xmrig | 5edc833c205a6cdf10d0438297c315cf1ccb35762b4169350bd9575c22669c84

Analysis

max time kernel
77s
max time network
49s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30-04-2024 05:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
Size

2.1MB
MD5

092375bbd586fb216c6ccb8e8a74f7ee
SHA1

ad58fa4b97390904611cf31fa539a6e867d6ed1c
SHA256

5edc833c205a6cdf10d0438297c315cf1ccb35762b4169350bd9575c22669c84
SHA512

35101cc50a4e440909a7e853f02ed7984153b12f057fa031804821c983266194e9b62f03d920d792c6ebafb437b93247d1f5521442fcf5aacf475af08378bbd3
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qr8:NABz

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 43 IoCs

miner

resource	yara_rule
behavioral2/memory/4128-348-0x00007FF638C30000-0x00007FF639022000-memory.dmp	xmrig
behavioral2/memory/4448-308-0x00007FF7D70B0000-0x00007FF7D74A2000-memory.dmp	xmrig
behavioral2/memory/3728-265-0x00007FF725340000-0x00007FF725732000-memory.dmp	xmrig
behavioral2/memory/644-261-0x00007FF6B7AB0000-0x00007FF6B7EA2000-memory.dmp	xmrig
behavioral2/memory/3472-224-0x00007FF7A10E0000-0x00007FF7A14D2000-memory.dmp	xmrig
behavioral2/memory/2684-470-0x00007FF6ADD10000-0x00007FF6AE102000-memory.dmp	xmrig
behavioral2/memory/4408-500-0x00007FF63D220000-0x00007FF63D612000-memory.dmp	xmrig
behavioral2/memory/1268-501-0x00007FF7A4AD0000-0x00007FF7A4EC2000-memory.dmp	xmrig
behavioral2/memory/3892-536-0x00007FF660F90000-0x00007FF661382000-memory.dmp	xmrig
behavioral2/memory/1056-547-0x00007FF745E30000-0x00007FF746222000-memory.dmp	xmrig
behavioral2/memory/1172-545-0x00007FF64E400000-0x00007FF64E7F2000-memory.dmp	xmrig
behavioral2/memory/1776-544-0x00007FF61E570000-0x00007FF61E962000-memory.dmp	xmrig
behavioral2/memory/3192-543-0x00007FF7242B0000-0x00007FF7246A2000-memory.dmp	xmrig
behavioral2/memory/1544-502-0x00007FF650010000-0x00007FF650402000-memory.dmp	xmrig
behavioral2/memory/1808-499-0x00007FF7102B0000-0x00007FF7106A2000-memory.dmp	xmrig
behavioral2/memory/3204-425-0x00007FF70E540000-0x00007FF70E932000-memory.dmp	xmrig
behavioral2/memory/4816-391-0x00007FF6DE190000-0x00007FF6DE582000-memory.dmp	xmrig
behavioral2/memory/640-176-0x00007FF7DDE70000-0x00007FF7DE262000-memory.dmp	xmrig
behavioral2/memory/856-133-0x00007FF741620000-0x00007FF741A12000-memory.dmp	xmrig
behavioral2/memory/2632-109-0x00007FF6F9CF0000-0x00007FF6FA0E2000-memory.dmp	xmrig
behavioral2/memory/5048-1904-0x00007FF7D69A0000-0x00007FF7D6D92000-memory.dmp	xmrig
behavioral2/memory/3928-2047-0x00007FF7E8AA0000-0x00007FF7E8E92000-memory.dmp	xmrig
behavioral2/memory/3928-2056-0x00007FF7E8AA0000-0x00007FF7E8E92000-memory.dmp	xmrig
behavioral2/memory/644-2058-0x00007FF6B7AB0000-0x00007FF6B7EA2000-memory.dmp	xmrig
behavioral2/memory/2632-2060-0x00007FF6F9CF0000-0x00007FF6FA0E2000-memory.dmp	xmrig
behavioral2/memory/3204-2062-0x00007FF70E540000-0x00007FF70E932000-memory.dmp	xmrig
behavioral2/memory/856-2064-0x00007FF741620000-0x00007FF741A12000-memory.dmp	xmrig
behavioral2/memory/640-2066-0x00007FF7DDE70000-0x00007FF7DE262000-memory.dmp	xmrig
behavioral2/memory/3472-2077-0x00007FF7A10E0000-0x00007FF7A14D2000-memory.dmp	xmrig
behavioral2/memory/1808-2082-0x00007FF7102B0000-0x00007FF7106A2000-memory.dmp	xmrig
behavioral2/memory/4408-2081-0x00007FF63D220000-0x00007FF63D612000-memory.dmp	xmrig
behavioral2/memory/4128-2079-0x00007FF638C30000-0x00007FF639022000-memory.dmp	xmrig
behavioral2/memory/3728-2075-0x00007FF725340000-0x00007FF725732000-memory.dmp	xmrig
behavioral2/memory/4816-2073-0x00007FF6DE190000-0x00007FF6DE582000-memory.dmp	xmrig
behavioral2/memory/4448-2070-0x00007FF7D70B0000-0x00007FF7D74A2000-memory.dmp	xmrig
behavioral2/memory/2684-2069-0x00007FF6ADD10000-0x00007FF6AE102000-memory.dmp	xmrig
behavioral2/memory/1056-2088-0x00007FF745E30000-0x00007FF746222000-memory.dmp	xmrig
behavioral2/memory/1172-2093-0x00007FF64E400000-0x00007FF64E7F2000-memory.dmp	xmrig
behavioral2/memory/1776-2091-0x00007FF61E570000-0x00007FF61E962000-memory.dmp	xmrig
behavioral2/memory/1544-2086-0x00007FF650010000-0x00007FF650402000-memory.dmp	xmrig
behavioral2/memory/1268-2085-0x00007FF7A4AD0000-0x00007FF7A4EC2000-memory.dmp	xmrig
behavioral2/memory/3892-2105-0x00007FF660F90000-0x00007FF661382000-memory.dmp	xmrig
behavioral2/memory/3192-2114-0x00007FF7242B0000-0x00007FF7246A2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3928	WuVEOTu.exe
2632	SKPjlBz.exe
856	UijwqED.exe
640	IrXczCi.exe
3472	GbzbWEn.exe
644	lRaqzDR.exe
3728	ExKtswE.exe
4448	MKAlBNR.exe
4128	PZpLkVO.exe
4816	oYfXLrl.exe
3204	mVVqhae.exe
2684	jRCWrod.exe
1808	gJWvXyW.exe
4408	AfJERWG.exe
1056	EfnJohm.exe
1268	OlvsCUl.exe
1544	sBctQNL.exe
3892	GXqHFgh.exe
3192	YTOdTeF.exe
1776	pgcRDcb.exe
1172	YqgqPKz.exe
1260	aMmbNuq.exe
2948	KVFVFOt.exe
3484	OedRyQG.exe
4260	QZcVvey.exe
1588	VKQZWBK.exe
2128	UQqerCi.exe
1360	YsuqzZu.exe
4576	NEyKHiJ.exe
5016	qqdEpWb.exe
3040	jcCOVhz.exe
4628	FvMgFKU.exe
1532	hmQvxlS.exe
1684	cQuhpRf.exe
3144	WqqEPou.exe
2896	BHKtxSM.exe
1600	qYHpoFS.exe
4396	ZVmHUZv.exe
1264	orIisgn.exe
5000	VbHZofx.exe
3632	vGEpppA.exe
3972	UgoycQn.exe
1284	tGuwqxq.exe
3848	KhBXxFh.exe
972	MBghktr.exe
756	JKNriHl.exe
2460	GdoBdAH.exe
2300	pdUNZQh.exe
2424	eWdGxEv.exe
400	wKRalAE.exe
2080	FIbBzid.exe
1020	PRkXNdh.exe
2860	BByRzBz.exe
2996	NdeiZoM.exe
2716	gtrYXEy.exe
452	UtTlScr.exe
3980	oHcfFyR.exe
2944	QjXwZYB.exe
1048	qkAlYYC.exe
3080	MeuGKCO.exe
3724	ycVXFRS.exe
4300	qmBtVvy.exe
2644	qmnIJDo.exe
3692	nXNXyHz.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5048-0-0x00007FF7D69A0000-0x00007FF7D6D92000-memory.dmp	upx
behavioral2/files/0x000b000000023bb2-5.dat	upx
behavioral2/files/0x000a000000023bb6-21.dat	upx
behavioral2/files/0x000a000000023bb7-35.dat	upx
behavioral2/files/0x0031000000023bbf-55.dat	upx
behavioral2/files/0x000a000000023bc0-98.dat	upx
behavioral2/files/0x000a000000023bc1-121.dat	upx
behavioral2/files/0x000a000000023bc8-156.dat	upx
behavioral2/memory/4128-348-0x00007FF638C30000-0x00007FF639022000-memory.dmp	upx
behavioral2/memory/4448-308-0x00007FF7D70B0000-0x00007FF7D74A2000-memory.dmp	upx
behavioral2/memory/3728-265-0x00007FF725340000-0x00007FF725732000-memory.dmp	upx
behavioral2/memory/644-261-0x00007FF6B7AB0000-0x00007FF6B7EA2000-memory.dmp	upx
behavioral2/memory/3472-224-0x00007FF7A10E0000-0x00007FF7A14D2000-memory.dmp	upx
behavioral2/files/0x000a000000023bdb-192.dat	upx
behavioral2/files/0x000a000000023bda-191.dat	upx
behavioral2/files/0x000a000000023bd9-185.dat	upx
behavioral2/files/0x000a000000023bcb-180.dat	upx
behavioral2/files/0x000a000000023bd8-174.dat	upx
behavioral2/files/0x000a000000023bd7-170.dat	upx
behavioral2/files/0x000a000000023bd1-168.dat	upx
behavioral2/files/0x000a000000023bd6-165.dat	upx
behavioral2/files/0x000a000000023bca-161.dat	upx
behavioral2/files/0x000a000000023bc9-159.dat	upx
behavioral2/files/0x000a000000023bd5-158.dat	upx
behavioral2/files/0x000a000000023bc6-150.dat	upx
behavioral2/files/0x000a000000023bc5-148.dat	upx
behavioral2/files/0x000a000000023bd4-146.dat	upx
behavioral2/files/0x000a000000023bcd-142.dat	upx
behavioral2/files/0x000a000000023bc4-140.dat	upx
behavioral2/memory/2684-470-0x00007FF6ADD10000-0x00007FF6AE102000-memory.dmp	upx
behavioral2/memory/4408-500-0x00007FF63D220000-0x00007FF63D612000-memory.dmp	upx
behavioral2/memory/1268-501-0x00007FF7A4AD0000-0x00007FF7A4EC2000-memory.dmp	upx
behavioral2/memory/3892-536-0x00007FF660F90000-0x00007FF661382000-memory.dmp	upx
behavioral2/memory/1056-547-0x00007FF745E30000-0x00007FF746222000-memory.dmp	upx
behavioral2/memory/1172-545-0x00007FF64E400000-0x00007FF64E7F2000-memory.dmp	upx
behavioral2/memory/1776-544-0x00007FF61E570000-0x00007FF61E962000-memory.dmp	upx
behavioral2/memory/3192-543-0x00007FF7242B0000-0x00007FF7246A2000-memory.dmp	upx
behavioral2/memory/1544-502-0x00007FF650010000-0x00007FF650402000-memory.dmp	upx
behavioral2/memory/1808-499-0x00007FF7102B0000-0x00007FF7106A2000-memory.dmp	upx
behavioral2/memory/3204-425-0x00007FF70E540000-0x00007FF70E932000-memory.dmp	upx
behavioral2/memory/4816-391-0x00007FF6DE190000-0x00007FF6DE582000-memory.dmp	upx
behavioral2/files/0x000a000000023bcc-187.dat	upx
behavioral2/files/0x000a000000023bd3-181.dat	upx
behavioral2/memory/640-176-0x00007FF7DDE70000-0x00007FF7DE262000-memory.dmp	upx
behavioral2/memory/856-133-0x00007FF741620000-0x00007FF741A12000-memory.dmp	upx
behavioral2/files/0x000a000000023bd2-132.dat	upx
behavioral2/files/0x000a000000023bc3-123.dat	upx
behavioral2/files/0x000a000000023bcf-119.dat	upx
behavioral2/files/0x000a000000023bce-118.dat	upx
behavioral2/files/0x000a000000023bc2-103.dat	upx
behavioral2/files/0x000a000000023bc7-101.dat	upx
behavioral2/files/0x000a000000023bd0-120.dat	upx
behavioral2/files/0x000a000000023bbc-92.dat	upx
behavioral2/files/0x000a000000023bbb-83.dat	upx
behavioral2/files/0x000a000000023bb9-79.dat	upx
behavioral2/memory/2632-109-0x00007FF6F9CF0000-0x00007FF6FA0E2000-memory.dmp	upx
behavioral2/files/0x000a000000023bb8-66.dat	upx
behavioral2/files/0x0031000000023bbe-88.dat	upx
behavioral2/files/0x0031000000023bbd-46.dat	upx
behavioral2/files/0x000a000000023bba-29.dat	upx
behavioral2/memory/3928-13-0x00007FF7E8AA0000-0x00007FF7E8E92000-memory.dmp	upx
behavioral2/memory/5048-1904-0x00007FF7D69A0000-0x00007FF7D6D92000-memory.dmp	upx
behavioral2/memory/3928-2047-0x00007FF7E8AA0000-0x00007FF7E8E92000-memory.dmp	upx
behavioral2/memory/3928-2056-0x00007FF7E8AA0000-0x00007FF7E8E92000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\gRnpltv.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\zWUqPSE.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\TIceZis.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\ifJukFY.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\eivpVZU.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\ySspSwe.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\FLhanxd.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\rmqSYIx.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\KwXRnVW.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\hFQWSxY.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\hfinPLz.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\ejNPnsI.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\TxLSdPS.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\rwuJzJj.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\CNGJVAh.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\dxKppfQ.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\QMdZZtN.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\aMmbNuq.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\OpXyvkm.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\MguBYPo.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\lsljkYA.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\BnDsFYC.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\aexFAjW.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\iAxYVKd.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\UvLrYHr.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\oTBgVly.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\oBGIrIC.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\kuEXJlS.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\arabYyU.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\ZjzRRgi.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\QNObuUg.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\lkVdIRI.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\leVseZz.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\hOdnjPh.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\hAexOYX.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\WbahZOG.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\PZLedHQ.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\SUzHvOy.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\PixDjPo.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\IrXczCi.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\tGuwqxq.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\GEZYQLG.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\aVINOqN.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\RntCxXz.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\BwDGPlH.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\iWdKCvO.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\OaDRZNF.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\gqxbrDQ.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\PcnLnff.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\dFydupV.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\fGQyOvs.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\KQnLcLk.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\XLimhUC.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\EVQacJy.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\hIKrNen.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\YTOdTeF.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\gGsgcLD.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\dyfCaiv.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\CATSTzQ.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\LqRVhnR.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\fynmoHi.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\EWriDWd.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\zIOskfD.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\oyecowN.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1416	powershell.exe
1416	powershell.exe
1416	powershell.exe
1416	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
Token: SeDebugPrivilege	1416	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 1416	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	84
PID 5048 wrote to memory of 1416	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	84
PID 5048 wrote to memory of 3928	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	85
PID 5048 wrote to memory of 3928	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	85
PID 5048 wrote to memory of 2632	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	86
PID 5048 wrote to memory of 2632	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	86
PID 5048 wrote to memory of 856	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	87
PID 5048 wrote to memory of 856	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	87
PID 5048 wrote to memory of 640	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	88
PID 5048 wrote to memory of 640	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	88
PID 5048 wrote to memory of 3472	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	89
PID 5048 wrote to memory of 3472	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	89
PID 5048 wrote to memory of 644	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	90
PID 5048 wrote to memory of 644	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	90
PID 5048 wrote to memory of 3728	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	91
PID 5048 wrote to memory of 3728	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	91
PID 5048 wrote to memory of 4448	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	92
PID 5048 wrote to memory of 4448	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	92
PID 5048 wrote to memory of 4128	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	93
PID 5048 wrote to memory of 4128	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	93
PID 5048 wrote to memory of 4816	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	94
PID 5048 wrote to memory of 4816	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	94
PID 5048 wrote to memory of 3204	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	95
PID 5048 wrote to memory of 3204	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	95
PID 5048 wrote to memory of 2684	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	96
PID 5048 wrote to memory of 2684	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	96
PID 5048 wrote to memory of 1808	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	97
PID 5048 wrote to memory of 1808	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	97
PID 5048 wrote to memory of 3192	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	98
PID 5048 wrote to memory of 3192	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	98
PID 5048 wrote to memory of 4408	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	99
PID 5048 wrote to memory of 4408	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	99
PID 5048 wrote to memory of 1056	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	100
PID 5048 wrote to memory of 1056	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	100
PID 5048 wrote to memory of 1268	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	101
PID 5048 wrote to memory of 1268	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	101
PID 5048 wrote to memory of 1544	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	102
PID 5048 wrote to memory of 1544	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	102
PID 5048 wrote to memory of 3892	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	103
PID 5048 wrote to memory of 3892	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	103
PID 5048 wrote to memory of 1776	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	104
PID 5048 wrote to memory of 1776	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	104
PID 5048 wrote to memory of 1172	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	105
PID 5048 wrote to memory of 1172	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	105
PID 5048 wrote to memory of 1260	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	106
PID 5048 wrote to memory of 1260	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	106
PID 5048 wrote to memory of 5016	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	107
PID 5048 wrote to memory of 5016	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	107
PID 5048 wrote to memory of 2948	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	108
PID 5048 wrote to memory of 2948	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	108
PID 5048 wrote to memory of 3484	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	109
PID 5048 wrote to memory of 3484	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	109
PID 5048 wrote to memory of 4260	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	110
PID 5048 wrote to memory of 4260	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	110
PID 5048 wrote to memory of 1588	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	111
PID 5048 wrote to memory of 1588	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	111
PID 5048 wrote to memory of 2128	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	112
PID 5048 wrote to memory of 2128	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	112
PID 5048 wrote to memory of 1360	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	113
PID 5048 wrote to memory of 1360	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	113
PID 5048 wrote to memory of 4576	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	114
PID 5048 wrote to memory of 4576	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	114
PID 5048 wrote to memory of 3040	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	115
PID 5048 wrote to memory of 3040	5048	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1416
- C:\Windows\System\WuVEOTu.exe
  C:\Windows\System\WuVEOTu.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\SKPjlBz.exe
  C:\Windows\System\SKPjlBz.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\UijwqED.exe
  C:\Windows\System\UijwqED.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\IrXczCi.exe
  C:\Windows\System\IrXczCi.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\GbzbWEn.exe
  C:\Windows\System\GbzbWEn.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System\lRaqzDR.exe
  C:\Windows\System\lRaqzDR.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\ExKtswE.exe
  C:\Windows\System\ExKtswE.exe
  2⤵
  - Executes dropped EXE
  PID:3728
- C:\Windows\System\MKAlBNR.exe
  C:\Windows\System\MKAlBNR.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\PZpLkVO.exe
  C:\Windows\System\PZpLkVO.exe
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\Windows\System\oYfXLrl.exe
  C:\Windows\System\oYfXLrl.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\mVVqhae.exe
  C:\Windows\System\mVVqhae.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\jRCWrod.exe
  C:\Windows\System\jRCWrod.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\gJWvXyW.exe
  C:\Windows\System\gJWvXyW.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\YTOdTeF.exe
  C:\Windows\System\YTOdTeF.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\AfJERWG.exe
  C:\Windows\System\AfJERWG.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\EfnJohm.exe
  C:\Windows\System\EfnJohm.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\OlvsCUl.exe
  C:\Windows\System\OlvsCUl.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\sBctQNL.exe
  C:\Windows\System\sBctQNL.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\GXqHFgh.exe
  C:\Windows\System\GXqHFgh.exe
  2⤵
  - Executes dropped EXE
  PID:3892
- C:\Windows\System\pgcRDcb.exe
  C:\Windows\System\pgcRDcb.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\YqgqPKz.exe
  C:\Windows\System\YqgqPKz.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\aMmbNuq.exe
  C:\Windows\System\aMmbNuq.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\qqdEpWb.exe
  C:\Windows\System\qqdEpWb.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\KVFVFOt.exe
  C:\Windows\System\KVFVFOt.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\OedRyQG.exe
  C:\Windows\System\OedRyQG.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\QZcVvey.exe
  C:\Windows\System\QZcVvey.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\VKQZWBK.exe
  C:\Windows\System\VKQZWBK.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\UQqerCi.exe
  C:\Windows\System\UQqerCi.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\YsuqzZu.exe
  C:\Windows\System\YsuqzZu.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\NEyKHiJ.exe
  C:\Windows\System\NEyKHiJ.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\jcCOVhz.exe
  C:\Windows\System\jcCOVhz.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\FvMgFKU.exe
  C:\Windows\System\FvMgFKU.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\hmQvxlS.exe
  C:\Windows\System\hmQvxlS.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\cQuhpRf.exe
  C:\Windows\System\cQuhpRf.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\WqqEPou.exe
  C:\Windows\System\WqqEPou.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\BHKtxSM.exe
  C:\Windows\System\BHKtxSM.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\qYHpoFS.exe
  C:\Windows\System\qYHpoFS.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\ZVmHUZv.exe
  C:\Windows\System\ZVmHUZv.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\orIisgn.exe
  C:\Windows\System\orIisgn.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\VbHZofx.exe
  C:\Windows\System\VbHZofx.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\vGEpppA.exe
  C:\Windows\System\vGEpppA.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\UgoycQn.exe
  C:\Windows\System\UgoycQn.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\tGuwqxq.exe
  C:\Windows\System\tGuwqxq.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\KhBXxFh.exe
  C:\Windows\System\KhBXxFh.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System\MBghktr.exe
  C:\Windows\System\MBghktr.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\qkAlYYC.exe
  C:\Windows\System\qkAlYYC.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\ycVXFRS.exe
  C:\Windows\System\ycVXFRS.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\JKNriHl.exe
  C:\Windows\System\JKNriHl.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\GdoBdAH.exe
  C:\Windows\System\GdoBdAH.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\pdUNZQh.exe
  C:\Windows\System\pdUNZQh.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\eWdGxEv.exe
  C:\Windows\System\eWdGxEv.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\wKRalAE.exe
  C:\Windows\System\wKRalAE.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\FIbBzid.exe
  C:\Windows\System\FIbBzid.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\PRkXNdh.exe
  C:\Windows\System\PRkXNdh.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\BByRzBz.exe
  C:\Windows\System\BByRzBz.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\NdeiZoM.exe
  C:\Windows\System\NdeiZoM.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\gtrYXEy.exe
  C:\Windows\System\gtrYXEy.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\UtTlScr.exe
  C:\Windows\System\UtTlScr.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\oHcfFyR.exe
  C:\Windows\System\oHcfFyR.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\QjXwZYB.exe
  C:\Windows\System\QjXwZYB.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\MeuGKCO.exe
  C:\Windows\System\MeuGKCO.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\qmBtVvy.exe
  C:\Windows\System\qmBtVvy.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\qmnIJDo.exe
  C:\Windows\System\qmnIJDo.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\nXNXyHz.exe
  C:\Windows\System\nXNXyHz.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\YXzQMUX.exe
  C:\Windows\System\YXzQMUX.exe
  2⤵
  PID:372
- C:\Windows\System\SkpZVFo.exe
  C:\Windows\System\SkpZVFo.exe
  2⤵
  PID:1672
- C:\Windows\System\ZjzRRgi.exe
  C:\Windows\System\ZjzRRgi.exe
  2⤵
  PID:716
- C:\Windows\System\AdAwWEz.exe
  C:\Windows\System\AdAwWEz.exe
  2⤵
  PID:1484
- C:\Windows\System\mNCbpkV.exe
  C:\Windows\System\mNCbpkV.exe
  2⤵
  PID:4468
- C:\Windows\System\cLTKNLx.exe
  C:\Windows\System\cLTKNLx.exe
  2⤵
  PID:3816
- C:\Windows\System\dmhWLkG.exe
  C:\Windows\System\dmhWLkG.exe
  2⤵
  PID:2744
- C:\Windows\System\OrlLIWp.exe
  C:\Windows\System\OrlLIWp.exe
  2⤵
  PID:704
- C:\Windows\System\gqxbrDQ.exe
  C:\Windows\System\gqxbrDQ.exe
  2⤵
  PID:4708
- C:\Windows\System\taSDylw.exe
  C:\Windows\System\taSDylw.exe
  2⤵
  PID:5020
- C:\Windows\System\qDgGFfQ.exe
  C:\Windows\System\qDgGFfQ.exe
  2⤵
  PID:1652
- C:\Windows\System\AfKeJWa.exe
  C:\Windows\System\AfKeJWa.exe
  2⤵
  PID:2308
- C:\Windows\System\xavsCTG.exe
  C:\Windows\System\xavsCTG.exe
  2⤵
  PID:2268
- C:\Windows\System\hRMIlZl.exe
  C:\Windows\System\hRMIlZl.exe
  2⤵
  PID:4452
- C:\Windows\System\OqbbbMR.exe
  C:\Windows\System\OqbbbMR.exe
  2⤵
  PID:436
- C:\Windows\System\bbVPeGz.exe
  C:\Windows\System\bbVPeGz.exe
  2⤵
  PID:1972
- C:\Windows\System\gGsgcLD.exe
  C:\Windows\System\gGsgcLD.exe
  2⤵
  PID:3900
- C:\Windows\System\MEHdBVb.exe
  C:\Windows\System\MEHdBVb.exe
  2⤵
  PID:4008
- C:\Windows\System\CMKRnuk.exe
  C:\Windows\System\CMKRnuk.exe
  2⤵
  PID:3252
- C:\Windows\System\kkJIFKY.exe
  C:\Windows\System\kkJIFKY.exe
  2⤵
  PID:5128
- C:\Windows\System\vYoXpiC.exe
  C:\Windows\System\vYoXpiC.exe
  2⤵
  PID:5148
- C:\Windows\System\NSQPPor.exe
  C:\Windows\System\NSQPPor.exe
  2⤵
  PID:5176
- C:\Windows\System\IEWSNRZ.exe
  C:\Windows\System\IEWSNRZ.exe
  2⤵
  PID:5200
- C:\Windows\System\gRnpltv.exe
  C:\Windows\System\gRnpltv.exe
  2⤵
  PID:5216
- C:\Windows\System\NnsdiFv.exe
  C:\Windows\System\NnsdiFv.exe
  2⤵
  PID:5232
- C:\Windows\System\mSzdsec.exe
  C:\Windows\System\mSzdsec.exe
  2⤵
  PID:5248
- C:\Windows\System\HiuPcUj.exe
  C:\Windows\System\HiuPcUj.exe
  2⤵
  PID:5268
- C:\Windows\System\hOdnjPh.exe
  C:\Windows\System\hOdnjPh.exe
  2⤵
  PID:5336
- C:\Windows\System\CTZRjuJ.exe
  C:\Windows\System\CTZRjuJ.exe
  2⤵
  PID:5412
- C:\Windows\System\uWGRqcc.exe
  C:\Windows\System\uWGRqcc.exe
  2⤵
  PID:5484
- C:\Windows\System\ZHVdEyP.exe
  C:\Windows\System\ZHVdEyP.exe
  2⤵
  PID:5508
- C:\Windows\System\PcnLnff.exe
  C:\Windows\System\PcnLnff.exe
  2⤵
  PID:5528
- C:\Windows\System\KUzVeMM.exe
  C:\Windows\System\KUzVeMM.exe
  2⤵
  PID:5548
- C:\Windows\System\LARSplX.exe
  C:\Windows\System\LARSplX.exe
  2⤵
  PID:5568
- C:\Windows\System\HFsIaHP.exe
  C:\Windows\System\HFsIaHP.exe
  2⤵
  PID:5588
- C:\Windows\System\PPPHHWz.exe
  C:\Windows\System\PPPHHWz.exe
  2⤵
  PID:5616
- C:\Windows\System\TpxtJyc.exe
  C:\Windows\System\TpxtJyc.exe
  2⤵
  PID:5640
- C:\Windows\System\WUsEVCM.exe
  C:\Windows\System\WUsEVCM.exe
  2⤵
  PID:5660
- C:\Windows\System\JTRzoQK.exe
  C:\Windows\System\JTRzoQK.exe
  2⤵
  PID:5692
- C:\Windows\System\CDVJzkQ.exe
  C:\Windows\System\CDVJzkQ.exe
  2⤵
  PID:5768
- C:\Windows\System\RZTFFXa.exe
  C:\Windows\System\RZTFFXa.exe
  2⤵
  PID:5792
- C:\Windows\System\uerrNzv.exe
  C:\Windows\System\uerrNzv.exe
  2⤵
  PID:5812
- C:\Windows\System\OHBIwoB.exe
  C:\Windows\System\OHBIwoB.exe
  2⤵
  PID:5836
- C:\Windows\System\fynmoHi.exe
  C:\Windows\System\fynmoHi.exe
  2⤵
  PID:5856
- C:\Windows\System\poDAzNi.exe
  C:\Windows\System\poDAzNi.exe
  2⤵
  PID:5880
- C:\Windows\System\UEhbbgm.exe
  C:\Windows\System\UEhbbgm.exe
  2⤵
  PID:5896
- C:\Windows\System\ugkXvaC.exe
  C:\Windows\System\ugkXvaC.exe
  2⤵
  PID:5916
- C:\Windows\System\dyfCaiv.exe
  C:\Windows\System\dyfCaiv.exe
  2⤵
  PID:5940
- C:\Windows\System\jTRfqlj.exe
  C:\Windows\System\jTRfqlj.exe
  2⤵
  PID:5956
- C:\Windows\System\VaOYGMj.exe
  C:\Windows\System\VaOYGMj.exe
  2⤵
  PID:5976
- C:\Windows\System\tlCywSJ.exe
  C:\Windows\System\tlCywSJ.exe
  2⤵
  PID:6004
- C:\Windows\System\MHaSmLv.exe
  C:\Windows\System\MHaSmLv.exe
  2⤵
  PID:6028
- C:\Windows\System\uKfLljF.exe
  C:\Windows\System\uKfLljF.exe
  2⤵
  PID:6044
- C:\Windows\System\ooTsqRs.exe
  C:\Windows\System\ooTsqRs.exe
  2⤵
  PID:6068
- C:\Windows\System\USibckM.exe
  C:\Windows\System\USibckM.exe
  2⤵
  PID:6104
- C:\Windows\System\vCmVuNh.exe
  C:\Windows\System\vCmVuNh.exe
  2⤵
  PID:6128
- C:\Windows\System\vCUpklX.exe
  C:\Windows\System\vCUpklX.exe
  2⤵
  PID:3168
- C:\Windows\System\bWWClhu.exe
  C:\Windows\System\bWWClhu.exe
  2⤵
  PID:3604
- C:\Windows\System\ejaiBeM.exe
  C:\Windows\System\ejaiBeM.exe
  2⤵
  PID:4204
- C:\Windows\System\iJQNmIE.exe
  C:\Windows\System\iJQNmIE.exe
  2⤵
  PID:2640
- C:\Windows\System\CHeouzP.exe
  C:\Windows\System\CHeouzP.exe
  2⤵
  PID:2252
- C:\Windows\System\RnzkKOx.exe
  C:\Windows\System\RnzkKOx.exe
  2⤵
  PID:5024
- C:\Windows\System\mCrwPKO.exe
  C:\Windows\System\mCrwPKO.exe
  2⤵
  PID:896
- C:\Windows\System\nwIAzdf.exe
  C:\Windows\System\nwIAzdf.exe
  2⤵
  PID:2012
- C:\Windows\System\bHMMjtT.exe
  C:\Windows\System\bHMMjtT.exe
  2⤵
  PID:3680
- C:\Windows\System\shbEqcD.exe
  C:\Windows\System\shbEqcD.exe
  2⤵
  PID:1392
- C:\Windows\System\xoOEkCW.exe
  C:\Windows\System\xoOEkCW.exe
  2⤵
  PID:3844
- C:\Windows\System\NGXEAdY.exe
  C:\Windows\System\NGXEAdY.exe
  2⤵
  PID:2420
- C:\Windows\System\QOcAAnE.exe
  C:\Windows\System\QOcAAnE.exe
  2⤵
  PID:5140
- C:\Windows\System\sgSNpWY.exe
  C:\Windows\System\sgSNpWY.exe
  2⤵
  PID:5192
- C:\Windows\System\fqtCdUp.exe
  C:\Windows\System\fqtCdUp.exe
  2⤵
  PID:4544
- C:\Windows\System\ThdPAyW.exe
  C:\Windows\System\ThdPAyW.exe
  2⤵
  PID:6036
- C:\Windows\System\OpXyvkm.exe
  C:\Windows\System\OpXyvkm.exe
  2⤵
  PID:6084
- C:\Windows\System\ggipidg.exe
  C:\Windows\System\ggipidg.exe
  2⤵
  PID:5704
- C:\Windows\System\dwKWZTM.exe
  C:\Windows\System\dwKWZTM.exe
  2⤵
  PID:5356
- C:\Windows\System\RfIphjq.exe
  C:\Windows\System\RfIphjq.exe
  2⤵
  PID:5804
- C:\Windows\System\ZDkWpGA.exe
  C:\Windows\System\ZDkWpGA.exe
  2⤵
  PID:5472
- C:\Windows\System\eMHmJYB.exe
  C:\Windows\System\eMHmJYB.exe
  2⤵
  PID:5520
- C:\Windows\System\kbvxgnP.exe
  C:\Windows\System\kbvxgnP.exe
  2⤵
  PID:5560
- C:\Windows\System\cbyPAiu.exe
  C:\Windows\System\cbyPAiu.exe
  2⤵
  PID:5624
- C:\Windows\System\jElfJmh.exe
  C:\Windows\System\jElfJmh.exe
  2⤵
  PID:5668
- C:\Windows\System\zcTeiUo.exe
  C:\Windows\System\zcTeiUo.exe
  2⤵
  PID:6152
- C:\Windows\System\pJpnabR.exe
  C:\Windows\System\pJpnabR.exe
  2⤵
  PID:6176
- C:\Windows\System\PPTNeXF.exe
  C:\Windows\System\PPTNeXF.exe
  2⤵
  PID:6200
- C:\Windows\System\JOTNZAy.exe
  C:\Windows\System\JOTNZAy.exe
  2⤵
  PID:6216
- C:\Windows\System\ljhmEhc.exe
  C:\Windows\System\ljhmEhc.exe
  2⤵
  PID:6232
- C:\Windows\System\LkgzUgi.exe
  C:\Windows\System\LkgzUgi.exe
  2⤵
  PID:6248
- C:\Windows\System\hVtnixv.exe
  C:\Windows\System\hVtnixv.exe
  2⤵
  PID:6264
- C:\Windows\System\oKAlBpb.exe
  C:\Windows\System\oKAlBpb.exe
  2⤵
  PID:6312
- C:\Windows\System\TTVGGrA.exe
  C:\Windows\System\TTVGGrA.exe
  2⤵
  PID:6428
- C:\Windows\System\jSIvfxu.exe
  C:\Windows\System\jSIvfxu.exe
  2⤵
  PID:6452
- C:\Windows\System\YfkuBIY.exe
  C:\Windows\System\YfkuBIY.exe
  2⤵
  PID:6476
- C:\Windows\System\rKjGnVV.exe
  C:\Windows\System\rKjGnVV.exe
  2⤵
  PID:6496
- C:\Windows\System\ticUAjC.exe
  C:\Windows\System\ticUAjC.exe
  2⤵
  PID:6516
- C:\Windows\System\DbqmRHf.exe
  C:\Windows\System\DbqmRHf.exe
  2⤵
  PID:6536
- C:\Windows\System\IptYGiM.exe
  C:\Windows\System\IptYGiM.exe
  2⤵
  PID:6556
- C:\Windows\System\vAkyBDC.exe
  C:\Windows\System\vAkyBDC.exe
  2⤵
  PID:6572
- C:\Windows\System\cDZTyes.exe
  C:\Windows\System\cDZTyes.exe
  2⤵
  PID:6596
- C:\Windows\System\eVllCEL.exe
  C:\Windows\System\eVllCEL.exe
  2⤵
  PID:6616
- C:\Windows\System\GBTARFu.exe
  C:\Windows\System\GBTARFu.exe
  2⤵
  PID:6636
- C:\Windows\System\vXonrus.exe
  C:\Windows\System\vXonrus.exe
  2⤵
  PID:6652
- C:\Windows\System\wCIlwEk.exe
  C:\Windows\System\wCIlwEk.exe
  2⤵
  PID:6668
- C:\Windows\System\jqcvjkH.exe
  C:\Windows\System\jqcvjkH.exe
  2⤵
  PID:6972
- C:\Windows\System\KHnTvnM.exe
  C:\Windows\System\KHnTvnM.exe
  2⤵
  PID:6996
- C:\Windows\System\DDIjHsz.exe
  C:\Windows\System\DDIjHsz.exe
  2⤵
  PID:7020
- C:\Windows\System\vcGSrcU.exe
  C:\Windows\System\vcGSrcU.exe
  2⤵
  PID:7044
- C:\Windows\System\ypnZGkG.exe
  C:\Windows\System\ypnZGkG.exe
  2⤵
  PID:7108
- C:\Windows\System\NdMdGMu.exe
  C:\Windows\System\NdMdGMu.exe
  2⤵
  PID:7124
- C:\Windows\System\YWphLXP.exe
  C:\Windows\System\YWphLXP.exe
  2⤵
  PID:7140
- C:\Windows\System\VDfNEjx.exe
  C:\Windows\System\VDfNEjx.exe
  2⤵
  PID:7156
- C:\Windows\System\vmoDyDW.exe
  C:\Windows\System\vmoDyDW.exe
  2⤵
  PID:5736
- C:\Windows\System\PeAmHif.exe
  C:\Windows\System\PeAmHif.exe
  2⤵
  PID:6000
- C:\Windows\System\xbEgaij.exe
  C:\Windows\System\xbEgaij.exe
  2⤵
  PID:5952
- C:\Windows\System\LYDQgib.exe
  C:\Windows\System\LYDQgib.exe
  2⤵
  PID:5848
- C:\Windows\System\yknXypc.exe
  C:\Windows\System\yknXypc.exe
  2⤵
  PID:5784
- C:\Windows\System\iLBNiHF.exe
  C:\Windows\System\iLBNiHF.exe
  2⤵
  PID:5752
- C:\Windows\System\BBeySua.exe
  C:\Windows\System\BBeySua.exe
  2⤵
  PID:3092
- C:\Windows\System\ySspSwe.exe
  C:\Windows\System\ySspSwe.exe
  2⤵
  PID:2408
- C:\Windows\System\vhDzVLt.exe
  C:\Windows\System\vhDzVLt.exe
  2⤵
  PID:1368
- C:\Windows\System\rwuJzJj.exe
  C:\Windows\System\rwuJzJj.exe
  2⤵
  PID:5432
- C:\Windows\System\qUHQYSw.exe
  C:\Windows\System\qUHQYSw.exe
  2⤵
  PID:3736
- C:\Windows\System\tXQrFAf.exe
  C:\Windows\System\tXQrFAf.exe
  2⤵
  PID:5908
- C:\Windows\System\QvzPGwQ.exe
  C:\Windows\System\QvzPGwQ.exe
  2⤵
  PID:6148
- C:\Windows\System\JEKQNFT.exe
  C:\Windows\System\JEKQNFT.exe
  2⤵
  PID:6228
- C:\Windows\System\aLzzHVK.exe
  C:\Windows\System\aLzzHVK.exe
  2⤵
  PID:6060
- C:\Windows\System\DGwWVUH.exe
  C:\Windows\System\DGwWVUH.exe
  2⤵
  PID:5464
- C:\Windows\System\fHlLvtg.exe
  C:\Windows\System\fHlLvtg.exe
  2⤵
  PID:5224
- C:\Windows\System\dtuBUpw.exe
  C:\Windows\System\dtuBUpw.exe
  2⤵
  PID:5324
- C:\Windows\System\PceaCqG.exe
  C:\Windows\System\PceaCqG.exe
  2⤵
  PID:5460
- C:\Windows\System\ZakMjYr.exe
  C:\Windows\System\ZakMjYr.exe
  2⤵
  PID:4988
- C:\Windows\System\zeNrAWA.exe
  C:\Windows\System\zeNrAWA.exe
  2⤵
  PID:6208
- C:\Windows\System\PanPlzo.exe
  C:\Windows\System\PanPlzo.exe
  2⤵
  PID:6360
- C:\Windows\System\RbPyQLR.exe
  C:\Windows\System\RbPyQLR.exe
  2⤵
  PID:6408
- C:\Windows\System\MjCoTeK.exe
  C:\Windows\System\MjCoTeK.exe
  2⤵
  PID:6444
- C:\Windows\System\dgKGdIW.exe
  C:\Windows\System\dgKGdIW.exe
  2⤵
  PID:6488
- C:\Windows\System\abNfhZl.exe
  C:\Windows\System\abNfhZl.exe
  2⤵
  PID:6548
- C:\Windows\System\caGkjWT.exe
  C:\Windows\System\caGkjWT.exe
  2⤵
  PID:6588
- C:\Windows\System\yCwUWQq.exe
  C:\Windows\System\yCwUWQq.exe
  2⤵
  PID:6624
- C:\Windows\System\SpYkSMh.exe
  C:\Windows\System\SpYkSMh.exe
  2⤵
  PID:6704
- C:\Windows\System\jhvDNNt.exe
  C:\Windows\System\jhvDNNt.exe
  2⤵
  PID:5852
- C:\Windows\System\czIqxDn.exe
  C:\Windows\System\czIqxDn.exe
  2⤵
  PID:5764
- C:\Windows\System\oZAnIoA.exe
  C:\Windows\System\oZAnIoA.exe
  2⤵
  PID:7172
- C:\Windows\System\zWUqPSE.exe
  C:\Windows\System\zWUqPSE.exe
  2⤵
  PID:7196
- C:\Windows\System\UvLrYHr.exe
  C:\Windows\System\UvLrYHr.exe
  2⤵
  PID:7212
- C:\Windows\System\fexaohb.exe
  C:\Windows\System\fexaohb.exe
  2⤵
  PID:7236
- C:\Windows\System\QnCdApO.exe
  C:\Windows\System\QnCdApO.exe
  2⤵
  PID:7260
- C:\Windows\System\WCsDFGb.exe
  C:\Windows\System\WCsDFGb.exe
  2⤵
  PID:7276
- C:\Windows\System\aYWmVlN.exe
  C:\Windows\System\aYWmVlN.exe
  2⤵
  PID:7308
- C:\Windows\System\CNGJVAh.exe
  C:\Windows\System\CNGJVAh.exe
  2⤵
  PID:7336
- C:\Windows\System\thCMrLs.exe
  C:\Windows\System\thCMrLs.exe
  2⤵
  PID:7360
- C:\Windows\System\WusveEa.exe
  C:\Windows\System\WusveEa.exe
  2⤵
  PID:7384
- C:\Windows\System\FBPxksR.exe
  C:\Windows\System\FBPxksR.exe
  2⤵
  PID:7624
- C:\Windows\System\rAyIyuI.exe
  C:\Windows\System\rAyIyuI.exe
  2⤵
  PID:7644
- C:\Windows\System\aQSBQnq.exe
  C:\Windows\System\aQSBQnq.exe
  2⤵
  PID:7668
- C:\Windows\System\pfFVakn.exe
  C:\Windows\System\pfFVakn.exe
  2⤵
  PID:7684
- C:\Windows\System\jOKVWdz.exe
  C:\Windows\System\jOKVWdz.exe
  2⤵
  PID:7708
- C:\Windows\System\GEZYQLG.exe
  C:\Windows\System\GEZYQLG.exe
  2⤵
  PID:7732
- C:\Windows\System\AUXactM.exe
  C:\Windows\System\AUXactM.exe
  2⤵
  PID:7768
- C:\Windows\System\reEjZwO.exe
  C:\Windows\System\reEjZwO.exe
  2⤵
  PID:7788
- C:\Windows\System\EufWtfG.exe
  C:\Windows\System\EufWtfG.exe
  2⤵
  PID:7812
- C:\Windows\System\xnPaDar.exe
  C:\Windows\System\xnPaDar.exe
  2⤵
  PID:7840
- C:\Windows\System\wLsOvyT.exe
  C:\Windows\System\wLsOvyT.exe
  2⤵
  PID:7856
- C:\Windows\System\osGDzjD.exe
  C:\Windows\System\osGDzjD.exe
  2⤵
  PID:7880
- C:\Windows\System\CdwdUhU.exe
  C:\Windows\System\CdwdUhU.exe
  2⤵
  PID:7904
- C:\Windows\System\FEVRlzG.exe
  C:\Windows\System\FEVRlzG.exe
  2⤵
  PID:7928
- C:\Windows\System\rvJtSBZ.exe
  C:\Windows\System\rvJtSBZ.exe
  2⤵
  PID:7948
- C:\Windows\System\qLoOxgx.exe
  C:\Windows\System\qLoOxgx.exe
  2⤵
  PID:7968
- C:\Windows\System\obVGYAW.exe
  C:\Windows\System\obVGYAW.exe
  2⤵
  PID:7992
- C:\Windows\System\KTSdwiA.exe
  C:\Windows\System\KTSdwiA.exe
  2⤵
  PID:8016
- C:\Windows\System\SKhxmQj.exe
  C:\Windows\System\SKhxmQj.exe
  2⤵
  PID:8036
- C:\Windows\System\IqFUtfc.exe
  C:\Windows\System\IqFUtfc.exe
  2⤵
  PID:8056
- C:\Windows\System\LuBvOaN.exe
  C:\Windows\System\LuBvOaN.exe
  2⤵
  PID:8096
- C:\Windows\System\aJjMPzh.exe
  C:\Windows\System\aJjMPzh.exe
  2⤵
  PID:8136
- C:\Windows\System\MguBYPo.exe
  C:\Windows\System\MguBYPo.exe
  2⤵
  PID:8156
- C:\Windows\System\lGixJcN.exe
  C:\Windows\System\lGixJcN.exe
  2⤵
  PID:8176
- C:\Windows\System\QeArlxJ.exe
  C:\Windows\System\QeArlxJ.exe
  2⤵
  PID:5088
- C:\Windows\System\bBMcEbW.exe
  C:\Windows\System\bBMcEbW.exe
  2⤵
  PID:5260
- C:\Windows\System\jREdDal.exe
  C:\Windows\System\jREdDal.exe
  2⤵
  PID:5212
- C:\Windows\System\fbUSOLO.exe
  C:\Windows\System\fbUSOLO.exe
  2⤵
  PID:1068
- C:\Windows\System\MJmLpnI.exe
  C:\Windows\System\MJmLpnI.exe
  2⤵
  PID:7088
- C:\Windows\System\zzVixvx.exe
  C:\Windows\System\zzVixvx.exe
  2⤵
  PID:7120
- C:\Windows\System\dlXBNcp.exe
  C:\Windows\System\dlXBNcp.exe
  2⤵
  PID:5972
- C:\Windows\System\Gnersmi.exe
  C:\Windows\System\Gnersmi.exe
  2⤵
  PID:6224
- C:\Windows\System\zWJLxuU.exe
  C:\Windows\System\zWJLxuU.exe
  2⤵
  PID:5652
- C:\Windows\System\uJYXPiM.exe
  C:\Windows\System\uJYXPiM.exe
  2⤵
  PID:6260
- C:\Windows\System\CtFmCdt.exe
  C:\Windows\System\CtFmCdt.exe
  2⤵
  PID:7332
- C:\Windows\System\MYoFLFp.exe
  C:\Windows\System\MYoFLFp.exe
  2⤵
  PID:7372
- C:\Windows\System\EWriDWd.exe
  C:\Windows\System\EWriDWd.exe
  2⤵
  PID:7424
- C:\Windows\System\soDgMWK.exe
  C:\Windows\System\soDgMWK.exe
  2⤵
  PID:7920
- C:\Windows\System\TDCDvSt.exe
  C:\Windows\System\TDCDvSt.exe
  2⤵
  PID:7452
- C:\Windows\System\RnIyGYt.exe
  C:\Windows\System\RnIyGYt.exe
  2⤵
  PID:7964
- C:\Windows\System\lnLwSDH.exe
  C:\Windows\System\lnLwSDH.exe
  2⤵
  PID:8208
- C:\Windows\System\vEdcPrd.exe
  C:\Windows\System\vEdcPrd.exe
  2⤵
  PID:8232
- C:\Windows\System\sEQhQTB.exe
  C:\Windows\System\sEQhQTB.exe
  2⤵
  PID:8252
- C:\Windows\System\cfEcBYo.exe
  C:\Windows\System\cfEcBYo.exe
  2⤵
  PID:8308
- C:\Windows\System\pfBNkRl.exe
  C:\Windows\System\pfBNkRl.exe
  2⤵
  PID:8332
- C:\Windows\System\ZVIhRej.exe
  C:\Windows\System\ZVIhRej.exe
  2⤵
  PID:8356
- C:\Windows\System\MQwJkCI.exe
  C:\Windows\System\MQwJkCI.exe
  2⤵
  PID:8380
- C:\Windows\System\QPiYPkI.exe
  C:\Windows\System\QPiYPkI.exe
  2⤵
  PID:8408
- C:\Windows\System\sxYgaNe.exe
  C:\Windows\System\sxYgaNe.exe
  2⤵
  PID:8428
- C:\Windows\System\vVbCFUw.exe
  C:\Windows\System\vVbCFUw.exe
  2⤵
  PID:8516
- C:\Windows\System\aYHBbkO.exe
  C:\Windows\System\aYHBbkO.exe
  2⤵
  PID:8540
- C:\Windows\System\xPinUQo.exe
  C:\Windows\System\xPinUQo.exe
  2⤵
  PID:8560
- C:\Windows\System\hRIMWPZ.exe
  C:\Windows\System\hRIMWPZ.exe
  2⤵
  PID:8580
- C:\Windows\System\FoADNSk.exe
  C:\Windows\System\FoADNSk.exe
  2⤵
  PID:8596
- C:\Windows\System\HtSzBHH.exe
  C:\Windows\System\HtSzBHH.exe
  2⤵
  PID:8616
- C:\Windows\System\bnviBRB.exe
  C:\Windows\System\bnviBRB.exe
  2⤵
  PID:8648
- C:\Windows\System\qAwRQLh.exe
  C:\Windows\System\qAwRQLh.exe
  2⤵
  PID:8668
- C:\Windows\System\QNObuUg.exe
  C:\Windows\System\QNObuUg.exe
  2⤵
  PID:8696
- C:\Windows\System\oPwsXcy.exe
  C:\Windows\System\oPwsXcy.exe
  2⤵
  PID:8724
- C:\Windows\System\uTTEluf.exe
  C:\Windows\System\uTTEluf.exe
  2⤵
  PID:8740
- C:\Windows\System\eSvabfl.exe
  C:\Windows\System\eSvabfl.exe
  2⤵
  PID:8756
- C:\Windows\System\ZcBuKGZ.exe
  C:\Windows\System\ZcBuKGZ.exe
  2⤵
  PID:8772
- C:\Windows\System\aaOqBdU.exe
  C:\Windows\System\aaOqBdU.exe
  2⤵
  PID:8792
- C:\Windows\System\rWaLqjv.exe
  C:\Windows\System\rWaLqjv.exe
  2⤵
  PID:8808
- C:\Windows\System\sVoJatM.exe
  C:\Windows\System\sVoJatM.exe
  2⤵
  PID:8828
- C:\Windows\System\EslnKvY.exe
  C:\Windows\System\EslnKvY.exe
  2⤵
  PID:8844
- C:\Windows\System\YNQkLqx.exe
  C:\Windows\System\YNQkLqx.exe
  2⤵
  PID:8920
- C:\Windows\System\zrBLlRW.exe
  C:\Windows\System\zrBLlRW.exe
  2⤵
  PID:8936
- C:\Windows\System\umBrRmN.exe
  C:\Windows\System\umBrRmN.exe
  2⤵
  PID:8956
- C:\Windows\System\wbDvKPq.exe
  C:\Windows\System\wbDvKPq.exe
  2⤵
  PID:8976
- C:\Windows\System\UsMjroK.exe
  C:\Windows\System\UsMjroK.exe
  2⤵
  PID:8992
- C:\Windows\System\mrMTnZd.exe
  C:\Windows\System\mrMTnZd.exe
  2⤵
  PID:9016
- C:\Windows\System\OToZxql.exe
  C:\Windows\System\OToZxql.exe
  2⤵
  PID:9040
- C:\Windows\System\gkAJfpU.exe
  C:\Windows\System\gkAJfpU.exe
  2⤵
  PID:9064
- C:\Windows\System\vyKSxfY.exe
  C:\Windows\System\vyKSxfY.exe
  2⤵
  PID:9088
- C:\Windows\System\UvqCwpS.exe
  C:\Windows\System\UvqCwpS.exe
  2⤵
  PID:9108
- C:\Windows\System\mLCkfJK.exe
  C:\Windows\System\mLCkfJK.exe
  2⤵
  PID:9208
- C:\Windows\System\auvBMHt.exe
  C:\Windows\System\auvBMHt.exe
  2⤵
  PID:7632
- C:\Windows\System\atIMbvV.exe
  C:\Windows\System\atIMbvV.exe
  2⤵
  PID:7664
- C:\Windows\System\JZKolQe.exe
  C:\Windows\System\JZKolQe.exe
  2⤵
  PID:7716
- C:\Windows\System\VzqWqHC.exe
  C:\Windows\System\VzqWqHC.exe
  2⤵
  PID:7756
- C:\Windows\System\tSqmPcx.exe
  C:\Windows\System\tSqmPcx.exe
  2⤵
  PID:7804
- C:\Windows\System\HEHKtFI.exe
  C:\Windows\System\HEHKtFI.exe
  2⤵
  PID:7896
- C:\Windows\System\pAjTxgI.exe
  C:\Windows\System\pAjTxgI.exe
  2⤵
  PID:8012
- C:\Windows\System\ZKZXtZM.exe
  C:\Windows\System\ZKZXtZM.exe
  2⤵
  PID:8052
- C:\Windows\System\rAFTjRx.exe
  C:\Windows\System\rAFTjRx.exe
  2⤵
  PID:8108
- C:\Windows\System\qGMNnuX.exe
  C:\Windows\System\qGMNnuX.exe
  2⤵
  PID:8164
- C:\Windows\System\fUJfmKY.exe
  C:\Windows\System\fUJfmKY.exe
  2⤵
  PID:4076
- C:\Windows\System\oDFODOY.exe
  C:\Windows\System\oDFODOY.exe
  2⤵
  PID:5156
- C:\Windows\System\SNGbhMJ.exe
  C:\Windows\System\SNGbhMJ.exe
  2⤵
  PID:2028
- C:\Windows\System\Pvcbasr.exe
  C:\Windows\System\Pvcbasr.exe
  2⤵
  PID:3408
- C:\Windows\System\uqUdWrZ.exe
  C:\Windows\System\uqUdWrZ.exe
  2⤵
  PID:7076
- C:\Windows\System\aVINOqN.exe
  C:\Windows\System\aVINOqN.exe
  2⤵
  PID:5600
- C:\Windows\System\ImPXcam.exe
  C:\Windows\System\ImPXcam.exe
  2⤵
  PID:4620
- C:\Windows\System\UHffeAv.exe
  C:\Windows\System\UHffeAv.exe
  2⤵
  PID:6468
- C:\Windows\System\DSDWOOy.exe
  C:\Windows\System\DSDWOOy.exe
  2⤵
  PID:6968
- C:\Windows\System\ghMpgiu.exe
  C:\Windows\System\ghMpgiu.exe
  2⤵
  PID:7232
- C:\Windows\System\zIOskfD.exe
  C:\Windows\System\zIOskfD.exe
  2⤵
  PID:7444
- C:\Windows\System\BKyuMcB.exe
  C:\Windows\System\BKyuMcB.exe
  2⤵
  PID:8044
- C:\Windows\System\yotLlHR.exe
  C:\Windows\System\yotLlHR.exe
  2⤵
  PID:8220
- C:\Windows\System\wOFMYLX.exe
  C:\Windows\System\wOFMYLX.exe
  2⤵
  PID:8280
- C:\Windows\System\dFydupV.exe
  C:\Windows\System\dFydupV.exe
  2⤵
  PID:8348
- C:\Windows\System\XmeEHFH.exe
  C:\Windows\System\XmeEHFH.exe
  2⤵
  PID:8400
- C:\Windows\System\XFFjQDG.exe
  C:\Windows\System\XFFjQDG.exe
  2⤵
  PID:2396
- C:\Windows\System\lsljkYA.exe
  C:\Windows\System\lsljkYA.exe
  2⤵
  PID:8504
- C:\Windows\System\ASydPgE.exe
  C:\Windows\System\ASydPgE.exe
  2⤵
  PID:8608
- C:\Windows\System\yyRcbrY.exe
  C:\Windows\System\yyRcbrY.exe
  2⤵
  PID:8568
- C:\Windows\System\MEypatR.exe
  C:\Windows\System\MEypatR.exe
  2⤵
  PID:8708
- C:\Windows\System\fGQyOvs.exe
  C:\Windows\System\fGQyOvs.exe
  2⤵
  PID:8752
- C:\Windows\System\bbWKKbQ.exe
  C:\Windows\System\bbWKKbQ.exe
  2⤵
  PID:8864
- C:\Windows\System\iQAuMWS.exe
  C:\Windows\System\iQAuMWS.exe
  2⤵
  PID:8784
- C:\Windows\System\oxKyRxt.exe
  C:\Windows\System\oxKyRxt.exe
  2⤵
  PID:9240
- C:\Windows\System\QjTfYnN.exe
  C:\Windows\System\QjTfYnN.exe
  2⤵
  PID:9264
- C:\Windows\System\XeGSSqA.exe
  C:\Windows\System\XeGSSqA.exe
  2⤵
  PID:9280
- C:\Windows\System\RntCxXz.exe
  C:\Windows\System\RntCxXz.exe
  2⤵
  PID:9296
- C:\Windows\System\QxEPOyp.exe
  C:\Windows\System\QxEPOyp.exe
  2⤵
  PID:9312
- C:\Windows\System\sTKkHKo.exe
  C:\Windows\System\sTKkHKo.exe
  2⤵
  PID:9396
- C:\Windows\System\dxDImsH.exe
  C:\Windows\System\dxDImsH.exe
  2⤵
  PID:9424
- C:\Windows\System\ibCadPV.exe
  C:\Windows\System\ibCadPV.exe
  2⤵
  PID:9440
- C:\Windows\System\zaLdZdK.exe
  C:\Windows\System\zaLdZdK.exe
  2⤵
  PID:9460
- C:\Windows\System\bEgQsZZ.exe
  C:\Windows\System\bEgQsZZ.exe
  2⤵
  PID:9492
- C:\Windows\System\tmAMyLF.exe
  C:\Windows\System\tmAMyLF.exe
  2⤵
  PID:9516
- C:\Windows\System\nWnlmCI.exe
  C:\Windows\System\nWnlmCI.exe
  2⤵
  PID:9532
- C:\Windows\System\wlVKaNd.exe
  C:\Windows\System\wlVKaNd.exe
  2⤵
  PID:9556
- C:\Windows\System\LvCRnBZ.exe
  C:\Windows\System\LvCRnBZ.exe
  2⤵
  PID:9588
- C:\Windows\System\DqjPbzO.exe
  C:\Windows\System\DqjPbzO.exe
  2⤵
  PID:9612
- C:\Windows\System\PZLedHQ.exe
  C:\Windows\System\PZLedHQ.exe
  2⤵
  PID:9628
- C:\Windows\System\rpFttbz.exe
  C:\Windows\System\rpFttbz.exe
  2⤵
  PID:9652
- C:\Windows\System\hhFyRXl.exe
  C:\Windows\System\hhFyRXl.exe
  2⤵
  PID:9676
- C:\Windows\System\tpzcdAj.exe
  C:\Windows\System\tpzcdAj.exe
  2⤵
  PID:9700
- C:\Windows\System\NvpBHWe.exe
  C:\Windows\System\NvpBHWe.exe
  2⤵
  PID:9724
- C:\Windows\System\bkaSKZS.exe
  C:\Windows\System\bkaSKZS.exe
  2⤵
  PID:9752
- C:\Windows\System\uduMDfv.exe
  C:\Windows\System\uduMDfv.exe
  2⤵
  PID:10068
- C:\Windows\System\RGtXoQn.exe
  C:\Windows\System\RGtXoQn.exe
  2⤵
  PID:10124
- C:\Windows\System\cGzjdqz.exe
  C:\Windows\System\cGzjdqz.exe
  2⤵
  PID:10144
- C:\Windows\System\DuqmQbc.exe
  C:\Windows\System\DuqmQbc.exe
  2⤵
  PID:10164
- C:\Windows\System\mJJeaMq.exe
  C:\Windows\System\mJJeaMq.exe
  2⤵
  PID:10184
- C:\Windows\System\jSWACol.exe
  C:\Windows\System\jSWACol.exe
  2⤵
  PID:10204
- C:\Windows\System\kigXcXK.exe
  C:\Windows\System\kigXcXK.exe
  2⤵
  PID:10224
- C:\Windows\System\XLimhUC.exe
  C:\Windows\System\XLimhUC.exe
  2⤵
  PID:8928
- C:\Windows\System\jULTYZU.exe
  C:\Windows\System\jULTYZU.exe
  2⤵
  PID:8984
- C:\Windows\System\mkAWAZe.exe
  C:\Windows\System\mkAWAZe.exe
  2⤵
  PID:9036
- C:\Windows\System\hFQWSxY.exe
  C:\Windows\System\hFQWSxY.exe
  2⤵
  PID:9072
- C:\Windows\System\tiimLdD.exe
  C:\Windows\System\tiimLdD.exe
  2⤵
  PID:9152
- C:\Windows\System\hzHvgFT.exe
  C:\Windows\System\hzHvgFT.exe
  2⤵
  PID:8548
- C:\Windows\System\xSvCuqy.exe
  C:\Windows\System\xSvCuqy.exe
  2⤵
  PID:7080
- C:\Windows\System\oTBgVly.exe
  C:\Windows\System\oTBgVly.exe
  2⤵
  PID:9308
- C:\Windows\System\ZJAsqDW.exe
  C:\Windows\System\ZJAsqDW.exe
  2⤵
  PID:7652
- C:\Windows\System\hfinPLz.exe
  C:\Windows\System\hfinPLz.exe
  2⤵
  PID:2752
- C:\Windows\System\yvjXxeu.exe
  C:\Windows\System\yvjXxeu.exe
  2⤵
  PID:7820
- C:\Windows\System\SbzrMKB.exe
  C:\Windows\System\SbzrMKB.exe
  2⤵
  PID:3648
- C:\Windows\System\xtLgKXL.exe
  C:\Windows\System\xtLgKXL.exe
  2⤵
  PID:8684
- C:\Windows\System\TblpWxE.exe
  C:\Windows\System\TblpWxE.exe
  2⤵
  PID:8888
- C:\Windows\System\pvBllZs.exe
  C:\Windows\System\pvBllZs.exe
  2⤵
  PID:9256
- C:\Windows\System\BVgCdEg.exe
  C:\Windows\System\BVgCdEg.exe
  2⤵
  PID:9392
- C:\Windows\System\MaAyHhN.exe
  C:\Windows\System\MaAyHhN.exe
  2⤵
  PID:9508
- C:\Windows\System\JbvBuCT.exe
  C:\Windows\System\JbvBuCT.exe
  2⤵
  PID:9552
- C:\Windows\System\vRxdoAo.exe
  C:\Windows\System\vRxdoAo.exe
  2⤵
  PID:9636
- C:\Windows\System\ALZFmcM.exe
  C:\Windows\System\ALZFmcM.exe
  2⤵
  PID:9696
- C:\Windows\System\oDVoGde.exe
  C:\Windows\System\oDVoGde.exe
  2⤵
  PID:9740
- C:\Windows\System\hfHcfci.exe
  C:\Windows\System\hfHcfci.exe
  2⤵
  PID:9788
- C:\Windows\System\cNupktL.exe
  C:\Windows\System\cNupktL.exe
  2⤵
  PID:4456
- C:\Windows\System\HATsuqj.exe
  C:\Windows\System\HATsuqj.exe
  2⤵
  PID:3496
- C:\Windows\System\jxRLQnG.exe
  C:\Windows\System\jxRLQnG.exe
  2⤵
  PID:964
- C:\Windows\System\BQINvJB.exe
  C:\Windows\System\BQINvJB.exe
  2⤵
  PID:4552
- C:\Windows\System\ZiqMRGg.exe
  C:\Windows\System\ZiqMRGg.exe
  2⤵
  PID:2916
- C:\Windows\System\YkXjKQE.exe
  C:\Windows\System\YkXjKQE.exe
  2⤵
  PID:2652
- C:\Windows\System\eRIEMHe.exe
  C:\Windows\System\eRIEMHe.exe
  2⤵
  PID:4972
- C:\Windows\System\bBuULKW.exe
  C:\Windows\System\bBuULKW.exe
  2⤵
  PID:1212
- C:\Windows\System\ZWxhhaz.exe
  C:\Windows\System\ZWxhhaz.exe
  2⤵
  PID:4952
- C:\Windows\System\OAdbNyh.exe
  C:\Windows\System\OAdbNyh.exe
  2⤵
  PID:224
- C:\Windows\System\iSEQoDg.exe
  C:\Windows\System\iSEQoDg.exe
  2⤵
  PID:6352
- C:\Windows\System\bkhPSNw.exe
  C:\Windows\System\bkhPSNw.exe
  2⤵
  PID:6832
- C:\Windows\System\MgnTICR.exe
  C:\Windows\System\MgnTICR.exe
  2⤵
  PID:10088
- C:\Windows\System\chlVDug.exe
  C:\Windows\System\chlVDug.exe
  2⤵
  PID:10040
- C:\Windows\System\oZlTFRh.exe
  C:\Windows\System\oZlTFRh.exe
  2⤵
  PID:10036
- C:\Windows\System\bKdrCkV.exe
  C:\Windows\System\bKdrCkV.exe
  2⤵
  PID:10152
- C:\Windows\System\ctCyKkx.exe
  C:\Windows\System\ctCyKkx.exe
  2⤵
  PID:10192
- C:\Windows\System\nBvcfwW.exe
  C:\Windows\System\nBvcfwW.exe
  2⤵
  PID:8732
- C:\Windows\System\YOpEdmX.exe
  C:\Windows\System\YOpEdmX.exe
  2⤵
  PID:7680
- C:\Windows\System\MkaYmMW.exe
  C:\Windows\System\MkaYmMW.exe
  2⤵
  PID:8000
- C:\Windows\System\jirDwLr.exe
  C:\Windows\System\jirDwLr.exe
  2⤵
  PID:10116
- C:\Windows\System\OrgsXfr.exe
  C:\Windows\System\OrgsXfr.exe
  2⤵
  PID:8916
- C:\Windows\System\AkFkcEe.exe
  C:\Windows\System\AkFkcEe.exe
  2⤵
  PID:9012
- C:\Windows\System\vRIkxdq.exe
  C:\Windows\System\vRIkxdq.exe
  2⤵
  PID:9096
- C:\Windows\System\qNAcZOB.exe
  C:\Windows\System\qNAcZOB.exe
  2⤵
  PID:7700
- C:\Windows\System\IaFXaxg.exe
  C:\Windows\System\IaFXaxg.exe
  2⤵
  PID:8104
- C:\Windows\System\JKbBXCU.exe
  C:\Windows\System\JKbBXCU.exe
  2⤵
  PID:8820
- C:\Windows\System\VyPHyXU.exe
  C:\Windows\System\VyPHyXU.exe
  2⤵
  PID:8424
- C:\Windows\System\Uxdyhlh.exe
  C:\Windows\System\Uxdyhlh.exe
  2⤵
  PID:9500
- C:\Windows\System\meGRoFT.exe
  C:\Windows\System\meGRoFT.exe
  2⤵
  PID:8244
- C:\Windows\System\BZCvfie.exe
  C:\Windows\System\BZCvfie.exe
  2⤵
  PID:4640
- C:\Windows\System\FZKoxQn.exe
  C:\Windows\System\FZKoxQn.exe
  2⤵
  PID:9248
- C:\Windows\System\eVZEKVW.exe
  C:\Windows\System\eVZEKVW.exe
  2⤵
  PID:4496
- C:\Windows\System\QMxLjcE.exe
  C:\Windows\System\QMxLjcE.exe
  2⤵
  PID:5036
- C:\Windows\System\llanvnc.exe
  C:\Windows\System\llanvnc.exe
  2⤵
  PID:6348
- C:\Windows\System\nCkdcMp.exe
  C:\Windows\System\nCkdcMp.exe
  2⤵
  PID:10028
- C:\Windows\System\oBGIrIC.exe
  C:\Windows\System\oBGIrIC.exe
  2⤵
  PID:4636
- C:\Windows\System\FjfmZtk.exe
  C:\Windows\System\FjfmZtk.exe
  2⤵
  PID:10200
- C:\Windows\System\gDqdMEy.exe
  C:\Windows\System\gDqdMEy.exe
  2⤵
  PID:7604
- C:\Windows\System\SaOnLnZ.exe
  C:\Windows\System\SaOnLnZ.exe
  2⤵
  PID:6940
- C:\Windows\System\DbVVwkl.exe
  C:\Windows\System\DbVVwkl.exe
  2⤵
  PID:1164
- C:\Windows\System\MCexrde.exe
  C:\Windows\System\MCexrde.exe
  2⤵
  PID:8840
- C:\Windows\System\ZGGggGo.exe
  C:\Windows\System\ZGGggGo.exe
  2⤵
  PID:10140
- C:\Windows\System\ZCMtQlN.exe
  C:\Windows\System\ZCMtQlN.exe
  2⤵
  PID:3368
- C:\Windows\System\wJZgAtl.exe
  C:\Windows\System\wJZgAtl.exe
  2⤵
  PID:10260
- C:\Windows\System\KQnLcLk.exe
  C:\Windows\System\KQnLcLk.exe
  2⤵
  PID:10292
- C:\Windows\System\RxruRSw.exe
  C:\Windows\System\RxruRSw.exe
  2⤵
  PID:10320
- C:\Windows\System\zrPVywa.exe
  C:\Windows\System\zrPVywa.exe
  2⤵
  PID:10340
- C:\Windows\System\KAORWIK.exe
  C:\Windows\System\KAORWIK.exe
  2⤵
  PID:10360
- C:\Windows\System\jiuTyDK.exe
  C:\Windows\System\jiuTyDK.exe
  2⤵
  PID:10380
- C:\Windows\System\PvtOvsl.exe
  C:\Windows\System\PvtOvsl.exe
  2⤵
  PID:10400
- C:\Windows\System\FLhanxd.exe
  C:\Windows\System\FLhanxd.exe
  2⤵
  PID:10424
- C:\Windows\System\oechPIh.exe
  C:\Windows\System\oechPIh.exe
  2⤵
  PID:10444
- C:\Windows\System\CqrhsGX.exe
  C:\Windows\System\CqrhsGX.exe
  2⤵
  PID:10468
- C:\Windows\System\xnWMgIN.exe
  C:\Windows\System\xnWMgIN.exe
  2⤵
  PID:10488
- C:\Windows\System\zgoKOmj.exe
  C:\Windows\System\zgoKOmj.exe
  2⤵
  PID:10512
- C:\Windows\System\dMuXrvO.exe
  C:\Windows\System\dMuXrvO.exe
  2⤵
  PID:10532
- C:\Windows\System\JjUCCTu.exe
  C:\Windows\System\JjUCCTu.exe
  2⤵
  PID:10552
- C:\Windows\System\QhkvdRX.exe
  C:\Windows\System\QhkvdRX.exe
  2⤵
  PID:10576
- C:\Windows\System\tnIFADw.exe
  C:\Windows\System\tnIFADw.exe
  2⤵
  PID:10600
- C:\Windows\System\VMLJQbI.exe
  C:\Windows\System\VMLJQbI.exe
  2⤵
  PID:10624
- C:\Windows\System\EFFKRoN.exe
  C:\Windows\System\EFFKRoN.exe
  2⤵
  PID:10648
- C:\Windows\System\FTRRhFF.exe
  C:\Windows\System\FTRRhFF.exe
  2⤵
  PID:10672
- C:\Windows\System\gVFpbof.exe
  C:\Windows\System\gVFpbof.exe
  2⤵
  PID:10688
- C:\Windows\System\uokRCKq.exe
  C:\Windows\System\uokRCKq.exe
  2⤵
  PID:10712
- C:\Windows\System\EVQacJy.exe
  C:\Windows\System\EVQacJy.exe
  2⤵
  PID:10740
- C:\Windows\System\jSlADqA.exe
  C:\Windows\System\jSlADqA.exe
  2⤵
  PID:10764
- C:\Windows\System\igmppSG.exe
  C:\Windows\System\igmppSG.exe
  2⤵
  PID:10788
- C:\Windows\System\koZUsZC.exe
  C:\Windows\System\koZUsZC.exe
  2⤵
  PID:10816
- C:\Windows\System\ZzmqjbN.exe
  C:\Windows\System\ZzmqjbN.exe
  2⤵
  PID:10840
- C:\Windows\System\FXEYHCC.exe
  C:\Windows\System\FXEYHCC.exe
  2⤵
  PID:10864
- C:\Windows\System\TPmCTLh.exe
  C:\Windows\System\TPmCTLh.exe
  2⤵
  PID:10888
- C:\Windows\System\gYaIOrl.exe
  C:\Windows\System\gYaIOrl.exe
  2⤵
  PID:10912
- C:\Windows\System\qdoYtPU.exe
  C:\Windows\System\qdoYtPU.exe
  2⤵
  PID:10936
- C:\Windows\System\ncRIfcw.exe
  C:\Windows\System\ncRIfcw.exe
  2⤵
  PID:10960
- C:\Windows\System\HrMeJjr.exe
  C:\Windows\System\HrMeJjr.exe
  2⤵
  PID:10980
- C:\Windows\System\HaPuzjB.exe
  C:\Windows\System\HaPuzjB.exe
  2⤵
  PID:11000
- C:\Windows\System\LVwogih.exe
  C:\Windows\System\LVwogih.exe
  2⤵
  PID:11028
- C:\Windows\System\hvtPHmy.exe
  C:\Windows\System\hvtPHmy.exe
  2⤵
  PID:11048
- C:\Windows\System\RoIUlau.exe
  C:\Windows\System\RoIUlau.exe
  2⤵
  PID:11068
- C:\Windows\System\tLsFciw.exe
  C:\Windows\System\tLsFciw.exe
  2⤵
  PID:11092
- C:\Windows\System\LMMcKnH.exe
  C:\Windows\System\LMMcKnH.exe
  2⤵
  PID:11120
- C:\Windows\System\oQiPQgn.exe
  C:\Windows\System\oQiPQgn.exe
  2⤵
  PID:11144
- C:\Windows\System\gbYnwKN.exe
  C:\Windows\System\gbYnwKN.exe
  2⤵
  PID:11160
- C:\Windows\System\YfBPWBR.exe
  C:\Windows\System\YfBPWBR.exe
  2⤵
  PID:11180
- C:\Windows\System\StPuBzN.exe
  C:\Windows\System\StPuBzN.exe
  2⤵
  PID:11204
- C:\Windows\System\WTJZmcy.exe
  C:\Windows\System\WTJZmcy.exe
  2⤵
  PID:11224
- C:\Windows\System\lVburfl.exe
  C:\Windows\System\lVburfl.exe
  2⤵
  PID:11244
- C:\Windows\System\JXCTjqh.exe
  C:\Windows\System\JXCTjqh.exe
  2⤵
  PID:11260
- C:\Windows\System\MeSmbOB.exe
  C:\Windows\System\MeSmbOB.exe
  2⤵
  PID:4808
- C:\Windows\System\EIgVdep.exe
  C:\Windows\System\EIgVdep.exe
  2⤵
  PID:10004
- C:\Windows\System\nXJMYhL.exe
  C:\Windows\System\nXJMYhL.exe
  2⤵
  PID:7796
- C:\Windows\System\XYLKQiO.exe
  C:\Windows\System\XYLKQiO.exe
  2⤵
  PID:7876
- C:\Windows\System\YhCIObW.exe
  C:\Windows\System\YhCIObW.exe
  2⤵
  PID:9540
- C:\Windows\System\jIVgfyF.exe
  C:\Windows\System\jIVgfyF.exe
  2⤵
  PID:10276
- C:\Windows\System\numrRoM.exe
  C:\Windows\System\numrRoM.exe
  2⤵
  PID:10356
- C:\Windows\System\oPlIBGd.exe
  C:\Windows\System\oPlIBGd.exe
  2⤵
  PID:10436
- C:\Windows\System\COClsNo.exe
  C:\Windows\System\COClsNo.exe
  2⤵
  PID:10160
- C:\Windows\System\mWVAYSP.exe
  C:\Windows\System\mWVAYSP.exe
  2⤵
  PID:9000
- C:\Windows\System\ZNEkrGG.exe
  C:\Windows\System\ZNEkrGG.exe
  2⤵
  PID:868
- C:\Windows\System\NlCKaLC.exe
  C:\Windows\System\NlCKaLC.exe
  2⤵
  PID:10728
- C:\Windows\System\PJsEQkp.exe
  C:\Windows\System\PJsEQkp.exe
  2⤵
  PID:10780
- C:\Windows\System\SefSKao.exe
  C:\Windows\System\SefSKao.exe
  2⤵
  PID:10408
- C:\Windows\System\AImiRRO.exe
  C:\Windows\System\AImiRRO.exe
  2⤵
  PID:10452
- C:\Windows\System\fmTOUvZ.exe
  C:\Windows\System\fmTOUvZ.exe
  2⤵
  PID:8572
- C:\Windows\System\vuIQzpr.exe
  C:\Windows\System\vuIQzpr.exe
  2⤵
  PID:10996
- C:\Windows\System\tCNaHWD.exe
  C:\Windows\System\tCNaHWD.exe
  2⤵
  PID:11108
- C:\Windows\System\DzEyORq.exe
  C:\Windows\System\DzEyORq.exe
  2⤵
  PID:11152
- C:\Windows\System\hvVoxjR.exe
  C:\Windows\System\hvVoxjR.exe
  2⤵
  PID:11196
- C:\Windows\System\bcSUsdW.exe
  C:\Windows\System\bcSUsdW.exe
  2⤵
  PID:10256
- C:\Windows\System\aHeSELI.exe
  C:\Windows\System\aHeSELI.exe
  2⤵
  PID:11284
- C:\Windows\System\oATVumK.exe
  C:\Windows\System\oATVumK.exe
  2⤵
  PID:11312
- C:\Windows\System\TNTASel.exe
  C:\Windows\System\TNTASel.exe
  2⤵
  PID:11336
- C:\Windows\System\YsHnjjr.exe
  C:\Windows\System\YsHnjjr.exe
  2⤵
  PID:11356
- C:\Windows\System\chKYVLS.exe
  C:\Windows\System\chKYVLS.exe
  2⤵
  PID:11384
- C:\Windows\System\hAexOYX.exe
  C:\Windows\System\hAexOYX.exe
  2⤵
  PID:11412
- C:\Windows\System\kuEXJlS.exe
  C:\Windows\System\kuEXJlS.exe
  2⤵
  PID:11432
- C:\Windows\System\DjtiWGZ.exe
  C:\Windows\System\DjtiWGZ.exe
  2⤵
  PID:11460
- C:\Windows\System\hIKrNen.exe
  C:\Windows\System\hIKrNen.exe
  2⤵
  PID:11484
- C:\Windows\System\HVkgeZP.exe
  C:\Windows\System\HVkgeZP.exe
  2⤵
  PID:11516
- C:\Windows\System\ivpbQIQ.exe
  C:\Windows\System\ivpbQIQ.exe
  2⤵
  PID:11544
- C:\Windows\System\olTQbjK.exe
  C:\Windows\System\olTQbjK.exe
  2⤵
  PID:11568
- C:\Windows\System\bFLCjbr.exe
  C:\Windows\System\bFLCjbr.exe
  2⤵
  PID:11592
- C:\Windows\System\uFPACLZ.exe
  C:\Windows\System\uFPACLZ.exe
  2⤵
  PID:11616
- C:\Windows\System\qDktdNm.exe
  C:\Windows\System\qDktdNm.exe
  2⤵
  PID:11636
- C:\Windows\System\etOKmkq.exe
  C:\Windows\System\etOKmkq.exe
  2⤵
  PID:11656
- C:\Windows\System\IxeWqlY.exe
  C:\Windows\System\IxeWqlY.exe
  2⤵
  PID:11676
- C:\Windows\System\SUzHvOy.exe
  C:\Windows\System\SUzHvOy.exe
  2⤵
  PID:11700
- C:\Windows\System\MhvdTrU.exe
  C:\Windows\System\MhvdTrU.exe
  2⤵
  PID:11720
- C:\Windows\System\zvMJIPL.exe
  C:\Windows\System\zvMJIPL.exe
  2⤵
  PID:11740
- C:\Windows\System\yzYnbfM.exe
  C:\Windows\System\yzYnbfM.exe
  2⤵
  PID:11772
- C:\Windows\System\YmAfaQb.exe
  C:\Windows\System\YmAfaQb.exe
  2⤵
  PID:11788
- C:\Windows\System\FdjNPuN.exe
  C:\Windows\System\FdjNPuN.exe
  2⤵
  PID:11812
- C:\Windows\System\LFCQMSp.exe
  C:\Windows\System\LFCQMSp.exe
  2⤵
  PID:11836
- C:\Windows\System\STSPhKO.exe
  C:\Windows\System\STSPhKO.exe
  2⤵
  PID:11852
- C:\Windows\System\DpmFrxL.exe
  C:\Windows\System\DpmFrxL.exe
  2⤵
  PID:11872
- C:\Windows\System\CUUfexL.exe
  C:\Windows\System\CUUfexL.exe
  2⤵
  PID:11900
- C:\Windows\System\TIceZis.exe
  C:\Windows\System\TIceZis.exe
  2⤵
  PID:11920
- C:\Windows\System\bVWFObD.exe
  C:\Windows\System\bVWFObD.exe
  2⤵
  PID:11944
- C:\Windows\System\rtIVXNZ.exe
  C:\Windows\System\rtIVXNZ.exe
  2⤵
  PID:11968
- C:\Windows\System\ZhTSqWG.exe
  C:\Windows\System\ZhTSqWG.exe
  2⤵
  PID:11984
- C:\Windows\System\uShGsiN.exe
  C:\Windows\System\uShGsiN.exe
  2⤵
  PID:12008
- C:\Windows\System\KvTGgDm.exe
  C:\Windows\System\KvTGgDm.exe
  2⤵
  PID:12028
- C:\Windows\System\xnSWgnK.exe
  C:\Windows\System\xnSWgnK.exe
  2⤵
  PID:12044
- C:\Windows\System\WXHXEdU.exe
  C:\Windows\System\WXHXEdU.exe
  2⤵
  PID:12060
- C:\Windows\System\CXpshMd.exe
  C:\Windows\System\CXpshMd.exe
  2⤵
  PID:12076
- C:\Windows\System\yaeeoNR.exe
  C:\Windows\System\yaeeoNR.exe
  2⤵
  PID:12096
- C:\Windows\System\tPHwcFi.exe
  C:\Windows\System\tPHwcFi.exe
  2⤵
  PID:12112
- C:\Windows\System\YRopdgs.exe
  C:\Windows\System\YRopdgs.exe
  2⤵
  PID:12128
- C:\Windows\System\shQmgXL.exe
  C:\Windows\System\shQmgXL.exe
  2⤵
  PID:12148
- C:\Windows\System\cJuOuvS.exe
  C:\Windows\System\cJuOuvS.exe
  2⤵
  PID:12172
- C:\Windows\System\qSKYFDO.exe
  C:\Windows\System\qSKYFDO.exe
  2⤵
  PID:12192
- C:\Windows\System\ETWpXhF.exe
  C:\Windows\System\ETWpXhF.exe
  2⤵
  PID:12216
- C:\Windows\System\uubyUiz.exe
  C:\Windows\System\uubyUiz.exe
  2⤵
  PID:12236
- C:\Windows\System\PixDjPo.exe
  C:\Windows\System\PixDjPo.exe
  2⤵
  PID:12264
- C:\Windows\System\unMEJfV.exe
  C:\Windows\System\unMEJfV.exe
  2⤵
  PID:11240
- C:\Windows\System\xvsjLwt.exe
  C:\Windows\System\xvsjLwt.exe
  2⤵
  PID:3984
- C:\Windows\System\ceoOLBp.exe
  C:\Windows\System\ceoOLBp.exe
  2⤵
  PID:10504
- C:\Windows\System\BVFEWqc.exe
  C:\Windows\System\BVFEWqc.exe
  2⤵
  PID:10976
- C:\Windows\System\kfmXlhl.exe
  C:\Windows\System\kfmXlhl.exe
  2⤵
  PID:11020
- C:\Windows\System\nsLzAMH.exe
  C:\Windows\System\nsLzAMH.exe
  2⤵
  PID:10616
- C:\Windows\System\fotlyLu.exe
  C:\Windows\System\fotlyLu.exe
  2⤵
  PID:10176
- C:\Windows\System\ejNPnsI.exe
  C:\Windows\System\ejNPnsI.exe
  2⤵
  PID:5040
- C:\Windows\System\fbefxHb.exe
  C:\Windows\System\fbefxHb.exe
  2⤵
  PID:10968
- C:\Windows\System\CATSTzQ.exe
  C:\Windows\System\CATSTzQ.exe
  2⤵
  PID:11212
- C:\Windows\System\dmktavR.exe
  C:\Windows\System\dmktavR.exe
  2⤵
  PID:11296
- C:\Windows\System\wbdrznl.exe
  C:\Windows\System\wbdrznl.exe
  2⤵
  PID:10752
- C:\Windows\System\ACqJIkI.exe
  C:\Windows\System\ACqJIkI.exe
  2⤵
  PID:3428
- C:\Windows\System\sgBWvTt.exe
  C:\Windows\System\sgBWvTt.exe
  2⤵
  PID:10860
- C:\Windows\System\QWRszHa.exe
  C:\Windows\System\QWRszHa.exe
  2⤵
  PID:11468
- C:\Windows\System\AykiirU.exe
  C:\Windows\System\AykiirU.exe
  2⤵
  PID:1496
- C:\Windows\System\qSZyXCG.exe
  C:\Windows\System\qSZyXCG.exe
  2⤵
  PID:11560
- C:\Windows\System\YOpMWfj.exe
  C:\Windows\System\YOpMWfj.exe
  2⤵
  PID:11060
- C:\Windows\System\cHMvrcV.exe
  C:\Windows\System\cHMvrcV.exe
  2⤵
  PID:11100
- C:\Windows\System\MiXQvvP.exe
  C:\Windows\System\MiXQvvP.exe
  2⤵
  PID:12292
- C:\Windows\System\AZnNROY.exe
  C:\Windows\System\AZnNROY.exe
  2⤵
  PID:12316
- C:\Windows\System\lkVdIRI.exe
  C:\Windows\System\lkVdIRI.exe
  2⤵
  PID:12340
- C:\Windows\System\IDEsVxi.exe
  C:\Windows\System\IDEsVxi.exe
  2⤵
  PID:12360
- C:\Windows\System\zresXtU.exe
  C:\Windows\System\zresXtU.exe
  2⤵
  PID:12384
- C:\Windows\System\LwIOAqx.exe
  C:\Windows\System\LwIOAqx.exe
  2⤵
  PID:12408
- C:\Windows\System\LJMfhjw.exe
  C:\Windows\System\LJMfhjw.exe
  2⤵
  PID:12428
- C:\Windows\System\gKZKnCm.exe
  C:\Windows\System\gKZKnCm.exe
  2⤵
  PID:12448
- C:\Windows\System\tDEWlYs.exe
  C:\Windows\System\tDEWlYs.exe
  2⤵
  PID:12468
- C:\Windows\System\ZiGzeqY.exe
  C:\Windows\System\ZiGzeqY.exe
  2⤵
  PID:12488
- C:\Windows\System\jTdroWl.exe
  C:\Windows\System\jTdroWl.exe
  2⤵
  PID:12504
- C:\Windows\System\arabYyU.exe
  C:\Windows\System\arabYyU.exe
  2⤵
  PID:12528
- C:\Windows\System\UdmaBsw.exe
  C:\Windows\System\UdmaBsw.exe
  2⤵
  PID:12548
- C:\Windows\System\HhcGhrF.exe
  C:\Windows\System\HhcGhrF.exe
  2⤵
  PID:12568
- C:\Windows\System\BGBjPIJ.exe
  C:\Windows\System\BGBjPIJ.exe
  2⤵
  PID:12596
- C:\Windows\System\XXAmxdC.exe
  C:\Windows\System\XXAmxdC.exe
  2⤵
  PID:12620
- C:\Windows\System\PcVFfZH.exe
  C:\Windows\System\PcVFfZH.exe
  2⤵
  PID:12644
- C:\Windows\System\aexFAjW.exe
  C:\Windows\System\aexFAjW.exe
  2⤵
  PID:12664
- C:\Windows\System\AkjTDUC.exe
  C:\Windows\System\AkjTDUC.exe
  2⤵
  PID:12684
- C:\Windows\System\NVbeECN.exe
  C:\Windows\System\NVbeECN.exe
  2⤵
  PID:12700
- C:\Windows\System\jsPGXCi.exe
  C:\Windows\System\jsPGXCi.exe
  2⤵
  PID:12720
- C:\Windows\System\qHRadpk.exe
  C:\Windows\System\qHRadpk.exe
  2⤵
  PID:12744
- C:\Windows\System\UKVHExC.exe
  C:\Windows\System\UKVHExC.exe
  2⤵
  PID:12772
- C:\Windows\System\elJBGFN.exe
  C:\Windows\System\elJBGFN.exe
  2⤵
  PID:12796
- C:\Windows\System\KCNhZul.exe
  C:\Windows\System\KCNhZul.exe
  2⤵
  PID:12816
- C:\Windows\System\cDiVkKe.exe
  C:\Windows\System\cDiVkKe.exe
  2⤵
  PID:12836
- C:\Windows\System\yCDAwuc.exe
  C:\Windows\System\yCDAwuc.exe
  2⤵
  PID:12864
- C:\Windows\System\ACGpiLO.exe
  C:\Windows\System\ACGpiLO.exe
  2⤵
  PID:12884
- C:\Windows\System\dLHrqEy.exe
  C:\Windows\System\dLHrqEy.exe
  2⤵
  PID:12908
- C:\Windows\System\ARmzzzY.exe
  C:\Windows\System\ARmzzzY.exe
  2⤵
  PID:12932
- C:\Windows\System\mXDXJTY.exe
  C:\Windows\System\mXDXJTY.exe
  2⤵
  PID:12948
- C:\Windows\System\OibTmDu.exe
  C:\Windows\System\OibTmDu.exe
  2⤵
  PID:12964
- C:\Windows\System\oyecowN.exe
  C:\Windows\System\oyecowN.exe
  2⤵
  PID:12980
- C:\Windows\System\sFrdJWv.exe
  C:\Windows\System\sFrdJWv.exe
  2⤵
  PID:12996
- C:\Windows\System\ssdUczH.exe
  C:\Windows\System\ssdUczH.exe
  2⤵
  PID:13012
- C:\Windows\System\TuxOBHx.exe
  C:\Windows\System\TuxOBHx.exe
  2⤵
  PID:13032
- C:\Windows\System\ThyDJLk.exe
  C:\Windows\System\ThyDJLk.exe
  2⤵
  PID:13048
- C:\Windows\System\yOcFLsE.exe
  C:\Windows\System\yOcFLsE.exe
  2⤵
  PID:13064
- C:\Windows\System\WaWfled.exe
  C:\Windows\System\WaWfled.exe
  2⤵
  PID:13080
- C:\Windows\System\FzvCPLk.exe
  C:\Windows\System\FzvCPLk.exe
  2⤵
  PID:13104
- C:\Windows\System\vxVOpPt.exe
  C:\Windows\System\vxVOpPt.exe
  2⤵
  PID:13120
- C:\Windows\System\trFrgyJ.exe
  C:\Windows\System\trFrgyJ.exe
  2⤵
  PID:13140
- C:\Windows\System\kwTOuBg.exe
  C:\Windows\System\kwTOuBg.exe
  2⤵
  PID:10932
- C:\Windows\System\EoIfBrM.exe
  C:\Windows\System\EoIfBrM.exe
  2⤵
  PID:10584
- C:\Windows\System\mSbjVdT.exe
  C:\Windows\System\mSbjVdT.exe
  2⤵
  PID:11652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3wbtnnmh.ipg.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AfJERWG.exe

Filesize
2.1MB

MD5
c9492730d33989823413f0ad7b2aeca7

SHA1
553b50b681b9aef1dc54c7ccba048b84e41afa8b

SHA256
6fe383a5b2094d7ccb292f69d64280384fb589df17418442cda3a6c1da60fd27

SHA512
69e7a9d035cc7d7ccf1af57b4a326d9406986df704f9cbf4ec4ffd5526a9fbd4772f3b0f1499b0b786f02e1bb93ea28862972ee195ca8a5a74c4be0e2e1a9b5a

Download Submit
C:\Windows\System\BHKtxSM.exe

Filesize
2.1MB

MD5
c01a8c11a5ae7d9086741e95eb97ad50

SHA1
1d0506b2fb414128dac5c097c172e8e6e9aa2d16

SHA256
fcb65595feafd1caf18336b4103618ec9031236474ab7c70c3dd23a0caadd0b7

SHA512
fa810ebf37aab03c8810b18549a279df33f4146a9b4a3baf31c9b24fcf38b4750281ae8c9040d69589eb9a448b588e349cd2d6e8c2f469f37203b6d52e58f91e

Download Submit
C:\Windows\System\EfnJohm.exe

Filesize
2.1MB

MD5
dc27e77abd911f66b306e0d8a6f7a30f

SHA1
4254b879d0c0bbf3a236f1bbae9f3d957aecde03

SHA256
a4a3deaf6fcae304aaf1e5b7928a7928197ef79be669516c72c9b0a35719d9dd

SHA512
ce627e613a3e7e6aeb0cfce6cc7cca23a6a93a33444e8d671f1175eefb550518de8d4a5f84e32ea69d3ae82a0035b83d0b5f643731c9322df1281de81d8fb14e

Download Submit
C:\Windows\System\ExKtswE.exe

Filesize
2.1MB

MD5
acf1b7226e712e746ffe81516bcf80d6

SHA1
4071c266784e7bcbce223464aef0024e9e6f653e

SHA256
af06c719956363a7040597752b9e1d17265eb98498e991c56d06a9ec722d617b

SHA512
f1615f320fba76abfa8545c7e8d3f1205be346a8ef0fe2d7b3f796653fd7a49c2a00195ef6cec8681358f0755d7337dbc86e03eeb3fefe3e6094d486b1dbfc54

Download Submit
C:\Windows\System\FvMgFKU.exe

Filesize
2.1MB

MD5
6d87d87b63acd536e678a447c1c90ad2

SHA1
03b6cd73b833bbe034e73783acc821e29b17f828

SHA256
6624dafe8acffd974bd631b1a561f3c61a12511d72f50752be3f79b06c650aec

SHA512
3da94d7537ab17a2fa5189e62d57d6eed979643c704481dbb6f123681651ad270b25c49dbc42ec171be4a9a11011422d693052faf1522e894b6d30b8539dc5eb

Download Submit
C:\Windows\System\GXqHFgh.exe

Filesize
2.1MB

MD5
bf07bdd7755e19375f432a2221e309d9

SHA1
c9c5a6d28fc3526e964f042c479afd958ef91c7c

SHA256
6f1bd55138111fe8ca32de4d653a5361ca423a1cdbd42a9abbb2b66931b5ffbb

SHA512
b898abb044ccbabe6aaf053ec44804ad6ec4e683a658a4f78c78ef00fc8503131fe0c8535100f36e24b7919b08f0394a1c0476d2a3662c2780ee6380223157dc

Download Submit
C:\Windows\System\GbzbWEn.exe

Filesize
2.1MB

MD5
815f72e299eec22aabe53e546d285f56

SHA1
c12dc71a1911649d54ddbc65d88528e856a3c296

SHA256
5860833cb8d5ff1f6eaa6d3fee8be113e6e0e3b1909aa1cfa1c570579c1f66db

SHA512
0ca6502aa06cbe4a12e7d1297fe53660ee69928f31699f0ebfdf0e64a453d85c0793ff05027c7bbb11f5218575c4152436363e2c366781d53de71b3c226aa41d

Download Submit
C:\Windows\System\IrXczCi.exe

Filesize
2.1MB

MD5
968ad187d1d72ac0d019a9add4d9ec97

SHA1
57a77c7afa2eebdef7de61b8480bd7ae9604a702

SHA256
39121c63d4d5917c4ebeb4212ba7c6a3bcf96ed02d63d81ecc2ddb373475f82a

SHA512
a14a3639bd3a0c9923dae7869da4ee8530e12f05692b61846285bb328341db933ab3406240f079dc71921dd60e3b78676b0657131f761df01a6c8d16fa5bbb16

Download Submit
C:\Windows\System\KVFVFOt.exe

Filesize
2.1MB

MD5
a6e201f9376ff4662baa6a944501104e

SHA1
4355287fc2c9f38484722a9b5cbcb66ba273c4b9

SHA256
18f15c6981c166e14e2a9ad54c2120cd9a831240a2969aaaafc2b13a17dbd276

SHA512
364a3487aaf57caa6fcb31dba4ccbf4f27b468ab4f49b9874591d5564688d566cb68260850f84c045d15be6d027d209d01dd8d6057408fffa7f612f2059cf0ba

Download Submit
C:\Windows\System\MKAlBNR.exe

Filesize
2.1MB

MD5
1ff41b8441fcac8b5d1a7b96c3db8d35

SHA1
a58855535373acdbf1cc712f6cd0c6f62fba7ae3

SHA256
50effaf4c6f454156b3c18cb485355f41b7b65f9eca9cf5b0661ea27ca62f298

SHA512
a107059318d286212d2cb93eecebd056d3e9e682d8d95a063da25ae1ef02b79fa636d3ffc659efafed858202f506adba1774ea399cdfec6da8fb59342e4c3032

Download Submit
C:\Windows\System\NEyKHiJ.exe

Filesize
2.1MB

MD5
cca5afdd4b24fc79215011385f7ed7e4

SHA1
05bad1dde59b2045bb586ebfe82e2453bed55b65

SHA256
90faa3f7e499fa2f2bb24471ae7c43bcd9b5ee834afa80a83b432e9c7a6cdc90

SHA512
5da9600d74c85c10e27acfc5fca3c71a8ad27ab0d98fb6a8bafedae9c0a05994ffe2e270542b1c6f952f3246a6b0677bf3d7b3cc93453c87e219d7d4fdcae18f

Download Submit
C:\Windows\System\OedRyQG.exe

Filesize
2.1MB

MD5
77a0fe105f29a6391e32a9168bc0b1d7

SHA1
035fca6fe08ab9dfe20e5884caa19b3e1ae02738

SHA256
35d9d89a807a6aae53e5b08c3fec8ad463787dc8bea36fa2aeb6e5f7245e7edf

SHA512
c4edc58c45c9dba5a68d06f8c616e72046b916aaf681c70f16de324a0eaa8425edaa6103ba23deb54eabfb7f1f064e66502b1aa44a51d5ebbaeab4672776cb29

Download Submit
C:\Windows\System\OlvsCUl.exe

Filesize
2.1MB

MD5
0a781b9a7b2173fbeb4844d5a54db55a

SHA1
42efbf8a76d7f9cd4e7109907656fb5de88d0a8f

SHA256
f67d82f3de7519336b1a977712cff309ee12d7efe9ff7fd1d49230c3c821917e

SHA512
d3d100c679a1a630b8d17aa7534668f82c77f18de0ede64648c4d8b5caaeefa38a7d764e98c2e2e8cf0ff856898bcdc4338f625d50ac0bae0fb35428a9fac2a2

Download Submit
C:\Windows\System\PZpLkVO.exe

Filesize
2.1MB

MD5
152ddb3ab7ca108f84e925ded06e7bbf

SHA1
e27eaba177fed4afed3b72c4056a55ff0893194a

SHA256
4f3a80abd59033c22342f3fc2d123de36f8b66c222bf0f76b99bd3d178f59b1f

SHA512
752c76f5e5b0f989080243b33e6e981608e689a41c349b538ad1531b4a8131f66a092a255602aa1f1d91597894719e37263df12dfc62edb021830cb9eaf72da1

Download Submit
C:\Windows\System\QZcVvey.exe

Filesize
2.1MB

MD5
1b8db8c107693c0db64a71c7c656087d

SHA1
cc8bb30f02755c184ae1535e9607f19edadeb98a

SHA256
ae9e877eed14ac347c8f4791cf714f8beea704190730b503bbe134b3577716d8

SHA512
a7d9e1da714168c0d6657556a8b997d873a2016feb5a5784deac63f5be4b0f8ac406b6adb9e723d22f1ca4f6923fc246a8e11a713325dcf6a5cbe2f03d8b3bd5

Download Submit
C:\Windows\System\SKPjlBz.exe

Filesize
2.1MB

MD5
1cb2d170680380f3c00e4f74e2331733

SHA1
f9ec775d6bc27fdfb8dab1b8db62af94acd60a99

SHA256
be442731a2223dd76d4b6418e98ccda5e174362faf069dd70656451ee1986040

SHA512
b5907c25bd919cd888c10fb9132c25a52f353dda129067080bc750153c922734770ee28a564a9c555e3822c0d4ce4a99fcab21ec78d546e395b0355d546344a3

Download Submit
C:\Windows\System\UQqerCi.exe

Filesize
2.1MB

MD5
f1fe0228cd18127494b01053c355b03c

SHA1
55457546e4723304b1ed38ac5c2fb846b2f75cf4

SHA256
0d014003aa7f6be809a3025b5aa935250b91a6bce6e897d3d6b561c59dcc8e35

SHA512
dafca96dac467018e05bb9441cbd8e290eb9a2cb2488b2abfb8c0549af06a3641800b1236a94bb709e15a463b0e9e3ce361ac57d2e68bd28937d21c0c1841038

Download Submit
C:\Windows\System\UijwqED.exe

Filesize
2.1MB

MD5
5404346b555ea563ebbcc7dc42ec82c9

SHA1
2965b9a46cd058f4d78880ee42b4472132ae66b7

SHA256
3b766987711d6699b6afa3077bf22d6f78cc4cfcb82b931927dcd905420b30cd

SHA512
43c88b3ec50eb0c0c94878c8a80529dee92e374199d927bf493c0b4ed582cd88c0d69febaf4947d2aca2381fdeb7ba16fdf9f0ab5aed1b2047b23b276a9030bc

Download Submit
C:\Windows\System\VKQZWBK.exe

Filesize
2.1MB

MD5
11573fa894206a55052a97ccdb553eb2

SHA1
0f33f290883e6cc5a3898e28a304927af1a250d0

SHA256
4d8fca257cd499d1b758998e7cf86c785cac7a98f4e10291829f4a1510ac2efc

SHA512
9336a157210b5a465bf744c4b6dcafed13dd4be439500118decf29c4a8aac0cf0ed0ea08699471996331226d81e2f70a9fcc03a94df0ed91b96e98c98500f7eb

Download Submit
C:\Windows\System\WqqEPou.exe

Filesize
2.1MB

MD5
c86dc40232b9d46d9b81bebfd8eaf1af

SHA1
26f465139b3b5e124bef5054389aedc74b0f07d1

SHA256
2f01ef262466b86b62fa66ef1118ae2eaab68f607ae55aab1742bf4ac940c9fd

SHA512
6b6697521c3448d79a97574c7cb11b604a30acb3370b28e7af9e0518d976e59e920bd857a9fa99028d1aba193845b499e038bdd98d3120c5614b8bc7009597db

Download Submit
C:\Windows\System\WuVEOTu.exe

Filesize
2.1MB

MD5
4abb0e39b9c1648005305ddc70327ae5

SHA1
68d618b8a23d3035594768c40257a87ab9a0a366

SHA256
2d5b5788754a2016786898cd1debc13e45db75cab32a397fa26b884d0bd64f7d

SHA512
cad468f4fb6923fbb200257f9081250431ee59476f14f4167c07228c66d6bbbb25da5a915edbad606136a16de8dd1077328e5d5207a67ceb5192988aedffe2b4

Download Submit
C:\Windows\System\YTOdTeF.exe

Filesize
2.1MB

MD5
6428d8a050d821f2a4e476529106d88d

SHA1
6d0e7a9c17711b6ee1f522b283eefc264586e3e3

SHA256
01d3d9d02b337c1bc2ef7c6e54a2c6686b73b7a7896cf27a156b0e44824dbf11

SHA512
0a38b9d64da20ae9e90a16d77d7eb9b87d7b05c94fa1bfe18b2c7789f7c235916e2608ead162945a988974f73bdef9e03176a4eba11447cbb75e7fc7e00b5a58

Download Submit
C:\Windows\System\YqgqPKz.exe

Filesize
2.1MB

MD5
d30949123f3bce9428135868b282e99c

SHA1
f00c71db54c31feacc612a62e5c069c6a6d9580a

SHA256
84fe9a9202a979ddf1cfdb36ed2a633f746d79b29b242c9b8ece776c61621691

SHA512
a04cf44c689d1b6d50c2b3fd9c1c64a73fea7ceb709c0eef5778199641b846dc2b879be9c3f16256bb1a4b399b10c6714a681c577639b86b9fd78ce552881bf4

Download Submit
C:\Windows\System\YsuqzZu.exe

Filesize
2.1MB

MD5
7e6fb364042886f211237f5acd973b9d

SHA1
8f3c5124d2c5f6e4871d4204e34e7ef6a575842a

SHA256
9c12f85a21f163a42be7d511d2319050a245077fc5f60701136563f53be3ef0d

SHA512
e8f115973ebc306de0e84fb8f737bbb7935329a72cd247eea7b96bf7d509515109605268b660fec4316dbfa8f2339417f0e6bc39eee0f62186def30c6914ee06

Download Submit
C:\Windows\System\ZVmHUZv.exe

Filesize
2.1MB

MD5
073241ba98b336edb9e9007d5dc8aa41

SHA1
ab7a552621974631a1e5aab07d9083246844cbc9

SHA256
ec661bd88c4c554e3baa71be1ff81af052bed3bc0a2a70997736fb59496df843

SHA512
1c6e8fb474c859c53ec3e0095a0020fb7bad34361828e1523fb7523aa6be4618d155476e374040f704f78c8b35eb51b9b2273357010adc317464a2287843591d

Download Submit
C:\Windows\System\aMmbNuq.exe

Filesize
2.1MB

MD5
2f00bedb017c7767a7ba3164578bf9c4

SHA1
751d2bba71471cb4c944ee1064e3daee15052c5e

SHA256
c369f44ff83bb374fe8aae3b139e4db292000a7da2283811a7cef5dbdacc9c40

SHA512
13efbaf8984037454ea42126a641f72e05c855cb0d31f8aaba2a925c0c17ebba71c12e1bcf49ac29b3384aa25eb34609a8628c7f8fc5b07db7e617e7a808ca5b

Download Submit
C:\Windows\System\cQuhpRf.exe

Filesize
2.1MB

MD5
d33129054135b4dbfca796605b6efd82

SHA1
59a83ed716858ba5bfb5172dc13b1f34b10a5abc

SHA256
ca3a18c469d04674a7873def3068f0929b38d3288b2707064f17d78e473ddb6d

SHA512
bd8f94e71e927bd62716172403e2dbe6a219575cd8e63c8d0748be55417aff448ff68be3f117c64413504a604ad46d6b380435c666a67319c96465c1473be06a

Download Submit
C:\Windows\System\gJWvXyW.exe

Filesize
2.1MB

MD5
8167aebc930008135f5827a2f581b18f

SHA1
977a7e8bbb1bd24012297e06d5a6d350012077a6

SHA256
a699cd78abfedb7b060da7c98891d6e8a586a32a314e9d171ae5c58e693fbd0b

SHA512
bdae7f7d893f8180f7be9c040cc00aab1632f7c394065fc07c53da1fd9bf3a04ca0143ea3b601096cefa42ea244440b30d177aa35d9ccd765a5b90f3d455016b

Download Submit
C:\Windows\System\hmQvxlS.exe

Filesize
2.1MB

MD5
d6a1f4dedc39aa1c1592b0eb8e36f2f2

SHA1
f369fe120f0b0dfd3e54eebde58eadd1bd604bd0

SHA256
dad30fd44f88ca69141882e0b313b1643ee1d2112384208186d2145e0372ca52

SHA512
7a8384fcc3e3c2815282704cb78fb741bce874542870e45da97edf203d1ebdec7231980c67b16e878daeb9e1f890ece71f36c16372c353d370d04c5307afcc6f

Download Submit
C:\Windows\System\jRCWrod.exe

Filesize
2.1MB

MD5
a24e003e3b968c56b34a82aad172e175

SHA1
7dabc9688f6114cfc6c8a6024fa275ae64ccb604

SHA256
f11086c44c410a9dffdc6032dbf456e20fc08d0e0d711b043e15ada2ffe940f3

SHA512
582bd89529a421ae4e7491a71d875a59570750706700e23802442c95efa33023a18d1aba6d718acab31a969ad20f81a61d165f57d626198f822e425e0beee3d0

Download Submit
C:\Windows\System\jcCOVhz.exe

Filesize
2.1MB

MD5
3db6e29b1644ad8e43f1fc144326adf5

SHA1
b4ad0b5888526faf6845e15e4658c29c6d55edf3

SHA256
17d93c83293474fa0dea1d8f5d6fc23293e71383f801d7d149fbe02a39b82f4f

SHA512
f8becb8be1077152fc757b422941854788d8ec156420faf22c063a8ab611add4ba0f96253964dca78bbffdc627af4445da9d4cba8f92eb01402ce5c0fd1733c3

Download Submit
C:\Windows\System\lRaqzDR.exe

Filesize
2.1MB

MD5
53dec4049acdf048cf829e9455a759cf

SHA1
2f5e505a7900b42bc3896ba8158d3f1e355dba06

SHA256
4cbb6e530fde0d2aed0a7843fbb7da98a2be6fd69ad0d8303789e5b76bab6bc5

SHA512
7c325fd4c63ae6948837ec93f619ea15b06dc9b9a655e7a27ba25fcec984f3fe164777e6aa2ad327754bb11a30fbfc6b324038d6b2f7ac348a456b8b7cac784f

Download Submit
C:\Windows\System\mVVqhae.exe

Filesize
2.1MB

MD5
d5b02fa6d7933d6e8146d085ff7179a1

SHA1
c6e449db5c1e31a620995e46da54494bd6146a35

SHA256
198e9cbb98c82df1395df2c203cc5f27c875bc63a358856dc81d3812b275570c

SHA512
f41ccb805f657d67fc4460e43fae3be6bde008391be81e593939c765003480ec03b27ac78e61caed679e53ab22662c92c9709797842f9bae24936f5a22632090

Download Submit
C:\Windows\System\oYfXLrl.exe

Filesize
2.1MB

MD5
a57ed2bae8d323302008df7de6c12620

SHA1
a5b55e92293be36934b10a55bc47f466508c273f

SHA256
9b9cce6856c2d8cb07d587081a9b09bcbb87b518544dbff821047a3244f013c9

SHA512
35ff1a4f9af24bfdeab136de6e898bfbfaeb289d993dcf9b5a5f26b22fc65e7961ca40e0d666b401e1a41dca3ac8078887cbd481bb11136d3f7086a194b0bbf0

Download Submit
C:\Windows\System\orIisgn.exe

Filesize
2.1MB

MD5
5123d0d2b202493bf1eefb8472fbaa31

SHA1
1f8bc51964a2a045943eede432a0e7e2f4b0d8be

SHA256
aba29f1722f5bc744e4411467f8a3155e7f5e4d9bbd95c667a5d5ec8ab98b232

SHA512
b8c50e87d608e561db37e935da456d8ef03d291f7ddc22f0aa48fae3d4529d1783f6758b56bbdcb6a1b69e9c5e88b8346d77151d580b4709c2340d63f17a8130

Download Submit
C:\Windows\System\pgcRDcb.exe

Filesize
2.1MB

MD5
4832983a6bb89b29c5e43701076bb519

SHA1
4acedc21f57bb7e7ba03cf796b92117cd0a5f241

SHA256
7d3f6515f9b1fba613e58bb977e0acc30ea484d1187f51a557d5564e19a0c7d2

SHA512
af35971da232ae5508e060115001ddf22021d2f0bc03f901bb1937b1bc6094a4e4b9732fd78b13c9a8c2c83340928080c253b21577cef312aa281be303829253

Download Submit
C:\Windows\System\qYHpoFS.exe

Filesize
2.1MB

MD5
aa1f00768e6d19618f9c3a551ed44d98

SHA1
3db26919a7e98d789a335777734292cfa8bd599f

SHA256
4f476373d49edc85c662ee7611b4f746cccfae356cf9d78547a6f179f4511f55

SHA512
b22fe85efada650f3404241f14010081909a863844a2f50b38cb8869972eebae8693c6348550d03ef597b71bed19edbfb570cbb356a8ff3e90a6f02a33256e55

Download Submit
C:\Windows\System\qqdEpWb.exe

Filesize
2.1MB

MD5
30ed8d7f69a2156cb1ae1f76b570f9b2

SHA1
51276e92b61726962e83f1ac37b677a396d47d3f

SHA256
b98f5d0d0bd78074452fb0d87e0cee5bb906c0fff654f5b91b79f17cbc42ccd0

SHA512
7aaf80a729dc79ebf455d629f5aaedc3fbbbc531f43343ba72509b8c170336cbdc39fd87128f54411556a8befd61b2021accab4184d3fb3ddefe21cc41f6613e

Download Submit
C:\Windows\System\sBctQNL.exe

Filesize
2.1MB

MD5
d0b72b14ca550ffe0e450e11274fb644

SHA1
0122857b179271ef068056b7140d0becf73d7666

SHA256
261d434a212c4be05be632fdae593ab9bd2299dd4d430eef066b70b62d2610d9

SHA512
14515976aeea5f38ce358ef98b869e53de008f0c1ce9b3262f792fd19f4cbfa5c1ab6a36b7dc4b6bcc0724f0d0987530150376ea6628fd57714d234c592b07f7

Download Submit
memory/640-2066-0x00007FF7DDE70000-0x00007FF7DE262000-memory.dmp

Filesize
3.9MB

Download
memory/640-176-0x00007FF7DDE70000-0x00007FF7DE262000-memory.dmp

Filesize
3.9MB

Download
memory/644-261-0x00007FF6B7AB0000-0x00007FF6B7EA2000-memory.dmp

Filesize
3.9MB

Download
memory/644-2058-0x00007FF6B7AB0000-0x00007FF6B7EA2000-memory.dmp

Filesize
3.9MB

Download
memory/856-2064-0x00007FF741620000-0x00007FF741A12000-memory.dmp

Filesize
3.9MB

Download
memory/856-133-0x00007FF741620000-0x00007FF741A12000-memory.dmp

Filesize
3.9MB

Download
memory/1056-547-0x00007FF745E30000-0x00007FF746222000-memory.dmp

Filesize
3.9MB

Download
memory/1056-2088-0x00007FF745E30000-0x00007FF746222000-memory.dmp

Filesize
3.9MB

Download
memory/1172-545-0x00007FF64E400000-0x00007FF64E7F2000-memory.dmp

Filesize
3.9MB

Download
memory/1172-2093-0x00007FF64E400000-0x00007FF64E7F2000-memory.dmp

Filesize
3.9MB

Download
memory/1268-2085-0x00007FF7A4AD0000-0x00007FF7A4EC2000-memory.dmp

Filesize
3.9MB

Download
memory/1268-501-0x00007FF7A4AD0000-0x00007FF7A4EC2000-memory.dmp

Filesize
3.9MB

Download
memory/1416-546-0x000001A2BA420000-0x000001A2BA430000-memory.dmp

Filesize
64KB

Download
memory/1416-75-0x00007FFEED150000-0x00007FFEEDC11000-memory.dmp

Filesize
10.8MB

Download
memory/1416-1933-0x00007FFEED150000-0x00007FFEEDC11000-memory.dmp

Filesize
10.8MB

Download
memory/1416-334-0x000001A2BA370000-0x000001A2BA392000-memory.dmp

Filesize
136KB

Download
memory/1544-502-0x00007FF650010000-0x00007FF650402000-memory.dmp

Filesize
3.9MB

Download
memory/1544-2086-0x00007FF650010000-0x00007FF650402000-memory.dmp

Filesize
3.9MB

Download
memory/1776-544-0x00007FF61E570000-0x00007FF61E962000-memory.dmp

Filesize
3.9MB

Download
memory/1776-2091-0x00007FF61E570000-0x00007FF61E962000-memory.dmp

Filesize
3.9MB

Download
memory/1808-499-0x00007FF7102B0000-0x00007FF7106A2000-memory.dmp

Filesize
3.9MB

Download
memory/1808-2082-0x00007FF7102B0000-0x00007FF7106A2000-memory.dmp

Filesize
3.9MB

Download
memory/2632-2060-0x00007FF6F9CF0000-0x00007FF6FA0E2000-memory.dmp

Filesize
3.9MB

Download
memory/2632-109-0x00007FF6F9CF0000-0x00007FF6FA0E2000-memory.dmp

Filesize
3.9MB

Download
memory/2684-2069-0x00007FF6ADD10000-0x00007FF6AE102000-memory.dmp

Filesize
3.9MB

Download
memory/2684-470-0x00007FF6ADD10000-0x00007FF6AE102000-memory.dmp

Filesize
3.9MB

Download
memory/3192-543-0x00007FF7242B0000-0x00007FF7246A2000-memory.dmp

Filesize
3.9MB

Download
memory/3192-2114-0x00007FF7242B0000-0x00007FF7246A2000-memory.dmp

Filesize
3.9MB

Download
memory/3204-2062-0x00007FF70E540000-0x00007FF70E932000-memory.dmp

Filesize
3.9MB

Download
memory/3204-425-0x00007FF70E540000-0x00007FF70E932000-memory.dmp

Filesize
3.9MB

Download
memory/3472-224-0x00007FF7A10E0000-0x00007FF7A14D2000-memory.dmp

Filesize
3.9MB

Download
memory/3472-2077-0x00007FF7A10E0000-0x00007FF7A14D2000-memory.dmp

Filesize
3.9MB

Download
memory/3728-265-0x00007FF725340000-0x00007FF725732000-memory.dmp

Filesize
3.9MB

Download
memory/3728-2075-0x00007FF725340000-0x00007FF725732000-memory.dmp

Filesize
3.9MB

Download
memory/3892-536-0x00007FF660F90000-0x00007FF661382000-memory.dmp

Filesize
3.9MB

Download
memory/3892-2105-0x00007FF660F90000-0x00007FF661382000-memory.dmp

Filesize
3.9MB

Download
memory/3928-2056-0x00007FF7E8AA0000-0x00007FF7E8E92000-memory.dmp

Filesize
3.9MB

Download
memory/3928-13-0x00007FF7E8AA0000-0x00007FF7E8E92000-memory.dmp

Filesize
3.9MB

Download
memory/3928-2047-0x00007FF7E8AA0000-0x00007FF7E8E92000-memory.dmp

Filesize
3.9MB

Download
memory/4128-2079-0x00007FF638C30000-0x00007FF639022000-memory.dmp

Filesize
3.9MB

Download
memory/4128-348-0x00007FF638C30000-0x00007FF639022000-memory.dmp

Filesize
3.9MB

Download
memory/4408-500-0x00007FF63D220000-0x00007FF63D612000-memory.dmp

Filesize
3.9MB

Download
memory/4408-2081-0x00007FF63D220000-0x00007FF63D612000-memory.dmp

Filesize
3.9MB

Download
memory/4448-2070-0x00007FF7D70B0000-0x00007FF7D74A2000-memory.dmp

Filesize
3.9MB

Download
memory/4448-308-0x00007FF7D70B0000-0x00007FF7D74A2000-memory.dmp

Filesize
3.9MB

Download
memory/4816-2073-0x00007FF6DE190000-0x00007FF6DE582000-memory.dmp

Filesize
3.9MB

Download
memory/4816-391-0x00007FF6DE190000-0x00007FF6DE582000-memory.dmp

Filesize
3.9MB

Download
memory/5048-1-0x000002CA06FA0000-0x000002CA06FB0000-memory.dmp

Filesize
64KB

Download
memory/5048-0-0x00007FF7D69A0000-0x00007FF7D6D92000-memory.dmp

Filesize
3.9MB

Download
memory/5048-1904-0x00007FF7D69A0000-0x00007FF7D6D92000-memory.dmp

Filesize
3.9MB

Download