xmrig | 658f30974625c7b519392798bb75817c0bd3d9812c8693106f00988a8ec2b695

Analysis

max time kernel
83s
max time network
60s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 14:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
Size

2.3MB
MD5

09ff447e753a063b3157bc7950b32a2c
SHA1

fbb645276a25f2c480850dfe2a73f03d0244eb87
SHA256

658f30974625c7b519392798bb75817c0bd3d9812c8693106f00988a8ec2b695
SHA512

8c816c4cbb0c336b68cd6f7f33a1ded4c3a8f40c02c525b586f8ea5c9396e4feb0a1e3a316b3cfb84eace49daeef99503660d948c955bc10c5f52d76509c91c4
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9cM:NABk

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 42 IoCs

miner

resource	yara_rule
behavioral2/memory/4644-42-0x00007FF7CADD0000-0x00007FF7CB1C2000-memory.dmp	xmrig
behavioral2/memory/4988-60-0x00007FF6A2350000-0x00007FF6A2742000-memory.dmp	xmrig
behavioral2/memory/2128-78-0x00007FF7E8DA0000-0x00007FF7E9192000-memory.dmp	xmrig
behavioral2/memory/2836-88-0x00007FF7C5060000-0x00007FF7C5452000-memory.dmp	xmrig
behavioral2/memory/2000-97-0x00007FF7A4B00000-0x00007FF7A4EF2000-memory.dmp	xmrig
behavioral2/memory/5048-98-0x00007FF7479F0000-0x00007FF747DE2000-memory.dmp	xmrig
behavioral2/memory/4460-96-0x00007FF79EB30000-0x00007FF79EF22000-memory.dmp	xmrig
behavioral2/memory/2360-95-0x00007FF7C9100000-0x00007FF7C94F2000-memory.dmp	xmrig
behavioral2/memory/5004-93-0x00007FF6F9A40000-0x00007FF6F9E32000-memory.dmp	xmrig
behavioral2/memory/2576-92-0x00007FF6599E0000-0x00007FF659DD2000-memory.dmp	xmrig
behavioral2/memory/3256-87-0x00007FF7F3A20000-0x00007FF7F3E12000-memory.dmp	xmrig
behavioral2/memory/4444-84-0x00007FF798DC0000-0x00007FF7991B2000-memory.dmp	xmrig
behavioral2/memory/4064-80-0x00007FF6361E0000-0x00007FF6365D2000-memory.dmp	xmrig
behavioral2/memory/1000-121-0x00007FF7FC030000-0x00007FF7FC422000-memory.dmp	xmrig
behavioral2/memory/1500-125-0x00007FF76D510000-0x00007FF76D902000-memory.dmp	xmrig
behavioral2/memory/2796-157-0x00007FF60D520000-0x00007FF60D912000-memory.dmp	xmrig
behavioral2/memory/2504-149-0x00007FF7AD8A0000-0x00007FF7ADC92000-memory.dmp	xmrig
behavioral2/memory/3852-2108-0x00007FF6A8770000-0x00007FF6A8B62000-memory.dmp	xmrig
behavioral2/memory/752-2125-0x00007FF63ACD0000-0x00007FF63B0C2000-memory.dmp	xmrig
behavioral2/memory/3296-2142-0x00007FF6BB350000-0x00007FF6BB742000-memory.dmp	xmrig
behavioral2/memory/3968-2143-0x00007FF6923A0000-0x00007FF692792000-memory.dmp	xmrig
behavioral2/memory/3852-2161-0x00007FF6A8770000-0x00007FF6A8B62000-memory.dmp	xmrig
behavioral2/memory/2360-2163-0x00007FF7C9100000-0x00007FF7C94F2000-memory.dmp	xmrig
behavioral2/memory/4644-2165-0x00007FF7CADD0000-0x00007FF7CB1C2000-memory.dmp	xmrig
behavioral2/memory/4988-2171-0x00007FF6A2350000-0x00007FF6A2742000-memory.dmp	xmrig
behavioral2/memory/4444-2175-0x00007FF798DC0000-0x00007FF7991B2000-memory.dmp	xmrig
behavioral2/memory/2000-2179-0x00007FF7A4B00000-0x00007FF7A4EF2000-memory.dmp	xmrig
behavioral2/memory/2836-2181-0x00007FF7C5060000-0x00007FF7C5452000-memory.dmp	xmrig
behavioral2/memory/2576-2183-0x00007FF6599E0000-0x00007FF659DD2000-memory.dmp	xmrig
behavioral2/memory/3256-2178-0x00007FF7F3A20000-0x00007FF7F3E12000-memory.dmp	xmrig
behavioral2/memory/4460-2173-0x00007FF79EB30000-0x00007FF79EF22000-memory.dmp	xmrig
behavioral2/memory/2128-2168-0x00007FF7E8DA0000-0x00007FF7E9192000-memory.dmp	xmrig
behavioral2/memory/4064-2169-0x00007FF6361E0000-0x00007FF6365D2000-memory.dmp	xmrig
behavioral2/memory/5048-2187-0x00007FF7479F0000-0x00007FF747DE2000-memory.dmp	xmrig
behavioral2/memory/5004-2186-0x00007FF6F9A40000-0x00007FF6F9E32000-memory.dmp	xmrig
behavioral2/memory/752-2217-0x00007FF63ACD0000-0x00007FF63B0C2000-memory.dmp	xmrig
behavioral2/memory/1000-2220-0x00007FF7FC030000-0x00007FF7FC422000-memory.dmp	xmrig
behavioral2/memory/1500-2222-0x00007FF76D510000-0x00007FF76D902000-memory.dmp	xmrig
behavioral2/memory/3296-2225-0x00007FF6BB350000-0x00007FF6BB742000-memory.dmp	xmrig
behavioral2/memory/3968-2227-0x00007FF6923A0000-0x00007FF692792000-memory.dmp	xmrig
behavioral2/memory/2504-2226-0x00007FF7AD8A0000-0x00007FF7ADC92000-memory.dmp	xmrig
behavioral2/memory/2796-2229-0x00007FF60D520000-0x00007FF60D912000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3852	wbYOMwh.exe
2360	MMWoRru.exe
4644	bLtnRkK.exe
4988	lpNLJNt.exe
2128	SHivlxL.exe
4064	HnhRKjW.exe
4460	pEIAdtE.exe
4444	yzwAtOW.exe
2000	JRRizik.exe
3256	EBhnmnP.exe
2836	MkGOzeA.exe
2576	AswGVSE.exe
5048	nLCmtek.exe
5004	NhmZDpx.exe
752	KFTvmFb.exe
1000	ASoneeD.exe
1500	vXeASdr.exe
3968	fcPmPBK.exe
2504	jMYHpvS.exe
3296	RpMeXwc.exe
2796	Rjmjfxf.exe
1376	TDokuUf.exe
2124	hUftPDn.exe
3648	bGsKTrg.exe
3208	fPFvjaa.exe
3272	QagOVrx.exe
3500	UPMnQsv.exe
1164	imqMTfx.exe
3228	TDJdNwM.exe
3552	jEpFrIZ.exe
716	LDMpSpl.exe
4940	Mskeyxx.exe
3404	ojmUdLz.exe
2680	lrHkqGt.exe
5000	IHpCVMg.exe
1156	hZzASxk.exe
3232	DCNeJRa.exe
2412	ZyhBDFC.exe
1088	zeFmKQN.exe
3172	Hkrzfjt.exe
1260	pSuDzAg.exe
5008	BOnOuii.exe
2648	SiFlNpU.exe
1820	cVieekL.exe
3804	hoLdKmj.exe
3128	vLhdOmL.exe
4548	svxiGEU.exe
624	xaihNXJ.exe
4628	tClBqWb.exe
5020	IvWYhlr.exe
3012	ZiAdbFl.exe
5016	UKBftGm.exe
4592	skWFlET.exe
1168	MQOuNWk.exe
1980	MfIVgqa.exe
3988	sftjydE.exe
3420	itbYfsw.exe
3056	MPJZmAE.exe
4752	jvVykJp.exe
4456	zYoZVel.exe
3548	oRAjeBc.exe
764	EJMkqUl.exe
4808	LkdcmgM.exe
3912	stBLpiX.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2168-0-0x00007FF6827F0000-0x00007FF682BE2000-memory.dmp	upx
behavioral2/files/0x000c000000023b77-5.dat	upx
behavioral2/memory/3852-9-0x00007FF6A8770000-0x00007FF6A8B62000-memory.dmp	upx
behavioral2/files/0x000a000000023b8a-17.dat	upx
behavioral2/files/0x000a000000023b8d-26.dat	upx
behavioral2/memory/4644-42-0x00007FF7CADD0000-0x00007FF7CB1C2000-memory.dmp	upx
behavioral2/files/0x000a000000023b90-55.dat	upx
behavioral2/memory/4988-60-0x00007FF6A2350000-0x00007FF6A2742000-memory.dmp	upx
behavioral2/memory/2128-78-0x00007FF7E8DA0000-0x00007FF7E9192000-memory.dmp	upx
behavioral2/files/0x000a000000023b95-85.dat	upx
behavioral2/memory/2836-88-0x00007FF7C5060000-0x00007FF7C5452000-memory.dmp	upx
behavioral2/memory/2000-97-0x00007FF7A4B00000-0x00007FF7A4EF2000-memory.dmp	upx
behavioral2/memory/5048-98-0x00007FF7479F0000-0x00007FF747DE2000-memory.dmp	upx
behavioral2/memory/4460-96-0x00007FF79EB30000-0x00007FF79EF22000-memory.dmp	upx
behavioral2/memory/2360-95-0x00007FF7C9100000-0x00007FF7C94F2000-memory.dmp	upx
behavioral2/memory/5004-93-0x00007FF6F9A40000-0x00007FF6F9E32000-memory.dmp	upx
behavioral2/memory/2576-92-0x00007FF6599E0000-0x00007FF659DD2000-memory.dmp	upx
behavioral2/files/0x000a000000023b96-90.dat	upx
behavioral2/memory/3256-87-0x00007FF7F3A20000-0x00007FF7F3E12000-memory.dmp	upx
behavioral2/memory/4444-84-0x00007FF798DC0000-0x00007FF7991B2000-memory.dmp	upx
behavioral2/memory/4064-80-0x00007FF6361E0000-0x00007FF6365D2000-memory.dmp	upx
behavioral2/files/0x000a000000023b94-76.dat	upx
behavioral2/files/0x000a000000023b93-73.dat	upx
behavioral2/files/0x000a000000023b91-72.dat	upx
behavioral2/files/0x000a000000023b92-61.dat	upx
behavioral2/files/0x000a000000023b8f-53.dat	upx
behavioral2/files/0x000a000000023b8e-30.dat	upx
behavioral2/files/0x000a000000023b8c-27.dat	upx
behavioral2/files/0x000a000000023b8b-21.dat	upx
behavioral2/files/0x000a000000023b99-101.dat	upx
behavioral2/files/0x000b000000023b97-109.dat	upx
behavioral2/files/0x000d000000023b83-110.dat	upx
behavioral2/memory/752-108-0x00007FF63ACD0000-0x00007FF63B0C2000-memory.dmp	upx
behavioral2/memory/1000-121-0x00007FF7FC030000-0x00007FF7FC422000-memory.dmp	upx
behavioral2/files/0x000b000000023b98-117.dat	upx
behavioral2/memory/3296-128-0x00007FF6BB350000-0x00007FF6BB742000-memory.dmp	upx
behavioral2/files/0x000a000000023b9c-132.dat	upx
behavioral2/files/0x000a000000023b9b-130.dat	upx
behavioral2/memory/1500-125-0x00007FF76D510000-0x00007FF76D902000-memory.dmp	upx
behavioral2/files/0x000a000000023b9a-123.dat	upx
behavioral2/memory/3968-137-0x00007FF6923A0000-0x00007FF692792000-memory.dmp	upx
behavioral2/files/0x000a000000023b9e-143.dat	upx
behavioral2/files/0x000a000000023b9d-153.dat	upx
behavioral2/files/0x000a000000023ba3-174.dat	upx
behavioral2/files/0x000a000000023ba4-178.dat	upx
behavioral2/files/0x000a000000023ba2-170.dat	upx
behavioral2/files/0x000a000000023ba1-169.dat	upx
behavioral2/files/0x000a000000023ba0-163.dat	upx
behavioral2/files/0x000a000000023b9f-161.dat	upx
behavioral2/memory/2796-157-0x00007FF60D520000-0x00007FF60D912000-memory.dmp	upx
behavioral2/memory/2504-149-0x00007FF7AD8A0000-0x00007FF7ADC92000-memory.dmp	upx
behavioral2/files/0x000a000000023ba5-183.dat	upx
behavioral2/files/0x000a000000023ba6-190.dat	upx
behavioral2/files/0x000a000000023ba8-196.dat	upx
behavioral2/files/0x000a000000023ba7-195.dat	upx
behavioral2/memory/3852-2108-0x00007FF6A8770000-0x00007FF6A8B62000-memory.dmp	upx
behavioral2/memory/752-2125-0x00007FF63ACD0000-0x00007FF63B0C2000-memory.dmp	upx
behavioral2/memory/3296-2142-0x00007FF6BB350000-0x00007FF6BB742000-memory.dmp	upx
behavioral2/memory/3968-2143-0x00007FF6923A0000-0x00007FF692792000-memory.dmp	upx
behavioral2/memory/3852-2161-0x00007FF6A8770000-0x00007FF6A8B62000-memory.dmp	upx
behavioral2/memory/2360-2163-0x00007FF7C9100000-0x00007FF7C94F2000-memory.dmp	upx
behavioral2/memory/4644-2165-0x00007FF7CADD0000-0x00007FF7CB1C2000-memory.dmp	upx
behavioral2/memory/4988-2171-0x00007FF6A2350000-0x00007FF6A2742000-memory.dmp	upx
behavioral2/memory/4444-2175-0x00007FF798DC0000-0x00007FF7991B2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\XkjvCOS.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\OxJYyvI.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\ZlIjTXW.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\kehzysM.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\ehLomxW.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\dDzfjzS.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\QBGhWqH.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\PYQTBcI.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\pSuDzAg.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\GtzhQTU.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\ASrEDat.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\NPbGvWq.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\ExfSfhc.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\WNNBCyA.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\CaSpEMC.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\quckaUf.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\JpTIKGF.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\eEZWKYV.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\cApZebE.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\eSpFHbN.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\PbLlgCs.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\lDrcwca.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\odiKfPc.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\wbYOMwh.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\jMYHpvS.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\MfIVgqa.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\YMMhsBb.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\TorWstB.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\fehHIgb.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\ZsfSTku.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\dIjVDia.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\IuGOaxu.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\OSkRTjV.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\qKNCnJM.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\YgPgsIy.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\wNCvxQz.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\vjKXePv.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\QqwIiGD.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\GaMaKJe.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\LpJyChP.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\bLtnRkK.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\hJVstuU.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\CfEjaOw.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\hQxEqmL.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\YkieFOJ.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\RsjuUiY.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\cdzXCxc.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\eGRkgsz.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\SmjIDGS.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\ZXHhBeJ.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\nDvGrrM.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\KVwfJnl.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\KUFBPCf.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\jPnrhsY.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\CVceEht.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\Mskeyxx.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\isDiUbH.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\oyEYnzB.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\qfwdLWS.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\uLjtzmV.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\pdwzGgj.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\lpzAwbz.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\qJVfemn.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
File created	C:\Windows\System\pSLtEPI.exe	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1940	powershell.exe
1940	powershell.exe
1940	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
Token: SeDebugPrivilege	1940	powershell.exe
Token: SeLockMemoryPrivilege	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 1940	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	86
PID 2168 wrote to memory of 1940	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	86
PID 2168 wrote to memory of 3852	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	87
PID 2168 wrote to memory of 3852	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	87
PID 2168 wrote to memory of 2360	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	88
PID 2168 wrote to memory of 2360	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	88
PID 2168 wrote to memory of 4644	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	89
PID 2168 wrote to memory of 4644	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	89
PID 2168 wrote to memory of 4988	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	90
PID 2168 wrote to memory of 4988	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	90
PID 2168 wrote to memory of 2128	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	91
PID 2168 wrote to memory of 2128	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	91
PID 2168 wrote to memory of 4064	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	92
PID 2168 wrote to memory of 4064	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	92
PID 2168 wrote to memory of 4460	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	93
PID 2168 wrote to memory of 4460	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	93
PID 2168 wrote to memory of 4444	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	94
PID 2168 wrote to memory of 4444	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	94
PID 2168 wrote to memory of 3256	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	95
PID 2168 wrote to memory of 3256	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	95
PID 2168 wrote to memory of 2000	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	96
PID 2168 wrote to memory of 2000	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	96
PID 2168 wrote to memory of 2836	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	97
PID 2168 wrote to memory of 2836	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	97
PID 2168 wrote to memory of 2576	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	98
PID 2168 wrote to memory of 2576	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	98
PID 2168 wrote to memory of 5048	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	99
PID 2168 wrote to memory of 5048	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	99
PID 2168 wrote to memory of 5004	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	100
PID 2168 wrote to memory of 5004	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	100
PID 2168 wrote to memory of 752	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	101
PID 2168 wrote to memory of 752	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	101
PID 2168 wrote to memory of 1500	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	102
PID 2168 wrote to memory of 1500	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	102
PID 2168 wrote to memory of 1000	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	103
PID 2168 wrote to memory of 1000	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	103
PID 2168 wrote to memory of 3968	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	104
PID 2168 wrote to memory of 3968	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	104
PID 2168 wrote to memory of 2504	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	106
PID 2168 wrote to memory of 2504	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	106
PID 2168 wrote to memory of 3296	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	107
PID 2168 wrote to memory of 3296	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	107
PID 2168 wrote to memory of 2796	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	108
PID 2168 wrote to memory of 2796	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	108
PID 2168 wrote to memory of 2124	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	109
PID 2168 wrote to memory of 2124	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	109
PID 2168 wrote to memory of 1376	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	110
PID 2168 wrote to memory of 1376	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	110
PID 2168 wrote to memory of 3648	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	111
PID 2168 wrote to memory of 3648	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	111
PID 2168 wrote to memory of 3208	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	112
PID 2168 wrote to memory of 3208	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	112
PID 2168 wrote to memory of 3272	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	113
PID 2168 wrote to memory of 3272	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	113
PID 2168 wrote to memory of 3500	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	114
PID 2168 wrote to memory of 3500	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	114
PID 2168 wrote to memory of 1164	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	115
PID 2168 wrote to memory of 1164	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	115
PID 2168 wrote to memory of 3228	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	116
PID 2168 wrote to memory of 3228	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	116
PID 2168 wrote to memory of 3552	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	117
PID 2168 wrote to memory of 3552	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	117
PID 2168 wrote to memory of 716	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	119
PID 2168 wrote to memory of 716	2168	09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe	119

C:\Users\Admin\AppData\Local\Temp\09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\09ff447e753a063b3157bc7950b32a2c_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1940
- C:\Windows\System\wbYOMwh.exe
  C:\Windows\System\wbYOMwh.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\MMWoRru.exe
  C:\Windows\System\MMWoRru.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\bLtnRkK.exe
  C:\Windows\System\bLtnRkK.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\lpNLJNt.exe
  C:\Windows\System\lpNLJNt.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\SHivlxL.exe
  C:\Windows\System\SHivlxL.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\HnhRKjW.exe
  C:\Windows\System\HnhRKjW.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\pEIAdtE.exe
  C:\Windows\System\pEIAdtE.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\yzwAtOW.exe
  C:\Windows\System\yzwAtOW.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\EBhnmnP.exe
  C:\Windows\System\EBhnmnP.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\JRRizik.exe
  C:\Windows\System\JRRizik.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\MkGOzeA.exe
  C:\Windows\System\MkGOzeA.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\AswGVSE.exe
  C:\Windows\System\AswGVSE.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\nLCmtek.exe
  C:\Windows\System\nLCmtek.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\NhmZDpx.exe
  C:\Windows\System\NhmZDpx.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\KFTvmFb.exe
  C:\Windows\System\KFTvmFb.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\vXeASdr.exe
  C:\Windows\System\vXeASdr.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\ASoneeD.exe
  C:\Windows\System\ASoneeD.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\fcPmPBK.exe
  C:\Windows\System\fcPmPBK.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\jMYHpvS.exe
  C:\Windows\System\jMYHpvS.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\RpMeXwc.exe
  C:\Windows\System\RpMeXwc.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\Rjmjfxf.exe
  C:\Windows\System\Rjmjfxf.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\hUftPDn.exe
  C:\Windows\System\hUftPDn.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\TDokuUf.exe
  C:\Windows\System\TDokuUf.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\bGsKTrg.exe
  C:\Windows\System\bGsKTrg.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\fPFvjaa.exe
  C:\Windows\System\fPFvjaa.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\QagOVrx.exe
  C:\Windows\System\QagOVrx.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\UPMnQsv.exe
  C:\Windows\System\UPMnQsv.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\imqMTfx.exe
  C:\Windows\System\imqMTfx.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\TDJdNwM.exe
  C:\Windows\System\TDJdNwM.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\jEpFrIZ.exe
  C:\Windows\System\jEpFrIZ.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\LDMpSpl.exe
  C:\Windows\System\LDMpSpl.exe
  2⤵
  - Executes dropped EXE
  PID:716
- C:\Windows\System\Mskeyxx.exe
  C:\Windows\System\Mskeyxx.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\ojmUdLz.exe
  C:\Windows\System\ojmUdLz.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\lrHkqGt.exe
  C:\Windows\System\lrHkqGt.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\IHpCVMg.exe
  C:\Windows\System\IHpCVMg.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\hZzASxk.exe
  C:\Windows\System\hZzASxk.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\ZyhBDFC.exe
  C:\Windows\System\ZyhBDFC.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\DCNeJRa.exe
  C:\Windows\System\DCNeJRa.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\zeFmKQN.exe
  C:\Windows\System\zeFmKQN.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\Hkrzfjt.exe
  C:\Windows\System\Hkrzfjt.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\pSuDzAg.exe
  C:\Windows\System\pSuDzAg.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\SiFlNpU.exe
  C:\Windows\System\SiFlNpU.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\BOnOuii.exe
  C:\Windows\System\BOnOuii.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\cVieekL.exe
  C:\Windows\System\cVieekL.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\hoLdKmj.exe
  C:\Windows\System\hoLdKmj.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\vLhdOmL.exe
  C:\Windows\System\vLhdOmL.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\svxiGEU.exe
  C:\Windows\System\svxiGEU.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\xaihNXJ.exe
  C:\Windows\System\xaihNXJ.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\tClBqWb.exe
  C:\Windows\System\tClBqWb.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\IvWYhlr.exe
  C:\Windows\System\IvWYhlr.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\ZiAdbFl.exe
  C:\Windows\System\ZiAdbFl.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\UKBftGm.exe
  C:\Windows\System\UKBftGm.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\skWFlET.exe
  C:\Windows\System\skWFlET.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\MQOuNWk.exe
  C:\Windows\System\MQOuNWk.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\MfIVgqa.exe
  C:\Windows\System\MfIVgqa.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\sftjydE.exe
  C:\Windows\System\sftjydE.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\itbYfsw.exe
  C:\Windows\System\itbYfsw.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\MPJZmAE.exe
  C:\Windows\System\MPJZmAE.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\jvVykJp.exe
  C:\Windows\System\jvVykJp.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\zYoZVel.exe
  C:\Windows\System\zYoZVel.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\oRAjeBc.exe
  C:\Windows\System\oRAjeBc.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\EJMkqUl.exe
  C:\Windows\System\EJMkqUl.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\LkdcmgM.exe
  C:\Windows\System\LkdcmgM.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\stBLpiX.exe
  C:\Windows\System\stBLpiX.exe
  2⤵
  - Executes dropped EXE
  PID:3912
- C:\Windows\System\tMqPmFm.exe
  C:\Windows\System\tMqPmFm.exe
  2⤵
  PID:5084
- C:\Windows\System\esgJNJA.exe
  C:\Windows\System\esgJNJA.exe
  2⤵
  PID:3116
- C:\Windows\System\taPWLMw.exe
  C:\Windows\System\taPWLMw.exe
  2⤵
  PID:5044
- C:\Windows\System\reqFDwY.exe
  C:\Windows\System\reqFDwY.exe
  2⤵
  PID:3484
- C:\Windows\System\wronvbX.exe
  C:\Windows\System\wronvbX.exe
  2⤵
  PID:2552
- C:\Windows\System\ubgXPGS.exe
  C:\Windows\System\ubgXPGS.exe
  2⤵
  PID:3932
- C:\Windows\System\iEHczFZ.exe
  C:\Windows\System\iEHczFZ.exe
  2⤵
  PID:3568
- C:\Windows\System\icOhGpe.exe
  C:\Windows\System\icOhGpe.exe
  2⤵
  PID:4944
- C:\Windows\System\puytiQn.exe
  C:\Windows\System\puytiQn.exe
  2⤵
  PID:2040
- C:\Windows\System\FWDnDAM.exe
  C:\Windows\System\FWDnDAM.exe
  2⤵
  PID:4228
- C:\Windows\System\RiLPYUL.exe
  C:\Windows\System\RiLPYUL.exe
  2⤵
  PID:4580
- C:\Windows\System\KDkvure.exe
  C:\Windows\System\KDkvure.exe
  2⤵
  PID:3652
- C:\Windows\System\vTtONdJ.exe
  C:\Windows\System\vTtONdJ.exe
  2⤵
  PID:3200
- C:\Windows\System\dEIASLG.exe
  C:\Windows\System\dEIASLG.exe
  2⤵
  PID:4344
- C:\Windows\System\eEAsxIR.exe
  C:\Windows\System\eEAsxIR.exe
  2⤵
  PID:2272
- C:\Windows\System\YMMhsBb.exe
  C:\Windows\System\YMMhsBb.exe
  2⤵
  PID:2228
- C:\Windows\System\XCqqdKW.exe
  C:\Windows\System\XCqqdKW.exe
  2⤵
  PID:4436
- C:\Windows\System\nDvGrrM.exe
  C:\Windows\System\nDvGrrM.exe
  2⤵
  PID:3752
- C:\Windows\System\VNijCRi.exe
  C:\Windows\System\VNijCRi.exe
  2⤵
  PID:4880
- C:\Windows\System\kvKQNgD.exe
  C:\Windows\System\kvKQNgD.exe
  2⤵
  PID:5128
- C:\Windows\System\wxBJPHT.exe
  C:\Windows\System\wxBJPHT.exe
  2⤵
  PID:5148
- C:\Windows\System\HXWyatI.exe
  C:\Windows\System\HXWyatI.exe
  2⤵
  PID:5172
- C:\Windows\System\orzUzIv.exe
  C:\Windows\System\orzUzIv.exe
  2⤵
  PID:5192
- C:\Windows\System\pSLtEPI.exe
  C:\Windows\System\pSLtEPI.exe
  2⤵
  PID:5212
- C:\Windows\System\RwSpWAe.exe
  C:\Windows\System\RwSpWAe.exe
  2⤵
  PID:5236
- C:\Windows\System\DTtryPG.exe
  C:\Windows\System\DTtryPG.exe
  2⤵
  PID:5256
- C:\Windows\System\npcbfzj.exe
  C:\Windows\System\npcbfzj.exe
  2⤵
  PID:5280
- C:\Windows\System\IsaZqUa.exe
  C:\Windows\System\IsaZqUa.exe
  2⤵
  PID:5300
- C:\Windows\System\DjKYZPV.exe
  C:\Windows\System\DjKYZPV.exe
  2⤵
  PID:5344
- C:\Windows\System\TrAMket.exe
  C:\Windows\System\TrAMket.exe
  2⤵
  PID:5376
- C:\Windows\System\uggsSGw.exe
  C:\Windows\System\uggsSGw.exe
  2⤵
  PID:5396
- C:\Windows\System\MPOJnEf.exe
  C:\Windows\System\MPOJnEf.exe
  2⤵
  PID:5432
- C:\Windows\System\cDEzYZa.exe
  C:\Windows\System\cDEzYZa.exe
  2⤵
  PID:5452
- C:\Windows\System\bILsQOZ.exe
  C:\Windows\System\bILsQOZ.exe
  2⤵
  PID:5488
- C:\Windows\System\vLdMpmD.exe
  C:\Windows\System\vLdMpmD.exe
  2⤵
  PID:5508
- C:\Windows\System\Cxwsttd.exe
  C:\Windows\System\Cxwsttd.exe
  2⤵
  PID:5540
- C:\Windows\System\isDiUbH.exe
  C:\Windows\System\isDiUbH.exe
  2⤵
  PID:5584
- C:\Windows\System\HmuuXhf.exe
  C:\Windows\System\HmuuXhf.exe
  2⤵
  PID:5604
- C:\Windows\System\aIyLMHR.exe
  C:\Windows\System\aIyLMHR.exe
  2⤵
  PID:5632
- C:\Windows\System\cdzXCxc.exe
  C:\Windows\System\cdzXCxc.exe
  2⤵
  PID:5652
- C:\Windows\System\tBpCHQE.exe
  C:\Windows\System\tBpCHQE.exe
  2⤵
  PID:5676
- C:\Windows\System\WFmgwzk.exe
  C:\Windows\System\WFmgwzk.exe
  2⤵
  PID:5716
- C:\Windows\System\IaTUgcp.exe
  C:\Windows\System\IaTUgcp.exe
  2⤵
  PID:5740
- C:\Windows\System\RJwoZIk.exe
  C:\Windows\System\RJwoZIk.exe
  2⤵
  PID:5768
- C:\Windows\System\ZpAtTYf.exe
  C:\Windows\System\ZpAtTYf.exe
  2⤵
  PID:5788
- C:\Windows\System\pMCRXjM.exe
  C:\Windows\System\pMCRXjM.exe
  2⤵
  PID:5812
- C:\Windows\System\cxKRqIU.exe
  C:\Windows\System\cxKRqIU.exe
  2⤵
  PID:5860
- C:\Windows\System\chDDjPl.exe
  C:\Windows\System\chDDjPl.exe
  2⤵
  PID:5880
- C:\Windows\System\hyDiTvY.exe
  C:\Windows\System\hyDiTvY.exe
  2⤵
  PID:5904
- C:\Windows\System\kIQTrNf.exe
  C:\Windows\System\kIQTrNf.exe
  2⤵
  PID:5932
- C:\Windows\System\ocgAdFM.exe
  C:\Windows\System\ocgAdFM.exe
  2⤵
  PID:5948
- C:\Windows\System\PIwvoXT.exe
  C:\Windows\System\PIwvoXT.exe
  2⤵
  PID:5976
- C:\Windows\System\yxJPFZf.exe
  C:\Windows\System\yxJPFZf.exe
  2⤵
  PID:5996
- C:\Windows\System\KSqZhZT.exe
  C:\Windows\System\KSqZhZT.exe
  2⤵
  PID:6048
- C:\Windows\System\DqyJDlx.exe
  C:\Windows\System\DqyJDlx.exe
  2⤵
  PID:6076
- C:\Windows\System\SwiSZfE.exe
  C:\Windows\System\SwiSZfE.exe
  2⤵
  PID:6124
- C:\Windows\System\NgryFFj.exe
  C:\Windows\System\NgryFFj.exe
  2⤵
  PID:5136
- C:\Windows\System\CHMjLQm.exe
  C:\Windows\System\CHMjLQm.exe
  2⤵
  PID:5228
- C:\Windows\System\NPAMSQl.exe
  C:\Windows\System\NPAMSQl.exe
  2⤵
  PID:5248
- C:\Windows\System\kADOHCE.exe
  C:\Windows\System\kADOHCE.exe
  2⤵
  PID:5276
- C:\Windows\System\GtzhQTU.exe
  C:\Windows\System\GtzhQTU.exe
  2⤵
  PID:5392
- C:\Windows\System\WaRXSKp.exe
  C:\Windows\System\WaRXSKp.exe
  2⤵
  PID:5424
- C:\Windows\System\eSpFHbN.exe
  C:\Windows\System\eSpFHbN.exe
  2⤵
  PID:5484
- C:\Windows\System\MuHfepa.exe
  C:\Windows\System\MuHfepa.exe
  2⤵
  PID:5532
- C:\Windows\System\ONtRanv.exe
  C:\Windows\System\ONtRanv.exe
  2⤵
  PID:5564
- C:\Windows\System\CymJBqX.exe
  C:\Windows\System\CymJBqX.exe
  2⤵
  PID:5640
- C:\Windows\System\eLQcCry.exe
  C:\Windows\System\eLQcCry.exe
  2⤵
  PID:5708
- C:\Windows\System\wjVEkAz.exe
  C:\Windows\System\wjVEkAz.exe
  2⤵
  PID:5800
- C:\Windows\System\ssGdAmt.exe
  C:\Windows\System\ssGdAmt.exe
  2⤵
  PID:5748
- C:\Windows\System\NiBmGqc.exe
  C:\Windows\System\NiBmGqc.exe
  2⤵
  PID:5888
- C:\Windows\System\XYLeUCx.exe
  C:\Windows\System\XYLeUCx.exe
  2⤵
  PID:5988
- C:\Windows\System\laWVfBw.exe
  C:\Windows\System\laWVfBw.exe
  2⤵
  PID:6056
- C:\Windows\System\DTMRFjf.exe
  C:\Windows\System\DTMRFjf.exe
  2⤵
  PID:6132
- C:\Windows\System\EMLbCiI.exe
  C:\Windows\System\EMLbCiI.exe
  2⤵
  PID:5204
- C:\Windows\System\fdqvKpS.exe
  C:\Windows\System\fdqvKpS.exe
  2⤵
  PID:5352
- C:\Windows\System\EdqJgdS.exe
  C:\Windows\System\EdqJgdS.exe
  2⤵
  PID:5444
- C:\Windows\System\QVkxFhL.exe
  C:\Windows\System\QVkxFhL.exe
  2⤵
  PID:5736
- C:\Windows\System\kbbHqjr.exe
  C:\Windows\System\kbbHqjr.exe
  2⤵
  PID:5808
- C:\Windows\System\GWZtWMF.exe
  C:\Windows\System\GWZtWMF.exe
  2⤵
  PID:5960
- C:\Windows\System\WqAEKlg.exe
  C:\Windows\System\WqAEKlg.exe
  2⤵
  PID:5320
- C:\Windows\System\raUSPcZ.exe
  C:\Windows\System\raUSPcZ.exe
  2⤵
  PID:5600
- C:\Windows\System\QJnArsk.exe
  C:\Windows\System\QJnArsk.exe
  2⤵
  PID:5732
- C:\Windows\System\lPESeyP.exe
  C:\Windows\System\lPESeyP.exe
  2⤵
  PID:5672
- C:\Windows\System\ykuGNql.exe
  C:\Windows\System\ykuGNql.exe
  2⤵
  PID:6152
- C:\Windows\System\dcfZTAg.exe
  C:\Windows\System\dcfZTAg.exe
  2⤵
  PID:6188
- C:\Windows\System\KKWnypJ.exe
  C:\Windows\System\KKWnypJ.exe
  2⤵
  PID:6224
- C:\Windows\System\RHoQama.exe
  C:\Windows\System\RHoQama.exe
  2⤵
  PID:6248
- C:\Windows\System\ZoJwZCu.exe
  C:\Windows\System\ZoJwZCu.exe
  2⤵
  PID:6272
- C:\Windows\System\ntRMPzA.exe
  C:\Windows\System\ntRMPzA.exe
  2⤵
  PID:6296
- C:\Windows\System\MZkHCKQ.exe
  C:\Windows\System\MZkHCKQ.exe
  2⤵
  PID:6316
- C:\Windows\System\QlWXidY.exe
  C:\Windows\System\QlWXidY.exe
  2⤵
  PID:6340
- C:\Windows\System\OSkRTjV.exe
  C:\Windows\System\OSkRTjV.exe
  2⤵
  PID:6364
- C:\Windows\System\zQGmATk.exe
  C:\Windows\System\zQGmATk.exe
  2⤵
  PID:6396
- C:\Windows\System\ahfiTvU.exe
  C:\Windows\System\ahfiTvU.exe
  2⤵
  PID:6412
- C:\Windows\System\ZxBscKS.exe
  C:\Windows\System\ZxBscKS.exe
  2⤵
  PID:6436
- C:\Windows\System\nLolczv.exe
  C:\Windows\System\nLolczv.exe
  2⤵
  PID:6460
- C:\Windows\System\ZgEDZMF.exe
  C:\Windows\System\ZgEDZMF.exe
  2⤵
  PID:6484
- C:\Windows\System\wGqrCtT.exe
  C:\Windows\System\wGqrCtT.exe
  2⤵
  PID:6508
- C:\Windows\System\RRICVPg.exe
  C:\Windows\System\RRICVPg.exe
  2⤵
  PID:6552
- C:\Windows\System\ASrEDat.exe
  C:\Windows\System\ASrEDat.exe
  2⤵
  PID:6628
- C:\Windows\System\qUUOWBe.exe
  C:\Windows\System\qUUOWBe.exe
  2⤵
  PID:6648
- C:\Windows\System\OJTvTuj.exe
  C:\Windows\System\OJTvTuj.exe
  2⤵
  PID:6664
- C:\Windows\System\RitBLfF.exe
  C:\Windows\System\RitBLfF.exe
  2⤵
  PID:6700
- C:\Windows\System\EkBqgCE.exe
  C:\Windows\System\EkBqgCE.exe
  2⤵
  PID:6728
- C:\Windows\System\FICqgiz.exe
  C:\Windows\System\FICqgiz.exe
  2⤵
  PID:6752
- C:\Windows\System\HmulARh.exe
  C:\Windows\System\HmulARh.exe
  2⤵
  PID:6772
- C:\Windows\System\SoeNaRu.exe
  C:\Windows\System\SoeNaRu.exe
  2⤵
  PID:6796
- C:\Windows\System\RZUyjpM.exe
  C:\Windows\System\RZUyjpM.exe
  2⤵
  PID:6816
- C:\Windows\System\UQAHVZr.exe
  C:\Windows\System\UQAHVZr.exe
  2⤵
  PID:6848
- C:\Windows\System\CVYAzWb.exe
  C:\Windows\System\CVYAzWb.exe
  2⤵
  PID:6872
- C:\Windows\System\kPJwIQK.exe
  C:\Windows\System\kPJwIQK.exe
  2⤵
  PID:6892
- C:\Windows\System\SKLjdqr.exe
  C:\Windows\System\SKLjdqr.exe
  2⤵
  PID:6936
- C:\Windows\System\hJVstuU.exe
  C:\Windows\System\hJVstuU.exe
  2⤵
  PID:6964
- C:\Windows\System\TelxNox.exe
  C:\Windows\System\TelxNox.exe
  2⤵
  PID:6984
- C:\Windows\System\hbGOocr.exe
  C:\Windows\System\hbGOocr.exe
  2⤵
  PID:7032
- C:\Windows\System\iRcwBST.exe
  C:\Windows\System\iRcwBST.exe
  2⤵
  PID:7052
- C:\Windows\System\GPPFaCR.exe
  C:\Windows\System\GPPFaCR.exe
  2⤵
  PID:7080
- C:\Windows\System\JpTIKGF.exe
  C:\Windows\System\JpTIKGF.exe
  2⤵
  PID:7104
- C:\Windows\System\iLJSJWg.exe
  C:\Windows\System\iLJSJWg.exe
  2⤵
  PID:7152
- C:\Windows\System\TWOfcMk.exe
  C:\Windows\System\TWOfcMk.exe
  2⤵
  PID:5876
- C:\Windows\System\WmApBXp.exe
  C:\Windows\System\WmApBXp.exe
  2⤵
  PID:6172
- C:\Windows\System\CZDUAzV.exe
  C:\Windows\System\CZDUAzV.exe
  2⤵
  PID:6280
- C:\Windows\System\RhCAtOX.exe
  C:\Windows\System\RhCAtOX.exe
  2⤵
  PID:6360
- C:\Windows\System\wMHrXcj.exe
  C:\Windows\System\wMHrXcj.exe
  2⤵
  PID:6384
- C:\Windows\System\eEZWKYV.exe
  C:\Windows\System\eEZWKYV.exe
  2⤵
  PID:6500
- C:\Windows\System\PaLOgdv.exe
  C:\Windows\System\PaLOgdv.exe
  2⤵
  PID:6572
- C:\Windows\System\RzHfyPl.exe
  C:\Windows\System\RzHfyPl.exe
  2⤵
  PID:6620
- C:\Windows\System\yqsxPHj.exe
  C:\Windows\System\yqsxPHj.exe
  2⤵
  PID:6720
- C:\Windows\System\mtdLsQP.exe
  C:\Windows\System\mtdLsQP.exe
  2⤵
  PID:6688
- C:\Windows\System\opjcZDP.exe
  C:\Windows\System\opjcZDP.exe
  2⤵
  PID:6812
- C:\Windows\System\IKdtsiW.exe
  C:\Windows\System\IKdtsiW.exe
  2⤵
  PID:6860
- C:\Windows\System\CfEjaOw.exe
  C:\Windows\System\CfEjaOw.exe
  2⤵
  PID:6920
- C:\Windows\System\bGuWWHA.exe
  C:\Windows\System\bGuWWHA.exe
  2⤵
  PID:6976
- C:\Windows\System\ZJzuMom.exe
  C:\Windows\System\ZJzuMom.exe
  2⤵
  PID:7020
- C:\Windows\System\YgRgWVc.exe
  C:\Windows\System\YgRgWVc.exe
  2⤵
  PID:7100
- C:\Windows\System\daKvrci.exe
  C:\Windows\System\daKvrci.exe
  2⤵
  PID:7144
- C:\Windows\System\dPspCkh.exe
  C:\Windows\System\dPspCkh.exe
  2⤵
  PID:5560
- C:\Windows\System\MMXOyEq.exe
  C:\Windows\System\MMXOyEq.exe
  2⤵
  PID:6232
- C:\Windows\System\MBRNsHT.exe
  C:\Windows\System\MBRNsHT.exe
  2⤵
  PID:6660
- C:\Windows\System\PfYrBVC.exe
  C:\Windows\System\PfYrBVC.exe
  2⤵
  PID:6808
- C:\Windows\System\wNCvxQz.exe
  C:\Windows\System\wNCvxQz.exe
  2⤵
  PID:6992
- C:\Windows\System\sqEoxga.exe
  C:\Windows\System\sqEoxga.exe
  2⤵
  PID:6916
- C:\Windows\System\OIUjltd.exe
  C:\Windows\System\OIUjltd.exe
  2⤵
  PID:7088
- C:\Windows\System\XygGUku.exe
  C:\Windows\System\XygGUku.exe
  2⤵
  PID:6924
- C:\Windows\System\TBfquwS.exe
  C:\Windows\System\TBfquwS.exe
  2⤵
  PID:7140
- C:\Windows\System\kQCFcBI.exe
  C:\Windows\System\kQCFcBI.exe
  2⤵
  PID:6676
- C:\Windows\System\vLQnqbU.exe
  C:\Windows\System\vLQnqbU.exe
  2⤵
  PID:6856
- C:\Windows\System\txXFHdr.exe
  C:\Windows\System\txXFHdr.exe
  2⤵
  PID:7192
- C:\Windows\System\QGEjkxa.exe
  C:\Windows\System\QGEjkxa.exe
  2⤵
  PID:7236
- C:\Windows\System\EAQUJeM.exe
  C:\Windows\System\EAQUJeM.exe
  2⤵
  PID:7252
- C:\Windows\System\CvKmDBP.exe
  C:\Windows\System\CvKmDBP.exe
  2⤵
  PID:7332
- C:\Windows\System\PfnxuhZ.exe
  C:\Windows\System\PfnxuhZ.exe
  2⤵
  PID:7360
- C:\Windows\System\NBVfyct.exe
  C:\Windows\System\NBVfyct.exe
  2⤵
  PID:7380
- C:\Windows\System\zaaBvNP.exe
  C:\Windows\System\zaaBvNP.exe
  2⤵
  PID:7404
- C:\Windows\System\LaEJtzi.exe
  C:\Windows\System\LaEJtzi.exe
  2⤵
  PID:7432
- C:\Windows\System\JUOvyDU.exe
  C:\Windows\System\JUOvyDU.exe
  2⤵
  PID:7452
- C:\Windows\System\UPqScWb.exe
  C:\Windows\System\UPqScWb.exe
  2⤵
  PID:7484
- C:\Windows\System\yEIyEoC.exe
  C:\Windows\System\yEIyEoC.exe
  2⤵
  PID:7504
- C:\Windows\System\kmrkxfE.exe
  C:\Windows\System\kmrkxfE.exe
  2⤵
  PID:7544
- C:\Windows\System\ZWFRdFd.exe
  C:\Windows\System\ZWFRdFd.exe
  2⤵
  PID:7568
- C:\Windows\System\acRoQFi.exe
  C:\Windows\System\acRoQFi.exe
  2⤵
  PID:7588
- C:\Windows\System\vblJUUK.exe
  C:\Windows\System\vblJUUK.exe
  2⤵
  PID:7620
- C:\Windows\System\pdbOmcO.exe
  C:\Windows\System\pdbOmcO.exe
  2⤵
  PID:7640
- C:\Windows\System\ipfyehM.exe
  C:\Windows\System\ipfyehM.exe
  2⤵
  PID:7656
- C:\Windows\System\oyEYnzB.exe
  C:\Windows\System\oyEYnzB.exe
  2⤵
  PID:7716
- C:\Windows\System\aMKNRZC.exe
  C:\Windows\System\aMKNRZC.exe
  2⤵
  PID:7740
- C:\Windows\System\IvFjhxf.exe
  C:\Windows\System\IvFjhxf.exe
  2⤵
  PID:7764
- C:\Windows\System\dpiQvLV.exe
  C:\Windows\System\dpiQvLV.exe
  2⤵
  PID:7808
- C:\Windows\System\NGMywxB.exe
  C:\Windows\System\NGMywxB.exe
  2⤵
  PID:7844
- C:\Windows\System\HhyRYrE.exe
  C:\Windows\System\HhyRYrE.exe
  2⤵
  PID:7864
- C:\Windows\System\xgclUej.exe
  C:\Windows\System\xgclUej.exe
  2⤵
  PID:7904
- C:\Windows\System\OxJYyvI.exe
  C:\Windows\System\OxJYyvI.exe
  2⤵
  PID:7920
- C:\Windows\System\QgwQjqV.exe
  C:\Windows\System\QgwQjqV.exe
  2⤵
  PID:7940
- C:\Windows\System\kJDxxee.exe
  C:\Windows\System\kJDxxee.exe
  2⤵
  PID:7984
- C:\Windows\System\AVUkcDD.exe
  C:\Windows\System\AVUkcDD.exe
  2⤵
  PID:8012
- C:\Windows\System\pdLqXtt.exe
  C:\Windows\System\pdLqXtt.exe
  2⤵
  PID:8028
- C:\Windows\System\totbKiU.exe
  C:\Windows\System\totbKiU.exe
  2⤵
  PID:8088
- C:\Windows\System\jWdpTrU.exe
  C:\Windows\System\jWdpTrU.exe
  2⤵
  PID:8104
- C:\Windows\System\csADevX.exe
  C:\Windows\System\csADevX.exe
  2⤵
  PID:8124
- C:\Windows\System\FNSOcuV.exe
  C:\Windows\System\FNSOcuV.exe
  2⤵
  PID:8156
- C:\Windows\System\cjIVOLs.exe
  C:\Windows\System\cjIVOLs.exe
  2⤵
  PID:8184
- C:\Windows\System\DrFgqom.exe
  C:\Windows\System\DrFgqom.exe
  2⤵
  PID:7116
- C:\Windows\System\VtyPlsd.exe
  C:\Windows\System\VtyPlsd.exe
  2⤵
  PID:7188
- C:\Windows\System\bXBkyBJ.exe
  C:\Windows\System\bXBkyBJ.exe
  2⤵
  PID:7260
- C:\Windows\System\SkTtTHi.exe
  C:\Windows\System\SkTtTHi.exe
  2⤵
  PID:7244
- C:\Windows\System\QwhPRVc.exe
  C:\Windows\System\QwhPRVc.exe
  2⤵
  PID:7324
- C:\Windows\System\fBXrwAC.exe
  C:\Windows\System\fBXrwAC.exe
  2⤵
  PID:7444
- C:\Windows\System\VrBZdfJ.exe
  C:\Windows\System\VrBZdfJ.exe
  2⤵
  PID:7528
- C:\Windows\System\wgOhwxD.exe
  C:\Windows\System\wgOhwxD.exe
  2⤵
  PID:7564
- C:\Windows\System\paqCohV.exe
  C:\Windows\System\paqCohV.exe
  2⤵
  PID:7536
- C:\Windows\System\pXpRgBg.exe
  C:\Windows\System\pXpRgBg.exe
  2⤵
  PID:7684
- C:\Windows\System\uDZuNpx.exe
  C:\Windows\System\uDZuNpx.exe
  2⤵
  PID:7760
- C:\Windows\System\jwSWARK.exe
  C:\Windows\System\jwSWARK.exe
  2⤵
  PID:7792
- C:\Windows\System\YLTBqAA.exe
  C:\Windows\System\YLTBqAA.exe
  2⤵
  PID:7852
- C:\Windows\System\ZuhITxe.exe
  C:\Windows\System\ZuhITxe.exe
  2⤵
  PID:7900
- C:\Windows\System\EOhGnul.exe
  C:\Windows\System\EOhGnul.exe
  2⤵
  PID:7960
- C:\Windows\System\oDiaLxt.exe
  C:\Windows\System\oDiaLxt.exe
  2⤵
  PID:8044
- C:\Windows\System\IgHmHIf.exe
  C:\Windows\System\IgHmHIf.exe
  2⤵
  PID:8100
- C:\Windows\System\NPbGvWq.exe
  C:\Windows\System\NPbGvWq.exe
  2⤵
  PID:8136
- C:\Windows\System\cAdQkuW.exe
  C:\Windows\System\cAdQkuW.exe
  2⤵
  PID:7072
- C:\Windows\System\YHYpUCn.exe
  C:\Windows\System\YHYpUCn.exe
  2⤵
  PID:7272
- C:\Windows\System\fpuzqau.exe
  C:\Windows\System\fpuzqau.exe
  2⤵
  PID:7468
- C:\Windows\System\zvjCtXt.exe
  C:\Windows\System\zvjCtXt.exe
  2⤵
  PID:7604
- C:\Windows\System\uQYyLnZ.exe
  C:\Windows\System\uQYyLnZ.exe
  2⤵
  PID:7784
- C:\Windows\System\pOmjtLH.exe
  C:\Windows\System\pOmjtLH.exe
  2⤵
  PID:7976
- C:\Windows\System\cApZebE.exe
  C:\Windows\System\cApZebE.exe
  2⤵
  PID:6788
- C:\Windows\System\udkduRk.exe
  C:\Windows\System\udkduRk.exe
  2⤵
  PID:7232
- C:\Windows\System\hvreuTB.exe
  C:\Windows\System\hvreuTB.exe
  2⤵
  PID:7600
- C:\Windows\System\DPcHohv.exe
  C:\Windows\System\DPcHohv.exe
  2⤵
  PID:7680
- C:\Windows\System\dUsFQSF.exe
  C:\Windows\System\dUsFQSF.exe
  2⤵
  PID:7376
- C:\Windows\System\PpnzXLL.exe
  C:\Windows\System\PpnzXLL.exe
  2⤵
  PID:7788
- C:\Windows\System\ISJJTaj.exe
  C:\Windows\System\ISJJTaj.exe
  2⤵
  PID:8228
- C:\Windows\System\NkVllxy.exe
  C:\Windows\System\NkVllxy.exe
  2⤵
  PID:8248
- C:\Windows\System\LxanqZn.exe
  C:\Windows\System\LxanqZn.exe
  2⤵
  PID:8268
- C:\Windows\System\jCZnKHc.exe
  C:\Windows\System\jCZnKHc.exe
  2⤵
  PID:8292
- C:\Windows\System\fkUwPnV.exe
  C:\Windows\System\fkUwPnV.exe
  2⤵
  PID:8320
- C:\Windows\System\vdOewze.exe
  C:\Windows\System\vdOewze.exe
  2⤵
  PID:8340
- C:\Windows\System\YAUecTM.exe
  C:\Windows\System\YAUecTM.exe
  2⤵
  PID:8384
- C:\Windows\System\csIFDdK.exe
  C:\Windows\System\csIFDdK.exe
  2⤵
  PID:8420
- C:\Windows\System\khadflF.exe
  C:\Windows\System\khadflF.exe
  2⤵
  PID:8456
- C:\Windows\System\roItgcQ.exe
  C:\Windows\System\roItgcQ.exe
  2⤵
  PID:8500
- C:\Windows\System\aaiegEP.exe
  C:\Windows\System\aaiegEP.exe
  2⤵
  PID:8528
- C:\Windows\System\HbOonZA.exe
  C:\Windows\System\HbOonZA.exe
  2⤵
  PID:8560
- C:\Windows\System\MSMzCfP.exe
  C:\Windows\System\MSMzCfP.exe
  2⤵
  PID:8580
- C:\Windows\System\fPWVVcX.exe
  C:\Windows\System\fPWVVcX.exe
  2⤵
  PID:8600
- C:\Windows\System\pNLWejB.exe
  C:\Windows\System\pNLWejB.exe
  2⤵
  PID:8644
- C:\Windows\System\emYgLIy.exe
  C:\Windows\System\emYgLIy.exe
  2⤵
  PID:8664
- C:\Windows\System\kJJQUpb.exe
  C:\Windows\System\kJJQUpb.exe
  2⤵
  PID:8684
- C:\Windows\System\nFbVNMW.exe
  C:\Windows\System\nFbVNMW.exe
  2⤵
  PID:8708
- C:\Windows\System\BvOndBE.exe
  C:\Windows\System\BvOndBE.exe
  2⤵
  PID:8736
- C:\Windows\System\TorWstB.exe
  C:\Windows\System\TorWstB.exe
  2⤵
  PID:8768
- C:\Windows\System\xrSkWjb.exe
  C:\Windows\System\xrSkWjb.exe
  2⤵
  PID:8792
- C:\Windows\System\BTkfeSf.exe
  C:\Windows\System\BTkfeSf.exe
  2⤵
  PID:8812
- C:\Windows\System\whkHoUs.exe
  C:\Windows\System\whkHoUs.exe
  2⤵
  PID:8864
- C:\Windows\System\zJantLi.exe
  C:\Windows\System\zJantLi.exe
  2⤵
  PID:8888
- C:\Windows\System\nkzgIke.exe
  C:\Windows\System\nkzgIke.exe
  2⤵
  PID:8908
- C:\Windows\System\zuCjxup.exe
  C:\Windows\System\zuCjxup.exe
  2⤵
  PID:8956
- C:\Windows\System\qBvSpIg.exe
  C:\Windows\System\qBvSpIg.exe
  2⤵
  PID:8992
- C:\Windows\System\pqBJObn.exe
  C:\Windows\System\pqBJObn.exe
  2⤵
  PID:9032
- C:\Windows\System\LhJIOMJ.exe
  C:\Windows\System\LhJIOMJ.exe
  2⤵
  PID:9056
- C:\Windows\System\ZuimFoK.exe
  C:\Windows\System\ZuimFoK.exe
  2⤵
  PID:9096
- C:\Windows\System\KXZVSuA.exe
  C:\Windows\System\KXZVSuA.exe
  2⤵
  PID:9112
- C:\Windows\System\pqRuFdp.exe
  C:\Windows\System\pqRuFdp.exe
  2⤵
  PID:9140
- C:\Windows\System\cOYoBEY.exe
  C:\Windows\System\cOYoBEY.exe
  2⤵
  PID:9172
- C:\Windows\System\ABcTDvk.exe
  C:\Windows\System\ABcTDvk.exe
  2⤵
  PID:9188
- C:\Windows\System\KsAEsAW.exe
  C:\Windows\System\KsAEsAW.exe
  2⤵
  PID:8148
- C:\Windows\System\wefhQEJ.exe
  C:\Windows\System\wefhQEJ.exe
  2⤵
  PID:8208
- C:\Windows\System\EsHKypU.exe
  C:\Windows\System\EsHKypU.exe
  2⤵
  PID:8216
- C:\Windows\System\CaSpEMC.exe
  C:\Windows\System\CaSpEMC.exe
  2⤵
  PID:8288
- C:\Windows\System\MBahSft.exe
  C:\Windows\System\MBahSft.exe
  2⤵
  PID:8412
- C:\Windows\System\DXbxbCG.exe
  C:\Windows\System\DXbxbCG.exe
  2⤵
  PID:8444
- C:\Windows\System\KSTrGzH.exe
  C:\Windows\System\KSTrGzH.exe
  2⤵
  PID:8540
- C:\Windows\System\MdeYKBz.exe
  C:\Windows\System\MdeYKBz.exe
  2⤵
  PID:8596
- C:\Windows\System\bqvaDAu.exe
  C:\Windows\System\bqvaDAu.exe
  2⤵
  PID:8704
- C:\Windows\System\gAhMAMO.exe
  C:\Windows\System\gAhMAMO.exe
  2⤵
  PID:8728
- C:\Windows\System\lecdOeU.exe
  C:\Windows\System\lecdOeU.exe
  2⤵
  PID:8872
- C:\Windows\System\MkldrtR.exe
  C:\Windows\System\MkldrtR.exe
  2⤵
  PID:8916
- C:\Windows\System\ehLomxW.exe
  C:\Windows\System\ehLomxW.exe
  2⤵
  PID:9004
- C:\Windows\System\kcUKerg.exe
  C:\Windows\System\kcUKerg.exe
  2⤵
  PID:9072
- C:\Windows\System\uRbWeTd.exe
  C:\Windows\System\uRbWeTd.exe
  2⤵
  PID:9084
- C:\Windows\System\rYQQhSi.exe
  C:\Windows\System\rYQQhSi.exe
  2⤵
  PID:9180
- C:\Windows\System\gzbigpX.exe
  C:\Windows\System\gzbigpX.exe
  2⤵
  PID:7756
- C:\Windows\System\uOTKphD.exe
  C:\Windows\System\uOTKphD.exe
  2⤵
  PID:8236
- C:\Windows\System\FLXHVJG.exe
  C:\Windows\System\FLXHVJG.exe
  2⤵
  PID:8376
- C:\Windows\System\GbKatSI.exe
  C:\Windows\System\GbKatSI.exe
  2⤵
  PID:8448
- C:\Windows\System\DxoLajW.exe
  C:\Windows\System\DxoLajW.exe
  2⤵
  PID:8652
- C:\Windows\System\DHkVnot.exe
  C:\Windows\System\DHkVnot.exe
  2⤵
  PID:8788
- C:\Windows\System\BdcVQCH.exe
  C:\Windows\System\BdcVQCH.exe
  2⤵
  PID:8988
- C:\Windows\System\dBCSNhV.exe
  C:\Windows\System\dBCSNhV.exe
  2⤵
  PID:9212
- C:\Windows\System\chcGxki.exe
  C:\Windows\System\chcGxki.exe
  2⤵
  PID:8764
- C:\Windows\System\jbdgxxq.exe
  C:\Windows\System\jbdgxxq.exe
  2⤵
  PID:8492
- C:\Windows\System\SCJtlVF.exe
  C:\Windows\System\SCJtlVF.exe
  2⤵
  PID:4876
- C:\Windows\System\rWFkMwH.exe
  C:\Windows\System\rWFkMwH.exe
  2⤵
  PID:8328
- C:\Windows\System\peJMkeE.exe
  C:\Windows\System\peJMkeE.exe
  2⤵
  PID:9044
- C:\Windows\System\ikqRQnM.exe
  C:\Windows\System\ikqRQnM.exe
  2⤵
  PID:8804
- C:\Windows\System\bOcBShf.exe
  C:\Windows\System\bOcBShf.exe
  2⤵
  PID:9232
- C:\Windows\System\RdUVGdi.exe
  C:\Windows\System\RdUVGdi.exe
  2⤵
  PID:9256
- C:\Windows\System\pPSpxOo.exe
  C:\Windows\System\pPSpxOo.exe
  2⤵
  PID:9312
- C:\Windows\System\sZZKrpg.exe
  C:\Windows\System\sZZKrpg.exe
  2⤵
  PID:9340
- C:\Windows\System\hLnGclS.exe
  C:\Windows\System\hLnGclS.exe
  2⤵
  PID:9368
- C:\Windows\System\qAIjrrm.exe
  C:\Windows\System\qAIjrrm.exe
  2⤵
  PID:9396
- C:\Windows\System\PPZJyhZ.exe
  C:\Windows\System\PPZJyhZ.exe
  2⤵
  PID:9420
- C:\Windows\System\UwYgXiC.exe
  C:\Windows\System\UwYgXiC.exe
  2⤵
  PID:9452
- C:\Windows\System\zSjACRG.exe
  C:\Windows\System\zSjACRG.exe
  2⤵
  PID:9468
- C:\Windows\System\QiCCMia.exe
  C:\Windows\System\QiCCMia.exe
  2⤵
  PID:9492
- C:\Windows\System\OHNnFhE.exe
  C:\Windows\System\OHNnFhE.exe
  2⤵
  PID:9512
- C:\Windows\System\PbLlgCs.exe
  C:\Windows\System\PbLlgCs.exe
  2⤵
  PID:9544
- C:\Windows\System\lDrcwca.exe
  C:\Windows\System\lDrcwca.exe
  2⤵
  PID:9560
- C:\Windows\System\UutCZMD.exe
  C:\Windows\System\UutCZMD.exe
  2⤵
  PID:9608
- C:\Windows\System\sgjFpJa.exe
  C:\Windows\System\sgjFpJa.exe
  2⤵
  PID:9656
- C:\Windows\System\CosiTgO.exe
  C:\Windows\System\CosiTgO.exe
  2⤵
  PID:9676
- C:\Windows\System\WcHGsjQ.exe
  C:\Windows\System\WcHGsjQ.exe
  2⤵
  PID:9700
- C:\Windows\System\RamQnpA.exe
  C:\Windows\System\RamQnpA.exe
  2⤵
  PID:9748
- C:\Windows\System\xdimUXS.exe
  C:\Windows\System\xdimUXS.exe
  2⤵
  PID:9768
- C:\Windows\System\uNxpqWS.exe
  C:\Windows\System\uNxpqWS.exe
  2⤵
  PID:9800
- C:\Windows\System\vjKXePv.exe
  C:\Windows\System\vjKXePv.exe
  2⤵
  PID:9824
- C:\Windows\System\SpkoWFT.exe
  C:\Windows\System\SpkoWFT.exe
  2⤵
  PID:9848
- C:\Windows\System\MDFAkdU.exe
  C:\Windows\System\MDFAkdU.exe
  2⤵
  PID:9896
- C:\Windows\System\nbKwoPC.exe
  C:\Windows\System\nbKwoPC.exe
  2⤵
  PID:9912
- C:\Windows\System\YHbHgSc.exe
  C:\Windows\System\YHbHgSc.exe
  2⤵
  PID:9944
- C:\Windows\System\MSLyniZ.exe
  C:\Windows\System\MSLyniZ.exe
  2⤵
  PID:9976
- C:\Windows\System\IwUEbXB.exe
  C:\Windows\System\IwUEbXB.exe
  2⤵
  PID:10008
- C:\Windows\System\JraPasP.exe
  C:\Windows\System\JraPasP.exe
  2⤵
  PID:10036
- C:\Windows\System\XPLpMix.exe
  C:\Windows\System\XPLpMix.exe
  2⤵
  PID:10056
- C:\Windows\System\JVdmOgE.exe
  C:\Windows\System\JVdmOgE.exe
  2⤵
  PID:10096
- C:\Windows\System\TCPCUAx.exe
  C:\Windows\System\TCPCUAx.exe
  2⤵
  PID:10120
- C:\Windows\System\paCocrT.exe
  C:\Windows\System\paCocrT.exe
  2⤵
  PID:10140
- C:\Windows\System\zaEqlft.exe
  C:\Windows\System\zaEqlft.exe
  2⤵
  PID:10160
- C:\Windows\System\fAjkMbJ.exe
  C:\Windows\System\fAjkMbJ.exe
  2⤵
  PID:10188
- C:\Windows\System\xpIyMpx.exe
  C:\Windows\System\xpIyMpx.exe
  2⤵
  PID:10216
- C:\Windows\System\TKCwgeJ.exe
  C:\Windows\System\TKCwgeJ.exe
  2⤵
  PID:8520
- C:\Windows\System\LMgIRRL.exe
  C:\Windows\System\LMgIRRL.exe
  2⤵
  PID:9320
- C:\Windows\System\eDzVOTB.exe
  C:\Windows\System\eDzVOTB.exe
  2⤵
  PID:9500
- C:\Windows\System\yDniTZf.exe
  C:\Windows\System\yDniTZf.exe
  2⤵
  PID:9476
- C:\Windows\System\CireOXb.exe
  C:\Windows\System\CireOXb.exe
  2⤵
  PID:9460
- C:\Windows\System\zduiQCL.exe
  C:\Windows\System\zduiQCL.exe
  2⤵
  PID:9532
- C:\Windows\System\HMNUcxz.exe
  C:\Windows\System\HMNUcxz.exe
  2⤵
  PID:9588
- C:\Windows\System\ZlIjTXW.exe
  C:\Windows\System\ZlIjTXW.exe
  2⤵
  PID:9648
- C:\Windows\System\YziQVBX.exe
  C:\Windows\System\YziQVBX.exe
  2⤵
  PID:9692
- C:\Windows\System\FeCDjjk.exe
  C:\Windows\System\FeCDjjk.exe
  2⤵
  PID:9732
- C:\Windows\System\qfwdLWS.exe
  C:\Windows\System\qfwdLWS.exe
  2⤵
  PID:9816
- C:\Windows\System\CqlPKhi.exe
  C:\Windows\System\CqlPKhi.exe
  2⤵
  PID:9880
- C:\Windows\System\NnmXoFP.exe
  C:\Windows\System\NnmXoFP.exe
  2⤵
  PID:9904
- C:\Windows\System\UghLDqU.exe
  C:\Windows\System\UghLDqU.exe
  2⤵
  PID:10016
- C:\Windows\System\wMeFHXU.exe
  C:\Windows\System\wMeFHXU.exe
  2⤵
  PID:10132
- C:\Windows\System\MhccccK.exe
  C:\Windows\System\MhccccK.exe
  2⤵
  PID:2420
- C:\Windows\System\zJsOGNQ.exe
  C:\Windows\System\zJsOGNQ.exe
  2⤵
  PID:9572
- C:\Windows\System\UUcRbqM.exe
  C:\Windows\System\UUcRbqM.exe
  2⤵
  PID:9488
- C:\Windows\System\kiNMEEM.exe
  C:\Windows\System\kiNMEEM.exe
  2⤵
  PID:9412
- C:\Windows\System\OCtpjML.exe
  C:\Windows\System\OCtpjML.exe
  2⤵
  PID:9628
- C:\Windows\System\DpEneAN.exe
  C:\Windows\System\DpEneAN.exe
  2⤵
  PID:9928
- C:\Windows\System\odiKfPc.exe
  C:\Windows\System\odiKfPc.exe
  2⤵
  PID:10024
- C:\Windows\System\zZpLtjs.exe
  C:\Windows\System\zZpLtjs.exe
  2⤵
  PID:8844
- C:\Windows\System\QqwIiGD.exe
  C:\Windows\System\QqwIiGD.exe
  2⤵
  PID:10204
- C:\Windows\System\wbgIusz.exe
  C:\Windows\System\wbgIusz.exe
  2⤵
  PID:3360
- C:\Windows\System\dDzfjzS.exe
  C:\Windows\System\dDzfjzS.exe
  2⤵
  PID:9404
- C:\Windows\System\jjEvaUv.exe
  C:\Windows\System\jjEvaUv.exe
  2⤵
  PID:10180
- C:\Windows\System\jSdlBOQ.exe
  C:\Windows\System\jSdlBOQ.exe
  2⤵
  PID:9376
- C:\Windows\System\KVwfJnl.exe
  C:\Windows\System\KVwfJnl.exe
  2⤵
  PID:9724
- C:\Windows\System\GaMaKJe.exe
  C:\Windows\System\GaMaKJe.exe
  2⤵
  PID:4632
- C:\Windows\System\GTHHnlU.exe
  C:\Windows\System\GTHHnlU.exe
  2⤵
  PID:3364
- C:\Windows\System\AMmxusR.exe
  C:\Windows\System\AMmxusR.exe
  2⤵
  PID:10156
- C:\Windows\System\NrCteik.exe
  C:\Windows\System\NrCteik.exe
  2⤵
  PID:1984
- C:\Windows\System\ifKXhzY.exe
  C:\Windows\System\ifKXhzY.exe
  2⤵
  PID:2500
- C:\Windows\System\UPzQtRc.exe
  C:\Windows\System\UPzQtRc.exe
  2⤵
  PID:10268
- C:\Windows\System\lBQDfrI.exe
  C:\Windows\System\lBQDfrI.exe
  2⤵
  PID:10292
- C:\Windows\System\VyPauXE.exe
  C:\Windows\System\VyPauXE.exe
  2⤵
  PID:10312
- C:\Windows\System\GqtLQSi.exe
  C:\Windows\System\GqtLQSi.exe
  2⤵
  PID:10332
- C:\Windows\System\UunKYYR.exe
  C:\Windows\System\UunKYYR.exe
  2⤵
  PID:10360
- C:\Windows\System\qEVoxHX.exe
  C:\Windows\System\qEVoxHX.exe
  2⤵
  PID:10400
- C:\Windows\System\SyEnTTP.exe
  C:\Windows\System\SyEnTTP.exe
  2⤵
  PID:10452
- C:\Windows\System\YGtDVBb.exe
  C:\Windows\System\YGtDVBb.exe
  2⤵
  PID:10476
- C:\Windows\System\VVhhaWW.exe
  C:\Windows\System\VVhhaWW.exe
  2⤵
  PID:10500
- C:\Windows\System\RdvOrPQ.exe
  C:\Windows\System\RdvOrPQ.exe
  2⤵
  PID:10516
- C:\Windows\System\odIBoYw.exe
  C:\Windows\System\odIBoYw.exe
  2⤵
  PID:10532
- C:\Windows\System\pjqBefR.exe
  C:\Windows\System\pjqBefR.exe
  2⤵
  PID:10572
- C:\Windows\System\lgvrVOT.exe
  C:\Windows\System\lgvrVOT.exe
  2⤵
  PID:10592
- C:\Windows\System\Nnougba.exe
  C:\Windows\System\Nnougba.exe
  2⤵
  PID:10616
- C:\Windows\System\mlkWqtC.exe
  C:\Windows\System\mlkWqtC.exe
  2⤵
  PID:10660
- C:\Windows\System\TVRwdDD.exe
  C:\Windows\System\TVRwdDD.exe
  2⤵
  PID:10692
- C:\Windows\System\muVKkNf.exe
  C:\Windows\System\muVKkNf.exe
  2⤵
  PID:10724
- C:\Windows\System\anmYJyu.exe
  C:\Windows\System\anmYJyu.exe
  2⤵
  PID:10744
- C:\Windows\System\tcyDGXD.exe
  C:\Windows\System\tcyDGXD.exe
  2⤵
  PID:10780
- C:\Windows\System\ltPQqZk.exe
  C:\Windows\System\ltPQqZk.exe
  2⤵
  PID:10812
- C:\Windows\System\nvYClKy.exe
  C:\Windows\System\nvYClKy.exe
  2⤵
  PID:10832
- C:\Windows\System\WLSLbga.exe
  C:\Windows\System\WLSLbga.exe
  2⤵
  PID:10856
- C:\Windows\System\mshVZEZ.exe
  C:\Windows\System\mshVZEZ.exe
  2⤵
  PID:10892
- C:\Windows\System\pjIsHkL.exe
  C:\Windows\System\pjIsHkL.exe
  2⤵
  PID:10924
- C:\Windows\System\FKASJJI.exe
  C:\Windows\System\FKASJJI.exe
  2⤵
  PID:10968
- C:\Windows\System\qKNCnJM.exe
  C:\Windows\System\qKNCnJM.exe
  2⤵
  PID:10992
- C:\Windows\System\WgNpPgr.exe
  C:\Windows\System\WgNpPgr.exe
  2⤵
  PID:11012
- C:\Windows\System\SRIeqcd.exe
  C:\Windows\System\SRIeqcd.exe
  2⤵
  PID:11032
- C:\Windows\System\fRJoNeb.exe
  C:\Windows\System\fRJoNeb.exe
  2⤵
  PID:11056
- C:\Windows\System\kehzysM.exe
  C:\Windows\System\kehzysM.exe
  2⤵
  PID:11072
- C:\Windows\System\GHhIeNk.exe
  C:\Windows\System\GHhIeNk.exe
  2⤵
  PID:11116
- C:\Windows\System\FFNwoxc.exe
  C:\Windows\System\FFNwoxc.exe
  2⤵
  PID:11148
- C:\Windows\System\bYdznET.exe
  C:\Windows\System\bYdznET.exe
  2⤵
  PID:11172
- C:\Windows\System\jHiVRDL.exe
  C:\Windows\System\jHiVRDL.exe
  2⤵
  PID:11192
- C:\Windows\System\OSVppgZ.exe
  C:\Windows\System\OSVppgZ.exe
  2⤵
  PID:11212
- C:\Windows\System\MXXKRGb.exe
  C:\Windows\System\MXXKRGb.exe
  2⤵
  PID:11240
- C:\Windows\System\DprMadt.exe
  C:\Windows\System\DprMadt.exe
  2⤵
  PID:9728
- C:\Windows\System\nUPBmVN.exe
  C:\Windows\System\nUPBmVN.exe
  2⤵
  PID:10276
- C:\Windows\System\njIIdIE.exe
  C:\Windows\System\njIIdIE.exe
  2⤵
  PID:10356
- C:\Windows\System\QoUQBMp.exe
  C:\Windows\System\QoUQBMp.exe
  2⤵
  PID:10328
- C:\Windows\System\LpJyChP.exe
  C:\Windows\System\LpJyChP.exe
  2⤵
  PID:10548
- C:\Windows\System\FQLsnwW.exe
  C:\Windows\System\FQLsnwW.exe
  2⤵
  PID:10608
- C:\Windows\System\MRPSvmb.exe
  C:\Windows\System\MRPSvmb.exe
  2⤵
  PID:10636
- C:\Windows\System\zDRpCaO.exe
  C:\Windows\System\zDRpCaO.exe
  2⤵
  PID:10716
- C:\Windows\System\XFDJxTA.exe
  C:\Windows\System\XFDJxTA.exe
  2⤵
  PID:10772
- C:\Windows\System\oyfGewg.exe
  C:\Windows\System\oyfGewg.exe
  2⤵
  PID:10824
- C:\Windows\System\FvOGZKX.exe
  C:\Windows\System\FvOGZKX.exe
  2⤵
  PID:10940
- C:\Windows\System\VaQKMsb.exe
  C:\Windows\System\VaQKMsb.exe
  2⤵
  PID:9696
- C:\Windows\System\HxtDdfb.exe
  C:\Windows\System\HxtDdfb.exe
  2⤵
  PID:11088
- C:\Windows\System\noZOjgq.exe
  C:\Windows\System\noZOjgq.exe
  2⤵
  PID:11108
- C:\Windows\System\YgPgsIy.exe
  C:\Windows\System\YgPgsIy.exe
  2⤵
  PID:11164
- C:\Windows\System\jaFWcBs.exe
  C:\Windows\System\jaFWcBs.exe
  2⤵
  PID:10228
- C:\Windows\System\jPnrhsY.exe
  C:\Windows\System\jPnrhsY.exe
  2⤵
  PID:10388
- C:\Windows\System\UXAjtqz.exe
  C:\Windows\System\UXAjtqz.exe
  2⤵
  PID:10488
- C:\Windows\System\EgvESoz.exe
  C:\Windows\System\EgvESoz.exe
  2⤵
  PID:10684
- C:\Windows\System\GWnnqdd.exe
  C:\Windows\System\GWnnqdd.exe
  2⤵
  PID:10808
- C:\Windows\System\TxEtGSd.exe
  C:\Windows\System\TxEtGSd.exe
  2⤵
  PID:10920
- C:\Windows\System\XbEwdCx.exe
  C:\Windows\System\XbEwdCx.exe
  2⤵
  PID:11024
- C:\Windows\System\ZIxCqfv.exe
  C:\Windows\System\ZIxCqfv.exe
  2⤵
  PID:11204
- C:\Windows\System\atNEJvX.exe
  C:\Windows\System\atNEJvX.exe
  2⤵
  PID:10288
- C:\Windows\System\eGRkgsz.exe
  C:\Windows\System\eGRkgsz.exe
  2⤵
  PID:10584
- C:\Windows\System\TUMJRcV.exe
  C:\Windows\System\TUMJRcV.exe
  2⤵
  PID:11044
- C:\Windows\System\zdgsQQC.exe
  C:\Windows\System\zdgsQQC.exe
  2⤵
  PID:10264
- C:\Windows\System\cpMmyhz.exe
  C:\Windows\System\cpMmyhz.exe
  2⤵
  PID:10948
- C:\Windows\System\DuzNEga.exe
  C:\Windows\System\DuzNEga.exe
  2⤵
  PID:11288
- C:\Windows\System\wrzQkAE.exe
  C:\Windows\System\wrzQkAE.exe
  2⤵
  PID:11312
- C:\Windows\System\ZGRyJsu.exe
  C:\Windows\System\ZGRyJsu.exe
  2⤵
  PID:11332
- C:\Windows\System\NDMrbVN.exe
  C:\Windows\System\NDMrbVN.exe
  2⤵
  PID:11348
- C:\Windows\System\eIHdtGh.exe
  C:\Windows\System\eIHdtGh.exe
  2⤵
  PID:11396
- C:\Windows\System\adKWDsy.exe
  C:\Windows\System\adKWDsy.exe
  2⤵
  PID:11416
- C:\Windows\System\WNLKcLh.exe
  C:\Windows\System\WNLKcLh.exe
  2⤵
  PID:11448
- C:\Windows\System\uLjtzmV.exe
  C:\Windows\System\uLjtzmV.exe
  2⤵
  PID:11472
- C:\Windows\System\HgDAudA.exe
  C:\Windows\System\HgDAudA.exe
  2⤵
  PID:11500
- C:\Windows\System\ZEaTSIz.exe
  C:\Windows\System\ZEaTSIz.exe
  2⤵
  PID:11520
- C:\Windows\System\JTisGjO.exe
  C:\Windows\System\JTisGjO.exe
  2⤵
  PID:11568
- C:\Windows\System\vFjxikc.exe
  C:\Windows\System\vFjxikc.exe
  2⤵
  PID:11588
- C:\Windows\System\AMELfen.exe
  C:\Windows\System\AMELfen.exe
  2⤵
  PID:11620
- C:\Windows\System\ZsfSTku.exe
  C:\Windows\System\ZsfSTku.exe
  2⤵
  PID:11640
- C:\Windows\System\VtRrcNJ.exe
  C:\Windows\System\VtRrcNJ.exe
  2⤵
  PID:11672
- C:\Windows\System\NozMouh.exe
  C:\Windows\System\NozMouh.exe
  2⤵
  PID:11700
- C:\Windows\System\bystEzZ.exe
  C:\Windows\System\bystEzZ.exe
  2⤵
  PID:11732
- C:\Windows\System\CASCtOJ.exe
  C:\Windows\System\CASCtOJ.exe
  2⤵
  PID:11752
- C:\Windows\System\eFJVoud.exe
  C:\Windows\System\eFJVoud.exe
  2⤵
  PID:11788
- C:\Windows\System\uTIhOPM.exe
  C:\Windows\System\uTIhOPM.exe
  2⤵
  PID:11820
- C:\Windows\System\wWIWoJh.exe
  C:\Windows\System\wWIWoJh.exe
  2⤵
  PID:11840
- C:\Windows\System\RuaWVjR.exe
  C:\Windows\System\RuaWVjR.exe
  2⤵
  PID:11864
- C:\Windows\System\DchzxJb.exe
  C:\Windows\System\DchzxJb.exe
  2⤵
  PID:11904
- C:\Windows\System\pwgJlCu.exe
  C:\Windows\System\pwgJlCu.exe
  2⤵
  PID:11928
- C:\Windows\System\hwxDKgc.exe
  C:\Windows\System\hwxDKgc.exe
  2⤵
  PID:11948
- C:\Windows\System\HRGdFjf.exe
  C:\Windows\System\HRGdFjf.exe
  2⤵
  PID:11972
- C:\Windows\System\uTbYiGI.exe
  C:\Windows\System\uTbYiGI.exe
  2⤵
  PID:11992
- C:\Windows\System\SUWiGLR.exe
  C:\Windows\System\SUWiGLR.exe
  2⤵
  PID:12036
- C:\Windows\System\GfynCxX.exe
  C:\Windows\System\GfynCxX.exe
  2⤵
  PID:12060
- C:\Windows\System\XGruWdZ.exe
  C:\Windows\System\XGruWdZ.exe
  2⤵
  PID:12088
- C:\Windows\System\OvqszOK.exe
  C:\Windows\System\OvqszOK.exe
  2⤵
  PID:12112
- C:\Windows\System\kflXrAG.exe
  C:\Windows\System\kflXrAG.exe
  2⤵
  PID:12152
- C:\Windows\System\YVvwlOt.exe
  C:\Windows\System\YVvwlOt.exe
  2⤵
  PID:12172
- C:\Windows\System\pdwzGgj.exe
  C:\Windows\System\pdwzGgj.exe
  2⤵
  PID:12204
- C:\Windows\System\JJXbRIo.exe
  C:\Windows\System\JJXbRIo.exe
  2⤵
  PID:12232
- C:\Windows\System\htFODQV.exe
  C:\Windows\System\htFODQV.exe
  2⤵
  PID:12252
- C:\Windows\System\irtOBAr.exe
  C:\Windows\System\irtOBAr.exe
  2⤵
  PID:12276
- C:\Windows\System\WTXvrUT.exe
  C:\Windows\System\WTXvrUT.exe
  2⤵
  PID:11140
- C:\Windows\System\DGDhjcb.exe
  C:\Windows\System\DGDhjcb.exe
  2⤵
  PID:11320
- C:\Windows\System\sINPPJL.exe
  C:\Windows\System\sINPPJL.exe
  2⤵
  PID:11408
- C:\Windows\System\UUffnpS.exe
  C:\Windows\System\UUffnpS.exe
  2⤵
  PID:11544
- C:\Windows\System\FTzPwfY.exe
  C:\Windows\System\FTzPwfY.exe
  2⤵
  PID:11560
- C:\Windows\System\tjDMnLA.exe
  C:\Windows\System\tjDMnLA.exe
  2⤵
  PID:1800
- C:\Windows\System\NdnbPQH.exe
  C:\Windows\System\NdnbPQH.exe
  2⤵
  PID:11612
- C:\Windows\System\QssbTjA.exe
  C:\Windows\System\QssbTjA.exe
  2⤵
  PID:11668
- C:\Windows\System\kUGMRSV.exe
  C:\Windows\System\kUGMRSV.exe
  2⤵
  PID:11688
- C:\Windows\System\nZVfSWe.exe
  C:\Windows\System\nZVfSWe.exe
  2⤵
  PID:11768
- C:\Windows\System\IeYFRJr.exe
  C:\Windows\System\IeYFRJr.exe
  2⤵
  PID:11836
- C:\Windows\System\WTqKhrF.exe
  C:\Windows\System\WTqKhrF.exe
  2⤵
  PID:11892
- C:\Windows\System\LwsCLgd.exe
  C:\Windows\System\LwsCLgd.exe
  2⤵
  PID:11960
- C:\Windows\System\vlqbGjl.exe
  C:\Windows\System\vlqbGjl.exe
  2⤵
  PID:12008
- C:\Windows\System\iiREHBo.exe
  C:\Windows\System\iiREHBo.exe
  2⤵
  PID:12072
- C:\Windows\System\qLZeStt.exe
  C:\Windows\System\qLZeStt.exe
  2⤵
  PID:12104
- C:\Windows\System\sgvyqnB.exe
  C:\Windows\System\sgvyqnB.exe
  2⤵
  PID:12164
- C:\Windows\System\dIjVDia.exe
  C:\Windows\System\dIjVDia.exe
  2⤵
  PID:10652
- C:\Windows\System\tejmpKo.exe
  C:\Windows\System\tejmpKo.exe
  2⤵
  PID:11512
- C:\Windows\System\YWtFQSq.exe
  C:\Windows\System\YWtFQSq.exe
  2⤵
  PID:11584
- C:\Windows\System\lmDyWVz.exe
  C:\Windows\System\lmDyWVz.exe
  2⤵
  PID:11656
- C:\Windows\System\KUFBPCf.exe
  C:\Windows\System\KUFBPCf.exe
  2⤵
  PID:8084
- C:\Windows\System\hoYKxjE.exe
  C:\Windows\System\hoYKxjE.exe
  2⤵
  PID:11780
- C:\Windows\System\sfeMFLf.exe
  C:\Windows\System\sfeMFLf.exe
  2⤵
  PID:12052
- C:\Windows\System\OkTWqyY.exe
  C:\Windows\System\OkTWqyY.exe
  2⤵
  PID:12224
- C:\Windows\System\oHHVDLP.exe
  C:\Windows\System\oHHVDLP.exe
  2⤵
  PID:11372
- C:\Windows\System\VAlkcmw.exe
  C:\Windows\System\VAlkcmw.exe
  2⤵
  PID:1676
- C:\Windows\System\hQxEqmL.exe
  C:\Windows\System\hQxEqmL.exe
  2⤵
  PID:11916
- C:\Windows\System\GUpbKRw.exe
  C:\Windows\System\GUpbKRw.exe
  2⤵
  PID:12056
- C:\Windows\System\DfapcsG.exe
  C:\Windows\System\DfapcsG.exe
  2⤵
  PID:12192
- C:\Windows\System\QyVgdBz.exe
  C:\Windows\System\QyVgdBz.exe
  2⤵
  PID:1572
- C:\Windows\System\NHSShnj.exe
  C:\Windows\System\NHSShnj.exe
  2⤵
  PID:4928
- C:\Windows\System\SBAAeGo.exe
  C:\Windows\System\SBAAeGo.exe
  2⤵
  PID:12300
- C:\Windows\System\yQrFnka.exe
  C:\Windows\System\yQrFnka.exe
  2⤵
  PID:12324
- C:\Windows\System\ChfiVaP.exe
  C:\Windows\System\ChfiVaP.exe
  2⤵
  PID:12340
- C:\Windows\System\EaFzgTN.exe
  C:\Windows\System\EaFzgTN.exe
  2⤵
  PID:12360
- C:\Windows\System\HxBFdBA.exe
  C:\Windows\System\HxBFdBA.exe
  2⤵
  PID:12380
- C:\Windows\System\XCMhjiy.exe
  C:\Windows\System\XCMhjiy.exe
  2⤵
  PID:12408
- C:\Windows\System\tLtGcbr.exe
  C:\Windows\System\tLtGcbr.exe
  2⤵
  PID:12448
- C:\Windows\System\wNzvJyY.exe
  C:\Windows\System\wNzvJyY.exe
  2⤵
  PID:12484
- C:\Windows\System\lFgLEnN.exe
  C:\Windows\System\lFgLEnN.exe
  2⤵
  PID:12512
- C:\Windows\System\lpzAwbz.exe
  C:\Windows\System\lpzAwbz.exe
  2⤵
  PID:12528
- C:\Windows\System\ZBsbANj.exe
  C:\Windows\System\ZBsbANj.exe
  2⤵
  PID:12544
- C:\Windows\System\DbkVjHz.exe
  C:\Windows\System\DbkVjHz.exe
  2⤵
  PID:12584
- C:\Windows\System\oDNHiit.exe
  C:\Windows\System\oDNHiit.exe
  2⤵
  PID:12636
- C:\Windows\System\ExfSfhc.exe
  C:\Windows\System\ExfSfhc.exe
  2⤵
  PID:12668
- C:\Windows\System\rBDHsFb.exe
  C:\Windows\System\rBDHsFb.exe
  2⤵
  PID:12692
- C:\Windows\System\AnPoaYY.exe
  C:\Windows\System\AnPoaYY.exe
  2⤵
  PID:12708
- C:\Windows\System\PgeRRHA.exe
  C:\Windows\System\PgeRRHA.exe
  2⤵
  PID:12724
- C:\Windows\System\gYCPwjQ.exe
  C:\Windows\System\gYCPwjQ.exe
  2⤵
  PID:12776
- C:\Windows\System\XzPtgbi.exe
  C:\Windows\System\XzPtgbi.exe
  2⤵
  PID:12800
- C:\Windows\System\iVqJhBT.exe
  C:\Windows\System\iVqJhBT.exe
  2⤵
  PID:12828
- C:\Windows\System\CNuXYIj.exe
  C:\Windows\System\CNuXYIj.exe
  2⤵
  PID:12856
- C:\Windows\System\sIxupuu.exe
  C:\Windows\System\sIxupuu.exe
  2⤵
  PID:12888
- C:\Windows\System\tjlyzXv.exe
  C:\Windows\System\tjlyzXv.exe
  2⤵
  PID:12904
- C:\Windows\System\HzTYwEP.exe
  C:\Windows\System\HzTYwEP.exe
  2⤵
  PID:12956
- C:\Windows\System\SCnpdfe.exe
  C:\Windows\System\SCnpdfe.exe
  2⤵
  PID:12976
- C:\Windows\System\quckaUf.exe
  C:\Windows\System\quckaUf.exe
  2⤵
  PID:13012
- C:\Windows\System\mUnsTvJ.exe
  C:\Windows\System\mUnsTvJ.exe
  2⤵
  PID:13028
- C:\Windows\System\MVDnGmx.exe
  C:\Windows\System\MVDnGmx.exe
  2⤵
  PID:13068
- C:\Windows\System\eMaAIIE.exe
  C:\Windows\System\eMaAIIE.exe
  2⤵
  PID:13092
- C:\Windows\System\yRnbUIF.exe
  C:\Windows\System\yRnbUIF.exe
  2⤵
  PID:13112
- C:\Windows\System\aPUnknz.exe
  C:\Windows\System\aPUnknz.exe
  2⤵
  PID:13132
- C:\Windows\System\vfOCXnT.exe
  C:\Windows\System\vfOCXnT.exe
  2⤵
  PID:13148
- C:\Windows\System\IxLyWpg.exe
  C:\Windows\System\IxLyWpg.exe
  2⤵
  PID:13172
- C:\Windows\System\XFYKwGq.exe
  C:\Windows\System\XFYKwGq.exe
  2⤵
  PID:13192
- C:\Windows\System\rJlVtle.exe
  C:\Windows\System\rJlVtle.exe
  2⤵
  PID:13232
- C:\Windows\System\KyBZuPF.exe
  C:\Windows\System\KyBZuPF.exe
  2⤵
  PID:13256
- C:\Windows\System\MQHpJCH.exe
  C:\Windows\System\MQHpJCH.exe
  2⤵
  PID:13276
- C:\Windows\System\BQGUyUH.exe
  C:\Windows\System\BQGUyUH.exe
  2⤵
  PID:12336
- C:\Windows\System\YrJqSAg.exe
  C:\Windows\System\YrJqSAg.exe
  2⤵
  PID:12372
- C:\Windows\System\XkjvCOS.exe
  C:\Windows\System\XkjvCOS.exe
  2⤵
  PID:12456
- C:\Windows\System\cFXjHiO.exe
  C:\Windows\System\cFXjHiO.exe
  2⤵
  PID:12520
- C:\Windows\System\MSZhdyM.exe
  C:\Windows\System\MSZhdyM.exe
  2⤵
  PID:12476
- C:\Windows\System\ZUGXLmF.exe
  C:\Windows\System\ZUGXLmF.exe
  2⤵
  PID:12680
- C:\Windows\System\IxsCSOn.exe
  C:\Windows\System\IxsCSOn.exe
  2⤵
  PID:12740
- C:\Windows\System\oaLYYDO.exe
  C:\Windows\System\oaLYYDO.exe
  2⤵
  PID:12820
- C:\Windows\System\sLHdtGB.exe
  C:\Windows\System\sLHdtGB.exe
  2⤵
  PID:12864
- C:\Windows\System\NpiSsXa.exe
  C:\Windows\System\NpiSsXa.exe
  2⤵
  PID:12900
- C:\Windows\System\qJVfemn.exe
  C:\Windows\System\qJVfemn.exe
  2⤵
  PID:12932
- C:\Windows\System\JEGGGbk.exe
  C:\Windows\System\JEGGGbk.exe
  2⤵
  PID:13024
- C:\Windows\System\GbxfXFd.exe
  C:\Windows\System\GbxfXFd.exe
  2⤵
  PID:13108
- C:\Windows\System\bfhfHzZ.exe
  C:\Windows\System\bfhfHzZ.exe
  2⤵
  PID:13160
- C:\Windows\System\UXfJhHD.exe
  C:\Windows\System\UXfJhHD.exe
  2⤵
  PID:13284
- C:\Windows\System\RTAXjUa.exe
  C:\Windows\System\RTAXjUa.exe
  2⤵
  PID:13240
- C:\Windows\System\xCAaIAv.exe
  C:\Windows\System\xCAaIAv.exe
  2⤵
  PID:11764
- C:\Windows\System\xHbFoQB.exe
  C:\Windows\System\xHbFoQB.exe
  2⤵
  PID:12388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vjgz2qff.2sd.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ASoneeD.exe

Filesize
2.3MB

MD5
803464522961f9cbb274426563992560

SHA1
a7c50648d141fe1752eeab8682f6dc477c4bf123

SHA256
8a0017058f4505b7328b9238fae3f481a449fa9344983b158c3e71ecd2543770

SHA512
de79b442600b1fc1b3cbc23e91bbf995f4aeb5742c42d4e56078dbbf5bc5213b58b7ac9e5d07d66788e42a10a45b3cb45f9bde420c2d851effbd7d0798296155

Download Submit
C:\Windows\System\AswGVSE.exe

Filesize
2.3MB

MD5
7760aacccbc872b4f62c2e049b4cebb1

SHA1
4319a373a76d4b8653a005527a3224f43354d845

SHA256
f377923e6ce018a99ebea8b67502312212331986d396509582d6e51ba8cf1c70

SHA512
5c0fd372365d19ef833843ab491e8caa28cb8ba4666e995be1b11f78c8eebc4b50f1fd344e03672bbbedc36406b40401519aa69af480063587d36a9abddfa8ff

Download Submit
C:\Windows\System\EBhnmnP.exe

Filesize
2.3MB

MD5
c74aef3152bb910d42c14aba66b1a7a9

SHA1
8031f1d33201829da744d9eaf0aa4f0c622d97e5

SHA256
002ef7612e7a17c38bee96b5ef15d1dc3a9e91ff1d33e08ef38308ed3af5971c

SHA512
5bd447f8bf47319f7318c145a8cbb94b6af73a8f686753faa1e13ea1991dc88d1d404cf1b33d6409d055bfbdc1297460b5c1f32de1dd61d49e82bb4eec1744e7

Download Submit
C:\Windows\System\HnhRKjW.exe

Filesize
2.3MB

MD5
29a4b719c88752a0941e963ecf1c4d2e

SHA1
e6e57bea4d503d80d09957e1739661b417ec48ec

SHA256
33bfb2e7bf5202a4f471b95883d26a21d238d8ae21a3b9b73247ea9cc2519379

SHA512
f5015f4c14ab67f98b454046ce91ad17c5928ee985bb8e366b455f9d119441e67615bfcc319f217fc5776257270fde1b1f1f4f2ea61c430e03e466a02260151f

Download Submit
C:\Windows\System\JRRizik.exe

Filesize
2.3MB

MD5
e75cf83da00f9936b0a391a5d09181da

SHA1
a58225b5a2c2a038bca2756a85a185d83b0f85f9

SHA256
c02d8295df56bbd2cc9b2e20d7007b0188bd9efa802829320884b78191849fa4

SHA512
7d237d74bd357ed01ac4c8733ffec9fba6d6501d50668851fd96d518a99c8be8b91ea3140af2c661ced8478d22772549dfde7d7340f404c42b3fe953e111c994

Download Submit
C:\Windows\System\KFTvmFb.exe

Filesize
2.3MB

MD5
4d9237133b2329e6023711cc20bfdd3e

SHA1
c80bd5d1e7191cf70276d413ec68a4c813db2dac

SHA256
af6eabb3023883ffb1b13d6ad6862a1c9e35eebfaea1cd93adcd1da343ac78b1

SHA512
73d3a82bb0d58806294797d70ec57939681c40e76befc45d971b54981106a420ff19db07d380d991068ab589ab4e9ab9647edf36b0e436f5b9112f7b5bd53876

Download Submit
C:\Windows\System\LDMpSpl.exe

Filesize
2.3MB

MD5
65e526e4f5037f7b8b8be9c23334bb14

SHA1
bb17cb7e710e8b41f38c8ad3658cae08bf82c24a

SHA256
89d9e5f5b730611fd9ae2070401990cf44dc99837f6649323e81558d582b7fc1

SHA512
fffe15086a2cd2e3991a3286b27ad441964a37edac70d09a8543e2a5b53913adc72b1642093155b3606a01f09d9bf6b54bc6b7096042e012793dc83fbf00339e

Download Submit
C:\Windows\System\MMWoRru.exe

Filesize
2.3MB

MD5
c8131e83d14edb7683c06585fec16dba

SHA1
6127c99095e225e4c7070c1a1441e67b806d5b81

SHA256
0f2a8f49994a7702fb6a143f12eae1fe5b57caceedf018e9ee7ad756160b40c5

SHA512
6ce17046c944fae45c44fb1a2f4d17c1a3de6779dac0000836853cf0a9b32652ce822af78971a24834605ee816ba04af54077efaa72538728c99aa2cfc194f77

Download Submit
C:\Windows\System\MkGOzeA.exe

Filesize
2.3MB

MD5
960113557002c157a7efaaa4659c2efe

SHA1
924a5aa7bfdf584344f9a730a14b304dedca79bf

SHA256
dadcb34db4fba48e8e370b3ef9399320c3211a58cd302b02f90eb01fa84f1508

SHA512
9ec6a6834e3d71d212c7da83b7af3354b0ace2d3653fcddf6a36b348f6b338262cbc430e0c4538dc49ef65abbf01299e7c7e965f0cf8e8381bfb246dc097f46b

Download Submit
C:\Windows\System\Mskeyxx.exe

Filesize
2.3MB

MD5
71f8cbcdcdca56a6cf9c889987bfd8e4

SHA1
6cac4986951a40b5bf981f80ee158679f65dbce9

SHA256
199234df7d7af9f5d2937f0a92cc1febcd762ac8b7f98c38f233a725ab4708d8

SHA512
0c1e50aef90609c70a675457d7f29e3bd9449fbb55628854b43ffd14d98294390c2f2cc3153ec905152504467061f143337ccf789cdb42d6517d2a3d0506c629

Download Submit
C:\Windows\System\NhmZDpx.exe

Filesize
2.3MB

MD5
7566752761acdb86a6eeb24840621646

SHA1
aba534bf0434be2974d6a94d1c17587c771347a3

SHA256
2d5af8655d30422923eaaa3188ac465e5a0cb419f5f0fbc22598dac3446e2fff

SHA512
61cf29e2daa0426d3bd9c10c15462295cbd006b435dc7c91a7b1ae8285d82c5c0a1907ce8d6fc44300b700de6c9c14558513f36875fc41bead243a92ada5f85b

Download Submit
C:\Windows\System\QagOVrx.exe

Filesize
2.3MB

MD5
dd39f9d60f275358fbf2802725237bb3

SHA1
fe5c14372238931a8011839c284eb337f21036a5

SHA256
1bfd31f2eb3cef1a5a2822506792d86c6cb287b844a7bed69ffe4e1cdb4a9e61

SHA512
1ae81d0cd742dd9992feb5f67f9931a33946d64f951299c7dd31e8dc1d69d57699479f6a5092bcd778b2a9fd2e379be60484daef3fceaad88892efd735b1642d

Download Submit
C:\Windows\System\Rjmjfxf.exe

Filesize
2.3MB

MD5
7e35d22eaf70c981be9d96f4de8dc630

SHA1
ea9435ee1532bed41de110b39e158d6dceee422c

SHA256
49d74760dc8c9609de5cbd869bf05597c3293fea13c96fc48db1f2771c2e4698

SHA512
ebcd2ebb12a3c946a5f8e03a37e5afb1970eedc24f7169a9be1a27cf3ee227713ce0e827e6994888c26d1120577b3c6acb054f607605d7fb84498604783df0b5

Download Submit
C:\Windows\System\RpMeXwc.exe

Filesize
2.3MB

MD5
419c0acbe19713be8b6d7e68ee2fabaf

SHA1
4bb1a19f1462948bb51b1cd2c076987f8710e26b

SHA256
1c84f15088284e78cabce45b6f0b5cd3f966d188a85b398b837293df91032694

SHA512
80b72f112934cf64125132ea1982bab6dd1f00561b34caad325101ccd032159d4a032886602ea0513ea123ad746c25cbaf86b1c264fac278addf8adec1a70366

Download Submit
C:\Windows\System\SHivlxL.exe

Filesize
2.3MB

MD5
928285def52718d2ae66fe11fe588125

SHA1
23986c7e26303df10191f0fc8d18a407842a5d1c

SHA256
8f142054629ea3cd42ad321fd1a55540b1f251ce5f1c8bb61a24708550f4ff94

SHA512
aca1b19146c3ab10350adb245173624712e655a2f4e20c6e95ecca5d5eb2cd18f0a083d855a76f4cc20f075542260e92343e9107ce51c45bfb360d91594ef85b

Download Submit
C:\Windows\System\TDJdNwM.exe

Filesize
2.3MB

MD5
23d8761fcd87f101523cb92ee11befe9

SHA1
df2589ac5e1ddc2f49927f79bfecfbb5ade2e122

SHA256
61de8f0df914ec63c711b7335de1932a1512aed0e3deda747c32f5f39547be8b

SHA512
200efdd47e535b233ca5495adf8c3b675b97c606606e9d5f8026393604cb36339574cd9672ff660bcba4ee4e92542ff4ed7e951ac1bd51b381f94b96b138b6ba

Download Submit
C:\Windows\System\TDokuUf.exe

Filesize
2.3MB

MD5
15f11703b00c0083c335882fe4f39dd9

SHA1
db0725b50528f3ecced9f1361b89dce37522b9a4

SHA256
316eaaffea15c57360d59e1b5ca8e287f469c16332602a68b38be9b596bada1a

SHA512
470565d9f1484b2071bead54a5bed2ea53141e2cceeed5a73154d4d345d04bdbb5b971981dd02df5d943cdd92ced675fc1cd572ea2e74cb0349e6f93a4e66c64

Download Submit
C:\Windows\System\UPMnQsv.exe

Filesize
2.3MB

MD5
95103cd311e11c3650a87bdffa5ebdef

SHA1
b066c3ea6ddd8836b8874cd735968080e0758519

SHA256
32712f75ac5809e16f0043348e2a27a4b6f611dcca85b3d11adafc4d2c4e2736

SHA512
afc49b5711c43383695c6d5a113f81879a911f5ed665bc8e7ebb4a42c5a32bc1ff8590ad7510abb93ff510cc5a74955968145dd3da989fed1c43e1e73971024e

Download Submit
C:\Windows\System\bGsKTrg.exe

Filesize
2.3MB

MD5
8f5d60cbf0ad9f8e98448ef0c5d33d7d

SHA1
7ea51de1556d6d1200578a0951205dd65cdf5c9f

SHA256
44f745a839b574fe6cfbc9e8d6d8fed000e70449e51c9853fb319a79ba10024e

SHA512
b75a641b69333b62bca9c20c5a51bea8e5dc27d0630a5c0c6a3adb05f9c0e797884e340b9cfd661302c1329c9ee8fb11c907a7e61318c73442f29bfa29197156

Download Submit
C:\Windows\System\bLtnRkK.exe

Filesize
2.3MB

MD5
735404e17bf1c10812b5011c60cff88f

SHA1
b4f19c7ddb371cf201bcd7fb7953eae90bd56a8b

SHA256
3523b841003ccf356517a83eb363287f4544966cfe9058e022f6883094e455e9

SHA512
f5f769866754bc1d7340c38604cd6bcc2984f0be1b97e82e2e71441180f384f6a363ed32d8f9b25967251a00a1b4d46331f071e1c7793df77c9017b5a8a208d4

Download Submit
C:\Windows\System\fPFvjaa.exe

Filesize
2.3MB

MD5
7e18f776eda4462b0680b7bfc132a1c4

SHA1
5ab9a9a32dcf203ba5bb97df9cfa0ec739827d73

SHA256
9df6f90f0fe52b7927b405d61939d62c6cc06a58c6203bf2744142d7ab78ce29

SHA512
ef4d158feb88122706419f705e76e148d4709b410f21464bc3435970f3e3ddb4162dca46c3ee1a1868e141d2ad54cada6a8832a7375995de852d543c99a8db1a

Download Submit
C:\Windows\System\fcPmPBK.exe

Filesize
2.3MB

MD5
3c29e1034738d7f5089442317f15c998

SHA1
57bdfc8d4379dce31cf727086790836fd3e4283a

SHA256
5a8fe279adac5793d9b22e7a8ace2923b49d1ff4fe536a33fe9ca82b59a9df56

SHA512
b608558cc13b6aec7bd0a6704835eefa3292cef233f71c23da99a0a8354f73ddcb752edccb696110e2df0433aed39f9692a0f8554161eed67ae3858826a9d1c1

Download Submit
C:\Windows\System\hUftPDn.exe

Filesize
2.3MB

MD5
1d4ae834c2b855b90dc364728ff87268

SHA1
c43b67a74cb9c5fe91288faae4ca67e50a50a243

SHA256
8166ebdcd3b931568ad320ccf260205fe320478d5db6a114ef359290918d6a19

SHA512
78944a7d3422642e9e5286c34a91071d8e5b8e297f5d814eb83a09f2a786f95716a1dba5bd5e3f307eaf2846c3c9b7c7460df38ce368bd146df6f13ad31d0a6e

Download Submit
C:\Windows\System\imqMTfx.exe

Filesize
2.3MB

MD5
496ce868abfc174eaa03ad94365c5614

SHA1
ee32a40dfc139c61fc58050246cec25285e0d631

SHA256
ee5110d0c45666b3ebcfe4cbdc3f5a058db12aadb1c5eb5c7855183ffb230426

SHA512
0b651ca3d14033bc32a350945e446200ab0a601aeda7e3d7fe1ee4da22126bccb3b0aa476018397e55518b7c225f8c860fcc57f6df9413e494c6f1817b5c3b7c

Download Submit
C:\Windows\System\jEpFrIZ.exe

Filesize
2.3MB

MD5
5465b85633e5af99b9fd37f585fe20ba

SHA1
1542d59cdaea716466aa3e4381c7d87179e4602c

SHA256
4af0e4736903b368f7f70b4b7de6cfbb059cc7d9fb5595f9b361a51cedda4a22

SHA512
31a9cf368ffdd1f5a6d56a14a356f0c2c830e5a0e5d522e0e174d33ec55deff390b42c32abf07b1a4db14fe39c2fa99c489aa0db6bd3882d4566460204ae3e11

Download Submit
C:\Windows\System\jMYHpvS.exe

Filesize
2.3MB

MD5
5ec529010d3d90dc85a16e2f381826ab

SHA1
186eff4c6ad8da5cd068417785a1d0a29d799216

SHA256
5006617565c8bdd7eb12631f1b749136ca4126de93929f1e63b3844ef4ad7d64

SHA512
2466301eff736917d65815a15deee86bddb1ec0353b473236d5603c576c4cfe7c0d60a377ea782f061162b3ae129021a2afb9dbc090deedf84057a50948be3dd

Download Submit
C:\Windows\System\lpNLJNt.exe

Filesize
2.3MB

MD5
3d985d6c5966d8acf8b14bf48f7f074c

SHA1
b7daefe0082d5fd7a1044fcf856f67d6030a8462

SHA256
55989cbcb7567fadeb93abe998edb2817cd546556e946c8943c39d9c528c45e5

SHA512
76f11729e051d1d2b2bd466690ddfe9ec4596ac08f73dbff30871ca1cd47870aac85a8befe7f3dcce3da480a5bbb2f51bb48f90cc57675de75a8b66bec17e9aa

Download Submit
C:\Windows\System\nLCmtek.exe

Filesize
2.3MB

MD5
3de9e12854646aab834faca0bae6827a

SHA1
9369e7981757deb2db0a6d359fc81f96854f4d1e

SHA256
2cab32e3013364798364b51e835f5b8970e0bea3dad2e4902bf258509a09306e

SHA512
da39c786fcdd0e55ce59783287eb1ebf1603c7744882b219b0c13295a15374c84d87ccc4bd9f183c1c734762b275ea0bfed252d0e1db4dcfccdc9b9ff8eac5c0

Download Submit
C:\Windows\System\ojmUdLz.exe

Filesize
2.3MB

MD5
2c7623f6c0629e49b19005d32bd0dbc1

SHA1
715f9377be45bbf017d1ff6909a2c38dfacc25e1

SHA256
0ca3f3776357ef187ee642b217ea2aeab8fd6739f5cc3ac2f78b5d4132fe2256

SHA512
add003d147cf2f614d891d693ad7eab04bcb75610cefeac7b202c8736dfcc3529346738998408647b11d58d98730103680e2190f607f79f52951b097bbfe65c9

Download Submit
C:\Windows\System\pEIAdtE.exe

Filesize
2.3MB

MD5
be30d0cac8a24be73898e0cc11e9ad8c

SHA1
78c2f84195582e29346a59b467b838f1c984b462

SHA256
48e8be7d84cf65a3b1b10bfdeaa90121e175603db765d0d07d5e9a56d1adea78

SHA512
ccee683abce89bec5da9d7ed76ecb5e9c89cf9b816f26092d15704e1510f0e465c597f54f588effe43623b9f9f342ecaff6001a1f8ca31984328dc9b71cbaae5

Download Submit
C:\Windows\System\vXeASdr.exe

Filesize
2.3MB

MD5
2a8b89ef8b638c63887dd679fc254388

SHA1
86a7864988f62ef7784ee61a3b4ec8c65f110bd0

SHA256
57677e9f9eb256d40b5692b958c487e151646841b647a586e299eb10dca72aa5

SHA512
d5af4c1d69ab3d5aa3512e21f12463c02026c2855c82fbc9e756e45c89e51cc49bf209e2e20db2fafd53961d27b92b6940565f0f7589d776c39fb5f497e104a4

Download Submit
C:\Windows\System\wbYOMwh.exe

Filesize
2.3MB

MD5
42bea0767a5b26a65f95a10fb9ccb521

SHA1
c5756da601a5387bc024a0e3db086a6de140e7c8

SHA256
c0991ed45bda981a09e0f771375f4aa1fca832d075049a782dde015c3661bc8a

SHA512
33298d75649f4b2d1b92a4cd608c068da5a7491faed9d2057d72dc0f4c30570735d04e98211095a6a9fef5ff582830ba91228777ab5d303b225d01f082416e90

Download Submit
C:\Windows\System\yzwAtOW.exe

Filesize
2.3MB

MD5
7b0a7d6b69e370dfc03c65f90ece4fee

SHA1
af8b9f7d126f0678176fada4d4b7091bff4993dc

SHA256
421843d6006bfa1532621854ec133b390478b72a52703f31847d56584623f1a0

SHA512
1a44c6a37ce4b3d987becdf8f1a2e5424bcadd18a8854a72d69e520c18dc806b0a3630e875605ae5bff3c403052b74f83d1397a57710cde4f4cba94ac67317ca

Download Submit
memory/752-108-0x00007FF63ACD0000-0x00007FF63B0C2000-memory.dmp

Filesize
3.9MB

Download
memory/752-2125-0x00007FF63ACD0000-0x00007FF63B0C2000-memory.dmp

Filesize
3.9MB

Download
memory/752-2217-0x00007FF63ACD0000-0x00007FF63B0C2000-memory.dmp

Filesize
3.9MB

Download
memory/1000-121-0x00007FF7FC030000-0x00007FF7FC422000-memory.dmp

Filesize
3.9MB

Download
memory/1000-2220-0x00007FF7FC030000-0x00007FF7FC422000-memory.dmp

Filesize
3.9MB

Download
memory/1500-125-0x00007FF76D510000-0x00007FF76D902000-memory.dmp

Filesize
3.9MB

Download
memory/1500-2222-0x00007FF76D510000-0x00007FF76D902000-memory.dmp

Filesize
3.9MB

Download
memory/1940-94-0x0000026CEA280000-0x0000026CEA290000-memory.dmp

Filesize
64KB

Download
memory/1940-1323-0x00007FFFDFE10000-0x00007FFFE08D1000-memory.dmp

Filesize
10.8MB

Download
memory/1940-31-0x00007FFFDFE10000-0x00007FFFE08D1000-memory.dmp

Filesize
10.8MB

Download
memory/1940-74-0x0000026CEAFA0000-0x0000026CEAFC2000-memory.dmp

Filesize
136KB

Download
memory/2000-2179-0x00007FF7A4B00000-0x00007FF7A4EF2000-memory.dmp

Filesize
3.9MB

Download
memory/2000-97-0x00007FF7A4B00000-0x00007FF7A4EF2000-memory.dmp

Filesize
3.9MB

Download
memory/2128-78-0x00007FF7E8DA0000-0x00007FF7E9192000-memory.dmp

Filesize
3.9MB

Download
memory/2128-2168-0x00007FF7E8DA0000-0x00007FF7E9192000-memory.dmp

Filesize
3.9MB

Download
memory/2168-0-0x00007FF6827F0000-0x00007FF682BE2000-memory.dmp

Filesize
3.9MB

Download
memory/2168-1-0x000002A8D72B0000-0x000002A8D72C0000-memory.dmp

Filesize
64KB

Download
memory/2360-2163-0x00007FF7C9100000-0x00007FF7C94F2000-memory.dmp

Filesize
3.9MB

Download
memory/2360-95-0x00007FF7C9100000-0x00007FF7C94F2000-memory.dmp

Filesize
3.9MB

Download
memory/2504-149-0x00007FF7AD8A0000-0x00007FF7ADC92000-memory.dmp

Filesize
3.9MB

Download
memory/2504-2226-0x00007FF7AD8A0000-0x00007FF7ADC92000-memory.dmp

Filesize
3.9MB

Download
memory/2576-2183-0x00007FF6599E0000-0x00007FF659DD2000-memory.dmp

Filesize
3.9MB

Download
memory/2576-92-0x00007FF6599E0000-0x00007FF659DD2000-memory.dmp

Filesize
3.9MB

Download
memory/2796-157-0x00007FF60D520000-0x00007FF60D912000-memory.dmp

Filesize
3.9MB

Download
memory/2796-2229-0x00007FF60D520000-0x00007FF60D912000-memory.dmp

Filesize
3.9MB

Download
memory/2836-88-0x00007FF7C5060000-0x00007FF7C5452000-memory.dmp

Filesize
3.9MB

Download
memory/2836-2181-0x00007FF7C5060000-0x00007FF7C5452000-memory.dmp

Filesize
3.9MB

Download
memory/3256-87-0x00007FF7F3A20000-0x00007FF7F3E12000-memory.dmp

Filesize
3.9MB

Download
memory/3256-2178-0x00007FF7F3A20000-0x00007FF7F3E12000-memory.dmp

Filesize
3.9MB

Download
memory/3296-2142-0x00007FF6BB350000-0x00007FF6BB742000-memory.dmp

Filesize
3.9MB

Download
memory/3296-128-0x00007FF6BB350000-0x00007FF6BB742000-memory.dmp

Filesize
3.9MB

Download
memory/3296-2225-0x00007FF6BB350000-0x00007FF6BB742000-memory.dmp

Filesize
3.9MB

Download
memory/3852-2161-0x00007FF6A8770000-0x00007FF6A8B62000-memory.dmp

Filesize
3.9MB

Download
memory/3852-2108-0x00007FF6A8770000-0x00007FF6A8B62000-memory.dmp

Filesize
3.9MB

Download
memory/3852-9-0x00007FF6A8770000-0x00007FF6A8B62000-memory.dmp

Filesize
3.9MB

Download
memory/3968-2227-0x00007FF6923A0000-0x00007FF692792000-memory.dmp

Filesize
3.9MB

Download
memory/3968-137-0x00007FF6923A0000-0x00007FF692792000-memory.dmp

Filesize
3.9MB

Download
memory/3968-2143-0x00007FF6923A0000-0x00007FF692792000-memory.dmp

Filesize
3.9MB

Download
memory/4064-2169-0x00007FF6361E0000-0x00007FF6365D2000-memory.dmp

Filesize
3.9MB

Download
memory/4064-80-0x00007FF6361E0000-0x00007FF6365D2000-memory.dmp

Filesize
3.9MB

Download
memory/4444-2175-0x00007FF798DC0000-0x00007FF7991B2000-memory.dmp

Filesize
3.9MB

Download
memory/4444-84-0x00007FF798DC0000-0x00007FF7991B2000-memory.dmp

Filesize
3.9MB

Download
memory/4460-2173-0x00007FF79EB30000-0x00007FF79EF22000-memory.dmp

Filesize
3.9MB

Download
memory/4460-96-0x00007FF79EB30000-0x00007FF79EF22000-memory.dmp

Filesize
3.9MB

Download
memory/4644-42-0x00007FF7CADD0000-0x00007FF7CB1C2000-memory.dmp

Filesize
3.9MB

Download
memory/4644-2165-0x00007FF7CADD0000-0x00007FF7CB1C2000-memory.dmp

Filesize
3.9MB

Download
memory/4988-60-0x00007FF6A2350000-0x00007FF6A2742000-memory.dmp

Filesize
3.9MB

Download
memory/4988-2171-0x00007FF6A2350000-0x00007FF6A2742000-memory.dmp

Filesize
3.9MB

Download
memory/5004-2186-0x00007FF6F9A40000-0x00007FF6F9E32000-memory.dmp

Filesize
3.9MB

Download
memory/5004-93-0x00007FF6F9A40000-0x00007FF6F9E32000-memory.dmp

Filesize
3.9MB

Download
memory/5048-2187-0x00007FF7479F0000-0x00007FF747DE2000-memory.dmp

Filesize
3.9MB

Download
memory/5048-98-0x00007FF7479F0000-0x00007FF747DE2000-memory.dmp

Filesize
3.9MB

Download