xmrig | fba9a7683d89b5e50d81693b30fd5350ff001da51fb201a71452aa39e2961732

Analysis

max time kernel
130s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 11:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
Size

1.8MB
MD5

00afcab08c39bff45365e93136b47089
SHA1

04d26887d70fa3d4270d8ec617509abc64888315
SHA256

fba9a7683d89b5e50d81693b30fd5350ff001da51fb201a71452aa39e2961732
SHA512

04d9c34967c166582bf4e85621fe3f179f3e4406ffd21d31b7d8bea4f838d421e8c658921b029bcfc03e640afd395a025e183f65e44befbaadde11f74dd72e0d
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrl2E:NABS

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 42 IoCs

miner

resource	yara_rule
behavioral2/memory/1936-299-0x00007FF732400000-0x00007FF7327F2000-memory.dmp	xmrig
behavioral2/memory/884-318-0x00007FF73D240000-0x00007FF73D632000-memory.dmp	xmrig
behavioral2/memory/1812-374-0x00007FF7139B0000-0x00007FF713DA2000-memory.dmp	xmrig
behavioral2/memory/5072-420-0x00007FF7FA070000-0x00007FF7FA462000-memory.dmp	xmrig
behavioral2/memory/460-425-0x00007FF6DD610000-0x00007FF6DDA02000-memory.dmp	xmrig
behavioral2/memory/2664-434-0x00007FF658E90000-0x00007FF659282000-memory.dmp	xmrig
behavioral2/memory/3472-433-0x00007FF7D64D0000-0x00007FF7D68C2000-memory.dmp	xmrig
behavioral2/memory/2180-424-0x00007FF67D110000-0x00007FF67D502000-memory.dmp	xmrig
behavioral2/memory/1988-416-0x00007FF7623E0000-0x00007FF7627D2000-memory.dmp	xmrig
behavioral2/memory/1456-359-0x00007FF650F30000-0x00007FF651322000-memory.dmp	xmrig
behavioral2/memory/3232-358-0x00007FF677060000-0x00007FF677452000-memory.dmp	xmrig
behavioral2/memory/1756-354-0x00007FF720FF0000-0x00007FF7213E2000-memory.dmp	xmrig
behavioral2/memory/3228-272-0x00007FF7C5560000-0x00007FF7C5952000-memory.dmp	xmrig
behavioral2/memory/2952-271-0x00007FF6CE680000-0x00007FF6CEA72000-memory.dmp	xmrig
behavioral2/memory/3452-228-0x00007FF7280D0000-0x00007FF7284C2000-memory.dmp	xmrig
behavioral2/memory/4784-210-0x00007FF78FAF0000-0x00007FF78FEE2000-memory.dmp	xmrig
behavioral2/memory/1444-173-0x00007FF7CEB70000-0x00007FF7CEF62000-memory.dmp	xmrig
behavioral2/memory/220-158-0x00007FF65FAB0000-0x00007FF65FEA2000-memory.dmp	xmrig
behavioral2/memory/916-118-0x00007FF7DAF50000-0x00007FF7DB342000-memory.dmp	xmrig
behavioral2/memory/4196-3729-0x00007FF7C8780000-0x00007FF7C8B72000-memory.dmp	xmrig
behavioral2/memory/3356-3730-0x00007FF619DE0000-0x00007FF61A1D2000-memory.dmp	xmrig
behavioral2/memory/4196-3732-0x00007FF7C8780000-0x00007FF7C8B72000-memory.dmp	xmrig
behavioral2/memory/916-3734-0x00007FF7DAF50000-0x00007FF7DB342000-memory.dmp	xmrig
behavioral2/memory/3356-3736-0x00007FF619DE0000-0x00007FF61A1D2000-memory.dmp	xmrig
behavioral2/memory/4784-3738-0x00007FF78FAF0000-0x00007FF78FEE2000-memory.dmp	xmrig
behavioral2/memory/460-3742-0x00007FF6DD610000-0x00007FF6DDA02000-memory.dmp	xmrig
behavioral2/memory/220-3741-0x00007FF65FAB0000-0x00007FF65FEA2000-memory.dmp	xmrig
behavioral2/memory/3452-3744-0x00007FF7280D0000-0x00007FF7284C2000-memory.dmp	xmrig
behavioral2/memory/1756-3746-0x00007FF720FF0000-0x00007FF7213E2000-memory.dmp	xmrig
behavioral2/memory/1444-3748-0x00007FF7CEB70000-0x00007FF7CEF62000-memory.dmp	xmrig
behavioral2/memory/3228-3750-0x00007FF7C5560000-0x00007FF7C5952000-memory.dmp	xmrig
behavioral2/memory/2180-3771-0x00007FF67D110000-0x00007FF67D502000-memory.dmp	xmrig
behavioral2/memory/1988-3776-0x00007FF7623E0000-0x00007FF7627D2000-memory.dmp	xmrig
behavioral2/memory/5072-3789-0x00007FF7FA070000-0x00007FF7FA462000-memory.dmp	xmrig
behavioral2/memory/3472-3767-0x00007FF7D64D0000-0x00007FF7D68C2000-memory.dmp	xmrig
behavioral2/memory/2664-3766-0x00007FF658E90000-0x00007FF659282000-memory.dmp	xmrig
behavioral2/memory/884-3764-0x00007FF73D240000-0x00007FF73D632000-memory.dmp	xmrig
behavioral2/memory/2952-3762-0x00007FF6CE680000-0x00007FF6CEA72000-memory.dmp	xmrig
behavioral2/memory/1936-3758-0x00007FF732400000-0x00007FF7327F2000-memory.dmp	xmrig
behavioral2/memory/1812-3756-0x00007FF7139B0000-0x00007FF713DA2000-memory.dmp	xmrig
behavioral2/memory/3232-3760-0x00007FF677060000-0x00007FF677452000-memory.dmp	xmrig
behavioral2/memory/1456-3755-0x00007FF650F30000-0x00007FF651322000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4196	dJBqmtj.exe
3356	ubaHeWN.exe
916	JRUwcIT.exe
460	bKiEuaT.exe
220	UTCwvAF.exe
3472	paSJHFz.exe
1444	JJmqydP.exe
4784	JljQtpL.exe
3452	qcLPIgf.exe
2952	WvrTMkh.exe
3228	SEUkzUJ.exe
1936	zFkFClA.exe
884	jukvTMb.exe
1756	AjUPdZW.exe
3232	BIUJzps.exe
1456	cEvImmK.exe
1812	ZmCUbny.exe
1988	KHUVOoC.exe
5072	XOVESat.exe
2664	XssUFQc.exe
2180	hsRdfXx.exe
2008	KDnMvOw.exe
64	tKuzYLp.exe
4204	LOjLkhu.exe
2688	ebYLbtz.exe
392	kVOElrm.exe
1676	zztXebX.exe
2176	OFLqeuC.exe
1792	FGWGNOV.exe
4460	WrdhPKU.exe
3204	wTTcAxj.exe
2684	OOnTqbR.exe
5060	bLPYPhF.exe
4748	qnOnWxa.exe
4220	edULpgq.exe
2368	vawGFzc.exe
1864	IJJjbae.exe
4020	gUlEckM.exe
1904	ZyDNONw.exe
4920	FNJfnLT.exe
372	xHAcWCy.exe
4088	EBmZtMQ.exe
4928	crETVIH.exe
652	KblMlSn.exe
1772	vyIsxKQ.exe
5032	ZPuqlpi.exe
4160	bLgOxxL.exe
2168	DONNFyc.exe
4184	iCszsGE.exe
4212	EEGOKSC.exe
636	JjFUgpQ.exe
5088	vApqmWF.exe
1580	qrVKJch.exe
5036	oiYTbAL.exe
2468	uhkjyWT.exe
3336	KOaHtFO.exe
2472	UpvEBKL.exe
2492	JBUbFMY.exe
1868	pkqTijs.exe
2108	lDLOvjJ.exe
3364	CXZZHUZ.exe
1520	YAqoDre.exe
224	tMYhrTZ.exe
4348	lGlavkd.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4480-0-0x00007FF728380000-0x00007FF728772000-memory.dmp	upx
behavioral2/files/0x000b000000023bbb-11.dat	upx
behavioral2/files/0x000c000000023b5e-15.dat	upx
behavioral2/memory/4196-8-0x00007FF7C8780000-0x00007FF7C8B72000-memory.dmp	upx
behavioral2/files/0x000a000000023bbc-7.dat	upx
behavioral2/files/0x000a000000023bc2-38.dat	upx
behavioral2/files/0x000a000000023bd6-150.dat	upx
behavioral2/files/0x000a000000023bdf-187.dat	upx
behavioral2/memory/1936-299-0x00007FF732400000-0x00007FF7327F2000-memory.dmp	upx
behavioral2/memory/884-318-0x00007FF73D240000-0x00007FF73D632000-memory.dmp	upx
behavioral2/memory/1812-374-0x00007FF7139B0000-0x00007FF713DA2000-memory.dmp	upx
behavioral2/memory/5072-420-0x00007FF7FA070000-0x00007FF7FA462000-memory.dmp	upx
behavioral2/memory/460-425-0x00007FF6DD610000-0x00007FF6DDA02000-memory.dmp	upx
behavioral2/memory/2664-434-0x00007FF658E90000-0x00007FF659282000-memory.dmp	upx
behavioral2/memory/3472-433-0x00007FF7D64D0000-0x00007FF7D68C2000-memory.dmp	upx
behavioral2/memory/2180-424-0x00007FF67D110000-0x00007FF67D502000-memory.dmp	upx
behavioral2/memory/1988-416-0x00007FF7623E0000-0x00007FF7627D2000-memory.dmp	upx
behavioral2/memory/1456-359-0x00007FF650F30000-0x00007FF651322000-memory.dmp	upx
behavioral2/memory/3232-358-0x00007FF677060000-0x00007FF677452000-memory.dmp	upx
behavioral2/memory/1756-354-0x00007FF720FF0000-0x00007FF7213E2000-memory.dmp	upx
behavioral2/memory/3228-272-0x00007FF7C5560000-0x00007FF7C5952000-memory.dmp	upx
behavioral2/memory/2952-271-0x00007FF6CE680000-0x00007FF6CEA72000-memory.dmp	upx
behavioral2/memory/3452-228-0x00007FF7280D0000-0x00007FF7284C2000-memory.dmp	upx
behavioral2/memory/4784-210-0x00007FF78FAF0000-0x00007FF78FEE2000-memory.dmp	upx
behavioral2/files/0x000a000000023bea-204.dat	upx
behavioral2/files/0x000b000000023be2-203.dat	upx
behavioral2/files/0x000a000000023bcb-199.dat	upx
behavioral2/files/0x000b000000023be1-196.dat	upx
behavioral2/files/0x000b000000023be0-193.dat	upx
behavioral2/files/0x000a000000023bd3-184.dat	upx
behavioral2/files/0x000a000000023bcf-180.dat	upx
behavioral2/files/0x000a000000023bdb-179.dat	upx
behavioral2/memory/1444-173-0x00007FF7CEB70000-0x00007FF7CEF62000-memory.dmp	upx
behavioral2/files/0x000a000000023bda-168.dat	upx
behavioral2/files/0x000a000000023bd4-163.dat	upx
behavioral2/memory/220-158-0x00007FF65FAB0000-0x00007FF65FEA2000-memory.dmp	upx
behavioral2/files/0x000a000000023bd9-157.dat	upx
behavioral2/files/0x000a000000023bd8-154.dat	upx
behavioral2/files/0x000a000000023bd5-149.dat	upx
behavioral2/files/0x000a000000023bc9-143.dat	upx
behavioral2/files/0x000a000000023bd2-136.dat	upx
behavioral2/files/0x000a000000023bca-134.dat	upx
behavioral2/files/0x000a000000023bd1-130.dat	upx
behavioral2/files/0x000a000000023bc8-126.dat	upx
behavioral2/files/0x000a000000023bcc-175.dat	upx
behavioral2/memory/916-118-0x00007FF7DAF50000-0x00007FF7DB342000-memory.dmp	upx
behavioral2/files/0x000a000000023bd0-115.dat	upx
behavioral2/files/0x000a000000023bd7-153.dat	upx
behavioral2/files/0x000a000000023bc7-109.dat	upx
behavioral2/files/0x000a000000023bcd-97.dat	upx
behavioral2/files/0x000a000000023bc6-96.dat	upx
behavioral2/files/0x000a000000023bce-125.dat	upx
behavioral2/files/0x000a000000023bc3-80.dat	upx
behavioral2/files/0x000a000000023bc0-74.dat	upx
behavioral2/files/0x000a000000023bc5-69.dat	upx
behavioral2/files/0x000a000000023bbf-65.dat	upx
behavioral2/files/0x000a000000023bc4-83.dat	upx
behavioral2/files/0x000a000000023bc1-53.dat	upx
behavioral2/files/0x000a000000023bbd-47.dat	upx
behavioral2/files/0x000a000000023bbe-43.dat	upx
behavioral2/memory/3356-33-0x00007FF619DE0000-0x00007FF61A1D2000-memory.dmp	upx
behavioral2/memory/4196-3729-0x00007FF7C8780000-0x00007FF7C8B72000-memory.dmp	upx
behavioral2/memory/3356-3730-0x00007FF619DE0000-0x00007FF61A1D2000-memory.dmp	upx
behavioral2/memory/4196-3732-0x00007FF7C8780000-0x00007FF7C8B72000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\uRyqDPd.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\oeRcShE.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\CIGSCIo.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\SEKqznV.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\lPpWBQB.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\gecjRzz.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\MAhczcO.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\Uhqtoxc.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\jWxUXQz.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\fppTMwW.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\zDBfVHO.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\UPjTHUr.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\cQrFhYC.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\fABYxVi.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\kfZAILZ.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\IoYPASe.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\xsHBjlO.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\oYjYOKW.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\psMvJiU.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\SAedRVl.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\ZmCUbny.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\xzMLtUT.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\OajJdcI.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\SstRVLK.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\sEOqfwc.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\rjhoDiw.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\WxmdWCA.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\zSSvKfX.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\PsDAOCl.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\OLgtTQQ.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\DzJfzGh.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\XHRKuCv.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\ZoYBkXV.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\lbPAXTP.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\swKWFVO.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\fUAKuze.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\HmQtjSK.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\vIzwxCy.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\DzEQmUX.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\mNGxxZI.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\pzBfBGL.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\NaLwdtF.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\pwMVvvv.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\iGUtGns.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\sXJOuZs.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\ZdHazFW.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\hXpGjmO.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\lqAsjTO.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\XzOTvLL.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\TYPQXIj.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\IeOaZqR.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\znJBiKO.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\KAZozHe.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\HGfJgXz.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\ZjoyLww.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\YDuOzXA.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\NnmLdWS.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\zkLnxsq.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\wQGrOyF.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\FutgXbr.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\DqUUmQj.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\Rbefthl.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\oRtNXYA.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
File created	C:\Windows\System\XYAioit.exe	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4856	powershell.exe
4856	powershell.exe
4856	powershell.exe
4856	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4856	powershell.exe
Token: SeLockMemoryPrivilege	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4480 wrote to memory of 4856	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	83
PID 4480 wrote to memory of 4856	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	83
PID 4480 wrote to memory of 4196	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	84
PID 4480 wrote to memory of 4196	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	84
PID 4480 wrote to memory of 3356	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	85
PID 4480 wrote to memory of 3356	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	85
PID 4480 wrote to memory of 916	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	86
PID 4480 wrote to memory of 916	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	86
PID 4480 wrote to memory of 220	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	87
PID 4480 wrote to memory of 220	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	87
PID 4480 wrote to memory of 460	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	88
PID 4480 wrote to memory of 460	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	88
PID 4480 wrote to memory of 3472	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	89
PID 4480 wrote to memory of 3472	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	89
PID 4480 wrote to memory of 1444	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	90
PID 4480 wrote to memory of 1444	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	90
PID 4480 wrote to memory of 4784	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	91
PID 4480 wrote to memory of 4784	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	91
PID 4480 wrote to memory of 3452	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	92
PID 4480 wrote to memory of 3452	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	92
PID 4480 wrote to memory of 2952	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	93
PID 4480 wrote to memory of 2952	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	93
PID 4480 wrote to memory of 3228	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	94
PID 4480 wrote to memory of 3228	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	94
PID 4480 wrote to memory of 1756	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	95
PID 4480 wrote to memory of 1756	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	95
PID 4480 wrote to memory of 1936	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	96
PID 4480 wrote to memory of 1936	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	96
PID 4480 wrote to memory of 884	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	97
PID 4480 wrote to memory of 884	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	97
PID 4480 wrote to memory of 3232	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	98
PID 4480 wrote to memory of 3232	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	98
PID 4480 wrote to memory of 1456	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	99
PID 4480 wrote to memory of 1456	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	99
PID 4480 wrote to memory of 1812	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	100
PID 4480 wrote to memory of 1812	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	100
PID 4480 wrote to memory of 1988	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	101
PID 4480 wrote to memory of 1988	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	101
PID 4480 wrote to memory of 5072	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	102
PID 4480 wrote to memory of 5072	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	102
PID 4480 wrote to memory of 2664	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	103
PID 4480 wrote to memory of 2664	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	103
PID 4480 wrote to memory of 64	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	104
PID 4480 wrote to memory of 64	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	104
PID 4480 wrote to memory of 2180	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	105
PID 4480 wrote to memory of 2180	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	105
PID 4480 wrote to memory of 2008	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	106
PID 4480 wrote to memory of 2008	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	106
PID 4480 wrote to memory of 4204	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	107
PID 4480 wrote to memory of 4204	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	107
PID 4480 wrote to memory of 2688	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	108
PID 4480 wrote to memory of 2688	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	108
PID 4480 wrote to memory of 392	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	109
PID 4480 wrote to memory of 392	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	109
PID 4480 wrote to memory of 1676	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	110
PID 4480 wrote to memory of 1676	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	110
PID 4480 wrote to memory of 2176	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	111
PID 4480 wrote to memory of 2176	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	111
PID 4480 wrote to memory of 1792	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	112
PID 4480 wrote to memory of 1792	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	112
PID 4480 wrote to memory of 4460	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	113
PID 4480 wrote to memory of 4460	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	113
PID 4480 wrote to memory of 3204	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	114
PID 4480 wrote to memory of 3204	4480	00afcab08c39bff45365e93136b47089_JaffaCakes118.exe	114

C:\Users\Admin\AppData\Local\Temp\00afcab08c39bff45365e93136b47089_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\00afcab08c39bff45365e93136b47089_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4856
- C:\Windows\System\dJBqmtj.exe
  C:\Windows\System\dJBqmtj.exe
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Windows\System\ubaHeWN.exe
  C:\Windows\System\ubaHeWN.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\JRUwcIT.exe
  C:\Windows\System\JRUwcIT.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\UTCwvAF.exe
  C:\Windows\System\UTCwvAF.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\bKiEuaT.exe
  C:\Windows\System\bKiEuaT.exe
  2⤵
  - Executes dropped EXE
  PID:460
- C:\Windows\System\paSJHFz.exe
  C:\Windows\System\paSJHFz.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System\JJmqydP.exe
  C:\Windows\System\JJmqydP.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\JljQtpL.exe
  C:\Windows\System\JljQtpL.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\qcLPIgf.exe
  C:\Windows\System\qcLPIgf.exe
  2⤵
  - Executes dropped EXE
  PID:3452
- C:\Windows\System\WvrTMkh.exe
  C:\Windows\System\WvrTMkh.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\SEUkzUJ.exe
  C:\Windows\System\SEUkzUJ.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\AjUPdZW.exe
  C:\Windows\System\AjUPdZW.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\zFkFClA.exe
  C:\Windows\System\zFkFClA.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\jukvTMb.exe
  C:\Windows\System\jukvTMb.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\BIUJzps.exe
  C:\Windows\System\BIUJzps.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\cEvImmK.exe
  C:\Windows\System\cEvImmK.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\ZmCUbny.exe
  C:\Windows\System\ZmCUbny.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\KHUVOoC.exe
  C:\Windows\System\KHUVOoC.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\XOVESat.exe
  C:\Windows\System\XOVESat.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\XssUFQc.exe
  C:\Windows\System\XssUFQc.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\tKuzYLp.exe
  C:\Windows\System\tKuzYLp.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\hsRdfXx.exe
  C:\Windows\System\hsRdfXx.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\KDnMvOw.exe
  C:\Windows\System\KDnMvOw.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\LOjLkhu.exe
  C:\Windows\System\LOjLkhu.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\ebYLbtz.exe
  C:\Windows\System\ebYLbtz.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\kVOElrm.exe
  C:\Windows\System\kVOElrm.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\zztXebX.exe
  C:\Windows\System\zztXebX.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\OFLqeuC.exe
  C:\Windows\System\OFLqeuC.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\FGWGNOV.exe
  C:\Windows\System\FGWGNOV.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\WrdhPKU.exe
  C:\Windows\System\WrdhPKU.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\wTTcAxj.exe
  C:\Windows\System\wTTcAxj.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\OOnTqbR.exe
  C:\Windows\System\OOnTqbR.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\bLPYPhF.exe
  C:\Windows\System\bLPYPhF.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\qnOnWxa.exe
  C:\Windows\System\qnOnWxa.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\crETVIH.exe
  C:\Windows\System\crETVIH.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\KblMlSn.exe
  C:\Windows\System\KblMlSn.exe
  2⤵
  - Executes dropped EXE
  PID:652
- C:\Windows\System\vyIsxKQ.exe
  C:\Windows\System\vyIsxKQ.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\edULpgq.exe
  C:\Windows\System\edULpgq.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\vApqmWF.exe
  C:\Windows\System\vApqmWF.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\vawGFzc.exe
  C:\Windows\System\vawGFzc.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\IJJjbae.exe
  C:\Windows\System\IJJjbae.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\gUlEckM.exe
  C:\Windows\System\gUlEckM.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\ZyDNONw.exe
  C:\Windows\System\ZyDNONw.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\FNJfnLT.exe
  C:\Windows\System\FNJfnLT.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\xHAcWCy.exe
  C:\Windows\System\xHAcWCy.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\EBmZtMQ.exe
  C:\Windows\System\EBmZtMQ.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\ZPuqlpi.exe
  C:\Windows\System\ZPuqlpi.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\bLgOxxL.exe
  C:\Windows\System\bLgOxxL.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System\DONNFyc.exe
  C:\Windows\System\DONNFyc.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\iCszsGE.exe
  C:\Windows\System\iCszsGE.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\EEGOKSC.exe
  C:\Windows\System\EEGOKSC.exe
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Windows\System\JjFUgpQ.exe
  C:\Windows\System\JjFUgpQ.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\qrVKJch.exe
  C:\Windows\System\qrVKJch.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\JBUbFMY.exe
  C:\Windows\System\JBUbFMY.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\oiYTbAL.exe
  C:\Windows\System\oiYTbAL.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\uhkjyWT.exe
  C:\Windows\System\uhkjyWT.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\KOaHtFO.exe
  C:\Windows\System\KOaHtFO.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\UpvEBKL.exe
  C:\Windows\System\UpvEBKL.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\pkqTijs.exe
  C:\Windows\System\pkqTijs.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\lDLOvjJ.exe
  C:\Windows\System\lDLOvjJ.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\odCwrtv.exe
  C:\Windows\System\odCwrtv.exe
  2⤵
  PID:2816
- C:\Windows\System\CXZZHUZ.exe
  C:\Windows\System\CXZZHUZ.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System\YAqoDre.exe
  C:\Windows\System\YAqoDre.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\tMYhrTZ.exe
  C:\Windows\System\tMYhrTZ.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\lGlavkd.exe
  C:\Windows\System\lGlavkd.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\giswHes.exe
  C:\Windows\System\giswHes.exe
  2⤵
  PID:4612
- C:\Windows\System\BfKWyno.exe
  C:\Windows\System\BfKWyno.exe
  2⤵
  PID:1128
- C:\Windows\System\ABUBNaq.exe
  C:\Windows\System\ABUBNaq.exe
  2⤵
  PID:1632
- C:\Windows\System\EMUXEMt.exe
  C:\Windows\System\EMUXEMt.exe
  2⤵
  PID:2536
- C:\Windows\System\eFVSFQu.exe
  C:\Windows\System\eFVSFQu.exe
  2⤵
  PID:1040
- C:\Windows\System\HvyCecE.exe
  C:\Windows\System\HvyCecE.exe
  2⤵
  PID:428
- C:\Windows\System\VvBfoiM.exe
  C:\Windows\System\VvBfoiM.exe
  2⤵
  PID:1628
- C:\Windows\System\QsIpVeC.exe
  C:\Windows\System\QsIpVeC.exe
  2⤵
  PID:1224
- C:\Windows\System\EwanqXQ.exe
  C:\Windows\System\EwanqXQ.exe
  2⤵
  PID:1504
- C:\Windows\System\VSzjVvv.exe
  C:\Windows\System\VSzjVvv.exe
  2⤵
  PID:1932
- C:\Windows\System\NUMSxXU.exe
  C:\Windows\System\NUMSxXU.exe
  2⤵
  PID:4608
- C:\Windows\System\qufNHZU.exe
  C:\Windows\System\qufNHZU.exe
  2⤵
  PID:2420
- C:\Windows\System\JOUgrAL.exe
  C:\Windows\System\JOUgrAL.exe
  2⤵
  PID:3244
- C:\Windows\System\TNhNYxt.exe
  C:\Windows\System\TNhNYxt.exe
  2⤵
  PID:2880
- C:\Windows\System\pstXfgt.exe
  C:\Windows\System\pstXfgt.exe
  2⤵
  PID:4576
- C:\Windows\System\yuGVTWv.exe
  C:\Windows\System\yuGVTWv.exe
  2⤵
  PID:2456
- C:\Windows\System\nltwtUr.exe
  C:\Windows\System\nltwtUr.exe
  2⤵
  PID:680
- C:\Windows\System\IxnSozi.exe
  C:\Windows\System\IxnSozi.exe
  2⤵
  PID:5144
- C:\Windows\System\duQQXWz.exe
  C:\Windows\System\duQQXWz.exe
  2⤵
  PID:5204
- C:\Windows\System\tWbUHPa.exe
  C:\Windows\System\tWbUHPa.exe
  2⤵
  PID:5220
- C:\Windows\System\iNhnkxv.exe
  C:\Windows\System\iNhnkxv.exe
  2⤵
  PID:5240
- C:\Windows\System\WAZnbpm.exe
  C:\Windows\System\WAZnbpm.exe
  2⤵
  PID:5268
- C:\Windows\System\qfQZsiM.exe
  C:\Windows\System\qfQZsiM.exe
  2⤵
  PID:5316
- C:\Windows\System\tWLLvuq.exe
  C:\Windows\System\tWLLvuq.exe
  2⤵
  PID:5336
- C:\Windows\System\WaKYquU.exe
  C:\Windows\System\WaKYquU.exe
  2⤵
  PID:5392
- C:\Windows\System\qtHuvnY.exe
  C:\Windows\System\qtHuvnY.exe
  2⤵
  PID:5412
- C:\Windows\System\tawYyHg.exe
  C:\Windows\System\tawYyHg.exe
  2⤵
  PID:5432
- C:\Windows\System\MZTEjZv.exe
  C:\Windows\System\MZTEjZv.exe
  2⤵
  PID:5456
- C:\Windows\System\BrvlYGQ.exe
  C:\Windows\System\BrvlYGQ.exe
  2⤵
  PID:5488
- C:\Windows\System\nCxRMfo.exe
  C:\Windows\System\nCxRMfo.exe
  2⤵
  PID:5504
- C:\Windows\System\lMzPrhM.exe
  C:\Windows\System\lMzPrhM.exe
  2⤵
  PID:5528
- C:\Windows\System\CPuREBX.exe
  C:\Windows\System\CPuREBX.exe
  2⤵
  PID:5712
- C:\Windows\System\kHUOBmr.exe
  C:\Windows\System\kHUOBmr.exe
  2⤵
  PID:5748
- C:\Windows\System\ABWTgdT.exe
  C:\Windows\System\ABWTgdT.exe
  2⤵
  PID:5780
- C:\Windows\System\FwaHiUJ.exe
  C:\Windows\System\FwaHiUJ.exe
  2⤵
  PID:5824
- C:\Windows\System\CSBvSeh.exe
  C:\Windows\System\CSBvSeh.exe
  2⤵
  PID:5844
- C:\Windows\System\JLnBECW.exe
  C:\Windows\System\JLnBECW.exe
  2⤵
  PID:5868
- C:\Windows\System\dWLObHZ.exe
  C:\Windows\System\dWLObHZ.exe
  2⤵
  PID:5888
- C:\Windows\System\rsLXpZm.exe
  C:\Windows\System\rsLXpZm.exe
  2⤵
  PID:5936
- C:\Windows\System\IhogZtw.exe
  C:\Windows\System\IhogZtw.exe
  2⤵
  PID:5952
- C:\Windows\System\HfqpFRb.exe
  C:\Windows\System\HfqpFRb.exe
  2⤵
  PID:5968
- C:\Windows\System\SmYRUbO.exe
  C:\Windows\System\SmYRUbO.exe
  2⤵
  PID:5984
- C:\Windows\System\wTRyZnP.exe
  C:\Windows\System\wTRyZnP.exe
  2⤵
  PID:6000
- C:\Windows\System\YvbnAqH.exe
  C:\Windows\System\YvbnAqH.exe
  2⤵
  PID:6016
- C:\Windows\System\vlkRgqC.exe
  C:\Windows\System\vlkRgqC.exe
  2⤵
  PID:6032
- C:\Windows\System\iHWTmRI.exe
  C:\Windows\System\iHWTmRI.exe
  2⤵
  PID:6048
- C:\Windows\System\eAgRBLx.exe
  C:\Windows\System\eAgRBLx.exe
  2⤵
  PID:6064
- C:\Windows\System\HZJQZRC.exe
  C:\Windows\System\HZJQZRC.exe
  2⤵
  PID:6084
- C:\Windows\System\AohsAeu.exe
  C:\Windows\System\AohsAeu.exe
  2⤵
  PID:6100
- C:\Windows\System\lPpWBQB.exe
  C:\Windows\System\lPpWBQB.exe
  2⤵
  PID:6124
- C:\Windows\System\rIdCWsf.exe
  C:\Windows\System\rIdCWsf.exe
  2⤵
  PID:6140
- C:\Windows\System\TgYLmCS.exe
  C:\Windows\System\TgYLmCS.exe
  2⤵
  PID:4824
- C:\Windows\System\txcGXJL.exe
  C:\Windows\System\txcGXJL.exe
  2⤵
  PID:512
- C:\Windows\System\EIopJmg.exe
  C:\Windows\System\EIopJmg.exe
  2⤵
  PID:1072
- C:\Windows\System\hmqXvjX.exe
  C:\Windows\System\hmqXvjX.exe
  2⤵
  PID:1132
- C:\Windows\System\farGDhw.exe
  C:\Windows\System\farGDhw.exe
  2⤵
  PID:1920
- C:\Windows\System\MEFIFwF.exe
  C:\Windows\System\MEFIFwF.exe
  2⤵
  PID:2244
- C:\Windows\System\uwDaeyd.exe
  C:\Windows\System\uwDaeyd.exe
  2⤵
  PID:4916
- C:\Windows\System\VYCwlni.exe
  C:\Windows\System\VYCwlni.exe
  2⤵
  PID:4236
- C:\Windows\System\LhJcahP.exe
  C:\Windows\System\LhJcahP.exe
  2⤵
  PID:5192
- C:\Windows\System\DLEkeJc.exe
  C:\Windows\System\DLEkeJc.exe
  2⤵
  PID:5440
- C:\Windows\System\Vynzfub.exe
  C:\Windows\System\Vynzfub.exe
  2⤵
  PID:5400
- C:\Windows\System\qoGpfLM.exe
  C:\Windows\System\qoGpfLM.exe
  2⤵
  PID:5348
- C:\Windows\System\ntYdgDc.exe
  C:\Windows\System\ntYdgDc.exe
  2⤵
  PID:5312
- C:\Windows\System\qJytDcq.exe
  C:\Windows\System\qJytDcq.exe
  2⤵
  PID:5264
- C:\Windows\System\mxApCZh.exe
  C:\Windows\System\mxApCZh.exe
  2⤵
  PID:5232
- C:\Windows\System\GtApSwJ.exe
  C:\Windows\System\GtApSwJ.exe
  2⤵
  PID:5516
- C:\Windows\System\GVPAkiF.exe
  C:\Windows\System\GVPAkiF.exe
  2⤵
  PID:5560
- C:\Windows\System\NynpcOr.exe
  C:\Windows\System\NynpcOr.exe
  2⤵
  PID:5656
- C:\Windows\System\HZqpiLr.exe
  C:\Windows\System\HZqpiLr.exe
  2⤵
  PID:5700
- C:\Windows\System\NUEDNlP.exe
  C:\Windows\System\NUEDNlP.exe
  2⤵
  PID:5740
- C:\Windows\System\MVdJxTG.exe
  C:\Windows\System\MVdJxTG.exe
  2⤵
  PID:5792
- C:\Windows\System\NJiwCvU.exe
  C:\Windows\System\NJiwCvU.exe
  2⤵
  PID:5832
- C:\Windows\System\IIuDGZs.exe
  C:\Windows\System\IIuDGZs.exe
  2⤵
  PID:5876
- C:\Windows\System\hTqZhEw.exe
  C:\Windows\System\hTqZhEw.exe
  2⤵
  PID:3188
- C:\Windows\System\JmedZiM.exe
  C:\Windows\System\JmedZiM.exe
  2⤵
  PID:3368
- C:\Windows\System\prIcIXo.exe
  C:\Windows\System\prIcIXo.exe
  2⤵
  PID:3048
- C:\Windows\System\CkdUFVD.exe
  C:\Windows\System\CkdUFVD.exe
  2⤵
  PID:6148
- C:\Windows\System\mbfxeFf.exe
  C:\Windows\System\mbfxeFf.exe
  2⤵
  PID:6168
- C:\Windows\System\xnuBLEF.exe
  C:\Windows\System\xnuBLEF.exe
  2⤵
  PID:6192
- C:\Windows\System\knnfmhk.exe
  C:\Windows\System\knnfmhk.exe
  2⤵
  PID:6212
- C:\Windows\System\SIzlERL.exe
  C:\Windows\System\SIzlERL.exe
  2⤵
  PID:6232
- C:\Windows\System\KmIfNFD.exe
  C:\Windows\System\KmIfNFD.exe
  2⤵
  PID:6256
- C:\Windows\System\lORZTAA.exe
  C:\Windows\System\lORZTAA.exe
  2⤵
  PID:6272
- C:\Windows\System\CEIAheX.exe
  C:\Windows\System\CEIAheX.exe
  2⤵
  PID:6296
- C:\Windows\System\XyPVDZJ.exe
  C:\Windows\System\XyPVDZJ.exe
  2⤵
  PID:6328
- C:\Windows\System\hPvuLoS.exe
  C:\Windows\System\hPvuLoS.exe
  2⤵
  PID:6344
- C:\Windows\System\HyqpwoP.exe
  C:\Windows\System\HyqpwoP.exe
  2⤵
  PID:6364
- C:\Windows\System\DXeQRfu.exe
  C:\Windows\System\DXeQRfu.exe
  2⤵
  PID:6380
- C:\Windows\System\tOLNyEY.exe
  C:\Windows\System\tOLNyEY.exe
  2⤵
  PID:6404
- C:\Windows\System\qZwqylc.exe
  C:\Windows\System\qZwqylc.exe
  2⤵
  PID:6512
- C:\Windows\System\KsiDEGB.exe
  C:\Windows\System\KsiDEGB.exe
  2⤵
  PID:6528
- C:\Windows\System\jTIjltx.exe
  C:\Windows\System\jTIjltx.exe
  2⤵
  PID:6544
- C:\Windows\System\rEWxECl.exe
  C:\Windows\System\rEWxECl.exe
  2⤵
  PID:6560
- C:\Windows\System\wlPjXET.exe
  C:\Windows\System\wlPjXET.exe
  2⤵
  PID:6580
- C:\Windows\System\kpJhRkr.exe
  C:\Windows\System\kpJhRkr.exe
  2⤵
  PID:6604
- C:\Windows\System\ipbCKMH.exe
  C:\Windows\System\ipbCKMH.exe
  2⤵
  PID:6620
- C:\Windows\System\ZvZAlDF.exe
  C:\Windows\System\ZvZAlDF.exe
  2⤵
  PID:6640
- C:\Windows\System\iyOHbZA.exe
  C:\Windows\System\iyOHbZA.exe
  2⤵
  PID:6664
- C:\Windows\System\qKnYpwB.exe
  C:\Windows\System\qKnYpwB.exe
  2⤵
  PID:6692
- C:\Windows\System\EKcBqsP.exe
  C:\Windows\System\EKcBqsP.exe
  2⤵
  PID:6708
- C:\Windows\System\OiMUVwa.exe
  C:\Windows\System\OiMUVwa.exe
  2⤵
  PID:6808
- C:\Windows\System\HpCFjkr.exe
  C:\Windows\System\HpCFjkr.exe
  2⤵
  PID:6832
- C:\Windows\System\NwjLMgr.exe
  C:\Windows\System\NwjLMgr.exe
  2⤵
  PID:6944
- C:\Windows\System\OqRmhsa.exe
  C:\Windows\System\OqRmhsa.exe
  2⤵
  PID:6996
- C:\Windows\System\LqSBfTi.exe
  C:\Windows\System\LqSBfTi.exe
  2⤵
  PID:7012
- C:\Windows\System\UnBEDiV.exe
  C:\Windows\System\UnBEDiV.exe
  2⤵
  PID:7028
- C:\Windows\System\QkfRMxU.exe
  C:\Windows\System\QkfRMxU.exe
  2⤵
  PID:7044
- C:\Windows\System\UERgbEN.exe
  C:\Windows\System\UERgbEN.exe
  2⤵
  PID:7060
- C:\Windows\System\pcmzsAD.exe
  C:\Windows\System\pcmzsAD.exe
  2⤵
  PID:7076
- C:\Windows\System\VVlQPem.exe
  C:\Windows\System\VVlQPem.exe
  2⤵
  PID:7092
- C:\Windows\System\VtghlrV.exe
  C:\Windows\System\VtghlrV.exe
  2⤵
  PID:7108
- C:\Windows\System\ByoWTYU.exe
  C:\Windows\System\ByoWTYU.exe
  2⤵
  PID:7124
- C:\Windows\System\GSKvqfP.exe
  C:\Windows\System\GSKvqfP.exe
  2⤵
  PID:7140
- C:\Windows\System\qzUjQaj.exe
  C:\Windows\System\qzUjQaj.exe
  2⤵
  PID:7156
- C:\Windows\System\dGcReCL.exe
  C:\Windows\System\dGcReCL.exe
  2⤵
  PID:760
- C:\Windows\System\QnmwYKA.exe
  C:\Windows\System\QnmwYKA.exe
  2⤵
  PID:4628
- C:\Windows\System\mXTKfPZ.exe
  C:\Windows\System\mXTKfPZ.exe
  2⤵
  PID:3276
- C:\Windows\System\gyRPbey.exe
  C:\Windows\System\gyRPbey.exe
  2⤵
  PID:5472
- C:\Windows\System\eXkMJYP.exe
  C:\Windows\System\eXkMJYP.exe
  2⤵
  PID:6224
- C:\Windows\System\TjoYTLn.exe
  C:\Windows\System\TjoYTLn.exe
  2⤵
  PID:6308
- C:\Windows\System\HXaykaI.exe
  C:\Windows\System\HXaykaI.exe
  2⤵
  PID:5360
- C:\Windows\System\vcUtfmk.exe
  C:\Windows\System\vcUtfmk.exe
  2⤵
  PID:6400
- C:\Windows\System\ZoYBkXV.exe
  C:\Windows\System\ZoYBkXV.exe
  2⤵
  PID:5328
- C:\Windows\System\CUrupeU.exe
  C:\Windows\System\CUrupeU.exe
  2⤵
  PID:5212
- C:\Windows\System\VuMMkkZ.exe
  C:\Windows\System\VuMMkkZ.exe
  2⤵
  PID:5604
- C:\Windows\System\LqZJWVW.exe
  C:\Windows\System\LqZJWVW.exe
  2⤵
  PID:5680
- C:\Windows\System\AWJKxiM.exe
  C:\Windows\System\AWJKxiM.exe
  2⤵
  PID:5788
- C:\Windows\System\kjqDRfU.exe
  C:\Windows\System\kjqDRfU.exe
  2⤵
  PID:6720
- C:\Windows\System\GicQJvN.exe
  C:\Windows\System\GicQJvN.exe
  2⤵
  PID:4500
- C:\Windows\System\umUbntw.exe
  C:\Windows\System\umUbntw.exe
  2⤵
  PID:5896
- C:\Windows\System\EXEMqnM.exe
  C:\Windows\System\EXEMqnM.exe
  2⤵
  PID:6228
- C:\Windows\System\SYVWmIR.exe
  C:\Windows\System\SYVWmIR.exe
  2⤵
  PID:6280
- C:\Windows\System\huZPGib.exe
  C:\Windows\System\huZPGib.exe
  2⤵
  PID:6360
- C:\Windows\System\ZJRjkpO.exe
  C:\Windows\System\ZJRjkpO.exe
  2⤵
  PID:4888
- C:\Windows\System\johDawc.exe
  C:\Windows\System\johDawc.exe
  2⤵
  PID:6552
- C:\Windows\System\zmvuppu.exe
  C:\Windows\System\zmvuppu.exe
  2⤵
  PID:6588
- C:\Windows\System\zxPgMfw.exe
  C:\Windows\System\zxPgMfw.exe
  2⤵
  PID:6688
- C:\Windows\System\aszaxFw.exe
  C:\Windows\System\aszaxFw.exe
  2⤵
  PID:6756
- C:\Windows\System\ZamOzaq.exe
  C:\Windows\System\ZamOzaq.exe
  2⤵
  PID:6788
- C:\Windows\System\PCKOdzq.exe
  C:\Windows\System\PCKOdzq.exe
  2⤵
  PID:6952
- C:\Windows\System\AcoByIv.exe
  C:\Windows\System\AcoByIv.exe
  2⤵
  PID:5776
- C:\Windows\System\vdydfXQ.exe
  C:\Windows\System\vdydfXQ.exe
  2⤵
  PID:6888
- C:\Windows\System\WrgMvNp.exe
  C:\Windows\System\WrgMvNp.exe
  2⤵
  PID:6920
- C:\Windows\System\GVeLmMP.exe
  C:\Windows\System\GVeLmMP.exe
  2⤵
  PID:6252
- C:\Windows\System\TbQpWJT.exe
  C:\Windows\System\TbQpWJT.exe
  2⤵
  PID:6488
- C:\Windows\System\ggiNMzw.exe
  C:\Windows\System\ggiNMzw.exe
  2⤵
  PID:7020
- C:\Windows\System\QVcDiPg.exe
  C:\Windows\System\QVcDiPg.exe
  2⤵
  PID:7184
- C:\Windows\System\cluDjDg.exe
  C:\Windows\System\cluDjDg.exe
  2⤵
  PID:7208
- C:\Windows\System\fuYVODh.exe
  C:\Windows\System\fuYVODh.exe
  2⤵
  PID:7224
- C:\Windows\System\cTaoDvq.exe
  C:\Windows\System\cTaoDvq.exe
  2⤵
  PID:7248
- C:\Windows\System\gdgLkRx.exe
  C:\Windows\System\gdgLkRx.exe
  2⤵
  PID:7272
- C:\Windows\System\hYQZWZf.exe
  C:\Windows\System\hYQZWZf.exe
  2⤵
  PID:7288
- C:\Windows\System\AzQtDEX.exe
  C:\Windows\System\AzQtDEX.exe
  2⤵
  PID:7312
- C:\Windows\System\dFIVeaA.exe
  C:\Windows\System\dFIVeaA.exe
  2⤵
  PID:7340
- C:\Windows\System\pXWeiRZ.exe
  C:\Windows\System\pXWeiRZ.exe
  2⤵
  PID:7360
- C:\Windows\System\bGIgNYL.exe
  C:\Windows\System\bGIgNYL.exe
  2⤵
  PID:7392
- C:\Windows\System\aCeMtYE.exe
  C:\Windows\System\aCeMtYE.exe
  2⤵
  PID:7412
- C:\Windows\System\vZVXMsV.exe
  C:\Windows\System\vZVXMsV.exe
  2⤵
  PID:7432
- C:\Windows\System\gtWLXqr.exe
  C:\Windows\System\gtWLXqr.exe
  2⤵
  PID:7456
- C:\Windows\System\RMUOFAS.exe
  C:\Windows\System\RMUOFAS.exe
  2⤵
  PID:7472
- C:\Windows\System\RwFOFSH.exe
  C:\Windows\System\RwFOFSH.exe
  2⤵
  PID:7500
- C:\Windows\System\dLWThnA.exe
  C:\Windows\System\dLWThnA.exe
  2⤵
  PID:7632
- C:\Windows\System\eVKZuvI.exe
  C:\Windows\System\eVKZuvI.exe
  2⤵
  PID:7648
- C:\Windows\System\QrdoVKF.exe
  C:\Windows\System\QrdoVKF.exe
  2⤵
  PID:7668
- C:\Windows\System\NfBpzRF.exe
  C:\Windows\System\NfBpzRF.exe
  2⤵
  PID:7684
- C:\Windows\System\fyzwvJI.exe
  C:\Windows\System\fyzwvJI.exe
  2⤵
  PID:7708
- C:\Windows\System\BPUdyDf.exe
  C:\Windows\System\BPUdyDf.exe
  2⤵
  PID:7732
- C:\Windows\System\uhdcLVs.exe
  C:\Windows\System\uhdcLVs.exe
  2⤵
  PID:7756
- C:\Windows\System\IhFmJNq.exe
  C:\Windows\System\IhFmJNq.exe
  2⤵
  PID:7856
- C:\Windows\System\bVUMdBc.exe
  C:\Windows\System\bVUMdBc.exe
  2⤵
  PID:7872
- C:\Windows\System\rPsFClh.exe
  C:\Windows\System\rPsFClh.exe
  2⤵
  PID:7896
- C:\Windows\System\vvtxSpi.exe
  C:\Windows\System\vvtxSpi.exe
  2⤵
  PID:7920
- C:\Windows\System\asRdBjj.exe
  C:\Windows\System\asRdBjj.exe
  2⤵
  PID:7944
- C:\Windows\System\gpLQsrn.exe
  C:\Windows\System\gpLQsrn.exe
  2⤵
  PID:7960
- C:\Windows\System\xXqhZgB.exe
  C:\Windows\System\xXqhZgB.exe
  2⤵
  PID:8072
- C:\Windows\System\CDkIgAh.exe
  C:\Windows\System\CDkIgAh.exe
  2⤵
  PID:8088
- C:\Windows\System\oQXRVMd.exe
  C:\Windows\System\oQXRVMd.exe
  2⤵
  PID:8112
- C:\Windows\System\sEOqfwc.exe
  C:\Windows\System\sEOqfwc.exe
  2⤵
  PID:8136
- C:\Windows\System\DLafHXH.exe
  C:\Windows\System\DLafHXH.exe
  2⤵
  PID:8160
- C:\Windows\System\NuwRajR.exe
  C:\Windows\System\NuwRajR.exe
  2⤵
  PID:7036
- C:\Windows\System\jQdSFbw.exe
  C:\Windows\System\jQdSFbw.exe
  2⤵
  PID:7068
- C:\Windows\System\raCLAnA.exe
  C:\Windows\System\raCLAnA.exe
  2⤵
  PID:7104
- C:\Windows\System\HGfJgXz.exe
  C:\Windows\System\HGfJgXz.exe
  2⤵
  PID:7136
- C:\Windows\System\PuoqMon.exe
  C:\Windows\System\PuoqMon.exe
  2⤵
  PID:7164
- C:\Windows\System\cOdOMIH.exe
  C:\Windows\System\cOdOMIH.exe
  2⤵
  PID:2828
- C:\Windows\System\QVMIdMQ.exe
  C:\Windows\System\QVMIdMQ.exe
  2⤵
  PID:6204
- C:\Windows\System\UTIfLrH.exe
  C:\Windows\System\UTIfLrH.exe
  2⤵
  PID:5376
- C:\Windows\System\CgdyTbA.exe
  C:\Windows\System\CgdyTbA.exe
  2⤵
  PID:6424
- C:\Windows\System\WgDAUhh.exe
  C:\Windows\System\WgDAUhh.exe
  2⤵
  PID:5500
- C:\Windows\System\kVmieNz.exe
  C:\Windows\System\kVmieNz.exe
  2⤵
  PID:6536
- C:\Windows\System\zxyheld.exe
  C:\Windows\System\zxyheld.exe
  2⤵
  PID:6600
- C:\Windows\System\jOjtysZ.exe
  C:\Windows\System\jOjtysZ.exe
  2⤵
  PID:6684
- C:\Windows\System\qsxAuIN.exe
  C:\Windows\System\qsxAuIN.exe
  2⤵
  PID:6780
- C:\Windows\System\MtXTdud.exe
  C:\Windows\System\MtXTdud.exe
  2⤵
  PID:212
- C:\Windows\System\BAmOCBb.exe
  C:\Windows\System\BAmOCBb.exe
  2⤵
  PID:6940
- C:\Windows\System\pzBfBGL.exe
  C:\Windows\System\pzBfBGL.exe
  2⤵
  PID:7004
- C:\Windows\System\ZkXDeRA.exe
  C:\Windows\System\ZkXDeRA.exe
  2⤵
  PID:7196
- C:\Windows\System\duCQZbo.exe
  C:\Windows\System\duCQZbo.exe
  2⤵
  PID:7244
- C:\Windows\System\ztQlixG.exe
  C:\Windows\System\ztQlixG.exe
  2⤵
  PID:7284
- C:\Windows\System\EmWgqkH.exe
  C:\Windows\System\EmWgqkH.exe
  2⤵
  PID:7324
- C:\Windows\System\OmwpVwg.exe
  C:\Windows\System\OmwpVwg.exe
  2⤵
  PID:7368
- C:\Windows\System\Seomquu.exe
  C:\Windows\System\Seomquu.exe
  2⤵
  PID:7400
- C:\Windows\System\EKgAKbs.exe
  C:\Windows\System\EKgAKbs.exe
  2⤵
  PID:7904
- C:\Windows\System\LDojqdN.exe
  C:\Windows\System\LDojqdN.exe
  2⤵
  PID:7544
- C:\Windows\System\luLFHez.exe
  C:\Windows\System\luLFHez.exe
  2⤵
  PID:7624
- C:\Windows\System\IUnNufE.exe
  C:\Windows\System\IUnNufE.exe
  2⤵
  PID:7676
- C:\Windows\System\tUCZXnR.exe
  C:\Windows\System\tUCZXnR.exe
  2⤵
  PID:7700
- C:\Windows\System\rmWkcQm.exe
  C:\Windows\System\rmWkcQm.exe
  2⤵
  PID:7864
- C:\Windows\System\YJSBqLq.exe
  C:\Windows\System\YJSBqLq.exe
  2⤵
  PID:3320
- C:\Windows\System\NroBilV.exe
  C:\Windows\System\NroBilV.exe
  2⤵
  PID:8196
- C:\Windows\System\QArqODz.exe
  C:\Windows\System\QArqODz.exe
  2⤵
  PID:8216
- C:\Windows\System\XbzZlfG.exe
  C:\Windows\System\XbzZlfG.exe
  2⤵
  PID:8240
- C:\Windows\System\kQgEnaW.exe
  C:\Windows\System\kQgEnaW.exe
  2⤵
  PID:8260
- C:\Windows\System\sazXepC.exe
  C:\Windows\System\sazXepC.exe
  2⤵
  PID:8280
- C:\Windows\System\CxRHJNg.exe
  C:\Windows\System\CxRHJNg.exe
  2⤵
  PID:8304
- C:\Windows\System\nkCqlAD.exe
  C:\Windows\System\nkCqlAD.exe
  2⤵
  PID:8320
- C:\Windows\System\MAmZjsp.exe
  C:\Windows\System\MAmZjsp.exe
  2⤵
  PID:8340
- C:\Windows\System\CrmULyS.exe
  C:\Windows\System\CrmULyS.exe
  2⤵
  PID:8356
- C:\Windows\System\vqfejlw.exe
  C:\Windows\System\vqfejlw.exe
  2⤵
  PID:8372
- C:\Windows\System\cqgkyPv.exe
  C:\Windows\System\cqgkyPv.exe
  2⤵
  PID:8392
- C:\Windows\System\WLZFNxQ.exe
  C:\Windows\System\WLZFNxQ.exe
  2⤵
  PID:8416
- C:\Windows\System\CxwFkWO.exe
  C:\Windows\System\CxwFkWO.exe
  2⤵
  PID:8492
- C:\Windows\System\deCsUVV.exe
  C:\Windows\System\deCsUVV.exe
  2⤵
  PID:8512
- C:\Windows\System\XWtSTaM.exe
  C:\Windows\System\XWtSTaM.exe
  2⤵
  PID:8540
- C:\Windows\System\hxjQXUz.exe
  C:\Windows\System\hxjQXUz.exe
  2⤵
  PID:8560
- C:\Windows\System\GcYZDnZ.exe
  C:\Windows\System\GcYZDnZ.exe
  2⤵
  PID:8580
- C:\Windows\System\SDGrmwS.exe
  C:\Windows\System\SDGrmwS.exe
  2⤵
  PID:8600
- C:\Windows\System\iNJmXEs.exe
  C:\Windows\System\iNJmXEs.exe
  2⤵
  PID:8620
- C:\Windows\System\rmccdJI.exe
  C:\Windows\System\rmccdJI.exe
  2⤵
  PID:8640
- C:\Windows\System\kauPhIf.exe
  C:\Windows\System\kauPhIf.exe
  2⤵
  PID:8664
- C:\Windows\System\PYVmlCA.exe
  C:\Windows\System\PYVmlCA.exe
  2⤵
  PID:8680
- C:\Windows\System\yPSPiLY.exe
  C:\Windows\System\yPSPiLY.exe
  2⤵
  PID:8700
- C:\Windows\System\tAhApgx.exe
  C:\Windows\System\tAhApgx.exe
  2⤵
  PID:8724
- C:\Windows\System\EcGDnnN.exe
  C:\Windows\System\EcGDnnN.exe
  2⤵
  PID:8764
- C:\Windows\System\PnSRivc.exe
  C:\Windows\System\PnSRivc.exe
  2⤵
  PID:8780
- C:\Windows\System\wlkWtNM.exe
  C:\Windows\System\wlkWtNM.exe
  2⤵
  PID:8804
- C:\Windows\System\pljSqSE.exe
  C:\Windows\System\pljSqSE.exe
  2⤵
  PID:8820
- C:\Windows\System\zxaoWCm.exe
  C:\Windows\System\zxaoWCm.exe
  2⤵
  PID:8844
- C:\Windows\System\vTEsuNG.exe
  C:\Windows\System\vTEsuNG.exe
  2⤵
  PID:8868
- C:\Windows\System\IoVzuld.exe
  C:\Windows\System\IoVzuld.exe
  2⤵
  PID:8888
- C:\Windows\System\xqSPWPB.exe
  C:\Windows\System\xqSPWPB.exe
  2⤵
  PID:8912
- C:\Windows\System\cePHlaD.exe
  C:\Windows\System\cePHlaD.exe
  2⤵
  PID:8936
- C:\Windows\System\VzYiXzx.exe
  C:\Windows\System\VzYiXzx.exe
  2⤵
  PID:8956
- C:\Windows\System\UTJQwHg.exe
  C:\Windows\System\UTJQwHg.exe
  2⤵
  PID:8980
- C:\Windows\System\KGHYDzs.exe
  C:\Windows\System\KGHYDzs.exe
  2⤵
  PID:9004
- C:\Windows\System\PJPxYhN.exe
  C:\Windows\System\PJPxYhN.exe
  2⤵
  PID:9036
- C:\Windows\System\vDFYjhh.exe
  C:\Windows\System\vDFYjhh.exe
  2⤵
  PID:9056
- C:\Windows\System\nkCnSKr.exe
  C:\Windows\System\nkCnSKr.exe
  2⤵
  PID:9120
- C:\Windows\System\yxmzvcY.exe
  C:\Windows\System\yxmzvcY.exe
  2⤵
  PID:9144
- C:\Windows\System\qPMtLXs.exe
  C:\Windows\System\qPMtLXs.exe
  2⤵
  PID:9164
- C:\Windows\System\jVJBdoE.exe
  C:\Windows\System\jVJBdoE.exe
  2⤵
  PID:9184
- C:\Windows\System\dgmBuIe.exe
  C:\Windows\System\dgmBuIe.exe
  2⤵
  PID:9212
- C:\Windows\System\uHebszN.exe
  C:\Windows\System\uHebszN.exe
  2⤵
  PID:6396
- C:\Windows\System\BHnXlCE.exe
  C:\Windows\System\BHnXlCE.exe
  2⤵
  PID:5812
- C:\Windows\System\zJOwsLH.exe
  C:\Windows\System\zJOwsLH.exe
  2⤵
  PID:8040
- C:\Windows\System\tTFdsOo.exe
  C:\Windows\System\tTFdsOo.exe
  2⤵
  PID:8084
- C:\Windows\System\HZbJQar.exe
  C:\Windows\System\HZbJQar.exe
  2⤵
  PID:332
- C:\Windows\System\AlJXyTb.exe
  C:\Windows\System\AlJXyTb.exe
  2⤵
  PID:2104
- C:\Windows\System\PUYcJox.exe
  C:\Windows\System\PUYcJox.exe
  2⤵
  PID:8276
- C:\Windows\System\vhFCgHj.exe
  C:\Windows\System\vhFCgHj.exe
  2⤵
  PID:8352
- C:\Windows\System\fUAKuze.exe
  C:\Windows\System\fUAKuze.exe
  2⤵
  PID:4228
- C:\Windows\System\yGNlcqZ.exe
  C:\Windows\System\yGNlcqZ.exe
  2⤵
  PID:4904
- C:\Windows\System\qHShzVO.exe
  C:\Windows\System\qHShzVO.exe
  2⤵
  PID:6576
- C:\Windows\System\CqVjstc.exe
  C:\Windows\System\CqVjstc.exe
  2⤵
  PID:6824
- C:\Windows\System\tiXnMqm.exe
  C:\Windows\System\tiXnMqm.exe
  2⤵
  PID:6356
- C:\Windows\System\UmswueV.exe
  C:\Windows\System\UmswueV.exe
  2⤵
  PID:7232
- C:\Windows\System\UFHfjlJ.exe
  C:\Windows\System\UFHfjlJ.exe
  2⤵
  PID:7308
- C:\Windows\System\OtkSDgh.exe
  C:\Windows\System\OtkSDgh.exe
  2⤵
  PID:1368
- C:\Windows\System\raMXZtF.exe
  C:\Windows\System\raMXZtF.exe
  2⤵
  PID:4992
- C:\Windows\System\tKgyTob.exe
  C:\Windows\System\tKgyTob.exe
  2⤵
  PID:8636
- C:\Windows\System\rajBMAr.exe
  C:\Windows\System\rajBMAr.exe
  2⤵
  PID:1588
- C:\Windows\System\tewJgGP.exe
  C:\Windows\System\tewJgGP.exe
  2⤵
  PID:8836
- C:\Windows\System\SfiBlfQ.exe
  C:\Windows\System\SfiBlfQ.exe
  2⤵
  PID:8884
- C:\Windows\System\oMZkxHl.exe
  C:\Windows\System\oMZkxHl.exe
  2⤵
  PID:8924
- C:\Windows\System\QKhNFJK.exe
  C:\Windows\System\QKhNFJK.exe
  2⤵
  PID:3976
- C:\Windows\System\ZfgKCDZ.exe
  C:\Windows\System\ZfgKCDZ.exe
  2⤵
  PID:7804
- C:\Windows\System\czrBbEt.exe
  C:\Windows\System\czrBbEt.exe
  2⤵
  PID:880
- C:\Windows\System\DJVrvTR.exe
  C:\Windows\System\DJVrvTR.exe
  2⤵
  PID:8252
- C:\Windows\System\SWBlCJk.exe
  C:\Windows\System\SWBlCJk.exe
  2⤵
  PID:8592
- C:\Windows\System\gUOAGOX.exe
  C:\Windows\System\gUOAGOX.exe
  2⤵
  PID:9156
- C:\Windows\System\zFhOsbq.exe
  C:\Windows\System\zFhOsbq.exe
  2⤵
  PID:9208
- C:\Windows\System\WisxrGJ.exe
  C:\Windows\System\WisxrGJ.exe
  2⤵
  PID:8080
- C:\Windows\System\KERbuTz.exe
  C:\Windows\System\KERbuTz.exe
  2⤵
  PID:8428
- C:\Windows\System\kwGabJr.exe
  C:\Windows\System\kwGabJr.exe
  2⤵
  PID:9232
- C:\Windows\System\lRbFJus.exe
  C:\Windows\System\lRbFJus.exe
  2⤵
  PID:9256
- C:\Windows\System\lRvmOmK.exe
  C:\Windows\System\lRvmOmK.exe
  2⤵
  PID:9276
- C:\Windows\System\NJugyTA.exe
  C:\Windows\System\NJugyTA.exe
  2⤵
  PID:9300
- C:\Windows\System\GjIEuNS.exe
  C:\Windows\System\GjIEuNS.exe
  2⤵
  PID:9316
- C:\Windows\System\eOxHDbL.exe
  C:\Windows\System\eOxHDbL.exe
  2⤵
  PID:9340
- C:\Windows\System\eHqZwEL.exe
  C:\Windows\System\eHqZwEL.exe
  2⤵
  PID:9368
- C:\Windows\System\aeElneX.exe
  C:\Windows\System\aeElneX.exe
  2⤵
  PID:9388
- C:\Windows\System\zpgOyRA.exe
  C:\Windows\System\zpgOyRA.exe
  2⤵
  PID:9408
- C:\Windows\System\ySXGbtd.exe
  C:\Windows\System\ySXGbtd.exe
  2⤵
  PID:9428
- C:\Windows\System\kqNiuES.exe
  C:\Windows\System\kqNiuES.exe
  2⤵
  PID:9452
- C:\Windows\System\ObpdUoj.exe
  C:\Windows\System\ObpdUoj.exe
  2⤵
  PID:9480
- C:\Windows\System\GFoWszk.exe
  C:\Windows\System\GFoWszk.exe
  2⤵
  PID:9500
- C:\Windows\System\aCzKXhT.exe
  C:\Windows\System\aCzKXhT.exe
  2⤵
  PID:9524
- C:\Windows\System\vNEJuJC.exe
  C:\Windows\System\vNEJuJC.exe
  2⤵
  PID:9548
- C:\Windows\System\nGVuAWC.exe
  C:\Windows\System\nGVuAWC.exe
  2⤵
  PID:9564
- C:\Windows\System\oQysgNu.exe
  C:\Windows\System\oQysgNu.exe
  2⤵
  PID:9584
- C:\Windows\System\CHDysMK.exe
  C:\Windows\System\CHDysMK.exe
  2⤵
  PID:9620
- C:\Windows\System\qJWFGWd.exe
  C:\Windows\System\qJWFGWd.exe
  2⤵
  PID:9636
- C:\Windows\System\UVQdOig.exe
  C:\Windows\System\UVQdOig.exe
  2⤵
  PID:9656
- C:\Windows\System\WFzLbLI.exe
  C:\Windows\System\WFzLbLI.exe
  2⤵
  PID:9688
- C:\Windows\System\vviOSfR.exe
  C:\Windows\System\vviOSfR.exe
  2⤵
  PID:9708
- C:\Windows\System\WJAjsrD.exe
  C:\Windows\System\WJAjsrD.exe
  2⤵
  PID:9732
- C:\Windows\System\XAAShzQ.exe
  C:\Windows\System\XAAShzQ.exe
  2⤵
  PID:9752
- C:\Windows\System\NaJGhrr.exe
  C:\Windows\System\NaJGhrr.exe
  2⤵
  PID:9776
- C:\Windows\System\HiXANvN.exe
  C:\Windows\System\HiXANvN.exe
  2⤵
  PID:9796
- C:\Windows\System\ioeiiYh.exe
  C:\Windows\System\ioeiiYh.exe
  2⤵
  PID:9816
- C:\Windows\System\kJHmejr.exe
  C:\Windows\System\kJHmejr.exe
  2⤵
  PID:9840
- C:\Windows\System\reIOuTS.exe
  C:\Windows\System\reIOuTS.exe
  2⤵
  PID:9860
- C:\Windows\System\XXUIHRd.exe
  C:\Windows\System\XXUIHRd.exe
  2⤵
  PID:9876
- C:\Windows\System\CjLWqBu.exe
  C:\Windows\System\CjLWqBu.exe
  2⤵
  PID:9896
- C:\Windows\System\xnYINPh.exe
  C:\Windows\System\xnYINPh.exe
  2⤵
  PID:9920
- C:\Windows\System\WniSmMt.exe
  C:\Windows\System\WniSmMt.exe
  2⤵
  PID:9948
- C:\Windows\System\UQMwxgO.exe
  C:\Windows\System\UQMwxgO.exe
  2⤵
  PID:9968
- C:\Windows\System\SZdCGIn.exe
  C:\Windows\System\SZdCGIn.exe
  2⤵
  PID:9988
- C:\Windows\System\OnmRGYn.exe
  C:\Windows\System\OnmRGYn.exe
  2⤵
  PID:10008
- C:\Windows\System\ghJswjH.exe
  C:\Windows\System\ghJswjH.exe
  2⤵
  PID:10028
- C:\Windows\System\XZaSZCw.exe
  C:\Windows\System\XZaSZCw.exe
  2⤵
  PID:10048
- C:\Windows\System\zHKownG.exe
  C:\Windows\System\zHKownG.exe
  2⤵
  PID:10084
- C:\Windows\System\RMYvpJV.exe
  C:\Windows\System\RMYvpJV.exe
  2⤵
  PID:10108
- C:\Windows\System\CgTXHoY.exe
  C:\Windows\System\CgTXHoY.exe
  2⤵
  PID:10132
- C:\Windows\System\nVxDyxu.exe
  C:\Windows\System\nVxDyxu.exe
  2⤵
  PID:10156
- C:\Windows\System\qyVTiXt.exe
  C:\Windows\System\qyVTiXt.exe
  2⤵
  PID:10176
- C:\Windows\System\jOcjopj.exe
  C:\Windows\System\jOcjopj.exe
  2⤵
  PID:10192
- C:\Windows\System\YyynJEP.exe
  C:\Windows\System\YyynJEP.exe
  2⤵
  PID:10216
- C:\Windows\System\pGzFNVk.exe
  C:\Windows\System\pGzFNVk.exe
  2⤵
  PID:10232
- C:\Windows\System\wjmRHKw.exe
  C:\Windows\System\wjmRHKw.exe
  2⤵
  PID:5028
- C:\Windows\System\AIbemVR.exe
  C:\Windows\System\AIbemVR.exe
  2⤵
  PID:8348
- C:\Windows\System\uRIkAab.exe
  C:\Windows\System\uRIkAab.exe
  2⤵
  PID:3096
- C:\Windows\System\PQdQaDn.exe
  C:\Windows\System\PQdQaDn.exe
  2⤵
  PID:7192
- C:\Windows\System\erDHrkd.exe
  C:\Windows\System\erDHrkd.exe
  2⤵
  PID:8976
- C:\Windows\System\uOTwMUZ.exe
  C:\Windows\System\uOTwMUZ.exe
  2⤵
  PID:8476
- C:\Windows\System\aXuXWhA.exe
  C:\Windows\System\aXuXWhA.exe
  2⤵
  PID:8528
- C:\Windows\System\QYePJcB.exe
  C:\Windows\System\QYePJcB.exe
  2⤵
  PID:8568
- C:\Windows\System\NSNaMgR.exe
  C:\Windows\System\NSNaMgR.exe
  2⤵
  PID:8904
- C:\Windows\System\ooPBWZL.exe
  C:\Windows\System\ooPBWZL.exe
  2⤵
  PID:9020
- C:\Windows\System\dIjVELt.exe
  C:\Windows\System\dIjVELt.exe
  2⤵
  PID:8228
- C:\Windows\System\WsRVbNk.exe
  C:\Windows\System\WsRVbNk.exe
  2⤵
  PID:2404
- C:\Windows\System\LIQzmkD.exe
  C:\Windows\System\LIQzmkD.exe
  2⤵
  PID:8748
- C:\Windows\System\BdwefVd.exe
  C:\Windows\System\BdwefVd.exe
  2⤵
  PID:8156
- C:\Windows\System\KUPfmFl.exe
  C:\Windows\System\KUPfmFl.exe
  2⤵
  PID:7100
- C:\Windows\System\ChFcrDy.exe
  C:\Windows\System\ChFcrDy.exe
  2⤵
  PID:8812
- C:\Windows\System\frgocux.exe
  C:\Windows\System\frgocux.exe
  2⤵
  PID:9336
- C:\Windows\System\NeEETbh.exe
  C:\Windows\System\NeEETbh.exe
  2⤵
  PID:9376
- C:\Windows\System\mvYDdLd.exe
  C:\Windows\System\mvYDdLd.exe
  2⤵
  PID:7280
- C:\Windows\System\qRUAqTq.exe
  C:\Windows\System\qRUAqTq.exe
  2⤵
  PID:9044
- C:\Windows\System\ghsZOsh.exe
  C:\Windows\System\ghsZOsh.exe
  2⤵
  PID:9048
- C:\Windows\System\XaZuPIU.exe
  C:\Windows\System\XaZuPIU.exe
  2⤵
  PID:2600
- C:\Windows\System\tkManWu.exe
  C:\Windows\System\tkManWu.exe
  2⤵
  PID:9112
- C:\Windows\System\PGhWNbO.exe
  C:\Windows\System\PGhWNbO.exe
  2⤵
  PID:6388
- C:\Windows\System\vkjkSMD.exe
  C:\Windows\System\vkjkSMD.exe
  2⤵
  PID:9696
- C:\Windows\System\WwioPKf.exe
  C:\Windows\System\WwioPKf.exe
  2⤵
  PID:8024
- C:\Windows\System\hPKVRhK.exe
  C:\Windows\System\hPKVRhK.exe
  2⤵
  PID:8120
- C:\Windows\System\vFpHixr.exe
  C:\Windows\System\vFpHixr.exe
  2⤵
  PID:10252
- C:\Windows\System\pypTYqQ.exe
  C:\Windows\System\pypTYqQ.exe
  2⤵
  PID:10272
- C:\Windows\System\kwIDrdm.exe
  C:\Windows\System\kwIDrdm.exe
  2⤵
  PID:10296
- C:\Windows\System\OOHeMYM.exe
  C:\Windows\System\OOHeMYM.exe
  2⤵
  PID:10320
- C:\Windows\System\UcFVnDE.exe
  C:\Windows\System\UcFVnDE.exe
  2⤵
  PID:10336
- C:\Windows\System\oToNwjI.exe
  C:\Windows\System\oToNwjI.exe
  2⤵
  PID:10360
- C:\Windows\System\HBqjBzc.exe
  C:\Windows\System\HBqjBzc.exe
  2⤵
  PID:10380
- C:\Windows\System\ZdHazFW.exe
  C:\Windows\System\ZdHazFW.exe
  2⤵
  PID:10400
- C:\Windows\System\KjYYNBl.exe
  C:\Windows\System\KjYYNBl.exe
  2⤵
  PID:10424
- C:\Windows\System\NdDjlsr.exe
  C:\Windows\System\NdDjlsr.exe
  2⤵
  PID:10448
- C:\Windows\System\CIANfOf.exe
  C:\Windows\System\CIANfOf.exe
  2⤵
  PID:10468
- C:\Windows\System\bVCPeMy.exe
  C:\Windows\System\bVCPeMy.exe
  2⤵
  PID:10492
- C:\Windows\System\dZLeTpQ.exe
  C:\Windows\System\dZLeTpQ.exe
  2⤵
  PID:10516
- C:\Windows\System\qjfuXEb.exe
  C:\Windows\System\qjfuXEb.exe
  2⤵
  PID:10536
- C:\Windows\System\FMNKtyl.exe
  C:\Windows\System\FMNKtyl.exe
  2⤵
  PID:10560
- C:\Windows\System\YOwfzHY.exe
  C:\Windows\System\YOwfzHY.exe
  2⤵
  PID:10580
- C:\Windows\System\WkvUIzr.exe
  C:\Windows\System\WkvUIzr.exe
  2⤵
  PID:10600
- C:\Windows\System\iLpVqql.exe
  C:\Windows\System\iLpVqql.exe
  2⤵
  PID:10624
- C:\Windows\System\AxDXJMf.exe
  C:\Windows\System\AxDXJMf.exe
  2⤵
  PID:10644
- C:\Windows\System\LfrpZdg.exe
  C:\Windows\System\LfrpZdg.exe
  2⤵
  PID:10664
- C:\Windows\System\pteKGkJ.exe
  C:\Windows\System\pteKGkJ.exe
  2⤵
  PID:10688
- C:\Windows\System\Vdapweo.exe
  C:\Windows\System\Vdapweo.exe
  2⤵
  PID:10704
- C:\Windows\System\cRQbXrw.exe
  C:\Windows\System\cRQbXrw.exe
  2⤵
  PID:10720
- C:\Windows\System\tXVLRwy.exe
  C:\Windows\System\tXVLRwy.exe
  2⤵
  PID:10756
- C:\Windows\System\ErMQVhh.exe
  C:\Windows\System\ErMQVhh.exe
  2⤵
  PID:10776
- C:\Windows\System\HahUxsm.exe
  C:\Windows\System\HahUxsm.exe
  2⤵
  PID:10792
- C:\Windows\System\rSwIzOj.exe
  C:\Windows\System\rSwIzOj.exe
  2⤵
  PID:10808
- C:\Windows\System\bCBtnkS.exe
  C:\Windows\System\bCBtnkS.exe
  2⤵
  PID:10824
- C:\Windows\System\sdicIXB.exe
  C:\Windows\System\sdicIXB.exe
  2⤵
  PID:10848
- C:\Windows\System\TjTpSva.exe
  C:\Windows\System\TjTpSva.exe
  2⤵
  PID:10872
- C:\Windows\System\oopeMAp.exe
  C:\Windows\System\oopeMAp.exe
  2⤵
  PID:10892
- C:\Windows\System\gAFXuAK.exe
  C:\Windows\System\gAFXuAK.exe
  2⤵
  PID:10912
- C:\Windows\System\qEQHeay.exe
  C:\Windows\System\qEQHeay.exe
  2⤵
  PID:10928
- C:\Windows\System\XyuGBWJ.exe
  C:\Windows\System\XyuGBWJ.exe
  2⤵
  PID:10948
- C:\Windows\System\ecQANVN.exe
  C:\Windows\System\ecQANVN.exe
  2⤵
  PID:10964
- C:\Windows\System\eZELJEm.exe
  C:\Windows\System\eZELJEm.exe
  2⤵
  PID:10980
- C:\Windows\System\weglszo.exe
  C:\Windows\System\weglszo.exe
  2⤵
  PID:11000
- C:\Windows\System\CLIJDxp.exe
  C:\Windows\System\CLIJDxp.exe
  2⤵
  PID:11020
- C:\Windows\System\QfbdEDI.exe
  C:\Windows\System\QfbdEDI.exe
  2⤵
  PID:11036
- C:\Windows\System\NXvJNYJ.exe
  C:\Windows\System\NXvJNYJ.exe
  2⤵
  PID:11060
- C:\Windows\System\muIwIAr.exe
  C:\Windows\System\muIwIAr.exe
  2⤵
  PID:11080
- C:\Windows\System\UhfZsIb.exe
  C:\Windows\System\UhfZsIb.exe
  2⤵
  PID:11100
- C:\Windows\System\IkStlQx.exe
  C:\Windows\System\IkStlQx.exe
  2⤵
  PID:11120
- C:\Windows\System\kPeqKrE.exe
  C:\Windows\System\kPeqKrE.exe
  2⤵
  PID:11144
- C:\Windows\System\ZNwxYbx.exe
  C:\Windows\System\ZNwxYbx.exe
  2⤵
  PID:11168
- C:\Windows\System\cbEGnMy.exe
  C:\Windows\System\cbEGnMy.exe
  2⤵
  PID:11192
- C:\Windows\System\tqexFWQ.exe
  C:\Windows\System\tqexFWQ.exe
  2⤵
  PID:11212
- C:\Windows\System\AreXumL.exe
  C:\Windows\System\AreXumL.exe
  2⤵
  PID:11232
- C:\Windows\System\aaykPLR.exe
  C:\Windows\System\aaykPLR.exe
  2⤵
  PID:9288
- C:\Windows\System\rjhoDiw.exe
  C:\Windows\System\rjhoDiw.exe
  2⤵
  PID:6652
- C:\Windows\System\hWOKkZf.exe
  C:\Windows\System\hWOKkZf.exe
  2⤵
  PID:9956
- C:\Windows\System\hXpGjmO.exe
  C:\Windows\System\hXpGjmO.exe
  2⤵
  PID:9436
- C:\Windows\System\qNnOZVS.exe
  C:\Windows\System\qNnOZVS.exe
  2⤵
  PID:8696
- C:\Windows\System\XFEvsKz.exe
  C:\Windows\System\XFEvsKz.exe
  2⤵
  PID:1384
- C:\Windows\System\ULcKuAi.exe
  C:\Windows\System\ULcKuAi.exe
  2⤵
  PID:10124
- C:\Windows\System\bEliapc.exe
  C:\Windows\System\bEliapc.exe
  2⤵
  PID:10164
- C:\Windows\System\VadtzAN.exe
  C:\Windows\System\VadtzAN.exe
  2⤵
  PID:1496
- C:\Windows\System\kIjwsPH.exe
  C:\Windows\System\kIjwsPH.exe
  2⤵
  PID:9180
- C:\Windows\System\TELTBxl.exe
  C:\Windows\System\TELTBxl.exe
  2⤵
  PID:9668
- C:\Windows\System\bZtUjNS.exe
  C:\Windows\System\bZtUjNS.exe
  2⤵
  PID:8688
- C:\Windows\System\MqeKFRA.exe
  C:\Windows\System\MqeKFRA.exe
  2⤵
  PID:9228
- C:\Windows\System\TzGukjH.exe
  C:\Windows\System\TzGukjH.exe
  2⤵
  PID:8920
- C:\Windows\System\aFOcwsv.exe
  C:\Windows\System\aFOcwsv.exe
  2⤵
  PID:9128
- C:\Windows\System\OnESYup.exe
  C:\Windows\System\OnESYup.exe
  2⤵
  PID:8676
- C:\Windows\System\zwyvUQW.exe
  C:\Windows\System\zwyvUQW.exe
  2⤵
  PID:9828
- C:\Windows\System\FhXgNeQ.exe
  C:\Windows\System\FhXgNeQ.exe
  2⤵
  PID:10292
- C:\Windows\System\RSqjqna.exe
  C:\Windows\System\RSqjqna.exe
  2⤵
  PID:11268
- C:\Windows\System\yzgCmTO.exe
  C:\Windows\System\yzgCmTO.exe
  2⤵
  PID:11288
- C:\Windows\System\FthkZHQ.exe
  C:\Windows\System\FthkZHQ.exe
  2⤵
  PID:11312
- C:\Windows\System\vfgkzJs.exe
  C:\Windows\System\vfgkzJs.exe
  2⤵
  PID:11336
- C:\Windows\System\jzbRQOg.exe
  C:\Windows\System\jzbRQOg.exe
  2⤵
  PID:11360
- C:\Windows\System\BPkuexL.exe
  C:\Windows\System\BPkuexL.exe
  2⤵
  PID:11380
- C:\Windows\System\DBLRvzZ.exe
  C:\Windows\System\DBLRvzZ.exe
  2⤵
  PID:11400
- C:\Windows\System\xgOphgw.exe
  C:\Windows\System\xgOphgw.exe
  2⤵
  PID:11424
- C:\Windows\System\jYOkwqA.exe
  C:\Windows\System\jYOkwqA.exe
  2⤵
  PID:11444
- C:\Windows\System\RcGcAuw.exe
  C:\Windows\System\RcGcAuw.exe
  2⤵
  PID:11464
- C:\Windows\System\udNKDNa.exe
  C:\Windows\System\udNKDNa.exe
  2⤵
  PID:11488
- C:\Windows\System\wSCkCpl.exe
  C:\Windows\System\wSCkCpl.exe
  2⤵
  PID:11516
- C:\Windows\System\vrPzjKh.exe
  C:\Windows\System\vrPzjKh.exe
  2⤵
  PID:11536
- C:\Windows\System\tcCahGO.exe
  C:\Windows\System\tcCahGO.exe
  2⤵
  PID:11556
- C:\Windows\System\bzamyOu.exe
  C:\Windows\System\bzamyOu.exe
  2⤵
  PID:11576
- C:\Windows\System\xlOIURE.exe
  C:\Windows\System\xlOIURE.exe
  2⤵
  PID:11596
- C:\Windows\System\Rnjikuc.exe
  C:\Windows\System\Rnjikuc.exe
  2⤵
  PID:11620
- C:\Windows\System\nUYYuQh.exe
  C:\Windows\System\nUYYuQh.exe
  2⤵
  PID:11644
- C:\Windows\System\aLaBCBY.exe
  C:\Windows\System\aLaBCBY.exe
  2⤵
  PID:11664
- C:\Windows\System\CYDGrog.exe
  C:\Windows\System\CYDGrog.exe
  2⤵
  PID:11688
- C:\Windows\System\vCwnbhK.exe
  C:\Windows\System\vCwnbhK.exe
  2⤵
  PID:11704
- C:\Windows\System\TtLlkTL.exe
  C:\Windows\System\TtLlkTL.exe
  2⤵
  PID:11728
- C:\Windows\System\aDALmpA.exe
  C:\Windows\System\aDALmpA.exe
  2⤵
  PID:11744
- C:\Windows\System\dvigSyw.exe
  C:\Windows\System\dvigSyw.exe
  2⤵
  PID:11764
- C:\Windows\System\fTJaFTN.exe
  C:\Windows\System\fTJaFTN.exe
  2⤵
  PID:11784
- C:\Windows\System\iTrBAAT.exe
  C:\Windows\System\iTrBAAT.exe
  2⤵
  PID:11804
- C:\Windows\System\RRIWeih.exe
  C:\Windows\System\RRIWeih.exe
  2⤵
  PID:11824
- C:\Windows\System\Goygkaj.exe
  C:\Windows\System\Goygkaj.exe
  2⤵
  PID:11844
- C:\Windows\System\WEAKoRc.exe
  C:\Windows\System\WEAKoRc.exe
  2⤵
  PID:11860
- C:\Windows\System\fOaeFFd.exe
  C:\Windows\System\fOaeFFd.exe
  2⤵
  PID:11876
- C:\Windows\System\zdrqfrb.exe
  C:\Windows\System\zdrqfrb.exe
  2⤵
  PID:11892
- C:\Windows\System\kFAtzOj.exe
  C:\Windows\System\kFAtzOj.exe
  2⤵
  PID:11908
- C:\Windows\System\DTQMmEc.exe
  C:\Windows\System\DTQMmEc.exe
  2⤵
  PID:11924
- C:\Windows\System\xMXfGKc.exe
  C:\Windows\System\xMXfGKc.exe
  2⤵
  PID:11940
- C:\Windows\System\EyzkJiI.exe
  C:\Windows\System\EyzkJiI.exe
  2⤵
  PID:11956
- C:\Windows\System\efaXAZz.exe
  C:\Windows\System\efaXAZz.exe
  2⤵
  PID:11984
- C:\Windows\System\wxWmMnW.exe
  C:\Windows\System\wxWmMnW.exe
  2⤵
  PID:12000
- C:\Windows\System\muVAWtN.exe
  C:\Windows\System\muVAWtN.exe
  2⤵
  PID:12016
- C:\Windows\System\qfrSehQ.exe
  C:\Windows\System\qfrSehQ.exe
  2⤵
  PID:12032
- C:\Windows\System\ZBcEEaH.exe
  C:\Windows\System\ZBcEEaH.exe
  2⤵
  PID:12048
- C:\Windows\System\ngAtSwG.exe
  C:\Windows\System\ngAtSwG.exe
  2⤵
  PID:12064
- C:\Windows\System\iOXVAir.exe
  C:\Windows\System\iOXVAir.exe
  2⤵
  PID:12084
- C:\Windows\System\PSKzNHl.exe
  C:\Windows\System\PSKzNHl.exe
  2⤵
  PID:12100
- C:\Windows\System\NsGdKtR.exe
  C:\Windows\System\NsGdKtR.exe
  2⤵
  PID:12120
- C:\Windows\System\tzDeqhQ.exe
  C:\Windows\System\tzDeqhQ.exe
  2⤵
  PID:12136
- C:\Windows\System\gkrrpFF.exe
  C:\Windows\System\gkrrpFF.exe
  2⤵
  PID:12156
- C:\Windows\System\UmvVUMz.exe
  C:\Windows\System\UmvVUMz.exe
  2⤵
  PID:12176
- C:\Windows\System\WxmdWCA.exe
  C:\Windows\System\WxmdWCA.exe
  2⤵
  PID:12196
- C:\Windows\System\cQrFhYC.exe
  C:\Windows\System\cQrFhYC.exe
  2⤵
  PID:12212
- C:\Windows\System\fWMqjsX.exe
  C:\Windows\System\fWMqjsX.exe
  2⤵
  PID:12236
- C:\Windows\System\aIlhhEs.exe
  C:\Windows\System\aIlhhEs.exe
  2⤵
  PID:12252
- C:\Windows\System\NaLwdtF.exe
  C:\Windows\System\NaLwdtF.exe
  2⤵
  PID:12268
- C:\Windows\System\nwZYvHW.exe
  C:\Windows\System\nwZYvHW.exe
  2⤵
  PID:10356
- C:\Windows\System\FeUsvGT.exe
  C:\Windows\System\FeUsvGT.exe
  2⤵
  PID:9360
- C:\Windows\System\eZYRncS.exe
  C:\Windows\System\eZYRncS.exe
  2⤵
  PID:9892
- C:\Windows\System\HjiEsDk.exe
  C:\Windows\System\HjiEsDk.exe
  2⤵
  PID:10504
- C:\Windows\System\hsQLjiX.exe
  C:\Windows\System\hsQLjiX.exe
  2⤵
  PID:10552
- C:\Windows\System\WejUhls.exe
  C:\Windows\System\WejUhls.exe
  2⤵
  PID:10020
- C:\Windows\System\hWMjjdy.exe
  C:\Windows\System\hWMjjdy.exe
  2⤵
  PID:10080
- C:\Windows\System\pfxHCfp.exe
  C:\Windows\System\pfxHCfp.exe
  2⤵
  PID:9496
- C:\Windows\System\jnDckfq.exe
  C:\Windows\System\jnDckfq.exe
  2⤵
  PID:9532
- C:\Windows\System\BAAGTFI.exe
  C:\Windows\System\BAAGTFI.exe
  2⤵
  PID:1544
- C:\Windows\System\hKiAPTG.exe
  C:\Windows\System\hKiAPTG.exe
  2⤵
  PID:9576
- C:\Windows\System\iIBJoHs.exe
  C:\Windows\System\iIBJoHs.exe
  2⤵
  PID:8504
- C:\Windows\System\jKTKlMI.exe
  C:\Windows\System\jKTKlMI.exe
  2⤵
  PID:10800
- C:\Windows\System\mANHXIH.exe
  C:\Windows\System\mANHXIH.exe
  2⤵
  PID:9608
- C:\Windows\System\LzKAlhk.exe
  C:\Windows\System\LzKAlhk.exe
  2⤵
  PID:11092
- C:\Windows\System\osqiuFQ.exe
  C:\Windows\System\osqiuFQ.exe
  2⤵
  PID:11136
- C:\Windows\System\jtKLYeU.exe
  C:\Windows\System\jtKLYeU.exe
  2⤵
  PID:9268
- C:\Windows\System\TDrxWox.exe
  C:\Windows\System\TDrxWox.exe
  2⤵
  PID:9356
- C:\Windows\System\bcBRVYH.exe
  C:\Windows\System\bcBRVYH.exe
  2⤵
  PID:9404
- C:\Windows\System\dupQUJQ.exe
  C:\Windows\System\dupQUJQ.exe
  2⤵
  PID:9536
- C:\Windows\System\pmoNlKV.exe
  C:\Windows\System\pmoNlKV.exe
  2⤵
  PID:12308
- C:\Windows\System\XYDFfeQ.exe
  C:\Windows\System\XYDFfeQ.exe
  2⤵
  PID:12332
- C:\Windows\System\EucXNmL.exe
  C:\Windows\System\EucXNmL.exe
  2⤵
  PID:12352
- C:\Windows\System\wuMIxlQ.exe
  C:\Windows\System\wuMIxlQ.exe
  2⤵
  PID:10432
- C:\Windows\System\qeGcvoY.exe
  C:\Windows\System\qeGcvoY.exe
  2⤵
  PID:11500
- C:\Windows\System\AzHcclR.exe
  C:\Windows\System\AzHcclR.exe
  2⤵
  PID:11628
- C:\Windows\System\YeJKAWu.exe
  C:\Windows\System\YeJKAWu.exe
  2⤵
  PID:11752
- C:\Windows\System\AHsfeJg.exe
  C:\Windows\System\AHsfeJg.exe
  2⤵
  PID:11796
- C:\Windows\System\bSuloaM.exe
  C:\Windows\System\bSuloaM.exe
  2⤵
  PID:11884
- C:\Windows\System\IpgEUEj.exe
  C:\Windows\System\IpgEUEj.exe
  2⤵
  PID:2728
- C:\Windows\System\cMIfBeQ.exe
  C:\Windows\System\cMIfBeQ.exe
  2⤵
  PID:12768
- C:\Windows\System\RVHSPYL.exe
  C:\Windows\System\RVHSPYL.exe
  2⤵
  PID:9352
- C:\Windows\System\WNemNjo.exe
  C:\Windows\System\WNemNjo.exe
  2⤵
  PID:12412
- C:\Windows\System\okWOaeK.exe
  C:\Windows\System\okWOaeK.exe
  2⤵
  PID:13096
- C:\Windows\System\eHaofxW.exe
  C:\Windows\System\eHaofxW.exe
  2⤵
  PID:11356
- C:\Windows\System\IHBLjkl.exe
  C:\Windows\System\IHBLjkl.exe
  2⤵
  PID:12752
- C:\Windows\System\MptgFeE.exe
  C:\Windows\System\MptgFeE.exe
  2⤵
  PID:12836
- C:\Windows\System\DdWxSPv.exe
  C:\Windows\System\DdWxSPv.exe
  2⤵
  PID:12900
- C:\Windows\System\VlPmmff.exe
  C:\Windows\System\VlPmmff.exe
  2⤵
  PID:12932
- C:\Windows\System\SnRFzTq.exe
  C:\Windows\System\SnRFzTq.exe
  2⤵
  PID:13032
- C:\Windows\System\fdIyVuq.exe
  C:\Windows\System\fdIyVuq.exe
  2⤵
  PID:11068
- C:\Windows\System\LgsMAWu.exe
  C:\Windows\System\LgsMAWu.exe
  2⤵
  PID:3448
- C:\Windows\System\DLmkvqG.exe
  C:\Windows\System\DLmkvqG.exe
  2⤵
  PID:11992
- C:\Windows\System\BTMxAjq.exe
  C:\Windows\System\BTMxAjq.exe
  2⤵
  PID:10024
- C:\Windows\System\WpwIUFg.exe
  C:\Windows\System\WpwIUFg.exe
  2⤵
  PID:10920
- C:\Windows\System\kasRGTH.exe
  C:\Windows\System\kasRGTH.exe
  2⤵
  PID:11008
- C:\Windows\System\wPMglpE.exe
  C:\Windows\System\wPMglpE.exe
  2⤵
  PID:9984
- C:\Windows\System\SrqpbdJ.exe
  C:\Windows\System\SrqpbdJ.exe
  2⤵
  PID:4276
- C:\Windows\System\ssxPzla.exe
  C:\Windows\System\ssxPzla.exe
  2⤵
  PID:2720
- C:\Windows\System\xFHhuYe.exe
  C:\Windows\System\xFHhuYe.exe
  2⤵
  PID:12480
- C:\Windows\System\FEBcTbS.exe
  C:\Windows\System\FEBcTbS.exe
  2⤵
  PID:10976
- C:\Windows\System\GSjmgMz.exe
  C:\Windows\System\GSjmgMz.exe
  2⤵
  PID:11240
- C:\Windows\System\hRLZTOa.exe
  C:\Windows\System\hRLZTOa.exe
  2⤵
  PID:7260
- C:\Windows\System\dhLOmdk.exe
  C:\Windows\System\dhLOmdk.exe
  2⤵
  PID:8300
- C:\Windows\System\LuLeDUm.exe
  C:\Windows\System\LuLeDUm.exe
  2⤵
  PID:9400
- C:\Windows\System\ORXHSvn.exe
  C:\Windows\System\ORXHSvn.exe
  2⤵
  PID:9476
- C:\Windows\System\BXdSAll.exe
  C:\Windows\System\BXdSAll.exe
  2⤵
  PID:12132
- C:\Windows\System\QEzCGiw.exe
  C:\Windows\System\QEzCGiw.exe
  2⤵
  PID:11964
- C:\Windows\System\LfoqgdB.exe
  C:\Windows\System\LfoqgdB.exe
  2⤵
  PID:11048
- C:\Windows\System\lDiQwkH.exe
  C:\Windows\System\lDiQwkH.exe
  2⤵
  PID:10396
- C:\Windows\System\BTUZMyQ.exe
  C:\Windows\System\BTUZMyQ.exe
  2⤵
  PID:12736
- C:\Windows\System\ZdbYlby.exe
  C:\Windows\System\ZdbYlby.exe
  2⤵
  PID:1992
- C:\Windows\System\UvkOQJJ.exe
  C:\Windows\System\UvkOQJJ.exe
  2⤵
  PID:9912
- C:\Windows\System\VBxkxvO.exe
  C:\Windows\System\VBxkxvO.exe
  2⤵
  PID:3988
- C:\Windows\System\HlNqqiR.exe
  C:\Windows\System\HlNqqiR.exe
  2⤵
  PID:2428
- C:\Windows\System\kVuCDZt.exe
  C:\Windows\System\kVuCDZt.exe
  2⤵
  PID:12972
- C:\Windows\System\BEzvYLI.exe
  C:\Windows\System\BEzvYLI.exe
  2⤵
  PID:13124
- C:\Windows\System\XOmjMBv.exe
  C:\Windows\System\XOmjMBv.exe
  2⤵
  PID:12936
- C:\Windows\System\qkvMiFN.exe
  C:\Windows\System\qkvMiFN.exe
  2⤵
  PID:3992
- C:\Windows\System\TsSdRFF.exe
  C:\Windows\System\TsSdRFF.exe
  2⤵
  PID:3692
- C:\Windows\System\nnbsVFc.exe
  C:\Windows\System\nnbsVFc.exe
  2⤵
  PID:11836
- C:\Windows\System\ucWYhCi.exe
  C:\Windows\System\ucWYhCi.exe
  2⤵
  PID:10656
- C:\Windows\System\wlTHTcw.exe
  C:\Windows\System\wlTHTcw.exe
  2⤵
  PID:13208
- C:\Windows\System\zHlWTwl.exe
  C:\Windows\System\zHlWTwl.exe
  2⤵
  PID:10784
- C:\Windows\System\FBjHBTV.exe
  C:\Windows\System\FBjHBTV.exe
  2⤵
  PID:13220
- C:\Windows\System\WGYcVxQ.exe
  C:\Windows\System\WGYcVxQ.exe
  2⤵
  PID:13004
- C:\Windows\System\YCXRRaM.exe
  C:\Windows\System\YCXRRaM.exe
  2⤵
  PID:12184
- C:\Windows\System\kNtAnAa.exe
  C:\Windows\System\kNtAnAa.exe
  2⤵
  PID:10832
- C:\Windows\System\nyICUFk.exe
  C:\Windows\System\nyICUFk.exe
  2⤵
  PID:10116
- C:\Windows\System\qrqlORU.exe
  C:\Windows\System\qrqlORU.exe
  2⤵
  PID:11128
- C:\Windows\System\hdDSUUg.exe
  C:\Windows\System\hdDSUUg.exe
  2⤵
  PID:8972
- C:\Windows\System\Ufseacq.exe
  C:\Windows\System\Ufseacq.exe
  2⤵
  PID:9652
- C:\Windows\System\IsBQbqS.exe
  C:\Windows\System\IsBQbqS.exe
  2⤵
  PID:12672
- C:\Windows\System\GTKZtvo.exe
  C:\Windows\System\GTKZtvo.exe
  2⤵
  PID:12144
- C:\Windows\System\eHjrSOR.exe
  C:\Windows\System\eHjrSOR.exe
  2⤵
  PID:5568
- C:\Windows\System\JlaygmI.exe
  C:\Windows\System\JlaygmI.exe
  2⤵
  PID:9076
- C:\Windows\System\ivhTPti.exe
  C:\Windows\System\ivhTPti.exe
  2⤵
  PID:5024
- C:\Windows\System\EBtXVYS.exe
  C:\Windows\System\EBtXVYS.exe
  2⤵
  PID:12344
- C:\Windows\System\lqAsjTO.exe
  C:\Windows\System\lqAsjTO.exe
  2⤵
  PID:12968
- C:\Windows\System\tImNecC.exe
  C:\Windows\System\tImNecC.exe
  2⤵
  PID:9612
- C:\Windows\System\iEeLXks.exe
  C:\Windows\System\iEeLXks.exe
  2⤵
  PID:11208
- C:\Windows\System\xNOOJSz.exe
  C:\Windows\System\xNOOJSz.exe
  2⤵
  PID:10864
- C:\Windows\System\kYmMjtm.exe
  C:\Windows\System\kYmMjtm.exe
  2⤵
  PID:10072
- C:\Windows\System\HxrHPwu.exe
  C:\Windows\System\HxrHPwu.exe
  2⤵
  PID:12640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bgke4xcu.bqr.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AjUPdZW.exe

Filesize
1.8MB

MD5
7dc58920a2739797fb4b8a54d7a5e070

SHA1
5b011fb2b860b8fad2a6b3e4d84ead9cf9858369

SHA256
c4f43ea86f71798aecffe3931b60ae019a3ace649424549656686c53fce24ec7

SHA512
471b9967cc04fb0a01890f14490d9310239b445de68cf5c90e147c22378da891a24c46c83cd1f9f4d098f6a31fe536eac0294eb084c2c71252fb2e105baaa413

Download Submit
C:\Windows\System\BIUJzps.exe

Filesize
1.8MB

MD5
7c41f3759a0fc6f66f37203ae1a0a19c

SHA1
2d8755a05b01d6d7b7c0ca97d68a069456a71345

SHA256
a1025d6d7e919759de633efa5c6aff73a85559bd8668578de38b1c2af506d44f

SHA512
4381d21e2d70e477452bfffd1c50fcdf8ec4ffd5c1427dde10a1cc31db8f0063a6292b2772dc646b2bc3b2c9e140e6ea7d9d8e771da2e72b527faba4df6206d4

Download Submit
C:\Windows\System\FGWGNOV.exe

Filesize
1.8MB

MD5
16525021075fad5ad7d3e97e218f955c

SHA1
f5d38265aa563c955cc6dc970c6690925a400d24

SHA256
1b90863c3d330784c2cb737bd49f257ae30012212a9ed4416c7331813f3be7bf

SHA512
851bc2962fbafabb081086abb0cc329d395ea05601118f6139d90ffb347291a16d46537b79ac5062e5624c20e3e379ec8c45775abe0cbd837fbc44da5b521ecf

Download Submit
C:\Windows\System\IJJjbae.exe

Filesize
1.8MB

MD5
2f7bdf6342a93fd2089e52514291f2f2

SHA1
f7ae143453513f4e3e0152a5bbae92910dc88f75

SHA256
c771a8bcbca820742a0f0c46ea361bf224f36b6a035d82a2a5d0e88de5db43be

SHA512
b8613c40c77001e79efccab68e9e7093ce67683472c1fdde2cdd0a447951d23b840c6c3a8dc10093fd257c23ca4816a395e66cba55451e58c6ca8adfb36b9b37

Download Submit
C:\Windows\System\JJmqydP.exe

Filesize
1.8MB

MD5
729f4e2a070396fce9190d8f02dfd475

SHA1
c0ceeb804ace78eddfe78275a1b7ec9717eb0f7e

SHA256
1e0591a739525a7e19655b15f0c51c89bfd1b8aaca9d2a900f857f5e91225bb7

SHA512
7cf9d635768b6fa882f274df266c2841cd406ab71b799916fb028ae7f180c843505cd3c80b3f5e07768363d0ece72ebf34d40d2128f66efb448fe66d5e9fdabc

Download Submit
C:\Windows\System\JRUwcIT.exe

Filesize
1.8MB

MD5
acb1b2a3a286e5730b4ae6f3f89de2a7

SHA1
aa7182311ec02147e565a7887b72daea1cc1d5e5

SHA256
cc9754e5885558abc891f64cd85398b5c78c0ecad36fb9f4182cd63778a24963

SHA512
ab50870ac632006a7ccdb99755b0d6766b32ac3478dbb2292778fe5aa5c7c4e9c1ea3283d6aa002470f96e6f0a3ca52657d2e62535cdcb86a906cd01c65b065c

Download Submit
C:\Windows\System\JljQtpL.exe

Filesize
1.8MB

MD5
a385e6dd142050a5361d6aaa73b5d6e9

SHA1
cddf5c8410ef7f8c4181aa590de3c49177de2726

SHA256
3e83fd8ac792d4db4c2c63456e1ddd6a148763017102f6c8623548bf7652604e

SHA512
5fe84d945e5e6a6cc46f6de40b8efeda52992dbdb7f943a571e8e4c7beff53c069ad57b0b1a63e8718acbff3e05c140efc4fb0a94c4db869ce863080f2654111

Download Submit
C:\Windows\System\KDnMvOw.exe

Filesize
1.8MB

MD5
f3ddc596c67025ff322cc9b6a98497b8

SHA1
8c9f308002fcdd29c2acff596464b9c623c7e7a5

SHA256
67f6c47eaefe9792bfaea346d90b860ee135f4a0706388561d9ce1d639585cf2

SHA512
052911b2d2921dc9eb5c6be59c99d5d173e2a5dee20dccba44c17bf9f579447a9d4fe732d19f2f42ebd2e22fc9e0f33458c7d70d39251058a02e595137fe72ca

Download Submit
C:\Windows\System\KHUVOoC.exe

Filesize
1.8MB

MD5
e8025c58c5be22cb9a3c2e484fcd0d2b

SHA1
2b820c3b78e633005319dd64c3a221a70feb9cee

SHA256
6a3b31a8eb25d754d329f53d7892a78059d52c6890defe0db2d4798a93f6e092

SHA512
477abd2e2359a8e2a6fb585dbaf67e09c6b430ccdbb77cd328c42055a719ac9316da89e1255a9b7317626515633fb06b79cd1443b0838db0a303baad79f24425

Download Submit
C:\Windows\System\LOjLkhu.exe

Filesize
1.8MB

MD5
7f7a114570dc8bb1c2465cb333f1f302

SHA1
835c2ab721c6d4e3ebac9eb77d35de7525ab4b3c

SHA256
99799413a6b9cca00987869a446eb1620a008af330cb7082e7b82a6fd14755fb

SHA512
8a23148fb2d11a1b18eaf61c0cafce3989e8f927a38afd66cd564bea0a2c56930096a2bad0bbce25277f7f369bf81684637e78fc7e405fa74b459c1fca621300

Download Submit
C:\Windows\System\OFLqeuC.exe

Filesize
1.8MB

MD5
fc6eb78bbe69433a52f2de4b00d1dd6b

SHA1
76f5e09fb6f5136875535106575ca696a20dfbe1

SHA256
8d2cabda4b7503b26f67c3c15e536174981e66410e11f380e572c470ceeeee1a

SHA512
435be5a30eb65d80f244a1b28ed269e507400617a644fc7b9ac241b3fd9ad9c86c5a2f1d214a4e0f1c471e28db46810c8bf46e9476754f00fa4f1da0bf9e9dba

Download Submit
C:\Windows\System\OOnTqbR.exe

Filesize
1.8MB

MD5
684a07329eb6e8dd32388c15de9df481

SHA1
d556e010386d1014785d7bcf6d3a27913f8b7a14

SHA256
f391982e06a00749e8213634a518b75c8d2087a03a10ebb274a6bbea20573e37

SHA512
77b01b180c3891cd2c7420e68cadd8bd51d26050e02463090e35ad2bfc10eb58f44d09c43ea20b4348fe94db1710299aff91bca558facc243e15ac0c12501ad1

Download Submit
C:\Windows\System\SEUkzUJ.exe

Filesize
1.8MB

MD5
b16c9ecda27b4239d2cd180f380e3efe

SHA1
153a495db1d1d0a268f9ae3b4a386c56bfe9572d

SHA256
685ddf3081b841d94b584683234514d4b99f962b15f7d064740753397fce0862

SHA512
d1f6e50f1f7e25e8ab4af38a0fa4414be5318f02e31e7a0437685863b4c4b4b43931cd2f572a7ab774863f386d8592dd12ce82de30ebd925de1489321f6e56da

Download Submit
C:\Windows\System\UTCwvAF.exe

Filesize
1.8MB

MD5
27eac3865dd4de45956be40098342d45

SHA1
5d49104634f2f3a1038bb932613212c6fd05475d

SHA256
a20abc45fe1a286d9644f260c25e4102533b37017bce5b1325f28d80f2c7718b

SHA512
c5235cd8179f3619180c8d549a5992fd1bc0b3a97cae5c4de5c21594904107419e50fc912bee01bd6e8e48bcef4fc087e59634be78416803279b82f89b52fb89

Download Submit
C:\Windows\System\WrdhPKU.exe

Filesize
1.8MB

MD5
cb10339014227f15f778402d51c67db7

SHA1
54064fafc604d80dcf81170e8d8de3a31c04cff2

SHA256
3e9c38f1d9de5f2eb9f3e9c4f86ab8e5ddb4af907587ae4a1a2cc6ad9c3f2b78

SHA512
37356552f5324b5c6ac2bf609733dd59962bbbedf5ae4f829aa3929cfe85d24dcace3fe57bb0716e5fd6a08e1a5fb8c679f416962167399425b5e39ebaab67fd

Download Submit
C:\Windows\System\WvrTMkh.exe

Filesize
1.8MB

MD5
56179fcdfadef8af5bd6ceef0ada6efc

SHA1
fae529b8f2ff480850be68dcaeccd7dd81fb952f

SHA256
3f35388a3fd77f05e8cbc765ad6340e0a806f88988414bdeff68828d7763d02d

SHA512
e94a758c5afcc5ee4872a796f67f3e24c1be286dbe7ba09a100c93d573a759dea7a38449ee9ef4aed5be79e400f718114c8ad7fc7eaf569b435ae8558a10b275

Download Submit
C:\Windows\System\XOVESat.exe

Filesize
1.8MB

MD5
0f93de5bdc39e2600473981013b1a520

SHA1
67e49fd13a88df74a9bc4e431a320889c5c4c3d4

SHA256
8af95a733346794c529f012e18d1d1558c6a90bfcf4631955602124f50279d4d

SHA512
44ed24fe25f643c3e1c65bfc6c8c423ae938de8e5c6f0c960f676accfba97c8a99a76eb4b9a00ae8df5071540a55aac9f5f1292d5938be8becbae2b580916911

Download Submit
C:\Windows\System\XssUFQc.exe

Filesize
1.8MB

MD5
1ea73916d928a15634cb07d401e7b290

SHA1
3eba5d09a0df829269c36f5c5cb7221d7b2a8359

SHA256
5d11b60e6bc2f2b72d8b99665f399d21b8eb124a2c79aecd29546669d471861b

SHA512
3ce695ae2dd3485cf0cb3ce2db0bf3cdf1d136eb4e73778632fa81d7ecbd8d193311d011c40336946706287e9f1b59aaef0c093290bc27fc8a71a475e0bee638

Download Submit
C:\Windows\System\ZmCUbny.exe

Filesize
1.8MB

MD5
dda4d9e9b1558ceab7eb448de9862fc7

SHA1
203b89563515842e0b6850e8b1fa2ac4e52283a4

SHA256
c6d95ea0cb6d0907cb091e7785db641548f0f99d4c327fd03cd84d8b3bdce550

SHA512
d520841a2f53112b55e4f339f2af948da18e150a22734f9e217ee5e0de00302da3ee63bdb9642343cd11f1d3e2f56c19bea558104be07b93020f61ffed8795d3

Download Submit
C:\Windows\System\ZyDNONw.exe

Filesize
1.8MB

MD5
cadb35f3189ff1e013daed6ca8f0511f

SHA1
437b4736ebe58158c5f77c0b1c4d16229362d87e

SHA256
d3f9c83022d273c5169eee476faeada2e1a6265e2226064be3f88d318504adb1

SHA512
df79939e9aa7a2302d0af8af1143efca6092dda7f159633750cb864d2e7a4ee49b8ff4b0beb2b9d00dfead57ebd850dd47b97f434e27dfee69ba4f4a7a274a1d

Download Submit
C:\Windows\System\bKiEuaT.exe

Filesize
1.8MB

MD5
8365817d93c31102aad7a0baca33efdc

SHA1
8a00ad1f0d374253eea4ed0ea312469a83f89ac7

SHA256
9470d753c601b3a8ea59da128640059ca6f8f96fda85c37fdee1b029ddccae56

SHA512
3ae438107e4b37512a75961259a7bccd2e3b8975a71573ad1981d173f40a1340963604b5d2b5aa641a355efe323e789b1c998da78553f309abca83b9e3a274bd

Download Submit
C:\Windows\System\bLPYPhF.exe

Filesize
1.8MB

MD5
5b5f0f70ce00cbb0c27c965ed7df7b2f

SHA1
5095e938ff30843bea47ded0995de17a86ec099a

SHA256
1814469057b3e9fd5568ca5a67ce68dedf5bbf0e536cb9bb006658971a7f8019

SHA512
500400cfe82251ef14fca76bdd1f5e6a62cb75ca9699d56b918f7a1665e4b8de1a306fffb9cafe158a68720f37856457ecc0d4c4cc377c820de2d0037f83944a

Download Submit
C:\Windows\System\cEvImmK.exe

Filesize
1.8MB

MD5
04c824721fa0848776d80128f0a7f318

SHA1
d465324f9bfd9ab6b4193af834df1efeca69129e

SHA256
146078ca224501a112dd52bd6d204ac2c639edbe36e29e58e3bc076642172da3

SHA512
46ce16c71ab80135218d086da75685d75a0290640fc5aa2945d0eb0666e0a4ec8d7978c33fb57f01366e2154490fce891f0adceef553d8b24c0d108d5ff456d6

Download Submit
C:\Windows\System\dJBqmtj.exe

Filesize
1.8MB

MD5
8d5cb539a8d675b8b686652ff0e77e2f

SHA1
e6550b498b28b8cc33e5337bb2439ee3bb3ba71b

SHA256
6a9404200636f8e1755d38ed37608aeee45c6896651eef6d6662926172aa2f37

SHA512
cdfea1c624dd23cadbc007b33f9cb37ca64b475a8558d0617b85c2f73fd871fed0b0e16f5bec12d0efe7aadd2d6b514e6a0f345f62f49cf05ef855f26910b1fd

Download Submit
C:\Windows\System\ebYLbtz.exe

Filesize
1.8MB

MD5
846c1c4e997649bd0127a655615eeb05

SHA1
36d2e8b97976cdbaeb3847e53dc0e39fafbada78

SHA256
433626125ea6b31c24eb6f4d369a8388e1781c3af2ed2ca45f318aa29a42cdbe

SHA512
5b84ca029638118171135c7408773398481e7e2009e72b8247d2e447c6cebf2c0923ebbbccf4c915fa07d50547f9d642084c56f4da94d85183f261a5d0e7c3ce

Download Submit
C:\Windows\System\edULpgq.exe

Filesize
1.8MB

MD5
a62cfd28e8b6a9d6e66cdce6b2a657a1

SHA1
8e97c50925b3f540a26062b50e281f03118022aa

SHA256
10fa7aa14a6a2f2afe8cdd3cf571bb2c078e5304a9d3b37ad1b034383df8a386

SHA512
6807384b2219e425e5c47cc297bab54637f6f78f5271cba681e2fdb440afe94a670258411fc0eee7460d298a67fae065ce634c4cc325a10b719dae50f96b6090

Download Submit
C:\Windows\System\gUlEckM.exe

Filesize
1.8MB

MD5
e3dc1494fa6005b0489a75290af9ebaf

SHA1
6b184cde072f97c4580b8d021eabb8868b3b75f2

SHA256
31706d88a83938fcd5469d04c128a098f2ba366768187b5c14ed1cbc3175c34a

SHA512
14864414703cd0a12280b9ce69622e6ebf932f1ca213e8ef3c55f40f294ad27d2970a1c90cee22602298aba15895e14e2bcecfa9620ba2d6b3fe87df4934323d

Download Submit
C:\Windows\System\hsRdfXx.exe

Filesize
1.8MB

MD5
4289f73bc118c864d384b013fc2d69ec

SHA1
26f8be3b8057ab7b0a89f99bf9a5f98a9aa274d5

SHA256
3cb0a6596ca4d778b95f4413ba279f673d4a4411fb69ba1e870efae8d0666172

SHA512
323312ffe11f16715b01300428e24475045aa61741324e1fa50b909dab4e2f494c096af7328e8e3934075e152ae94e3519747e75d01c78deb73a068dcfec9946

Download Submit
C:\Windows\System\jukvTMb.exe

Filesize
1.8MB

MD5
da9b7e0f43150f02fd9c655fd24748de

SHA1
afd33fd9c26535c4b49462c1138f759f6b5cdd78

SHA256
946a3b2824ecd6ccfe8ca9c6a5eee4c73b82f0974650bb9bec0d07c1ca6f74f8

SHA512
38221b411b631bcdf02752bce7a612e86aa33c0711744b1e3954172b702558c899ad06eca9b88c048671abd8054a1ae530e6b03fac5a41ff1d36c2cf6ce0a977

Download Submit
C:\Windows\System\kVOElrm.exe

Filesize
1.8MB

MD5
65e826839218b3f4e9769330341610c8

SHA1
f005b77d6b40efb91a0811e9f203d6b372a94959

SHA256
f69166bbf45f0e19449df76928f310179dc7c6a5ad64a02bb4d92409dab45513

SHA512
cbe0ab65c9400f2daea91a8c6e626cefe57b2c912bff9d22937ded5a2e66e9e6cf05e76011f07e0d74471c4bce5c2bbed4bb7f72a65154b045dc4dd987b11de3

Download Submit
C:\Windows\System\paSJHFz.exe

Filesize
1.8MB

MD5
93787cad15cee63b39cf2931fc14b141

SHA1
344a494105db635a28316e8b6896e932c2310819

SHA256
2053fa42ed54403570f9972ba4d652a2137c6fd8a0d3c8a4c46b5b47e41474ba

SHA512
919d07ee2b6bc701726ea499fa39bc3000df3262a9cadcafc91f9deaf8c74b61c5af11937a36262ad5c974f2d31d7f2569421dbb6cfd3e6deaddcc4b728a872c

Download Submit
C:\Windows\System\qcLPIgf.exe

Filesize
1.8MB

MD5
e795b1e7ecc227fb842e199f26671c53

SHA1
d9214f2e4345647a040c02cfa533d67147140811

SHA256
733d75d6f1b83db589ad2449c55dc02b84091e9fc933f024b28bf63a7787b311

SHA512
6e5b9d19058306090ae0c562b5b49b409e37aaaff0193d44810f6a34c04af942ce286436e3ecf1bd5cafc1845337ba0ec245d0deb3fa38c76a4f7cb72be4e5f0

Download Submit
C:\Windows\System\qnOnWxa.exe

Filesize
1.8MB

MD5
84cd4fe34ad0dfa4551c914c5ea89a9b

SHA1
cd9b7a5a54e5a9e154b7f5cb037eb05c212c9289

SHA256
8fa28c73a6ee4c6713dede58c6caa3e70e84336c2cba788bfd32f5a316284cbc

SHA512
b076930365c239227f6e2ae09f807df07a29f34e46ba241db8610c3db5df2c8814330d4601c532446441a5e4bbb30a57f18e3c945918f8c553cf9a308af85e8b

Download Submit
C:\Windows\System\tKuzYLp.exe

Filesize
1.8MB

MD5
87bf2082caf10c4f87f6c098fe4226e3

SHA1
ee29bba522a57c84bfb6713bbfb4d19687e59fd8

SHA256
33a5ae6fc84e4e490141226b9f60954b38b03055aab1dc34004b53b574590a0b

SHA512
9dea352e078c1af2eb6d4f169b0ad35e68a53b08e12938b6f67bb14a50133000757a3cd2fba4baa5e9c88002ea05e4a2de5d6d294255c34ba28c40d447381e1a

Download Submit
C:\Windows\System\ubaHeWN.exe

Filesize
1.8MB

MD5
172d6638fa6c264d5a1a2c280d4907e3

SHA1
cd4e39cba258314d4b9284be7a964b57f2e6881c

SHA256
1ee105c924a73505dd0ace45b22630664408bf3fbcc7089df17f84de997c6e24

SHA512
3b28effa23d44858d103902e464aa0deb7351b891d0a861729e778b1f3f10d5f9fe4ccb7e88482522f8edabc87c038619ef42f98b313424d8c0a76ef716dab5e

Download Submit
C:\Windows\System\vawGFzc.exe

Filesize
1.8MB

MD5
87dc3d6e1551de63d035ec6779bb1472

SHA1
dca2e87fb76572bdcc4c26d9750882245af9c8de

SHA256
47d196975c275dda763c548dcf2f5867115a6765b31acbfcf0368ff10413a881

SHA512
8f1f9340a281eebb5fc1da1de1bfbd1376a1b95db2469b9703156e94937f0f002b1c89e7fb43faa623643c7851a082f8a1f7143918a628c72d2e402050c3af4b

Download Submit
C:\Windows\System\wTTcAxj.exe

Filesize
1.8MB

MD5
182822d1ec871bb19e03ebc9faf3800b

SHA1
41e8ab966b3a3938215c7e19e779b3002fd9b6f3

SHA256
6ed431bde633aaa0ce4443794704427fc6239d09af43325706a430c752859713

SHA512
ba8725f26c314c213fd3a26c7372ed081e488b8ab8be232550da1f0d1072185d5c3484d4dfb1864f725bdf831401a022df516be71e772b240a1638c9ed700011

Download Submit
C:\Windows\System\zFkFClA.exe

Filesize
1.8MB

MD5
5a77da95f8f4aea6aaa00e3c43ebbf90

SHA1
c59fe6023b3924a1dcf69cc73deb32351fd2379b

SHA256
dc3ce31cc6c08e721d476553dcd6af62c8e5f3e511e4ffb32f901aa1bf99410d

SHA512
74319a82c3afdf92500cf530af0de0bfa0cbad8cbb9f8550c09d264160d1755a26e34abd811318e650343ef4505cbea9af1518d409965b18b4bde604ffd53039

Download Submit
C:\Windows\System\zztXebX.exe

Filesize
1.8MB

MD5
8dd193a7c37d47589f5f096e5d773a65

SHA1
cf077c64cf645bf5e8c43ad8d2544fdd134880f4

SHA256
665be68d905b4cacb3a7469adcd484449a9f36a1c26f669d9bd627aa1fb2a8f2

SHA512
45d956be4b39c9b8f3bf2cb19550922fa16f6e41700fe0bd9519f41ee29d1dd0c08c9699545bd60d09eb2f598edde60842761ec1671c9fed49f4cdd7099d2a0b

Download Submit
memory/220-3741-0x00007FF65FAB0000-0x00007FF65FEA2000-memory.dmp

Filesize
3.9MB

Download
memory/220-158-0x00007FF65FAB0000-0x00007FF65FEA2000-memory.dmp

Filesize
3.9MB

Download
memory/460-425-0x00007FF6DD610000-0x00007FF6DDA02000-memory.dmp

Filesize
3.9MB

Download
memory/460-3742-0x00007FF6DD610000-0x00007FF6DDA02000-memory.dmp

Filesize
3.9MB

Download
memory/884-3764-0x00007FF73D240000-0x00007FF73D632000-memory.dmp

Filesize
3.9MB

Download
memory/884-318-0x00007FF73D240000-0x00007FF73D632000-memory.dmp

Filesize
3.9MB

Download
memory/916-3734-0x00007FF7DAF50000-0x00007FF7DB342000-memory.dmp

Filesize
3.9MB

Download
memory/916-118-0x00007FF7DAF50000-0x00007FF7DB342000-memory.dmp

Filesize
3.9MB

Download
memory/1444-3748-0x00007FF7CEB70000-0x00007FF7CEF62000-memory.dmp

Filesize
3.9MB

Download
memory/1444-173-0x00007FF7CEB70000-0x00007FF7CEF62000-memory.dmp

Filesize
3.9MB

Download
memory/1456-359-0x00007FF650F30000-0x00007FF651322000-memory.dmp

Filesize
3.9MB

Download
memory/1456-3755-0x00007FF650F30000-0x00007FF651322000-memory.dmp

Filesize
3.9MB

Download
memory/1756-3746-0x00007FF720FF0000-0x00007FF7213E2000-memory.dmp

Filesize
3.9MB

Download
memory/1756-354-0x00007FF720FF0000-0x00007FF7213E2000-memory.dmp

Filesize
3.9MB

Download
memory/1812-3756-0x00007FF7139B0000-0x00007FF713DA2000-memory.dmp

Filesize
3.9MB

Download
memory/1812-374-0x00007FF7139B0000-0x00007FF713DA2000-memory.dmp

Filesize
3.9MB

Download
memory/1936-299-0x00007FF732400000-0x00007FF7327F2000-memory.dmp

Filesize
3.9MB

Download
memory/1936-3758-0x00007FF732400000-0x00007FF7327F2000-memory.dmp

Filesize
3.9MB

Download
memory/1988-416-0x00007FF7623E0000-0x00007FF7627D2000-memory.dmp

Filesize
3.9MB

Download
memory/1988-3776-0x00007FF7623E0000-0x00007FF7627D2000-memory.dmp

Filesize
3.9MB

Download
memory/2180-424-0x00007FF67D110000-0x00007FF67D502000-memory.dmp

Filesize
3.9MB

Download
memory/2180-3771-0x00007FF67D110000-0x00007FF67D502000-memory.dmp

Filesize
3.9MB

Download
memory/2664-434-0x00007FF658E90000-0x00007FF659282000-memory.dmp

Filesize
3.9MB

Download
memory/2664-3766-0x00007FF658E90000-0x00007FF659282000-memory.dmp

Filesize
3.9MB

Download
memory/2952-3762-0x00007FF6CE680000-0x00007FF6CEA72000-memory.dmp

Filesize
3.9MB

Download
memory/2952-271-0x00007FF6CE680000-0x00007FF6CEA72000-memory.dmp

Filesize
3.9MB

Download
memory/3228-272-0x00007FF7C5560000-0x00007FF7C5952000-memory.dmp

Filesize
3.9MB

Download
memory/3228-3750-0x00007FF7C5560000-0x00007FF7C5952000-memory.dmp

Filesize
3.9MB

Download
memory/3232-358-0x00007FF677060000-0x00007FF677452000-memory.dmp

Filesize
3.9MB

Download
memory/3232-3760-0x00007FF677060000-0x00007FF677452000-memory.dmp

Filesize
3.9MB

Download
memory/3356-3730-0x00007FF619DE0000-0x00007FF61A1D2000-memory.dmp

Filesize
3.9MB

Download
memory/3356-33-0x00007FF619DE0000-0x00007FF61A1D2000-memory.dmp

Filesize
3.9MB

Download
memory/3356-3736-0x00007FF619DE0000-0x00007FF61A1D2000-memory.dmp

Filesize
3.9MB

Download
memory/3452-228-0x00007FF7280D0000-0x00007FF7284C2000-memory.dmp

Filesize
3.9MB

Download
memory/3452-3744-0x00007FF7280D0000-0x00007FF7284C2000-memory.dmp

Filesize
3.9MB

Download
memory/3472-433-0x00007FF7D64D0000-0x00007FF7D68C2000-memory.dmp

Filesize
3.9MB

Download
memory/3472-3767-0x00007FF7D64D0000-0x00007FF7D68C2000-memory.dmp

Filesize
3.9MB

Download
memory/4196-8-0x00007FF7C8780000-0x00007FF7C8B72000-memory.dmp

Filesize
3.9MB

Download
memory/4196-3729-0x00007FF7C8780000-0x00007FF7C8B72000-memory.dmp

Filesize
3.9MB

Download
memory/4196-3732-0x00007FF7C8780000-0x00007FF7C8B72000-memory.dmp

Filesize
3.9MB

Download
memory/4480-1-0x00000281BFBA0000-0x00000281BFBB0000-memory.dmp

Filesize
64KB

Download
memory/4480-0-0x00007FF728380000-0x00007FF728772000-memory.dmp

Filesize
3.9MB

Download
memory/4784-3738-0x00007FF78FAF0000-0x00007FF78FEE2000-memory.dmp

Filesize
3.9MB

Download
memory/4784-210-0x00007FF78FAF0000-0x00007FF78FEE2000-memory.dmp

Filesize
3.9MB

Download
memory/4856-110-0x000001D7CEF20000-0x000001D7CEF42000-memory.dmp

Filesize
136KB

Download
memory/4856-122-0x000001D7CF000000-0x000001D7CF010000-memory.dmp

Filesize
64KB

Download
memory/4856-92-0x000001D7CF000000-0x000001D7CF010000-memory.dmp

Filesize
64KB

Download
memory/4856-91-0x00007FFFCCBD0000-0x00007FFFCD691000-memory.dmp

Filesize
10.8MB

Download
memory/5072-3789-0x00007FF7FA070000-0x00007FF7FA462000-memory.dmp

Filesize
3.9MB

Download
memory/5072-420-0x00007FF7FA070000-0x00007FF7FA462000-memory.dmp

Filesize
3.9MB

Download