xmrig | 0ef2ca6c425545b292d8ed95545b003fbc533b259918365dd3c9a4cc41dfc2a2

Analysis

max time kernel
128s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 01:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
Size

2.1MB
MD5

0224b83efc26850a5fde3791247aded8
SHA1

6bf4cf53f55ee445cf81f240dd65f3c475bdc30f
SHA256

0ef2ca6c425545b292d8ed95545b003fbc533b259918365dd3c9a4cc41dfc2a2
SHA512

a90a5daf461c8f99307e269cebc568092271c62f9130f30ddde895a864a52e5b03840ddda5b1391a45a4cc52619fc4d6aa08f46fad34124773428e2ebd85570d
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrW:NABn

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 39 IoCs

miner

resource	yara_rule
behavioral2/memory/3436-128-0x00007FF6D9660000-0x00007FF6D9A52000-memory.dmp	xmrig
behavioral2/memory/4052-130-0x00007FF62E230000-0x00007FF62E622000-memory.dmp	xmrig
behavioral2/memory/4552-132-0x00007FF6AF060000-0x00007FF6AF452000-memory.dmp	xmrig
behavioral2/memory/432-134-0x00007FF713E30000-0x00007FF714222000-memory.dmp	xmrig
behavioral2/memory/5044-283-0x00007FF78C3A0000-0x00007FF78C792000-memory.dmp	xmrig
behavioral2/memory/4600-233-0x00007FF7A6EA0000-0x00007FF7A7292000-memory.dmp	xmrig
behavioral2/memory/1808-201-0x00007FF74EAA0000-0x00007FF74EE92000-memory.dmp	xmrig
behavioral2/memory/3844-149-0x00007FF7C5380000-0x00007FF7C5772000-memory.dmp	xmrig
behavioral2/memory/1848-148-0x00007FF67BE10000-0x00007FF67C202000-memory.dmp	xmrig
behavioral2/memory/5104-138-0x00007FF709A80000-0x00007FF709E72000-memory.dmp	xmrig
behavioral2/memory/1000-135-0x00007FF608E90000-0x00007FF609282000-memory.dmp	xmrig
behavioral2/memory/2928-133-0x00007FF6D1A70000-0x00007FF6D1E62000-memory.dmp	xmrig
behavioral2/memory/2004-131-0x00007FF6EF370000-0x00007FF6EF762000-memory.dmp	xmrig
behavioral2/memory/2056-129-0x00007FF6593C0000-0x00007FF6597B2000-memory.dmp	xmrig
behavioral2/memory/2340-124-0x00007FF789ED0000-0x00007FF78A2C2000-memory.dmp	xmrig
behavioral2/memory/3496-97-0x00007FF7ABA50000-0x00007FF7ABE42000-memory.dmp	xmrig
behavioral2/memory/4628-75-0x00007FF750E50000-0x00007FF751242000-memory.dmp	xmrig
behavioral2/memory/4456-15-0x00007FF718330000-0x00007FF718722000-memory.dmp	xmrig
behavioral2/memory/4456-2844-0x00007FF718330000-0x00007FF718722000-memory.dmp	xmrig
behavioral2/memory/4628-2848-0x00007FF750E50000-0x00007FF751242000-memory.dmp	xmrig
behavioral2/memory/3496-2852-0x00007FF7ABA50000-0x00007FF7ABE42000-memory.dmp	xmrig
behavioral2/memory/3436-2854-0x00007FF6D9660000-0x00007FF6D9A52000-memory.dmp	xmrig
behavioral2/memory/2340-2850-0x00007FF789ED0000-0x00007FF78A2C2000-memory.dmp	xmrig
behavioral2/memory/1808-2847-0x00007FF74EAA0000-0x00007FF74EE92000-memory.dmp	xmrig
behavioral2/memory/432-2872-0x00007FF713E30000-0x00007FF714222000-memory.dmp	xmrig
behavioral2/memory/1000-2870-0x00007FF608E90000-0x00007FF609282000-memory.dmp	xmrig
behavioral2/memory/1848-2874-0x00007FF67BE10000-0x00007FF67C202000-memory.dmp	xmrig
behavioral2/memory/5104-2869-0x00007FF709A80000-0x00007FF709E72000-memory.dmp	xmrig
behavioral2/memory/2928-2866-0x00007FF6D1A70000-0x00007FF6D1E62000-memory.dmp	xmrig
behavioral2/memory/4552-2865-0x00007FF6AF060000-0x00007FF6AF452000-memory.dmp	xmrig
behavioral2/memory/2004-2862-0x00007FF6EF370000-0x00007FF6EF762000-memory.dmp	xmrig
behavioral2/memory/2056-2861-0x00007FF6593C0000-0x00007FF6597B2000-memory.dmp	xmrig
behavioral2/memory/3844-2858-0x00007FF7C5380000-0x00007FF7C5772000-memory.dmp	xmrig
behavioral2/memory/4052-2857-0x00007FF62E230000-0x00007FF62E622000-memory.dmp	xmrig
behavioral2/memory/5044-2883-0x00007FF78C3A0000-0x00007FF78C792000-memory.dmp	xmrig
behavioral2/memory/2600-2889-0x00007FF746EC0000-0x00007FF7472B2000-memory.dmp	xmrig
behavioral2/memory/4600-2887-0x00007FF7A6EA0000-0x00007FF7A7292000-memory.dmp	xmrig
behavioral2/memory/4252-2879-0x00007FF613070000-0x00007FF613462000-memory.dmp	xmrig
behavioral2/memory/4232-2881-0x00007FF715CF0000-0x00007FF7160E2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4456	kuvyYOj.exe
1808	MyEbucW.exe
4628	hQCrwaS.exe
3496	GqtyLCt.exe
2340	djFpnTs.exe
3436	dVrBQRT.exe
2056	GTbpfXV.exe
4052	MBNaTAY.exe
2004	aukVncS.exe
4552	hUUkXMV.exe
2928	cLXhCrm.exe
4600	zrJmYtC.exe
432	lgOMeWi.exe
1000	vbcCxvc.exe
4232	ZnyQdXA.exe
2600	fQKauEt.exe
5104	DPCVcbc.exe
1848	JoZiWiy.exe
3844	jytErDB.exe
5044	IYzeDPz.exe
4252	rSEcwBP.exe
412	LXgFrwx.exe
1708	gqZwLYp.exe
380	CGQwLJM.exe
3548	SSmpmQC.exe
4804	HHvnMNs.exe
4204	vbsXOId.exe
1416	LgZbfoR.exe
3876	bHvaXFy.exe
3192	guHbdhh.exe
4712	azbqtKw.exe
1280	dbCWqnz.exe
4084	DqJFUQZ.exe
1804	IEBTqts.exe
1216	EcRopLz.exe
4924	YqtNnza.exe
1404	MCMlPmG.exe
3996	FSeYBNY.exe
4108	NZvkMQX.exe
4460	tYQaBun.exe
2444	mHPTAZB.exe
4524	xqNoetL.exe
640	VFFCJFb.exe
3076	zjBbzke.exe
3948	LTJFhxe.exe
1408	ZCIMKxv.exe
624	oFMOvSV.exe
4336	PjkDmvQ.exe
3992	erLGZvJ.exe
1736	HGKfFQP.exe
1532	UocRhgH.exe
1156	RDOgQEe.exe
3836	ejJvhfB.exe
1328	OHHMLNP.exe
1384	jTqBBlu.exe
4672	eTdcvXZ.exe
2416	RFPrQKE.exe
2124	opeXZhm.exe
4748	Otiluet.exe
4584	SJKpHZd.exe
2420	fqRlASf.exe
4732	lMrFMRR.exe
2700	GEcmPjg.exe
2888	PTItfnW.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2704-0-0x00007FF7D80F0000-0x00007FF7D84E2000-memory.dmp	upx
behavioral2/files/0x000d000000023b23-6.dat	upx
behavioral2/files/0x000a000000023b92-18.dat	upx
behavioral2/files/0x000a000000023b93-33.dat	upx
behavioral2/files/0x000a000000023b9e-70.dat	upx
behavioral2/files/0x000a000000023b99-85.dat	upx
behavioral2/files/0x000a000000023b97-125.dat	upx
behavioral2/memory/3436-128-0x00007FF6D9660000-0x00007FF6D9A52000-memory.dmp	upx
behavioral2/memory/4052-130-0x00007FF62E230000-0x00007FF62E622000-memory.dmp	upx
behavioral2/memory/4552-132-0x00007FF6AF060000-0x00007FF6AF452000-memory.dmp	upx
behavioral2/memory/432-134-0x00007FF713E30000-0x00007FF714222000-memory.dmp	upx
behavioral2/memory/4252-179-0x00007FF613070000-0x00007FF613462000-memory.dmp	upx
behavioral2/memory/5044-283-0x00007FF78C3A0000-0x00007FF78C792000-memory.dmp	upx
behavioral2/memory/4600-233-0x00007FF7A6EA0000-0x00007FF7A7292000-memory.dmp	upx
behavioral2/memory/1808-201-0x00007FF74EAA0000-0x00007FF74EE92000-memory.dmp	upx
behavioral2/files/0x000b000000023b8e-196.dat	upx
behavioral2/files/0x0031000000023bb5-195.dat	upx
behavioral2/files/0x000a000000023ba3-193.dat	upx
behavioral2/files/0x000a000000023b9d-191.dat	upx
behavioral2/files/0x000a000000023ba2-189.dat	upx
behavioral2/files/0x000a000000023bad-187.dat	upx
behavioral2/files/0x000a000000023bb4-186.dat	upx
behavioral2/files/0x000a000000023bb3-185.dat	upx
behavioral2/files/0x000a000000023bb2-182.dat	upx
behavioral2/files/0x000a000000023ba7-204.dat	upx
behavioral2/files/0x000a000000023bb1-181.dat	upx
behavioral2/files/0x000a000000023bae-180.dat	upx
behavioral2/files/0x000a000000023bac-169.dat	upx
behavioral2/files/0x000a000000023ba5-166.dat	upx
behavioral2/files/0x000a000000023ba4-163.dat	upx
behavioral2/files/0x000a000000023bab-162.dat	upx
behavioral2/files/0x000a000000023baa-161.dat	upx
behavioral2/files/0x000a000000023ba8-160.dat	upx
behavioral2/files/0x000a000000023ba9-159.dat	upx
behavioral2/files/0x000a000000023ba6-152.dat	upx
behavioral2/memory/3844-149-0x00007FF7C5380000-0x00007FF7C5772000-memory.dmp	upx
behavioral2/memory/1848-148-0x00007FF67BE10000-0x00007FF67C202000-memory.dmp	upx
behavioral2/memory/5104-138-0x00007FF709A80000-0x00007FF709E72000-memory.dmp	upx
behavioral2/memory/2600-137-0x00007FF746EC0000-0x00007FF7472B2000-memory.dmp	upx
behavioral2/memory/4232-136-0x00007FF715CF0000-0x00007FF7160E2000-memory.dmp	upx
behavioral2/memory/1000-135-0x00007FF608E90000-0x00007FF609282000-memory.dmp	upx
behavioral2/memory/2928-133-0x00007FF6D1A70000-0x00007FF6D1E62000-memory.dmp	upx
behavioral2/memory/2004-131-0x00007FF6EF370000-0x00007FF6EF762000-memory.dmp	upx
behavioral2/memory/2056-129-0x00007FF6593C0000-0x00007FF6597B2000-memory.dmp	upx
behavioral2/memory/2340-124-0x00007FF789ED0000-0x00007FF78A2C2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba0-112.dat	upx
behavioral2/files/0x000a000000023b9c-102.dat	upx
behavioral2/files/0x000a000000023b9b-99.dat	upx
behavioral2/files/0x000a000000023ba1-91.dat	upx
behavioral2/files/0x000a000000023b9a-86.dat	upx
behavioral2/files/0x000a000000023b98-79.dat	upx
behavioral2/memory/3496-97-0x00007FF7ABA50000-0x00007FF7ABE42000-memory.dmp	upx
behavioral2/memory/4628-75-0x00007FF750E50000-0x00007FF751242000-memory.dmp	upx
behavioral2/files/0x000a000000023b9f-74.dat	upx
behavioral2/files/0x000a000000023b96-57.dat	upx
behavioral2/files/0x000a000000023b95-49.dat	upx
behavioral2/files/0x000a000000023b91-42.dat	upx
behavioral2/files/0x000a000000023b94-38.dat	upx
behavioral2/files/0x000b000000023b8d-34.dat	upx
behavioral2/memory/4456-15-0x00007FF718330000-0x00007FF718722000-memory.dmp	upx
behavioral2/memory/4456-2844-0x00007FF718330000-0x00007FF718722000-memory.dmp	upx
behavioral2/memory/4628-2848-0x00007FF750E50000-0x00007FF751242000-memory.dmp	upx
behavioral2/memory/3496-2852-0x00007FF7ABA50000-0x00007FF7ABE42000-memory.dmp	upx
behavioral2/memory/3436-2854-0x00007FF6D9660000-0x00007FF6D9A52000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\fcbYwzt.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\bnDofdb.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\pwTvBNb.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\GNFQKHQ.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\pbJgyHO.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\yYiGrjY.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\WNUJEiJ.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\ecwpQcJ.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\gxitPYQ.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\jlniVYi.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\RWvAWkc.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\SkrOmgn.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\WjxKfso.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\lfyZsxE.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\RpXmjiB.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\kfSfJTC.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\oJDCiUV.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\KspFoHl.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\YTpXcDN.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\ysELrCJ.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\CbAYBdY.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\NCwDRNm.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\VRbVfQm.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\ProHKgM.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\VHzOTQJ.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\HrwvDFM.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\iUAyzoA.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\ylQUwLY.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\JwWaaAt.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\KUmKCWo.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\mTVjbcY.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\JWSbxmC.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\tyWrGlB.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\gYPceMA.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\acoLNAF.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\FXvUJDM.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\QITrikf.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\XKmhpfZ.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\xfNBjKt.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\rmIAIMz.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\DAfCgND.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\THmozSx.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\MRKktwL.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\yUQKfDr.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\APzkyse.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\toaIuxB.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\OBIlDDn.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\RRnYCAx.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\JnHBVSg.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\IxrJoVT.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\MjENIfo.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\axQvvEl.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\gvUZJtu.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\VYXlQqW.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\lHEmpYq.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\dGcIArr.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\NgGkDCk.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\rJXhqQc.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\OYmDelV.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\VHuZZUT.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\FePWuIr.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\MiOAzmT.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\TtxhBex.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\syfTUaB.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2072	powershell.exe
2072	powershell.exe
2072	powershell.exe
2072	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
Token: SeDebugPrivilege	2072	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 2072	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	84
PID 2704 wrote to memory of 2072	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	84
PID 2704 wrote to memory of 4456	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	85
PID 2704 wrote to memory of 4456	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	85
PID 2704 wrote to memory of 3496	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	86
PID 2704 wrote to memory of 3496	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	86
PID 2704 wrote to memory of 3436	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	87
PID 2704 wrote to memory of 3436	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	87
PID 2704 wrote to memory of 1808	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	88
PID 2704 wrote to memory of 1808	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	88
PID 2704 wrote to memory of 4628	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	89
PID 2704 wrote to memory of 4628	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	89
PID 2704 wrote to memory of 2340	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	90
PID 2704 wrote to memory of 2340	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	90
PID 2704 wrote to memory of 2056	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	91
PID 2704 wrote to memory of 2056	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	91
PID 2704 wrote to memory of 4052	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	92
PID 2704 wrote to memory of 4052	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	92
PID 2704 wrote to memory of 4600	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	93
PID 2704 wrote to memory of 4600	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	93
PID 2704 wrote to memory of 2004	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	94
PID 2704 wrote to memory of 2004	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	94
PID 2704 wrote to memory of 4552	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	95
PID 2704 wrote to memory of 4552	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	95
PID 2704 wrote to memory of 2928	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	96
PID 2704 wrote to memory of 2928	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	96
PID 2704 wrote to memory of 432	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	97
PID 2704 wrote to memory of 432	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	97
PID 2704 wrote to memory of 1000	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	98
PID 2704 wrote to memory of 1000	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	98
PID 2704 wrote to memory of 4232	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	99
PID 2704 wrote to memory of 4232	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	99
PID 2704 wrote to memory of 2600	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	100
PID 2704 wrote to memory of 2600	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	100
PID 2704 wrote to memory of 5104	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	101
PID 2704 wrote to memory of 5104	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	101
PID 2704 wrote to memory of 1848	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	102
PID 2704 wrote to memory of 1848	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	102
PID 2704 wrote to memory of 3844	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	103
PID 2704 wrote to memory of 3844	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	103
PID 2704 wrote to memory of 5044	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	104
PID 2704 wrote to memory of 5044	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	104
PID 2704 wrote to memory of 4252	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	105
PID 2704 wrote to memory of 4252	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	105
PID 2704 wrote to memory of 412	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	106
PID 2704 wrote to memory of 412	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	106
PID 2704 wrote to memory of 1708	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	107
PID 2704 wrote to memory of 1708	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	107
PID 2704 wrote to memory of 380	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	108
PID 2704 wrote to memory of 380	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	108
PID 2704 wrote to memory of 3548	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	109
PID 2704 wrote to memory of 3548	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	109
PID 2704 wrote to memory of 4804	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	110
PID 2704 wrote to memory of 4804	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	110
PID 2704 wrote to memory of 4204	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	111
PID 2704 wrote to memory of 4204	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	111
PID 2704 wrote to memory of 1416	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	112
PID 2704 wrote to memory of 1416	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	112
PID 2704 wrote to memory of 3876	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	113
PID 2704 wrote to memory of 3876	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	113
PID 2704 wrote to memory of 3192	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	114
PID 2704 wrote to memory of 3192	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	114
PID 2704 wrote to memory of 4712	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	115
PID 2704 wrote to memory of 4712	2704	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2072
- C:\Windows\System\kuvyYOj.exe
  C:\Windows\System\kuvyYOj.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\GqtyLCt.exe
  C:\Windows\System\GqtyLCt.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\dVrBQRT.exe
  C:\Windows\System\dVrBQRT.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\MyEbucW.exe
  C:\Windows\System\MyEbucW.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\hQCrwaS.exe
  C:\Windows\System\hQCrwaS.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\djFpnTs.exe
  C:\Windows\System\djFpnTs.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\GTbpfXV.exe
  C:\Windows\System\GTbpfXV.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\MBNaTAY.exe
  C:\Windows\System\MBNaTAY.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\zrJmYtC.exe
  C:\Windows\System\zrJmYtC.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\aukVncS.exe
  C:\Windows\System\aukVncS.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\hUUkXMV.exe
  C:\Windows\System\hUUkXMV.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\cLXhCrm.exe
  C:\Windows\System\cLXhCrm.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\lgOMeWi.exe
  C:\Windows\System\lgOMeWi.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\vbcCxvc.exe
  C:\Windows\System\vbcCxvc.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\ZnyQdXA.exe
  C:\Windows\System\ZnyQdXA.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\fQKauEt.exe
  C:\Windows\System\fQKauEt.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\DPCVcbc.exe
  C:\Windows\System\DPCVcbc.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\JoZiWiy.exe
  C:\Windows\System\JoZiWiy.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\jytErDB.exe
  C:\Windows\System\jytErDB.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System\IYzeDPz.exe
  C:\Windows\System\IYzeDPz.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\rSEcwBP.exe
  C:\Windows\System\rSEcwBP.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\LXgFrwx.exe
  C:\Windows\System\LXgFrwx.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\gqZwLYp.exe
  C:\Windows\System\gqZwLYp.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\CGQwLJM.exe
  C:\Windows\System\CGQwLJM.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\SSmpmQC.exe
  C:\Windows\System\SSmpmQC.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\HHvnMNs.exe
  C:\Windows\System\HHvnMNs.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\vbsXOId.exe
  C:\Windows\System\vbsXOId.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\LgZbfoR.exe
  C:\Windows\System\LgZbfoR.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\bHvaXFy.exe
  C:\Windows\System\bHvaXFy.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\guHbdhh.exe
  C:\Windows\System\guHbdhh.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\azbqtKw.exe
  C:\Windows\System\azbqtKw.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\dbCWqnz.exe
  C:\Windows\System\dbCWqnz.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\DqJFUQZ.exe
  C:\Windows\System\DqJFUQZ.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\IEBTqts.exe
  C:\Windows\System\IEBTqts.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\EcRopLz.exe
  C:\Windows\System\EcRopLz.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\YqtNnza.exe
  C:\Windows\System\YqtNnza.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\MCMlPmG.exe
  C:\Windows\System\MCMlPmG.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\FSeYBNY.exe
  C:\Windows\System\FSeYBNY.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\NZvkMQX.exe
  C:\Windows\System\NZvkMQX.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\tYQaBun.exe
  C:\Windows\System\tYQaBun.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\mHPTAZB.exe
  C:\Windows\System\mHPTAZB.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\xqNoetL.exe
  C:\Windows\System\xqNoetL.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\UocRhgH.exe
  C:\Windows\System\UocRhgH.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\eTdcvXZ.exe
  C:\Windows\System\eTdcvXZ.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\VFFCJFb.exe
  C:\Windows\System\VFFCJFb.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\zjBbzke.exe
  C:\Windows\System\zjBbzke.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\LTJFhxe.exe
  C:\Windows\System\LTJFhxe.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\ZCIMKxv.exe
  C:\Windows\System\ZCIMKxv.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\oFMOvSV.exe
  C:\Windows\System\oFMOvSV.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\PjkDmvQ.exe
  C:\Windows\System\PjkDmvQ.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\erLGZvJ.exe
  C:\Windows\System\erLGZvJ.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\HGKfFQP.exe
  C:\Windows\System\HGKfFQP.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\RDOgQEe.exe
  C:\Windows\System\RDOgQEe.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\ejJvhfB.exe
  C:\Windows\System\ejJvhfB.exe
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Windows\System\OHHMLNP.exe
  C:\Windows\System\OHHMLNP.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\jTqBBlu.exe
  C:\Windows\System\jTqBBlu.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\RFPrQKE.exe
  C:\Windows\System\RFPrQKE.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\opeXZhm.exe
  C:\Windows\System\opeXZhm.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\HaKNASZ.exe
  C:\Windows\System\HaKNASZ.exe
  2⤵
  PID:4468
- C:\Windows\System\Otiluet.exe
  C:\Windows\System\Otiluet.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\SJKpHZd.exe
  C:\Windows\System\SJKpHZd.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\fqRlASf.exe
  C:\Windows\System\fqRlASf.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\lMrFMRR.exe
  C:\Windows\System\lMrFMRR.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\GEcmPjg.exe
  C:\Windows\System\GEcmPjg.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\PTItfnW.exe
  C:\Windows\System\PTItfnW.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\mqkSvtr.exe
  C:\Windows\System\mqkSvtr.exe
  2⤵
  PID:3508
- C:\Windows\System\OyjYwpW.exe
  C:\Windows\System\OyjYwpW.exe
  2⤵
  PID:2136
- C:\Windows\System\ZRIZRxW.exe
  C:\Windows\System\ZRIZRxW.exe
  2⤵
  PID:5020
- C:\Windows\System\NnlwMOo.exe
  C:\Windows\System\NnlwMOo.exe
  2⤵
  PID:1132
- C:\Windows\System\bpROkCh.exe
  C:\Windows\System\bpROkCh.exe
  2⤵
  PID:4072
- C:\Windows\System\RZJgHRQ.exe
  C:\Windows\System\RZJgHRQ.exe
  2⤵
  PID:4844
- C:\Windows\System\BFJIfaD.exe
  C:\Windows\System\BFJIfaD.exe
  2⤵
  PID:2356
- C:\Windows\System\IVvZGOC.exe
  C:\Windows\System\IVvZGOC.exe
  2⤵
  PID:4132
- C:\Windows\System\ZzQjMxD.exe
  C:\Windows\System\ZzQjMxD.exe
  2⤵
  PID:4056
- C:\Windows\System\xYksxPg.exe
  C:\Windows\System\xYksxPg.exe
  2⤵
  PID:5144
- C:\Windows\System\JgMMPOW.exe
  C:\Windows\System\JgMMPOW.exe
  2⤵
  PID:5164
- C:\Windows\System\xdMnPMy.exe
  C:\Windows\System\xdMnPMy.exe
  2⤵
  PID:5188
- C:\Windows\System\msMvjfJ.exe
  C:\Windows\System\msMvjfJ.exe
  2⤵
  PID:5212
- C:\Windows\System\PsrSigO.exe
  C:\Windows\System\PsrSigO.exe
  2⤵
  PID:5240
- C:\Windows\System\sFcKfvV.exe
  C:\Windows\System\sFcKfvV.exe
  2⤵
  PID:5260
- C:\Windows\System\lxOYgQU.exe
  C:\Windows\System\lxOYgQU.exe
  2⤵
  PID:5276
- C:\Windows\System\nZGqqqn.exe
  C:\Windows\System\nZGqqqn.exe
  2⤵
  PID:5356
- C:\Windows\System\ILoCYvi.exe
  C:\Windows\System\ILoCYvi.exe
  2⤵
  PID:5380
- C:\Windows\System\VZAxlLS.exe
  C:\Windows\System\VZAxlLS.exe
  2⤵
  PID:5408
- C:\Windows\System\XdwkDVc.exe
  C:\Windows\System\XdwkDVc.exe
  2⤵
  PID:5432
- C:\Windows\System\AcjCIcP.exe
  C:\Windows\System\AcjCIcP.exe
  2⤵
  PID:5672
- C:\Windows\System\fxcEtbC.exe
  C:\Windows\System\fxcEtbC.exe
  2⤵
  PID:5704
- C:\Windows\System\YHNZeEj.exe
  C:\Windows\System\YHNZeEj.exe
  2⤵
  PID:5732
- C:\Windows\System\dCwqeQc.exe
  C:\Windows\System\dCwqeQc.exe
  2⤵
  PID:5756
- C:\Windows\System\AnFipku.exe
  C:\Windows\System\AnFipku.exe
  2⤵
  PID:5848
- C:\Windows\System\kBmnJZI.exe
  C:\Windows\System\kBmnJZI.exe
  2⤵
  PID:5868
- C:\Windows\System\YyZXFxj.exe
  C:\Windows\System\YyZXFxj.exe
  2⤵
  PID:5884
- C:\Windows\System\AVXuggh.exe
  C:\Windows\System\AVXuggh.exe
  2⤵
  PID:5900
- C:\Windows\System\ONzwBKA.exe
  C:\Windows\System\ONzwBKA.exe
  2⤵
  PID:5916
- C:\Windows\System\uxUzzce.exe
  C:\Windows\System\uxUzzce.exe
  2⤵
  PID:5932
- C:\Windows\System\NIJpuKC.exe
  C:\Windows\System\NIJpuKC.exe
  2⤵
  PID:5948
- C:\Windows\System\BiGFzlc.exe
  C:\Windows\System\BiGFzlc.exe
  2⤵
  PID:5964
- C:\Windows\System\FwBVQhU.exe
  C:\Windows\System\FwBVQhU.exe
  2⤵
  PID:5984
- C:\Windows\System\pFZypsM.exe
  C:\Windows\System\pFZypsM.exe
  2⤵
  PID:6000
- C:\Windows\System\cTJTiYT.exe
  C:\Windows\System\cTJTiYT.exe
  2⤵
  PID:6024
- C:\Windows\System\lrCJSpM.exe
  C:\Windows\System\lrCJSpM.exe
  2⤵
  PID:6040
- C:\Windows\System\nieDaAC.exe
  C:\Windows\System\nieDaAC.exe
  2⤵
  PID:6080
- C:\Windows\System\NfIiiwd.exe
  C:\Windows\System\NfIiiwd.exe
  2⤵
  PID:6096
- C:\Windows\System\GgkuOcw.exe
  C:\Windows\System\GgkuOcw.exe
  2⤵
  PID:6124
- C:\Windows\System\LOzuwEL.exe
  C:\Windows\System\LOzuwEL.exe
  2⤵
  PID:2968
- C:\Windows\System\ShPDlZY.exe
  C:\Windows\System\ShPDlZY.exe
  2⤵
  PID:3860
- C:\Windows\System\davNaue.exe
  C:\Windows\System\davNaue.exe
  2⤵
  PID:3736
- C:\Windows\System\lgfmVlD.exe
  C:\Windows\System\lgfmVlD.exe
  2⤵
  PID:3216
- C:\Windows\System\ylQUwLY.exe
  C:\Windows\System\ylQUwLY.exe
  2⤵
  PID:4972
- C:\Windows\System\HFfvrCl.exe
  C:\Windows\System\HFfvrCl.exe
  2⤵
  PID:5424
- C:\Windows\System\suuLtCA.exe
  C:\Windows\System\suuLtCA.exe
  2⤵
  PID:5496
- C:\Windows\System\HdgTuer.exe
  C:\Windows\System\HdgTuer.exe
  2⤵
  PID:5572
- C:\Windows\System\leYmMQC.exe
  C:\Windows\System\leYmMQC.exe
  2⤵
  PID:5612
- C:\Windows\System\hoFhvwj.exe
  C:\Windows\System\hoFhvwj.exe
  2⤵
  PID:5644
- C:\Windows\System\PYfuvQg.exe
  C:\Windows\System\PYfuvQg.exe
  2⤵
  PID:5680
- C:\Windows\System\gGWELUP.exe
  C:\Windows\System\gGWELUP.exe
  2⤵
  PID:5784
- C:\Windows\System\HMkANLS.exe
  C:\Windows\System\HMkANLS.exe
  2⤵
  PID:5912
- C:\Windows\System\CjsRqvn.exe
  C:\Windows\System\CjsRqvn.exe
  2⤵
  PID:5956
- C:\Windows\System\erLPkvW.exe
  C:\Windows\System\erLPkvW.exe
  2⤵
  PID:6036
- C:\Windows\System\hLsZqMm.exe
  C:\Windows\System\hLsZqMm.exe
  2⤵
  PID:6104
- C:\Windows\System\adbaSws.exe
  C:\Windows\System\adbaSws.exe
  2⤵
  PID:2400
- C:\Windows\System\HKzrJjA.exe
  C:\Windows\System\HKzrJjA.exe
  2⤵
  PID:4316
- C:\Windows\System\HebeWCQ.exe
  C:\Windows\System\HebeWCQ.exe
  2⤵
  PID:6112
- C:\Windows\System\sQsleKm.exe
  C:\Windows\System\sQsleKm.exe
  2⤵
  PID:5876
- C:\Windows\System\QzOvudi.exe
  C:\Windows\System\QzOvudi.exe
  2⤵
  PID:400
- C:\Windows\System\qlymqWk.exe
  C:\Windows\System\qlymqWk.exe
  2⤵
  PID:644
- C:\Windows\System\FgPTmDk.exe
  C:\Windows\System\FgPTmDk.exe
  2⤵
  PID:4352
- C:\Windows\System\YmldaFW.exe
  C:\Windows\System\YmldaFW.exe
  2⤵
  PID:5236
- C:\Windows\System\tVZfrXu.exe
  C:\Windows\System\tVZfrXu.exe
  2⤵
  PID:4540
- C:\Windows\System\vxFCKWP.exe
  C:\Windows\System\vxFCKWP.exe
  2⤵
  PID:3588
- C:\Windows\System\swEvRrd.exe
  C:\Windows\System\swEvRrd.exe
  2⤵
  PID:4888
- C:\Windows\System\MZXFkGn.exe
  C:\Windows\System\MZXFkGn.exe
  2⤵
  PID:904
- C:\Windows\System\lSiBOPt.exe
  C:\Windows\System\lSiBOPt.exe
  2⤵
  PID:4756
- C:\Windows\System\wnoicGv.exe
  C:\Windows\System\wnoicGv.exe
  2⤵
  PID:2380
- C:\Windows\System\GgXOgyI.exe
  C:\Windows\System\GgXOgyI.exe
  2⤵
  PID:892
- C:\Windows\System\RBqZxRV.exe
  C:\Windows\System\RBqZxRV.exe
  2⤵
  PID:3820
- C:\Windows\System\OchnAUC.exe
  C:\Windows\System\OchnAUC.exe
  2⤵
  PID:1060
- C:\Windows\System\okQeufs.exe
  C:\Windows\System\okQeufs.exe
  2⤵
  PID:3112
- C:\Windows\System\UsJgFIC.exe
  C:\Windows\System\UsJgFIC.exe
  2⤵
  PID:4636
- C:\Windows\System\tzXGzuE.exe
  C:\Windows\System\tzXGzuE.exe
  2⤵
  PID:4956
- C:\Windows\System\mBMQvPF.exe
  C:\Windows\System\mBMQvPF.exe
  2⤵
  PID:2396
- C:\Windows\System\DagCRCO.exe
  C:\Windows\System\DagCRCO.exe
  2⤵
  PID:2692
- C:\Windows\System\DSwOOdE.exe
  C:\Windows\System\DSwOOdE.exe
  2⤵
  PID:4324
- C:\Windows\System\UxTCKjt.exe
  C:\Windows\System\UxTCKjt.exe
  2⤵
  PID:5128
- C:\Windows\System\poFNVNa.exe
  C:\Windows\System\poFNVNa.exe
  2⤵
  PID:5596
- C:\Windows\System\wdruZRY.exe
  C:\Windows\System\wdruZRY.exe
  2⤵
  PID:5692
- C:\Windows\System\sPgLPwf.exe
  C:\Windows\System\sPgLPwf.exe
  2⤵
  PID:5944
- C:\Windows\System\NkAHnjP.exe
  C:\Windows\System\NkAHnjP.exe
  2⤵
  PID:6092
- C:\Windows\System\bQxsfqY.exe
  C:\Windows\System\bQxsfqY.exe
  2⤵
  PID:876
- C:\Windows\System\QfFhaQa.exe
  C:\Windows\System\QfFhaQa.exe
  2⤵
  PID:1316
- C:\Windows\System\ryNyTDo.exe
  C:\Windows\System\ryNyTDo.exe
  2⤵
  PID:3584
- C:\Windows\System\mHLfgdR.exe
  C:\Windows\System\mHLfgdR.exe
  2⤵
  PID:3236
- C:\Windows\System\rfONFLP.exe
  C:\Windows\System\rfONFLP.exe
  2⤵
  PID:3688
- C:\Windows\System\JlIaAdL.exe
  C:\Windows\System\JlIaAdL.exe
  2⤵
  PID:1196
- C:\Windows\System\SHtEWtL.exe
  C:\Windows\System\SHtEWtL.exe
  2⤵
  PID:3208
- C:\Windows\System\LexWAHX.exe
  C:\Windows\System\LexWAHX.exe
  2⤵
  PID:4272
- C:\Windows\System\mWoSUlQ.exe
  C:\Windows\System\mWoSUlQ.exe
  2⤵
  PID:2084
- C:\Windows\System\jFiolco.exe
  C:\Windows\System\jFiolco.exe
  2⤵
  PID:4952
- C:\Windows\System\RzkWhiO.exe
  C:\Windows\System\RzkWhiO.exe
  2⤵
  PID:5880
- C:\Windows\System\igoozLM.exe
  C:\Windows\System\igoozLM.exe
  2⤵
  PID:6140
- C:\Windows\System\ustQCBR.exe
  C:\Windows\System\ustQCBR.exe
  2⤵
  PID:5184
- C:\Windows\System\xXmbHnu.exe
  C:\Windows\System\xXmbHnu.exe
  2⤵
  PID:6152
- C:\Windows\System\TmzMYLV.exe
  C:\Windows\System\TmzMYLV.exe
  2⤵
  PID:6176
- C:\Windows\System\CKUJZYk.exe
  C:\Windows\System\CKUJZYk.exe
  2⤵
  PID:6192
- C:\Windows\System\rTVmHBI.exe
  C:\Windows\System\rTVmHBI.exe
  2⤵
  PID:6220
- C:\Windows\System\bEkMXzQ.exe
  C:\Windows\System\bEkMXzQ.exe
  2⤵
  PID:6248
- C:\Windows\System\rsrHkff.exe
  C:\Windows\System\rsrHkff.exe
  2⤵
  PID:6264
- C:\Windows\System\jTWqJYH.exe
  C:\Windows\System\jTWqJYH.exe
  2⤵
  PID:6288
- C:\Windows\System\LzqoQQW.exe
  C:\Windows\System\LzqoQQW.exe
  2⤵
  PID:6312
- C:\Windows\System\fUDGCGT.exe
  C:\Windows\System\fUDGCGT.exe
  2⤵
  PID:6336
- C:\Windows\System\LIGhqGj.exe
  C:\Windows\System\LIGhqGj.exe
  2⤵
  PID:6356
- C:\Windows\System\hQgMoCv.exe
  C:\Windows\System\hQgMoCv.exe
  2⤵
  PID:6384
- C:\Windows\System\nlsLNLZ.exe
  C:\Windows\System\nlsLNLZ.exe
  2⤵
  PID:6404
- C:\Windows\System\lgsRnPN.exe
  C:\Windows\System\lgsRnPN.exe
  2⤵
  PID:6428
- C:\Windows\System\TcmVyWj.exe
  C:\Windows\System\TcmVyWj.exe
  2⤵
  PID:6448
- C:\Windows\System\afCsFtW.exe
  C:\Windows\System\afCsFtW.exe
  2⤵
  PID:6468
- C:\Windows\System\ooeZAUc.exe
  C:\Windows\System\ooeZAUc.exe
  2⤵
  PID:6496
- C:\Windows\System\GNsIHYR.exe
  C:\Windows\System\GNsIHYR.exe
  2⤵
  PID:6512
- C:\Windows\System\QcwazOW.exe
  C:\Windows\System\QcwazOW.exe
  2⤵
  PID:6536
- C:\Windows\System\SvCfNvI.exe
  C:\Windows\System\SvCfNvI.exe
  2⤵
  PID:6572
- C:\Windows\System\dMXQwLF.exe
  C:\Windows\System\dMXQwLF.exe
  2⤵
  PID:6600
- C:\Windows\System\FJdWYXD.exe
  C:\Windows\System\FJdWYXD.exe
  2⤵
  PID:6620
- C:\Windows\System\XNicksP.exe
  C:\Windows\System\XNicksP.exe
  2⤵
  PID:6644
- C:\Windows\System\TLrtlKC.exe
  C:\Windows\System\TLrtlKC.exe
  2⤵
  PID:6668
- C:\Windows\System\xjxIMhV.exe
  C:\Windows\System\xjxIMhV.exe
  2⤵
  PID:6688
- C:\Windows\System\SvdkLOI.exe
  C:\Windows\System\SvdkLOI.exe
  2⤵
  PID:6712
- C:\Windows\System\ihoXiQu.exe
  C:\Windows\System\ihoXiQu.exe
  2⤵
  PID:6732
- C:\Windows\System\shhXbts.exe
  C:\Windows\System\shhXbts.exe
  2⤵
  PID:6756
- C:\Windows\System\KIPeqCf.exe
  C:\Windows\System\KIPeqCf.exe
  2⤵
  PID:6780
- C:\Windows\System\syPlQxr.exe
  C:\Windows\System\syPlQxr.exe
  2⤵
  PID:6804
- C:\Windows\System\SmeUzZM.exe
  C:\Windows\System\SmeUzZM.exe
  2⤵
  PID:6824
- C:\Windows\System\fwDlbsI.exe
  C:\Windows\System\fwDlbsI.exe
  2⤵
  PID:6844
- C:\Windows\System\gagPqTj.exe
  C:\Windows\System\gagPqTj.exe
  2⤵
  PID:6864
- C:\Windows\System\otijTtL.exe
  C:\Windows\System\otijTtL.exe
  2⤵
  PID:6884
- C:\Windows\System\iUugJvH.exe
  C:\Windows\System\iUugJvH.exe
  2⤵
  PID:6900
- C:\Windows\System\tHugLCa.exe
  C:\Windows\System\tHugLCa.exe
  2⤵
  PID:6924
- C:\Windows\System\tEDiCWF.exe
  C:\Windows\System\tEDiCWF.exe
  2⤵
  PID:6948
- C:\Windows\System\vgGkJYa.exe
  C:\Windows\System\vgGkJYa.exe
  2⤵
  PID:6972
- C:\Windows\System\pCwmwXe.exe
  C:\Windows\System\pCwmwXe.exe
  2⤵
  PID:6992
- C:\Windows\System\ycoEZyy.exe
  C:\Windows\System\ycoEZyy.exe
  2⤵
  PID:7016
- C:\Windows\System\iClIRtc.exe
  C:\Windows\System\iClIRtc.exe
  2⤵
  PID:7036
- C:\Windows\System\XBGyWPT.exe
  C:\Windows\System\XBGyWPT.exe
  2⤵
  PID:7060
- C:\Windows\System\sLDQMPH.exe
  C:\Windows\System\sLDQMPH.exe
  2⤵
  PID:7080
- C:\Windows\System\XPSXoNq.exe
  C:\Windows\System\XPSXoNq.exe
  2⤵
  PID:7104
- C:\Windows\System\nVMltUf.exe
  C:\Windows\System\nVMltUf.exe
  2⤵
  PID:7120
- C:\Windows\System\qTikHpV.exe
  C:\Windows\System\qTikHpV.exe
  2⤵
  PID:7148
- C:\Windows\System\heskXZI.exe
  C:\Windows\System\heskXZI.exe
  2⤵
  PID:4176
- C:\Windows\System\BBbqrcT.exe
  C:\Windows\System\BBbqrcT.exe
  2⤵
  PID:3872
- C:\Windows\System\fdDJluw.exe
  C:\Windows\System\fdDJluw.exe
  2⤵
  PID:4688
- C:\Windows\System\OSKDNdX.exe
  C:\Windows\System\OSKDNdX.exe
  2⤵
  PID:2456
- C:\Windows\System\NOhCUnW.exe
  C:\Windows\System\NOhCUnW.exe
  2⤵
  PID:5892
- C:\Windows\System\TkvUFCU.exe
  C:\Windows\System\TkvUFCU.exe
  2⤵
  PID:6364
- C:\Windows\System\vmbRFSf.exe
  C:\Windows\System\vmbRFSf.exe
  2⤵
  PID:4940
- C:\Windows\System\VoeTIcr.exe
  C:\Windows\System\VoeTIcr.exe
  2⤵
  PID:6464
- C:\Windows\System\KVuSKGI.exe
  C:\Windows\System\KVuSKGI.exe
  2⤵
  PID:6552
- C:\Windows\System\kPDqwHu.exe
  C:\Windows\System\kPDqwHu.exe
  2⤵
  PID:6564
- C:\Windows\System\LpmSJOu.exe
  C:\Windows\System\LpmSJOu.exe
  2⤵
  PID:6320
- C:\Windows\System\askHlPP.exe
  C:\Windows\System\askHlPP.exe
  2⤵
  PID:6588
- C:\Windows\System\sAlCZWh.exe
  C:\Windows\System\sAlCZWh.exe
  2⤵
  PID:6636
- C:\Windows\System\UAcnvYv.exe
  C:\Windows\System\UAcnvYv.exe
  2⤵
  PID:6684
- C:\Windows\System\YrFTFTy.exe
  C:\Windows\System\YrFTFTy.exe
  2⤵
  PID:6728
- C:\Windows\System\NCNveRp.exe
  C:\Windows\System\NCNveRp.exe
  2⤵
  PID:6772
- C:\Windows\System\doehuPT.exe
  C:\Windows\System\doehuPT.exe
  2⤵
  PID:6816
- C:\Windows\System\KEdYbJF.exe
  C:\Windows\System\KEdYbJF.exe
  2⤵
  PID:6284
- C:\Windows\System\wTkqWAO.exe
  C:\Windows\System\wTkqWAO.exe
  2⤵
  PID:6988
- C:\Windows\System\aeEaxCH.exe
  C:\Windows\System\aeEaxCH.exe
  2⤵
  PID:7024
- C:\Windows\System\NnFqUjM.exe
  C:\Windows\System\NnFqUjM.exe
  2⤵
  PID:7068
- C:\Windows\System\mjRhwEX.exe
  C:\Windows\System\mjRhwEX.exe
  2⤵
  PID:7128
- C:\Windows\System\SDhUiWM.exe
  C:\Windows\System\SDhUiWM.exe
  2⤵
  PID:3824
- C:\Windows\System\ljuLgGQ.exe
  C:\Windows\System\ljuLgGQ.exe
  2⤵
  PID:7188
- C:\Windows\System\nOVqjaP.exe
  C:\Windows\System\nOVqjaP.exe
  2⤵
  PID:7208
- C:\Windows\System\ASNjWSS.exe
  C:\Windows\System\ASNjWSS.exe
  2⤵
  PID:7240
- C:\Windows\System\gpYwEiC.exe
  C:\Windows\System\gpYwEiC.exe
  2⤵
  PID:7260
- C:\Windows\System\wOPKiJW.exe
  C:\Windows\System\wOPKiJW.exe
  2⤵
  PID:7288
- C:\Windows\System\IhHCMTs.exe
  C:\Windows\System\IhHCMTs.exe
  2⤵
  PID:7308
- C:\Windows\System\kBtAznE.exe
  C:\Windows\System\kBtAznE.exe
  2⤵
  PID:7508
- C:\Windows\System\XRxKUxV.exe
  C:\Windows\System\XRxKUxV.exe
  2⤵
  PID:7528
- C:\Windows\System\xWEmzgO.exe
  C:\Windows\System\xWEmzgO.exe
  2⤵
  PID:7556
- C:\Windows\System\QHWlrSD.exe
  C:\Windows\System\QHWlrSD.exe
  2⤵
  PID:7572
- C:\Windows\System\dEVJphc.exe
  C:\Windows\System\dEVJphc.exe
  2⤵
  PID:7600
- C:\Windows\System\pzcqBFr.exe
  C:\Windows\System\pzcqBFr.exe
  2⤵
  PID:7632
- C:\Windows\System\stffAwC.exe
  C:\Windows\System\stffAwC.exe
  2⤵
  PID:7656
- C:\Windows\System\BzJbNqf.exe
  C:\Windows\System\BzJbNqf.exe
  2⤵
  PID:7680
- C:\Windows\System\PqkZPmT.exe
  C:\Windows\System\PqkZPmT.exe
  2⤵
  PID:7712
- C:\Windows\System\rYEhmxw.exe
  C:\Windows\System\rYEhmxw.exe
  2⤵
  PID:7728
- C:\Windows\System\mdGVyaA.exe
  C:\Windows\System\mdGVyaA.exe
  2⤵
  PID:7752
- C:\Windows\System\bxkAVMu.exe
  C:\Windows\System\bxkAVMu.exe
  2⤵
  PID:7772
- C:\Windows\System\sTXmqhg.exe
  C:\Windows\System\sTXmqhg.exe
  2⤵
  PID:7792
- C:\Windows\System\SifZuVP.exe
  C:\Windows\System\SifZuVP.exe
  2⤵
  PID:7812
- C:\Windows\System\NnnVbUQ.exe
  C:\Windows\System\NnnVbUQ.exe
  2⤵
  PID:7832
- C:\Windows\System\SoXNcgD.exe
  C:\Windows\System\SoXNcgD.exe
  2⤵
  PID:7852
- C:\Windows\System\TfBUAPQ.exe
  C:\Windows\System\TfBUAPQ.exe
  2⤵
  PID:7876
- C:\Windows\System\MwKhElO.exe
  C:\Windows\System\MwKhElO.exe
  2⤵
  PID:7900
- C:\Windows\System\ntTuODu.exe
  C:\Windows\System\ntTuODu.exe
  2⤵
  PID:7928
- C:\Windows\System\WxUMBKq.exe
  C:\Windows\System\WxUMBKq.exe
  2⤵
  PID:7948
- C:\Windows\System\tCehlRs.exe
  C:\Windows\System\tCehlRs.exe
  2⤵
  PID:7976
- C:\Windows\System\mQvWumW.exe
  C:\Windows\System\mQvWumW.exe
  2⤵
  PID:8008
- C:\Windows\System\ZoxdqdC.exe
  C:\Windows\System\ZoxdqdC.exe
  2⤵
  PID:8028
- C:\Windows\System\cZBQTMY.exe
  C:\Windows\System\cZBQTMY.exe
  2⤵
  PID:8064
- C:\Windows\System\BSLNCel.exe
  C:\Windows\System\BSLNCel.exe
  2⤵
  PID:8092
- C:\Windows\System\leWYcyk.exe
  C:\Windows\System\leWYcyk.exe
  2⤵
  PID:8112
- C:\Windows\System\xSMxavG.exe
  C:\Windows\System\xSMxavG.exe
  2⤵
  PID:8136
- C:\Windows\System\uhUUdAQ.exe
  C:\Windows\System\uhUUdAQ.exe
  2⤵
  PID:8160
- C:\Windows\System\DyoPQQf.exe
  C:\Windows\System\DyoPQQf.exe
  2⤵
  PID:8184
- C:\Windows\System\ltBMfxy.exe
  C:\Windows\System\ltBMfxy.exe
  2⤵
  PID:6400
- C:\Windows\System\SBRyJtV.exe
  C:\Windows\System\SBRyJtV.exe
  2⤵
  PID:6296
- C:\Windows\System\IvyWNDf.exe
  C:\Windows\System\IvyWNDf.exe
  2⤵
  PID:7160
- C:\Windows\System\iNILlTZ.exe
  C:\Windows\System\iNILlTZ.exe
  2⤵
  PID:3952
- C:\Windows\System\UdKKheF.exe
  C:\Windows\System\UdKKheF.exe
  2⤵
  PID:6936
- C:\Windows\System\zFAgJws.exe
  C:\Windows\System\zFAgJws.exe
  2⤵
  PID:7252
- C:\Windows\System\yALCkhF.exe
  C:\Windows\System\yALCkhF.exe
  2⤵
  PID:7320
- C:\Windows\System\CogcScQ.exe
  C:\Windows\System\CogcScQ.exe
  2⤵
  PID:7352
- C:\Windows\System\LfloqOY.exe
  C:\Windows\System\LfloqOY.exe
  2⤵
  PID:6368
- C:\Windows\System\UuiJwOS.exe
  C:\Windows\System\UuiJwOS.exe
  2⤵
  PID:7396
- C:\Windows\System\GewBXXB.exe
  C:\Windows\System\GewBXXB.exe
  2⤵
  PID:7112
- C:\Windows\System\LVZnfhz.exe
  C:\Windows\System\LVZnfhz.exe
  2⤵
  PID:4916
- C:\Windows\System\nYiiiyV.exe
  C:\Windows\System\nYiiiyV.exe
  2⤵
  PID:7140
- C:\Windows\System\dmWnOLo.exe
  C:\Windows\System\dmWnOLo.exe
  2⤵
  PID:7476
- C:\Windows\System\TxxalwV.exe
  C:\Windows\System\TxxalwV.exe
  2⤵
  PID:7280
- C:\Windows\System\SnkpCri.exe
  C:\Windows\System\SnkpCri.exe
  2⤵
  PID:7564
- C:\Windows\System\daRGNEb.exe
  C:\Windows\System\daRGNEb.exe
  2⤵
  PID:7624
- C:\Windows\System\PCmlMfj.exe
  C:\Windows\System\PCmlMfj.exe
  2⤵
  PID:1724
- C:\Windows\System\ZNOxWMC.exe
  C:\Windows\System\ZNOxWMC.exe
  2⤵
  PID:7720
- C:\Windows\System\cDxUSIx.exe
  C:\Windows\System\cDxUSIx.exe
  2⤵
  PID:7800
- C:\Windows\System\GIYRRnH.exe
  C:\Windows\System\GIYRRnH.exe
  2⤵
  PID:7008
- C:\Windows\System\COawmpL.exe
  C:\Windows\System\COawmpL.exe
  2⤵
  PID:7860
- C:\Windows\System\MWYiMwR.exe
  C:\Windows\System\MWYiMwR.exe
  2⤵
  PID:7180
- C:\Windows\System\THyEtFx.exe
  C:\Windows\System\THyEtFx.exe
  2⤵
  PID:7924
- C:\Windows\System\twOemcd.exe
  C:\Windows\System\twOemcd.exe
  2⤵
  PID:7544
- C:\Windows\System\XZzSqPz.exe
  C:\Windows\System\XZzSqPz.exe
  2⤵
  PID:8084
- C:\Windows\System\LbVarBv.exe
  C:\Windows\System\LbVarBv.exe
  2⤵
  PID:8196
- C:\Windows\System\hVCEggU.exe
  C:\Windows\System\hVCEggU.exe
  2⤵
  PID:8216
- C:\Windows\System\Inabnav.exe
  C:\Windows\System\Inabnav.exe
  2⤵
  PID:8244
- C:\Windows\System\CMbBdIB.exe
  C:\Windows\System\CMbBdIB.exe
  2⤵
  PID:8264
- C:\Windows\System\aGPQuhg.exe
  C:\Windows\System\aGPQuhg.exe
  2⤵
  PID:8280
- C:\Windows\System\lZxMaJk.exe
  C:\Windows\System\lZxMaJk.exe
  2⤵
  PID:8308
- C:\Windows\System\ApZvoxX.exe
  C:\Windows\System\ApZvoxX.exe
  2⤵
  PID:8344
- C:\Windows\System\ZMhnoiA.exe
  C:\Windows\System\ZMhnoiA.exe
  2⤵
  PID:8380
- C:\Windows\System\OqEsEKM.exe
  C:\Windows\System\OqEsEKM.exe
  2⤵
  PID:8400
- C:\Windows\System\NLkjiTi.exe
  C:\Windows\System\NLkjiTi.exe
  2⤵
  PID:8424
- C:\Windows\System\QlDFdkQ.exe
  C:\Windows\System\QlDFdkQ.exe
  2⤵
  PID:8452
- C:\Windows\System\fADyIII.exe
  C:\Windows\System\fADyIII.exe
  2⤵
  PID:8476
- C:\Windows\System\fnFzgKh.exe
  C:\Windows\System\fnFzgKh.exe
  2⤵
  PID:8496
- C:\Windows\System\btpzrLp.exe
  C:\Windows\System\btpzrLp.exe
  2⤵
  PID:8520
- C:\Windows\System\UUZiSFj.exe
  C:\Windows\System\UUZiSFj.exe
  2⤵
  PID:8544
- C:\Windows\System\KIwzAjO.exe
  C:\Windows\System\KIwzAjO.exe
  2⤵
  PID:8564
- C:\Windows\System\eyFYWjk.exe
  C:\Windows\System\eyFYWjk.exe
  2⤵
  PID:8588
- C:\Windows\System\WGOJqNS.exe
  C:\Windows\System\WGOJqNS.exe
  2⤵
  PID:8608
- C:\Windows\System\NoRztVh.exe
  C:\Windows\System\NoRztVh.exe
  2⤵
  PID:8632
- C:\Windows\System\kWKzwOn.exe
  C:\Windows\System\kWKzwOn.exe
  2⤵
  PID:8656
- C:\Windows\System\NWtftxt.exe
  C:\Windows\System\NWtftxt.exe
  2⤵
  PID:8680
- C:\Windows\System\rHtHRZW.exe
  C:\Windows\System\rHtHRZW.exe
  2⤵
  PID:8700
- C:\Windows\System\BIgZQWX.exe
  C:\Windows\System\BIgZQWX.exe
  2⤵
  PID:8720
- C:\Windows\System\QjHXSyf.exe
  C:\Windows\System\QjHXSyf.exe
  2⤵
  PID:8744
- C:\Windows\System\aPvcMhM.exe
  C:\Windows\System\aPvcMhM.exe
  2⤵
  PID:8776
- C:\Windows\System\TLknpeI.exe
  C:\Windows\System\TLknpeI.exe
  2⤵
  PID:8796
- C:\Windows\System\KlRJBON.exe
  C:\Windows\System\KlRJBON.exe
  2⤵
  PID:8820
- C:\Windows\System\RleHNOf.exe
  C:\Windows\System\RleHNOf.exe
  2⤵
  PID:8844
- C:\Windows\System\gSmGvit.exe
  C:\Windows\System\gSmGvit.exe
  2⤵
  PID:8868
- C:\Windows\System\kDKeasc.exe
  C:\Windows\System\kDKeasc.exe
  2⤵
  PID:8892
- C:\Windows\System\pDoMytN.exe
  C:\Windows\System\pDoMytN.exe
  2⤵
  PID:8916
- C:\Windows\System\SqZHQbQ.exe
  C:\Windows\System\SqZHQbQ.exe
  2⤵
  PID:8940
- C:\Windows\System\SJhOGjk.exe
  C:\Windows\System\SJhOGjk.exe
  2⤵
  PID:8956
- C:\Windows\System\WXTlxiu.exe
  C:\Windows\System\WXTlxiu.exe
  2⤵
  PID:8984
- C:\Windows\System\qfOXYcz.exe
  C:\Windows\System\qfOXYcz.exe
  2⤵
  PID:9008
- C:\Windows\System\MpBsHlU.exe
  C:\Windows\System\MpBsHlU.exe
  2⤵
  PID:9028
- C:\Windows\System\aZLWuUg.exe
  C:\Windows\System\aZLWuUg.exe
  2⤵
  PID:9056
- C:\Windows\System\wtUygYe.exe
  C:\Windows\System\wtUygYe.exe
  2⤵
  PID:9080
- C:\Windows\System\VdwSlNK.exe
  C:\Windows\System\VdwSlNK.exe
  2⤵
  PID:9108
- C:\Windows\System\JtyPOwX.exe
  C:\Windows\System\JtyPOwX.exe
  2⤵
  PID:9128
- C:\Windows\System\IVeUcwi.exe
  C:\Windows\System\IVeUcwi.exe
  2⤵
  PID:9156
- C:\Windows\System\MoFBOaO.exe
  C:\Windows\System\MoFBOaO.exe
  2⤵
  PID:9188
- C:\Windows\System\lYFULep.exe
  C:\Windows\System\lYFULep.exe
  2⤵
  PID:9212
- C:\Windows\System\ykVfnqF.exe
  C:\Windows\System\ykVfnqF.exe
  2⤵
  PID:6860
- C:\Windows\System\woWlNFr.exe
  C:\Windows\System\woWlNFr.exe
  2⤵
  PID:7248
- C:\Windows\System\urLegVB.exe
  C:\Windows\System\urLegVB.exe
  2⤵
  PID:7944
- C:\Windows\System\xPNRTuA.exe
  C:\Windows\System\xPNRTuA.exe
  2⤵
  PID:6148
- C:\Windows\System\uJTnNWI.exe
  C:\Windows\System\uJTnNWI.exe
  2⤵
  PID:6800
- C:\Windows\System\cxXdRaf.exe
  C:\Windows\System\cxXdRaf.exe
  2⤵
  PID:7628
- C:\Windows\System\ZFiNCXb.exe
  C:\Windows\System\ZFiNCXb.exe
  2⤵
  PID:7472
- C:\Windows\System\QleowBO.exe
  C:\Windows\System\QleowBO.exe
  2⤵
  PID:6704
- C:\Windows\System\TaGqMiT.exe
  C:\Windows\System\TaGqMiT.exe
  2⤵
  PID:6720
- C:\Windows\System\GrIkHWm.exe
  C:\Windows\System\GrIkHWm.exe
  2⤵
  PID:6656
- C:\Windows\System\UWyBOwd.exe
  C:\Windows\System\UWyBOwd.exe
  2⤵
  PID:7740
- C:\Windows\System\pEMtdaR.exe
  C:\Windows\System\pEMtdaR.exe
  2⤵
  PID:7768
- C:\Windows\System\IngntZl.exe
  C:\Windows\System\IngntZl.exe
  2⤵
  PID:8004
- C:\Windows\System\LehEiQm.exe
  C:\Windows\System\LehEiQm.exe
  2⤵
  PID:7840
- C:\Windows\System\xUuSpsc.exe
  C:\Windows\System\xUuSpsc.exe
  2⤵
  PID:8252
- C:\Windows\System\ooEXqor.exe
  C:\Windows\System\ooEXqor.exe
  2⤵
  PID:8340
- C:\Windows\System\NDPDnti.exe
  C:\Windows\System\NDPDnti.exe
  2⤵
  PID:8020
- C:\Windows\System\ZONZaIY.exe
  C:\Windows\System\ZONZaIY.exe
  2⤵
  PID:8508
- C:\Windows\System\YmxidqZ.exe
  C:\Windows\System\YmxidqZ.exe
  2⤵
  PID:7276
- C:\Windows\System\zWspaqp.exe
  C:\Windows\System\zWspaqp.exe
  2⤵
  PID:8600
- C:\Windows\System\YXHKUCH.exe
  C:\Windows\System\YXHKUCH.exe
  2⤵
  PID:7892
- C:\Windows\System\hjGBQhE.exe
  C:\Windows\System\hjGBQhE.exe
  2⤵
  PID:8840
- C:\Windows\System\JlKlnnV.exe
  C:\Windows\System\JlKlnnV.exe
  2⤵
  PID:8864
- C:\Windows\System\uWdCOHk.exe
  C:\Windows\System\uWdCOHk.exe
  2⤵
  PID:9520
- C:\Windows\System\cqImiOD.exe
  C:\Windows\System\cqImiOD.exe
  2⤵
  PID:9572
- C:\Windows\System\uzrRkrC.exe
  C:\Windows\System\uzrRkrC.exe
  2⤵
  PID:9592
- C:\Windows\System\iHiavOx.exe
  C:\Windows\System\iHiavOx.exe
  2⤵
  PID:9616
- C:\Windows\System\GqVUAfW.exe
  C:\Windows\System\GqVUAfW.exe
  2⤵
  PID:9636
- C:\Windows\System\GaoAvoC.exe
  C:\Windows\System\GaoAvoC.exe
  2⤵
  PID:9660
- C:\Windows\System\IXbySay.exe
  C:\Windows\System\IXbySay.exe
  2⤵
  PID:10056
- C:\Windows\System\QYLlZzN.exe
  C:\Windows\System\QYLlZzN.exe
  2⤵
  PID:10080
- C:\Windows\System\mAXOkVK.exe
  C:\Windows\System\mAXOkVK.exe
  2⤵
  PID:10096
- C:\Windows\System\sNmgMMY.exe
  C:\Windows\System\sNmgMMY.exe
  2⤵
  PID:10116
- C:\Windows\System\UhCAJlf.exe
  C:\Windows\System\UhCAJlf.exe
  2⤵
  PID:10136
- C:\Windows\System\iqSFwjB.exe
  C:\Windows\System\iqSFwjB.exe
  2⤵
  PID:10156
- C:\Windows\System\FvlNeZs.exe
  C:\Windows\System\FvlNeZs.exe
  2⤵
  PID:10176
- C:\Windows\System\QYlcKPu.exe
  C:\Windows\System\QYlcKPu.exe
  2⤵
  PID:10200
- C:\Windows\System\HtVeQWn.exe
  C:\Windows\System\HtVeQWn.exe
  2⤵
  PID:10224
- C:\Windows\System\bVXokvH.exe
  C:\Windows\System\bVXokvH.exe
  2⤵
  PID:8992
- C:\Windows\System\oXgBnCS.exe
  C:\Windows\System\oXgBnCS.exe
  2⤵
  PID:9088
- C:\Windows\System\hdRfLcO.exe
  C:\Windows\System\hdRfLcO.exe
  2⤵
  PID:9120
- C:\Windows\System\toaIuxB.exe
  C:\Windows\System\toaIuxB.exe
  2⤵
  PID:9164
- C:\Windows\System\FePWuIr.exe
  C:\Windows\System\FePWuIr.exe
  2⤵
  PID:7972
- C:\Windows\System\iOcfWSL.exe
  C:\Windows\System\iOcfWSL.exe
  2⤵
  PID:6436
- C:\Windows\System\XLwlqrJ.exe
  C:\Windows\System\XLwlqrJ.exe
  2⤵
  PID:8560
- C:\Windows\System\KGELLsH.exe
  C:\Windows\System\KGELLsH.exe
  2⤵
  PID:6632
- C:\Windows\System\qBDhCIJ.exe
  C:\Windows\System\qBDhCIJ.exe
  2⤵
  PID:8784
- C:\Windows\System\kZKyocH.exe
  C:\Windows\System\kZKyocH.exe
  2⤵
  PID:8852
- C:\Windows\System\VjgivUZ.exe
  C:\Windows\System\VjgivUZ.exe
  2⤵
  PID:8952
- C:\Windows\System\YRSrFaA.exe
  C:\Windows\System\YRSrFaA.exe
  2⤵
  PID:8316
- C:\Windows\System\fsXvxcH.exe
  C:\Windows\System\fsXvxcH.exe
  2⤵
  PID:7076
- C:\Windows\System\zdVgSEa.exe
  C:\Windows\System\zdVgSEa.exe
  2⤵
  PID:9312
- C:\Windows\System\fUmNziN.exe
  C:\Windows\System\fUmNziN.exe
  2⤵
  PID:9388
- C:\Windows\System\VpnEQPn.exe
  C:\Windows\System\VpnEQPn.exe
  2⤵
  PID:8120
- C:\Windows\System\eOzsFtE.exe
  C:\Windows\System\eOzsFtE.exe
  2⤵
  PID:8672
- C:\Windows\System\qcfPiEs.exe
  C:\Windows\System\qcfPiEs.exe
  2⤵
  PID:8728
- C:\Windows\System\Vixyxam.exe
  C:\Windows\System\Vixyxam.exe
  2⤵
  PID:8764
- C:\Windows\System\DLFlOcA.exe
  C:\Windows\System\DLFlOcA.exe
  2⤵
  PID:8356
- C:\Windows\System\ufCHvyJ.exe
  C:\Windows\System\ufCHvyJ.exe
  2⤵
  PID:7868
- C:\Windows\System\ALqbspj.exe
  C:\Windows\System\ALqbspj.exe
  2⤵
  PID:9020
- C:\Windows\System\kQbpplA.exe
  C:\Windows\System\kQbpplA.exe
  2⤵
  PID:9204
- C:\Windows\System\oEXChAE.exe
  C:\Windows\System\oEXChAE.exe
  2⤵
  PID:9336
- C:\Windows\System\pRFyTUk.exe
  C:\Windows\System\pRFyTUk.exe
  2⤵
  PID:7920
- C:\Windows\System\GfNHgEB.exe
  C:\Windows\System\GfNHgEB.exe
  2⤵
  PID:8472
- C:\Windows\System\cddFWML.exe
  C:\Windows\System\cddFWML.exe
  2⤵
  PID:8172
- C:\Windows\System\MRzsWgm.exe
  C:\Windows\System\MRzsWgm.exe
  2⤵
  PID:9260
- C:\Windows\System\DWmkHvd.exe
  C:\Windows\System\DWmkHvd.exe
  2⤵
  PID:9936
- C:\Windows\System\ldxJQWK.exe
  C:\Windows\System\ldxJQWK.exe
  2⤵
  PID:9732
- C:\Windows\System\sABigeV.exe
  C:\Windows\System\sABigeV.exe
  2⤵
  PID:9420
- C:\Windows\System\JnwlQxw.exe
  C:\Windows\System\JnwlQxw.exe
  2⤵
  PID:9868
- C:\Windows\System\JODBwlA.exe
  C:\Windows\System\JODBwlA.exe
  2⤵
  PID:10128
- C:\Windows\System\ceHjtFS.exe
  C:\Windows\System\ceHjtFS.exe
  2⤵
  PID:5628
- C:\Windows\System\zgsobcD.exe
  C:\Windows\System\zgsobcD.exe
  2⤵
  PID:8396
- C:\Windows\System\nOyYiEl.exe
  C:\Windows\System\nOyYiEl.exe
  2⤵
  PID:9516
- C:\Windows\System\SNRpIDo.exe
  C:\Windows\System\SNRpIDo.exe
  2⤵
  PID:8752
- C:\Windows\System\oPGuWEZ.exe
  C:\Windows\System\oPGuWEZ.exe
  2⤵
  PID:8924
- C:\Windows\System\CFANkQf.exe
  C:\Windows\System\CFANkQf.exe
  2⤵
  PID:8996
- C:\Windows\System\FGdPrmF.exe
  C:\Windows\System\FGdPrmF.exe
  2⤵
  PID:7348
- C:\Windows\System\BOmUgkU.exe
  C:\Windows\System\BOmUgkU.exe
  2⤵
  PID:10004
- C:\Windows\System\mAqmqDH.exe
  C:\Windows\System\mAqmqDH.exe
  2⤵
  PID:7828
- C:\Windows\System\SVGyrpK.exe
  C:\Windows\System\SVGyrpK.exe
  2⤵
  PID:10092
- C:\Windows\System\UQxDwYd.exe
  C:\Windows\System\UQxDwYd.exe
  2⤵
  PID:9676
- C:\Windows\System\xExrTNr.exe
  C:\Windows\System\xExrTNr.exe
  2⤵
  PID:7988
- C:\Windows\System\cCQmKZq.exe
  C:\Windows\System\cCQmKZq.exe
  2⤵
  PID:9000
- C:\Windows\System\dRpTMWS.exe
  C:\Windows\System\dRpTMWS.exe
  2⤵
  PID:10252
- C:\Windows\System\EOcabql.exe
  C:\Windows\System\EOcabql.exe
  2⤵
  PID:10272
- C:\Windows\System\oiKRqez.exe
  C:\Windows\System\oiKRqez.exe
  2⤵
  PID:10292
- C:\Windows\System\tVkxfNN.exe
  C:\Windows\System\tVkxfNN.exe
  2⤵
  PID:10320
- C:\Windows\System\smDJLvS.exe
  C:\Windows\System\smDJLvS.exe
  2⤵
  PID:10340
- C:\Windows\System\tavIfxC.exe
  C:\Windows\System\tavIfxC.exe
  2⤵
  PID:10364
- C:\Windows\System\PAAlbUx.exe
  C:\Windows\System\PAAlbUx.exe
  2⤵
  PID:10384
- C:\Windows\System\RlRlYJR.exe
  C:\Windows\System\RlRlYJR.exe
  2⤵
  PID:10408
- C:\Windows\System\gToWVLy.exe
  C:\Windows\System\gToWVLy.exe
  2⤵
  PID:10428
- C:\Windows\System\ebjoOtQ.exe
  C:\Windows\System\ebjoOtQ.exe
  2⤵
  PID:10448
- C:\Windows\System\xyRhEDq.exe
  C:\Windows\System\xyRhEDq.exe
  2⤵
  PID:10464
- C:\Windows\System\nqDTCHT.exe
  C:\Windows\System\nqDTCHT.exe
  2⤵
  PID:10484
- C:\Windows\System\CTnVZcI.exe
  C:\Windows\System\CTnVZcI.exe
  2⤵
  PID:10500
- C:\Windows\System\UtDYekT.exe
  C:\Windows\System\UtDYekT.exe
  2⤵
  PID:10516
- C:\Windows\System\RTsUnFc.exe
  C:\Windows\System\RTsUnFc.exe
  2⤵
  PID:10536
- C:\Windows\System\lYUGrky.exe
  C:\Windows\System\lYUGrky.exe
  2⤵
  PID:10560
- C:\Windows\System\KyIFOQw.exe
  C:\Windows\System\KyIFOQw.exe
  2⤵
  PID:10580
- C:\Windows\System\ZLWFljy.exe
  C:\Windows\System\ZLWFljy.exe
  2⤵
  PID:10600
- C:\Windows\System\WNnaPtA.exe
  C:\Windows\System\WNnaPtA.exe
  2⤵
  PID:10620
- C:\Windows\System\iqUkHZe.exe
  C:\Windows\System\iqUkHZe.exe
  2⤵
  PID:10640
- C:\Windows\System\MljGRTu.exe
  C:\Windows\System\MljGRTu.exe
  2⤵
  PID:10668
- C:\Windows\System\fVlInpP.exe
  C:\Windows\System\fVlInpP.exe
  2⤵
  PID:10688
- C:\Windows\System\DEncNfX.exe
  C:\Windows\System\DEncNfX.exe
  2⤵
  PID:10712
- C:\Windows\System\yXcggNV.exe
  C:\Windows\System\yXcggNV.exe
  2⤵
  PID:10732
- C:\Windows\System\nyXAoRq.exe
  C:\Windows\System\nyXAoRq.exe
  2⤵
  PID:10752
- C:\Windows\System\yEOTLhq.exe
  C:\Windows\System\yEOTLhq.exe
  2⤵
  PID:10776
- C:\Windows\System\KwgCLdA.exe
  C:\Windows\System\KwgCLdA.exe
  2⤵
  PID:10808
- C:\Windows\System\aUIHBkP.exe
  C:\Windows\System\aUIHBkP.exe
  2⤵
  PID:10828
- C:\Windows\System\beRrmVr.exe
  C:\Windows\System\beRrmVr.exe
  2⤵
  PID:10844
- C:\Windows\System\upueguJ.exe
  C:\Windows\System\upueguJ.exe
  2⤵
  PID:10868
- C:\Windows\System\asGZPKR.exe
  C:\Windows\System\asGZPKR.exe
  2⤵
  PID:10892
- C:\Windows\System\ffxfiWH.exe
  C:\Windows\System\ffxfiWH.exe
  2⤵
  PID:10916
- C:\Windows\System\gSsFczR.exe
  C:\Windows\System\gSsFczR.exe
  2⤵
  PID:10940
- C:\Windows\System\nYVTxhm.exe
  C:\Windows\System\nYVTxhm.exe
  2⤵
  PID:10976
- C:\Windows\System\MCiVEwX.exe
  C:\Windows\System\MCiVEwX.exe
  2⤵
  PID:10996
- C:\Windows\System\PFhXSFJ.exe
  C:\Windows\System\PFhXSFJ.exe
  2⤵
  PID:11016
- C:\Windows\System\phbfGYO.exe
  C:\Windows\System\phbfGYO.exe
  2⤵
  PID:11036
- C:\Windows\System\PfCILES.exe
  C:\Windows\System\PfCILES.exe
  2⤵
  PID:11060
- C:\Windows\System\vABAEpq.exe
  C:\Windows\System\vABAEpq.exe
  2⤵
  PID:11080
- C:\Windows\System\RrnKmxx.exe
  C:\Windows\System\RrnKmxx.exe
  2⤵
  PID:11104
- C:\Windows\System\MLpzyrA.exe
  C:\Windows\System\MLpzyrA.exe
  2⤵
  PID:11132
- C:\Windows\System\wqKVUFm.exe
  C:\Windows\System\wqKVUFm.exe
  2⤵
  PID:11152
- C:\Windows\System\jYFNBRn.exe
  C:\Windows\System\jYFNBRn.exe
  2⤵
  PID:11176
- C:\Windows\System\kmayqbz.exe
  C:\Windows\System\kmayqbz.exe
  2⤵
  PID:11196
- C:\Windows\System\rMktNNG.exe
  C:\Windows\System\rMktNNG.exe
  2⤵
  PID:11224
- C:\Windows\System\XLvdnyK.exe
  C:\Windows\System\XLvdnyK.exe
  2⤵
  PID:11248
- C:\Windows\System\UUPEpno.exe
  C:\Windows\System\UUPEpno.exe
  2⤵
  PID:8432
- C:\Windows\System\cArEJFZ.exe
  C:\Windows\System\cArEJFZ.exe
  2⤵
  PID:9768
- C:\Windows\System\iLFFddB.exe
  C:\Windows\System\iLFFddB.exe
  2⤵
  PID:7216
- C:\Windows\System\mhOCCjs.exe
  C:\Windows\System\mhOCCjs.exe
  2⤵
  PID:9440
- C:\Windows\System\jNyUnLX.exe
  C:\Windows\System\jNyUnLX.exe
  2⤵
  PID:8620
- C:\Windows\System\VvyaUzB.exe
  C:\Windows\System\VvyaUzB.exe
  2⤵
  PID:8964
- C:\Windows\System\FfuhVnI.exe
  C:\Windows\System\FfuhVnI.exe
  2⤵
  PID:10112
- C:\Windows\System\ycrbVqZ.exe
  C:\Windows\System\ycrbVqZ.exe
  2⤵
  PID:6916
- C:\Windows\System\wvZKUIR.exe
  C:\Windows\System\wvZKUIR.exe
  2⤵
  PID:10332
- C:\Windows\System\ERjOuNh.exe
  C:\Windows\System\ERjOuNh.exe
  2⤵
  PID:9724
- C:\Windows\System\PuRhGxf.exe
  C:\Windows\System\PuRhGxf.exe
  2⤵
  PID:10372
- C:\Windows\System\setvzBn.exe
  C:\Windows\System\setvzBn.exe
  2⤵
  PID:8368
- C:\Windows\System\nHBYsMJ.exe
  C:\Windows\System\nHBYsMJ.exe
  2⤵
  PID:10568
- C:\Windows\System\pzUJEQd.exe
  C:\Windows\System\pzUJEQd.exe
  2⤵
  PID:10572
- C:\Windows\System\hJhbIIM.exe
  C:\Windows\System\hJhbIIM.exe
  2⤵
  PID:3900
- C:\Windows\System\djVUzsy.exe
  C:\Windows\System\djVUzsy.exe
  2⤵
  PID:10684
- C:\Windows\System\qummcSF.exe
  C:\Windows\System\qummcSF.exe
  2⤵
  PID:9992
- C:\Windows\System\bgDaSTp.exe
  C:\Windows\System\bgDaSTp.exe
  2⤵
  PID:10796
- C:\Windows\System\aPrdzAX.exe
  C:\Windows\System\aPrdzAX.exe
  2⤵
  PID:10164
- C:\Windows\System\SJjDxxF.exe
  C:\Windows\System\SJjDxxF.exe
  2⤵
  PID:10924
- C:\Windows\System\JZkEmtf.exe
  C:\Windows\System\JZkEmtf.exe
  2⤵
  PID:10260
- C:\Windows\System\joJqXdy.exe
  C:\Windows\System\joJqXdy.exe
  2⤵
  PID:10992
- C:\Windows\System\bgerVcz.exe
  C:\Windows\System\bgerVcz.exe
  2⤵
  PID:10312
- C:\Windows\System\teiCCSG.exe
  C:\Windows\System\teiCCSG.exe
  2⤵
  PID:11280
- C:\Windows\System\ZOIoBgQ.exe
  C:\Windows\System\ZOIoBgQ.exe
  2⤵
  PID:11296
- C:\Windows\System\HOPPJuq.exe
  C:\Windows\System\HOPPJuq.exe
  2⤵
  PID:11316
- C:\Windows\System\BwFYVxZ.exe
  C:\Windows\System\BwFYVxZ.exe
  2⤵
  PID:11332
- C:\Windows\System\ZLkEosl.exe
  C:\Windows\System\ZLkEosl.exe
  2⤵
  PID:11348
- C:\Windows\System\BlqbsOv.exe
  C:\Windows\System\BlqbsOv.exe
  2⤵
  PID:11368
- C:\Windows\System\YNJZRHr.exe
  C:\Windows\System\YNJZRHr.exe
  2⤵
  PID:11388
- C:\Windows\System\PuAZqLC.exe
  C:\Windows\System\PuAZqLC.exe
  2⤵
  PID:11404
- C:\Windows\System\iTLyzDn.exe
  C:\Windows\System\iTLyzDn.exe
  2⤵
  PID:11420
- C:\Windows\System\gPzXjAn.exe
  C:\Windows\System\gPzXjAn.exe
  2⤵
  PID:11444
- C:\Windows\System\OuaWFfS.exe
  C:\Windows\System\OuaWFfS.exe
  2⤵
  PID:11464
- C:\Windows\System\hBYDoUm.exe
  C:\Windows\System\hBYDoUm.exe
  2⤵
  PID:11484
- C:\Windows\System\axsEMFI.exe
  C:\Windows\System\axsEMFI.exe
  2⤵
  PID:11508
- C:\Windows\System\oymCRLr.exe
  C:\Windows\System\oymCRLr.exe
  2⤵
  PID:11528
- C:\Windows\System\NpdQVqo.exe
  C:\Windows\System\NpdQVqo.exe
  2⤵
  PID:11548
- C:\Windows\System\dTBswFk.exe
  C:\Windows\System\dTBswFk.exe
  2⤵
  PID:11572
- C:\Windows\System\fLoOsId.exe
  C:\Windows\System\fLoOsId.exe
  2⤵
  PID:11596
- C:\Windows\System\NLPYCBa.exe
  C:\Windows\System\NLPYCBa.exe
  2⤵
  PID:11624
- C:\Windows\System\PVqfjho.exe
  C:\Windows\System\PVqfjho.exe
  2⤵
  PID:11640
- C:\Windows\System\mJiglNW.exe
  C:\Windows\System\mJiglNW.exe
  2⤵
  PID:11664
- C:\Windows\System\SGawqro.exe
  C:\Windows\System\SGawqro.exe
  2⤵
  PID:11688
- C:\Windows\System\RFZxBDU.exe
  C:\Windows\System\RFZxBDU.exe
  2⤵
  PID:11712
- C:\Windows\System\FDTxgKM.exe
  C:\Windows\System\FDTxgKM.exe
  2⤵
  PID:11736
- C:\Windows\System\HXaotKH.exe
  C:\Windows\System\HXaotKH.exe
  2⤵
  PID:11756
- C:\Windows\System\KrlsaOv.exe
  C:\Windows\System\KrlsaOv.exe
  2⤵
  PID:11780
- C:\Windows\System\ZIVQOBf.exe
  C:\Windows\System\ZIVQOBf.exe
  2⤵
  PID:11804
- C:\Windows\System\hYUIukC.exe
  C:\Windows\System\hYUIukC.exe
  2⤵
  PID:11824
- C:\Windows\System\pgLRoGM.exe
  C:\Windows\System\pgLRoGM.exe
  2⤵
  PID:11852
- C:\Windows\System\ZTxmfhP.exe
  C:\Windows\System\ZTxmfhP.exe
  2⤵
  PID:11876
- C:\Windows\System\LMctYCn.exe
  C:\Windows\System\LMctYCn.exe
  2⤵
  PID:11896
- C:\Windows\System\POETNIs.exe
  C:\Windows\System\POETNIs.exe
  2⤵
  PID:11920
- C:\Windows\System\vySaQtj.exe
  C:\Windows\System\vySaQtj.exe
  2⤵
  PID:11944
- C:\Windows\System\cEbZMfF.exe
  C:\Windows\System\cEbZMfF.exe
  2⤵
  PID:11968
- C:\Windows\System\sNdleGf.exe
  C:\Windows\System\sNdleGf.exe
  2⤵
  PID:11988
- C:\Windows\System\ANzIMYA.exe
  C:\Windows\System\ANzIMYA.exe
  2⤵
  PID:12008
- C:\Windows\System\QuxORMD.exe
  C:\Windows\System\QuxORMD.exe
  2⤵
  PID:12036
- C:\Windows\System\sfpZNPr.exe
  C:\Windows\System\sfpZNPr.exe
  2⤵
  PID:12064
- C:\Windows\System\LMznGej.exe
  C:\Windows\System\LMznGej.exe
  2⤵
  PID:12092
- C:\Windows\System\RwIibUd.exe
  C:\Windows\System\RwIibUd.exe
  2⤵
  PID:12120
- C:\Windows\System\lpGwkqj.exe
  C:\Windows\System\lpGwkqj.exe
  2⤵
  PID:12148
- C:\Windows\System\AojphFT.exe
  C:\Windows\System\AojphFT.exe
  2⤵
  PID:12172
- C:\Windows\System\CWRLhRW.exe
  C:\Windows\System\CWRLhRW.exe
  2⤵
  PID:12200
- C:\Windows\System\ABBFWUZ.exe
  C:\Windows\System\ABBFWUZ.exe
  2⤵
  PID:12224
- C:\Windows\System\BNJREJA.exe
  C:\Windows\System\BNJREJA.exe
  2⤵
  PID:12260
- C:\Windows\System\cbpzeuo.exe
  C:\Windows\System\cbpzeuo.exe
  2⤵
  PID:10440
- C:\Windows\System\AtBVmxq.exe
  C:\Windows\System\AtBVmxq.exe
  2⤵
  PID:10508
- C:\Windows\System\ejtudCA.exe
  C:\Windows\System\ejtudCA.exe
  2⤵
  PID:11140
- C:\Windows\System\JAvIIwK.exe
  C:\Windows\System\JAvIIwK.exe
  2⤵
  PID:11212
- C:\Windows\System\basxIDb.exe
  C:\Windows\System\basxIDb.exe
  2⤵
  PID:10608
- C:\Windows\System\bOmYbmq.exe
  C:\Windows\System\bOmYbmq.exe
  2⤵
  PID:10660
- C:\Windows\System\PbWVyLi.exe
  C:\Windows\System\PbWVyLi.exe
  2⤵
  PID:10744
- C:\Windows\System\huyNhYb.exe
  C:\Windows\System\huyNhYb.exe
  2⤵
  PID:9680
- C:\Windows\System\OqHYdqB.exe
  C:\Windows\System\OqHYdqB.exe
  2⤵
  PID:10836
- C:\Windows\System\KskejLP.exe
  C:\Windows\System\KskejLP.exe
  2⤵
  PID:10852
- C:\Windows\System\DiTlUKL.exe
  C:\Windows\System\DiTlUKL.exe
  2⤵
  PID:10680
- C:\Windows\System\aDPKdDO.exe
  C:\Windows\System\aDPKdDO.exe
  2⤵
  PID:10960
- C:\Windows\System\QLLvhnN.exe
  C:\Windows\System\QLLvhnN.exe
  2⤵
  PID:10972
- C:\Windows\System\DQQZyIe.exe
  C:\Windows\System\DQQZyIe.exe
  2⤵
  PID:9508
- C:\Windows\System\IvuJyJc.exe
  C:\Windows\System\IvuJyJc.exe
  2⤵
  PID:11012
- C:\Windows\System\wsPfEoQ.exe
  C:\Windows\System\wsPfEoQ.exe
  2⤵
  PID:11028
- C:\Windows\System\xgfRABw.exe
  C:\Windows\System\xgfRABw.exe
  2⤵
  PID:11044
- C:\Windows\System\IKxZqPs.exe
  C:\Windows\System\IKxZqPs.exe
  2⤵
  PID:11304
- C:\Windows\System\aefTADp.exe
  C:\Windows\System\aefTADp.exe
  2⤵
  PID:11340
- C:\Windows\System\wDXcPBo.exe
  C:\Windows\System\wDXcPBo.exe
  2⤵
  PID:11364
- C:\Windows\System\wUsWOnb.exe
  C:\Windows\System\wUsWOnb.exe
  2⤵
  PID:11400
- C:\Windows\System\uLUAxiX.exe
  C:\Windows\System\uLUAxiX.exe
  2⤵
  PID:11440
- C:\Windows\System\fwlFRvo.exe
  C:\Windows\System\fwlFRvo.exe
  2⤵
  PID:11476
- C:\Windows\System\XYffkYk.exe
  C:\Windows\System\XYffkYk.exe
  2⤵
  PID:11056
- C:\Windows\System\jCWocWS.exe
  C:\Windows\System\jCWocWS.exe
  2⤵
  PID:11544
- C:\Windows\System\GuOlvBu.exe
  C:\Windows\System\GuOlvBu.exe
  2⤵
  PID:11560
- C:\Windows\System\abXvLdm.exe
  C:\Windows\System\abXvLdm.exe
  2⤵
  PID:11244
- C:\Windows\System\mMXbCyl.exe
  C:\Windows\System\mMXbCyl.exe
  2⤵
  PID:11720
- C:\Windows\System\ZCSndNF.exe
  C:\Windows\System\ZCSndNF.exe
  2⤵
  PID:9148
- C:\Windows\System\YiMgOEE.exe
  C:\Windows\System\YiMgOEE.exe
  2⤵
  PID:10748
- C:\Windows\System\yWwQWef.exe
  C:\Windows\System\yWwQWef.exe
  2⤵
  PID:12004
- C:\Windows\System\TjtRItf.exe
  C:\Windows\System\TjtRItf.exe
  2⤵
  PID:10528
- C:\Windows\System\wnoIVlN.exe
  C:\Windows\System\wnoIVlN.exe
  2⤵
  PID:12308
- C:\Windows\System\vFgdcsX.exe
  C:\Windows\System\vFgdcsX.exe
  2⤵
  PID:12332
- C:\Windows\System\AvXsBsi.exe
  C:\Windows\System\AvXsBsi.exe
  2⤵
  PID:12352
- C:\Windows\System\VjxsWmn.exe
  C:\Windows\System\VjxsWmn.exe
  2⤵
  PID:12372
- C:\Windows\System\lOespfl.exe
  C:\Windows\System\lOespfl.exe
  2⤵
  PID:12396
- C:\Windows\System\EwpomAY.exe
  C:\Windows\System\EwpomAY.exe
  2⤵
  PID:12420
- C:\Windows\System\jREFprE.exe
  C:\Windows\System\jREFprE.exe
  2⤵
  PID:12444
- C:\Windows\System\GPiAkim.exe
  C:\Windows\System\GPiAkim.exe
  2⤵
  PID:12464
- C:\Windows\System\jnShbjx.exe
  C:\Windows\System\jnShbjx.exe
  2⤵
  PID:12484
- C:\Windows\System\WUJrCMY.exe
  C:\Windows\System\WUJrCMY.exe
  2⤵
  PID:12508
- C:\Windows\System\fOvHVFr.exe
  C:\Windows\System\fOvHVFr.exe
  2⤵
  PID:12536
- C:\Windows\System\WqlbkXQ.exe
  C:\Windows\System\WqlbkXQ.exe
  2⤵
  PID:12556
- C:\Windows\System\UDTVcZu.exe
  C:\Windows\System\UDTVcZu.exe
  2⤵
  PID:12580
- C:\Windows\System\griQAWf.exe
  C:\Windows\System\griQAWf.exe
  2⤵
  PID:12604
- C:\Windows\System\FCWoalS.exe
  C:\Windows\System\FCWoalS.exe
  2⤵
  PID:12628
- C:\Windows\System\ftXpGeb.exe
  C:\Windows\System\ftXpGeb.exe
  2⤵
  PID:12652
- C:\Windows\System\ABaSnqA.exe
  C:\Windows\System\ABaSnqA.exe
  2⤵
  PID:12680
- C:\Windows\System\JkNgksI.exe
  C:\Windows\System\JkNgksI.exe
  2⤵
  PID:12704
- C:\Windows\System\MStZmVX.exe
  C:\Windows\System\MStZmVX.exe
  2⤵
  PID:12728
- C:\Windows\System\SITIRlp.exe
  C:\Windows\System\SITIRlp.exe
  2⤵
  PID:12744
- C:\Windows\System\AHONeeB.exe
  C:\Windows\System\AHONeeB.exe
  2⤵
  PID:12760
- C:\Windows\System\eWiXvsL.exe
  C:\Windows\System\eWiXvsL.exe
  2⤵
  PID:12780
- C:\Windows\System\BMWZzbc.exe
  C:\Windows\System\BMWZzbc.exe
  2⤵
  PID:12800
- C:\Windows\System\PIaBmJl.exe
  C:\Windows\System\PIaBmJl.exe
  2⤵
  PID:12824
- C:\Windows\System\NViFJQy.exe
  C:\Windows\System\NViFJQy.exe
  2⤵
  PID:12844
- C:\Windows\System\iOFYMLA.exe
  C:\Windows\System\iOFYMLA.exe
  2⤵
  PID:12864
- C:\Windows\System\rBXTdCq.exe
  C:\Windows\System\rBXTdCq.exe
  2⤵
  PID:12880
- C:\Windows\System\pnQCWLA.exe
  C:\Windows\System\pnQCWLA.exe
  2⤵
  PID:12900
- C:\Windows\System\LambSPe.exe
  C:\Windows\System\LambSPe.exe
  2⤵
  PID:12920
- C:\Windows\System\zrgELxL.exe
  C:\Windows\System\zrgELxL.exe
  2⤵
  PID:12948
- C:\Windows\System\HjywQOK.exe
  C:\Windows\System\HjywQOK.exe
  2⤵
  PID:12968
- C:\Windows\System\jjpsBcX.exe
  C:\Windows\System\jjpsBcX.exe
  2⤵
  PID:12576
- C:\Windows\System\eEWrvKY.exe
  C:\Windows\System\eEWrvKY.exe
  2⤵
  PID:12636
- C:\Windows\System\gaAwNrW.exe
  C:\Windows\System\gaAwNrW.exe
  2⤵
  PID:11912
- C:\Windows\System\ZIiFizd.exe
  C:\Windows\System\ZIiFizd.exe
  2⤵
  PID:10424
- C:\Windows\System\KAMqwvd.exe
  C:\Windows\System\KAMqwvd.exe
  2⤵
  PID:12380
- C:\Windows\System\KACRZvO.exe
  C:\Windows\System\KACRZvO.exe
  2⤵
  PID:12140
- C:\Windows\System\juailKY.exe
  C:\Windows\System\juailKY.exe
  2⤵
  PID:5724
- C:\Windows\System\fYaoLzJ.exe
  C:\Windows\System\fYaoLzJ.exe
  2⤵
  PID:4504
- C:\Windows\System\RwyNSRt.exe
  C:\Windows\System\RwyNSRt.exe
  2⤵
  PID:11584
- C:\Windows\System\pcpxEBh.exe
  C:\Windows\System\pcpxEBh.exe
  2⤵
  PID:11240
- C:\Windows\System\QDqqZLG.exe
  C:\Windows\System\QDqqZLG.exe
  2⤵
  PID:10772
- C:\Windows\System\rbCjnLB.exe
  C:\Windows\System\rbCjnLB.exe
  2⤵
  PID:12796
- C:\Windows\System\iqnXCkJ.exe
  C:\Windows\System\iqnXCkJ.exe
  2⤵
  PID:12876
- C:\Windows\System\EdQoPQy.exe
  C:\Windows\System\EdQoPQy.exe
  2⤵
  PID:11148
- C:\Windows\System\eDGrrNc.exe
  C:\Windows\System\eDGrrNc.exe
  2⤵
  PID:3964
- C:\Windows\System\vldidLK.exe
  C:\Windows\System\vldidLK.exe
  2⤵
  PID:6160
- C:\Windows\System\GWTvWzP.exe
  C:\Windows\System\GWTvWzP.exe
  2⤵
  PID:10288
- C:\Windows\System\LQZKuds.exe
  C:\Windows\System\LQZKuds.exe
  2⤵
  PID:11008
- C:\Windows\System\mLMeZzb.exe
  C:\Windows\System\mLMeZzb.exe
  2⤵
  PID:12856
- C:\Windows\System\xfNBjKt.exe
  C:\Windows\System\xfNBjKt.exe
  2⤵
  PID:7524
- C:\Windows\System\DfRUiWm.exe
  C:\Windows\System\DfRUiWm.exe
  2⤵
  PID:12752
- C:\Windows\System\XpNtEwT.exe
  C:\Windows\System\XpNtEwT.exe
  2⤵
  PID:11204
- C:\Windows\System\ZgabnzI.exe
  C:\Windows\System\ZgabnzI.exe
  2⤵
  PID:5024
- C:\Windows\System\WLawbUd.exe
  C:\Windows\System\WLawbUd.exe
  2⤵
  PID:12612
- C:\Windows\System\xozsyAL.exe
  C:\Windows\System\xozsyAL.exe
  2⤵
  PID:12788
- C:\Windows\System\hhygvoG.exe
  C:\Windows\System\hhygvoG.exe
  2⤵
  PID:4664
- C:\Windows\System\rmIAIMz.exe
  C:\Windows\System\rmIAIMz.exe
  2⤵
  PID:11752
- C:\Windows\System\ANpnZYQ.exe
  C:\Windows\System\ANpnZYQ.exe
  2⤵
  PID:9200
- C:\Windows\System\FFoosBn.exe
  C:\Windows\System\FFoosBn.exe
  2⤵
  PID:8128
- C:\Windows\System\TxoaArw.exe
  C:\Windows\System\TxoaArw.exe
  2⤵
  PID:10420
- C:\Windows\System\ieCkjLl.exe
  C:\Windows\System\ieCkjLl.exe
  2⤵
  PID:11832
- C:\Windows\System\YKlACsU.exe
  C:\Windows\System\YKlACsU.exe
  2⤵
  PID:12792
- C:\Windows\System\jihliNQ.exe
  C:\Windows\System\jihliNQ.exe
  2⤵
  PID:10544
- C:\Windows\System\SASARRp.exe
  C:\Windows\System\SASARRp.exe
  2⤵
  PID:12908
- C:\Windows\System\FLYrBli.exe
  C:\Windows\System\FLYrBli.exe
  2⤵
  PID:11556
- C:\Windows\System\VZPnhIB.exe
  C:\Windows\System\VZPnhIB.exe
  2⤵
  PID:12676
- C:\Windows\System\xQfiZDs.exe
  C:\Windows\System\xQfiZDs.exe
  2⤵
  PID:2832
- C:\Windows\System\pbzfrZq.exe
  C:\Windows\System\pbzfrZq.exe
  2⤵
  PID:12232
- C:\Windows\System\UPvKIWm.exe
  C:\Windows\System\UPvKIWm.exe
  2⤵
  PID:9428
- C:\Windows\System\RvKtPuN.exe
  C:\Windows\System\RvKtPuN.exe
  2⤵
  PID:10704
- C:\Windows\System\bmSHPCh.exe
  C:\Windows\System\bmSHPCh.exe
  2⤵
  PID:10676
- C:\Windows\System\rpYCOPF.exe
  C:\Windows\System\rpYCOPF.exe
  2⤵
  PID:8972
- C:\Windows\System\KJmdwro.exe
  C:\Windows\System\KJmdwro.exe
  2⤵
  PID:2800
- C:\Windows\System\cetKDpT.exe
  C:\Windows\System\cetKDpT.exe
  2⤵
  PID:428
- C:\Windows\System\PKacOPw.exe
  C:\Windows\System\PKacOPw.exe
  2⤵
  PID:10404
- C:\Windows\System\zUmEeft.exe
  C:\Windows\System\zUmEeft.exe
  2⤵
  PID:13288
- C:\Windows\System\USPSHDI.exe
  C:\Windows\System\USPSHDI.exe
  2⤵
  PID:10480
- C:\Windows\System\euslsVr.exe
  C:\Windows\System\euslsVr.exe
  2⤵
  PID:12164
- C:\Windows\System\wARCSkZ.exe
  C:\Windows\System\wARCSkZ.exe
  2⤵
  PID:4548
- C:\Windows\System\dGcIArr.exe
  C:\Windows\System\dGcIArr.exe
  2⤵
  PID:11656
- C:\Windows\System\uusoXWb.exe
  C:\Windows\System\uusoXWb.exe
  2⤵
  PID:3160
- C:\Windows\System\VnjBdcZ.exe
  C:\Windows\System\VnjBdcZ.exe
  2⤵
  PID:12132
- C:\Windows\System\jzYbuii.exe
  C:\Windows\System\jzYbuii.exe
  2⤵
  PID:12196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zxbhu3ne.bgc.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\CGQwLJM.exe

Filesize
2.1MB

MD5
14e39d654731be52b01c78c38d62e5f8

SHA1
b9d15ee5186bd4de2e33f64444ff1c1452d2c6f0

SHA256
59714ea210cf4d3da083166349c73969979f3c3b2ac401fdcbac09c86f02945a

SHA512
0304df8740b5f335a60df39c5ca175a4732748377e01a60f590f94cf401f25151afd474e4a7366029d2674e550c4fc76900cbc8fff7769c0a51ae1b9e543376d

Download Submit
C:\Windows\System\DPCVcbc.exe

Filesize
2.1MB

MD5
a5b234e2423bceb3d937008318654e67

SHA1
befbe8e1460b05d7c8e8539db95e6110165fc584

SHA256
26516e42f24059681bba718bcba75c267e57bcaf0d20d885fe81491c0c3f5c9a

SHA512
1dd02338fa236bddae0c6eaf495b65ebd6fdd9dbe62924eabac68b7929ffcccf0d661fa0deaedaa774df8960a0a38e895ee0489cc7729c54e719f8dc55035d79

Download Submit
C:\Windows\System\DqJFUQZ.exe

Filesize
2.1MB

MD5
7165594376a4deb3429dc54ee7e4e668

SHA1
d8f3d0d0bb773f08b3816301ba1b032536d21446

SHA256
6439b3d2d9351ea3fed88553dc6c6f52c0ccc076a6e16852c1086c5af5ac1dd2

SHA512
54d82f9d40b770bb253c58505465f87f71163ee6599cb23686947ff2f5e17bfc88cc7c3963da024d2caea51bae5700dda23b5ae7e29300b63f799f98b9757f80

Download Submit
C:\Windows\System\EcRopLz.exe

Filesize
2.1MB

MD5
64260dbb591f5aba354621a9b81f403e

SHA1
1473e7eb86ea4b945863336e285c5f2669756d2a

SHA256
786d403eebace5ec9b935305782aaf010b988002aa328b99ade2ab9537e22ab1

SHA512
cdf4898ba0164900207c1a7c86518320060358faa22f3f860815998dc2a9e9b0924fe90c087faad9af2587afca5de6812dcec605f8eda4ac258d4c4d88b11da3

Download Submit
C:\Windows\System\FSeYBNY.exe

Filesize
2.1MB

MD5
4c48d455759d6fdc22adaef7186d3161

SHA1
177478f7b710efb402d71074a84bd879b6435a83

SHA256
d47754174cda47636268857486bfd5434d0eaae773c629da5622abde38dc1f74

SHA512
019039990aee2307314996f87166947c727d2d3b1ffe56df01872ee21e426d7f5de1ec51f2f6b6a51609367eaf16548e6d93adee244ecae03251c5a2c5689c86

Download Submit
C:\Windows\System\GTbpfXV.exe

Filesize
2.1MB

MD5
5b906f33d37156309fd8a5fecf2de720

SHA1
6c9230dfa238705f73252c72eba69320ff5d7154

SHA256
bff807688261a67dee0614d71f070b3d2fe9e83af10c9de6cb66d2aa42a18063

SHA512
cc9bbc71d2fadfbff5e50cd6455b3f1047ca6e55097ec53078922184c9f928a8867268a5fce0c4e14bf0b20b50494040db6883d6b63852b7b8a0f8b1437d6baa

Download Submit
C:\Windows\System\GqtyLCt.exe

Filesize
2.1MB

MD5
cef5812942c45cd357d9d25e89abd2ed

SHA1
c69d60805ea5a256f83847724a8e843838e564b5

SHA256
0681d7681addb408247da51a02928aad474b6a9165102b616d3fedf25389066c

SHA512
2b1b7646a94798de1d6d277dfafae52efb5c4c4857a972737b988fcbc1c4c99901df9a92d2edb76243c5d9a5565332cc34d19e94e6711eda62581fa3c82a69d5

Download Submit
C:\Windows\System\HHvnMNs.exe

Filesize
2.1MB

MD5
ee86e34717ba5c76af5cd7aa1a370ad7

SHA1
32a96d85d4a179c329b465e556715d5e550d7a2e

SHA256
7c7c61993efb72ec63ab30755a28ba285b92c29e2ce4a7cf486fb3c4a27c3a16

SHA512
b896cd0c8e44edb7f346a57ccebb3a30100e729abdc1db73697f43ff70e82da71c15767910ff508401986465900a3ce225fcca7aaa2b0a3a391e14dc15bb6a20

Download Submit
C:\Windows\System\IEBTqts.exe

Filesize
2.1MB

MD5
8da069b57847aac9e9d02a13256a3c56

SHA1
8759b8a9145bee8c55a8f6ebc6d83388c4df6b38

SHA256
5b18491f8d30e44ded8832a07e4a92a7a0a004c025e5fcade623555e87e851ab

SHA512
24ca7e2c20c3496d68772216c40065ec6af4f11d6f434545866ca0a37eedb4673f385110ef5752b95a84b56823a2b89025c9149ffa624ed764837e19d233141a

Download Submit
C:\Windows\System\IYzeDPz.exe

Filesize
2.1MB

MD5
5303615408745528377763b1056d521e

SHA1
43c12b31298a0d58e40cb996dc295ef2024a9ec5

SHA256
8fb27a5e18fe6fa78edeb470a137b1addfb06a287d4fbc04966709520cf5333f

SHA512
6b1be5fd8a7701848d53387f7745b9db1a036eaf17fcf28a8c7cd9772757faba1a6bb2d968e90467ce0c7c6789134628c52ec562e704b9c4d634ebb02b4a6b45

Download Submit
C:\Windows\System\JoZiWiy.exe

Filesize
2.1MB

MD5
a79c0c3076019665062c7bc47bbfe33d

SHA1
7fc2831a6e26c1808b6dd9b0af16c92d20b6aee8

SHA256
5f7d672e0f34b4bc7748c410cd6f1bcb94d91d1b7a759d54e21caa671b9421c5

SHA512
431b05591935a0308f107e8d51c652ef99184e03fc40097011db5f6834317920eebf6731b9ef8292e9c1dd7a8fb89b8dca0a25f0bd00f9eab2241a130e545b47

Download Submit
C:\Windows\System\LXgFrwx.exe

Filesize
2.1MB

MD5
72bd63d2f07440157bd995d6e20f6ab7

SHA1
2b6a41b403b5f408808dc469595f352dfa6ed9e6

SHA256
b872bcefbcdb948ecc61e2c009a512bce36ff690a7ce88e6071b1b2c78e0ad1e

SHA512
701e74fb7e8124f624383763980904f088afc01d841b4c3804a6bd4932707d91d5cd0faa78b47bbfc9668f3b2d2998b41e17f625d656054acaae740dbc79036c

Download Submit
C:\Windows\System\LgZbfoR.exe

Filesize
2.1MB

MD5
a573d6e1dc3e00af76510f527344e6eb

SHA1
73e1d5a505d02273717596d6a9e70eba2669599d

SHA256
3a91f9c3f0ddc12c925a81abc87e796f5f179afeb6c1ac0faf46830a3cdcdfb2

SHA512
f6a9a702672fe25b681b900f5a7718cd331bc03adf0779fc09720e083d61ee95e3751f288370ac82c20dd53b73ab47f0ea6095176085c0544500da4b5a529be6

Download Submit
C:\Windows\System\MBNaTAY.exe

Filesize
2.1MB

MD5
1842b23726183ff8d0c80659a605a070

SHA1
15a9d1141e8ba2198d7c1c547ac92fe66d1ba74d

SHA256
49e515d30b67d25cb1d5caf059ba000f82cb1a1b72832199216574fa3106a90f

SHA512
66a63862e4e11ce80373a99aaf314dddeb2ddf2923268057ba54d356ecf1057da612c8e9ddeca25278f8562ddd17b8f291ee742f9431d4e7cc9f3894ba4f467c

Download Submit
C:\Windows\System\MCMlPmG.exe

Filesize
2.1MB

MD5
3c38f42661348a74c3ba40cd02b8a29d

SHA1
7b2e1013c22870a54045a3f69f71d95d270ce080

SHA256
b225e5e9779b65878c19da7ae562543c99d2f081909554e6e9b144e97e895d88

SHA512
10f61e5c39947d57851730f885fcd8cb5f27946561ece0c1c2b04ef34801a1cc6a8d008bcb48d0f95711401954dabd67eb4c2df5f03c2f8ecfc3eeabc771f085

Download Submit
C:\Windows\System\MyEbucW.exe

Filesize
2.1MB

MD5
f081dbafd163a6d809476dcdd3c1e408

SHA1
f9ed49ff2884114510bd582a42e93e0fefc37397

SHA256
7a0fc74e255b17ea03cbd7b87e29e79e44f169d5d05ce08baf1b61878d9bea28

SHA512
5cfc3845a59ec99823846c4483d913fa0bf92bf5a6d0e6272b72b7cc09588acd40d5eba8474c00f82ef475a3aa85e021d8deca7065de1c6932e7bd6485039db5

Download Submit
C:\Windows\System\SSmpmQC.exe

Filesize
2.1MB

MD5
ac87a3b60882d0e52620233e1336d1a5

SHA1
b9690ae970cddd4beb2077c09af861d97c9a3964

SHA256
f91f2652ea9e27384d05e36ea88336a710cf34dcd34f4e162b15fbb58944fce2

SHA512
826225acbf805c220b6feeccb5d1bdd6da6264df9be1c8ffcc6b8e6b0990dc808f8ac02d8aec54cdf98921c42fd76cab12af10ebf9f09a5242d4ea052615bfc8

Download Submit
C:\Windows\System\YqtNnza.exe

Filesize
2.1MB

MD5
84476389d9eb533feff34024cfa35e6a

SHA1
673fdb1817f88a6b89e6ffd76e273280258f6f0b

SHA256
fcff4c02fcc47a9b8ba510dc4fcf4c15fc2d02442adb6274848f18f399e23c48

SHA512
592a777f20bc63c1862e948e5cccd4688b0a0c0c9ee9ef60e5d53c890d59e342e3a2d080bf114b3fecce4b7ad9c8558cbf1c8091cdab2aacd74fcd8047cceca6

Download Submit
C:\Windows\System\ZnyQdXA.exe

Filesize
2.1MB

MD5
fa374527de8fd111d81654203d8671bf

SHA1
cdb7c8284a208c5a31959a20bf00616ea0e5e170

SHA256
9ac8b5094b0c93245c34797f3a9ef402581f682c956c6e78f637afee4f7512d6

SHA512
752f3b231c00529f08cd906738ad5788948219f7db5f4e63cff1a345150f414bf767cb509551199e8fe924487d1ef2c178bca2dba9d2f5df45ea924aab6038fd

Download Submit
C:\Windows\System\aukVncS.exe

Filesize
2.1MB

MD5
f2c25da7b9ec998c0b0df434277841f6

SHA1
d04ae54fa0c12425dc24ca050f97ade5ef3c35f9

SHA256
ec1aae50841a3730f83d8c30bd25e9a5259c64023f0063defc61dee521c86754

SHA512
12ce04064185bb550be6c2626f76857786a2cb4fb4484dadee18316cf36be065cf940183e51aee862aa8cd7615a44fc1bacc7b8d304cba8a6a02a6dfbbb9b000

Download Submit
C:\Windows\System\azbqtKw.exe

Filesize
2.1MB

MD5
b1edc16d98a86e786df19c993e1b344d

SHA1
483a8258d7ad6bcadf6c68b1c2c62d4cfb6d9782

SHA256
b68217a128486884f31cadbffad31e108b36661f226349751cb6f7b0547ea47b

SHA512
cfd0253a9e12611c42e7d1a8093b1ae900b9f8d8ce26e034f19ac77f325466b172e707912b0a99f528c7d34fcbfe05541e71659a84b3fd71a9e91c093ba85bc0

Download Submit
C:\Windows\System\bHvaXFy.exe

Filesize
2.1MB

MD5
a1ae61a25a6019a854b4994a75d2f5b7

SHA1
c3b83eccdbbd183514d24a186258e65341d03a36

SHA256
9ba8aae7111b954b661188bc553f9728a0201d2c17751822e19585e575eb881a

SHA512
615e1b29a3959ddb6e3bff7f6473b4c8c5879693f7b6bedb350b7176ad2b7fa6d45c841a5ac42c37b506b26f58efb6141d5581041d2a466f5253890be1f5cb1b

Download Submit
C:\Windows\System\cLXhCrm.exe

Filesize
2.1MB

MD5
9f09edb12f8efab60ffc95e4bcf2c51c

SHA1
fdcc06962fa234a3dace5ac4edb59aaf65d9e374

SHA256
2e9520e3fd9360973de4c1c085aafae360fb250bbb5fcd2c4d02c899556b5d5d

SHA512
37ae13174fbbcd8ccb34141cc5a7806ad1b5ad07a5b0ac9c82d7c529d8a09e96716c921f100d297e527917c71b81213a139b20f8ad44c75cf17ff46488872d1a

Download Submit
C:\Windows\System\dVrBQRT.exe

Filesize
2.1MB

MD5
d8c8f2d17e9f81464bbc1658ecbc860c

SHA1
2a939ed060cdac7b9b1d8c0fde366fb48634a109

SHA256
965fcc9c6bba1aaad87b6906b3235cf513692653dfe9d0e245b4f9bb58d3153d

SHA512
3a1790ad04953bf46c1061255a5679d1ef0d31e207d9ca763f50a181233ec8edae064fccc2f041e7a674f8fc467feff75e0ccac399bea6d73a5979a4c2feb1e7

Download Submit
C:\Windows\System\dbCWqnz.exe

Filesize
2.1MB

MD5
352831aeb1b0e09c85c10736e2147465

SHA1
a308abbbaa3aec04175503ce1edeb1f823a7a3e7

SHA256
caf2081e1dc95c0f890fda7269073c120d1b5420afba96e1fb02801116e0b060

SHA512
a275658585afcf26116dde898a675dcddc318e373da4ab2b9d47b0738215c61ad9fc3f34d0f5e5db4f6d0daa08795f9dce35948e87eb529adf58995183be7a9f

Download Submit
C:\Windows\System\djFpnTs.exe

Filesize
2.1MB

MD5
cf2efaa51fc17430e02096f1969d9134

SHA1
975d4fc04789a2bcc9e139af3ac7edb018dfb247

SHA256
34e5eb50041d16ce693b20e258bdd5e04b66c6f4b08f4412c626b06f37810c62

SHA512
35b11ad9edbf692a69fd64ed055d1ac1b79178b0c1ed0e0cc28f8a755ac1f78c70e6e2fa875da88ac7ae9111c984ddd8469c5660c10087e5a67f932dccf4acdf

Download Submit
C:\Windows\System\fQKauEt.exe

Filesize
2.1MB

MD5
adc3e948e387a5579081af20bceb82a9

SHA1
f628334212e7fa7f184d7956ed67f92d511867c9

SHA256
860bd79180c52e942aa5c7c937d719c5cdca1d079c84d50c20e937d4252c0d5b

SHA512
4b64e67f745d2ca92ae013110d1401349d704727d3f9f8e3d90096048857e8cd3d06bd8a6518a2a5535823d347773bf8828eae7d334ebd1a2aaee910884667a7

Download Submit
C:\Windows\System\gqZwLYp.exe

Filesize
2.1MB

MD5
258daaa768ade6f560e30dca39d533ba

SHA1
f7cd9c195f428a93aafd822b87c406723eead24d

SHA256
46ea128fc2e736f5b1c44b63a0675763ae71fa0a56798914799639ef5dfa5ec4

SHA512
d7703e49d320d62a6a23ca0c06477ee999ac2ea141676679587708dd93c71825099ed340a9233f2476f96ac60efa24ed55d0c436fffb1f959a19ad52aa936316

Download Submit
C:\Windows\System\guHbdhh.exe

Filesize
2.1MB

MD5
34c10b3714386b6bdda1fccce50a251e

SHA1
75ca6c7eef28052387e639ff54fe8e17deaf3c05

SHA256
ded3ac2bcb8cc7dfe934434fff4ba26cb4266524d84f7a27388075c9e013790f

SHA512
09791bfc1b1d87dc3cbc538a77c82c45c6b7268787f552c969fef20b60de74913dd64000b69c045c14842afb2d64c6dbb66db32a22b147eef47c8971e65fc6cd

Download Submit
C:\Windows\System\hQCrwaS.exe

Filesize
2.1MB

MD5
5f06b87d492994ad7f258fa5132171d0

SHA1
f01d0907e91f35d9544c9ca02c3d5853ba8053a4

SHA256
937375b854126e2a1ccdefa3ee62c812ca381ad25f6f1ca851ce20387fc1ebc3

SHA512
18ba88cba1e0ead610c05f45beac8bead668a274c41ee86ab48eaa1d83e96d255fb3d6dbd3a73d0b1e5f101f6e80836a3caa9c35252570655bd821b147d25efe

Download Submit
C:\Windows\System\hUUkXMV.exe

Filesize
2.1MB

MD5
1f4686bc3b30742c4eaf6ff42b2e3172

SHA1
c12647cf608af38bc8740578d69ae5fc749a2bc4

SHA256
6f4a64b2ae49a785d83725f909792b5c8355bd6e47cd21a5deb704360c110b28

SHA512
ebc4509348de740685b402339d771593bbe6ab5d3470fab9b05bb6a9596b69566900e982aa3bb9a4018b250d3fe14f7be7ca21b70cddd5065aa751d031ce0ad9

Download Submit
C:\Windows\System\jytErDB.exe

Filesize
2.1MB

MD5
3f53737dd13d49605dbad257e0e02809

SHA1
b8c5aeb9a6aaf0da0f806d5ded9facf371325aea

SHA256
f33e22b6655f255c06a16f120d9ca8f5b11e5dc7cb142f82e47dea45d9108ae3

SHA512
9a6208b638658caff03d0d086f3718f7cec1cdadf9acef98f5065c6f422b035001fb935c6fe50d3a083cf37718b6e7a19a2a31bcdc35f83503063d02f16491df

Download Submit
C:\Windows\System\kuvyYOj.exe

Filesize
2.1MB

MD5
fe955fff37f8e1333ed9805c646a4c96

SHA1
c2783b162a9b94cc2978ce8d82bbeaa9a3d22cd4

SHA256
72c281fe8f56daef85ceb313b6c7fe18b2bd5e762eacd712e4fc585896fcc0ff

SHA512
9bf5cd1bba193d6c924d5bebc98403f58387747ce5dafb5cf429ede61f7227f2c92a5ebea2ec88b6bc083f8e3f7340a16d0d000350a979a34553c852aa04966d

Download Submit
C:\Windows\System\lgOMeWi.exe

Filesize
2.1MB

MD5
26a613d66515eb73c28ad93ed93d385c

SHA1
89b4791a3cd54f3798ebcf73f5b1f741ddc7271a

SHA256
391d24f01890ddc426f776752303b7f63f49a4f9a12f79c9f2d5c1653e2aa626

SHA512
19bf1b368de51496b16cdbe543a8f842192ece6cd3c89cba687c5adf98cd45c03b97bbbad1c4ab4fd6db253a6db120f3e1632eb2abb45a096707f49a23578683

Download Submit
C:\Windows\System\rSEcwBP.exe

Filesize
2.1MB

MD5
5c95f6c7b838c196045fce6e13cfcd4c

SHA1
078d7957881ad1604e31d337ccfccafaba5af41f

SHA256
0da4ebf9380a781c32c3141adc2603b6a7552acbe04c65be084faa97aaedb7e7

SHA512
6b69ed8a66cc0ad6fc043e949b33a9d84b3c8b7aef720105560fd867f112793f1bc71f71dcf5900628631be10c6b3c0a27babbc9f5c7a01c817f27aed9f4f589

Download Submit
C:\Windows\System\ugPjhff.exe

Filesize
8B

MD5
408407fe49e2a1bd1de2fb4f4e1c1e4e

SHA1
6781f0ed16b9f9a0e8a861848782ae1a9b183885

SHA256
413c20c52ba69478c63daee39bcd70926f09cbc71ce3aa1577802440938b324a

SHA512
51204da6f17b6725f4e9b8b9381f34a7ed365926b3780a3bfe9e8d70ab81ec8caad96b3f0838e87a0f0c0c6baeed1ea2ea2f5c7ee1fa6a13b720a1ec69c3f3fd

Download Submit
C:\Windows\System\vbcCxvc.exe

Filesize
2.1MB

MD5
a13385ab80996d5749adcaaac962b701

SHA1
a4f4a6334a2f006543b6b14fe99e6e0b2ba9f223

SHA256
9930f992e4f6a79412774115bb2d2544219bbf9064fb66a7dea4d38dd04798c1

SHA512
2436f8a786729db9db7b76e7cec4b80f385eaa000f540a3df3e18adc5e71418897061075e76444fec5beb6adfc9f308894ac0449ef1b5077a8d59473ec25c065

Download Submit
C:\Windows\System\vbsXOId.exe

Filesize
2.1MB

MD5
2fd3fa015184c1658cfc2e3d01d8f560

SHA1
460afa70d111cdd81d9ede46df3dce8430e92788

SHA256
6ab1ab4416865e3be6b54c06499940200d63fc8fa84829283cae349b2a5cd3be

SHA512
6a67d3e7bce4998d350640b888b502499623b3a30b778309adce586832aa3efb5bde26c76abc09aba348045b92fc28110eecf277d2aa07a98e58ef1cafbec22b

Download Submit
C:\Windows\System\zrJmYtC.exe

Filesize
2.1MB

MD5
f79d86297fc93efd6e955f884cf44846

SHA1
79131c7c8eccaf096659ee6af88ff2b98bc70c2b

SHA256
0c975f8fffd4d9df7d09c01580380e8724cee35cc89e7c51ea26f8a964d0cd3e

SHA512
f8fb340595cd44b725dd82eecb6d1e1374a50a4b591bd3640599b1d01142cb424294e305af42b5fe1b757fdef31d0262afc12daf2239ca3fab5801b5b851e578

Download Submit
memory/432-134-0x00007FF713E30000-0x00007FF714222000-memory.dmp

Filesize
3.9MB

Download
memory/432-2872-0x00007FF713E30000-0x00007FF714222000-memory.dmp

Filesize
3.9MB

Download
memory/1000-2870-0x00007FF608E90000-0x00007FF609282000-memory.dmp

Filesize
3.9MB

Download
memory/1000-135-0x00007FF608E90000-0x00007FF609282000-memory.dmp

Filesize
3.9MB

Download
memory/1808-2847-0x00007FF74EAA0000-0x00007FF74EE92000-memory.dmp

Filesize
3.9MB

Download
memory/1808-201-0x00007FF74EAA0000-0x00007FF74EE92000-memory.dmp

Filesize
3.9MB

Download
memory/1848-148-0x00007FF67BE10000-0x00007FF67C202000-memory.dmp

Filesize
3.9MB

Download
memory/1848-2874-0x00007FF67BE10000-0x00007FF67C202000-memory.dmp

Filesize
3.9MB

Download
memory/2004-131-0x00007FF6EF370000-0x00007FF6EF762000-memory.dmp

Filesize
3.9MB

Download
memory/2004-2862-0x00007FF6EF370000-0x00007FF6EF762000-memory.dmp

Filesize
3.9MB

Download
memory/2056-129-0x00007FF6593C0000-0x00007FF6597B2000-memory.dmp

Filesize
3.9MB

Download
memory/2056-2861-0x00007FF6593C0000-0x00007FF6597B2000-memory.dmp

Filesize
3.9MB

Download
memory/2072-176-0x00000230F2530000-0x00000230F2552000-memory.dmp

Filesize
136KB

Download
memory/2072-65-0x00000230F25C0000-0x00000230F25D0000-memory.dmp

Filesize
64KB

Download
memory/2072-62-0x00007FFA1E1E0000-0x00007FFA1ECA1000-memory.dmp

Filesize
10.8MB

Download
memory/2340-124-0x00007FF789ED0000-0x00007FF78A2C2000-memory.dmp

Filesize
3.9MB

Download
memory/2340-2850-0x00007FF789ED0000-0x00007FF78A2C2000-memory.dmp

Filesize
3.9MB

Download
memory/2600-137-0x00007FF746EC0000-0x00007FF7472B2000-memory.dmp

Filesize
3.9MB

Download
memory/2600-2889-0x00007FF746EC0000-0x00007FF7472B2000-memory.dmp

Filesize
3.9MB

Download
memory/2704-0-0x00007FF7D80F0000-0x00007FF7D84E2000-memory.dmp

Filesize
3.9MB

Download
memory/2704-1-0x000001A916320000-0x000001A916330000-memory.dmp

Filesize
64KB

Download
memory/2928-2866-0x00007FF6D1A70000-0x00007FF6D1E62000-memory.dmp

Filesize
3.9MB

Download
memory/2928-133-0x00007FF6D1A70000-0x00007FF6D1E62000-memory.dmp

Filesize
3.9MB

Download
memory/3436-2854-0x00007FF6D9660000-0x00007FF6D9A52000-memory.dmp

Filesize
3.9MB

Download
memory/3436-128-0x00007FF6D9660000-0x00007FF6D9A52000-memory.dmp

Filesize
3.9MB

Download
memory/3496-97-0x00007FF7ABA50000-0x00007FF7ABE42000-memory.dmp

Filesize
3.9MB

Download
memory/3496-2852-0x00007FF7ABA50000-0x00007FF7ABE42000-memory.dmp

Filesize
3.9MB

Download
memory/3844-149-0x00007FF7C5380000-0x00007FF7C5772000-memory.dmp

Filesize
3.9MB

Download
memory/3844-2858-0x00007FF7C5380000-0x00007FF7C5772000-memory.dmp

Filesize
3.9MB

Download
memory/4052-130-0x00007FF62E230000-0x00007FF62E622000-memory.dmp

Filesize
3.9MB

Download
memory/4052-2857-0x00007FF62E230000-0x00007FF62E622000-memory.dmp

Filesize
3.9MB

Download
memory/4232-2881-0x00007FF715CF0000-0x00007FF7160E2000-memory.dmp

Filesize
3.9MB

Download
memory/4232-136-0x00007FF715CF0000-0x00007FF7160E2000-memory.dmp

Filesize
3.9MB

Download
memory/4252-179-0x00007FF613070000-0x00007FF613462000-memory.dmp

Filesize
3.9MB

Download
memory/4252-2879-0x00007FF613070000-0x00007FF613462000-memory.dmp

Filesize
3.9MB

Download
memory/4456-2844-0x00007FF718330000-0x00007FF718722000-memory.dmp

Filesize
3.9MB

Download
memory/4456-15-0x00007FF718330000-0x00007FF718722000-memory.dmp

Filesize
3.9MB

Download
memory/4552-2865-0x00007FF6AF060000-0x00007FF6AF452000-memory.dmp

Filesize
3.9MB

Download
memory/4552-132-0x00007FF6AF060000-0x00007FF6AF452000-memory.dmp

Filesize
3.9MB

Download
memory/4600-233-0x00007FF7A6EA0000-0x00007FF7A7292000-memory.dmp

Filesize
3.9MB

Download
memory/4600-2887-0x00007FF7A6EA0000-0x00007FF7A7292000-memory.dmp

Filesize
3.9MB

Download
memory/4628-75-0x00007FF750E50000-0x00007FF751242000-memory.dmp

Filesize
3.9MB

Download
memory/4628-2848-0x00007FF750E50000-0x00007FF751242000-memory.dmp

Filesize
3.9MB

Download
memory/5044-2883-0x00007FF78C3A0000-0x00007FF78C792000-memory.dmp

Filesize
3.9MB

Download
memory/5044-283-0x00007FF78C3A0000-0x00007FF78C792000-memory.dmp

Filesize
3.9MB

Download
memory/5104-138-0x00007FF709A80000-0x00007FF709E72000-memory.dmp

Filesize
3.9MB

Download
memory/5104-2869-0x00007FF709A80000-0x00007FF709E72000-memory.dmp

Filesize
3.9MB

Download