xmrig | 520655622dbf973a9015320e1bcf52976c0181e43784404d595df3d534457310

Analysis

max time kernel
70s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 08:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
Size

2.2MB
MD5

04d4a36845d29019ab11f9d517c6203c
SHA1

ae26bcd5e18471e222dab83a0d21075165dc18dd
SHA256

520655622dbf973a9015320e1bcf52976c0181e43784404d595df3d534457310
SHA512

d4707ab374abd0e61d27396d9290680c44b55fd3fbc04900909632d60f412ab3047f2b2b5ee5fea19513b0439dc9ede36cbd205140a325d668652f7ce9f544bd
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfO:NABJ

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 43 IoCs

miner

resource	yara_rule
behavioral2/memory/2256-72-0x00007FF7FD760000-0x00007FF7FDB52000-memory.dmp	xmrig
behavioral2/memory/1896-93-0x00007FF7A4F60000-0x00007FF7A5352000-memory.dmp	xmrig
behavioral2/memory/4748-107-0x00007FF7A6E90000-0x00007FF7A7282000-memory.dmp	xmrig
behavioral2/memory/4908-135-0x00007FF67EAC0000-0x00007FF67EEB2000-memory.dmp	xmrig
behavioral2/memory/3832-145-0x00007FF7895D0000-0x00007FF7899C2000-memory.dmp	xmrig
behavioral2/memory/4608-164-0x00007FF6A1F00000-0x00007FF6A22F2000-memory.dmp	xmrig
behavioral2/memory/1712-158-0x00007FF674140000-0x00007FF674532000-memory.dmp	xmrig
behavioral2/memory/4872-152-0x00007FF676020000-0x00007FF676412000-memory.dmp	xmrig
behavioral2/memory/4368-151-0x00007FF6B1B50000-0x00007FF6B1F42000-memory.dmp	xmrig
behavioral2/memory/2396-141-0x00007FF62E1B0000-0x00007FF62E5A2000-memory.dmp	xmrig
behavioral2/memory/2920-115-0x00007FF7B89C0000-0x00007FF7B8DB2000-memory.dmp	xmrig
behavioral2/memory/1092-89-0x00007FF7CC590000-0x00007FF7CC982000-memory.dmp	xmrig
behavioral2/memory/116-83-0x00007FF789CF0000-0x00007FF78A0E2000-memory.dmp	xmrig
behavioral2/memory/2568-82-0x00007FF689960000-0x00007FF689D52000-memory.dmp	xmrig
behavioral2/memory/892-79-0x00007FF749680000-0x00007FF749A72000-memory.dmp	xmrig
behavioral2/memory/2156-73-0x00007FF65AC70000-0x00007FF65B062000-memory.dmp	xmrig
behavioral2/memory/4520-50-0x00007FF73B040000-0x00007FF73B432000-memory.dmp	xmrig
behavioral2/memory/2916-37-0x00007FF67B9E0000-0x00007FF67BDD2000-memory.dmp	xmrig
behavioral2/memory/1612-2244-0x00007FF71DBD0000-0x00007FF71DFC2000-memory.dmp	xmrig
behavioral2/memory/892-2245-0x00007FF749680000-0x00007FF749A72000-memory.dmp	xmrig
behavioral2/memory/760-2246-0x00007FF7A92F0000-0x00007FF7A96E2000-memory.dmp	xmrig
behavioral2/memory/2384-2247-0x00007FF779450000-0x00007FF779842000-memory.dmp	xmrig
behavioral2/memory/1612-2249-0x00007FF71DBD0000-0x00007FF71DFC2000-memory.dmp	xmrig
behavioral2/memory/2916-2251-0x00007FF67B9E0000-0x00007FF67BDD2000-memory.dmp	xmrig
behavioral2/memory/1092-2253-0x00007FF7CC590000-0x00007FF7CC982000-memory.dmp	xmrig
behavioral2/memory/1896-2256-0x00007FF7A4F60000-0x00007FF7A5352000-memory.dmp	xmrig
behavioral2/memory/2256-2257-0x00007FF7FD760000-0x00007FF7FDB52000-memory.dmp	xmrig
behavioral2/memory/116-2262-0x00007FF789CF0000-0x00007FF78A0E2000-memory.dmp	xmrig
behavioral2/memory/4520-2260-0x00007FF73B040000-0x00007FF73B432000-memory.dmp	xmrig
behavioral2/memory/2156-2263-0x00007FF65AC70000-0x00007FF65B062000-memory.dmp	xmrig
behavioral2/memory/3832-2273-0x00007FF7895D0000-0x00007FF7899C2000-memory.dmp	xmrig
behavioral2/memory/2920-2275-0x00007FF7B89C0000-0x00007FF7B8DB2000-memory.dmp	xmrig
behavioral2/memory/4872-2277-0x00007FF676020000-0x00007FF676412000-memory.dmp	xmrig
behavioral2/memory/4748-2271-0x00007FF7A6E90000-0x00007FF7A7282000-memory.dmp	xmrig
behavioral2/memory/4368-2270-0x00007FF6B1B50000-0x00007FF6B1F42000-memory.dmp	xmrig
behavioral2/memory/892-2267-0x00007FF749680000-0x00007FF749A72000-memory.dmp	xmrig
behavioral2/memory/2568-2266-0x00007FF689960000-0x00007FF689D52000-memory.dmp	xmrig
behavioral2/memory/1712-2293-0x00007FF674140000-0x00007FF674532000-memory.dmp	xmrig
behavioral2/memory/2384-2291-0x00007FF779450000-0x00007FF779842000-memory.dmp	xmrig
behavioral2/memory/2396-2301-0x00007FF62E1B0000-0x00007FF62E5A2000-memory.dmp	xmrig
behavioral2/memory/4908-2290-0x00007FF67EAC0000-0x00007FF67EEB2000-memory.dmp	xmrig
behavioral2/memory/760-2289-0x00007FF7A92F0000-0x00007FF7A96E2000-memory.dmp	xmrig
behavioral2/memory/4608-2288-0x00007FF6A1F00000-0x00007FF6A22F2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1612	DGBffNv.exe
116	ELtxEPM.exe
1092	PuWuulJ.exe
2916	EfyHaMR.exe
4520	hJJUBDP.exe
1896	jTBzxIO.exe
2256	afcNBgI.exe
2156	SpzTodW.exe
4748	oHzSAvg.exe
892	zKGJzrz.exe
2568	VRtcVFb.exe
2920	HzkUGrw.exe
3832	LEwvqeE.exe
4368	BCQnKeo.exe
4872	YrJiUNi.exe
1712	HYnwFhY.exe
2384	JBjiWcs.exe
760	fUKRXfS.exe
4908	XvGaeQv.exe
2396	sjSpROI.exe
4608	JVxjjap.exe
816	QILXMhF.exe
5052	tonsBac.exe
1948	dlALnRJ.exe
2172	ZkXpUtr.exe
1828	idtULuX.exe
1012	fCfVxHb.exe
2524	Wdsvrlp.exe
2564	pufZKwh.exe
2832	nKerqyy.exe
3608	iQaBKkL.exe
4484	sXNRccm.exe
4132	dBQnBII.exe
768	FtSbAka.exe
3844	pUZfifk.exe
3288	rRXxyEb.exe
1636	XezSPkx.exe
1800	gkyxqDR.exe
748	eFjBYva.exe
4476	SeLKGVd.exe
400	xrHpisi.exe
4372	rSDMOUE.exe
1412	UeQbJli.exe
408	jIrhvvC.exe
3292	VpqetMM.exe
536	kANaEHU.exe
4256	gDkTBDG.exe
464	liMGdAI.exe
4728	QMOMOhL.exe
4532	tLAoPjF.exe
2132	cPveDdo.exe
764	pyMloZs.exe
3296	QItXLcr.exe
2600	ASFqAWY.exe
3960	HGuZhvK.exe
3464	TDFYJUV.exe
4016	qCBQNaX.exe
4428	IhvGyUO.exe
4252	pTWkqkw.exe
2440	ydXgMxY.exe
4184	tsKxqQi.exe
2764	YULARcp.exe
3368	jgGgtgc.exe
4552	WmcXSKZ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2896-0-0x00007FF765E40000-0x00007FF766232000-memory.dmp	upx
behavioral2/files/0x000b000000023ba0-5.dat	upx
behavioral2/files/0x000a000000023ba5-7.dat	upx
behavioral2/memory/1612-12-0x00007FF71DBD0000-0x00007FF71DFC2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba4-11.dat	upx
behavioral2/files/0x000a000000023ba6-20.dat	upx
behavioral2/files/0x000a000000023ba9-35.dat	upx
behavioral2/files/0x000a000000023ba8-39.dat	upx
behavioral2/files/0x000a000000023baa-52.dat	upx
behavioral2/memory/2256-72-0x00007FF7FD760000-0x00007FF7FDB52000-memory.dmp	upx
behavioral2/files/0x000a000000023bb1-84.dat	upx
behavioral2/memory/1896-93-0x00007FF7A4F60000-0x00007FF7A5352000-memory.dmp	upx
behavioral2/memory/4748-107-0x00007FF7A6E90000-0x00007FF7A7282000-memory.dmp	upx
behavioral2/files/0x000b000000023bb0-116.dat	upx
behavioral2/files/0x000a000000023bb3-126.dat	upx
behavioral2/memory/4908-135-0x00007FF67EAC0000-0x00007FF67EEB2000-memory.dmp	upx
behavioral2/memory/3832-145-0x00007FF7895D0000-0x00007FF7899C2000-memory.dmp	upx
behavioral2/files/0x000a000000023bba-155.dat	upx
behavioral2/files/0x000a000000023bbc-167.dat	upx
behavioral2/files/0x000a000000023bc0-187.dat	upx
behavioral2/files/0x000a000000023bc2-197.dat	upx
behavioral2/files/0x000a000000023bc1-192.dat	upx
behavioral2/files/0x000a000000023bbf-190.dat	upx
behavioral2/files/0x000a000000023bbe-185.dat	upx
behavioral2/files/0x000a000000023bbd-180.dat	upx
behavioral2/files/0x000a000000023bbb-170.dat	upx
behavioral2/memory/4608-164-0x00007FF6A1F00000-0x00007FF6A22F2000-memory.dmp	upx
behavioral2/files/0x000a000000023bb9-159.dat	upx
behavioral2/memory/1712-158-0x00007FF674140000-0x00007FF674532000-memory.dmp	upx
behavioral2/files/0x000a000000023bb8-153.dat	upx
behavioral2/memory/4872-152-0x00007FF676020000-0x00007FF676412000-memory.dmp	upx
behavioral2/memory/4368-151-0x00007FF6B1B50000-0x00007FF6B1F42000-memory.dmp	upx
behavioral2/files/0x000a000000023bb7-146.dat	upx
behavioral2/memory/2396-141-0x00007FF62E1B0000-0x00007FF62E5A2000-memory.dmp	upx
behavioral2/files/0x0031000000023bb6-136.dat	upx
behavioral2/memory/760-132-0x00007FF7A92F0000-0x00007FF7A96E2000-memory.dmp	upx
behavioral2/files/0x0031000000023bb5-129.dat	upx
behavioral2/files/0x0031000000023bb4-127.dat	upx
behavioral2/files/0x000a000000023bb2-124.dat	upx
behavioral2/files/0x000b000000023baf-122.dat	upx
behavioral2/memory/2384-120-0x00007FF779450000-0x00007FF779842000-memory.dmp	upx
behavioral2/memory/2920-115-0x00007FF7B89C0000-0x00007FF7B8DB2000-memory.dmp	upx
behavioral2/files/0x000b000000023ba1-96.dat	upx
behavioral2/memory/1092-89-0x00007FF7CC590000-0x00007FF7CC982000-memory.dmp	upx
behavioral2/files/0x000a000000023bae-85.dat	upx
behavioral2/memory/116-83-0x00007FF789CF0000-0x00007FF78A0E2000-memory.dmp	upx
behavioral2/memory/2568-82-0x00007FF689960000-0x00007FF689D52000-memory.dmp	upx
behavioral2/memory/892-79-0x00007FF749680000-0x00007FF749A72000-memory.dmp	upx
behavioral2/files/0x000a000000023bad-76.dat	upx
behavioral2/files/0x000a000000023bac-75.dat	upx
behavioral2/memory/2156-73-0x00007FF65AC70000-0x00007FF65B062000-memory.dmp	upx
behavioral2/files/0x000a000000023bab-68.dat	upx
behavioral2/memory/4520-50-0x00007FF73B040000-0x00007FF73B432000-memory.dmp	upx
behavioral2/files/0x000a000000023ba7-47.dat	upx
behavioral2/memory/2916-37-0x00007FF67B9E0000-0x00007FF67BDD2000-memory.dmp	upx
behavioral2/memory/1612-2244-0x00007FF71DBD0000-0x00007FF71DFC2000-memory.dmp	upx
behavioral2/memory/892-2245-0x00007FF749680000-0x00007FF749A72000-memory.dmp	upx
behavioral2/memory/760-2246-0x00007FF7A92F0000-0x00007FF7A96E2000-memory.dmp	upx
behavioral2/memory/2384-2247-0x00007FF779450000-0x00007FF779842000-memory.dmp	upx
behavioral2/memory/1612-2249-0x00007FF71DBD0000-0x00007FF71DFC2000-memory.dmp	upx
behavioral2/memory/2916-2251-0x00007FF67B9E0000-0x00007FF67BDD2000-memory.dmp	upx
behavioral2/memory/1092-2253-0x00007FF7CC590000-0x00007FF7CC982000-memory.dmp	upx
behavioral2/memory/1896-2256-0x00007FF7A4F60000-0x00007FF7A5352000-memory.dmp	upx
behavioral2/memory/2256-2257-0x00007FF7FD760000-0x00007FF7FDB52000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\fBISljG.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\GMRceHJ.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\tEdLhCU.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\lZJiQjl.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\xinEOMW.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\BEwEntl.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\oDOAcTu.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\DsobfYc.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\pUZfifk.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\PyueNEf.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\ePJFIMD.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\ukLIIwo.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\IbAZfQW.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\jIrhvvC.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\NAcYJjW.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\SflWZFv.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\UBekIDA.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\sLTDRHj.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\vgBZrhM.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\lrabkTL.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\VHkBjXf.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\XbdgfkS.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\aarIHJe.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\fIvwXVN.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\EDhciwS.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\WQJKtjd.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\PQfXfqR.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\aKJqlSM.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\RqQpCVs.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\KbHqsPR.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\SeLKGVd.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\NzxtpFG.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\rYVaVbx.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\HDYLhnq.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\hocBCse.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\AwWMkCv.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\tonsBac.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\QXfGbwD.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\SCHCnZG.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\WwJyLtv.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\WbSrVtL.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\DniqYRa.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\opZpLaJ.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\cQQcyPX.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\sxXtIAF.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\cQLvSMu.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\SAXSxSQ.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\YqPjLLE.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\uvFmtTf.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\caFTdek.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\PRxKnfX.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\eUsrEEB.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\CPrWpEn.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\FZqrpyy.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\lBRnuiy.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\lFOvApI.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\ATfmVen.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\ZsxPjoO.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\WufBlhN.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\xVqDIsA.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\ulTMTfp.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\qPKYgPQ.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\BIPpvmu.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\AGHUhDT.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3452	powershell.exe
3452	powershell.exe
3452	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
Token: SeDebugPrivilege	3452	powershell.exe
Token: SeLockMemoryPrivilege	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 3452	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	85
PID 2896 wrote to memory of 3452	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	85
PID 2896 wrote to memory of 1612	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	86
PID 2896 wrote to memory of 1612	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	86
PID 2896 wrote to memory of 116	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	87
PID 2896 wrote to memory of 116	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	87
PID 2896 wrote to memory of 1092	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	88
PID 2896 wrote to memory of 1092	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	88
PID 2896 wrote to memory of 2916	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	89
PID 2896 wrote to memory of 2916	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	89
PID 2896 wrote to memory of 1896	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	90
PID 2896 wrote to memory of 1896	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	90
PID 2896 wrote to memory of 4520	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	91
PID 2896 wrote to memory of 4520	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	91
PID 2896 wrote to memory of 2256	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	92
PID 2896 wrote to memory of 2256	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	92
PID 2896 wrote to memory of 2156	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	93
PID 2896 wrote to memory of 2156	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	93
PID 2896 wrote to memory of 4748	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	94
PID 2896 wrote to memory of 4748	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	94
PID 2896 wrote to memory of 892	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	95
PID 2896 wrote to memory of 892	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	95
PID 2896 wrote to memory of 2568	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	96
PID 2896 wrote to memory of 2568	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	96
PID 2896 wrote to memory of 2920	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	97
PID 2896 wrote to memory of 2920	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	97
PID 2896 wrote to memory of 3832	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	98
PID 2896 wrote to memory of 3832	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	98
PID 2896 wrote to memory of 4368	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	99
PID 2896 wrote to memory of 4368	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	99
PID 2896 wrote to memory of 4872	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	100
PID 2896 wrote to memory of 4872	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	100
PID 2896 wrote to memory of 1712	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	101
PID 2896 wrote to memory of 1712	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	101
PID 2896 wrote to memory of 2384	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	102
PID 2896 wrote to memory of 2384	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	102
PID 2896 wrote to memory of 760	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	103
PID 2896 wrote to memory of 760	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	103
PID 2896 wrote to memory of 4908	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	104
PID 2896 wrote to memory of 4908	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	104
PID 2896 wrote to memory of 2396	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	105
PID 2896 wrote to memory of 2396	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	105
PID 2896 wrote to memory of 4608	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	106
PID 2896 wrote to memory of 4608	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	106
PID 2896 wrote to memory of 816	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	107
PID 2896 wrote to memory of 816	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	107
PID 2896 wrote to memory of 5052	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	108
PID 2896 wrote to memory of 5052	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	108
PID 2896 wrote to memory of 1948	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	109
PID 2896 wrote to memory of 1948	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	109
PID 2896 wrote to memory of 2172	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	110
PID 2896 wrote to memory of 2172	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	110
PID 2896 wrote to memory of 1828	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	111
PID 2896 wrote to memory of 1828	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	111
PID 2896 wrote to memory of 1012	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	112
PID 2896 wrote to memory of 1012	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	112
PID 2896 wrote to memory of 2524	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	113
PID 2896 wrote to memory of 2524	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	113
PID 2896 wrote to memory of 2564	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	114
PID 2896 wrote to memory of 2564	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	114
PID 2896 wrote to memory of 2832	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	115
PID 2896 wrote to memory of 2832	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	115
PID 2896 wrote to memory of 3608	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	116
PID 2896 wrote to memory of 3608	2896	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3452
- C:\Windows\System\DGBffNv.exe
  C:\Windows\System\DGBffNv.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\ELtxEPM.exe
  C:\Windows\System\ELtxEPM.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\PuWuulJ.exe
  C:\Windows\System\PuWuulJ.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\EfyHaMR.exe
  C:\Windows\System\EfyHaMR.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\jTBzxIO.exe
  C:\Windows\System\jTBzxIO.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\hJJUBDP.exe
  C:\Windows\System\hJJUBDP.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\afcNBgI.exe
  C:\Windows\System\afcNBgI.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\SpzTodW.exe
  C:\Windows\System\SpzTodW.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\oHzSAvg.exe
  C:\Windows\System\oHzSAvg.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\zKGJzrz.exe
  C:\Windows\System\zKGJzrz.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\VRtcVFb.exe
  C:\Windows\System\VRtcVFb.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\HzkUGrw.exe
  C:\Windows\System\HzkUGrw.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\LEwvqeE.exe
  C:\Windows\System\LEwvqeE.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System\BCQnKeo.exe
  C:\Windows\System\BCQnKeo.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\YrJiUNi.exe
  C:\Windows\System\YrJiUNi.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\HYnwFhY.exe
  C:\Windows\System\HYnwFhY.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\JBjiWcs.exe
  C:\Windows\System\JBjiWcs.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\fUKRXfS.exe
  C:\Windows\System\fUKRXfS.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\XvGaeQv.exe
  C:\Windows\System\XvGaeQv.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\sjSpROI.exe
  C:\Windows\System\sjSpROI.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\JVxjjap.exe
  C:\Windows\System\JVxjjap.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\QILXMhF.exe
  C:\Windows\System\QILXMhF.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\tonsBac.exe
  C:\Windows\System\tonsBac.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\dlALnRJ.exe
  C:\Windows\System\dlALnRJ.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\ZkXpUtr.exe
  C:\Windows\System\ZkXpUtr.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\idtULuX.exe
  C:\Windows\System\idtULuX.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\fCfVxHb.exe
  C:\Windows\System\fCfVxHb.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\Wdsvrlp.exe
  C:\Windows\System\Wdsvrlp.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\pufZKwh.exe
  C:\Windows\System\pufZKwh.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\nKerqyy.exe
  C:\Windows\System\nKerqyy.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\iQaBKkL.exe
  C:\Windows\System\iQaBKkL.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\sXNRccm.exe
  C:\Windows\System\sXNRccm.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\dBQnBII.exe
  C:\Windows\System\dBQnBII.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System\FtSbAka.exe
  C:\Windows\System\FtSbAka.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\pUZfifk.exe
  C:\Windows\System\pUZfifk.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System\rRXxyEb.exe
  C:\Windows\System\rRXxyEb.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\XezSPkx.exe
  C:\Windows\System\XezSPkx.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\gkyxqDR.exe
  C:\Windows\System\gkyxqDR.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\eFjBYva.exe
  C:\Windows\System\eFjBYva.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\SeLKGVd.exe
  C:\Windows\System\SeLKGVd.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\xrHpisi.exe
  C:\Windows\System\xrHpisi.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\rSDMOUE.exe
  C:\Windows\System\rSDMOUE.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\UeQbJli.exe
  C:\Windows\System\UeQbJli.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\jIrhvvC.exe
  C:\Windows\System\jIrhvvC.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\VpqetMM.exe
  C:\Windows\System\VpqetMM.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\kANaEHU.exe
  C:\Windows\System\kANaEHU.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\gDkTBDG.exe
  C:\Windows\System\gDkTBDG.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\liMGdAI.exe
  C:\Windows\System\liMGdAI.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\QMOMOhL.exe
  C:\Windows\System\QMOMOhL.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\tLAoPjF.exe
  C:\Windows\System\tLAoPjF.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\cPveDdo.exe
  C:\Windows\System\cPveDdo.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\pyMloZs.exe
  C:\Windows\System\pyMloZs.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\QItXLcr.exe
  C:\Windows\System\QItXLcr.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\ASFqAWY.exe
  C:\Windows\System\ASFqAWY.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\HGuZhvK.exe
  C:\Windows\System\HGuZhvK.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\TDFYJUV.exe
  C:\Windows\System\TDFYJUV.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\qCBQNaX.exe
  C:\Windows\System\qCBQNaX.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\IhvGyUO.exe
  C:\Windows\System\IhvGyUO.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\pTWkqkw.exe
  C:\Windows\System\pTWkqkw.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\ydXgMxY.exe
  C:\Windows\System\ydXgMxY.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\tsKxqQi.exe
  C:\Windows\System\tsKxqQi.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\YULARcp.exe
  C:\Windows\System\YULARcp.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\jgGgtgc.exe
  C:\Windows\System\jgGgtgc.exe
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Windows\System\WmcXSKZ.exe
  C:\Windows\System\WmcXSKZ.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\kZtgZLV.exe
  C:\Windows\System\kZtgZLV.exe
  2⤵
  PID:4784
- C:\Windows\System\DLqxRjf.exe
  C:\Windows\System\DLqxRjf.exe
  2⤵
  PID:2096
- C:\Windows\System\BIPpvmu.exe
  C:\Windows\System\BIPpvmu.exe
  2⤵
  PID:5128
- C:\Windows\System\lrabkTL.exe
  C:\Windows\System\lrabkTL.exe
  2⤵
  PID:5156
- C:\Windows\System\kCnAyBn.exe
  C:\Windows\System\kCnAyBn.exe
  2⤵
  PID:5184
- C:\Windows\System\cKHqRFC.exe
  C:\Windows\System\cKHqRFC.exe
  2⤵
  PID:5212
- C:\Windows\System\qxggoIe.exe
  C:\Windows\System\qxggoIe.exe
  2⤵
  PID:5240
- C:\Windows\System\eUsrEEB.exe
  C:\Windows\System\eUsrEEB.exe
  2⤵
  PID:5268
- C:\Windows\System\UdXarpg.exe
  C:\Windows\System\UdXarpg.exe
  2⤵
  PID:5296
- C:\Windows\System\ViAPnIq.exe
  C:\Windows\System\ViAPnIq.exe
  2⤵
  PID:5324
- C:\Windows\System\IOkwOCf.exe
  C:\Windows\System\IOkwOCf.exe
  2⤵
  PID:5352
- C:\Windows\System\oZWSyqt.exe
  C:\Windows\System\oZWSyqt.exe
  2⤵
  PID:5380
- C:\Windows\System\UhDMqfb.exe
  C:\Windows\System\UhDMqfb.exe
  2⤵
  PID:5412
- C:\Windows\System\JcRqdHj.exe
  C:\Windows\System\JcRqdHj.exe
  2⤵
  PID:5440
- C:\Windows\System\fBISljG.exe
  C:\Windows\System\fBISljG.exe
  2⤵
  PID:5464
- C:\Windows\System\fEsAbvY.exe
  C:\Windows\System\fEsAbvY.exe
  2⤵
  PID:5492
- C:\Windows\System\FmOVrLr.exe
  C:\Windows\System\FmOVrLr.exe
  2⤵
  PID:5520
- C:\Windows\System\IoXhIZB.exe
  C:\Windows\System\IoXhIZB.exe
  2⤵
  PID:5548
- C:\Windows\System\anNDYpq.exe
  C:\Windows\System\anNDYpq.exe
  2⤵
  PID:5576
- C:\Windows\System\ZoTIMMV.exe
  C:\Windows\System\ZoTIMMV.exe
  2⤵
  PID:5604
- C:\Windows\System\rrNHiRq.exe
  C:\Windows\System\rrNHiRq.exe
  2⤵
  PID:5632
- C:\Windows\System\mnInjED.exe
  C:\Windows\System\mnInjED.exe
  2⤵
  PID:5660
- C:\Windows\System\whEpLvH.exe
  C:\Windows\System\whEpLvH.exe
  2⤵
  PID:5688
- C:\Windows\System\PIdkWTV.exe
  C:\Windows\System\PIdkWTV.exe
  2⤵
  PID:5716
- C:\Windows\System\YgcTGUk.exe
  C:\Windows\System\YgcTGUk.exe
  2⤵
  PID:5744
- C:\Windows\System\YqPjLLE.exe
  C:\Windows\System\YqPjLLE.exe
  2⤵
  PID:5772
- C:\Windows\System\GkCnWvw.exe
  C:\Windows\System\GkCnWvw.exe
  2⤵
  PID:5796
- C:\Windows\System\tauXrFr.exe
  C:\Windows\System\tauXrFr.exe
  2⤵
  PID:5828
- C:\Windows\System\FfNWtAI.exe
  C:\Windows\System\FfNWtAI.exe
  2⤵
  PID:5856
- C:\Windows\System\WvshFsl.exe
  C:\Windows\System\WvshFsl.exe
  2⤵
  PID:5884
- C:\Windows\System\wUFmdWQ.exe
  C:\Windows\System\wUFmdWQ.exe
  2⤵
  PID:5912
- C:\Windows\System\uOlUkAJ.exe
  C:\Windows\System\uOlUkAJ.exe
  2⤵
  PID:5940
- C:\Windows\System\BmEymBx.exe
  C:\Windows\System\BmEymBx.exe
  2⤵
  PID:5968
- C:\Windows\System\uvFmtTf.exe
  C:\Windows\System\uvFmtTf.exe
  2⤵
  PID:5996
- C:\Windows\System\PIfRHWw.exe
  C:\Windows\System\PIfRHWw.exe
  2⤵
  PID:6024
- C:\Windows\System\zKEWgGL.exe
  C:\Windows\System\zKEWgGL.exe
  2⤵
  PID:6040
- C:\Windows\System\NNIbmTY.exe
  C:\Windows\System\NNIbmTY.exe
  2⤵
  PID:6068
- C:\Windows\System\aGRwOjd.exe
  C:\Windows\System\aGRwOjd.exe
  2⤵
  PID:6104
- C:\Windows\System\KKnnRfY.exe
  C:\Windows\System\KKnnRfY.exe
  2⤵
  PID:6136
- C:\Windows\System\GvKeCjv.exe
  C:\Windows\System\GvKeCjv.exe
  2⤵
  PID:2664
- C:\Windows\System\lsmxeXl.exe
  C:\Windows\System\lsmxeXl.exe
  2⤵
  PID:1956
- C:\Windows\System\LyYDsWB.exe
  C:\Windows\System\LyYDsWB.exe
  2⤵
  PID:4656
- C:\Windows\System\BQOAgfu.exe
  C:\Windows\System\BQOAgfu.exe
  2⤵
  PID:2012
- C:\Windows\System\QqfjdSL.exe
  C:\Windows\System\QqfjdSL.exe
  2⤵
  PID:5140
- C:\Windows\System\hNuhBIG.exe
  C:\Windows\System\hNuhBIG.exe
  2⤵
  PID:5200
- C:\Windows\System\UGBVZoC.exe
  C:\Windows\System\UGBVZoC.exe
  2⤵
  PID:5260
- C:\Windows\System\VzYLpnA.exe
  C:\Windows\System\VzYLpnA.exe
  2⤵
  PID:5336
- C:\Windows\System\HWdyBXk.exe
  C:\Windows\System\HWdyBXk.exe
  2⤵
  PID:5392
- C:\Windows\System\aWONCuX.exe
  C:\Windows\System\aWONCuX.exe
  2⤵
  PID:5456
- C:\Windows\System\qCjnQQn.exe
  C:\Windows\System\qCjnQQn.exe
  2⤵
  PID:5512
- C:\Windows\System\OhLKqRm.exe
  C:\Windows\System\OhLKqRm.exe
  2⤵
  PID:5588
- C:\Windows\System\ozSqrkH.exe
  C:\Windows\System\ozSqrkH.exe
  2⤵
  PID:5644
- C:\Windows\System\wmBbsNh.exe
  C:\Windows\System\wmBbsNh.exe
  2⤵
  PID:5704
- C:\Windows\System\wOrPeiM.exe
  C:\Windows\System\wOrPeiM.exe
  2⤵
  PID:5760
- C:\Windows\System\SxhicsR.exe
  C:\Windows\System\SxhicsR.exe
  2⤵
  PID:5816
- C:\Windows\System\pQcXdBb.exe
  C:\Windows\System\pQcXdBb.exe
  2⤵
  PID:5876
- C:\Windows\System\FaAXwdH.exe
  C:\Windows\System\FaAXwdH.exe
  2⤵
  PID:5952
- C:\Windows\System\YOaGUiM.exe
  C:\Windows\System\YOaGUiM.exe
  2⤵
  PID:6008
- C:\Windows\System\CliSuJl.exe
  C:\Windows\System\CliSuJl.exe
  2⤵
  PID:6060
- C:\Windows\System\CVQoRtC.exe
  C:\Windows\System\CVQoRtC.exe
  2⤵
  PID:6128
- C:\Windows\System\kkGAdrk.exe
  C:\Windows\System\kkGAdrk.exe
  2⤵
  PID:1920
- C:\Windows\System\EBHGGKo.exe
  C:\Windows\System\EBHGGKo.exe
  2⤵
  PID:1272
- C:\Windows\System\GlmePAL.exe
  C:\Windows\System\GlmePAL.exe
  2⤵
  PID:5176
- C:\Windows\System\RZcfwCE.exe
  C:\Windows\System\RZcfwCE.exe
  2⤵
  PID:5364
- C:\Windows\System\mHyVdeA.exe
  C:\Windows\System\mHyVdeA.exe
  2⤵
  PID:5480
- C:\Windows\System\QXfGbwD.exe
  C:\Windows\System\QXfGbwD.exe
  2⤵
  PID:5616
- C:\Windows\System\WufBlhN.exe
  C:\Windows\System\WufBlhN.exe
  2⤵
  PID:5728
- C:\Windows\System\GiESCbi.exe
  C:\Windows\System\GiESCbi.exe
  2⤵
  PID:5848
- C:\Windows\System\HtgRYFq.exe
  C:\Windows\System\HtgRYFq.exe
  2⤵
  PID:5984
- C:\Windows\System\gqmTIQE.exe
  C:\Windows\System\gqmTIQE.exe
  2⤵
  PID:3012
- C:\Windows\System\uZLBeUU.exe
  C:\Windows\System\uZLBeUU.exe
  2⤵
  PID:4996
- C:\Windows\System\lvBRBGe.exe
  C:\Windows\System\lvBRBGe.exe
  2⤵
  PID:5252
- C:\Windows\System\IlkJvwj.exe
  C:\Windows\System\IlkJvwj.exe
  2⤵
  PID:6148
- C:\Windows\System\KOpyLas.exe
  C:\Windows\System\KOpyLas.exe
  2⤵
  PID:6176
- C:\Windows\System\rTKeQZY.exe
  C:\Windows\System\rTKeQZY.exe
  2⤵
  PID:6204
- C:\Windows\System\JaCnVdC.exe
  C:\Windows\System\JaCnVdC.exe
  2⤵
  PID:6232
- C:\Windows\System\YntaSzg.exe
  C:\Windows\System\YntaSzg.exe
  2⤵
  PID:6260
- C:\Windows\System\edIhPZh.exe
  C:\Windows\System\edIhPZh.exe
  2⤵
  PID:6288
- C:\Windows\System\jeNwoJP.exe
  C:\Windows\System\jeNwoJP.exe
  2⤵
  PID:6316
- C:\Windows\System\JwVVaPB.exe
  C:\Windows\System\JwVVaPB.exe
  2⤵
  PID:6344
- C:\Windows\System\FBfbqGZ.exe
  C:\Windows\System\FBfbqGZ.exe
  2⤵
  PID:6376
- C:\Windows\System\HgkLhSi.exe
  C:\Windows\System\HgkLhSi.exe
  2⤵
  PID:6400
- C:\Windows\System\rQfivIr.exe
  C:\Windows\System\rQfivIr.exe
  2⤵
  PID:6428
- C:\Windows\System\bWWnOie.exe
  C:\Windows\System\bWWnOie.exe
  2⤵
  PID:6456
- C:\Windows\System\vhxguzM.exe
  C:\Windows\System\vhxguzM.exe
  2⤵
  PID:6484
- C:\Windows\System\sQfudON.exe
  C:\Windows\System\sQfudON.exe
  2⤵
  PID:6512
- C:\Windows\System\DniqYRa.exe
  C:\Windows\System\DniqYRa.exe
  2⤵
  PID:6536
- C:\Windows\System\BvlFmUK.exe
  C:\Windows\System\BvlFmUK.exe
  2⤵
  PID:6564
- C:\Windows\System\nTaaSAw.exe
  C:\Windows\System\nTaaSAw.exe
  2⤵
  PID:6592
- C:\Windows\System\xrCwDdy.exe
  C:\Windows\System\xrCwDdy.exe
  2⤵
  PID:6620
- C:\Windows\System\AexGEyD.exe
  C:\Windows\System\AexGEyD.exe
  2⤵
  PID:6652
- C:\Windows\System\JRivJlh.exe
  C:\Windows\System\JRivJlh.exe
  2⤵
  PID:6676
- C:\Windows\System\zxboZaR.exe
  C:\Windows\System\zxboZaR.exe
  2⤵
  PID:6708
- C:\Windows\System\SywDnCQ.exe
  C:\Windows\System\SywDnCQ.exe
  2⤵
  PID:6736
- C:\Windows\System\iTJTbIV.exe
  C:\Windows\System\iTJTbIV.exe
  2⤵
  PID:6764
- C:\Windows\System\ulswxGC.exe
  C:\Windows\System\ulswxGC.exe
  2⤵
  PID:6792
- C:\Windows\System\pleEqah.exe
  C:\Windows\System\pleEqah.exe
  2⤵
  PID:6820
- C:\Windows\System\jSIaXEO.exe
  C:\Windows\System\jSIaXEO.exe
  2⤵
  PID:6848
- C:\Windows\System\XEdkVMR.exe
  C:\Windows\System\XEdkVMR.exe
  2⤵
  PID:6876
- C:\Windows\System\PyueNEf.exe
  C:\Windows\System\PyueNEf.exe
  2⤵
  PID:6908
- C:\Windows\System\yQFpugw.exe
  C:\Windows\System\yQFpugw.exe
  2⤵
  PID:6932
- C:\Windows\System\cqiCYQx.exe
  C:\Windows\System\cqiCYQx.exe
  2⤵
  PID:6960
- C:\Windows\System\iBgcHXe.exe
  C:\Windows\System\iBgcHXe.exe
  2⤵
  PID:6992
- C:\Windows\System\ogJiLoC.exe
  C:\Windows\System\ogJiLoC.exe
  2⤵
  PID:7016
- C:\Windows\System\VUyIktw.exe
  C:\Windows\System\VUyIktw.exe
  2⤵
  PID:7044
- C:\Windows\System\xiGWqaj.exe
  C:\Windows\System\xiGWqaj.exe
  2⤵
  PID:7072
- C:\Windows\System\VhwOcns.exe
  C:\Windows\System\VhwOcns.exe
  2⤵
  PID:7100
- C:\Windows\System\FSmPVNn.exe
  C:\Windows\System\FSmPVNn.exe
  2⤵
  PID:7128
- C:\Windows\System\MEamqHR.exe
  C:\Windows\System\MEamqHR.exe
  2⤵
  PID:7156
- C:\Windows\System\xKHzYpT.exe
  C:\Windows\System\xKHzYpT.exe
  2⤵
  PID:5672
- C:\Windows\System\cAyToTP.exe
  C:\Windows\System\cAyToTP.exe
  2⤵
  PID:5928
- C:\Windows\System\WCtAWFG.exe
  C:\Windows\System\WCtAWFG.exe
  2⤵
  PID:4944
- C:\Windows\System\YvEdtnA.exe
  C:\Windows\System\YvEdtnA.exe
  2⤵
  PID:5420
- C:\Windows\System\hkdnuzL.exe
  C:\Windows\System\hkdnuzL.exe
  2⤵
  PID:4896
- C:\Windows\System\bDjHFfi.exe
  C:\Windows\System\bDjHFfi.exe
  2⤵
  PID:6244
- C:\Windows\System\APOCsIx.exe
  C:\Windows\System\APOCsIx.exe
  2⤵
  PID:6300
- C:\Windows\System\KwRxefE.exe
  C:\Windows\System\KwRxefE.exe
  2⤵
  PID:6336
- C:\Windows\System\MUPjXDg.exe
  C:\Windows\System\MUPjXDg.exe
  2⤵
  PID:6412
- C:\Windows\System\SbLCjBH.exe
  C:\Windows\System\SbLCjBH.exe
  2⤵
  PID:6476
- C:\Windows\System\axWTRgP.exe
  C:\Windows\System\axWTRgP.exe
  2⤵
  PID:6560
- C:\Windows\System\NUhARdD.exe
  C:\Windows\System\NUhARdD.exe
  2⤵
  PID:2964
- C:\Windows\System\iDobrxj.exe
  C:\Windows\System\iDobrxj.exe
  2⤵
  PID:6640
- C:\Windows\System\VEFSGVJ.exe
  C:\Windows\System\VEFSGVJ.exe
  2⤵
  PID:6696
- C:\Windows\System\rzPTlhH.exe
  C:\Windows\System\rzPTlhH.exe
  2⤵
  PID:4260
- C:\Windows\System\KXaZpII.exe
  C:\Windows\System\KXaZpII.exe
  2⤵
  PID:6812
- C:\Windows\System\ATRLdka.exe
  C:\Windows\System\ATRLdka.exe
  2⤵
  PID:6864
- C:\Windows\System\nITElgF.exe
  C:\Windows\System\nITElgF.exe
  2⤵
  PID:6916
- C:\Windows\System\fIvwXVN.exe
  C:\Windows\System\fIvwXVN.exe
  2⤵
  PID:6976
- C:\Windows\System\NzxtpFG.exe
  C:\Windows\System\NzxtpFG.exe
  2⤵
  PID:1560
- C:\Windows\System\UrHYKcx.exe
  C:\Windows\System\UrHYKcx.exe
  2⤵
  PID:3648
- C:\Windows\System\hNfOAtt.exe
  C:\Windows\System\hNfOAtt.exe
  2⤵
  PID:7064
- C:\Windows\System\IXjLqjI.exe
  C:\Windows\System\IXjLqjI.exe
  2⤵
  PID:4232
- C:\Windows\System\tlkYCvf.exe
  C:\Windows\System\tlkYCvf.exe
  2⤵
  PID:7140
- C:\Windows\System\JDvryWS.exe
  C:\Windows\System\JDvryWS.exe
  2⤵
  PID:1280
- C:\Windows\System\TknSyIp.exe
  C:\Windows\System\TknSyIp.exe
  2⤵
  PID:6052
- C:\Windows\System\PGJYmqs.exe
  C:\Windows\System\PGJYmqs.exe
  2⤵
  PID:1572
- C:\Windows\System\VscQHaC.exe
  C:\Windows\System\VscQHaC.exe
  2⤵
  PID:6220
- C:\Windows\System\WymDMLO.exe
  C:\Windows\System\WymDMLO.exe
  2⤵
  PID:2504
- C:\Windows\System\gNoISiK.exe
  C:\Windows\System\gNoISiK.exe
  2⤵
  PID:532
- C:\Windows\System\CJfjmEm.exe
  C:\Windows\System\CJfjmEm.exe
  2⤵
  PID:3900
- C:\Windows\System\qsXFfkK.exe
  C:\Windows\System\qsXFfkK.exe
  2⤵
  PID:1804
- C:\Windows\System\HghWoyS.exe
  C:\Windows\System\HghWoyS.exe
  2⤵
  PID:1628
- C:\Windows\System\zxLtXnX.exe
  C:\Windows\System\zxLtXnX.exe
  2⤵
  PID:3624
- C:\Windows\System\WcFrJpv.exe
  C:\Windows\System\WcFrJpv.exe
  2⤵
  PID:1364
- C:\Windows\System\ePJFIMD.exe
  C:\Windows\System\ePJFIMD.exe
  2⤵
  PID:3924
- C:\Windows\System\CpgJTUk.exe
  C:\Windows\System\CpgJTUk.exe
  2⤵
  PID:6972
- C:\Windows\System\PkNJXey.exe
  C:\Windows\System\PkNJXey.exe
  2⤵
  PID:4964
- C:\Windows\System\hejFyIR.exe
  C:\Windows\System\hejFyIR.exe
  2⤵
  PID:7036
- C:\Windows\System\fEIKGWl.exe
  C:\Windows\System\fEIKGWl.exe
  2⤵
  PID:3052
- C:\Windows\System\DDjTxZL.exe
  C:\Windows\System\DDjTxZL.exe
  2⤵
  PID:6168
- C:\Windows\System\nkblcCE.exe
  C:\Windows\System\nkblcCE.exe
  2⤵
  PID:6196
- C:\Windows\System\NCGUKiQ.exe
  C:\Windows\System\NCGUKiQ.exe
  2⤵
  PID:6392
- C:\Windows\System\rUSfZrE.exe
  C:\Windows\System\rUSfZrE.exe
  2⤵
  PID:64
- C:\Windows\System\kMkZAhr.exe
  C:\Windows\System\kMkZAhr.exe
  2⤵
  PID:2160
- C:\Windows\System\tRoyrPn.exe
  C:\Windows\System\tRoyrPn.exe
  2⤵
  PID:7060
- C:\Windows\System\SCHCnZG.exe
  C:\Windows\System\SCHCnZG.exe
  2⤵
  PID:5044
- C:\Windows\System\caFTdek.exe
  C:\Windows\System\caFTdek.exe
  2⤵
  PID:6272
- C:\Windows\System\rstrTVj.exe
  C:\Windows\System\rstrTVj.exe
  2⤵
  PID:6840
- C:\Windows\System\dPPmAeN.exe
  C:\Windows\System\dPPmAeN.exe
  2⤵
  PID:2732
- C:\Windows\System\khomeRc.exe
  C:\Windows\System\khomeRc.exe
  2⤵
  PID:7192
- C:\Windows\System\ymiWxTJ.exe
  C:\Windows\System\ymiWxTJ.exe
  2⤵
  PID:7232
- C:\Windows\System\mQKfWXv.exe
  C:\Windows\System\mQKfWXv.exe
  2⤵
  PID:7252
- C:\Windows\System\ukLIIwo.exe
  C:\Windows\System\ukLIIwo.exe
  2⤵
  PID:7268
- C:\Windows\System\LcOaklr.exe
  C:\Windows\System\LcOaklr.exe
  2⤵
  PID:7308
- C:\Windows\System\NrVpPjp.exe
  C:\Windows\System\NrVpPjp.exe
  2⤵
  PID:7336
- C:\Windows\System\XdwQtYp.exe
  C:\Windows\System\XdwQtYp.exe
  2⤵
  PID:7360
- C:\Windows\System\DqnclQf.exe
  C:\Windows\System\DqnclQf.exe
  2⤵
  PID:7392
- C:\Windows\System\pRPzpvj.exe
  C:\Windows\System\pRPzpvj.exe
  2⤵
  PID:7412
- C:\Windows\System\WZdCsoL.exe
  C:\Windows\System\WZdCsoL.exe
  2⤵
  PID:7436
- C:\Windows\System\OSvXxkm.exe
  C:\Windows\System\OSvXxkm.exe
  2⤵
  PID:7456
- C:\Windows\System\HTuBVaL.exe
  C:\Windows\System\HTuBVaL.exe
  2⤵
  PID:7476
- C:\Windows\System\jjWngsr.exe
  C:\Windows\System\jjWngsr.exe
  2⤵
  PID:7524
- C:\Windows\System\SQuvDTK.exe
  C:\Windows\System\SQuvDTK.exe
  2⤵
  PID:7548
- C:\Windows\System\DcyMGfR.exe
  C:\Windows\System\DcyMGfR.exe
  2⤵
  PID:7568
- C:\Windows\System\rYVaVbx.exe
  C:\Windows\System\rYVaVbx.exe
  2⤵
  PID:7596
- C:\Windows\System\BjWSbYR.exe
  C:\Windows\System\BjWSbYR.exe
  2⤵
  PID:7648
- C:\Windows\System\wlTAmrj.exe
  C:\Windows\System\wlTAmrj.exe
  2⤵
  PID:7672
- C:\Windows\System\CyIdIFQ.exe
  C:\Windows\System\CyIdIFQ.exe
  2⤵
  PID:7692
- C:\Windows\System\vyjFZcX.exe
  C:\Windows\System\vyjFZcX.exe
  2⤵
  PID:7724
- C:\Windows\System\ZkkKwEX.exe
  C:\Windows\System\ZkkKwEX.exe
  2⤵
  PID:7744
- C:\Windows\System\HDYLhnq.exe
  C:\Windows\System\HDYLhnq.exe
  2⤵
  PID:7784
- C:\Windows\System\RgkeHQb.exe
  C:\Windows\System\RgkeHQb.exe
  2⤵
  PID:7812
- C:\Windows\System\uHeykfR.exe
  C:\Windows\System\uHeykfR.exe
  2⤵
  PID:7852
- C:\Windows\System\GKUVKdt.exe
  C:\Windows\System\GKUVKdt.exe
  2⤵
  PID:7876
- C:\Windows\System\hocBCse.exe
  C:\Windows\System\hocBCse.exe
  2⤵
  PID:7896
- C:\Windows\System\LYuViuo.exe
  C:\Windows\System\LYuViuo.exe
  2⤵
  PID:7916
- C:\Windows\System\TKvabvd.exe
  C:\Windows\System\TKvabvd.exe
  2⤵
  PID:7944
- C:\Windows\System\EvrCDtc.exe
  C:\Windows\System\EvrCDtc.exe
  2⤵
  PID:7972
- C:\Windows\System\mntXNTq.exe
  C:\Windows\System\mntXNTq.exe
  2⤵
  PID:8000
- C:\Windows\System\JktbyPd.exe
  C:\Windows\System\JktbyPd.exe
  2⤵
  PID:8024
- C:\Windows\System\YmhBRoz.exe
  C:\Windows\System\YmhBRoz.exe
  2⤵
  PID:8048
- C:\Windows\System\vsyiaOU.exe
  C:\Windows\System\vsyiaOU.exe
  2⤵
  PID:8100
- C:\Windows\System\RRKMmkE.exe
  C:\Windows\System\RRKMmkE.exe
  2⤵
  PID:8120
- C:\Windows\System\qgDcRWR.exe
  C:\Windows\System\qgDcRWR.exe
  2⤵
  PID:8140
- C:\Windows\System\LjWNncz.exe
  C:\Windows\System\LjWNncz.exe
  2⤵
  PID:8168
- C:\Windows\System\nSUQELq.exe
  C:\Windows\System\nSUQELq.exe
  2⤵
  PID:6216
- C:\Windows\System\NAcYJjW.exe
  C:\Windows\System\NAcYJjW.exe
  2⤵
  PID:4188
- C:\Windows\System\mXuyqNn.exe
  C:\Windows\System\mXuyqNn.exe
  2⤵
  PID:7240
- C:\Windows\System\gUkawJj.exe
  C:\Windows\System\gUkawJj.exe
  2⤵
  PID:7372
- C:\Windows\System\bhhgUXM.exe
  C:\Windows\System\bhhgUXM.exe
  2⤵
  PID:7408
- C:\Windows\System\molZgNI.exe
  C:\Windows\System\molZgNI.exe
  2⤵
  PID:7496
- C:\Windows\System\JqXsamH.exe
  C:\Windows\System\JqXsamH.exe
  2⤵
  PID:7492
- C:\Windows\System\XXmcxiz.exe
  C:\Windows\System\XXmcxiz.exe
  2⤵
  PID:7564
- C:\Windows\System\AmGSOHq.exe
  C:\Windows\System\AmGSOHq.exe
  2⤵
  PID:7668
- C:\Windows\System\LOsBpoi.exe
  C:\Windows\System\LOsBpoi.exe
  2⤵
  PID:7760
- C:\Windows\System\VZzLXTj.exe
  C:\Windows\System\VZzLXTj.exe
  2⤵
  PID:7772
- C:\Windows\System\FGvGvhX.exe
  C:\Windows\System\FGvGvhX.exe
  2⤵
  PID:7836
- C:\Windows\System\GBeKwhM.exe
  C:\Windows\System\GBeKwhM.exe
  2⤵
  PID:7884
- C:\Windows\System\sqFKorh.exe
  C:\Windows\System\sqFKorh.exe
  2⤵
  PID:7952
- C:\Windows\System\XtQZZJU.exe
  C:\Windows\System\XtQZZJU.exe
  2⤵
  PID:8040
- C:\Windows\System\mkCyrRi.exe
  C:\Windows\System\mkCyrRi.exe
  2⤵
  PID:8108
- C:\Windows\System\QYpdRmB.exe
  C:\Windows\System\QYpdRmB.exe
  2⤵
  PID:8148
- C:\Windows\System\dCrdbUr.exe
  C:\Windows\System\dCrdbUr.exe
  2⤵
  PID:8160
- C:\Windows\System\HgWcsjt.exe
  C:\Windows\System\HgWcsjt.exe
  2⤵
  PID:7384
- C:\Windows\System\EDhciwS.exe
  C:\Windows\System\EDhciwS.exe
  2⤵
  PID:7540
- C:\Windows\System\opZpLaJ.exe
  C:\Windows\System\opZpLaJ.exe
  2⤵
  PID:7620
- C:\Windows\System\XbzrLzL.exe
  C:\Windows\System\XbzrLzL.exe
  2⤵
  PID:7740
- C:\Windows\System\CixoiAN.exe
  C:\Windows\System\CixoiAN.exe
  2⤵
  PID:8056
- C:\Windows\System\skvrqCo.exe
  C:\Windows\System\skvrqCo.exe
  2⤵
  PID:8184
- C:\Windows\System\TmXYSly.exe
  C:\Windows\System\TmXYSly.exe
  2⤵
  PID:7304
- C:\Windows\System\MEaUmUo.exe
  C:\Windows\System\MEaUmUo.exe
  2⤵
  PID:7656
- C:\Windows\System\Uvfjijd.exe
  C:\Windows\System\Uvfjijd.exe
  2⤵
  PID:8016
- C:\Windows\System\MRqkUoI.exe
  C:\Windows\System\MRqkUoI.exe
  2⤵
  PID:8220
- C:\Windows\System\eYzAUjb.exe
  C:\Windows\System\eYzAUjb.exe
  2⤵
  PID:8236
- C:\Windows\System\EZcqWoZ.exe
  C:\Windows\System\EZcqWoZ.exe
  2⤵
  PID:8280
- C:\Windows\System\kPABiAF.exe
  C:\Windows\System\kPABiAF.exe
  2⤵
  PID:8300
- C:\Windows\System\TlIJwet.exe
  C:\Windows\System\TlIJwet.exe
  2⤵
  PID:8320
- C:\Windows\System\cQQcyPX.exe
  C:\Windows\System\cQQcyPX.exe
  2⤵
  PID:8340
- C:\Windows\System\CDlRsoN.exe
  C:\Windows\System\CDlRsoN.exe
  2⤵
  PID:8356
- C:\Windows\System\rJzcZdA.exe
  C:\Windows\System\rJzcZdA.exe
  2⤵
  PID:8376
- C:\Windows\System\VBXcdUA.exe
  C:\Windows\System\VBXcdUA.exe
  2⤵
  PID:8400
- C:\Windows\System\IbAZfQW.exe
  C:\Windows\System\IbAZfQW.exe
  2⤵
  PID:8416
- C:\Windows\System\EhcLTLt.exe
  C:\Windows\System\EhcLTLt.exe
  2⤵
  PID:8448
- C:\Windows\System\qfbVJAc.exe
  C:\Windows\System\qfbVJAc.exe
  2⤵
  PID:8468
- C:\Windows\System\QBjaiGY.exe
  C:\Windows\System\QBjaiGY.exe
  2⤵
  PID:8536
- C:\Windows\System\mTDxpYz.exe
  C:\Windows\System\mTDxpYz.exe
  2⤵
  PID:8568
- C:\Windows\System\Cbdmdqx.exe
  C:\Windows\System\Cbdmdqx.exe
  2⤵
  PID:8588
- C:\Windows\System\esvAXQa.exe
  C:\Windows\System\esvAXQa.exe
  2⤵
  PID:8632
- C:\Windows\System\CuSEpEG.exe
  C:\Windows\System\CuSEpEG.exe
  2⤵
  PID:8648
- C:\Windows\System\SflWZFv.exe
  C:\Windows\System\SflWZFv.exe
  2⤵
  PID:8668
- C:\Windows\System\AeguikT.exe
  C:\Windows\System\AeguikT.exe
  2⤵
  PID:8692
- C:\Windows\System\PdhzOYq.exe
  C:\Windows\System\PdhzOYq.exe
  2⤵
  PID:8720
- C:\Windows\System\RIisCmG.exe
  C:\Windows\System\RIisCmG.exe
  2⤵
  PID:8744
- C:\Windows\System\aXrEHgs.exe
  C:\Windows\System\aXrEHgs.exe
  2⤵
  PID:8760
- C:\Windows\System\qxHrEGA.exe
  C:\Windows\System\qxHrEGA.exe
  2⤵
  PID:8788
- C:\Windows\System\vWrdFIb.exe
  C:\Windows\System\vWrdFIb.exe
  2⤵
  PID:8808
- C:\Windows\System\LJfkrwH.exe
  C:\Windows\System\LJfkrwH.exe
  2⤵
  PID:8844
- C:\Windows\System\ArSgnpk.exe
  C:\Windows\System\ArSgnpk.exe
  2⤵
  PID:8904
- C:\Windows\System\WqcZdMB.exe
  C:\Windows\System\WqcZdMB.exe
  2⤵
  PID:8944
- C:\Windows\System\mdLsuWv.exe
  C:\Windows\System\mdLsuWv.exe
  2⤵
  PID:8960
- C:\Windows\System\UBekIDA.exe
  C:\Windows\System\UBekIDA.exe
  2⤵
  PID:8992
- C:\Windows\System\ZehLkph.exe
  C:\Windows\System\ZehLkph.exe
  2⤵
  PID:9028
- C:\Windows\System\lbUmGct.exe
  C:\Windows\System\lbUmGct.exe
  2⤵
  PID:9060
- C:\Windows\System\fOjeXtn.exe
  C:\Windows\System\fOjeXtn.exe
  2⤵
  PID:9080
- C:\Windows\System\OVdhAQZ.exe
  C:\Windows\System\OVdhAQZ.exe
  2⤵
  PID:9096
- C:\Windows\System\JfZhHpZ.exe
  C:\Windows\System\JfZhHpZ.exe
  2⤵
  PID:9116
- C:\Windows\System\pNoWrzx.exe
  C:\Windows\System\pNoWrzx.exe
  2⤵
  PID:9136
- C:\Windows\System\PgHwJGu.exe
  C:\Windows\System\PgHwJGu.exe
  2⤵
  PID:9160
- C:\Windows\System\IeJsLlu.exe
  C:\Windows\System\IeJsLlu.exe
  2⤵
  PID:9184
- C:\Windows\System\rfzxNrX.exe
  C:\Windows\System\rfzxNrX.exe
  2⤵
  PID:9200
- C:\Windows\System\ogQpUZm.exe
  C:\Windows\System\ogQpUZm.exe
  2⤵
  PID:7432
- C:\Windows\System\IQXQtQo.exe
  C:\Windows\System\IQXQtQo.exe
  2⤵
  PID:8232
- C:\Windows\System\qqjFWJL.exe
  C:\Windows\System\qqjFWJL.exe
  2⤵
  PID:8332
- C:\Windows\System\CptpSDV.exe
  C:\Windows\System\CptpSDV.exe
  2⤵
  PID:8392
- C:\Windows\System\MPvCdwC.exe
  C:\Windows\System\MPvCdwC.exe
  2⤵
  PID:8504
- C:\Windows\System\KbHqsPR.exe
  C:\Windows\System\KbHqsPR.exe
  2⤵
  PID:8576
- C:\Windows\System\qQzZZPl.exe
  C:\Windows\System\qQzZZPl.exe
  2⤵
  PID:8644
- C:\Windows\System\bReApOS.exe
  C:\Windows\System\bReApOS.exe
  2⤵
  PID:8704
- C:\Windows\System\LApbTZI.exe
  C:\Windows\System\LApbTZI.exe
  2⤵
  PID:8736
- C:\Windows\System\IYXPdlg.exe
  C:\Windows\System\IYXPdlg.exe
  2⤵
  PID:8840
- C:\Windows\System\PRxKnfX.exe
  C:\Windows\System\PRxKnfX.exe
  2⤵
  PID:8864
- C:\Windows\System\kVVTlsa.exe
  C:\Windows\System\kVVTlsa.exe
  2⤵
  PID:8884
- C:\Windows\System\msbtDuK.exe
  C:\Windows\System\msbtDuK.exe
  2⤵
  PID:8984
- C:\Windows\System\qSgCsrm.exe
  C:\Windows\System\qSgCsrm.exe
  2⤵
  PID:9052
- C:\Windows\System\jdnkYbQ.exe
  C:\Windows\System\jdnkYbQ.exe
  2⤵
  PID:9092
- C:\Windows\System\kVdNzsE.exe
  C:\Windows\System\kVdNzsE.exe
  2⤵
  PID:8196
- C:\Windows\System\upuphLG.exe
  C:\Windows\System\upuphLG.exe
  2⤵
  PID:8384
- C:\Windows\System\HHZUtmV.exe
  C:\Windows\System\HHZUtmV.exe
  2⤵
  PID:8604
- C:\Windows\System\BAkuHRo.exe
  C:\Windows\System\BAkuHRo.exe
  2⤵
  PID:8728
- C:\Windows\System\JxFuVFe.exe
  C:\Windows\System\JxFuVFe.exe
  2⤵
  PID:8924
- C:\Windows\System\lwaujXS.exe
  C:\Windows\System\lwaujXS.exe
  2⤵
  PID:8956
- C:\Windows\System\XPXDgpE.exe
  C:\Windows\System\XPXDgpE.exe
  2⤵
  PID:8388
- C:\Windows\System\eCZFqPA.exe
  C:\Windows\System\eCZFqPA.exe
  2⤵
  PID:8688
- C:\Windows\System\RDrxRun.exe
  C:\Windows\System\RDrxRun.exe
  2⤵
  PID:8892
- C:\Windows\System\uOTaroC.exe
  C:\Windows\System\uOTaroC.exe
  2⤵
  PID:8368
- C:\Windows\System\algVEiu.exe
  C:\Windows\System\algVEiu.exe
  2⤵
  PID:8272
- C:\Windows\System\MCrKOLw.exe
  C:\Windows\System\MCrKOLw.exe
  2⤵
  PID:9220
- C:\Windows\System\GMRceHJ.exe
  C:\Windows\System\GMRceHJ.exe
  2⤵
  PID:9280
- C:\Windows\System\HGHOWtc.exe
  C:\Windows\System\HGHOWtc.exe
  2⤵
  PID:9304
- C:\Windows\System\IBhYSzF.exe
  C:\Windows\System\IBhYSzF.exe
  2⤵
  PID:9340
- C:\Windows\System\jNxzMeX.exe
  C:\Windows\System\jNxzMeX.exe
  2⤵
  PID:9368
- C:\Windows\System\KKHyiOa.exe
  C:\Windows\System\KKHyiOa.exe
  2⤵
  PID:9388
- C:\Windows\System\jnFnurS.exe
  C:\Windows\System\jnFnurS.exe
  2⤵
  PID:9408
- C:\Windows\System\LEscXmL.exe
  C:\Windows\System\LEscXmL.exe
  2⤵
  PID:9432
- C:\Windows\System\zbJDPRp.exe
  C:\Windows\System\zbJDPRp.exe
  2⤵
  PID:9452
- C:\Windows\System\ygyBeDC.exe
  C:\Windows\System\ygyBeDC.exe
  2⤵
  PID:9508
- C:\Windows\System\KuWHlhf.exe
  C:\Windows\System\KuWHlhf.exe
  2⤵
  PID:9528
- C:\Windows\System\gvDQqmX.exe
  C:\Windows\System\gvDQqmX.exe
  2⤵
  PID:9548
- C:\Windows\System\cWEHwVr.exe
  C:\Windows\System\cWEHwVr.exe
  2⤵
  PID:9572
- C:\Windows\System\FBjzBHi.exe
  C:\Windows\System\FBjzBHi.exe
  2⤵
  PID:9604
- C:\Windows\System\FXMifSi.exe
  C:\Windows\System\FXMifSi.exe
  2⤵
  PID:9624
- C:\Windows\System\Vmunuyi.exe
  C:\Windows\System\Vmunuyi.exe
  2⤵
  PID:9668
- C:\Windows\System\CKkeUkk.exe
  C:\Windows\System\CKkeUkk.exe
  2⤵
  PID:9688
- C:\Windows\System\VchbslJ.exe
  C:\Windows\System\VchbslJ.exe
  2⤵
  PID:9716
- C:\Windows\System\QEGfcii.exe
  C:\Windows\System\QEGfcii.exe
  2⤵
  PID:9744
- C:\Windows\System\CYbOGGH.exe
  C:\Windows\System\CYbOGGH.exe
  2⤵
  PID:9836
- C:\Windows\System\VHkBjXf.exe
  C:\Windows\System\VHkBjXf.exe
  2⤵
  PID:9852
- C:\Windows\System\sxXtIAF.exe
  C:\Windows\System\sxXtIAF.exe
  2⤵
  PID:9868
- C:\Windows\System\IohsoLF.exe
  C:\Windows\System\IohsoLF.exe
  2⤵
  PID:9884
- C:\Windows\System\dKgyONJ.exe
  C:\Windows\System\dKgyONJ.exe
  2⤵
  PID:9900
- C:\Windows\System\xxxtSGx.exe
  C:\Windows\System\xxxtSGx.exe
  2⤵
  PID:9916
- C:\Windows\System\UxjkpSs.exe
  C:\Windows\System\UxjkpSs.exe
  2⤵
  PID:9932
- C:\Windows\System\DOKcaoc.exe
  C:\Windows\System\DOKcaoc.exe
  2⤵
  PID:9948
- C:\Windows\System\MXYtvwv.exe
  C:\Windows\System\MXYtvwv.exe
  2⤵
  PID:9968
- C:\Windows\System\XEEjeto.exe
  C:\Windows\System\XEEjeto.exe
  2⤵
  PID:10016
- C:\Windows\System\wGxcECZ.exe
  C:\Windows\System\wGxcECZ.exe
  2⤵
  PID:10088
- C:\Windows\System\XCTPcXN.exe
  C:\Windows\System\XCTPcXN.exe
  2⤵
  PID:10104
- C:\Windows\System\lzCcyQw.exe
  C:\Windows\System\lzCcyQw.exe
  2⤵
  PID:10120
- C:\Windows\System\EPPghZm.exe
  C:\Windows\System\EPPghZm.exe
  2⤵
  PID:10136
- C:\Windows\System\nbcprir.exe
  C:\Windows\System\nbcprir.exe
  2⤵
  PID:10152
- C:\Windows\System\iPIDmui.exe
  C:\Windows\System\iPIDmui.exe
  2⤵
  PID:10168
- C:\Windows\System\ulaGNJl.exe
  C:\Windows\System\ulaGNJl.exe
  2⤵
  PID:10184
- C:\Windows\System\jsjxDEc.exe
  C:\Windows\System\jsjxDEc.exe
  2⤵
  PID:9476
- C:\Windows\System\XCPEBPE.exe
  C:\Windows\System\XCPEBPE.exe
  2⤵
  PID:9564
- C:\Windows\System\eTIDwVg.exe
  C:\Windows\System\eTIDwVg.exe
  2⤵
  PID:9616
- C:\Windows\System\TMRNCrt.exe
  C:\Windows\System\TMRNCrt.exe
  2⤵
  PID:9712
- C:\Windows\System\Bfcrmas.exe
  C:\Windows\System\Bfcrmas.exe
  2⤵
  PID:9800
- C:\Windows\System\bIwTFyE.exe
  C:\Windows\System\bIwTFyE.exe
  2⤵
  PID:9740
- C:\Windows\System\XgUesDE.exe
  C:\Windows\System\XgUesDE.exe
  2⤵
  PID:9776
- C:\Windows\System\FvHKiHl.exe
  C:\Windows\System\FvHKiHl.exe
  2⤵
  PID:9892
- C:\Windows\System\mKcHJfM.exe
  C:\Windows\System\mKcHJfM.exe
  2⤵
  PID:9956
- C:\Windows\System\bCgeSOh.exe
  C:\Windows\System\bCgeSOh.exe
  2⤵
  PID:10076
- C:\Windows\System\ZCWdqVP.exe
  C:\Windows\System\ZCWdqVP.exe
  2⤵
  PID:10100
- C:\Windows\System\gOEGWTc.exe
  C:\Windows\System\gOEGWTc.exe
  2⤵
  PID:9860
- C:\Windows\System\ZCIxliW.exe
  C:\Windows\System\ZCIxliW.exe
  2⤵
  PID:10004
- C:\Windows\System\tqtoiRl.exe
  C:\Windows\System\tqtoiRl.exe
  2⤵
  PID:10128
- C:\Windows\System\JcWgtuf.exe
  C:\Windows\System\JcWgtuf.exe
  2⤵
  PID:10164
- C:\Windows\System\ZfHkXUx.exe
  C:\Windows\System\ZfHkXUx.exe
  2⤵
  PID:9356
- C:\Windows\System\bZDPyKL.exe
  C:\Windows\System\bZDPyKL.exe
  2⤵
  PID:9540
- C:\Windows\System\AwWMkCv.exe
  C:\Windows\System\AwWMkCv.exe
  2⤵
  PID:9984
- C:\Windows\System\tDkfLpz.exe
  C:\Windows\System\tDkfLpz.exe
  2⤵
  PID:9732
- C:\Windows\System\LAvHmVy.exe
  C:\Windows\System\LAvHmVy.exe
  2⤵
  PID:10008
- C:\Windows\System\LnVrLfZ.exe
  C:\Windows\System\LnVrLfZ.exe
  2⤵
  PID:10068
- C:\Windows\System\BUYwnWW.exe
  C:\Windows\System\BUYwnWW.exe
  2⤵
  PID:9992
- C:\Windows\System\WHnxCzQ.exe
  C:\Windows\System\WHnxCzQ.exe
  2⤵
  PID:9228
- C:\Windows\System\ulTMTfp.exe
  C:\Windows\System\ulTMTfp.exe
  2⤵
  PID:9332
- C:\Windows\System\vxmUqyt.exe
  C:\Windows\System\vxmUqyt.exe
  2⤵
  PID:10000
- C:\Windows\System\QzahmGL.exe
  C:\Windows\System\QzahmGL.exe
  2⤵
  PID:9380
- C:\Windows\System\XcIlNey.exe
  C:\Windows\System\XcIlNey.exe
  2⤵
  PID:9728
- C:\Windows\System\xVqDIsA.exe
  C:\Windows\System\xVqDIsA.exe
  2⤵
  PID:10252
- C:\Windows\System\lYWiClj.exe
  C:\Windows\System\lYWiClj.exe
  2⤵
  PID:10276
- C:\Windows\System\QoAduOo.exe
  C:\Windows\System\QoAduOo.exe
  2⤵
  PID:10300
- C:\Windows\System\GJfJkin.exe
  C:\Windows\System\GJfJkin.exe
  2⤵
  PID:10352
- C:\Windows\System\zoCcvUL.exe
  C:\Windows\System\zoCcvUL.exe
  2⤵
  PID:10368
- C:\Windows\System\OGtahgz.exe
  C:\Windows\System\OGtahgz.exe
  2⤵
  PID:10392
- C:\Windows\System\BWYjtAJ.exe
  C:\Windows\System\BWYjtAJ.exe
  2⤵
  PID:10412
- C:\Windows\System\pqMmEwQ.exe
  C:\Windows\System\pqMmEwQ.exe
  2⤵
  PID:10432
- C:\Windows\System\EJLvYze.exe
  C:\Windows\System\EJLvYze.exe
  2⤵
  PID:10460
- C:\Windows\System\ijFQBqV.exe
  C:\Windows\System\ijFQBqV.exe
  2⤵
  PID:10488
- C:\Windows\System\jyLutEo.exe
  C:\Windows\System\jyLutEo.exe
  2⤵
  PID:10512
- C:\Windows\System\lWJGykI.exe
  C:\Windows\System\lWJGykI.exe
  2⤵
  PID:10548
- C:\Windows\System\JgvMXaf.exe
  C:\Windows\System\JgvMXaf.exe
  2⤵
  PID:10584
- C:\Windows\System\WwJyLtv.exe
  C:\Windows\System\WwJyLtv.exe
  2⤵
  PID:10604
- C:\Windows\System\pCDwkvJ.exe
  C:\Windows\System\pCDwkvJ.exe
  2⤵
  PID:10624
- C:\Windows\System\aLCLLpI.exe
  C:\Windows\System\aLCLLpI.exe
  2⤵
  PID:10652
- C:\Windows\System\ljOGQQW.exe
  C:\Windows\System\ljOGQQW.exe
  2⤵
  PID:10676
- C:\Windows\System\PkcuNtg.exe
  C:\Windows\System\PkcuNtg.exe
  2⤵
  PID:10692
- C:\Windows\System\gpgVbLi.exe
  C:\Windows\System\gpgVbLi.exe
  2⤵
  PID:10716
- C:\Windows\System\SpyIuvA.exe
  C:\Windows\System\SpyIuvA.exe
  2⤵
  PID:10736
- C:\Windows\System\LGsTZit.exe
  C:\Windows\System\LGsTZit.exe
  2⤵
  PID:10756
- C:\Windows\System\QJHyRtd.exe
  C:\Windows\System\QJHyRtd.exe
  2⤵
  PID:10776
- C:\Windows\System\nFmuHwS.exe
  C:\Windows\System\nFmuHwS.exe
  2⤵
  PID:10824
- C:\Windows\System\ATfmVen.exe
  C:\Windows\System\ATfmVen.exe
  2⤵
  PID:10880
- C:\Windows\System\RZqzFyo.exe
  C:\Windows\System\RZqzFyo.exe
  2⤵
  PID:10904
- C:\Windows\System\XDReHYy.exe
  C:\Windows\System\XDReHYy.exe
  2⤵
  PID:10924
- C:\Windows\System\oOMcjSX.exe
  C:\Windows\System\oOMcjSX.exe
  2⤵
  PID:10948
- C:\Windows\System\BAFmSoa.exe
  C:\Windows\System\BAFmSoa.exe
  2⤵
  PID:10968
- C:\Windows\System\tFdqMwl.exe
  C:\Windows\System\tFdqMwl.exe
  2⤵
  PID:10996
- C:\Windows\System\lDtfJpq.exe
  C:\Windows\System\lDtfJpq.exe
  2⤵
  PID:11048
- C:\Windows\System\qpSYOat.exe
  C:\Windows\System\qpSYOat.exe
  2⤵
  PID:11068
- C:\Windows\System\vqlgHtI.exe
  C:\Windows\System\vqlgHtI.exe
  2⤵
  PID:11088
- C:\Windows\System\UuntPPR.exe
  C:\Windows\System\UuntPPR.exe
  2⤵
  PID:11120
- C:\Windows\System\nGjONlL.exe
  C:\Windows\System\nGjONlL.exe
  2⤵
  PID:11160
- C:\Windows\System\WbSrVtL.exe
  C:\Windows\System\WbSrVtL.exe
  2⤵
  PID:11212
- C:\Windows\System\LcBvQNS.exe
  C:\Windows\System\LcBvQNS.exe
  2⤵
  PID:11240
- C:\Windows\System\BSphqtJ.exe
  C:\Windows\System\BSphqtJ.exe
  2⤵
  PID:10096
- C:\Windows\System\ZbCLcqC.exe
  C:\Windows\System\ZbCLcqC.exe
  2⤵
  PID:10328
- C:\Windows\System\YnkubXY.exe
  C:\Windows\System\YnkubXY.exe
  2⤵
  PID:10360
- C:\Windows\System\CPrWpEn.exe
  C:\Windows\System\CPrWpEn.exe
  2⤵
  PID:10424
- C:\Windows\System\SKIGDWZ.exe
  C:\Windows\System\SKIGDWZ.exe
  2⤵
  PID:10508
- C:\Windows\System\ceWVQrQ.exe
  C:\Windows\System\ceWVQrQ.exe
  2⤵
  PID:10540
- C:\Windows\System\TwKKpiB.exe
  C:\Windows\System\TwKKpiB.exe
  2⤵
  PID:10576
- C:\Windows\System\SieVmyl.exe
  C:\Windows\System\SieVmyl.exe
  2⤵
  PID:10708
- C:\Windows\System\cQLvSMu.exe
  C:\Windows\System\cQLvSMu.exe
  2⤵
  PID:10752
- C:\Windows\System\eMAKWtR.exe
  C:\Windows\System\eMAKWtR.exe
  2⤵
  PID:10768
- C:\Windows\System\TlsqiJT.exe
  C:\Windows\System\TlsqiJT.exe
  2⤵
  PID:10860
- C:\Windows\System\iMuFKTk.exe
  C:\Windows\System\iMuFKTk.exe
  2⤵
  PID:10892
- C:\Windows\System\MhHoFVA.exe
  C:\Windows\System\MhHoFVA.exe
  2⤵
  PID:4340
- C:\Windows\System\kdlbJIo.exe
  C:\Windows\System\kdlbJIo.exe
  2⤵
  PID:11028
- C:\Windows\System\dzQrPXK.exe
  C:\Windows\System\dzQrPXK.exe
  2⤵
  PID:11136
- C:\Windows\System\FpvCCpf.exe
  C:\Windows\System\FpvCCpf.exe
  2⤵
  PID:11204
- C:\Windows\System\VrOzAvm.exe
  C:\Windows\System\VrOzAvm.exe
  2⤵
  PID:11232
- C:\Windows\System\ySXDcEo.exe
  C:\Windows\System\ySXDcEo.exe
  2⤵
  PID:10384
- C:\Windows\System\ZsxPjoO.exe
  C:\Windows\System\ZsxPjoO.exe
  2⤵
  PID:10448
- C:\Windows\System\TSOVWBm.exe
  C:\Windows\System\TSOVWBm.exe
  2⤵
  PID:10704
- C:\Windows\System\pAKdAQy.exe
  C:\Windows\System\pAKdAQy.exe
  2⤵
  PID:10888
- C:\Windows\System\hMYftBi.exe
  C:\Windows\System\hMYftBi.exe
  2⤵
  PID:3668
- C:\Windows\System\cwWMiAP.exe
  C:\Windows\System\cwWMiAP.exe
  2⤵
  PID:11056
- C:\Windows\System\RRFjDHD.exe
  C:\Windows\System\RRFjDHD.exe
  2⤵
  PID:10292
- C:\Windows\System\cuMiKMg.exe
  C:\Windows\System\cuMiKMg.exe
  2⤵
  PID:10336
- C:\Windows\System\qUklHnf.exe
  C:\Windows\System\qUklHnf.exe
  2⤵
  PID:10688
- C:\Windows\System\btSsRnb.exe
  C:\Windows\System\btSsRnb.exe
  2⤵
  PID:10980
- C:\Windows\System\rKgEEjf.exe
  C:\Windows\System\rKgEEjf.exe
  2⤵
  PID:11260
- C:\Windows\System\IrRUDbR.exe
  C:\Windows\System\IrRUDbR.exe
  2⤵
  PID:11308
- C:\Windows\System\CFaiusd.exe
  C:\Windows\System\CFaiusd.exe
  2⤵
  PID:11328
- C:\Windows\System\tEdLhCU.exe
  C:\Windows\System\tEdLhCU.exe
  2⤵
  PID:11352
- C:\Windows\System\pjBSpHt.exe
  C:\Windows\System\pjBSpHt.exe
  2⤵
  PID:11380
- C:\Windows\System\oLzlcka.exe
  C:\Windows\System\oLzlcka.exe
  2⤵
  PID:11400
- C:\Windows\System\XvJCSJt.exe
  C:\Windows\System\XvJCSJt.exe
  2⤵
  PID:11420
- C:\Windows\System\kQTfjSP.exe
  C:\Windows\System\kQTfjSP.exe
  2⤵
  PID:11448
- C:\Windows\System\bCzVTkk.exe
  C:\Windows\System\bCzVTkk.exe
  2⤵
  PID:11468
- C:\Windows\System\hQYBbck.exe
  C:\Windows\System\hQYBbck.exe
  2⤵
  PID:11520
- C:\Windows\System\uECRASt.exe
  C:\Windows\System\uECRASt.exe
  2⤵
  PID:11540
- C:\Windows\System\ejfoZPI.exe
  C:\Windows\System\ejfoZPI.exe
  2⤵
  PID:11604
- C:\Windows\System\lACZhcK.exe
  C:\Windows\System\lACZhcK.exe
  2⤵
  PID:11624
- C:\Windows\System\xIahUNN.exe
  C:\Windows\System\xIahUNN.exe
  2⤵
  PID:11648
- C:\Windows\System\XGNJqEZ.exe
  C:\Windows\System\XGNJqEZ.exe
  2⤵
  PID:11668
- C:\Windows\System\dsSMRSw.exe
  C:\Windows\System\dsSMRSw.exe
  2⤵
  PID:11692
- C:\Windows\System\ijgmPuP.exe
  C:\Windows\System\ijgmPuP.exe
  2⤵
  PID:11732
- C:\Windows\System\NZsgBOG.exe
  C:\Windows\System\NZsgBOG.exe
  2⤵
  PID:11756
- C:\Windows\System\IMqWNlJ.exe
  C:\Windows\System\IMqWNlJ.exe
  2⤵
  PID:11800
- C:\Windows\System\kmXEjzg.exe
  C:\Windows\System\kmXEjzg.exe
  2⤵
  PID:11816
- C:\Windows\System\fQUEJoz.exe
  C:\Windows\System\fQUEJoz.exe
  2⤵
  PID:11848
- C:\Windows\System\LtQUOAM.exe
  C:\Windows\System\LtQUOAM.exe
  2⤵
  PID:11872
- C:\Windows\System\iktxgup.exe
  C:\Windows\System\iktxgup.exe
  2⤵
  PID:11896
- C:\Windows\System\ePeiOZG.exe
  C:\Windows\System\ePeiOZG.exe
  2⤵
  PID:11928
- C:\Windows\System\EGxNuXW.exe
  C:\Windows\System\EGxNuXW.exe
  2⤵
  PID:11956
- C:\Windows\System\QVufbbu.exe
  C:\Windows\System\QVufbbu.exe
  2⤵
  PID:11984
- C:\Windows\System\lnHhWSy.exe
  C:\Windows\System\lnHhWSy.exe
  2⤵
  PID:12012
- C:\Windows\System\qQAvbUH.exe
  C:\Windows\System\qQAvbUH.exe
  2⤵
  PID:12032
- C:\Windows\System\khWvtYU.exe
  C:\Windows\System\khWvtYU.exe
  2⤵
  PID:12072
- C:\Windows\System\gaBxGlR.exe
  C:\Windows\System\gaBxGlR.exe
  2⤵
  PID:12088
- C:\Windows\System\BOSIdQp.exe
  C:\Windows\System\BOSIdQp.exe
  2⤵
  PID:12116
- C:\Windows\System\imlybTI.exe
  C:\Windows\System\imlybTI.exe
  2⤵
  PID:12136
- C:\Windows\System\KPbKiUc.exe
  C:\Windows\System\KPbKiUc.exe
  2⤵
  PID:12156
- C:\Windows\System\EfFKPea.exe
  C:\Windows\System\EfFKPea.exe
  2⤵
  PID:12176
- C:\Windows\System\uEsnYCv.exe
  C:\Windows\System\uEsnYCv.exe
  2⤵
  PID:12200
- C:\Windows\System\JDnZjzk.exe
  C:\Windows\System\JDnZjzk.exe
  2⤵
  PID:12228
- C:\Windows\System\VaoeABX.exe
  C:\Windows\System\VaoeABX.exe
  2⤵
  PID:12252
- C:\Windows\System\dPsNMcv.exe
  C:\Windows\System\dPsNMcv.exe
  2⤵
  PID:12272
- C:\Windows\System\qegmCBL.exe
  C:\Windows\System\qegmCBL.exe
  2⤵
  PID:11288
- C:\Windows\System\BWswUgM.exe
  C:\Windows\System\BWswUgM.exe
  2⤵
  PID:10940
- C:\Windows\System\xnNbyUk.exe
  C:\Windows\System\xnNbyUk.exe
  2⤵
  PID:11344
- C:\Windows\System\uSeRhxp.exe
  C:\Windows\System\uSeRhxp.exe
  2⤵
  PID:11500
- C:\Windows\System\sHaptEz.exe
  C:\Windows\System\sHaptEz.exe
  2⤵
  PID:11532
- C:\Windows\System\JwVKiIc.exe
  C:\Windows\System\JwVKiIc.exe
  2⤵
  PID:11616
- C:\Windows\System\qjZbmBG.exe
  C:\Windows\System\qjZbmBG.exe
  2⤵
  PID:11676
- C:\Windows\System\xZSMWgF.exe
  C:\Windows\System\xZSMWgF.exe
  2⤵
  PID:11784
- C:\Windows\System\oTMfIIU.exe
  C:\Windows\System\oTMfIIU.exe
  2⤵
  PID:11812
- C:\Windows\System\vGFSVZy.exe
  C:\Windows\System\vGFSVZy.exe
  2⤵
  PID:11868
- C:\Windows\System\lWGiWvu.exe
  C:\Windows\System\lWGiWvu.exe
  2⤵
  PID:11944
- C:\Windows\System\ELMZXyM.exe
  C:\Windows\System\ELMZXyM.exe
  2⤵
  PID:11996
- C:\Windows\System\AGHUhDT.exe
  C:\Windows\System\AGHUhDT.exe
  2⤵
  PID:12084
- C:\Windows\System\TcuHlQd.exe
  C:\Windows\System\TcuHlQd.exe
  2⤵
  PID:12124
- C:\Windows\System\lZVvJFb.exe
  C:\Windows\System\lZVvJFb.exe
  2⤵
  PID:12236
- C:\Windows\System\pEgjIIs.exe
  C:\Windows\System\pEgjIIs.exe
  2⤵
  PID:12196
- C:\Windows\System\DXfIbIj.exe
  C:\Windows\System\DXfIbIj.exe
  2⤵
  PID:4436
- C:\Windows\System\qPKYgPQ.exe
  C:\Windows\System\qPKYgPQ.exe
  2⤵
  PID:10816
- C:\Windows\System\XlYxxPj.exe
  C:\Windows\System\XlYxxPj.exe
  2⤵
  PID:11388
- C:\Windows\System\TNnTGAa.exe
  C:\Windows\System\TNnTGAa.exe
  2⤵
  PID:11580
- C:\Windows\System\ogFCujH.exe
  C:\Windows\System\ogFCujH.exe
  2⤵
  PID:11664
- C:\Windows\System\BrZButG.exe
  C:\Windows\System\BrZButG.exe
  2⤵
  PID:11640
- C:\Windows\System\sURXPbA.exe
  C:\Windows\System\sURXPbA.exe
  2⤵
  PID:8
- C:\Windows\System\FAwhfvs.exe
  C:\Windows\System\FAwhfvs.exe
  2⤵
  PID:12024
- C:\Windows\System\QkFHxbr.exe
  C:\Windows\System\QkFHxbr.exe
  2⤵
  PID:1492
- C:\Windows\System\zJQusXC.exe
  C:\Windows\System\zJQusXC.exe
  2⤵
  PID:2264
- C:\Windows\System\dcYazNC.exe
  C:\Windows\System\dcYazNC.exe
  2⤵
  PID:11396
- C:\Windows\System\wTqQtOR.exe
  C:\Windows\System\wTqQtOR.exe
  2⤵
  PID:11560
- C:\Windows\System\EYAlzDo.exe
  C:\Windows\System\EYAlzDo.exe
  2⤵
  PID:10312
- C:\Windows\System\FcHWyAO.exe
  C:\Windows\System\FcHWyAO.exe
  2⤵
  PID:3616
- C:\Windows\System\GqhTFtL.exe
  C:\Windows\System\GqhTFtL.exe
  2⤵
  PID:12152
- C:\Windows\System\EKvcaRz.exe
  C:\Windows\System\EKvcaRz.exe
  2⤵
  PID:11660
- C:\Windows\System\TIBQYbU.exe
  C:\Windows\System\TIBQYbU.exe
  2⤵
  PID:11720
- C:\Windows\System\bFHavVh.exe
  C:\Windows\System\bFHavVh.exe
  2⤵
  PID:12308
- C:\Windows\System\XuaCbti.exe
  C:\Windows\System\XuaCbti.exe
  2⤵
  PID:12368
- C:\Windows\System\LRWetJd.exe
  C:\Windows\System\LRWetJd.exe
  2⤵
  PID:12404
- C:\Windows\System\motVjYI.exe
  C:\Windows\System\motVjYI.exe
  2⤵
  PID:12428
- C:\Windows\System\gpjjSJJ.exe
  C:\Windows\System\gpjjSJJ.exe
  2⤵
  PID:12452
- C:\Windows\System\NYoKHnC.exe
  C:\Windows\System\NYoKHnC.exe
  2⤵
  PID:12496
- C:\Windows\System\LZOcrJF.exe
  C:\Windows\System\LZOcrJF.exe
  2⤵
  PID:12516
- C:\Windows\System\CpdWmtt.exe
  C:\Windows\System\CpdWmtt.exe
  2⤵
  PID:12544
- C:\Windows\System\KUyrFaq.exe
  C:\Windows\System\KUyrFaq.exe
  2⤵
  PID:12568
- C:\Windows\System\RUCVXFc.exe
  C:\Windows\System\RUCVXFc.exe
  2⤵
  PID:12608
- C:\Windows\System\WycYUcC.exe
  C:\Windows\System\WycYUcC.exe
  2⤵
  PID:12628
- C:\Windows\System\ynFAYqR.exe
  C:\Windows\System\ynFAYqR.exe
  2⤵
  PID:12656
- C:\Windows\System\sTtZzFr.exe
  C:\Windows\System\sTtZzFr.exe
  2⤵
  PID:12680
- C:\Windows\System\adLmICh.exe
  C:\Windows\System\adLmICh.exe
  2⤵
  PID:12720
- C:\Windows\System\qxtfzMO.exe
  C:\Windows\System\qxtfzMO.exe
  2⤵
  PID:12744
- C:\Windows\System\fneVHhb.exe
  C:\Windows\System\fneVHhb.exe
  2⤵
  PID:12764
- C:\Windows\System\CHLJfRK.exe
  C:\Windows\System\CHLJfRK.exe
  2⤵
  PID:12784
- C:\Windows\System\xlDVcmX.exe
  C:\Windows\System\xlDVcmX.exe
  2⤵
  PID:12812
- C:\Windows\System\EIIuEdQ.exe
  C:\Windows\System\EIIuEdQ.exe
  2⤵
  PID:12840
- C:\Windows\System\tGmgsIv.exe
  C:\Windows\System\tGmgsIv.exe
  2⤵
  PID:12860
- C:\Windows\System\eagKvMw.exe
  C:\Windows\System\eagKvMw.exe
  2⤵
  PID:12884
- C:\Windows\System\XbdgfkS.exe
  C:\Windows\System\XbdgfkS.exe
  2⤵
  PID:12916
- C:\Windows\System\SIhEoaK.exe
  C:\Windows\System\SIhEoaK.exe
  2⤵
  PID:12940
- C:\Windows\System\VJHONgq.exe
  C:\Windows\System\VJHONgq.exe
  2⤵
  PID:12984
- C:\Windows\System\alWMbkv.exe
  C:\Windows\System\alWMbkv.exe
  2⤵
  PID:13008
- C:\Windows\System\DPZepim.exe
  C:\Windows\System\DPZepim.exe
  2⤵
  PID:13040
- C:\Windows\System\AqdlOhi.exe
  C:\Windows\System\AqdlOhi.exe
  2⤵
  PID:13056
- C:\Windows\System\wZVDlFJ.exe
  C:\Windows\System\wZVDlFJ.exe
  2⤵
  PID:12304
- C:\Windows\System\gsESzly.exe
  C:\Windows\System\gsESzly.exe
  2⤵
  PID:12328
- C:\Windows\System\zuUohIb.exe
  C:\Windows\System\zuUohIb.exe
  2⤵
  PID:12448
- C:\Windows\System\PYZGatu.exe
  C:\Windows\System\PYZGatu.exe
  2⤵
  PID:12700
- C:\Windows\System\yiZLFVH.exe
  C:\Windows\System\yiZLFVH.exe
  2⤵
  PID:12760
- C:\Windows\System\EReHpIn.exe
  C:\Windows\System\EReHpIn.exe
  2⤵
  PID:12780
- C:\Windows\System\LsghhWp.exe
  C:\Windows\System\LsghhWp.exe
  2⤵
  PID:12828
- C:\Windows\System\kLpdXiV.exe
  C:\Windows\System\kLpdXiV.exe
  2⤵
  PID:3904
- C:\Windows\System\aKJqlSM.exe
  C:\Windows\System\aKJqlSM.exe
  2⤵
  PID:12992
- C:\Windows\System\UJfjVly.exe
  C:\Windows\System\UJfjVly.exe
  2⤵
  PID:12972
- C:\Windows\System\XRXlgWt.exe
  C:\Windows\System\XRXlgWt.exe
  2⤵
  PID:13020
- C:\Windows\System\FXvIcZO.exe
  C:\Windows\System\FXvIcZO.exe
  2⤵
  PID:13088
- C:\Windows\System\kjDLNEL.exe
  C:\Windows\System\kjDLNEL.exe
  2⤵
  PID:13132
- C:\Windows\System\nglNbCg.exe
  C:\Windows\System\nglNbCg.exe
  2⤵
  PID:13124
- C:\Windows\System\aqwLFbr.exe
  C:\Windows\System\aqwLFbr.exe
  2⤵
  PID:13172
- C:\Windows\System\oZXBXAk.exe
  C:\Windows\System\oZXBXAk.exe
  2⤵
  PID:13208
- C:\Windows\System\ZcVAFMx.exe
  C:\Windows\System\ZcVAFMx.exe
  2⤵
  PID:13236
- C:\Windows\System\AMHNGBb.exe
  C:\Windows\System\AMHNGBb.exe
  2⤵
  PID:13308
- C:\Windows\System\qzrcMtq.exe
  C:\Windows\System\qzrcMtq.exe
  2⤵
  PID:12300
- C:\Windows\System\gUJkncr.exe
  C:\Windows\System\gUJkncr.exe
  2⤵
  PID:12364
- C:\Windows\System\djDAyrO.exe
  C:\Windows\System\djDAyrO.exe
  2⤵
  PID:12640
- C:\Windows\System\bheiGNg.exe
  C:\Windows\System\bheiGNg.exe
  2⤵
  PID:11372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_x3rx53eq.ec5.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BCQnKeo.exe

Filesize
2.2MB

MD5
9066589107b567018ef736c3f5ef9147

SHA1
9db2c46732438ca0ea4191197747da33f75bc89a

SHA256
362c17acfd88aae9223c09dad558b4a11c3511cbd17995f85465892d6c79a365

SHA512
3c3624e014f14d20563418de81e2d815707652f7472e1b5cc908aa3c0975902bcd0e84dfcfaae5a2dc2c13aea4535d62118037e019f3521c6435bc9b1da62b93

Download Submit
C:\Windows\System\DGBffNv.exe

Filesize
2.2MB

MD5
27bcc1c41fc307681aadc7f2c62efb48

SHA1
6069a1d352573a49b14dfb42aa9c1672f9650ef9

SHA256
90f7be1b8a679c24792b6d34ef78fbb123877feac98cdfeea52934c055aff50a

SHA512
8ae9b8a7c59a9f4af80b58ae9a832e06ad3a1d7e59ffcfe7c3308d9c9f4297e2fe426ec925d3fb55c6dcb52e7fa65cebd52448ede5b153ebf4cd508d363d6239

Download Submit
C:\Windows\System\ELtxEPM.exe

Filesize
2.2MB

MD5
f3a33a66c4853b5c30d6c7962e933f70

SHA1
99d6b72580754747a09069bbcb276a5de84889ab

SHA256
678c2ce3a8a422dc80d9286aa439c3284e0ab71d086cdb52f1ba03c8f6471262

SHA512
3016713ebea9fca6e54d5607e3f5b5132aebd254a0fa9de46f9518ad9effdbd23401a86f0cd60c2039b1fe524d257205d41bb69208c98c96ab6a0353d17fd0cd

Download Submit
C:\Windows\System\EfyHaMR.exe

Filesize
2.2MB

MD5
63122be81dd15d7d51cab7e1e7bca351

SHA1
606eba696664d1f8a5c23fd432ed655bd31bae82

SHA256
4325cfb0795899f737ecb71ae323a4b68e7048b354ef1763c5d2c43fc3afd825

SHA512
499f7f8ee98e86bcf4113689a415ef823b048e6c2b612bc8122607b977d1b5bf1774b02cc851ce9a8750c11f1a9903d46502fef204b45e8ea787ed1b3d418763

Download Submit
C:\Windows\System\HYnwFhY.exe

Filesize
2.2MB

MD5
923730d4cbc9393597ed26fbaeaed369

SHA1
f674e4a977ffe10e8735a7827b1e545b8b74c022

SHA256
9ed016528276d0f4c4166b4f0f36f869b2a15f87cb422c64a24945ee9df9f18f

SHA512
3742ae77e6643dd34a02cff7faf423c9f4b1aea6aef5a7ad481791fc33aa124d3a91a116a770663c3feee7791ba988c44d526e7f8dba16458630e549a9dc71f8

Download Submit
C:\Windows\System\HzkUGrw.exe

Filesize
2.2MB

MD5
31d834c2dcd5f1a9a715dcd698c5d9c9

SHA1
86b63816f146b511681aba1fc49b379fbcdcc2e2

SHA256
482e0ecafd857e5fb194e28cfc10dced732295b7987c74ca0dd60a37018482ff

SHA512
5441ba850fc5d472090d215619a1efd31afde5ea9380e8db44d442781cc4edcbb274b6cf87042db4d44f11c5483aeaaa0550e19e552af9d437dcc19939301f6e

Download Submit
C:\Windows\System\JBjiWcs.exe

Filesize
2.2MB

MD5
e6540bd1e2db3689ba1de32247338aa0

SHA1
8e9fde95d2fe1e3491b728b0a33f82a6fc4c9550

SHA256
9d4f31a3da3882d452a489dfcbf9ab305458bd8180fd9d87218288d6d18ee0c3

SHA512
25a6e2fbb442fd98597f28dcf4a95b170658dfd6185522a6b24579c1ce7a5bb2914b8efb672cd86c54b3c56dfbbdde8cc833100c6fa864e23a30c79da703abe3

Download Submit
C:\Windows\System\JVxjjap.exe

Filesize
2.2MB

MD5
2b109c0b0e09139443a0ea2c8042da53

SHA1
af87891dc293c2295fcfc8c28282de67ab8c9816

SHA256
3f255f8fe8b5aab18b5a61f1c5c6c77f56eea0c71cc7c83f4e71dfaf753df095

SHA512
afdcbef3adf453d4eaf49c69dea71d1be75684592b79d0be2b1acf3efa7035747c07b67e244d6fa7b305cd308343f0c9dadfb1b23096dfdc113a66eca7d022d0

Download Submit
C:\Windows\System\LEwvqeE.exe

Filesize
2.2MB

MD5
5d05bd08f0c618356c981638a4c64774

SHA1
cb8cfc3acf0d5047fe7a37d1b9c894fdf0da03da

SHA256
f90846b5a2a7430d82ace1fefa5873f7984982e49a0576902f8ffde462bb52b1

SHA512
800dcafbdabee210dade621d388ae0dac0eb3f5a7323687470aa279c0c508a8efa0e3d0367ba3660c2a4225f6b0392584dd9e6ea3866f2dcaf005ea26b870290

Download Submit
C:\Windows\System\PuWuulJ.exe

Filesize
2.2MB

MD5
37569c842b3c5b97b95e208fdb0a28fd

SHA1
77e13269b28d0514ca49949e473b7af24535dc68

SHA256
188a1aec7ea3ffcce052c47ad0ef855135914e77584664cb1581b61ac1f5a6b3

SHA512
74af67b19b2ded4b6d8259e644f88b6092e3c0d4c1e8c82f883df7cbf6e889aac5c82d9654057027ff273b9daa517bd52c40f5d816c5f5551410f33aab6234a2

Download Submit
C:\Windows\System\QILXMhF.exe

Filesize
2.2MB

MD5
119fc89b9b0ed830586e4308daf4ee74

SHA1
ceb66cb0e3dd4b1141206a4bd251a3e68ef96832

SHA256
8bca57e58b7efe457d5f62ae6bd60c2ecb8e5eefc508ef261b77198818f50a75

SHA512
0923dd7bd0d5b22c242c418450733774235ddd8ccad24cb12df5e70f1f8486c4ed33b39ffa8c26067b3cdf555055c89817c8741832a2e4de5a6ae85a18287a12

Download Submit
C:\Windows\System\SpzTodW.exe

Filesize
2.2MB

MD5
0b7043d1e189f1987ae8dc66771d20af

SHA1
412f03f0c9bd3980914ca43fa5701ebaa4679c98

SHA256
32b62bc0777caf57492837e92f2efdae9e722159fec6116063e579c85d0ccefd

SHA512
557c32b4c67b586c95d31a90595f725189a4722ea9ed97be8d3fbc98636989ab7dc36458b69681d7f69ce3003cefac70b3e84f4247ee93b96043bd40dd7bde96

Download Submit
C:\Windows\System\VRtcVFb.exe

Filesize
2.2MB

MD5
c3e1426a61fa186936d747d1de967705

SHA1
16b41eca282ce1d4b5cadbf3f87d5990f6ddb79b

SHA256
4fcb19b4dffb08568636ca0953a166dcd46ca2cbe9db2ab1932b56061262673d

SHA512
a59e759f3dbe3897246606f18ab0b3c3b325c17db78e6a3bfed58047e1c923c4160e746fa682fd6ef322571254e88f40ca57b9f3e4ad669cced47f847a2655f3

Download Submit
C:\Windows\System\Wdsvrlp.exe

Filesize
2.2MB

MD5
f3426477811f9e68977b7131d15bad71

SHA1
86197d0b23fa1638c61a9c747d758fbf5018c729

SHA256
c7dda1868c27bc8174ceb3b2d5c5d82324db7658fe31b0a9ba4b34445abd00e2

SHA512
e1e77d8a9b0e3e38a3270b37b28e009b3e34b2679803981829746d91f63df547f383fa33462689ca90340ad749bdadd617c26cc89dd4463dfda4c2917b3e4562

Download Submit
C:\Windows\System\XvGaeQv.exe

Filesize
2.2MB

MD5
1185d95c2e78146bb87073019fbf9128

SHA1
743c9c7d7a84f82d7914459ef977a1f7da4eaa8b

SHA256
a23c896a517fa4776a1bc13d4088ed0886639a9b00fe87363fadbc5f3ab65a3b

SHA512
6324e8007afa88c8a468eb92feacc86529f212af8c18afc2d718baa517b7b03c7f16c6e4715727107ef493e98393934d4cf61645c7df5512c400e6f654af2e52

Download Submit
C:\Windows\System\YrJiUNi.exe

Filesize
2.2MB

MD5
5f46816dfbfd28c04ccdf976bd25e5ce

SHA1
bddb2cdad7055f697e2d21a928eb78e612a7d65a

SHA256
96fb7ba90ce4661e4522ecd994ee6acf00a8f6922d60c2366f42328b445baf71

SHA512
5ddd73098e1b13ff1dd87e05de23bf769fd4209312c69cf17b8f1d9c0e9a23f8c85c788e836128805170176f5242c9e55c96887c0e3f821dcdb87e0cc2681e2a

Download Submit
C:\Windows\System\ZkXpUtr.exe

Filesize
2.2MB

MD5
0334a9346858877a34cc2b79a73a3d70

SHA1
93918dc4091609d30cac0daebf1c47cb8b0f0aaa

SHA256
c4030a698007db172d7585f182f997e192a176a06a191994cecef21c80cb90cf

SHA512
d5510865a9251c25711b641421140dfbfe8c97928bf75604e4bb89e05fd49c77f65388eda8acad96ab4ba7bf29289738e9052bf7bd165195bf8e23c636291652

Download Submit
C:\Windows\System\afcNBgI.exe

Filesize
2.2MB

MD5
19d26ecebe9e146ffd0cbc9d71341a0e

SHA1
d18df71fd645fbc20471186ff748676b1c1249a0

SHA256
c4b5551280382497164cc5ffcecda5b08eb852cf0a29a9ce8554346d57a1643c

SHA512
6ad603d19cf90a89d43e33227715c00122beb543292c4bad9a0ec85226e6069aead6e95660c263989bc4929c6916cd393c00c311d792a6423b6f1a9267533e18

Download Submit
C:\Windows\System\dBQnBII.exe

Filesize
2.2MB

MD5
3bb9dc758d3eb5358d686b84fa38c769

SHA1
366d060aba48818940357f9de1ee3fa4e0e31a41

SHA256
2c6640b4d84a043dc7d6b91add120050bc6c046444ca24c82a85ce393d713439

SHA512
7a377ab88978cc7f539b6f455aa56bc7f68aca61ee52f85ebe6641f78944162ef4f4d497c2cb4e792b9108f4fbb38cd5dc84e9267cae034a0a27819baaf7c032

Download Submit
C:\Windows\System\dlALnRJ.exe

Filesize
2.2MB

MD5
326dd63dd53a381d8668f2852f13978f

SHA1
d25a51a7e13c01dd1bd6f8244adf5737c08dad21

SHA256
46f5b10b683d89cc8c0e246c7eb4d49e3e979b20386109eb4f47a89f3c776fd7

SHA512
67c26f65dbb57a95d532e17faf6a27f2e902391fca3db4b958bd61dfaa2e08067aa896ad5309c6f51da03e384b686d55ae8008f5d833df755421b9834158a8f7

Download Submit
C:\Windows\System\emsVrkf.exe

Filesize
8B

MD5
0b02220145771e90ebe4310a5742c9eb

SHA1
9bd568d96b03bd5446f96a7b59c08196eb5a57c3

SHA256
6135f164d0697be47c97ab606a7a1adcbc1eb3846ae4debecafb1a6ccfd23e4e

SHA512
cb08dee7f4e4dd1bb8de836a2364c078d9de5aef5dcb329e7e0b8e1cc2bfaa06c42f8b8ddf04bdb30392074759beef091a761854b0812b9a726b3c820c99a5a8

Download Submit
C:\Windows\System\fCfVxHb.exe

Filesize
2.2MB

MD5
a45e873e54ab75e758233ba1369018dd

SHA1
6685e04e31c0cce7b4bf79568b04e34296a41472

SHA256
dd7225d8b5e6e93900d1d8b7ab01b69c3f821ba705514cf2cbf3d4d5f205b08b

SHA512
b595148ada829836c77d9658199f776bc82bb16ecb49ca7510c738a381063624c4c1978906ae572edff26a1698231db9ac6a885d461d620f3c2ad2ff2561d69e

Download Submit
C:\Windows\System\fUKRXfS.exe

Filesize
2.2MB

MD5
6513c8c1f025e6012f1538ec9083f679

SHA1
ac28bf3cb168719a3e4dfb44e3ad1d2714fa93b7

SHA256
a871acf8ffca8161bb3b626c7dd9c6d49949c5e792d26cf755747e245cbc1549

SHA512
ba046cfa4076b09252c33e7be642b2899c355bfdcd838e7d6b35abbfde2fc84cb8e86471ff49c7c85d51416a83abba457073f59a3fa5564ad6fce09711cf37ad

Download Submit
C:\Windows\System\hJJUBDP.exe

Filesize
2.2MB

MD5
80e86cb200530727cae8397d372cd270

SHA1
9988f6512c80122c82415e292d20ccd9972bfa00

SHA256
1e0d4c32dc313ec2ee2d679c9f44be68faeadd85f6db24491bba658f9a83c5de

SHA512
193d71a39dfff6b9e97b34f940d0ab71ab9f0527096eb708089e2ceccfdd879199eea9400ff6d092e9650cf4c26eb7512dd145da618fdf586d7b8a64a742d80a

Download Submit
C:\Windows\System\iQaBKkL.exe

Filesize
2.2MB

MD5
ce9e416dbedc28b6b6ea86a57b6dcc30

SHA1
cba7bbce1a3730eb97233e935f0bbd67bc9a642c

SHA256
bf3534afd6fff2c46ff686ee4cc68e686e49a10e9bab616eacce17a05040af2c

SHA512
4e97f2919e0f53feaf2ad2e61e40a95a5df898b6fbd68204e79705a1e44ffdbf4c7a0ce61aaf3e7c125d635eac9751893c8d7efecd88a12d2c14d0eae571d736

Download Submit
C:\Windows\System\idtULuX.exe

Filesize
2.2MB

MD5
fa75b2c6e7d946cc08280d26e9a07a3b

SHA1
f7a959b0d99b04925ba7f7cb829b330fa91686e1

SHA256
9a9ddf5ad7eb70c537f3e8754679ad60cc5f0c594fc309ed3690d61d222c2d5c

SHA512
e5e01df0ebc0cab2d7f5633ada91a8f138d10157964df13c4fb0d0a0929d9173942bd81f6827f9cbc72abf581308cc116c4789579fba09dfadf357c98a6fee20

Download Submit
C:\Windows\System\jTBzxIO.exe

Filesize
2.2MB

MD5
3c87e1904e075d51ec55bba2e3a08206

SHA1
ec62ae59b57b841479f640a473da4a5b7c92a70b

SHA256
209bb51d49f0e3d46158183508328053561b30dd7d3aefc7b98c5b42d27e2ff2

SHA512
89b897073ca314c5b07d7fb83028a6afc42e9a07187640dde5bf252a151dbdcda6fde6f2ab7876baf3ab5167a018bdb6101b8e7c31f9ce963a80ecb2f52912a2

Download Submit
C:\Windows\System\nKerqyy.exe

Filesize
2.2MB

MD5
d2da4a5fa336f28b84fb1a5fc82fdecc

SHA1
d6d333d0c516808256668b26eda1de82d6b53b1c

SHA256
8c58827e8f48ad529a3885dcff7e03e904a87b5cfe82e29ed42460d8d1ccb7db

SHA512
98840f3c53bd7cb0885a67d8083ba0d7f945192346374f94f119a4bb19d15b13b49ff8aee5a051047e5c2ecdfb1737fcacc99a3453754255cd835749dd1c99c8

Download Submit
C:\Windows\System\oHzSAvg.exe

Filesize
2.2MB

MD5
7fcb6482207f51cea735e0fe42ce65a2

SHA1
42de12ac0f19a5ba73c7a5f9cd938f6c368b9f61

SHA256
d993798c4806b393c36116d93321e8f3bc671dbb41d18ded10617fdcfd4d9e1d

SHA512
02de3e372ae5a70e24c58717090701f262e4cf039c6662367fc133ad12d9e43c14968e2f9a40d345c3d91f70e572ee18af6a5fc1b9a703bba547f6df1fade0c4

Download Submit
C:\Windows\System\pufZKwh.exe

Filesize
2.2MB

MD5
c86f1fea6b8d800a68e88cc20559b8c4

SHA1
45131c88bb3d0ba94d71b549459b695809c32fdb

SHA256
092742973b4101148c942c7d8028653908bd711a4e72948ff71d82aae6b79b81

SHA512
046d8d580c742fbd41b73a2571acc85aafa1bcf99f1ebfe92f6e4d2af6c0ee51797164a593d11b63a66043c397b8dd565c09a93cd0805e3abb2db69ae238261a

Download Submit
C:\Windows\System\sXNRccm.exe

Filesize
2.2MB

MD5
e0c6cfa9b3d8225459b26a3027d003ee

SHA1
51561f5c49d21d38ace5554d486483e29cffc395

SHA256
b91d47b5ec34fa396376697da04cf9a03772f90855205e26c9847aa46a94b6c2

SHA512
fc8f87bb300cd203caa5200480e10aab60faf668168bd37efc4c8e145cf17b4db90329eed4b4bf19cbca9ff9b480ab6d9ab0628c37e9a82f29915a2d69c189d5

Download Submit
C:\Windows\System\sjSpROI.exe

Filesize
2.2MB

MD5
58aa6ff074ea5c3d990ae3f70076f646

SHA1
e0d0de9cb0268daee49ebb35154a57741280c5b6

SHA256
f8db28ec485ad117531c85ec266f1b284d656bef2f6cc9f2c3c48c4b79646352

SHA512
2fda5b4076558ac2ff0095c3875fe2c32435452197e15c8536ca41f65054287ccda4d9ace9abad32ec214efc3b1a598cb4dc6b345f3ce2391fbb1a9c21b08daa

Download Submit
C:\Windows\System\tonsBac.exe

Filesize
2.2MB

MD5
6f669fe771d5e3740d25bc288790a21a

SHA1
8a9aaec7910fa0dd6304776478c1a444f66ad51e

SHA256
7f60205869213d1118e13a8ee2eec4856097879aec89adf53f83a6d16c6e173f

SHA512
87f477f781f7a0bb7302f8e867ec6c378eb05928713d868cf12fcd489d90312a3ff98cafc22412adcf2fe7dd55a2283ea5a695566bf828654d48eee61e139afc

Download Submit
C:\Windows\System\zKGJzrz.exe

Filesize
2.2MB

MD5
e75b81d792bf8f7f5c6a7123803526ad

SHA1
88b94577e94f2c30a291ed2bed91a0a5d76ada13

SHA256
67f9b196583bfe8aedc10cf8b5de07d58f03092d4171a70de43a5adaf8193927

SHA512
0597126dec67d1375ceb1fbece0ec717c1fb26de7fc4f1ae310416f6f2494481e9665af2417e92d0b273446211d2ef97fcf7cbcbc039c5493c09a4a867203c09

Download Submit
memory/116-83-0x00007FF789CF0000-0x00007FF78A0E2000-memory.dmp

Filesize
3.9MB

Download
memory/116-2262-0x00007FF789CF0000-0x00007FF78A0E2000-memory.dmp

Filesize
3.9MB

Download
memory/760-132-0x00007FF7A92F0000-0x00007FF7A96E2000-memory.dmp

Filesize
3.9MB

Download
memory/760-2246-0x00007FF7A92F0000-0x00007FF7A96E2000-memory.dmp

Filesize
3.9MB

Download
memory/760-2289-0x00007FF7A92F0000-0x00007FF7A96E2000-memory.dmp

Filesize
3.9MB

Download
memory/892-2245-0x00007FF749680000-0x00007FF749A72000-memory.dmp

Filesize
3.9MB

Download
memory/892-79-0x00007FF749680000-0x00007FF749A72000-memory.dmp

Filesize
3.9MB

Download
memory/892-2267-0x00007FF749680000-0x00007FF749A72000-memory.dmp

Filesize
3.9MB

Download
memory/1092-2253-0x00007FF7CC590000-0x00007FF7CC982000-memory.dmp

Filesize
3.9MB

Download
memory/1092-89-0x00007FF7CC590000-0x00007FF7CC982000-memory.dmp

Filesize
3.9MB

Download
memory/1612-2244-0x00007FF71DBD0000-0x00007FF71DFC2000-memory.dmp

Filesize
3.9MB

Download
memory/1612-2249-0x00007FF71DBD0000-0x00007FF71DFC2000-memory.dmp

Filesize
3.9MB

Download
memory/1612-12-0x00007FF71DBD0000-0x00007FF71DFC2000-memory.dmp

Filesize
3.9MB

Download
memory/1712-2293-0x00007FF674140000-0x00007FF674532000-memory.dmp

Filesize
3.9MB

Download
memory/1712-158-0x00007FF674140000-0x00007FF674532000-memory.dmp

Filesize
3.9MB

Download
memory/1896-2256-0x00007FF7A4F60000-0x00007FF7A5352000-memory.dmp

Filesize
3.9MB

Download
memory/1896-93-0x00007FF7A4F60000-0x00007FF7A5352000-memory.dmp

Filesize
3.9MB

Download
memory/2156-73-0x00007FF65AC70000-0x00007FF65B062000-memory.dmp

Filesize
3.9MB

Download
memory/2156-2263-0x00007FF65AC70000-0x00007FF65B062000-memory.dmp

Filesize
3.9MB

Download
memory/2256-2257-0x00007FF7FD760000-0x00007FF7FDB52000-memory.dmp

Filesize
3.9MB

Download
memory/2256-72-0x00007FF7FD760000-0x00007FF7FDB52000-memory.dmp

Filesize
3.9MB

Download
memory/2384-2291-0x00007FF779450000-0x00007FF779842000-memory.dmp

Filesize
3.9MB

Download
memory/2384-2247-0x00007FF779450000-0x00007FF779842000-memory.dmp

Filesize
3.9MB

Download
memory/2384-120-0x00007FF779450000-0x00007FF779842000-memory.dmp

Filesize
3.9MB

Download
memory/2396-141-0x00007FF62E1B0000-0x00007FF62E5A2000-memory.dmp

Filesize
3.9MB

Download
memory/2396-2301-0x00007FF62E1B0000-0x00007FF62E5A2000-memory.dmp

Filesize
3.9MB

Download
memory/2568-82-0x00007FF689960000-0x00007FF689D52000-memory.dmp

Filesize
3.9MB

Download
memory/2568-2266-0x00007FF689960000-0x00007FF689D52000-memory.dmp

Filesize
3.9MB

Download
memory/2896-0-0x00007FF765E40000-0x00007FF766232000-memory.dmp

Filesize
3.9MB

Download
memory/2896-1-0x0000021736E60000-0x0000021736E70000-memory.dmp

Filesize
64KB

Download
memory/2916-2251-0x00007FF67B9E0000-0x00007FF67BDD2000-memory.dmp

Filesize
3.9MB

Download
memory/2916-37-0x00007FF67B9E0000-0x00007FF67BDD2000-memory.dmp

Filesize
3.9MB

Download
memory/2920-2275-0x00007FF7B89C0000-0x00007FF7B8DB2000-memory.dmp

Filesize
3.9MB

Download
memory/2920-115-0x00007FF7B89C0000-0x00007FF7B8DB2000-memory.dmp

Filesize
3.9MB

Download
memory/3452-29-0x0000012D55F10000-0x0000012D55F20000-memory.dmp

Filesize
64KB

Download
memory/3452-31-0x0000012D55F10000-0x0000012D55F20000-memory.dmp

Filesize
64KB

Download
memory/3452-67-0x0000012D564B0000-0x0000012D564D2000-memory.dmp

Filesize
136KB

Download
memory/3452-28-0x00007FFF05FD0000-0x00007FFF06A91000-memory.dmp

Filesize
10.8MB

Download
memory/3832-145-0x00007FF7895D0000-0x00007FF7899C2000-memory.dmp

Filesize
3.9MB

Download
memory/3832-2273-0x00007FF7895D0000-0x00007FF7899C2000-memory.dmp

Filesize
3.9MB

Download
memory/4368-151-0x00007FF6B1B50000-0x00007FF6B1F42000-memory.dmp

Filesize
3.9MB

Download
memory/4368-2270-0x00007FF6B1B50000-0x00007FF6B1F42000-memory.dmp

Filesize
3.9MB

Download
memory/4520-2260-0x00007FF73B040000-0x00007FF73B432000-memory.dmp

Filesize
3.9MB

Download
memory/4520-50-0x00007FF73B040000-0x00007FF73B432000-memory.dmp

Filesize
3.9MB

Download
memory/4608-164-0x00007FF6A1F00000-0x00007FF6A22F2000-memory.dmp

Filesize
3.9MB

Download
memory/4608-2288-0x00007FF6A1F00000-0x00007FF6A22F2000-memory.dmp

Filesize
3.9MB

Download
memory/4748-2271-0x00007FF7A6E90000-0x00007FF7A7282000-memory.dmp

Filesize
3.9MB

Download
memory/4748-107-0x00007FF7A6E90000-0x00007FF7A7282000-memory.dmp

Filesize
3.9MB

Download
memory/4872-152-0x00007FF676020000-0x00007FF676412000-memory.dmp

Filesize
3.9MB

Download
memory/4872-2277-0x00007FF676020000-0x00007FF676412000-memory.dmp

Filesize
3.9MB

Download
memory/4908-135-0x00007FF67EAC0000-0x00007FF67EEB2000-memory.dmp

Filesize
3.9MB

Download
memory/4908-2290-0x00007FF67EAC0000-0x00007FF67EEB2000-memory.dmp

Filesize
3.9MB

Download