xmrig | 0127aee23390aff420220981ce1fa2065798060517dc8319c771761116c7010a

Analysis

max time kernel
40s
max time network
41s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 00:54

Sharing

Copy URL Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
Size

1.8MB
MD5

020bd1bff2e7bfabeab74b210cbf9d0e
SHA1

6c7c8c5118d3ec2f5fcb9c816e42a55490073956
SHA256

0127aee23390aff420220981ce1fa2065798060517dc8319c771761116c7010a
SHA512

ed614fe62842d3da6ab98a88ede6d6de1a9b563272a224129fa80e4e89926b592ecce3eccecaee2e5562cfcc566921e1505bf3995a285a1d2b64f48880b3b98e
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrl9:NABo

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 16 IoCs

miner

resource	yara_rule
behavioral2/memory/2900-72-0x00007FF676D10000-0x00007FF677102000-memory.dmp	xmrig
behavioral2/memory/3508-65-0x00007FF783E20000-0x00007FF784212000-memory.dmp	xmrig
behavioral2/memory/4260-61-0x00007FF6052A0000-0x00007FF605692000-memory.dmp	xmrig
behavioral2/memory/2780-57-0x00007FF6ACB70000-0x00007FF6ACF62000-memory.dmp	xmrig
behavioral2/memory/3880-37-0x00007FF792500000-0x00007FF7928F2000-memory.dmp	xmrig
behavioral2/memory/2100-28-0x00007FF63ABF0000-0x00007FF63AFE2000-memory.dmp	xmrig
behavioral2/memory/116-394-0x00007FF6F8110000-0x00007FF6F8502000-memory.dmp	xmrig
behavioral2/memory/1320-492-0x00007FF78C870000-0x00007FF78CC62000-memory.dmp	xmrig
behavioral2/memory/2244-537-0x00007FF7A2710000-0x00007FF7A2B02000-memory.dmp	xmrig
behavioral2/memory/5072-560-0x00007FF64C670000-0x00007FF64CA62000-memory.dmp	xmrig
behavioral2/memory/4564-568-0x00007FF76FAD0000-0x00007FF76FEC2000-memory.dmp	xmrig
behavioral2/memory/4828-566-0x00007FF62FF60000-0x00007FF630352000-memory.dmp	xmrig
behavioral2/memory/2484-565-0x00007FF6E6000000-0x00007FF6E63F2000-memory.dmp	xmrig
behavioral2/memory/116-3991-0x00007FF6F8110000-0x00007FF6F8502000-memory.dmp	xmrig
behavioral2/memory/4768-4308-0x00007FF7970B0000-0x00007FF7974A2000-memory.dmp	xmrig
behavioral2/memory/2184-4310-0x00007FF711430000-0x00007FF711822000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4248	ELQPYxx.exe
2100	uSWvBQI.exe
2780	MYPhpUo.exe
3880	YAeKHYZ.exe
4260	eeqrZrk.exe
3508	fQIowTq.exe
2964	jiNDeJb.exe
4240	egLpMND.exe
2900	NCdfUKF.exe
4088	klqfjSN.exe
116	qvQIlLS.exe
5072	gqnfsKa.exe
2484	KYweQad.exe
4588	hxRAgcD.exe
3412	KGUYDnC.exe
4768	lNPwXZc.exe
4828	dSfyQVl.exe
4564	sNSiHmc.exe
2184	eRmLDPg.exe
1320	tiEgDgU.exe
2244	gYQhlLZ.exe
4572	BCIeaEb.exe
3768	PxhmBJQ.exe
1332	ktQtlih.exe
4488	tGIhzQQ.exe
3320	RWpypTH.exe
1736	qkDwBJk.exe
1168	ufrssyt.exe
4004	rWcgzOC.exe
2120	EdIXxOR.exe
1648	IGOhauj.exe
364	FTxMXis.exe
4376	ukUoJon.exe
3088	RGkZqDW.exe
3736	FQZgddh.exe
4304	uDYJEBM.exe
4852	cyaGQdi.exe
1008	iaBzoap.exe
2700	mfJbihp.exe
372	yPIJUCz.exe
772	ZLvWEGR.exe
1616	UejFfak.exe
4196	DeLWtGE.exe
3964	HhsXsTe.exe
4016	JaqweBA.exe
444	DSsGcmf.exe
1812	gUrzHCX.exe
1644	iObxBtu.exe
4652	xchoOfq.exe
4784	zTwFcSr.exe
5040	EildTGn.exe
4220	GiaCOco.exe
3844	uFAXXRr.exe
396	hJUjCqZ.exe
5096	zEjJeXb.exe
4644	xvFWAwu.exe
3660	RdvJGQC.exe
3636	pGEVYZC.exe
4772	ALhWjap.exe
1316	rFDbbaH.exe
4912	bxYFFpg.exe
976	XJeWDaK.exe
3484	NKwOnhR.exe
2696	VHQfvQW.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/808-0-0x00007FF6B2CA0000-0x00007FF6B3092000-memory.dmp	upx
behavioral2/files/0x000a000000023bb6-7.dat	upx
behavioral2/files/0x000a000000023bb5-11.dat	upx
behavioral2/files/0x000a000000023bb7-25.dat	upx
behavioral2/files/0x000a000000023bba-49.dat	upx
behavioral2/files/0x000a000000023bb9-51.dat	upx
behavioral2/memory/2900-72-0x00007FF676D10000-0x00007FF677102000-memory.dmp	upx
behavioral2/memory/4088-78-0x00007FF6C7BA0000-0x00007FF6C7F92000-memory.dmp	upx
behavioral2/memory/4240-75-0x00007FF7A0C20000-0x00007FF7A1012000-memory.dmp	upx
behavioral2/files/0x0031000000023bbe-69.dat	upx
behavioral2/files/0x0032000000023bbd-67.dat	upx
behavioral2/files/0x000a000000023bbb-66.dat	upx
behavioral2/memory/3508-65-0x00007FF783E20000-0x00007FF784212000-memory.dmp	upx
behavioral2/memory/4260-61-0x00007FF6052A0000-0x00007FF605692000-memory.dmp	upx
behavioral2/memory/2780-57-0x00007FF6ACB70000-0x00007FF6ACF62000-memory.dmp	upx
behavioral2/memory/2964-50-0x00007FF75D5A0000-0x00007FF75D992000-memory.dmp	upx
behavioral2/memory/3880-37-0x00007FF792500000-0x00007FF7928F2000-memory.dmp	upx
behavioral2/files/0x000a000000023bb8-34.dat	upx
behavioral2/memory/2100-28-0x00007FF63ABF0000-0x00007FF63AFE2000-memory.dmp	upx
behavioral2/memory/4248-10-0x00007FF612260000-0x00007FF612652000-memory.dmp	upx
behavioral2/files/0x000a000000023be6-392.dat	upx
behavioral2/files/0x000a000000023bdf-385.dat	upx
behavioral2/files/0x000a000000023bdc-382.dat	upx
behavioral2/files/0x000a000000023bd1-371.dat	upx
behavioral2/files/0x000b000000023be7-393.dat	upx
behavioral2/files/0x000a000000023be5-391.dat	upx
behavioral2/files/0x000a000000023be4-390.dat	upx
behavioral2/files/0x000a000000023be3-389.dat	upx
behavioral2/files/0x000a000000023be2-388.dat	upx
behavioral2/files/0x000a000000023be1-387.dat	upx
behavioral2/files/0x000a000000023be0-386.dat	upx
behavioral2/files/0x000a000000023bde-384.dat	upx
behavioral2/files/0x000a000000023bdd-383.dat	upx
behavioral2/files/0x000a000000023bdb-381.dat	upx
behavioral2/files/0x000a000000023bda-380.dat	upx
behavioral2/files/0x000a000000023bd9-379.dat	upx
behavioral2/files/0x000a000000023bd8-378.dat	upx
behavioral2/files/0x000a000000023bd7-377.dat	upx
behavioral2/files/0x000a000000023bd6-376.dat	upx
behavioral2/files/0x000a000000023bd5-375.dat	upx
behavioral2/files/0x000a000000023bd4-374.dat	upx
behavioral2/files/0x000a000000023bd3-373.dat	upx
behavioral2/files/0x000a000000023bd2-372.dat	upx
behavioral2/files/0x000a000000023bd0-370.dat	upx
behavioral2/files/0x000a000000023bcf-369.dat	upx
behavioral2/files/0x000a000000023bce-368.dat	upx
behavioral2/files/0x000a000000023bcc-366.dat	upx
behavioral2/files/0x000a000000023bcb-365.dat	upx
behavioral2/files/0x000a000000023bca-364.dat	upx
behavioral2/files/0x000a000000023bc9-363.dat	upx
behavioral2/files/0x000a000000023bc8-362.dat	upx
behavioral2/files/0x000a000000023bc7-361.dat	upx
behavioral2/files/0x000a000000023bc6-360.dat	upx
behavioral2/files/0x000a000000023bc5-359.dat	upx
behavioral2/files/0x000a000000023bc4-358.dat	upx
behavioral2/files/0x000a000000023bc3-357.dat	upx
behavioral2/files/0x000a000000023bc0-355.dat	upx
behavioral2/files/0x000c000000023bb1-354.dat	upx
behavioral2/files/0x000b000000023bbc-353.dat	upx
behavioral2/files/0x0031000000023bbf-351.dat	upx
behavioral2/files/0x0007000000023cdc-349.dat	upx
behavioral2/memory/116-394-0x00007FF6F8110000-0x00007FF6F8502000-memory.dmp	upx
behavioral2/files/0x000a000000023bcd-367.dat	upx
behavioral2/files/0x000a000000023bc1-356.dat	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ieNQvoK.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\tRiCmOi.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\QRJluth.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\ZgzRShr.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\ZilshdN.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\SCbVmxY.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\wOClEHf.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\LgFxDdb.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\QIsYswk.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\mGVJJDI.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\ZxcHQcY.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\AXKrRjk.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\ZSAqVfV.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\qKEoHKX.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\fLEpyMV.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\tkmYMch.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\TkLDEIW.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\cpzmqoc.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\YdIQijD.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\QTkZsTb.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\bQHwAjO.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\SyTxATk.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\jAEvUNk.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\LzYxTPD.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\zqeNBXG.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\ZOYTeBG.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\iNdTICS.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\uZgyiFr.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\IxJWHgt.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\zoxfmvs.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\MpCHdOG.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\AbtXeby.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\oQsEUwV.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\hVwcrll.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\ltUyKzK.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\aLdWZEi.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\EsnPKFE.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\zTwFcSr.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\ZDshoAh.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\WDIHrnF.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\USPfiGC.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\mbSOmFM.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\wfIRrRB.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\jWgVHbR.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\AMLLJLf.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\AUeOkUu.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\FVkIyyj.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\ccwMwtc.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\uiHMwwf.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\YgydfJN.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\TEmObgu.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\hxRAgcD.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\jIpoRBM.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\PdcaoiW.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\xaJuWjE.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\sUmNTFt.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\JTYrgUb.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\wwsFXVv.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\dvHLZAe.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\cIaLWeQ.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\MyhidLf.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\wKEffyD.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\okSpEWJ.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\XNJewGM.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3160	powershell.exe
3160	powershell.exe
3160	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
Token: SeDebugPrivilege	3160	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 808 wrote to memory of 3160	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	84
PID 808 wrote to memory of 3160	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	84
PID 808 wrote to memory of 4248	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	85
PID 808 wrote to memory of 4248	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	85
PID 808 wrote to memory of 2100	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	86
PID 808 wrote to memory of 2100	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	86
PID 808 wrote to memory of 2780	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	87
PID 808 wrote to memory of 2780	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	87
PID 808 wrote to memory of 3880	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	88
PID 808 wrote to memory of 3880	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	88
PID 808 wrote to memory of 4260	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	89
PID 808 wrote to memory of 4260	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	89
PID 808 wrote to memory of 3508	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	90
PID 808 wrote to memory of 3508	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	90
PID 808 wrote to memory of 2964	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	91
PID 808 wrote to memory of 2964	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	91
PID 808 wrote to memory of 4240	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	92
PID 808 wrote to memory of 4240	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	92
PID 808 wrote to memory of 2900	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	93
PID 808 wrote to memory of 2900	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	93
PID 808 wrote to memory of 4088	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	94
PID 808 wrote to memory of 4088	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	94
PID 808 wrote to memory of 5072	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	95
PID 808 wrote to memory of 5072	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	95
PID 808 wrote to memory of 2484	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	96
PID 808 wrote to memory of 2484	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	96
PID 808 wrote to memory of 4588	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	97
PID 808 wrote to memory of 4588	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	97
PID 808 wrote to memory of 3412	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	98
PID 808 wrote to memory of 3412	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	98
PID 808 wrote to memory of 4768	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	99
PID 808 wrote to memory of 4768	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	99
PID 808 wrote to memory of 2876	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	100
PID 808 wrote to memory of 2876	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	100
PID 808 wrote to memory of 4828	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	101
PID 808 wrote to memory of 4828	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	101
PID 808 wrote to memory of 4564	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	102
PID 808 wrote to memory of 4564	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	102
PID 808 wrote to memory of 2184	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	103
PID 808 wrote to memory of 2184	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	103
PID 808 wrote to memory of 1320	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	104
PID 808 wrote to memory of 1320	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	104
PID 808 wrote to memory of 2244	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	105
PID 808 wrote to memory of 2244	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	105
PID 808 wrote to memory of 4572	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	106
PID 808 wrote to memory of 4572	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	106
PID 808 wrote to memory of 3768	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	107
PID 808 wrote to memory of 3768	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	107
PID 808 wrote to memory of 1332	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	108
PID 808 wrote to memory of 1332	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	108
PID 808 wrote to memory of 4488	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	109
PID 808 wrote to memory of 4488	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	109
PID 808 wrote to memory of 3320	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	110
PID 808 wrote to memory of 3320	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	110
PID 808 wrote to memory of 1736	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	111
PID 808 wrote to memory of 1736	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	111
PID 808 wrote to memory of 1168	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	112
PID 808 wrote to memory of 1168	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	112
PID 808 wrote to memory of 4004	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	113
PID 808 wrote to memory of 4004	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	113
PID 808 wrote to memory of 2120	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	114
PID 808 wrote to memory of 2120	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	114
PID 808 wrote to memory of 1648	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	115
PID 808 wrote to memory of 1648	808	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3160
- C:\Windows\System\ELQPYxx.exe
  C:\Windows\System\ELQPYxx.exe
  2⤵
  - Executes dropped EXE
  PID:4248
- C:\Windows\System\uSWvBQI.exe
  C:\Windows\System\uSWvBQI.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\MYPhpUo.exe
  C:\Windows\System\MYPhpUo.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\YAeKHYZ.exe
  C:\Windows\System\YAeKHYZ.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\eeqrZrk.exe
  C:\Windows\System\eeqrZrk.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\fQIowTq.exe
  C:\Windows\System\fQIowTq.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\jiNDeJb.exe
  C:\Windows\System\jiNDeJb.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\egLpMND.exe
  C:\Windows\System\egLpMND.exe
  2⤵
  - Executes dropped EXE
  PID:4240
- C:\Windows\System\NCdfUKF.exe
  C:\Windows\System\NCdfUKF.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\klqfjSN.exe
  C:\Windows\System\klqfjSN.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\gqnfsKa.exe
  C:\Windows\System\gqnfsKa.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\KYweQad.exe
  C:\Windows\System\KYweQad.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\hxRAgcD.exe
  C:\Windows\System\hxRAgcD.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\KGUYDnC.exe
  C:\Windows\System\KGUYDnC.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\lNPwXZc.exe
  C:\Windows\System\lNPwXZc.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\SeskjRA.exe
  C:\Windows\System\SeskjRA.exe
  2⤵
  PID:2876
- C:\Windows\System\dSfyQVl.exe
  C:\Windows\System\dSfyQVl.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\sNSiHmc.exe
  C:\Windows\System\sNSiHmc.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\eRmLDPg.exe
  C:\Windows\System\eRmLDPg.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\tiEgDgU.exe
  C:\Windows\System\tiEgDgU.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\gYQhlLZ.exe
  C:\Windows\System\gYQhlLZ.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\BCIeaEb.exe
  C:\Windows\System\BCIeaEb.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\PxhmBJQ.exe
  C:\Windows\System\PxhmBJQ.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\ktQtlih.exe
  C:\Windows\System\ktQtlih.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\tGIhzQQ.exe
  C:\Windows\System\tGIhzQQ.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\RWpypTH.exe
  C:\Windows\System\RWpypTH.exe
  2⤵
  - Executes dropped EXE
  PID:3320
- C:\Windows\System\qkDwBJk.exe
  C:\Windows\System\qkDwBJk.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\ufrssyt.exe
  C:\Windows\System\ufrssyt.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\rWcgzOC.exe
  C:\Windows\System\rWcgzOC.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\EdIXxOR.exe
  C:\Windows\System\EdIXxOR.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\IGOhauj.exe
  C:\Windows\System\IGOhauj.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\FTxMXis.exe
  C:\Windows\System\FTxMXis.exe
  2⤵
  - Executes dropped EXE
  PID:364
- C:\Windows\System\ukUoJon.exe
  C:\Windows\System\ukUoJon.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\RGkZqDW.exe
  C:\Windows\System\RGkZqDW.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\FQZgddh.exe
  C:\Windows\System\FQZgddh.exe
  2⤵
  - Executes dropped EXE
  PID:3736
- C:\Windows\System\uDYJEBM.exe
  C:\Windows\System\uDYJEBM.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\cyaGQdi.exe
  C:\Windows\System\cyaGQdi.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\iaBzoap.exe
  C:\Windows\System\iaBzoap.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\mfJbihp.exe
  C:\Windows\System\mfJbihp.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\yPIJUCz.exe
  C:\Windows\System\yPIJUCz.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\ZLvWEGR.exe
  C:\Windows\System\ZLvWEGR.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\UejFfak.exe
  C:\Windows\System\UejFfak.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\DeLWtGE.exe
  C:\Windows\System\DeLWtGE.exe
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Windows\System\HhsXsTe.exe
  C:\Windows\System\HhsXsTe.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\JaqweBA.exe
  C:\Windows\System\JaqweBA.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\DSsGcmf.exe
  C:\Windows\System\DSsGcmf.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System\gUrzHCX.exe
  C:\Windows\System\gUrzHCX.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\iObxBtu.exe
  C:\Windows\System\iObxBtu.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\xchoOfq.exe
  C:\Windows\System\xchoOfq.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\zTwFcSr.exe
  C:\Windows\System\zTwFcSr.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\EildTGn.exe
  C:\Windows\System\EildTGn.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\GiaCOco.exe
  C:\Windows\System\GiaCOco.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\uFAXXRr.exe
  C:\Windows\System\uFAXXRr.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System\hJUjCqZ.exe
  C:\Windows\System\hJUjCqZ.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\zEjJeXb.exe
  C:\Windows\System\zEjJeXb.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\xvFWAwu.exe
  C:\Windows\System\xvFWAwu.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\RdvJGQC.exe
  C:\Windows\System\RdvJGQC.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\pGEVYZC.exe
  C:\Windows\System\pGEVYZC.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\ALhWjap.exe
  C:\Windows\System\ALhWjap.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\rFDbbaH.exe
  C:\Windows\System\rFDbbaH.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\bxYFFpg.exe
  C:\Windows\System\bxYFFpg.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\XJeWDaK.exe
  C:\Windows\System\XJeWDaK.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\NKwOnhR.exe
  C:\Windows\System\NKwOnhR.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\VHQfvQW.exe
  C:\Windows\System\VHQfvQW.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\EDiUNFR.exe
  C:\Windows\System\EDiUNFR.exe
  2⤵
  PID:2224
- C:\Windows\System\RfOuMtz.exe
  C:\Windows\System\RfOuMtz.exe
  2⤵
  PID:408
- C:\Windows\System\zTofxtl.exe
  C:\Windows\System\zTofxtl.exe
  2⤵
  PID:3896
- C:\Windows\System\rbccrkn.exe
  C:\Windows\System\rbccrkn.exe
  2⤵
  PID:1780
- C:\Windows\System\zVOciGC.exe
  C:\Windows\System\zVOciGC.exe
  2⤵
  PID:2860
- C:\Windows\System\cqduuUj.exe
  C:\Windows\System\cqduuUj.exe
  2⤵
  PID:3148
- C:\Windows\System\vIpxfIL.exe
  C:\Windows\System\vIpxfIL.exe
  2⤵
  PID:4396
- C:\Windows\System\nnbueHo.exe
  C:\Windows\System\nnbueHo.exe
  2⤵
  PID:1036
- C:\Windows\System\uAQtOer.exe
  C:\Windows\System\uAQtOer.exe
  2⤵
  PID:1704
- C:\Windows\System\QbpfeyT.exe
  C:\Windows\System\QbpfeyT.exe
  2⤵
  PID:400
- C:\Windows\System\LIWAQgK.exe
  C:\Windows\System\LIWAQgK.exe
  2⤵
  PID:4200
- C:\Windows\System\HffXJhh.exe
  C:\Windows\System\HffXJhh.exe
  2⤵
  PID:4468
- C:\Windows\System\eBqrYOc.exe
  C:\Windows\System\eBqrYOc.exe
  2⤵
  PID:5012
- C:\Windows\System\cVWNwcl.exe
  C:\Windows\System\cVWNwcl.exe
  2⤵
  PID:2732
- C:\Windows\System\VDqUHbg.exe
  C:\Windows\System\VDqUHbg.exe
  2⤵
  PID:3468
- C:\Windows\System\KpQLUyf.exe
  C:\Windows\System\KpQLUyf.exe
  2⤵
  PID:2324
- C:\Windows\System\ltjzHRW.exe
  C:\Windows\System\ltjzHRW.exe
  2⤵
  PID:4952
- C:\Windows\System\KpIKjbv.exe
  C:\Windows\System\KpIKjbv.exe
  2⤵
  PID:4340
- C:\Windows\System\dDedDqa.exe
  C:\Windows\System\dDedDqa.exe
  2⤵
  PID:4336
- C:\Windows\System\TrzlAeh.exe
  C:\Windows\System\TrzlAeh.exe
  2⤵
  PID:4796
- C:\Windows\System\zyUquOd.exe
  C:\Windows\System\zyUquOd.exe
  2⤵
  PID:60
- C:\Windows\System\Hnnxylt.exe
  C:\Windows\System\Hnnxylt.exe
  2⤵
  PID:3960
- C:\Windows\System\UyBFmxS.exe
  C:\Windows\System\UyBFmxS.exe
  2⤵
  PID:3648
- C:\Windows\System\AflMkIu.exe
  C:\Windows\System\AflMkIu.exe
  2⤵
  PID:4464
- C:\Windows\System\MwyUVpc.exe
  C:\Windows\System\MwyUVpc.exe
  2⤵
  PID:536
- C:\Windows\System\tIWcmhC.exe
  C:\Windows\System\tIWcmhC.exe
  2⤵
  PID:1416
- C:\Windows\System\liMoHUJ.exe
  C:\Windows\System\liMoHUJ.exe
  2⤵
  PID:4532
- C:\Windows\System\cWpTlxf.exe
  C:\Windows\System\cWpTlxf.exe
  2⤵
  PID:2492
- C:\Windows\System\XVCPxpe.exe
  C:\Windows\System\XVCPxpe.exe
  2⤵
  PID:3872
- C:\Windows\System\YJViunS.exe
  C:\Windows\System\YJViunS.exe
  2⤵
  PID:2080
- C:\Windows\System\lbEeeHo.exe
  C:\Windows\System\lbEeeHo.exe
  2⤵
  PID:3104
- C:\Windows\System\iQpifdp.exe
  C:\Windows\System\iQpifdp.exe
  2⤵
  PID:4692
- C:\Windows\System\pYBUGtX.exe
  C:\Windows\System\pYBUGtX.exe
  2⤵
  PID:208
- C:\Windows\System\rkJwaPX.exe
  C:\Windows\System\rkJwaPX.exe
  2⤵
  PID:4820
- C:\Windows\System\CByGOAL.exe
  C:\Windows\System\CByGOAL.exe
  2⤵
  PID:1800
- C:\Windows\System\IOKTMqS.exe
  C:\Windows\System\IOKTMqS.exe
  2⤵
  PID:3424
- C:\Windows\System\jcNFXZA.exe
  C:\Windows\System\jcNFXZA.exe
  2⤵
  PID:1104
- C:\Windows\System\ONGEpAq.exe
  C:\Windows\System\ONGEpAq.exe
  2⤵
  PID:2916
- C:\Windows\System\vOyhprD.exe
  C:\Windows\System\vOyhprD.exe
  2⤵
  PID:4632
- C:\Windows\System\LbIOLOe.exe
  C:\Windows\System\LbIOLOe.exe
  2⤵
  PID:2848
- C:\Windows\System\DkjFjeK.exe
  C:\Windows\System\DkjFjeK.exe
  2⤵
  PID:3544
- C:\Windows\System\KbselfK.exe
  C:\Windows\System\KbselfK.exe
  2⤵
  PID:3396
- C:\Windows\System\IHkhrkv.exe
  C:\Windows\System\IHkhrkv.exe
  2⤵
  PID:4744
- C:\Windows\System\ligpTdw.exe
  C:\Windows\System\ligpTdw.exe
  2⤵
  PID:4008
- C:\Windows\System\FbrKeae.exe
  C:\Windows\System\FbrKeae.exe
  2⤵
  PID:4036
- C:\Windows\System\RQyFHVz.exe
  C:\Windows\System\RQyFHVz.exe
  2⤵
  PID:2816
- C:\Windows\System\XWhOzlj.exe
  C:\Windows\System\XWhOzlj.exe
  2⤵
  PID:4896
- C:\Windows\System\cwFtsSL.exe
  C:\Windows\System\cwFtsSL.exe
  2⤵
  PID:952
- C:\Windows\System\fXtUtwX.exe
  C:\Windows\System\fXtUtwX.exe
  2⤵
  PID:4840
- C:\Windows\System\VdiRAaX.exe
  C:\Windows\System\VdiRAaX.exe
  2⤵
  PID:2540
- C:\Windows\System\CkdSYki.exe
  C:\Windows\System\CkdSYki.exe
  2⤵
  PID:2132
- C:\Windows\System\WfUKHwp.exe
  C:\Windows\System\WfUKHwp.exe
  2⤵
  PID:3400
- C:\Windows\System\ziayfbv.exe
  C:\Windows\System\ziayfbv.exe
  2⤵
  PID:1352
- C:\Windows\System\FOasGAL.exe
  C:\Windows\System\FOasGAL.exe
  2⤵
  PID:4856
- C:\Windows\System\BoYgpyf.exe
  C:\Windows\System\BoYgpyf.exe
  2⤵
  PID:4984
- C:\Windows\System\pyuBRUo.exe
  C:\Windows\System\pyuBRUo.exe
  2⤵
  PID:3656
- C:\Windows\System\BhyupIB.exe
  C:\Windows\System\BhyupIB.exe
  2⤵
  PID:3428
- C:\Windows\System\CbkJfzM.exe
  C:\Windows\System\CbkJfzM.exe
  2⤵
  PID:4592
- C:\Windows\System\QtEDYhE.exe
  C:\Windows\System\QtEDYhE.exe
  2⤵
  PID:3916
- C:\Windows\System\hnaehYL.exe
  C:\Windows\System\hnaehYL.exe
  2⤵
  PID:4056
- C:\Windows\System\LSLgPCF.exe
  C:\Windows\System\LSLgPCF.exe
  2⤵
  PID:3032
- C:\Windows\System\fmUymKo.exe
  C:\Windows\System\fmUymKo.exe
  2⤵
  PID:316
- C:\Windows\System\YjBJSzu.exe
  C:\Windows\System\YjBJSzu.exe
  2⤵
  PID:5064
- C:\Windows\System\sbhfXMS.exe
  C:\Windows\System\sbhfXMS.exe
  2⤵
  PID:3060
- C:\Windows\System\tjKTZcd.exe
  C:\Windows\System\tjKTZcd.exe
  2⤵
  PID:512
- C:\Windows\System\bLTdETU.exe
  C:\Windows\System\bLTdETU.exe
  2⤵
  PID:1572
- C:\Windows\System\Ealurvk.exe
  C:\Windows\System\Ealurvk.exe
  2⤵
  PID:2228
- C:\Windows\System\UbREnXR.exe
  C:\Windows\System\UbREnXR.exe
  2⤵
  PID:3376
- C:\Windows\System\YKzpYaa.exe
  C:\Windows\System\YKzpYaa.exe
  2⤵
  PID:5076
- C:\Windows\System\DBQxzbo.exe
  C:\Windows\System\DBQxzbo.exe
  2⤵
  PID:920
- C:\Windows\System\RWAzDdL.exe
  C:\Windows\System\RWAzDdL.exe
  2⤵
  PID:4284
- C:\Windows\System\XQPcuWI.exe
  C:\Windows\System\XQPcuWI.exe
  2⤵
  PID:3120
- C:\Windows\System\pvdhDGp.exe
  C:\Windows\System\pvdhDGp.exe
  2⤵
  PID:2388
- C:\Windows\System\DnxTqrU.exe
  C:\Windows\System\DnxTqrU.exe
  2⤵
  PID:2960
- C:\Windows\System\pByxieh.exe
  C:\Windows\System\pByxieh.exe
  2⤵
  PID:2980
- C:\Windows\System\pmUNJGt.exe
  C:\Windows\System\pmUNJGt.exe
  2⤵
  PID:3560
- C:\Windows\System\STgJpyW.exe
  C:\Windows\System\STgJpyW.exe
  2⤵
  PID:1776
- C:\Windows\System\XtJtxfb.exe
  C:\Windows\System\XtJtxfb.exe
  2⤵
  PID:4924
- C:\Windows\System\WdQqzLQ.exe
  C:\Windows\System\WdQqzLQ.exe
  2⤵
  PID:3980
- C:\Windows\System\QKrpVLb.exe
  C:\Windows\System\QKrpVLb.exe
  2⤵
  PID:4888
- C:\Windows\System\ucVXCgX.exe
  C:\Windows\System\ucVXCgX.exe
  2⤵
  PID:688
- C:\Windows\System\jROewts.exe
  C:\Windows\System\jROewts.exe
  2⤵
  PID:1608
- C:\Windows\System\HnqefGb.exe
  C:\Windows\System\HnqefGb.exe
  2⤵
  PID:1784
- C:\Windows\System\qvQIlLS.exe
  C:\Windows\System\qvQIlLS.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\hGJbthA.exe
  C:\Windows\System\hGJbthA.exe
  2⤵
  PID:740
- C:\Windows\System\ZJxpaoL.exe
  C:\Windows\System\ZJxpaoL.exe
  2⤵
  PID:2176
- C:\Windows\System\zwrxGDA.exe
  C:\Windows\System\zwrxGDA.exe
  2⤵
  PID:4424
- C:\Windows\System\vszmVzd.exe
  C:\Windows\System\vszmVzd.exe
  2⤵
  PID:5788
- C:\Windows\System\wfvyaxs.exe
  C:\Windows\System\wfvyaxs.exe
  2⤵
  PID:6140
- C:\Windows\System\EcgiwTT.exe
  C:\Windows\System\EcgiwTT.exe
  2⤵
  PID:1400
- C:\Windows\System\ynNvfnr.exe
  C:\Windows\System\ynNvfnr.exe
  2⤵
  PID:6420
- C:\Windows\System\nyeHNrl.exe
  C:\Windows\System\nyeHNrl.exe
  2⤵
  PID:6476
- C:\Windows\System\CvRrzpQ.exe
  C:\Windows\System\CvRrzpQ.exe
  2⤵
  PID:6504
- C:\Windows\System\ANUTPPu.exe
  C:\Windows\System\ANUTPPu.exe
  2⤵
  PID:6556
- C:\Windows\System\TFoAELp.exe
  C:\Windows\System\TFoAELp.exe
  2⤵
  PID:6692
- C:\Windows\System\jIpoRBM.exe
  C:\Windows\System\jIpoRBM.exe
  2⤵
  PID:6792
- C:\Windows\System\MRMSlSj.exe
  C:\Windows\System\MRMSlSj.exe
  2⤵
  PID:6812
- C:\Windows\System\JJeemvd.exe
  C:\Windows\System\JJeemvd.exe
  2⤵
  PID:6832
- C:\Windows\System\bdARkMv.exe
  C:\Windows\System\bdARkMv.exe
  2⤵
  PID:6848
- C:\Windows\System\nCtRjrA.exe
  C:\Windows\System\nCtRjrA.exe
  2⤵
  PID:6864
- C:\Windows\System\ZpsQkJH.exe
  C:\Windows\System\ZpsQkJH.exe
  2⤵
  PID:6880
- C:\Windows\System\fcEOmNf.exe
  C:\Windows\System\fcEOmNf.exe
  2⤵
  PID:6896
- C:\Windows\System\FqmMDUh.exe
  C:\Windows\System\FqmMDUh.exe
  2⤵
  PID:6912
- C:\Windows\System\WRlvTra.exe
  C:\Windows\System\WRlvTra.exe
  2⤵
  PID:6928
- C:\Windows\System\LFNOOtG.exe
  C:\Windows\System\LFNOOtG.exe
  2⤵
  PID:6948
- C:\Windows\System\TqSsMwS.exe
  C:\Windows\System\TqSsMwS.exe
  2⤵
  PID:6976
- C:\Windows\System\fHeQfyg.exe
  C:\Windows\System\fHeQfyg.exe
  2⤵
  PID:7100
- C:\Windows\System\rAycwFu.exe
  C:\Windows\System\rAycwFu.exe
  2⤵
  PID:7160
- C:\Windows\System\ZDshoAh.exe
  C:\Windows\System\ZDshoAh.exe
  2⤵
  PID:5984
- C:\Windows\System\ZGOVmEk.exe
  C:\Windows\System\ZGOVmEk.exe
  2⤵
  PID:5344
- C:\Windows\System\vBinSmH.exe
  C:\Windows\System\vBinSmH.exe
  2⤵
  PID:5856
- C:\Windows\System\kEfdYzj.exe
  C:\Windows\System\kEfdYzj.exe
  2⤵
  PID:5472
- C:\Windows\System\fOiavUE.exe
  C:\Windows\System\fOiavUE.exe
  2⤵
  PID:5576
- C:\Windows\System\VlIMuuZ.exe
  C:\Windows\System\VlIMuuZ.exe
  2⤵
  PID:6220
- C:\Windows\System\QGGPRyU.exe
  C:\Windows\System\QGGPRyU.exe
  2⤵
  PID:6264
- C:\Windows\System\PUYnKKu.exe
  C:\Windows\System\PUYnKKu.exe
  2⤵
  PID:5644
- C:\Windows\System\eVtwUnR.exe
  C:\Windows\System\eVtwUnR.exe
  2⤵
  PID:5728
- C:\Windows\System\ChHzhUW.exe
  C:\Windows\System\ChHzhUW.exe
  2⤵
  PID:5036
- C:\Windows\System\VAQpSkP.exe
  C:\Windows\System\VAQpSkP.exe
  2⤵
  PID:6084
- C:\Windows\System\ncnreNl.exe
  C:\Windows\System\ncnreNl.exe
  2⤵
  PID:5256
- C:\Windows\System\JuIkrMr.exe
  C:\Windows\System\JuIkrMr.exe
  2⤵
  PID:5396
- C:\Windows\System\rPHVFZg.exe
  C:\Windows\System\rPHVFZg.exe
  2⤵
  PID:6148
- C:\Windows\System\jhfbrpO.exe
  C:\Windows\System\jhfbrpO.exe
  2⤵
  PID:6312
- C:\Windows\System\dVozPSw.exe
  C:\Windows\System\dVozPSw.exe
  2⤵
  PID:6388
- C:\Windows\System\tRNbeso.exe
  C:\Windows\System\tRNbeso.exe
  2⤵
  PID:6496
- C:\Windows\System\UtsXMND.exe
  C:\Windows\System\UtsXMND.exe
  2⤵
  PID:5100
- C:\Windows\System\stgGMsE.exe
  C:\Windows\System\stgGMsE.exe
  2⤵
  PID:6788
- C:\Windows\System\qOjLbFc.exe
  C:\Windows\System\qOjLbFc.exe
  2⤵
  PID:6844
- C:\Windows\System\HIcwAyV.exe
  C:\Windows\System\HIcwAyV.exe
  2⤵
  PID:6904
- C:\Windows\System\chFDcyk.exe
  C:\Windows\System\chFDcyk.exe
  2⤵
  PID:6960
- C:\Windows\System\RnrgmJh.exe
  C:\Windows\System\RnrgmJh.exe
  2⤵
  PID:7024
- C:\Windows\System\Orvqepw.exe
  C:\Windows\System\Orvqepw.exe
  2⤵
  PID:2460
- C:\Windows\System\jCgNHnR.exe
  C:\Windows\System\jCgNHnR.exe
  2⤵
  PID:7124
- C:\Windows\System\CINbGFS.exe
  C:\Windows\System\CINbGFS.exe
  2⤵
  PID:1624
- C:\Windows\System\YkxwvJL.exe
  C:\Windows\System\YkxwvJL.exe
  2⤵
  PID:5448
- C:\Windows\System\SogZrxt.exe
  C:\Windows\System\SogZrxt.exe
  2⤵
  PID:6192
- C:\Windows\System\FWYLzEg.exe
  C:\Windows\System\FWYLzEg.exe
  2⤵
  PID:5684
- C:\Windows\System\FGAeXhT.exe
  C:\Windows\System\FGAeXhT.exe
  2⤵
  PID:6564
- C:\Windows\System\OQZuctB.exe
  C:\Windows\System\OQZuctB.exe
  2⤵
  PID:6356
- C:\Windows\System\AGDpAGC.exe
  C:\Windows\System\AGDpAGC.exe
  2⤵
  PID:6428
- C:\Windows\System\hAhAzqn.exe
  C:\Windows\System\hAhAzqn.exe
  2⤵
  PID:6672
- C:\Windows\System\XCyipIW.exe
  C:\Windows\System\XCyipIW.exe
  2⤵
  PID:6784
- C:\Windows\System\pEEFByU.exe
  C:\Windows\System\pEEFByU.exe
  2⤵
  PID:7000
- C:\Windows\System\uKbCEYO.exe
  C:\Windows\System\uKbCEYO.exe
  2⤵
  PID:7112
- C:\Windows\System\YIGYElY.exe
  C:\Windows\System\YIGYElY.exe
  2⤵
  PID:5848
- C:\Windows\System\neEpiYK.exe
  C:\Windows\System\neEpiYK.exe
  2⤵
  PID:912
- C:\Windows\System\lxTjlTK.exe
  C:\Windows\System\lxTjlTK.exe
  2⤵
  PID:5620
- C:\Windows\System\alLokmE.exe
  C:\Windows\System\alLokmE.exe
  2⤵
  PID:1728
- C:\Windows\System\mUaHUBB.exe
  C:\Windows\System\mUaHUBB.exe
  2⤵
  PID:5332
- C:\Windows\System\pkFaYxe.exe
  C:\Windows\System\pkFaYxe.exe
  2⤵
  PID:2412
- C:\Windows\System\bTrflgu.exe
  C:\Windows\System\bTrflgu.exe
  2⤵
  PID:5840
- C:\Windows\System\prUAzve.exe
  C:\Windows\System\prUAzve.exe
  2⤵
  PID:6368
- C:\Windows\System\lKVRiAZ.exe
  C:\Windows\System\lKVRiAZ.exe
  2⤵
  PID:6956
- C:\Windows\System\qwtXcFr.exe
  C:\Windows\System\qwtXcFr.exe
  2⤵
  PID:5968
- C:\Windows\System\DrmpoTo.exe
  C:\Windows\System\DrmpoTo.exe
  2⤵
  PID:5588
- C:\Windows\System\AawookX.exe
  C:\Windows\System\AawookX.exe
  2⤵
  PID:2836
- C:\Windows\System\AUjimxk.exe
  C:\Windows\System\AUjimxk.exe
  2⤵
  PID:5028
- C:\Windows\System\KSFWXNH.exe
  C:\Windows\System\KSFWXNH.exe
  2⤵
  PID:6708
- C:\Windows\System\VfKrFBW.exe
  C:\Windows\System\VfKrFBW.exe
  2⤵
  PID:4944
- C:\Windows\System\eiZBgKC.exe
  C:\Windows\System\eiZBgKC.exe
  2⤵
  PID:5408
- C:\Windows\System\wqZJwwr.exe
  C:\Windows\System\wqZJwwr.exe
  2⤵
  PID:4508
- C:\Windows\System\FEbwHEN.exe
  C:\Windows\System\FEbwHEN.exe
  2⤵
  PID:3528
- C:\Windows\System\HvaWoNq.exe
  C:\Windows\System\HvaWoNq.exe
  2⤵
  PID:6704
- C:\Windows\System\kbnylyj.exe
  C:\Windows\System\kbnylyj.exe
  2⤵
  PID:7176
- C:\Windows\System\CIeKeSZ.exe
  C:\Windows\System\CIeKeSZ.exe
  2⤵
  PID:7196
- C:\Windows\System\Jromtkk.exe
  C:\Windows\System\Jromtkk.exe
  2⤵
  PID:7224
- C:\Windows\System\cfIBAwX.exe
  C:\Windows\System\cfIBAwX.exe
  2⤵
  PID:7248
- C:\Windows\System\ZilshdN.exe
  C:\Windows\System\ZilshdN.exe
  2⤵
  PID:7268
- C:\Windows\System\ziFsDWX.exe
  C:\Windows\System\ziFsDWX.exe
  2⤵
  PID:7296
- C:\Windows\System\qALxoOY.exe
  C:\Windows\System\qALxoOY.exe
  2⤵
  PID:7324
- C:\Windows\System\yyzzdpb.exe
  C:\Windows\System\yyzzdpb.exe
  2⤵
  PID:7348
- C:\Windows\System\jGSdNgw.exe
  C:\Windows\System\jGSdNgw.exe
  2⤵
  PID:7368
- C:\Windows\System\PdiqSeP.exe
  C:\Windows\System\PdiqSeP.exe
  2⤵
  PID:7440
- C:\Windows\System\eZlfHBQ.exe
  C:\Windows\System\eZlfHBQ.exe
  2⤵
  PID:7464
- C:\Windows\System\QItVUSc.exe
  C:\Windows\System\QItVUSc.exe
  2⤵
  PID:7484
- C:\Windows\System\zHtcphl.exe
  C:\Windows\System\zHtcphl.exe
  2⤵
  PID:7504
- C:\Windows\System\jHGOcOu.exe
  C:\Windows\System\jHGOcOu.exe
  2⤵
  PID:7532
- C:\Windows\System\sACzlvx.exe
  C:\Windows\System\sACzlvx.exe
  2⤵
  PID:7556
- C:\Windows\System\FqKMgNo.exe
  C:\Windows\System\FqKMgNo.exe
  2⤵
  PID:7576
- C:\Windows\System\KiOqxPE.exe
  C:\Windows\System\KiOqxPE.exe
  2⤵
  PID:7604
- C:\Windows\System\xjcHuXR.exe
  C:\Windows\System\xjcHuXR.exe
  2⤵
  PID:7664
- C:\Windows\System\RrSTLfc.exe
  C:\Windows\System\RrSTLfc.exe
  2⤵
  PID:7688
- C:\Windows\System\NFlkHgn.exe
  C:\Windows\System\NFlkHgn.exe
  2⤵
  PID:7708
- C:\Windows\System\BZAohTb.exe
  C:\Windows\System\BZAohTb.exe
  2⤵
  PID:7748
- C:\Windows\System\jYbUxuy.exe
  C:\Windows\System\jYbUxuy.exe
  2⤵
  PID:7776
- C:\Windows\System\eeqIvgT.exe
  C:\Windows\System\eeqIvgT.exe
  2⤵
  PID:7796
- C:\Windows\System\aMHcSha.exe
  C:\Windows\System\aMHcSha.exe
  2⤵
  PID:7816
- C:\Windows\System\qnLxYJA.exe
  C:\Windows\System\qnLxYJA.exe
  2⤵
  PID:7856
- C:\Windows\System\LzMeGXZ.exe
  C:\Windows\System\LzMeGXZ.exe
  2⤵
  PID:7880
- C:\Windows\System\iAenSPJ.exe
  C:\Windows\System\iAenSPJ.exe
  2⤵
  PID:7896
- C:\Windows\System\KfxEdoJ.exe
  C:\Windows\System\KfxEdoJ.exe
  2⤵
  PID:7916
- C:\Windows\System\jAVPYaQ.exe
  C:\Windows\System\jAVPYaQ.exe
  2⤵
  PID:7948
- C:\Windows\System\WmcmqSl.exe
  C:\Windows\System\WmcmqSl.exe
  2⤵
  PID:7968
- C:\Windows\System\cyyJDZJ.exe
  C:\Windows\System\cyyJDZJ.exe
  2⤵
  PID:7996
- C:\Windows\System\YuMhCUE.exe
  C:\Windows\System\YuMhCUE.exe
  2⤵
  PID:8024
- C:\Windows\System\JEwVTtW.exe
  C:\Windows\System\JEwVTtW.exe
  2⤵
  PID:8040
- C:\Windows\System\OMUpcAK.exe
  C:\Windows\System\OMUpcAK.exe
  2⤵
  PID:8068
- C:\Windows\System\fcNyJKr.exe
  C:\Windows\System\fcNyJKr.exe
  2⤵
  PID:8088
- C:\Windows\System\fsgOZAr.exe
  C:\Windows\System\fsgOZAr.exe
  2⤵
  PID:8112
- C:\Windows\System\MqUFFVh.exe
  C:\Windows\System\MqUFFVh.exe
  2⤵
  PID:8136
- C:\Windows\System\qJZGGEG.exe
  C:\Windows\System\qJZGGEG.exe
  2⤵
  PID:4600
- C:\Windows\System\zPvBanI.exe
  C:\Windows\System\zPvBanI.exe
  2⤵
  PID:7260
- C:\Windows\System\zdQeEcX.exe
  C:\Windows\System\zdQeEcX.exe
  2⤵
  PID:7288
- C:\Windows\System\IPdDbUq.exe
  C:\Windows\System\IPdDbUq.exe
  2⤵
  PID:7360
- C:\Windows\System\YcHJieJ.exe
  C:\Windows\System\YcHJieJ.exe
  2⤵
  PID:7400
- C:\Windows\System\dDStgxI.exe
  C:\Windows\System\dDStgxI.exe
  2⤵
  PID:7552
- C:\Windows\System\YIpSjXB.exe
  C:\Windows\System\YIpSjXB.exe
  2⤵
  PID:7572
- C:\Windows\System\rAPDgLP.exe
  C:\Windows\System\rAPDgLP.exe
  2⤵
  PID:7652
- C:\Windows\System\UpNuRJF.exe
  C:\Windows\System\UpNuRJF.exe
  2⤵
  PID:7676
- C:\Windows\System\OTeHBMr.exe
  C:\Windows\System\OTeHBMr.exe
  2⤵
  PID:7740
- C:\Windows\System\JTYrgUb.exe
  C:\Windows\System\JTYrgUb.exe
  2⤵
  PID:7924
- C:\Windows\System\DHxJLIx.exe
  C:\Windows\System\DHxJLIx.exe
  2⤵
  PID:8008
- C:\Windows\System\vJPHJhV.exe
  C:\Windows\System\vJPHJhV.exe
  2⤵
  PID:7980
- C:\Windows\System\uvzaeaQ.exe
  C:\Windows\System\uvzaeaQ.exe
  2⤵
  PID:8060
- C:\Windows\System\cCBCUPR.exe
  C:\Windows\System\cCBCUPR.exe
  2⤵
  PID:8152
- C:\Windows\System\OJVhyXG.exe
  C:\Windows\System\OJVhyXG.exe
  2⤵
  PID:8128
- C:\Windows\System\bOCJdRN.exe
  C:\Windows\System\bOCJdRN.exe
  2⤵
  PID:7332
- C:\Windows\System\PWvcxVw.exe
  C:\Windows\System\PWvcxVw.exe
  2⤵
  PID:7496
- C:\Windows\System\Pdgjirb.exe
  C:\Windows\System\Pdgjirb.exe
  2⤵
  PID:4512
- C:\Windows\System\djJzWny.exe
  C:\Windows\System\djJzWny.exe
  2⤵
  PID:7792
- C:\Windows\System\JjeUvSq.exe
  C:\Windows\System\JjeUvSq.exe
  2⤵
  PID:7840
- C:\Windows\System\UbEiqaD.exe
  C:\Windows\System\UbEiqaD.exe
  2⤵
  PID:8012
- C:\Windows\System\pVWlCGg.exe
  C:\Windows\System\pVWlCGg.exe
  2⤵
  PID:8104
- C:\Windows\System\hXZbMIR.exe
  C:\Windows\System\hXZbMIR.exe
  2⤵
  PID:7276
- C:\Windows\System\WQUGqCL.exe
  C:\Windows\System\WQUGqCL.exe
  2⤵
  PID:7568
- C:\Windows\System\ZeECmis.exe
  C:\Windows\System\ZeECmis.exe
  2⤵
  PID:8096
- C:\Windows\System\DgrIQGe.exe
  C:\Windows\System\DgrIQGe.exe
  2⤵
  PID:7344
- C:\Windows\System\ZIHYzrx.exe
  C:\Windows\System\ZIHYzrx.exe
  2⤵
  PID:8236
- C:\Windows\System\SixIVYU.exe
  C:\Windows\System\SixIVYU.exe
  2⤵
  PID:8264
- C:\Windows\System\EAXMHCq.exe
  C:\Windows\System\EAXMHCq.exe
  2⤵
  PID:8280
- C:\Windows\System\RFsUAKO.exe
  C:\Windows\System\RFsUAKO.exe
  2⤵
  PID:8312
- C:\Windows\System\vyFobjW.exe
  C:\Windows\System\vyFobjW.exe
  2⤵
  PID:8352
- C:\Windows\System\IMfIAKb.exe
  C:\Windows\System\IMfIAKb.exe
  2⤵
  PID:8372
- C:\Windows\System\thtKBoY.exe
  C:\Windows\System\thtKBoY.exe
  2⤵
  PID:8424
- C:\Windows\System\IjdFfRN.exe
  C:\Windows\System\IjdFfRN.exe
  2⤵
  PID:8440
- C:\Windows\System\AhoHJuH.exe
  C:\Windows\System\AhoHJuH.exe
  2⤵
  PID:8464
- C:\Windows\System\JeIQClG.exe
  C:\Windows\System\JeIQClG.exe
  2⤵
  PID:8500
- C:\Windows\System\kBVvcwB.exe
  C:\Windows\System\kBVvcwB.exe
  2⤵
  PID:8528
- C:\Windows\System\qYqEWJg.exe
  C:\Windows\System\qYqEWJg.exe
  2⤵
  PID:8552
- C:\Windows\System\udDzLkg.exe
  C:\Windows\System\udDzLkg.exe
  2⤵
  PID:8568
- C:\Windows\System\FMjnZnn.exe
  C:\Windows\System\FMjnZnn.exe
  2⤵
  PID:8588
- C:\Windows\System\XqNiVFj.exe
  C:\Windows\System\XqNiVFj.exe
  2⤵
  PID:8640
- C:\Windows\System\tEXofcy.exe
  C:\Windows\System\tEXofcy.exe
  2⤵
  PID:8660
- C:\Windows\System\eoWqjyp.exe
  C:\Windows\System\eoWqjyp.exe
  2⤵
  PID:8684
- C:\Windows\System\bbjwNIj.exe
  C:\Windows\System\bbjwNIj.exe
  2⤵
  PID:8724
- C:\Windows\System\wDfhgdD.exe
  C:\Windows\System\wDfhgdD.exe
  2⤵
  PID:8748
- C:\Windows\System\vHIQHfH.exe
  C:\Windows\System\vHIQHfH.exe
  2⤵
  PID:8764
- C:\Windows\System\ZsGqUWX.exe
  C:\Windows\System\ZsGqUWX.exe
  2⤵
  PID:8788
- C:\Windows\System\SGFNRaw.exe
  C:\Windows\System\SGFNRaw.exe
  2⤵
  PID:8816
- C:\Windows\System\JTmvGkb.exe
  C:\Windows\System\JTmvGkb.exe
  2⤵
  PID:8840
- C:\Windows\System\UKWcbKs.exe
  C:\Windows\System\UKWcbKs.exe
  2⤵
  PID:8896
- C:\Windows\System\EaRxXcA.exe
  C:\Windows\System\EaRxXcA.exe
  2⤵
  PID:8912
- C:\Windows\System\jwWlrew.exe
  C:\Windows\System\jwWlrew.exe
  2⤵
  PID:8960
- C:\Windows\System\lcmkirU.exe
  C:\Windows\System\lcmkirU.exe
  2⤵
  PID:8980
- C:\Windows\System\MWpFpev.exe
  C:\Windows\System\MWpFpev.exe
  2⤵
  PID:9004
- C:\Windows\System\cljxjXT.exe
  C:\Windows\System\cljxjXT.exe
  2⤵
  PID:9044
- C:\Windows\System\GcKNvQG.exe
  C:\Windows\System\GcKNvQG.exe
  2⤵
  PID:9064
- C:\Windows\System\chHmahZ.exe
  C:\Windows\System\chHmahZ.exe
  2⤵
  PID:9096
- C:\Windows\System\TEmObgu.exe
  C:\Windows\System\TEmObgu.exe
  2⤵
  PID:9116
- C:\Windows\System\FCLissx.exe
  C:\Windows\System\FCLissx.exe
  2⤵
  PID:9132
- C:\Windows\System\oKdtdyQ.exe
  C:\Windows\System\oKdtdyQ.exe
  2⤵
  PID:9168
- C:\Windows\System\kxviHpN.exe
  C:\Windows\System\kxviHpN.exe
  2⤵
  PID:9184
- C:\Windows\System\EnlNjRT.exe
  C:\Windows\System\EnlNjRT.exe
  2⤵
  PID:9204
- C:\Windows\System\qTMxEeb.exe
  C:\Windows\System\qTMxEeb.exe
  2⤵
  PID:7596
- C:\Windows\System\YGYWdcx.exe
  C:\Windows\System\YGYWdcx.exe
  2⤵
  PID:7876
- C:\Windows\System\PjTwheX.exe
  C:\Windows\System\PjTwheX.exe
  2⤵
  PID:8228
- C:\Windows\System\WmwKlUo.exe
  C:\Windows\System\WmwKlUo.exe
  2⤵
  PID:8416
- C:\Windows\System\aMQWUJO.exe
  C:\Windows\System\aMQWUJO.exe
  2⤵
  PID:8452
- C:\Windows\System\JmdfvYO.exe
  C:\Windows\System\JmdfvYO.exe
  2⤵
  PID:8564
- C:\Windows\System\DtMlecH.exe
  C:\Windows\System\DtMlecH.exe
  2⤵
  PID:8584
- C:\Windows\System\FEtIonl.exe
  C:\Windows\System\FEtIonl.exe
  2⤵
  PID:8676
- C:\Windows\System\zxEwtNC.exe
  C:\Windows\System\zxEwtNC.exe
  2⤵
  PID:8704
- C:\Windows\System\MyhidLf.exe
  C:\Windows\System\MyhidLf.exe
  2⤵
  PID:8824
- C:\Windows\System\QOhSmkT.exe
  C:\Windows\System\QOhSmkT.exe
  2⤵
  PID:8920
- C:\Windows\System\cSgXFSy.exe
  C:\Windows\System\cSgXFSy.exe
  2⤵
  PID:8940
- C:\Windows\System\ReIdYoT.exe
  C:\Windows\System\ReIdYoT.exe
  2⤵
  PID:9040
- C:\Windows\System\qVwbjiC.exe
  C:\Windows\System\qVwbjiC.exe
  2⤵
  PID:9084
- C:\Windows\System\nDLGzxb.exe
  C:\Windows\System\nDLGzxb.exe
  2⤵
  PID:9148
- C:\Windows\System\GiizlJj.exe
  C:\Windows\System\GiizlJj.exe
  2⤵
  PID:9200
- C:\Windows\System\uuLKrzv.exe
  C:\Windows\System\uuLKrzv.exe
  2⤵
  PID:7472
- C:\Windows\System\GbFPnZO.exe
  C:\Windows\System\GbFPnZO.exe
  2⤵
  PID:8340
- C:\Windows\System\ImcwTZs.exe
  C:\Windows\System\ImcwTZs.exe
  2⤵
  PID:8608
- C:\Windows\System\LaNdVwo.exe
  C:\Windows\System\LaNdVwo.exe
  2⤵
  PID:8680
- C:\Windows\System\wlMIbcI.exe
  C:\Windows\System\wlMIbcI.exe
  2⤵
  PID:8904
- C:\Windows\System\ZBZXFXH.exe
  C:\Windows\System\ZBZXFXH.exe
  2⤵
  PID:9192
- C:\Windows\System\kixogGo.exe
  C:\Windows\System\kixogGo.exe
  2⤵
  PID:9176
- C:\Windows\System\eRpklOq.exe
  C:\Windows\System\eRpklOq.exe
  2⤵
  PID:8432
- C:\Windows\System\jvtnJqq.exe
  C:\Windows\System\jvtnJqq.exe
  2⤵
  PID:8972
- C:\Windows\System\xGGYyKo.exe
  C:\Windows\System\xGGYyKo.exe
  2⤵
  PID:8344
- C:\Windows\System\AvKTCIc.exe
  C:\Windows\System\AvKTCIc.exe
  2⤵
  PID:9228
- C:\Windows\System\potlBUV.exe
  C:\Windows\System\potlBUV.exe
  2⤵
  PID:9244
- C:\Windows\System\AuNYfAI.exe
  C:\Windows\System\AuNYfAI.exe
  2⤵
  PID:9268
- C:\Windows\System\SbwtdOG.exe
  C:\Windows\System\SbwtdOG.exe
  2⤵
  PID:9292
- C:\Windows\System\YZUfhvM.exe
  C:\Windows\System\YZUfhvM.exe
  2⤵
  PID:9312
- C:\Windows\System\qbGlDio.exe
  C:\Windows\System\qbGlDio.exe
  2⤵
  PID:9332
- C:\Windows\System\cpaUjiR.exe
  C:\Windows\System\cpaUjiR.exe
  2⤵
  PID:9352
- C:\Windows\System\TTflQVU.exe
  C:\Windows\System\TTflQVU.exe
  2⤵
  PID:9376
- C:\Windows\System\nUyLbvW.exe
  C:\Windows\System\nUyLbvW.exe
  2⤵
  PID:9404
- C:\Windows\System\ZSCuepc.exe
  C:\Windows\System\ZSCuepc.exe
  2⤵
  PID:9424
- C:\Windows\System\yptoEOx.exe
  C:\Windows\System\yptoEOx.exe
  2⤵
  PID:9456
- C:\Windows\System\GaxpnVo.exe
  C:\Windows\System\GaxpnVo.exe
  2⤵
  PID:9476
- C:\Windows\System\DNMckjS.exe
  C:\Windows\System\DNMckjS.exe
  2⤵
  PID:9520
- C:\Windows\System\KEFSiWV.exe
  C:\Windows\System\KEFSiWV.exe
  2⤵
  PID:9536
- C:\Windows\System\YhBaLXm.exe
  C:\Windows\System\YhBaLXm.exe
  2⤵
  PID:9620
- C:\Windows\System\YNPCUnl.exe
  C:\Windows\System\YNPCUnl.exe
  2⤵
  PID:9640
- C:\Windows\System\piHEGMf.exe
  C:\Windows\System\piHEGMf.exe
  2⤵
  PID:9664
- C:\Windows\System\gVYYcNe.exe
  C:\Windows\System\gVYYcNe.exe
  2⤵
  PID:9680
- C:\Windows\System\PPRodwD.exe
  C:\Windows\System\PPRodwD.exe
  2⤵
  PID:9728
- C:\Windows\System\MfWKWFs.exe
  C:\Windows\System\MfWKWFs.exe
  2⤵
  PID:9744
- C:\Windows\System\InnpNlR.exe
  C:\Windows\System\InnpNlR.exe
  2⤵
  PID:9788
- C:\Windows\System\qxySGYU.exe
  C:\Windows\System\qxySGYU.exe
  2⤵
  PID:9804
- C:\Windows\System\teDXlRu.exe
  C:\Windows\System\teDXlRu.exe
  2⤵
  PID:9844
- C:\Windows\System\mxpslyv.exe
  C:\Windows\System\mxpslyv.exe
  2⤵
  PID:9860
- C:\Windows\System\HjKlSsS.exe
  C:\Windows\System\HjKlSsS.exe
  2⤵
  PID:9900
- C:\Windows\System\gCSLUrw.exe
  C:\Windows\System\gCSLUrw.exe
  2⤵
  PID:9916
- C:\Windows\System\YqZPWNF.exe
  C:\Windows\System\YqZPWNF.exe
  2⤵
  PID:9936
- C:\Windows\System\jzJHtea.exe
  C:\Windows\System\jzJHtea.exe
  2⤵
  PID:9960
- C:\Windows\System\BYkjWSv.exe
  C:\Windows\System\BYkjWSv.exe
  2⤵
  PID:10004
- C:\Windows\System\UCOaITA.exe
  C:\Windows\System\UCOaITA.exe
  2⤵
  PID:10024
- C:\Windows\System\fEasHaT.exe
  C:\Windows\System\fEasHaT.exe
  2⤵
  PID:10044
- C:\Windows\System\feLjzaG.exe
  C:\Windows\System\feLjzaG.exe
  2⤵
  PID:10064
- C:\Windows\System\WHFLmGH.exe
  C:\Windows\System\WHFLmGH.exe
  2⤵
  PID:10200
- C:\Windows\System\xxwnhUS.exe
  C:\Windows\System\xxwnhUS.exe
  2⤵
  PID:8656
- C:\Windows\System\WoUBoCM.exe
  C:\Windows\System\WoUBoCM.exe
  2⤵
  PID:9304
- C:\Windows\System\YpCUocp.exe
  C:\Windows\System\YpCUocp.exe
  2⤵
  PID:9360
- C:\Windows\System\DSakQrG.exe
  C:\Windows\System\DSakQrG.exe
  2⤵
  PID:9364
- C:\Windows\System\aAAOglc.exe
  C:\Windows\System\aAAOglc.exe
  2⤵
  PID:9416
- C:\Windows\System\aLxJgfL.exe
  C:\Windows\System\aLxJgfL.exe
  2⤵
  PID:9544
- C:\Windows\System\fzBZCqg.exe
  C:\Windows\System\fzBZCqg.exe
  2⤵
  PID:9560
- C:\Windows\System\TpLmqRk.exe
  C:\Windows\System\TpLmqRk.exe
  2⤵
  PID:9656
- C:\Windows\System\ttjJHsP.exe
  C:\Windows\System\ttjJHsP.exe
  2⤵
  PID:9764
- C:\Windows\System\MOOrJtr.exe
  C:\Windows\System\MOOrJtr.exe
  2⤵
  PID:9820
- C:\Windows\System\xzqEApl.exe
  C:\Windows\System\xzqEApl.exe
  2⤵
  PID:9884
- C:\Windows\System\nQvXoxe.exe
  C:\Windows\System\nQvXoxe.exe
  2⤵
  PID:9948
- C:\Windows\System\nxPJQOO.exe
  C:\Windows\System\nxPJQOO.exe
  2⤵
  PID:9996
- C:\Windows\System\PlohvBT.exe
  C:\Windows\System\PlohvBT.exe
  2⤵
  PID:10104
- C:\Windows\System\ycoMUAF.exe
  C:\Windows\System\ycoMUAF.exe
  2⤵
  PID:10192
- C:\Windows\System\RorckhM.exe
  C:\Windows\System\RorckhM.exe
  2⤵
  PID:10232
- C:\Windows\System\bRBLWoP.exe
  C:\Windows\System\bRBLWoP.exe
  2⤵
  PID:10112
- C:\Windows\System\plxmlUR.exe
  C:\Windows\System\plxmlUR.exe
  2⤵
  PID:10148
- C:\Windows\System\FcZiOwV.exe
  C:\Windows\System\FcZiOwV.exe
  2⤵
  PID:9220
- C:\Windows\System\THChzmS.exe
  C:\Windows\System\THChzmS.exe
  2⤵
  PID:9276
- C:\Windows\System\VTgOSqt.exe
  C:\Windows\System\VTgOSqt.exe
  2⤵
  PID:9448
- C:\Windows\System\itEDQBH.exe
  C:\Windows\System\itEDQBH.exe
  2⤵
  PID:4980
- C:\Windows\System\HcyrQov.exe
  C:\Windows\System\HcyrQov.exe
  2⤵
  PID:9740
- C:\Windows\System\jCexidu.exe
  C:\Windows\System\jCexidu.exe
  2⤵
  PID:9984
- C:\Windows\System\VCLSxWr.exe
  C:\Windows\System\VCLSxWr.exe
  2⤵
  PID:10096
- C:\Windows\System\MzpKwVn.exe
  C:\Windows\System\MzpKwVn.exe
  2⤵
  PID:10040
- C:\Windows\System\oCUJcNF.exe
  C:\Windows\System\oCUJcNF.exe
  2⤵
  PID:10228
- C:\Windows\System\xIAPFEl.exe
  C:\Windows\System\xIAPFEl.exe
  2⤵
  PID:9396
- C:\Windows\System\ZdFMQcT.exe
  C:\Windows\System\ZdFMQcT.exe
  2⤵
  PID:9736
- C:\Windows\System\EONYwIC.exe
  C:\Windows\System\EONYwIC.exe
  2⤵
  PID:10016
- C:\Windows\System\lVFFCcY.exe
  C:\Windows\System\lVFFCcY.exe
  2⤵
  PID:10092
- C:\Windows\System\WersrHn.exe
  C:\Windows\System\WersrHn.exe
  2⤵
  PID:996
- C:\Windows\System\OCXRAPV.exe
  C:\Windows\System\OCXRAPV.exe
  2⤵
  PID:964
- C:\Windows\System\nExpXHv.exe
  C:\Windows\System\nExpXHv.exe
  2⤵
  PID:10248
- C:\Windows\System\sSbKKBm.exe
  C:\Windows\System\sSbKKBm.exe
  2⤵
  PID:10268
- C:\Windows\System\RanYCSN.exe
  C:\Windows\System\RanYCSN.exe
  2⤵
  PID:10296
- C:\Windows\System\JCiDiyS.exe
  C:\Windows\System\JCiDiyS.exe
  2⤵
  PID:10332
- C:\Windows\System\YZSIXZO.exe
  C:\Windows\System\YZSIXZO.exe
  2⤵
  PID:10376
- C:\Windows\System\LiKxPup.exe
  C:\Windows\System\LiKxPup.exe
  2⤵
  PID:10392
- C:\Windows\System\dSUzejC.exe
  C:\Windows\System\dSUzejC.exe
  2⤵
  PID:10416
- C:\Windows\System\hokkDKq.exe
  C:\Windows\System\hokkDKq.exe
  2⤵
  PID:10440
- C:\Windows\System\lFzpiZI.exe
  C:\Windows\System\lFzpiZI.exe
  2⤵
  PID:10468
- C:\Windows\System\GYzWldk.exe
  C:\Windows\System\GYzWldk.exe
  2⤵
  PID:10492
- C:\Windows\System\zSFPTXD.exe
  C:\Windows\System\zSFPTXD.exe
  2⤵
  PID:10508
- C:\Windows\System\aJCBKOe.exe
  C:\Windows\System\aJCBKOe.exe
  2⤵
  PID:10528
- C:\Windows\System\BhQAPDK.exe
  C:\Windows\System\BhQAPDK.exe
  2⤵
  PID:10552
- C:\Windows\System\UDxHHBC.exe
  C:\Windows\System\UDxHHBC.exe
  2⤵
  PID:10568
- C:\Windows\System\KFOKsbh.exe
  C:\Windows\System\KFOKsbh.exe
  2⤵
  PID:10604
- C:\Windows\System\OFhwKZk.exe
  C:\Windows\System\OFhwKZk.exe
  2⤵
  PID:10660
- C:\Windows\System\gDGMlAJ.exe
  C:\Windows\System\gDGMlAJ.exe
  2⤵
  PID:10680
- C:\Windows\System\MshfTvm.exe
  C:\Windows\System\MshfTvm.exe
  2⤵
  PID:10700
- C:\Windows\System\yoQyoAI.exe
  C:\Windows\System\yoQyoAI.exe
  2⤵
  PID:10724
- C:\Windows\System\JgahAoU.exe
  C:\Windows\System\JgahAoU.exe
  2⤵
  PID:10748
- C:\Windows\System\wbBLvMC.exe
  C:\Windows\System\wbBLvMC.exe
  2⤵
  PID:10772
- C:\Windows\System\bQHwAjO.exe
  C:\Windows\System\bQHwAjO.exe
  2⤵
  PID:10796
- C:\Windows\System\MCpfgVb.exe
  C:\Windows\System\MCpfgVb.exe
  2⤵
  PID:10840
- C:\Windows\System\gRlvvVO.exe
  C:\Windows\System\gRlvvVO.exe
  2⤵
  PID:10868
- C:\Windows\System\AXrKwYi.exe
  C:\Windows\System\AXrKwYi.exe
  2⤵
  PID:10888
- C:\Windows\System\SdYsAil.exe
  C:\Windows\System\SdYsAil.exe
  2⤵
  PID:10908
- C:\Windows\System\jJVLQwW.exe
  C:\Windows\System\jJVLQwW.exe
  2⤵
  PID:10952
- C:\Windows\System\ZSyuuzG.exe
  C:\Windows\System\ZSyuuzG.exe
  2⤵
  PID:10992
- C:\Windows\System\SdUCMdu.exe
  C:\Windows\System\SdUCMdu.exe
  2⤵
  PID:11024
- C:\Windows\System\hadSfOD.exe
  C:\Windows\System\hadSfOD.exe
  2⤵
  PID:11044
- C:\Windows\System\IEeQPPS.exe
  C:\Windows\System\IEeQPPS.exe
  2⤵
  PID:11060
- C:\Windows\System\GZSEopv.exe
  C:\Windows\System\GZSEopv.exe
  2⤵
  PID:11088
- C:\Windows\System\krjBTaC.exe
  C:\Windows\System\krjBTaC.exe
  2⤵
  PID:11116
- C:\Windows\System\ZkwPowk.exe
  C:\Windows\System\ZkwPowk.exe
  2⤵
  PID:11132
- C:\Windows\System\PkoQhAE.exe
  C:\Windows\System\PkoQhAE.exe
  2⤵
  PID:11172
- C:\Windows\System\FRhdogw.exe
  C:\Windows\System\FRhdogw.exe
  2⤵
  PID:11208
- C:\Windows\System\ulyEZJp.exe
  C:\Windows\System\ulyEZJp.exe
  2⤵
  PID:11248
- C:\Windows\System\DhVFDuf.exe
  C:\Windows\System\DhVFDuf.exe
  2⤵
  PID:10292
- C:\Windows\System\lnnsIxs.exe
  C:\Windows\System\lnnsIxs.exe
  2⤵
  PID:10324
- C:\Windows\System\OmzNmeH.exe
  C:\Windows\System\OmzNmeH.exe
  2⤵
  PID:10388
- C:\Windows\System\gBVWFPw.exe
  C:\Windows\System\gBVWFPw.exe
  2⤵
  PID:10424
- C:\Windows\System\drUwvcu.exe
  C:\Windows\System\drUwvcu.exe
  2⤵
  PID:10500
- C:\Windows\System\bPFrMRF.exe
  C:\Windows\System\bPFrMRF.exe
  2⤵
  PID:10524
- C:\Windows\System\iCUyfvz.exe
  C:\Windows\System\iCUyfvz.exe
  2⤵
  PID:10520
- C:\Windows\System\FUkBOxe.exe
  C:\Windows\System\FUkBOxe.exe
  2⤵
  PID:4432
- C:\Windows\System\AbtXeby.exe
  C:\Windows\System\AbtXeby.exe
  2⤵
  PID:10708
- C:\Windows\System\SQWxSOr.exe
  C:\Windows\System\SQWxSOr.exe
  2⤵
  PID:10852
- C:\Windows\System\BaGKlLe.exe
  C:\Windows\System\BaGKlLe.exe
  2⤵
  PID:10932
- C:\Windows\System\Ftlotmn.exe
  C:\Windows\System\Ftlotmn.exe
  2⤵
  PID:10972
- C:\Windows\System\PFmZWrz.exe
  C:\Windows\System\PFmZWrz.exe
  2⤵
  PID:11016
- C:\Windows\System\XEixinI.exe
  C:\Windows\System\XEixinI.exe
  2⤵
  PID:11052
- C:\Windows\System\WcFeapM.exe
  C:\Windows\System\WcFeapM.exe
  2⤵
  PID:11096
- C:\Windows\System\gLuLnbw.exe
  C:\Windows\System\gLuLnbw.exe
  2⤵
  PID:11148
- C:\Windows\System\kahQZRE.exe
  C:\Windows\System\kahQZRE.exe
  2⤵
  PID:10260
- C:\Windows\System\GroEqny.exe
  C:\Windows\System\GroEqny.exe
  2⤵
  PID:10404
- C:\Windows\System\KcZvnhR.exe
  C:\Windows\System\KcZvnhR.exe
  2⤵
  PID:10536
- C:\Windows\System\hCYqXgh.exe
  C:\Windows\System\hCYqXgh.exe
  2⤵
  PID:10576
- C:\Windows\System\rlPebkS.exe
  C:\Windows\System\rlPebkS.exe
  2⤵
  PID:4184
- C:\Windows\System\fgiZNtm.exe
  C:\Windows\System\fgiZNtm.exe
  2⤵
  PID:10920
- C:\Windows\System\AdYrWdl.exe
  C:\Windows\System\AdYrWdl.exe
  2⤵
  PID:11056
- C:\Windows\System\UHOozvb.exe
  C:\Windows\System\UHOozvb.exe
  2⤵
  PID:11124
- C:\Windows\System\hxLCpWN.exe
  C:\Windows\System\hxLCpWN.exe
  2⤵
  PID:11108
- C:\Windows\System\DAtQNyA.exe
  C:\Windows\System\DAtQNyA.exe
  2⤵
  PID:10368
- C:\Windows\System\rTRycmU.exe
  C:\Windows\System\rTRycmU.exe
  2⤵
  PID:4748
- C:\Windows\System\QfPshcu.exe
  C:\Windows\System\QfPshcu.exe
  2⤵
  PID:10864
- C:\Windows\System\SYfXFoQ.exe
  C:\Windows\System\SYfXFoQ.exe
  2⤵
  PID:10880
- C:\Windows\System\QMwbCcP.exe
  C:\Windows\System\QMwbCcP.exe
  2⤵
  PID:11288
- C:\Windows\System\kdMibEh.exe
  C:\Windows\System\kdMibEh.exe
  2⤵
  PID:11308
- C:\Windows\System\cdXLBNV.exe
  C:\Windows\System\cdXLBNV.exe
  2⤵
  PID:11356
- C:\Windows\System\IuKFuim.exe
  C:\Windows\System\IuKFuim.exe
  2⤵
  PID:11376
- C:\Windows\System\dvuySLB.exe
  C:\Windows\System\dvuySLB.exe
  2⤵
  PID:11392
- C:\Windows\System\kBKVwgm.exe
  C:\Windows\System\kBKVwgm.exe
  2⤵
  PID:11412
- C:\Windows\System\NWYJATm.exe
  C:\Windows\System\NWYJATm.exe
  2⤵
  PID:11440
- C:\Windows\System\CRVqtqK.exe
  C:\Windows\System\CRVqtqK.exe
  2⤵
  PID:11476
- C:\Windows\System\QrIMFHQ.exe
  C:\Windows\System\QrIMFHQ.exe
  2⤵
  PID:11536
- C:\Windows\System\YfBRsgD.exe
  C:\Windows\System\YfBRsgD.exe
  2⤵
  PID:11580
- C:\Windows\System\YOeehnt.exe
  C:\Windows\System\YOeehnt.exe
  2⤵
  PID:11612
- C:\Windows\System\iGddxWg.exe
  C:\Windows\System\iGddxWg.exe
  2⤵
  PID:11632
- C:\Windows\System\JTETLuC.exe
  C:\Windows\System\JTETLuC.exe
  2⤵
  PID:11652
- C:\Windows\System\nQSDlbd.exe
  C:\Windows\System\nQSDlbd.exe
  2⤵
  PID:11688
- C:\Windows\System\QTkZsTb.exe
  C:\Windows\System\QTkZsTb.exe
  2⤵
  PID:11708
- C:\Windows\System\QtYvmGb.exe
  C:\Windows\System\QtYvmGb.exe
  2⤵
  PID:11744
- C:\Windows\System\dFoRDWr.exe
  C:\Windows\System\dFoRDWr.exe
  2⤵
  PID:11760
- C:\Windows\System\WkTfKLB.exe
  C:\Windows\System\WkTfKLB.exe
  2⤵
  PID:11788
- C:\Windows\System\KCznasJ.exe
  C:\Windows\System\KCznasJ.exe
  2⤵
  PID:11808
- C:\Windows\System\xEnzeQl.exe
  C:\Windows\System\xEnzeQl.exe
  2⤵
  PID:11828
- C:\Windows\System\YXhZHCC.exe
  C:\Windows\System\YXhZHCC.exe
  2⤵
  PID:11872
- C:\Windows\System\XHdpTIn.exe
  C:\Windows\System\XHdpTIn.exe
  2⤵
  PID:11892
- C:\Windows\System\xQYPFGq.exe
  C:\Windows\System\xQYPFGq.exe
  2⤵
  PID:11916
- C:\Windows\System\oWPmxvH.exe
  C:\Windows\System\oWPmxvH.exe
  2⤵
  PID:11940
- C:\Windows\System\CLztSAx.exe
  C:\Windows\System\CLztSAx.exe
  2⤵
  PID:11964
- C:\Windows\System\TvgvsRw.exe
  C:\Windows\System\TvgvsRw.exe
  2⤵
  PID:11984
- C:\Windows\System\HSvwiYX.exe
  C:\Windows\System\HSvwiYX.exe
  2⤵
  PID:12032
- C:\Windows\System\hSSSOIY.exe
  C:\Windows\System\hSSSOIY.exe
  2⤵
  PID:12052
- C:\Windows\System\NfAQOVQ.exe
  C:\Windows\System\NfAQOVQ.exe
  2⤵
  PID:12108
- C:\Windows\System\mHcYIvb.exe
  C:\Windows\System\mHcYIvb.exe
  2⤵
  PID:12136
- C:\Windows\System\XCkeVZu.exe
  C:\Windows\System\XCkeVZu.exe
  2⤵
  PID:12156
- C:\Windows\System\EVFOxDx.exe
  C:\Windows\System\EVFOxDx.exe
  2⤵
  PID:12180
- C:\Windows\System\IbgdsvG.exe
  C:\Windows\System\IbgdsvG.exe
  2⤵
  PID:12200
- C:\Windows\System\WzgCTNJ.exe
  C:\Windows\System\WzgCTNJ.exe
  2⤵
  PID:12220
- C:\Windows\System\FWvgLTJ.exe
  C:\Windows\System\FWvgLTJ.exe
  2⤵
  PID:12260
- C:\Windows\System\ovvSbhG.exe
  C:\Windows\System\ovvSbhG.exe
  2⤵
  PID:11240
- C:\Windows\System\PmfGTih.exe
  C:\Windows\System\PmfGTih.exe
  2⤵
  PID:11304
- C:\Windows\System\rGbrqsW.exe
  C:\Windows\System\rGbrqsW.exe
  2⤵
  PID:11424
- C:\Windows\System\lkbuboE.exe
  C:\Windows\System\lkbuboE.exe
  2⤵
  PID:11404
- C:\Windows\System\AdeonzB.exe
  C:\Windows\System\AdeonzB.exe
  2⤵
  PID:11432
- C:\Windows\System\xTtoUEk.exe
  C:\Windows\System\xTtoUEk.exe
  2⤵
  PID:11468
- C:\Windows\System\SIuulnc.exe
  C:\Windows\System\SIuulnc.exe
  2⤵
  PID:11572
- C:\Windows\System\LcpduSb.exe
  C:\Windows\System\LcpduSb.exe
  2⤵
  PID:11640
- C:\Windows\System\AidcQuE.exe
  C:\Windows\System\AidcQuE.exe
  2⤵
  PID:11676
- C:\Windows\System\VvRnWMl.exe
  C:\Windows\System\VvRnWMl.exe
  2⤵
  PID:11732
- C:\Windows\System\SyTxATk.exe
  C:\Windows\System\SyTxATk.exe
  2⤵
  PID:11756
- C:\Windows\System\PSDksSZ.exe
  C:\Windows\System\PSDksSZ.exe
  2⤵
  PID:11804
- C:\Windows\System\cQfjDZS.exe
  C:\Windows\System\cQfjDZS.exe
  2⤵
  PID:11860
- C:\Windows\System\cCNzExv.exe
  C:\Windows\System\cCNzExv.exe
  2⤵
  PID:12004
- C:\Windows\System\DaQQljf.exe
  C:\Windows\System\DaQQljf.exe
  2⤵
  PID:12144
- C:\Windows\System\yogHulI.exe
  C:\Windows\System\yogHulI.exe
  2⤵
  PID:12192
- C:\Windows\System\foKzQVB.exe
  C:\Windows\System\foKzQVB.exe
  2⤵
  PID:12272
- C:\Windows\System\LsSsnoI.exe
  C:\Windows\System\LsSsnoI.exe
  2⤵
  PID:2688
- C:\Windows\System\PFrIxAI.exe
  C:\Windows\System\PFrIxAI.exe
  2⤵
  PID:11388
- C:\Windows\System\zJqkqFE.exe
  C:\Windows\System\zJqkqFE.exe
  2⤵
  PID:11576
- C:\Windows\System\AXKrRjk.exe
  C:\Windows\System\AXKrRjk.exe
  2⤵
  PID:3744
- C:\Windows\System\qQproAD.exe
  C:\Windows\System\qQproAD.exe
  2⤵
  PID:11856
- C:\Windows\System\oOhmzMH.exe
  C:\Windows\System\oOhmzMH.exe
  2⤵
  PID:11956
- C:\Windows\System\bKTPkrj.exe
  C:\Windows\System\bKTPkrj.exe
  2⤵
  PID:12176
- C:\Windows\System\ANuqUVy.exe
  C:\Windows\System\ANuqUVy.exe
  2⤵
  PID:12168
- C:\Windows\System\QVnsIKX.exe
  C:\Windows\System\QVnsIKX.exe
  2⤵
  PID:11508
- C:\Windows\System\zqHpBqd.exe
  C:\Windows\System\zqHpBqd.exe
  2⤵
  PID:4080
- C:\Windows\System\mXzUDUd.exe
  C:\Windows\System\mXzUDUd.exe
  2⤵
  PID:11680
- C:\Windows\System\awGTUJo.exe
  C:\Windows\System\awGTUJo.exe
  2⤵
  PID:4448
- C:\Windows\System\XDbnNtF.exe
  C:\Windows\System\XDbnNtF.exe
  2⤵
  PID:11340
- C:\Windows\System\BFZYoYY.exe
  C:\Windows\System\BFZYoYY.exe
  2⤵
  PID:11784
- C:\Windows\System\arwygue.exe
  C:\Windows\System\arwygue.exe
  2⤵
  PID:12292
- C:\Windows\System\azNwjIz.exe
  C:\Windows\System\azNwjIz.exe
  2⤵
  PID:12316
- C:\Windows\System\QqECEUp.exe
  C:\Windows\System\QqECEUp.exe
  2⤵
  PID:12332
- C:\Windows\System\GVkBTeY.exe
  C:\Windows\System\GVkBTeY.exe
  2⤵
  PID:12372
- C:\Windows\System\ewrKYjZ.exe
  C:\Windows\System\ewrKYjZ.exe
  2⤵
  PID:12416
- C:\Windows\System\sgsmNzX.exe
  C:\Windows\System\sgsmNzX.exe
  2⤵
  PID:12448
- C:\Windows\System\zWVGeZh.exe
  C:\Windows\System\zWVGeZh.exe
  2⤵
  PID:12468
- C:\Windows\System\uZHcaZA.exe
  C:\Windows\System\uZHcaZA.exe
  2⤵
  PID:12484
- C:\Windows\System\ICNEIQl.exe
  C:\Windows\System\ICNEIQl.exe
  2⤵
  PID:12516
- C:\Windows\System\MSjFaim.exe
  C:\Windows\System\MSjFaim.exe
  2⤵
  PID:12564
- C:\Windows\System\tjvUrzY.exe
  C:\Windows\System\tjvUrzY.exe
  2⤵
  PID:12584
- C:\Windows\System\EBnShtr.exe
  C:\Windows\System\EBnShtr.exe
  2⤵
  PID:12620
- C:\Windows\System\AsVAzZd.exe
  C:\Windows\System\AsVAzZd.exe
  2⤵
  PID:12648
- C:\Windows\System\OEQoCNq.exe
  C:\Windows\System\OEQoCNq.exe
  2⤵
  PID:12668
- C:\Windows\System\ZXNeleK.exe
  C:\Windows\System\ZXNeleK.exe
  2⤵
  PID:12692
- C:\Windows\System\VwDlKka.exe
  C:\Windows\System\VwDlKka.exe
  2⤵
  PID:12708
- C:\Windows\System\zohLyFC.exe
  C:\Windows\System\zohLyFC.exe
  2⤵
  PID:12736
- C:\Windows\System\UVBiTnY.exe
  C:\Windows\System\UVBiTnY.exe
  2⤵
  PID:12756
- C:\Windows\System\THGCqFL.exe
  C:\Windows\System\THGCqFL.exe
  2⤵
  PID:12812
- C:\Windows\System\VjZMIXZ.exe
  C:\Windows\System\VjZMIXZ.exe
  2⤵
  PID:12832
- C:\Windows\System\wiStZrT.exe
  C:\Windows\System\wiStZrT.exe
  2⤵
  PID:12860
- C:\Windows\System\FVaTPga.exe
  C:\Windows\System\FVaTPga.exe
  2⤵
  PID:12876
- C:\Windows\System\phAcbTF.exe
  C:\Windows\System\phAcbTF.exe
  2⤵
  PID:12924
- C:\Windows\System\qgchIqi.exe
  C:\Windows\System\qgchIqi.exe
  2⤵
  PID:12948
- C:\Windows\System\IFVCRFN.exe
  C:\Windows\System\IFVCRFN.exe
  2⤵
  PID:12972
- C:\Windows\System\KaUlLBJ.exe
  C:\Windows\System\KaUlLBJ.exe
  2⤵
  PID:12988
- C:\Windows\System\MtmYqzQ.exe
  C:\Windows\System\MtmYqzQ.exe
  2⤵
  PID:13004
- C:\Windows\System\tgafyRV.exe
  C:\Windows\System\tgafyRV.exe
  2⤵
  PID:13036
- C:\Windows\System\omUSzih.exe
  C:\Windows\System\omUSzih.exe
  2⤵
  PID:13060
- C:\Windows\System\KJCIfoR.exe
  C:\Windows\System\KJCIfoR.exe
  2⤵
  PID:13076
- C:\Windows\System\mWbErFo.exe
  C:\Windows\System\mWbErFo.exe
  2⤵
  PID:13096
- C:\Windows\System\KJECNxz.exe
  C:\Windows\System\KJECNxz.exe
  2⤵
  PID:10432
- C:\Windows\System\TIpDMlS.exe
  C:\Windows\System\TIpDMlS.exe
  2⤵
  PID:12412
- C:\Windows\System\iciYwqn.exe
  C:\Windows\System\iciYwqn.exe
  2⤵
  PID:12440
- C:\Windows\System\BXzJQxo.exe
  C:\Windows\System\BXzJQxo.exe
  2⤵
  PID:12600
- C:\Windows\System\qImSDQU.exe
  C:\Windows\System\qImSDQU.exe
  2⤵
  PID:12576
- C:\Windows\System\kgUtRJA.exe
  C:\Windows\System\kgUtRJA.exe
  2⤵
  PID:12660
- C:\Windows\System\PxJCTKq.exe
  C:\Windows\System\PxJCTKq.exe
  2⤵
  PID:12704
- C:\Windows\System\UIUIKru.exe
  C:\Windows\System\UIUIKru.exe
  2⤵
  PID:12616
- C:\Windows\System\MwdnRzP.exe
  C:\Windows\System\MwdnRzP.exe
  2⤵
  PID:12368
- C:\Windows\System\XxpmcGp.exe
  C:\Windows\System\XxpmcGp.exe
  2⤵
  PID:12852
- C:\Windows\System\SScxUwN.exe
  C:\Windows\System\SScxUwN.exe
  2⤵
  PID:12940
- C:\Windows\System\TxVdgId.exe
  C:\Windows\System\TxVdgId.exe
  2⤵
  PID:12996
- C:\Windows\System\bCURrsF.exe
  C:\Windows\System\bCURrsF.exe
  2⤵
  PID:13052
- C:\Windows\System\wBDmcGK.exe
  C:\Windows\System\wBDmcGK.exe
  2⤵
  PID:13160
- C:\Windows\System\niItHgp.exe
  C:\Windows\System\niItHgp.exe
  2⤵
  PID:13092
- C:\Windows\System\HUHCFPn.exe
  C:\Windows\System\HUHCFPn.exe
  2⤵
  PID:1568
- C:\Windows\System\QcvyNAS.exe
  C:\Windows\System\QcvyNAS.exe
  2⤵
  PID:13048
- C:\Windows\System\AUeOkUu.exe
  C:\Windows\System\AUeOkUu.exe
  2⤵
  PID:3728
- C:\Windows\System\FhLvHBJ.exe
  C:\Windows\System\FhLvHBJ.exe
  2⤵
  PID:13192
- C:\Windows\System\fIWffiP.exe
  C:\Windows\System\fIWffiP.exe
  2⤵
  PID:4528
- C:\Windows\System\CRBjIle.exe
  C:\Windows\System\CRBjIle.exe
  2⤵
  PID:13228
- C:\Windows\System\CZdaMfF.exe
  C:\Windows\System\CZdaMfF.exe
  2⤵
  PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_deckucfi.ni3.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BCIeaEb.exe

Filesize
1.9MB

MD5
c9209c279eb6bbde5b7e0d4c4f3160eb

SHA1
94bf8dfaf43dfc5e5c77ad15f2f2eba16e958029

SHA256
743089eda261d44ad13c81aec54b05a716bb84a63ddc0b67b46a4c649db17e85

SHA512
700f69ce2adb72187b9302f625b552facbaf7ebcede5dd7f8149c7c31e66a80f769abc0dcafcad66744f54e5ee70d5c429389efa8bf9b1593227f884940ead7e

Download Submit
C:\Windows\System\DSsGcmf.exe

Filesize
1.9MB

MD5
a3db2981ea4a1f1a00895e0aa0eff588

SHA1
72a51f63f494461e0f3eccd5b9fca24148e51ee3

SHA256
c6f7d8d4c6f4353755ce7996f995a6aba97342e1b69ab87d053e32bdd5714f4e

SHA512
04f17c3cc41c6e1b23efad596249d834c18041d18f987c454dcc81a4db5a60df62717e5eadb5ed8f6d2cea05b6367f6156731d652ea64aa821723a527131de88

Download Submit
C:\Windows\System\DeLWtGE.exe

Filesize
1.9MB

MD5
f361c31eb5d19dc06b90a761fc41263a

SHA1
9e4a8b26aab9b3b61255daf07b160f7bafe8efe5

SHA256
6babcdda319e79b6131c9c3635acebe99b8c7a6e00fdd843332a34924c3b4a3e

SHA512
c36e4141bc71942a570c2f3d1e7cf10b57ec4b3d8f146bed0fdd2f7003783b9a2f53b67c93b35b5709a7ac2dd742977914891338a712022185e4b3cd4372565b

Download Submit
C:\Windows\System\ELQPYxx.exe

Filesize
1.8MB

MD5
d61b42a28b9cc62cbd00f4905db22280

SHA1
d4e330044b2b87a9805309d868d88a48b3cef9c9

SHA256
8f821d40f6499cff60133ed579b5ba7ce7a2b2a5ee0063c96f792ca3ea9e8aa8

SHA512
6393b5155d35c4d50346b161aab7370a922305350a26d5644c2db61500b77b27e10bafa2f037ff95e52608412d196fbdfb8bf7ac2a414028b883981032eb6c86

Download Submit
C:\Windows\System\EdIXxOR.exe

Filesize
1.9MB

MD5
4b6b648b9955ea6ca9d71a3e9aea1f28

SHA1
b63d2f91e15ab7c138aad3f2bf459c02ea66f537

SHA256
0d7924fe14bc66a1744a59448ba7034cef0e713c086e2e80890ba450c4f3d720

SHA512
232c9fd32a343592bca8c984766351d82c9493c1613b11ab4a157db638e9612d9afd2c51605affa3e04938d0ea3bfe95417719ab985d95f002906e86c84ac969

Download Submit
C:\Windows\System\EildTGn.exe

Filesize
1.9MB

MD5
72d7bba338d9749d9a7741386686d8e3

SHA1
af2f9b32ab85c4727a14264c09579f8912f46ee1

SHA256
32c59da0e2ff909aef67aca8e8e1c3799e6716cdc34dc2f09587b491cf531667

SHA512
0097928206d19e41a4d7c2a503771128dbb6e20a0f77cc04136d51c11c787a30cfa51c7500c15141c9cb20c02148b796d38dcaa4de3dc697011bbb8c2c8765f9

Download Submit
C:\Windows\System\FQZgddh.exe

Filesize
1.9MB

MD5
337b029f5ce1b53087bb0c96e69cea33

SHA1
a9482d8ce888e067e4826cf67d9317571c5668f5

SHA256
6f3c0389c226780083ded6eb6050a3d8f04673852081d17c3a4401ad346f414a

SHA512
26630e002d1814d559bc1753ef99af21b63d54a0ddfec6ff60fbe30aa46b2894d4755bd66c78c12dc5a406575500ed5d5d10a52e1c5f460d2b8ea12e0b1fed89

Download Submit
C:\Windows\System\FTxMXis.exe

Filesize
1.9MB

MD5
09c1e5e350f8ba8b5921829c0981d275

SHA1
c1e5427efd14659a505b1dcda3dfa35ef849dd54

SHA256
b765b4be7addbcbf48fedd3facfb7c9872bf37ea05d12675302e275488847567

SHA512
b30c35ee24c94f41cf8a9b8c272b6918bae56250546d0d338cea92f58ea04fcc71565aa329c9fabb1a8b0414a5be0374bd692c7197082f1985620c37f590b1a8

Download Submit
C:\Windows\System\GiaCOco.exe

Filesize
1.9MB

MD5
435b80d6a41542ce2e43ee339301b858

SHA1
9fe75dd032fb373306296b133240d1cdb4986cee

SHA256
31b0ab2eee9611aa4414e4740cb914fa6e15ba8e147bc795adead796be773dcb

SHA512
f6b71ca784352003b57c1b39dd286536954bf8e28f9b218f043cba8d820413abfbd0ba3263e2a6ff943d41fbab1e8eebd7dd5a0ce883adcdb2f5981c5144fed8

Download Submit
C:\Windows\System\HhsXsTe.exe

Filesize
1.9MB

MD5
9d81866d6ded2eea5b46a94437f3349a

SHA1
165604413bbd5fd320f0632bfb1104efac8956a8

SHA256
a7187083da3256b54912bde4b6a82ce21f2339b58fb6c497144214bf6b5c2583

SHA512
1522eb1ff2b6346a4935f35272792ab8b5670af0aa7b4b25a3ceb13cf50cdc49ca3335c185fab084061e0c03a2e4976c1620c6ac4736feef8d79347907019a21

Download Submit
C:\Windows\System\IGOhauj.exe

Filesize
1.9MB

MD5
e2c45d1a25ae3d32da96a250691d25cb

SHA1
3ac42628747d4ad766d4842b5f8d51d3521e7528

SHA256
8b6e2bdae44cf2c704603fc5d5e57e9ee42a20e3161216b092a0e18bf220d99c

SHA512
50c289abfa76190f3e53ff399ed048eee377dcc351978a8d05e3b295e6e1d97a4bf0a85889c5812963286d126ce4ede046ac96683f3d88b13e664e2bede4e3ae

Download Submit
C:\Windows\System\JaqweBA.exe

Filesize
1.9MB

MD5
fbd174d9306e2e2958ca5a564a830d81

SHA1
405c5190c0fa7adf557ed2d42ccf481c680f841f

SHA256
e3ae956b236e55465736ca95d619ea435c7470101b1ce0a7c02eb6b6e669561a

SHA512
d24ae6e553eefb3e4261c19b4a12705a79f8658f009a21d33b32644b3a5641784bec130321e2d9aaf1cff99e048b3b7df6dad690277278ffeff02f58fb6825bc

Download Submit
C:\Windows\System\KGUYDnC.exe

Filesize
1.8MB

MD5
689a1ea783ac7f59d5e81596bceaa894

SHA1
bb65b318850302365f281c0fb80226a6db0fe7d3

SHA256
867b6d91dd3ddf746c78e3353c94d016c5758b3ed7197dda71e4b7496a5238dc

SHA512
e8010ee1a6dc70c2b22256634bd1aff8d87f54c687fdacc10dac2e1ec79c3710eb7c486151ac41bf31a93cbb32277fcc5c8659b043910f8ecb0c4ec67fbb99b2

Download Submit
C:\Windows\System\KYweQad.exe

Filesize
1.8MB

MD5
49e77b33dcc97f069368d1d94b41ed7c

SHA1
881fb03eadca9a37fe2af22533e59033c8d749ca

SHA256
5ed1937ecb4b127c6db6d71bdfd86be01db95836428e86ac207b82fbc6847ffe

SHA512
f163f13a45af5d0492c36d11d4318f86ba41faa0e1499fee1395c6d8af31c6e48ba9cf4514597aec7ed25cae5072eb9c058ddfa35cf1500aea903366692db126

Download Submit
C:\Windows\System\MYPhpUo.exe

Filesize
1.8MB

MD5
5b726fb0368d8861fa4c273f26a0ffdb

SHA1
a29a7cfa859e75be0188a8749ba63fe743be3f62

SHA256
cfb4c6e607fbf6836767f56d3ed96b3d5d3c402ec842730ae4a3b5b796239500

SHA512
6fb2ef98919f0bb1378b2d7fc06c099d3db3f843139b0a6d1e6b32a54d525221fe118acc090eeda2e5d64db7a90aa4ca7b2c161b32102a1d320e465f8757ba44

Download Submit
C:\Windows\System\NCdfUKF.exe

Filesize
1.8MB

MD5
48bda32c86acdfe288747427114c8557

SHA1
d187d49b25d5a4d8a424bc3c135f6747bd8144e9

SHA256
1e9952f01bb98ccdc0ec0b8c92daa637a7f14222e771a1288ed5605f2a6b461b

SHA512
3a3c7a0ed73ef5a979577877f5002f43698224b5eb5e0fa91e19d21bb6929d592475b5e57cb787fc822ccbb4994c44750833fa03d07eaeb3d51a0156c170143a

Download Submit
C:\Windows\System\PxhmBJQ.exe

Filesize
1.9MB

MD5
e765212ee4fd7dc6d6272590cf6c28e5

SHA1
306714d62a46da64eee82fe421c463215775d4ee

SHA256
df5c46448e4ceff75a36a451f9606e1965e22f71bb5ecd660fd1af49bbaddcb1

SHA512
9e2c488ddece03ca8b2d355af6bce9def93f1fd7c642532076af2dfab8bd0b885d2d84f98f4bd6a1ea568d2f1cdf3c7c6e88daadd7ba5a236cfbd708ba59b4e2

Download Submit
C:\Windows\System\RGkZqDW.exe

Filesize
1.9MB

MD5
254911159e89ad8c48fcb39ea88784aa

SHA1
a17e579a4d3feb77a8ab91791ed3cd721a742e76

SHA256
5204d917bd1796b0f92bee3bbb13a4b8d28108af943c43fab83888d13e780a11

SHA512
f6e98ebfa2c4bffc10e0d1bfe9f716189235a5790d0e83b96f570d5f7b281300d49149a352a3f7297bb6c7bf0e9e8a0c04cfc4d09b58af32b97a4adc5e98d798

Download Submit
C:\Windows\System\RWpypTH.exe

Filesize
1.9MB

MD5
90ae40ea7405a44887d6d11841eb64ae

SHA1
de77028e5cdbd590275134f3e953392480106f5a

SHA256
a9abacf952fc4a7030b16882cddd327fb77151b0c4ea6041178a6edeb0b3cf38

SHA512
8236423a9782f3b97a920bcef757e689e12ba43170844aae1954b9b79d23abc1a7f73b9c6a82e49e218cd6020249654a275396e8b9f1bd9d25b3d2538335df42

Download Submit
C:\Windows\System\UejFfak.exe

Filesize
1.9MB

MD5
2c016ff7af625db29faa3aef55bb9a99

SHA1
58ee808497a14eb71a4885ccc5b15e5daceee653

SHA256
938b6bbfa4031fd284a083b571adb8c02c847319678f720ebc316713465870ca

SHA512
b735100df0e502592ef3c7f17881243cc4db825a005961e5ca4393ad847d2d9fea7777535bc22baa8d06dbaf80176d6d2bc0061e4752333ae13a5d673f73db0c

Download Submit
C:\Windows\System\YAeKHYZ.exe

Filesize
1.8MB

MD5
4af078cce5ab85219c62a38d5d872a48

SHA1
caaca160e03f6a4b64e0ae62c8e3da5d4a716ca7

SHA256
997a6c1f59315d745390948ed94d530b336efd3356c61fb5c42906ff638324d4

SHA512
bd6de5249f38791a044ae32d2dffd42a75dc560f6b1f97cbe9ddfa7a04fd5e1cef44739a679702c7746ceae8cb2a11ef9e4f887e3b4affffafd956e82b91dfd0

Download Submit
C:\Windows\System\ZLvWEGR.exe

Filesize
1.9MB

MD5
544f538f28aa5e9bc9ca7c78af755b10

SHA1
92245fbf3afa5934512f1c20f8a26ab823f32c37

SHA256
b1944f6b71545c39ea238855148baba5745acb672511d1f0c9254fb293db2d03

SHA512
5e0b9a639e6630c381f23fdf87bfd384d78dccfa3aa29446d98bca1ba33c4b669a196d8ec7df84c32cd4cf074e5f2549b955b399993d929e6e10ccbef5ed724b

Download Submit
C:\Windows\System\cyaGQdi.exe

Filesize
1.9MB

MD5
483f1217f556e98595945da3a3706cb5

SHA1
1b2ea68aeee3a955c7efc9a9d62b3694e4232577

SHA256
0c0504a2d855a34b27500bca14f86bf02862b304e55b5de293a9daea7be9e997

SHA512
5c6880dac5344fc37a0923af384837129522879733bc78eb5f92baf7a9474eda10a28e0b2e7e8638f98a25e25cec47c24fd5cff95c3cc8a14a7ed473c33b4e55

Download Submit
C:\Windows\System\dSfyQVl.exe

Filesize
1.8MB

MD5
4dda9513a440eb36f0aa0d21a3f22979

SHA1
9f79cf0a8009fc85dca9fe0257f2ef1260dd1270

SHA256
4fe40c61ea85d30c9b4338df2429e0e1374ae78e749537e8d38109db101bfd9f

SHA512
0571b2e5ca299483b4b17e5f73479723c75599b1b050a63d7ae74b9c825c657923d733fcf141d65902634bbb535020e976da5f1acbb620a3b4388f2481a08039

Download Submit
C:\Windows\System\eRmLDPg.exe

Filesize
1.8MB

MD5
89a4807c9ae6e100b5e0de749538f245

SHA1
0cbc885fbf9ea4bdfedd726b5439eef6c052ee52

SHA256
8f30c71a1679b18896a2aabf4ca1baf1d3501c41ba38dfa58f2f23c4d5995a16

SHA512
781adae33fe22e1f934286ee7785f197c7ed4b95eb5d8a92561dee6beb38e0d8982f604135fbe60f8dbb1aa2936a0a726368fd4ed052de1e8cbf87c81cc214a8

Download Submit
C:\Windows\System\eeqrZrk.exe

Filesize
1.8MB

MD5
b0ff54e22e9b3e1c49255a822d8009ce

SHA1
0976a94a14aae9980dc4e2ba039dd81ea37b6574

SHA256
ec3ece0d134fa8af04ae5215999f8f2fb8623d8124b94b522d168e9477680e66

SHA512
4b7bb3d3e6093faa6141ebf55493b6a79273f629b72b2e946f408102879b80175d74f6f80fd1e54cf86cdd34c824d7dd81c2899c35213ed0c067141864666244

Download Submit
C:\Windows\System\egLpMND.exe

Filesize
1.8MB

MD5
a6a85257bb2cc2f5001d33a0155a4de9

SHA1
2cb9310cfd3b407c68f6b2b769dbd836e6deac29

SHA256
a4194f62b6527436e7bd53cee46651cf623e04c37bb3e03ba115c4d6eaa0b1a7

SHA512
e83c6a34bedd258a88efcbb160c57e1f621032677254d07ab32c9a06522605c8a3d4f689eb268ca1399a11de8469d3f089ca1137376e5bd5f43a5dc1d26726e3

Download Submit
C:\Windows\System\fQIowTq.exe

Filesize
1.8MB

MD5
449a229021faa8ea0065dda36ceca5fa

SHA1
6b61028186c85804a3cfed7ac193391bad8f59e4

SHA256
e823f675f2150006410df912a7219bb423cae41db687c8b30622993d9a026cb4

SHA512
db9687ef0ee3d210061c8fa40dbfb167eca80e1403a6ca3b51446f8499e54666332f8e2898f31161a4f24a1673900a105b9db735257ab2feeef3b8ba1c52691b

Download Submit
C:\Windows\System\gUrzHCX.exe

Filesize
1.9MB

MD5
cd192d41ea4b592b7fb0f13746af7277

SHA1
8dad884e03feaef554f0b31d4c1a93d31f5e5b71

SHA256
2f61923031725ef990d331cef447db1a05c2c2de3cb85ee7c840a691be805dc4

SHA512
b63b20331b5d5bfe9617ae28c4a74f8fd8598d1adca5248d83f2925263193947879d36387403eb59e58180d4cefea54982c917992a9c23b09a0beccf80965d8b

Download Submit
C:\Windows\System\gYQhlLZ.exe

Filesize
1.9MB

MD5
b7bfc9d143d57b80778550475802f26b

SHA1
772b3dda18629bd71d0e4dd228cfb823d7b04ae7

SHA256
825cf4cb1252542acc15a7825f1328465127d1bb7aca0bb8b788b846a84aa450

SHA512
cc352d0ab5a5786a3e6f065717b0d843b53b81b181305b225533c2e8ffeb2606049b1273d6170354a96f53df5ea0fe6f0b435902d512d9a0ab624dc0cb4f6530

Download Submit
C:\Windows\System\gqnfsKa.exe

Filesize
1.8MB

MD5
cfac8100cc1777535dbe3dfadb140c6c

SHA1
f2a7791f2739cd9d9d7a747c205149531c0f50fb

SHA256
0430502ccc3813eb3816ad9ab4f08131ae409fe6eedae97825ec26e2cdc45717

SHA512
c87853ed7f35bc501f705ab4563d208af6f34a5525ad03c20b4ac22ecc159e2177bcfcf31cd9a9382efb3a33f81cb667e9a108d998db25188467a9df1b1c2570

Download Submit
C:\Windows\System\hxRAgcD.exe

Filesize
1.8MB

MD5
bf5e6737f45d5e9700ffabec7903f01b

SHA1
f8d3a8fa78bd0b899eaaec046210911692fcaae2

SHA256
63bb5b6dc3205cf73a61c4ecf3c1c54eee8528ff864fedf54c8d497a73f7e586

SHA512
9872aa9300be635db7e44eeaeafdb978a220f7729da6a661e9aec4f1f215ff058a9f57e18cb838c8474417d332ad176fbccaa94c900523d48e097256aa06affc

Download Submit
C:\Windows\System\iObxBtu.exe

Filesize
1.9MB

MD5
f926befd3c7b3c1eab5d98e0025e7944

SHA1
b8c0f7be40a33862d847037796fb89e7d76dbd2c

SHA256
3b9ec9a0be143eeb171fd54877c440a7cb1d9e32279a06dc64bab4a3f3eb5192

SHA512
fdc320d7602e4f8ef6614eb8a86c6072e7373b411655227e2fe243ceeeab0a5976a8c90642bfdd3e2152d1ac02474142efb1e21299ae0d38f668c5e40b73a81b

Download Submit
C:\Windows\System\iaBzoap.exe

Filesize
1.9MB

MD5
08f5e57e73e349b833bd44011154167f

SHA1
93de162d39861782a9dc62281c847e8ce92e7a89

SHA256
022ef3d9f326fe71832dc8f001f14b7aba0ff92eb2b54d1369cc0d4049bfc020

SHA512
0fe370ddea12f05bb930859e08e50e51984dd386da22af22d20045dd227f07a3b806aafc03c49539c2e6c2432487be9e4c10dfaa043dd3921470b0164a1e70c2

Download Submit
C:\Windows\System\jiNDeJb.exe

Filesize
1.8MB

MD5
9e084faaf7397ff959c70a9ad5938782

SHA1
9b619bfd45b4ef4ca86beced17c77ce69f59752d

SHA256
d2763ad23eec2a8d5cf34da975f2d5e2243dd49a6ebb85ad8fe2df2fa596d57b

SHA512
49251775a9dc2e4d033060b9ae4f4dce9317dc28f662d27ba03d5e1e2d4b8ba5e3ea6519a553fb86d3f5b42bf98609c216f5fdb010ff86cd91db09f154893abe

Download Submit
C:\Windows\System\klqfjSN.exe

Filesize
1.8MB

MD5
def53080488f1bb22ee31f33a5199eda

SHA1
432a33b2241a072eeec91a3f7a986198bb305d35

SHA256
2bfb2ad00b0aaac7d34cc691be05016c45a43ea9c63fdbee6635be40a785e1d8

SHA512
25cc766343ec43b63f3d054740723007606e5c15e94808f6d25e01fa43ccaaee550898178df496ba5a614b2002651921bfd68331e215b07db2d9e8120f7fd7a3

Download Submit
C:\Windows\System\ktQtlih.exe

Filesize
1.9MB

MD5
e9a21a21952789d6813ede8c11994a58

SHA1
589d4c594eab15807bb71f62dfc4aeefc9e6cc41

SHA256
940642562f9be7de09fda73a092ba5afe1f1e00f8ff064ff4d1f83522ff5d5a0

SHA512
d2cb1189862b45293c41056b11a5fe341af97dfaf5fabf68261aae935c25293a6e4247ca561871de8ff51d39b66ee9c7ba2f8915204e89a9edba69817b93a6a5

Download Submit
C:\Windows\System\lNPwXZc.exe

Filesize
1.8MB

MD5
722e0b69e53223b91f40b372cb396775

SHA1
85a96e6b05cfc9f116d96f2837355cfd86241c5e

SHA256
b7afe4404c670264c30ad30d54e5b400e05b48e2c5eda53747ff524640cf0338

SHA512
4d78a98312b6ec1c253a8dee99c8ecc771c10e6d114248e0a92d00c9f909ad4372e9268d4d971de3c6275f276305c849c93df5b6771e2a6aac4177a28af8ab9e

Download Submit
C:\Windows\System\mfJbihp.exe

Filesize
1.9MB

MD5
e81eb951900581d9a678a1042384cd03

SHA1
2f79d8fede69fd33a49d21b378f6df5d44677f15

SHA256
912fa62fd8e2b4dcb706d110f60aa9cd874b05704087dbf3469762b61b4be7e9

SHA512
bc02d40b0c79ea1777daedea6295b843fab277726d0bff219066d451f8e364d8ea5576ee0a9e7d24543ff8984f939872587c1692063224224d703ff35e94b8be

Download Submit
C:\Windows\System\oqoHTKH.exe

Filesize
8B

MD5
0a4d9fd0cc8fe1472d155d5d981ff235

SHA1
137003f778b74f1b96494293112b43e4307e765e

SHA256
4707e767d70e4899759ce8aba6535007a27f8c132e3f3e05b8b8ae03c23dd080

SHA512
ad9c5b802b25d2a28cbec3d4cc246b638fad901bd44704bb559f8a0cf5c0d25f339a2e2fe9f4b8bbba249477fc11b0b14c51d97cfa76d081fb255f90811dd5c7

Download Submit
C:\Windows\System\qkDwBJk.exe

Filesize
1.9MB

MD5
b6e73ad9063b990a681db3c390a422ca

SHA1
fe060c9faa34f230db059ec4f3a91810ad9e6f97

SHA256
26dd07af42fe9c0665b665b20dc3205b93c8e151f8c2fd5351181f5fd8959485

SHA512
8469fa074a160ae1268df54dbfaba45c50c30397cf61b189b3bf1c3cbcea3d881ad606280124dadf1aae1e9443815c3ab7588330ce200cc73c278f2cab449fee

Download Submit
C:\Windows\System\qvQIlLS.exe

Filesize
1.9MB

MD5
d98e5a335cba48e49c9b4a2e55e1aad5

SHA1
93a8062f3bbfdee448d5a755d14a2dba190631ca

SHA256
1be0c37612f236a829bc63cdc8d3c9b6de848fe48b8a922ca2d6caf0b3ddd4db

SHA512
dbea34beeea5f276ef6972e1d14a15447ac78c5576fd076641bd9a9f567c1eefa37bf7f1fde52876eeff19091fdec11f8464283944620eb99d0e0cd286319441

Download Submit
C:\Windows\System\rWcgzOC.exe

Filesize
1.9MB

MD5
7c8860aeda5dbcbf079b395a92927168

SHA1
3e13659aab2fed81bf4115f9eceb0493bd427a12

SHA256
5a80a785107ffcbe2ec1f60318c74e4ab0ec3b72a9041b85ab7a1aab8a7f6af8

SHA512
d1678faf8523b7509251a2feeaa823f8ab26f69bef8cff3feb4086c4efc32b5c0f0052131563b5c22dfa9b8317e91d6823566a13c01c1a957c1a76fa18198bfb

Download Submit
C:\Windows\System\sNSiHmc.exe

Filesize
1.8MB

MD5
ec7bcb64fa0f6ab1e2404de0d1079662

SHA1
1a570075842f6b9ff2380967a494b82b2737d75d

SHA256
e86c82b7cb003cee5e7c3921171a90bfb8566267d8a759a25e237eeee89c3401

SHA512
b34ee85ae50b1869d462a18c15df61092873ee63b8428aac47c36e4fe42a28f46dcd0323f561d38746a6525a8c827a696c6092f50f1ae13ea4a8c8bf9b6b66bb

Download Submit
C:\Windows\System\tGIhzQQ.exe

Filesize
1.9MB

MD5
8d889416302ca91141f9c4d7dece0db4

SHA1
e45f24f56551fedab572432b209bf164c1095ee0

SHA256
0f13e9608da6c7044307f4da810bd5fe8ae50c0df1ba425ff85c242eeb63abcf

SHA512
59a198c383ced7fe92dce2c4fcaecbfc936b96bf107e1e2d84eb5b9e279a5d4d74344baff8ba10e23c40d1322d71f6dd03c4aa9a1909ccdc3c54c9ee0b28341f

Download Submit
C:\Windows\System\tiEgDgU.exe

Filesize
1.9MB

MD5
e0f3382e2d1ae28ee70865171996839a

SHA1
2ac6f7ee7ed009c4e41489da713e47c24f5e00e7

SHA256
b3aba17230a0ee804a580d2571aa4994f71a1bbb2c9ec32248d0479baa1f3915

SHA512
1d8c79da3e467e4644fc23ebeed0d2fa0f07c48676959821a816eec4e5d5d634f8d898aaada70491dd8dd66d246d4a84c43009489a67ec624cf55ebd4b6c61d6

Download Submit
C:\Windows\System\uDYJEBM.exe

Filesize
1.9MB

MD5
ce70b584daaa75ff3ce1b07534db8602

SHA1
f966b74503dee84e493a621ab4136e528cf23fff

SHA256
d706c133a938d4b69c2e8a288f378bbb5f79885d1d8151fc27efc3c4a06e7049

SHA512
9b444e00be4b9aff7015bd979daa6a33c45bb16e289a1c8b9fb748e550b46f46897628fbfd9a2d23dd6d4109df0d139791b50303be7108aef23f0d3291826f84

Download Submit
C:\Windows\System\uFAXXRr.exe

Filesize
1.9MB

MD5
58cf6e4e8a9428d86561f92f72124bfb

SHA1
7c3391900480fae1197cdf4dc0045358caea7175

SHA256
4dbceec8427866b02a0029f5d411c30a54f5f6c62d905bcc03564c85f6574b83

SHA512
84cc15413f5f592fd054d42806fb08cc6ffa02dc0326d9d3cf29c95ec821928ffa6b6af6cc569b43865678c6c03a3d7673160f1f9ebc4286296a0100807945ca

Download Submit
C:\Windows\System\uSWvBQI.exe

Filesize
1.8MB

MD5
68350068fb7782a78d6292f911b76011

SHA1
68c32935a2f3e34a86e63e65f915be279d0c3b4b

SHA256
8ba2892cfa00f20c670f04b8d4e87a9edfdcae84a0a5aba80cd4ae4a58b7cb0b

SHA512
95d5a75f96711897479570aa57e7dd2d35a708057821eb592bf720a6517e40310ec01b4cd58960a8cf53a7eb0881a38a85abdff826e1abeafac008babff28454

Download Submit
C:\Windows\System\ufrssyt.exe

Filesize
1.9MB

MD5
b712adcee6a16e80f2afdf19c761f45f

SHA1
8db6ab5f2800dd08c8e75a9e01029dfd98e89e51

SHA256
7d2e3f9dfe6898416657a4e9a9a0f32d6b52f347f282b955da10d0b1b704e681

SHA512
b89ffc583dcedc5b8ce9ef17f3803f144635ad568824ffd6488fb9eb6af99123ed50c41c0394b1c0fa7edc008a2212b7b1c6758d3ad76f29d7851fec4efc6f08

Download Submit
C:\Windows\System\ukUoJon.exe

Filesize
1.9MB

MD5
96bb8a6d557bb0ecf9a845fa8c2b9052

SHA1
93fa66f2c0ec1b5cff9dae68c1044d0c4910b0da

SHA256
c3b7aafa9e443ce5dfc722fa3f69067adc412f2b15d97847183539300c1e46d4

SHA512
3c85b5d5080db9178cec17bb30c7fe44241c1ffc6a5d4c5af31e5fe8f3c6116d1e8403c1f49c28025ae550cc9ed6277e5e2d67ff5e39e09e1b66150414ba8cd9

Download Submit
C:\Windows\System\xchoOfq.exe

Filesize
1.9MB

MD5
05d20b91314ca24558a3c3e75918743a

SHA1
5649a719257e1c31c219f79929b052133f2c3a27

SHA256
5b9acb998f125964854685a332cb1c84f9960bab4b3a947e26323cfb11bcdd11

SHA512
297ca0cc3acf7a28077c736a5f9cd4172dfae2689354f7762a206c21667354680f9eccc7ad4a1dcf196e1f155562437cd615db6202747a0736fe864e2a6fdd49

Download Submit
C:\Windows\System\yPIJUCz.exe

Filesize
1.9MB

MD5
ec2af1e1a4bc02982a3b284a64c0e173

SHA1
2e4d127b094437e108a878ae748cf362fe9869dc

SHA256
d74edc1d130d8a578b2a981c7f4698af01d7462262d9a24c148d750304d33a9c

SHA512
8d82d7a73edc248ef449ba496138fffa65effd35aa87bbd7d8e4e7f5fe78534deb7d85597ac71e5165c8120e88457ff376027e513b0abf04120d1fe0c25af418

Download Submit
C:\Windows\System\zTwFcSr.exe

Filesize
1.9MB

MD5
f259caa07f420da03bbbb7f1d576cc03

SHA1
f21718ebbba5c81a3cfff5391f7db1eb6cd3c149

SHA256
d238a9c4537b2c21449ab7589bf34b847f16bb4ebc9bbbb22de33f3593ef5728

SHA512
6299c31a321066009c2ba2ff1d203a03d8c053166d03f100fe4daf5450f5fd331f3a4aaa5f184dcfb4cf5c34a69aead5e50312c9ddbc9c40db4368b33fc2692e

Download Submit
memory/116-3991-0x00007FF6F8110000-0x00007FF6F8502000-memory.dmp

Filesize
3.9MB

Download
memory/116-394-0x00007FF6F8110000-0x00007FF6F8502000-memory.dmp

Filesize
3.9MB

Download
memory/808-0-0x00007FF6B2CA0000-0x00007FF6B3092000-memory.dmp

Filesize
3.9MB

Download
memory/808-1-0x000002E1B9AE0000-0x000002E1B9AF0000-memory.dmp

Filesize
64KB

Download
memory/1320-492-0x00007FF78C870000-0x00007FF78CC62000-memory.dmp

Filesize
3.9MB

Download
memory/2100-28-0x00007FF63ABF0000-0x00007FF63AFE2000-memory.dmp

Filesize
3.9MB

Download
memory/2184-459-0x00007FF711430000-0x00007FF711822000-memory.dmp

Filesize
3.9MB

Download
memory/2184-4310-0x00007FF711430000-0x00007FF711822000-memory.dmp

Filesize
3.9MB

Download
memory/2244-537-0x00007FF7A2710000-0x00007FF7A2B02000-memory.dmp

Filesize
3.9MB

Download
memory/2484-565-0x00007FF6E6000000-0x00007FF6E63F2000-memory.dmp

Filesize
3.9MB

Download
memory/2780-57-0x00007FF6ACB70000-0x00007FF6ACF62000-memory.dmp

Filesize
3.9MB

Download
memory/2900-72-0x00007FF676D10000-0x00007FF677102000-memory.dmp

Filesize
3.9MB

Download
memory/2964-50-0x00007FF75D5A0000-0x00007FF75D992000-memory.dmp

Filesize
3.9MB

Download
memory/3160-30-0x00000275552E0000-0x00000275552F0000-memory.dmp

Filesize
64KB

Download
memory/3160-29-0x00000275552E0000-0x00000275552F0000-memory.dmp

Filesize
64KB

Download
memory/3160-48-0x0000027557460000-0x0000027557482000-memory.dmp

Filesize
136KB

Download
memory/3160-22-0x00007FFA894D0000-0x00007FFA89F91000-memory.dmp

Filesize
10.8MB

Download
memory/3412-423-0x00007FF6D20D0000-0x00007FF6D24C2000-memory.dmp

Filesize
3.9MB

Download
memory/3508-65-0x00007FF783E20000-0x00007FF784212000-memory.dmp

Filesize
3.9MB

Download
memory/3880-37-0x00007FF792500000-0x00007FF7928F2000-memory.dmp

Filesize
3.9MB

Download
memory/4088-78-0x00007FF6C7BA0000-0x00007FF6C7F92000-memory.dmp

Filesize
3.9MB

Download
memory/4240-75-0x00007FF7A0C20000-0x00007FF7A1012000-memory.dmp

Filesize
3.9MB

Download
memory/4248-10-0x00007FF612260000-0x00007FF612652000-memory.dmp

Filesize
3.9MB

Download
memory/4260-61-0x00007FF6052A0000-0x00007FF605692000-memory.dmp

Filesize
3.9MB

Download
memory/4564-568-0x00007FF76FAD0000-0x00007FF76FEC2000-memory.dmp

Filesize
3.9MB

Download
memory/4588-409-0x00007FF640420000-0x00007FF640812000-memory.dmp

Filesize
3.9MB

Download
memory/4768-458-0x00007FF7970B0000-0x00007FF7974A2000-memory.dmp

Filesize
3.9MB

Download
memory/4768-4308-0x00007FF7970B0000-0x00007FF7974A2000-memory.dmp

Filesize
3.9MB

Download
memory/4828-566-0x00007FF62FF60000-0x00007FF630352000-memory.dmp

Filesize
3.9MB

Download
memory/5072-560-0x00007FF64C670000-0x00007FF64CA62000-memory.dmp

Filesize
3.9MB

Download