:\Windows\System\zNRiBkV.exe
  C:\Windows\System\zNRiBkV.exe
  2⤵
  PID:5268
- C:\Windows\System\WPVyWmL.exe
  C:\Windows\System\WPVyWmL.exe
  2⤵
  PID:5292
- C:\Windows\System\uknlTcT.exe
  C:\Windows\System\uknlTcT.exe
  2⤵
  PID:5324
- C:\Windows\System\njWkOQB.exe
  C:\Windows\System\njWkOQB.exe
  2⤵
  PID:5344
- C:\Windows\System\YfCrmQB.exe
  C:\Windows\System\YfCrmQB.exe
  2⤵
  PID:5360
- C:\Windows\System\xOFJfYj.exe
  C:\Windows\System\xOFJfYj.exe
  2⤵
  PID:5380
- C:\Windows\System\cEQUGJr.exe
  C:\Windows\System\cEQUGJr.exe
  2⤵
  PID:5396
- C:\Windows\System\DbHIDLs.exe
  C:\Windows\System\DbHIDLs.exe
  2⤵
  PID:5416
- C:\Windows\System\yeOhdFu.exe
  C:\Windows\System\yeOhdFu.exe
  2⤵
  PID:5436
- C:\Windows\System\XlHdXkR.exe
  C:\Windows\System\XlHdXkR.exe
  2⤵
  PID:5456
- C:\Windows\System\zaHawLo.exe
  C:\Windows\System\zaHawLo.exe
  2⤵
  PID:5476
- C:\Windows\System\tLOkdUk.exe
  C:\Windows\System\tLOkdUk.exe
  2⤵
  PID:5516
- C:\Windows\System\TeAIOMg.exe
  C:\Windows\System\TeAIOMg.exe
  2⤵
  PID:5676
- C:\Windows\System\XcaYzQx.exe
  C:\Windows\System\XcaYzQx.exe
  2⤵
  PID:5740
- C:\Windows\System\nAoBcKY.exe
  C:\Windows\System\nAoBcKY.exe
  2⤵
  PID:5764
- C:\Windows\System\vyIQwzy.exe
  C:\Windows\System\vyIQwzy.exe
  2⤵
  PID:5804
- C:\Windows\System\IbQEvHT.exe
  C:\Windows\System\IbQEvHT.exe
  2⤵
  PID:5844
- C:\Windows\System\HmtUJjK.exe
  C:\Windows\System\HmtUJjK.exe
  2⤵
  PID:5860
- C:\Windows\System\ddHsqtb.exe
  C:\Windows\System\ddHsqtb.exe
  2⤵
  PID:5876
- C:\Windows\System\rIGpAZG.exe
  C:\Windows\System\rIGpAZG.exe
  2⤵
  PID:5892
- C:\Windows\System\fZTPBQn.exe
  C:\Windows\System\fZTPBQn.exe
  2⤵
  PID:5908
- C:\Windows\System\GJgxazm.exe
  C:\Windows\System\GJgxazm.exe
  2⤵
  PID:5924
- C:\Windows\System\nVnErPt.exe
  C:\Windows\System\nVnErPt.exe
  2⤵
  PID:5940
- C:\Windows\System\cbBvbBf.exe
  C:\Windows\System\cbBvbBf.exe
  2⤵
  PID:5956
- C:\Windows\System\alNXEdx.exe
  C:\Windows\System\alNXEdx.exe
  2⤵
  PID:5980
- C:\Windows\System\LCbTZLK.exe
  C:\Windows\System\LCbTZLK.exe
  2⤵
  PID:3344
- C:\Windows\System\GtxFPjm.exe
  C:\Windows\System\GtxFPjm.exe
  2⤵
  PID:3240
- C:\Windows\System\JDyLDFo.exe
  C:\Windows\System\JDyLDFo.exe
  2⤵
  PID:1624
- C:\Windows\System\ZwwVqey.exe
  C:\Windows\System\ZwwVqey.exe
  2⤵
  PID:3196
- C:\Windows\System\LpozYVb.exe
  C:\Windows\System\LpozYVb.exe
  2⤵
  PID:2724
- C:\Windows\System\FTSzNJi.exe
  C:\Windows\System\FTSzNJi.exe
  2⤵
  PID:4672
- C:\Windows\System\gsSKKDN.exe
  C:\Windows\System\gsSKKDN.exe
  2⤵
  PID:1104
- C:\Windows\System\tNemkbp.exe
  C:\Windows\System\tNemkbp.exe
  2⤵
  PID:4208
- C:\Windows\System\ODJHCgT.exe
  C:\Windows\System\ODJHCgT.exe
  2⤵
  PID:4784
- C:\Windows\System\hSuYZou.exe
  C:\Windows\System\hSuYZou.exe
  2⤵
  PID:4236
- C:\Windows\System\otHcVSS.exe
  C:\Windows\System\otHcVSS.exe
  2⤵
  PID:2100
- C:\Windows\System\MjKaxaL.exe
  C:\Windows\System\MjKaxaL.exe
  2⤵
  PID:3136
- C:\Windows\System\XkLuMfN.exe
  C:\Windows\System\XkLuMfN.exe
  2⤵
  PID:1440
- C:\Windows\System\qYVxZGM.exe
  C:\Windows\System\qYVxZGM.exe
  2⤵
  PID:5736
- C:\Windows\System\nZoEEiL.exe
  C:\Windows\System\nZoEEiL.exe
  2⤵
  PID:5780
- C:\Windows\System\dlRZjGI.exe
  C:\Windows\System\dlRZjGI.exe
  2⤵
  PID:5812
- C:\Windows\System\eWXwspO.exe
  C:\Windows\System\eWXwspO.exe
  2⤵
  PID:6128
- C:\Windows\System\MeyVNxI.exe
  C:\Windows\System\MeyVNxI.exe
  2⤵
  PID:5900
- C:\Windows\System\RVLqmTQ.exe
  C:\Windows\System\RVLqmTQ.exe
  2⤵
  PID:5948
- C:\Windows\System\QXLcNIM.exe
  C:\Windows\System\QXLcNIM.exe
  2⤵
  PID:2680
- C:\Windows\System\QtSDwnA.exe
  C:\Windows\System\QtSDwnA.exe
  2⤵
  PID:6092
- C:\Windows\System\dxsTyKX.exe
  C:\Windows\System\dxsTyKX.exe
  2⤵
  PID:6124
- C:\Windows\System\mhuqcoi.exe
  C:\Windows\System\mhuqcoi.exe
  2⤵
  PID:3984
- C:\Windows\System\RfeITLY.exe
  C:\Windows\System\RfeITLY.exe
  2⤵
  PID:2896
- C:\Windows\System\UNnAPNZ.exe
  C:\Windows\System\UNnAPNZ.exe
  2⤵
  PID:4684
- C:\Windows\System\RUndDav.exe
  C:\Windows\System\RUndDav.exe
  2⤵
  PID:3580
- C:\Windows\System\BPcZnEj.exe
  C:\Windows\System\BPcZnEj.exe
  2⤵
  PID:1060
- C:\Windows\System\GyChSxB.exe
  C:\Windows\System\GyChSxB.exe
  2⤵
  PID:3904
- C:\Windows\System\WUxMwvI.exe
  C:\Windows\System\WUxMwvI.exe
  2⤵
  PID:5232
- C:\Windows\System\tpDoskZ.exe
  C:\Windows\System\tpDoskZ.exe
  2⤵
  PID:5368
- C:\Windows\System\NqnNXaV.exe
  C:\Windows\System\NqnNXaV.exe
  2⤵
  PID:3456
- C:\Windows\System\ycAsKzP.exe
  C:\Windows\System\ycAsKzP.exe
  2⤵
  PID:4396
- C:\Windows\System\vSHxCsr.exe
  C:\Windows\System\vSHxCsr.exe
  2⤵
  PID:1880
- C:\Windows\System\BwJKUGV.exe
  C:\Windows\System\BwJKUGV.exe
  2⤵
  PID:3092
- C:\Windows\System\wTjwsUR.exe
  C:\Windows\System\wTjwsUR.exe
  2⤵
  PID:4184
- C:\Windows\System\DVUPuHL.exe
  C:\Windows\System\DVUPuHL.exe
  2⤵
  PID:2936
- C:\Windows\System\yAzKOrl.exe
  C:\Windows\System\yAzKOrl.exe
  2⤵
  PID:3732
- C:\Windows\System\iNvSlDo.exe
  C:\Windows\System\iNvSlDo.exe
  2⤵
  PID:4748
- C:\Windows\System\KXgEgmp.exe
  C:\Windows\System\KXgEgmp.exe
  2⤵
  PID:3712
- C:\Windows\System\fqavudQ.exe
  C:\Windows\System\fqavudQ.exe
  2⤵
  PID:4688
- C:\Windows\System\FwdxRoL.exe
  C:\Windows\System\FwdxRoL.exe
  2⤵
  PID:3204
- C:\Windows\System\wPFhLZi.exe
  C:\Windows\System\wPFhLZi.exe
  2⤵
  PID:3776
- C:\Windows\System\llaaADF.exe
  C:\Windows\System\llaaADF.exe
  2⤵
  PID:872
- C:\Windows\System\IDjMtHv.exe
  C:\Windows\System\IDjMtHv.exe
  2⤵
  PID:5576
- C:\Windows\System\FRqjrgm.exe
  C:\Windows\System\FRqjrgm.exe
  2⤵
  PID:5968
- C:\Windows\System\DiHOgzW.exe
  C:\Windows\System\DiHOgzW.exe
  2⤵
  PID:1492
- C:\Windows\System\exEGdHo.exe
  C:\Windows\System\exEGdHo.exe
  2⤵
  PID:5852
- C:\Windows\System\XVZypHL.exe
  C:\Windows\System\XVZypHL.exe
  2⤵
  PID:5916
- C:\Windows\System\XTCjcRG.exe
  C:\Windows\System\XTCjcRG.exe
  2⤵
  PID:2272
- C:\Windows\System\FcwrdXF.exe
  C:\Windows\System\FcwrdXF.exe
  2⤵
  PID:4876
- C:\Windows\System\mwFHcrD.exe
  C:\Windows\System\mwFHcrD.exe
  2⤵
  PID:716
- C:\Windows\System\gOgFxTm.exe
  C:\Windows\System\gOgFxTm.exe
  2⤵
  PID:5252
- C:\Windows\System\IJOUSPI.exe
  C:\Windows\System\IJOUSPI.exe
  2⤵
  PID:3028
- C:\Windows\System\BevSflG.exe
  C:\Windows\System\BevSflG.exe
  2⤵
  PID:5352
- C:\Windows\System\tDRcRzr.exe
  C:\Windows\System\tDRcRzr.exe
  2⤵
  PID:1088
- C:\Windows\System\fEaWIjb.exe
  C:\Windows\System\fEaWIjb.exe
  2⤵
  PID:4820
- C:\Windows\System\SjczQsX.exe
  C:\Windows\System\SjczQsX.exe
  2⤵
  PID:4676
- C:\Windows\System\izdJFiG.exe
  C:\Windows\System\izdJFiG.exe
  2⤵
  PID:2212
- C:\Windows\System\RIohDgw.exe
  C:\Windows\System\RIohDgw.exe
  2⤵
  PID:2532
- C:\Windows\System\whKgRNH.exe
  C:\Windows\System\whKgRNH.exe
  2⤵
  PID:5888
- C:\Windows\System\ZHBmlHd.exe
  C:\Windows\System\ZHBmlHd.exe
  2⤵
  PID:3008
- C:\Windows\System\xTGbICA.exe
  C:\Windows\System\xTGbICA.exe
  2⤵
  PID:6160
- C:\Windows\System\UJAYxal.exe
  C:\Windows\System\UJAYxal.exe
  2⤵
  PID:6176
- C:\Windows\System\ACSbubh.exe
  C:\Windows\System\ACSbubh.exe
  2⤵
  PID:6196
- C:\Windows\System\wQlotNi.exe
  C:\Windows\System\wQlotNi.exe
  2⤵
  PID:6228
- C:\Windows\System\hXEDCHe.exe
  C:\Windows\System\hXEDCHe.exe
  2⤵
  PID:6252
- C:\Windows\System\wDcQMBb.exe
  C:\Windows\System\wDcQMBb.exe
  2⤵
  PID:6276
- C:\Windows\System\olcMvBI.exe
  C:\Windows\System\olcMvBI.exe
  2⤵
  PID:6304
- C:\Windows\System\PXwpOku.exe
  C:\Windows\System\PXwpOku.exe
  2⤵
  PID:6328
- C:\Windows\System\IxHLOtD.exe
  C:\Windows\System\IxHLOtD.exe
  2⤵
  PID:6348
- C:\Windows\System\ulKrNJY.exe
  C:\Windows\System\ulKrNJY.exe
  2⤵
  PID:6376
- C:\Windows\System\majjXBA.exe
  C:\Windows\System\majjXBA.exe
  2⤵
  PID:6396
- C:\Windows\System\VWOIhxe.exe
  C:\Windows\System\VWOIhxe.exe
  2⤵
  PID:6416
- C:\Windows\System\SDxVATj.exe
  C:\Windows\System\SDxVATj.exe
  2⤵
  PID:6444
- C:\Windows\System\puxUvvY.exe
  C:\Windows\System\puxUvvY.exe
  2⤵
  PID:6464
- C:\Windows\System\guGyNth.exe
  C:\Windows\System\guGyNth.exe
  2⤵
  PID:6484
- C:\Windows\System\sCnIWeg.exe
  C:\Windows\System\sCnIWeg.exe
  2⤵
  PID:6508
- C:\Windows\System\IdCKbGt.exe
  C:\Windows\System\IdCKbGt.exe
  2⤵
  PID:6532
- C:\Windows\System\dHGPdYV.exe
  C:\Windows\System\dHGPdYV.exe
  2⤵
  PID:6552
- C:\Windows\System\NmqZwzU.exe
  C:\Windows\System\NmqZwzU.exe
  2⤵
  PID:6576
- C:\Windows\System\eRGifTT.exe
  C:\Windows\System\eRGifTT.exe
  2⤵
  PID:6596
- C:\Windows\System\nnxKHpd.exe
  C:\Windows\System\nnxKHpd.exe
  2⤵
  PID:6624
- C:\Windows\System\gmmprLY.exe
  C:\Windows\System\gmmprLY.exe
  2⤵
  PID:6648
- C:\Windows\System\ARwbbCb.exe
  C:\Windows\System\ARwbbCb.exe
  2⤵
  PID:6668
- C:\Windows\System\zDnkXkh.exe
  C:\Windows\System\zDnkXkh.exe
  2⤵
  PID:6692
- C:\Windows\System\EMSJQCp.exe
  C:\Windows\System\EMSJQCp.exe
  2⤵
  PID:6712
- C:\Windows\System\QgiizLe.exe
  C:\Windows\System\QgiizLe.exe
  2⤵
  PID:6740
- C:\Windows\System\SUEynol.exe
  C:\Windows\System\SUEynol.exe
  2⤵
  PID:6760
- C:\Windows\System\WQMRaMM.exe
  C:\Windows\System\WQMRaMM.exe
  2⤵
  PID:6784
- C:\Windows\System\YaanItM.exe
  C:\Windows\System\YaanItM.exe
  2⤵
  PID:6812
- C:\Windows\System\LNrYihw.exe
  C:\Windows\System\LNrYihw.exe
  2⤵
  PID:6832
- C:\Windows\System\HeJmcul.exe
  C:\Windows\System\HeJmcul.exe
  2⤵
  PID:6852
- C:\Windows\System\CUVxtYD.exe
  C:\Windows\System\CUVxtYD.exe
  2⤵
  PID:6876
- C:\Windows\System\GBYpOKe.exe
  C:\Windows\System\GBYpOKe.exe
  2⤵
  PID:6900
- C:\Windows\System\HQiohic.exe
  C:\Windows\System\HQiohic.exe
  2⤵
  PID:6920
- C:\Windows\System\zXvucoe.exe
  C:\Windows\System\zXvucoe.exe
  2⤵
  PID:6952
- C:\Windows\System\GXdigHk.exe
  C:\Windows\System\GXdigHk.exe
  2⤵
  PID:6972
- C:\Windows\System\NJTckdR.exe
  C:\Windows\System\NJTckdR.exe
  2⤵
  PID:7000
- C:\Windows\System\QQBmoVR.exe
  C:\Windows\System\QQBmoVR.exe
  2⤵
  PID:7020
- C:\Windows\System\JclzTRO.exe
  C:\Windows\System\JclzTRO.exe
  2⤵
  PID:7060
- C:\Windows\System\AbnlXPa.exe
  C:\Windows\System\AbnlXPa.exe
  2⤵
  PID:7076
- C:\Windows\System\bDMLxMa.exe
  C:\Windows\System\bDMLxMa.exe
  2⤵
  PID:7104
- C:\Windows\System\RrLYFEI.exe
  C:\Windows\System\RrLYFEI.exe
  2⤵
  PID:7132
- C:\Windows\System\JCnIvkB.exe
  C:\Windows\System\JCnIvkB.exe
  2⤵
  PID:7152
- C:\Windows\System\shwcqVF.exe
  C:\Windows\System\shwcqVF.exe
  2⤵
  PID:4228
- C:\Windows\System\LZCvFeU.exe
  C:\Windows\System\LZCvFeU.exe
  2⤵
  PID:6192
- C:\Windows\System\qTtwDbe.exe
  C:\Windows\System\qTtwDbe.exe
  2⤵
  PID:3060
- C:\Windows\System\kJOQDFQ.exe
  C:\Windows\System\kJOQDFQ.exe
  2⤵
  PID:6248
- C:\Windows\System\eCkoSPE.exe
  C:\Windows\System\eCkoSPE.exe
  2⤵
  PID:6292
- C:\Windows\System\hsSaTSO.exe
  C:\Windows\System\hsSaTSO.exe
  2⤵
  PID:6320
- C:\Windows\System\nJHuZOf.exe
  C:\Windows\System\nJHuZOf.exe
  2⤵
  PID:6344
- C:\Windows\System\jhMJzGi.exe
  C:\Windows\System\jhMJzGi.exe
  2⤵
  PID:6368
- C:\Windows\System\ZmWGivJ.exe
  C:\Windows\System\ZmWGivJ.exe
  2⤵
  PID:6424
- C:\Windows\System\TUOQkEC.exe
  C:\Windows\System\TUOQkEC.exe
  2⤵
  PID:6184
- C:\Windows\System\yFwuIzk.exe
  C:\Windows\System\yFwuIzk.exe
  2⤵
  PID:6216
- C:\Windows\System\dQXZuHs.exe
  C:\Windows\System\dQXZuHs.exe
  2⤵
  PID:6548
- C:\Windows\System\mQsPAGC.exe
  C:\Windows\System\mQsPAGC.exe
  2⤵
  PID:6604
- C:\Windows\System\RVdEPCh.exe
  C:\Windows\System\RVdEPCh.exe
  2⤵
  PID:6384
- C:\Windows\System\vpsgyOr.exe
  C:\Windows\System\vpsgyOr.exe
  2⤵
  PID:6664
- C:\Windows\System\JeEMeux.exe
  C:\Windows\System\JeEMeux.exe
  2⤵
  PID:6040
- C:\Windows\System\rgPHrPl.exe
  C:\Windows\System\rgPHrPl.exe
  2⤵
  PID:6776
- C:\Windows\System\rONmNvE.exe
  C:\Windows\System\rONmNvE.exe
  2⤵
  PID:6888
- C:\Windows\System\TBtunFz.exe
  C:\Windows\System\TBtunFz.exe
  2⤵
  PID:6968
- C:\Windows\System\JwrRNjM.exe
  C:\Windows\System\JwrRNjM.exe
  2⤵
  PID:6460
- C:\Windows\System\BjYKYZJ.exe
  C:\Windows\System\BjYKYZJ.exe
  2⤵
  PID:6768
- C:\Windows\System\dWNLucc.exe
  C:\Windows\System\dWNLucc.exe
  2⤵
  PID:7092
- C:\Windows\System\UUIlOsG.exe
  C:\Windows\System\UUIlOsG.exe
  2⤵
  PID:7172
- C:\Windows\System\dMHIcDW.exe
  C:\Windows\System\dMHIcDW.exe
  2⤵
  PID:7196
- C:\Windows\System\ohjqNNA.exe
  C:\Windows\System\ohjqNNA.exe
  2⤵
  PID:7220
- C:\Windows\System\dXUIPya.exe
  C:\Windows\System\dXUIPya.exe
  2⤵
  PID:7244
- C:\Windows\System\WMurjbs.exe
  C:\Windows\System\WMurjbs.exe
  2⤵
  PID:7268
- C:\Windows\System\QpStzJO.exe
  C:\Windows\System\QpStzJO.exe
  2⤵
  PID:7292
- C:\Windows\System\TMluCyM.exe
  C:\Windows\System\TMluCyM.exe
  2⤵
  PID:7308
- C:\Windows\System\SisQYje.exe
  C:\Windows\System\SisQYje.exe
  2⤵
  PID:7336
- C:\Windows\System\GwjDHPc.exe
  C:\Windows\System\GwjDHPc.exe
  2⤵
  PID:7364
- C:\Windows\System\OWbpbty.exe
  C:\Windows\System\OWbpbty.exe
  2⤵
  PID:7388
- C:\Windows\System\ruDuGIr.exe
  C:\Windows\System\ruDuGIr.exe
  2⤵
  PID:7412
- C:\Windows\System\QqXdhOL.exe
  C:\Windows\System\QqXdhOL.exe
  2⤵
  PID:7436
- C:\Windows\System\xGipOTo.exe
  C:\Windows\System\xGipOTo.exe
  2⤵
  PID:7464
- C:\Windows\System\xEXKYMW.exe
  C:\Windows\System\xEXKYMW.exe
  2⤵
  PID:7488
- C:\Windows\System\VukheTq.exe
  C:\Windows\System\VukheTq.exe
  2⤵
  PID:7508
- C:\Windows\System\RdDYOtc.exe
  C:\Windows\System\RdDYOtc.exe
  2⤵
  PID:7528
- C:\Windows\System\zptRFmi.exe
  C:\Windows\System\zptRFmi.exe
  2⤵
  PID:7560
- C:\Windows\System\lYzWytW.exe
  C:\Windows\System\lYzWytW.exe
  2⤵
  PID:7584
- C:\Windows\System\GXVaYXm.exe
  C:\Windows\System\GXVaYXm.exe
  2⤵
  PID:7608
- C:\Windows\System\GGijsWm.exe
  C:\Windows\System\GGijsWm.exe
  2⤵
  PID:7632
- C:\Windows\System\JXFZSoe.exe
  C:\Windows\System\JXFZSoe.exe
  2⤵
  PID:7652
- C:\Windows\System\UYAUXwP.exe
  C:\Windows\System\UYAUXwP.exe
  2⤵
  PID:7676
- C:\Windows\System\cflpkpF.exe
  C:\Windows\System\cflpkpF.exe
  2⤵
  PID:7700
- C:\Windows\System\SCjjWEO.exe
  C:\Windows\System\SCjjWEO.exe
  2⤵
  PID:7720
- C:\Windows\System\iqgdhTe.exe
  C:\Windows\System\iqgdhTe.exe
  2⤵
  PID:7748
- C:\Windows\System\VdiVPwg.exe
  C:\Windows\System\VdiVPwg.exe
  2⤵
  PID:7772
- C:\Windows\System\evxDqmR.exe
  C:\Windows\System\evxDqmR.exe
  2⤵
  PID:7796
- C:\Windows\System\YemFUco.exe
  C:\Windows\System\YemFUco.exe
  2⤵
  PID:7816
- C:\Windows\System\wUareSC.exe
  C:\Windows\System\wUareSC.exe
  2⤵
  PID:7840
- C:\Windows\System\ZkkyEMC.exe
  C:\Windows\System\ZkkyEMC.exe
  2⤵
  PID:7864
- C:\Windows\System\LfyIpBW.exe
  C:\Windows\System\LfyIpBW.exe
  2⤵
  PID:7896
- C:\Windows\System\CxMsATp.exe
  C:\Windows\System\CxMsATp.exe
  2⤵
  PID:7932
- C:\Windows\System\ClfOlGT.exe
  C:\Windows\System\ClfOlGT.exe
  2⤵
  PID:7952
- C:\Windows\System\fbqavnu.exe
  C:\Windows\System\fbqavnu.exe
  2⤵
  PID:7976
- C:\Windows\System\TRXJqwX.exe
  C:\Windows\System\TRXJqwX.exe
  2⤵
  PID:8000
- C:\Windows\System\hFTlflY.exe
  C:\Windows\System\hFTlflY.exe
  2⤵
  PID:8024
- C:\Windows\System\CEXdcEe.exe
  C:\Windows\System\CEXdcEe.exe
  2⤵
  PID:8048
- C:\Windows\System\rRbLqTO.exe
  C:\Windows\System\rRbLqTO.exe
  2⤵
  PID:8068
- C:\Windows\System\OlZzDAm.exe
  C:\Windows\System\OlZzDAm.exe
  2⤵
  PID:8088
- C:\Windows\System\yIlkhTZ.exe
  C:\Windows\System\yIlkhTZ.exe
  2⤵
  PID:8112
- C:\Windows\System\wJbYgrT.exe
  C:\Windows\System\wJbYgrT.exe
  2⤵
  PID:8140
- C:\Windows\System\migaeJT.exe
  C:\Windows\System\migaeJT.exe
  2⤵
  PID:8160
- C:\Windows\System\tvitKDp.exe
  C:\Windows\System\tvitKDp.exe
  2⤵
  PID:8184
- C:\Windows\System\PJENijL.exe
  C:\Windows\System\PJENijL.exe
  2⤵
  PID:6312
- C:\Windows\System\VOUweyc.exe
  C:\Windows\System\VOUweyc.exe
  2⤵
  PID:5004
- C:\Windows\System\JaanHMN.exe
  C:\Windows\System\JaanHMN.exe
  2⤵
  PID:6632
- C:\Windows\System\ACZVPYa.exe
  C:\Windows\System\ACZVPYa.exe
  2⤵
  PID:7040
- C:\Windows\System\RbwbSDv.exe
  C:\Windows\System\RbwbSDv.exe
  2⤵
  PID:6824
- C:\Windows\System\vbDacyi.exe
  C:\Windows\System\vbDacyi.exe
  2⤵
  PID:6356
- C:\Windows\System\SsfZlMD.exe
  C:\Windows\System\SsfZlMD.exe
  2⤵
  PID:7116
- C:\Windows\System\FkIuNMZ.exe
  C:\Windows\System\FkIuNMZ.exe
  2⤵
  PID:5572
- C:\Windows\System\SNePbAu.exe
  C:\Windows\System\SNePbAu.exe
  2⤵
  PID:7280
- C:\Windows\System\JrXDBeT.exe
  C:\Windows\System\JrXDBeT.exe
  2⤵
  PID:7396
- C:\Windows\System\oprkqTF.exe
  C:\Windows\System\oprkqTF.exe
  2⤵
  PID:6660
- C:\Windows\System\YdLRkVg.exe
  C:\Windows\System\YdLRkVg.exe
  2⤵
  PID:7496
- C:\Windows\System\Eoybzta.exe
  C:\Windows\System\Eoybzta.exe
  2⤵
  PID:7552
- C:\Windows\System\RiVuFOD.exe
  C:\Windows\System\RiVuFOD.exe
  2⤵
  PID:7580
- C:\Windows\System\GjhcULh.exe
  C:\Windows\System\GjhcULh.exe
  2⤵
  PID:7600
- C:\Windows\System\Xtebzjh.exe
  C:\Windows\System\Xtebzjh.exe
  2⤵
  PID:7028
- C:\Windows\System\qjuppwK.exe
  C:\Windows\System\qjuppwK.exe
  2⤵
  PID:7668
- C:\Windows\System\bxGUzYZ.exe
  C:\Windows\System\bxGUzYZ.exe
  2⤵
  PID:4740
- C:\Windows\System\rdJBipg.exe
  C:\Windows\System\rdJBipg.exe
  2⤵
  PID:6116
- C:\Windows\System\qBohBCQ.exe
  C:\Windows\System\qBohBCQ.exe
  2⤵
  PID:7300
- C:\Windows\System\kEvkdgi.exe
  C:\Windows\System\kEvkdgi.exe
  2⤵
  PID:7324
- C:\Windows\System\BuFsSOT.exe
  C:\Windows\System\BuFsSOT.exe
  2⤵
  PID:6236
- C:\Windows\System\cpvyDRF.exe
  C:\Windows\System\cpvyDRF.exe
  2⤵
  PID:8208
- C:\Windows\System\WbBKFwQ.exe
  C:\Windows\System\WbBKFwQ.exe
  2⤵
  PID:8244
- C:\Windows\System\tCjlLVB.exe
  C:\Windows\System\tCjlLVB.exe
  2⤵
  PID:8268
- C:\Windows\System\uYDjxzO.exe
  C:\Windows\System\uYDjxzO.exe
  2⤵
  PID:8292
- C:\Windows\System\ZrdaZKz.exe
  C:\Windows\System\ZrdaZKz.exe
  2⤵
  PID:8312
- C:\Windows\System\HKIRiNG.exe
  C:\Windows\System\HKIRiNG.exe
  2⤵
  PID:8340
- C:\Windows\System\jQwPDIm.exe
  C:\Windows\System\jQwPDIm.exe
  2⤵
  PID:8368
- C:\Windows\System\BRWTseW.exe
  C:\Windows\System\BRWTseW.exe
  2⤵
  PID:8388
- C:\Windows\System\BGYcrHR.exe
  C:\Windows\System\BGYcrHR.exe
  2⤵
  PID:8412
- C:\Windows\System\npzNLdp.exe
  C:\Windows\System\npzNLdp.exe
  2⤵
  PID:8436
- C:\Windows\System\GLlQeNr.exe
  C:\Windows\System\GLlQeNr.exe
  2⤵
  PID:8464
- C:\Windows\System\sHnAyQm.exe
  C:\Windows\System\sHnAyQm.exe
  2⤵
  PID:8488
- C:\Windows\System\GfmkKbn.exe
  C:\Windows\System\GfmkKbn.exe
  2⤵
  PID:8516
- C:\Windows\System\PJngFLw.exe
  C:\Windows\System\PJngFLw.exe
  2⤵
  PID:8540
- C:\Windows\System\xFDnmRg.exe
  C:\Windows\System\xFDnmRg.exe
  2⤵
  PID:8568
- C:\Windows\System\jkyCvIz.exe
  C:\Windows\System\jkyCvIz.exe
  2⤵
  PID:8588
- C:\Windows\System\TOflwil.exe
  C:\Windows\System\TOflwil.exe
  2⤵
  PID:8616
- C:\Windows\System\MmsSRkD.exe
  C:\Windows\System\MmsSRkD.exe
  2⤵
  PID:8640
- C:\Windows\System\dHJaYCW.exe
  C:\Windows\System\dHJaYCW.exe
  2⤵
  PID:8660
- C:\Windows\System\RIrndEC.exe
  C:\Windows\System\RIrndEC.exe
  2⤵
  PID:8684
- C:\Windows\System\xSNROqS.exe
  C:\Windows\System\xSNROqS.exe
  2⤵
  PID:8712
- C:\Windows\System\chuoIqo.exe
  C:\Windows\System\chuoIqo.exe
  2⤵
  PID:8740
- C:\Windows\System\mFhPgQv.exe
  C:\Windows\System\mFhPgQv.exe
  2⤵
  PID:8768
- C:\Windows\System\xBzvNWK.exe
  C:\Windows\System\xBzvNWK.exe
  2⤵
  PID:8792
- C:\Windows\System\HjbJjCQ.exe
  C:\Windows\System\HjbJjCQ.exe
  2⤵
  PID:8812
- C:\Windows\System\BzpnOeg.exe
  C:\Windows\System\BzpnOeg.exe
  2⤵
  PID:8844
- C:\Windows\System\QBpyXHA.exe
  C:\Windows\System\QBpyXHA.exe
  2⤵
  PID:8872
- C:\Windows\System\HqBQfwC.exe
  C:\Windows\System\HqBQfwC.exe
  2⤵
  PID:8892
- C:\Windows\System\IkOZzOl.exe
  C:\Windows\System\IkOZzOl.exe
  2⤵
  PID:8916
- C:\Windows\System\sUBPomR.exe
  C:\Windows\System\sUBPomR.exe
  2⤵
  PID:8936
- C:\Windows\System\MuwXPmy.exe
  C:\Windows\System\MuwXPmy.exe
  2⤵
  PID:8960
- C:\Windows\System\hzCTcRa.exe
  C:\Windows\System\hzCTcRa.exe
  2⤵
  PID:8980
- C:\Windows\System\qvsuaFY.exe
  C:\Windows\System\qvsuaFY.exe
  2⤵
  PID:8996
- C:\Windows\System\uPJNOsP.exe
  C:\Windows\System\uPJNOsP.exe
  2⤵
  PID:9020
- C:\Windows\System\WKABsoL.exe
  C:\Windows\System\WKABsoL.exe
  2⤵
  PID:9036
- C:\Windows\System\MAUWBNN.exe
  C:\Windows\System\MAUWBNN.exe
  2⤵
  PID:9060
- C:\Windows\System\assdQpx.exe
  C:\Windows\System\assdQpx.exe
  2⤵
  PID:9080
- C:\Windows\System\VsZMylt.exe
  C:\Windows\System\VsZMylt.exe
  2⤵
  PID:9108
- C:\Windows\System\AWpvVJu.exe
  C:\Windows\System\AWpvVJu.exe
  2⤵
  PID:9136
- C:\Windows\System\YGNjyhy.exe
  C:\Windows\System\YGNjyhy.exe
  2⤵
  PID:9160
- C:\Windows\System\aPYiwsn.exe
  C:\Windows\System\aPYiwsn.exe
  2⤵
  PID:9184
- C:\Windows\System\BkpGcnm.exe
  C:\Windows\System\BkpGcnm.exe
  2⤵
  PID:7944
- C:\Windows\System\UrDFJYQ.exe
  C:\Windows\System\UrDFJYQ.exe
  2⤵
  PID:7992
- C:\Windows\System\jUilaDJ.exe
  C:\Windows\System\jUilaDJ.exe
  2⤵
  PID:8080
- C:\Windows\System\TUfNGzK.exe
  C:\Windows\System\TUfNGzK.exe
  2⤵
  PID:7940
- C:\Windows\System\SbuUzgA.exe
  C:\Windows\System\SbuUzgA.exe
  2⤵
  PID:8060
- C:\Windows\System\IlOtWrW.exe
  C:\Windows\System\IlOtWrW.exe
  2⤵
  PID:8132
- C:\Windows\System\pPxtGil.exe
  C:\Windows\System\pPxtGil.exe
  2⤵
  PID:1772
- C:\Windows\System\vkZWbsh.exe
  C:\Windows\System\vkZWbsh.exe
  2⤵
  PID:8624
- C:\Windows\System\pvnzUPe.exe
  C:\Windows\System\pvnzUPe.exe
  2⤵
  PID:6912
- C:\Windows\System\ydrykRu.exe
  C:\Windows\System\ydrykRu.exe
  2⤵
  PID:8704
- C:\Windows\System\ygllSaL.exe
  C:\Windows\System\ygllSaL.exe
  2⤵
  PID:8748
- C:\Windows\System\nzVjYUW.exe
  C:\Windows\System\nzVjYUW.exe
  2⤵
  PID:7852
- C:\Windows\System\oAIWgMi.exe
  C:\Windows\System\oAIWgMi.exe
  2⤵
  PID:8236
- C:\Windows\System\iunjkGt.exe
  C:\Windows\System\iunjkGt.exe
  2⤵
  PID:8304
- C:\Windows\System\JkzMypC.exe
  C:\Windows\System\JkzMypC.exe
  2⤵
  PID:9200
- C:\Windows\System\tZaVnhe.exe
  C:\Windows\System\tZaVnhe.exe
  2⤵
  PID:8432
- C:\Windows\System\FHItLOT.exe
  C:\Windows\System\FHItLOT.exe
  2⤵
  PID:8108
- C:\Windows\System\YfNQnpk.exe
  C:\Windows\System\YfNQnpk.exe
  2⤵
  PID:8852
- C:\Windows\System\BWyrtVv.exe
  C:\Windows\System\BWyrtVv.exe
  2⤵
  PID:7592
- C:\Windows\System\uglEjzr.exe
  C:\Windows\System\uglEjzr.exe
  2⤵
  PID:7764
- C:\Windows\System\QtuHdTT.exe
  C:\Windows\System\QtuHdTT.exe
  2⤵
  PID:9224
- C:\Windows\System\aHNakKm.exe
  C:\Windows\System\aHNakKm.exe
  2⤵
  PID:9248
- C:\Windows\System\WZZDkgA.exe
  C:\Windows\System\WZZDkgA.exe
  2⤵
  PID:9276
- C:\Windows\System\OPzCDRO.exe
  C:\Windows\System\OPzCDRO.exe
  2⤵
  PID:9300
- C:\Windows\System\jgSSLAZ.exe
  C:\Windows\System\jgSSLAZ.exe
  2⤵
  PID:9336
- C:\Windows\System\iizQaRU.exe
  C:\Windows\System\iizQaRU.exe
  2⤵
  PID:9368
- C:\Windows\System\Uodwhtt.exe
  C:\Windows\System\Uodwhtt.exe
  2⤵
  PID:9388
- C:\Windows\System\irSzSWQ.exe
  C:\Windows\System\irSzSWQ.exe
  2⤵
  PID:9412
- C:\Windows\System\ZPtsvQT.exe
  C:\Windows\System\ZPtsvQT.exe
  2⤵
  PID:9436
- C:\Windows\System\WykOKmY.exe
  C:\Windows\System\WykOKmY.exe
  2⤵
  PID:9460
- C:\Windows\System\iQTJfJl.exe
  C:\Windows\System\iQTJfJl.exe
  2⤵
  PID:9484
- C:\Windows\System\eDvkoEJ.exe
  C:\Windows\System\eDvkoEJ.exe
  2⤵
  PID:9512
- C:\Windows\System\qgvxRdB.exe
  C:\Windows\System\qgvxRdB.exe
  2⤵
  PID:9540
- C:\Windows\System\RCGigwa.exe
  C:\Windows\System\RCGigwa.exe
  2⤵
  PID:9564
- C:\Windows\System\BfvDCAZ.exe
  C:\Windows\System\BfvDCAZ.exe
  2⤵
  PID:9580
- C:\Windows\System\oROeaez.exe
  C:\Windows\System\oROeaez.exe
  2⤵
  PID:9600
- C:\Windows\System\yxfbCXO.exe
  C:\Windows\System\yxfbCXO.exe
  2⤵
  PID:9832
- C:\Windows\System\fGmvCom.exe
  C:\Windows\System\fGmvCom.exe
  2⤵
  PID:9860
- C:\Windows\System\eJhXwyw.exe
  C:\Windows\System\eJhXwyw.exe
  2⤵
  PID:9888
- C:\Windows\System\zLXAvdu.exe
  C:\Windows\System\zLXAvdu.exe
  2⤵
  PID:9912
- C:\Windows\System\oAOomoC.exe
  C:\Windows\System\oAOomoC.exe
  2⤵
  PID:9928
- C:\Windows\System\tydQOft.exe
  C:\Windows\System\tydQOft.exe
  2⤵
  PID:9956
- C:\Windows\System\PqVdYKn.exe
  C:\Windows\System\PqVdYKn.exe
  2⤵
  PID:9972
- C:\Windows\System\GBfJEYB.exe
  C:\Windows\System\GBfJEYB.exe
  2⤵
  PID:9996
- C:\Windows\System\iBYbzzs.exe
  C:\Windows\System\iBYbzzs.exe
  2⤵
  PID:10024
- C:\Windows\System\xshozyj.exe
  C:\Windows\System\xshozyj.exe
  2⤵
  PID:10048
- C:\Windows\System\cjcYAOp.exe
  C:\Windows\System\cjcYAOp.exe
  2⤵
  PID:10072
- C:\Windows\System\UQLzUuq.exe
  C:\Windows\System\UQLzUuq.exe
  2⤵
  PID:10096
- C:\Windows\System\PyNjPMR.exe
  C:\Windows\System\PyNjPMR.exe
  2⤵
  PID:10116
- C:\Windows\System\BtMalfv.exe
  C:\Windows\System\BtMalfv.exe
  2⤵
  PID:10136
- C:\Windows\System\JZnNMwI.exe
  C:\Windows\System\JZnNMwI.exe
  2⤵
  PID:10160
- C:\Windows\System\fydsFYp.exe
  C:\Windows\System\fydsFYp.exe
  2⤵
  PID:10192
- C:\Windows\System\mgudtcE.exe
  C:\Windows\System\mgudtcE.exe
  2⤵
  PID:10212
- C:\Windows\System\pfYsHnk.exe
  C:\Windows\System\pfYsHnk.exe
  2⤵
  PID:10232
- C:\Windows\System\dkmYKhJ.exe
  C:\Windows\System\dkmYKhJ.exe
  2⤵
  PID:8968
- C:\Windows\System\DfKIaIr.exe
  C:\Windows\System\DfKIaIr.exe
  2⤵
  PID:9076
- C:\Windows\System\skOmJFB.exe
  C:\Windows\System\skOmJFB.exe
  2⤵
  PID:8356
- C:\Windows\System\jefkgYe.exe
  C:\Windows\System\jefkgYe.exe
  2⤵
  PID:8452
- C:\Windows\System\UhBPrkC.exe
  C:\Windows\System\UhBPrkC.exe
  2⤵
  PID:8528
- C:\Windows\System\hJGjQwr.exe
  C:\Windows\System\hJGjQwr.exe
  2⤵
  PID:8584
- C:\Windows\System\tGrNrKg.exe
  C:\Windows\System\tGrNrKg.exe
  2⤵
  PID:8636
- C:\Windows\System\MYJvjcN.exe
  C:\Windows\System\MYJvjcN.exe
  2⤵
  PID:8288
- C:\Windows\System\hMkZHkU.exe
  C:\Windows\System\hMkZHkU.exe
  2⤵
  PID:8836
- C:\Windows\System\YDjXYmU.exe
  C:\Windows\System\YDjXYmU.exe
  2⤵
  PID:7784
- C:\Windows\System\bOuBmeN.exe
  C:\Windows\System\bOuBmeN.exe
  2⤵
  PID:9264
- C:\Windows\System\pLBJDSy.exe
  C:\Windows\System\pLBJDSy.exe
  2⤵
  PID:9056
- C:\Windows\System\TDZbudP.exe
  C:\Windows\System\TDZbudP.exe
  2⤵
  PID:8044
- C:\Windows\System\lJHXbyq.exe
  C:\Windows\System\lJHXbyq.exe
  2⤵
  PID:8220
- C:\Windows\System\FvZrWYS.exe
  C:\Windows\System\FvZrWYS.exe
  2⤵
  PID:8900
- C:\Windows\System\qIIkTEH.exe
  C:\Windows\System\qIIkTEH.exe
  2⤵
  PID:9376
- C:\Windows\System\jptziiz.exe
  C:\Windows\System\jptziiz.exe
  2⤵
  PID:9500
- C:\Windows\System\nsLkmlF.exe
  C:\Windows\System\nsLkmlF.exe
  2⤵
  PID:9588
- C:\Windows\System\DChJcou.exe
  C:\Windows\System\DChJcou.exe
  2⤵
  PID:9628
- C:\Windows\System\LkbEXxV.exe
  C:\Windows\System\LkbEXxV.exe
  2⤵
  PID:7996
- C:\Windows\System\dyDXcJh.exe
  C:\Windows\System\dyDXcJh.exe
  2⤵
  PID:7476
- C:\Windows\System\WwMsVEa.exe
  C:\Windows\System\WwMsVEa.exe
  2⤵
  PID:8652
- C:\Windows\System\zBraBzz.exe
  C:\Windows\System\zBraBzz.exe
  2⤵
  PID:8120
- C:\Windows\System\SZEdWBN.exe
  C:\Windows\System\SZEdWBN.exe
  2⤵
  PID:8992
- C:\Windows\System\IFnBjxZ.exe
  C:\Windows\System\IFnBjxZ.exe
  2⤵
  PID:10244
- C:\Windows\System\TmzfPeg.exe
  C:\Windows\System\TmzfPeg.exe
  2⤵
  PID:10260
- C:\Windows\System\KYqphba.exe
  C:\Windows\System\KYqphba.exe
  2⤵
  PID:10276
- C:\Windows\System\HwqhETx.exe
  C:\Windows\System\HwqhETx.exe
  2⤵
  PID:10292
- C:\Windows\System\fruXSRc.exe
  C:\Windows\System\fruXSRc.exe
  2⤵
  PID:10312
- C:\Windows\System\qqLCuNC.exe
  C:\Windows\System\qqLCuNC.exe
  2⤵
  PID:10336
- C:\Windows\System\WTiQvYx.exe
  C:\Windows\System\WTiQvYx.exe
  2⤵
  PID:10360
- C:\Windows\System\ypilgGL.exe
  C:\Windows\System\ypilgGL.exe
  2⤵
  PID:10380
- C:\Windows\System\BvtFdig.exe
  C:\Windows\System\BvtFdig.exe
  2⤵
  PID:10404
- C:\Windows\System\qBbmMIE.exe
  C:\Windows\System\qBbmMIE.exe
  2⤵
  PID:10432
- C:\Windows\System\DSzwVHw.exe
  C:\Windows\System\DSzwVHw.exe
  2⤵
  PID:10460
- C:\Windows\System\kZkjvpm.exe
  C:\Windows\System\kZkjvpm.exe
  2⤵
  PID:10488
- C:\Windows\System\qpBKxOr.exe
  C:\Windows\System\qpBKxOr.exe
  2⤵
  PID:10512
- C:\Windows\System\EyZauiI.exe
  C:\Windows\System\EyZauiI.exe
  2⤵
  PID:10540
- C:\Windows\System\mCLGkDw.exe
  C:\Windows\System\mCLGkDw.exe
  2⤵
  PID:10560
- C:\Windows\System\wEMPBjE.exe
  C:\Windows\System\wEMPBjE.exe
  2⤵
  PID:10580
- C:\Windows\System\rdJbJwz.exe
  C:\Windows\System\rdJbJwz.exe
  2⤵
  PID:10604
- C:\Windows\System\JEDRGiL.exe
  C:\Windows\System\JEDRGiL.exe
  2⤵
  PID:10624
- C:\Windows\System\MUHrnCf.exe
  C:\Windows\System\MUHrnCf.exe
  2⤵
  PID:10644
- C:\Windows\System\InoTKgu.exe
  C:\Windows\System\InoTKgu.exe
  2⤵
  PID:10672
- C:\Windows\System\BwvonmG.exe
  C:\Windows\System\BwvonmG.exe
  2⤵
  PID:10692
- C:\Windows\System\TdJXtNz.exe
  C:\Windows\System\TdJXtNz.exe
  2⤵
  PID:10716
- C:\Windows\System\VEheiHL.exe
  C:\Windows\System\VEheiHL.exe
  2⤵
  PID:10740
- C:\Windows\System\kLyxrIJ.exe
  C:\Windows\System\kLyxrIJ.exe
  2⤵
  PID:10768
- C:\Windows\System\jUNDfUw.exe
  C:\Windows\System\jUNDfUw.exe
  2⤵
  PID:10792
- C:\Windows\System\WFHRWuN.exe
  C:\Windows\System\WFHRWuN.exe
  2⤵
  PID:10808
- C:\Windows\System\kHEPYzu.exe
  C:\Windows\System\kHEPYzu.exe
  2⤵
  PID:10832
- C:\Windows\System\CnbazsZ.exe
  C:\Windows\System\CnbazsZ.exe
  2⤵
  PID:10856
- C:\Windows\System\QbHgAGt.exe
  C:\Windows\System\QbHgAGt.exe
  2⤵
  PID:10888
- C:\Windows\System\wLfkwjb.exe
  C:\Windows\System\wLfkwjb.exe
  2⤵
  PID:10908
- C:\Windows\System\QsvVIAb.exe
  C:\Windows\System\QsvVIAb.exe
  2⤵
  PID:10928
- C:\Windows\System\OrOCvCU.exe
  C:\Windows\System\OrOCvCU.exe
  2⤵
  PID:10952
- C:\Windows\System\VPzhWyU.exe
  C:\Windows\System\VPzhWyU.exe
  2⤵
  PID:10980
- C:\Windows\System\fysNaYZ.exe
  C:\Windows\System\fysNaYZ.exe
  2⤵
  PID:11004
- C:\Windows\System\LmxRgQj.exe
  C:\Windows\System\LmxRgQj.exe
  2⤵
  PID:11032
- C:\Windows\System\TECFhuW.exe
  C:\Windows\System\TECFhuW.exe
  2⤵
  PID:11056
- C:\Windows\System\ywZMSrH.exe
  C:\Windows\System\ywZMSrH.exe
  2⤵
  PID:11072
- C:\Windows\System\jSBiqKA.exe
  C:\Windows\System\jSBiqKA.exe
  2⤵
  PID:11100
- C:\Windows\System\YlxyQJG.exe
  C:\Windows\System\YlxyQJG.exe
  2⤵
  PID:11124
- C:\Windows\System\FLzerao.exe
  C:\Windows\System\FLzerao.exe
  2⤵
  PID:11140
- C:\Windows\System\qbfPOKX.exe
  C:\Windows\System\qbfPOKX.exe
  2⤵
  PID:11168
- C:\Windows\System\DHPHHJc.exe
  C:\Windows\System\DHPHHJc.exe
  2⤵
  PID:11188
- C:\Windows\System\haPYJFt.exe
  C:\Windows\System\haPYJFt.exe
  2⤵
  PID:11212
- C:\Windows\System\lXnufsU.exe
  C:\Windows\System\lXnufsU.exe
  2⤵
  PID:11232
- C:\Windows\System\SxuuWWA.exe
  C:\Windows\System\SxuuWWA.exe
  2⤵
  PID:11256
- C:\Windows\System\VlVUXCd.exe
  C:\Windows\System\VlVUXCd.exe
  2⤵
  PID:10228
- C:\Windows\System\VGiJSUH.exe
  C:\Windows\System\VGiJSUH.exe
  2⤵
  PID:9720
- C:\Windows\System\IyoZhKh.exe
  C:\Windows\System\IyoZhKh.exe
  2⤵
  PID:9344
- C:\Windows\System\bIamSrF.exe
  C:\Windows\System\bIamSrF.exe
  2⤵
  PID:9404
- C:\Windows\System\FAiIoNj.exe
  C:\Windows\System\FAiIoNj.exe
  2⤵
  PID:8496
- C:\Windows\System\wTcdgyi.exe
  C:\Windows\System\wTcdgyi.exe
  2⤵
  PID:9804
- C:\Windows\System\bpjoMjG.exe
  C:\Windows\System\bpjoMjG.exe
  2⤵
  PID:8040
- C:\Windows\System\HiKqzSy.exe
  C:\Windows\System\HiKqzSy.exe
  2⤵
  PID:9244
- C:\Windows\System\AQkfLle.exe
  C:\Windows\System\AQkfLle.exe
  2⤵
  PID:9532
- C:\Windows\System\xBegfJD.exe
  C:\Windows\System\xBegfJD.exe
  2⤵
  PID:9144
- C:\Windows\System\CPdcocl.exe
  C:\Windows\System\CPdcocl.exe
  2⤵
  PID:9592
- C:\Windows\System\euyZBGl.exe
  C:\Windows\System\euyZBGl.exe
  2⤵
  PID:8656
- C:\Windows\System\JcsnmSi.exe
  C:\Windows\System\JcsnmSi.exe
  2⤵
  PID:9156
- C:\Windows\System\DZHUgPv.exe
  C:\Windows\System\DZHUgPv.exe
  2⤵
  PID:10108
- C:\Windows\System\EcLpqiA.exe
  C:\Windows\System\EcLpqiA.exe
  2⤵
  PID:10144
- C:\Windows\System\bLQDWuc.exe
  C:\Windows\System\bLQDWuc.exe
  2⤵
  PID:10288
- C:\Windows\System\CTRhNUG.exe
  C:\Windows\System\CTRhNUG.exe
  2⤵
  PID:10348
- C:\Windows\System\ARcOyav.exe
  C:\Windows\System\ARcOyav.exe
  2⤵
  PID:10428
- C:\Windows\System\RgIroKH.exe
  C:\Windows\System\RgIroKH.exe
  2⤵
  PID:9728
- C:\Windows\System\FghxRNc.exe
  C:\Windows\System\FghxRNc.exe
  2⤵
  PID:10500
- C:\Windows\System\wQbirxJ.exe
  C:\Windows\System\wQbirxJ.exe
  2⤵
  PID:9816
- C:\Windows\System\SqzdKPL.exe
  C:\Windows\System\SqzdKPL.exe
  2⤵
  PID:10600
- C:\Windows\System\TgoeDsG.exe
  C:\Windows\System\TgoeDsG.exe
  2⤵
  PID:9908
- C:\Windows\System\CIWpRmq.exe
  C:\Windows\System\CIWpRmq.exe
  2⤵
  PID:10736
- C:\Windows\System\ONbvovh.exe
  C:\Windows\System\ONbvovh.exe
  2⤵
  PID:10800
- C:\Windows\System\hAjRMSX.exe
  C:\Windows\System\hAjRMSX.exe
  2⤵
  PID:9980
- C:\Windows\System\dkTmYAV.exe
  C:\Windows\System\dkTmYAV.exe
  2⤵
  PID:11284
- C:\Windows\System\jjIOowU.exe
  C:\Windows\System\jjIOowU.exe
  2⤵
  PID:11312
- C:\Windows\System\JHiEtcI.exe
  C:\Windows\System\JHiEtcI.exe
  2⤵
  PID:11336
- C:\Windows\System\JAMyfkE.exe
  C:\Windows\System\JAMyfkE.exe
  2⤵
  PID:11364
- C:\Windows\System\qajdnBc.exe
  C:\Windows\System\qajdnBc.exe
  2⤵
  PID:11920
- C:\Windows\System\WSeGBQG.exe
  C:\Windows\System\WSeGBQG.exe
  2⤵
  PID:11976
- C:\Windows\System\qOxcsLk.exe
  C:\Windows\System\qOxcsLk.exe
  2⤵
  PID:12004
- C:\Windows\System\JXjvLvZ.exe
  C:\Windows\System\JXjvLvZ.exe
  2⤵
  PID:12032
- C:\Windows\System\UWPtRyF.exe
  C:\Windows\System\UWPtRyF.exe
  2⤵
  PID:12068
- C:\Windows\System\AZVrlbI.exe
  C:\Windows\System\AZVrlbI.exe
  2⤵
  PID:12088
- C:\Windows\System\HlSIUnL.exe
  C:\Windows\System\HlSIUnL.exe
  2⤵
  PID:12116
- C:\Windows\System\YYSBuSu.exe
  C:\Windows\System\YYSBuSu.exe
  2⤵
  PID:12144
- C:\Windows\System\MyPYmnA.exe
  C:\Windows\System\MyPYmnA.exe
  2⤵
  PID:12160
- C:\Windows\System\ApTBgWc.exe
  C:\Windows\System\ApTBgWc.exe
  2⤵
  PID:12184
- C:\Windows\System\aucrCAj.exe
  C:\Windows\System\aucrCAj.exe
  2⤵
  PID:12200
- C:\Windows\System\hldDlkg.exe
  C:\Windows\System\hldDlkg.exe
  2⤵
  PID:12220
- C:\Windows\System\EQJURPC.exe
  C:\Windows\System\EQJURPC.exe
  2⤵
  PID:12236
- C:\Windows\System\AKztZio.exe
  C:\Windows\System\AKztZio.exe
  2⤵
  PID:12252
- C:\Windows\System\YXOzWxx.exe
  C:\Windows\System\YXOzWxx.exe
  2⤵
  PID:12268
- C:\Windows\System\ZmJLDrA.exe
  C:\Windows\System\ZmJLDrA.exe
  2⤵
  PID:12284
- C:\Windows\System\HifarUU.exe
  C:\Windows\System\HifarUU.exe
  2⤵
  PID:10940
- C:\Windows\System\EpUpNgq.exe
  C:\Windows\System\EpUpNgq.exe
  2⤵
  PID:11012
- C:\Windows\System\aXtanpB.exe
  C:\Windows\System\aXtanpB.exe
  2⤵
  PID:11028
- C:\Windows\System\zcIKztx.exe
  C:\Windows\System\zcIKztx.exe
  2⤵
  PID:10256
- C:\Windows\System\SKuBDQm.exe
  C:\Windows\System\SKuBDQm.exe
  2⤵
  PID:10468
- C:\Windows\System\pdIkWuO.exe
  C:\Windows\System\pdIkWuO.exe
  2⤵
  PID:8560
- C:\Windows\System\RAwRZQL.exe
  C:\Windows\System\RAwRZQL.exe
  2⤵
  PID:10056
- C:\Windows\System\eaIYqDC.exe
  C:\Windows\System\eaIYqDC.exe
  2⤵
  PID:7208
- C:\Windows\System\hlVfvaZ.exe
  C:\Windows\System\hlVfvaZ.exe
  2⤵
  PID:9288
- C:\Windows\System\VniQFrI.exe
  C:\Windows\System\VniQFrI.exe
  2⤵
  PID:11304
- C:\Windows\System\LJfDhkm.exe
  C:\Windows\System\LJfDhkm.exe
  2⤵
  PID:9876
- C:\Windows\System\TIJanDY.exe
  C:\Windows\System\TIJanDY.exe
  2⤵
  PID:11108
- C:\Windows\System\jcCVrIu.exe
  C:\Windows\System\jcCVrIu.exe
  2⤵
  PID:11148
- C:\Windows\System\DsjGwGQ.exe
  C:\Windows\System\DsjGwGQ.exe
  2⤵
  PID:10272
- C:\Windows\System\OzkjwJj.exe
  C:\Windows\System\OzkjwJj.exe
  2⤵
  PID:7192
- C:\Windows\System\psHfKzO.exe
  C:\Windows\System\psHfKzO.exe
  2⤵
  PID:8524
- C:\Windows\System\DvNccHW.exe
  C:\Windows\System\DvNccHW.exe
  2⤵
  PID:10616
- C:\Windows\System\oCWmQdY.exe
  C:\Windows\System\oCWmQdY.exe
  2⤵
  PID:10688
- C:\Windows\System\ieSEBNT.exe
  C:\Windows\System\ieSEBNT.exe
  2⤵
  PID:11568
- C:\Windows\System\CEWbFNq.exe
  C:\Windows\System\CEWbFNq.exe
  2⤵
  PID:10880
- C:\Windows\System\NcDbzeT.exe
  C:\Windows\System\NcDbzeT.exe
  2⤵
  PID:11588
- C:\Windows\System\tDcqkeD.exe
  C:\Windows\System\tDcqkeD.exe
  2⤵
  PID:9380
- C:\Windows\System\UlZfILU.exe
  C:\Windows\System\UlZfILU.exe
  2⤵
  PID:11180
- C:\Windows\System\rBlKsFw.exe
  C:\Windows\System\rBlKsFw.exe
  2⤵
  PID:11228
- C:\Windows\System\husOrBr.exe
  C:\Windows\System\husOrBr.exe
  2⤵
  PID:9384
- C:\Windows\System\IhEaptb.exe
  C:\Windows\System\IhEaptb.exe
  2⤵
  PID:8972
- C:\Windows\System\UdyreZu.exe
  C:\Windows\System\UdyreZu.exe
  2⤵
  PID:10016
- C:\Windows\System\JRlpTBf.exe
  C:\Windows\System\JRlpTBf.exe
  2⤵
  PID:10320
- C:\Windows\System\hyBFuKV.exe
  C:\Windows\System\hyBFuKV.exe
  2⤵
  PID:11856
- C:\Windows\System\BsMlmLD.exe
  C:\Windows\System\BsMlmLD.exe
  2⤵
  PID:11268
- C:\Windows\System\WEVMTMV.exe
  C:\Windows\System\WEVMTMV.exe
  2⤵
  PID:9492
- C:\Windows\System\CkcBZRt.exe
  C:\Windows\System\CkcBZRt.exe
  2⤵
  PID:9700
- C:\Windows\System\RKCduvz.exe
  C:\Windows\System\RKCduvz.exe
  2⤵
  PID:10128
- C:\Windows\System\stWRRtG.exe
  C:\Windows\System\stWRRtG.exe
  2⤵
  PID:9008
- C:\Windows\System\rMoVDty.exe
  C:\Windows\System\rMoVDty.exe
  2⤵
  PID:11648
- C:\Windows\System\lKGMNxI.exe
  C:\Windows\System\lKGMNxI.exe
  2⤵
  PID:12216
- C:\Windows\System\SAwLaly.exe
  C:\Windows\System\SAwLaly.exe
  2⤵
  PID:12292
- C:\Windows\System\ydUwjpq.exe
  C:\Windows\System\ydUwjpq.exe
  2⤵
  PID:12316
- C:\Windows\System\PezOInD.exe
  C:\Windows\System\PezOInD.exe
  2⤵
  PID:12336
- C:\Windows\System\ockWlEh.exe
  C:\Windows\System\ockWlEh.exe
  2⤵
  PID:12364
- C:\Windows\System\cekaNSS.exe
  C:\Windows\System\cekaNSS.exe
  2⤵
  PID:12392
- C:\Windows\System\lhRnMeN.exe
  C:\Windows\System\lhRnMeN.exe
  2⤵
  PID:12420
- C:\Windows\System\OOUAomg.exe
  C:\Windows\System\OOUAomg.exe
  2⤵
  PID:12444
- C:\Windows\System\MaiVMfk.exe
  C:\Windows\System\MaiVMfk.exe
  2⤵
  PID:12464
- C:\Windows\System\TDcfRNu.exe
  C:\Windows\System\TDcfRNu.exe
  2⤵
  PID:12488
- C:\Windows\System\XJkCSKc.exe
  C:\Windows\System\XJkCSKc.exe
  2⤵
  PID:12508
- C:\Windows\System\HtNKaLR.exe
  C:\Windows\System\HtNKaLR.exe
  2⤵
  PID:12536
- C:\Windows\System\NmMCTCm.exe
  C:\Windows\System\NmMCTCm.exe
  2⤵
  PID:12564
- C:\Windows\System\VkESeMO.exe
  C:\Windows\System\VkESeMO.exe
  2⤵
  PID:12584
- C:\Windows\System\UmiWDFa.exe
  C:\Windows\System\UmiWDFa.exe
  2⤵
  PID:12600
- C:\Windows\System\pdTGNXc.exe
  C:\Windows\System\pdTGNXc.exe
  2⤵
  PID:12620
- C:\Windows\System\QagUBqx.exe
  C:\Windows\System\QagUBqx.exe
  2⤵
  PID:12636
- C:\Windows\System\DQCzmig.exe
  C:\Windows\System\DQCzmig.exe
  2⤵
  PID:12660
- C:\Windows\System\bPTrgiB.exe
  C:\Windows\System\bPTrgiB.exe
  2⤵
  PID:12676
- C:\Windows\System\kNgrnFN.exe
  C:\Windows\System\kNgrnFN.exe
  2⤵
  PID:12692
- C:\Windows\System\PglJtsz.exe
  C:\Windows\System\PglJtsz.exe
  2⤵
  PID:12708
- C:\Windows\System\VAFbMjX.exe
  C:\Windows\System\VAFbMjX.exe
  2⤵
  PID:12728
- C:\Windows\System\NyGYiMo.exe
  C:\Windows\System\NyGYiMo.exe
  2⤵
  PID:12756
- C:\Windows\System\aWayCXu.exe
  C:\Windows\System\aWayCXu.exe
  2⤵
  PID:12780
- C:\Windows\System\ZAGbyhU.exe
  C:\Windows\System\ZAGbyhU.exe
  2⤵
  PID:12800
- C:\Windows\System\WNjfvAd.exe
  C:\Windows\System\WNjfvAd.exe
  2⤵
  PID:12828
- C:\Windows\System\VmyzasT.exe
  C:\Windows\System\VmyzasT.exe
  2⤵
  PID:12852
- C:\Windows\System\gaRCPiP.exe
  C:\Windows\System\gaRCPiP.exe
  2⤵
  PID:12868
- C:\Windows\System\qNHIiNn.exe
  C:\Windows\System\qNHIiNn.exe
  2⤵
  PID:12888
- C:\Windows\System\ycUONtm.exe
  C:\Windows\System\ycUONtm.exe
  2⤵
  PID:12908
- C:\Windows\System\mnxPXcg.exe
  C:\Windows\System\mnxPXcg.exe
  2⤵
  PID:12924
- C:\Windows\System\tBoIRUe.exe
  C:\Windows\System\tBoIRUe.exe
  2⤵
  PID:12944
- C:\Windows\System\qrLuCvv.exe
  C:\Windows\System\qrLuCvv.exe
  2⤵
  PID:12964
- C:\Windows\System\FZiJgZi.exe
  C:\Windows\System\FZiJgZi.exe
  2⤵
  PID:12984
- C:\Windows\System\zNKLZGU.exe
  C:\Windows\System\zNKLZGU.exe
  2⤵
  PID:13000
- C:\Windows\System\BqvOESR.exe
  C:\Windows\System\BqvOESR.exe
  2⤵
  PID:13024
- C:\Windows\System\btLIJrM.exe
  C:\Windows\System\btLIJrM.exe
  2⤵
  PID:13044
- C:\Windows\System\scCxwdn.exe
  C:\Windows\System\scCxwdn.exe
  2⤵
  PID:13072
- C:\Windows\System\TarlEGe.exe
  C:\Windows\System\TarlEGe.exe
  2⤵
  PID:13092
- C:\Windows\System\MBneOHp.exe
  C:\Windows\System\MBneOHp.exe
  2⤵
  PID:13112
- C:\Windows\System\vKjFwQt.exe
  C:\Windows\System\vKjFwQt.exe
  2⤵
  PID:13144
- C:\Windows\System\kFtldXx.exe
  C:\Windows\System\kFtldXx.exe
  2⤵
  PID:13168
- C:\Windows\System\ELgLWWq.exe
  C:\Windows\System\ELgLWWq.exe
  2⤵
  PID:13184
- C:\Windows\System\nHlMGjP.exe
  C:\Windows\System\nHlMGjP.exe
  2⤵
  PID:13204
- C:\Windows\System\DWLvcnI.exe
  C:\Windows\System\DWLvcnI.exe
  2⤵
  PID:13224
- C:\Windows\System\rdpgoPY.exe
  C:\Windows\System\rdpgoPY.exe
  2⤵
  PID:13240
- C:\Windows\System\wvOTojF.exe
  C:\Windows\System\wvOTojF.exe
  2⤵
  PID:13260
- C:\Windows\System\TyBDJfV.exe
  C:\Windows\System\TyBDJfV.exe
  2⤵
  PID:13280
- C:\Windows\System\vMINGSg.exe
  C:\Windows\System\vMINGSg.exe
  2⤵
  PID:13304
- C:\Windows\System\qeuSKMz.exe
  C:\Windows\System\qeuSKMz.exe
  2⤵
  PID:11708
- C:\Windows\System\TUNeAhY.exe
  C:\Windows\System\TUNeAhY.exe
  2⤵
  PID:7576
- C:\Windows\System\OQcxRch.exe
  C:\Windows\System\OQcxRch.exe
  2⤵
  PID:13220
- C:\Windows\System\ZrSdjhP.exe
  C:\Windows\System\ZrSdjhP.exe
  2⤵
  PID:11520
- C:\Windows\System\nNzzPdB.exe
  C:\Windows\System\nNzzPdB.exe
  2⤵
  PID:12904
- C:\Windows\System\hNdYjBF.exe
  C:\Windows\System\hNdYjBF.exe
  2⤵
  PID:5072
- C:\Windows\System\zLCsVEe.exe
  C:\Windows\System\zLCsVEe.exe
  2⤵
  PID:13088
- C:\Windows\System\OGvdzUj.exe
  C:\Windows\System\OGvdzUj.exe
  2⤵
  PID:7124
- C:\Windows\System\XVuViLr.exe
  C:\Windows\System\XVuViLr.exe
  2⤵
  PID:12308
- C:\Windows\System\nLbympF.exe
  C:\Windows\System\nLbympF.exe
  2⤵
  PID:12360
- C:\Windows\System\UrebXKK.exe
  C:\Windows\System\UrebXKK.exe
  2⤵
  PID:12552
- C:\Windows\System\RPMkoKy.exe
  C:\Windows\System\RPMkoKy.exe
  2⤵
  PID:10872
- C:\Windows\System\iEUNLgS.exe
  C:\Windows\System\iEUNLgS.exe
  2⤵
  PID:8604
- C:\Windows\System\RyLUkIB.exe
  C:\Windows\System\RyLUkIB.exe
  2⤵
  PID:1108
- C:\Windows\System\agnimmA.exe
  C:\Windows\System\agnimmA.exe
  2⤵
  PID:11068
- C:\Windows\System\zhnQOFU.exe
  C:\Windows\System\zhnQOFU.exe
  2⤵
  PID:9764
- C:\Windows\System\toZzCvU.exe
  C:\Windows\System\toZzCvU.exe
  2⤵
  PID:12016
- C:\Windows\System\TSBVkkr.exe
  C:\Windows\System\TSBVkkr.exe
  2⤵
  PID:10924
- C:\Windows\System\sgPoxPk.exe
  C:\Windows\System\sgPoxPk.exe
  2⤵
  PID:4800
- C:\Windows\System\deIxGXR.exe
  C:\Windows\System\deIxGXR.exe
  2⤵
  PID:5756
- C:\Windows\System\LhlXijU.exe
  C:\Windows\System\LhlXijU.exe
  2⤵
  PID:13036
- C:\Windows\System\PlPDqbv.exe
  C:\Windows\System\PlPDqbv.exe
  2⤵
  PID:13100
- C:\Windows\System\tYhktRB.exe
  C:\Windows\System\tYhktRB.exe
  2⤵
  PID:12996
- C:\Windows\System\PJXdgHe.exe
  C:\Windows\System\PJXdgHe.exe
  2⤵
  PID:10920
- C:\Windows\System\RfTDBsE.exe
  C:\Windows\System\RfTDBsE.exe
  2⤵
  PID:10824
- C:\Windows\System\fAUkOVN.exe
  C:\Windows\System\fAUkOVN.exe
  2⤵
  PID:4724
- C:\Windows\System\iTPESRn.exe
  C:\Windows\System\iTPESRn.exe
  2⤵
  PID:12056
- C:\Windows\System\LbsLWQh.exe
  C:\Windows\System\LbsLWQh.exe
  2⤵
  PID:12128
- C:\Windows\System\XazPEqN.exe
  C:\Windows\System\XazPEqN.exe
  2⤵
  PID:12260
- C:\Windows\System\DAycLDh.exe
  C:\Windows\System\DAycLDh.exe
  2⤵
  PID:12772
- C:\Windows\System\nTuWosS.exe
  C:\Windows\System\nTuWosS.exe
  2⤵
  PID:9476
- C:\Windows\System\WkCMSBs.exe
  C:\Windows\System\WkCMSBs.exe
  2⤵
  PID:10456
- C:\Windows\System\bylMVTH.exe
  C:\Windows\System\bylMVTH.exe
  2⤵
  PID:10840
- C:\Windows\System\naazZNM.exe
  C:\Windows\System\naazZNM.exe
  2⤵
  PID:10132
- C:\Windows\System\mxBBoJg.exe
  C:\Windows\System\mxBBoJg.exe
  2⤵
  PID:9668
- C:\Windows\System\yIlvlxU.exe
  C:\Windows\System\yIlvlxU.exe
  2⤵
  PID:4840
- C:\Windows\System\CrTCJCl.exe
  C:\Windows\System\CrTCJCl.exe
  2⤵
  PID:9324
- C:\Windows\System\OkqlEkZ.exe
  C:\Windows\System\OkqlEkZ.exe
  2⤵
  PID:4816
- C:\Windows\System\rjdoFWj.exe
  C:\Windows\System\rjdoFWj.exe
  2⤵
  PID:11536
- C:\Windows\System\hcuWdgH.exe
  C:\Windows\System\hcuWdgH.exe
  2⤵
  PID:10576
- C:\Windows\System\dZtLHWQ.exe
  C:\Windows\System\dZtLHWQ.exe
  2⤵
  PID:12688
- C:\Windows\System\WIgdOkV.exe
  C:\Windows\System\WIgdOkV.exe
  2⤵
  PID:12076
- C:\Windows\System\nsshIel.exe
  C:\Windows\System\nsshIel.exe
  2⤵
  PID:13160
- C:\Windows\System\drYdSkK.exe
  C:\Windows\System\drYdSkK.exe
  2⤵
  PID:13016
- C:\Windows\System\ztrZoRc.exe
  C:\Windows\System\ztrZoRc.exe
  2⤵
  PID:10572
- C:\Windows\System\BXYiLlh.exe
  C:\Windows\System\BXYiLlh.exe
  2⤵
  PID:1888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1smrkoqz.u3t.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BCYsRWv.exe

Filesize
2.3MB

MD5
2feb2ecb678724bc7d2bead07ec7d429

SHA1
4c052954c6410dd2a0eb7970c44e7492ad09cbd7

SHA256
3b25c2cf49f6165456965568d7dac75aa8178f2d8e59b4b18ae2f5b52d4ea126

SHA512
97c418470d64da1ca385ebf9924c1a3bc8416e7932685d4386bf3cb3d96797f59ad08e087980ac06bb288fbc4326005f18ef955a20ca81a481326b0aad8067e2

Download Submit
C:\Windows\System\CEphpwa.exe

Filesize
2.3MB

MD5
796fee24f164452ba31911942cd4fdd4

SHA1
4f8271c9625082d294a6640e98af22340f641e96

SHA256
3b5fe07a6b72fd9ba39ea915e9252204e21674a2acd6ccb167a5b8178328fe9e

SHA512
b5a6a5cd91d8545aa1d450221131bb3900324526e213fd0425389d5421c92c92b700d4ce7670a517adc1ae21362473b040e43dafc7c459b0b73571faf5db08a9

Download Submit
C:\Windows\System\DMErxUa.exe

Filesize
2.3MB

MD5
a06de37ce5e3db940dda61fd931247cb

SHA1
3e3d4ee584fa02f7e296038f796baf83a1c7ec58

SHA256
bc226bf2f754c579549dfd5f1b2cb1608e5987d92e4e6b5c1d9892087fa99116

SHA512
ee2032613319eac5440feaa31524ff9318b1547618b43adcbf86904a2b201500ebd9bf488834f0ae416352ecca8225170de303b05df01a80304a98c99cb5579f

Download Submit
C:\Windows\System\EUiIgol.exe

Filesize
2.3MB

MD5
2ffa3d2e1635acfd46b38bacd0dbf51d

SHA1
38b562e72a4365933cebad0de47e5f310ed59c1b

SHA256
35cfbe49fe79932dbd371e5258baee69e4f3c9037d123f7230080798b2bc6bab

SHA512
3ec3492ea262bd64156239fba0be40db89a4b6d07829ac9d159279c4d3dc5f887e12106070835488a3b93aef2d0fe607ac4a393ea1152fe7087d37afe1aeef29

Download Submit
C:\Windows\System\GCosOht.exe

Filesize
2.3MB

MD5
ebd731288142ce2161bb1441d16b80da

SHA1
6c2902bde47bec330519b64bf15d875055711e6b

SHA256
9ded2f5cb22a851bcc09514a4e04da61b9a72d86294c05a193f8c5ec3daaea28

SHA512
90d3110850440ff698e762e14f8b5ce32e27b558121e91508d87a4ddd8d7dadba6d9359c7ad84fa5da37c6813983b4f7805f88c06f472a711c65585926d47559

Download Submit
C:\Windows\System\GVcbptw.exe

Filesize
2.3MB

MD5
7c5e3786a0613455fa8930e8fefeacec

SHA1
475837e32bd1599d1bc30f3af1d20a672a6eb135

SHA256
e833558c7628e1d11a40cb185c8708db60ee05a326c4c8ef7cf9283998d83ef7

SHA512
aa91615c68ffaca17ddde56ba4499fb34844ff3ad4db312edf4d4eb9b5cb77b7bde896064783d1319e31e359e6b537b8b77f9795bd18ae938fa39948084fae34

Download Submit
C:\Windows\System\GiysNgS.exe

Filesize
2.3MB

MD5
112fe0daf4c4558a249212f5885ad632

SHA1
1a82867ea0390ad727c3241ee4185dbb0774621e

SHA256
49af500595e7aa9c5d379cac32ba2fe909f7521643ec5e1470f1b2eccf0a24af

SHA512
2f706c2bc47006a7114b51d3bffc376af631d6e15b9886576a4aec6734352a9e67aa5c11f584b8eec3621b86bcdab1f7646345c17c582f217afdd57e93d74e8b

Download Submit
C:\Windows\System\JItMnjd.exe

Filesize
2.3MB

MD5
98eb66fc529793a72ad174e3720257d1

SHA1
f2260c19d4c0e1d96e853b8f0e9b208cfadf7148

SHA256
9e3acc30db104ea07ebb9151d7076ab4892d4ed0aa9924512c9e97ff49e15adc

SHA512
e4735019f69213da4526f412e1a0882d1bed90ce6219f68399b2fe7e8f4ac8ebe602fbeaf3cbed6a43f240d21bd35606c7874aa257003af58c661bbb2d209702

Download Submit
C:\Windows\System\KGPMmuS.exe

Filesize
2.3MB

MD5
789076f3137f77cfa1a0ec1fe25bc7c6

SHA1
e3fcaf03dfcf84b3e8503fec1ff338b4917cf932

SHA256
e90679a740f21e003ac1cce54031acff936a3a0a839f0e40d7821c2991504819

SHA512
0a59d2f78246f3490f0f912bd097a433008f333c849056b79afe34f152e0236e022471d7c3216f388d1572bcb3464eb74e7694ee8e8d034a26184ef1b831b464

Download Submit
C:\Windows\System\LEiAsQr.exe

Filesize
2.3MB

MD5
8d5366852e579b4c8e1fb04fe1a2ed50

SHA1
6aeaf39d63e93d53eea637d9d60a97cf5d951dc4

SHA256
e390d97be2d11ecf536ba645d8dfce4bce3f022520ec6fcf51e087f252d4fb4f

SHA512
3eea1fce594bca72f224fb8ada213f1ed26dd1a54dfb61218053c38ba679292e987fbaeae5aa34eb9fda97379fb31d9a47d8b286961a0e32b55a597ab0e565a9

Download Submit
C:\Windows\System\OrwSjsW.exe

Filesize
2.3MB

MD5
fa8364ca331679d92041db8722343903

SHA1
0ad1c38ccafa8ef43fb11193271a99bf6ba5f3a5

SHA256
ecccf1f7fb85cc71803028f27163257050138d66c15fbed289771ea6a9bedf0c

SHA512
869db2078c7bdc5a46096eaa7df686fb8830d2c3897ed79d18e99e900d37bf3987ce498d296b2890bc40011bbdf91c803322ec3de7243384d36bee6567531b52

Download Submit
C:\Windows\System\PGacVOq.exe

Filesize
2.3MB

MD5
780a91ad0318ce3b0eb5d89fdd678719

SHA1
cb912cda826ecd52be1d72a959fdcd5a17abafd6

SHA256
96618a1fd6a8e0951a458ea7441c7485fe1ce51115ae6e3845a3eef874351744

SHA512
b7a51faadcb3ae81305de1127d5ba2d740274e19efe56fb67cd7b4a699e74423e822cb26553edf4e8ac764281bc6945ac00bb3f7326f30067531b0adb4330343

Download Submit
C:\Windows\System\QdBXzJD.exe

Filesize
2.3MB

MD5
0633d2d6b11626790685a01d4d85129f

SHA1
8027e917938c9ef17f0d22af081ff4f1c5ecc98d

SHA256
c3a5cbaf22748c9c925e8a4f95b1b3a1c95c2db7f43376aa29f37b925072244d

SHA512
9e250329b9989ab5dd43e56df7594945d1d755573ebb4f5af4ba3b5de5651dffda9f2e5d60dec82fdcffb85522083dbe28e067f8b0bf35aad3ff821e95d32d74

Download Submit
C:\Windows\System\TOmMzlQ.exe

Filesize
2.3MB

MD5
7a2fe0021f7a29f0dfd4c00a997d5cc0

SHA1
4ff9a5248ebcc604cbd4dbc15a4d9169f50cafd4

SHA256
b9fb246b26e90be54aa5488a9c1c18ec8ee73aedca394d6048f2a176e9ee570b

SHA512
d21d379d213f48ec3534217c8aa93d4c1f2051a9dd0034cf0a41686da655d68b05630e15fe6781c31e3fc47ee9a785faa61c7f2db3305a782a36421d1e7c3870

Download Submit
C:\Windows\System\UHAykgr.exe

Filesize
2.3MB

MD5
77baa0bd476d96147f8987951a39b192

SHA1
d72105739ae769e7c1928ebd8da06e7bbd02463c

SHA256
8efa98c1158b72f35db0c4b7a4819a053388817ee89340f5d29650bfc14f2ebd

SHA512
67a9a42114dbb8a7e4ff3b5260be65404017266e417f05a0c723204d338bfc2af259a2c8f0cb6c864f1d1ccf45ee8ff833f02a18468b89a05576b2b4169cc454

Download Submit
C:\Windows\System\XPLRLpv.exe

Filesize
2.3MB

MD5
7bd175808b8032f3ce718769a4a8280b

SHA1
fa43d2cd10d72d072ed123ebfdc4f6ec83af6242

SHA256
a82bd284211cb6ca585e7724de213bf10f83d4892f2d6ced7d6b88e31051ed93

SHA512
9d79a54eddfe3358af478a7a073764f137128ff3382beb6b123b0646946fba7adf0b069e8f01677275894f2b4619a3679fe21cd7911447f743d9eb7e5a851d10

Download Submit
C:\Windows\System\ZdaaBMo.exe

Filesize
2.3MB

MD5
97b8347414ae0bff7645189786d19f5d

SHA1
abcb39e004df9be5bcfd8da94c26958f97b152d1

SHA256
8d3cf2ab57fd5bc739e46f05f4b9f11f24fbff508c493f067dc7488bd4a8447f

SHA512
1be8bc093f79a3b4b62a9fb828e4b38c5dbc944cb65da7c7a455a076efb2013060d5263fab2351e9b77756575e611a5f43bb0b89982ec849a9ccbb504314fd04

Download Submit
C:\Windows\System\bPCEAjU.exe

Filesize
2.3MB

MD5
13b85a3240c797e66671672f2e1f7a82

SHA1
04814fb24e8922c192db78f9805c00732cb7f5bf

SHA256
c1622f4cb2105a7392550a9f2dba2b180e737a12ec9aa9a55484e81e5550e693

SHA512
994ade55d76709c23e90970e851414a98c1eb820d41eb74b35334ccca546d713fe0e9c4d24796864edc0f67d2fc8aa57de1b466aeeab1a1f9f7676e89ce9bacd

Download Submit
C:\Windows\System\daGGrIs.exe

Filesize
2.3MB

MD5
df5b232ead29c051b6dd10a30ce7d091

SHA1
0365a18d77e9fd191f109e4799a87b2e2bf8026a

SHA256
6274b22c334b6b313ff26752a480c59d89fe4b0da7301971c184394fdc7dfc63

SHA512
49c75bfcaae67a0bed9c8061a6e0c9f29a743d685506b19e1c044b9ff495f289d69629b81d356a18298bdf5d2328432f3f929814024f762570fd5e49a74bd4e2

Download Submit
C:\Windows\System\fvvNqaO.exe

Filesize
2.3MB

MD5
8dafa8bfbb2021c08fe65e18f0d0c03c

SHA1
d353f9085d373684c747dd308074fa28bcc48630

SHA256
0b852a74f9f24ea76133ac648af5a84ea7210239e7b296881cfc53099274336a

SHA512
24757803e60614c7bea09e0091f66d63a0843229a80a6e9d75eb59649cb7a3baf43ef8ae8ff79d35a8d351b99480181437f388687f84a6e9ebe0728ff8172f9c

Download Submit
C:\Windows\System\gOKpSeA.exe

Filesize
2.3MB

MD5
2579d00abf26de3b6a6800deb46a2f1a

SHA1
1948d36d7fe5fb29758a46fb2db280c691dd1677

SHA256
ec596d6394a1e8c7cdc48913d695b0e0c73b309a32d35933a108f114fe17020e

SHA512
a6185d09fdb2e870527746beb32c05821f72166aba67a9bb0f2a48c99c54ec2b7394f3ac9f59c300f85c4f0912130c671789fd25221b6ce2655c6097227cc3f9

Download Submit
C:\Windows\System\gSeJvKg.exe

Filesize
2.3MB

MD5
bb4b4e7ea0beb730ec5f4dc06fae8b81

SHA1
af5e3877d8f81581f1dc2a2cee347a642f1dd638

SHA256
5457dbfc039dc98e5c57fe689c7b73f06c933e59dc9a542bf7c3eddf558b9d5e

SHA512
ba8c8c4836bf6ac3ed39b914fa7082a8ef08e22bfb2cf2898e3e01243e9d3a1737b780db35920463803ff5b503270d564e8a045ded84959d3d8cac55eca09fe9

Download Submit
C:\Windows\System\gWKNSvE.exe

Filesize
2.3MB

MD5
8eb3c51cbbe9346022be7d56d5df48b5

SHA1
3eb6507977d2be595b60ed7e9e61b35cd4224304

SHA256
bd1488ad6fe8a1f7a4b793c6042da30ce574064497fa46b8a40716dc62f595e2

SHA512
7ff152720196f29817322158175b51e71ddafe4a977cf0810f216fbfa6c8ceec22cdceac9ff84d0d2b93098f1a54977a8055c51361e6e21d742daaf11985896d

Download Submit
C:\Windows\System\gXYLGBk.exe

Filesize
2.3MB

MD5
0cc6862dfaae0c52216a7c78c6ee66b2

SHA1
9df02bbf96f0be37411ce477dae6212da0e867b7

SHA256
cf17d3f1762b66334bf056b1553804ed95c658a5638bfa37c30d7fd749b359bb

SHA512
7ac35c12f859edd8c7aed8cc182cf2719769491598fe8d72eab9e25d815ecfe494627b58622bebde86f0f25b4a19f0a2111fad6d262ad660b248c68ac6ed09ae

Download Submit
C:\Windows\System\gghdyFr.exe

Filesize
2.3MB

MD5
d4bbcc46df556ab152a13ad102e84962

SHA1
4ba990254e3eb4e8c45da7da00ffbf3cf844767c

SHA256
efea8145625422dd00fe8d447bdbb1fe7b21fe3107e4a93b8667b258e465da90

SHA512
abbb9b5f72bcb7fd839ed0a7d3fa83bce1be079de1e4624767ed6ad8f787b75d5be82ea54b59517f2ae50a55630eb71d666e84c0356cd6827f660874a55d484e

Download Submit
C:\Windows\System\jGOTmEK.exe

Filesize
2.3MB

MD5
355f8dccd9fc309875e1b971a969137a

SHA1
8f7e5dd0073aeb87cf331dc99ebdd3d0f816ed71

SHA256
adfa32b670aefb55fe550c8f6b91bd5a94099bdceb2e3afba29c3db95fcc9cf1

SHA512
1cb1561fa26f4d2743bb6a344578c61c249f09761a56eb56355f275d7321e977b6fc53c694e55442f9ff435422b353ecbb9b73bc0740796d96dc930bec8c68e8

Download Submit
C:\Windows\System\lmAgMfF.exe

Filesize
2.3MB

MD5
fa9595c12bed5b24bbb3fe3348aafe8e

SHA1
e8d340bfb068328c5a87ea6385656f1375dee06b

SHA256
d09cd296214a7a51a182048e4a4887ff3c99c432fd1c28d5874b0fa108de6257

SHA512
d5618888dbe37e169ca92475bb6371d9d73010657431fc94f84c6658d1243bcf8124f9a4767a313584a30d4ce02bcae1cd88059b9df20677a96b57cdc3c4b86a

Download Submit
C:\Windows\System\mNvwCSH.exe

Filesize
2.3MB

MD5
4da8685a6850ad83789bd16ff8ab92e2

SHA1
ea69dc195c0c8be3a4cd8343df4fe3c0b49b752d

SHA256
99626a5764d870e54cc391e2f4b4c73aabb1fa15f5106b97d68c84b483c6ae9a

SHA512
f409b14634538ffb2dfc5df7e2afeb2bdebc7c55e42834d78fa8123b13dc20b748cc192bf86efa3796dc633a866ef6dc39a2cddfce502e740e6848caf430b2fb

Download Submit
C:\Windows\System\ntVifQH.exe

Filesize
2.3MB

MD5
e5492da7a526ba6c4de47acf5eec0a14

SHA1
28c8f0772ef7b18d27080710fe4eb4ac9f72685c

SHA256
623f016204770f15375516be5968928f2cef0e91fab4190bc14156fd8f36ee4b

SHA512
b7b8a064cfeaeaee09d91c0d1baee7d882fb65b68217200d4342b071fc9eedcde5e1440d69f4974936b69abc7d98f36c33f44c5376a65ef0d7e3b0c45c502f3d

Download Submit
C:\Windows\System\suNjgHL.exe

Filesize
2.3MB

MD5
9fccfd67a46d7a40047206fc29545e06

SHA1
e77a5dbb39798867982e69e526e520f5b8929e0c

SHA256
c5aed76616de09198f8c06d0b58e971f65373eb1c6c0ae7ec89cb7f0dbe0b2cc

SHA512
a989c26d722729c84250f2d2144dcb37f9560e4695649b0b14184c95a6b6dae049d7ec116ade65f0356914d8ce8a2884a59ee9476ad085db570080edeb9fdc88

Download Submit
C:\Windows\System\tXkHlHe.exe

Filesize
2.3MB

MD5
85c7a67726db607cc1614f0f5a24fdd7

SHA1
0b9488bd9ce97ee0e1c09e147dbc51bab98cd556

SHA256
2b456af2f5bcc51f073f635d7009fb73481f6a8b7af49706476ede7aef254f0b

SHA512
ea1809de6f0417091a61c08a2cece0849808531d0c5e630ecf4c6186fd1664e9df2b73706bad484ca9532561c02ff7a39cba8318e4ec23a52d70d86602c11655

Download Submit
C:\Windows\System\ttPRaqf.exe

Filesize
2.3MB

MD5
0c683a21dd85cbc254a19e95744d9280

SHA1
025ca2bb31276efb44ac73ed5db3f462348a24e3

SHA256
4a43628aeb10a9163231df4d9087742491bcc6bf68e130a3257705d06dbda73d

SHA512
60775e87361572654a4137132f956371fce878c319f3ae0cd695595a692bfb3f6c50bd180b61705013f82b163ef868d4dbddd700c41ccba40b0fb03a994e250a

Download Submit
C:\Windows\System\uytcTKi.exe

Filesize
2.3MB

MD5
1669e9e5f89a9653ef54e7ff1a11defc

SHA1
bf396f37c061e2f2c0183fddac8b5102299d1be8

SHA256
0fe932369952003c69e0652f59b72f652dfebe7ccce2d077076740578b94466c

SHA512
4c83832b9df68c01cd8bd5943279c8800e9a5ca6b22819db87924834d44b4c22cbf00ade769e110d74c0b882cebc4d45ded2b377513f20e826c827a048aeefc2

Download Submit
C:\Windows\System\vVRRvtf.exe

Filesize
2.3MB

MD5
020c090481a8f704d95766cb849670db

SHA1
ab9b8fdc69782c35c15a8ac5a8e51800467d9190

SHA256
e0113f6c201bf7feb5c48da0eb747deb398217a4f5fdb8cff65d32f396c4ce83

SHA512
f0318039414a394035b1913bf0582a90dc8def10f5c79e8ae9d8e88625f17cddb5495b02587fde5af1505a29640e7d4319a14b1f77341ac3c5842249c7483506

Download Submit
C:\Windows\System\xAXRbKL.exe

Filesize
2.3MB

MD5
89e6bd306bc74c4ebc9154d3159f1a49

SHA1
5aad592e76aec3812852fdbce2c72eb428fa1f47

SHA256
933ae86346e18d1cd7e803c34ccf68edb2ce3980890d1b347d8a545a790445a2

SHA512
f0c4ed214f299d6c3c0148838afa9501df6da8b4d5c5eb0c2b09a53f476ff718308d2f99176c659101d1c570dbe72d331ccca3d22211ae4f0192d9a2752b7fc2

Download Submit
C:\Windows\System\xYdZOZr.exe

Filesize
8B

MD5
2adac273ce248e8d242a4b12f749bb46

SHA1
300bd2c60c669d978305195f11eaf26c73d9e457

SHA256
5a695799bf8f73300a4f9c4a59fd25b209a2457abf1051a262d540e520557456

SHA512
011941b215532355e8e4d21af78180da68d2fe04927118ebe818ec14ec4bfb6a7a2d9aaa01fdfd0cd2c6dc84968b5f642ccf10cc92c29aa0e1d06bcf6f120232

Download Submit
C:\Windows\System\zTCKqMj.exe

Filesize
2.3MB

MD5
20425866e396e162518918d388adfdc8

SHA1
f5dfe088ab4e9ec47b29e5fec740f169d7fcdcd7

SHA256
980d2e1e6434f06fee0a938bc1879f1cd1f07cd1f5e4d4745b3a252217f3f901

SHA512
804b953eaadb752e8f79193c345e334eb1eb05d2a1db0d95e5b5ea9dff77e22fc83f1f8fad6a535ee73939ba1b13e1c1edba5edb843719acb6ea32cc05dfc3bd

Download Submit
C:\Windows\System\zYMPFYp.exe

Filesize
2.3MB

MD5
7eb74dbd44fc1f3dc09438b71639f2df

SHA1
3ce82e3dab421d8bf5df4e9a64cf5ea34cf37e2f

SHA256
e484c8bf332a8037d3971dd2a00aa79dfd1730436188612f6232e2cab2e2723b

SHA512
1d1eb7debe69bb552968e9f6647cf02bd8de439f2041893eed1ceaeb3e3ce71b9e04a7add52c002b9cfabbbe94368d9d983f836a6ac3274469a14d4aedb38514

Download Submit
memory/400-127-0x00007FF6D38B0000-0x00007FF6D3CA2000-memory.dmp

Filesize
3.9MB

Download
memory/400-2867-0x00007FF6D38B0000-0x00007FF6D3CA2000-memory.dmp

Filesize
3.9MB

Download
memory/536-1-0x00000226FBC30000-0x00000226FBC40000-memory.dmp

Filesize
64KB

Download
memory/536-0-0x00007FF64B960000-0x00007FF64BD52000-memory.dmp

Filesize
3.9MB

Download
memory/928-2879-0x00007FF7A1E10000-0x00007FF7A2202000-memory.dmp

Filesize
3.9MB

Download
memory/928-231-0x00007FF7A1E10000-0x00007FF7A2202000-memory.dmp

Filesize
3.9MB

Download
memory/1252-2853-0x00007FF740240000-0x00007FF740632000-memory.dmp

Filesize
3.9MB

Download
memory/1252-394-0x00007FF740240000-0x00007FF740632000-memory.dmp

Filesize
3.9MB

Download
memory/1520-395-0x00007FF77F280000-0x00007FF77F672000-memory.dmp

Filesize
3.9MB

Download
memory/1520-2877-0x00007FF77F280000-0x00007FF77F672000-memory.dmp

Filesize
3.9MB

Download
memory/1640-339-0x00007FF7259F0000-0x00007FF725DE2000-memory.dmp

Filesize
3.9MB

Download
memory/1640-2902-0x00007FF7259F0000-0x00007FF725DE2000-memory.dmp

Filesize
3.9MB

Download
memory/1752-2883-0x00007FF78B860000-0x00007FF78BC52000-memory.dmp

Filesize
3.9MB

Download
memory/1752-422-0x00007FF78B860000-0x00007FF78BC52000-memory.dmp

Filesize
3.9MB

Download
memory/2308-2851-0x00007FF602C00000-0x00007FF602FF2000-memory.dmp

Filesize
3.9MB

Download
memory/2308-73-0x00007FF602C00000-0x00007FF602FF2000-memory.dmp

Filesize
3.9MB

Download
memory/2344-2892-0x00007FF67C8A0000-0x00007FF67CC92000-memory.dmp

Filesize
3.9MB

Download
memory/2344-430-0x00007FF67C8A0000-0x00007FF67CC92000-memory.dmp

Filesize
3.9MB

Download
memory/2360-382-0x00007FF72DEB0000-0x00007FF72E2A2000-memory.dmp

Filesize
3.9MB

Download
memory/2360-2895-0x00007FF72DEB0000-0x00007FF72E2A2000-memory.dmp

Filesize
3.9MB

Download
memory/2464-273-0x00007FF6E8B10000-0x00007FF6E8F02000-memory.dmp

Filesize
3.9MB

Download
memory/2464-2858-0x00007FF6E8B10000-0x00007FF6E8F02000-memory.dmp

Filesize
3.9MB

Download
memory/2508-386-0x00007FF7B2110000-0x00007FF7B2502000-memory.dmp

Filesize
3.9MB

Download
memory/2508-2849-0x00007FF7B2110000-0x00007FF7B2502000-memory.dmp

Filesize
3.9MB

Download
memory/2592-2887-0x00007FF7847E0000-0x00007FF784BD2000-memory.dmp

Filesize
3.9MB

Download
memory/2592-260-0x00007FF7847E0000-0x00007FF784BD2000-memory.dmp

Filesize
3.9MB

Download
memory/2776-245-0x0000012940FB0000-0x0000012940FD2000-memory.dmp

Filesize
136KB

Download
memory/2776-45-0x00000129287F0000-0x0000012928800000-memory.dmp

Filesize
64KB

Download
memory/2776-44-0x00007FFFFBC00000-0x00007FFFFC6C1000-memory.dmp

Filesize
10.8MB

Download
memory/2776-130-0x00000129287F0000-0x0000012928800000-memory.dmp

Filesize
64KB

Download
memory/2888-94-0x00007FF77A670000-0x00007FF77AA62000-memory.dmp

Filesize
3.9MB

Download
memory/2888-2862-0x00007FF77A670000-0x00007FF77AA62000-memory.dmp

Filesize
3.9MB

Download
memory/3108-2865-0x00007FF76A480000-0x00007FF76A872000-memory.dmp

Filesize
3.9MB

Download
memory/3108-331-0x00007FF76A480000-0x00007FF76A872000-memory.dmp

Filesize
3.9MB

Download
memory/3112-2860-0x00007FF759D60000-0x00007FF75A152000-memory.dmp

Filesize
3.9MB

Download
memory/3112-168-0x00007FF759D60000-0x00007FF75A152000-memory.dmp

Filesize
3.9MB

Download
memory/3352-340-0x00007FF639170000-0x00007FF639562000-memory.dmp

Filesize
3.9MB

Download
memory/3352-2900-0x00007FF639170000-0x00007FF639562000-memory.dmp

Filesize
3.9MB

Download
memory/3644-347-0x00007FF7494E0000-0x00007FF7498D2000-memory.dmp

Filesize
3.9MB

Download
memory/3644-2873-0x00007FF7494E0000-0x00007FF7498D2000-memory.dmp

Filesize
3.9MB

Download
memory/4460-2863-0x00007FF6379C0000-0x00007FF637DB2000-memory.dmp

Filesize
3.9MB

Download
memory/4460-197-0x00007FF6379C0000-0x00007FF637DB2000-memory.dmp

Filesize
3.9MB

Download
memory/4904-2856-0x00007FF605CC0000-0x00007FF6060B2000-memory.dmp

Filesize
3.9MB

Download
memory/4904-296-0x00007FF605CC0000-0x00007FF6060B2000-memory.dmp

Filesize
3.9MB

Download
memory/4956-2872-0x00007FF6A9360000-0x00007FF6A9752000-memory.dmp

Filesize
3.9MB

Download
memory/4956-261-0x00007FF6A9360000-0x00007FF6A9752000-memory.dmp

Filesize
3.9MB

Download
memory/5028-2898-0x00007FF6CB720000-0x00007FF6CBB12000-memory.dmp

Filesize
3.9MB

Download
memory/5028-299-0x00007FF6CB720000-0x00007FF6CBB12000-memory.dmp

Filesize
3.9MB

Download