xmrig | 46172cbc8fbc2bc1e8d3ca612cb915f0a11226a83b8eb33353d52c40d9d192d9

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
28/07/2024, 01:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
Size

1.8MB
MD5

04f4c160684d6bcad7cba7bc8dc41d26
SHA1

2792033b5cab6af67217835784beccaee3fd7b6e
SHA256

46172cbc8fbc2bc1e8d3ca612cb915f0a11226a83b8eb33353d52c40d9d192d9
SHA512

362cbc36f7ed1eb3fbb80c0072030d8e8c81388873068d75620696d18a9ea189f580085251118a467d6d079e638a46193a3da4d2a5693d949615bb2f50187fde
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p1HzDgUa:NABa

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 47 IoCs

miner

resource	yara_rule
behavioral2/memory/4292-453-0x00007FF765D40000-0x00007FF766132000-memory.dmp	xmrig
behavioral2/memory/2424-581-0x00007FF737C50000-0x00007FF738042000-memory.dmp	xmrig
behavioral2/memory/4368-597-0x00007FF6BF1F0000-0x00007FF6BF5E2000-memory.dmp	xmrig
behavioral2/memory/1844-599-0x00007FF7117C0000-0x00007FF711BB2000-memory.dmp	xmrig
behavioral2/memory/4176-602-0x00007FF6B73E0000-0x00007FF6B77D2000-memory.dmp	xmrig
behavioral2/memory/624-605-0x00007FF79EC00000-0x00007FF79EFF2000-memory.dmp	xmrig
behavioral2/memory/2348-608-0x00007FF7B4900000-0x00007FF7B4CF2000-memory.dmp	xmrig
behavioral2/memory/3344-2925-0x00007FF6D7F40000-0x00007FF6D8332000-memory.dmp	xmrig
behavioral2/memory/4624-2927-0x00007FF75A1F0000-0x00007FF75A5E2000-memory.dmp	xmrig
behavioral2/memory/4572-2929-0x00007FF70D7F0000-0x00007FF70DBE2000-memory.dmp	xmrig
behavioral2/memory/1912-2933-0x00007FF7BEDA0000-0x00007FF7BF192000-memory.dmp	xmrig
behavioral2/memory/2472-2939-0x00007FF781DC0000-0x00007FF7821B2000-memory.dmp	xmrig
behavioral2/memory/3860-2945-0x00007FF7CE590000-0x00007FF7CE982000-memory.dmp	xmrig
behavioral2/memory/404-2947-0x00007FF65B5C0000-0x00007FF65B9B2000-memory.dmp	xmrig
behavioral2/memory/1760-2949-0x00007FF7E4440000-0x00007FF7E4832000-memory.dmp	xmrig
behavioral2/memory/820-2981-0x00007FF68D2F0000-0x00007FF68D6E2000-memory.dmp	xmrig
behavioral2/memory/4368-3002-0x00007FF6BF1F0000-0x00007FF6BF5E2000-memory.dmp	xmrig
behavioral2/memory/4664-3041-0x00007FF6458E0000-0x00007FF645CD2000-memory.dmp	xmrig
behavioral2/memory/2348-3062-0x00007FF7B4900000-0x00007FF7B4CF2000-memory.dmp	xmrig
behavioral2/memory/4456-3071-0x00007FF69F3B0000-0x00007FF69F7A2000-memory.dmp	xmrig
behavioral2/memory/1348-3068-0x00007FF6D49F0000-0x00007FF6D4DE2000-memory.dmp	xmrig
behavioral2/memory/3176-3065-0x00007FF728090000-0x00007FF728482000-memory.dmp	xmrig
behavioral2/memory/2372-3064-0x00007FF7F4000000-0x00007FF7F43F2000-memory.dmp	xmrig
behavioral2/memory/4176-3060-0x00007FF6B73E0000-0x00007FF6B77D2000-memory.dmp	xmrig
behavioral2/memory/624-3039-0x00007FF79EC00000-0x00007FF79EFF2000-memory.dmp	xmrig
behavioral2/memory/3976-3001-0x00007FF7273B0000-0x00007FF7277A2000-memory.dmp	xmrig
behavioral2/memory/2424-2943-0x00007FF737C50000-0x00007FF738042000-memory.dmp	xmrig
behavioral2/memory/1844-2941-0x00007FF7117C0000-0x00007FF711BB2000-memory.dmp	xmrig
behavioral2/memory/4292-2937-0x00007FF765D40000-0x00007FF766132000-memory.dmp	xmrig
behavioral2/memory/2304-2935-0x00007FF605230000-0x00007FF605622000-memory.dmp	xmrig
behavioral2/memory/4736-2931-0x00007FF6558F0000-0x00007FF655CE2000-memory.dmp	xmrig
behavioral2/memory/4456-833-0x00007FF69F3B0000-0x00007FF69F7A2000-memory.dmp	xmrig
behavioral2/memory/4736-832-0x00007FF6558F0000-0x00007FF655CE2000-memory.dmp	xmrig
behavioral2/memory/3176-607-0x00007FF728090000-0x00007FF728482000-memory.dmp	xmrig
behavioral2/memory/4664-606-0x00007FF6458E0000-0x00007FF645CD2000-memory.dmp	xmrig
behavioral2/memory/2372-604-0x00007FF7F4000000-0x00007FF7F43F2000-memory.dmp	xmrig
behavioral2/memory/1348-603-0x00007FF6D49F0000-0x00007FF6D4DE2000-memory.dmp	xmrig
behavioral2/memory/3976-601-0x00007FF7273B0000-0x00007FF7277A2000-memory.dmp	xmrig
behavioral2/memory/820-600-0x00007FF68D2F0000-0x00007FF68D6E2000-memory.dmp	xmrig
behavioral2/memory/1760-598-0x00007FF7E4440000-0x00007FF7E4832000-memory.dmp	xmrig
behavioral2/memory/404-596-0x00007FF65B5C0000-0x00007FF65B9B2000-memory.dmp	xmrig
behavioral2/memory/3860-595-0x00007FF7CE590000-0x00007FF7CE982000-memory.dmp	xmrig
behavioral2/memory/2304-360-0x00007FF605230000-0x00007FF605622000-memory.dmp	xmrig
behavioral2/memory/1912-328-0x00007FF7BEDA0000-0x00007FF7BF192000-memory.dmp	xmrig
behavioral2/memory/4624-265-0x00007FF75A1F0000-0x00007FF75A5E2000-memory.dmp	xmrig
behavioral2/memory/4572-195-0x00007FF70D7F0000-0x00007FF70DBE2000-memory.dmp	xmrig
behavioral2/memory/2472-137-0x00007FF781DC0000-0x00007FF7821B2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4844	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3344	JcJovPG.exe
4736	eQGloAf.exe
2472	nNvvyjv.exe
4572	UIeJAlY.exe
4624	utWyQQR.exe
1912	mbTPjAy.exe
2304	mmtzgDK.exe
4292	WoVvVGW.exe
2424	EQusPxA.exe
3860	xsgNWqf.exe
404	ELyoXKF.exe
4368	erzCStF.exe
1760	dzRhkES.exe
1844	ewxHskq.exe
820	kUIwAIg.exe
3976	BfbjzIy.exe
4176	baFcRUa.exe
1348	vOfTaMX.exe
2372	REKvnOg.exe
4456	KIDwxGj.exe
624	IkNvRyE.exe
4664	gjHKvuQ.exe
3176	IvZJpqp.exe
2348	EkGZIVc.exe
3640	rNsaHRW.exe
1420	RUJWByg.exe
3592	mtXoHrp.exe
3504	gPtfvUz.exe
1148	iqlktlj.exe
1908	ZSGNQSu.exe
3464	pofNMkJ.exe
2416	lRmhHzv.exe
2412	aPsuMkL.exe
3752	zOyseOg.exe
1732	PxJWIqV.exe
2740	IEuCIyV.exe
3388	gsaueiy.exe
232	NKzueHi.exe
824	MrqGOnp.exe
548	iUOUiVb.exe
4940	YrzSfuh.exe
4752	aJktpWo.exe
1896	wLsexaU.exe
4400	VXutlPS.exe
3180	pPjFprj.exe
2044	coVOVOh.exe
2548	BHgmjKU.exe
3412	XuKqXga.exe
1044	bmfVmCy.exe
5024	gDMrzKi.exe
3368	DILybGs.exe
4016	NvOAgZj.exe
528	sSFtmgh.exe
3496	yuZRdJz.exe
4852	xcRhGJD.exe
3112	eVIBcdt.exe
4616	aTVASjX.exe
4088	cEeLvsb.exe
3324	kXeHXhK.exe
4392	IgSpxKh.exe
4556	AYOQBEP.exe
4148	MeNhVIk.exe
1200	KlWGfrp.exe
1820	kTAZHDV.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3804-0-0x00007FF678ED0000-0x00007FF6792C2000-memory.dmp	upx
behavioral2/files/0x0009000000023466-5.dat	upx
behavioral2/files/0x00070000000234bc-7.dat	upx
behavioral2/files/0x00070000000234bd-22.dat	upx
behavioral2/files/0x00070000000234bf-61.dat	upx
behavioral2/files/0x00070000000234cc-94.dat	upx
behavioral2/files/0x00070000000234d7-133.dat	upx
behavioral2/files/0x00070000000234e0-190.dat	upx
behavioral2/memory/4292-453-0x00007FF765D40000-0x00007FF766132000-memory.dmp	upx
behavioral2/memory/2424-581-0x00007FF737C50000-0x00007FF738042000-memory.dmp	upx
behavioral2/memory/4368-597-0x00007FF6BF1F0000-0x00007FF6BF5E2000-memory.dmp	upx
behavioral2/memory/1844-599-0x00007FF7117C0000-0x00007FF711BB2000-memory.dmp	upx
behavioral2/memory/4176-602-0x00007FF6B73E0000-0x00007FF6B77D2000-memory.dmp	upx
behavioral2/memory/624-605-0x00007FF79EC00000-0x00007FF79EFF2000-memory.dmp	upx
behavioral2/memory/2348-608-0x00007FF7B4900000-0x00007FF7B4CF2000-memory.dmp	upx
behavioral2/memory/3344-2925-0x00007FF6D7F40000-0x00007FF6D8332000-memory.dmp	upx
behavioral2/memory/4624-2927-0x00007FF75A1F0000-0x00007FF75A5E2000-memory.dmp	upx
behavioral2/memory/4572-2929-0x00007FF70D7F0000-0x00007FF70DBE2000-memory.dmp	upx
behavioral2/memory/1912-2933-0x00007FF7BEDA0000-0x00007FF7BF192000-memory.dmp	upx
behavioral2/memory/2472-2939-0x00007FF781DC0000-0x00007FF7821B2000-memory.dmp	upx
behavioral2/memory/3860-2945-0x00007FF7CE590000-0x00007FF7CE982000-memory.dmp	upx
behavioral2/memory/404-2947-0x00007FF65B5C0000-0x00007FF65B9B2000-memory.dmp	upx
behavioral2/memory/1760-2949-0x00007FF7E4440000-0x00007FF7E4832000-memory.dmp	upx
behavioral2/memory/820-2981-0x00007FF68D2F0000-0x00007FF68D6E2000-memory.dmp	upx
behavioral2/memory/4368-3002-0x00007FF6BF1F0000-0x00007FF6BF5E2000-memory.dmp	upx
behavioral2/memory/4664-3041-0x00007FF6458E0000-0x00007FF645CD2000-memory.dmp	upx
behavioral2/memory/2348-3062-0x00007FF7B4900000-0x00007FF7B4CF2000-memory.dmp	upx
behavioral2/memory/4456-3071-0x00007FF69F3B0000-0x00007FF69F7A2000-memory.dmp	upx
behavioral2/memory/1348-3068-0x00007FF6D49F0000-0x00007FF6D4DE2000-memory.dmp	upx
behavioral2/memory/3176-3065-0x00007FF728090000-0x00007FF728482000-memory.dmp	upx
behavioral2/memory/2372-3064-0x00007FF7F4000000-0x00007FF7F43F2000-memory.dmp	upx
behavioral2/memory/4176-3060-0x00007FF6B73E0000-0x00007FF6B77D2000-memory.dmp	upx
behavioral2/memory/624-3039-0x00007FF79EC00000-0x00007FF79EFF2000-memory.dmp	upx
behavioral2/memory/3976-3001-0x00007FF7273B0000-0x00007FF7277A2000-memory.dmp	upx
behavioral2/memory/2424-2943-0x00007FF737C50000-0x00007FF738042000-memory.dmp	upx
behavioral2/memory/1844-2941-0x00007FF7117C0000-0x00007FF711BB2000-memory.dmp	upx
behavioral2/memory/4292-2937-0x00007FF765D40000-0x00007FF766132000-memory.dmp	upx
behavioral2/memory/2304-2935-0x00007FF605230000-0x00007FF605622000-memory.dmp	upx
behavioral2/memory/4736-2931-0x00007FF6558F0000-0x00007FF655CE2000-memory.dmp	upx
behavioral2/memory/4456-833-0x00007FF69F3B0000-0x00007FF69F7A2000-memory.dmp	upx
behavioral2/memory/4736-832-0x00007FF6558F0000-0x00007FF655CE2000-memory.dmp	upx
behavioral2/memory/3176-607-0x00007FF728090000-0x00007FF728482000-memory.dmp	upx
behavioral2/memory/4664-606-0x00007FF6458E0000-0x00007FF645CD2000-memory.dmp	upx
behavioral2/memory/2372-604-0x00007FF7F4000000-0x00007FF7F43F2000-memory.dmp	upx
behavioral2/memory/1348-603-0x00007FF6D49F0000-0x00007FF6D4DE2000-memory.dmp	upx
behavioral2/memory/3976-601-0x00007FF7273B0000-0x00007FF7277A2000-memory.dmp	upx
behavioral2/memory/820-600-0x00007FF68D2F0000-0x00007FF68D6E2000-memory.dmp	upx
behavioral2/memory/1760-598-0x00007FF7E4440000-0x00007FF7E4832000-memory.dmp	upx
behavioral2/memory/404-596-0x00007FF65B5C0000-0x00007FF65B9B2000-memory.dmp	upx
behavioral2/memory/3860-595-0x00007FF7CE590000-0x00007FF7CE982000-memory.dmp	upx
behavioral2/memory/2304-360-0x00007FF605230000-0x00007FF605622000-memory.dmp	upx
behavioral2/memory/1912-328-0x00007FF7BEDA0000-0x00007FF7BF192000-memory.dmp	upx
behavioral2/memory/4624-265-0x00007FF75A1F0000-0x00007FF75A5E2000-memory.dmp	upx
behavioral2/files/0x00070000000234e6-217.dat	upx
behavioral2/files/0x00070000000234cf-209.dat	upx
behavioral2/files/0x00070000000234da-208.dat	upx
behavioral2/files/0x00070000000234e4-205.dat	upx
behavioral2/files/0x00070000000234e3-204.dat	upx
behavioral2/files/0x00070000000234e1-199.dat	upx
behavioral2/files/0x00070000000234df-189.dat	upx
behavioral2/files/0x00070000000234d4-188.dat	upx
behavioral2/files/0x00070000000234de-170.dat	upx
behavioral2/files/0x00070000000234dd-166.dat	upx
behavioral2/files/0x00070000000234c9-164.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ayCeUFq.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\zZMQssK.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\mnnkHir.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\jMAvBzQ.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\iRKWfTy.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\YKOxpjX.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\jxctycJ.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\trwlmSH.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\RyAxUUa.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\rNsaHRW.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\cQebhJQ.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\xDTYpex.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\UdixTlO.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\SHSNTRl.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\cYLTfkn.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\jXxDUML.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\EbiGnMY.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\LdvPrJb.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\CTRoQgv.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\gyYViSN.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\bYBzxEK.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\PPsvgvU.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\vjpqAbU.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\CKkiXMN.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\gDcXRSn.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\AFhatCg.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\HFSUVsd.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\PSwKAtn.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\RJwZsnC.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\qytJrxg.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\PKWnChH.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\ddrtcOL.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\PsTHKVf.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\fANxxCS.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\SGzlyvp.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\cGvPfdT.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\pdjPsTc.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\QSzyENb.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\rKCjcRT.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\mzwQjqR.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\irTYJNm.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\xedzsTW.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\PjBDSgr.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\aOxSuEM.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\mcAKpjf.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\NJablVw.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\dcvXMge.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\EYcWNUC.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\IjBsjAT.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\GbhpFPs.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\WRWJbqJ.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\thyHBbl.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\ZuWsPok.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\sSFtmgh.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\UmjItjn.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\HmrPbQE.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\bLJtqsZ.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\RReeTOv.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\UJSSxjq.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\nlgENCM.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\okAeCyK.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\CWgKRAK.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\CHIsobH.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
File created	C:\Windows\System\TOWvajO.exe	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
Token: SeDebugPrivilege	4844	powershell.exe
Token: SeLockMemoryPrivilege	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3804 wrote to memory of 4844	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	85
PID 3804 wrote to memory of 4844	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	85
PID 3804 wrote to memory of 3344	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	86
PID 3804 wrote to memory of 3344	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	86
PID 3804 wrote to memory of 2472	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	87
PID 3804 wrote to memory of 2472	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	87
PID 3804 wrote to memory of 4736	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	88
PID 3804 wrote to memory of 4736	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	88
PID 3804 wrote to memory of 4572	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	89
PID 3804 wrote to memory of 4572	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	89
PID 3804 wrote to memory of 4624	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	90
PID 3804 wrote to memory of 4624	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	90
PID 3804 wrote to memory of 1912	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	91
PID 3804 wrote to memory of 1912	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	91
PID 3804 wrote to memory of 2304	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	92
PID 3804 wrote to memory of 2304	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	92
PID 3804 wrote to memory of 4292	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	93
PID 3804 wrote to memory of 4292	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	93
PID 3804 wrote to memory of 2424	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	94
PID 3804 wrote to memory of 2424	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	94
PID 3804 wrote to memory of 3860	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	95
PID 3804 wrote to memory of 3860	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	95
PID 3804 wrote to memory of 404	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	96
PID 3804 wrote to memory of 404	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	96
PID 3804 wrote to memory of 4368	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	97
PID 3804 wrote to memory of 4368	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	97
PID 3804 wrote to memory of 1760	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	98
PID 3804 wrote to memory of 1760	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	98
PID 3804 wrote to memory of 1844	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	99
PID 3804 wrote to memory of 1844	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	99
PID 3804 wrote to memory of 820	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	100
PID 3804 wrote to memory of 820	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	100
PID 3804 wrote to memory of 3976	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	101
PID 3804 wrote to memory of 3976	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	101
PID 3804 wrote to memory of 4176	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	102
PID 3804 wrote to memory of 4176	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	102
PID 3804 wrote to memory of 1348	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	103
PID 3804 wrote to memory of 1348	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	103
PID 3804 wrote to memory of 2372	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	104
PID 3804 wrote to memory of 2372	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	104
PID 3804 wrote to memory of 1420	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	105
PID 3804 wrote to memory of 1420	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	105
PID 3804 wrote to memory of 4456	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	106
PID 3804 wrote to memory of 4456	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	106
PID 3804 wrote to memory of 624	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	107
PID 3804 wrote to memory of 624	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	107
PID 3804 wrote to memory of 4664	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	108
PID 3804 wrote to memory of 4664	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	108
PID 3804 wrote to memory of 3176	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	109
PID 3804 wrote to memory of 3176	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	109
PID 3804 wrote to memory of 2348	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	110
PID 3804 wrote to memory of 2348	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	110
PID 3804 wrote to memory of 3640	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	111
PID 3804 wrote to memory of 3640	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	111
PID 3804 wrote to memory of 3388	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	112
PID 3804 wrote to memory of 3388	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	112
PID 3804 wrote to memory of 3592	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	113
PID 3804 wrote to memory of 3592	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	113
PID 3804 wrote to memory of 3504	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	114
PID 3804 wrote to memory of 3504	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	114
PID 3804 wrote to memory of 1148	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	115
PID 3804 wrote to memory of 1148	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	115
PID 3804 wrote to memory of 1908	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	116
PID 3804 wrote to memory of 1908	3804	04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\04f4c160684d6bcad7cba7bc8dc41d26_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4844
- C:\Windows\System\JcJovPG.exe
  C:\Windows\System\JcJovPG.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System\nNvvyjv.exe
  C:\Windows\System\nNvvyjv.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\eQGloAf.exe
  C:\Windows\System\eQGloAf.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\UIeJAlY.exe
  C:\Windows\System\UIeJAlY.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\utWyQQR.exe
  C:\Windows\System\utWyQQR.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\mbTPjAy.exe
  C:\Windows\System\mbTPjAy.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\mmtzgDK.exe
  C:\Windows\System\mmtzgDK.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\WoVvVGW.exe
  C:\Windows\System\WoVvVGW.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\EQusPxA.exe
  C:\Windows\System\EQusPxA.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\xsgNWqf.exe
  C:\Windows\System\xsgNWqf.exe
  2⤵
  - Executes dropped EXE
  PID:3860
- C:\Windows\System\ELyoXKF.exe
  C:\Windows\System\ELyoXKF.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\erzCStF.exe
  C:\Windows\System\erzCStF.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\dzRhkES.exe
  C:\Windows\System\dzRhkES.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\ewxHskq.exe
  C:\Windows\System\ewxHskq.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\kUIwAIg.exe
  C:\Windows\System\kUIwAIg.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\BfbjzIy.exe
  C:\Windows\System\BfbjzIy.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\baFcRUa.exe
  C:\Windows\System\baFcRUa.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\vOfTaMX.exe
  C:\Windows\System\vOfTaMX.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\REKvnOg.exe
  C:\Windows\System\REKvnOg.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\RUJWByg.exe
  C:\Windows\System\RUJWByg.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\KIDwxGj.exe
  C:\Windows\System\KIDwxGj.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\IkNvRyE.exe
  C:\Windows\System\IkNvRyE.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\gjHKvuQ.exe
  C:\Windows\System\gjHKvuQ.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\IvZJpqp.exe
  C:\Windows\System\IvZJpqp.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\EkGZIVc.exe
  C:\Windows\System\EkGZIVc.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\rNsaHRW.exe
  C:\Windows\System\rNsaHRW.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\gsaueiy.exe
  C:\Windows\System\gsaueiy.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\mtXoHrp.exe
  C:\Windows\System\mtXoHrp.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\gPtfvUz.exe
  C:\Windows\System\gPtfvUz.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\iqlktlj.exe
  C:\Windows\System\iqlktlj.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\ZSGNQSu.exe
  C:\Windows\System\ZSGNQSu.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\pofNMkJ.exe
  C:\Windows\System\pofNMkJ.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\lRmhHzv.exe
  C:\Windows\System\lRmhHzv.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\aPsuMkL.exe
  C:\Windows\System\aPsuMkL.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\zOyseOg.exe
  C:\Windows\System\zOyseOg.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\PxJWIqV.exe
  C:\Windows\System\PxJWIqV.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\IEuCIyV.exe
  C:\Windows\System\IEuCIyV.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\NKzueHi.exe
  C:\Windows\System\NKzueHi.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\MrqGOnp.exe
  C:\Windows\System\MrqGOnp.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\iUOUiVb.exe
  C:\Windows\System\iUOUiVb.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\bmfVmCy.exe
  C:\Windows\System\bmfVmCy.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\YrzSfuh.exe
  C:\Windows\System\YrzSfuh.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\aJktpWo.exe
  C:\Windows\System\aJktpWo.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\NvOAgZj.exe
  C:\Windows\System\NvOAgZj.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\wLsexaU.exe
  C:\Windows\System\wLsexaU.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\VXutlPS.exe
  C:\Windows\System\VXutlPS.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\pPjFprj.exe
  C:\Windows\System\pPjFprj.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\YYHUSyX.exe
  C:\Windows\System\YYHUSyX.exe
  2⤵
  PID:928
- C:\Windows\System\oinarHY.exe
  C:\Windows\System\oinarHY.exe
  2⤵
  PID:3872
- C:\Windows\System\coVOVOh.exe
  C:\Windows\System\coVOVOh.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\BHgmjKU.exe
  C:\Windows\System\BHgmjKU.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\GxrhFcv.exe
  C:\Windows\System\GxrhFcv.exe
  2⤵
  PID:1160
- C:\Windows\System\LeOLzAq.exe
  C:\Windows\System\LeOLzAq.exe
  2⤵
  PID:1488
- C:\Windows\System\XuKqXga.exe
  C:\Windows\System\XuKqXga.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\gDMrzKi.exe
  C:\Windows\System\gDMrzKi.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\DILybGs.exe
  C:\Windows\System\DILybGs.exe
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Windows\System\sSFtmgh.exe
  C:\Windows\System\sSFtmgh.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\yuZRdJz.exe
  C:\Windows\System\yuZRdJz.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\xcRhGJD.exe
  C:\Windows\System\xcRhGJD.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\eVIBcdt.exe
  C:\Windows\System\eVIBcdt.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\aTVASjX.exe
  C:\Windows\System\aTVASjX.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\cEeLvsb.exe
  C:\Windows\System\cEeLvsb.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\kXeHXhK.exe
  C:\Windows\System\kXeHXhK.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\IgSpxKh.exe
  C:\Windows\System\IgSpxKh.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\AYOQBEP.exe
  C:\Windows\System\AYOQBEP.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\MeNhVIk.exe
  C:\Windows\System\MeNhVIk.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\KlWGfrp.exe
  C:\Windows\System\KlWGfrp.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\kTAZHDV.exe
  C:\Windows\System\kTAZHDV.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\qytJrxg.exe
  C:\Windows\System\qytJrxg.exe
  2⤵
  PID:2216
- C:\Windows\System\uqaCYBf.exe
  C:\Windows\System\uqaCYBf.exe
  2⤵
  PID:916
- C:\Windows\System\uYVyPWm.exe
  C:\Windows\System\uYVyPWm.exe
  2⤵
  PID:3788
- C:\Windows\System\DrVEQkT.exe
  C:\Windows\System\DrVEQkT.exe
  2⤵
  PID:3360
- C:\Windows\System\FipRlUS.exe
  C:\Windows\System\FipRlUS.exe
  2⤵
  PID:4704
- C:\Windows\System\SjDgcbF.exe
  C:\Windows\System\SjDgcbF.exe
  2⤵
  PID:4312
- C:\Windows\System\aFMFqvu.exe
  C:\Windows\System\aFMFqvu.exe
  2⤵
  PID:720
- C:\Windows\System\CrkXbsE.exe
  C:\Windows\System\CrkXbsE.exe
  2⤵
  PID:1292
- C:\Windows\System\GImzCjQ.exe
  C:\Windows\System\GImzCjQ.exe
  2⤵
  PID:2332
- C:\Windows\System\Qggihrn.exe
  C:\Windows\System\Qggihrn.exe
  2⤵
  PID:2288
- C:\Windows\System\bhPzWUU.exe
  C:\Windows\System\bhPzWUU.exe
  2⤵
  PID:4620
- C:\Windows\System\jKcKMQs.exe
  C:\Windows\System\jKcKMQs.exe
  2⤵
  PID:4920
- C:\Windows\System\BpCnelc.exe
  C:\Windows\System\BpCnelc.exe
  2⤵
  PID:4924
- C:\Windows\System\fldCaRC.exe
  C:\Windows\System\fldCaRC.exe
  2⤵
  PID:4364
- C:\Windows\System\WoZckiG.exe
  C:\Windows\System\WoZckiG.exe
  2⤵
  PID:1108
- C:\Windows\System\acWPijk.exe
  C:\Windows\System\acWPijk.exe
  2⤵
  PID:5136
- C:\Windows\System\lpuDORT.exe
  C:\Windows\System\lpuDORT.exe
  2⤵
  PID:5160
- C:\Windows\System\vqAlZdq.exe
  C:\Windows\System\vqAlZdq.exe
  2⤵
  PID:5176
- C:\Windows\System\odhumgC.exe
  C:\Windows\System\odhumgC.exe
  2⤵
  PID:5204
- C:\Windows\System\RsybEdE.exe
  C:\Windows\System\RsybEdE.exe
  2⤵
  PID:5220
- C:\Windows\System\RZueqyY.exe
  C:\Windows\System\RZueqyY.exe
  2⤵
  PID:5240
- C:\Windows\System\xilPOXz.exe
  C:\Windows\System\xilPOXz.exe
  2⤵
  PID:5264
- C:\Windows\System\yNWdDwa.exe
  C:\Windows\System\yNWdDwa.exe
  2⤵
  PID:5280
- C:\Windows\System\CcihBAy.exe
  C:\Windows\System\CcihBAy.exe
  2⤵
  PID:5304
- C:\Windows\System\xeXaRLm.exe
  C:\Windows\System\xeXaRLm.exe
  2⤵
  PID:5320
- C:\Windows\System\wZZTOOi.exe
  C:\Windows\System\wZZTOOi.exe
  2⤵
  PID:5344
- C:\Windows\System\YpaLpLu.exe
  C:\Windows\System\YpaLpLu.exe
  2⤵
  PID:5368
- C:\Windows\System\xjrkwOM.exe
  C:\Windows\System\xjrkwOM.exe
  2⤵
  PID:5388
- C:\Windows\System\VFaRFEn.exe
  C:\Windows\System\VFaRFEn.exe
  2⤵
  PID:5412
- C:\Windows\System\ctlVVTh.exe
  C:\Windows\System\ctlVVTh.exe
  2⤵
  PID:5428
- C:\Windows\System\IHClrun.exe
  C:\Windows\System\IHClrun.exe
  2⤵
  PID:5452
- C:\Windows\System\vICGRIp.exe
  C:\Windows\System\vICGRIp.exe
  2⤵
  PID:5476
- C:\Windows\System\HXrfnOD.exe
  C:\Windows\System\HXrfnOD.exe
  2⤵
  PID:5492
- C:\Windows\System\VoJAgUT.exe
  C:\Windows\System\VoJAgUT.exe
  2⤵
  PID:5512
- C:\Windows\System\VuzzRIv.exe
  C:\Windows\System\VuzzRIv.exe
  2⤵
  PID:5532
- C:\Windows\System\hARuXRZ.exe
  C:\Windows\System\hARuXRZ.exe
  2⤵
  PID:5552
- C:\Windows\System\KMuwwnC.exe
  C:\Windows\System\KMuwwnC.exe
  2⤵
  PID:5568
- C:\Windows\System\ZEjTeyr.exe
  C:\Windows\System\ZEjTeyr.exe
  2⤵
  PID:5600
- C:\Windows\System\gVEspiI.exe
  C:\Windows\System\gVEspiI.exe
  2⤵
  PID:5628
- C:\Windows\System\jkEPMKo.exe
  C:\Windows\System\jkEPMKo.exe
  2⤵
  PID:5708
- C:\Windows\System\vFZcleD.exe
  C:\Windows\System\vFZcleD.exe
  2⤵
  PID:5724
- C:\Windows\System\BXqiskh.exe
  C:\Windows\System\BXqiskh.exe
  2⤵
  PID:5752
- C:\Windows\System\uvRgozm.exe
  C:\Windows\System\uvRgozm.exe
  2⤵
  PID:5772
- C:\Windows\System\NZVVDxo.exe
  C:\Windows\System\NZVVDxo.exe
  2⤵
  PID:5792
- C:\Windows\System\qIvNNlR.exe
  C:\Windows\System\qIvNNlR.exe
  2⤵
  PID:5812
- C:\Windows\System\OLbdfst.exe
  C:\Windows\System\OLbdfst.exe
  2⤵
  PID:5832
- C:\Windows\System\QLPfzHy.exe
  C:\Windows\System\QLPfzHy.exe
  2⤵
  PID:5868
- C:\Windows\System\jQaibov.exe
  C:\Windows\System\jQaibov.exe
  2⤵
  PID:5888
- C:\Windows\System\dZjEhyh.exe
  C:\Windows\System\dZjEhyh.exe
  2⤵
  PID:5908
- C:\Windows\System\PPsvgvU.exe
  C:\Windows\System\PPsvgvU.exe
  2⤵
  PID:5924
- C:\Windows\System\GBiAiqe.exe
  C:\Windows\System\GBiAiqe.exe
  2⤵
  PID:5948
- C:\Windows\System\awQdMaM.exe
  C:\Windows\System\awQdMaM.exe
  2⤵
  PID:5972
- C:\Windows\System\HIpssvq.exe
  C:\Windows\System\HIpssvq.exe
  2⤵
  PID:5992
- C:\Windows\System\nakAFif.exe
  C:\Windows\System\nakAFif.exe
  2⤵
  PID:6012
- C:\Windows\System\DLgDjuS.exe
  C:\Windows\System\DLgDjuS.exe
  2⤵
  PID:6028
- C:\Windows\System\YSbMWBo.exe
  C:\Windows\System\YSbMWBo.exe
  2⤵
  PID:6052
- C:\Windows\System\kOPbmHb.exe
  C:\Windows\System\kOPbmHb.exe
  2⤵
  PID:6068
- C:\Windows\System\AwXwDjx.exe
  C:\Windows\System\AwXwDjx.exe
  2⤵
  PID:6092
- C:\Windows\System\HVJMxpi.exe
  C:\Windows\System\HVJMxpi.exe
  2⤵
  PID:6116
- C:\Windows\System\jSsndDq.exe
  C:\Windows\System\jSsndDq.exe
  2⤵
  PID:6136
- C:\Windows\System\jDdXJMU.exe
  C:\Windows\System\jDdXJMU.exe
  2⤵
  PID:4008
- C:\Windows\System\XvOhtoX.exe
  C:\Windows\System\XvOhtoX.exe
  2⤵
  PID:5068
- C:\Windows\System\wOphrIx.exe
  C:\Windows\System\wOphrIx.exe
  2⤵
  PID:3424
- C:\Windows\System\gpAdZYa.exe
  C:\Windows\System\gpAdZYa.exe
  2⤵
  PID:4680
- C:\Windows\System\pUcEiIy.exe
  C:\Windows\System\pUcEiIy.exe
  2⤵
  PID:4764
- C:\Windows\System\fYqEDbc.exe
  C:\Windows\System\fYqEDbc.exe
  2⤵
  PID:3124
- C:\Windows\System\WYXJYKy.exe
  C:\Windows\System\WYXJYKy.exe
  2⤵
  PID:1476
- C:\Windows\System\DSoGPte.exe
  C:\Windows\System\DSoGPte.exe
  2⤵
  PID:5524
- C:\Windows\System\TVNCKHP.exe
  C:\Windows\System\TVNCKHP.exe
  2⤵
  PID:3980
- C:\Windows\System\Gflnrmi.exe
  C:\Windows\System\Gflnrmi.exe
  2⤵
  PID:4748
- C:\Windows\System\LouLrzN.exe
  C:\Windows\System\LouLrzN.exe
  2⤵
  PID:1648
- C:\Windows\System\GeqErnP.exe
  C:\Windows\System\GeqErnP.exe
  2⤵
  PID:5592
- C:\Windows\System\OijaMYL.exe
  C:\Windows\System\OijaMYL.exe
  2⤵
  PID:6148
- C:\Windows\System\KZsQIuY.exe
  C:\Windows\System\KZsQIuY.exe
  2⤵
  PID:6164
- C:\Windows\System\gVUhuAD.exe
  C:\Windows\System\gVUhuAD.exe
  2⤵
  PID:6188
- C:\Windows\System\PlvGCKs.exe
  C:\Windows\System\PlvGCKs.exe
  2⤵
  PID:6204
- C:\Windows\System\vyimpbx.exe
  C:\Windows\System\vyimpbx.exe
  2⤵
  PID:6232
- C:\Windows\System\yjIHqsu.exe
  C:\Windows\System\yjIHqsu.exe
  2⤵
  PID:6252
- C:\Windows\System\PMflWAJ.exe
  C:\Windows\System\PMflWAJ.exe
  2⤵
  PID:6268
- C:\Windows\System\wLgwpAH.exe
  C:\Windows\System\wLgwpAH.exe
  2⤵
  PID:6292
- C:\Windows\System\SuNjlbZ.exe
  C:\Windows\System\SuNjlbZ.exe
  2⤵
  PID:6308
- C:\Windows\System\vjpqAbU.exe
  C:\Windows\System\vjpqAbU.exe
  2⤵
  PID:6380
- C:\Windows\System\sdkJchb.exe
  C:\Windows\System\sdkJchb.exe
  2⤵
  PID:6404
- C:\Windows\System\ZcKTUtM.exe
  C:\Windows\System\ZcKTUtM.exe
  2⤵
  PID:6424
- C:\Windows\System\jkbzPDw.exe
  C:\Windows\System\jkbzPDw.exe
  2⤵
  PID:6464
- C:\Windows\System\eUmxuWW.exe
  C:\Windows\System\eUmxuWW.exe
  2⤵
  PID:6480
- C:\Windows\System\gCiJsYz.exe
  C:\Windows\System\gCiJsYz.exe
  2⤵
  PID:6508
- C:\Windows\System\eGVyyyT.exe
  C:\Windows\System\eGVyyyT.exe
  2⤵
  PID:6532
- C:\Windows\System\wNVuoXb.exe
  C:\Windows\System\wNVuoXb.exe
  2⤵
  PID:6552
- C:\Windows\System\aHnJanJ.exe
  C:\Windows\System\aHnJanJ.exe
  2⤵
  PID:6580
- C:\Windows\System\ojvspwC.exe
  C:\Windows\System\ojvspwC.exe
  2⤵
  PID:6596
- C:\Windows\System\UvnsdCM.exe
  C:\Windows\System\UvnsdCM.exe
  2⤵
  PID:6620
- C:\Windows\System\UqwovJo.exe
  C:\Windows\System\UqwovJo.exe
  2⤵
  PID:6644
- C:\Windows\System\tubVoYJ.exe
  C:\Windows\System\tubVoYJ.exe
  2⤵
  PID:6664
- C:\Windows\System\cgBoCIA.exe
  C:\Windows\System\cgBoCIA.exe
  2⤵
  PID:6688
- C:\Windows\System\cEdmkBu.exe
  C:\Windows\System\cEdmkBu.exe
  2⤵
  PID:6716
- C:\Windows\System\gPIJzcE.exe
  C:\Windows\System\gPIJzcE.exe
  2⤵
  PID:6736
- C:\Windows\System\mNImdiE.exe
  C:\Windows\System\mNImdiE.exe
  2⤵
  PID:6756
- C:\Windows\System\QzSUKyg.exe
  C:\Windows\System\QzSUKyg.exe
  2⤵
  PID:6772
- C:\Windows\System\CfsgZbF.exe
  C:\Windows\System\CfsgZbF.exe
  2⤵
  PID:6796
- C:\Windows\System\GVnrbkK.exe
  C:\Windows\System\GVnrbkK.exe
  2⤵
  PID:6812
- C:\Windows\System\YiYtlVK.exe
  C:\Windows\System\YiYtlVK.exe
  2⤵
  PID:6832
- C:\Windows\System\LKwxChm.exe
  C:\Windows\System\LKwxChm.exe
  2⤵
  PID:6856
- C:\Windows\System\SgDxYkh.exe
  C:\Windows\System\SgDxYkh.exe
  2⤵
  PID:6872
- C:\Windows\System\PjBDSgr.exe
  C:\Windows\System\PjBDSgr.exe
  2⤵
  PID:6900
- C:\Windows\System\NynFDlE.exe
  C:\Windows\System\NynFDlE.exe
  2⤵
  PID:6916
- C:\Windows\System\OWVGNft.exe
  C:\Windows\System\OWVGNft.exe
  2⤵
  PID:6936
- C:\Windows\System\VXzoFuC.exe
  C:\Windows\System\VXzoFuC.exe
  2⤵
  PID:6952
- C:\Windows\System\lgqDWLO.exe
  C:\Windows\System\lgqDWLO.exe
  2⤵
  PID:6972
- C:\Windows\System\aFqmhQm.exe
  C:\Windows\System\aFqmhQm.exe
  2⤵
  PID:6992
- C:\Windows\System\KfNZXGH.exe
  C:\Windows\System\KfNZXGH.exe
  2⤵
  PID:7012
- C:\Windows\System\dRLGAhi.exe
  C:\Windows\System\dRLGAhi.exe
  2⤵
  PID:7036
- C:\Windows\System\ikYPkfW.exe
  C:\Windows\System\ikYPkfW.exe
  2⤵
  PID:7052
- C:\Windows\System\LuoUdlt.exe
  C:\Windows\System\LuoUdlt.exe
  2⤵
  PID:7076
- C:\Windows\System\dKqoTCV.exe
  C:\Windows\System\dKqoTCV.exe
  2⤵
  PID:7096
- C:\Windows\System\zJYByLx.exe
  C:\Windows\System\zJYByLx.exe
  2⤵
  PID:7116
- C:\Windows\System\bQbesOI.exe
  C:\Windows\System\bQbesOI.exe
  2⤵
  PID:7140
- C:\Windows\System\PJKVJFY.exe
  C:\Windows\System\PJKVJFY.exe
  2⤵
  PID:7156
- C:\Windows\System\ollmdqe.exe
  C:\Windows\System\ollmdqe.exe
  2⤵
  PID:2436
- C:\Windows\System\Ldsqqkv.exe
  C:\Windows\System\Ldsqqkv.exe
  2⤵
  PID:3196
- C:\Windows\System\UNAErBB.exe
  C:\Windows\System\UNAErBB.exe
  2⤵
  PID:664
- C:\Windows\System\FaKzGex.exe
  C:\Windows\System\FaKzGex.exe
  2⤵
  PID:1628
- C:\Windows\System\betJDiq.exe
  C:\Windows\System\betJDiq.exe
  2⤵
  PID:2156
- C:\Windows\System\BLBdnTC.exe
  C:\Windows\System\BLBdnTC.exe
  2⤵
  PID:3984
- C:\Windows\System\rXeCXNA.exe
  C:\Windows\System\rXeCXNA.exe
  2⤵
  PID:5488
- C:\Windows\System\BBTFmCL.exe
  C:\Windows\System\BBTFmCL.exe
  2⤵
  PID:2824
- C:\Windows\System\CHIsobH.exe
  C:\Windows\System\CHIsobH.exe
  2⤵
  PID:6048
- C:\Windows\System\qtRUCOq.exe
  C:\Windows\System\qtRUCOq.exe
  2⤵
  PID:6132
- C:\Windows\System\WlaJylN.exe
  C:\Windows\System\WlaJylN.exe
  2⤵
  PID:512
- C:\Windows\System\gQVuBdw.exe
  C:\Windows\System\gQVuBdw.exe
  2⤵
  PID:4316
- C:\Windows\System\nPOPdJJ.exe
  C:\Windows\System\nPOPdJJ.exe
  2⤵
  PID:5636
- C:\Windows\System\Cuflrge.exe
  C:\Windows\System\Cuflrge.exe
  2⤵
  PID:4672
- C:\Windows\System\NHGmdSZ.exe
  C:\Windows\System\NHGmdSZ.exe
  2⤵
  PID:5228
- C:\Windows\System\RKAAabn.exe
  C:\Windows\System\RKAAabn.exe
  2⤵
  PID:5260
- C:\Windows\System\KjkWzpu.exe
  C:\Windows\System\KjkWzpu.exe
  2⤵
  PID:5300
- C:\Windows\System\TOWvajO.exe
  C:\Windows\System\TOWvajO.exe
  2⤵
  PID:5732
- C:\Windows\System\EwfFTjo.exe
  C:\Windows\System\EwfFTjo.exe
  2⤵
  PID:5764
- C:\Windows\System\IVeBBJF.exe
  C:\Windows\System\IVeBBJF.exe
  2⤵
  PID:5800
- C:\Windows\System\lGiWxEx.exe
  C:\Windows\System\lGiWxEx.exe
  2⤵
  PID:5840
- C:\Windows\System\mdvLFKC.exe
  C:\Windows\System\mdvLFKC.exe
  2⤵
  PID:5904
- C:\Windows\System\KNvTAtS.exe
  C:\Windows\System\KNvTAtS.exe
  2⤵
  PID:5960
- C:\Windows\System\IpmEaBY.exe
  C:\Windows\System\IpmEaBY.exe
  2⤵
  PID:6004
- C:\Windows\System\JkFwdhS.exe
  C:\Windows\System\JkFwdhS.exe
  2⤵
  PID:6088
- C:\Windows\System\rHEQPMG.exe
  C:\Windows\System\rHEQPMG.exe
  2⤵
  PID:1224
- C:\Windows\System\xbMEAyY.exe
  C:\Windows\System\xbMEAyY.exe
  2⤵
  PID:6684
- C:\Windows\System\nBjqGWR.exe
  C:\Windows\System\nBjqGWR.exe
  2⤵
  PID:4264
- C:\Windows\System\BCFTBTw.exe
  C:\Windows\System\BCFTBTw.exe
  2⤵
  PID:6184
- C:\Windows\System\PNpXQke.exe
  C:\Windows\System\PNpXQke.exe
  2⤵
  PID:6240
- C:\Windows\System\lJeunYT.exe
  C:\Windows\System\lJeunYT.exe
  2⤵
  PID:6264
- C:\Windows\System\VCWIvEG.exe
  C:\Windows\System\VCWIvEG.exe
  2⤵
  PID:6348
- C:\Windows\System\zOyfirj.exe
  C:\Windows\System\zOyfirj.exe
  2⤵
  PID:6396
- C:\Windows\System\XGzJhbU.exe
  C:\Windows\System\XGzJhbU.exe
  2⤵
  PID:6432
- C:\Windows\System\ugeDXeN.exe
  C:\Windows\System\ugeDXeN.exe
  2⤵
  PID:6476
- C:\Windows\System\FWCqQIk.exe
  C:\Windows\System\FWCqQIk.exe
  2⤵
  PID:6520
- C:\Windows\System\gXmArRS.exe
  C:\Windows\System\gXmArRS.exe
  2⤵
  PID:6544
- C:\Windows\System\ZGHKnhi.exe
  C:\Windows\System\ZGHKnhi.exe
  2⤵
  PID:6612
- C:\Windows\System\ICLeyKY.exe
  C:\Windows\System\ICLeyKY.exe
  2⤵
  PID:6636
- C:\Windows\System\scwJrim.exe
  C:\Windows\System\scwJrim.exe
  2⤵
  PID:6732
- C:\Windows\System\GxYcZoH.exe
  C:\Windows\System\GxYcZoH.exe
  2⤵
  PID:7060
- C:\Windows\System\pgtQaLa.exe
  C:\Windows\System\pgtQaLa.exe
  2⤵
  PID:1268
- C:\Windows\System\ZOYVDsp.exe
  C:\Windows\System\ZOYVDsp.exe
  2⤵
  PID:6104
- C:\Windows\System\MsNLcHQ.exe
  C:\Windows\System\MsNLcHQ.exe
  2⤵
  PID:5152
- C:\Windows\System\fruAhcS.exe
  C:\Windows\System\fruAhcS.exe
  2⤵
  PID:6744
- C:\Windows\System\WPTALDG.exe
  C:\Windows\System\WPTALDG.exe
  2⤵
  PID:6824
- C:\Windows\System\nDSUWVl.exe
  C:\Windows\System\nDSUWVl.exe
  2⤵
  PID:6880
- C:\Windows\System\iAEAABC.exe
  C:\Windows\System\iAEAABC.exe
  2⤵
  PID:6964
- C:\Windows\System\izLzjyh.exe
  C:\Windows\System\izLzjyh.exe
  2⤵
  PID:7048
- C:\Windows\System\BBMyada.exe
  C:\Windows\System\BBMyada.exe
  2⤵
  PID:7020
- C:\Windows\System\rFxogEZ.exe
  C:\Windows\System\rFxogEZ.exe
  2⤵
  PID:1832
- C:\Windows\System\CHiYfiv.exe
  C:\Windows\System\CHiYfiv.exe
  2⤵
  PID:3680
- C:\Windows\System\YWKKdLT.exe
  C:\Windows\System\YWKKdLT.exe
  2⤵
  PID:2964
- C:\Windows\System\nEsTota.exe
  C:\Windows\System\nEsTota.exe
  2⤵
  PID:7184
- C:\Windows\System\oypQmRT.exe
  C:\Windows\System\oypQmRT.exe
  2⤵
  PID:7200
- C:\Windows\System\ZgvtRSE.exe
  C:\Windows\System\ZgvtRSE.exe
  2⤵
  PID:7224
- C:\Windows\System\mXHocgh.exe
  C:\Windows\System\mXHocgh.exe
  2⤵
  PID:7240
- C:\Windows\System\AtqFvex.exe
  C:\Windows\System\AtqFvex.exe
  2⤵
  PID:7264
- C:\Windows\System\tMoGrRw.exe
  C:\Windows\System\tMoGrRw.exe
  2⤵
  PID:7288
- C:\Windows\System\jXxDUML.exe
  C:\Windows\System\jXxDUML.exe
  2⤵
  PID:7304
- C:\Windows\System\kNYgnpk.exe
  C:\Windows\System\kNYgnpk.exe
  2⤵
  PID:7328
- C:\Windows\System\qpnGBPb.exe
  C:\Windows\System\qpnGBPb.exe
  2⤵
  PID:7352
- C:\Windows\System\kOXXbtZ.exe
  C:\Windows\System\kOXXbtZ.exe
  2⤵
  PID:7372
- C:\Windows\System\dBECGhv.exe
  C:\Windows\System\dBECGhv.exe
  2⤵
  PID:7392
- C:\Windows\System\LIjKUzg.exe
  C:\Windows\System\LIjKUzg.exe
  2⤵
  PID:7416
- C:\Windows\System\zmyTwAe.exe
  C:\Windows\System\zmyTwAe.exe
  2⤵
  PID:7432
- C:\Windows\System\cIVpVko.exe
  C:\Windows\System\cIVpVko.exe
  2⤵
  PID:7456
- C:\Windows\System\ayCeUFq.exe
  C:\Windows\System\ayCeUFq.exe
  2⤵
  PID:7476
- C:\Windows\System\XpqkejJ.exe
  C:\Windows\System\XpqkejJ.exe
  2⤵
  PID:7816
- C:\Windows\System\eUbJlcu.exe
  C:\Windows\System\eUbJlcu.exe
  2⤵
  PID:7852
- C:\Windows\System\MuMQkaf.exe
  C:\Windows\System\MuMQkaf.exe
  2⤵
  PID:7868
- C:\Windows\System\GGAqTqZ.exe
  C:\Windows\System\GGAqTqZ.exe
  2⤵
  PID:7896
- C:\Windows\System\lMbwVoq.exe
  C:\Windows\System\lMbwVoq.exe
  2⤵
  PID:7916
- C:\Windows\System\zzsipcN.exe
  C:\Windows\System\zzsipcN.exe
  2⤵
  PID:7932
- C:\Windows\System\VCRzWlu.exe
  C:\Windows\System\VCRzWlu.exe
  2⤵
  PID:7956
- C:\Windows\System\qGIqFyI.exe
  C:\Windows\System\qGIqFyI.exe
  2⤵
  PID:7972
- C:\Windows\System\gToJjhk.exe
  C:\Windows\System\gToJjhk.exe
  2⤵
  PID:7996
- C:\Windows\System\HythwFF.exe
  C:\Windows\System\HythwFF.exe
  2⤵
  PID:8020
- C:\Windows\System\oGpBHVB.exe
  C:\Windows\System\oGpBHVB.exe
  2⤵
  PID:8048
- C:\Windows\System\ayBCiqT.exe
  C:\Windows\System\ayBCiqT.exe
  2⤵
  PID:8064
- C:\Windows\System\IWCPlJw.exe
  C:\Windows\System\IWCPlJw.exe
  2⤵
  PID:8092
- C:\Windows\System\xRIWfTN.exe
  C:\Windows\System\xRIWfTN.exe
  2⤵
  PID:8116
- C:\Windows\System\tXPaXkH.exe
  C:\Windows\System\tXPaXkH.exe
  2⤵
  PID:8132
- C:\Windows\System\fPWihsN.exe
  C:\Windows\System\fPWihsN.exe
  2⤵
  PID:8160
- C:\Windows\System\zWqCmUT.exe
  C:\Windows\System\zWqCmUT.exe
  2⤵
  PID:8180
- C:\Windows\System\jkmRYER.exe
  C:\Windows\System\jkmRYER.exe
  2⤵
  PID:6944
- C:\Windows\System\azlsFvm.exe
  C:\Windows\System\azlsFvm.exe
  2⤵
  PID:7340
- C:\Windows\System\YgXPMUP.exe
  C:\Windows\System\YgXPMUP.exe
  2⤵
  PID:7384
- C:\Windows\System\HInHczx.exe
  C:\Windows\System\HInHczx.exe
  2⤵
  PID:7440
- C:\Windows\System\dCCXgBB.exe
  C:\Windows\System\dCCXgBB.exe
  2⤵
  PID:8196
- C:\Windows\System\YRSiDQG.exe
  C:\Windows\System\YRSiDQG.exe
  2⤵
  PID:8216
- C:\Windows\System\YRYxWJW.exe
  C:\Windows\System\YRYxWJW.exe
  2⤵
  PID:8236
- C:\Windows\System\iKAoRdd.exe
  C:\Windows\System\iKAoRdd.exe
  2⤵
  PID:8256
- C:\Windows\System\cmRxZMR.exe
  C:\Windows\System\cmRxZMR.exe
  2⤵
  PID:8284
- C:\Windows\System\UIHFVlu.exe
  C:\Windows\System\UIHFVlu.exe
  2⤵
  PID:8304
- C:\Windows\System\HAqAMoc.exe
  C:\Windows\System\HAqAMoc.exe
  2⤵
  PID:8324
- C:\Windows\System\OEtWtHr.exe
  C:\Windows\System\OEtWtHr.exe
  2⤵
  PID:8460
- C:\Windows\System\VJqUfJI.exe
  C:\Windows\System\VJqUfJI.exe
  2⤵
  PID:8484
- C:\Windows\System\CTHFrvR.exe
  C:\Windows\System\CTHFrvR.exe
  2⤵
  PID:8508
- C:\Windows\System\AHgeVla.exe
  C:\Windows\System\AHgeVla.exe
  2⤵
  PID:8528
- C:\Windows\System\BJKToyB.exe
  C:\Windows\System\BJKToyB.exe
  2⤵
  PID:8552
- C:\Windows\System\tuyURRG.exe
  C:\Windows\System\tuyURRG.exe
  2⤵
  PID:8580
- C:\Windows\System\xUkvxrf.exe
  C:\Windows\System\xUkvxrf.exe
  2⤵
  PID:8596
- C:\Windows\System\uFAPizl.exe
  C:\Windows\System\uFAPizl.exe
  2⤵
  PID:8616
- C:\Windows\System\nHyhAur.exe
  C:\Windows\System\nHyhAur.exe
  2⤵
  PID:8644
- C:\Windows\System\YRziPFB.exe
  C:\Windows\System\YRziPFB.exe
  2⤵
  PID:8660
- C:\Windows\System\UOEdHyR.exe
  C:\Windows\System\UOEdHyR.exe
  2⤵
  PID:8676
- C:\Windows\System\OZHniZo.exe
  C:\Windows\System\OZHniZo.exe
  2⤵
  PID:8692
- C:\Windows\System\SwYybOq.exe
  C:\Windows\System\SwYybOq.exe
  2⤵
  PID:8712
- C:\Windows\System\VnlJSJZ.exe
  C:\Windows\System\VnlJSJZ.exe
  2⤵
  PID:8732
- C:\Windows\System\QsqMTif.exe
  C:\Windows\System\QsqMTif.exe
  2⤵
  PID:8752
- C:\Windows\System\GCwBZzZ.exe
  C:\Windows\System\GCwBZzZ.exe
  2⤵
  PID:8776
- C:\Windows\System\PAnCZlb.exe
  C:\Windows\System\PAnCZlb.exe
  2⤵
  PID:8800
- C:\Windows\System\xNirmzq.exe
  C:\Windows\System\xNirmzq.exe
  2⤵
  PID:8816
- C:\Windows\System\lAtBSHd.exe
  C:\Windows\System\lAtBSHd.exe
  2⤵
  PID:8840
- C:\Windows\System\kGzWzDZ.exe
  C:\Windows\System\kGzWzDZ.exe
  2⤵
  PID:8864
- C:\Windows\System\qhJyQTV.exe
  C:\Windows\System\qhJyQTV.exe
  2⤵
  PID:8896
- C:\Windows\System\jexcgiU.exe
  C:\Windows\System\jexcgiU.exe
  2⤵
  PID:8916
- C:\Windows\System\wDzUALk.exe
  C:\Windows\System\wDzUALk.exe
  2⤵
  PID:8948
- C:\Windows\System\fSZUULI.exe
  C:\Windows\System\fSZUULI.exe
  2⤵
  PID:8968
- C:\Windows\System\IHsxuTQ.exe
  C:\Windows\System\IHsxuTQ.exe
  2⤵
  PID:8988
- C:\Windows\System\zPbUirL.exe
  C:\Windows\System\zPbUirL.exe
  2⤵
  PID:9012
- C:\Windows\System\qXcfXaM.exe
  C:\Windows\System\qXcfXaM.exe
  2⤵
  PID:9032
- C:\Windows\System\NrUOdzP.exe
  C:\Windows\System\NrUOdzP.exe
  2⤵
  PID:9064
- C:\Windows\System\wWDGGdL.exe
  C:\Windows\System\wWDGGdL.exe
  2⤵
  PID:9080
- C:\Windows\System\temEkkQ.exe
  C:\Windows\System\temEkkQ.exe
  2⤵
  PID:9124
- C:\Windows\System\GXdEhhR.exe
  C:\Windows\System\GXdEhhR.exe
  2⤵
  PID:9148
- C:\Windows\System\yNKdgYU.exe
  C:\Windows\System\yNKdgYU.exe
  2⤵
  PID:9180
- C:\Windows\System\VMAnWLw.exe
  C:\Windows\System\VMAnWLw.exe
  2⤵
  PID:9208
- C:\Windows\System\vGGbGgw.exe
  C:\Windows\System\vGGbGgw.exe
  2⤵
  PID:6948
- C:\Windows\System\FsOAvWN.exe
  C:\Windows\System\FsOAvWN.exe
  2⤵
  PID:1368
- C:\Windows\System\XlUsoIm.exe
  C:\Windows\System\XlUsoIm.exe
  2⤵
  PID:5640
- C:\Windows\System\xWZvJRY.exe
  C:\Windows\System\xWZvJRY.exe
  2⤵
  PID:7312
- C:\Windows\System\pinWvwY.exe
  C:\Windows\System\pinWvwY.exe
  2⤵
  PID:7488
- C:\Windows\System\dLspYzf.exe
  C:\Windows\System\dLspYzf.exe
  2⤵
  PID:7988
- C:\Windows\System\BgcVBjJ.exe
  C:\Windows\System\BgcVBjJ.exe
  2⤵
  PID:8072
- C:\Windows\System\oRxOeLv.exe
  C:\Windows\System\oRxOeLv.exe
  2⤵
  PID:8112
- C:\Windows\System\eYNUjGl.exe
  C:\Windows\System\eYNUjGl.exe
  2⤵
  PID:5296
- C:\Windows\System\kAqjPuM.exe
  C:\Windows\System\kAqjPuM.exe
  2⤵
  PID:7364
- C:\Windows\System\YauVdIE.exe
  C:\Windows\System\YauVdIE.exe
  2⤵
  PID:8212
- C:\Windows\System\yumFFJD.exe
  C:\Windows\System\yumFFJD.exe
  2⤵
  PID:9220
- C:\Windows\System\DpfXyJU.exe
  C:\Windows\System\DpfXyJU.exe
  2⤵
  PID:9264
- C:\Windows\System\DYWTThq.exe
  C:\Windows\System\DYWTThq.exe
  2⤵
  PID:9280
- C:\Windows\System\OqfxDAs.exe
  C:\Windows\System\OqfxDAs.exe
  2⤵
  PID:9304
- C:\Windows\System\YdLcLXo.exe
  C:\Windows\System\YdLcLXo.exe
  2⤵
  PID:9328
- C:\Windows\System\PirwbmT.exe
  C:\Windows\System\PirwbmT.exe
  2⤵
  PID:9348
- C:\Windows\System\oZiwHgv.exe
  C:\Windows\System\oZiwHgv.exe
  2⤵
  PID:9376
- C:\Windows\System\XfHtAzp.exe
  C:\Windows\System\XfHtAzp.exe
  2⤵
  PID:9396
- C:\Windows\System\JjwiGoJ.exe
  C:\Windows\System\JjwiGoJ.exe
  2⤵
  PID:9448
- C:\Windows\System\nEVgQgd.exe
  C:\Windows\System\nEVgQgd.exe
  2⤵
  PID:9464
- C:\Windows\System\uKCfAVb.exe
  C:\Windows\System\uKCfAVb.exe
  2⤵
  PID:9480
- C:\Windows\System\LjwHmik.exe
  C:\Windows\System\LjwHmik.exe
  2⤵
  PID:9496
- C:\Windows\System\zZMQssK.exe
  C:\Windows\System\zZMQssK.exe
  2⤵
  PID:9512
- C:\Windows\System\RDNlcKD.exe
  C:\Windows\System\RDNlcKD.exe
  2⤵
  PID:9528
- C:\Windows\System\hKnOncg.exe
  C:\Windows\System\hKnOncg.exe
  2⤵
  PID:9544
- C:\Windows\System\yYBvBwD.exe
  C:\Windows\System\yYBvBwD.exe
  2⤵
  PID:9564
- C:\Windows\System\gRAYzDy.exe
  C:\Windows\System\gRAYzDy.exe
  2⤵
  PID:9588
- C:\Windows\System\kmgfOPf.exe
  C:\Windows\System\kmgfOPf.exe
  2⤵
  PID:9612
- C:\Windows\System\MShjLzs.exe
  C:\Windows\System\MShjLzs.exe
  2⤵
  PID:9632
- C:\Windows\System\IqVxyuD.exe
  C:\Windows\System\IqVxyuD.exe
  2⤵
  PID:9656
- C:\Windows\System\PlIFUeW.exe
  C:\Windows\System\PlIFUeW.exe
  2⤵
  PID:9672
- C:\Windows\System\PZetQXM.exe
  C:\Windows\System\PZetQXM.exe
  2⤵
  PID:9696
- C:\Windows\System\BSzJEWP.exe
  C:\Windows\System\BSzJEWP.exe
  2⤵
  PID:9712
- C:\Windows\System\YfayECY.exe
  C:\Windows\System\YfayECY.exe
  2⤵
  PID:9740
- C:\Windows\System\KNkdAfv.exe
  C:\Windows\System\KNkdAfv.exe
  2⤵
  PID:9764
- C:\Windows\System\AVgQUYr.exe
  C:\Windows\System\AVgQUYr.exe
  2⤵
  PID:9780
- C:\Windows\System\PETcCka.exe
  C:\Windows\System\PETcCka.exe
  2⤵
  PID:9800
- C:\Windows\System\nTIraCl.exe
  C:\Windows\System\nTIraCl.exe
  2⤵
  PID:9824
- C:\Windows\System\nQYvYOd.exe
  C:\Windows\System\nQYvYOd.exe
  2⤵
  PID:9840
- C:\Windows\System\SwjTmPM.exe
  C:\Windows\System\SwjTmPM.exe
  2⤵
  PID:9872
- C:\Windows\System\FFUHFrq.exe
  C:\Windows\System\FFUHFrq.exe
  2⤵
  PID:9892
- C:\Windows\System\lsjyuPA.exe
  C:\Windows\System\lsjyuPA.exe
  2⤵
  PID:9912
- C:\Windows\System\PwLoIIr.exe
  C:\Windows\System\PwLoIIr.exe
  2⤵
  PID:9936
- C:\Windows\System\eCTviZe.exe
  C:\Windows\System\eCTviZe.exe
  2⤵
  PID:9956
- C:\Windows\System\SXvsHIO.exe
  C:\Windows\System\SXvsHIO.exe
  2⤵
  PID:9980
- C:\Windows\System\hsXiiMY.exe
  C:\Windows\System\hsXiiMY.exe
  2⤵
  PID:10008
- C:\Windows\System\jRhuHXB.exe
  C:\Windows\System\jRhuHXB.exe
  2⤵
  PID:10024
- C:\Windows\System\aTOatNu.exe
  C:\Windows\System\aTOatNu.exe
  2⤵
  PID:10048
- C:\Windows\System\eaIIgDe.exe
  C:\Windows\System\eaIIgDe.exe
  2⤵
  PID:10072
- C:\Windows\System\GbZHJsv.exe
  C:\Windows\System\GbZHJsv.exe
  2⤵
  PID:10092
- C:\Windows\System\YNZxRbr.exe
  C:\Windows\System\YNZxRbr.exe
  2⤵
  PID:10116
- C:\Windows\System\bbBKsuk.exe
  C:\Windows\System\bbBKsuk.exe
  2⤵
  PID:10140
- C:\Windows\System\NJablVw.exe
  C:\Windows\System\NJablVw.exe
  2⤵
  PID:10160
- C:\Windows\System\fxuAhRa.exe
  C:\Windows\System\fxuAhRa.exe
  2⤵
  PID:10180
- C:\Windows\System\OodiYJy.exe
  C:\Windows\System\OodiYJy.exe
  2⤵
  PID:10208
- C:\Windows\System\LHYdSkt.exe
  C:\Windows\System\LHYdSkt.exe
  2⤵
  PID:10228
- C:\Windows\System\jTstIFe.exe
  C:\Windows\System\jTstIFe.exe
  2⤵
  PID:5716
- C:\Windows\System\nlgENCM.exe
  C:\Windows\System\nlgENCM.exe
  2⤵
  PID:5808
- C:\Windows\System\IRocwtt.exe
  C:\Windows\System\IRocwtt.exe
  2⤵
  PID:5932
- C:\Windows\System\JPVvUQm.exe
  C:\Windows\System\JPVvUQm.exe
  2⤵
  PID:6084
- C:\Windows\System\wFYjmER.exe
  C:\Windows\System\wFYjmER.exe
  2⤵
  PID:6564
- C:\Windows\System\mlzxaZC.exe
  C:\Windows\System\mlzxaZC.exe
  2⤵
  PID:6712
- C:\Windows\System\hvVdeRt.exe
  C:\Windows\System\hvVdeRt.exe
  2⤵
  PID:6100
- C:\Windows\System\vbXuZoS.exe
  C:\Windows\System\vbXuZoS.exe
  2⤵
  PID:1888
- C:\Windows\System\aHKMmGT.exe
  C:\Windows\System\aHKMmGT.exe
  2⤵
  PID:5460
- C:\Windows\System\SGzlyvp.exe
  C:\Windows\System\SGzlyvp.exe
  2⤵
  PID:6840
- C:\Windows\System\ypuZSyD.exe
  C:\Windows\System\ypuZSyD.exe
  2⤵
  PID:7008
- C:\Windows\System\bzsETyI.exe
  C:\Windows\System\bzsETyI.exe
  2⤵
  PID:7152
- C:\Windows\System\LKpdboB.exe
  C:\Windows\System\LKpdboB.exe
  2⤵
  PID:8504
- C:\Windows\System\XisNnAO.exe
  C:\Windows\System\XisNnAO.exe
  2⤵
  PID:8588
- C:\Windows\System\NzzRBoO.exe
  C:\Windows\System\NzzRBoO.exe
  2⤵
  PID:8652
- C:\Windows\System\xKQEfws.exe
  C:\Windows\System\xKQEfws.exe
  2⤵
  PID:8720
- C:\Windows\System\tKYnBBY.exe
  C:\Windows\System\tKYnBBY.exe
  2⤵
  PID:4824
- C:\Windows\System\HIZMGSo.exe
  C:\Windows\System\HIZMGSo.exe
  2⤵
  PID:5596
- C:\Windows\System\VDLshFV.exe
  C:\Windows\System\VDLshFV.exe
  2⤵
  PID:7712
- C:\Windows\System\ehdVkqG.exe
  C:\Windows\System\ehdVkqG.exe
  2⤵
  PID:7232
- C:\Windows\System\wIBEagm.exe
  C:\Windows\System\wIBEagm.exe
  2⤵
  PID:7196
- C:\Windows\System\dGkBQDr.exe
  C:\Windows\System\dGkBQDr.exe
  2⤵
  PID:7272
- C:\Windows\System\zRXjeUe.exe
  C:\Windows\System\zRXjeUe.exe
  2⤵
  PID:4224
- C:\Windows\System\CpAFdyY.exe
  C:\Windows\System\CpAFdyY.exe
  2⤵
  PID:7400
- C:\Windows\System\uLGgchB.exe
  C:\Windows\System\uLGgchB.exe
  2⤵
  PID:9116
- C:\Windows\System\gJSAhKt.exe
  C:\Windows\System\gJSAhKt.exe
  2⤵
  PID:7812
- C:\Windows\System\srLIpha.exe
  C:\Windows\System\srLIpha.exe
  2⤵
  PID:7520
- C:\Windows\System\eMDpofg.exe
  C:\Windows\System\eMDpofg.exe
  2⤵
  PID:7980
- C:\Windows\System\nEUqGDe.exe
  C:\Windows\System\nEUqGDe.exe
  2⤵
  PID:8056
- C:\Windows\System\EGREYVn.exe
  C:\Windows\System\EGREYVn.exe
  2⤵
  PID:6036
- C:\Windows\System\lVBKhvU.exe
  C:\Windows\System\lVBKhvU.exe
  2⤵
  PID:7428
- C:\Windows\System\xemGOEV.exe
  C:\Windows\System\xemGOEV.exe
  2⤵
  PID:8228
- C:\Windows\System\sgpqIyd.exe
  C:\Windows\System\sgpqIyd.exe
  2⤵
  PID:5276
- C:\Windows\System\gZBcujr.exe
  C:\Windows\System\gZBcujr.exe
  2⤵
  PID:7472
- C:\Windows\System\zJObIVG.exe
  C:\Windows\System\zJObIVG.exe
  2⤵
  PID:10256
- C:\Windows\System\uDarFgB.exe
  C:\Windows\System\uDarFgB.exe
  2⤵
  PID:10280
- C:\Windows\System\ohhcqge.exe
  C:\Windows\System\ohhcqge.exe
  2⤵
  PID:10296
- C:\Windows\System\rQEkcOc.exe
  C:\Windows\System\rQEkcOc.exe
  2⤵
  PID:10400
- C:\Windows\System\TuKKgDG.exe
  C:\Windows\System\TuKKgDG.exe
  2⤵
  PID:10416
- C:\Windows\System\zjVWDZs.exe
  C:\Windows\System\zjVWDZs.exe
  2⤵
  PID:10432
- C:\Windows\System\HGDBNPG.exe
  C:\Windows\System\HGDBNPG.exe
  2⤵
  PID:10448
- C:\Windows\System\gZzkuzu.exe
  C:\Windows\System\gZzkuzu.exe
  2⤵
  PID:10464
- C:\Windows\System\srQCSlO.exe
  C:\Windows\System\srQCSlO.exe
  2⤵
  PID:10496
- C:\Windows\System\VxvQrBh.exe
  C:\Windows\System\VxvQrBh.exe
  2⤵
  PID:10512
- C:\Windows\System\JWfIqRl.exe
  C:\Windows\System\JWfIqRl.exe
  2⤵
  PID:10532
- C:\Windows\System\aVIDfnX.exe
  C:\Windows\System\aVIDfnX.exe
  2⤵
  PID:10556
- C:\Windows\System\hOWKddc.exe
  C:\Windows\System\hOWKddc.exe
  2⤵
  PID:10620
- C:\Windows\System\KtcLPCH.exe
  C:\Windows\System\KtcLPCH.exe
  2⤵
  PID:10652
- C:\Windows\System\atniHeF.exe
  C:\Windows\System\atniHeF.exe
  2⤵
  PID:10672
- C:\Windows\System\YhdoBhL.exe
  C:\Windows\System\YhdoBhL.exe
  2⤵
  PID:10692
- C:\Windows\System\AqcRECX.exe
  C:\Windows\System\AqcRECX.exe
  2⤵
  PID:10708
- C:\Windows\System\aOxSuEM.exe
  C:\Windows\System\aOxSuEM.exe
  2⤵
  PID:10728
- C:\Windows\System\cQebhJQ.exe
  C:\Windows\System\cQebhJQ.exe
  2⤵
  PID:10748
- C:\Windows\System\PyCxTby.exe
  C:\Windows\System\PyCxTby.exe
  2⤵
  PID:10768
- C:\Windows\System\JzMTGyG.exe
  C:\Windows\System\JzMTGyG.exe
  2⤵
  PID:10788
- C:\Windows\System\HTotDDy.exe
  C:\Windows\System\HTotDDy.exe
  2⤵
  PID:10808
- C:\Windows\System\Npbwcek.exe
  C:\Windows\System\Npbwcek.exe
  2⤵
  PID:10828
- C:\Windows\System\BOoESRw.exe
  C:\Windows\System\BOoESRw.exe
  2⤵
  PID:10844
- C:\Windows\System\cMHrVAg.exe
  C:\Windows\System\cMHrVAg.exe
  2⤵
  PID:10864
- C:\Windows\System\MxiJwXV.exe
  C:\Windows\System\MxiJwXV.exe
  2⤵
  PID:10884
- C:\Windows\System\OKvFIDv.exe
  C:\Windows\System\OKvFIDv.exe
  2⤵
  PID:10904
- C:\Windows\System\WwHyZCm.exe
  C:\Windows\System\WwHyZCm.exe
  2⤵
  PID:10924
- C:\Windows\System\yACZntM.exe
  C:\Windows\System\yACZntM.exe
  2⤵
  PID:10944
- C:\Windows\System\QJkOCpr.exe
  C:\Windows\System\QJkOCpr.exe
  2⤵
  PID:10960
- C:\Windows\System\xDTYpex.exe
  C:\Windows\System\xDTYpex.exe
  2⤵
  PID:10980
- C:\Windows\System\VkLdgtw.exe
  C:\Windows\System\VkLdgtw.exe
  2⤵
  PID:11000
- C:\Windows\System\RrDFsGP.exe
  C:\Windows\System\RrDFsGP.exe
  2⤵
  PID:11016
- C:\Windows\System\FcDzdqd.exe
  C:\Windows\System\FcDzdqd.exe
  2⤵
  PID:11032
- C:\Windows\System\SiwlhIR.exe
  C:\Windows\System\SiwlhIR.exe
  2⤵
  PID:11048
- C:\Windows\System\VlAuJpK.exe
  C:\Windows\System\VlAuJpK.exe
  2⤵
  PID:11076
- C:\Windows\System\gixtOBw.exe
  C:\Windows\System\gixtOBw.exe
  2⤵
  PID:11112
- C:\Windows\System\FWOoAsf.exe
  C:\Windows\System\FWOoAsf.exe
  2⤵
  PID:11136
- C:\Windows\System\ZnWxFsM.exe
  C:\Windows\System\ZnWxFsM.exe
  2⤵
  PID:11156
- C:\Windows\System\oIEFELp.exe
  C:\Windows\System\oIEFELp.exe
  2⤵
  PID:11176
- C:\Windows\System\NDJyWbJ.exe
  C:\Windows\System\NDJyWbJ.exe
  2⤵
  PID:11200
- C:\Windows\System\AlYjWSi.exe
  C:\Windows\System\AlYjWSi.exe
  2⤵
  PID:11220
- C:\Windows\System\hbIsQuE.exe
  C:\Windows\System\hbIsQuE.exe
  2⤵
  PID:11240
- C:\Windows\System\cUIVaGl.exe
  C:\Windows\System\cUIVaGl.exe
  2⤵
  PID:9340
- C:\Windows\System\oBVccUi.exe
  C:\Windows\System\oBVccUi.exe
  2⤵
  PID:9456
- C:\Windows\System\VKsPGrO.exe
  C:\Windows\System\VKsPGrO.exe
  2⤵
  PID:9556
- C:\Windows\System\ovloPfl.exe
  C:\Windows\System\ovloPfl.exe
  2⤵
  PID:9664
- C:\Windows\System\zINmndf.exe
  C:\Windows\System\zINmndf.exe
  2⤵
  PID:9772
- C:\Windows\System\kplLEiH.exe
  C:\Windows\System\kplLEiH.exe
  2⤵
  PID:9928
- C:\Windows\System\PNSFGet.exe
  C:\Windows\System\PNSFGet.exe
  2⤵
  PID:10040
- C:\Windows\System\UPxYgkG.exe
  C:\Windows\System\UPxYgkG.exe
  2⤵
  PID:10152
- C:\Windows\System\OnxOKRb.exe
  C:\Windows\System\OnxOKRb.exe
  2⤵
  PID:5784
- C:\Windows\System\pADKlmN.exe
  C:\Windows\System\pADKlmN.exe
  2⤵
  PID:1112
- C:\Windows\System\lKGxvGa.exe
  C:\Windows\System\lKGxvGa.exe
  2⤵
  PID:8960
- C:\Windows\System\rqgYGVk.exe
  C:\Windows\System\rqgYGVk.exe
  2⤵
  PID:6632
- C:\Windows\System\tGbiFqY.exe
  C:\Windows\System\tGbiFqY.exe
  2⤵
  PID:6808
- C:\Windows\System\nJgKOlv.exe
  C:\Windows\System\nJgKOlv.exe
  2⤵
  PID:7848
- C:\Windows\System\TLRypXw.exe
  C:\Windows\System\TLRypXw.exe
  2⤵
  PID:7928
- C:\Windows\System\hTPgXhy.exe
  C:\Windows\System\hTPgXhy.exe
  2⤵
  PID:7912
- C:\Windows\System\xNOyMHn.exe
  C:\Windows\System\xNOyMHn.exe
  2⤵
  PID:6804
- C:\Windows\System\DmRpCUQ.exe
  C:\Windows\System\DmRpCUQ.exe
  2⤵
  PID:8188
- C:\Windows\System\SvIuKRX.exe
  C:\Windows\System\SvIuKRX.exe
  2⤵
  PID:7216
- C:\Windows\System\iuCICeD.exe
  C:\Windows\System\iuCICeD.exe
  2⤵
  PID:8248
- C:\Windows\System\DsCROSj.exe
  C:\Windows\System\DsCROSj.exe
  2⤵
  PID:11280
- C:\Windows\System\XjFpnLe.exe
  C:\Windows\System\XjFpnLe.exe
  2⤵
  PID:11304
- C:\Windows\System\nBoUDzq.exe
  C:\Windows\System\nBoUDzq.exe
  2⤵
  PID:11324
- C:\Windows\System\JfKQMiY.exe
  C:\Windows\System\JfKQMiY.exe
  2⤵
  PID:11344
- C:\Windows\System\cGvPfdT.exe
  C:\Windows\System\cGvPfdT.exe
  2⤵
  PID:11364
- C:\Windows\System\tbZgRSr.exe
  C:\Windows\System\tbZgRSr.exe
  2⤵
  PID:11380
- C:\Windows\System\mcAKpjf.exe
  C:\Windows\System\mcAKpjf.exe
  2⤵
  PID:11412
- C:\Windows\System\nRnTHSH.exe
  C:\Windows\System\nRnTHSH.exe
  2⤵
  PID:11432
- C:\Windows\System\WtpKzFf.exe
  C:\Windows\System\WtpKzFf.exe
  2⤵
  PID:11456
- C:\Windows\System\vQFvfaQ.exe
  C:\Windows\System\vQFvfaQ.exe
  2⤵
  PID:11540
- C:\Windows\System\BdMOUIG.exe
  C:\Windows\System\BdMOUIG.exe
  2⤵
  PID:11560
- C:\Windows\System\witCEmP.exe
  C:\Windows\System\witCEmP.exe
  2⤵
  PID:11584
- C:\Windows\System\EvTckTn.exe
  C:\Windows\System\EvTckTn.exe
  2⤵
  PID:11612
- C:\Windows\System\GnwzyxF.exe
  C:\Windows\System\GnwzyxF.exe
  2⤵
  PID:11632
- C:\Windows\System\GtfaQYV.exe
  C:\Windows\System\GtfaQYV.exe
  2⤵
  PID:11648
- C:\Windows\System\VVCulGx.exe
  C:\Windows\System\VVCulGx.exe
  2⤵
  PID:11664
- C:\Windows\System\EpRtvoq.exe
  C:\Windows\System\EpRtvoq.exe
  2⤵
  PID:11688
- C:\Windows\System\JOPleIG.exe
  C:\Windows\System\JOPleIG.exe
  2⤵
  PID:11704
- C:\Windows\System\EbiGnMY.exe
  C:\Windows\System\EbiGnMY.exe
  2⤵
  PID:11720
- C:\Windows\System\LjjNeHd.exe
  C:\Windows\System\LjjNeHd.exe
  2⤵
  PID:11736
- C:\Windows\System\cUldKbh.exe
  C:\Windows\System\cUldKbh.exe
  2⤵
  PID:11756
- C:\Windows\System\KwSBGPs.exe
  C:\Windows\System\KwSBGPs.exe
  2⤵
  PID:11776
- C:\Windows\System\tJjuwlx.exe
  C:\Windows\System\tJjuwlx.exe
  2⤵
  PID:11816
- C:\Windows\System\PjFonjd.exe
  C:\Windows\System\PjFonjd.exe
  2⤵
  PID:11832
- C:\Windows\System\QwCPJTp.exe
  C:\Windows\System\QwCPJTp.exe
  2⤵
  PID:11856
- C:\Windows\System\PVPpoAZ.exe
  C:\Windows\System\PVPpoAZ.exe
  2⤵
  PID:11876
- C:\Windows\System\NzZFmbI.exe
  C:\Windows\System\NzZFmbI.exe
  2⤵
  PID:11896
- C:\Windows\System\kENnWGW.exe
  C:\Windows\System\kENnWGW.exe
  2⤵
  PID:11924
- C:\Windows\System\IrnkPNT.exe
  C:\Windows\System\IrnkPNT.exe
  2⤵
  PID:11944
- C:\Windows\System\cBGsWHR.exe
  C:\Windows\System\cBGsWHR.exe
  2⤵
  PID:11960
- C:\Windows\System\BFNqoXk.exe
  C:\Windows\System\BFNqoXk.exe
  2⤵
  PID:11976
- C:\Windows\System\fKFdnia.exe
  C:\Windows\System\fKFdnia.exe
  2⤵
  PID:11992
- C:\Windows\System\UyyFBIs.exe
  C:\Windows\System\UyyFBIs.exe
  2⤵
  PID:12008
- C:\Windows\System\vGfhbWx.exe
  C:\Windows\System\vGfhbWx.exe
  2⤵
  PID:12028
- C:\Windows\System\XZRJiuD.exe
  C:\Windows\System\XZRJiuD.exe
  2⤵
  PID:12048
- C:\Windows\System\pxjzaDl.exe
  C:\Windows\System\pxjzaDl.exe
  2⤵
  PID:12068
- C:\Windows\System\CmtIYuT.exe
  C:\Windows\System\CmtIYuT.exe
  2⤵
  PID:12084
- C:\Windows\System\CGZNDnA.exe
  C:\Windows\System\CGZNDnA.exe
  2⤵
  PID:12108
- C:\Windows\System\rcTitos.exe
  C:\Windows\System\rcTitos.exe
  2⤵
  PID:12128
- C:\Windows\System\KmpDRNZ.exe
  C:\Windows\System\KmpDRNZ.exe
  2⤵
  PID:12144
- C:\Windows\System\IdfUgGo.exe
  C:\Windows\System\IdfUgGo.exe
  2⤵
  PID:12160
- C:\Windows\System\oWJqYJK.exe
  C:\Windows\System\oWJqYJK.exe
  2⤵
  PID:12176
- C:\Windows\System\zzYcfUF.exe
  C:\Windows\System\zzYcfUF.exe
  2⤵
  PID:12192
- C:\Windows\System\AiFevve.exe
  C:\Windows\System\AiFevve.exe
  2⤵
  PID:12208
- C:\Windows\System\rmHLSGB.exe
  C:\Windows\System\rmHLSGB.exe
  2⤵
  PID:12224
- C:\Windows\System\zemJUVw.exe
  C:\Windows\System\zemJUVw.exe
  2⤵
  PID:12244
- C:\Windows\System\NNlewNQ.exe
  C:\Windows\System\NNlewNQ.exe
  2⤵
  PID:12264
- C:\Windows\System\ihpHKvF.exe
  C:\Windows\System\ihpHKvF.exe
  2⤵
  PID:8016
- C:\Windows\System\UHzaeXx.exe
  C:\Windows\System\UHzaeXx.exe
  2⤵
  PID:9320
- C:\Windows\System\sWgtdmE.exe
  C:\Windows\System\sWgtdmE.exe
  2⤵
  PID:8412
- C:\Windows\System\eubiqzR.exe
  C:\Windows\System\eubiqzR.exe
  2⤵
  PID:8492
- C:\Windows\System\mTqUsPh.exe
  C:\Windows\System\mTqUsPh.exe
  2⤵
  PID:8520
- C:\Windows\System\BrBpBFF.exe
  C:\Windows\System\BrBpBFF.exe
  2⤵
  PID:8640
- C:\Windows\System\FozLluy.exe
  C:\Windows\System\FozLluy.exe
  2⤵
  PID:8744
- C:\Windows\System\dFSQODL.exe
  C:\Windows\System\dFSQODL.exe
  2⤵
  PID:8792
- C:\Windows\System\uxTdMrh.exe
  C:\Windows\System\uxTdMrh.exe
  2⤵
  PID:8808
- C:\Windows\System\qIxLgtP.exe
  C:\Windows\System\qIxLgtP.exe
  2⤵
  PID:10200
- C:\Windows\System\IlDPGCM.exe
  C:\Windows\System\IlDPGCM.exe
  2⤵
  PID:8836
- C:\Windows\System\TzzNriF.exe
  C:\Windows\System\TzzNriF.exe
  2⤵
  PID:5988
- C:\Windows\System\jxctycJ.exe
  C:\Windows\System\jxctycJ.exe
  2⤵
  PID:8908
- C:\Windows\System\nAOtAnZ.exe
  C:\Windows\System\nAOtAnZ.exe
  2⤵
  PID:8996
- C:\Windows\System\brhSwnF.exe
  C:\Windows\System\brhSwnF.exe
  2⤵
  PID:10780
- C:\Windows\System\YyQeKOk.exe
  C:\Windows\System\YyQeKOk.exe
  2⤵
  PID:10856
- C:\Windows\System\bYmDcNO.exe
  C:\Windows\System\bYmDcNO.exe
  2⤵
  PID:10896
- C:\Windows\System\qMcAtNK.exe
  C:\Windows\System\qMcAtNK.exe
  2⤵
  PID:11040
- C:\Windows\System\fsKHFyB.exe
  C:\Windows\System\fsKHFyB.exe
  2⤵
  PID:9044
- C:\Windows\System\SuCiLAE.exe
  C:\Windows\System\SuCiLAE.exe
  2⤵
  PID:11164
- C:\Windows\System\DrxPxIl.exe
  C:\Windows\System\DrxPxIl.exe
  2⤵
  PID:2152
- C:\Windows\System\FldUfRT.exe
  C:\Windows\System\FldUfRT.exe
  2⤵
  PID:11248
- C:\Windows\System\yVCrePH.exe
  C:\Windows\System\yVCrePH.exe
  2⤵
  PID:9336
- C:\Windows\System\CTOZBtC.exe
  C:\Windows\System\CTOZBtC.exe
  2⤵
  PID:9488
- C:\Windows\System\yVuGtPO.exe
  C:\Windows\System\yVuGtPO.exe
  2⤵
  PID:12312
- C:\Windows\System\rDkHOHQ.exe
  C:\Windows\System\rDkHOHQ.exe
  2⤵
  PID:12332
- C:\Windows\System\CKkiXMN.exe
  C:\Windows\System\CKkiXMN.exe
  2⤵
  PID:12356
- C:\Windows\System\HZeFcls.exe
  C:\Windows\System\HZeFcls.exe
  2⤵
  PID:12380
- C:\Windows\System\HYREJYl.exe
  C:\Windows\System\HYREJYl.exe
  2⤵
  PID:12400
- C:\Windows\System\wlGTeMA.exe
  C:\Windows\System\wlGTeMA.exe
  2⤵
  PID:12420
- C:\Windows\System\uJpUEQI.exe
  C:\Windows\System\uJpUEQI.exe
  2⤵
  PID:12444
- C:\Windows\System\mnnkHir.exe
  C:\Windows\System\mnnkHir.exe
  2⤵
  PID:12464
- C:\Windows\System\mhMDdpH.exe
  C:\Windows\System\mhMDdpH.exe
  2⤵
  PID:12488
- C:\Windows\System\ZGKxzqA.exe
  C:\Windows\System\ZGKxzqA.exe
  2⤵
  PID:12508
- C:\Windows\System\rEkpezS.exe
  C:\Windows\System\rEkpezS.exe
  2⤵
  PID:12536
- C:\Windows\System\pTmnRfl.exe
  C:\Windows\System\pTmnRfl.exe
  2⤵
  PID:12556
- C:\Windows\System\zBeKFBu.exe
  C:\Windows\System\zBeKFBu.exe
  2⤵
  PID:12580
- C:\Windows\System\zfbWYiO.exe
  C:\Windows\System\zfbWYiO.exe
  2⤵
  PID:12604
- C:\Windows\System\qqQRGDk.exe
  C:\Windows\System\qqQRGDk.exe
  2⤵
  PID:12624
- C:\Windows\System\fRwPTfz.exe
  C:\Windows\System\fRwPTfz.exe
  2⤵
  PID:12644
- C:\Windows\System\PSwKAtn.exe
  C:\Windows\System\PSwKAtn.exe
  2⤵
  PID:12664
- C:\Windows\System\cztdzBq.exe
  C:\Windows\System\cztdzBq.exe
  2⤵
  PID:12688
- C:\Windows\System\MAYNJRx.exe
  C:\Windows\System\MAYNJRx.exe
  2⤵
  PID:12708
- C:\Windows\System\IZliYks.exe
  C:\Windows\System\IZliYks.exe
  2⤵
  PID:12728
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 12728 -s 28
    3⤵
    PID:2248
- C:\Windows\System\HFBjDkZ.exe
  C:\Windows\System\HFBjDkZ.exe
  2⤵
  PID:12752
- C:\Windows\System\MbfMZCl.exe
  C:\Windows\System\MbfMZCl.exe
  2⤵
  PID:12776
- C:\Windows\System\xGWxqPf.exe
  C:\Windows\System\xGWxqPf.exe
  2⤵
  PID:12800
- C:\Windows\System\WTwhZMt.exe
  C:\Windows\System\WTwhZMt.exe
  2⤵
  PID:12816
- C:\Windows\System\vuEKpzU.exe
  C:\Windows\System\vuEKpzU.exe
  2⤵
  PID:12840
- C:\Windows\System\ICAsFAv.exe
  C:\Windows\System\ICAsFAv.exe
  2⤵
  PID:12860
- C:\Windows\System\xIdgQye.exe
  C:\Windows\System\xIdgQye.exe
  2⤵
  PID:12884
- C:\Windows\System\ouPLDFd.exe
  C:\Windows\System\ouPLDFd.exe
  2⤵
  PID:12900
- C:\Windows\System\hBmoqfM.exe
  C:\Windows\System\hBmoqfM.exe
  2⤵
  PID:12928
- C:\Windows\System\daZnYpD.exe
  C:\Windows\System\daZnYpD.exe
  2⤵
  PID:12948
- C:\Windows\System\eRRvxzO.exe
  C:\Windows\System\eRRvxzO.exe
  2⤵
  PID:12968
- C:\Windows\System\pYhjJoh.exe
  C:\Windows\System\pYhjJoh.exe
  2⤵
  PID:12984
- C:\Windows\System\HCdzikk.exe
  C:\Windows\System\HCdzikk.exe
  2⤵
  PID:13244
- C:\Windows\System\MPshnrn.exe
  C:\Windows\System\MPshnrn.exe
  2⤵
  PID:13260
- C:\Windows\System\zzhGBcL.exe
  C:\Windows\System\zzhGBcL.exe
  2⤵
  PID:10016
- C:\Windows\System\zvppsRd.exe
  C:\Windows\System\zvppsRd.exe
  2⤵
  PID:9008
- C:\Windows\System\axOZIeL.exe
  C:\Windows\System\axOZIeL.exe
  2⤵
  PID:7260
- C:\Windows\System\micJiYW.exe
  C:\Windows\System\micJiYW.exe
  2⤵
  PID:9136
- C:\Windows\System\iMObeRc.exe
  C:\Windows\System\iMObeRc.exe
  2⤵
  PID:9200
- C:\Windows\System\ZNIagXH.exe
  C:\Windows\System\ZNIagXH.exe
  2⤵
  PID:11056
- C:\Windows\System\KUMpQQl.exe
  C:\Windows\System\KUMpQQl.exe
  2⤵
  PID:11092
- C:\Windows\System\bBcPuUL.exe
  C:\Windows\System\bBcPuUL.exe
  2⤵
  PID:10188
- C:\Windows\System\rLCuvRQ.exe
  C:\Windows\System\rLCuvRQ.exe
  2⤵
  PID:9968
- C:\Windows\System\dLGTCME.exe
  C:\Windows\System\dLGTCME.exe
  2⤵
  PID:6924
- C:\Windows\System\PwHzEkR.exe
  C:\Windows\System\PwHzEkR.exe
  2⤵
  PID:11292
- C:\Windows\System\SgcRCpp.exe
  C:\Windows\System\SgcRCpp.exe
  2⤵
  PID:13012
- C:\Windows\System\jDKPytS.exe
  C:\Windows\System\jDKPytS.exe
  2⤵
  PID:11464
- C:\Windows\System\pndMQSK.exe
  C:\Windows\System\pndMQSK.exe
  2⤵
  PID:11608
- C:\Windows\System\SeWBllJ.exe
  C:\Windows\System\SeWBllJ.exe
  2⤵
  PID:11656
- C:\Windows\System\yYpUWxd.exe
  C:\Windows\System\yYpUWxd.exe
  2⤵
  PID:11700
- C:\Windows\System\EbPrqyO.exe
  C:\Windows\System\EbPrqyO.exe
  2⤵
  PID:11752
- C:\Windows\System\GNfChRF.exe
  C:\Windows\System\GNfChRF.exe
  2⤵
  PID:11840
- C:\Windows\System\OfuBFil.exe
  C:\Windows\System\OfuBFil.exe
  2⤵
  PID:11888
- C:\Windows\System\vpeHKGD.exe
  C:\Windows\System\vpeHKGD.exe
  2⤵
  PID:11916
- C:\Windows\System\RvHolon.exe
  C:\Windows\System\RvHolon.exe
  2⤵
  PID:11988
- C:\Windows\System\UiCDHhe.exe
  C:\Windows\System\UiCDHhe.exe
  2⤵
  PID:12104
- C:\Windows\System\QmpGToU.exe
  C:\Windows\System\QmpGToU.exe
  2⤵
  PID:12156
- C:\Windows\System\PiaLLZs.exe
  C:\Windows\System\PiaLLZs.exe
  2⤵
  PID:12220
- C:\Windows\System\kaqyvRn.exe
  C:\Windows\System\kaqyvRn.exe
  2⤵
  PID:8168
- C:\Windows\System\NXmyWCP.exe
  C:\Windows\System\NXmyWCP.exe
  2⤵
  PID:8320
- C:\Windows\System\RUpDqMq.exe
  C:\Windows\System\RUpDqMq.exe
  2⤵
  PID:9736
- C:\Windows\System\ODfQzNB.exe
  C:\Windows\System\ODfQzNB.exe
  2⤵
  PID:12004
- C:\Windows\System\JlhzITg.exe
  C:\Windows\System\JlhzITg.exe
  2⤵
  PID:12136
- C:\Windows\System\bfAGCvE.exe
  C:\Windows\System\bfAGCvE.exe
  2⤵
  PID:12284
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 12284 -s 240
    3⤵
    PID:3096
- C:\Windows\System\YmLWcYY.exe
  C:\Windows\System\YmLWcYY.exe
  2⤵
  PID:8468
- C:\Windows\System\NqfhsIz.exe
  C:\Windows\System\NqfhsIz.exe
  2⤵
  PID:13172
- C:\Windows\System\vrrmLeZ.exe
  C:\Windows\System\vrrmLeZ.exe
  2⤵
  PID:10424
- C:\Windows\System\FzpDkgE.exe
  C:\Windows\System\FzpDkgE.exe
  2⤵
  PID:10972
- C:\Windows\System\pMhRRXC.exe
  C:\Windows\System\pMhRRXC.exe
  2⤵
  PID:11192
- C:\Windows\System\wauvSRE.exe
  C:\Windows\System\wauvSRE.exe
  2⤵
  PID:12892
- C:\Windows\System\wRSlMrv.exe
  C:\Windows\System\wRSlMrv.exe
  2⤵
  PID:12656
- C:\Windows\System\SqwwJIg.exe
  C:\Windows\System\SqwwJIg.exe
  2⤵
  PID:10892
- C:\Windows\System\XRnvDqW.exe
  C:\Windows\System\XRnvDqW.exe
  2⤵
  PID:9776
- C:\Windows\System\neEeDfE.exe
  C:\Windows\System\neEeDfE.exe
  2⤵
  PID:11748
- C:\Windows\System\aCrSSBV.exe
  C:\Windows\System\aCrSSBV.exe
  2⤵
  PID:8476
- C:\Windows\System\IdSbGya.exe
  C:\Windows\System\IdSbGya.exe
  2⤵
  PID:8608
- C:\Windows\System\PpFtiXn.exe
  C:\Windows\System\PpFtiXn.exe
  2⤵
  PID:10020
- C:\Windows\System\WTecKaj.exe
  C:\Windows\System\WTecKaj.exe
  2⤵
  PID:12704
- C:\Windows\System\godihBZ.exe
  C:\Windows\System\godihBZ.exe
  2⤵
  PID:10504
- C:\Windows\System\nUmSRkW.exe
  C:\Windows\System\nUmSRkW.exe
  2⤵
  PID:11100
- C:\Windows\System\UAnGgEy.exe
  C:\Windows\System\UAnGgEy.exe
  2⤵
  PID:12124
- C:\Windows\System\ilkBMQI.exe
  C:\Windows\System\ilkBMQI.exe
  2⤵
  PID:7744
- C:\Windows\System\gOFsGMZ.exe
  C:\Windows\System\gOFsGMZ.exe
  2⤵
  PID:10840
- C:\Windows\System\BFNJlcm.exe
  C:\Windows\System\BFNJlcm.exe
  2⤵
  PID:4192
- C:\Windows\System\hYZbfTD.exe
  C:\Windows\System\hYZbfTD.exe
  2⤵
  PID:11624
- C:\Windows\System\naOnrjC.exe
  C:\Windows\System\naOnrjC.exe
  2⤵
  PID:9624
- C:\Windows\System\lZvJijm.exe
  C:\Windows\System\lZvJijm.exe
  2⤵
  PID:10684
- C:\Windows\System\nWKMSLv.exe
  C:\Windows\System\nWKMSLv.exe
  2⤵
  PID:12684
- C:\Windows\System\UqpvLFf.exe
  C:\Windows\System\UqpvLFf.exe
  2⤵
  PID:2252
- C:\Windows\System\NlPqJYx.exe
  C:\Windows\System\NlPqJYx.exe
  2⤵
  PID:13220
- C:\Windows\System\LdvPrJb.exe
  C:\Windows\System\LdvPrJb.exe
  2⤵
  PID:13120
- C:\Windows\System\XYbDsXF.exe
  C:\Windows\System\XYbDsXF.exe
  2⤵
  PID:9552
- C:\Windows\System\cYLTfkn.exe
  C:\Windows\System\cYLTfkn.exe
  2⤵
  PID:12120
- C:\Windows\System\rHOCMEI.exe
  C:\Windows\System\rHOCMEI.exe
  2⤵
  PID:11728
- C:\Windows\System\gZQffUg.exe
  C:\Windows\System\gZQffUg.exe
  2⤵
  PID:4628
- C:\Windows\System\KzeSPgl.exe
  C:\Windows\System\KzeSPgl.exe
  2⤵
  PID:2756
- C:\Windows\System\apPXtpV.exe
  C:\Windows\System\apPXtpV.exe
  2⤵
  PID:10824
- C:\Windows\System\TkCDjmy.exe
  C:\Windows\System\TkCDjmy.exe
  2⤵
  PID:4712
- C:\Windows\System\VqOvFpT.exe
  C:\Windows\System\VqOvFpT.exe
  2⤵
  PID:9708
- C:\Windows\System\HtJvdCb.exe
  C:\Windows\System\HtJvdCb.exe
  2⤵
  PID:13204
- C:\Windows\System\lUAgVOO.exe
  C:\Windows\System\lUAgVOO.exe
  2⤵
  PID:2532
- C:\Windows\System\SfNAlhD.exe
  C:\Windows\System\SfNAlhD.exe
  2⤵
  PID:12980
- C:\Windows\System\hNlxYZD.exe
  C:\Windows\System\hNlxYZD.exe
  2⤵
  PID:13048
- C:\Windows\System\fyucxaC.exe
  C:\Windows\System\fyucxaC.exe
  2⤵
  PID:12960
- C:\Windows\System\LzpukPy.exe
  C:\Windows\System\LzpukPy.exe
  2⤵
  PID:12784
- C:\Windows\System\XsIzLTR.exe
  C:\Windows\System\XsIzLTR.exe
  2⤵
  PID:2588
- C:\Windows\System\cHieVfC.exe
  C:\Windows\System\cHieVfC.exe
  2⤵
  PID:11084
- C:\Windows\System\ZznYYFS.exe
  C:\Windows\System\ZznYYFS.exe
  2⤵
  PID:6628
- C:\Windows\System\NEjzzGa.exe
  C:\Windows\System\NEjzzGa.exe
  2⤵
  PID:3736
- C:\Windows\System\KtUuftE.exe
  C:\Windows\System\KtUuftE.exe
  2⤵
  PID:8980
- C:\Windows\System\MYTGavT.exe
  C:\Windows\System\MYTGavT.exe
  2⤵
  PID:8612
- C:\Windows\System\PlvoOuZ.exe
  C:\Windows\System\PlvoOuZ.exe
  2⤵
  PID:904
- C:\Windows\System\SsuMdee.exe
  C:\Windows\System\SsuMdee.exe
  2⤵
  PID:11912
- C:\Windows\System\UDyMliW.exe
  C:\Windows\System\UDyMliW.exe
  2⤵
  PID:9296
- C:\Windows\System\EOnTDtF.exe
  C:\Windows\System\EOnTDtF.exe
  2⤵
  PID:13104
- C:\Windows\System\jlQXYwJ.exe
  C:\Windows\System\jlQXYwJ.exe
  2⤵
  PID:8848
- C:\Windows\System\FGwRmjS.exe
  C:\Windows\System\FGwRmjS.exe
  2⤵
  PID:5028
- C:\Windows\System\Ljsfliq.exe
  C:\Windows\System\Ljsfliq.exe
  2⤵
  PID:3732
- C:\Windows\System\dxdPInc.exe
  C:\Windows\System\dxdPInc.exe
  2⤵
  PID:5116
- C:\Windows\System\UsRcqwj.exe
  C:\Windows\System\UsRcqwj.exe
  2⤵
  PID:12392
- C:\Windows\System\QxlQwci.exe
  C:\Windows\System\QxlQwci.exe
  2⤵
  PID:3096
- C:\Windows\System\taSTHWM.exe
  C:\Windows\System\taSTHWM.exe
  2⤵
  PID:7208
- C:\Windows\System\rKCjcRT.exe
  C:\Windows\System\rKCjcRT.exe
  2⤵
  PID:12236
- C:\Windows\System\oTgnGmp.exe
  C:\Windows\System\oTgnGmp.exe
  2⤵
  PID:9972
- C:\Windows\System\WTodGwR.exe
  C:\Windows\System\WTodGwR.exe
  2⤵
  PID:2248
- C:\Windows\System\HdkBkMP.exe
  C:\Windows\System\HdkBkMP.exe
  2⤵
  PID:4280
- C:\Windows\System\pLFXQqP.exe
  C:\Windows\System\pLFXQqP.exe
  2⤵
  PID:4836
- C:\Windows\System\xWmAHdP.exe
  C:\Windows\System\xWmAHdP.exe
  2⤵
  PID:11952

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 648 -p 11560 -ip 11560
1⤵
PID:4280

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
PID:4712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_14as2bhp.3dy.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BfbjzIy.exe

Filesize
1.8MB

MD5
5aaa9a60ce52be2e1b7228c3ae4fa762

SHA1
45c70b9ddcd7327b2876cae001a1533d469b8e14

SHA256
0f3f2bc66a63b12c260ee580eddc2e4888bd68e4c2ab9ee1f79df1211b495e37

SHA512
c802d52f694b5bd8a1e9ecda281e7fe85e21406a0dfeaf43751f43edf36fdc38cac16312d2af59de08020645c2b544b39cbc01a5216cbf605df202e84599a758

Download Submit
C:\Windows\System\ELyoXKF.exe

Filesize
1.8MB

MD5
7a13111ea454673fb410b6c5b1640ae4

SHA1
be855c541e71d2d541a8b6eba88677f063ffcae2

SHA256
5a73c1a67653f5b5059e5fcd0bc40c04159471945ee733ba4abd7164c4bdf4ae

SHA512
c415f80952ae0d828220681b1172d326adafab7f273371d37e93806178b2337c17cf06254d4ea0f4825dd51d744256997205c4030f40a60ec61ef5bf69469d8f

Download Submit
C:\Windows\System\EQusPxA.exe

Filesize
1.8MB

MD5
d7ea2d93ce78e8e2822bffc01b4328e0

SHA1
34ffa95b26aa48578dc3dd6e8c13e20fa57facb9

SHA256
75d081b1a2717f4521e078bae479eb15dc95c6e2a042ba2b029dbb7715bedeea

SHA512
e6de3c4c69f7f62d74842d4ba9f5059adc9d41b62aa6bc34073c22ee66f196858b7f4b3bc2763e84f341a11903f90b588b28a60a17e30f17387e124598ba683b

Download Submit
C:\Windows\System\EkGZIVc.exe

Filesize
1.8MB

MD5
40b9f4669073cd98185aa2d5abf296a9

SHA1
bd49bd0c747d7a9c4fd7ed21cd1f9fbd6586b46b

SHA256
bcd6294318d76d77590b20b6bfa0fc3ebd077bffd7139ebafd6e849672a9499a

SHA512
14828ff30642a2237497a6fb52b96b8f892587dd9c4c82abaebcdb60d0a322374f3d7f14d9d862c8b8c3823c1b56a9ab6abaec668027d8fa019fdea9f1870e53

Download Submit
C:\Windows\System\IEuCIyV.exe

Filesize
1.8MB

MD5
937b065d486f17f0fd996caab5de92ab

SHA1
1a6eae6f155adac114ef43650ceff80798a50044

SHA256
662d8c2bcac56d4caf97a2014727142c5ee38e39d53a177d6ee569ce3e0d36bf

SHA512
5673beb33c74164db2503b6c6768d194c7087bfef7573f381780e230e85d57cd77da92dac6f8e03b25fec70b832d2c4a8b6839bdf8910be3a91a42bd3a8bc0d4

Download Submit
C:\Windows\System\IkNvRyE.exe

Filesize
1.8MB

MD5
814e95d7accdb4f1cd55161d175dcf28

SHA1
6616ab41733c9c7e5638ea534b82da35fd3ccc9a

SHA256
a2644f73ab04b8c7063c2b9dc4d5e9cd1a3deccd081b8dd9591b8db11ffdbfc2

SHA512
90b31a372dccc4aecb5d3c5b2fc0b6804712ea83f1bf931f07a99c577c63fd758a90f562620772e7c6b21f6cdfcfb836c661e8d07bc1905bdf7d4814621f0d3d

Download Submit
C:\Windows\System\IvZJpqp.exe

Filesize
1.8MB

MD5
359cf4b7df5212bbc84387f124766912

SHA1
0c5e7564bcd1130b5e8142e6f1eaca80023c124b

SHA256
662755b71bbfb4a7fafe19fff780a1086dc18b5adc55089d1aaf3422cb5b17cb

SHA512
949924561e8091818273806b9d2e1046f4095f434d6136667a9a882d84510146acc778042cfa4aea10310509109c462a22cd82f00c0d685185b4c87225692451

Download Submit
C:\Windows\System\JcJovPG.exe

Filesize
1.8MB

MD5
5f58218293b7aeaa5d3674b0d12b9c1b

SHA1
79894d8f105fb517dad324114d3dce2e9d3a44b1

SHA256
f45d1448e47e24ed513ac3b4e11defd4fe43f622f23159b043c4cae53be8bc7d

SHA512
ec00fda39027a31c61d00114e76bb4bfff6f84a177a0f5645458c90cb9b8055e306c93330ac13ed5024119f18b5cf4d35897ba12b21d5242ae35787043b9ee9d

Download Submit
C:\Windows\System\KIDwxGj.exe

Filesize
1.8MB

MD5
d3efd61f6d78b7edc3a648541c814297

SHA1
6f2d9f6ca11d9b5ca4ad99e39241da2426519d63

SHA256
fb652f77f9169eef2e3b58e1ff728416e0e8457af68bb722678abe9defdee22f

SHA512
d9cfa82e9a64e39b281681ac747ac4808998dec7b902cf1991553e462a4e0b918a2598ed98c237621ffbe812a53725e7e26aa60ec3a73c13bb7e82b0be103100

Download Submit
C:\Windows\System\MrqGOnp.exe

Filesize
1.8MB

MD5
6fcb2611349db742f272fd9d99f70c46

SHA1
a903202c564be92a3b2375ff4f58527888203b92

SHA256
73cd28232bacff74a9ab6b1bb4fd698cbb07a4a18f4714d2611f951ba44148a6

SHA512
11224e110f87981ee7dc1bb681367d4511cfe5d0e1fe235b2409e7d0e7655bf70e720726374cfce1eb8709ae0b6cc92a01ca71175bfb411d3a2550392d3dda15

Download Submit
C:\Windows\System\NKzueHi.exe

Filesize
1.8MB

MD5
d5bac0a0d9c7f962771afb35a082224c

SHA1
9cfd4bba13624c0dd8b88b8e3bba2df09f4e5d48

SHA256
847ea0ca273d7e92aa4cb24004f982ff8b5ba33b22f1a91401f6701a90c446f6

SHA512
44b6e83b3f30d895ef655f08ef5b2075019111b757daae28abd19080648957ce7e392838a0311bdf5b895e50fcdf6acbe69c80fbd77df7c3041d9a0f12ab310a

Download Submit
C:\Windows\System\PxJWIqV.exe

Filesize
1.8MB

MD5
14ce70679603bb964d5343e53fbce3ca

SHA1
1a688376fcd0f1fa3f5da841140ed1bb00a0be4b

SHA256
334dfb2100810a45c889058648d9b975e9d441211cbba0d93dee0b576ebbefc5

SHA512
87c1d97ce50841ea4f99f0067b9622d9b83797d33bfc22e293aa8004d93ae14696d87c7945bf82bb5fe6bd10d5b5854e9f715157b9c67198a95023720af09243

Download Submit
C:\Windows\System\REKvnOg.exe

Filesize
1.8MB

MD5
87524a9bbdac286947e4ee3c406fc6f5

SHA1
11d6f9bc0ac66cb9fed047d4bfb84c0162cd1c06

SHA256
8032c5962700b0597b23e37b3569170a73e19675858243b4f0a7e8cfdacd6479

SHA512
c2a5748f9d380d0baf0725f61aa4365399dc8e63834a1ff8c477bfe79ca1fee2b144603a5813ed2fb3ad325f237138efbdf67b02b406717c26ccea463e70247b

Download Submit
C:\Windows\System\RUJWByg.exe

Filesize
1.8MB

MD5
3a5134cd2ef7214260eab3bb5a20aa5f

SHA1
cbcc94287b0d1deff580a8e91d42418710aadfd1

SHA256
3bc49142ba58765a9f838d5c58dd660565e516a7221b82b2f7e599e2dee286f8

SHA512
236856c13a760f139ace9ea1d89b199456193e42930f2915ecab01159c3194c512f343d48f38ae45d1e735c498467947ea0b907b45aeaaf1344703ba5d085ceb

Download Submit
C:\Windows\System\UIeJAlY.exe

Filesize
1.8MB

MD5
e7f23fec74c459dcf2e3a8225706a218

SHA1
e2c3c1e4fc4a75d6d446c07b16050702470a125e

SHA256
13bffd7fa8138b032f02ae6a73aaaf9be742965545223efe01170ebc82ddca9e

SHA512
b1b58a067d195d7a03ae1b430bb622adc4da15ff0a47e1d5ffbdccda603e74e6c7ce678e107f77f1abf6de74779b062415535c3e5519f3a30e238b474d495943

Download Submit
C:\Windows\System\WoVvVGW.exe

Filesize
1.8MB

MD5
b01e5afaee183133edaeacd9bf962082

SHA1
f6e5d8b42126bb5f03f7ef818a3e9b1d79db3c30

SHA256
56624694f5ad69698fea333ed5115916dd495fbb88950400f9ebfb7a323a40d4

SHA512
06bde067b3de7af56159ceb5c63768eb7c55316a23c98150562cdbfd8dc2f4bea12605a24f50e59a7493bddabeee1d5cc527d968d355097732dd2781d923cf64

Download Submit
C:\Windows\System\YrzSfuh.exe

Filesize
1.8MB

MD5
90b7c5a07a338f3d3b13f040b7135fa3

SHA1
74c616a96741c196799d380eae2a18c1c5edd8c7

SHA256
1943845d462029a0a25033f29711c495b82c13dfccfb3f132c9917c8cb1487cf

SHA512
ca7700b62b24fae71781ae80d283cf3ed3b51ce8da5eee5e06be84a177be339ba0d3c707928bd44480107f8c5a4d16624c5a59c7b0f3c91a9bd4d209afcad66f

Download Submit
C:\Windows\System\ZSGNQSu.exe

Filesize
1.8MB

MD5
8efb74f3fc4576c3bb4245d717ff1f78

SHA1
1030d2ae114a9537cc2d1fd270ed4c056f97a5f2

SHA256
4369f48231f06e9a865a6d492bd57e8d5df0e66ca72b520be31643efac6e854f

SHA512
7d0c56aefd7863ea3a6cb2baa0cbc09ef5fb6083c6c22f1a99ad3ede520125413faeef2a3678db250101885d4bb88a755af958d02dcf0c957c97dea66e9ec028

Download Submit
C:\Windows\System\aFLMAmd.exe

Filesize
8B

MD5
1855a32bc20d82a1da2b5edf8967f4e6

SHA1
25928e56f89ec28b56047592b93000c1d36e2a23

SHA256
197265335822dae03e837ac88a16d32bf68b201da4bc921af00edba259c1267c

SHA512
6ba43273aa11ef21001bd21641b2cb12d306e904aaff29ff56a8c7b3eadaaec0f04afabf47cd7eb2a1a7b9c79f098b4d11d9a442d2048486e96355d7914a5e67

Download Submit
C:\Windows\System\aJktpWo.exe

Filesize
1.8MB

MD5
77695855958a1c07a21effeba1bb768c

SHA1
e253358e74a570c643b3f6e23d39163489d52fbe

SHA256
6da49184fc1eb8cbd24ee18edb29053d548709dfad81d5effbbf8ee8d58e79c0

SHA512
6a4c7b52d66fe82b6d53cad5233107353f9b2ea8daff4e504bca8a5af08818b95a6c06e11f54402e1d81eb70a81521065c51776a14bc8cb03e3e7a5148373d5b

Download Submit
C:\Windows\System\aPsuMkL.exe

Filesize
1.8MB

MD5
a57ca5f0c0f97a2af129c4a2264bd3dd

SHA1
6c7462eda99ab841f5bd9032a6181321176d0f71

SHA256
e0e7b12c1cd5c8a9eeb667f97b9cab2a4ed1a0007585e8f8bc9a23c23b6a7df4

SHA512
6904dde8dfbfe3a20d3a4819b1f31c94953abba0e8677a842c5b3efd774148881bdbd91561232dbb4b6e04b2161a144da714a78d9d2fff30cf96a391ffbf8348

Download Submit
C:\Windows\System\baFcRUa.exe

Filesize
1.8MB

MD5
37f1432cf46e7b9dd27fac36fa28a418

SHA1
502ba508eec7315980bf31b972bd0ee47ac6d145

SHA256
5566a04e88578eca13fe6941af1ec56dbcdef77439c56be816f75362766e66c2

SHA512
009ea0bb85108ed392fa224ddd4a1fd2c88a943f7e5cde837677bf98cc4fc4f9e3ff1e86e38de08a4697d4a3d13c2938775300352bc695cb425822e5c02aed4d

Download Submit
C:\Windows\System\dzRhkES.exe

Filesize
1.8MB

MD5
9641d54f98c2a7bd8c56139842b2c106

SHA1
5c088c71ceff10111e96eb7c7afefb0aeca2099b

SHA256
2543167d6945fa3c9aa9740961439b68c7c2e84b2a563afd6cf8dae645297fcb

SHA512
951ce767d09879909789511804564e78e85d2e36342f97eb4c49cbfd3c6adbda7972c2037dd2bb221397adafb579283875ec0be1a2954227113af58ea81b412d

Download Submit
C:\Windows\System\eQGloAf.exe

Filesize
1.8MB

MD5
efaea918ce560678b5989d8ea3dc336e

SHA1
c4da69b4eeacbb363e0031822f467c1a1e4be975

SHA256
5832508add71cba28b7ceac855bb447870deed6b1b27888187e3f225974e9d4c

SHA512
92997c45975729a511feca54679cd55aa337e8d1c22f53c1f61c1cfa90e26bd6902bb44ec2ef3af7c713b441fb509e2483823a192f7d38ef7f5294e294335d76

Download Submit
C:\Windows\System\erzCStF.exe

Filesize
1.8MB

MD5
f614a95f5c72f64b3320686f640aab24

SHA1
81266eafeb13985d075ba137a69d178c701bd0c2

SHA256
5b5b2a9f5247d366024fb09b07c5c13cc1db9ca5da6eab9e9176800eb11adf65

SHA512
f934c98436bd8786062ae93061366c7d7318406e9f1024d72cf2843d3f52079d8ca98ca30dc97635f63d358021e4db6d10f621462a1f979257510171e6933177

Download Submit
C:\Windows\System\ewxHskq.exe

Filesize
1.8MB

MD5
6d48528cb4ff05ab351cf56fd26235e5

SHA1
57ca0ed05e943782e091d3f6a68460a7e5a2d23d

SHA256
ed0f54bcf7c49662235e8804f4eb511c1a2b35d523ac943467eb18ab23fd1dfe

SHA512
58c62efce2221d3d9bd60feb938a4270feb2470a85463306b9a243344aeea3e4d92ffab76cefab979a64037b41d115bcab6037718de8cc40543b9e05bd99ffda

Download Submit
C:\Windows\System\gPtfvUz.exe

Filesize
1.8MB

MD5
bbc8694ae5fd9dc13ecc10784340f44b

SHA1
1886134ba4703ff384978e1ad18bde0e33815cc7

SHA256
e2e921ae92309600ef457f2a576934e01b793e45bfb2429bafb2abe85da41146

SHA512
1c7b1fa6e2258324bc50bbec81343a27d3d8e71787ecabe092ec22276652371c93eddb9fc1b137df33f39c21e194a1f1ab349066042adec78dd9c1d5dec2efc7

Download Submit
C:\Windows\System\gjHKvuQ.exe

Filesize
1.8MB

MD5
d667fe6f944e1cb035ca32fbaaa814ca

SHA1
c1ebc90e71bf2e873f9a0c02af3ea184081787f5

SHA256
be36cd334f9204fde4d3157decb16fdbbb0fcf3c789c8a65d34d3ac35bccc013

SHA512
6d2b54dae71076bc510f4f0a078e2e72b07593114a790792f2415a5d5398045715bd02754dd5867d0d7e85ea1834e7be85335afe8a27100f03b10cfa6644d31c

Download Submit
C:\Windows\System\gsaueiy.exe

Filesize
1.8MB

MD5
df4bb044e88091eb928edd713eb44352

SHA1
7a61b0a9a8b54183226e8d2e5393f65d9e4bdae2

SHA256
5fc5eff8ab46aa969cb08f40a2168433f684067e0ac377bbf130e8b6d53456d9

SHA512
876181036977916ef815481cf4367ddde6bf690fb43aeff5fbd89ca09d342caf878735c70788a8cdc58bd0ec8340f7dd39e84bf70979e09b618a1bd612f394fa

Download Submit
C:\Windows\System\iUOUiVb.exe

Filesize
1.8MB

MD5
7c49faf61c8b76c326339f230c6a286b

SHA1
bb882d1fda226527917ae5d76bc69e2ad2a06dba

SHA256
3fb7dca3df2f05f64dac38a27f8e109b7ca5657403a5278c8d4cef4c9218c556

SHA512
1940e86f4507c2f4d8337a65ff48edf3ec6942081d17422e700db9843ac980f5eab3e663f0d7d863a6c167b61f3647d1c3b196b9726ed4152986306a4b69c60c

Download Submit
C:\Windows\System\iqlktlj.exe

Filesize
1.8MB

MD5
3376206f9ba9137f98429e03bc815bab

SHA1
afb63fbe4876e730f3c8ef2ae5b9e9aaba861438

SHA256
33ef0aa3b4d330e97b7f2d0c997cd254b3d88c4cb5f8127dec0604627e31d386

SHA512
141a0949d12b492158bb06aae15455c83f5f99ec454e31efbb662d8c2b6814699b9bf61c9b23bc649dc5068eedbb6c2a68c9c4e2d9b68e571e0a535db2a4cb30

Download Submit
C:\Windows\System\kUIwAIg.exe

Filesize
1.8MB

MD5
ad917d4a25931048864b7cfd4eef2c03

SHA1
3a1957d3b2e93a3ef8a0732d86d5caa0c0923998

SHA256
968f6651e0a4a47a7955a3601f748d3295eb0e601b9d424e5c79db7c1f04c515

SHA512
4acd1dc87d0dbd64251ca7a71cd2922ffff57e91afce7bb112ab90dd06b03e7f363ff1d2a2b654cf84fc7e6339eae213fd74fd780ed8f6df85afce6a331138a4

Download Submit
C:\Windows\System\lRmhHzv.exe

Filesize
1.8MB

MD5
ed4471060e7cc63d7566a7d68e64dd76

SHA1
fe3d426d57c4484372990eb639cf9cab854947c1

SHA256
dd683bc8a6ce22b1bb88d4103cea4bca86bafb51a262214485deacfad8054b03

SHA512
d2c22f6364dd9701f75ee240645e0a09bbb6e61453e8924c571dcc5516ca8d51dd1f4f0e9267cda5e5c8a28887811f91b307d46af8a648dc1405b73597ca7e1f

Download Submit
C:\Windows\System\mbTPjAy.exe

Filesize
1.8MB

MD5
0152c5ce08442e4596661a9623a96d81

SHA1
ec3c127931930fbe18b92576817aa9f6165f68dd

SHA256
7c2fda48a88425d183b01b6dd85d2ca3d40428d909807a9809d5ecfa73e97bf8

SHA512
ad963389f736a9044797910db494862a6138e7f4242dbee89348c27166ea725228d0a21b8f8c1c8932052fb26142380c16a17bd8c1c7af99b05859c31f63eb59

Download Submit
C:\Windows\System\mmtzgDK.exe

Filesize
1.8MB

MD5
d8a655424b15f1fcce3a360ca3d7e2e6

SHA1
ead4860da84aef931d769563dffcf5a2ab71164a

SHA256
cdb4d877623f185b31c321e656643b778f3d02a88131b3417dadc6883e775fe2

SHA512
82ca5dd45a4ad889137c3da7f9965745de2dc3a68d47824616092d87e4616c718159db7fe71e6be1c1636d798201b52265c64313e163c043aed607ad5f8de695

Download Submit
C:\Windows\System\mtXoHrp.exe

Filesize
1.8MB

MD5
5ddb396374345b59f2c601c8e5c4ad3c

SHA1
5614eaebf93f96b165a820fc8f8b1a98639d458a

SHA256
7b6550d26f39f35cd7e687f0ad46ea435289963902b863b8ae7728030309aa60

SHA512
1edd31996aae5bed513a0b0d1b3b4704b39803b13425ee8d256db259298bced288e4a8e909c17695c0d607ce065e5f1960fa46e18a2b9c42a4385a442d8a195e

Download Submit
C:\Windows\System\nNvvyjv.exe

Filesize
1.8MB

MD5
2524f4b379d7036d534fb1b0697d7c85

SHA1
1b04d62d383c6f83fa3e00747348d702b545dd1b

SHA256
b9853aeb6a506186e15360efe7ff50ab77642f271ebd147f118249ddce4b8732

SHA512
89db18c61767345af80865cafa1c111f2b9ec54ee9fd583922dbe6cf2e619dceadb00d257d333d6a9004e85903d36dfc6ff9c024edf9acf07f6ffc796a76d081

Download Submit
C:\Windows\System\pofNMkJ.exe

Filesize
1.8MB

MD5
38bd99b5b261656efc40904aa30d1bbf

SHA1
7b2d2427d7624a391fdc651e1e7ff5950e2d63a8

SHA256
ee59011c1239ec0e12a630d54b06df7be8762caa422c9d31ba1eb4e571571841

SHA512
2ecf8cd77c57b6f5c2b31a9954ef552bffeeeb7d50859ecc2c4e54ab78c0906e4dbdf23d97b819eb125cf6b70cae83ab71f655ba916918348226af115cc27f1a

Download Submit
C:\Windows\System\rNsaHRW.exe

Filesize
1.8MB

MD5
0f96e36989dcfbc833097d8db6606409

SHA1
c29e11f22cadb530444934218b2be13e77039cfd

SHA256
7ce6145ab77a5002970ac9b695f6b8aa57773b4a76d64c183f8135981010385e

SHA512
d0d72a691f222a41c0fcb4dde03e1ee14f7cc855d2029d693e1fcb7d2c6a15529b6f6efe879eb35b009ed695a513119d459ae00ee1924997aafe92f69837d7aa

Download Submit
C:\Windows\System\utWyQQR.exe

Filesize
1.8MB

MD5
91291724e756490bc86fbdf278b750bf

SHA1
8c583ac856be9eae50d1d02cb94d25d29765c77b

SHA256
b8e152d1a1cc71c493de51af56c7dfefae199441a8fbf7dae318b28b8b96ec9f

SHA512
8142c2e237569db9dcf0048671e0cb60bbae5fbf184777030571a70da3a3076d837a51b0efe47ea6b592b9c70e232849fdf9ed6453fb921f4c2cf15ea46e2b89

Download Submit
C:\Windows\System\vOfTaMX.exe

Filesize
1.8MB

MD5
cc803d359ba08457f7ba3961976f5c14

SHA1
cad015674102b64c3f4c599999b9a423a77d969c

SHA256
4770b0191d0aa5a5a7d30c89559bfa24ce29dabfb1a955d86b2fd79af830ec71

SHA512
0bae4c4c30e6e02a5ffd75c30bc205961f67f6080e9b24441ed45f2de30e22f654f7ed1b7955eeedac31b7641066f2a9976e9584e0041337b5f770a773b59bef

Download Submit
C:\Windows\System\wLsexaU.exe

Filesize
1.8MB

MD5
b975879c6f5100912093fa64c5b42c9c

SHA1
c409bad5ee55b0cb50562db06b82e77edca6439d

SHA256
32d84b142a4cdf6aa70cab5e27a09d955463cb5b302f333ff4af6e367d261b6b

SHA512
a896d9012a74e513e93ad91c5ff3892a2875fe062515bfed41ecd97cbd084cdf7ca05ff0bc8218f47e8e93831491577a300ba60d11c6250411a224c7e834a7cf

Download Submit
C:\Windows\System\xsgNWqf.exe

Filesize
1.8MB

MD5
bd0d314369a31cbca70d808d588fd3f2

SHA1
ff99082fc86ec58bffbf71fcfe4edab4db54c9ed

SHA256
9acd8be6f3cd122624a2ddf5731f0aff86e97fd4dd39c6a4843cae4f562b8f25

SHA512
1fcafd8039c1925180515057192a4710b48778688a2f8d6a76ca40e839385f45f30c5f3ba2b18324432d10be75504b0b3129844bdac7414e4e43df2ab2e12814

Download Submit
C:\Windows\System\zOyseOg.exe

Filesize
1.8MB

MD5
8759fb9a738e72bf7284d578b5cabdc8

SHA1
4a2df348c72fca450bd15ddb11dd83e13a9a4313

SHA256
b4ecd5f31a7c669bcdbf4e5bad18adce2a805c6611db646bc22876ab82b9112b

SHA512
e618d2ad0e6a38b3d59f0567a5366b23c8e0eee14ae9ccf4f907448d9ffcaa8f28249385921799304f6cc921da8052274ca20c98e12548c71b85d02ad8a017d0

Download Submit
memory/404-596-0x00007FF65B5C0000-0x00007FF65B9B2000-memory.dmp

Filesize
3.9MB

Download
memory/404-2947-0x00007FF65B5C0000-0x00007FF65B9B2000-memory.dmp

Filesize
3.9MB

Download
memory/624-3039-0x00007FF79EC00000-0x00007FF79EFF2000-memory.dmp

Filesize
3.9MB

Download
memory/624-605-0x00007FF79EC00000-0x00007FF79EFF2000-memory.dmp

Filesize
3.9MB

Download
memory/820-2981-0x00007FF68D2F0000-0x00007FF68D6E2000-memory.dmp

Filesize
3.9MB

Download
memory/820-600-0x00007FF68D2F0000-0x00007FF68D6E2000-memory.dmp

Filesize
3.9MB

Download
memory/1348-603-0x00007FF6D49F0000-0x00007FF6D4DE2000-memory.dmp

Filesize
3.9MB

Download
memory/1348-3068-0x00007FF6D49F0000-0x00007FF6D4DE2000-memory.dmp

Filesize
3.9MB

Download
memory/1760-2949-0x00007FF7E4440000-0x00007FF7E4832000-memory.dmp

Filesize
3.9MB

Download
memory/1760-598-0x00007FF7E4440000-0x00007FF7E4832000-memory.dmp

Filesize
3.9MB

Download
memory/1844-599-0x00007FF7117C0000-0x00007FF711BB2000-memory.dmp

Filesize
3.9MB

Download
memory/1844-2941-0x00007FF7117C0000-0x00007FF711BB2000-memory.dmp

Filesize
3.9MB

Download
memory/1912-2933-0x00007FF7BEDA0000-0x00007FF7BF192000-memory.dmp

Filesize
3.9MB

Download
memory/1912-328-0x00007FF7BEDA0000-0x00007FF7BF192000-memory.dmp

Filesize
3.9MB

Download
memory/2304-360-0x00007FF605230000-0x00007FF605622000-memory.dmp

Filesize
3.9MB

Download
memory/2304-2935-0x00007FF605230000-0x00007FF605622000-memory.dmp

Filesize
3.9MB

Download
memory/2348-608-0x00007FF7B4900000-0x00007FF7B4CF2000-memory.dmp

Filesize
3.9MB

Download
memory/2348-3062-0x00007FF7B4900000-0x00007FF7B4CF2000-memory.dmp

Filesize
3.9MB

Download
memory/2372-604-0x00007FF7F4000000-0x00007FF7F43F2000-memory.dmp

Filesize
3.9MB

Download
memory/2372-3064-0x00007FF7F4000000-0x00007FF7F43F2000-memory.dmp

Filesize
3.9MB

Download
memory/2424-581-0x00007FF737C50000-0x00007FF738042000-memory.dmp

Filesize
3.9MB

Download
memory/2424-2943-0x00007FF737C50000-0x00007FF738042000-memory.dmp

Filesize
3.9MB

Download
memory/2472-137-0x00007FF781DC0000-0x00007FF7821B2000-memory.dmp

Filesize
3.9MB

Download
memory/2472-2939-0x00007FF781DC0000-0x00007FF7821B2000-memory.dmp

Filesize
3.9MB

Download
memory/3176-607-0x00007FF728090000-0x00007FF728482000-memory.dmp

Filesize
3.9MB

Download
memory/3176-3065-0x00007FF728090000-0x00007FF728482000-memory.dmp

Filesize
3.9MB

Download
memory/3344-12-0x00007FF6D7F40000-0x00007FF6D8332000-memory.dmp

Filesize
3.9MB

Download
memory/3344-2925-0x00007FF6D7F40000-0x00007FF6D8332000-memory.dmp

Filesize
3.9MB

Download
memory/3804-0-0x00007FF678ED0000-0x00007FF6792C2000-memory.dmp

Filesize
3.9MB

Download
memory/3804-1-0x000002740AFE0000-0x000002740AFF0000-memory.dmp

Filesize
64KB

Download
memory/3860-595-0x00007FF7CE590000-0x00007FF7CE982000-memory.dmp

Filesize
3.9MB

Download
memory/3860-2945-0x00007FF7CE590000-0x00007FF7CE982000-memory.dmp

Filesize
3.9MB

Download
memory/3976-601-0x00007FF7273B0000-0x00007FF7277A2000-memory.dmp

Filesize
3.9MB

Download
memory/3976-3001-0x00007FF7273B0000-0x00007FF7277A2000-memory.dmp

Filesize
3.9MB

Download
memory/4176-602-0x00007FF6B73E0000-0x00007FF6B77D2000-memory.dmp

Filesize
3.9MB

Download
memory/4176-3060-0x00007FF6B73E0000-0x00007FF6B77D2000-memory.dmp

Filesize
3.9MB

Download
memory/4292-453-0x00007FF765D40000-0x00007FF766132000-memory.dmp

Filesize
3.9MB

Download
memory/4292-2937-0x00007FF765D40000-0x00007FF766132000-memory.dmp

Filesize
3.9MB

Download
memory/4368-3002-0x00007FF6BF1F0000-0x00007FF6BF5E2000-memory.dmp

Filesize
3.9MB

Download
memory/4368-597-0x00007FF6BF1F0000-0x00007FF6BF5E2000-memory.dmp

Filesize
3.9MB

Download
memory/4456-833-0x00007FF69F3B0000-0x00007FF69F7A2000-memory.dmp

Filesize
3.9MB

Download
memory/4456-3071-0x00007FF69F3B0000-0x00007FF69F7A2000-memory.dmp

Filesize
3.9MB

Download
memory/4572-2929-0x00007FF70D7F0000-0x00007FF70DBE2000-memory.dmp

Filesize
3.9MB

Download
memory/4572-195-0x00007FF70D7F0000-0x00007FF70DBE2000-memory.dmp

Filesize
3.9MB

Download
memory/4624-265-0x00007FF75A1F0000-0x00007FF75A5E2000-memory.dmp

Filesize
3.9MB

Download
memory/4624-2927-0x00007FF75A1F0000-0x00007FF75A5E2000-memory.dmp

Filesize
3.9MB

Download
memory/4664-3041-0x00007FF6458E0000-0x00007FF645CD2000-memory.dmp

Filesize
3.9MB

Download
memory/4664-606-0x00007FF6458E0000-0x00007FF645CD2000-memory.dmp

Filesize
3.9MB

Download
memory/4736-2931-0x00007FF6558F0000-0x00007FF655CE2000-memory.dmp

Filesize
3.9MB

Download
memory/4736-832-0x00007FF6558F0000-0x00007FF655CE2000-memory.dmp

Filesize
3.9MB

Download
memory/4844-95-0x00007FFFF09E0000-0x00007FFFF14A1000-memory.dmp

Filesize
10.8MB

Download
memory/4844-177-0x00000210B45B0000-0x00000210B45D2000-memory.dmp

Filesize
136KB

Download
memory/4844-13-0x00007FFFF09E3000-0x00007FFFF09E5000-memory.dmp

Filesize
8KB

Download
memory/4844-609-0x00007FFFF09E0000-0x00007FFFF14A1000-memory.dmp

Filesize
10.8MB

Download