xmrig | c357742869fe3cb91cc0d7e4458fbe9350b32c71114e97ba35e8c5d1c222d9be

Analysis

max time kernel
68s
max time network
45s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 22:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
Size

1.8MB
MD5

01c5680929e5cd5f121dee10bb0795d7
SHA1

c162586b6bba6340062b51992afdef8351da4c8b
SHA256

c357742869fe3cb91cc0d7e4458fbe9350b32c71114e97ba35e8c5d1c222d9be
SHA512

7b94c3859bea8588b42cd4a62203bc223b09efe41fad23f8d154098c001984a00a5003454ad951fef4dd232783a5b32255e6c0f778c0dc65ba8ca404e7733c96
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrls:NABX

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 45 IoCs

miner

resource	yara_rule
behavioral2/memory/2764-38-0x00007FF6003F0000-0x00007FF6007E2000-memory.dmp	xmrig
behavioral2/memory/3132-69-0x00007FF62BCE0000-0x00007FF62C0D2000-memory.dmp	xmrig
behavioral2/memory/1892-75-0x00007FF715F10000-0x00007FF716302000-memory.dmp	xmrig
behavioral2/memory/1960-83-0x00007FF61BD70000-0x00007FF61C162000-memory.dmp	xmrig
behavioral2/memory/2784-87-0x00007FF79D090000-0x00007FF79D482000-memory.dmp	xmrig
behavioral2/memory/4844-94-0x00007FF681DF0000-0x00007FF6821E2000-memory.dmp	xmrig
behavioral2/memory/3404-90-0x00007FF6554B0000-0x00007FF6558A2000-memory.dmp	xmrig
behavioral2/memory/2812-86-0x00007FF68E5B0000-0x00007FF68E9A2000-memory.dmp	xmrig
behavioral2/memory/4252-65-0x00007FF7C17D0000-0x00007FF7C1BC2000-memory.dmp	xmrig
behavioral2/memory/3340-63-0x00007FF67BAF0000-0x00007FF67BEE2000-memory.dmp	xmrig
behavioral2/memory/4992-26-0x00007FF663DE0000-0x00007FF6641D2000-memory.dmp	xmrig
behavioral2/memory/3272-343-0x00007FF62B790000-0x00007FF62BB82000-memory.dmp	xmrig
behavioral2/memory/4948-143-0x00007FF795310000-0x00007FF795702000-memory.dmp	xmrig
behavioral2/memory/1440-141-0x00007FF739330000-0x00007FF739722000-memory.dmp	xmrig
behavioral2/memory/3512-127-0x00007FF75BFF0000-0x00007FF75C3E2000-memory.dmp	xmrig
behavioral2/memory/1532-1560-0x00007FF7AB7C0000-0x00007FF7ABBB2000-memory.dmp	xmrig
behavioral2/memory/3340-2077-0x00007FF67BAF0000-0x00007FF67BEE2000-memory.dmp	xmrig
behavioral2/memory/2864-2075-0x00007FF64B760000-0x00007FF64BB52000-memory.dmp	xmrig
behavioral2/memory/4844-2354-0x00007FF681DF0000-0x00007FF6821E2000-memory.dmp	xmrig
behavioral2/memory/2432-2355-0x00007FF7454C0000-0x00007FF7458B2000-memory.dmp	xmrig
behavioral2/memory/4980-2373-0x00007FF70F170000-0x00007FF70F562000-memory.dmp	xmrig
behavioral2/memory/2244-2374-0x00007FF785FA0000-0x00007FF786392000-memory.dmp	xmrig
behavioral2/memory/2220-2375-0x00007FF644FB0000-0x00007FF6453A2000-memory.dmp	xmrig
behavioral2/memory/4460-2376-0x00007FF6FF6F0000-0x00007FF6FFAE2000-memory.dmp	xmrig
behavioral2/memory/4992-2393-0x00007FF663DE0000-0x00007FF6641D2000-memory.dmp	xmrig
behavioral2/memory/4252-2395-0x00007FF7C17D0000-0x00007FF7C1BC2000-memory.dmp	xmrig
behavioral2/memory/2764-2408-0x00007FF6003F0000-0x00007FF6007E2000-memory.dmp	xmrig
behavioral2/memory/1892-2422-0x00007FF715F10000-0x00007FF716302000-memory.dmp	xmrig
behavioral2/memory/3340-2430-0x00007FF67BAF0000-0x00007FF67BEE2000-memory.dmp	xmrig
behavioral2/memory/3132-2428-0x00007FF62BCE0000-0x00007FF62C0D2000-memory.dmp	xmrig
behavioral2/memory/2864-2426-0x00007FF64B760000-0x00007FF64BB52000-memory.dmp	xmrig
behavioral2/memory/2432-2441-0x00007FF7454C0000-0x00007FF7458B2000-memory.dmp	xmrig
behavioral2/memory/4980-2443-0x00007FF70F170000-0x00007FF70F562000-memory.dmp	xmrig
behavioral2/memory/4844-2446-0x00007FF681DF0000-0x00007FF6821E2000-memory.dmp	xmrig
behavioral2/memory/2220-2448-0x00007FF644FB0000-0x00007FF6453A2000-memory.dmp	xmrig
behavioral2/memory/2244-2438-0x00007FF785FA0000-0x00007FF786392000-memory.dmp	xmrig
behavioral2/memory/2812-2434-0x00007FF68E5B0000-0x00007FF68E9A2000-memory.dmp	xmrig
behavioral2/memory/3404-2444-0x00007FF6554B0000-0x00007FF6558A2000-memory.dmp	xmrig
behavioral2/memory/2784-2436-0x00007FF79D090000-0x00007FF79D482000-memory.dmp	xmrig
behavioral2/memory/1960-2432-0x00007FF61BD70000-0x00007FF61C162000-memory.dmp	xmrig
behavioral2/memory/4460-2450-0x00007FF6FF6F0000-0x00007FF6FFAE2000-memory.dmp	xmrig
behavioral2/memory/3512-2466-0x00007FF75BFF0000-0x00007FF75C3E2000-memory.dmp	xmrig
behavioral2/memory/1440-2469-0x00007FF739330000-0x00007FF739722000-memory.dmp	xmrig
behavioral2/memory/4948-2470-0x00007FF795310000-0x00007FF795702000-memory.dmp	xmrig
behavioral2/memory/3272-2473-0x00007FF62B790000-0x00007FF62BB82000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4992	fIVxSaY.exe
4252	bIcGBkf.exe
2764	zYdWleF.exe
3132	zNVxGDb.exe
1892	IsVaEUi.exe
2864	uvIilSH.exe
3340	uxoqLWp.exe
1960	jdYYpOt.exe
2812	AsZdFbi.exe
3404	XIpnxmA.exe
4844	yjYfEMN.exe
2432	EhapqaA.exe
2784	ntSEqna.exe
4980	RJTeMJl.exe
2244	mGpnOQd.exe
2220	UqvXVuU.exe
4460	GgTiWSg.exe
3512	tNlrpfw.exe
1440	aOePkZJ.exe
4948	shywfFA.exe
3272	SqsSCQZ.exe
4448	dqSNOoh.exe
3224	UCGPlyo.exe
3604	zyDlxXl.exe
2644	MRlRtOB.exe
4936	SIbpOHP.exe
4784	glBsBpF.exe
1816	bduHPZo.exe
3160	daEJznN.exe
2496	wHfEJNW.exe
2756	ooFpvOL.exe
2256	YfATmRQ.exe
3204	HdEFkSd.exe
2836	eFUtzzF.exe
3460	mPaxjLD.exe
3912	STMPquU.exe
4344	tMfsYAs.exe
4328	JfMkhmt.exe
3152	GYynHVr.exe
3900	suqzTFG.exe
4056	XMxZJdr.exe
3036	oTgGRZE.exe
3936	BMTZDOq.exe
3904	dczAWwW.exe
4596	CkGpJMt.exe
736	mgvtaVj.exe
2776	QtOmanB.exe
848	uqeJkTx.exe
2720	mgIlOdV.exe
3200	SgkjiVV.exe
4488	nxZYmWA.exe
1260	QWLZWAC.exe
4704	EiZGQEC.exe
3652	pIatAjH.exe
4892	VaGtjWX.exe
332	utFAJOu.exe
2740	ukQPFfk.exe
1648	WmtuwWz.exe
5144	cZCjCus.exe
5172	DsSsjGA.exe
5204	KHQrFiX.exe
5228	TMYkBSg.exe
5256	WlyGtQI.exe
5284	rAXDAuc.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1532-0-0x00007FF7AB7C0000-0x00007FF7ABBB2000-memory.dmp	upx
behavioral2/files/0x000c000000023b48-5.dat	upx
behavioral2/files/0x000a000000023ba5-9.dat	upx
behavioral2/files/0x000e000000023b99-10.dat	upx
behavioral2/files/0x000a000000023ba8-29.dat	upx
behavioral2/memory/2764-38-0x00007FF6003F0000-0x00007FF6007E2000-memory.dmp	upx
behavioral2/memory/2864-56-0x00007FF64B760000-0x00007FF64BB52000-memory.dmp	upx
behavioral2/files/0x000a000000023ba9-53.dat	upx
behavioral2/files/0x000a000000023baa-59.dat	upx
behavioral2/memory/3132-69-0x00007FF62BCE0000-0x00007FF62C0D2000-memory.dmp	upx
behavioral2/memory/1892-75-0x00007FF715F10000-0x00007FF716302000-memory.dmp	upx
behavioral2/memory/1960-83-0x00007FF61BD70000-0x00007FF61C162000-memory.dmp	upx
behavioral2/memory/2784-87-0x00007FF79D090000-0x00007FF79D482000-memory.dmp	upx
behavioral2/memory/4844-94-0x00007FF681DF0000-0x00007FF6821E2000-memory.dmp	upx
behavioral2/files/0x000a000000023bb0-100.dat	upx
behavioral2/files/0x000d000000023b9a-108.dat	upx
behavioral2/files/0x000a000000023bb2-114.dat	upx
behavioral2/memory/4460-116-0x00007FF6FF6F0000-0x00007FF6FFAE2000-memory.dmp	upx
behavioral2/memory/2220-113-0x00007FF644FB0000-0x00007FF6453A2000-memory.dmp	upx
behavioral2/files/0x000a000000023bb1-111.dat	upx
behavioral2/memory/2244-107-0x00007FF785FA0000-0x00007FF786392000-memory.dmp	upx
behavioral2/files/0x000b000000023bab-102.dat	upx
behavioral2/memory/4980-99-0x00007FF70F170000-0x00007FF70F562000-memory.dmp	upx
behavioral2/memory/2432-95-0x00007FF7454C0000-0x00007FF7458B2000-memory.dmp	upx
behavioral2/memory/3404-90-0x00007FF6554B0000-0x00007FF6558A2000-memory.dmp	upx
behavioral2/memory/2812-86-0x00007FF68E5B0000-0x00007FF68E9A2000-memory.dmp	upx
behavioral2/files/0x000a000000023baf-84.dat	upx
behavioral2/files/0x000a000000023bae-80.dat	upx
behavioral2/files/0x000b000000023bac-78.dat	upx
behavioral2/files/0x000a000000023bad-70.dat	upx
behavioral2/memory/4252-65-0x00007FF7C17D0000-0x00007FF7C1BC2000-memory.dmp	upx
behavioral2/memory/3340-63-0x00007FF67BAF0000-0x00007FF67BEE2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba6-51.dat	upx
behavioral2/files/0x000a000000023ba7-41.dat	upx
behavioral2/memory/4992-26-0x00007FF663DE0000-0x00007FF6641D2000-memory.dmp	upx
behavioral2/files/0x000a000000023bb3-120.dat	upx
behavioral2/files/0x0031000000023bb7-135.dat	upx
behavioral2/files/0x000a000000023bb8-142.dat	upx
behavioral2/files/0x000a000000023bba-153.dat	upx
behavioral2/files/0x000a000000023bbb-158.dat	upx
behavioral2/files/0x000a000000023bbf-178.dat	upx
behavioral2/files/0x000a000000023bc1-186.dat	upx
behavioral2/memory/3272-343-0x00007FF62B790000-0x00007FF62BB82000-memory.dmp	upx
behavioral2/files/0x000a000000023bc3-196.dat	upx
behavioral2/files/0x000a000000023bc2-191.dat	upx
behavioral2/files/0x000a000000023bc0-189.dat	upx
behavioral2/files/0x000a000000023bbe-176.dat	upx
behavioral2/files/0x000a000000023bbd-172.dat	upx
behavioral2/files/0x000a000000023bbc-167.dat	upx
behavioral2/files/0x000a000000023bb9-149.dat	upx
behavioral2/memory/4948-143-0x00007FF795310000-0x00007FF795702000-memory.dmp	upx
behavioral2/memory/1440-141-0x00007FF739330000-0x00007FF739722000-memory.dmp	upx
behavioral2/files/0x0031000000023bb6-133.dat	upx
behavioral2/files/0x000a000000023bb4-130.dat	upx
behavioral2/memory/3512-127-0x00007FF75BFF0000-0x00007FF75C3E2000-memory.dmp	upx
behavioral2/memory/1532-1560-0x00007FF7AB7C0000-0x00007FF7ABBB2000-memory.dmp	upx
behavioral2/memory/3340-2077-0x00007FF67BAF0000-0x00007FF67BEE2000-memory.dmp	upx
behavioral2/memory/2864-2075-0x00007FF64B760000-0x00007FF64BB52000-memory.dmp	upx
behavioral2/memory/4844-2354-0x00007FF681DF0000-0x00007FF6821E2000-memory.dmp	upx
behavioral2/memory/2432-2355-0x00007FF7454C0000-0x00007FF7458B2000-memory.dmp	upx
behavioral2/memory/4980-2373-0x00007FF70F170000-0x00007FF70F562000-memory.dmp	upx
behavioral2/memory/2244-2374-0x00007FF785FA0000-0x00007FF786392000-memory.dmp	upx
behavioral2/memory/2220-2375-0x00007FF644FB0000-0x00007FF6453A2000-memory.dmp	upx
behavioral2/memory/4460-2376-0x00007FF6FF6F0000-0x00007FF6FFAE2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\HdEFkSd.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\uWfWIJi.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\ybRTYXs.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\NoreITd.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\VSUmCWa.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\uxoqLWp.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\cZCjCus.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\HkWpOCM.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\daEJznN.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\QFuiTcd.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\sLYBRWj.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\GmyrFVB.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\TnAfZwk.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\VwcXSGC.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\suqzTFG.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\uJbKkwG.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\AvXmBer.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\rPikbKa.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\jTcCaQA.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\aYPEbDH.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\wnDrvNo.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\DfejvaE.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\nLxYUDn.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\DwsicWx.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\CwCuhdz.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\RGQOwPx.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\PnWUvfT.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\ihNkUjm.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\yVZkvbh.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\ldesZFW.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\vYXaddr.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\dPSnjfh.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\wXKepTt.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\INlWDvV.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\ttNQsfg.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\TxrJpit.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\kOhSQbL.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\FNSPNyW.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\kTRhmkD.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\nzjyvuC.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\mMhdfJh.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\mgaNqwW.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\wfxclcG.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\TBCwotK.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\awCQrhk.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\YUpSSVC.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\LPBkRuq.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\UxQMDJq.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\pNovxll.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\nIdnsdn.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\EhapqaA.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\PaUfAQq.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\rpVPMhX.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\XMxZJdr.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\cNtuKJA.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\APkqZXD.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\YtvKsZb.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\GiqTQuQ.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\qULGFcY.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\vjDUyOg.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\aYorDDD.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\cYeDFsl.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\MPcBQGk.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
File created	C:\Windows\System\hYzdZPS.exe	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2448	powershell.exe
2448	powershell.exe
2448	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2448	powershell.exe
Token: SeLockMemoryPrivilege	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 2448	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	86
PID 1532 wrote to memory of 2448	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	86
PID 1532 wrote to memory of 4992	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	87
PID 1532 wrote to memory of 4992	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	87
PID 1532 wrote to memory of 4252	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	88
PID 1532 wrote to memory of 4252	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	88
PID 1532 wrote to memory of 2764	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	89
PID 1532 wrote to memory of 2764	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	89
PID 1532 wrote to memory of 3132	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	90
PID 1532 wrote to memory of 3132	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	90
PID 1532 wrote to memory of 1892	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	91
PID 1532 wrote to memory of 1892	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	91
PID 1532 wrote to memory of 2864	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	92
PID 1532 wrote to memory of 2864	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	92
PID 1532 wrote to memory of 3340	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	93
PID 1532 wrote to memory of 3340	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	93
PID 1532 wrote to memory of 1960	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	94
PID 1532 wrote to memory of 1960	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	94
PID 1532 wrote to memory of 2812	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	95
PID 1532 wrote to memory of 2812	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	95
PID 1532 wrote to memory of 3404	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	96
PID 1532 wrote to memory of 3404	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	96
PID 1532 wrote to memory of 4844	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	97
PID 1532 wrote to memory of 4844	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	97
PID 1532 wrote to memory of 2432	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	98
PID 1532 wrote to memory of 2432	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	98
PID 1532 wrote to memory of 2784	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	99
PID 1532 wrote to memory of 2784	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	99
PID 1532 wrote to memory of 4980	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	100
PID 1532 wrote to memory of 4980	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	100
PID 1532 wrote to memory of 2244	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	101
PID 1532 wrote to memory of 2244	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	101
PID 1532 wrote to memory of 2220	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	102
PID 1532 wrote to memory of 2220	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	102
PID 1532 wrote to memory of 4460	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	103
PID 1532 wrote to memory of 4460	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	103
PID 1532 wrote to memory of 3512	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	104
PID 1532 wrote to memory of 3512	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	104
PID 1532 wrote to memory of 1440	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	105
PID 1532 wrote to memory of 1440	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	105
PID 1532 wrote to memory of 4948	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	106
PID 1532 wrote to memory of 4948	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	106
PID 1532 wrote to memory of 3272	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	107
PID 1532 wrote to memory of 3272	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	107
PID 1532 wrote to memory of 4448	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	108
PID 1532 wrote to memory of 4448	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	108
PID 1532 wrote to memory of 3224	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	109
PID 1532 wrote to memory of 3224	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	109
PID 1532 wrote to memory of 3604	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	110
PID 1532 wrote to memory of 3604	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	110
PID 1532 wrote to memory of 2644	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	111
PID 1532 wrote to memory of 2644	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	111
PID 1532 wrote to memory of 4936	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	112
PID 1532 wrote to memory of 4936	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	112
PID 1532 wrote to memory of 4784	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	113
PID 1532 wrote to memory of 4784	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	113
PID 1532 wrote to memory of 1816	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	114
PID 1532 wrote to memory of 1816	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	114
PID 1532 wrote to memory of 3160	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	115
PID 1532 wrote to memory of 3160	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	115
PID 1532 wrote to memory of 2496	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	116
PID 1532 wrote to memory of 2496	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	116
PID 1532 wrote to memory of 2756	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	117
PID 1532 wrote to memory of 2756	1532	01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe	117

C:\Users\Admin\AppData\Local\Temp\01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\01c5680929e5cd5f121dee10bb0795d7_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2448
- C:\Windows\System\fIVxSaY.exe
  C:\Windows\System\fIVxSaY.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\bIcGBkf.exe
  C:\Windows\System\bIcGBkf.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\zYdWleF.exe
  C:\Windows\System\zYdWleF.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\zNVxGDb.exe
  C:\Windows\System\zNVxGDb.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\IsVaEUi.exe
  C:\Windows\System\IsVaEUi.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\uvIilSH.exe
  C:\Windows\System\uvIilSH.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\uxoqLWp.exe
  C:\Windows\System\uxoqLWp.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\jdYYpOt.exe
  C:\Windows\System\jdYYpOt.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\AsZdFbi.exe
  C:\Windows\System\AsZdFbi.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\XIpnxmA.exe
  C:\Windows\System\XIpnxmA.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\yjYfEMN.exe
  C:\Windows\System\yjYfEMN.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\EhapqaA.exe
  C:\Windows\System\EhapqaA.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\ntSEqna.exe
  C:\Windows\System\ntSEqna.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\RJTeMJl.exe
  C:\Windows\System\RJTeMJl.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\mGpnOQd.exe
  C:\Windows\System\mGpnOQd.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\UqvXVuU.exe
  C:\Windows\System\UqvXVuU.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\GgTiWSg.exe
  C:\Windows\System\GgTiWSg.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\tNlrpfw.exe
  C:\Windows\System\tNlrpfw.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\aOePkZJ.exe
  C:\Windows\System\aOePkZJ.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\shywfFA.exe
  C:\Windows\System\shywfFA.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\SqsSCQZ.exe
  C:\Windows\System\SqsSCQZ.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\dqSNOoh.exe
  C:\Windows\System\dqSNOoh.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\UCGPlyo.exe
  C:\Windows\System\UCGPlyo.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\zyDlxXl.exe
  C:\Windows\System\zyDlxXl.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\MRlRtOB.exe
  C:\Windows\System\MRlRtOB.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\SIbpOHP.exe
  C:\Windows\System\SIbpOHP.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\glBsBpF.exe
  C:\Windows\System\glBsBpF.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\bduHPZo.exe
  C:\Windows\System\bduHPZo.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\daEJznN.exe
  C:\Windows\System\daEJznN.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\wHfEJNW.exe
  C:\Windows\System\wHfEJNW.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\ooFpvOL.exe
  C:\Windows\System\ooFpvOL.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\YfATmRQ.exe
  C:\Windows\System\YfATmRQ.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\HdEFkSd.exe
  C:\Windows\System\HdEFkSd.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\eFUtzzF.exe
  C:\Windows\System\eFUtzzF.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\mPaxjLD.exe
  C:\Windows\System\mPaxjLD.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\STMPquU.exe
  C:\Windows\System\STMPquU.exe
  2⤵
  - Executes dropped EXE
  PID:3912
- C:\Windows\System\tMfsYAs.exe
  C:\Windows\System\tMfsYAs.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\JfMkhmt.exe
  C:\Windows\System\JfMkhmt.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\GYynHVr.exe
  C:\Windows\System\GYynHVr.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\suqzTFG.exe
  C:\Windows\System\suqzTFG.exe
  2⤵
  - Executes dropped EXE
  PID:3900
- C:\Windows\System\XMxZJdr.exe
  C:\Windows\System\XMxZJdr.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\oTgGRZE.exe
  C:\Windows\System\oTgGRZE.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\BMTZDOq.exe
  C:\Windows\System\BMTZDOq.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System\dczAWwW.exe
  C:\Windows\System\dczAWwW.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\CkGpJMt.exe
  C:\Windows\System\CkGpJMt.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\mgvtaVj.exe
  C:\Windows\System\mgvtaVj.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\QtOmanB.exe
  C:\Windows\System\QtOmanB.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\uqeJkTx.exe
  C:\Windows\System\uqeJkTx.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\mgIlOdV.exe
  C:\Windows\System\mgIlOdV.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\SgkjiVV.exe
  C:\Windows\System\SgkjiVV.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\nxZYmWA.exe
  C:\Windows\System\nxZYmWA.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\QWLZWAC.exe
  C:\Windows\System\QWLZWAC.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\EiZGQEC.exe
  C:\Windows\System\EiZGQEC.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\pIatAjH.exe
  C:\Windows\System\pIatAjH.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\VaGtjWX.exe
  C:\Windows\System\VaGtjWX.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\utFAJOu.exe
  C:\Windows\System\utFAJOu.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\ukQPFfk.exe
  C:\Windows\System\ukQPFfk.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\WmtuwWz.exe
  C:\Windows\System\WmtuwWz.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\cZCjCus.exe
  C:\Windows\System\cZCjCus.exe
  2⤵
  - Executes dropped EXE
  PID:5144
- C:\Windows\System\DsSsjGA.exe
  C:\Windows\System\DsSsjGA.exe
  2⤵
  - Executes dropped EXE
  PID:5172
- C:\Windows\System\KHQrFiX.exe
  C:\Windows\System\KHQrFiX.exe
  2⤵
  - Executes dropped EXE
  PID:5204
- C:\Windows\System\TMYkBSg.exe
  C:\Windows\System\TMYkBSg.exe
  2⤵
  - Executes dropped EXE
  PID:5228
- C:\Windows\System\WlyGtQI.exe
  C:\Windows\System\WlyGtQI.exe
  2⤵
  - Executes dropped EXE
  PID:5256
- C:\Windows\System\rAXDAuc.exe
  C:\Windows\System\rAXDAuc.exe
  2⤵
  - Executes dropped EXE
  PID:5284
- C:\Windows\System\NlevTAK.exe
  C:\Windows\System\NlevTAK.exe
  2⤵
  PID:5312
- C:\Windows\System\tYBSEkO.exe
  C:\Windows\System\tYBSEkO.exe
  2⤵
  PID:5340
- C:\Windows\System\RUlisbF.exe
  C:\Windows\System\RUlisbF.exe
  2⤵
  PID:5368
- C:\Windows\System\fOOSuUu.exe
  C:\Windows\System\fOOSuUu.exe
  2⤵
  PID:5396
- C:\Windows\System\RlwftVd.exe
  C:\Windows\System\RlwftVd.exe
  2⤵
  PID:5424
- C:\Windows\System\jgOgmcs.exe
  C:\Windows\System\jgOgmcs.exe
  2⤵
  PID:5452
- C:\Windows\System\zHCZTlK.exe
  C:\Windows\System\zHCZTlK.exe
  2⤵
  PID:5480
- C:\Windows\System\LfjRxtx.exe
  C:\Windows\System\LfjRxtx.exe
  2⤵
  PID:5512
- C:\Windows\System\hbIWuDx.exe
  C:\Windows\System\hbIWuDx.exe
  2⤵
  PID:5536
- C:\Windows\System\KKqBWtv.exe
  C:\Windows\System\KKqBWtv.exe
  2⤵
  PID:5560
- C:\Windows\System\UuBbwiJ.exe
  C:\Windows\System\UuBbwiJ.exe
  2⤵
  PID:5592
- C:\Windows\System\PJgYKDL.exe
  C:\Windows\System\PJgYKDL.exe
  2⤵
  PID:5620
- C:\Windows\System\mlIsrfT.exe
  C:\Windows\System\mlIsrfT.exe
  2⤵
  PID:5648
- C:\Windows\System\HOWnhlS.exe
  C:\Windows\System\HOWnhlS.exe
  2⤵
  PID:5676
- C:\Windows\System\NADMZrZ.exe
  C:\Windows\System\NADMZrZ.exe
  2⤵
  PID:5704
- C:\Windows\System\SOrukQS.exe
  C:\Windows\System\SOrukQS.exe
  2⤵
  PID:5732
- C:\Windows\System\DLkuEcp.exe
  C:\Windows\System\DLkuEcp.exe
  2⤵
  PID:5760
- C:\Windows\System\ZgHiAnH.exe
  C:\Windows\System\ZgHiAnH.exe
  2⤵
  PID:5788
- C:\Windows\System\srPcVEI.exe
  C:\Windows\System\srPcVEI.exe
  2⤵
  PID:5820
- C:\Windows\System\xDdBHAT.exe
  C:\Windows\System\xDdBHAT.exe
  2⤵
  PID:5856
- C:\Windows\System\zJAJqMj.exe
  C:\Windows\System\zJAJqMj.exe
  2⤵
  PID:5916
- C:\Windows\System\VKPNBqP.exe
  C:\Windows\System\VKPNBqP.exe
  2⤵
  PID:5944
- C:\Windows\System\Kshdfhw.exe
  C:\Windows\System\Kshdfhw.exe
  2⤵
  PID:5972
- C:\Windows\System\ZHDpwPi.exe
  C:\Windows\System\ZHDpwPi.exe
  2⤵
  PID:5996
- C:\Windows\System\hUolIDb.exe
  C:\Windows\System\hUolIDb.exe
  2⤵
  PID:6040
- C:\Windows\System\renDobC.exe
  C:\Windows\System\renDobC.exe
  2⤵
  PID:6056
- C:\Windows\System\ZpsMGfm.exe
  C:\Windows\System\ZpsMGfm.exe
  2⤵
  PID:6088
- C:\Windows\System\ClRkZXy.exe
  C:\Windows\System\ClRkZXy.exe
  2⤵
  PID:6108
- C:\Windows\System\yhcIAXW.exe
  C:\Windows\System\yhcIAXW.exe
  2⤵
  PID:6140
- C:\Windows\System\TBCwotK.exe
  C:\Windows\System\TBCwotK.exe
  2⤵
  PID:2696
- C:\Windows\System\yVqoHtF.exe
  C:\Windows\System\yVqoHtF.exe
  2⤵
  PID:5604
- C:\Windows\System\nNBYwuF.exe
  C:\Windows\System\nNBYwuF.exe
  2⤵
  PID:2276
- C:\Windows\System\pCTRlVt.exe
  C:\Windows\System\pCTRlVt.exe
  2⤵
  PID:5532
- C:\Windows\System\NtycoVi.exe
  C:\Windows\System\NtycoVi.exe
  2⤵
  PID:5496
- C:\Windows\System\xAdBgun.exe
  C:\Windows\System\xAdBgun.exe
  2⤵
  PID:5440
- C:\Windows\System\WfGDfBY.exe
  C:\Windows\System\WfGDfBY.exe
  2⤵
  PID:5384
- C:\Windows\System\kzWHgAA.exe
  C:\Windows\System\kzWHgAA.exe
  2⤵
  PID:5328
- C:\Windows\System\qrLVXds.exe
  C:\Windows\System\qrLVXds.exe
  2⤵
  PID:5268
- C:\Windows\System\qIouOaY.exe
  C:\Windows\System\qIouOaY.exe
  2⤵
  PID:5160
- C:\Windows\System\NAfjMjN.exe
  C:\Windows\System\NAfjMjN.exe
  2⤵
  PID:4812
- C:\Windows\System\uJbKkwG.exe
  C:\Windows\System\uJbKkwG.exe
  2⤵
  PID:4788
- C:\Windows\System\pQtKqsy.exe
  C:\Windows\System\pQtKqsy.exe
  2⤵
  PID:1244
- C:\Windows\System\WDvGQPX.exe
  C:\Windows\System\WDvGQPX.exe
  2⤵
  PID:3320
- C:\Windows\System\ePXvhcU.exe
  C:\Windows\System\ePXvhcU.exe
  2⤵
  PID:3524
- C:\Windows\System\DIecIZo.exe
  C:\Windows\System\DIecIZo.exe
  2⤵
  PID:2288
- C:\Windows\System\rIFrlLj.exe
  C:\Windows\System\rIFrlLj.exe
  2⤵
  PID:2364
- C:\Windows\System\rzcZqzX.exe
  C:\Windows\System\rzcZqzX.exe
  2⤵
  PID:3236
- C:\Windows\System\XdOxjET.exe
  C:\Windows\System\XdOxjET.exe
  2⤵
  PID:2848
- C:\Windows\System\TDRPsrr.exe
  C:\Windows\System\TDRPsrr.exe
  2⤵
  PID:3528
- C:\Windows\System\GUQRPLy.exe
  C:\Windows\System\GUQRPLy.exe
  2⤵
  PID:4424
- C:\Windows\System\aDDxVjB.exe
  C:\Windows\System\aDDxVjB.exe
  2⤵
  PID:4572
- C:\Windows\System\mgaNqwW.exe
  C:\Windows\System\mgaNqwW.exe
  2⤵
  PID:5080
- C:\Windows\System\QzwGLnR.exe
  C:\Windows\System\QzwGLnR.exe
  2⤵
  PID:4540
- C:\Windows\System\gPFkMFL.exe
  C:\Windows\System\gPFkMFL.exe
  2⤵
  PID:4428
- C:\Windows\System\phjzJLX.exe
  C:\Windows\System\phjzJLX.exe
  2⤵
  PID:4544
- C:\Windows\System\EHDbOfB.exe
  C:\Windows\System\EHDbOfB.exe
  2⤵
  PID:3980
- C:\Windows\System\BBRAPvO.exe
  C:\Windows\System\BBRAPvO.exe
  2⤵
  PID:5744
- C:\Windows\System\iXtxGuo.exe
  C:\Windows\System\iXtxGuo.exe
  2⤵
  PID:3544
- C:\Windows\System\kQBAHcN.exe
  C:\Windows\System\kQBAHcN.exe
  2⤵
  PID:4464
- C:\Windows\System\YuDOFzN.exe
  C:\Windows\System\YuDOFzN.exe
  2⤵
  PID:5808
- C:\Windows\System\MnahsQb.exe
  C:\Windows\System\MnahsQb.exe
  2⤵
  PID:5896
- C:\Windows\System\MTFQTJX.exe
  C:\Windows\System\MTFQTJX.exe
  2⤵
  PID:3364
- C:\Windows\System\AWMLuYL.exe
  C:\Windows\System\AWMLuYL.exe
  2⤵
  PID:5984
- C:\Windows\System\tgYdmjd.exe
  C:\Windows\System\tgYdmjd.exe
  2⤵
  PID:4368
- C:\Windows\System\PJVhNsU.exe
  C:\Windows\System\PJVhNsU.exe
  2⤵
  PID:5612
- C:\Windows\System\dtwJDUB.exe
  C:\Windows\System\dtwJDUB.exe
  2⤵
  PID:5552
- C:\Windows\System\WiZhfMz.exe
  C:\Windows\System\WiZhfMz.exe
  2⤵
  PID:5388
- C:\Windows\System\XqVMQYj.exe
  C:\Windows\System\XqVMQYj.exe
  2⤵
  PID:5188
- C:\Windows\System\cHfraFN.exe
  C:\Windows\System\cHfraFN.exe
  2⤵
  PID:4176
- C:\Windows\System\boSDRQs.exe
  C:\Windows\System\boSDRQs.exe
  2⤵
  PID:5832
- C:\Windows\System\ldesZFW.exe
  C:\Windows\System\ldesZFW.exe
  2⤵
  PID:3216
- C:\Windows\System\deJZIVH.exe
  C:\Windows\System\deJZIVH.exe
  2⤵
  PID:2808
- C:\Windows\System\uyVkRBM.exe
  C:\Windows\System\uyVkRBM.exe
  2⤵
  PID:4012
- C:\Windows\System\KyqOvXa.exe
  C:\Windows\System\KyqOvXa.exe
  2⤵
  PID:3968
- C:\Windows\System\kQJSpXq.exe
  C:\Windows\System\kQJSpXq.exe
  2⤵
  PID:1996
- C:\Windows\System\OpIfoTt.exe
  C:\Windows\System\OpIfoTt.exe
  2⤵
  PID:4104
- C:\Windows\System\kCZqQuV.exe
  C:\Windows\System\kCZqQuV.exe
  2⤵
  PID:5772
- C:\Windows\System\WQuNvyq.exe
  C:\Windows\System\WQuNvyq.exe
  2⤵
  PID:6016
- C:\Windows\System\AqqtpDb.exe
  C:\Windows\System\AqqtpDb.exe
  2⤵
  PID:6100
- C:\Windows\System\SLnDyxJ.exe
  C:\Windows\System\SLnDyxJ.exe
  2⤵
  PID:5556
- C:\Windows\System\snDWjnY.exe
  C:\Windows\System\snDWjnY.exe
  2⤵
  PID:1728
- C:\Windows\System\aYorDDD.exe
  C:\Windows\System\aYorDDD.exe
  2⤵
  PID:5048
- C:\Windows\System\zyiIKHU.exe
  C:\Windows\System\zyiIKHU.exe
  2⤵
  PID:4020
- C:\Windows\System\yEIvgRk.exe
  C:\Windows\System\yEIvgRk.exe
  2⤵
  PID:3004
- C:\Windows\System\WZzeNva.exe
  C:\Windows\System\WZzeNva.exe
  2⤵
  PID:2460
- C:\Windows\System\YVOuKVy.exe
  C:\Windows\System\YVOuKVy.exe
  2⤵
  PID:5756
- C:\Windows\System\bOBsUpb.exe
  C:\Windows\System\bOBsUpb.exe
  2⤵
  PID:2216
- C:\Windows\System\cyfMLGv.exe
  C:\Windows\System\cyfMLGv.exe
  2⤵
  PID:60
- C:\Windows\System\SjkCJFA.exe
  C:\Windows\System\SjkCJFA.exe
  2⤵
  PID:1428
- C:\Windows\System\WGWfeXT.exe
  C:\Windows\System\WGWfeXT.exe
  2⤵
  PID:5192
- C:\Windows\System\YjLiElx.exe
  C:\Windows\System\YjLiElx.exe
  2⤵
  PID:6148
- C:\Windows\System\OpFnGKK.exe
  C:\Windows\System\OpFnGKK.exe
  2⤵
  PID:6172
- C:\Windows\System\VJHlluF.exe
  C:\Windows\System\VJHlluF.exe
  2⤵
  PID:6232
- C:\Windows\System\haKFVWR.exe
  C:\Windows\System\haKFVWR.exe
  2⤵
  PID:6280
- C:\Windows\System\cGAzldG.exe
  C:\Windows\System\cGAzldG.exe
  2⤵
  PID:6312
- C:\Windows\System\vRireKw.exe
  C:\Windows\System\vRireKw.exe
  2⤵
  PID:6328
- C:\Windows\System\nWitVho.exe
  C:\Windows\System\nWitVho.exe
  2⤵
  PID:6360
- C:\Windows\System\qoDjVac.exe
  C:\Windows\System\qoDjVac.exe
  2⤵
  PID:6380
- C:\Windows\System\riOLyhf.exe
  C:\Windows\System\riOLyhf.exe
  2⤵
  PID:6396
- C:\Windows\System\fztjehM.exe
  C:\Windows\System\fztjehM.exe
  2⤵
  PID:6416
- C:\Windows\System\WQvsJEw.exe
  C:\Windows\System\WQvsJEw.exe
  2⤵
  PID:6436
- C:\Windows\System\uWfWIJi.exe
  C:\Windows\System\uWfWIJi.exe
  2⤵
  PID:6468
- C:\Windows\System\RzqmjBw.exe
  C:\Windows\System\RzqmjBw.exe
  2⤵
  PID:6488
- C:\Windows\System\cYeDFsl.exe
  C:\Windows\System\cYeDFsl.exe
  2⤵
  PID:6536
- C:\Windows\System\mamhCJs.exe
  C:\Windows\System\mamhCJs.exe
  2⤵
  PID:6556
- C:\Windows\System\lTlgDWL.exe
  C:\Windows\System\lTlgDWL.exe
  2⤵
  PID:6608
- C:\Windows\System\ObfqkEU.exe
  C:\Windows\System\ObfqkEU.exe
  2⤵
  PID:6636
- C:\Windows\System\HUpPumJ.exe
  C:\Windows\System\HUpPumJ.exe
  2⤵
  PID:6656
- C:\Windows\System\iCNejnd.exe
  C:\Windows\System\iCNejnd.exe
  2⤵
  PID:6684
- C:\Windows\System\ELTpzjC.exe
  C:\Windows\System\ELTpzjC.exe
  2⤵
  PID:6732
- C:\Windows\System\GlIxsgH.exe
  C:\Windows\System\GlIxsgH.exe
  2⤵
  PID:6752
- C:\Windows\System\uRuciyH.exe
  C:\Windows\System\uRuciyH.exe
  2⤵
  PID:6808
- C:\Windows\System\sqQJRnc.exe
  C:\Windows\System\sqQJRnc.exe
  2⤵
  PID:6824
- C:\Windows\System\VpDNMpB.exe
  C:\Windows\System\VpDNMpB.exe
  2⤵
  PID:6844
- C:\Windows\System\jrksZEo.exe
  C:\Windows\System\jrksZEo.exe
  2⤵
  PID:6872
- C:\Windows\System\TxrJpit.exe
  C:\Windows\System\TxrJpit.exe
  2⤵
  PID:6896
- C:\Windows\System\WXjpjCw.exe
  C:\Windows\System\WXjpjCw.exe
  2⤵
  PID:6932
- C:\Windows\System\ESkrmNn.exe
  C:\Windows\System\ESkrmNn.exe
  2⤵
  PID:6956
- C:\Windows\System\ZxuuhDB.exe
  C:\Windows\System\ZxuuhDB.exe
  2⤵
  PID:6980
- C:\Windows\System\NfsNcoJ.exe
  C:\Windows\System\NfsNcoJ.exe
  2⤵
  PID:7028
- C:\Windows\System\hmRdzka.exe
  C:\Windows\System\hmRdzka.exe
  2⤵
  PID:7044
- C:\Windows\System\FOzvctZ.exe
  C:\Windows\System\FOzvctZ.exe
  2⤵
  PID:7068
- C:\Windows\System\Odrflqg.exe
  C:\Windows\System\Odrflqg.exe
  2⤵
  PID:7088
- C:\Windows\System\CUCRglB.exe
  C:\Windows\System\CUCRglB.exe
  2⤵
  PID:7136
- C:\Windows\System\FsatzNc.exe
  C:\Windows\System\FsatzNc.exe
  2⤵
  PID:4648
- C:\Windows\System\cCwNjNi.exe
  C:\Windows\System\cCwNjNi.exe
  2⤵
  PID:6200
- C:\Windows\System\iDvVNgh.exe
  C:\Windows\System\iDvVNgh.exe
  2⤵
  PID:6224
- C:\Windows\System\tDgCoHE.exe
  C:\Windows\System\tDgCoHE.exe
  2⤵
  PID:6320
- C:\Windows\System\ptFHpNh.exe
  C:\Windows\System\ptFHpNh.exe
  2⤵
  PID:6372
- C:\Windows\System\vAXumoC.exe
  C:\Windows\System\vAXumoC.exe
  2⤵
  PID:6428
- C:\Windows\System\AVIXXRC.exe
  C:\Windows\System\AVIXXRC.exe
  2⤵
  PID:6496
- C:\Windows\System\oeEPEQA.exe
  C:\Windows\System\oeEPEQA.exe
  2⤵
  PID:6460
- C:\Windows\System\QyImvFF.exe
  C:\Windows\System\QyImvFF.exe
  2⤵
  PID:6568
- C:\Windows\System\cPTObVc.exe
  C:\Windows\System\cPTObVc.exe
  2⤵
  PID:6744
- C:\Windows\System\jSHcVKB.exe
  C:\Windows\System\jSHcVKB.exe
  2⤵
  PID:6764
- C:\Windows\System\ZDiMYsF.exe
  C:\Windows\System\ZDiMYsF.exe
  2⤵
  PID:6840
- C:\Windows\System\wlafJNF.exe
  C:\Windows\System\wlafJNF.exe
  2⤵
  PID:6924
- C:\Windows\System\NPRBAiD.exe
  C:\Windows\System\NPRBAiD.exe
  2⤵
  PID:6952
- C:\Windows\System\fzcDdwR.exe
  C:\Windows\System\fzcDdwR.exe
  2⤵
  PID:6968
- C:\Windows\System\dtMPAMS.exe
  C:\Windows\System\dtMPAMS.exe
  2⤵
  PID:7080
- C:\Windows\System\EcOnKOY.exe
  C:\Windows\System\EcOnKOY.exe
  2⤵
  PID:7112
- C:\Windows\System\Jkjrctd.exe
  C:\Windows\System\Jkjrctd.exe
  2⤵
  PID:2996
- C:\Windows\System\nvCXEpW.exe
  C:\Windows\System\nvCXEpW.exe
  2⤵
  PID:6336
- C:\Windows\System\AayztGF.exe
  C:\Windows\System\AayztGF.exe
  2⤵
  PID:6452
- C:\Windows\System\RKGfpPX.exe
  C:\Windows\System\RKGfpPX.exe
  2⤵
  PID:6628
- C:\Windows\System\OzNvHzc.exe
  C:\Windows\System\OzNvHzc.exe
  2⤵
  PID:6704
- C:\Windows\System\RjlbMFx.exe
  C:\Windows\System\RjlbMFx.exe
  2⤵
  PID:6836
- C:\Windows\System\AZhakXl.exe
  C:\Windows\System\AZhakXl.exe
  2⤵
  PID:7036
- C:\Windows\System\gIpmlSq.exe
  C:\Windows\System\gIpmlSq.exe
  2⤵
  PID:6260
- C:\Windows\System\gnyDxGD.exe
  C:\Windows\System\gnyDxGD.exe
  2⤵
  PID:6552
- C:\Windows\System\dPSnjfh.exe
  C:\Windows\System\dPSnjfh.exe
  2⤵
  PID:7132
- C:\Windows\System\CSqJHdS.exe
  C:\Windows\System\CSqJHdS.exe
  2⤵
  PID:6796
- C:\Windows\System\spScVJo.exe
  C:\Windows\System\spScVJo.exe
  2⤵
  PID:6972
- C:\Windows\System\DwsicWx.exe
  C:\Windows\System\DwsicWx.exe
  2⤵
  PID:7176
- C:\Windows\System\VzRrarQ.exe
  C:\Windows\System\VzRrarQ.exe
  2⤵
  PID:7200
- C:\Windows\System\lVSJJre.exe
  C:\Windows\System\lVSJJre.exe
  2⤵
  PID:7220
- C:\Windows\System\DDVpKRc.exe
  C:\Windows\System\DDVpKRc.exe
  2⤵
  PID:7260
- C:\Windows\System\AvXmBer.exe
  C:\Windows\System\AvXmBer.exe
  2⤵
  PID:7288
- C:\Windows\System\CionaSK.exe
  C:\Windows\System\CionaSK.exe
  2⤵
  PID:7308
- C:\Windows\System\GCGZDin.exe
  C:\Windows\System\GCGZDin.exe
  2⤵
  PID:7328
- C:\Windows\System\lauWajH.exe
  C:\Windows\System\lauWajH.exe
  2⤵
  PID:7368
- C:\Windows\System\tvUvCob.exe
  C:\Windows\System\tvUvCob.exe
  2⤵
  PID:7408
- C:\Windows\System\GqrkjTs.exe
  C:\Windows\System\GqrkjTs.exe
  2⤵
  PID:7428
- C:\Windows\System\rPikbKa.exe
  C:\Windows\System\rPikbKa.exe
  2⤵
  PID:7452
- C:\Windows\System\OuUcOkR.exe
  C:\Windows\System\OuUcOkR.exe
  2⤵
  PID:7472
- C:\Windows\System\PClHqPW.exe
  C:\Windows\System\PClHqPW.exe
  2⤵
  PID:7500
- C:\Windows\System\RSdqbtX.exe
  C:\Windows\System\RSdqbtX.exe
  2⤵
  PID:7556
- C:\Windows\System\dKRBzUO.exe
  C:\Windows\System\dKRBzUO.exe
  2⤵
  PID:7576
- C:\Windows\System\hWhLegR.exe
  C:\Windows\System\hWhLegR.exe
  2⤵
  PID:7616
- C:\Windows\System\LHYxsxs.exe
  C:\Windows\System\LHYxsxs.exe
  2⤵
  PID:7644
- C:\Windows\System\XJxdxhj.exe
  C:\Windows\System\XJxdxhj.exe
  2⤵
  PID:7668
- C:\Windows\System\QqFHxGK.exe
  C:\Windows\System\QqFHxGK.exe
  2⤵
  PID:7688
- C:\Windows\System\LVrujDf.exe
  C:\Windows\System\LVrujDf.exe
  2⤵
  PID:7712
- C:\Windows\System\BlvzDJV.exe
  C:\Windows\System\BlvzDJV.exe
  2⤵
  PID:7736
- C:\Windows\System\BGNVrTL.exe
  C:\Windows\System\BGNVrTL.exe
  2⤵
  PID:7756
- C:\Windows\System\kOhSQbL.exe
  C:\Windows\System\kOhSQbL.exe
  2⤵
  PID:7804
- C:\Windows\System\SpEsIgU.exe
  C:\Windows\System\SpEsIgU.exe
  2⤵
  PID:7824
- C:\Windows\System\SNpFGSA.exe
  C:\Windows\System\SNpFGSA.exe
  2⤵
  PID:7848
- C:\Windows\System\qEoJgEE.exe
  C:\Windows\System\qEoJgEE.exe
  2⤵
  PID:7876
- C:\Windows\System\xNcaSNH.exe
  C:\Windows\System\xNcaSNH.exe
  2⤵
  PID:7920
- C:\Windows\System\LUdrnJR.exe
  C:\Windows\System\LUdrnJR.exe
  2⤵
  PID:7936
- C:\Windows\System\YgtDCvN.exe
  C:\Windows\System\YgtDCvN.exe
  2⤵
  PID:7960
- C:\Windows\System\AIuSeMH.exe
  C:\Windows\System\AIuSeMH.exe
  2⤵
  PID:7984
- C:\Windows\System\sEUqxdf.exe
  C:\Windows\System\sEUqxdf.exe
  2⤵
  PID:8004
- C:\Windows\System\sqZHGLW.exe
  C:\Windows\System\sqZHGLW.exe
  2⤵
  PID:8052
- C:\Windows\System\tblHSQT.exe
  C:\Windows\System\tblHSQT.exe
  2⤵
  PID:8080
- C:\Windows\System\unoRywN.exe
  C:\Windows\System\unoRywN.exe
  2⤵
  PID:8096
- C:\Windows\System\rZZQKdV.exe
  C:\Windows\System\rZZQKdV.exe
  2⤵
  PID:8144
- C:\Windows\System\bPiwmuC.exe
  C:\Windows\System\bPiwmuC.exe
  2⤵
  PID:8172
- C:\Windows\System\VYUHiTL.exe
  C:\Windows\System\VYUHiTL.exe
  2⤵
  PID:6800
- C:\Windows\System\cbbDjHf.exe
  C:\Windows\System\cbbDjHf.exe
  2⤵
  PID:7216
- C:\Windows\System\zPsJlnM.exe
  C:\Windows\System\zPsJlnM.exe
  2⤵
  PID:7296
- C:\Windows\System\DRCHAkB.exe
  C:\Windows\System\DRCHAkB.exe
  2⤵
  PID:7392
- C:\Windows\System\kdhGCvM.exe
  C:\Windows\System\kdhGCvM.exe
  2⤵
  PID:7356
- C:\Windows\System\BOOHGRq.exe
  C:\Windows\System\BOOHGRq.exe
  2⤵
  PID:7464
- C:\Windows\System\sGJCjfQ.exe
  C:\Windows\System\sGJCjfQ.exe
  2⤵
  PID:7480
- C:\Windows\System\oMYbAxr.exe
  C:\Windows\System\oMYbAxr.exe
  2⤵
  PID:7596
- C:\Windows\System\QShCKoe.exe
  C:\Windows\System\QShCKoe.exe
  2⤵
  PID:7636
- C:\Windows\System\lzNFwGA.exe
  C:\Windows\System\lzNFwGA.exe
  2⤵
  PID:7704
- C:\Windows\System\oCGhjih.exe
  C:\Windows\System\oCGhjih.exe
  2⤵
  PID:7752
- C:\Windows\System\xLoiBGK.exe
  C:\Windows\System\xLoiBGK.exe
  2⤵
  PID:7820
- C:\Windows\System\GWIHZrt.exe
  C:\Windows\System\GWIHZrt.exe
  2⤵
  PID:7856
- C:\Windows\System\vEGHqoc.exe
  C:\Windows\System\vEGHqoc.exe
  2⤵
  PID:7928
- C:\Windows\System\ZsSLeaS.exe
  C:\Windows\System\ZsSLeaS.exe
  2⤵
  PID:7976
- C:\Windows\System\aNZHjYx.exe
  C:\Windows\System\aNZHjYx.exe
  2⤵
  PID:8092
- C:\Windows\System\gZamvpv.exe
  C:\Windows\System\gZamvpv.exe
  2⤵
  PID:8188
- C:\Windows\System\iUoiVZn.exe
  C:\Windows\System\iUoiVZn.exe
  2⤵
  PID:7448
- C:\Windows\System\wmNukfW.exe
  C:\Windows\System\wmNukfW.exe
  2⤵
  PID:7488
- C:\Windows\System\WNmtFuh.exe
  C:\Windows\System\WNmtFuh.exe
  2⤵
  PID:7728
- C:\Windows\System\wvEOuSi.exe
  C:\Windows\System\wvEOuSi.exe
  2⤵
  PID:7956
- C:\Windows\System\VBDclwX.exe
  C:\Windows\System\VBDclwX.exe
  2⤵
  PID:7212
- C:\Windows\System\uVUJaPE.exe
  C:\Windows\System\uVUJaPE.exe
  2⤵
  PID:7348
- C:\Windows\System\PjSllIM.exe
  C:\Windows\System\PjSllIM.exe
  2⤵
  PID:7952
- C:\Windows\System\MNbNyET.exe
  C:\Windows\System\MNbNyET.exe
  2⤵
  PID:7592
- C:\Windows\System\bTAbgTb.exe
  C:\Windows\System\bTAbgTb.exe
  2⤵
  PID:7680
- C:\Windows\System\iwXlzkD.exe
  C:\Windows\System\iwXlzkD.exe
  2⤵
  PID:7420
- C:\Windows\System\JDBmaPU.exe
  C:\Windows\System\JDBmaPU.exe
  2⤵
  PID:7792
- C:\Windows\System\inVYGxc.exe
  C:\Windows\System\inVYGxc.exe
  2⤵
  PID:8224
- C:\Windows\System\YsGPXUt.exe
  C:\Windows\System\YsGPXUt.exe
  2⤵
  PID:8252
- C:\Windows\System\IcUtBqt.exe
  C:\Windows\System\IcUtBqt.exe
  2⤵
  PID:8316
- C:\Windows\System\ODOTXQB.exe
  C:\Windows\System\ODOTXQB.exe
  2⤵
  PID:8340
- C:\Windows\System\DTaESvj.exe
  C:\Windows\System\DTaESvj.exe
  2⤵
  PID:8372
- C:\Windows\System\cyEkAZs.exe
  C:\Windows\System\cyEkAZs.exe
  2⤵
  PID:8392
- C:\Windows\System\TdNFpGb.exe
  C:\Windows\System\TdNFpGb.exe
  2⤵
  PID:8416
- C:\Windows\System\PmgQOjY.exe
  C:\Windows\System\PmgQOjY.exe
  2⤵
  PID:8432
- C:\Windows\System\TVrbcVY.exe
  C:\Windows\System\TVrbcVY.exe
  2⤵
  PID:8452
- C:\Windows\System\EYWQYxj.exe
  C:\Windows\System\EYWQYxj.exe
  2⤵
  PID:8476
- C:\Windows\System\gSXNnKj.exe
  C:\Windows\System\gSXNnKj.exe
  2⤵
  PID:8492
- C:\Windows\System\YToqnHc.exe
  C:\Windows\System\YToqnHc.exe
  2⤵
  PID:8524
- C:\Windows\System\MFjKLfX.exe
  C:\Windows\System\MFjKLfX.exe
  2⤵
  PID:8556
- C:\Windows\System\BBSrgkZ.exe
  C:\Windows\System\BBSrgkZ.exe
  2⤵
  PID:8576
- C:\Windows\System\sNWVlhV.exe
  C:\Windows\System\sNWVlhV.exe
  2⤵
  PID:8596
- C:\Windows\System\FGSPAEJ.exe
  C:\Windows\System\FGSPAEJ.exe
  2⤵
  PID:8620
- C:\Windows\System\fBKAOye.exe
  C:\Windows\System\fBKAOye.exe
  2⤵
  PID:8644
- C:\Windows\System\vYXaddr.exe
  C:\Windows\System\vYXaddr.exe
  2⤵
  PID:8664
- C:\Windows\System\GjlLrzq.exe
  C:\Windows\System\GjlLrzq.exe
  2⤵
  PID:8688
- C:\Windows\System\eSYFCca.exe
  C:\Windows\System\eSYFCca.exe
  2⤵
  PID:8728
- C:\Windows\System\eDgGVYT.exe
  C:\Windows\System\eDgGVYT.exe
  2⤵
  PID:8772
- C:\Windows\System\QnrqlYJ.exe
  C:\Windows\System\QnrqlYJ.exe
  2⤵
  PID:8804
- C:\Windows\System\XuGWnXp.exe
  C:\Windows\System\XuGWnXp.exe
  2⤵
  PID:8848
- C:\Windows\System\LsRMBbw.exe
  C:\Windows\System\LsRMBbw.exe
  2⤵
  PID:8864
- C:\Windows\System\dJCrPvZ.exe
  C:\Windows\System\dJCrPvZ.exe
  2⤵
  PID:8900
- C:\Windows\System\nrMqHcA.exe
  C:\Windows\System\nrMqHcA.exe
  2⤵
  PID:8936
- C:\Windows\System\nKTnBJk.exe
  C:\Windows\System\nKTnBJk.exe
  2⤵
  PID:8968
- C:\Windows\System\NqdPDbX.exe
  C:\Windows\System\NqdPDbX.exe
  2⤵
  PID:8992
- C:\Windows\System\EyunUiv.exe
  C:\Windows\System\EyunUiv.exe
  2⤵
  PID:9008
- C:\Windows\System\IiWCimg.exe
  C:\Windows\System\IiWCimg.exe
  2⤵
  PID:9040
- C:\Windows\System\hCoJzJd.exe
  C:\Windows\System\hCoJzJd.exe
  2⤵
  PID:9092
- C:\Windows\System\QFuiTcd.exe
  C:\Windows\System\QFuiTcd.exe
  2⤵
  PID:9116
- C:\Windows\System\zVqmYvv.exe
  C:\Windows\System\zVqmYvv.exe
  2⤵
  PID:9156
- C:\Windows\System\EvFesBy.exe
  C:\Windows\System\EvFesBy.exe
  2⤵
  PID:9176
- C:\Windows\System\BmRQaDH.exe
  C:\Windows\System\BmRQaDH.exe
  2⤵
  PID:9212
- C:\Windows\System\IjlmpCp.exe
  C:\Windows\System\IjlmpCp.exe
  2⤵
  PID:7324
- C:\Windows\System\zfFharY.exe
  C:\Windows\System\zfFharY.exe
  2⤵
  PID:8216
- C:\Windows\System\jfMaKfb.exe
  C:\Windows\System\jfMaKfb.exe
  2⤵
  PID:8260
- C:\Windows\System\LYiLvnd.exe
  C:\Windows\System\LYiLvnd.exe
  2⤵
  PID:8324
- C:\Windows\System\CRgLYtI.exe
  C:\Windows\System\CRgLYtI.exe
  2⤵
  PID:8368
- C:\Windows\System\GHyBRaL.exe
  C:\Windows\System\GHyBRaL.exe
  2⤵
  PID:8472
- C:\Windows\System\zonqCVT.exe
  C:\Windows\System\zonqCVT.exe
  2⤵
  PID:8572
- C:\Windows\System\htzxXzD.exe
  C:\Windows\System\htzxXzD.exe
  2⤵
  PID:8616
- C:\Windows\System\VjsbVYa.exe
  C:\Windows\System\VjsbVYa.exe
  2⤵
  PID:8660
- C:\Windows\System\llELktA.exe
  C:\Windows\System\llELktA.exe
  2⤵
  PID:8764
- C:\Windows\System\DXwGoPS.exe
  C:\Windows\System\DXwGoPS.exe
  2⤵
  PID:8828
- C:\Windows\System\kiphboG.exe
  C:\Windows\System\kiphboG.exe
  2⤵
  PID:8892
- C:\Windows\System\rQEWOxZ.exe
  C:\Windows\System\rQEWOxZ.exe
  2⤵
  PID:8932
- C:\Windows\System\JTVQmtw.exe
  C:\Windows\System\JTVQmtw.exe
  2⤵
  PID:8956
- C:\Windows\System\OKHOjId.exe
  C:\Windows\System\OKHOjId.exe
  2⤵
  PID:9088
- C:\Windows\System\UnREjqF.exe
  C:\Windows\System\UnREjqF.exe
  2⤵
  PID:9100
- C:\Windows\System\megpcLS.exe
  C:\Windows\System\megpcLS.exe
  2⤵
  PID:9148
- C:\Windows\System\bpBdMbE.exe
  C:\Windows\System\bpBdMbE.exe
  2⤵
  PID:9204
- C:\Windows\System\ehWFMmz.exe
  C:\Windows\System\ehWFMmz.exe
  2⤵
  PID:8264
- C:\Windows\System\XkWEDXF.exe
  C:\Windows\System\XkWEDXF.exe
  2⤵
  PID:8332
- C:\Windows\System\sboXsdh.exe
  C:\Windows\System\sboXsdh.exe
  2⤵
  PID:8752
- C:\Windows\System\MovjOhd.exe
  C:\Windows\System\MovjOhd.exe
  2⤵
  PID:8884
- C:\Windows\System\cBIzvlf.exe
  C:\Windows\System\cBIzvlf.exe
  2⤵
  PID:8856
- C:\Windows\System\jenpKAL.exe
  C:\Windows\System\jenpKAL.exe
  2⤵
  PID:9136
- C:\Windows\System\FNSPNyW.exe
  C:\Windows\System\FNSPNyW.exe
  2⤵
  PID:8612
- C:\Windows\System\wfxclcG.exe
  C:\Windows\System\wfxclcG.exe
  2⤵
  PID:9004
- C:\Windows\System\BMIPXxH.exe
  C:\Windows\System\BMIPXxH.exe
  2⤵
  PID:7684
- C:\Windows\System\wbkXuCU.exe
  C:\Windows\System\wbkXuCU.exe
  2⤵
  PID:8816
- C:\Windows\System\zVtZSqq.exe
  C:\Windows\System\zVtZSqq.exe
  2⤵
  PID:9228
- C:\Windows\System\oASNdLY.exe
  C:\Windows\System\oASNdLY.exe
  2⤵
  PID:9244
- C:\Windows\System\xXedZxP.exe
  C:\Windows\System\xXedZxP.exe
  2⤵
  PID:9272
- C:\Windows\System\IfDZkbz.exe
  C:\Windows\System\IfDZkbz.exe
  2⤵
  PID:9292
- C:\Windows\System\gAzAVyb.exe
  C:\Windows\System\gAzAVyb.exe
  2⤵
  PID:9316
- C:\Windows\System\rnKGGtk.exe
  C:\Windows\System\rnKGGtk.exe
  2⤵
  PID:9340
- C:\Windows\System\jayhJai.exe
  C:\Windows\System\jayhJai.exe
  2⤵
  PID:9412
- C:\Windows\System\iBfhPdp.exe
  C:\Windows\System\iBfhPdp.exe
  2⤵
  PID:9436
- C:\Windows\System\uZDykAh.exe
  C:\Windows\System\uZDykAh.exe
  2⤵
  PID:9456
- C:\Windows\System\qwWVpmV.exe
  C:\Windows\System\qwWVpmV.exe
  2⤵
  PID:9496
- C:\Windows\System\UrtCyHv.exe
  C:\Windows\System\UrtCyHv.exe
  2⤵
  PID:9520
- C:\Windows\System\plNbAzQ.exe
  C:\Windows\System\plNbAzQ.exe
  2⤵
  PID:9536
- C:\Windows\System\NALjIKv.exe
  C:\Windows\System\NALjIKv.exe
  2⤵
  PID:9584
- C:\Windows\System\Bwuhhxm.exe
  C:\Windows\System\Bwuhhxm.exe
  2⤵
  PID:9612
- C:\Windows\System\hLbBUvK.exe
  C:\Windows\System\hLbBUvK.exe
  2⤵
  PID:9632
- C:\Windows\System\yCnoihk.exe
  C:\Windows\System\yCnoihk.exe
  2⤵
  PID:9652
- C:\Windows\System\YNxLlGM.exe
  C:\Windows\System\YNxLlGM.exe
  2⤵
  PID:9688
- C:\Windows\System\JQzKjwW.exe
  C:\Windows\System\JQzKjwW.exe
  2⤵
  PID:9704
- C:\Windows\System\Zqwamtg.exe
  C:\Windows\System\Zqwamtg.exe
  2⤵
  PID:9724
- C:\Windows\System\HkWpOCM.exe
  C:\Windows\System\HkWpOCM.exe
  2⤵
  PID:9744
- C:\Windows\System\HVUztkS.exe
  C:\Windows\System\HVUztkS.exe
  2⤵
  PID:9792
- C:\Windows\System\DBWyVpQ.exe
  C:\Windows\System\DBWyVpQ.exe
  2⤵
  PID:9816
- C:\Windows\System\PjyPpen.exe
  C:\Windows\System\PjyPpen.exe
  2⤵
  PID:9836
- C:\Windows\System\ZvXxaDc.exe
  C:\Windows\System\ZvXxaDc.exe
  2⤵
  PID:9860
- C:\Windows\System\gincVci.exe
  C:\Windows\System\gincVci.exe
  2⤵
  PID:9876
- C:\Windows\System\GcyfZbj.exe
  C:\Windows\System\GcyfZbj.exe
  2⤵
  PID:9896
- C:\Windows\System\romdLnK.exe
  C:\Windows\System\romdLnK.exe
  2⤵
  PID:9992
- C:\Windows\System\AtbFiYt.exe
  C:\Windows\System\AtbFiYt.exe
  2⤵
  PID:10012
- C:\Windows\System\KuxZUVe.exe
  C:\Windows\System\KuxZUVe.exe
  2⤵
  PID:10028
- C:\Windows\System\IMFkUHA.exe
  C:\Windows\System\IMFkUHA.exe
  2⤵
  PID:10044
- C:\Windows\System\dMwDdmQ.exe
  C:\Windows\System\dMwDdmQ.exe
  2⤵
  PID:10092
- C:\Windows\System\EzGfpRR.exe
  C:\Windows\System\EzGfpRR.exe
  2⤵
  PID:10116
- C:\Windows\System\rdgBRSv.exe
  C:\Windows\System\rdgBRSv.exe
  2⤵
  PID:10156
- C:\Windows\System\EFaYrdE.exe
  C:\Windows\System\EFaYrdE.exe
  2⤵
  PID:10172
- C:\Windows\System\cNtuKJA.exe
  C:\Windows\System\cNtuKJA.exe
  2⤵
  PID:10192
- C:\Windows\System\qTbEAKB.exe
  C:\Windows\System\qTbEAKB.exe
  2⤵
  PID:10216
- C:\Windows\System\PSzWNuK.exe
  C:\Windows\System\PSzWNuK.exe
  2⤵
  PID:9060
- C:\Windows\System\EgXUdMH.exe
  C:\Windows\System\EgXUdMH.exe
  2⤵
  PID:9280
- C:\Windows\System\xeCqoQb.exe
  C:\Windows\System\xeCqoQb.exe
  2⤵
  PID:9360
- C:\Windows\System\NwcviuD.exe
  C:\Windows\System\NwcviuD.exe
  2⤵
  PID:9328
- C:\Windows\System\cYgzvra.exe
  C:\Windows\System\cYgzvra.exe
  2⤵
  PID:9468
- C:\Windows\System\freWZIH.exe
  C:\Windows\System\freWZIH.exe
  2⤵
  PID:9484
- C:\Windows\System\wkTMdwJ.exe
  C:\Windows\System\wkTMdwJ.exe
  2⤵
  PID:9604
- C:\Windows\System\WAuimdd.exe
  C:\Windows\System\WAuimdd.exe
  2⤵
  PID:9600
- C:\Windows\System\snrVCTr.exe
  C:\Windows\System\snrVCTr.exe
  2⤵
  PID:9700
- C:\Windows\System\qUYkIXN.exe
  C:\Windows\System\qUYkIXN.exe
  2⤵
  PID:9828
- C:\Windows\System\hXIIjBq.exe
  C:\Windows\System\hXIIjBq.exe
  2⤵
  PID:9856
- C:\Windows\System\DrTTbOA.exe
  C:\Windows\System\DrTTbOA.exe
  2⤵
  PID:9940
- C:\Windows\System\hWVaRuI.exe
  C:\Windows\System\hWVaRuI.exe
  2⤵
  PID:5912
- C:\Windows\System\OlangqQ.exe
  C:\Windows\System\OlangqQ.exe
  2⤵
  PID:10036
- C:\Windows\System\PaUfAQq.exe
  C:\Windows\System\PaUfAQq.exe
  2⤵
  PID:8628
- C:\Windows\System\gxJShYr.exe
  C:\Windows\System\gxJShYr.exe
  2⤵
  PID:10136
- C:\Windows\System\NSaaeJZ.exe
  C:\Windows\System\NSaaeJZ.exe
  2⤵
  PID:10188
- C:\Windows\System\mZlNkPZ.exe
  C:\Windows\System\mZlNkPZ.exe
  2⤵
  PID:10208
- C:\Windows\System\VdqtdlK.exe
  C:\Windows\System\VdqtdlK.exe
  2⤵
  PID:9432
- C:\Windows\System\AIOcqno.exe
  C:\Windows\System\AIOcqno.exe
  2⤵
  PID:9580
- C:\Windows\System\JJeVkHx.exe
  C:\Windows\System\JJeVkHx.exe
  2⤵
  PID:9592
- C:\Windows\System\WTRjlTO.exe
  C:\Windows\System\WTRjlTO.exe
  2⤵
  PID:9644
- C:\Windows\System\APkqZXD.exe
  C:\Windows\System\APkqZXD.exe
  2⤵
  PID:9892
- C:\Windows\System\plHhgIJ.exe
  C:\Windows\System\plHhgIJ.exe
  2⤵
  PID:10008
- C:\Windows\System\hYWvmIt.exe
  C:\Windows\System\hYWvmIt.exe
  2⤵
  PID:10004
- C:\Windows\System\koBoaKl.exe
  C:\Windows\System\koBoaKl.exe
  2⤵
  PID:9324
- C:\Windows\System\DIwYggr.exe
  C:\Windows\System\DIwYggr.exe
  2⤵
  PID:9452
- C:\Windows\System\MkBNKPO.exe
  C:\Windows\System\MkBNKPO.exe
  2⤵
  PID:10132
- C:\Windows\System\BmeNAjg.exe
  C:\Windows\System\BmeNAjg.exe
  2⤵
  PID:10148
- C:\Windows\System\DfxgvVy.exe
  C:\Windows\System\DfxgvVy.exe
  2⤵
  PID:10268
- C:\Windows\System\wfVufGK.exe
  C:\Windows\System\wfVufGK.exe
  2⤵
  PID:10308
- C:\Windows\System\QJTqGRc.exe
  C:\Windows\System\QJTqGRc.exe
  2⤵
  PID:10332
- C:\Windows\System\YfywWYG.exe
  C:\Windows\System\YfywWYG.exe
  2⤵
  PID:10352
- C:\Windows\System\iDqyUxf.exe
  C:\Windows\System\iDqyUxf.exe
  2⤵
  PID:10372
- C:\Windows\System\FtlDHpo.exe
  C:\Windows\System\FtlDHpo.exe
  2⤵
  PID:10404
- C:\Windows\System\jTcCaQA.exe
  C:\Windows\System\jTcCaQA.exe
  2⤵
  PID:10424
- C:\Windows\System\oArhzXA.exe
  C:\Windows\System\oArhzXA.exe
  2⤵
  PID:10452
- C:\Windows\System\ocHhfyI.exe
  C:\Windows\System\ocHhfyI.exe
  2⤵
  PID:10484
- C:\Windows\System\BwHXwYf.exe
  C:\Windows\System\BwHXwYf.exe
  2⤵
  PID:10504
- C:\Windows\System\ashWkZY.exe
  C:\Windows\System\ashWkZY.exe
  2⤵
  PID:10532
- C:\Windows\System\jMajSdg.exe
  C:\Windows\System\jMajSdg.exe
  2⤵
  PID:10552
- C:\Windows\System\qqPoacs.exe
  C:\Windows\System\qqPoacs.exe
  2⤵
  PID:10596
- C:\Windows\System\ZtKDFBa.exe
  C:\Windows\System\ZtKDFBa.exe
  2⤵
  PID:10624
- C:\Windows\System\OdPCkwJ.exe
  C:\Windows\System\OdPCkwJ.exe
  2⤵
  PID:10644
- C:\Windows\System\UxQMDJq.exe
  C:\Windows\System\UxQMDJq.exe
  2⤵
  PID:10664
- C:\Windows\System\BdzDFVy.exe
  C:\Windows\System\BdzDFVy.exe
  2⤵
  PID:10704
- C:\Windows\System\BQEkvIC.exe
  C:\Windows\System\BQEkvIC.exe
  2⤵
  PID:10744
- C:\Windows\System\FEBDADm.exe
  C:\Windows\System\FEBDADm.exe
  2⤵
  PID:10768
- C:\Windows\System\HlgDhcX.exe
  C:\Windows\System\HlgDhcX.exe
  2⤵
  PID:10792
- C:\Windows\System\JbtSYwg.exe
  C:\Windows\System\JbtSYwg.exe
  2⤵
  PID:10812
- C:\Windows\System\jjWRgqM.exe
  C:\Windows\System\jjWRgqM.exe
  2⤵
  PID:10832
- C:\Windows\System\Etveirg.exe
  C:\Windows\System\Etveirg.exe
  2⤵
  PID:10852
- C:\Windows\System\iseJSiQ.exe
  C:\Windows\System\iseJSiQ.exe
  2⤵
  PID:10900
- C:\Windows\System\FQCfrDu.exe
  C:\Windows\System\FQCfrDu.exe
  2⤵
  PID:10920
- C:\Windows\System\YCAODHh.exe
  C:\Windows\System\YCAODHh.exe
  2⤵
  PID:10956
- C:\Windows\System\uJMkJAw.exe
  C:\Windows\System\uJMkJAw.exe
  2⤵
  PID:10976
- C:\Windows\System\ZUsXIyS.exe
  C:\Windows\System\ZUsXIyS.exe
  2⤵
  PID:11004
- C:\Windows\System\YFlGfZA.exe
  C:\Windows\System\YFlGfZA.exe
  2⤵
  PID:11024
- C:\Windows\System\tyXYxEr.exe
  C:\Windows\System\tyXYxEr.exe
  2⤵
  PID:11064
- C:\Windows\System\RhskLBm.exe
  C:\Windows\System\RhskLBm.exe
  2⤵
  PID:11080
- C:\Windows\System\vYgxeSk.exe
  C:\Windows\System\vYgxeSk.exe
  2⤵
  PID:11104
- C:\Windows\System\TbBUxrG.exe
  C:\Windows\System\TbBUxrG.exe
  2⤵
  PID:11128
- C:\Windows\System\ygLgIyc.exe
  C:\Windows\System\ygLgIyc.exe
  2⤵
  PID:11148
- C:\Windows\System\ojGiMzh.exe
  C:\Windows\System\ojGiMzh.exe
  2⤵
  PID:11176
- C:\Windows\System\TholRuj.exe
  C:\Windows\System\TholRuj.exe
  2⤵
  PID:11208
- C:\Windows\System\hCzYyvS.exe
  C:\Windows\System\hCzYyvS.exe
  2⤵
  PID:11224
- C:\Windows\System\zNmywgp.exe
  C:\Windows\System\zNmywgp.exe
  2⤵
  PID:11248
- C:\Windows\System\pdtywQr.exe
  C:\Windows\System\pdtywQr.exe
  2⤵
  PID:10324
- C:\Windows\System\bGMAwKc.exe
  C:\Windows\System\bGMAwKc.exe
  2⤵
  PID:10392
- C:\Windows\System\NwtaZeE.exe
  C:\Windows\System\NwtaZeE.exe
  2⤵
  PID:10396
- C:\Windows\System\jWbAtnF.exe
  C:\Windows\System\jWbAtnF.exe
  2⤵
  PID:10540
- C:\Windows\System\jCunfMH.exe
  C:\Windows\System\jCunfMH.exe
  2⤵
  PID:10612
- C:\Windows\System\ZCkeLdc.exe
  C:\Windows\System\ZCkeLdc.exe
  2⤵
  PID:10656
- C:\Windows\System\LqZCZjM.exe
  C:\Windows\System\LqZCZjM.exe
  2⤵
  PID:10732
- C:\Windows\System\XHdLAqa.exe
  C:\Windows\System\XHdLAqa.exe
  2⤵
  PID:10728
- C:\Windows\System\rTxNDAb.exe
  C:\Windows\System\rTxNDAb.exe
  2⤵
  PID:10876
- C:\Windows\System\CWeLaQa.exe
  C:\Windows\System\CWeLaQa.exe
  2⤵
  PID:10932
- C:\Windows\System\VZatxLx.exe
  C:\Windows\System\VZatxLx.exe
  2⤵
  PID:10972
- C:\Windows\System\CQrjtLJ.exe
  C:\Windows\System\CQrjtLJ.exe
  2⤵
  PID:11044
- C:\Windows\System\MMeQiHZ.exe
  C:\Windows\System\MMeQiHZ.exe
  2⤵
  PID:11160
- C:\Windows\System\tXnCTKA.exe
  C:\Windows\System\tXnCTKA.exe
  2⤵
  PID:11124
- C:\Windows\System\qULGFcY.exe
  C:\Windows\System\qULGFcY.exe
  2⤵
  PID:11172
- C:\Windows\System\RNWdhmp.exe
  C:\Windows\System\RNWdhmp.exe
  2⤵
  PID:10288
- C:\Windows\System\WpKjNbN.exe
  C:\Windows\System\WpKjNbN.exe
  2⤵
  PID:10340
- C:\Windows\System\HvexeGt.exe
  C:\Windows\System\HvexeGt.exe
  2⤵
  PID:10500
- C:\Windows\System\CwCuhdz.exe
  C:\Windows\System\CwCuhdz.exe
  2⤵
  PID:10588
- C:\Windows\System\WSDWevB.exe
  C:\Windows\System\WSDWevB.exe
  2⤵
  PID:10908
- C:\Windows\System\rJhCwoa.exe
  C:\Windows\System\rJhCwoa.exe
  2⤵
  PID:10912
- C:\Windows\System\LwMpqFq.exe
  C:\Windows\System\LwMpqFq.exe
  2⤵
  PID:11196
- C:\Windows\System\MZxkmNP.exe
  C:\Windows\System\MZxkmNP.exe
  2⤵
  PID:10480
- C:\Windows\System\BbymXoB.exe
  C:\Windows\System\BbymXoB.exe
  2⤵
  PID:10692
- C:\Windows\System\yfooWhy.exe
  C:\Windows\System\yfooWhy.exe
  2⤵
  PID:11076
- C:\Windows\System\fDAhguJ.exe
  C:\Windows\System\fDAhguJ.exe
  2⤵
  PID:10468
- C:\Windows\System\tfwRCXU.exe
  C:\Windows\System\tfwRCXU.exe
  2⤵
  PID:11316
- C:\Windows\System\SZbppGm.exe
  C:\Windows\System\SZbppGm.exe
  2⤵
  PID:11340
- C:\Windows\System\jPAHNlI.exe
  C:\Windows\System\jPAHNlI.exe
  2⤵
  PID:11356
- C:\Windows\System\CIZGgdi.exe
  C:\Windows\System\CIZGgdi.exe
  2⤵
  PID:11376
- C:\Windows\System\RGQOwPx.exe
  C:\Windows\System\RGQOwPx.exe
  2⤵
  PID:11468
- C:\Windows\System\EcVSgVw.exe
  C:\Windows\System\EcVSgVw.exe
  2⤵
  PID:11488
- C:\Windows\System\ybRTYXs.exe
  C:\Windows\System\ybRTYXs.exe
  2⤵
  PID:11508
- C:\Windows\System\bXIVBYz.exe
  C:\Windows\System\bXIVBYz.exe
  2⤵
  PID:11556
- C:\Windows\System\UjwQRyk.exe
  C:\Windows\System\UjwQRyk.exe
  2⤵
  PID:11600
- C:\Windows\System\RaoTelN.exe
  C:\Windows\System\RaoTelN.exe
  2⤵
  PID:11624
- C:\Windows\System\HKOBuCb.exe
  C:\Windows\System\HKOBuCb.exe
  2⤵
  PID:11640
- C:\Windows\System\TNXmTXm.exe
  C:\Windows\System\TNXmTXm.exe
  2⤵
  PID:11668
- C:\Windows\System\rwdklgG.exe
  C:\Windows\System\rwdklgG.exe
  2⤵
  PID:11704
- C:\Windows\System\OeSmpQa.exe
  C:\Windows\System\OeSmpQa.exe
  2⤵
  PID:11736
- C:\Windows\System\zpWDLEX.exe
  C:\Windows\System\zpWDLEX.exe
  2⤵
  PID:11764
- C:\Windows\System\oXEJrOw.exe
  C:\Windows\System\oXEJrOw.exe
  2⤵
  PID:11796
- C:\Windows\System\TgnaiZk.exe
  C:\Windows\System\TgnaiZk.exe
  2⤵
  PID:11816
- C:\Windows\System\jFbhtjy.exe
  C:\Windows\System\jFbhtjy.exe
  2⤵
  PID:11840
- C:\Windows\System\XAUBgZD.exe
  C:\Windows\System\XAUBgZD.exe
  2⤵
  PID:11896
- C:\Windows\System\wXKepTt.exe
  C:\Windows\System\wXKepTt.exe
  2⤵
  PID:11916
- C:\Windows\System\GQpfkQP.exe
  C:\Windows\System\GQpfkQP.exe
  2⤵
  PID:11936
- C:\Windows\System\ajnwwTE.exe
  C:\Windows\System\ajnwwTE.exe
  2⤵
  PID:11952
- C:\Windows\System\WROGNrN.exe
  C:\Windows\System\WROGNrN.exe
  2⤵
  PID:11976
- C:\Windows\System\QtSHCew.exe
  C:\Windows\System\QtSHCew.exe
  2⤵
  PID:11996
- C:\Windows\System\adQYhHO.exe
  C:\Windows\System\adQYhHO.exe
  2⤵
  PID:12024
- C:\Windows\System\vWpSnxe.exe
  C:\Windows\System\vWpSnxe.exe
  2⤵
  PID:12052
- C:\Windows\System\ZseYWtv.exe
  C:\Windows\System\ZseYWtv.exe
  2⤵
  PID:12076
- C:\Windows\System\eUKTAAn.exe
  C:\Windows\System\eUKTAAn.exe
  2⤵
  PID:12104
- C:\Windows\System\AGaYbZQ.exe
  C:\Windows\System\AGaYbZQ.exe
  2⤵
  PID:12124
- C:\Windows\System\BQHCXYh.exe
  C:\Windows\System\BQHCXYh.exe
  2⤵
  PID:12148
- C:\Windows\System\scpXFcA.exe
  C:\Windows\System\scpXFcA.exe
  2⤵
  PID:12168
- C:\Windows\System\nqJNVXh.exe
  C:\Windows\System\nqJNVXh.exe
  2⤵
  PID:12200
- C:\Windows\System\DazzcBh.exe
  C:\Windows\System\DazzcBh.exe
  2⤵
  PID:12224
- C:\Windows\System\zhttCOs.exe
  C:\Windows\System\zhttCOs.exe
  2⤵
  PID:12276
- C:\Windows\System\qTeTLih.exe
  C:\Windows\System\qTeTLih.exe
  2⤵
  PID:11032
- C:\Windows\System\WzNbEFZ.exe
  C:\Windows\System\WzNbEFZ.exe
  2⤵
  PID:11272
- C:\Windows\System\HnbQxso.exe
  C:\Windows\System\HnbQxso.exe
  2⤵
  PID:11368
- C:\Windows\System\ioSvBYD.exe
  C:\Windows\System\ioSvBYD.exe
  2⤵
  PID:11460
- C:\Windows\System\bnhwmvb.exe
  C:\Windows\System\bnhwmvb.exe
  2⤵
  PID:11520
- C:\Windows\System\hdOSfsU.exe
  C:\Windows\System\hdOSfsU.exe
  2⤵
  PID:11544
- C:\Windows\System\ObYEFEr.exe
  C:\Windows\System\ObYEFEr.exe
  2⤵
  PID:11568
- C:\Windows\System\IxdfVqJ.exe
  C:\Windows\System\IxdfVqJ.exe
  2⤵
  PID:11612
- C:\Windows\System\UoMwBtn.exe
  C:\Windows\System\UoMwBtn.exe
  2⤵
  PID:11716
- C:\Windows\System\pBVSVbu.exe
  C:\Windows\System\pBVSVbu.exe
  2⤵
  PID:11688
- C:\Windows\System\NsrkRsv.exe
  C:\Windows\System\NsrkRsv.exe
  2⤵
  PID:11760
- C:\Windows\System\tvMaKnZ.exe
  C:\Windows\System\tvMaKnZ.exe
  2⤵
  PID:11792
- C:\Windows\System\awCQrhk.exe
  C:\Windows\System\awCQrhk.exe
  2⤵
  PID:11868
- C:\Windows\System\kTRhmkD.exe
  C:\Windows\System\kTRhmkD.exe
  2⤵
  PID:12020
- C:\Windows\System\DzdmTHb.exe
  C:\Windows\System\DzdmTHb.exe
  2⤵
  PID:12068
- C:\Windows\System\DPCZCqB.exe
  C:\Windows\System\DPCZCqB.exe
  2⤵
  PID:12164
- C:\Windows\System\DlUThwF.exe
  C:\Windows\System\DlUThwF.exe
  2⤵
  PID:12220
- C:\Windows\System\MmXwdLd.exe
  C:\Windows\System\MmXwdLd.exe
  2⤵
  PID:12268
- C:\Windows\System\ZDWvdDb.exe
  C:\Windows\System\ZDWvdDb.exe
  2⤵
  PID:6024
- C:\Windows\System\QJkyKoe.exe
  C:\Windows\System\QJkyKoe.exe
  2⤵
  PID:11396
- C:\Windows\System\LQpEVmK.exe
  C:\Windows\System\LQpEVmK.exe
  2⤵
  PID:11448
- C:\Windows\System\tQHtnvj.exe
  C:\Windows\System\tQHtnvj.exe
  2⤵
  PID:11608
- C:\Windows\System\xvyDlfC.exe
  C:\Windows\System\xvyDlfC.exe
  2⤵
  PID:11660
- C:\Windows\System\Lqdicgw.exe
  C:\Windows\System\Lqdicgw.exe
  2⤵
  PID:11476
- C:\Windows\System\aYPEbDH.exe
  C:\Windows\System\aYPEbDH.exe
  2⤵
  PID:11968
- C:\Windows\System\zvyvnic.exe
  C:\Windows\System\zvyvnic.exe
  2⤵
  PID:12160
- C:\Windows\System\IyzIfOr.exe
  C:\Windows\System\IyzIfOr.exe
  2⤵
  PID:10444
- C:\Windows\System\sLYBRWj.exe
  C:\Windows\System\sLYBRWj.exe
  2⤵
  PID:11832
- C:\Windows\System\Dkmbnim.exe
  C:\Windows\System\Dkmbnim.exe
  2⤵
  PID:11860
- C:\Windows\System\RnreqGB.exe
  C:\Windows\System\RnreqGB.exe
  2⤵
  PID:12156
- C:\Windows\System\hhaRgQo.exe
  C:\Windows\System\hhaRgQo.exe
  2⤵
  PID:4532
- C:\Windows\System\uZFTrxn.exe
  C:\Windows\System\uZFTrxn.exe
  2⤵
  PID:11232
- C:\Windows\System\fhrlmaQ.exe
  C:\Windows\System\fhrlmaQ.exe
  2⤵
  PID:12296
- C:\Windows\System\WWjXuSf.exe
  C:\Windows\System\WWjXuSf.exe
  2⤵
  PID:12328
- C:\Windows\System\tRfimCG.exe
  C:\Windows\System\tRfimCG.exe
  2⤵
  PID:12352
- C:\Windows\System\CiGFbPf.exe
  C:\Windows\System\CiGFbPf.exe
  2⤵
  PID:12372
- C:\Windows\System\MsQSOJZ.exe
  C:\Windows\System\MsQSOJZ.exe
  2⤵
  PID:12392
- C:\Windows\System\qpiNeWh.exe
  C:\Windows\System\qpiNeWh.exe
  2⤵
  PID:12444
- C:\Windows\System\NuEujhV.exe
  C:\Windows\System\NuEujhV.exe
  2⤵
  PID:12492
- C:\Windows\System\MPcBQGk.exe
  C:\Windows\System\MPcBQGk.exe
  2⤵
  PID:12512
- C:\Windows\System\sAktaPV.exe
  C:\Windows\System\sAktaPV.exe
  2⤵
  PID:12536
- C:\Windows\System\GwTHxJF.exe
  C:\Windows\System\GwTHxJF.exe
  2⤵
  PID:12552
- C:\Windows\System\kNsFena.exe
  C:\Windows\System\kNsFena.exe
  2⤵
  PID:12576
- C:\Windows\System\KIHWjos.exe
  C:\Windows\System\KIHWjos.exe
  2⤵
  PID:12592
- C:\Windows\System\LrYqNaC.exe
  C:\Windows\System\LrYqNaC.exe
  2⤵
  PID:12620
- C:\Windows\System\oquLmpN.exe
  C:\Windows\System\oquLmpN.exe
  2⤵
  PID:12644
- C:\Windows\System\nsJwQJP.exe
  C:\Windows\System\nsJwQJP.exe
  2⤵
  PID:12668
- C:\Windows\System\THVtqCy.exe
  C:\Windows\System\THVtqCy.exe
  2⤵
  PID:12696
- C:\Windows\System\tYJkiBX.exe
  C:\Windows\System\tYJkiBX.exe
  2⤵
  PID:12724
- C:\Windows\System\YbAAEqZ.exe
  C:\Windows\System\YbAAEqZ.exe
  2⤵
  PID:12752
- C:\Windows\System\MBSNPmh.exe
  C:\Windows\System\MBSNPmh.exe
  2⤵
  PID:12768
- C:\Windows\System\GfhbTKb.exe
  C:\Windows\System\GfhbTKb.exe
  2⤵
  PID:12824
- C:\Windows\System\SXdJFOY.exe
  C:\Windows\System\SXdJFOY.exe
  2⤵
  PID:12860
- C:\Windows\System\KyItjMo.exe
  C:\Windows\System\KyItjMo.exe
  2⤵
  PID:12880
- C:\Windows\System\JtmxjPn.exe
  C:\Windows\System\JtmxjPn.exe
  2⤵
  PID:12908
- C:\Windows\System\NDFZzIv.exe
  C:\Windows\System\NDFZzIv.exe
  2⤵
  PID:12944
- C:\Windows\System\XTZQupx.exe
  C:\Windows\System\XTZQupx.exe
  2⤵
  PID:12984
- C:\Windows\System\ZFsdxcV.exe
  C:\Windows\System\ZFsdxcV.exe
  2⤵
  PID:13004
- C:\Windows\System\gqYbirO.exe
  C:\Windows\System\gqYbirO.exe
  2⤵
  PID:13040
- C:\Windows\System\qBJtEdH.exe
  C:\Windows\System\qBJtEdH.exe
  2⤵
  PID:13072
- C:\Windows\System\aVkVXjb.exe
  C:\Windows\System\aVkVXjb.exe
  2⤵
  PID:13092
- C:\Windows\System\rdSGKqw.exe
  C:\Windows\System\rdSGKqw.exe
  2⤵
  PID:13112
- C:\Windows\System\CywJLah.exe
  C:\Windows\System\CywJLah.exe
  2⤵
  PID:13144
- C:\Windows\System\SQecphu.exe
  C:\Windows\System\SQecphu.exe
  2⤵
  PID:13192
- C:\Windows\System\gijCPiA.exe
  C:\Windows\System\gijCPiA.exe
  2⤵
  PID:13216
- C:\Windows\System\oCcPQgp.exe
  C:\Windows\System\oCcPQgp.exe
  2⤵
  PID:13244
- C:\Windows\System\MLNtGCN.exe
  C:\Windows\System\MLNtGCN.exe
  2⤵
  PID:13260
- C:\Windows\System\ROQYBvY.exe
  C:\Windows\System\ROQYBvY.exe
  2⤵
  PID:13276
- C:\Windows\System\ADMUxxN.exe
  C:\Windows\System\ADMUxxN.exe
  2⤵
  PID:13296
- C:\Windows\System\MLIRMHc.exe
  C:\Windows\System\MLIRMHc.exe
  2⤵
  PID:12364
- C:\Windows\System\VgRmxBS.exe
  C:\Windows\System\VgRmxBS.exe
  2⤵
  PID:12340
- C:\Windows\System\zqrYhML.exe
  C:\Windows\System\zqrYhML.exe
  2⤵
  PID:11580
- C:\Windows\System\KSmmqkP.exe
  C:\Windows\System\KSmmqkP.exe
  2⤵
  PID:12544
- C:\Windows\System\TnNkmpS.exe
  C:\Windows\System\TnNkmpS.exe
  2⤵
  PID:12584
- C:\Windows\System\qhzvsQy.exe
  C:\Windows\System\qhzvsQy.exe
  2⤵
  PID:12608
- C:\Windows\System\kWTCPDn.exe
  C:\Windows\System\kWTCPDn.exe
  2⤵
  PID:12688
- C:\Windows\System\paTPFfG.exe
  C:\Windows\System\paTPFfG.exe
  2⤵
  PID:13020
- C:\Windows\System\iareyvB.exe
  C:\Windows\System\iareyvB.exe
  2⤵
  PID:13036
- C:\Windows\System\cCpdcpi.exe
  C:\Windows\System\cCpdcpi.exe
  2⤵
  PID:13108
- C:\Windows\System\QceuXVP.exe
  C:\Windows\System\QceuXVP.exe
  2⤵
  PID:13152
- C:\Windows\System\NoreITd.exe
  C:\Windows\System\NoreITd.exe
  2⤵
  PID:13272
- C:\Windows\System\FTaArrj.exe
  C:\Windows\System\FTaArrj.exe
  2⤵
  PID:11636
- C:\Windows\System\kDOOgbt.exe
  C:\Windows\System\kDOOgbt.exe
  2⤵
  PID:12384
- C:\Windows\System\munCWvN.exe
  C:\Windows\System\munCWvN.exe
  2⤵
  PID:12532
- C:\Windows\System\fkefazn.exe
  C:\Windows\System\fkefazn.exe
  2⤵
  PID:12560
- C:\Windows\System\zGEFWkZ.exe
  C:\Windows\System\zGEFWkZ.exe
  2⤵
  PID:12808
- C:\Windows\System\UgzYFNP.exe
  C:\Windows\System\UgzYFNP.exe
  2⤵
  PID:11500
- C:\Windows\System\PnWUvfT.exe
  C:\Windows\System\PnWUvfT.exe
  2⤵
  PID:12940
- C:\Windows\System\ZJJfHko.exe
  C:\Windows\System\ZJJfHko.exe
  2⤵
  PID:4664
- C:\Windows\System\VDFGUtW.exe
  C:\Windows\System\VDFGUtW.exe
  2⤵
  PID:13032
- C:\Windows\System\ZYhOXJa.exe
  C:\Windows\System\ZYhOXJa.exe
  2⤵
  PID:13064
- C:\Windows\System\YFdaGml.exe
  C:\Windows\System\YFdaGml.exe
  2⤵
  PID:13068
- C:\Windows\System\veSvqqA.exe
  C:\Windows\System\veSvqqA.exe
  2⤵
  PID:968
- C:\Windows\System\lGPIQEH.exe
  C:\Windows\System\lGPIQEH.exe
  2⤵
  PID:3988
- C:\Windows\System\UdJtOaI.exe
  C:\Windows\System\UdJtOaI.exe
  2⤵
  PID:1408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_obkuvkqn.rez.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AsZdFbi.exe

Filesize
1.8MB

MD5
0c0e273c296a3e139c0b2ad753b1e6c8

SHA1
5d9ae6bd6b827f9c610997da36ecf7b99a3f8d6f

SHA256
1466a4c89d9c854b48ca75e94de729c30c896e61774cacb8948ec99034396901

SHA512
45f6c31c67ba6d755cc51d3e6b01b07f9b2ff4ed6b7cce493a3b5e71b090c3b8528ae9b8784dc5fd1cee7d3c6af66ed1fa6ac517d7e76612ca0bd67a22a07e3c

Download Submit
C:\Windows\System\EhapqaA.exe

Filesize
1.8MB

MD5
699f8078335a8ebab2b7e6f81e608a24

SHA1
b03d1e1445d6196568e7d17bd3c769265478e8bd

SHA256
9f2b497d64b268b9469daf1d9d8b64a7090aa0be09f4c45648b5ff91ff5ad110

SHA512
c0d80cb0e4d52f20fae82970d756f282024ab53d450f7b15cd1bb0e077c6345da02602c81c2454f5c33b7111c184ebaf8e0e25d84a1f80949adc916062ed76e3

Download Submit
C:\Windows\System\GgTiWSg.exe

Filesize
1.8MB

MD5
c6425284ddf843c0e860b914f4316472

SHA1
c41e5748148ec36b064452d97196bafaa68aa5cc

SHA256
43635f7d25b23b7a1ce29b7721426173e129232f1c832e4b548ad1afbe53474f

SHA512
a496e9ca50f0a40f9012ecd7d4564b30560036658fcba8f8420f770e7f5b68d62ac258826f55178e62695ac30140f05d041b24178bf9855ac755aa5909a786a5

Download Submit
C:\Windows\System\HdEFkSd.exe

Filesize
1.8MB

MD5
ce2debcf8ec270c52b1b94b0621dcda2

SHA1
563efee7ab15a978464195e10a49dd544e90d7f2

SHA256
f7d74e632a727d9a34d201f34e9de4b5350cea0ee0a891f234659b1d844ee64c

SHA512
d7c126e77731bab7921851029eea9b31967a463ea4bb93fd6720da34aa44980bdf1dd27c6f330555ac0725e1d303d8092966f52961bace71b47c627f2a52383a

Download Submit
C:\Windows\System\IsVaEUi.exe

Filesize
1.8MB

MD5
d393d2ce59699a658ffbf7fc335fe61b

SHA1
ab4ab3cbf186045a8c3d75f270620e9ddab13237

SHA256
c2563d75ce57e606e4b3adcb00afbb9a27bda307338c74a73da4654418ad2647

SHA512
c1188b772b9c6a845cc6e43720a8be8073579fc04cfdd4602b379fcb2e97f1db4b6e2f5c39071e3c8a25598450546b97e3b9b6f3cef02b2edb72f3cc603171f9

Download Submit
C:\Windows\System\MRlRtOB.exe

Filesize
1.8MB

MD5
907d69b8902ff4a07630f863069abcab

SHA1
e57273510619412ca475c82b8c57904ba52061c7

SHA256
7dd4f7200e1e6f389e458079fcbeb9d87649b58e524e802ac356b8cb87a00fdf

SHA512
66e8f3165243a93893cb8ca9c2424702c65189de1e95fca2b66b23bdf870c266279d4da6eae55cda2f5b6459d12219dee5c1220bc729504800a27dbaf34886b0

Download Submit
C:\Windows\System\RJTeMJl.exe

Filesize
1.8MB

MD5
530131b644c751fda52acde0d528fdcb

SHA1
4145ff45d4871b8809c7933a96476d485806b10e

SHA256
77150ea1db07d068aff623f3efd92567f7199daddc464db8e27d633814443872

SHA512
521339a41ece9426dc0759aa368868d07a2e79527e83fd08eb0e48774190a4a4288d5724a2a63b0070659ab4803f6f46ccf7d8724f129c4aee6c43ff1ba5825b

Download Submit
C:\Windows\System\SIbpOHP.exe

Filesize
1.8MB

MD5
d168041e7982d4c44ec2d6432ea08ec7

SHA1
5f0eed1aeef49bf8bc0f03617e1efb50f7d2232c

SHA256
6521fb87d7c1328d22fa9277e2d3663c8a5f1780091c5d940bdd23b51d85d2d2

SHA512
5a1c1666c5f82a3f4fe416f34bec6408201836dfcbf6337d7a441790e2597c0be7913c00769809d6621379e1370da49a2e1842ea89bd2dc31f7a49e79b303903

Download Submit
C:\Windows\System\SqsSCQZ.exe

Filesize
1.8MB

MD5
5ce1685e261328ab2255f128e1c34558

SHA1
c4322d49616844ac5ff80c2ffdd2043bb799e7d8

SHA256
c649a039ddd3ce657af441e0bf4e7a6c57e5bb7f8d259d58ee01ac7f98279684

SHA512
b2f46de4907459f5303604663f4121361cb33d4a6a09ef8f33be9057d7c78a437a4ab5e7caa8c575c19df7c9d93604ba578eff8343aae08f201cb26db9ee9b01

Download Submit
C:\Windows\System\UCGPlyo.exe

Filesize
1.8MB

MD5
c988f3c07fb8b52fd1e367a8fbe058ae

SHA1
4e1d256a1e8cb0ee9ef296cc98f9ce6e40876d94

SHA256
9be3d051d68cc962f7a4a2879f10a3705222b47fb043ac584057abf947d07e01

SHA512
5e6a92712f1de8f7eab85d1b61941b76343778da10aac7aeb6e928aede670f682cdd27ba9cb0486b1173d7f1381336ba2640e6946461590f6e6409afefa6a854

Download Submit
C:\Windows\System\UqvXVuU.exe

Filesize
1.8MB

MD5
5aec0bce7fdfbfbbcb388bcd4b23a6d3

SHA1
114ff076d00f48b1dd3902319cf44a83569e8a2a

SHA256
09372bf8cb3cede57451a53f704f1cc1365ac3b7dda6b7d54bba079d7727d8f3

SHA512
75785d890ace97172f172a11ab55df60a8ce679f1ceb11a865e32c53d51770638d617316400a46af7cd8be8d2182d31b03ccc2c7c420dd9e0a1e7e34638a8a1a

Download Submit
C:\Windows\System\XIpnxmA.exe

Filesize
1.8MB

MD5
9ab57a0db1ab68ec3e5134f700cbdd23

SHA1
0ad7047644993ee0df02cba2a7ab2e2e01b8c136

SHA256
615951f4783bbf7b17dfa8ca9f12e645fcfa9c725f3b1e57e380b41c672d5eb3

SHA512
788f929522cef76361f2be8cb82100d316b3e135d169803b0831f4211512bf8e085eec9d9363b46dea6e6796338b4de374c2f156074798a15dbeeb97fa6acdd2

Download Submit
C:\Windows\System\YfATmRQ.exe

Filesize
1.8MB

MD5
5558e1fe0f798cbd612f0b8f6b03c4cb

SHA1
b17510f879a9d2db8c74398e489f18d91a111e14

SHA256
46d7161c8f44a9aa2a765b74ccc2c8276e443b0645e306561ee52a48f9fc51b6

SHA512
967413749608ba9c25292024719cf3c29179df8dd93c7d6ab992a9815e390723b2bdeb3406f71f63e2acb38eab0dd91e4e591387622d3e58f06f9f186e089701

Download Submit
C:\Windows\System\YlwuHip.exe

Filesize
8B

MD5
b849dbcfb08ac877290add49e99178d8

SHA1
e96fe151173fd43a6d834740f52198931a388bf9

SHA256
a924546cb05e0d111a25fcb8e7f183457926abae319588a0b32ef2b05d457163

SHA512
8b4a01f83882b6e5a7d86633f11ab4b0beb94666eb64954ae2be067858515a1f39d026e62a6fa7cb4c876187b4f3fb07031095ae0126acf1cb139bd0d21d7863

Download Submit
C:\Windows\System\aOePkZJ.exe

Filesize
1.8MB

MD5
ddd57d7a11c6ea7cce5736aa35b598e6

SHA1
10cc59e5592f87446b2b5c2a8aab5d8945d6a793

SHA256
b76de1fdda1a732dd8b61b22177c19d70ba2c3f15721a788d4f1593b1f927beb

SHA512
419d254e00f7a6b8724b4e4307cdbe71355d35eda73cf5a488f580e270e3c6aec8585b9ab8845d4939e83f70f561940003073c0e8493ee31f1ac7621be3e9e9a

Download Submit
C:\Windows\System\bIcGBkf.exe

Filesize
1.8MB

MD5
fd44370fdfbfdc3c8728bde417529c07

SHA1
2328b5b510a92d06e8c95aaa5c9877207d333468

SHA256
53629575f460823160e525aa1a1a7619a9b95b03b774e8a8d71172160a29341e

SHA512
7631873e6eaf8d258df08c7b422b49191cef281f0b3ecb5ad37286f3e29fc12aa30a9deae61302d846d24970d64a952c3b9b00d7d4fdb30fc90e8f8fcb77bc6c

Download Submit
C:\Windows\System\bduHPZo.exe

Filesize
1.8MB

MD5
a14214719eb15e4f4dd7488462eb65e7

SHA1
b3cb23d9ce34b6f6acf4d2f95d4e31fc77fb6cf6

SHA256
09c4d589fbdd4fdd1ec7148aa6a57ea494d9e8d8d7155230b5a47be571393bad

SHA512
044f291a682345fee9937248a25e06ec9e7cf9af1eb687bfd436e552404607555ec5dae7c98e4a64d8ccc5e37bc5c6136972f395d649e24e3164230fbf5ee42f

Download Submit
C:\Windows\System\daEJznN.exe

Filesize
1.8MB

MD5
3f69a6617449eed88035ede865a479b0

SHA1
b76d281f6da160fda7a613c27e9199e8deab2e8a

SHA256
9fe25c2befd18ce49a634c851a5d14fe6736a3ff287e9bdf5935bce946a9ab01

SHA512
ceaf66625051615c0a6b379ac62ea256b654fb8c63a5add2b42b23c8b84dbc408d7a0d8995f970b6a9fb69cdb11c3ae93a4d6cdb9bd709eeb216cce107b7b038

Download Submit
C:\Windows\System\dqSNOoh.exe

Filesize
1.8MB

MD5
38342a5acdc5d9b40fd09a61b522fd7d

SHA1
27e75e5adac33230e6d1fea3031565cc5c09aa86

SHA256
75f5401fbffedad4dbb259df1bc98af5562a9539f612b0ccc5e0d5c061d9e27b

SHA512
4388e38d654be9896d81ea570b505ffcc354cdd8d8e52318c7db2b44f7d19e3275aeb8427876ebcf446299b5b7a9abd3070dcfb1792d06674196a331528de641

Download Submit
C:\Windows\System\fIVxSaY.exe

Filesize
1.8MB

MD5
29f18b36c430e29cada78c9ff413b6dd

SHA1
412657a4e9e8b0b1d784f3c0ce20b716837bac6d

SHA256
e8a005f49b8dd70a15093e28d51397dd8e23c8b50ad4288fe5cb173566f7573c

SHA512
fd4fcd5bbbf37ce7b28f57712b9de85288d95638c7d1d780f93b80a49ecd85b7599e748ff9f9c71f99443ae37ad5fd5e35c9c50ec4b153d98c547b97b7d7c450

Download Submit
C:\Windows\System\glBsBpF.exe

Filesize
1.8MB

MD5
3b0bd0081a1764f132263178f795cfd8

SHA1
4ae5bf0194d7ac25b62535d3bafe60c0369afe77

SHA256
968ce9555103114cb6cdc3fc02c7cd6229631738a11cb252f99acba181d44492

SHA512
48a0febef3602ecac74d4dc3f89d0a66d604f0ab3d7c6171633ad4834e25a1fd6bab39d1f1e71aea777035bb20f27e6b082bfeff10bf9d138edc510592bbd30b

Download Submit
C:\Windows\System\jdYYpOt.exe

Filesize
1.8MB

MD5
dbe4335b0251e5c9a124da64e7a54e10

SHA1
fa589c9193ead0340e876c40b9a5ed1aa0247ead

SHA256
332c1f06a416b03ba68e6bdd8679663ef7e884946a412b6ec25a89c80624b977

SHA512
9f180b0c9164ab2434b7410e1fbcc47be81cf5c4f8cafb47a13be4e881bf0447ec789e4da3d7ed4a485aa183db8882d66c3abd7e2cc9485bd277439adbae4258

Download Submit
C:\Windows\System\mGpnOQd.exe

Filesize
1.8MB

MD5
ea541eabca843a52671a69547cc4ad35

SHA1
b81c7ea9a01421ee720bc84cdaeb958b7362081d

SHA256
62344c2073dcd22c00b59a9420b3b451090e17bf1ca87bc405d26520846adf7b

SHA512
d23010e42c2b766c14b2eb6e1efe118093dd6608d68875f1ea5c14067b96c9fe9580b55eac4f5f44d17519966c217975128271782ad6092102fdcb7c3880cb09

Download Submit
C:\Windows\System\ntSEqna.exe

Filesize
1.8MB

MD5
b95cc9c9f7e59a9734c27c0682763a4e

SHA1
660acd8fba569cffc3e72ec40d637b50a2f664f8

SHA256
b0fa6771863d489088740307b48242d4eaa3adf4392ed2ee255f367d7c978342

SHA512
988a659cf175f68752b3c2b7c8b2352f7c34427b1a45345fc6fc87229caa39df03eb688088c6858d668474e22346608bdc397999bb5478cf254937fb46c188bf

Download Submit
C:\Windows\System\ooFpvOL.exe

Filesize
1.8MB

MD5
2a033251d26a557495eec2f3cacd8d4e

SHA1
58dafe6fb3f7b8eecdfd4ba1849b054b30d681d5

SHA256
295eb6cc01a3fdb188fd83a55ebc21132cecf6250e8bcaa3989becb344553290

SHA512
b5a5b55e20229f30777b9b4e3df75d2a0eeedb0a05661d27820a9ede26fb90239b69637d9b2b6d901f7cd441fb8530a25af3d5a05b92a3515011e63a8bef4cb0

Download Submit
C:\Windows\System\shywfFA.exe

Filesize
1.8MB

MD5
7018656e036c786ad96783efa53aeb58

SHA1
6fa264770936e1715b29c8df1ed1cd5019a84810

SHA256
c132269d069f29e94e3371aea38976f5aee55a787c3ce39ae4a678cfaf3c59fc

SHA512
5f964a3518a0a4cc5fd99058ba0fb3794be9430f21e8a2dfef6794ab96d87ec6d8b2bc2f3eeeb62fdfc468c660d349e99256b231d962b78cb4f05dc8c8a525ed

Download Submit
C:\Windows\System\tNlrpfw.exe

Filesize
1.8MB

MD5
fa81b8425f8982616d581427479f8280

SHA1
dfedc2016587d7d36ec3f95540efe2fde3771daf

SHA256
6561655db6bf26755a596a0297b35bef269b13a0105ba4268b9373e573359f16

SHA512
5fd074d1d3ca73d3d11a7ca963a3b422bb7f5e051fd5e48cd93fe3375e2a49935af8dda322a5c0d065faedf627d03987745a1ba9b39ff1ad4e3391c774214f12

Download Submit
C:\Windows\System\uvIilSH.exe

Filesize
1.8MB

MD5
7ffd742b6852d9c8d2289fab9ee9731f

SHA1
c8e86e04f5771de45211481f6a77410ff7839b0a

SHA256
9ab0eb4db29f8d0a13ec27bf6a0eae66697c80c5677d7ab2ddbc9ac81dc6e8c1

SHA512
04e38bffa9f2719d38ea9a0b8a2cc6d6a13489c8b336723fd05ea03e20040b916237ad60f28abcafe2f2888c36652e0b784ae483831811c248e3e4aedfaff60d

Download Submit
C:\Windows\System\uxoqLWp.exe

Filesize
1.8MB

MD5
f7aec019570de5ef4e64d3dbb0d4736a

SHA1
b91ea3024f57014070e6dda806c3b1e8fe911ca3

SHA256
3a472142939e044a1ced62fbe269aa6badca0fc0af41a1ef83fe3343190c4307

SHA512
bb920699afb507203f844e514c6ccbb8b6629c8ee1fcdbd202fb19b7789e76a9e94eb880b1dd913f19837340da111a8d28cd6c733f9bffed471e8f659d09a973

Download Submit
C:\Windows\System\wHfEJNW.exe

Filesize
1.8MB

MD5
14a8ca14e38b8042ec2588a6ac6958d1

SHA1
7444221ad2c2ccf94f5e159657552b8a77b50ad7

SHA256
f27ac9a4f9d7f1bda2e49bf63a733cbe1dba028721c2f6d6259801707dbfb4cd

SHA512
d3bc6249d0724406152f830d9ac6f5aa9d1f8252fa6dd0a25c9457f51f398c0a6b7c15b8d0e418d91d99bfc3ffbf0728b9d458733f6f7dbdbdf7ad34f5cb88bc

Download Submit
C:\Windows\System\yjYfEMN.exe

Filesize
1.8MB

MD5
be1d277478fc4c8746a3347dcd85a05a

SHA1
f728ed3798148aba533713c25b21e376690d1439

SHA256
022bffb29e51e0c59de65b2eaf6878a022a058406cafc2ea1659e906da66420e

SHA512
a00a2a7229625715a41f33f02db60bd9113cff2f959a888126297e7197370acab8860dc0c5848fe9e6916f7754aa14afdf33fe2366d9bed52a088e26ab488588

Download Submit
C:\Windows\System\zNVxGDb.exe

Filesize
1.8MB

MD5
4969af34b6c359bfd25e15a97cce9243

SHA1
e3213441f64993e1ca72d3f948ecacf802e84cff

SHA256
4e8a2671a129d535e7e809787daee2f3a3f31025943e1eea099dcd403b5ade1f

SHA512
b7c5732bc70f5d7fbc8988902467e8f0ee2cc5bdd9224256260b7a361519135b9cb85ac779bc95f0da8d4525be6383c979314ee2266de9d1d33ed6f1669d5f0a

Download Submit
C:\Windows\System\zYdWleF.exe

Filesize
1.8MB

MD5
ac340f7cc7184799e8db530afe7116b4

SHA1
4b967292681768067defa0975890bab5b61d9e8f

SHA256
420dbfe95dcf16a52976ae80f2ff875e3d2eb987dfc9537c0a9693b6f37e5891

SHA512
c26b6e338973a402d74ec0884710205722f7101ed901e0e2eae5ce7e71f96c74c0c0de763ba4179e2814633b6e81c2b64692202faf140e5f599112dc078d49cf

Download Submit
C:\Windows\System\zyDlxXl.exe

Filesize
1.8MB

MD5
3e593d711a78f9f4b14789dbe6e15b79

SHA1
4790a494885b67c4daebf0e4cf26dbafba6d138c

SHA256
4231ba1853e4265f8607549650d29febde77efb0a5f61b2eca8b5a0d3b1a0a3e

SHA512
83751080098b8e2ff27c5545b8b8f927baf4a0f54c4baa9487b31cef376fd680c6a4e3362acb10e64a3ae467d9e4452d61a4d089c189ce4a407ec5049bbe4118

Download Submit
memory/1440-2469-0x00007FF739330000-0x00007FF739722000-memory.dmp

Filesize
3.9MB

Download
memory/1440-141-0x00007FF739330000-0x00007FF739722000-memory.dmp

Filesize
3.9MB

Download
memory/1532-0-0x00007FF7AB7C0000-0x00007FF7ABBB2000-memory.dmp

Filesize
3.9MB

Download
memory/1532-1560-0x00007FF7AB7C0000-0x00007FF7ABBB2000-memory.dmp

Filesize
3.9MB

Download
memory/1532-1-0x0000012DB9770000-0x0000012DB9780000-memory.dmp

Filesize
64KB

Download
memory/1892-2422-0x00007FF715F10000-0x00007FF716302000-memory.dmp

Filesize
3.9MB

Download
memory/1892-75-0x00007FF715F10000-0x00007FF716302000-memory.dmp

Filesize
3.9MB

Download
memory/1960-2432-0x00007FF61BD70000-0x00007FF61C162000-memory.dmp

Filesize
3.9MB

Download
memory/1960-83-0x00007FF61BD70000-0x00007FF61C162000-memory.dmp

Filesize
3.9MB

Download
memory/2220-2448-0x00007FF644FB0000-0x00007FF6453A2000-memory.dmp

Filesize
3.9MB

Download
memory/2220-2375-0x00007FF644FB0000-0x00007FF6453A2000-memory.dmp

Filesize
3.9MB

Download
memory/2220-113-0x00007FF644FB0000-0x00007FF6453A2000-memory.dmp

Filesize
3.9MB

Download
memory/2244-2374-0x00007FF785FA0000-0x00007FF786392000-memory.dmp

Filesize
3.9MB

Download
memory/2244-2438-0x00007FF785FA0000-0x00007FF786392000-memory.dmp

Filesize
3.9MB

Download
memory/2244-107-0x00007FF785FA0000-0x00007FF786392000-memory.dmp

Filesize
3.9MB

Download
memory/2432-2441-0x00007FF7454C0000-0x00007FF7458B2000-memory.dmp

Filesize
3.9MB

Download
memory/2432-95-0x00007FF7454C0000-0x00007FF7458B2000-memory.dmp

Filesize
3.9MB

Download
memory/2432-2355-0x00007FF7454C0000-0x00007FF7458B2000-memory.dmp

Filesize
3.9MB

Download
memory/2448-47-0x0000019C325A0000-0x0000019C325C2000-memory.dmp

Filesize
136KB

Download
memory/2448-64-0x0000019C325F0000-0x0000019C32600000-memory.dmp

Filesize
64KB

Download
memory/2448-18-0x0000019C325F0000-0x0000019C32600000-memory.dmp

Filesize
64KB

Download
memory/2448-17-0x00007FFFE41E0000-0x00007FFFE4CA1000-memory.dmp

Filesize
10.8MB

Download
memory/2764-38-0x00007FF6003F0000-0x00007FF6007E2000-memory.dmp

Filesize
3.9MB

Download
memory/2764-2408-0x00007FF6003F0000-0x00007FF6007E2000-memory.dmp

Filesize
3.9MB

Download
memory/2784-2436-0x00007FF79D090000-0x00007FF79D482000-memory.dmp

Filesize
3.9MB

Download
memory/2784-87-0x00007FF79D090000-0x00007FF79D482000-memory.dmp

Filesize
3.9MB

Download
memory/2812-2434-0x00007FF68E5B0000-0x00007FF68E9A2000-memory.dmp

Filesize
3.9MB

Download
memory/2812-86-0x00007FF68E5B0000-0x00007FF68E9A2000-memory.dmp

Filesize
3.9MB

Download
memory/2864-56-0x00007FF64B760000-0x00007FF64BB52000-memory.dmp

Filesize
3.9MB

Download
memory/2864-2426-0x00007FF64B760000-0x00007FF64BB52000-memory.dmp

Filesize
3.9MB

Download
memory/2864-2075-0x00007FF64B760000-0x00007FF64BB52000-memory.dmp

Filesize
3.9MB

Download
memory/3132-69-0x00007FF62BCE0000-0x00007FF62C0D2000-memory.dmp

Filesize
3.9MB

Download
memory/3132-2428-0x00007FF62BCE0000-0x00007FF62C0D2000-memory.dmp

Filesize
3.9MB

Download
memory/3272-343-0x00007FF62B790000-0x00007FF62BB82000-memory.dmp

Filesize
3.9MB

Download
memory/3272-2473-0x00007FF62B790000-0x00007FF62BB82000-memory.dmp

Filesize
3.9MB

Download
memory/3340-2077-0x00007FF67BAF0000-0x00007FF67BEE2000-memory.dmp

Filesize
3.9MB

Download
memory/3340-2430-0x00007FF67BAF0000-0x00007FF67BEE2000-memory.dmp

Filesize
3.9MB

Download
memory/3340-63-0x00007FF67BAF0000-0x00007FF67BEE2000-memory.dmp

Filesize
3.9MB

Download
memory/3404-90-0x00007FF6554B0000-0x00007FF6558A2000-memory.dmp

Filesize
3.9MB

Download
memory/3404-2444-0x00007FF6554B0000-0x00007FF6558A2000-memory.dmp

Filesize
3.9MB

Download
memory/3512-2466-0x00007FF75BFF0000-0x00007FF75C3E2000-memory.dmp

Filesize
3.9MB

Download
memory/3512-127-0x00007FF75BFF0000-0x00007FF75C3E2000-memory.dmp

Filesize
3.9MB

Download
memory/4252-65-0x00007FF7C17D0000-0x00007FF7C1BC2000-memory.dmp

Filesize
3.9MB

Download
memory/4252-2395-0x00007FF7C17D0000-0x00007FF7C1BC2000-memory.dmp

Filesize
3.9MB

Download
memory/4460-2376-0x00007FF6FF6F0000-0x00007FF6FFAE2000-memory.dmp

Filesize
3.9MB

Download
memory/4460-2450-0x00007FF6FF6F0000-0x00007FF6FFAE2000-memory.dmp

Filesize
3.9MB

Download
memory/4460-116-0x00007FF6FF6F0000-0x00007FF6FFAE2000-memory.dmp

Filesize
3.9MB

Download
memory/4844-2354-0x00007FF681DF0000-0x00007FF6821E2000-memory.dmp

Filesize
3.9MB

Download
memory/4844-2446-0x00007FF681DF0000-0x00007FF6821E2000-memory.dmp

Filesize
3.9MB

Download
memory/4844-94-0x00007FF681DF0000-0x00007FF6821E2000-memory.dmp

Filesize
3.9MB

Download
memory/4948-143-0x00007FF795310000-0x00007FF795702000-memory.dmp

Filesize
3.9MB

Download
memory/4948-2470-0x00007FF795310000-0x00007FF795702000-memory.dmp

Filesize
3.9MB

Download
memory/4980-2443-0x00007FF70F170000-0x00007FF70F562000-memory.dmp

Filesize
3.9MB

Download
memory/4980-99-0x00007FF70F170000-0x00007FF70F562000-memory.dmp

Filesize
3.9MB

Download
memory/4980-2373-0x00007FF70F170000-0x00007FF70F562000-memory.dmp

Filesize
3.9MB

Download
memory/4992-2393-0x00007FF663DE0000-0x00007FF6641D2000-memory.dmp

Filesize
3.9MB

Download
memory/4992-26-0x00007FF663DE0000-0x00007FF6641D2000-memory.dmp

Filesize
3.9MB

Download