xmrig | cf6540341d1f63c06f727a4f29c17e7e3457c22d2da02cc526657c4b7d5c56c4

Analysis

max time kernel
62s
max time network
50s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 09:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
Size

2.3MB
MD5

04e878bfb78176799ff79519fb85ebf8
SHA1

a7dd3b0b3604003ea8adade75e8f58d333928988
SHA256

cf6540341d1f63c06f727a4f29c17e7e3457c22d2da02cc526657c4b7d5c56c4
SHA512

9689c4b0b70fa62763bd6c9a3ac31e4b0043436730073b4b497d3b53ff4a306a35a28290ebddd8584e3a6cb7093fc4821def81aa97ec54fb6d9675435ab1f52f
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aD2:NABp

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 42 IoCs

miner

resource	yara_rule
behavioral2/memory/4016-27-0x00007FF75BDD0000-0x00007FF75C1C2000-memory.dmp	xmrig
behavioral2/memory/3224-71-0x00007FF61B470000-0x00007FF61B862000-memory.dmp	xmrig
behavioral2/memory/4048-79-0x00007FF60F110000-0x00007FF60F502000-memory.dmp	xmrig
behavioral2/memory/2432-393-0x00007FF734FF0000-0x00007FF7353E2000-memory.dmp	xmrig
behavioral2/memory/1732-395-0x00007FF61F1B0000-0x00007FF61F5A2000-memory.dmp	xmrig
behavioral2/memory/1776-397-0x00007FF6BDD20000-0x00007FF6BE112000-memory.dmp	xmrig
behavioral2/memory/4080-398-0x00007FF699DD0000-0x00007FF69A1C2000-memory.dmp	xmrig
behavioral2/memory/536-399-0x00007FF6F09C0000-0x00007FF6F0DB2000-memory.dmp	xmrig
behavioral2/memory/2392-400-0x00007FF7045C0000-0x00007FF7049B2000-memory.dmp	xmrig
behavioral2/memory/4740-402-0x00007FF734F00000-0x00007FF7352F2000-memory.dmp	xmrig
behavioral2/memory/4312-401-0x00007FF766C30000-0x00007FF767022000-memory.dmp	xmrig
behavioral2/memory/440-396-0x00007FF620F00000-0x00007FF6212F2000-memory.dmp	xmrig
behavioral2/memory/1328-394-0x00007FF767B20000-0x00007FF767F12000-memory.dmp	xmrig
behavioral2/memory/2456-83-0x00007FF7D8440000-0x00007FF7D8832000-memory.dmp	xmrig
behavioral2/memory/2768-80-0x00007FF74B940000-0x00007FF74BD32000-memory.dmp	xmrig
behavioral2/memory/1520-72-0x00007FF6916B0000-0x00007FF691AA2000-memory.dmp	xmrig
behavioral2/memory/4416-67-0x00007FF6E7A60000-0x00007FF6E7E52000-memory.dmp	xmrig
behavioral2/memory/4884-46-0x00007FF70F270000-0x00007FF70F662000-memory.dmp	xmrig
behavioral2/memory/2136-31-0x00007FF6B1440000-0x00007FF6B1832000-memory.dmp	xmrig
behavioral2/memory/4492-2213-0x00007FF624EC0000-0x00007FF6252B2000-memory.dmp	xmrig
behavioral2/memory/5092-2214-0x00007FF665920000-0x00007FF665D12000-memory.dmp	xmrig
behavioral2/memory/4016-2217-0x00007FF75BDD0000-0x00007FF75C1C2000-memory.dmp	xmrig
behavioral2/memory/4884-2219-0x00007FF70F270000-0x00007FF70F662000-memory.dmp	xmrig
behavioral2/memory/2136-2221-0x00007FF6B1440000-0x00007FF6B1832000-memory.dmp	xmrig
behavioral2/memory/4416-2224-0x00007FF6E7A60000-0x00007FF6E7E52000-memory.dmp	xmrig
behavioral2/memory/4492-2225-0x00007FF624EC0000-0x00007FF6252B2000-memory.dmp	xmrig
behavioral2/memory/1520-2229-0x00007FF6916B0000-0x00007FF691AA2000-memory.dmp	xmrig
behavioral2/memory/4048-2233-0x00007FF60F110000-0x00007FF60F502000-memory.dmp	xmrig
behavioral2/memory/3224-2232-0x00007FF61B470000-0x00007FF61B862000-memory.dmp	xmrig
behavioral2/memory/2768-2228-0x00007FF74B940000-0x00007FF74BD32000-memory.dmp	xmrig
behavioral2/memory/5092-2241-0x00007FF665920000-0x00007FF665D12000-memory.dmp	xmrig
behavioral2/memory/440-2247-0x00007FF620F00000-0x00007FF6212F2000-memory.dmp	xmrig
behavioral2/memory/1776-2246-0x00007FF6BDD20000-0x00007FF6BE112000-memory.dmp	xmrig
behavioral2/memory/4080-2249-0x00007FF699DD0000-0x00007FF69A1C2000-memory.dmp	xmrig
behavioral2/memory/2456-2243-0x00007FF7D8440000-0x00007FF7D8832000-memory.dmp	xmrig
behavioral2/memory/2432-2240-0x00007FF734FF0000-0x00007FF7353E2000-memory.dmp	xmrig
behavioral2/memory/1328-2238-0x00007FF767B20000-0x00007FF767F12000-memory.dmp	xmrig
behavioral2/memory/1732-2236-0x00007FF61F1B0000-0x00007FF61F5A2000-memory.dmp	xmrig
behavioral2/memory/536-2262-0x00007FF6F09C0000-0x00007FF6F0DB2000-memory.dmp	xmrig
behavioral2/memory/2392-2260-0x00007FF7045C0000-0x00007FF7049B2000-memory.dmp	xmrig
behavioral2/memory/4740-2256-0x00007FF734F00000-0x00007FF7352F2000-memory.dmp	xmrig
behavioral2/memory/4312-2258-0x00007FF766C30000-0x00007FF767022000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4884	qnAwxEk.exe
4016	ojyLKuA.exe
2136	ZrNlMcd.exe
4416	auKzpOm.exe
4492	GvfiuEu.exe
3224	ubGSyxY.exe
4048	KjgPiNw.exe
2768	jKdevlN.exe
1520	tLMsNeQ.exe
2456	KXaCvta.exe
5092	wimaaHi.exe
2432	KaYspJi.exe
1328	nWSprGU.exe
1732	EeVfzFs.exe
440	BAjinxW.exe
1776	oRXdRsU.exe
4080	MIHwYSP.exe
536	KDhAogn.exe
2392	ttrKnke.exe
4312	BxPlgXU.exe
4740	PagSITv.exe
3800	CYZeDJM.exe
2676	lgKEczh.exe
3640	ouXbkVs.exe
4020	VXJdbjy.exe
1524	brLlugw.exe
4664	nAKDwyV.exe
3064	MUhgbrO.exe
4840	rpGAEfP.exe
3080	UNciCbY.exe
2984	MwTnnqh.exe
2472	HNIyIpN.exe
4824	invASoK.exe
2012	EUHItbh.exe
2968	YOToPDx.exe
2980	eGHWqvj.exe
2500	CaJmzWA.exe
1500	MyRlONC.exe
3728	iPciYtz.exe
4432	qlyGhuL.exe
3932	hyjBSFt.exe
4496	xgmhNQg.exe
4292	FzEirXw.exe
2700	FstmIVD.exe
4720	kdnitFZ.exe
4384	JSQuddZ.exe
3856	DswZGeP.exe
2576	SXequgB.exe
4748	IfKqiZD.exe
4948	KsYhEVC.exe
2340	BwBfUgl.exe
1880	MpPgeQA.exe
5100	rioIKiS.exe
1800	XikYHsV.exe
4844	ZFBdcdO.exe
2620	TvHjnHs.exe
4512	HyKqedz.exe
404	IropsnS.exe
4040	Wdlsdfv.exe
2660	URMpoeQ.exe
3796	caBaDmm.exe
4280	NKvyFNb.exe
3680	akDcuGc.exe
2380	pbNymdX.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4924-0-0x00007FF78E970000-0x00007FF78ED62000-memory.dmp	upx
behavioral2/files/0x000a000000023bc6-7.dat	upx
behavioral2/files/0x000b000000023bc2-8.dat	upx
behavioral2/memory/4016-27-0x00007FF75BDD0000-0x00007FF75C1C2000-memory.dmp	upx
behavioral2/files/0x000a000000023bc9-51.dat	upx
behavioral2/files/0x000b000000023bcc-58.dat	upx
behavioral2/files/0x000a000000023bcd-61.dat	upx
behavioral2/memory/3224-71-0x00007FF61B470000-0x00007FF61B862000-memory.dmp	upx
behavioral2/memory/5092-73-0x00007FF665920000-0x00007FF665D12000-memory.dmp	upx
behavioral2/memory/4048-79-0x00007FF60F110000-0x00007FF60F502000-memory.dmp	upx
behavioral2/files/0x000a000000023bd0-87.dat	upx
behavioral2/files/0x000b000000023bcb-92.dat	upx
behavioral2/files/0x000a000000023bd4-112.dat	upx
behavioral2/files/0x000a000000023bd7-127.dat	upx
behavioral2/files/0x000a000000023bd8-140.dat	upx
behavioral2/files/0x000a000000023bda-150.dat	upx
behavioral2/files/0x000a000000023bdd-157.dat	upx
behavioral2/files/0x000b000000023be0-172.dat	upx
behavioral2/files/0x000a000000023be9-182.dat	upx
behavioral2/memory/2432-393-0x00007FF734FF0000-0x00007FF7353E2000-memory.dmp	upx
behavioral2/memory/1732-395-0x00007FF61F1B0000-0x00007FF61F5A2000-memory.dmp	upx
behavioral2/memory/1776-397-0x00007FF6BDD20000-0x00007FF6BE112000-memory.dmp	upx
behavioral2/memory/4080-398-0x00007FF699DD0000-0x00007FF69A1C2000-memory.dmp	upx
behavioral2/memory/536-399-0x00007FF6F09C0000-0x00007FF6F0DB2000-memory.dmp	upx
behavioral2/memory/2392-400-0x00007FF7045C0000-0x00007FF7049B2000-memory.dmp	upx
behavioral2/memory/4740-402-0x00007FF734F00000-0x00007FF7352F2000-memory.dmp	upx
behavioral2/memory/4312-401-0x00007FF766C30000-0x00007FF767022000-memory.dmp	upx
behavioral2/memory/440-396-0x00007FF620F00000-0x00007FF6212F2000-memory.dmp	upx
behavioral2/memory/1328-394-0x00007FF767B20000-0x00007FF767F12000-memory.dmp	upx
behavioral2/files/0x000e000000023bf0-187.dat	upx
behavioral2/files/0x000b000000023be1-185.dat	upx
behavioral2/files/0x000b000000023bdf-175.dat	upx
behavioral2/files/0x000a000000023bde-170.dat	upx
behavioral2/files/0x000a000000023bdc-160.dat	upx
behavioral2/files/0x000a000000023bdb-155.dat	upx
behavioral2/files/0x000a000000023bd9-145.dat	upx
behavioral2/files/0x000a000000023bd6-130.dat	upx
behavioral2/files/0x000a000000023bd5-125.dat	upx
behavioral2/files/0x000a000000023bd3-115.dat	upx
behavioral2/files/0x000a000000023bd2-110.dat	upx
behavioral2/files/0x000a000000023bd1-105.dat	upx
behavioral2/files/0x000b000000023bc3-95.dat	upx
behavioral2/memory/2456-83-0x00007FF7D8440000-0x00007FF7D8832000-memory.dmp	upx
behavioral2/memory/2768-80-0x00007FF74B940000-0x00007FF74BD32000-memory.dmp	upx
behavioral2/files/0x000a000000023bcf-76.dat	upx
behavioral2/files/0x000a000000023bce-74.dat	upx
behavioral2/memory/1520-72-0x00007FF6916B0000-0x00007FF691AA2000-memory.dmp	upx
behavioral2/memory/4416-67-0x00007FF6E7A60000-0x00007FF6E7E52000-memory.dmp	upx
behavioral2/files/0x000a000000023bca-59.dat	upx
behavioral2/memory/4884-46-0x00007FF70F270000-0x00007FF70F662000-memory.dmp	upx
behavioral2/memory/4492-45-0x00007FF624EC0000-0x00007FF6252B2000-memory.dmp	upx
behavioral2/files/0x000a000000023bc8-33.dat	upx
behavioral2/files/0x000a000000023bc7-32.dat	upx
behavioral2/memory/2136-31-0x00007FF6B1440000-0x00007FF6B1832000-memory.dmp	upx
behavioral2/files/0x0010000000023b7b-13.dat	upx
behavioral2/memory/4492-2213-0x00007FF624EC0000-0x00007FF6252B2000-memory.dmp	upx
behavioral2/memory/5092-2214-0x00007FF665920000-0x00007FF665D12000-memory.dmp	upx
behavioral2/memory/4016-2217-0x00007FF75BDD0000-0x00007FF75C1C2000-memory.dmp	upx
behavioral2/memory/4884-2219-0x00007FF70F270000-0x00007FF70F662000-memory.dmp	upx
behavioral2/memory/2136-2221-0x00007FF6B1440000-0x00007FF6B1832000-memory.dmp	upx
behavioral2/memory/4416-2224-0x00007FF6E7A60000-0x00007FF6E7E52000-memory.dmp	upx
behavioral2/memory/4492-2225-0x00007FF624EC0000-0x00007FF6252B2000-memory.dmp	upx
behavioral2/memory/1520-2229-0x00007FF6916B0000-0x00007FF691AA2000-memory.dmp	upx
behavioral2/memory/4048-2233-0x00007FF60F110000-0x00007FF60F502000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\qZmjwDK.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\yrtgOCD.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\oRfwSLP.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\GzdzrAL.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\ULDKLBS.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\DoxfXtz.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\ZZSCJnS.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\YHaXKQt.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\NuJtzIG.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\xgmhNQg.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\ztZgjVl.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\IxFKRUF.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\qXPqoJH.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\wSRKgtN.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\OpMvoDM.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\IksIoUq.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\IfKqiZD.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\BgXOUCo.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\fsGXxJw.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\GwHHHpm.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\MIHwYSP.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\PJOEULq.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\mDSNvHv.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\vtMXOaK.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\HRmbspD.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\eGRWFMd.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\AysWSlH.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\OrnNKJo.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\joGbgpg.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\lYgoEdb.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\dLvBGHJ.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\TvHjnHs.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\lKECQTA.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\blqyNBa.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\ZEAfUOT.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\kbVQuMq.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\HamtotK.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\IKlOakT.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\doWeOic.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\UKBasfr.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\ONfFFVT.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\ZIIlWcc.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\JvfEvTE.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\GHLGAnc.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\eiyfzfa.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\MosYnUI.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\IXJfqmD.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\DnyZeoM.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\JZXsnLO.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\tLMsNeQ.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\aeKEBIy.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\msgFlfD.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\YGiXCwE.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\iSpnsNI.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\ZrNlMcd.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\jToDYkA.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\FNgTWhY.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\GvfiuEu.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\hRItVGs.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\YfHehVA.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\kRVvNMk.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\ITtkMPs.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\eRfpBfX.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\qXeRKvM.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3068	powershell.exe
3068	powershell.exe
3068	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3068	powershell.exe
Token: SeLockMemoryPrivilege	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 3068	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	85
PID 4924 wrote to memory of 3068	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	85
PID 4924 wrote to memory of 4884	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	86
PID 4924 wrote to memory of 4884	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	86
PID 4924 wrote to memory of 4016	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	87
PID 4924 wrote to memory of 4016	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	87
PID 4924 wrote to memory of 2136	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	88
PID 4924 wrote to memory of 2136	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	88
PID 4924 wrote to memory of 4416	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	89
PID 4924 wrote to memory of 4416	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	89
PID 4924 wrote to memory of 4492	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	90
PID 4924 wrote to memory of 4492	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	90
PID 4924 wrote to memory of 3224	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	91
PID 4924 wrote to memory of 3224	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	91
PID 4924 wrote to memory of 4048	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	92
PID 4924 wrote to memory of 4048	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	92
PID 4924 wrote to memory of 2768	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	93
PID 4924 wrote to memory of 2768	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	93
PID 4924 wrote to memory of 1520	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	94
PID 4924 wrote to memory of 1520	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	94
PID 4924 wrote to memory of 2456	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	95
PID 4924 wrote to memory of 2456	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	95
PID 4924 wrote to memory of 5092	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	96
PID 4924 wrote to memory of 5092	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	96
PID 4924 wrote to memory of 2432	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	97
PID 4924 wrote to memory of 2432	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	97
PID 4924 wrote to memory of 1328	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	98
PID 4924 wrote to memory of 1328	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	98
PID 4924 wrote to memory of 1732	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	99
PID 4924 wrote to memory of 1732	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	99
PID 4924 wrote to memory of 440	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	100
PID 4924 wrote to memory of 440	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	100
PID 4924 wrote to memory of 1776	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	101
PID 4924 wrote to memory of 1776	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	101
PID 4924 wrote to memory of 4080	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	102
PID 4924 wrote to memory of 4080	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	102
PID 4924 wrote to memory of 536	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	103
PID 4924 wrote to memory of 536	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	103
PID 4924 wrote to memory of 2392	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	104
PID 4924 wrote to memory of 2392	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	104
PID 4924 wrote to memory of 4312	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	105
PID 4924 wrote to memory of 4312	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	105
PID 4924 wrote to memory of 4740	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	106
PID 4924 wrote to memory of 4740	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	106
PID 4924 wrote to memory of 3800	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	107
PID 4924 wrote to memory of 3800	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	107
PID 4924 wrote to memory of 2676	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	108
PID 4924 wrote to memory of 2676	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	108
PID 4924 wrote to memory of 3640	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	109
PID 4924 wrote to memory of 3640	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	109
PID 4924 wrote to memory of 4020	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	110
PID 4924 wrote to memory of 4020	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	110
PID 4924 wrote to memory of 1524	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	111
PID 4924 wrote to memory of 1524	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	111
PID 4924 wrote to memory of 4664	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	112
PID 4924 wrote to memory of 4664	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	112
PID 4924 wrote to memory of 3064	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	113
PID 4924 wrote to memory of 3064	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	113
PID 4924 wrote to memory of 4840	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	114
PID 4924 wrote to memory of 4840	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	114
PID 4924 wrote to memory of 3080	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	115
PID 4924 wrote to memory of 3080	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	115
PID 4924 wrote to memory of 2984	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	116
PID 4924 wrote to memory of 2984	4924	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3068
- C:\Windows\System\qnAwxEk.exe
  C:\Windows\System\qnAwxEk.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\ojyLKuA.exe
  C:\Windows\System\ojyLKuA.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\ZrNlMcd.exe
  C:\Windows\System\ZrNlMcd.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\auKzpOm.exe
  C:\Windows\System\auKzpOm.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\GvfiuEu.exe
  C:\Windows\System\GvfiuEu.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\ubGSyxY.exe
  C:\Windows\System\ubGSyxY.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\KjgPiNw.exe
  C:\Windows\System\KjgPiNw.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\jKdevlN.exe
  C:\Windows\System\jKdevlN.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\tLMsNeQ.exe
  C:\Windows\System\tLMsNeQ.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\KXaCvta.exe
  C:\Windows\System\KXaCvta.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\wimaaHi.exe
  C:\Windows\System\wimaaHi.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\KaYspJi.exe
  C:\Windows\System\KaYspJi.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\nWSprGU.exe
  C:\Windows\System\nWSprGU.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\EeVfzFs.exe
  C:\Windows\System\EeVfzFs.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\BAjinxW.exe
  C:\Windows\System\BAjinxW.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\oRXdRsU.exe
  C:\Windows\System\oRXdRsU.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\MIHwYSP.exe
  C:\Windows\System\MIHwYSP.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\KDhAogn.exe
  C:\Windows\System\KDhAogn.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\ttrKnke.exe
  C:\Windows\System\ttrKnke.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\BxPlgXU.exe
  C:\Windows\System\BxPlgXU.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\PagSITv.exe
  C:\Windows\System\PagSITv.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\CYZeDJM.exe
  C:\Windows\System\CYZeDJM.exe
  2⤵
  - Executes dropped EXE
  PID:3800
- C:\Windows\System\lgKEczh.exe
  C:\Windows\System\lgKEczh.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\ouXbkVs.exe
  C:\Windows\System\ouXbkVs.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\VXJdbjy.exe
  C:\Windows\System\VXJdbjy.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\brLlugw.exe
  C:\Windows\System\brLlugw.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\nAKDwyV.exe
  C:\Windows\System\nAKDwyV.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\MUhgbrO.exe
  C:\Windows\System\MUhgbrO.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\rpGAEfP.exe
  C:\Windows\System\rpGAEfP.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\UNciCbY.exe
  C:\Windows\System\UNciCbY.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\MwTnnqh.exe
  C:\Windows\System\MwTnnqh.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\HNIyIpN.exe
  C:\Windows\System\HNIyIpN.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\invASoK.exe
  C:\Windows\System\invASoK.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\EUHItbh.exe
  C:\Windows\System\EUHItbh.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\YOToPDx.exe
  C:\Windows\System\YOToPDx.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\eGHWqvj.exe
  C:\Windows\System\eGHWqvj.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\CaJmzWA.exe
  C:\Windows\System\CaJmzWA.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\MyRlONC.exe
  C:\Windows\System\MyRlONC.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\iPciYtz.exe
  C:\Windows\System\iPciYtz.exe
  2⤵
  - Executes dropped EXE
  PID:3728
- C:\Windows\System\qlyGhuL.exe
  C:\Windows\System\qlyGhuL.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\hyjBSFt.exe
  C:\Windows\System\hyjBSFt.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\xgmhNQg.exe
  C:\Windows\System\xgmhNQg.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\FzEirXw.exe
  C:\Windows\System\FzEirXw.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\FstmIVD.exe
  C:\Windows\System\FstmIVD.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\kdnitFZ.exe
  C:\Windows\System\kdnitFZ.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\JSQuddZ.exe
  C:\Windows\System\JSQuddZ.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\DswZGeP.exe
  C:\Windows\System\DswZGeP.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\SXequgB.exe
  C:\Windows\System\SXequgB.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\IfKqiZD.exe
  C:\Windows\System\IfKqiZD.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\KsYhEVC.exe
  C:\Windows\System\KsYhEVC.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\BwBfUgl.exe
  C:\Windows\System\BwBfUgl.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\MpPgeQA.exe
  C:\Windows\System\MpPgeQA.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\rioIKiS.exe
  C:\Windows\System\rioIKiS.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\XikYHsV.exe
  C:\Windows\System\XikYHsV.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\ZFBdcdO.exe
  C:\Windows\System\ZFBdcdO.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\TvHjnHs.exe
  C:\Windows\System\TvHjnHs.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\HyKqedz.exe
  C:\Windows\System\HyKqedz.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\IropsnS.exe
  C:\Windows\System\IropsnS.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\Wdlsdfv.exe
  C:\Windows\System\Wdlsdfv.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\URMpoeQ.exe
  C:\Windows\System\URMpoeQ.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\caBaDmm.exe
  C:\Windows\System\caBaDmm.exe
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Windows\System\NKvyFNb.exe
  C:\Windows\System\NKvyFNb.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\akDcuGc.exe
  C:\Windows\System\akDcuGc.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System\pbNymdX.exe
  C:\Windows\System\pbNymdX.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\JuaWizx.exe
  C:\Windows\System\JuaWizx.exe
  2⤵
  PID:2348
- C:\Windows\System\dpdPPBq.exe
  C:\Windows\System\dpdPPBq.exe
  2⤵
  PID:4248
- C:\Windows\System\NsfeWHm.exe
  C:\Windows\System\NsfeWHm.exe
  2⤵
  PID:232
- C:\Windows\System\MELgInO.exe
  C:\Windows\System\MELgInO.exe
  2⤵
  PID:736
- C:\Windows\System\MosYnUI.exe
  C:\Windows\System\MosYnUI.exe
  2⤵
  PID:4684
- C:\Windows\System\xEIDoYq.exe
  C:\Windows\System\xEIDoYq.exe
  2⤵
  PID:380
- C:\Windows\System\UEBTwTT.exe
  C:\Windows\System\UEBTwTT.exe
  2⤵
  PID:976
- C:\Windows\System\wgEbIaQ.exe
  C:\Windows\System\wgEbIaQ.exe
  2⤵
  PID:2288
- C:\Windows\System\GBSqRUk.exe
  C:\Windows\System\GBSqRUk.exe
  2⤵
  PID:3976
- C:\Windows\System\ONBQYDX.exe
  C:\Windows\System\ONBQYDX.exe
  2⤵
  PID:1144
- C:\Windows\System\mvunfOV.exe
  C:\Windows\System\mvunfOV.exe
  2⤵
  PID:116
- C:\Windows\System\KsMSjbR.exe
  C:\Windows\System\KsMSjbR.exe
  2⤵
  PID:2736
- C:\Windows\System\iWdXPlX.exe
  C:\Windows\System\iWdXPlX.exe
  2⤵
  PID:4612
- C:\Windows\System\jWDMnCJ.exe
  C:\Windows\System\jWDMnCJ.exe
  2⤵
  PID:1812
- C:\Windows\System\aeKEBIy.exe
  C:\Windows\System\aeKEBIy.exe
  2⤵
  PID:3260
- C:\Windows\System\aJnwQoz.exe
  C:\Windows\System\aJnwQoz.exe
  2⤵
  PID:2820
- C:\Windows\System\ULyBzRf.exe
  C:\Windows\System\ULyBzRf.exe
  2⤵
  PID:372
- C:\Windows\System\qCDzeUP.exe
  C:\Windows\System\qCDzeUP.exe
  2⤵
  PID:972
- C:\Windows\System\RQCsTNr.exe
  C:\Windows\System\RQCsTNr.exe
  2⤵
  PID:5128
- C:\Windows\System\xNRnTjV.exe
  C:\Windows\System\xNRnTjV.exe
  2⤵
  PID:5156
- C:\Windows\System\WDjzpLK.exe
  C:\Windows\System\WDjzpLK.exe
  2⤵
  PID:5184
- C:\Windows\System\xFEDvNN.exe
  C:\Windows\System\xFEDvNN.exe
  2⤵
  PID:5212
- C:\Windows\System\AuIgRCH.exe
  C:\Windows\System\AuIgRCH.exe
  2⤵
  PID:5240
- C:\Windows\System\wbdnmoN.exe
  C:\Windows\System\wbdnmoN.exe
  2⤵
  PID:5268
- C:\Windows\System\LSRwHut.exe
  C:\Windows\System\LSRwHut.exe
  2⤵
  PID:5296
- C:\Windows\System\WypABUT.exe
  C:\Windows\System\WypABUT.exe
  2⤵
  PID:5324
- C:\Windows\System\AvzljMy.exe
  C:\Windows\System\AvzljMy.exe
  2⤵
  PID:5352
- C:\Windows\System\BvqeQht.exe
  C:\Windows\System\BvqeQht.exe
  2⤵
  PID:5380
- C:\Windows\System\VNkRhTb.exe
  C:\Windows\System\VNkRhTb.exe
  2⤵
  PID:5408
- C:\Windows\System\tJvrJWA.exe
  C:\Windows\System\tJvrJWA.exe
  2⤵
  PID:5436
- C:\Windows\System\aeSwMmw.exe
  C:\Windows\System\aeSwMmw.exe
  2⤵
  PID:5484
- C:\Windows\System\joGbgpg.exe
  C:\Windows\System\joGbgpg.exe
  2⤵
  PID:5504
- C:\Windows\System\McBODZK.exe
  C:\Windows\System\McBODZK.exe
  2⤵
  PID:5532
- C:\Windows\System\UmmYmec.exe
  C:\Windows\System\UmmYmec.exe
  2⤵
  PID:5548
- C:\Windows\System\vlJvYWT.exe
  C:\Windows\System\vlJvYWT.exe
  2⤵
  PID:5576
- C:\Windows\System\KmGTMjP.exe
  C:\Windows\System\KmGTMjP.exe
  2⤵
  PID:5600
- C:\Windows\System\tUoAuEs.exe
  C:\Windows\System\tUoAuEs.exe
  2⤵
  PID:5628
- C:\Windows\System\NhLnUfQ.exe
  C:\Windows\System\NhLnUfQ.exe
  2⤵
  PID:5660
- C:\Windows\System\IoxwDLY.exe
  C:\Windows\System\IoxwDLY.exe
  2⤵
  PID:5684
- C:\Windows\System\ahtomnT.exe
  C:\Windows\System\ahtomnT.exe
  2⤵
  PID:5772
- C:\Windows\System\bUumjzW.exe
  C:\Windows\System\bUumjzW.exe
  2⤵
  PID:5888
- C:\Windows\System\eeSjkkD.exe
  C:\Windows\System\eeSjkkD.exe
  2⤵
  PID:5908
- C:\Windows\System\UVCuiQV.exe
  C:\Windows\System\UVCuiQV.exe
  2⤵
  PID:5948
- C:\Windows\System\hjCTyTI.exe
  C:\Windows\System\hjCTyTI.exe
  2⤵
  PID:5968
- C:\Windows\System\iAZdpMt.exe
  C:\Windows\System\iAZdpMt.exe
  2⤵
  PID:5988
- C:\Windows\System\dxOOLnj.exe
  C:\Windows\System\dxOOLnj.exe
  2⤵
  PID:6016
- C:\Windows\System\mcljonS.exe
  C:\Windows\System\mcljonS.exe
  2⤵
  PID:6040
- C:\Windows\System\dULobKX.exe
  C:\Windows\System\dULobKX.exe
  2⤵
  PID:6060
- C:\Windows\System\NgDEdvy.exe
  C:\Windows\System\NgDEdvy.exe
  2⤵
  PID:6076
- C:\Windows\System\hSGiSVm.exe
  C:\Windows\System\hSGiSVm.exe
  2⤵
  PID:6104
- C:\Windows\System\gqbDkFO.exe
  C:\Windows\System\gqbDkFO.exe
  2⤵
  PID:6120
- C:\Windows\System\vjBWsiF.exe
  C:\Windows\System\vjBWsiF.exe
  2⤵
  PID:4380
- C:\Windows\System\YohddgD.exe
  C:\Windows\System\YohddgD.exe
  2⤵
  PID:2084
- C:\Windows\System\UBWmbOJ.exe
  C:\Windows\System\UBWmbOJ.exe
  2⤵
  PID:4028
- C:\Windows\System\UjjrmFb.exe
  C:\Windows\System\UjjrmFb.exe
  2⤵
  PID:436
- C:\Windows\System\GMslSxN.exe
  C:\Windows\System\GMslSxN.exe
  2⤵
  PID:5148
- C:\Windows\System\qEGXjZY.exe
  C:\Windows\System\qEGXjZY.exe
  2⤵
  PID:5260
- C:\Windows\System\pPMXldn.exe
  C:\Windows\System\pPMXldn.exe
  2⤵
  PID:5336
- C:\Windows\System\thPBelm.exe
  C:\Windows\System\thPBelm.exe
  2⤵
  PID:1908
- C:\Windows\System\dhBKmmF.exe
  C:\Windows\System\dhBKmmF.exe
  2⤵
  PID:5400
- C:\Windows\System\dSnUgOX.exe
  C:\Windows\System\dSnUgOX.exe
  2⤵
  PID:5452
- C:\Windows\System\yWuxiYR.exe
  C:\Windows\System\yWuxiYR.exe
  2⤵
  PID:2556
- C:\Windows\System\ZzFubIW.exe
  C:\Windows\System\ZzFubIW.exe
  2⤵
  PID:5544
- C:\Windows\System\RzEqsTJ.exe
  C:\Windows\System\RzEqsTJ.exe
  2⤵
  PID:4372
- C:\Windows\System\pxWhVrd.exe
  C:\Windows\System\pxWhVrd.exe
  2⤵
  PID:2144
- C:\Windows\System\cegtoQF.exe
  C:\Windows\System\cegtoQF.exe
  2⤵
  PID:4732
- C:\Windows\System\meQWbpw.exe
  C:\Windows\System\meQWbpw.exe
  2⤵
  PID:5644
- C:\Windows\System\DSYUhOm.exe
  C:\Windows\System\DSYUhOm.exe
  2⤵
  PID:1928
- C:\Windows\System\UKBasfr.exe
  C:\Windows\System\UKBasfr.exe
  2⤵
  PID:3692
- C:\Windows\System\wdsaIBb.exe
  C:\Windows\System\wdsaIBb.exe
  2⤵
  PID:5760
- C:\Windows\System\CtrvTyx.exe
  C:\Windows\System\CtrvTyx.exe
  2⤵
  PID:5812
- C:\Windows\System\kzSaWrN.exe
  C:\Windows\System\kzSaWrN.exe
  2⤵
  PID:5716
- C:\Windows\System\IOaGcLP.exe
  C:\Windows\System\IOaGcLP.exe
  2⤵
  PID:5740
- C:\Windows\System\MYCphhp.exe
  C:\Windows\System\MYCphhp.exe
  2⤵
  PID:5904
- C:\Windows\System\uqCXchx.exe
  C:\Windows\System\uqCXchx.exe
  2⤵
  PID:5960
- C:\Windows\System\yrtgOCD.exe
  C:\Windows\System\yrtgOCD.exe
  2⤵
  PID:6068
- C:\Windows\System\cdPbXor.exe
  C:\Windows\System\cdPbXor.exe
  2⤵
  PID:6092
- C:\Windows\System\ngZmhBA.exe
  C:\Windows\System\ngZmhBA.exe
  2⤵
  PID:4000
- C:\Windows\System\APaDSAh.exe
  C:\Windows\System\APaDSAh.exe
  2⤵
  PID:1320
- C:\Windows\System\ufedDwk.exe
  C:\Windows\System\ufedDwk.exe
  2⤵
  PID:5176
- C:\Windows\System\kiCHRGe.exe
  C:\Windows\System\kiCHRGe.exe
  2⤵
  PID:5316
- C:\Windows\System\Pfkpwsr.exe
  C:\Windows\System\Pfkpwsr.exe
  2⤵
  PID:5424
- C:\Windows\System\XFcSAyc.exe
  C:\Windows\System\XFcSAyc.exe
  2⤵
  PID:5420
- C:\Windows\System\OpJdFsV.exe
  C:\Windows\System\OpJdFsV.exe
  2⤵
  PID:5588
- C:\Windows\System\kRJDymx.exe
  C:\Windows\System\kRJDymx.exe
  2⤵
  PID:2496
- C:\Windows\System\ImIoOiF.exe
  C:\Windows\System\ImIoOiF.exe
  2⤵
  PID:5800
- C:\Windows\System\HIzsBfd.exe
  C:\Windows\System\HIzsBfd.exe
  2⤵
  PID:3668
- C:\Windows\System\GzGKxyT.exe
  C:\Windows\System\GzGKxyT.exe
  2⤵
  PID:5884
- C:\Windows\System\CZGkdyc.exe
  C:\Windows\System\CZGkdyc.exe
  2⤵
  PID:6048
- C:\Windows\System\QjbFMEH.exe
  C:\Windows\System\QjbFMEH.exe
  2⤵
  PID:5396
- C:\Windows\System\IjKRico.exe
  C:\Windows\System\IjKRico.exe
  2⤵
  PID:5456
- C:\Windows\System\KqllzOP.exe
  C:\Windows\System\KqllzOP.exe
  2⤵
  PID:2236
- C:\Windows\System\FghxWiY.exe
  C:\Windows\System\FghxWiY.exe
  2⤵
  PID:2612
- C:\Windows\System\FRLZTir.exe
  C:\Windows\System\FRLZTir.exe
  2⤵
  PID:4144
- C:\Windows\System\ojeezvy.exe
  C:\Windows\System\ojeezvy.exe
  2⤵
  PID:5144
- C:\Windows\System\EVmjbUV.exe
  C:\Windows\System\EVmjbUV.exe
  2⤵
  PID:3840
- C:\Windows\System\yBPCNAi.exe
  C:\Windows\System\yBPCNAi.exe
  2⤵
  PID:6148
- C:\Windows\System\mVUQmdT.exe
  C:\Windows\System\mVUQmdT.exe
  2⤵
  PID:6172
- C:\Windows\System\nDZQuIq.exe
  C:\Windows\System\nDZQuIq.exe
  2⤵
  PID:6192
- C:\Windows\System\XCioIdC.exe
  C:\Windows\System\XCioIdC.exe
  2⤵
  PID:6220
- C:\Windows\System\yDWtyxi.exe
  C:\Windows\System\yDWtyxi.exe
  2⤵
  PID:6248
- C:\Windows\System\KQNCvCN.exe
  C:\Windows\System\KQNCvCN.exe
  2⤵
  PID:6276
- C:\Windows\System\qMYzwsn.exe
  C:\Windows\System\qMYzwsn.exe
  2⤵
  PID:6304
- C:\Windows\System\NnidcAA.exe
  C:\Windows\System\NnidcAA.exe
  2⤵
  PID:6328
- C:\Windows\System\VZCYXLL.exe
  C:\Windows\System\VZCYXLL.exe
  2⤵
  PID:6352
- C:\Windows\System\lahvLwv.exe
  C:\Windows\System\lahvLwv.exe
  2⤵
  PID:6376
- C:\Windows\System\JNXNutc.exe
  C:\Windows\System\JNXNutc.exe
  2⤵
  PID:6400
- C:\Windows\System\BFrsrrP.exe
  C:\Windows\System\BFrsrrP.exe
  2⤵
  PID:6420
- C:\Windows\System\btznRHt.exe
  C:\Windows\System\btznRHt.exe
  2⤵
  PID:6448
- C:\Windows\System\wQxiibU.exe
  C:\Windows\System\wQxiibU.exe
  2⤵
  PID:6468
- C:\Windows\System\ybEWbDV.exe
  C:\Windows\System\ybEWbDV.exe
  2⤵
  PID:6516
- C:\Windows\System\SaPRIfK.exe
  C:\Windows\System\SaPRIfK.exe
  2⤵
  PID:6544
- C:\Windows\System\nlKnqmx.exe
  C:\Windows\System\nlKnqmx.exe
  2⤵
  PID:6564
- C:\Windows\System\VaHFMBr.exe
  C:\Windows\System\VaHFMBr.exe
  2⤵
  PID:6588
- C:\Windows\System\hRItVGs.exe
  C:\Windows\System\hRItVGs.exe
  2⤵
  PID:6620
- C:\Windows\System\BJHYxih.exe
  C:\Windows\System\BJHYxih.exe
  2⤵
  PID:6644
- C:\Windows\System\KTlwoMh.exe
  C:\Windows\System\KTlwoMh.exe
  2⤵
  PID:6668
- C:\Windows\System\BQMPhmV.exe
  C:\Windows\System\BQMPhmV.exe
  2⤵
  PID:6688
- C:\Windows\System\PtnpCSu.exe
  C:\Windows\System\PtnpCSu.exe
  2⤵
  PID:6708
- C:\Windows\System\jyFBwyI.exe
  C:\Windows\System\jyFBwyI.exe
  2⤵
  PID:6728
- C:\Windows\System\wXoJuSZ.exe
  C:\Windows\System\wXoJuSZ.exe
  2⤵
  PID:6760
- C:\Windows\System\sBHsaKa.exe
  C:\Windows\System\sBHsaKa.exe
  2⤵
  PID:6840
- C:\Windows\System\RawhTAH.exe
  C:\Windows\System\RawhTAH.exe
  2⤵
  PID:6864
- C:\Windows\System\yMsrefQ.exe
  C:\Windows\System\yMsrefQ.exe
  2⤵
  PID:6892
- C:\Windows\System\YfHehVA.exe
  C:\Windows\System\YfHehVA.exe
  2⤵
  PID:6908
- C:\Windows\System\DOmWdJd.exe
  C:\Windows\System\DOmWdJd.exe
  2⤵
  PID:6944
- C:\Windows\System\lOMUdEj.exe
  C:\Windows\System\lOMUdEj.exe
  2⤵
  PID:6980
- C:\Windows\System\QBGmRog.exe
  C:\Windows\System\QBGmRog.exe
  2⤵
  PID:7008
- C:\Windows\System\JrPVjdU.exe
  C:\Windows\System\JrPVjdU.exe
  2⤵
  PID:7044
- C:\Windows\System\dgVSdae.exe
  C:\Windows\System\dgVSdae.exe
  2⤵
  PID:7076
- C:\Windows\System\hKgcBTf.exe
  C:\Windows\System\hKgcBTf.exe
  2⤵
  PID:7096
- C:\Windows\System\BgXOUCo.exe
  C:\Windows\System\BgXOUCo.exe
  2⤵
  PID:7128
- C:\Windows\System\GXkRSFo.exe
  C:\Windows\System\GXkRSFo.exe
  2⤵
  PID:7144
- C:\Windows\System\DGdVvHo.exe
  C:\Windows\System\DGdVvHo.exe
  2⤵
  PID:6164
- C:\Windows\System\IRjgZDO.exe
  C:\Windows\System\IRjgZDO.exe
  2⤵
  PID:6212
- C:\Windows\System\FIfIIwa.exe
  C:\Windows\System\FIfIIwa.exe
  2⤵
  PID:6316
- C:\Windows\System\GULaczS.exe
  C:\Windows\System\GULaczS.exe
  2⤵
  PID:6396
- C:\Windows\System\oRfwSLP.exe
  C:\Windows\System\oRfwSLP.exe
  2⤵
  PID:6372
- C:\Windows\System\MPVtafq.exe
  C:\Windows\System\MPVtafq.exe
  2⤵
  PID:6464
- C:\Windows\System\FUTQcns.exe
  C:\Windows\System\FUTQcns.exe
  2⤵
  PID:6460
- C:\Windows\System\zkkOzuk.exe
  C:\Windows\System\zkkOzuk.exe
  2⤵
  PID:6508
- C:\Windows\System\qXJlVFS.exe
  C:\Windows\System\qXJlVFS.exe
  2⤵
  PID:6580
- C:\Windows\System\CUjSVug.exe
  C:\Windows\System\CUjSVug.exe
  2⤵
  PID:6696
- C:\Windows\System\oGXRnvR.exe
  C:\Windows\System\oGXRnvR.exe
  2⤵
  PID:6772
- C:\Windows\System\kYHitwA.exe
  C:\Windows\System\kYHitwA.exe
  2⤵
  PID:6876
- C:\Windows\System\zStFmHt.exe
  C:\Windows\System\zStFmHt.exe
  2⤵
  PID:6900
- C:\Windows\System\zXtuAvn.exe
  C:\Windows\System\zXtuAvn.exe
  2⤵
  PID:6952
- C:\Windows\System\axGPMuw.exe
  C:\Windows\System\axGPMuw.exe
  2⤵
  PID:7004
- C:\Windows\System\LBvNkQC.exe
  C:\Windows\System\LBvNkQC.exe
  2⤵
  PID:7040
- C:\Windows\System\vzJjPpw.exe
  C:\Windows\System\vzJjPpw.exe
  2⤵
  PID:6188
- C:\Windows\System\GpUpeyi.exe
  C:\Windows\System\GpUpeyi.exe
  2⤵
  PID:6284
- C:\Windows\System\qwmDHnd.exe
  C:\Windows\System\qwmDHnd.exe
  2⤵
  PID:6540
- C:\Windows\System\djIAVBi.exe
  C:\Windows\System\djIAVBi.exe
  2⤵
  PID:6636
- C:\Windows\System\wNfpQYw.exe
  C:\Windows\System\wNfpQYw.exe
  2⤵
  PID:6856
- C:\Windows\System\NRgIhhE.exe
  C:\Windows\System\NRgIhhE.exe
  2⤵
  PID:7000
- C:\Windows\System\elwsgkA.exe
  C:\Windows\System\elwsgkA.exe
  2⤵
  PID:6360
- C:\Windows\System\jYxHjST.exe
  C:\Windows\System\jYxHjST.exe
  2⤵
  PID:6256
- C:\Windows\System\OkAPbft.exe
  C:\Windows\System\OkAPbft.exe
  2⤵
  PID:6852
- C:\Windows\System\lYgoEdb.exe
  C:\Windows\System\lYgoEdb.exe
  2⤵
  PID:6340
- C:\Windows\System\MQeaCbz.exe
  C:\Windows\System\MQeaCbz.exe
  2⤵
  PID:6976
- C:\Windows\System\kdPeqFY.exe
  C:\Windows\System\kdPeqFY.exe
  2⤵
  PID:7188
- C:\Windows\System\OqtOEjo.exe
  C:\Windows\System\OqtOEjo.exe
  2⤵
  PID:7224
- C:\Windows\System\dGVLDVR.exe
  C:\Windows\System\dGVLDVR.exe
  2⤵
  PID:7244
- C:\Windows\System\bRvSGoU.exe
  C:\Windows\System\bRvSGoU.exe
  2⤵
  PID:7264
- C:\Windows\System\BhrYFpB.exe
  C:\Windows\System\BhrYFpB.exe
  2⤵
  PID:7288
- C:\Windows\System\vzgugfE.exe
  C:\Windows\System\vzgugfE.exe
  2⤵
  PID:7308
- C:\Windows\System\sooajGa.exe
  C:\Windows\System\sooajGa.exe
  2⤵
  PID:7332
- C:\Windows\System\qinkJZX.exe
  C:\Windows\System\qinkJZX.exe
  2⤵
  PID:7368
- C:\Windows\System\rSwCYYP.exe
  C:\Windows\System\rSwCYYP.exe
  2⤵
  PID:7404
- C:\Windows\System\yEUFfrR.exe
  C:\Windows\System\yEUFfrR.exe
  2⤵
  PID:7432
- C:\Windows\System\MCHLxds.exe
  C:\Windows\System\MCHLxds.exe
  2⤵
  PID:7456
- C:\Windows\System\EqCdpVi.exe
  C:\Windows\System\EqCdpVi.exe
  2⤵
  PID:7476
- C:\Windows\System\prkbBdL.exe
  C:\Windows\System\prkbBdL.exe
  2⤵
  PID:7508
- C:\Windows\System\setffEE.exe
  C:\Windows\System\setffEE.exe
  2⤵
  PID:7536
- C:\Windows\System\KmTuRYi.exe
  C:\Windows\System\KmTuRYi.exe
  2⤵
  PID:7576
- C:\Windows\System\NqfISsW.exe
  C:\Windows\System\NqfISsW.exe
  2⤵
  PID:7600
- C:\Windows\System\ZZSCJnS.exe
  C:\Windows\System\ZZSCJnS.exe
  2⤵
  PID:7628
- C:\Windows\System\YHaXKQt.exe
  C:\Windows\System\YHaXKQt.exe
  2⤵
  PID:7648
- C:\Windows\System\IXJfqmD.exe
  C:\Windows\System\IXJfqmD.exe
  2⤵
  PID:7676
- C:\Windows\System\gOWDcgM.exe
  C:\Windows\System\gOWDcgM.exe
  2⤵
  PID:7692
- C:\Windows\System\LPsioJw.exe
  C:\Windows\System\LPsioJw.exe
  2⤵
  PID:7724
- C:\Windows\System\KzgyRMX.exe
  C:\Windows\System\KzgyRMX.exe
  2⤵
  PID:7764
- C:\Windows\System\KiYpMig.exe
  C:\Windows\System\KiYpMig.exe
  2⤵
  PID:7800
- C:\Windows\System\euUYTAn.exe
  C:\Windows\System\euUYTAn.exe
  2⤵
  PID:7824
- C:\Windows\System\fdqErVc.exe
  C:\Windows\System\fdqErVc.exe
  2⤵
  PID:7864
- C:\Windows\System\YQFoYAG.exe
  C:\Windows\System\YQFoYAG.exe
  2⤵
  PID:7888
- C:\Windows\System\AJYvtSl.exe
  C:\Windows\System\AJYvtSl.exe
  2⤵
  PID:7912
- C:\Windows\System\HGshIan.exe
  C:\Windows\System\HGshIan.exe
  2⤵
  PID:7940
- C:\Windows\System\hOrpCwc.exe
  C:\Windows\System\hOrpCwc.exe
  2⤵
  PID:7972
- C:\Windows\System\ThMqSwJ.exe
  C:\Windows\System\ThMqSwJ.exe
  2⤵
  PID:7992
- C:\Windows\System\JFHbhRs.exe
  C:\Windows\System\JFHbhRs.exe
  2⤵
  PID:8012
- C:\Windows\System\UFHoPNp.exe
  C:\Windows\System\UFHoPNp.exe
  2⤵
  PID:8068
- C:\Windows\System\NuJtzIG.exe
  C:\Windows\System\NuJtzIG.exe
  2⤵
  PID:8084
- C:\Windows\System\xHedaQH.exe
  C:\Windows\System\xHedaQH.exe
  2⤵
  PID:8104
- C:\Windows\System\LwXhuYQ.exe
  C:\Windows\System\LwXhuYQ.exe
  2⤵
  PID:8128
- C:\Windows\System\ApPEpAy.exe
  C:\Windows\System\ApPEpAy.exe
  2⤵
  PID:8156
- C:\Windows\System\GBPATod.exe
  C:\Windows\System\GBPATod.exe
  2⤵
  PID:8180
- C:\Windows\System\ynnwPfr.exe
  C:\Windows\System\ynnwPfr.exe
  2⤵
  PID:7176
- C:\Windows\System\qxvZJKq.exe
  C:\Windows\System\qxvZJKq.exe
  2⤵
  PID:7232
- C:\Windows\System\ZyzIJIZ.exe
  C:\Windows\System\ZyzIJIZ.exe
  2⤵
  PID:7300
- C:\Windows\System\wwJCjKX.exe
  C:\Windows\System\wwJCjKX.exe
  2⤵
  PID:7356
- C:\Windows\System\vAnCUsz.exe
  C:\Windows\System\vAnCUsz.exe
  2⤵
  PID:7548
- C:\Windows\System\gJOqvRc.exe
  C:\Windows\System\gJOqvRc.exe
  2⤵
  PID:7572
- C:\Windows\System\JyGAkJB.exe
  C:\Windows\System\JyGAkJB.exe
  2⤵
  PID:7612
- C:\Windows\System\JqJXXQP.exe
  C:\Windows\System\JqJXXQP.exe
  2⤵
  PID:7640
- C:\Windows\System\axeQcbY.exe
  C:\Windows\System\axeQcbY.exe
  2⤵
  PID:7708
- C:\Windows\System\jpxqFuR.exe
  C:\Windows\System\jpxqFuR.exe
  2⤵
  PID:7736
- C:\Windows\System\MvUQqGE.exe
  C:\Windows\System\MvUQqGE.exe
  2⤵
  PID:7884
- C:\Windows\System\cWKeUwh.exe
  C:\Windows\System\cWKeUwh.exe
  2⤵
  PID:7904
- C:\Windows\System\pyoYkyD.exe
  C:\Windows\System\pyoYkyD.exe
  2⤵
  PID:8008
- C:\Windows\System\BAFMpHO.exe
  C:\Windows\System\BAFMpHO.exe
  2⤵
  PID:8024
- C:\Windows\System\zAMrCrj.exe
  C:\Windows\System\zAMrCrj.exe
  2⤵
  PID:8140
- C:\Windows\System\tGbyFGf.exe
  C:\Windows\System\tGbyFGf.exe
  2⤵
  PID:8100
- C:\Windows\System\iQYCitu.exe
  C:\Windows\System\iQYCitu.exe
  2⤵
  PID:7316
- C:\Windows\System\pCFbxWi.exe
  C:\Windows\System\pCFbxWi.exe
  2⤵
  PID:7448
- C:\Windows\System\kbVQuMq.exe
  C:\Windows\System\kbVQuMq.exe
  2⤵
  PID:7688
- C:\Windows\System\wATtfIP.exe
  C:\Windows\System\wATtfIP.exe
  2⤵
  PID:7852
- C:\Windows\System\JZXsnLO.exe
  C:\Windows\System\JZXsnLO.exe
  2⤵
  PID:7964
- C:\Windows\System\NJeqBxY.exe
  C:\Windows\System\NJeqBxY.exe
  2⤵
  PID:8092
- C:\Windows\System\sPMszsY.exe
  C:\Windows\System\sPMszsY.exe
  2⤵
  PID:7280
- C:\Windows\System\XCUQYBj.exe
  C:\Windows\System\XCUQYBj.exe
  2⤵
  PID:7584
- C:\Windows\System\fgGvpri.exe
  C:\Windows\System\fgGvpri.exe
  2⤵
  PID:7752
- C:\Windows\System\HRmbspD.exe
  C:\Windows\System\HRmbspD.exe
  2⤵
  PID:7592
- C:\Windows\System\GwFfaWC.exe
  C:\Windows\System\GwFfaWC.exe
  2⤵
  PID:8204
- C:\Windows\System\iVvCZXO.exe
  C:\Windows\System\iVvCZXO.exe
  2⤵
  PID:8228
- C:\Windows\System\ZItjhFe.exe
  C:\Windows\System\ZItjhFe.exe
  2⤵
  PID:8260
- C:\Windows\System\CSMGNeO.exe
  C:\Windows\System\CSMGNeO.exe
  2⤵
  PID:8296
- C:\Windows\System\gkCoWoG.exe
  C:\Windows\System\gkCoWoG.exe
  2⤵
  PID:8316
- C:\Windows\System\Xvvhcdt.exe
  C:\Windows\System\Xvvhcdt.exe
  2⤵
  PID:8344
- C:\Windows\System\oaRyMmT.exe
  C:\Windows\System\oaRyMmT.exe
  2⤵
  PID:8364
- C:\Windows\System\aghGYtX.exe
  C:\Windows\System\aghGYtX.exe
  2⤵
  PID:8384
- C:\Windows\System\cgviHVW.exe
  C:\Windows\System\cgviHVW.exe
  2⤵
  PID:8404
- C:\Windows\System\MXGpssW.exe
  C:\Windows\System\MXGpssW.exe
  2⤵
  PID:8476
- C:\Windows\System\eDNXuKH.exe
  C:\Windows\System\eDNXuKH.exe
  2⤵
  PID:8496
- C:\Windows\System\pxKTZVU.exe
  C:\Windows\System\pxKTZVU.exe
  2⤵
  PID:8552
- C:\Windows\System\FLNrCUE.exe
  C:\Windows\System\FLNrCUE.exe
  2⤵
  PID:8616
- C:\Windows\System\mEIGlnS.exe
  C:\Windows\System\mEIGlnS.exe
  2⤵
  PID:8632
- C:\Windows\System\wwvMzTz.exe
  C:\Windows\System\wwvMzTz.exe
  2⤵
  PID:8648
- C:\Windows\System\GxYWFWz.exe
  C:\Windows\System\GxYWFWz.exe
  2⤵
  PID:8664
- C:\Windows\System\aIpSzFv.exe
  C:\Windows\System\aIpSzFv.exe
  2⤵
  PID:8680
- C:\Windows\System\EhHFqyD.exe
  C:\Windows\System\EhHFqyD.exe
  2⤵
  PID:8696
- C:\Windows\System\dSJPArI.exe
  C:\Windows\System\dSJPArI.exe
  2⤵
  PID:8712
- C:\Windows\System\dygLiyL.exe
  C:\Windows\System\dygLiyL.exe
  2⤵
  PID:8728
- C:\Windows\System\nDbKkTi.exe
  C:\Windows\System\nDbKkTi.exe
  2⤵
  PID:8748
- C:\Windows\System\SBGqnZA.exe
  C:\Windows\System\SBGqnZA.exe
  2⤵
  PID:8788
- C:\Windows\System\HRZFzDt.exe
  C:\Windows\System\HRZFzDt.exe
  2⤵
  PID:8808
- C:\Windows\System\BTSJBHO.exe
  C:\Windows\System\BTSJBHO.exe
  2⤵
  PID:8864
- C:\Windows\System\PUvmCVM.exe
  C:\Windows\System\PUvmCVM.exe
  2⤵
  PID:8892
- C:\Windows\System\KCqrLmv.exe
  C:\Windows\System\KCqrLmv.exe
  2⤵
  PID:8912
- C:\Windows\System\blqyNBa.exe
  C:\Windows\System\blqyNBa.exe
  2⤵
  PID:9004
- C:\Windows\System\AtjgWgM.exe
  C:\Windows\System\AtjgWgM.exe
  2⤵
  PID:9020
- C:\Windows\System\EkVjEXc.exe
  C:\Windows\System\EkVjEXc.exe
  2⤵
  PID:9044
- C:\Windows\System\ITtkMPs.exe
  C:\Windows\System\ITtkMPs.exe
  2⤵
  PID:9084
- C:\Windows\System\koPMpUs.exe
  C:\Windows\System\koPMpUs.exe
  2⤵
  PID:9112
- C:\Windows\System\lkAqown.exe
  C:\Windows\System\lkAqown.exe
  2⤵
  PID:9144
- C:\Windows\System\fiHMEyy.exe
  C:\Windows\System\fiHMEyy.exe
  2⤵
  PID:9164
- C:\Windows\System\OXYqIJX.exe
  C:\Windows\System\OXYqIJX.exe
  2⤵
  PID:9204
- C:\Windows\System\OJafzSm.exe
  C:\Windows\System\OJafzSm.exe
  2⤵
  PID:8216
- C:\Windows\System\XoiVMpV.exe
  C:\Windows\System\XoiVMpV.exe
  2⤵
  PID:8308
- C:\Windows\System\fusrdQz.exe
  C:\Windows\System\fusrdQz.exe
  2⤵
  PID:8372
- C:\Windows\System\Yoxlpmo.exe
  C:\Windows\System\Yoxlpmo.exe
  2⤵
  PID:8380
- C:\Windows\System\pHWtuxZ.exe
  C:\Windows\System\pHWtuxZ.exe
  2⤵
  PID:8472
- C:\Windows\System\olUfjTq.exe
  C:\Windows\System\olUfjTq.exe
  2⤵
  PID:8604
- C:\Windows\System\TmWEzch.exe
  C:\Windows\System\TmWEzch.exe
  2⤵
  PID:8692
- C:\Windows\System\eNwXgiT.exe
  C:\Windows\System\eNwXgiT.exe
  2⤵
  PID:8548
- C:\Windows\System\fsGXxJw.exe
  C:\Windows\System\fsGXxJw.exe
  2⤵
  PID:8640
- C:\Windows\System\aFreBDo.exe
  C:\Windows\System\aFreBDo.exe
  2⤵
  PID:8624
- C:\Windows\System\iXHERhE.exe
  C:\Windows\System\iXHERhE.exe
  2⤵
  PID:8704
- C:\Windows\System\dFcTjye.exe
  C:\Windows\System\dFcTjye.exe
  2⤵
  PID:8932
- C:\Windows\System\eLwHdLM.exe
  C:\Windows\System\eLwHdLM.exe
  2⤵
  PID:8804
- C:\Windows\System\WyRehwB.exe
  C:\Windows\System\WyRehwB.exe
  2⤵
  PID:8872
- C:\Windows\System\rpgVOxY.exe
  C:\Windows\System\rpgVOxY.exe
  2⤵
  PID:9012
- C:\Windows\System\YIhuMFx.exe
  C:\Windows\System\YIhuMFx.exe
  2⤵
  PID:9040
- C:\Windows\System\xfbGrRP.exe
  C:\Windows\System\xfbGrRP.exe
  2⤵
  PID:9196
- C:\Windows\System\VhstKHv.exe
  C:\Windows\System\VhstKHv.exe
  2⤵
  PID:9140
- C:\Windows\System\UrbKiRI.exe
  C:\Windows\System\UrbKiRI.exe
  2⤵
  PID:8336
- C:\Windows\System\pNLyDIC.exe
  C:\Windows\System\pNLyDIC.exe
  2⤵
  PID:8492
- C:\Windows\System\NATxXzv.exe
  C:\Windows\System\NATxXzv.exe
  2⤵
  PID:8544
- C:\Windows\System\xHYVLIV.exe
  C:\Windows\System\xHYVLIV.exe
  2⤵
  PID:8600
- C:\Windows\System\gDfDlpf.exe
  C:\Windows\System\gDfDlpf.exe
  2⤵
  PID:8568
- C:\Windows\System\TGwufGk.exe
  C:\Windows\System\TGwufGk.exe
  2⤵
  PID:8756
- C:\Windows\System\ZTaJfiq.exe
  C:\Windows\System\ZTaJfiq.exe
  2⤵
  PID:8960
- C:\Windows\System\qmDSQsG.exe
  C:\Windows\System\qmDSQsG.exe
  2⤵
  PID:9056
- C:\Windows\System\ZZGBkZz.exe
  C:\Windows\System\ZZGBkZz.exe
  2⤵
  PID:8284
- C:\Windows\System\Vlistfv.exe
  C:\Windows\System\Vlistfv.exe
  2⤵
  PID:8564
- C:\Windows\System\kudilAu.exe
  C:\Windows\System\kudilAu.exe
  2⤵
  PID:8908
- C:\Windows\System\JZyfxTi.exe
  C:\Windows\System\JZyfxTi.exe
  2⤵
  PID:9240
- C:\Windows\System\NCizBxy.exe
  C:\Windows\System\NCizBxy.exe
  2⤵
  PID:9256
- C:\Windows\System\clVTqzj.exe
  C:\Windows\System\clVTqzj.exe
  2⤵
  PID:9308
- C:\Windows\System\xcgqCeC.exe
  C:\Windows\System\xcgqCeC.exe
  2⤵
  PID:9328
- C:\Windows\System\hIyufbo.exe
  C:\Windows\System\hIyufbo.exe
  2⤵
  PID:9348
- C:\Windows\System\FvtLwXi.exe
  C:\Windows\System\FvtLwXi.exe
  2⤵
  PID:9392
- C:\Windows\System\WELSMhS.exe
  C:\Windows\System\WELSMhS.exe
  2⤵
  PID:9412
- C:\Windows\System\lzGOOHp.exe
  C:\Windows\System\lzGOOHp.exe
  2⤵
  PID:9428
- C:\Windows\System\wArarqs.exe
  C:\Windows\System\wArarqs.exe
  2⤵
  PID:9448
- C:\Windows\System\xOKuxEb.exe
  C:\Windows\System\xOKuxEb.exe
  2⤵
  PID:9472
- C:\Windows\System\DnyZeoM.exe
  C:\Windows\System\DnyZeoM.exe
  2⤵
  PID:9492
- C:\Windows\System\vsqLSlP.exe
  C:\Windows\System\vsqLSlP.exe
  2⤵
  PID:9544
- C:\Windows\System\cCNukka.exe
  C:\Windows\System\cCNukka.exe
  2⤵
  PID:9588
- C:\Windows\System\dYyyRtd.exe
  C:\Windows\System\dYyyRtd.exe
  2⤵
  PID:9608
- C:\Windows\System\lJjXhMy.exe
  C:\Windows\System\lJjXhMy.exe
  2⤵
  PID:9624
- C:\Windows\System\ICJyVPR.exe
  C:\Windows\System\ICJyVPR.exe
  2⤵
  PID:9672
- C:\Windows\System\qvCnrab.exe
  C:\Windows\System\qvCnrab.exe
  2⤵
  PID:9692
- C:\Windows\System\SHbvZVa.exe
  C:\Windows\System\SHbvZVa.exe
  2⤵
  PID:9708
- C:\Windows\System\KMBeZCW.exe
  C:\Windows\System\KMBeZCW.exe
  2⤵
  PID:9748
- C:\Windows\System\MGoqnZB.exe
  C:\Windows\System\MGoqnZB.exe
  2⤵
  PID:9768
- C:\Windows\System\dKTVDWB.exe
  C:\Windows\System\dKTVDWB.exe
  2⤵
  PID:9796
- C:\Windows\System\GzdzrAL.exe
  C:\Windows\System\GzdzrAL.exe
  2⤵
  PID:9832
- C:\Windows\System\fJbtblG.exe
  C:\Windows\System\fJbtblG.exe
  2⤵
  PID:9848
- C:\Windows\System\YrvRDEi.exe
  C:\Windows\System\YrvRDEi.exe
  2⤵
  PID:9888
- C:\Windows\System\sHWNopS.exe
  C:\Windows\System\sHWNopS.exe
  2⤵
  PID:9908
- C:\Windows\System\nzVeZBa.exe
  C:\Windows\System\nzVeZBa.exe
  2⤵
  PID:9936
- C:\Windows\System\hTHqogZ.exe
  C:\Windows\System\hTHqogZ.exe
  2⤵
  PID:9988
- C:\Windows\System\gbKKvxI.exe
  C:\Windows\System\gbKKvxI.exe
  2⤵
  PID:10008
- C:\Windows\System\PHJUglF.exe
  C:\Windows\System\PHJUglF.exe
  2⤵
  PID:10036
- C:\Windows\System\BCDKDZJ.exe
  C:\Windows\System\BCDKDZJ.exe
  2⤵
  PID:10060
- C:\Windows\System\WpXZxll.exe
  C:\Windows\System\WpXZxll.exe
  2⤵
  PID:10092
- C:\Windows\System\RPGSKqW.exe
  C:\Windows\System\RPGSKqW.exe
  2⤵
  PID:10116
- C:\Windows\System\NynWQle.exe
  C:\Windows\System\NynWQle.exe
  2⤵
  PID:10156
- C:\Windows\System\YEDkayl.exe
  C:\Windows\System\YEDkayl.exe
  2⤵
  PID:10180
- C:\Windows\System\ihFHYUw.exe
  C:\Windows\System\ihFHYUw.exe
  2⤵
  PID:10200
- C:\Windows\System\avFsZju.exe
  C:\Windows\System\avFsZju.exe
  2⤵
  PID:10224
- C:\Windows\System\EZvbypM.exe
  C:\Windows\System\EZvbypM.exe
  2⤵
  PID:8720
- C:\Windows\System\KyGyWRL.exe
  C:\Windows\System\KyGyWRL.exe
  2⤵
  PID:9296
- C:\Windows\System\dJuMWXs.exe
  C:\Windows\System\dJuMWXs.exe
  2⤵
  PID:9316
- C:\Windows\System\EHienoj.exe
  C:\Windows\System\EHienoj.exe
  2⤵
  PID:9364
- C:\Windows\System\ugryzpY.exe
  C:\Windows\System\ugryzpY.exe
  2⤵
  PID:9444
- C:\Windows\System\fURZNbu.exe
  C:\Windows\System\fURZNbu.exe
  2⤵
  PID:9488
- C:\Windows\System\stkVTPv.exe
  C:\Windows\System\stkVTPv.exe
  2⤵
  PID:9580
- C:\Windows\System\iecGnpC.exe
  C:\Windows\System\iecGnpC.exe
  2⤵
  PID:9584
- C:\Windows\System\rmPIDhY.exe
  C:\Windows\System\rmPIDhY.exe
  2⤵
  PID:9680
- C:\Windows\System\msgFlfD.exe
  C:\Windows\System\msgFlfD.exe
  2⤵
  PID:9764
- C:\Windows\System\HVXWDrj.exe
  C:\Windows\System\HVXWDrj.exe
  2⤵
  PID:9876
- C:\Windows\System\eBfvroM.exe
  C:\Windows\System\eBfvroM.exe
  2⤵
  PID:9968
- C:\Windows\System\wiFbyvp.exe
  C:\Windows\System\wiFbyvp.exe
  2⤵
  PID:10032
- C:\Windows\System\XtQRNbZ.exe
  C:\Windows\System\XtQRNbZ.exe
  2⤵
  PID:10104
- C:\Windows\System\hhyKWcc.exe
  C:\Windows\System\hhyKWcc.exe
  2⤵
  PID:10188
- C:\Windows\System\rjUOVPs.exe
  C:\Windows\System\rjUOVPs.exe
  2⤵
  PID:7932
- C:\Windows\System\AlqljHx.exe
  C:\Windows\System\AlqljHx.exe
  2⤵
  PID:9280
- C:\Windows\System\lpgDAIh.exe
  C:\Windows\System\lpgDAIh.exe
  2⤵
  PID:9440
- C:\Windows\System\TZiMcCa.exe
  C:\Windows\System\TZiMcCa.exe
  2⤵
  PID:9564
- C:\Windows\System\wbzFrDU.exe
  C:\Windows\System\wbzFrDU.exe
  2⤵
  PID:9600
- C:\Windows\System\ArAcvHn.exe
  C:\Windows\System\ArAcvHn.exe
  2⤵
  PID:9860
- C:\Windows\System\fRsssVF.exe
  C:\Windows\System\fRsssVF.exe
  2⤵
  PID:9944
- C:\Windows\System\ujFQShv.exe
  C:\Windows\System\ujFQShv.exe
  2⤵
  PID:10084
- C:\Windows\System\caPFqAS.exe
  C:\Windows\System\caPFqAS.exe
  2⤵
  PID:10148
- C:\Windows\System\qJzVUTN.exe
  C:\Windows\System\qJzVUTN.exe
  2⤵
  PID:9336
- C:\Windows\System\ODBqMZu.exe
  C:\Windows\System\ODBqMZu.exe
  2⤵
  PID:9640
- C:\Windows\System\mKUmrSx.exe
  C:\Windows\System\mKUmrSx.exe
  2⤵
  PID:9932
- C:\Windows\System\lNGDLLm.exe
  C:\Windows\System\lNGDLLm.exe
  2⤵
  PID:9520
- C:\Windows\System\sJbjZSk.exe
  C:\Windows\System\sJbjZSk.exe
  2⤵
  PID:10232
- C:\Windows\System\bJfCZDX.exe
  C:\Windows\System\bJfCZDX.exe
  2⤵
  PID:10256
- C:\Windows\System\PIchNZH.exe
  C:\Windows\System\PIchNZH.exe
  2⤵
  PID:10276
- C:\Windows\System\EunIAHe.exe
  C:\Windows\System\EunIAHe.exe
  2⤵
  PID:10304
- C:\Windows\System\isbCdQg.exe
  C:\Windows\System\isbCdQg.exe
  2⤵
  PID:10352
- C:\Windows\System\qxGPZrJ.exe
  C:\Windows\System\qxGPZrJ.exe
  2⤵
  PID:10372
- C:\Windows\System\EeRBgcM.exe
  C:\Windows\System\EeRBgcM.exe
  2⤵
  PID:10388
- C:\Windows\System\mlpvRxH.exe
  C:\Windows\System\mlpvRxH.exe
  2⤵
  PID:10412
- C:\Windows\System\zjercZU.exe
  C:\Windows\System\zjercZU.exe
  2⤵
  PID:10452
- C:\Windows\System\oboRnAg.exe
  C:\Windows\System\oboRnAg.exe
  2⤵
  PID:10480
- C:\Windows\System\dLvBGHJ.exe
  C:\Windows\System\dLvBGHJ.exe
  2⤵
  PID:10508
- C:\Windows\System\rLZNGzD.exe
  C:\Windows\System\rLZNGzD.exe
  2⤵
  PID:10536
- C:\Windows\System\SgPEAAu.exe
  C:\Windows\System\SgPEAAu.exe
  2⤵
  PID:10560
- C:\Windows\System\VdoeKvh.exe
  C:\Windows\System\VdoeKvh.exe
  2⤵
  PID:10604
- C:\Windows\System\axhjSmL.exe
  C:\Windows\System\axhjSmL.exe
  2⤵
  PID:10628
- C:\Windows\System\wvZoMhq.exe
  C:\Windows\System\wvZoMhq.exe
  2⤵
  PID:10648
- C:\Windows\System\uNlEosm.exe
  C:\Windows\System\uNlEosm.exe
  2⤵
  PID:10676
- C:\Windows\System\jkzqnlh.exe
  C:\Windows\System\jkzqnlh.exe
  2⤵
  PID:10700
- C:\Windows\System\QvgvDot.exe
  C:\Windows\System\QvgvDot.exe
  2⤵
  PID:10716
- C:\Windows\System\JoVIpji.exe
  C:\Windows\System\JoVIpji.exe
  2⤵
  PID:10732
- C:\Windows\System\eBxeUpb.exe
  C:\Windows\System\eBxeUpb.exe
  2⤵
  PID:10780
- C:\Windows\System\ZEAfUOT.exe
  C:\Windows\System\ZEAfUOT.exe
  2⤵
  PID:10820
- C:\Windows\System\KqbbjUQ.exe
  C:\Windows\System\KqbbjUQ.exe
  2⤵
  PID:10844
- C:\Windows\System\JZWttHW.exe
  C:\Windows\System\JZWttHW.exe
  2⤵
  PID:10868
- C:\Windows\System\UryHMqS.exe
  C:\Windows\System\UryHMqS.exe
  2⤵
  PID:10916
- C:\Windows\System\kkKRwdV.exe
  C:\Windows\System\kkKRwdV.exe
  2⤵
  PID:10936
- C:\Windows\System\RwJbogS.exe
  C:\Windows\System\RwJbogS.exe
  2⤵
  PID:10964
- C:\Windows\System\zjuxlln.exe
  C:\Windows\System\zjuxlln.exe
  2⤵
  PID:10988
- C:\Windows\System\onrGmSa.exe
  C:\Windows\System\onrGmSa.exe
  2⤵
  PID:11012
- C:\Windows\System\jHKSTVp.exe
  C:\Windows\System\jHKSTVp.exe
  2⤵
  PID:11040
- C:\Windows\System\JRQlHfc.exe
  C:\Windows\System\JRQlHfc.exe
  2⤵
  PID:11064
- C:\Windows\System\ONfFFVT.exe
  C:\Windows\System\ONfFFVT.exe
  2⤵
  PID:11100
- C:\Windows\System\xQGODTM.exe
  C:\Windows\System\xQGODTM.exe
  2⤵
  PID:11120
- C:\Windows\System\bZVKoSY.exe
  C:\Windows\System\bZVKoSY.exe
  2⤵
  PID:11184
- C:\Windows\System\SuyFmwg.exe
  C:\Windows\System\SuyFmwg.exe
  2⤵
  PID:11200
- C:\Windows\System\HMbTegy.exe
  C:\Windows\System\HMbTegy.exe
  2⤵
  PID:11224
- C:\Windows\System\gvscwCg.exe
  C:\Windows\System\gvscwCg.exe
  2⤵
  PID:11252
- C:\Windows\System\VHpGOIu.exe
  C:\Windows\System\VHpGOIu.exe
  2⤵
  PID:10284
- C:\Windows\System\XsqnItI.exe
  C:\Windows\System\XsqnItI.exe
  2⤵
  PID:10296
- C:\Windows\System\XOTrKJM.exe
  C:\Windows\System\XOTrKJM.exe
  2⤵
  PID:10360
- C:\Windows\System\lbrSZAh.exe
  C:\Windows\System\lbrSZAh.exe
  2⤵
  PID:10384
- C:\Windows\System\BznWjWU.exe
  C:\Windows\System\BznWjWU.exe
  2⤵
  PID:10492
- C:\Windows\System\elBUYnK.exe
  C:\Windows\System\elBUYnK.exe
  2⤵
  PID:5756
- C:\Windows\System\GVdMhKK.exe
  C:\Windows\System\GVdMhKK.exe
  2⤵
  PID:10548
- C:\Windows\System\ZdHtcxC.exe
  C:\Windows\System\ZdHtcxC.exe
  2⤵
  PID:10588
- C:\Windows\System\WkzvHWQ.exe
  C:\Windows\System\WkzvHWQ.exe
  2⤵
  PID:10692
- C:\Windows\System\nolbkoM.exe
  C:\Windows\System\nolbkoM.exe
  2⤵
  PID:10768
- C:\Windows\System\eyXMUPf.exe
  C:\Windows\System\eyXMUPf.exe
  2⤵
  PID:10828
- C:\Windows\System\eRfpBfX.exe
  C:\Windows\System\eRfpBfX.exe
  2⤵
  PID:10864
- C:\Windows\System\CvCfhJL.exe
  C:\Windows\System\CvCfhJL.exe
  2⤵
  PID:10928
- C:\Windows\System\pqXgbte.exe
  C:\Windows\System\pqXgbte.exe
  2⤵
  PID:11020
- C:\Windows\System\fPpJwBv.exe
  C:\Windows\System\fPpJwBv.exe
  2⤵
  PID:11096
- C:\Windows\System\MyDwkOM.exe
  C:\Windows\System\MyDwkOM.exe
  2⤵
  PID:11116
- C:\Windows\System\KLhoUiZ.exe
  C:\Windows\System\KLhoUiZ.exe
  2⤵
  PID:2120
- C:\Windows\System\HocRyzD.exe
  C:\Windows\System\HocRyzD.exe
  2⤵
  PID:11232
- C:\Windows\System\XfJWgsr.exe
  C:\Windows\System\XfJWgsr.exe
  2⤵
  PID:11244
- C:\Windows\System\kDxQkMQ.exe
  C:\Windows\System\kDxQkMQ.exe
  2⤵
  PID:4468
- C:\Windows\System\ztZgjVl.exe
  C:\Windows\System\ztZgjVl.exe
  2⤵
  PID:10432
- C:\Windows\System\VLULaKt.exe
  C:\Windows\System\VLULaKt.exe
  2⤵
  PID:10528
- C:\Windows\System\YfEUSmX.exe
  C:\Windows\System\YfEUSmX.exe
  2⤵
  PID:10684
- C:\Windows\System\Utifcmh.exe
  C:\Windows\System\Utifcmh.exe
  2⤵
  PID:10808
- C:\Windows\System\XsdYJBP.exe
  C:\Windows\System\XsdYJBP.exe
  2⤵
  PID:10980
- C:\Windows\System\UxwrEDs.exe
  C:\Windows\System\UxwrEDs.exe
  2⤵
  PID:11052
- C:\Windows\System\CbTYYrp.exe
  C:\Windows\System\CbTYYrp.exe
  2⤵
  PID:5820
- C:\Windows\System\mBJEnbK.exe
  C:\Windows\System\mBJEnbK.exe
  2⤵
  PID:11192
- C:\Windows\System\AnkLtEN.exe
  C:\Windows\System\AnkLtEN.exe
  2⤵
  PID:10324
- C:\Windows\System\VzUcSwi.exe
  C:\Windows\System\VzUcSwi.exe
  2⤵
  PID:10612
- C:\Windows\System\MNNVJMD.exe
  C:\Windows\System\MNNVJMD.exe
  2⤵
  PID:10908
- C:\Windows\System\JqjAnok.exe
  C:\Windows\System\JqjAnok.exe
  2⤵
  PID:3264
- C:\Windows\System\jToDYkA.exe
  C:\Windows\System\jToDYkA.exe
  2⤵
  PID:10800
- C:\Windows\System\nRjafYM.exe
  C:\Windows\System\nRjafYM.exe
  2⤵
  PID:11288
- C:\Windows\System\Maltftj.exe
  C:\Windows\System\Maltftj.exe
  2⤵
  PID:11328
- C:\Windows\System\VWOZvyD.exe
  C:\Windows\System\VWOZvyD.exe
  2⤵
  PID:11376
- C:\Windows\System\hhBDxDH.exe
  C:\Windows\System\hhBDxDH.exe
  2⤵
  PID:11396
- C:\Windows\System\zmxGQzl.exe
  C:\Windows\System\zmxGQzl.exe
  2⤵
  PID:11424
- C:\Windows\System\YLQeBNJ.exe
  C:\Windows\System\YLQeBNJ.exe
  2⤵
  PID:11464
- C:\Windows\System\pIjgcem.exe
  C:\Windows\System\pIjgcem.exe
  2⤵
  PID:11480
- C:\Windows\System\SlrulTA.exe
  C:\Windows\System\SlrulTA.exe
  2⤵
  PID:11512
- C:\Windows\System\JmKSCaa.exe
  C:\Windows\System\JmKSCaa.exe
  2⤵
  PID:11548
- C:\Windows\System\AEmgutf.exe
  C:\Windows\System\AEmgutf.exe
  2⤵
  PID:11568
- C:\Windows\System\DGFqiAk.exe
  C:\Windows\System\DGFqiAk.exe
  2⤵
  PID:11588
- C:\Windows\System\XvjAVdm.exe
  C:\Windows\System\XvjAVdm.exe
  2⤵
  PID:11624
- C:\Windows\System\riEQrXn.exe
  C:\Windows\System\riEQrXn.exe
  2⤵
  PID:11644
- C:\Windows\System\cIJYQkt.exe
  C:\Windows\System\cIJYQkt.exe
  2⤵
  PID:11672
- C:\Windows\System\qcOOakD.exe
  C:\Windows\System\qcOOakD.exe
  2⤵
  PID:11700
- C:\Windows\System\UjARnCz.exe
  C:\Windows\System\UjARnCz.exe
  2⤵
  PID:11720
- C:\Windows\System\zZHzGzs.exe
  C:\Windows\System\zZHzGzs.exe
  2⤵
  PID:11744
- C:\Windows\System\TOKCqDp.exe
  C:\Windows\System\TOKCqDp.exe
  2⤵
  PID:11796
- C:\Windows\System\HzghPkl.exe
  C:\Windows\System\HzghPkl.exe
  2⤵
  PID:11812
- C:\Windows\System\gymSnpd.exe
  C:\Windows\System\gymSnpd.exe
  2⤵
  PID:11832
- C:\Windows\System\UpAchxW.exe
  C:\Windows\System\UpAchxW.exe
  2⤵
  PID:11852
- C:\Windows\System\dhsbntL.exe
  C:\Windows\System\dhsbntL.exe
  2⤵
  PID:11868
- C:\Windows\System\zcbHUrp.exe
  C:\Windows\System\zcbHUrp.exe
  2⤵
  PID:11888
- C:\Windows\System\EkDGeCM.exe
  C:\Windows\System\EkDGeCM.exe
  2⤵
  PID:11912
- C:\Windows\System\TboTcpn.exe
  C:\Windows\System\TboTcpn.exe
  2⤵
  PID:11988
- C:\Windows\System\XztQXPP.exe
  C:\Windows\System\XztQXPP.exe
  2⤵
  PID:12020
- C:\Windows\System\aRSUAnR.exe
  C:\Windows\System\aRSUAnR.exe
  2⤵
  PID:12040
- C:\Windows\System\QzjCayB.exe
  C:\Windows\System\QzjCayB.exe
  2⤵
  PID:12072
- C:\Windows\System\rulcvau.exe
  C:\Windows\System\rulcvau.exe
  2⤵
  PID:12088
- C:\Windows\System\nCgNMcg.exe
  C:\Windows\System\nCgNMcg.exe
  2⤵
  PID:12104
- C:\Windows\System\HUnjqiw.exe
  C:\Windows\System\HUnjqiw.exe
  2⤵
  PID:12128
- C:\Windows\System\YSVbbwE.exe
  C:\Windows\System\YSVbbwE.exe
  2⤵
  PID:12152
- C:\Windows\System\MlpnSRu.exe
  C:\Windows\System\MlpnSRu.exe
  2⤵
  PID:12176
- C:\Windows\System\DNOBKos.exe
  C:\Windows\System\DNOBKos.exe
  2⤵
  PID:12196
- C:\Windows\System\kGHWOOa.exe
  C:\Windows\System\kGHWOOa.exe
  2⤵
  PID:12256
- C:\Windows\System\tEEdyZE.exe
  C:\Windows\System\tEEdyZE.exe
  2⤵
  PID:12276
- C:\Windows\System\MEkrfAs.exe
  C:\Windows\System\MEkrfAs.exe
  2⤵
  PID:4908
- C:\Windows\System\duphDpu.exe
  C:\Windows\System\duphDpu.exe
  2⤵
  PID:11284
- C:\Windows\System\SqRlquV.exe
  C:\Windows\System\SqRlquV.exe
  2⤵
  PID:11364
- C:\Windows\System\HEWqknl.exe
  C:\Windows\System\HEWqknl.exe
  2⤵
  PID:11388
- C:\Windows\System\NoxzFUD.exe
  C:\Windows\System\NoxzFUD.exe
  2⤵
  PID:11452
- C:\Windows\System\CyhaTwR.exe
  C:\Windows\System\CyhaTwR.exe
  2⤵
  PID:11496
- C:\Windows\System\kQtXOpJ.exe
  C:\Windows\System\kQtXOpJ.exe
  2⤵
  PID:11560
- C:\Windows\System\aWrtFai.exe
  C:\Windows\System\aWrtFai.exe
  2⤵
  PID:11656
- C:\Windows\System\qXeRKvM.exe
  C:\Windows\System\qXeRKvM.exe
  2⤵
  PID:11772
- C:\Windows\System\dOxfeGG.exe
  C:\Windows\System\dOxfeGG.exe
  2⤵
  PID:11904
- C:\Windows\System\nUUxJZk.exe
  C:\Windows\System\nUUxJZk.exe
  2⤵
  PID:11976
- C:\Windows\System\rNoSGQo.exe
  C:\Windows\System\rNoSGQo.exe
  2⤵
  PID:11956
- C:\Windows\System\xEVAAEW.exe
  C:\Windows\System\xEVAAEW.exe
  2⤵
  PID:12032
- C:\Windows\System\raEPDHG.exe
  C:\Windows\System\raEPDHG.exe
  2⤵
  PID:12168
- C:\Windows\System\DWHIUHc.exe
  C:\Windows\System\DWHIUHc.exe
  2⤵
  PID:12096
- C:\Windows\System\SusbXNd.exe
  C:\Windows\System\SusbXNd.exe
  2⤵
  PID:10444
- C:\Windows\System\hMneBYb.exe
  C:\Windows\System\hMneBYb.exe
  2⤵
  PID:11296
- C:\Windows\System\uFhRqom.exe
  C:\Windows\System\uFhRqom.exe
  2⤵
  PID:11440
- C:\Windows\System\YjULUxe.exe
  C:\Windows\System\YjULUxe.exe
  2⤵
  PID:1400
- C:\Windows\System\JFWTVvM.exe
  C:\Windows\System\JFWTVvM.exe
  2⤵
  PID:11556
- C:\Windows\System\FNgTWhY.exe
  C:\Windows\System\FNgTWhY.exe
  2⤵
  PID:11792
- C:\Windows\System\fMulOZi.exe
  C:\Windows\System\fMulOZi.exe
  2⤵
  PID:12080
- C:\Windows\System\gEoRfSG.exe
  C:\Windows\System\gEoRfSG.exe
  2⤵
  PID:12164
- C:\Windows\System\StTztqF.exe
  C:\Windows\System\StTztqF.exe
  2⤵
  PID:3328
- C:\Windows\System\kRVvNMk.exe
  C:\Windows\System\kRVvNMk.exe
  2⤵
  PID:11492
- C:\Windows\System\XqZsncC.exe
  C:\Windows\System\XqZsncC.exe
  2⤵
  PID:11768
- C:\Windows\System\WdGxNbl.exe
  C:\Windows\System\WdGxNbl.exe
  2⤵
  PID:3216
- C:\Windows\System\NwCosEG.exe
  C:\Windows\System\NwCosEG.exe
  2⤵
  PID:12192
- C:\Windows\System\FecujyE.exe
  C:\Windows\System\FecujyE.exe
  2⤵
  PID:3608
- C:\Windows\System\FfmEPWa.exe
  C:\Windows\System\FfmEPWa.exe
  2⤵
  PID:12292
- C:\Windows\System\AADXRgK.exe
  C:\Windows\System\AADXRgK.exe
  2⤵
  PID:12320
- C:\Windows\System\BNiwcJT.exe
  C:\Windows\System\BNiwcJT.exe
  2⤵
  PID:12376
- C:\Windows\System\CKMfQFJ.exe
  C:\Windows\System\CKMfQFJ.exe
  2⤵
  PID:12396
- C:\Windows\System\gBiCtys.exe
  C:\Windows\System\gBiCtys.exe
  2⤵
  PID:12424
- C:\Windows\System\TqvrYlT.exe
  C:\Windows\System\TqvrYlT.exe
  2⤵
  PID:12444
- C:\Windows\System\adQPyxv.exe
  C:\Windows\System\adQPyxv.exe
  2⤵
  PID:12468
- C:\Windows\System\SNGjzLp.exe
  C:\Windows\System\SNGjzLp.exe
  2⤵
  PID:12512
- C:\Windows\System\cFQXjmO.exe
  C:\Windows\System\cFQXjmO.exe
  2⤵
  PID:12544
- C:\Windows\System\bzPlqZa.exe
  C:\Windows\System\bzPlqZa.exe
  2⤵
  PID:12560
- C:\Windows\System\cXqpLwL.exe
  C:\Windows\System\cXqpLwL.exe
  2⤵
  PID:12584
- C:\Windows\System\uUeTYgA.exe
  C:\Windows\System\uUeTYgA.exe
  2⤵
  PID:12616
- C:\Windows\System\ydBfPyx.exe
  C:\Windows\System\ydBfPyx.exe
  2⤵
  PID:12640
- C:\Windows\System\XCicjTY.exe
  C:\Windows\System\XCicjTY.exe
  2⤵
  PID:12668
- C:\Windows\System\QPVXNkR.exe
  C:\Windows\System\QPVXNkR.exe
  2⤵
  PID:12696
- C:\Windows\System\KCZeupJ.exe
  C:\Windows\System\KCZeupJ.exe
  2⤵
  PID:12720
- C:\Windows\System\wSLoZVz.exe
  C:\Windows\System\wSLoZVz.exe
  2⤵
  PID:12748
- C:\Windows\System\vWOjoPT.exe
  C:\Windows\System\vWOjoPT.exe
  2⤵
  PID:12804
- C:\Windows\System\ymBuuRi.exe
  C:\Windows\System\ymBuuRi.exe
  2⤵
  PID:12824
- C:\Windows\System\LFdZZpR.exe
  C:\Windows\System\LFdZZpR.exe
  2⤵
  PID:12872
- C:\Windows\System\QsCUxBI.exe
  C:\Windows\System\QsCUxBI.exe
  2⤵
  PID:12900
- C:\Windows\System\orDmCjo.exe
  C:\Windows\System\orDmCjo.exe
  2⤵
  PID:12924
- C:\Windows\System\ihAPrxi.exe
  C:\Windows\System\ihAPrxi.exe
  2⤵
  PID:12952
- C:\Windows\System\nCHgieo.exe
  C:\Windows\System\nCHgieo.exe
  2⤵
  PID:12980
- C:\Windows\System\ZMNQiZP.exe
  C:\Windows\System\ZMNQiZP.exe
  2⤵
  PID:13016
- C:\Windows\System\GqQhjVV.exe
  C:\Windows\System\GqQhjVV.exe
  2⤵
  PID:13036
- C:\Windows\System\oWcFQZz.exe
  C:\Windows\System\oWcFQZz.exe
  2⤵
  PID:13068
- C:\Windows\System\snxghCs.exe
  C:\Windows\System\snxghCs.exe
  2⤵
  PID:13088
- C:\Windows\System\ZeQWiIr.exe
  C:\Windows\System\ZeQWiIr.exe
  2⤵
  PID:13112
- C:\Windows\System\PdKJFlq.exe
  C:\Windows\System\PdKJFlq.exe
  2⤵
  PID:13136
- C:\Windows\System\cKbkvSB.exe
  C:\Windows\System\cKbkvSB.exe
  2⤵
  PID:13164
- C:\Windows\System\jXbvcOx.exe
  C:\Windows\System\jXbvcOx.exe
  2⤵
  PID:13192
- C:\Windows\System\rbxmInQ.exe
  C:\Windows\System\rbxmInQ.exe
  2⤵
  PID:12384
- C:\Windows\System\kLbpQam.exe
  C:\Windows\System\kLbpQam.exe
  2⤵
  PID:12420
- C:\Windows\System\UqSEfcv.exe
  C:\Windows\System\UqSEfcv.exe
  2⤵
  PID:12456
- C:\Windows\System\vzAwFWG.exe
  C:\Windows\System\vzAwFWG.exe
  2⤵
  PID:12556
- C:\Windows\System\imxdJXV.exe
  C:\Windows\System\imxdJXV.exe
  2⤵
  PID:12592
- C:\Windows\System\LDTvCTO.exe
  C:\Windows\System\LDTvCTO.exe
  2⤵
  PID:12684
- C:\Windows\System\IxFKRUF.exe
  C:\Windows\System\IxFKRUF.exe
  2⤵
  PID:12728
- C:\Windows\System\NZEIYHE.exe
  C:\Windows\System\NZEIYHE.exe
  2⤵
  PID:12740
- C:\Windows\System\OyiGPBj.exe
  C:\Windows\System\OyiGPBj.exe
  2⤵
  PID:12784
- C:\Windows\System\BtIpHkK.exe
  C:\Windows\System\BtIpHkK.exe
  2⤵
  PID:12880
- C:\Windows\System\bcATZRR.exe
  C:\Windows\System\bcATZRR.exe
  2⤵
  PID:12944
- C:\Windows\System\PuOqAUT.exe
  C:\Windows\System\PuOqAUT.exe
  2⤵
  PID:12972
- C:\Windows\System\KednmLc.exe
  C:\Windows\System\KednmLc.exe
  2⤵
  PID:13012
- C:\Windows\System\oooZrQj.exe
  C:\Windows\System\oooZrQj.exe
  2⤵
  PID:13060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sstt3hxc.gfl.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BAjinxW.exe

Filesize
2.3MB

MD5
8dc99337facb619da1fc5e24e79fded0

SHA1
97c13defd2bcd674a9f2aa5e1545ff9eacb1ba66

SHA256
9f4bf256228f4d162eef351f1af60b853b09b363eebd7ec40b7af68db158f681

SHA512
c726d3fe990e049831116e7e9969511ddadc8165105bdc0c49dbcb4b1d5ffec86e7bdbebccf1d39c12f225469cf2fced13badc2e57c394767e04ed60b26074a2

Download Submit
C:\Windows\System\BxPlgXU.exe

Filesize
2.3MB

MD5
68970e7d4d8ea5082d80551cc9d19f36

SHA1
1e3d6d4821df285a7139ce11e27b01e4c6ff881e

SHA256
ce5d65024161f1f9d1531ed81426ecf05b4d432674a0188b8356eaa50bc9e1b9

SHA512
ee0f2475500ac2a5085326c7406a0241f845ab8591088ce6b9267ab5ee4209de4f970b168fbdcd5ed6a5d0feb78cb4a4024bacba46bcdf415c199679c2a6b956

Download Submit
C:\Windows\System\CYZeDJM.exe

Filesize
2.3MB

MD5
83ff041927132a8c1a357b1f9e09417b

SHA1
db68faef522b37c9e70d00242869df104e3abf32

SHA256
7ec6a8e815e6c3ca406e21d397af7a591b00050ded4a7c9c47be18239fa9fc61

SHA512
58648446c74cbd96ef137ab22f0079b7c7ccf8f6724b571e7cc2bd1b6398da1d3ce6143ed9445034ac11a2ec3e96f9881de1edd6fe5b8d942b69f4168a7c8967

Download Submit
C:\Windows\System\EeVfzFs.exe

Filesize
2.3MB

MD5
fee1475909277e7e591230da9d85f351

SHA1
f7e1c0fe982326c2996adfae475dc271ebb8a6e3

SHA256
0da6abbd5ad07b07a0165232ad624134a537d3b4b2ccbe0428ec611281afd0d4

SHA512
adb4a63d10c5c6a6eba6ba5d3d00810ace0860185f6e087fba7638b57464ad2464e39710d8629bd005bb36408a994f69dd92665ebc67c076c2906250b342a4ce

Download Submit
C:\Windows\System\GvfiuEu.exe

Filesize
2.3MB

MD5
fd65f0a220a3553dbeb49269ac5b9f87

SHA1
7ed7302781f51ce6ad89b769bd4f19a67af6fbcb

SHA256
98775b56aef4562f072568bf66aa144bce7da7ad72feb48a663c89cd0d1dd0f5

SHA512
ff6d22ef8f54c880bc5f95f93618d7de7419c23e3a448c2c19cfedb8bfbadd2d993c604d20dc17fd3abcffcd667ed415ae3774166f828a23615194030a6576e8

Download Submit
C:\Windows\System\HNIyIpN.exe

Filesize
2.3MB

MD5
5f6761b761b31ac46fde8b1464fea050

SHA1
d99c65ddf76e6dd65a074cd305016240554c1a42

SHA256
7c9d24381a539fdfd095c4e89917cb9aee83956a1c8a29ca748f26a863a249c0

SHA512
14732ce846bdf7bed9539d6e1e9e1e34470eeaf26bc24885aaf41c7da71533a8d496f690457a37a466e4ab7aa6380f60caab0277f0f321b74faa58c52378c3d5

Download Submit
C:\Windows\System\KDhAogn.exe

Filesize
2.3MB

MD5
119d97f39bd3b31ff2adbb4a9e6b596e

SHA1
ffd563fd7176e3cef6bf00f8261624d178869fb2

SHA256
4c647aabc7778fe6a42bce596fa3352c405407b5ce2c4b3da473c961b6dbd83f

SHA512
473b14ee5c9bc2f0a67667e35fe0c7589bad42b4749834aeefd6d232e1201f54fb94088f20d4a0bbf469361c1c7f3bd7f79b50cae532eadc175925aa8359a243

Download Submit
C:\Windows\System\KXaCvta.exe

Filesize
2.3MB

MD5
266d2c18510b014383011b890b11a71d

SHA1
84229c1a99e6e3f84f7d03d80dce8a9ffbb56a8a

SHA256
a5352147d052cfd1f5475361c88c3e9acab679b2302632ec52a7074626730233

SHA512
453f6355defb665a5a72eecd9bb21a685315961318d287b1b6d02cbe5efef11f5556efcc6c28a0a52974610e4517e79af547c58dcdb7ddc726e4e6ace509ab57

Download Submit
C:\Windows\System\KaYspJi.exe

Filesize
2.3MB

MD5
1d3a762d8f9a899b62b309bbf072c757

SHA1
6b7c4bfb8e1b6f334e910b54df354d54630b9b1d

SHA256
8c1f1431d1995d0b3105a5b61b4ed6348609530e296eb0a43294a089bbcbe1bb

SHA512
0bf0258cff7b98754c8e2da077dfac5e0c26de1fedc8909b8b1c2380ffd1d76b83056aa61efa883dbbd01f85cdb84b9374ce7584809da80ac82e29a17301e772

Download Submit
C:\Windows\System\KjgPiNw.exe

Filesize
2.3MB

MD5
4c0e66cf6e55053db2ebad87660add6e

SHA1
a21814d728d23b889fadf526d07e431b3811d945

SHA256
8fbcc9d5bf7ea8cf8438238f318cc7f0978defec76201cb6972bc942a28a5f06

SHA512
836648904e5590fd28d5fc0ac5d7af2937577072cd53825e9be33db065a9fea7420e82160f6a7bc3e9cdb5b96889ce956356f5839bb876292a6b5fe67c1a87d9

Download Submit
C:\Windows\System\MIHwYSP.exe

Filesize
2.3MB

MD5
1ee272a29a9db37c2616b4a31031cabb

SHA1
1f728ec6b03102d6d16e82a6008e7fb6219aa6ae

SHA256
a0e2ba349e7d1806370f0f80a0dfe852e7d30e58ff463f2707000b13e1bb08e0

SHA512
cf9526e6fd462f1cc635e3f9bf2a8cdcbc519bc50713bdbbaf963f8ad11df77ffe895454626d0d17a13cb54b020f2cc114d739c3fb53c6832546b1f283377ae7

Download Submit
C:\Windows\System\MUhgbrO.exe

Filesize
2.3MB

MD5
f4d4b4c312f84d82fcedaab7cc6c9bdb

SHA1
dd3f08ff852b1e8be1072c708dc98f88b2050393

SHA256
4f7e8e5584218ac74f9446e7e879e10760d0c3e89edae2eb86a4e40de3f932ca

SHA512
c1b9d5aa29d9ea90896e18d5730b91ed9d496c4366a87e325941e4b47b6717320ca0ffa73d3c1d83d5b0789d8c43a4ebb5deec3eb7bed9e4b32f2c88f5167a5e

Download Submit
C:\Windows\System\MwTnnqh.exe

Filesize
2.3MB

MD5
24feb9c485ed35bc5cf3cdb820838ce9

SHA1
168a30b180691ca3445c6d93370809a24dd455dc

SHA256
ebfdc5d0d4b03938c1af827426a5e2d822cc09e350e5bd11c56dcdac134e5a0b

SHA512
987fa7e1d3863c370a7540fb608b40d65eca996a61db826fdff4315a517439e937c7022f721ed12eeb7db76f5046766279f050cd0ffaf44840ef557f0725eb34

Download Submit
C:\Windows\System\PagSITv.exe

Filesize
2.3MB

MD5
6efaf032779534682a6de31d8e9afddd

SHA1
13efd7857f04d8356f06075bf1c3f58d953dacc8

SHA256
e48e1ad31091e5de9f7f71b3ae8bcc5edcbd3d4ac2eec7d23d3bcd9dfccde5b5

SHA512
44bd6be0f18c1f9f89798ff11272e77c1af54b12d77b00c42ceb27fac20d6ac898e5a2e8b2da0f5083af25c59ddc5c00a8f86a544d0a4d91d589697e0b2ffb22

Download Submit
C:\Windows\System\UNciCbY.exe

Filesize
2.3MB

MD5
2fcef003e611dc380ef8ce0b5ec3bd0b

SHA1
6c19530710f69e75da7ecd0946c2f40561754c48

SHA256
654712f7430aa2612aafbe8e8bc4da2ae3de670b396923a62a165189012f350e

SHA512
1822f824145047c1d7a8435fbd98bc73ca5e438848b5940a8213256ae0047a4f5bcee218213d2a5ae79401aed77053d14aa3d66521a813f3b22caf8cb83bf0ef

Download Submit
C:\Windows\System\VXJdbjy.exe

Filesize
2.3MB

MD5
940e760a6e6bb5a61d6c661e3ed56bcf

SHA1
5151a2564ead69664c00f7129ee7eedd9912fc19

SHA256
ea3556915ff37ad35a9eaf0438848a1c6aae4d03900eba2ed4b72012230ee38e

SHA512
d7fe6e555d633119c625f386371cfdaa840d4297cbc6628f4515a8aa475e2b36e669bb5ab293e6e3564b0f8d778a3144b5e5400f81313a1cabf16d4b701002fc

Download Submit
C:\Windows\System\ZrNlMcd.exe

Filesize
2.3MB

MD5
2f1299586a0f7219e2d4ef18c6ea7f28

SHA1
93cf6cc9b3b786956a378488d7d4b054018b74bf

SHA256
17904a9cdf4bfa382d720d47390ac3e31bd85546bb4078d0419696caa5bdc02b

SHA512
1df34afff0b62cd03901dbced6b4889b8126bbf0d83b48f3bdd8077b79e3a3266ca8e89ea68373b333be4772f468e5852fb02fe9acfce0be824c2b3ba6f3057a

Download Submit
C:\Windows\System\auKzpOm.exe

Filesize
2.3MB

MD5
2bab5fcedcb103891756d520867c4862

SHA1
c22090164b834cf3a430cf0da79e1d4a93670af5

SHA256
dd2e78625a9ba5a0127b21635d626fd17a87f23c5d51309286e5def59238800d

SHA512
be18ad506e10b952f74458946fcf10b0bb1223b9396205efbb9c8b4673181d96fec5034d43b6e510821e1acdd6ad2b53b9eeacf1b23e833ba3b4249b445d8706

Download Submit
C:\Windows\System\brLlugw.exe

Filesize
2.3MB

MD5
ea9b152b71a43acf57645a1fef244450

SHA1
68b61bbf7a45fceb020b2a051f32498ea457e86e

SHA256
97372e88341375a7205c889bc765b537f4f32713d58f9dfe8b6366140f91bae7

SHA512
f6298713b02a3d9d3ccc22278d7b196ec662cbcea77f79d92b0ac0a02a33dca21a3303412315340323764b91d3e473c1315ffb30891d7c6903357728d28cdeeb

Download Submit
C:\Windows\System\gtJZcMB.exe

Filesize
8B

MD5
7844449f1717b2590e53c215fcf07352

SHA1
79d0c9d199e3401234813cacf5dd2de0f53d76f4

SHA256
d54f9b9a769720c875f9b7152a74884a4a9e5a4d80da35d3f847cb8b30b14f4d

SHA512
08987ef45e3b930599e24a17bad53cfff0dadf3651ece3e5b0469612e6c0a9a6cc61ef278c49c769a425e8c5349976b197865ce68d78055e84972e2fe8a0851c

Download Submit
C:\Windows\System\invASoK.exe

Filesize
2.3MB

MD5
2cfa7d06c6b8348b33691f62e3e16cb0

SHA1
5df0bd228b5557bbe31e075755500004ffb3ae04

SHA256
8fdff082cc0bcd2a45901e7313b03b745836b5f654f25f2f745cd409448fdab2

SHA512
4074ddab1ec8199f22f6b410aca07e397c1ee42285c5789af754fd6cbaddf537d1633bc352ed75db1b29da168cea5481f54bacd0c2b5e140f9f81b4b39ba6a30

Download Submit
C:\Windows\System\jKdevlN.exe

Filesize
2.3MB

MD5
af75b0c477af6d9f60e8f861f99975c2

SHA1
66c0a32293db265a049a6467676c789eda2b3f18

SHA256
dc07d599027d65a19ff5ffa00d3a3e77ff1e7087ee475877451e2b2996b94c93

SHA512
ee5a7f02ca48ae7f9ecfe4587f7e26dd9173fa311fc1690b4fd35d5bc5ecc720877d8d9bbe9775ffab08975ddbcce6392f32f0e76b777f992a0de0493f391874

Download Submit
C:\Windows\System\lgKEczh.exe

Filesize
2.3MB

MD5
bcbb77bb7c151a266e59b2ed2450c738

SHA1
52d3f6f53eefa20d3d8abea13d52f5615eb764ff

SHA256
f33915bb7239ca556eba2930779d450436bae2f29b7682004f3d2014e509e724

SHA512
009f153ea92eba53f77c2b0ca67db59b65039c5e3b3dbc591d62da89c65145ecc41ecec5f74c40eb64d77737bbac90264722cb22051e8490f9bbb078055c0321

Download Submit
C:\Windows\System\nAKDwyV.exe

Filesize
2.3MB

MD5
4d3bbc3f080318dbb7ab6df02abe7b98

SHA1
81b7f44ee68e807a5f4f6d7706d122fbacaec585

SHA256
86a5200e1fd6feceaf460a34776f288f5ef7a2dac4e7a905b694a471d63d0818

SHA512
58e397d768e623eccb80d71c4152dead285325728eba3ce3c064ce43fbcda59a8793176835e889d212f4d56da01e79635ec6c7f771527a36d6a2e3ac425b5ccb

Download Submit
C:\Windows\System\nWSprGU.exe

Filesize
2.3MB

MD5
16716a8879d6faa5744341a7728fb3dc

SHA1
0be4a12a6215d60829274f18c81fc9d30dfa0e64

SHA256
307d62702df62bf7cf6d25db10b1f994479fc0b54a086014f19ba67cd1927599

SHA512
3281d50b59eb5fe766a77d85f282b073cfda13e6ac7c8b743cfd99c9438d181ecf1a2a4ca3c95334acd6929fe3096f0144575dc86724d6ebd9dfd2b2d249b7ea

Download Submit
C:\Windows\System\oRXdRsU.exe

Filesize
2.3MB

MD5
56749917a8f7adcff2075e323f21ce7e

SHA1
ca428b3227fcbc6cf61777410817a286112f0fd3

SHA256
c07afa8ac57919a8b300c74aef10ec5eaffb4f47463d7e91e24b2a7c9fe167df

SHA512
d34e1547731773b7dde5fcfd357d34e0674f72b1be83ee34422d4971103c501894b4c8431ad677ad17d7b84e50b2a0e86775c34606c10233107ae69089069fb3

Download Submit
C:\Windows\System\ojyLKuA.exe

Filesize
2.3MB

MD5
230f64c4fe703e7606f4397718fc104e

SHA1
3f3566fe16746ed52eac9670ffb6af2dc6a9e7e6

SHA256
70b021cc42e1dfb2078ec02dcf9450f7f12571eb110ad71ba8f6041d3f15ec7e

SHA512
d9e08d04a1d72d57c6d2a6be8dc46e0b352635365b35a550e430d6d6f118c59bf5f8b409b0a24ef1da505b7d4ed0e2762b6ab581a57e243d68cb35b8e9dd02d3

Download Submit
C:\Windows\System\ouXbkVs.exe

Filesize
2.3MB

MD5
ea8346d98ddaf5ec4d909df3e5033276

SHA1
38ce6765ed35469ffde443d365a109eef4abae03

SHA256
3ab5cb5d11fc395ea0279897a22a49de234388a44142c5d4bf7cc31b4902897e

SHA512
b89f4856163f2f9a6b7bf6463e9dde985c820b3749f8a2893bd8f276ac065ce059da3227aaa457133501f45d5e1a08bf748586dfd33be70ab6c073c875353a7d

Download Submit
C:\Windows\System\qnAwxEk.exe

Filesize
2.3MB

MD5
2c3cbba1415df2032a606a9285ae0211

SHA1
6ca2af9df0113c31d982af7a934de63e83d7f379

SHA256
b49b130d4d7c59f9d0bdaa019ff3f22d2a68f1f5213b1884afaa3eea34e987c9

SHA512
af6ca4727ec9f166d5a2e697b53f21692f6fc2a7da9dc3343fcd8b1599f6f6748a6abf8cf49f3aceb02e55b6f5778ae2922e1f210045b1139e190833f2c9ac70

Download Submit
C:\Windows\System\rpGAEfP.exe

Filesize
2.3MB

MD5
8473c849e04e587966ae6f97d8025200

SHA1
c60cf7ccccaa0aa6dd36cbed577e14b95a9968d0

SHA256
651326b87cb12caa626c1c199158ccd1cd92e05882fdde9e2056e89f70c81a5c

SHA512
415202bf8c15520204b631ae14baf5a31b2788b0f4daf117ca9d615db579efdfa3b6832b5c654f007df00ee165f73d4f29404a3b652e8485abcdb5b3b9320513

Download Submit
C:\Windows\System\tLMsNeQ.exe

Filesize
2.3MB

MD5
aa61878b630075baf8a503d3734315e8

SHA1
f1a1b3d106c782947dfe8804d28ecb8f086aded6

SHA256
dc06714c1601045382f4d20ac8841da75301cdb4fe38c3c1aa960432c2b8e1f7

SHA512
f8fcb4adaf07c9b20c3812ba9eaa9afbce4da96e738d58ddb20752d2bb5f196d05fae422750c6d3a7c61887958e550b6298c245c7e845c7a4f9d3fbbef704511

Download Submit
C:\Windows\System\ttrKnke.exe

Filesize
2.3MB

MD5
80083e558b41b628ac4ce3319f0a5136

SHA1
1fad3ef0868b19cd8417306c94e47fde65994665

SHA256
08bafadaccd1eaad391373f7bd0bc438804d66880d9cb59e3a981681990f04a1

SHA512
5b5b9ba8d8801fdeba173e82e0e1c27e00ff87d99d46e60685970a2be739f069186959db266ba4ae5a5d59c4621400c782b61cc764fa068c800f049e2dee1bee

Download Submit
C:\Windows\System\ubGSyxY.exe

Filesize
2.3MB

MD5
d1b609776b8601d37819e17dddf9e99e

SHA1
9e3ce126c8e20271540d7fe760ec6b12ca155239

SHA256
f4540fb6443610e446bbd267729aabdca9d16d6b2275de79cfb7f419b3a81828

SHA512
9b769121c036f8bb6e0373d1a556ebbfecc45250e285d135c30eb2d2f192cc724ad379f3533c8175c1998957f23dd4811320f27edf94f6e770959f66105f4ec4

Download Submit
C:\Windows\System\wimaaHi.exe

Filesize
2.3MB

MD5
8ca3c8f79f1894ef81a1b59ff119ee3d

SHA1
8b119298a5affc48176a6a8cac64415458e8f7e8

SHA256
6cbc9a6aa1af41c278ee8d22b0755df56879d4f0957c64b2924e2e473186c1b2

SHA512
00f362d7e5b4e6c63d2576c3965363f2c7417b87a009a1d9e65d32567f5f30ee33256f0505db8217a01bc979431c61bd0024484238fd361279b2984497370422

Download Submit
memory/440-396-0x00007FF620F00000-0x00007FF6212F2000-memory.dmp

Filesize
3.9MB

Download
memory/440-2247-0x00007FF620F00000-0x00007FF6212F2000-memory.dmp

Filesize
3.9MB

Download
memory/536-399-0x00007FF6F09C0000-0x00007FF6F0DB2000-memory.dmp

Filesize
3.9MB

Download
memory/536-2262-0x00007FF6F09C0000-0x00007FF6F0DB2000-memory.dmp

Filesize
3.9MB

Download
memory/1328-394-0x00007FF767B20000-0x00007FF767F12000-memory.dmp

Filesize
3.9MB

Download
memory/1328-2238-0x00007FF767B20000-0x00007FF767F12000-memory.dmp

Filesize
3.9MB

Download
memory/1520-72-0x00007FF6916B0000-0x00007FF691AA2000-memory.dmp

Filesize
3.9MB

Download
memory/1520-2229-0x00007FF6916B0000-0x00007FF691AA2000-memory.dmp

Filesize
3.9MB

Download
memory/1732-2236-0x00007FF61F1B0000-0x00007FF61F5A2000-memory.dmp

Filesize
3.9MB

Download
memory/1732-395-0x00007FF61F1B0000-0x00007FF61F5A2000-memory.dmp

Filesize
3.9MB

Download
memory/1776-2246-0x00007FF6BDD20000-0x00007FF6BE112000-memory.dmp

Filesize
3.9MB

Download
memory/1776-397-0x00007FF6BDD20000-0x00007FF6BE112000-memory.dmp

Filesize
3.9MB

Download
memory/2136-2221-0x00007FF6B1440000-0x00007FF6B1832000-memory.dmp

Filesize
3.9MB

Download
memory/2136-31-0x00007FF6B1440000-0x00007FF6B1832000-memory.dmp

Filesize
3.9MB

Download
memory/2392-400-0x00007FF7045C0000-0x00007FF7049B2000-memory.dmp

Filesize
3.9MB

Download
memory/2392-2260-0x00007FF7045C0000-0x00007FF7049B2000-memory.dmp

Filesize
3.9MB

Download
memory/2432-393-0x00007FF734FF0000-0x00007FF7353E2000-memory.dmp

Filesize
3.9MB

Download
memory/2432-2240-0x00007FF734FF0000-0x00007FF7353E2000-memory.dmp

Filesize
3.9MB

Download
memory/2456-2243-0x00007FF7D8440000-0x00007FF7D8832000-memory.dmp

Filesize
3.9MB

Download
memory/2456-83-0x00007FF7D8440000-0x00007FF7D8832000-memory.dmp

Filesize
3.9MB

Download
memory/2768-80-0x00007FF74B940000-0x00007FF74BD32000-memory.dmp

Filesize
3.9MB

Download
memory/2768-2228-0x00007FF74B940000-0x00007FF74BD32000-memory.dmp

Filesize
3.9MB

Download
memory/3068-20-0x000002293BD10000-0x000002293BD20000-memory.dmp

Filesize
64KB

Download
memory/3068-16-0x00007FFF27C80000-0x00007FFF28741000-memory.dmp

Filesize
10.8MB

Download
memory/3068-21-0x000002293BD10000-0x000002293BD20000-memory.dmp

Filesize
64KB

Download
memory/3068-41-0x000002293C2B0000-0x000002293C2D2000-memory.dmp

Filesize
136KB

Download
memory/3224-71-0x00007FF61B470000-0x00007FF61B862000-memory.dmp

Filesize
3.9MB

Download
memory/3224-2232-0x00007FF61B470000-0x00007FF61B862000-memory.dmp

Filesize
3.9MB

Download
memory/4016-2217-0x00007FF75BDD0000-0x00007FF75C1C2000-memory.dmp

Filesize
3.9MB

Download
memory/4016-27-0x00007FF75BDD0000-0x00007FF75C1C2000-memory.dmp

Filesize
3.9MB

Download
memory/4048-79-0x00007FF60F110000-0x00007FF60F502000-memory.dmp

Filesize
3.9MB

Download
memory/4048-2233-0x00007FF60F110000-0x00007FF60F502000-memory.dmp

Filesize
3.9MB

Download
memory/4080-398-0x00007FF699DD0000-0x00007FF69A1C2000-memory.dmp

Filesize
3.9MB

Download
memory/4080-2249-0x00007FF699DD0000-0x00007FF69A1C2000-memory.dmp

Filesize
3.9MB

Download
memory/4312-401-0x00007FF766C30000-0x00007FF767022000-memory.dmp

Filesize
3.9MB

Download
memory/4312-2258-0x00007FF766C30000-0x00007FF767022000-memory.dmp

Filesize
3.9MB

Download
memory/4416-2224-0x00007FF6E7A60000-0x00007FF6E7E52000-memory.dmp

Filesize
3.9MB

Download
memory/4416-67-0x00007FF6E7A60000-0x00007FF6E7E52000-memory.dmp

Filesize
3.9MB

Download
memory/4492-2213-0x00007FF624EC0000-0x00007FF6252B2000-memory.dmp

Filesize
3.9MB

Download
memory/4492-2225-0x00007FF624EC0000-0x00007FF6252B2000-memory.dmp

Filesize
3.9MB

Download
memory/4492-45-0x00007FF624EC0000-0x00007FF6252B2000-memory.dmp

Filesize
3.9MB

Download
memory/4740-2256-0x00007FF734F00000-0x00007FF7352F2000-memory.dmp

Filesize
3.9MB

Download
memory/4740-402-0x00007FF734F00000-0x00007FF7352F2000-memory.dmp

Filesize
3.9MB

Download
memory/4884-2219-0x00007FF70F270000-0x00007FF70F662000-memory.dmp

Filesize
3.9MB

Download
memory/4884-46-0x00007FF70F270000-0x00007FF70F662000-memory.dmp

Filesize
3.9MB

Download
memory/4924-1-0x0000024025280000-0x0000024025290000-memory.dmp

Filesize
64KB

Download
memory/4924-0-0x00007FF78E970000-0x00007FF78ED62000-memory.dmp

Filesize
3.9MB

Download
memory/5092-2241-0x00007FF665920000-0x00007FF665D12000-memory.dmp

Filesize
3.9MB

Download
memory/5092-2214-0x00007FF665920000-0x00007FF665D12000-memory.dmp

Filesize
3.9MB

Download
memory/5092-73-0x00007FF665920000-0x00007FF665D12000-memory.dmp

Filesize
3.9MB

Download