xmrig | edf05075511fa8aa7c2a67a050521bc879b1f4bbefd71d515a120fe76bc62eac

Analysis

max time kernel
65s
max time network
57s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 20:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
Size

2.3MB
MD5

039536860792d739ae27f15a568b9bd8
SHA1

a5cceca1d0f7fd86b69f53bc9b61f296ae187998
SHA256

edf05075511fa8aa7c2a67a050521bc879b1f4bbefd71d515a120fe76bc62eac
SHA512

454c1cd5dc0f629e8c5e792b7bddb5474db853e158778c915eef1fe0db9026a926ce2176ed70239a73fd6f5e7f03593e013a9b5a0d94219ab7a79254d761b54a
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9ceP5:NABk

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 42 IoCs

miner

resource	yara_rule
behavioral2/memory/1496-32-0x00007FF6E6D90000-0x00007FF6E7182000-memory.dmp	xmrig
behavioral2/memory/1436-83-0x00007FF7123A0000-0x00007FF712792000-memory.dmp	xmrig
behavioral2/memory/1052-86-0x00007FF719DC0000-0x00007FF71A1B2000-memory.dmp	xmrig
behavioral2/memory/2924-90-0x00007FF68BA20000-0x00007FF68BE12000-memory.dmp	xmrig
behavioral2/memory/3336-95-0x00007FF682250000-0x00007FF682642000-memory.dmp	xmrig
behavioral2/memory/2284-98-0x00007FF6C8F40000-0x00007FF6C9332000-memory.dmp	xmrig
behavioral2/memory/3252-93-0x00007FF6E50E0000-0x00007FF6E54D2000-memory.dmp	xmrig
behavioral2/memory/2128-89-0x00007FF7B3FE0000-0x00007FF7B43D2000-memory.dmp	xmrig
behavioral2/memory/2632-80-0x00007FF6731A0000-0x00007FF673592000-memory.dmp	xmrig
behavioral2/memory/3188-77-0x00007FF7D0D90000-0x00007FF7D1182000-memory.dmp	xmrig
behavioral2/memory/2308-39-0x00007FF6E74B0000-0x00007FF6E78A2000-memory.dmp	xmrig
behavioral2/memory/4824-605-0x00007FF646A10000-0x00007FF646E02000-memory.dmp	xmrig
behavioral2/memory/1080-615-0x00007FF72AD80000-0x00007FF72B172000-memory.dmp	xmrig
behavioral2/memory/2464-611-0x00007FF602DE0000-0x00007FF6031D2000-memory.dmp	xmrig
behavioral2/memory/4964-604-0x00007FF698200000-0x00007FF6985F2000-memory.dmp	xmrig
behavioral2/memory/2788-1759-0x00007FF6F44A0000-0x00007FF6F4892000-memory.dmp	xmrig
behavioral2/memory/3196-2111-0x00007FF6911B0000-0x00007FF6915A2000-memory.dmp	xmrig
behavioral2/memory/4240-2144-0x00007FF708310000-0x00007FF708702000-memory.dmp	xmrig
behavioral2/memory/1488-2145-0x00007FF65D4B0000-0x00007FF65D8A2000-memory.dmp	xmrig
behavioral2/memory/868-2149-0x00007FF607230000-0x00007FF607622000-memory.dmp	xmrig
behavioral2/memory/4632-2150-0x00007FF766EB0000-0x00007FF7672A2000-memory.dmp	xmrig
behavioral2/memory/3196-2152-0x00007FF6911B0000-0x00007FF6915A2000-memory.dmp	xmrig
behavioral2/memory/2788-2155-0x00007FF6F44A0000-0x00007FF6F4892000-memory.dmp	xmrig
behavioral2/memory/1496-2156-0x00007FF6E6D90000-0x00007FF6E7182000-memory.dmp	xmrig
behavioral2/memory/3188-2161-0x00007FF7D0D90000-0x00007FF7D1182000-memory.dmp	xmrig
behavioral2/memory/2632-2159-0x00007FF6731A0000-0x00007FF673592000-memory.dmp	xmrig
behavioral2/memory/2308-2162-0x00007FF6E74B0000-0x00007FF6E78A2000-memory.dmp	xmrig
behavioral2/memory/3252-2172-0x00007FF6E50E0000-0x00007FF6E54D2000-memory.dmp	xmrig
behavioral2/memory/2128-2171-0x00007FF7B3FE0000-0x00007FF7B43D2000-memory.dmp	xmrig
behavioral2/memory/1052-2168-0x00007FF719DC0000-0x00007FF71A1B2000-memory.dmp	xmrig
behavioral2/memory/1436-2166-0x00007FF7123A0000-0x00007FF712792000-memory.dmp	xmrig
behavioral2/memory/2924-2165-0x00007FF68BA20000-0x00007FF68BE12000-memory.dmp	xmrig
behavioral2/memory/2284-2183-0x00007FF6C8F40000-0x00007FF6C9332000-memory.dmp	xmrig
behavioral2/memory/3336-2188-0x00007FF682250000-0x00007FF682642000-memory.dmp	xmrig
behavioral2/memory/1080-2192-0x00007FF72AD80000-0x00007FF72B172000-memory.dmp	xmrig
behavioral2/memory/2464-2190-0x00007FF602DE0000-0x00007FF6031D2000-memory.dmp	xmrig
behavioral2/memory/4240-2184-0x00007FF708310000-0x00007FF708702000-memory.dmp	xmrig
behavioral2/memory/4824-2186-0x00007FF646A10000-0x00007FF646E02000-memory.dmp	xmrig
behavioral2/memory/1488-2179-0x00007FF65D4B0000-0x00007FF65D8A2000-memory.dmp	xmrig
behavioral2/memory/868-2176-0x00007FF607230000-0x00007FF607622000-memory.dmp	xmrig
behavioral2/memory/4632-2175-0x00007FF766EB0000-0x00007FF7672A2000-memory.dmp	xmrig
behavioral2/memory/4964-2180-0x00007FF698200000-0x00007FF6985F2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3196	nfiVSfS.exe
2788	pCQqwlB.exe
1496	NlmrdPR.exe
2308	YbWmUmN.exe
3188	YfJIpVu.exe
2632	bCsjMMb.exe
2924	CAVzmxT.exe
1436	hTpsphB.exe
1052	bUjNhoE.exe
3252	kmuruPG.exe
2128	IfVHsSw.exe
3336	NZqqnEK.exe
2284	kZuVEOx.exe
4240	KVRbDle.exe
1488	DDaGMXd.exe
868	botzIii.exe
4632	VATWhWh.exe
4964	EUPhhXA.exe
4824	TssxIny.exe
2464	ycjVikO.exe
1080	ZkeceWl.exe
4648	gJtQkco.exe
1000	vzDQwhE.exe
516	dVSlFgZ.exe
3612	umGuewp.exe
2468	KduiTCH.exe
3592	tMYqFPG.exe
4884	uGnhbtN.exe
2028	DzelIaR.exe
2260	jjQnxbq.exe
2952	QXjgnWh.exe
1800	lMQiObL.exe
4936	yTtbKEy.exe
5108	dVDxcTF.exe
4456	XyvkHZr.exe
2380	NOPLepT.exe
3272	HkWsHCa.exe
3260	NMJDhWf.exe
4492	RXiVTar.exe
2988	FyvoEDc.exe
2940	JCgwnbe.exe
4440	zHnAUFB.exe
4384	XykPDVn.exe
3932	gOCKiFU.exe
4312	SggpSEY.exe
2156	zvMNaKP.exe
3060	LFAfBzt.exe
3288	tiTrhdH.exe
2564	RazhnkK.exe
1900	ilmOguz.exe
3064	RbmSCss.exe
2440	JyegQuZ.exe
5016	VfTlHSM.exe
1784	vZvgDbl.exe
4488	AuWugtt.exe
2188	zyUwgbk.exe
1908	IWDqxhy.exe
696	RYuJbqo.exe
1536	MoGaqQi.exe
3268	QZjmPLd.exe
1980	onMUuSD.exe
3812	VhtImtk.exe
860	tjuueUB.exe
3776	gZGaHcL.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1020-0-0x00007FF624170000-0x00007FF624562000-memory.dmp	upx
behavioral2/files/0x000a000000023bb1-7.dat	upx
behavioral2/files/0x000d000000023bac-11.dat	upx
behavioral2/memory/3196-13-0x00007FF6911B0000-0x00007FF6915A2000-memory.dmp	upx
behavioral2/files/0x000a000000023bb2-17.dat	upx
behavioral2/files/0x000a000000023bb0-18.dat	upx
behavioral2/memory/1496-32-0x00007FF6E6D90000-0x00007FF6E7182000-memory.dmp	upx
behavioral2/files/0x0031000000023bb5-42.dat	upx
behavioral2/files/0x0031000000023bb6-58.dat	upx
behavioral2/files/0x000a000000023bba-71.dat	upx
behavioral2/files/0x000b000000023bb9-78.dat	upx
behavioral2/memory/1436-83-0x00007FF7123A0000-0x00007FF712792000-memory.dmp	upx
behavioral2/memory/1052-86-0x00007FF719DC0000-0x00007FF71A1B2000-memory.dmp	upx
behavioral2/memory/2924-90-0x00007FF68BA20000-0x00007FF68BE12000-memory.dmp	upx
behavioral2/memory/3336-95-0x00007FF682250000-0x00007FF682642000-memory.dmp	upx
behavioral2/files/0x000a000000023bbd-105.dat	upx
behavioral2/files/0x000a000000023bc4-149.dat	upx
behavioral2/files/0x000a000000023bce-193.dat	upx
behavioral2/files/0x000a000000023bcc-189.dat	upx
behavioral2/files/0x000a000000023bcd-188.dat	upx
behavioral2/files/0x000a000000023bcb-183.dat	upx
behavioral2/files/0x000a000000023bca-179.dat	upx
behavioral2/files/0x000a000000023bc9-173.dat	upx
behavioral2/files/0x000a000000023bc8-169.dat	upx
behavioral2/files/0x000a000000023bc7-164.dat	upx
behavioral2/files/0x000a000000023bc6-159.dat	upx
behavioral2/files/0x000a000000023bc5-154.dat	upx
behavioral2/files/0x000a000000023bc3-143.dat	upx
behavioral2/files/0x000a000000023bc2-139.dat	upx
behavioral2/files/0x000a000000023bc1-134.dat	upx
behavioral2/files/0x000a000000023bc0-128.dat	upx
behavioral2/files/0x000a000000023bbf-124.dat	upx
behavioral2/files/0x000a000000023bbe-116.dat	upx
behavioral2/memory/4632-115-0x00007FF766EB0000-0x00007FF7672A2000-memory.dmp	upx
behavioral2/memory/868-112-0x00007FF607230000-0x00007FF607622000-memory.dmp	upx
behavioral2/files/0x000a000000023bbc-109.dat	upx
behavioral2/memory/1488-108-0x00007FF65D4B0000-0x00007FF65D8A2000-memory.dmp	upx
behavioral2/memory/4240-104-0x00007FF708310000-0x00007FF708702000-memory.dmp	upx
behavioral2/memory/2284-98-0x00007FF6C8F40000-0x00007FF6C9332000-memory.dmp	upx
behavioral2/files/0x000a000000023bbb-94.dat	upx
behavioral2/memory/3252-93-0x00007FF6E50E0000-0x00007FF6E54D2000-memory.dmp	upx
behavioral2/memory/2128-89-0x00007FF7B3FE0000-0x00007FF7B43D2000-memory.dmp	upx
behavioral2/files/0x000b000000023bb8-87.dat	upx
behavioral2/memory/2632-80-0x00007FF6731A0000-0x00007FF673592000-memory.dmp	upx
behavioral2/memory/3188-77-0x00007FF7D0D90000-0x00007FF7D1182000-memory.dmp	upx
behavioral2/files/0x000c000000023bad-73.dat	upx
behavioral2/files/0x000a000000023bb7-64.dat	upx
behavioral2/memory/2308-39-0x00007FF6E74B0000-0x00007FF6E78A2000-memory.dmp	upx
behavioral2/files/0x000a000000023bb3-38.dat	upx
behavioral2/files/0x0031000000023bb4-34.dat	upx
behavioral2/memory/2788-28-0x00007FF6F44A0000-0x00007FF6F4892000-memory.dmp	upx
behavioral2/memory/4824-605-0x00007FF646A10000-0x00007FF646E02000-memory.dmp	upx
behavioral2/memory/1080-615-0x00007FF72AD80000-0x00007FF72B172000-memory.dmp	upx
behavioral2/memory/2464-611-0x00007FF602DE0000-0x00007FF6031D2000-memory.dmp	upx
behavioral2/memory/4964-604-0x00007FF698200000-0x00007FF6985F2000-memory.dmp	upx
behavioral2/memory/2788-1759-0x00007FF6F44A0000-0x00007FF6F4892000-memory.dmp	upx
behavioral2/memory/3196-2111-0x00007FF6911B0000-0x00007FF6915A2000-memory.dmp	upx
behavioral2/memory/4240-2144-0x00007FF708310000-0x00007FF708702000-memory.dmp	upx
behavioral2/memory/1488-2145-0x00007FF65D4B0000-0x00007FF65D8A2000-memory.dmp	upx
behavioral2/memory/868-2149-0x00007FF607230000-0x00007FF607622000-memory.dmp	upx
behavioral2/memory/4632-2150-0x00007FF766EB0000-0x00007FF7672A2000-memory.dmp	upx
behavioral2/memory/3196-2152-0x00007FF6911B0000-0x00007FF6915A2000-memory.dmp	upx
behavioral2/memory/2788-2155-0x00007FF6F44A0000-0x00007FF6F4892000-memory.dmp	upx
behavioral2/memory/1496-2156-0x00007FF6E6D90000-0x00007FF6E7182000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\UkVjBld.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\botzIii.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\GrQuxyF.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\JrnZFfH.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\ZkeceWl.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\JwhbJPB.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\cSSwCIS.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\JyegQuZ.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\gZGaHcL.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\WrikcJn.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\znTpWBX.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\kCBfuEg.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\NZpOTQn.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\FEkdmuW.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\KvbGnSA.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\YbWmUmN.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\DzelIaR.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\dVDxcTF.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\bVjYyvo.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\cSZdpCU.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\EOguthf.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\gAMsqoO.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\AFitjdw.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\kehFXCR.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\SWucjvy.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\ycjVikO.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\vMTzBZT.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\fTJEoDx.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\rBWBMdB.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\tJTZyVy.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\gIrzEZO.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\MZnQlvC.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\GxFapKX.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\ahVJstw.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\KdNocwW.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\djjWCCV.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\csdWRCq.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\NMJDhWf.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\QBFqAnd.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\SnPbCVt.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\PEnpxWe.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\rPxIEyp.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\XjIgFvX.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\QhGopJP.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\TDjKXND.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\eFSFinL.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\AuWugtt.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\mNZXeZq.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\uLFthlA.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\aQatYfD.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\IsYpGbl.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\QGZQhTX.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\jCTwfCO.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\xDCwVLz.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\fPWIZTz.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\zHnAUFB.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\oKmtNQp.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\RTpfaFw.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\ybcbrYS.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\iNkUZYK.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\ebtBdnT.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\isIOTea.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\DsjKSrD.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\llcLbIT.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3248	powershell.exe
3248	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3248	powershell.exe
Token: SeLockMemoryPrivilege	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1020 wrote to memory of 3248	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	84
PID 1020 wrote to memory of 3248	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	84
PID 1020 wrote to memory of 3196	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	85
PID 1020 wrote to memory of 3196	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	85
PID 1020 wrote to memory of 2788	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	86
PID 1020 wrote to memory of 2788	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	86
PID 1020 wrote to memory of 1496	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	87
PID 1020 wrote to memory of 1496	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	87
PID 1020 wrote to memory of 2308	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	88
PID 1020 wrote to memory of 2308	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	88
PID 1020 wrote to memory of 3188	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	89
PID 1020 wrote to memory of 3188	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	89
PID 1020 wrote to memory of 2632	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	90
PID 1020 wrote to memory of 2632	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	90
PID 1020 wrote to memory of 2924	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	91
PID 1020 wrote to memory of 2924	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	91
PID 1020 wrote to memory of 1436	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	92
PID 1020 wrote to memory of 1436	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	92
PID 1020 wrote to memory of 1052	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	93
PID 1020 wrote to memory of 1052	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	93
PID 1020 wrote to memory of 3252	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	94
PID 1020 wrote to memory of 3252	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	94
PID 1020 wrote to memory of 2128	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	95
PID 1020 wrote to memory of 2128	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	95
PID 1020 wrote to memory of 3336	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	96
PID 1020 wrote to memory of 3336	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	96
PID 1020 wrote to memory of 2284	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	97
PID 1020 wrote to memory of 2284	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	97
PID 1020 wrote to memory of 4240	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	98
PID 1020 wrote to memory of 4240	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	98
PID 1020 wrote to memory of 1488	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	99
PID 1020 wrote to memory of 1488	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	99
PID 1020 wrote to memory of 868	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	100
PID 1020 wrote to memory of 868	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	100
PID 1020 wrote to memory of 4632	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	101
PID 1020 wrote to memory of 4632	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	101
PID 1020 wrote to memory of 4964	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	102
PID 1020 wrote to memory of 4964	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	102
PID 1020 wrote to memory of 4824	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	103
PID 1020 wrote to memory of 4824	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	103
PID 1020 wrote to memory of 2464	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	104
PID 1020 wrote to memory of 2464	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	104
PID 1020 wrote to memory of 1080	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	105
PID 1020 wrote to memory of 1080	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	105
PID 1020 wrote to memory of 4648	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	106
PID 1020 wrote to memory of 4648	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	106
PID 1020 wrote to memory of 1000	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	107
PID 1020 wrote to memory of 1000	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	107
PID 1020 wrote to memory of 516	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	108
PID 1020 wrote to memory of 516	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	108
PID 1020 wrote to memory of 3612	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	109
PID 1020 wrote to memory of 3612	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	109
PID 1020 wrote to memory of 2468	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	110
PID 1020 wrote to memory of 2468	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	110
PID 1020 wrote to memory of 3592	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	111
PID 1020 wrote to memory of 3592	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	111
PID 1020 wrote to memory of 4884	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	112
PID 1020 wrote to memory of 4884	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	112
PID 1020 wrote to memory of 2028	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	113
PID 1020 wrote to memory of 2028	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	113
PID 1020 wrote to memory of 2260	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	114
PID 1020 wrote to memory of 2260	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	114
PID 1020 wrote to memory of 2952	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	115
PID 1020 wrote to memory of 2952	1020	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3248
- C:\Windows\System\nfiVSfS.exe
  C:\Windows\System\nfiVSfS.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\pCQqwlB.exe
  C:\Windows\System\pCQqwlB.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\NlmrdPR.exe
  C:\Windows\System\NlmrdPR.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\YbWmUmN.exe
  C:\Windows\System\YbWmUmN.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\YfJIpVu.exe
  C:\Windows\System\YfJIpVu.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System\bCsjMMb.exe
  C:\Windows\System\bCsjMMb.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\CAVzmxT.exe
  C:\Windows\System\CAVzmxT.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\hTpsphB.exe
  C:\Windows\System\hTpsphB.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\bUjNhoE.exe
  C:\Windows\System\bUjNhoE.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\kmuruPG.exe
  C:\Windows\System\kmuruPG.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\System\IfVHsSw.exe
  C:\Windows\System\IfVHsSw.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\NZqqnEK.exe
  C:\Windows\System\NZqqnEK.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\kZuVEOx.exe
  C:\Windows\System\kZuVEOx.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\KVRbDle.exe
  C:\Windows\System\KVRbDle.exe
  2⤵
  - Executes dropped EXE
  PID:4240
- C:\Windows\System\DDaGMXd.exe
  C:\Windows\System\DDaGMXd.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\botzIii.exe
  C:\Windows\System\botzIii.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\VATWhWh.exe
  C:\Windows\System\VATWhWh.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\EUPhhXA.exe
  C:\Windows\System\EUPhhXA.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\TssxIny.exe
  C:\Windows\System\TssxIny.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\ycjVikO.exe
  C:\Windows\System\ycjVikO.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\ZkeceWl.exe
  C:\Windows\System\ZkeceWl.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\gJtQkco.exe
  C:\Windows\System\gJtQkco.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\vzDQwhE.exe
  C:\Windows\System\vzDQwhE.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\dVSlFgZ.exe
  C:\Windows\System\dVSlFgZ.exe
  2⤵
  - Executes dropped EXE
  PID:516
- C:\Windows\System\umGuewp.exe
  C:\Windows\System\umGuewp.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\KduiTCH.exe
  C:\Windows\System\KduiTCH.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\tMYqFPG.exe
  C:\Windows\System\tMYqFPG.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\uGnhbtN.exe
  C:\Windows\System\uGnhbtN.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\DzelIaR.exe
  C:\Windows\System\DzelIaR.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\jjQnxbq.exe
  C:\Windows\System\jjQnxbq.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\QXjgnWh.exe
  C:\Windows\System\QXjgnWh.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\lMQiObL.exe
  C:\Windows\System\lMQiObL.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\yTtbKEy.exe
  C:\Windows\System\yTtbKEy.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\dVDxcTF.exe
  C:\Windows\System\dVDxcTF.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\XyvkHZr.exe
  C:\Windows\System\XyvkHZr.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\NOPLepT.exe
  C:\Windows\System\NOPLepT.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\HkWsHCa.exe
  C:\Windows\System\HkWsHCa.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\NMJDhWf.exe
  C:\Windows\System\NMJDhWf.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\RXiVTar.exe
  C:\Windows\System\RXiVTar.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\FyvoEDc.exe
  C:\Windows\System\FyvoEDc.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\JCgwnbe.exe
  C:\Windows\System\JCgwnbe.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\zHnAUFB.exe
  C:\Windows\System\zHnAUFB.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\XykPDVn.exe
  C:\Windows\System\XykPDVn.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\gOCKiFU.exe
  C:\Windows\System\gOCKiFU.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\SggpSEY.exe
  C:\Windows\System\SggpSEY.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\zvMNaKP.exe
  C:\Windows\System\zvMNaKP.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\LFAfBzt.exe
  C:\Windows\System\LFAfBzt.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\tiTrhdH.exe
  C:\Windows\System\tiTrhdH.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\RazhnkK.exe
  C:\Windows\System\RazhnkK.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\ilmOguz.exe
  C:\Windows\System\ilmOguz.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\RbmSCss.exe
  C:\Windows\System\RbmSCss.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\JyegQuZ.exe
  C:\Windows\System\JyegQuZ.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\VfTlHSM.exe
  C:\Windows\System\VfTlHSM.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\vZvgDbl.exe
  C:\Windows\System\vZvgDbl.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\AuWugtt.exe
  C:\Windows\System\AuWugtt.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\zyUwgbk.exe
  C:\Windows\System\zyUwgbk.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\IWDqxhy.exe
  C:\Windows\System\IWDqxhy.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\RYuJbqo.exe
  C:\Windows\System\RYuJbqo.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\MoGaqQi.exe
  C:\Windows\System\MoGaqQi.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\QZjmPLd.exe
  C:\Windows\System\QZjmPLd.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\onMUuSD.exe
  C:\Windows\System\onMUuSD.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\VhtImtk.exe
  C:\Windows\System\VhtImtk.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\tjuueUB.exe
  C:\Windows\System\tjuueUB.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\gZGaHcL.exe
  C:\Windows\System\gZGaHcL.exe
  2⤵
  - Executes dropped EXE
  PID:3776
- C:\Windows\System\wGjLkRo.exe
  C:\Windows\System\wGjLkRo.exe
  2⤵
  PID:4996
- C:\Windows\System\rJneXhU.exe
  C:\Windows\System\rJneXhU.exe
  2⤵
  PID:4860
- C:\Windows\System\HSQQYUp.exe
  C:\Windows\System\HSQQYUp.exe
  2⤵
  PID:4808
- C:\Windows\System\lJXmygr.exe
  C:\Windows\System\lJXmygr.exe
  2⤵
  PID:1736
- C:\Windows\System\GrQuxyF.exe
  C:\Windows\System\GrQuxyF.exe
  2⤵
  PID:2324
- C:\Windows\System\KymxMTw.exe
  C:\Windows\System\KymxMTw.exe
  2⤵
  PID:4724
- C:\Windows\System\CsJhdFg.exe
  C:\Windows\System\CsJhdFg.exe
  2⤵
  PID:2088
- C:\Windows\System\ZbwQmGq.exe
  C:\Windows\System\ZbwQmGq.exe
  2⤵
  PID:2984
- C:\Windows\System\YECWkTQ.exe
  C:\Windows\System\YECWkTQ.exe
  2⤵
  PID:224
- C:\Windows\System\QNXknsx.exe
  C:\Windows\System\QNXknsx.exe
  2⤵
  PID:3320
- C:\Windows\System\fqrRVyg.exe
  C:\Windows\System\fqrRVyg.exe
  2⤵
  PID:1540
- C:\Windows\System\OFFGCgW.exe
  C:\Windows\System\OFFGCgW.exe
  2⤵
  PID:1960
- C:\Windows\System\SrBEhlf.exe
  C:\Windows\System\SrBEhlf.exe
  2⤵
  PID:1816
- C:\Windows\System\sJzCPIc.exe
  C:\Windows\System\sJzCPIc.exe
  2⤵
  PID:4036
- C:\Windows\System\YNHUlJp.exe
  C:\Windows\System\YNHUlJp.exe
  2⤵
  PID:5068
- C:\Windows\System\twXjAAl.exe
  C:\Windows\System\twXjAAl.exe
  2⤵
  PID:2452
- C:\Windows\System\KIFUZse.exe
  C:\Windows\System\KIFUZse.exe
  2⤵
  PID:4640
- C:\Windows\System\EHkMFAI.exe
  C:\Windows\System\EHkMFAI.exe
  2⤵
  PID:5148
- C:\Windows\System\yfrbKzB.exe
  C:\Windows\System\yfrbKzB.exe
  2⤵
  PID:5172
- C:\Windows\System\FMTTZAF.exe
  C:\Windows\System\FMTTZAF.exe
  2⤵
  PID:5204
- C:\Windows\System\MYXQekY.exe
  C:\Windows\System\MYXQekY.exe
  2⤵
  PID:5232
- C:\Windows\System\bxblmHV.exe
  C:\Windows\System\bxblmHV.exe
  2⤵
  PID:5256
- C:\Windows\System\cIBOSKt.exe
  C:\Windows\System\cIBOSKt.exe
  2⤵
  PID:5288
- C:\Windows\System\TiANjyH.exe
  C:\Windows\System\TiANjyH.exe
  2⤵
  PID:5316
- C:\Windows\System\IjSjYwc.exe
  C:\Windows\System\IjSjYwc.exe
  2⤵
  PID:5344
- C:\Windows\System\sGGLjJw.exe
  C:\Windows\System\sGGLjJw.exe
  2⤵
  PID:5372
- C:\Windows\System\zJfOods.exe
  C:\Windows\System\zJfOods.exe
  2⤵
  PID:5400
- C:\Windows\System\bfcVWKw.exe
  C:\Windows\System\bfcVWKw.exe
  2⤵
  PID:5424
- C:\Windows\System\bVjYyvo.exe
  C:\Windows\System\bVjYyvo.exe
  2⤵
  PID:5456
- C:\Windows\System\ltwuswX.exe
  C:\Windows\System\ltwuswX.exe
  2⤵
  PID:5484
- C:\Windows\System\VtENXaU.exe
  C:\Windows\System\VtENXaU.exe
  2⤵
  PID:5512
- C:\Windows\System\gAMsqoO.exe
  C:\Windows\System\gAMsqoO.exe
  2⤵
  PID:5540
- C:\Windows\System\dhJyXpY.exe
  C:\Windows\System\dhJyXpY.exe
  2⤵
  PID:5568
- C:\Windows\System\jfWSbPo.exe
  C:\Windows\System\jfWSbPo.exe
  2⤵
  PID:5596
- C:\Windows\System\IRouejo.exe
  C:\Windows\System\IRouejo.exe
  2⤵
  PID:5624
- C:\Windows\System\IazTgGd.exe
  C:\Windows\System\IazTgGd.exe
  2⤵
  PID:5648
- C:\Windows\System\aVWRdSf.exe
  C:\Windows\System\aVWRdSf.exe
  2⤵
  PID:5680
- C:\Windows\System\CXlNksY.exe
  C:\Windows\System\CXlNksY.exe
  2⤵
  PID:5708
- C:\Windows\System\grLeCbR.exe
  C:\Windows\System\grLeCbR.exe
  2⤵
  PID:5732
- C:\Windows\System\bplRBTV.exe
  C:\Windows\System\bplRBTV.exe
  2⤵
  PID:5760
- C:\Windows\System\SyIvfvE.exe
  C:\Windows\System\SyIvfvE.exe
  2⤵
  PID:5788
- C:\Windows\System\TEtEngj.exe
  C:\Windows\System\TEtEngj.exe
  2⤵
  PID:5820
- C:\Windows\System\HqYRGvl.exe
  C:\Windows\System\HqYRGvl.exe
  2⤵
  PID:5844
- C:\Windows\System\xKaMKyF.exe
  C:\Windows\System\xKaMKyF.exe
  2⤵
  PID:5872
- C:\Windows\System\TxfVwfG.exe
  C:\Windows\System\TxfVwfG.exe
  2⤵
  PID:5904
- C:\Windows\System\YbvueKj.exe
  C:\Windows\System\YbvueKj.exe
  2⤵
  PID:5932
- C:\Windows\System\SGmlptZ.exe
  C:\Windows\System\SGmlptZ.exe
  2⤵
  PID:5960
- C:\Windows\System\TfaCLEo.exe
  C:\Windows\System\TfaCLEo.exe
  2⤵
  PID:5988
- C:\Windows\System\UHoTWiz.exe
  C:\Windows\System\UHoTWiz.exe
  2⤵
  PID:6016
- C:\Windows\System\mnLjNzE.exe
  C:\Windows\System\mnLjNzE.exe
  2⤵
  PID:6044
- C:\Windows\System\CRgRcYp.exe
  C:\Windows\System\CRgRcYp.exe
  2⤵
  PID:6072
- C:\Windows\System\yXkquVE.exe
  C:\Windows\System\yXkquVE.exe
  2⤵
  PID:6100
- C:\Windows\System\aAVUGaa.exe
  C:\Windows\System\aAVUGaa.exe
  2⤵
  PID:6128
- C:\Windows\System\kvkNkBN.exe
  C:\Windows\System\kvkNkBN.exe
  2⤵
  PID:4048
- C:\Windows\System\IDYuPHn.exe
  C:\Windows\System\IDYuPHn.exe
  2⤵
  PID:4980
- C:\Windows\System\cJakFpW.exe
  C:\Windows\System\cJakFpW.exe
  2⤵
  PID:4192
- C:\Windows\System\WvwxAif.exe
  C:\Windows\System\WvwxAif.exe
  2⤵
  PID:5136
- C:\Windows\System\cGnOdXY.exe
  C:\Windows\System\cGnOdXY.exe
  2⤵
  PID:5196
- C:\Windows\System\TGWpHEf.exe
  C:\Windows\System\TGWpHEf.exe
  2⤵
  PID:5272
- C:\Windows\System\euwsrWO.exe
  C:\Windows\System\euwsrWO.exe
  2⤵
  PID:5332
- C:\Windows\System\HoFQsSP.exe
  C:\Windows\System\HoFQsSP.exe
  2⤵
  PID:5388
- C:\Windows\System\sytpuOQ.exe
  C:\Windows\System\sytpuOQ.exe
  2⤵
  PID:5448
- C:\Windows\System\cjJDJKw.exe
  C:\Windows\System\cjJDJKw.exe
  2⤵
  PID:5504
- C:\Windows\System\UNzEFfh.exe
  C:\Windows\System\UNzEFfh.exe
  2⤵
  PID:5580
- C:\Windows\System\VOeWfpa.exe
  C:\Windows\System\VOeWfpa.exe
  2⤵
  PID:2140
- C:\Windows\System\AFitjdw.exe
  C:\Windows\System\AFitjdw.exe
  2⤵
  PID:5692
- C:\Windows\System\TcqnXpr.exe
  C:\Windows\System\TcqnXpr.exe
  2⤵
  PID:5748
- C:\Windows\System\ziuPfbh.exe
  C:\Windows\System\ziuPfbh.exe
  2⤵
  PID:5804
- C:\Windows\System\yNuCdIJ.exe
  C:\Windows\System\yNuCdIJ.exe
  2⤵
  PID:5860
- C:\Windows\System\xzcPNEZ.exe
  C:\Windows\System\xzcPNEZ.exe
  2⤵
  PID:5920
- C:\Windows\System\pomrBTc.exe
  C:\Windows\System\pomrBTc.exe
  2⤵
  PID:5980
- C:\Windows\System\edfCKbj.exe
  C:\Windows\System\edfCKbj.exe
  2⤵
  PID:6036
- C:\Windows\System\YQfbUXz.exe
  C:\Windows\System\YQfbUXz.exe
  2⤵
  PID:1028
- C:\Windows\System\VfikAZp.exe
  C:\Windows\System\VfikAZp.exe
  2⤵
  PID:980
- C:\Windows\System\bXZCCKV.exe
  C:\Windows\System\bXZCCKV.exe
  2⤵
  PID:2492
- C:\Windows\System\OMlDPuA.exe
  C:\Windows\System\OMlDPuA.exe
  2⤵
  PID:5188
- C:\Windows\System\JbKJaNh.exe
  C:\Windows\System\JbKJaNh.exe
  2⤵
  PID:5308
- C:\Windows\System\lZmxQhF.exe
  C:\Windows\System\lZmxQhF.exe
  2⤵
  PID:5440
- C:\Windows\System\tMkXgKV.exe
  C:\Windows\System\tMkXgKV.exe
  2⤵
  PID:5608
- C:\Windows\System\BWQVYRp.exe
  C:\Windows\System\BWQVYRp.exe
  2⤵
  PID:5720
- C:\Windows\System\XTMijEv.exe
  C:\Windows\System\XTMijEv.exe
  2⤵
  PID:1608
- C:\Windows\System\TkNTagC.exe
  C:\Windows\System\TkNTagC.exe
  2⤵
  PID:5948
- C:\Windows\System\OMFIEjC.exe
  C:\Windows\System\OMFIEjC.exe
  2⤵
  PID:6084
- C:\Windows\System\pYwxreL.exe
  C:\Windows\System\pYwxreL.exe
  2⤵
  PID:2336
- C:\Windows\System\ulCTmdQ.exe
  C:\Windows\System\ulCTmdQ.exe
  2⤵
  PID:5300
- C:\Windows\System\iSSaeso.exe
  C:\Windows\System\iSSaeso.exe
  2⤵
  PID:5612
- C:\Windows\System\FVTZqJQ.exe
  C:\Windows\System\FVTZqJQ.exe
  2⤵
  PID:5776
- C:\Windows\System\DsBzgkq.exe
  C:\Windows\System\DsBzgkq.exe
  2⤵
  PID:6168
- C:\Windows\System\CUscgOT.exe
  C:\Windows\System\CUscgOT.exe
  2⤵
  PID:6200
- C:\Windows\System\lhlLKcb.exe
  C:\Windows\System\lhlLKcb.exe
  2⤵
  PID:6228
- C:\Windows\System\bLAvDrs.exe
  C:\Windows\System\bLAvDrs.exe
  2⤵
  PID:6256
- C:\Windows\System\xwBWbRK.exe
  C:\Windows\System\xwBWbRK.exe
  2⤵
  PID:6284
- C:\Windows\System\mdMkwro.exe
  C:\Windows\System\mdMkwro.exe
  2⤵
  PID:6312
- C:\Windows\System\cSZdpCU.exe
  C:\Windows\System\cSZdpCU.exe
  2⤵
  PID:6336
- C:\Windows\System\LoZklnO.exe
  C:\Windows\System\LoZklnO.exe
  2⤵
  PID:6368
- C:\Windows\System\xRbhGJa.exe
  C:\Windows\System\xRbhGJa.exe
  2⤵
  PID:6396
- C:\Windows\System\oKmtNQp.exe
  C:\Windows\System\oKmtNQp.exe
  2⤵
  PID:6424
- C:\Windows\System\OSneqDt.exe
  C:\Windows\System\OSneqDt.exe
  2⤵
  PID:6452
- C:\Windows\System\DLNCdTq.exe
  C:\Windows\System\DLNCdTq.exe
  2⤵
  PID:6560
- C:\Windows\System\oVYMUwP.exe
  C:\Windows\System\oVYMUwP.exe
  2⤵
  PID:6576
- C:\Windows\System\XoqUMFS.exe
  C:\Windows\System\XoqUMFS.exe
  2⤵
  PID:6604
- C:\Windows\System\vROboHI.exe
  C:\Windows\System\vROboHI.exe
  2⤵
  PID:6628
- C:\Windows\System\IWwDwRv.exe
  C:\Windows\System\IWwDwRv.exe
  2⤵
  PID:6644
- C:\Windows\System\cqDlhAI.exe
  C:\Windows\System\cqDlhAI.exe
  2⤵
  PID:6668
- C:\Windows\System\faZXtUk.exe
  C:\Windows\System\faZXtUk.exe
  2⤵
  PID:6700
- C:\Windows\System\KiijXjm.exe
  C:\Windows\System\KiijXjm.exe
  2⤵
  PID:6724
- C:\Windows\System\kTLhBYF.exe
  C:\Windows\System\kTLhBYF.exe
  2⤵
  PID:6748
- C:\Windows\System\lhDDNBY.exe
  C:\Windows\System\lhDDNBY.exe
  2⤵
  PID:6768
- C:\Windows\System\mMAzxOh.exe
  C:\Windows\System\mMAzxOh.exe
  2⤵
  PID:6796
- C:\Windows\System\ybmvVUx.exe
  C:\Windows\System\ybmvVUx.exe
  2⤵
  PID:6848
- C:\Windows\System\KKqJngM.exe
  C:\Windows\System\KKqJngM.exe
  2⤵
  PID:6904
- C:\Windows\System\QGZQhTX.exe
  C:\Windows\System\QGZQhTX.exe
  2⤵
  PID:6956
- C:\Windows\System\zgdxjFz.exe
  C:\Windows\System\zgdxjFz.exe
  2⤵
  PID:6984
- C:\Windows\System\EugTBou.exe
  C:\Windows\System\EugTBou.exe
  2⤵
  PID:7008
- C:\Windows\System\eVBXWke.exe
  C:\Windows\System\eVBXWke.exe
  2⤵
  PID:7036
- C:\Windows\System\spkwHZG.exe
  C:\Windows\System\spkwHZG.exe
  2⤵
  PID:7052
- C:\Windows\System\hKDqkhI.exe
  C:\Windows\System\hKDqkhI.exe
  2⤵
  PID:7076
- C:\Windows\System\NVRzTtM.exe
  C:\Windows\System\NVRzTtM.exe
  2⤵
  PID:7100
- C:\Windows\System\hPXXIHV.exe
  C:\Windows\System\hPXXIHV.exe
  2⤵
  PID:7124
- C:\Windows\System\jCTwfCO.exe
  C:\Windows\System\jCTwfCO.exe
  2⤵
  PID:7160
- C:\Windows\System\UIixphf.exe
  C:\Windows\System\UIixphf.exe
  2⤵
  PID:6008
- C:\Windows\System\SOApXUZ.exe
  C:\Windows\System\SOApXUZ.exe
  2⤵
  PID:6120
- C:\Windows\System\QBFqAnd.exe
  C:\Windows\System\QBFqAnd.exe
  2⤵
  PID:5244
- C:\Windows\System\IuiEpKi.exe
  C:\Windows\System\IuiEpKi.exe
  2⤵
  PID:1580
- C:\Windows\System\wrueOCc.exe
  C:\Windows\System\wrueOCc.exe
  2⤵
  PID:6164
- C:\Windows\System\vfCjIRC.exe
  C:\Windows\System\vfCjIRC.exe
  2⤵
  PID:6192
- C:\Windows\System\APFGuuJ.exe
  C:\Windows\System\APFGuuJ.exe
  2⤵
  PID:6276
- C:\Windows\System\zcbUnOf.exe
  C:\Windows\System\zcbUnOf.exe
  2⤵
  PID:548
- C:\Windows\System\GxFapKX.exe
  C:\Windows\System\GxFapKX.exe
  2⤵
  PID:4580
- C:\Windows\System\SnPbCVt.exe
  C:\Windows\System\SnPbCVt.exe
  2⤵
  PID:6436
- C:\Windows\System\xQilPCR.exe
  C:\Windows\System\xQilPCR.exe
  2⤵
  PID:6408
- C:\Windows\System\gDaISAG.exe
  C:\Windows\System\gDaISAG.exe
  2⤵
  PID:1968
- C:\Windows\System\tJTZyVy.exe
  C:\Windows\System\tJTZyVy.exe
  2⤵
  PID:6552
- C:\Windows\System\YXYtdqp.exe
  C:\Windows\System\YXYtdqp.exe
  2⤵
  PID:6512
- C:\Windows\System\JPVfrSH.exe
  C:\Windows\System\JPVfrSH.exe
  2⤵
  PID:6636
- C:\Windows\System\xwcPubq.exe
  C:\Windows\System\xwcPubq.exe
  2⤵
  PID:6584
- C:\Windows\System\dYERTeM.exe
  C:\Windows\System\dYERTeM.exe
  2⤵
  PID:1648
- C:\Windows\System\peYNSqD.exe
  C:\Windows\System\peYNSqD.exe
  2⤵
  PID:6740
- C:\Windows\System\WqKuTNo.exe
  C:\Windows\System\WqKuTNo.exe
  2⤵
  PID:6712
- C:\Windows\System\rYHNvmm.exe
  C:\Windows\System\rYHNvmm.exe
  2⤵
  PID:4776
- C:\Windows\System\PcLQzjt.exe
  C:\Windows\System\PcLQzjt.exe
  2⤵
  PID:2348
- C:\Windows\System\jxLVEPB.exe
  C:\Windows\System\jxLVEPB.exe
  2⤵
  PID:6948
- C:\Windows\System\raajaYL.exe
  C:\Windows\System\raajaYL.exe
  2⤵
  PID:6980
- C:\Windows\System\SecyAKO.exe
  C:\Windows\System\SecyAKO.exe
  2⤵
  PID:7048
- C:\Windows\System\MiwFPCW.exe
  C:\Windows\System\MiwFPCW.exe
  2⤵
  PID:7108
- C:\Windows\System\IyiAmVI.exe
  C:\Windows\System\IyiAmVI.exe
  2⤵
  PID:7156
- C:\Windows\System\lzqfaPE.exe
  C:\Windows\System\lzqfaPE.exe
  2⤵
  PID:4252
- C:\Windows\System\QreruBF.exe
  C:\Windows\System\QreruBF.exe
  2⤵
  PID:6216
- C:\Windows\System\mcSwbqG.exe
  C:\Windows\System\mcSwbqG.exe
  2⤵
  PID:6160
- C:\Windows\System\VKiIUPL.exe
  C:\Windows\System\VKiIUPL.exe
  2⤵
  PID:1764
- C:\Windows\System\ttHtkZn.exe
  C:\Windows\System\ttHtkZn.exe
  2⤵
  PID:6352
- C:\Windows\System\ZHCnRJK.exe
  C:\Windows\System\ZHCnRJK.exe
  2⤵
  PID:6380
- C:\Windows\System\QtXiXuI.exe
  C:\Windows\System\QtXiXuI.exe
  2⤵
  PID:1176
- C:\Windows\System\oNYBOvz.exe
  C:\Windows\System\oNYBOvz.exe
  2⤵
  PID:4480
- C:\Windows\System\BnVkaoM.exe
  C:\Windows\System\BnVkaoM.exe
  2⤵
  PID:6792
- C:\Windows\System\vEgMqyY.exe
  C:\Windows\System\vEgMqyY.exe
  2⤵
  PID:6764
- C:\Windows\System\OfrIOzt.exe
  C:\Windows\System\OfrIOzt.exe
  2⤵
  PID:6864
- C:\Windows\System\XSiukGk.exe
  C:\Windows\System\XSiukGk.exe
  2⤵
  PID:7016
- C:\Windows\System\EOguthf.exe
  C:\Windows\System\EOguthf.exe
  2⤵
  PID:6248
- C:\Windows\System\NBNBaGj.exe
  C:\Windows\System\NBNBaGj.exe
  2⤵
  PID:1876
- C:\Windows\System\PmIleMO.exe
  C:\Windows\System\PmIleMO.exe
  2⤵
  PID:536
- C:\Windows\System\EjEdqKS.exe
  C:\Windows\System\EjEdqKS.exe
  2⤵
  PID:4472
- C:\Windows\System\ZGRpMYR.exe
  C:\Windows\System\ZGRpMYR.exe
  2⤵
  PID:6896
- C:\Windows\System\DsjKSrD.exe
  C:\Windows\System\DsjKSrD.exe
  2⤵
  PID:5164
- C:\Windows\System\rkdWaQK.exe
  C:\Windows\System\rkdWaQK.exe
  2⤵
  PID:2616
- C:\Windows\System\ZPtCzBw.exe
  C:\Windows\System\ZPtCzBw.exe
  2⤵
  PID:6572
- C:\Windows\System\IOjsfts.exe
  C:\Windows\System\IOjsfts.exe
  2⤵
  PID:7176
- C:\Windows\System\ussvGwP.exe
  C:\Windows\System\ussvGwP.exe
  2⤵
  PID:7212
- C:\Windows\System\AJfjwzY.exe
  C:\Windows\System\AJfjwzY.exe
  2⤵
  PID:7244
- C:\Windows\System\euaMGVW.exe
  C:\Windows\System\euaMGVW.exe
  2⤵
  PID:7264
- C:\Windows\System\sLedAdK.exe
  C:\Windows\System\sLedAdK.exe
  2⤵
  PID:7280
- C:\Windows\System\usdvpNQ.exe
  C:\Windows\System\usdvpNQ.exe
  2⤵
  PID:7304
- C:\Windows\System\OsgwWxK.exe
  C:\Windows\System\OsgwWxK.exe
  2⤵
  PID:7324
- C:\Windows\System\YnYGiDv.exe
  C:\Windows\System\YnYGiDv.exe
  2⤵
  PID:7356
- C:\Windows\System\tufdAZK.exe
  C:\Windows\System\tufdAZK.exe
  2⤵
  PID:7376
- C:\Windows\System\DbKwQSG.exe
  C:\Windows\System\DbKwQSG.exe
  2⤵
  PID:7400
- C:\Windows\System\DlTErpy.exe
  C:\Windows\System\DlTErpy.exe
  2⤵
  PID:7436
- C:\Windows\System\kIXNZIB.exe
  C:\Windows\System\kIXNZIB.exe
  2⤵
  PID:7460
- C:\Windows\System\oKycoPg.exe
  C:\Windows\System\oKycoPg.exe
  2⤵
  PID:7480
- C:\Windows\System\lCFzpPk.exe
  C:\Windows\System\lCFzpPk.exe
  2⤵
  PID:7512
- C:\Windows\System\GmXfXwU.exe
  C:\Windows\System\GmXfXwU.exe
  2⤵
  PID:7536
- C:\Windows\System\ejXFEPS.exe
  C:\Windows\System\ejXFEPS.exe
  2⤵
  PID:7572
- C:\Windows\System\iTfpTMl.exe
  C:\Windows\System\iTfpTMl.exe
  2⤵
  PID:7596
- C:\Windows\System\AMmigzH.exe
  C:\Windows\System\AMmigzH.exe
  2⤵
  PID:7648
- C:\Windows\System\CAKBhlC.exe
  C:\Windows\System\CAKBhlC.exe
  2⤵
  PID:7700
- C:\Windows\System\bbgPgww.exe
  C:\Windows\System\bbgPgww.exe
  2⤵
  PID:7716
- C:\Windows\System\AagKxGw.exe
  C:\Windows\System\AagKxGw.exe
  2⤵
  PID:7740
- C:\Windows\System\BCirxjN.exe
  C:\Windows\System\BCirxjN.exe
  2⤵
  PID:7760
- C:\Windows\System\jIhLVGB.exe
  C:\Windows\System\jIhLVGB.exe
  2⤵
  PID:7792
- C:\Windows\System\WjJRUOf.exe
  C:\Windows\System\WjJRUOf.exe
  2⤵
  PID:7808
- C:\Windows\System\DTSVJDS.exe
  C:\Windows\System\DTSVJDS.exe
  2⤵
  PID:7824
- C:\Windows\System\vMTzBZT.exe
  C:\Windows\System\vMTzBZT.exe
  2⤵
  PID:7848
- C:\Windows\System\LfmWllb.exe
  C:\Windows\System\LfmWllb.exe
  2⤵
  PID:7892
- C:\Windows\System\fjnbJAc.exe
  C:\Windows\System\fjnbJAc.exe
  2⤵
  PID:7916
- C:\Windows\System\KOFlKWx.exe
  C:\Windows\System\KOFlKWx.exe
  2⤵
  PID:7968
- C:\Windows\System\eALvvKW.exe
  C:\Windows\System\eALvvKW.exe
  2⤵
  PID:7984
- C:\Windows\System\ZaXeWqc.exe
  C:\Windows\System\ZaXeWqc.exe
  2⤵
  PID:8012
- C:\Windows\System\kehFXCR.exe
  C:\Windows\System\kehFXCR.exe
  2⤵
  PID:8028
- C:\Windows\System\xCUPMad.exe
  C:\Windows\System\xCUPMad.exe
  2⤵
  PID:8044
- C:\Windows\System\PFhrrmW.exe
  C:\Windows\System\PFhrrmW.exe
  2⤵
  PID:8060
- C:\Windows\System\fXXUgJN.exe
  C:\Windows\System\fXXUgJN.exe
  2⤵
  PID:8100
- C:\Windows\System\aiaKoaG.exe
  C:\Windows\System\aiaKoaG.exe
  2⤵
  PID:8120
- C:\Windows\System\DmalEQr.exe
  C:\Windows\System\DmalEQr.exe
  2⤵
  PID:8144
- C:\Windows\System\MPprQSS.exe
  C:\Windows\System\MPprQSS.exe
  2⤵
  PID:8164
- C:\Windows\System\rLHbpSi.exe
  C:\Windows\System\rLHbpSi.exe
  2⤵
  PID:6612
- C:\Windows\System\FshpanM.exe
  C:\Windows\System\FshpanM.exe
  2⤵
  PID:7224
- C:\Windows\System\EwFbGrs.exe
  C:\Windows\System\EwFbGrs.exe
  2⤵
  PID:7300
- C:\Windows\System\GIHSQPQ.exe
  C:\Windows\System\GIHSQPQ.exe
  2⤵
  PID:7444
- C:\Windows\System\qMJsupR.exe
  C:\Windows\System\qMJsupR.exe
  2⤵
  PID:7524
- C:\Windows\System\vyhzPtE.exe
  C:\Windows\System\vyhzPtE.exe
  2⤵
  PID:7608
- C:\Windows\System\eHGSxCX.exe
  C:\Windows\System\eHGSxCX.exe
  2⤵
  PID:7628
- C:\Windows\System\EhlLkCC.exe
  C:\Windows\System\EhlLkCC.exe
  2⤵
  PID:7708
- C:\Windows\System\ERYgDbQ.exe
  C:\Windows\System\ERYgDbQ.exe
  2⤵
  PID:7768
- C:\Windows\System\UBjCIwR.exe
  C:\Windows\System\UBjCIwR.exe
  2⤵
  PID:7820
- C:\Windows\System\ydIFULW.exe
  C:\Windows\System\ydIFULW.exe
  2⤵
  PID:7860
- C:\Windows\System\RZdXTVo.exe
  C:\Windows\System\RZdXTVo.exe
  2⤵
  PID:8004
- C:\Windows\System\aZzZjLV.exe
  C:\Windows\System\aZzZjLV.exe
  2⤵
  PID:8000
- C:\Windows\System\RTpfaFw.exe
  C:\Windows\System\RTpfaFw.exe
  2⤵
  PID:8084
- C:\Windows\System\RFtDFNO.exe
  C:\Windows\System\RFtDFNO.exe
  2⤵
  PID:8112
- C:\Windows\System\oosCTAo.exe
  C:\Windows\System\oosCTAo.exe
  2⤵
  PID:7208
- C:\Windows\System\oiOmlus.exe
  C:\Windows\System\oiOmlus.exe
  2⤵
  PID:7488
- C:\Windows\System\GOhStoD.exe
  C:\Windows\System\GOhStoD.exe
  2⤵
  PID:7432
- C:\Windows\System\aLraDlj.exe
  C:\Windows\System\aLraDlj.exe
  2⤵
  PID:7724
- C:\Windows\System\SWucjvy.exe
  C:\Windows\System\SWucjvy.exe
  2⤵
  PID:7884
- C:\Windows\System\Prnxdtd.exe
  C:\Windows\System\Prnxdtd.exe
  2⤵
  PID:8136
- C:\Windows\System\XiQnRlR.exe
  C:\Windows\System\XiQnRlR.exe
  2⤵
  PID:7964
- C:\Windows\System\ASEvwsl.exe
  C:\Windows\System\ASEvwsl.exe
  2⤵
  PID:7256
- C:\Windows\System\znTpWBX.exe
  C:\Windows\System\znTpWBX.exe
  2⤵
  PID:7680
- C:\Windows\System\YHvTxHi.exe
  C:\Windows\System\YHvTxHi.exe
  2⤵
  PID:7928
- C:\Windows\System\GcwNQsf.exe
  C:\Windows\System\GcwNQsf.exe
  2⤵
  PID:8196
- C:\Windows\System\cIfrxOY.exe
  C:\Windows\System\cIfrxOY.exe
  2⤵
  PID:8216
- C:\Windows\System\TYlAOfo.exe
  C:\Windows\System\TYlAOfo.exe
  2⤵
  PID:8252
- C:\Windows\System\NgTMqwS.exe
  C:\Windows\System\NgTMqwS.exe
  2⤵
  PID:8268
- C:\Windows\System\lrxUWvj.exe
  C:\Windows\System\lrxUWvj.exe
  2⤵
  PID:8288
- C:\Windows\System\eIbSfWs.exe
  C:\Windows\System\eIbSfWs.exe
  2⤵
  PID:8356
- C:\Windows\System\zvUPYra.exe
  C:\Windows\System\zvUPYra.exe
  2⤵
  PID:8372
- C:\Windows\System\VtQALvb.exe
  C:\Windows\System\VtQALvb.exe
  2⤵
  PID:8416
- C:\Windows\System\XGSstcE.exe
  C:\Windows\System\XGSstcE.exe
  2⤵
  PID:8440
- C:\Windows\System\hCRBzDv.exe
  C:\Windows\System\hCRBzDv.exe
  2⤵
  PID:8460
- C:\Windows\System\kdfnGEH.exe
  C:\Windows\System\kdfnGEH.exe
  2⤵
  PID:8500
- C:\Windows\System\eVLEwLs.exe
  C:\Windows\System\eVLEwLs.exe
  2⤵
  PID:8516
- C:\Windows\System\uDmqiYZ.exe
  C:\Windows\System\uDmqiYZ.exe
  2⤵
  PID:8564
- C:\Windows\System\vVyzHqP.exe
  C:\Windows\System\vVyzHqP.exe
  2⤵
  PID:8580
- C:\Windows\System\PWzrObY.exe
  C:\Windows\System\PWzrObY.exe
  2⤵
  PID:8612
- C:\Windows\System\xszCNaN.exe
  C:\Windows\System\xszCNaN.exe
  2⤵
  PID:8652
- C:\Windows\System\DMPDcqY.exe
  C:\Windows\System\DMPDcqY.exe
  2⤵
  PID:8676
- C:\Windows\System\fTJEoDx.exe
  C:\Windows\System\fTJEoDx.exe
  2⤵
  PID:8700
- C:\Windows\System\fphmegt.exe
  C:\Windows\System\fphmegt.exe
  2⤵
  PID:8724
- C:\Windows\System\YUWuOjx.exe
  C:\Windows\System\YUWuOjx.exe
  2⤵
  PID:8764
- C:\Windows\System\lmTkuYn.exe
  C:\Windows\System\lmTkuYn.exe
  2⤵
  PID:8780
- C:\Windows\System\JIpkGlF.exe
  C:\Windows\System\JIpkGlF.exe
  2⤵
  PID:8800
- C:\Windows\System\PmKEjWG.exe
  C:\Windows\System\PmKEjWG.exe
  2⤵
  PID:8828
- C:\Windows\System\pyXunlg.exe
  C:\Windows\System\pyXunlg.exe
  2⤵
  PID:8856
- C:\Windows\System\hbQMrkc.exe
  C:\Windows\System\hbQMrkc.exe
  2⤵
  PID:8872
- C:\Windows\System\PCwxuiq.exe
  C:\Windows\System\PCwxuiq.exe
  2⤵
  PID:8916
- C:\Windows\System\mCRFsPU.exe
  C:\Windows\System\mCRFsPU.exe
  2⤵
  PID:8952
- C:\Windows\System\BNofnBi.exe
  C:\Windows\System\BNofnBi.exe
  2⤵
  PID:8976
- C:\Windows\System\VQHVRyf.exe
  C:\Windows\System\VQHVRyf.exe
  2⤵
  PID:8992
- C:\Windows\System\sNwYeiZ.exe
  C:\Windows\System\sNwYeiZ.exe
  2⤵
  PID:9008
- C:\Windows\System\nBxBCGJ.exe
  C:\Windows\System\nBxBCGJ.exe
  2⤵
  PID:9048
- C:\Windows\System\cZfqPmo.exe
  C:\Windows\System\cZfqPmo.exe
  2⤵
  PID:9084
- C:\Windows\System\nRiovwz.exe
  C:\Windows\System\nRiovwz.exe
  2⤵
  PID:9132
- C:\Windows\System\dFFPbZv.exe
  C:\Windows\System\dFFPbZv.exe
  2⤵
  PID:9148
- C:\Windows\System\GfYpAak.exe
  C:\Windows\System\GfYpAak.exe
  2⤵
  PID:9188
- C:\Windows\System\wCfTnXu.exe
  C:\Windows\System\wCfTnXu.exe
  2⤵
  PID:9212
- C:\Windows\System\GFfxKue.exe
  C:\Windows\System\GFfxKue.exe
  2⤵
  PID:8212
- C:\Windows\System\iklylzs.exe
  C:\Windows\System\iklylzs.exe
  2⤵
  PID:8264
- C:\Windows\System\dtJBYxa.exe
  C:\Windows\System\dtJBYxa.exe
  2⤵
  PID:8368
- C:\Windows\System\drWImkR.exe
  C:\Windows\System\drWImkR.exe
  2⤵
  PID:8400
- C:\Windows\System\ITvzWJP.exe
  C:\Windows\System\ITvzWJP.exe
  2⤵
  PID:8456
- C:\Windows\System\ytCcPBx.exe
  C:\Windows\System\ytCcPBx.exe
  2⤵
  PID:8492
- C:\Windows\System\xDCwVLz.exe
  C:\Windows\System\xDCwVLz.exe
  2⤵
  PID:4028
- C:\Windows\System\nDjESKP.exe
  C:\Windows\System\nDjESKP.exe
  2⤵
  PID:8576
- C:\Windows\System\pADeTQE.exe
  C:\Windows\System\pADeTQE.exe
  2⤵
  PID:8632
- C:\Windows\System\tRxyrpj.exe
  C:\Windows\System\tRxyrpj.exe
  2⤵
  PID:8776
- C:\Windows\System\TYWDPta.exe
  C:\Windows\System\TYWDPta.exe
  2⤵
  PID:8796
- C:\Windows\System\wnlXsDg.exe
  C:\Windows\System\wnlXsDg.exe
  2⤵
  PID:8900
- C:\Windows\System\oURRHuK.exe
  C:\Windows\System\oURRHuK.exe
  2⤵
  PID:8960
- C:\Windows\System\HRKZCHj.exe
  C:\Windows\System\HRKZCHj.exe
  2⤵
  PID:9032
- C:\Windows\System\PEnpxWe.exe
  C:\Windows\System\PEnpxWe.exe
  2⤵
  PID:9092
- C:\Windows\System\wJIoeOd.exe
  C:\Windows\System\wJIoeOd.exe
  2⤵
  PID:9144
- C:\Windows\System\tzOHGDS.exe
  C:\Windows\System\tzOHGDS.exe
  2⤵
  PID:9184
- C:\Windows\System\gQspIat.exe
  C:\Windows\System\gQspIat.exe
  2⤵
  PID:8396
- C:\Windows\System\uwwJKgc.exe
  C:\Windows\System\uwwJKgc.exe
  2⤵
  PID:8548
- C:\Windows\System\lbUXXtD.exe
  C:\Windows\System\lbUXXtD.exe
  2⤵
  PID:8628
- C:\Windows\System\RSlERni.exe
  C:\Windows\System\RSlERni.exe
  2⤵
  PID:8716
- C:\Windows\System\gxgCjjO.exe
  C:\Windows\System\gxgCjjO.exe
  2⤵
  PID:8848
- C:\Windows\System\iMSZnrx.exe
  C:\Windows\System\iMSZnrx.exe
  2⤵
  PID:8884
- C:\Windows\System\ifAqGZc.exe
  C:\Windows\System\ifAqGZc.exe
  2⤵
  PID:9000
- C:\Windows\System\VqwulAF.exe
  C:\Windows\System\VqwulAF.exe
  2⤵
  PID:9120
- C:\Windows\System\VAyTLcW.exe
  C:\Windows\System\VAyTLcW.exe
  2⤵
  PID:8480
- C:\Windows\System\blYsEQR.exe
  C:\Windows\System\blYsEQR.exe
  2⤵
  PID:9236
- C:\Windows\System\YWcigBE.exe
  C:\Windows\System\YWcigBE.exe
  2⤵
  PID:9324
- C:\Windows\System\nBUWXsR.exe
  C:\Windows\System\nBUWXsR.exe
  2⤵
  PID:9340
- C:\Windows\System\IrRxBCz.exe
  C:\Windows\System\IrRxBCz.exe
  2⤵
  PID:9356
- C:\Windows\System\WNMLzyi.exe
  C:\Windows\System\WNMLzyi.exe
  2⤵
  PID:9372
- C:\Windows\System\yzPBuyU.exe
  C:\Windows\System\yzPBuyU.exe
  2⤵
  PID:9392
- C:\Windows\System\aKPmqBx.exe
  C:\Windows\System\aKPmqBx.exe
  2⤵
  PID:9412
- C:\Windows\System\KGYnbjz.exe
  C:\Windows\System\KGYnbjz.exe
  2⤵
  PID:9440
- C:\Windows\System\oqgkwqb.exe
  C:\Windows\System\oqgkwqb.exe
  2⤵
  PID:9464
- C:\Windows\System\aJjKJFS.exe
  C:\Windows\System\aJjKJFS.exe
  2⤵
  PID:9524
- C:\Windows\System\ZBtwayk.exe
  C:\Windows\System\ZBtwayk.exe
  2⤵
  PID:9544
- C:\Windows\System\llcLbIT.exe
  C:\Windows\System\llcLbIT.exe
  2⤵
  PID:9640
- C:\Windows\System\zpXdtGI.exe
  C:\Windows\System\zpXdtGI.exe
  2⤵
  PID:9684
- C:\Windows\System\aFocQDV.exe
  C:\Windows\System\aFocQDV.exe
  2⤵
  PID:9720
- C:\Windows\System\HXYqzPS.exe
  C:\Windows\System\HXYqzPS.exe
  2⤵
  PID:9740
- C:\Windows\System\ZSxJKBo.exe
  C:\Windows\System\ZSxJKBo.exe
  2⤵
  PID:9780
- C:\Windows\System\JGmLAwT.exe
  C:\Windows\System\JGmLAwT.exe
  2⤵
  PID:9812
- C:\Windows\System\WrikcJn.exe
  C:\Windows\System\WrikcJn.exe
  2⤵
  PID:9836
- C:\Windows\System\hpEvZbt.exe
  C:\Windows\System\hpEvZbt.exe
  2⤵
  PID:9852
- C:\Windows\System\oujTPcY.exe
  C:\Windows\System\oujTPcY.exe
  2⤵
  PID:9872
- C:\Windows\System\gGrCkUM.exe
  C:\Windows\System\gGrCkUM.exe
  2⤵
  PID:9924
- C:\Windows\System\awksePC.exe
  C:\Windows\System\awksePC.exe
  2⤵
  PID:9944
- C:\Windows\System\hSdnoAk.exe
  C:\Windows\System\hSdnoAk.exe
  2⤵
  PID:9968
- C:\Windows\System\dklZAPS.exe
  C:\Windows\System\dklZAPS.exe
  2⤵
  PID:10028
- C:\Windows\System\ZVXBPjM.exe
  C:\Windows\System\ZVXBPjM.exe
  2⤵
  PID:10068
- C:\Windows\System\oNxUWIU.exe
  C:\Windows\System\oNxUWIU.exe
  2⤵
  PID:10092
- C:\Windows\System\APRQnEQ.exe
  C:\Windows\System\APRQnEQ.exe
  2⤵
  PID:10116
- C:\Windows\System\zSPpGPl.exe
  C:\Windows\System\zSPpGPl.exe
  2⤵
  PID:10156
- C:\Windows\System\rZnuONC.exe
  C:\Windows\System\rZnuONC.exe
  2⤵
  PID:10184
- C:\Windows\System\SHToTTg.exe
  C:\Windows\System\SHToTTg.exe
  2⤵
  PID:10200
- C:\Windows\System\ynOeBJQ.exe
  C:\Windows\System\ynOeBJQ.exe
  2⤵
  PID:10220
- C:\Windows\System\ICdSVmL.exe
  C:\Windows\System\ICdSVmL.exe
  2⤵
  PID:2116
- C:\Windows\System\xJJtPIT.exe
  C:\Windows\System\xJJtPIT.exe
  2⤵
  PID:9200
- C:\Windows\System\UiSIcCM.exe
  C:\Windows\System\UiSIcCM.exe
  2⤵
  PID:9056
- C:\Windows\System\TEhBJvQ.exe
  C:\Windows\System\TEhBJvQ.exe
  2⤵
  PID:8772
- C:\Windows\System\lLTVkVL.exe
  C:\Windows\System\lLTVkVL.exe
  2⤵
  PID:8392
- C:\Windows\System\QcfWotK.exe
  C:\Windows\System\QcfWotK.exe
  2⤵
  PID:9248
- C:\Windows\System\dwzfQex.exe
  C:\Windows\System\dwzfQex.exe
  2⤵
  PID:9352
- C:\Windows\System\gIrzEZO.exe
  C:\Windows\System\gIrzEZO.exe
  2⤵
  PID:9304
- C:\Windows\System\nnAZPNu.exe
  C:\Windows\System\nnAZPNu.exe
  2⤵
  PID:9404
- C:\Windows\System\qUWEiZh.exe
  C:\Windows\System\qUWEiZh.exe
  2⤵
  PID:9456
- C:\Windows\System\phBAcqw.exe
  C:\Windows\System\phBAcqw.exe
  2⤵
  PID:9488
- C:\Windows\System\OaDsEUA.exe
  C:\Windows\System\OaDsEUA.exe
  2⤵
  PID:9576
- C:\Windows\System\AeIdfsd.exe
  C:\Windows\System\AeIdfsd.exe
  2⤵
  PID:9648
- C:\Windows\System\JrnZFfH.exe
  C:\Windows\System\JrnZFfH.exe
  2⤵
  PID:9700
- C:\Windows\System\REWtFhA.exe
  C:\Windows\System\REWtFhA.exe
  2⤵
  PID:9880
- C:\Windows\System\sohnkHS.exe
  C:\Windows\System\sohnkHS.exe
  2⤵
  PID:9892
- C:\Windows\System\icwpWvA.exe
  C:\Windows\System\icwpWvA.exe
  2⤵
  PID:9916
- C:\Windows\System\rKDXNVZ.exe
  C:\Windows\System\rKDXNVZ.exe
  2⤵
  PID:10036
- C:\Windows\System\GzpglPQ.exe
  C:\Windows\System\GzpglPQ.exe
  2⤵
  PID:10100
- C:\Windows\System\THQVvab.exe
  C:\Windows\System\THQVvab.exe
  2⤵
  PID:10088
- C:\Windows\System\ckBnTIL.exe
  C:\Windows\System\ckBnTIL.exe
  2⤵
  PID:10152
- C:\Windows\System\ngJFzqy.exe
  C:\Windows\System\ngJFzqy.exe
  2⤵
  PID:10236
- C:\Windows\System\roawOOo.exe
  C:\Windows\System\roawOOo.exe
  2⤵
  PID:8412
- C:\Windows\System\eQxNaIR.exe
  C:\Windows\System\eQxNaIR.exe
  2⤵
  PID:4836
- C:\Windows\System\oVKRYaB.exe
  C:\Windows\System\oVKRYaB.exe
  2⤵
  PID:9492
- C:\Windows\System\pbHwvqi.exe
  C:\Windows\System\pbHwvqi.exe
  2⤵
  PID:9364
- C:\Windows\System\LFFGecA.exe
  C:\Windows\System\LFFGecA.exe
  2⤵
  PID:9584
- C:\Windows\System\VirWybX.exe
  C:\Windows\System\VirWybX.exe
  2⤵
  PID:9556
- C:\Windows\System\pxWriSp.exe
  C:\Windows\System\pxWriSp.exe
  2⤵
  PID:9772
- C:\Windows\System\MIpQYqK.exe
  C:\Windows\System\MIpQYqK.exe
  2⤵
  PID:10136
- C:\Windows\System\mStkxqt.exe
  C:\Windows\System\mStkxqt.exe
  2⤵
  PID:10196
- C:\Windows\System\dLuRlua.exe
  C:\Windows\System\dLuRlua.exe
  2⤵
  PID:9276
- C:\Windows\System\NMzyTHZ.exe
  C:\Windows\System\NMzyTHZ.exe
  2⤵
  PID:9400
- C:\Windows\System\PfNsUgz.exe
  C:\Windows\System\PfNsUgz.exe
  2⤵
  PID:9960
- C:\Windows\System\hIUkPvL.exe
  C:\Windows\System\hIUkPvL.exe
  2⤵
  PID:10112
- C:\Windows\System\BqaOQGu.exe
  C:\Windows\System\BqaOQGu.exe
  2⤵
  PID:884
- C:\Windows\System\cNnRXOh.exe
  C:\Windows\System\cNnRXOh.exe
  2⤵
  PID:10008
- C:\Windows\System\akmOYFd.exe
  C:\Windows\System\akmOYFd.exe
  2⤵
  PID:9696
- C:\Windows\System\kqwXtON.exe
  C:\Windows\System\kqwXtON.exe
  2⤵
  PID:10272
- C:\Windows\System\BfVPSah.exe
  C:\Windows\System\BfVPSah.exe
  2⤵
  PID:10296
- C:\Windows\System\QqsuKLL.exe
  C:\Windows\System\QqsuKLL.exe
  2⤵
  PID:10312
- C:\Windows\System\hUhejbr.exe
  C:\Windows\System\hUhejbr.exe
  2⤵
  PID:10336
- C:\Windows\System\GBNvjeW.exe
  C:\Windows\System\GBNvjeW.exe
  2⤵
  PID:10364
- C:\Windows\System\HTyUdKD.exe
  C:\Windows\System\HTyUdKD.exe
  2⤵
  PID:10384
- C:\Windows\System\FYkomRm.exe
  C:\Windows\System\FYkomRm.exe
  2⤵
  PID:10404
- C:\Windows\System\tmixHIT.exe
  C:\Windows\System\tmixHIT.exe
  2⤵
  PID:10440
- C:\Windows\System\ZcmdlcW.exe
  C:\Windows\System\ZcmdlcW.exe
  2⤵
  PID:10464
- C:\Windows\System\ZVtUvad.exe
  C:\Windows\System\ZVtUvad.exe
  2⤵
  PID:10488
- C:\Windows\System\OMLSMzu.exe
  C:\Windows\System\OMLSMzu.exe
  2⤵
  PID:10524
- C:\Windows\System\fqOwNHi.exe
  C:\Windows\System\fqOwNHi.exe
  2⤵
  PID:10572
- C:\Windows\System\NscoLyr.exe
  C:\Windows\System\NscoLyr.exe
  2⤵
  PID:10604
- C:\Windows\System\XeivNqI.exe
  C:\Windows\System\XeivNqI.exe
  2⤵
  PID:10628
- C:\Windows\System\BtPSVWN.exe
  C:\Windows\System\BtPSVWN.exe
  2⤵
  PID:10668
- C:\Windows\System\kCBfuEg.exe
  C:\Windows\System\kCBfuEg.exe
  2⤵
  PID:10696
- C:\Windows\System\pXnCYcT.exe
  C:\Windows\System\pXnCYcT.exe
  2⤵
  PID:10724
- C:\Windows\System\goCVqfi.exe
  C:\Windows\System\goCVqfi.exe
  2⤵
  PID:10744
- C:\Windows\System\yeBRZNd.exe
  C:\Windows\System\yeBRZNd.exe
  2⤵
  PID:10792
- C:\Windows\System\kEeDKeg.exe
  C:\Windows\System\kEeDKeg.exe
  2⤵
  PID:10816
- C:\Windows\System\uTJIYuJ.exe
  C:\Windows\System\uTJIYuJ.exe
  2⤵
  PID:10836
- C:\Windows\System\syDsCtT.exe
  C:\Windows\System\syDsCtT.exe
  2⤵
  PID:10856
- C:\Windows\System\fwwiHlb.exe
  C:\Windows\System\fwwiHlb.exe
  2⤵
  PID:10884
- C:\Windows\System\duAQpjB.exe
  C:\Windows\System\duAQpjB.exe
  2⤵
  PID:10924
- C:\Windows\System\klryhDB.exe
  C:\Windows\System\klryhDB.exe
  2⤵
  PID:10948
- C:\Windows\System\BHAepDx.exe
  C:\Windows\System\BHAepDx.exe
  2⤵
  PID:10964
- C:\Windows\System\blWWBtm.exe
  C:\Windows\System\blWWBtm.exe
  2⤵
  PID:10992
- C:\Windows\System\vEZBHEB.exe
  C:\Windows\System\vEZBHEB.exe
  2⤵
  PID:11032
- C:\Windows\System\XsbBJuZ.exe
  C:\Windows\System\XsbBJuZ.exe
  2⤵
  PID:11064
- C:\Windows\System\mPyatAt.exe
  C:\Windows\System\mPyatAt.exe
  2⤵
  PID:11084
- C:\Windows\System\pBCWzWD.exe
  C:\Windows\System\pBCWzWD.exe
  2⤵
  PID:11136
- C:\Windows\System\oCZilUG.exe
  C:\Windows\System\oCZilUG.exe
  2⤵
  PID:11164
- C:\Windows\System\eDGbobP.exe
  C:\Windows\System\eDGbobP.exe
  2⤵
  PID:11184
- C:\Windows\System\IOygyYZ.exe
  C:\Windows\System\IOygyYZ.exe
  2⤵
  PID:11212
- C:\Windows\System\KUlAcXw.exe
  C:\Windows\System\KUlAcXw.exe
  2⤵
  PID:11240
- C:\Windows\System\DCkciLT.exe
  C:\Windows\System\DCkciLT.exe
  2⤵
  PID:11256
- C:\Windows\System\jtmStnY.exe
  C:\Windows\System\jtmStnY.exe
  2⤵
  PID:10256
- C:\Windows\System\ccEPEVV.exe
  C:\Windows\System\ccEPEVV.exe
  2⤵
  PID:10280
- C:\Windows\System\yOmAxkE.exe
  C:\Windows\System\yOmAxkE.exe
  2⤵
  PID:10376
- C:\Windows\System\zCMBGSc.exe
  C:\Windows\System\zCMBGSc.exe
  2⤵
  PID:10420
- C:\Windows\System\jmqOWBA.exe
  C:\Windows\System\jmqOWBA.exe
  2⤵
  PID:10536
- C:\Windows\System\KcNWxiF.exe
  C:\Windows\System\KcNWxiF.exe
  2⤵
  PID:10548
- C:\Windows\System\lVtzppC.exe
  C:\Windows\System\lVtzppC.exe
  2⤵
  PID:10708
- C:\Windows\System\fPWIZTz.exe
  C:\Windows\System\fPWIZTz.exe
  2⤵
  PID:2184
- C:\Windows\System\ihJwabi.exe
  C:\Windows\System\ihJwabi.exe
  2⤵
  PID:10808
- C:\Windows\System\jJoxSny.exe
  C:\Windows\System\jJoxSny.exe
  2⤵
  PID:10848
- C:\Windows\System\ebtBdnT.exe
  C:\Windows\System\ebtBdnT.exe
  2⤵
  PID:10916
- C:\Windows\System\OriElpz.exe
  C:\Windows\System\OriElpz.exe
  2⤵
  PID:10944
- C:\Windows\System\hHdhJka.exe
  C:\Windows\System\hHdhJka.exe
  2⤵
  PID:11056
- C:\Windows\System\evQuaBa.exe
  C:\Windows\System\evQuaBa.exe
  2⤵
  PID:11096
- C:\Windows\System\ffHknCW.exe
  C:\Windows\System\ffHknCW.exe
  2⤵
  PID:11160
- C:\Windows\System\PViMLJo.exe
  C:\Windows\System\PViMLJo.exe
  2⤵
  PID:11192
- C:\Windows\System\oFNcJiB.exe
  C:\Windows\System\oFNcJiB.exe
  2⤵
  PID:11228
- C:\Windows\System\AxBAeWc.exe
  C:\Windows\System\AxBAeWc.exe
  2⤵
  PID:404
- C:\Windows\System\rGBMGHe.exe
  C:\Windows\System\rGBMGHe.exe
  2⤵
  PID:10396
- C:\Windows\System\gysWJqX.exe
  C:\Windows\System\gysWJqX.exe
  2⤵
  PID:10504
- C:\Windows\System\NKkPbAG.exe
  C:\Windows\System\NKkPbAG.exe
  2⤵
  PID:4128
- C:\Windows\System\jPPSFnp.exe
  C:\Windows\System\jPPSFnp.exe
  2⤵
  PID:10828
- C:\Windows\System\DxTcvKM.exe
  C:\Windows\System\DxTcvKM.exe
  2⤵
  PID:10940
- C:\Windows\System\rQMUvGY.exe
  C:\Windows\System\rQMUvGY.exe
  2⤵
  PID:11156
- C:\Windows\System\NfHlCYT.exe
  C:\Windows\System\NfHlCYT.exe
  2⤵
  PID:10648
- C:\Windows\System\PapoLmu.exe
  C:\Windows\System\PapoLmu.exe
  2⤵
  PID:10896
- C:\Windows\System\YjGFLRW.exe
  C:\Windows\System\YjGFLRW.exe
  2⤵
  PID:11232
- C:\Windows\System\FBAydkt.exe
  C:\Windows\System\FBAydkt.exe
  2⤵
  PID:11268
- C:\Windows\System\lszShEp.exe
  C:\Windows\System\lszShEp.exe
  2⤵
  PID:11284
- C:\Windows\System\iBhbmDq.exe
  C:\Windows\System\iBhbmDq.exe
  2⤵
  PID:11312
- C:\Windows\System\QsrfWKN.exe
  C:\Windows\System\QsrfWKN.exe
  2⤵
  PID:11332
- C:\Windows\System\vdUcEGf.exe
  C:\Windows\System\vdUcEGf.exe
  2⤵
  PID:11360
- C:\Windows\System\HwKLUoz.exe
  C:\Windows\System\HwKLUoz.exe
  2⤵
  PID:11392
- C:\Windows\System\aFjdWUR.exe
  C:\Windows\System\aFjdWUR.exe
  2⤵
  PID:11444
- C:\Windows\System\ZSOLvxh.exe
  C:\Windows\System\ZSOLvxh.exe
  2⤵
  PID:11468
- C:\Windows\System\oNcompH.exe
  C:\Windows\System\oNcompH.exe
  2⤵
  PID:11496
- C:\Windows\System\JwhbJPB.exe
  C:\Windows\System\JwhbJPB.exe
  2⤵
  PID:11516
- C:\Windows\System\ahVJstw.exe
  C:\Windows\System\ahVJstw.exe
  2⤵
  PID:11536
- C:\Windows\System\oUIlnRs.exe
  C:\Windows\System\oUIlnRs.exe
  2⤵
  PID:11576
- C:\Windows\System\JdUZAcM.exe
  C:\Windows\System\JdUZAcM.exe
  2⤵
  PID:11596
- C:\Windows\System\OiZfuIz.exe
  C:\Windows\System\OiZfuIz.exe
  2⤵
  PID:11632
- C:\Windows\System\IyJfbOf.exe
  C:\Windows\System\IyJfbOf.exe
  2⤵
  PID:11660
- C:\Windows\System\WgXrwKz.exe
  C:\Windows\System\WgXrwKz.exe
  2⤵
  PID:11676
- C:\Windows\System\xfpYEvh.exe
  C:\Windows\System\xfpYEvh.exe
  2⤵
  PID:11724
- C:\Windows\System\zCvVHbL.exe
  C:\Windows\System\zCvVHbL.exe
  2⤵
  PID:11748
- C:\Windows\System\wYDNIGx.exe
  C:\Windows\System\wYDNIGx.exe
  2⤵
  PID:11772
- C:\Windows\System\WJkTrfw.exe
  C:\Windows\System\WJkTrfw.exe
  2⤵
  PID:11796
- C:\Windows\System\yPmZSyD.exe
  C:\Windows\System\yPmZSyD.exe
  2⤵
  PID:11816
- C:\Windows\System\CtRozYg.exe
  C:\Windows\System\CtRozYg.exe
  2⤵
  PID:11844
- C:\Windows\System\TdpZDkh.exe
  C:\Windows\System\TdpZDkh.exe
  2⤵
  PID:11864
- C:\Windows\System\TSJQHxk.exe
  C:\Windows\System\TSJQHxk.exe
  2⤵
  PID:11892
- C:\Windows\System\CAcaAcV.exe
  C:\Windows\System\CAcaAcV.exe
  2⤵
  PID:11916
- C:\Windows\System\GGItmwR.exe
  C:\Windows\System\GGItmwR.exe
  2⤵
  PID:11944
- C:\Windows\System\imxhxsk.exe
  C:\Windows\System\imxhxsk.exe
  2⤵
  PID:11964
- C:\Windows\System\EBmpBEC.exe
  C:\Windows\System\EBmpBEC.exe
  2⤵
  PID:11992
- C:\Windows\System\xoDFodF.exe
  C:\Windows\System\xoDFodF.exe
  2⤵
  PID:12012
- C:\Windows\System\wccBCdA.exe
  C:\Windows\System\wccBCdA.exe
  2⤵
  PID:12060
- C:\Windows\System\KtXkHDx.exe
  C:\Windows\System\KtXkHDx.exe
  2⤵
  PID:12088
- C:\Windows\System\xqudQeW.exe
  C:\Windows\System\xqudQeW.exe
  2⤵
  PID:12108
- C:\Windows\System\CNSgamu.exe
  C:\Windows\System\CNSgamu.exe
  2⤵
  PID:12128
- C:\Windows\System\sQVERNZ.exe
  C:\Windows\System\sQVERNZ.exe
  2⤵
  PID:12148
- C:\Windows\System\aFsjUDw.exe
  C:\Windows\System\aFsjUDw.exe
  2⤵
  PID:12180
- C:\Windows\System\PbhZyNk.exe
  C:\Windows\System\PbhZyNk.exe
  2⤵
  PID:12200
- C:\Windows\System\AfzlQnk.exe
  C:\Windows\System\AfzlQnk.exe
  2⤵
  PID:12240
- C:\Windows\System\USjXHUC.exe
  C:\Windows\System\USjXHUC.exe
  2⤵
  PID:10568
- C:\Windows\System\nCOueMx.exe
  C:\Windows\System\nCOueMx.exe
  2⤵
  PID:11300
- C:\Windows\System\ITeaZya.exe
  C:\Windows\System\ITeaZya.exe
  2⤵
  PID:11420
- C:\Windows\System\YGsDjBv.exe
  C:\Windows\System\YGsDjBv.exe
  2⤵
  PID:11484
- C:\Windows\System\AvUssjr.exe
  C:\Windows\System\AvUssjr.exe
  2⤵
  PID:11556
- C:\Windows\System\ZfFAmxN.exe
  C:\Windows\System\ZfFAmxN.exe
  2⤵
  PID:11568
- C:\Windows\System\mgacEbR.exe
  C:\Windows\System\mgacEbR.exe
  2⤵
  PID:11644
- C:\Windows\System\XYWCTOA.exe
  C:\Windows\System\XYWCTOA.exe
  2⤵
  PID:11716
- C:\Windows\System\NgEbDaF.exe
  C:\Windows\System\NgEbDaF.exe
  2⤵
  PID:11940
- C:\Windows\System\HvCKzak.exe
  C:\Windows\System\HvCKzak.exe
  2⤵
  PID:11980
- C:\Windows\System\HJOTGUV.exe
  C:\Windows\System\HJOTGUV.exe
  2⤵
  PID:11960
- C:\Windows\System\mOOivgI.exe
  C:\Windows\System\mOOivgI.exe
  2⤵
  PID:12040
- C:\Windows\System\IuemGkg.exe
  C:\Windows\System\IuemGkg.exe
  2⤵
  PID:12104
- C:\Windows\System\rjKSOmz.exe
  C:\Windows\System\rjKSOmz.exe
  2⤵
  PID:12080
- C:\Windows\System\gXXanpk.exe
  C:\Windows\System\gXXanpk.exe
  2⤵
  PID:12168
- C:\Windows\System\RkGBkap.exe
  C:\Windows\System\RkGBkap.exe
  2⤵
  PID:12156
- C:\Windows\System\LLBQzgI.exe
  C:\Windows\System\LLBQzgI.exe
  2⤵
  PID:4280
- C:\Windows\System\MPsDsuH.exe
  C:\Windows\System\MPsDsuH.exe
  2⤵
  PID:11384
- C:\Windows\System\uGxWhWj.exe
  C:\Windows\System\uGxWhWj.exe
  2⤵
  PID:11440
- C:\Windows\System\mNZXeZq.exe
  C:\Windows\System\mNZXeZq.exe
  2⤵
  PID:11504
- C:\Windows\System\FtQuaoq.exe
  C:\Windows\System\FtQuaoq.exe
  2⤵
  PID:11812
- C:\Windows\System\rgoWdBc.exe
  C:\Windows\System\rgoWdBc.exe
  2⤵
  PID:11836
- C:\Windows\System\ysnUbBJ.exe
  C:\Windows\System\ysnUbBJ.exe
  2⤵
  PID:12232
- C:\Windows\System\nqtljiM.exe
  C:\Windows\System\nqtljiM.exe
  2⤵
  PID:1572
- C:\Windows\System\LMGAhxQ.exe
  C:\Windows\System\LMGAhxQ.exe
  2⤵
  PID:12284
- C:\Windows\System\xCMCtXt.exe
  C:\Windows\System\xCMCtXt.exe
  2⤵
  PID:11508
- C:\Windows\System\FoXKltK.exe
  C:\Windows\System\FoXKltK.exe
  2⤵
  PID:11804
- C:\Windows\System\KflGaeO.exe
  C:\Windows\System\KflGaeO.exe
  2⤵
  PID:11760
- C:\Windows\System\XNTdLPM.exe
  C:\Windows\System\XNTdLPM.exe
  2⤵
  PID:11744
- C:\Windows\System\NZpOTQn.exe
  C:\Windows\System\NZpOTQn.exe
  2⤵
  PID:12300
- C:\Windows\System\fwxQpeX.exe
  C:\Windows\System\fwxQpeX.exe
  2⤵
  PID:12320
- C:\Windows\System\ojvHXiO.exe
  C:\Windows\System\ojvHXiO.exe
  2⤵
  PID:12348
- C:\Windows\System\igKFmoh.exe
  C:\Windows\System\igKFmoh.exe
  2⤵
  PID:12384
- C:\Windows\System\sGuilvX.exe
  C:\Windows\System\sGuilvX.exe
  2⤵
  PID:12436
- C:\Windows\System\pYsmTWO.exe
  C:\Windows\System\pYsmTWO.exe
  2⤵
  PID:12464
- C:\Windows\System\iimyxSY.exe
  C:\Windows\System\iimyxSY.exe
  2⤵
  PID:12484
- C:\Windows\System\FmBNPsA.exe
  C:\Windows\System\FmBNPsA.exe
  2⤵
  PID:12508
- C:\Windows\System\kuNIRnB.exe
  C:\Windows\System\kuNIRnB.exe
  2⤵
  PID:12548
- C:\Windows\System\cVATyzA.exe
  C:\Windows\System\cVATyzA.exe
  2⤵
  PID:12572
- C:\Windows\System\rkGPRSk.exe
  C:\Windows\System\rkGPRSk.exe
  2⤵
  PID:12612
- C:\Windows\System\uLFthlA.exe
  C:\Windows\System\uLFthlA.exe
  2⤵
  PID:12632
- C:\Windows\System\eCVQbIN.exe
  C:\Windows\System\eCVQbIN.exe
  2⤵
  PID:12656
- C:\Windows\System\YepYOPv.exe
  C:\Windows\System\YepYOPv.exe
  2⤵
  PID:12680
- C:\Windows\System\lScnKWk.exe
  C:\Windows\System\lScnKWk.exe
  2⤵
  PID:12708
- C:\Windows\System\mQYANAW.exe
  C:\Windows\System\mQYANAW.exe
  2⤵
  PID:12744
- C:\Windows\System\rZuozYN.exe
  C:\Windows\System\rZuozYN.exe
  2⤵
  PID:12784
- C:\Windows\System\kiqglkx.exe
  C:\Windows\System\kiqglkx.exe
  2⤵
  PID:12800
- C:\Windows\System\MZnQlvC.exe
  C:\Windows\System\MZnQlvC.exe
  2⤵
  PID:12828
- C:\Windows\System\YmYWmyT.exe
  C:\Windows\System\YmYWmyT.exe
  2⤵
  PID:12856
- C:\Windows\System\LgRTGda.exe
  C:\Windows\System\LgRTGda.exe
  2⤵
  PID:12876
- C:\Windows\System\LQQWAeY.exe
  C:\Windows\System\LQQWAeY.exe
  2⤵
  PID:12904
- C:\Windows\System\SYfmLoK.exe
  C:\Windows\System\SYfmLoK.exe
  2⤵
  PID:12932
- C:\Windows\System\MmLEUTl.exe
  C:\Windows\System\MmLEUTl.exe
  2⤵
  PID:12972
- C:\Windows\System\GRlqNBg.exe
  C:\Windows\System\GRlqNBg.exe
  2⤵
  PID:12992
- C:\Windows\System\jvZaZOb.exe
  C:\Windows\System\jvZaZOb.exe
  2⤵
  PID:13012
- C:\Windows\System\rHSjkHJ.exe
  C:\Windows\System\rHSjkHJ.exe
  2⤵
  PID:13040
- C:\Windows\System\DKMQrQA.exe
  C:\Windows\System\DKMQrQA.exe
  2⤵
  PID:13056
- C:\Windows\System\WeNWMDz.exe
  C:\Windows\System\WeNWMDz.exe
  2⤵
  PID:13100
- C:\Windows\System\aGCrvrm.exe
  C:\Windows\System\aGCrvrm.exe
  2⤵
  PID:13260
- C:\Windows\System\tTVxEmt.exe
  C:\Windows\System\tTVxEmt.exe
  2⤵
  PID:13284
- C:\Windows\System\tDyiwuA.exe
  C:\Windows\System\tDyiwuA.exe
  2⤵
  PID:11912
- C:\Windows\System\DIVqppH.exe
  C:\Windows\System\DIVqppH.exe
  2⤵
  PID:12476
- C:\Windows\System\ItGWVvy.exe
  C:\Windows\System\ItGWVvy.exe
  2⤵
  PID:12580
- C:\Windows\System\FEkdmuW.exe
  C:\Windows\System\FEkdmuW.exe
  2⤵
  PID:12588
- C:\Windows\System\qOfNshn.exe
  C:\Windows\System\qOfNshn.exe
  2⤵
  PID:12648
- C:\Windows\System\xOelJys.exe
  C:\Windows\System\xOelJys.exe
  2⤵
  PID:12700
- C:\Windows\System\csdWRCq.exe
  C:\Windows\System\csdWRCq.exe
  2⤵
  PID:12768
- C:\Windows\System\cMHEyVn.exe
  C:\Windows\System\cMHEyVn.exe
  2⤵
  PID:12848
- C:\Windows\System\XjIgFvX.exe
  C:\Windows\System\XjIgFvX.exe
  2⤵
  PID:12872
- C:\Windows\System\wYOOZTw.exe
  C:\Windows\System\wYOOZTw.exe
  2⤵
  PID:12964
- C:\Windows\System\jqvxboa.exe
  C:\Windows\System\jqvxboa.exe
  2⤵
  PID:13032
- C:\Windows\System\PCQJkpc.exe
  C:\Windows\System\PCQJkpc.exe
  2⤵
  PID:13092
- C:\Windows\System\DqBRmZl.exe
  C:\Windows\System\DqBRmZl.exe
  2⤵
  PID:13072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_j34a1tza.g21.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\CAVzmxT.exe

Filesize
2.3MB

MD5
1a3cfcce60c7ab8440318e1ea5aa7515

SHA1
131bdb9ca1360857fcef6f73c2c9ccccf89e29f2

SHA256
65ef0001af986b6265fe694c1861a54c1380dc2244326d820bac234f7bf6f8ec

SHA512
51ca044e90912ebacfce4099bb90cbe853cd2ee6c161ce53073cee51651d6fd07f29a7d1187c802546ccdd135916992e8ba1859f54304d95e651e9be44bd9bf3

Download Submit
C:\Windows\System\DDaGMXd.exe

Filesize
2.3MB

MD5
4fbd340833b31c95ad36a42a26d3f21a

SHA1
c89268e4d1a5aa6a883791bd1b2102078925f898

SHA256
1752aee7a48330a2a61879826afb5cd4f24dcf06c7a1dd48e8ae1226eb5822b0

SHA512
38f7700d5e7227d6f4554ca17ba547b0a39e8230b66a5da8f589942e347b5bb0b0a86c3724baa2e6ad572ccd96b681661074de11a3139037460dcd67075540f0

Download Submit
C:\Windows\System\DzelIaR.exe

Filesize
2.3MB

MD5
cf1a0c1a38eb55f6dc177ec77e4a3522

SHA1
203ab2c3538c1caa4fde921ac17a229a4e5c1270

SHA256
b2d3232d450e294ab3488ba37b384261428b889a2353bac66a2b47f5e655787f

SHA512
e10ef19e1893113e75ab34f676b584444e3a5f57d6fdde9fbb42925de57fa87043eaf2baec4abe2d8bc170f38492a948ae9ea296e6d9b7fc604e62b8754554c4

Download Submit
C:\Windows\System\EMyKCoI.exe

Filesize
8B

MD5
2adac273ce248e8d242a4b12f749bb46

SHA1
300bd2c60c669d978305195f11eaf26c73d9e457

SHA256
5a695799bf8f73300a4f9c4a59fd25b209a2457abf1051a262d540e520557456

SHA512
011941b215532355e8e4d21af78180da68d2fe04927118ebe818ec14ec4bfb6a7a2d9aaa01fdfd0cd2c6dc84968b5f642ccf10cc92c29aa0e1d06bcf6f120232

Download Submit
C:\Windows\System\EUPhhXA.exe

Filesize
2.3MB

MD5
46b1c1645627603e5ddb1ab1b12fde47

SHA1
0b0457dd51dedc41ef998aa3eaba3d270d2b8638

SHA256
27b5c252d64ea3f005c17a179f1083bb8ba84c3d6bd8bfae21ca86c5c2ae1a5b

SHA512
e7651fc18376d362ebe3b0f3533a6fca3a42c6d249937e33faf7e963baaf249c0eb65841535e232f9ea0a226d9393ddcc4838933d928f55b30fb78999ffcd2db

Download Submit
C:\Windows\System\IfVHsSw.exe

Filesize
2.3MB

MD5
3b11a4d48b8fead39cc296b4e534eca2

SHA1
3a55984636008850a3b13e5dcbbcbd0f4f919daa

SHA256
e2849c122f46307e887b011c75c0b7b9e95a963c2c8a71f1779c494e7f03661d

SHA512
b9fdcd93962716dfd6a792931d6b1c6832059a641436e2e09de448c16e165b9d5ef7d8d14b0a9f9b8755bec88d2aeee1b08dfe22830bb349c753b66cea2cbf8a

Download Submit
C:\Windows\System\KVRbDle.exe

Filesize
2.3MB

MD5
a5b55c874f1fa95108ecd760c22e0703

SHA1
aa33acd90c8c5ee11c955a85492e96af6acaf891

SHA256
b789d7a1947a8132d4f8ff8e054322980bcf255bb1af0fea543b76c547641ed9

SHA512
d44b833af88cb816eb02afa3c1ce1dac6965dc4e14027e93cd62815c62356bad99ef0f2218359d259f56c9db1c37ac50bc3f13a65daa53f6b96977fd5ade6b52

Download Submit
C:\Windows\System\KduiTCH.exe

Filesize
2.3MB

MD5
4c6709bfac59d12468761686622ce01b

SHA1
34c94f61e7a2469ab3f442be1caf92d8b8c61b82

SHA256
9b6cbdbd46877d8f1e15ce8eb455d8d7daff02a293efb1ba8def15edd4e76b86

SHA512
6603839d728edcc6f5028a4d8efc6db2bb92a0c86881413c13099ebeb8929a144f6d69ffea49c4614d5d0178bfd4b4aa6e9d38049c06a3a9bd98eb966261fbfc

Download Submit
C:\Windows\System\NZqqnEK.exe

Filesize
2.3MB

MD5
7aa63d18ac709e56207139893d92c216

SHA1
493ca59b641cec12faad2b6d7a7ee3d8debbb2c8

SHA256
c32847718a276dc2575cb8df77d8a15c270bd981a87f5bfd25e4d92f2829bad1

SHA512
170a3ecfcd2296bc05ba926041c15df77fbbf3851743f42ef235d816067bac36da7ab3b05711afb49cd46496d8e1b4dc87d0572c90937fe1e9ecb1c06271bf42

Download Submit
C:\Windows\System\NlmrdPR.exe

Filesize
2.3MB

MD5
3159c51301784773e0dc908177bacba8

SHA1
25204083531e67c9877dbf4a2b34aa3efd14a8f1

SHA256
e5ed424c5d1c0fe7bd0c47721789abd16c8c1c29bff393246ccb774ecbedf3ce

SHA512
9a4cd09888c20483a6d49cbac165bfbb03b559f7b9ac30ca568d698c5116d54e2e480ea877cb830d24f8485c47d70f304a093aaab6786994a38aa9d7f32bab42

Download Submit
C:\Windows\System\QXjgnWh.exe

Filesize
2.3MB

MD5
b548cdb5695ae9c96ac2789ab324c561

SHA1
29ae093b0e77ac1b5b3c7e3f7324a03f6380f218

SHA256
b1fba8701323390b021f6bee77e66ed8ad7c1ad8ece8266d741ac6079c9ef922

SHA512
0020707af07b26487eae10bafd1a4ec6a4d709c5d3dd8178e878bc84703978f7098e88a8667a5c08da9c816ea4591999cac6c0777606f6e2b1ce8c5f7001e610

Download Submit
C:\Windows\System\TssxIny.exe

Filesize
2.3MB

MD5
90619cfe71b20bc4b5df14c00711b105

SHA1
d105981fda89b2fb3771f30788620ed0738b5030

SHA256
595e9d727fb079f4d0c4bf35990c7f967882b1f75a4da17ded8802f5591b0a8f

SHA512
1c1f7395e34b8ef9888450de490707a296bc927b56dfa4c579cfe052fc41e80a9e9aa6baf263e2d721c0c879fc1165afd4ba5f956b79b2e55b892d50906d1d62

Download Submit
C:\Windows\System\VATWhWh.exe

Filesize
2.3MB

MD5
eabee4bde6b18903f6d97200d414ce87

SHA1
a2ee07246f962c38a7d5a21458c29a19fe2e3c39

SHA256
86dfe2aafed5cb2d83929223892f3ffa14a6be51b0ad8e5b91371d647c49540a

SHA512
1d90f83da35e78bf0d811eb1a694cc092289d57bc64fcc3b94eb054311cc017f8f29cc26abc6ae989f787c674117386d17ba0da5315879cb028fa8999d298424

Download Submit
C:\Windows\System\YbWmUmN.exe

Filesize
2.3MB

MD5
4424d4c82396ff49abef7f268cc849f5

SHA1
645f5b3c0f2aeab2a8dfa70e6b468b2df6eb9672

SHA256
611153968886da567f831502997c48dbb0d47fdd9da17c63f6b3e9b93f89a7d4

SHA512
2879c90e3d7cced9ca19b5508c320a514801b626713873312b96b73ff7bdf6ff5f4b7ba992921f36aeed048b5821737276555345dedcef2baa4323a3a62d7b0b

Download Submit
C:\Windows\System\YfJIpVu.exe

Filesize
2.3MB

MD5
d6f3f946cd07f08f32df90aa60c69d49

SHA1
51c48efbe549580bca754ad7962d8903a65ee980

SHA256
5ae02c8f24f992babc2f1241f57293437ec3e18f3d02b7b2bbf1483ffb09d5e6

SHA512
400433e0b773db11a06f5f5cde992b3b2ca883aa56e8dca16969a19a71069732d7fe19bea26ea998182ba183019fc3a8aa23ff0acdd2f9321b2e160c9a60f891

Download Submit
C:\Windows\System\ZkeceWl.exe

Filesize
2.3MB

MD5
d2733d7eb497fb374d77c90d42a21128

SHA1
50bcdb660f4a6dcb427ea35ee5e99448e3d82e46

SHA256
9ef42ca4a78e660d58f4b8c3cb400e817bb7f0a05210bde67c187b23998cf420

SHA512
74306d73dce1967bc503576be589434e042954a7e15a27fa6d3d3d4bb81d3752cac753448d0bdff9a3d9170734a4ae3b0d48bf458e9fc4584d739a00b3eb477c

Download Submit
C:\Windows\System\bCsjMMb.exe

Filesize
2.3MB

MD5
6192f0a8fcbfe052b1bd03fd50847138

SHA1
19a9891fcd848483dc9baa75ac1cffd4768484cf

SHA256
88b213c1c03dca8164e477d9bad488dfc4b7dc429e9fce9ae76cc10fd3c7004c

SHA512
248508398f26d35ed62cce3b6c4e3f0c5067dd64b8bfebe0d2b68713a6f7b945dcaf0dd409f4ca8d20ff837bdb95813dc495bd92a920950f78abfc31c56d1ff3

Download Submit
C:\Windows\System\bUjNhoE.exe

Filesize
2.3MB

MD5
a412d74372309f95ac73980bcca1b8c1

SHA1
c1dbf989defa8949bc16f0c2a9514cc0157e7691

SHA256
627868360406b4407e9df1db52881f668c0997389bc5569bb90f5765e37ac52c

SHA512
19458793afffc5a8e2ff19fb7daeaaa50e8e0b0700b747e4bf293a8961388f7145ed7534b7f2cefbadd4424e5ec4f9f0c0294b6dff3e949f3efe37a81dc0a8f6

Download Submit
C:\Windows\System\botzIii.exe

Filesize
2.3MB

MD5
80df9c5a31007398cb09985e9fdb2228

SHA1
964dd514c6de993e7c9ee562986fd48badf2836d

SHA256
4240e52766840163b1eabef528cad1c226893242d618a39123b5a10b9dc77597

SHA512
cb76e080925b635a77b8ac8e0076d4ca8cb1daa899f22e585130e697d61c61b1de1f4c6d05e9e2df1ebc98044856d455e282146b395c9dc8c8e1df364b82b848

Download Submit
C:\Windows\System\dVSlFgZ.exe

Filesize
2.3MB

MD5
30646529a23300e0a8299049d1086bd7

SHA1
054246e50748067053d86719517b6cb38f1f6680

SHA256
29b0ff7096bf0158582ca618c94008521c78e2efacf91f7f3680ab8df2373c25

SHA512
7662f9e7a2a5b1664b77157fcc44c4339018877e6fc8c521336869ab146c5eb9288461a0e0f6569f38fe9fc4bea1db6c30e7fd1ab753960ae95ace8cbaaeef5e

Download Submit
C:\Windows\System\gJtQkco.exe

Filesize
2.3MB

MD5
986e9041a182d837d15759d62773924d

SHA1
dcdade54d9d8ba2ca904853823320b18454416bd

SHA256
9978d849b455ccbde90a3adfb0fda00631f80dea8ed7027ed8c33fe409339ac0

SHA512
f6463cf92e7f046c39f0f15eb4f21ac8da3f4b0bc47c11b5da63751c783fdccce6150a03d224f785078ca718c1fdd7310f47f1bf3e73466bc1728663f0c71db0

Download Submit
C:\Windows\System\hTpsphB.exe

Filesize
2.3MB

MD5
e1f42e186461e5d9b2b5b815656c8a0b

SHA1
e8eb848f03315930e9ab81785b6e54f2bce2bad8

SHA256
b251a3b0b6f219ee9ab506108411ca0d82b611e84aa56dfe80c81df88cb6db56

SHA512
d9ddb0534acdff014f7d8101fe24063f1d9a6329903c94a5476555a564c240be9c5c4707f25ca135e12ed99c88419f1164abcdd5d3e75efce83b91244adff055

Download Submit
C:\Windows\System\jjQnxbq.exe

Filesize
2.3MB

MD5
f1aab14ed72d931409f5dd4def898e9d

SHA1
24635704c80cb78ffeb98790b1e121a8965b10d8

SHA256
937924d2528e447b5bbc6c1738a0dca3eb13e5d213b3978dcd7a75abc0ea026d

SHA512
d4e6efeaa2ef75f179837513db5390d447fa2460fadb1f796bebafe266abecb66f9e527b45c579276c24911f1cade71184c9a9b8d605b9b38f671166d67d1600

Download Submit
C:\Windows\System\kZuVEOx.exe

Filesize
2.3MB

MD5
cb543391da6cfc90f815dab667afccb1

SHA1
7fb8a417d127862ab2e214115a285772b31aa172

SHA256
181f2e16dbeb2b5680863fcdb735687b7e30204b56f291b35e89d6ef4fbeab0f

SHA512
927ce0c6480462d4afcc26ad6c6a66f2773a09bfb81af598f79272b6fa1305b4753e609c6963b113836c0239ebe8f079f67b3fabeeb3a1c84acae9e740db4d13

Download Submit
C:\Windows\System\kmuruPG.exe

Filesize
2.3MB

MD5
120b43ca85a7257de2b9b5e627c64625

SHA1
bb8113b0efb2034e4390e869c1ab6409281e791e

SHA256
7de757a6187a2fdef8f59a7946f7e25f21419cd18ff902e176d2d2dce8c97f78

SHA512
3b052644d0e76f7b6736d2864e4073efffd4a4e8f6b60ac152651e162c45a1c381acc18c42691d9c143bc144864162dc2f026638ba3cff63232370c2d01481a1

Download Submit
C:\Windows\System\lMQiObL.exe

Filesize
2.3MB

MD5
610bbae5657a4087ae425ac98e53aa94

SHA1
c4a2171831d5c1137f401670605d97ff95f36087

SHA256
65c31c53d27a5efaf670f3d942da01f961e67fd04431a826adcc869e82c76852

SHA512
b929908120d89fa021e5d3e9d015c8f0599a950829ec842764c251e1cb6f41b029119e65485c6986a865df4afb590553630159208616d771347830c3340b4d99

Download Submit
C:\Windows\System\nfiVSfS.exe

Filesize
2.3MB

MD5
5d8ed5eaaac836f3f6ee6ca4c1dc2c7f

SHA1
39581f8394b5958388404929eb08324488712b23

SHA256
29fecd3027aa562a3c428ea4e6bd1db360825cb7387ef1394f261bba1482f8a5

SHA512
782f30f939d2ae0d159ef0adda3cb34bd8efddcd94c77e545c67253f8bd10755edb388c1fec5b6f1dd9d1908423d2b82d2ce9d81c81aabab8dab7a4669a782ef

Download Submit
C:\Windows\System\pCQqwlB.exe

Filesize
2.3MB

MD5
8e1cde263c1fb8874533c76e3ac21b26

SHA1
15c0bae265e3bff1067731ae00a57c956d7952c7

SHA256
7b1fcedcfe660f83bc588036044477f08d62ef7c0af8dafbfabcc074e19b0c25

SHA512
cb9163b12f4ee1b651a20a5dfbfd885709be526a760c3b5f476771d6df52339e3bfef0268dc0ac07812a9b6eeabfa32bd6cae2f125791230a9816bc0dc8c912b

Download Submit
C:\Windows\System\tMYqFPG.exe

Filesize
2.3MB

MD5
553481229d262da56b613aabc5a4180a

SHA1
b2d80eb81f82fe75d72690f82161d5dd5a6c7bb7

SHA256
16f33c79b42163d03c55ec2eb4049fa957e9a2962d046c8876380608466dfcab

SHA512
ff23116181b889bb4ebb719b80501b767d623aafa176fd2e9d85ce31fd9545bb7c184ff9408d961ae70bc5fd3efc38d05dae7ecd40f401f2935b8c7405e51dec

Download Submit
C:\Windows\System\uGnhbtN.exe

Filesize
2.3MB

MD5
a2a1217b9c4a6c1b6bed8f22dacd4a6b

SHA1
03ad331623bcaff14cda4442dff3e163ef4f583d

SHA256
d3eecc04d044c458c07fd333bc34e041e3c1150b96314ffcbfb3ac9d43822c93

SHA512
dc9292fd7605eb3d9149ac13fe633f396ee67de9fc52bb55e6a3b5329330b08de0342115ffebaf4eca43ff7c37ab6a8f0c1fbb39069401dbece164663f2df900

Download Submit
C:\Windows\System\umGuewp.exe

Filesize
2.3MB

MD5
cd964ed827d0980314ab06c327b7b80c

SHA1
3265de4cef5217c47e3f5a97fe7ea4ac014bfc27

SHA256
24f2985a2e36819a2dbff72fcfc1931a52c6051cbd89ee6578385acc6de30c04

SHA512
d3e05094eaef044d010e4c95175ae11eae3b56f68566f7759f01dd77f50cc9a5fa9b4661c239aadcf95ae12fb85120acb843149c96d8da28ca90c4beba910bc3

Download Submit
C:\Windows\System\vzDQwhE.exe

Filesize
2.3MB

MD5
e5f528a17c2cf856452042427fd6f86a

SHA1
27e4ca5d231498a111d261b645bb9a5719a8cc55

SHA256
c92aaa5b6eac5a8e54eb551c65664108ab8a7c9036ab5c701e9684c454345b9f

SHA512
ac11b414223bae93aa1bd151699691e319e34427f6c51691193abf7bc4c6e66e11df6491db2e91a19abf7fd657e16a8ede455760ba1e2282a5abcd4e22e8d35a

Download Submit
C:\Windows\System\yTtbKEy.exe

Filesize
2.3MB

MD5
a49b6bcef06bc1a119061093751b1962

SHA1
a20583c7b2dfb1f74fa798829cdbabd2af7e2410

SHA256
7ff6694e881b4082cf69309bc16f78f85d8b9cdb46b729d93324adf323ed43c9

SHA512
d6d5b7a223af0996cedf3caa19c71e4db35f1aafac937444614749461d230c8019ad005c49ac463da832ad5cbe3095ce0b3f659b59568c65ad80ce846d8cdaa7

Download Submit
C:\Windows\System\ycjVikO.exe

Filesize
2.3MB

MD5
3bc4baffe66a3bf1269766b3345e9974

SHA1
bc2eec100754ff888e0c2ae3ca10a08e156d7bfa

SHA256
0c1a4e49700f0dcdc11e25b94c8fe28294e582c85e0c64b1705d5f037bad8837

SHA512
5780784e1dd4686cf83fe623a83121c7ba284e53cc1b2bf49ee07d90b3f37d3cb0a30692d59b2118f189f086e8032838febe5c37d2829af18b2102cd5ff6dec7

Download Submit
memory/868-112-0x00007FF607230000-0x00007FF607622000-memory.dmp

Filesize
3.9MB

Download
memory/868-2176-0x00007FF607230000-0x00007FF607622000-memory.dmp

Filesize
3.9MB

Download
memory/868-2149-0x00007FF607230000-0x00007FF607622000-memory.dmp

Filesize
3.9MB

Download
memory/1020-0-0x00007FF624170000-0x00007FF624562000-memory.dmp

Filesize
3.9MB

Download
memory/1020-1-0x000001A4DD700000-0x000001A4DD710000-memory.dmp

Filesize
64KB

Download
memory/1052-86-0x00007FF719DC0000-0x00007FF71A1B2000-memory.dmp

Filesize
3.9MB

Download
memory/1052-2168-0x00007FF719DC0000-0x00007FF71A1B2000-memory.dmp

Filesize
3.9MB

Download
memory/1080-615-0x00007FF72AD80000-0x00007FF72B172000-memory.dmp

Filesize
3.9MB

Download
memory/1080-2192-0x00007FF72AD80000-0x00007FF72B172000-memory.dmp

Filesize
3.9MB

Download
memory/1436-2166-0x00007FF7123A0000-0x00007FF712792000-memory.dmp

Filesize
3.9MB

Download
memory/1436-83-0x00007FF7123A0000-0x00007FF712792000-memory.dmp

Filesize
3.9MB

Download
memory/1488-2145-0x00007FF65D4B0000-0x00007FF65D8A2000-memory.dmp

Filesize
3.9MB

Download
memory/1488-2179-0x00007FF65D4B0000-0x00007FF65D8A2000-memory.dmp

Filesize
3.9MB

Download
memory/1488-108-0x00007FF65D4B0000-0x00007FF65D8A2000-memory.dmp

Filesize
3.9MB

Download
memory/1496-2156-0x00007FF6E6D90000-0x00007FF6E7182000-memory.dmp

Filesize
3.9MB

Download
memory/1496-32-0x00007FF6E6D90000-0x00007FF6E7182000-memory.dmp

Filesize
3.9MB

Download
memory/2128-2171-0x00007FF7B3FE0000-0x00007FF7B43D2000-memory.dmp

Filesize
3.9MB

Download
memory/2128-89-0x00007FF7B3FE0000-0x00007FF7B43D2000-memory.dmp

Filesize
3.9MB

Download
memory/2284-98-0x00007FF6C8F40000-0x00007FF6C9332000-memory.dmp

Filesize
3.9MB

Download
memory/2284-2183-0x00007FF6C8F40000-0x00007FF6C9332000-memory.dmp

Filesize
3.9MB

Download
memory/2308-39-0x00007FF6E74B0000-0x00007FF6E78A2000-memory.dmp

Filesize
3.9MB

Download
memory/2308-2162-0x00007FF6E74B0000-0x00007FF6E78A2000-memory.dmp

Filesize
3.9MB

Download
memory/2464-611-0x00007FF602DE0000-0x00007FF6031D2000-memory.dmp

Filesize
3.9MB

Download
memory/2464-2190-0x00007FF602DE0000-0x00007FF6031D2000-memory.dmp

Filesize
3.9MB

Download
memory/2632-2159-0x00007FF6731A0000-0x00007FF673592000-memory.dmp

Filesize
3.9MB

Download
memory/2632-80-0x00007FF6731A0000-0x00007FF673592000-memory.dmp

Filesize
3.9MB

Download
memory/2788-2155-0x00007FF6F44A0000-0x00007FF6F4892000-memory.dmp

Filesize
3.9MB

Download
memory/2788-1759-0x00007FF6F44A0000-0x00007FF6F4892000-memory.dmp

Filesize
3.9MB

Download
memory/2788-28-0x00007FF6F44A0000-0x00007FF6F4892000-memory.dmp

Filesize
3.9MB

Download
memory/2924-90-0x00007FF68BA20000-0x00007FF68BE12000-memory.dmp

Filesize
3.9MB

Download
memory/2924-2165-0x00007FF68BA20000-0x00007FF68BE12000-memory.dmp

Filesize
3.9MB

Download
memory/3188-2161-0x00007FF7D0D90000-0x00007FF7D1182000-memory.dmp

Filesize
3.9MB

Download
memory/3188-77-0x00007FF7D0D90000-0x00007FF7D1182000-memory.dmp

Filesize
3.9MB

Download
memory/3196-2111-0x00007FF6911B0000-0x00007FF6915A2000-memory.dmp

Filesize
3.9MB

Download
memory/3196-13-0x00007FF6911B0000-0x00007FF6915A2000-memory.dmp

Filesize
3.9MB

Download
memory/3196-2152-0x00007FF6911B0000-0x00007FF6915A2000-memory.dmp

Filesize
3.9MB

Download
memory/3248-20-0x0000021729580000-0x0000021729590000-memory.dmp

Filesize
64KB

Download
memory/3248-19-0x0000021729580000-0x0000021729590000-memory.dmp

Filesize
64KB

Download
memory/3248-66-0x0000021729590000-0x00000217295B2000-memory.dmp

Filesize
136KB

Download
memory/3248-63-0x00007FFE2A0A0000-0x00007FFE2AB61000-memory.dmp

Filesize
10.8MB

Download
memory/3252-2172-0x00007FF6E50E0000-0x00007FF6E54D2000-memory.dmp

Filesize
3.9MB

Download
memory/3252-93-0x00007FF6E50E0000-0x00007FF6E54D2000-memory.dmp

Filesize
3.9MB

Download
memory/3336-95-0x00007FF682250000-0x00007FF682642000-memory.dmp

Filesize
3.9MB

Download
memory/3336-2188-0x00007FF682250000-0x00007FF682642000-memory.dmp

Filesize
3.9MB

Download
memory/4240-2144-0x00007FF708310000-0x00007FF708702000-memory.dmp

Filesize
3.9MB

Download
memory/4240-104-0x00007FF708310000-0x00007FF708702000-memory.dmp

Filesize
3.9MB

Download
memory/4240-2184-0x00007FF708310000-0x00007FF708702000-memory.dmp

Filesize
3.9MB

Download
memory/4632-2150-0x00007FF766EB0000-0x00007FF7672A2000-memory.dmp

Filesize
3.9MB

Download
memory/4632-115-0x00007FF766EB0000-0x00007FF7672A2000-memory.dmp

Filesize
3.9MB

Download
memory/4632-2175-0x00007FF766EB0000-0x00007FF7672A2000-memory.dmp

Filesize
3.9MB

Download
memory/4824-2186-0x00007FF646A10000-0x00007FF646E02000-memory.dmp

Filesize
3.9MB

Download
memory/4824-605-0x00007FF646A10000-0x00007FF646E02000-memory.dmp

Filesize
3.9MB

Download
memory/4964-604-0x00007FF698200000-0x00007FF6985F2000-memory.dmp

Filesize
3.9MB

Download
memory/4964-2180-0x00007FF698200000-0x00007FF6985F2000-memory.dmp

Filesize
3.9MB

Download