xmrig | 62e492e965d048e995afc0968bd403ad49b1e6e0d1112ea95dcd5a19b3b5c5c3

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
28/07/2024, 00:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
Size

1.7MB
MD5

03dfc660eda1b54e31fbf4146987fcd2
SHA1

dbda8126871751580bbe5c9a65c2bfd6e8b3bbc3
SHA256

62e492e965d048e995afc0968bd403ad49b1e6e0d1112ea95dcd5a19b3b5c5c3
SHA512

b8fd445994f3fe04f43849cb77d4299221e8a7ee2183e29aa0509e6837629e20c80148f6bc23e1bf6083d02ac57e6fa5ae620c6869bd3a139ca0572854daa2e1
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWY1s38kQu12bPxvyuzaBgJ9pcFt/:Lz071uv4BPMkibTIA5I4TNrpDGK/yj

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 39 IoCs

miner

resource	yara_rule
behavioral2/memory/4740-11-0x00007FF7FAF00000-0x00007FF7FB2F2000-memory.dmp	xmrig
behavioral2/memory/2472-1561-0x00007FF75A630000-0x00007FF75AA22000-memory.dmp	xmrig
behavioral2/memory/3744-1101-0x00007FF6EB890000-0x00007FF6EBC82000-memory.dmp	xmrig
behavioral2/memory/3972-1096-0x00007FF715780000-0x00007FF715B72000-memory.dmp	xmrig
behavioral2/memory/4756-865-0x00007FF6C5CD0000-0x00007FF6C60C2000-memory.dmp	xmrig
behavioral2/memory/2364-869-0x00007FF7DE290000-0x00007FF7DE682000-memory.dmp	xmrig
behavioral2/memory/2960-709-0x00007FF662CE0000-0x00007FF6630D2000-memory.dmp	xmrig
behavioral2/memory/1988-607-0x00007FF658E20000-0x00007FF659212000-memory.dmp	xmrig
behavioral2/memory/648-605-0x00007FF6C0290000-0x00007FF6C0682000-memory.dmp	xmrig
behavioral2/memory/5112-489-0x00007FF7065D0000-0x00007FF7069C2000-memory.dmp	xmrig
behavioral2/memory/5044-393-0x00007FF7A9780000-0x00007FF7A9B72000-memory.dmp	xmrig
behavioral2/memory/3336-338-0x00007FF7971B0000-0x00007FF7975A2000-memory.dmp	xmrig
behavioral2/memory/4352-329-0x00007FF6880D0000-0x00007FF6884C2000-memory.dmp	xmrig
behavioral2/memory/3936-256-0x00007FF67F1A0000-0x00007FF67F592000-memory.dmp	xmrig
behavioral2/memory/1848-197-0x00007FF6A77D0000-0x00007FF6A7BC2000-memory.dmp	xmrig
behavioral2/memory/4032-133-0x00007FF711520000-0x00007FF711912000-memory.dmp	xmrig
behavioral2/memory/620-2607-0x00007FF702350000-0x00007FF702742000-memory.dmp	xmrig
behavioral2/memory/1460-2608-0x00007FF768100000-0x00007FF7684F2000-memory.dmp	xmrig
behavioral2/memory/3200-2609-0x00007FF626D50000-0x00007FF627142000-memory.dmp	xmrig
behavioral2/memory/4740-2611-0x00007FF7FAF00000-0x00007FF7FB2F2000-memory.dmp	xmrig
behavioral2/memory/3744-2613-0x00007FF6EB890000-0x00007FF6EBC82000-memory.dmp	xmrig
behavioral2/memory/620-2615-0x00007FF702350000-0x00007FF702742000-memory.dmp	xmrig
behavioral2/memory/4816-2650-0x00007FF6C2E40000-0x00007FF6C3232000-memory.dmp	xmrig
behavioral2/memory/3936-2657-0x00007FF67F1A0000-0x00007FF67F592000-memory.dmp	xmrig
behavioral2/memory/1848-2674-0x00007FF6A77D0000-0x00007FF6A7BC2000-memory.dmp	xmrig
behavioral2/memory/5044-2713-0x00007FF7A9780000-0x00007FF7A9B72000-memory.dmp	xmrig
behavioral2/memory/2472-2703-0x00007FF75A630000-0x00007FF75AA22000-memory.dmp	xmrig
behavioral2/memory/3336-2700-0x00007FF7971B0000-0x00007FF7975A2000-memory.dmp	xmrig
behavioral2/memory/4352-2685-0x00007FF6880D0000-0x00007FF6884C2000-memory.dmp	xmrig
behavioral2/memory/1460-2677-0x00007FF768100000-0x00007FF7684F2000-memory.dmp	xmrig
behavioral2/memory/648-2717-0x00007FF6C0290000-0x00007FF6C0682000-memory.dmp	xmrig
behavioral2/memory/2364-2735-0x00007FF7DE290000-0x00007FF7DE682000-memory.dmp	xmrig
behavioral2/memory/3972-2741-0x00007FF715780000-0x00007FF715B72000-memory.dmp	xmrig
behavioral2/memory/5112-2743-0x00007FF7065D0000-0x00007FF7069C2000-memory.dmp	xmrig
behavioral2/memory/4756-2738-0x00007FF6C5CD0000-0x00007FF6C60C2000-memory.dmp	xmrig
behavioral2/memory/1988-2731-0x00007FF658E20000-0x00007FF659212000-memory.dmp	xmrig
behavioral2/memory/2960-2676-0x00007FF662CE0000-0x00007FF6630D2000-memory.dmp	xmrig
behavioral2/memory/4032-2671-0x00007FF711520000-0x00007FF711912000-memory.dmp	xmrig
behavioral2/memory/3200-2659-0x00007FF626D50000-0x00007FF627142000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3140	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4740	VzPDmCw.exe
3744	geaQPaw.exe
620	HpSLVfl.exe
4816	LsozNqe.exe
1460	lBGkcrF.exe
2472	CXzeLcX.exe
3200	eBgJoNM.exe
4032	XFEEyuR.exe
1848	XpMluAh.exe
3936	ulMDVnf.exe
3568	pDgfdxI.exe
4352	ArGJwjZ.exe
1996	aqEVlTb.exe
3336	IYRGcco.exe
5044	LupPxnP.exe
5112	SRImuld.exe
648	ajhpkhU.exe
1988	ktcwMRb.exe
2360	VLlQQPq.exe
2960	aGllUgG.exe
3708	tlMBSTX.exe
4756	UhCXsvt.exe
2364	vljJiHb.exe
3972	fZQkPya.exe
2512	pTZAYga.exe
2300	JQqDqIq.exe
4068	copyDwc.exe
440	EhjJFAY.exe
3724	HqRmULr.exe
1724	ZoftgvJ.exe
3984	YUlTNXT.exe
4376	roInGwr.exe
4788	wElhCMn.exe
2588	AcBvyPa.exe
2420	jGdIIvw.exe
4260	KZKoFfx.exe
2700	aFgsWPb.exe
2916	jTclxxi.exe
1228	nwgtolC.exe
2384	HLIJKxp.exe
3020	Todipze.exe
2064	klhdDVE.exe
2516	tmNOjsZ.exe
816	InecgCF.exe
4672	NNBbtnt.exe
4556	qfhoQPe.exe
4044	CNvmRrJ.exe
4760	qOmWOpv.exe
5008	YGsVxgK.exe
1496	lpVUfVU.exe
4000	QUPvNLZ.exe
4288	KJGbgOx.exe
2896	PZoWuLn.exe
3440	pQrZXlM.exe
1096	YROsUfA.exe
332	ZfVNxdF.exe
4880	bawvQPR.exe
3208	xtGzMnl.exe
3356	rjOXwWS.exe
1476	BwnKYYo.exe
3416	jZstEqA.exe
1756	dHhyamB.exe
4856	KQTgPXb.exe
2744	wXoKWcJ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1572-0-0x00007FF767200000-0x00007FF7675F2000-memory.dmp	upx
behavioral2/files/0x0008000000023494-5.dat	upx
behavioral2/memory/4740-11-0x00007FF7FAF00000-0x00007FF7FB2F2000-memory.dmp	upx
behavioral2/files/0x0007000000023499-14.dat	upx
behavioral2/files/0x0007000000023498-10.dat	upx
behavioral2/files/0x000700000002349e-57.dat	upx
behavioral2/files/0x000700000002349d-54.dat	upx
behavioral2/memory/620-61-0x00007FF702350000-0x00007FF702742000-memory.dmp	upx
behavioral2/memory/4816-62-0x00007FF6C2E40000-0x00007FF6C3232000-memory.dmp	upx
behavioral2/files/0x00070000000234a0-60.dat	upx
behavioral2/files/0x000700000002349a-59.dat	upx
behavioral2/files/0x000700000002349f-58.dat	upx
behavioral2/files/0x00070000000234aa-91.dat	upx
behavioral2/files/0x00070000000234b6-182.dat	upx
behavioral2/memory/2472-1561-0x00007FF75A630000-0x00007FF75AA22000-memory.dmp	upx
behavioral2/memory/3744-1101-0x00007FF6EB890000-0x00007FF6EBC82000-memory.dmp	upx
behavioral2/memory/3972-1096-0x00007FF715780000-0x00007FF715B72000-memory.dmp	upx
behavioral2/memory/4756-865-0x00007FF6C5CD0000-0x00007FF6C60C2000-memory.dmp	upx
behavioral2/memory/2364-869-0x00007FF7DE290000-0x00007FF7DE682000-memory.dmp	upx
behavioral2/memory/2960-709-0x00007FF662CE0000-0x00007FF6630D2000-memory.dmp	upx
behavioral2/memory/1988-607-0x00007FF658E20000-0x00007FF659212000-memory.dmp	upx
behavioral2/memory/648-605-0x00007FF6C0290000-0x00007FF6C0682000-memory.dmp	upx
behavioral2/memory/5112-489-0x00007FF7065D0000-0x00007FF7069C2000-memory.dmp	upx
behavioral2/memory/5044-393-0x00007FF7A9780000-0x00007FF7A9B72000-memory.dmp	upx
behavioral2/memory/3336-338-0x00007FF7971B0000-0x00007FF7975A2000-memory.dmp	upx
behavioral2/memory/4352-329-0x00007FF6880D0000-0x00007FF6884C2000-memory.dmp	upx
behavioral2/memory/3936-256-0x00007FF67F1A0000-0x00007FF67F592000-memory.dmp	upx
behavioral2/files/0x00070000000234ab-219.dat	upx
behavioral2/files/0x00070000000234bb-215.dat	upx
behavioral2/files/0x00070000000234af-212.dat	upx
behavioral2/files/0x00070000000234ba-210.dat	upx
behavioral2/files/0x0008000000023495-208.dat	upx
behavioral2/files/0x00070000000234b9-202.dat	upx
behavioral2/memory/1848-197-0x00007FF6A77D0000-0x00007FF6A7BC2000-memory.dmp	upx
behavioral2/files/0x00070000000234b8-194.dat	upx
behavioral2/files/0x00070000000234b7-187.dat	upx
behavioral2/files/0x00070000000234a9-175.dat	upx
behavioral2/files/0x00070000000234b5-174.dat	upx
behavioral2/files/0x00070000000234b4-173.dat	upx
behavioral2/files/0x00070000000234b2-164.dat	upx
behavioral2/files/0x00070000000234a7-159.dat	upx
behavioral2/files/0x00070000000234b1-158.dat	upx
behavioral2/files/0x00080000000234a4-152.dat	upx
behavioral2/files/0x00070000000234ae-139.dat	upx
behavioral2/memory/4032-133-0x00007FF711520000-0x00007FF711912000-memory.dmp	upx
behavioral2/files/0x00070000000234b3-169.dat	upx
behavioral2/files/0x00070000000234a8-168.dat	upx
behavioral2/files/0x00070000000234ac-112.dat	upx
behavioral2/files/0x00070000000234b0-149.dat	upx
behavioral2/files/0x00080000000234a5-147.dat	upx
behavioral2/files/0x00070000000234a6-137.dat	upx
behavioral2/files/0x00070000000234ad-135.dat	upx
behavioral2/memory/3200-92-0x00007FF626D50000-0x00007FF627142000-memory.dmp	upx
behavioral2/files/0x00070000000234a2-121.dat	upx
behavioral2/files/0x00070000000234a1-116.dat	upx
behavioral2/files/0x000700000002349c-107.dat	upx
behavioral2/files/0x000700000002349b-76.dat	upx
behavioral2/files/0x00070000000234a3-73.dat	upx
behavioral2/memory/1460-71-0x00007FF768100000-0x00007FF7684F2000-memory.dmp	upx
behavioral2/memory/620-2607-0x00007FF702350000-0x00007FF702742000-memory.dmp	upx
behavioral2/memory/1460-2608-0x00007FF768100000-0x00007FF7684F2000-memory.dmp	upx
behavioral2/memory/3200-2609-0x00007FF626D50000-0x00007FF627142000-memory.dmp	upx
behavioral2/memory/4740-2611-0x00007FF7FAF00000-0x00007FF7FB2F2000-memory.dmp	upx
behavioral2/memory/3744-2613-0x00007FF6EB890000-0x00007FF6EBC82000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\pqInnvs.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\NfrOgES.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\WnpHGde.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\MsMamBo.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\rUVFYXx.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\bkXBFet.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\vJiCNNV.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\IAcgXaZ.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\fuRahRW.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\wElhCMn.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\kxvOGTm.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\vecCgMw.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\cXTFDcU.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\mUOWbPa.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\oCdQJbX.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\rjLBIpi.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\cewfgLj.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\copyDwc.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\FTFMaOf.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\BhGaMuh.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\CjPoLTB.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\DGnpRdE.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\HoQwVlD.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\sEESSRT.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\ETSpZDb.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\GPqdZqZ.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\mbjLWWs.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\jGdIIvw.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\WclHOoW.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\sQgOthp.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\jjubKlO.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\OPRmvWR.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\llhPQqW.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\GKtOcgv.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\dmietqC.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\ZKmbFHg.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\eaVcTyD.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\IVvPRMY.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\kLfjsma.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\SVavEHi.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\HBWZKMj.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\dHleDQs.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\HoYQLAt.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\gQSqcIW.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\bGqyOLy.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\pIPsVPi.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\NWjFclT.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\kNGAGvL.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\TkAPKyY.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\uLdHmQJ.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\EApSTQS.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\acjpSpS.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\fofUvwA.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\roInGwr.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\JdJGbOE.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\bwnSoVu.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\YbuDzNg.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\CWxFPSS.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\ehhwJgh.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\RGpEWMG.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\EUXUShJ.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\ktcwMRb.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\YGsVxgK.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
File created	C:\Windows\System\BLhdxjf.exe	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3140	powershell.exe
3140	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
Token: SeDebugPrivilege	3140	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 3140	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	85
PID 1572 wrote to memory of 3140	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	85
PID 1572 wrote to memory of 4740	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	86
PID 1572 wrote to memory of 4740	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	86
PID 1572 wrote to memory of 3744	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	87
PID 1572 wrote to memory of 3744	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	87
PID 1572 wrote to memory of 620	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	88
PID 1572 wrote to memory of 620	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	88
PID 1572 wrote to memory of 4816	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	89
PID 1572 wrote to memory of 4816	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	89
PID 1572 wrote to memory of 1460	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	90
PID 1572 wrote to memory of 1460	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	90
PID 1572 wrote to memory of 2472	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	91
PID 1572 wrote to memory of 2472	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	91
PID 1572 wrote to memory of 3200	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	92
PID 1572 wrote to memory of 3200	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	92
PID 1572 wrote to memory of 4032	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	93
PID 1572 wrote to memory of 4032	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	93
PID 1572 wrote to memory of 1848	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	94
PID 1572 wrote to memory of 1848	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	94
PID 1572 wrote to memory of 3936	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	95
PID 1572 wrote to memory of 3936	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	95
PID 1572 wrote to memory of 3568	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	96
PID 1572 wrote to memory of 3568	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	96
PID 1572 wrote to memory of 4352	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	97
PID 1572 wrote to memory of 4352	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	97
PID 1572 wrote to memory of 1996	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	98
PID 1572 wrote to memory of 1996	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	98
PID 1572 wrote to memory of 3336	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	99
PID 1572 wrote to memory of 3336	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	99
PID 1572 wrote to memory of 5044	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	100
PID 1572 wrote to memory of 5044	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	100
PID 1572 wrote to memory of 5112	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	101
PID 1572 wrote to memory of 5112	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	101
PID 1572 wrote to memory of 648	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	102
PID 1572 wrote to memory of 648	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	102
PID 1572 wrote to memory of 1988	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	103
PID 1572 wrote to memory of 1988	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	103
PID 1572 wrote to memory of 2512	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	104
PID 1572 wrote to memory of 2512	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	104
PID 1572 wrote to memory of 2300	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	105
PID 1572 wrote to memory of 2300	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	105
PID 1572 wrote to memory of 2360	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	106
PID 1572 wrote to memory of 2360	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	106
PID 1572 wrote to memory of 2960	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	107
PID 1572 wrote to memory of 2960	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	107
PID 1572 wrote to memory of 3708	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	108
PID 1572 wrote to memory of 3708	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	108
PID 1572 wrote to memory of 4756	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	109
PID 1572 wrote to memory of 4756	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	109
PID 1572 wrote to memory of 2364	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	110
PID 1572 wrote to memory of 2364	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	110
PID 1572 wrote to memory of 3972	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	111
PID 1572 wrote to memory of 3972	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	111
PID 1572 wrote to memory of 4068	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	112
PID 1572 wrote to memory of 4068	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	112
PID 1572 wrote to memory of 440	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	113
PID 1572 wrote to memory of 440	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	113
PID 1572 wrote to memory of 3724	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	114
PID 1572 wrote to memory of 3724	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	114
PID 1572 wrote to memory of 1724	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	115
PID 1572 wrote to memory of 1724	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	115
PID 1572 wrote to memory of 3984	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	116
PID 1572 wrote to memory of 3984	1572	03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03dfc660eda1b54e31fbf4146987fcd2_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3140
- C:\Windows\System\VzPDmCw.exe
  C:\Windows\System\VzPDmCw.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\geaQPaw.exe
  C:\Windows\System\geaQPaw.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\HpSLVfl.exe
  C:\Windows\System\HpSLVfl.exe
  2⤵
  - Executes dropped EXE
  PID:620
- C:\Windows\System\LsozNqe.exe
  C:\Windows\System\LsozNqe.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\lBGkcrF.exe
  C:\Windows\System\lBGkcrF.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\CXzeLcX.exe
  C:\Windows\System\CXzeLcX.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\eBgJoNM.exe
  C:\Windows\System\eBgJoNM.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\XFEEyuR.exe
  C:\Windows\System\XFEEyuR.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\XpMluAh.exe
  C:\Windows\System\XpMluAh.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\ulMDVnf.exe
  C:\Windows\System\ulMDVnf.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System\pDgfdxI.exe
  C:\Windows\System\pDgfdxI.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\ArGJwjZ.exe
  C:\Windows\System\ArGJwjZ.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\aqEVlTb.exe
  C:\Windows\System\aqEVlTb.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\IYRGcco.exe
  C:\Windows\System\IYRGcco.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\LupPxnP.exe
  C:\Windows\System\LupPxnP.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\SRImuld.exe
  C:\Windows\System\SRImuld.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\ajhpkhU.exe
  C:\Windows\System\ajhpkhU.exe
  2⤵
  - Executes dropped EXE
  PID:648
- C:\Windows\System\ktcwMRb.exe
  C:\Windows\System\ktcwMRb.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\pTZAYga.exe
  C:\Windows\System\pTZAYga.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\JQqDqIq.exe
  C:\Windows\System\JQqDqIq.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\VLlQQPq.exe
  C:\Windows\System\VLlQQPq.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\aGllUgG.exe
  C:\Windows\System\aGllUgG.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\tlMBSTX.exe
  C:\Windows\System\tlMBSTX.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\UhCXsvt.exe
  C:\Windows\System\UhCXsvt.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\vljJiHb.exe
  C:\Windows\System\vljJiHb.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\fZQkPya.exe
  C:\Windows\System\fZQkPya.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\copyDwc.exe
  C:\Windows\System\copyDwc.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\EhjJFAY.exe
  C:\Windows\System\EhjJFAY.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\HqRmULr.exe
  C:\Windows\System\HqRmULr.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\ZoftgvJ.exe
  C:\Windows\System\ZoftgvJ.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\YUlTNXT.exe
  C:\Windows\System\YUlTNXT.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\roInGwr.exe
  C:\Windows\System\roInGwr.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\wElhCMn.exe
  C:\Windows\System\wElhCMn.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\AcBvyPa.exe
  C:\Windows\System\AcBvyPa.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\jGdIIvw.exe
  C:\Windows\System\jGdIIvw.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\KZKoFfx.exe
  C:\Windows\System\KZKoFfx.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\aFgsWPb.exe
  C:\Windows\System\aFgsWPb.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\jTclxxi.exe
  C:\Windows\System\jTclxxi.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\nwgtolC.exe
  C:\Windows\System\nwgtolC.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\HLIJKxp.exe
  C:\Windows\System\HLIJKxp.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\Todipze.exe
  C:\Windows\System\Todipze.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\klhdDVE.exe
  C:\Windows\System\klhdDVE.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\tmNOjsZ.exe
  C:\Windows\System\tmNOjsZ.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\InecgCF.exe
  C:\Windows\System\InecgCF.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\NNBbtnt.exe
  C:\Windows\System\NNBbtnt.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\qfhoQPe.exe
  C:\Windows\System\qfhoQPe.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\CNvmRrJ.exe
  C:\Windows\System\CNvmRrJ.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\qOmWOpv.exe
  C:\Windows\System\qOmWOpv.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\YGsVxgK.exe
  C:\Windows\System\YGsVxgK.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\lpVUfVU.exe
  C:\Windows\System\lpVUfVU.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\QUPvNLZ.exe
  C:\Windows\System\QUPvNLZ.exe
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Windows\System\KJGbgOx.exe
  C:\Windows\System\KJGbgOx.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\PZoWuLn.exe
  C:\Windows\System\PZoWuLn.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\pQrZXlM.exe
  C:\Windows\System\pQrZXlM.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\YROsUfA.exe
  C:\Windows\System\YROsUfA.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\ZfVNxdF.exe
  C:\Windows\System\ZfVNxdF.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\bawvQPR.exe
  C:\Windows\System\bawvQPR.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\xtGzMnl.exe
  C:\Windows\System\xtGzMnl.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\rjOXwWS.exe
  C:\Windows\System\rjOXwWS.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\BwnKYYo.exe
  C:\Windows\System\BwnKYYo.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\jZstEqA.exe
  C:\Windows\System\jZstEqA.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\dHhyamB.exe
  C:\Windows\System\dHhyamB.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\KQTgPXb.exe
  C:\Windows\System\KQTgPXb.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\wXoKWcJ.exe
  C:\Windows\System\wXoKWcJ.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\cbCTtYA.exe
  C:\Windows\System\cbCTtYA.exe
  2⤵
  PID:1104
- C:\Windows\System\PRRKTyd.exe
  C:\Windows\System\PRRKTyd.exe
  2⤵
  PID:1792
- C:\Windows\System\nYmsmgj.exe
  C:\Windows\System\nYmsmgj.exe
  2⤵
  PID:4428
- C:\Windows\System\BYnIFKu.exe
  C:\Windows\System\BYnIFKu.exe
  2⤵
  PID:5140
- C:\Windows\System\qvzlBBQ.exe
  C:\Windows\System\qvzlBBQ.exe
  2⤵
  PID:5156
- C:\Windows\System\MsMamBo.exe
  C:\Windows\System\MsMamBo.exe
  2⤵
  PID:5176
- C:\Windows\System\UnGuzjZ.exe
  C:\Windows\System\UnGuzjZ.exe
  2⤵
  PID:5196
- C:\Windows\System\cZEvXJj.exe
  C:\Windows\System\cZEvXJj.exe
  2⤵
  PID:5220
- C:\Windows\System\JSTWwxK.exe
  C:\Windows\System\JSTWwxK.exe
  2⤵
  PID:5240
- C:\Windows\System\vAFTrjy.exe
  C:\Windows\System\vAFTrjy.exe
  2⤵
  PID:5284
- C:\Windows\System\fGdnCIQ.exe
  C:\Windows\System\fGdnCIQ.exe
  2⤵
  PID:5304
- C:\Windows\System\YJYFxvC.exe
  C:\Windows\System\YJYFxvC.exe
  2⤵
  PID:5324
- C:\Windows\System\TKAMnSj.exe
  C:\Windows\System\TKAMnSj.exe
  2⤵
  PID:5348
- C:\Windows\System\tdJqAeJ.exe
  C:\Windows\System\tdJqAeJ.exe
  2⤵
  PID:5364
- C:\Windows\System\prNSriv.exe
  C:\Windows\System\prNSriv.exe
  2⤵
  PID:5392
- C:\Windows\System\SbvGFFW.exe
  C:\Windows\System\SbvGFFW.exe
  2⤵
  PID:5416
- C:\Windows\System\sOMSMbv.exe
  C:\Windows\System\sOMSMbv.exe
  2⤵
  PID:5440
- C:\Windows\System\XxaGnpg.exe
  C:\Windows\System\XxaGnpg.exe
  2⤵
  PID:5456
- C:\Windows\System\jKmIKTH.exe
  C:\Windows\System\jKmIKTH.exe
  2⤵
  PID:5488
- C:\Windows\System\iBvvTFf.exe
  C:\Windows\System\iBvvTFf.exe
  2⤵
  PID:5512
- C:\Windows\System\BLDlrIl.exe
  C:\Windows\System\BLDlrIl.exe
  2⤵
  PID:5528
- C:\Windows\System\fOppDEF.exe
  C:\Windows\System\fOppDEF.exe
  2⤵
  PID:5552
- C:\Windows\System\NLrjSqj.exe
  C:\Windows\System\NLrjSqj.exe
  2⤵
  PID:5572
- C:\Windows\System\JMZfohc.exe
  C:\Windows\System\JMZfohc.exe
  2⤵
  PID:5592
- C:\Windows\System\IVvPRMY.exe
  C:\Windows\System\IVvPRMY.exe
  2⤵
  PID:5612
- C:\Windows\System\BLhdxjf.exe
  C:\Windows\System\BLhdxjf.exe
  2⤵
  PID:5632
- C:\Windows\System\LOqzncZ.exe
  C:\Windows\System\LOqzncZ.exe
  2⤵
  PID:5652
- C:\Windows\System\zCGKLIA.exe
  C:\Windows\System\zCGKLIA.exe
  2⤵
  PID:5680
- C:\Windows\System\stftciP.exe
  C:\Windows\System\stftciP.exe
  2⤵
  PID:5700
- C:\Windows\System\wcklKdJ.exe
  C:\Windows\System\wcklKdJ.exe
  2⤵
  PID:5720
- C:\Windows\System\YLVboNt.exe
  C:\Windows\System\YLVboNt.exe
  2⤵
  PID:5764
- C:\Windows\System\zMgXveB.exe
  C:\Windows\System\zMgXveB.exe
  2⤵
  PID:5792
- C:\Windows\System\BUjjcvC.exe
  C:\Windows\System\BUjjcvC.exe
  2⤵
  PID:5812
- C:\Windows\System\GJcYWkP.exe
  C:\Windows\System\GJcYWkP.exe
  2⤵
  PID:5844
- C:\Windows\System\CdpMFRJ.exe
  C:\Windows\System\CdpMFRJ.exe
  2⤵
  PID:5864
- C:\Windows\System\VdzTLrs.exe
  C:\Windows\System\VdzTLrs.exe
  2⤵
  PID:5880
- C:\Windows\System\bpqRRAU.exe
  C:\Windows\System\bpqRRAU.exe
  2⤵
  PID:5904
- C:\Windows\System\XryjqOG.exe
  C:\Windows\System\XryjqOG.exe
  2⤵
  PID:5928
- C:\Windows\System\AXepYeI.exe
  C:\Windows\System\AXepYeI.exe
  2⤵
  PID:5952
- C:\Windows\System\ObgPTqf.exe
  C:\Windows\System\ObgPTqf.exe
  2⤵
  PID:5980
- C:\Windows\System\gSduzfU.exe
  C:\Windows\System\gSduzfU.exe
  2⤵
  PID:5996
- C:\Windows\System\eKfJeFZ.exe
  C:\Windows\System\eKfJeFZ.exe
  2⤵
  PID:6020
- C:\Windows\System\HrjiqOG.exe
  C:\Windows\System\HrjiqOG.exe
  2⤵
  PID:6036
- C:\Windows\System\jGoLdsz.exe
  C:\Windows\System\jGoLdsz.exe
  2⤵
  PID:6056
- C:\Windows\System\EeIQuLx.exe
  C:\Windows\System\EeIQuLx.exe
  2⤵
  PID:6080
- C:\Windows\System\ilgwoQQ.exe
  C:\Windows\System\ilgwoQQ.exe
  2⤵
  PID:6100
- C:\Windows\System\ygAAeWs.exe
  C:\Windows\System\ygAAeWs.exe
  2⤵
  PID:6120
- C:\Windows\System\biybfce.exe
  C:\Windows\System\biybfce.exe
  2⤵
  PID:2460
- C:\Windows\System\GRGXcmv.exe
  C:\Windows\System\GRGXcmv.exe
  2⤵
  PID:2696
- C:\Windows\System\DoiSehG.exe
  C:\Windows\System\DoiSehG.exe
  2⤵
  PID:4396
- C:\Windows\System\kxvOGTm.exe
  C:\Windows\System\kxvOGTm.exe
  2⤵
  PID:1608
- C:\Windows\System\JpFIQvd.exe
  C:\Windows\System\JpFIQvd.exe
  2⤵
  PID:1976
- C:\Windows\System\fLvMPjz.exe
  C:\Windows\System\fLvMPjz.exe
  2⤵
  PID:4240
- C:\Windows\System\rvdnpye.exe
  C:\Windows\System\rvdnpye.exe
  2⤵
  PID:2952
- C:\Windows\System\oEtFZop.exe
  C:\Windows\System\oEtFZop.exe
  2⤵
  PID:5412
- C:\Windows\System\VKXMYNg.exe
  C:\Windows\System\VKXMYNg.exe
  2⤵
  PID:3332
- C:\Windows\System\oAMsUPT.exe
  C:\Windows\System\oAMsUPT.exe
  2⤵
  PID:5524
- C:\Windows\System\MOMVjUU.exe
  C:\Windows\System\MOMVjUU.exe
  2⤵
  PID:5564
- C:\Windows\System\CUopCdR.exe
  C:\Windows\System\CUopCdR.exe
  2⤵
  PID:4752
- C:\Windows\System\XDOmCiG.exe
  C:\Windows\System\XDOmCiG.exe
  2⤵
  PID:1500
- C:\Windows\System\PdCarKV.exe
  C:\Windows\System\PdCarKV.exe
  2⤵
  PID:1672
- C:\Windows\System\sMVTPKG.exe
  C:\Windows\System\sMVTPKG.exe
  2⤵
  PID:4304
- C:\Windows\System\zrlFUlc.exe
  C:\Windows\System\zrlFUlc.exe
  2⤵
  PID:5168
- C:\Windows\System\QxlCtSQ.exe
  C:\Windows\System\QxlCtSQ.exe
  2⤵
  PID:5048
- C:\Windows\System\zyCHeEy.exe
  C:\Windows\System\zyCHeEy.exe
  2⤵
  PID:5920
- C:\Windows\System\oCnSjoZ.exe
  C:\Windows\System\oCnSjoZ.exe
  2⤵
  PID:5332
- C:\Windows\System\MrFbBYA.exe
  C:\Windows\System\MrFbBYA.exe
  2⤵
  PID:4460
- C:\Windows\System\ubaZtPs.exe
  C:\Windows\System\ubaZtPs.exe
  2⤵
  PID:2964
- C:\Windows\System\DlyYmlX.exe
  C:\Windows\System\DlyYmlX.exe
  2⤵
  PID:6152
- C:\Windows\System\SgMeyyj.exe
  C:\Windows\System\SgMeyyj.exe
  2⤵
  PID:6176
- C:\Windows\System\ccIKrjA.exe
  C:\Windows\System\ccIKrjA.exe
  2⤵
  PID:6212
- C:\Windows\System\WBThezM.exe
  C:\Windows\System\WBThezM.exe
  2⤵
  PID:6228
- C:\Windows\System\OpSHjvd.exe
  C:\Windows\System\OpSHjvd.exe
  2⤵
  PID:6252
- C:\Windows\System\lDfjMCt.exe
  C:\Windows\System\lDfjMCt.exe
  2⤵
  PID:6280
- C:\Windows\System\JhwsrGz.exe
  C:\Windows\System\JhwsrGz.exe
  2⤵
  PID:6296
- C:\Windows\System\zFCwXfQ.exe
  C:\Windows\System\zFCwXfQ.exe
  2⤵
  PID:6320
- C:\Windows\System\ZDqwjbi.exe
  C:\Windows\System\ZDqwjbi.exe
  2⤵
  PID:6336
- C:\Windows\System\gDsyNNk.exe
  C:\Windows\System\gDsyNNk.exe
  2⤵
  PID:6360
- C:\Windows\System\OBBdnSM.exe
  C:\Windows\System\OBBdnSM.exe
  2⤵
  PID:6380
- C:\Windows\System\flsIIbI.exe
  C:\Windows\System\flsIIbI.exe
  2⤵
  PID:6404
- C:\Windows\System\AngZduv.exe
  C:\Windows\System\AngZduv.exe
  2⤵
  PID:6420
- C:\Windows\System\YcePtHq.exe
  C:\Windows\System\YcePtHq.exe
  2⤵
  PID:6440
- C:\Windows\System\LDxFOob.exe
  C:\Windows\System\LDxFOob.exe
  2⤵
  PID:6464
- C:\Windows\System\vdgmymq.exe
  C:\Windows\System\vdgmymq.exe
  2⤵
  PID:6492
- C:\Windows\System\uPfrdvv.exe
  C:\Windows\System\uPfrdvv.exe
  2⤵
  PID:6516
- C:\Windows\System\rwKxEsr.exe
  C:\Windows\System\rwKxEsr.exe
  2⤵
  PID:6532
- C:\Windows\System\cnmEbhB.exe
  C:\Windows\System\cnmEbhB.exe
  2⤵
  PID:6560
- C:\Windows\System\vrOtiPv.exe
  C:\Windows\System\vrOtiPv.exe
  2⤵
  PID:6576
- C:\Windows\System\vvfYZCT.exe
  C:\Windows\System\vvfYZCT.exe
  2⤵
  PID:6616
- C:\Windows\System\RmzryGQ.exe
  C:\Windows\System\RmzryGQ.exe
  2⤵
  PID:6640
- C:\Windows\System\WmYWHCH.exe
  C:\Windows\System\WmYWHCH.exe
  2⤵
  PID:6656
- C:\Windows\System\NOtmikq.exe
  C:\Windows\System\NOtmikq.exe
  2⤵
  PID:6676
- C:\Windows\System\KpkxbTk.exe
  C:\Windows\System\KpkxbTk.exe
  2⤵
  PID:6696
- C:\Windows\System\vecCgMw.exe
  C:\Windows\System\vecCgMw.exe
  2⤵
  PID:6728
- C:\Windows\System\rUVFYXx.exe
  C:\Windows\System\rUVFYXx.exe
  2⤵
  PID:6744
- C:\Windows\System\HILQora.exe
  C:\Windows\System\HILQora.exe
  2⤵
  PID:6768
- C:\Windows\System\tywNEff.exe
  C:\Windows\System\tywNEff.exe
  2⤵
  PID:6792
- C:\Windows\System\llErujg.exe
  C:\Windows\System\llErujg.exe
  2⤵
  PID:6808
- C:\Windows\System\NYuaYaj.exe
  C:\Windows\System\NYuaYaj.exe
  2⤵
  PID:6836
- C:\Windows\System\YrIuuQt.exe
  C:\Windows\System\YrIuuQt.exe
  2⤵
  PID:6852
- C:\Windows\System\dheVnYR.exe
  C:\Windows\System\dheVnYR.exe
  2⤵
  PID:6880
- C:\Windows\System\bmNYVQE.exe
  C:\Windows\System\bmNYVQE.exe
  2⤵
  PID:6900
- C:\Windows\System\cZgFUMQ.exe
  C:\Windows\System\cZgFUMQ.exe
  2⤵
  PID:6936
- C:\Windows\System\jYeryhI.exe
  C:\Windows\System\jYeryhI.exe
  2⤵
  PID:6952
- C:\Windows\System\pqInnvs.exe
  C:\Windows\System\pqInnvs.exe
  2⤵
  PID:6968
- C:\Windows\System\ELLWAjG.exe
  C:\Windows\System\ELLWAjG.exe
  2⤵
  PID:6988
- C:\Windows\System\mYrcwzP.exe
  C:\Windows\System\mYrcwzP.exe
  2⤵
  PID:7008
- C:\Windows\System\GYGmrvS.exe
  C:\Windows\System\GYGmrvS.exe
  2⤵
  PID:7032
- C:\Windows\System\pnWjGaw.exe
  C:\Windows\System\pnWjGaw.exe
  2⤵
  PID:7052
- C:\Windows\System\BpYXCBA.exe
  C:\Windows\System\BpYXCBA.exe
  2⤵
  PID:7080
- C:\Windows\System\FeCohGp.exe
  C:\Windows\System\FeCohGp.exe
  2⤵
  PID:7104
- C:\Windows\System\EHEFLpe.exe
  C:\Windows\System\EHEFLpe.exe
  2⤵
  PID:7124
- C:\Windows\System\AyzwYhH.exe
  C:\Windows\System\AyzwYhH.exe
  2⤵
  PID:7144
- C:\Windows\System\WAOJsZo.exe
  C:\Windows\System\WAOJsZo.exe
  2⤵
  PID:3248
- C:\Windows\System\mdZuqKb.exe
  C:\Windows\System\mdZuqKb.exe
  2⤵
  PID:5536
- C:\Windows\System\cAYANRG.exe
  C:\Windows\System\cAYANRG.exe
  2⤵
  PID:548
- C:\Windows\System\JdJGbOE.exe
  C:\Windows\System\JdJGbOE.exe
  2⤵
  PID:2832
- C:\Windows\System\ZBMYEfz.exe
  C:\Windows\System\ZBMYEfz.exe
  2⤵
  PID:5500
- C:\Windows\System\KdECSuE.exe
  C:\Windows\System\KdECSuE.exe
  2⤵
  PID:3960
- C:\Windows\System\RWnFOIi.exe
  C:\Windows\System\RWnFOIi.exe
  2⤵
  PID:5280
- C:\Windows\System\XgJGgrL.exe
  C:\Windows\System\XgJGgrL.exe
  2⤵
  PID:2044
- C:\Windows\System\ATbAdib.exe
  C:\Windows\System\ATbAdib.exe
  2⤵
  PID:632
- C:\Windows\System\zyLoInt.exe
  C:\Windows\System\zyLoInt.exe
  2⤵
  PID:4700
- C:\Windows\System\gUdiqJR.exe
  C:\Windows\System\gUdiqJR.exe
  2⤵
  PID:5376
- C:\Windows\System\nJSCyBF.exe
  C:\Windows\System\nJSCyBF.exe
  2⤵
  PID:5028
- C:\Windows\System\WclHOoW.exe
  C:\Windows\System\WclHOoW.exe
  2⤵
  PID:5424
- C:\Windows\System\cXTFDcU.exe
  C:\Windows\System\cXTFDcU.exe
  2⤵
  PID:6160
- C:\Windows\System\JYNwvxg.exe
  C:\Windows\System\JYNwvxg.exe
  2⤵
  PID:4560
- C:\Windows\System\FUuepkq.exe
  C:\Windows\System\FUuepkq.exe
  2⤵
  PID:6208
- C:\Windows\System\ZrzrSxu.exe
  C:\Windows\System\ZrzrSxu.exe
  2⤵
  PID:5520
- C:\Windows\System\GPNwIii.exe
  C:\Windows\System\GPNwIii.exe
  2⤵
  PID:6316
- C:\Windows\System\iBNuyQU.exe
  C:\Windows\System\iBNuyQU.exe
  2⤵
  PID:6108
- C:\Windows\System\ebekWxO.exe
  C:\Windows\System\ebekWxO.exe
  2⤵
  PID:5640
- C:\Windows\System\fSdKLsU.exe
  C:\Windows\System\fSdKLsU.exe
  2⤵
  PID:892
- C:\Windows\System\EPnKEuh.exe
  C:\Windows\System\EPnKEuh.exe
  2⤵
  PID:5676
- C:\Windows\System\NeEURrK.exe
  C:\Windows\System\NeEURrK.exe
  2⤵
  PID:3736
- C:\Windows\System\GOejvxi.exe
  C:\Windows\System\GOejvxi.exe
  2⤵
  PID:5756
- C:\Windows\System\IScmAvI.exe
  C:\Windows\System\IScmAvI.exe
  2⤵
  PID:5856
- C:\Windows\System\NJCbmGH.exe
  C:\Windows\System\NJCbmGH.exe
  2⤵
  PID:5820
- C:\Windows\System\RYxLmEt.exe
  C:\Windows\System\RYxLmEt.exe
  2⤵
  PID:7192
- C:\Windows\System\klPayka.exe
  C:\Windows\System\klPayka.exe
  2⤵
  PID:7228
- C:\Windows\System\PtvBnsW.exe
  C:\Windows\System\PtvBnsW.exe
  2⤵
  PID:7248
- C:\Windows\System\iLZoYKU.exe
  C:\Windows\System\iLZoYKU.exe
  2⤵
  PID:7272
- C:\Windows\System\qQDzxHl.exe
  C:\Windows\System\qQDzxHl.exe
  2⤵
  PID:7300
- C:\Windows\System\rEcNrVK.exe
  C:\Windows\System\rEcNrVK.exe
  2⤵
  PID:7316
- C:\Windows\System\uZRJrTc.exe
  C:\Windows\System\uZRJrTc.exe
  2⤵
  PID:7340
- C:\Windows\System\jkKESIc.exe
  C:\Windows\System\jkKESIc.exe
  2⤵
  PID:7356
- C:\Windows\System\jPdIyoz.exe
  C:\Windows\System\jPdIyoz.exe
  2⤵
  PID:7380
- C:\Windows\System\kbhefxm.exe
  C:\Windows\System\kbhefxm.exe
  2⤵
  PID:7400
- C:\Windows\System\RRXAJVe.exe
  C:\Windows\System\RRXAJVe.exe
  2⤵
  PID:7424
- C:\Windows\System\PSOddxS.exe
  C:\Windows\System\PSOddxS.exe
  2⤵
  PID:7440
- C:\Windows\System\CjOkQHi.exe
  C:\Windows\System\CjOkQHi.exe
  2⤵
  PID:7464
- C:\Windows\System\zxctitn.exe
  C:\Windows\System\zxctitn.exe
  2⤵
  PID:7488
- C:\Windows\System\qOMHxUN.exe
  C:\Windows\System\qOMHxUN.exe
  2⤵
  PID:7512
- C:\Windows\System\LWRTvDI.exe
  C:\Windows\System\LWRTvDI.exe
  2⤵
  PID:7532
- C:\Windows\System\SVVGqBL.exe
  C:\Windows\System\SVVGqBL.exe
  2⤵
  PID:7548
- C:\Windows\System\KeLbhXd.exe
  C:\Windows\System\KeLbhXd.exe
  2⤵
  PID:7572
- C:\Windows\System\oXRKDQR.exe
  C:\Windows\System\oXRKDQR.exe
  2⤵
  PID:7588
- C:\Windows\System\xwxQVvs.exe
  C:\Windows\System\xwxQVvs.exe
  2⤵
  PID:7608
- C:\Windows\System\hFoPTqg.exe
  C:\Windows\System\hFoPTqg.exe
  2⤵
  PID:7624
- C:\Windows\System\FrCCNfD.exe
  C:\Windows\System\FrCCNfD.exe
  2⤵
  PID:7648
- C:\Windows\System\BbMPkKB.exe
  C:\Windows\System\BbMPkKB.exe
  2⤵
  PID:7672
- C:\Windows\System\iFCJGRF.exe
  C:\Windows\System\iFCJGRF.exe
  2⤵
  PID:7688
- C:\Windows\System\NcdtKVZ.exe
  C:\Windows\System\NcdtKVZ.exe
  2⤵
  PID:7704
- C:\Windows\System\BGQaVve.exe
  C:\Windows\System\BGQaVve.exe
  2⤵
  PID:7732
- C:\Windows\System\BokSsvp.exe
  C:\Windows\System\BokSsvp.exe
  2⤵
  PID:7752
- C:\Windows\System\MaHxVGy.exe
  C:\Windows\System\MaHxVGy.exe
  2⤵
  PID:7768
- C:\Windows\System\UtGBdna.exe
  C:\Windows\System\UtGBdna.exe
  2⤵
  PID:7792
- C:\Windows\System\VpHffLL.exe
  C:\Windows\System\VpHffLL.exe
  2⤵
  PID:7816
- C:\Windows\System\ERhiKEH.exe
  C:\Windows\System\ERhiKEH.exe
  2⤵
  PID:7840
- C:\Windows\System\CqNIhfF.exe
  C:\Windows\System\CqNIhfF.exe
  2⤵
  PID:7856
- C:\Windows\System\DRtRHmo.exe
  C:\Windows\System\DRtRHmo.exe
  2⤵
  PID:7880
- C:\Windows\System\XhRcRIs.exe
  C:\Windows\System\XhRcRIs.exe
  2⤵
  PID:7896
- C:\Windows\System\vLTmwDi.exe
  C:\Windows\System\vLTmwDi.exe
  2⤵
  PID:7924
- C:\Windows\System\jrsFcyE.exe
  C:\Windows\System\jrsFcyE.exe
  2⤵
  PID:7940
- C:\Windows\System\jsJxuJq.exe
  C:\Windows\System\jsJxuJq.exe
  2⤵
  PID:7960
- C:\Windows\System\dhdalBR.exe
  C:\Windows\System\dhdalBR.exe
  2⤵
  PID:7976
- C:\Windows\System\CdEKiqC.exe
  C:\Windows\System\CdEKiqC.exe
  2⤵
  PID:7996
- C:\Windows\System\ZfuERLY.exe
  C:\Windows\System\ZfuERLY.exe
  2⤵
  PID:8048
- C:\Windows\System\NNzhzky.exe
  C:\Windows\System\NNzhzky.exe
  2⤵
  PID:8068
- C:\Windows\System\jsIbCDN.exe
  C:\Windows\System\jsIbCDN.exe
  2⤵
  PID:8132
- C:\Windows\System\xZraUQV.exe
  C:\Windows\System\xZraUQV.exe
  2⤵
  PID:8156
- C:\Windows\System\RKPnxIC.exe
  C:\Windows\System\RKPnxIC.exe
  2⤵
  PID:8172
- C:\Windows\System\jSqzQZh.exe
  C:\Windows\System\jSqzQZh.exe
  2⤵
  PID:5876
- C:\Windows\System\aatCaQl.exe
  C:\Windows\System\aatCaQl.exe
  2⤵
  PID:6780
- C:\Windows\System\NhNdmAm.exe
  C:\Windows\System\NhNdmAm.exe
  2⤵
  PID:6844
- C:\Windows\System\QglecDh.exe
  C:\Windows\System\QglecDh.exe
  2⤵
  PID:6872
- C:\Windows\System\VYgiTYv.exe
  C:\Windows\System\VYgiTYv.exe
  2⤵
  PID:6912
- C:\Windows\System\RmojwuS.exe
  C:\Windows\System\RmojwuS.exe
  2⤵
  PID:5960
- C:\Windows\System\ziOnSpY.exe
  C:\Windows\System\ziOnSpY.exe
  2⤵
  PID:7004
- C:\Windows\System\QrRqysR.exe
  C:\Windows\System\QrRqysR.exe
  2⤵
  PID:6168
- C:\Windows\System\HzvwQEQ.exe
  C:\Windows\System\HzvwQEQ.exe
  2⤵
  PID:6064
- C:\Windows\System\lIdJwxB.exe
  C:\Windows\System\lIdJwxB.exe
  2⤵
  PID:7116
- C:\Windows\System\gtdugRj.exe
  C:\Windows\System\gtdugRj.exe
  2⤵
  PID:7136
- C:\Windows\System\JEkGqvk.exe
  C:\Windows\System\JEkGqvk.exe
  2⤵
  PID:7164
- C:\Windows\System\JdoitZL.exe
  C:\Windows\System\JdoitZL.exe
  2⤵
  PID:4228
- C:\Windows\System\ueluhmh.exe
  C:\Windows\System\ueluhmh.exe
  2⤵
  PID:5136
- C:\Windows\System\UDOVZfL.exe
  C:\Windows\System\UDOVZfL.exe
  2⤵
  PID:6392
- C:\Windows\System\zdhyifY.exe
  C:\Windows\System\zdhyifY.exe
  2⤵
  PID:6412
- C:\Windows\System\pknMULE.exe
  C:\Windows\System\pknMULE.exe
  2⤵
  PID:6428
- C:\Windows\System\pXJzsYK.exe
  C:\Windows\System\pXJzsYK.exe
  2⤵
  PID:5496
- C:\Windows\System\ZuQGPgj.exe
  C:\Windows\System\ZuQGPgj.exe
  2⤵
  PID:6092
- C:\Windows\System\BphYBZO.exe
  C:\Windows\System\BphYBZO.exe
  2⤵
  PID:6484
- C:\Windows\System\GqfJWxs.exe
  C:\Windows\System\GqfJWxs.exe
  2⤵
  PID:6128
- C:\Windows\System\ozlpJiC.exe
  C:\Windows\System\ozlpJiC.exe
  2⤵
  PID:5360
- C:\Windows\System\JBfIeYx.exe
  C:\Windows\System\JBfIeYx.exe
  2⤵
  PID:4684
- C:\Windows\System\ejVaJjP.exe
  C:\Windows\System\ejVaJjP.exe
  2⤵
  PID:5748
- C:\Windows\System\FTFMaOf.exe
  C:\Windows\System\FTFMaOf.exe
  2⤵
  PID:5832
- C:\Windows\System\unTsvFn.exe
  C:\Windows\System\unTsvFn.exe
  2⤵
  PID:2504
- C:\Windows\System\dSCYkSe.exe
  C:\Windows\System\dSCYkSe.exe
  2⤵
  PID:7244
- C:\Windows\System\xmpNoXR.exe
  C:\Windows\System\xmpNoXR.exe
  2⤵
  PID:6948
- C:\Windows\System\ugqiuDq.exe
  C:\Windows\System\ugqiuDq.exe
  2⤵
  PID:7388
- C:\Windows\System\vVScfdq.exe
  C:\Windows\System\vVScfdq.exe
  2⤵
  PID:7432
- C:\Windows\System\nxzjHPU.exe
  C:\Windows\System\nxzjHPU.exe
  2⤵
  PID:7472
- C:\Windows\System\AwZFhOd.exe
  C:\Windows\System\AwZFhOd.exe
  2⤵
  PID:1768
- C:\Windows\System\bkXBFet.exe
  C:\Windows\System\bkXBFet.exe
  2⤵
  PID:2356
- C:\Windows\System\FxMetIO.exe
  C:\Windows\System\FxMetIO.exe
  2⤵
  PID:6352
- C:\Windows\System\zSqdclv.exe
  C:\Windows\System\zSqdclv.exe
  2⤵
  PID:5484
- C:\Windows\System\xaUVFbe.exe
  C:\Windows\System\xaUVFbe.exe
  2⤵
  PID:7684
- C:\Windows\System\WyMlDrF.exe
  C:\Windows\System\WyMlDrF.exe
  2⤵
  PID:7780
- C:\Windows\System\uPgLiyO.exe
  C:\Windows\System\uPgLiyO.exe
  2⤵
  PID:7848
- C:\Windows\System\dHleDQs.exe
  C:\Windows\System\dHleDQs.exe
  2⤵
  PID:6452
- C:\Windows\System\LvxOXDF.exe
  C:\Windows\System\LvxOXDF.exe
  2⤵
  PID:8212
- C:\Windows\System\Tajfewa.exe
  C:\Windows\System\Tajfewa.exe
  2⤵
  PID:8236
- C:\Windows\System\zfQHacs.exe
  C:\Windows\System\zfQHacs.exe
  2⤵
  PID:8264
- C:\Windows\System\alZpOya.exe
  C:\Windows\System\alZpOya.exe
  2⤵
  PID:8284
- C:\Windows\System\wakmAHv.exe
  C:\Windows\System\wakmAHv.exe
  2⤵
  PID:8304
- C:\Windows\System\WTObnbC.exe
  C:\Windows\System\WTObnbC.exe
  2⤵
  PID:8320
- C:\Windows\System\JQzthcj.exe
  C:\Windows\System\JQzthcj.exe
  2⤵
  PID:8340
- C:\Windows\System\ngzbpqD.exe
  C:\Windows\System\ngzbpqD.exe
  2⤵
  PID:8364
- C:\Windows\System\iVlAspq.exe
  C:\Windows\System\iVlAspq.exe
  2⤵
  PID:8396
- C:\Windows\System\vrksyLZ.exe
  C:\Windows\System\vrksyLZ.exe
  2⤵
  PID:8432
- C:\Windows\System\MnbutJv.exe
  C:\Windows\System\MnbutJv.exe
  2⤵
  PID:8456
- C:\Windows\System\JnJnTfs.exe
  C:\Windows\System\JnJnTfs.exe
  2⤵
  PID:8476
- C:\Windows\System\TBxapxL.exe
  C:\Windows\System\TBxapxL.exe
  2⤵
  PID:8500
- C:\Windows\System\gAbDjCJ.exe
  C:\Windows\System\gAbDjCJ.exe
  2⤵
  PID:8520
- C:\Windows\System\hvWOLoU.exe
  C:\Windows\System\hvWOLoU.exe
  2⤵
  PID:8544
- C:\Windows\System\phPJYxK.exe
  C:\Windows\System\phPJYxK.exe
  2⤵
  PID:8568
- C:\Windows\System\cXHBkrJ.exe
  C:\Windows\System\cXHBkrJ.exe
  2⤵
  PID:8596
- C:\Windows\System\vhYrsMS.exe
  C:\Windows\System\vhYrsMS.exe
  2⤵
  PID:8612
- C:\Windows\System\NkjOPRd.exe
  C:\Windows\System\NkjOPRd.exe
  2⤵
  PID:8636
- C:\Windows\System\UmToGPw.exe
  C:\Windows\System\UmToGPw.exe
  2⤵
  PID:8652
- C:\Windows\System\WFEjDzV.exe
  C:\Windows\System\WFEjDzV.exe
  2⤵
  PID:8672
- C:\Windows\System\tRKpfrx.exe
  C:\Windows\System\tRKpfrx.exe
  2⤵
  PID:8692
- C:\Windows\System\LIChEDn.exe
  C:\Windows\System\LIChEDn.exe
  2⤵
  PID:8712
- C:\Windows\System\xUtaZDW.exe
  C:\Windows\System\xUtaZDW.exe
  2⤵
  PID:8728
- C:\Windows\System\GNvPRXS.exe
  C:\Windows\System\GNvPRXS.exe
  2⤵
  PID:8752
- C:\Windows\System\KfaWkFp.exe
  C:\Windows\System\KfaWkFp.exe
  2⤵
  PID:8780
- C:\Windows\System\DsGDNVp.exe
  C:\Windows\System\DsGDNVp.exe
  2⤵
  PID:8800
- C:\Windows\System\MEYfzIi.exe
  C:\Windows\System\MEYfzIi.exe
  2⤵
  PID:8832
- C:\Windows\System\rPBoEyw.exe
  C:\Windows\System\rPBoEyw.exe
  2⤵
  PID:8848
- C:\Windows\System\NjMpAYS.exe
  C:\Windows\System\NjMpAYS.exe
  2⤵
  PID:8864
- C:\Windows\System\oAkpVuj.exe
  C:\Windows\System\oAkpVuj.exe
  2⤵
  PID:8884
- C:\Windows\System\TXWiXoQ.exe
  C:\Windows\System\TXWiXoQ.exe
  2⤵
  PID:8904
- C:\Windows\System\ChzJzEF.exe
  C:\Windows\System\ChzJzEF.exe
  2⤵
  PID:8928
- C:\Windows\System\uLLlYhY.exe
  C:\Windows\System\uLLlYhY.exe
  2⤵
  PID:8948
- C:\Windows\System\FrloQmp.exe
  C:\Windows\System\FrloQmp.exe
  2⤵
  PID:8968
- C:\Windows\System\TPSzNPg.exe
  C:\Windows\System\TPSzNPg.exe
  2⤵
  PID:9000
- C:\Windows\System\CNByXfi.exe
  C:\Windows\System\CNByXfi.exe
  2⤵
  PID:9016
- C:\Windows\System\PwXahsL.exe
  C:\Windows\System\PwXahsL.exe
  2⤵
  PID:9036
- C:\Windows\System\neCNzvI.exe
  C:\Windows\System\neCNzvI.exe
  2⤵
  PID:9052
- C:\Windows\System\bKbXcaB.exe
  C:\Windows\System\bKbXcaB.exe
  2⤵
  PID:9080
- C:\Windows\System\lqHNFgF.exe
  C:\Windows\System\lqHNFgF.exe
  2⤵
  PID:9096
- C:\Windows\System\mOEyRUL.exe
  C:\Windows\System\mOEyRUL.exe
  2⤵
  PID:9116
- C:\Windows\System\USdiyQD.exe
  C:\Windows\System\USdiyQD.exe
  2⤵
  PID:9136
- C:\Windows\System\OHNwxuL.exe
  C:\Windows\System\OHNwxuL.exe
  2⤵
  PID:9152
- C:\Windows\System\bGqyOLy.exe
  C:\Windows\System\bGqyOLy.exe
  2⤵
  PID:9172
- C:\Windows\System\yWxXzzR.exe
  C:\Windows\System\yWxXzzR.exe
  2⤵
  PID:9196
- C:\Windows\System\ONumOAO.exe
  C:\Windows\System\ONumOAO.exe
  2⤵
  PID:6304
- C:\Windows\System\KLjqGFG.exe
  C:\Windows\System\KLjqGFG.exe
  2⤵
  PID:64
- C:\Windows\System\EixYYIv.exe
  C:\Windows\System\EixYYIv.exe
  2⤵
  PID:6552
- C:\Windows\System\uLdHmQJ.exe
  C:\Windows\System\uLdHmQJ.exe
  2⤵
  PID:6612
- C:\Windows\System\bwnSoVu.exe
  C:\Windows\System\bwnSoVu.exe
  2⤵
  PID:6664
- C:\Windows\System\knsxIQI.exe
  C:\Windows\System\knsxIQI.exe
  2⤵
  PID:6688
- C:\Windows\System\MwDjOoa.exe
  C:\Windows\System\MwDjOoa.exe
  2⤵
  PID:5624
- C:\Windows\System\IbbosDT.exe
  C:\Windows\System\IbbosDT.exe
  2⤵
  PID:7240
- C:\Windows\System\vDsLTEx.exe
  C:\Windows\System\vDsLTEx.exe
  2⤵
  PID:5872
- C:\Windows\System\BHQiLiQ.exe
  C:\Windows\System\BHQiLiQ.exe
  2⤵
  PID:6924
- C:\Windows\System\BAIVJLF.exe
  C:\Windows\System\BAIVJLF.exe
  2⤵
  PID:7324
- C:\Windows\System\YtDLRbE.exe
  C:\Windows\System\YtDLRbE.exe
  2⤵
  PID:6980
- C:\Windows\System\mDRiosH.exe
  C:\Windows\System\mDRiosH.exe
  2⤵
  PID:6268
- C:\Windows\System\qDDMWAo.exe
  C:\Windows\System\qDDMWAo.exe
  2⤵
  PID:7092
- C:\Windows\System\UjhYStU.exe
  C:\Windows\System\UjhYStU.exe
  2⤵
  PID:7556
- C:\Windows\System\RizYyFa.exe
  C:\Windows\System\RizYyFa.exe
  2⤵
  PID:6164
- C:\Windows\System\AVbgvDL.exe
  C:\Windows\System\AVbgvDL.exe
  2⤵
  PID:9220
- C:\Windows\System\lladdJZ.exe
  C:\Windows\System\lladdJZ.exe
  2⤵
  PID:9244
- C:\Windows\System\vRFsunb.exe
  C:\Windows\System\vRFsunb.exe
  2⤵
  PID:9264
- C:\Windows\System\TsYpnwk.exe
  C:\Windows\System\TsYpnwk.exe
  2⤵
  PID:9288
- C:\Windows\System\QJiIJig.exe
  C:\Windows\System\QJiIJig.exe
  2⤵
  PID:9312
- C:\Windows\System\YIsJCaL.exe
  C:\Windows\System\YIsJCaL.exe
  2⤵
  PID:9332
- C:\Windows\System\zvoFsUl.exe
  C:\Windows\System\zvoFsUl.exe
  2⤵
  PID:9348
- C:\Windows\System\eZHQaqe.exe
  C:\Windows\System\eZHQaqe.exe
  2⤵
  PID:9372
- C:\Windows\System\qOKlJTU.exe
  C:\Windows\System\qOKlJTU.exe
  2⤵
  PID:9396
- C:\Windows\System\YbuDzNg.exe
  C:\Windows\System\YbuDzNg.exe
  2⤵
  PID:9420
- C:\Windows\System\HLcXAcU.exe
  C:\Windows\System\HLcXAcU.exe
  2⤵
  PID:9448
- C:\Windows\System\OhwhnGn.exe
  C:\Windows\System\OhwhnGn.exe
  2⤵
  PID:9464
- C:\Windows\System\Svfyoju.exe
  C:\Windows\System\Svfyoju.exe
  2⤵
  PID:9492
- C:\Windows\System\senVrlm.exe
  C:\Windows\System\senVrlm.exe
  2⤵
  PID:9508
- C:\Windows\System\JgUhwKR.exe
  C:\Windows\System\JgUhwKR.exe
  2⤵
  PID:9536
- C:\Windows\System\opeFtyL.exe
  C:\Windows\System\opeFtyL.exe
  2⤵
  PID:9552
- C:\Windows\System\BaytUTU.exe
  C:\Windows\System\BaytUTU.exe
  2⤵
  PID:9572
- C:\Windows\System\tFjrFYd.exe
  C:\Windows\System\tFjrFYd.exe
  2⤵
  PID:9588
- C:\Windows\System\kFpMyRw.exe
  C:\Windows\System\kFpMyRw.exe
  2⤵
  PID:9616
- C:\Windows\System\YPcrmBy.exe
  C:\Windows\System\YPcrmBy.exe
  2⤵
  PID:9636
- C:\Windows\System\UYVjCCr.exe
  C:\Windows\System\UYVjCCr.exe
  2⤵
  PID:9652
- C:\Windows\System\OApoNam.exe
  C:\Windows\System\OApoNam.exe
  2⤵
  PID:9672
- C:\Windows\System\LMtAxtu.exe
  C:\Windows\System\LMtAxtu.exe
  2⤵
  PID:9696
- C:\Windows\System\NYBoPbt.exe
  C:\Windows\System\NYBoPbt.exe
  2⤵
  PID:9716
- C:\Windows\System\YMZphxw.exe
  C:\Windows\System\YMZphxw.exe
  2⤵
  PID:9732
- C:\Windows\System\XOADDhN.exe
  C:\Windows\System\XOADDhN.exe
  2⤵
  PID:9756
- C:\Windows\System\ezCHazD.exe
  C:\Windows\System\ezCHazD.exe
  2⤵
  PID:9784
- C:\Windows\System\ylRMEkY.exe
  C:\Windows\System\ylRMEkY.exe
  2⤵
  PID:9804
- C:\Windows\System\wMnXJHX.exe
  C:\Windows\System\wMnXJHX.exe
  2⤵
  PID:9824
- C:\Windows\System\jrSnmTp.exe
  C:\Windows\System\jrSnmTp.exe
  2⤵
  PID:9844
- C:\Windows\System\OnjxrEw.exe
  C:\Windows\System\OnjxrEw.exe
  2⤵
  PID:9868
- C:\Windows\System\HQTADVI.exe
  C:\Windows\System\HQTADVI.exe
  2⤵
  PID:9892
- C:\Windows\System\AGSVlMI.exe
  C:\Windows\System\AGSVlMI.exe
  2⤵
  PID:9912
- C:\Windows\System\aDjdVnW.exe
  C:\Windows\System\aDjdVnW.exe
  2⤵
  PID:9936
- C:\Windows\System\AKyFdBD.exe
  C:\Windows\System\AKyFdBD.exe
  2⤵
  PID:9964
- C:\Windows\System\enmrPFc.exe
  C:\Windows\System\enmrPFc.exe
  2⤵
  PID:9980
- C:\Windows\System\YtBeGIg.exe
  C:\Windows\System\YtBeGIg.exe
  2⤵
  PID:9996
- C:\Windows\System\cyQalbW.exe
  C:\Windows\System\cyQalbW.exe
  2⤵
  PID:10020
- C:\Windows\System\DvYfjNc.exe
  C:\Windows\System\DvYfjNc.exe
  2⤵
  PID:10052
- C:\Windows\System\dZWquKq.exe
  C:\Windows\System\dZWquKq.exe
  2⤵
  PID:10068
- C:\Windows\System\VLxjkOj.exe
  C:\Windows\System\VLxjkOj.exe
  2⤵
  PID:10100
- C:\Windows\System\JIAWRSQ.exe
  C:\Windows\System\JIAWRSQ.exe
  2⤵
  PID:10124
- C:\Windows\System\ClOsxWU.exe
  C:\Windows\System\ClOsxWU.exe
  2⤵
  PID:10148
- C:\Windows\System\sQgOthp.exe
  C:\Windows\System\sQgOthp.exe
  2⤵
  PID:10172
- C:\Windows\System\iDdNuYT.exe
  C:\Windows\System\iDdNuYT.exe
  2⤵
  PID:10192
- C:\Windows\System\dwMnbwi.exe
  C:\Windows\System\dwMnbwi.exe
  2⤵
  PID:10212
- C:\Windows\System\mUOWbPa.exe
  C:\Windows\System\mUOWbPa.exe
  2⤵
  PID:10228
- C:\Windows\System\SNQtVmh.exe
  C:\Windows\System\SNQtVmh.exe
  2⤵
  PID:2804
- C:\Windows\System\wtEMTYm.exe
  C:\Windows\System\wtEMTYm.exe
  2⤵
  PID:5428
- C:\Windows\System\OEyIEqS.exe
  C:\Windows\System\OEyIEqS.exe
  2⤵
  PID:5808
- C:\Windows\System\GPqdZqZ.exe
  C:\Windows\System\GPqdZqZ.exe
  2⤵
  PID:544
- C:\Windows\System\HbSDZlf.exe
  C:\Windows\System\HbSDZlf.exe
  2⤵
  PID:7740
- C:\Windows\System\AYvYFHX.exe
  C:\Windows\System\AYvYFHX.exe
  2⤵
  PID:7760
- C:\Windows\System\qBBADFi.exe
  C:\Windows\System\qBBADFi.exe
  2⤵
  PID:7448
- C:\Windows\System\rXmvzoH.exe
  C:\Windows\System\rXmvzoH.exe
  2⤵
  PID:4976
- C:\Windows\System\FRxWoTa.exe
  C:\Windows\System\FRxWoTa.exe
  2⤵
  PID:7824
- C:\Windows\System\slJDeeY.exe
  C:\Windows\System\slJDeeY.exe
  2⤵
  PID:7872
- C:\Windows\System\REpQwdG.exe
  C:\Windows\System\REpQwdG.exe
  2⤵
  PID:6240
- C:\Windows\System\ZbYJHBc.exe
  C:\Windows\System\ZbYJHBc.exe
  2⤵
  PID:8252
- C:\Windows\System\bnpbcPU.exe
  C:\Windows\System\bnpbcPU.exe
  2⤵
  PID:8372
- C:\Windows\System\CVmGFAr.exe
  C:\Windows\System\CVmGFAr.exe
  2⤵
  PID:8536
- C:\Windows\System\eIKETux.exe
  C:\Windows\System\eIKETux.exe
  2⤵
  PID:5660
- C:\Windows\System\UxAmbWi.exe
  C:\Windows\System\UxAmbWi.exe
  2⤵
  PID:7188
- C:\Windows\System\LFfjVQJ.exe
  C:\Windows\System\LFfjVQJ.exe
  2⤵
  PID:8704
- C:\Windows\System\OvEjqXY.exe
  C:\Windows\System\OvEjqXY.exe
  2⤵
  PID:8736
- C:\Windows\System\jCHwseA.exe
  C:\Windows\System\jCHwseA.exe
  2⤵
  PID:8164
- C:\Windows\System\SNGtDIg.exe
  C:\Windows\System\SNGtDIg.exe
  2⤵
  PID:8856
- C:\Windows\System\UbkIojC.exe
  C:\Windows\System\UbkIojC.exe
  2⤵
  PID:8924
- C:\Windows\System\pyUMdIJ.exe
  C:\Windows\System\pyUMdIJ.exe
  2⤵
  PID:9012
- C:\Windows\System\zrxCmEo.exe
  C:\Windows\System\zrxCmEo.exe
  2⤵
  PID:4640
- C:\Windows\System\HFqVcUv.exe
  C:\Windows\System\HFqVcUv.exe
  2⤵
  PID:7024
- C:\Windows\System\RKwqtVI.exe
  C:\Windows\System\RKwqtVI.exe
  2⤵
  PID:6048
- C:\Windows\System\xBGnnOx.exe
  C:\Windows\System\xBGnnOx.exe
  2⤵
  PID:9188
- C:\Windows\System\sQBvaeS.exe
  C:\Windows\System\sQBvaeS.exe
  2⤵
  PID:9204
- C:\Windows\System\wAyqxIB.exe
  C:\Windows\System\wAyqxIB.exe
  2⤵
  PID:10264
- C:\Windows\System\jYGQXIl.exe
  C:\Windows\System\jYGQXIl.exe
  2⤵
  PID:10284
- C:\Windows\System\jyDIIxH.exe
  C:\Windows\System\jyDIIxH.exe
  2⤵
  PID:10308
- C:\Windows\System\neIVdCz.exe
  C:\Windows\System\neIVdCz.exe
  2⤵
  PID:10332
- C:\Windows\System\loIObSv.exe
  C:\Windows\System\loIObSv.exe
  2⤵
  PID:10352
- C:\Windows\System\PikzwHL.exe
  C:\Windows\System\PikzwHL.exe
  2⤵
  PID:10376
- C:\Windows\System\mWYTcQc.exe
  C:\Windows\System\mWYTcQc.exe
  2⤵
  PID:10396
- C:\Windows\System\FfCpDcm.exe
  C:\Windows\System\FfCpDcm.exe
  2⤵
  PID:10420
- C:\Windows\System\XNrARHG.exe
  C:\Windows\System\XNrARHG.exe
  2⤵
  PID:10452
- C:\Windows\System\yOboPAO.exe
  C:\Windows\System\yOboPAO.exe
  2⤵
  PID:10484
- C:\Windows\System\HMPPaTb.exe
  C:\Windows\System\HMPPaTb.exe
  2⤵
  PID:10508
- C:\Windows\System\qzdGQwM.exe
  C:\Windows\System\qzdGQwM.exe
  2⤵
  PID:10528
- C:\Windows\System\VfrHNGT.exe
  C:\Windows\System\VfrHNGT.exe
  2⤵
  PID:10548
- C:\Windows\System\oCdQJbX.exe
  C:\Windows\System\oCdQJbX.exe
  2⤵
  PID:10572
- C:\Windows\System\JFjOGqV.exe
  C:\Windows\System\JFjOGqV.exe
  2⤵
  PID:10588
- C:\Windows\System\FukTqNm.exe
  C:\Windows\System\FukTqNm.exe
  2⤵
  PID:10616
- C:\Windows\System\hbeCIXj.exe
  C:\Windows\System\hbeCIXj.exe
  2⤵
  PID:10640
- C:\Windows\System\XLeyHRn.exe
  C:\Windows\System\XLeyHRn.exe
  2⤵
  PID:11220
- C:\Windows\System\MCkDvyH.exe
  C:\Windows\System\MCkDvyH.exe
  2⤵
  PID:11248
- C:\Windows\System\YvuclMl.exe
  C:\Windows\System\YvuclMl.exe
  2⤵
  PID:7152
- C:\Windows\System\DnjjVkk.exe
  C:\Windows\System\DnjjVkk.exe
  2⤵
  PID:8088
- C:\Windows\System\hsjykqM.exe
  C:\Windows\System\hsjykqM.exe
  2⤵
  PID:7496
- C:\Windows\System\SxGjwFJ.exe
  C:\Windows\System\SxGjwFJ.exe
  2⤵
  PID:7000
- C:\Windows\System\AtQoMvq.exe
  C:\Windows\System\AtQoMvq.exe
  2⤵
  PID:6460
- C:\Windows\System\lBMUYaT.exe
  C:\Windows\System\lBMUYaT.exe
  2⤵
  PID:9260
- C:\Windows\System\gEagCPQ.exe
  C:\Windows\System\gEagCPQ.exe
  2⤵
  PID:9304
- C:\Windows\System\ClxMgCl.exe
  C:\Windows\System\ClxMgCl.exe
  2⤵
  PID:7044
- C:\Windows\System\ymUWNXv.exe
  C:\Windows\System\ymUWNXv.exe
  2⤵
  PID:7864
- C:\Windows\System\aZlCuFi.exe
  C:\Windows\System\aZlCuFi.exe
  2⤵
  PID:7912
- C:\Windows\System\JpOtoSf.exe
  C:\Windows\System\JpOtoSf.exe
  2⤵
  PID:9876
- C:\Windows\System\gMzhwMT.exe
  C:\Windows\System\gMzhwMT.exe
  2⤵
  PID:8356
- C:\Windows\System\rNpELze.exe
  C:\Windows\System\rNpELze.exe
  2⤵
  PID:8064
- C:\Windows\System\aXFaasm.exe
  C:\Windows\System\aXFaasm.exe
  2⤵
  PID:8808
- C:\Windows\System\bUdHRsb.exe
  C:\Windows\System\bUdHRsb.exe
  2⤵
  PID:7952
- C:\Windows\System\SXVIKlB.exe
  C:\Windows\System\SXVIKlB.exe
  2⤵
  PID:6896
- C:\Windows\System\dOekHAy.exe
  C:\Windows\System\dOekHAy.exe
  2⤵
  PID:9032
- C:\Windows\System\euzAHeC.exe
  C:\Windows\System\euzAHeC.exe
  2⤵
  PID:4860
- C:\Windows\System\kLfjsma.exe
  C:\Windows\System\kLfjsma.exe
  2⤵
  PID:9168
- C:\Windows\System\jpRdXLy.exe
  C:\Windows\System\jpRdXLy.exe
  2⤵
  PID:6648
- C:\Windows\System\xQuuWQU.exe
  C:\Windows\System\xQuuWQU.exe
  2⤵
  PID:3032
- C:\Windows\System\jjubKlO.exe
  C:\Windows\System\jjubKlO.exe
  2⤵
  PID:9276
- C:\Windows\System\ydWlTwV.exe
  C:\Windows\System\ydWlTwV.exe
  2⤵
  PID:6148
- C:\Windows\System\MHIuQgm.exe
  C:\Windows\System\MHIuQgm.exe
  2⤵
  PID:9852
- C:\Windows\System\sQQFJoN.exe
  C:\Windows\System\sQQFJoN.exe
  2⤵
  PID:8760
- C:\Windows\System\onokDWp.exe
  C:\Windows\System\onokDWp.exe
  2⤵
  PID:9412
- C:\Windows\System\JqevALk.exe
  C:\Windows\System\JqevALk.exe
  2⤵
  PID:9500
- C:\Windows\System\zJzVUiE.exe
  C:\Windows\System\zJzVUiE.exe
  2⤵
  PID:9704
- C:\Windows\System\UrLuWJi.exe
  C:\Windows\System\UrLuWJi.exe
  2⤵
  PID:9904
- C:\Windows\System\YtwMdIF.exe
  C:\Windows\System\YtwMdIF.exe
  2⤵
  PID:10044
- C:\Windows\System\aGtFXmb.exe
  C:\Windows\System\aGtFXmb.exe
  2⤵
  PID:10156
- C:\Windows\System\aInaLRU.exe
  C:\Windows\System\aInaLRU.exe
  2⤵
  PID:3680
- C:\Windows\System\HnfzsXX.exe
  C:\Windows\System\HnfzsXX.exe
  2⤵
  PID:10252
- C:\Windows\System\akNFjpI.exe
  C:\Windows\System\akNFjpI.exe
  2⤵
  PID:10388
- C:\Windows\System\heLBiLh.exe
  C:\Windows\System\heLBiLh.exe
  2⤵
  PID:7312
- C:\Windows\System\OufENBF.exe
  C:\Windows\System\OufENBF.exe
  2⤵
  PID:2708
- C:\Windows\System\tlIeXtJ.exe
  C:\Windows\System\tlIeXtJ.exe
  2⤵
  PID:10652
- C:\Windows\System\BDeCAir.exe
  C:\Windows\System\BDeCAir.exe
  2⤵
  PID:9356
- C:\Windows\System\GfFuUlM.exe
  C:\Windows\System\GfFuUlM.exe
  2⤵
  PID:9428
- C:\Windows\System\BhGQbDB.exe
  C:\Windows\System\BhGQbDB.exe
  2⤵
  PID:9472
- C:\Windows\System\APVxdRW.exe
  C:\Windows\System\APVxdRW.exe
  2⤵
  PID:9596
- C:\Windows\System\MsSXHWl.exe
  C:\Windows\System\MsSXHWl.exe
  2⤵
  PID:7680
- C:\Windows\System\HNSbRFg.exe
  C:\Windows\System\HNSbRFg.exe
  2⤵
  PID:10796
- C:\Windows\System\hMIGNPP.exe
  C:\Windows\System\hMIGNPP.exe
  2⤵
  PID:9712
- C:\Windows\System\XowjCPn.exe
  C:\Windows\System\XowjCPn.exe
  2⤵
  PID:10828
- C:\Windows\System\cHxYCxr.exe
  C:\Windows\System\cHxYCxr.exe
  2⤵
  PID:11280
- C:\Windows\System\BUvYGQM.exe
  C:\Windows\System\BUvYGQM.exe
  2⤵
  PID:11312
- C:\Windows\System\rYTfNBV.exe
  C:\Windows\System\rYTfNBV.exe
  2⤵
  PID:11328
- C:\Windows\System\zquXAVB.exe
  C:\Windows\System\zquXAVB.exe
  2⤵
  PID:11352
- C:\Windows\System\mlbscEV.exe
  C:\Windows\System\mlbscEV.exe
  2⤵
  PID:11380
- C:\Windows\System\JhDooJl.exe
  C:\Windows\System\JhDooJl.exe
  2⤵
  PID:11496
- C:\Windows\System\cSASAsE.exe
  C:\Windows\System\cSASAsE.exe
  2⤵
  PID:11516
- C:\Windows\System\XUazGgo.exe
  C:\Windows\System\XUazGgo.exe
  2⤵
  PID:11536
- C:\Windows\System\BhGaMuh.exe
  C:\Windows\System\BhGaMuh.exe
  2⤵
  PID:11560
- C:\Windows\System\ieASyvC.exe
  C:\Windows\System\ieASyvC.exe
  2⤵
  PID:11584
- C:\Windows\System\YqFXMdB.exe
  C:\Windows\System\YqFXMdB.exe
  2⤵
  PID:11608
- C:\Windows\System\vanpmcb.exe
  C:\Windows\System\vanpmcb.exe
  2⤵
  PID:11624
- C:\Windows\System\RLcLlyI.exe
  C:\Windows\System\RLcLlyI.exe
  2⤵
  PID:11648
- C:\Windows\System\huMXAMc.exe
  C:\Windows\System\huMXAMc.exe
  2⤵
  PID:11668
- C:\Windows\System\wzPdtGP.exe
  C:\Windows\System\wzPdtGP.exe
  2⤵
  PID:11692
- C:\Windows\System\qYPqvlu.exe
  C:\Windows\System\qYPqvlu.exe
  2⤵
  PID:11740
- C:\Windows\System\EampDoJ.exe
  C:\Windows\System\EampDoJ.exe
  2⤵
  PID:11812
- C:\Windows\System\lWdnYRX.exe
  C:\Windows\System\lWdnYRX.exe
  2⤵
  PID:11860
- C:\Windows\System\HbZGtil.exe
  C:\Windows\System\HbZGtil.exe
  2⤵
  PID:11876
- C:\Windows\System\FzkIzMc.exe
  C:\Windows\System\FzkIzMc.exe
  2⤵
  PID:11896
- C:\Windows\System\dwBTjzg.exe
  C:\Windows\System\dwBTjzg.exe
  2⤵
  PID:11920
- C:\Windows\System\mvrElkC.exe
  C:\Windows\System\mvrElkC.exe
  2⤵
  PID:11944
- C:\Windows\System\sEESSRT.exe
  C:\Windows\System\sEESSRT.exe
  2⤵
  PID:11968
- C:\Windows\System\OSVHNzc.exe
  C:\Windows\System\OSVHNzc.exe
  2⤵
  PID:11988
- C:\Windows\System\CHbfgQt.exe
  C:\Windows\System\CHbfgQt.exe
  2⤵
  PID:12012
- C:\Windows\System\zmpirRc.exe
  C:\Windows\System\zmpirRc.exe
  2⤵
  PID:12032
- C:\Windows\System\wHumkGD.exe
  C:\Windows\System\wHumkGD.exe
  2⤵
  PID:12056
- C:\Windows\System\ROTrnNM.exe
  C:\Windows\System\ROTrnNM.exe
  2⤵
  PID:12072
- C:\Windows\System\qNRHBFZ.exe
  C:\Windows\System\qNRHBFZ.exe
  2⤵
  PID:12088
- C:\Windows\System\tsZcDKi.exe
  C:\Windows\System\tsZcDKi.exe
  2⤵
  PID:12104
- C:\Windows\System\QGCqvcm.exe
  C:\Windows\System\QGCqvcm.exe
  2⤵
  PID:12124
- C:\Windows\System\clSBJsq.exe
  C:\Windows\System\clSBJsq.exe
  2⤵
  PID:12140
- C:\Windows\System\REDcVDd.exe
  C:\Windows\System\REDcVDd.exe
  2⤵
  PID:12156
- C:\Windows\System\MUQWvJq.exe
  C:\Windows\System\MUQWvJq.exe
  2⤵
  PID:12172
- C:\Windows\System\OapqMjx.exe
  C:\Windows\System\OapqMjx.exe
  2⤵
  PID:12188
- C:\Windows\System\StBfHOy.exe
  C:\Windows\System\StBfHOy.exe
  2⤵
  PID:12208
- C:\Windows\System\bVHnuna.exe
  C:\Windows\System\bVHnuna.exe
  2⤵
  PID:12224
- C:\Windows\System\CbRoZyq.exe
  C:\Windows\System\CbRoZyq.exe
  2⤵
  PID:12244
- C:\Windows\System\INwiOgi.exe
  C:\Windows\System\INwiOgi.exe
  2⤵
  PID:12764
- C:\Windows\System\ETKzaDD.exe
  C:\Windows\System\ETKzaDD.exe
  2⤵
  PID:12784
- C:\Windows\System\niTDUsM.exe
  C:\Windows\System\niTDUsM.exe
  2⤵
  PID:12804
- C:\Windows\System\CeMMoKA.exe
  C:\Windows\System\CeMMoKA.exe
  2⤵
  PID:12836
- C:\Windows\System\XsMUMHA.exe
  C:\Windows\System\XsMUMHA.exe
  2⤵
  PID:12856
- C:\Windows\System\DwdPitD.exe
  C:\Windows\System\DwdPitD.exe
  2⤵
  PID:12892
- C:\Windows\System\Wzkomvy.exe
  C:\Windows\System\Wzkomvy.exe
  2⤵
  PID:12920
- C:\Windows\System\lBUDBJn.exe
  C:\Windows\System\lBUDBJn.exe
  2⤵
  PID:12936
- C:\Windows\System\GcARJhf.exe
  C:\Windows\System\GcARJhf.exe
  2⤵
  PID:12956
- C:\Windows\System\DNsotNZ.exe
  C:\Windows\System\DNsotNZ.exe
  2⤵
  PID:12976
- C:\Windows\System\CZIrJrU.exe
  C:\Windows\System\CZIrJrU.exe
  2⤵
  PID:12996
- C:\Windows\System\vVjMUff.exe
  C:\Windows\System\vVjMUff.exe
  2⤵
  PID:13012
- C:\Windows\System\FDYdSzj.exe
  C:\Windows\System\FDYdSzj.exe
  2⤵
  PID:13032
- C:\Windows\System\VVyjrGV.exe
  C:\Windows\System\VVyjrGV.exe
  2⤵
  PID:13052
- C:\Windows\System\gnENdzW.exe
  C:\Windows\System\gnENdzW.exe
  2⤵
  PID:13068
- C:\Windows\System\VKDPovc.exe
  C:\Windows\System\VKDPovc.exe
  2⤵
  PID:13088
- C:\Windows\System\PGFajOu.exe
  C:\Windows\System\PGFajOu.exe
  2⤵
  PID:13104
- C:\Windows\System\Tnphobs.exe
  C:\Windows\System\Tnphobs.exe
  2⤵
  PID:13120
- C:\Windows\System\XtbDzVc.exe
  C:\Windows\System\XtbDzVc.exe
  2⤵
  PID:13140
- C:\Windows\System\JTNkfyr.exe
  C:\Windows\System\JTNkfyr.exe
  2⤵
  PID:13156
- C:\Windows\System\bTsPBLr.exe
  C:\Windows\System\bTsPBLr.exe
  2⤵
  PID:13176
- C:\Windows\System\iUfhPMT.exe
  C:\Windows\System\iUfhPMT.exe
  2⤵
  PID:13196
- C:\Windows\System\TncSdaA.exe
  C:\Windows\System\TncSdaA.exe
  2⤵
  PID:13220
- C:\Windows\System\IDknLxu.exe
  C:\Windows\System\IDknLxu.exe
  2⤵
  PID:13244
- C:\Windows\System\GsUXymA.exe
  C:\Windows\System\GsUXymA.exe
  2⤵
  PID:13268
- C:\Windows\System\NfrOgES.exe
  C:\Windows\System\NfrOgES.exe
  2⤵
  PID:13292
- C:\Windows\System\jdYGCqM.exe
  C:\Windows\System\jdYGCqM.exe
  2⤵
  PID:13308
- C:\Windows\System\AsNyYDa.exe
  C:\Windows\System\AsNyYDa.exe
  2⤵
  PID:10048
- C:\Windows\System\PsnFfcm.exe
  C:\Windows\System\PsnFfcm.exe
  2⤵
  PID:1196
- C:\Windows\System\tDzjlzr.exe
  C:\Windows\System\tDzjlzr.exe
  2⤵
  PID:10164
- C:\Windows\System\bGAMtxD.exe
  C:\Windows\System\bGAMtxD.exe
  2⤵
  PID:3548
- C:\Windows\System\feCpRXu.exe
  C:\Windows\System\feCpRXu.exe
  2⤵
  PID:7200
- C:\Windows\System\zTaeyjl.exe
  C:\Windows\System\zTaeyjl.exe
  2⤵
  PID:7376
- C:\Windows\System\pQTIOpp.exe
  C:\Windows\System\pQTIOpp.exe
  2⤵
  PID:11680
- C:\Windows\System\LLUlpqD.exe
  C:\Windows\System\LLUlpqD.exe
  2⤵
  PID:11820
- C:\Windows\System\yGfKdEe.exe
  C:\Windows\System\yGfKdEe.exe
  2⤵
  PID:11888
- C:\Windows\System\dTMamQG.exe
  C:\Windows\System\dTMamQG.exe
  2⤵
  PID:11960
- C:\Windows\System\FuTWbzN.exe
  C:\Windows\System\FuTWbzN.exe
  2⤵
  PID:12084
- C:\Windows\System\xLbZDZa.exe
  C:\Windows\System\xLbZDZa.exe
  2⤵
  PID:12116
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 12116 -s 28
    3⤵
    PID:11980
- C:\Windows\System\WYQZkaK.exe
  C:\Windows\System\WYQZkaK.exe
  2⤵
  PID:12168
- C:\Windows\System\sxBuAUJ.exe
  C:\Windows\System\sxBuAUJ.exe
  2⤵
  PID:4980
- C:\Windows\System\aamaoKf.exe
  C:\Windows\System\aamaoKf.exe
  2⤵
  PID:12280
- C:\Windows\System\WDGUsRa.exe
  C:\Windows\System\WDGUsRa.exe
  2⤵
  PID:9816
- C:\Windows\System\waeNZcX.exe
  C:\Windows\System\waeNZcX.exe
  2⤵
  PID:10256
- C:\Windows\System\ijWFUWS.exe
  C:\Windows\System\ijWFUWS.exe
  2⤵
  PID:10384
- C:\Windows\System\UgshQOg.exe
  C:\Windows\System\UgshQOg.exe
  2⤵
  PID:10624
- C:\Windows\System\EtSIzMF.exe
  C:\Windows\System\EtSIzMF.exe
  2⤵
  PID:9296
- C:\Windows\System\aHvYQsx.exe
  C:\Windows\System\aHvYQsx.exe
  2⤵
  PID:10008
- C:\Windows\System\HZMNJWu.exe
  C:\Windows\System\HZMNJWu.exe
  2⤵
  PID:5804
- C:\Windows\System\xTlvfqb.exe
  C:\Windows\System\xTlvfqb.exe
  2⤵
  PID:11720
- C:\Windows\System\rVrCfNM.exe
  C:\Windows\System\rVrCfNM.exe
  2⤵
  PID:12700
- C:\Windows\System\FexJGlN.exe
  C:\Windows\System\FexJGlN.exe
  2⤵
  PID:9112
- C:\Windows\System\gGKLAKO.exe
  C:\Windows\System\gGKLAKO.exe
  2⤵
  PID:11392
- C:\Windows\System\KraJGer.exe
  C:\Windows\System\KraJGer.exe
  2⤵
  PID:11216
- C:\Windows\System\hLecNBU.exe
  C:\Windows\System\hLecNBU.exe
  2⤵
  PID:12852
- C:\Windows\System\qexIGLf.exe
  C:\Windows\System\qexIGLf.exe
  2⤵
  PID:12872
- C:\Windows\System\KioPQFy.exe
  C:\Windows\System\KioPQFy.exe
  2⤵
  PID:13300
- C:\Windows\System\NANJoRm.exe
  C:\Windows\System\NANJoRm.exe
  2⤵
  PID:8040
- C:\Windows\System\XyOhPxH.exe
  C:\Windows\System\XyOhPxH.exe
  2⤵
  PID:12184
- C:\Windows\System\SEdupyx.exe
  C:\Windows\System\SEdupyx.exe
  2⤵
  PID:11772
- C:\Windows\System\szAhEtE.exe
  C:\Windows\System\szAhEtE.exe
  2⤵
  PID:3004
- C:\Windows\System\vHPIxtY.exe
  C:\Windows\System\vHPIxtY.exe
  2⤵
  PID:12080
- C:\Windows\System\nqsPrlp.exe
  C:\Windows\System\nqsPrlp.exe
  2⤵
  PID:11552
- C:\Windows\System\kfAWkfu.exe
  C:\Windows\System\kfAWkfu.exe
  2⤵
  PID:13172
- C:\Windows\System\eTZxdRm.exe
  C:\Windows\System\eTZxdRm.exe
  2⤵
  PID:11932
- C:\Windows\System\vQEyqRa.exe
  C:\Windows\System\vQEyqRa.exe
  2⤵
  PID:11684
- C:\Windows\System\JVJjqmx.exe
  C:\Windows\System\JVJjqmx.exe
  2⤵
  PID:12436
- C:\Windows\System\uiZrgEV.exe
  C:\Windows\System\uiZrgEV.exe
  2⤵
  PID:12844
- C:\Windows\System\OqaheII.exe
  C:\Windows\System\OqaheII.exe
  2⤵
  PID:7184
- C:\Windows\System\QyixKUx.exe
  C:\Windows\System\QyixKUx.exe
  2⤵
  PID:9580
- C:\Windows\System\XVyzAeV.exe
  C:\Windows\System\XVyzAeV.exe
  2⤵
  PID:7072
- C:\Windows\System\PTvOmGm.exe
  C:\Windows\System\PTvOmGm.exe
  2⤵
  PID:12412
- C:\Windows\System\gVcIhMy.exe
  C:\Windows\System\gVcIhMy.exe
  2⤵
  PID:12680
- C:\Windows\System\nqDYFnH.exe
  C:\Windows\System\nqDYFnH.exe
  2⤵
  PID:10208
- C:\Windows\System\yTvckgU.exe
  C:\Windows\System\yTvckgU.exe
  2⤵
  PID:8328
- C:\Windows\System\OPfdHeK.exe
  C:\Windows\System\OPfdHeK.exe
  2⤵
  PID:12984
- C:\Windows\System\uyoxpiK.exe
  C:\Windows\System\uyoxpiK.exe
  2⤵
  PID:12688
- C:\Windows\System\boCKafh.exe
  C:\Windows\System\boCKafh.exe
  2⤵
  PID:12216
- C:\Windows\System\dLCELIw.exe
  C:\Windows\System\dLCELIw.exe
  2⤵
  PID:4344
- C:\Windows\System\HLueISQ.exe
  C:\Windows\System\HLueISQ.exe
  2⤵
  PID:6132
- C:\Windows\System\eIygWjF.exe
  C:\Windows\System\eIygWjF.exe
  2⤵
  PID:12240
- C:\Windows\System\lGauKRZ.exe
  C:\Windows\System\lGauKRZ.exe
  2⤵
  PID:1144
- C:\Windows\System\mdfzIuk.exe
  C:\Windows\System\mdfzIuk.exe
  2⤵
  PID:11760
- C:\Windows\System\qLiswoC.exe
  C:\Windows\System\qLiswoC.exe
  2⤵
  PID:3040
- C:\Windows\System\qjwdrHy.exe
  C:\Windows\System\qjwdrHy.exe
  2⤵
  PID:9884
- C:\Windows\System\OQQwxAq.exe
  C:\Windows\System\OQQwxAq.exe
  2⤵
  PID:492
- C:\Windows\System\xjPBUoA.exe
  C:\Windows\System\xjPBUoA.exe
  2⤵
  PID:4996
- C:\Windows\System\nnxmTNF.exe
  C:\Windows\System\nnxmTNF.exe
  2⤵
  PID:11272
- C:\Windows\System\phjYzgc.exe
  C:\Windows\System\phjYzgc.exe
  2⤵
  PID:3132
- C:\Windows\System\bMIEJzl.exe
  C:\Windows\System\bMIEJzl.exe
  2⤵
  PID:12868
- C:\Windows\System\yTzUhrh.exe
  C:\Windows\System\yTzUhrh.exe
  2⤵
  PID:11980
- C:\Windows\System\XgLoXla.exe
  C:\Windows\System\XgLoXla.exe
  2⤵
  PID:5068
- C:\Windows\System\IQeZUtb.exe
  C:\Windows\System\IQeZUtb.exe
  2⤵
  PID:6004
- C:\Windows\System\wAWFKiy.exe
  C:\Windows\System\wAWFKiy.exe
  2⤵
  PID:5056
- C:\Windows\System\rLMgPRD.exe
  C:\Windows\System\rLMgPRD.exe
  2⤵
  PID:2288
- C:\Windows\System\XjMmcum.exe
  C:\Windows\System\XjMmcum.exe
  2⤵
  PID:12672
- C:\Windows\System\NyIOAEt.exe
  C:\Windows\System\NyIOAEt.exe
  2⤵
  PID:9684
- C:\Windows\System\APYZvhR.exe
  C:\Windows\System\APYZvhR.exe
  2⤵
  PID:9564
- C:\Windows\System\FoMAgZc.exe
  C:\Windows\System\FoMAgZc.exe
  2⤵
  PID:12596
- C:\Windows\System\dAoRkNc.exe
  C:\Windows\System\dAoRkNc.exe
  2⤵
  PID:11996
- C:\Windows\System\owvvRxB.exe
  C:\Windows\System\owvvRxB.exe
  2⤵
  PID:12404
- C:\Windows\System\vzYEWbt.exe
  C:\Windows\System\vzYEWbt.exe
  2⤵
  PID:2368
- C:\Windows\System\PSQSVfi.exe
  C:\Windows\System\PSQSVfi.exe
  2⤵
  PID:9252
- C:\Windows\System\MTInIvx.exe
  C:\Windows\System\MTInIvx.exe
  2⤵
  PID:11292
- C:\Windows\System\KNBhxDX.exe
  C:\Windows\System\KNBhxDX.exe
  2⤵
  PID:12112
- C:\Windows\System\kNGAGvL.exe
  C:\Windows\System\kNGAGvL.exe
  2⤵
  PID:10996
- C:\Windows\System\EZPOUFd.exe
  C:\Windows\System\EZPOUFd.exe
  2⤵
  PID:4276
- C:\Windows\System\acKxOLd.exe
  C:\Windows\System\acKxOLd.exe
  2⤵
  PID:11428
- C:\Windows\System\tMLSGxU.exe
  C:\Windows\System\tMLSGxU.exe
  2⤵
  PID:9104
- C:\Windows\System\yBodzAd.exe
  C:\Windows\System\yBodzAd.exe
  2⤵
  PID:3512
- C:\Windows\System\jONwPzT.exe
  C:\Windows\System\jONwPzT.exe
  2⤵
  PID:11724
- C:\Windows\System\bTpUsOp.exe
  C:\Windows\System\bTpUsOp.exe
  2⤵
  PID:4808
- C:\Windows\System\fEZJhGa.exe
  C:\Windows\System\fEZJhGa.exe
  2⤵
  PID:6756
- C:\Windows\System\DwciaoJ.exe
  C:\Windows\System\DwciaoJ.exe
  2⤵
  PID:12432
- C:\Windows\System\ETSpZDb.exe
  C:\Windows\System\ETSpZDb.exe
  2⤵
  PID:3188
- C:\Windows\System\pEzvuOT.exe
  C:\Windows\System\pEzvuOT.exe
  2⤵
  PID:12932
- C:\Windows\System\RvfLFzs.exe
  C:\Windows\System\RvfLFzs.exe
  2⤵
  PID:12164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3b0322td.mho.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AcBvyPa.exe

Filesize
1.7MB

MD5
9bc28d9ee66fc454fae68852a10a20af

SHA1
2fe0c2832ae56ac64322e1c69990b2668fff5aae

SHA256
5dfc67d42d8e493a4d3e601ecccdb2cdebaaff4c8e1e4bcd5d82c290649e395c

SHA512
f2409d015ffbeba679570e872964cc20e8eb68dd2561d3ce7ccb112746817595fefa9b5fb545069e3ed7b223bcae21b623df61ec24541765f4d5e6490411aa7e

Download Submit
C:\Windows\System\ArGJwjZ.exe

Filesize
1.7MB

MD5
eae10c4789112b728cb90cdab9f21a85

SHA1
0bb5ba1eb8456dd98d28692180276917b9586eeb

SHA256
0971e330eebac2f20472c17fe9915faa3631e7249fd22b8f8c02df34c6892891

SHA512
aa64df3ec38dd2eb56aa685ece3c6102e1720fa0b89cec894f3ac0c5c17f3e6831c485110b4238f46850a6e5f73333c1fe42d88ba765f28afaa9b90270b7822c

Download Submit
C:\Windows\System\CXzeLcX.exe

Filesize
1.7MB

MD5
9722ccb4df819bacc0803b8c7aa16bbf

SHA1
7eee1c91af94122e5dfab23fe9be0e7b33738d3e

SHA256
c1d2d13d1ac66ff205c138bd082f494392ae76892fad0b345f04701014e22f56

SHA512
e3d91e5b1e42fe1ff61e515d025a4620184dedb41197d0da4073d33b8435c463cf02dca8be86ccf57b4833f0047e4b0c12d4c964f4cb840efee51ec9d43f80ea

Download Submit
C:\Windows\System\EhjJFAY.exe

Filesize
1.7MB

MD5
78a71f68394c30f2b138bf9b1858bff5

SHA1
cd7d2d4e2f187255cba0531778b63a2f5d1a0b2f

SHA256
50a5205cdb4ec68ff7acb63b5d0dd28010915a40730fb34f6a7087d554477492

SHA512
5a68302e64ec5d9c196ba751662023e011c26b32b874f85735940cfc23d90456c16cbedd2e24375105fe0edf9222b404ec7a230fc6c9fdc70423834a1897a730

Download Submit
C:\Windows\System\HpSLVfl.exe

Filesize
1.7MB

MD5
53f325afa2864aa7d8d948eb1ebf0ffb

SHA1
550dcf330039f3fe1bfdfe867467185a08aa4b72

SHA256
8c445f26d36aabd47998a522bc1439ee60c18a3e2d6dde673c098b10c54df91d

SHA512
5d71b0f0c01c4088f395c05b4f4c5334cd48615841a8d51d9f6f0390085ae8faa117b39f845ae6e414a9d117874f10ea40e1794dd2e5f2788e7cac6d4dc7692b

Download Submit
C:\Windows\System\HqRmULr.exe

Filesize
1.7MB

MD5
493126951faa66dc1a32920cde8d28e2

SHA1
1ba4aba5125e11db86464ae41327171cb1782654

SHA256
fb0751fe81f40a3bbae3f7de29a3661d2879d34e705ccf9c25e01e7998df46e6

SHA512
e953b43b59afecc7ee37afa51acee9568694bc7ad5d876d9df611f52ecf3aed69f490154bc4d731675f8205191201d899fcb8b2acfaaedff157a7a75ac67a6df

Download Submit
C:\Windows\System\IYRGcco.exe

Filesize
1.7MB

MD5
966d6ab648dcaef13a0ef93e321c5ed8

SHA1
733c3fab1b7b9430bc314c759ccbca3de92956f8

SHA256
802b83798c3009639c4c5adb1070c7966c47ad8aa97e91c734de9696538469a5

SHA512
bb9b059ca9ec4cf0c22ee077f2d0375eb504df00c19755293200552ccf59dd70304e27cdb491c9670a99df9c5463740435e9684e17cec24d0e2ecc76d984403b

Download Submit
C:\Windows\System\JQqDqIq.exe

Filesize
1.7MB

MD5
bafc91355e6e80bfbc4031dc39f8ac95

SHA1
4dbe87750e8b999bbbe292f271b592f3de269d66

SHA256
b1be73c92f01ece4f9a608b69934fe646bdd4745e21dc197c1cc9f38087be3ff

SHA512
91d9a0763ec64c54e5d2d4993611c49b5c6ada89d080147769833d699862975ed2a7c4277e5830233bdc1cebd8134361285c6c2fbec842444d941e2258010596

Download Submit
C:\Windows\System\KZKoFfx.exe

Filesize
1.7MB

MD5
fab0c465c37c8d130416ec29424dd140

SHA1
3420e164cd61b227827aa0e404cd2cb8391154a8

SHA256
f943956d3d9f060fe3ed82bdcb2f4863a234150472d45c5e3eb68c7aff61716a

SHA512
c20a158254a0d8d809a3fae812b317c1930a9ce945c3dc28496871af47b75c4a446135367b63556b07fdfadac596f199204bcb505abcc46177d80a5100de6715

Download Submit
C:\Windows\System\LsozNqe.exe

Filesize
1.7MB

MD5
c5e2679701eef8f3fc836d3be037812e

SHA1
5eebadbca5febd2c547f114e2eea94a9019c168a

SHA256
bb50cbb991ae35e8d13ed46b5182155dd23f88c7ef475148b2492d168475f98a

SHA512
73515ef19301f2ebe8eecb42295458acc96053dcc62f7b0b63cf7d352b288d440d89165c8ec7ce55eaf5af66568d55115c3dcc336422dd351ded01aac58aaf4b

Download Submit
C:\Windows\System\LupPxnP.exe

Filesize
1.7MB

MD5
823e4f57c39cff02f3de9871b3f50485

SHA1
8a050704bac6e04de16049eaccbbbfe31846cead

SHA256
6a0eba50574d7f9b69c56993b21504c3688642909e23b04dc4cf4d56eebbf861

SHA512
1149deadaf25d4b63cb63a195df32e617e4632ccca8f636a55fc5dbf98eccabda242590071956f54c216b63729b89552c10a64d225914e9d5b174d1940ae82f1

Download Submit
C:\Windows\System\SRImuld.exe

Filesize
1.7MB

MD5
7c901b61f4f3c48a88ab9e65634c7c01

SHA1
2d3a574cec3411ee72cec7848c9cc84fdb0a4b0c

SHA256
a6c3a957d83602463eb7d6d124dbe9720f2bd9e66fc06ce2cd1fc8cc0d98b946

SHA512
d1705e56cee221b8d63869c5fc91b88e2bd3d8b687182eefb3a6c2572d0f097fe2f7f2b9fda4baa62c4a0bcfff6639bc2d57109bdb1583348a17a05de2c3ae62

Download Submit
C:\Windows\System\UhCXsvt.exe

Filesize
1.7MB

MD5
e77e133da5ee8c3c9a96954f99a17282

SHA1
242d24ebf216e6c061af366378fc6d763fcb60af

SHA256
eb6c1bd38fdd0f834ba813035aed2de5b509b0e042d4d8a131aea44cf3e03f39

SHA512
613d7988ce40b9d98e7074e4af71642e099fe686a338e0165ff8023395807c02d1eed26bd52e35b79c509229ab690da566843bea71fc56e25e389b94bdb9ba8d

Download Submit
C:\Windows\System\VLlQQPq.exe

Filesize
1.7MB

MD5
90e1132ab85b3f55860e5960f030867c

SHA1
7db15ff0d9a16f78708e6644e6464f5cd1a79aa5

SHA256
067a55b42ff6720b153788469ecb7f9db8994b9a91cd4c8577962c9d92ba48ca

SHA512
fab373ed7da916dbd1a372a46d4bdb743668776042230ea912ebf8e872ffa14ef41fa70765f69198dd11cdd202dc657531e263d0a624f3aab89fe2d25ed1321a

Download Submit
C:\Windows\System\VzPDmCw.exe

Filesize
1.7MB

MD5
e258ab9683c2bca1c82c287260d64d16

SHA1
318a7ae81eebe120aaa5c45370694f2664816062

SHA256
4f181704859c23f0d4624a2bc5ba489d53101619b61d5c5b66ac38b1ddae668e

SHA512
2cad7e18cb2e73b5155cb6b6dcb9a7a79b38b9988acb32aa19b446308063969bbd908892bc1362e5aa0368781f48808eb77d5e798bef0537317f4010bd788478

Download Submit
C:\Windows\System\XFEEyuR.exe

Filesize
1.7MB

MD5
40f80888a40e0557af60dd256e5a4a80

SHA1
3799a691e84362becb6e9ca3fccd19b6e6b9f410

SHA256
0632bb9e2694f4f4e480d36198b94f0ca0a3e04a18a7896458ad39ac6ba0bc49

SHA512
6e80955323d2aeac1c2f19b9eedd1830833591e08d01f663e65a96e8003d4f601187419798998298eb43a543f74852175033360c7d1a9bc9d8857d2e14f13e5a

Download Submit
C:\Windows\System\XpMluAh.exe

Filesize
1.7MB

MD5
ccbc0c2bc576514cb3415b33633882e8

SHA1
56f7f8b2ae612d0b732caf6c72aa8dafb025f411

SHA256
89af7c19f6e9f72aa702442f13455abe3da29b8fe05147ba074858ca621168a0

SHA512
36ff80d968ce03579db2af8ec4a8663a3d0ae9d7a7003e64edbfda101505c19b92d869a0a992f2d980544ede6d66a8fe1383766ebbc5491c1a9cc1956387f00b

Download Submit
C:\Windows\System\YUlTNXT.exe

Filesize
1.7MB

MD5
ee35981ce399805653a116389701d25e

SHA1
2749d36f84b0edb351ac11500a8d3cced656b0a6

SHA256
f9251f81a5cab99b4f83c87c0ccd818eb7e3a9b7d2b115598fa791180306fbbe

SHA512
54c0eafe381637320c537a3c325f0a7d928526a5db66f218c5a065a7bf253e942b8d52a59b7ff087fa71a0571ba0c6b2943bc1fc19de9a5f8d5a04fa0bb944dd

Download Submit
C:\Windows\System\ZoftgvJ.exe

Filesize
1.7MB

MD5
494243001edac7723fb03cc4766e6178

SHA1
bdebeac160d3d7c15c1aca65f5dfb5dc19c722b9

SHA256
a93af50917f7a30a23fede2f7cd487668f26c708d427ef2d1308106f7c261c33

SHA512
55b3b9ebe1c25b6c68293726236534f44d30fe12a95f2e6d0c693159cd1cd94047e3771dbbac44e9f9d6c51b5c4908171ee981435cfb0ccbf6cfae106ac9cb68

Download Submit
C:\Windows\System\aFgsWPb.exe

Filesize
1.7MB

MD5
e1037f0097754da9a6390b874220bf58

SHA1
cd188f2c3d8d16e1535a82635348925529e57048

SHA256
641e3b2aebbec256b229ab0529d66477559ae45b24a86c90b9f1e1754c6aa9b7

SHA512
57866f2d16b494193d56256969d5769faeddb6723714c5cacb63d5684cff4fde050e2a3b7f9fb2bb244b22c0eeb2f4089c588a4f9cd2f79015b1ed7615e159d7

Download Submit
C:\Windows\System\aGllUgG.exe

Filesize
1.7MB

MD5
26d757a7735f8e5c6586537703058a88

SHA1
dba4eb861029ec9dcc93325f4153664879e11abc

SHA256
61d3a1e754bf0175127f4175314c91aea5b43e693183ff61166caf2cd781dab6

SHA512
e42d0f70a080cf71dd902ea33009644185d1959d0ffeda48c53232bda79dcf376a4583d08bb079c29677f665ed79207c4c18b450313492f598b47ac3bf6a0499

Download Submit
C:\Windows\System\ajhpkhU.exe

Filesize
1.7MB

MD5
cf630a112e48bab23b14bd11eea14d2d

SHA1
849f046cef3ef805edbfe93d507c6a4d2740b8f4

SHA256
08b71508aa85aaa142b20b416033a13d45430bb357dacda0c065d833ccad179d

SHA512
056ed828d6f1b70911a1fae48d7300c13a3c1e30c6726624784435e39ac19437dd536805a3715238ffbd2a056ac0d8b8adf5f97d72f144978e86c35abf24a843

Download Submit
C:\Windows\System\aqEVlTb.exe

Filesize
1.7MB

MD5
0c08c8e5909c4cea1d3697a681df9060

SHA1
b4e6edb13667bb345b4a84e86529f0db7ecd0432

SHA256
831a9b6ea5046b08d75b08e9c56745c206323ebd81ee005090fe55657d6f43ea

SHA512
3b15d4f11277d6eaa9cf18df0e96e72807a9057ec73e3014a5c2b784f20b741b9cc77af4aaee108d564a24a17bfae5632bef52978e6ad34940cf78a13d58a02f

Download Submit
C:\Windows\System\copyDwc.exe

Filesize
1.7MB

MD5
f0efb0d203fda2907080e0f51e63df9b

SHA1
6085e649dfaf22a93c28117ec92df265c70e1261

SHA256
de7bc193b35e48e7d8983fc816ef229c1e17581cd168de6eed2fa9cffb09f4f0

SHA512
7046be60913bc534b936e0dbbbcecaa41ff66ae87f38a6b40ba5cd41156abba037a783b2f7ad4a0ff1d0c89875981175c20b2d70170651b8a8e83eae1f26bff5

Download Submit
C:\Windows\System\eBgJoNM.exe

Filesize
1.7MB

MD5
d51c22124b394a9d948f3e767ced0d60

SHA1
ec9bc78d095d88c1060bcf6f2253a5a2b5f377ac

SHA256
5e4f56be130e547705d25685b8ea712a023a9b47870dd971ecbfefd4c7914583

SHA512
d7bdfbf67fb0076302c4cdf48098004086e9eb8b1cb36eb26dd4f27d29adf2902c8b5b9286f242a93d40f11aeb9ab3b4478b976bc1d87b001f36271c60ea508f

Download Submit
C:\Windows\System\fZQkPya.exe

Filesize
1.7MB

MD5
fa8b0eb4bb3d6bbb26b4fff1604aca95

SHA1
5d6bd317a1675374c044ebc14ee920761a3f9eef

SHA256
21677796999b84b23f20565e2bf0724d69858a39e18fc80d273c12d7b67a79b4

SHA512
414481e31bcf4a761d35bf7ff86a367581591701197e1506fc8b1c5bf2f53f8832656b4ed3923e4948ed196553d1740a8c06ad96b228ec9e0e471255cf2417ae

Download Submit
C:\Windows\System\geaQPaw.exe

Filesize
1.7MB

MD5
0335e4431117bb0f48e3d0d65f01ba6e

SHA1
1e21976df7f5f1c514d248a5b20985c85f27a022

SHA256
37615216816e1dd1f4af4c17c0d7beae3c626c0bdeae7f0fdcc32f2228581689

SHA512
b5e1e25728fa4f2dafa853ec1e3d7635568778275aeef51a99c172a4e5649f42854bd5d5e8b8965f89c522e98f38d818ba15bbb5ae60d7c972c652597b59db32

Download Submit
C:\Windows\System\jGdIIvw.exe

Filesize
1.7MB

MD5
9edc311f52840ee48c8045cf1657605c

SHA1
1e54d2e329dd561c002f2dc01fed1974b5e8cc44

SHA256
ceef31efea6438fceb993fe297240044172e8e96d9ba190bb2eb4c6eb4638726

SHA512
631d148e474e1c9e3458fddd7c1ab312b6722ae9a60abe5db0d0e83d7cbf8f9814984f9331779a7d9a8d8215d3995734b5cde71f99d33da11233556e6ebd16ae

Download Submit
C:\Windows\System\jTclxxi.exe

Filesize
1.7MB

MD5
3a28c0a50d844a692671b8f7b3ea8245

SHA1
564693bcda83cb6d4ad0eb3214ea62e3eabd99d7

SHA256
fefe3f9870f148cd3f06df9f490fa3d10937664b1819168d49248259e2ae4123

SHA512
d5c2eb6963ebd4f84034ccb427302efd9cf6ffa172a7fa835ff14368e3b5fd7713f9a06661b601cac7923747da01258e68df293ca392e0026213c1818851fea9

Download Submit
C:\Windows\System\ktcwMRb.exe

Filesize
1.7MB

MD5
9b47fce5f63ef203f7db153824b4eec5

SHA1
4e440c41b8375ab08310fbeb7a289a402f2e1954

SHA256
dd315b2968f032daf1f1ffb7efd9d48679cf801cac4eefc28b5ce55ec5f018b7

SHA512
b2d46ea352afa1d420e3e53e7dd4297a25b0afa2cd4b42adfa0ed68187f9052e0979b55f26840e08c3349dd7ce351e30894682fca222b299b0338eef4ce9e4c8

Download Submit
C:\Windows\System\lBGkcrF.exe

Filesize
1.7MB

MD5
a87f853d97d33f3979f767f173b8b793

SHA1
b066d95705a64173f7a4681e773e1045c830eff2

SHA256
84e5832f1a54884f29ad93e00c0db0b3e582136a0df62c25ab48144419e52956

SHA512
86821aaced025f26a29381bcaf74ef30cbf3bbdb93d4dcc003635daca9fb0b0a9cd0f0d01c55926ae7f00fcc42a42bf231fd10282ada777e0559c62d69043629

Download Submit
C:\Windows\System\pDgfdxI.exe

Filesize
1.7MB

MD5
1c2cf9351c725e2c25d7214e7fa97ec9

SHA1
1bba6138b3d3990ca0a8440a2ed4fa9b124d5b1c

SHA256
6d9400eb230d4bd586c7a24aca3f1a7f6bf559bff40c323fd15b248919110390

SHA512
3fab8be47c3dad1402638690dfd1502d9783f6cd985784a3057f1ccfaec9c5ac25077ce873a0c569816800133ab4f3d9bb044d7f8e3191f558a9e9d031f4ef50

Download Submit
C:\Windows\System\pTZAYga.exe

Filesize
1.7MB

MD5
3449a133c2f97ba0ee98d936a440fceb

SHA1
bccea046bdefae083994fe38e00b4cc7b65c360e

SHA256
ff436447c57df2192628c49b6d1a275b0a827bc52d20ae2f0231bb2d4a974d7a

SHA512
66c405dc62b0a93ee93f4ee981d7467eb83dbdd12c7d1ff6352db68630c13ceef9403ac7eb540c5518da52e36bbfe54e82c435c068be4d593e64df8be254a764

Download Submit
C:\Windows\System\roInGwr.exe

Filesize
1.7MB

MD5
4cecb91e919f7a790af683d84dac79fc

SHA1
3dbdc6e3e2bbdfb8c41a52422e5111161e4ed7bd

SHA256
a4ffab3627891fdfcd61a6e50c9b43a19e840a5e70054da1f72b94fe362d8570

SHA512
4bbfbd35195b69ed1f917763ce7c497eb5cd329a7499315b305af40aad2b2e9d795cceff0195575fc602f0c91b229598f6472ca891392c3cb768f8c87f3d6257

Download Submit
C:\Windows\System\tlMBSTX.exe

Filesize
1.7MB

MD5
6f89d35251cf60a92fa02557dbf4696f

SHA1
a3ac87c7b872393c97f39f006df385e3b3899297

SHA256
8213a011d6cde7568b79b14568fc30b9acf1f848b2c419bc1ce7212b8871c47a

SHA512
109e64c6412e4694a52a6fcee0f14db551115ff653c9a73e00780ee1a50234f6cc7c6e5672a5a5704e49b07ff0ba2f96f50707b6aa4219d82d362e5632e15bd5

Download Submit
C:\Windows\System\ulMDVnf.exe

Filesize
1.7MB

MD5
94acddca05c3f91c3849e5557a099eba

SHA1
ec2f1d065170c49699c1bc0b1681e8ba5a91d74c

SHA256
2c8d35b5c556b2ba121e39b0b303ea170c0e7a3b264c99ae785c9c9e41d95837

SHA512
c3d1df98782214da46fed6e8792c661e312a2051b25de78f39569a504dea118413d23574237978060749e762accc8ca1e1220ffc925eebffb21270a831791f88

Download Submit
C:\Windows\System\vljJiHb.exe

Filesize
1.7MB

MD5
515938b30ab07bf58472a58b19d4638e

SHA1
638484f62d74563040c49158a9189b05ba02ecd0

SHA256
8f6d632382f5db1d6a1abb7583a3f189edaab056003a2964a21b26c165a564fe

SHA512
70295a2e9e2cb12577ffa12649ccb403c1096831ebf4c0e7041611e1085ff9e200d1febaf6535340d0fb2046c3a26f3a00d3b3b6dc3bbf403b021f7e449b7196

Download Submit
C:\Windows\System\wElhCMn.exe

Filesize
1.7MB

MD5
65e5621efbd4a1c8837a2c66e9831814

SHA1
e60f25a1c4532b1c5a6b183491d52d3f03e1354c

SHA256
0114f111098058e2d83acb58988b67ddbb1873df437bf9fe91b4abf39326bc6d

SHA512
78c0e2cd696b61e23c615b39f2a457a06a427630e05c956dbb059633805bf5331c2bf1f03faa8f52a17afa17f3b7bec4118c634aac2bccb646695ac3067bc8e5

Download Submit
memory/620-61-0x00007FF702350000-0x00007FF702742000-memory.dmp

Filesize
3.9MB

Download
memory/620-2607-0x00007FF702350000-0x00007FF702742000-memory.dmp

Filesize
3.9MB

Download
memory/620-2615-0x00007FF702350000-0x00007FF702742000-memory.dmp

Filesize
3.9MB

Download
memory/648-605-0x00007FF6C0290000-0x00007FF6C0682000-memory.dmp

Filesize
3.9MB

Download
memory/648-2717-0x00007FF6C0290000-0x00007FF6C0682000-memory.dmp

Filesize
3.9MB

Download
memory/1460-2608-0x00007FF768100000-0x00007FF7684F2000-memory.dmp

Filesize
3.9MB

Download
memory/1460-71-0x00007FF768100000-0x00007FF7684F2000-memory.dmp

Filesize
3.9MB

Download
memory/1460-2677-0x00007FF768100000-0x00007FF7684F2000-memory.dmp

Filesize
3.9MB

Download
memory/1572-1-0x0000018086E30000-0x0000018086E40000-memory.dmp

Filesize
64KB

Download
memory/1572-0-0x00007FF767200000-0x00007FF7675F2000-memory.dmp

Filesize
3.9MB

Download
memory/1848-2674-0x00007FF6A77D0000-0x00007FF6A7BC2000-memory.dmp

Filesize
3.9MB

Download
memory/1848-197-0x00007FF6A77D0000-0x00007FF6A7BC2000-memory.dmp

Filesize
3.9MB

Download
memory/1988-2731-0x00007FF658E20000-0x00007FF659212000-memory.dmp

Filesize
3.9MB

Download
memory/1988-607-0x00007FF658E20000-0x00007FF659212000-memory.dmp

Filesize
3.9MB

Download
memory/2364-869-0x00007FF7DE290000-0x00007FF7DE682000-memory.dmp

Filesize
3.9MB

Download
memory/2364-2735-0x00007FF7DE290000-0x00007FF7DE682000-memory.dmp

Filesize
3.9MB

Download
memory/2472-1561-0x00007FF75A630000-0x00007FF75AA22000-memory.dmp

Filesize
3.9MB

Download
memory/2472-2703-0x00007FF75A630000-0x00007FF75AA22000-memory.dmp

Filesize
3.9MB

Download
memory/2960-709-0x00007FF662CE0000-0x00007FF6630D2000-memory.dmp

Filesize
3.9MB

Download
memory/2960-2676-0x00007FF662CE0000-0x00007FF6630D2000-memory.dmp

Filesize
3.9MB

Download
memory/3140-12-0x00007FF9253B3000-0x00007FF9253B5000-memory.dmp

Filesize
8KB

Download
memory/3140-30-0x00007FF9253B0000-0x00007FF925E71000-memory.dmp

Filesize
10.8MB

Download
memory/3140-47-0x000002104BDB0000-0x000002104BDD2000-memory.dmp

Filesize
136KB

Download
memory/3140-1416-0x00007FF9253B0000-0x00007FF925E71000-memory.dmp

Filesize
10.8MB

Download
memory/3200-2659-0x00007FF626D50000-0x00007FF627142000-memory.dmp

Filesize
3.9MB

Download
memory/3200-2609-0x00007FF626D50000-0x00007FF627142000-memory.dmp

Filesize
3.9MB

Download
memory/3200-92-0x00007FF626D50000-0x00007FF627142000-memory.dmp

Filesize
3.9MB

Download
memory/3336-338-0x00007FF7971B0000-0x00007FF7975A2000-memory.dmp

Filesize
3.9MB

Download
memory/3336-2700-0x00007FF7971B0000-0x00007FF7975A2000-memory.dmp

Filesize
3.9MB

Download
memory/3744-1101-0x00007FF6EB890000-0x00007FF6EBC82000-memory.dmp

Filesize
3.9MB

Download
memory/3744-2613-0x00007FF6EB890000-0x00007FF6EBC82000-memory.dmp

Filesize
3.9MB

Download
memory/3936-2657-0x00007FF67F1A0000-0x00007FF67F592000-memory.dmp

Filesize
3.9MB

Download
memory/3936-256-0x00007FF67F1A0000-0x00007FF67F592000-memory.dmp

Filesize
3.9MB

Download
memory/3972-2741-0x00007FF715780000-0x00007FF715B72000-memory.dmp

Filesize
3.9MB

Download
memory/3972-1096-0x00007FF715780000-0x00007FF715B72000-memory.dmp

Filesize
3.9MB

Download
memory/4032-2671-0x00007FF711520000-0x00007FF711912000-memory.dmp

Filesize
3.9MB

Download
memory/4032-133-0x00007FF711520000-0x00007FF711912000-memory.dmp

Filesize
3.9MB

Download
memory/4352-329-0x00007FF6880D0000-0x00007FF6884C2000-memory.dmp

Filesize
3.9MB

Download
memory/4352-2685-0x00007FF6880D0000-0x00007FF6884C2000-memory.dmp

Filesize
3.9MB

Download
memory/4740-2611-0x00007FF7FAF00000-0x00007FF7FB2F2000-memory.dmp

Filesize
3.9MB

Download
memory/4740-11-0x00007FF7FAF00000-0x00007FF7FB2F2000-memory.dmp

Filesize
3.9MB

Download
memory/4756-865-0x00007FF6C5CD0000-0x00007FF6C60C2000-memory.dmp

Filesize
3.9MB

Download
memory/4756-2738-0x00007FF6C5CD0000-0x00007FF6C60C2000-memory.dmp

Filesize
3.9MB

Download
memory/4816-2650-0x00007FF6C2E40000-0x00007FF6C3232000-memory.dmp

Filesize
3.9MB

Download
memory/4816-62-0x00007FF6C2E40000-0x00007FF6C3232000-memory.dmp

Filesize
3.9MB

Download
memory/5044-393-0x00007FF7A9780000-0x00007FF7A9B72000-memory.dmp

Filesize
3.9MB

Download
memory/5044-2713-0x00007FF7A9780000-0x00007FF7A9B72000-memory.dmp

Filesize
3.9MB

Download
memory/5112-2743-0x00007FF7065D0000-0x00007FF7069C2000-memory.dmp

Filesize
3.9MB

Download
memory/5112-489-0x00007FF7065D0000-0x00007FF7069C2000-memory.dmp

Filesize
3.9MB

Download