xmrig | ed1e1fa4d52ee1388ee5f79946238eb5c884ce41ce66baf08857d65c35cfc315

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 00:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
Size

1.8MB
MD5

03f9eeaa3148691c2cd3fd75366b3fc3
SHA1

dc19754ab6746a57e956d3f670807d5a2e67f99e
SHA256

ed1e1fa4d52ee1388ee5f79946238eb5c884ce41ce66baf08857d65c35cfc315
SHA512

3b309bd0f5aaf8cf63cbfe0cc58b112561d350d609641d6cfe9bb6429e5cbc4aa339505739232a60eaa7a85344a5ee445431767bb1f4faa8197b1b7dac9cdf0f
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrI5/:NAB1

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 43 IoCs

miner

resource	yara_rule
behavioral2/memory/2808-69-0x00007FF764550000-0x00007FF764942000-memory.dmp	xmrig
behavioral2/memory/1856-79-0x00007FF73FD80000-0x00007FF740172000-memory.dmp	xmrig
behavioral2/memory/4472-82-0x00007FF662230000-0x00007FF662622000-memory.dmp	xmrig
behavioral2/memory/4016-81-0x00007FF6D7DB0000-0x00007FF6D81A2000-memory.dmp	xmrig
behavioral2/memory/2360-76-0x00007FF703F10000-0x00007FF704302000-memory.dmp	xmrig
behavioral2/memory/3324-68-0x00007FF7D0950000-0x00007FF7D0D42000-memory.dmp	xmrig
behavioral2/memory/4148-62-0x00007FF69A580000-0x00007FF69A972000-memory.dmp	xmrig
behavioral2/memory/2508-26-0x00007FF64F020000-0x00007FF64F412000-memory.dmp	xmrig
behavioral2/memory/380-9-0x00007FF7265B0000-0x00007FF7269A2000-memory.dmp	xmrig
behavioral2/memory/2120-133-0x00007FF6E02A0000-0x00007FF6E0692000-memory.dmp	xmrig
behavioral2/memory/2788-188-0x00007FF60F9E0000-0x00007FF60FDD2000-memory.dmp	xmrig
behavioral2/memory/4760-171-0x00007FF672DA0000-0x00007FF673192000-memory.dmp	xmrig
behavioral2/memory/1084-166-0x00007FF600AB0000-0x00007FF600EA2000-memory.dmp	xmrig
behavioral2/memory/4712-157-0x00007FF67BA40000-0x00007FF67BE32000-memory.dmp	xmrig
behavioral2/memory/1436-147-0x00007FF6E60B0000-0x00007FF6E64A2000-memory.dmp	xmrig
behavioral2/memory/380-2045-0x00007FF7265B0000-0x00007FF7269A2000-memory.dmp	xmrig
behavioral2/memory/3248-2290-0x00007FF6A5610000-0x00007FF6A5A02000-memory.dmp	xmrig
behavioral2/memory/2088-2309-0x00007FF763EF0000-0x00007FF7642E2000-memory.dmp	xmrig
behavioral2/memory/1732-2310-0x00007FF673D50000-0x00007FF674142000-memory.dmp	xmrig
behavioral2/memory/3608-2323-0x00007FF79DF70000-0x00007FF79E362000-memory.dmp	xmrig
behavioral2/memory/2120-2324-0x00007FF6E02A0000-0x00007FF6E0692000-memory.dmp	xmrig
behavioral2/memory/4912-2337-0x00007FF71A900000-0x00007FF71ACF2000-memory.dmp	xmrig
behavioral2/memory/2508-2347-0x00007FF64F020000-0x00007FF64F412000-memory.dmp	xmrig
behavioral2/memory/1856-2345-0x00007FF73FD80000-0x00007FF740172000-memory.dmp	xmrig
behavioral2/memory/380-2343-0x00007FF7265B0000-0x00007FF7269A2000-memory.dmp	xmrig
behavioral2/memory/4148-2353-0x00007FF69A580000-0x00007FF69A972000-memory.dmp	xmrig
behavioral2/memory/3324-2355-0x00007FF7D0950000-0x00007FF7D0D42000-memory.dmp	xmrig
behavioral2/memory/2808-2357-0x00007FF764550000-0x00007FF764942000-memory.dmp	xmrig
behavioral2/memory/4016-2351-0x00007FF6D7DB0000-0x00007FF6D81A2000-memory.dmp	xmrig
behavioral2/memory/3536-2350-0x00007FF62A780000-0x00007FF62AB72000-memory.dmp	xmrig
behavioral2/memory/3248-2360-0x00007FF6A5610000-0x00007FF6A5A02000-memory.dmp	xmrig
behavioral2/memory/2360-2362-0x00007FF703F10000-0x00007FF704302000-memory.dmp	xmrig
behavioral2/memory/4472-2363-0x00007FF662230000-0x00007FF662622000-memory.dmp	xmrig
behavioral2/memory/2088-2365-0x00007FF763EF0000-0x00007FF7642E2000-memory.dmp	xmrig
behavioral2/memory/1732-2403-0x00007FF673D50000-0x00007FF674142000-memory.dmp	xmrig
behavioral2/memory/4912-2405-0x00007FF71A900000-0x00007FF71ACF2000-memory.dmp	xmrig
behavioral2/memory/4760-2409-0x00007FF672DA0000-0x00007FF673192000-memory.dmp	xmrig
behavioral2/memory/2120-2411-0x00007FF6E02A0000-0x00007FF6E0692000-memory.dmp	xmrig
behavioral2/memory/1436-2413-0x00007FF6E60B0000-0x00007FF6E64A2000-memory.dmp	xmrig
behavioral2/memory/3608-2407-0x00007FF79DF70000-0x00007FF79E362000-memory.dmp	xmrig
behavioral2/memory/4712-2419-0x00007FF67BA40000-0x00007FF67BE32000-memory.dmp	xmrig
behavioral2/memory/2788-2421-0x00007FF60F9E0000-0x00007FF60FDD2000-memory.dmp	xmrig
behavioral2/memory/1084-2418-0x00007FF600AB0000-0x00007FF600EA2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
380	cPbkass.exe
1856	RnwLPZt.exe
2508	bdBBtPT.exe
3536	frVyJei.exe
4148	fQoytls.exe
4016	EhYTrzX.exe
3324	nHAwNfS.exe
2808	OiYVUDS.exe
4472	rqCInrw.exe
3248	mXmBBuE.exe
2360	VWqsCAL.exe
2088	XEdPVjK.exe
1732	wjSMKjM.exe
3608	nQikjyz.exe
4912	aNXiQxg.exe
4760	gvRXXbR.exe
2120	DiAvBoM.exe
1436	JLkjhxq.exe
2788	VHAnEbP.exe
4712	ppDlOSy.exe
1084	LNIRAeZ.exe
2884	pjFaMHu.exe
1696	ePhQXiN.exe
4808	klHWZuJ.exe
4960	kXikWvJ.exe
2240	kFJSLtr.exe
4512	sEsXlsH.exe
3116	PXbyjzW.exe
2784	HwEtGco.exe
2140	gsehkxr.exe
1880	aywjYuh.exe
2412	nSeNYDT.exe
2112	UkCRYtX.exe
1540	kPTYsXL.exe
2344	zcVhTvo.exe
1600	RvPsGso.exe
2232	BypcWxj.exe
1820	BzARwuB.exe
3388	DKuqjZe.exe
4704	pXYKdEv.exe
2208	SksKRvd.exe
3584	GFCSrik.exe
5008	RwpzArl.exe
4816	MoTdZIM.exe
4764	LuynZgQ.exe
3752	tbHwuDI.exe
448	DmpEljM.exe
1904	oYgjHBu.exe
2180	GysUkJL.exe
4904	GAwWFzA.exe
2368	EMvKxsh.exe
3652	bzbxSlD.exe
2856	lHZBGVW.exe
4112	IuSaXSu.exe
960	PbhwWxy.exe
1100	JQFhpPm.exe
2792	VlIxMmB.exe
3704	zqzzYzY.exe
3180	zdGunJN.exe
1368	LTKXTLe.exe
4624	lgjWreI.exe
4672	ewhiMvg.exe
3596	MgCyIlT.exe
4396	TEmjibf.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2092-0-0x00007FF7B8FB0000-0x00007FF7B93A2000-memory.dmp	upx
behavioral2/files/0x000b000000023bc0-5.dat	upx
behavioral2/files/0x000a000000023bc5-8.dat	upx
behavioral2/files/0x000a000000023bc6-19.dat	upx
behavioral2/files/0x000a000000023bc8-34.dat	upx
behavioral2/files/0x000b000000023bcd-67.dat	upx
behavioral2/memory/2808-69-0x00007FF764550000-0x00007FF764942000-memory.dmp	upx
behavioral2/memory/3248-75-0x00007FF6A5610000-0x00007FF6A5A02000-memory.dmp	upx
behavioral2/memory/1856-79-0x00007FF73FD80000-0x00007FF740172000-memory.dmp	upx
behavioral2/memory/4472-82-0x00007FF662230000-0x00007FF662622000-memory.dmp	upx
behavioral2/memory/2088-85-0x00007FF763EF0000-0x00007FF7642E2000-memory.dmp	upx
behavioral2/files/0x000a000000023bcf-83.dat	upx
behavioral2/memory/4016-81-0x00007FF6D7DB0000-0x00007FF6D81A2000-memory.dmp	upx
behavioral2/memory/2360-76-0x00007FF703F10000-0x00007FF704302000-memory.dmp	upx
behavioral2/files/0x000a000000023bce-72.dat	upx
behavioral2/files/0x000a000000023bcb-70.dat	upx
behavioral2/memory/3324-68-0x00007FF7D0950000-0x00007FF7D0D42000-memory.dmp	upx
behavioral2/memory/4148-62-0x00007FF69A580000-0x00007FF69A972000-memory.dmp	upx
behavioral2/files/0x000a000000023bca-56.dat	upx
behavioral2/memory/3536-42-0x00007FF62A780000-0x00007FF62AB72000-memory.dmp	upx
behavioral2/files/0x000a000000023bc9-54.dat	upx
behavioral2/files/0x000a000000023bc7-38.dat	upx
behavioral2/memory/2508-26-0x00007FF64F020000-0x00007FF64F412000-memory.dmp	upx
behavioral2/files/0x000a000000023bc4-11.dat	upx
behavioral2/memory/380-9-0x00007FF7265B0000-0x00007FF7269A2000-memory.dmp	upx
behavioral2/files/0x000b000000023bcc-88.dat	upx
behavioral2/memory/1732-93-0x00007FF673D50000-0x00007FF674142000-memory.dmp	upx
behavioral2/files/0x000b000000023bc1-94.dat	upx
behavioral2/memory/3608-103-0x00007FF79DF70000-0x00007FF79E362000-memory.dmp	upx
behavioral2/memory/4912-108-0x00007FF71A900000-0x00007FF71ACF2000-memory.dmp	upx
behavioral2/files/0x000a000000023bd2-114.dat	upx
behavioral2/files/0x000a000000023bd4-121.dat	upx
behavioral2/files/0x000a000000023bd6-130.dat	upx
behavioral2/files/0x000a000000023bd7-135.dat	upx
behavioral2/files/0x000a000000023bd8-142.dat	upx
behavioral2/files/0x000a000000023bd5-134.dat	upx
behavioral2/memory/2120-133-0x00007FF6E02A0000-0x00007FF6E0692000-memory.dmp	upx
behavioral2/files/0x000a000000023bd3-120.dat	upx
behavioral2/files/0x000a000000023bd1-116.dat	upx
behavioral2/files/0x000a000000023bd0-102.dat	upx
behavioral2/files/0x000a000000023bdb-156.dat	upx
behavioral2/files/0x000a000000023bda-159.dat	upx
behavioral2/files/0x000a000000023bdd-169.dat	upx
behavioral2/files/0x000a000000023bdc-177.dat	upx
behavioral2/files/0x000b000000023be0-187.dat	upx
behavioral2/files/0x000a000000023be8-191.dat	upx
behavioral2/files/0x000e000000023bef-196.dat	upx
behavioral2/memory/2788-188-0x00007FF60F9E0000-0x00007FF60FDD2000-memory.dmp	upx
behavioral2/files/0x000b000000023bdf-184.dat	upx
behavioral2/files/0x000b000000023bde-182.dat	upx
behavioral2/memory/4760-171-0x00007FF672DA0000-0x00007FF673192000-memory.dmp	upx
behavioral2/memory/1084-166-0x00007FF600AB0000-0x00007FF600EA2000-memory.dmp	upx
behavioral2/memory/4712-157-0x00007FF67BA40000-0x00007FF67BE32000-memory.dmp	upx
behavioral2/files/0x000a000000023bd9-155.dat	upx
behavioral2/memory/1436-147-0x00007FF6E60B0000-0x00007FF6E64A2000-memory.dmp	upx
behavioral2/memory/380-2045-0x00007FF7265B0000-0x00007FF7269A2000-memory.dmp	upx
behavioral2/memory/3248-2290-0x00007FF6A5610000-0x00007FF6A5A02000-memory.dmp	upx
behavioral2/memory/2088-2309-0x00007FF763EF0000-0x00007FF7642E2000-memory.dmp	upx
behavioral2/memory/1732-2310-0x00007FF673D50000-0x00007FF674142000-memory.dmp	upx
behavioral2/memory/3608-2323-0x00007FF79DF70000-0x00007FF79E362000-memory.dmp	upx
behavioral2/memory/2120-2324-0x00007FF6E02A0000-0x00007FF6E0692000-memory.dmp	upx
behavioral2/memory/4912-2337-0x00007FF71A900000-0x00007FF71ACF2000-memory.dmp	upx
behavioral2/memory/2508-2347-0x00007FF64F020000-0x00007FF64F412000-memory.dmp	upx
behavioral2/memory/1856-2345-0x00007FF73FD80000-0x00007FF740172000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\JoooEWd.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\jtDIppQ.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\ZFrXPuz.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\UdLxnyu.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\rXOVudR.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\CdMLtug.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\NLKoqVd.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\BbOsVjn.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\RZTzInl.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\kzTTFOh.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\LCdrqhD.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\UOYVjVm.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\EWazEhZ.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\vRllqIJ.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\rpQpPKX.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\zHYeNkE.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\rUeWVsP.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\BoCGqHL.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\NBMCFQv.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\YxwYFnW.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\kavPFsJ.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\raqlmzi.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\TBQkorf.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\KQPQVzm.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\vIdEhIB.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\xvEcMXG.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\lgjWreI.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\KpzhrAE.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\VDcDhCn.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\wpVMmZg.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\zomluhX.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\OcQtejU.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\oDiohat.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\PQTrnZd.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\NsjDFPX.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\xxLDoYo.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\ZsQyPDq.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\aggztuz.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\zPSLgcQ.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\QNfREYH.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\sPULRgg.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\hjxJBYa.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\XwCafpr.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\QrlzXgM.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\xNfdeKB.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\SZdNxKy.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\NCbrkNi.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\FCLBSad.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\pcCIDXQ.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\XkDlzPI.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\jopDPvS.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\nAhOCOw.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\DeYdHmw.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\oeYALwC.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\HLdcIWO.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\GDNHJMi.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\lpxQrfh.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\VErStMT.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\eIEkRNq.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\GxDYFhX.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\zGArGaK.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\QxFyEBv.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\WGOHxgh.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\zkWaMFf.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4564	powershell.exe
4564	powershell.exe
4564	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4564	powershell.exe
Token: SeLockMemoryPrivilege	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 4564	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	87
PID 2092 wrote to memory of 4564	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	87
PID 2092 wrote to memory of 380	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	88
PID 2092 wrote to memory of 380	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	88
PID 2092 wrote to memory of 1856	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	89
PID 2092 wrote to memory of 1856	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	89
PID 2092 wrote to memory of 2508	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	90
PID 2092 wrote to memory of 2508	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	90
PID 2092 wrote to memory of 3536	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	91
PID 2092 wrote to memory of 3536	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	91
PID 2092 wrote to memory of 4148	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	92
PID 2092 wrote to memory of 4148	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	92
PID 2092 wrote to memory of 4016	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	93
PID 2092 wrote to memory of 4016	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	93
PID 2092 wrote to memory of 3324	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	94
PID 2092 wrote to memory of 3324	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	94
PID 2092 wrote to memory of 2808	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	95
PID 2092 wrote to memory of 2808	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	95
PID 2092 wrote to memory of 4472	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	96
PID 2092 wrote to memory of 4472	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	96
PID 2092 wrote to memory of 3248	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	97
PID 2092 wrote to memory of 3248	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	97
PID 2092 wrote to memory of 2360	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	98
PID 2092 wrote to memory of 2360	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	98
PID 2092 wrote to memory of 2088	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	99
PID 2092 wrote to memory of 2088	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	99
PID 2092 wrote to memory of 1732	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	100
PID 2092 wrote to memory of 1732	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	100
PID 2092 wrote to memory of 3608	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	101
PID 2092 wrote to memory of 3608	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	101
PID 2092 wrote to memory of 4912	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	102
PID 2092 wrote to memory of 4912	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	102
PID 2092 wrote to memory of 2120	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	103
PID 2092 wrote to memory of 2120	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	103
PID 2092 wrote to memory of 4760	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	104
PID 2092 wrote to memory of 4760	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	104
PID 2092 wrote to memory of 1436	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	105
PID 2092 wrote to memory of 1436	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	105
PID 2092 wrote to memory of 2788	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	106
PID 2092 wrote to memory of 2788	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	106
PID 2092 wrote to memory of 4712	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	107
PID 2092 wrote to memory of 4712	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	107
PID 2092 wrote to memory of 1084	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	108
PID 2092 wrote to memory of 1084	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	108
PID 2092 wrote to memory of 2884	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	109
PID 2092 wrote to memory of 2884	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	109
PID 2092 wrote to memory of 1696	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	110
PID 2092 wrote to memory of 1696	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	110
PID 2092 wrote to memory of 4808	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	111
PID 2092 wrote to memory of 4808	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	111
PID 2092 wrote to memory of 4960	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	112
PID 2092 wrote to memory of 4960	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	112
PID 2092 wrote to memory of 2240	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	113
PID 2092 wrote to memory of 2240	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	113
PID 2092 wrote to memory of 4512	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	114
PID 2092 wrote to memory of 4512	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	114
PID 2092 wrote to memory of 3116	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	115
PID 2092 wrote to memory of 3116	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	115
PID 2092 wrote to memory of 2784	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	116
PID 2092 wrote to memory of 2784	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	116
PID 2092 wrote to memory of 2140	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	117
PID 2092 wrote to memory of 2140	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	117
PID 2092 wrote to memory of 1880	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	118
PID 2092 wrote to memory of 1880	2092	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	118

C:\Users\Admin\AppData\Local\Temp\03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4564
- C:\Windows\System\cPbkass.exe
  C:\Windows\System\cPbkass.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\RnwLPZt.exe
  C:\Windows\System\RnwLPZt.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\bdBBtPT.exe
  C:\Windows\System\bdBBtPT.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\frVyJei.exe
  C:\Windows\System\frVyJei.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\fQoytls.exe
  C:\Windows\System\fQoytls.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\EhYTrzX.exe
  C:\Windows\System\EhYTrzX.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\nHAwNfS.exe
  C:\Windows\System\nHAwNfS.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\OiYVUDS.exe
  C:\Windows\System\OiYVUDS.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\rqCInrw.exe
  C:\Windows\System\rqCInrw.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\mXmBBuE.exe
  C:\Windows\System\mXmBBuE.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\VWqsCAL.exe
  C:\Windows\System\VWqsCAL.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\XEdPVjK.exe
  C:\Windows\System\XEdPVjK.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\wjSMKjM.exe
  C:\Windows\System\wjSMKjM.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\nQikjyz.exe
  C:\Windows\System\nQikjyz.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\aNXiQxg.exe
  C:\Windows\System\aNXiQxg.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\DiAvBoM.exe
  C:\Windows\System\DiAvBoM.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\gvRXXbR.exe
  C:\Windows\System\gvRXXbR.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\JLkjhxq.exe
  C:\Windows\System\JLkjhxq.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\VHAnEbP.exe
  C:\Windows\System\VHAnEbP.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\ppDlOSy.exe
  C:\Windows\System\ppDlOSy.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\LNIRAeZ.exe
  C:\Windows\System\LNIRAeZ.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\pjFaMHu.exe
  C:\Windows\System\pjFaMHu.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\ePhQXiN.exe
  C:\Windows\System\ePhQXiN.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\klHWZuJ.exe
  C:\Windows\System\klHWZuJ.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\kXikWvJ.exe
  C:\Windows\System\kXikWvJ.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\kFJSLtr.exe
  C:\Windows\System\kFJSLtr.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\sEsXlsH.exe
  C:\Windows\System\sEsXlsH.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\PXbyjzW.exe
  C:\Windows\System\PXbyjzW.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\HwEtGco.exe
  C:\Windows\System\HwEtGco.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\gsehkxr.exe
  C:\Windows\System\gsehkxr.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\aywjYuh.exe
  C:\Windows\System\aywjYuh.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\nSeNYDT.exe
  C:\Windows\System\nSeNYDT.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\UkCRYtX.exe
  C:\Windows\System\UkCRYtX.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\kPTYsXL.exe
  C:\Windows\System\kPTYsXL.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\zcVhTvo.exe
  C:\Windows\System\zcVhTvo.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\RvPsGso.exe
  C:\Windows\System\RvPsGso.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\BypcWxj.exe
  C:\Windows\System\BypcWxj.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\BzARwuB.exe
  C:\Windows\System\BzARwuB.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\DKuqjZe.exe
  C:\Windows\System\DKuqjZe.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\pXYKdEv.exe
  C:\Windows\System\pXYKdEv.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\SksKRvd.exe
  C:\Windows\System\SksKRvd.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\GFCSrik.exe
  C:\Windows\System\GFCSrik.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\RwpzArl.exe
  C:\Windows\System\RwpzArl.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\MoTdZIM.exe
  C:\Windows\System\MoTdZIM.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\LuynZgQ.exe
  C:\Windows\System\LuynZgQ.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\tbHwuDI.exe
  C:\Windows\System\tbHwuDI.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\DmpEljM.exe
  C:\Windows\System\DmpEljM.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\oYgjHBu.exe
  C:\Windows\System\oYgjHBu.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\GysUkJL.exe
  C:\Windows\System\GysUkJL.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\GAwWFzA.exe
  C:\Windows\System\GAwWFzA.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\EMvKxsh.exe
  C:\Windows\System\EMvKxsh.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\bzbxSlD.exe
  C:\Windows\System\bzbxSlD.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\lHZBGVW.exe
  C:\Windows\System\lHZBGVW.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\IuSaXSu.exe
  C:\Windows\System\IuSaXSu.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\PbhwWxy.exe
  C:\Windows\System\PbhwWxy.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\JQFhpPm.exe
  C:\Windows\System\JQFhpPm.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\VlIxMmB.exe
  C:\Windows\System\VlIxMmB.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\zqzzYzY.exe
  C:\Windows\System\zqzzYzY.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\zdGunJN.exe
  C:\Windows\System\zdGunJN.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\LTKXTLe.exe
  C:\Windows\System\LTKXTLe.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\lgjWreI.exe
  C:\Windows\System\lgjWreI.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\ewhiMvg.exe
  C:\Windows\System\ewhiMvg.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\MgCyIlT.exe
  C:\Windows\System\MgCyIlT.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\TEmjibf.exe
  C:\Windows\System\TEmjibf.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\BFCUIJg.exe
  C:\Windows\System\BFCUIJg.exe
  2⤵
  PID:544
- C:\Windows\System\tdOZQlS.exe
  C:\Windows\System\tdOZQlS.exe
  2⤵
  PID:2612
- C:\Windows\System\wyGGYkD.exe
  C:\Windows\System\wyGGYkD.exe
  2⤵
  PID:868
- C:\Windows\System\GuboUUQ.exe
  C:\Windows\System\GuboUUQ.exe
  2⤵
  PID:3828
- C:\Windows\System\wVjaFZy.exe
  C:\Windows\System\wVjaFZy.exe
  2⤵
  PID:4064
- C:\Windows\System\ARRiqvj.exe
  C:\Windows\System\ARRiqvj.exe
  2⤵
  PID:2420
- C:\Windows\System\AnnKfsW.exe
  C:\Windows\System\AnnKfsW.exe
  2⤵
  PID:2340
- C:\Windows\System\UNclGMn.exe
  C:\Windows\System\UNclGMn.exe
  2⤵
  PID:3640
- C:\Windows\System\eeXjbOI.exe
  C:\Windows\System\eeXjbOI.exe
  2⤵
  PID:1000
- C:\Windows\System\NTUMVfq.exe
  C:\Windows\System\NTUMVfq.exe
  2⤵
  PID:2472
- C:\Windows\System\yrlBghL.exe
  C:\Windows\System\yrlBghL.exe
  2⤵
  PID:860
- C:\Windows\System\xsecXDu.exe
  C:\Windows\System\xsecXDu.exe
  2⤵
  PID:1656
- C:\Windows\System\wcQMRid.exe
  C:\Windows\System\wcQMRid.exe
  2⤵
  PID:2992
- C:\Windows\System\IuIWYvL.exe
  C:\Windows\System\IuIWYvL.exe
  2⤵
  PID:2224
- C:\Windows\System\mRyKqBa.exe
  C:\Windows\System\mRyKqBa.exe
  2⤵
  PID:3036
- C:\Windows\System\wsLBdPi.exe
  C:\Windows\System\wsLBdPi.exe
  2⤵
  PID:4216
- C:\Windows\System\rqhOszE.exe
  C:\Windows\System\rqhOszE.exe
  2⤵
  PID:3512
- C:\Windows\System\EVbzZfm.exe
  C:\Windows\System\EVbzZfm.exe
  2⤵
  PID:1512
- C:\Windows\System\AxRowXL.exe
  C:\Windows\System\AxRowXL.exe
  2⤵
  PID:64
- C:\Windows\System\wmZgmtI.exe
  C:\Windows\System\wmZgmtI.exe
  2⤵
  PID:3864
- C:\Windows\System\qMwbXvF.exe
  C:\Windows\System\qMwbXvF.exe
  2⤵
  PID:3996
- C:\Windows\System\zccRiOd.exe
  C:\Windows\System\zccRiOd.exe
  2⤵
  PID:2152
- C:\Windows\System\ewTTVrV.exe
  C:\Windows\System\ewTTVrV.exe
  2⤵
  PID:4756
- C:\Windows\System\VURkPRx.exe
  C:\Windows\System\VURkPRx.exe
  2⤵
  PID:5124
- C:\Windows\System\eVNPTaY.exe
  C:\Windows\System\eVNPTaY.exe
  2⤵
  PID:5156
- C:\Windows\System\bBaAXpV.exe
  C:\Windows\System\bBaAXpV.exe
  2⤵
  PID:5196
- C:\Windows\System\leanIIS.exe
  C:\Windows\System\leanIIS.exe
  2⤵
  PID:5224
- C:\Windows\System\pxHvdud.exe
  C:\Windows\System\pxHvdud.exe
  2⤵
  PID:5248
- C:\Windows\System\ulVOIFf.exe
  C:\Windows\System\ulVOIFf.exe
  2⤵
  PID:5280
- C:\Windows\System\kzTTFOh.exe
  C:\Windows\System\kzTTFOh.exe
  2⤵
  PID:5324
- C:\Windows\System\MfQaFqW.exe
  C:\Windows\System\MfQaFqW.exe
  2⤵
  PID:5348
- C:\Windows\System\hPuAafT.exe
  C:\Windows\System\hPuAafT.exe
  2⤵
  PID:5384
- C:\Windows\System\zWKluHZ.exe
  C:\Windows\System\zWKluHZ.exe
  2⤵
  PID:5408
- C:\Windows\System\kSvEiRm.exe
  C:\Windows\System\kSvEiRm.exe
  2⤵
  PID:5440
- C:\Windows\System\YJULHFg.exe
  C:\Windows\System\YJULHFg.exe
  2⤵
  PID:5464
- C:\Windows\System\bZnGQnZ.exe
  C:\Windows\System\bZnGQnZ.exe
  2⤵
  PID:5492
- C:\Windows\System\QOskRde.exe
  C:\Windows\System\QOskRde.exe
  2⤵
  PID:5536
- C:\Windows\System\MvvpXKv.exe
  C:\Windows\System\MvvpXKv.exe
  2⤵
  PID:5560
- C:\Windows\System\ojEvogW.exe
  C:\Windows\System\ojEvogW.exe
  2⤵
  PID:5592
- C:\Windows\System\szfXXLz.exe
  C:\Windows\System\szfXXLz.exe
  2⤵
  PID:5620
- C:\Windows\System\NCPnwEJ.exe
  C:\Windows\System\NCPnwEJ.exe
  2⤵
  PID:5644
- C:\Windows\System\TQocmOU.exe
  C:\Windows\System\TQocmOU.exe
  2⤵
  PID:5668
- C:\Windows\System\LgIzVAe.exe
  C:\Windows\System\LgIzVAe.exe
  2⤵
  PID:5684
- C:\Windows\System\vWnEGaE.exe
  C:\Windows\System\vWnEGaE.exe
  2⤵
  PID:5704
- C:\Windows\System\bgUwAVQ.exe
  C:\Windows\System\bgUwAVQ.exe
  2⤵
  PID:5728
- C:\Windows\System\CdMLtug.exe
  C:\Windows\System\CdMLtug.exe
  2⤵
  PID:5744
- C:\Windows\System\eShYMMg.exe
  C:\Windows\System\eShYMMg.exe
  2⤵
  PID:5772
- C:\Windows\System\CUMsaEt.exe
  C:\Windows\System\CUMsaEt.exe
  2⤵
  PID:5836
- C:\Windows\System\sRyPhFE.exe
  C:\Windows\System\sRyPhFE.exe
  2⤵
  PID:5852
- C:\Windows\System\tWuTWaL.exe
  C:\Windows\System\tWuTWaL.exe
  2⤵
  PID:5872
- C:\Windows\System\vWukuat.exe
  C:\Windows\System\vWukuat.exe
  2⤵
  PID:5900
- C:\Windows\System\VUVsWBQ.exe
  C:\Windows\System\VUVsWBQ.exe
  2⤵
  PID:5916
- C:\Windows\System\VNpqXCr.exe
  C:\Windows\System\VNpqXCr.exe
  2⤵
  PID:5944
- C:\Windows\System\WHCkyOH.exe
  C:\Windows\System\WHCkyOH.exe
  2⤵
  PID:5968
- C:\Windows\System\PqDRHUC.exe
  C:\Windows\System\PqDRHUC.exe
  2⤵
  PID:6004
- C:\Windows\System\rrRTvgN.exe
  C:\Windows\System\rrRTvgN.exe
  2⤵
  PID:6024
- C:\Windows\System\MxqGaPw.exe
  C:\Windows\System\MxqGaPw.exe
  2⤵
  PID:6080
- C:\Windows\System\zRMofnk.exe
  C:\Windows\System\zRMofnk.exe
  2⤵
  PID:6104
- C:\Windows\System\muEplou.exe
  C:\Windows\System\muEplou.exe
  2⤵
  PID:6120
- C:\Windows\System\dLdqXBd.exe
  C:\Windows\System\dLdqXBd.exe
  2⤵
  PID:6140
- C:\Windows\System\nliNOQK.exe
  C:\Windows\System\nliNOQK.exe
  2⤵
  PID:2268
- C:\Windows\System\LspdbiD.exe
  C:\Windows\System\LspdbiD.exe
  2⤵
  PID:3660
- C:\Windows\System\SdENJtq.exe
  C:\Windows\System\SdENJtq.exe
  2⤵
  PID:5180
- C:\Windows\System\fjfcgvU.exe
  C:\Windows\System\fjfcgvU.exe
  2⤵
  PID:5364
- C:\Windows\System\LnfkeHU.exe
  C:\Windows\System\LnfkeHU.exe
  2⤵
  PID:5400
- C:\Windows\System\JRoGjVl.exe
  C:\Windows\System\JRoGjVl.exe
  2⤵
  PID:5456
- C:\Windows\System\hjEBsge.exe
  C:\Windows\System\hjEBsge.exe
  2⤵
  PID:5504
- C:\Windows\System\uHHGDsP.exe
  C:\Windows\System\uHHGDsP.exe
  2⤵
  PID:5552
- C:\Windows\System\BMGRyoT.exe
  C:\Windows\System\BMGRyoT.exe
  2⤵
  PID:5660
- C:\Windows\System\NVJJGsB.exe
  C:\Windows\System\NVJJGsB.exe
  2⤵
  PID:5712
- C:\Windows\System\mGVNllH.exe
  C:\Windows\System\mGVNllH.exe
  2⤵
  PID:5736
- C:\Windows\System\PhkrZpO.exe
  C:\Windows\System\PhkrZpO.exe
  2⤵
  PID:5792
- C:\Windows\System\yKuuApQ.exe
  C:\Windows\System\yKuuApQ.exe
  2⤵
  PID:5888
- C:\Windows\System\rUOlibA.exe
  C:\Windows\System\rUOlibA.exe
  2⤵
  PID:5996
- C:\Windows\System\yWcJQFx.exe
  C:\Windows\System\yWcJQFx.exe
  2⤵
  PID:6076
- C:\Windows\System\RjtlyTO.exe
  C:\Windows\System\RjtlyTO.exe
  2⤵
  PID:6112
- C:\Windows\System\cSQaWJQ.exe
  C:\Windows\System\cSQaWJQ.exe
  2⤵
  PID:5260
- C:\Windows\System\XmBThJj.exe
  C:\Windows\System\XmBThJj.exe
  2⤵
  PID:5436
- C:\Windows\System\QoXexSN.exe
  C:\Windows\System\QoXexSN.exe
  2⤵
  PID:5424
- C:\Windows\System\cYztamT.exe
  C:\Windows\System\cYztamT.exe
  2⤵
  PID:5676
- C:\Windows\System\gVRFdYT.exe
  C:\Windows\System\gVRFdYT.exe
  2⤵
  PID:5760
- C:\Windows\System\vwQqnoX.exe
  C:\Windows\System\vwQqnoX.exe
  2⤵
  PID:5924
- C:\Windows\System\NsjDFPX.exe
  C:\Windows\System\NsjDFPX.exe
  2⤵
  PID:6072
- C:\Windows\System\tftsRqc.exe
  C:\Windows\System\tftsRqc.exe
  2⤵
  PID:5432
- C:\Windows\System\slAujjP.exe
  C:\Windows\System\slAujjP.exe
  2⤵
  PID:5616
- C:\Windows\System\ffqjdvI.exe
  C:\Windows\System\ffqjdvI.exe
  2⤵
  PID:5864
- C:\Windows\System\HtcCbxl.exe
  C:\Windows\System\HtcCbxl.exe
  2⤵
  PID:5340
- C:\Windows\System\DAbPmwj.exe
  C:\Windows\System\DAbPmwj.exe
  2⤵
  PID:5488
- C:\Windows\System\WTjzvGQ.exe
  C:\Windows\System\WTjzvGQ.exe
  2⤵
  PID:6168
- C:\Windows\System\xyrgdAW.exe
  C:\Windows\System\xyrgdAW.exe
  2⤵
  PID:6188
- C:\Windows\System\qRUdtXU.exe
  C:\Windows\System\qRUdtXU.exe
  2⤵
  PID:6220
- C:\Windows\System\EGtkYDk.exe
  C:\Windows\System\EGtkYDk.exe
  2⤵
  PID:6248
- C:\Windows\System\oCimMOR.exe
  C:\Windows\System\oCimMOR.exe
  2⤵
  PID:6268
- C:\Windows\System\qRWpGAQ.exe
  C:\Windows\System\qRWpGAQ.exe
  2⤵
  PID:6308
- C:\Windows\System\NuMJfWf.exe
  C:\Windows\System\NuMJfWf.exe
  2⤵
  PID:6336
- C:\Windows\System\rAvAyHK.exe
  C:\Windows\System\rAvAyHK.exe
  2⤵
  PID:6364
- C:\Windows\System\EfRZkFM.exe
  C:\Windows\System\EfRZkFM.exe
  2⤵
  PID:6380
- C:\Windows\System\Mfjmueh.exe
  C:\Windows\System\Mfjmueh.exe
  2⤵
  PID:6404
- C:\Windows\System\tcAscTC.exe
  C:\Windows\System\tcAscTC.exe
  2⤵
  PID:6424
- C:\Windows\System\fisUjLH.exe
  C:\Windows\System\fisUjLH.exe
  2⤵
  PID:6444
- C:\Windows\System\zHYeNkE.exe
  C:\Windows\System\zHYeNkE.exe
  2⤵
  PID:6496
- C:\Windows\System\kKlgmhX.exe
  C:\Windows\System\kKlgmhX.exe
  2⤵
  PID:6552
- C:\Windows\System\DEKcsEc.exe
  C:\Windows\System\DEKcsEc.exe
  2⤵
  PID:6572
- C:\Windows\System\qIFysVe.exe
  C:\Windows\System\qIFysVe.exe
  2⤵
  PID:6604
- C:\Windows\System\iLmQmGi.exe
  C:\Windows\System\iLmQmGi.exe
  2⤵
  PID:6644
- C:\Windows\System\WUCIaWi.exe
  C:\Windows\System\WUCIaWi.exe
  2⤵
  PID:6664
- C:\Windows\System\aJTyYrl.exe
  C:\Windows\System\aJTyYrl.exe
  2⤵
  PID:6680
- C:\Windows\System\YDGnmtV.exe
  C:\Windows\System\YDGnmtV.exe
  2⤵
  PID:6712
- C:\Windows\System\uDBfOhq.exe
  C:\Windows\System\uDBfOhq.exe
  2⤵
  PID:6740
- C:\Windows\System\NTEnTaA.exe
  C:\Windows\System\NTEnTaA.exe
  2⤵
  PID:6764
- C:\Windows\System\qcYwKFt.exe
  C:\Windows\System\qcYwKFt.exe
  2⤵
  PID:6784
- C:\Windows\System\gCUrGuM.exe
  C:\Windows\System\gCUrGuM.exe
  2⤵
  PID:6800
- C:\Windows\System\fDOmmrV.exe
  C:\Windows\System\fDOmmrV.exe
  2⤵
  PID:6824
- C:\Windows\System\UGZnFtE.exe
  C:\Windows\System\UGZnFtE.exe
  2⤵
  PID:6852
- C:\Windows\System\keOMpnk.exe
  C:\Windows\System\keOMpnk.exe
  2⤵
  PID:6868
- C:\Windows\System\xkDjlDa.exe
  C:\Windows\System\xkDjlDa.exe
  2⤵
  PID:6892
- C:\Windows\System\ishgOae.exe
  C:\Windows\System\ishgOae.exe
  2⤵
  PID:6928
- C:\Windows\System\cGlmsQJ.exe
  C:\Windows\System\cGlmsQJ.exe
  2⤵
  PID:6976
- C:\Windows\System\ZgfCbxD.exe
  C:\Windows\System\ZgfCbxD.exe
  2⤵
  PID:7004
- C:\Windows\System\Ivawbou.exe
  C:\Windows\System\Ivawbou.exe
  2⤵
  PID:7028
- C:\Windows\System\NszkANw.exe
  C:\Windows\System\NszkANw.exe
  2⤵
  PID:7052
- C:\Windows\System\vtGXLBm.exe
  C:\Windows\System\vtGXLBm.exe
  2⤵
  PID:7080
- C:\Windows\System\QjqSMrF.exe
  C:\Windows\System\QjqSMrF.exe
  2⤵
  PID:7100
- C:\Windows\System\eibxHsx.exe
  C:\Windows\System\eibxHsx.exe
  2⤵
  PID:7124
- C:\Windows\System\BvWZTWb.exe
  C:\Windows\System\BvWZTWb.exe
  2⤵
  PID:7144
- C:\Windows\System\tMPdJfS.exe
  C:\Windows\System\tMPdJfS.exe
  2⤵
  PID:5140
- C:\Windows\System\JgAAKCZ.exe
  C:\Windows\System\JgAAKCZ.exe
  2⤵
  PID:5812
- C:\Windows\System\PbEAqKc.exe
  C:\Windows\System\PbEAqKc.exe
  2⤵
  PID:6228
- C:\Windows\System\XQPcgGy.exe
  C:\Windows\System\XQPcgGy.exe
  2⤵
  PID:6164
- C:\Windows\System\tqTNjLr.exe
  C:\Windows\System\tqTNjLr.exe
  2⤵
  PID:6280
- C:\Windows\System\GqCPSzf.exe
  C:\Windows\System\GqCPSzf.exe
  2⤵
  PID:6388
- C:\Windows\System\owWtRkv.exe
  C:\Windows\System\owWtRkv.exe
  2⤵
  PID:6420
- C:\Windows\System\lHqKefO.exe
  C:\Windows\System\lHqKefO.exe
  2⤵
  PID:5516
- C:\Windows\System\MTEVlbO.exe
  C:\Windows\System\MTEVlbO.exe
  2⤵
  PID:6620
- C:\Windows\System\twuILEd.exe
  C:\Windows\System\twuILEd.exe
  2⤵
  PID:6660
- C:\Windows\System\xHGHbVE.exe
  C:\Windows\System\xHGHbVE.exe
  2⤵
  PID:6708
- C:\Windows\System\kdHawNt.exe
  C:\Windows\System\kdHawNt.exe
  2⤵
  PID:6840
- C:\Windows\System\dzVhReA.exe
  C:\Windows\System\dzVhReA.exe
  2⤵
  PID:6792
- C:\Windows\System\vmvOiZa.exe
  C:\Windows\System\vmvOiZa.exe
  2⤵
  PID:6940
- C:\Windows\System\rOHyokg.exe
  C:\Windows\System\rOHyokg.exe
  2⤵
  PID:6968
- C:\Windows\System\HSkKsyG.exe
  C:\Windows\System\HSkKsyG.exe
  2⤵
  PID:7068
- C:\Windows\System\vFsplUj.exe
  C:\Windows\System\vFsplUj.exe
  2⤵
  PID:7064
- C:\Windows\System\YSvSbNV.exe
  C:\Windows\System\YSvSbNV.exe
  2⤵
  PID:6216
- C:\Windows\System\UAXTikj.exe
  C:\Windows\System\UAXTikj.exe
  2⤵
  PID:6440
- C:\Windows\System\miKgGau.exe
  C:\Windows\System\miKgGau.exe
  2⤵
  PID:6916
- C:\Windows\System\pYFqjtE.exe
  C:\Windows\System\pYFqjtE.exe
  2⤵
  PID:6796
- C:\Windows\System\HwZQcKZ.exe
  C:\Windows\System\HwZQcKZ.exe
  2⤵
  PID:6924
- C:\Windows\System\sPULRgg.exe
  C:\Windows\System\sPULRgg.exe
  2⤵
  PID:7112
- C:\Windows\System\KLBwRWo.exe
  C:\Windows\System\KLBwRWo.exe
  2⤵
  PID:6524
- C:\Windows\System\RfaGWVg.exe
  C:\Windows\System\RfaGWVg.exe
  2⤵
  PID:6584
- C:\Windows\System\SVTZdsG.exe
  C:\Windows\System\SVTZdsG.exe
  2⤵
  PID:7092
- C:\Windows\System\PYTlmFH.exe
  C:\Windows\System\PYTlmFH.exe
  2⤵
  PID:7180
- C:\Windows\System\vAzuDeg.exe
  C:\Windows\System\vAzuDeg.exe
  2⤵
  PID:7200
- C:\Windows\System\KptSwSa.exe
  C:\Windows\System\KptSwSa.exe
  2⤵
  PID:7228
- C:\Windows\System\KlPBLVd.exe
  C:\Windows\System\KlPBLVd.exe
  2⤵
  PID:7248
- C:\Windows\System\leCpexd.exe
  C:\Windows\System\leCpexd.exe
  2⤵
  PID:7268
- C:\Windows\System\KpVfaNV.exe
  C:\Windows\System\KpVfaNV.exe
  2⤵
  PID:7316
- C:\Windows\System\lesqufs.exe
  C:\Windows\System\lesqufs.exe
  2⤵
  PID:7336
- C:\Windows\System\XpZlQgY.exe
  C:\Windows\System\XpZlQgY.exe
  2⤵
  PID:7384
- C:\Windows\System\NvBvsaP.exe
  C:\Windows\System\NvBvsaP.exe
  2⤵
  PID:7408
- C:\Windows\System\jUWCatU.exe
  C:\Windows\System\jUWCatU.exe
  2⤵
  PID:7428
- C:\Windows\System\DcwGnGG.exe
  C:\Windows\System\DcwGnGG.exe
  2⤵
  PID:7468
- C:\Windows\System\pXNnOsS.exe
  C:\Windows\System\pXNnOsS.exe
  2⤵
  PID:7484
- C:\Windows\System\wGBjdst.exe
  C:\Windows\System\wGBjdst.exe
  2⤵
  PID:7532
- C:\Windows\System\xFEqoao.exe
  C:\Windows\System\xFEqoao.exe
  2⤵
  PID:7552
- C:\Windows\System\mYEMpAr.exe
  C:\Windows\System\mYEMpAr.exe
  2⤵
  PID:7584
- C:\Windows\System\TTqJQSO.exe
  C:\Windows\System\TTqJQSO.exe
  2⤵
  PID:7608
- C:\Windows\System\QSdDyzv.exe
  C:\Windows\System\QSdDyzv.exe
  2⤵
  PID:7628
- C:\Windows\System\tQvOEhj.exe
  C:\Windows\System\tQvOEhj.exe
  2⤵
  PID:7668
- C:\Windows\System\ippXXhv.exe
  C:\Windows\System\ippXXhv.exe
  2⤵
  PID:7696
- C:\Windows\System\QHPqZKD.exe
  C:\Windows\System\QHPqZKD.exe
  2⤵
  PID:7720
- C:\Windows\System\uboqmZG.exe
  C:\Windows\System\uboqmZG.exe
  2⤵
  PID:7756
- C:\Windows\System\ZjAAtwD.exe
  C:\Windows\System\ZjAAtwD.exe
  2⤵
  PID:7784
- C:\Windows\System\iQGvtoZ.exe
  C:\Windows\System\iQGvtoZ.exe
  2⤵
  PID:7804
- C:\Windows\System\pulYgwf.exe
  C:\Windows\System\pulYgwf.exe
  2⤵
  PID:7824
- C:\Windows\System\SlBdggx.exe
  C:\Windows\System\SlBdggx.exe
  2⤵
  PID:7852
- C:\Windows\System\swluemC.exe
  C:\Windows\System\swluemC.exe
  2⤵
  PID:7872
- C:\Windows\System\WzQMtPQ.exe
  C:\Windows\System\WzQMtPQ.exe
  2⤵
  PID:7896
- C:\Windows\System\uSjypPN.exe
  C:\Windows\System\uSjypPN.exe
  2⤵
  PID:7916
- C:\Windows\System\mvzfwxQ.exe
  C:\Windows\System\mvzfwxQ.exe
  2⤵
  PID:7940
- C:\Windows\System\KpzhrAE.exe
  C:\Windows\System\KpzhrAE.exe
  2⤵
  PID:7968
- C:\Windows\System\IhfZZqr.exe
  C:\Windows\System\IhfZZqr.exe
  2⤵
  PID:7992
- C:\Windows\System\xOtDWbc.exe
  C:\Windows\System\xOtDWbc.exe
  2⤵
  PID:8072
- C:\Windows\System\BAoTwjm.exe
  C:\Windows\System\BAoTwjm.exe
  2⤵
  PID:8092
- C:\Windows\System\fOvCexA.exe
  C:\Windows\System\fOvCexA.exe
  2⤵
  PID:8128
- C:\Windows\System\SGcUJfL.exe
  C:\Windows\System\SGcUJfL.exe
  2⤵
  PID:8152
- C:\Windows\System\KtCxlEn.exe
  C:\Windows\System\KtCxlEn.exe
  2⤵
  PID:8172
- C:\Windows\System\oIzUTtq.exe
  C:\Windows\System\oIzUTtq.exe
  2⤵
  PID:6816
- C:\Windows\System\LnLYiPL.exe
  C:\Windows\System\LnLYiPL.exe
  2⤵
  PID:6476
- C:\Windows\System\KDgNzBa.exe
  C:\Windows\System\KDgNzBa.exe
  2⤵
  PID:6780
- C:\Windows\System\KyHPncN.exe
  C:\Windows\System\KyHPncN.exe
  2⤵
  PID:7308
- C:\Windows\System\XwCafpr.exe
  C:\Windows\System\XwCafpr.exe
  2⤵
  PID:7332
- C:\Windows\System\dTqZSmQ.exe
  C:\Windows\System\dTqZSmQ.exe
  2⤵
  PID:7436
- C:\Windows\System\AImDVZT.exe
  C:\Windows\System\AImDVZT.exe
  2⤵
  PID:7480
- C:\Windows\System\WGRPZhj.exe
  C:\Windows\System\WGRPZhj.exe
  2⤵
  PID:7596
- C:\Windows\System\AAknLWQ.exe
  C:\Windows\System\AAknLWQ.exe
  2⤵
  PID:7716
- C:\Windows\System\tgqufYA.exe
  C:\Windows\System\tgqufYA.exe
  2⤵
  PID:7764
- C:\Windows\System\REBgfXx.exe
  C:\Windows\System\REBgfXx.exe
  2⤵
  PID:7816
- C:\Windows\System\uBBbBgz.exe
  C:\Windows\System\uBBbBgz.exe
  2⤵
  PID:7884
- C:\Windows\System\aRPlpAJ.exe
  C:\Windows\System\aRPlpAJ.exe
  2⤵
  PID:7844
- C:\Windows\System\snYNXTn.exe
  C:\Windows\System\snYNXTn.exe
  2⤵
  PID:8008
- C:\Windows\System\eOoPBxu.exe
  C:\Windows\System\eOoPBxu.exe
  2⤵
  PID:8084
- C:\Windows\System\WqPGNTa.exe
  C:\Windows\System\WqPGNTa.exe
  2⤵
  PID:8120
- C:\Windows\System\KnAvxTJ.exe
  C:\Windows\System\KnAvxTJ.exe
  2⤵
  PID:8168
- C:\Windows\System\tKxYAHq.exe
  C:\Windows\System\tKxYAHq.exe
  2⤵
  PID:7256
- C:\Windows\System\cMaXlgs.exe
  C:\Windows\System\cMaXlgs.exe
  2⤵
  PID:7460
- C:\Windows\System\FsezVQx.exe
  C:\Windows\System\FsezVQx.exe
  2⤵
  PID:7676
- C:\Windows\System\jdYvelx.exe
  C:\Windows\System\jdYvelx.exe
  2⤵
  PID:7772
- C:\Windows\System\KPDrWSG.exe
  C:\Windows\System\KPDrWSG.exe
  2⤵
  PID:7744
- C:\Windows\System\bFaBsEL.exe
  C:\Windows\System\bFaBsEL.exe
  2⤵
  PID:8024
- C:\Windows\System\gZcrZcB.exe
  C:\Windows\System\gZcrZcB.exe
  2⤵
  PID:8148
- C:\Windows\System\QxpvXHc.exe
  C:\Windows\System\QxpvXHc.exe
  2⤵
  PID:7208
- C:\Windows\System\cWjvogH.exe
  C:\Windows\System\cWjvogH.exe
  2⤵
  PID:7864
- C:\Windows\System\EZRUAAh.exe
  C:\Windows\System\EZRUAAh.exe
  2⤵
  PID:7520
- C:\Windows\System\eHtkycX.exe
  C:\Windows\System\eHtkycX.exe
  2⤵
  PID:8268
- C:\Windows\System\AqrpJOv.exe
  C:\Windows\System\AqrpJOv.exe
  2⤵
  PID:8284
- C:\Windows\System\qjKqSYZ.exe
  C:\Windows\System\qjKqSYZ.exe
  2⤵
  PID:8300
- C:\Windows\System\gBfyBDM.exe
  C:\Windows\System\gBfyBDM.exe
  2⤵
  PID:8316
- C:\Windows\System\muSfTOk.exe
  C:\Windows\System\muSfTOk.exe
  2⤵
  PID:8332
- C:\Windows\System\AqlGLYG.exe
  C:\Windows\System\AqlGLYG.exe
  2⤵
  PID:8348
- C:\Windows\System\kBkzdUN.exe
  C:\Windows\System\kBkzdUN.exe
  2⤵
  PID:8364
- C:\Windows\System\KeQYqXs.exe
  C:\Windows\System\KeQYqXs.exe
  2⤵
  PID:8380
- C:\Windows\System\uvCYgaf.exe
  C:\Windows\System\uvCYgaf.exe
  2⤵
  PID:8396
- C:\Windows\System\yfbAfHr.exe
  C:\Windows\System\yfbAfHr.exe
  2⤵
  PID:8412
- C:\Windows\System\PPWKzKY.exe
  C:\Windows\System\PPWKzKY.exe
  2⤵
  PID:8428
- C:\Windows\System\mHuACVa.exe
  C:\Windows\System\mHuACVa.exe
  2⤵
  PID:8444
- C:\Windows\System\FPOvWjS.exe
  C:\Windows\System\FPOvWjS.exe
  2⤵
  PID:8460
- C:\Windows\System\WOoJXyQ.exe
  C:\Windows\System\WOoJXyQ.exe
  2⤵
  PID:8476
- C:\Windows\System\HElQbHA.exe
  C:\Windows\System\HElQbHA.exe
  2⤵
  PID:8492
- C:\Windows\System\xxLDoYo.exe
  C:\Windows\System\xxLDoYo.exe
  2⤵
  PID:8508
- C:\Windows\System\ZmAGHwU.exe
  C:\Windows\System\ZmAGHwU.exe
  2⤵
  PID:8548
- C:\Windows\System\hlZmRHX.exe
  C:\Windows\System\hlZmRHX.exe
  2⤵
  PID:8568
- C:\Windows\System\NLKoqVd.exe
  C:\Windows\System\NLKoqVd.exe
  2⤵
  PID:8584
- C:\Windows\System\lLpMayD.exe
  C:\Windows\System\lLpMayD.exe
  2⤵
  PID:8644
- C:\Windows\System\WPAVTQE.exe
  C:\Windows\System\WPAVTQE.exe
  2⤵
  PID:8740
- C:\Windows\System\XiQBCSQ.exe
  C:\Windows\System\XiQBCSQ.exe
  2⤵
  PID:8860
- C:\Windows\System\XkXcWPj.exe
  C:\Windows\System\XkXcWPj.exe
  2⤵
  PID:8908
- C:\Windows\System\VwYzPze.exe
  C:\Windows\System\VwYzPze.exe
  2⤵
  PID:8952
- C:\Windows\System\hjxJBYa.exe
  C:\Windows\System\hjxJBYa.exe
  2⤵
  PID:8976
- C:\Windows\System\TZWMEJU.exe
  C:\Windows\System\TZWMEJU.exe
  2⤵
  PID:9020
- C:\Windows\System\PAPReCZ.exe
  C:\Windows\System\PAPReCZ.exe
  2⤵
  PID:9048
- C:\Windows\System\EUIkYku.exe
  C:\Windows\System\EUIkYku.exe
  2⤵
  PID:9064
- C:\Windows\System\mAVDiTJ.exe
  C:\Windows\System\mAVDiTJ.exe
  2⤵
  PID:9088
- C:\Windows\System\FFejfVv.exe
  C:\Windows\System\FFejfVv.exe
  2⤵
  PID:9108
- C:\Windows\System\NSdPRyp.exe
  C:\Windows\System\NSdPRyp.exe
  2⤵
  PID:9132
- C:\Windows\System\GKzgfSa.exe
  C:\Windows\System\GKzgfSa.exe
  2⤵
  PID:9148
- C:\Windows\System\miewNJp.exe
  C:\Windows\System\miewNJp.exe
  2⤵
  PID:9168
- C:\Windows\System\VrqvfBN.exe
  C:\Windows\System\VrqvfBN.exe
  2⤵
  PID:9200
- C:\Windows\System\qQdHHFa.exe
  C:\Windows\System\qQdHHFa.exe
  2⤵
  PID:8324
- C:\Windows\System\KQPQVzm.exe
  C:\Windows\System\KQPQVzm.exe
  2⤵
  PID:7692
- C:\Windows\System\gZxXEdQ.exe
  C:\Windows\System\gZxXEdQ.exe
  2⤵
  PID:8200
- C:\Windows\System\TstoGOb.exe
  C:\Windows\System\TstoGOb.exe
  2⤵
  PID:8236
- C:\Windows\System\tjoJqbm.exe
  C:\Windows\System\tjoJqbm.exe
  2⤵
  PID:8252
- C:\Windows\System\oRQZlwv.exe
  C:\Windows\System\oRQZlwv.exe
  2⤵
  PID:8264
- C:\Windows\System\EolPvTC.exe
  C:\Windows\System\EolPvTC.exe
  2⤵
  PID:8596
- C:\Windows\System\Sathlqo.exe
  C:\Windows\System\Sathlqo.exe
  2⤵
  PID:8668
- C:\Windows\System\gDjxDfy.exe
  C:\Windows\System\gDjxDfy.exe
  2⤵
  PID:8536
- C:\Windows\System\nLrGtaK.exe
  C:\Windows\System\nLrGtaK.exe
  2⤵
  PID:8580
- C:\Windows\System\WXpsGGS.exe
  C:\Windows\System\WXpsGGS.exe
  2⤵
  PID:8752
- C:\Windows\System\CrkShZF.exe
  C:\Windows\System\CrkShZF.exe
  2⤵
  PID:8804
- C:\Windows\System\pmXzJNs.exe
  C:\Windows\System\pmXzJNs.exe
  2⤵
  PID:8944
- C:\Windows\System\nBxwqDM.exe
  C:\Windows\System\nBxwqDM.exe
  2⤵
  PID:8972
- C:\Windows\System\dBfuWqa.exe
  C:\Windows\System\dBfuWqa.exe
  2⤵
  PID:9040
- C:\Windows\System\EpSqyyw.exe
  C:\Windows\System\EpSqyyw.exe
  2⤵
  PID:9060
- C:\Windows\System\dkCVzaZ.exe
  C:\Windows\System\dkCVzaZ.exe
  2⤵
  PID:9120
- C:\Windows\System\brwXPWv.exe
  C:\Windows\System\brwXPWv.exe
  2⤵
  PID:8360
- C:\Windows\System\CYIQaYM.exe
  C:\Windows\System\CYIQaYM.exe
  2⤵
  PID:8308
- C:\Windows\System\XkDlzPI.exe
  C:\Windows\System\XkDlzPI.exe
  2⤵
  PID:8516
- C:\Windows\System\UcCYuHZ.exe
  C:\Windows\System\UcCYuHZ.exe
  2⤵
  PID:8388
- C:\Windows\System\jGnhANK.exe
  C:\Windows\System\jGnhANK.exe
  2⤵
  PID:3300
- C:\Windows\System\IgXvGhq.exe
  C:\Windows\System\IgXvGhq.exe
  2⤵
  PID:8632
- C:\Windows\System\qsqGdye.exe
  C:\Windows\System\qsqGdye.exe
  2⤵
  PID:8928
- C:\Windows\System\cHiHiKL.exe
  C:\Windows\System\cHiHiKL.exe
  2⤵
  PID:9004
- C:\Windows\System\xQJOLnp.exe
  C:\Windows\System\xQJOLnp.exe
  2⤵
  PID:9104
- C:\Windows\System\JbYwcNR.exe
  C:\Windows\System\JbYwcNR.exe
  2⤵
  PID:8500
- C:\Windows\System\GLdOmTR.exe
  C:\Windows\System\GLdOmTR.exe
  2⤵
  PID:3832
- C:\Windows\System\aWZtdSt.exe
  C:\Windows\System\aWZtdSt.exe
  2⤵
  PID:8992
- C:\Windows\System\MmDrhki.exe
  C:\Windows\System\MmDrhki.exe
  2⤵
  PID:8256
- C:\Windows\System\hJFnTSi.exe
  C:\Windows\System\hJFnTSi.exe
  2⤵
  PID:3728
- C:\Windows\System\YNzrkut.exe
  C:\Windows\System\YNzrkut.exe
  2⤵
  PID:9076
- C:\Windows\System\PiIWeXz.exe
  C:\Windows\System\PiIWeXz.exe
  2⤵
  PID:9236
- C:\Windows\System\EVeVnfN.exe
  C:\Windows\System\EVeVnfN.exe
  2⤵
  PID:9256
- C:\Windows\System\BAKUcqG.exe
  C:\Windows\System\BAKUcqG.exe
  2⤵
  PID:9280
- C:\Windows\System\EoPsMwr.exe
  C:\Windows\System\EoPsMwr.exe
  2⤵
  PID:9300
- C:\Windows\System\VmrpSVu.exe
  C:\Windows\System\VmrpSVu.exe
  2⤵
  PID:9340
- C:\Windows\System\lywOVpt.exe
  C:\Windows\System\lywOVpt.exe
  2⤵
  PID:9368
- C:\Windows\System\LEdrouG.exe
  C:\Windows\System\LEdrouG.exe
  2⤵
  PID:9388
- C:\Windows\System\bYWvAwK.exe
  C:\Windows\System\bYWvAwK.exe
  2⤵
  PID:9416
- C:\Windows\System\lSFDMkh.exe
  C:\Windows\System\lSFDMkh.exe
  2⤵
  PID:9436
- C:\Windows\System\BaYQOPs.exe
  C:\Windows\System\BaYQOPs.exe
  2⤵
  PID:9456
- C:\Windows\System\xlwSMGQ.exe
  C:\Windows\System\xlwSMGQ.exe
  2⤵
  PID:9492
- C:\Windows\System\PYFEAKL.exe
  C:\Windows\System\PYFEAKL.exe
  2⤵
  PID:9524
- C:\Windows\System\EhGdBXN.exe
  C:\Windows\System\EhGdBXN.exe
  2⤵
  PID:9556
- C:\Windows\System\DRgPaJJ.exe
  C:\Windows\System\DRgPaJJ.exe
  2⤵
  PID:9592
- C:\Windows\System\toxveEQ.exe
  C:\Windows\System\toxveEQ.exe
  2⤵
  PID:9640
- C:\Windows\System\uRiIzvJ.exe
  C:\Windows\System\uRiIzvJ.exe
  2⤵
  PID:9664
- C:\Windows\System\DeYdHmw.exe
  C:\Windows\System\DeYdHmw.exe
  2⤵
  PID:9692
- C:\Windows\System\wmpbrfK.exe
  C:\Windows\System\wmpbrfK.exe
  2⤵
  PID:9712
- C:\Windows\System\HDJmrZE.exe
  C:\Windows\System\HDJmrZE.exe
  2⤵
  PID:9732
- C:\Windows\System\AISRhkj.exe
  C:\Windows\System\AISRhkj.exe
  2⤵
  PID:9760
- C:\Windows\System\WGvpsYR.exe
  C:\Windows\System\WGvpsYR.exe
  2⤵
  PID:9784
- C:\Windows\System\hMLrweg.exe
  C:\Windows\System\hMLrweg.exe
  2⤵
  PID:9828
- C:\Windows\System\uLoNOpl.exe
  C:\Windows\System\uLoNOpl.exe
  2⤵
  PID:9852
- C:\Windows\System\YaIZtMa.exe
  C:\Windows\System\YaIZtMa.exe
  2⤵
  PID:9868
- C:\Windows\System\zfHpqzI.exe
  C:\Windows\System\zfHpqzI.exe
  2⤵
  PID:9916
- C:\Windows\System\qfYuXwT.exe
  C:\Windows\System\qfYuXwT.exe
  2⤵
  PID:9936
- C:\Windows\System\jzLVOew.exe
  C:\Windows\System\jzLVOew.exe
  2⤵
  PID:9976
- C:\Windows\System\WjPOZdv.exe
  C:\Windows\System\WjPOZdv.exe
  2⤵
  PID:9996
- C:\Windows\System\VxTYhPk.exe
  C:\Windows\System\VxTYhPk.exe
  2⤵
  PID:10036
- C:\Windows\System\CTiDMmB.exe
  C:\Windows\System\CTiDMmB.exe
  2⤵
  PID:10052
- C:\Windows\System\xuCdkaw.exe
  C:\Windows\System\xuCdkaw.exe
  2⤵
  PID:10080
- C:\Windows\System\xSdaonO.exe
  C:\Windows\System\xSdaonO.exe
  2⤵
  PID:10100
- C:\Windows\System\sQOdQTs.exe
  C:\Windows\System\sQOdQTs.exe
  2⤵
  PID:10124
- C:\Windows\System\koqJGPg.exe
  C:\Windows\System\koqJGPg.exe
  2⤵
  PID:10156
- C:\Windows\System\tKyGshP.exe
  C:\Windows\System\tKyGshP.exe
  2⤵
  PID:10176
- C:\Windows\System\QwDnFhR.exe
  C:\Windows\System\QwDnFhR.exe
  2⤵
  PID:10204
- C:\Windows\System\eFGgQie.exe
  C:\Windows\System\eFGgQie.exe
  2⤵
  PID:10228
- C:\Windows\System\DqbRSEU.exe
  C:\Windows\System\DqbRSEU.exe
  2⤵
  PID:3916
- C:\Windows\System\chtivgT.exe
  C:\Windows\System\chtivgT.exe
  2⤵
  PID:9252
- C:\Windows\System\oWsnEDQ.exe
  C:\Windows\System\oWsnEDQ.exe
  2⤵
  PID:3272
- C:\Windows\System\wZTafaV.exe
  C:\Windows\System\wZTafaV.exe
  2⤵
  PID:9428
- C:\Windows\System\Jobbyis.exe
  C:\Windows\System\Jobbyis.exe
  2⤵
  PID:9484
- C:\Windows\System\JRVYZjz.exe
  C:\Windows\System\JRVYZjz.exe
  2⤵
  PID:9488
- C:\Windows\System\lVjwaJa.exe
  C:\Windows\System\lVjwaJa.exe
  2⤵
  PID:9548
- C:\Windows\System\whlOSln.exe
  C:\Windows\System\whlOSln.exe
  2⤵
  PID:9620
- C:\Windows\System\fEcMHtP.exe
  C:\Windows\System\fEcMHtP.exe
  2⤵
  PID:9672
- C:\Windows\System\BdHZvMi.exe
  C:\Windows\System\BdHZvMi.exe
  2⤵
  PID:9756
- C:\Windows\System\lOlIUvq.exe
  C:\Windows\System\lOlIUvq.exe
  2⤵
  PID:9840
- C:\Windows\System\zBwVWSo.exe
  C:\Windows\System\zBwVWSo.exe
  2⤵
  PID:9972
- C:\Windows\System\UMUgXzj.exe
  C:\Windows\System\UMUgXzj.exe
  2⤵
  PID:9984
- C:\Windows\System\FbaMlBZ.exe
  C:\Windows\System\FbaMlBZ.exe
  2⤵
  PID:10072
- C:\Windows\System\GwVyrof.exe
  C:\Windows\System\GwVyrof.exe
  2⤵
  PID:10120
- C:\Windows\System\VDcDhCn.exe
  C:\Windows\System\VDcDhCn.exe
  2⤵
  PID:10212
- C:\Windows\System\ImynrzR.exe
  C:\Windows\System\ImynrzR.exe
  2⤵
  PID:9348
- C:\Windows\System\UbHUbeH.exe
  C:\Windows\System\UbHUbeH.exe
  2⤵
  PID:9376
- C:\Windows\System\gIFCVpt.exe
  C:\Windows\System\gIFCVpt.exe
  2⤵
  PID:468
- C:\Windows\System\beTraIE.exe
  C:\Windows\System\beTraIE.exe
  2⤵
  PID:9540
- C:\Windows\System\yDThwtN.exe
  C:\Windows\System\yDThwtN.exe
  2⤵
  PID:9780
- C:\Windows\System\ZPUsohf.exe
  C:\Windows\System\ZPUsohf.exe
  2⤵
  PID:9888
- C:\Windows\System\ZMTiUIn.exe
  C:\Windows\System\ZMTiUIn.exe
  2⤵
  PID:1296
- C:\Windows\System\jvwxcui.exe
  C:\Windows\System\jvwxcui.exe
  2⤵
  PID:10144
- C:\Windows\System\vWDyWZM.exe
  C:\Windows\System\vWDyWZM.exe
  2⤵
  PID:10224
- C:\Windows\System\UnoGMIE.exe
  C:\Windows\System\UnoGMIE.exe
  2⤵
  PID:9572
- C:\Windows\System\gJobqBp.exe
  C:\Windows\System\gJobqBp.exe
  2⤵
  PID:9928
- C:\Windows\System\JRYSAfN.exe
  C:\Windows\System\JRYSAfN.exe
  2⤵
  PID:10020
- C:\Windows\System\xHatXrs.exe
  C:\Windows\System\xHatXrs.exe
  2⤵
  PID:3560
- C:\Windows\System\gPrenJa.exe
  C:\Windows\System\gPrenJa.exe
  2⤵
  PID:9648
- C:\Windows\System\CqQttxh.exe
  C:\Windows\System\CqQttxh.exe
  2⤵
  PID:10264
- C:\Windows\System\qcTxNSy.exe
  C:\Windows\System\qcTxNSy.exe
  2⤵
  PID:10284
- C:\Windows\System\lYRBEoL.exe
  C:\Windows\System\lYRBEoL.exe
  2⤵
  PID:10336
- C:\Windows\System\aBSjcbF.exe
  C:\Windows\System\aBSjcbF.exe
  2⤵
  PID:10360
- C:\Windows\System\viqwWtz.exe
  C:\Windows\System\viqwWtz.exe
  2⤵
  PID:10396
- C:\Windows\System\pnyXlrT.exe
  C:\Windows\System\pnyXlrT.exe
  2⤵
  PID:10416
- C:\Windows\System\PjnzQtZ.exe
  C:\Windows\System\PjnzQtZ.exe
  2⤵
  PID:10444
- C:\Windows\System\ksLjQYc.exe
  C:\Windows\System\ksLjQYc.exe
  2⤵
  PID:10472
- C:\Windows\System\BqRPpqr.exe
  C:\Windows\System\BqRPpqr.exe
  2⤵
  PID:10496
- C:\Windows\System\ZSEHcWq.exe
  C:\Windows\System\ZSEHcWq.exe
  2⤵
  PID:10520
- C:\Windows\System\ZYQPjEf.exe
  C:\Windows\System\ZYQPjEf.exe
  2⤵
  PID:10540
- C:\Windows\System\qdtRApQ.exe
  C:\Windows\System\qdtRApQ.exe
  2⤵
  PID:10568
- C:\Windows\System\XKnzKCj.exe
  C:\Windows\System\XKnzKCj.exe
  2⤵
  PID:10584
- C:\Windows\System\uIVTTMT.exe
  C:\Windows\System\uIVTTMT.exe
  2⤵
  PID:10608
- C:\Windows\System\KqGouUL.exe
  C:\Windows\System\KqGouUL.exe
  2⤵
  PID:10628
- C:\Windows\System\wtnVgli.exe
  C:\Windows\System\wtnVgli.exe
  2⤵
  PID:10648
- C:\Windows\System\oeYALwC.exe
  C:\Windows\System\oeYALwC.exe
  2⤵
  PID:10680
- C:\Windows\System\XuntAtW.exe
  C:\Windows\System\XuntAtW.exe
  2⤵
  PID:10696
- C:\Windows\System\CiCjNjb.exe
  C:\Windows\System\CiCjNjb.exe
  2⤵
  PID:10720
- C:\Windows\System\dmNmnYw.exe
  C:\Windows\System\dmNmnYw.exe
  2⤵
  PID:10792
- C:\Windows\System\UlfNsXH.exe
  C:\Windows\System\UlfNsXH.exe
  2⤵
  PID:10816
- C:\Windows\System\daWAWZY.exe
  C:\Windows\System\daWAWZY.exe
  2⤵
  PID:10868
- C:\Windows\System\rUeWVsP.exe
  C:\Windows\System\rUeWVsP.exe
  2⤵
  PID:10892
- C:\Windows\System\TPFpanZ.exe
  C:\Windows\System\TPFpanZ.exe
  2⤵
  PID:10944
- C:\Windows\System\orPSfzv.exe
  C:\Windows\System\orPSfzv.exe
  2⤵
  PID:10960
- C:\Windows\System\glqzubC.exe
  C:\Windows\System\glqzubC.exe
  2⤵
  PID:10984
- C:\Windows\System\XznyooZ.exe
  C:\Windows\System\XznyooZ.exe
  2⤵
  PID:11008
- C:\Windows\System\SgQyrnD.exe
  C:\Windows\System\SgQyrnD.exe
  2⤵
  PID:11036
- C:\Windows\System\lHhDGbm.exe
  C:\Windows\System\lHhDGbm.exe
  2⤵
  PID:11060
- C:\Windows\System\HUiHxlO.exe
  C:\Windows\System\HUiHxlO.exe
  2⤵
  PID:11100
- C:\Windows\System\fQmpFWR.exe
  C:\Windows\System\fQmpFWR.exe
  2⤵
  PID:11120
- C:\Windows\System\uwHISol.exe
  C:\Windows\System\uwHISol.exe
  2⤵
  PID:11152
- C:\Windows\System\PkLjwQk.exe
  C:\Windows\System\PkLjwQk.exe
  2⤵
  PID:11176
- C:\Windows\System\izYZXkK.exe
  C:\Windows\System\izYZXkK.exe
  2⤵
  PID:11200
- C:\Windows\System\UOYVjVm.exe
  C:\Windows\System\UOYVjVm.exe
  2⤵
  PID:11216
- C:\Windows\System\VQcSbRl.exe
  C:\Windows\System\VQcSbRl.exe
  2⤵
  PID:11236
- C:\Windows\System\zGArGaK.exe
  C:\Windows\System\zGArGaK.exe
  2⤵
  PID:10260
- C:\Windows\System\jWKHMlN.exe
  C:\Windows\System\jWKHMlN.exe
  2⤵
  PID:10352
- C:\Windows\System\zVprNBs.exe
  C:\Windows\System\zVprNBs.exe
  2⤵
  PID:10404
- C:\Windows\System\UUuuVOb.exe
  C:\Windows\System\UUuuVOb.exe
  2⤵
  PID:10484
- C:\Windows\System\eDBLbqF.exe
  C:\Windows\System\eDBLbqF.exe
  2⤵
  PID:10508
- C:\Windows\System\TNjEIsh.exe
  C:\Windows\System\TNjEIsh.exe
  2⤵
  PID:10532
- C:\Windows\System\hDdcRxc.exe
  C:\Windows\System\hDdcRxc.exe
  2⤵
  PID:10716
- C:\Windows\System\nzGFDzi.exe
  C:\Windows\System\nzGFDzi.exe
  2⤵
  PID:10760
- C:\Windows\System\pIwlYDH.exe
  C:\Windows\System\pIwlYDH.exe
  2⤵
  PID:10788
- C:\Windows\System\wIUhwGg.exe
  C:\Windows\System\wIUhwGg.exe
  2⤵
  PID:10812
- C:\Windows\System\YjtNkCV.exe
  C:\Windows\System\YjtNkCV.exe
  2⤵
  PID:10920
- C:\Windows\System\oDoWphM.exe
  C:\Windows\System\oDoWphM.exe
  2⤵
  PID:11024
- C:\Windows\System\yrWMgxO.exe
  C:\Windows\System\yrWMgxO.exe
  2⤵
  PID:11088
- C:\Windows\System\DvDDKsf.exe
  C:\Windows\System\DvDDKsf.exe
  2⤵
  PID:11116
- C:\Windows\System\rmQemzE.exe
  C:\Windows\System\rmQemzE.exe
  2⤵
  PID:11196
- C:\Windows\System\eeiQbtV.exe
  C:\Windows\System\eeiQbtV.exe
  2⤵
  PID:10248
- C:\Windows\System\XBzBrDk.exe
  C:\Windows\System\XBzBrDk.exe
  2⤵
  PID:9520
- C:\Windows\System\QIwaJHO.exe
  C:\Windows\System\QIwaJHO.exe
  2⤵
  PID:10344
- C:\Windows\System\HYfCuRE.exe
  C:\Windows\System\HYfCuRE.exe
  2⤵
  PID:10464
- C:\Windows\System\BLhiSEL.exe
  C:\Windows\System\BLhiSEL.exe
  2⤵
  PID:10644
- C:\Windows\System\KAhyauC.exe
  C:\Windows\System\KAhyauC.exe
  2⤵
  PID:10800
- C:\Windows\System\HhHrQKF.exe
  C:\Windows\System\HhHrQKF.exe
  2⤵
  PID:10952
- C:\Windows\System\raqlmzi.exe
  C:\Windows\System\raqlmzi.exe
  2⤵
  PID:11144
- C:\Windows\System\iraxsEU.exe
  C:\Windows\System\iraxsEU.exe
  2⤵
  PID:11212
- C:\Windows\System\baKlxjU.exe
  C:\Windows\System\baKlxjU.exe
  2⤵
  PID:10552
- C:\Windows\System\NWDGDhQ.exe
  C:\Windows\System\NWDGDhQ.exe
  2⤵
  PID:10148
- C:\Windows\System\hmmwlxa.exe
  C:\Windows\System\hmmwlxa.exe
  2⤵
  PID:10488
- C:\Windows\System\HTcDggm.exe
  C:\Windows\System\HTcDggm.exe
  2⤵
  PID:11280
- C:\Windows\System\imnDlTo.exe
  C:\Windows\System\imnDlTo.exe
  2⤵
  PID:11300
- C:\Windows\System\aPkLNqR.exe
  C:\Windows\System\aPkLNqR.exe
  2⤵
  PID:11320
- C:\Windows\System\TCCzKLN.exe
  C:\Windows\System\TCCzKLN.exe
  2⤵
  PID:11344
- C:\Windows\System\KsHHsxV.exe
  C:\Windows\System\KsHHsxV.exe
  2⤵
  PID:11408
- C:\Windows\System\PdOvOga.exe
  C:\Windows\System\PdOvOga.exe
  2⤵
  PID:11432
- C:\Windows\System\aEuINvV.exe
  C:\Windows\System\aEuINvV.exe
  2⤵
  PID:11456
- C:\Windows\System\ldTAkml.exe
  C:\Windows\System\ldTAkml.exe
  2⤵
  PID:11492
- C:\Windows\System\jDiiBBv.exe
  C:\Windows\System\jDiiBBv.exe
  2⤵
  PID:11520
- C:\Windows\System\kbMaOcs.exe
  C:\Windows\System\kbMaOcs.exe
  2⤵
  PID:11536
- C:\Windows\System\iZXUBhp.exe
  C:\Windows\System\iZXUBhp.exe
  2⤵
  PID:11572
- C:\Windows\System\qijztLh.exe
  C:\Windows\System\qijztLh.exe
  2⤵
  PID:11600
- C:\Windows\System\hRfqyTo.exe
  C:\Windows\System\hRfqyTo.exe
  2⤵
  PID:11624
- C:\Windows\System\rVZNuUL.exe
  C:\Windows\System\rVZNuUL.exe
  2⤵
  PID:11668
- C:\Windows\System\YVpNkoX.exe
  C:\Windows\System\YVpNkoX.exe
  2⤵
  PID:11712
- C:\Windows\System\sPTXaTm.exe
  C:\Windows\System\sPTXaTm.exe
  2⤵
  PID:11732
- C:\Windows\System\hnxCYUz.exe
  C:\Windows\System\hnxCYUz.exe
  2⤵
  PID:11748
- C:\Windows\System\FeQImUm.exe
  C:\Windows\System\FeQImUm.exe
  2⤵
  PID:11776
- C:\Windows\System\pGISWEm.exe
  C:\Windows\System\pGISWEm.exe
  2⤵
  PID:11800
- C:\Windows\System\irDzVZn.exe
  C:\Windows\System\irDzVZn.exe
  2⤵
  PID:11816
- C:\Windows\System\CIdzkXB.exe
  C:\Windows\System\CIdzkXB.exe
  2⤵
  PID:11872
- C:\Windows\System\swKHBRz.exe
  C:\Windows\System\swKHBRz.exe
  2⤵
  PID:11900
- C:\Windows\System\lsUMNRg.exe
  C:\Windows\System\lsUMNRg.exe
  2⤵
  PID:11924
- C:\Windows\System\zNnkgCl.exe
  C:\Windows\System\zNnkgCl.exe
  2⤵
  PID:11944
- C:\Windows\System\vIdEhIB.exe
  C:\Windows\System\vIdEhIB.exe
  2⤵
  PID:11972
- C:\Windows\System\YjhOQKY.exe
  C:\Windows\System\YjhOQKY.exe
  2⤵
  PID:12004
- C:\Windows\System\CuaBVzn.exe
  C:\Windows\System\CuaBVzn.exe
  2⤵
  PID:12112
- C:\Windows\System\aiDtQnW.exe
  C:\Windows\System\aiDtQnW.exe
  2⤵
  PID:12132
- C:\Windows\System\UulAJFH.exe
  C:\Windows\System\UulAJFH.exe
  2⤵
  PID:12172
- C:\Windows\System\oJdKCbV.exe
  C:\Windows\System\oJdKCbV.exe
  2⤵
  PID:12192
- C:\Windows\System\DfwxVhB.exe
  C:\Windows\System\DfwxVhB.exe
  2⤵
  PID:12220
- C:\Windows\System\tSTmewA.exe
  C:\Windows\System\tSTmewA.exe
  2⤵
  PID:12236
- C:\Windows\System\bycnFOV.exe
  C:\Windows\System\bycnFOV.exe
  2⤵
  PID:3312
- C:\Windows\System\jiZeCdn.exe
  C:\Windows\System\jiZeCdn.exe
  2⤵
  PID:11296
- C:\Windows\System\CnvYYKk.exe
  C:\Windows\System\CnvYYKk.exe
  2⤵
  PID:11360
- C:\Windows\System\LFHWbXo.exe
  C:\Windows\System\LFHWbXo.exe
  2⤵
  PID:11380
- C:\Windows\System\NbmpaEf.exe
  C:\Windows\System\NbmpaEf.exe
  2⤵
  PID:11452
- C:\Windows\System\JIkKhpz.exe
  C:\Windows\System\JIkKhpz.exe
  2⤵
  PID:11568
- C:\Windows\System\fSTTcee.exe
  C:\Windows\System\fSTTcee.exe
  2⤵
  PID:11592
- C:\Windows\System\FkSlZfP.exe
  C:\Windows\System\FkSlZfP.exe
  2⤵
  PID:11696
- C:\Windows\System\bhDDrhB.exe
  C:\Windows\System\bhDDrhB.exe
  2⤵
  PID:3676
- C:\Windows\System\EnBSDMc.exe
  C:\Windows\System\EnBSDMc.exe
  2⤵
  PID:11796
- C:\Windows\System\hOqbbOR.exe
  C:\Windows\System\hOqbbOR.exe
  2⤵
  PID:2500
- C:\Windows\System\wpVMmZg.exe
  C:\Windows\System\wpVMmZg.exe
  2⤵
  PID:11808
- C:\Windows\System\nlwUfon.exe
  C:\Windows\System\nlwUfon.exe
  2⤵
  PID:11864
- C:\Windows\System\RnFLJfq.exe
  C:\Windows\System\RnFLJfq.exe
  2⤵
  PID:11912
- C:\Windows\System\ynDFCxY.exe
  C:\Windows\System\ynDFCxY.exe
  2⤵
  PID:11956
- C:\Windows\System\YzfPvRW.exe
  C:\Windows\System\YzfPvRW.exe
  2⤵
  PID:12044
- C:\Windows\System\WJruDHq.exe
  C:\Windows\System\WJruDHq.exe
  2⤵
  PID:11992
- C:\Windows\System\QxFyEBv.exe
  C:\Windows\System\QxFyEBv.exe
  2⤵
  PID:12160
- C:\Windows\System\somCQhW.exe
  C:\Windows\System\somCQhW.exe
  2⤵
  PID:12100
- C:\Windows\System\TBQkorf.exe
  C:\Windows\System\TBQkorf.exe
  2⤵
  PID:12068
- C:\Windows\System\tMXBAZQ.exe
  C:\Windows\System\tMXBAZQ.exe
  2⤵
  PID:12164
- C:\Windows\System\lnnyOtE.exe
  C:\Windows\System\lnnyOtE.exe
  2⤵
  PID:12272
- C:\Windows\System\eFOasnJ.exe
  C:\Windows\System\eFOasnJ.exe
  2⤵
  PID:12276
- C:\Windows\System\wGzlGFV.exe
  C:\Windows\System\wGzlGFV.exe
  2⤵
  PID:11564
- C:\Windows\System\JRTBZzG.exe
  C:\Windows\System\JRTBZzG.exe
  2⤵
  PID:11664
- C:\Windows\System\FrYSvOV.exe
  C:\Windows\System\FrYSvOV.exe
  2⤵
  PID:11828
- C:\Windows\System\YBbbSFH.exe
  C:\Windows\System\YBbbSFH.exe
  2⤵
  PID:5116
- C:\Windows\System\EpLUaHB.exe
  C:\Windows\System\EpLUaHB.exe
  2⤵
  PID:11892
- C:\Windows\System\BWGJMpw.exe
  C:\Windows\System\BWGJMpw.exe
  2⤵
  PID:12056
- C:\Windows\System\ehgNKou.exe
  C:\Windows\System\ehgNKou.exe
  2⤵
  PID:10940
- C:\Windows\System\GCAuhPv.exe
  C:\Windows\System\GCAuhPv.exe
  2⤵
  PID:11620
- C:\Windows\System\BzbtcfL.exe
  C:\Windows\System\BzbtcfL.exe
  2⤵
  PID:11656
- C:\Windows\System\pFKpOtP.exe
  C:\Windows\System\pFKpOtP.exe
  2⤵
  PID:11852
- C:\Windows\System\veVBpqo.exe
  C:\Windows\System\veVBpqo.exe
  2⤵
  PID:3492
- C:\Windows\System\uHyLLZv.exe
  C:\Windows\System\uHyLLZv.exe
  2⤵
  PID:12124
- C:\Windows\System\zTdtlEQ.exe
  C:\Windows\System\zTdtlEQ.exe
  2⤵
  PID:11500
- C:\Windows\System\oLCyftG.exe
  C:\Windows\System\oLCyftG.exe
  2⤵
  PID:4188
- C:\Windows\System\XtzIkKJ.exe
  C:\Windows\System\XtzIkKJ.exe
  2⤵
  PID:12316
- C:\Windows\System\RkldUUI.exe
  C:\Windows\System\RkldUUI.exe
  2⤵
  PID:12344
- C:\Windows\System\jYLCVdz.exe
  C:\Windows\System\jYLCVdz.exe
  2⤵
  PID:12372
- C:\Windows\System\pIybcld.exe
  C:\Windows\System\pIybcld.exe
  2⤵
  PID:12392
- C:\Windows\System\pbuROrV.exe
  C:\Windows\System\pbuROrV.exe
  2⤵
  PID:12416
- C:\Windows\System\KRWfrvu.exe
  C:\Windows\System\KRWfrvu.exe
  2⤵
  PID:12432
- C:\Windows\System\AcUTdIl.exe
  C:\Windows\System\AcUTdIl.exe
  2⤵
  PID:12456
- C:\Windows\System\JoooEWd.exe
  C:\Windows\System\JoooEWd.exe
  2⤵
  PID:12480
- C:\Windows\System\LRgRAdF.exe
  C:\Windows\System\LRgRAdF.exe
  2⤵
  PID:12504
- C:\Windows\System\qhLYYoc.exe
  C:\Windows\System\qhLYYoc.exe
  2⤵
  PID:12532
- C:\Windows\System\amdEzBl.exe
  C:\Windows\System\amdEzBl.exe
  2⤵
  PID:12552
- C:\Windows\System\tLclYrC.exe
  C:\Windows\System\tLclYrC.exe
  2⤵
  PID:12616
- C:\Windows\System\DOegQCT.exe
  C:\Windows\System\DOegQCT.exe
  2⤵
  PID:12636
- C:\Windows\System\WQGuVbw.exe
  C:\Windows\System\WQGuVbw.exe
  2⤵
  PID:12656
- C:\Windows\System\rsvwWtn.exe
  C:\Windows\System\rsvwWtn.exe
  2⤵
  PID:12672
- C:\Windows\System\kZwLYMC.exe
  C:\Windows\System\kZwLYMC.exe
  2⤵
  PID:12736
- C:\Windows\System\UEaWHSp.exe
  C:\Windows\System\UEaWHSp.exe
  2⤵
  PID:12760
- C:\Windows\System\yEEgbNZ.exe
  C:\Windows\System\yEEgbNZ.exe
  2⤵
  PID:12780
- C:\Windows\System\UvKFYsK.exe
  C:\Windows\System\UvKFYsK.exe
  2⤵
  PID:12804
- C:\Windows\System\yCNxNcj.exe
  C:\Windows\System\yCNxNcj.exe
  2⤵
  PID:12832
- C:\Windows\System\KGWamup.exe
  C:\Windows\System\KGWamup.exe
  2⤵
  PID:12864
- C:\Windows\System\YQfEWJi.exe
  C:\Windows\System\YQfEWJi.exe
  2⤵
  PID:12896
- C:\Windows\System\mJGAoLf.exe
  C:\Windows\System\mJGAoLf.exe
  2⤵
  PID:12916
- C:\Windows\System\srRdaQr.exe
  C:\Windows\System\srRdaQr.exe
  2⤵
  PID:12964
- C:\Windows\System\HLdcIWO.exe
  C:\Windows\System\HLdcIWO.exe
  2⤵
  PID:12988
- C:\Windows\System\lkJbJGp.exe
  C:\Windows\System\lkJbJGp.exe
  2⤵
  PID:13016
- C:\Windows\System\mJsWkZy.exe
  C:\Windows\System\mJsWkZy.exe
  2⤵
  PID:13036
- C:\Windows\System\TDHBzjg.exe
  C:\Windows\System\TDHBzjg.exe
  2⤵
  PID:13052
- C:\Windows\System\VrqiAPW.exe
  C:\Windows\System\VrqiAPW.exe
  2⤵
  PID:13100
- C:\Windows\System\OEPNPyN.exe
  C:\Windows\System\OEPNPyN.exe
  2⤵
  PID:13120
- C:\Windows\System\TzSCLDI.exe
  C:\Windows\System\TzSCLDI.exe
  2⤵
  PID:13140
- C:\Windows\System\VyCtpsK.exe
  C:\Windows\System\VyCtpsK.exe
  2⤵
  PID:13160
- C:\Windows\System\KHdihXL.exe
  C:\Windows\System\KHdihXL.exe
  2⤵
  PID:13188
- C:\Windows\System\pGzwLUv.exe
  C:\Windows\System\pGzwLUv.exe
  2⤵
  PID:13204
- C:\Windows\System\KzlQvwc.exe
  C:\Windows\System\KzlQvwc.exe
  2⤵
  PID:13224
- C:\Windows\System\VuJRHre.exe
  C:\Windows\System\VuJRHre.exe
  2⤵
  PID:13260
- C:\Windows\System\MbbOvXz.exe
  C:\Windows\System\MbbOvXz.exe
  2⤵
  PID:13280
- C:\Windows\System\XYOxAbU.exe
  C:\Windows\System\XYOxAbU.exe
  2⤵
  PID:11332
- C:\Windows\System\FqbVvKa.exe
  C:\Windows\System\FqbVvKa.exe
  2⤵
  PID:12336
- C:\Windows\System\ImswyFc.exe
  C:\Windows\System\ImswyFc.exe
  2⤵
  PID:12428
- C:\Windows\System\ZzyAsdE.exe
  C:\Windows\System\ZzyAsdE.exe
  2⤵
  PID:12500
- C:\Windows\System\FEstAsN.exe
  C:\Windows\System\FEstAsN.exe
  2⤵
  PID:12576
- C:\Windows\System\jopDPvS.exe
  C:\Windows\System\jopDPvS.exe
  2⤵
  PID:12628
- C:\Windows\System\obiEHxL.exe
  C:\Windows\System\obiEHxL.exe
  2⤵
  PID:12692
- C:\Windows\System\jSfbENI.exe
  C:\Windows\System\jSfbENI.exe
  2⤵
  PID:12756
- C:\Windows\System\xaybcqr.exe
  C:\Windows\System\xaybcqr.exe
  2⤵
  PID:12856
- C:\Windows\System\RzzjCRQ.exe
  C:\Windows\System\RzzjCRQ.exe
  2⤵
  PID:12908
- C:\Windows\System\DVvCbKX.exe
  C:\Windows\System\DVvCbKX.exe
  2⤵
  PID:12944
- C:\Windows\System\SWrJbCk.exe
  C:\Windows\System\SWrJbCk.exe
  2⤵
  PID:12996
- C:\Windows\System\GpoGTow.exe
  C:\Windows\System\GpoGTow.exe
  2⤵
  PID:13012
- C:\Windows\System\cBkavse.exe
  C:\Windows\System\cBkavse.exe
  2⤵
  PID:13152
- C:\Windows\System\MsdzmQE.exe
  C:\Windows\System\MsdzmQE.exe
  2⤵
  PID:13244
- C:\Windows\System\mOLWQql.exe
  C:\Windows\System\mOLWQql.exe
  2⤵
  PID:13288
- C:\Windows\System\bspSsRw.exe
  C:\Windows\System\bspSsRw.exe
  2⤵
  PID:4516
- C:\Windows\System\SZdNxKy.exe
  C:\Windows\System\SZdNxKy.exe
  2⤵
  PID:440
- C:\Windows\System\ODGSRMv.exe
  C:\Windows\System\ODGSRMv.exe
  2⤵
  PID:60
- C:\Windows\System\FyHopYL.exe
  C:\Windows\System\FyHopYL.exe
  2⤵
  PID:13072
- C:\Windows\System\trjMGcL.exe
  C:\Windows\System\trjMGcL.exe
  2⤵
  PID:13108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_435pd11f.e1e.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\DiAvBoM.exe

Filesize
1.8MB

MD5
cdab1267505a557c24e5086a7d4a8c06

SHA1
cf1f60a508da3f21f62eda5be527f6ab47583dbb

SHA256
122cf2066acae7d05dee600f24e2a440ffa2f889a0086aa17146fc558ce753c3

SHA512
186cdb526ff15dc981aa76f7aab213a1ad600ad957117ea4b58d583e7f748271541d29137d5c19917a2c25b3840b417aea3a9de1452b4ffc1694c9d57045028b

Download Submit
C:\Windows\System\EhYTrzX.exe

Filesize
1.8MB

MD5
71ce262a640b030d0a54f66528b65ddb

SHA1
967fe340c45a89a249d567b670b8eb37ee1f2d57

SHA256
91446dabfd215093795121b17ba6dd8132150ac5441dcb41d74477816215c8af

SHA512
5dc0d920a97a0bca3b4691db387e3b9b0e560464b5f91a09a5d98bd983771f8e843edd3e78535fb397d6465d331d7138c2a0ed883d5316f87f9554caac061893

Download Submit
C:\Windows\System\HwEtGco.exe

Filesize
1.8MB

MD5
50e6bb05e719e22936c2d391c8a3cc21

SHA1
438449e4b2ce48b010f38ae63bc953d96485cb41

SHA256
1b30099a2db9ed0cc8f2b7a3c56843f688c386a72bbf84dc663c472c33dbeead

SHA512
14ad1a811c4e4600b5dbefcc1d488348bd3b7b905823df4d72786ad14a553309639a266b02290c9491c4d0634c95c974db81dc8c7f4fa8e7be1e0584207c4774

Download Submit
C:\Windows\System\JLkjhxq.exe

Filesize
1.8MB

MD5
85cce1911620968f5990b16d0eeb456a

SHA1
d921a6216641f3764cc76fa49e3ac683b167acd6

SHA256
4600ac6ae847034c8fbb10095bb065e382f4e49c18bb7ce664c884739e28ec1c

SHA512
d3aae818e01cbc1a4a734258569c973646ab0ea952856b476faa6f7b155ef4836c5d6fadaf1f9814fb2366bf3f4d9d7a5ceb8a7a054739ebcfdac1e88e90a69e

Download Submit
C:\Windows\System\LNIRAeZ.exe

Filesize
1.8MB

MD5
f5d8313d2caf5b29766e2e2141526c76

SHA1
017c83349b4f79faea097318d891ae9c20cbfe33

SHA256
9040093e06634c0ce8734b930d972eae532ee48ed088d4062b4701f1182f4b5c

SHA512
3b2eafe109b6d978ce42b924703a7778b408f8069da5022144b7657ce5c99627157d6742ea5604388056776b6b020838ff3dd5e3d3b5e9eb82c9c060875d7c6e

Download Submit
C:\Windows\System\OiYVUDS.exe

Filesize
1.8MB

MD5
f59e6eb56589856c9b32dda50316f4cc

SHA1
d3890ad00bf540f71ca2c610603b69ebd827e909

SHA256
0dc8673350bc04ebeb60fd0065f1c4213adf9ecec965279dec3606cd3dadf31e

SHA512
4f902204164408e3d3964526a694f6440400bef4121d2683b85bf6cd3a0148b3d754480868bcb1405af9503911fd1533df9fb86cbad95a721bbedfbe0e8e35ae

Download Submit
C:\Windows\System\PXbyjzW.exe

Filesize
1.8MB

MD5
c0e4e14b60b94e6c6117291d186bb54d

SHA1
3c1cf985286fa28192c5ccfaca9c3b3ad9ccadf7

SHA256
9e46ef25a3041cb7ccf1f559f8e6ff8112c627ed41711cb5a7d962c689d28f50

SHA512
e7c9d6a99b901d92c6575b3a70d4327f12a4fb017daae3c21249a6c3fc192345754578509a5d62aa2a6062321f4ff9874a08f888edb2154a3178a13da566d101

Download Submit
C:\Windows\System\RnwLPZt.exe

Filesize
1.8MB

MD5
422f80bf5adf33b8dab8c78607e7efb1

SHA1
af85126a0809630f0c3bbc004cd265db5fa3a47c

SHA256
982c4da4af6859316b20137d79f29355226fc0b962d0e13c8810f9d4c7d61482

SHA512
a95e48f4450647751f2bded0ddf789c7d32c9e0d14fc7ea150fbe3902989ab031329ad3a1d112564811bd1b7b6287df56145588ed2cdae107826c3d751e56426

Download Submit
C:\Windows\System\UkCRYtX.exe

Filesize
1.8MB

MD5
a226550aa6bf986a81a5ca06a5c78ae4

SHA1
2e788eb2088c51d77cf3903a41ae091c3b5ebbc6

SHA256
08385582d2389a14e18e207e9a0815db21ac897e2ef5b2f2533c2e4dd70f1a53

SHA512
43f4d6011bd0f83d7f3fd0083f7bf90cf12801bb9b272ee7022442822dd4cf24aa3a5e74cbf470742b4f99a7a2725feee3a5dad608eb2fafe9be77985b435b86

Download Submit
C:\Windows\System\VHAnEbP.exe

Filesize
1.8MB

MD5
1e4f5b32963361547ff53f6a6b4a7f6d

SHA1
5c7982a086002058e1f45e8eacee71a98b0beb88

SHA256
04728fb4d54471bc6dc3543b2786fd8ae116f664eb962391f77828f3b7eac581

SHA512
e997e1a0638de86d176de147908bf833f12b3f5091de2f06fd45d415f443dd561bb5ef4ec8f388c20c411f7888feff61d4f80f158fc16604ab2f8e65200af3a5

Download Submit
C:\Windows\System\VWqsCAL.exe

Filesize
1.8MB

MD5
2309cc9d02cdca5c1e80b9a66978a245

SHA1
a0f3d51f7e55a9e22a5d37187332b295e6fae510

SHA256
5da83f09f75284bb996024abf4116f44ae231e18ceb2260fb91e4b80a2240109

SHA512
e19045bb694dd21434dfe6fd279cc875384245fb09bea5bb37d36f4f71f3889bffb9c21107cc5c3ae1e6751ae777e3396010f48042e018283827cadb9b0352f7

Download Submit
C:\Windows\System\XEdPVjK.exe

Filesize
1.8MB

MD5
cc0256ef1bff946f021d6126ef5dddbe

SHA1
8e386df3efc485b769c593074ce4ab69213e22a0

SHA256
e0ffb961feb67d49f287949b736b5c9fab829db11322083e32b6a31f624e92b3

SHA512
946d1cc6e0ae0dc2e7196432a6e2169a607a91565c82d4feef0f8c92814eeab99271f767059b62e64c0cc017b334c798e856da117561e15f868a7c3dcaeb40f1

Download Submit
C:\Windows\System\aNXiQxg.exe

Filesize
1.8MB

MD5
e1ec9487af16f3ba97bbd5d8104d94a4

SHA1
348babf1ff9b9c161bc0dc12d1d3f5a7e9252fa1

SHA256
a8374bcfaf9cdbdc44295161a085744bba3271e8d747ba025f4059b8d418351f

SHA512
57518aecd11c8be6250dbedff4e8a513ea8154eec105e2ea9e07ee42e1ee8a9ec8eca71116adcbc5cd40554c18a4da45ca23f2c125ea9731c5bd9dd6c6d3b9b9

Download Submit
C:\Windows\System\aywjYuh.exe

Filesize
1.8MB

MD5
bdc0fa9646ed2b95423a86c8ada3fa02

SHA1
44f5cbd10acf7782ae5edc104853c76fa957506d

SHA256
2f09aa45cebff58fe73e4afcf7590c236bbf5b1edf770537cdbab1096a3bb44e

SHA512
5ae8bff6d072225e8855ee30c762333210de4fe2defa4ec478258ac214478c03928956370526685096b719dcdc688cc73b3a9e8b589ca596270b61c438c8f3d2

Download Submit
C:\Windows\System\bdBBtPT.exe

Filesize
1.8MB

MD5
ef215ebb73921e25d4c51951c4096602

SHA1
a4916d31f4f163710d6492088977687c96a8d7d7

SHA256
96d24e2993a5e82411d30da616b81f266f7a7af21b3aadd8dc851aa9505e7d1b

SHA512
3e04f6a34131ee2ad25d907b0e14e07db53f5393dce6e9eca7d3f914cdc9b74148564bca3b0dc433f73df5fe85eb3a420faadfb49b6a27d4db4eefe81ef59740

Download Submit
C:\Windows\System\cPbkass.exe

Filesize
1.8MB

MD5
263f9f0daf185c4f201619b66f8e8da7

SHA1
7132b7625d215b98a51ecc630c756879938e3765

SHA256
65a5b75136bb7e44b2eaed571bb68c9c0ff3195eb0a846ecea59aaf7d9c92239

SHA512
885b002a9b01fa2c56a3553c183e7302ec4f14ec0afa7cdebc9d3d5a4f4922a0522f45b4699b0b19a8e4ce9de474fc795ca9799dea7901bf7a9e8a09fc1d6426

Download Submit
C:\Windows\System\ePhQXiN.exe

Filesize
1.8MB

MD5
a9d466df6f89d8744816994e0751be2e

SHA1
293b416fa263665acb5d6cdc475c014c5cdd6296

SHA256
61c924b744eceb8d3f8e509fc59ac881f75ce95d633203e2ece1bf048c74a1c3

SHA512
7bdafe1d4e9efac5677bde30e6060e3152741a0e1b2c8dcc8e5e280d2af75c43b0bea9e5797e3330b75e7979e31a80ad9cc38f2889c93f6d121e783fa83c8af4

Download Submit
C:\Windows\System\fQoytls.exe

Filesize
1.8MB

MD5
efb12ff065494e7b807ad5a1a31e97ea

SHA1
9d1410d2fa17935dd4006717d9a6836f2034be8c

SHA256
9d59aee800b904235b755fec1c6fbb544158d49411556b1a19c1b55a738d8972

SHA512
c539e30c290e29399a185f80812809f8db0a3b2f7d2ca8ae6185f3c84b4ed49247b9080b8d281289cb6c056504e5a2f5dfeae494e5b6fc81cd669de722daa7be

Download Submit
C:\Windows\System\frVyJei.exe

Filesize
1.8MB

MD5
d1690ca203e537086ca74058d44a0d41

SHA1
90e63b6eb09b208d3e3124301750e0b30d331de1

SHA256
801bcc1632670f3bba2a37bb6e09c3aea283d6f62aacd1307f21cc3ff3bf5659

SHA512
71b88ca988cd2a25bb1111049934cdb2bbb4ba0621b575bc6d95928a90dcf14206f1c73e7485978d926ba08650abe17aed364f70374e88dd281b7b69b87792d4

Download Submit
C:\Windows\System\gsehkxr.exe

Filesize
1.8MB

MD5
4985a9ed8cfb0a3bd7363d394a192722

SHA1
f49a6e86a08319d7ba5f771794349c5f4f2446cd

SHA256
1ff338216cd824dcafdf889a3788d7fbe12aa67ff72ed4626551fe449d2e5f45

SHA512
22b136f5ca6f3cd5c38feb170de8657f9f297ccfb5f1bdc202bad24828553580031188c253ecb749e035570c3b0fd68ade9b72bd2d50e8a2dfbee102a715c800

Download Submit
C:\Windows\System\gvRXXbR.exe

Filesize
1.8MB

MD5
854f31555278a916407e15367da67344

SHA1
ae0dbb2ef785dd81eef4e45cef4667fc6bafc13b

SHA256
d9ee1d76feb0a50d108539ccb3e7fb8160c703eca6152793c555396ce65dc487

SHA512
32dacef6acca5d16cd2ab5008e900c9896fd3a2bc6850ae590f692993a792a5c8cc4b7b29b0996d12db08a3e5ef9cbda4a728233678443a0da51882514c0bce7

Download Submit
C:\Windows\System\kFJSLtr.exe

Filesize
1.8MB

MD5
ada9f129c17484d906df35662673f417

SHA1
a2fe5ab10ea04dcbb475264f0a6a4b40529ac889

SHA256
22c8966a78ca89a0a6de3610de9b34856dfa1acc59810265b82c2008ff1f7496

SHA512
03e4016de238a54b4d40521801cb593cecf8319cd14fbe630e8a7baf3226918535eb129a7f940c0867e184c1e30af6a1880cedf45f587d8b4233d2a721df8f20

Download Submit
C:\Windows\System\kXikWvJ.exe

Filesize
1.8MB

MD5
83a2db115f94a7234d72a3a287dfa9ce

SHA1
5d283cbb3334237840c94931caa8a82e4ccda603

SHA256
4f85b830903deb17be6bef25d542ba39858b3594fc398756412ba84ad762067e

SHA512
481716b3ad8e2ac4d9bcd730c4888ad4420a469b2d005fb7fc91495fd6c1b97d3288dde333ef338ea24b3bc75e840a5bea72b80b88c514a4b85f473c297f67da

Download Submit
C:\Windows\System\klHWZuJ.exe

Filesize
1.8MB

MD5
6c861d37a373cec34f6f6db3e8fe702b

SHA1
7af42a0908dd46c64da1a431280fff83dc15bdb9

SHA256
555b8d43c95eebb97d83c8fc655540e672baa064c1125781d76bf143918f684e

SHA512
cdd363b8a572e6a14886773a5ebb6c2e7f4469c12e4092a3c720a40c22b73a14943e9cb3008dbdb5cfd06c2edd72fe6ae66f0215416b623e4442665bfc485948

Download Submit
C:\Windows\System\mXmBBuE.exe

Filesize
1.8MB

MD5
0520085ed7d1ef23675196b2f2daa3ea

SHA1
ff592c5890f2a40b56cdf5579619a517d731bf79

SHA256
92c9e00b5eb224ad454c7019265f76b75dbbb6c431c73eb65f873f7946b9d0e4

SHA512
f190fe5800e0dc4870fa039a25767748604a01afcb35f7640724b7067904b1d9efd03de447508fe4ea82bac983a0c26975a65c6545aa38fa2106cbb6a7bcd761

Download Submit
C:\Windows\System\nHAwNfS.exe

Filesize
1.8MB

MD5
d379019ae1cb5a3d5e3ea0e32d14351a

SHA1
3e36cc69db3cf2558c79454723ffb66ca2dcfb3d

SHA256
79fd4fd3474f30551c0b55833114b20d309501bc99408346959ff55dad64ba3f

SHA512
33586f979aa3023f93eb94bd2c86846696d78602976ae3e273b664b01741655f596b619aa10108b31deee1c829befb2c6cd9fc6fbea64d448d470f48f3ca9bbe

Download Submit
C:\Windows\System\nQikjyz.exe

Filesize
1.8MB

MD5
699b6aebe1db79ddd9445fe72a5ffd5a

SHA1
cd262c3e7c4a8eaf917f795502a4e930f972cbda

SHA256
f851ae62d4acc54b47c4a5a9c033bf0f43c56d7f981d143ed9b258c6cc91ae3f

SHA512
08865ecde4dd4c4105886ac3759bd63c8a39488d3120e19800741c80cb54413122bf80d2b4af4e880fbe66b474d6becf4f6037f3cb05ad0701f75a2a87eb8fae

Download Submit
C:\Windows\System\nSeNYDT.exe

Filesize
1.8MB

MD5
43d13b60b4b22db7ae0082a7624e0049

SHA1
81444227e3ae6a33cb71a79ad961bcc5cf83651a

SHA256
4da168cbc07f9b2b30fc43f5545e502aceaba673e0e29db79c16190fdb610943

SHA512
b9af9af29bcf0eac3300356db461253c7d474050683c70006a9f386e3cd202921219567407e14ecbb8b52ef2b14ee43cc58d84a6dee558f71078d427fab4948c

Download Submit
C:\Windows\System\pjFaMHu.exe

Filesize
1.8MB

MD5
e67facf82b98d811bd9d778bbd2dc9f1

SHA1
9fa311f657638fb74281a60edc5922159c876b9b

SHA256
02fd5685b452a4c6fa3647bfeb21789a11cfb009b544f96955f4ac1a110e7036

SHA512
61213ea82c85ac2b567c1e63ca7d283d2bc8095b6532c4a899d53adcc4fba0389ae0c7a6d52936dbad48f08b60d32fd42c83ea07fd10d9fc66de59c84df9f6f8

Download Submit
C:\Windows\System\ppDlOSy.exe

Filesize
1.8MB

MD5
4354459fc382ed77cdf3b832b3302755

SHA1
e6dd531d430a0917eee557112a4f5913456fec20

SHA256
6091d7cfc5e79b99e77f0cb34b0487ee24d1d0a0e3edb632b6602c57849d95d5

SHA512
1eaba442d48c5d171f2849139d6d008e0f96408afa41151278db9c5a6a045cf9d9f31233e7a90d07ec221025051b150a5a65ab29acbeb46e2980d3e5a07b5a9d

Download Submit
C:\Windows\System\rqCInrw.exe

Filesize
1.8MB

MD5
3882fb75174f6aa729242b2098b163d0

SHA1
819b187f64e34b25442459a476d6aa826d879c10

SHA256
132bc232f9df2feced3e8ed7df81bfb46e3c9a21cbb15ade0b1bbdd3c8375269

SHA512
d8349bc3bbf257bf064c14eacc07330b794044c83d4b818efecb06d817f5d0ea1e74341dc6ec1c93c57a061c9a32d0a5a539e14a68a67bc0b773bc09fab7123c

Download Submit
C:\Windows\System\sEsXlsH.exe

Filesize
1.8MB

MD5
ce0cffe3f1149dff0147dd529e07b431

SHA1
8b90b0fda5e840b21bee7c5145763834770ae808

SHA256
8b4d743bc72f9eab4c73d92589f5a3c8651a8ac1b4d96b4954cd8f6533382be0

SHA512
55d4e0d4e4d0ee39a3ba75a93b61809b70e2aec5df06b0567ea604bbf2394a5bc49943fa22d09a132a3e576a3220e2a1bdf80144e325b327e257387ac37ba051

Download Submit
C:\Windows\System\wjSMKjM.exe

Filesize
1.8MB

MD5
6c444676bbf5115e0e666a00c32468ae

SHA1
2592caa9759de88660e086f76e3a344a801a7f4a

SHA256
c4e7c23bc0c167cfeaaac23308887ce74f7262f193ba566ac7301faf553b62d3

SHA512
366d2f43ab277ec9ccf6c565de999a96ff90fce56bf6ae274f8988880eaaa662de2b80c28342800ed86a3724b093422e5c38389d83e06d82d584ebc0967885e1

Download Submit
memory/380-9-0x00007FF7265B0000-0x00007FF7269A2000-memory.dmp

Filesize
3.9MB

Download
memory/380-2343-0x00007FF7265B0000-0x00007FF7269A2000-memory.dmp

Filesize
3.9MB

Download
memory/380-2045-0x00007FF7265B0000-0x00007FF7269A2000-memory.dmp

Filesize
3.9MB

Download
memory/1084-2418-0x00007FF600AB0000-0x00007FF600EA2000-memory.dmp

Filesize
3.9MB

Download
memory/1084-166-0x00007FF600AB0000-0x00007FF600EA2000-memory.dmp

Filesize
3.9MB

Download
memory/1436-2413-0x00007FF6E60B0000-0x00007FF6E64A2000-memory.dmp

Filesize
3.9MB

Download
memory/1436-147-0x00007FF6E60B0000-0x00007FF6E64A2000-memory.dmp

Filesize
3.9MB

Download
memory/1732-2310-0x00007FF673D50000-0x00007FF674142000-memory.dmp

Filesize
3.9MB

Download
memory/1732-2403-0x00007FF673D50000-0x00007FF674142000-memory.dmp

Filesize
3.9MB

Download
memory/1732-93-0x00007FF673D50000-0x00007FF674142000-memory.dmp

Filesize
3.9MB

Download
memory/1856-2345-0x00007FF73FD80000-0x00007FF740172000-memory.dmp

Filesize
3.9MB

Download
memory/1856-79-0x00007FF73FD80000-0x00007FF740172000-memory.dmp

Filesize
3.9MB

Download
memory/2088-85-0x00007FF763EF0000-0x00007FF7642E2000-memory.dmp

Filesize
3.9MB

Download
memory/2088-2309-0x00007FF763EF0000-0x00007FF7642E2000-memory.dmp

Filesize
3.9MB

Download
memory/2088-2365-0x00007FF763EF0000-0x00007FF7642E2000-memory.dmp

Filesize
3.9MB

Download
memory/2092-0-0x00007FF7B8FB0000-0x00007FF7B93A2000-memory.dmp

Filesize
3.9MB

Download
memory/2092-1-0x000001E8D4380000-0x000001E8D4390000-memory.dmp

Filesize
64KB

Download
memory/2120-2411-0x00007FF6E02A0000-0x00007FF6E0692000-memory.dmp

Filesize
3.9MB

Download
memory/2120-133-0x00007FF6E02A0000-0x00007FF6E0692000-memory.dmp

Filesize
3.9MB

Download
memory/2120-2324-0x00007FF6E02A0000-0x00007FF6E0692000-memory.dmp

Filesize
3.9MB

Download
memory/2360-2362-0x00007FF703F10000-0x00007FF704302000-memory.dmp

Filesize
3.9MB

Download
memory/2360-76-0x00007FF703F10000-0x00007FF704302000-memory.dmp

Filesize
3.9MB

Download
memory/2508-26-0x00007FF64F020000-0x00007FF64F412000-memory.dmp

Filesize
3.9MB

Download
memory/2508-2347-0x00007FF64F020000-0x00007FF64F412000-memory.dmp

Filesize
3.9MB

Download
memory/2788-188-0x00007FF60F9E0000-0x00007FF60FDD2000-memory.dmp

Filesize
3.9MB

Download
memory/2788-2421-0x00007FF60F9E0000-0x00007FF60FDD2000-memory.dmp

Filesize
3.9MB

Download
memory/2808-69-0x00007FF764550000-0x00007FF764942000-memory.dmp

Filesize
3.9MB

Download
memory/2808-2357-0x00007FF764550000-0x00007FF764942000-memory.dmp

Filesize
3.9MB

Download
memory/3248-2290-0x00007FF6A5610000-0x00007FF6A5A02000-memory.dmp

Filesize
3.9MB

Download
memory/3248-2360-0x00007FF6A5610000-0x00007FF6A5A02000-memory.dmp

Filesize
3.9MB

Download
memory/3248-75-0x00007FF6A5610000-0x00007FF6A5A02000-memory.dmp

Filesize
3.9MB

Download
memory/3324-2355-0x00007FF7D0950000-0x00007FF7D0D42000-memory.dmp

Filesize
3.9MB

Download
memory/3324-68-0x00007FF7D0950000-0x00007FF7D0D42000-memory.dmp

Filesize
3.9MB

Download
memory/3536-2350-0x00007FF62A780000-0x00007FF62AB72000-memory.dmp

Filesize
3.9MB

Download
memory/3536-42-0x00007FF62A780000-0x00007FF62AB72000-memory.dmp

Filesize
3.9MB

Download
memory/3608-103-0x00007FF79DF70000-0x00007FF79E362000-memory.dmp

Filesize
3.9MB

Download
memory/3608-2323-0x00007FF79DF70000-0x00007FF79E362000-memory.dmp

Filesize
3.9MB

Download
memory/3608-2407-0x00007FF79DF70000-0x00007FF79E362000-memory.dmp

Filesize
3.9MB

Download
memory/4016-81-0x00007FF6D7DB0000-0x00007FF6D81A2000-memory.dmp

Filesize
3.9MB

Download
memory/4016-2351-0x00007FF6D7DB0000-0x00007FF6D81A2000-memory.dmp

Filesize
3.9MB

Download
memory/4148-62-0x00007FF69A580000-0x00007FF69A972000-memory.dmp

Filesize
3.9MB

Download
memory/4148-2353-0x00007FF69A580000-0x00007FF69A972000-memory.dmp

Filesize
3.9MB

Download
memory/4472-2363-0x00007FF662230000-0x00007FF662622000-memory.dmp

Filesize
3.9MB

Download
memory/4472-82-0x00007FF662230000-0x00007FF662622000-memory.dmp

Filesize
3.9MB

Download
memory/4564-1605-0x00007FFA16B80000-0x00007FFA17641000-memory.dmp

Filesize
10.8MB

Download
memory/4564-24-0x000002844B7F0000-0x000002844B800000-memory.dmp

Filesize
64KB

Download
memory/4564-53-0x00000284676B0000-0x00000284676D2000-memory.dmp

Filesize
136KB

Download
memory/4564-23-0x00007FFA16B80000-0x00007FFA17641000-memory.dmp

Filesize
10.8MB

Download
memory/4564-27-0x000002844B7F0000-0x000002844B800000-memory.dmp

Filesize
64KB

Download
memory/4712-157-0x00007FF67BA40000-0x00007FF67BE32000-memory.dmp

Filesize
3.9MB

Download
memory/4712-2419-0x00007FF67BA40000-0x00007FF67BE32000-memory.dmp

Filesize
3.9MB

Download
memory/4760-171-0x00007FF672DA0000-0x00007FF673192000-memory.dmp

Filesize
3.9MB

Download
memory/4760-2409-0x00007FF672DA0000-0x00007FF673192000-memory.dmp

Filesize
3.9MB

Download
memory/4912-108-0x00007FF71A900000-0x00007FF71ACF2000-memory.dmp

Filesize
3.9MB

Download
memory/4912-2405-0x00007FF71A900000-0x00007FF71ACF2000-memory.dmp

Filesize
3.9MB

Download
memory/4912-2337-0x00007FF71A900000-0x00007FF71ACF2000-memory.dmp

Filesize
3.9MB

Download