xmrig | d4a1281dddb7b263c395e83e949f3d56c5a91c24ef33f4862413f35941f113d2

Analysis

max time kernel
69s
max time network
44s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 13:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
Size

1.8MB
MD5

07c8b79433320039a2c5ec74581e6e75
SHA1

d18f0139eb37d64ee55e1c254401f685219e5a2f
SHA256

d4a1281dddb7b263c395e83e949f3d56c5a91c24ef33f4862413f35941f113d2
SHA512

1c5113eb2f6bc1b45fca2841d05f403b14547688a149085f279069acfc5d33f860267c842b8a74eb1b87877cb27f0a6a6051b4a8ea77ae058290741d0404ec5f
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDr6:NAB7

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 46 IoCs

miner

resource	yara_rule
behavioral2/memory/2640-58-0x00007FF723410000-0x00007FF723802000-memory.dmp	xmrig
behavioral2/memory/3680-67-0x00007FF77B100000-0x00007FF77B4F2000-memory.dmp	xmrig
behavioral2/memory/4320-72-0x00007FF6C2D40000-0x00007FF6C3132000-memory.dmp	xmrig
behavioral2/memory/4296-73-0x00007FF6B13D0000-0x00007FF6B17C2000-memory.dmp	xmrig
behavioral2/memory/4824-70-0x00007FF60C7E0000-0x00007FF60CBD2000-memory.dmp	xmrig
behavioral2/memory/2068-69-0x00007FF6ECDA0000-0x00007FF6ED192000-memory.dmp	xmrig
behavioral2/memory/2376-52-0x00007FF74E420000-0x00007FF74E812000-memory.dmp	xmrig
behavioral2/memory/3540-28-0x00007FF69F8A0000-0x00007FF69FC92000-memory.dmp	xmrig
behavioral2/memory/4748-97-0x00007FF7162B0000-0x00007FF7166A2000-memory.dmp	xmrig
behavioral2/memory/8-107-0x00007FF7861B0000-0x00007FF7865A2000-memory.dmp	xmrig
behavioral2/memory/5072-138-0x00007FF69DE50000-0x00007FF69E242000-memory.dmp	xmrig
behavioral2/memory/4880-139-0x00007FF7C9F50000-0x00007FF7CA342000-memory.dmp	xmrig
behavioral2/memory/4400-145-0x00007FF6A3370000-0x00007FF6A3762000-memory.dmp	xmrig
behavioral2/memory/3112-144-0x00007FF78F240000-0x00007FF78F632000-memory.dmp	xmrig
behavioral2/memory/3744-140-0x00007FF601360000-0x00007FF601752000-memory.dmp	xmrig
behavioral2/memory/1416-123-0x00007FF669EE0000-0x00007FF66A2D2000-memory.dmp	xmrig
behavioral2/memory/3248-119-0x00007FF70F0E0000-0x00007FF70F4D2000-memory.dmp	xmrig
behavioral2/memory/748-114-0x00007FF628A80000-0x00007FF628E72000-memory.dmp	xmrig
behavioral2/memory/3540-1004-0x00007FF69F8A0000-0x00007FF69FC92000-memory.dmp	xmrig
behavioral2/memory/3680-1594-0x00007FF77B100000-0x00007FF77B4F2000-memory.dmp	xmrig
behavioral2/memory/3116-2477-0x00007FF667F10000-0x00007FF668302000-memory.dmp	xmrig
behavioral2/memory/1612-2490-0x00007FF700570000-0x00007FF700962000-memory.dmp	xmrig
behavioral2/memory/3248-2491-0x00007FF70F0E0000-0x00007FF70F4D2000-memory.dmp	xmrig
behavioral2/memory/4960-2492-0x00007FF7990B0000-0x00007FF7994A2000-memory.dmp	xmrig
behavioral2/memory/5072-2512-0x00007FF69DE50000-0x00007FF69E242000-memory.dmp	xmrig
behavioral2/memory/3112-2514-0x00007FF78F240000-0x00007FF78F632000-memory.dmp	xmrig
behavioral2/memory/3540-2518-0x00007FF69F8A0000-0x00007FF69FC92000-memory.dmp	xmrig
behavioral2/memory/4400-2517-0x00007FF6A3370000-0x00007FF6A3762000-memory.dmp	xmrig
behavioral2/memory/2068-2522-0x00007FF6ECDA0000-0x00007FF6ED192000-memory.dmp	xmrig
behavioral2/memory/2376-2521-0x00007FF74E420000-0x00007FF74E812000-memory.dmp	xmrig
behavioral2/memory/3680-2528-0x00007FF77B100000-0x00007FF77B4F2000-memory.dmp	xmrig
behavioral2/memory/4320-2532-0x00007FF6C2D40000-0x00007FF6C3132000-memory.dmp	xmrig
behavioral2/memory/4296-2530-0x00007FF6B13D0000-0x00007FF6B17C2000-memory.dmp	xmrig
behavioral2/memory/4824-2527-0x00007FF60C7E0000-0x00007FF60CBD2000-memory.dmp	xmrig
behavioral2/memory/2640-2525-0x00007FF723410000-0x00007FF723802000-memory.dmp	xmrig
behavioral2/memory/3116-2534-0x00007FF667F10000-0x00007FF668302000-memory.dmp	xmrig
behavioral2/memory/4528-2547-0x00007FF6870B0000-0x00007FF6874A2000-memory.dmp	xmrig
behavioral2/memory/4748-2561-0x00007FF7162B0000-0x00007FF7166A2000-memory.dmp	xmrig
behavioral2/memory/8-2563-0x00007FF7861B0000-0x00007FF7865A2000-memory.dmp	xmrig
behavioral2/memory/1612-2565-0x00007FF700570000-0x00007FF700962000-memory.dmp	xmrig
behavioral2/memory/3248-2568-0x00007FF70F0E0000-0x00007FF70F4D2000-memory.dmp	xmrig
behavioral2/memory/1416-2569-0x00007FF669EE0000-0x00007FF66A2D2000-memory.dmp	xmrig
behavioral2/memory/4880-2571-0x00007FF7C9F50000-0x00007FF7CA342000-memory.dmp	xmrig
behavioral2/memory/4960-2573-0x00007FF7990B0000-0x00007FF7994A2000-memory.dmp	xmrig
behavioral2/memory/3744-2575-0x00007FF601360000-0x00007FF601752000-memory.dmp	xmrig
behavioral2/memory/4528-2577-0x00007FF6870B0000-0x00007FF6874A2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
5072	XPfamME.exe
3112	nyMpigm.exe
4400	ifcSdvW.exe
3540	WAVyvPR.exe
2068	OLZfqBE.exe
2376	kvmsqLI.exe
2640	OcrzuEh.exe
3680	WoETOoo.exe
4824	eRmclKo.exe
4320	bEHLiKX.exe
4296	codLqZr.exe
3116	DCmXcEO.exe
4748	UntjJqu.exe
1612	eprifxp.exe
8	ZRchZui.exe
3248	gfUVMrN.exe
1416	FhZTvsk.exe
4880	dHzFPBa.exe
4960	LSnelXO.exe
4528	yOtwZDV.exe
3744	ZoLbHUh.exe
3032	dLpFiVI.exe
5028	AYqWOdq.exe
4752	uoWYKfr.exe
888	fYDnEFf.exe
3568	AhxaKvj.exe
5092	CTxwNqY.exe
924	wmGrgoS.exe
3416	DUQvoyU.exe
4512	RfGgkNI.exe
4040	aTMgLwY.exe
4516	lqdKofJ.exe
2508	DaPYlFf.exe
2900	IQpaXus.exe
2540	GLECqit.exe
3736	DOJOipT.exe
4408	ZABrFkC.exe
3908	ZPpFKBp.exe
4600	CKDOSgH.exe
2240	VQuwxrj.exe
4604	OtTXNOL.exe
3244	KuYgdkn.exe
1448	mJfRIMN.exe
2808	LGOudTH.exe
2428	gHkEycs.exe
4648	cmJMync.exe
2564	OXzfQkC.exe
4668	VgKCRcX.exe
2280	hpKZiMO.exe
2536	zlMMdPD.exe
3020	wcCqzer.exe
1436	IaOnlHx.exe
2768	dJMhnef.exe
3520	BfuXGng.exe
2140	vfqxEmf.exe
4176	MoETJqH.exe
4064	YAmJBAa.exe
4144	nVKDJEt.exe
2704	gqbRlKc.exe
4632	kGfRZRa.exe
5116	fArBlEv.exe
628	YmkbtvR.exe
3512	sCFKCmY.exe
4192	EXQzfDr.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/748-0-0x00007FF628A80000-0x00007FF628E72000-memory.dmp	upx
behavioral2/files/0x000b000000023b7b-5.dat	upx
behavioral2/memory/5072-6-0x00007FF69DE50000-0x00007FF69E242000-memory.dmp	upx
behavioral2/files/0x000a000000023b7f-11.dat	upx
behavioral2/memory/4400-23-0x00007FF6A3370000-0x00007FF6A3762000-memory.dmp	upx
behavioral2/files/0x000a000000023b82-32.dat	upx
behavioral2/files/0x000a000000023b83-38.dat	upx
behavioral2/files/0x000a000000023b85-42.dat	upx
behavioral2/files/0x000a000000023b84-48.dat	upx
behavioral2/memory/2640-58-0x00007FF723410000-0x00007FF723802000-memory.dmp	upx
behavioral2/memory/3680-67-0x00007FF77B100000-0x00007FF77B4F2000-memory.dmp	upx
behavioral2/memory/4320-72-0x00007FF6C2D40000-0x00007FF6C3132000-memory.dmp	upx
behavioral2/files/0x000a000000023b89-74.dat	upx
behavioral2/memory/3116-76-0x00007FF667F10000-0x00007FF668302000-memory.dmp	upx
behavioral2/memory/4296-73-0x00007FF6B13D0000-0x00007FF6B17C2000-memory.dmp	upx
behavioral2/memory/4824-70-0x00007FF60C7E0000-0x00007FF60CBD2000-memory.dmp	upx
behavioral2/memory/2068-69-0x00007FF6ECDA0000-0x00007FF6ED192000-memory.dmp	upx
behavioral2/files/0x000a000000023b87-64.dat	upx
behavioral2/files/0x000a000000023b88-63.dat	upx
behavioral2/memory/2376-52-0x00007FF74E420000-0x00007FF74E812000-memory.dmp	upx
behavioral2/files/0x000a000000023b86-59.dat	upx
behavioral2/memory/3540-28-0x00007FF69F8A0000-0x00007FF69FC92000-memory.dmp	upx
behavioral2/files/0x000a000000023b80-22.dat	upx
behavioral2/files/0x000a000000023b81-21.dat	upx
behavioral2/memory/3112-12-0x00007FF78F240000-0x00007FF78F632000-memory.dmp	upx
behavioral2/files/0x000a000000023b8a-90.dat	upx
behavioral2/files/0x000b000000023b8b-99.dat	upx
behavioral2/files/0x000c000000023b7c-98.dat	upx
behavioral2/memory/4748-97-0x00007FF7162B0000-0x00007FF7166A2000-memory.dmp	upx
behavioral2/memory/8-107-0x00007FF7861B0000-0x00007FF7865A2000-memory.dmp	upx
behavioral2/files/0x000a000000023b8c-109.dat	upx
behavioral2/files/0x000a000000023b8d-113.dat	upx
behavioral2/files/0x000a000000023b90-126.dat	upx
behavioral2/files/0x000a000000023b8f-130.dat	upx
behavioral2/files/0x000a000000023b91-133.dat	upx
behavioral2/memory/5072-138-0x00007FF69DE50000-0x00007FF69E242000-memory.dmp	upx
behavioral2/memory/4880-139-0x00007FF7C9F50000-0x00007FF7CA342000-memory.dmp	upx
behavioral2/memory/4400-145-0x00007FF6A3370000-0x00007FF6A3762000-memory.dmp	upx
behavioral2/memory/3112-144-0x00007FF78F240000-0x00007FF78F632000-memory.dmp	upx
behavioral2/memory/4528-143-0x00007FF6870B0000-0x00007FF6874A2000-memory.dmp	upx
behavioral2/memory/3744-140-0x00007FF601360000-0x00007FF601752000-memory.dmp	upx
behavioral2/memory/4960-128-0x00007FF7990B0000-0x00007FF7994A2000-memory.dmp	upx
behavioral2/files/0x000a000000023b8e-127.dat	upx
behavioral2/memory/1416-123-0x00007FF669EE0000-0x00007FF66A2D2000-memory.dmp	upx
behavioral2/memory/3248-119-0x00007FF70F0E0000-0x00007FF70F4D2000-memory.dmp	upx
behavioral2/memory/748-114-0x00007FF628A80000-0x00007FF628E72000-memory.dmp	upx
behavioral2/memory/1612-105-0x00007FF700570000-0x00007FF700962000-memory.dmp	upx
behavioral2/files/0x000a000000023b92-148.dat	upx
behavioral2/files/0x000a000000023b93-152.dat	upx
behavioral2/files/0x000a000000023b94-158.dat	upx
behavioral2/files/0x000a000000023b95-162.dat	upx
behavioral2/files/0x000a000000023b96-168.dat	upx
behavioral2/files/0x000a000000023b97-173.dat	upx
behavioral2/files/0x000a000000023b99-180.dat	upx
behavioral2/files/0x000a000000023b9a-183.dat	upx
behavioral2/files/0x000a000000023b9d-192.dat	upx
behavioral2/files/0x000a000000023b9f-198.dat	upx
behavioral2/files/0x000a000000023ba1-203.dat	upx
behavioral2/files/0x000a000000023ba0-201.dat	upx
behavioral2/files/0x000a000000023b9e-195.dat	upx
behavioral2/files/0x000a000000023b9c-189.dat	upx
behavioral2/files/0x000a000000023b9b-186.dat	upx
behavioral2/files/0x000a000000023b98-177.dat	upx
behavioral2/memory/3540-1004-0x00007FF69F8A0000-0x00007FF69FC92000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\IaOnlHx.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\vWwJDpM.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\otuDKwI.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\EiIdalQ.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\JVORWYi.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\IMiNqDB.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\yCsouQf.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\wYiOXle.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\igXOUUe.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\vYXVOGW.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\KLPwSyG.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\xMjrHaI.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\jFzSZPx.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\BfcZJOo.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\SshfQAT.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\byuSguQ.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\fxuJxvb.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\xfYWufI.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\lSHdsHk.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\Rtgbxlw.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\vamrkIC.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\MtGjnmD.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\oFMZKvR.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\GpDiTaA.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\vkTxjJD.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\NvUIfPt.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\yXhNnYw.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\tuuoIlo.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\VAljkQf.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\KLzZXSv.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\xklHlCV.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\qTIhHBJ.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\PLNjZaf.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\ARdnVRb.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\GrMlezR.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\OtTXNOL.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\byVvLJV.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\RdfLaJe.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\HjWjsNf.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\PNuQoxV.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\JqbAFNl.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\XKQhAZb.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\jTlIDyG.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\sgPgRRp.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\GaZFXQQ.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\dtlOEIS.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\MSUKuZB.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\JAKxbgh.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\hoadKNz.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\QcvIQfq.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\FomcXNj.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\AeOuDJN.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\inUkAYP.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\nuxFAbS.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\LMTJGZC.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\mGzvYlB.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\yVinIGj.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\pJScPcE.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\pVIQjqO.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\mETTYjv.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\VOCCTlA.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\QarGKkJ.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\ZPgRRPF.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
File created	C:\Windows\System\HVDGRuI.exe	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2072	powershell.exe
2072	powershell.exe
2072	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
Token: SeDebugPrivilege	2072	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 2072	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	86
PID 748 wrote to memory of 2072	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	86
PID 748 wrote to memory of 5072	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	87
PID 748 wrote to memory of 5072	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	87
PID 748 wrote to memory of 3112	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	88
PID 748 wrote to memory of 3112	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	88
PID 748 wrote to memory of 4400	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	89
PID 748 wrote to memory of 4400	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	89
PID 748 wrote to memory of 3540	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	90
PID 748 wrote to memory of 3540	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	90
PID 748 wrote to memory of 2068	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	91
PID 748 wrote to memory of 2068	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	91
PID 748 wrote to memory of 2376	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	92
PID 748 wrote to memory of 2376	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	92
PID 748 wrote to memory of 2640	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	93
PID 748 wrote to memory of 2640	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	93
PID 748 wrote to memory of 3680	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	94
PID 748 wrote to memory of 3680	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	94
PID 748 wrote to memory of 4824	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	95
PID 748 wrote to memory of 4824	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	95
PID 748 wrote to memory of 4320	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	96
PID 748 wrote to memory of 4320	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	96
PID 748 wrote to memory of 4296	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	97
PID 748 wrote to memory of 4296	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	97
PID 748 wrote to memory of 3116	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	98
PID 748 wrote to memory of 3116	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	98
PID 748 wrote to memory of 4748	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	99
PID 748 wrote to memory of 4748	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	99
PID 748 wrote to memory of 1612	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	100
PID 748 wrote to memory of 1612	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	100
PID 748 wrote to memory of 8	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	101
PID 748 wrote to memory of 8	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	101
PID 748 wrote to memory of 3248	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	102
PID 748 wrote to memory of 3248	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	102
PID 748 wrote to memory of 1416	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	103
PID 748 wrote to memory of 1416	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	103
PID 748 wrote to memory of 4880	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	104
PID 748 wrote to memory of 4880	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	104
PID 748 wrote to memory of 4528	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	105
PID 748 wrote to memory of 4528	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	105
PID 748 wrote to memory of 4960	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	106
PID 748 wrote to memory of 4960	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	106
PID 748 wrote to memory of 3744	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	107
PID 748 wrote to memory of 3744	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	107
PID 748 wrote to memory of 3032	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	108
PID 748 wrote to memory of 3032	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	108
PID 748 wrote to memory of 5028	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	109
PID 748 wrote to memory of 5028	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	109
PID 748 wrote to memory of 4752	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	110
PID 748 wrote to memory of 4752	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	110
PID 748 wrote to memory of 888	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	111
PID 748 wrote to memory of 888	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	111
PID 748 wrote to memory of 3568	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	112
PID 748 wrote to memory of 3568	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	112
PID 748 wrote to memory of 5092	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	113
PID 748 wrote to memory of 5092	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	113
PID 748 wrote to memory of 924	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	114
PID 748 wrote to memory of 924	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	114
PID 748 wrote to memory of 3416	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	115
PID 748 wrote to memory of 3416	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	115
PID 748 wrote to memory of 4512	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	116
PID 748 wrote to memory of 4512	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	116
PID 748 wrote to memory of 4040	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	117
PID 748 wrote to memory of 4040	748	07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe	117

C:\Users\Admin\AppData\Local\Temp\07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\07c8b79433320039a2c5ec74581e6e75_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2072
- C:\Windows\System\XPfamME.exe
  C:\Windows\System\XPfamME.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\nyMpigm.exe
  C:\Windows\System\nyMpigm.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\ifcSdvW.exe
  C:\Windows\System\ifcSdvW.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\WAVyvPR.exe
  C:\Windows\System\WAVyvPR.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\OLZfqBE.exe
  C:\Windows\System\OLZfqBE.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\kvmsqLI.exe
  C:\Windows\System\kvmsqLI.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\OcrzuEh.exe
  C:\Windows\System\OcrzuEh.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\WoETOoo.exe
  C:\Windows\System\WoETOoo.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System\eRmclKo.exe
  C:\Windows\System\eRmclKo.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\bEHLiKX.exe
  C:\Windows\System\bEHLiKX.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\codLqZr.exe
  C:\Windows\System\codLqZr.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\DCmXcEO.exe
  C:\Windows\System\DCmXcEO.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\UntjJqu.exe
  C:\Windows\System\UntjJqu.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\eprifxp.exe
  C:\Windows\System\eprifxp.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\ZRchZui.exe
  C:\Windows\System\ZRchZui.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\gfUVMrN.exe
  C:\Windows\System\gfUVMrN.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\FhZTvsk.exe
  C:\Windows\System\FhZTvsk.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\dHzFPBa.exe
  C:\Windows\System\dHzFPBa.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\yOtwZDV.exe
  C:\Windows\System\yOtwZDV.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\LSnelXO.exe
  C:\Windows\System\LSnelXO.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\ZoLbHUh.exe
  C:\Windows\System\ZoLbHUh.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\dLpFiVI.exe
  C:\Windows\System\dLpFiVI.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\AYqWOdq.exe
  C:\Windows\System\AYqWOdq.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\uoWYKfr.exe
  C:\Windows\System\uoWYKfr.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\fYDnEFf.exe
  C:\Windows\System\fYDnEFf.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\AhxaKvj.exe
  C:\Windows\System\AhxaKvj.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\CTxwNqY.exe
  C:\Windows\System\CTxwNqY.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\wmGrgoS.exe
  C:\Windows\System\wmGrgoS.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\DUQvoyU.exe
  C:\Windows\System\DUQvoyU.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\RfGgkNI.exe
  C:\Windows\System\RfGgkNI.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\aTMgLwY.exe
  C:\Windows\System\aTMgLwY.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\lqdKofJ.exe
  C:\Windows\System\lqdKofJ.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\DaPYlFf.exe
  C:\Windows\System\DaPYlFf.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\IQpaXus.exe
  C:\Windows\System\IQpaXus.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\GLECqit.exe
  C:\Windows\System\GLECqit.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\DOJOipT.exe
  C:\Windows\System\DOJOipT.exe
  2⤵
  - Executes dropped EXE
  PID:3736
- C:\Windows\System\ZABrFkC.exe
  C:\Windows\System\ZABrFkC.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\ZPpFKBp.exe
  C:\Windows\System\ZPpFKBp.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\CKDOSgH.exe
  C:\Windows\System\CKDOSgH.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\VQuwxrj.exe
  C:\Windows\System\VQuwxrj.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\OtTXNOL.exe
  C:\Windows\System\OtTXNOL.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\KuYgdkn.exe
  C:\Windows\System\KuYgdkn.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\mJfRIMN.exe
  C:\Windows\System\mJfRIMN.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\LGOudTH.exe
  C:\Windows\System\LGOudTH.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\gHkEycs.exe
  C:\Windows\System\gHkEycs.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\cmJMync.exe
  C:\Windows\System\cmJMync.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\OXzfQkC.exe
  C:\Windows\System\OXzfQkC.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\VgKCRcX.exe
  C:\Windows\System\VgKCRcX.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\hpKZiMO.exe
  C:\Windows\System\hpKZiMO.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\zlMMdPD.exe
  C:\Windows\System\zlMMdPD.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\wcCqzer.exe
  C:\Windows\System\wcCqzer.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\IaOnlHx.exe
  C:\Windows\System\IaOnlHx.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\dJMhnef.exe
  C:\Windows\System\dJMhnef.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\BfuXGng.exe
  C:\Windows\System\BfuXGng.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\vfqxEmf.exe
  C:\Windows\System\vfqxEmf.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\MoETJqH.exe
  C:\Windows\System\MoETJqH.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\YAmJBAa.exe
  C:\Windows\System\YAmJBAa.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\nVKDJEt.exe
  C:\Windows\System\nVKDJEt.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\gqbRlKc.exe
  C:\Windows\System\gqbRlKc.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\kGfRZRa.exe
  C:\Windows\System\kGfRZRa.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\fArBlEv.exe
  C:\Windows\System\fArBlEv.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\YmkbtvR.exe
  C:\Windows\System\YmkbtvR.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\sCFKCmY.exe
  C:\Windows\System\sCFKCmY.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\EXQzfDr.exe
  C:\Windows\System\EXQzfDr.exe
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Windows\System\AHHjZKS.exe
  C:\Windows\System\AHHjZKS.exe
  2⤵
  PID:2500
- C:\Windows\System\HkabSRk.exe
  C:\Windows\System\HkabSRk.exe
  2⤵
  PID:744
- C:\Windows\System\wRkhlHp.exe
  C:\Windows\System\wRkhlHp.exe
  2⤵
  PID:4332
- C:\Windows\System\sWmeaUu.exe
  C:\Windows\System\sWmeaUu.exe
  2⤵
  PID:1632
- C:\Windows\System\nZxzBKQ.exe
  C:\Windows\System\nZxzBKQ.exe
  2⤵
  PID:4608
- C:\Windows\System\yywsPkG.exe
  C:\Windows\System\yywsPkG.exe
  2⤵
  PID:2876
- C:\Windows\System\OBzUxkI.exe
  C:\Windows\System\OBzUxkI.exe
  2⤵
  PID:2584
- C:\Windows\System\nGjvLsw.exe
  C:\Windows\System\nGjvLsw.exe
  2⤵
  PID:2228
- C:\Windows\System\faZEPgv.exe
  C:\Windows\System\faZEPgv.exe
  2⤵
  PID:1836
- C:\Windows\System\qHytJXt.exe
  C:\Windows\System\qHytJXt.exe
  2⤵
  PID:3684
- C:\Windows\System\XKQhAZb.exe
  C:\Windows\System\XKQhAZb.exe
  2⤵
  PID:4004
- C:\Windows\System\ChkiZiO.exe
  C:\Windows\System\ChkiZiO.exe
  2⤵
  PID:2504
- C:\Windows\System\VxLVghW.exe
  C:\Windows\System\VxLVghW.exe
  2⤵
  PID:2736
- C:\Windows\System\WAYoHeU.exe
  C:\Windows\System\WAYoHeU.exe
  2⤵
  PID:1752
- C:\Windows\System\GxlHuBt.exe
  C:\Windows\System\GxlHuBt.exe
  2⤵
  PID:1068
- C:\Windows\System\sjtvpKA.exe
  C:\Windows\System\sjtvpKA.exe
  2⤵
  PID:2748
- C:\Windows\System\MNprgbT.exe
  C:\Windows\System\MNprgbT.exe
  2⤵
  PID:3336
- C:\Windows\System\PaGIZvy.exe
  C:\Windows\System\PaGIZvy.exe
  2⤵
  PID:384
- C:\Windows\System\cVxRpyg.exe
  C:\Windows\System\cVxRpyg.exe
  2⤵
  PID:3292
- C:\Windows\System\UeKHMlq.exe
  C:\Windows\System\UeKHMlq.exe
  2⤵
  PID:4036
- C:\Windows\System\PQvrvlW.exe
  C:\Windows\System\PQvrvlW.exe
  2⤵
  PID:5132
- C:\Windows\System\UdcgNcH.exe
  C:\Windows\System\UdcgNcH.exe
  2⤵
  PID:5148
- C:\Windows\System\PWrCYwk.exe
  C:\Windows\System\PWrCYwk.exe
  2⤵
  PID:5164
- C:\Windows\System\gYLRhww.exe
  C:\Windows\System\gYLRhww.exe
  2⤵
  PID:5180
- C:\Windows\System\zusCBzA.exe
  C:\Windows\System\zusCBzA.exe
  2⤵
  PID:5196
- C:\Windows\System\OeqiZzr.exe
  C:\Windows\System\OeqiZzr.exe
  2⤵
  PID:5212
- C:\Windows\System\covbqDm.exe
  C:\Windows\System\covbqDm.exe
  2⤵
  PID:5228
- C:\Windows\System\NaZdDNE.exe
  C:\Windows\System\NaZdDNE.exe
  2⤵
  PID:5244
- C:\Windows\System\qoIKFvm.exe
  C:\Windows\System\qoIKFvm.exe
  2⤵
  PID:5260
- C:\Windows\System\HbxxSZp.exe
  C:\Windows\System\HbxxSZp.exe
  2⤵
  PID:5276
- C:\Windows\System\tLiEuxY.exe
  C:\Windows\System\tLiEuxY.exe
  2⤵
  PID:5292
- C:\Windows\System\efybmNZ.exe
  C:\Windows\System\efybmNZ.exe
  2⤵
  PID:5308
- C:\Windows\System\qHKcVtp.exe
  C:\Windows\System\qHKcVtp.exe
  2⤵
  PID:5324
- C:\Windows\System\ionHGfk.exe
  C:\Windows\System\ionHGfk.exe
  2⤵
  PID:5340
- C:\Windows\System\OnhrhZZ.exe
  C:\Windows\System\OnhrhZZ.exe
  2⤵
  PID:5356
- C:\Windows\System\mpaQrhB.exe
  C:\Windows\System\mpaQrhB.exe
  2⤵
  PID:5372
- C:\Windows\System\lzsAJat.exe
  C:\Windows\System\lzsAJat.exe
  2⤵
  PID:5388
- C:\Windows\System\nbrcgIk.exe
  C:\Windows\System\nbrcgIk.exe
  2⤵
  PID:5404
- C:\Windows\System\BSgjRkd.exe
  C:\Windows\System\BSgjRkd.exe
  2⤵
  PID:5420
- C:\Windows\System\AEDPYvo.exe
  C:\Windows\System\AEDPYvo.exe
  2⤵
  PID:5436
- C:\Windows\System\iiwYadk.exe
  C:\Windows\System\iiwYadk.exe
  2⤵
  PID:5452
- C:\Windows\System\Nxlfdrw.exe
  C:\Windows\System\Nxlfdrw.exe
  2⤵
  PID:5468
- C:\Windows\System\BERIjNk.exe
  C:\Windows\System\BERIjNk.exe
  2⤵
  PID:5492
- C:\Windows\System\QlpNVSB.exe
  C:\Windows\System\QlpNVSB.exe
  2⤵
  PID:5516
- C:\Windows\System\qLiaYLy.exe
  C:\Windows\System\qLiaYLy.exe
  2⤵
  PID:5540
- C:\Windows\System\ndvixQx.exe
  C:\Windows\System\ndvixQx.exe
  2⤵
  PID:5568
- C:\Windows\System\kdIDyRR.exe
  C:\Windows\System\kdIDyRR.exe
  2⤵
  PID:5272
- C:\Windows\System\NBZkywS.exe
  C:\Windows\System\NBZkywS.exe
  2⤵
  PID:5140
- C:\Windows\System\dKqnsix.exe
  C:\Windows\System\dKqnsix.exe
  2⤵
  PID:1468
- C:\Windows\System\yDTRllo.exe
  C:\Windows\System\yDTRllo.exe
  2⤵
  PID:532
- C:\Windows\System\QVqOXsT.exe
  C:\Windows\System\QVqOXsT.exe
  2⤵
  PID:5048
- C:\Windows\System\vKhOWLd.exe
  C:\Windows\System\vKhOWLd.exe
  2⤵
  PID:2220
- C:\Windows\System\fxPpUYT.exe
  C:\Windows\System\fxPpUYT.exe
  2⤵
  PID:4424
- C:\Windows\System\BrwfCJN.exe
  C:\Windows\System\BrwfCJN.exe
  2⤵
  PID:3984
- C:\Windows\System\gUFFudr.exe
  C:\Windows\System\gUFFudr.exe
  2⤵
  PID:2192
- C:\Windows\System\hGSjTvC.exe
  C:\Windows\System\hGSjTvC.exe
  2⤵
  PID:5040
- C:\Windows\System\yWYgpyB.exe
  C:\Windows\System\yWYgpyB.exe
  2⤵
  PID:5460
- C:\Windows\System\FzFEpcx.exe
  C:\Windows\System\FzFEpcx.exe
  2⤵
  PID:5564
- C:\Windows\System\GJXinlW.exe
  C:\Windows\System\GJXinlW.exe
  2⤵
  PID:5700
- C:\Windows\System\MNsnofL.exe
  C:\Windows\System\MNsnofL.exe
  2⤵
  PID:5508
- C:\Windows\System\TCaDlXb.exe
  C:\Windows\System\TCaDlXb.exe
  2⤵
  PID:6080
- C:\Windows\System\dVckvEh.exe
  C:\Windows\System\dVckvEh.exe
  2⤵
  PID:5612
- C:\Windows\System\PkaAumQ.exe
  C:\Windows\System\PkaAumQ.exe
  2⤵
  PID:5652
- C:\Windows\System\EpPVCrK.exe
  C:\Windows\System\EpPVCrK.exe
  2⤵
  PID:5740
- C:\Windows\System\YiNZjpE.exe
  C:\Windows\System\YiNZjpE.exe
  2⤵
  PID:5772
- C:\Windows\System\KmkHPBg.exe
  C:\Windows\System\KmkHPBg.exe
  2⤵
  PID:5124
- C:\Windows\System\SAalTiC.exe
  C:\Windows\System\SAalTiC.exe
  2⤵
  PID:5844
- C:\Windows\System\oOxDlLU.exe
  C:\Windows\System\oOxDlLU.exe
  2⤵
  PID:5892
- C:\Windows\System\DZCJZKr.exe
  C:\Windows\System\DZCJZKr.exe
  2⤵
  PID:5932
- C:\Windows\System\FvNMXKC.exe
  C:\Windows\System\FvNMXKC.exe
  2⤵
  PID:6012
- C:\Windows\System\nlNWAld.exe
  C:\Windows\System\nlNWAld.exe
  2⤵
  PID:6136
- C:\Windows\System\zFshJIn.exe
  C:\Windows\System\zFshJIn.exe
  2⤵
  PID:1216
- C:\Windows\System\yWfFsUi.exe
  C:\Windows\System\yWfFsUi.exe
  2⤵
  PID:1556
- C:\Windows\System\RGehqTd.exe
  C:\Windows\System\RGehqTd.exe
  2⤵
  PID:4172
- C:\Windows\System\yKQFXIZ.exe
  C:\Windows\System\yKQFXIZ.exe
  2⤵
  PID:3768
- C:\Windows\System\WisVpln.exe
  C:\Windows\System\WisVpln.exe
  2⤵
  PID:3900
- C:\Windows\System\JXtGtYV.exe
  C:\Windows\System\JXtGtYV.exe
  2⤵
  PID:6072
- C:\Windows\System\gOHCKMM.exe
  C:\Windows\System\gOHCKMM.exe
  2⤵
  PID:5644
- C:\Windows\System\JRgtSkU.exe
  C:\Windows\System\JRgtSkU.exe
  2⤵
  PID:3572
- C:\Windows\System\rteLnTR.exe
  C:\Windows\System\rteLnTR.exe
  2⤵
  PID:5868
- C:\Windows\System\oXYqLQC.exe
  C:\Windows\System\oXYqLQC.exe
  2⤵
  PID:5628
- C:\Windows\System\knCAFAo.exe
  C:\Windows\System\knCAFAo.exe
  2⤵
  PID:6024
- C:\Windows\System\yIJscIB.exe
  C:\Windows\System\yIJscIB.exe
  2⤵
  PID:1240
- C:\Windows\System\HQhorUK.exe
  C:\Windows\System\HQhorUK.exe
  2⤵
  PID:5684
- C:\Windows\System\YAsRcdF.exe
  C:\Windows\System\YAsRcdF.exe
  2⤵
  PID:5756
- C:\Windows\System\VOCCTlA.exe
  C:\Windows\System\VOCCTlA.exe
  2⤵
  PID:5604
- C:\Windows\System\PzMqmIL.exe
  C:\Windows\System\PzMqmIL.exe
  2⤵
  PID:5860
- C:\Windows\System\Oedkaxp.exe
  C:\Windows\System\Oedkaxp.exe
  2⤵
  PID:5220
- C:\Windows\System\cTHaaWW.exe
  C:\Windows\System\cTHaaWW.exe
  2⤵
  PID:6160
- C:\Windows\System\QNEYFFS.exe
  C:\Windows\System\QNEYFFS.exe
  2⤵
  PID:6184
- C:\Windows\System\CnBRBQP.exe
  C:\Windows\System\CnBRBQP.exe
  2⤵
  PID:6212
- C:\Windows\System\YgHbWLe.exe
  C:\Windows\System\YgHbWLe.exe
  2⤵
  PID:6228
- C:\Windows\System\wAfDMia.exe
  C:\Windows\System\wAfDMia.exe
  2⤵
  PID:6248
- C:\Windows\System\DJhGcHb.exe
  C:\Windows\System\DJhGcHb.exe
  2⤵
  PID:6268
- C:\Windows\System\iXCkMnV.exe
  C:\Windows\System\iXCkMnV.exe
  2⤵
  PID:6308
- C:\Windows\System\SGcCFib.exe
  C:\Windows\System\SGcCFib.exe
  2⤵
  PID:6332
- C:\Windows\System\yjMbFqb.exe
  C:\Windows\System\yjMbFqb.exe
  2⤵
  PID:6352
- C:\Windows\System\fhCONTC.exe
  C:\Windows\System\fhCONTC.exe
  2⤵
  PID:6412
- C:\Windows\System\GtDSOgo.exe
  C:\Windows\System\GtDSOgo.exe
  2⤵
  PID:6436
- C:\Windows\System\qvInoGn.exe
  C:\Windows\System\qvInoGn.exe
  2⤵
  PID:6452
- C:\Windows\System\pfLUKIk.exe
  C:\Windows\System\pfLUKIk.exe
  2⤵
  PID:6480
- C:\Windows\System\YifafBc.exe
  C:\Windows\System\YifafBc.exe
  2⤵
  PID:6500
- C:\Windows\System\BKsQbVM.exe
  C:\Windows\System\BKsQbVM.exe
  2⤵
  PID:6544
- C:\Windows\System\WSHBCfs.exe
  C:\Windows\System\WSHBCfs.exe
  2⤵
  PID:6564
- C:\Windows\System\vquUYtK.exe
  C:\Windows\System\vquUYtK.exe
  2⤵
  PID:6648
- C:\Windows\System\fFTgnhY.exe
  C:\Windows\System\fFTgnhY.exe
  2⤵
  PID:6700
- C:\Windows\System\wsPgnpO.exe
  C:\Windows\System\wsPgnpO.exe
  2⤵
  PID:6720
- C:\Windows\System\keCMVlc.exe
  C:\Windows\System\keCMVlc.exe
  2⤵
  PID:6748
- C:\Windows\System\hYJpLRK.exe
  C:\Windows\System\hYJpLRK.exe
  2⤵
  PID:6768
- C:\Windows\System\TyLwAKf.exe
  C:\Windows\System\TyLwAKf.exe
  2⤵
  PID:6792
- C:\Windows\System\cCmLIjB.exe
  C:\Windows\System\cCmLIjB.exe
  2⤵
  PID:6812
- C:\Windows\System\cPgdxzL.exe
  C:\Windows\System\cPgdxzL.exe
  2⤵
  PID:6868
- C:\Windows\System\WqsUSSd.exe
  C:\Windows\System\WqsUSSd.exe
  2⤵
  PID:6900
- C:\Windows\System\FyvtHtv.exe
  C:\Windows\System\FyvtHtv.exe
  2⤵
  PID:6948
- C:\Windows\System\beDLkJB.exe
  C:\Windows\System\beDLkJB.exe
  2⤵
  PID:6968
- C:\Windows\System\riSZPQy.exe
  C:\Windows\System\riSZPQy.exe
  2⤵
  PID:6992
- C:\Windows\System\MOukbOi.exe
  C:\Windows\System\MOukbOi.exe
  2⤵
  PID:7032
- C:\Windows\System\veJgyQC.exe
  C:\Windows\System\veJgyQC.exe
  2⤵
  PID:7052
- C:\Windows\System\fRXeLWI.exe
  C:\Windows\System\fRXeLWI.exe
  2⤵
  PID:7076
- C:\Windows\System\pOoVXbE.exe
  C:\Windows\System\pOoVXbE.exe
  2⤵
  PID:7096
- C:\Windows\System\CHsbSWJ.exe
  C:\Windows\System\CHsbSWJ.exe
  2⤵
  PID:7120
- C:\Windows\System\XOOWuYX.exe
  C:\Windows\System\XOOWuYX.exe
  2⤵
  PID:7164
- C:\Windows\System\owYIyXO.exe
  C:\Windows\System\owYIyXO.exe
  2⤵
  PID:6048
- C:\Windows\System\KLzZXSv.exe
  C:\Windows\System\KLzZXSv.exe
  2⤵
  PID:6264
- C:\Windows\System\QaPEfeJ.exe
  C:\Windows\System\QaPEfeJ.exe
  2⤵
  PID:6204
- C:\Windows\System\soGNNmx.exe
  C:\Windows\System\soGNNmx.exe
  2⤵
  PID:6236
- C:\Windows\System\QBVeaaa.exe
  C:\Windows\System\QBVeaaa.exe
  2⤵
  PID:6288
- C:\Windows\System\YUXOeBg.exe
  C:\Windows\System\YUXOeBg.exe
  2⤵
  PID:6300
- C:\Windows\System\MniqEdD.exe
  C:\Windows\System\MniqEdD.exe
  2⤵
  PID:6396
- C:\Windows\System\gpftFws.exe
  C:\Windows\System\gpftFws.exe
  2⤵
  PID:6460
- C:\Windows\System\PEcPGdG.exe
  C:\Windows\System\PEcPGdG.exe
  2⤵
  PID:6492
- C:\Windows\System\lKXwwXO.exe
  C:\Windows\System\lKXwwXO.exe
  2⤵
  PID:6728
- C:\Windows\System\vxvZbZk.exe
  C:\Windows\System\vxvZbZk.exe
  2⤵
  PID:6716
- C:\Windows\System\ycdtjFO.exe
  C:\Windows\System\ycdtjFO.exe
  2⤵
  PID:6804
- C:\Windows\System\rseTmyy.exe
  C:\Windows\System\rseTmyy.exe
  2⤵
  PID:6800
- C:\Windows\System\HFFmmjY.exe
  C:\Windows\System\HFFmmjY.exe
  2⤵
  PID:6856
- C:\Windows\System\GaDJtdb.exe
  C:\Windows\System\GaDJtdb.exe
  2⤵
  PID:6928
- C:\Windows\System\kCyjtLs.exe
  C:\Windows\System\kCyjtLs.exe
  2⤵
  PID:7008
- C:\Windows\System\xONjAZi.exe
  C:\Windows\System\xONjAZi.exe
  2⤵
  PID:7092
- C:\Windows\System\wnTItlg.exe
  C:\Windows\System\wnTItlg.exe
  2⤵
  PID:7140
- C:\Windows\System\RfJEPZX.exe
  C:\Windows\System\RfJEPZX.exe
  2⤵
  PID:6196
- C:\Windows\System\UvBAJPo.exe
  C:\Windows\System\UvBAJPo.exe
  2⤵
  PID:6348
- C:\Windows\System\SEmEmJl.exe
  C:\Windows\System\SEmEmJl.exe
  2⤵
  PID:6448
- C:\Windows\System\GHAxGvq.exe
  C:\Windows\System\GHAxGvq.exe
  2⤵
  PID:6764
- C:\Windows\System\XJSGzPK.exe
  C:\Windows\System\XJSGzPK.exe
  2⤵
  PID:6744
- C:\Windows\System\wkezeoN.exe
  C:\Windows\System\wkezeoN.exe
  2⤵
  PID:6808
- C:\Windows\System\zEXRTBo.exe
  C:\Windows\System\zEXRTBo.exe
  2⤵
  PID:5884
- C:\Windows\System\QORFVwc.exe
  C:\Windows\System\QORFVwc.exe
  2⤵
  PID:6376
- C:\Windows\System\FGKEHbk.exe
  C:\Windows\System\FGKEHbk.exe
  2⤵
  PID:6712
- C:\Windows\System\TuectKV.exe
  C:\Windows\System\TuectKV.exe
  2⤵
  PID:6924
- C:\Windows\System\IXyfPZW.exe
  C:\Windows\System\IXyfPZW.exe
  2⤵
  PID:6588
- C:\Windows\System\QoTtJYb.exe
  C:\Windows\System\QoTtJYb.exe
  2⤵
  PID:7180
- C:\Windows\System\LAQhGmk.exe
  C:\Windows\System\LAQhGmk.exe
  2⤵
  PID:7204
- C:\Windows\System\xMjrHaI.exe
  C:\Windows\System\xMjrHaI.exe
  2⤵
  PID:7220
- C:\Windows\System\wHgEZLb.exe
  C:\Windows\System\wHgEZLb.exe
  2⤵
  PID:7252
- C:\Windows\System\JWXNVLu.exe
  C:\Windows\System\JWXNVLu.exe
  2⤵
  PID:7268
- C:\Windows\System\auUiVIO.exe
  C:\Windows\System\auUiVIO.exe
  2⤵
  PID:7288
- C:\Windows\System\NnZIuJe.exe
  C:\Windows\System\NnZIuJe.exe
  2⤵
  PID:7308
- C:\Windows\System\fdhNOKK.exe
  C:\Windows\System\fdhNOKK.exe
  2⤵
  PID:7344
- C:\Windows\System\SqmITbw.exe
  C:\Windows\System\SqmITbw.exe
  2⤵
  PID:7364
- C:\Windows\System\ErIzYwC.exe
  C:\Windows\System\ErIzYwC.exe
  2⤵
  PID:7388
- C:\Windows\System\jTlIDyG.exe
  C:\Windows\System\jTlIDyG.exe
  2⤵
  PID:7408
- C:\Windows\System\RoNgkpt.exe
  C:\Windows\System\RoNgkpt.exe
  2⤵
  PID:7468
- C:\Windows\System\cQqmQwR.exe
  C:\Windows\System\cQqmQwR.exe
  2⤵
  PID:7504
- C:\Windows\System\hYStxIp.exe
  C:\Windows\System\hYStxIp.exe
  2⤵
  PID:7560
- C:\Windows\System\ZkuxJOE.exe
  C:\Windows\System\ZkuxJOE.exe
  2⤵
  PID:7580
- C:\Windows\System\rNvKlsf.exe
  C:\Windows\System\rNvKlsf.exe
  2⤵
  PID:7608
- C:\Windows\System\PslgFhC.exe
  C:\Windows\System\PslgFhC.exe
  2⤵
  PID:7632
- C:\Windows\System\ylIUFSc.exe
  C:\Windows\System\ylIUFSc.exe
  2⤵
  PID:7648
- C:\Windows\System\GuiXeGi.exe
  C:\Windows\System\GuiXeGi.exe
  2⤵
  PID:7668
- C:\Windows\System\GlGjtQu.exe
  C:\Windows\System\GlGjtQu.exe
  2⤵
  PID:7712
- C:\Windows\System\hCCMRCb.exe
  C:\Windows\System\hCCMRCb.exe
  2⤵
  PID:7736
- C:\Windows\System\jfdTMex.exe
  C:\Windows\System\jfdTMex.exe
  2⤵
  PID:7760
- C:\Windows\System\hnzWfuW.exe
  C:\Windows\System\hnzWfuW.exe
  2⤵
  PID:7780
- C:\Windows\System\lmcfWyi.exe
  C:\Windows\System\lmcfWyi.exe
  2⤵
  PID:7808
- C:\Windows\System\XmcEexO.exe
  C:\Windows\System\XmcEexO.exe
  2⤵
  PID:7832
- C:\Windows\System\ZZNiXLO.exe
  C:\Windows\System\ZZNiXLO.exe
  2⤵
  PID:7864
- C:\Windows\System\Huvrrhm.exe
  C:\Windows\System\Huvrrhm.exe
  2⤵
  PID:7892
- C:\Windows\System\iFETqSm.exe
  C:\Windows\System\iFETqSm.exe
  2⤵
  PID:7920
- C:\Windows\System\YZGQfDM.exe
  C:\Windows\System\YZGQfDM.exe
  2⤵
  PID:7944
- C:\Windows\System\YAyVLyP.exe
  C:\Windows\System\YAyVLyP.exe
  2⤵
  PID:7972
- C:\Windows\System\SgtMeYL.exe
  C:\Windows\System\SgtMeYL.exe
  2⤵
  PID:7992
- C:\Windows\System\PYDCofp.exe
  C:\Windows\System\PYDCofp.exe
  2⤵
  PID:8032
- C:\Windows\System\YXGpAyA.exe
  C:\Windows\System\YXGpAyA.exe
  2⤵
  PID:8092
- C:\Windows\System\LmXPGOm.exe
  C:\Windows\System\LmXPGOm.exe
  2⤵
  PID:8108
- C:\Windows\System\sHbPdjA.exe
  C:\Windows\System\sHbPdjA.exe
  2⤵
  PID:8136
- C:\Windows\System\hoxUHcR.exe
  C:\Windows\System\hoxUHcR.exe
  2⤵
  PID:8172
- C:\Windows\System\xklHlCV.exe
  C:\Windows\System\xklHlCV.exe
  2⤵
  PID:6320
- C:\Windows\System\QarGKkJ.exe
  C:\Windows\System\QarGKkJ.exe
  2⤵
  PID:7284
- C:\Windows\System\FVSmzly.exe
  C:\Windows\System\FVSmzly.exe
  2⤵
  PID:6516
- C:\Windows\System\fFbImEX.exe
  C:\Windows\System\fFbImEX.exe
  2⤵
  PID:7328
- C:\Windows\System\gIjYAXk.exe
  C:\Windows\System\gIjYAXk.exe
  2⤵
  PID:7380
- C:\Windows\System\LMSstKC.exe
  C:\Windows\System\LMSstKC.exe
  2⤵
  PID:7428
- C:\Windows\System\fyPOeLy.exe
  C:\Windows\System\fyPOeLy.exe
  2⤵
  PID:7536
- C:\Windows\System\gdeADqM.exe
  C:\Windows\System\gdeADqM.exe
  2⤵
  PID:7624
- C:\Windows\System\oFMZKvR.exe
  C:\Windows\System\oFMZKvR.exe
  2⤵
  PID:7700
- C:\Windows\System\XGdLSPE.exe
  C:\Windows\System\XGdLSPE.exe
  2⤵
  PID:7752
- C:\Windows\System\pnnVTVG.exe
  C:\Windows\System\pnnVTVG.exe
  2⤵
  PID:7772
- C:\Windows\System\vzShYFz.exe
  C:\Windows\System\vzShYFz.exe
  2⤵
  PID:7900
- C:\Windows\System\GPzILxb.exe
  C:\Windows\System\GPzILxb.exe
  2⤵
  PID:7916
- C:\Windows\System\YwBCuKj.exe
  C:\Windows\System\YwBCuKj.exe
  2⤵
  PID:7968
- C:\Windows\System\WIzANml.exe
  C:\Windows\System\WIzANml.exe
  2⤵
  PID:8028
- C:\Windows\System\nMTbuWa.exe
  C:\Windows\System\nMTbuWa.exe
  2⤵
  PID:8148
- C:\Windows\System\wLMrIzZ.exe
  C:\Windows\System\wLMrIzZ.exe
  2⤵
  PID:7192
- C:\Windows\System\poNpzmr.exe
  C:\Windows\System\poNpzmr.exe
  2⤵
  PID:7300
- C:\Windows\System\hzBOnHN.exe
  C:\Windows\System\hzBOnHN.exe
  2⤵
  PID:6832
- C:\Windows\System\QOXeVHC.exe
  C:\Windows\System\QOXeVHC.exe
  2⤵
  PID:7696
- C:\Windows\System\NzylcPQ.exe
  C:\Windows\System\NzylcPQ.exe
  2⤵
  PID:7776
- C:\Windows\System\XCWmGif.exe
  C:\Windows\System\XCWmGif.exe
  2⤵
  PID:7860
- C:\Windows\System\NHroQUB.exe
  C:\Windows\System\NHroQUB.exe
  2⤵
  PID:7964
- C:\Windows\System\gisYZBu.exe
  C:\Windows\System\gisYZBu.exe
  2⤵
  PID:8120
- C:\Windows\System\WOdunZK.exe
  C:\Windows\System\WOdunZK.exe
  2⤵
  PID:7404
- C:\Windows\System\epYuEJA.exe
  C:\Windows\System\epYuEJA.exe
  2⤵
  PID:7708
- C:\Windows\System\nuBjXRj.exe
  C:\Windows\System\nuBjXRj.exe
  2⤵
  PID:7676
- C:\Windows\System\bKsToId.exe
  C:\Windows\System\bKsToId.exe
  2⤵
  PID:8180
- C:\Windows\System\FcekZfN.exe
  C:\Windows\System\FcekZfN.exe
  2⤵
  PID:8212
- C:\Windows\System\fTNFmnj.exe
  C:\Windows\System\fTNFmnj.exe
  2⤵
  PID:8256
- C:\Windows\System\qNiBXbs.exe
  C:\Windows\System\qNiBXbs.exe
  2⤵
  PID:8280
- C:\Windows\System\RsINLmJ.exe
  C:\Windows\System\RsINLmJ.exe
  2⤵
  PID:8300
- C:\Windows\System\TnXMnPp.exe
  C:\Windows\System\TnXMnPp.exe
  2⤵
  PID:8328
- C:\Windows\System\MyBPzGL.exe
  C:\Windows\System\MyBPzGL.exe
  2⤵
  PID:8344
- C:\Windows\System\htDFscp.exe
  C:\Windows\System\htDFscp.exe
  2⤵
  PID:8392
- C:\Windows\System\TfWdzeM.exe
  C:\Windows\System\TfWdzeM.exe
  2⤵
  PID:8432
- C:\Windows\System\ZDwflWz.exe
  C:\Windows\System\ZDwflWz.exe
  2⤵
  PID:8456
- C:\Windows\System\HNLbHgO.exe
  C:\Windows\System\HNLbHgO.exe
  2⤵
  PID:8476
- C:\Windows\System\ziNvisS.exe
  C:\Windows\System\ziNvisS.exe
  2⤵
  PID:8492
- C:\Windows\System\UocvUCh.exe
  C:\Windows\System\UocvUCh.exe
  2⤵
  PID:8512
- C:\Windows\System\sdSBQoU.exe
  C:\Windows\System\sdSBQoU.exe
  2⤵
  PID:8608
- C:\Windows\System\pmnQRQg.exe
  C:\Windows\System\pmnQRQg.exe
  2⤵
  PID:8628
- C:\Windows\System\ByYzuFt.exe
  C:\Windows\System\ByYzuFt.exe
  2⤵
  PID:8684
- C:\Windows\System\TDkDzbD.exe
  C:\Windows\System\TDkDzbD.exe
  2⤵
  PID:8724
- C:\Windows\System\MQruNmX.exe
  C:\Windows\System\MQruNmX.exe
  2⤵
  PID:8792
- C:\Windows\System\HfIVyBE.exe
  C:\Windows\System\HfIVyBE.exe
  2⤵
  PID:8812
- C:\Windows\System\zUJpnSj.exe
  C:\Windows\System\zUJpnSj.exe
  2⤵
  PID:8844
- C:\Windows\System\MHOwcjt.exe
  C:\Windows\System\MHOwcjt.exe
  2⤵
  PID:8864
- C:\Windows\System\zCNrgcH.exe
  C:\Windows\System\zCNrgcH.exe
  2⤵
  PID:8904
- C:\Windows\System\BiRPHGy.exe
  C:\Windows\System\BiRPHGy.exe
  2⤵
  PID:8924
- C:\Windows\System\ZPgRRPF.exe
  C:\Windows\System\ZPgRRPF.exe
  2⤵
  PID:8948
- C:\Windows\System\kSMAzLz.exe
  C:\Windows\System\kSMAzLz.exe
  2⤵
  PID:8968
- C:\Windows\System\BetloSI.exe
  C:\Windows\System\BetloSI.exe
  2⤵
  PID:9012
- C:\Windows\System\inUkAYP.exe
  C:\Windows\System\inUkAYP.exe
  2⤵
  PID:9040
- C:\Windows\System\RMpjdAn.exe
  C:\Windows\System\RMpjdAn.exe
  2⤵
  PID:9080
- C:\Windows\System\JCnujGN.exe
  C:\Windows\System\JCnujGN.exe
  2⤵
  PID:9100
- C:\Windows\System\DQNzPHK.exe
  C:\Windows\System\DQNzPHK.exe
  2⤵
  PID:9120
- C:\Windows\System\xYHUIhj.exe
  C:\Windows\System\xYHUIhj.exe
  2⤵
  PID:9168
- C:\Windows\System\vJrhuVh.exe
  C:\Windows\System\vJrhuVh.exe
  2⤵
  PID:9184
- C:\Windows\System\BDFLdCX.exe
  C:\Windows\System\BDFLdCX.exe
  2⤵
  PID:9204
- C:\Windows\System\DRtfsor.exe
  C:\Windows\System\DRtfsor.exe
  2⤵
  PID:7872
- C:\Windows\System\mtVnhgD.exe
  C:\Windows\System\mtVnhgD.exe
  2⤵
  PID:8232
- C:\Windows\System\YEkONNU.exe
  C:\Windows\System\YEkONNU.exe
  2⤵
  PID:8296
- C:\Windows\System\OaPbelL.exe
  C:\Windows\System\OaPbelL.exe
  2⤵
  PID:8340
- C:\Windows\System\GlRmvrD.exe
  C:\Windows\System\GlRmvrD.exe
  2⤵
  PID:8424
- C:\Windows\System\TAxeXpM.exe
  C:\Windows\System\TAxeXpM.exe
  2⤵
  PID:8488
- C:\Windows\System\Xyiwwdz.exe
  C:\Windows\System\Xyiwwdz.exe
  2⤵
  PID:8600
- C:\Windows\System\jAAjdeq.exe
  C:\Windows\System\jAAjdeq.exe
  2⤵
  PID:8652
- C:\Windows\System\jOYFrUX.exe
  C:\Windows\System\jOYFrUX.exe
  2⤵
  PID:8548
- C:\Windows\System\HVYSOEu.exe
  C:\Windows\System\HVYSOEu.exe
  2⤵
  PID:8568
- C:\Windows\System\RcTYAJy.exe
  C:\Windows\System\RcTYAJy.exe
  2⤵
  PID:8604
- C:\Windows\System\VTyGSXR.exe
  C:\Windows\System\VTyGSXR.exe
  2⤵
  PID:8744
- C:\Windows\System\VfQzMJg.exe
  C:\Windows\System\VfQzMJg.exe
  2⤵
  PID:8900
- C:\Windows\System\WRMkwYj.exe
  C:\Windows\System\WRMkwYj.exe
  2⤵
  PID:8916
- C:\Windows\System\dOMimXs.exe
  C:\Windows\System\dOMimXs.exe
  2⤵
  PID:9036
- C:\Windows\System\GoAiVtZ.exe
  C:\Windows\System\GoAiVtZ.exe
  2⤵
  PID:9072
- C:\Windows\System\dtFNjiG.exe
  C:\Windows\System\dtFNjiG.exe
  2⤵
  PID:9156
- C:\Windows\System\wqzizFd.exe
  C:\Windows\System\wqzizFd.exe
  2⤵
  PID:8200
- C:\Windows\System\zSZaHnh.exe
  C:\Windows\System\zSZaHnh.exe
  2⤵
  PID:8484
- C:\Windows\System\NTJJimY.exe
  C:\Windows\System\NTJJimY.exe
  2⤵
  PID:8540
- C:\Windows\System\mjUfjpw.exe
  C:\Windows\System\mjUfjpw.exe
  2⤵
  PID:8572
- C:\Windows\System\hORwhqy.exe
  C:\Windows\System\hORwhqy.exe
  2⤵
  PID:8740
- C:\Windows\System\PDIJJxj.exe
  C:\Windows\System\PDIJJxj.exe
  2⤵
  PID:8856
- C:\Windows\System\ozeEoWj.exe
  C:\Windows\System\ozeEoWj.exe
  2⤵
  PID:8100
- C:\Windows\System\TEdbvmK.exe
  C:\Windows\System\TEdbvmK.exe
  2⤵
  PID:8264
- C:\Windows\System\ESRpxSQ.exe
  C:\Windows\System\ESRpxSQ.exe
  2⤵
  PID:8664
- C:\Windows\System\QTsPpuL.exe
  C:\Windows\System\QTsPpuL.exe
  2⤵
  PID:8888
- C:\Windows\System\RtXdcgv.exe
  C:\Windows\System\RtXdcgv.exe
  2⤵
  PID:9092
- C:\Windows\System\WuTPtEk.exe
  C:\Windows\System\WuTPtEk.exe
  2⤵
  PID:8336
- C:\Windows\System\GpDiTaA.exe
  C:\Windows\System\GpDiTaA.exe
  2⤵
  PID:9232
- C:\Windows\System\RdjuwRJ.exe
  C:\Windows\System\RdjuwRJ.exe
  2⤵
  PID:9256
- C:\Windows\System\MgLMwPW.exe
  C:\Windows\System\MgLMwPW.exe
  2⤵
  PID:9276
- C:\Windows\System\SEBZPtJ.exe
  C:\Windows\System\SEBZPtJ.exe
  2⤵
  PID:9300
- C:\Windows\System\NOvktRH.exe
  C:\Windows\System\NOvktRH.exe
  2⤵
  PID:9340
- C:\Windows\System\vDqJgGL.exe
  C:\Windows\System\vDqJgGL.exe
  2⤵
  PID:9380
- C:\Windows\System\iqwNbIa.exe
  C:\Windows\System\iqwNbIa.exe
  2⤵
  PID:9396
- C:\Windows\System\XvUahBi.exe
  C:\Windows\System\XvUahBi.exe
  2⤵
  PID:9416
- C:\Windows\System\hizzrrU.exe
  C:\Windows\System\hizzrrU.exe
  2⤵
  PID:9464
- C:\Windows\System\aVHXkJM.exe
  C:\Windows\System\aVHXkJM.exe
  2⤵
  PID:9484
- C:\Windows\System\UAKCEUr.exe
  C:\Windows\System\UAKCEUr.exe
  2⤵
  PID:9508
- C:\Windows\System\BRcJewO.exe
  C:\Windows\System\BRcJewO.exe
  2⤵
  PID:9532
- C:\Windows\System\gbFDOVT.exe
  C:\Windows\System\gbFDOVT.exe
  2⤵
  PID:9556
- C:\Windows\System\vneNndD.exe
  C:\Windows\System\vneNndD.exe
  2⤵
  PID:9584
- C:\Windows\System\jBUZCen.exe
  C:\Windows\System\jBUZCen.exe
  2⤵
  PID:9608
- C:\Windows\System\lYZJMIY.exe
  C:\Windows\System\lYZJMIY.exe
  2⤵
  PID:9628
- C:\Windows\System\wtMKvHO.exe
  C:\Windows\System\wtMKvHO.exe
  2⤵
  PID:9656
- C:\Windows\System\ymwSzhr.exe
  C:\Windows\System\ymwSzhr.exe
  2⤵
  PID:9676
- C:\Windows\System\EfLdggX.exe
  C:\Windows\System\EfLdggX.exe
  2⤵
  PID:9724
- C:\Windows\System\ZJptwLj.exe
  C:\Windows\System\ZJptwLj.exe
  2⤵
  PID:9744
- C:\Windows\System\qdayakL.exe
  C:\Windows\System\qdayakL.exe
  2⤵
  PID:9792
- C:\Windows\System\pDlYmFi.exe
  C:\Windows\System\pDlYmFi.exe
  2⤵
  PID:9820
- C:\Windows\System\SHvgFFq.exe
  C:\Windows\System\SHvgFFq.exe
  2⤵
  PID:9836
- C:\Windows\System\AdmfrXj.exe
  C:\Windows\System\AdmfrXj.exe
  2⤵
  PID:9856
- C:\Windows\System\KDeZzan.exe
  C:\Windows\System\KDeZzan.exe
  2⤵
  PID:9896
- C:\Windows\System\byVvLJV.exe
  C:\Windows\System\byVvLJV.exe
  2⤵
  PID:9932
- C:\Windows\System\NoXkcUt.exe
  C:\Windows\System\NoXkcUt.exe
  2⤵
  PID:9948
- C:\Windows\System\jrfpYyl.exe
  C:\Windows\System\jrfpYyl.exe
  2⤵
  PID:9996
- C:\Windows\System\NBreoDs.exe
  C:\Windows\System\NBreoDs.exe
  2⤵
  PID:10012
- C:\Windows\System\HCetIeu.exe
  C:\Windows\System\HCetIeu.exe
  2⤵
  PID:10036
- C:\Windows\System\sPtuBBb.exe
  C:\Windows\System\sPtuBBb.exe
  2⤵
  PID:10060
- C:\Windows\System\ElCGOAl.exe
  C:\Windows\System\ElCGOAl.exe
  2⤵
  PID:10100
- C:\Windows\System\dIEdcsm.exe
  C:\Windows\System\dIEdcsm.exe
  2⤵
  PID:10120
- C:\Windows\System\pNIKNvM.exe
  C:\Windows\System\pNIKNvM.exe
  2⤵
  PID:10164
- C:\Windows\System\hZqjFiS.exe
  C:\Windows\System\hZqjFiS.exe
  2⤵
  PID:10188
- C:\Windows\System\WtlnIFw.exe
  C:\Windows\System\WtlnIFw.exe
  2⤵
  PID:10224
- C:\Windows\System\LPBGQLt.exe
  C:\Windows\System\LPBGQLt.exe
  2⤵
  PID:9148
- C:\Windows\System\duaPLqu.exe
  C:\Windows\System\duaPLqu.exe
  2⤵
  PID:9268
- C:\Windows\System\XMusSIP.exe
  C:\Windows\System\XMusSIP.exe
  2⤵
  PID:9320
- C:\Windows\System\BUAARBO.exe
  C:\Windows\System\BUAARBO.exe
  2⤵
  PID:9372
- C:\Windows\System\LrvNGqO.exe
  C:\Windows\System\LrvNGqO.exe
  2⤵
  PID:9448
- C:\Windows\System\TiwNBeV.exe
  C:\Windows\System\TiwNBeV.exe
  2⤵
  PID:9492
- C:\Windows\System\GOLFkyd.exe
  C:\Windows\System\GOLFkyd.exe
  2⤵
  PID:9600
- C:\Windows\System\OIaogoo.exe
  C:\Windows\System\OIaogoo.exe
  2⤵
  PID:9624
- C:\Windows\System\xkFsbnP.exe
  C:\Windows\System\xkFsbnP.exe
  2⤵
  PID:9664
- C:\Windows\System\qTIhHBJ.exe
  C:\Windows\System\qTIhHBJ.exe
  2⤵
  PID:9756
- C:\Windows\System\ZPGvmSt.exe
  C:\Windows\System\ZPGvmSt.exe
  2⤵
  PID:9804
- C:\Windows\System\fsestxc.exe
  C:\Windows\System\fsestxc.exe
  2⤵
  PID:9928
- C:\Windows\System\ZhjKSMt.exe
  C:\Windows\System\ZhjKSMt.exe
  2⤵
  PID:9968
- C:\Windows\System\TgwDtpW.exe
  C:\Windows\System\TgwDtpW.exe
  2⤵
  PID:10044
- C:\Windows\System\mdpofLw.exe
  C:\Windows\System\mdpofLw.exe
  2⤵
  PID:10076
- C:\Windows\System\IlYccCX.exe
  C:\Windows\System\IlYccCX.exe
  2⤵
  PID:10180
- C:\Windows\System\xTqfXCj.exe
  C:\Windows\System\xTqfXCj.exe
  2⤵
  PID:10212
- C:\Windows\System\gqzHPcY.exe
  C:\Windows\System\gqzHPcY.exe
  2⤵
  PID:9424
- C:\Windows\System\DLoVUGB.exe
  C:\Windows\System\DLoVUGB.exe
  2⤵
  PID:9480
- C:\Windows\System\RdfLaJe.exe
  C:\Windows\System\RdfLaJe.exe
  2⤵
  PID:9596
- C:\Windows\System\kBCpcdw.exe
  C:\Windows\System\kBCpcdw.exe
  2⤵
  PID:9808
- C:\Windows\System\QiSUrjN.exe
  C:\Windows\System\QiSUrjN.exe
  2⤵
  PID:9768
- C:\Windows\System\FvUbvSl.exe
  C:\Windows\System\FvUbvSl.exe
  2⤵
  PID:10132
- C:\Windows\System\NuVzfLy.exe
  C:\Windows\System\NuVzfLy.exe
  2⤵
  PID:10232
- C:\Windows\System\bdiCHQm.exe
  C:\Windows\System\bdiCHQm.exe
  2⤵
  PID:8984
- C:\Windows\System\wEvYvws.exe
  C:\Windows\System\wEvYvws.exe
  2⤵
  PID:9644
- C:\Windows\System\pMmEVnq.exe
  C:\Windows\System\pMmEVnq.exe
  2⤵
  PID:10172
- C:\Windows\System\QZoNyrU.exe
  C:\Windows\System\QZoNyrU.exe
  2⤵
  PID:8592
- C:\Windows\System\KGWkPCO.exe
  C:\Windows\System\KGWkPCO.exe
  2⤵
  PID:10252
- C:\Windows\System\UqnhlFU.exe
  C:\Windows\System\UqnhlFU.exe
  2⤵
  PID:10304
- C:\Windows\System\eduhUvv.exe
  C:\Windows\System\eduhUvv.exe
  2⤵
  PID:10324
- C:\Windows\System\nmNpTCI.exe
  C:\Windows\System\nmNpTCI.exe
  2⤵
  PID:10352
- C:\Windows\System\dHFYIJj.exe
  C:\Windows\System\dHFYIJj.exe
  2⤵
  PID:10380
- C:\Windows\System\TWeITNc.exe
  C:\Windows\System\TWeITNc.exe
  2⤵
  PID:10412
- C:\Windows\System\ulFPwRF.exe
  C:\Windows\System\ulFPwRF.exe
  2⤵
  PID:10428
- C:\Windows\System\IOoNDQb.exe
  C:\Windows\System\IOoNDQb.exe
  2⤵
  PID:10460
- C:\Windows\System\TLNtFyn.exe
  C:\Windows\System\TLNtFyn.exe
  2⤵
  PID:10484
- C:\Windows\System\koDIhfZ.exe
  C:\Windows\System\koDIhfZ.exe
  2⤵
  PID:10524
- C:\Windows\System\PMpeNSK.exe
  C:\Windows\System\PMpeNSK.exe
  2⤵
  PID:10548
- C:\Windows\System\XcjpEKq.exe
  C:\Windows\System\XcjpEKq.exe
  2⤵
  PID:10564
- C:\Windows\System\qkZvkas.exe
  C:\Windows\System\qkZvkas.exe
  2⤵
  PID:10584
- C:\Windows\System\CEzMhtE.exe
  C:\Windows\System\CEzMhtE.exe
  2⤵
  PID:10608
- C:\Windows\System\ZXEFFSE.exe
  C:\Windows\System\ZXEFFSE.exe
  2⤵
  PID:10664
- C:\Windows\System\kHmETaE.exe
  C:\Windows\System\kHmETaE.exe
  2⤵
  PID:10684
- C:\Windows\System\TVRRiFj.exe
  C:\Windows\System\TVRRiFj.exe
  2⤵
  PID:10720
- C:\Windows\System\QVDxUGJ.exe
  C:\Windows\System\QVDxUGJ.exe
  2⤵
  PID:10748
- C:\Windows\System\XcFbVOI.exe
  C:\Windows\System\XcFbVOI.exe
  2⤵
  PID:10780
- C:\Windows\System\WzILYXt.exe
  C:\Windows\System\WzILYXt.exe
  2⤵
  PID:10796
- C:\Windows\System\ShfrKpM.exe
  C:\Windows\System\ShfrKpM.exe
  2⤵
  PID:10832
- C:\Windows\System\efuiuUg.exe
  C:\Windows\System\efuiuUg.exe
  2⤵
  PID:10860
- C:\Windows\System\DvAVYCn.exe
  C:\Windows\System\DvAVYCn.exe
  2⤵
  PID:10880
- C:\Windows\System\NvWytjF.exe
  C:\Windows\System\NvWytjF.exe
  2⤵
  PID:10920
- C:\Windows\System\vUnBlcZ.exe
  C:\Windows\System\vUnBlcZ.exe
  2⤵
  PID:10944
- C:\Windows\System\igXOUUe.exe
  C:\Windows\System\igXOUUe.exe
  2⤵
  PID:10972
- C:\Windows\System\bikNtzg.exe
  C:\Windows\System\bikNtzg.exe
  2⤵
  PID:11000
- C:\Windows\System\FOxOJZJ.exe
  C:\Windows\System\FOxOJZJ.exe
  2⤵
  PID:11028
- C:\Windows\System\ZhrAMnT.exe
  C:\Windows\System\ZhrAMnT.exe
  2⤵
  PID:11060
- C:\Windows\System\oiNxxjM.exe
  C:\Windows\System\oiNxxjM.exe
  2⤵
  PID:11088
- C:\Windows\System\ylJQcGQ.exe
  C:\Windows\System\ylJQcGQ.exe
  2⤵
  PID:11104
- C:\Windows\System\aCnGdSw.exe
  C:\Windows\System\aCnGdSw.exe
  2⤵
  PID:11148
- C:\Windows\System\cWtUxSX.exe
  C:\Windows\System\cWtUxSX.exe
  2⤵
  PID:11168
- C:\Windows\System\dsUbMbb.exe
  C:\Windows\System\dsUbMbb.exe
  2⤵
  PID:11196
- C:\Windows\System\OJCgxrt.exe
  C:\Windows\System\OJCgxrt.exe
  2⤵
  PID:11220
- C:\Windows\System\kddSjmU.exe
  C:\Windows\System\kddSjmU.exe
  2⤵
  PID:11236
- C:\Windows\System\KRoGHbQ.exe
  C:\Windows\System\KRoGHbQ.exe
  2⤵
  PID:11256
- C:\Windows\System\FWZfPCO.exe
  C:\Windows\System\FWZfPCO.exe
  2⤵
  PID:9552
- C:\Windows\System\bsZHIDu.exe
  C:\Windows\System\bsZHIDu.exe
  2⤵
  PID:10316
- C:\Windows\System\lPiTCRB.exe
  C:\Windows\System\lPiTCRB.exe
  2⤵
  PID:10448
- C:\Windows\System\VDdKntD.exe
  C:\Windows\System\VDdKntD.exe
  2⤵
  PID:10516
- C:\Windows\System\tBUHZcU.exe
  C:\Windows\System\tBUHZcU.exe
  2⤵
  PID:10624
- C:\Windows\System\NoZAjPg.exe
  C:\Windows\System\NoZAjPg.exe
  2⤵
  PID:10604
- C:\Windows\System\tcAFbPo.exe
  C:\Windows\System\tcAFbPo.exe
  2⤵
  PID:10696
- C:\Windows\System\QWQGfXV.exe
  C:\Windows\System\QWQGfXV.exe
  2⤵
  PID:10792
- C:\Windows\System\HjWjsNf.exe
  C:\Windows\System\HjWjsNf.exe
  2⤵
  PID:10872
- C:\Windows\System\ZQCeUJf.exe
  C:\Windows\System\ZQCeUJf.exe
  2⤵
  PID:10840
- C:\Windows\System\WgitmNN.exe
  C:\Windows\System\WgitmNN.exe
  2⤵
  PID:10940
- C:\Windows\System\QuvXLQp.exe
  C:\Windows\System\QuvXLQp.exe
  2⤵
  PID:10968
- C:\Windows\System\eFKQsNo.exe
  C:\Windows\System\eFKQsNo.exe
  2⤵
  PID:11024
- C:\Windows\System\TEsiThs.exe
  C:\Windows\System\TEsiThs.exe
  2⤵
  PID:11124
- C:\Windows\System\OtXBfZH.exe
  C:\Windows\System\OtXBfZH.exe
  2⤵
  PID:11164
- C:\Windows\System\MLFcPnS.exe
  C:\Windows\System\MLFcPnS.exe
  2⤵
  PID:11232
- C:\Windows\System\hnKOksC.exe
  C:\Windows\System\hnKOksC.exe
  2⤵
  PID:11248
- C:\Windows\System\ssTzPwQ.exe
  C:\Windows\System\ssTzPwQ.exe
  2⤵
  PID:10512
- C:\Windows\System\yucicFS.exe
  C:\Windows\System\yucicFS.exe
  2⤵
  PID:10468
- C:\Windows\System\rJcxBfk.exe
  C:\Windows\System\rJcxBfk.exe
  2⤵
  PID:10736
- C:\Windows\System\ynyqgXk.exe
  C:\Windows\System\ynyqgXk.exe
  2⤵
  PID:10788
- C:\Windows\System\kKlKCjs.exe
  C:\Windows\System\kKlKCjs.exe
  2⤵
  PID:10988
- C:\Windows\System\aphyBAd.exe
  C:\Windows\System\aphyBAd.exe
  2⤵
  PID:11100
- C:\Windows\System\szymhGd.exe
  C:\Windows\System\szymhGd.exe
  2⤵
  PID:10420
- C:\Windows\System\nTdciYv.exe
  C:\Windows\System\nTdciYv.exe
  2⤵
  PID:10536
- C:\Windows\System\RdmGPgI.exe
  C:\Windows\System\RdmGPgI.exe
  2⤵
  PID:10912
- C:\Windows\System\nPfezXj.exe
  C:\Windows\System\nPfezXj.exe
  2⤵
  PID:11288
- C:\Windows\System\FUGZZib.exe
  C:\Windows\System\FUGZZib.exe
  2⤵
  PID:11312
- C:\Windows\System\xDeIZTM.exe
  C:\Windows\System\xDeIZTM.exe
  2⤵
  PID:11340
- C:\Windows\System\PKDWgpQ.exe
  C:\Windows\System\PKDWgpQ.exe
  2⤵
  PID:11368
- C:\Windows\System\fVuWQal.exe
  C:\Windows\System\fVuWQal.exe
  2⤵
  PID:11392
- C:\Windows\System\yIdEvxk.exe
  C:\Windows\System\yIdEvxk.exe
  2⤵
  PID:11408
- C:\Windows\System\mCXUPbI.exe
  C:\Windows\System\mCXUPbI.exe
  2⤵
  PID:11432
- C:\Windows\System\ixjjfJn.exe
  C:\Windows\System\ixjjfJn.exe
  2⤵
  PID:11456
- C:\Windows\System\UkjcgEJ.exe
  C:\Windows\System\UkjcgEJ.exe
  2⤵
  PID:11496
- C:\Windows\System\jGUQMld.exe
  C:\Windows\System\jGUQMld.exe
  2⤵
  PID:11584
- C:\Windows\System\tjdqpaG.exe
  C:\Windows\System\tjdqpaG.exe
  2⤵
  PID:11648
- C:\Windows\System\MrqDRCq.exe
  C:\Windows\System\MrqDRCq.exe
  2⤵
  PID:11664
- C:\Windows\System\qBUnLnq.exe
  C:\Windows\System\qBUnLnq.exe
  2⤵
  PID:11684
- C:\Windows\System\XPAPKRa.exe
  C:\Windows\System\XPAPKRa.exe
  2⤵
  PID:11700
- C:\Windows\System\hThSlNf.exe
  C:\Windows\System\hThSlNf.exe
  2⤵
  PID:11716
- C:\Windows\System\nqhXhQI.exe
  C:\Windows\System\nqhXhQI.exe
  2⤵
  PID:11732
- C:\Windows\System\lxWAWRl.exe
  C:\Windows\System\lxWAWRl.exe
  2⤵
  PID:11760
- C:\Windows\System\NGcvnOq.exe
  C:\Windows\System\NGcvnOq.exe
  2⤵
  PID:11788
- C:\Windows\System\VMcMsZM.exe
  C:\Windows\System\VMcMsZM.exe
  2⤵
  PID:11812
- C:\Windows\System\LXCBpVm.exe
  C:\Windows\System\LXCBpVm.exe
  2⤵
  PID:11836
- C:\Windows\System\CDQzteW.exe
  C:\Windows\System\CDQzteW.exe
  2⤵
  PID:11860
- C:\Windows\System\vZjUNPJ.exe
  C:\Windows\System\vZjUNPJ.exe
  2⤵
  PID:11880
- C:\Windows\System\nVPyMeF.exe
  C:\Windows\System\nVPyMeF.exe
  2⤵
  PID:11980
- C:\Windows\System\IFtIwZF.exe
  C:\Windows\System\IFtIwZF.exe
  2⤵
  PID:12004
- C:\Windows\System\hUJuLIe.exe
  C:\Windows\System\hUJuLIe.exe
  2⤵
  PID:12056
- C:\Windows\System\PLNjZaf.exe
  C:\Windows\System\PLNjZaf.exe
  2⤵
  PID:12108
- C:\Windows\System\TmJBKgv.exe
  C:\Windows\System\TmJBKgv.exe
  2⤵
  PID:12124
- C:\Windows\System\rLIlRDf.exe
  C:\Windows\System\rLIlRDf.exe
  2⤵
  PID:12148
- C:\Windows\System\OujaoEP.exe
  C:\Windows\System\OujaoEP.exe
  2⤵
  PID:12180
- C:\Windows\System\elXuMJx.exe
  C:\Windows\System\elXuMJx.exe
  2⤵
  PID:12208
- C:\Windows\System\NvUIfPt.exe
  C:\Windows\System\NvUIfPt.exe
  2⤵
  PID:12224
- C:\Windows\System\HJZdlwn.exe
  C:\Windows\System\HJZdlwn.exe
  2⤵
  PID:12248
- C:\Windows\System\WVFxUth.exe
  C:\Windows\System\WVFxUth.exe
  2⤵
  PID:12280
- C:\Windows\System\QYICrjT.exe
  C:\Windows\System\QYICrjT.exe
  2⤵
  PID:10424
- C:\Windows\System\PXGMSLH.exe
  C:\Windows\System\PXGMSLH.exe
  2⤵
  PID:11276
- C:\Windows\System\pJdlYVh.exe
  C:\Windows\System\pJdlYVh.exe
  2⤵
  PID:11416
- C:\Windows\System\SvKqbqL.exe
  C:\Windows\System\SvKqbqL.exe
  2⤵
  PID:11448
- C:\Windows\System\KNBaWIj.exe
  C:\Windows\System\KNBaWIj.exe
  2⤵
  PID:11508
- C:\Windows\System\kbIscKW.exe
  C:\Windows\System\kbIscKW.exe
  2⤵
  PID:11556
- C:\Windows\System\rNRIoUv.exe
  C:\Windows\System\rNRIoUv.exe
  2⤵
  PID:11576
- C:\Windows\System\PxaOzBx.exe
  C:\Windows\System\PxaOzBx.exe
  2⤵
  PID:11572
- C:\Windows\System\wEAIJXy.exe
  C:\Windows\System\wEAIJXy.exe
  2⤵
  PID:11624
- C:\Windows\System\MvchVLr.exe
  C:\Windows\System\MvchVLr.exe
  2⤵
  PID:11680
- C:\Windows\System\SxmzJxM.exe
  C:\Windows\System\SxmzJxM.exe
  2⤵
  PID:11752
- C:\Windows\System\rJXcAVH.exe
  C:\Windows\System\rJXcAVH.exe
  2⤵
  PID:11632
- C:\Windows\System\hoadKNz.exe
  C:\Windows\System\hoadKNz.exe
  2⤵
  PID:11772
- C:\Windows\System\AMIcnAE.exe
  C:\Windows\System\AMIcnAE.exe
  2⤵
  PID:11948
- C:\Windows\System\xRDzofA.exe
  C:\Windows\System\xRDzofA.exe
  2⤵
  PID:3180
- C:\Windows\System\coODPau.exe
  C:\Windows\System\coODPau.exe
  2⤵
  PID:12044
- C:\Windows\System\eQzOVWX.exe
  C:\Windows\System\eQzOVWX.exe
  2⤵
  PID:12096
- C:\Windows\System\XSLJein.exe
  C:\Windows\System\XSLJein.exe
  2⤵
  PID:4892
- C:\Windows\System\SzXoIRc.exe
  C:\Windows\System\SzXoIRc.exe
  2⤵
  PID:2660
- C:\Windows\System\MnzMnwR.exe
  C:\Windows\System\MnzMnwR.exe
  2⤵
  PID:12140
- C:\Windows\System\sWSleVJ.exe
  C:\Windows\System\sWSleVJ.exe
  2⤵
  PID:12160
- C:\Windows\System\yNZnjsK.exe
  C:\Windows\System\yNZnjsK.exe
  2⤵
  PID:12216
- C:\Windows\System\VWfAAia.exe
  C:\Windows\System\VWfAAia.exe
  2⤵
  PID:5036
- C:\Windows\System\Urweqfq.exe
  C:\Windows\System\Urweqfq.exe
  2⤵
  PID:11404
- C:\Windows\System\hbKSzQG.exe
  C:\Windows\System\hbKSzQG.exe
  2⤵
  PID:11472
- C:\Windows\System\BIxphzD.exe
  C:\Windows\System\BIxphzD.exe
  2⤵
  PID:11552
- C:\Windows\System\ZJYoMSz.exe
  C:\Windows\System\ZJYoMSz.exe
  2⤵
  PID:11696
- C:\Windows\System\cxaeZoe.exe
  C:\Windows\System\cxaeZoe.exe
  2⤵
  PID:11676
- C:\Windows\System\boZqCWM.exe
  C:\Windows\System\boZqCWM.exe
  2⤵
  PID:11924
- C:\Windows\System\WapJAwV.exe
  C:\Windows\System\WapJAwV.exe
  2⤵
  PID:12088
- C:\Windows\System\RzqtLNR.exe
  C:\Windows\System\RzqtLNR.exe
  2⤵
  PID:12164
- C:\Windows\System\ckRgohU.exe
  C:\Windows\System\ckRgohU.exe
  2⤵
  PID:12272
- C:\Windows\System\oPjXsUG.exe
  C:\Windows\System\oPjXsUG.exe
  2⤵
  PID:11128
- C:\Windows\System\PrvbhOk.exe
  C:\Windows\System\PrvbhOk.exe
  2⤵
  PID:11872
- C:\Windows\System\QxDjDsm.exe
  C:\Windows\System\QxDjDsm.exe
  2⤵
  PID:11828
- C:\Windows\System\rFDyTlF.exe
  C:\Windows\System\rFDyTlF.exe
  2⤵
  PID:2464
- C:\Windows\System\RokUZvu.exe
  C:\Windows\System\RokUZvu.exe
  2⤵
  PID:1356
- C:\Windows\System\KItyaET.exe
  C:\Windows\System\KItyaET.exe
  2⤵
  PID:10320
- C:\Windows\System\yXhNnYw.exe
  C:\Windows\System\yXhNnYw.exe
  2⤵
  PID:11740
- C:\Windows\System\wlhKxNX.exe
  C:\Windows\System\wlhKxNX.exe
  2⤵
  PID:11380
- C:\Windows\System\jFzSZPx.exe
  C:\Windows\System\jFzSZPx.exe
  2⤵
  PID:12312
- C:\Windows\System\bMZktKr.exe
  C:\Windows\System\bMZktKr.exe
  2⤵
  PID:12336
- C:\Windows\System\SBiQVqX.exe
  C:\Windows\System\SBiQVqX.exe
  2⤵
  PID:12356
- C:\Windows\System\ciljoXM.exe
  C:\Windows\System\ciljoXM.exe
  2⤵
  PID:12372
- C:\Windows\System\UOFnvhE.exe
  C:\Windows\System\UOFnvhE.exe
  2⤵
  PID:12396
- C:\Windows\System\IGIGjcN.exe
  C:\Windows\System\IGIGjcN.exe
  2⤵
  PID:12428
- C:\Windows\System\oGKjARK.exe
  C:\Windows\System\oGKjARK.exe
  2⤵
  PID:12460
- C:\Windows\System\LOBTJlT.exe
  C:\Windows\System\LOBTJlT.exe
  2⤵
  PID:12520
- C:\Windows\System\rxGXqyc.exe
  C:\Windows\System\rxGXqyc.exe
  2⤵
  PID:12540
- C:\Windows\System\TmgnhcT.exe
  C:\Windows\System\TmgnhcT.exe
  2⤵
  PID:12560
- C:\Windows\System\NlSrypF.exe
  C:\Windows\System\NlSrypF.exe
  2⤵
  PID:12580
- C:\Windows\System\hXdRgsy.exe
  C:\Windows\System\hXdRgsy.exe
  2⤵
  PID:12608
- C:\Windows\System\SrmNhOv.exe
  C:\Windows\System\SrmNhOv.exe
  2⤵
  PID:12652
- C:\Windows\System\vvFQIWw.exe
  C:\Windows\System\vvFQIWw.exe
  2⤵
  PID:12676
- C:\Windows\System\prMaGsv.exe
  C:\Windows\System\prMaGsv.exe
  2⤵
  PID:12692
- C:\Windows\System\aAqqdiB.exe
  C:\Windows\System\aAqqdiB.exe
  2⤵
  PID:12732
- C:\Windows\System\IrYEqLv.exe
  C:\Windows\System\IrYEqLv.exe
  2⤵
  PID:12748
- C:\Windows\System\FuVQWJp.exe
  C:\Windows\System\FuVQWJp.exe
  2⤵
  PID:12788
- C:\Windows\System\RzKOdcG.exe
  C:\Windows\System\RzKOdcG.exe
  2⤵
  PID:12820
- C:\Windows\System\rObHVVL.exe
  C:\Windows\System\rObHVVL.exe
  2⤵
  PID:12848
- C:\Windows\System\tYlhAnF.exe
  C:\Windows\System\tYlhAnF.exe
  2⤵
  PID:12872
- C:\Windows\System\hlEgPDU.exe
  C:\Windows\System\hlEgPDU.exe
  2⤵
  PID:12924
- C:\Windows\System\NFBjoUh.exe
  C:\Windows\System\NFBjoUh.exe
  2⤵
  PID:12940
- C:\Windows\System\YIOBrVt.exe
  C:\Windows\System\YIOBrVt.exe
  2⤵
  PID:12972
- C:\Windows\System\HIvFnyO.exe
  C:\Windows\System\HIvFnyO.exe
  2⤵
  PID:12996
- C:\Windows\System\CovdsJg.exe
  C:\Windows\System\CovdsJg.exe
  2⤵
  PID:13016
- C:\Windows\System\BVCfDdZ.exe
  C:\Windows\System\BVCfDdZ.exe
  2⤵
  PID:13048
- C:\Windows\System\AVIhAEM.exe
  C:\Windows\System\AVIhAEM.exe
  2⤵
  PID:13076
- C:\Windows\System\jMBqwev.exe
  C:\Windows\System\jMBqwev.exe
  2⤵
  PID:13092
- C:\Windows\System\LFoTjsw.exe
  C:\Windows\System\LFoTjsw.exe
  2⤵
  PID:13116
- C:\Windows\System\fvKntFr.exe
  C:\Windows\System\fvKntFr.exe
  2⤵
  PID:13144
- C:\Windows\System\nuxFAbS.exe
  C:\Windows\System\nuxFAbS.exe
  2⤵
  PID:13188
- C:\Windows\System\aSkZMNb.exe
  C:\Windows\System\aSkZMNb.exe
  2⤵
  PID:13208
- C:\Windows\System\BYdLdIv.exe
  C:\Windows\System\BYdLdIv.exe
  2⤵
  PID:13228
- C:\Windows\System\RUFafoB.exe
  C:\Windows\System\RUFafoB.exe
  2⤵
  PID:13256
- C:\Windows\System\lzitiHc.exe
  C:\Windows\System\lzitiHc.exe
  2⤵
  PID:13276
- C:\Windows\System\csbfODx.exe
  C:\Windows\System\csbfODx.exe
  2⤵
  PID:12320
- C:\Windows\System\AejvUqX.exe
  C:\Windows\System\AejvUqX.exe
  2⤵
  PID:12364
- C:\Windows\System\QYBOdAU.exe
  C:\Windows\System\QYBOdAU.exe
  2⤵
  PID:12448
- C:\Windows\System\vWwJDpM.exe
  C:\Windows\System\vWwJDpM.exe
  2⤵
  PID:12424
- C:\Windows\System\IXBjUQF.exe
  C:\Windows\System\IXBjUQF.exe
  2⤵
  PID:12504
- C:\Windows\System\mFKWkcz.exe
  C:\Windows\System\mFKWkcz.exe
  2⤵
  PID:12604
- C:\Windows\System\zxLmINM.exe
  C:\Windows\System\zxLmINM.exe
  2⤵
  PID:4952
- C:\Windows\System\SWMlllW.exe
  C:\Windows\System\SWMlllW.exe
  2⤵
  PID:12712
- C:\Windows\System\GYeqppF.exe
  C:\Windows\System\GYeqppF.exe
  2⤵
  PID:12784
- C:\Windows\System\WYGmDuY.exe
  C:\Windows\System\WYGmDuY.exe
  2⤵
  PID:12856
- C:\Windows\System\FxkHvWX.exe
  C:\Windows\System\FxkHvWX.exe
  2⤵
  PID:12920
- C:\Windows\System\QSnKkKv.exe
  C:\Windows\System\QSnKkKv.exe
  2⤵
  PID:12984
- C:\Windows\System\flxdjBI.exe
  C:\Windows\System\flxdjBI.exe
  2⤵
  PID:13084
- C:\Windows\System\igSAiBn.exe
  C:\Windows\System\igSAiBn.exe
  2⤵
  PID:13100
- C:\Windows\System\reCLFtz.exe
  C:\Windows\System\reCLFtz.exe
  2⤵
  PID:13136
- C:\Windows\System\segdPPe.exe
  C:\Windows\System\segdPPe.exe
  2⤵
  PID:13204
- C:\Windows\System\rwaeUjM.exe
  C:\Windows\System\rwaeUjM.exe
  2⤵
  PID:13296
- C:\Windows\System\ITBdfDu.exe
  C:\Windows\System\ITBdfDu.exe
  2⤵
  PID:12388
- C:\Windows\System\wvbToJc.exe
  C:\Windows\System\wvbToJc.exe
  2⤵
  PID:12484
- C:\Windows\System\OYCKswl.exe
  C:\Windows\System\OYCKswl.exe
  2⤵
  PID:12572
- C:\Windows\System\HPkvxyU.exe
  C:\Windows\System\HPkvxyU.exe
  2⤵
  PID:12708
- C:\Windows\System\XGvuFzt.exe
  C:\Windows\System\XGvuFzt.exe
  2⤵
  PID:12812
- C:\Windows\System\TEFImYJ.exe
  C:\Windows\System\TEFImYJ.exe
  2⤵
  PID:13044
- C:\Windows\System\KmRvDnI.exe
  C:\Windows\System\KmRvDnI.exe
  2⤵
  PID:13124
- C:\Windows\System\BzBZzeM.exe
  C:\Windows\System\BzBZzeM.exe
  2⤵
  PID:13252
- C:\Windows\System\FKHHdsI.exe
  C:\Windows\System\FKHHdsI.exe
  2⤵
  PID:12600
- C:\Windows\System\VtkxdnL.exe
  C:\Windows\System\VtkxdnL.exe
  2⤵
  PID:4964
- C:\Windows\System\XmBBtXK.exe
  C:\Windows\System\XmBBtXK.exe
  2⤵
  PID:992
- C:\Windows\System\fSTavkw.exe
  C:\Windows\System\fSTavkw.exe
  2⤵
  PID:13336
- C:\Windows\System\qpQGBzq.exe
  C:\Windows\System\qpQGBzq.exe
  2⤵
  PID:13360
- C:\Windows\System\pqoFBAw.exe
  C:\Windows\System\pqoFBAw.exe
  2⤵
  PID:13396
- C:\Windows\System\NJPtrRA.exe
  C:\Windows\System\NJPtrRA.exe
  2⤵
  PID:13424
- C:\Windows\System\AdBMtjb.exe
  C:\Windows\System\AdBMtjb.exe
  2⤵
  PID:13448
- C:\Windows\System\mzLIAny.exe
  C:\Windows\System\mzLIAny.exe
  2⤵
  PID:13560
- C:\Windows\System\jeZrChg.exe
  C:\Windows\System\jeZrChg.exe
  2⤵
  PID:14248
- C:\Windows\System\reKZneY.exe
  C:\Windows\System\reKZneY.exe
  2⤵
  PID:14280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fprro1lv.0a2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AYqWOdq.exe

Filesize
1.8MB

MD5
59f09c2bdb1e8eefad91417e85e1184f

SHA1
5c194646490a8652e879f100f102a861168a3fb3

SHA256
f330aa9bd5e5c0045b63d93d44ed7390f5bd914ee4c8b77b7c822e595ef881e4

SHA512
81c17ac4d07154f6c642360513cb4a9af8870d38c49d40b3bf25b21f86892105e345101dd22fd22cf0c00b879513e839b9bc6b1bb00112354cc8ee8545d3bcc1

Download Submit
C:\Windows\System\AhxaKvj.exe

Filesize
1.8MB

MD5
4e4d35becde63478bfbeda0d7947a0c2

SHA1
fb020c82cb4ce3b33220021b4365ab94306ae7b6

SHA256
52115b4affd4b2938b1e61904bab16d130d5682ae4c938cd5849644f31b375f9

SHA512
59fc579d6fb8616eb4592528038856814065a9d209d40e6fca88c6bacad51943a8e08621a6f52e6931d38fa024513533b40baf238ceab52c7889b407cb50dd7b

Download Submit
C:\Windows\System\CTxwNqY.exe

Filesize
1.8MB

MD5
7ff8dc4e71ad9eca04840a83ea9e2e63

SHA1
e0f15cf3f661b3d251b10c8b6649ee72267a97f8

SHA256
6cb237a89fcd3a0875f7b12ac8fb61231b29c63e4619261c61df7581e85cd209

SHA512
53bca583724e2a9a787247a74106949047e6ce33287e57bdc5271f2c9d3dc4e64813f902502864401d101a02c2dd242bfbb17898b61542ce285426930f7f87ee

Download Submit
C:\Windows\System\DCmXcEO.exe

Filesize
1.8MB

MD5
0a07917ebf50328d1b63e239333833ce

SHA1
ccf30c221e12a5ce3b89caba5dd43f061d5fde2a

SHA256
0da5af18c575a57e8c0dd4b4bc471a4aefb039aebb1fdef328116078c5d122b5

SHA512
43234da1c868ec62551f81749893cb7fc22879cb64233f0de471a3806ab0a813b4c84e6b00d12ea21a8ca4a9e0cf6eba5ce36a01a67076d43d3488f8ed78c30f

Download Submit
C:\Windows\System\DOJOipT.exe

Filesize
1.8MB

MD5
e878e6ce24c096282180927c9585bf2a

SHA1
a4b90fbd50bd60bb0a0c45f64c08cf04b0e6fd4e

SHA256
3ec3efe6c886affbdc4aca732afca8b723c90cee07e9b508979619865b07ff9e

SHA512
8bb41dc31a4dd13e4ac07c147d517e9ddd97d05e00a7cb63de996511a0c69983f8fd3fd27232c9ad23542de1da7dc3e3f8347fd2fe521c5219a1924451e8ee06

Download Submit
C:\Windows\System\DUQvoyU.exe

Filesize
1.8MB

MD5
0ad8beda58c79cbee5d17dbaef7be494

SHA1
ce609913295627a24487e8de661655f3bdf0116f

SHA256
f1f6c5ccf6612675f55a243887fcf0700c248616aa030b2a3883f088e1950e89

SHA512
b9691d43b3ddaedaad42729bfb5e92660cb2c595606d43dd06bdccfb61ba02026290aa04af563bfb8dfde4b18dd5d1a4ee115f3a6ade8aa2223f04af81ff6d7b

Download Submit
C:\Windows\System\DaPYlFf.exe

Filesize
1.8MB

MD5
44ff1f207cc98a192b5ba4a5188fc0b8

SHA1
b14fac9185e3fc013523432a580bea4a4271369d

SHA256
b5232c9197de72239701c46df51ff3da85b86e63d2b772ab87363b3b38ea1727

SHA512
3f628dd3b4ea9c025fe9ea8d2e8cf163d8be90c5b688bcbe8d40519b9862f39aa5fd0ab43091648834026273206ac2611029c8dcf572324a20a39991e61b4f3a

Download Submit
C:\Windows\System\FhZTvsk.exe

Filesize
1.8MB

MD5
aab39383268d5987c7466d064110e616

SHA1
a16b08b30131d88afdc78c552e2306e39be1b14d

SHA256
f145d626876b93c0d30f540aa338c2cbe9a8f21f1ce1fe5eea8f86743ff1eef3

SHA512
4c8204c9cbb8f297b657585d13c322489d794c99fd0e02f315058b940d2e6018d63780fe13344c80c58da7eff681e6eaa8031562c9e8c6cda8fe5d72f2ba7337

Download Submit
C:\Windows\System\GLECqit.exe

Filesize
1.8MB

MD5
f7e4edcf03b07de8165f4c8e5a876882

SHA1
6d139b64cb8278b1f46131fd03cbf9da4a1e5d69

SHA256
029d922c31ddd94fab4a3596bb50a6c03a4dba237c88472fc213c399e4f518cf

SHA512
32a2c91ba26a341c34f57e173e2eb3fd9a3352ff5c3ca0d50411631da57e879392a41cb2d2d364b046a74e66f3b29db607eeb68ac2ef68c64d0cbeb2f20e3436

Download Submit
C:\Windows\System\IQpaXus.exe

Filesize
1.8MB

MD5
08503f366b8b8bcb583edd8cfab5061d

SHA1
4fc4ea0079bbe93a8a2fab7754e9ac224d5580e8

SHA256
f6e24bf2d16b857c6752f63541a5373f9cdea9db15ef835f8c1ecd2408805462

SHA512
f711d37ee2144f9f523c4a25a525f0a760ef8fc21da802789cc781a8aa0b00a615e74f4af55a6334c66865d651e173454fabe6411a16c4e15d3e4057775a03f6

Download Submit
C:\Windows\System\LSnelXO.exe

Filesize
1.8MB

MD5
f059ed8b47bccefa1dcf957d731dae1e

SHA1
e0c1e37ef871a4cb5b0144ef9f3ff72979b3ee40

SHA256
52fbf9444203e439c4cd53c0337189c509e4d860a30cffb146f2b92829bcf5f1

SHA512
9bea3106fe235cbdc4145efad4d3b179806dcfb2468c359f5b494ecc5dcc34e85332a4de0fa3c200a1dd40fdebf91e57861f2b529ee8b908532d5af17bdc84a5

Download Submit
C:\Windows\System\OLZfqBE.exe

Filesize
1.8MB

MD5
08b2e58381ea452d6d9ff7682a96f964

SHA1
1bca24a8ec33a62e3a17ac6616e4c5e66e921bde

SHA256
35f14955f53068c978fe0ecb1cf3c81b9cafb39598c05ab2833e0aeebbde197d

SHA512
abcd7263b8ab2bcc7cfdaf6b82c22db0773f70385d48acb7acf8910ad72ba844f7dc0e1083a5b2361342a539c00817655ba7ec7585912a9dde4264ec956c3dd9

Download Submit
C:\Windows\System\OcrzuEh.exe

Filesize
1.8MB

MD5
92adfebb08cf80779a541d828594bbc6

SHA1
0756d78d6a276685f0bf23f3446afae609289fd8

SHA256
893521937bfd939cf46e80390f77723c8e61c23014fc07708f95568f799b24d7

SHA512
b0797c71d65f4b92e4b969cb551547f9370c6ee781edd9a0a5151d19eb4cc88718fd2cc04e352ed5d4069ed53ccd13190d991e79df3fd7a88eba681c2092d56b

Download Submit
C:\Windows\System\RfGgkNI.exe

Filesize
1.8MB

MD5
84c5b770200c01a0fdb16d19087add96

SHA1
75477d9c062a254a1a74385351fb3e24eda85ea6

SHA256
5c8b2706ca2a4fa1dbeb8f1710d70b9d6648551992857e4452483d334dadd4d2

SHA512
fe00e35abe785fc06956a82f8e06bc6c5fc54c4879138fe1c24db247c8d149e1e4aa8b89b110d1954aa0db672933bdeca47cea8e13d7aaf37de955bb2fe9f2c5

Download Submit
C:\Windows\System\UntjJqu.exe

Filesize
1.8MB

MD5
2144cc120339a8e7b409d5980de80e8d

SHA1
467f42355cce86377ef35bd4e3c7a05d529d65eb

SHA256
1875cc75540f3314e980616d5c301bdbbe6a6a27426406458a369d59728eda37

SHA512
0a9f468f1ef1899e0583e9ab4fa1cd2c7916e2f112e135a5ae0c7c01b08f159ab6cafdef01c846e9770d3861803e3d78de43ad54c978076ef38f8fb880c17199

Download Submit
C:\Windows\System\WAVyvPR.exe

Filesize
1.8MB

MD5
c3ae885dc908c24609ce735675abc120

SHA1
50aa24a081f1f28faf98eca23b11382e4bb5e4d3

SHA256
e900aa818f54c846ac31a0eb1361a236bfaf8e474885f00fb89c3783c35bd26a

SHA512
2c0327a27dc8994797d8bf3d7a2c35362add2a9db340f2ade244253919603fa5c9835c960869e00ba9b4427a30ed585f9167dab953796f40fbe3464f48ae9e11

Download Submit
C:\Windows\System\WoETOoo.exe

Filesize
1.8MB

MD5
788e243c8e5f5b593a05056760dee1a7

SHA1
30a53ed14d490b6e7d0c9541e49213b3f4e16d45

SHA256
c8909bbc99b87094f62737a5ea9b7d04541c3a521fb605088b0c6864e150b66e

SHA512
5f4a405cde6fbb1d543b444e53c2a556aa708ab6d6338a9310a322ce398c92190f9070916e7c2db1edfc63b3003121e1c9110557022a09c469d71de0ceb6774a

Download Submit
C:\Windows\System\XPfamME.exe

Filesize
1.8MB

MD5
aee8d757452c27f0730bf58a193d9901

SHA1
35704a20d49afc6c7cb632b2f94a73356df995c3

SHA256
9466989ca5d407d9eb64ff2b405b9f1dbdefe63ed000f310560fedb0c15b1d0d

SHA512
4c51533141ce84bf29701d001df74a2cb8d2509afb9be48a50c81b586c527c861d51b881e125a3e0e7a161c4b8a522f5f87437ad529f9160a6e2b5c660f1330e

Download Submit
C:\Windows\System\ZABrFkC.exe

Filesize
1.8MB

MD5
a266d935241f6d9a4443b11431708461

SHA1
ee78f91ad07a949676bd57ca326a6ac7d98e68e9

SHA256
edef942bef0b14edb7c2cc95c533c974135a08f90f3dfa35601bd8d9765bdd42

SHA512
067b3785e4d0a32a98713179f5bd3889a537ce4f8734c6b5c98160083d4fa0c1d5ecd52e54b73f0a803fa5888f34e6900052b5cc94fe680c69eb7865a402b2bb

Download Submit
C:\Windows\System\ZRchZui.exe

Filesize
1.8MB

MD5
8413dd34a910598aa322a5d3a0f63368

SHA1
a4410194cdd32105e2ccbc7363818a27f7d4deda

SHA256
741d6fe80f98831a9d6b3966073d04b40ce4b24c20847d1404a037fb6b1688ce

SHA512
2c321a47a4e86aa685a052fa915fcf7ae709fbacc37295b981317c012826a4419627e3f864a0ae62c94bd89f25f89fef6471989e5dd390a57dc212102ef3d9c3

Download Submit
C:\Windows\System\ZoLbHUh.exe

Filesize
1.8MB

MD5
3d014b31c0b3b08ca57f6b565a8e17ec

SHA1
3432097836e89462e9380fd8c567f98e135d0316

SHA256
c9d2d0efec4bbaadc8b938769bfd21d0981fefdfab8a703d60619729766866c5

SHA512
2c9128b122b52fe671790c3df3488bfa655cc6a6d24a2bcfda0c41efd93cd5826b176df101664ca95149a737a325ad591852e1a9402b334af8fce3a259ccbb50

Download Submit
C:\Windows\System\aTMgLwY.exe

Filesize
1.8MB

MD5
27a585e80ed8fd1f6e0e7c176587b3bc

SHA1
dc62ecc6674cd1507486b5cf0633bb8d8000e7d9

SHA256
81512d18a303fc7ae86b983dd01f17a1c4f1bff1224279ee307fa47b75a26ae6

SHA512
90e30cd62c262e6b3a785cc127bec17923117bf4c19f4c26d82a39005eb825e25527fa48cbcf1f3a061cb58688b11465a74fec46a4d4f14ada46ff6f4a9f51c0

Download Submit
C:\Windows\System\bEHLiKX.exe

Filesize
1.8MB

MD5
42f114702d63559edd204120c3b4caa4

SHA1
d675b8b7ee70cd39b9e1c1ee65017d3b8a10032b

SHA256
e95e54b582d219b26dcb57eb832304b4f8eb22fc1d07b7b4b15621413c07d31f

SHA512
9f523d7ffdd1818e15e6559d68e20ce324de80f3ecd3caef87bfd61f796402347173d47e40e26c5b3eabd3442fd895e0a26b78be0f543467e0a9f584797731f3

Download Submit
C:\Windows\System\codLqZr.exe

Filesize
1.8MB

MD5
b894063ed44ef29824e1253ee37166d7

SHA1
4e49144798076905ff437e3aa75449283385f766

SHA256
d27bf84d1a3bfb9478bacbdfedc057ce18205eef0da9a26c0d43ff37e16dc970

SHA512
7da6d7e4cbb3deb924c2d16c9a9e827e5dde4c4cd0002fdb57651b02b60ff2fb18961b1e4f9b5ccf870e1c15625d749e04a8dac721a2cba37dd26760f34c7f98

Download Submit
C:\Windows\System\dHzFPBa.exe

Filesize
1.8MB

MD5
1e0f68c0881a88b7a1c89d1e2ed4168d

SHA1
925a60a6607a04979bc7414949cd7c7f2db99bf6

SHA256
ca7599acbe4fe39de1f3c04915fb9889d3aa951f1d30df74a14748c8595aa572

SHA512
a71f113d0faa315154d9558011989153361e7c1871d2d920ae93e261a45c2f3d49c1eec4bef1272694a616a762ef861beb25c7385989278cd3268fd772a1badf

Download Submit
C:\Windows\System\dLpFiVI.exe

Filesize
1.8MB

MD5
d92ad9a8b596511f0a39a258498aa0db

SHA1
fa48ca377403aa9b859667859d6c6b815e4ad585

SHA256
3679aa78ff01dc9367c7789f4e6f57f4c4f3906c045dcb03f9c29731b6821e9e

SHA512
aa9430798457ee91333af5883570c8126517b0b8e3b31b2fa711a6d1997a8b83a0a3eb3707ec68069c95925d10a58cb5a11b261bbb73ae4d9370093c07cbd0c1

Download Submit
C:\Windows\System\eRmclKo.exe

Filesize
1.8MB

MD5
b33c5e43263453cd2bba347a73db14c7

SHA1
3226939a2a31cd09f246edb4d5037ec658f2a16e

SHA256
bf031d262a497befcfc83ff139b4623d6044bd3c529cf6a7cb2c411bed1fa197

SHA512
b6244ed7f909a67701df72d25e72188fc6090f44a8647c27aa92dba5cbe21e2f218ca270c4f994152ce60bfde59a87f60c3f38e26dd499bb452c796e69f28270

Download Submit
C:\Windows\System\eprifxp.exe

Filesize
1.8MB

MD5
91b31840ca15e892d0191ebb5fdc8c10

SHA1
13c9481397cbb074c49f35ef4240b7a8d6541063

SHA256
0b7e962b6cdd4d1c566cb4482368ce2abb1929f7c0fddd9e9297d93969daf58b

SHA512
ba8ddf66420d4f9b055285525e93292602d4bf20b17691b222c8fdeaff19318a567989945fa6455a4c2655dffe0a7f4ac7f6b71d08cd6bca2f79ce31797309e6

Download Submit
C:\Windows\System\fYDnEFf.exe

Filesize
1.8MB

MD5
9924819f284d7e82d066fe1257979da8

SHA1
a850baabddde261f11b9ff8f33c6a698e9df33fe

SHA256
35b935e6908e1300b3c3948441428fbce2432a8c9c36d29057f772cafcd41f0a

SHA512
a3ea49966cc5330329d18b496d1eea12a89ad1cdda5ea9a372b2fd956b02b246678aa157f65bc66ac8259fd7fb72dc9e7aa4462f77f3477fd846e17631a0f676

Download Submit
C:\Windows\System\gfUVMrN.exe

Filesize
1.8MB

MD5
f99f3d520ef4c6fd439bac98eec66307

SHA1
c40ad94aa21218cb77c075f4ea45d3aaa6a211ff

SHA256
c107426d860102a7712b5aaf011906c9eb9dcf8e9a45957438465a1e94b467e2

SHA512
dbb91758959c75563eff734435f436fe309df244cff0478672aea1faef2c28d5037ee98a98971d84013ca2a530a1273b23411f648f580a28681eb7d88e70caed

Download Submit
C:\Windows\System\ifcSdvW.exe

Filesize
1.8MB

MD5
78530660de0fe7fa8d7634a3884a8819

SHA1
e8fc91ae10568de8810cb26a5e2e95c69ccba456

SHA256
d6a369ebba3ed702dcee2425c587a8b24202cfffd1dcd3ae0461dea71a268eae

SHA512
0105d983d6a5d0dc7210ad053c86fe06ccbc827b3c082252e1dd62efd96988dd2147c991f85a20a63e4b162ac72eb4e0a013829470fb7ef4d8a5afcf097dea77

Download Submit
C:\Windows\System\kvmsqLI.exe

Filesize
1.8MB

MD5
4548f9d6be6d1af673c88c8a38fe1522

SHA1
742de1460d9474b392e3da0c6b8228644c7fa7b4

SHA256
054d6eec354bf9d9f767a19148041c812c0caca53da6e469a6401cfb64ab212a

SHA512
8e693111de1465d007794ae8001be0035fdbbdbac38ca6da35ce178e7adcf1f6be51d45ae23227c144bd0532e9f69a503579c863959e2619eb7dd7bbf0abb106

Download Submit
C:\Windows\System\lqdKofJ.exe

Filesize
1.8MB

MD5
45da2af469acb3b689195fb33872148d

SHA1
8b9ed6c64ae8f034ec55004d87cfe16c28ba7a7e

SHA256
4efa15a2b0b05f64f7c5a2797112fe653d45c27ec59c568f45136737ff221f1f

SHA512
92d7db99ac457b4d150470c00f1f62ea2b3a20f97269b7e326c72fd5d100e7e7506c0a7ba110ab40e00859d6021ef40af66c24e5a45d41c3cc304351c8c83bbc

Download Submit
C:\Windows\System\nyMpigm.exe

Filesize
1.8MB

MD5
684d9f669375034b6d6137726cf64882

SHA1
599979a4e618a4e7eead1f5fdfb0937ba4d44a9b

SHA256
e8c57f85c42bb9b7f85b29da14c66efeb39483ba8daa39c0c556511eded5fd36

SHA512
4577083709799cb0fbcf955d608f9b0e190a703fd0b76e35450a838adffb251c038c2c09f648dff263a2f4547c8bcf8903ed8a642d070252b3243f8078a1307a

Download Submit
C:\Windows\System\uoWYKfr.exe

Filesize
1.8MB

MD5
f2aa86de1472678466c2a892fd64a457

SHA1
54d7840fb0c8194e6497adf3d9b3e734fed24517

SHA256
da9b7049b1698ff8b97ee2e6ea8728a3bb316f2b519ff48ac875ef13bebf8c42

SHA512
dfa0b7f494570c22b59c2306ae92fb1f87153b35cb4a900f25b813a9b71d837b6157dbcb7ce1cdf93561e181d93d93c2c2bba282ff47ffef2e44426b3ae2f571

Download Submit
C:\Windows\System\wmGrgoS.exe

Filesize
1.8MB

MD5
5ec56a25e08495250c4c4f5e23701380

SHA1
62244e3a6003365645504104ea56a10580648c01

SHA256
b60990be507799ad5486d4b914c8a044e2afc007f33852b1f413e7393f35ef1c

SHA512
25142830b471d4397f7e7aa0ed26b8abc2db7c58f9cbf07d4f8c5de1a17c8318aac5891a881c5c6fad4a75e6337101c19a3ce781e66b4c70fd179feb9b3fb30c

Download Submit
C:\Windows\System\yOtwZDV.exe

Filesize
1.8MB

MD5
d333c8519c3e718cd4f1aeb50cf09d58

SHA1
51e8b27046be169ca3255496a68d5c0d3375484a

SHA256
0fffde0c47949b929b255f2bfdc1d3271e77661c270b59d0025f00a970913d72

SHA512
89626dac8ab19b7c32efec74878ce898ece869fe8bcb3717a670b8c216cb09f1a5369d6c31d481dae215de31e7017e89f00070286f70bf1462f4e4d36453767d

Download Submit
memory/8-107-0x00007FF7861B0000-0x00007FF7865A2000-memory.dmp

Filesize
3.9MB

Download
memory/8-2563-0x00007FF7861B0000-0x00007FF7865A2000-memory.dmp

Filesize
3.9MB

Download
memory/748-114-0x00007FF628A80000-0x00007FF628E72000-memory.dmp

Filesize
3.9MB

Download
memory/748-0-0x00007FF628A80000-0x00007FF628E72000-memory.dmp

Filesize
3.9MB

Download
memory/748-1-0x0000029F9C6F0000-0x0000029F9C700000-memory.dmp

Filesize
64KB

Download
memory/1416-2569-0x00007FF669EE0000-0x00007FF66A2D2000-memory.dmp

Filesize
3.9MB

Download
memory/1416-123-0x00007FF669EE0000-0x00007FF66A2D2000-memory.dmp

Filesize
3.9MB

Download
memory/1612-2490-0x00007FF700570000-0x00007FF700962000-memory.dmp

Filesize
3.9MB

Download
memory/1612-2565-0x00007FF700570000-0x00007FF700962000-memory.dmp

Filesize
3.9MB

Download
memory/1612-105-0x00007FF700570000-0x00007FF700962000-memory.dmp

Filesize
3.9MB

Download
memory/2068-2522-0x00007FF6ECDA0000-0x00007FF6ED192000-memory.dmp

Filesize
3.9MB

Download
memory/2068-69-0x00007FF6ECDA0000-0x00007FF6ED192000-memory.dmp

Filesize
3.9MB

Download
memory/2072-46-0x00007FF823EF0000-0x00007FF8249B1000-memory.dmp

Filesize
10.8MB

Download
memory/2072-29-0x000001F7F2860000-0x000001F7F2870000-memory.dmp

Filesize
64KB

Download
memory/2072-1632-0x00007FF823EF0000-0x00007FF8249B1000-memory.dmp

Filesize
10.8MB

Download
memory/2072-1591-0x00007FF823EF0000-0x00007FF8249B1000-memory.dmp

Filesize
10.8MB

Download
memory/2072-1577-0x000001F7F2860000-0x000001F7F2870000-memory.dmp

Filesize
64KB

Download
memory/2072-86-0x000001F7F4B10000-0x000001F7F4B32000-memory.dmp

Filesize
136KB

Download
memory/2072-53-0x000001F7F2860000-0x000001F7F2870000-memory.dmp

Filesize
64KB

Download
memory/2376-2521-0x00007FF74E420000-0x00007FF74E812000-memory.dmp

Filesize
3.9MB

Download
memory/2376-52-0x00007FF74E420000-0x00007FF74E812000-memory.dmp

Filesize
3.9MB

Download
memory/2640-2525-0x00007FF723410000-0x00007FF723802000-memory.dmp

Filesize
3.9MB

Download
memory/2640-58-0x00007FF723410000-0x00007FF723802000-memory.dmp

Filesize
3.9MB

Download
memory/3112-2514-0x00007FF78F240000-0x00007FF78F632000-memory.dmp

Filesize
3.9MB

Download
memory/3112-12-0x00007FF78F240000-0x00007FF78F632000-memory.dmp

Filesize
3.9MB

Download
memory/3112-144-0x00007FF78F240000-0x00007FF78F632000-memory.dmp

Filesize
3.9MB

Download
memory/3116-76-0x00007FF667F10000-0x00007FF668302000-memory.dmp

Filesize
3.9MB

Download
memory/3116-2477-0x00007FF667F10000-0x00007FF668302000-memory.dmp

Filesize
3.9MB

Download
memory/3116-2534-0x00007FF667F10000-0x00007FF668302000-memory.dmp

Filesize
3.9MB

Download
memory/3248-119-0x00007FF70F0E0000-0x00007FF70F4D2000-memory.dmp

Filesize
3.9MB

Download
memory/3248-2568-0x00007FF70F0E0000-0x00007FF70F4D2000-memory.dmp

Filesize
3.9MB

Download
memory/3248-2491-0x00007FF70F0E0000-0x00007FF70F4D2000-memory.dmp

Filesize
3.9MB

Download
memory/3540-1004-0x00007FF69F8A0000-0x00007FF69FC92000-memory.dmp

Filesize
3.9MB

Download
memory/3540-2518-0x00007FF69F8A0000-0x00007FF69FC92000-memory.dmp

Filesize
3.9MB

Download
memory/3540-28-0x00007FF69F8A0000-0x00007FF69FC92000-memory.dmp

Filesize
3.9MB

Download
memory/3680-2528-0x00007FF77B100000-0x00007FF77B4F2000-memory.dmp

Filesize
3.9MB

Download
memory/3680-1594-0x00007FF77B100000-0x00007FF77B4F2000-memory.dmp

Filesize
3.9MB

Download
memory/3680-67-0x00007FF77B100000-0x00007FF77B4F2000-memory.dmp

Filesize
3.9MB

Download
memory/3744-140-0x00007FF601360000-0x00007FF601752000-memory.dmp

Filesize
3.9MB

Download
memory/3744-2575-0x00007FF601360000-0x00007FF601752000-memory.dmp

Filesize
3.9MB

Download
memory/4296-73-0x00007FF6B13D0000-0x00007FF6B17C2000-memory.dmp

Filesize
3.9MB

Download
memory/4296-2530-0x00007FF6B13D0000-0x00007FF6B17C2000-memory.dmp

Filesize
3.9MB

Download
memory/4320-72-0x00007FF6C2D40000-0x00007FF6C3132000-memory.dmp

Filesize
3.9MB

Download
memory/4320-2532-0x00007FF6C2D40000-0x00007FF6C3132000-memory.dmp

Filesize
3.9MB

Download
memory/4400-23-0x00007FF6A3370000-0x00007FF6A3762000-memory.dmp

Filesize
3.9MB

Download
memory/4400-145-0x00007FF6A3370000-0x00007FF6A3762000-memory.dmp

Filesize
3.9MB

Download
memory/4400-2517-0x00007FF6A3370000-0x00007FF6A3762000-memory.dmp

Filesize
3.9MB

Download
memory/4528-2577-0x00007FF6870B0000-0x00007FF6874A2000-memory.dmp

Filesize
3.9MB

Download
memory/4528-143-0x00007FF6870B0000-0x00007FF6874A2000-memory.dmp

Filesize
3.9MB

Download
memory/4528-2547-0x00007FF6870B0000-0x00007FF6874A2000-memory.dmp

Filesize
3.9MB

Download
memory/4748-97-0x00007FF7162B0000-0x00007FF7166A2000-memory.dmp

Filesize
3.9MB

Download
memory/4748-2561-0x00007FF7162B0000-0x00007FF7166A2000-memory.dmp

Filesize
3.9MB

Download
memory/4824-2527-0x00007FF60C7E0000-0x00007FF60CBD2000-memory.dmp

Filesize
3.9MB

Download
memory/4824-70-0x00007FF60C7E0000-0x00007FF60CBD2000-memory.dmp

Filesize
3.9MB

Download
memory/4880-139-0x00007FF7C9F50000-0x00007FF7CA342000-memory.dmp

Filesize
3.9MB

Download
memory/4880-2571-0x00007FF7C9F50000-0x00007FF7CA342000-memory.dmp

Filesize
3.9MB

Download
memory/4960-2492-0x00007FF7990B0000-0x00007FF7994A2000-memory.dmp

Filesize
3.9MB

Download
memory/4960-2573-0x00007FF7990B0000-0x00007FF7994A2000-memory.dmp

Filesize
3.9MB

Download
memory/4960-128-0x00007FF7990B0000-0x00007FF7994A2000-memory.dmp

Filesize
3.9MB

Download
memory/5072-138-0x00007FF69DE50000-0x00007FF69E242000-memory.dmp

Filesize
3.9MB

Download
memory/5072-2512-0x00007FF69DE50000-0x00007FF69E242000-memory.dmp

Filesize
3.9MB

Download
memory/5072-6-0x00007FF69DE50000-0x00007FF69E242000-memory.dmp

Filesize
3.9MB

Download