xmrig | 7997d507d71561515c5778db747a4a4438564ad1d057362dad56d59be0effa5a

Analysis

max time kernel
145s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 23:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
Size

2.3MB
MD5

01de488ecb59483ddad40c09501a44ef
SHA1

2d0bc89b47e7ee8c98aca16ac4231cd930cd1266
SHA256

7997d507d71561515c5778db747a4a4438564ad1d057362dad56d59be0effa5a
SHA512

8d27ff1443bf7df4da4d5a0a8324d33ab00bb97d7ea509ed29945aa1ccc852230ebbe63d439a65c4ba229a4c9122dfd20eb7a6d58a53d355ad06c129dc947e7e
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiqj:NABE

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 42 IoCs

miner

resource	yara_rule
behavioral2/memory/4436-54-0x00007FF6A8ED0000-0x00007FF6A92C2000-memory.dmp	xmrig
behavioral2/memory/4660-61-0x00007FF7DABE0000-0x00007FF7DAFD2000-memory.dmp	xmrig
behavioral2/memory/4156-65-0x00007FF6B17F0000-0x00007FF6B1BE2000-memory.dmp	xmrig
behavioral2/memory/4620-77-0x00007FF7D83A0000-0x00007FF7D8792000-memory.dmp	xmrig
behavioral2/memory/3228-88-0x00007FF635B60000-0x00007FF635F52000-memory.dmp	xmrig
behavioral2/memory/1832-78-0x00007FF661A00000-0x00007FF661DF2000-memory.dmp	xmrig
behavioral2/memory/3580-47-0x00007FF7B2EC0000-0x00007FF7B32B2000-memory.dmp	xmrig
behavioral2/memory/4528-41-0x00007FF7B9060000-0x00007FF7B9452000-memory.dmp	xmrig
behavioral2/memory/4628-24-0x00007FF734810000-0x00007FF734C02000-memory.dmp	xmrig
behavioral2/memory/324-10-0x00007FF6BA4A0000-0x00007FF6BA892000-memory.dmp	xmrig
behavioral2/memory/4440-122-0x00007FF6C5960000-0x00007FF6C5D52000-memory.dmp	xmrig
behavioral2/memory/3388-152-0x00007FF68EDC0000-0x00007FF68F1B2000-memory.dmp	xmrig
behavioral2/memory/4008-143-0x00007FF710DD0000-0x00007FF7111C2000-memory.dmp	xmrig
behavioral2/memory/2612-131-0x00007FF7A8990000-0x00007FF7A8D82000-memory.dmp	xmrig
behavioral2/memory/4072-1685-0x00007FF7490A0000-0x00007FF749492000-memory.dmp	xmrig
behavioral2/memory/3948-2165-0x00007FF788360000-0x00007FF788752000-memory.dmp	xmrig
behavioral2/memory/3376-2285-0x00007FF6671D0000-0x00007FF6675C2000-memory.dmp	xmrig
behavioral2/memory/4536-2302-0x00007FF77AAE0000-0x00007FF77AED2000-memory.dmp	xmrig
behavioral2/memory/4616-2303-0x00007FF62EB00000-0x00007FF62EEF2000-memory.dmp	xmrig
behavioral2/memory/3804-2304-0x00007FF605E70000-0x00007FF606262000-memory.dmp	xmrig
behavioral2/memory/3564-2320-0x00007FF7A4FA0000-0x00007FF7A5392000-memory.dmp	xmrig
behavioral2/memory/324-2338-0x00007FF6BA4A0000-0x00007FF6BA892000-memory.dmp	xmrig
behavioral2/memory/4628-2340-0x00007FF734810000-0x00007FF734C02000-memory.dmp	xmrig
behavioral2/memory/4528-2342-0x00007FF7B9060000-0x00007FF7B9452000-memory.dmp	xmrig
behavioral2/memory/3580-2344-0x00007FF7B2EC0000-0x00007FF7B32B2000-memory.dmp	xmrig
behavioral2/memory/4436-2346-0x00007FF6A8ED0000-0x00007FF6A92C2000-memory.dmp	xmrig
behavioral2/memory/4660-2348-0x00007FF7DABE0000-0x00007FF7DAFD2000-memory.dmp	xmrig
behavioral2/memory/4156-2350-0x00007FF6B17F0000-0x00007FF6B1BE2000-memory.dmp	xmrig
behavioral2/memory/4620-2352-0x00007FF7D83A0000-0x00007FF7D8792000-memory.dmp	xmrig
behavioral2/memory/1832-2354-0x00007FF661A00000-0x00007FF661DF2000-memory.dmp	xmrig
behavioral2/memory/3228-2356-0x00007FF635B60000-0x00007FF635F52000-memory.dmp	xmrig
behavioral2/memory/4072-2373-0x00007FF7490A0000-0x00007FF749492000-memory.dmp	xmrig
behavioral2/memory/3948-2377-0x00007FF788360000-0x00007FF788752000-memory.dmp	xmrig
behavioral2/memory/3376-2379-0x00007FF6671D0000-0x00007FF6675C2000-memory.dmp	xmrig
behavioral2/memory/2040-2376-0x00007FF61AAB0000-0x00007FF61AEA2000-memory.dmp	xmrig
behavioral2/memory/4536-2381-0x00007FF77AAE0000-0x00007FF77AED2000-memory.dmp	xmrig
behavioral2/memory/4440-2383-0x00007FF6C5960000-0x00007FF6C5D52000-memory.dmp	xmrig
behavioral2/memory/4616-2385-0x00007FF62EB00000-0x00007FF62EEF2000-memory.dmp	xmrig
behavioral2/memory/4008-2389-0x00007FF710DD0000-0x00007FF7111C2000-memory.dmp	xmrig
behavioral2/memory/3804-2387-0x00007FF605E70000-0x00007FF606262000-memory.dmp	xmrig
behavioral2/memory/3564-2391-0x00007FF7A4FA0000-0x00007FF7A5392000-memory.dmp	xmrig
behavioral2/memory/3388-2393-0x00007FF68EDC0000-0x00007FF68F1B2000-memory.dmp	xmrig

Blocklisted process makes network request 6 IoCs

flow	pid	Process
3	1564	powershell.exe
7	1564	powershell.exe
15	1564	powershell.exe
16	1564	powershell.exe
18	1564	powershell.exe
21	1564	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
324	jjCYRSu.exe
4528	JLGisPl.exe
4628	WRevucW.exe
3580	XQURmWv.exe
4436	nRWiWPw.exe
4660	MlEsmRm.exe
4156	cDOcDWW.exe
4620	qJwJdOv.exe
1832	msvAabI.exe
3228	xQHMjtg.exe
2040	dRgAexC.exe
4072	HXfpvym.exe
3376	SBdXLlk.exe
3948	rrsNGec.exe
4536	hVKSABw.exe
4616	xNoiXIW.exe
4440	LoHqVSn.exe
3804	PxzZGEt.exe
3564	KwnLhUX.exe
4008	EebTsLI.exe
3388	pORomAx.exe
1932	HYGFGxU.exe
2776	qNkNeuv.exe
4044	rLXXdSp.exe
2948	oTclxRu.exe
456	mqQGPJl.exe
4088	WoJnllP.exe
4060	eRFZXSH.exe
2168	LFiRCsl.exe
2032	OklJlcS.exe
8	wAHDRuX.exe
376	IIoGirT.exe
3600	nZKTpUE.exe
4836	effOUos.exe
4360	twiUhmP.exe
2340	FsCvOGa.exe
2864	OPwVbZi.exe
2076	yRwnCpy.exe
3880	frDZEmR.exe
4992	JFrbdgv.exe
1920	HjLTtDe.exe
3544	uSHBcxo.exe
780	EubedTo.exe
2732	rejsJHR.exe
2900	SZPuZmn.exe
4152	lZvRxJb.exe
2504	LImpCgl.exe
1424	MkVMrLZ.exe
4696	LNrFykY.exe
1376	qyDPdFi.exe
344	fvDEXbc.exe
2616	bUGlbwX.exe
2588	kabytsF.exe
4752	zoArEfP.exe
3492	KasARYr.exe
4940	ckeTXBM.exe
1220	LajZEiV.exe
4816	vAaygne.exe
4052	vAXHcre.exe
4356	HPPZyEU.exe
2480	AVDiXmj.exe
3988	QMJrqqG.exe
3648	mfbiNis.exe
4476	oEEQsMN.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2612-0-0x00007FF7A8990000-0x00007FF7A8D82000-memory.dmp	upx
behavioral2/files/0x0007000000023298-6.dat	upx
behavioral2/files/0x0008000000023425-8.dat	upx
behavioral2/files/0x0008000000023422-14.dat	upx
behavioral2/files/0x0007000000023426-23.dat	upx
behavioral2/files/0x0007000000023427-39.dat	upx
behavioral2/files/0x0007000000023428-45.dat	upx
behavioral2/files/0x000800000002342a-50.dat	upx
behavioral2/memory/4436-54-0x00007FF6A8ED0000-0x00007FF6A92C2000-memory.dmp	upx
behavioral2/files/0x000700000002342b-59.dat	upx
behavioral2/memory/4660-61-0x00007FF7DABE0000-0x00007FF7DAFD2000-memory.dmp	upx
behavioral2/memory/4156-65-0x00007FF6B17F0000-0x00007FF6B1BE2000-memory.dmp	upx
behavioral2/files/0x0008000000023429-66.dat	upx
behavioral2/files/0x000700000002342c-73.dat	upx
behavioral2/memory/4620-77-0x00007FF7D83A0000-0x00007FF7D8792000-memory.dmp	upx
behavioral2/files/0x000700000002342d-80.dat	upx
behavioral2/memory/3228-88-0x00007FF635B60000-0x00007FF635F52000-memory.dmp	upx
behavioral2/memory/3376-93-0x00007FF6671D0000-0x00007FF6675C2000-memory.dmp	upx
behavioral2/files/0x000700000002342f-96.dat	upx
behavioral2/files/0x0007000000023430-98.dat	upx
behavioral2/memory/3948-91-0x00007FF788360000-0x00007FF788752000-memory.dmp	upx
behavioral2/memory/2040-90-0x00007FF61AAB0000-0x00007FF61AEA2000-memory.dmp	upx
behavioral2/files/0x000700000002342e-89.dat	upx
behavioral2/memory/4072-85-0x00007FF7490A0000-0x00007FF749492000-memory.dmp	upx
behavioral2/memory/1832-78-0x00007FF661A00000-0x00007FF661DF2000-memory.dmp	upx
behavioral2/memory/3580-47-0x00007FF7B2EC0000-0x00007FF7B32B2000-memory.dmp	upx
behavioral2/memory/4528-41-0x00007FF7B9060000-0x00007FF7B9452000-memory.dmp	upx
behavioral2/memory/4628-24-0x00007FF734810000-0x00007FF734C02000-memory.dmp	upx
behavioral2/memory/324-10-0x00007FF6BA4A0000-0x00007FF6BA892000-memory.dmp	upx
behavioral2/files/0x000500000002297c-111.dat	upx
behavioral2/memory/4616-117-0x00007FF62EB00000-0x00007FF62EEF2000-memory.dmp	upx
behavioral2/memory/4440-122-0x00007FF6C5960000-0x00007FF6C5D52000-memory.dmp	upx
behavioral2/files/0x0007000000023433-132.dat	upx
behavioral2/files/0x0007000000023432-146.dat	upx
behavioral2/files/0x0007000000023436-153.dat	upx
behavioral2/files/0x0007000000023437-163.dat	upx
behavioral2/files/0x0007000000023439-170.dat	upx
behavioral2/files/0x0007000000023438-168.dat	upx
behavioral2/files/0x0007000000023435-154.dat	upx
behavioral2/memory/3388-152-0x00007FF68EDC0000-0x00007FF68F1B2000-memory.dmp	upx
behavioral2/files/0x000700000002343b-183.dat	upx
behavioral2/files/0x0007000000023440-202.dat	upx
behavioral2/files/0x000700000002343e-198.dat	upx
behavioral2/files/0x000700000002343f-197.dat	upx
behavioral2/files/0x000700000002343d-193.dat	upx
behavioral2/files/0x000700000002343c-188.dat	upx
behavioral2/files/0x000700000002343a-175.dat	upx
behavioral2/files/0x0007000000023434-149.dat	upx
behavioral2/memory/4008-143-0x00007FF710DD0000-0x00007FF7111C2000-memory.dmp	upx
behavioral2/memory/3564-138-0x00007FF7A4FA0000-0x00007FF7A5392000-memory.dmp	upx
behavioral2/memory/2612-131-0x00007FF7A8990000-0x00007FF7A8D82000-memory.dmp	upx
behavioral2/memory/3804-130-0x00007FF605E70000-0x00007FF606262000-memory.dmp	upx
behavioral2/files/0x0007000000023431-128.dat	upx
behavioral2/files/0x000600000002296d-120.dat	upx
behavioral2/files/0x0008000000023423-112.dat	upx
behavioral2/memory/4536-107-0x00007FF77AAE0000-0x00007FF77AED2000-memory.dmp	upx
behavioral2/memory/4072-1685-0x00007FF7490A0000-0x00007FF749492000-memory.dmp	upx
behavioral2/memory/3948-2165-0x00007FF788360000-0x00007FF788752000-memory.dmp	upx
behavioral2/memory/3376-2285-0x00007FF6671D0000-0x00007FF6675C2000-memory.dmp	upx
behavioral2/memory/4536-2302-0x00007FF77AAE0000-0x00007FF77AED2000-memory.dmp	upx
behavioral2/memory/4616-2303-0x00007FF62EB00000-0x00007FF62EEF2000-memory.dmp	upx
behavioral2/memory/3804-2304-0x00007FF605E70000-0x00007FF606262000-memory.dmp	upx
behavioral2/memory/3564-2320-0x00007FF7A4FA0000-0x00007FF7A5392000-memory.dmp	upx
behavioral2/memory/324-2338-0x00007FF6BA4A0000-0x00007FF6BA892000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\WXicQcY.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\JoWwcNu.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\KCbmgsH.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\LCfnRzE.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\pORomAx.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\fYFNQMb.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\HVtpOpn.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\YBNTYat.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\XtfnGxt.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\DmbTRiG.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\MUgdCrC.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\wNdiykS.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\xvimbLU.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\LOnypXs.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\dJaUiCL.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\MoxLZxe.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\EtDoRFO.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\EebTsLI.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\dLjryPH.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\LCaXkyG.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\NcBvoie.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\ROTjWzY.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\jeNiUly.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\twiUhmP.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\bUGlbwX.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\qOUhjWX.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\ZyCHVVV.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\qojkDPw.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\FcaDBZJ.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\esTLYLn.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\IMbEyzs.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\PXQajXw.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\LIHZGms.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\JjUnoSa.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\pesbFMT.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\CtzHioe.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\fwJhBiJ.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\zDoheFb.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\AfaxVot.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\YiCgpBY.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\qtmbCaQ.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\eAVQTML.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\oqXTjmF.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\xbVyiEd.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\fxFNlAi.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\RKqYIPk.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\bSiVjWD.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\AnuUdcG.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\jLmAtkB.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\DcQgcUD.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\NSKUpVh.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\kJcMxyz.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\qWUHEGw.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\QIHahLp.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\tqIxtmm.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\zVknGoo.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\MjnwFtw.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\VUiMRFO.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\kIyHzQM.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\QWIlzGV.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\xoZEFBA.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\gpeCAJR.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\pGSqyjh.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
File created	C:\Windows\System\OJwqDkr.exe	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1564	powershell.exe
1564	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
Token: SeDebugPrivilege	1564	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 1564	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	83
PID 2612 wrote to memory of 1564	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	83
PID 2612 wrote to memory of 324	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	84
PID 2612 wrote to memory of 324	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	84
PID 2612 wrote to memory of 4528	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	85
PID 2612 wrote to memory of 4528	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	85
PID 2612 wrote to memory of 4628	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	86
PID 2612 wrote to memory of 4628	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	86
PID 2612 wrote to memory of 3580	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	87
PID 2612 wrote to memory of 3580	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	87
PID 2612 wrote to memory of 4436	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	88
PID 2612 wrote to memory of 4436	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	88
PID 2612 wrote to memory of 4660	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	89
PID 2612 wrote to memory of 4660	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	89
PID 2612 wrote to memory of 4156	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	90
PID 2612 wrote to memory of 4156	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	90
PID 2612 wrote to memory of 4620	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	91
PID 2612 wrote to memory of 4620	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	91
PID 2612 wrote to memory of 1832	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	92
PID 2612 wrote to memory of 1832	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	92
PID 2612 wrote to memory of 3228	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	93
PID 2612 wrote to memory of 3228	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	93
PID 2612 wrote to memory of 4072	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	94
PID 2612 wrote to memory of 4072	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	94
PID 2612 wrote to memory of 2040	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	95
PID 2612 wrote to memory of 2040	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	95
PID 2612 wrote to memory of 3376	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	96
PID 2612 wrote to memory of 3376	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	96
PID 2612 wrote to memory of 3948	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	97
PID 2612 wrote to memory of 3948	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	97
PID 2612 wrote to memory of 4536	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	98
PID 2612 wrote to memory of 4536	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	98
PID 2612 wrote to memory of 4616	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	100
PID 2612 wrote to memory of 4616	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	100
PID 2612 wrote to memory of 4440	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	101
PID 2612 wrote to memory of 4440	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	101
PID 2612 wrote to memory of 3804	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	102
PID 2612 wrote to memory of 3804	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	102
PID 2612 wrote to memory of 3564	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	103
PID 2612 wrote to memory of 3564	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	103
PID 2612 wrote to memory of 4008	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	104
PID 2612 wrote to memory of 4008	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	104
PID 2612 wrote to memory of 3388	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	105
PID 2612 wrote to memory of 3388	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	105
PID 2612 wrote to memory of 2776	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	106
PID 2612 wrote to memory of 2776	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	106
PID 2612 wrote to memory of 1932	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	107
PID 2612 wrote to memory of 1932	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	107
PID 2612 wrote to memory of 4044	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	108
PID 2612 wrote to memory of 4044	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	108
PID 2612 wrote to memory of 2948	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	109
PID 2612 wrote to memory of 2948	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	109
PID 2612 wrote to memory of 456	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	110
PID 2612 wrote to memory of 456	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	110
PID 2612 wrote to memory of 4088	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	111
PID 2612 wrote to memory of 4088	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	111
PID 2612 wrote to memory of 4060	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	112
PID 2612 wrote to memory of 4060	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	112
PID 2612 wrote to memory of 2168	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	113
PID 2612 wrote to memory of 2168	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	113
PID 2612 wrote to memory of 2032	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	114
PID 2612 wrote to memory of 2032	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	114
PID 2612 wrote to memory of 8	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	115
PID 2612 wrote to memory of 8	2612	01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\01de488ecb59483ddad40c09501a44ef_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1564
- C:\Windows\System\jjCYRSu.exe
  C:\Windows\System\jjCYRSu.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\JLGisPl.exe
  C:\Windows\System\JLGisPl.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\WRevucW.exe
  C:\Windows\System\WRevucW.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\XQURmWv.exe
  C:\Windows\System\XQURmWv.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\nRWiWPw.exe
  C:\Windows\System\nRWiWPw.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\MlEsmRm.exe
  C:\Windows\System\MlEsmRm.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\cDOcDWW.exe
  C:\Windows\System\cDOcDWW.exe
  2⤵
  - Executes dropped EXE
  PID:4156
- C:\Windows\System\qJwJdOv.exe
  C:\Windows\System\qJwJdOv.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\msvAabI.exe
  C:\Windows\System\msvAabI.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\xQHMjtg.exe
  C:\Windows\System\xQHMjtg.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\HXfpvym.exe
  C:\Windows\System\HXfpvym.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\dRgAexC.exe
  C:\Windows\System\dRgAexC.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\SBdXLlk.exe
  C:\Windows\System\SBdXLlk.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\rrsNGec.exe
  C:\Windows\System\rrsNGec.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\hVKSABw.exe
  C:\Windows\System\hVKSABw.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\xNoiXIW.exe
  C:\Windows\System\xNoiXIW.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\LoHqVSn.exe
  C:\Windows\System\LoHqVSn.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\PxzZGEt.exe
  C:\Windows\System\PxzZGEt.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\KwnLhUX.exe
  C:\Windows\System\KwnLhUX.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\EebTsLI.exe
  C:\Windows\System\EebTsLI.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\pORomAx.exe
  C:\Windows\System\pORomAx.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\qNkNeuv.exe
  C:\Windows\System\qNkNeuv.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\HYGFGxU.exe
  C:\Windows\System\HYGFGxU.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\rLXXdSp.exe
  C:\Windows\System\rLXXdSp.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\oTclxRu.exe
  C:\Windows\System\oTclxRu.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\mqQGPJl.exe
  C:\Windows\System\mqQGPJl.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\WoJnllP.exe
  C:\Windows\System\WoJnllP.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\eRFZXSH.exe
  C:\Windows\System\eRFZXSH.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\LFiRCsl.exe
  C:\Windows\System\LFiRCsl.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\OklJlcS.exe
  C:\Windows\System\OklJlcS.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\wAHDRuX.exe
  C:\Windows\System\wAHDRuX.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\IIoGirT.exe
  C:\Windows\System\IIoGirT.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\nZKTpUE.exe
  C:\Windows\System\nZKTpUE.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\effOUos.exe
  C:\Windows\System\effOUos.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\twiUhmP.exe
  C:\Windows\System\twiUhmP.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\FsCvOGa.exe
  C:\Windows\System\FsCvOGa.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\OPwVbZi.exe
  C:\Windows\System\OPwVbZi.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\yRwnCpy.exe
  C:\Windows\System\yRwnCpy.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\frDZEmR.exe
  C:\Windows\System\frDZEmR.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\JFrbdgv.exe
  C:\Windows\System\JFrbdgv.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\HjLTtDe.exe
  C:\Windows\System\HjLTtDe.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\uSHBcxo.exe
  C:\Windows\System\uSHBcxo.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\EubedTo.exe
  C:\Windows\System\EubedTo.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\rejsJHR.exe
  C:\Windows\System\rejsJHR.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\SZPuZmn.exe
  C:\Windows\System\SZPuZmn.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\lZvRxJb.exe
  C:\Windows\System\lZvRxJb.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\LImpCgl.exe
  C:\Windows\System\LImpCgl.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\MkVMrLZ.exe
  C:\Windows\System\MkVMrLZ.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\LNrFykY.exe
  C:\Windows\System\LNrFykY.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\qyDPdFi.exe
  C:\Windows\System\qyDPdFi.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\fvDEXbc.exe
  C:\Windows\System\fvDEXbc.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System\bUGlbwX.exe
  C:\Windows\System\bUGlbwX.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\kabytsF.exe
  C:\Windows\System\kabytsF.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\zoArEfP.exe
  C:\Windows\System\zoArEfP.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\KasARYr.exe
  C:\Windows\System\KasARYr.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\ckeTXBM.exe
  C:\Windows\System\ckeTXBM.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\LajZEiV.exe
  C:\Windows\System\LajZEiV.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\vAaygne.exe
  C:\Windows\System\vAaygne.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\vAXHcre.exe
  C:\Windows\System\vAXHcre.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\HPPZyEU.exe
  C:\Windows\System\HPPZyEU.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\AVDiXmj.exe
  C:\Windows\System\AVDiXmj.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\QMJrqqG.exe
  C:\Windows\System\QMJrqqG.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\mfbiNis.exe
  C:\Windows\System\mfbiNis.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\oEEQsMN.exe
  C:\Windows\System\oEEQsMN.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\MTrbkQC.exe
  C:\Windows\System\MTrbkQC.exe
  2⤵
  PID:4268
- C:\Windows\System\ThwHiXt.exe
  C:\Windows\System\ThwHiXt.exe
  2⤵
  PID:4496
- C:\Windows\System\UvVPGuh.exe
  C:\Windows\System\UvVPGuh.exe
  2⤵
  PID:4592
- C:\Windows\System\ICeYnop.exe
  C:\Windows\System\ICeYnop.exe
  2⤵
  PID:4084
- C:\Windows\System\TVyUlAd.exe
  C:\Windows\System\TVyUlAd.exe
  2⤵
  PID:4176
- C:\Windows\System\RBJuqDu.exe
  C:\Windows\System\RBJuqDu.exe
  2⤵
  PID:2408
- C:\Windows\System\VUNxEqv.exe
  C:\Windows\System\VUNxEqv.exe
  2⤵
  PID:4324
- C:\Windows\System\jIxjxrg.exe
  C:\Windows\System\jIxjxrg.exe
  2⤵
  PID:2724
- C:\Windows\System\xoZEFBA.exe
  C:\Windows\System\xoZEFBA.exe
  2⤵
  PID:2428
- C:\Windows\System\HGFMzhT.exe
  C:\Windows\System\HGFMzhT.exe
  2⤵
  PID:4692
- C:\Windows\System\IeSaQRo.exe
  C:\Windows\System\IeSaQRo.exe
  2⤵
  PID:440
- C:\Windows\System\lgqCeFb.exe
  C:\Windows\System\lgqCeFb.exe
  2⤵
  PID:1440
- C:\Windows\System\gCkRmeL.exe
  C:\Windows\System\gCkRmeL.exe
  2⤵
  PID:4732
- C:\Windows\System\ZNFHBLY.exe
  C:\Windows\System\ZNFHBLY.exe
  2⤵
  PID:4276
- C:\Windows\System\PXQajXw.exe
  C:\Windows\System\PXQajXw.exe
  2⤵
  PID:1956
- C:\Windows\System\LUjkKtP.exe
  C:\Windows\System\LUjkKtP.exe
  2⤵
  PID:3324
- C:\Windows\System\WxCqtSE.exe
  C:\Windows\System\WxCqtSE.exe
  2⤵
  PID:3792
- C:\Windows\System\CmVnfrY.exe
  C:\Windows\System\CmVnfrY.exe
  2⤵
  PID:5128
- C:\Windows\System\qOxnKWw.exe
  C:\Windows\System\qOxnKWw.exe
  2⤵
  PID:5164
- C:\Windows\System\WshSwlQ.exe
  C:\Windows\System\WshSwlQ.exe
  2⤵
  PID:5180
- C:\Windows\System\cwBCLTN.exe
  C:\Windows\System\cwBCLTN.exe
  2⤵
  PID:5208
- C:\Windows\System\wqHvGPc.exe
  C:\Windows\System\wqHvGPc.exe
  2⤵
  PID:5228
- C:\Windows\System\KbAEFMv.exe
  C:\Windows\System\KbAEFMv.exe
  2⤵
  PID:5244
- C:\Windows\System\ANFLoll.exe
  C:\Windows\System\ANFLoll.exe
  2⤵
  PID:5284
- C:\Windows\System\uVmQlSg.exe
  C:\Windows\System\uVmQlSg.exe
  2⤵
  PID:5304
- C:\Windows\System\GPPtbBt.exe
  C:\Windows\System\GPPtbBt.exe
  2⤵
  PID:5356
- C:\Windows\System\kTyTKIN.exe
  C:\Windows\System\kTyTKIN.exe
  2⤵
  PID:5376
- C:\Windows\System\RvfyFRi.exe
  C:\Windows\System\RvfyFRi.exe
  2⤵
  PID:5404
- C:\Windows\System\uYyxIoc.exe
  C:\Windows\System\uYyxIoc.exe
  2⤵
  PID:5428
- C:\Windows\System\jZWMhtA.exe
  C:\Windows\System\jZWMhtA.exe
  2⤵
  PID:5448
- C:\Windows\System\AkIdgrY.exe
  C:\Windows\System\AkIdgrY.exe
  2⤵
  PID:5472
- C:\Windows\System\qEPFXdH.exe
  C:\Windows\System\qEPFXdH.exe
  2⤵
  PID:5492
- C:\Windows\System\SidfjlX.exe
  C:\Windows\System\SidfjlX.exe
  2⤵
  PID:5516
- C:\Windows\System\cQgweos.exe
  C:\Windows\System\cQgweos.exe
  2⤵
  PID:5536
- C:\Windows\System\iohyFTi.exe
  C:\Windows\System\iohyFTi.exe
  2⤵
  PID:5556
- C:\Windows\System\kQTGDPv.exe
  C:\Windows\System\kQTGDPv.exe
  2⤵
  PID:5580
- C:\Windows\System\yQmCAri.exe
  C:\Windows\System\yQmCAri.exe
  2⤵
  PID:5628
- C:\Windows\System\tqIxtmm.exe
  C:\Windows\System\tqIxtmm.exe
  2⤵
  PID:5652
- C:\Windows\System\LIHZGms.exe
  C:\Windows\System\LIHZGms.exe
  2⤵
  PID:5668
- C:\Windows\System\VnoDNhp.exe
  C:\Windows\System\VnoDNhp.exe
  2⤵
  PID:5728
- C:\Windows\System\iCBKtFL.exe
  C:\Windows\System\iCBKtFL.exe
  2⤵
  PID:5772
- C:\Windows\System\xBrMlbm.exe
  C:\Windows\System\xBrMlbm.exe
  2⤵
  PID:5804
- C:\Windows\System\TqYnsEd.exe
  C:\Windows\System\TqYnsEd.exe
  2⤵
  PID:5852
- C:\Windows\System\PxycCDo.exe
  C:\Windows\System\PxycCDo.exe
  2⤵
  PID:5872
- C:\Windows\System\fYFNQMb.exe
  C:\Windows\System\fYFNQMb.exe
  2⤵
  PID:5904
- C:\Windows\System\MHhVdQR.exe
  C:\Windows\System\MHhVdQR.exe
  2⤵
  PID:5932
- C:\Windows\System\uACGINY.exe
  C:\Windows\System\uACGINY.exe
  2⤵
  PID:5952
- C:\Windows\System\LPJBABh.exe
  C:\Windows\System\LPJBABh.exe
  2⤵
  PID:5972
- C:\Windows\System\kklCFvo.exe
  C:\Windows\System\kklCFvo.exe
  2⤵
  PID:6004
- C:\Windows\System\wNdiykS.exe
  C:\Windows\System\wNdiykS.exe
  2⤵
  PID:6024
- C:\Windows\System\fwJhBiJ.exe
  C:\Windows\System\fwJhBiJ.exe
  2⤵
  PID:6048
- C:\Windows\System\PfHUimi.exe
  C:\Windows\System\PfHUimi.exe
  2⤵
  PID:6084
- C:\Windows\System\scYkkFE.exe
  C:\Windows\System\scYkkFE.exe
  2⤵
  PID:6124
- C:\Windows\System\sLmCDSj.exe
  C:\Windows\System\sLmCDSj.exe
  2⤵
  PID:3092
- C:\Windows\System\RyfCpEU.exe
  C:\Windows\System\RyfCpEU.exe
  2⤵
  PID:2208
- C:\Windows\System\gUbsOcE.exe
  C:\Windows\System\gUbsOcE.exe
  2⤵
  PID:2604
- C:\Windows\System\KVpypbt.exe
  C:\Windows\System\KVpypbt.exe
  2⤵
  PID:5160
- C:\Windows\System\AWDQyFI.exe
  C:\Windows\System\AWDQyFI.exe
  2⤵
  PID:5268
- C:\Windows\System\PgBqDwD.exe
  C:\Windows\System\PgBqDwD.exe
  2⤵
  PID:5332
- C:\Windows\System\NgxYdAE.exe
  C:\Windows\System\NgxYdAE.exe
  2⤵
  PID:5444
- C:\Windows\System\xjunxCu.exe
  C:\Windows\System\xjunxCu.exe
  2⤵
  PID:5396
- C:\Windows\System\aZeNvEJ.exe
  C:\Windows\System\aZeNvEJ.exe
  2⤵
  PID:5484
- C:\Windows\System\bdyoIZM.exe
  C:\Windows\System\bdyoIZM.exe
  2⤵
  PID:5680
- C:\Windows\System\rVYhfgL.exe
  C:\Windows\System\rVYhfgL.exe
  2⤵
  PID:5640
- C:\Windows\System\BKdHhbs.exe
  C:\Windows\System\BKdHhbs.exe
  2⤵
  PID:5744
- C:\Windows\System\gcZqsOe.exe
  C:\Windows\System\gcZqsOe.exe
  2⤵
  PID:5832
- C:\Windows\System\QCQxrzS.exe
  C:\Windows\System\QCQxrzS.exe
  2⤵
  PID:5888
- C:\Windows\System\JThwyfN.exe
  C:\Windows\System\JThwyfN.exe
  2⤵
  PID:5948
- C:\Windows\System\kTBYREw.exe
  C:\Windows\System\kTBYREw.exe
  2⤵
  PID:6032
- C:\Windows\System\KwcQvbC.exe
  C:\Windows\System\KwcQvbC.exe
  2⤵
  PID:6040
- C:\Windows\System\WUdPDvE.exe
  C:\Windows\System\WUdPDvE.exe
  2⤵
  PID:6140
- C:\Windows\System\RtdtJnu.exe
  C:\Windows\System\RtdtJnu.exe
  2⤵
  PID:5236
- C:\Windows\System\pzoBGIL.exe
  C:\Windows\System\pzoBGIL.exe
  2⤵
  PID:5508
- C:\Windows\System\IWuDmUM.exe
  C:\Windows\System\IWuDmUM.exe
  2⤵
  PID:5764
- C:\Windows\System\YeZedQj.exe
  C:\Windows\System\YeZedQj.exe
  2⤵
  PID:5660
- C:\Windows\System\oyWhdWn.exe
  C:\Windows\System\oyWhdWn.exe
  2⤵
  PID:5724
- C:\Windows\System\NIyyFco.exe
  C:\Windows\System\NIyyFco.exe
  2⤵
  PID:5896
- C:\Windows\System\QDwhSqK.exe
  C:\Windows\System\QDwhSqK.exe
  2⤵
  PID:552
- C:\Windows\System\kJncMKT.exe
  C:\Windows\System\kJncMKT.exe
  2⤵
  PID:3852
- C:\Windows\System\nFhwBVH.exe
  C:\Windows\System\nFhwBVH.exe
  2⤵
  PID:1544
- C:\Windows\System\dLjryPH.exe
  C:\Windows\System\dLjryPH.exe
  2⤵
  PID:5124
- C:\Windows\System\jYXMAdQ.exe
  C:\Windows\System\jYXMAdQ.exe
  2⤵
  PID:5092
- C:\Windows\System\lhuVHxN.exe
  C:\Windows\System\lhuVHxN.exe
  2⤵
  PID:5964
- C:\Windows\System\HVtpOpn.exe
  C:\Windows\System\HVtpOpn.exe
  2⤵
  PID:5940
- C:\Windows\System\JjUnoSa.exe
  C:\Windows\System\JjUnoSa.exe
  2⤵
  PID:5392
- C:\Windows\System\XHgCNJw.exe
  C:\Windows\System\XHgCNJw.exe
  2⤵
  PID:812
- C:\Windows\System\CmMgdtu.exe
  C:\Windows\System\CmMgdtu.exe
  2⤵
  PID:6020
- C:\Windows\System\zxKGvhy.exe
  C:\Windows\System\zxKGvhy.exe
  2⤵
  PID:5424
- C:\Windows\System\RYYDoZk.exe
  C:\Windows\System\RYYDoZk.exe
  2⤵
  PID:6200
- C:\Windows\System\JqGzihF.exe
  C:\Windows\System\JqGzihF.exe
  2⤵
  PID:6228
- C:\Windows\System\xvimbLU.exe
  C:\Windows\System\xvimbLU.exe
  2⤵
  PID:6280
- C:\Windows\System\MoCzyWI.exe
  C:\Windows\System\MoCzyWI.exe
  2⤵
  PID:6308
- C:\Windows\System\zVknGoo.exe
  C:\Windows\System\zVknGoo.exe
  2⤵
  PID:6328
- C:\Windows\System\VebVAfg.exe
  C:\Windows\System\VebVAfg.exe
  2⤵
  PID:6348
- C:\Windows\System\rvVTiIP.exe
  C:\Windows\System\rvVTiIP.exe
  2⤵
  PID:6400
- C:\Windows\System\qqIhQrp.exe
  C:\Windows\System\qqIhQrp.exe
  2⤵
  PID:6420
- C:\Windows\System\dwajfTx.exe
  C:\Windows\System\dwajfTx.exe
  2⤵
  PID:6440
- C:\Windows\System\LiVUcTC.exe
  C:\Windows\System\LiVUcTC.exe
  2⤵
  PID:6508
- C:\Windows\System\VeviWFL.exe
  C:\Windows\System\VeviWFL.exe
  2⤵
  PID:6528
- C:\Windows\System\UfdfdVv.exe
  C:\Windows\System\UfdfdVv.exe
  2⤵
  PID:6620
- C:\Windows\System\ByzaKiv.exe
  C:\Windows\System\ByzaKiv.exe
  2⤵
  PID:6644
- C:\Windows\System\vaNzCFh.exe
  C:\Windows\System\vaNzCFh.exe
  2⤵
  PID:6692
- C:\Windows\System\sQAtOtO.exe
  C:\Windows\System\sQAtOtO.exe
  2⤵
  PID:6712
- C:\Windows\System\zDoheFb.exe
  C:\Windows\System\zDoheFb.exe
  2⤵
  PID:6736
- C:\Windows\System\KRZSjVc.exe
  C:\Windows\System\KRZSjVc.exe
  2⤵
  PID:6756
- C:\Windows\System\bBNeqFJ.exe
  C:\Windows\System\bBNeqFJ.exe
  2⤵
  PID:6780
- C:\Windows\System\fHcKPVe.exe
  C:\Windows\System\fHcKPVe.exe
  2⤵
  PID:6808
- C:\Windows\System\aDiBCxe.exe
  C:\Windows\System\aDiBCxe.exe
  2⤵
  PID:6848
- C:\Windows\System\KpPHDNA.exe
  C:\Windows\System\KpPHDNA.exe
  2⤵
  PID:6932
- C:\Windows\System\qxISPDp.exe
  C:\Windows\System\qxISPDp.exe
  2⤵
  PID:6956
- C:\Windows\System\WgoXkPX.exe
  C:\Windows\System\WgoXkPX.exe
  2⤵
  PID:6976
- C:\Windows\System\oZFRFfv.exe
  C:\Windows\System\oZFRFfv.exe
  2⤵
  PID:7040
- C:\Windows\System\lAUblbM.exe
  C:\Windows\System\lAUblbM.exe
  2⤵
  PID:7080
- C:\Windows\System\IOGFTeL.exe
  C:\Windows\System\IOGFTeL.exe
  2⤵
  PID:7104
- C:\Windows\System\sOeISUr.exe
  C:\Windows\System\sOeISUr.exe
  2⤵
  PID:7160
- C:\Windows\System\qeFcHZJ.exe
  C:\Windows\System\qeFcHZJ.exe
  2⤵
  PID:5440
- C:\Windows\System\SwlcQpH.exe
  C:\Windows\System\SwlcQpH.exe
  2⤵
  PID:6216
- C:\Windows\System\pqpVMsT.exe
  C:\Windows\System\pqpVMsT.exe
  2⤵
  PID:6244
- C:\Windows\System\hEDkqFU.exe
  C:\Windows\System\hEDkqFU.exe
  2⤵
  PID:6288
- C:\Windows\System\SzApmji.exe
  C:\Windows\System\SzApmji.exe
  2⤵
  PID:6364
- C:\Windows\System\RmIzpjz.exe
  C:\Windows\System\RmIzpjz.exe
  2⤵
  PID:6472
- C:\Windows\System\UGoJXWY.exe
  C:\Windows\System\UGoJXWY.exe
  2⤵
  PID:6556
- C:\Windows\System\cRHziRR.exe
  C:\Windows\System\cRHziRR.exe
  2⤵
  PID:6604
- C:\Windows\System\caprHhE.exe
  C:\Windows\System\caprHhE.exe
  2⤵
  PID:6684
- C:\Windows\System\xCkePKW.exe
  C:\Windows\System\xCkePKW.exe
  2⤵
  PID:6720
- C:\Windows\System\gmlojPa.exe
  C:\Windows\System\gmlojPa.exe
  2⤵
  PID:6752
- C:\Windows\System\xLejgtD.exe
  C:\Windows\System\xLejgtD.exe
  2⤵
  PID:6788
- C:\Windows\System\MgbFuEj.exe
  C:\Windows\System\MgbFuEj.exe
  2⤵
  PID:6792
- C:\Windows\System\ONgLRwa.exe
  C:\Windows\System\ONgLRwa.exe
  2⤵
  PID:6968
- C:\Windows\System\OFIIuVs.exe
  C:\Windows\System\OFIIuVs.exe
  2⤵
  PID:7028
- C:\Windows\System\KLSrfkL.exe
  C:\Windows\System\KLSrfkL.exe
  2⤵
  PID:7088
- C:\Windows\System\TkdtzhV.exe
  C:\Windows\System\TkdtzhV.exe
  2⤵
  PID:5196
- C:\Windows\System\UqEzIIU.exe
  C:\Windows\System\UqEzIIU.exe
  2⤵
  PID:6152
- C:\Windows\System\yikKDZR.exe
  C:\Windows\System\yikKDZR.exe
  2⤵
  PID:6252
- C:\Windows\System\nnSWQeQ.exe
  C:\Windows\System\nnSWQeQ.exe
  2⤵
  PID:6376
- C:\Windows\System\GcwguHF.exe
  C:\Windows\System\GcwguHF.exe
  2⤵
  PID:6504
- C:\Windows\System\liInlhh.exe
  C:\Windows\System\liInlhh.exe
  2⤵
  PID:6600
- C:\Windows\System\jLmAtkB.exe
  C:\Windows\System\jLmAtkB.exe
  2⤵
  PID:6772
- C:\Windows\System\FpqxSbv.exe
  C:\Windows\System\FpqxSbv.exe
  2⤵
  PID:6876
- C:\Windows\System\MpCdyAr.exe
  C:\Windows\System\MpCdyAr.exe
  2⤵
  PID:6972
- C:\Windows\System\bYPFIhm.exe
  C:\Windows\System\bYPFIhm.exe
  2⤵
  PID:5524
- C:\Windows\System\bMjUdvQ.exe
  C:\Windows\System\bMjUdvQ.exe
  2⤵
  PID:6500
- C:\Windows\System\aywJfHV.exe
  C:\Windows\System\aywJfHV.exe
  2⤵
  PID:6704
- C:\Windows\System\SjKvIAf.exe
  C:\Windows\System\SjKvIAf.exe
  2⤵
  PID:6748
- C:\Windows\System\MMUJizK.exe
  C:\Windows\System\MMUJizK.exe
  2⤵
  PID:6904
- C:\Windows\System\vnkUFDS.exe
  C:\Windows\System\vnkUFDS.exe
  2⤵
  PID:6160
- C:\Windows\System\FfzKBbI.exe
  C:\Windows\System\FfzKBbI.exe
  2⤵
  PID:6392
- C:\Windows\System\lahFyTV.exe
  C:\Windows\System\lahFyTV.exe
  2⤵
  PID:6344
- C:\Windows\System\ggCDKAE.exe
  C:\Windows\System\ggCDKAE.exe
  2⤵
  PID:7008
- C:\Windows\System\KMGaBZw.exe
  C:\Windows\System\KMGaBZw.exe
  2⤵
  PID:6548
- C:\Windows\System\GZIBUIH.exe
  C:\Windows\System\GZIBUIH.exe
  2⤵
  PID:6908
- C:\Windows\System\FSmAjUJ.exe
  C:\Windows\System\FSmAjUJ.exe
  2⤵
  PID:7140
- C:\Windows\System\wVETVVw.exe
  C:\Windows\System\wVETVVw.exe
  2⤵
  PID:7116
- C:\Windows\System\pesbFMT.exe
  C:\Windows\System\pesbFMT.exe
  2⤵
  PID:7172
- C:\Windows\System\YBNTYat.exe
  C:\Windows\System\YBNTYat.exe
  2⤵
  PID:7200
- C:\Windows\System\qJGwEsB.exe
  C:\Windows\System\qJGwEsB.exe
  2⤵
  PID:7256
- C:\Windows\System\hjSYsgl.exe
  C:\Windows\System\hjSYsgl.exe
  2⤵
  PID:7288
- C:\Windows\System\OWKukvw.exe
  C:\Windows\System\OWKukvw.exe
  2⤵
  PID:7320
- C:\Windows\System\TrgGefu.exe
  C:\Windows\System\TrgGefu.exe
  2⤵
  PID:7348
- C:\Windows\System\MWFtxZr.exe
  C:\Windows\System\MWFtxZr.exe
  2⤵
  PID:7376
- C:\Windows\System\wYskaqj.exe
  C:\Windows\System\wYskaqj.exe
  2⤵
  PID:7404
- C:\Windows\System\JaIDyKR.exe
  C:\Windows\System\JaIDyKR.exe
  2⤵
  PID:7440
- C:\Windows\System\OKwQWRd.exe
  C:\Windows\System\OKwQWRd.exe
  2⤵
  PID:7468
- C:\Windows\System\PePExlS.exe
  C:\Windows\System\PePExlS.exe
  2⤵
  PID:7512
- C:\Windows\System\uKLknom.exe
  C:\Windows\System\uKLknom.exe
  2⤵
  PID:7532
- C:\Windows\System\LzDGVWD.exe
  C:\Windows\System\LzDGVWD.exe
  2⤵
  PID:7572
- C:\Windows\System\BLWqQYI.exe
  C:\Windows\System\BLWqQYI.exe
  2⤵
  PID:7608
- C:\Windows\System\rIeGypL.exe
  C:\Windows\System\rIeGypL.exe
  2⤵
  PID:7632
- C:\Windows\System\ekeyonI.exe
  C:\Windows\System\ekeyonI.exe
  2⤵
  PID:7664
- C:\Windows\System\bHXDEOF.exe
  C:\Windows\System\bHXDEOF.exe
  2⤵
  PID:7688
- C:\Windows\System\FbLrvCl.exe
  C:\Windows\System\FbLrvCl.exe
  2⤵
  PID:7708
- C:\Windows\System\KuXrwYS.exe
  C:\Windows\System\KuXrwYS.exe
  2⤵
  PID:7740
- C:\Windows\System\TYUnGuy.exe
  C:\Windows\System\TYUnGuy.exe
  2⤵
  PID:7760
- C:\Windows\System\NawvbJI.exe
  C:\Windows\System\NawvbJI.exe
  2⤵
  PID:7784
- C:\Windows\System\RrPZHCI.exe
  C:\Windows\System\RrPZHCI.exe
  2⤵
  PID:7812
- C:\Windows\System\kkfbede.exe
  C:\Windows\System\kkfbede.exe
  2⤵
  PID:7832
- C:\Windows\System\iOEBYRy.exe
  C:\Windows\System\iOEBYRy.exe
  2⤵
  PID:7860
- C:\Windows\System\jInNYkp.exe
  C:\Windows\System\jInNYkp.exe
  2⤵
  PID:7912
- C:\Windows\System\LCaXkyG.exe
  C:\Windows\System\LCaXkyG.exe
  2⤵
  PID:7932
- C:\Windows\System\KJIUmxn.exe
  C:\Windows\System\KJIUmxn.exe
  2⤵
  PID:7968
- C:\Windows\System\HaxbjxQ.exe
  C:\Windows\System\HaxbjxQ.exe
  2⤵
  PID:8004
- C:\Windows\System\ecalUne.exe
  C:\Windows\System\ecalUne.exe
  2⤵
  PID:8036
- C:\Windows\System\FnUDSkr.exe
  C:\Windows\System\FnUDSkr.exe
  2⤵
  PID:8076
- C:\Windows\System\zDPvxuO.exe
  C:\Windows\System\zDPvxuO.exe
  2⤵
  PID:8104
- C:\Windows\System\csIaXUc.exe
  C:\Windows\System\csIaXUc.exe
  2⤵
  PID:8136
- C:\Windows\System\ZHPQZrM.exe
  C:\Windows\System\ZHPQZrM.exe
  2⤵
  PID:8180
- C:\Windows\System\MjnwFtw.exe
  C:\Windows\System\MjnwFtw.exe
  2⤵
  PID:7264
- C:\Windows\System\nHxbSMP.exe
  C:\Windows\System\nHxbSMP.exe
  2⤵
  PID:7316
- C:\Windows\System\nzCgdGs.exe
  C:\Windows\System\nzCgdGs.exe
  2⤵
  PID:7396
- C:\Windows\System\tCwnYYQ.exe
  C:\Windows\System\tCwnYYQ.exe
  2⤵
  PID:7520
- C:\Windows\System\LcLSTfB.exe
  C:\Windows\System\LcLSTfB.exe
  2⤵
  PID:7552
- C:\Windows\System\LgqQRbQ.exe
  C:\Windows\System\LgqQRbQ.exe
  2⤵
  PID:7584
- C:\Windows\System\jclkSSH.exe
  C:\Windows\System\jclkSSH.exe
  2⤵
  PID:7624
- C:\Windows\System\DcQgcUD.exe
  C:\Windows\System\DcQgcUD.exe
  2⤵
  PID:7672
- C:\Windows\System\RijHUFq.exe
  C:\Windows\System\RijHUFq.exe
  2⤵
  PID:7736
- C:\Windows\System\ApvKjgg.exe
  C:\Windows\System\ApvKjgg.exe
  2⤵
  PID:7768
- C:\Windows\System\ejBxQot.exe
  C:\Windows\System\ejBxQot.exe
  2⤵
  PID:7956
- C:\Windows\System\cwQBBMC.exe
  C:\Windows\System\cwQBBMC.exe
  2⤵
  PID:8052
- C:\Windows\System\gbpVTDm.exe
  C:\Windows\System\gbpVTDm.exe
  2⤵
  PID:8156
- C:\Windows\System\RkGmKvB.exe
  C:\Windows\System\RkGmKvB.exe
  2⤵
  PID:8176
- C:\Windows\System\FYWBbzD.exe
  C:\Windows\System\FYWBbzD.exe
  2⤵
  PID:7232
- C:\Windows\System\QmNUhTQ.exe
  C:\Windows\System\QmNUhTQ.exe
  2⤵
  PID:7368
- C:\Windows\System\gpeCAJR.exe
  C:\Windows\System\gpeCAJR.exe
  2⤵
  PID:7364
- C:\Windows\System\ISsdtRR.exe
  C:\Windows\System\ISsdtRR.exe
  2⤵
  PID:7500
- C:\Windows\System\XBcnXFw.exe
  C:\Windows\System\XBcnXFw.exe
  2⤵
  PID:7656
- C:\Windows\System\KJgXGBR.exe
  C:\Windows\System\KJgXGBR.exe
  2⤵
  PID:7884
- C:\Windows\System\AjBkoNx.exe
  C:\Windows\System\AjBkoNx.exe
  2⤵
  PID:7848
- C:\Windows\System\WXicQcY.exe
  C:\Windows\System\WXicQcY.exe
  2⤵
  PID:8000
- C:\Windows\System\HwPPgAQ.exe
  C:\Windows\System\HwPPgAQ.exe
  2⤵
  PID:7196
- C:\Windows\System\AlrajVA.exe
  C:\Windows\System\AlrajVA.exe
  2⤵
  PID:7252
- C:\Windows\System\zWaGOkI.exe
  C:\Windows\System\zWaGOkI.exe
  2⤵
  PID:7588
- C:\Windows\System\unPJsWz.exe
  C:\Windows\System\unPJsWz.exe
  2⤵
  PID:7568
- C:\Windows\System\qOUhjWX.exe
  C:\Windows\System\qOUhjWX.exe
  2⤵
  PID:7684
- C:\Windows\System\lwFWwby.exe
  C:\Windows\System\lwFWwby.exe
  2⤵
  PID:7948
- C:\Windows\System\yLuypgI.exe
  C:\Windows\System\yLuypgI.exe
  2⤵
  PID:8200
- C:\Windows\System\QRpbueR.exe
  C:\Windows\System\QRpbueR.exe
  2⤵
  PID:8224
- C:\Windows\System\XyccfLn.exe
  C:\Windows\System\XyccfLn.exe
  2⤵
  PID:8252
- C:\Windows\System\bRpFdfe.exe
  C:\Windows\System\bRpFdfe.exe
  2⤵
  PID:8272
- C:\Windows\System\BcbCZsn.exe
  C:\Windows\System\BcbCZsn.exe
  2⤵
  PID:8312
- C:\Windows\System\VSnzJvR.exe
  C:\Windows\System\VSnzJvR.exe
  2⤵
  PID:8336
- C:\Windows\System\KzvHeEf.exe
  C:\Windows\System\KzvHeEf.exe
  2⤵
  PID:8368
- C:\Windows\System\kaKbfpa.exe
  C:\Windows\System\kaKbfpa.exe
  2⤵
  PID:8396
- C:\Windows\System\PGnKEAc.exe
  C:\Windows\System\PGnKEAc.exe
  2⤵
  PID:8420
- C:\Windows\System\IztvXCH.exe
  C:\Windows\System\IztvXCH.exe
  2⤵
  PID:8444
- C:\Windows\System\nVHliQc.exe
  C:\Windows\System\nVHliQc.exe
  2⤵
  PID:8496
- C:\Windows\System\xQvJAcA.exe
  C:\Windows\System\xQvJAcA.exe
  2⤵
  PID:8524
- C:\Windows\System\lLtyfas.exe
  C:\Windows\System\lLtyfas.exe
  2⤵
  PID:8552
- C:\Windows\System\LhPRQjt.exe
  C:\Windows\System\LhPRQjt.exe
  2⤵
  PID:8580
- C:\Windows\System\JwSZtqt.exe
  C:\Windows\System\JwSZtqt.exe
  2⤵
  PID:8600
- C:\Windows\System\uXXleEV.exe
  C:\Windows\System\uXXleEV.exe
  2⤵
  PID:8620
- C:\Windows\System\iiVrVOg.exe
  C:\Windows\System\iiVrVOg.exe
  2⤵
  PID:8652
- C:\Windows\System\ZIgmXMs.exe
  C:\Windows\System\ZIgmXMs.exe
  2⤵
  PID:8676
- C:\Windows\System\uKYKayv.exe
  C:\Windows\System\uKYKayv.exe
  2⤵
  PID:8704
- C:\Windows\System\hvfydmH.exe
  C:\Windows\System\hvfydmH.exe
  2⤵
  PID:8748
- C:\Windows\System\GHZsGCx.exe
  C:\Windows\System\GHZsGCx.exe
  2⤵
  PID:8768
- C:\Windows\System\GbNGECm.exe
  C:\Windows\System\GbNGECm.exe
  2⤵
  PID:8788
- C:\Windows\System\LErCCqx.exe
  C:\Windows\System\LErCCqx.exe
  2⤵
  PID:8816
- C:\Windows\System\QPupBse.exe
  C:\Windows\System\QPupBse.exe
  2⤵
  PID:8840
- C:\Windows\System\VuXIHgZ.exe
  C:\Windows\System\VuXIHgZ.exe
  2⤵
  PID:8860
- C:\Windows\System\NcBvoie.exe
  C:\Windows\System\NcBvoie.exe
  2⤵
  PID:8888
- C:\Windows\System\cVBQlBA.exe
  C:\Windows\System\cVBQlBA.exe
  2⤵
  PID:8916
- C:\Windows\System\nkONVVI.exe
  C:\Windows\System\nkONVVI.exe
  2⤵
  PID:8976
- C:\Windows\System\dEFcFTu.exe
  C:\Windows\System\dEFcFTu.exe
  2⤵
  PID:9000
- C:\Windows\System\iogZbrE.exe
  C:\Windows\System\iogZbrE.exe
  2⤵
  PID:9028
- C:\Windows\System\FZMlbtB.exe
  C:\Windows\System\FZMlbtB.exe
  2⤵
  PID:9056
- C:\Windows\System\LOnypXs.exe
  C:\Windows\System\LOnypXs.exe
  2⤵
  PID:9088
- C:\Windows\System\FhSHUVR.exe
  C:\Windows\System\FhSHUVR.exe
  2⤵
  PID:9108
- C:\Windows\System\VUiMRFO.exe
  C:\Windows\System\VUiMRFO.exe
  2⤵
  PID:9140
- C:\Windows\System\zddlfaJ.exe
  C:\Windows\System\zddlfaJ.exe
  2⤵
  PID:9160
- C:\Windows\System\gGtKSIG.exe
  C:\Windows\System\gGtKSIG.exe
  2⤵
  PID:9208
- C:\Windows\System\SUfbRhE.exe
  C:\Windows\System\SUfbRhE.exe
  2⤵
  PID:7432
- C:\Windows\System\uzvwMBE.exe
  C:\Windows\System\uzvwMBE.exe
  2⤵
  PID:8208
- C:\Windows\System\nqmlklK.exe
  C:\Windows\System\nqmlklK.exe
  2⤵
  PID:7728
- C:\Windows\System\bFFzMWs.exe
  C:\Windows\System\bFFzMWs.exe
  2⤵
  PID:8332
- C:\Windows\System\wMBmQXG.exe
  C:\Windows\System\wMBmQXG.exe
  2⤵
  PID:8408
- C:\Windows\System\cqHNFmC.exe
  C:\Windows\System\cqHNFmC.exe
  2⤵
  PID:8452
- C:\Windows\System\JebGNKo.exe
  C:\Windows\System\JebGNKo.exe
  2⤵
  PID:7480
- C:\Windows\System\qtmbCaQ.exe
  C:\Windows\System\qtmbCaQ.exe
  2⤵
  PID:8588
- C:\Windows\System\USPZclt.exe
  C:\Windows\System\USPZclt.exe
  2⤵
  PID:8660
- C:\Windows\System\SpRIhsG.exe
  C:\Windows\System\SpRIhsG.exe
  2⤵
  PID:8688
- C:\Windows\System\eSSZbIX.exe
  C:\Windows\System\eSSZbIX.exe
  2⤵
  PID:8764
- C:\Windows\System\ZiCteVb.exe
  C:\Windows\System\ZiCteVb.exe
  2⤵
  PID:8836
- C:\Windows\System\xapgIdE.exe
  C:\Windows\System\xapgIdE.exe
  2⤵
  PID:8880
- C:\Windows\System\qSYLPev.exe
  C:\Windows\System\qSYLPev.exe
  2⤵
  PID:8932
- C:\Windows\System\ViYcSbz.exe
  C:\Windows\System\ViYcSbz.exe
  2⤵
  PID:8992
- C:\Windows\System\jyXLcxc.exe
  C:\Windows\System\jyXLcxc.exe
  2⤵
  PID:9048
- C:\Windows\System\amGZNfP.exe
  C:\Windows\System\amGZNfP.exe
  2⤵
  PID:9120
- C:\Windows\System\ksPuWve.exe
  C:\Windows\System\ksPuWve.exe
  2⤵
  PID:8128
- C:\Windows\System\acffLhQ.exe
  C:\Windows\System\acffLhQ.exe
  2⤵
  PID:8288
- C:\Windows\System\ZyCHVVV.exe
  C:\Windows\System\ZyCHVVV.exe
  2⤵
  PID:8388
- C:\Windows\System\eMUDIGq.exe
  C:\Windows\System\eMUDIGq.exe
  2⤵
  PID:8460
- C:\Windows\System\RYNAbXq.exe
  C:\Windows\System\RYNAbXq.exe
  2⤵
  PID:8728
- C:\Windows\System\voHWwmV.exe
  C:\Windows\System\voHWwmV.exe
  2⤵
  PID:8868
- C:\Windows\System\YvWuwes.exe
  C:\Windows\System\YvWuwes.exe
  2⤵
  PID:9016
- C:\Windows\System\kixsEFV.exe
  C:\Windows\System\kixsEFV.exe
  2⤵
  PID:9204
- C:\Windows\System\AHqCsrE.exe
  C:\Windows\System\AHqCsrE.exe
  2⤵
  PID:8344
- C:\Windows\System\JakelPr.exe
  C:\Windows\System\JakelPr.exe
  2⤵
  PID:8616
- C:\Windows\System\goZbxuk.exe
  C:\Windows\System\goZbxuk.exe
  2⤵
  PID:8908
- C:\Windows\System\yBdwAVb.exe
  C:\Windows\System\yBdwAVb.exe
  2⤵
  PID:8960
- C:\Windows\System\aBvSGZt.exe
  C:\Windows\System\aBvSGZt.exe
  2⤵
  PID:8304
- C:\Windows\System\WjWJkax.exe
  C:\Windows\System\WjWJkax.exe
  2⤵
  PID:9240
- C:\Windows\System\MoxLZxe.exe
  C:\Windows\System\MoxLZxe.exe
  2⤵
  PID:9264
- C:\Windows\System\AFwBrWp.exe
  C:\Windows\System\AFwBrWp.exe
  2⤵
  PID:9304
- C:\Windows\System\cHheHts.exe
  C:\Windows\System\cHheHts.exe
  2⤵
  PID:9328
- C:\Windows\System\hAjxxTu.exe
  C:\Windows\System\hAjxxTu.exe
  2⤵
  PID:9348
- C:\Windows\System\qFXOLok.exe
  C:\Windows\System\qFXOLok.exe
  2⤵
  PID:9388
- C:\Windows\System\HwoKYDw.exe
  C:\Windows\System\HwoKYDw.exe
  2⤵
  PID:9404
- C:\Windows\System\SusQQzL.exe
  C:\Windows\System\SusQQzL.exe
  2⤵
  PID:9424
- C:\Windows\System\ntffATg.exe
  C:\Windows\System\ntffATg.exe
  2⤵
  PID:9460
- C:\Windows\System\znQFrCh.exe
  C:\Windows\System\znQFrCh.exe
  2⤵
  PID:9488
- C:\Windows\System\SKMeMmZ.exe
  C:\Windows\System\SKMeMmZ.exe
  2⤵
  PID:9524
- C:\Windows\System\qjFoxXO.exe
  C:\Windows\System\qjFoxXO.exe
  2⤵
  PID:9672
- C:\Windows\System\mjhMLLK.exe
  C:\Windows\System\mjhMLLK.exe
  2⤵
  PID:9692
- C:\Windows\System\ZHHdlgR.exe
  C:\Windows\System\ZHHdlgR.exe
  2⤵
  PID:9716
- C:\Windows\System\cNZpLBA.exe
  C:\Windows\System\cNZpLBA.exe
  2⤵
  PID:9764
- C:\Windows\System\dwhEYAa.exe
  C:\Windows\System\dwhEYAa.exe
  2⤵
  PID:9796
- C:\Windows\System\qojkDPw.exe
  C:\Windows\System\qojkDPw.exe
  2⤵
  PID:9812
- C:\Windows\System\loTYXHt.exe
  C:\Windows\System\loTYXHt.exe
  2⤵
  PID:9856
- C:\Windows\System\lSOzeyK.exe
  C:\Windows\System\lSOzeyK.exe
  2⤵
  PID:9884
- C:\Windows\System\atZRPwR.exe
  C:\Windows\System\atZRPwR.exe
  2⤵
  PID:9908
- C:\Windows\System\gemYJmO.exe
  C:\Windows\System\gemYJmO.exe
  2⤵
  PID:9932
- C:\Windows\System\zPEfFYM.exe
  C:\Windows\System\zPEfFYM.exe
  2⤵
  PID:9956
- C:\Windows\System\FJMrqXk.exe
  C:\Windows\System\FJMrqXk.exe
  2⤵
  PID:9992
- C:\Windows\System\pPijxfm.exe
  C:\Windows\System\pPijxfm.exe
  2⤵
  PID:10008
- C:\Windows\System\NHAvgWI.exe
  C:\Windows\System\NHAvgWI.exe
  2⤵
  PID:10028
- C:\Windows\System\SeQPrag.exe
  C:\Windows\System\SeQPrag.exe
  2⤵
  PID:10072
- C:\Windows\System\ZILTXUc.exe
  C:\Windows\System\ZILTXUc.exe
  2⤵
  PID:10096
- C:\Windows\System\pGSqyjh.exe
  C:\Windows\System\pGSqyjh.exe
  2⤵
  PID:10120
- C:\Windows\System\eKGJqgA.exe
  C:\Windows\System\eKGJqgA.exe
  2⤵
  PID:10148
- C:\Windows\System\FcaDBZJ.exe
  C:\Windows\System\FcaDBZJ.exe
  2⤵
  PID:10176
- C:\Windows\System\OWCbQMq.exe
  C:\Windows\System\OWCbQMq.exe
  2⤵
  PID:10208
- C:\Windows\System\mLUQdjj.exe
  C:\Windows\System\mLUQdjj.exe
  2⤵
  PID:10232
- C:\Windows\System\eqHYJXJ.exe
  C:\Windows\System\eqHYJXJ.exe
  2⤵
  PID:8572
- C:\Windows\System\urzfMQY.exe
  C:\Windows\System\urzfMQY.exe
  2⤵
  PID:9284
- C:\Windows\System\Lpekkpq.exe
  C:\Windows\System\Lpekkpq.exe
  2⤵
  PID:9368
- C:\Windows\System\dEaNPXx.exe
  C:\Windows\System\dEaNPXx.exe
  2⤵
  PID:9400
- C:\Windows\System\tumgWcu.exe
  C:\Windows\System\tumgWcu.exe
  2⤵
  PID:9476
- C:\Windows\System\dJaUiCL.exe
  C:\Windows\System\dJaUiCL.exe
  2⤵
  PID:9544
- C:\Windows\System\OJwqDkr.exe
  C:\Windows\System\OJwqDkr.exe
  2⤵
  PID:9564
- C:\Windows\System\zeXBYVG.exe
  C:\Windows\System\zeXBYVG.exe
  2⤵
  PID:9604
- C:\Windows\System\eAVQTML.exe
  C:\Windows\System\eAVQTML.exe
  2⤵
  PID:9508
- C:\Windows\System\AHzBFAt.exe
  C:\Windows\System\AHzBFAt.exe
  2⤵
  PID:9684
- C:\Windows\System\UUGqNZW.exe
  C:\Windows\System\UUGqNZW.exe
  2⤵
  PID:9748
- C:\Windows\System\cNNzMCr.exe
  C:\Windows\System\cNNzMCr.exe
  2⤵
  PID:9852
- C:\Windows\System\cSicfHm.exe
  C:\Windows\System\cSicfHm.exe
  2⤵
  PID:9904
- C:\Windows\System\GMJlcQH.exe
  C:\Windows\System\GMJlcQH.exe
  2⤵
  PID:9924
- C:\Windows\System\uMVtsRN.exe
  C:\Windows\System\uMVtsRN.exe
  2⤵
  PID:10016
- C:\Windows\System\WGdHIJS.exe
  C:\Windows\System\WGdHIJS.exe
  2⤵
  PID:10088
- C:\Windows\System\uUEAIdn.exe
  C:\Windows\System\uUEAIdn.exe
  2⤵
  PID:10168
- C:\Windows\System\kscgwPt.exe
  C:\Windows\System\kscgwPt.exe
  2⤵
  PID:10184
- C:\Windows\System\uOdgnBf.exe
  C:\Windows\System\uOdgnBf.exe
  2⤵
  PID:9224
- C:\Windows\System\YZLbOWL.exe
  C:\Windows\System\YZLbOWL.exe
  2⤵
  PID:9480
- C:\Windows\System\aZSeqNt.exe
  C:\Windows\System\aZSeqNt.exe
  2⤵
  PID:9560
- C:\Windows\System\wOxUaOA.exe
  C:\Windows\System\wOxUaOA.exe
  2⤵
  PID:9648
- C:\Windows\System\QIHahLp.exe
  C:\Windows\System\QIHahLp.exe
  2⤵
  PID:9744
- C:\Windows\System\KzPHDCG.exe
  C:\Windows\System\KzPHDCG.exe
  2⤵
  PID:9300
- C:\Windows\System\uQAyyWV.exe
  C:\Windows\System\uQAyyWV.exe
  2⤵
  PID:9472
- C:\Windows\System\ZQweljF.exe
  C:\Windows\System\ZQweljF.exe
  2⤵
  PID:9940
- C:\Windows\System\jQTViGL.exe
  C:\Windows\System\jQTViGL.exe
  2⤵
  PID:8756
- C:\Windows\System\ivBsiaL.exe
  C:\Windows\System\ivBsiaL.exe
  2⤵
  PID:10228
- C:\Windows\System\jgMSLox.exe
  C:\Windows\System\jgMSLox.exe
  2⤵
  PID:4792
- C:\Windows\System\EfjxPvR.exe
  C:\Windows\System\EfjxPvR.exe
  2⤵
  PID:9576
- C:\Windows\System\PCRGloi.exe
  C:\Windows\System\PCRGloi.exe
  2⤵
  PID:10128
- C:\Windows\System\qvlfCWb.exe
  C:\Windows\System\qvlfCWb.exe
  2⤵
  PID:10260
- C:\Windows\System\KYduMrr.exe
  C:\Windows\System\KYduMrr.exe
  2⤵
  PID:10292
- C:\Windows\System\nqMeYPw.exe
  C:\Windows\System\nqMeYPw.exe
  2⤵
  PID:10320
- C:\Windows\System\iwJmRvB.exe
  C:\Windows\System\iwJmRvB.exe
  2⤵
  PID:10348
- C:\Windows\System\vbUZcMj.exe
  C:\Windows\System\vbUZcMj.exe
  2⤵
  PID:10376
- C:\Windows\System\yDLuASS.exe
  C:\Windows\System\yDLuASS.exe
  2⤵
  PID:10404
- C:\Windows\System\xUSpSdd.exe
  C:\Windows\System\xUSpSdd.exe
  2⤵
  PID:10428
- C:\Windows\System\jiOTSzQ.exe
  C:\Windows\System\jiOTSzQ.exe
  2⤵
  PID:10448
- C:\Windows\System\XyKzaEp.exe
  C:\Windows\System\XyKzaEp.exe
  2⤵
  PID:10504
- C:\Windows\System\eVhZdzi.exe
  C:\Windows\System\eVhZdzi.exe
  2⤵
  PID:10524
- C:\Windows\System\nsRwRUI.exe
  C:\Windows\System\nsRwRUI.exe
  2⤵
  PID:10560
- C:\Windows\System\lXbkdyK.exe
  C:\Windows\System\lXbkdyK.exe
  2⤵
  PID:10580
- C:\Windows\System\esTLYLn.exe
  C:\Windows\System\esTLYLn.exe
  2⤵
  PID:10600
- C:\Windows\System\tIinQMn.exe
  C:\Windows\System\tIinQMn.exe
  2⤵
  PID:10628
- C:\Windows\System\wGpCaFB.exe
  C:\Windows\System\wGpCaFB.exe
  2⤵
  PID:10656
- C:\Windows\System\JoWwcNu.exe
  C:\Windows\System\JoWwcNu.exe
  2⤵
  PID:10680
- C:\Windows\System\ATmBcKd.exe
  C:\Windows\System\ATmBcKd.exe
  2⤵
  PID:10700
- C:\Windows\System\zVDShhG.exe
  C:\Windows\System\zVDShhG.exe
  2⤵
  PID:10728
- C:\Windows\System\nzmddjs.exe
  C:\Windows\System\nzmddjs.exe
  2⤵
  PID:10756
- C:\Windows\System\NSKUpVh.exe
  C:\Windows\System\NSKUpVh.exe
  2⤵
  PID:10776
- C:\Windows\System\yqBdnRQ.exe
  C:\Windows\System\yqBdnRQ.exe
  2⤵
  PID:10800
- C:\Windows\System\kJcMxyz.exe
  C:\Windows\System\kJcMxyz.exe
  2⤵
  PID:10852
- C:\Windows\System\KHwuYHd.exe
  C:\Windows\System\KHwuYHd.exe
  2⤵
  PID:10888
- C:\Windows\System\pnOPurX.exe
  C:\Windows\System\pnOPurX.exe
  2⤵
  PID:10904
- C:\Windows\System\XORBPvl.exe
  C:\Windows\System\XORBPvl.exe
  2⤵
  PID:10936
- C:\Windows\System\zwfKNtQ.exe
  C:\Windows\System\zwfKNtQ.exe
  2⤵
  PID:10964
- C:\Windows\System\SNaXQLu.exe
  C:\Windows\System\SNaXQLu.exe
  2⤵
  PID:11012
- C:\Windows\System\fxFNlAi.exe
  C:\Windows\System\fxFNlAi.exe
  2⤵
  PID:11028
- C:\Windows\System\tvYkAEM.exe
  C:\Windows\System\tvYkAEM.exe
  2⤵
  PID:11048
- C:\Windows\System\IMbEyzs.exe
  C:\Windows\System\IMbEyzs.exe
  2⤵
  PID:11072
- C:\Windows\System\OtGlrpe.exe
  C:\Windows\System\OtGlrpe.exe
  2⤵
  PID:11160
- C:\Windows\System\CsiLCcj.exe
  C:\Windows\System\CsiLCcj.exe
  2⤵
  PID:11176
- C:\Windows\System\dUVDJYO.exe
  C:\Windows\System\dUVDJYO.exe
  2⤵
  PID:11212
- C:\Windows\System\ZKjoJYI.exe
  C:\Windows\System\ZKjoJYI.exe
  2⤵
  PID:9976
- C:\Windows\System\ilYqCkc.exe
  C:\Windows\System\ilYqCkc.exe
  2⤵
  PID:10284
- C:\Windows\System\dZYFwoE.exe
  C:\Windows\System\dZYFwoE.exe
  2⤵
  PID:10336
- C:\Windows\System\QnCrdDF.exe
  C:\Windows\System\QnCrdDF.exe
  2⤵
  PID:10424
- C:\Windows\System\BQBylXL.exe
  C:\Windows\System\BQBylXL.exe
  2⤵
  PID:10468
- C:\Windows\System\sIpVesS.exe
  C:\Windows\System\sIpVesS.exe
  2⤵
  PID:10540
- C:\Windows\System\pBBLgze.exe
  C:\Windows\System\pBBLgze.exe
  2⤵
  PID:10592
- C:\Windows\System\RTfUYTG.exe
  C:\Windows\System\RTfUYTG.exe
  2⤵
  PID:10624
- C:\Windows\System\UWRfDPS.exe
  C:\Windows\System\UWRfDPS.exe
  2⤵
  PID:10768
- C:\Windows\System\LujxbKI.exe
  C:\Windows\System\LujxbKI.exe
  2⤵
  PID:10792
- C:\Windows\System\efgmKgI.exe
  C:\Windows\System\efgmKgI.exe
  2⤵
  PID:10840
- C:\Windows\System\ipKiyWb.exe
  C:\Windows\System\ipKiyWb.exe
  2⤵
  PID:10896
- C:\Windows\System\YsxVzKi.exe
  C:\Windows\System\YsxVzKi.exe
  2⤵
  PID:10952
- C:\Windows\System\QdxiIEy.exe
  C:\Windows\System\QdxiIEy.exe
  2⤵
  PID:11004
- C:\Windows\System\sPTiOOC.exe
  C:\Windows\System\sPTiOOC.exe
  2⤵
  PID:11044
- C:\Windows\System\zXUVxAN.exe
  C:\Windows\System\zXUVxAN.exe
  2⤵
  PID:11080
- C:\Windows\System\ShtUHYJ.exe
  C:\Windows\System\ShtUHYJ.exe
  2⤵
  PID:11108
- C:\Windows\System\nMZYwBr.exe
  C:\Windows\System\nMZYwBr.exe
  2⤵
  PID:11192
- C:\Windows\System\cvrdBGw.exe
  C:\Windows\System\cvrdBGw.exe
  2⤵
  PID:11156
- C:\Windows\System\YuoRjET.exe
  C:\Windows\System\YuoRjET.exe
  2⤵
  PID:10384
- C:\Windows\System\JzDsidL.exe
  C:\Windows\System\JzDsidL.exe
  2⤵
  PID:10476
- C:\Windows\System\XmVBmlm.exe
  C:\Windows\System\XmVBmlm.exe
  2⤵
  PID:10576
- C:\Windows\System\acwvVrX.exe
  C:\Windows\System\acwvVrX.exe
  2⤵
  PID:10864
- C:\Windows\System\RsUkqUX.exe
  C:\Windows\System\RsUkqUX.exe
  2⤵
  PID:10992
- C:\Windows\System\eoiuacw.exe
  C:\Windows\System\eoiuacw.exe
  2⤵
  PID:11120
- C:\Windows\System\JCakDTL.exe
  C:\Windows\System\JCakDTL.exe
  2⤵
  PID:11088
- C:\Windows\System\AYAAEnq.exe
  C:\Windows\System\AYAAEnq.exe
  2⤵
  PID:11260
- C:\Windows\System\syzmnuu.exe
  C:\Windows\System\syzmnuu.exe
  2⤵
  PID:10928
- C:\Windows\System\WLzohtz.exe
  C:\Windows\System\WLzohtz.exe
  2⤵
  PID:10268
- C:\Windows\System\fiBnYmN.exe
  C:\Windows\System\fiBnYmN.exe
  2⤵
  PID:11068
- C:\Windows\System\vLiugdw.exe
  C:\Windows\System\vLiugdw.exe
  2⤵
  PID:10648
- C:\Windows\System\gnlzmYe.exe
  C:\Windows\System\gnlzmYe.exe
  2⤵
  PID:11284
- C:\Windows\System\xIhFJmj.exe
  C:\Windows\System\xIhFJmj.exe
  2⤵
  PID:11332
- C:\Windows\System\kdWVIBK.exe
  C:\Windows\System\kdWVIBK.exe
  2⤵
  PID:11352
- C:\Windows\System\FYJNaIr.exe
  C:\Windows\System\FYJNaIr.exe
  2⤵
  PID:11376
- C:\Windows\System\vWNxHIU.exe
  C:\Windows\System\vWNxHIU.exe
  2⤵
  PID:11412
- C:\Windows\System\ugptSAs.exe
  C:\Windows\System\ugptSAs.exe
  2⤵
  PID:11436
- C:\Windows\System\Pjtszrh.exe
  C:\Windows\System\Pjtszrh.exe
  2⤵
  PID:11476
- C:\Windows\System\DIZkyRj.exe
  C:\Windows\System\DIZkyRj.exe
  2⤵
  PID:11496
- C:\Windows\System\JkXNvMw.exe
  C:\Windows\System\JkXNvMw.exe
  2⤵
  PID:11548
- C:\Windows\System\aofdoJR.exe
  C:\Windows\System\aofdoJR.exe
  2⤵
  PID:11564
- C:\Windows\System\CGNOgKr.exe
  C:\Windows\System\CGNOgKr.exe
  2⤵
  PID:11588
- C:\Windows\System\DZBliRQ.exe
  C:\Windows\System\DZBliRQ.exe
  2⤵
  PID:11608
- C:\Windows\System\SmKikqq.exe
  C:\Windows\System\SmKikqq.exe
  2⤵
  PID:11628
- C:\Windows\System\OzjQmMy.exe
  C:\Windows\System\OzjQmMy.exe
  2⤵
  PID:11656
- C:\Windows\System\sJnfuwD.exe
  C:\Windows\System\sJnfuwD.exe
  2⤵
  PID:11700
- C:\Windows\System\qScDyYc.exe
  C:\Windows\System\qScDyYc.exe
  2⤵
  PID:11720
- C:\Windows\System\UHBMtZy.exe
  C:\Windows\System\UHBMtZy.exe
  2⤵
  PID:11748
- C:\Windows\System\viIUytO.exe
  C:\Windows\System\viIUytO.exe
  2⤵
  PID:11768
- C:\Windows\System\cjMoryZ.exe
  C:\Windows\System\cjMoryZ.exe
  2⤵
  PID:11792
- C:\Windows\System\EAWFBgE.exe
  C:\Windows\System\EAWFBgE.exe
  2⤵
  PID:11812
- C:\Windows\System\XarlpHp.exe
  C:\Windows\System\XarlpHp.exe
  2⤵
  PID:11836
- C:\Windows\System\KeufNFW.exe
  C:\Windows\System\KeufNFW.exe
  2⤵
  PID:11868
- C:\Windows\System\ubMqIno.exe
  C:\Windows\System\ubMqIno.exe
  2⤵
  PID:11892
- C:\Windows\System\esZgxOx.exe
  C:\Windows\System\esZgxOx.exe
  2⤵
  PID:11920
- C:\Windows\System\LcUlZvI.exe
  C:\Windows\System\LcUlZvI.exe
  2⤵
  PID:11940
- C:\Windows\System\BqwThqH.exe
  C:\Windows\System\BqwThqH.exe
  2⤵
  PID:11964
- C:\Windows\System\ROTjWzY.exe
  C:\Windows\System\ROTjWzY.exe
  2⤵
  PID:12020
- C:\Windows\System\GnBqTtG.exe
  C:\Windows\System\GnBqTtG.exe
  2⤵
  PID:12040
- C:\Windows\System\BBUnfDW.exe
  C:\Windows\System\BBUnfDW.exe
  2⤵
  PID:12092
- C:\Windows\System\ZErhapp.exe
  C:\Windows\System\ZErhapp.exe
  2⤵
  PID:12116
- C:\Windows\System\oqXTjmF.exe
  C:\Windows\System\oqXTjmF.exe
  2⤵
  PID:12136
- C:\Windows\System\jxUtele.exe
  C:\Windows\System\jxUtele.exe
  2⤵
  PID:12168
- C:\Windows\System\ivlYNKJ.exe
  C:\Windows\System\ivlYNKJ.exe
  2⤵
  PID:12196
- C:\Windows\System\BWXxTYO.exe
  C:\Windows\System\BWXxTYO.exe
  2⤵
  PID:12212
- C:\Windows\System\QdcAAvp.exe
  C:\Windows\System\QdcAAvp.exe
  2⤵
  PID:12240
- C:\Windows\System\RKqYIPk.exe
  C:\Windows\System\RKqYIPk.exe
  2⤵
  PID:12276
- C:\Windows\System\fjLhxEs.exe
  C:\Windows\System\fjLhxEs.exe
  2⤵
  PID:11092
- C:\Windows\System\sDTXsdt.exe
  C:\Windows\System\sDTXsdt.exe
  2⤵
  PID:11324
- C:\Windows\System\GOtHgLv.exe
  C:\Windows\System\GOtHgLv.exe
  2⤵
  PID:11452
- C:\Windows\System\DIihvYx.exe
  C:\Windows\System\DIihvYx.exe
  2⤵
  PID:11512
- C:\Windows\System\sSKRwpX.exe
  C:\Windows\System\sSKRwpX.exe
  2⤵
  PID:11580
- C:\Windows\System\GLqXhEb.exe
  C:\Windows\System\GLqXhEb.exe
  2⤵
  PID:11624
- C:\Windows\System\kwjQqjU.exe
  C:\Windows\System\kwjQqjU.exe
  2⤵
  PID:11716
- C:\Windows\System\rgpdPfr.exe
  C:\Windows\System\rgpdPfr.exe
  2⤵
  PID:11764
- C:\Windows\System\kAUamAO.exe
  C:\Windows\System\kAUamAO.exe
  2⤵
  PID:11832
- C:\Windows\System\CPzNHwT.exe
  C:\Windows\System\CPzNHwT.exe
  2⤵
  PID:11864
- C:\Windows\System\FWnULts.exe
  C:\Windows\System\FWnULts.exe
  2⤵
  PID:11932
- C:\Windows\System\dsSzSRp.exe
  C:\Windows\System\dsSzSRp.exe
  2⤵
  PID:11992
- C:\Windows\System\DWXCCai.exe
  C:\Windows\System\DWXCCai.exe
  2⤵
  PID:12036
- C:\Windows\System\DSPRplr.exe
  C:\Windows\System\DSPRplr.exe
  2⤵
  PID:12112
- C:\Windows\System\ldxOYPu.exe
  C:\Windows\System\ldxOYPu.exe
  2⤵
  PID:12192
- C:\Windows\System\sFsQvry.exe
  C:\Windows\System\sFsQvry.exe
  2⤵
  PID:10872
- C:\Windows\System\RKyoqzC.exe
  C:\Windows\System\RKyoqzC.exe
  2⤵
  PID:11368
- C:\Windows\System\SzQEaIn.exe
  C:\Windows\System\SzQEaIn.exe
  2⤵
  PID:11488
- C:\Windows\System\ilKrfir.exe
  C:\Windows\System\ilKrfir.exe
  2⤵
  PID:11708
- C:\Windows\System\kIyHzQM.exe
  C:\Windows\System\kIyHzQM.exe
  2⤵
  PID:11844
- C:\Windows\System\emtAmmo.exe
  C:\Windows\System\emtAmmo.exe
  2⤵
  PID:11960
- C:\Windows\System\uXVKhvf.exe
  C:\Windows\System\uXVKhvf.exe
  2⤵
  PID:12104
- C:\Windows\System\TmKwVfu.exe
  C:\Windows\System\TmKwVfu.exe
  2⤵
  PID:12228
- C:\Windows\System\DGcbuTr.exe
  C:\Windows\System\DGcbuTr.exe
  2⤵
  PID:11560
- C:\Windows\System\KSRxRcs.exe
  C:\Windows\System\KSRxRcs.exe
  2⤵
  PID:2232
- C:\Windows\System\wcBxXhb.exe
  C:\Windows\System\wcBxXhb.exe
  2⤵
  PID:12012
- C:\Windows\System\HZlygSI.exe
  C:\Windows\System\HZlygSI.exe
  2⤵
  PID:11424
- C:\Windows\System\McoxZsR.exe
  C:\Windows\System\McoxZsR.exe
  2⤵
  PID:11620
- C:\Windows\System\ogNWmtO.exe
  C:\Windows\System\ogNWmtO.exe
  2⤵
  PID:12312
- C:\Windows\System\BQCQwaj.exe
  C:\Windows\System\BQCQwaj.exe
  2⤵
  PID:12368
- C:\Windows\System\yWMqUyd.exe
  C:\Windows\System\yWMqUyd.exe
  2⤵
  PID:12388
- C:\Windows\System\TqjwAVp.exe
  C:\Windows\System\TqjwAVp.exe
  2⤵
  PID:12404
- C:\Windows\System\KCySAbp.exe
  C:\Windows\System\KCySAbp.exe
  2⤵
  PID:12428
- C:\Windows\System\DmbTRiG.exe
  C:\Windows\System\DmbTRiG.exe
  2⤵
  PID:12452
- C:\Windows\System\RhJkiAY.exe
  C:\Windows\System\RhJkiAY.exe
  2⤵
  PID:12480
- C:\Windows\System\kiNWUQS.exe
  C:\Windows\System\kiNWUQS.exe
  2⤵
  PID:12524
- C:\Windows\System\ucXxhsI.exe
  C:\Windows\System\ucXxhsI.exe
  2⤵
  PID:12540
- C:\Windows\System\SfflZBK.exe
  C:\Windows\System\SfflZBK.exe
  2⤵
  PID:12576
- C:\Windows\System\SfwSLrT.exe
  C:\Windows\System\SfwSLrT.exe
  2⤵
  PID:12600
- C:\Windows\System\aJORbgU.exe
  C:\Windows\System\aJORbgU.exe
  2⤵
  PID:12620
- C:\Windows\System\HLjWQKZ.exe
  C:\Windows\System\HLjWQKZ.exe
  2⤵
  PID:12644
- C:\Windows\System\pXqXBFO.exe
  C:\Windows\System\pXqXBFO.exe
  2⤵
  PID:12668
- C:\Windows\System\oLfRIAd.exe
  C:\Windows\System\oLfRIAd.exe
  2⤵
  PID:12688
- C:\Windows\System\EfMrLsZ.exe
  C:\Windows\System\EfMrLsZ.exe
  2⤵
  PID:12732
- C:\Windows\System\TkvSzXD.exe
  C:\Windows\System\TkvSzXD.exe
  2⤵
  PID:12760
- C:\Windows\System\wXLjFbF.exe
  C:\Windows\System\wXLjFbF.exe
  2⤵
  PID:12812
- C:\Windows\System\yNayByD.exe
  C:\Windows\System\yNayByD.exe
  2⤵
  PID:12836
- C:\Windows\System\ZLATFLh.exe
  C:\Windows\System\ZLATFLh.exe
  2⤵
  PID:12856
- C:\Windows\System\TqqqaPx.exe
  C:\Windows\System\TqqqaPx.exe
  2⤵
  PID:12884
- C:\Windows\System\mpulRMa.exe
  C:\Windows\System\mpulRMa.exe
  2⤵
  PID:12924
- C:\Windows\System\BWamTUz.exe
  C:\Windows\System\BWamTUz.exe
  2⤵
  PID:12960
- C:\Windows\System\mGyNitW.exe
  C:\Windows\System\mGyNitW.exe
  2⤵
  PID:12976
- C:\Windows\System\NLCgbvc.exe
  C:\Windows\System\NLCgbvc.exe
  2⤵
  PID:12996
- C:\Windows\System\ajGsaYt.exe
  C:\Windows\System\ajGsaYt.exe
  2⤵
  PID:13016
- C:\Windows\System\WxzlUnc.exe
  C:\Windows\System\WxzlUnc.exe
  2⤵
  PID:13040
- C:\Windows\System\pQBiJRX.exe
  C:\Windows\System\pQBiJRX.exe
  2⤵
  PID:13060
- C:\Windows\System\ilNKlAM.exe
  C:\Windows\System\ilNKlAM.exe
  2⤵
  PID:13080
- C:\Windows\System\cOLpjwA.exe
  C:\Windows\System\cOLpjwA.exe
  2⤵
  PID:13112
- C:\Windows\System\FWheFNU.exe
  C:\Windows\System\FWheFNU.exe
  2⤵
  PID:13128
- C:\Windows\System\LNDjhJd.exe
  C:\Windows\System\LNDjhJd.exe
  2⤵
  PID:13184
- C:\Windows\System\ZDEUBWC.exe
  C:\Windows\System\ZDEUBWC.exe
  2⤵
  PID:13216
- C:\Windows\System\JmxuAxb.exe
  C:\Windows\System\JmxuAxb.exe
  2⤵
  PID:13272
- C:\Windows\System\QvrYaSD.exe
  C:\Windows\System\QvrYaSD.exe
  2⤵
  PID:13304
- C:\Windows\System\EpiNsyV.exe
  C:\Windows\System\EpiNsyV.exe
  2⤵
  PID:11820
- C:\Windows\System\rqtoIsz.exe
  C:\Windows\System\rqtoIsz.exe
  2⤵
  PID:12376
- C:\Windows\System\EBQOfjk.exe
  C:\Windows\System\EBQOfjk.exe
  2⤵
  PID:12412
- C:\Windows\System\kQyFEcw.exe
  C:\Windows\System\kQyFEcw.exe
  2⤵
  PID:12476
- C:\Windows\System\dAtUlOy.exe
  C:\Windows\System\dAtUlOy.exe
  2⤵
  PID:12520
- C:\Windows\System\CfgNkPO.exe
  C:\Windows\System\CfgNkPO.exe
  2⤵
  PID:12512
- C:\Windows\System\EggvtLQ.exe
  C:\Windows\System\EggvtLQ.exe
  2⤵
  PID:1700
- C:\Windows\System\AfaxVot.exe
  C:\Windows\System\AfaxVot.exe
  2⤵
  PID:12592
- C:\Windows\System\NHeuJqf.exe
  C:\Windows\System\NHeuJqf.exe
  2⤵
  PID:12720
- C:\Windows\System\WPvOkvc.exe
  C:\Windows\System\WPvOkvc.exe
  2⤵
  PID:12772
- C:\Windows\System\PQIITOy.exe
  C:\Windows\System\PQIITOy.exe
  2⤵
  PID:12848
- C:\Windows\System\jeNiUly.exe
  C:\Windows\System\jeNiUly.exe
  2⤵
  PID:12952
- C:\Windows\System\bSiVjWD.exe
  C:\Windows\System\bSiVjWD.exe
  2⤵
  PID:12968
- C:\Windows\System\QuNVPwg.exe
  C:\Windows\System\QuNVPwg.exe
  2⤵
  PID:13052
- C:\Windows\System\bWinhnM.exe
  C:\Windows\System\bWinhnM.exe
  2⤵
  PID:13076
- C:\Windows\System\scnvYUb.exe
  C:\Windows\System\scnvYUb.exe
  2⤵
  PID:13120
- C:\Windows\System\KFgKNIZ.exe
  C:\Windows\System\KFgKNIZ.exe
  2⤵
  PID:13280
- C:\Windows\System\diKfkbc.exe
  C:\Windows\System\diKfkbc.exe
  2⤵
  PID:13296
- C:\Windows\System\xWJCevL.exe
  C:\Windows\System\xWJCevL.exe
  2⤵
  PID:1672
- C:\Windows\System\dyFLxUM.exe
  C:\Windows\System\dyFLxUM.exe
  2⤵
  PID:13036
- C:\Windows\System\FEoOgUe.exe
  C:\Windows\System\FEoOgUe.exe
  2⤵
  PID:13244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9O7X9C7J\home-993d2c38b2c1[1].css

Filesize
11KB

MD5
6328d6d9a6b00ce7f992230b97b17c1f

SHA1
88837b802bdde407e37e92641072ea2eeec95556

SHA256
c9d9b80794cebd7d97daf52f7f0ce0e31bcf7a6f65a6e07851c688d67f10dba8

SHA512
993d2c38b2c15499aebdb39c1f9c21d0501d4c2a5973caec65be9ddc3ddfd6e46d06449e7483daa4fa9afa17cb81ff27a391519a64629169eb15c52911aab2c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kikskldi.x4z.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\EebTsLI.exe

Filesize
2.3MB

MD5
2a88c2a07b3a57e588f4444898a2827a

SHA1
a9f32bf5cb4bd3485cc6eb18210380f5c59061dd

SHA256
684f6d551383690c1194f61aaba624840314ac9e87ff4c19e58f0f2fadb51662

SHA512
efa0f04296eaa190a63dd4cc1e2b8623464210e8b1876a452b703ffd494d00548ffcea1ce0f9b537c8f315291b28b40fd048567035a9ef559fc16bd6cee45356

Download Submit
C:\Windows\System\HXfpvym.exe

Filesize
2.3MB

MD5
5be29617909514aabf0f8e7064a30ba0

SHA1
a3e183f532f23d67e1c198bd8c48b98e66dc9f2e

SHA256
b772e40b4bbc945248d996c3bbb6e7c54cf5971cdcbfe0b3176968ae45ce9e35

SHA512
a69c75f52bf35e2fb9a8d90b960fee05f23e9a5f9fd420fa0342e6e51ef6e7388be2125f2e0a2c497404040bc189a00e5ea58ff4a822e9e898a2a72295fb908e

Download Submit
C:\Windows\System\HYGFGxU.exe

Filesize
2.3MB

MD5
abfe0d5dceba2f2e02922685cce3020e

SHA1
d1bdac37d9e91faf0b06a4b044e302a428230b1c

SHA256
963935d0ea7acd8a80196d886a40f0e1243becb8fb824732a6ce30b6d839da5a

SHA512
194161f1f7eefc74f8ca88961f423f409c444e242df8d85fefafa5d225357a33169909c451c55490790f4496b9a8072a3c7ea8fd2004efaea77078cbc7aa3fb8

Download Submit
C:\Windows\System\IIoGirT.exe

Filesize
2.3MB

MD5
fe3d663f783000fd902e07a5e44c71aa

SHA1
9ff599c884673cc22d1aafc44c70fd223e5f8559

SHA256
e282346bda9870aaabe244dd2b2079fccbd1fadae7b060ee02411036896869f6

SHA512
33eda7d52d0c79000c3a57d6c760c04bc758ec6e2369bfffdc7fc475517b4c726d0580f8f358a9b81e6cc0865403b7316c5fb197c0b60a1d881ade03d0ec1532

Download Submit
C:\Windows\System\JLGisPl.exe

Filesize
2.3MB

MD5
346be50f59a73f2940551f621d62c32f

SHA1
0ab90a4c84dfea33eab635902170c62356fb4dae

SHA256
5bb266c9658a4fadb05e83cda9691c217a2d558a829cc6e579519b619f97bdd3

SHA512
cd8a3d61550208ba5398b489cb5866c0de8adaf5145e4c8de07fbcb65f476c12bd042f001145391d0dacc362b24b066d7364ef80b989dd37ddc2b7fc93e010b1

Download Submit
C:\Windows\System\KwnLhUX.exe

Filesize
2.3MB

MD5
1a1780cd337f2ebb1d44a00d24ed448f

SHA1
bdcab2beff1bafc15dc6a40c02dbe98e55f389e1

SHA256
647576e6f30939d54a6afd7dfce47f66d99a5942c601295dedff7b035dee3f5e

SHA512
adf2f5e8fe80a7217a03336cc3a0de5525e517a82da7f3bb03c1f82dfedc74160cfd08116408d8ad531ac528c6e7da7479e9e0d982007264a6d034a65cce154f

Download Submit
C:\Windows\System\LFiRCsl.exe

Filesize
2.3MB

MD5
7db283dbf74c4f5c4de37dd23375522f

SHA1
4697c31c4f33af762b2e9bcdc997ed760a2f0229

SHA256
9ba9be346d7e88279e35132c45a8a105258f8690636d7a82eec551ba7a7b1fc4

SHA512
ac2c4eca134c2891f7542f63e2ecae558fd97090805328c67c121bdf420471f356dc49c3293c1bc01079f72afb53380f9eacc3b6a1e73ee854b20f7ba921436f

Download Submit
C:\Windows\System\LoHqVSn.exe

Filesize
2.3MB

MD5
d19c0aafc40dd7c6eea53a9475f19311

SHA1
6ac5f38c84156fcabcb8c6337bd48f1f18cc617d

SHA256
03c4780c188bf4aa446acfb3f63f73cd7aa4194e32a1f8f15d92fdefc26ac691

SHA512
c3538e623ce3d0179a1f29389688eeb410e06f86be41adc70f0f9452f3e3294310421eb3f439c41c3abca1cc0dad52f0c964f11166df02a249710bce9632e69b

Download Submit
C:\Windows\System\MlEsmRm.exe

Filesize
2.3MB

MD5
ac6f18b51fd8f682c66dea89a111274a

SHA1
a1a8f17b882bd68a544a2ffeb6f10d9cf22ff4ac

SHA256
9354ef4370b44f94f0556aa72b0ce74517807c20b34ed85e72f59a6045973b50

SHA512
0898d74af505afbae7ded7ecd40cfe10d29bd35789a0af2ec6e382084fa8080a4fbec65374734a6a408af7d6d7f19f538771afc55790de8849d8b4f92656c980

Download Submit
C:\Windows\System\OklJlcS.exe

Filesize
2.3MB

MD5
125c34ebc0f5fd977cbf4a41ff4e605a

SHA1
95c4852ef11ef50a73e38ac9579166f3bd497265

SHA256
e53f32a4ed95f7d3b8cdd9b5928597d33734811f364efa5e0c42ac8f0a672e04

SHA512
190d6b2786540074e74ca7149e3b636ad39e9f90f9bd3dd7bcaa20716f89722269ea5be837d4998153996f21b36e662e9f3b0f5573065e7e3c4684b88d708679

Download Submit
C:\Windows\System\PxzZGEt.exe

Filesize
2.3MB

MD5
a8133fae59eb9508a5345df7799a247f

SHA1
70a5c1ac5b9e9b7ada2476ad4ec2fba2eba80b58

SHA256
48d88feee2dd8f9b068e59d615c9c02827876accfc2e0d83712c76a220e5608f

SHA512
0d8781a948a096df887b4d74d9679360b20b8f4b55a1ae45d4a689a7ab80a3c524857396248666e1d2431f4e1306788a3f1334d3c00d7bb92e85504192b8aac3

Download Submit
C:\Windows\System\SBdXLlk.exe

Filesize
2.3MB

MD5
97037210fa6b0d7a2ba05f789c95d720

SHA1
9a3d0a20164763b0c159dfe708fd8cc57df405d5

SHA256
451e463e3bc2dca4bc8e549efec8620f4e994ac2ad26a22feb02483cdf18bddc

SHA512
e1b32a9d9c5c38a22eb0cd10fd835a1e19573af1bdf529bfda49ba28ba10533ffd69238a99733cbcb382631d4d86e3436be4a19288d030d034680202e1eedcc9

Download Submit
C:\Windows\System\WRevucW.exe

Filesize
2.3MB

MD5
b527601c3831c8d57945a4789f7ec000

SHA1
bb54d46d88e3c5f0890cd33fa43b787bc0fb47d9

SHA256
30e8b307b1f03b98a627e95412bbd7d857b30366248fca92061a88b78f40947f

SHA512
b0221cf194cf31c56858cb4076ec0d8a1500560937918ae61bc12171450b86cb8e875219fa97f743fcaf4060b25fd23a5fd14a54608163f838280b50a999ba36

Download Submit
C:\Windows\System\WoJnllP.exe

Filesize
2.3MB

MD5
36d6eab4e07df237889ee7c476c5c2a9

SHA1
611a6380b8a32d1d3b4a39705b569cbc3747ce83

SHA256
30ef4dc252e37b6d3a911dc9b3a87249cc8f5d2478ca7ebc12d7c3c9c901287a

SHA512
4006b8380e08cf09d6293a09e0772d69035a3e8ac92704aee2d8eb8f201fe0385c3d0bb9d88b14f00c22b9c38f17ec37c4d5ec9930105ccdddb26b10d279eeef

Download Submit
C:\Windows\System\XQURmWv.exe

Filesize
2.3MB

MD5
997a975de8d286edc7f18cd69424ccf6

SHA1
d30abc8377c94be1a371f4b523fb802d7d12d32a

SHA256
3020b34590151a72750e458f8ae50d6d5178820e9fb4a900ca5d4d3da592281e

SHA512
d8e4644d47246aa0fb233644e9f91756f842d045a64a90de03bf00eed27eadeb81fdab1970604c494b8708249bc8142e14b2588ada604077e32351844f5be31e

Download Submit
C:\Windows\System\cDOcDWW.exe

Filesize
2.3MB

MD5
4cacdb9081e3c74576f28d74b3db5e3d

SHA1
63afbd39cf93db537faa47bdcbeb658b785a7dd9

SHA256
62eec45484c19246ada9cbd1f8c72e45e9e6e21d8c06f9c596a83046c86e70f4

SHA512
2fc687232371b46144b6e3002de44a755349a103ec1ae5767765b0f107685853078dbf680fafb559f58d1ecab265c9cf5caaba4718c5a4f29e7aad59ff89e933

Download Submit
C:\Windows\System\dRgAexC.exe

Filesize
2.3MB

MD5
19124e28783f2e7c03c37ec28fd31d78

SHA1
c39bcb431c25c83f9d6839104e446b1db961e446

SHA256
879216136b636ee29754b62a3c3345ddd85dc783e502e18fd5802f9c28713317

SHA512
4505e9d514519b1613b6b3042ab08b2eefb0d53a0f109ada1acd66996afef677b2afd6e6f1e425309389e8bfc30ecfd94c5c3020a937505614b9fe3d0a7256d7

Download Submit
C:\Windows\System\eRFZXSH.exe

Filesize
2.3MB

MD5
705b8ec4493be0c2b51af891ba92a091

SHA1
67397cdc959fb6f313dac4938b14d8bb462bdf1b

SHA256
fbd7fc29e185ffe78d689ec84da416b2bf127495cb5a8924108fb5abd3b19c19

SHA512
91f60f94e26fea4ee22a8859cbecdcaea909d2bf297940f35e76552e8695f770056d88cca56f9905bed82d2e6f5ecc5f0125a11ed28debc477acd0bad317f60b

Download Submit
C:\Windows\System\hVKSABw.exe

Filesize
2.3MB

MD5
89982e5addbc1dbd88ec7c3ee13f8fbb

SHA1
017aa9ef22bc888a1ad95036680197c7736b6ca6

SHA256
f2cd29c8c9d55c9c8984edb4bf0610ad9a8711a596e3cdf725442505e78b9614

SHA512
631b89b600a58ebede15d3269877868a6d2dd6fab21ab15293b59884e60dee7c538c9c572be0847029266c40e38a61bea25cf167e36ae8241661a4e15c8b98fc

Download Submit
C:\Windows\System\jjCYRSu.exe

Filesize
2.3MB

MD5
34c95f256d1362ccdf2ea8c26443d8fe

SHA1
2e0515ee98615da857131b7025b508282d9f22f3

SHA256
3a3270b31552a32849a9df4decab43341cedf35f37968dde2ae1e2a626241182

SHA512
4422022346a904e7fbd0f5b8ff09b3963d82479add0bfbc7c8c695987a9c6d07331fcee22ae2c5c43433b97f462499c5e2312376851e0228593f15d77a4284ac

Download Submit
C:\Windows\System\mqQGPJl.exe

Filesize
2.3MB

MD5
79aa3fc1a6e679c0848d216e54a24b66

SHA1
6a2cdd5b8d765136fd01aadd3e3db15fc6522ec8

SHA256
b9c1a3c415a2f9541a855f077d703e1d15aee5609a86d969b9b5e1885dfb16eb

SHA512
d55a71eda70d5a284b20eb88337cbf50cd411f67a8bed1fd4361048ca4fe8160353a8795d77c5a7b287497a1a6143a77611fbec83dd883efed432ee6490ffbdb

Download Submit
C:\Windows\System\msvAabI.exe

Filesize
2.3MB

MD5
06ae4c23a49a457597e052c6f2b54293

SHA1
40dbb23e49bae23558f375f0e938d7cad5b40957

SHA256
c1d08ac53023a47c6f549fb9bc92a90801d5e144819eaa0a35b269efb5d0648e

SHA512
2fc5d9769a376dfe77e5e53d9e9c7115e780c712c3af547e038f91b9cbccf3757a0b0d3a63ecda70e196d1b64fe4c79ca97fca458f179861214e1c283e772401

Download Submit
C:\Windows\System\nRWiWPw.exe

Filesize
2.3MB

MD5
2ec8c04f635333e8f5a489af19db9d63

SHA1
af34e04b2834dcc5a12bb5751d87b957a397b63e

SHA256
341fcbbe5b1650a5930c919da6d04f62d26ff3793a5ed25764565696d53953bb

SHA512
86d5c09ef405d17aaaf487bd0732e35da8281d2241f0825f2d400e2df2ab66f144e7f4906fba3ce601bd615019ff421043710cf00ec9150d13fcdf9a4b158283

Download Submit
C:\Windows\System\nZKTpUE.exe

Filesize
2.3MB

MD5
862ddcae88c1e89514746459e9e9394f

SHA1
62b74ed4e1be54149479424965ded782a3fae216

SHA256
866dc2caf0935dab4663b005017a5ddb9b21410b357f6e15581f46c355228dfd

SHA512
1528c7c33f115e4393140612b976be83ae8699c6c202308ef484bb8fb0df8ff2c4c9c2d174b8c03f199b3968c6a0abe0fb57eaea91bb424353cff6816676dcb4

Download Submit
C:\Windows\System\oTclxRu.exe

Filesize
2.3MB

MD5
7ae9be211103c0ef96d54a1563193d73

SHA1
7c0d165fd12a83eaffc59830f6f83384dae08b67

SHA256
f05af5bc0f6f94606e20ddb15c17756f81a7310a942f6b7d4fc6ef6b0c545a62

SHA512
2fba5001d8f78a5c2a2659636a8663cc1daa31b3f79f42824f145e77a5473bc9743029f8cd66fdffa76ecbcdd1c79ae207745f934deed1a1cc39c0ea2d247c47

Download Submit
C:\Windows\System\pORomAx.exe

Filesize
2.3MB

MD5
580abc85abc323a8898c81391bbaae6d

SHA1
1aed875a7effcf0ecc73b457b74122805b40aaae

SHA256
29d72426d061e61e7870c7655b46006f26652f9e646e5f2c49fa1b713466d77e

SHA512
4a25d7be33cc97b3fbaea52f27258e8d297ca1ec56fc09363ec2e8db570ef740a56602094f246f2e852a57771273ca0c5e1bec5521cd79025a2436dd7b98eded

Download Submit
C:\Windows\System\qJwJdOv.exe

Filesize
2.3MB

MD5
45e65a80711bebc75682c1e65fe6b184

SHA1
a8d508ab9f25557a2414d3fedb0afefc9fc81885

SHA256
c427670fb7fb8e2069f162feb603e3503530c794426e87a560b50d049f69fc07

SHA512
ddff524bf20f9b32079d63366e0116561a427ddeba487189d4cced598f4a100fcc991d5880d11b3e1fcfae371a496ff446279fac2608f6f0c64df4c0ac80026c

Download Submit
C:\Windows\System\qNkNeuv.exe

Filesize
2.3MB

MD5
717a0a593687fef100ffeea3b519b3df

SHA1
1b59aeb740d137f9f1e62a9d27e1ee13edddfc6d

SHA256
57b59f5c2a74e33308c7241cc9c6e1850f340cb2fe1dd17a0fe4c5767166ac5b

SHA512
18f5822122a0d2a8607a529ccb6d9ebeb117744bfe59871123baf029dbd2d66431bd9c47376b5bde8f430672b68bb35bbeb0b0bb6d19800883103eb323672b13

Download Submit
C:\Windows\System\rLXXdSp.exe

Filesize
2.3MB

MD5
70af6c71ea93b2e6630bfce910eae196

SHA1
ac12fd827a7c096ebd86bf74fc9851d901b4c0d6

SHA256
a97e183d7f3cdf1425865e3259eb4277d7846f5b9e5fa7a88b98c6933cef109e

SHA512
7b95d407c5ce998dbb8ccbc309be4c694ca296ac4e8aee16aa447ba6808f0dd53943e775cffe7e3f8ccef42cb4e55a690728ae6e80315cac293d8ac6638a0359

Download Submit
C:\Windows\System\rrsNGec.exe

Filesize
2.3MB

MD5
06ca8d853509658fc23ca4e229c3ee52

SHA1
815c39537108d8d9c98bbb562f8f6205d30065a8

SHA256
04d739fbf70cef9049eafaef30312853bbf5d342a0c8b129ea037c82890e4496

SHA512
32c1f5d2d63943a2c0c27cddd4da04f999269dcf07e169cf8318d8a82d57b07d2a0185114020fe5d72a18a3ccec4fb7483d2eb72893d1b0d935ff5578271e20f

Download Submit
C:\Windows\System\vhfctnu.exe

Filesize
8B

MD5
ce98e4fb0d1b3e55b413072afff0d9b0

SHA1
ea92124ca4b7f582ca9bded1d03be27e59b4ea59

SHA256
ff9bed5abd6e63c0617526102c0f954cef8653d22647e6d0cc15dd6455af1a78

SHA512
b03d5e8e2563e87b69e649ee452bd2c1714db6cee8c57a2d9c80350a9bfea4a14df4deeed12085a7535561f33b8025c13820b94443ecdbd732b098776b2234a9

Download Submit
C:\Windows\System\wAHDRuX.exe

Filesize
2.3MB

MD5
31419e46c4589183efea16e4682d1f17

SHA1
9921566947e141d9740d3414c28fce6ec7e2c814

SHA256
e6f4c0980d4230b6cd26211b4f88aa0830bd71cda00880f5f3820900ee8c521a

SHA512
1f476950a127d42888a0070596607c47604ab23ab2fffb87aa62a97bbe5d6fcea72d87eaa1f73e454c98e8ae0f31e704d3b157d9d55503623114b68d5b3ac86e

Download Submit
C:\Windows\System\xNoiXIW.exe

Filesize
2.3MB

MD5
a4a720515d3b996f3dab7bed3256f1ba

SHA1
e71017c3af7d79673cd4d37bcd86e0efec298974

SHA256
e62759d5611d2c6d8bc604bd3e9b28a8ad6d76c87899674a57b004d7df647a07

SHA512
0c04218fcd5ab67adc75997ac0697ec01883746b162d9b9b0caaa9a7e676ad2f8f3cd9c721ecca6126a0525409754500120abd42372f1570dfc4702fc1c4ca38

Download Submit
C:\Windows\System\xQHMjtg.exe

Filesize
2.3MB

MD5
e67ead2329d90a780a9e73290ed8ef6a

SHA1
633ce8b0d7ac609c31af56411b23daa121c72087

SHA256
570d41e114eb51dba481c1f006b3d7201e8932f95d0bb78fe32c753fbef681f4

SHA512
ba7608e9d41a299e6b47a74516a972a20f245a75f62035940654573b5683cb6892cc27603bba6f26722574b897522b7a1691ab52cb73aa9df382bd9fc4915397

Download Submit
memory/324-2338-0x00007FF6BA4A0000-0x00007FF6BA892000-memory.dmp

Filesize
3.9MB

Download
memory/324-10-0x00007FF6BA4A0000-0x00007FF6BA892000-memory.dmp

Filesize
3.9MB

Download
memory/1564-139-0x000001367B3A0000-0x000001367B3B0000-memory.dmp

Filesize
64KB

Download
memory/1564-21-0x00007FFE6E380000-0x00007FFE6EE41000-memory.dmp

Filesize
10.8MB

Download
memory/1564-22-0x000001367B3A0000-0x000001367B3B0000-memory.dmp

Filesize
64KB

Download
memory/1564-38-0x000001367B450000-0x000001367B472000-memory.dmp

Filesize
136KB

Download
memory/1564-100-0x000001367E2A0000-0x000001367EA46000-memory.dmp

Filesize
7.6MB

Download
memory/1564-116-0x00007FFE6E380000-0x00007FFE6EE41000-memory.dmp

Filesize
10.8MB

Download
memory/1564-25-0x000001367B3A0000-0x000001367B3B0000-memory.dmp

Filesize
64KB

Download
memory/1832-78-0x00007FF661A00000-0x00007FF661DF2000-memory.dmp

Filesize
3.9MB

Download
memory/1832-2354-0x00007FF661A00000-0x00007FF661DF2000-memory.dmp

Filesize
3.9MB

Download
memory/2040-90-0x00007FF61AAB0000-0x00007FF61AEA2000-memory.dmp

Filesize
3.9MB

Download
memory/2040-2376-0x00007FF61AAB0000-0x00007FF61AEA2000-memory.dmp

Filesize
3.9MB

Download
memory/2612-131-0x00007FF7A8990000-0x00007FF7A8D82000-memory.dmp

Filesize
3.9MB

Download
memory/2612-1-0x00000175D4FD0000-0x00000175D4FE0000-memory.dmp

Filesize
64KB

Download
memory/2612-0-0x00007FF7A8990000-0x00007FF7A8D82000-memory.dmp

Filesize
3.9MB

Download
memory/3228-88-0x00007FF635B60000-0x00007FF635F52000-memory.dmp

Filesize
3.9MB

Download
memory/3228-2356-0x00007FF635B60000-0x00007FF635F52000-memory.dmp

Filesize
3.9MB

Download
memory/3376-2285-0x00007FF6671D0000-0x00007FF6675C2000-memory.dmp

Filesize
3.9MB

Download
memory/3376-93-0x00007FF6671D0000-0x00007FF6675C2000-memory.dmp

Filesize
3.9MB

Download
memory/3376-2379-0x00007FF6671D0000-0x00007FF6675C2000-memory.dmp

Filesize
3.9MB

Download
memory/3388-2393-0x00007FF68EDC0000-0x00007FF68F1B2000-memory.dmp

Filesize
3.9MB

Download
memory/3388-152-0x00007FF68EDC0000-0x00007FF68F1B2000-memory.dmp

Filesize
3.9MB

Download
memory/3564-2391-0x00007FF7A4FA0000-0x00007FF7A5392000-memory.dmp

Filesize
3.9MB

Download
memory/3564-138-0x00007FF7A4FA0000-0x00007FF7A5392000-memory.dmp

Filesize
3.9MB

Download
memory/3564-2320-0x00007FF7A4FA0000-0x00007FF7A5392000-memory.dmp

Filesize
3.9MB

Download
memory/3580-47-0x00007FF7B2EC0000-0x00007FF7B32B2000-memory.dmp

Filesize
3.9MB

Download
memory/3580-2344-0x00007FF7B2EC0000-0x00007FF7B32B2000-memory.dmp

Filesize
3.9MB

Download
memory/3804-2387-0x00007FF605E70000-0x00007FF606262000-memory.dmp

Filesize
3.9MB

Download
memory/3804-130-0x00007FF605E70000-0x00007FF606262000-memory.dmp

Filesize
3.9MB

Download
memory/3804-2304-0x00007FF605E70000-0x00007FF606262000-memory.dmp

Filesize
3.9MB

Download
memory/3948-91-0x00007FF788360000-0x00007FF788752000-memory.dmp

Filesize
3.9MB

Download
memory/3948-2165-0x00007FF788360000-0x00007FF788752000-memory.dmp

Filesize
3.9MB

Download
memory/3948-2377-0x00007FF788360000-0x00007FF788752000-memory.dmp

Filesize
3.9MB

Download
memory/4008-143-0x00007FF710DD0000-0x00007FF7111C2000-memory.dmp

Filesize
3.9MB

Download
memory/4008-2389-0x00007FF710DD0000-0x00007FF7111C2000-memory.dmp

Filesize
3.9MB

Download
memory/4072-1685-0x00007FF7490A0000-0x00007FF749492000-memory.dmp

Filesize
3.9MB

Download
memory/4072-85-0x00007FF7490A0000-0x00007FF749492000-memory.dmp

Filesize
3.9MB

Download
memory/4072-2373-0x00007FF7490A0000-0x00007FF749492000-memory.dmp

Filesize
3.9MB

Download
memory/4156-65-0x00007FF6B17F0000-0x00007FF6B1BE2000-memory.dmp

Filesize
3.9MB

Download
memory/4156-2350-0x00007FF6B17F0000-0x00007FF6B1BE2000-memory.dmp

Filesize
3.9MB

Download
memory/4436-54-0x00007FF6A8ED0000-0x00007FF6A92C2000-memory.dmp

Filesize
3.9MB

Download
memory/4436-2346-0x00007FF6A8ED0000-0x00007FF6A92C2000-memory.dmp

Filesize
3.9MB

Download
memory/4440-2383-0x00007FF6C5960000-0x00007FF6C5D52000-memory.dmp

Filesize
3.9MB

Download
memory/4440-122-0x00007FF6C5960000-0x00007FF6C5D52000-memory.dmp

Filesize
3.9MB

Download
memory/4528-2342-0x00007FF7B9060000-0x00007FF7B9452000-memory.dmp

Filesize
3.9MB

Download
memory/4528-41-0x00007FF7B9060000-0x00007FF7B9452000-memory.dmp

Filesize
3.9MB

Download
memory/4536-2302-0x00007FF77AAE0000-0x00007FF77AED2000-memory.dmp

Filesize
3.9MB

Download
memory/4536-2381-0x00007FF77AAE0000-0x00007FF77AED2000-memory.dmp

Filesize
3.9MB

Download
memory/4536-107-0x00007FF77AAE0000-0x00007FF77AED2000-memory.dmp

Filesize
3.9MB

Download
memory/4616-2303-0x00007FF62EB00000-0x00007FF62EEF2000-memory.dmp

Filesize
3.9MB

Download
memory/4616-2385-0x00007FF62EB00000-0x00007FF62EEF2000-memory.dmp

Filesize
3.9MB

Download
memory/4616-117-0x00007FF62EB00000-0x00007FF62EEF2000-memory.dmp

Filesize
3.9MB

Download
memory/4620-2352-0x00007FF7D83A0000-0x00007FF7D8792000-memory.dmp

Filesize
3.9MB

Download
memory/4620-77-0x00007FF7D83A0000-0x00007FF7D8792000-memory.dmp

Filesize
3.9MB

Download
memory/4628-2340-0x00007FF734810000-0x00007FF734C02000-memory.dmp

Filesize
3.9MB

Download
memory/4628-24-0x00007FF734810000-0x00007FF734C02000-memory.dmp

Filesize
3.9MB

Download
memory/4660-2348-0x00007FF7DABE0000-0x00007FF7DAFD2000-memory.dmp

Filesize
3.9MB

Download
memory/4660-61-0x00007FF7DABE0000-0x00007FF7DAFD2000-memory.dmp

Filesize
3.9MB

Download