xmrig | 3be37de983205eb7124c8b77d3ce7c06104f75e9922668128c1c93db70d605c8

Analysis

max time kernel
67s
max time network
39s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 12:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
Size

1.8MB
MD5

00d175378c9889449b980aa3ee3d8b8c
SHA1

5bf2d2d1584fd237584580bb0583e67a94bee31e
SHA256

3be37de983205eb7124c8b77d3ce7c06104f75e9922668128c1c93db70d605c8
SHA512

d9fa8bf77cede5eb845a27fa2340ba111f9c0ab0a2c00b81e4b762af459f52640c1a6bc41b47a178c95b29b03ad51ccbe20bddea989ca0f2964ec9744e26a890
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlS:NABB

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 43 IoCs

miner

resource	yara_rule
behavioral2/memory/4796-24-0x00007FF7A7010000-0x00007FF7A7402000-memory.dmp	xmrig
behavioral2/memory/3344-36-0x00007FF69FA40000-0x00007FF69FE32000-memory.dmp	xmrig
behavioral2/memory/1376-85-0x00007FF75F640000-0x00007FF75FA32000-memory.dmp	xmrig
behavioral2/memory/2388-87-0x00007FF77A5F0000-0x00007FF77A9E2000-memory.dmp	xmrig
behavioral2/memory/2452-86-0x00007FF6B9BB0000-0x00007FF6B9FA2000-memory.dmp	xmrig
behavioral2/memory/628-84-0x00007FF65D6C0000-0x00007FF65DAB2000-memory.dmp	xmrig
behavioral2/memory/1032-79-0x00007FF6830E0000-0x00007FF6834D2000-memory.dmp	xmrig
behavioral2/memory/552-74-0x00007FF6CCDB0000-0x00007FF6CD1A2000-memory.dmp	xmrig
behavioral2/memory/4928-70-0x00007FF7469F0000-0x00007FF746DE2000-memory.dmp	xmrig
behavioral2/memory/5112-68-0x00007FF6087F0000-0x00007FF608BE2000-memory.dmp	xmrig
behavioral2/memory/2620-51-0x00007FF664580000-0x00007FF664972000-memory.dmp	xmrig
behavioral2/memory/2904-109-0x00007FF6532A0000-0x00007FF653692000-memory.dmp	xmrig
behavioral2/memory/3188-140-0x00007FF74B4A0000-0x00007FF74B892000-memory.dmp	xmrig
behavioral2/memory/3428-169-0x00007FF748B90000-0x00007FF748F82000-memory.dmp	xmrig
behavioral2/memory/1216-163-0x00007FF670A30000-0x00007FF670E22000-memory.dmp	xmrig
behavioral2/memory/216-149-0x00007FF7B1460000-0x00007FF7B1852000-memory.dmp	xmrig
behavioral2/memory/4192-137-0x00007FF645920000-0x00007FF645D12000-memory.dmp	xmrig
behavioral2/memory/4864-131-0x00007FF6123B0000-0x00007FF6127A2000-memory.dmp	xmrig
behavioral2/memory/3212-1420-0x00007FF6FACE0000-0x00007FF6FB0D2000-memory.dmp	xmrig
behavioral2/memory/1328-2146-0x00007FF72F5D0000-0x00007FF72F9C2000-memory.dmp	xmrig
behavioral2/memory/4316-2161-0x00007FF7685B0000-0x00007FF7689A2000-memory.dmp	xmrig
behavioral2/memory/4260-2162-0x00007FF77F720000-0x00007FF77FB12000-memory.dmp	xmrig
behavioral2/memory/4796-2196-0x00007FF7A7010000-0x00007FF7A7402000-memory.dmp	xmrig
behavioral2/memory/2620-2198-0x00007FF664580000-0x00007FF664972000-memory.dmp	xmrig
behavioral2/memory/3344-2200-0x00007FF69FA40000-0x00007FF69FE32000-memory.dmp	xmrig
behavioral2/memory/4928-2204-0x00007FF7469F0000-0x00007FF746DE2000-memory.dmp	xmrig
behavioral2/memory/5112-2205-0x00007FF6087F0000-0x00007FF608BE2000-memory.dmp	xmrig
behavioral2/memory/1376-2207-0x00007FF75F640000-0x00007FF75FA32000-memory.dmp	xmrig
behavioral2/memory/1032-2212-0x00007FF6830E0000-0x00007FF6834D2000-memory.dmp	xmrig
behavioral2/memory/2452-2218-0x00007FF6B9BB0000-0x00007FF6B9FA2000-memory.dmp	xmrig
behavioral2/memory/552-2219-0x00007FF6CCDB0000-0x00007FF6CD1A2000-memory.dmp	xmrig
behavioral2/memory/2388-2216-0x00007FF77A5F0000-0x00007FF77A9E2000-memory.dmp	xmrig
behavioral2/memory/1328-2214-0x00007FF72F5D0000-0x00007FF72F9C2000-memory.dmp	xmrig
behavioral2/memory/628-2210-0x00007FF65D6C0000-0x00007FF65DAB2000-memory.dmp	xmrig
behavioral2/memory/4316-2257-0x00007FF7685B0000-0x00007FF7689A2000-memory.dmp	xmrig
behavioral2/memory/4260-2259-0x00007FF77F720000-0x00007FF77FB12000-memory.dmp	xmrig
behavioral2/memory/2904-2261-0x00007FF6532A0000-0x00007FF653692000-memory.dmp	xmrig
behavioral2/memory/1216-2263-0x00007FF670A30000-0x00007FF670E22000-memory.dmp	xmrig
behavioral2/memory/4864-2269-0x00007FF6123B0000-0x00007FF6127A2000-memory.dmp	xmrig
behavioral2/memory/3188-2271-0x00007FF74B4A0000-0x00007FF74B892000-memory.dmp	xmrig
behavioral2/memory/4192-2268-0x00007FF645920000-0x00007FF645D12000-memory.dmp	xmrig
behavioral2/memory/216-2266-0x00007FF7B1460000-0x00007FF7B1852000-memory.dmp	xmrig
behavioral2/memory/3428-2273-0x00007FF748B90000-0x00007FF748F82000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4796	eaGMSSw.exe
2620	GwbqmBs.exe
3344	BRscWgo.exe
5112	MxunwrE.exe
4928	JVZwPoN.exe
1376	OMFLbhz.exe
552	DkZeOEh.exe
1032	EQOerEK.exe
2452	awbESao.exe
2388	IckkrQU.exe
1328	OIwGdZM.exe
628	EVkDeUM.exe
4316	EdyuvMA.exe
4260	JXWTmCU.exe
2904	xFNtyLe.exe
4864	MaPkDRH.exe
4192	zKOHQxX.exe
3188	UpTrdTN.exe
216	ovMUmxG.exe
1216	fqhjCXp.exe
3428	JLpPoma.exe
3356	yaiGvUD.exe
376	flfbNlL.exe
3192	daACBSb.exe
4496	pfQbpBc.exe
2352	SjxbmRQ.exe
4288	REhIXkD.exe
4856	MxXisYn.exe
2340	xaxSRUa.exe
3484	yfCOWvK.exe
4804	yONQALm.exe
2440	kJyLAsN.exe
1576	dcpWhVS.exe
740	oWUMWiy.exe
4940	YKgTShB.exe
3892	oJSaheP.exe
4568	HRgfNEs.exe
464	ipWdNus.exe
2232	GEjRZlS.exe
2636	mlEKpKn.exe
1128	PtskfBM.exe
4952	qdvMjQS.exe
4872	DMOMHfV.exe
2288	qkSCguB.exe
1432	JAePcim.exe
2552	bdlMwZd.exe
4292	tjHNgpH.exe
4832	vHsOqqK.exe
3104	dTRhhJw.exe
808	jqTkcFm.exe
2140	IqYKxor.exe
2460	kzJCFvU.exe
432	wPfhsAf.exe
3180	ZLIcGSX.exe
436	VfRMtIU.exe
1644	gLZclNb.exe
4000	ZNMDqZl.exe
4512	wOOEana.exe
5004	pMFKDBK.exe
3488	wkzJNrK.exe
3208	DxMsQWe.exe
2600	dbKiJxA.exe
3380	ufLrPhu.exe
4900	gMJNyaO.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3212-0-0x00007FF6FACE0000-0x00007FF6FB0D2000-memory.dmp	upx
behavioral2/files/0x000c000000023b4b-5.dat	upx
behavioral2/files/0x000b000000023ba8-10.dat	upx
behavioral2/files/0x000a000000023ba9-16.dat	upx
behavioral2/memory/4796-24-0x00007FF7A7010000-0x00007FF7A7402000-memory.dmp	upx
behavioral2/memory/3344-36-0x00007FF69FA40000-0x00007FF69FE32000-memory.dmp	upx
behavioral2/files/0x000a000000023bae-50.dat	upx
behavioral2/files/0x000b000000023bb0-73.dat	upx
behavioral2/files/0x000b000000023bb1-77.dat	upx
behavioral2/memory/1376-85-0x00007FF75F640000-0x00007FF75FA32000-memory.dmp	upx
behavioral2/memory/2388-87-0x00007FF77A5F0000-0x00007FF77A9E2000-memory.dmp	upx
behavioral2/memory/2452-86-0x00007FF6B9BB0000-0x00007FF6B9FA2000-memory.dmp	upx
behavioral2/memory/628-84-0x00007FF65D6C0000-0x00007FF65DAB2000-memory.dmp	upx
behavioral2/memory/1328-83-0x00007FF72F5D0000-0x00007FF72F9C2000-memory.dmp	upx
behavioral2/memory/1032-79-0x00007FF6830E0000-0x00007FF6834D2000-memory.dmp	upx
behavioral2/memory/552-74-0x00007FF6CCDB0000-0x00007FF6CD1A2000-memory.dmp	upx
behavioral2/files/0x000a000000023bb2-71.dat	upx
behavioral2/memory/4928-70-0x00007FF7469F0000-0x00007FF746DE2000-memory.dmp	upx
behavioral2/memory/5112-68-0x00007FF6087F0000-0x00007FF608BE2000-memory.dmp	upx
behavioral2/files/0x000a000000023baf-62.dat	upx
behavioral2/files/0x000a000000023bad-58.dat	upx
behavioral2/files/0x000a000000023bac-56.dat	upx
behavioral2/memory/2620-51-0x00007FF664580000-0x00007FF664972000-memory.dmp	upx
behavioral2/files/0x000a000000023baa-29.dat	upx
behavioral2/files/0x000a000000023bab-28.dat	upx
behavioral2/files/0x000a000000023bb3-90.dat	upx
behavioral2/memory/4316-92-0x00007FF7685B0000-0x00007FF7689A2000-memory.dmp	upx
behavioral2/files/0x0031000000023bb4-105.dat	upx
behavioral2/files/0x0031000000023bb5-111.dat	upx
behavioral2/files/0x000a000000023bb7-120.dat	upx
behavioral2/files/0x000a000000023bb9-129.dat	upx
behavioral2/files/0x000a000000023bb8-127.dat	upx
behavioral2/files/0x0031000000023bb6-119.dat	upx
behavioral2/memory/2904-109-0x00007FF6532A0000-0x00007FF653692000-memory.dmp	upx
behavioral2/memory/4260-104-0x00007FF77F720000-0x00007FF77FB12000-memory.dmp	upx
behavioral2/files/0x000b000000023ba6-96.dat	upx
behavioral2/memory/3188-140-0x00007FF74B4A0000-0x00007FF74B892000-memory.dmp	upx
behavioral2/files/0x000a000000023bbd-147.dat	upx
behavioral2/files/0x000a000000023bc0-165.dat	upx
behavioral2/memory/3428-169-0x00007FF748B90000-0x00007FF748F82000-memory.dmp	upx
behavioral2/files/0x000a000000023bc1-177.dat	upx
behavioral2/files/0x000a000000023bc2-182.dat	upx
behavioral2/files/0x000a000000023bc3-184.dat	upx
behavioral2/files/0x000a000000023bbf-175.dat	upx
behavioral2/files/0x000a000000023bbe-168.dat	upx
behavioral2/memory/1216-163-0x00007FF670A30000-0x00007FF670E22000-memory.dmp	upx
behavioral2/files/0x000a000000023bbc-160.dat	upx
behavioral2/memory/216-149-0x00007FF7B1460000-0x00007FF7B1852000-memory.dmp	upx
behavioral2/files/0x000a000000023bbb-148.dat	upx
behavioral2/files/0x000a000000023bba-141.dat	upx
behavioral2/memory/4192-137-0x00007FF645920000-0x00007FF645D12000-memory.dmp	upx
behavioral2/memory/4864-131-0x00007FF6123B0000-0x00007FF6127A2000-memory.dmp	upx
behavioral2/files/0x000a000000023bc4-189.dat	upx
behavioral2/files/0x000a000000023bc6-197.dat	upx
behavioral2/files/0x000a000000023bc5-196.dat	upx
behavioral2/memory/3212-1420-0x00007FF6FACE0000-0x00007FF6FB0D2000-memory.dmp	upx
behavioral2/memory/1328-2146-0x00007FF72F5D0000-0x00007FF72F9C2000-memory.dmp	upx
behavioral2/memory/4316-2161-0x00007FF7685B0000-0x00007FF7689A2000-memory.dmp	upx
behavioral2/memory/4260-2162-0x00007FF77F720000-0x00007FF77FB12000-memory.dmp	upx
behavioral2/memory/4796-2196-0x00007FF7A7010000-0x00007FF7A7402000-memory.dmp	upx
behavioral2/memory/2620-2198-0x00007FF664580000-0x00007FF664972000-memory.dmp	upx
behavioral2/memory/3344-2200-0x00007FF69FA40000-0x00007FF69FE32000-memory.dmp	upx
behavioral2/memory/4928-2204-0x00007FF7469F0000-0x00007FF746DE2000-memory.dmp	upx
behavioral2/memory/5112-2205-0x00007FF6087F0000-0x00007FF608BE2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\flfbNlL.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\BOsgwBV.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\RiYBWco.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\ClOhYtt.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\EVkDeUM.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\DxMsQWe.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\DtfwzSY.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\oRLNNxQ.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\FWHpwYP.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\onxvELo.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\SyyqJFK.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\cNyGYlg.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\VSnqcnM.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\xsxNtdX.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\DIjiPXP.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\rnxQjIs.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\YpQToXl.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\klaqtmi.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\rJVNcWE.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\IyCTomb.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\czYNxQU.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\NfugWeL.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\GnxuvRB.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\TNMEdEb.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\OyVhCiH.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\hNjzfRY.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\gAqDDbK.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\MqXBGqD.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\XgylhvT.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\ePyYFaz.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\ohqGyWl.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\kJyLAsN.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\ZmwpyAb.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\GTBVFZR.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\cmFsisC.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\VGwjQsw.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\afPWuLV.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\zDpQrRl.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\iCRDKzl.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\REhIXkD.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\wkzJNrK.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\OEYbIBY.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\OBVglnU.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\KZvfRYY.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\CkXUdvq.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\yzLbwvI.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\ZLIcGSX.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\MaRKxMr.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\ZthtIPY.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\vrjgkOR.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\spNqOrK.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\EdyuvMA.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\ClKFeDJ.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\irwEzbI.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\WnvmPPf.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\pYfHTGC.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\JLpPoma.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\OHJPDTE.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\cTylZws.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\MMaphEE.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\DisUFIY.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\AiiWOgh.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\PcKiEXG.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\YjKkPOh.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1224	powershell.exe
1224	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
Token: SeDebugPrivilege	1224	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 1224	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	86
PID 3212 wrote to memory of 1224	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	86
PID 3212 wrote to memory of 4796	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	87
PID 3212 wrote to memory of 4796	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	87
PID 3212 wrote to memory of 2620	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	88
PID 3212 wrote to memory of 2620	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	88
PID 3212 wrote to memory of 3344	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	89
PID 3212 wrote to memory of 3344	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	89
PID 3212 wrote to memory of 5112	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	90
PID 3212 wrote to memory of 5112	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	90
PID 3212 wrote to memory of 4928	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	91
PID 3212 wrote to memory of 4928	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	91
PID 3212 wrote to memory of 1376	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	92
PID 3212 wrote to memory of 1376	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	92
PID 3212 wrote to memory of 552	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	93
PID 3212 wrote to memory of 552	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	93
PID 3212 wrote to memory of 1032	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	94
PID 3212 wrote to memory of 1032	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	94
PID 3212 wrote to memory of 2452	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	95
PID 3212 wrote to memory of 2452	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	95
PID 3212 wrote to memory of 1328	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	96
PID 3212 wrote to memory of 1328	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	96
PID 3212 wrote to memory of 2388	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	97
PID 3212 wrote to memory of 2388	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	97
PID 3212 wrote to memory of 628	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	98
PID 3212 wrote to memory of 628	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	98
PID 3212 wrote to memory of 4316	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	99
PID 3212 wrote to memory of 4316	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	99
PID 3212 wrote to memory of 4260	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	101
PID 3212 wrote to memory of 4260	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	101
PID 3212 wrote to memory of 2904	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	102
PID 3212 wrote to memory of 2904	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	102
PID 3212 wrote to memory of 4864	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	103
PID 3212 wrote to memory of 4864	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	103
PID 3212 wrote to memory of 4192	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	104
PID 3212 wrote to memory of 4192	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	104
PID 3212 wrote to memory of 3188	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	105
PID 3212 wrote to memory of 3188	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	105
PID 3212 wrote to memory of 216	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	106
PID 3212 wrote to memory of 216	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	106
PID 3212 wrote to memory of 1216	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	107
PID 3212 wrote to memory of 1216	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	107
PID 3212 wrote to memory of 3428	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	108
PID 3212 wrote to memory of 3428	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	108
PID 3212 wrote to memory of 3356	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	110
PID 3212 wrote to memory of 3356	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	110
PID 3212 wrote to memory of 376	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	111
PID 3212 wrote to memory of 376	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	111
PID 3212 wrote to memory of 3192	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	112
PID 3212 wrote to memory of 3192	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	112
PID 3212 wrote to memory of 4496	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	113
PID 3212 wrote to memory of 4496	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	113
PID 3212 wrote to memory of 4288	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	114
PID 3212 wrote to memory of 4288	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	114
PID 3212 wrote to memory of 2352	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	115
PID 3212 wrote to memory of 2352	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	115
PID 3212 wrote to memory of 4856	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	116
PID 3212 wrote to memory of 4856	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	116
PID 3212 wrote to memory of 2340	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	117
PID 3212 wrote to memory of 2340	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	117
PID 3212 wrote to memory of 3484	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	118
PID 3212 wrote to memory of 3484	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	118
PID 3212 wrote to memory of 4804	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	119
PID 3212 wrote to memory of 4804	3212	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	119

C:\Users\Admin\AppData\Local\Temp\00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1224
- C:\Windows\System\eaGMSSw.exe
  C:\Windows\System\eaGMSSw.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\GwbqmBs.exe
  C:\Windows\System\GwbqmBs.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\BRscWgo.exe
  C:\Windows\System\BRscWgo.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System\MxunwrE.exe
  C:\Windows\System\MxunwrE.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\JVZwPoN.exe
  C:\Windows\System\JVZwPoN.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\OMFLbhz.exe
  C:\Windows\System\OMFLbhz.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\DkZeOEh.exe
  C:\Windows\System\DkZeOEh.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\EQOerEK.exe
  C:\Windows\System\EQOerEK.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\awbESao.exe
  C:\Windows\System\awbESao.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\OIwGdZM.exe
  C:\Windows\System\OIwGdZM.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\IckkrQU.exe
  C:\Windows\System\IckkrQU.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\EVkDeUM.exe
  C:\Windows\System\EVkDeUM.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\EdyuvMA.exe
  C:\Windows\System\EdyuvMA.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\JXWTmCU.exe
  C:\Windows\System\JXWTmCU.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\xFNtyLe.exe
  C:\Windows\System\xFNtyLe.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\MaPkDRH.exe
  C:\Windows\System\MaPkDRH.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\zKOHQxX.exe
  C:\Windows\System\zKOHQxX.exe
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Windows\System\UpTrdTN.exe
  C:\Windows\System\UpTrdTN.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System\ovMUmxG.exe
  C:\Windows\System\ovMUmxG.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\fqhjCXp.exe
  C:\Windows\System\fqhjCXp.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\JLpPoma.exe
  C:\Windows\System\JLpPoma.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\yaiGvUD.exe
  C:\Windows\System\yaiGvUD.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\flfbNlL.exe
  C:\Windows\System\flfbNlL.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\daACBSb.exe
  C:\Windows\System\daACBSb.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\pfQbpBc.exe
  C:\Windows\System\pfQbpBc.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\REhIXkD.exe
  C:\Windows\System\REhIXkD.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\SjxbmRQ.exe
  C:\Windows\System\SjxbmRQ.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\MxXisYn.exe
  C:\Windows\System\MxXisYn.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\xaxSRUa.exe
  C:\Windows\System\xaxSRUa.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\yfCOWvK.exe
  C:\Windows\System\yfCOWvK.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\yONQALm.exe
  C:\Windows\System\yONQALm.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\kJyLAsN.exe
  C:\Windows\System\kJyLAsN.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\dcpWhVS.exe
  C:\Windows\System\dcpWhVS.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\oWUMWiy.exe
  C:\Windows\System\oWUMWiy.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\YKgTShB.exe
  C:\Windows\System\YKgTShB.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\oJSaheP.exe
  C:\Windows\System\oJSaheP.exe
  2⤵
  - Executes dropped EXE
  PID:3892
- C:\Windows\System\HRgfNEs.exe
  C:\Windows\System\HRgfNEs.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\ipWdNus.exe
  C:\Windows\System\ipWdNus.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\GEjRZlS.exe
  C:\Windows\System\GEjRZlS.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\mlEKpKn.exe
  C:\Windows\System\mlEKpKn.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\PtskfBM.exe
  C:\Windows\System\PtskfBM.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\qdvMjQS.exe
  C:\Windows\System\qdvMjQS.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\DMOMHfV.exe
  C:\Windows\System\DMOMHfV.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\qkSCguB.exe
  C:\Windows\System\qkSCguB.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\JAePcim.exe
  C:\Windows\System\JAePcim.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\bdlMwZd.exe
  C:\Windows\System\bdlMwZd.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\tjHNgpH.exe
  C:\Windows\System\tjHNgpH.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\vHsOqqK.exe
  C:\Windows\System\vHsOqqK.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\dTRhhJw.exe
  C:\Windows\System\dTRhhJw.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\jqTkcFm.exe
  C:\Windows\System\jqTkcFm.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\IqYKxor.exe
  C:\Windows\System\IqYKxor.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\kzJCFvU.exe
  C:\Windows\System\kzJCFvU.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\wPfhsAf.exe
  C:\Windows\System\wPfhsAf.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\ZLIcGSX.exe
  C:\Windows\System\ZLIcGSX.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\VfRMtIU.exe
  C:\Windows\System\VfRMtIU.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\gLZclNb.exe
  C:\Windows\System\gLZclNb.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\ZNMDqZl.exe
  C:\Windows\System\ZNMDqZl.exe
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Windows\System\wOOEana.exe
  C:\Windows\System\wOOEana.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\pMFKDBK.exe
  C:\Windows\System\pMFKDBK.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\wkzJNrK.exe
  C:\Windows\System\wkzJNrK.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\DxMsQWe.exe
  C:\Windows\System\DxMsQWe.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\dbKiJxA.exe
  C:\Windows\System\dbKiJxA.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\ufLrPhu.exe
  C:\Windows\System\ufLrPhu.exe
  2⤵
  - Executes dropped EXE
  PID:3380
- C:\Windows\System\gMJNyaO.exe
  C:\Windows\System\gMJNyaO.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\UrJJYyM.exe
  C:\Windows\System\UrJJYyM.exe
  2⤵
  PID:3196
- C:\Windows\System\qRBMgRf.exe
  C:\Windows\System\qRBMgRf.exe
  2⤵
  PID:1252
- C:\Windows\System\hIXnzpk.exe
  C:\Windows\System\hIXnzpk.exe
  2⤵
  PID:624
- C:\Windows\System\MyCxWbJ.exe
  C:\Windows\System\MyCxWbJ.exe
  2⤵
  PID:3320
- C:\Windows\System\TohWMpt.exe
  C:\Windows\System\TohWMpt.exe
  2⤵
  PID:1728
- C:\Windows\System\TstDRuQ.exe
  C:\Windows\System\TstDRuQ.exe
  2⤵
  PID:4556
- C:\Windows\System\MQmEluy.exe
  C:\Windows\System\MQmEluy.exe
  2⤵
  PID:3548
- C:\Windows\System\FFLBeQN.exe
  C:\Windows\System\FFLBeQN.exe
  2⤵
  PID:4580
- C:\Windows\System\rpTWhCk.exe
  C:\Windows\System\rpTWhCk.exe
  2⤵
  PID:3432
- C:\Windows\System\DNWoEFf.exe
  C:\Windows\System\DNWoEFf.exe
  2⤵
  PID:4460
- C:\Windows\System\QJOcMHw.exe
  C:\Windows\System\QJOcMHw.exe
  2⤵
  PID:4064
- C:\Windows\System\DTZLIgl.exe
  C:\Windows\System\DTZLIgl.exe
  2⤵
  PID:3008
- C:\Windows\System\VhhYDqN.exe
  C:\Windows\System\VhhYDqN.exe
  2⤵
  PID:4836
- C:\Windows\System\DtfwzSY.exe
  C:\Windows\System\DtfwzSY.exe
  2⤵
  PID:4896
- C:\Windows\System\fjlnHrd.exe
  C:\Windows\System\fjlnHrd.exe
  2⤵
  PID:2192
- C:\Windows\System\DGheVdv.exe
  C:\Windows\System\DGheVdv.exe
  2⤵
  PID:1832
- C:\Windows\System\XUzpDIz.exe
  C:\Windows\System\XUzpDIz.exe
  2⤵
  PID:1528
- C:\Windows\System\ljGPOub.exe
  C:\Windows\System\ljGPOub.exe
  2⤵
  PID:1360
- C:\Windows\System\OHJPDTE.exe
  C:\Windows\System\OHJPDTE.exe
  2⤵
  PID:1796
- C:\Windows\System\sTpUnLV.exe
  C:\Windows\System\sTpUnLV.exe
  2⤵
  PID:4692
- C:\Windows\System\DvSdvpc.exe
  C:\Windows\System\DvSdvpc.exe
  2⤵
  PID:2612
- C:\Windows\System\gfpIpbd.exe
  C:\Windows\System\gfpIpbd.exe
  2⤵
  PID:4324
- C:\Windows\System\WwGHSRR.exe
  C:\Windows\System\WwGHSRR.exe
  2⤵
  PID:2476
- C:\Windows\System\vJdjnyS.exe
  C:\Windows\System\vJdjnyS.exe
  2⤵
  PID:5148
- C:\Windows\System\ViMjtNu.exe
  C:\Windows\System\ViMjtNu.exe
  2⤵
  PID:5180
- C:\Windows\System\aIRgmEG.exe
  C:\Windows\System\aIRgmEG.exe
  2⤵
  PID:5204
- C:\Windows\System\HLtmnsz.exe
  C:\Windows\System\HLtmnsz.exe
  2⤵
  PID:5232
- C:\Windows\System\CSKJPMN.exe
  C:\Windows\System\CSKJPMN.exe
  2⤵
  PID:5256
- C:\Windows\System\Czwdsdb.exe
  C:\Windows\System\Czwdsdb.exe
  2⤵
  PID:5304
- C:\Windows\System\owCNcGs.exe
  C:\Windows\System\owCNcGs.exe
  2⤵
  PID:5320
- C:\Windows\System\KqCqNJa.exe
  C:\Windows\System\KqCqNJa.exe
  2⤵
  PID:5336
- C:\Windows\System\TXoCUqb.exe
  C:\Windows\System\TXoCUqb.exe
  2⤵
  PID:5372
- C:\Windows\System\hWXHqQa.exe
  C:\Windows\System\hWXHqQa.exe
  2⤵
  PID:5392
- C:\Windows\System\ERCrcqa.exe
  C:\Windows\System\ERCrcqa.exe
  2⤵
  PID:5416
- C:\Windows\System\OcuTCrp.exe
  C:\Windows\System\OcuTCrp.exe
  2⤵
  PID:5436
- C:\Windows\System\esEIisr.exe
  C:\Windows\System\esEIisr.exe
  2⤵
  PID:5452
- C:\Windows\System\eoiozsD.exe
  C:\Windows\System\eoiozsD.exe
  2⤵
  PID:5500
- C:\Windows\System\gnFClSB.exe
  C:\Windows\System\gnFClSB.exe
  2⤵
  PID:5520
- C:\Windows\System\ukwZVfU.exe
  C:\Windows\System\ukwZVfU.exe
  2⤵
  PID:5540
- C:\Windows\System\msEOEOL.exe
  C:\Windows\System\msEOEOL.exe
  2⤵
  PID:5592
- C:\Windows\System\sJVJmiN.exe
  C:\Windows\System\sJVJmiN.exe
  2⤵
  PID:5620
- C:\Windows\System\IyjtASr.exe
  C:\Windows\System\IyjtASr.exe
  2⤵
  PID:5644
- C:\Windows\System\fatwCcP.exe
  C:\Windows\System\fatwCcP.exe
  2⤵
  PID:5664
- C:\Windows\System\AuTMfbT.exe
  C:\Windows\System\AuTMfbT.exe
  2⤵
  PID:5688
- C:\Windows\System\NisZoEQ.exe
  C:\Windows\System\NisZoEQ.exe
  2⤵
  PID:5732
- C:\Windows\System\NfugWeL.exe
  C:\Windows\System\NfugWeL.exe
  2⤵
  PID:5756
- C:\Windows\System\gXNycTl.exe
  C:\Windows\System\gXNycTl.exe
  2⤵
  PID:5772
- C:\Windows\System\vocfOzU.exe
  C:\Windows\System\vocfOzU.exe
  2⤵
  PID:5808
- C:\Windows\System\jvVTDWc.exe
  C:\Windows\System\jvVTDWc.exe
  2⤵
  PID:5844
- C:\Windows\System\Hkmktns.exe
  C:\Windows\System\Hkmktns.exe
  2⤵
  PID:5884
- C:\Windows\System\OgJCWmJ.exe
  C:\Windows\System\OgJCWmJ.exe
  2⤵
  PID:5904
- C:\Windows\System\KKUDpOY.exe
  C:\Windows\System\KKUDpOY.exe
  2⤵
  PID:5928
- C:\Windows\System\LQdfcRA.exe
  C:\Windows\System\LQdfcRA.exe
  2⤵
  PID:5972
- C:\Windows\System\azVKPkx.exe
  C:\Windows\System\azVKPkx.exe
  2⤵
  PID:5988
- C:\Windows\System\xCtrPJU.exe
  C:\Windows\System\xCtrPJU.exe
  2⤵
  PID:6012
- C:\Windows\System\Fhuizki.exe
  C:\Windows\System\Fhuizki.exe
  2⤵
  PID:6028
- C:\Windows\System\dsQmedF.exe
  C:\Windows\System\dsQmedF.exe
  2⤵
  PID:6072
- C:\Windows\System\jioMLxr.exe
  C:\Windows\System\jioMLxr.exe
  2⤵
  PID:6088
- C:\Windows\System\qtyrTVE.exe
  C:\Windows\System\qtyrTVE.exe
  2⤵
  PID:6112
- C:\Windows\System\hRHCesq.exe
  C:\Windows\System\hRHCesq.exe
  2⤵
  PID:5124
- C:\Windows\System\gVXdrnv.exe
  C:\Windows\System\gVXdrnv.exe
  2⤵
  PID:5172
- C:\Windows\System\LACYJFH.exe
  C:\Windows\System\LACYJFH.exe
  2⤵
  PID:5220
- C:\Windows\System\bJrCryt.exe
  C:\Windows\System\bJrCryt.exe
  2⤵
  PID:5288
- C:\Windows\System\YaFjUqe.exe
  C:\Windows\System\YaFjUqe.exe
  2⤵
  PID:5352
- C:\Windows\System\yjKKAwP.exe
  C:\Windows\System\yjKKAwP.exe
  2⤵
  PID:5360
- C:\Windows\System\RCPsKdD.exe
  C:\Windows\System\RCPsKdD.exe
  2⤵
  PID:5512
- C:\Windows\System\vZJADmR.exe
  C:\Windows\System\vZJADmR.exe
  2⤵
  PID:5584
- C:\Windows\System\YvHnmse.exe
  C:\Windows\System\YvHnmse.exe
  2⤵
  PID:5616
- C:\Windows\System\UMFqAXK.exe
  C:\Windows\System\UMFqAXK.exe
  2⤵
  PID:5744
- C:\Windows\System\bHqNhYp.exe
  C:\Windows\System\bHqNhYp.exe
  2⤵
  PID:5720
- C:\Windows\System\dnTWTht.exe
  C:\Windows\System\dnTWTht.exe
  2⤵
  PID:5800
- C:\Windows\System\hzXGNkB.exe
  C:\Windows\System\hzXGNkB.exe
  2⤵
  PID:5860
- C:\Windows\System\YcxFFob.exe
  C:\Windows\System\YcxFFob.exe
  2⤵
  PID:5944
- C:\Windows\System\dDgIXNy.exe
  C:\Windows\System\dDgIXNy.exe
  2⤵
  PID:6004
- C:\Windows\System\RnHPtyY.exe
  C:\Windows\System\RnHPtyY.exe
  2⤵
  PID:6044
- C:\Windows\System\xluJozB.exe
  C:\Windows\System\xluJozB.exe
  2⤵
  PID:5168
- C:\Windows\System\stfsswI.exe
  C:\Windows\System\stfsswI.exe
  2⤵
  PID:5380
- C:\Windows\System\aPkFqcn.exe
  C:\Windows\System\aPkFqcn.exe
  2⤵
  PID:5328
- C:\Windows\System\lxBsSoX.exe
  C:\Windows\System\lxBsSoX.exe
  2⤵
  PID:5428
- C:\Windows\System\wYXLDxc.exe
  C:\Windows\System\wYXLDxc.exe
  2⤵
  PID:5680
- C:\Windows\System\LKaTskP.exe
  C:\Windows\System\LKaTskP.exe
  2⤵
  PID:5788
- C:\Windows\System\cAcJLNG.exe
  C:\Windows\System\cAcJLNG.exe
  2⤵
  PID:4904
- C:\Windows\System\etCsJxS.exe
  C:\Windows\System\etCsJxS.exe
  2⤵
  PID:6052
- C:\Windows\System\MMaphEE.exe
  C:\Windows\System\MMaphEE.exe
  2⤵
  PID:6136
- C:\Windows\System\PZxetsP.exe
  C:\Windows\System\PZxetsP.exe
  2⤵
  PID:5408
- C:\Windows\System\LNQiGoq.exe
  C:\Windows\System\LNQiGoq.exe
  2⤵
  PID:5964
- C:\Windows\System\ezrEVgH.exe
  C:\Windows\System\ezrEVgH.exe
  2⤵
  PID:6152
- C:\Windows\System\PqKutoF.exe
  C:\Windows\System\PqKutoF.exe
  2⤵
  PID:6172
- C:\Windows\System\xlcoeSG.exe
  C:\Windows\System\xlcoeSG.exe
  2⤵
  PID:6196
- C:\Windows\System\vJdzNIt.exe
  C:\Windows\System\vJdzNIt.exe
  2⤵
  PID:6212
- C:\Windows\System\CNoDNqQ.exe
  C:\Windows\System\CNoDNqQ.exe
  2⤵
  PID:6232
- C:\Windows\System\DjzdEGj.exe
  C:\Windows\System\DjzdEGj.exe
  2⤵
  PID:6256
- C:\Windows\System\yvvDzKo.exe
  C:\Windows\System\yvvDzKo.exe
  2⤵
  PID:6308
- C:\Windows\System\VhSJAnF.exe
  C:\Windows\System\VhSJAnF.exe
  2⤵
  PID:6332
- C:\Windows\System\yBRxRUU.exe
  C:\Windows\System\yBRxRUU.exe
  2⤵
  PID:6352
- C:\Windows\System\oyBLkvH.exe
  C:\Windows\System\oyBLkvH.exe
  2⤵
  PID:6380
- C:\Windows\System\lMqtONc.exe
  C:\Windows\System\lMqtONc.exe
  2⤵
  PID:6396
- C:\Windows\System\diPlOWi.exe
  C:\Windows\System\diPlOWi.exe
  2⤵
  PID:6464
- C:\Windows\System\DIjiPXP.exe
  C:\Windows\System\DIjiPXP.exe
  2⤵
  PID:6504
- C:\Windows\System\MnEnSYz.exe
  C:\Windows\System\MnEnSYz.exe
  2⤵
  PID:6524
- C:\Windows\System\MpjHeHe.exe
  C:\Windows\System\MpjHeHe.exe
  2⤵
  PID:6572
- C:\Windows\System\rkZYwTF.exe
  C:\Windows\System\rkZYwTF.exe
  2⤵
  PID:6596
- C:\Windows\System\fnqGXzR.exe
  C:\Windows\System\fnqGXzR.exe
  2⤵
  PID:6616
- C:\Windows\System\lCMtXdD.exe
  C:\Windows\System\lCMtXdD.exe
  2⤵
  PID:6636
- C:\Windows\System\pFPSQta.exe
  C:\Windows\System\pFPSQta.exe
  2⤵
  PID:6664
- C:\Windows\System\XtmIRkl.exe
  C:\Windows\System\XtmIRkl.exe
  2⤵
  PID:6712
- C:\Windows\System\ZRsppce.exe
  C:\Windows\System\ZRsppce.exe
  2⤵
  PID:6732
- C:\Windows\System\GkBMnXJ.exe
  C:\Windows\System\GkBMnXJ.exe
  2⤵
  PID:6756
- C:\Windows\System\TeWzBSz.exe
  C:\Windows\System\TeWzBSz.exe
  2⤵
  PID:6776
- C:\Windows\System\EhAUyMM.exe
  C:\Windows\System\EhAUyMM.exe
  2⤵
  PID:6804
- C:\Windows\System\QWcEGDK.exe
  C:\Windows\System\QWcEGDK.exe
  2⤵
  PID:6852
- C:\Windows\System\hXrfOVr.exe
  C:\Windows\System\hXrfOVr.exe
  2⤵
  PID:6872
- C:\Windows\System\WnSSaVA.exe
  C:\Windows\System\WnSSaVA.exe
  2⤵
  PID:6888
- C:\Windows\System\KjooKKE.exe
  C:\Windows\System\KjooKKE.exe
  2⤵
  PID:6912
- C:\Windows\System\hgpgccQ.exe
  C:\Windows\System\hgpgccQ.exe
  2⤵
  PID:6936
- C:\Windows\System\VMAtvqL.exe
  C:\Windows\System\VMAtvqL.exe
  2⤵
  PID:6952
- C:\Windows\System\EfarluB.exe
  C:\Windows\System\EfarluB.exe
  2⤵
  PID:6980
- C:\Windows\System\DqHlGLi.exe
  C:\Windows\System\DqHlGLi.exe
  2⤵
  PID:7028
- C:\Windows\System\NtnWPNf.exe
  C:\Windows\System\NtnWPNf.exe
  2⤵
  PID:7076
- C:\Windows\System\klaqtmi.exe
  C:\Windows\System\klaqtmi.exe
  2⤵
  PID:7096
- C:\Windows\System\piZhBfb.exe
  C:\Windows\System\piZhBfb.exe
  2⤵
  PID:7120
- C:\Windows\System\MlxuErZ.exe
  C:\Windows\System\MlxuErZ.exe
  2⤵
  PID:7140
- C:\Windows\System\CcPYiKT.exe
  C:\Windows\System\CcPYiKT.exe
  2⤵
  PID:7164
- C:\Windows\System\nidQQLp.exe
  C:\Windows\System\nidQQLp.exe
  2⤵
  PID:6148
- C:\Windows\System\urFwvAC.exe
  C:\Windows\System\urFwvAC.exe
  2⤵
  PID:6180
- C:\Windows\System\MFHmaey.exe
  C:\Windows\System\MFHmaey.exe
  2⤵
  PID:6252
- C:\Windows\System\ZmwpyAb.exe
  C:\Windows\System\ZmwpyAb.exe
  2⤵
  PID:6388
- C:\Windows\System\WOIPWxE.exe
  C:\Windows\System\WOIPWxE.exe
  2⤵
  PID:6420
- C:\Windows\System\xaLgLjp.exe
  C:\Windows\System\xaLgLjp.exe
  2⤵
  PID:6500
- C:\Windows\System\VGwjQsw.exe
  C:\Windows\System\VGwjQsw.exe
  2⤵
  PID:6516
- C:\Windows\System\XceAwLQ.exe
  C:\Windows\System\XceAwLQ.exe
  2⤵
  PID:6568
- C:\Windows\System\pfhGEqV.exe
  C:\Windows\System\pfhGEqV.exe
  2⤵
  PID:6612
- C:\Windows\System\DisUFIY.exe
  C:\Windows\System\DisUFIY.exe
  2⤵
  PID:6696
- C:\Windows\System\YuBjjcY.exe
  C:\Windows\System\YuBjjcY.exe
  2⤵
  PID:6728
- C:\Windows\System\abuNiRU.exe
  C:\Windows\System\abuNiRU.exe
  2⤵
  PID:6832
- C:\Windows\System\PbCuFfi.exe
  C:\Windows\System\PbCuFfi.exe
  2⤵
  PID:6896
- C:\Windows\System\dErMPny.exe
  C:\Windows\System\dErMPny.exe
  2⤵
  PID:6944
- C:\Windows\System\KWFzHtv.exe
  C:\Windows\System\KWFzHtv.exe
  2⤵
  PID:6968
- C:\Windows\System\VDgIKcF.exe
  C:\Windows\System\VDgIKcF.exe
  2⤵
  PID:7068
- C:\Windows\System\kPdjBHU.exe
  C:\Windows\System\kPdjBHU.exe
  2⤵
  PID:7072
- C:\Windows\System\OEYbIBY.exe
  C:\Windows\System\OEYbIBY.exe
  2⤵
  PID:7160
- C:\Windows\System\EZSvajK.exe
  C:\Windows\System\EZSvajK.exe
  2⤵
  PID:6208
- C:\Windows\System\rCCPjas.exe
  C:\Windows\System\rCCPjas.exe
  2⤵
  PID:6324
- C:\Windows\System\nQsutYK.exe
  C:\Windows\System\nQsutYK.exe
  2⤵
  PID:6416
- C:\Windows\System\fAeWHuy.exe
  C:\Windows\System\fAeWHuy.exe
  2⤵
  PID:6812
- C:\Windows\System\xeSicXq.exe
  C:\Windows\System\xeSicXq.exe
  2⤵
  PID:7056
- C:\Windows\System\tLZbTCW.exe
  C:\Windows\System\tLZbTCW.exe
  2⤵
  PID:6348
- C:\Windows\System\cwkQGXz.exe
  C:\Windows\System\cwkQGXz.exe
  2⤵
  PID:6604
- C:\Windows\System\KsXJQDb.exe
  C:\Windows\System\KsXJQDb.exe
  2⤵
  PID:7204
- C:\Windows\System\WOZtYWT.exe
  C:\Windows\System\WOZtYWT.exe
  2⤵
  PID:7268
- C:\Windows\System\GNxlBIT.exe
  C:\Windows\System\GNxlBIT.exe
  2⤵
  PID:7308
- C:\Windows\System\RNSIHfR.exe
  C:\Windows\System\RNSIHfR.exe
  2⤵
  PID:7336
- C:\Windows\System\xLqlOVe.exe
  C:\Windows\System\xLqlOVe.exe
  2⤵
  PID:7356
- C:\Windows\System\VggNwrO.exe
  C:\Windows\System\VggNwrO.exe
  2⤵
  PID:7376
- C:\Windows\System\zJyCWgl.exe
  C:\Windows\System\zJyCWgl.exe
  2⤵
  PID:7424
- C:\Windows\System\RLFNYSs.exe
  C:\Windows\System\RLFNYSs.exe
  2⤵
  PID:7444
- C:\Windows\System\EAJDSeY.exe
  C:\Windows\System\EAJDSeY.exe
  2⤵
  PID:7492
- C:\Windows\System\flUZyBK.exe
  C:\Windows\System\flUZyBK.exe
  2⤵
  PID:7512
- C:\Windows\System\SkEFTJS.exe
  C:\Windows\System\SkEFTJS.exe
  2⤵
  PID:7528
- C:\Windows\System\OzCHEQv.exe
  C:\Windows\System\OzCHEQv.exe
  2⤵
  PID:7548
- C:\Windows\System\lBqLnLG.exe
  C:\Windows\System\lBqLnLG.exe
  2⤵
  PID:7580
- C:\Windows\System\RooGIpY.exe
  C:\Windows\System\RooGIpY.exe
  2⤵
  PID:7600
- C:\Windows\System\OJEbDon.exe
  C:\Windows\System\OJEbDon.exe
  2⤵
  PID:7628
- C:\Windows\System\aRYSPqj.exe
  C:\Windows\System\aRYSPqj.exe
  2⤵
  PID:7648
- C:\Windows\System\EcvldZy.exe
  C:\Windows\System\EcvldZy.exe
  2⤵
  PID:7676
- C:\Windows\System\mdaOpSc.exe
  C:\Windows\System\mdaOpSc.exe
  2⤵
  PID:7720
- C:\Windows\System\ciRIPsa.exe
  C:\Windows\System\ciRIPsa.exe
  2⤵
  PID:7752
- C:\Windows\System\aRnOaht.exe
  C:\Windows\System\aRnOaht.exe
  2⤵
  PID:7796
- C:\Windows\System\qkCXHpq.exe
  C:\Windows\System\qkCXHpq.exe
  2⤵
  PID:7820
- C:\Windows\System\ZVRqXZM.exe
  C:\Windows\System\ZVRqXZM.exe
  2⤵
  PID:7860
- C:\Windows\System\SyyqJFK.exe
  C:\Windows\System\SyyqJFK.exe
  2⤵
  PID:7876
- C:\Windows\System\ZBQYawi.exe
  C:\Windows\System\ZBQYawi.exe
  2⤵
  PID:7896
- C:\Windows\System\AXbrRvD.exe
  C:\Windows\System\AXbrRvD.exe
  2⤵
  PID:7920
- C:\Windows\System\XHvAYUs.exe
  C:\Windows\System\XHvAYUs.exe
  2⤵
  PID:7940
- C:\Windows\System\MxILWVf.exe
  C:\Windows\System\MxILWVf.exe
  2⤵
  PID:7968
- C:\Windows\System\mvNaeGI.exe
  C:\Windows\System\mvNaeGI.exe
  2⤵
  PID:8008
- C:\Windows\System\sXgNsGq.exe
  C:\Windows\System\sXgNsGq.exe
  2⤵
  PID:8032
- C:\Windows\System\KAJGfUR.exe
  C:\Windows\System\KAJGfUR.exe
  2⤵
  PID:8060
- C:\Windows\System\fSkZZdY.exe
  C:\Windows\System\fSkZZdY.exe
  2⤵
  PID:8076
- C:\Windows\System\rnxQjIs.exe
  C:\Windows\System\rnxQjIs.exe
  2⤵
  PID:8124
- C:\Windows\System\svGduLg.exe
  C:\Windows\System\svGduLg.exe
  2⤵
  PID:8144
- C:\Windows\System\QwCcDsR.exe
  C:\Windows\System\QwCcDsR.exe
  2⤵
  PID:8164
- C:\Windows\System\GTBVFZR.exe
  C:\Windows\System\GTBVFZR.exe
  2⤵
  PID:7092
- C:\Windows\System\GaOVARX.exe
  C:\Windows\System\GaOVARX.exe
  2⤵
  PID:7180
- C:\Windows\System\NsDpKPJ.exe
  C:\Windows\System\NsDpKPJ.exe
  2⤵
  PID:7052
- C:\Windows\System\YItLKJw.exe
  C:\Windows\System\YItLKJw.exe
  2⤵
  PID:6884
- C:\Windows\System\hwzfRqD.exe
  C:\Windows\System\hwzfRqD.exe
  2⤵
  PID:7196
- C:\Windows\System\hSPTQLs.exe
  C:\Windows\System\hSPTQLs.exe
  2⤵
  PID:7224
- C:\Windows\System\jLrqygh.exe
  C:\Windows\System\jLrqygh.exe
  2⤵
  PID:7400
- C:\Windows\System\WmVkpNA.exe
  C:\Windows\System\WmVkpNA.exe
  2⤵
  PID:7404
- C:\Windows\System\fvqdjAI.exe
  C:\Windows\System\fvqdjAI.exe
  2⤵
  PID:7540
- C:\Windows\System\uwDCIIv.exe
  C:\Windows\System\uwDCIIv.exe
  2⤵
  PID:7560
- C:\Windows\System\rminbQP.exe
  C:\Windows\System\rminbQP.exe
  2⤵
  PID:7620
- C:\Windows\System\IzMdWzW.exe
  C:\Windows\System\IzMdWzW.exe
  2⤵
  PID:7744
- C:\Windows\System\tkOPNXP.exe
  C:\Windows\System\tkOPNXP.exe
  2⤵
  PID:7768
- C:\Windows\System\FPtOpjU.exe
  C:\Windows\System\FPtOpjU.exe
  2⤵
  PID:7852
- C:\Windows\System\MaRKxMr.exe
  C:\Windows\System\MaRKxMr.exe
  2⤵
  PID:7916
- C:\Windows\System\dBlRLWL.exe
  C:\Windows\System\dBlRLWL.exe
  2⤵
  PID:8016
- C:\Windows\System\DCJpnzi.exe
  C:\Windows\System\DCJpnzi.exe
  2⤵
  PID:8040
- C:\Windows\System\rJVNcWE.exe
  C:\Windows\System\rJVNcWE.exe
  2⤵
  PID:8092
- C:\Windows\System\mXbYsxr.exe
  C:\Windows\System\mXbYsxr.exe
  2⤵
  PID:8152
- C:\Windows\System\hrtECwQ.exe
  C:\Windows\System\hrtECwQ.exe
  2⤵
  PID:8188
- C:\Windows\System\SRLTACA.exe
  C:\Windows\System\SRLTACA.exe
  2⤵
  PID:7000
- C:\Windows\System\rAkVxJC.exe
  C:\Windows\System\rAkVxJC.exe
  2⤵
  PID:7200
- C:\Windows\System\hkZsEDl.exe
  C:\Windows\System\hkZsEDl.exe
  2⤵
  PID:7324
- C:\Windows\System\Piyypbk.exe
  C:\Windows\System\Piyypbk.exe
  2⤵
  PID:7608
- C:\Windows\System\cGxuDCA.exe
  C:\Windows\System\cGxuDCA.exe
  2⤵
  PID:7840
- C:\Windows\System\plgrjOp.exe
  C:\Windows\System\plgrjOp.exe
  2⤵
  PID:7872
- C:\Windows\System\cNyGYlg.exe
  C:\Windows\System\cNyGYlg.exe
  2⤵
  PID:7960
- C:\Windows\System\oRLNNxQ.exe
  C:\Windows\System\oRLNNxQ.exe
  2⤵
  PID:8184
- C:\Windows\System\WQwywcr.exe
  C:\Windows\System\WQwywcr.exe
  2⤵
  PID:7256
- C:\Windows\System\RssuhEo.exe
  C:\Windows\System\RssuhEo.exe
  2⤵
  PID:7672
- C:\Windows\System\CpxPiSE.exe
  C:\Windows\System\CpxPiSE.exe
  2⤵
  PID:8000
- C:\Windows\System\tefxkaK.exe
  C:\Windows\System\tefxkaK.exe
  2⤵
  PID:6928
- C:\Windows\System\vPvDwNr.exe
  C:\Windows\System\vPvDwNr.exe
  2⤵
  PID:8208
- C:\Windows\System\qpVQWhT.exe
  C:\Windows\System\qpVQWhT.exe
  2⤵
  PID:8232
- C:\Windows\System\VVdMQJO.exe
  C:\Windows\System\VVdMQJO.exe
  2⤵
  PID:8252
- C:\Windows\System\ZthtIPY.exe
  C:\Windows\System\ZthtIPY.exe
  2⤵
  PID:8312
- C:\Windows\System\CGsVkOw.exe
  C:\Windows\System\CGsVkOw.exe
  2⤵
  PID:8332
- C:\Windows\System\mMwlJjY.exe
  C:\Windows\System\mMwlJjY.exe
  2⤵
  PID:8352
- C:\Windows\System\cKruWmQ.exe
  C:\Windows\System\cKruWmQ.exe
  2⤵
  PID:8384
- C:\Windows\System\hCPuzZp.exe
  C:\Windows\System\hCPuzZp.exe
  2⤵
  PID:8412
- C:\Windows\System\qPFFTAf.exe
  C:\Windows\System\qPFFTAf.exe
  2⤵
  PID:8452
- C:\Windows\System\fKmdFJY.exe
  C:\Windows\System\fKmdFJY.exe
  2⤵
  PID:8488
- C:\Windows\System\qHjqrHr.exe
  C:\Windows\System\qHjqrHr.exe
  2⤵
  PID:8504
- C:\Windows\System\Pczhegn.exe
  C:\Windows\System\Pczhegn.exe
  2⤵
  PID:8544
- C:\Windows\System\ssjnYQn.exe
  C:\Windows\System\ssjnYQn.exe
  2⤵
  PID:8560
- C:\Windows\System\hfmiKNZ.exe
  C:\Windows\System\hfmiKNZ.exe
  2⤵
  PID:8576
- C:\Windows\System\ygaSPgk.exe
  C:\Windows\System\ygaSPgk.exe
  2⤵
  PID:8596
- C:\Windows\System\BVAdoTW.exe
  C:\Windows\System\BVAdoTW.exe
  2⤵
  PID:8616
- C:\Windows\System\OpZWOvR.exe
  C:\Windows\System\OpZWOvR.exe
  2⤵
  PID:8640
- C:\Windows\System\hFwSSAM.exe
  C:\Windows\System\hFwSSAM.exe
  2⤵
  PID:8676
- C:\Windows\System\ELCSRbt.exe
  C:\Windows\System\ELCSRbt.exe
  2⤵
  PID:8724
- C:\Windows\System\BraTEys.exe
  C:\Windows\System\BraTEys.exe
  2⤵
  PID:8748
- C:\Windows\System\tMjJwMP.exe
  C:\Windows\System\tMjJwMP.exe
  2⤵
  PID:8784
- C:\Windows\System\IHFNrau.exe
  C:\Windows\System\IHFNrau.exe
  2⤵
  PID:8804
- C:\Windows\System\CGzKqsZ.exe
  C:\Windows\System\CGzKqsZ.exe
  2⤵
  PID:8852
- C:\Windows\System\RYDdchY.exe
  C:\Windows\System\RYDdchY.exe
  2⤵
  PID:8876
- C:\Windows\System\YjxPZfL.exe
  C:\Windows\System\YjxPZfL.exe
  2⤵
  PID:8896
- C:\Windows\System\clzrHyu.exe
  C:\Windows\System\clzrHyu.exe
  2⤵
  PID:8936
- C:\Windows\System\SKklAEk.exe
  C:\Windows\System\SKklAEk.exe
  2⤵
  PID:8960
- C:\Windows\System\IyCTomb.exe
  C:\Windows\System\IyCTomb.exe
  2⤵
  PID:8980
- C:\Windows\System\mVqtXei.exe
  C:\Windows\System\mVqtXei.exe
  2⤵
  PID:9000
- C:\Windows\System\SUjThvt.exe
  C:\Windows\System\SUjThvt.exe
  2⤵
  PID:9028
- C:\Windows\System\hZduOXU.exe
  C:\Windows\System\hZduOXU.exe
  2⤵
  PID:9056
- C:\Windows\System\xffMrjw.exe
  C:\Windows\System\xffMrjw.exe
  2⤵
  PID:9076
- C:\Windows\System\CkwdRkq.exe
  C:\Windows\System\CkwdRkq.exe
  2⤵
  PID:9100
- C:\Windows\System\tNAnSyl.exe
  C:\Windows\System\tNAnSyl.exe
  2⤵
  PID:9132
- C:\Windows\System\RKiVRsJ.exe
  C:\Windows\System\RKiVRsJ.exe
  2⤵
  PID:9164
- C:\Windows\System\JCASDKB.exe
  C:\Windows\System\JCASDKB.exe
  2⤵
  PID:9180
- C:\Windows\System\tyCohqk.exe
  C:\Windows\System\tyCohqk.exe
  2⤵
  PID:9208
- C:\Windows\System\eizmjNZ.exe
  C:\Windows\System\eizmjNZ.exe
  2⤵
  PID:8216
- C:\Windows\System\mUgWaEm.exe
  C:\Windows\System\mUgWaEm.exe
  2⤵
  PID:8288
- C:\Windows\System\EyNMTSN.exe
  C:\Windows\System\EyNMTSN.exe
  2⤵
  PID:8344
- C:\Windows\System\FzdliRN.exe
  C:\Windows\System\FzdliRN.exe
  2⤵
  PID:8376
- C:\Windows\System\EIUcSGX.exe
  C:\Windows\System\EIUcSGX.exe
  2⤵
  PID:8476
- C:\Windows\System\yUVyuvX.exe
  C:\Windows\System\yUVyuvX.exe
  2⤵
  PID:8496
- C:\Windows\System\FKXJQGe.exe
  C:\Windows\System\FKXJQGe.exe
  2⤵
  PID:8552
- C:\Windows\System\NetEtnc.exe
  C:\Windows\System\NetEtnc.exe
  2⤵
  PID:8604
- C:\Windows\System\GnxuvRB.exe
  C:\Windows\System\GnxuvRB.exe
  2⤵
  PID:8692
- C:\Windows\System\vjWWCED.exe
  C:\Windows\System\vjWWCED.exe
  2⤵
  PID:8712
- C:\Windows\System\qPlcNxJ.exe
  C:\Windows\System\qPlcNxJ.exe
  2⤵
  PID:8760
- C:\Windows\System\QgaJvHX.exe
  C:\Windows\System\QgaJvHX.exe
  2⤵
  PID:8828
- C:\Windows\System\lFOacRQ.exe
  C:\Windows\System\lFOacRQ.exe
  2⤵
  PID:8888
- C:\Windows\System\PNXtqXk.exe
  C:\Windows\System\PNXtqXk.exe
  2⤵
  PID:8948
- C:\Windows\System\CygAFnT.exe
  C:\Windows\System\CygAFnT.exe
  2⤵
  PID:9044
- C:\Windows\System\ysKuSwQ.exe
  C:\Windows\System\ysKuSwQ.exe
  2⤵
  PID:1828
- C:\Windows\System\hZpErEo.exe
  C:\Windows\System\hZpErEo.exe
  2⤵
  PID:7304
- C:\Windows\System\TNMEdEb.exe
  C:\Windows\System\TNMEdEb.exe
  2⤵
  PID:8324
- C:\Windows\System\yfnqnRx.exe
  C:\Windows\System\yfnqnRx.exe
  2⤵
  PID:8472
- C:\Windows\System\vnsVIkf.exe
  C:\Windows\System\vnsVIkf.exe
  2⤵
  PID:8744
- C:\Windows\System\owXkRRS.exe
  C:\Windows\System\owXkRRS.exe
  2⤵
  PID:8800
- C:\Windows\System\YasLzGl.exe
  C:\Windows\System\YasLzGl.exe
  2⤵
  PID:2892
- C:\Windows\System\KGuzfXj.exe
  C:\Windows\System\KGuzfXj.exe
  2⤵
  PID:9016
- C:\Windows\System\AiiWOgh.exe
  C:\Windows\System\AiiWOgh.exe
  2⤵
  PID:9156
- C:\Windows\System\JIdmeGt.exe
  C:\Windows\System\JIdmeGt.exe
  2⤵
  PID:8240
- C:\Windows\System\JrFcFoX.exe
  C:\Windows\System\JrFcFoX.exe
  2⤵
  PID:8568
- C:\Windows\System\IeyhTIR.exe
  C:\Windows\System\IeyhTIR.exe
  2⤵
  PID:8868
- C:\Windows\System\nAnBaFm.exe
  C:\Windows\System\nAnBaFm.exe
  2⤵
  PID:8996
- C:\Windows\System\sDjnJWO.exe
  C:\Windows\System\sDjnJWO.exe
  2⤵
  PID:8480
- C:\Windows\System\WTJWVjQ.exe
  C:\Windows\System\WTJWVjQ.exe
  2⤵
  PID:9224
- C:\Windows\System\jTurXOr.exe
  C:\Windows\System\jTurXOr.exe
  2⤵
  PID:9256
- C:\Windows\System\wIQaVcI.exe
  C:\Windows\System\wIQaVcI.exe
  2⤵
  PID:9276
- C:\Windows\System\sXYvRVn.exe
  C:\Windows\System\sXYvRVn.exe
  2⤵
  PID:9312
- C:\Windows\System\eurcpul.exe
  C:\Windows\System\eurcpul.exe
  2⤵
  PID:9340
- C:\Windows\System\rezcpjU.exe
  C:\Windows\System\rezcpjU.exe
  2⤵
  PID:9400
- C:\Windows\System\Kxfulsr.exe
  C:\Windows\System\Kxfulsr.exe
  2⤵
  PID:9420
- C:\Windows\System\rmVitVj.exe
  C:\Windows\System\rmVitVj.exe
  2⤵
  PID:9456
- C:\Windows\System\WTJCEgr.exe
  C:\Windows\System\WTJCEgr.exe
  2⤵
  PID:9476
- C:\Windows\System\XCKDMCf.exe
  C:\Windows\System\XCKDMCf.exe
  2⤵
  PID:9504
- C:\Windows\System\PJKSdsQ.exe
  C:\Windows\System\PJKSdsQ.exe
  2⤵
  PID:9524
- C:\Windows\System\gwlLkyC.exe
  C:\Windows\System\gwlLkyC.exe
  2⤵
  PID:9556
- C:\Windows\System\OyVhCiH.exe
  C:\Windows\System\OyVhCiH.exe
  2⤵
  PID:9576
- C:\Windows\System\wdsYVBz.exe
  C:\Windows\System\wdsYVBz.exe
  2⤵
  PID:9600
- C:\Windows\System\bDfcqsY.exe
  C:\Windows\System\bDfcqsY.exe
  2⤵
  PID:9644
- C:\Windows\System\inVJOOU.exe
  C:\Windows\System\inVJOOU.exe
  2⤵
  PID:9660
- C:\Windows\System\FhjBUOD.exe
  C:\Windows\System\FhjBUOD.exe
  2⤵
  PID:9700
- C:\Windows\System\nHHiiPV.exe
  C:\Windows\System\nHHiiPV.exe
  2⤵
  PID:9720
- C:\Windows\System\eokqYgN.exe
  C:\Windows\System\eokqYgN.exe
  2⤵
  PID:9744
- C:\Windows\System\zjuzyWo.exe
  C:\Windows\System\zjuzyWo.exe
  2⤵
  PID:9768
- C:\Windows\System\zKWDSdD.exe
  C:\Windows\System\zKWDSdD.exe
  2⤵
  PID:9796
- C:\Windows\System\IxELuEm.exe
  C:\Windows\System\IxELuEm.exe
  2⤵
  PID:9816
- C:\Windows\System\wZreGYx.exe
  C:\Windows\System\wZreGYx.exe
  2⤵
  PID:9856
- C:\Windows\System\dNTebiJ.exe
  C:\Windows\System\dNTebiJ.exe
  2⤵
  PID:9876
- C:\Windows\System\VgQSbEs.exe
  C:\Windows\System\VgQSbEs.exe
  2⤵
  PID:9900
- C:\Windows\System\NyhGlLK.exe
  C:\Windows\System\NyhGlLK.exe
  2⤵
  PID:9928
- C:\Windows\System\smYzNzB.exe
  C:\Windows\System\smYzNzB.exe
  2⤵
  PID:9952
- C:\Windows\System\AOyblot.exe
  C:\Windows\System\AOyblot.exe
  2⤵
  PID:9980
- C:\Windows\System\pATyHfN.exe
  C:\Windows\System\pATyHfN.exe
  2⤵
  PID:9996
- C:\Windows\System\mBFxRoy.exe
  C:\Windows\System\mBFxRoy.exe
  2⤵
  PID:10016
- C:\Windows\System\mSlyjcn.exe
  C:\Windows\System\mSlyjcn.exe
  2⤵
  PID:10040
- C:\Windows\System\LyKHFUw.exe
  C:\Windows\System\LyKHFUw.exe
  2⤵
  PID:10060
- C:\Windows\System\afPWuLV.exe
  C:\Windows\System\afPWuLV.exe
  2⤵
  PID:10080
- C:\Windows\System\BxjQdKq.exe
  C:\Windows\System\BxjQdKq.exe
  2⤵
  PID:10144
- C:\Windows\System\rtINdpL.exe
  C:\Windows\System\rtINdpL.exe
  2⤵
  PID:10168
- C:\Windows\System\sublvMG.exe
  C:\Windows\System\sublvMG.exe
  2⤵
  PID:10188
- C:\Windows\System\czYNxQU.exe
  C:\Windows\System\czYNxQU.exe
  2⤵
  PID:10232
- C:\Windows\System\SVJEnxC.exe
  C:\Windows\System\SVJEnxC.exe
  2⤵
  PID:9304
- C:\Windows\System\XXOnrwc.exe
  C:\Windows\System\XXOnrwc.exe
  2⤵
  PID:9372
- C:\Windows\System\UNkQptk.exe
  C:\Windows\System\UNkQptk.exe
  2⤵
  PID:9440
- C:\Windows\System\UzOSGXK.exe
  C:\Windows\System\UzOSGXK.exe
  2⤵
  PID:9484
- C:\Windows\System\ELZMmtS.exe
  C:\Windows\System\ELZMmtS.exe
  2⤵
  PID:9552
- C:\Windows\System\QtfoyKq.exe
  C:\Windows\System\QtfoyKq.exe
  2⤵
  PID:9620
- C:\Windows\System\nqnrQEC.exe
  C:\Windows\System\nqnrQEC.exe
  2⤵
  PID:9728
- C:\Windows\System\QOWkboI.exe
  C:\Windows\System\QOWkboI.exe
  2⤵
  PID:9712
- C:\Windows\System\LJLIBqx.exe
  C:\Windows\System\LJLIBqx.exe
  2⤵
  PID:9784
- C:\Windows\System\uPciIhj.exe
  C:\Windows\System\uPciIhj.exe
  2⤵
  PID:9872
- C:\Windows\System\VSnqcnM.exe
  C:\Windows\System\VSnqcnM.exe
  2⤵
  PID:9920
- C:\Windows\System\dUpSTjv.exe
  C:\Windows\System\dUpSTjv.exe
  2⤵
  PID:10008
- C:\Windows\System\BOzPtCf.exe
  C:\Windows\System\BOzPtCf.exe
  2⤵
  PID:10112
- C:\Windows\System\IJkXnBo.exe
  C:\Windows\System\IJkXnBo.exe
  2⤵
  PID:10184
- C:\Windows\System\sVXsMlg.exe
  C:\Windows\System\sVXsMlg.exe
  2⤵
  PID:9268
- C:\Windows\System\rRjaagq.exe
  C:\Windows\System\rRjaagq.exe
  2⤵
  PID:536
- C:\Windows\System\BEcKyVx.exe
  C:\Windows\System\BEcKyVx.exe
  2⤵
  PID:9512
- C:\Windows\System\NvlGUXh.exe
  C:\Windows\System\NvlGUXh.exe
  2⤵
  PID:9516
- C:\Windows\System\SwFncTf.exe
  C:\Windows\System\SwFncTf.exe
  2⤵
  PID:2408
- C:\Windows\System\BOsgwBV.exe
  C:\Windows\System\BOsgwBV.exe
  2⤵
  PID:9896
- C:\Windows\System\ZdNUgUq.exe
  C:\Windows\System\ZdNUgUq.exe
  2⤵
  PID:9988
- C:\Windows\System\lKjygBY.exe
  C:\Windows\System\lKjygBY.exe
  2⤵
  PID:10036
- C:\Windows\System\SzeexGE.exe
  C:\Windows\System\SzeexGE.exe
  2⤵
  PID:9308
- C:\Windows\System\eclDwdW.exe
  C:\Windows\System\eclDwdW.exe
  2⤵
  PID:9332
- C:\Windows\System\baKiEvS.exe
  C:\Windows\System\baKiEvS.exe
  2⤵
  PID:9916
- C:\Windows\System\XpNQRxg.exe
  C:\Windows\System\XpNQRxg.exe
  2⤵
  PID:10076
- C:\Windows\System\FyFEDPB.exe
  C:\Windows\System\FyFEDPB.exe
  2⤵
  PID:9964
- C:\Windows\System\yUuanHl.exe
  C:\Windows\System\yUuanHl.exe
  2⤵
  PID:9968
- C:\Windows\System\kvyAHQX.exe
  C:\Windows\System\kvyAHQX.exe
  2⤵
  PID:10256
- C:\Windows\System\nRcdndl.exe
  C:\Windows\System\nRcdndl.exe
  2⤵
  PID:10284
- C:\Windows\System\eLNBCGO.exe
  C:\Windows\System\eLNBCGO.exe
  2⤵
  PID:10320
- C:\Windows\System\nYOMhqP.exe
  C:\Windows\System\nYOMhqP.exe
  2⤵
  PID:10356
- C:\Windows\System\VtEqmSO.exe
  C:\Windows\System\VtEqmSO.exe
  2⤵
  PID:10392
- C:\Windows\System\uriHBmK.exe
  C:\Windows\System\uriHBmK.exe
  2⤵
  PID:10412
- C:\Windows\System\QobqqVr.exe
  C:\Windows\System\QobqqVr.exe
  2⤵
  PID:10460
- C:\Windows\System\fcVOwce.exe
  C:\Windows\System\fcVOwce.exe
  2⤵
  PID:10484
- C:\Windows\System\hNjzfRY.exe
  C:\Windows\System\hNjzfRY.exe
  2⤵
  PID:10512
- C:\Windows\System\ILIfevb.exe
  C:\Windows\System\ILIfevb.exe
  2⤵
  PID:10532
- C:\Windows\System\qpdYIEy.exe
  C:\Windows\System\qpdYIEy.exe
  2⤵
  PID:10556
- C:\Windows\System\ByevBTe.exe
  C:\Windows\System\ByevBTe.exe
  2⤵
  PID:10576
- C:\Windows\System\wpYEoUn.exe
  C:\Windows\System\wpYEoUn.exe
  2⤵
  PID:10608
- C:\Windows\System\pllDJaW.exe
  C:\Windows\System\pllDJaW.exe
  2⤵
  PID:10636
- C:\Windows\System\pfKSBoh.exe
  C:\Windows\System\pfKSBoh.exe
  2⤵
  PID:10664
- C:\Windows\System\mctEyDE.exe
  C:\Windows\System\mctEyDE.exe
  2⤵
  PID:10684
- C:\Windows\System\DwDEzTQ.exe
  C:\Windows\System\DwDEzTQ.exe
  2⤵
  PID:10708
- C:\Windows\System\oWvSQrt.exe
  C:\Windows\System\oWvSQrt.exe
  2⤵
  PID:10724
- C:\Windows\System\uUUtXAH.exe
  C:\Windows\System\uUUtXAH.exe
  2⤵
  PID:10852
- C:\Windows\System\ORkLflX.exe
  C:\Windows\System\ORkLflX.exe
  2⤵
  PID:10896
- C:\Windows\System\rpvuWRk.exe
  C:\Windows\System\rpvuWRk.exe
  2⤵
  PID:10912
- C:\Windows\System\oDmDUSD.exe
  C:\Windows\System\oDmDUSD.exe
  2⤵
  PID:10932
- C:\Windows\System\bSXxcSd.exe
  C:\Windows\System\bSXxcSd.exe
  2⤵
  PID:10952
- C:\Windows\System\kfacHWc.exe
  C:\Windows\System\kfacHWc.exe
  2⤵
  PID:10984
- C:\Windows\System\LsrInpv.exe
  C:\Windows\System\LsrInpv.exe
  2⤵
  PID:11000
- C:\Windows\System\IZAMjvY.exe
  C:\Windows\System\IZAMjvY.exe
  2⤵
  PID:11044
- C:\Windows\System\jzybfPJ.exe
  C:\Windows\System\jzybfPJ.exe
  2⤵
  PID:11072
- C:\Windows\System\PZUZcWD.exe
  C:\Windows\System\PZUZcWD.exe
  2⤵
  PID:11120
- C:\Windows\System\POnKBeI.exe
  C:\Windows\System\POnKBeI.exe
  2⤵
  PID:11172
- C:\Windows\System\bHbDrZi.exe
  C:\Windows\System\bHbDrZi.exe
  2⤵
  PID:11196
- C:\Windows\System\jgbqEth.exe
  C:\Windows\System\jgbqEth.exe
  2⤵
  PID:11216
- C:\Windows\System\GwUcWLA.exe
  C:\Windows\System\GwUcWLA.exe
  2⤵
  PID:10316
- C:\Windows\System\mVxFHPF.exe
  C:\Windows\System\mVxFHPF.exe
  2⤵
  PID:10004
- C:\Windows\System\YGNcNkn.exe
  C:\Windows\System\YGNcNkn.exe
  2⤵
  PID:10372
- C:\Windows\System\elFZiaG.exe
  C:\Windows\System\elFZiaG.exe
  2⤵
  PID:10404
- C:\Windows\System\LwLOZjf.exe
  C:\Windows\System\LwLOZjf.exe
  2⤵
  PID:10476
- C:\Windows\System\stTEAVx.exe
  C:\Windows\System\stTEAVx.exe
  2⤵
  PID:10524
- C:\Windows\System\qPfsblX.exe
  C:\Windows\System\qPfsblX.exe
  2⤵
  PID:10568
- C:\Windows\System\CjAfnaW.exe
  C:\Windows\System\CjAfnaW.exe
  2⤵
  PID:10740
- C:\Windows\System\XJIfJpN.exe
  C:\Windows\System\XJIfJpN.exe
  2⤵
  PID:10844
- C:\Windows\System\VVSWdvA.exe
  C:\Windows\System\VVSWdvA.exe
  2⤵
  PID:10720
- C:\Windows\System\kmcWQqx.exe
  C:\Windows\System\kmcWQqx.exe
  2⤵
  PID:1164
- C:\Windows\System\TtFlvJa.exe
  C:\Windows\System\TtFlvJa.exe
  2⤵
  PID:10784
- C:\Windows\System\HytlUPe.exe
  C:\Windows\System\HytlUPe.exe
  2⤵
  PID:10840
- C:\Windows\System\tWqYXAJ.exe
  C:\Windows\System\tWqYXAJ.exe
  2⤵
  PID:10924
- C:\Windows\System\DAHEksv.exe
  C:\Windows\System\DAHEksv.exe
  2⤵
  PID:10964
- C:\Windows\System\DIOFjRW.exe
  C:\Windows\System\DIOFjRW.exe
  2⤵
  PID:11092
- C:\Windows\System\KJcoelC.exe
  C:\Windows\System\KJcoelC.exe
  2⤵
  PID:11056
- C:\Windows\System\akMQREo.exe
  C:\Windows\System\akMQREo.exe
  2⤵
  PID:11132
- C:\Windows\System\IzdyxiS.exe
  C:\Windows\System\IzdyxiS.exe
  2⤵
  PID:11228
- C:\Windows\System\oCOQWQc.exe
  C:\Windows\System\oCOQWQc.exe
  2⤵
  PID:10420
- C:\Windows\System\cmFsisC.exe
  C:\Windows\System\cmFsisC.exe
  2⤵
  PID:10544
- C:\Windows\System\wkbazbs.exe
  C:\Windows\System\wkbazbs.exe
  2⤵
  PID:3124
- C:\Windows\System\bynfaIP.exe
  C:\Windows\System\bynfaIP.exe
  2⤵
  PID:3588
- C:\Windows\System\GnGMaFO.exe
  C:\Windows\System\GnGMaFO.exe
  2⤵
  PID:10660
- C:\Windows\System\KCwePFJ.exe
  C:\Windows\System\KCwePFJ.exe
  2⤵
  PID:4024
- C:\Windows\System\XCzreJX.exe
  C:\Windows\System\XCzreJX.exe
  2⤵
  PID:10696
- C:\Windows\System\wYTsahJ.exe
  C:\Windows\System\wYTsahJ.exe
  2⤵
  PID:10760
- C:\Windows\System\POxLzsb.exe
  C:\Windows\System\POxLzsb.exe
  2⤵
  PID:11064
- C:\Windows\System\NSQxzCL.exe
  C:\Windows\System\NSQxzCL.exe
  2⤵
  PID:4988
- C:\Windows\System\LxcgzgT.exe
  C:\Windows\System\LxcgzgT.exe
  2⤵
  PID:11168
- C:\Windows\System\gWfkecp.exe
  C:\Windows\System\gWfkecp.exe
  2⤵
  PID:3364
- C:\Windows\System\knpZOMW.exe
  C:\Windows\System\knpZOMW.exe
  2⤵
  PID:1068
- C:\Windows\System\bBgSnQK.exe
  C:\Windows\System\bBgSnQK.exe
  2⤵
  PID:4880
- C:\Windows\System\LgucbKg.exe
  C:\Windows\System\LgucbKg.exe
  2⤵
  PID:10972
- C:\Windows\System\BTLzJqf.exe
  C:\Windows\System\BTLzJqf.exe
  2⤵
  PID:11248
- C:\Windows\System\JCbfOcL.exe
  C:\Windows\System\JCbfOcL.exe
  2⤵
  PID:10656
- C:\Windows\System\VTtfFRX.exe
  C:\Windows\System\VTtfFRX.exe
  2⤵
  PID:11280
- C:\Windows\System\XgylhvT.exe
  C:\Windows\System\XgylhvT.exe
  2⤵
  PID:11304
- C:\Windows\System\SMWhYRI.exe
  C:\Windows\System\SMWhYRI.exe
  2⤵
  PID:11324
- C:\Windows\System\HLEoONX.exe
  C:\Windows\System\HLEoONX.exe
  2⤵
  PID:11344
- C:\Windows\System\YMpbSMM.exe
  C:\Windows\System\YMpbSMM.exe
  2⤵
  PID:11408
- C:\Windows\System\ZiYmVWC.exe
  C:\Windows\System\ZiYmVWC.exe
  2⤵
  PID:11440
- C:\Windows\System\gbJijGO.exe
  C:\Windows\System\gbJijGO.exe
  2⤵
  PID:11480
- C:\Windows\System\NaquekW.exe
  C:\Windows\System\NaquekW.exe
  2⤵
  PID:11508
- C:\Windows\System\NXzzIcP.exe
  C:\Windows\System\NXzzIcP.exe
  2⤵
  PID:11524
- C:\Windows\System\jUaNSyL.exe
  C:\Windows\System\jUaNSyL.exe
  2⤵
  PID:11548
- C:\Windows\System\mjxPGyn.exe
  C:\Windows\System\mjxPGyn.exe
  2⤵
  PID:11576
- C:\Windows\System\HxBmheD.exe
  C:\Windows\System\HxBmheD.exe
  2⤵
  PID:11600
- C:\Windows\System\MFBRees.exe
  C:\Windows\System\MFBRees.exe
  2⤵
  PID:11620
- C:\Windows\System\Fvutxvr.exe
  C:\Windows\System\Fvutxvr.exe
  2⤵
  PID:11656
- C:\Windows\System\qhqdguV.exe
  C:\Windows\System\qhqdguV.exe
  2⤵
  PID:11696
- C:\Windows\System\lIsfTwk.exe
  C:\Windows\System\lIsfTwk.exe
  2⤵
  PID:11720
- C:\Windows\System\DsNVQhY.exe
  C:\Windows\System\DsNVQhY.exe
  2⤵
  PID:11744
- C:\Windows\System\TtCdxjw.exe
  C:\Windows\System\TtCdxjw.exe
  2⤵
  PID:11760
- C:\Windows\System\NwDkZeo.exe
  C:\Windows\System\NwDkZeo.exe
  2⤵
  PID:11780
- C:\Windows\System\MpGqYqu.exe
  C:\Windows\System\MpGqYqu.exe
  2⤵
  PID:11856
- C:\Windows\System\DYVaFpH.exe
  C:\Windows\System\DYVaFpH.exe
  2⤵
  PID:11876
- C:\Windows\System\ArBpoFM.exe
  C:\Windows\System\ArBpoFM.exe
  2⤵
  PID:11900
- C:\Windows\System\itkbifp.exe
  C:\Windows\System\itkbifp.exe
  2⤵
  PID:11920
- C:\Windows\System\qUIQXgL.exe
  C:\Windows\System\qUIQXgL.exe
  2⤵
  PID:11948
- C:\Windows\System\rEtSlJu.exe
  C:\Windows\System\rEtSlJu.exe
  2⤵
  PID:11980
- C:\Windows\System\BAbkmmg.exe
  C:\Windows\System\BAbkmmg.exe
  2⤵
  PID:11996
- C:\Windows\System\bDZpGNl.exe
  C:\Windows\System\bDZpGNl.exe
  2⤵
  PID:12044
- C:\Windows\System\JkXUHuG.exe
  C:\Windows\System\JkXUHuG.exe
  2⤵
  PID:12076
- C:\Windows\System\bVrfvVa.exe
  C:\Windows\System\bVrfvVa.exe
  2⤵
  PID:12112
- C:\Windows\System\evdcUWl.exe
  C:\Windows\System\evdcUWl.exe
  2⤵
  PID:12152
- C:\Windows\System\WxZdZzj.exe
  C:\Windows\System\WxZdZzj.exe
  2⤵
  PID:12168
- C:\Windows\System\dkQOPcd.exe
  C:\Windows\System\dkQOPcd.exe
  2⤵
  PID:12188
- C:\Windows\System\MWlnFuH.exe
  C:\Windows\System\MWlnFuH.exe
  2⤵
  PID:12216
- C:\Windows\System\agedYSL.exe
  C:\Windows\System\agedYSL.exe
  2⤵
  PID:12232
- C:\Windows\System\UaWvkXZ.exe
  C:\Windows\System\UaWvkXZ.exe
  2⤵
  PID:12260
- C:\Windows\System\zciBuAi.exe
  C:\Windows\System\zciBuAi.exe
  2⤵
  PID:12284
- C:\Windows\System\uDbAmlT.exe
  C:\Windows\System\uDbAmlT.exe
  2⤵
  PID:11272
- C:\Windows\System\koeqQki.exe
  C:\Windows\System\koeqQki.exe
  2⤵
  PID:11300
- C:\Windows\System\vVJzpgZ.exe
  C:\Windows\System\vVJzpgZ.exe
  2⤵
  PID:11368
- C:\Windows\System\QktHUkG.exe
  C:\Windows\System\QktHUkG.exe
  2⤵
  PID:11416
- C:\Windows\System\phoJhqC.exe
  C:\Windows\System\phoJhqC.exe
  2⤵
  PID:11544
- C:\Windows\System\STPlcwU.exe
  C:\Windows\System\STPlcwU.exe
  2⤵
  PID:11568
- C:\Windows\System\xivKmQx.exe
  C:\Windows\System\xivKmQx.exe
  2⤵
  PID:11608
- C:\Windows\System\kEFyfPR.exe
  C:\Windows\System\kEFyfPR.exe
  2⤵
  PID:11688
- C:\Windows\System\kXAOXlI.exe
  C:\Windows\System\kXAOXlI.exe
  2⤵
  PID:11808
- C:\Windows\System\lkxQhyS.exe
  C:\Windows\System\lkxQhyS.exe
  2⤵
  PID:11872
- C:\Windows\System\qctoDKl.exe
  C:\Windows\System\qctoDKl.exe
  2⤵
  PID:11896
- C:\Windows\System\PhWdiIj.exe
  C:\Windows\System\PhWdiIj.exe
  2⤵
  PID:11992
- C:\Windows\System\ooWYToI.exe
  C:\Windows\System\ooWYToI.exe
  2⤵
  PID:12024
- C:\Windows\System\joPoDyO.exe
  C:\Windows\System\joPoDyO.exe
  2⤵
  PID:12068
- C:\Windows\System\lhaMSbX.exe
  C:\Windows\System\lhaMSbX.exe
  2⤵
  PID:12136
- C:\Windows\System\syiVFSp.exe
  C:\Windows\System\syiVFSp.exe
  2⤵
  PID:12184
- C:\Windows\System\XqVoBfz.exe
  C:\Windows\System\XqVoBfz.exe
  2⤵
  PID:10768
- C:\Windows\System\fABtvpF.exe
  C:\Windows\System\fABtvpF.exe
  2⤵
  PID:11336
- C:\Windows\System\hnSxdli.exe
  C:\Windows\System\hnSxdli.exe
  2⤵
  PID:11356
- C:\Windows\System\woFAafV.exe
  C:\Windows\System\woFAafV.exe
  2⤵
  PID:11680
- C:\Windows\System\ClKFeDJ.exe
  C:\Windows\System\ClKFeDJ.exe
  2⤵
  PID:11752
- C:\Windows\System\iAaCgrn.exe
  C:\Windows\System\iAaCgrn.exe
  2⤵
  PID:11944
- C:\Windows\System\piSkSIN.exe
  C:\Windows\System\piSkSIN.exe
  2⤵
  PID:11988
- C:\Windows\System\hOdIZJg.exe
  C:\Windows\System\hOdIZJg.exe
  2⤵
  PID:12228
- C:\Windows\System\LRXuKbW.exe
  C:\Windows\System\LRXuKbW.exe
  2⤵
  PID:11560
- C:\Windows\System\APIzjQn.exe
  C:\Windows\System\APIzjQn.exe
  2⤵
  PID:11884
- C:\Windows\System\IqNcfyL.exe
  C:\Windows\System\IqNcfyL.exe
  2⤵
  PID:12108
- C:\Windows\System\LdrqIIk.exe
  C:\Windows\System\LdrqIIk.exe
  2⤵
  PID:12180
- C:\Windows\System\hoShJHg.exe
  C:\Windows\System\hoShJHg.exe
  2⤵
  PID:12304
- C:\Windows\System\pLKROyv.exe
  C:\Windows\System\pLKROyv.exe
  2⤵
  PID:12340
- C:\Windows\System\vBnwMiZ.exe
  C:\Windows\System\vBnwMiZ.exe
  2⤵
  PID:12364
- C:\Windows\System\FActrUl.exe
  C:\Windows\System\FActrUl.exe
  2⤵
  PID:12396
- C:\Windows\System\dHzxmLx.exe
  C:\Windows\System\dHzxmLx.exe
  2⤵
  PID:12424
- C:\Windows\System\fwooYYl.exe
  C:\Windows\System\fwooYYl.exe
  2⤵
  PID:12444
- C:\Windows\System\xsxNtdX.exe
  C:\Windows\System\xsxNtdX.exe
  2⤵
  PID:12468
- C:\Windows\System\cWRVSVd.exe
  C:\Windows\System\cWRVSVd.exe
  2⤵
  PID:12488
- C:\Windows\System\LeziLdx.exe
  C:\Windows\System\LeziLdx.exe
  2⤵
  PID:12512
- C:\Windows\System\frBWFRS.exe
  C:\Windows\System\frBWFRS.exe
  2⤵
  PID:12584
- C:\Windows\System\YshYNvP.exe
  C:\Windows\System\YshYNvP.exe
  2⤵
  PID:12600
- C:\Windows\System\CkXUdvq.exe
  C:\Windows\System\CkXUdvq.exe
  2⤵
  PID:12620
- C:\Windows\System\Wjtpceo.exe
  C:\Windows\System\Wjtpceo.exe
  2⤵
  PID:12640
- C:\Windows\System\irwEzbI.exe
  C:\Windows\System\irwEzbI.exe
  2⤵
  PID:12664
- C:\Windows\System\liTvksf.exe
  C:\Windows\System\liTvksf.exe
  2⤵
  PID:12692
- C:\Windows\System\oHhLEVE.exe
  C:\Windows\System\oHhLEVE.exe
  2⤵
  PID:12716
- C:\Windows\System\aCSKxoW.exe
  C:\Windows\System\aCSKxoW.exe
  2⤵
  PID:12748
- C:\Windows\System\WNDcFfM.exe
  C:\Windows\System\WNDcFfM.exe
  2⤵
  PID:12764
- C:\Windows\System\VZgGUUM.exe
  C:\Windows\System\VZgGUUM.exe
  2⤵
  PID:12792
- C:\Windows\System\juEphFM.exe
  C:\Windows\System\juEphFM.exe
  2⤵
  PID:12820
- C:\Windows\System\umJMCyV.exe
  C:\Windows\System\umJMCyV.exe
  2⤵
  PID:12844
- C:\Windows\System\zQiIeqD.exe
  C:\Windows\System\zQiIeqD.exe
  2⤵
  PID:12900
- C:\Windows\System\CnrhUKb.exe
  C:\Windows\System\CnrhUKb.exe
  2⤵
  PID:12928
- C:\Windows\System\NkSuyuJ.exe
  C:\Windows\System\NkSuyuJ.exe
  2⤵
  PID:12956
- C:\Windows\System\VcYCPEP.exe
  C:\Windows\System\VcYCPEP.exe
  2⤵
  PID:12972
- C:\Windows\System\OMUamzz.exe
  C:\Windows\System\OMUamzz.exe
  2⤵
  PID:13000
- C:\Windows\System\QrdQqir.exe
  C:\Windows\System\QrdQqir.exe
  2⤵
  PID:13032
- C:\Windows\System\xVSIGSp.exe
  C:\Windows\System\xVSIGSp.exe
  2⤵
  PID:13056
- C:\Windows\System\opXuXdo.exe
  C:\Windows\System\opXuXdo.exe
  2⤵
  PID:13084
- C:\Windows\System\EbtCOmC.exe
  C:\Windows\System\EbtCOmC.exe
  2⤵
  PID:13112
- C:\Windows\System\vRdNJVN.exe
  C:\Windows\System\vRdNJVN.exe
  2⤵
  PID:13144
- C:\Windows\System\fHQAORb.exe
  C:\Windows\System\fHQAORb.exe
  2⤵
  PID:13200
- C:\Windows\System\oKKNpEk.exe
  C:\Windows\System\oKKNpEk.exe
  2⤵
  PID:13224
- C:\Windows\System\AGODiCN.exe
  C:\Windows\System\AGODiCN.exe
  2⤵
  PID:13244
- C:\Windows\System\rxKOIva.exe
  C:\Windows\System\rxKOIva.exe
  2⤵
  PID:13264
- C:\Windows\System\xCcVZVG.exe
  C:\Windows\System\xCcVZVG.exe
  2⤵
  PID:13288
- C:\Windows\System\dMACFio.exe
  C:\Windows\System\dMACFio.exe
  2⤵
  PID:11104
- C:\Windows\System\uWOpOhi.exe
  C:\Windows\System\uWOpOhi.exe
  2⤵
  PID:12348
- C:\Windows\System\UJATGDD.exe
  C:\Windows\System\UJATGDD.exe
  2⤵
  PID:12356
- C:\Windows\System\FemSTwo.exe
  C:\Windows\System\FemSTwo.exe
  2⤵
  PID:12420
- C:\Windows\System\ZcJjHpy.exe
  C:\Windows\System\ZcJjHpy.exe
  2⤵
  PID:2348
- C:\Windows\System\cAALqyH.exe
  C:\Windows\System\cAALqyH.exe
  2⤵
  PID:4028
- C:\Windows\System\XDglSPr.exe
  C:\Windows\System\XDglSPr.exe
  2⤵
  PID:12596
- C:\Windows\System\eGveXIh.exe
  C:\Windows\System\eGveXIh.exe
  2⤵
  PID:12636
- C:\Windows\System\OslBeKR.exe
  C:\Windows\System\OslBeKR.exe
  2⤵
  PID:12736
- C:\Windows\System\LJISdzB.exe
  C:\Windows\System\LJISdzB.exe
  2⤵
  PID:12740
- C:\Windows\System\qZMZtGG.exe
  C:\Windows\System\qZMZtGG.exe
  2⤵
  PID:12812
- C:\Windows\System\edUjpGE.exe
  C:\Windows\System\edUjpGE.exe
  2⤵
  PID:12908
- C:\Windows\System\PcKiEXG.exe
  C:\Windows\System\PcKiEXG.exe
  2⤵
  PID:12948
- C:\Windows\System\anpSoKX.exe
  C:\Windows\System\anpSoKX.exe
  2⤵
  PID:13020
- C:\Windows\System\cIyKoTD.exe
  C:\Windows\System\cIyKoTD.exe
  2⤵
  PID:13072
- C:\Windows\System\ccGMMPm.exe
  C:\Windows\System\ccGMMPm.exe
  2⤵
  PID:13176
- C:\Windows\System\YpQToXl.exe
  C:\Windows\System\YpQToXl.exe
  2⤵
  PID:13236
- C:\Windows\System\RkZWZiU.exe
  C:\Windows\System\RkZWZiU.exe
  2⤵
  PID:13308
- C:\Windows\System\JXhEvIt.exe
  C:\Windows\System\JXhEvIt.exe
  2⤵
  PID:12336
- C:\Windows\System\VavqPwG.exe
  C:\Windows\System\VavqPwG.exe
  2⤵
  PID:11536
- C:\Windows\System\ZOvcGcQ.exe
  C:\Windows\System\ZOvcGcQ.exe
  2⤵
  PID:12580
- C:\Windows\System\ePyVnvC.exe
  C:\Windows\System\ePyVnvC.exe
  2⤵
  PID:12756
- C:\Windows\System\CWLhTKN.exe
  C:\Windows\System\CWLhTKN.exe
  2⤵
  PID:12892
- C:\Windows\System\EaDBERn.exe
  C:\Windows\System\EaDBERn.exe
  2⤵
  PID:13052
- C:\Windows\System\MhHseAw.exe
  C:\Windows\System\MhHseAw.exe
  2⤵
  PID:13136
- C:\Windows\System\wmGwcwO.exe
  C:\Windows\System\wmGwcwO.exe
  2⤵
  PID:11976
- C:\Windows\System\byFmTqh.exe
  C:\Windows\System\byFmTqh.exe
  2⤵
  PID:12440
- C:\Windows\System\VvphqEB.exe
  C:\Windows\System\VvphqEB.exe
  2⤵
  PID:12084
- C:\Windows\System\ohqGyWl.exe
  C:\Windows\System\ohqGyWl.exe
  2⤵
  PID:12480
- C:\Windows\System\JEuZuNX.exe
  C:\Windows\System\JEuZuNX.exe
  2⤵
  PID:12872
- C:\Windows\System\sphWluC.exe
  C:\Windows\System\sphWluC.exe
  2⤵
  PID:13300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ijgtnuiy.ib5.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BRscWgo.exe

Filesize
1.8MB

MD5
ca23fbf52d919ef1a47a2b1a2482a38e

SHA1
adaecb613f40a9a7705800209a06d2474401a2b1

SHA256
1eb2ce31968675ce964a21ad2ad473539b73a98b6b05a033ab046684ee2ff2bc

SHA512
0ef6037503dbbba53de158e8a8cced54d5b5620b51c480b7acff0a3db70e129f65b590488bef17167724209755a2bcd9337c5152e0a004f41330d0bed7e237e5

Download Submit
C:\Windows\System\DkZeOEh.exe

Filesize
1.8MB

MD5
f4c0703251b8043d9709f63ae09f6c91

SHA1
f6b4cecb6cde6cfc04e4d4bfb2f593a88b5ab1e3

SHA256
f370b4b3c0da08132b559a85c8d8b4c670004888adc8329db2095cfc84aca7d9

SHA512
9607a46feb8bf28a14261aff982765793bd17435da4d9ff013c936164867e4f709189a123004f5715d5b6607b393d7fd16b0398f7dd5d31fb817d1e44800b6dd

Download Submit
C:\Windows\System\EQOerEK.exe

Filesize
1.8MB

MD5
0d9b322b045704a1df35312422632b22

SHA1
060d185288a895357946ba3f8ac91f5fc1d09580

SHA256
aff55c0da22a17850309e67aeb3a554e04d8d13a4c92ecfee7f088a8cadd70a1

SHA512
b26eb89ef0d4ced1827a9f43ab2bb829ae7814a916d453c56b849d1b985c866ad1de65d0fdbc48931fd6a1b8b95a26d15828986dbf19520ff60ed680c428c4c9

Download Submit
C:\Windows\System\EVkDeUM.exe

Filesize
1.8MB

MD5
31f906e495765c9edfa9d459c2a4a262

SHA1
83f9c14444168825aac54852c3f37fd332505408

SHA256
71e0e1b16da10610827521c7a86536abf6a2ab0fc7fc308baea226ef0d017876

SHA512
282b34ad4c3d1650d452db9e895174d6c63d02e3450a15a21b8f55a4796e70b121b4b25c8484d7ac2b1a68ad9d10f1a7f58e706becbd096abbecccf62af148d7

Download Submit
C:\Windows\System\EdyuvMA.exe

Filesize
1.8MB

MD5
b155152406391adfc9d5535b49d1611c

SHA1
67102c4f266f38bb148efcf4580884791d445f26

SHA256
02c4741aacdf5c934e26d777fb84e4d869ff519d03dfc42a511358f3b0f1b149

SHA512
7bfe6c07014687d555ea1153ced9e454b67160184994327ed8251215cc08e138909e9e52dcd6ee998263876bdf900e28fcf7b7de0c4da0a2d5abb43bae3a22da

Download Submit
C:\Windows\System\GwbqmBs.exe

Filesize
1.8MB

MD5
babccc1d0d436aece9640a6611eef11f

SHA1
5b923565f74001f2174c09313fd8090c6b7a13f6

SHA256
7614c5f9ef9bf91b522f7983bdd1c58acd855db66d7c62f0f676250751e85966

SHA512
8c56f9729b79fc8785b41acd735740ed995eeff61751f0086887f6a83478a123a79daae4f8063ccda97bfe3c658b3dd340dbddc6b2dce3e16fca2e204015956b

Download Submit
C:\Windows\System\IckkrQU.exe

Filesize
1.8MB

MD5
7fce00ed6f70e92adc6564c941c96c1c

SHA1
196a54c40eef5020f18420318667fe7935e0aa2f

SHA256
e078f8c16789c62bc047d1f0eda310bd42423231b36e4cdb46d3e920fae0ddc3

SHA512
e7fb241c5507b1dbb6c4582445a02993494b6725e7803d24f54186e2183f939b5a9b9249c138a03f07f2a53faa43ec6540896a6b7247177225a4e8e555d21c48

Download Submit
C:\Windows\System\JLpPoma.exe

Filesize
1.8MB

MD5
fbba26b2a3a33e76256b01d988c3bbb8

SHA1
4c6cc6761c2567ed100cd073227922e834c55349

SHA256
ed1b65ad68ea3628e3774adf999a10ad116ccde7408cb05a8d407549230b83c4

SHA512
425c345b587b78dc0658faf8e8defa7cd1317614ccd5a7247353df99dd2e48d6488376f133a3c86393d866f906f439773df85935c14b18ecc63533512516c99b

Download Submit
C:\Windows\System\JVZwPoN.exe

Filesize
1.8MB

MD5
83b96a52ef3d3d51817252a59ac5a993

SHA1
f5861588596f270b6d06d50e4c6a2e36f902ca6c

SHA256
9108f8a3727827d8cf2476b735ba6f5d34f321a33d60728e8ae8b180bdf2e9c6

SHA512
c37f1de5224b7b3d434e0f2a804dc3fc4cb07b838fabad2d43cc3e14fa5a044216da2da4f16584bb8f0b67acf78fb9d8fe6df9a2bd17f5504d25c6cb110963d0

Download Submit
C:\Windows\System\JXWTmCU.exe

Filesize
1.8MB

MD5
4e3e726d96b1c86862d55d5016f5bc6f

SHA1
8388d02aa68c83ea5a871c88544c39e6831e493e

SHA256
a47b928aa07be11aa19e53a9f614bd7fe5e1873613f62c3a0d27533037d77111

SHA512
1cdbecf68b3615e2601bfe63e91bd6b2c91e12c2bd98bff63277513f89eadde28e1d789761fc5d77b078e7671abcacf13db461242e4339feed2156d26551a474

Download Submit
C:\Windows\System\MaPkDRH.exe

Filesize
1.8MB

MD5
cc3b17757f5f2434e6a391c533e90fd9

SHA1
8c80ff189677f02ea612ef80ce6e0952566f72f0

SHA256
9b7447e0edc70fb2afa61429442e51382cfec78a76cd9169d84f60db6fe7d8b5

SHA512
df3596429d66969dd731121ea981d120a76b94b54f0f0bf2f046dc08c0ae1cb04789847cc8de3f40ff4d1560f572339dbe37e6826a80f167cd383ec735e4892f

Download Submit
C:\Windows\System\MxXisYn.exe

Filesize
1.8MB

MD5
15e146269d19540b0cbc21677100bef0

SHA1
1839795302e28c37f876b8d1c0663675d1d3c6da

SHA256
e6d59f986b39da9365dee7fabb04ccd16df4c3799a3dec6dcfdbaa4a97f7fc6b

SHA512
ded8e5b059f9d54b09ba8e0b5429c809ba6d241f8ab5a130569363f734f56028d48089b0874ac5b3d7cb0ff11eca4eca71dd150330d352a61b07cedc1f904132

Download Submit
C:\Windows\System\MxunwrE.exe

Filesize
1.8MB

MD5
924380b5b0368c4a03c68558861fd2d0

SHA1
e289d6b416caa50a38a9d198e7c5fa7718e9ebb0

SHA256
1a4e24eaf92608304086e06a8af776a5a93cf8baf8dd4c8fae03bb26321525ed

SHA512
a838eea4c2f24baf3e8872c50fc62418ebf089429f2bad173df2b623017fbccdc59dc479d6093d66f62b0c4209b705015c119068dfdd4adfdfc2e7d61ca773b1

Download Submit
C:\Windows\System\OIwGdZM.exe

Filesize
1.8MB

MD5
db913b54dba9d129018e351f9d2a0739

SHA1
afd89156ed75b7e185ca67259dcc1fc1e438152f

SHA256
637a0eb76cb56ab1344ed4048fbeadbc343c13a1b49cc59578af9d8074ef3f8c

SHA512
4cdd52202c0b9a0c536eedeb709fdb0ec47cbf78bd7090f6bd143f311cdec656f6f771d61fa223fa5a7e182aa9fca7c8ff99e6dff5f58d83e66ef6b69b9252b3

Download Submit
C:\Windows\System\OMFLbhz.exe

Filesize
1.8MB

MD5
35e3b13470d3727a847eadbde24ee46e

SHA1
ae5f013eda847bcbae284b0893c383be8ff0bfb9

SHA256
bf27e953b83cfbefcbf7cc7de8fa94765d22eabf39121e64731d07acd74c66bb

SHA512
3623f3b11c141c6863ef6bec3c6b12245d2ad027f98cfe0724cd96a2c269ca292b83db2e55c51e8f3ff68a4306dfcf90658c28596806e5559a74ba73b3088469

Download Submit
C:\Windows\System\REhIXkD.exe

Filesize
1.8MB

MD5
cc24f3f1d63c7163ad9a6d7452d20e19

SHA1
f4572ecbeeb229307068ce57d679d01608fb62a7

SHA256
1cfd02fe92f6eaad6f33547575f163cafc1b7036d97604deee152131c689f146

SHA512
ca41159fbdf065a5fcd7ad79c4a9ef4012ddbc1f68b51bb816d13ee3b327038e57dc0842e6bdcb241816acb34af255be870484fdfd2f16a64653bc788dcd7ddf

Download Submit
C:\Windows\System\SjxbmRQ.exe

Filesize
1.8MB

MD5
7f9b341fdb3326428e1b6801bca7d1d0

SHA1
a2ff69a6b108505ad9e2de5cc520871f5786bc48

SHA256
28d97c0642525ca3eb12366ffe500f71c992616b71104887d71d1d8c1024375b

SHA512
35d88b0cc568764274ffb5444125793f82344db95a73850f390f4f5ade43f4cd62d9122460799b3a79997e3c73aedc348b61f7647266fe45fd5999451da513f6

Download Submit
C:\Windows\System\UpTrdTN.exe

Filesize
1.8MB

MD5
7c22eceaa870b895523593b154d7b55f

SHA1
e50a3615e5244140409d24b3546b9f3c5683d53a

SHA256
9d3c0da6f32456397f718cbaf83f28886db65c5ddc36e647d9552d96d10e1319

SHA512
691e61e65d687c30d6064c5d0b214031d3dc672fc6c46f59d1ea0fad3587512ec60a67411e1b243cade005b3f790a5fb7b0024748437e2ca4f45d13222fdd95a

Download Submit
C:\Windows\System\awbESao.exe

Filesize
1.8MB

MD5
d904eafa6fcf5680149d902b6eb05c92

SHA1
7f7f2dfc0da152383f06e25d306a0b04fa0c1515

SHA256
743505ee52bfaba5a9d3c4d7a8b83c3ba84bc3a31bcf4ee95c5319de57d31fb9

SHA512
39e0bb2c65ded2e2ee8c46db1945f31798a96aa4c3b04f27407f75a499aaee3bed26f05662ed1dede3d4f4c2f0a0f24ccddfc05bf5c5cebeec8a31d05f752bde

Download Submit
C:\Windows\System\daACBSb.exe

Filesize
1.8MB

MD5
9f7b3b19fd23ccd07109cbfea5f36ad0

SHA1
1f114fee35d4f2aec5fbe8589604de70a2a1023c

SHA256
367848e248e0cc8c1c7f8a894f30fab20c2f60bf8edd76e1e7f659f1b6a383a1

SHA512
2b699849e6271aeaad1a08d94cde821c33cea6b86e0d8172929349c293cb0508d628ac3100927a3ea8dfb114282d02ff1678276f7c023b7f852f4ae064c32f96

Download Submit
C:\Windows\System\dcpWhVS.exe

Filesize
1.8MB

MD5
471a0f90496c59357b2a0402a6eab06e

SHA1
93808b963ce4c6aa17e9798b95285432fbf34898

SHA256
92f54321e4e5e5be2b764f2b7166152df406bd53adcc56076b8a59487f0930c7

SHA512
9ca5e3842cfcaba90a229b6977a7f226011a58a74a0acbd562be04f4e0bf38d1522b4e4513752f44fe0b4bc87c5a3ce0173b62652b853b0d17811de99bdbf6eb

Download Submit
C:\Windows\System\eaGMSSw.exe

Filesize
1.8MB

MD5
9f6464623c58b730d383a411fd9f2282

SHA1
40120ca05f6dbc997c156c3966fd54e0620b7d9d

SHA256
6854a8206dfe795b3174635a1c68fb8680aeb8fba9ba18fc56287a7cc3b800aa

SHA512
b33ed1d8e8461330dbebe668b3a1406acb26e1e992635c92273c1b5cac6e1111a0e808e5e293b0521a92fa1f296c6bab4670d25dd67f1a6632cea233d8fdc978

Download Submit
C:\Windows\System\flfbNlL.exe

Filesize
1.8MB

MD5
3d59e62c010b4df74eb358ee5c680b26

SHA1
241ec88bb055940605e6ed42fa7c2934f5b31472

SHA256
2b345c69e7c291fdcd194e7a8fe4e293ef3ebf4e8175e943c00f2ce8fcdb9d99

SHA512
e2a3b7ee9e375ce080643cb30c77af4dc184b6d8ac3a10c09f1a1f170ada7fd2301309c914a7065541657c5d9bbd134c174201f589fc493cf14f0e03046b7649

Download Submit
C:\Windows\System\fqhjCXp.exe

Filesize
1.8MB

MD5
e6f5366a3afe6834da767e212dfafe53

SHA1
1726e21ce5a8da9eb7eed9a3a06a9361bb8ad741

SHA256
da383980bbdc490faba69f71b7758ecf687afc00992d2c93151e4cffe99e1c00

SHA512
46abc6aa810e1acc9267a6090fb692cacd8161c251d325dbd3db20cde54a137746614e6cf41559e4185643cc951688c0008172bd3030cfd82c009e273adb7797

Download Submit
C:\Windows\System\gAqDDbK.exe

Filesize
8B

MD5
3277aa72bb7d7f1eb1043502fbd1c406

SHA1
8712dca2f3fbc82bf0cbbeecdc5d6a26c87f443c

SHA256
e94b62f30c9ce8b0b5cea14d4367a52fe08005d1bd56ca932a1fd7fc15c61bc9

SHA512
9fb0369549dba8937fb796cbc4ade6bacf540f10f98e02675f1b04c615cbb49e396cdbd25cd29de56c7bfb889c8464199939a84fa31434a75c020caeb4f9f503

Download Submit
C:\Windows\System\kJyLAsN.exe

Filesize
1.8MB

MD5
64980c3083a3cc7e9d88a6405dc155be

SHA1
567be2f353462ea4bf7047691b652a89f98cb39f

SHA256
6c3f54f4f8afec1ffee4f07605b1d3847b810409c6016563287bb12eff7853a9

SHA512
55a7ad34e47995e50f9aa689f47c28a9bcfaedf48bf32aaef46c35e5d4c27f2d3575f2fb2b977d677fdcc5caf9276c201d56f344909ca91236302279ff1bba60

Download Submit
C:\Windows\System\ovMUmxG.exe

Filesize
1.8MB

MD5
0c484745e93c2e43b40ffff3a7ad591b

SHA1
9dd6d8b500b7a54f06f74ca1b637636f4e619184

SHA256
26828fff325089461b2f7a2f3c85f93a2a3703c4e50a4a6a252ce3276f820e54

SHA512
e50d25f59a6f51d558551ebc24fad99c5fa156b33b0f6e0946e51a523715763582e2f2e966c2be7fd6a76a3fd8835f3d3b27651e19f05f67cd6a516d4ec2197f

Download Submit
C:\Windows\System\pfQbpBc.exe

Filesize
1.8MB

MD5
b3edcbb4b0d0180a14f5c5bfdc36776a

SHA1
69bf728c723586376723a36da5a12bc5ca5cbe4a

SHA256
f8f61d2fb2c5790e99e3d98e93953761c8e8656b4bd10eccee1e34cb313681b3

SHA512
0211cb89ebd5d765f709b366f96b7266aea73c84759168102851621c0a66cedba22feca4975dc6b206ac3e5ffcc3b95ed8ab2a74da5d73f6628d0d4e911aae79

Download Submit
C:\Windows\System\xFNtyLe.exe

Filesize
1.8MB

MD5
018c7686e35e493fb7005d0823c00686

SHA1
e1261f1fa1518b59b5eeba95052672558c1fb77f

SHA256
99ff2858f7e111228d7cf244def398268583ea83ec07566558a0aca21aa92796

SHA512
00a28738bf075edbeef78b7d1a61d8df3693cf97766a9c809b0e8a6ebf9572613902f6c1d2b8b2f0761d91d7726180baac2dbe084b716433d3c1b58add09d8aa

Download Submit
C:\Windows\System\xaxSRUa.exe

Filesize
1.8MB

MD5
54a84fa82bac9b0f9a84d26a2c69c3d5

SHA1
d58312c0bd2a8df9cf1eb688257ebcf4bbd331b3

SHA256
50df063c665a4c96ef1adaaec32dfb440da583395cfb73a4aa84cb06ee2bc25e

SHA512
0ee4b0ad41513d3ca91432d952bd98a77c097467f4044c8ac6306bcb3b280770645437b62c6a36df03712325a0c6bc0f094ffb2b791592d07b6b59904b64b6ac

Download Submit
C:\Windows\System\yONQALm.exe

Filesize
1.8MB

MD5
cbfb1d2dba62907a29145a59610d119c

SHA1
389c29c289079a63a741a1d80338ff09a51b4cd5

SHA256
83a7d9877a2acc3363bfab3cb408d796928a2621461427abbdb5d24b19aad035

SHA512
9742c72b6a20cd5f6a1ef03ecb3846ddf2e449a4e6feb75f89438100dfbf05e1dfe8bc70d8c91e92fa244e2e338e4dd0044384a0f9f749421b82412fa67a72c0

Download Submit
C:\Windows\System\yaiGvUD.exe

Filesize
1.8MB

MD5
5b33c8f9407d8e12e59dc2aabd2670ee

SHA1
eb34e17dee24326d463d1b40a6660bb43a4f4614

SHA256
8bfe5fde3f0cb46ecabde5e22ff61a6da90c20a60565d40cb8571637eec1f421

SHA512
8f8a76b49a52489d5a8960a8899bcae6b04902ff4d35ac09498ffdc2edc3e9e3275d63f03571b5851cf9ba772351b82b6a9a385657ab4865cb60f087583ecf72

Download Submit
C:\Windows\System\yfCOWvK.exe

Filesize
1.8MB

MD5
0b15743a7f9f5ee24feddf754d556733

SHA1
8c6d25c3827e2d0caac0f9c0819d042cf9b66cbd

SHA256
8c0c70611d613579ea7c9191f360a7db5797298f9b24dbdcc79563a9482065ad

SHA512
56eea72aa678e8f95c590925404697aca9bf82227fe4dc1b3facd8ac040d551cfcd23831fa4507a150f64bcff64d480ef07e585e90cdb867434a15bae20a2619

Download Submit
C:\Windows\System\zKOHQxX.exe

Filesize
1.8MB

MD5
c8c92ef3c61e29932a694de789b8adec

SHA1
b03482b78be01a451621417f1730dc9605eef2d6

SHA256
d6116c755210770cb18deebc03fb8be8b5391fcbb76a5cc5f0ffa810c46e5bc0

SHA512
ede1d2ac276653dc91abfaa3b6d405f684d6238894ed4669feb72449137af57ef2694d5272b2b2a2fe605fa933adf20db8dd8b32498bc69f436ee38e6d168859

Download Submit
memory/216-149-0x00007FF7B1460000-0x00007FF7B1852000-memory.dmp

Filesize
3.9MB

Download
memory/216-2266-0x00007FF7B1460000-0x00007FF7B1852000-memory.dmp

Filesize
3.9MB

Download
memory/552-2219-0x00007FF6CCDB0000-0x00007FF6CD1A2000-memory.dmp

Filesize
3.9MB

Download
memory/552-74-0x00007FF6CCDB0000-0x00007FF6CD1A2000-memory.dmp

Filesize
3.9MB

Download
memory/628-84-0x00007FF65D6C0000-0x00007FF65DAB2000-memory.dmp

Filesize
3.9MB

Download
memory/628-2210-0x00007FF65D6C0000-0x00007FF65DAB2000-memory.dmp

Filesize
3.9MB

Download
memory/1032-2212-0x00007FF6830E0000-0x00007FF6834D2000-memory.dmp

Filesize
3.9MB

Download
memory/1032-79-0x00007FF6830E0000-0x00007FF6834D2000-memory.dmp

Filesize
3.9MB

Download
memory/1216-163-0x00007FF670A30000-0x00007FF670E22000-memory.dmp

Filesize
3.9MB

Download
memory/1216-2263-0x00007FF670A30000-0x00007FF670E22000-memory.dmp

Filesize
3.9MB

Download
memory/1224-1485-0x00007FFA81B70000-0x00007FFA82631000-memory.dmp

Filesize
10.8MB

Download
memory/1224-54-0x0000027FB8F40000-0x0000027FB8F62000-memory.dmp

Filesize
136KB

Download
memory/1224-26-0x0000027FB6C90000-0x0000027FB6CA0000-memory.dmp

Filesize
64KB

Download
memory/1224-1428-0x00007FFA81B70000-0x00007FFA82631000-memory.dmp

Filesize
10.8MB

Download
memory/1224-25-0x0000027FB6C90000-0x0000027FB6CA0000-memory.dmp

Filesize
64KB

Download
memory/1224-20-0x00007FFA81B70000-0x00007FFA82631000-memory.dmp

Filesize
10.8MB

Download
memory/1328-2146-0x00007FF72F5D0000-0x00007FF72F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/1328-83-0x00007FF72F5D0000-0x00007FF72F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/1328-2214-0x00007FF72F5D0000-0x00007FF72F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/1376-85-0x00007FF75F640000-0x00007FF75FA32000-memory.dmp

Filesize
3.9MB

Download
memory/1376-2207-0x00007FF75F640000-0x00007FF75FA32000-memory.dmp

Filesize
3.9MB

Download
memory/2388-87-0x00007FF77A5F0000-0x00007FF77A9E2000-memory.dmp

Filesize
3.9MB

Download
memory/2388-2216-0x00007FF77A5F0000-0x00007FF77A9E2000-memory.dmp

Filesize
3.9MB

Download
memory/2452-86-0x00007FF6B9BB0000-0x00007FF6B9FA2000-memory.dmp

Filesize
3.9MB

Download
memory/2452-2218-0x00007FF6B9BB0000-0x00007FF6B9FA2000-memory.dmp

Filesize
3.9MB

Download
memory/2620-2198-0x00007FF664580000-0x00007FF664972000-memory.dmp

Filesize
3.9MB

Download
memory/2620-51-0x00007FF664580000-0x00007FF664972000-memory.dmp

Filesize
3.9MB

Download
memory/2904-2261-0x00007FF6532A0000-0x00007FF653692000-memory.dmp

Filesize
3.9MB

Download
memory/2904-109-0x00007FF6532A0000-0x00007FF653692000-memory.dmp

Filesize
3.9MB

Download
memory/3188-140-0x00007FF74B4A0000-0x00007FF74B892000-memory.dmp

Filesize
3.9MB

Download
memory/3188-2271-0x00007FF74B4A0000-0x00007FF74B892000-memory.dmp

Filesize
3.9MB

Download
memory/3212-1-0x000001F0A64D0000-0x000001F0A64E0000-memory.dmp

Filesize
64KB

Download
memory/3212-0-0x00007FF6FACE0000-0x00007FF6FB0D2000-memory.dmp

Filesize
3.9MB

Download
memory/3212-1420-0x00007FF6FACE0000-0x00007FF6FB0D2000-memory.dmp

Filesize
3.9MB

Download
memory/3344-2200-0x00007FF69FA40000-0x00007FF69FE32000-memory.dmp

Filesize
3.9MB

Download
memory/3344-36-0x00007FF69FA40000-0x00007FF69FE32000-memory.dmp

Filesize
3.9MB

Download
memory/3428-2273-0x00007FF748B90000-0x00007FF748F82000-memory.dmp

Filesize
3.9MB

Download
memory/3428-169-0x00007FF748B90000-0x00007FF748F82000-memory.dmp

Filesize
3.9MB

Download
memory/4192-2268-0x00007FF645920000-0x00007FF645D12000-memory.dmp

Filesize
3.9MB

Download
memory/4192-137-0x00007FF645920000-0x00007FF645D12000-memory.dmp

Filesize
3.9MB

Download
memory/4260-104-0x00007FF77F720000-0x00007FF77FB12000-memory.dmp

Filesize
3.9MB

Download
memory/4260-2259-0x00007FF77F720000-0x00007FF77FB12000-memory.dmp

Filesize
3.9MB

Download
memory/4260-2162-0x00007FF77F720000-0x00007FF77FB12000-memory.dmp

Filesize
3.9MB

Download
memory/4316-2161-0x00007FF7685B0000-0x00007FF7689A2000-memory.dmp

Filesize
3.9MB

Download
memory/4316-92-0x00007FF7685B0000-0x00007FF7689A2000-memory.dmp

Filesize
3.9MB

Download
memory/4316-2257-0x00007FF7685B0000-0x00007FF7689A2000-memory.dmp

Filesize
3.9MB

Download
memory/4796-24-0x00007FF7A7010000-0x00007FF7A7402000-memory.dmp

Filesize
3.9MB

Download
memory/4796-2196-0x00007FF7A7010000-0x00007FF7A7402000-memory.dmp

Filesize
3.9MB

Download
memory/4864-131-0x00007FF6123B0000-0x00007FF6127A2000-memory.dmp

Filesize
3.9MB

Download
memory/4864-2269-0x00007FF6123B0000-0x00007FF6127A2000-memory.dmp

Filesize
3.9MB

Download
memory/4928-2204-0x00007FF7469F0000-0x00007FF746DE2000-memory.dmp

Filesize
3.9MB

Download
memory/4928-70-0x00007FF7469F0000-0x00007FF746DE2000-memory.dmp

Filesize
3.9MB

Download
memory/5112-68-0x00007FF6087F0000-0x00007FF608BE2000-memory.dmp

Filesize
3.9MB

Download
memory/5112-2205-0x00007FF6087F0000-0x00007FF608BE2000-memory.dmp

Filesize
3.9MB

Download