xmrig | 906a7fc61cc4ae457c0ee1e0e1e800d7bc3be776904a390bf3660e37fb09e128

Analysis

max time kernel
126s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 22:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
Size

2.0MB
MD5

0a8d9036c2528a7f4995a5c18067ab95
SHA1

f19a444616a2d839c618dc6ada2feb537edc114f
SHA256

906a7fc61cc4ae457c0ee1e0e1e800d7bc3be776904a390bf3660e37fb09e128
SHA512

3722e10341cb6ba363ef8a2f1cfde79cb3c809e43c5eb4328b816518575650f08a935bc816fef235a858acb9bf5c67113f7a211dfa1e6110b2b246ae057a3344
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p/pOMn+hk:NABt

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 42 IoCs

miner

resource	yara_rule
behavioral2/memory/2444-28-0x00007FF74D3C0000-0x00007FF74D7B2000-memory.dmp	xmrig
behavioral2/memory/2224-43-0x00007FF731160000-0x00007FF731552000-memory.dmp	xmrig
behavioral2/memory/2088-62-0x00007FF70B420000-0x00007FF70B812000-memory.dmp	xmrig
behavioral2/memory/1408-78-0x00007FF7965D0000-0x00007FF7969C2000-memory.dmp	xmrig
behavioral2/memory/1564-123-0x00007FF6BFCB0000-0x00007FF6C00A2000-memory.dmp	xmrig
behavioral2/memory/6088-153-0x00007FF66C7D0000-0x00007FF66CBC2000-memory.dmp	xmrig
behavioral2/memory/5428-147-0x00007FF767BF0000-0x00007FF767FE2000-memory.dmp	xmrig
behavioral2/memory/4652-141-0x00007FF7886F0000-0x00007FF788AE2000-memory.dmp	xmrig
behavioral2/memory/5480-135-0x00007FF69D9E0000-0x00007FF69DDD2000-memory.dmp	xmrig
behavioral2/memory/3944-129-0x00007FF7CB370000-0x00007FF7CB762000-memory.dmp	xmrig
behavioral2/memory/4316-117-0x00007FF7349B0000-0x00007FF734DA2000-memory.dmp	xmrig
behavioral2/memory/2364-116-0x00007FF688AE0000-0x00007FF688ED2000-memory.dmp	xmrig
behavioral2/memory/3816-110-0x00007FF60AF10000-0x00007FF60B302000-memory.dmp	xmrig
behavioral2/memory/3028-98-0x00007FF6D97F0000-0x00007FF6D9BE2000-memory.dmp	xmrig
behavioral2/memory/3736-94-0x00007FF724940000-0x00007FF724D32000-memory.dmp	xmrig
behavioral2/memory/5164-90-0x00007FF743E40000-0x00007FF744232000-memory.dmp	xmrig
behavioral2/memory/5108-80-0x00007FF6F11E0000-0x00007FF6F15D2000-memory.dmp	xmrig
behavioral2/memory/4680-79-0x00007FF7B5700000-0x00007FF7B5AF2000-memory.dmp	xmrig
behavioral2/memory/1012-38-0x00007FF6192C0000-0x00007FF6196B2000-memory.dmp	xmrig
behavioral2/memory/2944-2120-0x00007FF7BB170000-0x00007FF7BB562000-memory.dmp	xmrig
behavioral2/memory/5612-2122-0x00007FF65AD10000-0x00007FF65B102000-memory.dmp	xmrig
behavioral2/memory/1408-2148-0x00007FF7965D0000-0x00007FF7969C2000-memory.dmp	xmrig
behavioral2/memory/1012-2177-0x00007FF6192C0000-0x00007FF6196B2000-memory.dmp	xmrig
behavioral2/memory/2224-2179-0x00007FF731160000-0x00007FF731552000-memory.dmp	xmrig
behavioral2/memory/2088-2174-0x00007FF70B420000-0x00007FF70B812000-memory.dmp	xmrig
behavioral2/memory/2444-2171-0x00007FF74D3C0000-0x00007FF74D7B2000-memory.dmp	xmrig
behavioral2/memory/4680-2176-0x00007FF7B5700000-0x00007FF7B5AF2000-memory.dmp	xmrig
behavioral2/memory/5108-2193-0x00007FF6F11E0000-0x00007FF6F15D2000-memory.dmp	xmrig
behavioral2/memory/1564-2197-0x00007FF6BFCB0000-0x00007FF6C00A2000-memory.dmp	xmrig
behavioral2/memory/4316-2196-0x00007FF7349B0000-0x00007FF734DA2000-memory.dmp	xmrig
behavioral2/memory/5164-2190-0x00007FF743E40000-0x00007FF744232000-memory.dmp	xmrig
behavioral2/memory/3736-2187-0x00007FF724940000-0x00007FF724D32000-memory.dmp	xmrig
behavioral2/memory/2364-2184-0x00007FF688AE0000-0x00007FF688ED2000-memory.dmp	xmrig
behavioral2/memory/2944-2192-0x00007FF7BB170000-0x00007FF7BB562000-memory.dmp	xmrig
behavioral2/memory/3816-2186-0x00007FF60AF10000-0x00007FF60B302000-memory.dmp	xmrig
behavioral2/memory/3028-2182-0x00007FF6D97F0000-0x00007FF6D9BE2000-memory.dmp	xmrig
behavioral2/memory/5428-2216-0x00007FF767BF0000-0x00007FF767FE2000-memory.dmp	xmrig
behavioral2/memory/3944-2210-0x00007FF7CB370000-0x00007FF7CB762000-memory.dmp	xmrig
behavioral2/memory/5480-2202-0x00007FF69D9E0000-0x00007FF69DDD2000-memory.dmp	xmrig
behavioral2/memory/4652-2200-0x00007FF7886F0000-0x00007FF788AE2000-memory.dmp	xmrig
behavioral2/memory/6088-2212-0x00007FF66C7D0000-0x00007FF66CBC2000-memory.dmp	xmrig
behavioral2/memory/5612-2422-0x00007FF65AD10000-0x00007FF65B102000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
10	4248	powershell.exe
12	4248	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1408	irhPiKL.exe
2444	yBEyreR.exe
1012	jYcCqzf.exe
2224	WLksKeJ.exe
2088	yssGHxH.exe
4680	uHiQyWd.exe
5108	DCcVPKQ.exe
5164	svBgyjO.exe
2944	pJnuWOe.exe
3816	tkMPydN.exe
3736	pnVfuax.exe
3028	ImijeqT.exe
5612	cXzQnDz.exe
2364	jmyKhrj.exe
4316	EEnDwHU.exe
1564	CsXXAjT.exe
3944	VkyGLyf.exe
5480	tvkQLnZ.exe
4652	HPyfPDE.exe
5428	SsXxovW.exe
6088	AeyMDeq.exe
5444	yAobjGt.exe
1992	YiEpccp.exe
2752	GYnQcRE.exe
3132	XDOukzU.exe
468	pBXIdVM.exe
1752	VRpcteU.exe
6132	pmmVoof.exe
1624	cdskIDg.exe
3548	fnPGaSG.exe
2412	fJySBZl.exe
3324	wyFvPyv.exe
4388	HzNMwZL.exe
2796	MUjZmrY.exe
4588	qwCFOVL.exe
4596	slfExJy.exe
2280	eCABxyF.exe
5588	CqiDXtb.exe
6044	uWtVQom.exe
4924	NnnuOGb.exe
2188	eDCLvGt.exe
948	unzApnN.exe
3532	dZjpKvP.exe
1900	CEORnWQ.exe
4608	Ofmnpwd.exe
6032	QodLxBI.exe
6120	CYONiIE.exe
6096	PxvdsPP.exe
5452	RFWXyaq.exe
2152	cyydQRW.exe
5832	sAxMfWs.exe
5628	cTLGgHA.exe
5432	mitGnJC.exe
1076	DoHGtJO.exe
1152	kJGTHFL.exe
5648	sHNUmFc.exe
2968	DZQghcZ.exe
548	eWTepjk.exe
1736	NLygNoU.exe
2564	JygLBpX.exe
5564	TWvIpJE.exe
1080	MLGqYbD.exe
2704	mYGPMfz.exe
1932	OVPgcMR.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4216-0-0x00007FF742460000-0x00007FF742852000-memory.dmp	upx
behavioral2/files/0x000c000000023b34-5.dat	upx
behavioral2/files/0x000a000000023b97-7.dat	upx
behavioral2/files/0x000a000000023b96-16.dat	upx
behavioral2/files/0x000a000000023b98-20.dat	upx
behavioral2/files/0x000a000000023b9a-30.dat	upx
behavioral2/memory/2444-28-0x00007FF74D3C0000-0x00007FF74D7B2000-memory.dmp	upx
behavioral2/files/0x000a000000023b99-21.dat	upx
behavioral2/files/0x000a000000023b9b-40.dat	upx
behavioral2/memory/2224-43-0x00007FF731160000-0x00007FF731552000-memory.dmp	upx
behavioral2/files/0x000a000000023b9c-44.dat	upx
behavioral2/memory/2088-62-0x00007FF70B420000-0x00007FF70B812000-memory.dmp	upx
behavioral2/memory/1408-78-0x00007FF7965D0000-0x00007FF7969C2000-memory.dmp	upx
behavioral2/files/0x000a000000023b9e-84.dat	upx
behavioral2/files/0x000a000000023ba3-99.dat	upx
behavioral2/files/0x000a000000023ba4-105.dat	upx
behavioral2/memory/1564-123-0x00007FF6BFCB0000-0x00007FF6C00A2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba8-142.dat	upx
behavioral2/memory/6088-153-0x00007FF66C7D0000-0x00007FF66CBC2000-memory.dmp	upx
behavioral2/files/0x000a000000023bad-169.dat	upx
behavioral2/files/0x000a000000023baf-179.dat	upx
behavioral2/files/0x000a000000023bb2-194.dat	upx
behavioral2/files/0x0031000000023bb4-196.dat	upx
behavioral2/files/0x000a000000023bb3-191.dat	upx
behavioral2/files/0x000a000000023bb1-189.dat	upx
behavioral2/files/0x000a000000023bb0-184.dat	upx
behavioral2/files/0x000a000000023bae-174.dat	upx
behavioral2/files/0x000a000000023bac-164.dat	upx
behavioral2/files/0x000a000000023bab-159.dat	upx
behavioral2/files/0x000a000000023baa-154.dat	upx
behavioral2/files/0x000a000000023ba9-148.dat	upx
behavioral2/memory/5428-147-0x00007FF767BF0000-0x00007FF767FE2000-memory.dmp	upx
behavioral2/memory/4652-141-0x00007FF7886F0000-0x00007FF788AE2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba7-136.dat	upx
behavioral2/memory/5480-135-0x00007FF69D9E0000-0x00007FF69DDD2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba6-130.dat	upx
behavioral2/memory/3944-129-0x00007FF7CB370000-0x00007FF7CB762000-memory.dmp	upx
behavioral2/files/0x000a000000023ba5-124.dat	upx
behavioral2/files/0x000b000000023ba0-118.dat	upx
behavioral2/memory/4316-117-0x00007FF7349B0000-0x00007FF734DA2000-memory.dmp	upx
behavioral2/memory/2364-116-0x00007FF688AE0000-0x00007FF688ED2000-memory.dmp	upx
behavioral2/files/0x000b000000023b93-111.dat	upx
behavioral2/memory/3816-110-0x00007FF60AF10000-0x00007FF60B302000-memory.dmp	upx
behavioral2/memory/5612-104-0x00007FF65AD10000-0x00007FF65B102000-memory.dmp	upx
behavioral2/memory/3028-98-0x00007FF6D97F0000-0x00007FF6D9BE2000-memory.dmp	upx
behavioral2/memory/3736-94-0x00007FF724940000-0x00007FF724D32000-memory.dmp	upx
behavioral2/memory/5164-90-0x00007FF743E40000-0x00007FF744232000-memory.dmp	upx
behavioral2/files/0x000a000000023ba2-88.dat	upx
behavioral2/files/0x000b000000023ba1-86.dat	upx
behavioral2/files/0x000a000000023b9f-81.dat	upx
behavioral2/memory/5108-80-0x00007FF6F11E0000-0x00007FF6F15D2000-memory.dmp	upx
behavioral2/memory/4680-79-0x00007FF7B5700000-0x00007FF7B5AF2000-memory.dmp	upx
behavioral2/memory/2944-71-0x00007FF7BB170000-0x00007FF7BB562000-memory.dmp	upx
behavioral2/files/0x000a000000023b9d-67.dat	upx
behavioral2/memory/1012-38-0x00007FF6192C0000-0x00007FF6196B2000-memory.dmp	upx
behavioral2/memory/2944-2120-0x00007FF7BB170000-0x00007FF7BB562000-memory.dmp	upx
behavioral2/memory/5612-2122-0x00007FF65AD10000-0x00007FF65B102000-memory.dmp	upx
behavioral2/memory/1408-2148-0x00007FF7965D0000-0x00007FF7969C2000-memory.dmp	upx
behavioral2/memory/1012-2177-0x00007FF6192C0000-0x00007FF6196B2000-memory.dmp	upx
behavioral2/memory/2224-2179-0x00007FF731160000-0x00007FF731552000-memory.dmp	upx
behavioral2/memory/2088-2174-0x00007FF70B420000-0x00007FF70B812000-memory.dmp	upx
behavioral2/memory/2444-2171-0x00007FF74D3C0000-0x00007FF74D7B2000-memory.dmp	upx
behavioral2/memory/4680-2176-0x00007FF7B5700000-0x00007FF7B5AF2000-memory.dmp	upx
behavioral2/memory/5108-2193-0x00007FF6F11E0000-0x00007FF6F15D2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
10	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\KYMOguN.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\gYMoDbV.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\VVxgvey.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\uYnsBYr.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\hVsmCzj.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\mitGnJC.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\nSnnfaZ.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\ZvixRHn.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\BGQqZRY.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\AhKYQDo.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\teBfiFO.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\mchPoIG.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\SEMJfcS.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\ORWWoQQ.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\bEKyHMJ.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\vwpVcyM.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\rWUNPGd.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\fnVoANv.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\hjYXOZT.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\mHvDuGr.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\iNVQvvg.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\WeeWBsR.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\XRXRRLv.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\SeHeivs.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\yOdsNHs.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\UgoiHAC.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\mBWZsCk.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\fIcoaTX.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\CnQCqeI.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\YdvLAxV.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\IYDCGjd.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\WYbFBwN.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\cvCguSr.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\WwAoHhl.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\elQIXXg.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\xUnhnxJ.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\WheVKGR.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\aOucRrd.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\hYOpVsy.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\vPzwQPp.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\khcyLWw.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\ELCpxXu.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\RvctYCc.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\tuPnFCg.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\mYGPMfz.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\ALMTrDu.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\nLdzctr.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\IaSxjLd.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\idOsySl.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\uNgCYXw.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\NWlhQlQ.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\pJYoVtG.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\dlTcexG.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\FjtHhRe.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\cmUBzlw.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\JGlNzNn.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\NKguacd.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\QiUDleH.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\FukMSbR.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\FileBzj.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\uWtVQom.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\HGBARMg.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\NGxxUgZ.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
File created	C:\Windows\System\GvhmgZC.exe	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4248	powershell.exe
4248	powershell.exe
4248	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4248	powershell.exe
Token: SeLockMemoryPrivilege	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 4248	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	84
PID 4216 wrote to memory of 4248	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	84
PID 4216 wrote to memory of 1408	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	85
PID 4216 wrote to memory of 1408	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	85
PID 4216 wrote to memory of 2444	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	86
PID 4216 wrote to memory of 2444	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	86
PID 4216 wrote to memory of 1012	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	87
PID 4216 wrote to memory of 1012	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	87
PID 4216 wrote to memory of 2224	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	88
PID 4216 wrote to memory of 2224	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	88
PID 4216 wrote to memory of 2088	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	89
PID 4216 wrote to memory of 2088	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	89
PID 4216 wrote to memory of 4680	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	90
PID 4216 wrote to memory of 4680	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	90
PID 4216 wrote to memory of 5108	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	91
PID 4216 wrote to memory of 5108	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	91
PID 4216 wrote to memory of 5164	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	92
PID 4216 wrote to memory of 5164	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	92
PID 4216 wrote to memory of 2944	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	93
PID 4216 wrote to memory of 2944	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	93
PID 4216 wrote to memory of 3736	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	94
PID 4216 wrote to memory of 3736	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	94
PID 4216 wrote to memory of 3816	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	95
PID 4216 wrote to memory of 3816	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	95
PID 4216 wrote to memory of 3028	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	96
PID 4216 wrote to memory of 3028	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	96
PID 4216 wrote to memory of 5612	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	97
PID 4216 wrote to memory of 5612	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	97
PID 4216 wrote to memory of 2364	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	98
PID 4216 wrote to memory of 2364	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	98
PID 4216 wrote to memory of 4316	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	99
PID 4216 wrote to memory of 4316	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	99
PID 4216 wrote to memory of 1564	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	100
PID 4216 wrote to memory of 1564	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	100
PID 4216 wrote to memory of 3944	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	101
PID 4216 wrote to memory of 3944	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	101
PID 4216 wrote to memory of 5480	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	102
PID 4216 wrote to memory of 5480	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	102
PID 4216 wrote to memory of 4652	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	103
PID 4216 wrote to memory of 4652	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	103
PID 4216 wrote to memory of 5428	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	104
PID 4216 wrote to memory of 5428	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	104
PID 4216 wrote to memory of 6088	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	105
PID 4216 wrote to memory of 6088	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	105
PID 4216 wrote to memory of 5444	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	106
PID 4216 wrote to memory of 5444	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	106
PID 4216 wrote to memory of 1992	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	107
PID 4216 wrote to memory of 1992	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	107
PID 4216 wrote to memory of 2752	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	108
PID 4216 wrote to memory of 2752	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	108
PID 4216 wrote to memory of 3132	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	109
PID 4216 wrote to memory of 3132	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	109
PID 4216 wrote to memory of 468	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	110
PID 4216 wrote to memory of 468	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	110
PID 4216 wrote to memory of 1752	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	111
PID 4216 wrote to memory of 1752	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	111
PID 4216 wrote to memory of 6132	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	112
PID 4216 wrote to memory of 6132	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	112
PID 4216 wrote to memory of 1624	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	113
PID 4216 wrote to memory of 1624	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	113
PID 4216 wrote to memory of 3548	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	114
PID 4216 wrote to memory of 3548	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	114
PID 4216 wrote to memory of 2412	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	115
PID 4216 wrote to memory of 2412	4216	0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0a8d9036c2528a7f4995a5c18067ab95_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4248
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4248" "2980" "2912" "2984" "0" "0" "2988" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:13036
- C:\Windows\System\irhPiKL.exe
  C:\Windows\System\irhPiKL.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\yBEyreR.exe
  C:\Windows\System\yBEyreR.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\jYcCqzf.exe
  C:\Windows\System\jYcCqzf.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\WLksKeJ.exe
  C:\Windows\System\WLksKeJ.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\yssGHxH.exe
  C:\Windows\System\yssGHxH.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\uHiQyWd.exe
  C:\Windows\System\uHiQyWd.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\DCcVPKQ.exe
  C:\Windows\System\DCcVPKQ.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\svBgyjO.exe
  C:\Windows\System\svBgyjO.exe
  2⤵
  - Executes dropped EXE
  PID:5164
- C:\Windows\System\pJnuWOe.exe
  C:\Windows\System\pJnuWOe.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\pnVfuax.exe
  C:\Windows\System\pnVfuax.exe
  2⤵
  - Executes dropped EXE
  PID:3736
- C:\Windows\System\tkMPydN.exe
  C:\Windows\System\tkMPydN.exe
  2⤵
  - Executes dropped EXE
  PID:3816
- C:\Windows\System\ImijeqT.exe
  C:\Windows\System\ImijeqT.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\cXzQnDz.exe
  C:\Windows\System\cXzQnDz.exe
  2⤵
  - Executes dropped EXE
  PID:5612
- C:\Windows\System\jmyKhrj.exe
  C:\Windows\System\jmyKhrj.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\EEnDwHU.exe
  C:\Windows\System\EEnDwHU.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\CsXXAjT.exe
  C:\Windows\System\CsXXAjT.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\VkyGLyf.exe
  C:\Windows\System\VkyGLyf.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\tvkQLnZ.exe
  C:\Windows\System\tvkQLnZ.exe
  2⤵
  - Executes dropped EXE
  PID:5480
- C:\Windows\System\HPyfPDE.exe
  C:\Windows\System\HPyfPDE.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\SsXxovW.exe
  C:\Windows\System\SsXxovW.exe
  2⤵
  - Executes dropped EXE
  PID:5428
- C:\Windows\System\AeyMDeq.exe
  C:\Windows\System\AeyMDeq.exe
  2⤵
  - Executes dropped EXE
  PID:6088
- C:\Windows\System\yAobjGt.exe
  C:\Windows\System\yAobjGt.exe
  2⤵
  - Executes dropped EXE
  PID:5444
- C:\Windows\System\YiEpccp.exe
  C:\Windows\System\YiEpccp.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\GYnQcRE.exe
  C:\Windows\System\GYnQcRE.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\XDOukzU.exe
  C:\Windows\System\XDOukzU.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\pBXIdVM.exe
  C:\Windows\System\pBXIdVM.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\VRpcteU.exe
  C:\Windows\System\VRpcteU.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\pmmVoof.exe
  C:\Windows\System\pmmVoof.exe
  2⤵
  - Executes dropped EXE
  PID:6132
- C:\Windows\System\cdskIDg.exe
  C:\Windows\System\cdskIDg.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\fnPGaSG.exe
  C:\Windows\System\fnPGaSG.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\fJySBZl.exe
  C:\Windows\System\fJySBZl.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\wyFvPyv.exe
  C:\Windows\System\wyFvPyv.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\HzNMwZL.exe
  C:\Windows\System\HzNMwZL.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\MUjZmrY.exe
  C:\Windows\System\MUjZmrY.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\qwCFOVL.exe
  C:\Windows\System\qwCFOVL.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\slfExJy.exe
  C:\Windows\System\slfExJy.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\eCABxyF.exe
  C:\Windows\System\eCABxyF.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\CqiDXtb.exe
  C:\Windows\System\CqiDXtb.exe
  2⤵
  - Executes dropped EXE
  PID:5588
- C:\Windows\System\uWtVQom.exe
  C:\Windows\System\uWtVQom.exe
  2⤵
  - Executes dropped EXE
  PID:6044
- C:\Windows\System\NnnuOGb.exe
  C:\Windows\System\NnnuOGb.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\eDCLvGt.exe
  C:\Windows\System\eDCLvGt.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\unzApnN.exe
  C:\Windows\System\unzApnN.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\dZjpKvP.exe
  C:\Windows\System\dZjpKvP.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\CEORnWQ.exe
  C:\Windows\System\CEORnWQ.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\Ofmnpwd.exe
  C:\Windows\System\Ofmnpwd.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\QodLxBI.exe
  C:\Windows\System\QodLxBI.exe
  2⤵
  - Executes dropped EXE
  PID:6032
- C:\Windows\System\CYONiIE.exe
  C:\Windows\System\CYONiIE.exe
  2⤵
  - Executes dropped EXE
  PID:6120
- C:\Windows\System\PxvdsPP.exe
  C:\Windows\System\PxvdsPP.exe
  2⤵
  - Executes dropped EXE
  PID:6096
- C:\Windows\System\RFWXyaq.exe
  C:\Windows\System\RFWXyaq.exe
  2⤵
  - Executes dropped EXE
  PID:5452
- C:\Windows\System\cyydQRW.exe
  C:\Windows\System\cyydQRW.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\sAxMfWs.exe
  C:\Windows\System\sAxMfWs.exe
  2⤵
  - Executes dropped EXE
  PID:5832
- C:\Windows\System\cTLGgHA.exe
  C:\Windows\System\cTLGgHA.exe
  2⤵
  - Executes dropped EXE
  PID:5628
- C:\Windows\System\mitGnJC.exe
  C:\Windows\System\mitGnJC.exe
  2⤵
  - Executes dropped EXE
  PID:5432
- C:\Windows\System\DoHGtJO.exe
  C:\Windows\System\DoHGtJO.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\kJGTHFL.exe
  C:\Windows\System\kJGTHFL.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\sHNUmFc.exe
  C:\Windows\System\sHNUmFc.exe
  2⤵
  - Executes dropped EXE
  PID:5648
- C:\Windows\System\DZQghcZ.exe
  C:\Windows\System\DZQghcZ.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\eWTepjk.exe
  C:\Windows\System\eWTepjk.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\NLygNoU.exe
  C:\Windows\System\NLygNoU.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\JygLBpX.exe
  C:\Windows\System\JygLBpX.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\TWvIpJE.exe
  C:\Windows\System\TWvIpJE.exe
  2⤵
  - Executes dropped EXE
  PID:5564
- C:\Windows\System\MLGqYbD.exe
  C:\Windows\System\MLGqYbD.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\mYGPMfz.exe
  C:\Windows\System\mYGPMfz.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\OVPgcMR.exe
  C:\Windows\System\OVPgcMR.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\QMFiiKG.exe
  C:\Windows\System\QMFiiKG.exe
  2⤵
  PID:3932
- C:\Windows\System\FYhESKE.exe
  C:\Windows\System\FYhESKE.exe
  2⤵
  PID:5964
- C:\Windows\System\QdsENNv.exe
  C:\Windows\System\QdsENNv.exe
  2⤵
  PID:5192
- C:\Windows\System\nzvwLOj.exe
  C:\Windows\System\nzvwLOj.exe
  2⤵
  PID:1836
- C:\Windows\System\CtbzbsM.exe
  C:\Windows\System\CtbzbsM.exe
  2⤵
  PID:5968
- C:\Windows\System\EKbLjxs.exe
  C:\Windows\System\EKbLjxs.exe
  2⤵
  PID:4696
- C:\Windows\System\SOXYTuu.exe
  C:\Windows\System\SOXYTuu.exe
  2⤵
  PID:4432
- C:\Windows\System\cJTaOaA.exe
  C:\Windows\System\cJTaOaA.exe
  2⤵
  PID:4024
- C:\Windows\System\BGQqZRY.exe
  C:\Windows\System\BGQqZRY.exe
  2⤵
  PID:4512
- C:\Windows\System\oReaPvP.exe
  C:\Windows\System\oReaPvP.exe
  2⤵
  PID:4364
- C:\Windows\System\tjYyqJw.exe
  C:\Windows\System\tjYyqJw.exe
  2⤵
  PID:4412
- C:\Windows\System\jTWKyvV.exe
  C:\Windows\System\jTWKyvV.exe
  2⤵
  PID:1708
- C:\Windows\System\nRdKmmB.exe
  C:\Windows\System\nRdKmmB.exe
  2⤵
  PID:5732
- C:\Windows\System\KpyOdJN.exe
  C:\Windows\System\KpyOdJN.exe
  2⤵
  PID:5136
- C:\Windows\System\cqxllol.exe
  C:\Windows\System\cqxllol.exe
  2⤵
  PID:4932
- C:\Windows\System\rFfNamb.exe
  C:\Windows\System\rFfNamb.exe
  2⤵
  PID:3920
- C:\Windows\System\UgoiHAC.exe
  C:\Windows\System\UgoiHAC.exe
  2⤵
  PID:744
- C:\Windows\System\lsmZpWD.exe
  C:\Windows\System\lsmZpWD.exe
  2⤵
  PID:3792
- C:\Windows\System\uxJlTlZ.exe
  C:\Windows\System\uxJlTlZ.exe
  2⤵
  PID:2492
- C:\Windows\System\CEOcbvI.exe
  C:\Windows\System\CEOcbvI.exe
  2⤵
  PID:4612
- C:\Windows\System\ghomxPR.exe
  C:\Windows\System\ghomxPR.exe
  2⤵
  PID:5780
- C:\Windows\System\SWjLsLZ.exe
  C:\Windows\System\SWjLsLZ.exe
  2⤵
  PID:4344
- C:\Windows\System\uhjKGfx.exe
  C:\Windows\System\uhjKGfx.exe
  2⤵
  PID:1784
- C:\Windows\System\OcapDDK.exe
  C:\Windows\System\OcapDDK.exe
  2⤵
  PID:4048
- C:\Windows\System\SzKxZJk.exe
  C:\Windows\System\SzKxZJk.exe
  2⤵
  PID:464
- C:\Windows\System\ebFJKJW.exe
  C:\Windows\System\ebFJKJW.exe
  2⤵
  PID:5360
- C:\Windows\System\KvjKJJP.exe
  C:\Windows\System\KvjKJJP.exe
  2⤵
  PID:4080
- C:\Windows\System\vXlaehb.exe
  C:\Windows\System\vXlaehb.exe
  2⤵
  PID:1160
- C:\Windows\System\nSnnfaZ.exe
  C:\Windows\System\nSnnfaZ.exe
  2⤵
  PID:1212
- C:\Windows\System\NMukInS.exe
  C:\Windows\System\NMukInS.exe
  2⤵
  PID:6036
- C:\Windows\System\xpXtDBG.exe
  C:\Windows\System\xpXtDBG.exe
  2⤵
  PID:3664
- C:\Windows\System\FYdhfLl.exe
  C:\Windows\System\FYdhfLl.exe
  2⤵
  PID:5544
- C:\Windows\System\yOPvrQV.exe
  C:\Windows\System\yOPvrQV.exe
  2⤵
  PID:2324
- C:\Windows\System\XRXRRLv.exe
  C:\Windows\System\XRXRRLv.exe
  2⤵
  PID:3744
- C:\Windows\System\twywxqA.exe
  C:\Windows\System\twywxqA.exe
  2⤵
  PID:6104
- C:\Windows\System\izEYUUU.exe
  C:\Windows\System\izEYUUU.exe
  2⤵
  PID:6124
- C:\Windows\System\khcyLWw.exe
  C:\Windows\System\khcyLWw.exe
  2⤵
  PID:5300
- C:\Windows\System\CDRvriS.exe
  C:\Windows\System\CDRvriS.exe
  2⤵
  PID:3116
- C:\Windows\System\WeeWBsR.exe
  C:\Windows\System\WeeWBsR.exe
  2⤵
  PID:800
- C:\Windows\System\wrdCuFi.exe
  C:\Windows\System\wrdCuFi.exe
  2⤵
  PID:832
- C:\Windows\System\KYMOguN.exe
  C:\Windows\System\KYMOguN.exe
  2⤵
  PID:5620
- C:\Windows\System\PCemDdO.exe
  C:\Windows\System\PCemDdO.exe
  2⤵
  PID:6028
- C:\Windows\System\qVgnUYl.exe
  C:\Windows\System\qVgnUYl.exe
  2⤵
  PID:216
- C:\Windows\System\kGSOARs.exe
  C:\Windows\System\kGSOARs.exe
  2⤵
  PID:1088
- C:\Windows\System\zALqJHE.exe
  C:\Windows\System\zALqJHE.exe
  2⤵
  PID:2812
- C:\Windows\System\DTWJqzQ.exe
  C:\Windows\System\DTWJqzQ.exe
  2⤵
  PID:4132
- C:\Windows\System\UjYnGwQ.exe
  C:\Windows\System\UjYnGwQ.exe
  2⤵
  PID:4468
- C:\Windows\System\BjouYDJ.exe
  C:\Windows\System\BjouYDJ.exe
  2⤵
  PID:692
- C:\Windows\System\bimINCB.exe
  C:\Windows\System\bimINCB.exe
  2⤵
  PID:1236
- C:\Windows\System\jpvHOop.exe
  C:\Windows\System\jpvHOop.exe
  2⤵
  PID:4424
- C:\Windows\System\ihjvDsC.exe
  C:\Windows\System\ihjvDsC.exe
  2⤵
  PID:2652
- C:\Windows\System\bBdlSrJ.exe
  C:\Windows\System\bBdlSrJ.exe
  2⤵
  PID:5492
- C:\Windows\System\LClvnPv.exe
  C:\Windows\System\LClvnPv.exe
  2⤵
  PID:5364
- C:\Windows\System\FjtHhRe.exe
  C:\Windows\System\FjtHhRe.exe
  2⤵
  PID:2336
- C:\Windows\System\jwCOZcQ.exe
  C:\Windows\System\jwCOZcQ.exe
  2⤵
  PID:1100
- C:\Windows\System\cSwStrm.exe
  C:\Windows\System\cSwStrm.exe
  2⤵
  PID:3172
- C:\Windows\System\CZBNHrr.exe
  C:\Windows\System\CZBNHrr.exe
  2⤵
  PID:3516
- C:\Windows\System\AMvPEZe.exe
  C:\Windows\System\AMvPEZe.exe
  2⤵
  PID:1856
- C:\Windows\System\gudRbdR.exe
  C:\Windows\System\gudRbdR.exe
  2⤵
  PID:4692
- C:\Windows\System\HaUOvjQ.exe
  C:\Windows\System\HaUOvjQ.exe
  2⤵
  PID:6064
- C:\Windows\System\dJptcfi.exe
  C:\Windows\System\dJptcfi.exe
  2⤵
  PID:2764
- C:\Windows\System\DIDCiUZ.exe
  C:\Windows\System\DIDCiUZ.exe
  2⤵
  PID:3488
- C:\Windows\System\umhXBBw.exe
  C:\Windows\System\umhXBBw.exe
  2⤵
  PID:1664
- C:\Windows\System\IsJqfGh.exe
  C:\Windows\System\IsJqfGh.exe
  2⤵
  PID:4476
- C:\Windows\System\uBWREbL.exe
  C:\Windows\System\uBWREbL.exe
  2⤵
  PID:5608
- C:\Windows\System\zzhaCKZ.exe
  C:\Windows\System\zzhaCKZ.exe
  2⤵
  PID:5208
- C:\Windows\System\mRwQwqw.exe
  C:\Windows\System\mRwQwqw.exe
  2⤵
  PID:1128
- C:\Windows\System\LPDwNUJ.exe
  C:\Windows\System\LPDwNUJ.exe
  2⤵
  PID:3284
- C:\Windows\System\YFFovKF.exe
  C:\Windows\System\YFFovKF.exe
  2⤵
  PID:212
- C:\Windows\System\KFJfuVX.exe
  C:\Windows\System\KFJfuVX.exe
  2⤵
  PID:1604
- C:\Windows\System\WagjBXj.exe
  C:\Windows\System\WagjBXj.exe
  2⤵
  PID:3964
- C:\Windows\System\GNEIdkg.exe
  C:\Windows\System\GNEIdkg.exe
  2⤵
  PID:3808
- C:\Windows\System\WjmHraK.exe
  C:\Windows\System\WjmHraK.exe
  2⤵
  PID:5256
- C:\Windows\System\eVKfDjD.exe
  C:\Windows\System\eVKfDjD.exe
  2⤵
  PID:5276
- C:\Windows\System\fkncKYb.exe
  C:\Windows\System\fkncKYb.exe
  2⤵
  PID:6164
- C:\Windows\System\mUiZELC.exe
  C:\Windows\System\mUiZELC.exe
  2⤵
  PID:6188
- C:\Windows\System\chRWuls.exe
  C:\Windows\System\chRWuls.exe
  2⤵
  PID:6216
- C:\Windows\System\iCoWbAb.exe
  C:\Windows\System\iCoWbAb.exe
  2⤵
  PID:6248
- C:\Windows\System\gctUdwQ.exe
  C:\Windows\System\gctUdwQ.exe
  2⤵
  PID:6276
- C:\Windows\System\LsKVRQb.exe
  C:\Windows\System\LsKVRQb.exe
  2⤵
  PID:6304
- C:\Windows\System\EroHhwJ.exe
  C:\Windows\System\EroHhwJ.exe
  2⤵
  PID:6328
- C:\Windows\System\byWEXNL.exe
  C:\Windows\System\byWEXNL.exe
  2⤵
  PID:6356
- C:\Windows\System\DEXdbLo.exe
  C:\Windows\System\DEXdbLo.exe
  2⤵
  PID:6384
- C:\Windows\System\XULMIyI.exe
  C:\Windows\System\XULMIyI.exe
  2⤵
  PID:6416
- C:\Windows\System\CCyPnvQ.exe
  C:\Windows\System\CCyPnvQ.exe
  2⤵
  PID:6440
- C:\Windows\System\PLHBEWI.exe
  C:\Windows\System\PLHBEWI.exe
  2⤵
  PID:6468
- C:\Windows\System\dIbsZEo.exe
  C:\Windows\System\dIbsZEo.exe
  2⤵
  PID:6496
- C:\Windows\System\JyRcJpo.exe
  C:\Windows\System\JyRcJpo.exe
  2⤵
  PID:6528
- C:\Windows\System\irLkQGM.exe
  C:\Windows\System\irLkQGM.exe
  2⤵
  PID:6552
- C:\Windows\System\FqncuFG.exe
  C:\Windows\System\FqncuFG.exe
  2⤵
  PID:6580
- C:\Windows\System\SPwGwAT.exe
  C:\Windows\System\SPwGwAT.exe
  2⤵
  PID:6612
- C:\Windows\System\dWZvpom.exe
  C:\Windows\System\dWZvpom.exe
  2⤵
  PID:6636
- C:\Windows\System\pMQlJYk.exe
  C:\Windows\System\pMQlJYk.exe
  2⤵
  PID:6664
- C:\Windows\System\QpXLXSe.exe
  C:\Windows\System\QpXLXSe.exe
  2⤵
  PID:6692
- C:\Windows\System\wAxZjnS.exe
  C:\Windows\System\wAxZjnS.exe
  2⤵
  PID:6724
- C:\Windows\System\xhXKTfr.exe
  C:\Windows\System\xhXKTfr.exe
  2⤵
  PID:6752
- C:\Windows\System\eBPrwjC.exe
  C:\Windows\System\eBPrwjC.exe
  2⤵
  PID:6776
- C:\Windows\System\cHPbEvU.exe
  C:\Windows\System\cHPbEvU.exe
  2⤵
  PID:6804
- C:\Windows\System\PSVaobm.exe
  C:\Windows\System\PSVaobm.exe
  2⤵
  PID:6832
- C:\Windows\System\hMDcilS.exe
  C:\Windows\System\hMDcilS.exe
  2⤵
  PID:6860
- C:\Windows\System\TZUlRuk.exe
  C:\Windows\System\TZUlRuk.exe
  2⤵
  PID:6888
- C:\Windows\System\yktgZdM.exe
  C:\Windows\System\yktgZdM.exe
  2⤵
  PID:6916
- C:\Windows\System\yOLQreo.exe
  C:\Windows\System\yOLQreo.exe
  2⤵
  PID:6944
- C:\Windows\System\dJmApoi.exe
  C:\Windows\System\dJmApoi.exe
  2⤵
  PID:6976
- C:\Windows\System\Hsqxfsc.exe
  C:\Windows\System\Hsqxfsc.exe
  2⤵
  PID:7000
- C:\Windows\System\SeHeivs.exe
  C:\Windows\System\SeHeivs.exe
  2⤵
  PID:7028
- C:\Windows\System\BehMyEz.exe
  C:\Windows\System\BehMyEz.exe
  2⤵
  PID:7060
- C:\Windows\System\HePXbtj.exe
  C:\Windows\System\HePXbtj.exe
  2⤵
  PID:7088
- C:\Windows\System\vToPFWb.exe
  C:\Windows\System\vToPFWb.exe
  2⤵
  PID:7116
- C:\Windows\System\HMwoBXX.exe
  C:\Windows\System\HMwoBXX.exe
  2⤵
  PID:1380
- C:\Windows\System\Pbyqdaz.exe
  C:\Windows\System\Pbyqdaz.exe
  2⤵
  PID:5212
- C:\Windows\System\SfVWwjg.exe
  C:\Windows\System\SfVWwjg.exe
  2⤵
  PID:5820
- C:\Windows\System\hngpnkv.exe
  C:\Windows\System\hngpnkv.exe
  2⤵
  PID:4788
- C:\Windows\System\hCPvtyF.exe
  C:\Windows\System\hCPvtyF.exe
  2⤵
  PID:3612
- C:\Windows\System\mfllbqp.exe
  C:\Windows\System\mfllbqp.exe
  2⤵
  PID:6264
- C:\Windows\System\GmEgeYx.exe
  C:\Windows\System\GmEgeYx.exe
  2⤵
  PID:6316
- C:\Windows\System\WwAoHhl.exe
  C:\Windows\System\WwAoHhl.exe
  2⤵
  PID:6352
- C:\Windows\System\HyUFkWN.exe
  C:\Windows\System\HyUFkWN.exe
  2⤵
  PID:6400
- C:\Windows\System\ZqzKNuR.exe
  C:\Windows\System\ZqzKNuR.exe
  2⤵
  PID:5668
- C:\Windows\System\BrxWAIZ.exe
  C:\Windows\System\BrxWAIZ.exe
  2⤵
  PID:6540
- C:\Windows\System\ORWWoQQ.exe
  C:\Windows\System\ORWWoQQ.exe
  2⤵
  PID:2800
- C:\Windows\System\dMLiyOA.exe
  C:\Windows\System\dMLiyOA.exe
  2⤵
  PID:3136
- C:\Windows\System\gDLItiY.exe
  C:\Windows\System\gDLItiY.exe
  2⤵
  PID:6684
- C:\Windows\System\tNUSsjJ.exe
  C:\Windows\System\tNUSsjJ.exe
  2⤵
  PID:6712
- C:\Windows\System\aKioLxG.exe
  C:\Windows\System\aKioLxG.exe
  2⤵
  PID:5744
- C:\Windows\System\SBkbLgq.exe
  C:\Windows\System\SBkbLgq.exe
  2⤵
  PID:6744
- C:\Windows\System\nrqbhZc.exe
  C:\Windows\System\nrqbhZc.exe
  2⤵
  PID:1960
- C:\Windows\System\EVZmxxW.exe
  C:\Windows\System\EVZmxxW.exe
  2⤵
  PID:6820
- C:\Windows\System\cmUBzlw.exe
  C:\Windows\System\cmUBzlw.exe
  2⤵
  PID:6852
- C:\Windows\System\LBMmNFm.exe
  C:\Windows\System\LBMmNFm.exe
  2⤵
  PID:6912
- C:\Windows\System\DhmDbeW.exe
  C:\Windows\System\DhmDbeW.exe
  2⤵
  PID:6960
- C:\Windows\System\YeFFuUG.exe
  C:\Windows\System\YeFFuUG.exe
  2⤵
  PID:7016
- C:\Windows\System\huGOIkM.exe
  C:\Windows\System\huGOIkM.exe
  2⤵
  PID:7052
- C:\Windows\System\gYMoDbV.exe
  C:\Windows\System\gYMoDbV.exe
  2⤵
  PID:5196
- C:\Windows\System\JhHzhqI.exe
  C:\Windows\System\JhHzhqI.exe
  2⤵
  PID:4452
- C:\Windows\System\yOdsNHs.exe
  C:\Windows\System\yOdsNHs.exe
  2⤵
  PID:4628
- C:\Windows\System\qTRUbVP.exe
  C:\Windows\System\qTRUbVP.exe
  2⤵
  PID:7160
- C:\Windows\System\qitmEyQ.exe
  C:\Windows\System\qitmEyQ.exe
  2⤵
  PID:3784
- C:\Windows\System\TylsCqR.exe
  C:\Windows\System\TylsCqR.exe
  2⤵
  PID:5484
- C:\Windows\System\lNoFIAz.exe
  C:\Windows\System\lNoFIAz.exe
  2⤵
  PID:1400
- C:\Windows\System\HCJdysh.exe
  C:\Windows\System\HCJdysh.exe
  2⤵
  PID:1608
- C:\Windows\System\aIjDTho.exe
  C:\Windows\System\aIjDTho.exe
  2⤵
  PID:6296
- C:\Windows\System\BdifHYf.exe
  C:\Windows\System\BdifHYf.exe
  2⤵
  PID:6380
- C:\Windows\System\JYdcLmA.exe
  C:\Windows\System\JYdcLmA.exe
  2⤵
  PID:6548
- C:\Windows\System\QywgmlG.exe
  C:\Windows\System\QywgmlG.exe
  2⤵
  PID:6632
- C:\Windows\System\waCpmfE.exe
  C:\Windows\System\waCpmfE.exe
  2⤵
  PID:5132
- C:\Windows\System\eREbDFj.exe
  C:\Windows\System\eREbDFj.exe
  2⤵
  PID:5800
- C:\Windows\System\EDZAbCE.exe
  C:\Windows\System\EDZAbCE.exe
  2⤵
  PID:6848
- C:\Windows\System\OMLGaPF.exe
  C:\Windows\System\OMLGaPF.exe
  2⤵
  PID:7044
- C:\Windows\System\Hgkbaez.exe
  C:\Windows\System\Hgkbaez.exe
  2⤵
  PID:4560
- C:\Windows\System\cCYOeuK.exe
  C:\Windows\System\cCYOeuK.exe
  2⤵
  PID:5580
- C:\Windows\System\mBWZsCk.exe
  C:\Windows\System\mBWZsCk.exe
  2⤵
  PID:6292
- C:\Windows\System\WPWnKUq.exe
  C:\Windows\System\WPWnKUq.exe
  2⤵
  PID:3224
- C:\Windows\System\bvEPzhg.exe
  C:\Windows\System\bvEPzhg.exe
  2⤵
  PID:5384
- C:\Windows\System\MJHRcuU.exe
  C:\Windows\System\MJHRcuU.exe
  2⤵
  PID:4632
- C:\Windows\System\LCaNnAV.exe
  C:\Windows\System\LCaNnAV.exe
  2⤵
  PID:6968
- C:\Windows\System\swNaEho.exe
  C:\Windows\System\swNaEho.exe
  2⤵
  PID:1060
- C:\Windows\System\jFCaFKd.exe
  C:\Windows\System\jFCaFKd.exe
  2⤵
  PID:6456
- C:\Windows\System\CnkmyWp.exe
  C:\Windows\System\CnkmyWp.exe
  2⤵
  PID:5252
- C:\Windows\System\WGVGwfn.exe
  C:\Windows\System\WGVGwfn.exe
  2⤵
  PID:2912
- C:\Windows\System\esPsLBq.exe
  C:\Windows\System\esPsLBq.exe
  2⤵
  PID:6736
- C:\Windows\System\HoKVgKm.exe
  C:\Windows\System\HoKVgKm.exe
  2⤵
  PID:7180
- C:\Windows\System\yinekow.exe
  C:\Windows\System\yinekow.exe
  2⤵
  PID:7208
- C:\Windows\System\AlHmFfK.exe
  C:\Windows\System\AlHmFfK.exe
  2⤵
  PID:7232
- C:\Windows\System\RXXHDOR.exe
  C:\Windows\System\RXXHDOR.exe
  2⤵
  PID:7280
- C:\Windows\System\qtLtBCK.exe
  C:\Windows\System\qtLtBCK.exe
  2⤵
  PID:7308
- C:\Windows\System\FhGegmq.exe
  C:\Windows\System\FhGegmq.exe
  2⤵
  PID:7340
- C:\Windows\System\JtGeNGj.exe
  C:\Windows\System\JtGeNGj.exe
  2⤵
  PID:7360
- C:\Windows\System\YRulEcX.exe
  C:\Windows\System\YRulEcX.exe
  2⤵
  PID:7384
- C:\Windows\System\TNoploX.exe
  C:\Windows\System\TNoploX.exe
  2⤵
  PID:7420
- C:\Windows\System\nNVYslD.exe
  C:\Windows\System\nNVYslD.exe
  2⤵
  PID:7484
- C:\Windows\System\OjehAzp.exe
  C:\Windows\System\OjehAzp.exe
  2⤵
  PID:7508
- C:\Windows\System\BvzjJEo.exe
  C:\Windows\System\BvzjJEo.exe
  2⤵
  PID:7532
- C:\Windows\System\TyXsCJC.exe
  C:\Windows\System\TyXsCJC.exe
  2⤵
  PID:7556
- C:\Windows\System\tmGCSet.exe
  C:\Windows\System\tmGCSet.exe
  2⤵
  PID:7580
- C:\Windows\System\oohYpzs.exe
  C:\Windows\System\oohYpzs.exe
  2⤵
  PID:7600
- C:\Windows\System\znbCqsU.exe
  C:\Windows\System\znbCqsU.exe
  2⤵
  PID:7636
- C:\Windows\System\IpLCjgz.exe
  C:\Windows\System\IpLCjgz.exe
  2⤵
  PID:7680
- C:\Windows\System\sDKpAYZ.exe
  C:\Windows\System\sDKpAYZ.exe
  2⤵
  PID:7696
- C:\Windows\System\RXJZlvU.exe
  C:\Windows\System\RXJZlvU.exe
  2⤵
  PID:7720
- C:\Windows\System\LfbubzV.exe
  C:\Windows\System\LfbubzV.exe
  2⤵
  PID:7736
- C:\Windows\System\tlvPlqP.exe
  C:\Windows\System\tlvPlqP.exe
  2⤵
  PID:7784
- C:\Windows\System\UptHYIh.exe
  C:\Windows\System\UptHYIh.exe
  2⤵
  PID:7808
- C:\Windows\System\hxCBCpt.exe
  C:\Windows\System\hxCBCpt.exe
  2⤵
  PID:7836
- C:\Windows\System\SUFQSjg.exe
  C:\Windows\System\SUFQSjg.exe
  2⤵
  PID:7884
- C:\Windows\System\HCtrVEI.exe
  C:\Windows\System\HCtrVEI.exe
  2⤵
  PID:7904
- C:\Windows\System\vJRXzOU.exe
  C:\Windows\System\vJRXzOU.exe
  2⤵
  PID:7928
- C:\Windows\System\bEKyHMJ.exe
  C:\Windows\System\bEKyHMJ.exe
  2⤵
  PID:7968
- C:\Windows\System\YlqGqeC.exe
  C:\Windows\System\YlqGqeC.exe
  2⤵
  PID:7984
- C:\Windows\System\dlTcexG.exe
  C:\Windows\System\dlTcexG.exe
  2⤵
  PID:8012
- C:\Windows\System\fIcoaTX.exe
  C:\Windows\System\fIcoaTX.exe
  2⤵
  PID:8040
- C:\Windows\System\KoMpIih.exe
  C:\Windows\System\KoMpIih.exe
  2⤵
  PID:8064
- C:\Windows\System\CnQCqeI.exe
  C:\Windows\System\CnQCqeI.exe
  2⤵
  PID:8092
- C:\Windows\System\FsrIBUJ.exe
  C:\Windows\System\FsrIBUJ.exe
  2⤵
  PID:8112
- C:\Windows\System\KHcJmft.exe
  C:\Windows\System\KHcJmft.exe
  2⤵
  PID:8132
- C:\Windows\System\ldnXAFq.exe
  C:\Windows\System\ldnXAFq.exe
  2⤵
  PID:8160
- C:\Windows\System\DNuwUaP.exe
  C:\Windows\System\DNuwUaP.exe
  2⤵
  PID:8184
- C:\Windows\System\inQFbyi.exe
  C:\Windows\System\inQFbyi.exe
  2⤵
  PID:7204
- C:\Windows\System\VZawjyL.exe
  C:\Windows\System\VZawjyL.exe
  2⤵
  PID:7200
- C:\Windows\System\BspOdpG.exe
  C:\Windows\System\BspOdpG.exe
  2⤵
  PID:7324
- C:\Windows\System\jANvNZr.exe
  C:\Windows\System\jANvNZr.exe
  2⤵
  PID:7276
- C:\Windows\System\AFstpBK.exe
  C:\Windows\System\AFstpBK.exe
  2⤵
  PID:7404
- C:\Windows\System\xZbXOkj.exe
  C:\Windows\System\xZbXOkj.exe
  2⤵
  PID:7568
- C:\Windows\System\gJHtTan.exe
  C:\Windows\System\gJHtTan.exe
  2⤵
  PID:7596
- C:\Windows\System\wSIyWPe.exe
  C:\Windows\System\wSIyWPe.exe
  2⤵
  PID:7692
- C:\Windows\System\WlzZSrw.exe
  C:\Windows\System\WlzZSrw.exe
  2⤵
  PID:7756
- C:\Windows\System\xZEjbKE.exe
  C:\Windows\System\xZEjbKE.exe
  2⤵
  PID:7796
- C:\Windows\System\pKCiKwb.exe
  C:\Windows\System\pKCiKwb.exe
  2⤵
  PID:7912
- C:\Windows\System\sAlOJnD.exe
  C:\Windows\System\sAlOJnD.exe
  2⤵
  PID:7924
- C:\Windows\System\GvhmgZC.exe
  C:\Windows\System\GvhmgZC.exe
  2⤵
  PID:7976
- C:\Windows\System\vwpVcyM.exe
  C:\Windows\System\vwpVcyM.exe
  2⤵
  PID:8028
- C:\Windows\System\wiQIkLD.exe
  C:\Windows\System\wiQIkLD.exe
  2⤵
  PID:8140
- C:\Windows\System\sUzsAuv.exe
  C:\Windows\System\sUzsAuv.exe
  2⤵
  PID:7172
- C:\Windows\System\vMWNhMJ.exe
  C:\Windows\System\vMWNhMJ.exe
  2⤵
  PID:7296
- C:\Windows\System\uIHNmGY.exe
  C:\Windows\System\uIHNmGY.exe
  2⤵
  PID:7400
- C:\Windows\System\IaSxjLd.exe
  C:\Windows\System\IaSxjLd.exe
  2⤵
  PID:7704
- C:\Windows\System\tWtMdPI.exe
  C:\Windows\System\tWtMdPI.exe
  2⤵
  PID:7880
- C:\Windows\System\HlpwcQe.exe
  C:\Windows\System\HlpwcQe.exe
  2⤵
  PID:8100
- C:\Windows\System\TYSytYz.exe
  C:\Windows\System\TYSytYz.exe
  2⤵
  PID:8128
- C:\Windows\System\VVxgvey.exe
  C:\Windows\System\VVxgvey.exe
  2⤵
  PID:8172
- C:\Windows\System\SSZxgnk.exe
  C:\Windows\System\SSZxgnk.exe
  2⤵
  PID:7620
- C:\Windows\System\aVRaJEj.exe
  C:\Windows\System\aVRaJEj.exe
  2⤵
  PID:7416
- C:\Windows\System\NGZLSqI.exe
  C:\Windows\System\NGZLSqI.exe
  2⤵
  PID:8204
- C:\Windows\System\NOGokPk.exe
  C:\Windows\System\NOGokPk.exe
  2⤵
  PID:8240
- C:\Windows\System\aWpNEwK.exe
  C:\Windows\System\aWpNEwK.exe
  2⤵
  PID:8280
- C:\Windows\System\seMVzBB.exe
  C:\Windows\System\seMVzBB.exe
  2⤵
  PID:8300
- C:\Windows\System\QjEVvAk.exe
  C:\Windows\System\QjEVvAk.exe
  2⤵
  PID:8320
- C:\Windows\System\fuFIvXC.exe
  C:\Windows\System\fuFIvXC.exe
  2⤵
  PID:8344
- C:\Windows\System\YjNASqH.exe
  C:\Windows\System\YjNASqH.exe
  2⤵
  PID:8360
- C:\Windows\System\bBVeIsa.exe
  C:\Windows\System\bBVeIsa.exe
  2⤵
  PID:8396
- C:\Windows\System\tUuVgPL.exe
  C:\Windows\System\tUuVgPL.exe
  2⤵
  PID:8416
- C:\Windows\System\mvRKhYh.exe
  C:\Windows\System\mvRKhYh.exe
  2⤵
  PID:8436
- C:\Windows\System\tJKFbJk.exe
  C:\Windows\System\tJKFbJk.exe
  2⤵
  PID:8472
- C:\Windows\System\qQoucZM.exe
  C:\Windows\System\qQoucZM.exe
  2⤵
  PID:8492
- C:\Windows\System\qubWetk.exe
  C:\Windows\System\qubWetk.exe
  2⤵
  PID:8532
- C:\Windows\System\ifhEvaX.exe
  C:\Windows\System\ifhEvaX.exe
  2⤵
  PID:8552
- C:\Windows\System\aJGytXy.exe
  C:\Windows\System\aJGytXy.exe
  2⤵
  PID:8612
- C:\Windows\System\fDsIuYk.exe
  C:\Windows\System\fDsIuYk.exe
  2⤵
  PID:8628
- C:\Windows\System\AQiXFjm.exe
  C:\Windows\System\AQiXFjm.exe
  2⤵
  PID:8652
- C:\Windows\System\lLMdVjd.exe
  C:\Windows\System\lLMdVjd.exe
  2⤵
  PID:8668
- C:\Windows\System\hIXpomc.exe
  C:\Windows\System\hIXpomc.exe
  2⤵
  PID:8696
- C:\Windows\System\idOsySl.exe
  C:\Windows\System\idOsySl.exe
  2⤵
  PID:8724
- C:\Windows\System\ExKzYtK.exe
  C:\Windows\System\ExKzYtK.exe
  2⤵
  PID:8784
- C:\Windows\System\nQueBnn.exe
  C:\Windows\System\nQueBnn.exe
  2⤵
  PID:8800
- C:\Windows\System\WsdosAh.exe
  C:\Windows\System\WsdosAh.exe
  2⤵
  PID:8828
- C:\Windows\System\cjISwCQ.exe
  C:\Windows\System\cjISwCQ.exe
  2⤵
  PID:8848
- C:\Windows\System\TmkIBJo.exe
  C:\Windows\System\TmkIBJo.exe
  2⤵
  PID:8880
- C:\Windows\System\blaaheb.exe
  C:\Windows\System\blaaheb.exe
  2⤵
  PID:8916
- C:\Windows\System\RPJCHkf.exe
  C:\Windows\System\RPJCHkf.exe
  2⤵
  PID:8968
- C:\Windows\System\YdvLAxV.exe
  C:\Windows\System\YdvLAxV.exe
  2⤵
  PID:8988
- C:\Windows\System\cRZHlWF.exe
  C:\Windows\System\cRZHlWF.exe
  2⤵
  PID:9020
- C:\Windows\System\tzlfITQ.exe
  C:\Windows\System\tzlfITQ.exe
  2⤵
  PID:9040
- C:\Windows\System\ZNJqRrH.exe
  C:\Windows\System\ZNJqRrH.exe
  2⤵
  PID:9080
- C:\Windows\System\cVzzHQq.exe
  C:\Windows\System\cVzzHQq.exe
  2⤵
  PID:9100
- C:\Windows\System\IYDCGjd.exe
  C:\Windows\System\IYDCGjd.exe
  2⤵
  PID:9124
- C:\Windows\System\LUjvOQo.exe
  C:\Windows\System\LUjvOQo.exe
  2⤵
  PID:9144
- C:\Windows\System\UTEsOjH.exe
  C:\Windows\System\UTEsOjH.exe
  2⤵
  PID:9160
- C:\Windows\System\uNgCYXw.exe
  C:\Windows\System\uNgCYXw.exe
  2⤵
  PID:9180
- C:\Windows\System\ynNZafx.exe
  C:\Windows\System\ynNZafx.exe
  2⤵
  PID:9204
- C:\Windows\System\WYbFBwN.exe
  C:\Windows\System\WYbFBwN.exe
  2⤵
  PID:7216
- C:\Windows\System\AhKYQDo.exe
  C:\Windows\System\AhKYQDo.exe
  2⤵
  PID:8260
- C:\Windows\System\ZFFnozC.exe
  C:\Windows\System\ZFFnozC.exe
  2⤵
  PID:8328
- C:\Windows\System\RnGezcy.exe
  C:\Windows\System\RnGezcy.exe
  2⤵
  PID:8464
- C:\Windows\System\ZEzLlOA.exe
  C:\Windows\System\ZEzLlOA.exe
  2⤵
  PID:8512
- C:\Windows\System\ELCpxXu.exe
  C:\Windows\System\ELCpxXu.exe
  2⤵
  PID:8604
- C:\Windows\System\laRKpIV.exe
  C:\Windows\System\laRKpIV.exe
  2⤵
  PID:8640
- C:\Windows\System\FvrkmSW.exe
  C:\Windows\System\FvrkmSW.exe
  2⤵
  PID:8756
- C:\Windows\System\jUAWnjt.exe
  C:\Windows\System\jUAWnjt.exe
  2⤵
  PID:8792
- C:\Windows\System\zyHyuEV.exe
  C:\Windows\System\zyHyuEV.exe
  2⤵
  PID:8856
- C:\Windows\System\rmwvCXo.exe
  C:\Windows\System\rmwvCXo.exe
  2⤵
  PID:8912
- C:\Windows\System\CqwkBex.exe
  C:\Windows\System\CqwkBex.exe
  2⤵
  PID:8996
- C:\Windows\System\eCyqsFa.exe
  C:\Windows\System\eCyqsFa.exe
  2⤵
  PID:9032
- C:\Windows\System\ESsphjz.exe
  C:\Windows\System\ESsphjz.exe
  2⤵
  PID:9076
- C:\Windows\System\rWUNPGd.exe
  C:\Windows\System\rWUNPGd.exe
  2⤵
  PID:9108
- C:\Windows\System\XZgFITV.exe
  C:\Windows\System\XZgFITV.exe
  2⤵
  PID:9188
- C:\Windows\System\xwwiUGN.exe
  C:\Windows\System\xwwiUGN.exe
  2⤵
  PID:8212
- C:\Windows\System\ombpOBu.exe
  C:\Windows\System\ombpOBu.exe
  2⤵
  PID:8292
- C:\Windows\System\gsaUPge.exe
  C:\Windows\System\gsaUPge.exe
  2⤵
  PID:7368
- C:\Windows\System\ZKPBwLk.exe
  C:\Windows\System\ZKPBwLk.exe
  2⤵
  PID:8500
- C:\Windows\System\VRKoWnL.exe
  C:\Windows\System\VRKoWnL.exe
  2⤵
  PID:8636
- C:\Windows\System\pUZgzMp.exe
  C:\Windows\System\pUZgzMp.exe
  2⤵
  PID:8772
- C:\Windows\System\cFgHZWx.exe
  C:\Windows\System\cFgHZWx.exe
  2⤵
  PID:8952
- C:\Windows\System\VdxutGS.exe
  C:\Windows\System\VdxutGS.exe
  2⤵
  PID:8944
- C:\Windows\System\HgETVOz.exe
  C:\Windows\System\HgETVOz.exe
  2⤵
  PID:9176
- C:\Windows\System\KxUfXDu.exe
  C:\Windows\System\KxUfXDu.exe
  2⤵
  PID:9220
- C:\Windows\System\KFRSzoY.exe
  C:\Windows\System\KFRSzoY.exe
  2⤵
  PID:9260
- C:\Windows\System\IkGJlld.exe
  C:\Windows\System\IkGJlld.exe
  2⤵
  PID:9288
- C:\Windows\System\fTDhtmq.exe
  C:\Windows\System\fTDhtmq.exe
  2⤵
  PID:9332
- C:\Windows\System\TsMrTUk.exe
  C:\Windows\System\TsMrTUk.exe
  2⤵
  PID:9352
- C:\Windows\System\DRIjXDC.exe
  C:\Windows\System\DRIjXDC.exe
  2⤵
  PID:9384
- C:\Windows\System\QBtfzQh.exe
  C:\Windows\System\QBtfzQh.exe
  2⤵
  PID:9404
- C:\Windows\System\uXbqzJx.exe
  C:\Windows\System\uXbqzJx.exe
  2⤵
  PID:9428
- C:\Windows\System\CgOvMRm.exe
  C:\Windows\System\CgOvMRm.exe
  2⤵
  PID:9464
- C:\Windows\System\zRlJwIO.exe
  C:\Windows\System\zRlJwIO.exe
  2⤵
  PID:9488
- C:\Windows\System\hKXtVtj.exe
  C:\Windows\System\hKXtVtj.exe
  2⤵
  PID:9508
- C:\Windows\System\WWfUldU.exe
  C:\Windows\System\WWfUldU.exe
  2⤵
  PID:9524
- C:\Windows\System\GEkaQvd.exe
  C:\Windows\System\GEkaQvd.exe
  2⤵
  PID:9572
- C:\Windows\System\Yabauue.exe
  C:\Windows\System\Yabauue.exe
  2⤵
  PID:9592
- C:\Windows\System\jsRCAgu.exe
  C:\Windows\System\jsRCAgu.exe
  2⤵
  PID:9628
- C:\Windows\System\dySzxHH.exe
  C:\Windows\System\dySzxHH.exe
  2⤵
  PID:9648
- C:\Windows\System\QJPDpcy.exe
  C:\Windows\System\QJPDpcy.exe
  2⤵
  PID:9680
- C:\Windows\System\gXyUfZw.exe
  C:\Windows\System\gXyUfZw.exe
  2⤵
  PID:9700
- C:\Windows\System\LusQPhq.exe
  C:\Windows\System\LusQPhq.exe
  2⤵
  PID:9720
- C:\Windows\System\cvCguSr.exe
  C:\Windows\System\cvCguSr.exe
  2⤵
  PID:9744
- C:\Windows\System\nvEzAZP.exe
  C:\Windows\System\nvEzAZP.exe
  2⤵
  PID:9764
- C:\Windows\System\OPPgEjd.exe
  C:\Windows\System\OPPgEjd.exe
  2⤵
  PID:9868
- C:\Windows\System\jopBBmN.exe
  C:\Windows\System\jopBBmN.exe
  2⤵
  PID:9924
- C:\Windows\System\jARAEhE.exe
  C:\Windows\System\jARAEhE.exe
  2⤵
  PID:9996
- C:\Windows\System\fnVoANv.exe
  C:\Windows\System\fnVoANv.exe
  2⤵
  PID:10012
- C:\Windows\System\WRONphN.exe
  C:\Windows\System\WRONphN.exe
  2⤵
  PID:10028
- C:\Windows\System\eIYyLbm.exe
  C:\Windows\System\eIYyLbm.exe
  2⤵
  PID:10044
- C:\Windows\System\LWNTMqB.exe
  C:\Windows\System\LWNTMqB.exe
  2⤵
  PID:10060
- C:\Windows\System\xJaWGai.exe
  C:\Windows\System\xJaWGai.exe
  2⤵
  PID:10144
- C:\Windows\System\bWIafNL.exe
  C:\Windows\System\bWIafNL.exe
  2⤵
  PID:10172
- C:\Windows\System\nLdzctr.exe
  C:\Windows\System\nLdzctr.exe
  2⤵
  PID:10196
- C:\Windows\System\feRkDYW.exe
  C:\Windows\System\feRkDYW.exe
  2⤵
  PID:10220
- C:\Windows\System\czwdgQC.exe
  C:\Windows\System\czwdgQC.exe
  2⤵
  PID:9116
- C:\Windows\System\bNohOYc.exe
  C:\Windows\System\bNohOYc.exe
  2⤵
  PID:8644
- C:\Windows\System\ZVTMkoO.exe
  C:\Windows\System\ZVTMkoO.exe
  2⤵
  PID:9304
- C:\Windows\System\xChTlRZ.exe
  C:\Windows\System\xChTlRZ.exe
  2⤵
  PID:9316
- C:\Windows\System\KWtCwnZ.exe
  C:\Windows\System\KWtCwnZ.exe
  2⤵
  PID:9396
- C:\Windows\System\gLpWMVx.exe
  C:\Windows\System\gLpWMVx.exe
  2⤵
  PID:9456
- C:\Windows\System\dRssNHn.exe
  C:\Windows\System\dRssNHn.exe
  2⤵
  PID:9484
- C:\Windows\System\jmAcUgo.exe
  C:\Windows\System\jmAcUgo.exe
  2⤵
  PID:9580
- C:\Windows\System\TbIvpQu.exe
  C:\Windows\System\TbIvpQu.exe
  2⤵
  PID:9588
- C:\Windows\System\Pjrigyd.exe
  C:\Windows\System\Pjrigyd.exe
  2⤵
  PID:9740
- C:\Windows\System\ZOgQxTo.exe
  C:\Windows\System\ZOgQxTo.exe
  2⤵
  PID:9136
- C:\Windows\System\AStzpTg.exe
  C:\Windows\System\AStzpTg.exe
  2⤵
  PID:9932
- C:\Windows\System\RvctYCc.exe
  C:\Windows\System\RvctYCc.exe
  2⤵
  PID:10024
- C:\Windows\System\vISpvPB.exe
  C:\Windows\System\vISpvPB.exe
  2⤵
  PID:9880
- C:\Windows\System\UCOAHne.exe
  C:\Windows\System\UCOAHne.exe
  2⤵
  PID:9976
- C:\Windows\System\fEVESov.exe
  C:\Windows\System\fEVESov.exe
  2⤵
  PID:10092
- C:\Windows\System\EBslaCB.exe
  C:\Windows\System\EBslaCB.exe
  2⤵
  PID:10036
- C:\Windows\System\PqmKRFy.exe
  C:\Windows\System\PqmKRFy.exe
  2⤵
  PID:10072
- C:\Windows\System\HiUhiMh.exe
  C:\Windows\System\HiUhiMh.exe
  2⤵
  PID:10136
- C:\Windows\System\rPWhDqT.exe
  C:\Windows\System\rPWhDqT.exe
  2⤵
  PID:10216
- C:\Windows\System\hoQoMhe.exe
  C:\Windows\System\hoQoMhe.exe
  2⤵
  PID:9296
- C:\Windows\System\uTxWacx.exe
  C:\Windows\System\uTxWacx.exe
  2⤵
  PID:9344
- C:\Windows\System\sCDLFoA.exe
  C:\Windows\System\sCDLFoA.exe
  2⤵
  PID:9532
- C:\Windows\System\HaFURvi.exe
  C:\Windows\System\HaFURvi.exe
  2⤵
  PID:9604
- C:\Windows\System\fRxIloG.exe
  C:\Windows\System\fRxIloG.exe
  2⤵
  PID:9668
- C:\Windows\System\QwCYoFC.exe
  C:\Windows\System\QwCYoFC.exe
  2⤵
  PID:9712
- C:\Windows\System\kzPtEGo.exe
  C:\Windows\System\kzPtEGo.exe
  2⤵
  PID:9948
- C:\Windows\System\UJRSVHG.exe
  C:\Windows\System\UJRSVHG.exe
  2⤵
  PID:10192
- C:\Windows\System\lKfqvzN.exe
  C:\Windows\System\lKfqvzN.exe
  2⤵
  PID:9092
- C:\Windows\System\ATeZiFK.exe
  C:\Windows\System\ATeZiFK.exe
  2⤵
  PID:9252
- C:\Windows\System\ZvixRHn.exe
  C:\Windows\System\ZvixRHn.exe
  2⤵
  PID:10164
- C:\Windows\System\aWFLtLW.exe
  C:\Windows\System\aWFLtLW.exe
  2⤵
  PID:9544
- C:\Windows\System\YGWvOcJ.exe
  C:\Windows\System\YGWvOcJ.exe
  2⤵
  PID:10088
- C:\Windows\System\pdbkLBE.exe
  C:\Windows\System\pdbkLBE.exe
  2⤵
  PID:10248
- C:\Windows\System\OWRDyNq.exe
  C:\Windows\System\OWRDyNq.exe
  2⤵
  PID:10276
- C:\Windows\System\GaWtehJ.exe
  C:\Windows\System\GaWtehJ.exe
  2⤵
  PID:10304
- C:\Windows\System\TmoRBzS.exe
  C:\Windows\System\TmoRBzS.exe
  2⤵
  PID:10336
- C:\Windows\System\JGlNzNn.exe
  C:\Windows\System\JGlNzNn.exe
  2⤵
  PID:10352
- C:\Windows\System\GywnuzP.exe
  C:\Windows\System\GywnuzP.exe
  2⤵
  PID:10380
- C:\Windows\System\tfupRUy.exe
  C:\Windows\System\tfupRUy.exe
  2⤵
  PID:10400
- C:\Windows\System\OvKdvrH.exe
  C:\Windows\System\OvKdvrH.exe
  2⤵
  PID:10444
- C:\Windows\System\wpOMHWV.exe
  C:\Windows\System\wpOMHWV.exe
  2⤵
  PID:10460
- C:\Windows\System\ZhJFsSn.exe
  C:\Windows\System\ZhJFsSn.exe
  2⤵
  PID:10480
- C:\Windows\System\nudFlSd.exe
  C:\Windows\System\nudFlSd.exe
  2⤵
  PID:10512
- C:\Windows\System\vPzwQPp.exe
  C:\Windows\System\vPzwQPp.exe
  2⤵
  PID:10532
- C:\Windows\System\jxOtSWw.exe
  C:\Windows\System\jxOtSWw.exe
  2⤵
  PID:10580
- C:\Windows\System\rASCzLB.exe
  C:\Windows\System\rASCzLB.exe
  2⤵
  PID:10600
- C:\Windows\System\chsbViW.exe
  C:\Windows\System\chsbViW.exe
  2⤵
  PID:10624
- C:\Windows\System\guEwyaW.exe
  C:\Windows\System\guEwyaW.exe
  2⤵
  PID:10660
- C:\Windows\System\kkcmzbI.exe
  C:\Windows\System\kkcmzbI.exe
  2⤵
  PID:10684
- C:\Windows\System\qgvZyuG.exe
  C:\Windows\System\qgvZyuG.exe
  2⤵
  PID:10704
- C:\Windows\System\RJbzPpT.exe
  C:\Windows\System\RJbzPpT.exe
  2⤵
  PID:10764
- C:\Windows\System\NfXnSFW.exe
  C:\Windows\System\NfXnSFW.exe
  2⤵
  PID:10792
- C:\Windows\System\kLsLvEN.exe
  C:\Windows\System\kLsLvEN.exe
  2⤵
  PID:10824
- C:\Windows\System\fRrddyI.exe
  C:\Windows\System\fRrddyI.exe
  2⤵
  PID:10848
- C:\Windows\System\igMqcFJ.exe
  C:\Windows\System\igMqcFJ.exe
  2⤵
  PID:10868
- C:\Windows\System\XjxWZKt.exe
  C:\Windows\System\XjxWZKt.exe
  2⤵
  PID:10888
- C:\Windows\System\NWlhQlQ.exe
  C:\Windows\System\NWlhQlQ.exe
  2⤵
  PID:10912
- C:\Windows\System\xpRZMjr.exe
  C:\Windows\System\xpRZMjr.exe
  2⤵
  PID:10936
- C:\Windows\System\tdgVgGl.exe
  C:\Windows\System\tdgVgGl.exe
  2⤵
  PID:11000
- C:\Windows\System\OXgaDhz.exe
  C:\Windows\System\OXgaDhz.exe
  2⤵
  PID:11024
- C:\Windows\System\gUMweFu.exe
  C:\Windows\System\gUMweFu.exe
  2⤵
  PID:11044
- C:\Windows\System\ECExCYK.exe
  C:\Windows\System\ECExCYK.exe
  2⤵
  PID:11064
- C:\Windows\System\KQqTEGb.exe
  C:\Windows\System\KQqTEGb.exe
  2⤵
  PID:11088
- C:\Windows\System\pLpLUgN.exe
  C:\Windows\System\pLpLUgN.exe
  2⤵
  PID:11120
- C:\Windows\System\HcWFXmq.exe
  C:\Windows\System\HcWFXmq.exe
  2⤵
  PID:11172
- C:\Windows\System\BkQvILW.exe
  C:\Windows\System\BkQvILW.exe
  2⤵
  PID:11192
- C:\Windows\System\OiuuUZG.exe
  C:\Windows\System\OiuuUZG.exe
  2⤵
  PID:11216
- C:\Windows\System\JaAIpkG.exe
  C:\Windows\System\JaAIpkG.exe
  2⤵
  PID:11240
- C:\Windows\System\RjAcMjH.exe
  C:\Windows\System\RjAcMjH.exe
  2⤵
  PID:11256
- C:\Windows\System\zwnqNqu.exe
  C:\Windows\System\zwnqNqu.exe
  2⤵
  PID:10300
- C:\Windows\System\YMSbaCt.exe
  C:\Windows\System\YMSbaCt.exe
  2⤵
  PID:10372
- C:\Windows\System\UzeoSYp.exe
  C:\Windows\System\UzeoSYp.exe
  2⤵
  PID:10392
- C:\Windows\System\mYqxROc.exe
  C:\Windows\System\mYqxROc.exe
  2⤵
  PID:10524
- C:\Windows\System\JQGeKhp.exe
  C:\Windows\System\JQGeKhp.exe
  2⤵
  PID:10588
- C:\Windows\System\YKKWdgF.exe
  C:\Windows\System\YKKWdgF.exe
  2⤵
  PID:10656
- C:\Windows\System\aaYZEvW.exe
  C:\Windows\System\aaYZEvW.exe
  2⤵
  PID:10724
- C:\Windows\System\EUCXgFb.exe
  C:\Windows\System\EUCXgFb.exe
  2⤵
  PID:10776
- C:\Windows\System\oSRfDsE.exe
  C:\Windows\System\oSRfDsE.exe
  2⤵
  PID:10860
- C:\Windows\System\WvPKmMw.exe
  C:\Windows\System\WvPKmMw.exe
  2⤵
  PID:10896
- C:\Windows\System\IBkXXjG.exe
  C:\Windows\System\IBkXXjG.exe
  2⤵
  PID:10988
- C:\Windows\System\bjFWeoD.exe
  C:\Windows\System\bjFWeoD.exe
  2⤵
  PID:11084
- C:\Windows\System\YuSogXE.exe
  C:\Windows\System\YuSogXE.exe
  2⤵
  PID:11184
- C:\Windows\System\lmcGGux.exe
  C:\Windows\System\lmcGGux.exe
  2⤵
  PID:11252
- C:\Windows\System\dFpABBk.exe
  C:\Windows\System\dFpABBk.exe
  2⤵
  PID:10312
- C:\Windows\System\nZVSRYm.exe
  C:\Windows\System\nZVSRYm.exe
  2⤵
  PID:7464
- C:\Windows\System\IipVSEI.exe
  C:\Windows\System\IipVSEI.exe
  2⤵
  PID:10720
- C:\Windows\System\MEnCFyG.exe
  C:\Windows\System\MEnCFyG.exe
  2⤵
  PID:10272
- C:\Windows\System\bmbuIjY.exe
  C:\Windows\System\bmbuIjY.exe
  2⤵
  PID:10972
- C:\Windows\System\hLkRewR.exe
  C:\Windows\System\hLkRewR.exe
  2⤵
  PID:11104
- C:\Windows\System\gglCqyO.exe
  C:\Windows\System\gglCqyO.exe
  2⤵
  PID:11228
- C:\Windows\System\mnKyMzb.exe
  C:\Windows\System\mnKyMzb.exe
  2⤵
  PID:10412
- C:\Windows\System\iwGMdsg.exe
  C:\Windows\System\iwGMdsg.exe
  2⤵
  PID:10632
- C:\Windows\System\KKcKvXz.exe
  C:\Windows\System\KKcKvXz.exe
  2⤵
  PID:11204
- C:\Windows\System\bviqKoZ.exe
  C:\Windows\System\bviqKoZ.exe
  2⤵
  PID:10596
- C:\Windows\System\osqfbaJ.exe
  C:\Windows\System\osqfbaJ.exe
  2⤵
  PID:10692
- C:\Windows\System\oMjKyoh.exe
  C:\Windows\System\oMjKyoh.exe
  2⤵
  PID:11292
- C:\Windows\System\hbpBVXr.exe
  C:\Windows\System\hbpBVXr.exe
  2⤵
  PID:11308
- C:\Windows\System\BgVHtuq.exe
  C:\Windows\System\BgVHtuq.exe
  2⤵
  PID:11336
- C:\Windows\System\MmkjjPh.exe
  C:\Windows\System\MmkjjPh.exe
  2⤵
  PID:11356
- C:\Windows\System\bLlYkPr.exe
  C:\Windows\System\bLlYkPr.exe
  2⤵
  PID:11380
- C:\Windows\System\INUMXrG.exe
  C:\Windows\System\INUMXrG.exe
  2⤵
  PID:11416
- C:\Windows\System\KoKiGiC.exe
  C:\Windows\System\KoKiGiC.exe
  2⤵
  PID:11432
- C:\Windows\System\kyTBdhD.exe
  C:\Windows\System\kyTBdhD.exe
  2⤵
  PID:11460
- C:\Windows\System\wLtKNyg.exe
  C:\Windows\System\wLtKNyg.exe
  2⤵
  PID:11488
- C:\Windows\System\BcEHgpe.exe
  C:\Windows\System\BcEHgpe.exe
  2⤵
  PID:11508
- C:\Windows\System\NKguacd.exe
  C:\Windows\System\NKguacd.exe
  2⤵
  PID:11528
- C:\Windows\System\nVFhObG.exe
  C:\Windows\System\nVFhObG.exe
  2⤵
  PID:11580
- C:\Windows\System\kGjqdlQ.exe
  C:\Windows\System\kGjqdlQ.exe
  2⤵
  PID:11624
- C:\Windows\System\tuPnFCg.exe
  C:\Windows\System\tuPnFCg.exe
  2⤵
  PID:11664
- C:\Windows\System\JljYNOl.exe
  C:\Windows\System\JljYNOl.exe
  2⤵
  PID:11692
- C:\Windows\System\oAPkaiN.exe
  C:\Windows\System\oAPkaiN.exe
  2⤵
  PID:11712
- C:\Windows\System\HVAKazv.exe
  C:\Windows\System\HVAKazv.exe
  2⤵
  PID:11756
- C:\Windows\System\VjUsBYT.exe
  C:\Windows\System\VjUsBYT.exe
  2⤵
  PID:11776
- C:\Windows\System\xazAcgQ.exe
  C:\Windows\System\xazAcgQ.exe
  2⤵
  PID:11796
- C:\Windows\System\JFLPcvf.exe
  C:\Windows\System\JFLPcvf.exe
  2⤵
  PID:11824
- C:\Windows\System\cqKjukb.exe
  C:\Windows\System\cqKjukb.exe
  2⤵
  PID:11848
- C:\Windows\System\sMcpupz.exe
  C:\Windows\System\sMcpupz.exe
  2⤵
  PID:11884
- C:\Windows\System\CzsHaOs.exe
  C:\Windows\System\CzsHaOs.exe
  2⤵
  PID:11904
- C:\Windows\System\ZXdtrCF.exe
  C:\Windows\System\ZXdtrCF.exe
  2⤵
  PID:11932
- C:\Windows\System\IZgwtOd.exe
  C:\Windows\System\IZgwtOd.exe
  2⤵
  PID:11964
- C:\Windows\System\cHGCtOD.exe
  C:\Windows\System\cHGCtOD.exe
  2⤵
  PID:11992
- C:\Windows\System\MicErMj.exe
  C:\Windows\System\MicErMj.exe
  2⤵
  PID:12020
- C:\Windows\System\uSRnnmS.exe
  C:\Windows\System\uSRnnmS.exe
  2⤵
  PID:12040
- C:\Windows\System\yBwaiuA.exe
  C:\Windows\System\yBwaiuA.exe
  2⤵
  PID:12064
- C:\Windows\System\bRXAVlq.exe
  C:\Windows\System\bRXAVlq.exe
  2⤵
  PID:12096
- C:\Windows\System\zTyVhzb.exe
  C:\Windows\System\zTyVhzb.exe
  2⤵
  PID:12136
- C:\Windows\System\BCVhvhI.exe
  C:\Windows\System\BCVhvhI.exe
  2⤵
  PID:12164
- C:\Windows\System\gkaTHAG.exe
  C:\Windows\System\gkaTHAG.exe
  2⤵
  PID:12188
- C:\Windows\System\SPpRSBv.exe
  C:\Windows\System\SPpRSBv.exe
  2⤵
  PID:12216
- C:\Windows\System\ikbqiDJ.exe
  C:\Windows\System\ikbqiDJ.exe
  2⤵
  PID:12240
- C:\Windows\System\VnGbLKJ.exe
  C:\Windows\System\VnGbLKJ.exe
  2⤵
  PID:12280
- C:\Windows\System\ntggDHb.exe
  C:\Windows\System\ntggDHb.exe
  2⤵
  PID:11332
- C:\Windows\System\zALJkwS.exe
  C:\Windows\System\zALJkwS.exe
  2⤵
  PID:11412
- C:\Windows\System\OFtuBtJ.exe
  C:\Windows\System\OFtuBtJ.exe
  2⤵
  PID:11396
- C:\Windows\System\uJJXhed.exe
  C:\Windows\System\uJJXhed.exe
  2⤵
  PID:11500
- C:\Windows\System\jcPASUd.exe
  C:\Windows\System\jcPASUd.exe
  2⤵
  PID:11556
- C:\Windows\System\pJbNhkl.exe
  C:\Windows\System\pJbNhkl.exe
  2⤵
  PID:11616
- C:\Windows\System\ORmikHJ.exe
  C:\Windows\System\ORmikHJ.exe
  2⤵
  PID:11680
- C:\Windows\System\bnqXyVr.exe
  C:\Windows\System\bnqXyVr.exe
  2⤵
  PID:11704
- C:\Windows\System\gQQBLmW.exe
  C:\Windows\System\gQQBLmW.exe
  2⤵
  PID:11788
- C:\Windows\System\GKJohal.exe
  C:\Windows\System\GKJohal.exe
  2⤵
  PID:11860
- C:\Windows\System\PdjcIpL.exe
  C:\Windows\System\PdjcIpL.exe
  2⤵
  PID:11944
- C:\Windows\System\WqntpFI.exe
  C:\Windows\System\WqntpFI.exe
  2⤵
  PID:11960
- C:\Windows\System\xrQerkI.exe
  C:\Windows\System\xrQerkI.exe
  2⤵
  PID:12000
- C:\Windows\System\MeCGURU.exe
  C:\Windows\System\MeCGURU.exe
  2⤵
  PID:12052
- C:\Windows\System\xxwWVkS.exe
  C:\Windows\System\xxwWVkS.exe
  2⤵
  PID:12236
- C:\Windows\System\BPGqliY.exe
  C:\Windows\System\BPGqliY.exe
  2⤵
  PID:10884
- C:\Windows\System\KKrsYel.exe
  C:\Windows\System\KKrsYel.exe
  2⤵
  PID:10948
- C:\Windows\System\ChxhQhk.exe
  C:\Windows\System\ChxhQhk.exe
  2⤵
  PID:11452
- C:\Windows\System\aTKEjot.exe
  C:\Windows\System\aTKEjot.exe
  2⤵
  PID:11672
- C:\Windows\System\pejKzuR.exe
  C:\Windows\System\pejKzuR.exe
  2⤵
  PID:11804
- C:\Windows\System\yNvziNq.exe
  C:\Windows\System\yNvziNq.exe
  2⤵
  PID:11980
- C:\Windows\System\OuTKiAv.exe
  C:\Windows\System\OuTKiAv.exe
  2⤵
  PID:11924
- C:\Windows\System\ThcbqdA.exe
  C:\Windows\System\ThcbqdA.exe
  2⤵
  PID:12032
- C:\Windows\System\JTTYErs.exe
  C:\Windows\System\JTTYErs.exe
  2⤵
  PID:12112
- C:\Windows\System\yCaLxaP.exe
  C:\Windows\System\yCaLxaP.exe
  2⤵
  PID:11620
- C:\Windows\System\jnNZkcW.exe
  C:\Windows\System\jnNZkcW.exe
  2⤵
  PID:11876
- C:\Windows\System\wdKCbJU.exe
  C:\Windows\System\wdKCbJU.exe
  2⤵
  PID:3576
- C:\Windows\System\fNxkITn.exe
  C:\Windows\System\fNxkITn.exe
  2⤵
  PID:3464
- C:\Windows\System\uYnsBYr.exe
  C:\Windows\System\uYnsBYr.exe
  2⤵
  PID:12296
- C:\Windows\System\UGFAmMZ.exe
  C:\Windows\System\UGFAmMZ.exe
  2⤵
  PID:12324
- C:\Windows\System\lBGCWxh.exe
  C:\Windows\System\lBGCWxh.exe
  2⤵
  PID:12348
- C:\Windows\System\YwqsQly.exe
  C:\Windows\System\YwqsQly.exe
  2⤵
  PID:12380
- C:\Windows\System\wTMECYb.exe
  C:\Windows\System\wTMECYb.exe
  2⤵
  PID:12432
- C:\Windows\System\SpyTfUJ.exe
  C:\Windows\System\SpyTfUJ.exe
  2⤵
  PID:12460
- C:\Windows\System\hjYXOZT.exe
  C:\Windows\System\hjYXOZT.exe
  2⤵
  PID:12484
- C:\Windows\System\wVFtUAj.exe
  C:\Windows\System\wVFtUAj.exe
  2⤵
  PID:12516
- C:\Windows\System\wpsNYQv.exe
  C:\Windows\System\wpsNYQv.exe
  2⤵
  PID:12544
- C:\Windows\System\mHvDuGr.exe
  C:\Windows\System\mHvDuGr.exe
  2⤵
  PID:12568
- C:\Windows\System\qAwMxff.exe
  C:\Windows\System\qAwMxff.exe
  2⤵
  PID:12620
- C:\Windows\System\hJdzWvF.exe
  C:\Windows\System\hJdzWvF.exe
  2⤵
  PID:12644
- C:\Windows\System\BdEpxZm.exe
  C:\Windows\System\BdEpxZm.exe
  2⤵
  PID:12664
- C:\Windows\System\IQPnIRR.exe
  C:\Windows\System\IQPnIRR.exe
  2⤵
  PID:12696
- C:\Windows\System\EkOEgsG.exe
  C:\Windows\System\EkOEgsG.exe
  2⤵
  PID:12720
- C:\Windows\System\IzLNWUr.exe
  C:\Windows\System\IzLNWUr.exe
  2⤵
  PID:12740
- C:\Windows\System\LRPXXHO.exe
  C:\Windows\System\LRPXXHO.exe
  2⤵
  PID:12760
- C:\Windows\System\pLtmxFC.exe
  C:\Windows\System\pLtmxFC.exe
  2⤵
  PID:12780
- C:\Windows\System\ALMTrDu.exe
  C:\Windows\System\ALMTrDu.exe
  2⤵
  PID:12832
- C:\Windows\System\yvOjdVN.exe
  C:\Windows\System\yvOjdVN.exe
  2⤵
  PID:12852
- C:\Windows\System\aAnQYcE.exe
  C:\Windows\System\aAnQYcE.exe
  2⤵
  PID:12892
- C:\Windows\System\SHTtRxO.exe
  C:\Windows\System\SHTtRxO.exe
  2⤵
  PID:12916
- C:\Windows\System\PLpQjGy.exe
  C:\Windows\System\PLpQjGy.exe
  2⤵
  PID:12936
- C:\Windows\System\gbvAYNP.exe
  C:\Windows\System\gbvAYNP.exe
  2⤵
  PID:12960
- C:\Windows\System\AYrTSOi.exe
  C:\Windows\System\AYrTSOi.exe
  2⤵
  PID:13008
- C:\Windows\System\fwrDFZp.exe
  C:\Windows\System\fwrDFZp.exe
  2⤵
  PID:13028
- C:\Windows\System\Iarcxba.exe
  C:\Windows\System\Iarcxba.exe
  2⤵
  PID:13052
- C:\Windows\System\wINHytY.exe
  C:\Windows\System\wINHytY.exe
  2⤵
  PID:13076
- C:\Windows\System\ivEXTlo.exe
  C:\Windows\System\ivEXTlo.exe
  2⤵
  PID:13104
- C:\Windows\System\AOZjdUv.exe
  C:\Windows\System\AOZjdUv.exe
  2⤵
  PID:13124
- C:\Windows\System\hxLFbpA.exe
  C:\Windows\System\hxLFbpA.exe
  2⤵
  PID:13152
- C:\Windows\System\bbcdgXr.exe
  C:\Windows\System\bbcdgXr.exe
  2⤵
  PID:13184
- C:\Windows\System\FmCRkdj.exe
  C:\Windows\System\FmCRkdj.exe
  2⤵
  PID:11376
- C:\Windows\System\tWHDpYU.exe
  C:\Windows\System\tWHDpYU.exe
  2⤵
  PID:12320
- C:\Windows\System\WMQlzyI.exe
  C:\Windows\System\WMQlzyI.exe
  2⤵
  PID:12376
- C:\Windows\System\jRrJlCo.exe
  C:\Windows\System\jRrJlCo.exe
  2⤵
  PID:12468
- C:\Windows\System\eaydGZJ.exe
  C:\Windows\System\eaydGZJ.exe
  2⤵
  PID:12532
- C:\Windows\System\ybZwusg.exe
  C:\Windows\System\ybZwusg.exe
  2⤵
  PID:13244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_p0dkbiel.tcb.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AeyMDeq.exe

Filesize
2.0MB

MD5
7c6688f3bd43c456be849d1ef4f004f7

SHA1
54a1d5ed38fcbcd4d0eabb6457159f6512c47290

SHA256
a4097bebf036be016f50a0a48f3a6f572b4075bead37bcea70f915586f486430

SHA512
b3fa29210d795fb691f0a2ee422d551f4fe6b0afd57c26200fab00b921938f80ddcf9494fe5b59dcb08d552159666b21418b5d2025776391da52f686de833c4e

Download Submit
C:\Windows\System\CsXXAjT.exe

Filesize
2.0MB

MD5
b921070c7069d7ebc02f3f07d3329884

SHA1
8e0a5353b000b8752d2e760bf09e032f29ba16f0

SHA256
97107a3ad7381c8732f200b5e9f7f3b07088adc2f597353deddd208a88a772d7

SHA512
dd74f727fcac43c973962b962da1e52fcddb1fb4bdec5392f31315ba854f35814d6bbfcec0566a8ec5169710de469cdb6acdd89e7129769138c2b9636e9e3fd2

Download Submit
C:\Windows\System\DCcVPKQ.exe

Filesize
2.0MB

MD5
81bf67cde56bca48b19ce21b8d66e3df

SHA1
f003891363f8bb836e35e231cb8502cdfd85419a

SHA256
a0afd43b0b44b8b93242f6228c21ba7f4806cf3a67deb5d6422374b1977e0f4b

SHA512
86d702937c9ad0241e0ef6419a1749a6dcae55b29857c8691c33b099ded12514ab6a60c0286f63840162d043078d8a625c689b135bb0c239dd013ff8506bd67b

Download Submit
C:\Windows\System\EEnDwHU.exe

Filesize
2.0MB

MD5
770a8032057a98d56d20350199273abd

SHA1
670d3129bdf65227f0c312dde01fc6844010edfd

SHA256
18a0029137f86997dce6698fc99504d1053a70c90e22626b1068af39331228f8

SHA512
ca8ed10672d9656500217589c3a6a1aaa7ff78a6a10c737554769c325bd34b282f5d6450a211f9fce6a1c6eb3ef5dc8fac0e0c2b06c9630e0ac6bdc001b2d85a

Download Submit
C:\Windows\System\GYnQcRE.exe

Filesize
2.0MB

MD5
f29ff6da7cd1e5e4e26cad7fc7390cee

SHA1
2a9d9ee0d2a20e0d97ea99ccb0268ee0396ba344

SHA256
5ef5bc875d088fefa95e0a683424ac6ba06a957e14b43acbf01a6e04adfe1481

SHA512
0396bdec3fb2cad031ebd3200bed8d7ad2e7bba4bc5ae8b4a5a8785160ea9fc5e061e60d3e44fe8152ad8b5b09e82bf624a23f23579c43039f4f64e23fc299e8

Download Submit
C:\Windows\System\HPyfPDE.exe

Filesize
2.0MB

MD5
58a32d810213cbb24f158eb647f999eb

SHA1
dd3e4e10ed4f294e5430786ed3f2e8c8ca3d0507

SHA256
ea6af395b32b1fff5c8cd6e35a55782d30d8b7ca6d0b16f430621b3764dfa82f

SHA512
eb1c2e7d93e17dc5074865bfa913b6d1eaa8d34ad961f11691fdc1876368b68a1ad9ce33275f4c574aa56d0104e0578987962fa93858d16892c393e2c5cca2b4

Download Submit
C:\Windows\System\HzNMwZL.exe

Filesize
2.0MB

MD5
bfd75b47f7f0e8dfd34d2b1ecaea4db6

SHA1
53312439b2604af211ff4fd53d9b2a1a0a25181d

SHA256
00d1cd1315695ef94f05bb148c19db60b67300f9f518b2f86c41b7b81ce234de

SHA512
cbd55cb166811d28a28be37c27ec602f8cbf89edb7cbbf3ad2dbba65db7d7439b98dc40cdc95c27a59c29ea6e895047a27bed072e76f3fb94f7d3677293010ac

Download Submit
C:\Windows\System\ImijeqT.exe

Filesize
2.0MB

MD5
bd7df5471a2d36ff97017d66a85ef97c

SHA1
776aedf1c483987b72da82704c54569d5eae7307

SHA256
11aa2cef2b6653aca9b40f9a8a3d3bb013902c989e4049c8868ae7c099b62701

SHA512
6faf33cd39468a7b865c832372a6f24ff0db5c8e7d464fc7fcb7db77b6c2fa1ef664d7e8c718f0ece88e2c4a7fd57918a7173c54c3b626d69bd56985a7e33705

Download Submit
C:\Windows\System\SsXxovW.exe

Filesize
2.0MB

MD5
b1a4bbe764450c175d4fe72566de2c74

SHA1
1b45c44d591b0bbbbace99948575a734d9f59168

SHA256
c0bfe6cfcdd4f2ff11349d5107e91b4997d95bf07a9104d01b8d0b25b7478411

SHA512
ba7f77badaa0d1b7cc2f5815da43ca95ff3db3cd30ebf7c11ddbb46958995176498a451e629f7eab81ab435491f91691b5fffc4472ac4ca29bb573e50413236e

Download Submit
C:\Windows\System\VRpcteU.exe

Filesize
2.0MB

MD5
c911cbe5ca011dd82d78563840002332

SHA1
69a6fc0857d5f77acec1a77c008cf55da6b927ab

SHA256
c5bf62dbebf6f03938ec33a4ebdaa7ad907f8e0a7fc1b7bf81b3bec405d47912

SHA512
9d0ec594b1bf4b11fbaf82ee92b35387501913f9d7fda6f4d8441d12eb5698ddda7695268ea6b0d202d47b5234352a52d62a798c6306ae3501c27b87c114aef5

Download Submit
C:\Windows\System\VkyGLyf.exe

Filesize
2.0MB

MD5
89cc9674cc75f198e51269ea2762ec15

SHA1
2589410223a5fdca7e15ee515f1bd234f347f3ee

SHA256
5fe77edb8951f37db2fd3b88c67d0ac1a1523fdacc1de09687ae2590289c39b8

SHA512
d91e8600d2847ae4062c1de6d5d3e081a71138816a92f8d6713f1d80fc5e38f08af7ff0ae992ada4092601c674b941b880580e84098dd2db343d7e21c465b332

Download Submit
C:\Windows\System\WLksKeJ.exe

Filesize
2.0MB

MD5
2819eac416905437bbf70d2337c4b0a9

SHA1
9d73bb758a5f218b0c7dda58fec353c9f1b0f958

SHA256
e5f5bf31c46ba516f699c118cb3790d82db158191de6cd5fc90b85a4c6520be6

SHA512
411d0b6dd8c7a6dcc4f16e0ab8b53e22ec5ee72dff3f429cc2c03002bec1f5689939c3797a9a9a3d42d61d1546493f55d91b321a5cf69156cd020857d9936d25

Download Submit
C:\Windows\System\XDOukzU.exe

Filesize
2.0MB

MD5
f1a7653538d0db4a9e1729368d62ac7e

SHA1
69fe50ad31c127cd7b6b4ed0060883b7de7aba5a

SHA256
0b039e414796a2da1b8f7ced7f3f12e87a30cf35cd88e4967010241c74f7a265

SHA512
a7d33afb0e8897afe0eedec017ed661970ac4a15c9dadb247fa1ffbab6d6c03d543705ad79810458318789dd9349c5d138bc4ea8bbdfb0db624506c28989423c

Download Submit
C:\Windows\System\YiEpccp.exe

Filesize
2.0MB

MD5
2a9f1476052551bff2fbc875e0655a7c

SHA1
9c17273a1bc90f0f1d1b07f5fd17dee6b519ad71

SHA256
55fab11d3d1e9a129068daeb92c457a5360990ecc1603fd08132314bc769f65e

SHA512
4edf36cb36b719bc63edac662f287b09db12200414a416289ea391b93c28da0bd395d158d308d5c4d1631e884075c8ce0946af184f8e9ccd3641c0bf0b3d3616

Download Submit
C:\Windows\System\cXzQnDz.exe

Filesize
2.0MB

MD5
e879b5060c2bef8cbb69c8f2d2f1ae35

SHA1
2f224a1e4c0fe338fc67b832454bff29307ef8a6

SHA256
d85beda26f950775436ab8adbec4a0fef15d1668b3a60897cddc63872a74f8cb

SHA512
bf536b7ec5c8f05e1d7804a8ac89f327aa34f5e3d9b8b176713f199dd935041d16c3f1a2ac6008d463143e3c2ab5feb1b2b45476cd5574dfadaffe281e330e56

Download Submit
C:\Windows\System\cdskIDg.exe

Filesize
2.0MB

MD5
b3fae1f32c780dcfe83a0867462d1d3c

SHA1
c5d942339d5f587a500608be0263119158166788

SHA256
6379d8a64a279b68740abeb381119fae560192229d80b57105e3d96dd462e43f

SHA512
156cd66bb69e23b3d7c5f8e8fa10b8995d019699fd43296386e8d0675fd52afdcb8bc3ba8708652ddcc37e4eee79acc7723ba4541ed8670f8225cdb1c60ae520

Download Submit
C:\Windows\System\fJySBZl.exe

Filesize
2.0MB

MD5
ce77a9e5ec7f3769a268e2f2e01afab1

SHA1
3a65b5b81dad0d30bd7a5506971140c95b73a0b4

SHA256
d035e04278909c5debb9fcfcc1f7892a5835bb2cc82b8f36f15c3feef342f9ec

SHA512
72fa5e0a6b72db01fedcf97b55c17804313fc8fc2929515ce7f3cb5622c14d62af42ea3b35b093041108666fef9cdad5ef4d30bcfd7f9217b2307b51a5c43334

Download Submit
C:\Windows\System\fnPGaSG.exe

Filesize
2.0MB

MD5
7badc2c4bfe7a797f77d907917a5ee31

SHA1
4c4c29cc1005bf6935178855501abdaada23c2b2

SHA256
3197dbdb13a4b1aaaa1e7ed4a7b10ebb4799d97418cb76dfa394b11986d9f2d9

SHA512
d2f73d14ddb79e2743e8c8fff77a5e2e5bb3c5a2bdb829fe853ce8cf9f19e630dea03c2ab39adee1f7a5979376674ad2ae5cf15fd463d759fe1f88fed8b9d97d

Download Submit
C:\Windows\System\gDhtqNu.exe

Filesize
8B

MD5
3989110bf28e1752d8354fc44aee0a5a

SHA1
2d341ede84fcdf1393cbc1c69b98173c16076de5

SHA256
ebec1be56406b8ccda98c6ae40713b17ab0e77787c03fa110b421dcd4ed20236

SHA512
05d90fae41717bc7686b0f44550f09d1b8636af054b5f3ca56692a92791caee36e681dc16ad6673b593b02851b240971a152f999e8c1a1c5d0d92fad9fcf82a2

Download Submit
C:\Windows\System\irhPiKL.exe

Filesize
2.0MB

MD5
5191cbd7a9566597c97f71d29bcd92ec

SHA1
8beef480cf3d7fce20e263529aed47e391b2cd66

SHA256
540e3163e1ed492d20d67ec636d8bd737fb52654d7dc5c3e5161c0274fde67dd

SHA512
eb935cd70686537077e80eda686b9ad71b22389ca6d0e3f213739ecaf742fb73f8b6673d20058bbaf6b82325825aad9054e76d1c8260ef38b2becc98c44a9399

Download Submit
C:\Windows\System\jYcCqzf.exe

Filesize
2.0MB

MD5
8f2960fbddb1d3d7356f1cbf977f259c

SHA1
7d9372ab6cfaa360243f0aabc3a8c995b3d9fa62

SHA256
3d0bdb053c16223c1711c8f2241b8ec3d517e541d752f7638c1ef27eede4eff3

SHA512
e72a16d51c7ec71ee93177a732b0cd33eacc3e4c74e89e625e4fd5bf8494e70495ba3209d27830958599116fb12238833338f21bd1fc96fd614bd8510e7ddc58

Download Submit
C:\Windows\System\jmyKhrj.exe

Filesize
2.0MB

MD5
8b4b9e19fc5d7aed3e012cf23a4f0c38

SHA1
76379f9f29336972be1a3088e5c18067f377a701

SHA256
5ffdcc8b7f3d4f9347131f421c6853da0ca51488139a62e2b1f68546cdb5a71e

SHA512
44db688ca92e8b78985ddddbc37777b7e787adf103b04c8a227d73c1fec0d99528210d20282c188adb3b99a0be2c970e43619dfe8bb4ff79418bcf228bd8b7de

Download Submit
C:\Windows\System\pBXIdVM.exe

Filesize
2.0MB

MD5
1e643697fa20832777d5af981b3a1e41

SHA1
ed2fcec654c0d93d51042bad3abfed67bb8976e0

SHA256
fed041eebff9ff200fd49f64787ec0d4a088b0b3ca7b8aa20e685ae6e2dc3a92

SHA512
febecf5d13b168bf95f87f4e241c1e237507c1032545b1f0c7f2624170892f679d3b13695b7c42f6649d35363682c9ba64b8f145a38bb70ccb67a50ffd0d4bd9

Download Submit
C:\Windows\System\pJnuWOe.exe

Filesize
2.0MB

MD5
d01c5d03d02114ce0589157d4b522c85

SHA1
9d7ab06fc5909511373c44e69571dbdbf32e85a5

SHA256
bd9a6c4809c943fde3b12eb204eb9c710b286905074073b72567fe0a6dcbcefb

SHA512
fcd2023a44648a67ef77259ee4bef241c8e67e2c5a67f05173167bc0379fd6bb42c41e42426d8a81aca6c6ca0489ba23dfa20d35e55dd8768cb1264b03d1a92d

Download Submit
C:\Windows\System\pmmVoof.exe

Filesize
2.0MB

MD5
7875de2a7cb6c7f2ac1f1939943d7f8e

SHA1
701098868ed4d83e19722eab194adca4e0a6f9a2

SHA256
8fa3ad72d2306c04728aa704848b5b99e7c48a57d4c456cefe73e03bbbe08f2d

SHA512
9fc9a15db19251219fdecefeaed831a9b6a464a57e41e26b747c0154f70169357523ba7c015022fa2fccceaebe956835433b9c625458d3167b0bf350feaa4fa6

Download Submit
C:\Windows\System\pnVfuax.exe

Filesize
2.0MB

MD5
5cc4ef6efa1f50a58a6932a01107240e

SHA1
c34a4b1b4aa43f9458b14691a0acdd30c34e674b

SHA256
84a002967a507774ff03206e8ecd4a440f3db275ea0ab3fe5b734cc99bc18f99

SHA512
f6949eb5f59e9d4c053c3e671d72fdeccfca05b596f94be0d74c0f3adfae01c44ba76623e336d0d4410b9d061ef856781c9ead8d756a2adedd422db59bdbd044

Download Submit
C:\Windows\System\svBgyjO.exe

Filesize
2.0MB

MD5
94781dab608d93a62bb20f185f724b70

SHA1
812f9b2c535dc7ace499f9cdaa205e3deb7cf0a4

SHA256
bc918de0ec495f03c6267181847ee97356b0ad63cd06c689cb98219192ee0397

SHA512
6ac11b794fb38552a9fa993ff134a834cb5b649c72e022ade8dcf6ec18832a3c3e6a416c8a22ad0daf676540f5b965fb7d04595329843198914e0c7bbc61d62d

Download Submit
C:\Windows\System\tkMPydN.exe

Filesize
2.0MB

MD5
449121c3212456294fe43ac3c9aeac29

SHA1
1e3737d91b9403bae8b037b22ee8ce8495a6bfd1

SHA256
c6327f5a39e9b660b357a49a2a4fc7d9d51892375146776584af876ecb76dbe1

SHA512
05b98bb38a13c39753a6a15da37595de6319a723d1bdf9e0e77fa8aaae0a6de37f89dd189528011bca2adea096a09a48e76f5008b85cbef1fc5d1a4b168d9445

Download Submit
C:\Windows\System\tvkQLnZ.exe

Filesize
2.0MB

MD5
364c00f5687d295d4cc5fd1723eb4bbd

SHA1
4261376a66854f1228e28eb9bca1af47b7b3836d

SHA256
bf7dbea3869ad21f898262b547b5488e82a843f66b245fa10845e4e077cb55ce

SHA512
74e3055567a657814092c910d328e3daf63d168a734d82e6ea4547704e1b4afee010c1d58316e9f56189f4d4387c5896580656aa455bbe1d37b9af2b1bee442b

Download Submit
C:\Windows\System\uHiQyWd.exe

Filesize
2.0MB

MD5
d60f592eb87493f836c894386ab43e5d

SHA1
f963f428cdb82d4f614a91dd4ae277ad1724b532

SHA256
929277b548b560f1ba879dd41f98bc5e2cbb6871b725c1ecc4f1c1417e2ae966

SHA512
11ea8dcb959f437322d0d57489cfa80d8b4e90882dfa1d224ec62c92451190174d9ce47c5d4db77e15e44987e187c2e935c058afcb4a27350b3bab1a9aed2674

Download Submit
C:\Windows\System\wyFvPyv.exe

Filesize
2.0MB

MD5
ddab0dd86b0bfaf15844ef215f5c0dcc

SHA1
4b9e4a7dd1569de701aaa3e31a2af56b3f5a7dca

SHA256
9ba0ef6d789355edf6a1c26a1403fa8558c7709fe4a6ac99a7e7bcbef7e96c12

SHA512
0599856dd80c66760c3686b2f7fe2b335c78389cb284db9387cfd1c14c2bd10d42099dfc095455f9cd600214b026e92e63a0df89cfc2ed278461c46491a542c3

Download Submit
C:\Windows\System\yAobjGt.exe

Filesize
2.0MB

MD5
43cb723547dec08b9995252f6fd9cc80

SHA1
a17180cdf95ee69847a06d0f8bfb6c4f7527ea60

SHA256
69f0b4f0ff3d558cbacb06b817f35f7e277ebad9ba4114a9080ae7895c3d0c5e

SHA512
f8498bb96b46c9a2ea6029c7bfd28eb0149b99cbb7f073660149b13fc6235224da4c74afa19a07ac4adfff3011ca11b9b25083b18064ba5615fe0426a840abd6

Download Submit
C:\Windows\System\yBEyreR.exe

Filesize
2.0MB

MD5
fc839a9b070c77478d28916f2b30a25b

SHA1
41420c5ffb57ae0f30f0c1addb69364155e1f4a5

SHA256
23bd904e4de9107ccf1a5b40e0d54f2ff1bb436bc0c50c28acce48d78d291c5b

SHA512
daeb15bb895fc6d96bfa1ad6f4f2bc8d63d71c5f3b42e66f89c7925ec2bbbc99adfa0529515a2c03ad5f0e39f38bfb04193fd4eed79b8db696af7bc75dfc0d05

Download Submit
C:\Windows\System\yssGHxH.exe

Filesize
2.0MB

MD5
6983e4c8598ba9f5ca0afbee0d93f545

SHA1
7ded239026d757cd9d0754966498b3d1cee7b670

SHA256
66d181125bf8cfbc44599460bd48c01aeab1c7b40ee6e854fa5518a6733117d1

SHA512
6537b17ac12b44dba4ed9f941f4b900e75468c640bf127d7ff0fed8101ad32226b77dfa57e8f87b9976466210bbdc45fa0bd2bec36a09399c768a3bca98083eb

Download Submit
memory/1012-2177-0x00007FF6192C0000-0x00007FF6196B2000-memory.dmp

Filesize
3.9MB

Download
memory/1012-38-0x00007FF6192C0000-0x00007FF6196B2000-memory.dmp

Filesize
3.9MB

Download
memory/1408-2148-0x00007FF7965D0000-0x00007FF7969C2000-memory.dmp

Filesize
3.9MB

Download
memory/1408-78-0x00007FF7965D0000-0x00007FF7969C2000-memory.dmp

Filesize
3.9MB

Download
memory/1564-2197-0x00007FF6BFCB0000-0x00007FF6C00A2000-memory.dmp

Filesize
3.9MB

Download
memory/1564-123-0x00007FF6BFCB0000-0x00007FF6C00A2000-memory.dmp

Filesize
3.9MB

Download
memory/2088-62-0x00007FF70B420000-0x00007FF70B812000-memory.dmp

Filesize
3.9MB

Download
memory/2088-2174-0x00007FF70B420000-0x00007FF70B812000-memory.dmp

Filesize
3.9MB

Download
memory/2224-43-0x00007FF731160000-0x00007FF731552000-memory.dmp

Filesize
3.9MB

Download
memory/2224-2179-0x00007FF731160000-0x00007FF731552000-memory.dmp

Filesize
3.9MB

Download
memory/2364-116-0x00007FF688AE0000-0x00007FF688ED2000-memory.dmp

Filesize
3.9MB

Download
memory/2364-2184-0x00007FF688AE0000-0x00007FF688ED2000-memory.dmp

Filesize
3.9MB

Download
memory/2444-2171-0x00007FF74D3C0000-0x00007FF74D7B2000-memory.dmp

Filesize
3.9MB

Download
memory/2444-28-0x00007FF74D3C0000-0x00007FF74D7B2000-memory.dmp

Filesize
3.9MB

Download
memory/2944-71-0x00007FF7BB170000-0x00007FF7BB562000-memory.dmp

Filesize
3.9MB

Download
memory/2944-2192-0x00007FF7BB170000-0x00007FF7BB562000-memory.dmp

Filesize
3.9MB

Download
memory/2944-2120-0x00007FF7BB170000-0x00007FF7BB562000-memory.dmp

Filesize
3.9MB

Download
memory/3028-2182-0x00007FF6D97F0000-0x00007FF6D9BE2000-memory.dmp

Filesize
3.9MB

Download
memory/3028-98-0x00007FF6D97F0000-0x00007FF6D9BE2000-memory.dmp

Filesize
3.9MB

Download
memory/3736-2187-0x00007FF724940000-0x00007FF724D32000-memory.dmp

Filesize
3.9MB

Download
memory/3736-94-0x00007FF724940000-0x00007FF724D32000-memory.dmp

Filesize
3.9MB

Download
memory/3816-110-0x00007FF60AF10000-0x00007FF60B302000-memory.dmp

Filesize
3.9MB

Download
memory/3816-2186-0x00007FF60AF10000-0x00007FF60B302000-memory.dmp

Filesize
3.9MB

Download
memory/3944-129-0x00007FF7CB370000-0x00007FF7CB762000-memory.dmp

Filesize
3.9MB

Download
memory/3944-2210-0x00007FF7CB370000-0x00007FF7CB762000-memory.dmp

Filesize
3.9MB

Download
memory/4216-0-0x00007FF742460000-0x00007FF742852000-memory.dmp

Filesize
3.9MB

Download
memory/4216-1-0x0000021CA51D0000-0x0000021CA51E0000-memory.dmp

Filesize
64KB

Download
memory/4248-2098-0x00007FFF9C3A0000-0x00007FFF9CE61000-memory.dmp

Filesize
10.8MB

Download
memory/4248-59-0x000001F0F23B0000-0x000001F0F23D2000-memory.dmp

Filesize
136KB

Download
memory/4248-2119-0x000001F0F25D0000-0x000001F0F25E0000-memory.dmp

Filesize
64KB

Download
memory/4248-33-0x000001F0F25D0000-0x000001F0F25E0000-memory.dmp

Filesize
64KB

Download
memory/4248-2118-0x000001F0F25D0000-0x000001F0F25E0000-memory.dmp

Filesize
64KB

Download
memory/4248-422-0x000001F0F3440000-0x000001F0F3BE6000-memory.dmp

Filesize
7.6MB

Download
memory/4248-2143-0x00007FFF9C3A0000-0x00007FFF9CE61000-memory.dmp

Filesize
10.8MB

Download
memory/4248-24-0x000001F0F25D0000-0x000001F0F25E0000-memory.dmp

Filesize
64KB

Download
memory/4248-23-0x00007FFF9C3A0000-0x00007FFF9CE61000-memory.dmp

Filesize
10.8MB

Download
memory/4316-2196-0x00007FF7349B0000-0x00007FF734DA2000-memory.dmp

Filesize
3.9MB

Download
memory/4316-117-0x00007FF7349B0000-0x00007FF734DA2000-memory.dmp

Filesize
3.9MB

Download
memory/4652-141-0x00007FF7886F0000-0x00007FF788AE2000-memory.dmp

Filesize
3.9MB

Download
memory/4652-2200-0x00007FF7886F0000-0x00007FF788AE2000-memory.dmp

Filesize
3.9MB

Download
memory/4680-2176-0x00007FF7B5700000-0x00007FF7B5AF2000-memory.dmp

Filesize
3.9MB

Download
memory/4680-79-0x00007FF7B5700000-0x00007FF7B5AF2000-memory.dmp

Filesize
3.9MB

Download
memory/5108-2193-0x00007FF6F11E0000-0x00007FF6F15D2000-memory.dmp

Filesize
3.9MB

Download
memory/5108-80-0x00007FF6F11E0000-0x00007FF6F15D2000-memory.dmp

Filesize
3.9MB

Download
memory/5164-2190-0x00007FF743E40000-0x00007FF744232000-memory.dmp

Filesize
3.9MB

Download
memory/5164-90-0x00007FF743E40000-0x00007FF744232000-memory.dmp

Filesize
3.9MB

Download
memory/5428-147-0x00007FF767BF0000-0x00007FF767FE2000-memory.dmp

Filesize
3.9MB

Download
memory/5428-2216-0x00007FF767BF0000-0x00007FF767FE2000-memory.dmp

Filesize
3.9MB

Download
memory/5480-135-0x00007FF69D9E0000-0x00007FF69DDD2000-memory.dmp

Filesize
3.9MB

Download
memory/5480-2202-0x00007FF69D9E0000-0x00007FF69DDD2000-memory.dmp

Filesize
3.9MB

Download
memory/5612-104-0x00007FF65AD10000-0x00007FF65B102000-memory.dmp

Filesize
3.9MB

Download
memory/5612-2122-0x00007FF65AD10000-0x00007FF65B102000-memory.dmp

Filesize
3.9MB

Download
memory/5612-2422-0x00007FF65AD10000-0x00007FF65B102000-memory.dmp

Filesize
3.9MB

Download
memory/6088-153-0x00007FF66C7D0000-0x00007FF66CBC2000-memory.dmp

Filesize
3.9MB

Download
memory/6088-2212-0x00007FF66C7D0000-0x00007FF66CBC2000-memory.dmp

Filesize
3.9MB

Download