xmrig | 182263a459d39afd1ac2b45d370135ee4e6c0e74f5a0eeee3a1d24958f081cdf

Analysis

max time kernel
6s
max time network
21s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 02:57

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
Size

1.9MB
MD5

02434237cbfcb8e6aff5fd61acee4433
SHA1

be57918b0aba4c84dccf44ff01f38250d32da748
SHA256

182263a459d39afd1ac2b45d370135ee4e6c0e74f5a0eeee3a1d24958f081cdf
SHA512

0cd9994f87157dddfc48833d3696d8b45bfe57c19f059e128aeafbbf0ba2ed522861c0850c5e7d51617f057cbd0dd129a65215a21926cc49918d59eb6552e2ae
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+Uvk:NAB/

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 20 IoCs

miner

resource	yara_rule
behavioral2/memory/4460-265-0x00007FF677B90000-0x00007FF677F82000-memory.dmp	xmrig
behavioral2/memory/4396-275-0x00007FF70DAB0000-0x00007FF70DEA2000-memory.dmp	xmrig
behavioral2/memory/5012-304-0x00007FF669DD0000-0x00007FF66A1C2000-memory.dmp	xmrig
behavioral2/memory/1184-314-0x00007FF7A6460000-0x00007FF7A6852000-memory.dmp	xmrig
behavioral2/memory/548-317-0x00007FF7E57D0000-0x00007FF7E5BC2000-memory.dmp	xmrig
behavioral2/memory/1664-316-0x00007FF68E1C0000-0x00007FF68E5B2000-memory.dmp	xmrig
behavioral2/memory/1360-315-0x00007FF71EBA0000-0x00007FF71EF92000-memory.dmp	xmrig
behavioral2/memory/5000-313-0x00007FF658BF0000-0x00007FF658FE2000-memory.dmp	xmrig
behavioral2/memory/2040-312-0x00007FF753090000-0x00007FF753482000-memory.dmp	xmrig
behavioral2/memory/1048-311-0x00007FF632400000-0x00007FF6327F2000-memory.dmp	xmrig
behavioral2/memory/1392-310-0x00007FF786530000-0x00007FF786922000-memory.dmp	xmrig
behavioral2/memory/4596-308-0x00007FF74F9D0000-0x00007FF74FDC2000-memory.dmp	xmrig
behavioral2/memory/368-303-0x00007FF762CC0000-0x00007FF7630B2000-memory.dmp	xmrig
behavioral2/memory/4876-287-0x00007FF6EE360000-0x00007FF6EE752000-memory.dmp	xmrig
behavioral2/memory/4464-286-0x00007FF7CBF20000-0x00007FF7CC312000-memory.dmp	xmrig
behavioral2/memory/5064-204-0x00007FF7E9300000-0x00007FF7E96F2000-memory.dmp	xmrig
behavioral2/memory/2416-197-0x00007FF6851D0000-0x00007FF6855C2000-memory.dmp	xmrig
behavioral2/memory/1408-168-0x00007FF6554D0000-0x00007FF6558C2000-memory.dmp	xmrig
behavioral2/memory/3824-164-0x00007FF77EB20000-0x00007FF77EF12000-memory.dmp	xmrig
behavioral2/memory/1512-120-0x00007FF713C00000-0x00007FF713FF2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1344	EISxKiW.exe
1664	AbIcCzJ.exe
1512	qXlIqKS.exe
3824	iubqrTo.exe
1408	OkXCZHJ.exe
2416	rxIcuOX.exe
5064	Bcswtcs.exe
4460	ffzGQPL.exe
4396	FJBeKXx.exe
4464	pBpLkam.exe
4876	gPDsurh.exe
368	AeyJXct.exe
5012	VnYgwgx.exe
4596	bKANPiJ.exe
1392	ObggAVw.exe
548	KqneZEb.exe
1048	SXeZEdX.exe
2040	wClXfrW.exe
5000	YuwWJYw.exe
1184	iWRcAps.exe
1360	ZcRTLox.exe
8	lCsPuGL.exe
4268	xeTSctM.exe
4628	ZtuqYYB.exe
2256	WXgvAKM.exe
3660	aqDIVsl.exe
3948	JewwWLM.exe
1700	iNPBnVC.exe
1340	UUxjNeb.exe
4788	KhiVDrg.exe
752	OTPgcod.exe
4452	aZgrfAG.exe
5112	aZuVWUf.exe
4932	ASMHFNl.exe
3364	XHqiWGP.exe
4032	yBIVhlj.exe
1524	pNZOpFL.exe
1752	FdWxtdE.exe
4368	pdZtnAO.exe
728	UcZViZF.exe
3188	fsmGsBp.exe
1680	tYjJJTQ.exe
4784	dxjuuIe.exe
1464	ObGTcvD.exe
860	plwPmqh.exe
3564	UEkcryv.exe
2740	pPCVAeI.exe
2288	idSVxvj.exe
4224	FlYKRwb.exe
2276	aCadoxg.exe
2592	PbELaXl.exe
4812	GEHCQXy.exe
1424	pRXnPmW.exe
1628	jcsBRkT.exe
1764	GGOBMNN.exe
4112	SuADcYy.exe
1404	VRBQCfb.exe
232	svzzxZP.exe
4544	ACdjQzk.exe
528	ENDBips.exe
1092	rjtTIST.exe
856	bpDeUgX.exe
4288	bSUkySu.exe
3852	lxRFluT.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4728-0-0x00007FF6376F0000-0x00007FF637AE2000-memory.dmp	upx
behavioral2/files/0x000600000002327c-5.dat	upx
behavioral2/memory/1344-13-0x00007FF7B1390000-0x00007FF7B1782000-memory.dmp	upx
behavioral2/files/0x000a000000023430-12.dat	upx
behavioral2/files/0x000800000002343d-7.dat	upx
behavioral2/files/0x000700000002343e-23.dat	upx
behavioral2/files/0x0007000000023442-32.dat	upx
behavioral2/files/0x0007000000023444-41.dat	upx
behavioral2/files/0x0007000000023447-70.dat	upx
behavioral2/files/0x0007000000023455-136.dat	upx
behavioral2/files/0x0007000000023449-138.dat	upx
behavioral2/files/0x0007000000023462-178.dat	upx
behavioral2/files/0x000700000002344b-189.dat	upx
behavioral2/memory/4460-265-0x00007FF677B90000-0x00007FF677F82000-memory.dmp	upx
behavioral2/memory/4396-275-0x00007FF70DAB0000-0x00007FF70DEA2000-memory.dmp	upx
behavioral2/memory/5012-304-0x00007FF669DD0000-0x00007FF66A1C2000-memory.dmp	upx
behavioral2/memory/1184-314-0x00007FF7A6460000-0x00007FF7A6852000-memory.dmp	upx
behavioral2/memory/548-317-0x00007FF7E57D0000-0x00007FF7E5BC2000-memory.dmp	upx
behavioral2/memory/1664-316-0x00007FF68E1C0000-0x00007FF68E5B2000-memory.dmp	upx
behavioral2/memory/1360-315-0x00007FF71EBA0000-0x00007FF71EF92000-memory.dmp	upx
behavioral2/memory/5000-313-0x00007FF658BF0000-0x00007FF658FE2000-memory.dmp	upx
behavioral2/memory/2040-312-0x00007FF753090000-0x00007FF753482000-memory.dmp	upx
behavioral2/memory/1048-311-0x00007FF632400000-0x00007FF6327F2000-memory.dmp	upx
behavioral2/memory/1392-310-0x00007FF786530000-0x00007FF786922000-memory.dmp	upx
behavioral2/memory/4596-308-0x00007FF74F9D0000-0x00007FF74FDC2000-memory.dmp	upx
behavioral2/memory/368-303-0x00007FF762CC0000-0x00007FF7630B2000-memory.dmp	upx
behavioral2/memory/4876-287-0x00007FF6EE360000-0x00007FF6EE752000-memory.dmp	upx
behavioral2/memory/4464-286-0x00007FF7CBF20000-0x00007FF7CC312000-memory.dmp	upx
behavioral2/files/0x000700000002344a-186.dat	upx
behavioral2/files/0x0007000000023464-183.dat	upx
behavioral2/files/0x0007000000023458-182.dat	upx
behavioral2/files/0x0007000000023451-180.dat	upx
behavioral2/files/0x0007000000023463-179.dat	upx
behavioral2/files/0x000700000002344e-173.dat	upx
behavioral2/memory/5064-204-0x00007FF7E9300000-0x00007FF7E96F2000-memory.dmp	upx
behavioral2/memory/2416-197-0x00007FF6851D0000-0x00007FF6855C2000-memory.dmp	upx
behavioral2/memory/1408-168-0x00007FF6554D0000-0x00007FF6558C2000-memory.dmp	upx
behavioral2/memory/3824-164-0x00007FF77EB20000-0x00007FF77EF12000-memory.dmp	upx
behavioral2/files/0x000700000002345f-163.dat	upx
behavioral2/files/0x000700000002344c-158.dat	upx
behavioral2/files/0x000700000002345c-154.dat	upx
behavioral2/files/0x000700000002345b-153.dat	upx
behavioral2/files/0x000700000002345a-152.dat	upx
behavioral2/files/0x0007000000023459-151.dat	upx
behavioral2/files/0x0007000000023452-184.dat	upx
behavioral2/files/0x0007000000023457-146.dat	upx
behavioral2/files/0x000700000002344f-144.dat	upx
behavioral2/files/0x0007000000023461-177.dat	upx
behavioral2/files/0x0007000000023456-137.dat	upx
behavioral2/files/0x0007000000023460-172.dat	upx
behavioral2/files/0x000700000002345e-159.dat	upx
behavioral2/files/0x0007000000023454-126.dat	upx
behavioral2/files/0x000700000002345d-155.dat	upx
behavioral2/memory/1512-120-0x00007FF713C00000-0x00007FF713FF2000-memory.dmp	upx
behavioral2/files/0x0007000000023450-106.dat	upx
behavioral2/files/0x0007000000023448-99.dat	upx
behavioral2/files/0x0007000000023446-131.dat	upx
behavioral2/files/0x000700000002344d-94.dat	upx
behavioral2/files/0x0007000000023441-90.dat	upx
behavioral2/files/0x0007000000023453-123.dat	upx
behavioral2/files/0x000700000002343f-56.dat	upx
behavioral2/files/0x0007000000023445-52.dat	upx
behavioral2/files/0x0007000000023443-42.dat	upx
behavioral2/files/0x0007000000023440-51.dat	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\FFghmPw.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\pBpLkam.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\UUxjNeb.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\YAAPZKx.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\CTHULTC.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\DBgfPPb.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\WXgvAKM.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\ZIPIXdn.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\EISxKiW.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\xeTSctM.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\lYxrfGb.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\UpFcRtk.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\AeyJXct.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\bSUkySu.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\OyxLudE.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\cRAJDoC.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\jBxffjO.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\gIRelEM.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\jKnwxkf.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\lCsPuGL.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\bVIZPpt.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\AbDigOD.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\XkdGRDA.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\HfvKFHS.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\pyNZORr.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\XdUXrPV.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\KhiVDrg.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\OTPgcod.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\pBxDOen.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\cAQgUHl.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\YuwWJYw.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\FdWxtdE.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\yBIVhlj.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\OSsDiri.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\iubqrTo.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\ASMHFNl.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\Bcswtcs.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\TZTaBpl.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\hgedVOK.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\lVZuuuY.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\sFEkCvp.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\NyUcJHg.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\VnYgwgx.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\aZuVWUf.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\PRmWiof.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\vRLznYx.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\PErMjrp.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\qHNLrPy.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\YZrQtmE.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\RSUQAsP.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\lNFhzLa.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\BRcmvQJ.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\GEHCQXy.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\xRZEHVW.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\IscZMNJ.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\EwovOLd.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\ObggAVw.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\iNPBnVC.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\svzzxZP.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\RJliDQy.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\SXeZEdX.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\jcsBRkT.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\XHqiWGP.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
File created	C:\Windows\System\pdZtnAO.exe	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4776	powershell.exe
4776	powershell.exe
4776	powershell.exe
4776	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4776	powershell.exe
Token: SeLockMemoryPrivilege	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 4776	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	82
PID 4728 wrote to memory of 4776	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	82
PID 4728 wrote to memory of 1344	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	83
PID 4728 wrote to memory of 1344	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	83
PID 4728 wrote to memory of 1664	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	84
PID 4728 wrote to memory of 1664	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	84
PID 4728 wrote to memory of 5064	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	85
PID 4728 wrote to memory of 5064	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	85
PID 4728 wrote to memory of 1512	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	86
PID 4728 wrote to memory of 1512	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	86
PID 4728 wrote to memory of 1408	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	87
PID 4728 wrote to memory of 1408	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	87
PID 4728 wrote to memory of 3824	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	88
PID 4728 wrote to memory of 3824	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	88
PID 4728 wrote to memory of 2416	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	89
PID 4728 wrote to memory of 2416	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	89
PID 4728 wrote to memory of 4460	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	90
PID 4728 wrote to memory of 4460	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	90
PID 4728 wrote to memory of 4396	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	91
PID 4728 wrote to memory of 4396	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	91
PID 4728 wrote to memory of 4464	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	92
PID 4728 wrote to memory of 4464	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	92
PID 4728 wrote to memory of 4876	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	93
PID 4728 wrote to memory of 4876	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	93
PID 4728 wrote to memory of 368	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	94
PID 4728 wrote to memory of 368	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	94
PID 4728 wrote to memory of 5012	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	95
PID 4728 wrote to memory of 5012	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	95
PID 4728 wrote to memory of 4596	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	96
PID 4728 wrote to memory of 4596	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	96
PID 4728 wrote to memory of 1392	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	97
PID 4728 wrote to memory of 1392	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	97
PID 4728 wrote to memory of 548	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	98
PID 4728 wrote to memory of 548	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	98
PID 4728 wrote to memory of 1048	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	99
PID 4728 wrote to memory of 1048	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	99
PID 4728 wrote to memory of 2040	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	100
PID 4728 wrote to memory of 2040	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	100
PID 4728 wrote to memory of 5000	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	101
PID 4728 wrote to memory of 5000	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	101
PID 4728 wrote to memory of 1184	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	102
PID 4728 wrote to memory of 1184	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	102
PID 4728 wrote to memory of 1700	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	103
PID 4728 wrote to memory of 1700	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	103
PID 4728 wrote to memory of 1360	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	104
PID 4728 wrote to memory of 1360	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	104
PID 4728 wrote to memory of 8	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	105
PID 4728 wrote to memory of 8	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	105
PID 4728 wrote to memory of 4268	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	106
PID 4728 wrote to memory of 4268	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	106
PID 4728 wrote to memory of 4628	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	107
PID 4728 wrote to memory of 4628	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	107
PID 4728 wrote to memory of 2256	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	108
PID 4728 wrote to memory of 2256	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	108
PID 4728 wrote to memory of 3660	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	109
PID 4728 wrote to memory of 3660	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	109
PID 4728 wrote to memory of 3948	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	110
PID 4728 wrote to memory of 3948	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	110
PID 4728 wrote to memory of 1340	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	111
PID 4728 wrote to memory of 1340	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	111
PID 4728 wrote to memory of 3188	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	112
PID 4728 wrote to memory of 3188	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	112
PID 4728 wrote to memory of 4788	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	113
PID 4728 wrote to memory of 4788	4728	02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe	113

C:\Users\Admin\AppData\Local\Temp\02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\02434237cbfcb8e6aff5fd61acee4433_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4776
- C:\Windows\System\EISxKiW.exe
  C:\Windows\System\EISxKiW.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\AbIcCzJ.exe
  C:\Windows\System\AbIcCzJ.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\Bcswtcs.exe
  C:\Windows\System\Bcswtcs.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\qXlIqKS.exe
  C:\Windows\System\qXlIqKS.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\OkXCZHJ.exe
  C:\Windows\System\OkXCZHJ.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\iubqrTo.exe
  C:\Windows\System\iubqrTo.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\rxIcuOX.exe
  C:\Windows\System\rxIcuOX.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\ffzGQPL.exe
  C:\Windows\System\ffzGQPL.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\FJBeKXx.exe
  C:\Windows\System\FJBeKXx.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\pBpLkam.exe
  C:\Windows\System\pBpLkam.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\gPDsurh.exe
  C:\Windows\System\gPDsurh.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\AeyJXct.exe
  C:\Windows\System\AeyJXct.exe
  2⤵
  - Executes dropped EXE
  PID:368
- C:\Windows\System\VnYgwgx.exe
  C:\Windows\System\VnYgwgx.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\bKANPiJ.exe
  C:\Windows\System\bKANPiJ.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\ObggAVw.exe
  C:\Windows\System\ObggAVw.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\KqneZEb.exe
  C:\Windows\System\KqneZEb.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\SXeZEdX.exe
  C:\Windows\System\SXeZEdX.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\wClXfrW.exe
  C:\Windows\System\wClXfrW.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\YuwWJYw.exe
  C:\Windows\System\YuwWJYw.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\iWRcAps.exe
  C:\Windows\System\iWRcAps.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\iNPBnVC.exe
  C:\Windows\System\iNPBnVC.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\ZcRTLox.exe
  C:\Windows\System\ZcRTLox.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\lCsPuGL.exe
  C:\Windows\System\lCsPuGL.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\xeTSctM.exe
  C:\Windows\System\xeTSctM.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\ZtuqYYB.exe
  C:\Windows\System\ZtuqYYB.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\WXgvAKM.exe
  C:\Windows\System\WXgvAKM.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\aqDIVsl.exe
  C:\Windows\System\aqDIVsl.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\JewwWLM.exe
  C:\Windows\System\JewwWLM.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\UUxjNeb.exe
  C:\Windows\System\UUxjNeb.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\fsmGsBp.exe
  C:\Windows\System\fsmGsBp.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System\KhiVDrg.exe
  C:\Windows\System\KhiVDrg.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\OTPgcod.exe
  C:\Windows\System\OTPgcod.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\aZgrfAG.exe
  C:\Windows\System\aZgrfAG.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\aZuVWUf.exe
  C:\Windows\System\aZuVWUf.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\ASMHFNl.exe
  C:\Windows\System\ASMHFNl.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\XHqiWGP.exe
  C:\Windows\System\XHqiWGP.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System\yBIVhlj.exe
  C:\Windows\System\yBIVhlj.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\pNZOpFL.exe
  C:\Windows\System\pNZOpFL.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\FdWxtdE.exe
  C:\Windows\System\FdWxtdE.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\pdZtnAO.exe
  C:\Windows\System\pdZtnAO.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\UcZViZF.exe
  C:\Windows\System\UcZViZF.exe
  2⤵
  - Executes dropped EXE
  PID:728
- C:\Windows\System\tYjJJTQ.exe
  C:\Windows\System\tYjJJTQ.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\dxjuuIe.exe
  C:\Windows\System\dxjuuIe.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\ObGTcvD.exe
  C:\Windows\System\ObGTcvD.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\plwPmqh.exe
  C:\Windows\System\plwPmqh.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\UEkcryv.exe
  C:\Windows\System\UEkcryv.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\pPCVAeI.exe
  C:\Windows\System\pPCVAeI.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\idSVxvj.exe
  C:\Windows\System\idSVxvj.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\FlYKRwb.exe
  C:\Windows\System\FlYKRwb.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\aCadoxg.exe
  C:\Windows\System\aCadoxg.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\PbELaXl.exe
  C:\Windows\System\PbELaXl.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\GEHCQXy.exe
  C:\Windows\System\GEHCQXy.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\pRXnPmW.exe
  C:\Windows\System\pRXnPmW.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\jcsBRkT.exe
  C:\Windows\System\jcsBRkT.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\GGOBMNN.exe
  C:\Windows\System\GGOBMNN.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\SuADcYy.exe
  C:\Windows\System\SuADcYy.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\VRBQCfb.exe
  C:\Windows\System\VRBQCfb.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\svzzxZP.exe
  C:\Windows\System\svzzxZP.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\ACdjQzk.exe
  C:\Windows\System\ACdjQzk.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\ENDBips.exe
  C:\Windows\System\ENDBips.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\rjtTIST.exe
  C:\Windows\System\rjtTIST.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\bpDeUgX.exe
  C:\Windows\System\bpDeUgX.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\bSUkySu.exe
  C:\Windows\System\bSUkySu.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\lxRFluT.exe
  C:\Windows\System\lxRFluT.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\htzHFtT.exe
  C:\Windows\System\htzHFtT.exe
  2⤵
  PID:2948
- C:\Windows\System\IscZMNJ.exe
  C:\Windows\System\IscZMNJ.exe
  2⤵
  PID:3360
- C:\Windows\System\bVIZPpt.exe
  C:\Windows\System\bVIZPpt.exe
  2⤵
  PID:3624
- C:\Windows\System\OyxLudE.exe
  C:\Windows\System\OyxLudE.exe
  2⤵
  PID:1436
- C:\Windows\System\pBxDOen.exe
  C:\Windows\System\pBxDOen.exe
  2⤵
  PID:2656
- C:\Windows\System\qHNLrPy.exe
  C:\Windows\System\qHNLrPy.exe
  2⤵
  PID:5020
- C:\Windows\System\EwovOLd.exe
  C:\Windows\System\EwovOLd.exe
  2⤵
  PID:4564
- C:\Windows\System\RJliDQy.exe
  C:\Windows\System\RJliDQy.exe
  2⤵
  PID:4240
- C:\Windows\System\qLDlrvn.exe
  C:\Windows\System\qLDlrvn.exe
  2⤵
  PID:4652
- C:\Windows\System\nMewBGu.exe
  C:\Windows\System\nMewBGu.exe
  2⤵
  PID:4676
- C:\Windows\System\MGuxzot.exe
  C:\Windows\System\MGuxzot.exe
  2⤵
  PID:1100
- C:\Windows\System\AbDigOD.exe
  C:\Windows\System\AbDigOD.exe
  2⤵
  PID:3404
- C:\Windows\System\diVVrxZ.exe
  C:\Windows\System\diVVrxZ.exe
  2⤵
  PID:1620
- C:\Windows\System\HfvKFHS.exe
  C:\Windows\System\HfvKFHS.exe
  2⤵
  PID:4936
- C:\Windows\System\TZTaBpl.exe
  C:\Windows\System\TZTaBpl.exe
  2⤵
  PID:4296
- C:\Windows\System\zZeApzf.exe
  C:\Windows\System\zZeApzf.exe
  2⤵
  PID:1208
- C:\Windows\System\FgSHIhG.exe
  C:\Windows\System\FgSHIhG.exe
  2⤵
  PID:5484
- C:\Windows\System\hgedVOK.exe
  C:\Windows\System\hgedVOK.exe
  2⤵
  PID:5600
- C:\Windows\System\FVCpIxu.exe
  C:\Windows\System\FVCpIxu.exe
  2⤵
  PID:5616
- C:\Windows\System\unpNSzV.exe
  C:\Windows\System\unpNSzV.exe
  2⤵
  PID:5636
- C:\Windows\System\pyNZORr.exe
  C:\Windows\System\pyNZORr.exe
  2⤵
  PID:5768
- C:\Windows\System\YZrQtmE.exe
  C:\Windows\System\YZrQtmE.exe
  2⤵
  PID:5784
- C:\Windows\System\WmUaMRM.exe
  C:\Windows\System\WmUaMRM.exe
  2⤵
  PID:5800
- C:\Windows\System\PRmWiof.exe
  C:\Windows\System\PRmWiof.exe
  2⤵
  PID:5952
- C:\Windows\System\CgspDSh.exe
  C:\Windows\System\CgspDSh.exe
  2⤵
  PID:5976
- C:\Windows\System\WTqBfAJ.exe
  C:\Windows\System\WTqBfAJ.exe
  2⤵
  PID:5992
- C:\Windows\System\ILIevvW.exe
  C:\Windows\System\ILIevvW.exe
  2⤵
  PID:6020
- C:\Windows\System\FFghmPw.exe
  C:\Windows\System\FFghmPw.exe
  2⤵
  PID:6044
- C:\Windows\System\JDXEoEb.exe
  C:\Windows\System\JDXEoEb.exe
  2⤵
  PID:6060
- C:\Windows\System\XdUXrPV.exe
  C:\Windows\System\XdUXrPV.exe
  2⤵
  PID:6076
- C:\Windows\System\tfomFsm.exe
  C:\Windows\System\tfomFsm.exe
  2⤵
  PID:6092
- C:\Windows\System\HGjBDjo.exe
  C:\Windows\System\HGjBDjo.exe
  2⤵
  PID:6116
- C:\Windows\System\lVZuuuY.exe
  C:\Windows\System\lVZuuuY.exe
  2⤵
  PID:6140
- C:\Windows\System\WivtVrN.exe
  C:\Windows\System\WivtVrN.exe
  2⤵
  PID:4272
- C:\Windows\System\qDUmwnU.exe
  C:\Windows\System\qDUmwnU.exe
  2⤵
  PID:2892
- C:\Windows\System\Kcletdt.exe
  C:\Windows\System\Kcletdt.exe
  2⤵
  PID:4412
- C:\Windows\System\XkdGRDA.exe
  C:\Windows\System\XkdGRDA.exe
  2⤵
  PID:2444
- C:\Windows\System\loDstFx.exe
  C:\Windows\System\loDstFx.exe
  2⤵
  PID:4948
- C:\Windows\System\vRLznYx.exe
  C:\Windows\System\vRLznYx.exe
  2⤵
  PID:1528
- C:\Windows\System\CTHULTC.exe
  C:\Windows\System\CTHULTC.exe
  2⤵
  PID:1936
- C:\Windows\System\HzFXBSB.exe
  C:\Windows\System\HzFXBSB.exe
  2⤵
  PID:4524
- C:\Windows\System\qkmyuKU.exe
  C:\Windows\System\qkmyuKU.exe
  2⤵
  PID:4372
- C:\Windows\System\OSsDiri.exe
  C:\Windows\System\OSsDiri.exe
  2⤵
  PID:2356
- C:\Windows\System\DBgfPPb.exe
  C:\Windows\System\DBgfPPb.exe
  2⤵
  PID:1088
- C:\Windows\System\JnOiWsn.exe
  C:\Windows\System\JnOiWsn.exe
  2⤵
  PID:2776
- C:\Windows\System\xRZEHVW.exe
  C:\Windows\System\xRZEHVW.exe
  2⤵
  PID:3848
- C:\Windows\System\YAAPZKx.exe
  C:\Windows\System\YAAPZKx.exe
  2⤵
  PID:4636
- C:\Windows\System\RSUQAsP.exe
  C:\Windows\System\RSUQAsP.exe
  2⤵
  PID:5204
- C:\Windows\System\MFkIFTS.exe
  C:\Windows\System\MFkIFTS.exe
  2⤵
  PID:5260
- C:\Windows\System\zoElySV.exe
  C:\Windows\System\zoElySV.exe
  2⤵
  PID:5304
- C:\Windows\System\Bmzkeph.exe
  C:\Windows\System\Bmzkeph.exe
  2⤵
  PID:5368
- C:\Windows\System\ZIPIXdn.exe
  C:\Windows\System\ZIPIXdn.exe
  2⤵
  PID:5380
- C:\Windows\System\CscDBhb.exe
  C:\Windows\System\CscDBhb.exe
  2⤵
  PID:2056
- C:\Windows\System\lYxrfGb.exe
  C:\Windows\System\lYxrfGb.exe
  2⤵
  PID:1984
- C:\Windows\System\QrUgZCc.exe
  C:\Windows\System\QrUgZCc.exe
  2⤵
  PID:3800
- C:\Windows\System\cRAJDoC.exe
  C:\Windows\System\cRAJDoC.exe
  2⤵
  PID:264
- C:\Windows\System\jBxffjO.exe
  C:\Windows\System\jBxffjO.exe
  2⤵
  PID:5536
- C:\Windows\System\TCJJmuk.exe
  C:\Windows\System\TCJJmuk.exe
  2⤵
  PID:5568
- C:\Windows\System\gIRelEM.exe
  C:\Windows\System\gIRelEM.exe
  2⤵
  PID:5624
- C:\Windows\System\lNFhzLa.exe
  C:\Windows\System\lNFhzLa.exe
  2⤵
  PID:5648
- C:\Windows\System\YSzKMBc.exe
  C:\Windows\System\YSzKMBc.exe
  2⤵
  PID:5748
- C:\Windows\System\IXfbqFp.exe
  C:\Windows\System\IXfbqFp.exe
  2⤵
  PID:5808
- C:\Windows\System\pbueYXt.exe
  C:\Windows\System\pbueYXt.exe
  2⤵
  PID:5912
- C:\Windows\System\sFEkCvp.exe
  C:\Windows\System\sFEkCvp.exe
  2⤵
  PID:2584
- C:\Windows\System\cAQgUHl.exe
  C:\Windows\System\cAQgUHl.exe
  2⤵
  PID:3448
- C:\Windows\System\UpFcRtk.exe
  C:\Windows\System\UpFcRtk.exe
  2⤵
  PID:4140
- C:\Windows\System\BRcmvQJ.exe
  C:\Windows\System\BRcmvQJ.exe
  2⤵
  PID:740
- C:\Windows\System\jKnwxkf.exe
  C:\Windows\System\jKnwxkf.exe
  2⤵
  PID:4088
- C:\Windows\System\NyUcJHg.exe
  C:\Windows\System\NyUcJHg.exe
  2⤵
  PID:3632
- C:\Windows\System\hRjTDjQ.exe
  C:\Windows\System\hRjTDjQ.exe
  2⤵
  PID:4484
- C:\Windows\System\PErMjrp.exe
  C:\Windows\System\PErMjrp.exe
  2⤵
  PID:4680
- C:\Windows\System\eKIfsYA.exe
  C:\Windows\System\eKIfsYA.exe
  2⤵
  PID:4616
- C:\Windows\System\evViQeK.exe
  C:\Windows\System\evViQeK.exe
  2⤵
  PID:5024
- C:\Windows\System\qeTVhER.exe
  C:\Windows\System\qeTVhER.exe
  2⤵
  PID:1388
- C:\Windows\System\MsCzyRp.exe
  C:\Windows\System\MsCzyRp.exe
  2⤵
  PID:2836
- C:\Windows\System\GeWtRnC.exe
  C:\Windows\System\GeWtRnC.exe
  2⤵
  PID:4884
- C:\Windows\System\NknSAsg.exe
  C:\Windows\System\NknSAsg.exe
  2⤵
  PID:6056
- C:\Windows\System\qkNJukw.exe
  C:\Windows\System\qkNJukw.exe
  2⤵
  PID:6104
- C:\Windows\System\tAxeqxX.exe
  C:\Windows\System\tAxeqxX.exe
  2⤵
  PID:4672
- C:\Windows\System\MTnMOTe.exe
  C:\Windows\System\MTnMOTe.exe
  2⤵
  PID:1716
- C:\Windows\System\KniXYYR.exe
  C:\Windows\System\KniXYYR.exe
  2⤵
  PID:2000
- C:\Windows\System\WOoLRwZ.exe
  C:\Windows\System\WOoLRwZ.exe
  2⤵
  PID:4160
- C:\Windows\System\eMCpJDg.exe
  C:\Windows\System\eMCpJDg.exe
  2⤵
  PID:4944
- C:\Windows\System\gqJYpNU.exe
  C:\Windows\System\gqJYpNU.exe
  2⤵
  PID:2368
- C:\Windows\System\ZaYmoaz.exe
  C:\Windows\System\ZaYmoaz.exe
  2⤵
  PID:3560
- C:\Windows\System\pPcbyHI.exe
  C:\Windows\System\pPcbyHI.exe
  2⤵
  PID:4008
- C:\Windows\System\dkfMXHN.exe
  C:\Windows\System\dkfMXHN.exe
  2⤵
  PID:1568
- C:\Windows\System\xEGvfVs.exe
  C:\Windows\System\xEGvfVs.exe
  2⤵
  PID:5644
- C:\Windows\System\BhGemHq.exe
  C:\Windows\System\BhGemHq.exe
  2⤵
  PID:1772
- C:\Windows\System\PrCPbYA.exe
  C:\Windows\System\PrCPbYA.exe
  2⤵
  PID:5288
- C:\Windows\System\xzjFirC.exe
  C:\Windows\System\xzjFirC.exe
  2⤵
  PID:3388
- C:\Windows\System\fdnhlHa.exe
  C:\Windows\System\fdnhlHa.exe
  2⤵
  PID:5100
- C:\Windows\System\GOGVIFO.exe
  C:\Windows\System\GOGVIFO.exe
  2⤵
  PID:6068
- C:\Windows\System\ZMOrbWR.exe
  C:\Windows\System\ZMOrbWR.exe
  2⤵
  PID:6128
- C:\Windows\System\ufltvNB.exe
  C:\Windows\System\ufltvNB.exe
  2⤵
  PID:6164
- C:\Windows\System\UIQwfrJ.exe
  C:\Windows\System\UIQwfrJ.exe
  2⤵
  PID:6196
- C:\Windows\System\XqlwBkP.exe
  C:\Windows\System\XqlwBkP.exe
  2⤵
  PID:6216
- C:\Windows\System\mXQSPkO.exe
  C:\Windows\System\mXQSPkO.exe
  2⤵
  PID:6232
- C:\Windows\System\cDIqdKi.exe
  C:\Windows\System\cDIqdKi.exe
  2⤵
  PID:6252
- C:\Windows\System\frjVFsR.exe
  C:\Windows\System\frjVFsR.exe
  2⤵
  PID:6280
- C:\Windows\System\hGyRPjN.exe
  C:\Windows\System\hGyRPjN.exe
  2⤵
  PID:6524
- C:\Windows\System\nttFShU.exe
  C:\Windows\System\nttFShU.exe
  2⤵
  PID:6560
- C:\Windows\System\MGsXCqf.exe
  C:\Windows\System\MGsXCqf.exe
  2⤵
  PID:6584
- C:\Windows\System\IAHvxbO.exe
  C:\Windows\System\IAHvxbO.exe
  2⤵
  PID:6604
- C:\Windows\System\cbsQsrr.exe
  C:\Windows\System\cbsQsrr.exe
  2⤵
  PID:6620
- C:\Windows\System\WcSINOW.exe
  C:\Windows\System\WcSINOW.exe
  2⤵
  PID:6648
- C:\Windows\System\YybdIHh.exe
  C:\Windows\System\YybdIHh.exe
  2⤵
  PID:6668
- C:\Windows\System\iZtWmKk.exe
  C:\Windows\System\iZtWmKk.exe
  2⤵
  PID:6688
- C:\Windows\System\xlQBEQk.exe
  C:\Windows\System\xlQBEQk.exe
  2⤵
  PID:6712
- C:\Windows\System\hwAqDPv.exe
  C:\Windows\System\hwAqDPv.exe
  2⤵
  PID:6744
- C:\Windows\System\RKWQmBM.exe
  C:\Windows\System\RKWQmBM.exe
  2⤵
  PID:6768
- C:\Windows\System\tWvElHd.exe
  C:\Windows\System\tWvElHd.exe
  2⤵
  PID:6784
- C:\Windows\System\oPXKVuX.exe
  C:\Windows\System\oPXKVuX.exe
  2⤵
  PID:6808
- C:\Windows\System\gmHugwS.exe
  C:\Windows\System\gmHugwS.exe
  2⤵
  PID:6832
- C:\Windows\System\GVTGpAB.exe
  C:\Windows\System\GVTGpAB.exe
  2⤵
  PID:6848
- C:\Windows\System\bdCkhSK.exe
  C:\Windows\System\bdCkhSK.exe
  2⤵
  PID:6872
- C:\Windows\System\guJRCRO.exe
  C:\Windows\System\guJRCRO.exe
  2⤵
  PID:6920
- C:\Windows\System\ZtyQwfH.exe
  C:\Windows\System\ZtyQwfH.exe
  2⤵
  PID:6948
- C:\Windows\System\EWUFymM.exe
  C:\Windows\System\EWUFymM.exe
  2⤵
  PID:6976
- C:\Windows\System\yboBcux.exe
  C:\Windows\System\yboBcux.exe
  2⤵
  PID:6992
- C:\Windows\System\HnQkouR.exe
  C:\Windows\System\HnQkouR.exe
  2⤵
  PID:7016
- C:\Windows\System\RnvkiNj.exe
  C:\Windows\System\RnvkiNj.exe
  2⤵
  PID:7032
- C:\Windows\System\QPOFXzw.exe
  C:\Windows\System\QPOFXzw.exe
  2⤵
  PID:7052
- C:\Windows\System\QqphEAa.exe
  C:\Windows\System\QqphEAa.exe
  2⤵
  PID:7068
- C:\Windows\System\VlniGPp.exe
  C:\Windows\System\VlniGPp.exe
  2⤵
  PID:7112
- C:\Windows\System\LIKOcJU.exe
  C:\Windows\System\LIKOcJU.exe
  2⤵
  PID:7132
- C:\Windows\System\VyWrqPR.exe
  C:\Windows\System\VyWrqPR.exe
  2⤵
  PID:7164
- C:\Windows\System\HJfStfL.exe
  C:\Windows\System\HJfStfL.exe
  2⤵
  PID:3240
- C:\Windows\System\YYMPLhV.exe
  C:\Windows\System\YYMPLhV.exe
  2⤵
  PID:4980
- C:\Windows\System\kdgXbfO.exe
  C:\Windows\System\kdgXbfO.exe
  2⤵
  PID:1532
- C:\Windows\System\XcNAtFV.exe
  C:\Windows\System\XcNAtFV.exe
  2⤵
  PID:5048
- C:\Windows\System\rUhYxvb.exe
  C:\Windows\System\rUhYxvb.exe
  2⤵
  PID:4708
- C:\Windows\System\EeoDjOc.exe
  C:\Windows\System\EeoDjOc.exe
  2⤵
  PID:1872
- C:\Windows\System\iwMZAXQ.exe
  C:\Windows\System\iwMZAXQ.exe
  2⤵
  PID:744
- C:\Windows\System\JuRUkPp.exe
  C:\Windows\System\JuRUkPp.exe
  2⤵
  PID:848
- C:\Windows\System\TsYIflg.exe
  C:\Windows\System\TsYIflg.exe
  2⤵
  PID:6008
- C:\Windows\System\sYKhhFB.exe
  C:\Windows\System\sYKhhFB.exe
  2⤵
  PID:4016
- C:\Windows\System\QruXkfD.exe
  C:\Windows\System\QruXkfD.exe
  2⤵
  PID:3376
- C:\Windows\System\knrirlT.exe
  C:\Windows\System\knrirlT.exe
  2⤵
  PID:1976
- C:\Windows\System\DGsMfIa.exe
  C:\Windows\System\DGsMfIa.exe
  2⤵
  PID:6224
- C:\Windows\System\ROqwLlb.exe
  C:\Windows\System\ROqwLlb.exe
  2⤵
  PID:5968
- C:\Windows\System\mQyTkIL.exe
  C:\Windows\System\mQyTkIL.exe
  2⤵
  PID:5276
- C:\Windows\System\JNLsvwi.exe
  C:\Windows\System\JNLsvwi.exe
  2⤵
  PID:5608
- C:\Windows\System\ythUiRo.exe
  C:\Windows\System\ythUiRo.exe
  2⤵
  PID:6372
- C:\Windows\System\VUoywKK.exe
  C:\Windows\System\VUoywKK.exe
  2⤵
  PID:6580
- C:\Windows\System\EoIKHfH.exe
  C:\Windows\System\EoIKHfH.exe
  2⤵
  PID:6268
- C:\Windows\System\nbbRlrN.exe
  C:\Windows\System\nbbRlrN.exe
  2⤵
  PID:6628
- C:\Windows\System\xKoZgCv.exe
  C:\Windows\System\xKoZgCv.exe
  2⤵
  PID:6332
- C:\Windows\System\YiokExS.exe
  C:\Windows\System\YiokExS.exe
  2⤵
  PID:6816
- C:\Windows\System\EHfpYwl.exe
  C:\Windows\System\EHfpYwl.exe
  2⤵
  PID:6940
- C:\Windows\System\izpZSBY.exe
  C:\Windows\System\izpZSBY.exe
  2⤵
  PID:6640
- C:\Windows\System\gSnJtzx.exe
  C:\Windows\System\gSnJtzx.exe
  2⤵
  PID:6664
- C:\Windows\System\OsHDqcY.exe
  C:\Windows\System\OsHDqcY.exe
  2⤵
  PID:6700
- C:\Windows\System\HnbaGSr.exe
  C:\Windows\System\HnbaGSr.exe
  2⤵
  PID:7128
- C:\Windows\System\gkmtUBa.exe
  C:\Windows\System\gkmtUBa.exe
  2⤵
  PID:6824
- C:\Windows\System\jbmgtGY.exe
  C:\Windows\System\jbmgtGY.exe
  2⤵
  PID:6864
- C:\Windows\System\nNinXTl.exe
  C:\Windows\System\nNinXTl.exe
  2⤵
  PID:6540
- C:\Windows\System\phXezMT.exe
  C:\Windows\System\phXezMT.exe
  2⤵
  PID:3704
- C:\Windows\System\lYZryBJ.exe
  C:\Windows\System\lYZryBJ.exe
  2⤵
  PID:7028
- C:\Windows\System\JJODVCu.exe
  C:\Windows\System\JJODVCu.exe
  2⤵
  PID:6756
- C:\Windows\System\fJYhQZT.exe
  C:\Windows\System\fJYhQZT.exe
  2⤵
  PID:2612
- C:\Windows\System\jLjfOHm.exe
  C:\Windows\System\jLjfOHm.exe
  2⤵
  PID:5552
- C:\Windows\System\mKOqQjq.exe
  C:\Windows\System\mKOqQjq.exe
  2⤵
  PID:7184
- C:\Windows\System\ygNiRWh.exe
  C:\Windows\System\ygNiRWh.exe
  2⤵
  PID:7204
- C:\Windows\System\SIdnQId.exe
  C:\Windows\System\SIdnQId.exe
  2⤵
  PID:7228
- C:\Windows\System\SDGtypB.exe
  C:\Windows\System\SDGtypB.exe
  2⤵
  PID:7252
- C:\Windows\System\idnetXr.exe
  C:\Windows\System\idnetXr.exe
  2⤵
  PID:7276
- C:\Windows\System\FpXTZlM.exe
  C:\Windows\System\FpXTZlM.exe
  2⤵
  PID:7296
- C:\Windows\System\HJnrbwR.exe
  C:\Windows\System\HJnrbwR.exe
  2⤵
  PID:7320
- C:\Windows\System\nXvOSgU.exe
  C:\Windows\System\nXvOSgU.exe
  2⤵
  PID:7340
- C:\Windows\System\SWPgQVP.exe
  C:\Windows\System\SWPgQVP.exe
  2⤵
  PID:7372
- C:\Windows\System\EaZvORb.exe
  C:\Windows\System\EaZvORb.exe
  2⤵
  PID:7388
- C:\Windows\System\NPEdVqU.exe
  C:\Windows\System\NPEdVqU.exe
  2⤵
  PID:7412
- C:\Windows\System\PsTPXNV.exe
  C:\Windows\System\PsTPXNV.exe
  2⤵
  PID:7432
- C:\Windows\System\RybwLsH.exe
  C:\Windows\System\RybwLsH.exe
  2⤵
  PID:7460
- C:\Windows\System\ANQQQYv.exe
  C:\Windows\System\ANQQQYv.exe
  2⤵
  PID:7476
- C:\Windows\System\uThaZUA.exe
  C:\Windows\System\uThaZUA.exe
  2⤵
  PID:7500
- C:\Windows\System\GPPTfMq.exe
  C:\Windows\System\GPPTfMq.exe
  2⤵
  PID:7524
- C:\Windows\System\jHolSYT.exe
  C:\Windows\System\jHolSYT.exe
  2⤵
  PID:7544
- C:\Windows\System\iINLkEG.exe
  C:\Windows\System\iINLkEG.exe
  2⤵
  PID:7572
- C:\Windows\System\tIcDRrd.exe
  C:\Windows\System\tIcDRrd.exe
  2⤵
  PID:7592
- C:\Windows\System\HfljafV.exe
  C:\Windows\System\HfljafV.exe
  2⤵
  PID:7608
- C:\Windows\System\WywlLRW.exe
  C:\Windows\System\WywlLRW.exe
  2⤵
  PID:7624
- C:\Windows\System\BBOpYhv.exe
  C:\Windows\System\BBOpYhv.exe
  2⤵
  PID:7640
- C:\Windows\System\qSugqwW.exe
  C:\Windows\System\qSugqwW.exe
  2⤵
  PID:7664
- C:\Windows\System\EVOvMyx.exe
  C:\Windows\System\EVOvMyx.exe
  2⤵
  PID:7688
- C:\Windows\System\gZEtoAX.exe
  C:\Windows\System\gZEtoAX.exe
  2⤵
  PID:7708
- C:\Windows\System\RElfKdf.exe
  C:\Windows\System\RElfKdf.exe
  2⤵
  PID:7736
- C:\Windows\System\THUCdqR.exe
  C:\Windows\System\THUCdqR.exe
  2⤵
  PID:7752
- C:\Windows\System\kZdcphE.exe
  C:\Windows\System\kZdcphE.exe
  2⤵
  PID:7780
- C:\Windows\System\LeOWNLa.exe
  C:\Windows\System\LeOWNLa.exe
  2⤵
  PID:7804
- C:\Windows\System\jxQqXAD.exe
  C:\Windows\System\jxQqXAD.exe
  2⤵
  PID:7824
- C:\Windows\System\DerxCuZ.exe
  C:\Windows\System\DerxCuZ.exe
  2⤵
  PID:7844
- C:\Windows\System\BlbGEOc.exe
  C:\Windows\System\BlbGEOc.exe
  2⤵
  PID:7864
- C:\Windows\System\uAoDhnT.exe
  C:\Windows\System\uAoDhnT.exe
  2⤵
  PID:7884
- C:\Windows\System\tsunNFQ.exe
  C:\Windows\System\tsunNFQ.exe
  2⤵
  PID:7908
- C:\Windows\System\gSRySeM.exe
  C:\Windows\System\gSRySeM.exe
  2⤵
  PID:7928
- C:\Windows\System\AddmJrx.exe
  C:\Windows\System\AddmJrx.exe
  2⤵
  PID:7952
- C:\Windows\System\oGvztjD.exe
  C:\Windows\System\oGvztjD.exe
  2⤵
  PID:7972
- C:\Windows\System\VMJiobo.exe
  C:\Windows\System\VMJiobo.exe
  2⤵
  PID:7992
- C:\Windows\System\orukWHS.exe
  C:\Windows\System\orukWHS.exe
  2⤵
  PID:8012
- C:\Windows\System\nlRJoAg.exe
  C:\Windows\System\nlRJoAg.exe
  2⤵
  PID:8028
- C:\Windows\System\ApexCal.exe
  C:\Windows\System\ApexCal.exe
  2⤵
  PID:8048
- C:\Windows\System\xMGUQBz.exe
  C:\Windows\System\xMGUQBz.exe
  2⤵
  PID:8068
- C:\Windows\System\FrGqVDx.exe
  C:\Windows\System\FrGqVDx.exe
  2⤵
  PID:8092
- C:\Windows\System\VdzTubs.exe
  C:\Windows\System\VdzTubs.exe
  2⤵
  PID:8116
- C:\Windows\System\oUnVcDS.exe
  C:\Windows\System\oUnVcDS.exe
  2⤵
  PID:6600
- C:\Windows\System\HHMAIlh.exe
  C:\Windows\System\HHMAIlh.exe
  2⤵
  PID:7380
- C:\Windows\System\fOmHoMc.exe
  C:\Windows\System\fOmHoMc.exe
  2⤵
  PID:6636
- C:\Windows\System\BhoivUV.exe
  C:\Windows\System\BhoivUV.exe
  2⤵
  PID:7124
- C:\Windows\System\FpEaHQC.exe
  C:\Windows\System\FpEaHQC.exe
  2⤵
  PID:7716
- C:\Windows\System\jotOKjr.exe
  C:\Windows\System\jotOKjr.exe
  2⤵
  PID:7284
- C:\Windows\System\wSqKKys.exe
  C:\Windows\System\wSqKKys.exe
  2⤵
  PID:7916
- C:\Windows\System\JhyGykv.exe
  C:\Windows\System\JhyGykv.exe
  2⤵
  PID:7428
- C:\Windows\System\ZlKIBnQ.exe
  C:\Windows\System\ZlKIBnQ.exe
  2⤵
  PID:7520
- C:\Windows\System\aHNIRnl.exe
  C:\Windows\System\aHNIRnl.exe
  2⤵
  PID:7156
- C:\Windows\System\yAbqJgT.exe
  C:\Windows\System\yAbqJgT.exe
  2⤵
  PID:7348
- C:\Windows\System\oidGzpp.exe
  C:\Windows\System\oidGzpp.exe
  2⤵
  PID:8104
- C:\Windows\System\yHflrUE.exe
  C:\Windows\System\yHflrUE.exe
  2⤵
  PID:7496
- C:\Windows\System\NmvJwAT.exe
  C:\Windows\System\NmvJwAT.exe
  2⤵
  PID:7920
- C:\Windows\System\YAcyQTS.exe
  C:\Windows\System\YAcyQTS.exe
  2⤵
  PID:8128
- C:\Windows\System\ssnnPlx.exe
  C:\Windows\System\ssnnPlx.exe
  2⤵
  PID:7656
- C:\Windows\System\SLUMMQP.exe
  C:\Windows\System\SLUMMQP.exe
  2⤵
  PID:8196
- C:\Windows\System\bLVDGhC.exe
  C:\Windows\System\bLVDGhC.exe
  2⤵
  PID:8216
- C:\Windows\System\JiXYzWo.exe
  C:\Windows\System\JiXYzWo.exe
  2⤵
  PID:8240
- C:\Windows\System\TPTlELN.exe
  C:\Windows\System\TPTlELN.exe
  2⤵
  PID:8268
- C:\Windows\System\JdqTham.exe
  C:\Windows\System\JdqTham.exe
  2⤵
  PID:8292
- C:\Windows\System\bahalIf.exe
  C:\Windows\System\bahalIf.exe
  2⤵
  PID:8324
- C:\Windows\System\cGBHSPI.exe
  C:\Windows\System\cGBHSPI.exe
  2⤵
  PID:8348
- C:\Windows\System\IfpfDgW.exe
  C:\Windows\System\IfpfDgW.exe
  2⤵
  PID:8372
- C:\Windows\System\vpWsgpf.exe
  C:\Windows\System\vpWsgpf.exe
  2⤵
  PID:8396
- C:\Windows\System\vCdnbYq.exe
  C:\Windows\System\vCdnbYq.exe
  2⤵
  PID:8420
- C:\Windows\System\vRolKQV.exe
  C:\Windows\System\vRolKQV.exe
  2⤵
  PID:8456
- C:\Windows\System\MTJcRcM.exe
  C:\Windows\System\MTJcRcM.exe
  2⤵
  PID:8476
- C:\Windows\System\RyksyBY.exe
  C:\Windows\System\RyksyBY.exe
  2⤵
  PID:8500
- C:\Windows\System\DoMTJoP.exe
  C:\Windows\System\DoMTJoP.exe
  2⤵
  PID:8520
- C:\Windows\System\yMQaLxw.exe
  C:\Windows\System\yMQaLxw.exe
  2⤵
  PID:8548
- C:\Windows\System\ymhjDLM.exe
  C:\Windows\System\ymhjDLM.exe
  2⤵
  PID:8576
- C:\Windows\System\vvzbwPc.exe
  C:\Windows\System\vvzbwPc.exe
  2⤵
  PID:8596
- C:\Windows\System\rNZZJqf.exe
  C:\Windows\System\rNZZJqf.exe
  2⤵
  PID:8624
- C:\Windows\System\zgSRBKe.exe
  C:\Windows\System\zgSRBKe.exe
  2⤵
  PID:8648
- C:\Windows\System\PQUhImk.exe
  C:\Windows\System\PQUhImk.exe
  2⤵
  PID:8672
- C:\Windows\System\VhfUIbx.exe
  C:\Windows\System\VhfUIbx.exe
  2⤵
  PID:8724
- C:\Windows\System\ghqtXgL.exe
  C:\Windows\System\ghqtXgL.exe
  2⤵
  PID:8740
- C:\Windows\System\vFsBuvr.exe
  C:\Windows\System\vFsBuvr.exe
  2⤵
  PID:8756
- C:\Windows\System\LooVDvQ.exe
  C:\Windows\System\LooVDvQ.exe
  2⤵
  PID:8780
- C:\Windows\System\SUKnIFo.exe
  C:\Windows\System\SUKnIFo.exe
  2⤵
  PID:8804
- C:\Windows\System\wGRpOhV.exe
  C:\Windows\System\wGRpOhV.exe
  2⤵
  PID:8828
- C:\Windows\System\mEIGPWU.exe
  C:\Windows\System\mEIGPWU.exe
  2⤵
  PID:8852
- C:\Windows\System\jKPTXgf.exe
  C:\Windows\System\jKPTXgf.exe
  2⤵
  PID:8868
- C:\Windows\System\sPjiSKd.exe
  C:\Windows\System\sPjiSKd.exe
  2⤵
  PID:8892
- C:\Windows\System\QgwbDBx.exe
  C:\Windows\System\QgwbDBx.exe
  2⤵
  PID:8916
- C:\Windows\System\UyuLLWY.exe
  C:\Windows\System\UyuLLWY.exe
  2⤵
  PID:8932
- C:\Windows\System\cMaonEl.exe
  C:\Windows\System\cMaonEl.exe
  2⤵
  PID:8956
- C:\Windows\System\TIxgbKc.exe
  C:\Windows\System\TIxgbKc.exe
  2⤵
  PID:8976
- C:\Windows\System\agSOSbu.exe
  C:\Windows\System\agSOSbu.exe
  2⤵
  PID:8996
- C:\Windows\System\kBBNlHf.exe
  C:\Windows\System\kBBNlHf.exe
  2⤵
  PID:9024
- C:\Windows\System\WJbazLw.exe
  C:\Windows\System\WJbazLw.exe
  2⤵
  PID:9040
- C:\Windows\System\IvwTAih.exe
  C:\Windows\System\IvwTAih.exe
  2⤵
  PID:9068
- C:\Windows\System\NlGAZvP.exe
  C:\Windows\System\NlGAZvP.exe
  2⤵
  PID:9092
- C:\Windows\System\zFXuMQf.exe
  C:\Windows\System\zFXuMQf.exe
  2⤵
  PID:9112
- C:\Windows\System\lcUKZKX.exe
  C:\Windows\System\lcUKZKX.exe
  2⤵
  PID:9136
- C:\Windows\System\uvPkeyK.exe
  C:\Windows\System\uvPkeyK.exe
  2⤵
  PID:9152
- C:\Windows\System\jBrFjLf.exe
  C:\Windows\System\jBrFjLf.exe
  2⤵
  PID:9172
- C:\Windows\System\ybBpcih.exe
  C:\Windows\System\ybBpcih.exe
  2⤵
  PID:9192
- C:\Windows\System\ehSMqSY.exe
  C:\Windows\System\ehSMqSY.exe
  2⤵
  PID:9208
- C:\Windows\System\snhdUkt.exe
  C:\Windows\System\snhdUkt.exe
  2⤵
  PID:7220
- C:\Windows\System\CbzTCyt.exe
  C:\Windows\System\CbzTCyt.exe
  2⤵
  PID:7680
- C:\Windows\System\ytzNADB.exe
  C:\Windows\System\ytzNADB.exe
  2⤵
  PID:7964
- C:\Windows\System\yoiLUTt.exe
  C:\Windows\System\yoiLUTt.exe
  2⤵
  PID:7724
- C:\Windows\System\xoLpSNA.exe
  C:\Windows\System\xoLpSNA.exe
  2⤵
  PID:7396
- C:\Windows\System\gQYBBiJ.exe
  C:\Windows\System\gQYBBiJ.exe
  2⤵
  PID:8152
- C:\Windows\System\SODPYiX.exe
  C:\Windows\System\SODPYiX.exe
  2⤵
  PID:7564
- C:\Windows\System\rROmtGl.exe
  C:\Windows\System\rROmtGl.exe
  2⤵
  PID:6400
- C:\Windows\System\uvHEjvl.exe
  C:\Windows\System\uvHEjvl.exe
  2⤵
  PID:8280
- C:\Windows\System\EfyAlUB.exe
  C:\Windows\System\EfyAlUB.exe
  2⤵
  PID:8344
- C:\Windows\System\zVEpqZi.exe
  C:\Windows\System\zVEpqZi.exe
  2⤵
  PID:4116
- C:\Windows\System\RMlNHwD.exe
  C:\Windows\System\RMlNHwD.exe
  2⤵
  PID:7456
- C:\Windows\System\qnCOwgW.exe
  C:\Windows\System\qnCOwgW.exe
  2⤵
  PID:8516
- C:\Windows\System\JZtyEco.exe
  C:\Windows\System\JZtyEco.exe
  2⤵
  PID:8572
- C:\Windows\System\nqtYksI.exe
  C:\Windows\System\nqtYksI.exe
  2⤵
  PID:8616
- C:\Windows\System\VhIGKeW.exe
  C:\Windows\System\VhIGKeW.exe
  2⤵
  PID:8660
- C:\Windows\System\QfRKpJB.exe
  C:\Windows\System\QfRKpJB.exe
  2⤵
  PID:3984
- C:\Windows\System\RrchEzg.exe
  C:\Windows\System\RrchEzg.exe
  2⤵
  PID:6964
- C:\Windows\System\aimdXQr.exe
  C:\Windows\System\aimdXQr.exe
  2⤵
  PID:8752
- C:\Windows\System\YIvLPOR.exe
  C:\Windows\System\YIvLPOR.exe
  2⤵
  PID:8788
- C:\Windows\System\RUbfGQp.exe
  C:\Windows\System\RUbfGQp.exe
  2⤵
  PID:8824
- C:\Windows\System\MkaXgTV.exe
  C:\Windows\System\MkaXgTV.exe
  2⤵
  PID:6228
- C:\Windows\System\FggBDTH.exe
  C:\Windows\System\FggBDTH.exe
  2⤵
  PID:8888
- C:\Windows\System\AvUHsNj.exe
  C:\Windows\System\AvUHsNj.exe
  2⤵
  PID:7424
- C:\Windows\System\PsaZhXZ.exe
  C:\Windows\System\PsaZhXZ.exe
  2⤵
  PID:8484
- C:\Windows\System\OmNEBNS.exe
  C:\Windows\System\OmNEBNS.exe
  2⤵
  PID:9048
- C:\Windows\System\ePZrDgT.exe
  C:\Windows\System\ePZrDgT.exe
  2⤵
  PID:9088
- C:\Windows\System\ckEsYLd.exe
  C:\Windows\System\ckEsYLd.exe
  2⤵
  PID:9108
- C:\Windows\System\RgwBLCQ.exe
  C:\Windows\System\RgwBLCQ.exe
  2⤵
  PID:9492
- C:\Windows\System\NqAgPZO.exe
  C:\Windows\System\NqAgPZO.exe
  2⤵
  PID:9508
- C:\Windows\System\zWpNyYW.exe
  C:\Windows\System\zWpNyYW.exe
  2⤵
  PID:9536
- C:\Windows\System\RxhcLtc.exe
  C:\Windows\System\RxhcLtc.exe
  2⤵
  PID:9552
- C:\Windows\System\TKqArHk.exe
  C:\Windows\System\TKqArHk.exe
  2⤵
  PID:9572
- C:\Windows\System\JVuylOP.exe
  C:\Windows\System\JVuylOP.exe
  2⤵
  PID:9596
- C:\Windows\System\mtmnEFu.exe
  C:\Windows\System\mtmnEFu.exe
  2⤵
  PID:9620
- C:\Windows\System\YVaSbgM.exe
  C:\Windows\System\YVaSbgM.exe
  2⤵
  PID:9640
- C:\Windows\System\uqSMqpS.exe
  C:\Windows\System\uqSMqpS.exe
  2⤵
  PID:9660
- C:\Windows\System\HgkqkKn.exe
  C:\Windows\System\HgkqkKn.exe
  2⤵
  PID:9684
- C:\Windows\System\BuDSxkO.exe
  C:\Windows\System\BuDSxkO.exe
  2⤵
  PID:9708
- C:\Windows\System\hkicjhS.exe
  C:\Windows\System\hkicjhS.exe
  2⤵
  PID:9732
- C:\Windows\System\yTqwFKC.exe
  C:\Windows\System\yTqwFKC.exe
  2⤵
  PID:9756
- C:\Windows\System\bvGFitZ.exe
  C:\Windows\System\bvGFitZ.exe
  2⤵
  PID:9776
- C:\Windows\System\pKxMVII.exe
  C:\Windows\System\pKxMVII.exe
  2⤵
  PID:9800
- C:\Windows\System\iudedzg.exe
  C:\Windows\System\iudedzg.exe
  2⤵
  PID:9824
- C:\Windows\System\hXooxMQ.exe
  C:\Windows\System\hXooxMQ.exe
  2⤵
  PID:9848
- C:\Windows\System\CHdvdAJ.exe
  C:\Windows\System\CHdvdAJ.exe
  2⤵
  PID:9868
- C:\Windows\System\paUrRcn.exe
  C:\Windows\System\paUrRcn.exe
  2⤵
  PID:9892
- C:\Windows\System\SWhXZHv.exe
  C:\Windows\System\SWhXZHv.exe
  2⤵
  PID:9916
- C:\Windows\System\RQkTDeW.exe
  C:\Windows\System\RQkTDeW.exe
  2⤵
  PID:9940
- C:\Windows\System\diKixlA.exe
  C:\Windows\System\diKixlA.exe
  2⤵
  PID:9964
- C:\Windows\System\uHRMcYG.exe
  C:\Windows\System\uHRMcYG.exe
  2⤵
  PID:9980
- C:\Windows\System\RBvTWXY.exe
  C:\Windows\System\RBvTWXY.exe
  2⤵
  PID:10004
- C:\Windows\System\hPXVZVP.exe
  C:\Windows\System\hPXVZVP.exe
  2⤵
  PID:10216
- C:\Windows\System\OnFKUPB.exe
  C:\Windows\System\OnFKUPB.exe
  2⤵
  PID:1384
- C:\Windows\System\bvWEkji.exe
  C:\Windows\System\bvWEkji.exe
  2⤵
  PID:8224
- C:\Windows\System\OYtvMOA.exe
  C:\Windows\System\OYtvMOA.exe
  2⤵
  PID:7820
- C:\Windows\System\rdwvIQF.exe
  C:\Windows\System\rdwvIQF.exe
  2⤵
  PID:8140
- C:\Windows\System\cvCYBQW.exe
  C:\Windows\System\cvCYBQW.exe
  2⤵
  PID:7532
- C:\Windows\System\bULinkA.exe
  C:\Windows\System\bULinkA.exe
  2⤵
  PID:6820
- C:\Windows\System\IAWcWBv.exe
  C:\Windows\System\IAWcWBv.exe
  2⤵
  PID:8748
- C:\Windows\System\CmfHXpe.exe
  C:\Windows\System\CmfHXpe.exe
  2⤵
  PID:8360
- C:\Windows\System\cFrdwRm.exe
  C:\Windows\System\cFrdwRm.exe
  2⤵
  PID:8900
- C:\Windows\System\qNfUNLg.exe
  C:\Windows\System\qNfUNLg.exe
  2⤵
  PID:9036
- C:\Windows\System\dKogTSw.exe
  C:\Windows\System\dKogTSw.exe
  2⤵
  PID:9188
- C:\Windows\System\VgqRnpd.exe
  C:\Windows\System\VgqRnpd.exe
  2⤵
  PID:7904
- C:\Windows\System\ZtnpceV.exe
  C:\Windows\System\ZtnpceV.exe
  2⤵
  PID:7744
- C:\Windows\System\uVZdqIV.exe
  C:\Windows\System\uVZdqIV.exe
  2⤵
  PID:8560
- C:\Windows\System\hoBQKKk.exe
  C:\Windows\System\hoBQKKk.exe
  2⤵
  PID:9308
- C:\Windows\System\EGhDrbS.exe
  C:\Windows\System\EGhDrbS.exe
  2⤵
  PID:9032
- C:\Windows\System\ORZvngl.exe
  C:\Windows\System\ORZvngl.exe
  2⤵
  PID:8088
- C:\Windows\System\MwfSMoz.exe
  C:\Windows\System\MwfSMoz.exe
  2⤵
  PID:8684
- C:\Windows\System\lFpnuWF.exe
  C:\Windows\System\lFpnuWF.exe
  2⤵
  PID:9148
- C:\Windows\System\UwMqAkP.exe
  C:\Windows\System\UwMqAkP.exe
  2⤵
  PID:7044
- C:\Windows\System\igCeEwA.exe
  C:\Windows\System\igCeEwA.exe
  2⤵
  PID:8004
- C:\Windows\System\rUEEoNS.exe
  C:\Windows\System\rUEEoNS.exe
  2⤵
  PID:8496
- C:\Windows\System\GpCfVEv.exe
  C:\Windows\System\GpCfVEv.exe
  2⤵
  PID:8464
- C:\Windows\System\KoJWLoI.exe
  C:\Windows\System\KoJWLoI.exe
  2⤵
  PID:9424
- C:\Windows\System\UyeCZci.exe
  C:\Windows\System\UyeCZci.exe
  2⤵
  PID:9864
- C:\Windows\System\rRMEIwN.exe
  C:\Windows\System\rRMEIwN.exe
  2⤵
  PID:9544
- C:\Windows\System\ODczPMq.exe
  C:\Windows\System\ODczPMq.exe
  2⤵
  PID:9716
- C:\Windows\System\OKoAZAW.exe
  C:\Windows\System\OKoAZAW.exe
  2⤵
  PID:9772
- C:\Windows\System\rKLcwlV.exe
  C:\Windows\System\rKLcwlV.exe
  2⤵
  PID:9836
- C:\Windows\System\DbGZUvq.exe
  C:\Windows\System\DbGZUvq.exe
  2⤵
  PID:10196
- C:\Windows\System\fZhtbfu.exe
  C:\Windows\System\fZhtbfu.exe
  2⤵
  PID:9960
- C:\Windows\System\XqoNNrl.exe
  C:\Windows\System\XqoNNrl.exe
  2⤵
  PID:10012
- C:\Windows\System\CVLQlSr.exe
  C:\Windows\System\CVLQlSr.exe
  2⤵
  PID:10252
- C:\Windows\System\DslOeTK.exe
  C:\Windows\System\DslOeTK.exe
  2⤵
  PID:10272
- C:\Windows\System\RuuamAU.exe
  C:\Windows\System\RuuamAU.exe
  2⤵
  PID:10288
- C:\Windows\System\SqTniZU.exe
  C:\Windows\System\SqTniZU.exe
  2⤵
  PID:10304
- C:\Windows\System\XcsRFSu.exe
  C:\Windows\System\XcsRFSu.exe
  2⤵
  PID:10320
- C:\Windows\System\MwDPNjw.exe
  C:\Windows\System\MwDPNjw.exe
  2⤵
  PID:10336
- C:\Windows\System\WnWnFax.exe
  C:\Windows\System\WnWnFax.exe
  2⤵
  PID:10352
- C:\Windows\System\WriEyef.exe
  C:\Windows\System\WriEyef.exe
  2⤵
  PID:10368
- C:\Windows\System\aKECJDm.exe
  C:\Windows\System\aKECJDm.exe
  2⤵
  PID:10384
- C:\Windows\System\YphMikE.exe
  C:\Windows\System\YphMikE.exe
  2⤵
  PID:10400
- C:\Windows\System\OYhQeov.exe
  C:\Windows\System\OYhQeov.exe
  2⤵
  PID:10424
- C:\Windows\System\htNsZyg.exe
  C:\Windows\System\htNsZyg.exe
  2⤵
  PID:10452
- C:\Windows\System\troHlcB.exe
  C:\Windows\System\troHlcB.exe
  2⤵
  PID:10472
- C:\Windows\System\XmFRaAU.exe
  C:\Windows\System\XmFRaAU.exe
  2⤵
  PID:10496
- C:\Windows\System\hDyHrxB.exe
  C:\Windows\System\hDyHrxB.exe
  2⤵
  PID:10512
- C:\Windows\System\MXMfXrJ.exe
  C:\Windows\System\MXMfXrJ.exe
  2⤵
  PID:10536
- C:\Windows\System\qaccxcS.exe
  C:\Windows\System\qaccxcS.exe
  2⤵
  PID:10564
- C:\Windows\System\GPimypP.exe
  C:\Windows\System\GPimypP.exe
  2⤵
  PID:10596
- C:\Windows\System\vYtLZyH.exe
  C:\Windows\System\vYtLZyH.exe
  2⤵
  PID:10620
- C:\Windows\System\csPpssa.exe
  C:\Windows\System\csPpssa.exe
  2⤵
  PID:10644
- C:\Windows\System\pPGkdZR.exe
  C:\Windows\System\pPGkdZR.exe
  2⤵
  PID:10668
- C:\Windows\System\froEOHs.exe
  C:\Windows\System\froEOHs.exe
  2⤵
  PID:10688
- C:\Windows\System\uluJbHN.exe
  C:\Windows\System\uluJbHN.exe
  2⤵
  PID:10716
- C:\Windows\System\BxpgGOR.exe
  C:\Windows\System\BxpgGOR.exe
  2⤵
  PID:10748
- C:\Windows\System\RsqhLwd.exe
  C:\Windows\System\RsqhLwd.exe
  2⤵
  PID:10776
- C:\Windows\System\VSoXKiD.exe
  C:\Windows\System\VSoXKiD.exe
  2⤵
  PID:10800
- C:\Windows\System\hvDxqsP.exe
  C:\Windows\System\hvDxqsP.exe
  2⤵
  PID:10832
- C:\Windows\System\xppZinm.exe
  C:\Windows\System\xppZinm.exe
  2⤵
  PID:10856
- C:\Windows\System\QanMzdE.exe
  C:\Windows\System\QanMzdE.exe
  2⤵
  PID:10876
- C:\Windows\System\vhdmGkP.exe
  C:\Windows\System\vhdmGkP.exe
  2⤵
  PID:10896
- C:\Windows\System\pYjhsmD.exe
  C:\Windows\System\pYjhsmD.exe
  2⤵
  PID:10916
- C:\Windows\System\qZEkcUT.exe
  C:\Windows\System\qZEkcUT.exe
  2⤵
  PID:10936
- C:\Windows\System\lZdHIRj.exe
  C:\Windows\System\lZdHIRj.exe
  2⤵
  PID:10960
- C:\Windows\System\FpiWUbG.exe
  C:\Windows\System\FpiWUbG.exe
  2⤵
  PID:10984
- C:\Windows\System\XTAFfWj.exe
  C:\Windows\System\XTAFfWj.exe
  2⤵
  PID:11000
- C:\Windows\System\RDWrrDh.exe
  C:\Windows\System\RDWrrDh.exe
  2⤵
  PID:11024
- C:\Windows\System\IcwWJdD.exe
  C:\Windows\System\IcwWJdD.exe
  2⤵
  PID:11048
- C:\Windows\System\vbzjxBx.exe
  C:\Windows\System\vbzjxBx.exe
  2⤵
  PID:11076
- C:\Windows\System\qGMljbz.exe
  C:\Windows\System\qGMljbz.exe
  2⤵
  PID:11104
- C:\Windows\System\onROJHP.exe
  C:\Windows\System\onROJHP.exe
  2⤵
  PID:11120
- C:\Windows\System\uIjpboz.exe
  C:\Windows\System\uIjpboz.exe
  2⤵
  PID:11148
- C:\Windows\System\wpZXzlY.exe
  C:\Windows\System\wpZXzlY.exe
  2⤵
  PID:11192
- C:\Windows\System\EKzgxEi.exe
  C:\Windows\System\EKzgxEi.exe
  2⤵
  PID:11212
- C:\Windows\System\xdEatWY.exe
  C:\Windows\System\xdEatWY.exe
  2⤵
  PID:11240
- C:\Windows\System\BQuWCNx.exe
  C:\Windows\System\BQuWCNx.exe
  2⤵
  PID:10048
- C:\Windows\System\XehlxAo.exe
  C:\Windows\System\XehlxAo.exe
  2⤵
  PID:9604
- C:\Windows\System\CmuNtUH.exe
  C:\Windows\System\CmuNtUH.exe
  2⤵
  PID:9632
- C:\Windows\System\FOXgVZS.exe
  C:\Windows\System\FOXgVZS.exe
  2⤵
  PID:9680
- C:\Windows\System\gxEtzVn.exe
  C:\Windows\System\gxEtzVn.exe
  2⤵
  PID:4560
- C:\Windows\System\czCrNxV.exe
  C:\Windows\System\czCrNxV.exe
  2⤵
  PID:8820
- C:\Windows\System\jVddFAD.exe
  C:\Windows\System\jVddFAD.exe
  2⤵
  PID:9200
- C:\Windows\System\ymZRhmh.exe
  C:\Windows\System\ymZRhmh.exe
  2⤵
  PID:9300
- C:\Windows\System\TjFqYYQ.exe
  C:\Windows\System\TjFqYYQ.exe
  2⤵
  PID:8604
- C:\Windows\System\HftcQqa.exe
  C:\Windows\System\HftcQqa.exe
  2⤵
  PID:10144
- C:\Windows\System\WfGwLXt.exe
  C:\Windows\System\WfGwLXt.exe
  2⤵
  PID:9744
- C:\Windows\System\jaoBrdD.exe
  C:\Windows\System\jaoBrdD.exe
  2⤵
  PID:9832
- C:\Windows\System\LqfeoQr.exe
  C:\Windows\System\LqfeoQr.exe
  2⤵
  PID:10000
- C:\Windows\System\ViBDELI.exe
  C:\Windows\System\ViBDELI.exe
  2⤵
  PID:10228
- C:\Windows\System\TNakGcV.exe
  C:\Windows\System\TNakGcV.exe
  2⤵
  PID:8452
- C:\Windows\System\FVgiPwe.exe
  C:\Windows\System\FVgiPwe.exe
  2⤵
  PID:6696
- C:\Windows\System\ICCpQGs.exe
  C:\Windows\System\ICCpQGs.exe
  2⤵
  PID:10852
- C:\Windows\System\FkSlUjh.exe
  C:\Windows\System\FkSlUjh.exe
  2⤵
  PID:7236
- C:\Windows\System\AtWOEwg.exe
  C:\Windows\System\AtWOEwg.exe
  2⤵
  PID:6532
- C:\Windows\System\ymtundy.exe
  C:\Windows\System\ymtundy.exe
  2⤵
  PID:9796
- C:\Windows\System\gduVcvE.exe
  C:\Windows\System\gduVcvE.exe
  2⤵
  PID:10904
- C:\Windows\System\jaFdNDX.exe
  C:\Windows\System\jaFdNDX.exe
  2⤵
  PID:10944
- C:\Windows\System\GZxOSJt.exe
  C:\Windows\System\GZxOSJt.exe
  2⤵
  PID:10996
- C:\Windows\System\tASuWNN.exe
  C:\Windows\System\tASuWNN.exe
  2⤵
  PID:11040
- C:\Windows\System\nLqRdfL.exe
  C:\Windows\System\nLqRdfL.exe
  2⤵
  PID:11060
- C:\Windows\System\eUnkyXk.exe
  C:\Windows\System\eUnkyXk.exe
  2⤵
  PID:9820
- C:\Windows\System\GcnlWwO.exe
  C:\Windows\System\GcnlWwO.exe
  2⤵
  PID:9900
- C:\Windows\System\JpOqWbD.exe
  C:\Windows\System\JpOqWbD.exe
  2⤵
  PID:11112
- C:\Windows\System\UlJJOsh.exe
  C:\Windows\System\UlJJOsh.exe
  2⤵
  PID:11276
- C:\Windows\System\HhAtRbf.exe
  C:\Windows\System\HhAtRbf.exe
  2⤵
  PID:11292
- C:\Windows\System\XOXoMhp.exe
  C:\Windows\System\XOXoMhp.exe
  2⤵
  PID:11312
- C:\Windows\System\EPmeOKa.exe
  C:\Windows\System\EPmeOKa.exe
  2⤵
  PID:11332
- C:\Windows\System\bLIHNGQ.exe
  C:\Windows\System\bLIHNGQ.exe
  2⤵
  PID:11352
- C:\Windows\System\QCpEvQU.exe
  C:\Windows\System\QCpEvQU.exe
  2⤵
  PID:11368
- C:\Windows\System\HhRyvZj.exe
  C:\Windows\System\HhRyvZj.exe
  2⤵
  PID:11392
- C:\Windows\System\cyOKtdd.exe
  C:\Windows\System\cyOKtdd.exe
  2⤵
  PID:11420
- C:\Windows\System\KExztvQ.exe
  C:\Windows\System\KExztvQ.exe
  2⤵
  PID:11440
- C:\Windows\System\xVZxSGd.exe
  C:\Windows\System\xVZxSGd.exe
  2⤵
  PID:11460
- C:\Windows\System\BwCjdwY.exe
  C:\Windows\System\BwCjdwY.exe
  2⤵
  PID:11480
- C:\Windows\System\mVVmBTV.exe
  C:\Windows\System\mVVmBTV.exe
  2⤵
  PID:11500
- C:\Windows\System\VhttoNN.exe
  C:\Windows\System\VhttoNN.exe
  2⤵
  PID:11524
- C:\Windows\System\NMrgCLr.exe
  C:\Windows\System\NMrgCLr.exe
  2⤵
  PID:11548
- C:\Windows\System\ZiaHRaf.exe
  C:\Windows\System\ZiaHRaf.exe
  2⤵
  PID:11572
- C:\Windows\System\EPVaoIf.exe
  C:\Windows\System\EPVaoIf.exe
  2⤵
  PID:11596
- C:\Windows\System\sYVXbVH.exe
  C:\Windows\System\sYVXbVH.exe
  2⤵
  PID:11612
- C:\Windows\System\YIeJAzU.exe
  C:\Windows\System\YIeJAzU.exe
  2⤵
  PID:11636
- C:\Windows\System\seLCojy.exe
  C:\Windows\System\seLCojy.exe
  2⤵
  PID:11664
- C:\Windows\System\yCMPfeV.exe
  C:\Windows\System\yCMPfeV.exe
  2⤵
  PID:11684
- C:\Windows\System\ejUhdQB.exe
  C:\Windows\System\ejUhdQB.exe
  2⤵
  PID:11704
- C:\Windows\System\daCVGBg.exe
  C:\Windows\System\daCVGBg.exe
  2⤵
  PID:11728
- C:\Windows\System\Psepicg.exe
  C:\Windows\System\Psepicg.exe
  2⤵
  PID:11752
- C:\Windows\System\kPoSfyl.exe
  C:\Windows\System\kPoSfyl.exe
  2⤵
  PID:11772
- C:\Windows\System\ZHiZGUA.exe
  C:\Windows\System\ZHiZGUA.exe
  2⤵
  PID:11792
- C:\Windows\System\EWKuDnX.exe
  C:\Windows\System\EWKuDnX.exe
  2⤵
  PID:11812
- C:\Windows\System\EqnLsEV.exe
  C:\Windows\System\EqnLsEV.exe
  2⤵
  PID:11832
- C:\Windows\System\YNdZjDw.exe
  C:\Windows\System\YNdZjDw.exe
  2⤵
  PID:11856
- C:\Windows\System\jWpDlWA.exe
  C:\Windows\System\jWpDlWA.exe
  2⤵
  PID:11884
- C:\Windows\System\zpFcZIh.exe
  C:\Windows\System\zpFcZIh.exe
  2⤵
  PID:11904
- C:\Windows\System\pmpMIBU.exe
  C:\Windows\System\pmpMIBU.exe
  2⤵
  PID:11924
- C:\Windows\System\spbjOBS.exe
  C:\Windows\System\spbjOBS.exe
  2⤵
  PID:11944
- C:\Windows\System\EwJhZts.exe
  C:\Windows\System\EwJhZts.exe
  2⤵
  PID:11972
- C:\Windows\System\VOBABSq.exe
  C:\Windows\System\VOBABSq.exe
  2⤵
  PID:11992
- C:\Windows\System\jCgFmLQ.exe
  C:\Windows\System\jCgFmLQ.exe
  2⤵
  PID:12012
- C:\Windows\System\WdPgcya.exe
  C:\Windows\System\WdPgcya.exe
  2⤵
  PID:12036
- C:\Windows\System\cYkZIFX.exe
  C:\Windows\System\cYkZIFX.exe
  2⤵
  PID:12060
- C:\Windows\System\sShyvof.exe
  C:\Windows\System\sShyvof.exe
  2⤵
  PID:12084
- C:\Windows\System\SZDQXTE.exe
  C:\Windows\System\SZDQXTE.exe
  2⤵
  PID:12104
- C:\Windows\System\AHYwjGq.exe
  C:\Windows\System\AHYwjGq.exe
  2⤵
  PID:12128
- C:\Windows\System\SlnQyTp.exe
  C:\Windows\System\SlnQyTp.exe
  2⤵
  PID:12144
- C:\Windows\System\hggHVVf.exe
  C:\Windows\System\hggHVVf.exe
  2⤵
  PID:12168
- C:\Windows\System\JRSrxzx.exe
  C:\Windows\System\JRSrxzx.exe
  2⤵
  PID:12188
- C:\Windows\System\QCnEjiK.exe
  C:\Windows\System\QCnEjiK.exe
  2⤵
  PID:12216
- C:\Windows\System\WIAJfjR.exe
  C:\Windows\System\WIAJfjR.exe
  2⤵
  PID:12240
- C:\Windows\System\vpnVzJt.exe
  C:\Windows\System\vpnVzJt.exe
  2⤵
  PID:12260
- C:\Windows\System\gTyXeCQ.exe
  C:\Windows\System\gTyXeCQ.exe
  2⤵
  PID:12280
- C:\Windows\System\vVNrqxs.exe
  C:\Windows\System\vVNrqxs.exe
  2⤵
  PID:10468
- C:\Windows\System\mPivtbb.exe
  C:\Windows\System\mPivtbb.exe
  2⤵
  PID:11236
- C:\Windows\System\QRFUwSI.exe
  C:\Windows\System\QRFUwSI.exe
  2⤵
  PID:8248
- C:\Windows\System\AvsPjeo.exe
  C:\Windows\System\AvsPjeo.exe
  2⤵
  PID:10616
- C:\Windows\System\ILZVTyA.exe
  C:\Windows\System\ILZVTyA.exe
  2⤵
  PID:8736
- C:\Windows\System\ukodkcI.exe
  C:\Windows\System\ukodkcI.exe
  2⤵
  PID:11256
- C:\Windows\System\jVYypOT.exe
  C:\Windows\System\jVYypOT.exe
  2⤵
  PID:10792
- C:\Windows\System\SubKwYb.exe
  C:\Windows\System\SubKwYb.exe
  2⤵
  PID:4232
- C:\Windows\System\IkhJCDY.exe
  C:\Windows\System\IkhJCDY.exe
  2⤵
  PID:9580
- C:\Windows\System\RdCPtxV.exe
  C:\Windows\System\RdCPtxV.exe
  2⤵
  PID:11116
- C:\Windows\System\aFImtHI.exe
  C:\Windows\System\aFImtHI.exe
  2⤵
  PID:9248
- C:\Windows\System\vTCfNcU.exe
  C:\Windows\System\vTCfNcU.exe
  2⤵
  PID:10764
- C:\Windows\System\cmZKLWZ.exe
  C:\Windows\System\cmZKLWZ.exe
  2⤵
  PID:11144
- C:\Windows\System\EQfYFUS.exe
  C:\Windows\System\EQfYFUS.exe
  2⤵
  PID:11284
- C:\Windows\System\MFfOJUY.exe
  C:\Windows\System\MFfOJUY.exe
  2⤵
  PID:10328
- C:\Windows\System\ZPgmHWk.exe
  C:\Windows\System\ZPgmHWk.exe
  2⤵
  PID:10380
- C:\Windows\System\HQpuZng.exe
  C:\Windows\System\HQpuZng.exe
  2⤵
  PID:10432
- C:\Windows\System\PUPrYln.exe
  C:\Windows\System\PUPrYln.exe
  2⤵
  PID:10480
- C:\Windows\System\lDWOVmT.exe
  C:\Windows\System\lDWOVmT.exe
  2⤵
  PID:11224
- C:\Windows\System\krKucXe.exe
  C:\Windows\System\krKucXe.exe
  2⤵
  PID:10640
- C:\Windows\System\PWfgUxo.exe
  C:\Windows\System\PWfgUxo.exe
  2⤵
  PID:11412
- C:\Windows\System\PYMRBfR.exe
  C:\Windows\System\PYMRBfR.exe
  2⤵
  PID:10704
- C:\Windows\System\syGnKhI.exe
  C:\Windows\System\syGnKhI.exe
  2⤵
  PID:11252
- C:\Windows\System\PeMlklX.exe
  C:\Windows\System\PeMlklX.exe
  2⤵
  PID:11608
- C:\Windows\System\rySKPyK.exe
  C:\Windows\System\rySKPyK.exe
  2⤵
  PID:11660
- C:\Windows\System\myLqScR.exe
  C:\Windows\System\myLqScR.exe
  2⤵
  PID:11764
- C:\Windows\System\GwzmzLA.exe
  C:\Windows\System\GwzmzLA.exe
  2⤵
  PID:9588
- C:\Windows\System\rnkgjMP.exe
  C:\Windows\System\rnkgjMP.exe
  2⤵
  PID:11808
- C:\Windows\System\gFgMFQb.exe
  C:\Windows\System\gFgMFQb.exe
  2⤵
  PID:9636
- C:\Windows\System\XkGJcQj.exe
  C:\Windows\System\XkGJcQj.exe
  2⤵
  PID:12300
- C:\Windows\System\LMEtLdW.exe
  C:\Windows\System\LMEtLdW.exe
  2⤵
  PID:12332
- C:\Windows\System\SJxXoFT.exe
  C:\Windows\System\SJxXoFT.exe
  2⤵
  PID:12352
- C:\Windows\System\IAMHJiK.exe
  C:\Windows\System\IAMHJiK.exe
  2⤵
  PID:12380
- C:\Windows\System\MUcSZJp.exe
  C:\Windows\System\MUcSZJp.exe
  2⤵
  PID:12400
- C:\Windows\System\NUsSecP.exe
  C:\Windows\System\NUsSecP.exe
  2⤵
  PID:12420
- C:\Windows\System\QOYlYYc.exe
  C:\Windows\System\QOYlYYc.exe
  2⤵
  PID:12440
- C:\Windows\System\LOgGPbo.exe
  C:\Windows\System\LOgGPbo.exe
  2⤵
  PID:12460
- C:\Windows\System\VdbATzA.exe
  C:\Windows\System\VdbATzA.exe
  2⤵
  PID:12484
- C:\Windows\System\XPZotID.exe
  C:\Windows\System\XPZotID.exe
  2⤵
  PID:12512
- C:\Windows\System\HKAktCa.exe
  C:\Windows\System\HKAktCa.exe
  2⤵
  PID:12532
- C:\Windows\System\NwXjikb.exe
  C:\Windows\System\NwXjikb.exe
  2⤵
  PID:12560
- C:\Windows\System\tREkeWw.exe
  C:\Windows\System\tREkeWw.exe
  2⤵
  PID:12580
- C:\Windows\System\dAYdrzy.exe
  C:\Windows\System\dAYdrzy.exe
  2⤵
  PID:12600
- C:\Windows\System\pUceMMm.exe
  C:\Windows\System\pUceMMm.exe
  2⤵
  PID:12628
- C:\Windows\System\zLWaSNC.exe
  C:\Windows\System\zLWaSNC.exe
  2⤵
  PID:12652
- C:\Windows\System\DxCzymz.exe
  C:\Windows\System\DxCzymz.exe
  2⤵
  PID:12672
- C:\Windows\System\nPEOTAN.exe
  C:\Windows\System\nPEOTAN.exe
  2⤵
  PID:12692
- C:\Windows\System\arAeiPn.exe
  C:\Windows\System\arAeiPn.exe
  2⤵
  PID:12712
- C:\Windows\System\yBYWUft.exe
  C:\Windows\System\yBYWUft.exe
  2⤵
  PID:12736
- C:\Windows\System\DTzTwQr.exe
  C:\Windows\System\DTzTwQr.exe
  2⤵
  PID:12752
- C:\Windows\System\bxpDfmh.exe
  C:\Windows\System\bxpDfmh.exe
  2⤵
  PID:12780
- C:\Windows\System\TlpuJUR.exe
  C:\Windows\System\TlpuJUR.exe
  2⤵
  PID:12800
- C:\Windows\System\ACiXuNJ.exe
  C:\Windows\System\ACiXuNJ.exe
  2⤵
  PID:13116
- C:\Windows\System\NNqHOpI.exe
  C:\Windows\System\NNqHOpI.exe
  2⤵
  PID:10448
- C:\Windows\System\FkULHmc.exe
  C:\Windows\System\FkULHmc.exe
  2⤵
  PID:10544
- C:\Windows\System\sVgQGZN.exe
  C:\Windows\System\sVgQGZN.exe
  2⤵
  PID:8208
- C:\Windows\System\yZRiJSH.exe
  C:\Windows\System\yZRiJSH.exe
  2⤵
  PID:13004
- C:\Windows\System\PuaHZZv.exe
  C:\Windows\System\PuaHZZv.exe
  2⤵
  PID:13064
- C:\Windows\System\pxbVNEa.exe
  C:\Windows\System\pxbVNEa.exe
  2⤵
  PID:13088
- C:\Windows\System\XfSjZev.exe
  C:\Windows\System\XfSjZev.exe
  2⤵
  PID:12944
- C:\Windows\System\IleNOBg.exe
  C:\Windows\System\IleNOBg.exe
  2⤵
  PID:13292
- C:\Windows\System\wJxmVNG.exe
  C:\Windows\System\wJxmVNG.exe
  2⤵
  PID:11388
- C:\Windows\System\AYCNKXu.exe
  C:\Windows\System\AYCNKXu.exe
  2⤵
  PID:10296
- C:\Windows\System\RmccRTz.exe
  C:\Windows\System\RmccRTz.exe
  2⤵
  PID:12116
- C:\Windows\System\wNEabgo.exe
  C:\Windows\System\wNEabgo.exe
  2⤵
  PID:12072
- C:\Windows\System\jFDtxAI.exe
  C:\Windows\System\jFDtxAI.exe
  2⤵
  PID:12164
- C:\Windows\System\FutQVla.exe
  C:\Windows\System\FutQVla.exe
  2⤵
  PID:656
- C:\Windows\System\FToDboi.exe
  C:\Windows\System\FToDboi.exe
  2⤵
  PID:13020
- C:\Windows\System\EhineVt.exe
  C:\Windows\System\EhineVt.exe
  2⤵
  PID:320
- C:\Windows\System\vIgjerU.exe
  C:\Windows\System\vIgjerU.exe
  2⤵
  PID:11408
- C:\Windows\System\FaMHljq.exe
  C:\Windows\System\FaMHljq.exe
  2⤵
  PID:13160
- C:\Windows\System\Vjstxqk.exe
  C:\Windows\System\Vjstxqk.exe
  2⤵
  PID:10772
- C:\Windows\System\CSxwZip.exe
  C:\Windows\System\CSxwZip.exe
  2⤵
  PID:11508
- C:\Windows\System\ykTMwxb.exe
  C:\Windows\System\ykTMwxb.exe
  2⤵
  PID:10732
- C:\Windows\System\zNhbaTx.exe
  C:\Windows\System\zNhbaTx.exe
  2⤵
  PID:13212
- C:\Windows\System\xuvxzgx.exe
  C:\Windows\System\xuvxzgx.exe
  2⤵
  PID:11364
- C:\Windows\System\sbdbPrZ.exe
  C:\Windows\System\sbdbPrZ.exe
  2⤵
  PID:11644
- C:\Windows\System\pKUvAuN.exe
  C:\Windows\System\pKUvAuN.exe
  2⤵
  PID:12092
- C:\Windows\System\owREPwq.exe
  C:\Windows\System\owREPwq.exe
  2⤵
  PID:12668
- C:\Windows\System\yTHZKoI.exe
  C:\Windows\System\yTHZKoI.exe
  2⤵
  PID:12980
- C:\Windows\System\CkflHOg.exe
  C:\Windows\System\CkflHOg.exe
  2⤵
  PID:11532
- C:\Windows\System\LhQBLin.exe
  C:\Windows\System\LhQBLin.exe
  2⤵
  PID:13224
- C:\Windows\System\srfCOFz.exe
  C:\Windows\System\srfCOFz.exe
  2⤵
  PID:11056
- C:\Windows\System\QnEfOaW.exe
  C:\Windows\System\QnEfOaW.exe
  2⤵
  PID:11696
- C:\Windows\System\TqCJsgq.exe
  C:\Windows\System\TqCJsgq.exe
  2⤵
  PID:10812
- C:\Windows\System\JsmKSJg.exe
  C:\Windows\System\JsmKSJg.exe
  2⤵
  PID:11700
- C:\Windows\System\smjpTxE.exe
  C:\Windows\System\smjpTxE.exe
  2⤵
  PID:13124
- C:\Windows\System\fZFlXqm.exe
  C:\Windows\System\fZFlXqm.exe
  2⤵
  PID:12376
- C:\Windows\System\oiQgnwy.exe
  C:\Windows\System\oiQgnwy.exe
  2⤵
  PID:12048
- C:\Windows\System\nxfYLEh.exe
  C:\Windows\System\nxfYLEh.exe
  2⤵
  PID:13180
- C:\Windows\System\ClrhgZM.exe
  C:\Windows\System\ClrhgZM.exe
  2⤵
  PID:12360
- C:\Windows\System\DgUMnyA.exe
  C:\Windows\System\DgUMnyA.exe
  2⤵
  PID:4648
- C:\Windows\System\uVuLjIU.exe
  C:\Windows\System\uVuLjIU.exe
  2⤵
  PID:11492
- C:\Windows\System\FqyYKdj.exe
  C:\Windows\System\FqyYKdj.exe
  2⤵
  PID:10728
- C:\Windows\System\VZzDLjc.exe
  C:\Windows\System\VZzDLjc.exe
  2⤵
  PID:13056
- C:\Windows\System\zaxEAKR.exe
  C:\Windows\System\zaxEAKR.exe
  2⤵
  PID:12648
- C:\Windows\System\GFSpSUY.exe
  C:\Windows\System\GFSpSUY.exe
  2⤵
  PID:12160
- C:\Windows\System\hBXpsTP.exe
  C:\Windows\System\hBXpsTP.exe
  2⤵
  PID:13060
- C:\Windows\System\akhyrCF.exe
  C:\Windows\System\akhyrCF.exe
  2⤵
  PID:11712
- C:\Windows\System\MfBvQus.exe
  C:\Windows\System\MfBvQus.exe
  2⤵
  PID:13288
- C:\Windows\System\iibFvKH.exe
  C:\Windows\System\iibFvKH.exe
  2⤵
  PID:384
- C:\Windows\System\MvMFJKA.exe
  C:\Windows\System\MvMFJKA.exe
  2⤵
  PID:12428
- C:\Windows\System\sVaxcTK.exe
  C:\Windows\System\sVaxcTK.exe
  2⤵
  PID:12996
- C:\Windows\System\cADNKAi.exe
  C:\Windows\System\cADNKAi.exe
  2⤵
  PID:12928
- C:\Windows\System\hDmNkpc.exe
  C:\Windows\System\hDmNkpc.exe
  2⤵
  PID:3836
- C:\Windows\System\FkuDbFl.exe
  C:\Windows\System\FkuDbFl.exe
  2⤵
  PID:12608
- C:\Windows\System\gLgpvKw.exe
  C:\Windows\System\gLgpvKw.exe
  2⤵
  PID:13016
- C:\Windows\System\sIpCokz.exe
  C:\Windows\System\sIpCokz.exe
  2⤵
  PID:1044
- C:\Windows\System\TiMSmUn.exe
  C:\Windows\System\TiMSmUn.exe
  2⤵
  PID:11400
- C:\Windows\System\VrOYaby.exe
  C:\Windows\System\VrOYaby.exe
  2⤵
  PID:10224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5wbwhb2b.czo.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ASMHFNl.exe

Filesize
1.9MB

MD5
bee065dbeec596ee22717739b14f1ca9

SHA1
92605f9e40612eabe7dc513c88c5441a6c2bd08b

SHA256
8687c62b54197dd84881f3f57dce4e62a8fdb3a11dcb3df88da0ef5ec41047e4

SHA512
42b5a2e24361325a6254d1debe66e6503e886b1c9e952a026c810860943be609d90794426f78916c28843c875c9ddcb6ed2f69c8e1f333a39e0013cb4ed35fbf

Download Submit
C:\Windows\System\AbIcCzJ.exe

Filesize
1.9MB

MD5
76c47cb38aed4a1439eb29f933f549a9

SHA1
8a85bf5d39eeac43d4a40f73ac51ea47aaa90d04

SHA256
4f0f618c41cf72b0284e0dd79be20226b7d7dec1bc163a88383c6ede4db969e7

SHA512
90b6463ae50ab6b4cbc6e986563e938459e28cb469f16dbaf165f34b54ca141c6c7a62e1ed0f0610e94caf6580ba7f1451ea71b584532e6c91ac180b9fa81139

Download Submit
C:\Windows\System\AeyJXct.exe

Filesize
1.9MB

MD5
8725a5d4a5a31545df5b40fd92ffd212

SHA1
57cb783981a4d620f2e9982bb372c0c94414e085

SHA256
97098ccd592e5b06f21a61a5a8fe3974f163722e098dbcbd5504520d9c793b6b

SHA512
b91aa4bc56314c5271ac0074b75fff3621a44ec1ceb29d1845c93ece3e78de5832091abfe25a802e99710ec9e9134adfa4f5c8f2ff7317384ebb84e144601daa

Download Submit
C:\Windows\System\Bcswtcs.exe

Filesize
1.9MB

MD5
3fe17a0af8d0a09a07eb52c9cf04cc0e

SHA1
960505cafd2a0e85820fa75f04a919d24473e725

SHA256
bb959904593e2c64f01a4b9d2774802726148a69f88043a07b19cd2ae2425e80

SHA512
3922f1953aacbbe2616ee9ddb1df4a5ebd43c47cc1bc105d5758005c110ba59dcd28dedb2ff39becd1f118058f709feb0171891a8c0e66057d97c4e97a30ea37

Download Submit
C:\Windows\System\EISxKiW.exe

Filesize
1.9MB

MD5
ba9ce669b0a314c15970f6d6871b9f62

SHA1
a3341bc687150d5a88483931152f191cead4fc94

SHA256
818ec5e7d2c1db534a41845464925db6a0e7c14d26bb761da3a338a9e70eedaf

SHA512
fbbfb7325c551374570ffa4cb6b383e00bd88adf00096b6dcd7f26bcbd15701b94fa625612f5b6f35839b00adfa7cdf70dac3e0e6d5e249e4512bd88bf56b16e

Download Submit
C:\Windows\System\FJBeKXx.exe

Filesize
1.9MB

MD5
ae03ca14061178e5c52cab1f26148d23

SHA1
fc4b926aea8aaf3755507269249a41b00442ee41

SHA256
7082e08031f142828feb5caedfa7088b62802d2197f940fb1296a3121d87cde7

SHA512
cdde89b2687be5f46ab1d2304697fd2a4cb50c7b33fa8040bb69dd1d8ed85f46a2074346dda134ee2e0fa9886b2dbb343cee93f4fce3d9d4e59afd8dffaa2a11

Download Submit
C:\Windows\System\FdWxtdE.exe

Filesize
1.9MB

MD5
500df285ba1cafb0eb61ec84529f177d

SHA1
60bb5ef4fb436782044a04093e9a2e115373c435

SHA256
c4ae7b04b3882a6020ab3702ddd2f5b052a41f5a325498c5b3bc2f4202b0460c

SHA512
a755a3765198da5f03d704bcfd199a7712e64b9ce119465b549ecfbf8387195ebcc2faaa23d1f226654fb5903c0c8c9f4ff9dead3d888c6bdf548e4077634072

Download Submit
C:\Windows\System\JewwWLM.exe

Filesize
1.9MB

MD5
79a4c5623c65ebc1cd86108bf87b6f67

SHA1
25a8ebc8cc5456780553f6caaa9b8d26d7b4af9a

SHA256
88cf169bd747212c8ebf721c79a7f26ea53cc807472a951433cb579f1fec8fee

SHA512
f9af1b31d7fe35cdc7ecc57b91ddc237ee5a25b96e7a86eabc3a4bd3f0a10901165b0f4b5dbe6740a74e74184992a2c87e55c35b6e4831372e801185025a1f43

Download Submit
C:\Windows\System\KhiVDrg.exe

Filesize
1.9MB

MD5
bd0cccf0cd0ac323dc9abdc316fdb107

SHA1
50a9cab4fff73b80c16a97a03e1a912940a8a9c8

SHA256
5a8fced6ca52ec8c5a47b942e11bede0fafece8922af5e3ab255cf53b671665c

SHA512
48e1b2da91a69b415ad8b6cc0e7e3629e82ff9a54ee84836f8ec536ef2ae86d5fbbac402e1b415c0e2fa3ee2f76dd0750435f28971ba3370343233cef901c760

Download Submit
C:\Windows\System\KqneZEb.exe

Filesize
1.9MB

MD5
e84a975b582a1fc9d9b257a905d4e553

SHA1
d8d1923b0349a127a38920f59cda5549328de72e

SHA256
83d2a0ae1b224f994f70a0e9b365a8ea2092a56ec32f116cd7490449dfdee880

SHA512
34a24b4d758c933ee02349b6e6fbe5f529f71b6b0474f0b84e8a53176471954bcbc99d06857e84971acface21d8b2f15f23e1ab3873e0d4487554319b5965fe6

Download Submit
C:\Windows\System\OTPgcod.exe

Filesize
1.9MB

MD5
c56e65d7704ee52ec308ce8a596e8d3c

SHA1
a5b851eaba39a3de2818b8bd79ad71a8b973533c

SHA256
ca1f8dc353caef14ddbc069b567b787438d3ab1620906b1e9a88489214684eab

SHA512
d237d5a73a4ba8c21f9f59cd6d465c42354c427310fc167bdfa5efe3678d3703351515f08e479c47c7aacb6941bbcb513f66c1416e7e5b7b34c44ad6201e7be4

Download Submit
C:\Windows\System\ObggAVw.exe

Filesize
1.9MB

MD5
7574498ea208ef0b91d00bf838df4038

SHA1
e4fdce06cdd9d89d77b289640a4aa2180ad692d9

SHA256
dab5356633d45d3985fd47ea134a7af8493fedceb6eb70353144fdb5bb0f3e11

SHA512
7079fb89a5a0a00e07dafb49a82a89666a9621aa872b96ed4b8c9596c5a95b093fff9219e8da08d2f61d6d837949b78064351f9dbffe62b04db5f3efe8ff67ba

Download Submit
C:\Windows\System\OkXCZHJ.exe

Filesize
1.9MB

MD5
448a416dd4fe84af305524e4100091e3

SHA1
da48aa9a3f347a44f3eabaa5ea7a38cfec5f85ae

SHA256
94b2988d0544b53ad341f8c4cbae31b21c48c84560ce9e21a909084fa88ae77b

SHA512
4310b18beba2f2d0cd73e8060d6b9fa584bfd8318e4b0cf7e3566da61db1bfcd4cd64dd0d94d016266c07f6e228d1f01a808bf03e412d15a6d8ea977b5d1afa9

Download Submit
C:\Windows\System\SXeZEdX.exe

Filesize
1.9MB

MD5
6a74276ba750fbc8f7756fd8348ed8ff

SHA1
28502791d9a1bbb794fc48c6c11d0a1d5681669c

SHA256
2abd6f756845a301a5e7cfe1c762e46e0e77e4e028cadadfcfa02cec8afd805a

SHA512
bf0e4d99a8c1717869f115468d3b5d1837fc09fe9b311f8326a9145577c37aa1723c23b080a661c948dc9fc10a5939ffa54551475a9b7a7006226b041d9cb7f0

Download Submit
C:\Windows\System\UUxjNeb.exe

Filesize
1.9MB

MD5
a7066d388e01fd362c35fb6f4bad5d87

SHA1
51c9b74d1210fcaf6470c6fc465b80fc55de2c92

SHA256
3e18786232ce672daffaf5bc5fbe6b5904d1e029885f469a69bc73291312e5f7

SHA512
66bc99e1af6ffefc65ca0aef928ad0de941c3336f8943556fe8782395b1f9d049ed66a83a52ed2358eae034dcfd9b25264af28b73e0e661e90dccc39f4942dbd

Download Submit
C:\Windows\System\UcZViZF.exe

Filesize
1.9MB

MD5
90637b5915db0bdb37c29ea8148677cb

SHA1
3555fa31b330fdc27f904abe4762d9e576b478aa

SHA256
febec1a6bffa3fec7c590a4c9b6c057ac5400086529628d4cfdfe864627d3767

SHA512
f8355e47aec06bd7acc9bb25b912e77b7398a39cceefdb3c081a1f7b61b2ba2d9dc0ca50fb83a336711a6e920551deca7451e80fb25bef3a3871db293ad26659

Download Submit
C:\Windows\System\VnYgwgx.exe

Filesize
1.9MB

MD5
52274c3bd9bd6cf20028dc8f1838b916

SHA1
c90a49abc1e990dfa16e5ba8c8f310847ea27aaf

SHA256
63b0c54e694fb8a518c6f060146398b6cabcb447c15a7cb642bf871ff81ef763

SHA512
833835047413cedf0445b49b5547e8757f24d177a18cc280183e90a7beadb8182d00fc338d5bbb1f0faec11a3e09aa2359892ce208e673635f9cb852396445c0

Download Submit
C:\Windows\System\WXgvAKM.exe

Filesize
1.9MB

MD5
9c1620508cfb77f71bb1cbdfc43fcf86

SHA1
2ff77fc1ffccb7703c858cfde6436e4b5cbe7a99

SHA256
35aa550f2a695ad41284716b9872122fd249e416f30146a6fdb7dba6903e7f87

SHA512
55cb27d002df448e5a756ebca6f30d7c8d7a5ec3313fbd8419cbddcfc3255d0363a920849c2745793d4a5a3b892094d2fe4ec7ea5f0df31d1511b3846e79888a

Download Submit
C:\Windows\System\XHqiWGP.exe

Filesize
1.9MB

MD5
2702ef7e8c7ba77d6d55bc95d1582594

SHA1
3bd14f382d5af515cbe51f7c35aa79e21b00e3ae

SHA256
75f26d3c11bb939ff4b86bf8879bf3b3c40568181809634023b9b4fca1e0f4e7

SHA512
7ecb0dc1f50f8ae7ad59a42ad66ddf40ea9ee8e0927cee37096c93c629dca2c1dffd1367359baa72a2c5a0d5353f1ea29fd61a4f3b0157bf972d2460481ded82

Download Submit
C:\Windows\System\YuwWJYw.exe

Filesize
1.9MB

MD5
3d6c1194d548868a562dcee96f031fe5

SHA1
a86e71f27ca59ea63ec57afb80d9d960a8af13a5

SHA256
b6a7493e19b52c8c0e9f77b46c886925825da0b0f292ff62ba345dec8d68ced6

SHA512
6f83a80a3bd32933ee418870604e0210a69c968625ff1b8eb485beb3b4883fb7d72da9a7eed32ed100ca392e1ba0737f23b13346b8d4985760beef7d378abdd5

Download Submit
C:\Windows\System\ZcRTLox.exe

Filesize
1.9MB

MD5
a316a9c30aeb77bd69004edb16017020

SHA1
4e246e0ff2a8c82d20830fd43a068b77cbcf90c8

SHA256
a999ef7aeece087312375c8d2338920fee263e69c491b356aaaf72b432d86e19

SHA512
bc9300409d553ea65bd9514acf7d7031261334d1611ece11f9df635151fe5d9675687d8026da99699d9ceb8410d8e6159db7a439b67be0a10debe2928babe4c9

Download Submit
C:\Windows\System\ZtuqYYB.exe

Filesize
1.9MB

MD5
130fe0b8f354a4981332e50a4f67eedf

SHA1
a493194408ae76d401f83b44d7abc5a2e2ebdd8e

SHA256
5fd3c87822e75cef38d905ec83175cfcbe5b7ac74a9421ac11fa2cdf93b3a8df

SHA512
547fa8557dd967c970fd353e30b17bc86650edb39911962eb948146596d4f22630481f57a58f07a0e1208b95eac39494e9ce2a043faec8b267eddb2533dffcb7

Download Submit
C:\Windows\System\aZgrfAG.exe

Filesize
1.9MB

MD5
221d5bdf7f2fe548cdedaaad167cbee3

SHA1
db4a67927590c670683bd98e33ba171d628c8afb

SHA256
d37622e96971aaca77db51f144324822ffb72b0143db767935f62bcce2e4ea07

SHA512
2bba282d8da75e8d61fc0146f36fbe99127e2f9272c66574bc2d765e10a90f76b72144aeb10831a9ab1908306e1cf30c8fffe41daf7f90330e71deada4455fd6

Download Submit
C:\Windows\System\aZuVWUf.exe

Filesize
1.9MB

MD5
b2eba3e0ebeba903440ee6619d707de0

SHA1
78cf34c15c096429b36baf5b3770cf13882bfc03

SHA256
b31e25d7f18bc031263a5cf5676cb7793f843f472a564180c05c5918f486e28d

SHA512
42f79dd3845ae6cc789f69353c21852a278fe11f64c5c3a40b1432b8bb21e86538629efaf34c9a48f9794f08faa5f7a147567640fb4b3dd43e0e610aa6a645ee

Download Submit
C:\Windows\System\aqDIVsl.exe

Filesize
1.9MB

MD5
15941aac0684c8fa54f2f19430557001

SHA1
2bcdd0a5d22d484e0631bea7b1a5238ca6b64348

SHA256
68b91b2ec7d6a37ee460029a3365e17ec9d378d0d75165476d1a352320491454

SHA512
d706ef39aa55ceca11ac33c78bc17f1a7358f8054deff1c40c66a480d747535a9b49aad24fd9de50b6d37254669b5495eec468f7024658818b6d3f23d70cc1a3

Download Submit
C:\Windows\System\bKANPiJ.exe

Filesize
1.9MB

MD5
acf47e39d1c898064b3f9bb7814dbc14

SHA1
8e08e8e0548fbd279b1d9976a1ac3eaf9fa7ab65

SHA256
7a2cf4c4d698146a0af08fc10bfb5c1d9abc185b19ab0ebe860951ae9cb498da

SHA512
bf77d624b7354e5a4da0ced4b52b58f432f65ad29282e8664bc3bf2194cfc4a7414a9fa2410030c381418327b45cb9edecbb4e9efb36cabaf6d5c3eafd419111

Download Submit
C:\Windows\System\ffzGQPL.exe

Filesize
1.9MB

MD5
63d1015805fedede66a24fe0e33ab88a

SHA1
fbacdaad01306ad1f33af319d45dc12ad18bcc70

SHA256
472f68c6eb185e63cc94e0ad9d63eef116760d8cfcd4fcebd1e6773712705c9d

SHA512
27bee14c6c123c24d0e30ad69114571da17641d9f36da4f8326c8ea633c4ad6cf1ac8f59fd128c392b40991d4c8e533ef57392c4fac9cbb48b8dea34a9839645

Download Submit
C:\Windows\System\fsmGsBp.exe

Filesize
1.9MB

MD5
349489fcc88a6acae88bfdf9a51b4e84

SHA1
5eb21565248c667c739f1dc62858eb640a19edd6

SHA256
e7e49a29665e16cc179eb9d99487d0e0cf43a67ae0b93f42d2430675b377485e

SHA512
b6e460d9dccd14edd00d1618bbd9381c42d746d3a5409cf5f616cbc5d477f9b37f8cc470d9b4cc066ed1df943ffbc6a9cb74a7e8c50bb68602923d1f6f712ef6

Download Submit
C:\Windows\System\gPDsurh.exe

Filesize
1.9MB

MD5
d365b10cbcac066a0ddc94765f79a85c

SHA1
da21e45d3b839f642ca643f64eb54c37b2f98a41

SHA256
642cbc99dfe4d8c07874f0b73d9c2a3aab3eb25a50dcc48f1fbbac8292bed49f

SHA512
037a89663bb8ab60ff3f33055603b1887446763a9bbe6746c12cd5bfd6cf5424653826df6e3f2d6bc37bf23e709b26ae6839ab42d67239643720cce19a412549

Download Submit
C:\Windows\System\iNPBnVC.exe

Filesize
1.9MB

MD5
845c9ed5ad48b02305876c0749f5321c

SHA1
76471a485f91b1870bab4a9f509ced39508b57a7

SHA256
d234a5604b01bfbacb434224ae02bd6a3b20732cfc622ce6cb0365f3120bbc12

SHA512
788300c3432099a42e5f0bc9af364840669ad7612b5d06f61406d7f7832f58bcc3097c1e5d6add77b73c97bc6c91669b099620fca3867bfe8e2111d8ec471125

Download Submit
C:\Windows\System\iWRcAps.exe

Filesize
1.9MB

MD5
ee47c9b961843cf6eac9a57e7e58fcdf

SHA1
9c33d4b889baa056e59b23184f6ee755e050e53d

SHA256
2e0160a07b616d0a63175417fc51a5c6badec9e3829c23e30e7601a7eaa1b4c5

SHA512
8d181faf8b8bae0e0bcfbb399533010f00ded22a6edf17afe80912a907a6baa32c83b665a9fba3679ea4de2136f9c9c402e538a84995e67a6531b39434e991f0

Download Submit
C:\Windows\System\iubqrTo.exe

Filesize
1.9MB

MD5
bba0ed927471ee2e8fd49d78c4854f2d

SHA1
b84aebc0db14f54ffa145cf6f5735d5858a9b4e6

SHA256
a567e695dae3dcbf2b3f77d155689450cb2796c3534757a1a7d6957c8acff34e

SHA512
1738bd51806987634b8502fb0785a53d2c0c90042eaa0b9731ff6520d692d6dd263a3dcd20f5aa7bed60b6924e9e1ad6f7eba64981d11f40f786ed0a05723fd9

Download Submit
C:\Windows\System\lCsPuGL.exe

Filesize
1.9MB

MD5
44349e71666b62a6465eeaa701a01663

SHA1
c502fcce4b68cbff2cb6000ccc475589cdc23ec7

SHA256
8633e74a31ce8b051335fba85349f0c1b643fc93264831767fb65f0c964d9401

SHA512
1108bfa24a91a46bea7fe6ceefe98649f434bb4ebe14aeb4f4ca4b4dbf5b0ee9bcf5eac6bedb9383fea6203676ce2c246f3689f4f8b5f69d4c03feb0f660759d

Download Submit
C:\Windows\System\pBpLkam.exe

Filesize
1.9MB

MD5
734cb993b2784437144ecbc13656aa6b

SHA1
12d46814fcf956627771b34dbd6828794736db3d

SHA256
06bc567117320383c64920e6a436493cb691dab889e155751f7572ca1a149985

SHA512
56c663ba0de31466f107eb69d54b2b0fe2ceb33bbd080845e60d24cdb69b65fdfd5a56c8bc6acd782b4d0a0610cafb3cac7caaab8af30b02a7f9cf32f1b20ea1

Download Submit
C:\Windows\System\pNZOpFL.exe

Filesize
1.9MB

MD5
899f15584b9193fb11bfc45b537af60e

SHA1
28d8bb2cc38ba4e94a279055918f544ea1a2e7a1

SHA256
bbe9658a8fc01c386deed33801633b9fb0726da14f331b5baf4e32f8b5fc7ab4

SHA512
7f01c76bf6abd2fdcf3e3f1e96f119342960d835c7f0559c3c54470d2b14585aabd4ba04c3546f5e037aaf504187b50db1d5358804246affaad30e246d68ddd3

Download Submit
C:\Windows\System\pdZtnAO.exe

Filesize
1.9MB

MD5
6a23d7efcf382b9dbef5d0a88796d16a

SHA1
9272a3568b2f7062f79dfa7319a5d7378b2fc5e2

SHA256
4a75b9de6c9dbcf3a1955b8472ac0fc85b436f4168767769558ad9b85f1ac4f2

SHA512
0188200961f3251ed0c3b519911ab299b481424d9a1476fac5b139baa66e1ffd4d7f149ef236f4c6dda249bf5fc8259facb43a56e1135c5ae2d6293a604d4fc6

Download Submit
C:\Windows\System\qXlIqKS.exe

Filesize
1.9MB

MD5
a88a666069caebe07f74287603b61eba

SHA1
495c4aa1582c7c644921df44d5d14b0616582345

SHA256
cd179296a7405727ad665123d3d13bdf277f586d331fbc93afce8270adff1ea0

SHA512
699c3064aa4face9a64cb478b01f21e92dc8dec69417b8fe66144d428c95e5c6f6997373bcdfb230d97c3c0d87a474671abef98e41cb4e55e3624aa6cb241bd0

Download Submit
C:\Windows\System\rxIcuOX.exe

Filesize
1.9MB

MD5
d2b398e6634d895fba8c7723d1b965e9

SHA1
6b6c7db70c60ab6cf8b454b8edc11bf668d836fe

SHA256
e6eeb4c0b0a8a87ea5a5e12540488e6de2cc093634246931fd0c79aa81b2a83f

SHA512
48784ed0baa2721a0f33e280c288afdb0a14e762f8d05c60957ceaa7a83d52b7f7b5ca04a9d0443ec5c890893ae78f23cd3ea19b461db2ae29c93d1a5066d8ff

Download Submit
C:\Windows\System\tYjJJTQ.exe

Filesize
1.9MB

MD5
191d1e71b5c55ed7726a19e3e45d54b4

SHA1
c09a591a3f04da0853aa69c9b6ebb05f796714d8

SHA256
6f5a598d053e9d5ec1fafde9e631a33914c889775f253261d4c44ea061e14871

SHA512
e923f192f7ef274d58d7d75ccdf8c4097e3060e17257d2de248bdcfe1bcc7781d4e8a0506aa6af2affb1abb767919db7c1770dda133dc3ee7a88faab82d1c1f8

Download Submit
C:\Windows\System\wClXfrW.exe

Filesize
1.9MB

MD5
ed842a8e010e46e6ad1163c841290003

SHA1
f1c9363544ea1f8e86978351f4bae4a207d79835

SHA256
578c42b0d12ca83454077c4151be08ff14b6621941f0b6426209ac7aa74cbb07

SHA512
c9f51f135d02b6263d7af55396cb4cdae9829f41ef84dd376baacbfb56a50102157c1c3e0d1172234dbdf14b9672f28aa7278f1506d590ef3781487e2ca253dd

Download Submit
C:\Windows\System\xeTSctM.exe

Filesize
1.9MB

MD5
42c9c5069dc6046b0bcf5d7e807702ff

SHA1
2a511b4c4f7281168b93e5affe91e353b079a705

SHA256
486bc105f1836deb43678b63c582343e9a057862f0d54411628b50dbca6484e8

SHA512
272158250bae184e6ccded48de12148580fdd9e06b4d67691a16e5a1c83a403362943c8d75d501f1119077567f7b27903c1463e25b7e1399aaf6c49cd3e85a13

Download Submit
C:\Windows\System\yBIVhlj.exe

Filesize
1.9MB

MD5
db47cd8276c78526a836b2a64a44c8bc

SHA1
c13d75f99d8accfbb45bd7447ae473b912491958

SHA256
3a0a1dd6e2b49826988ba2c21c74090270c712f8f5930cb97aef98e54c61af03

SHA512
a98ffa8bb1115b9e6bcc1a0fd03a8b83eaf40f3a2e724276ed07a6212b6e2c5ad0ff7b74f353073f4f71fc475b8b4d6458a02a479fce7241c675bbffedc5c3e6

Download Submit
memory/368-303-0x00007FF762CC0000-0x00007FF7630B2000-memory.dmp

Filesize
3.9MB

Download
memory/548-317-0x00007FF7E57D0000-0x00007FF7E5BC2000-memory.dmp

Filesize
3.9MB

Download
memory/1048-311-0x00007FF632400000-0x00007FF6327F2000-memory.dmp

Filesize
3.9MB

Download
memory/1184-314-0x00007FF7A6460000-0x00007FF7A6852000-memory.dmp

Filesize
3.9MB

Download
memory/1344-13-0x00007FF7B1390000-0x00007FF7B1782000-memory.dmp

Filesize
3.9MB

Download
memory/1360-315-0x00007FF71EBA0000-0x00007FF71EF92000-memory.dmp

Filesize
3.9MB

Download
memory/1392-310-0x00007FF786530000-0x00007FF786922000-memory.dmp

Filesize
3.9MB

Download
memory/1408-168-0x00007FF6554D0000-0x00007FF6558C2000-memory.dmp

Filesize
3.9MB

Download
memory/1512-120-0x00007FF713C00000-0x00007FF713FF2000-memory.dmp

Filesize
3.9MB

Download
memory/1664-316-0x00007FF68E1C0000-0x00007FF68E5B2000-memory.dmp

Filesize
3.9MB

Download
memory/2040-312-0x00007FF753090000-0x00007FF753482000-memory.dmp

Filesize
3.9MB

Download
memory/2416-197-0x00007FF6851D0000-0x00007FF6855C2000-memory.dmp

Filesize
3.9MB

Download
memory/3824-164-0x00007FF77EB20000-0x00007FF77EF12000-memory.dmp

Filesize
3.9MB

Download
memory/4396-275-0x00007FF70DAB0000-0x00007FF70DEA2000-memory.dmp

Filesize
3.9MB

Download
memory/4460-265-0x00007FF677B90000-0x00007FF677F82000-memory.dmp

Filesize
3.9MB

Download
memory/4464-286-0x00007FF7CBF20000-0x00007FF7CC312000-memory.dmp

Filesize
3.9MB

Download
memory/4596-308-0x00007FF74F9D0000-0x00007FF74FDC2000-memory.dmp

Filesize
3.9MB

Download
memory/4728-1-0x0000027710180000-0x0000027710190000-memory.dmp

Filesize
64KB

Download
memory/4728-0-0x00007FF6376F0000-0x00007FF637AE2000-memory.dmp

Filesize
3.9MB

Download
memory/4776-297-0x000001FB7D2A0000-0x000001FB7D2C2000-memory.dmp

Filesize
136KB

Download
memory/4776-83-0x000001FB7D2F0000-0x000001FB7D300000-memory.dmp

Filesize
64KB

Download
memory/4776-81-0x00007FFC020F0000-0x00007FFC02BB1000-memory.dmp

Filesize
10.8MB

Download
memory/4776-1543-0x000001FB80070000-0x000001FB80816000-memory.dmp

Filesize
7.6MB

Download
memory/4876-287-0x00007FF6EE360000-0x00007FF6EE752000-memory.dmp

Filesize
3.9MB

Download
memory/5000-313-0x00007FF658BF0000-0x00007FF658FE2000-memory.dmp

Filesize
3.9MB

Download
memory/5012-304-0x00007FF669DD0000-0x00007FF66A1C2000-memory.dmp

Filesize
3.9MB

Download
memory/5064-204-0x00007FF7E9300000-0x00007FF7E96F2000-memory.dmp

Filesize
3.9MB

Download