xmrig | e06d6481c5e2811c20ec9f7a8f12e317785354d5b441c31b275f4ebc881d198d

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 08:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
Size

1.9MB
MD5

073780e99cce775f06742ce7037b1f93
SHA1

130d5672f44e4a03cfd5fe789544f5ff8a384deb
SHA256

e06d6481c5e2811c20ec9f7a8f12e317785354d5b441c31b275f4ebc881d198d
SHA512

63fa843d36d49d31f1534eea769c5abd62c0620e4026f394500bf0a0e018c6e9f527ffbcb5552e448b7cdcd1bb490f412d084f107d5918d54db12c91170f9473
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+UAm:NABG

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 42 IoCs

miner

resource	yara_rule
behavioral2/memory/5080-463-0x00007FF7434F0000-0x00007FF7438E2000-memory.dmp	xmrig
behavioral2/memory/4296-540-0x00007FF7175E0000-0x00007FF7179D2000-memory.dmp	xmrig
behavioral2/memory/3448-653-0x00007FF692D30000-0x00007FF693122000-memory.dmp	xmrig
behavioral2/memory/3280-702-0x00007FF6A1D00000-0x00007FF6A20F2000-memory.dmp	xmrig
behavioral2/memory/440-703-0x00007FF6DADC0000-0x00007FF6DB1B2000-memory.dmp	xmrig
behavioral2/memory/3672-701-0x00007FF60F1E0000-0x00007FF60F5D2000-memory.dmp	xmrig
behavioral2/memory/3560-534-0x00007FF7E0430000-0x00007FF7E0822000-memory.dmp	xmrig
behavioral2/memory/3956-460-0x00007FF7A9AF0000-0x00007FF7A9EE2000-memory.dmp	xmrig
behavioral2/memory/732-393-0x00007FF686BD0000-0x00007FF686FC2000-memory.dmp	xmrig
behavioral2/memory/2904-346-0x00007FF7D6730000-0x00007FF7D6B22000-memory.dmp	xmrig
behavioral2/memory/3232-284-0x00007FF72C3F0000-0x00007FF72C7E2000-memory.dmp	xmrig
behavioral2/memory/1008-280-0x00007FF70C5A0000-0x00007FF70C992000-memory.dmp	xmrig
behavioral2/memory/772-252-0x00007FF60DF00000-0x00007FF60E2F2000-memory.dmp	xmrig
behavioral2/memory/696-219-0x00007FF636620000-0x00007FF636A12000-memory.dmp	xmrig
behavioral2/memory/3680-181-0x00007FF6A1170000-0x00007FF6A1562000-memory.dmp	xmrig
behavioral2/memory/3940-130-0x00007FF7DAE00000-0x00007FF7DB1F2000-memory.dmp	xmrig
behavioral2/memory/3432-124-0x00007FF773600000-0x00007FF7739F2000-memory.dmp	xmrig
behavioral2/memory/1828-86-0x00007FF6A2B70000-0x00007FF6A2F62000-memory.dmp	xmrig
behavioral2/memory/1948-90-0x00007FF6DAD40000-0x00007FF6DB132000-memory.dmp	xmrig
behavioral2/memory/4652-65-0x00007FF685430000-0x00007FF685822000-memory.dmp	xmrig
behavioral2/memory/3372-46-0x00007FF6D5A50000-0x00007FF6D5E42000-memory.dmp	xmrig
behavioral2/memory/3448-2897-0x00007FF692D30000-0x00007FF693122000-memory.dmp	xmrig
behavioral2/memory/3372-2899-0x00007FF6D5A50000-0x00007FF6D5E42000-memory.dmp	xmrig
behavioral2/memory/4652-2901-0x00007FF685430000-0x00007FF685822000-memory.dmp	xmrig
behavioral2/memory/1828-2903-0x00007FF6A2B70000-0x00007FF6A2F62000-memory.dmp	xmrig
behavioral2/memory/3940-2905-0x00007FF7DAE00000-0x00007FF7DB1F2000-memory.dmp	xmrig
behavioral2/memory/1948-2907-0x00007FF6DAD40000-0x00007FF6DB132000-memory.dmp	xmrig
behavioral2/memory/3680-2911-0x00007FF6A1170000-0x00007FF6A1562000-memory.dmp	xmrig
behavioral2/memory/3432-2910-0x00007FF773600000-0x00007FF7739F2000-memory.dmp	xmrig
behavioral2/memory/772-2913-0x00007FF60DF00000-0x00007FF60E2F2000-memory.dmp	xmrig
behavioral2/memory/2904-2919-0x00007FF7D6730000-0x00007FF7D6B22000-memory.dmp	xmrig
behavioral2/memory/696-2923-0x00007FF636620000-0x00007FF636A12000-memory.dmp	xmrig
behavioral2/memory/3280-2922-0x00007FF6A1D00000-0x00007FF6A20F2000-memory.dmp	xmrig
behavioral2/memory/1008-2925-0x00007FF70C5A0000-0x00007FF70C992000-memory.dmp	xmrig
behavioral2/memory/732-2927-0x00007FF686BD0000-0x00007FF686FC2000-memory.dmp	xmrig
behavioral2/memory/3956-2929-0x00007FF7A9AF0000-0x00007FF7A9EE2000-memory.dmp	xmrig
behavioral2/memory/3672-2918-0x00007FF60F1E0000-0x00007FF60F5D2000-memory.dmp	xmrig
behavioral2/memory/3232-2916-0x00007FF72C3F0000-0x00007FF72C7E2000-memory.dmp	xmrig
behavioral2/memory/5080-2943-0x00007FF7434F0000-0x00007FF7438E2000-memory.dmp	xmrig
behavioral2/memory/4296-2942-0x00007FF7175E0000-0x00007FF7179D2000-memory.dmp	xmrig
behavioral2/memory/440-2940-0x00007FF6DADC0000-0x00007FF6DB1B2000-memory.dmp	xmrig
behavioral2/memory/3560-2953-0x00007FF7E0430000-0x00007FF7E0822000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3448	hCdRrwm.exe
3372	WDvUUrZ.exe
4652	xYmUTta.exe
1828	CPXNcQP.exe
1948	MWXkRkr.exe
3432	FYqvJbl.exe
3940	HsQBHMh.exe
3680	dAlRtAu.exe
3672	pyJoOiJ.exe
696	GpQaeqN.exe
772	gCoofeT.exe
1008	doyMHwF.exe
3280	CDVJHTg.exe
3232	taXJHjd.exe
2904	MIgkdNG.exe
732	XrlNgKU.exe
3956	SrHVvRB.exe
5080	mcLWOFK.exe
440	tGCuOyN.exe
3560	byzNLZv.exe
4296	GKUjccm.exe
4664	GShVncl.exe
4048	titwezO.exe
212	qRRTZZu.exe
1240	rmUJaec.exe
4308	EogbwBo.exe
552	fodRuRH.exe
1124	MAVbdxQ.exe
4744	aijPrMC.exe
2692	uOiEBra.exe
888	nHhXlGx.exe
4448	ATCPtkz.exe
2732	eINBkcs.exe
1160	RUUndia.exe
2448	gajbWtl.exe
3140	cWFudsI.exe
4920	fkAthOX.exe
4504	vghCMha.exe
4064	RfRSTFz.exe
2600	yjkmlmJ.exe
4988	vTqipVi.exe
4608	REZhGKE.exe
4872	TbaDDal.exe
1596	RwGxhec.exe
2552	earkARo.exe
2664	yUVBAFH.exe
2208	TzxGzPz.exe
3932	XhUYgWB.exe
4480	ItCceSc.exe
4384	QDuzWUS.exe
516	lnTwEBH.exe
2032	hNgTdPo.exe
1852	podpngu.exe
4352	ukcONCx.exe
2200	wjneBFD.exe
2100	eVUDTUV.exe
1140	IWgPdaU.exe
4860	bIBJzsK.exe
4940	eOhbnit.exe
4008	UzxgyuT.exe
1864	rZRYqmr.exe
2968	ljrpcHj.exe
1616	oyCAtfE.exe
1212	XTAHCMB.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1012-0-0x00007FF6CA7D0000-0x00007FF6CABC2000-memory.dmp	upx
behavioral2/files/0x000800000002344c-5.dat	upx
behavioral2/files/0x000800000002344f-7.dat	upx
behavioral2/files/0x0007000000023450-14.dat	upx
behavioral2/files/0x0007000000023454-51.dat	upx
behavioral2/files/0x0007000000023455-59.dat	upx
behavioral2/files/0x0007000000023470-185.dat	upx
behavioral2/files/0x000700000002346e-203.dat	upx
behavioral2/files/0x000700000002346c-202.dat	upx
behavioral2/files/0x0007000000023475-201.dat	upx
behavioral2/files/0x0007000000023463-196.dat	upx
behavioral2/files/0x0007000000023462-191.dat	upx
behavioral2/files/0x0007000000023473-188.dat	upx
behavioral2/files/0x0007000000023472-187.dat	upx
behavioral2/files/0x0007000000023471-186.dat	upx
behavioral2/files/0x000700000002346f-173.dat	upx
behavioral2/memory/5080-463-0x00007FF7434F0000-0x00007FF7438E2000-memory.dmp	upx
behavioral2/memory/4296-540-0x00007FF7175E0000-0x00007FF7179D2000-memory.dmp	upx
behavioral2/memory/3448-653-0x00007FF692D30000-0x00007FF693122000-memory.dmp	upx
behavioral2/memory/3280-702-0x00007FF6A1D00000-0x00007FF6A20F2000-memory.dmp	upx
behavioral2/memory/440-703-0x00007FF6DADC0000-0x00007FF6DB1B2000-memory.dmp	upx
behavioral2/memory/3672-701-0x00007FF60F1E0000-0x00007FF60F5D2000-memory.dmp	upx
behavioral2/memory/3560-534-0x00007FF7E0430000-0x00007FF7E0822000-memory.dmp	upx
behavioral2/memory/3956-460-0x00007FF7A9AF0000-0x00007FF7A9EE2000-memory.dmp	upx
behavioral2/memory/732-393-0x00007FF686BD0000-0x00007FF686FC2000-memory.dmp	upx
behavioral2/memory/2904-346-0x00007FF7D6730000-0x00007FF7D6B22000-memory.dmp	upx
behavioral2/memory/3232-284-0x00007FF72C3F0000-0x00007FF72C7E2000-memory.dmp	upx
behavioral2/memory/1008-280-0x00007FF70C5A0000-0x00007FF70C992000-memory.dmp	upx
behavioral2/memory/772-252-0x00007FF60DF00000-0x00007FF60E2F2000-memory.dmp	upx
behavioral2/memory/696-219-0x00007FF636620000-0x00007FF636A12000-memory.dmp	upx
behavioral2/files/0x0007000000023474-199.dat	upx
behavioral2/files/0x000700000002346d-165.dat	upx
behavioral2/files/0x000700000002345f-159.dat	upx
behavioral2/files/0x0007000000023464-157.dat	upx
behavioral2/files/0x0007000000023467-153.dat	upx
behavioral2/files/0x000700000002345e-152.dat	upx
behavioral2/files/0x0007000000023466-145.dat	upx
behavioral2/files/0x000700000002345d-139.dat	upx
behavioral2/files/0x000700000002345a-138.dat	upx
behavioral2/memory/3680-181-0x00007FF6A1170000-0x00007FF6A1562000-memory.dmp	upx
behavioral2/files/0x0007000000023460-180.dat	upx
behavioral2/memory/3940-130-0x00007FF7DAE00000-0x00007FF7DB1F2000-memory.dmp	upx
behavioral2/files/0x000700000002345b-127.dat	upx
behavioral2/memory/3432-124-0x00007FF773600000-0x00007FF7739F2000-memory.dmp	upx
behavioral2/files/0x000700000002345c-120.dat	upx
behavioral2/files/0x000700000002346b-156.dat	upx
behavioral2/files/0x000700000002346a-154.dat	upx
behavioral2/files/0x0007000000023461-99.dat	upx
behavioral2/files/0x0007000000023456-97.dat	upx
behavioral2/files/0x0007000000023465-134.dat	upx
behavioral2/memory/1828-86-0x00007FF6A2B70000-0x00007FF6A2F62000-memory.dmp	upx
behavioral2/files/0x0007000000023457-85.dat	upx
behavioral2/files/0x0007000000023459-77.dat	upx
behavioral2/files/0x0007000000023458-75.dat	upx
behavioral2/memory/1948-90-0x00007FF6DAD40000-0x00007FF6DB132000-memory.dmp	upx
behavioral2/memory/4652-65-0x00007FF685430000-0x00007FF685822000-memory.dmp	upx
behavioral2/files/0x0007000000023452-54.dat	upx
behavioral2/files/0x0007000000023453-49.dat	upx
behavioral2/files/0x0007000000023451-34.dat	upx
behavioral2/memory/3372-46-0x00007FF6D5A50000-0x00007FF6D5E42000-memory.dmp	upx
behavioral2/memory/3448-2897-0x00007FF692D30000-0x00007FF693122000-memory.dmp	upx
behavioral2/memory/3372-2899-0x00007FF6D5A50000-0x00007FF6D5E42000-memory.dmp	upx
behavioral2/memory/4652-2901-0x00007FF685430000-0x00007FF685822000-memory.dmp	upx
behavioral2/memory/1828-2903-0x00007FF6A2B70000-0x00007FF6A2F62000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\jreGkWC.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\BoUqRxi.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\hJIkqwZ.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\ErRZQGa.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\wNErnNs.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\ZkjfcqO.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\cVMbzvN.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\FgcdQCe.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\LgWiQOC.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\fmBKsKU.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\euilqqR.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\xdtliLV.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\AbZRQQq.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\fUOGKFA.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\xXuYNdq.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\mFafFCw.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\oSRVqEZ.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\LbSjFzC.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\SnEbDzs.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\JeVwMON.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\iQEsgQx.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\cvJGGyD.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\vPaiUgk.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\ZmVaose.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\TKfrVAg.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\lMsBqvL.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\yJArOKQ.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\XaljKbc.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\AmqZVrk.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\lXBBFyh.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\yWZzEIZ.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\zgBfeaf.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\EDorNRz.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\RLEbmoq.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\sJZvNde.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\XkDcHyA.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\zCkCWcV.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\fXoeLNm.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\EuSIXsC.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\etnCmUf.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\NzScUcK.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\MemisAd.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\mHiiZGo.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\IZcSJME.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\lViqRLl.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\sMtRvCQ.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\WFYgwWE.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\VzleFoL.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\wnyLBek.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\kTafiDH.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\BDsEFJy.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\uumdKwy.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\yPLrZbs.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\fXUzhcd.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\ehbnzmQ.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\qgsXeBi.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\EHihUkY.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\SYmQnwl.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\mSvScKa.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\SUcvjlB.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\IvIyArO.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\DbgextT.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\TdrdoxG.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\cMDWnHi.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
436	powershell.exe
436	powershell.exe
436	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
Token: SeDebugPrivilege	436	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1012 wrote to memory of 436	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	83
PID 1012 wrote to memory of 436	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	83
PID 1012 wrote to memory of 3448	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	84
PID 1012 wrote to memory of 3448	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	84
PID 1012 wrote to memory of 3372	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	85
PID 1012 wrote to memory of 3372	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	85
PID 1012 wrote to memory of 4652	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	86
PID 1012 wrote to memory of 4652	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	86
PID 1012 wrote to memory of 1828	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	87
PID 1012 wrote to memory of 1828	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	87
PID 1012 wrote to memory of 1948	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	88
PID 1012 wrote to memory of 1948	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	88
PID 1012 wrote to memory of 3432	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	89
PID 1012 wrote to memory of 3432	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	89
PID 1012 wrote to memory of 3940	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	90
PID 1012 wrote to memory of 3940	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	90
PID 1012 wrote to memory of 3680	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	91
PID 1012 wrote to memory of 3680	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	91
PID 1012 wrote to memory of 696	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	92
PID 1012 wrote to memory of 696	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	92
PID 1012 wrote to memory of 3672	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	93
PID 1012 wrote to memory of 3672	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	93
PID 1012 wrote to memory of 2904	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	94
PID 1012 wrote to memory of 2904	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	94
PID 1012 wrote to memory of 772	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	95
PID 1012 wrote to memory of 772	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	95
PID 1012 wrote to memory of 1008	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	96
PID 1012 wrote to memory of 1008	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	96
PID 1012 wrote to memory of 3280	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	97
PID 1012 wrote to memory of 3280	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	97
PID 1012 wrote to memory of 3232	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	98
PID 1012 wrote to memory of 3232	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	98
PID 1012 wrote to memory of 732	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	99
PID 1012 wrote to memory of 732	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	99
PID 1012 wrote to memory of 3956	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	100
PID 1012 wrote to memory of 3956	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	100
PID 1012 wrote to memory of 5080	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	101
PID 1012 wrote to memory of 5080	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	101
PID 1012 wrote to memory of 440	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	102
PID 1012 wrote to memory of 440	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	102
PID 1012 wrote to memory of 3560	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	103
PID 1012 wrote to memory of 3560	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	103
PID 1012 wrote to memory of 4296	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	104
PID 1012 wrote to memory of 4296	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	104
PID 1012 wrote to memory of 4664	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	105
PID 1012 wrote to memory of 4664	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	105
PID 1012 wrote to memory of 4048	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	106
PID 1012 wrote to memory of 4048	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	106
PID 1012 wrote to memory of 212	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	107
PID 1012 wrote to memory of 212	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	107
PID 1012 wrote to memory of 1240	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	108
PID 1012 wrote to memory of 1240	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	108
PID 1012 wrote to memory of 4308	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	109
PID 1012 wrote to memory of 4308	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	109
PID 1012 wrote to memory of 552	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	110
PID 1012 wrote to memory of 552	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	110
PID 1012 wrote to memory of 1124	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	111
PID 1012 wrote to memory of 1124	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	111
PID 1012 wrote to memory of 4504	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	112
PID 1012 wrote to memory of 4504	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	112
PID 1012 wrote to memory of 4744	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	113
PID 1012 wrote to memory of 4744	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	113
PID 1012 wrote to memory of 2692	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	114
PID 1012 wrote to memory of 2692	1012	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	114

C:\Users\Admin\AppData\Local\Temp\073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:436
- C:\Windows\System\hCdRrwm.exe
  C:\Windows\System\hCdRrwm.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\WDvUUrZ.exe
  C:\Windows\System\WDvUUrZ.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\xYmUTta.exe
  C:\Windows\System\xYmUTta.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\CPXNcQP.exe
  C:\Windows\System\CPXNcQP.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\MWXkRkr.exe
  C:\Windows\System\MWXkRkr.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\FYqvJbl.exe
  C:\Windows\System\FYqvJbl.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\HsQBHMh.exe
  C:\Windows\System\HsQBHMh.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\dAlRtAu.exe
  C:\Windows\System\dAlRtAu.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System\GpQaeqN.exe
  C:\Windows\System\GpQaeqN.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\pyJoOiJ.exe
  C:\Windows\System\pyJoOiJ.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\MIgkdNG.exe
  C:\Windows\System\MIgkdNG.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\gCoofeT.exe
  C:\Windows\System\gCoofeT.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\doyMHwF.exe
  C:\Windows\System\doyMHwF.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\CDVJHTg.exe
  C:\Windows\System\CDVJHTg.exe
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Windows\System\taXJHjd.exe
  C:\Windows\System\taXJHjd.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\XrlNgKU.exe
  C:\Windows\System\XrlNgKU.exe
  2⤵
  - Executes dropped EXE
  PID:732
- C:\Windows\System\SrHVvRB.exe
  C:\Windows\System\SrHVvRB.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\mcLWOFK.exe
  C:\Windows\System\mcLWOFK.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\tGCuOyN.exe
  C:\Windows\System\tGCuOyN.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\byzNLZv.exe
  C:\Windows\System\byzNLZv.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\GKUjccm.exe
  C:\Windows\System\GKUjccm.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\GShVncl.exe
  C:\Windows\System\GShVncl.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\titwezO.exe
  C:\Windows\System\titwezO.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\qRRTZZu.exe
  C:\Windows\System\qRRTZZu.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\rmUJaec.exe
  C:\Windows\System\rmUJaec.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\EogbwBo.exe
  C:\Windows\System\EogbwBo.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\fodRuRH.exe
  C:\Windows\System\fodRuRH.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\MAVbdxQ.exe
  C:\Windows\System\MAVbdxQ.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\vghCMha.exe
  C:\Windows\System\vghCMha.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\aijPrMC.exe
  C:\Windows\System\aijPrMC.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\uOiEBra.exe
  C:\Windows\System\uOiEBra.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\nHhXlGx.exe
  C:\Windows\System\nHhXlGx.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\ATCPtkz.exe
  C:\Windows\System\ATCPtkz.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\eINBkcs.exe
  C:\Windows\System\eINBkcs.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\RUUndia.exe
  C:\Windows\System\RUUndia.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\gajbWtl.exe
  C:\Windows\System\gajbWtl.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\cWFudsI.exe
  C:\Windows\System\cWFudsI.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\fkAthOX.exe
  C:\Windows\System\fkAthOX.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\RwGxhec.exe
  C:\Windows\System\RwGxhec.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\yjkmlmJ.exe
  C:\Windows\System\yjkmlmJ.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\earkARo.exe
  C:\Windows\System\earkARo.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\RfRSTFz.exe
  C:\Windows\System\RfRSTFz.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\TzxGzPz.exe
  C:\Windows\System\TzxGzPz.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\XhUYgWB.exe
  C:\Windows\System\XhUYgWB.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\vTqipVi.exe
  C:\Windows\System\vTqipVi.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\REZhGKE.exe
  C:\Windows\System\REZhGKE.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\TbaDDal.exe
  C:\Windows\System\TbaDDal.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\IWgPdaU.exe
  C:\Windows\System\IWgPdaU.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\yUVBAFH.exe
  C:\Windows\System\yUVBAFH.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\ItCceSc.exe
  C:\Windows\System\ItCceSc.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\QDuzWUS.exe
  C:\Windows\System\QDuzWUS.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\oyCAtfE.exe
  C:\Windows\System\oyCAtfE.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\lnTwEBH.exe
  C:\Windows\System\lnTwEBH.exe
  2⤵
  - Executes dropped EXE
  PID:516
- C:\Windows\System\hNgTdPo.exe
  C:\Windows\System\hNgTdPo.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\podpngu.exe
  C:\Windows\System\podpngu.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\ukcONCx.exe
  C:\Windows\System\ukcONCx.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\wjneBFD.exe
  C:\Windows\System\wjneBFD.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\eVUDTUV.exe
  C:\Windows\System\eVUDTUV.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\bIBJzsK.exe
  C:\Windows\System\bIBJzsK.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\eOhbnit.exe
  C:\Windows\System\eOhbnit.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\UzxgyuT.exe
  C:\Windows\System\UzxgyuT.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\rZRYqmr.exe
  C:\Windows\System\rZRYqmr.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\ljrpcHj.exe
  C:\Windows\System\ljrpcHj.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\XTAHCMB.exe
  C:\Windows\System\XTAHCMB.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\KAvzdEn.exe
  C:\Windows\System\KAvzdEn.exe
  2⤵
  PID:2004
- C:\Windows\System\ZOyeEin.exe
  C:\Windows\System\ZOyeEin.exe
  2⤵
  PID:4964
- C:\Windows\System\nssPwgD.exe
  C:\Windows\System\nssPwgD.exe
  2⤵
  PID:4112
- C:\Windows\System\bOctivb.exe
  C:\Windows\System\bOctivb.exe
  2⤵
  PID:448
- C:\Windows\System\PlMSujS.exe
  C:\Windows\System\PlMSujS.exe
  2⤵
  PID:3568
- C:\Windows\System\goFrnUk.exe
  C:\Windows\System\goFrnUk.exe
  2⤵
  PID:4416
- C:\Windows\System\PPTHEQx.exe
  C:\Windows\System\PPTHEQx.exe
  2⤵
  PID:432
- C:\Windows\System\YRPmxST.exe
  C:\Windows\System\YRPmxST.exe
  2⤵
  PID:3608
- C:\Windows\System\AvEhaGg.exe
  C:\Windows\System\AvEhaGg.exe
  2⤵
  PID:3484
- C:\Windows\System\ZZJVWxU.exe
  C:\Windows\System\ZZJVWxU.exe
  2⤵
  PID:640
- C:\Windows\System\btYfVFk.exe
  C:\Windows\System\btYfVFk.exe
  2⤵
  PID:4324
- C:\Windows\System\tKUmeex.exe
  C:\Windows\System\tKUmeex.exe
  2⤵
  PID:2548
- C:\Windows\System\kywehfQ.exe
  C:\Windows\System\kywehfQ.exe
  2⤵
  PID:1640
- C:\Windows\System\AmqZVrk.exe
  C:\Windows\System\AmqZVrk.exe
  2⤵
  PID:1976
- C:\Windows\System\XurtccF.exe
  C:\Windows\System\XurtccF.exe
  2⤵
  PID:2636
- C:\Windows\System\NCSdYHv.exe
  C:\Windows\System\NCSdYHv.exe
  2⤵
  PID:4084
- C:\Windows\System\sOSLlni.exe
  C:\Windows\System\sOSLlni.exe
  2⤵
  PID:5124
- C:\Windows\System\rgRhtOu.exe
  C:\Windows\System\rgRhtOu.exe
  2⤵
  PID:5144
- C:\Windows\System\QuzfUor.exe
  C:\Windows\System\QuzfUor.exe
  2⤵
  PID:5164
- C:\Windows\System\boIYzUV.exe
  C:\Windows\System\boIYzUV.exe
  2⤵
  PID:5196
- C:\Windows\System\XVBpmQD.exe
  C:\Windows\System\XVBpmQD.exe
  2⤵
  PID:5212
- C:\Windows\System\KziScXs.exe
  C:\Windows\System\KziScXs.exe
  2⤵
  PID:5236
- C:\Windows\System\jreGkWC.exe
  C:\Windows\System\jreGkWC.exe
  2⤵
  PID:5264
- C:\Windows\System\JMOlOpl.exe
  C:\Windows\System\JMOlOpl.exe
  2⤵
  PID:5288
- C:\Windows\System\nWOtiXr.exe
  C:\Windows\System\nWOtiXr.exe
  2⤵
  PID:5308
- C:\Windows\System\YZtGPfu.exe
  C:\Windows\System\YZtGPfu.exe
  2⤵
  PID:5332
- C:\Windows\System\TwGahQc.exe
  C:\Windows\System\TwGahQc.exe
  2⤵
  PID:5360
- C:\Windows\System\eeDrooW.exe
  C:\Windows\System\eeDrooW.exe
  2⤵
  PID:5384
- C:\Windows\System\VIOYgib.exe
  C:\Windows\System\VIOYgib.exe
  2⤵
  PID:5404
- C:\Windows\System\HzyUKHG.exe
  C:\Windows\System\HzyUKHG.exe
  2⤵
  PID:5424
- C:\Windows\System\JIHsdmO.exe
  C:\Windows\System\JIHsdmO.exe
  2⤵
  PID:5448
- C:\Windows\System\MLYeeJB.exe
  C:\Windows\System\MLYeeJB.exe
  2⤵
  PID:5464
- C:\Windows\System\xFcHYEJ.exe
  C:\Windows\System\xFcHYEJ.exe
  2⤵
  PID:5484
- C:\Windows\System\BkJLWxY.exe
  C:\Windows\System\BkJLWxY.exe
  2⤵
  PID:5504
- C:\Windows\System\UVwVwSZ.exe
  C:\Windows\System\UVwVwSZ.exe
  2⤵
  PID:5528
- C:\Windows\System\RxJapWP.exe
  C:\Windows\System\RxJapWP.exe
  2⤵
  PID:5560
- C:\Windows\System\aDCdDfo.exe
  C:\Windows\System\aDCdDfo.exe
  2⤵
  PID:5588
- C:\Windows\System\aEXQDIQ.exe
  C:\Windows\System\aEXQDIQ.exe
  2⤵
  PID:5604
- C:\Windows\System\rFLHtFQ.exe
  C:\Windows\System\rFLHtFQ.exe
  2⤵
  PID:5632
- C:\Windows\System\ehbnzmQ.exe
  C:\Windows\System\ehbnzmQ.exe
  2⤵
  PID:5652
- C:\Windows\System\iVSPnMb.exe
  C:\Windows\System\iVSPnMb.exe
  2⤵
  PID:5672
- C:\Windows\System\ooRxHwT.exe
  C:\Windows\System\ooRxHwT.exe
  2⤵
  PID:5700
- C:\Windows\System\hHtLrqZ.exe
  C:\Windows\System\hHtLrqZ.exe
  2⤵
  PID:5720
- C:\Windows\System\GiLjiai.exe
  C:\Windows\System\GiLjiai.exe
  2⤵
  PID:5744
- C:\Windows\System\reFjiWH.exe
  C:\Windows\System\reFjiWH.exe
  2⤵
  PID:5760
- C:\Windows\System\lcQCLNc.exe
  C:\Windows\System\lcQCLNc.exe
  2⤵
  PID:5788
- C:\Windows\System\FfatxZS.exe
  C:\Windows\System\FfatxZS.exe
  2⤵
  PID:5808
- C:\Windows\System\dYYkNrM.exe
  C:\Windows\System\dYYkNrM.exe
  2⤵
  PID:5840
- C:\Windows\System\ZLFuXDV.exe
  C:\Windows\System\ZLFuXDV.exe
  2⤵
  PID:5856
- C:\Windows\System\LetPiFX.exe
  C:\Windows\System\LetPiFX.exe
  2⤵
  PID:5884
- C:\Windows\System\RLEgZcq.exe
  C:\Windows\System\RLEgZcq.exe
  2⤵
  PID:5904
- C:\Windows\System\YUsFVnA.exe
  C:\Windows\System\YUsFVnA.exe
  2⤵
  PID:5924
- C:\Windows\System\NUyrudg.exe
  C:\Windows\System\NUyrudg.exe
  2⤵
  PID:5940
- C:\Windows\System\iKVirmR.exe
  C:\Windows\System\iKVirmR.exe
  2⤵
  PID:5964
- C:\Windows\System\xzRMEZL.exe
  C:\Windows\System\xzRMEZL.exe
  2⤵
  PID:5980
- C:\Windows\System\iTHzZMu.exe
  C:\Windows\System\iTHzZMu.exe
  2⤵
  PID:6000
- C:\Windows\System\BoUqRxi.exe
  C:\Windows\System\BoUqRxi.exe
  2⤵
  PID:6024
- C:\Windows\System\ddUgumj.exe
  C:\Windows\System\ddUgumj.exe
  2⤵
  PID:6044
- C:\Windows\System\CaOvRSg.exe
  C:\Windows\System\CaOvRSg.exe
  2⤵
  PID:6068
- C:\Windows\System\TOinNcT.exe
  C:\Windows\System\TOinNcT.exe
  2⤵
  PID:6108
- C:\Windows\System\DbgextT.exe
  C:\Windows\System\DbgextT.exe
  2⤵
  PID:6124
- C:\Windows\System\CHqCfPb.exe
  C:\Windows\System\CHqCfPb.exe
  2⤵
  PID:1916
- C:\Windows\System\QEgnBKA.exe
  C:\Windows\System\QEgnBKA.exe
  2⤵
  PID:3176
- C:\Windows\System\WaPkbai.exe
  C:\Windows\System\WaPkbai.exe
  2⤵
  PID:1080
- C:\Windows\System\MStaJZH.exe
  C:\Windows\System\MStaJZH.exe
  2⤵
  PID:4364
- C:\Windows\System\FbvHFpa.exe
  C:\Windows\System\FbvHFpa.exe
  2⤵
  PID:3116
- C:\Windows\System\HCCoyGl.exe
  C:\Windows\System\HCCoyGl.exe
  2⤵
  PID:3676
- C:\Windows\System\YZbOuVm.exe
  C:\Windows\System\YZbOuVm.exe
  2⤵
  PID:4928
- C:\Windows\System\LJJTPeu.exe
  C:\Windows\System\LJJTPeu.exe
  2⤵
  PID:8
- C:\Windows\System\gUJNWwy.exe
  C:\Windows\System\gUJNWwy.exe
  2⤵
  PID:5284
- C:\Windows\System\HybRXuQ.exe
  C:\Windows\System\HybRXuQ.exe
  2⤵
  PID:4908
- C:\Windows\System\djPyBoE.exe
  C:\Windows\System\djPyBoE.exe
  2⤵
  PID:4976
- C:\Windows\System\RgthInB.exe
  C:\Windows\System\RgthInB.exe
  2⤵
  PID:5432
- C:\Windows\System\zxshpcY.exe
  C:\Windows\System\zxshpcY.exe
  2⤵
  PID:5472
- C:\Windows\System\YIHNJgH.exe
  C:\Windows\System\YIHNJgH.exe
  2⤵
  PID:2372
- C:\Windows\System\VulSrBR.exe
  C:\Windows\System\VulSrBR.exe
  2⤵
  PID:4656
- C:\Windows\System\AWJDMOQ.exe
  C:\Windows\System\AWJDMOQ.exe
  2⤵
  PID:5696
- C:\Windows\System\nEPHxkD.exe
  C:\Windows\System\nEPHxkD.exe
  2⤵
  PID:5280
- C:\Windows\System\xubKazg.exe
  C:\Windows\System\xubKazg.exe
  2⤵
  PID:5880
- C:\Windows\System\NUGHcQz.exe
  C:\Windows\System\NUGHcQz.exe
  2⤵
  PID:5496
- C:\Windows\System\bdaiVqS.exe
  C:\Windows\System\bdaiVqS.exe
  2⤵
  PID:5972
- C:\Windows\System\jOnWPXj.exe
  C:\Windows\System\jOnWPXj.exe
  2⤵
  PID:6148
- C:\Windows\System\SMOmRKV.exe
  C:\Windows\System\SMOmRKV.exe
  2⤵
  PID:6176
- C:\Windows\System\HyeDwVL.exe
  C:\Windows\System\HyeDwVL.exe
  2⤵
  PID:6196
- C:\Windows\System\flcGIfd.exe
  C:\Windows\System\flcGIfd.exe
  2⤵
  PID:6212
- C:\Windows\System\nHXIHEG.exe
  C:\Windows\System\nHXIHEG.exe
  2⤵
  PID:6248
- C:\Windows\System\RvZhHqH.exe
  C:\Windows\System\RvZhHqH.exe
  2⤵
  PID:6264
- C:\Windows\System\yjOpEdJ.exe
  C:\Windows\System\yjOpEdJ.exe
  2⤵
  PID:6292
- C:\Windows\System\rJBVJDe.exe
  C:\Windows\System\rJBVJDe.exe
  2⤵
  PID:6312
- C:\Windows\System\HINIlsV.exe
  C:\Windows\System\HINIlsV.exe
  2⤵
  PID:6336
- C:\Windows\System\gmBVMyC.exe
  C:\Windows\System\gmBVMyC.exe
  2⤵
  PID:6352
- C:\Windows\System\NXuoCpA.exe
  C:\Windows\System\NXuoCpA.exe
  2⤵
  PID:6384
- C:\Windows\System\lViqRLl.exe
  C:\Windows\System\lViqRLl.exe
  2⤵
  PID:6400
- C:\Windows\System\nHVHCSS.exe
  C:\Windows\System\nHVHCSS.exe
  2⤵
  PID:6428
- C:\Windows\System\YQptHfE.exe
  C:\Windows\System\YQptHfE.exe
  2⤵
  PID:6452
- C:\Windows\System\iNDxLrO.exe
  C:\Windows\System\iNDxLrO.exe
  2⤵
  PID:6480
- C:\Windows\System\zTXEFTb.exe
  C:\Windows\System\zTXEFTb.exe
  2⤵
  PID:6496
- C:\Windows\System\jicLlqK.exe
  C:\Windows\System\jicLlqK.exe
  2⤵
  PID:6520
- C:\Windows\System\tYXWsya.exe
  C:\Windows\System\tYXWsya.exe
  2⤵
  PID:6536
- C:\Windows\System\awZqeMg.exe
  C:\Windows\System\awZqeMg.exe
  2⤵
  PID:6560
- C:\Windows\System\maCMkFd.exe
  C:\Windows\System\maCMkFd.exe
  2⤵
  PID:6584
- C:\Windows\System\pYcUMws.exe
  C:\Windows\System\pYcUMws.exe
  2⤵
  PID:6608
- C:\Windows\System\VmCxmyD.exe
  C:\Windows\System\VmCxmyD.exe
  2⤵
  PID:6624
- C:\Windows\System\YotCNpI.exe
  C:\Windows\System\YotCNpI.exe
  2⤵
  PID:6660
- C:\Windows\System\aUdHkLg.exe
  C:\Windows\System\aUdHkLg.exe
  2⤵
  PID:6680
- C:\Windows\System\pvQaOaH.exe
  C:\Windows\System\pvQaOaH.exe
  2⤵
  PID:6704
- C:\Windows\System\dpLOmxg.exe
  C:\Windows\System\dpLOmxg.exe
  2⤵
  PID:6728
- C:\Windows\System\cgaDOXe.exe
  C:\Windows\System\cgaDOXe.exe
  2⤵
  PID:6748
- C:\Windows\System\pmXDzqi.exe
  C:\Windows\System\pmXDzqi.exe
  2⤵
  PID:6772
- C:\Windows\System\qgsXeBi.exe
  C:\Windows\System\qgsXeBi.exe
  2⤵
  PID:6792
- C:\Windows\System\HPbYYpL.exe
  C:\Windows\System\HPbYYpL.exe
  2⤵
  PID:6812
- C:\Windows\System\UJvEhUt.exe
  C:\Windows\System\UJvEhUt.exe
  2⤵
  PID:6840
- C:\Windows\System\vSFrcfn.exe
  C:\Windows\System\vSFrcfn.exe
  2⤵
  PID:6856
- C:\Windows\System\wJsbbAL.exe
  C:\Windows\System\wJsbbAL.exe
  2⤵
  PID:6880
- C:\Windows\System\LuZnxgP.exe
  C:\Windows\System\LuZnxgP.exe
  2⤵
  PID:6896
- C:\Windows\System\AhHToNm.exe
  C:\Windows\System\AhHToNm.exe
  2⤵
  PID:6920
- C:\Windows\System\IzNdoEL.exe
  C:\Windows\System\IzNdoEL.exe
  2⤵
  PID:6948
- C:\Windows\System\yvHSHQl.exe
  C:\Windows\System\yvHSHQl.exe
  2⤵
  PID:6968
- C:\Windows\System\ZBWvaYO.exe
  C:\Windows\System\ZBWvaYO.exe
  2⤵
  PID:6988
- C:\Windows\System\ccYXFKJ.exe
  C:\Windows\System\ccYXFKJ.exe
  2⤵
  PID:7008
- C:\Windows\System\LdGzyXQ.exe
  C:\Windows\System\LdGzyXQ.exe
  2⤵
  PID:7028
- C:\Windows\System\GaIXRLf.exe
  C:\Windows\System\GaIXRLf.exe
  2⤵
  PID:7056
- C:\Windows\System\mTRgoQW.exe
  C:\Windows\System\mTRgoQW.exe
  2⤵
  PID:7072
- C:\Windows\System\cFbsSow.exe
  C:\Windows\System\cFbsSow.exe
  2⤵
  PID:7092
- C:\Windows\System\IOGDQEf.exe
  C:\Windows\System\IOGDQEf.exe
  2⤵
  PID:7164
- C:\Windows\System\IhgJLGi.exe
  C:\Windows\System\IhgJLGi.exe
  2⤵
  PID:4424
- C:\Windows\System\EteCMkA.exe
  C:\Windows\System\EteCMkA.exe
  2⤵
  PID:2028
- C:\Windows\System\EjxcQYo.exe
  C:\Windows\System\EjxcQYo.exe
  2⤵
  PID:5160
- C:\Windows\System\hkxFgse.exe
  C:\Windows\System\hkxFgse.exe
  2⤵
  PID:5256
- C:\Windows\System\nBUmSzL.exe
  C:\Windows\System\nBUmSzL.exe
  2⤵
  PID:5304
- C:\Windows\System\tWrjDks.exe
  C:\Windows\System\tWrjDks.exe
  2⤵
  PID:5340
- C:\Windows\System\FHXwwUx.exe
  C:\Windows\System\FHXwwUx.exe
  2⤵
  PID:5480
- C:\Windows\System\iKgDtYI.exe
  C:\Windows\System\iKgDtYI.exe
  2⤵
  PID:6184
- C:\Windows\System\LEbLYIo.exe
  C:\Windows\System\LEbLYIo.exe
  2⤵
  PID:5612
- C:\Windows\System\HxRjwxv.exe
  C:\Windows\System\HxRjwxv.exe
  2⤵
  PID:5648
- C:\Windows\System\QrnQxqj.exe
  C:\Windows\System\QrnQxqj.exe
  2⤵
  PID:5768
- C:\Windows\System\TdrdoxG.exe
  C:\Windows\System\TdrdoxG.exe
  2⤵
  PID:6380
- C:\Windows\System\bfXgxyR.exe
  C:\Windows\System\bfXgxyR.exe
  2⤵
  PID:5848
- C:\Windows\System\jtVpADm.exe
  C:\Windows\System\jtVpADm.exe
  2⤵
  PID:6516
- C:\Windows\System\CxaKKpd.exe
  C:\Windows\System\CxaKKpd.exe
  2⤵
  PID:6616
- C:\Windows\System\vvAWOYZ.exe
  C:\Windows\System\vvAWOYZ.exe
  2⤵
  PID:7180
- C:\Windows\System\lBSsLsV.exe
  C:\Windows\System\lBSsLsV.exe
  2⤵
  PID:7204
- C:\Windows\System\DKxzjoG.exe
  C:\Windows\System\DKxzjoG.exe
  2⤵
  PID:7220
- C:\Windows\System\zjkEoRU.exe
  C:\Windows\System\zjkEoRU.exe
  2⤵
  PID:7248
- C:\Windows\System\KAbFLGw.exe
  C:\Windows\System\KAbFLGw.exe
  2⤵
  PID:7264
- C:\Windows\System\xqbeGzm.exe
  C:\Windows\System\xqbeGzm.exe
  2⤵
  PID:7288
- C:\Windows\System\CjltDUJ.exe
  C:\Windows\System\CjltDUJ.exe
  2⤵
  PID:7316
- C:\Windows\System\PzdnAfL.exe
  C:\Windows\System\PzdnAfL.exe
  2⤵
  PID:7336
- C:\Windows\System\cTOVjPL.exe
  C:\Windows\System\cTOVjPL.exe
  2⤵
  PID:7360
- C:\Windows\System\zAJGgWH.exe
  C:\Windows\System\zAJGgWH.exe
  2⤵
  PID:7380
- C:\Windows\System\jQEVNcS.exe
  C:\Windows\System\jQEVNcS.exe
  2⤵
  PID:7396
- C:\Windows\System\UNGpuge.exe
  C:\Windows\System\UNGpuge.exe
  2⤵
  PID:7420
- C:\Windows\System\PzibNUf.exe
  C:\Windows\System\PzibNUf.exe
  2⤵
  PID:7440
- C:\Windows\System\PQEQYVt.exe
  C:\Windows\System\PQEQYVt.exe
  2⤵
  PID:7464
- C:\Windows\System\AlsXbQN.exe
  C:\Windows\System\AlsXbQN.exe
  2⤵
  PID:7488
- C:\Windows\System\QkCxmkM.exe
  C:\Windows\System\QkCxmkM.exe
  2⤵
  PID:7508
- C:\Windows\System\sEeaZAx.exe
  C:\Windows\System\sEeaZAx.exe
  2⤵
  PID:7528
- C:\Windows\System\wuiaFwZ.exe
  C:\Windows\System\wuiaFwZ.exe
  2⤵
  PID:7552
- C:\Windows\System\DlkTbxO.exe
  C:\Windows\System\DlkTbxO.exe
  2⤵
  PID:7576
- C:\Windows\System\HwAlEYV.exe
  C:\Windows\System\HwAlEYV.exe
  2⤵
  PID:7604
- C:\Windows\System\wcvCFDX.exe
  C:\Windows\System\wcvCFDX.exe
  2⤵
  PID:7624
- C:\Windows\System\OZayMKN.exe
  C:\Windows\System\OZayMKN.exe
  2⤵
  PID:7644
- C:\Windows\System\khucAGk.exe
  C:\Windows\System\khucAGk.exe
  2⤵
  PID:7700
- C:\Windows\System\HCxuRgI.exe
  C:\Windows\System\HCxuRgI.exe
  2⤵
  PID:7716
- C:\Windows\System\selRBLT.exe
  C:\Windows\System\selRBLT.exe
  2⤵
  PID:7748
- C:\Windows\System\dfWcuNy.exe
  C:\Windows\System\dfWcuNy.exe
  2⤵
  PID:7768
- C:\Windows\System\vWKYPYF.exe
  C:\Windows\System\vWKYPYF.exe
  2⤵
  PID:7792
- C:\Windows\System\twCUvte.exe
  C:\Windows\System\twCUvte.exe
  2⤵
  PID:7812
- C:\Windows\System\eXujzZU.exe
  C:\Windows\System\eXujzZU.exe
  2⤵
  PID:7840
- C:\Windows\System\IAViaoF.exe
  C:\Windows\System\IAViaoF.exe
  2⤵
  PID:6016
- C:\Windows\System\HxVzuAV.exe
  C:\Windows\System\HxVzuAV.exe
  2⤵
  PID:5368
- C:\Windows\System\vJafoSh.exe
  C:\Windows\System\vJafoSh.exe
  2⤵
  PID:5600
- C:\Windows\System\FVYJrHN.exe
  C:\Windows\System\FVYJrHN.exe
  2⤵
  PID:7296
- C:\Windows\System\OAhxfrI.exe
  C:\Windows\System\OAhxfrI.exe
  2⤵
  PID:7632
- C:\Windows\System\Rqxwayu.exe
  C:\Windows\System\Rqxwayu.exe
  2⤵
  PID:7820
- C:\Windows\System\taCuekj.exe
  C:\Windows\System\taCuekj.exe
  2⤵
  PID:836
- C:\Windows\System\esTBnID.exe
  C:\Windows\System\esTBnID.exe
  2⤵
  PID:5644
- C:\Windows\System\XJKjFWM.exe
  C:\Windows\System\XJKjFWM.exe
  2⤵
  PID:5780
- C:\Windows\System\AGmAwLm.exe
  C:\Windows\System\AGmAwLm.exe
  2⤵
  PID:7192
- C:\Windows\System\EHihUkY.exe
  C:\Windows\System\EHihUkY.exe
  2⤵
  PID:5876
- C:\Windows\System\cMDWnHi.exe
  C:\Windows\System\cMDWnHi.exe
  2⤵
  PID:7212
- C:\Windows\System\eDijNff.exe
  C:\Windows\System\eDijNff.exe
  2⤵
  PID:7368
- C:\Windows\System\hLgnHxx.exe
  C:\Windows\System\hLgnHxx.exe
  2⤵
  PID:7300
- C:\Windows\System\zOpyNDw.exe
  C:\Windows\System\zOpyNDw.exe
  2⤵
  PID:7416
- C:\Windows\System\xdtliLV.exe
  C:\Windows\System\xdtliLV.exe
  2⤵
  PID:7544
- C:\Windows\System\KpGwgIU.exe
  C:\Windows\System\KpGwgIU.exe
  2⤵
  PID:7500
- C:\Windows\System\hBjjfWO.exe
  C:\Windows\System\hBjjfWO.exe
  2⤵
  PID:7436
- C:\Windows\System\Vkyatho.exe
  C:\Windows\System\Vkyatho.exe
  2⤵
  PID:7568
- C:\Windows\System\oFHOuGB.exe
  C:\Windows\System\oFHOuGB.exe
  2⤵
  PID:7744
- C:\Windows\System\XOYQomh.exe
  C:\Windows\System\XOYQomh.exe
  2⤵
  PID:7652
- C:\Windows\System\nxyORbr.exe
  C:\Windows\System\nxyORbr.exe
  2⤵
  PID:7808
- C:\Windows\System\sNGmRdT.exe
  C:\Windows\System\sNGmRdT.exe
  2⤵
  PID:4372
- C:\Windows\System\XtGJkhw.exe
  C:\Windows\System\XtGJkhw.exe
  2⤵
  PID:5116
- C:\Windows\System\MhkFXRA.exe
  C:\Windows\System\MhkFXRA.exe
  2⤵
  PID:8200
- C:\Windows\System\tgjlBdN.exe
  C:\Windows\System\tgjlBdN.exe
  2⤵
  PID:8216
- C:\Windows\System\Chcqdsa.exe
  C:\Windows\System\Chcqdsa.exe
  2⤵
  PID:8232
- C:\Windows\System\TGXduGH.exe
  C:\Windows\System\TGXduGH.exe
  2⤵
  PID:8252
- C:\Windows\System\ezdlIXc.exe
  C:\Windows\System\ezdlIXc.exe
  2⤵
  PID:8268
- C:\Windows\System\jvvmHaA.exe
  C:\Windows\System\jvvmHaA.exe
  2⤵
  PID:8288
- C:\Windows\System\usWJxrT.exe
  C:\Windows\System\usWJxrT.exe
  2⤵
  PID:8308
- C:\Windows\System\FdymGKC.exe
  C:\Windows\System\FdymGKC.exe
  2⤵
  PID:8328
- C:\Windows\System\NKkZVsX.exe
  C:\Windows\System\NKkZVsX.exe
  2⤵
  PID:8348
- C:\Windows\System\VgzwkVb.exe
  C:\Windows\System\VgzwkVb.exe
  2⤵
  PID:8364
- C:\Windows\System\PYpjHCA.exe
  C:\Windows\System\PYpjHCA.exe
  2⤵
  PID:8384
- C:\Windows\System\QDjAJCP.exe
  C:\Windows\System\QDjAJCP.exe
  2⤵
  PID:8404
- C:\Windows\System\QjBnTUu.exe
  C:\Windows\System\QjBnTUu.exe
  2⤵
  PID:8424
- C:\Windows\System\eJoBljH.exe
  C:\Windows\System\eJoBljH.exe
  2⤵
  PID:8444
- C:\Windows\System\TjmUlir.exe
  C:\Windows\System\TjmUlir.exe
  2⤵
  PID:8464
- C:\Windows\System\QetlHAq.exe
  C:\Windows\System\QetlHAq.exe
  2⤵
  PID:8480
- C:\Windows\System\NXztSvB.exe
  C:\Windows\System\NXztSvB.exe
  2⤵
  PID:8500
- C:\Windows\System\TIXiZxG.exe
  C:\Windows\System\TIXiZxG.exe
  2⤵
  PID:8520
- C:\Windows\System\HkKkKfC.exe
  C:\Windows\System\HkKkKfC.exe
  2⤵
  PID:8544
- C:\Windows\System\gvYHBZX.exe
  C:\Windows\System\gvYHBZX.exe
  2⤵
  PID:8572
- C:\Windows\System\sMtRvCQ.exe
  C:\Windows\System\sMtRvCQ.exe
  2⤵
  PID:8588
- C:\Windows\System\hMBhMrs.exe
  C:\Windows\System\hMBhMrs.exe
  2⤵
  PID:8608
- C:\Windows\System\lMAmdzg.exe
  C:\Windows\System\lMAmdzg.exe
  2⤵
  PID:8632
- C:\Windows\System\fWPJwqg.exe
  C:\Windows\System\fWPJwqg.exe
  2⤵
  PID:8648
- C:\Windows\System\GFmHDGv.exe
  C:\Windows\System\GFmHDGv.exe
  2⤵
  PID:8668
- C:\Windows\System\CCKAiBR.exe
  C:\Windows\System\CCKAiBR.exe
  2⤵
  PID:8708
- C:\Windows\System\OFzDzME.exe
  C:\Windows\System\OFzDzME.exe
  2⤵
  PID:8724
- C:\Windows\System\hJIkqwZ.exe
  C:\Windows\System\hJIkqwZ.exe
  2⤵
  PID:8748
- C:\Windows\System\lZwdFvj.exe
  C:\Windows\System\lZwdFvj.exe
  2⤵
  PID:8764
- C:\Windows\System\rNEBBZv.exe
  C:\Windows\System\rNEBBZv.exe
  2⤵
  PID:8784
- C:\Windows\System\OVRlCGt.exe
  C:\Windows\System\OVRlCGt.exe
  2⤵
  PID:8804
- C:\Windows\System\OxNsbIv.exe
  C:\Windows\System\OxNsbIv.exe
  2⤵
  PID:8820
- C:\Windows\System\YeMLIqV.exe
  C:\Windows\System\YeMLIqV.exe
  2⤵
  PID:8836
- C:\Windows\System\VvkObRf.exe
  C:\Windows\System\VvkObRf.exe
  2⤵
  PID:8856
- C:\Windows\System\AcjSDVr.exe
  C:\Windows\System\AcjSDVr.exe
  2⤵
  PID:8876
- C:\Windows\System\YYPVzVP.exe
  C:\Windows\System\YYPVzVP.exe
  2⤵
  PID:8892
- C:\Windows\System\cqIJLsh.exe
  C:\Windows\System\cqIJLsh.exe
  2⤵
  PID:8912
- C:\Windows\System\dKDHtIS.exe
  C:\Windows\System\dKDHtIS.exe
  2⤵
  PID:8928
- C:\Windows\System\HXGMREI.exe
  C:\Windows\System\HXGMREI.exe
  2⤵
  PID:8948
- C:\Windows\System\OdMAUwP.exe
  C:\Windows\System\OdMAUwP.exe
  2⤵
  PID:8968
- C:\Windows\System\xGCFitE.exe
  C:\Windows\System\xGCFitE.exe
  2⤵
  PID:8984
- C:\Windows\System\kqKLara.exe
  C:\Windows\System\kqKLara.exe
  2⤵
  PID:9008
- C:\Windows\System\WFYgwWE.exe
  C:\Windows\System\WFYgwWE.exe
  2⤵
  PID:9032
- C:\Windows\System\XtlPwLq.exe
  C:\Windows\System\XtlPwLq.exe
  2⤵
  PID:9052
- C:\Windows\System\jzjECTI.exe
  C:\Windows\System\jzjECTI.exe
  2⤵
  PID:9072
- C:\Windows\System\Mtxceth.exe
  C:\Windows\System\Mtxceth.exe
  2⤵
  PID:9140
- C:\Windows\System\NWzzKhq.exe
  C:\Windows\System\NWzzKhq.exe
  2⤵
  PID:9164
- C:\Windows\System\VSZXoXj.exe
  C:\Windows\System\VSZXoXj.exe
  2⤵
  PID:9184
- C:\Windows\System\wbgdWHG.exe
  C:\Windows\System\wbgdWHG.exe
  2⤵
  PID:9204
- C:\Windows\System\LMZAYOd.exe
  C:\Windows\System\LMZAYOd.exe
  2⤵
  PID:5208
- C:\Windows\System\QQnUbNV.exe
  C:\Windows\System\QQnUbNV.exe
  2⤵
  PID:7548
- C:\Windows\System\XrsdGqL.exe
  C:\Windows\System\XrsdGqL.exe
  2⤵
  PID:7620
- C:\Windows\System\LbeUyLh.exe
  C:\Windows\System\LbeUyLh.exe
  2⤵
  PID:6136
- C:\Windows\System\CtXfOHb.exe
  C:\Windows\System\CtXfOHb.exe
  2⤵
  PID:5108
- C:\Windows\System\JyqzhAx.exe
  C:\Windows\System\JyqzhAx.exe
  2⤵
  PID:8248
- C:\Windows\System\LBtTHdx.exe
  C:\Windows\System\LBtTHdx.exe
  2⤵
  PID:8284
- C:\Windows\System\jBwwfYS.exe
  C:\Windows\System\jBwwfYS.exe
  2⤵
  PID:8372
- C:\Windows\System\uNlJyXr.exe
  C:\Windows\System\uNlJyXr.exe
  2⤵
  PID:8476
- C:\Windows\System\RTmQeAj.exe
  C:\Windows\System\RTmQeAj.exe
  2⤵
  PID:8564
- C:\Windows\System\yHPIdQw.exe
  C:\Windows\System\yHPIdQw.exe
  2⤵
  PID:2252
- C:\Windows\System\ivgIcsW.exe
  C:\Windows\System\ivgIcsW.exe
  2⤵
  PID:8660
- C:\Windows\System\zxHzIIi.exe
  C:\Windows\System\zxHzIIi.exe
  2⤵
  PID:6096
- C:\Windows\System\aBCmruL.exe
  C:\Windows\System\aBCmruL.exe
  2⤵
  PID:7504
- C:\Windows\System\lWkevAl.exe
  C:\Windows\System\lWkevAl.exe
  2⤵
  PID:5152
- C:\Windows\System\OXDtpzP.exe
  C:\Windows\System\OXDtpzP.exe
  2⤵
  PID:8228
- C:\Windows\System\IrLeTWL.exe
  C:\Windows\System\IrLeTWL.exe
  2⤵
  PID:8420
- C:\Windows\System\bzuKPbH.exe
  C:\Windows\System\bzuKPbH.exe
  2⤵
  PID:8440
- C:\Windows\System\rDlGUcT.exe
  C:\Windows\System\rDlGUcT.exe
  2⤵
  PID:8536
- C:\Windows\System\qlkNJbY.exe
  C:\Windows\System\qlkNJbY.exe
  2⤵
  PID:9000
- C:\Windows\System\jovWExl.exe
  C:\Windows\System\jovWExl.exe
  2⤵
  PID:9028
- C:\Windows\System\lIQZVAJ.exe
  C:\Windows\System\lIQZVAJ.exe
  2⤵
  PID:9220
- C:\Windows\System\QJXzWXF.exe
  C:\Windows\System\QJXzWXF.exe
  2⤵
  PID:9244
- C:\Windows\System\BzhFhdb.exe
  C:\Windows\System\BzhFhdb.exe
  2⤵
  PID:9268
- C:\Windows\System\AwjRBoV.exe
  C:\Windows\System\AwjRBoV.exe
  2⤵
  PID:9284
- C:\Windows\System\oKtITJK.exe
  C:\Windows\System\oKtITJK.exe
  2⤵
  PID:9308
- C:\Windows\System\AbZRQQq.exe
  C:\Windows\System\AbZRQQq.exe
  2⤵
  PID:9332
- C:\Windows\System\vEWGpLa.exe
  C:\Windows\System\vEWGpLa.exe
  2⤵
  PID:9356
- C:\Windows\System\gMQsmHH.exe
  C:\Windows\System\gMQsmHH.exe
  2⤵
  PID:9384
- C:\Windows\System\iBXCxqC.exe
  C:\Windows\System\iBXCxqC.exe
  2⤵
  PID:9404
- C:\Windows\System\fMQqxsc.exe
  C:\Windows\System\fMQqxsc.exe
  2⤵
  PID:9432
- C:\Windows\System\DCFvVzy.exe
  C:\Windows\System\DCFvVzy.exe
  2⤵
  PID:9452
- C:\Windows\System\bCshHeA.exe
  C:\Windows\System\bCshHeA.exe
  2⤵
  PID:9468
- C:\Windows\System\nRnBGxR.exe
  C:\Windows\System\nRnBGxR.exe
  2⤵
  PID:9492
- C:\Windows\System\iQEsgQx.exe
  C:\Windows\System\iQEsgQx.exe
  2⤵
  PID:9508
- C:\Windows\System\IjWoJXH.exe
  C:\Windows\System\IjWoJXH.exe
  2⤵
  PID:9532
- C:\Windows\System\LnXiaEx.exe
  C:\Windows\System\LnXiaEx.exe
  2⤵
  PID:9576
- C:\Windows\System\IEmnvWY.exe
  C:\Windows\System\IEmnvWY.exe
  2⤵
  PID:9592
- C:\Windows\System\joibdWQ.exe
  C:\Windows\System\joibdWQ.exe
  2⤵
  PID:9608
- C:\Windows\System\uZAsCea.exe
  C:\Windows\System\uZAsCea.exe
  2⤵
  PID:9632
- C:\Windows\System\GErzNyq.exe
  C:\Windows\System\GErzNyq.exe
  2⤵
  PID:9648
- C:\Windows\System\qRmKLJW.exe
  C:\Windows\System\qRmKLJW.exe
  2⤵
  PID:9672
- C:\Windows\System\DzKxHXC.exe
  C:\Windows\System\DzKxHXC.exe
  2⤵
  PID:9696
- C:\Windows\System\WsPRUAQ.exe
  C:\Windows\System\WsPRUAQ.exe
  2⤵
  PID:9720
- C:\Windows\System\ilpwtCb.exe
  C:\Windows\System\ilpwtCb.exe
  2⤵
  PID:9740
- C:\Windows\System\THpvDmC.exe
  C:\Windows\System\THpvDmC.exe
  2⤵
  PID:9768
- C:\Windows\System\EuHbizC.exe
  C:\Windows\System\EuHbizC.exe
  2⤵
  PID:9784
- C:\Windows\System\YMYHnNq.exe
  C:\Windows\System\YMYHnNq.exe
  2⤵
  PID:9804
- C:\Windows\System\VnkCvoP.exe
  C:\Windows\System\VnkCvoP.exe
  2⤵
  PID:9820
- C:\Windows\System\qqmAisG.exe
  C:\Windows\System\qqmAisG.exe
  2⤵
  PID:9840
- C:\Windows\System\KoVLpOj.exe
  C:\Windows\System\KoVLpOj.exe
  2⤵
  PID:9864
- C:\Windows\System\YNIPmNq.exe
  C:\Windows\System\YNIPmNq.exe
  2⤵
  PID:9884
- C:\Windows\System\sJZvNde.exe
  C:\Windows\System\sJZvNde.exe
  2⤵
  PID:9916
- C:\Windows\System\MvWrEWg.exe
  C:\Windows\System\MvWrEWg.exe
  2⤵
  PID:9940
- C:\Windows\System\CbTingC.exe
  C:\Windows\System\CbTingC.exe
  2⤵
  PID:9960
- C:\Windows\System\UqriKfg.exe
  C:\Windows\System\UqriKfg.exe
  2⤵
  PID:9988
- C:\Windows\System\iVeSTUt.exe
  C:\Windows\System\iVeSTUt.exe
  2⤵
  PID:10012
- C:\Windows\System\xuWmvkd.exe
  C:\Windows\System\xuWmvkd.exe
  2⤵
  PID:10032
- C:\Windows\System\rPEKJyo.exe
  C:\Windows\System\rPEKJyo.exe
  2⤵
  PID:10056
- C:\Windows\System\gNWowgY.exe
  C:\Windows\System\gNWowgY.exe
  2⤵
  PID:10076
- C:\Windows\System\CUpVXur.exe
  C:\Windows\System\CUpVXur.exe
  2⤵
  PID:10104
- C:\Windows\System\WrcDboK.exe
  C:\Windows\System\WrcDboK.exe
  2⤵
  PID:10132
- C:\Windows\System\kjhefkJ.exe
  C:\Windows\System\kjhefkJ.exe
  2⤵
  PID:10156
- C:\Windows\System\fXoeLNm.exe
  C:\Windows\System\fXoeLNm.exe
  2⤵
  PID:10180
- C:\Windows\System\gHzDQNR.exe
  C:\Windows\System\gHzDQNR.exe
  2⤵
  PID:10204
- C:\Windows\System\xkBvQXV.exe
  C:\Windows\System\xkBvQXV.exe
  2⤵
  PID:10232
- C:\Windows\System\snYLswZ.exe
  C:\Windows\System\snYLswZ.exe
  2⤵
  PID:6904
- C:\Windows\System\QGjtERW.exe
  C:\Windows\System\QGjtERW.exe
  2⤵
  PID:7064
- C:\Windows\System\iyYVOPg.exe
  C:\Windows\System\iyYVOPg.exe
  2⤵
  PID:6132
- C:\Windows\System\VzleFoL.exe
  C:\Windows\System\VzleFoL.exe
  2⤵
  PID:7404
- C:\Windows\System\SNuajcY.exe
  C:\Windows\System\SNuajcY.exe
  2⤵
  PID:3664
- C:\Windows\System\HohbGgR.exe
  C:\Windows\System\HohbGgR.exe
  2⤵
  PID:2540
- C:\Windows\System\VWaBpwY.exe
  C:\Windows\System\VWaBpwY.exe
  2⤵
  PID:5800
- C:\Windows\System\TpLLJgV.exe
  C:\Windows\System\TpLLJgV.exe
  2⤵
  PID:5836
- C:\Windows\System\RKakIlw.exe
  C:\Windows\System\RKakIlw.exe
  2⤵
  PID:7280
- C:\Windows\System\hUWtmUD.exe
  C:\Windows\System\hUWtmUD.exe
  2⤵
  PID:7828
- C:\Windows\System\WhEQxCo.exe
  C:\Windows\System\WhEQxCo.exe
  2⤵
  PID:4644
- C:\Windows\System\aGtGcrI.exe
  C:\Windows\System\aGtGcrI.exe
  2⤵
  PID:7952
- C:\Windows\System\HqTPogK.exe
  C:\Windows\System\HqTPogK.exe
  2⤵
  PID:8320
- C:\Windows\System\XydZCQy.exe
  C:\Windows\System\XydZCQy.exe
  2⤵
  PID:8888
- C:\Windows\System\VMZShDN.exe
  C:\Windows\System\VMZShDN.exe
  2⤵
  PID:8472
- C:\Windows\System\ctVxYGT.exe
  C:\Windows\System\ctVxYGT.exe
  2⤵
  PID:8552
- C:\Windows\System\gpGKadA.exe
  C:\Windows\System\gpGKadA.exe
  2⤵
  PID:2304
- C:\Windows\System\aIJgFkW.exe
  C:\Windows\System\aIJgFkW.exe
  2⤵
  PID:8884
- C:\Windows\System\fpvyYFx.exe
  C:\Windows\System\fpvyYFx.exe
  2⤵
  PID:8996
- C:\Windows\System\jcdTlYz.exe
  C:\Windows\System\jcdTlYz.exe
  2⤵
  PID:9328
- C:\Windows\System\qBoFsHz.exe
  C:\Windows\System\qBoFsHz.exe
  2⤵
  PID:9400
- C:\Windows\System\vyYPxef.exe
  C:\Windows\System\vyYPxef.exe
  2⤵
  PID:9544
- C:\Windows\System\aFydppR.exe
  C:\Windows\System\aFydppR.exe
  2⤵
  PID:8740
- C:\Windows\System\lAmaAGT.exe
  C:\Windows\System\lAmaAGT.exe
  2⤵
  PID:8780
- C:\Windows\System\leSIflS.exe
  C:\Windows\System\leSIflS.exe
  2⤵
  PID:8848
- C:\Windows\System\isEKOHK.exe
  C:\Windows\System\isEKOHK.exe
  2⤵
  PID:9752
- C:\Windows\System\vOlvRon.exe
  C:\Windows\System\vOlvRon.exe
  2⤵
  PID:9200
- C:\Windows\System\mxYzWtP.exe
  C:\Windows\System\mxYzWtP.exe
  2⤵
  PID:9832
- C:\Windows\System\idIISeg.exe
  C:\Windows\System\idIISeg.exe
  2⤵
  PID:10256
- C:\Windows\System\YqzzECQ.exe
  C:\Windows\System\YqzzECQ.exe
  2⤵
  PID:10276
- C:\Windows\System\yasLlmP.exe
  C:\Windows\System\yasLlmP.exe
  2⤵
  PID:10292
- C:\Windows\System\sJmrQIb.exe
  C:\Windows\System\sJmrQIb.exe
  2⤵
  PID:10312
- C:\Windows\System\ZnUXLSf.exe
  C:\Windows\System\ZnUXLSf.exe
  2⤵
  PID:10336
- C:\Windows\System\RDvEwuS.exe
  C:\Windows\System\RDvEwuS.exe
  2⤵
  PID:10352
- C:\Windows\System\WGWrCDW.exe
  C:\Windows\System\WGWrCDW.exe
  2⤵
  PID:10376
- C:\Windows\System\pmTihkY.exe
  C:\Windows\System\pmTihkY.exe
  2⤵
  PID:10404
- C:\Windows\System\bZdSzEL.exe
  C:\Windows\System\bZdSzEL.exe
  2⤵
  PID:10420
- C:\Windows\System\NWQttSR.exe
  C:\Windows\System\NWQttSR.exe
  2⤵
  PID:10444
- C:\Windows\System\MBAYUTx.exe
  C:\Windows\System\MBAYUTx.exe
  2⤵
  PID:10468
- C:\Windows\System\tpVhdwM.exe
  C:\Windows\System\tpVhdwM.exe
  2⤵
  PID:10496
- C:\Windows\System\sXbtAHx.exe
  C:\Windows\System\sXbtAHx.exe
  2⤵
  PID:10524
- C:\Windows\System\vfgeRPI.exe
  C:\Windows\System\vfgeRPI.exe
  2⤵
  PID:10544
- C:\Windows\System\CksnImr.exe
  C:\Windows\System\CksnImr.exe
  2⤵
  PID:10568
- C:\Windows\System\CwgbtHn.exe
  C:\Windows\System\CwgbtHn.exe
  2⤵
  PID:10592
- C:\Windows\System\qmnKIYY.exe
  C:\Windows\System\qmnKIYY.exe
  2⤵
  PID:10608
- C:\Windows\System\xcsSqwA.exe
  C:\Windows\System\xcsSqwA.exe
  2⤵
  PID:10632
- C:\Windows\System\HBQZDyp.exe
  C:\Windows\System\HBQZDyp.exe
  2⤵
  PID:10648
- C:\Windows\System\zzlasVX.exe
  C:\Windows\System\zzlasVX.exe
  2⤵
  PID:10672
- C:\Windows\System\LVFUaDJ.exe
  C:\Windows\System\LVFUaDJ.exe
  2⤵
  PID:10696
- C:\Windows\System\kDyFLcK.exe
  C:\Windows\System\kDyFLcK.exe
  2⤵
  PID:10720
- C:\Windows\System\CcJgwUJ.exe
  C:\Windows\System\CcJgwUJ.exe
  2⤵
  PID:10736
- C:\Windows\System\SEsNucN.exe
  C:\Windows\System\SEsNucN.exe
  2⤵
  PID:10768
- C:\Windows\System\HwLItHw.exe
  C:\Windows\System\HwLItHw.exe
  2⤵
  PID:10800
- C:\Windows\System\armJufh.exe
  C:\Windows\System\armJufh.exe
  2⤵
  PID:10824
- C:\Windows\System\XRNEXOh.exe
  C:\Windows\System\XRNEXOh.exe
  2⤵
  PID:10844
- C:\Windows\System\EuSIXsC.exe
  C:\Windows\System\EuSIXsC.exe
  2⤵
  PID:10872
- C:\Windows\System\Gujxilj.exe
  C:\Windows\System\Gujxilj.exe
  2⤵
  PID:10888
- C:\Windows\System\NczUfPj.exe
  C:\Windows\System\NczUfPj.exe
  2⤵
  PID:10904
- C:\Windows\System\xezSXVY.exe
  C:\Windows\System\xezSXVY.exe
  2⤵
  PID:10932
- C:\Windows\System\SFTlDgr.exe
  C:\Windows\System\SFTlDgr.exe
  2⤵
  PID:10952
- C:\Windows\System\LpWiZiv.exe
  C:\Windows\System\LpWiZiv.exe
  2⤵
  PID:10968
- C:\Windows\System\VcfFJKO.exe
  C:\Windows\System\VcfFJKO.exe
  2⤵
  PID:10992
- C:\Windows\System\jclpUvP.exe
  C:\Windows\System\jclpUvP.exe
  2⤵
  PID:11020
- C:\Windows\System\NswXsTd.exe
  C:\Windows\System\NswXsTd.exe
  2⤵
  PID:11040
- C:\Windows\System\XpEIrGr.exe
  C:\Windows\System\XpEIrGr.exe
  2⤵
  PID:11056
- C:\Windows\System\IVSIdlC.exe
  C:\Windows\System\IVSIdlC.exe
  2⤵
  PID:11072
- C:\Windows\System\mTxqWII.exe
  C:\Windows\System\mTxqWII.exe
  2⤵
  PID:11088
- C:\Windows\System\TqvtSZK.exe
  C:\Windows\System\TqvtSZK.exe
  2⤵
  PID:11104
- C:\Windows\System\sFchlUT.exe
  C:\Windows\System\sFchlUT.exe
  2⤵
  PID:11124
- C:\Windows\System\VPhFZUW.exe
  C:\Windows\System\VPhFZUW.exe
  2⤵
  PID:11144
- C:\Windows\System\WZJYRQj.exe
  C:\Windows\System\WZJYRQj.exe
  2⤵
  PID:11164
- C:\Windows\System\cvJGGyD.exe
  C:\Windows\System\cvJGGyD.exe
  2⤵
  PID:11184
- C:\Windows\System\rHNQvDB.exe
  C:\Windows\System\rHNQvDB.exe
  2⤵
  PID:11208
- C:\Windows\System\EMxqSty.exe
  C:\Windows\System\EMxqSty.exe
  2⤵
  PID:7460
- C:\Windows\System\CoHRRiU.exe
  C:\Windows\System\CoHRRiU.exe
  2⤵
  PID:9936
- C:\Windows\System\AxkEOTr.exe
  C:\Windows\System\AxkEOTr.exe
  2⤵
  PID:9972
- C:\Windows\System\RSzxnVl.exe
  C:\Windows\System\RSzxnVl.exe
  2⤵
  PID:10024
- C:\Windows\System\eySHMtL.exe
  C:\Windows\System\eySHMtL.exe
  2⤵
  PID:10068
- C:\Windows\System\DeecPXR.exe
  C:\Windows\System\DeecPXR.exe
  2⤵
  PID:7372
- C:\Windows\System\KaupGse.exe
  C:\Windows\System\KaupGse.exe
  2⤵
  PID:8960
- C:\Windows\System\nVWELai.exe
  C:\Windows\System\nVWELai.exe
  2⤵
  PID:10148
- C:\Windows\System\qezJLHk.exe
  C:\Windows\System\qezJLHk.exe
  2⤵
  PID:9240
- C:\Windows\System\ImJrtLk.exe
  C:\Windows\System\ImJrtLk.exe
  2⤵
  PID:9324
- C:\Windows\System\uLtkqAy.exe
  C:\Windows\System\uLtkqAy.exe
  2⤵
  PID:6976
- C:\Windows\System\MMrAhsA.exe
  C:\Windows\System\MMrAhsA.exe
  2⤵
  PID:8300
- C:\Windows\System\ciHwejJ.exe
  C:\Windows\System\ciHwejJ.exe
  2⤵
  PID:9132
- C:\Windows\System\KdRsVPF.exe
  C:\Windows\System\KdRsVPF.exe
  2⤵
  PID:8496
- C:\Windows\System\PWNBYRn.exe
  C:\Windows\System\PWNBYRn.exe
  2⤵
  PID:9588
- C:\Windows\System\VaPGOak.exe
  C:\Windows\System\VaPGOak.exe
  2⤵
  PID:9616
- C:\Windows\System\NoPiodI.exe
  C:\Windows\System\NoPiodI.exe
  2⤵
  PID:9192
- C:\Windows\System\acLfSoB.exe
  C:\Windows\System\acLfSoB.exe
  2⤵
  PID:7304
- C:\Windows\System\VOjbnAJ.exe
  C:\Windows\System\VOjbnAJ.exe
  2⤵
  PID:6156
- C:\Windows\System\teuyERP.exe
  C:\Windows\System\teuyERP.exe
  2⤵
  PID:9892
- C:\Windows\System\qREdQlv.exe
  C:\Windows\System\qREdQlv.exe
  2⤵
  PID:10320
- C:\Windows\System\mEfobzr.exe
  C:\Windows\System\mEfobzr.exe
  2⤵
  PID:10004
- C:\Windows\System\IVVJUVn.exe
  C:\Windows\System\IVVJUVn.exe
  2⤵
  PID:8400
- C:\Windows\System\HQDVuYG.exe
  C:\Windows\System\HQDVuYG.exe
  2⤵
  PID:10428
- C:\Windows\System\WlexOnb.exe
  C:\Windows\System\WlexOnb.exe
  2⤵
  PID:10464
- C:\Windows\System\AxSKcri.exe
  C:\Windows\System\AxSKcri.exe
  2⤵
  PID:10508
- C:\Windows\System\UWLzQCa.exe
  C:\Windows\System\UWLzQCa.exe
  2⤵
  PID:10576
- C:\Windows\System\ErumsYd.exe
  C:\Windows\System\ErumsYd.exe
  2⤵
  PID:11272
- C:\Windows\System\OlMTtmC.exe
  C:\Windows\System\OlMTtmC.exe
  2⤵
  PID:11296
- C:\Windows\System\keDNPvk.exe
  C:\Windows\System\keDNPvk.exe
  2⤵
  PID:11316
- C:\Windows\System\YVmkqlx.exe
  C:\Windows\System\YVmkqlx.exe
  2⤵
  PID:11336
- C:\Windows\System\jZfoqJF.exe
  C:\Windows\System\jZfoqJF.exe
  2⤵
  PID:11360
- C:\Windows\System\MZtAtjj.exe
  C:\Windows\System\MZtAtjj.exe
  2⤵
  PID:11384
- C:\Windows\System\yjrztux.exe
  C:\Windows\System\yjrztux.exe
  2⤵
  PID:11408
- C:\Windows\System\PpWjPTX.exe
  C:\Windows\System\PpWjPTX.exe
  2⤵
  PID:11432
- C:\Windows\System\cyorALR.exe
  C:\Windows\System\cyorALR.exe
  2⤵
  PID:11448
- C:\Windows\System\xhaHmXv.exe
  C:\Windows\System\xhaHmXv.exe
  2⤵
  PID:11464
- C:\Windows\System\CAreTon.exe
  C:\Windows\System\CAreTon.exe
  2⤵
  PID:11484
- C:\Windows\System\NoeccvA.exe
  C:\Windows\System\NoeccvA.exe
  2⤵
  PID:11508
- C:\Windows\System\xodXoYX.exe
  C:\Windows\System\xodXoYX.exe
  2⤵
  PID:11532
- C:\Windows\System\sNcYGEN.exe
  C:\Windows\System\sNcYGEN.exe
  2⤵
  PID:11552
- C:\Windows\System\VzlRwBI.exe
  C:\Windows\System\VzlRwBI.exe
  2⤵
  PID:11572
- C:\Windows\System\HkWxJCP.exe
  C:\Windows\System\HkWxJCP.exe
  2⤵
  PID:11596
- C:\Windows\System\bhEzEPg.exe
  C:\Windows\System\bhEzEPg.exe
  2⤵
  PID:11616
- C:\Windows\System\NeQUzkH.exe
  C:\Windows\System\NeQUzkH.exe
  2⤵
  PID:11640
- C:\Windows\System\WXzgXPZ.exe
  C:\Windows\System\WXzgXPZ.exe
  2⤵
  PID:11664
- C:\Windows\System\kZPHGhB.exe
  C:\Windows\System\kZPHGhB.exe
  2⤵
  PID:11684
- C:\Windows\System\afNOPAH.exe
  C:\Windows\System\afNOPAH.exe
  2⤵
  PID:11708
- C:\Windows\System\GSNMBnR.exe
  C:\Windows\System\GSNMBnR.exe
  2⤵
  PID:11736
- C:\Windows\System\YUmJGhc.exe
  C:\Windows\System\YUmJGhc.exe
  2⤵
  PID:11756
- C:\Windows\System\gFOykTR.exe
  C:\Windows\System\gFOykTR.exe
  2⤵
  PID:11772
- C:\Windows\System\qdIucCA.exe
  C:\Windows\System\qdIucCA.exe
  2⤵
  PID:11792
- C:\Windows\System\ADWTmns.exe
  C:\Windows\System\ADWTmns.exe
  2⤵
  PID:11808
- C:\Windows\System\hDqJMFu.exe
  C:\Windows\System\hDqJMFu.exe
  2⤵
  PID:11824
- C:\Windows\System\aMhMFtL.exe
  C:\Windows\System\aMhMFtL.exe
  2⤵
  PID:11844
- C:\Windows\System\MkKbCjH.exe
  C:\Windows\System\MkKbCjH.exe
  2⤵
  PID:11868
- C:\Windows\System\RoNnPLt.exe
  C:\Windows\System\RoNnPLt.exe
  2⤵
  PID:11888
- C:\Windows\System\LMUJzzj.exe
  C:\Windows\System\LMUJzzj.exe
  2⤵
  PID:11920
- C:\Windows\System\EfRqmoX.exe
  C:\Windows\System\EfRqmoX.exe
  2⤵
  PID:8296
- C:\Windows\System\CYYVpPs.exe
  C:\Windows\System\CYYVpPs.exe
  2⤵
  PID:9688
- C:\Windows\System\xBwdYfD.exe
  C:\Windows\System\xBwdYfD.exe
  2⤵
  PID:4936
- C:\Windows\System\aZoOwAo.exe
  C:\Windows\System\aZoOwAo.exe
  2⤵
  PID:8812
- C:\Windows\System\lIcfxCv.exe
  C:\Windows\System\lIcfxCv.exe
  2⤵
  PID:9924
- C:\Windows\System\gFOBTzk.exe
  C:\Windows\System\gFOBTzk.exe
  2⤵
  PID:9996
- C:\Windows\System\fQdIUwF.exe
  C:\Windows\System\fQdIUwF.exe
  2⤵
  PID:10392
- C:\Windows\System\mbvMPHo.exe
  C:\Windows\System\mbvMPHo.exe
  2⤵
  PID:10048
- C:\Windows\System\YlKwgLm.exe
  C:\Windows\System\YlKwgLm.exe
  2⤵
  PID:2912
- C:\Windows\System\jGUfwcc.exe
  C:\Windows\System\jGUfwcc.exe
  2⤵
  PID:8456
- C:\Windows\System\rlqLhmd.exe
  C:\Windows\System\rlqLhmd.exe
  2⤵
  PID:10656
- C:\Windows\System\gKzNZvm.exe
  C:\Windows\System\gKzNZvm.exe
  2⤵
  PID:11580
- C:\Windows\System\HKDmnTs.exe
  C:\Windows\System\HKDmnTs.exe
  2⤵
  PID:11820
- C:\Windows\System\lXBBFyh.exe
  C:\Windows\System\lXBBFyh.exe
  2⤵
  PID:10784
- C:\Windows\System\qrNOcQh.exe
  C:\Windows\System\qrNOcQh.exe
  2⤵
  PID:5992
- C:\Windows\System\FTUVZqq.exe
  C:\Windows\System\FTUVZqq.exe
  2⤵
  PID:1920
- C:\Windows\System\wnkUnsf.exe
  C:\Windows\System\wnkUnsf.exe
  2⤵
  PID:7216
- C:\Windows\System\zLyDnnd.exe
  C:\Windows\System\zLyDnnd.exe
  2⤵
  PID:10836
- C:\Windows\System\OYhUePT.exe
  C:\Windows\System\OYhUePT.exe
  2⤵
  PID:11944
- C:\Windows\System\cNPmKYG.exe
  C:\Windows\System\cNPmKYG.exe
  2⤵
  PID:11972
- C:\Windows\System\kvUQuRe.exe
  C:\Windows\System\kvUQuRe.exe
  2⤵
  PID:8704
- C:\Windows\System\SguuGDr.exe
  C:\Windows\System\SguuGDr.exe
  2⤵
  PID:10808
- C:\Windows\System\EQTXtQi.exe
  C:\Windows\System\EQTXtQi.exe
  2⤵
  PID:11180
- C:\Windows\System\dyuLBNT.exe
  C:\Windows\System\dyuLBNT.exe
  2⤵
  PID:9300
- C:\Windows\System\OuNhkTo.exe
  C:\Windows\System\OuNhkTo.exe
  2⤵
  PID:8736
- C:\Windows\System\NTRgVxi.exe
  C:\Windows\System\NTRgVxi.exe
  2⤵
  PID:9932
- C:\Windows\System\zQcigbH.exe
  C:\Windows\System\zQcigbH.exe
  2⤵
  PID:12300
- C:\Windows\System\wnyLBek.exe
  C:\Windows\System\wnyLBek.exe
  2⤵
  PID:12328
- C:\Windows\System\FNqYezT.exe
  C:\Windows\System\FNqYezT.exe
  2⤵
  PID:12360
- C:\Windows\System\ImBeVBP.exe
  C:\Windows\System\ImBeVBP.exe
  2⤵
  PID:12376
- C:\Windows\System\fUOGKFA.exe
  C:\Windows\System\fUOGKFA.exe
  2⤵
  PID:12400
- C:\Windows\System\XQfoNRJ.exe
  C:\Windows\System\XQfoNRJ.exe
  2⤵
  PID:12428
- C:\Windows\System\msKkWYp.exe
  C:\Windows\System\msKkWYp.exe
  2⤵
  PID:12448
- C:\Windows\System\sjsDIZm.exe
  C:\Windows\System\sjsDIZm.exe
  2⤵
  PID:12464
- C:\Windows\System\ZBjRwFw.exe
  C:\Windows\System\ZBjRwFw.exe
  2⤵
  PID:12480
- C:\Windows\System\XqKUrbF.exe
  C:\Windows\System\XqKUrbF.exe
  2⤵
  PID:12496
- C:\Windows\System\zAbBwAR.exe
  C:\Windows\System\zAbBwAR.exe
  2⤵
  PID:12516
- C:\Windows\System\EoyJvwy.exe
  C:\Windows\System\EoyJvwy.exe
  2⤵
  PID:12532
- C:\Windows\System\tqrKecF.exe
  C:\Windows\System\tqrKecF.exe
  2⤵
  PID:12548
- C:\Windows\System\aGczrxK.exe
  C:\Windows\System\aGczrxK.exe
  2⤵
  PID:12564
- C:\Windows\System\fhXItbv.exe
  C:\Windows\System\fhXItbv.exe
  2⤵
  PID:12588
- C:\Windows\System\HulXqTi.exe
  C:\Windows\System\HulXqTi.exe
  2⤵
  PID:12612
- C:\Windows\System\vZcbKtc.exe
  C:\Windows\System\vZcbKtc.exe
  2⤵
  PID:12640
- C:\Windows\System\wFdbUWH.exe
  C:\Windows\System\wFdbUWH.exe
  2⤵
  PID:12664
- C:\Windows\System\WdxIFvw.exe
  C:\Windows\System\WdxIFvw.exe
  2⤵
  PID:12692
- C:\Windows\System\ONkhSIb.exe
  C:\Windows\System\ONkhSIb.exe
  2⤵
  PID:12720
- C:\Windows\System\MqTHAxw.exe
  C:\Windows\System\MqTHAxw.exe
  2⤵
  PID:12744
- C:\Windows\System\cRnXbjh.exe
  C:\Windows\System\cRnXbjh.exe
  2⤵
  PID:12768
- C:\Windows\System\iFnYjgC.exe
  C:\Windows\System\iFnYjgC.exe
  2⤵
  PID:12792
- C:\Windows\System\IemXucs.exe
  C:\Windows\System\IemXucs.exe
  2⤵
  PID:12812
- C:\Windows\System\PjahjMq.exe
  C:\Windows\System\PjahjMq.exe
  2⤵
  PID:12840
- C:\Windows\System\HTEKskb.exe
  C:\Windows\System\HTEKskb.exe
  2⤵
  PID:12864
- C:\Windows\System\LsljjkI.exe
  C:\Windows\System\LsljjkI.exe
  2⤵
  PID:12888
- C:\Windows\System\tFeqJTU.exe
  C:\Windows\System\tFeqJTU.exe
  2⤵
  PID:12912
- C:\Windows\System\sbvlRmy.exe
  C:\Windows\System\sbvlRmy.exe
  2⤵
  PID:12932
- C:\Windows\System\rmejSrr.exe
  C:\Windows\System\rmejSrr.exe
  2⤵
  PID:12952
- C:\Windows\System\AHgRpOl.exe
  C:\Windows\System\AHgRpOl.exe
  2⤵
  PID:12968
- C:\Windows\System\FujrWLg.exe
  C:\Windows\System\FujrWLg.exe
  2⤵
  PID:13000
- C:\Windows\System\OsfYkLO.exe
  C:\Windows\System\OsfYkLO.exe
  2⤵
  PID:13020
- C:\Windows\System\sTSUdXy.exe
  C:\Windows\System\sTSUdXy.exe
  2⤵
  PID:13044
- C:\Windows\System\irGykwY.exe
  C:\Windows\System\irGykwY.exe
  2⤵
  PID:13072
- C:\Windows\System\ftAVJlg.exe
  C:\Windows\System\ftAVJlg.exe
  2⤵
  PID:13096
- C:\Windows\System\eeOKQqw.exe
  C:\Windows\System\eeOKQqw.exe
  2⤵
  PID:13128
- C:\Windows\System\wEcIiEu.exe
  C:\Windows\System\wEcIiEu.exe
  2⤵
  PID:13156
- C:\Windows\System\KVJxjUU.exe
  C:\Windows\System\KVJxjUU.exe
  2⤵
  PID:13188
- C:\Windows\System\ByMGfnJ.exe
  C:\Windows\System\ByMGfnJ.exe
  2⤵
  PID:13208
- C:\Windows\System\LwTzIuO.exe
  C:\Windows\System\LwTzIuO.exe
  2⤵
  PID:13252
- C:\Windows\System\PvKCoAx.exe
  C:\Windows\System\PvKCoAx.exe
  2⤵
  PID:13272
- C:\Windows\System\bNEnivf.exe
  C:\Windows\System\bNEnivf.exe
  2⤵
  PID:8688
- C:\Windows\System\etnCmUf.exe
  C:\Windows\System\etnCmUf.exe
  2⤵
  PID:12204
- C:\Windows\System\aAiiZwr.exe
  C:\Windows\System\aAiiZwr.exe
  2⤵
  PID:10368
- C:\Windows\System\CZhumaf.exe
  C:\Windows\System\CZhumaf.exe
  2⤵
  PID:11356
- C:\Windows\System\mQGjuXL.exe
  C:\Windows\System\mQGjuXL.exe
  2⤵
  PID:11400
- C:\Windows\System\yRHSXdm.exe
  C:\Windows\System\yRHSXdm.exe
  2⤵
  PID:10640
- C:\Windows\System\STDTYuG.exe
  C:\Windows\System\STDTYuG.exe
  2⤵
  PID:10220
- C:\Windows\System\qTtvuQF.exe
  C:\Windows\System\qTtvuQF.exe
  2⤵
  PID:10912
- C:\Windows\System\pGAhGqX.exe
  C:\Windows\System\pGAhGqX.exe
  2⤵
  PID:13308
- C:\Windows\System\iGUXyTG.exe
  C:\Windows\System\iGUXyTG.exe
  2⤵
  PID:11896
- C:\Windows\System\KxFNRof.exe
  C:\Windows\System\KxFNRof.exe
  2⤵
  PID:11048
- C:\Windows\System\bCUoSRV.exe
  C:\Windows\System\bCUoSRV.exe
  2⤵
  PID:8240
- C:\Windows\System\wkcBZdH.exe
  C:\Windows\System\wkcBZdH.exe
  2⤵
  PID:3424
- C:\Windows\System\ixuyivJ.exe
  C:\Windows\System\ixuyivJ.exe
  2⤵
  PID:12424
- C:\Windows\System\OnhmnGj.exe
  C:\Windows\System\OnhmnGj.exe
  2⤵
  PID:12476
- C:\Windows\System\iYsfMyP.exe
  C:\Windows\System\iYsfMyP.exe
  2⤵
  PID:12504
- C:\Windows\System\yAkSgwd.exe
  C:\Windows\System\yAkSgwd.exe
  2⤵
  PID:12808
- C:\Windows\System\KqBLzKo.exe
  C:\Windows\System\KqBLzKo.exe
  2⤵
  PID:12856
- C:\Windows\System\eJcOiCm.exe
  C:\Windows\System\eJcOiCm.exe
  2⤵
  PID:12924
- C:\Windows\System\rmKHLxL.exe
  C:\Windows\System\rmKHLxL.exe
  2⤵
  PID:13040
- C:\Windows\System\GGJPbuf.exe
  C:\Windows\System\GGJPbuf.exe
  2⤵
  PID:13152
- C:\Windows\System\klrEdVT.exe
  C:\Windows\System\klrEdVT.exe
  2⤵
  PID:13228
- C:\Windows\System\toZfRnD.exe
  C:\Windows\System\toZfRnD.exe
  2⤵
  PID:3044
- C:\Windows\System\MleYnur.exe
  C:\Windows\System\MleYnur.exe
  2⤵
  PID:11524
- C:\Windows\System\YehKkZf.exe
  C:\Windows\System\YehKkZf.exe
  2⤵
  PID:11008
- C:\Windows\System\jhLLFJq.exe
  C:\Windows\System\jhLLFJq.exe
  2⤵
  PID:9664
- C:\Windows\System\zngofYA.exe
  C:\Windows\System\zngofYA.exe
  2⤵
  PID:12684
- C:\Windows\System\YbCOVtr.exe
  C:\Windows\System\YbCOVtr.exe
  2⤵
  PID:12320
- C:\Windows\System\KXvwNhQ.exe
  C:\Windows\System\KXvwNhQ.exe
  2⤵
  PID:12728
- C:\Windows\System\CcSJnrs.exe
  C:\Windows\System\CcSJnrs.exe
  2⤵
  PID:11632
- C:\Windows\System\XkdDbSd.exe
  C:\Windows\System\XkdDbSd.exe
  2⤵
  PID:12632
- C:\Windows\System\XJGlbJm.exe
  C:\Windows\System\XJGlbJm.exe
  2⤵
  PID:11540
- C:\Windows\System\HOnMBvB.exe
  C:\Windows\System\HOnMBvB.exe
  2⤵
  PID:7776
- C:\Windows\System\fMgOCFR.exe
  C:\Windows\System\fMgOCFR.exe
  2⤵
  PID:3156
- C:\Windows\System\LsEoCwa.exe
  C:\Windows\System\LsEoCwa.exe
  2⤵
  PID:12456
- C:\Windows\System\wNErnNs.exe
  C:\Windows\System\wNErnNs.exe
  2⤵
  PID:9876
- C:\Windows\System\ZfrpNpn.exe
  C:\Windows\System\ZfrpNpn.exe
  2⤵
  PID:12948
- C:\Windows\System\SvrBbGr.exe
  C:\Windows\System\SvrBbGr.exe
  2⤵
  PID:11444
- C:\Windows\System\XjpVFkC.exe
  C:\Windows\System\XjpVFkC.exe
  2⤵
  PID:3804
- C:\Windows\System\KbCXixM.exe
  C:\Windows\System\KbCXixM.exe
  2⤵
  PID:12648
- C:\Windows\System\XNbOnYe.exe
  C:\Windows\System\XNbOnYe.exe
  2⤵
  PID:12836
- C:\Windows\System\RMMhJgS.exe
  C:\Windows\System\RMMhJgS.exe
  2⤵
  PID:11624
- C:\Windows\System\fhYPafx.exe
  C:\Windows\System\fhYPafx.exe
  2⤵
  PID:11096
- C:\Windows\System\GmPSlWI.exe
  C:\Windows\System\GmPSlWI.exe
  2⤵
  PID:2804
- C:\Windows\System\cVMbzvN.exe
  C:\Windows\System\cVMbzvN.exe
  2⤵
  PID:12492
- C:\Windows\System\xBnQpDQ.exe
  C:\Windows\System\xBnQpDQ.exe
  2⤵
  PID:456
- C:\Windows\System\yEAwKRQ.exe
  C:\Windows\System\yEAwKRQ.exe
  2⤵
  PID:9236
- C:\Windows\System\fhKCeJL.exe
  C:\Windows\System\fhKCeJL.exe
  2⤵
  PID:12152
- C:\Windows\System\FgcdQCe.exe
  C:\Windows\System\FgcdQCe.exe
  2⤵
  PID:9716
- C:\Windows\System\uumdKwy.exe
  C:\Windows\System\uumdKwy.exe
  2⤵
  PID:10628
- C:\Windows\System\bcEuvUe.exe
  C:\Windows\System\bcEuvUe.exe
  2⤵
  PID:11376
- C:\Windows\System\BDbLlSk.exe
  C:\Windows\System\BDbLlSk.exe
  2⤵
  PID:10396
- C:\Windows\System\gpSjeCg.exe
  C:\Windows\System\gpSjeCg.exe
  2⤵
  PID:8208
- C:\Windows\System\ucEDLVR.exe
  C:\Windows\System\ucEDLVR.exe
  2⤵
  PID:10272
- C:\Windows\System\AfOFegu.exe
  C:\Windows\System\AfOFegu.exe
  2⤵
  PID:1056
- C:\Windows\System\lOkPStS.exe
  C:\Windows\System\lOkPStS.exe
  2⤵
  PID:11140
- C:\Windows\System\BXlAgen.exe
  C:\Windows\System\BXlAgen.exe
  2⤵
  PID:4168
- C:\Windows\System\TGeVVnG.exe
  C:\Windows\System\TGeVVnG.exe
  2⤵
  PID:2852
- C:\Windows\System\lMsBqvL.exe
  C:\Windows\System\lMsBqvL.exe
  2⤵
  PID:9108
- C:\Windows\System\RCPeEZW.exe
  C:\Windows\System\RCPeEZW.exe
  2⤵
  PID:9780
- C:\Windows\System\XmEoytO.exe
  C:\Windows\System\XmEoytO.exe
  2⤵
  PID:11196
- C:\Windows\System\DKsccOg.exe
  C:\Windows\System\DKsccOg.exe
  2⤵
  PID:4756
- C:\Windows\System\DQpuMwk.exe
  C:\Windows\System\DQpuMwk.exe
  2⤵
  PID:5804
- C:\Windows\System\avqKawL.exe
  C:\Windows\System\avqKawL.exe
  2⤵
  PID:12560
- C:\Windows\System\WxRTRWd.exe
  C:\Windows\System\WxRTRWd.exe
  2⤵
  PID:12940
- C:\Windows\System\CLWgLZH.exe
  C:\Windows\System\CLWgLZH.exe
  2⤵
  PID:9548
- C:\Windows\System\IgcIjdb.exe
  C:\Windows\System\IgcIjdb.exe
  2⤵
  PID:12620
- C:\Windows\System\ZlYWWGs.exe
  C:\Windows\System\ZlYWWGs.exe
  2⤵
  PID:12756
- C:\Windows\System\CKJsoGc.exe
  C:\Windows\System\CKJsoGc.exe
  2⤵
  PID:10900
- C:\Windows\System\PNbffiD.exe
  C:\Windows\System\PNbffiD.exe
  2⤵
  PID:7900
- C:\Windows\System\DdtrQAS.exe
  C:\Windows\System\DdtrQAS.exe
  2⤵
  PID:4116
- C:\Windows\System\kRTZQIy.exe
  C:\Windows\System\kRTZQIy.exe
  2⤵
  PID:13060
- C:\Windows\System\FeJsGHv.exe
  C:\Windows\System\FeJsGHv.exe
  2⤵
  PID:11696
- C:\Windows\System\ffjxwbQ.exe
  C:\Windows\System\ffjxwbQ.exe
  2⤵
  PID:13264
- C:\Windows\System\DOECcCI.exe
  C:\Windows\System\DOECcCI.exe
  2⤵
  PID:11900
- C:\Windows\System\PsJCDyx.exe
  C:\Windows\System\PsJCDyx.exe
  2⤵
  PID:4292
- C:\Windows\System\JANvdGW.exe
  C:\Windows\System\JANvdGW.exe
  2⤵
  PID:11804
- C:\Windows\System\LbSjFzC.exe
  C:\Windows\System\LbSjFzC.exe
  2⤵
  PID:3104

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_txtxifmj.ujm.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ATCPtkz.exe

Filesize
1.9MB

MD5
a7573dfa1970338a57e7c9ecb54c8dc2

SHA1
6d04aa1b7a39a96e4d1f9e866c622f80729f549e

SHA256
46432ca6aca6587747699a4e76dd5650124df7b762144179f993a3e0d0c5adf2

SHA512
c39321bd2c546cd9139c6624b4115a7204c2e98adf8f660fa594ce1b035ca710742b02de78653f73611898f5e8eb3365b817a294b56a7c390d5fdbbf18d6b922

Download Submit
C:\Windows\System\CDVJHTg.exe

Filesize
1.9MB

MD5
fd9bcf141b484f37dc7b84f0ec98dfbc

SHA1
b6a23eefde62b7a39051b027022e6e4dbf72e464

SHA256
98047fc40f2d88ce10f5f655a495ec71987d6746aba4b524010d5c66c30aeeb3

SHA512
35b4f29a540e612ac407683ac78dc9fc57af111c928d0cc71ff6cddd1077037926bb683f54d3e4e02c815edeccbc0bb55f08b8e2c5eed434a1e30b7fca9860ee

Download Submit
C:\Windows\System\CPXNcQP.exe

Filesize
1.9MB

MD5
124e5f09c8d21b28031a5401337fc8b0

SHA1
3c89c2d44b67c9f0152fec334115ac1610c62634

SHA256
4ceed0ab36f39ec02a7b665a8f38985b38e3f7f4b39244cf0172a0a5ce3f64d4

SHA512
c8c4588cc3422e5c76baee28c9b2af08cdbb0468fb2f438664dfb3aac6209a4dbcbd86698e3376d2b3c4848e6298491d1f6c44db555a856e87bae9ba98a4bcd2

Download Submit
C:\Windows\System\EogbwBo.exe

Filesize
1.9MB

MD5
22991130ec6aff7a17c69560991aeea2

SHA1
2c2a706f9d6ca5cf4d8f66b09d127136d8dc63f4

SHA256
c648d3246d941a0d3dc68121fbdac0d90de6befd7912e1b3b2e482d54481a69a

SHA512
43173ca01643cca896d75c91a50a240b69e0b331c1833e800ce280bd6d46406c2814492784d49c5a770b621bf4f719ac8bbb56c49f39c14baebca9c74601870a

Download Submit
C:\Windows\System\FYqvJbl.exe

Filesize
1.9MB

MD5
07581f7369ecd39bb7b16a6a02bd33cf

SHA1
abc6d9c173b8abcc764482e7bd9b311866975703

SHA256
ee3fec904f2d870b8e261c8749c84fe86bb57a3038ee6cb73a255cef05f685e9

SHA512
85c279f5efeb42dff2865813eb0d1e40b5ff56088adfc442a93d53e6cee5490f70d7db811f0cf89df2854921a7961b308425edb7b42615c8842f6114a85ecb97

Download Submit
C:\Windows\System\GKUjccm.exe

Filesize
1.9MB

MD5
a70e75ba9a20a8a807f3a3c1471d89f0

SHA1
df06ff561901c5108c47305d8eed2075cb0174ae

SHA256
36b68e2963fd98fafab29449dd2e38373b9f27e6b0538787474fab7900837b9d

SHA512
ab3c16b27da5bd07e5c7afb68fc9f26b18a87eb278d93e0658165e75d072ed059eb4f32674d9f9423180ef60a90f2dd6bca6a6127c2b8c25b75695b566034911

Download Submit
C:\Windows\System\GShVncl.exe

Filesize
1.9MB

MD5
97da8ef996c6b72806695bbd16086bca

SHA1
d78cfcec57e02e7b52e4d2ea3d9129edf7c729a7

SHA256
2b4da42ae2ff733a6881e0709c6078d323c71896661f917f63ea252822f25655

SHA512
bbf1db2429b9effe61c3971271332f2f44add87455f638fcbcb500896b2d8fefa6bb12976805a940540b480a81d788f9e666d300dacb3b6459d22908c44048f2

Download Submit
C:\Windows\System\GpQaeqN.exe

Filesize
1.9MB

MD5
56fd2ba3d02a344487b6320928c93888

SHA1
4499069ddaafd0e89f179edba70afff06931618e

SHA256
a1ee1c3f56e4ffc5c5c27936b81f79907dfe6594e20f28a9b85ea7caf12245a2

SHA512
ed4dd4fd570c83da93cbb9a3a47c1bb3aa421e09162dc20370134cc9db773de9e94e9d458289bf230ec48633002ce2fcc553310dc76c2bb9e7f2a03882ebe152

Download Submit
C:\Windows\System\HsQBHMh.exe

Filesize
1.9MB

MD5
ee0f85ab0f5127319792262933d16310

SHA1
9891664999523c2735550a6cd15e8a89577dfc64

SHA256
ae2f5a1c279e1b60eae727aef64d080e5000a6e3410e190c84c9794d96421ac5

SHA512
0c07e7e80ec2d8c9803a4135942840c8bc87cac2696041a7664a729ef1a83a8f31fdd7666dc324af9721921dd10d8be9bd03d3bb6dd77c55c3724f237862b611

Download Submit
C:\Windows\System\MAVbdxQ.exe

Filesize
1.9MB

MD5
39fc1cab6f0ec7dbc3f589ace132c69e

SHA1
65f7445551eb77e572aeb25b617573cead6e813e

SHA256
c87b0c06db3daf877c0f309f73b9bbb80e1b9934ca634e7b4b223b099a5edc8f

SHA512
49d9f7ceb717a2d7fded004dd6753a019d5516a881ed2b585036ec9329c17854367c6a8afde5059639f47466167a157e02e8c4ff01c98aa59a488a8e3882a5da

Download Submit
C:\Windows\System\MIgkdNG.exe

Filesize
1.9MB

MD5
071b9475f2b8c99814418fc121cda643

SHA1
ef54dbcd33ce1dba6a057058ffc10dbb81b7b925

SHA256
74b6b946646c0cf3a6ae043158fa2d3c31c284df287f06a2fcbbf89b68e65bf9

SHA512
adf2c1ddf11dde11c8ebe1dbbdc140207d44050d608c8af1af304997eaef5b892f57a05d33bf70a986844dc69a857f732876934a0e75295b9ad3cef78b7e9cd8

Download Submit
C:\Windows\System\MWXkRkr.exe

Filesize
1.9MB

MD5
c18bc9be90432ba47d7df9efe0470d8a

SHA1
62b18f393708df587fa39facc0f62b711f1b753b

SHA256
78f92e59c6c4849edeac65abee87c297a918b168713df3ee3f506eaf9b8844fd

SHA512
13eb7647ae22340265afa1d55aa3c48d89a0309b85e73e0524bddfcd1fcac125c336afa1624316fa499473dbed16ff475403a8dbf680afda3425a3a5124e8389

Download Submit
C:\Windows\System\RLrgCJU.exe

Filesize
8B

MD5
a8f2921c80c15a3d426e5fdff8a56196

SHA1
4dc21bf95e22427a9dafcd4930e81b62e77d5fda

SHA256
7e9bbeeba45dae16f8c444596ee4180d7313e899e46fa6263fde6904f32d92a1

SHA512
996666f646b1878ee129a778184f9520541ee458797b8bfaefed6e1f152a5436e0ff19d28744463b706ffe3e24e429f5af102aa1e7733dbeeb6210754c828802

Download Submit
C:\Windows\System\RUUndia.exe

Filesize
1.9MB

MD5
733c75c6490a8dccff03b2a864ab9631

SHA1
e055d60ae76ffe76dbd22da44685a805e078834b

SHA256
824d101b1a7169cf68ebd303b00d3ac1e8804a03c231a9b8a90ad2edfce701f1

SHA512
d4bb199b4dc743f1eb3ffb2d2c4dfaef0712dc4e7868971e96c378198afe10b472fa0dddcf801063ba58a527862ee73d3534535536d52a10dc7f1badebb28512

Download Submit
C:\Windows\System\SrHVvRB.exe

Filesize
1.9MB

MD5
49fdb9f844c4867d3f8ac06f3db6cf0a

SHA1
1300a78d0d7880baadde414d93c45e03cf7d7a48

SHA256
5be2bcb959c0e36a5ba4de60aac15bc28c254ba71f2be6ebd45e656169329786

SHA512
eab54525f3bb94aef9c55a276fb63ed3f93fd560ed28ec4dc765fbf575140c48f0502fcad765cc66ab0b11b04b93111b4fd19373fb5d68152507f2a4c5affca2

Download Submit
C:\Windows\System\WDvUUrZ.exe

Filesize
1.9MB

MD5
95b25a2b188ad74d8bf312e34da5c169

SHA1
5d90ea04c1e026bd5dadec018793f6630f231034

SHA256
de52acb8084b578d7a1ee0aeec925e8ae7be0dcb5b428e384106d99960c9e87f

SHA512
62a895a47852af9e67aa12e287cd1e4442a3f483ef6748d32f4bf3feabbd508f27d02b56cd5d84dd6c389b7bd9195e85c44e041e96f4cc1992772eee5f0f7920

Download Submit
C:\Windows\System\XrlNgKU.exe

Filesize
1.9MB

MD5
9a1f9143a44d62836fcedb69bb7e9df3

SHA1
636c98aea56710008866bf509de7fb7cfd67397a

SHA256
178d3f477ba25c1bf2944c56225a2973f33c8c0d5ca75862c616b6ec20113ad1

SHA512
383c3c10ce2726f82337d0bd620bede776ea17c24af12f9c2e61136c494b36b6377b0449dc01db83fa68e2b6625219ec26252e18f133fe6169fd2f6adfebd6c6

Download Submit
C:\Windows\System\aijPrMC.exe

Filesize
1.9MB

MD5
a6bfae17581b04593f791c17c638d997

SHA1
a571c0eab4ee33381330cc8aa6a86cc6f78edf3a

SHA256
537c1b5b9b480c17ae28b7adcbf74206a6b8f19753723581aadc366f759b9db3

SHA512
435f6abee4c0210b69772230a9152b31e503722e8b4744956bc325807c4dc4e1a3af2f3b96d7e2a7949bb5bd3bc5ae9446adb6d90a4570f5eaa87c45ab0d1c53

Download Submit
C:\Windows\System\byzNLZv.exe

Filesize
1.9MB

MD5
0b7e4b74f358e709a98cb0499978cfe7

SHA1
7abe8a4ee484b3d17d86ea3224442a4ecb4faebd

SHA256
0bf298ae1629414205d9d1b99000d1be0ce9a1dd569445bfb71548b520ab9fa5

SHA512
34288fbb1c82a896305f674bfc928d3ff1edf06ead51f5f2ca46b83b098dc32762a03d7e19f670965af93d6bf76beeba0e737907cc9ed11222856004d06ff48a

Download Submit
C:\Windows\System\cWFudsI.exe

Filesize
1.9MB

MD5
6d94fa18f9d4288c4d7cd4c25295609e

SHA1
dbefcdb9e2c795b6b1122004697d88643de78857

SHA256
b96a26b9c7aa134283d2c2ea9b44b524087ae0ecc3efd0d9a1adb8803770f53b

SHA512
cbc428af0bb8aa0d9e186714587444e7ba76d388ed20801a05492a2d151307b21e6df99ed0322d01d12098efd28c79c6ab2be4f7a213c157ff626c3a2b15b2c9

Download Submit
C:\Windows\System\dAlRtAu.exe

Filesize
1.9MB

MD5
3c582a4b8f3e29a88053c756cb05421c

SHA1
a64b654312bc567080f1ecbd80571ae6bcc08a5e

SHA256
1edea0645946b2a72424a17001a50303e276da57170098edea799dfb16c2d5fd

SHA512
81f86f35b5a12e85cb3abe4571f9ae2f2f401c28a8d289140c6e09b120ea0233d71c232baa71d5676f333ddf976395aa86af308f7a24dfc45910bc10bc3eda8e

Download Submit
C:\Windows\System\doyMHwF.exe

Filesize
1.9MB

MD5
8b17090023a7e8daeb6455532ab78092

SHA1
f75f651d94a13b5afb63449d1a7b4763a970dea0

SHA256
b4f64b63e614e4c5e5647d95f17bdd5fe2b6a22eb99b540bca9ecd0e973fa193

SHA512
c01d956e5a4032e6a452ff3a16a81067b0075a03ec91dd5631c7da09067227cf188d388038467e92a94dd7b20e431b16869d413bac5b8ba77c51f9dad1d2f81a

Download Submit
C:\Windows\System\eINBkcs.exe

Filesize
1.9MB

MD5
cdfa0d22b3af4fff30c2a84db31d2554

SHA1
503d0ffc16facc47681ccff6d1ab223a2d0650b6

SHA256
91bcacac5cee09ab2fac3cf15c41a140a65134828fce60c0d16dbaeb4145319a

SHA512
36461f660be63b12668edece9de743ab685a3e470436b5e36f359706d8ea8a229e975e1a3684ae073ba1b7aba72a8735fc9ffb1ef75ef2e8cb310fdaa8904801

Download Submit
C:\Windows\System\fkAthOX.exe

Filesize
1.9MB

MD5
6f1d81f519d7dda2ec9fcc02c508b366

SHA1
701cfb4b0f9e8598a6d32dfdd73396dea180a648

SHA256
93d3cc5272e179e3481b130abe06fba7d2d76c520b80677a7cc0f996a6c6d227

SHA512
c16f06d6dcfeab17d70ef132c2c33cf0506938b3a432a6f88d490fe37ea231cbd05c1df7df051be3ad2c885cc6561b615cc585445dfe47064d9db74c7a936bde

Download Submit
C:\Windows\System\fodRuRH.exe

Filesize
1.9MB

MD5
01caade3b7244129bb1b82bcdb087041

SHA1
2025aa1b1e8688d6b65c39f226994832c9088013

SHA256
25b012be2848fa2e198c52de13960e28054339e87cebd18e164d0b7fc5ad8e64

SHA512
d50560c15ad6d8c95b7f31d888fe91cc85bcd36b8a8ba36659c8627a6cf26f9f78b0190b17fd6719ccdabb45db9e0d035caafb25da6b9ce32c4a3efbb01950f1

Download Submit
C:\Windows\System\gCoofeT.exe

Filesize
1.9MB

MD5
d6d09d145b41aa25b3a2e327d287f05c

SHA1
3c0c24c77c916eedd9b15c9e60dd25d314f19df1

SHA256
f7981409be334c6bd6854ec3aba40ed421e2f4971361d5f6b6136c10833e1186

SHA512
1de566d3a5660b9e6b4a9ba7062fd38d8c292f5c9c86cf5c6007cb7360f8be26193ad6fe909d9b9cd2f6917f322a69c08b6bf55f080087d5e3acc0d6d25a93a9

Download Submit
C:\Windows\System\gajbWtl.exe

Filesize
1.9MB

MD5
376676736459125212428f35ec884477

SHA1
d33661325cb84b926b7c59c3b5c5f34faa963b93

SHA256
9a700869cc625adff482e0bbd054534da63c793a25b64c26b7d20666163c485a

SHA512
8e5c4add0f8ac2533babe3713f9bab84af8bf435d1d92d97d5442b1ae274bc99b35f57e71662f87e451ec3c3e0952e4791e601fdf67cfe904259e4ee21fb4904

Download Submit
C:\Windows\System\hCdRrwm.exe

Filesize
1.9MB

MD5
7da834e52a7a9c71f4e606df5b7e3889

SHA1
6c7f6496e1d401bf46df6629617ebbddbf9005ba

SHA256
a4fc4d10353e2c2a0c24cd67c41122004e9b08588ac480bd03f3ce9cdd233661

SHA512
8f0cd7cf4679808bc0c110569efee5a0b8ced418e04c6903c51b066563de48eb465d8ec23eb845759876573d0fb15168499d63cd93e4b1625edf50ae3afbf508

Download Submit
C:\Windows\System\mcLWOFK.exe

Filesize
1.9MB

MD5
e10b239da4e0edde73f834cfc0bd0f36

SHA1
8db0561085b3cd41036825c1e36882c4296f2dae

SHA256
4fe517078d2e442402841046098c9e26cb7a5d78b843dc09bed08a13c9dc8fa1

SHA512
602f0728803403f0c1812a5219c13a68525f14eb52cdc081df3b019355f3bcda9dc51c4fd9ef783ab357b6ef28953091c04a00d432b12b08e25b450ac1358440

Download Submit
C:\Windows\System\nHhXlGx.exe

Filesize
1.9MB

MD5
49bb87ebfe3391e8b7376c3928ac77d3

SHA1
998610238613142f414c83d0f6d02d220676920a

SHA256
da932b1c0368d164ef0199a3941d2526dfad58a9df28a4ab0033dde1366325f6

SHA512
e8dd92100c0cce01ba4831dcc87bccf4eb35f805ced68b95911311751dd2a421ad05e62ff1b9d6d9b48f0852594d7cad59fe7482895988e9be1c6cdbc5331bf2

Download Submit
C:\Windows\System\pyJoOiJ.exe

Filesize
1.9MB

MD5
07e10c9250e80172dabbc630018d8bc5

SHA1
ae31ffc1bc0f6a341a076c05a7fa8ad681fb72be

SHA256
0548e27b130a18b67d9aff36d5ccfcb4101ac52908daae4d3b5df7c4d2f546e7

SHA512
f6f77044538432a9c9ca2ae6761200f4521d03280f9b8bfd88d7428e5403dd6b5eace064bf63d33768b62051055fcc04668b6914d7863e40c299f2604202f584

Download Submit
C:\Windows\System\qRRTZZu.exe

Filesize
1.9MB

MD5
c5c5d94498a298de8f9d733adaf5b219

SHA1
cb59a1bb16dd476dbd17b7347aa308e443091a41

SHA256
02282ce7de213a74c767e02b60dcaf321bf9e1a520b63fbd163923239e501cd8

SHA512
60e14cac57099f525b44e6346abe8d717507c56437c2a2301ac56844ab3bc0d550c81226eef8c3b245fb4442322695f81bb326312b1740deebeac9d774187d75

Download Submit
C:\Windows\System\rmUJaec.exe

Filesize
1.9MB

MD5
9be4e8d13b867aaad4793ae3464c7f63

SHA1
011100861300bb829b66cd0975c1d8d3165a5bfb

SHA256
3407d4782d22aa0e546bc887cb29ff413dd08a6774bf6f7ae08b2378c06d53c2

SHA512
14f2d44f677aec30eb9219fb3fe6170209f469b19acbd56ce8e5e2a9b000f94a1fcc5ba2db7093195c43f248aaf980bf9196bdd3131ab0f9e4a12b3a8a9d6a3a

Download Submit
C:\Windows\System\tGCuOyN.exe

Filesize
1.9MB

MD5
41bd7021a5f5f1990e1d38131d4281b4

SHA1
d8cc93c4b68d9db621b5d30bfce221370468f68e

SHA256
ba370f09db7d193dbef3a2dcff61348730ad78ef4274f490eb7f9d92423bd132

SHA512
728a0cdee199bad1e5536819626932f7f73793b94d4717ef027f793b76da3b2c3714b58dae554575d84e522c0c55db9452da381b3b903d2098102c9d25fc4e1b

Download Submit
C:\Windows\System\taXJHjd.exe

Filesize
1.9MB

MD5
7022684eb4ffb94a00b07fa2f4d7cf38

SHA1
aeef4e57203ab8bed9b02a34c1b259a5ba4e8a8b

SHA256
510b5ffda0cb0f2e385008f182533f1df3ea87583872e3e581da20003aa1d886

SHA512
77fbc20e7a15011f26e104a7ff5c653580838ef5725c8427d40cbdc7d68ddfa8406e32aa213c2f0b18e358107a730996bfd58cc9ac073911618c098d2d964829

Download Submit
C:\Windows\System\titwezO.exe

Filesize
1.9MB

MD5
cb2c47b7121472b5b635368191ee05cf

SHA1
5153dde9a43459c22d4457e90556af4444e30aa5

SHA256
98906c5d1c34292845509a20e37811e63f3d91d3bc5db1e91b1012f1a1f4a1de

SHA512
5ddb486ac2b501eb49420c3621ca302fc162edd7fd5713cf6d3163b3b7418acc1ab75af1a74ea48f385b936944114e4b50458e27feb135d82621fd0618e7c795

Download Submit
C:\Windows\System\uOiEBra.exe

Filesize
1.9MB

MD5
d58a24ed9d60e2b0f6384c0bd31c514a

SHA1
b92fed776445a657bd43555c534236a62603f333

SHA256
2d0190fd30ee623f46717b2f76b28c10570dce5382af74058534f2d5b91a8899

SHA512
d17de9f36383a4bdc40443897d45a9f5c1ea91502a93b00818de63b4f5398363ea33410ac301bd7d0f6b5697d968732b1fcfc201ee21257f27960e1f90eecdae

Download Submit
C:\Windows\System\vghCMha.exe

Filesize
1.9MB

MD5
640a3f7b1ebf34af1357bd1aa808c98f

SHA1
eff5ed1e6189a3ec44f60075939d7273c95a18d2

SHA256
28aa1e79a12e73b513dd6a6b1b570db683987a493810b6dafc4c782918c5981d

SHA512
fd2a8c23b423515eccca156aa52113575a09481b983112108a85117c0dc0e65ec203f38a4bee0223630b22dc25101890d93ec42c1dddd98fa9cfd84baa620a78

Download Submit
C:\Windows\System\xYmUTta.exe

Filesize
1.9MB

MD5
7efaeb73ebf1ff5c72c965a604a02fb8

SHA1
071c1b608cfb72b0586f9c5da29a253a9d30cca2

SHA256
3be0b995adcbefc6505b1e8cda45d9afcc96cea09ed0fac5277475262ee4fb15

SHA512
7ab5eca13cd112c97081832acda98781b434ea6727fc44552bb8a6fc6d0d51aca32d5d639a45ac67dbfa15cd76c83a56526930134a8b5f79b87c103935cf1972

Download Submit
memory/436-29-0x00007FFDD1A40000-0x00007FFDD2501000-memory.dmp

Filesize
10.8MB

Download
memory/436-109-0x0000020AC55D0000-0x0000020AC55F2000-memory.dmp

Filesize
136KB

Download
memory/436-41-0x0000020AC52A0000-0x0000020AC52B0000-memory.dmp

Filesize
64KB

Download
memory/436-42-0x0000020AC52A0000-0x0000020AC52B0000-memory.dmp

Filesize
64KB

Download
memory/440-703-0x00007FF6DADC0000-0x00007FF6DB1B2000-memory.dmp

Filesize
3.9MB

Download
memory/440-2940-0x00007FF6DADC0000-0x00007FF6DB1B2000-memory.dmp

Filesize
3.9MB

Download
memory/696-2923-0x00007FF636620000-0x00007FF636A12000-memory.dmp

Filesize
3.9MB

Download
memory/696-219-0x00007FF636620000-0x00007FF636A12000-memory.dmp

Filesize
3.9MB

Download
memory/732-2927-0x00007FF686BD0000-0x00007FF686FC2000-memory.dmp

Filesize
3.9MB

Download
memory/732-393-0x00007FF686BD0000-0x00007FF686FC2000-memory.dmp

Filesize
3.9MB

Download
memory/772-2913-0x00007FF60DF00000-0x00007FF60E2F2000-memory.dmp

Filesize
3.9MB

Download
memory/772-252-0x00007FF60DF00000-0x00007FF60E2F2000-memory.dmp

Filesize
3.9MB

Download
memory/1008-2925-0x00007FF70C5A0000-0x00007FF70C992000-memory.dmp

Filesize
3.9MB

Download
memory/1008-280-0x00007FF70C5A0000-0x00007FF70C992000-memory.dmp

Filesize
3.9MB

Download
memory/1012-0-0x00007FF6CA7D0000-0x00007FF6CABC2000-memory.dmp

Filesize
3.9MB

Download
memory/1012-1-0x0000021975AE0000-0x0000021975AF0000-memory.dmp

Filesize
64KB

Download
memory/1828-86-0x00007FF6A2B70000-0x00007FF6A2F62000-memory.dmp

Filesize
3.9MB

Download
memory/1828-2903-0x00007FF6A2B70000-0x00007FF6A2F62000-memory.dmp

Filesize
3.9MB

Download
memory/1948-2907-0x00007FF6DAD40000-0x00007FF6DB132000-memory.dmp

Filesize
3.9MB

Download
memory/1948-90-0x00007FF6DAD40000-0x00007FF6DB132000-memory.dmp

Filesize
3.9MB

Download
memory/2904-2919-0x00007FF7D6730000-0x00007FF7D6B22000-memory.dmp

Filesize
3.9MB

Download
memory/2904-346-0x00007FF7D6730000-0x00007FF7D6B22000-memory.dmp

Filesize
3.9MB

Download
memory/3232-2916-0x00007FF72C3F0000-0x00007FF72C7E2000-memory.dmp

Filesize
3.9MB

Download
memory/3232-284-0x00007FF72C3F0000-0x00007FF72C7E2000-memory.dmp

Filesize
3.9MB

Download
memory/3280-2922-0x00007FF6A1D00000-0x00007FF6A20F2000-memory.dmp

Filesize
3.9MB

Download
memory/3280-702-0x00007FF6A1D00000-0x00007FF6A20F2000-memory.dmp

Filesize
3.9MB

Download
memory/3372-46-0x00007FF6D5A50000-0x00007FF6D5E42000-memory.dmp

Filesize
3.9MB

Download
memory/3372-2899-0x00007FF6D5A50000-0x00007FF6D5E42000-memory.dmp

Filesize
3.9MB

Download
memory/3432-124-0x00007FF773600000-0x00007FF7739F2000-memory.dmp

Filesize
3.9MB

Download
memory/3432-2910-0x00007FF773600000-0x00007FF7739F2000-memory.dmp

Filesize
3.9MB

Download
memory/3448-653-0x00007FF692D30000-0x00007FF693122000-memory.dmp

Filesize
3.9MB

Download
memory/3448-2897-0x00007FF692D30000-0x00007FF693122000-memory.dmp

Filesize
3.9MB

Download
memory/3560-534-0x00007FF7E0430000-0x00007FF7E0822000-memory.dmp

Filesize
3.9MB

Download
memory/3560-2953-0x00007FF7E0430000-0x00007FF7E0822000-memory.dmp

Filesize
3.9MB

Download
memory/3672-2918-0x00007FF60F1E0000-0x00007FF60F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/3672-701-0x00007FF60F1E0000-0x00007FF60F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/3680-181-0x00007FF6A1170000-0x00007FF6A1562000-memory.dmp

Filesize
3.9MB

Download
memory/3680-2911-0x00007FF6A1170000-0x00007FF6A1562000-memory.dmp

Filesize
3.9MB

Download
memory/3940-2905-0x00007FF7DAE00000-0x00007FF7DB1F2000-memory.dmp

Filesize
3.9MB

Download
memory/3940-130-0x00007FF7DAE00000-0x00007FF7DB1F2000-memory.dmp

Filesize
3.9MB

Download
memory/3956-2929-0x00007FF7A9AF0000-0x00007FF7A9EE2000-memory.dmp

Filesize
3.9MB

Download
memory/3956-460-0x00007FF7A9AF0000-0x00007FF7A9EE2000-memory.dmp

Filesize
3.9MB

Download
memory/4296-2942-0x00007FF7175E0000-0x00007FF7179D2000-memory.dmp

Filesize
3.9MB

Download
memory/4296-540-0x00007FF7175E0000-0x00007FF7179D2000-memory.dmp

Filesize
3.9MB

Download
memory/4652-65-0x00007FF685430000-0x00007FF685822000-memory.dmp

Filesize
3.9MB

Download
memory/4652-2901-0x00007FF685430000-0x00007FF685822000-memory.dmp

Filesize
3.9MB

Download
memory/5080-2943-0x00007FF7434F0000-0x00007FF7438E2000-memory.dmp

Filesize
3.9MB

Download
memory/5080-463-0x00007FF7434F0000-0x00007FF7438E2000-memory.dmp

Filesize
3.9MB

Download