xmrig | 53064e6596445e4d0d12841f47b7d9ca681f893af7995c7d983f047be6dd1545

Analysis

max time kernel
71s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27-04-2024 23:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
Size

1.8MB
MD5

03ddfa3f1b3586d961b4151bce40e29e
SHA1

96564ab6f69c66feee20edbf4abb61387e32526d
SHA256

53064e6596445e4d0d12841f47b7d9ca681f893af7995c7d983f047be6dd1545
SHA512

4de734f585363da5903394b1d71e2fb6dcc744dd03d79c62d574d199af3dbb1965c54ff3d391d7b22edfebd23931eff93367588d7643806f3e5e0ca4f7461124
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlfRT:NAB2

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 43 IoCs

miner

resource	yara_rule
behavioral2/memory/2236-21-0x00007FF749830000-0x00007FF749C22000-memory.dmp	xmrig
behavioral2/memory/4876-45-0x00007FF719D00000-0x00007FF71A0F2000-memory.dmp	xmrig
behavioral2/memory/1840-25-0x00007FF7C8340000-0x00007FF7C8732000-memory.dmp	xmrig
behavioral2/memory/4924-94-0x00007FF705360000-0x00007FF705752000-memory.dmp	xmrig
behavioral2/memory/3008-153-0x00007FF67A150000-0x00007FF67A542000-memory.dmp	xmrig
behavioral2/memory/2908-162-0x00007FF72EF60000-0x00007FF72F352000-memory.dmp	xmrig
behavioral2/memory/3944-146-0x00007FF7DA640000-0x00007FF7DAA32000-memory.dmp	xmrig
behavioral2/memory/3412-134-0x00007FF702040000-0x00007FF702432000-memory.dmp	xmrig
behavioral2/memory/2280-129-0x00007FF7101A0000-0x00007FF710592000-memory.dmp	xmrig
behavioral2/memory/3496-98-0x00007FF6A2100000-0x00007FF6A24F2000-memory.dmp	xmrig
behavioral2/memory/3212-77-0x00007FF7DB130000-0x00007FF7DB522000-memory.dmp	xmrig
behavioral2/memory/2380-1629-0x00007FF6F35E0000-0x00007FF6F39D2000-memory.dmp	xmrig
behavioral2/memory/1320-1650-0x00007FF70B7A0000-0x00007FF70BB92000-memory.dmp	xmrig
behavioral2/memory/1400-2054-0x00007FF61B580000-0x00007FF61B972000-memory.dmp	xmrig
behavioral2/memory/1160-2055-0x00007FF7B9850000-0x00007FF7B9C42000-memory.dmp	xmrig
behavioral2/memory/4212-2056-0x00007FF6BA550000-0x00007FF6BA942000-memory.dmp	xmrig
behavioral2/memory/4224-2057-0x00007FF732F70000-0x00007FF733362000-memory.dmp	xmrig
behavioral2/memory/1332-2071-0x00007FF70D970000-0x00007FF70DD62000-memory.dmp	xmrig
behavioral2/memory/1412-2078-0x00007FF6DBE50000-0x00007FF6DC242000-memory.dmp	xmrig
behavioral2/memory/2356-2077-0x00007FF682ED0000-0x00007FF6832C2000-memory.dmp	xmrig
behavioral2/memory/4416-2093-0x00007FF779A50000-0x00007FF779E42000-memory.dmp	xmrig
behavioral2/memory/5096-2094-0x00007FF75EE60000-0x00007FF75F252000-memory.dmp	xmrig
behavioral2/memory/1840-2096-0x00007FF7C8340000-0x00007FF7C8732000-memory.dmp	xmrig
behavioral2/memory/2236-2112-0x00007FF749830000-0x00007FF749C22000-memory.dmp	xmrig
behavioral2/memory/4876-2114-0x00007FF719D00000-0x00007FF71A0F2000-memory.dmp	xmrig
behavioral2/memory/1320-2116-0x00007FF70B7A0000-0x00007FF70BB92000-memory.dmp	xmrig
behavioral2/memory/1400-2118-0x00007FF61B580000-0x00007FF61B972000-memory.dmp	xmrig
behavioral2/memory/4212-2122-0x00007FF6BA550000-0x00007FF6BA942000-memory.dmp	xmrig
behavioral2/memory/1160-2120-0x00007FF7B9850000-0x00007FF7B9C42000-memory.dmp	xmrig
behavioral2/memory/3212-2126-0x00007FF7DB130000-0x00007FF7DB522000-memory.dmp	xmrig
behavioral2/memory/4224-2125-0x00007FF732F70000-0x00007FF733362000-memory.dmp	xmrig
behavioral2/memory/3496-2128-0x00007FF6A2100000-0x00007FF6A24F2000-memory.dmp	xmrig
behavioral2/memory/1332-2130-0x00007FF70D970000-0x00007FF70DD62000-memory.dmp	xmrig
behavioral2/memory/4924-2132-0x00007FF705360000-0x00007FF705752000-memory.dmp	xmrig
behavioral2/memory/2280-2163-0x00007FF7101A0000-0x00007FF710592000-memory.dmp	xmrig
behavioral2/memory/3412-2165-0x00007FF702040000-0x00007FF702432000-memory.dmp	xmrig
behavioral2/memory/3944-2167-0x00007FF7DA640000-0x00007FF7DAA32000-memory.dmp	xmrig
behavioral2/memory/2356-2169-0x00007FF682ED0000-0x00007FF6832C2000-memory.dmp	xmrig
behavioral2/memory/1412-2177-0x00007FF6DBE50000-0x00007FF6DC242000-memory.dmp	xmrig
behavioral2/memory/2908-2176-0x00007FF72EF60000-0x00007FF72F352000-memory.dmp	xmrig
behavioral2/memory/4416-2174-0x00007FF779A50000-0x00007FF779E42000-memory.dmp	xmrig
behavioral2/memory/3008-2172-0x00007FF67A150000-0x00007FF67A542000-memory.dmp	xmrig
behavioral2/memory/5096-2315-0x00007FF75EE60000-0x00007FF75F252000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1840	NbNLVVf.exe
2236	wyGXBWa.exe
1320	ijNKjLu.exe
4876	SuTyuiN.exe
1160	gFnKNLe.exe
1400	BbxVODy.exe
4212	tzNnHkS.exe
3212	RuaGImN.exe
4224	TAnDWFv.exe
1332	LLfmilk.exe
4924	TAlUrQN.exe
3496	PkIUeXc.exe
2280	iVlqUOt.exe
2356	bDuZtpQ.exe
3412	INNavfc.exe
3944	KcfPmPH.exe
4416	EykDaoP.exe
1412	GjrLsir.exe
3008	vAgylqg.exe
2908	FZOJrwN.exe
5096	nuBICLj.exe
4288	eEGSbjo.exe
4448	jLgeVaX.exe
3596	OWDYRVz.exe
1744	EFRkPGD.exe
3684	xcdNUJj.exe
4232	kManrOG.exe
2192	nWDepkh.exe
3756	hDuCTVb.exe
3484	ecIqqsj.exe
2872	EYToorH.exe
3416	amAuABD.exe
960	sEMUPPN.exe
2704	hLexJXa.exe
3488	SLNDvFa.exe
2944	DHyxYkL.exe
3332	FPDOpuH.exe
4644	yUrsnSg.exe
4900	KuFAHSS.exe
3700	SPovTkT.exe
1956	sCLnxkE.exe
4608	wJapjHJ.exe
2164	INSosEk.exe
2672	DZSBRzT.exe
4324	lFiYiKY.exe
436	ZglisBz.exe
4192	ZCrjyBl.exe
2664	kYDRzBU.exe
4652	JDfLzJz.exe
2696	WzppzKA.exe
428	ujQphjm.exe
1936	pPnolGr.exe
1292	tHkovJO.exe
4252	CeEQLdR.exe
5016	NmrrHHr.exe
4960	AQjhZvg.exe
4656	itARsKH.exe
1448	klTlARZ.exe
4348	pPJtZdX.exe
2208	ZWScHfr.exe
832	zlKgkTk.exe
4492	ctDGDnT.exe
1996	YRhVWfO.exe
1472	RZksOkz.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2380-0-0x00007FF6F35E0000-0x00007FF6F39D2000-memory.dmp	upx
behavioral2/files/0x000e000000023b8a-5.dat	upx
behavioral2/files/0x000a000000023b97-10.dat	upx
behavioral2/files/0x000a000000023b98-9.dat	upx
behavioral2/files/0x000a000000023b99-22.dat	upx
behavioral2/memory/2236-21-0x00007FF749830000-0x00007FF749C22000-memory.dmp	upx
behavioral2/files/0x000b000000023b9d-51.dat	upx
behavioral2/files/0x000b000000023b9c-64.dat	upx
behavioral2/memory/4212-65-0x00007FF6BA550000-0x00007FF6BA942000-memory.dmp	upx
behavioral2/files/0x000a000000023b9f-66.dat	upx
behavioral2/files/0x000a000000023b9e-56.dat	upx
behavioral2/memory/1400-54-0x00007FF61B580000-0x00007FF61B972000-memory.dmp	upx
behavioral2/memory/1160-49-0x00007FF7B9850000-0x00007FF7B9C42000-memory.dmp	upx
behavioral2/files/0x000a000000023b9b-50.dat	upx
behavioral2/files/0x000a000000023b9a-46.dat	upx
behavioral2/memory/4876-45-0x00007FF719D00000-0x00007FF71A0F2000-memory.dmp	upx
behavioral2/memory/1320-41-0x00007FF70B7A0000-0x00007FF70BB92000-memory.dmp	upx
behavioral2/memory/1840-25-0x00007FF7C8340000-0x00007FF7C8732000-memory.dmp	upx
behavioral2/memory/1332-89-0x00007FF70D970000-0x00007FF70DD62000-memory.dmp	upx
behavioral2/files/0x000b000000023b94-91.dat	upx
behavioral2/memory/4924-94-0x00007FF705360000-0x00007FF705752000-memory.dmp	upx
behavioral2/files/0x000a000000023ba4-105.dat	upx
behavioral2/memory/2356-111-0x00007FF682ED0000-0x00007FF6832C2000-memory.dmp	upx
behavioral2/memory/4416-119-0x00007FF779A50000-0x00007FF779E42000-memory.dmp	upx
behavioral2/memory/1412-128-0x00007FF6DBE50000-0x00007FF6DC242000-memory.dmp	upx
behavioral2/files/0x000a000000023baa-141.dat	upx
behavioral2/memory/3008-153-0x00007FF67A150000-0x00007FF67A542000-memory.dmp	upx
behavioral2/files/0x000a000000023bac-159.dat	upx
behavioral2/files/0x000a000000023bae-168.dat	upx
behavioral2/files/0x000a000000023bb2-187.dat	upx
behavioral2/files/0x000a000000023bb5-196.dat	upx
behavioral2/files/0x000a000000023bb3-194.dat	upx
behavioral2/files/0x000a000000023bb4-191.dat	upx
behavioral2/files/0x000a000000023bb1-182.dat	upx
behavioral2/files/0x000a000000023bb0-174.dat	upx
behavioral2/files/0x000a000000023baf-170.dat	upx
behavioral2/files/0x000a000000023bad-166.dat	upx
behavioral2/files/0x000a000000023bab-164.dat	upx
behavioral2/memory/2908-162-0x00007FF72EF60000-0x00007FF72F352000-memory.dmp	upx
behavioral2/memory/5096-157-0x00007FF75EE60000-0x00007FF75F252000-memory.dmp	upx
behavioral2/files/0x000a000000023ba9-156.dat	upx
behavioral2/files/0x000a000000023ba8-147.dat	upx
behavioral2/memory/3944-146-0x00007FF7DA640000-0x00007FF7DAA32000-memory.dmp	upx
behavioral2/memory/3412-134-0x00007FF702040000-0x00007FF702432000-memory.dmp	upx
behavioral2/memory/2280-129-0x00007FF7101A0000-0x00007FF710592000-memory.dmp	upx
behavioral2/files/0x000a000000023ba5-122.dat	upx
behavioral2/files/0x000a000000023ba7-121.dat	upx
behavioral2/files/0x000a000000023ba6-127.dat	upx
behavioral2/files/0x000a000000023ba3-110.dat	upx
behavioral2/files/0x000a000000023ba2-102.dat	upx
behavioral2/memory/3496-98-0x00007FF6A2100000-0x00007FF6A24F2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba1-79.dat	upx
behavioral2/memory/3212-77-0x00007FF7DB130000-0x00007FF7DB522000-memory.dmp	upx
behavioral2/files/0x000a000000023ba0-82.dat	upx
behavioral2/memory/4224-70-0x00007FF732F70000-0x00007FF733362000-memory.dmp	upx
behavioral2/memory/2380-1629-0x00007FF6F35E0000-0x00007FF6F39D2000-memory.dmp	upx
behavioral2/memory/1320-1650-0x00007FF70B7A0000-0x00007FF70BB92000-memory.dmp	upx
behavioral2/memory/1400-2054-0x00007FF61B580000-0x00007FF61B972000-memory.dmp	upx
behavioral2/memory/1160-2055-0x00007FF7B9850000-0x00007FF7B9C42000-memory.dmp	upx
behavioral2/memory/4212-2056-0x00007FF6BA550000-0x00007FF6BA942000-memory.dmp	upx
behavioral2/memory/4224-2057-0x00007FF732F70000-0x00007FF733362000-memory.dmp	upx
behavioral2/memory/1332-2071-0x00007FF70D970000-0x00007FF70DD62000-memory.dmp	upx
behavioral2/memory/1412-2078-0x00007FF6DBE50000-0x00007FF6DC242000-memory.dmp	upx
behavioral2/memory/2356-2077-0x00007FF682ED0000-0x00007FF6832C2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\QlMZjXJ.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\pfaCglt.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\LAJtDOS.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\KPkqesN.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\qXpPiRq.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\jlfvcGI.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\IsrwhAE.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\mkEfjhe.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\nWDepkh.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\KSwFSjW.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\jAtDPxb.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\FDDoFCL.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\pNWVbjQ.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\NUKSHDo.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\KhlHfqU.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\kcxGsPv.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\kManrOG.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\nLocZUp.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\senrbiq.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\FaRmctD.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\naSUvgz.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\IRKIcTy.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\wZEoaxk.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\UfbUnKM.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\FPDOpuH.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\ctDGDnT.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\dogGxYZ.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\KNpswyP.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\HCTqwLP.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\LnAsRmI.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\WdVZCEB.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\hwnqxAZ.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\UeiksPM.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\TxutHAC.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\iPkDiwy.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\qrYVNRf.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\dDsIrTN.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\ECVDxXJ.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\MUBIuIz.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\WvLTVLa.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\xHhWwrv.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\QqcXHPL.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\aitwVem.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\obBASCL.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\WQyGrLb.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\txaYkNw.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\gbScsYz.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\DgEVPkg.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\GOlpFUx.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\ozwiDHA.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\YMomwYo.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\ewCQeRP.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\AYSvGPp.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\dIxAfNK.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\hJBRxoj.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\dCDqsRZ.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\scvWkDS.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\tsAWUIL.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\aHqQQMO.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\FPCiEKi.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\cqJZHNk.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\EOzPBUv.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\aIneOzy.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
File created	C:\Windows\System\ZXLvYQi.exe	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4948	powershell.exe
4948	powershell.exe
4948	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
Token: SeDebugPrivilege	4948	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 4948	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	85
PID 2380 wrote to memory of 4948	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	85
PID 2380 wrote to memory of 1840	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	86
PID 2380 wrote to memory of 1840	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	86
PID 2380 wrote to memory of 2236	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	87
PID 2380 wrote to memory of 2236	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	87
PID 2380 wrote to memory of 1320	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	88
PID 2380 wrote to memory of 1320	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	88
PID 2380 wrote to memory of 4876	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	89
PID 2380 wrote to memory of 4876	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	89
PID 2380 wrote to memory of 1160	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	90
PID 2380 wrote to memory of 1160	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	90
PID 2380 wrote to memory of 1400	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	91
PID 2380 wrote to memory of 1400	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	91
PID 2380 wrote to memory of 4212	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	92
PID 2380 wrote to memory of 4212	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	92
PID 2380 wrote to memory of 3212	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	93
PID 2380 wrote to memory of 3212	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	93
PID 2380 wrote to memory of 4224	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	94
PID 2380 wrote to memory of 4224	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	94
PID 2380 wrote to memory of 1332	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	95
PID 2380 wrote to memory of 1332	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	95
PID 2380 wrote to memory of 4924	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	96
PID 2380 wrote to memory of 4924	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	96
PID 2380 wrote to memory of 3496	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	97
PID 2380 wrote to memory of 3496	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	97
PID 2380 wrote to memory of 2280	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	98
PID 2380 wrote to memory of 2280	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	98
PID 2380 wrote to memory of 2356	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	99
PID 2380 wrote to memory of 2356	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	99
PID 2380 wrote to memory of 3412	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	100
PID 2380 wrote to memory of 3412	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	100
PID 2380 wrote to memory of 3944	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	101
PID 2380 wrote to memory of 3944	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	101
PID 2380 wrote to memory of 4416	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	102
PID 2380 wrote to memory of 4416	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	102
PID 2380 wrote to memory of 1412	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	103
PID 2380 wrote to memory of 1412	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	103
PID 2380 wrote to memory of 3008	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	104
PID 2380 wrote to memory of 3008	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	104
PID 2380 wrote to memory of 2908	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	105
PID 2380 wrote to memory of 2908	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	105
PID 2380 wrote to memory of 5096	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	106
PID 2380 wrote to memory of 5096	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	106
PID 2380 wrote to memory of 4288	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	107
PID 2380 wrote to memory of 4288	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	107
PID 2380 wrote to memory of 4448	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	108
PID 2380 wrote to memory of 4448	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	108
PID 2380 wrote to memory of 4232	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	109
PID 2380 wrote to memory of 4232	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	109
PID 2380 wrote to memory of 3596	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	110
PID 2380 wrote to memory of 3596	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	110
PID 2380 wrote to memory of 1744	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	111
PID 2380 wrote to memory of 1744	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	111
PID 2380 wrote to memory of 3684	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	112
PID 2380 wrote to memory of 3684	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	112
PID 2380 wrote to memory of 2192	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	113
PID 2380 wrote to memory of 2192	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	113
PID 2380 wrote to memory of 3756	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	114
PID 2380 wrote to memory of 3756	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	114
PID 2380 wrote to memory of 3484	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	115
PID 2380 wrote to memory of 3484	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	115
PID 2380 wrote to memory of 2872	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	116
PID 2380 wrote to memory of 2872	2380	03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03ddfa3f1b3586d961b4151bce40e29e_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4948
- C:\Windows\System\NbNLVVf.exe
  C:\Windows\System\NbNLVVf.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\wyGXBWa.exe
  C:\Windows\System\wyGXBWa.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\ijNKjLu.exe
  C:\Windows\System\ijNKjLu.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\SuTyuiN.exe
  C:\Windows\System\SuTyuiN.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\gFnKNLe.exe
  C:\Windows\System\gFnKNLe.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\BbxVODy.exe
  C:\Windows\System\BbxVODy.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\tzNnHkS.exe
  C:\Windows\System\tzNnHkS.exe
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Windows\System\RuaGImN.exe
  C:\Windows\System\RuaGImN.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\TAnDWFv.exe
  C:\Windows\System\TAnDWFv.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\LLfmilk.exe
  C:\Windows\System\LLfmilk.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\TAlUrQN.exe
  C:\Windows\System\TAlUrQN.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\PkIUeXc.exe
  C:\Windows\System\PkIUeXc.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\iVlqUOt.exe
  C:\Windows\System\iVlqUOt.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\bDuZtpQ.exe
  C:\Windows\System\bDuZtpQ.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\INNavfc.exe
  C:\Windows\System\INNavfc.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\KcfPmPH.exe
  C:\Windows\System\KcfPmPH.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\EykDaoP.exe
  C:\Windows\System\EykDaoP.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\GjrLsir.exe
  C:\Windows\System\GjrLsir.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\vAgylqg.exe
  C:\Windows\System\vAgylqg.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\FZOJrwN.exe
  C:\Windows\System\FZOJrwN.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\nuBICLj.exe
  C:\Windows\System\nuBICLj.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\eEGSbjo.exe
  C:\Windows\System\eEGSbjo.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\jLgeVaX.exe
  C:\Windows\System\jLgeVaX.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\kManrOG.exe
  C:\Windows\System\kManrOG.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\OWDYRVz.exe
  C:\Windows\System\OWDYRVz.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\EFRkPGD.exe
  C:\Windows\System\EFRkPGD.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\xcdNUJj.exe
  C:\Windows\System\xcdNUJj.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\nWDepkh.exe
  C:\Windows\System\nWDepkh.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\hDuCTVb.exe
  C:\Windows\System\hDuCTVb.exe
  2⤵
  - Executes dropped EXE
  PID:3756
- C:\Windows\System\ecIqqsj.exe
  C:\Windows\System\ecIqqsj.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\EYToorH.exe
  C:\Windows\System\EYToorH.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\amAuABD.exe
  C:\Windows\System\amAuABD.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\sEMUPPN.exe
  C:\Windows\System\sEMUPPN.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\hLexJXa.exe
  C:\Windows\System\hLexJXa.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\SLNDvFa.exe
  C:\Windows\System\SLNDvFa.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\DHyxYkL.exe
  C:\Windows\System\DHyxYkL.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\FPDOpuH.exe
  C:\Windows\System\FPDOpuH.exe
  2⤵
  - Executes dropped EXE
  PID:3332
- C:\Windows\System\yUrsnSg.exe
  C:\Windows\System\yUrsnSg.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\KuFAHSS.exe
  C:\Windows\System\KuFAHSS.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\SPovTkT.exe
  C:\Windows\System\SPovTkT.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System\sCLnxkE.exe
  C:\Windows\System\sCLnxkE.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\wJapjHJ.exe
  C:\Windows\System\wJapjHJ.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\INSosEk.exe
  C:\Windows\System\INSosEk.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\DZSBRzT.exe
  C:\Windows\System\DZSBRzT.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\lFiYiKY.exe
  C:\Windows\System\lFiYiKY.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\ZglisBz.exe
  C:\Windows\System\ZglisBz.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\ZCrjyBl.exe
  C:\Windows\System\ZCrjyBl.exe
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Windows\System\kYDRzBU.exe
  C:\Windows\System\kYDRzBU.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\JDfLzJz.exe
  C:\Windows\System\JDfLzJz.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\WzppzKA.exe
  C:\Windows\System\WzppzKA.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\ujQphjm.exe
  C:\Windows\System\ujQphjm.exe
  2⤵
  - Executes dropped EXE
  PID:428
- C:\Windows\System\pPnolGr.exe
  C:\Windows\System\pPnolGr.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\tHkovJO.exe
  C:\Windows\System\tHkovJO.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\CeEQLdR.exe
  C:\Windows\System\CeEQLdR.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\NmrrHHr.exe
  C:\Windows\System\NmrrHHr.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\AQjhZvg.exe
  C:\Windows\System\AQjhZvg.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\itARsKH.exe
  C:\Windows\System\itARsKH.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\klTlARZ.exe
  C:\Windows\System\klTlARZ.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\pPJtZdX.exe
  C:\Windows\System\pPJtZdX.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\ZWScHfr.exe
  C:\Windows\System\ZWScHfr.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\zlKgkTk.exe
  C:\Windows\System\zlKgkTk.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\ctDGDnT.exe
  C:\Windows\System\ctDGDnT.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\YRhVWfO.exe
  C:\Windows\System\YRhVWfO.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\RZksOkz.exe
  C:\Windows\System\RZksOkz.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\kPpcscp.exe
  C:\Windows\System\kPpcscp.exe
  2⤵
  PID:4940
- C:\Windows\System\MLrYZqU.exe
  C:\Windows\System\MLrYZqU.exe
  2⤵
  PID:4268
- C:\Windows\System\FxrOfRJ.exe
  C:\Windows\System\FxrOfRJ.exe
  2⤵
  PID:3816
- C:\Windows\System\iAXvIuL.exe
  C:\Windows\System\iAXvIuL.exe
  2⤵
  PID:5060
- C:\Windows\System\pkDTQKt.exe
  C:\Windows\System\pkDTQKt.exe
  2⤵
  PID:2088
- C:\Windows\System\SrixDEk.exe
  C:\Windows\System\SrixDEk.exe
  2⤵
  PID:3992
- C:\Windows\System\RBpHhba.exe
  C:\Windows\System\RBpHhba.exe
  2⤵
  PID:2900
- C:\Windows\System\INaAoCV.exe
  C:\Windows\System\INaAoCV.exe
  2⤵
  PID:5040
- C:\Windows\System\NdpSsEc.exe
  C:\Windows\System\NdpSsEc.exe
  2⤵
  PID:552
- C:\Windows\System\dogGxYZ.exe
  C:\Windows\System\dogGxYZ.exe
  2⤵
  PID:3140
- C:\Windows\System\eFQifIk.exe
  C:\Windows\System\eFQifIk.exe
  2⤵
  PID:2544
- C:\Windows\System\sOMfVmj.exe
  C:\Windows\System\sOMfVmj.exe
  2⤵
  PID:4064
- C:\Windows\System\HnuwTvX.exe
  C:\Windows\System\HnuwTvX.exe
  2⤵
  PID:4676
- C:\Windows\System\mTESXxd.exe
  C:\Windows\System\mTESXxd.exe
  2⤵
  PID:3644
- C:\Windows\System\bmJaeAa.exe
  C:\Windows\System\bmJaeAa.exe
  2⤵
  PID:4756
- C:\Windows\System\PNGqcBV.exe
  C:\Windows\System\PNGqcBV.exe
  2⤵
  PID:2120
- C:\Windows\System\zriEdPw.exe
  C:\Windows\System\zriEdPw.exe
  2⤵
  PID:4196
- C:\Windows\System\SYjaktN.exe
  C:\Windows\System\SYjaktN.exe
  2⤵
  PID:5128
- C:\Windows\System\vQHKzgh.exe
  C:\Windows\System\vQHKzgh.exe
  2⤵
  PID:5156
- C:\Windows\System\DrUEsqs.exe
  C:\Windows\System\DrUEsqs.exe
  2⤵
  PID:5184
- C:\Windows\System\vFHbxRF.exe
  C:\Windows\System\vFHbxRF.exe
  2⤵
  PID:5212
- C:\Windows\System\WGdqnNl.exe
  C:\Windows\System\WGdqnNl.exe
  2⤵
  PID:5240
- C:\Windows\System\KUcrgxW.exe
  C:\Windows\System\KUcrgxW.exe
  2⤵
  PID:5268
- C:\Windows\System\qLZMDFd.exe
  C:\Windows\System\qLZMDFd.exe
  2⤵
  PID:5300
- C:\Windows\System\DlNAgOZ.exe
  C:\Windows\System\DlNAgOZ.exe
  2⤵
  PID:5324
- C:\Windows\System\LwCrnlw.exe
  C:\Windows\System\LwCrnlw.exe
  2⤵
  PID:5352
- C:\Windows\System\hOlrWoq.exe
  C:\Windows\System\hOlrWoq.exe
  2⤵
  PID:5380
- C:\Windows\System\gvTdMJs.exe
  C:\Windows\System\gvTdMJs.exe
  2⤵
  PID:5404
- C:\Windows\System\apiLGVO.exe
  C:\Windows\System\apiLGVO.exe
  2⤵
  PID:5436
- C:\Windows\System\BjeANtR.exe
  C:\Windows\System\BjeANtR.exe
  2⤵
  PID:5464
- C:\Windows\System\nTdQjrM.exe
  C:\Windows\System\nTdQjrM.exe
  2⤵
  PID:5492
- C:\Windows\System\aytKGso.exe
  C:\Windows\System\aytKGso.exe
  2⤵
  PID:5520
- C:\Windows\System\HyTAcQb.exe
  C:\Windows\System\HyTAcQb.exe
  2⤵
  PID:5548
- C:\Windows\System\aLjkEbR.exe
  C:\Windows\System\aLjkEbR.exe
  2⤵
  PID:5580
- C:\Windows\System\enjKCWb.exe
  C:\Windows\System\enjKCWb.exe
  2⤵
  PID:5604
- C:\Windows\System\UeiksPM.exe
  C:\Windows\System\UeiksPM.exe
  2⤵
  PID:5632
- C:\Windows\System\PTJVtnN.exe
  C:\Windows\System\PTJVtnN.exe
  2⤵
  PID:5660
- C:\Windows\System\AWfKJJW.exe
  C:\Windows\System\AWfKJJW.exe
  2⤵
  PID:5688
- C:\Windows\System\tQesBZr.exe
  C:\Windows\System\tQesBZr.exe
  2⤵
  PID:5716
- C:\Windows\System\XRDMeUY.exe
  C:\Windows\System\XRDMeUY.exe
  2⤵
  PID:5744
- C:\Windows\System\kJqubMc.exe
  C:\Windows\System\kJqubMc.exe
  2⤵
  PID:5772
- C:\Windows\System\SbGVXIs.exe
  C:\Windows\System\SbGVXIs.exe
  2⤵
  PID:5800
- C:\Windows\System\KLMEdRa.exe
  C:\Windows\System\KLMEdRa.exe
  2⤵
  PID:5828
- C:\Windows\System\Crrvbrc.exe
  C:\Windows\System\Crrvbrc.exe
  2⤵
  PID:5856
- C:\Windows\System\UVLiXvU.exe
  C:\Windows\System\UVLiXvU.exe
  2⤵
  PID:5884
- C:\Windows\System\qXpPiRq.exe
  C:\Windows\System\qXpPiRq.exe
  2⤵
  PID:5948
- C:\Windows\System\aACNjcv.exe
  C:\Windows\System\aACNjcv.exe
  2⤵
  PID:5964
- C:\Windows\System\xOoFyXK.exe
  C:\Windows\System\xOoFyXK.exe
  2⤵
  PID:5980
- C:\Windows\System\leFCsPM.exe
  C:\Windows\System\leFCsPM.exe
  2⤵
  PID:6004
- C:\Windows\System\rbpzKgS.exe
  C:\Windows\System\rbpzKgS.exe
  2⤵
  PID:6032
- C:\Windows\System\EeXoeRA.exe
  C:\Windows\System\EeXoeRA.exe
  2⤵
  PID:6060
- C:\Windows\System\QlMZjXJ.exe
  C:\Windows\System\QlMZjXJ.exe
  2⤵
  PID:6080
- C:\Windows\System\pDZkKwH.exe
  C:\Windows\System\pDZkKwH.exe
  2⤵
  PID:6108
- C:\Windows\System\vJvaltG.exe
  C:\Windows\System\vJvaltG.exe
  2⤵
  PID:6136
- C:\Windows\System\nLocZUp.exe
  C:\Windows\System\nLocZUp.exe
  2⤵
  PID:1608
- C:\Windows\System\sWVMINR.exe
  C:\Windows\System\sWVMINR.exe
  2⤵
  PID:884
- C:\Windows\System\SErRuXP.exe
  C:\Windows\System\SErRuXP.exe
  2⤵
  PID:4788
- C:\Windows\System\PkGVJeV.exe
  C:\Windows\System\PkGVJeV.exe
  2⤵
  PID:5144
- C:\Windows\System\senrbiq.exe
  C:\Windows\System\senrbiq.exe
  2⤵
  PID:5224
- C:\Windows\System\NGXTWkx.exe
  C:\Windows\System\NGXTWkx.exe
  2⤵
  PID:5284
- C:\Windows\System\FymBKzk.exe
  C:\Windows\System\FymBKzk.exe
  2⤵
  PID:5336
- C:\Windows\System\ewCQeRP.exe
  C:\Windows\System\ewCQeRP.exe
  2⤵
  PID:5392
- C:\Windows\System\EtzDCSs.exe
  C:\Windows\System\EtzDCSs.exe
  2⤵
  PID:2796
- C:\Windows\System\sKTpkJm.exe
  C:\Windows\System\sKTpkJm.exe
  2⤵
  PID:5480
- C:\Windows\System\tZTerMb.exe
  C:\Windows\System\tZTerMb.exe
  2⤵
  PID:5620
- C:\Windows\System\PaNuKdU.exe
  C:\Windows\System\PaNuKdU.exe
  2⤵
  PID:5728
- C:\Windows\System\TklMgxX.exe
  C:\Windows\System\TklMgxX.exe
  2⤵
  PID:5760
- C:\Windows\System\EBjYCfx.exe
  C:\Windows\System\EBjYCfx.exe
  2⤵
  PID:2708
- C:\Windows\System\vhEyVtr.exe
  C:\Windows\System\vhEyVtr.exe
  2⤵
  PID:5840
- C:\Windows\System\QeiCfCK.exe
  C:\Windows\System\QeiCfCK.exe
  2⤵
  PID:5876
- C:\Windows\System\miUPWGq.exe
  C:\Windows\System\miUPWGq.exe
  2⤵
  PID:3724
- C:\Windows\System\umNUxug.exe
  C:\Windows\System\umNUxug.exe
  2⤵
  PID:5960
- C:\Windows\System\YwmVlwS.exe
  C:\Windows\System\YwmVlwS.exe
  2⤵
  PID:6000
- C:\Windows\System\zTSXJyE.exe
  C:\Windows\System\zTSXJyE.exe
  2⤵
  PID:6056
- C:\Windows\System\cPgiRXK.exe
  C:\Windows\System\cPgiRXK.exe
  2⤵
  PID:3696
- C:\Windows\System\qDrBfXX.exe
  C:\Windows\System\qDrBfXX.exe
  2⤵
  PID:4516
- C:\Windows\System\rCTJnEE.exe
  C:\Windows\System\rCTJnEE.exe
  2⤵
  PID:3172
- C:\Windows\System\OChztar.exe
  C:\Windows\System\OChztar.exe
  2⤵
  PID:4336
- C:\Windows\System\FOUCpJd.exe
  C:\Windows\System\FOUCpJd.exe
  2⤵
  PID:5364
- C:\Windows\System\LPiPgle.exe
  C:\Windows\System\LPiPgle.exe
  2⤵
  PID:536
- C:\Windows\System\LYnOzcd.exe
  C:\Windows\System\LYnOzcd.exe
  2⤵
  PID:5456
- C:\Windows\System\kzQXqzl.exe
  C:\Windows\System\kzQXqzl.exe
  2⤵
  PID:2464
- C:\Windows\System\TlDlnFQ.exe
  C:\Windows\System\TlDlnFQ.exe
  2⤵
  PID:4008
- C:\Windows\System\eTsvshH.exe
  C:\Windows\System\eTsvshH.exe
  2⤵
  PID:2000
- C:\Windows\System\PNSTleB.exe
  C:\Windows\System\PNSTleB.exe
  2⤵
  PID:4208
- C:\Windows\System\ALUTcrf.exe
  C:\Windows\System\ALUTcrf.exe
  2⤵
  PID:5708
- C:\Windows\System\scaJHaH.exe
  C:\Windows\System\scaJHaH.exe
  2⤵
  PID:5812
- C:\Windows\System\BQEipAT.exe
  C:\Windows\System\BQEipAT.exe
  2⤵
  PID:5928
- C:\Windows\System\zfpQOfH.exe
  C:\Windows\System\zfpQOfH.exe
  2⤵
  PID:5996
- C:\Windows\System\VrMQhvz.exe
  C:\Windows\System\VrMQhvz.exe
  2⤵
  PID:3640
- C:\Windows\System\ECVDxXJ.exe
  C:\Windows\System\ECVDxXJ.exe
  2⤵
  PID:5200
- C:\Windows\System\KymhADA.exe
  C:\Windows\System\KymhADA.exe
  2⤵
  PID:1296
- C:\Windows\System\GAGuTwW.exe
  C:\Windows\System\GAGuTwW.exe
  2⤵
  PID:4920
- C:\Windows\System\xwSiAfP.exe
  C:\Windows\System\xwSiAfP.exe
  2⤵
  PID:4892
- C:\Windows\System\EMfUdJm.exe
  C:\Windows\System\EMfUdJm.exe
  2⤵
  PID:4944
- C:\Windows\System\xnzUZWL.exe
  C:\Windows\System\xnzUZWL.exe
  2⤵
  PID:6100
- C:\Windows\System\lWtHUvd.exe
  C:\Windows\System\lWtHUvd.exe
  2⤵
  PID:3184
- C:\Windows\System\yYBGoFu.exe
  C:\Windows\System\yYBGoFu.exe
  2⤵
  PID:3300
- C:\Windows\System\qcFjGKh.exe
  C:\Windows\System\qcFjGKh.exe
  2⤵
  PID:5320
- C:\Windows\System\XAJTgOj.exe
  C:\Windows\System\XAJTgOj.exe
  2⤵
  PID:3188
- C:\Windows\System\UZDJPQj.exe
  C:\Windows\System\UZDJPQj.exe
  2⤵
  PID:6160
- C:\Windows\System\DPWUsqp.exe
  C:\Windows\System\DPWUsqp.exe
  2⤵
  PID:6188
- C:\Windows\System\xkyBWxW.exe
  C:\Windows\System\xkyBWxW.exe
  2⤵
  PID:6208
- C:\Windows\System\fUAQKYQ.exe
  C:\Windows\System\fUAQKYQ.exe
  2⤵
  PID:6228
- C:\Windows\System\CIYFwNk.exe
  C:\Windows\System\CIYFwNk.exe
  2⤵
  PID:6264
- C:\Windows\System\gbScsYz.exe
  C:\Windows\System\gbScsYz.exe
  2⤵
  PID:6324
- C:\Windows\System\cuWdsGf.exe
  C:\Windows\System\cuWdsGf.exe
  2⤵
  PID:6372
- C:\Windows\System\HXEdxYr.exe
  C:\Windows\System\HXEdxYr.exe
  2⤵
  PID:6388
- C:\Windows\System\GbxuuLX.exe
  C:\Windows\System\GbxuuLX.exe
  2⤵
  PID:6412
- C:\Windows\System\lajsoHD.exe
  C:\Windows\System\lajsoHD.exe
  2⤵
  PID:6440
- C:\Windows\System\ESJnroG.exe
  C:\Windows\System\ESJnroG.exe
  2⤵
  PID:6460
- C:\Windows\System\xAuPuRV.exe
  C:\Windows\System\xAuPuRV.exe
  2⤵
  PID:6476
- C:\Windows\System\RQRSESt.exe
  C:\Windows\System\RQRSESt.exe
  2⤵
  PID:6492
- C:\Windows\System\rdajfRU.exe
  C:\Windows\System\rdajfRU.exe
  2⤵
  PID:6512
- C:\Windows\System\OBzdBOt.exe
  C:\Windows\System\OBzdBOt.exe
  2⤵
  PID:6536
- C:\Windows\System\FXgGddV.exe
  C:\Windows\System\FXgGddV.exe
  2⤵
  PID:6556
- C:\Windows\System\pnuWLmP.exe
  C:\Windows\System\pnuWLmP.exe
  2⤵
  PID:6608
- C:\Windows\System\qQwpnyQ.exe
  C:\Windows\System\qQwpnyQ.exe
  2⤵
  PID:6632
- C:\Windows\System\EisBUVL.exe
  C:\Windows\System\EisBUVL.exe
  2⤵
  PID:6652
- C:\Windows\System\QSMOdXM.exe
  C:\Windows\System\QSMOdXM.exe
  2⤵
  PID:6704
- C:\Windows\System\VVYpZZg.exe
  C:\Windows\System\VVYpZZg.exe
  2⤵
  PID:6728
- C:\Windows\System\xJPQgdw.exe
  C:\Windows\System\xJPQgdw.exe
  2⤵
  PID:6796
- C:\Windows\System\HGaEbTr.exe
  C:\Windows\System\HGaEbTr.exe
  2⤵
  PID:6820
- C:\Windows\System\bBHKRmf.exe
  C:\Windows\System\bBHKRmf.exe
  2⤵
  PID:6840
- C:\Windows\System\ksHbNda.exe
  C:\Windows\System\ksHbNda.exe
  2⤵
  PID:6864
- C:\Windows\System\exEmtcD.exe
  C:\Windows\System\exEmtcD.exe
  2⤵
  PID:6880
- C:\Windows\System\qwcBGrW.exe
  C:\Windows\System\qwcBGrW.exe
  2⤵
  PID:6932
- C:\Windows\System\gnIkogp.exe
  C:\Windows\System\gnIkogp.exe
  2⤵
  PID:6952
- C:\Windows\System\rvMXlRN.exe
  C:\Windows\System\rvMXlRN.exe
  2⤵
  PID:6996
- C:\Windows\System\FiPLpDz.exe
  C:\Windows\System\FiPLpDz.exe
  2⤵
  PID:7016
- C:\Windows\System\wUIPXkL.exe
  C:\Windows\System\wUIPXkL.exe
  2⤵
  PID:7040
- C:\Windows\System\kUlFQZb.exe
  C:\Windows\System\kUlFQZb.exe
  2⤵
  PID:7080
- C:\Windows\System\HrdsTHk.exe
  C:\Windows\System\HrdsTHk.exe
  2⤵
  PID:7100
- C:\Windows\System\BBgijqB.exe
  C:\Windows\System\BBgijqB.exe
  2⤵
  PID:7128
- C:\Windows\System\tPdoUzL.exe
  C:\Windows\System\tPdoUzL.exe
  2⤵
  PID:7144
- C:\Windows\System\crWqoBl.exe
  C:\Windows\System\crWqoBl.exe
  2⤵
  PID:6124
- C:\Windows\System\seBkuFV.exe
  C:\Windows\System\seBkuFV.exe
  2⤵
  PID:6152
- C:\Windows\System\gKdXLcV.exe
  C:\Windows\System\gKdXLcV.exe
  2⤵
  PID:6220
- C:\Windows\System\CmdIppW.exe
  C:\Windows\System\CmdIppW.exe
  2⤵
  PID:6284
- C:\Windows\System\KPRktwT.exe
  C:\Windows\System\KPRktwT.exe
  2⤵
  PID:6316
- C:\Windows\System\rXBYgLY.exe
  C:\Windows\System\rXBYgLY.exe
  2⤵
  PID:6352
- C:\Windows\System\ccMdrNZ.exe
  C:\Windows\System\ccMdrNZ.exe
  2⤵
  PID:6488
- C:\Windows\System\YBJKHns.exe
  C:\Windows\System\YBJKHns.exe
  2⤵
  PID:6520
- C:\Windows\System\PuahRIR.exe
  C:\Windows\System\PuahRIR.exe
  2⤵
  PID:6568
- C:\Windows\System\wfDnqKC.exe
  C:\Windows\System\wfDnqKC.exe
  2⤵
  PID:6624
- C:\Windows\System\jnhyGgv.exe
  C:\Windows\System\jnhyGgv.exe
  2⤵
  PID:6668
- C:\Windows\System\mXzpwaG.exe
  C:\Windows\System\mXzpwaG.exe
  2⤵
  PID:6792
- C:\Windows\System\UjnCPeb.exe
  C:\Windows\System\UjnCPeb.exe
  2⤵
  PID:6928
- C:\Windows\System\LKFSSBh.exe
  C:\Windows\System\LKFSSBh.exe
  2⤵
  PID:6980
- C:\Windows\System\AzRrwvx.exe
  C:\Windows\System\AzRrwvx.exe
  2⤵
  PID:7004
- C:\Windows\System\DvXOlkD.exe
  C:\Windows\System\DvXOlkD.exe
  2⤵
  PID:7096
- C:\Windows\System\uifnUxY.exe
  C:\Windows\System\uifnUxY.exe
  2⤵
  PID:7124
- C:\Windows\System\oMsUgZm.exe
  C:\Windows\System\oMsUgZm.exe
  2⤵
  PID:5600
- C:\Windows\System\TMPcdAG.exe
  C:\Windows\System\TMPcdAG.exe
  2⤵
  PID:6428
- C:\Windows\System\yGSEKxh.exe
  C:\Windows\System\yGSEKxh.exe
  2⤵
  PID:6528
- C:\Windows\System\WlLIviB.exe
  C:\Windows\System\WlLIviB.exe
  2⤵
  PID:6692
- C:\Windows\System\mlTARHy.exe
  C:\Windows\System\mlTARHy.exe
  2⤵
  PID:6852
- C:\Windows\System\XBNNjDl.exe
  C:\Windows\System\XBNNjDl.exe
  2⤵
  PID:7056
- C:\Windows\System\eZTwTwU.exe
  C:\Windows\System\eZTwTwU.exe
  2⤵
  PID:7092
- C:\Windows\System\wqZkyHJ.exe
  C:\Windows\System\wqZkyHJ.exe
  2⤵
  PID:6424
- C:\Windows\System\YZRmtnA.exe
  C:\Windows\System\YZRmtnA.exe
  2⤵
  PID:6620
- C:\Windows\System\jmviePH.exe
  C:\Windows\System\jmviePH.exe
  2⤵
  PID:7120
- C:\Windows\System\FaRmctD.exe
  C:\Windows\System\FaRmctD.exe
  2⤵
  PID:6596
- C:\Windows\System\sqPeHLW.exe
  C:\Windows\System\sqPeHLW.exe
  2⤵
  PID:6748
- C:\Windows\System\VfHnBrG.exe
  C:\Windows\System\VfHnBrG.exe
  2⤵
  PID:7212
- C:\Windows\System\tfgvBko.exe
  C:\Windows\System\tfgvBko.exe
  2⤵
  PID:7236
- C:\Windows\System\CMRNzyZ.exe
  C:\Windows\System\CMRNzyZ.exe
  2⤵
  PID:7256
- C:\Windows\System\rkQNMqq.exe
  C:\Windows\System\rkQNMqq.exe
  2⤵
  PID:7272
- C:\Windows\System\amwklqJ.exe
  C:\Windows\System\amwklqJ.exe
  2⤵
  PID:7292
- C:\Windows\System\NDLNLzH.exe
  C:\Windows\System\NDLNLzH.exe
  2⤵
  PID:7312
- C:\Windows\System\KNpswyP.exe
  C:\Windows\System\KNpswyP.exe
  2⤵
  PID:7352
- C:\Windows\System\WvfkrLd.exe
  C:\Windows\System\WvfkrLd.exe
  2⤵
  PID:7384
- C:\Windows\System\AqTYOaM.exe
  C:\Windows\System\AqTYOaM.exe
  2⤵
  PID:7436
- C:\Windows\System\ODQBOWr.exe
  C:\Windows\System\ODQBOWr.exe
  2⤵
  PID:7452
- C:\Windows\System\wOptnRt.exe
  C:\Windows\System\wOptnRt.exe
  2⤵
  PID:7472
- C:\Windows\System\xMhqtyI.exe
  C:\Windows\System\xMhqtyI.exe
  2⤵
  PID:7520
- C:\Windows\System\ENEtQuL.exe
  C:\Windows\System\ENEtQuL.exe
  2⤵
  PID:7540
- C:\Windows\System\ATAxpiI.exe
  C:\Windows\System\ATAxpiI.exe
  2⤵
  PID:7564
- C:\Windows\System\LuLhdVA.exe
  C:\Windows\System\LuLhdVA.exe
  2⤵
  PID:7580
- C:\Windows\System\vFacuYB.exe
  C:\Windows\System\vFacuYB.exe
  2⤵
  PID:7608
- C:\Windows\System\xVPWWvm.exe
  C:\Windows\System\xVPWWvm.exe
  2⤵
  PID:7652
- C:\Windows\System\Tadzdpz.exe
  C:\Windows\System\Tadzdpz.exe
  2⤵
  PID:7672
- C:\Windows\System\aZSHibz.exe
  C:\Windows\System\aZSHibz.exe
  2⤵
  PID:7692
- C:\Windows\System\gWcSXVu.exe
  C:\Windows\System\gWcSXVu.exe
  2⤵
  PID:7736
- C:\Windows\System\JCMxmQh.exe
  C:\Windows\System\JCMxmQh.exe
  2⤵
  PID:7752
- C:\Windows\System\XCQsMwd.exe
  C:\Windows\System\XCQsMwd.exe
  2⤵
  PID:7768
- C:\Windows\System\BLRPBCz.exe
  C:\Windows\System\BLRPBCz.exe
  2⤵
  PID:7800
- C:\Windows\System\yDSqkiG.exe
  C:\Windows\System\yDSqkiG.exe
  2⤵
  PID:7856
- C:\Windows\System\FDAIuDS.exe
  C:\Windows\System\FDAIuDS.exe
  2⤵
  PID:7884
- C:\Windows\System\XxAlnwQ.exe
  C:\Windows\System\XxAlnwQ.exe
  2⤵
  PID:7904
- C:\Windows\System\NbsHeUk.exe
  C:\Windows\System\NbsHeUk.exe
  2⤵
  PID:7920
- C:\Windows\System\KSwFSjW.exe
  C:\Windows\System\KSwFSjW.exe
  2⤵
  PID:7940
- C:\Windows\System\DgEVPkg.exe
  C:\Windows\System\DgEVPkg.exe
  2⤵
  PID:7968
- C:\Windows\System\fCGCOhl.exe
  C:\Windows\System\fCGCOhl.exe
  2⤵
  PID:7992
- C:\Windows\System\htvNkvm.exe
  C:\Windows\System\htvNkvm.exe
  2⤵
  PID:8008
- C:\Windows\System\qvuCGEu.exe
  C:\Windows\System\qvuCGEu.exe
  2⤵
  PID:8060
- C:\Windows\System\oWSrDkn.exe
  C:\Windows\System\oWSrDkn.exe
  2⤵
  PID:8080
- C:\Windows\System\LqpnfGZ.exe
  C:\Windows\System\LqpnfGZ.exe
  2⤵
  PID:8104
- C:\Windows\System\RmpIJcc.exe
  C:\Windows\System\RmpIJcc.exe
  2⤵
  PID:8136
- C:\Windows\System\uaPrhzM.exe
  C:\Windows\System\uaPrhzM.exe
  2⤵
  PID:8164
- C:\Windows\System\bsewXgN.exe
  C:\Windows\System\bsewXgN.exe
  2⤵
  PID:8184
- C:\Windows\System\lncljsV.exe
  C:\Windows\System\lncljsV.exe
  2⤵
  PID:7192
- C:\Windows\System\HHmJCbl.exe
  C:\Windows\System\HHmJCbl.exe
  2⤵
  PID:7324
- C:\Windows\System\jaVirPM.exe
  C:\Windows\System\jaVirPM.exe
  2⤵
  PID:7392
- C:\Windows\System\nAnVUKy.exe
  C:\Windows\System\nAnVUKy.exe
  2⤵
  PID:7468
- C:\Windows\System\XZueAUt.exe
  C:\Windows\System\XZueAUt.exe
  2⤵
  PID:7508
- C:\Windows\System\xHhWwrv.exe
  C:\Windows\System\xHhWwrv.exe
  2⤵
  PID:7600
- C:\Windows\System\HCTqwLP.exe
  C:\Windows\System\HCTqwLP.exe
  2⤵
  PID:7668
- C:\Windows\System\ICdJsIB.exe
  C:\Windows\System\ICdJsIB.exe
  2⤵
  PID:7704
- C:\Windows\System\FAfQXwJ.exe
  C:\Windows\System\FAfQXwJ.exe
  2⤵
  PID:7792
- C:\Windows\System\FqTwTNS.exe
  C:\Windows\System\FqTwTNS.exe
  2⤵
  PID:7848
- C:\Windows\System\DVQaKEj.exe
  C:\Windows\System\DVQaKEj.exe
  2⤵
  PID:7872
- C:\Windows\System\ykVnhAD.exe
  C:\Windows\System\ykVnhAD.exe
  2⤵
  PID:7912
- C:\Windows\System\eDEIHAk.exe
  C:\Windows\System\eDEIHAk.exe
  2⤵
  PID:7976
- C:\Windows\System\AlvEHTd.exe
  C:\Windows\System\AlvEHTd.exe
  2⤵
  PID:8072
- C:\Windows\System\ctYuViP.exe
  C:\Windows\System\ctYuViP.exe
  2⤵
  PID:8128
- C:\Windows\System\PYlAKBm.exe
  C:\Windows\System\PYlAKBm.exe
  2⤵
  PID:6176
- C:\Windows\System\VCmlCUS.exe
  C:\Windows\System\VCmlCUS.exe
  2⤵
  PID:7280
- C:\Windows\System\wATksqd.exe
  C:\Windows\System\wATksqd.exe
  2⤵
  PID:6916
- C:\Windows\System\gDvQJGO.exe
  C:\Windows\System\gDvQJGO.exe
  2⤵
  PID:7744
- C:\Windows\System\CXlPkck.exe
  C:\Windows\System\CXlPkck.exe
  2⤵
  PID:7896
- C:\Windows\System\rFjnlcl.exe
  C:\Windows\System\rFjnlcl.exe
  2⤵
  PID:7948
- C:\Windows\System\rRmdsfX.exe
  C:\Windows\System\rRmdsfX.exe
  2⤵
  PID:8176
- C:\Windows\System\fJwjUkh.exe
  C:\Windows\System\fJwjUkh.exe
  2⤵
  PID:7308
- C:\Windows\System\dkUKQcX.exe
  C:\Windows\System\dkUKQcX.exe
  2⤵
  PID:7824
- C:\Windows\System\rezUeMp.exe
  C:\Windows\System\rezUeMp.exe
  2⤵
  PID:7984
- C:\Windows\System\QqcXHPL.exe
  C:\Windows\System\QqcXHPL.exe
  2⤵
  PID:7344
- C:\Windows\System\uqbKLpd.exe
  C:\Windows\System\uqbKLpd.exe
  2⤵
  PID:8204
- C:\Windows\System\pnPAOmx.exe
  C:\Windows\System\pnPAOmx.exe
  2⤵
  PID:8228
- C:\Windows\System\TysebfU.exe
  C:\Windows\System\TysebfU.exe
  2⤵
  PID:8248
- C:\Windows\System\pfaCglt.exe
  C:\Windows\System\pfaCglt.exe
  2⤵
  PID:8264
- C:\Windows\System\CFeAfXr.exe
  C:\Windows\System\CFeAfXr.exe
  2⤵
  PID:8304
- C:\Windows\System\vEHXFBv.exe
  C:\Windows\System\vEHXFBv.exe
  2⤵
  PID:8336
- C:\Windows\System\CQoUDBX.exe
  C:\Windows\System\CQoUDBX.exe
  2⤵
  PID:8364
- C:\Windows\System\nuReSQV.exe
  C:\Windows\System\nuReSQV.exe
  2⤵
  PID:8388
- C:\Windows\System\CdEnoKt.exe
  C:\Windows\System\CdEnoKt.exe
  2⤵
  PID:8432
- C:\Windows\System\FeOwMYn.exe
  C:\Windows\System\FeOwMYn.exe
  2⤵
  PID:8452
- C:\Windows\System\coDLPix.exe
  C:\Windows\System\coDLPix.exe
  2⤵
  PID:8468
- C:\Windows\System\eCRIePq.exe
  C:\Windows\System\eCRIePq.exe
  2⤵
  PID:8488
- C:\Windows\System\FdIYkml.exe
  C:\Windows\System\FdIYkml.exe
  2⤵
  PID:8524
- C:\Windows\System\IyGVAAm.exe
  C:\Windows\System\IyGVAAm.exe
  2⤵
  PID:8544
- C:\Windows\System\PbuiRVe.exe
  C:\Windows\System\PbuiRVe.exe
  2⤵
  PID:8572
- C:\Windows\System\oEgCPEK.exe
  C:\Windows\System\oEgCPEK.exe
  2⤵
  PID:8596
- C:\Windows\System\TxutHAC.exe
  C:\Windows\System\TxutHAC.exe
  2⤵
  PID:8620
- C:\Windows\System\MUBIuIz.exe
  C:\Windows\System\MUBIuIz.exe
  2⤵
  PID:8648
- C:\Windows\System\RDYGukO.exe
  C:\Windows\System\RDYGukO.exe
  2⤵
  PID:8672
- C:\Windows\System\JDLIkzz.exe
  C:\Windows\System\JDLIkzz.exe
  2⤵
  PID:8716
- C:\Windows\System\jAtDPxb.exe
  C:\Windows\System\jAtDPxb.exe
  2⤵
  PID:8740
- C:\Windows\System\GifFoEb.exe
  C:\Windows\System\GifFoEb.exe
  2⤵
  PID:8760
- C:\Windows\System\xFyTmqd.exe
  C:\Windows\System\xFyTmqd.exe
  2⤵
  PID:8796
- C:\Windows\System\TttQYJm.exe
  C:\Windows\System\TttQYJm.exe
  2⤵
  PID:8848
- C:\Windows\System\aIneOzy.exe
  C:\Windows\System\aIneOzy.exe
  2⤵
  PID:8876
- C:\Windows\System\DTieIJK.exe
  C:\Windows\System\DTieIJK.exe
  2⤵
  PID:8896
- C:\Windows\System\RFffZuW.exe
  C:\Windows\System\RFffZuW.exe
  2⤵
  PID:8920
- C:\Windows\System\uMuRKun.exe
  C:\Windows\System\uMuRKun.exe
  2⤵
  PID:8960
- C:\Windows\System\daCNVtS.exe
  C:\Windows\System\daCNVtS.exe
  2⤵
  PID:8980
- C:\Windows\System\UMmGtjs.exe
  C:\Windows\System\UMmGtjs.exe
  2⤵
  PID:8996
- C:\Windows\System\pAJXFdt.exe
  C:\Windows\System\pAJXFdt.exe
  2⤵
  PID:9024
- C:\Windows\System\SvopmFT.exe
  C:\Windows\System\SvopmFT.exe
  2⤵
  PID:9048
- C:\Windows\System\VBxgrFe.exe
  C:\Windows\System\VBxgrFe.exe
  2⤵
  PID:9164
- C:\Windows\System\YSsFEQB.exe
  C:\Windows\System\YSsFEQB.exe
  2⤵
  PID:8224
- C:\Windows\System\iPkDiwy.exe
  C:\Windows\System\iPkDiwy.exe
  2⤵
  PID:8344
- C:\Windows\System\nRYhRLG.exe
  C:\Windows\System\nRYhRLG.exe
  2⤵
  PID:8332
- C:\Windows\System\TqVxbwH.exe
  C:\Windows\System\TqVxbwH.exe
  2⤵
  PID:8380
- C:\Windows\System\DBbbQfR.exe
  C:\Windows\System\DBbbQfR.exe
  2⤵
  PID:8412
- C:\Windows\System\OtwtUAs.exe
  C:\Windows\System\OtwtUAs.exe
  2⤵
  PID:8460
- C:\Windows\System\YsELcbn.exe
  C:\Windows\System\YsELcbn.exe
  2⤵
  PID:8516
- C:\Windows\System\CEMpEfa.exe
  C:\Windows\System\CEMpEfa.exe
  2⤵
  PID:8664
- C:\Windows\System\HOCEBID.exe
  C:\Windows\System\HOCEBID.exe
  2⤵
  PID:8792
- C:\Windows\System\EpjrpZQ.exe
  C:\Windows\System\EpjrpZQ.exe
  2⤵
  PID:8776
- C:\Windows\System\XMwDRYY.exe
  C:\Windows\System\XMwDRYY.exe
  2⤵
  PID:8860
- C:\Windows\System\qrYVNRf.exe
  C:\Windows\System\qrYVNRf.exe
  2⤵
  PID:8912
- C:\Windows\System\pMOKtsw.exe
  C:\Windows\System\pMOKtsw.exe
  2⤵
  PID:8936
- C:\Windows\System\fLqXtHI.exe
  C:\Windows\System\fLqXtHI.exe
  2⤵
  PID:9120
- C:\Windows\System\YzdgkTJ.exe
  C:\Windows\System\YzdgkTJ.exe
  2⤵
  PID:9020
- C:\Windows\System\DrMtFio.exe
  C:\Windows\System\DrMtFio.exe
  2⤵
  PID:9132
- C:\Windows\System\SPRDiWT.exe
  C:\Windows\System\SPRDiWT.exe
  2⤵
  PID:8212
- C:\Windows\System\xhPhiaM.exe
  C:\Windows\System\xhPhiaM.exe
  2⤵
  PID:9200
- C:\Windows\System\iqZRAjz.exe
  C:\Windows\System\iqZRAjz.exe
  2⤵
  PID:9212
- C:\Windows\System\ZqkPkqd.exe
  C:\Windows\System\ZqkPkqd.exe
  2⤵
  PID:8408
- C:\Windows\System\LAJtDOS.exe
  C:\Windows\System\LAJtDOS.exe
  2⤵
  PID:8752
- C:\Windows\System\fWGtMIG.exe
  C:\Windows\System\fWGtMIG.exe
  2⤵
  PID:8788
- C:\Windows\System\aDJrIOD.exe
  C:\Windows\System\aDJrIOD.exe
  2⤵
  PID:9080
- C:\Windows\System\YwiQPfo.exe
  C:\Windows\System\YwiQPfo.exe
  2⤵
  PID:9112
- C:\Windows\System\tBzVSJQ.exe
  C:\Windows\System\tBzVSJQ.exe
  2⤵
  PID:9156
- C:\Windows\System\twnGvaU.exe
  C:\Windows\System\twnGvaU.exe
  2⤵
  PID:9188
- C:\Windows\System\QYXpqEK.exe
  C:\Windows\System\QYXpqEK.exe
  2⤵
  PID:8688
- C:\Windows\System\hWMbEHI.exe
  C:\Windows\System\hWMbEHI.exe
  2⤵
  PID:9036
- C:\Windows\System\DtOqsGX.exe
  C:\Windows\System\DtOqsGX.exe
  2⤵
  PID:9056
- C:\Windows\System\naSUvgz.exe
  C:\Windows\System\naSUvgz.exe
  2⤵
  PID:9084
- C:\Windows\System\LXNaBsO.exe
  C:\Windows\System\LXNaBsO.exe
  2⤵
  PID:9060
- C:\Windows\System\GOlpFUx.exe
  C:\Windows\System\GOlpFUx.exe
  2⤵
  PID:9248
- C:\Windows\System\ZXLvYQi.exe
  C:\Windows\System\ZXLvYQi.exe
  2⤵
  PID:9280
- C:\Windows\System\AgHgQYF.exe
  C:\Windows\System\AgHgQYF.exe
  2⤵
  PID:9300
- C:\Windows\System\qOOSgYp.exe
  C:\Windows\System\qOOSgYp.exe
  2⤵
  PID:9348
- C:\Windows\System\tsAWUIL.exe
  C:\Windows\System\tsAWUIL.exe
  2⤵
  PID:9372
- C:\Windows\System\SYZbOpy.exe
  C:\Windows\System\SYZbOpy.exe
  2⤵
  PID:9392
- C:\Windows\System\SrfpFeR.exe
  C:\Windows\System\SrfpFeR.exe
  2⤵
  PID:9440
- C:\Windows\System\UUVxlia.exe
  C:\Windows\System\UUVxlia.exe
  2⤵
  PID:9460
- C:\Windows\System\cjtxpWB.exe
  C:\Windows\System\cjtxpWB.exe
  2⤵
  PID:9496
- C:\Windows\System\zThysJW.exe
  C:\Windows\System\zThysJW.exe
  2⤵
  PID:9516
- C:\Windows\System\gAVsYXD.exe
  C:\Windows\System\gAVsYXD.exe
  2⤵
  PID:9544
- C:\Windows\System\dhjCpae.exe
  C:\Windows\System\dhjCpae.exe
  2⤵
  PID:9568
- C:\Windows\System\ULgAWax.exe
  C:\Windows\System\ULgAWax.exe
  2⤵
  PID:9588
- C:\Windows\System\iNqVjmJ.exe
  C:\Windows\System\iNqVjmJ.exe
  2⤵
  PID:9628
- C:\Windows\System\bMxZbcP.exe
  C:\Windows\System\bMxZbcP.exe
  2⤵
  PID:9656
- C:\Windows\System\xbaCSiy.exe
  C:\Windows\System\xbaCSiy.exe
  2⤵
  PID:9684
- C:\Windows\System\YoCbQaf.exe
  C:\Windows\System\YoCbQaf.exe
  2⤵
  PID:9708
- C:\Windows\System\LcEobnH.exe
  C:\Windows\System\LcEobnH.exe
  2⤵
  PID:9748
- C:\Windows\System\RztFjNG.exe
  C:\Windows\System\RztFjNG.exe
  2⤵
  PID:9772
- C:\Windows\System\yceeJzn.exe
  C:\Windows\System\yceeJzn.exe
  2⤵
  PID:9792
- C:\Windows\System\aHqQQMO.exe
  C:\Windows\System\aHqQQMO.exe
  2⤵
  PID:9832
- C:\Windows\System\lpgaRie.exe
  C:\Windows\System\lpgaRie.exe
  2⤵
  PID:9848
- C:\Windows\System\utETJLA.exe
  C:\Windows\System\utETJLA.exe
  2⤵
  PID:9868
- C:\Windows\System\FBlHNeU.exe
  C:\Windows\System\FBlHNeU.exe
  2⤵
  PID:9888
- C:\Windows\System\pFvWUQK.exe
  C:\Windows\System\pFvWUQK.exe
  2⤵
  PID:9928
- C:\Windows\System\kRITAZH.exe
  C:\Windows\System\kRITAZH.exe
  2⤵
  PID:9960
- C:\Windows\System\KXdSnEI.exe
  C:\Windows\System\KXdSnEI.exe
  2⤵
  PID:9988
- C:\Windows\System\JBuEdSP.exe
  C:\Windows\System\JBuEdSP.exe
  2⤵
  PID:10020
- C:\Windows\System\nLAKmKw.exe
  C:\Windows\System\nLAKmKw.exe
  2⤵
  PID:10044
- C:\Windows\System\wDzkaIQ.exe
  C:\Windows\System\wDzkaIQ.exe
  2⤵
  PID:10064
- C:\Windows\System\zsiGxNA.exe
  C:\Windows\System\zsiGxNA.exe
  2⤵
  PID:10088
- C:\Windows\System\XygouRL.exe
  C:\Windows\System\XygouRL.exe
  2⤵
  PID:10136
- C:\Windows\System\evjuTvX.exe
  C:\Windows\System\evjuTvX.exe
  2⤵
  PID:10156
- C:\Windows\System\MPzRLkd.exe
  C:\Windows\System\MPzRLkd.exe
  2⤵
  PID:10176
- C:\Windows\System\cfPQZXf.exe
  C:\Windows\System\cfPQZXf.exe
  2⤵
  PID:10232
- C:\Windows\System\niVudbh.exe
  C:\Windows\System\niVudbh.exe
  2⤵
  PID:9220
- C:\Windows\System\UbjOfMU.exe
  C:\Windows\System\UbjOfMU.exe
  2⤵
  PID:9264
- C:\Windows\System\gNSuYgi.exe
  C:\Windows\System\gNSuYgi.exe
  2⤵
  PID:9324
- C:\Windows\System\KwkPjWR.exe
  C:\Windows\System\KwkPjWR.exe
  2⤵
  PID:9420
- C:\Windows\System\FDDoFCL.exe
  C:\Windows\System\FDDoFCL.exe
  2⤵
  PID:9448
- C:\Windows\System\fNyABwE.exe
  C:\Windows\System\fNyABwE.exe
  2⤵
  PID:9536
- C:\Windows\System\hSeqrhD.exe
  C:\Windows\System\hSeqrhD.exe
  2⤵
  PID:9564
- C:\Windows\System\blWZmit.exe
  C:\Windows\System\blWZmit.exe
  2⤵
  PID:9640
- C:\Windows\System\rdpzail.exe
  C:\Windows\System\rdpzail.exe
  2⤵
  PID:9740
- C:\Windows\System\lOHKXSq.exe
  C:\Windows\System\lOHKXSq.exe
  2⤵
  PID:9788
- C:\Windows\System\XxigKBz.exe
  C:\Windows\System\XxigKBz.exe
  2⤵
  PID:9844
- C:\Windows\System\cmBFGBf.exe
  C:\Windows\System\cmBFGBf.exe
  2⤵
  PID:9876
- C:\Windows\System\mArzeFv.exe
  C:\Windows\System\mArzeFv.exe
  2⤵
  PID:9948
- C:\Windows\System\pgjJQaO.exe
  C:\Windows\System\pgjJQaO.exe
  2⤵
  PID:10032
- C:\Windows\System\cYiUprC.exe
  C:\Windows\System\cYiUprC.exe
  2⤵
  PID:10028
- C:\Windows\System\pPIGVFk.exe
  C:\Windows\System\pPIGVFk.exe
  2⤵
  PID:10148
- C:\Windows\System\CbefhMa.exe
  C:\Windows\System\CbefhMa.exe
  2⤵
  PID:10192
- C:\Windows\System\OvSScZC.exe
  C:\Windows\System\OvSScZC.exe
  2⤵
  PID:7808
- C:\Windows\System\BaYVksH.exe
  C:\Windows\System\BaYVksH.exe
  2⤵
  PID:9364
- C:\Windows\System\UubGdeQ.exe
  C:\Windows\System\UubGdeQ.exe
  2⤵
  PID:9436
- C:\Windows\System\InYrqNY.exe
  C:\Windows\System\InYrqNY.exe
  2⤵
  PID:9528
- C:\Windows\System\RoHAdyS.exe
  C:\Windows\System\RoHAdyS.exe
  2⤵
  PID:9696
- C:\Windows\System\kVWFlEn.exe
  C:\Windows\System\kVWFlEn.exe
  2⤵
  PID:10012
- C:\Windows\System\kOewNRl.exe
  C:\Windows\System\kOewNRl.exe
  2⤵
  PID:8512
- C:\Windows\System\IKLuyjm.exe
  C:\Windows\System\IKLuyjm.exe
  2⤵
  PID:9636
- C:\Windows\System\jzkKyCa.exe
  C:\Windows\System\jzkKyCa.exe
  2⤵
  PID:9812
- C:\Windows\System\LOaxPdk.exe
  C:\Windows\System\LOaxPdk.exe
  2⤵
  PID:9256
- C:\Windows\System\aIDSirH.exe
  C:\Windows\System\aIDSirH.exe
  2⤵
  PID:9240
- C:\Windows\System\RQKDjAT.exe
  C:\Windows\System\RQKDjAT.exe
  2⤵
  PID:10264
- C:\Windows\System\QcCpMMm.exe
  C:\Windows\System\QcCpMMm.exe
  2⤵
  PID:10280
- C:\Windows\System\tthAARC.exe
  C:\Windows\System\tthAARC.exe
  2⤵
  PID:10308
- C:\Windows\System\GWcjdpe.exe
  C:\Windows\System\GWcjdpe.exe
  2⤵
  PID:10348
- C:\Windows\System\cHBPgAG.exe
  C:\Windows\System\cHBPgAG.exe
  2⤵
  PID:10376
- C:\Windows\System\IYSFrwl.exe
  C:\Windows\System\IYSFrwl.exe
  2⤵
  PID:10400
- C:\Windows\System\mvhStuB.exe
  C:\Windows\System\mvhStuB.exe
  2⤵
  PID:10424
- C:\Windows\System\aitwVem.exe
  C:\Windows\System\aitwVem.exe
  2⤵
  PID:10444
- C:\Windows\System\UEeLnDd.exe
  C:\Windows\System\UEeLnDd.exe
  2⤵
  PID:10472
- C:\Windows\System\sQboOwt.exe
  C:\Windows\System\sQboOwt.exe
  2⤵
  PID:10492
- C:\Windows\System\fRBPZSi.exe
  C:\Windows\System\fRBPZSi.exe
  2⤵
  PID:10508
- C:\Windows\System\FPCiEKi.exe
  C:\Windows\System\FPCiEKi.exe
  2⤵
  PID:10544
- C:\Windows\System\qLnVUST.exe
  C:\Windows\System\qLnVUST.exe
  2⤵
  PID:10572
- C:\Windows\System\faouJYv.exe
  C:\Windows\System\faouJYv.exe
  2⤵
  PID:10632
- C:\Windows\System\lMtoWup.exe
  C:\Windows\System\lMtoWup.exe
  2⤵
  PID:10652
- C:\Windows\System\qqhdOaL.exe
  C:\Windows\System\qqhdOaL.exe
  2⤵
  PID:10680
- C:\Windows\System\dDsIrTN.exe
  C:\Windows\System\dDsIrTN.exe
  2⤵
  PID:10720
- C:\Windows\System\HXIoxQZ.exe
  C:\Windows\System\HXIoxQZ.exe
  2⤵
  PID:10740
- C:\Windows\System\hprfKyJ.exe
  C:\Windows\System\hprfKyJ.exe
  2⤵
  PID:10756
- C:\Windows\System\iChcUma.exe
  C:\Windows\System\iChcUma.exe
  2⤵
  PID:10788
- C:\Windows\System\BUNwalw.exe
  C:\Windows\System\BUNwalw.exe
  2⤵
  PID:10804
- C:\Windows\System\ozwiDHA.exe
  C:\Windows\System\ozwiDHA.exe
  2⤵
  PID:10832
- C:\Windows\System\KPkqesN.exe
  C:\Windows\System\KPkqesN.exe
  2⤵
  PID:10848
- C:\Windows\System\rBPGHnx.exe
  C:\Windows\System\rBPGHnx.exe
  2⤵
  PID:10868
- C:\Windows\System\LVSdkrw.exe
  C:\Windows\System\LVSdkrw.exe
  2⤵
  PID:10892
- C:\Windows\System\ZRNeuvK.exe
  C:\Windows\System\ZRNeuvK.exe
  2⤵
  PID:10908
- C:\Windows\System\hDoKGMo.exe
  C:\Windows\System\hDoKGMo.exe
  2⤵
  PID:10932
- C:\Windows\System\sxhNgAf.exe
  C:\Windows\System\sxhNgAf.exe
  2⤵
  PID:10992
- C:\Windows\System\NUKSHDo.exe
  C:\Windows\System\NUKSHDo.exe
  2⤵
  PID:11040
- C:\Windows\System\hWmCMCZ.exe
  C:\Windows\System\hWmCMCZ.exe
  2⤵
  PID:11064
- C:\Windows\System\EeGiXSB.exe
  C:\Windows\System\EeGiXSB.exe
  2⤵
  PID:11112
- C:\Windows\System\AYSvGPp.exe
  C:\Windows\System\AYSvGPp.exe
  2⤵
  PID:11132
- C:\Windows\System\DCGYkxC.exe
  C:\Windows\System\DCGYkxC.exe
  2⤵
  PID:11156
- C:\Windows\System\EzYTDVw.exe
  C:\Windows\System\EzYTDVw.exe
  2⤵
  PID:11176
- C:\Windows\System\jlfvcGI.exe
  C:\Windows\System\jlfvcGI.exe
  2⤵
  PID:11204
- C:\Windows\System\fhEtnTY.exe
  C:\Windows\System\fhEtnTY.exe
  2⤵
  PID:11232
- C:\Windows\System\YjBbFQM.exe
  C:\Windows\System\YjBbFQM.exe
  2⤵
  PID:10256
- C:\Windows\System\YdWsgDr.exe
  C:\Windows\System\YdWsgDr.exe
  2⤵
  PID:10296
- C:\Windows\System\HkDCPhH.exe
  C:\Windows\System\HkDCPhH.exe
  2⤵
  PID:10316
- C:\Windows\System\SMZUMsR.exe
  C:\Windows\System\SMZUMsR.exe
  2⤵
  PID:10412
- C:\Windows\System\JnGfrxp.exe
  C:\Windows\System\JnGfrxp.exe
  2⤵
  PID:10516
- C:\Windows\System\uyarBKr.exe
  C:\Windows\System\uyarBKr.exe
  2⤵
  PID:10480
- C:\Windows\System\gfmBHxJ.exe
  C:\Windows\System\gfmBHxJ.exe
  2⤵
  PID:10536
- C:\Windows\System\LDwDmxm.exe
  C:\Windows\System\LDwDmxm.exe
  2⤵
  PID:10568
- C:\Windows\System\dIxAfNK.exe
  C:\Windows\System\dIxAfNK.exe
  2⤵
  PID:10608
- C:\Windows\System\cqJZHNk.exe
  C:\Windows\System\cqJZHNk.exe
  2⤵
  PID:10728
- C:\Windows\System\zZgijfX.exe
  C:\Windows\System\zZgijfX.exe
  2⤵
  PID:10812
- C:\Windows\System\xPtJwnI.exe
  C:\Windows\System\xPtJwnI.exe
  2⤵
  PID:10988
- C:\Windows\System\obBASCL.exe
  C:\Windows\System\obBASCL.exe
  2⤵
  PID:11004
- C:\Windows\System\JcwBOHw.exe
  C:\Windows\System\JcwBOHw.exe
  2⤵
  PID:3200
- C:\Windows\System\HdEwlIE.exe
  C:\Windows\System\HdEwlIE.exe
  2⤵
  PID:11100
- C:\Windows\System\UzHjsFp.exe
  C:\Windows\System\UzHjsFp.exe
  2⤵
  PID:972
- C:\Windows\System\AXaNiPJ.exe
  C:\Windows\System\AXaNiPJ.exe
  2⤵
  PID:11220
- C:\Windows\System\SlMzurR.exe
  C:\Windows\System\SlMzurR.exe
  2⤵
  PID:10272
- C:\Windows\System\JcFChro.exe
  C:\Windows\System\JcFChro.exe
  2⤵
  PID:10340
- C:\Windows\System\cbIWzMJ.exe
  C:\Windows\System\cbIWzMJ.exe
  2⤵
  PID:10408
- C:\Windows\System\FkPlVYv.exe
  C:\Windows\System\FkPlVYv.exe
  2⤵
  PID:10504
- C:\Windows\System\ULHQKBy.exe
  C:\Windows\System\ULHQKBy.exe
  2⤵
  PID:1900
- C:\Windows\System\OmZjNPB.exe
  C:\Windows\System\OmZjNPB.exe
  2⤵
  PID:10916
- C:\Windows\System\ZkQTCFC.exe
  C:\Windows\System\ZkQTCFC.exe
  2⤵
  PID:11096
- C:\Windows\System\ljSWbGT.exe
  C:\Windows\System\ljSWbGT.exe
  2⤵
  PID:11196
- C:\Windows\System\geJeFHy.exe
  C:\Windows\System\geJeFHy.exe
  2⤵
  PID:11260
- C:\Windows\System\IWNhaWB.exe
  C:\Windows\System\IWNhaWB.exe
  2⤵
  PID:10624
- C:\Windows\System\FTEeSJK.exe
  C:\Windows\System\FTEeSJK.exe
  2⤵
  PID:10796
- C:\Windows\System\PLsmEEL.exe
  C:\Windows\System\PLsmEEL.exe
  2⤵
  PID:10960
- C:\Windows\System\vmyZaeM.exe
  C:\Windows\System\vmyZaeM.exe
  2⤵
  PID:10768
- C:\Windows\System\QEOrqpc.exe
  C:\Windows\System\QEOrqpc.exe
  2⤵
  PID:11284
- C:\Windows\System\OSUmdYY.exe
  C:\Windows\System\OSUmdYY.exe
  2⤵
  PID:11312
- C:\Windows\System\JXaYoOg.exe
  C:\Windows\System\JXaYoOg.exe
  2⤵
  PID:11340
- C:\Windows\System\WkinvDa.exe
  C:\Windows\System\WkinvDa.exe
  2⤵
  PID:11360
- C:\Windows\System\EOoyRFE.exe
  C:\Windows\System\EOoyRFE.exe
  2⤵
  PID:11380
- C:\Windows\System\urlWqph.exe
  C:\Windows\System\urlWqph.exe
  2⤵
  PID:11424
- C:\Windows\System\IYTblXr.exe
  C:\Windows\System\IYTblXr.exe
  2⤵
  PID:11444
- C:\Windows\System\NkBHyTT.exe
  C:\Windows\System\NkBHyTT.exe
  2⤵
  PID:11480
- C:\Windows\System\IMSxAey.exe
  C:\Windows\System\IMSxAey.exe
  2⤵
  PID:11500
- C:\Windows\System\whpIIFV.exe
  C:\Windows\System\whpIIFV.exe
  2⤵
  PID:11564
- C:\Windows\System\lMDwCYV.exe
  C:\Windows\System\lMDwCYV.exe
  2⤵
  PID:11592
- C:\Windows\System\RqNXlCU.exe
  C:\Windows\System\RqNXlCU.exe
  2⤵
  PID:11608
- C:\Windows\System\mVPMlSW.exe
  C:\Windows\System\mVPMlSW.exe
  2⤵
  PID:11636
- C:\Windows\System\hVlkDHh.exe
  C:\Windows\System\hVlkDHh.exe
  2⤵
  PID:11660
- C:\Windows\System\ZEbTecz.exe
  C:\Windows\System\ZEbTecz.exe
  2⤵
  PID:11684
- C:\Windows\System\YMomwYo.exe
  C:\Windows\System\YMomwYo.exe
  2⤵
  PID:11716
- C:\Windows\System\Aznfnwy.exe
  C:\Windows\System\Aznfnwy.exe
  2⤵
  PID:11756
- C:\Windows\System\hYUHYRv.exe
  C:\Windows\System\hYUHYRv.exe
  2⤵
  PID:11776
- C:\Windows\System\uLlyuAK.exe
  C:\Windows\System\uLlyuAK.exe
  2⤵
  PID:11796
- C:\Windows\System\zIuqUgp.exe
  C:\Windows\System\zIuqUgp.exe
  2⤵
  PID:11812
- C:\Windows\System\YVbHuMp.exe
  C:\Windows\System\YVbHuMp.exe
  2⤵
  PID:11828
- C:\Windows\System\UvOPJCZ.exe
  C:\Windows\System\UvOPJCZ.exe
  2⤵
  PID:11844
- C:\Windows\System\PfEgkLb.exe
  C:\Windows\System\PfEgkLb.exe
  2⤵
  PID:11872
- C:\Windows\System\iPGSjTc.exe
  C:\Windows\System\iPGSjTc.exe
  2⤵
  PID:11896
- C:\Windows\System\pHXPJKr.exe
  C:\Windows\System\pHXPJKr.exe
  2⤵
  PID:11912
- C:\Windows\System\fOEjJwu.exe
  C:\Windows\System\fOEjJwu.exe
  2⤵
  PID:11964
- C:\Windows\System\HnbNVMt.exe
  C:\Windows\System\HnbNVMt.exe
  2⤵
  PID:12020
- C:\Windows\System\KFlcIWB.exe
  C:\Windows\System\KFlcIWB.exe
  2⤵
  PID:12040
- C:\Windows\System\nTlorZz.exe
  C:\Windows\System\nTlorZz.exe
  2⤵
  PID:12064
- C:\Windows\System\JpYrBJp.exe
  C:\Windows\System\JpYrBJp.exe
  2⤵
  PID:12084
- C:\Windows\System\yUUSrYD.exe
  C:\Windows\System\yUUSrYD.exe
  2⤵
  PID:12140
- C:\Windows\System\wOHRXJa.exe
  C:\Windows\System\wOHRXJa.exe
  2⤵
  PID:12188
- C:\Windows\System\eRbbmIi.exe
  C:\Windows\System\eRbbmIi.exe
  2⤵
  PID:12212
- C:\Windows\System\zjbaikX.exe
  C:\Windows\System\zjbaikX.exe
  2⤵
  PID:12236
- C:\Windows\System\LnAsRmI.exe
  C:\Windows\System\LnAsRmI.exe
  2⤵
  PID:12256
- C:\Windows\System\gNRxbaN.exe
  C:\Windows\System\gNRxbaN.exe
  2⤵
  PID:12276
- C:\Windows\System\kCISeMB.exe
  C:\Windows\System\kCISeMB.exe
  2⤵
  PID:11224
- C:\Windows\System\RyrOCpI.exe
  C:\Windows\System\RyrOCpI.exe
  2⤵
  PID:11352
- C:\Windows\System\RQeginv.exe
  C:\Windows\System\RQeginv.exe
  2⤵
  PID:11420
- C:\Windows\System\OVxuFCH.exe
  C:\Windows\System\OVxuFCH.exe
  2⤵
  PID:10676
- C:\Windows\System\ShzTBsC.exe
  C:\Windows\System\ShzTBsC.exe
  2⤵
  PID:11496
- C:\Windows\System\xBJpKVf.exe
  C:\Windows\System\xBJpKVf.exe
  2⤵
  PID:11532
- C:\Windows\System\oLQNHtl.exe
  C:\Windows\System\oLQNHtl.exe
  2⤵
  PID:11648
- C:\Windows\System\OytnMZc.exe
  C:\Windows\System\OytnMZc.exe
  2⤵
  PID:11692
- C:\Windows\System\hAVgcSY.exe
  C:\Windows\System\hAVgcSY.exe
  2⤵
  PID:11744
- C:\Windows\System\SAaHcrU.exe
  C:\Windows\System\SAaHcrU.exe
  2⤵
  PID:11928
- C:\Windows\System\KqAzUZG.exe
  C:\Windows\System\KqAzUZG.exe
  2⤵
  PID:11752
- C:\Windows\System\bzEpUOP.exe
  C:\Windows\System\bzEpUOP.exe
  2⤵
  PID:11864
- C:\Windows\System\woOZmvA.exe
  C:\Windows\System\woOZmvA.exe
  2⤵
  PID:11956
- C:\Windows\System\DnRoeOK.exe
  C:\Windows\System\DnRoeOK.exe
  2⤵
  PID:12048
- C:\Windows\System\vRIvCuu.exe
  C:\Windows\System\vRIvCuu.exe
  2⤵
  PID:12100
- C:\Windows\System\CdPWhIP.exe
  C:\Windows\System\CdPWhIP.exe
  2⤵
  PID:12208
- C:\Windows\System\CRpDNTn.exe
  C:\Windows\System\CRpDNTn.exe
  2⤵
  PID:1512
- C:\Windows\System\FayUmII.exe
  C:\Windows\System\FayUmII.exe
  2⤵
  PID:11056
- C:\Windows\System\aWLSaVN.exe
  C:\Windows\System\aWLSaVN.exe
  2⤵
  PID:11396
- C:\Windows\System\glFEziB.exe
  C:\Windows\System\glFEziB.exe
  2⤵
  PID:11528
- C:\Windows\System\cQuPDdq.exe
  C:\Windows\System\cQuPDdq.exe
  2⤵
  PID:11708
- C:\Windows\System\bcsaXqQ.exe
  C:\Windows\System\bcsaXqQ.exe
  2⤵
  PID:11604
- C:\Windows\System\wIbHnal.exe
  C:\Windows\System\wIbHnal.exe
  2⤵
  PID:11936
- C:\Windows\System\mKXhukF.exe
  C:\Windows\System\mKXhukF.exe
  2⤵
  PID:11392
- C:\Windows\System\XViFMvD.exe
  C:\Windows\System\XViFMvD.exe
  2⤵
  PID:116
- C:\Windows\System\XbWNEbP.exe
  C:\Windows\System\XbWNEbP.exe
  2⤵
  PID:12272
- C:\Windows\System\YjiAmPi.exe
  C:\Windows\System\YjiAmPi.exe
  2⤵
  PID:11600
- C:\Windows\System\QndNcYa.exe
  C:\Windows\System\QndNcYa.exe
  2⤵
  PID:11576
- C:\Windows\System\HERotYe.exe
  C:\Windows\System\HERotYe.exe
  2⤵
  PID:11788
- C:\Windows\System\jeXCJfr.exe
  C:\Windows\System\jeXCJfr.exe
  2⤵
  PID:11884
- C:\Windows\System\qfylTpq.exe
  C:\Windows\System\qfylTpq.exe
  2⤵
  PID:11948
- C:\Windows\System\sGFbhxV.exe
  C:\Windows\System\sGFbhxV.exe
  2⤵
  PID:12292
- C:\Windows\System\gjaaokR.exe
  C:\Windows\System\gjaaokR.exe
  2⤵
  PID:12316
- C:\Windows\System\hJBRxoj.exe
  C:\Windows\System\hJBRxoj.exe
  2⤵
  PID:12348
- C:\Windows\System\YRmtuHs.exe
  C:\Windows\System\YRmtuHs.exe
  2⤵
  PID:12376
- C:\Windows\System\gXlvufc.exe
  C:\Windows\System\gXlvufc.exe
  2⤵
  PID:12404
- C:\Windows\System\cUnidUU.exe
  C:\Windows\System\cUnidUU.exe
  2⤵
  PID:12432
- C:\Windows\System\dCDqsRZ.exe
  C:\Windows\System\dCDqsRZ.exe
  2⤵
  PID:12456
- C:\Windows\System\REYCoXA.exe
  C:\Windows\System\REYCoXA.exe
  2⤵
  PID:12476
- C:\Windows\System\HzLFIOM.exe
  C:\Windows\System\HzLFIOM.exe
  2⤵
  PID:12492
- C:\Windows\System\pCbkLov.exe
  C:\Windows\System\pCbkLov.exe
  2⤵
  PID:12512
- C:\Windows\System\jFSFRjL.exe
  C:\Windows\System\jFSFRjL.exe
  2⤵
  PID:12540
- C:\Windows\System\wKiaKrn.exe
  C:\Windows\System\wKiaKrn.exe
  2⤵
  PID:12584
- C:\Windows\System\GJDMIJj.exe
  C:\Windows\System\GJDMIJj.exe
  2⤵
  PID:12608
- C:\Windows\System\hmAaalO.exe
  C:\Windows\System\hmAaalO.exe
  2⤵
  PID:12628
- C:\Windows\System\ehqGcxB.exe
  C:\Windows\System\ehqGcxB.exe
  2⤵
  PID:12704
- C:\Windows\System\MWpAegk.exe
  C:\Windows\System\MWpAegk.exe
  2⤵
  PID:12732
- C:\Windows\System\kqRwmFw.exe
  C:\Windows\System\kqRwmFw.exe
  2⤵
  PID:12752
- C:\Windows\System\sZMACYd.exe
  C:\Windows\System\sZMACYd.exe
  2⤵
  PID:12776
- C:\Windows\System\wrSKmoE.exe
  C:\Windows\System\wrSKmoE.exe
  2⤵
  PID:12800
- C:\Windows\System\wFKWWCs.exe
  C:\Windows\System\wFKWWCs.exe
  2⤵
  PID:12816
- C:\Windows\System\FhmyLIa.exe
  C:\Windows\System\FhmyLIa.exe
  2⤵
  PID:12848
- C:\Windows\System\NbouaYx.exe
  C:\Windows\System\NbouaYx.exe
  2⤵
  PID:12876
- C:\Windows\System\gORuiGP.exe
  C:\Windows\System\gORuiGP.exe
  2⤵
  PID:12904
- C:\Windows\System\HVgUjre.exe
  C:\Windows\System\HVgUjre.exe
  2⤵
  PID:12920
- C:\Windows\System\vupgKEn.exe
  C:\Windows\System\vupgKEn.exe
  2⤵
  PID:12952
- C:\Windows\System\XIxOMpF.exe
  C:\Windows\System\XIxOMpF.exe
  2⤵
  PID:12972
- C:\Windows\System\tsagiGM.exe
  C:\Windows\System\tsagiGM.exe
  2⤵
  PID:13028
- C:\Windows\System\KGCjcPn.exe
  C:\Windows\System\KGCjcPn.exe
  2⤵
  PID:13048
- C:\Windows\System\KhlHfqU.exe
  C:\Windows\System\KhlHfqU.exe
  2⤵
  PID:13068
- C:\Windows\System\JdUdaoX.exe
  C:\Windows\System\JdUdaoX.exe
  2⤵
  PID:13104
- C:\Windows\System\lFlEHmF.exe
  C:\Windows\System\lFlEHmF.exe
  2⤵
  PID:13160
- C:\Windows\System\HmFdIed.exe
  C:\Windows\System\HmFdIed.exe
  2⤵
  PID:13180
- C:\Windows\System\IRKIcTy.exe
  C:\Windows\System\IRKIcTy.exe
  2⤵
  PID:13204
- C:\Windows\System\HzDSZwk.exe
  C:\Windows\System\HzDSZwk.exe
  2⤵
  PID:13220
- C:\Windows\System\kgtrSdF.exe
  C:\Windows\System\kgtrSdF.exe
  2⤵
  PID:13240
- C:\Windows\System\cCeTATD.exe
  C:\Windows\System\cCeTATD.exe
  2⤵
  PID:13268
- C:\Windows\System\fEydVKX.exe
  C:\Windows\System\fEydVKX.exe
  2⤵
  PID:13292
- C:\Windows\System\okJrAbF.exe
  C:\Windows\System\okJrAbF.exe
  2⤵
  PID:12308
- C:\Windows\System\JuQrtqe.exe
  C:\Windows\System\JuQrtqe.exe
  2⤵
  PID:12372
- C:\Windows\System\JlFxHGv.exe
  C:\Windows\System\JlFxHGv.exe
  2⤵
  PID:12452
- C:\Windows\System\kcxGsPv.exe
  C:\Windows\System\kcxGsPv.exe
  2⤵
  PID:12500
- C:\Windows\System\sjcmwvt.exe
  C:\Windows\System\sjcmwvt.exe
  2⤵
  PID:12644
- C:\Windows\System\WvLTVLa.exe
  C:\Windows\System\WvLTVLa.exe
  2⤵
  PID:12692
- C:\Windows\System\bHwcrkQ.exe
  C:\Windows\System\bHwcrkQ.exe
  2⤵
  PID:11852
- C:\Windows\System\amKpVNf.exe
  C:\Windows\System\amKpVNf.exe
  2⤵
  PID:12744
- C:\Windows\System\OIlxCVH.exe
  C:\Windows\System\OIlxCVH.exe
  2⤵
  PID:700
- C:\Windows\System\xamVvdI.exe
  C:\Windows\System\xamVvdI.exe
  2⤵
  PID:12784
- C:\Windows\System\onldyvS.exe
  C:\Windows\System\onldyvS.exe
  2⤵
  PID:2108
- C:\Windows\System\eqqQaQA.exe
  C:\Windows\System\eqqQaQA.exe
  2⤵
  PID:12844
- C:\Windows\System\dFIstMZ.exe
  C:\Windows\System\dFIstMZ.exe
  2⤵
  PID:12860
- C:\Windows\System\hpskTAS.exe
  C:\Windows\System\hpskTAS.exe
  2⤵
  PID:13040
- C:\Windows\System\WdQYlmS.exe
  C:\Windows\System\WdQYlmS.exe
  2⤵
  PID:13036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vlosfn1e.zlj.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BbxVODy.exe

Filesize
1.9MB

MD5
7012601982b8ba04f7de4b05ca98f966

SHA1
7fa36b0957fd4c186739b4e569a34f751c44f23b

SHA256
1b99ac64f973e55574f78238dfbcaec42c7fc5f33959ba06f5cb212398ddfa0c

SHA512
56db0426df4129c460deaaa4c3baaee22b1c9fb62b3f8d18dfb7c11dc2eded2f6f9b4ce6f7a95f2a60541163418f38fb98fefc6b6625150144992254fb49dd89

Download Submit
C:\Windows\System\EFRkPGD.exe

Filesize
1.9MB

MD5
fa2649fabaadfa7fdc353ef7edb3aca2

SHA1
344856a40646938397c8c72914b2c1ae09cea9bd

SHA256
af4636c2af2b53ee054de74c4d982ecd985ab231c82d5cb3fd05bcd070512eff

SHA512
a97bd0b466e3de92206750fa6d27f70da879819bae92ab3cbc10d44e5ea6c21d1fc5105bd8180f960b9ba1e15dce9a46e447b0f59a59a075755e99e3ae92a5c1

Download Submit
C:\Windows\System\EYToorH.exe

Filesize
1.9MB

MD5
425d9fde63c2d089ae82585de36c38fd

SHA1
b3fc2fcb51b8d7c0f41c8651791899e085bad555

SHA256
1aa51e6d9158ef0e76acc6545370f87eab5c741e4ce6da14aa76c32c637a515d

SHA512
c3e446a0048d4ba40006df2b07df59c3dd25ee63584ad5c8a68b25968b806459231c6c556847291c614a3c22168376beb09428aaa98734a39aeb67c576c00fa9

Download Submit
C:\Windows\System\EykDaoP.exe

Filesize
1.9MB

MD5
c216d5cd6e0bb3629c8b13fdffa1dc5e

SHA1
c711eddb117c983419b8cf07670a758c07973753

SHA256
8a96dd3aef040d63b450f75f184e48bbcb618d9eae363a1452be04a4946d9bee

SHA512
b7676f87defc69c755fc06fb7e1d36f9b2c33d33a574196d47cf5375fc7f11f4d12bdcb5e7ba85c92dc900bfb061f15834f33db6afa7a6ee4c8b451b06fcadb2

Download Submit
C:\Windows\System\FZOJrwN.exe

Filesize
1.9MB

MD5
e9c76bab1b17c2e8b06631e67816c774

SHA1
bd6973c7ff39deaa371690a8ab40d6766e4ad7cd

SHA256
81cc74b49bb5350024bcdd4c61d0ac8af3954cd5f7ed0569a7c8b307720f26d0

SHA512
c30cc410717d84c881507adc4dfd631d482b411a7a9d3aeb10664fc5f8183ab0bed17fc9b7aaaba1b446040352b3aa3ab2cb66b063eca9fae428652c6bb21bec

Download Submit
C:\Windows\System\GjrLsir.exe

Filesize
1.9MB

MD5
9bf40ac199c53dc033112cd817ec0939

SHA1
add6d223bbdb592cd3e7b2604390921477239760

SHA256
1eb14b17fabb0ede6db0f183116aadff7e0587f84d6d93ab0cc08c67101e9fb3

SHA512
1dbc3b987c4a552e58bc1c844d82dba1997131f53b19574f77fcc00e2e3c5891a0fe820e1b3728e90dc9e8c88e6deb35c27ca727322b07aa4583c20461c94e72

Download Submit
C:\Windows\System\INNavfc.exe

Filesize
1.9MB

MD5
79df9099ba3cf3ff0b9ed55fb32ce526

SHA1
5ba64e0a06f9d54703ea9dbc3b280d3f3ad3155e

SHA256
f61cc613bc25ea07066fa0338d83108c4c4aa8be03ceb9a3bde64c8abd73e4d6

SHA512
173f0c7da0476ce7328bb645355010173dd46b599c4708c940f9e0f9f25700fc2ffaa61dbc271ea3519e0e604b78fe8e70b4cf66fbb499e4c9c3ff15e482c042

Download Submit
C:\Windows\System\KcfPmPH.exe

Filesize
1.9MB

MD5
00773e44e32a344f00c8e5b596b40153

SHA1
30874665fed27b2d65d67b7f0af62635491f4afa

SHA256
586a44933ce946a4bf69408cb6e4a7ced743e6431ec258527f3beb69a05eb306

SHA512
ba03db996b458ca75455490cbd3a4613d721ea0050bac917ee8b831b44a4b9c5115f2a2ac1a394edc70f8ecb654e9f8e51e3ddb0a36f9116fb0de9338e05bf5a

Download Submit
C:\Windows\System\LLfmilk.exe

Filesize
1.9MB

MD5
be3f64c17cde64b26020661deaa9f646

SHA1
fb8670867221f1f33bdc4bbb8e9a518f7a4d6743

SHA256
d171bd73f643d1587b48eb001391055fe446216e3a5a479f340d0d03dd44177f

SHA512
c69e214c0fe8e89cad520748c0d42a19bd7630a2c1c95f1031115f0d303a3fe335a25d90043a81864a9f3d480082f614c558810e6d6acd494f071b7fc0aaad93

Download Submit
C:\Windows\System\NbNLVVf.exe

Filesize
1.8MB

MD5
3051968005951b340a7f4c7dbb1373b5

SHA1
fe99a731a9948cb4e50ae82b00a509e3ea88face

SHA256
bce42362d985b3c7e282483aa77538e9eb0459ebc34b392dccffaf87153a08d8

SHA512
cf702dc94980c0f559e62a37caf50ea1c07ea1c2530d893b325b04e7176455c5925d20a8b348052636ea52f6c928f9877cc196b6b56ddb0ab3a922b77ca17cfa

Download Submit
C:\Windows\System\OWDYRVz.exe

Filesize
1.9MB

MD5
6e9e134f6088fe6ebbcaae56a8144338

SHA1
4e1a6cf3ebb39c91544de4158731c9fa8291c0e9

SHA256
d852593ed64de1c67b4860b6df03392e834bbcbc2ef5fa841afea5faf270d5eb

SHA512
91d6fdd25419bb86e080fc8cac748b701a9956f4edf44ec454ab9a80ec1bbd082bc47c06119120dafff516213aac5092180ac98e750d77bae42fce91784ac95b

Download Submit
C:\Windows\System\PkIUeXc.exe

Filesize
1.9MB

MD5
fe6fbe9c271139341d12fa7c58547b31

SHA1
b436490011bd2807848b4c6ff4a3bdea326b1965

SHA256
bb7524a88662c4c44ce4d0c12a60e2e317dc280674107ea38e7d716f5926579a

SHA512
2ab6e4731eac5cee7326f81ea0819b7904e4bf679348cf5cc448ae28237927fb92ff035c41e623662af0a5a1da0f625343f274f62b40aa9aabf20ffd6e34fc41

Download Submit
C:\Windows\System\RuaGImN.exe

Filesize
1.9MB

MD5
4caa0571c97e1bc479ec1acdf75129cf

SHA1
434b046fab8c4204e045cb3515c823fd8b4484d7

SHA256
309aff3ebfc7fbd5a6ef104d0d6e4a29ca69ed4ded48f9d7016e72c1d8ea7fce

SHA512
92a1efa4108a61160f89faa288171c2a129cfb01f8c4c955d8eed801e5da53aa598a0af2d662f117bc5cbc9e3aafd89f027ef25e7faf9a2d26a7a172df478fd6

Download Submit
C:\Windows\System\SuTyuiN.exe

Filesize
1.9MB

MD5
df9a5726782fa7658fcd2c0037eaf5f2

SHA1
65d4ea334b383bce0854a8998f73a377f7732226

SHA256
236610d6d59da6e9466c465ceb2645391ca6efc4ee338fd7df1902f99fc388e4

SHA512
eb5af969db33f1dd63e72ac5021176c985d7c164a23f02a1c8797b83e5e9f3e1922c2df36aebeabc97c731baa2e266f74bc699df7b03e3df112ac310d2a9ad78

Download Submit
C:\Windows\System\TAlUrQN.exe

Filesize
1.9MB

MD5
5f000730d0595fcc256669ae58b2b62d

SHA1
d33ef1d6492e2c84bc72670113ab50bb1ee581a9

SHA256
c5035a5953f551076a317533d64e9fa6d9e06cb8475d68b0fa1dc4d3a3ac7ef8

SHA512
c7a0845f0597f865183486786376bcfbe8e8c89a5f6bc653dd3c15d303c377439bdac7cf730c6f3132d92964b40d944328fb4ae82ed4f479f0d1a5d5cf39b0e5

Download Submit
C:\Windows\System\TAnDWFv.exe

Filesize
1.9MB

MD5
b8db884dcfb2fb202ca96c1097eea63d

SHA1
0f3f476680ca7f52a9c1a0ae3eda9897517e1688

SHA256
d14a740e7cc7c322fbdf9a13f8000a1aad9331899aac801bf975a53780d16f6a

SHA512
bb34c2967f9203ed9fa828942f5a1ad7c3e0f67e0c6305b3e7a8b1cf9df1eb14258b49cbfd3849700d6904220baad849b8b781541c03267e9ea0e8d2df781879

Download Submit
C:\Windows\System\YVFBZZk.exe

Filesize
8B

MD5
3277aa72bb7d7f1eb1043502fbd1c406

SHA1
8712dca2f3fbc82bf0cbbeecdc5d6a26c87f443c

SHA256
e94b62f30c9ce8b0b5cea14d4367a52fe08005d1bd56ca932a1fd7fc15c61bc9

SHA512
9fb0369549dba8937fb796cbc4ade6bacf540f10f98e02675f1b04c615cbb49e396cdbd25cd29de56c7bfb889c8464199939a84fa31434a75c020caeb4f9f503

Download Submit
C:\Windows\System\amAuABD.exe

Filesize
1.9MB

MD5
957de83bc0bbc1ab3db3cae3a6e9ceea

SHA1
9774705c77351439c365c007c8b7204f141024cf

SHA256
6286d1640b1705e3c8d266241adfa1474cbb80b87ee751234c9ff3bf6e80a479

SHA512
7cc53f1c5b26dc13a54765725a1a79811f889076ba19e27e1bede13e3b58da7e2df05e499d81cc671429ebb3af9c23fb286d5cc573e48cde0d03aff12eb7245d

Download Submit
C:\Windows\System\bDuZtpQ.exe

Filesize
1.9MB

MD5
e7cd1d2bd3b9a4c21b778060bfb150a0

SHA1
e41891b88073b1150883aa1b83527a819ddef18a

SHA256
33ea24745258ba0d2b7d6ab127b08ed44e75e5020a557168ff895ff779362c82

SHA512
1fa41afef054c8d8f9dff669acd6d393c559e4383192e4962e41133e6767e3391fa0f45273b9c9e243e6a6a444e85f0ade36dfd98929a03435af7ffd7a281126

Download Submit
C:\Windows\System\eEGSbjo.exe

Filesize
1.9MB

MD5
378e2b49be3221cb10ffc24824752821

SHA1
3b9adc33929c5c6332d807d22ce1c0656776aab9

SHA256
917a3268ed649e56a66e7c417bfe2f6249fe54f8edc437ffbe6bf8bdb52986cc

SHA512
17c53425b6cc7c2b48412817016e5639484d96fc56a481f7148ea21b838a336c61742776c51333da77016650386c82b2b2aaa96caafa3206f0253ad8d742c95f

Download Submit
C:\Windows\System\ecIqqsj.exe

Filesize
1.9MB

MD5
d7a05c0840ef989d91f9d803dd594067

SHA1
a4dcdccf374263cdc5c23d1b54c77c231fe2a186

SHA256
1dfdb63d1e619f51f87ef5c59d5bebe9ff5e791ef2b443f6ec9536ac9b01f703

SHA512
5eb3b4acdc217b081403d64c40518f12a9cc0f27b4ff4a2200bd8a7d6fa92adcebcc45fd81da729aa836cca77eae2394af763cd0ec2a813a7512f8da593daf8c

Download Submit
C:\Windows\System\gFnKNLe.exe

Filesize
1.9MB

MD5
a152f6b9c70f7a8320cfd75b0a3cf2e2

SHA1
1dd0d6605a7f352ef2cee789aa769637d275a8ab

SHA256
7635253c2a7605785a1cb46b0f130d8ea4ce0dfabb0b3915d2c31ed07044ec00

SHA512
42974559d9155114c40a4ddef25fe3db6605d7451d93e0f208519ed6e970764898451491e27ca174fad8361ed18a72c7fdd7248c6f4c6dbd9516ee5b8d284928

Download Submit
C:\Windows\System\hDuCTVb.exe

Filesize
1.9MB

MD5
9528fe21760869f17cc7373fe34a433d

SHA1
fea9102c145496238d4a741cbdbdbf4633d96d49

SHA256
ea48b98a8b166f88dd74e331fbeac70d90351f9be8919f887c1834d50453dab0

SHA512
be3e828192242e60102e15aac0a65fe06a8bd06dabbf5d437e60b89546bd32e5875fef9071aeb19a4869b13969e11ec902add7afb781c4224947e27b0fc6d794

Download Submit
C:\Windows\System\iVlqUOt.exe

Filesize
1.9MB

MD5
e6c8c71babbabd0d401dbd98b68f5a80

SHA1
c311ba88082c7798dc6c7ac87d7e17e7b34a22cc

SHA256
1f795d6c0040569a814c5317736686c360e9645a84eb3746e77731ecdb035a73

SHA512
3d32341beb6f79e84ef2ed435bf3062edbf0fd46fba096b5e9210c5d4c4993c56bc2b2c9a161f10766c990343c23cae487f7abbf3518a84791979a769b409167

Download Submit
C:\Windows\System\ijNKjLu.exe

Filesize
1.9MB

MD5
78f186ae9dce0f7f23a97bf70a93619c

SHA1
188cdf8390557a04071d5262df79171075f67c2a

SHA256
8a7491879df3d76fb9275b694d69db31a68ae22cfcb5c3f9276dcdb3f3f0ef44

SHA512
cd89cd53fa632e0f57b076a213156fc7b7396f3349a74e930a1d81e7b7e17fcc89227318e6002dcb35ae66c1e02cfa5c7a955f02848c9d012af07a16bded0c39

Download Submit
C:\Windows\System\jLgeVaX.exe

Filesize
1.9MB

MD5
2a0229ba29c9fa059d4e1c31dd21ca90

SHA1
49a3b25f78484acca273a476a2ddf5f8dfeea21e

SHA256
cc59b3b8aaac899497d8814be80a8ce8d0ecc982a16be2688b06ef4d2e4f8188

SHA512
d2eed30a90ede9aefb1e927d2e15935de80e54322b77fa525f19a4ac8c628ffb72b18b25258a16d485d42c71bc57665d04accae5b984e15cf43488bf763d2313

Download Submit
C:\Windows\System\kManrOG.exe

Filesize
1.9MB

MD5
11a7a4a20d9067b2658e28a43a0eab1d

SHA1
12c31c165a44cf6e5b9f5df3d7c703db6e63220a

SHA256
04b53cc15488e8073edaba108c776c523b475141f0c8bc97c27d6fdcf739ec86

SHA512
1a94c120679098910721195fcc48a0744d2d1f00ca35cb3cfdd0396b15dfeec864bbd010663fbe844ca818f1dba2d722eda3d5cb93ecbd2c5123cb5c9a45c560

Download Submit
C:\Windows\System\nWDepkh.exe

Filesize
1.9MB

MD5
715db8e1c0e86bbf0c77610612537629

SHA1
a9385c85c0ae9810f032b038d419bf43eb90d221

SHA256
0018482bcd212913ae39c9fc9bdfe548c5b79512ecae37fcad3fea9565332ca2

SHA512
0c4fa07f8d25f792e5725413ec03258643e7391de318eb4943750833f54b8632707712330d63c55eb898bcaa368b38947133ab569cff1a4b7e44ad707080e979

Download Submit
C:\Windows\System\nuBICLj.exe

Filesize
1.9MB

MD5
81694d3633778c7cbc28a355c5aed94c

SHA1
5caa8da20c5ebc4310a9753fae480253ffd26324

SHA256
135be7cb85ca8d56d834804dd56304e16ccb2d310eafe00f47275ee0fa3b99f0

SHA512
f6dccf0b36a32beb4b86c408d2bad69327fd348db539eba822cf9ec4f142e84389ca1fc8632e5a6d219eea86505ac63add964c97a6e5c9d1390ca7097f39c8d8

Download Submit
C:\Windows\System\sEMUPPN.exe

Filesize
1.9MB

MD5
fc8f0c1f9889f14c74abc3b9f780fdcd

SHA1
3673386b686dca555a58dd61952a22d057b94cad

SHA256
d24264a0588e3bb8276beb642b7015e9f0d7e9d7b97c11b0e326b3c4d1058d26

SHA512
fe2598ffa083607cc287b2b04feb72b4a0de699b3671d4da055a3a8383158850040d8e5f4b7febe5d802c9c29d53ec436ee0ee639fe73ff92cc0d2441f0c56c6

Download Submit
C:\Windows\System\tzNnHkS.exe

Filesize
1.9MB

MD5
2374e3831cedaa2e731df97466c394c6

SHA1
4d2b7dae2ae820c93782e987cfc34a165262bf65

SHA256
096ba26b006ff2db9839b58c888df6f9b95c42d9c7dfc5a101d18cfb1f54e4b7

SHA512
0d4e99b6d8ef25c0df93d759afebf8df93d8c24e0937cab54a884d1bd6da72ee7c15e34160bfa9ee7ff78fb6a8bc57361f33ede96df2ab8d9199a2061149c1c4

Download Submit
C:\Windows\System\vAgylqg.exe

Filesize
1.9MB

MD5
fbcbd07b3e8a193b958e741cb6d4ab6c

SHA1
0d629731f9e46d0f241ce643c10a3f975f2a2724

SHA256
98e70fbe611b22d695a406f505cda4e2cb8a5315309ecaa73ec4b10b2740079f

SHA512
331b92f311ff349eea1f2a4178664fea5f4523f9df3d48d19a41564a7cd1128a94f594608ef5bafc61e4d6a9a121c23b4486dc1b584e59a1a6b2f562bbd8d523

Download Submit
C:\Windows\System\wyGXBWa.exe

Filesize
1.8MB

MD5
1586f750b7778baf8a157059c8a91305

SHA1
31f69b4d932462ed26241137d52e6857456500d8

SHA256
da56376ef12992d91272a40d7ba9b2b726323ee9065579451bd40a15e18d7c89

SHA512
3d88afd8f557bca970525236eb5fd1dd12bb894d89f203a2d0c89787a6cf335816fe23a755e2d796d62dae94b329bb65f94b1594a6b7eb2ef63f528a644f99e0

Download Submit
C:\Windows\System\xcdNUJj.exe

Filesize
1.9MB

MD5
3b7f4756d7ed4937f787eba3c115ea5e

SHA1
156c88dca56c7fb8e036e31fb216bd6e76f50026

SHA256
ea7a29385f7e9055f776a0439ab8d99f3d18f8d733edb2fb309749074b1228e9

SHA512
a8f41bb461341f88934e08d26253572370076c9d7ba17625a743a4e6aea82d5494d203a2475a528b5e3d636351d778d8efa7a94bbd53302bf9b3beece4ce395f

Download Submit
memory/1160-49-0x00007FF7B9850000-0x00007FF7B9C42000-memory.dmp

Filesize
3.9MB

Download
memory/1160-2120-0x00007FF7B9850000-0x00007FF7B9C42000-memory.dmp

Filesize
3.9MB

Download
memory/1160-2055-0x00007FF7B9850000-0x00007FF7B9C42000-memory.dmp

Filesize
3.9MB

Download
memory/1320-1650-0x00007FF70B7A0000-0x00007FF70BB92000-memory.dmp

Filesize
3.9MB

Download
memory/1320-41-0x00007FF70B7A0000-0x00007FF70BB92000-memory.dmp

Filesize
3.9MB

Download
memory/1320-2116-0x00007FF70B7A0000-0x00007FF70BB92000-memory.dmp

Filesize
3.9MB

Download
memory/1332-2071-0x00007FF70D970000-0x00007FF70DD62000-memory.dmp

Filesize
3.9MB

Download
memory/1332-89-0x00007FF70D970000-0x00007FF70DD62000-memory.dmp

Filesize
3.9MB

Download
memory/1332-2130-0x00007FF70D970000-0x00007FF70DD62000-memory.dmp

Filesize
3.9MB

Download
memory/1400-54-0x00007FF61B580000-0x00007FF61B972000-memory.dmp

Filesize
3.9MB

Download
memory/1400-2054-0x00007FF61B580000-0x00007FF61B972000-memory.dmp

Filesize
3.9MB

Download
memory/1400-2118-0x00007FF61B580000-0x00007FF61B972000-memory.dmp

Filesize
3.9MB

Download
memory/1412-2177-0x00007FF6DBE50000-0x00007FF6DC242000-memory.dmp

Filesize
3.9MB

Download
memory/1412-128-0x00007FF6DBE50000-0x00007FF6DC242000-memory.dmp

Filesize
3.9MB

Download
memory/1412-2078-0x00007FF6DBE50000-0x00007FF6DC242000-memory.dmp

Filesize
3.9MB

Download
memory/1840-25-0x00007FF7C8340000-0x00007FF7C8732000-memory.dmp

Filesize
3.9MB

Download
memory/1840-2096-0x00007FF7C8340000-0x00007FF7C8732000-memory.dmp

Filesize
3.9MB

Download
memory/2236-21-0x00007FF749830000-0x00007FF749C22000-memory.dmp

Filesize
3.9MB

Download
memory/2236-2112-0x00007FF749830000-0x00007FF749C22000-memory.dmp

Filesize
3.9MB

Download
memory/2280-2163-0x00007FF7101A0000-0x00007FF710592000-memory.dmp

Filesize
3.9MB

Download
memory/2280-129-0x00007FF7101A0000-0x00007FF710592000-memory.dmp

Filesize
3.9MB

Download
memory/2356-2077-0x00007FF682ED0000-0x00007FF6832C2000-memory.dmp

Filesize
3.9MB

Download
memory/2356-111-0x00007FF682ED0000-0x00007FF6832C2000-memory.dmp

Filesize
3.9MB

Download
memory/2356-2169-0x00007FF682ED0000-0x00007FF6832C2000-memory.dmp

Filesize
3.9MB

Download
memory/2380-1-0x000001BA4EF00000-0x000001BA4EF10000-memory.dmp

Filesize
64KB

Download
memory/2380-0-0x00007FF6F35E0000-0x00007FF6F39D2000-memory.dmp

Filesize
3.9MB

Download
memory/2380-1629-0x00007FF6F35E0000-0x00007FF6F39D2000-memory.dmp

Filesize
3.9MB

Download
memory/2908-162-0x00007FF72EF60000-0x00007FF72F352000-memory.dmp

Filesize
3.9MB

Download
memory/2908-2176-0x00007FF72EF60000-0x00007FF72F352000-memory.dmp

Filesize
3.9MB

Download
memory/3008-2172-0x00007FF67A150000-0x00007FF67A542000-memory.dmp

Filesize
3.9MB

Download
memory/3008-153-0x00007FF67A150000-0x00007FF67A542000-memory.dmp

Filesize
3.9MB

Download
memory/3212-2126-0x00007FF7DB130000-0x00007FF7DB522000-memory.dmp

Filesize
3.9MB

Download
memory/3212-77-0x00007FF7DB130000-0x00007FF7DB522000-memory.dmp

Filesize
3.9MB

Download
memory/3412-2165-0x00007FF702040000-0x00007FF702432000-memory.dmp

Filesize
3.9MB

Download
memory/3412-134-0x00007FF702040000-0x00007FF702432000-memory.dmp

Filesize
3.9MB

Download
memory/3496-2128-0x00007FF6A2100000-0x00007FF6A24F2000-memory.dmp

Filesize
3.9MB

Download
memory/3496-98-0x00007FF6A2100000-0x00007FF6A24F2000-memory.dmp

Filesize
3.9MB

Download
memory/3944-146-0x00007FF7DA640000-0x00007FF7DAA32000-memory.dmp

Filesize
3.9MB

Download
memory/3944-2167-0x00007FF7DA640000-0x00007FF7DAA32000-memory.dmp

Filesize
3.9MB

Download
memory/4212-65-0x00007FF6BA550000-0x00007FF6BA942000-memory.dmp

Filesize
3.9MB

Download
memory/4212-2056-0x00007FF6BA550000-0x00007FF6BA942000-memory.dmp

Filesize
3.9MB

Download
memory/4212-2122-0x00007FF6BA550000-0x00007FF6BA942000-memory.dmp

Filesize
3.9MB

Download
memory/4224-2125-0x00007FF732F70000-0x00007FF733362000-memory.dmp

Filesize
3.9MB

Download
memory/4224-70-0x00007FF732F70000-0x00007FF733362000-memory.dmp

Filesize
3.9MB

Download
memory/4224-2057-0x00007FF732F70000-0x00007FF733362000-memory.dmp

Filesize
3.9MB

Download
memory/4416-2174-0x00007FF779A50000-0x00007FF779E42000-memory.dmp

Filesize
3.9MB

Download
memory/4416-119-0x00007FF779A50000-0x00007FF779E42000-memory.dmp

Filesize
3.9MB

Download
memory/4416-2093-0x00007FF779A50000-0x00007FF779E42000-memory.dmp

Filesize
3.9MB

Download
memory/4876-2114-0x00007FF719D00000-0x00007FF71A0F2000-memory.dmp

Filesize
3.9MB

Download
memory/4876-45-0x00007FF719D00000-0x00007FF71A0F2000-memory.dmp

Filesize
3.9MB

Download
memory/4924-2132-0x00007FF705360000-0x00007FF705752000-memory.dmp

Filesize
3.9MB

Download
memory/4924-94-0x00007FF705360000-0x00007FF705752000-memory.dmp

Filesize
3.9MB

Download
memory/4948-16-0x0000024FF2920000-0x0000024FF2930000-memory.dmp

Filesize
64KB

Download
memory/4948-17-0x0000024FF2920000-0x0000024FF2930000-memory.dmp

Filesize
64KB

Download
memory/4948-1843-0x00007FFAFE3C0000-0x00007FFAFEE81000-memory.dmp

Filesize
10.8MB

Download
memory/4948-1644-0x00007FFAFE3C0000-0x00007FFAFEE81000-memory.dmp

Filesize
10.8MB

Download
memory/4948-15-0x00007FFAFE3C0000-0x00007FFAFEE81000-memory.dmp

Filesize
10.8MB

Download
memory/4948-38-0x0000024FF2890000-0x0000024FF28B2000-memory.dmp

Filesize
136KB

Download
memory/5096-157-0x00007FF75EE60000-0x00007FF75F252000-memory.dmp

Filesize
3.9MB

Download
memory/5096-2094-0x00007FF75EE60000-0x00007FF75F252000-memory.dmp

Filesize
3.9MB

Download
memory/5096-2315-0x00007FF75EE60000-0x00007FF75F252000-memory.dmp

Filesize
3.9MB

Download