xmrig | da2e87ebad6fec75a4a3e91232f444ff0aa00b1d317082c4f476206a6eae6c95

Analysis

max time kernel
40s
max time network
41s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 14:01

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
Size

1.9MB
MD5

07d4d97803f409818821ae052de4dc62
SHA1

aa618a8442cb4ed2dbcb581756a9963f2a98b970
SHA256

da2e87ebad6fec75a4a3e91232f444ff0aa00b1d317082c4f476206a6eae6c95
SHA512

16ceff9224ade3dd83b0f0553ec12c5d14a15c2f5b603319a123ea96c84c8311d42434d13b3f6d122ff8824a7bca0d43d5ea0b3eaa49a40dec2dd1094e1496fb
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+Ue0Z:NABE

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 21 IoCs

miner

resource	yara_rule
behavioral2/memory/4020-422-0x00007FF7EF170000-0x00007FF7EF562000-memory.dmp	xmrig
behavioral2/memory/1492-494-0x00007FF619C40000-0x00007FF61A032000-memory.dmp	xmrig
behavioral2/memory/5060-555-0x00007FF7CB5C0000-0x00007FF7CB9B2000-memory.dmp	xmrig
behavioral2/memory/2952-561-0x00007FF665260000-0x00007FF665652000-memory.dmp	xmrig
behavioral2/memory/3720-563-0x00007FF697900000-0x00007FF697CF2000-memory.dmp	xmrig
behavioral2/memory/4144-562-0x00007FF6D3D70000-0x00007FF6D4162000-memory.dmp	xmrig
behavioral2/memory/2716-560-0x00007FF652FE0000-0x00007FF6533D2000-memory.dmp	xmrig
behavioral2/memory/4620-559-0x00007FF66BA40000-0x00007FF66BE32000-memory.dmp	xmrig
behavioral2/memory/468-558-0x00007FF7A9840000-0x00007FF7A9C32000-memory.dmp	xmrig
behavioral2/memory/4292-557-0x00007FF601040000-0x00007FF601432000-memory.dmp	xmrig
behavioral2/memory/1336-556-0x00007FF7D9C70000-0x00007FF7DA062000-memory.dmp	xmrig
behavioral2/memory/4736-554-0x00007FF6432A0000-0x00007FF643692000-memory.dmp	xmrig
behavioral2/memory/3808-550-0x00007FF651FE0000-0x00007FF6523D2000-memory.dmp	xmrig
behavioral2/memory/3956-362-0x00007FF7083D0000-0x00007FF7087C2000-memory.dmp	xmrig
behavioral2/memory/1832-314-0x00007FF6DAD20000-0x00007FF6DB112000-memory.dmp	xmrig
behavioral2/memory/4624-311-0x00007FF75FA90000-0x00007FF75FE82000-memory.dmp	xmrig
behavioral2/memory/3364-263-0x00007FF6142C0000-0x00007FF6146B2000-memory.dmp	xmrig
behavioral2/memory/3756-212-0x00007FF6C5320000-0x00007FF6C5712000-memory.dmp	xmrig
behavioral2/memory/752-183-0x00007FF78B1E0000-0x00007FF78B5D2000-memory.dmp	xmrig
behavioral2/memory/1516-136-0x00007FF796130000-0x00007FF796522000-memory.dmp	xmrig
behavioral2/memory/4336-90-0x00007FF7A7CC0000-0x00007FF7A80B2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4336	STVJjPJ.exe
1516	xidRcLk.exe
752	zOfNRJj.exe
2952	GnAkpwo.exe
3756	tfxpMsJ.exe
3364	gejvdpm.exe
4624	SIhkoXz.exe
1832	aUWamWr.exe
3956	LALBSKp.exe
4020	pGcUxgu.exe
1492	wyneyYA.exe
4144	PxujfzA.exe
3808	vTbpKWq.exe
4736	HZccwfF.exe
5060	VSRJSdu.exe
1336	TLaakHh.exe
3720	mlNFQnh.exe
4292	kOxLtAR.exe
468	Jjjwudg.exe
4620	MSjQNpA.exe
2716	IReaNVB.exe
3996	GKWtbcu.exe
1452	BqnpLMN.exe
1776	qqsdFuo.exe
1904	cLBzAfE.exe
4344	adOrAAk.exe
4628	zINifqe.exe
808	FFIyhpe.exe
3376	rvgfCyq.exe
1256	bXDLhGZ.exe
3608	NsczrPO.exe
864	wJuQbCS.exe
4332	lOKqXEv.exe
2608	MIZeBoA.exe
3888	SSTeOPn.exe
4524	ASFsTmE.exe
4100	CwwnrpI.exe
4140	eYVVICG.exe
3792	XXUqoWy.exe
3972	iTNbSbf.exe
3464	yYyvVHD.exe
1036	RpRyYVw.exe
4404	NosQPce.exe
3852	IfFRtXk.exe
3976	kfHuUnl.exe
4152	XNEcEEX.exe
2224	ijtXLpt.exe
1068	WeAmaQx.exe
3344	VxtCigt.exe
2440	YQCazyS.exe
1276	PKGdJLl.exe
3484	OZXyKyz.exe
5028	uJVHRDE.exe
2576	eDmtpnp.exe
2684	hLhzFYf.exe
4284	EXWoCWQ.exe
4604	nXwCVCH.exe
1076	ZEcFHGx.exe
400	Qmiqiav.exe
2000	vqLGbpz.exe
4088	oCxlqiQ.exe
4548	gXfkPgb.exe
4060	UqNHiem.exe
5068	cyKjght.exe

UPX packed file 61 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2612-0-0x00007FF730E90000-0x00007FF731282000-memory.dmp	upx
behavioral2/files/0x000a000000023b9b-6.dat	upx
behavioral2/files/0x000a000000023b9a-10.dat	upx
behavioral2/files/0x000a000000023b9c-16.dat	upx
behavioral2/files/0x000a000000023ba0-40.dat	upx
behavioral2/files/0x000a000000023b9f-36.dat	upx
behavioral2/files/0x000a000000023b9d-28.dat	upx
behavioral2/files/0x000a000000023ba2-46.dat	upx
behavioral2/files/0x000a000000023ba1-45.dat	upx
behavioral2/files/0x000b000000023b96-17.dat	upx
behavioral2/files/0x000a000000023b9e-35.dat	upx
behavioral2/files/0x000a000000023ba5-69.dat	upx
behavioral2/files/0x000a000000023bac-164.dat	upx
behavioral2/files/0x0031000000023bbf-189.dat	upx
behavioral2/memory/4020-422-0x00007FF7EF170000-0x00007FF7EF562000-memory.dmp	upx
behavioral2/memory/1492-494-0x00007FF619C40000-0x00007FF61A032000-memory.dmp	upx
behavioral2/memory/5060-555-0x00007FF7CB5C0000-0x00007FF7CB9B2000-memory.dmp	upx
behavioral2/memory/2952-561-0x00007FF665260000-0x00007FF665652000-memory.dmp	upx
behavioral2/memory/3720-563-0x00007FF697900000-0x00007FF697CF2000-memory.dmp	upx
behavioral2/memory/4144-562-0x00007FF6D3D70000-0x00007FF6D4162000-memory.dmp	upx
behavioral2/memory/2716-560-0x00007FF652FE0000-0x00007FF6533D2000-memory.dmp	upx
behavioral2/memory/4620-559-0x00007FF66BA40000-0x00007FF66BE32000-memory.dmp	upx
behavioral2/memory/468-558-0x00007FF7A9840000-0x00007FF7A9C32000-memory.dmp	upx
behavioral2/memory/4292-557-0x00007FF601040000-0x00007FF601432000-memory.dmp	upx
behavioral2/memory/1336-556-0x00007FF7D9C70000-0x00007FF7DA062000-memory.dmp	upx
behavioral2/memory/4736-554-0x00007FF6432A0000-0x00007FF643692000-memory.dmp	upx
behavioral2/memory/3808-550-0x00007FF651FE0000-0x00007FF6523D2000-memory.dmp	upx
behavioral2/memory/3956-362-0x00007FF7083D0000-0x00007FF7087C2000-memory.dmp	upx
behavioral2/memory/1832-314-0x00007FF6DAD20000-0x00007FF6DB112000-memory.dmp	upx
behavioral2/memory/4624-311-0x00007FF75FA90000-0x00007FF75FE82000-memory.dmp	upx
behavioral2/memory/3364-263-0x00007FF6142C0000-0x00007FF6146B2000-memory.dmp	upx
behavioral2/memory/3756-212-0x00007FF6C5320000-0x00007FF6C5712000-memory.dmp	upx
behavioral2/files/0x000a000000023bb7-184.dat	upx
behavioral2/memory/752-183-0x00007FF78B1E0000-0x00007FF78B5D2000-memory.dmp	upx
behavioral2/files/0x0031000000023bbd-182.dat	upx
behavioral2/files/0x000a000000023ba7-172.dat	upx
behavioral2/files/0x000a000000023bad-168.dat	upx
behavioral2/files/0x000a000000023bbc-167.dat	upx
behavioral2/files/0x000a000000023bbb-166.dat	upx
behavioral2/files/0x000a000000023bb6-163.dat	upx
behavioral2/files/0x000a000000023bba-162.dat	upx
behavioral2/files/0x000a000000023bb9-159.dat	upx
behavioral2/files/0x000a000000023baa-156.dat	upx
behavioral2/files/0x000a000000023ba4-148.dat	upx
behavioral2/files/0x000a000000023ba9-147.dat	upx
behavioral2/files/0x0031000000023bbe-187.dat	upx
behavioral2/files/0x000a000000023bae-176.dat	upx
behavioral2/memory/1516-136-0x00007FF796130000-0x00007FF796522000-memory.dmp	upx
behavioral2/files/0x000a000000023ba6-132.dat	upx
behavioral2/files/0x000a000000023bb4-126.dat	upx
behavioral2/files/0x000a000000023bb3-125.dat	upx
behavioral2/files/0x000a000000023bb2-155.dat	upx
behavioral2/files/0x000a000000023bb8-144.dat	upx
behavioral2/files/0x000a000000023bb1-118.dat	upx
behavioral2/files/0x000a000000023bb0-117.dat	upx
behavioral2/files/0x000a000000023baf-115.dat	upx
behavioral2/files/0x000a000000023ba8-113.dat	upx
behavioral2/files/0x000a000000023bab-101.dat	upx
behavioral2/files/0x000a000000023bb5-127.dat	upx
behavioral2/memory/4336-90-0x00007FF7A7CC0000-0x00007FF7A80B2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba3-82.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\dqydftt.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\uoyQIRM.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\pbwAVOs.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\QZFkRbn.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\KyBHSBy.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\zUAOXTS.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\oRqmxGN.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\zKEHMlk.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\KWTeUpU.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\QZYoOOi.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\EWlOhiO.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\OtKBhrY.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\qKTdYFE.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\kiTLmbp.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\YqLUJLV.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\RgAshhO.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\vRGEzmO.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\SxpQqHB.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\YVxXaNJ.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\uyQFwSa.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\BeimMyy.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\ttPtqLZ.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\RJbnjdO.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\vguGyXM.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\igOTzqF.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\TvgVLWR.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\iiaeSgA.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\BRogPAL.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\IFPdnRt.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\ihITDuX.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\lOkyuzs.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\DEIKrdB.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\FMJUGPf.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\xVVqKYT.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\ZMZNCSF.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\Lmegmoq.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\EDZrthX.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\WUkrekh.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\uhWCHya.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\kqumMIv.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\IwRdqeV.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\BbFnEDK.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\KUDbioX.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\qluPVVJ.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\AtUVVnw.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\WyQIkmm.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\KtNFFvR.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\mSMighr.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\DRyygWY.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\ViiJfqm.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\FMSspmU.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\splTsGp.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\TArWQzQ.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\BSmcWUN.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\skeeCJU.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\izwKQtx.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\bTzaTsF.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\fYLafYh.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\HJypoKH.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\YoxBxBP.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\MJcuNbr.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\xidRcLk.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\LALBSKp.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
File created	C:\Windows\System\vyFNDgd.exe	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4788	powershell.exe
4788	powershell.exe
4788	powershell.exe
4788	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
Token: SeDebugPrivilege	4788	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 4788	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	85
PID 2612 wrote to memory of 4788	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	85
PID 2612 wrote to memory of 4336	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	86
PID 2612 wrote to memory of 4336	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	86
PID 2612 wrote to memory of 1516	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	87
PID 2612 wrote to memory of 1516	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	87
PID 2612 wrote to memory of 752	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	88
PID 2612 wrote to memory of 752	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	88
PID 2612 wrote to memory of 2952	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	89
PID 2612 wrote to memory of 2952	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	89
PID 2612 wrote to memory of 3756	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	90
PID 2612 wrote to memory of 3756	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	90
PID 2612 wrote to memory of 3364	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	91
PID 2612 wrote to memory of 3364	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	91
PID 2612 wrote to memory of 4624	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	92
PID 2612 wrote to memory of 4624	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	92
PID 2612 wrote to memory of 1832	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	93
PID 2612 wrote to memory of 1832	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	93
PID 2612 wrote to memory of 3956	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	94
PID 2612 wrote to memory of 3956	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	94
PID 2612 wrote to memory of 4020	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	95
PID 2612 wrote to memory of 4020	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	95
PID 2612 wrote to memory of 1492	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	96
PID 2612 wrote to memory of 1492	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	96
PID 2612 wrote to memory of 4144	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	97
PID 2612 wrote to memory of 4144	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	97
PID 2612 wrote to memory of 3808	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	98
PID 2612 wrote to memory of 3808	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	98
PID 2612 wrote to memory of 4736	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	99
PID 2612 wrote to memory of 4736	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	99
PID 2612 wrote to memory of 5060	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	100
PID 2612 wrote to memory of 5060	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	100
PID 2612 wrote to memory of 1336	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	101
PID 2612 wrote to memory of 1336	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	101
PID 2612 wrote to memory of 3720	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	102
PID 2612 wrote to memory of 3720	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	102
PID 2612 wrote to memory of 4292	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	103
PID 2612 wrote to memory of 4292	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	103
PID 2612 wrote to memory of 468	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	104
PID 2612 wrote to memory of 468	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	104
PID 2612 wrote to memory of 4620	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	105
PID 2612 wrote to memory of 4620	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	105
PID 2612 wrote to memory of 2716	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	106
PID 2612 wrote to memory of 2716	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	106
PID 2612 wrote to memory of 3996	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	107
PID 2612 wrote to memory of 3996	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	107
PID 2612 wrote to memory of 1452	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	108
PID 2612 wrote to memory of 1452	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	108
PID 2612 wrote to memory of 1776	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	109
PID 2612 wrote to memory of 1776	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	109
PID 2612 wrote to memory of 1904	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	110
PID 2612 wrote to memory of 1904	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	110
PID 2612 wrote to memory of 3608	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	111
PID 2612 wrote to memory of 3608	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	111
PID 2612 wrote to memory of 4344	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	112
PID 2612 wrote to memory of 4344	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	112
PID 2612 wrote to memory of 4628	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	113
PID 2612 wrote to memory of 4628	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	113
PID 2612 wrote to memory of 808	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	114
PID 2612 wrote to memory of 808	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	114
PID 2612 wrote to memory of 2608	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	115
PID 2612 wrote to memory of 2608	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	115
PID 2612 wrote to memory of 3376	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	116
PID 2612 wrote to memory of 3376	2612	07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\07d4d97803f409818821ae052de4dc62_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4788
- C:\Windows\System\STVJjPJ.exe
  C:\Windows\System\STVJjPJ.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\xidRcLk.exe
  C:\Windows\System\xidRcLk.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\zOfNRJj.exe
  C:\Windows\System\zOfNRJj.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\GnAkpwo.exe
  C:\Windows\System\GnAkpwo.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\tfxpMsJ.exe
  C:\Windows\System\tfxpMsJ.exe
  2⤵
  - Executes dropped EXE
  PID:3756
- C:\Windows\System\gejvdpm.exe
  C:\Windows\System\gejvdpm.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System\SIhkoXz.exe
  C:\Windows\System\SIhkoXz.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\aUWamWr.exe
  C:\Windows\System\aUWamWr.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\LALBSKp.exe
  C:\Windows\System\LALBSKp.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\pGcUxgu.exe
  C:\Windows\System\pGcUxgu.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\wyneyYA.exe
  C:\Windows\System\wyneyYA.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\PxujfzA.exe
  C:\Windows\System\PxujfzA.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\vTbpKWq.exe
  C:\Windows\System\vTbpKWq.exe
  2⤵
  - Executes dropped EXE
  PID:3808
- C:\Windows\System\HZccwfF.exe
  C:\Windows\System\HZccwfF.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\VSRJSdu.exe
  C:\Windows\System\VSRJSdu.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\TLaakHh.exe
  C:\Windows\System\TLaakHh.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\mlNFQnh.exe
  C:\Windows\System\mlNFQnh.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\kOxLtAR.exe
  C:\Windows\System\kOxLtAR.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\Jjjwudg.exe
  C:\Windows\System\Jjjwudg.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\MSjQNpA.exe
  C:\Windows\System\MSjQNpA.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\IReaNVB.exe
  C:\Windows\System\IReaNVB.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\GKWtbcu.exe
  C:\Windows\System\GKWtbcu.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\BqnpLMN.exe
  C:\Windows\System\BqnpLMN.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\qqsdFuo.exe
  C:\Windows\System\qqsdFuo.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\cLBzAfE.exe
  C:\Windows\System\cLBzAfE.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\NsczrPO.exe
  C:\Windows\System\NsczrPO.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\adOrAAk.exe
  C:\Windows\System\adOrAAk.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\zINifqe.exe
  C:\Windows\System\zINifqe.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\FFIyhpe.exe
  C:\Windows\System\FFIyhpe.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\MIZeBoA.exe
  C:\Windows\System\MIZeBoA.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\rvgfCyq.exe
  C:\Windows\System\rvgfCyq.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\bXDLhGZ.exe
  C:\Windows\System\bXDLhGZ.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\wJuQbCS.exe
  C:\Windows\System\wJuQbCS.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\lOKqXEv.exe
  C:\Windows\System\lOKqXEv.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\SSTeOPn.exe
  C:\Windows\System\SSTeOPn.exe
  2⤵
  - Executes dropped EXE
  PID:3888
- C:\Windows\System\ASFsTmE.exe
  C:\Windows\System\ASFsTmE.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\CwwnrpI.exe
  C:\Windows\System\CwwnrpI.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\eYVVICG.exe
  C:\Windows\System\eYVVICG.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\XXUqoWy.exe
  C:\Windows\System\XXUqoWy.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System\iTNbSbf.exe
  C:\Windows\System\iTNbSbf.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\YQCazyS.exe
  C:\Windows\System\YQCazyS.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\yYyvVHD.exe
  C:\Windows\System\yYyvVHD.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\RpRyYVw.exe
  C:\Windows\System\RpRyYVw.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\NosQPce.exe
  C:\Windows\System\NosQPce.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\IfFRtXk.exe
  C:\Windows\System\IfFRtXk.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\kfHuUnl.exe
  C:\Windows\System\kfHuUnl.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\XNEcEEX.exe
  C:\Windows\System\XNEcEEX.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\ijtXLpt.exe
  C:\Windows\System\ijtXLpt.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\WeAmaQx.exe
  C:\Windows\System\WeAmaQx.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\VxtCigt.exe
  C:\Windows\System\VxtCigt.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System\PKGdJLl.exe
  C:\Windows\System\PKGdJLl.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\OZXyKyz.exe
  C:\Windows\System\OZXyKyz.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\uJVHRDE.exe
  C:\Windows\System\uJVHRDE.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\eDmtpnp.exe
  C:\Windows\System\eDmtpnp.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\hLhzFYf.exe
  C:\Windows\System\hLhzFYf.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\EXWoCWQ.exe
  C:\Windows\System\EXWoCWQ.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\nXwCVCH.exe
  C:\Windows\System\nXwCVCH.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\ZEcFHGx.exe
  C:\Windows\System\ZEcFHGx.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\Qmiqiav.exe
  C:\Windows\System\Qmiqiav.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\vqLGbpz.exe
  C:\Windows\System\vqLGbpz.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\oCxlqiQ.exe
  C:\Windows\System\oCxlqiQ.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\gXfkPgb.exe
  C:\Windows\System\gXfkPgb.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\UqNHiem.exe
  C:\Windows\System\UqNHiem.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\cyKjght.exe
  C:\Windows\System\cyKjght.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\pOQTJZP.exe
  C:\Windows\System\pOQTJZP.exe
  2⤵
  PID:884
- C:\Windows\System\lTjIDMw.exe
  C:\Windows\System\lTjIDMw.exe
  2⤵
  PID:4720
- C:\Windows\System\ivhJDxF.exe
  C:\Windows\System\ivhJDxF.exe
  2⤵
  PID:1896
- C:\Windows\System\xhDQKIX.exe
  C:\Windows\System\xhDQKIX.exe
  2⤵
  PID:4920
- C:\Windows\System\PUbBRKc.exe
  C:\Windows\System\PUbBRKc.exe
  2⤵
  PID:2240
- C:\Windows\System\adQYwPp.exe
  C:\Windows\System\adQYwPp.exe
  2⤵
  PID:3600
- C:\Windows\System\VpvgrEP.exe
  C:\Windows\System\VpvgrEP.exe
  2⤵
  PID:1764
- C:\Windows\System\ydNMcLu.exe
  C:\Windows\System\ydNMcLu.exe
  2⤵
  PID:3860
- C:\Windows\System\psuBjgU.exe
  C:\Windows\System\psuBjgU.exe
  2⤵
  PID:4276
- C:\Windows\System\YzhBGfu.exe
  C:\Windows\System\YzhBGfu.exe
  2⤵
  PID:748
- C:\Windows\System\GUOWKvo.exe
  C:\Windows\System\GUOWKvo.exe
  2⤵
  PID:2020
- C:\Windows\System\FFSdXEQ.exe
  C:\Windows\System\FFSdXEQ.exe
  2⤵
  PID:1676
- C:\Windows\System\qnmjEOv.exe
  C:\Windows\System\qnmjEOv.exe
  2⤵
  PID:5136
- C:\Windows\System\wBdOaod.exe
  C:\Windows\System\wBdOaod.exe
  2⤵
  PID:5220
- C:\Windows\System\yptNSom.exe
  C:\Windows\System\yptNSom.exe
  2⤵
  PID:5264
- C:\Windows\System\oPNJWAs.exe
  C:\Windows\System\oPNJWAs.exe
  2⤵
  PID:5280
- C:\Windows\System\ANmaUij.exe
  C:\Windows\System\ANmaUij.exe
  2⤵
  PID:5304
- C:\Windows\System\SJjxhfZ.exe
  C:\Windows\System\SJjxhfZ.exe
  2⤵
  PID:5324
- C:\Windows\System\tHbVzku.exe
  C:\Windows\System\tHbVzku.exe
  2⤵
  PID:5348
- C:\Windows\System\QeqPfJB.exe
  C:\Windows\System\QeqPfJB.exe
  2⤵
  PID:5368
- C:\Windows\System\vKMPKbu.exe
  C:\Windows\System\vKMPKbu.exe
  2⤵
  PID:5388
- C:\Windows\System\kKmwpcW.exe
  C:\Windows\System\kKmwpcW.exe
  2⤵
  PID:5412
- C:\Windows\System\ZgQYRMi.exe
  C:\Windows\System\ZgQYRMi.exe
  2⤵
  PID:5436
- C:\Windows\System\EcsRwMG.exe
  C:\Windows\System\EcsRwMG.exe
  2⤵
  PID:5460
- C:\Windows\System\fBsWbnJ.exe
  C:\Windows\System\fBsWbnJ.exe
  2⤵
  PID:5480
- C:\Windows\System\rUasyYq.exe
  C:\Windows\System\rUasyYq.exe
  2⤵
  PID:5496
- C:\Windows\System\btvTCxk.exe
  C:\Windows\System\btvTCxk.exe
  2⤵
  PID:5512
- C:\Windows\System\OxbMeGM.exe
  C:\Windows\System\OxbMeGM.exe
  2⤵
  PID:5536
- C:\Windows\System\feozoua.exe
  C:\Windows\System\feozoua.exe
  2⤵
  PID:5556
- C:\Windows\System\aRdSqfJ.exe
  C:\Windows\System\aRdSqfJ.exe
  2⤵
  PID:5600
- C:\Windows\System\fAzNImW.exe
  C:\Windows\System\fAzNImW.exe
  2⤵
  PID:5624
- C:\Windows\System\tLCESUS.exe
  C:\Windows\System\tLCESUS.exe
  2⤵
  PID:5648
- C:\Windows\System\cLfEDNz.exe
  C:\Windows\System\cLfEDNz.exe
  2⤵
  PID:5672
- C:\Windows\System\rNPDqiE.exe
  C:\Windows\System\rNPDqiE.exe
  2⤵
  PID:5688
- C:\Windows\System\zgouwnJ.exe
  C:\Windows\System\zgouwnJ.exe
  2⤵
  PID:5712
- C:\Windows\System\wvbxPyp.exe
  C:\Windows\System\wvbxPyp.exe
  2⤵
  PID:5732
- C:\Windows\System\UvsXOLZ.exe
  C:\Windows\System\UvsXOLZ.exe
  2⤵
  PID:5748
- C:\Windows\System\Nrpoets.exe
  C:\Windows\System\Nrpoets.exe
  2⤵
  PID:5788
- C:\Windows\System\uhWCHya.exe
  C:\Windows\System\uhWCHya.exe
  2⤵
  PID:5848
- C:\Windows\System\dZgYzNt.exe
  C:\Windows\System\dZgYzNt.exe
  2⤵
  PID:5868
- C:\Windows\System\edZisCb.exe
  C:\Windows\System\edZisCb.exe
  2⤵
  PID:5888
- C:\Windows\System\pksZfxM.exe
  C:\Windows\System\pksZfxM.exe
  2⤵
  PID:5908
- C:\Windows\System\XJiLuHm.exe
  C:\Windows\System\XJiLuHm.exe
  2⤵
  PID:5928
- C:\Windows\System\qVcDPPv.exe
  C:\Windows\System\qVcDPPv.exe
  2⤵
  PID:5944
- C:\Windows\System\xYqmnFk.exe
  C:\Windows\System\xYqmnFk.exe
  2⤵
  PID:5964
- C:\Windows\System\cEJLymm.exe
  C:\Windows\System\cEJLymm.exe
  2⤵
  PID:5992
- C:\Windows\System\uAaOHfG.exe
  C:\Windows\System\uAaOHfG.exe
  2⤵
  PID:6008
- C:\Windows\System\nBqLhVu.exe
  C:\Windows\System\nBqLhVu.exe
  2⤵
  PID:6028
- C:\Windows\System\idDYBjH.exe
  C:\Windows\System\idDYBjH.exe
  2⤵
  PID:6048
- C:\Windows\System\GYzGxop.exe
  C:\Windows\System\GYzGxop.exe
  2⤵
  PID:6076
- C:\Windows\System\JyOleQw.exe
  C:\Windows\System\JyOleQw.exe
  2⤵
  PID:6092
- C:\Windows\System\cNUHPuv.exe
  C:\Windows\System\cNUHPuv.exe
  2⤵
  PID:6116
- C:\Windows\System\GYgdMVT.exe
  C:\Windows\System\GYgdMVT.exe
  2⤵
  PID:6140
- C:\Windows\System\yHQWlDA.exe
  C:\Windows\System\yHQWlDA.exe
  2⤵
  PID:4460
- C:\Windows\System\damjnSR.exe
  C:\Windows\System\damjnSR.exe
  2⤵
  PID:856
- C:\Windows\System\BmeHwKB.exe
  C:\Windows\System\BmeHwKB.exe
  2⤵
  PID:2300
- C:\Windows\System\ZqXxmgG.exe
  C:\Windows\System\ZqXxmgG.exe
  2⤵
  PID:4400
- C:\Windows\System\EaiSXej.exe
  C:\Windows\System\EaiSXej.exe
  2⤵
  PID:4680
- C:\Windows\System\ZMUeKOJ.exe
  C:\Windows\System\ZMUeKOJ.exe
  2⤵
  PID:5204
- C:\Windows\System\tFmfTzx.exe
  C:\Windows\System\tFmfTzx.exe
  2⤵
  PID:4572
- C:\Windows\System\hUkwEhE.exe
  C:\Windows\System\hUkwEhE.exe
  2⤵
  PID:2100
- C:\Windows\System\BlzBcli.exe
  C:\Windows\System\BlzBcli.exe
  2⤵
  PID:1944
- C:\Windows\System\mxWDnSR.exe
  C:\Windows\System\mxWDnSR.exe
  2⤵
  PID:4236
- C:\Windows\System\icOtWjx.exe
  C:\Windows\System\icOtWjx.exe
  2⤵
  PID:2012
- C:\Windows\System\KwPNvsD.exe
  C:\Windows\System\KwPNvsD.exe
  2⤵
  PID:876
- C:\Windows\System\SSTUZEh.exe
  C:\Windows\System\SSTUZEh.exe
  2⤵
  PID:4396
- C:\Windows\System\OMZMgva.exe
  C:\Windows\System\OMZMgva.exe
  2⤵
  PID:5636
- C:\Windows\System\zBDbdpj.exe
  C:\Windows\System\zBDbdpj.exe
  2⤵
  PID:5724
- C:\Windows\System\uibOWrn.exe
  C:\Windows\System\uibOWrn.exe
  2⤵
  PID:3648
- C:\Windows\System\TDaNBHf.exe
  C:\Windows\System\TDaNBHf.exe
  2⤵
  PID:2548
- C:\Windows\System\oUhsXvU.exe
  C:\Windows\System\oUhsXvU.exe
  2⤵
  PID:5740
- C:\Windows\System\fHjvlyQ.exe
  C:\Windows\System\fHjvlyQ.exe
  2⤵
  PID:4464
- C:\Windows\System\urqpUai.exe
  C:\Windows\System\urqpUai.exe
  2⤵
  PID:5428
- C:\Windows\System\ElzzKAC.exe
  C:\Windows\System\ElzzKAC.exe
  2⤵
  PID:5904
- C:\Windows\System\JKYYlwN.exe
  C:\Windows\System\JKYYlwN.exe
  2⤵
  PID:6040
- C:\Windows\System\JTyUsCJ.exe
  C:\Windows\System\JTyUsCJ.exe
  2⤵
  PID:6068
- C:\Windows\System\GBLiugY.exe
  C:\Windows\System\GBLiugY.exe
  2⤵
  PID:6128
- C:\Windows\System\MzKnAyM.exe
  C:\Windows\System\MzKnAyM.exe
  2⤵
  PID:5664
- C:\Windows\System\icCdzYH.exe
  C:\Windows\System\icCdzYH.exe
  2⤵
  PID:6148
- C:\Windows\System\VYLaSUr.exe
  C:\Windows\System\VYLaSUr.exe
  2⤵
  PID:6164
- C:\Windows\System\pHrVJio.exe
  C:\Windows\System\pHrVJio.exe
  2⤵
  PID:6188
- C:\Windows\System\NVQkYUZ.exe
  C:\Windows\System\NVQkYUZ.exe
  2⤵
  PID:6208
- C:\Windows\System\dcaUDmR.exe
  C:\Windows\System\dcaUDmR.exe
  2⤵
  PID:6268
- C:\Windows\System\IRCeGJs.exe
  C:\Windows\System\IRCeGJs.exe
  2⤵
  PID:6292
- C:\Windows\System\bswyWIv.exe
  C:\Windows\System\bswyWIv.exe
  2⤵
  PID:6312
- C:\Windows\System\MtZPcUo.exe
  C:\Windows\System\MtZPcUo.exe
  2⤵
  PID:6332
- C:\Windows\System\UdpnYBB.exe
  C:\Windows\System\UdpnYBB.exe
  2⤵
  PID:6352
- C:\Windows\System\cXHzlgb.exe
  C:\Windows\System\cXHzlgb.exe
  2⤵
  PID:6372
- C:\Windows\System\xaywwcx.exe
  C:\Windows\System\xaywwcx.exe
  2⤵
  PID:6388
- C:\Windows\System\SsmVUcu.exe
  C:\Windows\System\SsmVUcu.exe
  2⤵
  PID:6404
- C:\Windows\System\BtmQLpR.exe
  C:\Windows\System\BtmQLpR.exe
  2⤵
  PID:6424
- C:\Windows\System\oVqJKyb.exe
  C:\Windows\System\oVqJKyb.exe
  2⤵
  PID:6440
- C:\Windows\System\yRllaiq.exe
  C:\Windows\System\yRllaiq.exe
  2⤵
  PID:6464
- C:\Windows\System\mJdzgnq.exe
  C:\Windows\System\mJdzgnq.exe
  2⤵
  PID:6488
- C:\Windows\System\XnSLrrU.exe
  C:\Windows\System\XnSLrrU.exe
  2⤵
  PID:6504
- C:\Windows\System\sYjKeVw.exe
  C:\Windows\System\sYjKeVw.exe
  2⤵
  PID:6528
- C:\Windows\System\rhMEJwm.exe
  C:\Windows\System\rhMEJwm.exe
  2⤵
  PID:6568
- C:\Windows\System\LnrzfbV.exe
  C:\Windows\System\LnrzfbV.exe
  2⤵
  PID:6592
- C:\Windows\System\utjfFXi.exe
  C:\Windows\System\utjfFXi.exe
  2⤵
  PID:6608
- C:\Windows\System\waAppAR.exe
  C:\Windows\System\waAppAR.exe
  2⤵
  PID:6632
- C:\Windows\System\cvpVcuK.exe
  C:\Windows\System\cvpVcuK.exe
  2⤵
  PID:6652
- C:\Windows\System\wwEndAh.exe
  C:\Windows\System\wwEndAh.exe
  2⤵
  PID:6672
- C:\Windows\System\QycKUbo.exe
  C:\Windows\System\QycKUbo.exe
  2⤵
  PID:6700
- C:\Windows\System\lztugBM.exe
  C:\Windows\System\lztugBM.exe
  2⤵
  PID:6720
- C:\Windows\System\SdFKKPO.exe
  C:\Windows\System\SdFKKPO.exe
  2⤵
  PID:6744
- C:\Windows\System\GUvMFxG.exe
  C:\Windows\System\GUvMFxG.exe
  2⤵
  PID:6768
- C:\Windows\System\SGNRnYR.exe
  C:\Windows\System\SGNRnYR.exe
  2⤵
  PID:6784
- C:\Windows\System\HdjUtoe.exe
  C:\Windows\System\HdjUtoe.exe
  2⤵
  PID:6808
- C:\Windows\System\gxWAoQJ.exe
  C:\Windows\System\gxWAoQJ.exe
  2⤵
  PID:6832
- C:\Windows\System\bDaZlGe.exe
  C:\Windows\System\bDaZlGe.exe
  2⤵
  PID:6856
- C:\Windows\System\vGhHqDC.exe
  C:\Windows\System\vGhHqDC.exe
  2⤵
  PID:6880
- C:\Windows\System\SoEJQps.exe
  C:\Windows\System\SoEJQps.exe
  2⤵
  PID:6904
- C:\Windows\System\hDiGscq.exe
  C:\Windows\System\hDiGscq.exe
  2⤵
  PID:6992
- C:\Windows\System\McbosHx.exe
  C:\Windows\System\McbosHx.exe
  2⤵
  PID:7012
- C:\Windows\System\RTjnWHi.exe
  C:\Windows\System\RTjnWHi.exe
  2⤵
  PID:7032
- C:\Windows\System\RHaPAOd.exe
  C:\Windows\System\RHaPAOd.exe
  2⤵
  PID:5276
- C:\Windows\System\nYJliRa.exe
  C:\Windows\System\nYJliRa.exe
  2⤵
  PID:5320
- C:\Windows\System\QFCHbIZ.exe
  C:\Windows\System\QFCHbIZ.exe
  2⤵
  PID:5360
- C:\Windows\System\zxLyHpp.exe
  C:\Windows\System\zxLyHpp.exe
  2⤵
  PID:5404
- C:\Windows\System\fdTMmsD.exe
  C:\Windows\System\fdTMmsD.exe
  2⤵
  PID:5916
- C:\Windows\System\rsSDLyO.exe
  C:\Windows\System\rsSDLyO.exe
  2⤵
  PID:5488
- C:\Windows\System\kcLxreV.exe
  C:\Windows\System\kcLxreV.exe
  2⤵
  PID:5524
- C:\Windows\System\ojINsyo.exe
  C:\Windows\System\ojINsyo.exe
  2⤵
  PID:5580
- C:\Windows\System\GrtkQpO.exe
  C:\Windows\System\GrtkQpO.exe
  2⤵
  PID:3116
- C:\Windows\System\yHAxafQ.exe
  C:\Windows\System\yHAxafQ.exe
  2⤵
  PID:5376
- C:\Windows\System\dmjxHYT.exe
  C:\Windows\System\dmjxHYT.exe
  2⤵
  PID:1304
- C:\Windows\System\nsfPFky.exe
  C:\Windows\System\nsfPFky.exe
  2⤵
  PID:5124
- C:\Windows\System\NzAoYfI.exe
  C:\Windows\System\NzAoYfI.exe
  2⤵
  PID:5744
- C:\Windows\System\PlSXrQx.exe
  C:\Windows\System\PlSXrQx.exe
  2⤵
  PID:5772
- C:\Windows\System\RRavquC.exe
  C:\Windows\System\RRavquC.exe
  2⤵
  PID:5776
- C:\Windows\System\kCUAJoo.exe
  C:\Windows\System\kCUAJoo.exe
  2⤵
  PID:5816
- C:\Windows\System\MnnlVXa.exe
  C:\Windows\System\MnnlVXa.exe
  2⤵
  PID:5896
- C:\Windows\System\qfOxqmC.exe
  C:\Windows\System\qfOxqmC.exe
  2⤵
  PID:4880
- C:\Windows\System\ssMdTWz.exe
  C:\Windows\System\ssMdTWz.exe
  2⤵
  PID:4296
- C:\Windows\System\xyzQxyY.exe
  C:\Windows\System\xyzQxyY.exe
  2⤵
  PID:3132
- C:\Windows\System\NBzRlXX.exe
  C:\Windows\System\NBzRlXX.exe
  2⤵
  PID:5188
- C:\Windows\System\apaITZS.exe
  C:\Windows\System\apaITZS.exe
  2⤵
  PID:3620
- C:\Windows\System\VrDXlcu.exe
  C:\Windows\System\VrDXlcu.exe
  2⤵
  PID:4156
- C:\Windows\System\tNwrHYZ.exe
  C:\Windows\System\tNwrHYZ.exe
  2⤵
  PID:5988
- C:\Windows\System\exNJrYS.exe
  C:\Windows\System\exNJrYS.exe
  2⤵
  PID:6516
- C:\Windows\System\AKGgCBJ.exe
  C:\Windows\System\AKGgCBJ.exe
  2⤵
  PID:6648
- C:\Windows\System\LYkgEMt.exe
  C:\Windows\System\LYkgEMt.exe
  2⤵
  PID:6912
- C:\Windows\System\NxfBhQb.exe
  C:\Windows\System\NxfBhQb.exe
  2⤵
  PID:7000
- C:\Windows\System\gVzlKTf.exe
  C:\Windows\System\gVzlKTf.exe
  2⤵
  PID:7140
- C:\Windows\System\pEgFjvm.exe
  C:\Windows\System\pEgFjvm.exe
  2⤵
  PID:6436
- C:\Windows\System\uRXYWkd.exe
  C:\Windows\System\uRXYWkd.exe
  2⤵
  PID:6500
- C:\Windows\System\DRjcCrA.exe
  C:\Windows\System\DRjcCrA.exe
  2⤵
  PID:6580
- C:\Windows\System\bitkimF.exe
  C:\Windows\System\bitkimF.exe
  2⤵
  PID:6640
- C:\Windows\System\FaGaOUA.exe
  C:\Windows\System\FaGaOUA.exe
  2⤵
  PID:6688
- C:\Windows\System\JudmoVk.exe
  C:\Windows\System\JudmoVk.exe
  2⤵
  PID:6752
- C:\Windows\System\qdzyReq.exe
  C:\Windows\System\qdzyReq.exe
  2⤵
  PID:6800
- C:\Windows\System\AzPraIR.exe
  C:\Windows\System\AzPraIR.exe
  2⤵
  PID:6844
- C:\Windows\System\qlJrGJm.exe
  C:\Windows\System\qlJrGJm.exe
  2⤵
  PID:7004
- C:\Windows\System\CAwJFzq.exe
  C:\Windows\System\CAwJFzq.exe
  2⤵
  PID:7176
- C:\Windows\System\MSnvPMN.exe
  C:\Windows\System\MSnvPMN.exe
  2⤵
  PID:7200
- C:\Windows\System\IMBJMSZ.exe
  C:\Windows\System\IMBJMSZ.exe
  2⤵
  PID:7224
- C:\Windows\System\pEtBHdO.exe
  C:\Windows\System\pEtBHdO.exe
  2⤵
  PID:7244
- C:\Windows\System\OjCbXng.exe
  C:\Windows\System\OjCbXng.exe
  2⤵
  PID:7264
- C:\Windows\System\ShxAwcs.exe
  C:\Windows\System\ShxAwcs.exe
  2⤵
  PID:7288
- C:\Windows\System\EeLnhYt.exe
  C:\Windows\System\EeLnhYt.exe
  2⤵
  PID:7312
- C:\Windows\System\NcxbfsX.exe
  C:\Windows\System\NcxbfsX.exe
  2⤵
  PID:7332
- C:\Windows\System\MnwocmZ.exe
  C:\Windows\System\MnwocmZ.exe
  2⤵
  PID:7352
- C:\Windows\System\SMQCZpY.exe
  C:\Windows\System\SMQCZpY.exe
  2⤵
  PID:7376
- C:\Windows\System\mEqmLWu.exe
  C:\Windows\System\mEqmLWu.exe
  2⤵
  PID:7400
- C:\Windows\System\xvxBCVz.exe
  C:\Windows\System\xvxBCVz.exe
  2⤵
  PID:7420
- C:\Windows\System\OAoRSZk.exe
  C:\Windows\System\OAoRSZk.exe
  2⤵
  PID:7444
- C:\Windows\System\NxueKoB.exe
  C:\Windows\System\NxueKoB.exe
  2⤵
  PID:7484
- C:\Windows\System\KicaHMG.exe
  C:\Windows\System\KicaHMG.exe
  2⤵
  PID:7504
- C:\Windows\System\iYhppwj.exe
  C:\Windows\System\iYhppwj.exe
  2⤵
  PID:7528
- C:\Windows\System\DIspCYd.exe
  C:\Windows\System\DIspCYd.exe
  2⤵
  PID:7552
- C:\Windows\System\bbhiuHv.exe
  C:\Windows\System\bbhiuHv.exe
  2⤵
  PID:7580
- C:\Windows\System\KrbOQMf.exe
  C:\Windows\System\KrbOQMf.exe
  2⤵
  PID:7600
- C:\Windows\System\JAQpsPK.exe
  C:\Windows\System\JAQpsPK.exe
  2⤵
  PID:7624
- C:\Windows\System\yBDmZfo.exe
  C:\Windows\System\yBDmZfo.exe
  2⤵
  PID:7640
- C:\Windows\System\cmYFzcB.exe
  C:\Windows\System\cmYFzcB.exe
  2⤵
  PID:7656
- C:\Windows\System\tEpsNvZ.exe
  C:\Windows\System\tEpsNvZ.exe
  2⤵
  PID:7676
- C:\Windows\System\jjhrsRU.exe
  C:\Windows\System\jjhrsRU.exe
  2⤵
  PID:7692
- C:\Windows\System\TMdkNgh.exe
  C:\Windows\System\TMdkNgh.exe
  2⤵
  PID:7708
- C:\Windows\System\plzCAxx.exe
  C:\Windows\System\plzCAxx.exe
  2⤵
  PID:7728
- C:\Windows\System\ZHoQnbq.exe
  C:\Windows\System\ZHoQnbq.exe
  2⤵
  PID:7912
- C:\Windows\System\tBkuXoZ.exe
  C:\Windows\System\tBkuXoZ.exe
  2⤵
  PID:7932
- C:\Windows\System\GpLfRlk.exe
  C:\Windows\System\GpLfRlk.exe
  2⤵
  PID:7952
- C:\Windows\System\BOMwkUf.exe
  C:\Windows\System\BOMwkUf.exe
  2⤵
  PID:7972
- C:\Windows\System\TxvvKUN.exe
  C:\Windows\System\TxvvKUN.exe
  2⤵
  PID:7992
- C:\Windows\System\HFZeVCh.exe
  C:\Windows\System\HFZeVCh.exe
  2⤵
  PID:8012
- C:\Windows\System\NnqNtzn.exe
  C:\Windows\System\NnqNtzn.exe
  2⤵
  PID:8028
- C:\Windows\System\Lmegmoq.exe
  C:\Windows\System\Lmegmoq.exe
  2⤵
  PID:8056
- C:\Windows\System\fzwFKgN.exe
  C:\Windows\System\fzwFKgN.exe
  2⤵
  PID:8072
- C:\Windows\System\YOrszPg.exe
  C:\Windows\System\YOrszPg.exe
  2⤵
  PID:8096
- C:\Windows\System\VKwhzqn.exe
  C:\Windows\System\VKwhzqn.exe
  2⤵
  PID:8116
- C:\Windows\System\kVYmIxZ.exe
  C:\Windows\System\kVYmIxZ.exe
  2⤵
  PID:8136
- C:\Windows\System\OnwdNVQ.exe
  C:\Windows\System\OnwdNVQ.exe
  2⤵
  PID:8152
- C:\Windows\System\PQxowQh.exe
  C:\Windows\System\PQxowQh.exe
  2⤵
  PID:8168
- C:\Windows\System\IEauOHj.exe
  C:\Windows\System\IEauOHj.exe
  2⤵
  PID:2572
- C:\Windows\System\yNsBNXK.exe
  C:\Windows\System\yNsBNXK.exe
  2⤵
  PID:4800
- C:\Windows\System\kliPSJq.exe
  C:\Windows\System\kliPSJq.exe
  2⤵
  PID:6616
- C:\Windows\System\QCelVkt.exe
  C:\Windows\System\QCelVkt.exe
  2⤵
  PID:6396
- C:\Windows\System\rXtdSHU.exe
  C:\Windows\System\rXtdSHU.exe
  2⤵
  PID:6824
- C:\Windows\System\aXiULVh.exe
  C:\Windows\System\aXiULVh.exe
  2⤵
  PID:7236
- C:\Windows\System\NsaDEMu.exe
  C:\Windows\System\NsaDEMu.exe
  2⤵
  PID:7320
- C:\Windows\System\yNyzGQJ.exe
  C:\Windows\System\yNyzGQJ.exe
  2⤵
  PID:8212
- C:\Windows\System\PKqJbiW.exe
  C:\Windows\System\PKqJbiW.exe
  2⤵
  PID:8248
- C:\Windows\System\KNlwMOC.exe
  C:\Windows\System\KNlwMOC.exe
  2⤵
  PID:8268
- C:\Windows\System\FUmDunE.exe
  C:\Windows\System\FUmDunE.exe
  2⤵
  PID:8296
- C:\Windows\System\bNPTeVO.exe
  C:\Windows\System\bNPTeVO.exe
  2⤵
  PID:8312
- C:\Windows\System\hzptVnP.exe
  C:\Windows\System\hzptVnP.exe
  2⤵
  PID:8340
- C:\Windows\System\zhBMAps.exe
  C:\Windows\System\zhBMAps.exe
  2⤵
  PID:8364
- C:\Windows\System\YTYpkgi.exe
  C:\Windows\System\YTYpkgi.exe
  2⤵
  PID:8380
- C:\Windows\System\NotYucD.exe
  C:\Windows\System\NotYucD.exe
  2⤵
  PID:8396
- C:\Windows\System\fmAaHjV.exe
  C:\Windows\System\fmAaHjV.exe
  2⤵
  PID:8412
- C:\Windows\System\CjxqZWX.exe
  C:\Windows\System\CjxqZWX.exe
  2⤵
  PID:8428
- C:\Windows\System\hShWYbk.exe
  C:\Windows\System\hShWYbk.exe
  2⤵
  PID:8444
- C:\Windows\System\PYmwxiq.exe
  C:\Windows\System\PYmwxiq.exe
  2⤵
  PID:8460
- C:\Windows\System\YOtcara.exe
  C:\Windows\System\YOtcara.exe
  2⤵
  PID:8476
- C:\Windows\System\AnkMekd.exe
  C:\Windows\System\AnkMekd.exe
  2⤵
  PID:8492
- C:\Windows\System\OziwalL.exe
  C:\Windows\System\OziwalL.exe
  2⤵
  PID:8508
- C:\Windows\System\CbsEdaC.exe
  C:\Windows\System\CbsEdaC.exe
  2⤵
  PID:8524
- C:\Windows\System\URMGBcC.exe
  C:\Windows\System\URMGBcC.exe
  2⤵
  PID:8540
- C:\Windows\System\ZwqIeZi.exe
  C:\Windows\System\ZwqIeZi.exe
  2⤵
  PID:8556
- C:\Windows\System\cWsSHfh.exe
  C:\Windows\System\cWsSHfh.exe
  2⤵
  PID:8572
- C:\Windows\System\SrTuMXy.exe
  C:\Windows\System\SrTuMXy.exe
  2⤵
  PID:8588
- C:\Windows\System\NwuTfcI.exe
  C:\Windows\System\NwuTfcI.exe
  2⤵
  PID:8604
- C:\Windows\System\QtwltKa.exe
  C:\Windows\System\QtwltKa.exe
  2⤵
  PID:8620
- C:\Windows\System\NgAkIyn.exe
  C:\Windows\System\NgAkIyn.exe
  2⤵
  PID:8636
- C:\Windows\System\zLGKSwK.exe
  C:\Windows\System\zLGKSwK.exe
  2⤵
  PID:8656
- C:\Windows\System\JSUCcdq.exe
  C:\Windows\System\JSUCcdq.exe
  2⤵
  PID:8684
- C:\Windows\System\LHTqgyy.exe
  C:\Windows\System\LHTqgyy.exe
  2⤵
  PID:8704
- C:\Windows\System\gtMOLYy.exe
  C:\Windows\System\gtMOLYy.exe
  2⤵
  PID:8720
- C:\Windows\System\PAPGaSV.exe
  C:\Windows\System\PAPGaSV.exe
  2⤵
  PID:8740
- C:\Windows\System\HCIbnWo.exe
  C:\Windows\System\HCIbnWo.exe
  2⤵
  PID:8760
- C:\Windows\System\lXVJMSc.exe
  C:\Windows\System\lXVJMSc.exe
  2⤵
  PID:8776
- C:\Windows\System\sxtYeKJ.exe
  C:\Windows\System\sxtYeKJ.exe
  2⤵
  PID:8796
- C:\Windows\System\hGgcWOu.exe
  C:\Windows\System\hGgcWOu.exe
  2⤵
  PID:8812
- C:\Windows\System\iqITuKz.exe
  C:\Windows\System\iqITuKz.exe
  2⤵
  PID:8836
- C:\Windows\System\glIHFFC.exe
  C:\Windows\System\glIHFFC.exe
  2⤵
  PID:8856
- C:\Windows\System\lsoPcun.exe
  C:\Windows\System\lsoPcun.exe
  2⤵
  PID:8872
- C:\Windows\System\CuFWfkQ.exe
  C:\Windows\System\CuFWfkQ.exe
  2⤵
  PID:8892
- C:\Windows\System\wKJLvgf.exe
  C:\Windows\System\wKJLvgf.exe
  2⤵
  PID:8912
- C:\Windows\System\MhoWhBt.exe
  C:\Windows\System\MhoWhBt.exe
  2⤵
  PID:8928
- C:\Windows\System\lEcVxDX.exe
  C:\Windows\System\lEcVxDX.exe
  2⤵
  PID:8972
- C:\Windows\System\MTEAmak.exe
  C:\Windows\System\MTEAmak.exe
  2⤵
  PID:8988
- C:\Windows\System\PRJhigx.exe
  C:\Windows\System\PRJhigx.exe
  2⤵
  PID:9004
- C:\Windows\System\KXtvupU.exe
  C:\Windows\System\KXtvupU.exe
  2⤵
  PID:9020
- C:\Windows\System\tuGzDhE.exe
  C:\Windows\System\tuGzDhE.exe
  2⤵
  PID:9036
- C:\Windows\System\EKhFDed.exe
  C:\Windows\System\EKhFDed.exe
  2⤵
  PID:9052
- C:\Windows\System\XBBPZTi.exe
  C:\Windows\System\XBBPZTi.exe
  2⤵
  PID:9084
- C:\Windows\System\KmqqTEL.exe
  C:\Windows\System\KmqqTEL.exe
  2⤵
  PID:9104
- C:\Windows\System\PdVPlDn.exe
  C:\Windows\System\PdVPlDn.exe
  2⤵
  PID:9128
- C:\Windows\System\rEvrBmq.exe
  C:\Windows\System\rEvrBmq.exe
  2⤵
  PID:9152
- C:\Windows\System\viAHHAa.exe
  C:\Windows\System\viAHHAa.exe
  2⤵
  PID:9172
- C:\Windows\System\kqDdCwR.exe
  C:\Windows\System\kqDdCwR.exe
  2⤵
  PID:9200
- C:\Windows\System\qtrVWkl.exe
  C:\Windows\System\qtrVWkl.exe
  2⤵
  PID:7436
- C:\Windows\System\wiMsaJo.exe
  C:\Windows\System\wiMsaJo.exe
  2⤵
  PID:7472
- C:\Windows\System\rUIVDKU.exe
  C:\Windows\System\rUIVDKU.exe
  2⤵
  PID:7520
- C:\Windows\System\nBppcQP.exe
  C:\Windows\System\nBppcQP.exe
  2⤵
  PID:7588
- C:\Windows\System\IbGkFDz.exe
  C:\Windows\System\IbGkFDz.exe
  2⤵
  PID:7964
- C:\Windows\System\eCoZqNH.exe
  C:\Windows\System\eCoZqNH.exe
  2⤵
  PID:8124
- C:\Windows\System\UpJwZbU.exe
  C:\Windows\System\UpJwZbU.exe
  2⤵
  PID:1700
- C:\Windows\System\WhuZnKU.exe
  C:\Windows\System\WhuZnKU.exe
  2⤵
  PID:7344
- C:\Windows\System\LYWVYUR.exe
  C:\Windows\System\LYWVYUR.exe
  2⤵
  PID:5292
- C:\Windows\System\SphgLYB.exe
  C:\Windows\System\SphgLYB.exe
  2⤵
  PID:5396
- C:\Windows\System\FRvNGUQ.exe
  C:\Windows\System\FRvNGUQ.exe
  2⤵
  PID:5508
- C:\Windows\System\eKkruCt.exe
  C:\Windows\System\eKkruCt.exe
  2⤵
  PID:5356
- C:\Windows\System\GgqcqaN.exe
  C:\Windows\System\GgqcqaN.exe
  2⤵
  PID:5920
- C:\Windows\System\osVeTwl.exe
  C:\Windows\System\osVeTwl.exe
  2⤵
  PID:5812
- C:\Windows\System\fSvspvH.exe
  C:\Windows\System\fSvspvH.exe
  2⤵
  PID:5704
- C:\Windows\System\slpfdQf.exe
  C:\Windows\System\slpfdQf.exe
  2⤵
  PID:3580
- C:\Windows\System\PbeIXPw.exe
  C:\Windows\System\PbeIXPw.exe
  2⤵
  PID:8108
- C:\Windows\System\qImboor.exe
  C:\Windows\System\qImboor.exe
  2⤵
  PID:6460
- C:\Windows\System\mZLqbWw.exe
  C:\Windows\System\mZLqbWw.exe
  2⤵
  PID:6604
- C:\Windows\System\FzOrcXA.exe
  C:\Windows\System\FzOrcXA.exe
  2⤵
  PID:6732
- C:\Windows\System\hqInWAW.exe
  C:\Windows\System\hqInWAW.exe
  2⤵
  PID:7192
- C:\Windows\System\cjiTKiW.exe
  C:\Windows\System\cjiTKiW.exe
  2⤵
  PID:7256
- C:\Windows\System\ijMqvIJ.exe
  C:\Windows\System\ijMqvIJ.exe
  2⤵
  PID:7412
- C:\Windows\System\uBumuMC.exe
  C:\Windows\System\uBumuMC.exe
  2⤵
  PID:9220
- C:\Windows\System\yUlwudh.exe
  C:\Windows\System\yUlwudh.exe
  2⤵
  PID:9240
- C:\Windows\System\vgxIXrv.exe
  C:\Windows\System\vgxIXrv.exe
  2⤵
  PID:9264
- C:\Windows\System\GVBaYxn.exe
  C:\Windows\System\GVBaYxn.exe
  2⤵
  PID:9292
- C:\Windows\System\wwZeNuK.exe
  C:\Windows\System\wwZeNuK.exe
  2⤵
  PID:9308
- C:\Windows\System\tkbrtSR.exe
  C:\Windows\System\tkbrtSR.exe
  2⤵
  PID:9332
- C:\Windows\System\uXHaBIw.exe
  C:\Windows\System\uXHaBIw.exe
  2⤵
  PID:9356
- C:\Windows\System\CfydoTi.exe
  C:\Windows\System\CfydoTi.exe
  2⤵
  PID:9380
- C:\Windows\System\mSMighr.exe
  C:\Windows\System\mSMighr.exe
  2⤵
  PID:9400
- C:\Windows\System\ImoOTRr.exe
  C:\Windows\System\ImoOTRr.exe
  2⤵
  PID:9424
- C:\Windows\System\wAuNDDL.exe
  C:\Windows\System\wAuNDDL.exe
  2⤵
  PID:9444
- C:\Windows\System\PoPOAib.exe
  C:\Windows\System\PoPOAib.exe
  2⤵
  PID:9472
- C:\Windows\System\FgreYpX.exe
  C:\Windows\System\FgreYpX.exe
  2⤵
  PID:9492
- C:\Windows\System\HuHHqjF.exe
  C:\Windows\System\HuHHqjF.exe
  2⤵
  PID:9512
- C:\Windows\System\Xsfpvlk.exe
  C:\Windows\System\Xsfpvlk.exe
  2⤵
  PID:9532
- C:\Windows\System\wTqmntw.exe
  C:\Windows\System\wTqmntw.exe
  2⤵
  PID:9556
- C:\Windows\System\WiBwyys.exe
  C:\Windows\System\WiBwyys.exe
  2⤵
  PID:9572
- C:\Windows\System\BcCZrzw.exe
  C:\Windows\System\BcCZrzw.exe
  2⤵
  PID:9588
- C:\Windows\System\CGituCy.exe
  C:\Windows\System\CGituCy.exe
  2⤵
  PID:9608
- C:\Windows\System\HsIROLn.exe
  C:\Windows\System\HsIROLn.exe
  2⤵
  PID:9628
- C:\Windows\System\AsHAkRR.exe
  C:\Windows\System\AsHAkRR.exe
  2⤵
  PID:9648
- C:\Windows\System\nNNLUuc.exe
  C:\Windows\System\nNNLUuc.exe
  2⤵
  PID:9672
- C:\Windows\System\HGlujYs.exe
  C:\Windows\System\HGlujYs.exe
  2⤵
  PID:9692
- C:\Windows\System\GgOIdGt.exe
  C:\Windows\System\GgOIdGt.exe
  2⤵
  PID:9712
- C:\Windows\System\DYNHzyt.exe
  C:\Windows\System\DYNHzyt.exe
  2⤵
  PID:9736
- C:\Windows\System\TcAYlgs.exe
  C:\Windows\System\TcAYlgs.exe
  2⤵
  PID:9760
- C:\Windows\System\YSjihYV.exe
  C:\Windows\System\YSjihYV.exe
  2⤵
  PID:9776
- C:\Windows\System\olbHteN.exe
  C:\Windows\System\olbHteN.exe
  2⤵
  PID:9792
- C:\Windows\System\erXCDfI.exe
  C:\Windows\System\erXCDfI.exe
  2⤵
  PID:9808
- C:\Windows\System\DdhIALI.exe
  C:\Windows\System\DdhIALI.exe
  2⤵
  PID:9824
- C:\Windows\System\QgjNJAy.exe
  C:\Windows\System\QgjNJAy.exe
  2⤵
  PID:9840
- C:\Windows\System\UDnrlux.exe
  C:\Windows\System\UDnrlux.exe
  2⤵
  PID:9856
- C:\Windows\System\ledFIxD.exe
  C:\Windows\System\ledFIxD.exe
  2⤵
  PID:9880
- C:\Windows\System\HAEHQYw.exe
  C:\Windows\System\HAEHQYw.exe
  2⤵
  PID:9900
- C:\Windows\System\QfRdTWU.exe
  C:\Windows\System\QfRdTWU.exe
  2⤵
  PID:9916
- C:\Windows\System\GGTjmql.exe
  C:\Windows\System\GGTjmql.exe
  2⤵
  PID:9932
- C:\Windows\System\SojMSBS.exe
  C:\Windows\System\SojMSBS.exe
  2⤵
  PID:9948
- C:\Windows\System\YTNkoxN.exe
  C:\Windows\System\YTNkoxN.exe
  2⤵
  PID:9972
- C:\Windows\System\OyDwlWp.exe
  C:\Windows\System\OyDwlWp.exe
  2⤵
  PID:9996
- C:\Windows\System\KzXjIvc.exe
  C:\Windows\System\KzXjIvc.exe
  2⤵
  PID:10020
- C:\Windows\System\ufxoqjE.exe
  C:\Windows\System\ufxoqjE.exe
  2⤵
  PID:10044
- C:\Windows\System\tHmEaAA.exe
  C:\Windows\System\tHmEaAA.exe
  2⤵
  PID:10060
- C:\Windows\System\Ibbqlzd.exe
  C:\Windows\System\Ibbqlzd.exe
  2⤵
  PID:10084
- C:\Windows\System\FtdExWA.exe
  C:\Windows\System\FtdExWA.exe
  2⤵
  PID:10108
- C:\Windows\System\qfuLtzG.exe
  C:\Windows\System\qfuLtzG.exe
  2⤵
  PID:10132
- C:\Windows\System\iEbUFHj.exe
  C:\Windows\System\iEbUFHj.exe
  2⤵
  PID:10156
- C:\Windows\System\USXBRis.exe
  C:\Windows\System\USXBRis.exe
  2⤵
  PID:10180
- C:\Windows\System\SmengJp.exe
  C:\Windows\System\SmengJp.exe
  2⤵
  PID:10204
- C:\Windows\System\vZjmJCW.exe
  C:\Windows\System\vZjmJCW.exe
  2⤵
  PID:10236
- C:\Windows\System\ZzWmUny.exe
  C:\Windows\System\ZzWmUny.exe
  2⤵
  PID:8852
- C:\Windows\System\uVOvkvg.exe
  C:\Windows\System\uVOvkvg.exe
  2⤵
  PID:7652
- C:\Windows\System\jmRRHqW.exe
  C:\Windows\System\jmRRHqW.exe
  2⤵
  PID:7684
- C:\Windows\System\wAPdbrf.exe
  C:\Windows\System\wAPdbrf.exe
  2⤵
  PID:7596
- C:\Windows\System\HcpOPEk.exe
  C:\Windows\System\HcpOPEk.exe
  2⤵
  PID:6536
- C:\Windows\System\yJucpBT.exe
  C:\Windows\System\yJucpBT.exe
  2⤵
  PID:9276
- C:\Windows\System\DaCVGHf.exe
  C:\Windows\System\DaCVGHf.exe
  2⤵
  PID:9392
- C:\Windows\System\XCPDQAQ.exe
  C:\Windows\System\XCPDQAQ.exe
  2⤵
  PID:10268
- C:\Windows\System\BcysAEn.exe
  C:\Windows\System\BcysAEn.exe
  2⤵
  PID:10292
- C:\Windows\System\bQACSFx.exe
  C:\Windows\System\bQACSFx.exe
  2⤵
  PID:10312
- C:\Windows\System\uRRGWyL.exe
  C:\Windows\System\uRRGWyL.exe
  2⤵
  PID:10688
- C:\Windows\System\lQPNmVu.exe
  C:\Windows\System\lQPNmVu.exe
  2⤵
  PID:10724
- C:\Windows\System\DViDbPW.exe
  C:\Windows\System\DViDbPW.exe
  2⤵
  PID:10744
- C:\Windows\System\mEYZXRH.exe
  C:\Windows\System\mEYZXRH.exe
  2⤵
  PID:10764
- C:\Windows\System\SxpQqHB.exe
  C:\Windows\System\SxpQqHB.exe
  2⤵
  PID:10784
- C:\Windows\System\DMJfnUN.exe
  C:\Windows\System\DMJfnUN.exe
  2⤵
  PID:10808
- C:\Windows\System\eiFBKIJ.exe
  C:\Windows\System\eiFBKIJ.exe
  2⤵
  PID:10828
- C:\Windows\System\gYJxkzh.exe
  C:\Windows\System\gYJxkzh.exe
  2⤵
  PID:10844
- C:\Windows\System\MGBfocZ.exe
  C:\Windows\System\MGBfocZ.exe
  2⤵
  PID:10864
- C:\Windows\System\QwrsxhS.exe
  C:\Windows\System\QwrsxhS.exe
  2⤵
  PID:10884
- C:\Windows\System\NtuvLNT.exe
  C:\Windows\System\NtuvLNT.exe
  2⤵
  PID:10904
- C:\Windows\System\kHGryPs.exe
  C:\Windows\System\kHGryPs.exe
  2⤵
  PID:10924
- C:\Windows\System\OxKtSiD.exe
  C:\Windows\System\OxKtSiD.exe
  2⤵
  PID:10948
- C:\Windows\System\NhvNZwc.exe
  C:\Windows\System\NhvNZwc.exe
  2⤵
  PID:10968
- C:\Windows\System\uxzpUYr.exe
  C:\Windows\System\uxzpUYr.exe
  2⤵
  PID:10988
- C:\Windows\System\gQImmKn.exe
  C:\Windows\System\gQImmKn.exe
  2⤵
  PID:11008
- C:\Windows\System\oyMZukP.exe
  C:\Windows\System\oyMZukP.exe
  2⤵
  PID:11032
- C:\Windows\System\pivSnpF.exe
  C:\Windows\System\pivSnpF.exe
  2⤵
  PID:11060
- C:\Windows\System\yGVIKCO.exe
  C:\Windows\System\yGVIKCO.exe
  2⤵
  PID:11080
- C:\Windows\System\jIRrMDT.exe
  C:\Windows\System\jIRrMDT.exe
  2⤵
  PID:11108
- C:\Windows\System\solQJhB.exe
  C:\Windows\System\solQJhB.exe
  2⤵
  PID:11136
- C:\Windows\System\lrkIkgn.exe
  C:\Windows\System\lrkIkgn.exe
  2⤵
  PID:11168
- C:\Windows\System\lWEsdjw.exe
  C:\Windows\System\lWEsdjw.exe
  2⤵
  PID:11188
- C:\Windows\System\WMMKhAE.exe
  C:\Windows\System\WMMKhAE.exe
  2⤵
  PID:11208
- C:\Windows\System\uLseSJB.exe
  C:\Windows\System\uLseSJB.exe
  2⤵
  PID:11224
- C:\Windows\System\eHqnRIX.exe
  C:\Windows\System\eHqnRIX.exe
  2⤵
  PID:11248
- C:\Windows\System\PieUMdr.exe
  C:\Windows\System\PieUMdr.exe
  2⤵
  PID:9432
- C:\Windows\System\lNNslHb.exe
  C:\Windows\System\lNNslHb.exe
  2⤵
  PID:9528
- C:\Windows\System\vuGRPxA.exe
  C:\Windows\System\vuGRPxA.exe
  2⤵
  PID:8288
- C:\Windows\System\HDkIURc.exe
  C:\Windows\System\HDkIURc.exe
  2⤵
  PID:9688
- C:\Windows\System\keEkISc.exe
  C:\Windows\System\keEkISc.exe
  2⤵
  PID:9720
- C:\Windows\System\EesXzme.exe
  C:\Windows\System\EesXzme.exe
  2⤵
  PID:8424
- C:\Windows\System\wTBPpgG.exe
  C:\Windows\System\wTBPpgG.exe
  2⤵
  PID:8472
- C:\Windows\System\tvuOvpp.exe
  C:\Windows\System\tvuOvpp.exe
  2⤵
  PID:8536
- C:\Windows\System\WGskPoy.exe
  C:\Windows\System\WGskPoy.exe
  2⤵
  PID:8596
- C:\Windows\System\EJDBtbm.exe
  C:\Windows\System\EJDBtbm.exe
  2⤵
  PID:8644
- C:\Windows\System\vlQfcLJ.exe
  C:\Windows\System\vlQfcLJ.exe
  2⤵
  PID:8712
- C:\Windows\System\dFThEyL.exe
  C:\Windows\System\dFThEyL.exe
  2⤵
  PID:9544
- C:\Windows\System\JdWCWnj.exe
  C:\Windows\System\JdWCWnj.exe
  2⤵
  PID:9728
- C:\Windows\System\mGSbRNU.exe
  C:\Windows\System\mGSbRNU.exe
  2⤵
  PID:1060
- C:\Windows\System\dvBCYRT.exe
  C:\Windows\System\dvBCYRT.exe
  2⤵
  PID:9620
- C:\Windows\System\xhRNaWC.exe
  C:\Windows\System\xhRNaWC.exe
  2⤵
  PID:7512
- C:\Windows\System\fYbMeuX.exe
  C:\Windows\System\fYbMeuX.exe
  2⤵
  PID:5880
- C:\Windows\System\sCqlnHC.exe
  C:\Windows\System\sCqlnHC.exe
  2⤵
  PID:5616
- C:\Windows\System\unAcUAn.exe
  C:\Windows\System\unAcUAn.exe
  2⤵
  PID:6016
- C:\Windows\System\VQWFBxz.exe
  C:\Windows\System\VQWFBxz.exe
  2⤵
  PID:6664
- C:\Windows\System\brGcclZ.exe
  C:\Windows\System\brGcclZ.exe
  2⤵
  PID:7212
- C:\Windows\System\aAoBIDN.exe
  C:\Windows\System\aAoBIDN.exe
  2⤵
  PID:9272
- C:\Windows\System\NharUep.exe
  C:\Windows\System\NharUep.exe
  2⤵
  PID:9504
- C:\Windows\System\IUgGzrH.exe
  C:\Windows\System\IUgGzrH.exe
  2⤵
  PID:8804
- C:\Windows\System\quJlLhb.exe
  C:\Windows\System\quJlLhb.exe
  2⤵
  PID:8880
- C:\Windows\System\htDlpcm.exe
  C:\Windows\System\htDlpcm.exe
  2⤵
  PID:8908
- C:\Windows\System\ILNvtpa.exe
  C:\Windows\System\ILNvtpa.exe
  2⤵
  PID:9752
- C:\Windows\System\hdhoKyt.exe
  C:\Windows\System\hdhoKyt.exe
  2⤵
  PID:8956
- C:\Windows\System\DYzbkfN.exe
  C:\Windows\System\DYzbkfN.exe
  2⤵
  PID:8996
- C:\Windows\System\WiJdcwY.exe
  C:\Windows\System\WiJdcwY.exe
  2⤵
  PID:10656
- C:\Windows\System\MxroKxi.exe
  C:\Windows\System\MxroKxi.exe
  2⤵
  PID:9164
- C:\Windows\System\CFNUEUz.exe
  C:\Windows\System\CFNUEUz.exe
  2⤵
  PID:7452
- C:\Windows\System\GNVWcob.exe
  C:\Windows\System\GNVWcob.exe
  2⤵
  PID:7636
- C:\Windows\System\DRyygWY.exe
  C:\Windows\System\DRyygWY.exe
  2⤵
  PID:7572
- C:\Windows\System\tLLwdBE.exe
  C:\Windows\System\tLLwdBE.exe
  2⤵
  PID:6712
- C:\Windows\System\HnwtziF.exe
  C:\Windows\System\HnwtziF.exe
  2⤵
  PID:10780
- C:\Windows\System\ZQyEjcn.exe
  C:\Windows\System\ZQyEjcn.exe
  2⤵
  PID:5544
- C:\Windows\System\RgnFfIi.exe
  C:\Windows\System\RgnFfIi.exe
  2⤵
  PID:5876
- C:\Windows\System\yJDymzY.exe
  C:\Windows\System\yJDymzY.exe
  2⤵
  PID:11288
- C:\Windows\System\JstrYEO.exe
  C:\Windows\System\JstrYEO.exe
  2⤵
  PID:11312
- C:\Windows\System\yVOobgu.exe
  C:\Windows\System\yVOobgu.exe
  2⤵
  PID:11332
- C:\Windows\System\nDtXKMW.exe
  C:\Windows\System\nDtXKMW.exe
  2⤵
  PID:11356
- C:\Windows\System\bAAboKB.exe
  C:\Windows\System\bAAboKB.exe
  2⤵
  PID:11376
- C:\Windows\System\tIPibnU.exe
  C:\Windows\System\tIPibnU.exe
  2⤵
  PID:11404
- C:\Windows\System\hNtaeDr.exe
  C:\Windows\System\hNtaeDr.exe
  2⤵
  PID:11428
- C:\Windows\System\mJgsclO.exe
  C:\Windows\System\mJgsclO.exe
  2⤵
  PID:11444
- C:\Windows\System\caxYYgC.exe
  C:\Windows\System\caxYYgC.exe
  2⤵
  PID:11464
- C:\Windows\System\nStdOhb.exe
  C:\Windows\System\nStdOhb.exe
  2⤵
  PID:11488
- C:\Windows\System\iMnZcTB.exe
  C:\Windows\System\iMnZcTB.exe
  2⤵
  PID:11504
- C:\Windows\System\OsFwlPW.exe
  C:\Windows\System\OsFwlPW.exe
  2⤵
  PID:11528
- C:\Windows\System\rkJLIjn.exe
  C:\Windows\System\rkJLIjn.exe
  2⤵
  PID:11552
- C:\Windows\System\YVxXaNJ.exe
  C:\Windows\System\YVxXaNJ.exe
  2⤵
  PID:11576
- C:\Windows\System\zOyICjh.exe
  C:\Windows\System\zOyICjh.exe
  2⤵
  PID:11600
- C:\Windows\System\Myksbjn.exe
  C:\Windows\System\Myksbjn.exe
  2⤵
  PID:11624
- C:\Windows\System\oLhoina.exe
  C:\Windows\System\oLhoina.exe
  2⤵
  PID:11648
- C:\Windows\System\hyOqgVC.exe
  C:\Windows\System\hyOqgVC.exe
  2⤵
  PID:11672
- C:\Windows\System\LSkHCQc.exe
  C:\Windows\System\LSkHCQc.exe
  2⤵
  PID:11692
- C:\Windows\System\ZGGpTxx.exe
  C:\Windows\System\ZGGpTxx.exe
  2⤵
  PID:11716
- C:\Windows\System\eejUuHO.exe
  C:\Windows\System\eejUuHO.exe
  2⤵
  PID:11740
- C:\Windows\System\qUKlAwx.exe
  C:\Windows\System\qUKlAwx.exe
  2⤵
  PID:11760
- C:\Windows\System\IaOTAAm.exe
  C:\Windows\System\IaOTAAm.exe
  2⤵
  PID:11780
- C:\Windows\System\nnNsaJG.exe
  C:\Windows\System\nnNsaJG.exe
  2⤵
  PID:11808
- C:\Windows\System\YqErncI.exe
  C:\Windows\System\YqErncI.exe
  2⤵
  PID:11832
- C:\Windows\System\sxFFwEd.exe
  C:\Windows\System\sxFFwEd.exe
  2⤵
  PID:11852
- C:\Windows\System\EXqKhqm.exe
  C:\Windows\System\EXqKhqm.exe
  2⤵
  PID:11880
- C:\Windows\System\BCdaJjd.exe
  C:\Windows\System\BCdaJjd.exe
  2⤵
  PID:11904
- C:\Windows\System\txEpwDm.exe
  C:\Windows\System\txEpwDm.exe
  2⤵
  PID:11920
- C:\Windows\System\sjuTcbH.exe
  C:\Windows\System\sjuTcbH.exe
  2⤵
  PID:11948
- C:\Windows\System\ErJozqJ.exe
  C:\Windows\System\ErJozqJ.exe
  2⤵
  PID:11972
- C:\Windows\System\oCuVbbo.exe
  C:\Windows\System\oCuVbbo.exe
  2⤵
  PID:11992
- C:\Windows\System\jPHWCro.exe
  C:\Windows\System\jPHWCro.exe
  2⤵
  PID:12016
- C:\Windows\System\WWqOdMg.exe
  C:\Windows\System\WWqOdMg.exe
  2⤵
  PID:12044
- C:\Windows\System\ZwJGlFA.exe
  C:\Windows\System\ZwJGlFA.exe
  2⤵
  PID:12068
- C:\Windows\System\aQedCfw.exe
  C:\Windows\System\aQedCfw.exe
  2⤵
  PID:12088
- C:\Windows\System\OEyRWLy.exe
  C:\Windows\System\OEyRWLy.exe
  2⤵
  PID:12112
- C:\Windows\System\RtfPbra.exe
  C:\Windows\System\RtfPbra.exe
  2⤵
  PID:12132
- C:\Windows\System\SEUVaWc.exe
  C:\Windows\System\SEUVaWc.exe
  2⤵
  PID:12156
- C:\Windows\System\MxWLbLg.exe
  C:\Windows\System\MxWLbLg.exe
  2⤵
  PID:12180
- C:\Windows\System\MekVDRu.exe
  C:\Windows\System\MekVDRu.exe
  2⤵
  PID:12204
- C:\Windows\System\QQXSssh.exe
  C:\Windows\System\QQXSssh.exe
  2⤵
  PID:12224
- C:\Windows\System\nvrMeVt.exe
  C:\Windows\System\nvrMeVt.exe
  2⤵
  PID:12240
- C:\Windows\System\JdVCStp.exe
  C:\Windows\System\JdVCStp.exe
  2⤵
  PID:12260
- C:\Windows\System\YNYTzJx.exe
  C:\Windows\System\YNYTzJx.exe
  2⤵
  PID:12276
- C:\Windows\System\tShnfiW.exe
  C:\Windows\System\tShnfiW.exe
  2⤵
  PID:10996
- C:\Windows\System\saFjuWZ.exe
  C:\Windows\System\saFjuWZ.exe
  2⤵
  PID:7216
- C:\Windows\System\ROPidCK.exe
  C:\Windows\System\ROPidCK.exe
  2⤵
  PID:7516
- C:\Windows\System\BnfBscV.exe
  C:\Windows\System\BnfBscV.exe
  2⤵
  PID:9248
- C:\Windows\System\NktLHfn.exe
  C:\Windows\System\NktLHfn.exe
  2⤵
  PID:11100
- C:\Windows\System\MgmdUqj.exe
  C:\Windows\System\MgmdUqj.exe
  2⤵
  PID:9376
- C:\Windows\System\VPupmTn.exe
  C:\Windows\System\VPupmTn.exe
  2⤵
  PID:9604
- C:\Windows\System\wNumSpY.exe
  C:\Windows\System\wNumSpY.exe
  2⤵
  PID:9656
- C:\Windows\System\EuKkuUT.exe
  C:\Windows\System\EuKkuUT.exe
  2⤵
  PID:8452
- C:\Windows\System\XQPMKMT.exe
  C:\Windows\System\XQPMKMT.exe
  2⤵
  PID:4436
- C:\Windows\System\wTCoMRM.exe
  C:\Windows\System\wTCoMRM.exe
  2⤵
  PID:9804
- C:\Windows\System\ECKGJcR.exe
  C:\Windows\System\ECKGJcR.exe
  2⤵
  PID:4364
- C:\Windows\System\PwsCPON.exe
  C:\Windows\System\PwsCPON.exe
  2⤵
  PID:940
- C:\Windows\System\SnkPPrW.exe
  C:\Windows\System\SnkPPrW.exe
  2⤵
  PID:9928
- C:\Windows\System\fkSLwYC.exe
  C:\Windows\System\fkSLwYC.exe
  2⤵
  PID:10004
- C:\Windows\System\bVKIEyw.exe
  C:\Windows\System\bVKIEyw.exe
  2⤵
  PID:10080
- C:\Windows\System\xhGxVDe.exe
  C:\Windows\System\xhGxVDe.exe
  2⤵
  PID:10140
- C:\Windows\System\FqXQbKy.exe
  C:\Windows\System\FqXQbKy.exe
  2⤵
  PID:10216
- C:\Windows\System\JxVPffo.exe
  C:\Windows\System\JxVPffo.exe
  2⤵
  PID:8360
- C:\Windows\System\EDNtMBE.exe
  C:\Windows\System\EDNtMBE.exe
  2⤵
  PID:3924
- C:\Windows\System\DWqAAXk.exe
  C:\Windows\System\DWqAAXk.exe
  2⤵
  PID:12316
- C:\Windows\System\HVRPPku.exe
  C:\Windows\System\HVRPPku.exe
  2⤵
  PID:12336
- C:\Windows\System\jKTdZMf.exe
  C:\Windows\System\jKTdZMf.exe
  2⤵
  PID:12360
- C:\Windows\System\VXKTqzO.exe
  C:\Windows\System\VXKTqzO.exe
  2⤵
  PID:12384
- C:\Windows\System\VpqTGBc.exe
  C:\Windows\System\VpqTGBc.exe
  2⤵
  PID:12416
- C:\Windows\System\vACjsbK.exe
  C:\Windows\System\vACjsbK.exe
  2⤵
  PID:12444
- C:\Windows\System\pCMknCI.exe
  C:\Windows\System\pCMknCI.exe
  2⤵
  PID:12468
- C:\Windows\System\YMdomoF.exe
  C:\Windows\System\YMdomoF.exe
  2⤵
  PID:12488
- C:\Windows\System\JnPWoBr.exe
  C:\Windows\System\JnPWoBr.exe
  2⤵
  PID:12512
- C:\Windows\System\ceyBIjb.exe
  C:\Windows\System\ceyBIjb.exe
  2⤵
  PID:12536
- C:\Windows\System\yBtAULq.exe
  C:\Windows\System\yBtAULq.exe
  2⤵
  PID:12560
- C:\Windows\System\dAerZOE.exe
  C:\Windows\System\dAerZOE.exe
  2⤵
  PID:12580
- C:\Windows\System\NZteRMG.exe
  C:\Windows\System\NZteRMG.exe
  2⤵
  PID:12608
- C:\Windows\System\wWizpTt.exe
  C:\Windows\System\wWizpTt.exe
  2⤵
  PID:12628
- C:\Windows\System\dQDIEns.exe
  C:\Windows\System\dQDIEns.exe
  2⤵
  PID:12648
- C:\Windows\System\YGqeXXT.exe
  C:\Windows\System\YGqeXXT.exe
  2⤵
  PID:12680
- C:\Windows\System\XRytexo.exe
  C:\Windows\System\XRytexo.exe
  2⤵
  PID:12712
- C:\Windows\System\EuqvRky.exe
  C:\Windows\System\EuqvRky.exe
  2⤵
  PID:12732
- C:\Windows\System\vTgqzAd.exe
  C:\Windows\System\vTgqzAd.exe
  2⤵
  PID:12752
- C:\Windows\System\wxAxKXk.exe
  C:\Windows\System\wxAxKXk.exe
  2⤵
  PID:12768
- C:\Windows\System\vhuEsYT.exe
  C:\Windows\System\vhuEsYT.exe
  2⤵
  PID:12788
- C:\Windows\System\yBAGhVa.exe
  C:\Windows\System\yBAGhVa.exe
  2⤵
  PID:12808
- C:\Windows\System\pWbMbkH.exe
  C:\Windows\System\pWbMbkH.exe
  2⤵
  PID:12828
- C:\Windows\System\eHcnJzJ.exe
  C:\Windows\System\eHcnJzJ.exe
  2⤵
  PID:12856
- C:\Windows\System\tOwmrwo.exe
  C:\Windows\System\tOwmrwo.exe
  2⤵
  PID:12880
- C:\Windows\System\jRkTwiW.exe
  C:\Windows\System\jRkTwiW.exe
  2⤵
  PID:12904
- C:\Windows\System\ZmlXCPZ.exe
  C:\Windows\System\ZmlXCPZ.exe
  2⤵
  PID:12920
- C:\Windows\System\UpAWJzx.exe
  C:\Windows\System\UpAWJzx.exe
  2⤵
  PID:12944
- C:\Windows\System\efJzwje.exe
  C:\Windows\System\efJzwje.exe
  2⤵
  PID:12964
- C:\Windows\System\gPxscqN.exe
  C:\Windows\System\gPxscqN.exe
  2⤵
  PID:12980
- C:\Windows\System\mgPCrfm.exe
  C:\Windows\System\mgPCrfm.exe
  2⤵
  PID:12996
- C:\Windows\System\RylKoDc.exe
  C:\Windows\System\RylKoDc.exe
  2⤵
  PID:13012
- C:\Windows\System\GASSLYJ.exe
  C:\Windows\System\GASSLYJ.exe
  2⤵
  PID:13028
- C:\Windows\System\SDwGZEe.exe
  C:\Windows\System\SDwGZEe.exe
  2⤵
  PID:13044
- C:\Windows\System\QZeEMTE.exe
  C:\Windows\System\QZeEMTE.exe
  2⤵
  PID:13064
- C:\Windows\System\TYbtLZW.exe
  C:\Windows\System\TYbtLZW.exe
  2⤵
  PID:13080
- C:\Windows\System\LeKWeGy.exe
  C:\Windows\System\LeKWeGy.exe
  2⤵
  PID:13096
- C:\Windows\System\CdeHWmq.exe
  C:\Windows\System\CdeHWmq.exe
  2⤵
  PID:13116
- C:\Windows\System\csAoozQ.exe
  C:\Windows\System\csAoozQ.exe
  2⤵
  PID:13140
- C:\Windows\System\lQuDcyc.exe
  C:\Windows\System\lQuDcyc.exe
  2⤵
  PID:13168
- C:\Windows\System\pnVHaLF.exe
  C:\Windows\System\pnVHaLF.exe
  2⤵
  PID:13184
- C:\Windows\System\XeFHeWL.exe
  C:\Windows\System\XeFHeWL.exe
  2⤵
  PID:13204
- C:\Windows\System\ZPZquUi.exe
  C:\Windows\System\ZPZquUi.exe
  2⤵
  PID:13224
- C:\Windows\System\WiWrBUQ.exe
  C:\Windows\System\WiWrBUQ.exe
  2⤵
  PID:13256
- C:\Windows\System\jZaPsdN.exe
  C:\Windows\System\jZaPsdN.exe
  2⤵
  PID:13280
- C:\Windows\System\QrtxSEC.exe
  C:\Windows\System\QrtxSEC.exe
  2⤵
  PID:13308
- C:\Windows\System\xMcxBfa.exe
  C:\Windows\System\xMcxBfa.exe
  2⤵
  PID:9748
- C:\Windows\System\UUAbdtr.exe
  C:\Windows\System\UUAbdtr.exe
  2⤵
  PID:10148
- C:\Windows\System\BuXJnIt.exe
  C:\Windows\System\BuXJnIt.exe
  2⤵
  PID:9964
- C:\Windows\System\ejpuZOP.exe
  C:\Windows\System\ejpuZOP.exe
  2⤵
  PID:9848
- C:\Windows\System\QzCtBmm.exe
  C:\Windows\System\QzCtBmm.exe
  2⤵
  PID:9664
- C:\Windows\System\dkxVmHS.exe
  C:\Windows\System\dkxVmHS.exe
  2⤵
  PID:10732
- C:\Windows\System\UEVKeEG.exe
  C:\Windows\System\UEVKeEG.exe
  2⤵
  PID:8064
- C:\Windows\System\vqTksly.exe
  C:\Windows\System\vqTksly.exe
  2⤵
  PID:5344
- C:\Windows\System\fVOwGLU.exe
  C:\Windows\System\fVOwGLU.exe
  2⤵
  PID:10876
- C:\Windows\System\zDMpyrV.exe
  C:\Windows\System\zDMpyrV.exe
  2⤵
  PID:11296
- C:\Windows\System\UebrDFt.exe
  C:\Windows\System\UebrDFt.exe
  2⤵
  PID:11416
- C:\Windows\System\fdRaWAe.exe
  C:\Windows\System\fdRaWAe.exe
  2⤵
  PID:11164
- C:\Windows\System\GFrQGvH.exe
  C:\Windows\System\GFrQGvH.exe
  2⤵
  PID:9304
- C:\Windows\System\PPnSyaJ.exe
  C:\Windows\System\PPnSyaJ.exe
  2⤵
  PID:11620
- C:\Windows\System\wfsMknP.exe
  C:\Windows\System\wfsMknP.exe
  2⤵
  PID:2700
- C:\Windows\System\wwBoyxz.exe
  C:\Windows\System\wwBoyxz.exe
  2⤵
  PID:12428
- C:\Windows\System\KQqovVr.exe
  C:\Windows\System\KQqovVr.exe
  2⤵
  PID:12596
- C:\Windows\System\PVRfqat.exe
  C:\Windows\System\PVRfqat.exe
  2⤵
  PID:12660
- C:\Windows\System\bNpUnJO.exe
  C:\Windows\System\bNpUnJO.exe
  2⤵
  PID:3884
- C:\Windows\System\sOtUkXI.exe
  C:\Windows\System\sOtUkXI.exe
  2⤵
  PID:8004
- C:\Windows\System\HdEvWHj.exe
  C:\Windows\System\HdEvWHj.exe
  2⤵
  PID:12344
- C:\Windows\System\NwEFiAG.exe
  C:\Windows\System\NwEFiAG.exe
  2⤵
  PID:12520
- C:\Windows\System\IoaAsUc.exe
  C:\Windows\System\IoaAsUc.exe
  2⤵
  PID:5000
- C:\Windows\System\ttOVBcr.exe
  C:\Windows\System\ttOVBcr.exe
  2⤵
  PID:13104
- C:\Windows\System\DznKCdj.exe
  C:\Windows\System\DznKCdj.exe
  2⤵
  PID:11436
- C:\Windows\System\jNappLR.exe
  C:\Windows\System\jNappLR.exe
  2⤵
  PID:11632
- C:\Windows\System\Irzquxo.exe
  C:\Windows\System\Irzquxo.exe
  2⤵
  PID:1000
- C:\Windows\System\juwFIib.exe
  C:\Windows\System\juwFIib.exe
  2⤵
  PID:3176
- C:\Windows\System\oIpKXIj.exe
  C:\Windows\System\oIpKXIj.exe
  2⤵
  PID:10600
- C:\Windows\System\VEGAOMU.exe
  C:\Windows\System\VEGAOMU.exe
  2⤵
  PID:10840
- C:\Windows\System\LMwATWj.exe
  C:\Windows\System\LMwATWj.exe
  2⤵
  PID:12760
- C:\Windows\System\RlDoPkC.exe
  C:\Windows\System\RlDoPkC.exe
  2⤵
  PID:12940
- C:\Windows\System\RgRqedK.exe
  C:\Windows\System\RgRqedK.exe
  2⤵
  PID:9896
- C:\Windows\System\sczMieG.exe
  C:\Windows\System\sczMieG.exe
  2⤵
  PID:3952
- C:\Windows\System\vguGyXM.exe
  C:\Windows\System\vguGyXM.exe
  2⤵
  PID:8304
- C:\Windows\System\SLFqTRf.exe
  C:\Windows\System\SLFqTRf.exe
  2⤵
  PID:12176
- C:\Windows\System\HJypoKH.exe
  C:\Windows\System\HJypoKH.exe
  2⤵
  PID:4688
- C:\Windows\System\tsNVzWh.exe
  C:\Windows\System\tsNVzWh.exe
  2⤵
  PID:11300
- C:\Windows\System\AUTUkyk.exe
  C:\Windows\System\AUTUkyk.exe
  2⤵
  PID:9912
- C:\Windows\System\rHZVoMT.exe
  C:\Windows\System\rHZVoMT.exe
  2⤵
  PID:12976
- C:\Windows\System\HZShhYg.exe
  C:\Windows\System\HZShhYg.exe
  2⤵
  PID:2760
- C:\Windows\System\AUBopBB.exe
  C:\Windows\System\AUBopBB.exe
  2⤵
  PID:8144
- C:\Windows\System\ZdOAmON.exe
  C:\Windows\System\ZdOAmON.exe
  2⤵
  PID:11512
- C:\Windows\System\GrEdlQs.exe
  C:\Windows\System\GrEdlQs.exe
  2⤵
  PID:8040
- C:\Windows\System\nZkgPNq.exe
  C:\Windows\System\nZkgPNq.exe
  2⤵
  PID:12960
- C:\Windows\System\TjIYXtc.exe
  C:\Windows\System\TjIYXtc.exe
  2⤵
  PID:11928
- C:\Windows\System\myOyvtx.exe
  C:\Windows\System\myOyvtx.exe
  2⤵
  PID:12704
- C:\Windows\System\mcyqKEd.exe
  C:\Windows\System\mcyqKEd.exe
  2⤵
  PID:7568
- C:\Windows\System\BWaqkCe.exe
  C:\Windows\System\BWaqkCe.exe
  2⤵
  PID:11748
- C:\Windows\System\hvQekIE.exe
  C:\Windows\System\hvQekIE.exe
  2⤵
  PID:1484
- C:\Windows\System\rQOwzUM.exe
  C:\Windows\System\rQOwzUM.exe
  2⤵
  PID:8376
- C:\Windows\System\KCdfGDZ.exe
  C:\Windows\System\KCdfGDZ.exe
  2⤵
  PID:12408
- C:\Windows\System\VBOHNQT.exe
  C:\Windows\System\VBOHNQT.exe
  2⤵
  PID:9568
- C:\Windows\System\MAyKDKp.exe
  C:\Windows\System\MAyKDKp.exe
  2⤵
  PID:5768
- C:\Windows\System\DimZuNP.exe
  C:\Windows\System\DimZuNP.exe
  2⤵
  PID:3252
- C:\Windows\System\puzHaOV.exe
  C:\Windows\System\puzHaOV.exe
  2⤵
  PID:11496
- C:\Windows\System\RuCBsLO.exe
  C:\Windows\System\RuCBsLO.exe
  2⤵
  PID:548
- C:\Windows\System\RcQakZU.exe
  C:\Windows\System\RcQakZU.exe
  2⤵
  PID:3940
- C:\Windows\System\lDilDXY.exe
  C:\Windows\System\lDilDXY.exe
  2⤵
  PID:8404
- C:\Windows\System\BSmcWUN.exe
  C:\Windows\System\BSmcWUN.exe
  2⤵
  PID:7164
- C:\Windows\System\mSpPeqX.exe
  C:\Windows\System\mSpPeqX.exe
  2⤵
  PID:7148
- C:\Windows\System\xPchUwR.exe
  C:\Windows\System\xPchUwR.exe
  2⤵
  PID:5260
- C:\Windows\System\KlbgxnG.exe
  C:\Windows\System\KlbgxnG.exe
  2⤵
  PID:4044
- C:\Windows\System\BNnhdmD.exe
  C:\Windows\System\BNnhdmD.exe
  2⤵
  PID:5180
- C:\Windows\System\QhJlAVV.exe
  C:\Windows\System\QhJlAVV.exe
  2⤵
  PID:9744
- C:\Windows\System\xtrvZTB.exe
  C:\Windows\System\xtrvZTB.exe
  2⤵
  PID:3912
- C:\Windows\System\EDGJnga.exe
  C:\Windows\System\EDGJnga.exe
  2⤵
  PID:3576
- C:\Windows\System\guExaen.exe
  C:\Windows\System\guExaen.exe
  2⤵
  PID:5232
- C:\Windows\System\OEcAjxx.exe
  C:\Windows\System\OEcAjxx.exe
  2⤵
  PID:10392
- C:\Windows\System\joHTAdh.exe
  C:\Windows\System\joHTAdh.exe
  2⤵
  PID:8020
- C:\Windows\System\HSQULPz.exe
  C:\Windows\System\HSQULPz.exe
  2⤵
  PID:7576
- C:\Windows\System\FKzqSLa.exe
  C:\Windows\System\FKzqSLa.exe
  2⤵
  PID:716
- C:\Windows\System\VAvfwrL.exe
  C:\Windows\System\VAvfwrL.exe
  2⤵
  PID:2188
- C:\Windows\System\AYNgiLc.exe
  C:\Windows\System\AYNgiLc.exe
  2⤵
  PID:13320
- C:\Windows\System\GSXoZZf.exe
  C:\Windows\System\GSXoZZf.exe
  2⤵
  PID:13344
- C:\Windows\System\uhKdDrp.exe
  C:\Windows\System\uhKdDrp.exe
  2⤵
  PID:13372
- C:\Windows\System\EniwNgL.exe
  C:\Windows\System\EniwNgL.exe
  2⤵
  PID:13396
- C:\Windows\System\hHPVQEH.exe
  C:\Windows\System\hHPVQEH.exe
  2⤵
  PID:13420
- C:\Windows\System\lLZFlhx.exe
  C:\Windows\System\lLZFlhx.exe
  2⤵
  PID:13440
- C:\Windows\System\jGXxAKF.exe
  C:\Windows\System\jGXxAKF.exe
  2⤵
  PID:13456
- C:\Windows\System\pkSMmVH.exe
  C:\Windows\System\pkSMmVH.exe
  2⤵
  PID:13484
- C:\Windows\System\wHzzJat.exe
  C:\Windows\System\wHzzJat.exe
  2⤵
  PID:13996
- C:\Windows\System\YrCrjrV.exe
  C:\Windows\System\YrCrjrV.exe
  2⤵
  PID:14100
- C:\Windows\System\XheUELc.exe
  C:\Windows\System\XheUELc.exe
  2⤵
  PID:14120
- C:\Windows\System\vexHquo.exe
  C:\Windows\System\vexHquo.exe
  2⤵
  PID:14140
- C:\Windows\System\hBTrmrN.exe
  C:\Windows\System\hBTrmrN.exe
  2⤵
  PID:14160
- C:\Windows\System\cAhambY.exe
  C:\Windows\System\cAhambY.exe
  2⤵
  PID:14272
- C:\Windows\System\Clvijvi.exe
  C:\Windows\System\Clvijvi.exe
  2⤵
  PID:14288
- C:\Windows\System\aYnbUUq.exe
  C:\Windows\System\aYnbUUq.exe
  2⤵
  PID:14304
- C:\Windows\System\FjKlkUY.exe
  C:\Windows\System\FjKlkUY.exe
  2⤵
  PID:14324
- C:\Windows\System\TlqmzaZ.exe
  C:\Windows\System\TlqmzaZ.exe
  2⤵
  PID:4568

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xaht3eba.s12.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ASFsTmE.exe

Filesize
1.9MB

MD5
67f1d76e52dd2606019729b538805dce

SHA1
3d3cbe390b12b2220aca96498450273803de27c2

SHA256
d25968e08965a136b337c8375dc250993f9cd7b317ddcc9edf44dcb8f07d7e8e

SHA512
8c46d7cf5a7f1d77be279cfe362b31aa28de2f0a1b426e16bece06087ad5d03ac2335df49801c08c6ed112fb0195c1480239f69c21cb063bd88d65ac40f61623

Download Submit
C:\Windows\System\BDUrnIi.exe

Filesize
8B

MD5
a8f2921c80c15a3d426e5fdff8a56196

SHA1
4dc21bf95e22427a9dafcd4930e81b62e77d5fda

SHA256
7e9bbeeba45dae16f8c444596ee4180d7313e899e46fa6263fde6904f32d92a1

SHA512
996666f646b1878ee129a778184f9520541ee458797b8bfaefed6e1f152a5436e0ff19d28744463b706ffe3e24e429f5af102aa1e7733dbeeb6210754c828802

Download Submit
C:\Windows\System\BqnpLMN.exe

Filesize
1.9MB

MD5
2295cae75516c5f34a870012b8faea74

SHA1
ab221164572c7f10e2ed2673f52677cb42ce8565

SHA256
656b84006353629bcf4b2da6165835a22235f9c5e85330c462d1a2358486ea5c

SHA512
1664d65f3c123efacf8f043e66a6d0c809a8619f333d2831dfd91a0594b797e02bf9a107c9a56d1aa803e1452199d1022e018d6eaa7b9f5e2090d2da54aa6c06

Download Submit
C:\Windows\System\CwwnrpI.exe

Filesize
1.9MB

MD5
dd7a71810da7a9f28e1f6697f2869cf0

SHA1
bf24fb4903cb0650ea53f39d919a5a2646d50fd6

SHA256
284e50b0c7200b3b24e1918b037ce00dc87937c43068ea36323acf0ec1343406

SHA512
1fb4f9974f8ca383d0675cc71974583bbf14ac94d162d059fb890e12a83de28963479fd10a7be826755607f9bcf586b229ac06284e6407f5814487b62211bff3

Download Submit
C:\Windows\System\FFIyhpe.exe

Filesize
1.9MB

MD5
644592def2ac1f2d6c7fa10560ccd78d

SHA1
0ed63cf23f5e7b661366856ad78e6aab5fc3e763

SHA256
08984490d0f6c59b94bc2cb0720f3a47fb01643367b8c045a7818bdabc1c302b

SHA512
5b07c97b88d5fb6296bff684bba345f5c4732ae3bc19b9003f3b28ff30338eb58df7e344064c68201398fe79b74765261f4b778bf02ae2b21132002a3cdfb66a

Download Submit
C:\Windows\System\GKWtbcu.exe

Filesize
1.9MB

MD5
3fdd6d7afd90e061e786fe738dbdb0b3

SHA1
cf5f877736453e87616ca3b0c681302785ef0569

SHA256
6513ff5aaf154f3496de40aab8ce758d8a4341d142901765f410f6cee637c463

SHA512
90c5c9367687674ceb6c518c4708710d19fc9737941ad57d56080c57cee6f02e730285a12daff860d615183222f4554630a3e221ad0d8d43c966542183364a9a

Download Submit
C:\Windows\System\GnAkpwo.exe

Filesize
1.9MB

MD5
5723663a720f43984f99d54cbf58f4be

SHA1
cd0f0f8fbd2aea3cb8d47063bd4c5111522c8c93

SHA256
2c627e0b9046b41510cdc17037700622f9e4b1f981949be29b31e32a7583301e

SHA512
a0a8edb2e93eecd7f44f19bc3074bb0150c97ea09ef1033cd7fa138e82f934e9bd693017c99408a3ac2cbfe1d6830eed6b6c583402917acc778d3aaaab44bb84

Download Submit
C:\Windows\System\HZccwfF.exe

Filesize
1.9MB

MD5
55262a6ff7a27729fdd8739bb135a4b3

SHA1
e6503b49a7efeeccccfdfc2a8104c6f8cc06ea4c

SHA256
971762717bf3be0fb713ffc724ed214a0dd3e2ee29ebf935ee210156aaa89e9f

SHA512
efc68a257f547ec94599e5675116e0332c4c405537d95795d196bfe9d0bd377ab71745036d12360d62fc186d32bcfa9089729e7d3ee95bb2b7c95cfa71f6f0ec

Download Submit
C:\Windows\System\IReaNVB.exe

Filesize
1.9MB

MD5
6fcfd173966bda6c46253a1fc35af9a0

SHA1
8686d23f5f25552248c5d141cc543aeee1289a48

SHA256
5516178ad38df85a10efea8f927a202f180837c892ca36f3ec680e2ddf876eb3

SHA512
df8cd7b7e59e255636b7d4ee591ec97be681007dd582dc6f389ae864d922fecf3f970bb2ac360efc0fa818be68578011471fe8b2cb421db1f11596d0abbb1a85

Download Submit
C:\Windows\System\Jjjwudg.exe

Filesize
1.9MB

MD5
f91f12f8094803fe25439f3d5b54b7d2

SHA1
41b2a351788bd6c13c7bf2777c7a3dd8a0e9b182

SHA256
b63feba396e8201aec24af815445e893f3f887255247a4bfa67bedf9de533d4b

SHA512
7c12e5cc873b95cf51cd4e91b8e9e531f9dff3fdd1f39f9658a392345c7fbc7ff7896f39de87d337a79ddc619550b02beb8c4bfc76d0bc8c7902e20670747312

Download Submit
C:\Windows\System\LALBSKp.exe

Filesize
1.9MB

MD5
dd4ff3fd6b7838876bf3834239d33574

SHA1
89aba62ad7f5ca7f47398d97178d7540c7135a29

SHA256
c1c30d92424ee243398505904d37be3cb6e454754eb9564c0f26176c1b071b0f

SHA512
69aa34b49bf2d1a8397dcf73c06ee6e9f0c04134c80ad3d5b28efc7ed952470a9a7bf66f379b8886e172b480d97a0ebf2beb892fd6dc7b0407374f698d412f56

Download Submit
C:\Windows\System\MIZeBoA.exe

Filesize
1.9MB

MD5
389232229c66bc02b8650aace4025c9d

SHA1
9cb3cd4d3369926a5e544da3a00529fe7af32ed8

SHA256
ab9fabc94c11be780912c30848b0976e39c863332584634d717b6e43432cc3e0

SHA512
f20007e60f2b91cedb76125f949a4ca764ce1dfce5c71aa15ebf271f539619391454c0930f3dc0cf6cf76a05099e8f520adbc1c414c81afd5035ae2144710f23

Download Submit
C:\Windows\System\MSjQNpA.exe

Filesize
1.9MB

MD5
af7dcbe87e6934d5067320c44d8e30b9

SHA1
0ce49f86d088ff207c51792ec9d7d5b81cf6ea41

SHA256
95cad51348e8f86be64c66ead37c2857f494ab69faf78395a3e98b7fbf209f23

SHA512
5986a95e2eec7791687d8852ef5387156bcb615693e3d85eeab4cab653ee875a763811384e1fd83746a8b4ee8777ed5661af21986a19763e95944be5c7cbdeed

Download Submit
C:\Windows\System\NsczrPO.exe

Filesize
1.9MB

MD5
c0c57daee0013d8d8dbc161e5c5ef85d

SHA1
49650705c7cc16b273915cd9eb8289ac12bfd266

SHA256
b665fb1aa0e9b2a6d909d49eb0d48c79a9bf37020a35adcff58148b04073287d

SHA512
2e5cf8e02a2b8f2cb6c1745cd7697f19eb5c6490a539bf3658c95d6d3f015d51c3415e65505c9e1be0197f6ee664278aef1199cf27e132eff10905a528dacd83

Download Submit
C:\Windows\System\PxujfzA.exe

Filesize
1.9MB

MD5
a424d8cef8d715d5a641660bc5cb3174

SHA1
7ff8e7a80af65a54295b8e7c339bf1042211388d

SHA256
c9cf67898da7e7271813e1a022704b8ee8a4ff0fea40b6f5e60de9a139406327

SHA512
383b8e40fb81e3fc41fcb8d54376da50d0e89ff8a6a53fc1a01228a2c3c033f6c22b0d070d9c8ed694839c72c84cf3eade04513cf08f26ce2a05c3dcb7401a5e

Download Submit
C:\Windows\System\SIhkoXz.exe

Filesize
1.9MB

MD5
00ac9241d67e8406e3c501613ddf427b

SHA1
8e1b5c784efba7d72be513509d0faa7ca3d132a7

SHA256
8508732bbd87ce0d9f8b656ef867a16775a707a254ab2ddc369186833045c0ac

SHA512
c4f0a2ddb5b9a9410c3fa700e90f9e18df03f6f4e0f390589fe96ec289f2ea5021d265888d049526ec8651d685bd1ce63649db9d608109151d73ebc8ae7e4b7e

Download Submit
C:\Windows\System\SSTeOPn.exe

Filesize
1.9MB

MD5
3bff02e23827ac3ff9146d0c32e2a77e

SHA1
42ab62b63997b23d6928c5c50ac8ced3806e77ff

SHA256
bf8b5991b54ae7f6483a1599b31635f3383f2484533e779be5caa7bb4794ecc5

SHA512
a3d3aff88876910a30d990a0b64b9ba387a29e5f5c92ff8c14bc42f27473957413bd3ad8a138bdf61a209606725ae199e5d34e637326c219a6e80fbbf2470cfc

Download Submit
C:\Windows\System\STVJjPJ.exe

Filesize
1.9MB

MD5
0cd586072c2b0bd91cd3117a9e947f41

SHA1
f105fb79943c983920f8cd955f40555b5d71a8a5

SHA256
8d9fa245155dc7122c771b9d9a6e361c4f86174263e5a70cee11af879cab1a2e

SHA512
769bc174c165d6ad9284f9569b44f5bf34d839591996b22653a6d0ef70bd2b47fa9eee5335bccdddce9344a869b758f055af9a4a69c6be71721cea0ad9f8e5ca

Download Submit
C:\Windows\System\TLaakHh.exe

Filesize
1.9MB

MD5
92237651a0fc9ec2959e8fa321220d49

SHA1
7747a8112b14704c3932105d72c9bdfcb31553dc

SHA256
2791c624035b2db0a0bf28589ba2bbbb101f8a5512b4ff218a37f753b2eca653

SHA512
db6cbcad398d4361baddbb2fe9f026f86b9a3db62a48d944ff4494087ba8d4c68e5433a0343097a0815ad30cd2bc2fce2e327f15b3a2cd5a013d2aaea5408022

Download Submit
C:\Windows\System\VSRJSdu.exe

Filesize
1.9MB

MD5
d0f2d421558683574f738a51daeb78ea

SHA1
a8963002ab97e113df85074f892893f2be59b0ef

SHA256
9dfc46a9a5a20a34c60a3ea2ac4f90f6168628f432cc8d6232a2aa1d35b7af9f

SHA512
02079d2b1613994647793b8c5a0954b32e9dd573581c4c15c85ab6ae904e8974342ca193534d9e2e9f3b6f006d23d83ff85178cea2504aa477cedb3ca53c3106

Download Submit
C:\Windows\System\XXUqoWy.exe

Filesize
1.9MB

MD5
a2da143e1b4a84537b79cbbebb291308

SHA1
ebff65268d24e3ce9b28d87e87a11414cf3e4e15

SHA256
6639914599bb4254b2f3f959029f44d705dfd0b61366988d8627fe78a28cda2a

SHA512
6435679e9ce231cbc82d3b23430636835f8690d109121314d10d6b90121333274b828d58030ba6052631a0c841208cc9abaa98bda83eeb55347f4ba201e466f4

Download Submit
C:\Windows\System\aUWamWr.exe

Filesize
1.9MB

MD5
68b7b91235d535dcf89547cabf4bfc12

SHA1
3d2b097eda2a86e9a517dfd95cc341c65338fb52

SHA256
7f8462db9f226575413c0d760e07af9c9283b88e2c36bece3620ee1414b13747

SHA512
58a89ccdb913c4ff394c997734ef8a34a4dbdf85bb9527a8334681cba76c7b285f446c38bbb6bf34807853e4101bfa5214dfc3942340daf5addc1070704adce2

Download Submit
C:\Windows\System\adOrAAk.exe

Filesize
1.9MB

MD5
cd4ff30812c9441b68a7677f0400e96a

SHA1
6b65437f091b8128ebe4c0a1b7db492e6cdef9cd

SHA256
c835fdefb536bec23b5c92a581fa5e077a443108d783b45499a321510f544546

SHA512
42eaa4b168ab0910ff78b92146c85ab7061801baabad937cf5f33ac414cb508ec16ef8d1c0039d83bf86724df3929ab0d9d0ae83ce3556bfbccff47058cf6464

Download Submit
C:\Windows\System\bXDLhGZ.exe

Filesize
1.9MB

MD5
aae296af09bdadeb9efbf0d3f45db1e6

SHA1
e0c8bee688028448ac7dfe3dba0b252dda1a4e26

SHA256
686aaa6ad3ed81da7f05a3db3e5b3df687d70efa967dba170ecd6939e3807d06

SHA512
a712a5fbd6e0661f8066432c2a59901698b992fdebb666866e238ce001d513c89ccf69dfc56fa5daeebc3b9fcf1da387240acb7ff38b7a24b33e4c80f1696679

Download Submit
C:\Windows\System\cLBzAfE.exe

Filesize
1.9MB

MD5
64178424aec4ce4c5370f298fe8b1332

SHA1
c4042d8dfc7f3699b9b09525eddc3e076a944f4e

SHA256
3e8e9dfea79755125901319b9c8be142fb4d6085c4a0e7ca62104ad43ff1b611

SHA512
62071aae916330850ecd054c1f88c9589ff3916a197420e8c981fedf19a237b149c4610cd9cbd44fce9a10668787503c5b0ff7c561c8059cae8cc9ac85790843

Download Submit
C:\Windows\System\eYVVICG.exe

Filesize
1.9MB

MD5
17b390764c4b5dbe99f59d8eca3c2a96

SHA1
2bbddd3e421d55ac0480a3b12044516eb4192250

SHA256
ade17d6c48147eeb16467132bf8c356dd2c7591a4d9740454238bc235a9a9001

SHA512
2fb868de71b0de9ee58336abf9c123f7bacf0859e26b19043efeb61058d2ac85b0a163b90899b26d41fdc266cd6e67a4104b51200f8ce172a021062a279bded1

Download Submit
C:\Windows\System\gejvdpm.exe

Filesize
1.9MB

MD5
223bab4774c9cc5d5b58bbc6231775a6

SHA1
e8f481d7f069e8cdda4b7da50dcd90f7d6f3c935

SHA256
075078a6abd261a1049195db0c1012fa6bbf65a8adf013d00d0468b6a6bb08b7

SHA512
2bd7364339969f9618f9334ea990e489ff27fb55887ab3f5d59dbc572b79afc23b21c752b05e6c3bafe08f3abce2d14c6c8bc57c5f85233f2948ed7e1f3e50d0

Download Submit
C:\Windows\System\kOxLtAR.exe

Filesize
1.9MB

MD5
50839a43aeeb0af05900f08ae9c8a703

SHA1
5483d10da7d507a00e963eea6538c72fd4bf3c69

SHA256
efe325c4008e288b3b7792e1069f326cfda21fe978314fd9b21d4c1731b6ce3e

SHA512
62168c5603c3bfc30629ec83f65bd45c37f437b82e6d9da93cf804a243e3c6dcee2b7d4f2b428472394527aeaf8bd817f3439ece27763b8ec5822cf3976f2ad2

Download Submit
C:\Windows\System\lOKqXEv.exe

Filesize
1.9MB

MD5
bc3942f5332cc84cba34a9d5c5f57daf

SHA1
82b940cf6fce4946b8068d8acc869d1534e5e741

SHA256
bc396e134afe275982cdb97d365b5108152a1c2ae2b4702ad8a5826258182602

SHA512
8ec3d7abda3bfafdbb61aad26d94218c565d0cd872956af901e16ea1841c888a4b20caf6df29c9606019270f8b51c12649f8777d3e34843067749333884b70ed

Download Submit
C:\Windows\System\mlNFQnh.exe

Filesize
1.9MB

MD5
37e93894f90c1ddd11c8aedd55912be4

SHA1
f6d9851b712439053f5cfefb2e9a16b795dea3d4

SHA256
6f722b04c31f7d9ee84c2c1e0a3b92d2857336bcfebb6d5fa45f284d8ef396d5

SHA512
2f505883efa657806746ee231eaa0425b06ffe3ceb284622a444e063a795322df3ff60fa81bd740cff69add16c3d7d0dc9a7928bccf42b04189017687122a082

Download Submit
C:\Windows\System\pGcUxgu.exe

Filesize
1.9MB

MD5
833b06e34cc49ab9f19ab6da2cbe04a1

SHA1
8671c2a960f19fb292afb23fa070bc6fd78dcac0

SHA256
e7464ddb335fab33c786cfbbd7be3cc6e212307e3c9284545a5a453eb57f6d82

SHA512
b68ae2a49e336f915da5fc078d653e21bd262f3a319637d31e13f832954773db6c08212c9abbf8205f0194681c0e0e7221f6e8f6260169c2abe57b27dd975040

Download Submit
C:\Windows\System\qqsdFuo.exe

Filesize
1.9MB

MD5
79de850bbf32edd313bef471880f9a13

SHA1
336b3c76c2f447eb4a905d8e5e17bf1ecdf9f168

SHA256
45f373f6f704625a73aab8ca60e13c77de411ee19c3a95a8e35db656374e7944

SHA512
b30a954f0a12f0c8bbf301833f4a6ef879fcdae9f004bdf8d94ba1de5b005e1d43422c664baf76a05ea52db73b19549ed1c86eb6aa36858422b6c95d92283687

Download Submit
C:\Windows\System\rvgfCyq.exe

Filesize
1.9MB

MD5
918dcc922ac0ff41163e36b762c6d4f2

SHA1
f8a569eb60731df4d5f818ecbb0851bbdceae32a

SHA256
c227b1d3f3e08c030983d5ae99ecf34750758cdc48b0858a83ba20d5443bcb25

SHA512
0ab75f21338b9b1123a3f1e0fea5a216baae9f610d69229cf6a6a48e13ed79c10462be07cf6f3a2f734027c4ef3d512bc02638049c8deb541c08ccffdad67045

Download Submit
C:\Windows\System\tfxpMsJ.exe

Filesize
1.9MB

MD5
2d853e75c3189cc062101114aed3af43

SHA1
6a214cec3afe9857da007f7b3661fcf514ec86a6

SHA256
641dcedd452010568d4519c6087c15db7519b627056e45e49343dcb5f686c521

SHA512
64975521087012fca2c97927d5d6d86987f43f58f08dfbf82ba32454d42f659a909a5dbeca4aa77eef8d6994096cedf053008cb38a3ce83a7255dba3cd0ac44c

Download Submit
C:\Windows\System\vTbpKWq.exe

Filesize
1.9MB

MD5
541dbf21cee1ed2a31612f48f99db938

SHA1
36bc54d440d6c6812c2cb607c016b8903f6aa9a2

SHA256
68193b797efc1a36e116376365dab9d8d20055f5656bb8b5c56256f02c59bae9

SHA512
04ac11269dacae9c58db82e7f6c0777230b7635db09dd6440922c8b00ed99c273bf247cfda7fcef53893beaa8c0625bb3e9aa4a3971b7b24434a65589d9798fa

Download Submit
C:\Windows\System\wJuQbCS.exe

Filesize
1.9MB

MD5
8bff2c1922b0890b8e2c74f6a4e57dda

SHA1
febf8f573451d73c2467f33ce0a85888db78bedc

SHA256
3372bf01685174cca00ca0c50a45e16d5710509d8b4592b47552a2d4598a0675

SHA512
606e129624115b3b0a8b0ebb99d91d53941068d30e54592041c7900f3e1a045324ed5491616174d027a8f9ca5a1562a0546ef81019e8aaf9f496ac66891b0cf8

Download Submit
C:\Windows\System\wyneyYA.exe

Filesize
1.9MB

MD5
8768dc0eb0b4cb9836dc0c991ec8f986

SHA1
56c73b6ca9c94f624a784a89cd6676839a76b949

SHA256
a1d45b2575ddfbf2dd5a029e5c0a44f10a774a1aabecdc5c21641f0568ae76a6

SHA512
e1e8ada03948ab28aa286f69a72a0f3b05a469936cae87a85d6d2499d672f59d3f4212e95a717285218ee436a6bedac62b091f19ea076137c56e948f0c2503e1

Download Submit
C:\Windows\System\xidRcLk.exe

Filesize
1.9MB

MD5
436df2cf9bff090862a2aa9af1fffb5a

SHA1
ee591eb26477c17438459283005257792fd33a52

SHA256
dde9b2d5d57115ab8f7ba1c5aa2f8eef6d7df8bec1f9f3f8a41b266c0db07229

SHA512
126bcecdc5085020a6f294bdc68312ce97ab5fb304dbb5f043c076bdfe1752df72c23bd15b6f100705a9c866f0e638d501ec400e02b6bdb44f262c86239955d4

Download Submit
C:\Windows\System\zINifqe.exe

Filesize
1.9MB

MD5
a5119989cc8c17eb7761f82b0818c6aa

SHA1
13a01f4ae51f7f2a39027f35911f68137390cf4c

SHA256
9418329c5f0e9621b4c85a7324a4e76bc7d4e7fc8bce24b994fcca82a8a438e3

SHA512
59a946fd7bd4b9360e86b39e50a6ced3c79e6ee50fb08d9dd0b32e16856def37f5d5f92058d93a9097b1eb7b01d3e6dbd593d4190e1b8cec0625366c29c6eba8

Download Submit
C:\Windows\System\zOfNRJj.exe

Filesize
1.9MB

MD5
b810d2c510d68472a7982df70101797d

SHA1
aebc730ea2d8dd9f3d33c14dbe5ddc6a32723704

SHA256
40b2c3c7574a3b73301dfb723e585e8069bb76d2d75822f0e5659c70600bdcba

SHA512
aac25943bb894ab37fa0010a0f0589136b782cb94cc933f07e945209e0bdee75bc9d967d7b4acdae6dd82635854b2242b12270c445d5c19908eae32712219b62

Download Submit
memory/468-558-0x00007FF7A9840000-0x00007FF7A9C32000-memory.dmp

Filesize
3.9MB

Download
memory/752-183-0x00007FF78B1E0000-0x00007FF78B5D2000-memory.dmp

Filesize
3.9MB

Download
memory/1336-556-0x00007FF7D9C70000-0x00007FF7DA062000-memory.dmp

Filesize
3.9MB

Download
memory/1492-494-0x00007FF619C40000-0x00007FF61A032000-memory.dmp

Filesize
3.9MB

Download
memory/1516-136-0x00007FF796130000-0x00007FF796522000-memory.dmp

Filesize
3.9MB

Download
memory/1832-314-0x00007FF6DAD20000-0x00007FF6DB112000-memory.dmp

Filesize
3.9MB

Download
memory/2612-1-0x000001ED411B0000-0x000001ED411C0000-memory.dmp

Filesize
64KB

Download
memory/2612-0-0x00007FF730E90000-0x00007FF731282000-memory.dmp

Filesize
3.9MB

Download
memory/2716-560-0x00007FF652FE0000-0x00007FF6533D2000-memory.dmp

Filesize
3.9MB

Download
memory/2952-561-0x00007FF665260000-0x00007FF665652000-memory.dmp

Filesize
3.9MB

Download
memory/3364-263-0x00007FF6142C0000-0x00007FF6146B2000-memory.dmp

Filesize
3.9MB

Download
memory/3720-563-0x00007FF697900000-0x00007FF697CF2000-memory.dmp

Filesize
3.9MB

Download
memory/3756-212-0x00007FF6C5320000-0x00007FF6C5712000-memory.dmp

Filesize
3.9MB

Download
memory/3808-550-0x00007FF651FE0000-0x00007FF6523D2000-memory.dmp

Filesize
3.9MB

Download
memory/3956-362-0x00007FF7083D0000-0x00007FF7087C2000-memory.dmp

Filesize
3.9MB

Download
memory/4020-422-0x00007FF7EF170000-0x00007FF7EF562000-memory.dmp

Filesize
3.9MB

Download
memory/4144-562-0x00007FF6D3D70000-0x00007FF6D4162000-memory.dmp

Filesize
3.9MB

Download
memory/4292-557-0x00007FF601040000-0x00007FF601432000-memory.dmp

Filesize
3.9MB

Download
memory/4336-90-0x00007FF7A7CC0000-0x00007FF7A80B2000-memory.dmp

Filesize
3.9MB

Download
memory/4620-559-0x00007FF66BA40000-0x00007FF66BE32000-memory.dmp

Filesize
3.9MB

Download
memory/4624-311-0x00007FF75FA90000-0x00007FF75FE82000-memory.dmp

Filesize
3.9MB

Download
memory/4736-554-0x00007FF6432A0000-0x00007FF643692000-memory.dmp

Filesize
3.9MB

Download
memory/4788-277-0x000001F1D89E0000-0x000001F1D8A02000-memory.dmp

Filesize
136KB

Download
memory/4788-2053-0x00007FFAD5290000-0x00007FFAD5D51000-memory.dmp

Filesize
10.8MB

Download
memory/4788-91-0x000001F1D8A80000-0x000001F1D8A90000-memory.dmp

Filesize
64KB

Download
memory/4788-56-0x00007FFAD5290000-0x00007FFAD5D51000-memory.dmp

Filesize
10.8MB

Download
memory/5060-555-0x00007FF7CB5C0000-0x00007FF7CB9B2000-memory.dmp

Filesize
3.9MB

Download