xmrig | d102885669437172b7e9020ef8dad1b1de2eeea9bc0fe9fd2425dfb0828f34b7

Analysis

max time kernel
69s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 19:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
Size

2.2MB
MD5

0382bc8cff270e1ad219837c17349dd4
SHA1

551d30a18d26d9d2c4aba446d992b3e4150830c0
SHA256

d102885669437172b7e9020ef8dad1b1de2eeea9bc0fe9fd2425dfb0828f34b7
SHA512

6f9d0fed5228f524e46495fd19716a053a5e123cbd2bea3bb242f3bd6fcdfd495e367d1eab094a147fcfc495f938d75b70f43d80e30ea7209dfdb657f15520b0
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aDg:NABP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 42 IoCs

miner

resource	yara_rule
behavioral2/memory/2916-154-0x00007FF7FD9F0000-0x00007FF7FDDE2000-memory.dmp	xmrig
behavioral2/memory/4372-153-0x00007FF72B270000-0x00007FF72B662000-memory.dmp	xmrig
behavioral2/memory/5052-147-0x00007FF6441E0000-0x00007FF6445D2000-memory.dmp	xmrig
behavioral2/memory/4520-141-0x00007FF687D90000-0x00007FF688182000-memory.dmp	xmrig
behavioral2/memory/1556-135-0x00007FF65B360000-0x00007FF65B752000-memory.dmp	xmrig
behavioral2/memory/4592-129-0x00007FF7B2DC0000-0x00007FF7B31B2000-memory.dmp	xmrig
behavioral2/memory/2316-128-0x00007FF63B200000-0x00007FF63B5F2000-memory.dmp	xmrig
behavioral2/memory/3368-124-0x00007FF6EF290000-0x00007FF6EF682000-memory.dmp	xmrig
behavioral2/memory/1576-118-0x00007FF6BF710000-0x00007FF6BFB02000-memory.dmp	xmrig
behavioral2/memory/2028-113-0x00007FF78FE70000-0x00007FF790262000-memory.dmp	xmrig
behavioral2/memory/1244-112-0x00007FF7D4640000-0x00007FF7D4A32000-memory.dmp	xmrig
behavioral2/memory/4896-108-0x00007FF714760000-0x00007FF714B52000-memory.dmp	xmrig
behavioral2/memory/2084-101-0x00007FF6BC1F0000-0x00007FF6BC5E2000-memory.dmp	xmrig
behavioral2/memory/3148-94-0x00007FF6764C0000-0x00007FF6768B2000-memory.dmp	xmrig
behavioral2/memory/4660-80-0x00007FF6CBD00000-0x00007FF6CC0F2000-memory.dmp	xmrig
behavioral2/memory/3316-79-0x00007FF7107A0000-0x00007FF710B92000-memory.dmp	xmrig
behavioral2/memory/2796-75-0x00007FF65D1D0000-0x00007FF65D5C2000-memory.dmp	xmrig
behavioral2/memory/3344-68-0x00007FF6CCC20000-0x00007FF6CD012000-memory.dmp	xmrig
behavioral2/memory/816-58-0x00007FF634F10000-0x00007FF635302000-memory.dmp	xmrig
behavioral2/memory/4364-2123-0x00007FF7D00C0000-0x00007FF7D04B2000-memory.dmp	xmrig
behavioral2/memory/1720-2124-0x00007FF7A0420000-0x00007FF7A0812000-memory.dmp	xmrig
behavioral2/memory/1720-2138-0x00007FF7A0420000-0x00007FF7A0812000-memory.dmp	xmrig
behavioral2/memory/4896-2140-0x00007FF714760000-0x00007FF714B52000-memory.dmp	xmrig
behavioral2/memory/816-2142-0x00007FF634F10000-0x00007FF635302000-memory.dmp	xmrig
behavioral2/memory/3344-2144-0x00007FF6CCC20000-0x00007FF6CD012000-memory.dmp	xmrig
behavioral2/memory/4364-2146-0x00007FF7D00C0000-0x00007FF7D04B2000-memory.dmp	xmrig
behavioral2/memory/4660-2148-0x00007FF6CBD00000-0x00007FF6CC0F2000-memory.dmp	xmrig
behavioral2/memory/3316-2150-0x00007FF7107A0000-0x00007FF710B92000-memory.dmp	xmrig
behavioral2/memory/2796-2152-0x00007FF65D1D0000-0x00007FF65D5C2000-memory.dmp	xmrig
behavioral2/memory/3148-2154-0x00007FF6764C0000-0x00007FF6768B2000-memory.dmp	xmrig
behavioral2/memory/2028-2158-0x00007FF78FE70000-0x00007FF790262000-memory.dmp	xmrig
behavioral2/memory/1244-2160-0x00007FF7D4640000-0x00007FF7D4A32000-memory.dmp	xmrig
behavioral2/memory/2084-2157-0x00007FF6BC1F0000-0x00007FF6BC5E2000-memory.dmp	xmrig
behavioral2/memory/4372-2172-0x00007FF72B270000-0x00007FF72B662000-memory.dmp	xmrig
behavioral2/memory/2316-2179-0x00007FF63B200000-0x00007FF63B5F2000-memory.dmp	xmrig
behavioral2/memory/2916-2180-0x00007FF7FD9F0000-0x00007FF7FDDE2000-memory.dmp	xmrig
behavioral2/memory/1576-2177-0x00007FF6BF710000-0x00007FF6BFB02000-memory.dmp	xmrig
behavioral2/memory/5052-2173-0x00007FF6441E0000-0x00007FF6445D2000-memory.dmp	xmrig
behavioral2/memory/4520-2167-0x00007FF687D90000-0x00007FF688182000-memory.dmp	xmrig
behavioral2/memory/3368-2163-0x00007FF6EF290000-0x00007FF6EF682000-memory.dmp	xmrig
behavioral2/memory/1556-2169-0x00007FF65B360000-0x00007FF65B752000-memory.dmp	xmrig
behavioral2/memory/4592-2165-0x00007FF7B2DC0000-0x00007FF7B31B2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1720	SFggNzh.exe
4896	VKoONAG.exe
4364	asmYBqO.exe
816	HDAiLtK.exe
3344	xLedjIY.exe
2796	pJJNNUh.exe
3316	UqneqVC.exe
4660	wRgBvMO.exe
1244	VNrwqTb.exe
3148	CbicTEi.exe
2028	oGqBwFq.exe
2084	qQdrrxN.exe
1576	IVTVdRM.exe
3368	rFKSxtb.exe
2316	NsACeTU.exe
4592	NJIIpET.exe
1556	ojLveOp.exe
4520	kNRFlNQ.exe
5052	XucHnge.exe
4372	wvDJpUe.exe
2916	fNvgOLR.exe
2748	zZMmWDh.exe
2276	szyEbPB.exe
3192	cCiKgOB.exe
2380	yQDQFSU.exe
4620	HwrWwEd.exe
452	AEhbEbx.exe
3652	eEfRkVj.exe
264	LFZCxOy.exe
3976	ndooDIr.exe
5104	JJmEWlY.exe
3988	PTLmzvG.exe
2240	IAPJwtu.exe
4644	nWhCMJO.exe
1960	BdFjcZL.exe
4544	OndrgIW.exe
5068	EDwZQho.exe
2692	bFDqiPC.exe
3104	DMjcYIK.exe
2760	KvPhfqd.exe
3420	vbCtTbW.exe
1536	JsMVsUa.exe
1924	qsoVZlU.exe
4960	MRfjTad.exe
4448	JJiXNSK.exe
3936	jFzHKWd.exe
4676	FsCOdGS.exe
4188	hqRQwJk.exe
4652	rahnjce.exe
4716	KUBMxij.exe
4768	BNTGlSs.exe
4536	tdrStLY.exe
1452	VPMwerO.exe
4664	iKFjwmT.exe
4108	qyDiVGJ.exe
4320	IHOoiHD.exe
1468	ZeyvpkB.exe
2740	AbraeNo.exe
1356	UMwqbMI.exe
1616	GDYPZIF.exe
4420	mxJveLQ.exe
3712	KSxBztM.exe
2596	zRScWji.exe
1072	PkzaGHg.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1496-0-0x00007FF720490000-0x00007FF720882000-memory.dmp	upx
behavioral2/files/0x000a000000023b96-14.dat	upx
behavioral2/files/0x000b000000023b91-11.dat	upx
behavioral2/files/0x000a000000023b97-18.dat	upx
behavioral2/files/0x000a000000023b99-23.dat	upx
behavioral2/files/0x000a000000023b9b-34.dat	upx
behavioral2/files/0x000a000000023b9e-52.dat	upx
behavioral2/files/0x000a000000023b9d-61.dat	upx
behavioral2/files/0x000a000000023ba0-78.dat	upx
behavioral2/files/0x000a000000023ba1-98.dat	upx
behavioral2/files/0x000a000000023ba6-105.dat	upx
behavioral2/files/0x000b000000023ba5-121.dat	upx
behavioral2/files/0x000a000000023ba8-148.dat	upx
behavioral2/files/0x000a000000023baf-177.dat	upx
behavioral2/files/0x000a000000023bb2-192.dat	upx
behavioral2/files/0x000a000000023bb3-197.dat	upx
behavioral2/files/0x000a000000023bb1-195.dat	upx
behavioral2/files/0x000a000000023bb0-190.dat	upx
behavioral2/files/0x000a000000023bae-180.dat	upx
behavioral2/files/0x000a000000023bad-175.dat	upx
behavioral2/files/0x000a000000023bac-170.dat	upx
behavioral2/files/0x000a000000023bab-165.dat	upx
behavioral2/files/0x000a000000023baa-160.dat	upx
behavioral2/files/0x000a000000023ba9-155.dat	upx
behavioral2/memory/2916-154-0x00007FF7FD9F0000-0x00007FF7FDDE2000-memory.dmp	upx
behavioral2/memory/4372-153-0x00007FF72B270000-0x00007FF72B662000-memory.dmp	upx
behavioral2/memory/5052-147-0x00007FF6441E0000-0x00007FF6445D2000-memory.dmp	upx
behavioral2/files/0x000b000000023ba4-142.dat	upx
behavioral2/memory/4520-141-0x00007FF687D90000-0x00007FF688182000-memory.dmp	upx
behavioral2/files/0x000a000000023ba7-136.dat	upx
behavioral2/memory/1556-135-0x00007FF65B360000-0x00007FF65B752000-memory.dmp	upx
behavioral2/memory/4592-129-0x00007FF7B2DC0000-0x00007FF7B31B2000-memory.dmp	upx
behavioral2/memory/2316-128-0x00007FF63B200000-0x00007FF63B5F2000-memory.dmp	upx
behavioral2/memory/3368-124-0x00007FF6EF290000-0x00007FF6EF682000-memory.dmp	upx
behavioral2/files/0x000b000000023b92-119.dat	upx
behavioral2/memory/1576-118-0x00007FF6BF710000-0x00007FF6BFB02000-memory.dmp	upx
behavioral2/memory/2028-113-0x00007FF78FE70000-0x00007FF790262000-memory.dmp	upx
behavioral2/memory/1244-112-0x00007FF7D4640000-0x00007FF7D4A32000-memory.dmp	upx
behavioral2/files/0x000a000000023ba3-109.dat	upx
behavioral2/memory/4896-108-0x00007FF714760000-0x00007FF714B52000-memory.dmp	upx
behavioral2/files/0x000a000000023ba2-102.dat	upx
behavioral2/memory/2084-101-0x00007FF6BC1F0000-0x00007FF6BC5E2000-memory.dmp	upx
behavioral2/memory/3148-94-0x00007FF6764C0000-0x00007FF6768B2000-memory.dmp	upx
behavioral2/memory/4660-80-0x00007FF6CBD00000-0x00007FF6CC0F2000-memory.dmp	upx
behavioral2/memory/3316-79-0x00007FF7107A0000-0x00007FF710B92000-memory.dmp	upx
behavioral2/memory/2796-75-0x00007FF65D1D0000-0x00007FF65D5C2000-memory.dmp	upx
behavioral2/files/0x000a000000023b9c-69.dat	upx
behavioral2/memory/3344-68-0x00007FF6CCC20000-0x00007FF6CD012000-memory.dmp	upx
behavioral2/files/0x000a000000023b9f-62.dat	upx
behavioral2/memory/816-58-0x00007FF634F10000-0x00007FF635302000-memory.dmp	upx
behavioral2/memory/4364-50-0x00007FF7D00C0000-0x00007FF7D04B2000-memory.dmp	upx
behavioral2/files/0x000a000000023b9a-55.dat	upx
behavioral2/files/0x000a000000023b98-39.dat	upx
behavioral2/files/0x000a000000023b95-31.dat	upx
behavioral2/memory/1720-10-0x00007FF7A0420000-0x00007FF7A0812000-memory.dmp	upx
behavioral2/memory/4364-2123-0x00007FF7D00C0000-0x00007FF7D04B2000-memory.dmp	upx
behavioral2/memory/1720-2124-0x00007FF7A0420000-0x00007FF7A0812000-memory.dmp	upx
behavioral2/memory/1720-2138-0x00007FF7A0420000-0x00007FF7A0812000-memory.dmp	upx
behavioral2/memory/4896-2140-0x00007FF714760000-0x00007FF714B52000-memory.dmp	upx
behavioral2/memory/816-2142-0x00007FF634F10000-0x00007FF635302000-memory.dmp	upx
behavioral2/memory/3344-2144-0x00007FF6CCC20000-0x00007FF6CD012000-memory.dmp	upx
behavioral2/memory/4364-2146-0x00007FF7D00C0000-0x00007FF7D04B2000-memory.dmp	upx
behavioral2/memory/4660-2148-0x00007FF6CBD00000-0x00007FF6CC0F2000-memory.dmp	upx
behavioral2/memory/3316-2150-0x00007FF7107A0000-0x00007FF710B92000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\FyFtcCk.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\SjXDTvN.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\VPMwerO.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\CmiyhMc.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\aVsvOsQ.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\hJveETE.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\cJLRgvO.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\szyEbPB.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\SgqwdFi.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\hNwEjPa.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\CEskTAO.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\ICyzFrR.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\lSyVrHa.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\IJpPfUi.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\hRUeEdi.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\NHsWvMD.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\aAmfoeV.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\hJAGpAn.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\hqRQwJk.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\VZJTpEh.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\gSPLRaC.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\fnSXlJx.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\miQDIxF.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\ynvUmId.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\nTgugfn.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\blxtGsk.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\oBgvosq.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\VtrwNQY.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\exTyqbQ.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\VvGIQio.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\oAJjYVz.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\PXZHuaz.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\paDCDQx.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\juZGpFP.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\KWIubpb.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\pKkBOHi.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\YGDEQpj.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\PkzaGHg.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\MRnzAOV.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\QCUpYel.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\fvChtOB.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\IRzuskf.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\ZiObbqR.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\lgWCXkE.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\rinTmgI.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\GvQDkCg.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\wuXqmDf.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\zeQmQxA.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\fcZbhTU.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\sHObvKY.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\GBXEApz.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\gXTRhjU.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\wgePQxN.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\MksKytV.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\mbhtKYp.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\CcQReUU.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\QrUDFLo.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\JruQpUK.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\gvWtVxC.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\wEcsMUM.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\Bqigqwo.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\fYnrUGh.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\QOduvIf.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\wXqIOAn.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3840	powershell.exe
3840	powershell.exe
3840	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
Token: SeDebugPrivilege	3840	powershell.exe
Token: SeLockMemoryPrivilege	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 3840	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	84
PID 1496 wrote to memory of 3840	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	84
PID 1496 wrote to memory of 1720	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	85
PID 1496 wrote to memory of 1720	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	85
PID 1496 wrote to memory of 4364	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	86
PID 1496 wrote to memory of 4364	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	86
PID 1496 wrote to memory of 4896	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	87
PID 1496 wrote to memory of 4896	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	87
PID 1496 wrote to memory of 816	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	88
PID 1496 wrote to memory of 816	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	88
PID 1496 wrote to memory of 3344	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	89
PID 1496 wrote to memory of 3344	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	89
PID 1496 wrote to memory of 2796	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	90
PID 1496 wrote to memory of 2796	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	90
PID 1496 wrote to memory of 3316	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	91
PID 1496 wrote to memory of 3316	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	91
PID 1496 wrote to memory of 4660	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	92
PID 1496 wrote to memory of 4660	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	92
PID 1496 wrote to memory of 1244	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	93
PID 1496 wrote to memory of 1244	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	93
PID 1496 wrote to memory of 3148	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	94
PID 1496 wrote to memory of 3148	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	94
PID 1496 wrote to memory of 2028	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	95
PID 1496 wrote to memory of 2028	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	95
PID 1496 wrote to memory of 2084	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	96
PID 1496 wrote to memory of 2084	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	96
PID 1496 wrote to memory of 3368	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	97
PID 1496 wrote to memory of 3368	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	97
PID 1496 wrote to memory of 1576	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	98
PID 1496 wrote to memory of 1576	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	98
PID 1496 wrote to memory of 2316	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	99
PID 1496 wrote to memory of 2316	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	99
PID 1496 wrote to memory of 4592	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	100
PID 1496 wrote to memory of 4592	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	100
PID 1496 wrote to memory of 1556	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	101
PID 1496 wrote to memory of 1556	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	101
PID 1496 wrote to memory of 4520	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	102
PID 1496 wrote to memory of 4520	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	102
PID 1496 wrote to memory of 5052	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	103
PID 1496 wrote to memory of 5052	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	103
PID 1496 wrote to memory of 4372	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	104
PID 1496 wrote to memory of 4372	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	104
PID 1496 wrote to memory of 2916	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	105
PID 1496 wrote to memory of 2916	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	105
PID 1496 wrote to memory of 2748	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	106
PID 1496 wrote to memory of 2748	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	106
PID 1496 wrote to memory of 2276	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	107
PID 1496 wrote to memory of 2276	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	107
PID 1496 wrote to memory of 3192	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	108
PID 1496 wrote to memory of 3192	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	108
PID 1496 wrote to memory of 2380	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	109
PID 1496 wrote to memory of 2380	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	109
PID 1496 wrote to memory of 4620	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	110
PID 1496 wrote to memory of 4620	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	110
PID 1496 wrote to memory of 452	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	111
PID 1496 wrote to memory of 452	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	111
PID 1496 wrote to memory of 3652	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	112
PID 1496 wrote to memory of 3652	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	112
PID 1496 wrote to memory of 264	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	113
PID 1496 wrote to memory of 264	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	113
PID 1496 wrote to memory of 3976	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	114
PID 1496 wrote to memory of 3976	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	114
PID 1496 wrote to memory of 5104	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	115
PID 1496 wrote to memory of 5104	1496	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3840
- C:\Windows\System\SFggNzh.exe
  C:\Windows\System\SFggNzh.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\asmYBqO.exe
  C:\Windows\System\asmYBqO.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\VKoONAG.exe
  C:\Windows\System\VKoONAG.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\HDAiLtK.exe
  C:\Windows\System\HDAiLtK.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\xLedjIY.exe
  C:\Windows\System\xLedjIY.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System\pJJNNUh.exe
  C:\Windows\System\pJJNNUh.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\UqneqVC.exe
  C:\Windows\System\UqneqVC.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System\wRgBvMO.exe
  C:\Windows\System\wRgBvMO.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\VNrwqTb.exe
  C:\Windows\System\VNrwqTb.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\CbicTEi.exe
  C:\Windows\System\CbicTEi.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\oGqBwFq.exe
  C:\Windows\System\oGqBwFq.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\qQdrrxN.exe
  C:\Windows\System\qQdrrxN.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\rFKSxtb.exe
  C:\Windows\System\rFKSxtb.exe
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Windows\System\IVTVdRM.exe
  C:\Windows\System\IVTVdRM.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\NsACeTU.exe
  C:\Windows\System\NsACeTU.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\NJIIpET.exe
  C:\Windows\System\NJIIpET.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\ojLveOp.exe
  C:\Windows\System\ojLveOp.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\kNRFlNQ.exe
  C:\Windows\System\kNRFlNQ.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\XucHnge.exe
  C:\Windows\System\XucHnge.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\wvDJpUe.exe
  C:\Windows\System\wvDJpUe.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\fNvgOLR.exe
  C:\Windows\System\fNvgOLR.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\zZMmWDh.exe
  C:\Windows\System\zZMmWDh.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\szyEbPB.exe
  C:\Windows\System\szyEbPB.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\cCiKgOB.exe
  C:\Windows\System\cCiKgOB.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\yQDQFSU.exe
  C:\Windows\System\yQDQFSU.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\HwrWwEd.exe
  C:\Windows\System\HwrWwEd.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\AEhbEbx.exe
  C:\Windows\System\AEhbEbx.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\eEfRkVj.exe
  C:\Windows\System\eEfRkVj.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\LFZCxOy.exe
  C:\Windows\System\LFZCxOy.exe
  2⤵
  - Executes dropped EXE
  PID:264
- C:\Windows\System\ndooDIr.exe
  C:\Windows\System\ndooDIr.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\JJmEWlY.exe
  C:\Windows\System\JJmEWlY.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\PTLmzvG.exe
  C:\Windows\System\PTLmzvG.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\IAPJwtu.exe
  C:\Windows\System\IAPJwtu.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\nWhCMJO.exe
  C:\Windows\System\nWhCMJO.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\BdFjcZL.exe
  C:\Windows\System\BdFjcZL.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\OndrgIW.exe
  C:\Windows\System\OndrgIW.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\EDwZQho.exe
  C:\Windows\System\EDwZQho.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\bFDqiPC.exe
  C:\Windows\System\bFDqiPC.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\DMjcYIK.exe
  C:\Windows\System\DMjcYIK.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\KvPhfqd.exe
  C:\Windows\System\KvPhfqd.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\vbCtTbW.exe
  C:\Windows\System\vbCtTbW.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\JsMVsUa.exe
  C:\Windows\System\JsMVsUa.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\qsoVZlU.exe
  C:\Windows\System\qsoVZlU.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\MRfjTad.exe
  C:\Windows\System\MRfjTad.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\JJiXNSK.exe
  C:\Windows\System\JJiXNSK.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\jFzHKWd.exe
  C:\Windows\System\jFzHKWd.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System\FsCOdGS.exe
  C:\Windows\System\FsCOdGS.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\hqRQwJk.exe
  C:\Windows\System\hqRQwJk.exe
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Windows\System\rahnjce.exe
  C:\Windows\System\rahnjce.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\KUBMxij.exe
  C:\Windows\System\KUBMxij.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\BNTGlSs.exe
  C:\Windows\System\BNTGlSs.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\tdrStLY.exe
  C:\Windows\System\tdrStLY.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\VPMwerO.exe
  C:\Windows\System\VPMwerO.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\iKFjwmT.exe
  C:\Windows\System\iKFjwmT.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\qyDiVGJ.exe
  C:\Windows\System\qyDiVGJ.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\IHOoiHD.exe
  C:\Windows\System\IHOoiHD.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\ZeyvpkB.exe
  C:\Windows\System\ZeyvpkB.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\AbraeNo.exe
  C:\Windows\System\AbraeNo.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\UMwqbMI.exe
  C:\Windows\System\UMwqbMI.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\GDYPZIF.exe
  C:\Windows\System\GDYPZIF.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\mxJveLQ.exe
  C:\Windows\System\mxJveLQ.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\KSxBztM.exe
  C:\Windows\System\KSxBztM.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\zRScWji.exe
  C:\Windows\System\zRScWji.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\PkzaGHg.exe
  C:\Windows\System\PkzaGHg.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\BNpaoYx.exe
  C:\Windows\System\BNpaoYx.exe
  2⤵
  PID:3416
- C:\Windows\System\MVTfrqN.exe
  C:\Windows\System\MVTfrqN.exe
  2⤵
  PID:3288
- C:\Windows\System\tQNDvVv.exe
  C:\Windows\System\tQNDvVv.exe
  2⤵
  PID:1580
- C:\Windows\System\clgPSsN.exe
  C:\Windows\System\clgPSsN.exe
  2⤵
  PID:756
- C:\Windows\System\SJwXlfz.exe
  C:\Windows\System\SJwXlfz.exe
  2⤵
  PID:5144
- C:\Windows\System\MrsPbLy.exe
  C:\Windows\System\MrsPbLy.exe
  2⤵
  PID:5172
- C:\Windows\System\QXsMGWF.exe
  C:\Windows\System\QXsMGWF.exe
  2⤵
  PID:5200
- C:\Windows\System\yDcDiVd.exe
  C:\Windows\System\yDcDiVd.exe
  2⤵
  PID:5228
- C:\Windows\System\VZJTpEh.exe
  C:\Windows\System\VZJTpEh.exe
  2⤵
  PID:5256
- C:\Windows\System\OlaOCrr.exe
  C:\Windows\System\OlaOCrr.exe
  2⤵
  PID:5284
- C:\Windows\System\XMESxqO.exe
  C:\Windows\System\XMESxqO.exe
  2⤵
  PID:5312
- C:\Windows\System\ZjTqNXw.exe
  C:\Windows\System\ZjTqNXw.exe
  2⤵
  PID:5340
- C:\Windows\System\SKYOJjc.exe
  C:\Windows\System\SKYOJjc.exe
  2⤵
  PID:5368
- C:\Windows\System\PHyZXQK.exe
  C:\Windows\System\PHyZXQK.exe
  2⤵
  PID:5400
- C:\Windows\System\rgwgBTh.exe
  C:\Windows\System\rgwgBTh.exe
  2⤵
  PID:5424
- C:\Windows\System\zRpnFye.exe
  C:\Windows\System\zRpnFye.exe
  2⤵
  PID:5452
- C:\Windows\System\oJwFJQR.exe
  C:\Windows\System\oJwFJQR.exe
  2⤵
  PID:5480
- C:\Windows\System\fojzfAg.exe
  C:\Windows\System\fojzfAg.exe
  2⤵
  PID:5508
- C:\Windows\System\pzEaZQH.exe
  C:\Windows\System\pzEaZQH.exe
  2⤵
  PID:5536
- C:\Windows\System\fSUlLhH.exe
  C:\Windows\System\fSUlLhH.exe
  2⤵
  PID:5568
- C:\Windows\System\kvdgQGM.exe
  C:\Windows\System\kvdgQGM.exe
  2⤵
  PID:5592
- C:\Windows\System\nKvWwny.exe
  C:\Windows\System\nKvWwny.exe
  2⤵
  PID:5620
- C:\Windows\System\dLUpNqy.exe
  C:\Windows\System\dLUpNqy.exe
  2⤵
  PID:5648
- C:\Windows\System\DBZUhWt.exe
  C:\Windows\System\DBZUhWt.exe
  2⤵
  PID:5700
- C:\Windows\System\zMymvdU.exe
  C:\Windows\System\zMymvdU.exe
  2⤵
  PID:5728
- C:\Windows\System\EsBARUT.exe
  C:\Windows\System\EsBARUT.exe
  2⤵
  PID:5744
- C:\Windows\System\EAsoApX.exe
  C:\Windows\System\EAsoApX.exe
  2⤵
  PID:5772
- C:\Windows\System\SGNWHRT.exe
  C:\Windows\System\SGNWHRT.exe
  2⤵
  PID:5796
- C:\Windows\System\qvbRicL.exe
  C:\Windows\System\qvbRicL.exe
  2⤵
  PID:5824
- C:\Windows\System\nfPVyxy.exe
  C:\Windows\System\nfPVyxy.exe
  2⤵
  PID:5852
- C:\Windows\System\lbVseKs.exe
  C:\Windows\System\lbVseKs.exe
  2⤵
  PID:5872
- C:\Windows\System\mnswEkY.exe
  C:\Windows\System\mnswEkY.exe
  2⤵
  PID:5900
- C:\Windows\System\CPRazzg.exe
  C:\Windows\System\CPRazzg.exe
  2⤵
  PID:5928
- C:\Windows\System\pQZaKWM.exe
  C:\Windows\System\pQZaKWM.exe
  2⤵
  PID:5956
- C:\Windows\System\NHsWvMD.exe
  C:\Windows\System\NHsWvMD.exe
  2⤵
  PID:5984
- C:\Windows\System\lwWoPPz.exe
  C:\Windows\System\lwWoPPz.exe
  2⤵
  PID:6012
- C:\Windows\System\CmiyhMc.exe
  C:\Windows\System\CmiyhMc.exe
  2⤵
  PID:6040
- C:\Windows\System\AjXNYDR.exe
  C:\Windows\System\AjXNYDR.exe
  2⤵
  PID:6068
- C:\Windows\System\QSzUeza.exe
  C:\Windows\System\QSzUeza.exe
  2⤵
  PID:6096
- C:\Windows\System\zuVYAgS.exe
  C:\Windows\System\zuVYAgS.exe
  2⤵
  PID:6124
- C:\Windows\System\cVPrlHB.exe
  C:\Windows\System\cVPrlHB.exe
  2⤵
  PID:4336
- C:\Windows\System\PIBupKk.exe
  C:\Windows\System\PIBupKk.exe
  2⤵
  PID:4600
- C:\Windows\System\SgqwdFi.exe
  C:\Windows\System\SgqwdFi.exe
  2⤵
  PID:2840
- C:\Windows\System\MlUMqbR.exe
  C:\Windows\System\MlUMqbR.exe
  2⤵
  PID:4880
- C:\Windows\System\PiOvJia.exe
  C:\Windows\System\PiOvJia.exe
  2⤵
  PID:2520
- C:\Windows\System\PtNdtXE.exe
  C:\Windows\System\PtNdtXE.exe
  2⤵
  PID:5160
- C:\Windows\System\vAmwYSY.exe
  C:\Windows\System\vAmwYSY.exe
  2⤵
  PID:5220
- C:\Windows\System\OpSGzrd.exe
  C:\Windows\System\OpSGzrd.exe
  2⤵
  PID:5296
- C:\Windows\System\eTfxqnB.exe
  C:\Windows\System\eTfxqnB.exe
  2⤵
  PID:5356
- C:\Windows\System\BvVTQDS.exe
  C:\Windows\System\BvVTQDS.exe
  2⤵
  PID:5420
- C:\Windows\System\gDJuHvf.exe
  C:\Windows\System\gDJuHvf.exe
  2⤵
  PID:5492
- C:\Windows\System\fnyGHJj.exe
  C:\Windows\System\fnyGHJj.exe
  2⤵
  PID:5548
- C:\Windows\System\gDKjHZq.exe
  C:\Windows\System\gDKjHZq.exe
  2⤵
  PID:5612
- C:\Windows\System\xLxzqCO.exe
  C:\Windows\System\xLxzqCO.exe
  2⤵
  PID:5668
- C:\Windows\System\gMsUtMi.exe
  C:\Windows\System\gMsUtMi.exe
  2⤵
  PID:5756
- C:\Windows\System\OTTCkle.exe
  C:\Windows\System\OTTCkle.exe
  2⤵
  PID:5792
- C:\Windows\System\fYnrUGh.exe
  C:\Windows\System\fYnrUGh.exe
  2⤵
  PID:5864
- C:\Windows\System\rNZMeMM.exe
  C:\Windows\System\rNZMeMM.exe
  2⤵
  PID:5916
- C:\Windows\System\aOLqmyL.exe
  C:\Windows\System\aOLqmyL.exe
  2⤵
  PID:5976
- C:\Windows\System\DzSybPZ.exe
  C:\Windows\System\DzSybPZ.exe
  2⤵
  PID:6056
- C:\Windows\System\VblTQqQ.exe
  C:\Windows\System\VblTQqQ.exe
  2⤵
  PID:6112
- C:\Windows\System\LOPRYIz.exe
  C:\Windows\System\LOPRYIz.exe
  2⤵
  PID:4916
- C:\Windows\System\ynvUmId.exe
  C:\Windows\System\ynvUmId.exe
  2⤵
  PID:684
- C:\Windows\System\jnozCzQ.exe
  C:\Windows\System\jnozCzQ.exe
  2⤵
  PID:5192
- C:\Windows\System\yTAPuym.exe
  C:\Windows\System\yTAPuym.exe
  2⤵
  PID:5332
- C:\Windows\System\SkeMyAH.exe
  C:\Windows\System\SkeMyAH.exe
  2⤵
  PID:5468
- C:\Windows\System\EPrnvub.exe
  C:\Windows\System\EPrnvub.exe
  2⤵
  PID:4908
- C:\Windows\System\WKeUJfU.exe
  C:\Windows\System\WKeUJfU.exe
  2⤵
  PID:5736
- C:\Windows\System\KXXvsit.exe
  C:\Windows\System\KXXvsit.exe
  2⤵
  PID:5844
- C:\Windows\System\VYpyUzb.exe
  C:\Windows\System\VYpyUzb.exe
  2⤵
  PID:5968
- C:\Windows\System\CavXZwR.exe
  C:\Windows\System\CavXZwR.exe
  2⤵
  PID:2620
- C:\Windows\System\LjvXcRe.exe
  C:\Windows\System\LjvXcRe.exe
  2⤵
  PID:4416
- C:\Windows\System\fcZbhTU.exe
  C:\Windows\System\fcZbhTU.exe
  2⤵
  PID:6148
- C:\Windows\System\MksKytV.exe
  C:\Windows\System\MksKytV.exe
  2⤵
  PID:6176
- C:\Windows\System\VvGIQio.exe
  C:\Windows\System\VvGIQio.exe
  2⤵
  PID:6204
- C:\Windows\System\tQLsGyD.exe
  C:\Windows\System\tQLsGyD.exe
  2⤵
  PID:6232
- C:\Windows\System\wXqIOAn.exe
  C:\Windows\System\wXqIOAn.exe
  2⤵
  PID:6260
- C:\Windows\System\bVPFMzd.exe
  C:\Windows\System\bVPFMzd.exe
  2⤵
  PID:6288
- C:\Windows\System\UjOPYvV.exe
  C:\Windows\System\UjOPYvV.exe
  2⤵
  PID:6316
- C:\Windows\System\FKXUDTc.exe
  C:\Windows\System\FKXUDTc.exe
  2⤵
  PID:6344
- C:\Windows\System\hKvUAwd.exe
  C:\Windows\System\hKvUAwd.exe
  2⤵
  PID:6372
- C:\Windows\System\NsJEgiC.exe
  C:\Windows\System\NsJEgiC.exe
  2⤵
  PID:6400
- C:\Windows\System\MRnzAOV.exe
  C:\Windows\System\MRnzAOV.exe
  2⤵
  PID:6428
- C:\Windows\System\IcwJdoc.exe
  C:\Windows\System\IcwJdoc.exe
  2⤵
  PID:6456
- C:\Windows\System\ZFTuwXh.exe
  C:\Windows\System\ZFTuwXh.exe
  2⤵
  PID:6484
- C:\Windows\System\IKgiygv.exe
  C:\Windows\System\IKgiygv.exe
  2⤵
  PID:6512
- C:\Windows\System\EzQFmvr.exe
  C:\Windows\System\EzQFmvr.exe
  2⤵
  PID:6540
- C:\Windows\System\xShfzyD.exe
  C:\Windows\System\xShfzyD.exe
  2⤵
  PID:6568
- C:\Windows\System\aAmfoeV.exe
  C:\Windows\System\aAmfoeV.exe
  2⤵
  PID:6596
- C:\Windows\System\ltzVIvv.exe
  C:\Windows\System\ltzVIvv.exe
  2⤵
  PID:6624
- C:\Windows\System\UVLbhGk.exe
  C:\Windows\System\UVLbhGk.exe
  2⤵
  PID:6652
- C:\Windows\System\sHObvKY.exe
  C:\Windows\System\sHObvKY.exe
  2⤵
  PID:6680
- C:\Windows\System\WxlWkZn.exe
  C:\Windows\System\WxlWkZn.exe
  2⤵
  PID:6708
- C:\Windows\System\JhlExbz.exe
  C:\Windows\System\JhlExbz.exe
  2⤵
  PID:6736
- C:\Windows\System\KxvrlIl.exe
  C:\Windows\System\KxvrlIl.exe
  2⤵
  PID:6764
- C:\Windows\System\IJpPfUi.exe
  C:\Windows\System\IJpPfUi.exe
  2⤵
  PID:6800
- C:\Windows\System\pJqsZxT.exe
  C:\Windows\System\pJqsZxT.exe
  2⤵
  PID:6820
- C:\Windows\System\mDiUWaZ.exe
  C:\Windows\System\mDiUWaZ.exe
  2⤵
  PID:6848
- C:\Windows\System\nTgugfn.exe
  C:\Windows\System\nTgugfn.exe
  2⤵
  PID:6876
- C:\Windows\System\OpJRmLV.exe
  C:\Windows\System\OpJRmLV.exe
  2⤵
  PID:6904
- C:\Windows\System\xUSZrej.exe
  C:\Windows\System\xUSZrej.exe
  2⤵
  PID:6932
- C:\Windows\System\YYystAE.exe
  C:\Windows\System\YYystAE.exe
  2⤵
  PID:6960
- C:\Windows\System\WnNZDQD.exe
  C:\Windows\System\WnNZDQD.exe
  2⤵
  PID:6988
- C:\Windows\System\hyzmOST.exe
  C:\Windows\System\hyzmOST.exe
  2⤵
  PID:7016
- C:\Windows\System\jeStiIQ.exe
  C:\Windows\System\jeStiIQ.exe
  2⤵
  PID:7044
- C:\Windows\System\PNeeZoc.exe
  C:\Windows\System\PNeeZoc.exe
  2⤵
  PID:7072
- C:\Windows\System\qpYCWFS.exe
  C:\Windows\System\qpYCWFS.exe
  2⤵
  PID:7100
- C:\Windows\System\NEoMZAl.exe
  C:\Windows\System\NEoMZAl.exe
  2⤵
  PID:7128
- C:\Windows\System\lgWCXkE.exe
  C:\Windows\System\lgWCXkE.exe
  2⤵
  PID:7156
- C:\Windows\System\oAJjYVz.exe
  C:\Windows\System\oAJjYVz.exe
  2⤵
  PID:5408
- C:\Windows\System\iKKzCHE.exe
  C:\Windows\System\iKKzCHE.exe
  2⤵
  PID:5664
- C:\Windows\System\eplOMwo.exe
  C:\Windows\System\eplOMwo.exe
  2⤵
  PID:5912
- C:\Windows\System\eMUIZrb.exe
  C:\Windows\System\eMUIZrb.exe
  2⤵
  PID:6140
- C:\Windows\System\fvqpiXU.exe
  C:\Windows\System\fvqpiXU.exe
  2⤵
  PID:5132
- C:\Windows\System\VyvUDjd.exe
  C:\Windows\System\VyvUDjd.exe
  2⤵
  PID:6192
- C:\Windows\System\awjKFQv.exe
  C:\Windows\System\awjKFQv.exe
  2⤵
  PID:6304
- C:\Windows\System\rlERWud.exe
  C:\Windows\System\rlERWud.exe
  2⤵
  PID:6336
- C:\Windows\System\tuIXQMG.exe
  C:\Windows\System\tuIXQMG.exe
  2⤵
  PID:6384
- C:\Windows\System\wdHXwXc.exe
  C:\Windows\System\wdHXwXc.exe
  2⤵
  PID:6500
- C:\Windows\System\YsSbDmH.exe
  C:\Windows\System\YsSbDmH.exe
  2⤵
  PID:6588
- C:\Windows\System\HUzTPdC.exe
  C:\Windows\System\HUzTPdC.exe
  2⤵
  PID:6616
- C:\Windows\System\GdfQsvp.exe
  C:\Windows\System\GdfQsvp.exe
  2⤵
  PID:6720
- C:\Windows\System\faCgCSN.exe
  C:\Windows\System\faCgCSN.exe
  2⤵
  PID:6748
- C:\Windows\System\qSWZoDj.exe
  C:\Windows\System\qSWZoDj.exe
  2⤵
  PID:6796
- C:\Windows\System\saWGDFc.exe
  C:\Windows\System\saWGDFc.exe
  2⤵
  PID:6840
- C:\Windows\System\SkEFlks.exe
  C:\Windows\System\SkEFlks.exe
  2⤵
  PID:6892
- C:\Windows\System\RgmrhHg.exe
  C:\Windows\System\RgmrhHg.exe
  2⤵
  PID:440
- C:\Windows\System\vaBOzjy.exe
  C:\Windows\System\vaBOzjy.exe
  2⤵
  PID:7000
- C:\Windows\System\YEvVXVP.exe
  C:\Windows\System\YEvVXVP.exe
  2⤵
  PID:1520
- C:\Windows\System\PXZHuaz.exe
  C:\Windows\System\PXZHuaz.exe
  2⤵
  PID:7064
- C:\Windows\System\DHVwtiW.exe
  C:\Windows\System\DHVwtiW.exe
  2⤵
  PID:7120
- C:\Windows\System\hmzRHLE.exe
  C:\Windows\System\hmzRHLE.exe
  2⤵
  PID:2568
- C:\Windows\System\anLVxgt.exe
  C:\Windows\System\anLVxgt.exe
  2⤵
  PID:5584
- C:\Windows\System\HhpxhUV.exe
  C:\Windows\System\HhpxhUV.exe
  2⤵
  PID:5784
- C:\Windows\System\hhVNsDS.exe
  C:\Windows\System\hhVNsDS.exe
  2⤵
  PID:4940
- C:\Windows\System\IvwFyQS.exe
  C:\Windows\System\IvwFyQS.exe
  2⤵
  PID:640
- C:\Windows\System\mrUvASU.exe
  C:\Windows\System\mrUvASU.exe
  2⤵
  PID:1664
- C:\Windows\System\zkhJYPH.exe
  C:\Windows\System\zkhJYPH.exe
  2⤵
  PID:1128
- C:\Windows\System\iTwFwpG.exe
  C:\Windows\System\iTwFwpG.exe
  2⤵
  PID:6188
- C:\Windows\System\zZiXvyc.exe
  C:\Windows\System\zZiXvyc.exe
  2⤵
  PID:6476
- C:\Windows\System\aJpfJcF.exe
  C:\Windows\System\aJpfJcF.exe
  2⤵
  PID:3216
- C:\Windows\System\eRnZZMV.exe
  C:\Windows\System\eRnZZMV.exe
  2⤵
  PID:4492
- C:\Windows\System\aJaKGRX.exe
  C:\Windows\System\aJaKGRX.exe
  2⤵
  PID:1052
- C:\Windows\System\foKvroJ.exe
  C:\Windows\System\foKvroJ.exe
  2⤵
  PID:2804
- C:\Windows\System\QOduvIf.exe
  C:\Windows\System\QOduvIf.exe
  2⤵
  PID:4112
- C:\Windows\System\klsaOYn.exe
  C:\Windows\System\klsaOYn.exe
  2⤵
  PID:6980
- C:\Windows\System\hJAGpAn.exe
  C:\Windows\System\hJAGpAn.exe
  2⤵
  PID:7036
- C:\Windows\System\adChuTr.exe
  C:\Windows\System\adChuTr.exe
  2⤵
  PID:7088
- C:\Windows\System\NFSPZoZ.exe
  C:\Windows\System\NFSPZoZ.exe
  2⤵
  PID:4992
- C:\Windows\System\TKIukDx.exe
  C:\Windows\System\TKIukDx.exe
  2⤵
  PID:5528
- C:\Windows\System\paDCDQx.exe
  C:\Windows\System\paDCDQx.exe
  2⤵
  PID:4976
- C:\Windows\System\DrFtTFH.exe
  C:\Windows\System\DrFtTFH.exe
  2⤵
  PID:5116
- C:\Windows\System\PmqZFsK.exe
  C:\Windows\System\PmqZFsK.exe
  2⤵
  PID:6552
- C:\Windows\System\ZfmQcpG.exe
  C:\Windows\System\ZfmQcpG.exe
  2⤵
  PID:6612
- C:\Windows\System\XwKMImb.exe
  C:\Windows\System\XwKMImb.exe
  2⤵
  PID:3084
- C:\Windows\System\EIOMyBS.exe
  C:\Windows\System\EIOMyBS.exe
  2⤵
  PID:6976
- C:\Windows\System\hRUeEdi.exe
  C:\Windows\System\hRUeEdi.exe
  2⤵
  PID:3540
- C:\Windows\System\RFBSken.exe
  C:\Windows\System\RFBSken.exe
  2⤵
  PID:6364
- C:\Windows\System\ECjzZyb.exe
  C:\Windows\System\ECjzZyb.exe
  2⤵
  PID:1684
- C:\Windows\System\tznFfbe.exe
  C:\Windows\System\tznFfbe.exe
  2⤵
  PID:3668
- C:\Windows\System\vCOBmdm.exe
  C:\Windows\System\vCOBmdm.exe
  2⤵
  PID:7192
- C:\Windows\System\svXQXJB.exe
  C:\Windows\System\svXQXJB.exe
  2⤵
  PID:7236
- C:\Windows\System\mbhtKYp.exe
  C:\Windows\System\mbhtKYp.exe
  2⤵
  PID:7280
- C:\Windows\System\IRzuskf.exe
  C:\Windows\System\IRzuskf.exe
  2⤵
  PID:7300
- C:\Windows\System\PGOeCkZ.exe
  C:\Windows\System\PGOeCkZ.exe
  2⤵
  PID:7324
- C:\Windows\System\pEjLZyE.exe
  C:\Windows\System\pEjLZyE.exe
  2⤵
  PID:7344
- C:\Windows\System\iwDFwaM.exe
  C:\Windows\System\iwDFwaM.exe
  2⤵
  PID:7408
- C:\Windows\System\eHetNnC.exe
  C:\Windows\System\eHetNnC.exe
  2⤵
  PID:7436
- C:\Windows\System\jORuDGA.exe
  C:\Windows\System\jORuDGA.exe
  2⤵
  PID:7456
- C:\Windows\System\wcsjONe.exe
  C:\Windows\System\wcsjONe.exe
  2⤵
  PID:7480
- C:\Windows\System\NAHWunx.exe
  C:\Windows\System\NAHWunx.exe
  2⤵
  PID:7500
- C:\Windows\System\EjCdcLJ.exe
  C:\Windows\System\EjCdcLJ.exe
  2⤵
  PID:7524
- C:\Windows\System\PfTDTiG.exe
  C:\Windows\System\PfTDTiG.exe
  2⤵
  PID:7540
- C:\Windows\System\IyclXEL.exe
  C:\Windows\System\IyclXEL.exe
  2⤵
  PID:7580
- C:\Windows\System\vAASUxT.exe
  C:\Windows\System\vAASUxT.exe
  2⤵
  PID:7604
- C:\Windows\System\hNwEjPa.exe
  C:\Windows\System\hNwEjPa.exe
  2⤵
  PID:7624
- C:\Windows\System\XkHHzIb.exe
  C:\Windows\System\XkHHzIb.exe
  2⤵
  PID:7652
- C:\Windows\System\ecDgsus.exe
  C:\Windows\System\ecDgsus.exe
  2⤵
  PID:7680
- C:\Windows\System\zOyABiG.exe
  C:\Windows\System\zOyABiG.exe
  2⤵
  PID:7720
- C:\Windows\System\bFHGeVP.exe
  C:\Windows\System\bFHGeVP.exe
  2⤵
  PID:7740
- C:\Windows\System\dXjEGWy.exe
  C:\Windows\System\dXjEGWy.exe
  2⤵
  PID:7768
- C:\Windows\System\CRhPVju.exe
  C:\Windows\System\CRhPVju.exe
  2⤵
  PID:7796
- C:\Windows\System\GRNZfXm.exe
  C:\Windows\System\GRNZfXm.exe
  2⤵
  PID:7820
- C:\Windows\System\KPsWcnn.exe
  C:\Windows\System\KPsWcnn.exe
  2⤵
  PID:7876
- C:\Windows\System\JUaHWmD.exe
  C:\Windows\System\JUaHWmD.exe
  2⤵
  PID:7900
- C:\Windows\System\AlPqXRW.exe
  C:\Windows\System\AlPqXRW.exe
  2⤵
  PID:7924
- C:\Windows\System\FbrMTFd.exe
  C:\Windows\System\FbrMTFd.exe
  2⤵
  PID:7956
- C:\Windows\System\iJJAFkd.exe
  C:\Windows\System\iJJAFkd.exe
  2⤵
  PID:7976
- C:\Windows\System\zafWwqa.exe
  C:\Windows\System\zafWwqa.exe
  2⤵
  PID:8016
- C:\Windows\System\mmchuet.exe
  C:\Windows\System\mmchuet.exe
  2⤵
  PID:8036
- C:\Windows\System\TxnfMeY.exe
  C:\Windows\System\TxnfMeY.exe
  2⤵
  PID:8064
- C:\Windows\System\akDuaGE.exe
  C:\Windows\System\akDuaGE.exe
  2⤵
  PID:8088
- C:\Windows\System\ktgGdxU.exe
  C:\Windows\System\ktgGdxU.exe
  2⤵
  PID:8108
- C:\Windows\System\YUsEcfm.exe
  C:\Windows\System\YUsEcfm.exe
  2⤵
  PID:8144
- C:\Windows\System\tYMccBM.exe
  C:\Windows\System\tYMccBM.exe
  2⤵
  PID:8168
- C:\Windows\System\zxmGpRt.exe
  C:\Windows\System\zxmGpRt.exe
  2⤵
  PID:4688
- C:\Windows\System\ecPhHuQ.exe
  C:\Windows\System\ecPhHuQ.exe
  2⤵
  PID:1428
- C:\Windows\System\XokQJHD.exe
  C:\Windows\System\XokQJHD.exe
  2⤵
  PID:7272
- C:\Windows\System\SfekXwj.exe
  C:\Windows\System\SfekXwj.exe
  2⤵
  PID:7296
- C:\Windows\System\NgBNnDM.exe
  C:\Windows\System\NgBNnDM.exe
  2⤵
  PID:7392
- C:\Windows\System\zJNjObd.exe
  C:\Windows\System\zJNjObd.exe
  2⤵
  PID:7452
- C:\Windows\System\lZwRkPL.exe
  C:\Windows\System\lZwRkPL.exe
  2⤵
  PID:7560
- C:\Windows\System\jMPEvTW.exe
  C:\Windows\System\jMPEvTW.exe
  2⤵
  PID:7596
- C:\Windows\System\bVIygQt.exe
  C:\Windows\System\bVIygQt.exe
  2⤵
  PID:7648
- C:\Windows\System\MRxhpvK.exe
  C:\Windows\System\MRxhpvK.exe
  2⤵
  PID:7704
- C:\Windows\System\WNpeWCx.exe
  C:\Windows\System\WNpeWCx.exe
  2⤵
  PID:7776
- C:\Windows\System\iCRsEwJ.exe
  C:\Windows\System\iCRsEwJ.exe
  2⤵
  PID:7788
- C:\Windows\System\okmhUbQ.exe
  C:\Windows\System\okmhUbQ.exe
  2⤵
  PID:7896
- C:\Windows\System\opWthyY.exe
  C:\Windows\System\opWthyY.exe
  2⤵
  PID:7932
- C:\Windows\System\FHEvttW.exe
  C:\Windows\System\FHEvttW.exe
  2⤵
  PID:8004
- C:\Windows\System\fdZHTZf.exe
  C:\Windows\System\fdZHTZf.exe
  2⤵
  PID:8044
- C:\Windows\System\yBspjwB.exe
  C:\Windows\System\yBspjwB.exe
  2⤵
  PID:8084
- C:\Windows\System\ZCBBAcU.exe
  C:\Windows\System\ZCBBAcU.exe
  2⤵
  PID:8160
- C:\Windows\System\DQeGNeQ.exe
  C:\Windows\System\DQeGNeQ.exe
  2⤵
  PID:7292
- C:\Windows\System\LHAOQrT.exe
  C:\Windows\System\LHAOQrT.exe
  2⤵
  PID:7428
- C:\Windows\System\lWHRZHK.exe
  C:\Windows\System\lWHRZHK.exe
  2⤵
  PID:7556
- C:\Windows\System\ZfszSTP.exe
  C:\Windows\System\ZfszSTP.exe
  2⤵
  PID:7700
- C:\Windows\System\pTVBCCg.exe
  C:\Windows\System\pTVBCCg.exe
  2⤵
  PID:8056
- C:\Windows\System\LbzswNE.exe
  C:\Windows\System\LbzswNE.exe
  2⤵
  PID:8116
- C:\Windows\System\dAAFcpA.exe
  C:\Windows\System\dAAFcpA.exe
  2⤵
  PID:7536
- C:\Windows\System\rKEHysL.exe
  C:\Windows\System\rKEHysL.exe
  2⤵
  PID:7844
- C:\Windows\System\aNUUHWN.exe
  C:\Windows\System\aNUUHWN.exe
  2⤵
  PID:8028
- C:\Windows\System\dtanfrN.exe
  C:\Windows\System\dtanfrN.exe
  2⤵
  PID:7512
- C:\Windows\System\TjSBNmc.exe
  C:\Windows\System\TjSBNmc.exe
  2⤵
  PID:8220
- C:\Windows\System\lWUrfya.exe
  C:\Windows\System\lWUrfya.exe
  2⤵
  PID:8240
- C:\Windows\System\YZAaKXb.exe
  C:\Windows\System\YZAaKXb.exe
  2⤵
  PID:8260
- C:\Windows\System\AZiOOJW.exe
  C:\Windows\System\AZiOOJW.exe
  2⤵
  PID:8288
- C:\Windows\System\BUYLGyG.exe
  C:\Windows\System\BUYLGyG.exe
  2⤵
  PID:8320
- C:\Windows\System\ptidgRF.exe
  C:\Windows\System\ptidgRF.exe
  2⤵
  PID:8344
- C:\Windows\System\ovwCNwl.exe
  C:\Windows\System\ovwCNwl.exe
  2⤵
  PID:8372
- C:\Windows\System\oLXeIdl.exe
  C:\Windows\System\oLXeIdl.exe
  2⤵
  PID:8396
- C:\Windows\System\ChpeqPU.exe
  C:\Windows\System\ChpeqPU.exe
  2⤵
  PID:8412
- C:\Windows\System\ZKVYjpV.exe
  C:\Windows\System\ZKVYjpV.exe
  2⤵
  PID:8456
- C:\Windows\System\gHvPIBE.exe
  C:\Windows\System\gHvPIBE.exe
  2⤵
  PID:8484
- C:\Windows\System\kbuDnlC.exe
  C:\Windows\System\kbuDnlC.exe
  2⤵
  PID:8508
- C:\Windows\System\JcjGzDH.exe
  C:\Windows\System\JcjGzDH.exe
  2⤵
  PID:8532
- C:\Windows\System\lDZKEPS.exe
  C:\Windows\System\lDZKEPS.exe
  2⤵
  PID:8556
- C:\Windows\System\ETKXpAw.exe
  C:\Windows\System\ETKXpAw.exe
  2⤵
  PID:8576
- C:\Windows\System\CcQReUU.exe
  C:\Windows\System\CcQReUU.exe
  2⤵
  PID:8624
- C:\Windows\System\AHXVvnm.exe
  C:\Windows\System\AHXVvnm.exe
  2⤵
  PID:8648
- C:\Windows\System\KvpNBSD.exe
  C:\Windows\System\KvpNBSD.exe
  2⤵
  PID:8684
- C:\Windows\System\PDJyxkb.exe
  C:\Windows\System\PDJyxkb.exe
  2⤵
  PID:8700
- C:\Windows\System\YTtfEUi.exe
  C:\Windows\System\YTtfEUi.exe
  2⤵
  PID:8732
- C:\Windows\System\iFxDyON.exe
  C:\Windows\System\iFxDyON.exe
  2⤵
  PID:8780
- C:\Windows\System\aLXSLqa.exe
  C:\Windows\System\aLXSLqa.exe
  2⤵
  PID:8800
- C:\Windows\System\eDwHfwT.exe
  C:\Windows\System\eDwHfwT.exe
  2⤵
  PID:8840
- C:\Windows\System\tEyElUx.exe
  C:\Windows\System\tEyElUx.exe
  2⤵
  PID:8864
- C:\Windows\System\wqsjDrl.exe
  C:\Windows\System\wqsjDrl.exe
  2⤵
  PID:8884
- C:\Windows\System\YXAXEbJ.exe
  C:\Windows\System\YXAXEbJ.exe
  2⤵
  PID:8912
- C:\Windows\System\yXWGMxl.exe
  C:\Windows\System\yXWGMxl.exe
  2⤵
  PID:8932
- C:\Windows\System\FdvjHgA.exe
  C:\Windows\System\FdvjHgA.exe
  2⤵
  PID:8972
- C:\Windows\System\EGrfVzD.exe
  C:\Windows\System\EGrfVzD.exe
  2⤵
  PID:8996
- C:\Windows\System\RMRRPrO.exe
  C:\Windows\System\RMRRPrO.exe
  2⤵
  PID:9020
- C:\Windows\System\AniyGRn.exe
  C:\Windows\System\AniyGRn.exe
  2⤵
  PID:9048
- C:\Windows\System\WkTnrjB.exe
  C:\Windows\System\WkTnrjB.exe
  2⤵
  PID:9072
- C:\Windows\System\CSGFfXo.exe
  C:\Windows\System\CSGFfXo.exe
  2⤵
  PID:9120
- C:\Windows\System\eALcyDz.exe
  C:\Windows\System\eALcyDz.exe
  2⤵
  PID:9140
- C:\Windows\System\JucfUHQ.exe
  C:\Windows\System\JucfUHQ.exe
  2⤵
  PID:9180
- C:\Windows\System\TmLyEzw.exe
  C:\Windows\System\TmLyEzw.exe
  2⤵
  PID:9200
- C:\Windows\System\CEskTAO.exe
  C:\Windows\System\CEskTAO.exe
  2⤵
  PID:7940
- C:\Windows\System\iubXvem.exe
  C:\Windows\System\iubXvem.exe
  2⤵
  PID:8300
- C:\Windows\System\ILibZqG.exe
  C:\Windows\System\ILibZqG.exe
  2⤵
  PID:8312
- C:\Windows\System\podfJlp.exe
  C:\Windows\System\podfJlp.exe
  2⤵
  PID:8364
- C:\Windows\System\BPzkFIl.exe
  C:\Windows\System\BPzkFIl.exe
  2⤵
  PID:8428
- C:\Windows\System\CppDxBe.exe
  C:\Windows\System\CppDxBe.exe
  2⤵
  PID:8444
- C:\Windows\System\XLiIFvl.exe
  C:\Windows\System\XLiIFvl.exe
  2⤵
  PID:8616
- C:\Windows\System\cKLRiYh.exe
  C:\Windows\System\cKLRiYh.exe
  2⤵
  PID:8644
- C:\Windows\System\NQIdgyT.exe
  C:\Windows\System\NQIdgyT.exe
  2⤵
  PID:8724
- C:\Windows\System\heluzSl.exe
  C:\Windows\System\heluzSl.exe
  2⤵
  PID:8792
- C:\Windows\System\nUaqOAq.exe
  C:\Windows\System\nUaqOAq.exe
  2⤵
  PID:8820
- C:\Windows\System\rinTmgI.exe
  C:\Windows\System\rinTmgI.exe
  2⤵
  PID:8876
- C:\Windows\System\lQWMbqZ.exe
  C:\Windows\System\lQWMbqZ.exe
  2⤵
  PID:8924
- C:\Windows\System\eIhsrwv.exe
  C:\Windows\System\eIhsrwv.exe
  2⤵
  PID:9036
- C:\Windows\System\bGACrIF.exe
  C:\Windows\System\bGACrIF.exe
  2⤵
  PID:9096
- C:\Windows\System\AbXDEhW.exe
  C:\Windows\System\AbXDEhW.exe
  2⤵
  PID:9172
- C:\Windows\System\TAHWwmN.exe
  C:\Windows\System\TAHWwmN.exe
  2⤵
  PID:9208
- C:\Windows\System\UJZSgPJ.exe
  C:\Windows\System\UJZSgPJ.exe
  2⤵
  PID:8332
- C:\Windows\System\NRTmaDX.exe
  C:\Windows\System\NRTmaDX.exe
  2⤵
  PID:8452
- C:\Windows\System\nwgLMjW.exe
  C:\Windows\System\nwgLMjW.exe
  2⤵
  PID:8572
- C:\Windows\System\qygrgZs.exe
  C:\Windows\System\qygrgZs.exe
  2⤵
  PID:8752
- C:\Windows\System\JYJZiXy.exe
  C:\Windows\System\JYJZiXy.exe
  2⤵
  PID:8956
- C:\Windows\System\pLeByeI.exe
  C:\Windows\System\pLeByeI.exe
  2⤵
  PID:9108
- C:\Windows\System\BHstbrF.exe
  C:\Windows\System\BHstbrF.exe
  2⤵
  PID:9196
- C:\Windows\System\EDdeeav.exe
  C:\Windows\System\EDdeeav.exe
  2⤵
  PID:8384
- C:\Windows\System\lgkTGaH.exe
  C:\Windows\System\lgkTGaH.exe
  2⤵
  PID:8776
- C:\Windows\System\tfiLZjv.exe
  C:\Windows\System\tfiLZjv.exe
  2⤵
  PID:8904
- C:\Windows\System\ucrzeIc.exe
  C:\Windows\System\ucrzeIc.exe
  2⤵
  PID:9244
- C:\Windows\System\bYtHcLe.exe
  C:\Windows\System\bYtHcLe.exe
  2⤵
  PID:9284
- C:\Windows\System\ClJhgYu.exe
  C:\Windows\System\ClJhgYu.exe
  2⤵
  PID:9304
- C:\Windows\System\lnjSvlA.exe
  C:\Windows\System\lnjSvlA.exe
  2⤵
  PID:9320
- C:\Windows\System\eAopTEB.exe
  C:\Windows\System\eAopTEB.exe
  2⤵
  PID:9344
- C:\Windows\System\yiTsLZa.exe
  C:\Windows\System\yiTsLZa.exe
  2⤵
  PID:9388
- C:\Windows\System\eKPyPJg.exe
  C:\Windows\System\eKPyPJg.exe
  2⤵
  PID:9432
- C:\Windows\System\YpWVRce.exe
  C:\Windows\System\YpWVRce.exe
  2⤵
  PID:9452
- C:\Windows\System\juZGpFP.exe
  C:\Windows\System\juZGpFP.exe
  2⤵
  PID:9484
- C:\Windows\System\GgZudWo.exe
  C:\Windows\System\GgZudWo.exe
  2⤵
  PID:9516
- C:\Windows\System\EsZLruP.exe
  C:\Windows\System\EsZLruP.exe
  2⤵
  PID:9548
- C:\Windows\System\nwaFcIM.exe
  C:\Windows\System\nwaFcIM.exe
  2⤵
  PID:9568
- C:\Windows\System\vwOfpqy.exe
  C:\Windows\System\vwOfpqy.exe
  2⤵
  PID:9592
- C:\Windows\System\DxHPdRp.exe
  C:\Windows\System\DxHPdRp.exe
  2⤵
  PID:9612
- C:\Windows\System\OxnbTnk.exe
  C:\Windows\System\OxnbTnk.exe
  2⤵
  PID:9644
- C:\Windows\System\PgmWzeB.exe
  C:\Windows\System\PgmWzeB.exe
  2⤵
  PID:9664
- C:\Windows\System\GQvgrdl.exe
  C:\Windows\System\GQvgrdl.exe
  2⤵
  PID:9744
- C:\Windows\System\zeYndxV.exe
  C:\Windows\System\zeYndxV.exe
  2⤵
  PID:9776
- C:\Windows\System\nRmkjJI.exe
  C:\Windows\System\nRmkjJI.exe
  2⤵
  PID:9892
- C:\Windows\System\MTcejdI.exe
  C:\Windows\System\MTcejdI.exe
  2⤵
  PID:9920
- C:\Windows\System\pRtPpyU.exe
  C:\Windows\System\pRtPpyU.exe
  2⤵
  PID:9940
- C:\Windows\System\WYCDndy.exe
  C:\Windows\System\WYCDndy.exe
  2⤵
  PID:9968
- C:\Windows\System\rUvKDol.exe
  C:\Windows\System\rUvKDol.exe
  2⤵
  PID:9996
- C:\Windows\System\CoHzTVE.exe
  C:\Windows\System\CoHzTVE.exe
  2⤵
  PID:10016
- C:\Windows\System\NHFzXmY.exe
  C:\Windows\System\NHFzXmY.exe
  2⤵
  PID:10036
- C:\Windows\System\VqwCPZq.exe
  C:\Windows\System\VqwCPZq.exe
  2⤵
  PID:10064
- C:\Windows\System\BVEnqKI.exe
  C:\Windows\System\BVEnqKI.exe
  2⤵
  PID:10088
- C:\Windows\System\rqrxrRW.exe
  C:\Windows\System\rqrxrRW.exe
  2⤵
  PID:10152
- C:\Windows\System\msVTope.exe
  C:\Windows\System\msVTope.exe
  2⤵
  PID:10172
- C:\Windows\System\YefyJqm.exe
  C:\Windows\System\YefyJqm.exe
  2⤵
  PID:10192
- C:\Windows\System\vHMGzeJ.exe
  C:\Windows\System\vHMGzeJ.exe
  2⤵
  PID:10216
- C:\Windows\System\sQTemgF.exe
  C:\Windows\System\sQTemgF.exe
  2⤵
  PID:10236
- C:\Windows\System\ubKnBRW.exe
  C:\Windows\System\ubKnBRW.exe
  2⤵
  PID:9164
- C:\Windows\System\YBWGdgW.exe
  C:\Windows\System\YBWGdgW.exe
  2⤵
  PID:9272
- C:\Windows\System\ljNiTld.exe
  C:\Windows\System\ljNiTld.exe
  2⤵
  PID:9368
- C:\Windows\System\ZVBwCKQ.exe
  C:\Windows\System\ZVBwCKQ.exe
  2⤵
  PID:9444
- C:\Windows\System\Jqsufxy.exe
  C:\Windows\System\Jqsufxy.exe
  2⤵
  PID:9500
- C:\Windows\System\iNJBIsI.exe
  C:\Windows\System\iNJBIsI.exe
  2⤵
  PID:9620
- C:\Windows\System\pFRbhhm.exe
  C:\Windows\System\pFRbhhm.exe
  2⤵
  PID:9656
- C:\Windows\System\IlSXtve.exe
  C:\Windows\System\IlSXtve.exe
  2⤵
  PID:9696
- C:\Windows\System\BkPJrso.exe
  C:\Windows\System\BkPJrso.exe
  2⤵
  PID:9768
- C:\Windows\System\lPJZclp.exe
  C:\Windows\System\lPJZclp.exe
  2⤵
  PID:9700
- C:\Windows\System\aVsvOsQ.exe
  C:\Windows\System\aVsvOsQ.exe
  2⤵
  PID:9756
- C:\Windows\System\EzWVwyn.exe
  C:\Windows\System\EzWVwyn.exe
  2⤵
  PID:9816
- C:\Windows\System\khAcIde.exe
  C:\Windows\System\khAcIde.exe
  2⤵
  PID:9848
- C:\Windows\System\oPnQkyp.exe
  C:\Windows\System\oPnQkyp.exe
  2⤵
  PID:9884
- C:\Windows\System\icFsXHD.exe
  C:\Windows\System\icFsXHD.exe
  2⤵
  PID:10004
- C:\Windows\System\yiCvyEM.exe
  C:\Windows\System\yiCvyEM.exe
  2⤵
  PID:10056
- C:\Windows\System\KWIubpb.exe
  C:\Windows\System\KWIubpb.exe
  2⤵
  PID:10124
- C:\Windows\System\aOSGQrh.exe
  C:\Windows\System\aOSGQrh.exe
  2⤵
  PID:10200
- C:\Windows\System\yVbnRAC.exe
  C:\Windows\System\yVbnRAC.exe
  2⤵
  PID:10232
- C:\Windows\System\kSJOWnO.exe
  C:\Windows\System\kSJOWnO.exe
  2⤵
  PID:9364
- C:\Windows\System\EuFIpUD.exe
  C:\Windows\System\EuFIpUD.exe
  2⤵
  PID:9468
- C:\Windows\System\qzGKApB.exe
  C:\Windows\System\qzGKApB.exe
  2⤵
  PID:9576
- C:\Windows\System\LItZqJN.exe
  C:\Windows\System\LItZqJN.exe
  2⤵
  PID:9788
- C:\Windows\System\hCXSepH.exe
  C:\Windows\System\hCXSepH.exe
  2⤵
  PID:9840
- C:\Windows\System\YAysobC.exe
  C:\Windows\System\YAysobC.exe
  2⤵
  PID:9936
- C:\Windows\System\PDPLdpw.exe
  C:\Windows\System\PDPLdpw.exe
  2⤵
  PID:10128
- C:\Windows\System\PQcAyEI.exe
  C:\Windows\System\PQcAyEI.exe
  2⤵
  PID:10208
- C:\Windows\System\UFCSTCL.exe
  C:\Windows\System\UFCSTCL.exe
  2⤵
  PID:9584
- C:\Windows\System\blxtGsk.exe
  C:\Windows\System\blxtGsk.exe
  2⤵
  PID:9860
- C:\Windows\System\oBgvosq.exe
  C:\Windows\System\oBgvosq.exe
  2⤵
  PID:10212
- C:\Windows\System\PPlBPYR.exe
  C:\Windows\System\PPlBPYR.exe
  2⤵
  PID:10060
- C:\Windows\System\eJyVrVh.exe
  C:\Windows\System\eJyVrVh.exe
  2⤵
  PID:10244
- C:\Windows\System\GvQDkCg.exe
  C:\Windows\System\GvQDkCg.exe
  2⤵
  PID:10268
- C:\Windows\System\oSJjNge.exe
  C:\Windows\System\oSJjNge.exe
  2⤵
  PID:10312
- C:\Windows\System\QrUDFLo.exe
  C:\Windows\System\QrUDFLo.exe
  2⤵
  PID:10336
- C:\Windows\System\xzelRuA.exe
  C:\Windows\System\xzelRuA.exe
  2⤵
  PID:10356
- C:\Windows\System\scWOzPj.exe
  C:\Windows\System\scWOzPj.exe
  2⤵
  PID:10380
- C:\Windows\System\erFqUCK.exe
  C:\Windows\System\erFqUCK.exe
  2⤵
  PID:10412
- C:\Windows\System\rrRRXUi.exe
  C:\Windows\System\rrRRXUi.exe
  2⤵
  PID:10432
- C:\Windows\System\SmwwRuo.exe
  C:\Windows\System\SmwwRuo.exe
  2⤵
  PID:10480
- C:\Windows\System\AEybYmy.exe
  C:\Windows\System\AEybYmy.exe
  2⤵
  PID:10496
- C:\Windows\System\qcSYyQr.exe
  C:\Windows\System\qcSYyQr.exe
  2⤵
  PID:10536
- C:\Windows\System\JRzhLrd.exe
  C:\Windows\System\JRzhLrd.exe
  2⤵
  PID:10564
- C:\Windows\System\qqGNyzi.exe
  C:\Windows\System\qqGNyzi.exe
  2⤵
  PID:10588
- C:\Windows\System\dWDZdOs.exe
  C:\Windows\System\dWDZdOs.exe
  2⤵
  PID:10608
- C:\Windows\System\jpptvvz.exe
  C:\Windows\System\jpptvvz.exe
  2⤵
  PID:10648
- C:\Windows\System\ejvHPat.exe
  C:\Windows\System\ejvHPat.exe
  2⤵
  PID:10672
- C:\Windows\System\PvtQlEL.exe
  C:\Windows\System\PvtQlEL.exe
  2⤵
  PID:10696
- C:\Windows\System\UvZHorD.exe
  C:\Windows\System\UvZHorD.exe
  2⤵
  PID:10728
- C:\Windows\System\mDZAsSH.exe
  C:\Windows\System\mDZAsSH.exe
  2⤵
  PID:10752
- C:\Windows\System\CyhjVOF.exe
  C:\Windows\System\CyhjVOF.exe
  2⤵
  PID:10776
- C:\Windows\System\pXrAXuc.exe
  C:\Windows\System\pXrAXuc.exe
  2⤵
  PID:10796
- C:\Windows\System\xYKWobM.exe
  C:\Windows\System\xYKWobM.exe
  2⤵
  PID:10824
- C:\Windows\System\YtiPvMB.exe
  C:\Windows\System\YtiPvMB.exe
  2⤵
  PID:10852
- C:\Windows\System\QFAAkCa.exe
  C:\Windows\System\QFAAkCa.exe
  2⤵
  PID:10880
- C:\Windows\System\NgQLwPi.exe
  C:\Windows\System\NgQLwPi.exe
  2⤵
  PID:10924
- C:\Windows\System\coHCRes.exe
  C:\Windows\System\coHCRes.exe
  2⤵
  PID:10944
- C:\Windows\System\BIZXxLq.exe
  C:\Windows\System\BIZXxLq.exe
  2⤵
  PID:10968
- C:\Windows\System\TzjvsZv.exe
  C:\Windows\System\TzjvsZv.exe
  2⤵
  PID:11008
- C:\Windows\System\EXMVDAm.exe
  C:\Windows\System\EXMVDAm.exe
  2⤵
  PID:11036
- C:\Windows\System\qUTWaii.exe
  C:\Windows\System\qUTWaii.exe
  2⤵
  PID:11060
- C:\Windows\System\dGJBFje.exe
  C:\Windows\System\dGJBFje.exe
  2⤵
  PID:11084
- C:\Windows\System\tOPhRhD.exe
  C:\Windows\System\tOPhRhD.exe
  2⤵
  PID:11104
- C:\Windows\System\ebTrOpY.exe
  C:\Windows\System\ebTrOpY.exe
  2⤵
  PID:11136
- C:\Windows\System\VIgfzQY.exe
  C:\Windows\System\VIgfzQY.exe
  2⤵
  PID:11156
- C:\Windows\System\fSyKRAI.exe
  C:\Windows\System\fSyKRAI.exe
  2⤵
  PID:11172
- C:\Windows\System\OROUHNt.exe
  C:\Windows\System\OROUHNt.exe
  2⤵
  PID:11224
- C:\Windows\System\VFykZET.exe
  C:\Windows\System\VFykZET.exe
  2⤵
  PID:11248
- C:\Windows\System\GmAQnRM.exe
  C:\Windows\System\GmAQnRM.exe
  2⤵
  PID:9856
- C:\Windows\System\pWQnBQr.exe
  C:\Windows\System\pWQnBQr.exe
  2⤵
  PID:10304
- C:\Windows\System\kNfVMMx.exe
  C:\Windows\System\kNfVMMx.exe
  2⤵
  PID:10404
- C:\Windows\System\pqoWgpK.exe
  C:\Windows\System\pqoWgpK.exe
  2⤵
  PID:10488
- C:\Windows\System\akgoJYv.exe
  C:\Windows\System\akgoJYv.exe
  2⤵
  PID:10552
- C:\Windows\System\ZwADyIz.exe
  C:\Windows\System\ZwADyIz.exe
  2⤵
  PID:10596
- C:\Windows\System\kouIMIm.exe
  C:\Windows\System\kouIMIm.exe
  2⤵
  PID:10640
- C:\Windows\System\JruQpUK.exe
  C:\Windows\System\JruQpUK.exe
  2⤵
  PID:10692
- C:\Windows\System\MKZdboe.exe
  C:\Windows\System\MKZdboe.exe
  2⤵
  PID:10768
- C:\Windows\System\YwIMsbM.exe
  C:\Windows\System\YwIMsbM.exe
  2⤵
  PID:10816
- C:\Windows\System\nvbsYcb.exe
  C:\Windows\System\nvbsYcb.exe
  2⤵
  PID:10964
- C:\Windows\System\nDYfVSi.exe
  C:\Windows\System\nDYfVSi.exe
  2⤵
  PID:10988
- C:\Windows\System\DYjWjzT.exe
  C:\Windows\System\DYjWjzT.exe
  2⤵
  PID:11076
- C:\Windows\System\ihTGqQg.exe
  C:\Windows\System\ihTGqQg.exe
  2⤵
  PID:11100
- C:\Windows\System\vqzOChK.exe
  C:\Windows\System\vqzOChK.exe
  2⤵
  PID:11164
- C:\Windows\System\ZXqKedZ.exe
  C:\Windows\System\ZXqKedZ.exe
  2⤵
  PID:11204
- C:\Windows\System\QNkMlWj.exe
  C:\Windows\System\QNkMlWj.exe
  2⤵
  PID:10300
- C:\Windows\System\vULPUGS.exe
  C:\Windows\System\vULPUGS.exe
  2⤵
  PID:10372
- C:\Windows\System\qwvSaXv.exe
  C:\Windows\System\qwvSaXv.exe
  2⤵
  PID:10580
- C:\Windows\System\eypHLcb.exe
  C:\Windows\System\eypHLcb.exe
  2⤵
  PID:10600
- C:\Windows\System\oHTBbeC.exe
  C:\Windows\System\oHTBbeC.exe
  2⤵
  PID:10836
- C:\Windows\System\rNqCMQb.exe
  C:\Windows\System\rNqCMQb.exe
  2⤵
  PID:11028
- C:\Windows\System\qbmmROM.exe
  C:\Windows\System\qbmmROM.exe
  2⤵
  PID:11192
- C:\Windows\System\nIcOeNN.exe
  C:\Windows\System\nIcOeNN.exe
  2⤵
  PID:9448
- C:\Windows\System\FEQyQEF.exe
  C:\Windows\System\FEQyQEF.exe
  2⤵
  PID:10472
- C:\Windows\System\KGCUyTa.exe
  C:\Windows\System\KGCUyTa.exe
  2⤵
  PID:10960
- C:\Windows\System\AQiBBkO.exe
  C:\Windows\System\AQiBBkO.exe
  2⤵
  PID:10352
- C:\Windows\System\YGdgEsR.exe
  C:\Windows\System\YGdgEsR.exe
  2⤵
  PID:11272
- C:\Windows\System\bwCYWWo.exe
  C:\Windows\System\bwCYWWo.exe
  2⤵
  PID:11296
- C:\Windows\System\gdteIjI.exe
  C:\Windows\System\gdteIjI.exe
  2⤵
  PID:11316
- C:\Windows\System\EtrZJLq.exe
  C:\Windows\System\EtrZJLq.exe
  2⤵
  PID:11356
- C:\Windows\System\gvWtVxC.exe
  C:\Windows\System\gvWtVxC.exe
  2⤵
  PID:11420
- C:\Windows\System\xNWBANQ.exe
  C:\Windows\System\xNWBANQ.exe
  2⤵
  PID:11436
- C:\Windows\System\fPCPFvT.exe
  C:\Windows\System\fPCPFvT.exe
  2⤵
  PID:11460
- C:\Windows\System\gSPLRaC.exe
  C:\Windows\System\gSPLRaC.exe
  2⤵
  PID:11492
- C:\Windows\System\uvQgUsX.exe
  C:\Windows\System\uvQgUsX.exe
  2⤵
  PID:11520
- C:\Windows\System\bpGwodC.exe
  C:\Windows\System\bpGwodC.exe
  2⤵
  PID:11548
- C:\Windows\System\xWzzMNl.exe
  C:\Windows\System\xWzzMNl.exe
  2⤵
  PID:11576
- C:\Windows\System\kuEvmuf.exe
  C:\Windows\System\kuEvmuf.exe
  2⤵
  PID:11608
- C:\Windows\System\BVaDJQf.exe
  C:\Windows\System\BVaDJQf.exe
  2⤵
  PID:11628
- C:\Windows\System\HBZWblm.exe
  C:\Windows\System\HBZWblm.exe
  2⤵
  PID:11656
- C:\Windows\System\gsJKcOD.exe
  C:\Windows\System\gsJKcOD.exe
  2⤵
  PID:11676
- C:\Windows\System\fDygVMF.exe
  C:\Windows\System\fDygVMF.exe
  2⤵
  PID:11724
- C:\Windows\System\QGnnyAF.exe
  C:\Windows\System\QGnnyAF.exe
  2⤵
  PID:11744
- C:\Windows\System\YdRaRBB.exe
  C:\Windows\System\YdRaRBB.exe
  2⤵
  PID:11772
- C:\Windows\System\AkOTRSn.exe
  C:\Windows\System\AkOTRSn.exe
  2⤵
  PID:11816
- C:\Windows\System\CyKTCDT.exe
  C:\Windows\System\CyKTCDT.exe
  2⤵
  PID:11844
- C:\Windows\System\GBXEApz.exe
  C:\Windows\System\GBXEApz.exe
  2⤵
  PID:11864
- C:\Windows\System\lJvncuQ.exe
  C:\Windows\System\lJvncuQ.exe
  2⤵
  PID:11880
- C:\Windows\System\DfocqBs.exe
  C:\Windows\System\DfocqBs.exe
  2⤵
  PID:11904
- C:\Windows\System\lwBbuTC.exe
  C:\Windows\System\lwBbuTC.exe
  2⤵
  PID:11936
- C:\Windows\System\hLUgojR.exe
  C:\Windows\System\hLUgojR.exe
  2⤵
  PID:11972
- C:\Windows\System\opoFuqN.exe
  C:\Windows\System\opoFuqN.exe
  2⤵
  PID:11992
- C:\Windows\System\iDuSIMc.exe
  C:\Windows\System\iDuSIMc.exe
  2⤵
  PID:12016
- C:\Windows\System\HzccRaP.exe
  C:\Windows\System\HzccRaP.exe
  2⤵
  PID:12072
- C:\Windows\System\FApAFPN.exe
  C:\Windows\System\FApAFPN.exe
  2⤵
  PID:12108
- C:\Windows\System\GJlubex.exe
  C:\Windows\System\GJlubex.exe
  2⤵
  PID:12132
- C:\Windows\System\spnQUYu.exe
  C:\Windows\System\spnQUYu.exe
  2⤵
  PID:12152
- C:\Windows\System\qHLeozz.exe
  C:\Windows\System\qHLeozz.exe
  2⤵
  PID:12180
- C:\Windows\System\lBVABHA.exe
  C:\Windows\System\lBVABHA.exe
  2⤵
  PID:12200
- C:\Windows\System\JtwkAIH.exe
  C:\Windows\System\JtwkAIH.exe
  2⤵
  PID:12232
- C:\Windows\System\BjnvGcv.exe
  C:\Windows\System\BjnvGcv.exe
  2⤵
  PID:12276
- C:\Windows\System\RaGmDaB.exe
  C:\Windows\System\RaGmDaB.exe
  2⤵
  PID:11200
- C:\Windows\System\saUlaqE.exe
  C:\Windows\System\saUlaqE.exe
  2⤵
  PID:11288
- C:\Windows\System\jIKkBQk.exe
  C:\Windows\System\jIKkBQk.exe
  2⤵
  PID:11400
- C:\Windows\System\BmuURDK.exe
  C:\Windows\System\BmuURDK.exe
  2⤵
  PID:11448
- C:\Windows\System\aSiSlpm.exe
  C:\Windows\System\aSiSlpm.exe
  2⤵
  PID:11512
- C:\Windows\System\nmKyDkb.exe
  C:\Windows\System\nmKyDkb.exe
  2⤵
  PID:11560
- C:\Windows\System\uCPEilH.exe
  C:\Windows\System\uCPEilH.exe
  2⤵
  PID:11624
- C:\Windows\System\YWnMoXE.exe
  C:\Windows\System\YWnMoXE.exe
  2⤵
  PID:11648
- C:\Windows\System\XWigtRp.exe
  C:\Windows\System\XWigtRp.exe
  2⤵
  PID:4472
- C:\Windows\System\axXVnZB.exe
  C:\Windows\System\axXVnZB.exe
  2⤵
  PID:11764
- C:\Windows\System\IIjkjLo.exe
  C:\Windows\System\IIjkjLo.exe
  2⤵
  PID:11836
- C:\Windows\System\nQMLnhn.exe
  C:\Windows\System\nQMLnhn.exe
  2⤵
  PID:11896
- C:\Windows\System\XzlXrUW.exe
  C:\Windows\System\XzlXrUW.exe
  2⤵
  PID:11944
- C:\Windows\System\KfZccot.exe
  C:\Windows\System\KfZccot.exe
  2⤵
  PID:12028
- C:\Windows\System\FyFtcCk.exe
  C:\Windows\System\FyFtcCk.exe
  2⤵
  PID:12060
- C:\Windows\System\KsRguIO.exe
  C:\Windows\System\KsRguIO.exe
  2⤵
  PID:12164
- C:\Windows\System\OGGlfHy.exe
  C:\Windows\System\OGGlfHy.exe
  2⤵
  PID:12196
- C:\Windows\System\JuQnIWP.exe
  C:\Windows\System\JuQnIWP.exe
  2⤵
  PID:12268
- C:\Windows\System\oOzCeXG.exe
  C:\Windows\System\oOzCeXG.exe
  2⤵
  PID:10576
- C:\Windows\System\JlaLLrT.exe
  C:\Windows\System\JlaLLrT.exe
  2⤵
  PID:11428
- C:\Windows\System\AugBUvh.exe
  C:\Windows\System\AugBUvh.exe
  2⤵
  PID:11536
- C:\Windows\System\hhSXCMU.exe
  C:\Windows\System\hhSXCMU.exe
  2⤵
  PID:11588
- C:\Windows\System\cOfGyND.exe
  C:\Windows\System\cOfGyND.exe
  2⤵
  PID:11740
- C:\Windows\System\HsyqAfV.exe
  C:\Windows\System\HsyqAfV.exe
  2⤵
  PID:11856
- C:\Windows\System\Pozdgew.exe
  C:\Windows\System\Pozdgew.exe
  2⤵
  PID:11956
- C:\Windows\System\inFfLWV.exe
  C:\Windows\System\inFfLWV.exe
  2⤵
  PID:12144
- C:\Windows\System\nonijkt.exe
  C:\Windows\System\nonijkt.exe
  2⤵
  PID:12256
- C:\Windows\System\GePynnr.exe
  C:\Windows\System\GePynnr.exe
  2⤵
  PID:11352
- C:\Windows\System\ZBhHKsq.exe
  C:\Windows\System\ZBhHKsq.exe
  2⤵
  PID:11876
- C:\Windows\System\MCfTtlt.exe
  C:\Windows\System\MCfTtlt.exe
  2⤵
  PID:12104
- C:\Windows\System\iwUAfyc.exe
  C:\Windows\System\iwUAfyc.exe
  2⤵
  PID:11292
- C:\Windows\System\MxemoeR.exe
  C:\Windows\System\MxemoeR.exe
  2⤵
  PID:12040
- C:\Windows\System\VtrwNQY.exe
  C:\Windows\System\VtrwNQY.exe
  2⤵
  PID:11900
- C:\Windows\System\AVKYWYa.exe
  C:\Windows\System\AVKYWYa.exe
  2⤵
  PID:12348
- C:\Windows\System\avBamSr.exe
  C:\Windows\System\avBamSr.exe
  2⤵
  PID:12368
- C:\Windows\System\KPRhJmM.exe
  C:\Windows\System\KPRhJmM.exe
  2⤵
  PID:12392
- C:\Windows\System\ICyzFrR.exe
  C:\Windows\System\ICyzFrR.exe
  2⤵
  PID:12408
- C:\Windows\System\jaGjaPi.exe
  C:\Windows\System\jaGjaPi.exe
  2⤵
  PID:12432
- C:\Windows\System\bhxmLMC.exe
  C:\Windows\System\bhxmLMC.exe
  2⤵
  PID:12452
- C:\Windows\System\AslBwGh.exe
  C:\Windows\System\AslBwGh.exe
  2⤵
  PID:12492
- C:\Windows\System\EWzWBhX.exe
  C:\Windows\System\EWzWBhX.exe
  2⤵
  PID:12524
- C:\Windows\System\EdsXCFr.exe
  C:\Windows\System\EdsXCFr.exe
  2⤵
  PID:12556
- C:\Windows\System\QlHYDHt.exe
  C:\Windows\System\QlHYDHt.exe
  2⤵
  PID:12580
- C:\Windows\System\YuJPBDW.exe
  C:\Windows\System\YuJPBDW.exe
  2⤵
  PID:12604
- C:\Windows\System\rwfwVWH.exe
  C:\Windows\System\rwfwVWH.exe
  2⤵
  PID:12632
- C:\Windows\System\wjvuPxU.exe
  C:\Windows\System\wjvuPxU.exe
  2⤵
  PID:12656
- C:\Windows\System\dqIexZI.exe
  C:\Windows\System\dqIexZI.exe
  2⤵
  PID:12676
- C:\Windows\System\BqAcsGa.exe
  C:\Windows\System\BqAcsGa.exe
  2⤵
  PID:12732
- C:\Windows\System\sBviqCu.exe
  C:\Windows\System\sBviqCu.exe
  2⤵
  PID:12756
- C:\Windows\System\ysXGnYp.exe
  C:\Windows\System\ysXGnYp.exe
  2⤵
  PID:12796
- C:\Windows\System\pixpOBZ.exe
  C:\Windows\System\pixpOBZ.exe
  2⤵
  PID:12820
- C:\Windows\System\oPNZFLg.exe
  C:\Windows\System\oPNZFLg.exe
  2⤵
  PID:12840
- C:\Windows\System\NljeSzI.exe
  C:\Windows\System\NljeSzI.exe
  2⤵
  PID:12880
- C:\Windows\System\bSGQXwV.exe
  C:\Windows\System\bSGQXwV.exe
  2⤵
  PID:12904
- C:\Windows\System\BdHgbIC.exe
  C:\Windows\System\BdHgbIC.exe
  2⤵
  PID:12932
- C:\Windows\System\FCgMltN.exe
  C:\Windows\System\FCgMltN.exe
  2⤵
  PID:12948
- C:\Windows\System\hrckGsr.exe
  C:\Windows\System\hrckGsr.exe
  2⤵
  PID:13000
- C:\Windows\System\CmAggQz.exe
  C:\Windows\System\CmAggQz.exe
  2⤵
  PID:13020
- C:\Windows\System\JIMpAZy.exe
  C:\Windows\System\JIMpAZy.exe
  2⤵
  PID:13036
- C:\Windows\System\dHvYbbP.exe
  C:\Windows\System\dHvYbbP.exe
  2⤵
  PID:13060
- C:\Windows\System\bhPxNBP.exe
  C:\Windows\System\bhPxNBP.exe
  2⤵
  PID:13076
- C:\Windows\System\NXuhMuE.exe
  C:\Windows\System\NXuhMuE.exe
  2⤵
  PID:13112
- C:\Windows\System\yRKYFlm.exe
  C:\Windows\System\yRKYFlm.exe
  2⤵
  PID:13136
- C:\Windows\System\GSkbBeW.exe
  C:\Windows\System\GSkbBeW.exe
  2⤵
  PID:13160
- C:\Windows\System\pKkBOHi.exe
  C:\Windows\System\pKkBOHi.exe
  2⤵
  PID:13196
- C:\Windows\System\bwzVoeY.exe
  C:\Windows\System\bwzVoeY.exe
  2⤵
  PID:13232
- C:\Windows\System\EfkrMPK.exe
  C:\Windows\System\EfkrMPK.exe
  2⤵
  PID:13256
- C:\Windows\System\SZHeNKC.exe
  C:\Windows\System\SZHeNKC.exe
  2⤵
  PID:13276
- C:\Windows\System\jNCEudV.exe
  C:\Windows\System\jNCEudV.exe
  2⤵
  PID:12488
- C:\Windows\System\ZiObbqR.exe
  C:\Windows\System\ZiObbqR.exe
  2⤵
  PID:12564
- C:\Windows\System\EcNIBZX.exe
  C:\Windows\System\EcNIBZX.exe
  2⤵
  PID:12724
- C:\Windows\System\REJYWSt.exe
  C:\Windows\System\REJYWSt.exe
  2⤵
  PID:12772
- C:\Windows\System\FnmmJqf.exe
  C:\Windows\System\FnmmJqf.exe
  2⤵
  PID:12808
- C:\Windows\System\SXgiNgH.exe
  C:\Windows\System\SXgiNgH.exe
  2⤵
  PID:12876
- C:\Windows\System\GmcTMNd.exe
  C:\Windows\System\GmcTMNd.exe
  2⤵
  PID:5112
- C:\Windows\System\faxlOap.exe
  C:\Windows\System\faxlOap.exe
  2⤵
  PID:12944
- C:\Windows\System\FqfGwGV.exe
  C:\Windows\System\FqfGwGV.exe
  2⤵
  PID:12964
- C:\Windows\System\nUGoqCN.exe
  C:\Windows\System\nUGoqCN.exe
  2⤵
  PID:13068
- C:\Windows\System\MjsfqYK.exe
  C:\Windows\System\MjsfqYK.exe
  2⤵
  PID:13108
- C:\Windows\System\fwgolTi.exe
  C:\Windows\System\fwgolTi.exe
  2⤵
  PID:13224
- C:\Windows\System\XVmXlpv.exe
  C:\Windows\System\XVmXlpv.exe
  2⤵
  PID:13292
- C:\Windows\System\VsafhqX.exe
  C:\Windows\System\VsafhqX.exe
  2⤵
  PID:13308
- C:\Windows\System\gxBTPkW.exe
  C:\Windows\System\gxBTPkW.exe
  2⤵
  PID:12356
- C:\Windows\System\dabZQtb.exe
  C:\Windows\System\dabZQtb.exe
  2⤵
  PID:12428
- C:\Windows\System\YOiNElT.exe
  C:\Windows\System\YOiNElT.exe
  2⤵
  PID:2604
- C:\Windows\System\NoVjIgj.exe
  C:\Windows\System\NoVjIgj.exe
  2⤵
  PID:3128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dvuywmve.b11.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AEhbEbx.exe

Filesize
2.2MB

MD5
f9fa57910c72a010e3c1e6d16764d66a

SHA1
5b0cc1ed6ce0a030f3bd0070b5299c341572ab76

SHA256
aa9cacd510fe8d6b88d3e737dfb72101547b677ae2404579f1c9e62ddc192bbc

SHA512
6d815c5f4d0651b52deb1429d151f051aa8deb4f578309e0e9167e2ada24a308a217b222e3bfc997cd0033a8be11586961395cb60cf2bf0c6786418139dc0b54

Download Submit
C:\Windows\System\CbicTEi.exe

Filesize
2.2MB

MD5
372b6e9e17aa2b1a82fd82f7bfcf5fe5

SHA1
872daa39ce8694fbc433e9742c03cf36f8583eac

SHA256
5bb5d2d8748953a67e03e57aa2690ac48940c8bab3ed1ae693b0130e8259c905

SHA512
818adb2ed1923a2721523902f08bc6be08f30cb9be22130bfa8343446a5fc36c30a1f33fa8816ed0c38d9d9e76e398aba82fa4eed652a8dc349d4a238dd88b45

Download Submit
C:\Windows\System\HDAiLtK.exe

Filesize
2.2MB

MD5
6decfdc6429557fe519f08f94ed26af1

SHA1
1cc9890c0e4232c49cdc3113986a67d302867d46

SHA256
78abb23abad770fcddb009d5b64cdbb046b6c52e220b5b455f345ba39c557f17

SHA512
215c619d84ef8371b3bd612c48d438b9d0502828a2d3e73fe6dc35a1e70517a7721625418c98c12183faa38a8dd23174a7aabcca2835df81a147bae2b4a801fb

Download Submit
C:\Windows\System\HwrWwEd.exe

Filesize
2.2MB

MD5
4d724cf65158f5d9f8914bbf074e8346

SHA1
5170d82f7f3dc2527c1a0294b32eaf044fb3fbc2

SHA256
083c0740f51d0ff58d54dcaae00b16a6c7be3dd69ac61ab526e7e2f5aba77c17

SHA512
d172b80f58fa801a87dbc48505fe39127478f72e734c98c1981da7ef74735a52cb37775a81a2ceb440fe5f06a68b775f1b2730e7b01f6500c7508c40bc1f7b32

Download Submit
C:\Windows\System\IAPJwtu.exe

Filesize
2.3MB

MD5
1449ba6474cc3efd9e4e7e61f8cf8174

SHA1
dc20850be13bcffde0d52c4e9521240d2e25a22c

SHA256
fa1aad67d40a71b5436b99564fb346545cc16546654141fc51003bbc771b1076

SHA512
cb49e43921d38add0462d66d07194d7d8e62956bac491044e4f1be0a7cbad959b158b499ed6c78ceaed6c5e5e4cd3965dffb7660be7a4eadc3054ee7bf98e7fa

Download Submit
C:\Windows\System\IVTVdRM.exe

Filesize
2.2MB

MD5
74af2663f616aa0cd7b951a011840b36

SHA1
1f0ca68c859fa8d7a5f2a62546e3815874116e70

SHA256
d09f29845cf72ce62d6c6b276f5cd92e56388b6ba84de6e5ec9de0809dfaddbd

SHA512
2731ecf84c9b73b55dfb65086df3730daaa845ee5d64ea562b116e04e7c9dc7bfef41c73552a44c9753bd1eefe9d77e19ad798a3f7d6797850cdbd88dc922476

Download Submit
C:\Windows\System\JJmEWlY.exe

Filesize
2.3MB

MD5
ab20ecdbca02bcf61dec0dd8b731fd08

SHA1
38e08f6c0613d52826a4b79fa557aeb282225ace

SHA256
965c827d20ba1dce4b52921086e6dfe4be568b1dc38c3a81d69252f8bc880982

SHA512
b290751411c489407afb345f1a03300dcfb03888e316a86eab15be40c26575287ce5de7e650daaaec42e9cfa570508a5a8e0949221629354cbfbb332b1a93182

Download Submit
C:\Windows\System\LFZCxOy.exe

Filesize
2.2MB

MD5
d8c43e7ffc144a5244b2ba023736d67e

SHA1
090f512bae33e1970dba571cca6f3a6faf0f7c4c

SHA256
b7008b1425067140b1261709ebfef728cb5c7a624673d5c645e8dbfb689b2034

SHA512
aed135046af8883e4f486447211a4c45188e15ce44d5732864ccc1f0718c301aa768854f3796e6412271e59475c16dc1f697eb5c56dcddc187251e805f33f873

Download Submit
C:\Windows\System\NJIIpET.exe

Filesize
2.2MB

MD5
c4d72a476ce43420d7e14493214e0fcd

SHA1
d2583be4dc3699ffa5d007b997d4ebaa957e5993

SHA256
7848a20df5bd36a9010d4b663d5bd4c463481bfc17e5ca5f6d17c73a31f4c024

SHA512
3af06d51ffb1937bc806b58462ac66c5d138d19f079b5ba3f93251e68bc71fbdacfdde681002d4e7fdeb3d2f6b37080d43f35a1e24e67b6fecac1d6a83ddfbd0

Download Submit
C:\Windows\System\NsACeTU.exe

Filesize
2.2MB

MD5
191b6b16b308b2bc424740b4bb0614bd

SHA1
d4a1750eadc408eff16a1d817b2c2d07c9cf132e

SHA256
3e8c832c524905fc84866cccf113cc3423fc3d1266874e7137efa9bd8298f6ef

SHA512
6472ee2c7faa048c5fdea90bc481bbeca95acc69a93b7ae7660aa62153ee2d950ee6e494177e32619f23fb3c4e83ce0e1cf651cf417c555bc14f9bf21ce9801d

Download Submit
C:\Windows\System\PTLmzvG.exe

Filesize
2.3MB

MD5
18fc5c5e3d6c508f622259164afb2787

SHA1
3a402e78874bbf7e67ffe3e1b481fd1802e88de7

SHA256
169953c15f8a784d6e082f6805d2fe3c5807bd426bfb6e23f1778fe088daf9d3

SHA512
671bf2aa2acbc31fe519da6c483e46781f6bf61ff8f517e079af4b3c1d73b338a92bc103da2f97ccdbb70b1d245b580ed95e7953b522b2d7bb9c12f72743ae63

Download Submit
C:\Windows\System\SFggNzh.exe

Filesize
2.2MB

MD5
a35db994ab3587410bb99308fd9e418f

SHA1
1bf23a67461f13000f99b096f0e2367ef7736e82

SHA256
e5e0b0a2b4e6d1ef3a9d111a78d38572cf1091a503ac532f19472e36aa024839

SHA512
943fb95f084e5ebfd0bee4038e13052e0bdd024207233358aa21a55e60831f48efc62f918f96988b454dd27092d00b36f1e19e5cd22c76aa3c6b14b4eef2f3a9

Download Submit
C:\Windows\System\UqneqVC.exe

Filesize
2.2MB

MD5
baea376f773887658668dea69d383ef8

SHA1
b25ae131d41af8500eb06b00eddc31d4c0f4db56

SHA256
64c7853ba2cddc5398036c2d1351daecc74298b0c25e5005a5c39ad552ddda42

SHA512
ffaab749fc1f83ce5e4d895e7bb66b300312aa5ccefab71ce6a94cf30bc59bfe98fbc622bde187205669788eae292d40ab0bc00bd31bf540b1863c13db805673

Download Submit
C:\Windows\System\VKoONAG.exe

Filesize
2.2MB

MD5
9ccd43525295cc252b6fb616338452fb

SHA1
c14d78f07ff8c5f3c65ff1565190116dedf5b7de

SHA256
2b5520c8f62162adafed3432b1c6ffd56013052dee4458888682310964a71e6a

SHA512
109931fdc6e41fae7b26ea46df7d1abfe070c89d1e9fe5066fcd0d78b8e9259b0a900df392270f857621568cdb6d12a3eca8dfbfc69ff73f4ff7189bee81ded0

Download Submit
C:\Windows\System\VNrwqTb.exe

Filesize
2.2MB

MD5
1f50bb210a33b75d3d13bca4ba76f7d5

SHA1
4269954f1bfdb43b7dfa502e543e36df3c095a63

SHA256
a2f81f2ab3b70222b4c03487cdbbbae25e0682cf085b5520a5a660d03da6ec52

SHA512
fd953c913e11ddfb9b20095845f1a75f7346eca7d2b350075199923be4349436b9d379995faa4a1ddc6480f395cbe49984edc9bf1ef1486c966b24e46145a6cc

Download Submit
C:\Windows\System\XucHnge.exe

Filesize
2.2MB

MD5
51acebbaf8825c4dfe790507e06298b7

SHA1
830b702f943c0456a4b0ae2c8534d98e1c38b7d6

SHA256
0486c6dd22d8e4c2955fb828e04625421d8a625376e8f9222c986d054e24630c

SHA512
dcf3b8b3fddb5714cbf7accafd8390de9711c36f25f3333760a624fd74a02a9f6fd7ebaa803bae723aed4473ef49f1f78277a3ee22563d0f1031cf05b76489b2

Download Submit
C:\Windows\System\asmYBqO.exe

Filesize
2.2MB

MD5
b0c0038829d8ffea0f3358f9212511bf

SHA1
0e7a117226a2ea6f87c0f90d79b11719e47d4e66

SHA256
a0cc00ccc2f40e531d08ee1e3b9b1419a5b8049f4395a1f227d738eb07b44960

SHA512
8321302a90d7b5c0a4cf73d04a2420cc6aca339f4c0387815f083e6b1449aa0a35b144cc4db060da64a006d2e3a6d6f8d88cc7471b1b4103b5600b2c7892345e

Download Submit
C:\Windows\System\cCiKgOB.exe

Filesize
2.2MB

MD5
58dcb98d966a9f3fa05ce131098ed879

SHA1
089c445063c9f98b1d8c74c60da858157c57b53e

SHA256
75d0bef8967cefaf9a9786c069cdd1752c1490af43b1619d094497d03d45ee34

SHA512
95d09c1eb43ebeeccec87dbe6aeb5625a2eb6ac20cb5f1fc3666e0d59458c3ceb0cc6b09aae02263d514f24f32898e36d6b8b96991a45005b1beb8cf7ab90f5b

Download Submit
C:\Windows\System\eEfRkVj.exe

Filesize
2.2MB

MD5
5d4b2480bf13a69cabf02725b3709fdb

SHA1
3e17644dee8a9667bbbdd7885c3f155aa2d1e39c

SHA256
0fb2babdfc73e6aa3ab61fe0ff9875ea7b2a88eb82566c9913dcf42862641cdd

SHA512
ff56d71a8eabf902139e9dbd82fbe88389c0dbda20d00eaa46fb56c76c33f3f0794451dea191a1b8286c68b08d17acf404f434dcba09be281ba3ce3c60af99f3

Download Submit
C:\Windows\System\fNvgOLR.exe

Filesize
2.2MB

MD5
c35ed69eff4bde0fdd7a3ed2e5f1928a

SHA1
63ce02f739eda4da78ab9d8495bc1e6715a682b6

SHA256
9c6d478dbdd474971f706366d7723326f08499037156d5d30e41da3cda440222

SHA512
17821759984924679b025c049b6ba4d3cbc8ed3f365961dce5df27041378b9fafdebb76ee97011c8e6bbe095c5a65d87725c4f5a687bd90bb2e7dc4cc22e0057

Download Submit
C:\Windows\System\kNRFlNQ.exe

Filesize
2.2MB

MD5
ac8ac981d4704c5517f82fc2188c667d

SHA1
09cdaff81b93e338f06fb5effd3608b2f87d77ba

SHA256
fbc82eda2d81ca4499bb402ed5d5cd55a87157687a38b2579e5df8b2dbfc66bb

SHA512
7974d09ff297c79e9f066c46e7c77c6fdb9b5810fff18249850817eca702097b172ed4ba0b1fc414c136fc04cf0b3a7fc2cc3600e559882f2d8af65527acb0f2

Download Submit
C:\Windows\System\ndooDIr.exe

Filesize
2.3MB

MD5
46a69626e2ae156097c521b8f5e296b1

SHA1
1b5f4914145faecbdfc88c3348e1aea34faa7392

SHA256
97016d78836c0af6820a06b7bbb27d9d8067f29f9820ee1e2f5e4061d1e3dc0c

SHA512
a710a85629619f572ec1983a04230e85587d89870cf4a211ad0342bfc44a23803e2e0bb8c419dc0e971fa5886340d7f10c49805cc5f01f9eb2a888c94d370beb

Download Submit
C:\Windows\System\oGqBwFq.exe

Filesize
2.2MB

MD5
86408a16dc8b9f8c6700798649291640

SHA1
170d769a486f990287fb93ebe7a965ac6a196c9b

SHA256
8400c981cad206d046ec911d94daeb9f9c0a0d565485b0b85b50e7ffcb19b1bc

SHA512
7bae94a7f03e22597e923c94b20e747f1983bb40d7bf4376276e66ca470fd9f668885236456e95cec4424952bcc2a2d1f39883f05e2c396791ed816c437cad91

Download Submit
C:\Windows\System\ojLveOp.exe

Filesize
2.2MB

MD5
205005407d7e39b6a07b5480d9fb4236

SHA1
6dee025788374532b1bd2598c2ac636413b8876f

SHA256
0ff5cb91e796baa2b3358f20c78486a64a23180eb1d090afa2fe2ff13509a2ae

SHA512
95f65548123d09e366bb0681283dd5214a221f29bc65971c9331d7c5ab7a9688524488f2df5910c6891082a865404f721f33ebc81cbd463f144d886e1431cc06

Download Submit
C:\Windows\System\pJJNNUh.exe

Filesize
2.2MB

MD5
051de0a529bb61c116c86441b4f945b2

SHA1
4ad589f95f167d20080ecff4ae2a223779d8a54c

SHA256
4aa1282abc6ea0e2fc6d0484faf752df3ea3ba230e78543eb79facf386e419b4

SHA512
20182379d06ac2fd3cf4e7478b0d6f0a7527d19b9c7b569bdcb3f6acb0606c40a79fbabe5622c8639720aec02f244a9344dc59d6aa793c74182b9ecfb4bea118

Download Submit
C:\Windows\System\qQdrrxN.exe

Filesize
2.2MB

MD5
b798eb3d098dd6e303dceeae30feb33e

SHA1
a9378fe558033cc302fcb44f7087ca4d538e0be8

SHA256
42bbe3e2afd59ac5a84bce37b03f507fbcd36bd5396041fc52ea9c1aae39ecf1

SHA512
ef11f935efc3404f77020b05d06f64dae507c2fec9cd53015e5d111297083d28ea22bfa31bc7ddd3e122a1524638f9b8959b7bf410c8f4fa198f5949c3f381ef

Download Submit
C:\Windows\System\rFKSxtb.exe

Filesize
2.2MB

MD5
f7512f18125c46645e437798a4ce7042

SHA1
cad1fcaa2b7cd90c7aaeb9fe464c24945b262259

SHA256
8cf11f1926c65315a96cd15dbefa5e3db4ce6cb760db77e57da605bebcad9b1a

SHA512
b351dde37008855250b2764ab5f25bf9aecf5eae70e8a6304299ef0751e3327a7584ed779756f643a4cf2357cc968753aa53e62e3692018286c3aad6db9397ae

Download Submit
C:\Windows\System\szyEbPB.exe

Filesize
2.2MB

MD5
fa28209915f479648350c440f1c3dcfa

SHA1
2e99c948ea8c291d7e1809ccbd5ee7f2341bde5e

SHA256
d3567ed22e55778496b6a703c9f54d25be332eda0a3afb6953cd54dcb7749146

SHA512
4d5799dd113fc220d11b1c88817579f8b375def65f51305fc1fc2677f06efe03d8d1fcaf15d6d13154d0e7da36e6396d55d7c8d3f6a1cd229eeac6162200b823

Download Submit
C:\Windows\System\wRgBvMO.exe

Filesize
2.2MB

MD5
5c288530c761d15d63fb78f9fed60ff8

SHA1
0f14528b0c6b2745d9f035f6d06c16fe54aa1cfe

SHA256
a5fb20e0eb414d53f8daa1f1a8cb20dfd2059c501333693370f107b4a79a08b7

SHA512
18967edb9f70fd04b934aaaaf52f40517bb5b6e31d9684d239caea9833337769e65056c5cc322fbe4cb8583dd956ce6945316e9e6dcf0ed8e3361a8b2ee1f23b

Download Submit
C:\Windows\System\wvDJpUe.exe

Filesize
2.2MB

MD5
5ee11a33b56d95b9779f59ac2364ed60

SHA1
8b56b349f8e38f100eef901c3e68b6251c2c9443

SHA256
3c2c5598780d0982cd91add4704240a756c25c1e414093b65d83f856a7b1abeb

SHA512
f6fdc26be6724213648f3b3530a4b757e11bbc20a4169a2f6918f2b39ac127e8233b699cec425c2e697509a4b09557107f9137de4a406a6898ddd8af26c434eb

Download Submit
C:\Windows\System\xLedjIY.exe

Filesize
2.2MB

MD5
9f61eb522d8a0e0bdf3dc155200e1736

SHA1
fa26f2036007ade8982fd84f6a5d6257ef97c750

SHA256
51d049a2177161c3d021c946fedfcb31a3227f471c334af291e30289467cacab

SHA512
a635d479d725095fad2396d81d312f54364cbc1b8ba29879ab22704d44b9a3d12e63f74f362d7d31f83203620b2adeae437fbad2e3ec06ea82b6e49710f20ae2

Download Submit
C:\Windows\System\yQDQFSU.exe

Filesize
2.2MB

MD5
03e6b66009bd8338f27f39cda7601bfd

SHA1
fd5ec7928226d673256c1284773ca7440c349719

SHA256
18c570343f47d88ebc5abfbcc351278f95db27f7b4639cf361172239ee385da7

SHA512
8803365099084d4f1e917fa6ed1e30c2f76c23461255519f7f47ad9d66e4f7f75d1b4283707f439d826107aa2d2826816f04d321a298098b9d851e897a7b9c43

Download Submit
C:\Windows\System\zZMmWDh.exe

Filesize
2.2MB

MD5
a0807bdaa9e36d31dd8e0fb9f365711f

SHA1
b549a4285ed736b52e2de3ecb5d5f1ad21444216

SHA256
786f85194d918c327acb212f078335c9789c23cf3d18deeeca2199dbf80ed9d1

SHA512
8a1bdcc9a3a6dce34979f9a134a3d7e467162bebd7d735ca760b980331c92348bc896cce3e046c168754ec52c988c66ffd0031a650a929434741d1018e28d7b3

Download Submit
memory/816-58-0x00007FF634F10000-0x00007FF635302000-memory.dmp

Filesize
3.9MB

Download
memory/816-2142-0x00007FF634F10000-0x00007FF635302000-memory.dmp

Filesize
3.9MB

Download
memory/1244-112-0x00007FF7D4640000-0x00007FF7D4A32000-memory.dmp

Filesize
3.9MB

Download
memory/1244-2160-0x00007FF7D4640000-0x00007FF7D4A32000-memory.dmp

Filesize
3.9MB

Download
memory/1496-1-0x0000023CAE710000-0x0000023CAE720000-memory.dmp

Filesize
64KB

Download
memory/1496-0-0x00007FF720490000-0x00007FF720882000-memory.dmp

Filesize
3.9MB

Download
memory/1556-135-0x00007FF65B360000-0x00007FF65B752000-memory.dmp

Filesize
3.9MB

Download
memory/1556-2169-0x00007FF65B360000-0x00007FF65B752000-memory.dmp

Filesize
3.9MB

Download
memory/1576-2177-0x00007FF6BF710000-0x00007FF6BFB02000-memory.dmp

Filesize
3.9MB

Download
memory/1576-118-0x00007FF6BF710000-0x00007FF6BFB02000-memory.dmp

Filesize
3.9MB

Download
memory/1720-2138-0x00007FF7A0420000-0x00007FF7A0812000-memory.dmp

Filesize
3.9MB

Download
memory/1720-10-0x00007FF7A0420000-0x00007FF7A0812000-memory.dmp

Filesize
3.9MB

Download
memory/1720-2124-0x00007FF7A0420000-0x00007FF7A0812000-memory.dmp

Filesize
3.9MB

Download
memory/2028-2158-0x00007FF78FE70000-0x00007FF790262000-memory.dmp

Filesize
3.9MB

Download
memory/2028-113-0x00007FF78FE70000-0x00007FF790262000-memory.dmp

Filesize
3.9MB

Download
memory/2084-101-0x00007FF6BC1F0000-0x00007FF6BC5E2000-memory.dmp

Filesize
3.9MB

Download
memory/2084-2157-0x00007FF6BC1F0000-0x00007FF6BC5E2000-memory.dmp

Filesize
3.9MB

Download
memory/2316-128-0x00007FF63B200000-0x00007FF63B5F2000-memory.dmp

Filesize
3.9MB

Download
memory/2316-2179-0x00007FF63B200000-0x00007FF63B5F2000-memory.dmp

Filesize
3.9MB

Download
memory/2796-75-0x00007FF65D1D0000-0x00007FF65D5C2000-memory.dmp

Filesize
3.9MB

Download
memory/2796-2152-0x00007FF65D1D0000-0x00007FF65D5C2000-memory.dmp

Filesize
3.9MB

Download
memory/2916-2180-0x00007FF7FD9F0000-0x00007FF7FDDE2000-memory.dmp

Filesize
3.9MB

Download
memory/2916-154-0x00007FF7FD9F0000-0x00007FF7FDDE2000-memory.dmp

Filesize
3.9MB

Download
memory/3148-2154-0x00007FF6764C0000-0x00007FF6768B2000-memory.dmp

Filesize
3.9MB

Download
memory/3148-94-0x00007FF6764C0000-0x00007FF6768B2000-memory.dmp

Filesize
3.9MB

Download
memory/3316-79-0x00007FF7107A0000-0x00007FF710B92000-memory.dmp

Filesize
3.9MB

Download
memory/3316-2150-0x00007FF7107A0000-0x00007FF710B92000-memory.dmp

Filesize
3.9MB

Download
memory/3344-68-0x00007FF6CCC20000-0x00007FF6CD012000-memory.dmp

Filesize
3.9MB

Download
memory/3344-2144-0x00007FF6CCC20000-0x00007FF6CD012000-memory.dmp

Filesize
3.9MB

Download
memory/3368-124-0x00007FF6EF290000-0x00007FF6EF682000-memory.dmp

Filesize
3.9MB

Download
memory/3368-2163-0x00007FF6EF290000-0x00007FF6EF682000-memory.dmp

Filesize
3.9MB

Download
memory/3840-37-0x0000027353350000-0x0000027353360000-memory.dmp

Filesize
64KB

Download
memory/3840-93-0x00000273532C0000-0x00000273532E2000-memory.dmp

Filesize
136KB

Download
memory/3840-38-0x0000027353350000-0x0000027353360000-memory.dmp

Filesize
64KB

Download
memory/3840-30-0x00007FFE2B310000-0x00007FFE2BDD1000-memory.dmp

Filesize
10.8MB

Download
memory/4364-2146-0x00007FF7D00C0000-0x00007FF7D04B2000-memory.dmp

Filesize
3.9MB

Download
memory/4364-50-0x00007FF7D00C0000-0x00007FF7D04B2000-memory.dmp

Filesize
3.9MB

Download
memory/4364-2123-0x00007FF7D00C0000-0x00007FF7D04B2000-memory.dmp

Filesize
3.9MB

Download
memory/4372-153-0x00007FF72B270000-0x00007FF72B662000-memory.dmp

Filesize
3.9MB

Download
memory/4372-2172-0x00007FF72B270000-0x00007FF72B662000-memory.dmp

Filesize
3.9MB

Download
memory/4520-141-0x00007FF687D90000-0x00007FF688182000-memory.dmp

Filesize
3.9MB

Download
memory/4520-2167-0x00007FF687D90000-0x00007FF688182000-memory.dmp

Filesize
3.9MB

Download
memory/4592-129-0x00007FF7B2DC0000-0x00007FF7B31B2000-memory.dmp

Filesize
3.9MB

Download
memory/4592-2165-0x00007FF7B2DC0000-0x00007FF7B31B2000-memory.dmp

Filesize
3.9MB

Download
memory/4660-80-0x00007FF6CBD00000-0x00007FF6CC0F2000-memory.dmp

Filesize
3.9MB

Download
memory/4660-2148-0x00007FF6CBD00000-0x00007FF6CC0F2000-memory.dmp

Filesize
3.9MB

Download
memory/4896-2140-0x00007FF714760000-0x00007FF714B52000-memory.dmp

Filesize
3.9MB

Download
memory/4896-108-0x00007FF714760000-0x00007FF714B52000-memory.dmp

Filesize
3.9MB

Download
memory/5052-147-0x00007FF6441E0000-0x00007FF6445D2000-memory.dmp

Filesize
3.9MB

Download
memory/5052-2173-0x00007FF6441E0000-0x00007FF6445D2000-memory.dmp

Filesize
3.9MB

Download