xmrig | 2fca1920bff751dd1edcd4ad89beb6041ca766aa308b56c5ca12055234596e60

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 18:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
Size

2.3MB
MD5

015959bb69f30b5aebc2d3944fd1de41
SHA1

06a165b51bfaed5d15dd9e87de2dcd8865fbf28f
SHA256

2fca1920bff751dd1edcd4ad89beb6041ca766aa308b56c5ca12055234596e60
SHA512

ff78738f0d562ea2bdc6c5804eae7c43bf89eb2eb9ea3de7bf8a1eece7857e1d6cb5d6512aa21ee7c4044f26fc9984aab6c004518a49d95adf8041c23d35f309
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aDUF:NAB9

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 42 IoCs

miner

resource	yara_rule
behavioral2/memory/4992-128-0x00007FF6DC5B0000-0x00007FF6DC9A2000-memory.dmp	xmrig
behavioral2/memory/404-92-0x00007FF6FBBB0000-0x00007FF6FBFA2000-memory.dmp	xmrig
behavioral2/memory/3016-89-0x00007FF6FAC90000-0x00007FF6FB082000-memory.dmp	xmrig
behavioral2/memory/3120-62-0x00007FF6D4BE0000-0x00007FF6D4FD2000-memory.dmp	xmrig
behavioral2/memory/4512-271-0x00007FF762CC0000-0x00007FF7630B2000-memory.dmp	xmrig
behavioral2/memory/1304-308-0x00007FF69A660000-0x00007FF69AA52000-memory.dmp	xmrig
behavioral2/memory/1016-326-0x00007FF7322E0000-0x00007FF7326D2000-memory.dmp	xmrig
behavioral2/memory/2536-329-0x00007FF74F8D0000-0x00007FF74FCC2000-memory.dmp	xmrig
behavioral2/memory/1188-328-0x00007FF7DB550000-0x00007FF7DB942000-memory.dmp	xmrig
behavioral2/memory/4752-327-0x00007FF6EE5D0000-0x00007FF6EE9C2000-memory.dmp	xmrig
behavioral2/memory/2116-325-0x00007FF622760000-0x00007FF622B52000-memory.dmp	xmrig
behavioral2/memory/1592-324-0x00007FF7641C0000-0x00007FF7645B2000-memory.dmp	xmrig
behavioral2/memory/1596-323-0x00007FF7C5D30000-0x00007FF7C6122000-memory.dmp	xmrig
behavioral2/memory/4860-322-0x00007FF699D40000-0x00007FF69A132000-memory.dmp	xmrig
behavioral2/memory/4936-321-0x00007FF7F5EB0000-0x00007FF7F62A2000-memory.dmp	xmrig
behavioral2/memory/3212-307-0x00007FF60E8C0000-0x00007FF60ECB2000-memory.dmp	xmrig
behavioral2/memory/2664-270-0x00007FF72BDB0000-0x00007FF72C1A2000-memory.dmp	xmrig
behavioral2/memory/1588-223-0x00007FF7440E0000-0x00007FF7444D2000-memory.dmp	xmrig
behavioral2/memory/1960-208-0x00007FF68B730000-0x00007FF68BB22000-memory.dmp	xmrig
behavioral2/memory/5088-181-0x00007FF6D1AE0000-0x00007FF6D1ED2000-memory.dmp	xmrig
behavioral2/memory/3964-169-0x00007FF7E3700000-0x00007FF7E3AF2000-memory.dmp	xmrig
behavioral2/memory/3120-2919-0x00007FF6D4BE0000-0x00007FF6D4FD2000-memory.dmp	xmrig
behavioral2/memory/3016-2921-0x00007FF6FAC90000-0x00007FF6FB082000-memory.dmp	xmrig
behavioral2/memory/404-2923-0x00007FF6FBBB0000-0x00007FF6FBFA2000-memory.dmp	xmrig
behavioral2/memory/4992-2925-0x00007FF6DC5B0000-0x00007FF6DC9A2000-memory.dmp	xmrig
behavioral2/memory/1960-2927-0x00007FF68B730000-0x00007FF68BB22000-memory.dmp	xmrig
behavioral2/memory/3964-2930-0x00007FF7E3700000-0x00007FF7E3AF2000-memory.dmp	xmrig
behavioral2/memory/1304-2933-0x00007FF69A660000-0x00007FF69AA52000-memory.dmp	xmrig
behavioral2/memory/4752-2932-0x00007FF6EE5D0000-0x00007FF6EE9C2000-memory.dmp	xmrig
behavioral2/memory/5088-2935-0x00007FF6D1AE0000-0x00007FF6D1ED2000-memory.dmp	xmrig
behavioral2/memory/4936-2939-0x00007FF7F5EB0000-0x00007FF7F62A2000-memory.dmp	xmrig
behavioral2/memory/1016-2938-0x00007FF7322E0000-0x00007FF7326D2000-memory.dmp	xmrig
behavioral2/memory/1588-2941-0x00007FF7440E0000-0x00007FF7444D2000-memory.dmp	xmrig
behavioral2/memory/4860-2964-0x00007FF699D40000-0x00007FF69A132000-memory.dmp	xmrig
behavioral2/memory/2664-2968-0x00007FF72BDB0000-0x00007FF72C1A2000-memory.dmp	xmrig
behavioral2/memory/4512-2962-0x00007FF762CC0000-0x00007FF7630B2000-memory.dmp	xmrig
behavioral2/memory/2536-2958-0x00007FF74F8D0000-0x00007FF74FCC2000-memory.dmp	xmrig
behavioral2/memory/3212-2954-0x00007FF60E8C0000-0x00007FF60ECB2000-memory.dmp	xmrig
behavioral2/memory/1592-2947-0x00007FF7641C0000-0x00007FF7645B2000-memory.dmp	xmrig
behavioral2/memory/1188-2946-0x00007FF7DB550000-0x00007FF7DB942000-memory.dmp	xmrig
behavioral2/memory/1596-2960-0x00007FF7C5D30000-0x00007FF7C6122000-memory.dmp	xmrig
behavioral2/memory/2116-2956-0x00007FF622760000-0x00007FF622B52000-memory.dmp	xmrig

Blocklisted process makes network request 1 IoCs

flow	pid	Process
4	2900	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3120	HeiVDjs.exe
3016	yEUdtJo.exe
404	sGOTYJT.exe
4992	pJQnBhy.exe
3964	lwMNXXp.exe
5088	jUxOSfj.exe
1960	zAHfHVI.exe
4752	qbmVOsr.exe
1588	VoUwPbD.exe
2664	MKPYtNK.exe
4512	OexyBUA.exe
3212	DypTFko.exe
1188	VRVizAj.exe
1304	UNBYRyh.exe
4936	NvLXyOX.exe
4860	dttgzaz.exe
1596	RgONyYd.exe
1592	vysgByJ.exe
2536	xLfhomj.exe
2116	nlxnKer.exe
1016	wcOKlVH.exe
1816	tKOQFhq.exe
2128	DbbvUaL.exe
4204	LFYRIgh.exe
728	HkfFuNn.exe
392	jUqwFJE.exe
3168	FIyOqNr.exe
1968	yYIcoVd.exe
3636	KKPTCQr.exe
4624	fPHSNBc.exe
4844	RZjCaSU.exe
4956	rVMgzcz.exe
2960	cWdWzCY.exe
3720	tVKYBVc.exe
4572	FAbDkoP.exe
4968	tdwNCEV.exe
2524	MkAhUiw.exe
1780	ibhLPkj.exe
3204	JgTQMgH.exe
3316	ZsBlvRU.exe
448	nMGlWAC.exe
4128	SUQDIWY.exe
1928	jGZhgom.exe
3624	BuhDqql.exe
2412	YLjgdVq.exe
4404	SPTiowm.exe
4472	WZYPbqC.exe
2112	cHlvEXb.exe
1100	xjYWdea.exe
4324	nkLcdvE.exe
3648	TENChlx.exe
1900	nDdfodn.exe
2320	PWQVqNp.exe
1336	tYzeIIe.exe
2448	PkotgXi.exe
3040	FOGwRJj.exe
2324	KXbxmFy.exe
3116	ShrVzAJ.exe
3456	MzaDUXW.exe
5100	zzZTujv.exe
2992	YMEeSGe.exe
4460	aAibdUR.exe
5024	xtAQSGH.exe
4904	ycUUusa.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1392-0-0x00007FF6F65D0000-0x00007FF6F69C2000-memory.dmp	upx
behavioral2/files/0x000900000002340b-6.dat	upx
behavioral2/files/0x000800000002340d-55.dat	upx
behavioral2/files/0x0007000000023412-115.dat	upx
behavioral2/files/0x0007000000023421-114.dat	upx
behavioral2/files/0x0007000000023427-138.dat	upx
behavioral2/files/0x0007000000023420-110.dat	upx
behavioral2/files/0x0007000000023418-109.dat	upx
behavioral2/files/0x000700000002341f-108.dat	upx
behavioral2/files/0x0007000000023417-100.dat	upx
behavioral2/files/0x0007000000023411-97.dat	upx
behavioral2/memory/4992-128-0x00007FF6DC5B0000-0x00007FF6DC9A2000-memory.dmp	upx
behavioral2/files/0x000700000002341d-93.dat	upx
behavioral2/memory/404-92-0x00007FF6FBBB0000-0x00007FF6FBFA2000-memory.dmp	upx
behavioral2/memory/3016-89-0x00007FF6FAC90000-0x00007FF6FB082000-memory.dmp	upx
behavioral2/files/0x000700000002341c-88.dat	upx
behavioral2/files/0x000700000002341b-85.dat	upx
behavioral2/files/0x000700000002341a-82.dat	upx
behavioral2/files/0x0007000000023414-81.dat	upx
behavioral2/files/0x0007000000023413-78.dat	upx
behavioral2/files/0x0007000000023419-77.dat	upx
behavioral2/files/0x000700000002341e-96.dat	upx
behavioral2/files/0x000700000002340e-66.dat	upx
behavioral2/files/0x0007000000023416-65.dat	upx
behavioral2/memory/3120-62-0x00007FF6D4BE0000-0x00007FF6D4FD2000-memory.dmp	upx
behavioral2/files/0x0007000000023410-47.dat	upx
behavioral2/files/0x0007000000023423-124.dat	upx
behavioral2/memory/4512-271-0x00007FF762CC0000-0x00007FF7630B2000-memory.dmp	upx
behavioral2/memory/1304-308-0x00007FF69A660000-0x00007FF69AA52000-memory.dmp	upx
behavioral2/memory/1016-326-0x00007FF7322E0000-0x00007FF7326D2000-memory.dmp	upx
behavioral2/memory/2536-329-0x00007FF74F8D0000-0x00007FF74FCC2000-memory.dmp	upx
behavioral2/memory/1188-328-0x00007FF7DB550000-0x00007FF7DB942000-memory.dmp	upx
behavioral2/memory/4752-327-0x00007FF6EE5D0000-0x00007FF6EE9C2000-memory.dmp	upx
behavioral2/memory/2116-325-0x00007FF622760000-0x00007FF622B52000-memory.dmp	upx
behavioral2/memory/1592-324-0x00007FF7641C0000-0x00007FF7645B2000-memory.dmp	upx
behavioral2/memory/1596-323-0x00007FF7C5D30000-0x00007FF7C6122000-memory.dmp	upx
behavioral2/memory/4860-322-0x00007FF699D40000-0x00007FF69A132000-memory.dmp	upx
behavioral2/memory/4936-321-0x00007FF7F5EB0000-0x00007FF7F62A2000-memory.dmp	upx
behavioral2/memory/3212-307-0x00007FF60E8C0000-0x00007FF60ECB2000-memory.dmp	upx
behavioral2/memory/2664-270-0x00007FF72BDB0000-0x00007FF72C1A2000-memory.dmp	upx
behavioral2/memory/1588-223-0x00007FF7440E0000-0x00007FF7444D2000-memory.dmp	upx
behavioral2/memory/1960-208-0x00007FF68B730000-0x00007FF68BB22000-memory.dmp	upx
behavioral2/files/0x000700000002342f-199.dat	upx
behavioral2/files/0x000700000002342e-194.dat	upx
behavioral2/files/0x000700000002342d-193.dat	upx
behavioral2/memory/5088-181-0x00007FF6D1AE0000-0x00007FF6D1ED2000-memory.dmp	upx
behavioral2/files/0x0007000000023426-174.dat	upx
behavioral2/files/0x0007000000023425-171.dat	upx
behavioral2/memory/3964-169-0x00007FF7E3700000-0x00007FF7E3AF2000-memory.dmp	upx
behavioral2/files/0x000700000002342c-165.dat	upx
behavioral2/files/0x0007000000023424-163.dat	upx
behavioral2/files/0x000700000002342a-154.dat	upx
behavioral2/files/0x0007000000023429-152.dat	upx
behavioral2/files/0x0007000000023428-150.dat	upx
behavioral2/files/0x000700000002342b-164.dat	upx
behavioral2/files/0x0007000000023422-119.dat	upx
behavioral2/files/0x000700000002340f-71.dat	upx
behavioral2/files/0x0007000000023415-61.dat	upx
behavioral2/files/0x00090000000233d5-37.dat	upx
behavioral2/files/0x0004000000023266-14.dat	upx
behavioral2/memory/3120-2919-0x00007FF6D4BE0000-0x00007FF6D4FD2000-memory.dmp	upx
behavioral2/memory/3016-2921-0x00007FF6FAC90000-0x00007FF6FB082000-memory.dmp	upx
behavioral2/memory/404-2923-0x00007FF6FBBB0000-0x00007FF6FBFA2000-memory.dmp	upx
behavioral2/memory/4992-2925-0x00007FF6DC5B0000-0x00007FF6DC9A2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\urqNuUu.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\PLyoxLF.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\WXZxhvW.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\JGmBatN.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\GOIIaJg.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\DdIRfHT.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\DtdGbRT.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\ckpvzWt.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\EvzCiev.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\LSGeqCX.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\KrinlBv.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\LYVEmRz.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\BnqXrmV.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\IHlCTFC.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\NTzAhwn.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\ZNiEmSg.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\LmAeYqn.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\HHIkcLj.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\KjYSIET.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\NrnqyOF.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\OQzvdYx.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\KzWketZ.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\lRJLQmM.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\CStspoS.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\ZcAHFNr.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\fCiGkAT.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\Fnvlzrn.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\VahWsag.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\yyTZwpR.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\AIzMVuU.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\qEUYWzx.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\JnyKOKa.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\NTieatW.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\PQRVqVd.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\wxMDhdb.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\PURDUbZ.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\AlmPTDJ.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\bRGQUfO.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\QpAhzZI.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\kJOlGea.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\SKCihmm.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\OlWeTcM.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\rDhUZFx.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\bjDLKPG.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\TNIsCsQ.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\KIoAWmv.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\MgeEvNC.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\HOaTDDR.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\XiCRFaB.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\TISMbVX.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\Pyioety.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\tukoTjC.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\wSmjUgg.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\RZjCaSU.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\syfsKIJ.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\rIYRiTR.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\ljgmtWh.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\rMkTmTV.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\fpLEsCh.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\ulCaeby.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\XHwiWuS.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\dCfcipb.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\jrQrqcG.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
File created	C:\Windows\System\cKobcvV.exe	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2900	powershell.exe
2900	powershell.exe
2900	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
Token: SeDebugPrivilege	2900	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 2900	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	81
PID 1392 wrote to memory of 2900	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	81
PID 1392 wrote to memory of 3120	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	82
PID 1392 wrote to memory of 3120	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	82
PID 1392 wrote to memory of 3016	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	83
PID 1392 wrote to memory of 3016	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	83
PID 1392 wrote to memory of 404	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	84
PID 1392 wrote to memory of 404	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	84
PID 1392 wrote to memory of 4992	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	85
PID 1392 wrote to memory of 4992	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	85
PID 1392 wrote to memory of 3964	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	86
PID 1392 wrote to memory of 3964	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	86
PID 1392 wrote to memory of 5088	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	87
PID 1392 wrote to memory of 5088	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	87
PID 1392 wrote to memory of 1960	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	88
PID 1392 wrote to memory of 1960	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	88
PID 1392 wrote to memory of 4752	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	89
PID 1392 wrote to memory of 4752	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	89
PID 1392 wrote to memory of 1588	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	90
PID 1392 wrote to memory of 1588	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	90
PID 1392 wrote to memory of 2664	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	91
PID 1392 wrote to memory of 2664	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	91
PID 1392 wrote to memory of 4512	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	92
PID 1392 wrote to memory of 4512	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	92
PID 1392 wrote to memory of 3212	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	93
PID 1392 wrote to memory of 3212	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	93
PID 1392 wrote to memory of 1188	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	94
PID 1392 wrote to memory of 1188	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	94
PID 1392 wrote to memory of 1304	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	95
PID 1392 wrote to memory of 1304	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	95
PID 1392 wrote to memory of 1016	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	96
PID 1392 wrote to memory of 1016	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	96
PID 1392 wrote to memory of 4936	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	97
PID 1392 wrote to memory of 4936	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	97
PID 1392 wrote to memory of 4860	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	98
PID 1392 wrote to memory of 4860	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	98
PID 1392 wrote to memory of 1596	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	99
PID 1392 wrote to memory of 1596	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	99
PID 1392 wrote to memory of 1592	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	100
PID 1392 wrote to memory of 1592	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	100
PID 1392 wrote to memory of 2536	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	101
PID 1392 wrote to memory of 2536	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	101
PID 1392 wrote to memory of 2116	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	102
PID 1392 wrote to memory of 2116	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	102
PID 1392 wrote to memory of 1816	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	103
PID 1392 wrote to memory of 1816	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	103
PID 1392 wrote to memory of 2128	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	104
PID 1392 wrote to memory of 2128	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	104
PID 1392 wrote to memory of 4204	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	105
PID 1392 wrote to memory of 4204	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	105
PID 1392 wrote to memory of 728	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	106
PID 1392 wrote to memory of 728	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	106
PID 1392 wrote to memory of 392	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	107
PID 1392 wrote to memory of 392	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	107
PID 1392 wrote to memory of 2960	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	108
PID 1392 wrote to memory of 2960	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	108
PID 1392 wrote to memory of 3168	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	109
PID 1392 wrote to memory of 3168	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	109
PID 1392 wrote to memory of 1968	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	110
PID 1392 wrote to memory of 1968	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	110
PID 1392 wrote to memory of 3636	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	111
PID 1392 wrote to memory of 3636	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	111
PID 1392 wrote to memory of 4624	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	112
PID 1392 wrote to memory of 4624	1392	015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe	112

C:\Users\Admin\AppData\Local\Temp\015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\015959bb69f30b5aebc2d3944fd1de41_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2900
- C:\Windows\System\HeiVDjs.exe
  C:\Windows\System\HeiVDjs.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\yEUdtJo.exe
  C:\Windows\System\yEUdtJo.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\sGOTYJT.exe
  C:\Windows\System\sGOTYJT.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\pJQnBhy.exe
  C:\Windows\System\pJQnBhy.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\lwMNXXp.exe
  C:\Windows\System\lwMNXXp.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\jUxOSfj.exe
  C:\Windows\System\jUxOSfj.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\zAHfHVI.exe
  C:\Windows\System\zAHfHVI.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\qbmVOsr.exe
  C:\Windows\System\qbmVOsr.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\VoUwPbD.exe
  C:\Windows\System\VoUwPbD.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\MKPYtNK.exe
  C:\Windows\System\MKPYtNK.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\OexyBUA.exe
  C:\Windows\System\OexyBUA.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\DypTFko.exe
  C:\Windows\System\DypTFko.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\VRVizAj.exe
  C:\Windows\System\VRVizAj.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\UNBYRyh.exe
  C:\Windows\System\UNBYRyh.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\wcOKlVH.exe
  C:\Windows\System\wcOKlVH.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\NvLXyOX.exe
  C:\Windows\System\NvLXyOX.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\dttgzaz.exe
  C:\Windows\System\dttgzaz.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\RgONyYd.exe
  C:\Windows\System\RgONyYd.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\vysgByJ.exe
  C:\Windows\System\vysgByJ.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\xLfhomj.exe
  C:\Windows\System\xLfhomj.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\nlxnKer.exe
  C:\Windows\System\nlxnKer.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\tKOQFhq.exe
  C:\Windows\System\tKOQFhq.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\DbbvUaL.exe
  C:\Windows\System\DbbvUaL.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\LFYRIgh.exe
  C:\Windows\System\LFYRIgh.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\HkfFuNn.exe
  C:\Windows\System\HkfFuNn.exe
  2⤵
  - Executes dropped EXE
  PID:728
- C:\Windows\System\jUqwFJE.exe
  C:\Windows\System\jUqwFJE.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\cWdWzCY.exe
  C:\Windows\System\cWdWzCY.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\FIyOqNr.exe
  C:\Windows\System\FIyOqNr.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\yYIcoVd.exe
  C:\Windows\System\yYIcoVd.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\KKPTCQr.exe
  C:\Windows\System\KKPTCQr.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\fPHSNBc.exe
  C:\Windows\System\fPHSNBc.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\RZjCaSU.exe
  C:\Windows\System\RZjCaSU.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\rVMgzcz.exe
  C:\Windows\System\rVMgzcz.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\tVKYBVc.exe
  C:\Windows\System\tVKYBVc.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\FAbDkoP.exe
  C:\Windows\System\FAbDkoP.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\tdwNCEV.exe
  C:\Windows\System\tdwNCEV.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\MkAhUiw.exe
  C:\Windows\System\MkAhUiw.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\ibhLPkj.exe
  C:\Windows\System\ibhLPkj.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\JgTQMgH.exe
  C:\Windows\System\JgTQMgH.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\WZYPbqC.exe
  C:\Windows\System\WZYPbqC.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\ZsBlvRU.exe
  C:\Windows\System\ZsBlvRU.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System\nMGlWAC.exe
  C:\Windows\System\nMGlWAC.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\SUQDIWY.exe
  C:\Windows\System\SUQDIWY.exe
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\Windows\System\jGZhgom.exe
  C:\Windows\System\jGZhgom.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\BuhDqql.exe
  C:\Windows\System\BuhDqql.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\YLjgdVq.exe
  C:\Windows\System\YLjgdVq.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\SPTiowm.exe
  C:\Windows\System\SPTiowm.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\cHlvEXb.exe
  C:\Windows\System\cHlvEXb.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\xjYWdea.exe
  C:\Windows\System\xjYWdea.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\nkLcdvE.exe
  C:\Windows\System\nkLcdvE.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\TENChlx.exe
  C:\Windows\System\TENChlx.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\nDdfodn.exe
  C:\Windows\System\nDdfodn.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\PWQVqNp.exe
  C:\Windows\System\PWQVqNp.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\tYzeIIe.exe
  C:\Windows\System\tYzeIIe.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\PkotgXi.exe
  C:\Windows\System\PkotgXi.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\FOGwRJj.exe
  C:\Windows\System\FOGwRJj.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\KXbxmFy.exe
  C:\Windows\System\KXbxmFy.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\ShrVzAJ.exe
  C:\Windows\System\ShrVzAJ.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\MzaDUXW.exe
  C:\Windows\System\MzaDUXW.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\zzZTujv.exe
  C:\Windows\System\zzZTujv.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\YMEeSGe.exe
  C:\Windows\System\YMEeSGe.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\aAibdUR.exe
  C:\Windows\System\aAibdUR.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\xtAQSGH.exe
  C:\Windows\System\xtAQSGH.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\ycUUusa.exe
  C:\Windows\System\ycUUusa.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\QyVUQHb.exe
  C:\Windows\System\QyVUQHb.exe
  2⤵
  PID:1312
- C:\Windows\System\mhUkIZL.exe
  C:\Windows\System\mhUkIZL.exe
  2⤵
  PID:1284
- C:\Windows\System\QIolvSj.exe
  C:\Windows\System\QIolvSj.exe
  2⤵
  PID:1388
- C:\Windows\System\GyvBQSQ.exe
  C:\Windows\System\GyvBQSQ.exe
  2⤵
  PID:3396
- C:\Windows\System\LOfinfl.exe
  C:\Windows\System\LOfinfl.exe
  2⤵
  PID:1684
- C:\Windows\System\XgQRhzL.exe
  C:\Windows\System\XgQRhzL.exe
  2⤵
  PID:1400
- C:\Windows\System\VCNVdSW.exe
  C:\Windows\System\VCNVdSW.exe
  2⤵
  PID:1436
- C:\Windows\System\lHZiuFi.exe
  C:\Windows\System\lHZiuFi.exe
  2⤵
  PID:4872
- C:\Windows\System\JPtQBRy.exe
  C:\Windows\System\JPtQBRy.exe
  2⤵
  PID:1556
- C:\Windows\System\oJPcSTe.exe
  C:\Windows\System\oJPcSTe.exe
  2⤵
  PID:4124
- C:\Windows\System\KMzABin.exe
  C:\Windows\System\KMzABin.exe
  2⤵
  PID:3712
- C:\Windows\System\zvCLYlX.exe
  C:\Windows\System\zvCLYlX.exe
  2⤵
  PID:4772
- C:\Windows\System\hODaPTi.exe
  C:\Windows\System\hODaPTi.exe
  2⤵
  PID:972
- C:\Windows\System\znJyrnN.exe
  C:\Windows\System\znJyrnN.exe
  2⤵
  PID:5084
- C:\Windows\System\vWfqqXY.exe
  C:\Windows\System\vWfqqXY.exe
  2⤵
  PID:4792
- C:\Windows\System\alYWyor.exe
  C:\Windows\System\alYWyor.exe
  2⤵
  PID:3032
- C:\Windows\System\RdMGFFH.exe
  C:\Windows\System\RdMGFFH.exe
  2⤵
  PID:2028
- C:\Windows\System\vogGBUF.exe
  C:\Windows\System\vogGBUF.exe
  2⤵
  PID:2176
- C:\Windows\System\GyOPOdD.exe
  C:\Windows\System\GyOPOdD.exe
  2⤵
  PID:556
- C:\Windows\System\syfsKIJ.exe
  C:\Windows\System\syfsKIJ.exe
  2⤵
  PID:1408
- C:\Windows\System\RaMOplH.exe
  C:\Windows\System\RaMOplH.exe
  2⤵
  PID:1936
- C:\Windows\System\hZYkxYE.exe
  C:\Windows\System\hZYkxYE.exe
  2⤵
  PID:4684
- C:\Windows\System\hVxMFTc.exe
  C:\Windows\System\hVxMFTc.exe
  2⤵
  PID:848
- C:\Windows\System\cBIocxc.exe
  C:\Windows\System\cBIocxc.exe
  2⤵
  PID:1008
- C:\Windows\System\LfoIevF.exe
  C:\Windows\System\LfoIevF.exe
  2⤵
  PID:512
- C:\Windows\System\GYxQXVN.exe
  C:\Windows\System\GYxQXVN.exe
  2⤵
  PID:2988
- C:\Windows\System\WwajMpp.exe
  C:\Windows\System\WwajMpp.exe
  2⤵
  PID:2372
- C:\Windows\System\BpXeAFV.exe
  C:\Windows\System\BpXeAFV.exe
  2⤵
  PID:3728
- C:\Windows\System\cgXfcIs.exe
  C:\Windows\System\cgXfcIs.exe
  2⤵
  PID:1552
- C:\Windows\System\QPnorOi.exe
  C:\Windows\System\QPnorOi.exe
  2⤵
  PID:2432
- C:\Windows\System\VwnAbdS.exe
  C:\Windows\System\VwnAbdS.exe
  2⤵
  PID:3980
- C:\Windows\System\eJIOsEP.exe
  C:\Windows\System\eJIOsEP.exe
  2⤵
  PID:1832
- C:\Windows\System\QFJCtcH.exe
  C:\Windows\System\QFJCtcH.exe
  2⤵
  PID:5136
- C:\Windows\System\XAvWPjq.exe
  C:\Windows\System\XAvWPjq.exe
  2⤵
  PID:5160
- C:\Windows\System\rTCkhUl.exe
  C:\Windows\System\rTCkhUl.exe
  2⤵
  PID:5260
- C:\Windows\System\myJPulF.exe
  C:\Windows\System\myJPulF.exe
  2⤵
  PID:5288
- C:\Windows\System\hpaYPuh.exe
  C:\Windows\System\hpaYPuh.exe
  2⤵
  PID:5312
- C:\Windows\System\LXSAvYw.exe
  C:\Windows\System\LXSAvYw.exe
  2⤵
  PID:5328
- C:\Windows\System\VVTCtot.exe
  C:\Windows\System\VVTCtot.exe
  2⤵
  PID:5360
- C:\Windows\System\uOZAWAr.exe
  C:\Windows\System\uOZAWAr.exe
  2⤵
  PID:5384
- C:\Windows\System\EdEFQVe.exe
  C:\Windows\System\EdEFQVe.exe
  2⤵
  PID:5412
- C:\Windows\System\fSmrHKe.exe
  C:\Windows\System\fSmrHKe.exe
  2⤵
  PID:5432
- C:\Windows\System\RpGVYkc.exe
  C:\Windows\System\RpGVYkc.exe
  2⤵
  PID:5456
- C:\Windows\System\VRMJznA.exe
  C:\Windows\System\VRMJznA.exe
  2⤵
  PID:5484
- C:\Windows\System\rYVjbXq.exe
  C:\Windows\System\rYVjbXq.exe
  2⤵
  PID:5656
- C:\Windows\System\VOWynlu.exe
  C:\Windows\System\VOWynlu.exe
  2⤵
  PID:5672
- C:\Windows\System\EuQZOOU.exe
  C:\Windows\System\EuQZOOU.exe
  2⤵
  PID:5696
- C:\Windows\System\RkBToBX.exe
  C:\Windows\System\RkBToBX.exe
  2⤵
  PID:5712
- C:\Windows\System\BWMehBr.exe
  C:\Windows\System\BWMehBr.exe
  2⤵
  PID:5772
- C:\Windows\System\BdCdWdb.exe
  C:\Windows\System\BdCdWdb.exe
  2⤵
  PID:5788
- C:\Windows\System\EZwLgfy.exe
  C:\Windows\System\EZwLgfy.exe
  2⤵
  PID:5804
- C:\Windows\System\xJaInQX.exe
  C:\Windows\System\xJaInQX.exe
  2⤵
  PID:5828
- C:\Windows\System\AxjmIUd.exe
  C:\Windows\System\AxjmIUd.exe
  2⤵
  PID:5856
- C:\Windows\System\ACKSVQm.exe
  C:\Windows\System\ACKSVQm.exe
  2⤵
  PID:5884
- C:\Windows\System\CZViPvn.exe
  C:\Windows\System\CZViPvn.exe
  2⤵
  PID:5948
- C:\Windows\System\bqwHjjM.exe
  C:\Windows\System\bqwHjjM.exe
  2⤵
  PID:5964
- C:\Windows\System\QHGMGqj.exe
  C:\Windows\System\QHGMGqj.exe
  2⤵
  PID:6084
- C:\Windows\System\FgGjdXX.exe
  C:\Windows\System\FgGjdXX.exe
  2⤵
  PID:6112
- C:\Windows\System\yBKBFyD.exe
  C:\Windows\System\yBKBFyD.exe
  2⤵
  PID:6132
- C:\Windows\System\KNYvfHM.exe
  C:\Windows\System\KNYvfHM.exe
  2⤵
  PID:4304
- C:\Windows\System\HNOcsHQ.exe
  C:\Windows\System\HNOcsHQ.exe
  2⤵
  PID:1632
- C:\Windows\System\nDRopdn.exe
  C:\Windows\System\nDRopdn.exe
  2⤵
  PID:1412
- C:\Windows\System\fOshJbH.exe
  C:\Windows\System\fOshJbH.exe
  2⤵
  PID:2168
- C:\Windows\System\eQFplVC.exe
  C:\Windows\System\eQFplVC.exe
  2⤵
  PID:4596
- C:\Windows\System\tiqJTco.exe
  C:\Windows\System\tiqJTco.exe
  2⤵
  PID:4952
- C:\Windows\System\AsTdwkw.exe
  C:\Windows\System\AsTdwkw.exe
  2⤵
  PID:1744
- C:\Windows\System\mIJtOwf.exe
  C:\Windows\System\mIJtOwf.exe
  2⤵
  PID:5180
- C:\Windows\System\wXAdVYi.exe
  C:\Windows\System\wXAdVYi.exe
  2⤵
  PID:5220
- C:\Windows\System\mqljubX.exe
  C:\Windows\System\mqljubX.exe
  2⤵
  PID:5252
- C:\Windows\System\kABBGkn.exe
  C:\Windows\System\kABBGkn.exe
  2⤵
  PID:5296
- C:\Windows\System\WYjohsH.exe
  C:\Windows\System\WYjohsH.exe
  2⤵
  PID:5720
- C:\Windows\System\aBDJKNe.exe
  C:\Windows\System\aBDJKNe.exe
  2⤵
  PID:5848
- C:\Windows\System\ddTAUtc.exe
  C:\Windows\System\ddTAUtc.exe
  2⤵
  PID:5872
- C:\Windows\System\fvykPCD.exe
  C:\Windows\System\fvykPCD.exe
  2⤵
  PID:6020
- C:\Windows\System\skEMKcT.exe
  C:\Windows\System\skEMKcT.exe
  2⤵
  PID:5944
- C:\Windows\System\bMvclut.exe
  C:\Windows\System\bMvclut.exe
  2⤵
  PID:5172
- C:\Windows\System\cAIRXSS.exe
  C:\Windows\System\cAIRXSS.exe
  2⤵
  PID:6012
- C:\Windows\System\anSIkmk.exe
  C:\Windows\System\anSIkmk.exe
  2⤵
  PID:6048
- C:\Windows\System\yVRXoBs.exe
  C:\Windows\System\yVRXoBs.exe
  2⤵
  PID:5200
- C:\Windows\System\FdkfVqo.exe
  C:\Windows\System\FdkfVqo.exe
  2⤵
  PID:5320
- C:\Windows\System\FLsNWuS.exe
  C:\Windows\System\FLsNWuS.exe
  2⤵
  PID:5440
- C:\Windows\System\LrEzwLW.exe
  C:\Windows\System\LrEzwLW.exe
  2⤵
  PID:5936
- C:\Windows\System\MgeEvNC.exe
  C:\Windows\System\MgeEvNC.exe
  2⤵
  PID:1828
- C:\Windows\System\mwxjfzr.exe
  C:\Windows\System\mwxjfzr.exe
  2⤵
  PID:6040
- C:\Windows\System\RsbMAzo.exe
  C:\Windows\System\RsbMAzo.exe
  2⤵
  PID:6072
- C:\Windows\System\oXoaYhm.exe
  C:\Windows\System\oXoaYhm.exe
  2⤵
  PID:880
- C:\Windows\System\KjsWzqI.exe
  C:\Windows\System\KjsWzqI.exe
  2⤵
  PID:5592
- C:\Windows\System\OiIPJAI.exe
  C:\Windows\System\OiIPJAI.exe
  2⤵
  PID:3144
- C:\Windows\System\bRGQUfO.exe
  C:\Windows\System\bRGQUfO.exe
  2⤵
  PID:2740
- C:\Windows\System\vmDvJsb.exe
  C:\Windows\System\vmDvJsb.exe
  2⤵
  PID:4776
- C:\Windows\System\LFFuGPa.exe
  C:\Windows\System\LFFuGPa.exe
  2⤵
  PID:3348
- C:\Windows\System\VBZiMfR.exe
  C:\Windows\System\VBZiMfR.exe
  2⤵
  PID:2264
- C:\Windows\System\AWWRonw.exe
  C:\Windows\System\AWWRonw.exe
  2⤵
  PID:2368
- C:\Windows\System\XcgljBg.exe
  C:\Windows\System\XcgljBg.exe
  2⤵
  PID:2132
- C:\Windows\System\jxojHoc.exe
  C:\Windows\System\jxojHoc.exe
  2⤵
  PID:1340
- C:\Windows\System\ObNJjdL.exe
  C:\Windows\System\ObNJjdL.exe
  2⤵
  PID:3024
- C:\Windows\System\kJOlGea.exe
  C:\Windows\System\kJOlGea.exe
  2⤵
  PID:1932
- C:\Windows\System\KXrTMwl.exe
  C:\Windows\System\KXrTMwl.exe
  2⤵
  PID:1568
- C:\Windows\System\qEUYWzx.exe
  C:\Windows\System\qEUYWzx.exe
  2⤵
  PID:5096
- C:\Windows\System\wfKUpIs.exe
  C:\Windows\System\wfKUpIs.exe
  2⤵
  PID:3236
- C:\Windows\System\zDcizmr.exe
  C:\Windows\System\zDcizmr.exe
  2⤵
  PID:2716
- C:\Windows\System\reDOqGp.exe
  C:\Windows\System\reDOqGp.exe
  2⤵
  PID:3896
- C:\Windows\System\UIgZEZZ.exe
  C:\Windows\System\UIgZEZZ.exe
  2⤵
  PID:2424
- C:\Windows\System\Vdkvsqd.exe
  C:\Windows\System\Vdkvsqd.exe
  2⤵
  PID:6148
- C:\Windows\System\SAVJqgE.exe
  C:\Windows\System\SAVJqgE.exe
  2⤵
  PID:6172
- C:\Windows\System\ZzpoMhz.exe
  C:\Windows\System\ZzpoMhz.exe
  2⤵
  PID:6196
- C:\Windows\System\OESvNto.exe
  C:\Windows\System\OESvNto.exe
  2⤵
  PID:6232
- C:\Windows\System\LjwyfjF.exe
  C:\Windows\System\LjwyfjF.exe
  2⤵
  PID:6252
- C:\Windows\System\GLsxFkd.exe
  C:\Windows\System\GLsxFkd.exe
  2⤵
  PID:6276
- C:\Windows\System\CYekjek.exe
  C:\Windows\System\CYekjek.exe
  2⤵
  PID:6296
- C:\Windows\System\LMPctNC.exe
  C:\Windows\System\LMPctNC.exe
  2⤵
  PID:6320
- C:\Windows\System\vSlyznJ.exe
  C:\Windows\System\vSlyznJ.exe
  2⤵
  PID:6344
- C:\Windows\System\dpQXyaA.exe
  C:\Windows\System\dpQXyaA.exe
  2⤵
  PID:6364
- C:\Windows\System\OloIXGi.exe
  C:\Windows\System\OloIXGi.exe
  2⤵
  PID:6384
- C:\Windows\System\HTuwzAL.exe
  C:\Windows\System\HTuwzAL.exe
  2⤵
  PID:6404
- C:\Windows\System\YqJitgC.exe
  C:\Windows\System\YqJitgC.exe
  2⤵
  PID:6432
- C:\Windows\System\QSttDqn.exe
  C:\Windows\System\QSttDqn.exe
  2⤵
  PID:6460
- C:\Windows\System\sVfZFWo.exe
  C:\Windows\System\sVfZFWo.exe
  2⤵
  PID:6496
- C:\Windows\System\CIChBpu.exe
  C:\Windows\System\CIChBpu.exe
  2⤵
  PID:6520
- C:\Windows\System\LYVEmRz.exe
  C:\Windows\System\LYVEmRz.exe
  2⤵
  PID:6540
- C:\Windows\System\enfgTBM.exe
  C:\Windows\System\enfgTBM.exe
  2⤵
  PID:6560
- C:\Windows\System\VtMIvKR.exe
  C:\Windows\System\VtMIvKR.exe
  2⤵
  PID:6584
- C:\Windows\System\WEuGKgR.exe
  C:\Windows\System\WEuGKgR.exe
  2⤵
  PID:6616
- C:\Windows\System\IQhXuEM.exe
  C:\Windows\System\IQhXuEM.exe
  2⤵
  PID:6636
- C:\Windows\System\cgCBuIS.exe
  C:\Windows\System\cgCBuIS.exe
  2⤵
  PID:6656
- C:\Windows\System\sRFuUrc.exe
  C:\Windows\System\sRFuUrc.exe
  2⤵
  PID:6676
- C:\Windows\System\JnyKOKa.exe
  C:\Windows\System\JnyKOKa.exe
  2⤵
  PID:6696
- C:\Windows\System\hFBNYab.exe
  C:\Windows\System\hFBNYab.exe
  2⤵
  PID:6724
- C:\Windows\System\qOkWpeB.exe
  C:\Windows\System\qOkWpeB.exe
  2⤵
  PID:6756
- C:\Windows\System\UxYNbfK.exe
  C:\Windows\System\UxYNbfK.exe
  2⤵
  PID:6952
- C:\Windows\System\OaIotdJ.exe
  C:\Windows\System\OaIotdJ.exe
  2⤵
  PID:6988
- C:\Windows\System\GIGNdXz.exe
  C:\Windows\System\GIGNdXz.exe
  2⤵
  PID:7004
- C:\Windows\System\Iriemmx.exe
  C:\Windows\System\Iriemmx.exe
  2⤵
  PID:7048
- C:\Windows\System\FfjZqHx.exe
  C:\Windows\System\FfjZqHx.exe
  2⤵
  PID:7068
- C:\Windows\System\wGDHnML.exe
  C:\Windows\System\wGDHnML.exe
  2⤵
  PID:7088
- C:\Windows\System\iFcUnAG.exe
  C:\Windows\System\iFcUnAG.exe
  2⤵
  PID:7108
- C:\Windows\System\RPiViOt.exe
  C:\Windows\System\RPiViOt.exe
  2⤵
  PID:7124
- C:\Windows\System\wqRSgrA.exe
  C:\Windows\System\wqRSgrA.exe
  2⤵
  PID:7140
- C:\Windows\System\YWUjGJc.exe
  C:\Windows\System\YWUjGJc.exe
  2⤵
  PID:7164
- C:\Windows\System\ocOFIqO.exe
  C:\Windows\System\ocOFIqO.exe
  2⤵
  PID:2328
- C:\Windows\System\JsMirsb.exe
  C:\Windows\System\JsMirsb.exe
  2⤵
  PID:6208
- C:\Windows\System\docrjeC.exe
  C:\Windows\System\docrjeC.exe
  2⤵
  PID:5104
- C:\Windows\System\VacMBKa.exe
  C:\Windows\System\VacMBKa.exe
  2⤵
  PID:6268
- C:\Windows\System\CrYbpEu.exe
  C:\Windows\System\CrYbpEu.exe
  2⤵
  PID:432
- C:\Windows\System\ZStYxgt.exe
  C:\Windows\System\ZStYxgt.exe
  2⤵
  PID:6160
- C:\Windows\System\sLAFkKA.exe
  C:\Windows\System\sLAFkKA.exe
  2⤵
  PID:6360
- C:\Windows\System\AOufwHm.exe
  C:\Windows\System\AOufwHm.exe
  2⤵
  PID:6412
- C:\Windows\System\NdVnOAA.exe
  C:\Windows\System\NdVnOAA.exe
  2⤵
  PID:6508
- C:\Windows\System\IXVoWJC.exe
  C:\Windows\System\IXVoWJC.exe
  2⤵
  PID:6536
- C:\Windows\System\gmZcNXS.exe
  C:\Windows\System\gmZcNXS.exe
  2⤵
  PID:6340
- C:\Windows\System\IYAhEzj.exe
  C:\Windows\System\IYAhEzj.exe
  2⤵
  PID:6732
- C:\Windows\System\jRPUCQt.exe
  C:\Windows\System\jRPUCQt.exe
  2⤵
  PID:6596
- C:\Windows\System\XyWcFUu.exe
  C:\Windows\System\XyWcFUu.exe
  2⤵
  PID:6504
- C:\Windows\System\ORMNLbm.exe
  C:\Windows\System\ORMNLbm.exe
  2⤵
  PID:6532
- C:\Windows\System\GLYRLxw.exe
  C:\Windows\System\GLYRLxw.exe
  2⤵
  PID:676
- C:\Windows\System\StgOCbN.exe
  C:\Windows\System\StgOCbN.exe
  2⤵
  PID:6840
- C:\Windows\System\TedxQJm.exe
  C:\Windows\System\TedxQJm.exe
  2⤵
  PID:6772
- C:\Windows\System\OcnzMaB.exe
  C:\Windows\System\OcnzMaB.exe
  2⤵
  PID:6940
- C:\Windows\System\pqHmhIl.exe
  C:\Windows\System\pqHmhIl.exe
  2⤵
  PID:2640
- C:\Windows\System\EPtGutd.exe
  C:\Windows\System\EPtGutd.exe
  2⤵
  PID:7012
- C:\Windows\System\CAUggdV.exe
  C:\Windows\System\CAUggdV.exe
  2⤵
  PID:2232
- C:\Windows\System\LVyORda.exe
  C:\Windows\System\LVyORda.exe
  2⤵
  PID:7044
- C:\Windows\System\jCFmHJl.exe
  C:\Windows\System\jCFmHJl.exe
  2⤵
  PID:7080
- C:\Windows\System\ZfkjRVX.exe
  C:\Windows\System\ZfkjRVX.exe
  2⤵
  PID:7116
- C:\Windows\System\IHlCTFC.exe
  C:\Windows\System\IHlCTFC.exe
  2⤵
  PID:7104
- C:\Windows\System\IBVsyyB.exe
  C:\Windows\System\IBVsyyB.exe
  2⤵
  PID:6260
- C:\Windows\System\ksHFtUF.exe
  C:\Windows\System\ksHFtUF.exe
  2⤵
  PID:7136
- C:\Windows\System\BZTQLDB.exe
  C:\Windows\System\BZTQLDB.exe
  2⤵
  PID:6292
- C:\Windows\System\Qgjfzzp.exe
  C:\Windows\System\Qgjfzzp.exe
  2⤵
  PID:6444
- C:\Windows\System\lADrpmi.exe
  C:\Windows\System\lADrpmi.exe
  2⤵
  PID:6468
- C:\Windows\System\aQpTNKu.exe
  C:\Windows\System\aQpTNKu.exe
  2⤵
  PID:6484
- C:\Windows\System\CpJUFeO.exe
  C:\Windows\System\CpJUFeO.exe
  2⤵
  PID:6396
- C:\Windows\System\UUquUgF.exe
  C:\Windows\System\UUquUgF.exe
  2⤵
  PID:6836
- C:\Windows\System\rKejlmS.exe
  C:\Windows\System\rKejlmS.exe
  2⤵
  PID:6972
- C:\Windows\System\yNijbPG.exe
  C:\Windows\System\yNijbPG.exe
  2⤵
  PID:4664
- C:\Windows\System\PqsfbVo.exe
  C:\Windows\System\PqsfbVo.exe
  2⤵
  PID:6788
- C:\Windows\System\BzSNypQ.exe
  C:\Windows\System\BzSNypQ.exe
  2⤵
  PID:7180
- C:\Windows\System\NpmyBXf.exe
  C:\Windows\System\NpmyBXf.exe
  2⤵
  PID:7200
- C:\Windows\System\QjozOEy.exe
  C:\Windows\System\QjozOEy.exe
  2⤵
  PID:7240
- C:\Windows\System\CUYkFpA.exe
  C:\Windows\System\CUYkFpA.exe
  2⤵
  PID:7260
- C:\Windows\System\dgnjSEN.exe
  C:\Windows\System\dgnjSEN.exe
  2⤵
  PID:7284
- C:\Windows\System\oPQWcVe.exe
  C:\Windows\System\oPQWcVe.exe
  2⤵
  PID:7308
- C:\Windows\System\RMVblYl.exe
  C:\Windows\System\RMVblYl.exe
  2⤵
  PID:7332
- C:\Windows\System\JYWpZur.exe
  C:\Windows\System\JYWpZur.exe
  2⤵
  PID:7356
- C:\Windows\System\JLhQmVn.exe
  C:\Windows\System\JLhQmVn.exe
  2⤵
  PID:7376
- C:\Windows\System\vrdLFhd.exe
  C:\Windows\System\vrdLFhd.exe
  2⤵
  PID:7404
- C:\Windows\System\wNMOICE.exe
  C:\Windows\System\wNMOICE.exe
  2⤵
  PID:7428
- C:\Windows\System\biekLWU.exe
  C:\Windows\System\biekLWU.exe
  2⤵
  PID:7452
- C:\Windows\System\ogSJYku.exe
  C:\Windows\System\ogSJYku.exe
  2⤵
  PID:7468
- C:\Windows\System\ZjmwYeJ.exe
  C:\Windows\System\ZjmwYeJ.exe
  2⤵
  PID:7488
- C:\Windows\System\bfdLlHo.exe
  C:\Windows\System\bfdLlHo.exe
  2⤵
  PID:7512
- C:\Windows\System\azZsXzx.exe
  C:\Windows\System\azZsXzx.exe
  2⤵
  PID:7544
- C:\Windows\System\fpLEsCh.exe
  C:\Windows\System\fpLEsCh.exe
  2⤵
  PID:7568
- C:\Windows\System\XDdULel.exe
  C:\Windows\System\XDdULel.exe
  2⤵
  PID:7588
- C:\Windows\System\dhresZY.exe
  C:\Windows\System\dhresZY.exe
  2⤵
  PID:7616
- C:\Windows\System\DkxaeIn.exe
  C:\Windows\System\DkxaeIn.exe
  2⤵
  PID:7640
- C:\Windows\System\QpfvSNl.exe
  C:\Windows\System\QpfvSNl.exe
  2⤵
  PID:7664
- C:\Windows\System\mSudbcr.exe
  C:\Windows\System\mSudbcr.exe
  2⤵
  PID:7688
- C:\Windows\System\erYXTqD.exe
  C:\Windows\System\erYXTqD.exe
  2⤵
  PID:7708
- C:\Windows\System\PmQJwvI.exe
  C:\Windows\System\PmQJwvI.exe
  2⤵
  PID:7724
- C:\Windows\System\KcaaqUu.exe
  C:\Windows\System\KcaaqUu.exe
  2⤵
  PID:7764
- C:\Windows\System\zmeTmRj.exe
  C:\Windows\System\zmeTmRj.exe
  2⤵
  PID:7788
- C:\Windows\System\XxXsfKa.exe
  C:\Windows\System\XxXsfKa.exe
  2⤵
  PID:7812
- C:\Windows\System\cIqzeTW.exe
  C:\Windows\System\cIqzeTW.exe
  2⤵
  PID:7836
- C:\Windows\System\EGgOzWd.exe
  C:\Windows\System\EGgOzWd.exe
  2⤵
  PID:7856
- C:\Windows\System\AcgOFIE.exe
  C:\Windows\System\AcgOFIE.exe
  2⤵
  PID:7880
- C:\Windows\System\wkFWAEY.exe
  C:\Windows\System\wkFWAEY.exe
  2⤵
  PID:7900
- C:\Windows\System\SKCihmm.exe
  C:\Windows\System\SKCihmm.exe
  2⤵
  PID:7920
- C:\Windows\System\BovQynv.exe
  C:\Windows\System\BovQynv.exe
  2⤵
  PID:7948
- C:\Windows\System\gAaLDhD.exe
  C:\Windows\System\gAaLDhD.exe
  2⤵
  PID:7972
- C:\Windows\System\iXwKheH.exe
  C:\Windows\System\iXwKheH.exe
  2⤵
  PID:7992
- C:\Windows\System\oOJsXrX.exe
  C:\Windows\System\oOJsXrX.exe
  2⤵
  PID:8028
- C:\Windows\System\soyEVvR.exe
  C:\Windows\System\soyEVvR.exe
  2⤵
  PID:8044
- C:\Windows\System\snwfATZ.exe
  C:\Windows\System\snwfATZ.exe
  2⤵
  PID:8076
- C:\Windows\System\OKJgvVt.exe
  C:\Windows\System\OKJgvVt.exe
  2⤵
  PID:8096
- C:\Windows\System\iiljqzP.exe
  C:\Windows\System\iiljqzP.exe
  2⤵
  PID:8116
- C:\Windows\System\bAOkbLN.exe
  C:\Windows\System\bAOkbLN.exe
  2⤵
  PID:8140
- C:\Windows\System\gaRRaJW.exe
  C:\Windows\System\gaRRaJW.exe
  2⤵
  PID:8160
- C:\Windows\System\jamuBvg.exe
  C:\Windows\System\jamuBvg.exe
  2⤵
  PID:8188
- C:\Windows\System\GtsTaVg.exe
  C:\Windows\System\GtsTaVg.exe
  2⤵
  PID:6744
- C:\Windows\System\vPeMYXo.exe
  C:\Windows\System\vPeMYXo.exe
  2⤵
  PID:1344
- C:\Windows\System\BEyGYwh.exe
  C:\Windows\System\BEyGYwh.exe
  2⤵
  PID:7172
- C:\Windows\System\DaCqFZY.exe
  C:\Windows\System\DaCqFZY.exe
  2⤵
  PID:6288
- C:\Windows\System\cBkbVGX.exe
  C:\Windows\System\cBkbVGX.exe
  2⤵
  PID:3140
- C:\Windows\System\bbMkEWq.exe
  C:\Windows\System\bbMkEWq.exe
  2⤵
  PID:6168
- C:\Windows\System\TcdkTGH.exe
  C:\Windows\System\TcdkTGH.exe
  2⤵
  PID:1692
- C:\Windows\System\LqqERcu.exe
  C:\Windows\System\LqqERcu.exe
  2⤵
  PID:6720
- C:\Windows\System\vbwqoPw.exe
  C:\Windows\System\vbwqoPw.exe
  2⤵
  PID:7192
- C:\Windows\System\rhklXnj.exe
  C:\Windows\System\rhklXnj.exe
  2⤵
  PID:7484
- C:\Windows\System\dshjhIJ.exe
  C:\Windows\System\dshjhIJ.exe
  2⤵
  PID:7608
- C:\Windows\System\cDuupRU.exe
  C:\Windows\System\cDuupRU.exe
  2⤵
  PID:7696
- C:\Windows\System\Ajhomgl.exe
  C:\Windows\System\Ajhomgl.exe
  2⤵
  PID:7720
- C:\Windows\System\KzWketZ.exe
  C:\Windows\System\KzWketZ.exe
  2⤵
  PID:7784
- C:\Windows\System\vgEtigB.exe
  C:\Windows\System\vgEtigB.exe
  2⤵
  PID:7508
- C:\Windows\System\nSgRePh.exe
  C:\Windows\System\nSgRePh.exe
  2⤵
  PID:7560
- C:\Windows\System\wTgCKGG.exe
  C:\Windows\System\wTgCKGG.exe
  2⤵
  PID:7604
- C:\Windows\System\QjLBmER.exe
  C:\Windows\System\QjLBmER.exe
  2⤵
  PID:8036
- C:\Windows\System\sQAvZrD.exe
  C:\Windows\System\sQAvZrD.exe
  2⤵
  PID:8168
- C:\Windows\System\pWzMjOm.exe
  C:\Windows\System\pWzMjOm.exe
  2⤵
  PID:8180
- C:\Windows\System\iwGfXaU.exe
  C:\Windows\System\iwGfXaU.exe
  2⤵
  PID:7852
- C:\Windows\System\lRJLQmM.exe
  C:\Windows\System\lRJLQmM.exe
  2⤵
  PID:1004
- C:\Windows\System\KoevjAR.exe
  C:\Windows\System\KoevjAR.exe
  2⤵
  PID:8208
- C:\Windows\System\HUcZCFG.exe
  C:\Windows\System\HUcZCFG.exe
  2⤵
  PID:8232
- C:\Windows\System\lApbDJC.exe
  C:\Windows\System\lApbDJC.exe
  2⤵
  PID:8260
- C:\Windows\System\kMTzxaZ.exe
  C:\Windows\System\kMTzxaZ.exe
  2⤵
  PID:8280
- C:\Windows\System\EIHPUyD.exe
  C:\Windows\System\EIHPUyD.exe
  2⤵
  PID:8300
- C:\Windows\System\dOwXLpP.exe
  C:\Windows\System\dOwXLpP.exe
  2⤵
  PID:8324
- C:\Windows\System\lptgfrP.exe
  C:\Windows\System\lptgfrP.exe
  2⤵
  PID:8348
- C:\Windows\System\fipVcje.exe
  C:\Windows\System\fipVcje.exe
  2⤵
  PID:8376
- C:\Windows\System\EjAtELB.exe
  C:\Windows\System\EjAtELB.exe
  2⤵
  PID:8408
- C:\Windows\System\cDBsmwk.exe
  C:\Windows\System\cDBsmwk.exe
  2⤵
  PID:8428
- C:\Windows\System\prxpqzG.exe
  C:\Windows\System\prxpqzG.exe
  2⤵
  PID:8456
- C:\Windows\System\BCdTOUP.exe
  C:\Windows\System\BCdTOUP.exe
  2⤵
  PID:8476
- C:\Windows\System\HRYLfoV.exe
  C:\Windows\System\HRYLfoV.exe
  2⤵
  PID:8496
- C:\Windows\System\BzBOWSN.exe
  C:\Windows\System\BzBOWSN.exe
  2⤵
  PID:8520
- C:\Windows\System\lsUiSXE.exe
  C:\Windows\System\lsUiSXE.exe
  2⤵
  PID:8540
- C:\Windows\System\wwnmGUk.exe
  C:\Windows\System\wwnmGUk.exe
  2⤵
  PID:8568
- C:\Windows\System\jHltypV.exe
  C:\Windows\System\jHltypV.exe
  2⤵
  PID:8592
- C:\Windows\System\RixDIVw.exe
  C:\Windows\System\RixDIVw.exe
  2⤵
  PID:8616
- C:\Windows\System\dUBrWPi.exe
  C:\Windows\System\dUBrWPi.exe
  2⤵
  PID:8636
- C:\Windows\System\equfGwq.exe
  C:\Windows\System\equfGwq.exe
  2⤵
  PID:8660
- C:\Windows\System\vYCeDGP.exe
  C:\Windows\System\vYCeDGP.exe
  2⤵
  PID:8680
- C:\Windows\System\HsysidR.exe
  C:\Windows\System\HsysidR.exe
  2⤵
  PID:8700
- C:\Windows\System\XoIspmn.exe
  C:\Windows\System\XoIspmn.exe
  2⤵
  PID:8724
- C:\Windows\System\WxUpwRS.exe
  C:\Windows\System\WxUpwRS.exe
  2⤵
  PID:8744
- C:\Windows\System\oBLKXGL.exe
  C:\Windows\System\oBLKXGL.exe
  2⤵
  PID:8768
- C:\Windows\System\fdlQXeu.exe
  C:\Windows\System\fdlQXeu.exe
  2⤵
  PID:8788
- C:\Windows\System\xPLOxCV.exe
  C:\Windows\System\xPLOxCV.exe
  2⤵
  PID:8816
- C:\Windows\System\BliZXEp.exe
  C:\Windows\System\BliZXEp.exe
  2⤵
  PID:8836
- C:\Windows\System\ncAGIsg.exe
  C:\Windows\System\ncAGIsg.exe
  2⤵
  PID:8868
- C:\Windows\System\fVqAtku.exe
  C:\Windows\System\fVqAtku.exe
  2⤵
  PID:8892
- C:\Windows\System\zyzPyTu.exe
  C:\Windows\System\zyzPyTu.exe
  2⤵
  PID:8912
- C:\Windows\System\durBJcj.exe
  C:\Windows\System\durBJcj.exe
  2⤵
  PID:8936
- C:\Windows\System\CkQizfk.exe
  C:\Windows\System\CkQizfk.exe
  2⤵
  PID:8960
- C:\Windows\System\mhWPzMh.exe
  C:\Windows\System\mhWPzMh.exe
  2⤵
  PID:8980
- C:\Windows\System\nPKaOrO.exe
  C:\Windows\System\nPKaOrO.exe
  2⤵
  PID:9004
- C:\Windows\System\bPiJMlZ.exe
  C:\Windows\System\bPiJMlZ.exe
  2⤵
  PID:9028
- C:\Windows\System\stjKOVc.exe
  C:\Windows\System\stjKOVc.exe
  2⤵
  PID:9056
- C:\Windows\System\kavMMpG.exe
  C:\Windows\System\kavMMpG.exe
  2⤵
  PID:9084
- C:\Windows\System\XEyZTGT.exe
  C:\Windows\System\XEyZTGT.exe
  2⤵
  PID:9104
- C:\Windows\System\cNQOQgT.exe
  C:\Windows\System\cNQOQgT.exe
  2⤵
  PID:9128
- C:\Windows\System\DlAcUjD.exe
  C:\Windows\System\DlAcUjD.exe
  2⤵
  PID:9152
- C:\Windows\System\KPfpWEZ.exe
  C:\Windows\System\KPfpWEZ.exe
  2⤵
  PID:9180
- C:\Windows\System\rwVhsgW.exe
  C:\Windows\System\rwVhsgW.exe
  2⤵
  PID:9204
- C:\Windows\System\itqJptk.exe
  C:\Windows\System\itqJptk.exe
  2⤵
  PID:7956
- C:\Windows\System\BovBiUc.exe
  C:\Windows\System\BovBiUc.exe
  2⤵
  PID:7624
- C:\Windows\System\hSDrkkT.exe
  C:\Windows\System\hSDrkkT.exe
  2⤵
  PID:7480
- C:\Windows\System\CcDZsqX.exe
  C:\Windows\System\CcDZsqX.exe
  2⤵
  PID:8084
- C:\Windows\System\AmgJHBC.exe
  C:\Windows\System\AmgJHBC.exe
  2⤵
  PID:8556
- C:\Windows\System\AIjYNaq.exe
  C:\Windows\System\AIjYNaq.exe
  2⤵
  PID:8608
- C:\Windows\System\YQqzGud.exe
  C:\Windows\System\YQqzGud.exe
  2⤵
  PID:7828
- C:\Windows\System\pHchkuV.exe
  C:\Windows\System\pHchkuV.exe
  2⤵
  PID:8204
- C:\Windows\System\cgrebOM.exe
  C:\Windows\System\cgrebOM.exe
  2⤵
  PID:8240
- C:\Windows\System\GipnWjv.exe
  C:\Windows\System\GipnWjv.exe
  2⤵
  PID:3708
- C:\Windows\System\cOarGfC.exe
  C:\Windows\System\cOarGfC.exe
  2⤵
  PID:8424
- C:\Windows\System\MCeLZVz.exe
  C:\Windows\System\MCeLZVz.exe
  2⤵
  PID:8488
- C:\Windows\System\BeKDrEw.exe
  C:\Windows\System\BeKDrEw.exe
  2⤵
  PID:7416
- C:\Windows\System\HlkCkFW.exe
  C:\Windows\System\HlkCkFW.exe
  2⤵
  PID:7256
- C:\Windows\System\HOaTDDR.exe
  C:\Windows\System\HOaTDDR.exe
  2⤵
  PID:8740
- C:\Windows\System\LgrVsjl.exe
  C:\Windows\System\LgrVsjl.exe
  2⤵
  PID:8796
- C:\Windows\System\KTnXMLH.exe
  C:\Windows\System\KTnXMLH.exe
  2⤵
  PID:9228
- C:\Windows\System\KSLEYFb.exe
  C:\Windows\System\KSLEYFb.exe
  2⤵
  PID:9252
- C:\Windows\System\cbtktGE.exe
  C:\Windows\System\cbtktGE.exe
  2⤵
  PID:9268
- C:\Windows\System\qQXpcfh.exe
  C:\Windows\System\qQXpcfh.exe
  2⤵
  PID:9288
- C:\Windows\System\xGFtMkW.exe
  C:\Windows\System\xGFtMkW.exe
  2⤵
  PID:9308
- C:\Windows\System\JAdOsQc.exe
  C:\Windows\System\JAdOsQc.exe
  2⤵
  PID:9332
- C:\Windows\System\IPDFFsa.exe
  C:\Windows\System\IPDFFsa.exe
  2⤵
  PID:9356
- C:\Windows\System\UVXbPyO.exe
  C:\Windows\System\UVXbPyO.exe
  2⤵
  PID:9376
- C:\Windows\System\GxHeETK.exe
  C:\Windows\System\GxHeETK.exe
  2⤵
  PID:9400
- C:\Windows\System\oRHBOkj.exe
  C:\Windows\System\oRHBOkj.exe
  2⤵
  PID:9428
- C:\Windows\System\VxNbKIX.exe
  C:\Windows\System\VxNbKIX.exe
  2⤵
  PID:9448
- C:\Windows\System\rIYRiTR.exe
  C:\Windows\System\rIYRiTR.exe
  2⤵
  PID:9476
- C:\Windows\System\uQdXzzA.exe
  C:\Windows\System\uQdXzzA.exe
  2⤵
  PID:9504
- C:\Windows\System\HkoJiBT.exe
  C:\Windows\System\HkoJiBT.exe
  2⤵
  PID:9540
- C:\Windows\System\CHChHdp.exe
  C:\Windows\System\CHChHdp.exe
  2⤵
  PID:9572
- C:\Windows\System\YBRjTNY.exe
  C:\Windows\System\YBRjTNY.exe
  2⤵
  PID:9600
- C:\Windows\System\xFHLIjW.exe
  C:\Windows\System\xFHLIjW.exe
  2⤵
  PID:9628
- C:\Windows\System\MHHjIXf.exe
  C:\Windows\System\MHHjIXf.exe
  2⤵
  PID:9648
- C:\Windows\System\HvuFOiG.exe
  C:\Windows\System\HvuFOiG.exe
  2⤵
  PID:9676
- C:\Windows\System\iZtaBiY.exe
  C:\Windows\System\iZtaBiY.exe
  2⤵
  PID:9712
- C:\Windows\System\GOAxNIW.exe
  C:\Windows\System\GOAxNIW.exe
  2⤵
  PID:9740
- C:\Windows\System\OsdBGXu.exe
  C:\Windows\System\OsdBGXu.exe
  2⤵
  PID:9760
- C:\Windows\System\IcLRjxd.exe
  C:\Windows\System\IcLRjxd.exe
  2⤵
  PID:9784
- C:\Windows\System\PnOVnPl.exe
  C:\Windows\System\PnOVnPl.exe
  2⤵
  PID:9804
- C:\Windows\System\qExiOas.exe
  C:\Windows\System\qExiOas.exe
  2⤵
  PID:9832
- C:\Windows\System\YWbglyH.exe
  C:\Windows\System\YWbglyH.exe
  2⤵
  PID:9856
- C:\Windows\System\hAdFyaL.exe
  C:\Windows\System\hAdFyaL.exe
  2⤵
  PID:9880
- C:\Windows\System\MdWyepo.exe
  C:\Windows\System\MdWyepo.exe
  2⤵
  PID:9900
- C:\Windows\System\fKnrkTk.exe
  C:\Windows\System\fKnrkTk.exe
  2⤵
  PID:9924
- C:\Windows\System\fBbcNnY.exe
  C:\Windows\System\fBbcNnY.exe
  2⤵
  PID:9944
- C:\Windows\System\OsqWEGi.exe
  C:\Windows\System\OsqWEGi.exe
  2⤵
  PID:9968
- C:\Windows\System\SClFDis.exe
  C:\Windows\System\SClFDis.exe
  2⤵
  PID:9996
- C:\Windows\System\wCUrQxV.exe
  C:\Windows\System\wCUrQxV.exe
  2⤵
  PID:10020
- C:\Windows\System\XbSDFtM.exe
  C:\Windows\System\XbSDFtM.exe
  2⤵
  PID:10044
- C:\Windows\System\KOIoAlC.exe
  C:\Windows\System\KOIoAlC.exe
  2⤵
  PID:10068
- C:\Windows\System\jxQieno.exe
  C:\Windows\System\jxQieno.exe
  2⤵
  PID:10092
- C:\Windows\System\iPveuTH.exe
  C:\Windows\System\iPveuTH.exe
  2⤵
  PID:10136
- C:\Windows\System\bAtZrhB.exe
  C:\Windows\System\bAtZrhB.exe
  2⤵
  PID:10156
- C:\Windows\System\MBXLIeB.exe
  C:\Windows\System\MBXLIeB.exe
  2⤵
  PID:10176
- C:\Windows\System\GDNErNU.exe
  C:\Windows\System\GDNErNU.exe
  2⤵
  PID:10200
- C:\Windows\System\TvWCnGm.exe
  C:\Windows\System\TvWCnGm.exe
  2⤵
  PID:10228
- C:\Windows\System\MSQqZUq.exe
  C:\Windows\System\MSQqZUq.exe
  2⤵
  PID:8864
- C:\Windows\System\GrCxTKG.exe
  C:\Windows\System\GrCxTKG.exe
  2⤵
  PID:8968
- C:\Windows\System\zXuCEMT.exe
  C:\Windows\System\zXuCEMT.exe
  2⤵
  PID:9096
- C:\Windows\System\JxrIHzl.exe
  C:\Windows\System\JxrIHzl.exe
  2⤵
  PID:9144
- C:\Windows\System\xlDGnZG.exe
  C:\Windows\System\xlDGnZG.exe
  2⤵
  PID:9192
- C:\Windows\System\bSHAARy.exe
  C:\Windows\System\bSHAARy.exe
  2⤵
  PID:8668
- C:\Windows\System\QDjfkhI.exe
  C:\Windows\System\QDjfkhI.exe
  2⤵
  PID:8720
- C:\Windows\System\XiCRFaB.exe
  C:\Windows\System\XiCRFaB.exe
  2⤵
  PID:8996
- C:\Windows\System\UfhpiiG.exe
  C:\Windows\System\UfhpiiG.exe
  2⤵
  PID:7780
- C:\Windows\System\nSQEUlx.exe
  C:\Windows\System\nSQEUlx.exe
  2⤵
  PID:8844
- C:\Windows\System\yJYvQxM.exe
  C:\Windows\System\yJYvQxM.exe
  2⤵
  PID:9276
- C:\Windows\System\NAyOYdy.exe
  C:\Windows\System\NAyOYdy.exe
  2⤵
  PID:8956
- C:\Windows\System\obHAbOO.exe
  C:\Windows\System\obHAbOO.exe
  2⤵
  PID:9016
- C:\Windows\System\AfoVcnR.exe
  C:\Windows\System\AfoVcnR.exe
  2⤵
  PID:8276
- C:\Windows\System\XmqaDbh.exe
  C:\Windows\System\XmqaDbh.exe
  2⤵
  PID:9120
- C:\Windows\System\sxaSfYb.exe
  C:\Windows\System\sxaSfYb.exe
  2⤵
  PID:9548
- C:\Windows\System\XMDbJjU.exe
  C:\Windows\System\XMDbJjU.exe
  2⤵
  PID:8448
- C:\Windows\System\UoogCvT.exe
  C:\Windows\System\UoogCvT.exe
  2⤵
  PID:9620
- C:\Windows\System\jACxkBK.exe
  C:\Windows\System\jACxkBK.exe
  2⤵
  PID:9724
- C:\Windows\System\UhbSLlm.exe
  C:\Windows\System\UhbSLlm.exe
  2⤵
  PID:8508
- C:\Windows\System\psLRRFL.exe
  C:\Windows\System\psLRRFL.exe
  2⤵
  PID:8656
- C:\Windows\System\BfvrUrq.exe
  C:\Windows\System\BfvrUrq.exe
  2⤵
  PID:9916
- C:\Windows\System\OJINRWT.exe
  C:\Windows\System\OJINRWT.exe
  2⤵
  PID:9328
- C:\Windows\System\fguQWSG.exe
  C:\Windows\System\fguQWSG.exe
  2⤵
  PID:9364
- C:\Windows\System\zTMtAFm.exe
  C:\Windows\System\zTMtAFm.exe
  2⤵
  PID:9420
- C:\Windows\System\IsgeRhC.exe
  C:\Windows\System\IsgeRhC.exe
  2⤵
  PID:10120
- C:\Windows\System\ZlbOUrj.exe
  C:\Windows\System\ZlbOUrj.exe
  2⤵
  PID:10184
- C:\Windows\System\WYydHPD.exe
  C:\Windows\System\WYydHPD.exe
  2⤵
  PID:9516
- C:\Windows\System\TNIsCsQ.exe
  C:\Windows\System\TNIsCsQ.exe
  2⤵
  PID:8040
- C:\Windows\System\jMOoFIk.exe
  C:\Windows\System\jMOoFIk.exe
  2⤵
  PID:9664
- C:\Windows\System\XhikGwG.exe
  C:\Windows\System\XhikGwG.exe
  2⤵
  PID:10260
- C:\Windows\System\WBqozgg.exe
  C:\Windows\System\WBqozgg.exe
  2⤵
  PID:10284
- C:\Windows\System\wGUXzsr.exe
  C:\Windows\System\wGUXzsr.exe
  2⤵
  PID:10308
- C:\Windows\System\NTzAhwn.exe
  C:\Windows\System\NTzAhwn.exe
  2⤵
  PID:10332
- C:\Windows\System\DZyFSEI.exe
  C:\Windows\System\DZyFSEI.exe
  2⤵
  PID:10356
- C:\Windows\System\NPKdxYB.exe
  C:\Windows\System\NPKdxYB.exe
  2⤵
  PID:10380
- C:\Windows\System\fXaklLy.exe
  C:\Windows\System\fXaklLy.exe
  2⤵
  PID:10420
- C:\Windows\System\OtidxRM.exe
  C:\Windows\System\OtidxRM.exe
  2⤵
  PID:10444
- C:\Windows\System\LJmWGwt.exe
  C:\Windows\System\LJmWGwt.exe
  2⤵
  PID:10468
- C:\Windows\System\nTYvziR.exe
  C:\Windows\System\nTYvziR.exe
  2⤵
  PID:10492
- C:\Windows\System\RAoHHLR.exe
  C:\Windows\System\RAoHHLR.exe
  2⤵
  PID:10516
- C:\Windows\System\JjpMnnW.exe
  C:\Windows\System\JjpMnnW.exe
  2⤵
  PID:10536
- C:\Windows\System\WVmEAmm.exe
  C:\Windows\System\WVmEAmm.exe
  2⤵
  PID:10560
- C:\Windows\System\TISMbVX.exe
  C:\Windows\System\TISMbVX.exe
  2⤵
  PID:10580
- C:\Windows\System\bHfgOtt.exe
  C:\Windows\System\bHfgOtt.exe
  2⤵
  PID:10604
- C:\Windows\System\dMrfzpv.exe
  C:\Windows\System\dMrfzpv.exe
  2⤵
  PID:10632
- C:\Windows\System\NmMrbKe.exe
  C:\Windows\System\NmMrbKe.exe
  2⤵
  PID:10652
- C:\Windows\System\VfyLmvf.exe
  C:\Windows\System\VfyLmvf.exe
  2⤵
  PID:10672
- C:\Windows\System\RIhrJje.exe
  C:\Windows\System\RIhrJje.exe
  2⤵
  PID:10696
- C:\Windows\System\wMFDpZI.exe
  C:\Windows\System\wMFDpZI.exe
  2⤵
  PID:10720
- C:\Windows\System\UbYXLfp.exe
  C:\Windows\System\UbYXLfp.exe
  2⤵
  PID:10744
- C:\Windows\System\AiunDSm.exe
  C:\Windows\System\AiunDSm.exe
  2⤵
  PID:10764
- C:\Windows\System\pumNObj.exe
  C:\Windows\System\pumNObj.exe
  2⤵
  PID:10784
- C:\Windows\System\DoHfxKM.exe
  C:\Windows\System\DoHfxKM.exe
  2⤵
  PID:10808
- C:\Windows\System\jdcJPYJ.exe
  C:\Windows\System\jdcJPYJ.exe
  2⤵
  PID:10828
- C:\Windows\System\dpBToin.exe
  C:\Windows\System\dpBToin.exe
  2⤵
  PID:10856
- C:\Windows\System\CStspoS.exe
  C:\Windows\System\CStspoS.exe
  2⤵
  PID:10884
- C:\Windows\System\NeobBAB.exe
  C:\Windows\System\NeobBAB.exe
  2⤵
  PID:10904
- C:\Windows\System\VtMduPS.exe
  C:\Windows\System\VtMduPS.exe
  2⤵
  PID:10928
- C:\Windows\System\yIBHKcK.exe
  C:\Windows\System\yIBHKcK.exe
  2⤵
  PID:10952
- C:\Windows\System\JPhmPzw.exe
  C:\Windows\System\JPhmPzw.exe
  2⤵
  PID:10976
- C:\Windows\System\IrvNujV.exe
  C:\Windows\System\IrvNujV.exe
  2⤵
  PID:11000
- C:\Windows\System\JPoDjcW.exe
  C:\Windows\System\JPoDjcW.exe
  2⤵
  PID:11024
- C:\Windows\System\KtcRPWp.exe
  C:\Windows\System\KtcRPWp.exe
  2⤵
  PID:11052
- C:\Windows\System\saBjjZe.exe
  C:\Windows\System\saBjjZe.exe
  2⤵
  PID:11072
- C:\Windows\System\QTnWsRK.exe
  C:\Windows\System\QTnWsRK.exe
  2⤵
  PID:11100
- C:\Windows\System\sBmOimF.exe
  C:\Windows\System\sBmOimF.exe
  2⤵
  PID:11120
- C:\Windows\System\ldHOPKF.exe
  C:\Windows\System\ldHOPKF.exe
  2⤵
  PID:11144
- C:\Windows\System\ljgmtWh.exe
  C:\Windows\System\ljgmtWh.exe
  2⤵
  PID:11168
- C:\Windows\System\mbqwOeh.exe
  C:\Windows\System\mbqwOeh.exe
  2⤵
  PID:11192
- C:\Windows\System\RqDveno.exe
  C:\Windows\System\RqDveno.exe
  2⤵
  PID:11216
- C:\Windows\System\xMoQyXD.exe
  C:\Windows\System\xMoQyXD.exe
  2⤵
  PID:11236
- C:\Windows\System\MKEtUSU.exe
  C:\Windows\System\MKEtUSU.exe
  2⤵
  PID:11256
- C:\Windows\System\BRzSHID.exe
  C:\Windows\System\BRzSHID.exe
  2⤵
  PID:9696
- C:\Windows\System\NTUrvAC.exe
  C:\Windows\System\NTUrvAC.exe
  2⤵
  PID:9160
- C:\Windows\System\PWZATrd.exe
  C:\Windows\System\PWZATrd.exe
  2⤵
  PID:9752
- C:\Windows\System\GurpBCP.exe
  C:\Windows\System\GurpBCP.exe
  2⤵
  PID:9848
- C:\Windows\System\aQimatR.exe
  C:\Windows\System\aQimatR.exe
  2⤵
  PID:8812
- C:\Windows\System\atZyICM.exe
  C:\Windows\System\atZyICM.exe
  2⤵
  PID:9236
- C:\Windows\System\FPzVrRL.exe
  C:\Windows\System\FPzVrRL.exe
  2⤵
  PID:9284
- C:\Windows\System\NSOkemx.exe
  C:\Windows\System\NSOkemx.exe
  2⤵
  PID:9196
- C:\Windows\System\QuDGDEQ.exe
  C:\Windows\System\QuDGDEQ.exe
  2⤵
  PID:9616
- C:\Windows\System\ESppPta.exe
  C:\Windows\System\ESppPta.exe
  2⤵
  PID:9732
- C:\Windows\System\HTRCoLU.exe
  C:\Windows\System\HTRCoLU.exe
  2⤵
  PID:10032
- C:\Windows\System\dwyHTZC.exe
  C:\Windows\System\dwyHTZC.exe
  2⤵
  PID:9436
- C:\Windows\System\NGXpBas.exe
  C:\Windows\System\NGXpBas.exe
  2⤵
  PID:9408
- C:\Windows\System\xmmFwbk.exe
  C:\Windows\System\xmmFwbk.exe
  2⤵
  PID:8860
- C:\Windows\System\ZcAHFNr.exe
  C:\Windows\System\ZcAHFNr.exe
  2⤵
  PID:10252
- C:\Windows\System\xwZiDvA.exe
  C:\Windows\System\xwZiDvA.exe
  2⤵
  PID:9772
- C:\Windows\System\LAQoTMf.exe
  C:\Windows\System\LAQoTMf.exe
  2⤵
  PID:9812
- C:\Windows\System\KMaaQjy.exe
  C:\Windows\System\KMaaQjy.exe
  2⤵
  PID:8756
- C:\Windows\System\eModDds.exe
  C:\Windows\System\eModDds.exe
  2⤵
  PID:9100
- C:\Windows\System\mxKwIbp.exe
  C:\Windows\System\mxKwIbp.exe
  2⤵
  PID:10484
- C:\Windows\System\IiPlhzX.exe
  C:\Windows\System\IiPlhzX.exe
  2⤵
  PID:10644
- C:\Windows\System\bJeJCNc.exe
  C:\Windows\System\bJeJCNc.exe
  2⤵
  PID:9896
- C:\Windows\System\kqoMOhD.exe
  C:\Windows\System\kqoMOhD.exe
  2⤵
  PID:11276
- C:\Windows\System\ZTuSBCJ.exe
  C:\Windows\System\ZTuSBCJ.exe
  2⤵
  PID:11312
- C:\Windows\System\WBydhSi.exe
  C:\Windows\System\WBydhSi.exe
  2⤵
  PID:11332
- C:\Windows\System\eDXglfV.exe
  C:\Windows\System\eDXglfV.exe
  2⤵
  PID:11352
- C:\Windows\System\LtxEZbZ.exe
  C:\Windows\System\LtxEZbZ.exe
  2⤵
  PID:11388
- C:\Windows\System\KUrpkcS.exe
  C:\Windows\System\KUrpkcS.exe
  2⤵
  PID:11408
- C:\Windows\System\wcwDzej.exe
  C:\Windows\System\wcwDzej.exe
  2⤵
  PID:11440
- C:\Windows\System\uegFoZt.exe
  C:\Windows\System\uegFoZt.exe
  2⤵
  PID:11460
- C:\Windows\System\npkxFld.exe
  C:\Windows\System\npkxFld.exe
  2⤵
  PID:11496
- C:\Windows\System\TYhUUte.exe
  C:\Windows\System\TYhUUte.exe
  2⤵
  PID:11516
- C:\Windows\System\MikBjSU.exe
  C:\Windows\System\MikBjSU.exe
  2⤵
  PID:11536
- C:\Windows\System\LSiukRM.exe
  C:\Windows\System\LSiukRM.exe
  2⤵
  PID:11564
- C:\Windows\System\tyKhngj.exe
  C:\Windows\System\tyKhngj.exe
  2⤵
  PID:11588
- C:\Windows\System\ScMhSic.exe
  C:\Windows\System\ScMhSic.exe
  2⤵
  PID:11608
- C:\Windows\System\keezDMP.exe
  C:\Windows\System\keezDMP.exe
  2⤵
  PID:11632
- C:\Windows\System\Ahsnxpj.exe
  C:\Windows\System\Ahsnxpj.exe
  2⤵
  PID:11648
- C:\Windows\System\VNTwWdU.exe
  C:\Windows\System\VNTwWdU.exe
  2⤵
  PID:11676
- C:\Windows\System\yFVGrSQ.exe
  C:\Windows\System\yFVGrSQ.exe
  2⤵
  PID:11696
- C:\Windows\System\eEKSWJE.exe
  C:\Windows\System\eEKSWJE.exe
  2⤵
  PID:11724
- C:\Windows\System\eehugMr.exe
  C:\Windows\System\eehugMr.exe
  2⤵
  PID:11752
- C:\Windows\System\cqzDbjn.exe
  C:\Windows\System\cqzDbjn.exe
  2⤵
  PID:9560
- C:\Windows\System\clYAoTy.exe
  C:\Windows\System\clYAoTy.exe
  2⤵
  PID:10968
- C:\Windows\System\uOevSNK.exe
  C:\Windows\System\uOevSNK.exe
  2⤵
  PID:10280
- C:\Windows\System\IcENdgu.exe
  C:\Windows\System\IcENdgu.exe
  2⤵
  PID:11068
- C:\Windows\System\lxFFpXe.exe
  C:\Windows\System\lxFFpXe.exe
  2⤵
  PID:3828
- C:\Windows\System\qQEuCZQ.exe
  C:\Windows\System\qQEuCZQ.exe
  2⤵
  PID:8876
- C:\Windows\System\RqBwUxE.exe
  C:\Windows\System\RqBwUxE.exe
  2⤵
  PID:8760
- C:\Windows\System\NGeOXTu.exe
  C:\Windows\System\NGeOXTu.exe
  2⤵
  PID:10600
- C:\Windows\System\XlraLeY.exe
  C:\Windows\System\XlraLeY.exe
  2⤵
  PID:10712
- C:\Windows\System\RzBqbAI.exe
  C:\Windows\System\RzBqbAI.exe
  2⤵
  PID:10792
- C:\Windows\System\fCiGkAT.exe
  C:\Windows\System\fCiGkAT.exe
  2⤵
  PID:10688
- C:\Windows\System\sDdWkdi.exe
  C:\Windows\System\sDdWkdi.exe
  2⤵
  PID:7352
- C:\Windows\System\vJifijN.exe
  C:\Windows\System\vJifijN.exe
  2⤵
  PID:10996
- C:\Windows\System\FTAwaLa.exe
  C:\Windows\System\FTAwaLa.exe
  2⤵
  PID:11604
- C:\Windows\System\WKYjXOZ.exe
  C:\Windows\System\WKYjXOZ.exe
  2⤵
  PID:8016
- C:\Windows\System\AwYYHoU.exe
  C:\Windows\System\AwYYHoU.exe
  2⤵
  PID:10464
- C:\Windows\System\mFUZSAV.exe
  C:\Windows\System\mFUZSAV.exe
  2⤵
  PID:9368
- C:\Windows\System\fKdJEbe.exe
  C:\Windows\System\fKdJEbe.exe
  2⤵
  PID:10572
- C:\Windows\System\odQccSl.exe
  C:\Windows\System\odQccSl.exe
  2⤵
  PID:10680
- C:\Windows\System\mUfqTDH.exe
  C:\Windows\System\mUfqTDH.exe
  2⤵
  PID:10408
- C:\Windows\System\urqNuUu.exe
  C:\Windows\System\urqNuUu.exe
  2⤵
  PID:10804
- C:\Windows\System\HcwaQTI.exe
  C:\Windows\System\HcwaQTI.exe
  2⤵
  PID:11292
- C:\Windows\System\oArhcYP.exe
  C:\Windows\System\oArhcYP.exe
  2⤵
  PID:11328
- C:\Windows\System\FDgtPnd.exe
  C:\Windows\System\FDgtPnd.exe
  2⤵
  PID:11452
- C:\Windows\System\VHdbUzb.exe
  C:\Windows\System\VHdbUzb.exe
  2⤵
  PID:11760
- C:\Windows\System\GEayvJl.exe
  C:\Windows\System\GEayvJl.exe
  2⤵
  PID:11212
- C:\Windows\System\eafunOz.exe
  C:\Windows\System\eafunOz.exe
  2⤵
  PID:9892
- C:\Windows\System\gnxAnba.exe
  C:\Windows\System\gnxAnba.exe
  2⤵
  PID:10208
- C:\Windows\System\cHLjwaX.exe
  C:\Windows\System\cHLjwaX.exe
  2⤵
  PID:10532
- C:\Windows\System\mfCdFqp.exe
  C:\Windows\System\mfCdFqp.exe
  2⤵
  PID:11344
- C:\Windows\System\Fnvlzrn.exe
  C:\Windows\System\Fnvlzrn.exe
  2⤵
  PID:11404
- C:\Windows\System\DPbcuhr.exe
  C:\Windows\System\DPbcuhr.exe
  2⤵
  PID:12308
- C:\Windows\System\toAmUfI.exe
  C:\Windows\System\toAmUfI.exe
  2⤵
  PID:12336
- C:\Windows\System\oKIYtlK.exe
  C:\Windows\System\oKIYtlK.exe
  2⤵
  PID:12360
- C:\Windows\System\ruiaexD.exe
  C:\Windows\System\ruiaexD.exe
  2⤵
  PID:12380
- C:\Windows\System\IykaNmI.exe
  C:\Windows\System\IykaNmI.exe
  2⤵
  PID:12400
- C:\Windows\System\NJmBQQc.exe
  C:\Windows\System\NJmBQQc.exe
  2⤵
  PID:12424
- C:\Windows\System\qoXQveW.exe
  C:\Windows\System\qoXQveW.exe
  2⤵
  PID:12440
- C:\Windows\System\vIBXAmT.exe
  C:\Windows\System\vIBXAmT.exe
  2⤵
  PID:12456
- C:\Windows\System\ZcFQxvC.exe
  C:\Windows\System\ZcFQxvC.exe
  2⤵
  PID:12476
- C:\Windows\System\jZLqOAf.exe
  C:\Windows\System\jZLqOAf.exe
  2⤵
  PID:12492
- C:\Windows\System\ECCjeis.exe
  C:\Windows\System\ECCjeis.exe
  2⤵
  PID:12508
- C:\Windows\System\UysupiE.exe
  C:\Windows\System\UysupiE.exe
  2⤵
  PID:12524
- C:\Windows\System\yAAexWq.exe
  C:\Windows\System\yAAexWq.exe
  2⤵
  PID:12540
- C:\Windows\System\cQRMCpv.exe
  C:\Windows\System\cQRMCpv.exe
  2⤵
  PID:12560
- C:\Windows\System\NTieatW.exe
  C:\Windows\System\NTieatW.exe
  2⤵
  PID:12576
- C:\Windows\System\KnePnhp.exe
  C:\Windows\System\KnePnhp.exe
  2⤵
  PID:12592
- C:\Windows\System\efjhQXO.exe
  C:\Windows\System\efjhQXO.exe
  2⤵
  PID:12608
- C:\Windows\System\CetnPnN.exe
  C:\Windows\System\CetnPnN.exe
  2⤵
  PID:12632
- C:\Windows\System\bmDODIs.exe
  C:\Windows\System\bmDODIs.exe
  2⤵
  PID:12656
- C:\Windows\System\ZNiEmSg.exe
  C:\Windows\System\ZNiEmSg.exe
  2⤵
  PID:12676
- C:\Windows\System\tyzlnEo.exe
  C:\Windows\System\tyzlnEo.exe
  2⤵
  PID:12696
- C:\Windows\System\dmnNwjn.exe
  C:\Windows\System\dmnNwjn.exe
  2⤵
  PID:12724
- C:\Windows\System\ZZsFPty.exe
  C:\Windows\System\ZZsFPty.exe
  2⤵
  PID:12748
- C:\Windows\System\KkBiJrO.exe
  C:\Windows\System\KkBiJrO.exe
  2⤵
  PID:12772
- C:\Windows\System\zVGSfHI.exe
  C:\Windows\System\zVGSfHI.exe
  2⤵
  PID:12800
- C:\Windows\System\jnmllYv.exe
  C:\Windows\System\jnmllYv.exe
  2⤵
  PID:12820
- C:\Windows\System\zSFdujd.exe
  C:\Windows\System\zSFdujd.exe
  2⤵
  PID:12840
- C:\Windows\System\tBhSnir.exe
  C:\Windows\System\tBhSnir.exe
  2⤵
  PID:12864
- C:\Windows\System\SPAaRei.exe
  C:\Windows\System\SPAaRei.exe
  2⤵
  PID:12888
- C:\Windows\System\MfvSzOp.exe
  C:\Windows\System\MfvSzOp.exe
  2⤵
  PID:12916
- C:\Windows\System\cmtajfi.exe
  C:\Windows\System\cmtajfi.exe
  2⤵
  PID:12940
- C:\Windows\System\MHYZMHD.exe
  C:\Windows\System\MHYZMHD.exe
  2⤵
  PID:12956
- C:\Windows\System\KIoAWmv.exe
  C:\Windows\System\KIoAWmv.exe
  2⤵
  PID:12980
- C:\Windows\System\VqJfWiD.exe
  C:\Windows\System\VqJfWiD.exe
  2⤵
  PID:13004
- C:\Windows\System\GaJSqfj.exe
  C:\Windows\System\GaJSqfj.exe
  2⤵
  PID:13036
- C:\Windows\System\PRZWLcm.exe
  C:\Windows\System\PRZWLcm.exe
  2⤵
  PID:13060
- C:\Windows\System\mewHbkW.exe
  C:\Windows\System\mewHbkW.exe
  2⤵
  PID:11600
- C:\Windows\System\joFxmmd.exe
  C:\Windows\System\joFxmmd.exe
  2⤵
  PID:13136
- C:\Windows\System\EdpCBnZ.exe
  C:\Windows\System\EdpCBnZ.exe
  2⤵
  PID:13164
- C:\Windows\System\xoAwmYe.exe
  C:\Windows\System\xoAwmYe.exe
  2⤵
  PID:13192
- C:\Windows\System\kpwonIh.exe
  C:\Windows\System\kpwonIh.exe
  2⤵
  PID:12896
- C:\Windows\System\QFUHehC.exe
  C:\Windows\System\QFUHehC.exe
  2⤵
  PID:13024
- C:\Windows\System\RwSaiYb.exe
  C:\Windows\System\RwSaiYb.exe
  2⤵
  PID:13132
- C:\Windows\System\vhIHdXL.exe
  C:\Windows\System\vhIHdXL.exe
  2⤵
  PID:11160
- C:\Windows\System\lFKixVv.exe
  C:\Windows\System\lFKixVv.exe
  2⤵
  PID:11688
- C:\Windows\System\HIfwItL.exe
  C:\Windows\System\HIfwItL.exe
  2⤵
  PID:11764
- C:\Windows\System\SZOQqWE.exe
  C:\Windows\System\SZOQqWE.exe
  2⤵
  PID:12008
- C:\Windows\System\XKcCXBB.exe
  C:\Windows\System\XKcCXBB.exe
  2⤵
  PID:11872
- C:\Windows\System\AIJaqUa.exe
  C:\Windows\System\AIJaqUa.exe
  2⤵
  PID:10104
- C:\Windows\System\xBQXRVc.exe
  C:\Windows\System\xBQXRVc.exe
  2⤵
  PID:9064
- C:\Windows\System\cxImiBT.exe
  C:\Windows\System\cxImiBT.exe
  2⤵
  PID:11360
- C:\Windows\System\VtQIlPq.exe
  C:\Windows\System\VtQIlPq.exe
  2⤵
  PID:12620
- C:\Windows\System\KKEpsDe.exe
  C:\Windows\System\KKEpsDe.exe
  2⤵
  PID:12084
- C:\Windows\System\bFTXQmo.exe
  C:\Windows\System\bFTXQmo.exe
  2⤵
  PID:10820
- C:\Windows\System\XHzRoSI.exe
  C:\Windows\System\XHzRoSI.exe
  2⤵
  PID:13228
- C:\Windows\System\cKobcvV.exe
  C:\Windows\System\cKobcvV.exe
  2⤵
  PID:10776
- C:\Windows\System\XxmymPG.exe
  C:\Windows\System\XxmymPG.exe
  2⤵
  PID:12832
- C:\Windows\System\JheAcTW.exe
  C:\Windows\System\JheAcTW.exe
  2⤵
  PID:11948
- C:\Windows\System\DdvLLQz.exe
  C:\Windows\System\DdvLLQz.exe
  2⤵
  PID:9936
- C:\Windows\System\PxlrWdC.exe
  C:\Windows\System\PxlrWdC.exe
  2⤵
  PID:7216
- C:\Windows\System\GmYlESh.exe
  C:\Windows\System\GmYlESh.exe
  2⤵
  PID:13232
- C:\Windows\System\ngBgPKN.exe
  C:\Windows\System\ngBgPKN.exe
  2⤵
  PID:12948
- C:\Windows\System\OGonfVD.exe
  C:\Windows\System\OGonfVD.exe
  2⤵
  PID:12284
- C:\Windows\System\euDSiQI.exe
  C:\Windows\System\euDSiQI.exe
  2⤵
  PID:10196
- C:\Windows\System\UXqFUYP.exe
  C:\Windows\System\UXqFUYP.exe
  2⤵
  PID:11112
- C:\Windows\System\xpnWckE.exe
  C:\Windows\System\xpnWckE.exe
  2⤵
  PID:9176
- C:\Windows\System\TmvQMPo.exe
  C:\Windows\System\TmvQMPo.exe
  2⤵
  PID:10416
- C:\Windows\System\IawsnHz.exe
  C:\Windows\System\IawsnHz.exe
  2⤵
  PID:11668
- C:\Windows\System\ojxZTFC.exe
  C:\Windows\System\ojxZTFC.exe
  2⤵
  PID:13208
- C:\Windows\System\FekZxJF.exe
  C:\Windows\System\FekZxJF.exe
  2⤵
  PID:11372
- C:\Windows\System\nzCXqWN.exe
  C:\Windows\System\nzCXqWN.exe
  2⤵
  PID:12976
- C:\Windows\System\BougnwL.exe
  C:\Windows\System\BougnwL.exe
  2⤵
  PID:12436
- C:\Windows\System\ugpMWaD.exe
  C:\Windows\System\ugpMWaD.exe
  2⤵
  PID:11436
- C:\Windows\System\QqITPPC.exe
  C:\Windows\System\QqITPPC.exe
  2⤵
  PID:11572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xifpqzo1.3lg.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\DbbvUaL.exe

Filesize
2.3MB

MD5
a8b2aaf98c22c2d9bfce63ded0f1b42c

SHA1
433d916a1ea22d4f0c0a55ba4c1b6c33f127ed7b

SHA256
18d9cc14d7266a7033c0233539348ecc37647e674bf3a444c7751a1e52316c37

SHA512
f86ac51a597038118882ab214e75c4c11fd54d6655a604f742ff277616abefbd3775369cb8cf332cb4aa036600421281b6a775c8c176fc7315666d92f824acbb

Download Submit
C:\Windows\System\DypTFko.exe

Filesize
2.3MB

MD5
0d5a0cba8647576011affe6005791c10

SHA1
79da6f75f23ecba96a159bac3a76188315dd3d09

SHA256
446b079faeacbfac98337d83358db602b9932270f963ac20397c1b0694b00d50

SHA512
e75eb60a0b5bd1817fd3de2052b52ee210dacb160fb85a1e0e51dbaf81d358439afd9c3c00dfb08ad71cd65de33a907bdf5a38c8b0187d83baee6d8a53184fde

Download Submit
C:\Windows\System\FAbDkoP.exe

Filesize
2.3MB

MD5
7f32d1d298d2465666346f080be83ae7

SHA1
f2f8fa375f1fbd6a04cb33740fb62a275be5893a

SHA256
ef8518f1b82bc581e00bd9432aeb0fc4e6949dc6685db06c42fdb6fabeadf930

SHA512
bcfb7aea374c1a569279ea24a1a48a5f2147ed5d2e537875deb9fd3d4357e8c5e270d6def65442472da80dccdb90553ba8ce47fc784942ff7f7e2629f8117538

Download Submit
C:\Windows\System\FIyOqNr.exe

Filesize
2.3MB

MD5
3e1ab0c89a22504163fdd734adac2742

SHA1
9ab0305475ec2c8342cfc9b0bbf08461490d74a0

SHA256
fdfb630780b4e77e978541724033c13e5cd5bbbceaabc3659b1099a5437b3a5c

SHA512
34facd58c243fc8a9e295884418dd219edd1a1438794e1d1d5b725f79fd3a58ec55d66463979c40a632078606b52e4507c40e89203628bfdb35ed4f8029913a0

Download Submit
C:\Windows\System\HeiVDjs.exe

Filesize
2.3MB

MD5
fbfb4ec7705e4119128fea427d3ddc2b

SHA1
d241161234b6f2204c3d4e48632fba600b63dbd7

SHA256
1b0e98c03dab63fee8be34346fa1bdcb757f8c680ba2b637abe0da142e500eba

SHA512
2d799a5b4f69e10c08ccded46e15909e824c58c66156162191e17a2f3a256e74a4a862e4798a98f4e2806bf5052d939d293279cd14cde9a743e0aac002535d2d

Download Submit
C:\Windows\System\HkfFuNn.exe

Filesize
2.3MB

MD5
2fdf440c28824d0e7644727962f0ebdd

SHA1
08bd3e4237caa5f296b5711e139b943b1b38fae7

SHA256
173cba151edb5b2fd03e19ec9232b2ba0ca83f870208119b419e9e68bdb4e779

SHA512
975e811a854ed05a099c645237cefa9beefde34affb9abca84a585680aec5843602ab5e5dd78e39bcf0bf14e27056fe804e0e8cf92082aaf17951824b1a2fac0

Download Submit
C:\Windows\System\KKPTCQr.exe

Filesize
2.3MB

MD5
d3fa16a279234a0375fb07f2be2a4bce

SHA1
930a11378efc69c63ee14629ec91707e68ca4613

SHA256
a00012badd1868a5520d83f99f901bb441e0a905b6bc7695b966af5c1c113783

SHA512
d66a294e97c35f73d48d5a8a7d431c3fecc5fbdf20a71862e66b6b2bb5e4a98733d09df391432db9825955aafb175b81d10ce57bec514b7e2a0770abf3a4d96a

Download Submit
C:\Windows\System\LFYRIgh.exe

Filesize
2.3MB

MD5
8f005e3c82f3c93ae0066f0bb3b09157

SHA1
69df17a1098749ac9189c2c1e766810413473b2b

SHA256
262709815084e0f693568f805e569e54be550b98c7eaa6ae3460a20118062d0a

SHA512
93e3f0e50607458919cd2492d666990170daf01aed9609e142bae0df6ba41686cc4333b79366a40f64de0016266b0e121abee75787e536b87382bca7d796329d

Download Submit
C:\Windows\System\MKPYtNK.exe

Filesize
2.3MB

MD5
9f009a6e9d55a9e0cf332e2bc2b273c2

SHA1
d99633408b6eba2dc47f12cfa80599f70ea504bf

SHA256
f72da62edd5dd061530412856cff3fe87d8cd9a50341a13bb9002f4df71bebf0

SHA512
be2bb8e3d51b5775194ac6d0915c604f71eaa4cd95049f5f7b3218ff5a67b18b7a02045e6fd5c7453c29f5473b50e6637527095a7d7e7349d3e0b3be05469a2e

Download Submit
C:\Windows\System\MkAhUiw.exe

Filesize
2.3MB

MD5
a972a11295cf295005edf8dc4ec134bd

SHA1
57de06579e3a9a6402ed9d4e6cde0b83d101a074

SHA256
cf15651f2f1a0c13ea8302f460c390a1c3f19e547c3c6d5d3b5e4a4404603e3c

SHA512
d197562125bbe8eca752373394ad0d197b4918566afc0c5644b19c0a825ae9454556182fd04f6b59bcd5c9d7ecf35c29b428b9ed06069e02e9d22054bf15c5ca

Download Submit
C:\Windows\System\NvLXyOX.exe

Filesize
2.3MB

MD5
4dac7c314c267270f696d792111d04a0

SHA1
1e4585114b22091f47a0dbb7de3533fcefbda03b

SHA256
272eacee9015ddaa0fedda9ac9828d25f12b10da686039426c6e5f79e59131f6

SHA512
9d82c4a8f983d882e92efee160b3f855dbe79d0d0ebc2f608b0adf25dac2a8e0b58bab7548752c6c61b85c0da767dc831525ee0abac11fd4c8ecd4eb58b1760b

Download Submit
C:\Windows\System\OexyBUA.exe

Filesize
2.3MB

MD5
985f0c035deead91dff456c2227767ad

SHA1
7ec707737df8e828200d841023560c0515b3c53d

SHA256
4c7f23a2fc68dfb31f2862c22704c95152e2fdb76b319d6b30457e4b82404df2

SHA512
76b9a2b4ef7eeaaca9b35d637b1ef1fc13ac8be0499cae6fc7b79b69c6b6affea76bbfce7d9ecb122a8e742d3a22140d0a4618929641460c6b46f872233d05c9

Download Submit
C:\Windows\System\RZjCaSU.exe

Filesize
2.3MB

MD5
3f5b0a1324594b481a1a5d83a0671ee3

SHA1
3a648b769fab426a1d69ade9af1441e9725fad29

SHA256
9909e08b7e380ec8f608684f8b61bdf3fb6db776a5ba092e84b09932801cc173

SHA512
1062253ea86080fc4d751978edc1570a7802ee1d5cad3eea4aee28d61b4eb785741bbf2c7a647d3092a2034a6ec403fd8290a4aae2a988b0165e1f230be7baea

Download Submit
C:\Windows\System\RgONyYd.exe

Filesize
2.3MB

MD5
724879566a76a8f8b876e287fdbee3b9

SHA1
853e8c476dc929ba10b11f9d7f71ca02e395c86f

SHA256
c010b9e94af81a9e3f12ecc5c6e812471dc9659417a76a94daf990f0cceb23e3

SHA512
f2f81c26bc60c083e0ee730cafc3a96aeea5ae859b87087b936d0a6576b428714a470c9ef6302a70ed50b3e08fc4509c3486ce41865ba7837048322386f69076

Download Submit
C:\Windows\System\UNBYRyh.exe

Filesize
2.3MB

MD5
741b8d17d367b555cd9721c8558e052f

SHA1
2a6e1c8841837585ad261e8c84c3fb26497f7874

SHA256
fcfc6aa1d3af3c7129155629053872285bd884da8b88d1467ca6e111967c6964

SHA512
823ecbdd3f7e76e17e77b8655073e4d2486375050911c510853e66dd559f4b4d08cf2a6bab91d638bd0b0f774b7cdd08d3875018bd249797bfd6b0a104e4b942

Download Submit
C:\Windows\System\VRVizAj.exe

Filesize
2.3MB

MD5
ed367afae05d4bbc5f23e90deecf4e07

SHA1
4131823f234ac401f10c3135da4ed40390260814

SHA256
d4e60c1c1e88c1849b89bc390dabb608d4213976b9dd1f31dfa9465324e2ee20

SHA512
b46469ad4e979d181bd1c11e438db5c80052923fd5be6eb40f97198b31322cacdb79ee3a423bfee09ba52d5ccb98ba92fc0d1185118d6723583e9fd7a7ef15c2

Download Submit
C:\Windows\System\VoUwPbD.exe

Filesize
2.3MB

MD5
2302571d78ff28bd0aac6799e9097ca4

SHA1
2dc31ac1a4e929f6d812fd8ac0b51349cdaf6708

SHA256
5b0b786368364bfe2a72711369b8e820c31b395c3d04f62062e4dc06eaa03e8f

SHA512
4b8c5fdd737546575d4905fe1fc8e02acb22cf945ef1d6c73a50627ce8be476edf67e4b93524cf8b7b29ed6dc91572ec7264671868d70a14d669ce81a8682c72

Download Submit
C:\Windows\System\cWdWzCY.exe

Filesize
2.3MB

MD5
35f2dc5df2f5c6774c0f370f159eaa62

SHA1
82c62e8f35f959735a88a3a7161c4d872215d27f

SHA256
646e8b72fc82e145e65033ce51fb4d4b9777b6cfea510bb90247569f94212ca6

SHA512
8a01a294f4c782b2e92b1d22657071434ae3b699b0e02b26121e2d12ffef9bf25ec2903bbf7d8fb00e8340cf01d85ae73d971ea74bce7358d99762aa4111a4f8

Download Submit
C:\Windows\System\cvTPCVx.exe

Filesize
8B

MD5
3989110bf28e1752d8354fc44aee0a5a

SHA1
2d341ede84fcdf1393cbc1c69b98173c16076de5

SHA256
ebec1be56406b8ccda98c6ae40713b17ab0e77787c03fa110b421dcd4ed20236

SHA512
05d90fae41717bc7686b0f44550f09d1b8636af054b5f3ca56692a92791caee36e681dc16ad6673b593b02851b240971a152f999e8c1a1c5d0d92fad9fcf82a2

Download Submit
C:\Windows\System\dttgzaz.exe

Filesize
2.3MB

MD5
5948ca924185ef2260ad5f4123cde3d4

SHA1
e470d29af4c0d6dafe3fd6e0990ea25220081e5c

SHA256
c9fc8b40bea7a4e23866405042a6f4495a9053be0a42dd6fff0b894e43fe262d

SHA512
3901438468a972d8fcb9ae3530b786b8e2415c80fb973628f3316738b755e3de180ead2b089732b00341d02f8cc49269afcf042e667a7fe9862a38d6618d6fb8

Download Submit
C:\Windows\System\fPHSNBc.exe

Filesize
2.3MB

MD5
c0d3e363697c860457f2f96182c460a4

SHA1
4d377586a826a9283a4bfd91fb33acb6f4d82501

SHA256
cb492727f9dacda0c789e21dcfeea995b11abfbad5c87970b243394d4d063458

SHA512
4685f288c550d345583fc45ac7212d1bccc90be319d6639f74e327c54ebbd92c9845d5c52cb81515ee5b9cf66ef22b429b090751f6248d8db941e4baf8bc7b59

Download Submit
C:\Windows\System\ibhLPkj.exe

Filesize
2.3MB

MD5
c3e2b21bc68b2043211fb15067902d06

SHA1
8bb8d5729d3605e8b5e64b5372e8d276e7ab5ede

SHA256
930b4359cd4e8bc81f0d5463b76bc8f03869790817eaac27d2abefad7a476a7f

SHA512
96d13b61050898594bf69844669532bcbe177c168738fa977daaef980f59ed905d1d66fc5b8cfe14d7d787c26175bb81d754865bc52ca8e00e84004bc6c1a410

Download Submit
C:\Windows\System\jUqwFJE.exe

Filesize
2.3MB

MD5
905836e8efd3e364c0eb2c4791a1663c

SHA1
6c8a8faa13dac74972fc34d84a234aa27a1b7007

SHA256
9af6dd0ca27ddabf9333bebe8373ac764828ee5aae73e6016221eb7354bb2e14

SHA512
bbfff35641c2329c93709428ff4e47e941915919ccf2d6578c2601d41e55a75612fd941ce9fb9ca605f3e03615743b6b3feb5a4a3d92f6f7e747d8b31313a0b6

Download Submit
C:\Windows\System\jUxOSfj.exe

Filesize
2.3MB

MD5
b00e680abc7b2ee1290af9a2740fb6a9

SHA1
7b69300d9616f0cb11cfa8549b3f1e2dda9bbdbb

SHA256
3fa8aaf0fb39d50790b3a9fc96b8402e12174fa70866ead5ac13d4408d2b5325

SHA512
5a8c6167f446ab44c15990faed863e06f75d6cdf17b16e7fdbd5ce4f1d79810496f0fd794b3696fd25a9172f93ac48162c84fe84294ad01a8f3dd734f73da082

Download Submit
C:\Windows\System\lwMNXXp.exe

Filesize
2.3MB

MD5
4ed969918a7a1caec47a00a6a40cb431

SHA1
819629778d58526a2b935fc3a6e323651c7982e3

SHA256
5126bb15974cd310637ac7604fae25c177473b45172decc1fc21fc4fd841695d

SHA512
217880624b080f137d6cffe4c1abebd48212a535310761b645c16d865d745f877fb4361072b7d115c7819c0b1d6cf71b68e97d0d9582b66d79750780f3fbe441

Download Submit
C:\Windows\System\nlxnKer.exe

Filesize
2.3MB

MD5
fcf9d8c0c79ce42857556c9a28450801

SHA1
dbb6071725e4066e57a1d253275c9cc29960a731

SHA256
91a3bb6425bb76e6e2a802af2af9d438cac991e5357e3e0c2829919785a8e819

SHA512
49ce3403aa7335d364c6ccd5ee7d7f56e7a792ef933b4bf5ed81ac818848bee7ae747cb6c4313f39abaf67382af34a7652e808ebdf86ea962cc8d3a32fb17f55

Download Submit
C:\Windows\System\pJQnBhy.exe

Filesize
2.3MB

MD5
46f504c5806abde9a57daf42aa64ab25

SHA1
664b0fb79d5be6334e87cc42e6d38b9632d64c92

SHA256
d6c7a5d467ff7b78d6869518fd413e5c0da9195c56dc56decc2d3aba70e8c84a

SHA512
9c8f8b36a9818b4f219cc0cfc6181043258d09ec7661501c631773e9e349a9244129430cff183c80221f3814130858befd5d1dd23b583e60c2958f6dde8224b5

Download Submit
C:\Windows\System\qbmVOsr.exe

Filesize
2.3MB

MD5
c419c051c7aad7297d82cc3ebe10e630

SHA1
a43fed2ddc6ee497e5c453fa0a40edd4ad64d03e

SHA256
bc379069246b0af942c0d6701dcfcbfd7fac9febdc9f638e1d6009058e2dbc0b

SHA512
66526504e3fe4d1d64ffe5c2acf398dd629bd946663fce5375c971591f7a4e6ff85713033dfb0a12b871968c699003648c9efd1c03e0a96c23f7eaa4ce2c151d

Download Submit
C:\Windows\System\rVMgzcz.exe

Filesize
2.3MB

MD5
ada936a5964356903f029ab27c7224a5

SHA1
88565fb9940ae3e0aa847550effb968ab5adce40

SHA256
1f86c741ddc8415d10f54f2e0d50c3fbf41e05923f5ab15d3d10cd4b8d8c8f2e

SHA512
9a6c0c955bf97a1b188e8430c55b014c702ffa8db4a966e741cd3f63d6f36f966f10d31b44593d18d043c216cc8fff56cccbf84b85229f99ead351423953a556

Download Submit
C:\Windows\System\sGOTYJT.exe

Filesize
2.3MB

MD5
ab381dc6a84d976de9558a2ffaa171f4

SHA1
5b0b52e188ba9d93baa720ba6d5af617c7cccc12

SHA256
6c984ba3b013ab071b3b22e86d5e8272e4c358609122031cc24d0a59047aa051

SHA512
35ccc87fc9c3de23091a84eb19f581699369ebe0a28c8ae11670e2c021cac8a6778554b2cb64c240fa6fec53bbe71ac33bf3bd7d277bfaa4edd9d69d5158ac56

Download Submit
C:\Windows\System\tKOQFhq.exe

Filesize
2.3MB

MD5
373b4b40643f30abb7c9f734247297c2

SHA1
a58ce0fddf131e549b878ff6063d192db8556ba7

SHA256
43009305679ebed7b00300cb1d06f6b9056bf60460d113292d002bfe667cd1b5

SHA512
4e2e281acef13b2c912773b6bee80e3779b05c9344a810c0fbc34da9353a1050aa492782d50124fdebeee84ab71d4c893e7283b6d53a57310f50c134a59b7e78

Download Submit
C:\Windows\System\tVKYBVc.exe

Filesize
2.3MB

MD5
e6831e77531838cc140273e98e0a5525

SHA1
35297441a7c993c8a5d0b054184344f1e7304e7a

SHA256
fdd5ec0fc9f8f1ebc398a91023e19cd53d948aa1a99b4579eea5a6963195f881

SHA512
35c3aa4b5a54e3299b4c9fc938e23820b930e9eef726c94501db048bae8072089cdc7af54b9831c66f6e3406f45528510f2fccb01293aa4279ac94e178d6b25d

Download Submit
C:\Windows\System\tdwNCEV.exe

Filesize
2.3MB

MD5
ffff5b7098d6c7aaef19dd939040444f

SHA1
296528833251b97ce1ebcb6a9f6c5c874647117b

SHA256
579556048a6aa64717be38bae1d16139cf53a8825abef702023d2906bc6eba8a

SHA512
776f1b3c405660c3d088a3179a47e9953b8b1b5fbd821321c570ef671cc11b74c819f035df2c2eff41f3c84c77891da62a9a4fa3dfc02c14c28be2b2d6554db0

Download Submit
C:\Windows\System\vysgByJ.exe

Filesize
2.3MB

MD5
7c6ccb66584643d3f13d3fc145136d59

SHA1
a890ba99247d8d981e66e167b49f3bf4e4faf092

SHA256
405121e3e99e4917dd802ba832441df312a985e0c0d14e20c80db11bb6a2931f

SHA512
7632fa0edecef1500e175fb6fad07e2629504374cf505fa25a01b32707994c9ee6196f41d9eaf16de6b1c2585cc027bb90f299958e513036904bd0f1704202eb

Download Submit
C:\Windows\System\wcOKlVH.exe

Filesize
2.3MB

MD5
0aefb35ddbe5374c45a9a28da610b733

SHA1
c7e0550595dd32e658925606c6e6904afd1a4c41

SHA256
7bc104f65eb0435c4ec0233fb61a59a2886650f3c564c5c33c97c3fc91530ce1

SHA512
eb331ecb83a97b214a18ff8d04512af3d05e26c461a22eb08c9a624e5c117d9aebc3fe1faa5d001d8e1cee677bfc585ed7fe9fd0a3bee5352b00df5403418220

Download Submit
C:\Windows\System\xLfhomj.exe

Filesize
2.3MB

MD5
dc742605058c41b6374489025a22a43b

SHA1
b925120f35b0b02084bda63e0040386cbb8b551b

SHA256
251fbc0d3ac261b316582c6ff374720dd9df3f1cdfbc85ca9d69d7cbf4ca5caa

SHA512
8bb71cf38ab20dfb9451286e4a13a2555f13871d2fe17ddaeda8e44f3b6d6486d58af0a4645508311ed3acbe33cbac3a438f85cc174b601a710dc949b7f48401

Download Submit
C:\Windows\System\yEUdtJo.exe

Filesize
2.3MB

MD5
9eac79825c828a75ba29aa254aece93e

SHA1
44f7feb867d81e9c00c5f608d636ec12af969936

SHA256
3082453935a2050c19a2e92edbb025a0336223d5d41e19253caa15ce5fe1ef7e

SHA512
455d271bdc1946b701ab1f3d4ed0dd4c6954adefe472f44fd593a869fdf661950f9670401c6bb7e9dfe29a8cdd224e02ead8cb21a261756713dbbbbebc119344

Download Submit
C:\Windows\System\yYIcoVd.exe

Filesize
2.3MB

MD5
fa6825a70957aae645917988b6f06087

SHA1
07c66499221fe28a69609becf481acb1b2c22459

SHA256
d1438b87d7f377864bd7b48a1c66e6cc9b5f3be9cfacf03ccc7edf25686c571c

SHA512
c06f1bbdea854bf7ce589d19791a870df26308e39e49882dba7e49607cc92247199bb9a546d35de5225e3249d7395a8371df58e7dee41791492a10a6db21a4cd

Download Submit
C:\Windows\System\zAHfHVI.exe

Filesize
2.3MB

MD5
8164914a3a626af3dff64d8b522f31c8

SHA1
776cbd0f37b4c79b8ba333bb99c17637d9602272

SHA256
d0bb134b8a01d686b25dac8325e5738084069d568a1c229918c42c1ea6c46ab3

SHA512
bd02c5ebb3a2e133097614f1bdfe1ed6700b02da4a1f073b4ea099af2ac5a4f68769d65af7cf7100a52ebcdacfb6d951ba47741ac376eb6a8683c368bef507d2

Download Submit
memory/404-92-0x00007FF6FBBB0000-0x00007FF6FBFA2000-memory.dmp

Filesize
3.9MB

Download
memory/404-2923-0x00007FF6FBBB0000-0x00007FF6FBFA2000-memory.dmp

Filesize
3.9MB

Download
memory/1016-326-0x00007FF7322E0000-0x00007FF7326D2000-memory.dmp

Filesize
3.9MB

Download
memory/1016-2938-0x00007FF7322E0000-0x00007FF7326D2000-memory.dmp

Filesize
3.9MB

Download
memory/1188-328-0x00007FF7DB550000-0x00007FF7DB942000-memory.dmp

Filesize
3.9MB

Download
memory/1188-2946-0x00007FF7DB550000-0x00007FF7DB942000-memory.dmp

Filesize
3.9MB

Download
memory/1304-308-0x00007FF69A660000-0x00007FF69AA52000-memory.dmp

Filesize
3.9MB

Download
memory/1304-2933-0x00007FF69A660000-0x00007FF69AA52000-memory.dmp

Filesize
3.9MB

Download
memory/1392-0-0x00007FF6F65D0000-0x00007FF6F69C2000-memory.dmp

Filesize
3.9MB

Download
memory/1392-1-0x0000022B8B340000-0x0000022B8B350000-memory.dmp

Filesize
64KB

Download
memory/1588-223-0x00007FF7440E0000-0x00007FF7444D2000-memory.dmp

Filesize
3.9MB

Download
memory/1588-2941-0x00007FF7440E0000-0x00007FF7444D2000-memory.dmp

Filesize
3.9MB

Download
memory/1592-324-0x00007FF7641C0000-0x00007FF7645B2000-memory.dmp

Filesize
3.9MB

Download
memory/1592-2947-0x00007FF7641C0000-0x00007FF7645B2000-memory.dmp

Filesize
3.9MB

Download
memory/1596-323-0x00007FF7C5D30000-0x00007FF7C6122000-memory.dmp

Filesize
3.9MB

Download
memory/1596-2960-0x00007FF7C5D30000-0x00007FF7C6122000-memory.dmp

Filesize
3.9MB

Download
memory/1960-208-0x00007FF68B730000-0x00007FF68BB22000-memory.dmp

Filesize
3.9MB

Download
memory/1960-2927-0x00007FF68B730000-0x00007FF68BB22000-memory.dmp

Filesize
3.9MB

Download
memory/2116-2956-0x00007FF622760000-0x00007FF622B52000-memory.dmp

Filesize
3.9MB

Download
memory/2116-325-0x00007FF622760000-0x00007FF622B52000-memory.dmp

Filesize
3.9MB

Download
memory/2536-2958-0x00007FF74F8D0000-0x00007FF74FCC2000-memory.dmp

Filesize
3.9MB

Download
memory/2536-329-0x00007FF74F8D0000-0x00007FF74FCC2000-memory.dmp

Filesize
3.9MB

Download
memory/2664-270-0x00007FF72BDB0000-0x00007FF72C1A2000-memory.dmp

Filesize
3.9MB

Download
memory/2664-2968-0x00007FF72BDB0000-0x00007FF72C1A2000-memory.dmp

Filesize
3.9MB

Download
memory/2900-228-0x0000025EFFEB0000-0x0000025EFFED2000-memory.dmp

Filesize
136KB

Download
memory/2900-35-0x00007FFA6C0C0000-0x00007FFA6CB81000-memory.dmp

Filesize
10.8MB

Download
memory/2900-36-0x0000025E80460000-0x0000025E80470000-memory.dmp

Filesize
64KB

Download
memory/3016-2921-0x00007FF6FAC90000-0x00007FF6FB082000-memory.dmp

Filesize
3.9MB

Download
memory/3016-89-0x00007FF6FAC90000-0x00007FF6FB082000-memory.dmp

Filesize
3.9MB

Download
memory/3120-62-0x00007FF6D4BE0000-0x00007FF6D4FD2000-memory.dmp

Filesize
3.9MB

Download
memory/3120-2919-0x00007FF6D4BE0000-0x00007FF6D4FD2000-memory.dmp

Filesize
3.9MB

Download
memory/3212-307-0x00007FF60E8C0000-0x00007FF60ECB2000-memory.dmp

Filesize
3.9MB

Download
memory/3212-2954-0x00007FF60E8C0000-0x00007FF60ECB2000-memory.dmp

Filesize
3.9MB

Download
memory/3964-2930-0x00007FF7E3700000-0x00007FF7E3AF2000-memory.dmp

Filesize
3.9MB

Download
memory/3964-169-0x00007FF7E3700000-0x00007FF7E3AF2000-memory.dmp

Filesize
3.9MB

Download
memory/4512-271-0x00007FF762CC0000-0x00007FF7630B2000-memory.dmp

Filesize
3.9MB

Download
memory/4512-2962-0x00007FF762CC0000-0x00007FF7630B2000-memory.dmp

Filesize
3.9MB

Download
memory/4752-2932-0x00007FF6EE5D0000-0x00007FF6EE9C2000-memory.dmp

Filesize
3.9MB

Download
memory/4752-327-0x00007FF6EE5D0000-0x00007FF6EE9C2000-memory.dmp

Filesize
3.9MB

Download
memory/4860-2964-0x00007FF699D40000-0x00007FF69A132000-memory.dmp

Filesize
3.9MB

Download
memory/4860-322-0x00007FF699D40000-0x00007FF69A132000-memory.dmp

Filesize
3.9MB

Download
memory/4936-321-0x00007FF7F5EB0000-0x00007FF7F62A2000-memory.dmp

Filesize
3.9MB

Download
memory/4936-2939-0x00007FF7F5EB0000-0x00007FF7F62A2000-memory.dmp

Filesize
3.9MB

Download
memory/4992-2925-0x00007FF6DC5B0000-0x00007FF6DC9A2000-memory.dmp

Filesize
3.9MB

Download
memory/4992-128-0x00007FF6DC5B0000-0x00007FF6DC9A2000-memory.dmp

Filesize
3.9MB

Download
memory/5088-181-0x00007FF6D1AE0000-0x00007FF6D1ED2000-memory.dmp

Filesize
3.9MB

Download
memory/5088-2935-0x00007FF6D1AE0000-0x00007FF6D1ED2000-memory.dmp

Filesize
3.9MB

Download