xmrig | c713b1219617a68f2fd9b0dd30dcd5c165c0229808aaa43b99ea51120d195c5d

Analysis

max time kernel
41s
max time network
40s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 00:41

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
Size

1.9MB
MD5

03ffd0e4421657df24ead0752925f3c2
SHA1

300b9a03bfdd88c8f1e8d757b12cf72969363627
SHA256

c713b1219617a68f2fd9b0dd30dcd5c165c0229808aaa43b99ea51120d195c5d
SHA512

37e9a2ccca54263bbba448702b7fdee3af1db2f3b6a4caed824f5c5b663f046070e76b127571fc2f697aa778aa9f027e7e83ac1460f7863b63d2372d0d19c248
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlBo:NABP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 20 IoCs

miner

resource	yara_rule
behavioral2/memory/4764-486-0x00007FF693F20000-0x00007FF694312000-memory.dmp	xmrig
behavioral2/memory/4892-496-0x00007FF604DA0000-0x00007FF605192000-memory.dmp	xmrig
behavioral2/memory/2732-524-0x00007FF68DAD0000-0x00007FF68DEC2000-memory.dmp	xmrig
behavioral2/memory/4272-518-0x00007FF65E6E0000-0x00007FF65EAD2000-memory.dmp	xmrig
behavioral2/memory/4488-515-0x00007FF7D4130000-0x00007FF7D4522000-memory.dmp	xmrig
behavioral2/memory/2676-508-0x00007FF70F680000-0x00007FF70FA72000-memory.dmp	xmrig
behavioral2/memory/468-501-0x00007FF6B01B0000-0x00007FF6B05A2000-memory.dmp	xmrig
behavioral2/memory/4012-479-0x00007FF689E30000-0x00007FF68A222000-memory.dmp	xmrig
behavioral2/memory/4428-538-0x00007FF76A830000-0x00007FF76AC22000-memory.dmp	xmrig
behavioral2/memory/3292-547-0x00007FF604350000-0x00007FF604742000-memory.dmp	xmrig
behavioral2/memory/1048-561-0x00007FF608ED0000-0x00007FF6092C2000-memory.dmp	xmrig
behavioral2/memory/1080-556-0x00007FF7FE930000-0x00007FF7FED22000-memory.dmp	xmrig
behavioral2/memory/636-555-0x00007FF684210000-0x00007FF684602000-memory.dmp	xmrig
behavioral2/memory/2000-535-0x00007FF6F93B0000-0x00007FF6F97A2000-memory.dmp	xmrig
behavioral2/memory/4532-76-0x00007FF6FAD60000-0x00007FF6FB152000-memory.dmp	xmrig
behavioral2/memory/2228-53-0x00007FF650140000-0x00007FF650532000-memory.dmp	xmrig
behavioral2/memory/1864-50-0x00007FF7A6230000-0x00007FF7A6622000-memory.dmp	xmrig
behavioral2/memory/3136-569-0x00007FF69BFD0000-0x00007FF69C3C2000-memory.dmp	xmrig
behavioral2/memory/4496-578-0x00007FF6F9820000-0x00007FF6F9C12000-memory.dmp	xmrig
behavioral2/memory/2772-567-0x00007FF746220000-0x00007FF746612000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2808	phyjiCJ.exe
2772	GmKgCpJ.exe
1864	blmgbtz.exe
2228	JgYYxPM.exe
4532	gcorRrL.exe
4012	BKiTVdV.exe
4764	DxNTBxz.exe
4892	jmjbGcH.exe
468	BIPJfRa.exe
3136	rfAKyIv.exe
4496	uGfwAwp.exe
2676	HdcEGee.exe
4488	EDCzvsP.exe
4272	lyfAfFT.exe
2732	DjuwIcv.exe
2000	gELHQbv.exe
4428	IwRlINB.exe
3292	JBezbcj.exe
636	RBAdiMZ.exe
1080	meZtFbg.exe
1048	OIkfNnP.exe
4896	qiEWHst.exe
760	jkynzbt.exe
4208	hGuxQOh.exe
2064	PqQChsl.exe
4400	ejrDZRn.exe
3636	zFEfWGU.exe
3192	JyNSMdH.exe
2208	GjHeiBr.exe
2840	LYGMXjU.exe
3888	ZGDyVDy.exe
3644	NjSvxwo.exe
3496	LcbVuyI.exe
3908	tTNxBGH.exe
4788	dhQDWxB.exe
2716	rcCOygw.exe
4552	JbLVDUZ.exe
3288	mECdHGQ.exe
1480	JxGLIjf.exe
4024	uZBHPVA.exe
4456	wlKGrZS.exe
4620	eUMbmcn.exe
4136	crrLLIc.exe
4996	PjylCrd.exe
1992	pSXMbmD.exe
2360	xXpiHCp.exe
1808	JfElEcV.exe
4860	QgMxquQ.exe
3716	XrOqFVl.exe
4832	yzFlkbY.exe
3932	GOAhzLt.exe
4476	TCDwQlr.exe
3796	AjwmDxc.exe
4520	sqCqbyS.exe
400	sJNHmVE.exe
2060	FsdPKTg.exe
2364	MeDgzyj.exe
4932	jagEDiP.exe
5048	fXyRnDf.exe
5044	vjCEyVv.exe
4536	oDcLvaz.exe
5096	zGhDXdF.exe
3672	ZKLWEPt.exe
4212	AGqtSFG.exe

UPX packed file 55 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4372-0-0x00007FF631390000-0x00007FF631782000-memory.dmp	upx
behavioral2/files/0x000d000000023b90-5.dat	upx
behavioral2/files/0x000a000000023b9c-25.dat	upx
behavioral2/files/0x000a000000023b9a-32.dat	upx
behavioral2/files/0x000a000000023b9d-35.dat	upx
behavioral2/files/0x000a000000023ba0-43.dat	upx
behavioral2/files/0x000a000000023ba1-54.dat	upx
behavioral2/files/0x000a000000023ba4-84.dat	upx
behavioral2/files/0x000b000000023ba7-94.dat	upx
behavioral2/files/0x000a000000023bad-129.dat	upx
behavioral2/files/0x000a000000023baf-139.dat	upx
behavioral2/files/0x000a000000023bb2-148.dat	upx
behavioral2/memory/4764-486-0x00007FF693F20000-0x00007FF694312000-memory.dmp	upx
behavioral2/memory/4892-496-0x00007FF604DA0000-0x00007FF605192000-memory.dmp	upx
behavioral2/memory/2732-524-0x00007FF68DAD0000-0x00007FF68DEC2000-memory.dmp	upx
behavioral2/memory/4272-518-0x00007FF65E6E0000-0x00007FF65EAD2000-memory.dmp	upx
behavioral2/memory/4488-515-0x00007FF7D4130000-0x00007FF7D4522000-memory.dmp	upx
behavioral2/memory/2676-508-0x00007FF70F680000-0x00007FF70FA72000-memory.dmp	upx
behavioral2/memory/468-501-0x00007FF6B01B0000-0x00007FF6B05A2000-memory.dmp	upx
behavioral2/memory/4012-479-0x00007FF689E30000-0x00007FF68A222000-memory.dmp	upx
behavioral2/memory/4428-538-0x00007FF76A830000-0x00007FF76AC22000-memory.dmp	upx
behavioral2/memory/3292-547-0x00007FF604350000-0x00007FF604742000-memory.dmp	upx
behavioral2/memory/1048-561-0x00007FF608ED0000-0x00007FF6092C2000-memory.dmp	upx
behavioral2/memory/1080-556-0x00007FF7FE930000-0x00007FF7FED22000-memory.dmp	upx
behavioral2/memory/636-555-0x00007FF684210000-0x00007FF684602000-memory.dmp	upx
behavioral2/memory/2000-535-0x00007FF6F93B0000-0x00007FF6F97A2000-memory.dmp	upx
behavioral2/files/0x000a000000023bb8-178.dat	upx
behavioral2/files/0x000a000000023bb6-176.dat	upx
behavioral2/files/0x000a000000023bb7-173.dat	upx
behavioral2/files/0x000a000000023bb5-171.dat	upx
behavioral2/files/0x000a000000023bb4-166.dat	upx
behavioral2/files/0x000a000000023bb3-161.dat	upx
behavioral2/files/0x000a000000023bb1-151.dat	upx
behavioral2/files/0x000a000000023bb0-146.dat	upx
behavioral2/files/0x000a000000023bae-134.dat	upx
behavioral2/files/0x000a000000023bac-124.dat	upx
behavioral2/files/0x000b000000023ba6-119.dat	upx
behavioral2/files/0x000a000000023bab-114.dat	upx
behavioral2/files/0x000a000000023baa-109.dat	upx
behavioral2/files/0x000a000000023ba9-104.dat	upx
behavioral2/files/0x000a000000023ba8-99.dat	upx
behavioral2/files/0x000a000000023ba5-89.dat	upx
behavioral2/files/0x000a000000023ba3-82.dat	upx
behavioral2/memory/4532-76-0x00007FF6FAD60000-0x00007FF6FB152000-memory.dmp	upx
behavioral2/files/0x000a000000023ba2-75.dat	upx
behavioral2/memory/2228-53-0x00007FF650140000-0x00007FF650532000-memory.dmp	upx
behavioral2/memory/1864-50-0x00007FF7A6230000-0x00007FF7A6622000-memory.dmp	upx
behavioral2/files/0x000a000000023b9f-45.dat	upx
behavioral2/files/0x000a000000023b9b-39.dat	upx
behavioral2/files/0x000a000000023b9e-28.dat	upx
behavioral2/files/0x000a000000023b99-26.dat	upx
behavioral2/memory/2808-17-0x00007FF7B13B0000-0x00007FF7B17A2000-memory.dmp	upx
behavioral2/memory/3136-569-0x00007FF69BFD0000-0x00007FF69C3C2000-memory.dmp	upx
behavioral2/memory/4496-578-0x00007FF6F9820000-0x00007FF6F9C12000-memory.dmp	upx
behavioral2/memory/2772-567-0x00007FF746220000-0x00007FF746612000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\onjXSzc.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\NBbGjzn.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\NtPTOOy.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\nNKrjJZ.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\Unlccjk.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\gGbklAL.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\LueBUIT.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\aKiQLJy.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\DiOfgpF.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\YhPJUzI.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\rYAheuR.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\NEwdKFW.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\zTDhbYK.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\lJuhnkm.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\HKydeDv.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\lMVGart.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\OIkfNnP.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\AFTkFIx.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\FFmeGsd.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\nRErvQw.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\bitSyiy.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\gVRNKLz.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\FIkFZoC.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\ZNOGtZP.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\XWTSiBV.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\mKiFfYN.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\WXQoGUz.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\CvbtVAZ.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\QZPBJed.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\AMHhMqU.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\hWjMZHo.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\qTSSCfc.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\kOWpEZU.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\WeTCZAq.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\engQcYi.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\jnRZCIe.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\LRIWQaY.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\CQDbxAK.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\wgTrbWk.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\VhOdFBg.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\clliqOV.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\jlxsysq.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\nErLwoi.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\DMTgPje.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\dvAjCSj.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\CvyvlAr.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\DeRRcMh.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\sZwqbZA.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\IcMhVKs.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\dwBUrVk.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\GRBsdou.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\pidZPAk.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\dMvrrfL.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\NqPfFxm.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\JKsnzGA.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\SfWqSXn.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\vbmQIwz.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\hBVcVxb.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\snhFGKW.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\tGzjRva.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\XJPiWfA.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\mofadkA.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\nSFLwqh.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\jbfOifm.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4396	powershell.exe
4396	powershell.exe
4396	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
Token: SeDebugPrivilege	4396	powershell.exe
Token: SeLockMemoryPrivilege	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 4396	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	85
PID 4372 wrote to memory of 4396	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	85
PID 4372 wrote to memory of 2808	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	86
PID 4372 wrote to memory of 2808	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	86
PID 4372 wrote to memory of 2772	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	87
PID 4372 wrote to memory of 2772	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	87
PID 4372 wrote to memory of 1864	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	88
PID 4372 wrote to memory of 1864	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	88
PID 4372 wrote to memory of 4532	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	89
PID 4372 wrote to memory of 4532	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	89
PID 4372 wrote to memory of 4012	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	90
PID 4372 wrote to memory of 4012	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	90
PID 4372 wrote to memory of 2228	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	91
PID 4372 wrote to memory of 2228	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	91
PID 4372 wrote to memory of 4764	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	92
PID 4372 wrote to memory of 4764	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	92
PID 4372 wrote to memory of 4892	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	93
PID 4372 wrote to memory of 4892	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	93
PID 4372 wrote to memory of 468	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	94
PID 4372 wrote to memory of 468	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	94
PID 4372 wrote to memory of 3136	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	95
PID 4372 wrote to memory of 3136	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	95
PID 4372 wrote to memory of 4496	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	96
PID 4372 wrote to memory of 4496	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	96
PID 4372 wrote to memory of 2676	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	97
PID 4372 wrote to memory of 2676	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	97
PID 4372 wrote to memory of 4488	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	98
PID 4372 wrote to memory of 4488	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	98
PID 4372 wrote to memory of 4272	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	99
PID 4372 wrote to memory of 4272	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	99
PID 4372 wrote to memory of 2732	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	100
PID 4372 wrote to memory of 2732	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	100
PID 4372 wrote to memory of 2000	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	101
PID 4372 wrote to memory of 2000	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	101
PID 4372 wrote to memory of 4428	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	102
PID 4372 wrote to memory of 4428	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	102
PID 4372 wrote to memory of 3292	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	103
PID 4372 wrote to memory of 3292	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	103
PID 4372 wrote to memory of 636	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	104
PID 4372 wrote to memory of 636	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	104
PID 4372 wrote to memory of 1080	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	105
PID 4372 wrote to memory of 1080	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	105
PID 4372 wrote to memory of 1048	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	106
PID 4372 wrote to memory of 1048	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	106
PID 4372 wrote to memory of 4896	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	107
PID 4372 wrote to memory of 4896	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	107
PID 4372 wrote to memory of 760	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	108
PID 4372 wrote to memory of 760	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	108
PID 4372 wrote to memory of 4208	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	109
PID 4372 wrote to memory of 4208	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	109
PID 4372 wrote to memory of 2064	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	110
PID 4372 wrote to memory of 2064	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	110
PID 4372 wrote to memory of 4400	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	111
PID 4372 wrote to memory of 4400	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	111
PID 4372 wrote to memory of 3636	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	112
PID 4372 wrote to memory of 3636	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	112
PID 4372 wrote to memory of 3192	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	113
PID 4372 wrote to memory of 3192	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	113
PID 4372 wrote to memory of 2208	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	114
PID 4372 wrote to memory of 2208	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	114
PID 4372 wrote to memory of 2840	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	115
PID 4372 wrote to memory of 2840	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	115
PID 4372 wrote to memory of 3888	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	116
PID 4372 wrote to memory of 3888	4372	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4396
- C:\Windows\System\phyjiCJ.exe
  C:\Windows\System\phyjiCJ.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\GmKgCpJ.exe
  C:\Windows\System\GmKgCpJ.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\blmgbtz.exe
  C:\Windows\System\blmgbtz.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\gcorRrL.exe
  C:\Windows\System\gcorRrL.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\BKiTVdV.exe
  C:\Windows\System\BKiTVdV.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\JgYYxPM.exe
  C:\Windows\System\JgYYxPM.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\DxNTBxz.exe
  C:\Windows\System\DxNTBxz.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\jmjbGcH.exe
  C:\Windows\System\jmjbGcH.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\BIPJfRa.exe
  C:\Windows\System\BIPJfRa.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\rfAKyIv.exe
  C:\Windows\System\rfAKyIv.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\uGfwAwp.exe
  C:\Windows\System\uGfwAwp.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\HdcEGee.exe
  C:\Windows\System\HdcEGee.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\EDCzvsP.exe
  C:\Windows\System\EDCzvsP.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\lyfAfFT.exe
  C:\Windows\System\lyfAfFT.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\DjuwIcv.exe
  C:\Windows\System\DjuwIcv.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\gELHQbv.exe
  C:\Windows\System\gELHQbv.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\IwRlINB.exe
  C:\Windows\System\IwRlINB.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\JBezbcj.exe
  C:\Windows\System\JBezbcj.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\RBAdiMZ.exe
  C:\Windows\System\RBAdiMZ.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\meZtFbg.exe
  C:\Windows\System\meZtFbg.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\OIkfNnP.exe
  C:\Windows\System\OIkfNnP.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\qiEWHst.exe
  C:\Windows\System\qiEWHst.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\jkynzbt.exe
  C:\Windows\System\jkynzbt.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\hGuxQOh.exe
  C:\Windows\System\hGuxQOh.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\PqQChsl.exe
  C:\Windows\System\PqQChsl.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\ejrDZRn.exe
  C:\Windows\System\ejrDZRn.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\zFEfWGU.exe
  C:\Windows\System\zFEfWGU.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\JyNSMdH.exe
  C:\Windows\System\JyNSMdH.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\GjHeiBr.exe
  C:\Windows\System\GjHeiBr.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\LYGMXjU.exe
  C:\Windows\System\LYGMXjU.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\ZGDyVDy.exe
  C:\Windows\System\ZGDyVDy.exe
  2⤵
  - Executes dropped EXE
  PID:3888
- C:\Windows\System\NjSvxwo.exe
  C:\Windows\System\NjSvxwo.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\LcbVuyI.exe
  C:\Windows\System\LcbVuyI.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\tTNxBGH.exe
  C:\Windows\System\tTNxBGH.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\dhQDWxB.exe
  C:\Windows\System\dhQDWxB.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\rcCOygw.exe
  C:\Windows\System\rcCOygw.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\JbLVDUZ.exe
  C:\Windows\System\JbLVDUZ.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\mECdHGQ.exe
  C:\Windows\System\mECdHGQ.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\JxGLIjf.exe
  C:\Windows\System\JxGLIjf.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\uZBHPVA.exe
  C:\Windows\System\uZBHPVA.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\wlKGrZS.exe
  C:\Windows\System\wlKGrZS.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\eUMbmcn.exe
  C:\Windows\System\eUMbmcn.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\crrLLIc.exe
  C:\Windows\System\crrLLIc.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\PjylCrd.exe
  C:\Windows\System\PjylCrd.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\pSXMbmD.exe
  C:\Windows\System\pSXMbmD.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\xXpiHCp.exe
  C:\Windows\System\xXpiHCp.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\JfElEcV.exe
  C:\Windows\System\JfElEcV.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\QgMxquQ.exe
  C:\Windows\System\QgMxquQ.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\XrOqFVl.exe
  C:\Windows\System\XrOqFVl.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System\yzFlkbY.exe
  C:\Windows\System\yzFlkbY.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\GOAhzLt.exe
  C:\Windows\System\GOAhzLt.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\TCDwQlr.exe
  C:\Windows\System\TCDwQlr.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\AjwmDxc.exe
  C:\Windows\System\AjwmDxc.exe
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Windows\System\sqCqbyS.exe
  C:\Windows\System\sqCqbyS.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\sJNHmVE.exe
  C:\Windows\System\sJNHmVE.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\FsdPKTg.exe
  C:\Windows\System\FsdPKTg.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\MeDgzyj.exe
  C:\Windows\System\MeDgzyj.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\jagEDiP.exe
  C:\Windows\System\jagEDiP.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\fXyRnDf.exe
  C:\Windows\System\fXyRnDf.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\vjCEyVv.exe
  C:\Windows\System\vjCEyVv.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\oDcLvaz.exe
  C:\Windows\System\oDcLvaz.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\zGhDXdF.exe
  C:\Windows\System\zGhDXdF.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\ZKLWEPt.exe
  C:\Windows\System\ZKLWEPt.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\AGqtSFG.exe
  C:\Windows\System\AGqtSFG.exe
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Windows\System\UNnPCSD.exe
  C:\Windows\System\UNnPCSD.exe
  2⤵
  PID:3152
- C:\Windows\System\DdaQNBt.exe
  C:\Windows\System\DdaQNBt.exe
  2⤵
  PID:2792
- C:\Windows\System\ftJAgbU.exe
  C:\Windows\System\ftJAgbU.exe
  2⤵
  PID:3140
- C:\Windows\System\VZHWTiT.exe
  C:\Windows\System\VZHWTiT.exe
  2⤵
  PID:3564
- C:\Windows\System\cXvgWSV.exe
  C:\Windows\System\cXvgWSV.exe
  2⤵
  PID:5136
- C:\Windows\System\yCXVScP.exe
  C:\Windows\System\yCXVScP.exe
  2⤵
  PID:5164
- C:\Windows\System\xZZKxIY.exe
  C:\Windows\System\xZZKxIY.exe
  2⤵
  PID:5192
- C:\Windows\System\HRHpKcB.exe
  C:\Windows\System\HRHpKcB.exe
  2⤵
  PID:5220
- C:\Windows\System\MFVHABv.exe
  C:\Windows\System\MFVHABv.exe
  2⤵
  PID:5248
- C:\Windows\System\pbzBOjw.exe
  C:\Windows\System\pbzBOjw.exe
  2⤵
  PID:5276
- C:\Windows\System\VCiUgtd.exe
  C:\Windows\System\VCiUgtd.exe
  2⤵
  PID:5304
- C:\Windows\System\uiRgORP.exe
  C:\Windows\System\uiRgORP.exe
  2⤵
  PID:5332
- C:\Windows\System\pqnXCDU.exe
  C:\Windows\System\pqnXCDU.exe
  2⤵
  PID:5360
- C:\Windows\System\ikqOchA.exe
  C:\Windows\System\ikqOchA.exe
  2⤵
  PID:5388
- C:\Windows\System\ETFQvyd.exe
  C:\Windows\System\ETFQvyd.exe
  2⤵
  PID:5416
- C:\Windows\System\VBiCxsW.exe
  C:\Windows\System\VBiCxsW.exe
  2⤵
  PID:5444
- C:\Windows\System\EfXCdnj.exe
  C:\Windows\System\EfXCdnj.exe
  2⤵
  PID:5472
- C:\Windows\System\IWCvzDT.exe
  C:\Windows\System\IWCvzDT.exe
  2⤵
  PID:5500
- C:\Windows\System\wcJHTvJ.exe
  C:\Windows\System\wcJHTvJ.exe
  2⤵
  PID:5528
- C:\Windows\System\iTtSZxH.exe
  C:\Windows\System\iTtSZxH.exe
  2⤵
  PID:5556
- C:\Windows\System\YYgbnie.exe
  C:\Windows\System\YYgbnie.exe
  2⤵
  PID:5584
- C:\Windows\System\jKjBpqY.exe
  C:\Windows\System\jKjBpqY.exe
  2⤵
  PID:5616
- C:\Windows\System\vUfVVdr.exe
  C:\Windows\System\vUfVVdr.exe
  2⤵
  PID:5640
- C:\Windows\System\SSXDxST.exe
  C:\Windows\System\SSXDxST.exe
  2⤵
  PID:5668
- C:\Windows\System\svrqsPU.exe
  C:\Windows\System\svrqsPU.exe
  2⤵
  PID:5696
- C:\Windows\System\nJHyUkd.exe
  C:\Windows\System\nJHyUkd.exe
  2⤵
  PID:5720
- C:\Windows\System\IHwjBnO.exe
  C:\Windows\System\IHwjBnO.exe
  2⤵
  PID:5752
- C:\Windows\System\mnqEuuU.exe
  C:\Windows\System\mnqEuuU.exe
  2⤵
  PID:5780
- C:\Windows\System\gErNOch.exe
  C:\Windows\System\gErNOch.exe
  2⤵
  PID:5808
- C:\Windows\System\JmVISyx.exe
  C:\Windows\System\JmVISyx.exe
  2⤵
  PID:5840
- C:\Windows\System\DNmjayg.exe
  C:\Windows\System\DNmjayg.exe
  2⤵
  PID:5864
- C:\Windows\System\WQcdmsa.exe
  C:\Windows\System\WQcdmsa.exe
  2⤵
  PID:5892
- C:\Windows\System\YkycqrR.exe
  C:\Windows\System\YkycqrR.exe
  2⤵
  PID:5920
- C:\Windows\System\mDTZJjW.exe
  C:\Windows\System\mDTZJjW.exe
  2⤵
  PID:5948
- C:\Windows\System\pKZMvwG.exe
  C:\Windows\System\pKZMvwG.exe
  2⤵
  PID:5972
- C:\Windows\System\LwzVXoW.exe
  C:\Windows\System\LwzVXoW.exe
  2⤵
  PID:6004
- C:\Windows\System\OWIWzxi.exe
  C:\Windows\System\OWIWzxi.exe
  2⤵
  PID:6032
- C:\Windows\System\JifWUnd.exe
  C:\Windows\System\JifWUnd.exe
  2⤵
  PID:6060
- C:\Windows\System\wnSkOYw.exe
  C:\Windows\System\wnSkOYw.exe
  2⤵
  PID:6088
- C:\Windows\System\WgfabTd.exe
  C:\Windows\System\WgfabTd.exe
  2⤵
  PID:6120
- C:\Windows\System\BYIteAw.exe
  C:\Windows\System\BYIteAw.exe
  2⤵
  PID:3312
- C:\Windows\System\Kevuxux.exe
  C:\Windows\System\Kevuxux.exe
  2⤵
  PID:2768
- C:\Windows\System\lZbONcd.exe
  C:\Windows\System\lZbONcd.exe
  2⤵
  PID:4864
- C:\Windows\System\EiqjoFO.exe
  C:\Windows\System\EiqjoFO.exe
  2⤵
  PID:2428
- C:\Windows\System\tyZhXHQ.exe
  C:\Windows\System\tyZhXHQ.exe
  2⤵
  PID:5124
- C:\Windows\System\KHbjqxv.exe
  C:\Windows\System\KHbjqxv.exe
  2⤵
  PID:5180
- C:\Windows\System\BmQNUCZ.exe
  C:\Windows\System\BmQNUCZ.exe
  2⤵
  PID:5240
- C:\Windows\System\HXwntqk.exe
  C:\Windows\System\HXwntqk.exe
  2⤵
  PID:5292
- C:\Windows\System\JGUnmvi.exe
  C:\Windows\System\JGUnmvi.exe
  2⤵
  PID:5352
- C:\Windows\System\AsIlAQI.exe
  C:\Windows\System\AsIlAQI.exe
  2⤵
  PID:5408
- C:\Windows\System\kNfpcsI.exe
  C:\Windows\System\kNfpcsI.exe
  2⤵
  PID:5548
- C:\Windows\System\lgpukQj.exe
  C:\Windows\System\lgpukQj.exe
  2⤵
  PID:2608
- C:\Windows\System\lvUxQAN.exe
  C:\Windows\System\lvUxQAN.exe
  2⤵
  PID:5624
- C:\Windows\System\MPWpAxf.exe
  C:\Windows\System\MPWpAxf.exe
  2⤵
  PID:5652
- C:\Windows\System\hXdjOZr.exe
  C:\Windows\System\hXdjOZr.exe
  2⤵
  PID:5708
- C:\Windows\System\qFsJUAa.exe
  C:\Windows\System\qFsJUAa.exe
  2⤵
  PID:5744
- C:\Windows\System\OJFOMzW.exe
  C:\Windows\System\OJFOMzW.exe
  2⤵
  PID:5796
- C:\Windows\System\tXonIBe.exe
  C:\Windows\System\tXonIBe.exe
  2⤵
  PID:5856
- C:\Windows\System\BMHUskh.exe
  C:\Windows\System\BMHUskh.exe
  2⤵
  PID:4296
- C:\Windows\System\RqLBiRB.exe
  C:\Windows\System\RqLBiRB.exe
  2⤵
  PID:5960
- C:\Windows\System\BoDEgCx.exe
  C:\Windows\System\BoDEgCx.exe
  2⤵
  PID:6016
- C:\Windows\System\mGvhAag.exe
  C:\Windows\System\mGvhAag.exe
  2⤵
  PID:6080
- C:\Windows\System\dxDboGV.exe
  C:\Windows\System\dxDboGV.exe
  2⤵
  PID:6128
- C:\Windows\System\npwOSIe.exe
  C:\Windows\System\npwOSIe.exe
  2⤵
  PID:4920
- C:\Windows\System\Ydcqafq.exe
  C:\Windows\System\Ydcqafq.exe
  2⤵
  PID:4368
- C:\Windows\System\oFrOhLD.exe
  C:\Windows\System\oFrOhLD.exe
  2⤵
  PID:5264
- C:\Windows\System\vzErzgQ.exe
  C:\Windows\System\vzErzgQ.exe
  2⤵
  PID:1768
- C:\Windows\System\QJdVgyo.exe
  C:\Windows\System\QJdVgyo.exe
  2⤵
  PID:2056
- C:\Windows\System\SRkIheb.exe
  C:\Windows\System\SRkIheb.exe
  2⤵
  PID:5688
- C:\Windows\System\UvRfiOr.exe
  C:\Windows\System\UvRfiOr.exe
  2⤵
  PID:4816
- C:\Windows\System\phcKhsi.exe
  C:\Windows\System\phcKhsi.exe
  2⤵
  PID:3772
- C:\Windows\System\blNljTq.exe
  C:\Windows\System\blNljTq.exe
  2⤵
  PID:5848
- C:\Windows\System\KmaRZzZ.exe
  C:\Windows\System\KmaRZzZ.exe
  2⤵
  PID:5996
- C:\Windows\System\gTHaYtX.exe
  C:\Windows\System\gTHaYtX.exe
  2⤵
  PID:6048
- C:\Windows\System\TjeJGZA.exe
  C:\Windows\System\TjeJGZA.exe
  2⤵
  PID:2036
- C:\Windows\System\TvtBmNA.exe
  C:\Windows\System\TvtBmNA.exe
  2⤵
  PID:6108
- C:\Windows\System\JDLxPdc.exe
  C:\Windows\System\JDLxPdc.exe
  2⤵
  PID:1252
- C:\Windows\System\QZPBJed.exe
  C:\Windows\System\QZPBJed.exe
  2⤵
  PID:5236
- C:\Windows\System\PRPAyID.exe
  C:\Windows\System\PRPAyID.exe
  2⤵
  PID:5544
- C:\Windows\System\ljBHvEb.exe
  C:\Windows\System\ljBHvEb.exe
  2⤵
  PID:3676
- C:\Windows\System\YRvaCdC.exe
  C:\Windows\System\YRvaCdC.exe
  2⤵
  PID:5488
- C:\Windows\System\SwXkppG.exe
  C:\Windows\System\SwXkppG.exe
  2⤵
  PID:5680
- C:\Windows\System\rFWfMOk.exe
  C:\Windows\System\rFWfMOk.exe
  2⤵
  PID:3488
- C:\Windows\System\LsBwpVS.exe
  C:\Windows\System\LsBwpVS.exe
  2⤵
  PID:976
- C:\Windows\System\GuxuGFk.exe
  C:\Windows\System\GuxuGFk.exe
  2⤵
  PID:6104
- C:\Windows\System\KmpDuKg.exe
  C:\Windows\System\KmpDuKg.exe
  2⤵
  PID:516
- C:\Windows\System\wYTuXzK.exe
  C:\Windows\System\wYTuXzK.exe
  2⤵
  PID:2196
- C:\Windows\System\OLMOMlk.exe
  C:\Windows\System\OLMOMlk.exe
  2⤵
  PID:3032
- C:\Windows\System\vfpWzPP.exe
  C:\Windows\System\vfpWzPP.exe
  2⤵
  PID:2984
- C:\Windows\System\PsgAYnW.exe
  C:\Windows\System\PsgAYnW.exe
  2⤵
  PID:6172
- C:\Windows\System\wKxpdMy.exe
  C:\Windows\System\wKxpdMy.exe
  2⤵
  PID:6192
- C:\Windows\System\coLfUND.exe
  C:\Windows\System\coLfUND.exe
  2⤵
  PID:6220
- C:\Windows\System\UCQLQii.exe
  C:\Windows\System\UCQLQii.exe
  2⤵
  PID:6240
- C:\Windows\System\BbDNFts.exe
  C:\Windows\System\BbDNFts.exe
  2⤵
  PID:6272
- C:\Windows\System\vKvcqCC.exe
  C:\Windows\System\vKvcqCC.exe
  2⤵
  PID:6336
- C:\Windows\System\yOjEdbv.exe
  C:\Windows\System\yOjEdbv.exe
  2⤵
  PID:6400
- C:\Windows\System\wzMMNIy.exe
  C:\Windows\System\wzMMNIy.exe
  2⤵
  PID:6468
- C:\Windows\System\bQuoCLL.exe
  C:\Windows\System\bQuoCLL.exe
  2⤵
  PID:6492
- C:\Windows\System\tXPsfKp.exe
  C:\Windows\System\tXPsfKp.exe
  2⤵
  PID:6520
- C:\Windows\System\MECUQsZ.exe
  C:\Windows\System\MECUQsZ.exe
  2⤵
  PID:6552
- C:\Windows\System\yKWgtBa.exe
  C:\Windows\System\yKWgtBa.exe
  2⤵
  PID:6576
- C:\Windows\System\aTWAwCL.exe
  C:\Windows\System\aTWAwCL.exe
  2⤵
  PID:6600
- C:\Windows\System\tEkOoHS.exe
  C:\Windows\System\tEkOoHS.exe
  2⤵
  PID:6620
- C:\Windows\System\plzHOjZ.exe
  C:\Windows\System\plzHOjZ.exe
  2⤵
  PID:6648
- C:\Windows\System\fukFFoi.exe
  C:\Windows\System\fukFFoi.exe
  2⤵
  PID:6672
- C:\Windows\System\uereVUq.exe
  C:\Windows\System\uereVUq.exe
  2⤵
  PID:6692
- C:\Windows\System\ttXmmct.exe
  C:\Windows\System\ttXmmct.exe
  2⤵
  PID:6736
- C:\Windows\System\xwZuyQU.exe
  C:\Windows\System\xwZuyQU.exe
  2⤵
  PID:6760
- C:\Windows\System\lsRUoqj.exe
  C:\Windows\System\lsRUoqj.exe
  2⤵
  PID:6792
- C:\Windows\System\FaQMBpI.exe
  C:\Windows\System\FaQMBpI.exe
  2⤵
  PID:6812
- C:\Windows\System\TZzwjdq.exe
  C:\Windows\System\TZzwjdq.exe
  2⤵
  PID:6848
- C:\Windows\System\hczXGqe.exe
  C:\Windows\System\hczXGqe.exe
  2⤵
  PID:6896
- C:\Windows\System\lwKIbuI.exe
  C:\Windows\System\lwKIbuI.exe
  2⤵
  PID:6928
- C:\Windows\System\KWvTHMK.exe
  C:\Windows\System\KWvTHMK.exe
  2⤵
  PID:6964
- C:\Windows\System\rmPuvUF.exe
  C:\Windows\System\rmPuvUF.exe
  2⤵
  PID:6984
- C:\Windows\System\lMdQAcp.exe
  C:\Windows\System\lMdQAcp.exe
  2⤵
  PID:7040
- C:\Windows\System\BztSGqY.exe
  C:\Windows\System\BztSGqY.exe
  2⤵
  PID:7060
- C:\Windows\System\xKRgtZd.exe
  C:\Windows\System\xKRgtZd.exe
  2⤵
  PID:7076
- C:\Windows\System\MkYremC.exe
  C:\Windows\System\MkYremC.exe
  2⤵
  PID:7120
- C:\Windows\System\vPEmcEq.exe
  C:\Windows\System\vPEmcEq.exe
  2⤵
  PID:7144
- C:\Windows\System\CPuYNqx.exe
  C:\Windows\System\CPuYNqx.exe
  2⤵
  PID:6100
- C:\Windows\System\HUdDjTU.exe
  C:\Windows\System\HUdDjTU.exe
  2⤵
  PID:2904
- C:\Windows\System\cCEFboX.exe
  C:\Windows\System\cCEFboX.exe
  2⤵
  PID:316
- C:\Windows\System\IEOKaeY.exe
  C:\Windows\System\IEOKaeY.exe
  2⤵
  PID:6180
- C:\Windows\System\KyKWzOl.exe
  C:\Windows\System\KyKWzOl.exe
  2⤵
  PID:6232
- C:\Windows\System\CdFgZYS.exe
  C:\Windows\System\CdFgZYS.exe
  2⤵
  PID:6436
- C:\Windows\System\cOKMwjC.exe
  C:\Windows\System\cOKMwjC.exe
  2⤵
  PID:6368
- C:\Windows\System\tuXcHPA.exe
  C:\Windows\System\tuXcHPA.exe
  2⤵
  PID:6528
- C:\Windows\System\SrzuFyW.exe
  C:\Windows\System\SrzuFyW.exe
  2⤵
  PID:6500
- C:\Windows\System\NSshDVU.exe
  C:\Windows\System\NSshDVU.exe
  2⤵
  PID:6560
- C:\Windows\System\nBAYTsq.exe
  C:\Windows\System\nBAYTsq.exe
  2⤵
  PID:6364
- C:\Windows\System\QIdYlPy.exe
  C:\Windows\System\QIdYlPy.exe
  2⤵
  PID:6504
- C:\Windows\System\AnGitFw.exe
  C:\Windows\System\AnGitFw.exe
  2⤵
  PID:6700
- C:\Windows\System\IYGNCdX.exe
  C:\Windows\System\IYGNCdX.exe
  2⤵
  PID:6644
- C:\Windows\System\zIStxGg.exe
  C:\Windows\System\zIStxGg.exe
  2⤵
  PID:6820
- C:\Windows\System\uzGHaNx.exe
  C:\Windows\System\uzGHaNx.exe
  2⤵
  PID:6784
- C:\Windows\System\tFCrear.exe
  C:\Windows\System\tFCrear.exe
  2⤵
  PID:6868
- C:\Windows\System\GpPtsid.exe
  C:\Windows\System\GpPtsid.exe
  2⤵
  PID:6888
- C:\Windows\System\yleFlAR.exe
  C:\Windows\System\yleFlAR.exe
  2⤵
  PID:6976
- C:\Windows\System\CHfClWu.exe
  C:\Windows\System\CHfClWu.exe
  2⤵
  PID:7032
- C:\Windows\System\kJdRyeL.exe
  C:\Windows\System\kJdRyeL.exe
  2⤵
  PID:7092
- C:\Windows\System\TmIQdtL.exe
  C:\Windows\System\TmIQdtL.exe
  2⤵
  PID:7136
- C:\Windows\System\wcTftwm.exe
  C:\Windows\System\wcTftwm.exe
  2⤵
  PID:5988
- C:\Windows\System\tKOujPX.exe
  C:\Windows\System\tKOujPX.exe
  2⤵
  PID:6324
- C:\Windows\System\zKhTiJO.exe
  C:\Windows\System\zKhTiJO.exe
  2⤵
  PID:6296
- C:\Windows\System\nWInsTf.exe
  C:\Windows\System\nWInsTf.exe
  2⤵
  PID:216
- C:\Windows\System\FqwxkUN.exe
  C:\Windows\System\FqwxkUN.exe
  2⤵
  PID:3056
- C:\Windows\System\FcWydqJ.exe
  C:\Windows\System\FcWydqJ.exe
  2⤵
  PID:5344
- C:\Windows\System\ERaeHHd.exe
  C:\Windows\System\ERaeHHd.exe
  2⤵
  PID:6612
- C:\Windows\System\CqNeHWg.exe
  C:\Windows\System\CqNeHWg.exe
  2⤵
  PID:6948
- C:\Windows\System\nPZsxvB.exe
  C:\Windows\System\nPZsxvB.exe
  2⤵
  PID:7052
- C:\Windows\System\vKuUQCY.exe
  C:\Windows\System\vKuUQCY.exe
  2⤵
  PID:6320
- C:\Windows\System\PnxGiAu.exe
  C:\Windows\System\PnxGiAu.exe
  2⤵
  PID:6536
- C:\Windows\System\LcZUuJx.exe
  C:\Windows\System\LcZUuJx.exe
  2⤵
  PID:6748
- C:\Windows\System\gDKBSUM.exe
  C:\Windows\System\gDKBSUM.exe
  2⤵
  PID:7176
- C:\Windows\System\UXSxRUO.exe
  C:\Windows\System\UXSxRUO.exe
  2⤵
  PID:7224
- C:\Windows\System\pROCAbJ.exe
  C:\Windows\System\pROCAbJ.exe
  2⤵
  PID:7240
- C:\Windows\System\CPYyXqL.exe
  C:\Windows\System\CPYyXqL.exe
  2⤵
  PID:7288
- C:\Windows\System\wLbEuXS.exe
  C:\Windows\System\wLbEuXS.exe
  2⤵
  PID:7316
- C:\Windows\System\SluSNNb.exe
  C:\Windows\System\SluSNNb.exe
  2⤵
  PID:7336
- C:\Windows\System\ERcAEPo.exe
  C:\Windows\System\ERcAEPo.exe
  2⤵
  PID:7356
- C:\Windows\System\zmhFACT.exe
  C:\Windows\System\zmhFACT.exe
  2⤵
  PID:7372
- C:\Windows\System\kSdewQT.exe
  C:\Windows\System\kSdewQT.exe
  2⤵
  PID:7396
- C:\Windows\System\vWbDFGZ.exe
  C:\Windows\System\vWbDFGZ.exe
  2⤵
  PID:7412
- C:\Windows\System\JcdWUrI.exe
  C:\Windows\System\JcdWUrI.exe
  2⤵
  PID:7432
- C:\Windows\System\tyQGMJe.exe
  C:\Windows\System\tyQGMJe.exe
  2⤵
  PID:7492
- C:\Windows\System\cJJAdbd.exe
  C:\Windows\System\cJJAdbd.exe
  2⤵
  PID:7524
- C:\Windows\System\FbrziDr.exe
  C:\Windows\System\FbrziDr.exe
  2⤵
  PID:7564
- C:\Windows\System\fLXFXdx.exe
  C:\Windows\System\fLXFXdx.exe
  2⤵
  PID:7596
- C:\Windows\System\mqnMDdN.exe
  C:\Windows\System\mqnMDdN.exe
  2⤵
  PID:7620
- C:\Windows\System\tJXhArj.exe
  C:\Windows\System\tJXhArj.exe
  2⤵
  PID:7640
- C:\Windows\System\hKXFTIq.exe
  C:\Windows\System\hKXFTIq.exe
  2⤵
  PID:7668
- C:\Windows\System\cKINvRV.exe
  C:\Windows\System\cKINvRV.exe
  2⤵
  PID:7684
- C:\Windows\System\uMPxfSj.exe
  C:\Windows\System\uMPxfSj.exe
  2⤵
  PID:7700
- C:\Windows\System\LiYkyto.exe
  C:\Windows\System\LiYkyto.exe
  2⤵
  PID:7720
- C:\Windows\System\ziAhlZf.exe
  C:\Windows\System\ziAhlZf.exe
  2⤵
  PID:7740
- C:\Windows\System\SxSQzyG.exe
  C:\Windows\System\SxSQzyG.exe
  2⤵
  PID:7808
- C:\Windows\System\jleUrnm.exe
  C:\Windows\System\jleUrnm.exe
  2⤵
  PID:7848
- C:\Windows\System\ZQLprgm.exe
  C:\Windows\System\ZQLprgm.exe
  2⤵
  PID:7868
- C:\Windows\System\ebIKjBD.exe
  C:\Windows\System\ebIKjBD.exe
  2⤵
  PID:7912
- C:\Windows\System\sJrSCAK.exe
  C:\Windows\System\sJrSCAK.exe
  2⤵
  PID:7948
- C:\Windows\System\YBCDqao.exe
  C:\Windows\System\YBCDqao.exe
  2⤵
  PID:7968
- C:\Windows\System\gwtSVZh.exe
  C:\Windows\System\gwtSVZh.exe
  2⤵
  PID:7984
- C:\Windows\System\recotMS.exe
  C:\Windows\System\recotMS.exe
  2⤵
  PID:8012
- C:\Windows\System\PghqRRh.exe
  C:\Windows\System\PghqRRh.exe
  2⤵
  PID:8032
- C:\Windows\System\lbPCoJt.exe
  C:\Windows\System\lbPCoJt.exe
  2⤵
  PID:8052
- C:\Windows\System\iRxFrEX.exe
  C:\Windows\System\iRxFrEX.exe
  2⤵
  PID:8104
- C:\Windows\System\hhImhcP.exe
  C:\Windows\System\hhImhcP.exe
  2⤵
  PID:8120
- C:\Windows\System\uyaroIL.exe
  C:\Windows\System\uyaroIL.exe
  2⤵
  PID:8160
- C:\Windows\System\wehItvi.exe
  C:\Windows\System\wehItvi.exe
  2⤵
  PID:8180
- C:\Windows\System\cartgMc.exe
  C:\Windows\System\cartgMc.exe
  2⤵
  PID:6940
- C:\Windows\System\DcHlDAg.exe
  C:\Windows\System\DcHlDAg.exe
  2⤵
  PID:7184
- C:\Windows\System\ypEaoNu.exe
  C:\Windows\System\ypEaoNu.exe
  2⤵
  PID:7324
- C:\Windows\System\NlevOuH.exe
  C:\Windows\System\NlevOuH.exe
  2⤵
  PID:7348
- C:\Windows\System\qcZPhHb.exe
  C:\Windows\System\qcZPhHb.exe
  2⤵
  PID:7464
- C:\Windows\System\xqkLFKg.exe
  C:\Windows\System\xqkLFKg.exe
  2⤵
  PID:7368
- C:\Windows\System\anBSbbY.exe
  C:\Windows\System\anBSbbY.exe
  2⤵
  PID:7572
- C:\Windows\System\pTJziGr.exe
  C:\Windows\System\pTJziGr.exe
  2⤵
  PID:7636
- C:\Windows\System\LueBUIT.exe
  C:\Windows\System\LueBUIT.exe
  2⤵
  PID:7648
- C:\Windows\System\RVBnvSH.exe
  C:\Windows\System\RVBnvSH.exe
  2⤵
  PID:7752
- C:\Windows\System\xYgRmFW.exe
  C:\Windows\System\xYgRmFW.exe
  2⤵
  PID:7836
- C:\Windows\System\DErrZjJ.exe
  C:\Windows\System\DErrZjJ.exe
  2⤵
  PID:7884
- C:\Windows\System\LMXbyfY.exe
  C:\Windows\System\LMXbyfY.exe
  2⤵
  PID:7904
- C:\Windows\System\CZsqUAM.exe
  C:\Windows\System\CZsqUAM.exe
  2⤵
  PID:8024
- C:\Windows\System\onjXSzc.exe
  C:\Windows\System\onjXSzc.exe
  2⤵
  PID:8072
- C:\Windows\System\FVCQhYC.exe
  C:\Windows\System\FVCQhYC.exe
  2⤵
  PID:8100
- C:\Windows\System\nJiPgJa.exe
  C:\Windows\System\nJiPgJa.exe
  2⤵
  PID:8168
- C:\Windows\System\xqGwtSx.exe
  C:\Windows\System\xqGwtSx.exe
  2⤵
  PID:7328
- C:\Windows\System\HHeMKtP.exe
  C:\Windows\System\HHeMKtP.exe
  2⤵
  PID:7388
- C:\Windows\System\BOWdBDL.exe
  C:\Windows\System\BOWdBDL.exe
  2⤵
  PID:7632
- C:\Windows\System\vxbKFth.exe
  C:\Windows\System\vxbKFth.exe
  2⤵
  PID:7832
- C:\Windows\System\NrrosvB.exe
  C:\Windows\System\NrrosvB.exe
  2⤵
  PID:7908
- C:\Windows\System\SKEdZwA.exe
  C:\Windows\System\SKEdZwA.exe
  2⤵
  PID:7992
- C:\Windows\System\YoIFMgx.exe
  C:\Windows\System\YoIFMgx.exe
  2⤵
  PID:7996
- C:\Windows\System\UAqeWsu.exe
  C:\Windows\System\UAqeWsu.exe
  2⤵
  PID:7200
- C:\Windows\System\zipsbPb.exe
  C:\Windows\System\zipsbPb.exe
  2⤵
  PID:7940
- C:\Windows\System\ltkmAyz.exe
  C:\Windows\System\ltkmAyz.exe
  2⤵
  PID:7380
- C:\Windows\System\OFfilbP.exe
  C:\Windows\System\OFfilbP.exe
  2⤵
  PID:8128
- C:\Windows\System\YQQEVXW.exe
  C:\Windows\System\YQQEVXW.exe
  2⤵
  PID:8200
- C:\Windows\System\yGfYOxR.exe
  C:\Windows\System\yGfYOxR.exe
  2⤵
  PID:8248
- C:\Windows\System\lhokSnD.exe
  C:\Windows\System\lhokSnD.exe
  2⤵
  PID:8268
- C:\Windows\System\paoAZQb.exe
  C:\Windows\System\paoAZQb.exe
  2⤵
  PID:8288
- C:\Windows\System\DbxxZhF.exe
  C:\Windows\System\DbxxZhF.exe
  2⤵
  PID:8316
- C:\Windows\System\iOmaIqN.exe
  C:\Windows\System\iOmaIqN.exe
  2⤵
  PID:8340
- C:\Windows\System\LirsrnT.exe
  C:\Windows\System\LirsrnT.exe
  2⤵
  PID:8368
- C:\Windows\System\ThZEFcy.exe
  C:\Windows\System\ThZEFcy.exe
  2⤵
  PID:8416
- C:\Windows\System\Puciqtb.exe
  C:\Windows\System\Puciqtb.exe
  2⤵
  PID:8440
- C:\Windows\System\HQjidNV.exe
  C:\Windows\System\HQjidNV.exe
  2⤵
  PID:8460
- C:\Windows\System\RmYJVlB.exe
  C:\Windows\System\RmYJVlB.exe
  2⤵
  PID:8480
- C:\Windows\System\JxgAYmV.exe
  C:\Windows\System\JxgAYmV.exe
  2⤵
  PID:8504
- C:\Windows\System\QcARqUs.exe
  C:\Windows\System\QcARqUs.exe
  2⤵
  PID:8528
- C:\Windows\System\rdMQHqM.exe
  C:\Windows\System\rdMQHqM.exe
  2⤵
  PID:8572
- C:\Windows\System\YcQxFHg.exe
  C:\Windows\System\YcQxFHg.exe
  2⤵
  PID:8600
- C:\Windows\System\tHApfZu.exe
  C:\Windows\System\tHApfZu.exe
  2⤵
  PID:8620
- C:\Windows\System\BTcmTQw.exe
  C:\Windows\System\BTcmTQw.exe
  2⤵
  PID:8640
- C:\Windows\System\eGfLIAU.exe
  C:\Windows\System\eGfLIAU.exe
  2⤵
  PID:8660
- C:\Windows\System\flRAsHO.exe
  C:\Windows\System\flRAsHO.exe
  2⤵
  PID:8688
- C:\Windows\System\wxBHNMh.exe
  C:\Windows\System\wxBHNMh.exe
  2⤵
  PID:8752
- C:\Windows\System\UDUooby.exe
  C:\Windows\System\UDUooby.exe
  2⤵
  PID:8776
- C:\Windows\System\sIRhumL.exe
  C:\Windows\System\sIRhumL.exe
  2⤵
  PID:8820
- C:\Windows\System\JRQJbXR.exe
  C:\Windows\System\JRQJbXR.exe
  2⤵
  PID:8840
- C:\Windows\System\cRfCRlW.exe
  C:\Windows\System\cRfCRlW.exe
  2⤵
  PID:8860
- C:\Windows\System\PAUjdal.exe
  C:\Windows\System\PAUjdal.exe
  2⤵
  PID:8888
- C:\Windows\System\piiQeAB.exe
  C:\Windows\System\piiQeAB.exe
  2⤵
  PID:8920
- C:\Windows\System\ggxUXoX.exe
  C:\Windows\System\ggxUXoX.exe
  2⤵
  PID:8964
- C:\Windows\System\xjrOLEb.exe
  C:\Windows\System\xjrOLEb.exe
  2⤵
  PID:8980
- C:\Windows\System\hHCyMIG.exe
  C:\Windows\System\hHCyMIG.exe
  2⤵
  PID:9000
- C:\Windows\System\zWhdwSL.exe
  C:\Windows\System\zWhdwSL.exe
  2⤵
  PID:9024
- C:\Windows\System\RcgkZSS.exe
  C:\Windows\System\RcgkZSS.exe
  2⤵
  PID:9068
- C:\Windows\System\uDdDyWQ.exe
  C:\Windows\System\uDdDyWQ.exe
  2⤵
  PID:9092
- C:\Windows\System\zdYqxON.exe
  C:\Windows\System\zdYqxON.exe
  2⤵
  PID:9116
- C:\Windows\System\ThdTgvL.exe
  C:\Windows\System\ThdTgvL.exe
  2⤵
  PID:9140
- C:\Windows\System\CyfxuGE.exe
  C:\Windows\System\CyfxuGE.exe
  2⤵
  PID:9180
- C:\Windows\System\ozEnswm.exe
  C:\Windows\System\ozEnswm.exe
  2⤵
  PID:9200
- C:\Windows\System\NOHGLnW.exe
  C:\Windows\System\NOHGLnW.exe
  2⤵
  PID:7264
- C:\Windows\System\oPzYUpM.exe
  C:\Windows\System\oPzYUpM.exe
  2⤵
  PID:8256
- C:\Windows\System\TWQGbar.exe
  C:\Windows\System\TWQGbar.exe
  2⤵
  PID:8308
- C:\Windows\System\pFkksmx.exe
  C:\Windows\System\pFkksmx.exe
  2⤵
  PID:8324
- C:\Windows\System\UYCAEFj.exe
  C:\Windows\System\UYCAEFj.exe
  2⤵
  PID:8436
- C:\Windows\System\RMNSBBm.exe
  C:\Windows\System\RMNSBBm.exe
  2⤵
  PID:8468
- C:\Windows\System\PMFpnlC.exe
  C:\Windows\System\PMFpnlC.exe
  2⤵
  PID:8516
- C:\Windows\System\UaTZhXZ.exe
  C:\Windows\System\UaTZhXZ.exe
  2⤵
  PID:8584
- C:\Windows\System\kLtpTsr.exe
  C:\Windows\System\kLtpTsr.exe
  2⤵
  PID:8652
- C:\Windows\System\cwsheWP.exe
  C:\Windows\System\cwsheWP.exe
  2⤵
  PID:8724
- C:\Windows\System\jmQXGiC.exe
  C:\Windows\System\jmQXGiC.exe
  2⤵
  PID:8808
- C:\Windows\System\kgJSbeo.exe
  C:\Windows\System\kgJSbeo.exe
  2⤵
  PID:8836
- C:\Windows\System\tlwHwwj.exe
  C:\Windows\System\tlwHwwj.exe
  2⤵
  PID:8976
- C:\Windows\System\oLAjvor.exe
  C:\Windows\System\oLAjvor.exe
  2⤵
  PID:8996
- C:\Windows\System\CLeHzio.exe
  C:\Windows\System\CLeHzio.exe
  2⤵
  PID:9112
- C:\Windows\System\UQoHlNB.exe
  C:\Windows\System\UQoHlNB.exe
  2⤵
  PID:9172
- C:\Windows\System\bNgYWPK.exe
  C:\Windows\System\bNgYWPK.exe
  2⤵
  PID:9212
- C:\Windows\System\JcQTcjm.exe
  C:\Windows\System\JcQTcjm.exe
  2⤵
  PID:8408
- C:\Windows\System\ACWhJPQ.exe
  C:\Windows\System\ACWhJPQ.exe
  2⤵
  PID:8476
- C:\Windows\System\RzhEcPK.exe
  C:\Windows\System\RzhEcPK.exe
  2⤵
  PID:8632
- C:\Windows\System\hVSgkFf.exe
  C:\Windows\System\hVSgkFf.exe
  2⤵
  PID:8708
- C:\Windows\System\rhieHqO.exe
  C:\Windows\System\rhieHqO.exe
  2⤵
  PID:8852
- C:\Windows\System\bDGmeMe.exe
  C:\Windows\System\bDGmeMe.exe
  2⤵
  PID:9192
- C:\Windows\System\rFKckWW.exe
  C:\Windows\System\rFKckWW.exe
  2⤵
  PID:8544
- C:\Windows\System\jFFXPSS.exe
  C:\Windows\System\jFFXPSS.exe
  2⤵
  PID:8452
- C:\Windows\System\mmgFmIg.exe
  C:\Windows\System\mmgFmIg.exe
  2⤵
  PID:8764
- C:\Windows\System\ETtKdtQ.exe
  C:\Windows\System\ETtKdtQ.exe
  2⤵
  PID:9132
- C:\Windows\System\RQtOiTY.exe
  C:\Windows\System\RQtOiTY.exe
  2⤵
  PID:8580
- C:\Windows\System\fTTYuBO.exe
  C:\Windows\System\fTTYuBO.exe
  2⤵
  PID:9224
- C:\Windows\System\hwjnnCJ.exe
  C:\Windows\System\hwjnnCJ.exe
  2⤵
  PID:9260
- C:\Windows\System\VWPgJmk.exe
  C:\Windows\System\VWPgJmk.exe
  2⤵
  PID:9288
- C:\Windows\System\xNudjrf.exe
  C:\Windows\System\xNudjrf.exe
  2⤵
  PID:9308
- C:\Windows\System\vGHvltG.exe
  C:\Windows\System\vGHvltG.exe
  2⤵
  PID:9328
- C:\Windows\System\dwiEzaN.exe
  C:\Windows\System\dwiEzaN.exe
  2⤵
  PID:9356
- C:\Windows\System\fnwAGUK.exe
  C:\Windows\System\fnwAGUK.exe
  2⤵
  PID:9376
- C:\Windows\System\rFGpbyL.exe
  C:\Windows\System\rFGpbyL.exe
  2⤵
  PID:9444
- C:\Windows\System\VvfUOsq.exe
  C:\Windows\System\VvfUOsq.exe
  2⤵
  PID:9488
- C:\Windows\System\mtmtJSe.exe
  C:\Windows\System\mtmtJSe.exe
  2⤵
  PID:9512
- C:\Windows\System\wCPOUel.exe
  C:\Windows\System\wCPOUel.exe
  2⤵
  PID:9532
- C:\Windows\System\PkIWfks.exe
  C:\Windows\System\PkIWfks.exe
  2⤵
  PID:9552
- C:\Windows\System\mLTPHbg.exe
  C:\Windows\System\mLTPHbg.exe
  2⤵
  PID:9600
- C:\Windows\System\mSpfiYU.exe
  C:\Windows\System\mSpfiYU.exe
  2⤵
  PID:9620
- C:\Windows\System\nnkqvPs.exe
  C:\Windows\System\nnkqvPs.exe
  2⤵
  PID:9644
- C:\Windows\System\wyuzRoT.exe
  C:\Windows\System\wyuzRoT.exe
  2⤵
  PID:9664
- C:\Windows\System\kOWpEZU.exe
  C:\Windows\System\kOWpEZU.exe
  2⤵
  PID:9680
- C:\Windows\System\EOSetOA.exe
  C:\Windows\System\EOSetOA.exe
  2⤵
  PID:9704
- C:\Windows\System\mKiFfYN.exe
  C:\Windows\System\mKiFfYN.exe
  2⤵
  PID:9748
- C:\Windows\System\IpaAijl.exe
  C:\Windows\System\IpaAijl.exe
  2⤵
  PID:9788
- C:\Windows\System\fXrBSmY.exe
  C:\Windows\System\fXrBSmY.exe
  2⤵
  PID:9824
- C:\Windows\System\KcXosoq.exe
  C:\Windows\System\KcXosoq.exe
  2⤵
  PID:9840
- C:\Windows\System\xotWmZA.exe
  C:\Windows\System\xotWmZA.exe
  2⤵
  PID:9860
- C:\Windows\System\pnAroSU.exe
  C:\Windows\System\pnAroSU.exe
  2⤵
  PID:9924
- C:\Windows\System\gIaGFQD.exe
  C:\Windows\System\gIaGFQD.exe
  2⤵
  PID:9976
- C:\Windows\System\SwfaZnU.exe
  C:\Windows\System\SwfaZnU.exe
  2⤵
  PID:9992
- C:\Windows\System\qMQMCoG.exe
  C:\Windows\System\qMQMCoG.exe
  2⤵
  PID:10008
- C:\Windows\System\rTxhnDn.exe
  C:\Windows\System\rTxhnDn.exe
  2⤵
  PID:10024
- C:\Windows\System\ZyNmLsT.exe
  C:\Windows\System\ZyNmLsT.exe
  2⤵
  PID:10088
- C:\Windows\System\mzWYdoY.exe
  C:\Windows\System\mzWYdoY.exe
  2⤵
  PID:10104
- C:\Windows\System\mfEXpQT.exe
  C:\Windows\System\mfEXpQT.exe
  2⤵
  PID:10124
- C:\Windows\System\vQkDWam.exe
  C:\Windows\System\vQkDWam.exe
  2⤵
  PID:10140
- C:\Windows\System\UqPKZoK.exe
  C:\Windows\System\UqPKZoK.exe
  2⤵
  PID:10160
- C:\Windows\System\TNBcSfM.exe
  C:\Windows\System\TNBcSfM.exe
  2⤵
  PID:10216
- C:\Windows\System\KkoiWPI.exe
  C:\Windows\System\KkoiWPI.exe
  2⤵
  PID:8832
- C:\Windows\System\VHtKAln.exe
  C:\Windows\System\VHtKAln.exe
  2⤵
  PID:9320
- C:\Windows\System\VRBnSHR.exe
  C:\Windows\System\VRBnSHR.exe
  2⤵
  PID:9472
- C:\Windows\System\RPUhCJa.exe
  C:\Windows\System\RPUhCJa.exe
  2⤵
  PID:9592
- C:\Windows\System\WWfWlTI.exe
  C:\Windows\System\WWfWlTI.exe
  2⤵
  PID:9636
- C:\Windows\System\JRvSLUx.exe
  C:\Windows\System\JRvSLUx.exe
  2⤵
  PID:9652
- C:\Windows\System\nqwDFXd.exe
  C:\Windows\System\nqwDFXd.exe
  2⤵
  PID:9736
- C:\Windows\System\Wotttui.exe
  C:\Windows\System\Wotttui.exe
  2⤵
  PID:9804
- C:\Windows\System\PfVtIFH.exe
  C:\Windows\System\PfVtIFH.exe
  2⤵
  PID:9920
- C:\Windows\System\RXffsCf.exe
  C:\Windows\System\RXffsCf.exe
  2⤵
  PID:9968
- C:\Windows\System\rgetOBj.exe
  C:\Windows\System\rgetOBj.exe
  2⤵
  PID:9880
- C:\Windows\System\alvaaSS.exe
  C:\Windows\System\alvaaSS.exe
  2⤵
  PID:10064
- C:\Windows\System\LjAdVcL.exe
  C:\Windows\System\LjAdVcL.exe
  2⤵
  PID:10032
- C:\Windows\System\ZZTgwRy.exe
  C:\Windows\System\ZZTgwRy.exe
  2⤵
  PID:10004
- C:\Windows\System\qqiNIFL.exe
  C:\Windows\System\qqiNIFL.exe
  2⤵
  PID:10080
- C:\Windows\System\HBegRkn.exe
  C:\Windows\System\HBegRkn.exe
  2⤵
  PID:10060
- C:\Windows\System\NUpirZa.exe
  C:\Windows\System\NUpirZa.exe
  2⤵
  PID:10156
- C:\Windows\System\ouIecjF.exe
  C:\Windows\System\ouIecjF.exe
  2⤵
  PID:9436
- C:\Windows\System\sZMAAyX.exe
  C:\Windows\System\sZMAAyX.exe
  2⤵
  PID:9656
- C:\Windows\System\UWSUVAK.exe
  C:\Windows\System\UWSUVAK.exe
  2⤵
  PID:9760
- C:\Windows\System\ElJeJWd.exe
  C:\Windows\System\ElJeJWd.exe
  2⤵
  PID:9836
- C:\Windows\System\KhkOgOn.exe
  C:\Windows\System\KhkOgOn.exe
  2⤵
  PID:9888
- C:\Windows\System\GtqJsYg.exe
  C:\Windows\System\GtqJsYg.exe
  2⤵
  PID:10044
- C:\Windows\System\aaUVFGM.exe
  C:\Windows\System\aaUVFGM.exe
  2⤵
  PID:10196
- C:\Windows\System\bZiVjon.exe
  C:\Windows\System\bZiVjon.exe
  2⤵
  PID:9528
- C:\Windows\System\UGqvwWl.exe
  C:\Windows\System\UGqvwWl.exe
  2⤵
  PID:9692
- C:\Windows\System\XJLdolI.exe
  C:\Windows\System\XJLdolI.exe
  2⤵
  PID:9780
- C:\Windows\System\uskRwLU.exe
  C:\Windows\System\uskRwLU.exe
  2⤵
  PID:10152
- C:\Windows\System\WYRKrNV.exe
  C:\Windows\System\WYRKrNV.exe
  2⤵
  PID:10244
- C:\Windows\System\kXkNJWn.exe
  C:\Windows\System\kXkNJWn.exe
  2⤵
  PID:10284
- C:\Windows\System\ymibYrg.exe
  C:\Windows\System\ymibYrg.exe
  2⤵
  PID:10308
- C:\Windows\System\KdeqDBK.exe
  C:\Windows\System\KdeqDBK.exe
  2⤵
  PID:10328
- C:\Windows\System\EEiWNNT.exe
  C:\Windows\System\EEiWNNT.exe
  2⤵
  PID:10356
- C:\Windows\System\LDazQbE.exe
  C:\Windows\System\LDazQbE.exe
  2⤵
  PID:10384
- C:\Windows\System\NBGQfRT.exe
  C:\Windows\System\NBGQfRT.exe
  2⤵
  PID:10412
- C:\Windows\System\YOAwlqV.exe
  C:\Windows\System\YOAwlqV.exe
  2⤵
  PID:10452
- C:\Windows\System\FStQMua.exe
  C:\Windows\System\FStQMua.exe
  2⤵
  PID:10476
- C:\Windows\System\WKEZzGb.exe
  C:\Windows\System\WKEZzGb.exe
  2⤵
  PID:10492
- C:\Windows\System\wBHwUzM.exe
  C:\Windows\System\wBHwUzM.exe
  2⤵
  PID:10516
- C:\Windows\System\ZVTpQXY.exe
  C:\Windows\System\ZVTpQXY.exe
  2⤵
  PID:10564
- C:\Windows\System\iXoaoeT.exe
  C:\Windows\System\iXoaoeT.exe
  2⤵
  PID:10584
- C:\Windows\System\ilxUKjd.exe
  C:\Windows\System\ilxUKjd.exe
  2⤵
  PID:10608
- C:\Windows\System\mhAxjGI.exe
  C:\Windows\System\mhAxjGI.exe
  2⤵
  PID:10628
- C:\Windows\System\MTbtXJS.exe
  C:\Windows\System\MTbtXJS.exe
  2⤵
  PID:10652
- C:\Windows\System\kSHeEHF.exe
  C:\Windows\System\kSHeEHF.exe
  2⤵
  PID:10700
- C:\Windows\System\DmUsgGO.exe
  C:\Windows\System\DmUsgGO.exe
  2⤵
  PID:10720
- C:\Windows\System\veZTHCi.exe
  C:\Windows\System\veZTHCi.exe
  2⤵
  PID:10740
- C:\Windows\System\lQTOdSw.exe
  C:\Windows\System\lQTOdSw.exe
  2⤵
  PID:10788
- C:\Windows\System\wHUJvhn.exe
  C:\Windows\System\wHUJvhn.exe
  2⤵
  PID:10804
- C:\Windows\System\xJxaTUp.exe
  C:\Windows\System\xJxaTUp.exe
  2⤵
  PID:10828
- C:\Windows\System\TCxNUho.exe
  C:\Windows\System\TCxNUho.exe
  2⤵
  PID:10860
- C:\Windows\System\WRZJIoW.exe
  C:\Windows\System\WRZJIoW.exe
  2⤵
  PID:10876
- C:\Windows\System\rqFkZVI.exe
  C:\Windows\System\rqFkZVI.exe
  2⤵
  PID:10912
- C:\Windows\System\BalyVWg.exe
  C:\Windows\System\BalyVWg.exe
  2⤵
  PID:10932
- C:\Windows\System\FlEMiFz.exe
  C:\Windows\System\FlEMiFz.exe
  2⤵
  PID:10952
- C:\Windows\System\gRqxzMo.exe
  C:\Windows\System\gRqxzMo.exe
  2⤵
  PID:11008
- C:\Windows\System\hlTiWvc.exe
  C:\Windows\System\hlTiWvc.exe
  2⤵
  PID:11032
- C:\Windows\System\HzLMjXf.exe
  C:\Windows\System\HzLMjXf.exe
  2⤵
  PID:11052
- C:\Windows\System\SQeWhqM.exe
  C:\Windows\System\SQeWhqM.exe
  2⤵
  PID:11080
- C:\Windows\System\hWEtbVr.exe
  C:\Windows\System\hWEtbVr.exe
  2⤵
  PID:11104
- C:\Windows\System\MlEFcrR.exe
  C:\Windows\System\MlEFcrR.exe
  2⤵
  PID:11124
- C:\Windows\System\oWTkLlH.exe
  C:\Windows\System\oWTkLlH.exe
  2⤵
  PID:11152
- C:\Windows\System\tAyoeBO.exe
  C:\Windows\System\tAyoeBO.exe
  2⤵
  PID:11204
- C:\Windows\System\JPPRAJh.exe
  C:\Windows\System\JPPRAJh.exe
  2⤵
  PID:11224
- C:\Windows\System\tLWBTPj.exe
  C:\Windows\System\tLWBTPj.exe
  2⤵
  PID:11244
- C:\Windows\System\LfNajAo.exe
  C:\Windows\System\LfNajAo.exe
  2⤵
  PID:10300
- C:\Windows\System\SaadwMg.exe
  C:\Windows\System\SaadwMg.exe
  2⤵
  PID:10320
- C:\Windows\System\yZNgWIq.exe
  C:\Windows\System\yZNgWIq.exe
  2⤵
  PID:10380
- C:\Windows\System\rZBmHOH.exe
  C:\Windows\System\rZBmHOH.exe
  2⤵
  PID:10408
- C:\Windows\System\MznOnvB.exe
  C:\Windows\System\MznOnvB.exe
  2⤵
  PID:10484
- C:\Windows\System\JdCoILy.exe
  C:\Windows\System\JdCoILy.exe
  2⤵
  PID:10540
- C:\Windows\System\wUYRYke.exe
  C:\Windows\System\wUYRYke.exe
  2⤵
  PID:10596
- C:\Windows\System\QeFsjNe.exe
  C:\Windows\System\QeFsjNe.exe
  2⤵
  PID:10672
- C:\Windows\System\jsmhPRa.exe
  C:\Windows\System\jsmhPRa.exe
  2⤵
  PID:10688
- C:\Windows\System\rbSBIPk.exe
  C:\Windows\System\rbSBIPk.exe
  2⤵
  PID:10852
- C:\Windows\System\kLoMHAs.exe
  C:\Windows\System\kLoMHAs.exe
  2⤵
  PID:10884
- C:\Windows\System\dDCIMQY.exe
  C:\Windows\System\dDCIMQY.exe
  2⤵
  PID:10900
- C:\Windows\System\pAZchjS.exe
  C:\Windows\System\pAZchjS.exe
  2⤵
  PID:10940
- C:\Windows\System\WpNRGcL.exe
  C:\Windows\System\WpNRGcL.exe
  2⤵
  PID:11048
- C:\Windows\System\QNOiXGb.exe
  C:\Windows\System\QNOiXGb.exe
  2⤵
  PID:11160
- C:\Windows\System\riVazDD.exe
  C:\Windows\System\riVazDD.exe
  2⤵
  PID:11176
- C:\Windows\System\mbSWfSp.exe
  C:\Windows\System\mbSWfSp.exe
  2⤵
  PID:11240
- C:\Windows\System\MnyMVTF.exe
  C:\Windows\System\MnyMVTF.exe
  2⤵
  PID:10340
- C:\Windows\System\eucIAnw.exe
  C:\Windows\System\eucIAnw.exe
  2⤵
  PID:10648
- C:\Windows\System\JXyPnOM.exe
  C:\Windows\System\JXyPnOM.exe
  2⤵
  PID:10544
- C:\Windows\System\yUkKCIz.exe
  C:\Windows\System\yUkKCIz.exe
  2⤵
  PID:10892
- C:\Windows\System\PLnoDWf.exe
  C:\Windows\System\PLnoDWf.exe
  2⤵
  PID:10924
- C:\Windows\System\MLMHzHK.exe
  C:\Windows\System\MLMHzHK.exe
  2⤵
  PID:10996
- C:\Windows\System\YplKHOq.exe
  C:\Windows\System\YplKHOq.exe
  2⤵
  PID:11096
- C:\Windows\System\LVcDHvH.exe
  C:\Windows\System\LVcDHvH.exe
  2⤵
  PID:9900
- C:\Windows\System\NZYMwdO.exe
  C:\Windows\System\NZYMwdO.exe
  2⤵
  PID:11024
- C:\Windows\System\UrAsnlS.exe
  C:\Windows\System\UrAsnlS.exe
  2⤵
  PID:11148
- C:\Windows\System\VUkTUbP.exe
  C:\Windows\System\VUkTUbP.exe
  2⤵
  PID:11280
- C:\Windows\System\uEQpFNB.exe
  C:\Windows\System\uEQpFNB.exe
  2⤵
  PID:11328
- C:\Windows\System\NnqsALp.exe
  C:\Windows\System\NnqsALp.exe
  2⤵
  PID:11344
- C:\Windows\System\ZJnGTJg.exe
  C:\Windows\System\ZJnGTJg.exe
  2⤵
  PID:11368
- C:\Windows\System\DwOWUiE.exe
  C:\Windows\System\DwOWUiE.exe
  2⤵
  PID:11388
- C:\Windows\System\iXWUIYS.exe
  C:\Windows\System\iXWUIYS.exe
  2⤵
  PID:11412
- C:\Windows\System\VydVynx.exe
  C:\Windows\System\VydVynx.exe
  2⤵
  PID:11448
- C:\Windows\System\rmNOsUf.exe
  C:\Windows\System\rmNOsUf.exe
  2⤵
  PID:11468
- C:\Windows\System\gxvkWqi.exe
  C:\Windows\System\gxvkWqi.exe
  2⤵
  PID:11496
- C:\Windows\System\JFmyUKi.exe
  C:\Windows\System\JFmyUKi.exe
  2⤵
  PID:11520
- C:\Windows\System\FlwLctA.exe
  C:\Windows\System\FlwLctA.exe
  2⤵
  PID:11560
- C:\Windows\System\zgvwDZO.exe
  C:\Windows\System\zgvwDZO.exe
  2⤵
  PID:11608
- C:\Windows\System\IIpDqZc.exe
  C:\Windows\System\IIpDqZc.exe
  2⤵
  PID:11636
- C:\Windows\System\ztKXUPK.exe
  C:\Windows\System\ztKXUPK.exe
  2⤵
  PID:11668
- C:\Windows\System\jenEYCN.exe
  C:\Windows\System\jenEYCN.exe
  2⤵
  PID:11688
- C:\Windows\System\ipidCRD.exe
  C:\Windows\System\ipidCRD.exe
  2⤵
  PID:11708
- C:\Windows\System\mToHxZO.exe
  C:\Windows\System\mToHxZO.exe
  2⤵
  PID:11736
- C:\Windows\System\lXrvFnn.exe
  C:\Windows\System\lXrvFnn.exe
  2⤵
  PID:11756
- C:\Windows\System\tDMqgJj.exe
  C:\Windows\System\tDMqgJj.exe
  2⤵
  PID:11792
- C:\Windows\System\DSbxMyw.exe
  C:\Windows\System\DSbxMyw.exe
  2⤵
  PID:11820
- C:\Windows\System\qSySkkT.exe
  C:\Windows\System\qSySkkT.exe
  2⤵
  PID:11836
- C:\Windows\System\oHLvYJa.exe
  C:\Windows\System\oHLvYJa.exe
  2⤵
  PID:11856
- C:\Windows\System\NkpFpeo.exe
  C:\Windows\System\NkpFpeo.exe
  2⤵
  PID:11872
- C:\Windows\System\PkkjFXm.exe
  C:\Windows\System\PkkjFXm.exe
  2⤵
  PID:11900
- C:\Windows\System\bzTZIuh.exe
  C:\Windows\System\bzTZIuh.exe
  2⤵
  PID:11928
- C:\Windows\System\pZrbMqP.exe
  C:\Windows\System\pZrbMqP.exe
  2⤵
  PID:11992
- C:\Windows\System\ykzMFsC.exe
  C:\Windows\System\ykzMFsC.exe
  2⤵
  PID:12016
- C:\Windows\System\MsXHFlR.exe
  C:\Windows\System\MsXHFlR.exe
  2⤵
  PID:12040
- C:\Windows\System\THIqwZt.exe
  C:\Windows\System\THIqwZt.exe
  2⤵
  PID:12076
- C:\Windows\System\sTvLKVt.exe
  C:\Windows\System\sTvLKVt.exe
  2⤵
  PID:12116
- C:\Windows\System\MkCCbBj.exe
  C:\Windows\System\MkCCbBj.exe
  2⤵
  PID:12136
- C:\Windows\System\AVHlzNx.exe
  C:\Windows\System\AVHlzNx.exe
  2⤵
  PID:12156
- C:\Windows\System\QXSsvDP.exe
  C:\Windows\System\QXSsvDP.exe
  2⤵
  PID:12184
- C:\Windows\System\UhDzabS.exe
  C:\Windows\System\UhDzabS.exe
  2⤵
  PID:12212
- C:\Windows\System\xQuTtBp.exe
  C:\Windows\System\xQuTtBp.exe
  2⤵
  PID:12236
- C:\Windows\System\MhcDWjb.exe
  C:\Windows\System\MhcDWjb.exe
  2⤵
  PID:12276
- C:\Windows\System\UvgXmGM.exe
  C:\Windows\System\UvgXmGM.exe
  2⤵
  PID:10764
- C:\Windows\System\gRcZNga.exe
  C:\Windows\System\gRcZNga.exe
  2⤵
  PID:4928
- C:\Windows\System\gDSunmZ.exe
  C:\Windows\System\gDSunmZ.exe
  2⤵
  PID:11304
- C:\Windows\System\CzfFEyG.exe
  C:\Windows\System\CzfFEyG.exe
  2⤵
  PID:11360
- C:\Windows\System\JzFWMmV.exe
  C:\Windows\System\JzFWMmV.exe
  2⤵
  PID:11424
- C:\Windows\System\zGPhhoO.exe
  C:\Windows\System\zGPhhoO.exe
  2⤵
  PID:11432
- C:\Windows\System\WZhEQvK.exe
  C:\Windows\System\WZhEQvK.exe
  2⤵
  PID:11516
- C:\Windows\System\FzNcrjO.exe
  C:\Windows\System\FzNcrjO.exe
  2⤵
  PID:3528
- C:\Windows\System\ImugMIQ.exe
  C:\Windows\System\ImugMIQ.exe
  2⤵
  PID:11732
- C:\Windows\System\boUwROV.exe
  C:\Windows\System\boUwROV.exe
  2⤵
  PID:11828
- C:\Windows\System\huFlOWN.exe
  C:\Windows\System\huFlOWN.exe
  2⤵
  PID:11852
- C:\Windows\System\tWZxWqQ.exe
  C:\Windows\System\tWZxWqQ.exe
  2⤵
  PID:11924
- C:\Windows\System\YSCevQF.exe
  C:\Windows\System\YSCevQF.exe
  2⤵
  PID:11980
- C:\Windows\System\ZjoKJYx.exe
  C:\Windows\System\ZjoKJYx.exe
  2⤵
  PID:12028
- C:\Windows\System\TFsIRHF.exe
  C:\Windows\System\TFsIRHF.exe
  2⤵
  PID:12072
- C:\Windows\System\rIOfFJA.exe
  C:\Windows\System\rIOfFJA.exe
  2⤵
  PID:12124
- C:\Windows\System\VmOxawj.exe
  C:\Windows\System\VmOxawj.exe
  2⤵
  PID:12180
- C:\Windows\System\afEZtin.exe
  C:\Windows\System\afEZtin.exe
  2⤵
  PID:12224
- C:\Windows\System\FdUluEf.exe
  C:\Windows\System\FdUluEf.exe
  2⤵
  PID:12260
- C:\Windows\System\EzEioSN.exe
  C:\Windows\System\EzEioSN.exe
  2⤵
  PID:11380
- C:\Windows\System\TkepyrP.exe
  C:\Windows\System\TkepyrP.exe
  2⤵
  PID:11460
- C:\Windows\System\aNUcRhp.exe
  C:\Windows\System\aNUcRhp.exe
  2⤵
  PID:11644
- C:\Windows\System\bukNqse.exe
  C:\Windows\System\bukNqse.exe
  2⤵
  PID:11848
- C:\Windows\System\WiXiVSF.exe
  C:\Windows\System\WiXiVSF.exe
  2⤵
  PID:12092
- C:\Windows\System\IuilsQQ.exe
  C:\Windows\System\IuilsQQ.exe
  2⤵
  PID:12228
- C:\Windows\System\DkueXRv.exe
  C:\Windows\System\DkueXRv.exe
  2⤵
  PID:11276
- C:\Windows\System\gbcqziM.exe
  C:\Windows\System\gbcqziM.exe
  2⤵
  PID:11556
- C:\Windows\System\nnpgEHf.exe
  C:\Windows\System\nnpgEHf.exe
  2⤵
  PID:11492
- C:\Windows\System\FLtLhtq.exe
  C:\Windows\System\FLtLhtq.exe
  2⤵
  PID:11780
- C:\Windows\System\UNQrney.exe
  C:\Windows\System\UNQrney.exe
  2⤵
  PID:12132
- C:\Windows\System\TNHbCzp.exe
  C:\Windows\System\TNHbCzp.exe
  2⤵
  PID:740
- C:\Windows\System\BQIZmTm.exe
  C:\Windows\System\BQIZmTm.exe
  2⤵
  PID:3384
- C:\Windows\System\SIPwozF.exe
  C:\Windows\System\SIPwozF.exe
  2⤵
  PID:11956
- C:\Windows\System\AfQuNvk.exe
  C:\Windows\System\AfQuNvk.exe
  2⤵
  PID:12308
- C:\Windows\System\zeajLFT.exe
  C:\Windows\System\zeajLFT.exe
  2⤵
  PID:12328
- C:\Windows\System\FnEqMCH.exe
  C:\Windows\System\FnEqMCH.exe
  2⤵
  PID:12400
- C:\Windows\System\Fztknar.exe
  C:\Windows\System\Fztknar.exe
  2⤵
  PID:12420
- C:\Windows\System\kQYOPpj.exe
  C:\Windows\System\kQYOPpj.exe
  2⤵
  PID:12444
- C:\Windows\System\jhJXZjb.exe
  C:\Windows\System\jhJXZjb.exe
  2⤵
  PID:12464
- C:\Windows\System\ibiwCdN.exe
  C:\Windows\System\ibiwCdN.exe
  2⤵
  PID:12484
- C:\Windows\System\CvyvlAr.exe
  C:\Windows\System\CvyvlAr.exe
  2⤵
  PID:12528
- C:\Windows\System\WhNBepT.exe
  C:\Windows\System\WhNBepT.exe
  2⤵
  PID:12548
- C:\Windows\System\JyNanAD.exe
  C:\Windows\System\JyNanAD.exe
  2⤵
  PID:12568
- C:\Windows\System\DcpaegD.exe
  C:\Windows\System\DcpaegD.exe
  2⤵
  PID:12584
- C:\Windows\System\eAELiIo.exe
  C:\Windows\System\eAELiIo.exe
  2⤵
  PID:12668
- C:\Windows\System\XhugTQX.exe
  C:\Windows\System\XhugTQX.exe
  2⤵
  PID:12712
- C:\Windows\System\PBDXSLe.exe
  C:\Windows\System\PBDXSLe.exe
  2⤵
  PID:12760
- C:\Windows\System\mfOkwTy.exe
  C:\Windows\System\mfOkwTy.exe
  2⤵
  PID:12788
- C:\Windows\System\ImVGUie.exe
  C:\Windows\System\ImVGUie.exe
  2⤵
  PID:12816
- C:\Windows\System\ldEhYcX.exe
  C:\Windows\System\ldEhYcX.exe
  2⤵
  PID:12840
- C:\Windows\System\ZVTKqAQ.exe
  C:\Windows\System\ZVTKqAQ.exe
  2⤵
  PID:12860
- C:\Windows\System\HjrIklE.exe
  C:\Windows\System\HjrIklE.exe
  2⤵
  PID:12892
- C:\Windows\System\gkkWaDu.exe
  C:\Windows\System\gkkWaDu.exe
  2⤵
  PID:12908
- C:\Windows\System\AaySIsF.exe
  C:\Windows\System\AaySIsF.exe
  2⤵
  PID:12944
- C:\Windows\System\SfWqSXn.exe
  C:\Windows\System\SfWqSXn.exe
  2⤵
  PID:12972
- C:\Windows\System\KMAevcW.exe
  C:\Windows\System\KMAevcW.exe
  2⤵
  PID:12992
- C:\Windows\System\xmkQoGA.exe
  C:\Windows\System\xmkQoGA.exe
  2⤵
  PID:13012
- C:\Windows\System\rxRPVrS.exe
  C:\Windows\System\rxRPVrS.exe
  2⤵
  PID:13052
- C:\Windows\System\McdjJRS.exe
  C:\Windows\System\McdjJRS.exe
  2⤵
  PID:13100
- C:\Windows\System\eOjCYoR.exe
  C:\Windows\System\eOjCYoR.exe
  2⤵
  PID:13120
- C:\Windows\System\ZTqexIb.exe
  C:\Windows\System\ZTqexIb.exe
  2⤵
  PID:13144
- C:\Windows\System\QlYVDQE.exe
  C:\Windows\System\QlYVDQE.exe
  2⤵
  PID:13160
- C:\Windows\System\pcPBlIe.exe
  C:\Windows\System\pcPBlIe.exe
  2⤵
  PID:13176
- C:\Windows\System\lpzYTnh.exe
  C:\Windows\System\lpzYTnh.exe
  2⤵
  PID:13212
- C:\Windows\System\CkbOrVj.exe
  C:\Windows\System\CkbOrVj.exe
  2⤵
  PID:13236
- C:\Windows\System\iaRxzRt.exe
  C:\Windows\System\iaRxzRt.exe
  2⤵
  PID:13268
- C:\Windows\System\YfEIMxN.exe
  C:\Windows\System\YfEIMxN.exe
  2⤵
  PID:4636
- C:\Windows\System\GfORAXL.exe
  C:\Windows\System\GfORAXL.exe
  2⤵
  PID:1156
- C:\Windows\System\oIzTFHB.exe
  C:\Windows\System\oIzTFHB.exe
  2⤵
  PID:12364
- C:\Windows\System\xvEVFgf.exe
  C:\Windows\System\xvEVFgf.exe
  2⤵
  PID:12432
- C:\Windows\System\TuZZmhc.exe
  C:\Windows\System\TuZZmhc.exe
  2⤵
  PID:12476
- C:\Windows\System\LIxgtPn.exe
  C:\Windows\System\LIxgtPn.exe
  2⤵
  PID:12504
- C:\Windows\System\kEArqKF.exe
  C:\Windows\System\kEArqKF.exe
  2⤵
  PID:12576
- C:\Windows\System\QfoqrUB.exe
  C:\Windows\System\QfoqrUB.exe
  2⤵
  PID:12636
- C:\Windows\System\AvziTir.exe
  C:\Windows\System\AvziTir.exe
  2⤵
  PID:12652
- C:\Windows\System\HiSsXLD.exe
  C:\Windows\System\HiSsXLD.exe
  2⤵
  PID:12640
- C:\Windows\System\sRitFhf.exe
  C:\Windows\System\sRitFhf.exe
  2⤵
  PID:12692
- C:\Windows\System\hgsyKEK.exe
  C:\Windows\System\hgsyKEK.exe
  2⤵
  PID:12752
- C:\Windows\System\ylwwqFC.exe
  C:\Windows\System\ylwwqFC.exe
  2⤵
  PID:12900
- C:\Windows\System\orQQidh.exe
  C:\Windows\System\orQQidh.exe
  2⤵
  PID:12940
- C:\Windows\System\KSLKyUV.exe
  C:\Windows\System\KSLKyUV.exe
  2⤵
  PID:13032
- C:\Windows\System\cGQBrrY.exe
  C:\Windows\System\cGQBrrY.exe
  2⤵
  PID:13044
- C:\Windows\System\nOgRbuK.exe
  C:\Windows\System\nOgRbuK.exe
  2⤵
  PID:3520
- C:\Windows\System\yFXWSoM.exe
  C:\Windows\System\yFXWSoM.exe
  2⤵
  PID:3808
- C:\Windows\System\PwwqIii.exe
  C:\Windows\System\PwwqIii.exe
  2⤵
  PID:13108
- C:\Windows\System\lGVAapy.exe
  C:\Windows\System\lGVAapy.exe
  2⤵
  PID:13204
- C:\Windows\System\kaBEFPI.exe
  C:\Windows\System\kaBEFPI.exe
  2⤵
  PID:12512
- C:\Windows\System\vmrLZoZ.exe
  C:\Windows\System\vmrLZoZ.exe
  2⤵
  PID:12968
- C:\Windows\System\lOdlbTc.exe
  C:\Windows\System\lOdlbTc.exe
  2⤵
  PID:13128
- C:\Windows\System\LjaSUzJ.exe
  C:\Windows\System\LjaSUzJ.exe
  2⤵
  PID:13296
- C:\Windows\System\dfMyPgz.exe
  C:\Windows\System\dfMyPgz.exe
  2⤵
  PID:13188
- C:\Windows\System\SMiXWvR.exe
  C:\Windows\System\SMiXWvR.exe
  2⤵
  PID:2108
- C:\Windows\System\DSPTfMV.exe
  C:\Windows\System\DSPTfMV.exe
  2⤵
  PID:12316
- C:\Windows\System\QqxNrkP.exe
  C:\Windows\System\QqxNrkP.exe
  2⤵
  PID:5480
- C:\Windows\System\hdHGGxS.exe
  C:\Windows\System\hdHGGxS.exe
  2⤵
  PID:1896
- C:\Windows\System\kjgvQiX.exe
  C:\Windows\System\kjgvQiX.exe
  2⤵
  PID:3324
- C:\Windows\System\lMVGart.exe
  C:\Windows\System\lMVGart.exe
  2⤵
  PID:3284
- C:\Windows\System\uKyNONX.exe
  C:\Windows\System\uKyNONX.exe
  2⤵
  PID:692
- C:\Windows\System\XQIHynO.exe
  C:\Windows\System\XQIHynO.exe
  2⤵
  PID:12600
- C:\Windows\System\ZzulGXE.exe
  C:\Windows\System\ZzulGXE.exe
  2⤵
  PID:3748
- C:\Windows\System\yltcaUj.exe
  C:\Windows\System\yltcaUj.exe
  2⤵
  PID:1424
- C:\Windows\System\lJKqGSY.exe
  C:\Windows\System\lJKqGSY.exe
  2⤵
  PID:12856
- C:\Windows\System\mofadkA.exe
  C:\Windows\System\mofadkA.exe
  2⤵
  PID:13028
- C:\Windows\System\AbPrSgD.exe
  C:\Windows\System\AbPrSgD.exe
  2⤵
  PID:12980
- C:\Windows\System\zQcgmBd.exe
  C:\Windows\System\zQcgmBd.exe
  2⤵
  PID:13156
- C:\Windows\System\KIMCvrf.exe
  C:\Windows\System\KIMCvrf.exe
  2⤵
  PID:5268
- C:\Windows\System\rmIHuTH.exe
  C:\Windows\System\rmIHuTH.exe
  2⤵
  PID:4568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h13zqlln.uws.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BIPJfRa.exe

Filesize
1.9MB

MD5
5fe75adb62f7a6fe458d5d7dc34bff5b

SHA1
823d025ac499abcf7696e269b3ff6ac57beb4b6b

SHA256
e0e9a30a882ba4dca2aa2eef926eb41c0762604905e92b881e6bca6f8b4f030e

SHA512
a2b031a42d98edb0e7f00854d1f8c179880d534a93bcf3fd703bdca49e8bc36df8c8881a63c167f6b676515201de05cc5fde9b7f7abfa844733cffb92a8688d7

Download Submit
C:\Windows\System\BKiTVdV.exe

Filesize
1.9MB

MD5
34173569c06b847873414ba20eeb4c48

SHA1
ddd9965e0cd67ed7e72d714780b254af2513278f

SHA256
bb4c00a277c8d2765abdaa8e9d6e80a6be9f4869210a3baf6f8b375614779283

SHA512
6e2151e8a1e20c6c13557de07d3ad2b207e2a684fd09d5092f4735fb80c13fd55c4f1226c2f0e11207d5cf03f6635ea40f4a5b64514f5e59ad2e437d46c2985e

Download Submit
C:\Windows\System\DjuwIcv.exe

Filesize
1.9MB

MD5
f9cba71824eadfa0d6484481b1e6a862

SHA1
68f651c45a66f341c35cedc9a6d3443930b9a974

SHA256
d9059de752ca7129c65d5c9d48ce0ed6c7a1f95af6110bf95a3cac031e72152d

SHA512
83d12df8bd32a346ff87446b28e5047335d509d62f606100da52d71e3ae3c1f7d9b1ba139a44f21d5aacfa8c60fc48ce3f151c0b9b9f7bcef3a6c0a9087c4aa8

Download Submit
C:\Windows\System\DxNTBxz.exe

Filesize
1.9MB

MD5
9bdade29a0bbb09949bd8dcb71316f36

SHA1
718f5b75b3e74a5d964c000f23fca41505d24350

SHA256
dfcb2ad7aff2f57cfe0971d9446828b8b771caa5da14992b1dfebe012bbf35e7

SHA512
aa9a3a3fe8bf96a82b0076f10014247418e0cada71e2b5e1c7149f443d20348995c2cc52232485e70e497ae9cb612d944c4da314bff3de6a0532e494e1b4ef9b

Download Submit
C:\Windows\System\EDCzvsP.exe

Filesize
1.9MB

MD5
ab0adcc7d9774da57246c6eb1f15509b

SHA1
86fe32e774237f8e3fd60f5bc305ef9e5eb7345b

SHA256
78bcbd3e7bddd832979568efab019257f1b999b0b3ea9a98d8db786086dd8cd1

SHA512
6c526125e0a08446ac18bccaf33d22c977bb71313ca5176a2aa327d32ed0f106e17ab2c208c63903d072ace98cd881dcadff9822385492ba085b80e2193777bf

Download Submit
C:\Windows\System\GjHeiBr.exe

Filesize
1.9MB

MD5
ec00bc13423cd1e9c7dcaad7c42394c5

SHA1
6134ba6ec718b2e4ee824aa7c9d18b0b3108611f

SHA256
e34636d1005acd298f284bd8183a4cd82ac7e450bd2623d631564904d86ea448

SHA512
9e74c3e40fec6fbec435fff8690649ab5b1af2e9b9fb4fd1e2162a5c524a62595c6e777879c0e9316bbbcff18c9c40c303440d0970ffc0a1f5902e29ee20836d

Download Submit
C:\Windows\System\GmKgCpJ.exe

Filesize
1.9MB

MD5
7efc592e035abaf48f605b19831dc75b

SHA1
ed17227cec78b9f0cae6c8b9572af9338efac198

SHA256
9639b6ea4217c6491ad9bbb0518e4d56b06d2451faffd4d1fdb458ce7e8354d1

SHA512
1099eb4c868e7dd6549e67348bf5060b09e4dddfd84efe7e0b746baaa53a116e33ef6319f9c588060961e25437b0f168d36fafbc7cebe8b3f5ac5cf58f557142

Download Submit
C:\Windows\System\HdcEGee.exe

Filesize
1.9MB

MD5
63857f852b3202b9c93b9900fa1873d0

SHA1
b04f972a606f886004356414f6cec31d70de0852

SHA256
01c6d3210e2a3e7cdcbe2d056a86397c8dbbd2f1b6072aa51308607752d23dfa

SHA512
2272faa1fade5ed5e83746af3d1c1afc1903414635d1c976b398a47c0e41211e9308746174eb9f6278aca35561bf55f8eeca4c49dded8919889e74e726014a86

Download Submit
C:\Windows\System\IwRlINB.exe

Filesize
1.9MB

MD5
52665e4ff5209357eeccdc3da243ed56

SHA1
e360b8e521f97fad764e899ce3332b679b7caf15

SHA256
ad4c85f4f64527e0d8e889646ba0ee1b4784fb7c76bb2650e4e9e5c4f60a739e

SHA512
61de091d7a695ab36d59f300cfffbf38fa336d0a73119e7fe530c259389714052d3764e51650fe3657642d7604f695b0a48c4b935c4069d1d18a7b32501918ad

Download Submit
C:\Windows\System\JBezbcj.exe

Filesize
1.9MB

MD5
f8605b57e47f8b40fb0c5cbfdc095d00

SHA1
603fc3380f912e972959b6361b3bedead72b2fe1

SHA256
7108881f5823889ac049532747da1b58043a3673163035a8945c4e83a0757a4d

SHA512
1db2333bf41e65eff8db710ee77b1052a49c67ecc403d976cac2af87a02435207d6873038b6b7687aa9cc5f3b9c2a7fb592a6d68a61482b092272dd72e81e08b

Download Submit
C:\Windows\System\JgYYxPM.exe

Filesize
1.9MB

MD5
58570470bef8e67c8b2aa42e93dca51a

SHA1
206bbc09e4bc6f92a998b23544b4854e0b0ee15b

SHA256
7e6f9417bffbfd1a0e2b5315a5857583a73719c802a6fe474262c0b2cba06cc4

SHA512
6b23414180fe3eae2b36d1371427c551d6e78425a061d3d272a839b566d080fed6467d851b73a7bace8e9f805a645af4a0827ff67f45b151aa88fb3e5136b94f

Download Submit
C:\Windows\System\JyNSMdH.exe

Filesize
1.9MB

MD5
7fa90408097abfc65e3d52948b6bd393

SHA1
fa1da4c02e43247ac488e9d4768b8f98edabffdf

SHA256
271499309d9907b4cb09dbe5a23067ef815251a0c00cf2c91620011bbffed932

SHA512
04359bb81f771661e81f12207cbbf126a75bc325ca865b9888ef10057f4aef1ba9013b7abed09e86871d02e24d0d3b55a09029adcf4522d9ff941c8004784bbc

Download Submit
C:\Windows\System\LYGMXjU.exe

Filesize
1.9MB

MD5
91c8770db36bd9ca6af6571f72cd5055

SHA1
9319ce048141a3fea7fd8edbecc18e5fa812794a

SHA256
e86647de4f75cd989da399404c48c90db38d1a11600021e73f2dd42e7c346b06

SHA512
29374273c5e60a0feed48943b53bbf35bb380e0017a242dddb22e6f9c7f3429b1d4801810f52ca428eca8409723b5b24edefea2949d2427cd20fbc1dd8167080

Download Submit
C:\Windows\System\LcbVuyI.exe

Filesize
1.9MB

MD5
75a764f017e213b984a5d242b1a6bc25

SHA1
b6284d3efe50d298cb56415df7f9d3b8aa0d5289

SHA256
af9175f29e229529a7d8a94a4ef7af38d8c4f576a4d42453df864ef0375e088e

SHA512
5e2ea86d85430c047df02b4b2aeebcc124f5387d1f01e34c6ad4b088597740068202b4b45c74f3f71fc76ca174f59be13e1d502f43553c4e6d5b0bc72d16eeb5

Download Submit
C:\Windows\System\NjSvxwo.exe

Filesize
1.9MB

MD5
8d2ad2154bfbead16f82b9f2546d5085

SHA1
cbc02d6bb54dc06cb7c7b4d244336421bb1c75d4

SHA256
e932c50e4f7d5b5b4d7032d499bf0b7a122d24345adb4393380365245958a4ac

SHA512
15567d422e7ca878d9776d4b221d883441050d0cca9730ea54b0198bb7de4c70a8f100848b0deaf2bbdd1001cd166311a0e2c7cff1faf6dbac63b7723bc24231

Download Submit
C:\Windows\System\OIkfNnP.exe

Filesize
1.9MB

MD5
39000fe5ea161fe25ec3df6942f71f63

SHA1
7ecd477c0da072d14d0cb0bf6da6daed6a18a235

SHA256
4982a97abf7cea1cb644c3e80fe401b10e142819d06b95f81cf1bc3f0fbec58e

SHA512
740cb2c6b39e1f6ff9b46339b33f2a78a647204ed86698dc5ab5431b7dd084af002dac0292ff74afe60da4fa36b4156ca434678b7bfab0fd3d710f1d5f63291d

Download Submit
C:\Windows\System\PqQChsl.exe

Filesize
1.9MB

MD5
b8bba292d7ef222ab7a297bbabc625a9

SHA1
06660512dc4ee667eecc6a1260488baddcd30d7d

SHA256
1ad25116a07e34adaf2da390cc5b47ffacf919480f042b2210778fa833f82dd9

SHA512
cc3d6fc0df4960bae0a8138855cdbabd0de115ef4ae8cf8b6bd3ba290f0e37560435c212b09704f7267e8209767e8758b60d7c93a83e78c95959c30c3fed6b41

Download Submit
C:\Windows\System\RBAdiMZ.exe

Filesize
1.9MB

MD5
468d34f6f8826d84afe24e21442020e4

SHA1
93ae12fd8dfc09f30f3e61a64dd831531d50a6ff

SHA256
61335b182e6479d25572ac695ea16c9e4057af03e6b0e821565ce3bad50cdf92

SHA512
366673fd8d32e2b76ae40a03a6d672f13c4e57274a7d96eba83cb60de3db8f7d618a55dbcf1b4f131403742746f31e6adfc2f8c2a5a50da1fff2ebebe2e0cafc

Download Submit
C:\Windows\System\ZGDyVDy.exe

Filesize
1.9MB

MD5
e862fe4aa19594da0f9e6ac3a35f1711

SHA1
f09c408261c931686c0b83f28172bb5a83c0efd1

SHA256
d7f9d0c98b7fd496ae1d6f0a26ac8cc8e56ec0c07d5663fd09225b827c54c3b9

SHA512
963ac7e80e729dc1aa9f83b5d876dcc6ea80cb8e3b5728378cae4773d6d0ac62b4f151fc39237952ca6bcb73211a889dba9dd39f64ba0d8c3632bc208f98f5a2

Download Submit
C:\Windows\System\blmgbtz.exe

Filesize
1.9MB

MD5
d9a81ac7b9c7c47bd6b49dfba0d8b301

SHA1
2300336fd1075e462d7f4703004e14a5df41406d

SHA256
fba6cff5b2f1f7e506b9a1fc05bded9f8b62c9462e0b7b417eabeebf3b67df97

SHA512
610c252e2e1ea560531a94a0e339819dd4789d6fed87ec9a0302a8fb30c0290b120208071b776653502dcbd59f53486e8ed6038f84693523aa4df48da6f95408

Download Submit
C:\Windows\System\ejrDZRn.exe

Filesize
1.9MB

MD5
874271aef033d830cb6d3d0816dc54a2

SHA1
703711a6500fc55078f66f7e585e7f5e2ab80d74

SHA256
7867e6a329702e6dcbed2cee03b9c66f10af317046c4e0561d18bbaf4b6fc3cd

SHA512
a07e10d29d8dab37abc1a1a377cc83bdf36566476a82dbdb9b23ab0f15860df9f03aa8b4a283caa8251ed3dbfed9026426512a4d9abf7e02e0715b5f43cd14be

Download Submit
C:\Windows\System\gELHQbv.exe

Filesize
1.9MB

MD5
e35d639f5ae534f37619bc0bd92634c6

SHA1
24edf4a93c3cb55ace2ac238b9c51609bfbb36f7

SHA256
e359ce5c472ae7d0ea390e2a068786ccfe1dffb62f61f94bcee7e2fa807342bc

SHA512
4eaba59be22f112f4927e08e34cda0afc3b04ab9b30fd042adfbfa0e7f8aeb60b504e103d8b36cd4df5acaaf90cbc4c3650d111dccbbc0fbf4fbf2ebc2453ef6

Download Submit
C:\Windows\System\gcorRrL.exe

Filesize
1.9MB

MD5
344a976070310cc59ccb8af0477c75c1

SHA1
4ad3461e35372428fe7ba4362e24209384542a06

SHA256
0dc0ed3011b7f82ff99b528a8314001e9ebf893b8a702dbd94d7feed626ee464

SHA512
3d80e874251d60eeb19300d0415ce4ad84d737a35fe254a2cd26d3c4b1830be39dbf93ce70192c64740b71f3f092c609fa9f7b72a812d5b2bae79b14d0d12120

Download Submit
C:\Windows\System\hGuxQOh.exe

Filesize
1.9MB

MD5
f3c6063cd702b589831f334440382dc3

SHA1
4e764de155a3e213d3523ecc49d2ef740f0f8f6e

SHA256
ff2e5321737245c4a28c667de9a33a7f41c0b8e44f8a1621e92658c57a5a771e

SHA512
ca8ac4a1ff9fda81d39e0b3a00468d55595ed09f16b4781c1c0f353ff3daca9e59e70edbcbc5aeca455d0eaae59ecf7a3b36e54f09472719195feccbc49b1e9f

Download Submit
C:\Windows\System\jkynzbt.exe

Filesize
1.9MB

MD5
bbca46342dc439e9f913baf728a931f4

SHA1
dd94bd9d3a3a33ec2684c55a6ec8635e7b5c8f84

SHA256
66f76253294bab7373577f9dd9075913c6d75ff808aab6ed7f21f48359f97c71

SHA512
959e4b5e4166c853e479a3843b1c35883b92a9785a1ae57543511158cddda068cc4fb290b6f2cc03ffd99da3dfdb481509b987c88378d3276c34263f95741d30

Download Submit
C:\Windows\System\jmjbGcH.exe

Filesize
1.9MB

MD5
2fbe976329899f07e52e3ecd0d65d224

SHA1
f0e954c29a357c255f4eaacbe5e36cafc8a7a5f1

SHA256
8d5c7a111f8cd422f2a4b76ebf3fa9162c21e2cc70f4a51512c99a2e4509dd8b

SHA512
ec4a354bff6cfedb65815da3f9bffddea37d2f10ad6529b12f64b841fcdd5360955e2b40f18a6dff7297610fdd167e28db88cdaeb7dad1a359c60f37836d86ff

Download Submit
C:\Windows\System\lyfAfFT.exe

Filesize
1.9MB

MD5
ff80ef5aa60af36ff30b25a1d6ed545d

SHA1
4d2235cb4d281a975d4487569f72a6cbfcab0d0c

SHA256
ea130c373bb0cacebb1c8024f603a060bb0743c52d789d996dcd18651fa3fa27

SHA512
0297abb5a8db02a081655ab50c23871d5dce1a0e7a854853ef7e0f83f0635b333df5dbee9a8b11b3cbbc507da5e730bbd9309a817930a59b10520999560bd329

Download Submit
C:\Windows\System\meZtFbg.exe

Filesize
1.9MB

MD5
57d46b7ec6e332693a9e434ce14dea01

SHA1
4535ad10feb54f6174864b5b04b680b75cbbf75c

SHA256
2d9293d60975e9bc5523a01abd65c30b37262d0fe26d9c9ca8f08c5e39fa64b4

SHA512
f6dbd5bfe2f1c0aae857184561cffa7a0ee9ce93c01d8822d6b65d5aa0cfad591c2873f52aff7ebca7280d151794b6b95e5510657c3cb388a02c8ec2bca39d29

Download Submit
C:\Windows\System\phyjiCJ.exe

Filesize
1.9MB

MD5
8b8a2e418d284fcff1648821613f1d0a

SHA1
ab53b9a4ec04bba8d90b4861cbd5f82f69021706

SHA256
35c813d4bfb0224f7060e1baf60e9b273dcabc13df1acfb8aec8dfe7af7f6eca

SHA512
19a81a5ebc83875ca8e90022bb74d17ead288efe068a1aef109eb0b0e97b9356d4646560c4c34ea3cefd3b58411c588e4d67ddebcf10f2ef5bcc19ca3fe33870

Download Submit
C:\Windows\System\qiEWHst.exe

Filesize
1.9MB

MD5
efb6a42809bfab2fe438e217b754789c

SHA1
04c97096b748f263c42bc7a9f90177e2674ba95f

SHA256
f9096d4539a4914247a2aa420057c6b8977ab0140313ad65a000877fc9e0c222

SHA512
f54a8e07db9f42e63840ee2fcd04c7fb9334628a18315a375bc3db40487b45afef649e6a59a6e7e49d317377625f2c97b535f53ebdd49f051adf331ccd82d3a9

Download Submit
C:\Windows\System\rKCvNDZ.exe

Filesize
8B

MD5
3277aa72bb7d7f1eb1043502fbd1c406

SHA1
8712dca2f3fbc82bf0cbbeecdc5d6a26c87f443c

SHA256
e94b62f30c9ce8b0b5cea14d4367a52fe08005d1bd56ca932a1fd7fc15c61bc9

SHA512
9fb0369549dba8937fb796cbc4ade6bacf540f10f98e02675f1b04c615cbb49e396cdbd25cd29de56c7bfb889c8464199939a84fa31434a75c020caeb4f9f503

Download Submit
C:\Windows\System\rfAKyIv.exe

Filesize
1.9MB

MD5
a244965dc79b74e39a65eced66b0706a

SHA1
331ed27c468902ec5c5fd933e39c411a53640480

SHA256
60a9202f03cc448dc1a87673541b1afb8fdc94852432519d95e15dc179fd2e1b

SHA512
fd75fd3fef41668311505af15c2268cf96d7d6453123f1b1afd5b242ab9146a1f2ba5b4b409d6b6b342c50cd625c94c9ca56a8b2e00cfeb9f2192b5b9a224b6d

Download Submit
C:\Windows\System\uGfwAwp.exe

Filesize
1.9MB

MD5
dc3c348ee0da4fa3d234403f66f5a0f2

SHA1
d0207f4814bb6310f2fc635ae9bb6a57403a64f3

SHA256
d6ca2fb015946a15f8fd5874d4f052abf1dc0578ed5874f8bb798b2093dd62a4

SHA512
66674c8195e25ffbda7ac67b65f7b102cf108fd79994ac41d1efc6ce110e33f9da6feb036f7243f6965c8cbd174d231be562fb794334477269fa375885def158

Download Submit
C:\Windows\System\zFEfWGU.exe

Filesize
1.9MB

MD5
71199f924ab35944f8a2973d7a29b365

SHA1
02dfd38b67e81112506cb0a014d64c4c4d8bf7b2

SHA256
344e46d3aad08ca419654230bd4a07af3f461b9d877cf69f8c1926772a17a5d4

SHA512
aeea40e7ffa9d8decc84ccb03e1bf0021ade31968db06729b820098ea96959d24fa2b7234a4707cc052fd63468960f42fd8faca19d39129b6f2fb819fb3232a7

Download Submit
memory/468-501-0x00007FF6B01B0000-0x00007FF6B05A2000-memory.dmp

Filesize
3.9MB

Download
memory/636-555-0x00007FF684210000-0x00007FF684602000-memory.dmp

Filesize
3.9MB

Download
memory/1048-561-0x00007FF608ED0000-0x00007FF6092C2000-memory.dmp

Filesize
3.9MB

Download
memory/1080-556-0x00007FF7FE930000-0x00007FF7FED22000-memory.dmp

Filesize
3.9MB

Download
memory/1864-50-0x00007FF7A6230000-0x00007FF7A6622000-memory.dmp

Filesize
3.9MB

Download
memory/2000-535-0x00007FF6F93B0000-0x00007FF6F97A2000-memory.dmp

Filesize
3.9MB

Download
memory/2228-53-0x00007FF650140000-0x00007FF650532000-memory.dmp

Filesize
3.9MB

Download
memory/2676-508-0x00007FF70F680000-0x00007FF70FA72000-memory.dmp

Filesize
3.9MB

Download
memory/2732-524-0x00007FF68DAD0000-0x00007FF68DEC2000-memory.dmp

Filesize
3.9MB

Download
memory/2772-567-0x00007FF746220000-0x00007FF746612000-memory.dmp

Filesize
3.9MB

Download
memory/2808-17-0x00007FF7B13B0000-0x00007FF7B17A2000-memory.dmp

Filesize
3.9MB

Download
memory/3136-569-0x00007FF69BFD0000-0x00007FF69C3C2000-memory.dmp

Filesize
3.9MB

Download
memory/3292-547-0x00007FF604350000-0x00007FF604742000-memory.dmp

Filesize
3.9MB

Download
memory/4012-479-0x00007FF689E30000-0x00007FF68A222000-memory.dmp

Filesize
3.9MB

Download
memory/4272-518-0x00007FF65E6E0000-0x00007FF65EAD2000-memory.dmp

Filesize
3.9MB

Download
memory/4372-0-0x00007FF631390000-0x00007FF631782000-memory.dmp

Filesize
3.9MB

Download
memory/4372-1-0x000001AF8E7A0000-0x000001AF8E7B0000-memory.dmp

Filesize
64KB

Download
memory/4396-48-0x00007FFECFC50000-0x00007FFED0711000-memory.dmp

Filesize
10.8MB

Download
memory/4396-74-0x000002026ABB0000-0x000002026ABD2000-memory.dmp

Filesize
136KB

Download
memory/4396-568-0x000002026AC50000-0x000002026AC60000-memory.dmp

Filesize
64KB

Download
memory/4396-1851-0x00007FFECFC50000-0x00007FFED0711000-memory.dmp

Filesize
10.8MB

Download
memory/4428-538-0x00007FF76A830000-0x00007FF76AC22000-memory.dmp

Filesize
3.9MB

Download
memory/4488-515-0x00007FF7D4130000-0x00007FF7D4522000-memory.dmp

Filesize
3.9MB

Download
memory/4496-578-0x00007FF6F9820000-0x00007FF6F9C12000-memory.dmp

Filesize
3.9MB

Download
memory/4532-76-0x00007FF6FAD60000-0x00007FF6FB152000-memory.dmp

Filesize
3.9MB

Download
memory/4764-486-0x00007FF693F20000-0x00007FF694312000-memory.dmp

Filesize
3.9MB

Download
memory/4892-496-0x00007FF604DA0000-0x00007FF605192000-memory.dmp

Filesize
3.9MB

Download