xmrig | 2f1f3fa1cd91cdd108112ea5f6fc9c77c836114b167e6ffbf941dfb68d596bad

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 11:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
Size

1.8MB
MD5

6e6ef12864d7c72c8b41144c11c9b941
SHA1

57901fb1e4dc858e5836430439876d2fba55e3b1
SHA256

2f1f3fa1cd91cdd108112ea5f6fc9c77c836114b167e6ffbf941dfb68d596bad
SHA512

7e45421af5a5826183c2b65e8b273d2f044bec88ed6f8b5b38b54bbfd783c2476e47ac55333739c41ce11b514e3a88da5683ddf143388bddd192a84814517962
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYlZ3pBjqlx7TovQmVV4dThen9zO:Lz071uv4BPMkibTIA5lCx7kvRWa4puWx

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 43 IoCs

miner

resource	yara_rule
behavioral2/memory/3628-228-0x00007FF6A0CA0000-0x00007FF6A1092000-memory.dmp	xmrig
behavioral2/memory/3712-244-0x00007FF703D30000-0x00007FF704122000-memory.dmp	xmrig
behavioral2/memory/3820-274-0x00007FF7836C0000-0x00007FF783AB2000-memory.dmp	xmrig
behavioral2/memory/1404-278-0x00007FF64DC20000-0x00007FF64E012000-memory.dmp	xmrig
behavioral2/memory/3916-289-0x00007FF632870000-0x00007FF632C62000-memory.dmp	xmrig
behavioral2/memory/5068-297-0x00007FF7C8C20000-0x00007FF7C9012000-memory.dmp	xmrig
behavioral2/memory/412-302-0x00007FF784740000-0x00007FF784B32000-memory.dmp	xmrig
behavioral2/memory/1692-303-0x00007FF7EAD10000-0x00007FF7EB102000-memory.dmp	xmrig
behavioral2/memory/4232-301-0x00007FF7A88B0000-0x00007FF7A8CA2000-memory.dmp	xmrig
behavioral2/memory/3204-300-0x00007FF71E9B0000-0x00007FF71EDA2000-memory.dmp	xmrig
behavioral2/memory/1072-298-0x00007FF6827B0000-0x00007FF682BA2000-memory.dmp	xmrig
behavioral2/memory/4884-296-0x00007FF771D10000-0x00007FF772102000-memory.dmp	xmrig
behavioral2/memory/2168-295-0x00007FF6F3870000-0x00007FF6F3C62000-memory.dmp	xmrig
behavioral2/memory/1912-294-0x00007FF733FD0000-0x00007FF7343C2000-memory.dmp	xmrig
behavioral2/memory/1572-273-0x00007FF74DAA0000-0x00007FF74DE92000-memory.dmp	xmrig
behavioral2/memory/1524-270-0x00007FF6A02D0000-0x00007FF6A06C2000-memory.dmp	xmrig
behavioral2/memory/4404-221-0x00007FF6B4A00000-0x00007FF6B4DF2000-memory.dmp	xmrig
behavioral2/memory/3380-209-0x00007FF6DC820000-0x00007FF6DCC12000-memory.dmp	xmrig
behavioral2/memory/3176-131-0x00007FF6B2520000-0x00007FF6B2912000-memory.dmp	xmrig
behavioral2/memory/1072-3134-0x00007FF6827B0000-0x00007FF682BA2000-memory.dmp	xmrig
behavioral2/memory/4100-3138-0x00007FF6A2DC0000-0x00007FF6A31B2000-memory.dmp	xmrig
behavioral2/memory/4904-3137-0x00007FF7E34E0000-0x00007FF7E38D2000-memory.dmp	xmrig
behavioral2/memory/1512-3140-0x00007FF6E7AA0000-0x00007FF6E7E92000-memory.dmp	xmrig
behavioral2/memory/3712-3142-0x00007FF703D30000-0x00007FF704122000-memory.dmp	xmrig
behavioral2/memory/3204-3144-0x00007FF71E9B0000-0x00007FF71EDA2000-memory.dmp	xmrig
behavioral2/memory/3380-3149-0x00007FF6DC820000-0x00007FF6DCC12000-memory.dmp	xmrig
behavioral2/memory/3176-3154-0x00007FF6B2520000-0x00007FF6B2912000-memory.dmp	xmrig
behavioral2/memory/4232-3153-0x00007FF7A88B0000-0x00007FF7A8CA2000-memory.dmp	xmrig
behavioral2/memory/1572-3150-0x00007FF74DAA0000-0x00007FF74DE92000-memory.dmp	xmrig
behavioral2/memory/1404-3158-0x00007FF64DC20000-0x00007FF64E012000-memory.dmp	xmrig
behavioral2/memory/3628-3157-0x00007FF6A0CA0000-0x00007FF6A1092000-memory.dmp	xmrig
behavioral2/memory/3244-3147-0x00007FF723E40000-0x00007FF724232000-memory.dmp	xmrig
behavioral2/memory/4884-3173-0x00007FF771D10000-0x00007FF772102000-memory.dmp	xmrig
behavioral2/memory/4404-3182-0x00007FF6B4A00000-0x00007FF6B4DF2000-memory.dmp	xmrig
behavioral2/memory/3916-3181-0x00007FF632870000-0x00007FF632C62000-memory.dmp	xmrig
behavioral2/memory/2168-3178-0x00007FF6F3870000-0x00007FF6F3C62000-memory.dmp	xmrig
behavioral2/memory/5068-3175-0x00007FF7C8C20000-0x00007FF7C9012000-memory.dmp	xmrig
behavioral2/memory/412-3171-0x00007FF784740000-0x00007FF784B32000-memory.dmp	xmrig
behavioral2/memory/1912-3169-0x00007FF733FD0000-0x00007FF7343C2000-memory.dmp	xmrig
behavioral2/memory/4316-3165-0x00007FF7DA060000-0x00007FF7DA452000-memory.dmp	xmrig
behavioral2/memory/1524-3160-0x00007FF6A02D0000-0x00007FF6A06C2000-memory.dmp	xmrig
behavioral2/memory/3820-3167-0x00007FF7836C0000-0x00007FF783AB2000-memory.dmp	xmrig
behavioral2/memory/1692-3193-0x00007FF7EAD10000-0x00007FF7EB102000-memory.dmp	xmrig

Blocklisted process makes network request 11 IoCs

flow	pid	Process
9	4652	powershell.exe
11	4652	powershell.exe
13	4652	powershell.exe
14	4652	powershell.exe
16	4652	powershell.exe
21	4652	powershell.exe
23	4652	powershell.exe
24	4652	powershell.exe
25	4652	powershell.exe
26	4652	powershell.exe
27	4652	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4652	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4100	bvJdtuB.exe
1072	QOocNPN.exe
4904	tvfJAIT.exe
1512	MbAwZIa.exe
3244	KpeNhIt.exe
3176	BMQGyRd.exe
3204	rVmVQtP.exe
4232	dogHNrF.exe
4316	aJSJYim.exe
3380	PbUzAdn.exe
412	yfDhNsk.exe
4404	kNAwYXB.exe
3628	fjSbBmm.exe
3712	qKtgBHg.exe
1524	tLDUmGV.exe
1572	vavbggS.exe
3820	nyJKEQx.exe
1692	EZgcfCy.exe
1404	nUirHJw.exe
3916	NPJCtQq.exe
1912	MNXUIwA.exe
2168	gfeJszW.exe
4884	cTnxXFZ.exe
5068	dXPQbfD.exe
3148	SSUmRTE.exe
1464	kWYwKul.exe
2916	QksrJUW.exe
5004	VxDKTJv.exe
1840	maQsGCL.exe
4348	canyZuD.exe
3988	WHmFIUy.exe
4620	ZzRuEBy.exe
3596	APXHtCL.exe
220	hvnpjjj.exe
2900	obxSLHw.exe
3804	EqicWkT.exe
2724	ZdeWqbi.exe
4752	TNWNphL.exe
5060	fpyvhYH.exe
4852	KkxOLGb.exe
4484	dfezEYq.exe
3152	esdijQX.exe
2288	gdGgbwR.exe
3836	tDEXLIM.exe
4872	ysBxHrs.exe
4456	jcSorGT.exe
2396	DCFZINd.exe
4656	WHvNtpb.exe
3240	tlKOmdD.exe
3996	SkjXcOx.exe
2704	SzHhpiv.exe
3928	rTDhzsT.exe
2552	ZRlbrPU.exe
3132	YEAKRji.exe
1440	jPjbbMU.exe
1428	LAqPGoX.exe
4056	WlmwIBO.exe
776	ZmjjfeT.exe
1228	VDlfoYm.exe
2340	GZVqUPK.exe
4388	eqKyeuW.exe
2200	XNRUfwm.exe
4740	hTduFVb.exe
1240	VWFTmWq.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1396-0-0x00007FF679370000-0x00007FF679762000-memory.dmp	upx
behavioral2/files/0x00080000000233bd-5.dat	upx
behavioral2/files/0x00070000000233c2-7.dat	upx
behavioral2/files/0x00070000000233c4-28.dat	upx
behavioral2/files/0x00070000000233d9-128.dat	upx
behavioral2/files/0x00070000000233da-152.dat	upx
behavioral2/files/0x00070000000233d8-166.dat	upx
behavioral2/memory/3628-228-0x00007FF6A0CA0000-0x00007FF6A1092000-memory.dmp	upx
behavioral2/memory/3712-244-0x00007FF703D30000-0x00007FF704122000-memory.dmp	upx
behavioral2/memory/3820-274-0x00007FF7836C0000-0x00007FF783AB2000-memory.dmp	upx
behavioral2/memory/1404-278-0x00007FF64DC20000-0x00007FF64E012000-memory.dmp	upx
behavioral2/memory/3916-289-0x00007FF632870000-0x00007FF632C62000-memory.dmp	upx
behavioral2/memory/5068-297-0x00007FF7C8C20000-0x00007FF7C9012000-memory.dmp	upx
behavioral2/memory/412-302-0x00007FF784740000-0x00007FF784B32000-memory.dmp	upx
behavioral2/memory/1692-303-0x00007FF7EAD10000-0x00007FF7EB102000-memory.dmp	upx
behavioral2/memory/4232-301-0x00007FF7A88B0000-0x00007FF7A8CA2000-memory.dmp	upx
behavioral2/memory/3204-300-0x00007FF71E9B0000-0x00007FF71EDA2000-memory.dmp	upx
behavioral2/memory/1072-298-0x00007FF6827B0000-0x00007FF682BA2000-memory.dmp	upx
behavioral2/memory/4884-296-0x00007FF771D10000-0x00007FF772102000-memory.dmp	upx
behavioral2/memory/2168-295-0x00007FF6F3870000-0x00007FF6F3C62000-memory.dmp	upx
behavioral2/memory/1912-294-0x00007FF733FD0000-0x00007FF7343C2000-memory.dmp	upx
behavioral2/memory/1572-273-0x00007FF74DAA0000-0x00007FF74DE92000-memory.dmp	upx
behavioral2/memory/1524-270-0x00007FF6A02D0000-0x00007FF6A06C2000-memory.dmp	upx
behavioral2/memory/4404-221-0x00007FF6B4A00000-0x00007FF6B4DF2000-memory.dmp	upx
behavioral2/memory/3380-209-0x00007FF6DC820000-0x00007FF6DCC12000-memory.dmp	upx
behavioral2/memory/4316-174-0x00007FF7DA060000-0x00007FF7DA452000-memory.dmp	upx
behavioral2/files/0x00070000000233d6-164.dat	upx
behavioral2/files/0x00070000000233d5-162.dat	upx
behavioral2/files/0x00070000000233e3-161.dat	upx
behavioral2/files/0x00070000000233d4-160.dat	upx
behavioral2/files/0x00070000000233cf-159.dat	upx
behavioral2/files/0x00070000000233e2-149.dat	upx
behavioral2/files/0x00070000000233d2-148.dat	upx
behavioral2/files/0x00070000000233e1-147.dat	upx
behavioral2/files/0x00070000000233e0-146.dat	upx
behavioral2/files/0x00070000000233df-145.dat	upx
behavioral2/files/0x00070000000233c7-144.dat	upx
behavioral2/files/0x00070000000233d1-142.dat	upx
behavioral2/files/0x00070000000233de-141.dat	upx
behavioral2/files/0x00070000000233d0-140.dat	upx
behavioral2/files/0x00070000000233ca-138.dat	upx
behavioral2/files/0x00070000000233dd-137.dat	upx
behavioral2/files/0x00070000000233dc-136.dat	upx
behavioral2/files/0x00070000000233db-134.dat	upx
behavioral2/files/0x00070000000233d3-133.dat	upx
behavioral2/memory/3176-131-0x00007FF6B2520000-0x00007FF6B2912000-memory.dmp	upx
behavioral2/files/0x00070000000233ce-127.dat	upx
behavioral2/files/0x00070000000233cd-122.dat	upx
behavioral2/files/0x00070000000233d7-117.dat	upx
behavioral2/files/0x00070000000233cc-114.dat	upx
behavioral2/files/0x00070000000233cb-107.dat	upx
behavioral2/files/0x00080000000233be-139.dat	upx
behavioral2/files/0x00070000000233c9-99.dat	upx
behavioral2/files/0x00070000000233c8-73.dat	upx
behavioral2/memory/3244-87-0x00007FF723E40000-0x00007FF724232000-memory.dmp	upx
behavioral2/files/0x00070000000233c6-61.dat	upx
behavioral2/memory/1512-58-0x00007FF6E7AA0000-0x00007FF6E7E92000-memory.dmp	upx
behavioral2/files/0x00070000000233c5-67.dat	upx
behavioral2/files/0x00070000000233c3-45.dat	upx
behavioral2/memory/4904-37-0x00007FF7E34E0000-0x00007FF7E38D2000-memory.dmp	upx
behavioral2/memory/4100-16-0x00007FF6A2DC0000-0x00007FF6A31B2000-memory.dmp	upx
behavioral2/files/0x00070000000233c1-11.dat	upx
behavioral2/memory/1072-3134-0x00007FF6827B0000-0x00007FF682BA2000-memory.dmp	upx
behavioral2/memory/4100-3138-0x00007FF6A2DC0000-0x00007FF6A31B2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ZdeWqbi.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\bRrijRX.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\cMGUHan.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\fIJnjGN.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\GaPeXfX.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\EDXXPyC.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\LxYesRU.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\xhVOvWh.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\WOaGajV.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\itjTAdd.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\gwzVIOw.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\nRROeEI.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\QMccxfS.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\YaNFGjF.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\RzvIATx.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\canyZuD.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\TNWNphL.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\rlmEpDH.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\OiCekXv.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\KUNhclG.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\ZpiGPkt.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\Boazxzh.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\WSioKoQ.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\RikdviK.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\bqMBfFG.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\NPHihDh.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\NGnoQLn.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\vGPzaYl.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\DTeaPUQ.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\kKMdrzG.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\KdExusF.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\vvimQwq.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\xkxdAld.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\cnzkssY.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\lvCqkRb.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\VkRJISe.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\WhQvNOn.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\eHSPics.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\SByGtEp.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\geSnFYd.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\mXPfxQU.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\alwTyJZ.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\zlPxKzp.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\trDMdZC.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\jeUFCSQ.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\hVCVwGW.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\iAJLBfg.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\SMKwPGu.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\OPBGZPz.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\Jilhqvn.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\lgqzTrW.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\UlLZRja.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\ANGOoWU.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\EvLCgqI.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\lZsjWMG.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\MLWwWvs.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\JAinfqT.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\QdmKyAx.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\vHcxJLd.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\ohYHScB.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\ZxtRpYu.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\jPIqVcJ.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\PIljPzA.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
File created	C:\Windows\System\IskebVs.exe	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4652	powershell.exe
4652	powershell.exe
4652	powershell.exe
4652	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
Token: SeDebugPrivilege	4652	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 4652	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	82
PID 1396 wrote to memory of 4652	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	82
PID 1396 wrote to memory of 4100	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	83
PID 1396 wrote to memory of 4100	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	83
PID 1396 wrote to memory of 1072	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	84
PID 1396 wrote to memory of 1072	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	84
PID 1396 wrote to memory of 4904	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	85
PID 1396 wrote to memory of 4904	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	85
PID 1396 wrote to memory of 1512	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	86
PID 1396 wrote to memory of 1512	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	86
PID 1396 wrote to memory of 3244	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	87
PID 1396 wrote to memory of 3244	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	87
PID 1396 wrote to memory of 3176	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	88
PID 1396 wrote to memory of 3176	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	88
PID 1396 wrote to memory of 3204	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	89
PID 1396 wrote to memory of 3204	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	89
PID 1396 wrote to memory of 412	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	90
PID 1396 wrote to memory of 412	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	90
PID 1396 wrote to memory of 3712	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	91
PID 1396 wrote to memory of 3712	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	91
PID 1396 wrote to memory of 4232	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	92
PID 1396 wrote to memory of 4232	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	92
PID 1396 wrote to memory of 4316	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	93
PID 1396 wrote to memory of 4316	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	93
PID 1396 wrote to memory of 3380	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	94
PID 1396 wrote to memory of 3380	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	94
PID 1396 wrote to memory of 1572	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	95
PID 1396 wrote to memory of 1572	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	95
PID 1396 wrote to memory of 4404	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	96
PID 1396 wrote to memory of 4404	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	96
PID 1396 wrote to memory of 3628	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	97
PID 1396 wrote to memory of 3628	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	97
PID 1396 wrote to memory of 1692	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	98
PID 1396 wrote to memory of 1692	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	98
PID 1396 wrote to memory of 1524	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	99
PID 1396 wrote to memory of 1524	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	99
PID 1396 wrote to memory of 4884	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	100
PID 1396 wrote to memory of 4884	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	100
PID 1396 wrote to memory of 3820	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	101
PID 1396 wrote to memory of 3820	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	101
PID 1396 wrote to memory of 1404	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	102
PID 1396 wrote to memory of 1404	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	102
PID 1396 wrote to memory of 3916	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	103
PID 1396 wrote to memory of 3916	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	103
PID 1396 wrote to memory of 1912	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	104
PID 1396 wrote to memory of 1912	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	104
PID 1396 wrote to memory of 2168	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	105
PID 1396 wrote to memory of 2168	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	105
PID 1396 wrote to memory of 5068	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	106
PID 1396 wrote to memory of 5068	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	106
PID 1396 wrote to memory of 3148	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	107
PID 1396 wrote to memory of 3148	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	107
PID 1396 wrote to memory of 1464	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	108
PID 1396 wrote to memory of 1464	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	108
PID 1396 wrote to memory of 3804	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	109
PID 1396 wrote to memory of 3804	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	109
PID 1396 wrote to memory of 2916	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	110
PID 1396 wrote to memory of 2916	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	110
PID 1396 wrote to memory of 5004	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	111
PID 1396 wrote to memory of 5004	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	111
PID 1396 wrote to memory of 1840	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	112
PID 1396 wrote to memory of 1840	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	112
PID 1396 wrote to memory of 4348	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	113
PID 1396 wrote to memory of 4348	1396	6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe	113

C:\Users\Admin\AppData\Local\Temp\6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6e6ef12864d7c72c8b41144c11c9b941_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4652
- C:\Windows\System\bvJdtuB.exe
  C:\Windows\System\bvJdtuB.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\QOocNPN.exe
  C:\Windows\System\QOocNPN.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\tvfJAIT.exe
  C:\Windows\System\tvfJAIT.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\MbAwZIa.exe
  C:\Windows\System\MbAwZIa.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\KpeNhIt.exe
  C:\Windows\System\KpeNhIt.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\BMQGyRd.exe
  C:\Windows\System\BMQGyRd.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\rVmVQtP.exe
  C:\Windows\System\rVmVQtP.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\yfDhNsk.exe
  C:\Windows\System\yfDhNsk.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\qKtgBHg.exe
  C:\Windows\System\qKtgBHg.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\dogHNrF.exe
  C:\Windows\System\dogHNrF.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\aJSJYim.exe
  C:\Windows\System\aJSJYim.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\PbUzAdn.exe
  C:\Windows\System\PbUzAdn.exe
  2⤵
  - Executes dropped EXE
  PID:3380
- C:\Windows\System\vavbggS.exe
  C:\Windows\System\vavbggS.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\kNAwYXB.exe
  C:\Windows\System\kNAwYXB.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\fjSbBmm.exe
  C:\Windows\System\fjSbBmm.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\EZgcfCy.exe
  C:\Windows\System\EZgcfCy.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\tLDUmGV.exe
  C:\Windows\System\tLDUmGV.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\cTnxXFZ.exe
  C:\Windows\System\cTnxXFZ.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\nyJKEQx.exe
  C:\Windows\System\nyJKEQx.exe
  2⤵
  - Executes dropped EXE
  PID:3820
- C:\Windows\System\nUirHJw.exe
  C:\Windows\System\nUirHJw.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\NPJCtQq.exe
  C:\Windows\System\NPJCtQq.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\MNXUIwA.exe
  C:\Windows\System\MNXUIwA.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\gfeJszW.exe
  C:\Windows\System\gfeJszW.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\dXPQbfD.exe
  C:\Windows\System\dXPQbfD.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\SSUmRTE.exe
  C:\Windows\System\SSUmRTE.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\kWYwKul.exe
  C:\Windows\System\kWYwKul.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\EqicWkT.exe
  C:\Windows\System\EqicWkT.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\QksrJUW.exe
  C:\Windows\System\QksrJUW.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\VxDKTJv.exe
  C:\Windows\System\VxDKTJv.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\maQsGCL.exe
  C:\Windows\System\maQsGCL.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\canyZuD.exe
  C:\Windows\System\canyZuD.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\WHmFIUy.exe
  C:\Windows\System\WHmFIUy.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\ZzRuEBy.exe
  C:\Windows\System\ZzRuEBy.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\APXHtCL.exe
  C:\Windows\System\APXHtCL.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\hvnpjjj.exe
  C:\Windows\System\hvnpjjj.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\obxSLHw.exe
  C:\Windows\System\obxSLHw.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\ZdeWqbi.exe
  C:\Windows\System\ZdeWqbi.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\TNWNphL.exe
  C:\Windows\System\TNWNphL.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\fpyvhYH.exe
  C:\Windows\System\fpyvhYH.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\KkxOLGb.exe
  C:\Windows\System\KkxOLGb.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\dfezEYq.exe
  C:\Windows\System\dfezEYq.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\esdijQX.exe
  C:\Windows\System\esdijQX.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\gdGgbwR.exe
  C:\Windows\System\gdGgbwR.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\tDEXLIM.exe
  C:\Windows\System\tDEXLIM.exe
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Windows\System\ysBxHrs.exe
  C:\Windows\System\ysBxHrs.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\jcSorGT.exe
  C:\Windows\System\jcSorGT.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\DCFZINd.exe
  C:\Windows\System\DCFZINd.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\WHvNtpb.exe
  C:\Windows\System\WHvNtpb.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\tlKOmdD.exe
  C:\Windows\System\tlKOmdD.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\SkjXcOx.exe
  C:\Windows\System\SkjXcOx.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\SzHhpiv.exe
  C:\Windows\System\SzHhpiv.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\rTDhzsT.exe
  C:\Windows\System\rTDhzsT.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\ZRlbrPU.exe
  C:\Windows\System\ZRlbrPU.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\YEAKRji.exe
  C:\Windows\System\YEAKRji.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\jPjbbMU.exe
  C:\Windows\System\jPjbbMU.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\LAqPGoX.exe
  C:\Windows\System\LAqPGoX.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\WlmwIBO.exe
  C:\Windows\System\WlmwIBO.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\ZmjjfeT.exe
  C:\Windows\System\ZmjjfeT.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\VDlfoYm.exe
  C:\Windows\System\VDlfoYm.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\GZVqUPK.exe
  C:\Windows\System\GZVqUPK.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\eqKyeuW.exe
  C:\Windows\System\eqKyeuW.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\XNRUfwm.exe
  C:\Windows\System\XNRUfwm.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\hTduFVb.exe
  C:\Windows\System\hTduFVb.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\VWFTmWq.exe
  C:\Windows\System\VWFTmWq.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\BcBYyRB.exe
  C:\Windows\System\BcBYyRB.exe
  2⤵
  PID:3068
- C:\Windows\System\AlYovXl.exe
  C:\Windows\System\AlYovXl.exe
  2⤵
  PID:900
- C:\Windows\System\RoRrNjD.exe
  C:\Windows\System\RoRrNjD.exe
  2⤵
  PID:3520
- C:\Windows\System\iAcpRGs.exe
  C:\Windows\System\iAcpRGs.exe
  2⤵
  PID:3436
- C:\Windows\System\LyHINSD.exe
  C:\Windows\System\LyHINSD.exe
  2⤵
  PID:4580
- C:\Windows\System\fOzCJRy.exe
  C:\Windows\System\fOzCJRy.exe
  2⤵
  PID:1028
- C:\Windows\System\koJpsSl.exe
  C:\Windows\System\koJpsSl.exe
  2⤵
  PID:2144
- C:\Windows\System\osnCpUk.exe
  C:\Windows\System\osnCpUk.exe
  2⤵
  PID:2160
- C:\Windows\System\uCvRorE.exe
  C:\Windows\System\uCvRorE.exe
  2⤵
  PID:5044
- C:\Windows\System\UicRQjK.exe
  C:\Windows\System\UicRQjK.exe
  2⤵
  PID:5020
- C:\Windows\System\wtHluOa.exe
  C:\Windows\System\wtHluOa.exe
  2⤵
  PID:1948
- C:\Windows\System\rlmEpDH.exe
  C:\Windows\System\rlmEpDH.exe
  2⤵
  PID:2476
- C:\Windows\System\BNqNoDH.exe
  C:\Windows\System\BNqNoDH.exe
  2⤵
  PID:4836
- C:\Windows\System\TJQRUjY.exe
  C:\Windows\System\TJQRUjY.exe
  2⤵
  PID:2676
- C:\Windows\System\twRPhXg.exe
  C:\Windows\System\twRPhXg.exe
  2⤵
  PID:2220
- C:\Windows\System\JTVCvCz.exe
  C:\Windows\System\JTVCvCz.exe
  2⤵
  PID:752
- C:\Windows\System\pevlwmp.exe
  C:\Windows\System\pevlwmp.exe
  2⤵
  PID:1800
- C:\Windows\System\ZIXVkjb.exe
  C:\Windows\System\ZIXVkjb.exe
  2⤵
  PID:1616
- C:\Windows\System\uLYEevU.exe
  C:\Windows\System\uLYEevU.exe
  2⤵
  PID:2812
- C:\Windows\System\tIRJFKa.exe
  C:\Windows\System\tIRJFKa.exe
  2⤵
  PID:888
- C:\Windows\System\aAsqMwc.exe
  C:\Windows\System\aAsqMwc.exe
  2⤵
  PID:4368
- C:\Windows\System\XQfTcxQ.exe
  C:\Windows\System\XQfTcxQ.exe
  2⤵
  PID:920
- C:\Windows\System\oUjsSeM.exe
  C:\Windows\System\oUjsSeM.exe
  2⤵
  PID:3688
- C:\Windows\System\IRvgPmj.exe
  C:\Windows\System\IRvgPmj.exe
  2⤵
  PID:2684
- C:\Windows\System\uAgyKeE.exe
  C:\Windows\System\uAgyKeE.exe
  2⤵
  PID:4808
- C:\Windows\System\FODvahE.exe
  C:\Windows\System\FODvahE.exe
  2⤵
  PID:1604
- C:\Windows\System\UlLZRja.exe
  C:\Windows\System\UlLZRja.exe
  2⤵
  PID:5052
- C:\Windows\System\rwfnoQu.exe
  C:\Windows\System\rwfnoQu.exe
  2⤵
  PID:4868
- C:\Windows\System\dWhmOOF.exe
  C:\Windows\System\dWhmOOF.exe
  2⤵
  PID:3584
- C:\Windows\System\BAxMolW.exe
  C:\Windows\System\BAxMolW.exe
  2⤵
  PID:1868
- C:\Windows\System\IUbYSIV.exe
  C:\Windows\System\IUbYSIV.exe
  2⤵
  PID:1272
- C:\Windows\System\jlZOdwQ.exe
  C:\Windows\System\jlZOdwQ.exe
  2⤵
  PID:3128
- C:\Windows\System\VpcvEpv.exe
  C:\Windows\System\VpcvEpv.exe
  2⤵
  PID:4532
- C:\Windows\System\gwLLodM.exe
  C:\Windows\System\gwLLodM.exe
  2⤵
  PID:1052
- C:\Windows\System\txdyRoU.exe
  C:\Windows\System\txdyRoU.exe
  2⤵
  PID:4944
- C:\Windows\System\ktAGDKF.exe
  C:\Windows\System\ktAGDKF.exe
  2⤵
  PID:5128
- C:\Windows\System\QWeHJlf.exe
  C:\Windows\System\QWeHJlf.exe
  2⤵
  PID:5152
- C:\Windows\System\nfkEEqr.exe
  C:\Windows\System\nfkEEqr.exe
  2⤵
  PID:5172
- C:\Windows\System\FjLUrov.exe
  C:\Windows\System\FjLUrov.exe
  2⤵
  PID:5204
- C:\Windows\System\LLNewtH.exe
  C:\Windows\System\LLNewtH.exe
  2⤵
  PID:5232
- C:\Windows\System\CGRtJDY.exe
  C:\Windows\System\CGRtJDY.exe
  2⤵
  PID:5256
- C:\Windows\System\HByrZsj.exe
  C:\Windows\System\HByrZsj.exe
  2⤵
  PID:5288
- C:\Windows\System\AUVvLcs.exe
  C:\Windows\System\AUVvLcs.exe
  2⤵
  PID:5324
- C:\Windows\System\iHXlKxa.exe
  C:\Windows\System\iHXlKxa.exe
  2⤵
  PID:5348
- C:\Windows\System\AgIbbIO.exe
  C:\Windows\System\AgIbbIO.exe
  2⤵
  PID:5368
- C:\Windows\System\SOLptyc.exe
  C:\Windows\System\SOLptyc.exe
  2⤵
  PID:5384
- C:\Windows\System\LnXkcLU.exe
  C:\Windows\System\LnXkcLU.exe
  2⤵
  PID:5404
- C:\Windows\System\FVyeTxv.exe
  C:\Windows\System\FVyeTxv.exe
  2⤵
  PID:5428
- C:\Windows\System\UwuOwmL.exe
  C:\Windows\System\UwuOwmL.exe
  2⤵
  PID:5468
- C:\Windows\System\rvOOdbf.exe
  C:\Windows\System\rvOOdbf.exe
  2⤵
  PID:5504
- C:\Windows\System\txuDITg.exe
  C:\Windows\System\txuDITg.exe
  2⤵
  PID:5536
- C:\Windows\System\vHcxJLd.exe
  C:\Windows\System\vHcxJLd.exe
  2⤵
  PID:5556
- C:\Windows\System\YyadszF.exe
  C:\Windows\System\YyadszF.exe
  2⤵
  PID:5604
- C:\Windows\System\OjPfFyi.exe
  C:\Windows\System\OjPfFyi.exe
  2⤵
  PID:5636
- C:\Windows\System\YvJsbXn.exe
  C:\Windows\System\YvJsbXn.exe
  2⤵
  PID:5668
- C:\Windows\System\sYBGuYo.exe
  C:\Windows\System\sYBGuYo.exe
  2⤵
  PID:5688
- C:\Windows\System\fHfAjPs.exe
  C:\Windows\System\fHfAjPs.exe
  2⤵
  PID:5724
- C:\Windows\System\nhBQmlt.exe
  C:\Windows\System\nhBQmlt.exe
  2⤵
  PID:5744
- C:\Windows\System\HREeBIj.exe
  C:\Windows\System\HREeBIj.exe
  2⤵
  PID:5760
- C:\Windows\System\WkdbBeQ.exe
  C:\Windows\System\WkdbBeQ.exe
  2⤵
  PID:5780
- C:\Windows\System\JUMCylh.exe
  C:\Windows\System\JUMCylh.exe
  2⤵
  PID:5804
- C:\Windows\System\etUlvOX.exe
  C:\Windows\System\etUlvOX.exe
  2⤵
  PID:5820
- C:\Windows\System\ohYHScB.exe
  C:\Windows\System\ohYHScB.exe
  2⤵
  PID:5848
- C:\Windows\System\YQOSGXa.exe
  C:\Windows\System\YQOSGXa.exe
  2⤵
  PID:5868
- C:\Windows\System\TenUXSa.exe
  C:\Windows\System\TenUXSa.exe
  2⤵
  PID:5892
- C:\Windows\System\gsEkWLL.exe
  C:\Windows\System\gsEkWLL.exe
  2⤵
  PID:5912
- C:\Windows\System\hAbjvid.exe
  C:\Windows\System\hAbjvid.exe
  2⤵
  PID:5936
- C:\Windows\System\QyDMwzN.exe
  C:\Windows\System\QyDMwzN.exe
  2⤵
  PID:5980
- C:\Windows\System\wZxWaRq.exe
  C:\Windows\System\wZxWaRq.exe
  2⤵
  PID:6000
- C:\Windows\System\BoZofHm.exe
  C:\Windows\System\BoZofHm.exe
  2⤵
  PID:6036
- C:\Windows\System\GAXTUei.exe
  C:\Windows\System\GAXTUei.exe
  2⤵
  PID:6080
- C:\Windows\System\wAsXfxV.exe
  C:\Windows\System\wAsXfxV.exe
  2⤵
  PID:6112
- C:\Windows\System\EIXbzmE.exe
  C:\Windows\System\EIXbzmE.exe
  2⤵
  PID:6128
- C:\Windows\System\KaUMZHN.exe
  C:\Windows\System\KaUMZHN.exe
  2⤵
  PID:4844
- C:\Windows\System\KEkuVvt.exe
  C:\Windows\System\KEkuVvt.exe
  2⤵
  PID:1280
- C:\Windows\System\MgyeCan.exe
  C:\Windows\System\MgyeCan.exe
  2⤵
  PID:1276
- C:\Windows\System\LrVuhiW.exe
  C:\Windows\System\LrVuhiW.exe
  2⤵
  PID:2980
- C:\Windows\System\gpfUQKv.exe
  C:\Windows\System\gpfUQKv.exe
  2⤵
  PID:2800
- C:\Windows\System\lNTpZmL.exe
  C:\Windows\System\lNTpZmL.exe
  2⤵
  PID:3060
- C:\Windows\System\WQWVDeC.exe
  C:\Windows\System\WQWVDeC.exe
  2⤵
  PID:5168
- C:\Windows\System\WlCDdNF.exe
  C:\Windows\System\WlCDdNF.exe
  2⤵
  PID:5332
- C:\Windows\System\KoyAfNH.exe
  C:\Windows\System\KoyAfNH.exe
  2⤵
  PID:3236
- C:\Windows\System\ZOrNuqW.exe
  C:\Windows\System\ZOrNuqW.exe
  2⤵
  PID:1876
- C:\Windows\System\EdiYXXl.exe
  C:\Windows\System\EdiYXXl.exe
  2⤵
  PID:5416
- C:\Windows\System\TJknfAU.exe
  C:\Windows\System\TJknfAU.exe
  2⤵
  PID:5448
- C:\Windows\System\gLEnXBo.exe
  C:\Windows\System\gLEnXBo.exe
  2⤵
  PID:5212
- C:\Windows\System\SGzNMFx.exe
  C:\Windows\System\SGzNMFx.exe
  2⤵
  PID:5220
- C:\Windows\System\pvGjIkO.exe
  C:\Windows\System\pvGjIkO.exe
  2⤵
  PID:5496
- C:\Windows\System\jstPKnN.exe
  C:\Windows\System\jstPKnN.exe
  2⤵
  PID:1556
- C:\Windows\System\sYrVLoi.exe
  C:\Windows\System\sYrVLoi.exe
  2⤵
  PID:5548
- C:\Windows\System\jqopQjT.exe
  C:\Windows\System\jqopQjT.exe
  2⤵
  PID:5580
- C:\Windows\System\PNIBSme.exe
  C:\Windows\System\PNIBSme.exe
  2⤵
  PID:5588
- C:\Windows\System\bdPGLrt.exe
  C:\Windows\System\bdPGLrt.exe
  2⤵
  PID:5336
- C:\Windows\System\kClihrd.exe
  C:\Windows\System\kClihrd.exe
  2⤵
  PID:4360
- C:\Windows\System\iaBEeJz.exe
  C:\Windows\System\iaBEeJz.exe
  2⤵
  PID:5376
- C:\Windows\System\vfgWMyE.exe
  C:\Windows\System\vfgWMyE.exe
  2⤵
  PID:5192
- C:\Windows\System\vTaKsTU.exe
  C:\Windows\System\vTaKsTU.exe
  2⤵
  PID:5268
- C:\Windows\System\MEYLLTP.exe
  C:\Windows\System\MEYLLTP.exe
  2⤵
  PID:5300
- C:\Windows\System\MabiQZT.exe
  C:\Windows\System\MabiQZT.exe
  2⤵
  PID:6008
- C:\Windows\System\FTlfVAT.exe
  C:\Windows\System\FTlfVAT.exe
  2⤵
  PID:6028
- C:\Windows\System\DBdzRRJ.exe
  C:\Windows\System\DBdzRRJ.exe
  2⤵
  PID:5752
- C:\Windows\System\EVhNKZY.exe
  C:\Windows\System\EVhNKZY.exe
  2⤵
  PID:6108
- C:\Windows\System\EQZKsTC.exe
  C:\Windows\System\EQZKsTC.exe
  2⤵
  PID:4760
- C:\Windows\System\TAWnOQR.exe
  C:\Windows\System\TAWnOQR.exe
  2⤵
  PID:5124
- C:\Windows\System\UymTROW.exe
  C:\Windows\System\UymTROW.exe
  2⤵
  PID:5532
- C:\Windows\System\mgknwog.exe
  C:\Windows\System\mgknwog.exe
  2⤵
  PID:5436
- C:\Windows\System\yKHNNiR.exe
  C:\Windows\System\yKHNNiR.exe
  2⤵
  PID:4376
- C:\Windows\System\XcfoFEF.exe
  C:\Windows\System\XcfoFEF.exe
  2⤵
  PID:5664
- C:\Windows\System\trDMdZC.exe
  C:\Windows\System\trDMdZC.exe
  2⤵
  PID:3588
- C:\Windows\System\ThLxrEZ.exe
  C:\Windows\System\ThLxrEZ.exe
  2⤵
  PID:5312
- C:\Windows\System\lgklYQa.exe
  C:\Windows\System\lgklYQa.exe
  2⤵
  PID:5648
- C:\Windows\System\TxBamty.exe
  C:\Windows\System\TxBamty.exe
  2⤵
  PID:6168
- C:\Windows\System\vsjDtHf.exe
  C:\Windows\System\vsjDtHf.exe
  2⤵
  PID:6184
- C:\Windows\System\HQqdonM.exe
  C:\Windows\System\HQqdonM.exe
  2⤵
  PID:6204
- C:\Windows\System\nKFokRb.exe
  C:\Windows\System\nKFokRb.exe
  2⤵
  PID:6224
- C:\Windows\System\sBoXPxs.exe
  C:\Windows\System\sBoXPxs.exe
  2⤵
  PID:6244
- C:\Windows\System\zKcHSrF.exe
  C:\Windows\System\zKcHSrF.exe
  2⤵
  PID:6264
- C:\Windows\System\xeoSTnN.exe
  C:\Windows\System\xeoSTnN.exe
  2⤵
  PID:6300
- C:\Windows\System\irxJaoP.exe
  C:\Windows\System\irxJaoP.exe
  2⤵
  PID:6320
- C:\Windows\System\xCVuoKM.exe
  C:\Windows\System\xCVuoKM.exe
  2⤵
  PID:6344
- C:\Windows\System\sdmuRjC.exe
  C:\Windows\System\sdmuRjC.exe
  2⤵
  PID:6364
- C:\Windows\System\kTbElox.exe
  C:\Windows\System\kTbElox.exe
  2⤵
  PID:6384
- C:\Windows\System\IFuEzMD.exe
  C:\Windows\System\IFuEzMD.exe
  2⤵
  PID:6404
- C:\Windows\System\fbjZFkH.exe
  C:\Windows\System\fbjZFkH.exe
  2⤵
  PID:6424
- C:\Windows\System\bRrijRX.exe
  C:\Windows\System\bRrijRX.exe
  2⤵
  PID:6448
- C:\Windows\System\zCxcOvE.exe
  C:\Windows\System\zCxcOvE.exe
  2⤵
  PID:6472
- C:\Windows\System\EjFyiiT.exe
  C:\Windows\System\EjFyiiT.exe
  2⤵
  PID:6500
- C:\Windows\System\RNvAvMR.exe
  C:\Windows\System\RNvAvMR.exe
  2⤵
  PID:6520
- C:\Windows\System\HFEVOyz.exe
  C:\Windows\System\HFEVOyz.exe
  2⤵
  PID:6540
- C:\Windows\System\DtxsqEr.exe
  C:\Windows\System\DtxsqEr.exe
  2⤵
  PID:6560
- C:\Windows\System\seFQHiB.exe
  C:\Windows\System\seFQHiB.exe
  2⤵
  PID:6576
- C:\Windows\System\sgPAaqr.exe
  C:\Windows\System\sgPAaqr.exe
  2⤵
  PID:6600
- C:\Windows\System\kIqkAkQ.exe
  C:\Windows\System\kIqkAkQ.exe
  2⤵
  PID:6620
- C:\Windows\System\ZHEvBwf.exe
  C:\Windows\System\ZHEvBwf.exe
  2⤵
  PID:6640
- C:\Windows\System\aknirMs.exe
  C:\Windows\System\aknirMs.exe
  2⤵
  PID:6664
- C:\Windows\System\cGQfemQ.exe
  C:\Windows\System\cGQfemQ.exe
  2⤵
  PID:6680
- C:\Windows\System\zCJyoTE.exe
  C:\Windows\System\zCJyoTE.exe
  2⤵
  PID:6704
- C:\Windows\System\LUnyeQi.exe
  C:\Windows\System\LUnyeQi.exe
  2⤵
  PID:6720
- C:\Windows\System\OpIaaEt.exe
  C:\Windows\System\OpIaaEt.exe
  2⤵
  PID:6744
- C:\Windows\System\yLMiatA.exe
  C:\Windows\System\yLMiatA.exe
  2⤵
  PID:6764
- C:\Windows\System\nkALLCW.exe
  C:\Windows\System\nkALLCW.exe
  2⤵
  PID:6792
- C:\Windows\System\NWjYKAa.exe
  C:\Windows\System\NWjYKAa.exe
  2⤵
  PID:6812
- C:\Windows\System\lOHIEky.exe
  C:\Windows\System\lOHIEky.exe
  2⤵
  PID:6848
- C:\Windows\System\djXHJfP.exe
  C:\Windows\System\djXHJfP.exe
  2⤵
  PID:6864
- C:\Windows\System\IdvHevp.exe
  C:\Windows\System\IdvHevp.exe
  2⤵
  PID:6892
- C:\Windows\System\xPGqulw.exe
  C:\Windows\System\xPGqulw.exe
  2⤵
  PID:6912
- C:\Windows\System\CcGvHvG.exe
  C:\Windows\System\CcGvHvG.exe
  2⤵
  PID:6936
- C:\Windows\System\kfslkGX.exe
  C:\Windows\System\kfslkGX.exe
  2⤵
  PID:6960
- C:\Windows\System\bYTPsVm.exe
  C:\Windows\System\bYTPsVm.exe
  2⤵
  PID:6976
- C:\Windows\System\qboARkb.exe
  C:\Windows\System\qboARkb.exe
  2⤵
  PID:7000
- C:\Windows\System\xAAksyj.exe
  C:\Windows\System\xAAksyj.exe
  2⤵
  PID:7016
- C:\Windows\System\VfBOqwL.exe
  C:\Windows\System\VfBOqwL.exe
  2⤵
  PID:7044
- C:\Windows\System\lAhKaLZ.exe
  C:\Windows\System\lAhKaLZ.exe
  2⤵
  PID:7068
- C:\Windows\System\DmHfcMZ.exe
  C:\Windows\System\DmHfcMZ.exe
  2⤵
  PID:7084
- C:\Windows\System\xeMhVbJ.exe
  C:\Windows\System\xeMhVbJ.exe
  2⤵
  PID:7108
- C:\Windows\System\NGnoQLn.exe
  C:\Windows\System\NGnoQLn.exe
  2⤵
  PID:7128
- C:\Windows\System\lvCqkRb.exe
  C:\Windows\System\lvCqkRb.exe
  2⤵
  PID:7148
- C:\Windows\System\BmzySbI.exe
  C:\Windows\System\BmzySbI.exe
  2⤵
  PID:6056
- C:\Windows\System\wxROmJB.exe
  C:\Windows\System\wxROmJB.exe
  2⤵
  PID:5712
- C:\Windows\System\urnmgfi.exe
  C:\Windows\System\urnmgfi.exe
  2⤵
  PID:6136
- C:\Windows\System\ZndaAAl.exe
  C:\Windows\System\ZndaAAl.exe
  2⤵
  PID:5788
- C:\Windows\System\WCMzAHY.exe
  C:\Windows\System\WCMzAHY.exe
  2⤵
  PID:1600
- C:\Windows\System\TGpXUEE.exe
  C:\Windows\System\TGpXUEE.exe
  2⤵
  PID:5876
- C:\Windows\System\QmUzDdx.exe
  C:\Windows\System\QmUzDdx.exe
  2⤵
  PID:6020
- C:\Windows\System\ZqBzKcO.exe
  C:\Windows\System\ZqBzKcO.exe
  2⤵
  PID:5732
- C:\Windows\System\bIDPrzd.exe
  C:\Windows\System\bIDPrzd.exe
  2⤵
  PID:5904
- C:\Windows\System\ADOKYpe.exe
  C:\Windows\System\ADOKYpe.exe
  2⤵
  PID:5952
- C:\Windows\System\zDyHOTi.exe
  C:\Windows\System\zDyHOTi.exe
  2⤵
  PID:5968
- C:\Windows\System\IfFwVuJ.exe
  C:\Windows\System\IfFwVuJ.exe
  2⤵
  PID:316
- C:\Windows\System\xuSHMNw.exe
  C:\Windows\System\xuSHMNw.exe
  2⤵
  PID:5596
- C:\Windows\System\QrSvMHE.exe
  C:\Windows\System\QrSvMHE.exe
  2⤵
  PID:5700
- C:\Windows\System\iZilipH.exe
  C:\Windows\System\iZilipH.exe
  2⤵
  PID:6256
- C:\Windows\System\JlLAwsQ.exe
  C:\Windows\System\JlLAwsQ.exe
  2⤵
  PID:5696
- C:\Windows\System\pVgmHtC.exe
  C:\Windows\System\pVgmHtC.exe
  2⤵
  PID:6380
- C:\Windows\System\QibXyDJ.exe
  C:\Windows\System\QibXyDJ.exe
  2⤵
  PID:6496
- C:\Windows\System\cQgOLeq.exe
  C:\Windows\System\cQgOLeq.exe
  2⤵
  PID:6512
- C:\Windows\System\EsvaUBr.exe
  C:\Windows\System\EsvaUBr.exe
  2⤵
  PID:3940
- C:\Windows\System\eMpAslP.exe
  C:\Windows\System\eMpAslP.exe
  2⤵
  PID:3600
- C:\Windows\System\EBYNSDU.exe
  C:\Windows\System\EBYNSDU.exe
  2⤵
  PID:5456
- C:\Windows\System\HPibnhH.exe
  C:\Windows\System\HPibnhH.exe
  2⤵
  PID:6636
- C:\Windows\System\oIdNZIu.exe
  C:\Windows\System\oIdNZIu.exe
  2⤵
  PID:5616
- C:\Windows\System\meHqJjd.exe
  C:\Windows\System\meHqJjd.exe
  2⤵
  PID:5704
- C:\Windows\System\pfrdswu.exe
  C:\Windows\System\pfrdswu.exe
  2⤵
  PID:6280
- C:\Windows\System\JAAhWPq.exe
  C:\Windows\System\JAAhWPq.exe
  2⤵
  PID:6836
- C:\Windows\System\rbviujg.exe
  C:\Windows\System\rbviujg.exe
  2⤵
  PID:6824
- C:\Windows\System\tIlrZRo.exe
  C:\Windows\System\tIlrZRo.exe
  2⤵
  PID:7024
- C:\Windows\System\DtxZStZ.exe
  C:\Windows\System\DtxZStZ.exe
  2⤵
  PID:7188
- C:\Windows\System\VrIhcYx.exe
  C:\Windows\System\VrIhcYx.exe
  2⤵
  PID:7208
- C:\Windows\System\wgpOZBm.exe
  C:\Windows\System\wgpOZBm.exe
  2⤵
  PID:7232
- C:\Windows\System\osQdIKt.exe
  C:\Windows\System\osQdIKt.exe
  2⤵
  PID:7252
- C:\Windows\System\xGdeOrN.exe
  C:\Windows\System\xGdeOrN.exe
  2⤵
  PID:7272
- C:\Windows\System\itcdCny.exe
  C:\Windows\System\itcdCny.exe
  2⤵
  PID:7292
- C:\Windows\System\cUWZRoE.exe
  C:\Windows\System\cUWZRoE.exe
  2⤵
  PID:7312
- C:\Windows\System\pAabQSq.exe
  C:\Windows\System\pAabQSq.exe
  2⤵
  PID:7344
- C:\Windows\System\mGXcXfw.exe
  C:\Windows\System\mGXcXfw.exe
  2⤵
  PID:7368
- C:\Windows\System\pXVHDIF.exe
  C:\Windows\System\pXVHDIF.exe
  2⤵
  PID:7388
- C:\Windows\System\LxYesRU.exe
  C:\Windows\System\LxYesRU.exe
  2⤵
  PID:7416
- C:\Windows\System\WSioKoQ.exe
  C:\Windows\System\WSioKoQ.exe
  2⤵
  PID:7432
- C:\Windows\System\ahtjFdF.exe
  C:\Windows\System\ahtjFdF.exe
  2⤵
  PID:7484
- C:\Windows\System\TPMLmUe.exe
  C:\Windows\System\TPMLmUe.exe
  2⤵
  PID:7508
- C:\Windows\System\rdmUtLw.exe
  C:\Windows\System\rdmUtLw.exe
  2⤵
  PID:7528
- C:\Windows\System\fVnPlxg.exe
  C:\Windows\System\fVnPlxg.exe
  2⤵
  PID:7548
- C:\Windows\System\elBBXaD.exe
  C:\Windows\System\elBBXaD.exe
  2⤵
  PID:7572
- C:\Windows\System\qbEQNic.exe
  C:\Windows\System\qbEQNic.exe
  2⤵
  PID:7592
- C:\Windows\System\zrDHHWN.exe
  C:\Windows\System\zrDHHWN.exe
  2⤵
  PID:7612
- C:\Windows\System\wACakkV.exe
  C:\Windows\System\wACakkV.exe
  2⤵
  PID:7636
- C:\Windows\System\qkBdWhl.exe
  C:\Windows\System\qkBdWhl.exe
  2⤵
  PID:7656
- C:\Windows\System\PlMUoAv.exe
  C:\Windows\System\PlMUoAv.exe
  2⤵
  PID:7676
- C:\Windows\System\XhaBlDV.exe
  C:\Windows\System\XhaBlDV.exe
  2⤵
  PID:7704
- C:\Windows\System\QEJlfts.exe
  C:\Windows\System\QEJlfts.exe
  2⤵
  PID:7724
- C:\Windows\System\bMyftjU.exe
  C:\Windows\System\bMyftjU.exe
  2⤵
  PID:7740
- C:\Windows\System\JJFQUny.exe
  C:\Windows\System\JJFQUny.exe
  2⤵
  PID:7760
- C:\Windows\System\idniJCj.exe
  C:\Windows\System\idniJCj.exe
  2⤵
  PID:7780
- C:\Windows\System\NcuQfln.exe
  C:\Windows\System\NcuQfln.exe
  2⤵
  PID:7804
- C:\Windows\System\sXDQwxZ.exe
  C:\Windows\System\sXDQwxZ.exe
  2⤵
  PID:7824
- C:\Windows\System\ZxtRpYu.exe
  C:\Windows\System\ZxtRpYu.exe
  2⤵
  PID:7844
- C:\Windows\System\ldXbsux.exe
  C:\Windows\System\ldXbsux.exe
  2⤵
  PID:7880
- C:\Windows\System\lNbtbFG.exe
  C:\Windows\System\lNbtbFG.exe
  2⤵
  PID:7896
- C:\Windows\System\OZVZHZa.exe
  C:\Windows\System\OZVZHZa.exe
  2⤵
  PID:7924
- C:\Windows\System\TMdVAvb.exe
  C:\Windows\System\TMdVAvb.exe
  2⤵
  PID:7948
- C:\Windows\System\lMcVXwE.exe
  C:\Windows\System\lMcVXwE.exe
  2⤵
  PID:7972
- C:\Windows\System\LdTrplf.exe
  C:\Windows\System\LdTrplf.exe
  2⤵
  PID:7992
- C:\Windows\System\cUMlprP.exe
  C:\Windows\System\cUMlprP.exe
  2⤵
  PID:8012
- C:\Windows\System\hCaKNOu.exe
  C:\Windows\System\hCaKNOu.exe
  2⤵
  PID:8036
- C:\Windows\System\VePgeUy.exe
  C:\Windows\System\VePgeUy.exe
  2⤵
  PID:8056
- C:\Windows\System\MrlGyjY.exe
  C:\Windows\System\MrlGyjY.exe
  2⤵
  PID:8076
- C:\Windows\System\kkruBnI.exe
  C:\Windows\System\kkruBnI.exe
  2⤵
  PID:8112
- C:\Windows\System\zFWEYoy.exe
  C:\Windows\System\zFWEYoy.exe
  2⤵
  PID:8132
- C:\Windows\System\pjAyYRt.exe
  C:\Windows\System\pjAyYRt.exe
  2⤵
  PID:8156
- C:\Windows\System\GUAWIsa.exe
  C:\Windows\System\GUAWIsa.exe
  2⤵
  PID:8180
- C:\Windows\System\pWhEMBO.exe
  C:\Windows\System\pWhEMBO.exe
  2⤵
  PID:6436
- C:\Windows\System\hGfzWUI.exe
  C:\Windows\System\hGfzWUI.exe
  2⤵
  PID:6984
- C:\Windows\System\IEbGTGf.exe
  C:\Windows\System\IEbGTGf.exe
  2⤵
  PID:3776
- C:\Windows\System\qeQWJju.exe
  C:\Windows\System\qeQWJju.exe
  2⤵
  PID:5908
- C:\Windows\System\BOptAKe.exe
  C:\Windows\System\BOptAKe.exe
  2⤵
  PID:2620
- C:\Windows\System\GEPryiK.exe
  C:\Windows\System\GEPryiK.exe
  2⤵
  PID:6352
- C:\Windows\System\BluMoWM.exe
  C:\Windows\System\BluMoWM.exe
  2⤵
  PID:6800
- C:\Windows\System\BFANOYv.exe
  C:\Windows\System\BFANOYv.exe
  2⤵
  PID:8212
- C:\Windows\System\wpAqAFc.exe
  C:\Windows\System\wpAqAFc.exe
  2⤵
  PID:8240
- C:\Windows\System\kFPxEYJ.exe
  C:\Windows\System\kFPxEYJ.exe
  2⤵
  PID:8260
- C:\Windows\System\qJhvLLv.exe
  C:\Windows\System\qJhvLLv.exe
  2⤵
  PID:8284
- C:\Windows\System\EbxuVLA.exe
  C:\Windows\System\EbxuVLA.exe
  2⤵
  PID:8300
- C:\Windows\System\YfDeEfn.exe
  C:\Windows\System\YfDeEfn.exe
  2⤵
  PID:8324
- C:\Windows\System\vBmcLwN.exe
  C:\Windows\System\vBmcLwN.exe
  2⤵
  PID:8344
- C:\Windows\System\cpTDNiV.exe
  C:\Windows\System\cpTDNiV.exe
  2⤵
  PID:8364
- C:\Windows\System\zTYMaaJ.exe
  C:\Windows\System\zTYMaaJ.exe
  2⤵
  PID:8388
- C:\Windows\System\uVUGlbK.exe
  C:\Windows\System\uVUGlbK.exe
  2⤵
  PID:8412
- C:\Windows\System\BYwfSeq.exe
  C:\Windows\System\BYwfSeq.exe
  2⤵
  PID:8436
- C:\Windows\System\PKyoSRr.exe
  C:\Windows\System\PKyoSRr.exe
  2⤵
  PID:8468
- C:\Windows\System\AjPLDSE.exe
  C:\Windows\System\AjPLDSE.exe
  2⤵
  PID:8492
- C:\Windows\System\meYHbqd.exe
  C:\Windows\System\meYHbqd.exe
  2⤵
  PID:8516
- C:\Windows\System\YLmzCng.exe
  C:\Windows\System\YLmzCng.exe
  2⤵
  PID:8540
- C:\Windows\System\Iizpgaw.exe
  C:\Windows\System\Iizpgaw.exe
  2⤵
  PID:8560
- C:\Windows\System\eelPNge.exe
  C:\Windows\System\eelPNge.exe
  2⤵
  PID:8588
- C:\Windows\System\wCGhUTD.exe
  C:\Windows\System\wCGhUTD.exe
  2⤵
  PID:8616
- C:\Windows\System\iPlPaxh.exe
  C:\Windows\System\iPlPaxh.exe
  2⤵
  PID:8632
- C:\Windows\System\zQvePdi.exe
  C:\Windows\System\zQvePdi.exe
  2⤵
  PID:8660
- C:\Windows\System\SKqrSAy.exe
  C:\Windows\System\SKqrSAy.exe
  2⤵
  PID:8680
- C:\Windows\System\PaFfxcI.exe
  C:\Windows\System\PaFfxcI.exe
  2⤵
  PID:8700
- C:\Windows\System\PXKOccq.exe
  C:\Windows\System\PXKOccq.exe
  2⤵
  PID:8724
- C:\Windows\System\eUefYte.exe
  C:\Windows\System\eUefYte.exe
  2⤵
  PID:8744
- C:\Windows\System\DadihaZ.exe
  C:\Windows\System\DadihaZ.exe
  2⤵
  PID:8764
- C:\Windows\System\AzFiWwv.exe
  C:\Windows\System\AzFiWwv.exe
  2⤵
  PID:8788
- C:\Windows\System\ZjRqjvJ.exe
  C:\Windows\System\ZjRqjvJ.exe
  2⤵
  PID:8808
- C:\Windows\System\ocgWVWN.exe
  C:\Windows\System\ocgWVWN.exe
  2⤵
  PID:8828
- C:\Windows\System\KZoUBzC.exe
  C:\Windows\System\KZoUBzC.exe
  2⤵
  PID:8848
- C:\Windows\System\sjKtyVQ.exe
  C:\Windows\System\sjKtyVQ.exe
  2⤵
  PID:8872
- C:\Windows\System\SHqPvNZ.exe
  C:\Windows\System\SHqPvNZ.exe
  2⤵
  PID:8892
- C:\Windows\System\eYfLLEG.exe
  C:\Windows\System\eYfLLEG.exe
  2⤵
  PID:8916
- C:\Windows\System\EaWuVqU.exe
  C:\Windows\System\EaWuVqU.exe
  2⤵
  PID:8932
- C:\Windows\System\xrxrrYc.exe
  C:\Windows\System\xrxrrYc.exe
  2⤵
  PID:8960
- C:\Windows\System\FCOhvqc.exe
  C:\Windows\System\FCOhvqc.exe
  2⤵
  PID:8984
- C:\Windows\System\EjHQomx.exe
  C:\Windows\System\EjHQomx.exe
  2⤵
  PID:9004
- C:\Windows\System\aENfMNz.exe
  C:\Windows\System\aENfMNz.exe
  2⤵
  PID:9040
- C:\Windows\System\TXpUstw.exe
  C:\Windows\System\TXpUstw.exe
  2⤵
  PID:9056
- C:\Windows\System\HERAnDl.exe
  C:\Windows\System\HERAnDl.exe
  2⤵
  PID:9092
- C:\Windows\System\QGKGYwm.exe
  C:\Windows\System\QGKGYwm.exe
  2⤵
  PID:9116
- C:\Windows\System\ZBDxfpb.exe
  C:\Windows\System\ZBDxfpb.exe
  2⤵
  PID:9136
- C:\Windows\System\hTRGPLb.exe
  C:\Windows\System\hTRGPLb.exe
  2⤵
  PID:9152
- C:\Windows\System\wLVLhZv.exe
  C:\Windows\System\wLVLhZv.exe
  2⤵
  PID:9188
- C:\Windows\System\JfPpWjG.exe
  C:\Windows\System\JfPpWjG.exe
  2⤵
  PID:6648
- C:\Windows\System\SorCHym.exe
  C:\Windows\System\SorCHym.exe
  2⤵
  PID:4576
- C:\Windows\System\XaqQeCZ.exe
  C:\Windows\System\XaqQeCZ.exe
  2⤵
  PID:7036
- C:\Windows\System\LzhIkps.exe
  C:\Windows\System\LzhIkps.exe
  2⤵
  PID:6196
- C:\Windows\System\pbbsSri.exe
  C:\Windows\System\pbbsSri.exe
  2⤵
  PID:2572
- C:\Windows\System\GKSqUXD.exe
  C:\Windows\System\GKSqUXD.exe
  2⤵
  PID:7204
- C:\Windows\System\JgcWTvh.exe
  C:\Windows\System\JgcWTvh.exe
  2⤵
  PID:7308
- C:\Windows\System\mvaNXts.exe
  C:\Windows\System\mvaNXts.exe
  2⤵
  PID:5756
- C:\Windows\System\uaewDbH.exe
  C:\Windows\System\uaewDbH.exe
  2⤵
  PID:7396
- C:\Windows\System\AfeJZPx.exe
  C:\Windows\System\AfeJZPx.exe
  2⤵
  PID:7584
- C:\Windows\System\xhVOvWh.exe
  C:\Windows\System\xhVOvWh.exe
  2⤵
  PID:7668
- C:\Windows\System\ANGOoWU.exe
  C:\Windows\System\ANGOoWU.exe
  2⤵
  PID:5620
- C:\Windows\System\RikdviK.exe
  C:\Windows\System\RikdviK.exe
  2⤵
  PID:5164
- C:\Windows\System\yUCovcb.exe
  C:\Windows\System\yUCovcb.exe
  2⤵
  PID:7980
- C:\Windows\System\bCqLaYC.exe
  C:\Windows\System\bCqLaYC.exe
  2⤵
  PID:8028
- C:\Windows\System\vvMefBh.exe
  C:\Windows\System\vvMefBh.exe
  2⤵
  PID:6732
- C:\Windows\System\yhyxEkm.exe
  C:\Windows\System\yhyxEkm.exe
  2⤵
  PID:9224
- C:\Windows\System\jhGlDue.exe
  C:\Windows\System\jhGlDue.exe
  2⤵
  PID:9248
- C:\Windows\System\awcKhEt.exe
  C:\Windows\System\awcKhEt.exe
  2⤵
  PID:9280
- C:\Windows\System\vGPzaYl.exe
  C:\Windows\System\vGPzaYl.exe
  2⤵
  PID:9304
- C:\Windows\System\TsGQBuy.exe
  C:\Windows\System\TsGQBuy.exe
  2⤵
  PID:9328
- C:\Windows\System\BlVVJys.exe
  C:\Windows\System\BlVVJys.exe
  2⤵
  PID:9348
- C:\Windows\System\pAXgMpg.exe
  C:\Windows\System\pAXgMpg.exe
  2⤵
  PID:9364
- C:\Windows\System\rhvMWGR.exe
  C:\Windows\System\rhvMWGR.exe
  2⤵
  PID:9388
- C:\Windows\System\tOlVunY.exe
  C:\Windows\System\tOlVunY.exe
  2⤵
  PID:9412
- C:\Windows\System\eIlggan.exe
  C:\Windows\System\eIlggan.exe
  2⤵
  PID:9428
- C:\Windows\System\EvLCgqI.exe
  C:\Windows\System\EvLCgqI.exe
  2⤵
  PID:9452
- C:\Windows\System\fIQzplA.exe
  C:\Windows\System\fIQzplA.exe
  2⤵
  PID:9476
- C:\Windows\System\gkNsbMn.exe
  C:\Windows\System\gkNsbMn.exe
  2⤵
  PID:9496
- C:\Windows\System\WdvkOjx.exe
  C:\Windows\System\WdvkOjx.exe
  2⤵
  PID:9516
- C:\Windows\System\DHClFxC.exe
  C:\Windows\System\DHClFxC.exe
  2⤵
  PID:9536
- C:\Windows\System\HOvKftE.exe
  C:\Windows\System\HOvKftE.exe
  2⤵
  PID:9560
- C:\Windows\System\sCjLJti.exe
  C:\Windows\System\sCjLJti.exe
  2⤵
  PID:9584
- C:\Windows\System\fBdmpTP.exe
  C:\Windows\System\fBdmpTP.exe
  2⤵
  PID:9604
- C:\Windows\System\cfAEwFb.exe
  C:\Windows\System\cfAEwFb.exe
  2⤵
  PID:9628
- C:\Windows\System\EgHTbRf.exe
  C:\Windows\System\EgHTbRf.exe
  2⤵
  PID:9648
- C:\Windows\System\nLyQdsf.exe
  C:\Windows\System\nLyQdsf.exe
  2⤵
  PID:9680
- C:\Windows\System\SREWhVc.exe
  C:\Windows\System\SREWhVc.exe
  2⤵
  PID:9704
- C:\Windows\System\zeaIVRV.exe
  C:\Windows\System\zeaIVRV.exe
  2⤵
  PID:9732
- C:\Windows\System\ZLHsClC.exe
  C:\Windows\System\ZLHsClC.exe
  2⤵
  PID:9748
- C:\Windows\System\ahFMjVr.exe
  C:\Windows\System\ahFMjVr.exe
  2⤵
  PID:9768
- C:\Windows\System\qbPlGLJ.exe
  C:\Windows\System\qbPlGLJ.exe
  2⤵
  PID:9784
- C:\Windows\System\fkESEOH.exe
  C:\Windows\System\fkESEOH.exe
  2⤵
  PID:9800
- C:\Windows\System\CbRUfYU.exe
  C:\Windows\System\CbRUfYU.exe
  2⤵
  PID:9836
- C:\Windows\System\XOTQqHO.exe
  C:\Windows\System\XOTQqHO.exe
  2⤵
  PID:9868
- C:\Windows\System\qGffEvq.exe
  C:\Windows\System\qGffEvq.exe
  2⤵
  PID:9892
- C:\Windows\System\fRzyqHd.exe
  C:\Windows\System\fRzyqHd.exe
  2⤵
  PID:9912
- C:\Windows\System\ChqepiH.exe
  C:\Windows\System\ChqepiH.exe
  2⤵
  PID:9932
- C:\Windows\System\ewZnwvG.exe
  C:\Windows\System\ewZnwvG.exe
  2⤵
  PID:9952
- C:\Windows\System\xDgtaeR.exe
  C:\Windows\System\xDgtaeR.exe
  2⤵
  PID:9980
- C:\Windows\System\GMgoiIv.exe
  C:\Windows\System\GMgoiIv.exe
  2⤵
  PID:9996
- C:\Windows\System\fAiMEHS.exe
  C:\Windows\System\fAiMEHS.exe
  2⤵
  PID:10020
- C:\Windows\System\ANmPFNi.exe
  C:\Windows\System\ANmPFNi.exe
  2⤵
  PID:10040
- C:\Windows\System\odNTlAE.exe
  C:\Windows\System\odNTlAE.exe
  2⤵
  PID:10064
- C:\Windows\System\xDnjDmv.exe
  C:\Windows\System\xDnjDmv.exe
  2⤵
  PID:10088
- C:\Windows\System\SZrikVE.exe
  C:\Windows\System\SZrikVE.exe
  2⤵
  PID:10116
- C:\Windows\System\pECVJLi.exe
  C:\Windows\System\pECVJLi.exe
  2⤵
  PID:10136
- C:\Windows\System\jDBQnOz.exe
  C:\Windows\System\jDBQnOz.exe
  2⤵
  PID:10156
- C:\Windows\System\yFAcUbe.exe
  C:\Windows\System\yFAcUbe.exe
  2⤵
  PID:10176
- C:\Windows\System\XjaWRao.exe
  C:\Windows\System\XjaWRao.exe
  2⤵
  PID:10204
- C:\Windows\System\BdOYgDi.exe
  C:\Windows\System\BdOYgDi.exe
  2⤵
  PID:10220
- C:\Windows\System\iWVvLLQ.exe
  C:\Windows\System\iWVvLLQ.exe
  2⤵
  PID:5928
- C:\Windows\System\jPIqVcJ.exe
  C:\Windows\System\jPIqVcJ.exe
  2⤵
  PID:6376
- C:\Windows\System\WrMiHyi.exe
  C:\Windows\System\WrMiHyi.exe
  2⤵
  PID:6884
- C:\Windows\System\axVJTzi.exe
  C:\Windows\System\axVJTzi.exe
  2⤵
  PID:8396
- C:\Windows\System\CBbLhQY.exe
  C:\Windows\System\CBbLhQY.exe
  2⤵
  PID:8484
- C:\Windows\System\GiQfmRP.exe
  C:\Windows\System\GiQfmRP.exe
  2⤵
  PID:8536
- C:\Windows\System\sayIfyB.exe
  C:\Windows\System\sayIfyB.exe
  2⤵
  PID:8672
- C:\Windows\System\wRZjPjH.exe
  C:\Windows\System\wRZjPjH.exe
  2⤵
  PID:8712
- C:\Windows\System\uPyHyHa.exe
  C:\Windows\System\uPyHyHa.exe
  2⤵
  PID:6972
- C:\Windows\System\rBzEMjP.exe
  C:\Windows\System\rBzEMjP.exe
  2⤵
  PID:7408
- C:\Windows\System\nrtAWlw.exe
  C:\Windows\System\nrtAWlw.exe
  2⤵
  PID:7456
- C:\Windows\System\zPAqwkt.exe
  C:\Windows\System\zPAqwkt.exe
  2⤵
  PID:7480
- C:\Windows\System\ctnnJlN.exe
  C:\Windows\System\ctnnJlN.exe
  2⤵
  PID:7500
- C:\Windows\System\AcoRzvV.exe
  C:\Windows\System\AcoRzvV.exe
  2⤵
  PID:7524
- C:\Windows\System\BxjCXuT.exe
  C:\Windows\System\BxjCXuT.exe
  2⤵
  PID:7604
- C:\Windows\System\QTkcnEG.exe
  C:\Windows\System\QTkcnEG.exe
  2⤵
  PID:9132
- C:\Windows\System\odjTtqE.exe
  C:\Windows\System\odjTtqE.exe
  2⤵
  PID:9208
- C:\Windows\System\nqpAYFO.exe
  C:\Windows\System\nqpAYFO.exe
  2⤵
  PID:7712
- C:\Windows\System\jeUFCSQ.exe
  C:\Windows\System\jeUFCSQ.exe
  2⤵
  PID:10272
- C:\Windows\System\FHEzxsQ.exe
  C:\Windows\System\FHEzxsQ.exe
  2⤵
  PID:10292
- C:\Windows\System\LrgYPdl.exe
  C:\Windows\System\LrgYPdl.exe
  2⤵
  PID:10312
- C:\Windows\System\pgAWoIb.exe
  C:\Windows\System\pgAWoIb.exe
  2⤵
  PID:10328
- C:\Windows\System\dyQVseX.exe
  C:\Windows\System\dyQVseX.exe
  2⤵
  PID:10344
- C:\Windows\System\BaBczSu.exe
  C:\Windows\System\BaBczSu.exe
  2⤵
  PID:10364
- C:\Windows\System\GqRHSTK.exe
  C:\Windows\System\GqRHSTK.exe
  2⤵
  PID:10388
- C:\Windows\System\DEkecQf.exe
  C:\Windows\System\DEkecQf.exe
  2⤵
  PID:10408
- C:\Windows\System\dQTHOtc.exe
  C:\Windows\System\dQTHOtc.exe
  2⤵
  PID:10444
- C:\Windows\System\dREtDCA.exe
  C:\Windows\System\dREtDCA.exe
  2⤵
  PID:10480
- C:\Windows\System\CsdJzNV.exe
  C:\Windows\System\CsdJzNV.exe
  2⤵
  PID:10508
- C:\Windows\System\OiCekXv.exe
  C:\Windows\System\OiCekXv.exe
  2⤵
  PID:10536
- C:\Windows\System\VUFsjlM.exe
  C:\Windows\System\VUFsjlM.exe
  2⤵
  PID:10552
- C:\Windows\System\bmjsxTH.exe
  C:\Windows\System\bmjsxTH.exe
  2⤵
  PID:10572
- C:\Windows\System\abAWWjG.exe
  C:\Windows\System\abAWWjG.exe
  2⤵
  PID:10596
- C:\Windows\System\yxzRZRa.exe
  C:\Windows\System\yxzRZRa.exe
  2⤵
  PID:10616
- C:\Windows\System\ccfThVh.exe
  C:\Windows\System\ccfThVh.exe
  2⤵
  PID:10632
- C:\Windows\System\ijeTbBI.exe
  C:\Windows\System\ijeTbBI.exe
  2⤵
  PID:10648
- C:\Windows\System\IVHshqg.exe
  C:\Windows\System\IVHshqg.exe
  2⤵
  PID:10672
- C:\Windows\System\xujQfzE.exe
  C:\Windows\System\xujQfzE.exe
  2⤵
  PID:10692
- C:\Windows\System\VNKcMxO.exe
  C:\Windows\System\VNKcMxO.exe
  2⤵
  PID:10720
- C:\Windows\System\amFiSKt.exe
  C:\Windows\System\amFiSKt.exe
  2⤵
  PID:10740
- C:\Windows\System\fEmEhkN.exe
  C:\Windows\System\fEmEhkN.exe
  2⤵
  PID:10768
- C:\Windows\System\QjwiauQ.exe
  C:\Windows\System\QjwiauQ.exe
  2⤵
  PID:10788
- C:\Windows\System\DXtUUpy.exe
  C:\Windows\System\DXtUUpy.exe
  2⤵
  PID:10808
- C:\Windows\System\KWiMEzs.exe
  C:\Windows\System\KWiMEzs.exe
  2⤵
  PID:10828
- C:\Windows\System\aXYHGbu.exe
  C:\Windows\System\aXYHGbu.exe
  2⤵
  PID:10852
- C:\Windows\System\mlydclk.exe
  C:\Windows\System\mlydclk.exe
  2⤵
  PID:10872
- C:\Windows\System\eEWnKRH.exe
  C:\Windows\System\eEWnKRH.exe
  2⤵
  PID:10892
- C:\Windows\System\QDNllFJ.exe
  C:\Windows\System\QDNllFJ.exe
  2⤵
  PID:10916
- C:\Windows\System\SAXciiL.exe
  C:\Windows\System\SAXciiL.exe
  2⤵
  PID:10936
- C:\Windows\System\vbPHdjf.exe
  C:\Windows\System\vbPHdjf.exe
  2⤵
  PID:10960
- C:\Windows\System\GWnMcWP.exe
  C:\Windows\System\GWnMcWP.exe
  2⤵
  PID:11172
- C:\Windows\System\VQMZzLy.exe
  C:\Windows\System\VQMZzLy.exe
  2⤵
  PID:11188
- C:\Windows\System\WxIOUhq.exe
  C:\Windows\System\WxIOUhq.exe
  2⤵
  PID:11204
- C:\Windows\System\DENazsP.exe
  C:\Windows\System\DENazsP.exe
  2⤵
  PID:11220
- C:\Windows\System\KaoqcYm.exe
  C:\Windows\System\KaoqcYm.exe
  2⤵
  PID:11240
- C:\Windows\System\hIaSrkv.exe
  C:\Windows\System\hIaSrkv.exe
  2⤵
  PID:11260
- C:\Windows\System\mtmmsgX.exe
  C:\Windows\System\mtmmsgX.exe
  2⤵
  PID:7792
- C:\Windows\System\ZbrpTaj.exe
  C:\Windows\System\ZbrpTaj.exe
  2⤵
  PID:7244
- C:\Windows\System\KHNjvUK.exe
  C:\Windows\System\KHNjvUK.exe
  2⤵
  PID:7820
- C:\Windows\System\wLrzeHa.exe
  C:\Windows\System\wLrzeHa.exe
  2⤵
  PID:6948
- C:\Windows\System\boBRHQB.exe
  C:\Windows\System\boBRHQB.exe
  2⤵
  PID:5856
- C:\Windows\System\cpsgtuj.exe
  C:\Windows\System\cpsgtuj.exe
  2⤵
  PID:7932
- C:\Windows\System\brdxvkP.exe
  C:\Windows\System\brdxvkP.exe
  2⤵
  PID:6052
- C:\Windows\System\lGSnBKV.exe
  C:\Windows\System\lGSnBKV.exe
  2⤵
  PID:8024
- C:\Windows\System\xNBEWcM.exe
  C:\Windows\System\xNBEWcM.exe
  2⤵
  PID:416
- C:\Windows\System\jcSTKgb.exe
  C:\Windows\System\jcSTKgb.exe
  2⤵
  PID:8092
- C:\Windows\System\nJInFsY.exe
  C:\Windows\System\nJInFsY.exe
  2⤵
  PID:8164
- C:\Windows\System\Ffyyryv.exe
  C:\Windows\System\Ffyyryv.exe
  2⤵
  PID:6480
- C:\Windows\System\xdMTPXE.exe
  C:\Windows\System\xdMTPXE.exe
  2⤵
  PID:9296
- C:\Windows\System\BEtlXca.exe
  C:\Windows\System\BEtlXca.exe
  2⤵
  PID:5600
- C:\Windows\System\iOCyZCa.exe
  C:\Windows\System\iOCyZCa.exe
  2⤵
  PID:8200
- C:\Windows\System\aWAdtoC.exe
  C:\Windows\System\aWAdtoC.exe
  2⤵
  PID:9360
- C:\Windows\System\IBgRbaS.exe
  C:\Windows\System\IBgRbaS.exe
  2⤵
  PID:9400
- C:\Windows\System\WCQMYtC.exe
  C:\Windows\System\WCQMYtC.exe
  2⤵
  PID:9420
- C:\Windows\System\OOxqbRT.exe
  C:\Windows\System\OOxqbRT.exe
  2⤵
  PID:9492
- C:\Windows\System\iJAtvrG.exe
  C:\Windows\System\iJAtvrG.exe
  2⤵
  PID:8356
- C:\Windows\System\jZsFKmz.exe
  C:\Windows\System\jZsFKmz.exe
  2⤵
  PID:9640
- C:\Windows\System\LKfrjoz.exe
  C:\Windows\System\LKfrjoz.exe
  2⤵
  PID:9668
- C:\Windows\System\gnrcZBZ.exe
  C:\Windows\System\gnrcZBZ.exe
  2⤵
  PID:9724
- C:\Windows\System\mjIHgSj.exe
  C:\Windows\System\mjIHgSj.exe
  2⤵
  PID:9792
- C:\Windows\System\SnWPXPt.exe
  C:\Windows\System\SnWPXPt.exe
  2⤵
  PID:2664
- C:\Windows\System\fMPbNti.exe
  C:\Windows\System\fMPbNti.exe
  2⤵
  PID:8600
- C:\Windows\System\TIJQWkg.exe
  C:\Windows\System\TIJQWkg.exe
  2⤵
  PID:9908
- C:\Windows\System\hesyprD.exe
  C:\Windows\System\hesyprD.exe
  2⤵
  PID:9960
- C:\Windows\System\qYPWoop.exe
  C:\Windows\System\qYPWoop.exe
  2⤵
  PID:9964
- C:\Windows\System\wXrbbUT.exe
  C:\Windows\System\wXrbbUT.exe
  2⤵
  PID:10016
- C:\Windows\System\IurUamm.exe
  C:\Windows\System\IurUamm.exe
  2⤵
  PID:8780
- C:\Windows\System\yORDGTI.exe
  C:\Windows\System\yORDGTI.exe
  2⤵
  PID:10084
- C:\Windows\System\xUPDTWP.exe
  C:\Windows\System\xUPDTWP.exe
  2⤵
  PID:10132
- C:\Windows\System\XcrTLCq.exe
  C:\Windows\System\XcrTLCq.exe
  2⤵
  PID:10172
- C:\Windows\System\fRCxKFp.exe
  C:\Windows\System\fRCxKFp.exe
  2⤵
  PID:10232
- C:\Windows\System\aDUmzLJ.exe
  C:\Windows\System\aDUmzLJ.exe
  2⤵
  PID:8336
- C:\Windows\System\CWdqflE.exe
  C:\Windows\System\CWdqflE.exe
  2⤵
  PID:8480
- C:\Windows\System\kzSKiUR.exe
  C:\Windows\System\kzSKiUR.exe
  2⤵
  PID:9024
- C:\Windows\System\QkDaAYD.exe
  C:\Windows\System\QkDaAYD.exe
  2⤵
  PID:9068
- C:\Windows\System\VzpQNXJ.exe
  C:\Windows\System\VzpQNXJ.exe
  2⤵
  PID:8652
- C:\Windows\System\jdAtQhO.exe
  C:\Windows\System\jdAtQhO.exe
  2⤵
  PID:7336
- C:\Windows\System\qoebDwS.exe
  C:\Windows\System\qoebDwS.exe
  2⤵
  PID:7648
- C:\Windows\System\ZrfRUNr.exe
  C:\Windows\System\ZrfRUNr.exe
  2⤵
  PID:9168
- C:\Windows\System\JYAuVfT.exe
  C:\Windows\System\JYAuVfT.exe
  2⤵
  PID:9196
- C:\Windows\System\hwiruIv.exe
  C:\Windows\System\hwiruIv.exe
  2⤵
  PID:11292
- C:\Windows\System\OIipubm.exe
  C:\Windows\System\OIipubm.exe
  2⤵
  PID:11312
- C:\Windows\System\gbfyvsp.exe
  C:\Windows\System\gbfyvsp.exe
  2⤵
  PID:11332
- C:\Windows\System\vYvcRVJ.exe
  C:\Windows\System\vYvcRVJ.exe
  2⤵
  PID:11352
- C:\Windows\System\tQBnLWb.exe
  C:\Windows\System\tQBnLWb.exe
  2⤵
  PID:11928
- C:\Windows\System\xRjkGpG.exe
  C:\Windows\System\xRjkGpG.exe
  2⤵
  PID:11952
- C:\Windows\System\cMGUHan.exe
  C:\Windows\System\cMGUHan.exe
  2⤵
  PID:11980
- C:\Windows\System\AwlurIC.exe
  C:\Windows\System\AwlurIC.exe
  2⤵
  PID:12004
- C:\Windows\System\MtihsDB.exe
  C:\Windows\System\MtihsDB.exe
  2⤵
  PID:12020
- C:\Windows\System\UMVoNYj.exe
  C:\Windows\System\UMVoNYj.exe
  2⤵
  PID:12036
- C:\Windows\System\XJtnTGV.exe
  C:\Windows\System\XJtnTGV.exe
  2⤵
  PID:12056
- C:\Windows\System\rzgFxgZ.exe
  C:\Windows\System\rzgFxgZ.exe
  2⤵
  PID:12080
- C:\Windows\System\AapUrER.exe
  C:\Windows\System\AapUrER.exe
  2⤵
  PID:12104
- C:\Windows\System\ADZHzvG.exe
  C:\Windows\System\ADZHzvG.exe
  2⤵
  PID:12120
- C:\Windows\System\eBMfQCJ.exe
  C:\Windows\System\eBMfQCJ.exe
  2⤵
  PID:12144
- C:\Windows\System\mGRJMev.exe
  C:\Windows\System\mGRJMev.exe
  2⤵
  PID:12160
- C:\Windows\System\bkJKHRm.exe
  C:\Windows\System\bkJKHRm.exe
  2⤵
  PID:12176
- C:\Windows\System\fGiUhVm.exe
  C:\Windows\System\fGiUhVm.exe
  2⤵
  PID:12200
- C:\Windows\System\yRxWPQT.exe
  C:\Windows\System\yRxWPQT.exe
  2⤵
  PID:12220
- C:\Windows\System\idmJDXS.exe
  C:\Windows\System\idmJDXS.exe
  2⤵
  PID:12240
- C:\Windows\System\ZBJmyiv.exe
  C:\Windows\System\ZBJmyiv.exe
  2⤵
  PID:12264
- C:\Windows\System\LXVcxRC.exe
  C:\Windows\System\LXVcxRC.exe
  2⤵
  PID:7540
- C:\Windows\System\BojLeEe.exe
  C:\Windows\System\BojLeEe.exe
  2⤵
  PID:6752
- C:\Windows\System\wGfMGeP.exe
  C:\Windows\System\wGfMGeP.exe
  2⤵
  PID:7092
- C:\Windows\System\WslKMeW.exe
  C:\Windows\System\WslKMeW.exe
  2⤵
  PID:10324
- C:\Windows\System\VgYLURp.exe
  C:\Windows\System\VgYLURp.exe
  2⤵
  PID:10372
- C:\Windows\System\FUvijcK.exe
  C:\Windows\System\FUvijcK.exe
  2⤵
  PID:10420
- C:\Windows\System\NCSVPqe.exe
  C:\Windows\System\NCSVPqe.exe
  2⤵
  PID:10436
- C:\Windows\System\UYkVIEc.exe
  C:\Windows\System\UYkVIEc.exe
  2⤵
  PID:10492
- C:\Windows\System\vauSmud.exe
  C:\Windows\System\vauSmud.exe
  2⤵
  PID:10528
- C:\Windows\System\fqgIBXT.exe
  C:\Windows\System\fqgIBXT.exe
  2⤵
  PID:8220
- C:\Windows\System\JncNifc.exe
  C:\Windows\System\JncNifc.exe
  2⤵
  PID:10612
- C:\Windows\System\wzIzGyi.exe
  C:\Windows\System\wzIzGyi.exe
  2⤵
  PID:10680
- C:\Windows\System\nhXHhgc.exe
  C:\Windows\System\nhXHhgc.exe
  2⤵
  PID:10836
- C:\Windows\System\duspWsH.exe
  C:\Windows\System\duspWsH.exe
  2⤵
  PID:9548
- C:\Windows\System\LNzjgRL.exe
  C:\Windows\System\LNzjgRL.exe
  2⤵
  PID:9696
- C:\Windows\System\qnJRrzJ.exe
  C:\Windows\System\qnJRrzJ.exe
  2⤵
  PID:10984
- C:\Windows\System\WETWnms.exe
  C:\Windows\System\WETWnms.exe
  2⤵
  PID:11008
- C:\Windows\System\dDBEgiD.exe
  C:\Windows\System\dDBEgiD.exe
  2⤵
  PID:11028
- C:\Windows\System\rbGpCuM.exe
  C:\Windows\System\rbGpCuM.exe
  2⤵
  PID:11088
- C:\Windows\System\FBNTwND.exe
  C:\Windows\System\FBNTwND.exe
  2⤵
  PID:11072
- C:\Windows\System\dilytpr.exe
  C:\Windows\System\dilytpr.exe
  2⤵
  PID:11084
- C:\Windows\System\QApsmzf.exe
  C:\Windows\System\QApsmzf.exe
  2⤵
  PID:11080
- C:\Windows\System\bqMBfFG.exe
  C:\Windows\System\bqMBfFG.exe
  2⤵
  PID:11116
- C:\Windows\System\KJjKIWH.exe
  C:\Windows\System\KJjKIWH.exe
  2⤵
  PID:11140
- C:\Windows\System\FJKzpgi.exe
  C:\Windows\System\FJKzpgi.exe
  2⤵
  PID:11168
- C:\Windows\System\GNaObvT.exe
  C:\Windows\System\GNaObvT.exe
  2⤵
  PID:9880
- C:\Windows\System\qWuKsZW.exe
  C:\Windows\System\qWuKsZW.exe
  2⤵
  PID:7816
- C:\Windows\System\wHdoZFA.exe
  C:\Windows\System\wHdoZFA.exe
  2⤵
  PID:8772
- C:\Windows\System\VxTrIpV.exe
  C:\Windows\System\VxTrIpV.exe
  2⤵
  PID:10128
- C:\Windows\System\oqNFvlS.exe
  C:\Windows\System\oqNFvlS.exe
  2⤵
  PID:10236
- C:\Windows\System\ZRBhXUJ.exe
  C:\Windows\System\ZRBhXUJ.exe
  2⤵
  PID:1740
- C:\Windows\System\cLTETsN.exe
  C:\Windows\System\cLTETsN.exe
  2⤵
  PID:8420
- C:\Windows\System\jtZNtiO.exe
  C:\Windows\System\jtZNtiO.exe
  2⤵
  PID:8528
- C:\Windows\System\rtufUVY.exe
  C:\Windows\System\rtufUVY.exe
  2⤵
  PID:9848
- C:\Windows\System\BnHZDHB.exe
  C:\Windows\System\BnHZDHB.exe
  2⤵
  PID:9944
- C:\Windows\System\JPGLhqe.exe
  C:\Windows\System\JPGLhqe.exe
  2⤵
  PID:8740
- C:\Windows\System\QIChJlQ.exe
  C:\Windows\System\QIChJlQ.exe
  2⤵
  PID:8880
- C:\Windows\System\QFQeoWK.exe
  C:\Windows\System\QFQeoWK.exe
  2⤵
  PID:10152
- C:\Windows\System\STnohzh.exe
  C:\Windows\System\STnohzh.exe
  2⤵
  PID:8408
- C:\Windows\System\lxRNpCe.exe
  C:\Windows\System\lxRNpCe.exe
  2⤵
  PID:9064
- C:\Windows\System\yInrFlX.exe
  C:\Windows\System\yInrFlX.exe
  2⤵
  PID:8972
- C:\Windows\System\FmTysek.exe
  C:\Windows\System\FmTysek.exe
  2⤵
  PID:7076
- C:\Windows\System\VxfeaDC.exe
  C:\Windows\System\VxfeaDC.exe
  2⤵
  PID:10380
- C:\Windows\System\ZSggEko.exe
  C:\Windows\System\ZSggEko.exe
  2⤵
  PID:11496
- C:\Windows\System\dUCRPbH.exe
  C:\Windows\System\dUCRPbH.exe
  2⤵
  PID:10464
- C:\Windows\System\reKbadU.exe
  C:\Windows\System\reKbadU.exe
  2⤵
  PID:9232
- C:\Windows\System\QZSVMsP.exe
  C:\Windows\System\QZSVMsP.exe
  2⤵
  PID:11536
- C:\Windows\System\YJLLZnx.exe
  C:\Windows\System\YJLLZnx.exe
  2⤵
  PID:9532
- C:\Windows\System\krphlvh.exe
  C:\Windows\System\krphlvh.exe
  2⤵
  PID:9712
- C:\Windows\System\dRAojTL.exe
  C:\Windows\System\dRAojTL.exe
  2⤵
  PID:11200
- C:\Windows\System\TyClBUQ.exe
  C:\Windows\System\TyClBUQ.exe
  2⤵
  PID:9904
- C:\Windows\System\WGzHXEq.exe
  C:\Windows\System\WGzHXEq.exe
  2⤵
  PID:12304
- C:\Windows\System\WqgWzIk.exe
  C:\Windows\System\WqgWzIk.exe
  2⤵
  PID:12328
- C:\Windows\System\CAypwBL.exe
  C:\Windows\System\CAypwBL.exe
  2⤵
  PID:12352
- C:\Windows\System\CNSdafX.exe
  C:\Windows\System\CNSdafX.exe
  2⤵
  PID:12372
- C:\Windows\System\KUNhclG.exe
  C:\Windows\System\KUNhclG.exe
  2⤵
  PID:12392
- C:\Windows\System\WXyABBM.exe
  C:\Windows\System\WXyABBM.exe
  2⤵
  PID:12412
- C:\Windows\System\QYRlWLh.exe
  C:\Windows\System\QYRlWLh.exe
  2⤵
  PID:12428
- C:\Windows\System\bzseoPw.exe
  C:\Windows\System\bzseoPw.exe
  2⤵
  PID:12444
- C:\Windows\System\PjVufqP.exe
  C:\Windows\System\PjVufqP.exe
  2⤵
  PID:12460
- C:\Windows\System\mvgakuX.exe
  C:\Windows\System\mvgakuX.exe
  2⤵
  PID:12476
- C:\Windows\System\vXrkymN.exe
  C:\Windows\System\vXrkymN.exe
  2⤵
  PID:12496
- C:\Windows\System\FVyksGg.exe
  C:\Windows\System\FVyksGg.exe
  2⤵
  PID:12520
- C:\Windows\System\SWWAUkn.exe
  C:\Windows\System\SWWAUkn.exe
  2⤵
  PID:12544
- C:\Windows\System\WVKZjbq.exe
  C:\Windows\System\WVKZjbq.exe
  2⤵
  PID:12564
- C:\Windows\System\bTFXuAg.exe
  C:\Windows\System\bTFXuAg.exe
  2⤵
  PID:12588
- C:\Windows\System\FJIFNDA.exe
  C:\Windows\System\FJIFNDA.exe
  2⤵
  PID:12612
- C:\Windows\System\irSxqyg.exe
  C:\Windows\System\irSxqyg.exe
  2⤵
  PID:10708
- C:\Windows\System\ifEJMWt.exe
  C:\Windows\System\ifEJMWt.exe
  2⤵
  PID:8072
- C:\Windows\System\TFFletK.exe
  C:\Windows\System\TFFletK.exe
  2⤵
  PID:12528
- C:\Windows\System\yIbxAMh.exe
  C:\Windows\System\yIbxAMh.exe
  2⤵
  PID:12644
- C:\Windows\System\LfIeKtX.exe
  C:\Windows\System\LfIeKtX.exe
  2⤵
  PID:7200
- C:\Windows\System\WOaGajV.exe
  C:\Windows\System\WOaGajV.exe
  2⤵
  PID:13104
- C:\Windows\System\lnJpzwy.exe
  C:\Windows\System\lnJpzwy.exe
  2⤵
  PID:9220
- C:\Windows\System\dBCBWZs.exe
  C:\Windows\System\dBCBWZs.exe
  2⤵
  PID:13176
- C:\Windows\System\zPbjzMe.exe
  C:\Windows\System\zPbjzMe.exe
  2⤵
  PID:13192
- C:\Windows\System\ERMrmge.exe
  C:\Windows\System\ERMrmge.exe
  2⤵
  PID:12364
- C:\Windows\System\CtknwRk.exe
  C:\Windows\System\CtknwRk.exe
  2⤵
  PID:13276
- C:\Windows\System\jlwQyps.exe
  C:\Windows\System\jlwQyps.exe
  2⤵
  PID:12584
- C:\Windows\System\HGBJjbh.exe
  C:\Windows\System\HGBJjbh.exe
  2⤵
  PID:11096
- C:\Windows\System\aNBIJKl.exe
  C:\Windows\System\aNBIJKl.exe
  2⤵
  PID:11152
- C:\Windows\System\weULifx.exe
  C:\Windows\System\weULifx.exe
  2⤵
  PID:7852
- C:\Windows\System\lPNqSZn.exe
  C:\Windows\System\lPNqSZn.exe
  2⤵
  PID:8524
- C:\Windows\System\oZHJvZx.exe
  C:\Windows\System\oZHJvZx.exe
  2⤵
  PID:8688
- C:\Windows\System\Ltgcxyg.exe
  C:\Windows\System\Ltgcxyg.exe
  2⤵
  PID:12628
- C:\Windows\System\dgzLuta.exe
  C:\Windows\System\dgzLuta.exe
  2⤵
  PID:12664
- C:\Windows\System\YegsZOW.exe
  C:\Windows\System\YegsZOW.exe
  2⤵
  PID:11416
- C:\Windows\System\paIUdFY.exe
  C:\Windows\System\paIUdFY.exe
  2⤵
  PID:12028
- C:\Windows\System\iJfecjK.exe
  C:\Windows\System\iJfecjK.exe
  2⤵
  PID:10748
- C:\Windows\System\FggPZRn.exe
  C:\Windows\System\FggPZRn.exe
  2⤵
  PID:12172
- C:\Windows\System\zrlMwyw.exe
  C:\Windows\System\zrlMwyw.exe
  2⤵
  PID:7940
- C:\Windows\System\wSaAuWn.exe
  C:\Windows\System\wSaAuWn.exe
  2⤵
  PID:12652
- C:\Windows\System\BDUZaYZ.exe
  C:\Windows\System\BDUZaYZ.exe
  2⤵
  PID:10980
- C:\Windows\System\reTnpsI.exe
  C:\Windows\System\reTnpsI.exe
  2⤵
  PID:12436
- C:\Windows\System\qEAQqBi.exe
  C:\Windows\System\qEAQqBi.exe
  2⤵
  PID:11180
- C:\Windows\System\mRwjTfE.exe
  C:\Windows\System\mRwjTfE.exe
  2⤵
  PID:11344
- C:\Windows\System\OKroXRB.exe
  C:\Windows\System\OKroXRB.exe
  2⤵
  PID:4984
- C:\Windows\System\fDTvHqD.exe
  C:\Windows\System\fDTvHqD.exe
  2⤵
  PID:11988
- C:\Windows\System\OrNRYvU.exe
  C:\Windows\System\OrNRYvU.exe
  2⤵
  PID:10396
- C:\Windows\System\qtBhvum.exe
  C:\Windows\System\qtBhvum.exe
  2⤵
  PID:12284
- C:\Windows\System\jofYJrO.exe
  C:\Windows\System\jofYJrO.exe
  2⤵
  PID:13116
- C:\Windows\System\kfzfZwu.exe
  C:\Windows\System\kfzfZwu.exe
  2⤵
  PID:8952
- C:\Windows\System\WuhHMPV.exe
  C:\Windows\System\WuhHMPV.exe
  2⤵
  PID:13152
- C:\Windows\System\peRFUcz.exe
  C:\Windows\System\peRFUcz.exe
  2⤵
  PID:12788
- C:\Windows\System\aDZNSgs.exe
  C:\Windows\System\aDZNSgs.exe
  2⤵
  PID:12472
- C:\Windows\System\owdAWrD.exe
  C:\Windows\System\owdAWrD.exe
  2⤵
  PID:13212
- C:\Windows\System\LMINUvi.exe
  C:\Windows\System\LMINUvi.exe
  2⤵
  PID:12596
- C:\Windows\System\cdWNhOm.exe
  C:\Windows\System\cdWNhOm.exe
  2⤵
  PID:1956
- C:\Windows\System\SByGtEp.exe
  C:\Windows\System\SByGtEp.exe
  2⤵
  PID:9924
- C:\Windows\System\BaTUaOM.exe
  C:\Windows\System\BaTUaOM.exe
  2⤵
  PID:12516
- C:\Windows\System\idIspGJ.exe
  C:\Windows\System\idIspGJ.exe
  2⤵
  PID:13032
- C:\Windows\System\yKsxCVq.exe
  C:\Windows\System\yKsxCVq.exe
  2⤵
  PID:11112
- C:\Windows\System\CnxGVIe.exe
  C:\Windows\System\CnxGVIe.exe
  2⤵
  PID:13220
- C:\Windows\System\SMKwPGu.exe
  C:\Windows\System\SMKwPGu.exe
  2⤵
  PID:12696
- C:\Windows\System\YafbDDF.exe
  C:\Windows\System\YafbDDF.exe
  2⤵
  PID:9312
- C:\Windows\System\tAtRbMS.exe
  C:\Windows\System\tAtRbMS.exe
  2⤵
  PID:12860
- C:\Windows\System\yVWwoym.exe
  C:\Windows\System\yVWwoym.exe
  2⤵
  PID:12924
- C:\Windows\System\vEBNJTR.exe
  C:\Windows\System\vEBNJTR.exe
  2⤵
  PID:12832
- C:\Windows\System\itjTAdd.exe
  C:\Windows\System\itjTAdd.exe
  2⤵
  PID:12996
- C:\Windows\System\zbTztML.exe
  C:\Windows\System\zbTztML.exe
  2⤵
  PID:13184
- C:\Windows\System\jHpnzBr.exe
  C:\Windows\System\jHpnzBr.exe
  2⤵
  PID:12300
- C:\Windows\System\piaBYpU.exe
  C:\Windows\System\piaBYpU.exe
  2⤵
  PID:11044
- C:\Windows\System\nRROeEI.exe
  C:\Windows\System\nRROeEI.exe
  2⤵
  PID:13016
- C:\Windows\System\pWDfkjS.exe
  C:\Windows\System\pWDfkjS.exe
  2⤵
  PID:12184
- C:\Windows\System\kHXoNIY.exe
  C:\Windows\System\kHXoNIY.exe
  2⤵
  PID:6928
- C:\Windows\System\UXKLdhB.exe
  C:\Windows\System\UXKLdhB.exe
  2⤵
  PID:12404
- C:\Windows\System\vdBJmES.exe
  C:\Windows\System\vdBJmES.exe
  2⤵
  PID:9244
- C:\Windows\System\jJzoMnC.exe
  C:\Windows\System\jJzoMnC.exe
  2⤵
  PID:11992
- C:\Windows\System\tqQTEoU.exe
  C:\Windows\System\tqQTEoU.exe
  2⤵
  PID:12256
- C:\Windows\System\RzvIATx.exe
  C:\Windows\System\RzvIATx.exe
  2⤵
  PID:11404
- C:\Windows\System\CxpbknK.exe
  C:\Windows\System\CxpbknK.exe
  2⤵
  PID:13076
- C:\Windows\System\OPBGZPz.exe
  C:\Windows\System\OPBGZPz.exe
  2⤵
  PID:4948
- C:\Windows\System\TLqbxxG.exe
  C:\Windows\System\TLqbxxG.exe
  2⤵
  PID:7124
- C:\Windows\System\XKphYqY.exe
  C:\Windows\System\XKphYqY.exe
  2⤵
  PID:9384
- C:\Windows\System\NTQyFdm.exe
  C:\Windows\System\NTQyFdm.exe
  2⤵
  PID:13204
- C:\Windows\System\YJaOfNZ.exe
  C:\Windows\System\YJaOfNZ.exe
  2⤵
  PID:7912
- C:\Windows\System\fIJnjGN.exe
  C:\Windows\System\fIJnjGN.exe
  2⤵
  PID:11024
- C:\Windows\System\CXZgkql.exe
  C:\Windows\System\CXZgkql.exe
  2⤵
  PID:12688
- C:\Windows\System\YeoHJiL.exe
  C:\Windows\System\YeoHJiL.exe
  2⤵
  PID:10860
- C:\Windows\System\ecYtOwG.exe
  C:\Windows\System\ecYtOwG.exe
  2⤵
  PID:10504
- C:\Windows\System\KwiLMHl.exe
  C:\Windows\System\KwiLMHl.exe
  2⤵
  PID:12636
- C:\Windows\System\lQjPcmJ.exe
  C:\Windows\System\lQjPcmJ.exe
  2⤵
  PID:4820
- C:\Windows\System\vHgAHIM.exe
  C:\Windows\System\vHgAHIM.exe
  2⤵
  PID:10212
- C:\Windows\System\NwUJZVZ.exe
  C:\Windows\System\NwUJZVZ.exe
  2⤵
  PID:10904
- C:\Windows\System\tqQxIHq.exe
  C:\Windows\System\tqQxIHq.exe
  2⤵
  PID:13068
- C:\Windows\System\MlBpBEr.exe
  C:\Windows\System\MlBpBEr.exe
  2⤵
  PID:12808
- C:\Windows\System\tMHudpx.exe
  C:\Windows\System\tMHudpx.exe
  2⤵
  PID:10884
- C:\Windows\System\ayVqaLH.exe
  C:\Windows\System\ayVqaLH.exe
  2⤵
  PID:7160
- C:\Windows\System\MwFBkYb.exe
  C:\Windows\System\MwFBkYb.exe
  2⤵
  PID:13168
- C:\Windows\System\mHrEaAX.exe
  C:\Windows\System\mHrEaAX.exe
  2⤵
  PID:3252
- C:\Windows\System\oNLxmCi.exe
  C:\Windows\System\oNLxmCi.exe
  2⤵
  PID:13024
- C:\Windows\System\sNQaFLe.exe
  C:\Windows\System\sNQaFLe.exe
  2⤵
  PID:10108
- C:\Windows\System\FLGysXF.exe
  C:\Windows\System\FLGysXF.exe
  2⤵
  PID:3888
- C:\Windows\System\ADyzCTl.exe
  C:\Windows\System\ADyzCTl.exe
  2⤵
  PID:12812
- C:\Windows\System\fmkARuL.exe
  C:\Windows\System\fmkARuL.exe
  2⤵
  PID:11944
- C:\Windows\System\EjZfqwA.exe
  C:\Windows\System\EjZfqwA.exe
  2⤵
  PID:9780
- C:\Windows\System\gUdPFcK.exe
  C:\Windows\System\gUdPFcK.exe
  2⤵
  PID:12452
- C:\Windows\System\IfkzNvr.exe
  C:\Windows\System\IfkzNvr.exe
  2⤵
  PID:2264
- C:\Windows\System\pDPrWIV.exe
  C:\Windows\System\pDPrWIV.exe
  2⤵
  PID:12784
- C:\Windows\System\iIRYPgQ.exe
  C:\Windows\System\iIRYPgQ.exe
  2⤵
  PID:11228
- C:\Windows\System\pynVTdk.exe
  C:\Windows\System\pynVTdk.exe
  2⤵
  PID:11056
- C:\Windows\System\OxTHKjc.exe
  C:\Windows\System\OxTHKjc.exe
  2⤵
  PID:11236
- C:\Windows\System\wIlcWUZ.exe
  C:\Windows\System\wIlcWUZ.exe
  2⤵
  PID:11972

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 548 -p 12104 -ip 12104
1⤵
PID:12636

C:\Windows\system32\WerFaultSecure.exe
"C:\Windows\system32\WerFaultSecure.exe" -protectedcrash -p 10864 -i 10864 -h 604 -j 504 -s 452 -d 11528
1⤵
PID:12312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tgwypzvm.05m.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\APXHtCL.exe

Filesize
1.8MB

MD5
2bd7b6f548e73aaadbe4976a0ffdb8dd

SHA1
53d97902bfd583087494c381dfb4ed50a28928f7

SHA256
cdc9d52f4fb31d094ccb2d2d978fbd3f573ee71aee7b9850ab87d5f8cbd57005

SHA512
aa0ad94b5e05c87a0bd218ec7e68a88417225d36da434f42814a5555f76226aa8a4ad30c4752db4cc1396c4e804c6fdc057e799be19920e78c997df9b436b5c7

Download Submit
C:\Windows\System\BMQGyRd.exe

Filesize
1.8MB

MD5
89f39632ee3e9b596c9eec9b690de12b

SHA1
e32f8afc65a52c8ae4a40948d9dcc1f55360f1fc

SHA256
1e7553705dcf09963b2e5e6737c602471debcb54588df1a87975f7dfd9dc8e5b

SHA512
5751110d5468cc4346d537a79dcdb25c49deeeb91e5726e10e52d5abc00c38c97c12f3d78d75dbee6c239296835d6d8c90c242fd1702ee5dc9ae365629dca85e

Download Submit
C:\Windows\System\EZgcfCy.exe

Filesize
1.8MB

MD5
6fe295205b348273c23560915b1b3d3e

SHA1
b96ada4b40addefe01938168c0ebb43449168d37

SHA256
2016c9845adf15165d6482541c91317a3c159b419ed7e499b2511f8e170bad64

SHA512
d1385eca9178af4c609630271c10f59326ed4e13b1ee12c0bd29fe2701c2d5d73c69c75ac646dc5918e30154ae94f9eca9dfa23afca61952ac3fa5d8261160a5

Download Submit
C:\Windows\System\EqicWkT.exe

Filesize
1.8MB

MD5
fb69863633843ef65be1c50557d41d50

SHA1
ab3452f42db34920cad5d4a2cba2e265b7f44196

SHA256
15b7284d53cd9ca58013fd9d16f60e4134c3d1217e3e1125e97061ecfe300b0d

SHA512
b36a7516a661c5a24e1cac9d68129b79f7168ec6e4e093d4c76453c7b7ecbb4a003dcd2eba4b4c13310723a7d1e60ba947dc2feb6c3f49776b704197115bae97

Download Submit
C:\Windows\System\KpeNhIt.exe

Filesize
1.8MB

MD5
b310b95e000ae2d49a6600c45dead604

SHA1
f3df37328dc57e68cc62100df9c69d94b3417ca1

SHA256
46f00a2ad3a442a508568740287b4099e0e5aea37b0cc73ef14fe4b2a5ec391f

SHA512
3bb463ba58fd5d1941331a2132679cea96c370b939710c1a616a6271e5c6816a22c67c2a38b11f5faaab309c8128050ce88d674a10cf9a2c63c1a2150715aaa3

Download Submit
C:\Windows\System\MNXUIwA.exe

Filesize
1.8MB

MD5
4aeae0a1b786ede2f489e0ef2c2cdf26

SHA1
da25ed597dc2329fb8fd61c531deb654b8e1f9e2

SHA256
8e0a5bbfbfa8e6544064292375112731ef958b5ef30ba46551de6240b0b8f1dd

SHA512
39598da7e77b683d9aec3606d6dc63797880b4cca6ba72226ecf096346db784e711f5cddfee790ad6a10d8d32df03d3ba668c54f4c8384f62de948f1d5b1c7b6

Download Submit
C:\Windows\System\MbAwZIa.exe

Filesize
1.8MB

MD5
e5d803895fa7a8f2f158917050e93342

SHA1
b8e36b56d444e3e631fe761c4fb4be932d445f66

SHA256
d84c2faddbf309cc95a85ef692620f72e82ffc0ea1ca6c4f30dbdd1d596772a4

SHA512
7faf0bd621bf75ab54f4c8ab76353d92149f82f83d97a9106c1006ebb0b151646416becafa47c04ea356e4eaec1519556874e6becb6f84a41965839a9294712f

Download Submit
C:\Windows\System\NPJCtQq.exe

Filesize
1.8MB

MD5
473f287758a119b4373f2ae540e4eeb2

SHA1
ca5a8b0954db26160e0314a3db785d7fa313a92b

SHA256
928b75f6aaf4f5155ac1bc1b37befc07256537c4de6a331d4e4e94dfbc7ffbec

SHA512
2d344ebc5924533e1e97a6e82d2c2cf5d6f70f316f3a1895f873966ae3fef6d534b90cdd7b38a092019b41006f0c9a658826f042cc324ac610307991a44ff415

Download Submit
C:\Windows\System\PbUzAdn.exe

Filesize
1.8MB

MD5
7232805f4e87b1a4dde7f05447051a0c

SHA1
fcc5f003334485b413bbf8a27ed98603110c1cbe

SHA256
ff9ee54a3783750b7b5bde760458d036b88ead9973c4a49d799c624ae878201d

SHA512
27ed96d961cf34b53f6d7657033ab7ac529bf20ed85fda2f3287ef2f70482822d317b5787c68915d464020e49da8b3e87279b656c758d3d5cf77436a9d6addf8

Download Submit
C:\Windows\System\QOocNPN.exe

Filesize
1.8MB

MD5
b795fca0f4acb61b29e70f65add02597

SHA1
e79c3271d829134735b41a9adc135511402291ed

SHA256
45ca47bae2695ac57a7c120b6de0002afebdf65bb9e3ee1218112c3ed8bf5f58

SHA512
2f84b6cfc26b2e4fae0999fafbbe92ae659dcf74aa9d9f3f9917ec1a6b61f0a07019f9d7f56592376fa82e356e636a25c46bbb3dd185075438b7539bb613e4cb

Download Submit
C:\Windows\System\QksrJUW.exe

Filesize
1.8MB

MD5
f83edcfadeb5fde574d9baa4796f2d69

SHA1
14ea70374db09f5ace0f7a6b13eb057f3f8af29a

SHA256
2f4245ad1cd5f470bb53bf63c5f985760d8783036338e13f780916fe7cb0d254

SHA512
fbea138b8128dc5d68e52dfef5054275d81940d901aaa2e4566bb4903564129ecd78a42be5be2823f287928c7cd6e1d70686834c56fe72996066ba2547ac08b2

Download Submit
C:\Windows\System\SSUmRTE.exe

Filesize
1.8MB

MD5
6a8f37df76c2143b8f15d1503aa54916

SHA1
918435e1619d871bf77beb25be6908d81d6bb90e

SHA256
bdb99ac946eece3f255829ec4bfb014edc076c8dfaf43940eeb77710cfdbe265

SHA512
aadf42b469ae433d1d22d930e14ac84a6fa72e9a5039547388b4e87331cda5fd62fcef8e722d04a3f45b42accf12adf9f9675d072f0af007b809a33d1b97e8ef

Download Submit
C:\Windows\System\VxDKTJv.exe

Filesize
1.8MB

MD5
de63a8db6bbd8968ce5812bbe47fabee

SHA1
fde7efd2acea756cf963e1de137a2eb70e12e668

SHA256
484c85ba416989624c43593e1629313aa10dc9c75063facf29048a3abec44f1a

SHA512
4eb8c0e73d14127c824c0df26befd7876844d991a4f8f59557fa44dda84eea95b03d7df7ddcf55e4eb303762c53380a21d4d576a7950fa0e64387ef71c6479b1

Download Submit
C:\Windows\System\WHmFIUy.exe

Filesize
1.8MB

MD5
8b7b54c60cee89c5505333dbb42d11c4

SHA1
fa262f1e33c464147a14eb7c2e31a8441c24cc3b

SHA256
3a9cf0ce5538a7d1ba3c2308188fd4d19984bff104e0d6e80b8b460c0dec7ad5

SHA512
4c8958c3f09a3b818450b641875741a4c82ead99835dbbd2affccd556cf3011ad9bbc79336df84e8c1082ff840a97b5a0d903f3aebadb8a72886c790565a0b75

Download Submit
C:\Windows\System\ZdeWqbi.exe

Filesize
1.8MB

MD5
575f410474f388603c0369e1e647fc40

SHA1
775aaaa3a2bb8b47da7b10dbb5fcbf6abc60b0d8

SHA256
d7abd29bab9b1f5efc0a7f8b644af2b68e9c0de672125240898bac8857f10a58

SHA512
5d49d697fcbafc6869c0fbfab5b7586ce06e118960ea435be91fdbdced450123470034c603128d0aa8aae6cd5623dcfcf1c6e37ee92bb7abe442fd58f2cbbdc2

Download Submit
C:\Windows\System\ZzRuEBy.exe

Filesize
1.8MB

MD5
d695117c5ee9d53c2b71a17dfbbfba59

SHA1
a9254a24910c8a5eb9832949a555c07a56d946bd

SHA256
cac64f9cf420ab9d626674697716c49b12192a15f6773c2fe35fe57d183a53b1

SHA512
622d53cc2f47d1b81748f444111ff5dbf86b80efc54ec75864f75858df58e95e2ab9267aad5d5baf842753585aff52fd5eadc1ad5bd671a8c6e5b387337b70c8

Download Submit
C:\Windows\System\aJSJYim.exe

Filesize
1.8MB

MD5
ed6a3113e1ada2a479e2545550eaa80e

SHA1
123d924e6435f06f71831386bd2297a15ecb49d0

SHA256
e0f98b709f6c54dd4f578285de4cff2a71d8208ff259983141bfd7b00f4470e5

SHA512
f330685a61b4b9627c51017b519324c0fa1b35a4f263a17f044cd7b4502427eab61cd4d70c70752ce9b45155295c6e8037ae538174db640963b720fd47e4f33c

Download Submit
C:\Windows\System\bvJdtuB.exe

Filesize
1.8MB

MD5
bd0c36b659dbc7f9dc12f59e20c5c44f

SHA1
db18c49d9439541eedfd445e3f6bc4b89cf758e5

SHA256
283597d6dfdaa84aa0439ecba2b5cbe5115ffb7487889fc6d57c5a2f35eb54a3

SHA512
10c70e681dc5b2f16818e249e9477ce09129a787464447e08a0a0a7dae827ce2a9f430bc7c27ffe32c04a019340b3fef32ae74f98f6cbde30c12a8fee4993201

Download Submit
C:\Windows\System\cTnxXFZ.exe

Filesize
1.8MB

MD5
e88dcf94c5fffc7636dfd8494b449cf1

SHA1
3014e3443d9b9496eb65b71f770c154ff304797e

SHA256
4e5eae3a8de4a02359a440a92fee8e591d3ff0428912b34e35fb189b50a7eabb

SHA512
33e9c4bc2e84abdaf2431e78998fd9f96dd9303a00f4d71680447bc7c417af4828a0ca3a05af779b14ab1c46085b8df3dee7a9b0cac2319fbdcce8b55d7474d2

Download Submit
C:\Windows\System\canyZuD.exe

Filesize
1.8MB

MD5
3fdd0a5e16eeb530fa0d51bc26cd723c

SHA1
d80d9990a5ff81279341efcf9307262c02fa55d2

SHA256
37e880aa3561b5521e46f50c242185bb81f20e97ee3ed1b62737650284d973a5

SHA512
8bbaf8371470217d39b03a166657a1c28e5bf79c03a5b9428fc0625629d16227016ef785482b5a595e8f69d69829703d1fc2222686cbe1e9fa14e80d773cf49b

Download Submit
C:\Windows\System\dXPQbfD.exe

Filesize
1.8MB

MD5
2909474271e31eca11c0dbb380ea48b7

SHA1
fb9e4d668fc21dbcd9219574ef224594352064d6

SHA256
11f4235e7d2a474eac79a2c40e6b3e7afb2b231b05a936b4afdba1ee55096fe7

SHA512
2e3b3313245d335d06310405b2942e72ba02b457f72fe495e439eb73a90cb91497b0e6b8ec65a41abfffbfc60462cec4c231bc3299e65c5e4fa8a4b86e3eb3d8

Download Submit
C:\Windows\System\dogHNrF.exe

Filesize
1.8MB

MD5
34b10a15e626d2b579716685fc8c500e

SHA1
6a9825d872b2f6b3ed704b476c01658a52134c13

SHA256
d386d366afe3671a61a09a67356b5c79f4c724246fefc0fef6618ecd790b8436

SHA512
6fa2be9ac9961fc00fb5cbede75f38c417ce8e02411e604b8e95459c835971774ce61e344753c371bba2e57c610a1259a84731e232543fdf23fd87c097880c01

Download Submit
C:\Windows\System\fjSbBmm.exe

Filesize
1.8MB

MD5
be5988beed32e7f59723531125872a4a

SHA1
f15869d4b56e28229beb16c173cccaa471b811ac

SHA256
83fbf96e6b9ad7699395ba14f755529aa9401f45f54673c6da6bc5108b938b61

SHA512
4b21fbe38da371dbc77e004107897a4f0a874ec4a6d85599b6e7d4317c3a49686f253b0f4c4d354a7d686b4878d895ea81e0e34ba39706419ecb83e82844ae44

Download Submit
C:\Windows\System\gfeJszW.exe

Filesize
1.8MB

MD5
4652c564a88218f942e19c58d6b45cfe

SHA1
e101f58a3188b539b50a2ff59dfa7d4269ec232f

SHA256
21eb78337069abdda51805a0dc07bd0878e3bf2ca4f3d48c5ce914404c760d0a

SHA512
c595a1b4a50a5e59137cfa7f7d5dbc709813846c3d75df3ce7adeba274bfdca11889c3f2d74f4168bb227ceb19be930362eb91d91d1a41baa21fe578408f00be

Download Submit
C:\Windows\System\hvnpjjj.exe

Filesize
1.8MB

MD5
fc60148f0e619f7da4bfcde8f379f427

SHA1
7d6322455cb7b541806bdf3a3d5752661af15878

SHA256
a88da96074caad6c6fefd27b4f887a08c493c76026b0c1564d52acfa49efd40c

SHA512
55c9c1c36a25b64e1f579c569eb282b3b97c81fdb7b3e8130ee604d2cf8eeb568b8f2d2f174e1c61619f042c704ef09639a80602c6bb35ecbae7b182dd17cd17

Download Submit
C:\Windows\System\kNAwYXB.exe

Filesize
1.8MB

MD5
1a17083e3d301833daf383c77e710fb9

SHA1
b719c96b7853246eb10cf896a5be206d8ead30dc

SHA256
36390dad8be283e647cd0da216862082b5838ffeb08466dcdeb7789a0e983517

SHA512
d1dc2e6e848df1224b2462e65e24cc05bb1bf81c2c19396d30799ef4c3e040606eef134b8dbedcb846cbaac35cfec5545730d0060a256953e78f22e9e82097a3

Download Submit
C:\Windows\System\kWYwKul.exe

Filesize
1.8MB

MD5
da8d9e82118aaada567f85f01581b46c

SHA1
401b64faa1a88c66fe680d17492a6e8724e07aae

SHA256
2f2ad3e98fbd8254de01d72f9b30a254fe15699e1f4926a66a88a489cbce4505

SHA512
fbc381572a0d09980514281a0b787f2ff9a80a72b57eb778dfef2741b6267b187648ee4bb7f6d68eb616bfeafdbc26cb1f9290249b82c076e46a2e931f9cf518

Download Submit
C:\Windows\System\maQsGCL.exe

Filesize
1.8MB

MD5
52dd6f2f8f884faf32f75753996eff52

SHA1
802f8d31c7401fa02d43cc68092c0aa8e2eb875a

SHA256
b4952dd654ba360dd8492e6bef1dcaeeb04a56cb48dfd3de0c488b43ace05569

SHA512
174bc8985f3677a93d477c22d5c3be7040033fd6dd024bd129a72fb9ecc9d600a06960794ad79a904d312e1ca72c42d96930ee1084e2b59032f8e68cc321803d

Download Submit
C:\Windows\System\nUirHJw.exe

Filesize
1.8MB

MD5
fe966b7935f3ff185aff3f69ee1bf953

SHA1
7dc25d431dee04bb3886260f39f99ac3cdb765db

SHA256
e7c53e4bd1ab7c6172e8cf76493ccb026fc22ed48e94a9224153c35e018303be

SHA512
1b77e47b1209d157332b722e477bd0ff7010a9adeef45e582c51611c3bab1b8f90fee0363841955fb1c8395ac9c0925e437b556c84ec8b519ec46e5728b9a1e0

Download Submit
C:\Windows\System\nyJKEQx.exe

Filesize
1.8MB

MD5
8345f7f381a42ddfc61bc43dd520c99e

SHA1
d4486a76c3b5d1c3849dad74e332d024b9f6cb52

SHA256
fb6534cbda9132c6a59f1bcdd7980d9685daa342bed8eb95a45eceaa2a449779

SHA512
761e2deb735a68333c48a4bbea8ee21734d08bc36d64924c7f9ff53be7c5ce5584f2509cea2574f1b9a9558d96a10d0365146cc0e527401ec3b617c41ca025a1

Download Submit
C:\Windows\System\obxSLHw.exe

Filesize
1.8MB

MD5
9d539f543f7d24c4a9cf102ae913dd59

SHA1
b41c686dee480f4d00cc58cec594ee6c2b5772be

SHA256
6e32ed82b10848f58d0a1de193d88ef96f28f70e98703cb1a32342467097500f

SHA512
6ba9ce996537a8f74edacf4d33b27772d69a589d4374138917f16de9c3475a49bae524fcd36b683560793ef71df28d04e6cd7641fdf1d9e18b26961c532b6b47

Download Submit
C:\Windows\System\qKtgBHg.exe

Filesize
1.8MB

MD5
0a7353487bb25af101b91dd21af8e578

SHA1
5d7d609d76a450b057e11d5bcd8dabcb26d97b95

SHA256
067e08ad1545ad524762be6db148959237d3c7dec542964248cd768744839764

SHA512
9a200975d257c562425fa70246f3f7ad4b05fb54791c821d1335dfab20e8ec60c61dbe6aa8cb968fdc24dc2b5b6f07d1b85298a90d181bfca6015b034227e9b9

Download Submit
C:\Windows\System\rVmVQtP.exe

Filesize
1.8MB

MD5
f8c2a299fe4c9320401cea9fb6b90aa9

SHA1
ce6316fa15236ca4215ea1f90b6b2f43bfbff5a1

SHA256
96402402099036ccaa12f279f46d25fc3c92b747b96924f87b482bf9e0ed49ab

SHA512
1bf00f8563ecc508bff2f446a80827b837fa0802a87dba3d7e444937b8f66842a97e3136169f27a8ccda806cb4f3c1c8bbc134b548b8c796371890680fe00284

Download Submit
C:\Windows\System\tLDUmGV.exe

Filesize
1.8MB

MD5
cac944f755e4db978afc1b2a5ce2bcc3

SHA1
e465882fd26aa503a339270391074e3bceaca6ee

SHA256
d22f1fa48a43b67d69e00a3938dcb3420eb95b874f48d3a570eb3c81600f37bb

SHA512
5d438012c8e37b5c92566523cedf9e229aa58d22d6e5bc83ab4030297e856c16096d55af301f6650c5614b8bd898a7dc15c2253b22e2b93980a7e61bac49f11c

Download Submit
C:\Windows\System\tvfJAIT.exe

Filesize
1.8MB

MD5
f4123c4d5f402cfea4c6ff83d2b2573b

SHA1
177bb327b1e59040e60331401e64b24e5e8b7124

SHA256
34c73f5d3368e7740f63e56e42d51837e06d889acf2690b5452027e0ffb7dc24

SHA512
34a5906e284201fe43d616b46aaf1547ac70872b7ecb4c710191175f648a8ba2c25b3820fb65a3ca2681f1c325a9ac29a4db2399341f505e3eb638dc0ad81e74

Download Submit
C:\Windows\System\vavbggS.exe

Filesize
1.8MB

MD5
a55cb4188c8a1e71ce0e115db55f308e

SHA1
f58e2d8795427dab18ea4c86f55394819bdf9846

SHA256
658af0dc4fe779b4dcc3d0bd4fb9cbb53abd515b3f557cab729b69d7dfdc02e2

SHA512
fa3f54d1e58d96869bda431fbe9061369692144511462b4c69bdfd4aae7c6ea35f0dbecb66b0d343fca76a99aea7e25a1b47ed67d39bebc0f403e1d74c5b38ab

Download Submit
C:\Windows\System\yfDhNsk.exe

Filesize
1.8MB

MD5
19ebc7a445eaf7b2b161580674d6c4ff

SHA1
5e9cc5a610e36e50ff9b0f9eb1c72f52e7a7e30a

SHA256
f6820d17631dc9fe8edbec2f936c6aa6073123c59b8354fb0eeadb3ecd081ccc

SHA512
ea6fc3eb26f5a14bfcfe6bda6f9e122c9ad04c631cca23626686063ccc37d611b7603404ac07c243cbfe091bc998c310060609990a8a65415443c4faa83c67c9

Download Submit
memory/412-3171-0x00007FF784740000-0x00007FF784B32000-memory.dmp

Filesize
3.9MB

Download
memory/412-302-0x00007FF784740000-0x00007FF784B32000-memory.dmp

Filesize
3.9MB

Download
memory/1072-3134-0x00007FF6827B0000-0x00007FF682BA2000-memory.dmp

Filesize
3.9MB

Download
memory/1072-298-0x00007FF6827B0000-0x00007FF682BA2000-memory.dmp

Filesize
3.9MB

Download
memory/1396-1-0x000001CC94A30000-0x000001CC94A40000-memory.dmp

Filesize
64KB

Download
memory/1396-0-0x00007FF679370000-0x00007FF679762000-memory.dmp

Filesize
3.9MB

Download
memory/1404-3158-0x00007FF64DC20000-0x00007FF64E012000-memory.dmp

Filesize
3.9MB

Download
memory/1404-278-0x00007FF64DC20000-0x00007FF64E012000-memory.dmp

Filesize
3.9MB

Download
memory/1512-58-0x00007FF6E7AA0000-0x00007FF6E7E92000-memory.dmp

Filesize
3.9MB

Download
memory/1512-3140-0x00007FF6E7AA0000-0x00007FF6E7E92000-memory.dmp

Filesize
3.9MB

Download
memory/1524-3160-0x00007FF6A02D0000-0x00007FF6A06C2000-memory.dmp

Filesize
3.9MB

Download
memory/1524-270-0x00007FF6A02D0000-0x00007FF6A06C2000-memory.dmp

Filesize
3.9MB

Download
memory/1572-273-0x00007FF74DAA0000-0x00007FF74DE92000-memory.dmp

Filesize
3.9MB

Download
memory/1572-3150-0x00007FF74DAA0000-0x00007FF74DE92000-memory.dmp

Filesize
3.9MB

Download
memory/1692-3193-0x00007FF7EAD10000-0x00007FF7EB102000-memory.dmp

Filesize
3.9MB

Download
memory/1692-303-0x00007FF7EAD10000-0x00007FF7EB102000-memory.dmp

Filesize
3.9MB

Download
memory/1912-294-0x00007FF733FD0000-0x00007FF7343C2000-memory.dmp

Filesize
3.9MB

Download
memory/1912-3169-0x00007FF733FD0000-0x00007FF7343C2000-memory.dmp

Filesize
3.9MB

Download
memory/2168-3178-0x00007FF6F3870000-0x00007FF6F3C62000-memory.dmp

Filesize
3.9MB

Download
memory/2168-295-0x00007FF6F3870000-0x00007FF6F3C62000-memory.dmp

Filesize
3.9MB

Download
memory/3176-131-0x00007FF6B2520000-0x00007FF6B2912000-memory.dmp

Filesize
3.9MB

Download
memory/3176-3154-0x00007FF6B2520000-0x00007FF6B2912000-memory.dmp

Filesize
3.9MB

Download
memory/3204-3144-0x00007FF71E9B0000-0x00007FF71EDA2000-memory.dmp

Filesize
3.9MB

Download
memory/3204-300-0x00007FF71E9B0000-0x00007FF71EDA2000-memory.dmp

Filesize
3.9MB

Download
memory/3244-3147-0x00007FF723E40000-0x00007FF724232000-memory.dmp

Filesize
3.9MB

Download
memory/3244-87-0x00007FF723E40000-0x00007FF724232000-memory.dmp

Filesize
3.9MB

Download
memory/3380-3149-0x00007FF6DC820000-0x00007FF6DCC12000-memory.dmp

Filesize
3.9MB

Download
memory/3380-209-0x00007FF6DC820000-0x00007FF6DCC12000-memory.dmp

Filesize
3.9MB

Download
memory/3628-228-0x00007FF6A0CA0000-0x00007FF6A1092000-memory.dmp

Filesize
3.9MB

Download
memory/3628-3157-0x00007FF6A0CA0000-0x00007FF6A1092000-memory.dmp

Filesize
3.9MB

Download
memory/3712-3142-0x00007FF703D30000-0x00007FF704122000-memory.dmp

Filesize
3.9MB

Download
memory/3712-244-0x00007FF703D30000-0x00007FF704122000-memory.dmp

Filesize
3.9MB

Download
memory/3820-3167-0x00007FF7836C0000-0x00007FF783AB2000-memory.dmp

Filesize
3.9MB

Download
memory/3820-274-0x00007FF7836C0000-0x00007FF783AB2000-memory.dmp

Filesize
3.9MB

Download
memory/3916-3181-0x00007FF632870000-0x00007FF632C62000-memory.dmp

Filesize
3.9MB

Download
memory/3916-289-0x00007FF632870000-0x00007FF632C62000-memory.dmp

Filesize
3.9MB

Download
memory/4100-3138-0x00007FF6A2DC0000-0x00007FF6A31B2000-memory.dmp

Filesize
3.9MB

Download
memory/4100-16-0x00007FF6A2DC0000-0x00007FF6A31B2000-memory.dmp

Filesize
3.9MB

Download
memory/4232-301-0x00007FF7A88B0000-0x00007FF7A8CA2000-memory.dmp

Filesize
3.9MB

Download
memory/4232-3153-0x00007FF7A88B0000-0x00007FF7A8CA2000-memory.dmp

Filesize
3.9MB

Download
memory/4316-3165-0x00007FF7DA060000-0x00007FF7DA452000-memory.dmp

Filesize
3.9MB

Download
memory/4316-174-0x00007FF7DA060000-0x00007FF7DA452000-memory.dmp

Filesize
3.9MB

Download
memory/4404-221-0x00007FF6B4A00000-0x00007FF6B4DF2000-memory.dmp

Filesize
3.9MB

Download
memory/4404-3182-0x00007FF6B4A00000-0x00007FF6B4DF2000-memory.dmp

Filesize
3.9MB

Download
memory/4652-3672-0x00007FFBA3163000-0x00007FFBA3165000-memory.dmp

Filesize
8KB

Download
memory/4652-304-0x00000227783C0000-0x0000022778B66000-memory.dmp

Filesize
7.6MB

Download
memory/4652-293-0x00007FFBA3160000-0x00007FFBA3C21000-memory.dmp

Filesize
10.8MB

Download
memory/4652-3746-0x00007FFBA3160000-0x00007FFBA3C21000-memory.dmp

Filesize
10.8MB

Download
memory/4652-299-0x00007FFBA3160000-0x00007FFBA3C21000-memory.dmp

Filesize
10.8MB

Download
memory/4652-268-0x0000022777690000-0x00000227776B2000-memory.dmp

Filesize
136KB

Download
memory/4652-17-0x00007FFBA3163000-0x00007FFBA3165000-memory.dmp

Filesize
8KB

Download
memory/4884-296-0x00007FF771D10000-0x00007FF772102000-memory.dmp

Filesize
3.9MB

Download
memory/4884-3173-0x00007FF771D10000-0x00007FF772102000-memory.dmp

Filesize
3.9MB

Download
memory/4904-3137-0x00007FF7E34E0000-0x00007FF7E38D2000-memory.dmp

Filesize
3.9MB

Download
memory/4904-37-0x00007FF7E34E0000-0x00007FF7E38D2000-memory.dmp

Filesize
3.9MB

Download
memory/5068-3175-0x00007FF7C8C20000-0x00007FF7C9012000-memory.dmp

Filesize
3.9MB

Download
memory/5068-297-0x00007FF7C8C20000-0x00007FF7C9012000-memory.dmp

Filesize
3.9MB

Download