xmrig | 541701ca67b696948b461eb5cbab1251e1c996e6c4f1fe2a4f5628831f12b18d

Analysis

max time kernel
62s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 12:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
Size

1.8MB
MD5

09be8a627a73540fb1d9a52901d1a7dd
SHA1

6f9f640e2d5394c98d09caeb9f1ce4cce84e2f39
SHA256

541701ca67b696948b461eb5cbab1251e1c996e6c4f1fe2a4f5628831f12b18d
SHA512

5794a33eb4952761cd900935b15635c44396967160198aeb281a9388e8e9a2f480317a329fc24869bf85a9b43c2ec4022bd11a2d46df7c897295ff6f9daf948d
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrI5t:NABP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 44 IoCs

miner

resource	yara_rule
behavioral2/memory/512-9-0x00007FF6F28D0000-0x00007FF6F2CC2000-memory.dmp	xmrig
behavioral2/memory/4420-72-0x00007FF7469F0000-0x00007FF746DE2000-memory.dmp	xmrig
behavioral2/memory/8-83-0x00007FF70BE90000-0x00007FF70C282000-memory.dmp	xmrig
behavioral2/memory/1428-104-0x00007FF60A570000-0x00007FF60A962000-memory.dmp	xmrig
behavioral2/memory/2632-110-0x00007FF7CDB30000-0x00007FF7CDF22000-memory.dmp	xmrig
behavioral2/memory/2136-526-0x00007FF64F8E0000-0x00007FF64FCD2000-memory.dmp	xmrig
behavioral2/memory/4148-528-0x00007FF7CBB90000-0x00007FF7CBF82000-memory.dmp	xmrig
behavioral2/memory/4700-527-0x00007FF78F090000-0x00007FF78F482000-memory.dmp	xmrig
behavioral2/memory/368-530-0x00007FF79F420000-0x00007FF79F812000-memory.dmp	xmrig
behavioral2/memory/400-529-0x00007FF602EC0000-0x00007FF6032B2000-memory.dmp	xmrig
behavioral2/memory/5060-111-0x00007FF7816C0000-0x00007FF781AB2000-memory.dmp	xmrig
behavioral2/memory/2372-107-0x00007FF765720000-0x00007FF765B12000-memory.dmp	xmrig
behavioral2/memory/3476-100-0x00007FF60D250000-0x00007FF60D642000-memory.dmp	xmrig
behavioral2/memory/4808-95-0x00007FF6640D0000-0x00007FF6644C2000-memory.dmp	xmrig
behavioral2/memory/1880-88-0x00007FF752F50000-0x00007FF753342000-memory.dmp	xmrig
behavioral2/memory/912-87-0x00007FF673800000-0x00007FF673BF2000-memory.dmp	xmrig
behavioral2/memory/3604-68-0x00007FF6A2E30000-0x00007FF6A3222000-memory.dmp	xmrig
behavioral2/memory/1960-61-0x00007FF7580C0000-0x00007FF7584B2000-memory.dmp	xmrig
behavioral2/memory/4784-43-0x00007FF7C8BA0000-0x00007FF7C8F92000-memory.dmp	xmrig
behavioral2/memory/884-35-0x00007FF727FB0000-0x00007FF7283A2000-memory.dmp	xmrig
behavioral2/memory/512-2633-0x00007FF6F28D0000-0x00007FF6F2CC2000-memory.dmp	xmrig
behavioral2/memory/4420-2666-0x00007FF7469F0000-0x00007FF746DE2000-memory.dmp	xmrig
behavioral2/memory/2572-2667-0x00007FF6924F0000-0x00007FF6928E2000-memory.dmp	xmrig
behavioral2/memory/512-2676-0x00007FF6F28D0000-0x00007FF6F2CC2000-memory.dmp	xmrig
behavioral2/memory/8-2678-0x00007FF70BE90000-0x00007FF70C282000-memory.dmp	xmrig
behavioral2/memory/4784-2680-0x00007FF7C8BA0000-0x00007FF7C8F92000-memory.dmp	xmrig
behavioral2/memory/884-2682-0x00007FF727FB0000-0x00007FF7283A2000-memory.dmp	xmrig
behavioral2/memory/1960-2686-0x00007FF7580C0000-0x00007FF7584B2000-memory.dmp	xmrig
behavioral2/memory/3604-2685-0x00007FF6A2E30000-0x00007FF6A3222000-memory.dmp	xmrig
behavioral2/memory/912-2688-0x00007FF673800000-0x00007FF673BF2000-memory.dmp	xmrig
behavioral2/memory/4420-2699-0x00007FF7469F0000-0x00007FF746DE2000-memory.dmp	xmrig
behavioral2/memory/1428-2700-0x00007FF60A570000-0x00007FF60A962000-memory.dmp	xmrig
behavioral2/memory/2372-2702-0x00007FF765720000-0x00007FF765B12000-memory.dmp	xmrig
behavioral2/memory/2632-2704-0x00007FF7CDB30000-0x00007FF7CDF22000-memory.dmp	xmrig
behavioral2/memory/4808-2697-0x00007FF6640D0000-0x00007FF6644C2000-memory.dmp	xmrig
behavioral2/memory/3476-2695-0x00007FF60D250000-0x00007FF60D642000-memory.dmp	xmrig
behavioral2/memory/2572-2692-0x00007FF6924F0000-0x00007FF6928E2000-memory.dmp	xmrig
behavioral2/memory/1880-2691-0x00007FF752F50000-0x00007FF753342000-memory.dmp	xmrig
behavioral2/memory/400-2717-0x00007FF602EC0000-0x00007FF6032B2000-memory.dmp	xmrig
behavioral2/memory/4700-2729-0x00007FF78F090000-0x00007FF78F482000-memory.dmp	xmrig
behavioral2/memory/2136-2730-0x00007FF64F8E0000-0x00007FF64FCD2000-memory.dmp	xmrig
behavioral2/memory/368-2725-0x00007FF79F420000-0x00007FF79F812000-memory.dmp	xmrig
behavioral2/memory/4148-2727-0x00007FF7CBB90000-0x00007FF7CBF82000-memory.dmp	xmrig
behavioral2/memory/5060-2710-0x00007FF7816C0000-0x00007FF781AB2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
512	dwnQEyh.exe
8	PxXTKBl.exe
884	KzUXeGA.exe
4784	vdklKaN.exe
1960	pJeXXGf.exe
3604	Yhvhylf.exe
912	YHiYyce.exe
1880	Dqbkexu.exe
4420	brqlgCD.exe
4808	QncfSeS.exe
2572	KtUkEkd.exe
1428	ULfKltG.exe
3476	SHkwasn.exe
2372	ulbREKK.exe
2632	dSUMAHw.exe
5060	imTQNrW.exe
2136	hxTDbeY.exe
4700	TEDwyBi.exe
4148	eoTRkjR.exe
400	DyuKaAR.exe
368	SCTIdUg.exe
2972	FtzIgfI.exe
3252	PScMzRK.exe
936	kljhIMn.exe
636	fuaNCcn.exe
3312	OpxivZR.exe
1072	PyAVQIv.exe
3404	OylHfWU.exe
4116	WCuXifc.exe
3824	nPuZLFu.exe
4196	XrHTaiW.exe
3520	cAFYMlc.exe
1708	auFpxbX.exe
2560	RpIKzGz.exe
2308	TjGvKVP.exe
556	uPfXzSB.exe
3928	ZWKwykR.exe
4556	nROTcDu.exe
4464	RjwzdDL.exe
1932	sSmebVi.exe
4660	GWtKXUf.exe
3964	rJGLtWT.exe
4416	PiDfkDg.exe
4428	YmQtuSc.exe
4044	xIbQsyS.exe
3456	ztvgCal.exe
2092	SxFVqRs.exe
5016	EfUyzDH.exe
2148	FCYvBVJ.exe
4316	dznoFlR.exe
1144	hNAHDHn.exe
1448	KkBzkQg.exe
3940	ffwXyjK.exe
4300	XRJEDZJ.exe
4644	gLycXiu.exe
780	hvYnWnF.exe
4624	kxDybFc.exe
3100	fCArqpi.exe
2172	XyIVsSW.exe
60	PkDdOyL.exe
4572	BKdDOsV.exe
2628	PPFBHrL.exe
1152	MtnyArg.exe
2388	uCwcnBK.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3888-0-0x00007FF797D90000-0x00007FF798182000-memory.dmp	upx
behavioral2/files/0x000c000000023b94-5.dat	upx
behavioral2/files/0x000a000000023b9d-8.dat	upx
behavioral2/memory/512-9-0x00007FF6F28D0000-0x00007FF6F2CC2000-memory.dmp	upx
behavioral2/files/0x000a000000023b9c-18.dat	upx
behavioral2/files/0x000a000000023b9e-28.dat	upx
behavioral2/files/0x000a000000023b9f-34.dat	upx
behavioral2/files/0x000a000000023ba2-65.dat	upx
behavioral2/files/0x000a000000023ba3-69.dat	upx
behavioral2/memory/4420-72-0x00007FF7469F0000-0x00007FF746DE2000-memory.dmp	upx
behavioral2/memory/2572-78-0x00007FF6924F0000-0x00007FF6928E2000-memory.dmp	upx
behavioral2/memory/8-83-0x00007FF70BE90000-0x00007FF70C282000-memory.dmp	upx
behavioral2/files/0x000b000000023ba6-93.dat	upx
behavioral2/files/0x000b000000023b99-96.dat	upx
behavioral2/memory/1428-104-0x00007FF60A570000-0x00007FF60A962000-memory.dmp	upx
behavioral2/memory/2632-110-0x00007FF7CDB30000-0x00007FF7CDF22000-memory.dmp	upx
behavioral2/files/0x000a000000023bb0-142.dat	upx
behavioral2/files/0x000a000000023bb4-170.dat	upx
behavioral2/files/0x000a000000023bb7-185.dat	upx
behavioral2/memory/2136-526-0x00007FF64F8E0000-0x00007FF64FCD2000-memory.dmp	upx
behavioral2/memory/4148-528-0x00007FF7CBB90000-0x00007FF7CBF82000-memory.dmp	upx
behavioral2/memory/4700-527-0x00007FF78F090000-0x00007FF78F482000-memory.dmp	upx
behavioral2/memory/368-530-0x00007FF79F420000-0x00007FF79F812000-memory.dmp	upx
behavioral2/memory/400-529-0x00007FF602EC0000-0x00007FF6032B2000-memory.dmp	upx
behavioral2/files/0x000a000000023bba-192.dat	upx
behavioral2/files/0x000a000000023bb8-190.dat	upx
behavioral2/files/0x000a000000023bb9-187.dat	upx
behavioral2/files/0x000a000000023bb6-180.dat	upx
behavioral2/files/0x000a000000023bb5-175.dat	upx
behavioral2/files/0x000a000000023bb3-165.dat	upx
behavioral2/files/0x000a000000023bb2-160.dat	upx
behavioral2/files/0x000a000000023bb1-155.dat	upx
behavioral2/files/0x000a000000023baf-145.dat	upx
behavioral2/files/0x000a000000023bae-140.dat	upx
behavioral2/files/0x000a000000023bad-135.dat	upx
behavioral2/files/0x000a000000023bac-130.dat	upx
behavioral2/files/0x000a000000023bab-125.dat	upx
behavioral2/files/0x000a000000023baa-120.dat	upx
behavioral2/memory/5060-111-0x00007FF7816C0000-0x00007FF781AB2000-memory.dmp	upx
behavioral2/files/0x000b000000023ba5-108.dat	upx
behavioral2/memory/2372-107-0x00007FF765720000-0x00007FF765B12000-memory.dmp	upx
behavioral2/files/0x000a000000023ba9-102.dat	upx
behavioral2/memory/3476-100-0x00007FF60D250000-0x00007FF60D642000-memory.dmp	upx
behavioral2/memory/4808-95-0x00007FF6640D0000-0x00007FF6644C2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba8-90.dat	upx
behavioral2/memory/1880-88-0x00007FF752F50000-0x00007FF753342000-memory.dmp	upx
behavioral2/memory/912-87-0x00007FF673800000-0x00007FF673BF2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba7-80.dat	upx
behavioral2/files/0x000a000000023ba4-75.dat	upx
behavioral2/memory/3604-68-0x00007FF6A2E30000-0x00007FF6A3222000-memory.dmp	upx
behavioral2/memory/1960-61-0x00007FF7580C0000-0x00007FF7584B2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba1-46.dat	upx
behavioral2/memory/4784-43-0x00007FF7C8BA0000-0x00007FF7C8F92000-memory.dmp	upx
behavioral2/files/0x000a000000023ba0-40.dat	upx
behavioral2/memory/884-35-0x00007FF727FB0000-0x00007FF7283A2000-memory.dmp	upx
behavioral2/memory/512-2633-0x00007FF6F28D0000-0x00007FF6F2CC2000-memory.dmp	upx
behavioral2/memory/4420-2666-0x00007FF7469F0000-0x00007FF746DE2000-memory.dmp	upx
behavioral2/memory/2572-2667-0x00007FF6924F0000-0x00007FF6928E2000-memory.dmp	upx
behavioral2/memory/512-2676-0x00007FF6F28D0000-0x00007FF6F2CC2000-memory.dmp	upx
behavioral2/memory/8-2678-0x00007FF70BE90000-0x00007FF70C282000-memory.dmp	upx
behavioral2/memory/4784-2680-0x00007FF7C8BA0000-0x00007FF7C8F92000-memory.dmp	upx
behavioral2/memory/884-2682-0x00007FF727FB0000-0x00007FF7283A2000-memory.dmp	upx
behavioral2/memory/1960-2686-0x00007FF7580C0000-0x00007FF7584B2000-memory.dmp	upx
behavioral2/memory/3604-2685-0x00007FF6A2E30000-0x00007FF6A3222000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\HppeYOj.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\MuCGcAz.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\jbQczmy.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\cqFXrHz.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\UGlVBTh.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\OfoGkBH.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\zSgqGFQ.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\UafPQTa.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\qdrYkJD.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\TWiHJNi.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\uXuSTyc.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\xpAqSsy.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\FhhBgEU.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\MkIFLIS.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\NoJkKte.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\XqHTjgB.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\dBqrqFA.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\KshXsgg.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\jPgfUSi.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\eGEkLun.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\KksaeUn.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\RfrkXIj.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\ujDKkYi.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\rtjKRJl.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\vNyiltV.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\uDfAYub.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\QaVhPpu.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\ahAHYDv.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\ONRRWQY.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\RWWXIrg.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\gUzupXR.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\qXeglLq.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\RlNQkAD.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\RLIEbWT.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\IbBKJJY.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\xBhmvFI.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\CbbnZwZ.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\NAkFafR.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\VoNbKdO.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\eevQcNa.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\mbBkZOn.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\TcLOMIF.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\llDklEl.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\oBPnnbF.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\CJrTRgk.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\woUWZDZ.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\PnztpFJ.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\REuPPqj.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\fjSamvD.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\YZZhwVW.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\BETpYzh.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\WJZZgYR.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\qMYzkzO.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\rzWTNyP.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\QmRmoHB.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\MzkayDA.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\FCYvBVJ.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\LvwLfVd.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\DwlAxto.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\MldVNXS.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\hpoMgLs.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\ZFerHVu.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\trLjzbU.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\EIIKXkx.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
764	powershell.exe
764	powershell.exe
764	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
Token: SeDebugPrivilege	764	powershell.exe
Token: SeLockMemoryPrivilege	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3888 wrote to memory of 764	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	84
PID 3888 wrote to memory of 764	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	84
PID 3888 wrote to memory of 512	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	85
PID 3888 wrote to memory of 512	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	85
PID 3888 wrote to memory of 8	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	86
PID 3888 wrote to memory of 8	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	86
PID 3888 wrote to memory of 884	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	87
PID 3888 wrote to memory of 884	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	87
PID 3888 wrote to memory of 4784	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	88
PID 3888 wrote to memory of 4784	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	88
PID 3888 wrote to memory of 1960	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	89
PID 3888 wrote to memory of 1960	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	89
PID 3888 wrote to memory of 3604	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	90
PID 3888 wrote to memory of 3604	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	90
PID 3888 wrote to memory of 912	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	91
PID 3888 wrote to memory of 912	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	91
PID 3888 wrote to memory of 1880	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	92
PID 3888 wrote to memory of 1880	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	92
PID 3888 wrote to memory of 4420	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	93
PID 3888 wrote to memory of 4420	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	93
PID 3888 wrote to memory of 4808	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	94
PID 3888 wrote to memory of 4808	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	94
PID 3888 wrote to memory of 2572	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	95
PID 3888 wrote to memory of 2572	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	95
PID 3888 wrote to memory of 1428	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	96
PID 3888 wrote to memory of 1428	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	96
PID 3888 wrote to memory of 3476	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	97
PID 3888 wrote to memory of 3476	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	97
PID 3888 wrote to memory of 2372	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	98
PID 3888 wrote to memory of 2372	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	98
PID 3888 wrote to memory of 2632	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	99
PID 3888 wrote to memory of 2632	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	99
PID 3888 wrote to memory of 5060	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	100
PID 3888 wrote to memory of 5060	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	100
PID 3888 wrote to memory of 2136	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	101
PID 3888 wrote to memory of 2136	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	101
PID 3888 wrote to memory of 4700	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	102
PID 3888 wrote to memory of 4700	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	102
PID 3888 wrote to memory of 4148	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	103
PID 3888 wrote to memory of 4148	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	103
PID 3888 wrote to memory of 400	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	104
PID 3888 wrote to memory of 400	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	104
PID 3888 wrote to memory of 368	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	105
PID 3888 wrote to memory of 368	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	105
PID 3888 wrote to memory of 2972	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	106
PID 3888 wrote to memory of 2972	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	106
PID 3888 wrote to memory of 3252	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	107
PID 3888 wrote to memory of 3252	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	107
PID 3888 wrote to memory of 936	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	108
PID 3888 wrote to memory of 936	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	108
PID 3888 wrote to memory of 636	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	109
PID 3888 wrote to memory of 636	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	109
PID 3888 wrote to memory of 3312	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	110
PID 3888 wrote to memory of 3312	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	110
PID 3888 wrote to memory of 1072	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	111
PID 3888 wrote to memory of 1072	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	111
PID 3888 wrote to memory of 3404	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	112
PID 3888 wrote to memory of 3404	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	112
PID 3888 wrote to memory of 4116	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	113
PID 3888 wrote to memory of 4116	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	113
PID 3888 wrote to memory of 3824	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	114
PID 3888 wrote to memory of 3824	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	114
PID 3888 wrote to memory of 4196	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	115
PID 3888 wrote to memory of 4196	3888	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:764
- C:\Windows\System\dwnQEyh.exe
  C:\Windows\System\dwnQEyh.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\PxXTKBl.exe
  C:\Windows\System\PxXTKBl.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\KzUXeGA.exe
  C:\Windows\System\KzUXeGA.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\vdklKaN.exe
  C:\Windows\System\vdklKaN.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\pJeXXGf.exe
  C:\Windows\System\pJeXXGf.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\Yhvhylf.exe
  C:\Windows\System\Yhvhylf.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\YHiYyce.exe
  C:\Windows\System\YHiYyce.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\Dqbkexu.exe
  C:\Windows\System\Dqbkexu.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\brqlgCD.exe
  C:\Windows\System\brqlgCD.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\QncfSeS.exe
  C:\Windows\System\QncfSeS.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\KtUkEkd.exe
  C:\Windows\System\KtUkEkd.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\ULfKltG.exe
  C:\Windows\System\ULfKltG.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\SHkwasn.exe
  C:\Windows\System\SHkwasn.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\ulbREKK.exe
  C:\Windows\System\ulbREKK.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\dSUMAHw.exe
  C:\Windows\System\dSUMAHw.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\imTQNrW.exe
  C:\Windows\System\imTQNrW.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\hxTDbeY.exe
  C:\Windows\System\hxTDbeY.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\TEDwyBi.exe
  C:\Windows\System\TEDwyBi.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\eoTRkjR.exe
  C:\Windows\System\eoTRkjR.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\DyuKaAR.exe
  C:\Windows\System\DyuKaAR.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\SCTIdUg.exe
  C:\Windows\System\SCTIdUg.exe
  2⤵
  - Executes dropped EXE
  PID:368
- C:\Windows\System\FtzIgfI.exe
  C:\Windows\System\FtzIgfI.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\PScMzRK.exe
  C:\Windows\System\PScMzRK.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\System\kljhIMn.exe
  C:\Windows\System\kljhIMn.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\fuaNCcn.exe
  C:\Windows\System\fuaNCcn.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\OpxivZR.exe
  C:\Windows\System\OpxivZR.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\PyAVQIv.exe
  C:\Windows\System\PyAVQIv.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\OylHfWU.exe
  C:\Windows\System\OylHfWU.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\WCuXifc.exe
  C:\Windows\System\WCuXifc.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System\nPuZLFu.exe
  C:\Windows\System\nPuZLFu.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\XrHTaiW.exe
  C:\Windows\System\XrHTaiW.exe
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Windows\System\cAFYMlc.exe
  C:\Windows\System\cAFYMlc.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\auFpxbX.exe
  C:\Windows\System\auFpxbX.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\RpIKzGz.exe
  C:\Windows\System\RpIKzGz.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\TjGvKVP.exe
  C:\Windows\System\TjGvKVP.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\uPfXzSB.exe
  C:\Windows\System\uPfXzSB.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\ZWKwykR.exe
  C:\Windows\System\ZWKwykR.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\nROTcDu.exe
  C:\Windows\System\nROTcDu.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\RjwzdDL.exe
  C:\Windows\System\RjwzdDL.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\sSmebVi.exe
  C:\Windows\System\sSmebVi.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\GWtKXUf.exe
  C:\Windows\System\GWtKXUf.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\rJGLtWT.exe
  C:\Windows\System\rJGLtWT.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\PiDfkDg.exe
  C:\Windows\System\PiDfkDg.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\YmQtuSc.exe
  C:\Windows\System\YmQtuSc.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\xIbQsyS.exe
  C:\Windows\System\xIbQsyS.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\ztvgCal.exe
  C:\Windows\System\ztvgCal.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\SxFVqRs.exe
  C:\Windows\System\SxFVqRs.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\EfUyzDH.exe
  C:\Windows\System\EfUyzDH.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\FCYvBVJ.exe
  C:\Windows\System\FCYvBVJ.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\dznoFlR.exe
  C:\Windows\System\dznoFlR.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\hNAHDHn.exe
  C:\Windows\System\hNAHDHn.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\KkBzkQg.exe
  C:\Windows\System\KkBzkQg.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\ffwXyjK.exe
  C:\Windows\System\ffwXyjK.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\XRJEDZJ.exe
  C:\Windows\System\XRJEDZJ.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\gLycXiu.exe
  C:\Windows\System\gLycXiu.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\hvYnWnF.exe
  C:\Windows\System\hvYnWnF.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\kxDybFc.exe
  C:\Windows\System\kxDybFc.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\fCArqpi.exe
  C:\Windows\System\fCArqpi.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\XyIVsSW.exe
  C:\Windows\System\XyIVsSW.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\PkDdOyL.exe
  C:\Windows\System\PkDdOyL.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\BKdDOsV.exe
  C:\Windows\System\BKdDOsV.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\PPFBHrL.exe
  C:\Windows\System\PPFBHrL.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\MtnyArg.exe
  C:\Windows\System\MtnyArg.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\uCwcnBK.exe
  C:\Windows\System\uCwcnBK.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\afWpsPQ.exe
  C:\Windows\System\afWpsPQ.exe
  2⤵
  PID:948
- C:\Windows\System\UEXoJzK.exe
  C:\Windows\System\UEXoJzK.exe
  2⤵
  PID:4676
- C:\Windows\System\mHmGutq.exe
  C:\Windows\System\mHmGutq.exe
  2⤵
  PID:2624
- C:\Windows\System\wbEziyj.exe
  C:\Windows\System\wbEziyj.exe
  2⤵
  PID:5052
- C:\Windows\System\KgqWZRu.exe
  C:\Windows\System\KgqWZRu.exe
  2⤵
  PID:3868
- C:\Windows\System\YxcHMBa.exe
  C:\Windows\System\YxcHMBa.exe
  2⤵
  PID:2156
- C:\Windows\System\AFRXAFg.exe
  C:\Windows\System\AFRXAFg.exe
  2⤵
  PID:3684
- C:\Windows\System\xasEqHJ.exe
  C:\Windows\System\xasEqHJ.exe
  2⤵
  PID:2788
- C:\Windows\System\WhBWYBV.exe
  C:\Windows\System\WhBWYBV.exe
  2⤵
  PID:4712
- C:\Windows\System\YGHLhIp.exe
  C:\Windows\System\YGHLhIp.exe
  2⤵
  PID:5136
- C:\Windows\System\kRfvQMG.exe
  C:\Windows\System\kRfvQMG.exe
  2⤵
  PID:5164
- C:\Windows\System\eqrpvNX.exe
  C:\Windows\System\eqrpvNX.exe
  2⤵
  PID:5192
- C:\Windows\System\JxlmnvK.exe
  C:\Windows\System\JxlmnvK.exe
  2⤵
  PID:5220
- C:\Windows\System\LkHPzoz.exe
  C:\Windows\System\LkHPzoz.exe
  2⤵
  PID:5248
- C:\Windows\System\lZAqboc.exe
  C:\Windows\System\lZAqboc.exe
  2⤵
  PID:5280
- C:\Windows\System\hwMCnLJ.exe
  C:\Windows\System\hwMCnLJ.exe
  2⤵
  PID:5304
- C:\Windows\System\KYmgLSK.exe
  C:\Windows\System\KYmgLSK.exe
  2⤵
  PID:5332
- C:\Windows\System\moGdmAg.exe
  C:\Windows\System\moGdmAg.exe
  2⤵
  PID:5356
- C:\Windows\System\XWxVDVj.exe
  C:\Windows\System\XWxVDVj.exe
  2⤵
  PID:5388
- C:\Windows\System\ynNAalY.exe
  C:\Windows\System\ynNAalY.exe
  2⤵
  PID:5416
- C:\Windows\System\pZFyznS.exe
  C:\Windows\System\pZFyznS.exe
  2⤵
  PID:5444
- C:\Windows\System\GmhZBcG.exe
  C:\Windows\System\GmhZBcG.exe
  2⤵
  PID:5472
- C:\Windows\System\gFHstbs.exe
  C:\Windows\System\gFHstbs.exe
  2⤵
  PID:5500
- C:\Windows\System\IJvAtzz.exe
  C:\Windows\System\IJvAtzz.exe
  2⤵
  PID:5528
- C:\Windows\System\bhKXZcF.exe
  C:\Windows\System\bhKXZcF.exe
  2⤵
  PID:5556
- C:\Windows\System\thgurYu.exe
  C:\Windows\System\thgurYu.exe
  2⤵
  PID:5584
- C:\Windows\System\pHctyaS.exe
  C:\Windows\System\pHctyaS.exe
  2⤵
  PID:5612
- C:\Windows\System\RWWXIrg.exe
  C:\Windows\System\RWWXIrg.exe
  2⤵
  PID:5640
- C:\Windows\System\PojxIrF.exe
  C:\Windows\System\PojxIrF.exe
  2⤵
  PID:5668
- C:\Windows\System\RarWXIW.exe
  C:\Windows\System\RarWXIW.exe
  2⤵
  PID:5696
- C:\Windows\System\DVzsEoM.exe
  C:\Windows\System\DVzsEoM.exe
  2⤵
  PID:5724
- C:\Windows\System\QqYZmRT.exe
  C:\Windows\System\QqYZmRT.exe
  2⤵
  PID:5756
- C:\Windows\System\djfnVSy.exe
  C:\Windows\System\djfnVSy.exe
  2⤵
  PID:5780
- C:\Windows\System\IkYxGEM.exe
  C:\Windows\System\IkYxGEM.exe
  2⤵
  PID:5808
- C:\Windows\System\yafjuUW.exe
  C:\Windows\System\yafjuUW.exe
  2⤵
  PID:5832
- C:\Windows\System\trNZSYq.exe
  C:\Windows\System\trNZSYq.exe
  2⤵
  PID:5864
- C:\Windows\System\jJvOjZq.exe
  C:\Windows\System\jJvOjZq.exe
  2⤵
  PID:5892
- C:\Windows\System\VYiJdmo.exe
  C:\Windows\System\VYiJdmo.exe
  2⤵
  PID:5920
- C:\Windows\System\RRrlcVC.exe
  C:\Windows\System\RRrlcVC.exe
  2⤵
  PID:5948
- C:\Windows\System\JEKPkiq.exe
  C:\Windows\System\JEKPkiq.exe
  2⤵
  PID:5976
- C:\Windows\System\dccysIP.exe
  C:\Windows\System\dccysIP.exe
  2⤵
  PID:6004
- C:\Windows\System\vQvzKyF.exe
  C:\Windows\System\vQvzKyF.exe
  2⤵
  PID:6032
- C:\Windows\System\abgVehD.exe
  C:\Windows\System\abgVehD.exe
  2⤵
  PID:6060
- C:\Windows\System\KAAnZSe.exe
  C:\Windows\System\KAAnZSe.exe
  2⤵
  PID:6088
- C:\Windows\System\bNUrVhq.exe
  C:\Windows\System\bNUrVhq.exe
  2⤵
  PID:6116
- C:\Windows\System\wbYUTyX.exe
  C:\Windows\System\wbYUTyX.exe
  2⤵
  PID:564
- C:\Windows\System\wmEfwZz.exe
  C:\Windows\System\wmEfwZz.exe
  2⤵
  PID:2088
- C:\Windows\System\IevnLps.exe
  C:\Windows\System\IevnLps.exe
  2⤵
  PID:2292
- C:\Windows\System\QjaYfFK.exe
  C:\Windows\System\QjaYfFK.exe
  2⤵
  PID:64
- C:\Windows\System\bKxnRUc.exe
  C:\Windows\System\bKxnRUc.exe
  2⤵
  PID:4488
- C:\Windows\System\ECKtppB.exe
  C:\Windows\System\ECKtppB.exe
  2⤵
  PID:5128
- C:\Windows\System\vmCyPYX.exe
  C:\Windows\System\vmCyPYX.exe
  2⤵
  PID:5184
- C:\Windows\System\WmDMiYs.exe
  C:\Windows\System\WmDMiYs.exe
  2⤵
  PID:5320
- C:\Windows\System\BoZiiMS.exe
  C:\Windows\System\BoZiiMS.exe
  2⤵
  PID:4304
- C:\Windows\System\NeWapZt.exe
  C:\Windows\System\NeWapZt.exe
  2⤵
  PID:5400
- C:\Windows\System\xGzoEmO.exe
  C:\Windows\System\xGzoEmO.exe
  2⤵
  PID:5456
- C:\Windows\System\EvwKUmb.exe
  C:\Windows\System\EvwKUmb.exe
  2⤵
  PID:5512
- C:\Windows\System\nvVbseq.exe
  C:\Windows\System\nvVbseq.exe
  2⤵
  PID:5544
- C:\Windows\System\CZyYguf.exe
  C:\Windows\System\CZyYguf.exe
  2⤵
  PID:5604
- C:\Windows\System\LHRzBoJ.exe
  C:\Windows\System\LHRzBoJ.exe
  2⤵
  PID:1516
- C:\Windows\System\pIkTRIq.exe
  C:\Windows\System\pIkTRIq.exe
  2⤵
  PID:5716
- C:\Windows\System\tvLZzMW.exe
  C:\Windows\System\tvLZzMW.exe
  2⤵
  PID:3644
- C:\Windows\System\qZHPtci.exe
  C:\Windows\System\qZHPtci.exe
  2⤵
  PID:5848
- C:\Windows\System\zokIvTb.exe
  C:\Windows\System\zokIvTb.exe
  2⤵
  PID:5904
- C:\Windows\System\zWTXjdK.exe
  C:\Windows\System\zWTXjdK.exe
  2⤵
  PID:5964
- C:\Windows\System\mqaxnVT.exe
  C:\Windows\System\mqaxnVT.exe
  2⤵
  PID:6016
- C:\Windows\System\QIOTWoG.exe
  C:\Windows\System\QIOTWoG.exe
  2⤵
  PID:1704
- C:\Windows\System\VmhFHSo.exe
  C:\Windows\System\VmhFHSo.exe
  2⤵
  PID:6128
- C:\Windows\System\ltNAwsN.exe
  C:\Windows\System\ltNAwsN.exe
  2⤵
  PID:1032
- C:\Windows\System\BiyKTvw.exe
  C:\Windows\System\BiyKTvw.exe
  2⤵
  PID:4120
- C:\Windows\System\JzYUQTV.exe
  C:\Windows\System\JzYUQTV.exe
  2⤵
  PID:840
- C:\Windows\System\BTUPDQN.exe
  C:\Windows\System\BTUPDQN.exe
  2⤵
  PID:5288
- C:\Windows\System\pTFFmav.exe
  C:\Windows\System\pTFFmav.exe
  2⤵
  PID:3288
- C:\Windows\System\GLKOkly.exe
  C:\Windows\System\GLKOkly.exe
  2⤵
  PID:5488
- C:\Windows\System\QrGgTUH.exe
  C:\Windows\System\QrGgTUH.exe
  2⤵
  PID:5596
- C:\Windows\System\tcHZvCz.exe
  C:\Windows\System\tcHZvCz.exe
  2⤵
  PID:5708
- C:\Windows\System\qxpLkWz.exe
  C:\Windows\System\qxpLkWz.exe
  2⤵
  PID:5824
- C:\Windows\System\IWAtFQb.exe
  C:\Windows\System\IWAtFQb.exe
  2⤵
  PID:5936
- C:\Windows\System\FvVMQsG.exe
  C:\Windows\System\FvVMQsG.exe
  2⤵
  PID:6048
- C:\Windows\System\VYpnEfB.exe
  C:\Windows\System\VYpnEfB.exe
  2⤵
  PID:2660
- C:\Windows\System\nrrxMRL.exe
  C:\Windows\System\nrrxMRL.exe
  2⤵
  PID:1324
- C:\Windows\System\XKwlymX.exe
  C:\Windows\System\XKwlymX.exe
  2⤵
  PID:5352
- C:\Windows\System\NSupSXu.exe
  C:\Windows\System\NSupSXu.exe
  2⤵
  PID:4812
- C:\Windows\System\pPcPAdd.exe
  C:\Windows\System\pPcPAdd.exe
  2⤵
  PID:5776
- C:\Windows\System\eVZCOmi.exe
  C:\Windows\System\eVZCOmi.exe
  2⤵
  PID:1560
- C:\Windows\System\umHbTuy.exe
  C:\Windows\System\umHbTuy.exe
  2⤵
  PID:5932
- C:\Windows\System\uvkoYjd.exe
  C:\Windows\System\uvkoYjd.exe
  2⤵
  PID:6104
- C:\Windows\System\PvtaaVl.exe
  C:\Windows\System\PvtaaVl.exe
  2⤵
  PID:5348
- C:\Windows\System\LUwtzLq.exe
  C:\Windows\System\LUwtzLq.exe
  2⤵
  PID:1480
- C:\Windows\System\qbuOIHh.exe
  C:\Windows\System\qbuOIHh.exe
  2⤵
  PID:4000
- C:\Windows\System\hWqXbXK.exe
  C:\Windows\System\hWqXbXK.exe
  2⤵
  PID:3500
- C:\Windows\System\QpUPwFI.exe
  C:\Windows\System\QpUPwFI.exe
  2⤵
  PID:5232
- C:\Windows\System\TpihzDa.exe
  C:\Windows\System\TpihzDa.exe
  2⤵
  PID:2908
- C:\Windows\System\LhKQIGq.exe
  C:\Windows\System\LhKQIGq.exe
  2⤵
  PID:1712
- C:\Windows\System\DoBhHEl.exe
  C:\Windows\System\DoBhHEl.exe
  2⤵
  PID:4324
- C:\Windows\System\jxWAYoD.exe
  C:\Windows\System\jxWAYoD.exe
  2⤵
  PID:1092
- C:\Windows\System\IkSFnnA.exe
  C:\Windows\System\IkSFnnA.exe
  2⤵
  PID:4452
- C:\Windows\System\SAODsWL.exe
  C:\Windows\System\SAODsWL.exe
  2⤵
  PID:3872
- C:\Windows\System\nuLCCra.exe
  C:\Windows\System\nuLCCra.exe
  2⤵
  PID:6164
- C:\Windows\System\ITBbugP.exe
  C:\Windows\System\ITBbugP.exe
  2⤵
  PID:6208
- C:\Windows\System\UDHcrWU.exe
  C:\Windows\System\UDHcrWU.exe
  2⤵
  PID:6240
- C:\Windows\System\nmqYgzh.exe
  C:\Windows\System\nmqYgzh.exe
  2⤵
  PID:6260
- C:\Windows\System\KPXPVkl.exe
  C:\Windows\System\KPXPVkl.exe
  2⤵
  PID:6280
- C:\Windows\System\gklbMba.exe
  C:\Windows\System\gklbMba.exe
  2⤵
  PID:6296
- C:\Windows\System\ENdSTuS.exe
  C:\Windows\System\ENdSTuS.exe
  2⤵
  PID:6316
- C:\Windows\System\KBbxrxw.exe
  C:\Windows\System\KBbxrxw.exe
  2⤵
  PID:6340
- C:\Windows\System\ntdWoyf.exe
  C:\Windows\System\ntdWoyf.exe
  2⤵
  PID:6356
- C:\Windows\System\lOJZiEo.exe
  C:\Windows\System\lOJZiEo.exe
  2⤵
  PID:6376
- C:\Windows\System\PgkGnXD.exe
  C:\Windows\System\PgkGnXD.exe
  2⤵
  PID:6436
- C:\Windows\System\hNRQuON.exe
  C:\Windows\System\hNRQuON.exe
  2⤵
  PID:6452
- C:\Windows\System\GWQewQp.exe
  C:\Windows\System\GWQewQp.exe
  2⤵
  PID:6500
- C:\Windows\System\RHdnLCP.exe
  C:\Windows\System\RHdnLCP.exe
  2⤵
  PID:6544
- C:\Windows\System\zPJKQmj.exe
  C:\Windows\System\zPJKQmj.exe
  2⤵
  PID:6584
- C:\Windows\System\zbOAYTU.exe
  C:\Windows\System\zbOAYTU.exe
  2⤵
  PID:6600
- C:\Windows\System\BETpYzh.exe
  C:\Windows\System\BETpYzh.exe
  2⤵
  PID:6620
- C:\Windows\System\MgMdtqo.exe
  C:\Windows\System\MgMdtqo.exe
  2⤵
  PID:6644
- C:\Windows\System\ETywrFe.exe
  C:\Windows\System\ETywrFe.exe
  2⤵
  PID:6696
- C:\Windows\System\MaWUYuS.exe
  C:\Windows\System\MaWUYuS.exe
  2⤵
  PID:6720
- C:\Windows\System\aMDdqOA.exe
  C:\Windows\System\aMDdqOA.exe
  2⤵
  PID:6740
- C:\Windows\System\irJvRTc.exe
  C:\Windows\System\irJvRTc.exe
  2⤵
  PID:6756
- C:\Windows\System\gCGaaqm.exe
  C:\Windows\System\gCGaaqm.exe
  2⤵
  PID:6776
- C:\Windows\System\qpEmbPj.exe
  C:\Windows\System\qpEmbPj.exe
  2⤵
  PID:6816
- C:\Windows\System\ClKGQiN.exe
  C:\Windows\System\ClKGQiN.exe
  2⤵
  PID:6840
- C:\Windows\System\iOLllLG.exe
  C:\Windows\System\iOLllLG.exe
  2⤵
  PID:6860
- C:\Windows\System\cXjFDDt.exe
  C:\Windows\System\cXjFDDt.exe
  2⤵
  PID:6884
- C:\Windows\System\UBGlZuf.exe
  C:\Windows\System\UBGlZuf.exe
  2⤵
  PID:6904
- C:\Windows\System\cZDNwPa.exe
  C:\Windows\System\cZDNwPa.exe
  2⤵
  PID:6924
- C:\Windows\System\CoYivRC.exe
  C:\Windows\System\CoYivRC.exe
  2⤵
  PID:6960
- C:\Windows\System\tEctoRg.exe
  C:\Windows\System\tEctoRg.exe
  2⤵
  PID:6996
- C:\Windows\System\jZsYiTe.exe
  C:\Windows\System\jZsYiTe.exe
  2⤵
  PID:7048
- C:\Windows\System\MnpvuLe.exe
  C:\Windows\System\MnpvuLe.exe
  2⤵
  PID:7076
- C:\Windows\System\jDMbjpo.exe
  C:\Windows\System\jDMbjpo.exe
  2⤵
  PID:7092
- C:\Windows\System\TfHFajK.exe
  C:\Windows\System\TfHFajK.exe
  2⤵
  PID:7112
- C:\Windows\System\haCJZuQ.exe
  C:\Windows\System\haCJZuQ.exe
  2⤵
  PID:7156
- C:\Windows\System\JoVIenS.exe
  C:\Windows\System\JoVIenS.exe
  2⤵
  PID:6192
- C:\Windows\System\ziuIHFy.exe
  C:\Windows\System\ziuIHFy.exe
  2⤵
  PID:6236
- C:\Windows\System\MQCnutL.exe
  C:\Windows\System\MQCnutL.exe
  2⤵
  PID:6304
- C:\Windows\System\NlrAXBT.exe
  C:\Windows\System\NlrAXBT.exe
  2⤵
  PID:6396
- C:\Windows\System\eaUJPLu.exe
  C:\Windows\System\eaUJPLu.exe
  2⤵
  PID:6420
- C:\Windows\System\DyxWtxV.exe
  C:\Windows\System\DyxWtxV.exe
  2⤵
  PID:6492
- C:\Windows\System\RLtTRYA.exe
  C:\Windows\System\RLtTRYA.exe
  2⤵
  PID:6520
- C:\Windows\System\uYffpRm.exe
  C:\Windows\System\uYffpRm.exe
  2⤵
  PID:6616
- C:\Windows\System\pNwrXxb.exe
  C:\Windows\System\pNwrXxb.exe
  2⤵
  PID:6708
- C:\Windows\System\oVwiyHu.exe
  C:\Windows\System\oVwiyHu.exe
  2⤵
  PID:6796
- C:\Windows\System\RZAunlX.exe
  C:\Windows\System\RZAunlX.exe
  2⤵
  PID:6768
- C:\Windows\System\fdFkBZL.exe
  C:\Windows\System\fdFkBZL.exe
  2⤵
  PID:6824
- C:\Windows\System\JgXCBEy.exe
  C:\Windows\System\JgXCBEy.exe
  2⤵
  PID:6896
- C:\Windows\System\YChPchu.exe
  C:\Windows\System\YChPchu.exe
  2⤵
  PID:6952
- C:\Windows\System\RGFmshb.exe
  C:\Windows\System\RGFmshb.exe
  2⤵
  PID:7068
- C:\Windows\System\XWzxIaS.exe
  C:\Windows\System\XWzxIaS.exe
  2⤵
  PID:7108
- C:\Windows\System\XeWlKwh.exe
  C:\Windows\System\XeWlKwh.exe
  2⤵
  PID:6232
- C:\Windows\System\nGnLPaz.exe
  C:\Windows\System\nGnLPaz.exe
  2⤵
  PID:6400
- C:\Windows\System\UmCkWnv.exe
  C:\Windows\System\UmCkWnv.exe
  2⤵
  PID:6592
- C:\Windows\System\CKfQNmJ.exe
  C:\Windows\System\CKfQNmJ.exe
  2⤵
  PID:6852
- C:\Windows\System\PDggRpS.exe
  C:\Windows\System\PDggRpS.exe
  2⤵
  PID:6876
- C:\Windows\System\QwvnaiO.exe
  C:\Windows\System\QwvnaiO.exe
  2⤵
  PID:6948
- C:\Windows\System\cXIZxmh.exe
  C:\Windows\System\cXIZxmh.exe
  2⤵
  PID:1028
- C:\Windows\System\uYFXQxd.exe
  C:\Windows\System\uYFXQxd.exe
  2⤵
  PID:6352
- C:\Windows\System\LqADtRt.exe
  C:\Windows\System\LqADtRt.exe
  2⤵
  PID:6732
- C:\Windows\System\ziLiWUV.exe
  C:\Windows\System\ziLiWUV.exe
  2⤵
  PID:6812
- C:\Windows\System\gMKYzKF.exe
  C:\Windows\System\gMKYzKF.exe
  2⤵
  PID:7016
- C:\Windows\System\aCMfHzq.exe
  C:\Windows\System\aCMfHzq.exe
  2⤵
  PID:7188
- C:\Windows\System\icWoGOX.exe
  C:\Windows\System\icWoGOX.exe
  2⤵
  PID:7232
- C:\Windows\System\APealVX.exe
  C:\Windows\System\APealVX.exe
  2⤵
  PID:7248
- C:\Windows\System\euLoIXH.exe
  C:\Windows\System\euLoIXH.exe
  2⤵
  PID:7280
- C:\Windows\System\OQoIpVC.exe
  C:\Windows\System\OQoIpVC.exe
  2⤵
  PID:7300
- C:\Windows\System\yIgzQRT.exe
  C:\Windows\System\yIgzQRT.exe
  2⤵
  PID:7340
- C:\Windows\System\FqUJsEA.exe
  C:\Windows\System\FqUJsEA.exe
  2⤵
  PID:7368
- C:\Windows\System\kOrsglY.exe
  C:\Windows\System\kOrsglY.exe
  2⤵
  PID:7392
- C:\Windows\System\DYCukrg.exe
  C:\Windows\System\DYCukrg.exe
  2⤵
  PID:7412
- C:\Windows\System\SiFhFLg.exe
  C:\Windows\System\SiFhFLg.exe
  2⤵
  PID:7436
- C:\Windows\System\MoHPRcg.exe
  C:\Windows\System\MoHPRcg.exe
  2⤵
  PID:7480
- C:\Windows\System\psbvIhW.exe
  C:\Windows\System\psbvIhW.exe
  2⤵
  PID:7520
- C:\Windows\System\iGcdfsS.exe
  C:\Windows\System\iGcdfsS.exe
  2⤵
  PID:7552
- C:\Windows\System\xidtWHu.exe
  C:\Windows\System\xidtWHu.exe
  2⤵
  PID:7580
- C:\Windows\System\lpqBDwH.exe
  C:\Windows\System\lpqBDwH.exe
  2⤵
  PID:7600
- C:\Windows\System\PjJUaVv.exe
  C:\Windows\System\PjJUaVv.exe
  2⤵
  PID:7632
- C:\Windows\System\uNDoYBt.exe
  C:\Windows\System\uNDoYBt.exe
  2⤵
  PID:7648
- C:\Windows\System\FAeofIt.exe
  C:\Windows\System\FAeofIt.exe
  2⤵
  PID:7672
- C:\Windows\System\BeDJgSh.exe
  C:\Windows\System\BeDJgSh.exe
  2⤵
  PID:7700
- C:\Windows\System\cyDrzpm.exe
  C:\Windows\System\cyDrzpm.exe
  2⤵
  PID:7740
- C:\Windows\System\SwpSDYC.exe
  C:\Windows\System\SwpSDYC.exe
  2⤵
  PID:7764
- C:\Windows\System\EvpkhAt.exe
  C:\Windows\System\EvpkhAt.exe
  2⤵
  PID:7784
- C:\Windows\System\ypqWOtb.exe
  C:\Windows\System\ypqWOtb.exe
  2⤵
  PID:7808
- C:\Windows\System\tXFQXeQ.exe
  C:\Windows\System\tXFQXeQ.exe
  2⤵
  PID:7844
- C:\Windows\System\KazkaUF.exe
  C:\Windows\System\KazkaUF.exe
  2⤵
  PID:7864
- C:\Windows\System\dCFaTxd.exe
  C:\Windows\System\dCFaTxd.exe
  2⤵
  PID:7904
- C:\Windows\System\eRyEYBC.exe
  C:\Windows\System\eRyEYBC.exe
  2⤵
  PID:7948
- C:\Windows\System\MENhRag.exe
  C:\Windows\System\MENhRag.exe
  2⤵
  PID:7972
- C:\Windows\System\OUmCqGX.exe
  C:\Windows\System\OUmCqGX.exe
  2⤵
  PID:7992
- C:\Windows\System\yZwsQfO.exe
  C:\Windows\System\yZwsQfO.exe
  2⤵
  PID:8040
- C:\Windows\System\QubTreq.exe
  C:\Windows\System\QubTreq.exe
  2⤵
  PID:8056
- C:\Windows\System\iCqsbCk.exe
  C:\Windows\System\iCqsbCk.exe
  2⤵
  PID:8096
- C:\Windows\System\yiOtlQa.exe
  C:\Windows\System\yiOtlQa.exe
  2⤵
  PID:8112
- C:\Windows\System\JUYGOhg.exe
  C:\Windows\System\JUYGOhg.exe
  2⤵
  PID:8152
- C:\Windows\System\ElTidNv.exe
  C:\Windows\System\ElTidNv.exe
  2⤵
  PID:8172
- C:\Windows\System\yzAQlxg.exe
  C:\Windows\System\yzAQlxg.exe
  2⤵
  PID:6464
- C:\Windows\System\WFSlRsg.exe
  C:\Windows\System\WFSlRsg.exe
  2⤵
  PID:7256
- C:\Windows\System\GRCaWht.exe
  C:\Windows\System\GRCaWht.exe
  2⤵
  PID:7292
- C:\Windows\System\LvwLfVd.exe
  C:\Windows\System\LvwLfVd.exe
  2⤵
  PID:7348
- C:\Windows\System\PUAzstX.exe
  C:\Windows\System\PUAzstX.exe
  2⤵
  PID:7364
- C:\Windows\System\TcLAOGK.exe
  C:\Windows\System\TcLAOGK.exe
  2⤵
  PID:7380
- C:\Windows\System\nvmMDGN.exe
  C:\Windows\System\nvmMDGN.exe
  2⤵
  PID:7504
- C:\Windows\System\WsYnudP.exe
  C:\Windows\System\WsYnudP.exe
  2⤵
  PID:7532
- C:\Windows\System\KGQNPmr.exe
  C:\Windows\System\KGQNPmr.exe
  2⤵
  PID:7612
- C:\Windows\System\fReqjks.exe
  C:\Windows\System\fReqjks.exe
  2⤵
  PID:6892
- C:\Windows\System\drfrFrg.exe
  C:\Windows\System\drfrFrg.exe
  2⤵
  PID:7668
- C:\Windows\System\ZsTcNeZ.exe
  C:\Windows\System\ZsTcNeZ.exe
  2⤵
  PID:7756
- C:\Windows\System\aHLxlfW.exe
  C:\Windows\System\aHLxlfW.exe
  2⤵
  PID:7896
- C:\Windows\System\UuhRNvM.exe
  C:\Windows\System\UuhRNvM.exe
  2⤵
  PID:7900
- C:\Windows\System\QfCjIOz.exe
  C:\Windows\System\QfCjIOz.exe
  2⤵
  PID:7988
- C:\Windows\System\HKyrLka.exe
  C:\Windows\System\HKyrLka.exe
  2⤵
  PID:8104
- C:\Windows\System\KNosbXt.exe
  C:\Windows\System\KNosbXt.exe
  2⤵
  PID:8148
- C:\Windows\System\TOcMqwJ.exe
  C:\Windows\System\TOcMqwJ.exe
  2⤵
  PID:7172
- C:\Windows\System\lzZHiss.exe
  C:\Windows\System\lzZHiss.exe
  2⤵
  PID:7240
- C:\Windows\System\ybvPRDz.exe
  C:\Windows\System\ybvPRDz.exe
  2⤵
  PID:7320
- C:\Windows\System\ovikkoC.exe
  C:\Windows\System\ovikkoC.exe
  2⤵
  PID:7404
- C:\Windows\System\DDXNOMJ.exe
  C:\Windows\System\DDXNOMJ.exe
  2⤵
  PID:7616
- C:\Windows\System\DChIrik.exe
  C:\Windows\System\DChIrik.exe
  2⤵
  PID:7804
- C:\Windows\System\oSzUtUk.exe
  C:\Windows\System\oSzUtUk.exe
  2⤵
  PID:7228
- C:\Windows\System\oGWPgFV.exe
  C:\Windows\System\oGWPgFV.exe
  2⤵
  PID:7296
- C:\Windows\System\AeeCphS.exe
  C:\Windows\System\AeeCphS.exe
  2⤵
  PID:7596
- C:\Windows\System\IPwqVIt.exe
  C:\Windows\System\IPwqVIt.exe
  2⤵
  PID:7748
- C:\Windows\System\hEjmIDv.exe
  C:\Windows\System\hEjmIDv.exe
  2⤵
  PID:7572
- C:\Windows\System\ncrvhOJ.exe
  C:\Windows\System\ncrvhOJ.exe
  2⤵
  PID:8200
- C:\Windows\System\UJpSmET.exe
  C:\Windows\System\UJpSmET.exe
  2⤵
  PID:8220
- C:\Windows\System\DzMsaYx.exe
  C:\Windows\System\DzMsaYx.exe
  2⤵
  PID:8248
- C:\Windows\System\niYpisW.exe
  C:\Windows\System\niYpisW.exe
  2⤵
  PID:8320
- C:\Windows\System\PGRGJDQ.exe
  C:\Windows\System\PGRGJDQ.exe
  2⤵
  PID:8336
- C:\Windows\System\ZiYEUxN.exe
  C:\Windows\System\ZiYEUxN.exe
  2⤵
  PID:8376
- C:\Windows\System\HtLuFbQ.exe
  C:\Windows\System\HtLuFbQ.exe
  2⤵
  PID:8396
- C:\Windows\System\xtBOMUn.exe
  C:\Windows\System\xtBOMUn.exe
  2⤵
  PID:8420
- C:\Windows\System\HbWRzSd.exe
  C:\Windows\System\HbWRzSd.exe
  2⤵
  PID:8440
- C:\Windows\System\CtEdhBJ.exe
  C:\Windows\System\CtEdhBJ.exe
  2⤵
  PID:8464
- C:\Windows\System\MbHwvgG.exe
  C:\Windows\System\MbHwvgG.exe
  2⤵
  PID:8504
- C:\Windows\System\aFLnnFb.exe
  C:\Windows\System\aFLnnFb.exe
  2⤵
  PID:8524
- C:\Windows\System\JXCKqfF.exe
  C:\Windows\System\JXCKqfF.exe
  2⤵
  PID:8548
- C:\Windows\System\cPMuKUF.exe
  C:\Windows\System\cPMuKUF.exe
  2⤵
  PID:8592
- C:\Windows\System\XtLNftq.exe
  C:\Windows\System\XtLNftq.exe
  2⤵
  PID:8620
- C:\Windows\System\Dwmmbck.exe
  C:\Windows\System\Dwmmbck.exe
  2⤵
  PID:8644
- C:\Windows\System\ePWSzuC.exe
  C:\Windows\System\ePWSzuC.exe
  2⤵
  PID:8664
- C:\Windows\System\mFrrMbn.exe
  C:\Windows\System\mFrrMbn.exe
  2⤵
  PID:8700
- C:\Windows\System\CmBmjdX.exe
  C:\Windows\System\CmBmjdX.exe
  2⤵
  PID:8728
- C:\Windows\System\fLbylPQ.exe
  C:\Windows\System\fLbylPQ.exe
  2⤵
  PID:8772
- C:\Windows\System\eevQcNa.exe
  C:\Windows\System\eevQcNa.exe
  2⤵
  PID:8796
- C:\Windows\System\FZEmJZk.exe
  C:\Windows\System\FZEmJZk.exe
  2⤵
  PID:8820
- C:\Windows\System\VMVsaUW.exe
  C:\Windows\System\VMVsaUW.exe
  2⤵
  PID:8844
- C:\Windows\System\gZniAWD.exe
  C:\Windows\System\gZniAWD.exe
  2⤵
  PID:8868
- C:\Windows\System\hdleRRp.exe
  C:\Windows\System\hdleRRp.exe
  2⤵
  PID:8892
- C:\Windows\System\dzNoxch.exe
  C:\Windows\System\dzNoxch.exe
  2⤵
  PID:8928
- C:\Windows\System\mOQNvPZ.exe
  C:\Windows\System\mOQNvPZ.exe
  2⤵
  PID:8948
- C:\Windows\System\hTjktjh.exe
  C:\Windows\System\hTjktjh.exe
  2⤵
  PID:8968
- C:\Windows\System\XGOxctl.exe
  C:\Windows\System\XGOxctl.exe
  2⤵
  PID:9000
- C:\Windows\System\gioIRXH.exe
  C:\Windows\System\gioIRXH.exe
  2⤵
  PID:9020
- C:\Windows\System\YUWzXBR.exe
  C:\Windows\System\YUWzXBR.exe
  2⤵
  PID:9060
- C:\Windows\System\rdNPIHz.exe
  C:\Windows\System\rdNPIHz.exe
  2⤵
  PID:9092
- C:\Windows\System\EgWQsdo.exe
  C:\Windows\System\EgWQsdo.exe
  2⤵
  PID:9116
- C:\Windows\System\jEmaLtw.exe
  C:\Windows\System\jEmaLtw.exe
  2⤵
  PID:9132
- C:\Windows\System\OmyEmrr.exe
  C:\Windows\System\OmyEmrr.exe
  2⤵
  PID:9152
- C:\Windows\System\qCguJfy.exe
  C:\Windows\System\qCguJfy.exe
  2⤵
  PID:9172
- C:\Windows\System\UQgSIXr.exe
  C:\Windows\System\UQgSIXr.exe
  2⤵
  PID:9200
- C:\Windows\System\PpAtUOE.exe
  C:\Windows\System\PpAtUOE.exe
  2⤵
  PID:8212
- C:\Windows\System\qCRAZMY.exe
  C:\Windows\System\qCRAZMY.exe
  2⤵
  PID:7732
- C:\Windows\System\OppWAhc.exe
  C:\Windows\System\OppWAhc.exe
  2⤵
  PID:8264
- C:\Windows\System\fVQDYzy.exe
  C:\Windows\System\fVQDYzy.exe
  2⤵
  PID:8372
- C:\Windows\System\LWHLtmN.exe
  C:\Windows\System\LWHLtmN.exe
  2⤵
  PID:8480
- C:\Windows\System\pKSxztO.exe
  C:\Windows\System\pKSxztO.exe
  2⤵
  PID:8568
- C:\Windows\System\hpoMgLs.exe
  C:\Windows\System\hpoMgLs.exe
  2⤵
  PID:8636
- C:\Windows\System\ZjeaNoD.exe
  C:\Windows\System\ZjeaNoD.exe
  2⤵
  PID:8660
- C:\Windows\System\NmLmMZd.exe
  C:\Windows\System\NmLmMZd.exe
  2⤵
  PID:8696
- C:\Windows\System\OosDcAA.exe
  C:\Windows\System\OosDcAA.exe
  2⤵
  PID:8808
- C:\Windows\System\gpcUfIs.exe
  C:\Windows\System\gpcUfIs.exe
  2⤵
  PID:8856
- C:\Windows\System\IUzsFWF.exe
  C:\Windows\System\IUzsFWF.exe
  2⤵
  PID:8904
- C:\Windows\System\cFoRphb.exe
  C:\Windows\System\cFoRphb.exe
  2⤵
  PID:8980
- C:\Windows\System\UbsazqV.exe
  C:\Windows\System\UbsazqV.exe
  2⤵
  PID:9084
- C:\Windows\System\fgNEjgi.exe
  C:\Windows\System\fgNEjgi.exe
  2⤵
  PID:9100
- C:\Windows\System\hmegmFd.exe
  C:\Windows\System\hmegmFd.exe
  2⤵
  PID:9168
- C:\Windows\System\QZKLXrr.exe
  C:\Windows\System\QZKLXrr.exe
  2⤵
  PID:9208
- C:\Windows\System\yRBFIMP.exe
  C:\Windows\System\yRBFIMP.exe
  2⤵
  PID:8368
- C:\Windows\System\PybVqAo.exe
  C:\Windows\System\PybVqAo.exe
  2⤵
  PID:8628
- C:\Windows\System\EQaEMYx.exe
  C:\Windows\System\EQaEMYx.exe
  2⤵
  PID:8756
- C:\Windows\System\neTYcWn.exe
  C:\Windows\System\neTYcWn.exe
  2⤵
  PID:8692
- C:\Windows\System\JWFCVqn.exe
  C:\Windows\System\JWFCVqn.exe
  2⤵
  PID:8912
- C:\Windows\System\nUoujzN.exe
  C:\Windows\System\nUoujzN.exe
  2⤵
  PID:8988
- C:\Windows\System\aAmnaTq.exe
  C:\Windows\System\aAmnaTq.exe
  2⤵
  PID:8584
- C:\Windows\System\rQcGhDk.exe
  C:\Windows\System\rQcGhDk.exe
  2⤵
  PID:9232
- C:\Windows\System\cARujJP.exe
  C:\Windows\System\cARujJP.exe
  2⤵
  PID:9260
- C:\Windows\System\mkfhalL.exe
  C:\Windows\System\mkfhalL.exe
  2⤵
  PID:9332
- C:\Windows\System\vbpblbR.exe
  C:\Windows\System\vbpblbR.exe
  2⤵
  PID:9376
- C:\Windows\System\UWpMhVd.exe
  C:\Windows\System\UWpMhVd.exe
  2⤵
  PID:9404
- C:\Windows\System\iYteWFd.exe
  C:\Windows\System\iYteWFd.exe
  2⤵
  PID:9424
- C:\Windows\System\TZDFxJE.exe
  C:\Windows\System\TZDFxJE.exe
  2⤵
  PID:9460
- C:\Windows\System\JErzOyZ.exe
  C:\Windows\System\JErzOyZ.exe
  2⤵
  PID:9524
- C:\Windows\System\wLwtNvg.exe
  C:\Windows\System\wLwtNvg.exe
  2⤵
  PID:9540
- C:\Windows\System\cliHdTI.exe
  C:\Windows\System\cliHdTI.exe
  2⤵
  PID:9576
- C:\Windows\System\OymKhsr.exe
  C:\Windows\System\OymKhsr.exe
  2⤵
  PID:9596
- C:\Windows\System\ePOoolu.exe
  C:\Windows\System\ePOoolu.exe
  2⤵
  PID:9632
- C:\Windows\System\rTJgSrP.exe
  C:\Windows\System\rTJgSrP.exe
  2⤵
  PID:9648
- C:\Windows\System\YHlExQV.exe
  C:\Windows\System\YHlExQV.exe
  2⤵
  PID:9672
- C:\Windows\System\pGLbSAu.exe
  C:\Windows\System\pGLbSAu.exe
  2⤵
  PID:9704
- C:\Windows\System\rOrVcYx.exe
  C:\Windows\System\rOrVcYx.exe
  2⤵
  PID:9724
- C:\Windows\System\VUZsPGc.exe
  C:\Windows\System\VUZsPGc.exe
  2⤵
  PID:9744
- C:\Windows\System\NwiyFsF.exe
  C:\Windows\System\NwiyFsF.exe
  2⤵
  PID:9764
- C:\Windows\System\rWZCwFC.exe
  C:\Windows\System\rWZCwFC.exe
  2⤵
  PID:9784
- C:\Windows\System\CiBBiIE.exe
  C:\Windows\System\CiBBiIE.exe
  2⤵
  PID:9844
- C:\Windows\System\dTpEgMy.exe
  C:\Windows\System\dTpEgMy.exe
  2⤵
  PID:9864
- C:\Windows\System\WmLvOim.exe
  C:\Windows\System\WmLvOim.exe
  2⤵
  PID:9900
- C:\Windows\System\QjQLdeT.exe
  C:\Windows\System\QjQLdeT.exe
  2⤵
  PID:9932
- C:\Windows\System\THrIBRM.exe
  C:\Windows\System\THrIBRM.exe
  2⤵
  PID:9968
- C:\Windows\System\UGlVBTh.exe
  C:\Windows\System\UGlVBTh.exe
  2⤵
  PID:9988
- C:\Windows\System\rhedhpu.exe
  C:\Windows\System\rhedhpu.exe
  2⤵
  PID:10012
- C:\Windows\System\oGOpdrZ.exe
  C:\Windows\System\oGOpdrZ.exe
  2⤵
  PID:10036
- C:\Windows\System\RyyoGpl.exe
  C:\Windows\System\RyyoGpl.exe
  2⤵
  PID:10084
- C:\Windows\System\xDeDZLJ.exe
  C:\Windows\System\xDeDZLJ.exe
  2⤵
  PID:10112
- C:\Windows\System\WXaazCP.exe
  C:\Windows\System\WXaazCP.exe
  2⤵
  PID:10132
- C:\Windows\System\RlNQkAD.exe
  C:\Windows\System\RlNQkAD.exe
  2⤵
  PID:10156
- C:\Windows\System\kTCHLbK.exe
  C:\Windows\System\kTCHLbK.exe
  2⤵
  PID:10184
- C:\Windows\System\jwmSiKx.exe
  C:\Windows\System\jwmSiKx.exe
  2⤵
  PID:10208
- C:\Windows\System\LreLEwb.exe
  C:\Windows\System\LreLEwb.exe
  2⤵
  PID:10232
- C:\Windows\System\ByGhYPa.exe
  C:\Windows\System\ByGhYPa.exe
  2⤵
  PID:8300
- C:\Windows\System\CJLpIVb.exe
  C:\Windows\System\CJLpIVb.exe
  2⤵
  PID:9224
- C:\Windows\System\KIikzJW.exe
  C:\Windows\System\KIikzJW.exe
  2⤵
  PID:9272
- C:\Windows\System\gGCsuED.exe
  C:\Windows\System\gGCsuED.exe
  2⤵
  PID:9344
- C:\Windows\System\nyJDHmH.exe
  C:\Windows\System\nyJDHmH.exe
  2⤵
  PID:9252
- C:\Windows\System\gTrWzEn.exe
  C:\Windows\System\gTrWzEn.exe
  2⤵
  PID:9316
- C:\Windows\System\ncDysfK.exe
  C:\Windows\System\ncDysfK.exe
  2⤵
  PID:9396
- C:\Windows\System\rWFDFRK.exe
  C:\Windows\System\rWFDFRK.exe
  2⤵
  PID:9468
- C:\Windows\System\Spmnkpl.exe
  C:\Windows\System\Spmnkpl.exe
  2⤵
  PID:9532
- C:\Windows\System\KZQQjvs.exe
  C:\Windows\System\KZQQjvs.exe
  2⤵
  PID:9644
- C:\Windows\System\ChCMcdq.exe
  C:\Windows\System\ChCMcdq.exe
  2⤵
  PID:9680
- C:\Windows\System\KWBtzzo.exe
  C:\Windows\System\KWBtzzo.exe
  2⤵
  PID:9816
- C:\Windows\System\oKpHJXh.exe
  C:\Windows\System\oKpHJXh.exe
  2⤵
  PID:9776
- C:\Windows\System\iBKOSBw.exe
  C:\Windows\System\iBKOSBw.exe
  2⤵
  PID:9852
- C:\Windows\System\GmYqyLu.exe
  C:\Windows\System\GmYqyLu.exe
  2⤵
  PID:9928
- C:\Windows\System\GNKoeuf.exe
  C:\Windows\System\GNKoeuf.exe
  2⤵
  PID:9952
- C:\Windows\System\ZTRvVHd.exe
  C:\Windows\System\ZTRvVHd.exe
  2⤵
  PID:10096
- C:\Windows\System\uuwbbfS.exe
  C:\Windows\System\uuwbbfS.exe
  2⤵
  PID:10196
- C:\Windows\System\JtWjlaP.exe
  C:\Windows\System\JtWjlaP.exe
  2⤵
  PID:9148
- C:\Windows\System\zayAbbw.exe
  C:\Windows\System\zayAbbw.exe
  2⤵
  PID:9288
- C:\Windows\System\jfRaOuE.exe
  C:\Windows\System\jfRaOuE.exe
  2⤵
  PID:3704
- C:\Windows\System\rFTbZqB.exe
  C:\Windows\System\rFTbZqB.exe
  2⤵
  PID:9412
- C:\Windows\System\xchwOgI.exe
  C:\Windows\System\xchwOgI.exe
  2⤵
  PID:9548
- C:\Windows\System\MaawETY.exe
  C:\Windows\System\MaawETY.exe
  2⤵
  PID:9780
- C:\Windows\System\GuSpUlS.exe
  C:\Windows\System\GuSpUlS.exe
  2⤵
  PID:9760
- C:\Windows\System\pxkVdZP.exe
  C:\Windows\System\pxkVdZP.exe
  2⤵
  PID:9940
- C:\Windows\System\UyhupXi.exe
  C:\Windows\System\UyhupXi.exe
  2⤵
  PID:10200
- C:\Windows\System\BohfPGo.exe
  C:\Windows\System\BohfPGo.exe
  2⤵
  PID:10164
- C:\Windows\System\PSGNYIx.exe
  C:\Windows\System\PSGNYIx.exe
  2⤵
  PID:9684
- C:\Windows\System\hDKrJdJ.exe
  C:\Windows\System\hDKrJdJ.exe
  2⤵
  PID:9752
- C:\Windows\System\pFDPLDI.exe
  C:\Windows\System\pFDPLDI.exe
  2⤵
  PID:10020
- C:\Windows\System\ZdbiPbx.exe
  C:\Windows\System\ZdbiPbx.exe
  2⤵
  PID:8484
- C:\Windows\System\YGpHlLk.exe
  C:\Windows\System\YGpHlLk.exe
  2⤵
  PID:9624
- C:\Windows\System\PKYIPvX.exe
  C:\Windows\System\PKYIPvX.exe
  2⤵
  PID:10264
- C:\Windows\System\SlIIUFY.exe
  C:\Windows\System\SlIIUFY.exe
  2⤵
  PID:10288
- C:\Windows\System\XbyACTd.exe
  C:\Windows\System\XbyACTd.exe
  2⤵
  PID:10308
- C:\Windows\System\CPfWGHd.exe
  C:\Windows\System\CPfWGHd.exe
  2⤵
  PID:10332
- C:\Windows\System\GsYPjaM.exe
  C:\Windows\System\GsYPjaM.exe
  2⤵
  PID:10376
- C:\Windows\System\KHlKpmu.exe
  C:\Windows\System\KHlKpmu.exe
  2⤵
  PID:10396
- C:\Windows\System\MJXUypA.exe
  C:\Windows\System\MJXUypA.exe
  2⤵
  PID:10420
- C:\Windows\System\WZtImnl.exe
  C:\Windows\System\WZtImnl.exe
  2⤵
  PID:10464
- C:\Windows\System\qOPHbFh.exe
  C:\Windows\System\qOPHbFh.exe
  2⤵
  PID:10484
- C:\Windows\System\KvdoXse.exe
  C:\Windows\System\KvdoXse.exe
  2⤵
  PID:10512
- C:\Windows\System\dIKszMW.exe
  C:\Windows\System\dIKszMW.exe
  2⤵
  PID:10552
- C:\Windows\System\MbJvUFw.exe
  C:\Windows\System\MbJvUFw.exe
  2⤵
  PID:10612
- C:\Windows\System\PwwyJln.exe
  C:\Windows\System\PwwyJln.exe
  2⤵
  PID:10636
- C:\Windows\System\XdMLTVi.exe
  C:\Windows\System\XdMLTVi.exe
  2⤵
  PID:10656
- C:\Windows\System\czffmZw.exe
  C:\Windows\System\czffmZw.exe
  2⤵
  PID:10676
- C:\Windows\System\pBIskJR.exe
  C:\Windows\System\pBIskJR.exe
  2⤵
  PID:10704
- C:\Windows\System\etspHYt.exe
  C:\Windows\System\etspHYt.exe
  2⤵
  PID:10732
- C:\Windows\System\RyPQgJK.exe
  C:\Windows\System\RyPQgJK.exe
  2⤵
  PID:10768
- C:\Windows\System\gnNKBaJ.exe
  C:\Windows\System\gnNKBaJ.exe
  2⤵
  PID:10808
- C:\Windows\System\KMXNyvx.exe
  C:\Windows\System\KMXNyvx.exe
  2⤵
  PID:10824
- C:\Windows\System\tTKyaIH.exe
  C:\Windows\System\tTKyaIH.exe
  2⤵
  PID:10844
- C:\Windows\System\zfyODWq.exe
  C:\Windows\System\zfyODWq.exe
  2⤵
  PID:10868
- C:\Windows\System\tqzWuwx.exe
  C:\Windows\System\tqzWuwx.exe
  2⤵
  PID:10888
- C:\Windows\System\eNEbfDz.exe
  C:\Windows\System\eNEbfDz.exe
  2⤵
  PID:10940
- C:\Windows\System\qrdTxHp.exe
  C:\Windows\System\qrdTxHp.exe
  2⤵
  PID:10964
- C:\Windows\System\wUCgsbv.exe
  C:\Windows\System\wUCgsbv.exe
  2⤵
  PID:10996
- C:\Windows\System\btCeYMe.exe
  C:\Windows\System\btCeYMe.exe
  2⤵
  PID:11016
- C:\Windows\System\BLoZFyd.exe
  C:\Windows\System\BLoZFyd.exe
  2⤵
  PID:11044
- C:\Windows\System\rgOfmZF.exe
  C:\Windows\System\rgOfmZF.exe
  2⤵
  PID:11068
- C:\Windows\System\edGJpmz.exe
  C:\Windows\System\edGJpmz.exe
  2⤵
  PID:11088
- C:\Windows\System\SOrPrdt.exe
  C:\Windows\System\SOrPrdt.exe
  2⤵
  PID:11108
- C:\Windows\System\wYCeErJ.exe
  C:\Windows\System\wYCeErJ.exe
  2⤵
  PID:11140
- C:\Windows\System\DqdOBMF.exe
  C:\Windows\System\DqdOBMF.exe
  2⤵
  PID:11184
- C:\Windows\System\cSoaCte.exe
  C:\Windows\System\cSoaCte.exe
  2⤵
  PID:11208
- C:\Windows\System\MXSizJs.exe
  C:\Windows\System\MXSizJs.exe
  2⤵
  PID:11236
- C:\Windows\System\FjYYbPw.exe
  C:\Windows\System\FjYYbPw.exe
  2⤵
  PID:10092
- C:\Windows\System\ucqSaWE.exe
  C:\Windows\System\ucqSaWE.exe
  2⤵
  PID:10272
- C:\Windows\System\UqDEjRH.exe
  C:\Windows\System\UqDEjRH.exe
  2⤵
  PID:10372
- C:\Windows\System\MuCGcAz.exe
  C:\Windows\System\MuCGcAz.exe
  2⤵
  PID:10368
- C:\Windows\System\VKBCFkn.exe
  C:\Windows\System\VKBCFkn.exe
  2⤵
  PID:10520
- C:\Windows\System\eAKRzUt.exe
  C:\Windows\System\eAKRzUt.exe
  2⤵
  PID:10500
- C:\Windows\System\SdnUooQ.exe
  C:\Windows\System\SdnUooQ.exe
  2⤵
  PID:10568
- C:\Windows\System\dYocPhL.exe
  C:\Windows\System\dYocPhL.exe
  2⤵
  PID:10648
- C:\Windows\System\LOXZwRc.exe
  C:\Windows\System\LOXZwRc.exe
  2⤵
  PID:10712
- C:\Windows\System\KpDEQiC.exe
  C:\Windows\System\KpDEQiC.exe
  2⤵
  PID:10752
- C:\Windows\System\ovrjizN.exe
  C:\Windows\System\ovrjizN.exe
  2⤵
  PID:10804
- C:\Windows\System\vNhaxhR.exe
  C:\Windows\System\vNhaxhR.exe
  2⤵
  PID:10852
- C:\Windows\System\sLBBMZC.exe
  C:\Windows\System\sLBBMZC.exe
  2⤵
  PID:10896
- C:\Windows\System\vOGbraz.exe
  C:\Windows\System\vOGbraz.exe
  2⤵
  PID:10936
- C:\Windows\System\pkgxFrH.exe
  C:\Windows\System\pkgxFrH.exe
  2⤵
  PID:11096
- C:\Windows\System\EOHsmnx.exe
  C:\Windows\System\EOHsmnx.exe
  2⤵
  PID:9356
- C:\Windows\System\GpCATBV.exe
  C:\Windows\System\GpCATBV.exe
  2⤵
  PID:11204
- C:\Windows\System\CBflMry.exe
  C:\Windows\System\CBflMry.exe
  2⤵
  PID:10364
- C:\Windows\System\aKZsPas.exe
  C:\Windows\System\aKZsPas.exe
  2⤵
  PID:10436
- C:\Windows\System\ebJbKuN.exe
  C:\Windows\System\ebJbKuN.exe
  2⤵
  PID:10476
- C:\Windows\System\MwUgytR.exe
  C:\Windows\System\MwUgytR.exe
  2⤵
  PID:10608
- C:\Windows\System\dyrTJXH.exe
  C:\Windows\System\dyrTJXH.exe
  2⤵
  PID:10672
- C:\Windows\System\oMzfGxW.exe
  C:\Windows\System\oMzfGxW.exe
  2⤵
  PID:11128
- C:\Windows\System\PzLqRud.exe
  C:\Windows\System\PzLqRud.exe
  2⤵
  PID:11176
- C:\Windows\System\HXCMabI.exe
  C:\Windows\System\HXCMabI.exe
  2⤵
  PID:10328
- C:\Windows\System\LLhQkjI.exe
  C:\Windows\System\LLhQkjI.exe
  2⤵
  PID:10592
- C:\Windows\System\EGLcPYj.exe
  C:\Windows\System\EGLcPYj.exe
  2⤵
  PID:10840
- C:\Windows\System\dNWHFjS.exe
  C:\Windows\System\dNWHFjS.exe
  2⤵
  PID:11228
- C:\Windows\System\pVvTHVa.exe
  C:\Windows\System\pVvTHVa.exe
  2⤵
  PID:11292
- C:\Windows\System\DVMhEsZ.exe
  C:\Windows\System\DVMhEsZ.exe
  2⤵
  PID:11312
- C:\Windows\System\zuSWPVc.exe
  C:\Windows\System\zuSWPVc.exe
  2⤵
  PID:11332
- C:\Windows\System\vDhELwX.exe
  C:\Windows\System\vDhELwX.exe
  2⤵
  PID:11376
- C:\Windows\System\OJgUpvN.exe
  C:\Windows\System\OJgUpvN.exe
  2⤵
  PID:11436
- C:\Windows\System\ZyUSgMk.exe
  C:\Windows\System\ZyUSgMk.exe
  2⤵
  PID:11464
- C:\Windows\System\KYckOnX.exe
  C:\Windows\System\KYckOnX.exe
  2⤵
  PID:11484
- C:\Windows\System\BlolKka.exe
  C:\Windows\System\BlolKka.exe
  2⤵
  PID:11504
- C:\Windows\System\cdMJXOH.exe
  C:\Windows\System\cdMJXOH.exe
  2⤵
  PID:11532
- C:\Windows\System\SmFGxDg.exe
  C:\Windows\System\SmFGxDg.exe
  2⤵
  PID:11556
- C:\Windows\System\gQtcNVb.exe
  C:\Windows\System\gQtcNVb.exe
  2⤵
  PID:11588
- C:\Windows\System\Nnammwn.exe
  C:\Windows\System\Nnammwn.exe
  2⤵
  PID:11620
- C:\Windows\System\DnvlATl.exe
  C:\Windows\System\DnvlATl.exe
  2⤵
  PID:11640
- C:\Windows\System\GKnJfGa.exe
  C:\Windows\System\GKnJfGa.exe
  2⤵
  PID:11688
- C:\Windows\System\lFHSESL.exe
  C:\Windows\System\lFHSESL.exe
  2⤵
  PID:11712
- C:\Windows\System\bJgVore.exe
  C:\Windows\System\bJgVore.exe
  2⤵
  PID:11728
- C:\Windows\System\FCNpZBh.exe
  C:\Windows\System\FCNpZBh.exe
  2⤵
  PID:11756
- C:\Windows\System\CUlKKdN.exe
  C:\Windows\System\CUlKKdN.exe
  2⤵
  PID:11788
- C:\Windows\System\ALQqcyr.exe
  C:\Windows\System\ALQqcyr.exe
  2⤵
  PID:11804
- C:\Windows\System\wiVrZOi.exe
  C:\Windows\System\wiVrZOi.exe
  2⤵
  PID:11824
- C:\Windows\System\gofguFe.exe
  C:\Windows\System\gofguFe.exe
  2⤵
  PID:11852
- C:\Windows\System\WTHzEjD.exe
  C:\Windows\System\WTHzEjD.exe
  2⤵
  PID:11904
- C:\Windows\System\OLJvPIe.exe
  C:\Windows\System\OLJvPIe.exe
  2⤵
  PID:11928
- C:\Windows\System\XjyIplw.exe
  C:\Windows\System\XjyIplw.exe
  2⤵
  PID:11948
- C:\Windows\System\DmSEBjv.exe
  C:\Windows\System\DmSEBjv.exe
  2⤵
  PID:11980
- C:\Windows\System\zTAfWCT.exe
  C:\Windows\System\zTAfWCT.exe
  2⤵
  PID:12016
- C:\Windows\System\BfpcglR.exe
  C:\Windows\System\BfpcglR.exe
  2⤵
  PID:12036
- C:\Windows\System\qxuRAlJ.exe
  C:\Windows\System\qxuRAlJ.exe
  2⤵
  PID:12072
- C:\Windows\System\JosmtxG.exe
  C:\Windows\System\JosmtxG.exe
  2⤵
  PID:12092
- C:\Windows\System\woUWZDZ.exe
  C:\Windows\System\woUWZDZ.exe
  2⤵
  PID:12148
- C:\Windows\System\tiSoWxI.exe
  C:\Windows\System\tiSoWxI.exe
  2⤵
  PID:12168
- C:\Windows\System\gIMYxQx.exe
  C:\Windows\System\gIMYxQx.exe
  2⤵
  PID:12200
- C:\Windows\System\KAROhrq.exe
  C:\Windows\System\KAROhrq.exe
  2⤵
  PID:12220
- C:\Windows\System\xbUnlHu.exe
  C:\Windows\System\xbUnlHu.exe
  2⤵
  PID:12236
- C:\Windows\System\ztOGxhm.exe
  C:\Windows\System\ztOGxhm.exe
  2⤵
  PID:10800
- C:\Windows\System\DLVITqi.exe
  C:\Windows\System\DLVITqi.exe
  2⤵
  PID:11056
- C:\Windows\System\XycuJyM.exe
  C:\Windows\System\XycuJyM.exe
  2⤵
  PID:11368
- C:\Windows\System\CKDnlGf.exe
  C:\Windows\System\CKDnlGf.exe
  2⤵
  PID:11408
- C:\Windows\System\qYYuHVM.exe
  C:\Windows\System\qYYuHVM.exe
  2⤵
  PID:11480
- C:\Windows\System\BhYGFAr.exe
  C:\Windows\System\BhYGFAr.exe
  2⤵
  PID:11540
- C:\Windows\System\qVfxOHq.exe
  C:\Windows\System\qVfxOHq.exe
  2⤵
  PID:11584
- C:\Windows\System\anRbCDF.exe
  C:\Windows\System\anRbCDF.exe
  2⤵
  PID:11696
- C:\Windows\System\ArkPPDn.exe
  C:\Windows\System\ArkPPDn.exe
  2⤵
  PID:11680
- C:\Windows\System\yUOhXST.exe
  C:\Windows\System\yUOhXST.exe
  2⤵
  PID:11764
- C:\Windows\System\eaSZoAi.exe
  C:\Windows\System\eaSZoAi.exe
  2⤵
  PID:11848
- C:\Windows\System\bviVyCR.exe
  C:\Windows\System\bviVyCR.exe
  2⤵
  PID:11916
- C:\Windows\System\OHvZhBY.exe
  C:\Windows\System\OHvZhBY.exe
  2⤵
  PID:11960
- C:\Windows\System\YixAjeK.exe
  C:\Windows\System\YixAjeK.exe
  2⤵
  PID:12008
- C:\Windows\System\lFklGSt.exe
  C:\Windows\System\lFklGSt.exe
  2⤵
  PID:12064
- C:\Windows\System\mbBkZOn.exe
  C:\Windows\System\mbBkZOn.exe
  2⤵
  PID:12088
- C:\Windows\System\zLsgazx.exe
  C:\Windows\System\zLsgazx.exe
  2⤵
  PID:12180
- C:\Windows\System\rvbvGOu.exe
  C:\Windows\System\rvbvGOu.exe
  2⤵
  PID:12232
- C:\Windows\System\KvEjdWW.exe
  C:\Windows\System\KvEjdWW.exe
  2⤵
  PID:10564
- C:\Windows\System\AjGOsQl.exe
  C:\Windows\System\AjGOsQl.exe
  2⤵
  PID:11400
- C:\Windows\System\PoCuKmr.exe
  C:\Windows\System\PoCuKmr.exe
  2⤵
  PID:11528
- C:\Windows\System\grEDGoF.exe
  C:\Windows\System\grEDGoF.exe
  2⤵
  PID:11632
- C:\Windows\System\rPWmIpN.exe
  C:\Windows\System\rPWmIpN.exe
  2⤵
  PID:11800
- C:\Windows\System\WGTVIjL.exe
  C:\Windows\System\WGTVIjL.exe
  2⤵
  PID:12212
- C:\Windows\System\aYYSwNg.exe
  C:\Windows\System\aYYSwNg.exe
  2⤵
  PID:12276
- C:\Windows\System\QYMkkpz.exe
  C:\Windows\System\QYMkkpz.exe
  2⤵
  PID:2188
- C:\Windows\System\IQKnCUW.exe
  C:\Windows\System\IQKnCUW.exe
  2⤵
  PID:12256
- C:\Windows\System\sVrNPQF.exe
  C:\Windows\System\sVrNPQF.exe
  2⤵
  PID:11432
- C:\Windows\System\vbIStbh.exe
  C:\Windows\System\vbIStbh.exe
  2⤵
  PID:11608
- C:\Windows\System\adqEaZC.exe
  C:\Windows\System\adqEaZC.exe
  2⤵
  PID:12308
- C:\Windows\System\gWQCKXt.exe
  C:\Windows\System\gWQCKXt.exe
  2⤵
  PID:12328
- C:\Windows\System\PvafrSB.exe
  C:\Windows\System\PvafrSB.exe
  2⤵
  PID:12348
- C:\Windows\System\tkUcPYh.exe
  C:\Windows\System\tkUcPYh.exe
  2⤵
  PID:12372
- C:\Windows\System\EZIasgO.exe
  C:\Windows\System\EZIasgO.exe
  2⤵
  PID:12392
- C:\Windows\System\OPnmjsA.exe
  C:\Windows\System\OPnmjsA.exe
  2⤵
  PID:12412
- C:\Windows\System\yxTztzx.exe
  C:\Windows\System\yxTztzx.exe
  2⤵
  PID:12448
- C:\Windows\System\FIbXuxb.exe
  C:\Windows\System\FIbXuxb.exe
  2⤵
  PID:12476
- C:\Windows\System\eYLTIdc.exe
  C:\Windows\System\eYLTIdc.exe
  2⤵
  PID:12496
- C:\Windows\System\YvKpzJz.exe
  C:\Windows\System\YvKpzJz.exe
  2⤵
  PID:12540
- C:\Windows\System\ZFRLFze.exe
  C:\Windows\System\ZFRLFze.exe
  2⤵
  PID:12560
- C:\Windows\System\PLnuHGg.exe
  C:\Windows\System\PLnuHGg.exe
  2⤵
  PID:12604
- C:\Windows\System\rXqHkPe.exe
  C:\Windows\System\rXqHkPe.exe
  2⤵
  PID:12628
- C:\Windows\System\GzzjGnJ.exe
  C:\Windows\System\GzzjGnJ.exe
  2⤵
  PID:12648
- C:\Windows\System\bPCXZeh.exe
  C:\Windows\System\bPCXZeh.exe
  2⤵
  PID:12680
- C:\Windows\System\HAwmEsH.exe
  C:\Windows\System\HAwmEsH.exe
  2⤵
  PID:12708
- C:\Windows\System\yvDUprq.exe
  C:\Windows\System\yvDUprq.exe
  2⤵
  PID:12728
- C:\Windows\System\csmtNkq.exe
  C:\Windows\System\csmtNkq.exe
  2⤵
  PID:12780
- C:\Windows\System\KuLTzox.exe
  C:\Windows\System\KuLTzox.exe
  2⤵
  PID:12808
- C:\Windows\System\htwDBma.exe
  C:\Windows\System\htwDBma.exe
  2⤵
  PID:12848
- C:\Windows\System\iaUHQdU.exe
  C:\Windows\System\iaUHQdU.exe
  2⤵
  PID:12872
- C:\Windows\System\OXzTshq.exe
  C:\Windows\System\OXzTshq.exe
  2⤵
  PID:12892
- C:\Windows\System\cKYXxpo.exe
  C:\Windows\System\cKYXxpo.exe
  2⤵
  PID:12912
- C:\Windows\System\xXFBxag.exe
  C:\Windows\System\xXFBxag.exe
  2⤵
  PID:12952
- C:\Windows\System\lfquejF.exe
  C:\Windows\System\lfquejF.exe
  2⤵
  PID:12976
- C:\Windows\System\JsPvPHY.exe
  C:\Windows\System\JsPvPHY.exe
  2⤵
  PID:13000
- C:\Windows\System\cjBsNPV.exe
  C:\Windows\System\cjBsNPV.exe
  2⤵
  PID:13020
- C:\Windows\System\kDrPPgd.exe
  C:\Windows\System\kDrPPgd.exe
  2⤵
  PID:13040
- C:\Windows\System\sLdfEmS.exe
  C:\Windows\System\sLdfEmS.exe
  2⤵
  PID:13056
- C:\Windows\System\CBNUiKp.exe
  C:\Windows\System\CBNUiKp.exe
  2⤵
  PID:13100
- C:\Windows\System\TpSwEIK.exe
  C:\Windows\System\TpSwEIK.exe
  2⤵
  PID:13132
- C:\Windows\System\gWkwRBI.exe
  C:\Windows\System\gWkwRBI.exe
  2⤵
  PID:13152
- C:\Windows\System\zinSgwd.exe
  C:\Windows\System\zinSgwd.exe
  2⤵
  PID:13172
- C:\Windows\System\uWowqqn.exe
  C:\Windows\System\uWowqqn.exe
  2⤵
  PID:13212
- C:\Windows\System\MzMBSdu.exe
  C:\Windows\System\MzMBSdu.exe
  2⤵
  PID:13248
- C:\Windows\System\BCrFMoU.exe
  C:\Windows\System\BCrFMoU.exe
  2⤵
  PID:13280
- C:\Windows\System\rHYEomy.exe
  C:\Windows\System\rHYEomy.exe
  2⤵
  PID:12356
- C:\Windows\System\RqREaib.exe
  C:\Windows\System\RqREaib.exe
  2⤵
  PID:12320
- C:\Windows\System\iwXIJKs.exe
  C:\Windows\System\iwXIJKs.exe
  2⤵
  PID:12640
- C:\Windows\System\umaEdbh.exe
  C:\Windows\System\umaEdbh.exe
  2⤵
  PID:12880
- C:\Windows\System\ZOdJQMe.exe
  C:\Windows\System\ZOdJQMe.exe
  2⤵
  PID:12908
- C:\Windows\System\RuwgJKg.exe
  C:\Windows\System\RuwgJKg.exe
  2⤵
  PID:12920
- C:\Windows\System\XLkZViM.exe
  C:\Windows\System\XLkZViM.exe
  2⤵
  PID:13032
- C:\Windows\System\rGFJClS.exe
  C:\Windows\System\rGFJClS.exe
  2⤵
  PID:13084
- C:\Windows\System\XMyOSWd.exe
  C:\Windows\System\XMyOSWd.exe
  2⤵
  PID:13196
- C:\Windows\System\ufHuYoO.exe
  C:\Windows\System\ufHuYoO.exe
  2⤵
  PID:3376
- C:\Windows\System\DajvSKZ.exe
  C:\Windows\System\DajvSKZ.exe
  2⤵
  PID:12344
- C:\Windows\System\QlEStxH.exe
  C:\Windows\System\QlEStxH.exe
  2⤵
  PID:12364
- C:\Windows\System\malmHxQ.exe
  C:\Windows\System\malmHxQ.exe
  2⤵
  PID:12428
- C:\Windows\System\ecYnFOb.exe
  C:\Windows\System\ecYnFOb.exe
  2⤵
  PID:12536
- C:\Windows\System\uSEKivO.exe
  C:\Windows\System\uSEKivO.exe
  2⤵
  PID:12624
- C:\Windows\System\qNDGgas.exe
  C:\Windows\System\qNDGgas.exe
  2⤵
  PID:12700
- C:\Windows\System\VSdOVpZ.exe
  C:\Windows\System\VSdOVpZ.exe
  2⤵
  PID:3172
- C:\Windows\System\BYBCZDo.exe
  C:\Windows\System\BYBCZDo.exe
  2⤵
  PID:12860
- C:\Windows\System\zPerUXb.exe
  C:\Windows\System\zPerUXb.exe
  2⤵
  PID:12984
- C:\Windows\System\qzDXBQD.exe
  C:\Windows\System\qzDXBQD.exe
  2⤵
  PID:13192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_j43tkzet.u3g.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\Dqbkexu.exe

Filesize
1.8MB

MD5
b6fc7141007a7d5ff47cbf0bf6dd8b87

SHA1
4a196a7318384be3c4cf5c81636c0411512c7104

SHA256
cf58e37a20b9c7a57582432aeb9609aef7c0765cc3bd573089acf512ad110e27

SHA512
84b3aca015521185be447ccf96b6b924feb8f32b7f7dfbe5a05c5d0a2e16107a052d3cd91cb4adadbae707fed148cc819bee10889c03bbfd064c1369464e6120

Download Submit
C:\Windows\System\DyuKaAR.exe

Filesize
1.8MB

MD5
da0ea07211d8083d9aa4672e610d053f

SHA1
62ffa64f8038ed50ca924006318df03b1a994bae

SHA256
47558eb24f074eff2f2daf0fa3fb2cc3a5124856895c93ec509270f7b3ebb49d

SHA512
ba1305719b4611faf1478c87597be564067939bcbdb21f5d837a0a5d0e931e9d79afcc887cba12902648b490e6d1488b87866c04aeafc46f868b68114092847b

Download Submit
C:\Windows\System\FtzIgfI.exe

Filesize
1.8MB

MD5
1236ab4114db7a9fc41f2adfa39aa0a2

SHA1
7b5fe66df73c321b50a3e54b91d8eca67c24d263

SHA256
f03e136aaf31fdd5a0c91a017b8cba86092c1788d2851bc1e6aaa3a7545c7174

SHA512
98767197d188ec4259bbd29d522b3798ca9ab5dc62e5943404a51e2982ed4f1d9ac33b1ed761085ca51e036e95c81e2afe7a54636bbab075bc44c0442c2d9620

Download Submit
C:\Windows\System\KtUkEkd.exe

Filesize
1.8MB

MD5
92668f780e1abf0e24f3a035e0fd5d75

SHA1
341b20e485805bc47c2c84c89978bdea12fa056a

SHA256
a4bcf300d605ae10e0282b4431e72c3814981ddc31f165acd71292305dc479ad

SHA512
fc99f549441ecf936a0f912781fe75a997474b78b0a28a9fda5509d10be5736a84ec2bcd2fa9d3141645ee97de55f304c220240836888e90c4a2b632ce795432

Download Submit
C:\Windows\System\KzUXeGA.exe

Filesize
1.8MB

MD5
18173720e289024299ba60eab88f4e8b

SHA1
fe471580e2d0e5148ad00742a86c74a9862f3d19

SHA256
68c94fffc1838d2228df0216da45e6bfe66f926a7e800431c6d56b6e186cef82

SHA512
c1eb12abd4d32b8c28b28288065e610881a682b488f27530236b6a6c332c669e6afd37f6d47e41dbf42af492485bebfa210da8cd85f4ea420f5d4644d60dcb96

Download Submit
C:\Windows\System\OpxivZR.exe

Filesize
1.8MB

MD5
fb69e845def553974d472eb9eb1dcd0b

SHA1
55d05ad538f9e21f833d177d3a925ffa874398a9

SHA256
98074c421ea1a18f6cd8a0c5909d7db8546345f6dc3a08fc86054612e7603464

SHA512
44850c07e916e7da07114abe135141cf26a0118cc92f378b5623cb268f31c8de7952099b24f24e7c85f34081126e045478d7d654f08ef840924c1fdb4780b751

Download Submit
C:\Windows\System\OylHfWU.exe

Filesize
1.8MB

MD5
a5d86b7683bc0affe4f10c43c8fc164b

SHA1
d9021366a766ab56dd325346cb971463dbd73fd6

SHA256
94bc5331481e67ec7bd7113507be6b52150160ffc54d625453c147e288dc1db1

SHA512
ebbfbc492a470fc027a5b769dae71362ae08bb2e84d027ca2f873deacabfbca02b4ff570973f3a893c3f507a645e45548ac36c108487e8cbc78e671bb6890624

Download Submit
C:\Windows\System\PScMzRK.exe

Filesize
1.8MB

MD5
a15e06671f608192549e255ad0b2de91

SHA1
92e4668a20fe17c963717a8d3deed26c16371687

SHA256
0ac7c7ad2b591d61579bda3cf7786c16333abb893a42640897556988fb663b4e

SHA512
239a8b5aa3fe37128b4826b32b1c9a2fb459e0e357225eb0e82db63b78070e2cfb5c5ae9c276bfdbb1f7387aaea838d241a1d356e263f009065d077acce1aa8f

Download Submit
C:\Windows\System\PxXTKBl.exe

Filesize
1.8MB

MD5
69d15366afbe59171096dcd023784258

SHA1
c04c373e6cdaa427852621afab206cbb6ab0a1e5

SHA256
a620e553f4359566da51a9833f27bfbfc4aec3bf7908163356da593acd6a80e7

SHA512
8189ecb694c575cace159cfd13dc7179d5870332549c1ecee6a1db04aa7ee52bc69405910723d3dd8911bfae5878dd29f958728fee767e958bbcea0f6418ffd6

Download Submit
C:\Windows\System\PyAVQIv.exe

Filesize
1.8MB

MD5
8faaadf4d44087eaab98cc80ec08f599

SHA1
9b4257110e0a0f36710cdf7c5f305aeda6b1d6a2

SHA256
93d375cf6caf153d474610f1ea18dc3c72f5c55c703df64684781e8bf7d5c825

SHA512
815e690faefa557b277202e6664b3c7cda0c8d321c416f4c5aa6f010d9d3e7b812f61bd64f9db6d12db56ed993c5b6e2c1db510f74683737c46528f8c0c6d73d

Download Submit
C:\Windows\System\QncfSeS.exe

Filesize
1.8MB

MD5
3f7dd2796c60316b7ac2596fb3e4860f

SHA1
b8bc8e459a8f123a9399a1eb810ec3767f3c77ee

SHA256
d435550562ee000ca2aa980113ebde81e1593eaf1a4067f732718ced06d2c76a

SHA512
716e299ed36f21019641ae6588d3146a998b09a1b3f91e16830674a6e01ba705cfad92da3cdb9aa6a1ae68188e0b7aa2a1202a89be6ffd172e7145a2b84b609c

Download Submit
C:\Windows\System\SCTIdUg.exe

Filesize
1.8MB

MD5
b6a2352a4f973a4d9dbfd33f6071fa5b

SHA1
c0840b25989ed8dae16c2f5d986e2b237b58817f

SHA256
29960ed0c0697dd3f205023f12f403997e9b7806a2f7411f76da3b045394a60e

SHA512
9f4aa4f8f0b5edd30a79efc520c1539dd3de4eca788eb631eda7a46a054c29dfd29ef331fbb4456ecee7626f50f794fb59a764e4710b89d2d5ac8e6c49a17130

Download Submit
C:\Windows\System\SHkwasn.exe

Filesize
1.8MB

MD5
5e1cdd755be21d8a066ec71e0033e9c7

SHA1
77c28f66218451e778d4b8b88c431a1f6a76c34e

SHA256
bddd0a7e6888075bba9b905aec0b1f1dedd8b2054ea99c7a6d176ae2824b63ca

SHA512
ea07d3bf6a4546c53088e3c435724f4056eb17137e06637861c157a3a9e3b362841e481a05736c2b56cdbc00a9c34df7988211de4ddb96573ee807a040f08570

Download Submit
C:\Windows\System\TEDwyBi.exe

Filesize
1.8MB

MD5
677a8f2b036ada924e646394339d9eb4

SHA1
af997207576fd12fc97cf7edd7f93c0b66797477

SHA256
db29423f36ea89bd290fb8f684f44104d175ddec0e991a3f74023af415d5234f

SHA512
766734112f46005f2221c1d7047d76d67b9ee28f47c31837398b8f23cbfa2cd6e24b4b585489a494c47305c9f85be907b78a9afb9bd6a78623e4507d0e13c6b0

Download Submit
C:\Windows\System\ULfKltG.exe

Filesize
1.8MB

MD5
5f17b4369b2bcb7b1a966ff4157d3366

SHA1
803e84c4cdf2d6466411db916f19f6da71ceb6bf

SHA256
c7ada1827b8f31d8acaf94e8a921bb7bbc0eda848adbc4753d78474939110d15

SHA512
bce3a2016bd9c72b96956b0a6db2dfcf58f6fc7b7ffb6860cbf891d7bf01fa989d832ba0e8ec9112bd9a04cbf30a302a7e40bb0ba6e567b287db2e806172f0db

Download Submit
C:\Windows\System\WCuXifc.exe

Filesize
1.8MB

MD5
e0d7e95e5a124da49561d7e4012d8dec

SHA1
2b65bc5ec77242b0507864f12c70be8f4e936c0e

SHA256
4fb4dbe4aa4c851ef47f1fe287fb5a6665520bc386dcbe604592d34c8ac881db

SHA512
4bb8c02708d7905fc699a5c695206e22eaf3c6ef5078a33596af05688ecb9f1e19e708b8644aa053fe8fa9473b7a4f5f25bc0a07562a4a42d2d48163803c08e9

Download Submit
C:\Windows\System\XrHTaiW.exe

Filesize
1.8MB

MD5
3a70aba8a83cda4e4c16ff4ae3646ce5

SHA1
b99df92900f83485616b54f7dcf2c4167e146762

SHA256
cfbac7df440568feb8ae73c642f7baaa682cc21ced0b523f22887f5015e2e3b7

SHA512
3235cc2751ec5ba2d3541f8277e4fce9f11cbbfc63a93e38b85a07f535bd98532b1f4ea938886192bc81884e3b8dfa738184eea6dd3f68c7973fc56cac049ac4

Download Submit
C:\Windows\System\YHiYyce.exe

Filesize
1.8MB

MD5
ee983285fbdb71ccbfacad3a6a62cd92

SHA1
4bcdf42781391ca585819d86831025adf495afed

SHA256
6be4f6adaf06af4fb248a29021368f472d1f95193ef1f5b8d5b0dbe4017dae47

SHA512
d6e2fd3a34d21078abab3b16a34eb128e2aa6d7245d40d60e43eedc593aed9efbd1ecfd4f8baf0c7a815b1738e10d638ccde48a8ac08896db07a066044d745e5

Download Submit
C:\Windows\System\Yhvhylf.exe

Filesize
1.8MB

MD5
0eef2b7cc08b359aac2d700b35111bdd

SHA1
52dc6e04b6fbfae6f9bd9d15fa735243c2a3cbf1

SHA256
7e6dab6aee9efee8bce6bda841addb7f08f727ceca52885d785571d1975eb18b

SHA512
2fe962b9261442c985ffdf83e43ea97149a66cf01aa8b90b9249206d96def6b48c80a67aebaef1037c6e95c5efea2b52fe6541e75d5750b8d56604528343bef0

Download Submit
C:\Windows\System\auFpxbX.exe

Filesize
1.8MB

MD5
8c8562569afb0dabeeb851c1ac1116de

SHA1
9d6223307635acaa158d16ce49878366a4868c16

SHA256
5b64605fa93ff817cba1c09bd33fc572342da1371378c0951c84256fe90c7067

SHA512
321ae39c5b1c98465874d862c6138af21b1c13e0c0cc9c861303bbb0616af71c7204d78dbda8a6bbfa07910f58eb81713d4cb0dea431d0341f115560463f37c9

Download Submit
C:\Windows\System\brqlgCD.exe

Filesize
1.8MB

MD5
c2dab03fbdce89ca104542c453dc13ee

SHA1
b67e5cc1ab2fca99c3272c5426d86f52487d7642

SHA256
8bd6ba37d03859c82a5cacd4637b6af42db1147f02ef9d68c4537d978fb34e2f

SHA512
741e822b608111e1716deb6df78d2c95a41ec431a7b7ec986c5f2d713ddfe8603eb9f728c1610d609fbc8662ccb668a29af575040557e200d21dd7d60e334c26

Download Submit
C:\Windows\System\cAFYMlc.exe

Filesize
1.8MB

MD5
757e2b23770444f571d7eb6c0d739070

SHA1
d11cba0a9babff6af7b2ede29d513a634b8fb86c

SHA256
4a65c86881bb82a1febed3d14413bc19f4d6ddcfcfe7fc9f13df5f63a7f13901

SHA512
d68d1f44e9aa9a6624062301c20e7ca71851cc756d865df57818721e57789730840feae48ca83a86ea1a653c4288879667d2e5a070e0a6dc75f9ebe2a66325a8

Download Submit
C:\Windows\System\dSUMAHw.exe

Filesize
1.8MB

MD5
81febce8ddcbaaf02eba70d545421eeb

SHA1
cddcc9e5be5d001ccb8b313471fefcfd4687d613

SHA256
af3711b1d65f286aca1e1150c6e881f682bacd372cba2c2d58b15f115d3a5275

SHA512
46d9cabc88e1629ec41c30dafbcae0decec638f1f4b80f368dddf214756cb53acb0dc7d1db6f1c8aa5081a5eb5c4440a77f54aa769ebde9ba5fb296d64a52376

Download Submit
C:\Windows\System\dwnQEyh.exe

Filesize
1.8MB

MD5
e973538d165214129a2ae62b950a3168

SHA1
94fac8dd52b7e1d6201a1e1eaf425432c03e8c03

SHA256
d11c36dce8a64770f33e2ddf837af778ba41db355f2d44b12b09a1ce4a4bdc4c

SHA512
2f4289b6c4c1a68509e024e716b6d5d5e535962968ebca17fe733570d2469fd95fc8952fee3b545030919e63c229e76632f451c8c4ebb57c6ccdfd5f2fb1bf9a

Download Submit
C:\Windows\System\eoTRkjR.exe

Filesize
1.8MB

MD5
24f21732dc786c0a0d41afd076961f42

SHA1
673cb0fa4f01e8437d70584557750d870c226d06

SHA256
4441ad58e20b283a31a32c9a70a3da83e9e3bdb128b986c226ea31201da98378

SHA512
3fd0ab540079d0f15bf4ecf5b0ff9dcf42bdc4c946f38ca93c4d4765d0522f469659719ed7cc3060e5c2ecbdfad19c83076952cd0bebaebdb911da317627c6df

Download Submit
C:\Windows\System\fuaNCcn.exe

Filesize
1.8MB

MD5
c7ea9f6d7e836e08588eb9dd6694ea38

SHA1
34c7c10998a973103e149b2225c820a1d3f37100

SHA256
bc0219f967a9511b39855fa0e92c47b5f8fb146f9abaacd14d356fbad3599dbb

SHA512
17592c967a89b505988ce1f0daaf9cead5d97e2c080773f5f1c6a12d1b4310076c11a59b1bc0af5688a0cc1c44d2b5413e0ccd52b79fa2895f346ff785354d36

Download Submit
C:\Windows\System\hxTDbeY.exe

Filesize
1.8MB

MD5
f2b0de96ce3ee5c36057f90f296c4cb8

SHA1
9e88f002546883584189cffeef671f1112f0af90

SHA256
39ed6d5b3c0be5e86810461244fe8602b68de26644a842e8098873a502b8458a

SHA512
e6fba6087e10e98e50e9bfd82f87d8cbe041cecbf0206e32f347d66f091d3f0cac627d9816888b811621ec33819af7d8c8ae9b011959115c725b167f1ac2b324

Download Submit
C:\Windows\System\imTQNrW.exe

Filesize
1.8MB

MD5
ce8071dc064fb99daded024fa1249c61

SHA1
f7f6ba915a7a95343489f69d3c06f286fb0fba3e

SHA256
c8e8732474d23868a3fd11a254a1225ab890776fee015ebf466e3cb5dfb4367a

SHA512
e53db2a25b67fbfb7f880e7fe04057cb87dac821a3dec92a5bd1cdaf7b850de8b0d6f7c7f4fbb7d2d3b5a5be46f3132e8a954cb5693b83618727ddab0ab644fd

Download Submit
C:\Windows\System\kljhIMn.exe

Filesize
1.8MB

MD5
25cb6ba3aa80b1cd090c4962356e1e31

SHA1
ba4f866835675ac1ec072b78a87a7cddf5b2b6e5

SHA256
b3bd901165e307cdf7f43ff175dd05e4919e14f21cec9feea5e6e0162e44747d

SHA512
038dbdf9a9ca1488b191a00c733e6c33c164829b26008ddd83d8ec867adfab27e0474b586a13a63430fb42db8cbf47ebfc60d1e971a630688df078b308bf32cc

Download Submit
C:\Windows\System\nPuZLFu.exe

Filesize
1.8MB

MD5
80427e2f2b62f4d5da73ab03246fb515

SHA1
74a7b725415207ed151ffb6a00aee889faf8cee5

SHA256
06b9b0fafb6a9821a0f2f3cceb902460fcc04e3260e839ce60c4c2d5f60d401c

SHA512
390f9d1f76db98666e2f0461dd9e8ff3fc11028f454ca30cd501136b5c107bdbbb4932bbe9606af1e301b01373ea798e85cd2e44fdc83111b80e173700902d1b

Download Submit
C:\Windows\System\pJeXXGf.exe

Filesize
1.8MB

MD5
d4a863ce27a7210391bb61a071dba516

SHA1
19b66472685f04d2a9a1cf958c42a2d1aa3e86f5

SHA256
bd3c734c57d1be926e15eb6b73a0c1d16104b10720965ef1a89102700ae9b4dc

SHA512
89bb0a03e67e679ab48e5d6eef6a4a4bd679e8cef9cc5ab290920a5d74d78ef317c824ffad025ea522633d05ebcc83deb58b41dcfac518d30dece045f5bf28da

Download Submit
C:\Windows\System\ulbREKK.exe

Filesize
1.8MB

MD5
41d578a5b0357a707fd2187fc069e395

SHA1
b8899c9db58fe46dfbace448894c2114370bd3e7

SHA256
0e59fd40d12a7dffd7a95845ba25b1553e501825aafa0befbb3e404c0013d6ac

SHA512
077b95eaced12004e6b4a67099b35be7821bd2ecb3e0626e5745350afec8fed2bd797a123bc3137167168c85fc4d172c1be5920761c2963491ee809136e96232

Download Submit
C:\Windows\System\vdklKaN.exe

Filesize
1.8MB

MD5
950ef0d03522c3ed7ca35b706f4554bd

SHA1
9bf462f4bc71cd9e76c117d3e20c21c99d0d14de

SHA256
2f971324725ae782ba588cc697cbf57038ac2f5d8e9cbba22d35f9ae5502d3b2

SHA512
6e96d81066a9e7a2c55f364016bed7aba109d868cb4495e8da0bfb1be9e71f9ad0ea1eaf5d34e4528ce27913223363a4544222b9cfed52998afac807147f9262

Download Submit
memory/8-83-0x00007FF70BE90000-0x00007FF70C282000-memory.dmp

Filesize
3.9MB

Download
memory/8-2678-0x00007FF70BE90000-0x00007FF70C282000-memory.dmp

Filesize
3.9MB

Download
memory/368-2725-0x00007FF79F420000-0x00007FF79F812000-memory.dmp

Filesize
3.9MB

Download
memory/368-530-0x00007FF79F420000-0x00007FF79F812000-memory.dmp

Filesize
3.9MB

Download
memory/400-529-0x00007FF602EC0000-0x00007FF6032B2000-memory.dmp

Filesize
3.9MB

Download
memory/400-2717-0x00007FF602EC0000-0x00007FF6032B2000-memory.dmp

Filesize
3.9MB

Download
memory/512-2676-0x00007FF6F28D0000-0x00007FF6F2CC2000-memory.dmp

Filesize
3.9MB

Download
memory/512-2633-0x00007FF6F28D0000-0x00007FF6F2CC2000-memory.dmp

Filesize
3.9MB

Download
memory/512-9-0x00007FF6F28D0000-0x00007FF6F2CC2000-memory.dmp

Filesize
3.9MB

Download
memory/764-11-0x00000203D8070000-0x00000203D8080000-memory.dmp

Filesize
64KB

Download
memory/764-59-0x00000203BFE90000-0x00000203BFEB2000-memory.dmp

Filesize
136KB

Download
memory/764-33-0x00007FFFD5850000-0x00007FFFD6311000-memory.dmp

Filesize
10.8MB

Download
memory/764-39-0x00000203D8070000-0x00000203D8080000-memory.dmp

Filesize
64KB

Download
memory/884-2682-0x00007FF727FB0000-0x00007FF7283A2000-memory.dmp

Filesize
3.9MB

Download
memory/884-35-0x00007FF727FB0000-0x00007FF7283A2000-memory.dmp

Filesize
3.9MB

Download
memory/912-2688-0x00007FF673800000-0x00007FF673BF2000-memory.dmp

Filesize
3.9MB

Download
memory/912-87-0x00007FF673800000-0x00007FF673BF2000-memory.dmp

Filesize
3.9MB

Download
memory/1428-2700-0x00007FF60A570000-0x00007FF60A962000-memory.dmp

Filesize
3.9MB

Download
memory/1428-104-0x00007FF60A570000-0x00007FF60A962000-memory.dmp

Filesize
3.9MB

Download
memory/1880-88-0x00007FF752F50000-0x00007FF753342000-memory.dmp

Filesize
3.9MB

Download
memory/1880-2691-0x00007FF752F50000-0x00007FF753342000-memory.dmp

Filesize
3.9MB

Download
memory/1960-2686-0x00007FF7580C0000-0x00007FF7584B2000-memory.dmp

Filesize
3.9MB

Download
memory/1960-61-0x00007FF7580C0000-0x00007FF7584B2000-memory.dmp

Filesize
3.9MB

Download
memory/2136-2730-0x00007FF64F8E0000-0x00007FF64FCD2000-memory.dmp

Filesize
3.9MB

Download
memory/2136-526-0x00007FF64F8E0000-0x00007FF64FCD2000-memory.dmp

Filesize
3.9MB

Download
memory/2372-107-0x00007FF765720000-0x00007FF765B12000-memory.dmp

Filesize
3.9MB

Download
memory/2372-2702-0x00007FF765720000-0x00007FF765B12000-memory.dmp

Filesize
3.9MB

Download
memory/2572-2667-0x00007FF6924F0000-0x00007FF6928E2000-memory.dmp

Filesize
3.9MB

Download
memory/2572-78-0x00007FF6924F0000-0x00007FF6928E2000-memory.dmp

Filesize
3.9MB

Download
memory/2572-2692-0x00007FF6924F0000-0x00007FF6928E2000-memory.dmp

Filesize
3.9MB

Download
memory/2632-110-0x00007FF7CDB30000-0x00007FF7CDF22000-memory.dmp

Filesize
3.9MB

Download
memory/2632-2704-0x00007FF7CDB30000-0x00007FF7CDF22000-memory.dmp

Filesize
3.9MB

Download
memory/3476-100-0x00007FF60D250000-0x00007FF60D642000-memory.dmp

Filesize
3.9MB

Download
memory/3476-2695-0x00007FF60D250000-0x00007FF60D642000-memory.dmp

Filesize
3.9MB

Download
memory/3604-68-0x00007FF6A2E30000-0x00007FF6A3222000-memory.dmp

Filesize
3.9MB

Download
memory/3604-2685-0x00007FF6A2E30000-0x00007FF6A3222000-memory.dmp

Filesize
3.9MB

Download
memory/3888-1-0x000002CEFF060000-0x000002CEFF070000-memory.dmp

Filesize
64KB

Download
memory/3888-0-0x00007FF797D90000-0x00007FF798182000-memory.dmp

Filesize
3.9MB

Download
memory/4148-528-0x00007FF7CBB90000-0x00007FF7CBF82000-memory.dmp

Filesize
3.9MB

Download
memory/4148-2727-0x00007FF7CBB90000-0x00007FF7CBF82000-memory.dmp

Filesize
3.9MB

Download
memory/4420-2699-0x00007FF7469F0000-0x00007FF746DE2000-memory.dmp

Filesize
3.9MB

Download
memory/4420-72-0x00007FF7469F0000-0x00007FF746DE2000-memory.dmp

Filesize
3.9MB

Download
memory/4420-2666-0x00007FF7469F0000-0x00007FF746DE2000-memory.dmp

Filesize
3.9MB

Download
memory/4700-527-0x00007FF78F090000-0x00007FF78F482000-memory.dmp

Filesize
3.9MB

Download
memory/4700-2729-0x00007FF78F090000-0x00007FF78F482000-memory.dmp

Filesize
3.9MB

Download
memory/4784-43-0x00007FF7C8BA0000-0x00007FF7C8F92000-memory.dmp

Filesize
3.9MB

Download
memory/4784-2680-0x00007FF7C8BA0000-0x00007FF7C8F92000-memory.dmp

Filesize
3.9MB

Download
memory/4808-2697-0x00007FF6640D0000-0x00007FF6644C2000-memory.dmp

Filesize
3.9MB

Download
memory/4808-95-0x00007FF6640D0000-0x00007FF6644C2000-memory.dmp

Filesize
3.9MB

Download
memory/5060-111-0x00007FF7816C0000-0x00007FF781AB2000-memory.dmp

Filesize
3.9MB

Download
memory/5060-2710-0x00007FF7816C0000-0x00007FF781AB2000-memory.dmp

Filesize
3.9MB

Download