xmrig | e2ec00b8eab9f6ad6b7f9aa60433e279221f66f19bd3cff173509ab8f15de524

Analysis

max time kernel
40s
max time network
40s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 03:59

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
Size

2.3MB
MD5

06c56a6d346186f50aa7dc813c26dedb
SHA1

9b6482eb5194012964f0d246df25eaf1a8d475d0
SHA256

e2ec00b8eab9f6ad6b7f9aa60433e279221f66f19bd3cff173509ab8f15de524
SHA512

3d53442edaffcd90be88a61d5c2c3f1202f1785921dc0de6f7d38352dba3b7918a312e24aa44ca6b2956ed81283d939b0c32de2e9a12daf28b7c7a8fa0825cc6
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aDs:NAB3

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 21 IoCs

miner

resource	yara_rule
behavioral2/memory/536-83-0x00007FF741040000-0x00007FF741432000-memory.dmp	xmrig
behavioral2/memory/5060-96-0x00007FF6FF8D0000-0x00007FF6FFCC2000-memory.dmp	xmrig
behavioral2/memory/3068-100-0x00007FF7EB4C0000-0x00007FF7EB8B2000-memory.dmp	xmrig
behavioral2/memory/2900-103-0x00007FF7426C0000-0x00007FF742AB2000-memory.dmp	xmrig
behavioral2/memory/5024-108-0x00007FF6A7990000-0x00007FF6A7D82000-memory.dmp	xmrig
behavioral2/memory/2024-107-0x00007FF7753D0000-0x00007FF7757C2000-memory.dmp	xmrig
behavioral2/memory/2376-106-0x00007FF79CEC0000-0x00007FF79D2B2000-memory.dmp	xmrig
behavioral2/memory/2288-102-0x00007FF61C900000-0x00007FF61CCF2000-memory.dmp	xmrig
behavioral2/memory/3976-90-0x00007FF7780F0000-0x00007FF7784E2000-memory.dmp	xmrig
behavioral2/memory/4084-84-0x00007FF75C290000-0x00007FF75C682000-memory.dmp	xmrig
behavioral2/memory/3648-77-0x00007FF6DF010000-0x00007FF6DF402000-memory.dmp	xmrig
behavioral2/memory/2152-47-0x00007FF7CCA80000-0x00007FF7CCE72000-memory.dmp	xmrig
behavioral2/memory/2780-40-0x00007FF6DE030000-0x00007FF6DE422000-memory.dmp	xmrig
behavioral2/memory/1552-32-0x00007FF6E3700000-0x00007FF6E3AF2000-memory.dmp	xmrig
behavioral2/memory/1708-149-0x00007FF7B20E0000-0x00007FF7B24D2000-memory.dmp	xmrig
behavioral2/memory/3856-145-0x00007FF74E2D0000-0x00007FF74E6C2000-memory.dmp	xmrig
behavioral2/memory/3532-121-0x00007FF661C70000-0x00007FF662062000-memory.dmp	xmrig
behavioral2/memory/2268-2477-0x00007FF605B00000-0x00007FF605EF2000-memory.dmp	xmrig
behavioral2/memory/2376-3341-0x00007FF79CEC0000-0x00007FF79D2B2000-memory.dmp	xmrig
behavioral2/memory/3416-3780-0x00007FF78EF40000-0x00007FF78F332000-memory.dmp	xmrig
behavioral2/memory/948-3782-0x00007FF777330000-0x00007FF777722000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3976	KeNJeOI.exe
1552	UPVjmYW.exe
2780	prfWXsp.exe
2152	HFpSkue.exe
5060	AWPlgzL.exe
2268	hBQblYO.exe
3648	sEkyfPZ.exe
3068	TKZxSbq.exe
536	zPTptnV.exe
2288	fJOANME.exe
2900	RTyzDMk.exe
2376	JQFxqTd.exe
4084	GXoRxNt.exe
2024	rdxvFpy.exe
5024	DWVYdzD.exe
3416	MXZLQoh.exe
3532	GUxuMGI.exe
3856	iRjLwsg.exe
4892	UOfNoqo.exe
948	xwZSUrD.exe
1708	uUvdPeF.exe
2700	pGCaKhV.exe
4380	iyjyWfS.exe
3964	lFJAfyl.exe
1856	DDaeSoD.exe
3288	GIjXrPK.exe
4220	BPpdZNh.exe
4404	dUEVdKH.exe
3996	vBrVnPc.exe
5016	SFmlUTD.exe
976	rbIXzof.exe
4608	tOkmeAs.exe
3916	YBtHlJc.exe
4056	jPXrLUv.exe
3212	mkTQZbr.exe
2252	tsWeNUS.exe
1764	dGbfnXj.exe
4048	nVSzdyI.exe
2732	bzKMLhQ.exe
2084	mELRmvn.exe
4320	CGbozbk.exe
4764	iaEsKtR.exe
3960	dMbgFfM.exe
4000	lhtoLlh.exe
1020	Zvfzwmo.exe
3244	lAgASuD.exe
2828	iWAynMK.exe
4836	EklWUyI.exe
1108	cCHZULw.exe
3560	MTjXLDs.exe
1444	BnFRlQj.exe
1600	RBDyzyb.exe
2412	jFzzwTG.exe
1176	Ikjjnsj.exe
1416	txtKuao.exe
4788	FVMihWI.exe
1332	POEVCkW.exe
4828	fVuoKye.exe
4624	LMTINTY.exe
532	GubyXwc.exe
4176	zCCubMC.exe
372	zaajEyc.exe
1784	CZeuiqT.exe
4492	fXmsiGE.exe

UPX packed file 59 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3772-0-0x00007FF61C4E0000-0x00007FF61C8D2000-memory.dmp	upx
behavioral2/files/0x000a000000023bb6-11.dat	upx
behavioral2/files/0x000a000000023bb5-10.dat	upx
behavioral2/files/0x000a000000023bb8-21.dat	upx
behavioral2/files/0x000a000000023bbc-48.dat	upx
behavioral2/files/0x0031000000023bbd-53.dat	upx
behavioral2/memory/536-83-0x00007FF741040000-0x00007FF741432000-memory.dmp	upx
behavioral2/files/0x0031000000023bbe-86.dat	upx
behavioral2/memory/5060-96-0x00007FF6FF8D0000-0x00007FF6FFCC2000-memory.dmp	upx
behavioral2/memory/3068-100-0x00007FF7EB4C0000-0x00007FF7EB8B2000-memory.dmp	upx
behavioral2/memory/2900-103-0x00007FF7426C0000-0x00007FF742AB2000-memory.dmp	upx
behavioral2/memory/5024-108-0x00007FF6A7990000-0x00007FF6A7D82000-memory.dmp	upx
behavioral2/files/0x000c000000023bb1-110.dat	upx
behavioral2/memory/3416-109-0x00007FF78EF40000-0x00007FF78F332000-memory.dmp	upx
behavioral2/memory/2024-107-0x00007FF7753D0000-0x00007FF7757C2000-memory.dmp	upx
behavioral2/memory/2376-106-0x00007FF79CEC0000-0x00007FF79D2B2000-memory.dmp	upx
behavioral2/memory/2288-102-0x00007FF61C900000-0x00007FF61CCF2000-memory.dmp	upx
behavioral2/files/0x000b000000023bc1-101.dat	upx
behavioral2/files/0x000a000000023bc3-97.dat	upx
behavioral2/files/0x0031000000023bbf-92.dat	upx
behavioral2/memory/3976-90-0x00007FF7780F0000-0x00007FF7784E2000-memory.dmp	upx
behavioral2/memory/4084-84-0x00007FF75C290000-0x00007FF75C682000-memory.dmp	upx
behavioral2/files/0x000a000000023bc2-80.dat	upx
behavioral2/memory/3648-77-0x00007FF6DF010000-0x00007FF6DF402000-memory.dmp	upx
behavioral2/memory/2268-57-0x00007FF605B00000-0x00007FF605EF2000-memory.dmp	upx
behavioral2/files/0x000a000000023bbb-51.dat	upx
behavioral2/memory/2152-47-0x00007FF7CCA80000-0x00007FF7CCE72000-memory.dmp	upx
behavioral2/files/0x000a000000023bb9-46.dat	upx
behavioral2/files/0x000a000000023bb7-44.dat	upx
behavioral2/memory/2780-40-0x00007FF6DE030000-0x00007FF6DE422000-memory.dmp	upx
behavioral2/files/0x000a000000023bba-34.dat	upx
behavioral2/memory/1552-32-0x00007FF6E3700000-0x00007FF6E3AF2000-memory.dmp	upx
behavioral2/files/0x000c000000023ba4-20.dat	upx
behavioral2/files/0x000a000000023bc4-114.dat	upx
behavioral2/files/0x000a000000023bc5-122.dat	upx
behavioral2/files/0x000a000000023bc6-126.dat	upx
behavioral2/memory/4892-130-0x00007FF7EC480000-0x00007FF7EC872000-memory.dmp	upx
behavioral2/files/0x000a000000023bc7-142.dat	upx
behavioral2/files/0x000a000000023bc9-144.dat	upx
behavioral2/files/0x000a000000023bc8-156.dat	upx
behavioral2/files/0x000a000000023bcd-167.dat	upx
behavioral2/files/0x000a000000023bce-172.dat	upx
behavioral2/files/0x000a000000023bd1-187.dat	upx
behavioral2/files/0x000a000000023bd3-197.dat	upx
behavioral2/files/0x000a000000023bd2-192.dat	upx
behavioral2/files/0x000a000000023bd0-190.dat	upx
behavioral2/files/0x000a000000023bcf-185.dat	upx
behavioral2/files/0x000a000000023bcc-170.dat	upx
behavioral2/files/0x000a000000023bcb-161.dat	upx
behavioral2/files/0x000a000000023bca-160.dat	upx
behavioral2/memory/1708-149-0x00007FF7B20E0000-0x00007FF7B24D2000-memory.dmp	upx
behavioral2/memory/3856-145-0x00007FF74E2D0000-0x00007FF74E6C2000-memory.dmp	upx
behavioral2/memory/948-136-0x00007FF777330000-0x00007FF777722000-memory.dmp	upx
behavioral2/files/0x000b000000023bc0-135.dat	upx
behavioral2/memory/3532-121-0x00007FF661C70000-0x00007FF662062000-memory.dmp	upx
behavioral2/memory/2268-2477-0x00007FF605B00000-0x00007FF605EF2000-memory.dmp	upx
behavioral2/memory/2376-3341-0x00007FF79CEC0000-0x00007FF79D2B2000-memory.dmp	upx
behavioral2/memory/3416-3780-0x00007FF78EF40000-0x00007FF78F332000-memory.dmp	upx
behavioral2/memory/948-3782-0x00007FF777330000-0x00007FF777722000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\WIhAGoS.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\IWgxCUe.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\XzKwUoz.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\rvJUbmz.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\YBNslPV.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\wBgtVMf.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\oCQuNPT.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\ZMPdzuH.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\gIpiCJZ.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\bssapdJ.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\PrceEXt.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\mrhXeyl.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\xauHseG.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\Qgglger.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\OtMmWay.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\HrpyAky.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\mZqBhQw.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\OFzdRXo.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\eLyuqCR.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\dWiujmS.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\llQMPJP.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\RUBavkq.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\rdxvFpy.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\MocEgnp.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\jYdrrYc.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\RZFUqOT.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\jsdoDMQ.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\OEpylKS.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\ZYxuOEa.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\EjAvPxz.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\RlXSunN.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\GYdFULT.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\IomHuGg.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\iAqlhNK.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\rtCPBpX.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\uYxBYGC.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\CkqkHJQ.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\KlratbE.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\clsmZAb.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\dORdpSu.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\DZrUMsH.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\EvcKKvq.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\GtUwAVU.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\oSQZgGe.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\diPvUOU.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\oRmGTRe.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\BfvKqBc.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\SDpKlSZ.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\lBcSosm.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\KfMuhrO.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\asRJcgO.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\iPLbiOj.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\IoKRxgp.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\FpFZVPK.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\YYnBIrw.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\BDzlnBW.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\QIahNHd.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\gElkvsj.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\QzssVrP.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\KjTVVku.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\OshTpKK.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\IJyBFui.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\tVVgHiY.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\sqBUzQp.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4372	powershell.exe
4372	powershell.exe
4372	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4372	powershell.exe
Token: SeLockMemoryPrivilege	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3772 wrote to memory of 4372	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	84
PID 3772 wrote to memory of 4372	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	84
PID 3772 wrote to memory of 3976	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	85
PID 3772 wrote to memory of 3976	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	85
PID 3772 wrote to memory of 1552	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	86
PID 3772 wrote to memory of 1552	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	86
PID 3772 wrote to memory of 2780	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	87
PID 3772 wrote to memory of 2780	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	87
PID 3772 wrote to memory of 5060	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	88
PID 3772 wrote to memory of 5060	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	88
PID 3772 wrote to memory of 2152	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	89
PID 3772 wrote to memory of 2152	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	89
PID 3772 wrote to memory of 2268	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	90
PID 3772 wrote to memory of 2268	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	90
PID 3772 wrote to memory of 3648	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	91
PID 3772 wrote to memory of 3648	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	91
PID 3772 wrote to memory of 3068	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	92
PID 3772 wrote to memory of 3068	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	92
PID 3772 wrote to memory of 536	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	93
PID 3772 wrote to memory of 536	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	93
PID 3772 wrote to memory of 2288	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	94
PID 3772 wrote to memory of 2288	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	94
PID 3772 wrote to memory of 2900	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	95
PID 3772 wrote to memory of 2900	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	95
PID 3772 wrote to memory of 2376	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	96
PID 3772 wrote to memory of 2376	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	96
PID 3772 wrote to memory of 4084	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	97
PID 3772 wrote to memory of 4084	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	97
PID 3772 wrote to memory of 2024	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	98
PID 3772 wrote to memory of 2024	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	98
PID 3772 wrote to memory of 5024	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	99
PID 3772 wrote to memory of 5024	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	99
PID 3772 wrote to memory of 3416	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	100
PID 3772 wrote to memory of 3416	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	100
PID 3772 wrote to memory of 3532	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	101
PID 3772 wrote to memory of 3532	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	101
PID 3772 wrote to memory of 4892	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	102
PID 3772 wrote to memory of 4892	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	102
PID 3772 wrote to memory of 3856	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	103
PID 3772 wrote to memory of 3856	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	103
PID 3772 wrote to memory of 948	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	104
PID 3772 wrote to memory of 948	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	104
PID 3772 wrote to memory of 1708	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	105
PID 3772 wrote to memory of 1708	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	105
PID 3772 wrote to memory of 2700	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	106
PID 3772 wrote to memory of 2700	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	106
PID 3772 wrote to memory of 4380	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	107
PID 3772 wrote to memory of 4380	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	107
PID 3772 wrote to memory of 3964	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	108
PID 3772 wrote to memory of 3964	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	108
PID 3772 wrote to memory of 1856	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	109
PID 3772 wrote to memory of 1856	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	109
PID 3772 wrote to memory of 3288	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	110
PID 3772 wrote to memory of 3288	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	110
PID 3772 wrote to memory of 4220	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	111
PID 3772 wrote to memory of 4220	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	111
PID 3772 wrote to memory of 4404	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	112
PID 3772 wrote to memory of 4404	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	112
PID 3772 wrote to memory of 3996	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	113
PID 3772 wrote to memory of 3996	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	113
PID 3772 wrote to memory of 5016	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	114
PID 3772 wrote to memory of 5016	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	114
PID 3772 wrote to memory of 976	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	115
PID 3772 wrote to memory of 976	3772	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4372
- C:\Windows\System\KeNJeOI.exe
  C:\Windows\System\KeNJeOI.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\UPVjmYW.exe
  C:\Windows\System\UPVjmYW.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\prfWXsp.exe
  C:\Windows\System\prfWXsp.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\AWPlgzL.exe
  C:\Windows\System\AWPlgzL.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\HFpSkue.exe
  C:\Windows\System\HFpSkue.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\hBQblYO.exe
  C:\Windows\System\hBQblYO.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\sEkyfPZ.exe
  C:\Windows\System\sEkyfPZ.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\TKZxSbq.exe
  C:\Windows\System\TKZxSbq.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\zPTptnV.exe
  C:\Windows\System\zPTptnV.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\fJOANME.exe
  C:\Windows\System\fJOANME.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\RTyzDMk.exe
  C:\Windows\System\RTyzDMk.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\JQFxqTd.exe
  C:\Windows\System\JQFxqTd.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\GXoRxNt.exe
  C:\Windows\System\GXoRxNt.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\rdxvFpy.exe
  C:\Windows\System\rdxvFpy.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\DWVYdzD.exe
  C:\Windows\System\DWVYdzD.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\MXZLQoh.exe
  C:\Windows\System\MXZLQoh.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\GUxuMGI.exe
  C:\Windows\System\GUxuMGI.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\UOfNoqo.exe
  C:\Windows\System\UOfNoqo.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\iRjLwsg.exe
  C:\Windows\System\iRjLwsg.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\xwZSUrD.exe
  C:\Windows\System\xwZSUrD.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\uUvdPeF.exe
  C:\Windows\System\uUvdPeF.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\pGCaKhV.exe
  C:\Windows\System\pGCaKhV.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\iyjyWfS.exe
  C:\Windows\System\iyjyWfS.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\lFJAfyl.exe
  C:\Windows\System\lFJAfyl.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\DDaeSoD.exe
  C:\Windows\System\DDaeSoD.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\GIjXrPK.exe
  C:\Windows\System\GIjXrPK.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\BPpdZNh.exe
  C:\Windows\System\BPpdZNh.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\dUEVdKH.exe
  C:\Windows\System\dUEVdKH.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\vBrVnPc.exe
  C:\Windows\System\vBrVnPc.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\SFmlUTD.exe
  C:\Windows\System\SFmlUTD.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\rbIXzof.exe
  C:\Windows\System\rbIXzof.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\tOkmeAs.exe
  C:\Windows\System\tOkmeAs.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\YBtHlJc.exe
  C:\Windows\System\YBtHlJc.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\jPXrLUv.exe
  C:\Windows\System\jPXrLUv.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\mkTQZbr.exe
  C:\Windows\System\mkTQZbr.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\tsWeNUS.exe
  C:\Windows\System\tsWeNUS.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\dGbfnXj.exe
  C:\Windows\System\dGbfnXj.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\nVSzdyI.exe
  C:\Windows\System\nVSzdyI.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\bzKMLhQ.exe
  C:\Windows\System\bzKMLhQ.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\mELRmvn.exe
  C:\Windows\System\mELRmvn.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\CGbozbk.exe
  C:\Windows\System\CGbozbk.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\iaEsKtR.exe
  C:\Windows\System\iaEsKtR.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\dMbgFfM.exe
  C:\Windows\System\dMbgFfM.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\lhtoLlh.exe
  C:\Windows\System\lhtoLlh.exe
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Windows\System\Zvfzwmo.exe
  C:\Windows\System\Zvfzwmo.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\lAgASuD.exe
  C:\Windows\System\lAgASuD.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\iWAynMK.exe
  C:\Windows\System\iWAynMK.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\EklWUyI.exe
  C:\Windows\System\EklWUyI.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\cCHZULw.exe
  C:\Windows\System\cCHZULw.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\MTjXLDs.exe
  C:\Windows\System\MTjXLDs.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\BnFRlQj.exe
  C:\Windows\System\BnFRlQj.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\RBDyzyb.exe
  C:\Windows\System\RBDyzyb.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\jFzzwTG.exe
  C:\Windows\System\jFzzwTG.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\Ikjjnsj.exe
  C:\Windows\System\Ikjjnsj.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\txtKuao.exe
  C:\Windows\System\txtKuao.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\FVMihWI.exe
  C:\Windows\System\FVMihWI.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\POEVCkW.exe
  C:\Windows\System\POEVCkW.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\fVuoKye.exe
  C:\Windows\System\fVuoKye.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\LMTINTY.exe
  C:\Windows\System\LMTINTY.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\GubyXwc.exe
  C:\Windows\System\GubyXwc.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\zCCubMC.exe
  C:\Windows\System\zCCubMC.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\zaajEyc.exe
  C:\Windows\System\zaajEyc.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\CZeuiqT.exe
  C:\Windows\System\CZeuiqT.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\fXmsiGE.exe
  C:\Windows\System\fXmsiGE.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\wCCdToG.exe
  C:\Windows\System\wCCdToG.exe
  2⤵
  PID:4480
- C:\Windows\System\JGAMcjn.exe
  C:\Windows\System\JGAMcjn.exe
  2⤵
  PID:4468
- C:\Windows\System\JvWxnLo.exe
  C:\Windows\System\JvWxnLo.exe
  2⤵
  PID:1036
- C:\Windows\System\GrKzZsz.exe
  C:\Windows\System\GrKzZsz.exe
  2⤵
  PID:3896
- C:\Windows\System\GUyscRt.exe
  C:\Windows\System\GUyscRt.exe
  2⤵
  PID:3484
- C:\Windows\System\HifXgfP.exe
  C:\Windows\System\HifXgfP.exe
  2⤵
  PID:3636
- C:\Windows\System\ojVBJBU.exe
  C:\Windows\System\ojVBJBU.exe
  2⤵
  PID:5040
- C:\Windows\System\iwRsvbo.exe
  C:\Windows\System\iwRsvbo.exe
  2⤵
  PID:2740
- C:\Windows\System\VGlYGHB.exe
  C:\Windows\System\VGlYGHB.exe
  2⤵
  PID:5092
- C:\Windows\System\dCYGkga.exe
  C:\Windows\System\dCYGkga.exe
  2⤵
  PID:364
- C:\Windows\System\DYRHOXO.exe
  C:\Windows\System\DYRHOXO.exe
  2⤵
  PID:1816
- C:\Windows\System\pHCUWpx.exe
  C:\Windows\System\pHCUWpx.exe
  2⤵
  PID:1328
- C:\Windows\System\aKkrGHa.exe
  C:\Windows\System\aKkrGHa.exe
  2⤵
  PID:1776
- C:\Windows\System\REbNztU.exe
  C:\Windows\System\REbNztU.exe
  2⤵
  PID:4924
- C:\Windows\System\mlIZdpW.exe
  C:\Windows\System\mlIZdpW.exe
  2⤵
  PID:4036
- C:\Windows\System\zULsNvj.exe
  C:\Windows\System\zULsNvj.exe
  2⤵
  PID:3108
- C:\Windows\System\SuxWZFN.exe
  C:\Windows\System\SuxWZFN.exe
  2⤵
  PID:3596
- C:\Windows\System\xdGUXgp.exe
  C:\Windows\System\xdGUXgp.exe
  2⤵
  PID:2408
- C:\Windows\System\ofjbDrx.exe
  C:\Windows\System\ofjbDrx.exe
  2⤵
  PID:1472
- C:\Windows\System\lNVvfGM.exe
  C:\Windows\System\lNVvfGM.exe
  2⤵
  PID:2544
- C:\Windows\System\omKBePr.exe
  C:\Windows\System\omKBePr.exe
  2⤵
  PID:3616
- C:\Windows\System\PVTVVYx.exe
  C:\Windows\System\PVTVVYx.exe
  2⤵
  PID:3736
- C:\Windows\System\vQfKZKZ.exe
  C:\Windows\System\vQfKZKZ.exe
  2⤵
  PID:4336
- C:\Windows\System\QvVRppO.exe
  C:\Windows\System\QvVRppO.exe
  2⤵
  PID:2156
- C:\Windows\System\JZTCwOz.exe
  C:\Windows\System\JZTCwOz.exe
  2⤵
  PID:2628
- C:\Windows\System\BHBdQjc.exe
  C:\Windows\System\BHBdQjc.exe
  2⤵
  PID:968
- C:\Windows\System\lOUpmbn.exe
  C:\Windows\System\lOUpmbn.exe
  2⤵
  PID:5136
- C:\Windows\System\CqogZJb.exe
  C:\Windows\System\CqogZJb.exe
  2⤵
  PID:5160
- C:\Windows\System\cdVSoIk.exe
  C:\Windows\System\cdVSoIk.exe
  2⤵
  PID:5188
- C:\Windows\System\EnHALEx.exe
  C:\Windows\System\EnHALEx.exe
  2⤵
  PID:5216
- C:\Windows\System\FIpIkzK.exe
  C:\Windows\System\FIpIkzK.exe
  2⤵
  PID:5244
- C:\Windows\System\XCVJTBd.exe
  C:\Windows\System\XCVJTBd.exe
  2⤵
  PID:5276
- C:\Windows\System\SrutEvX.exe
  C:\Windows\System\SrutEvX.exe
  2⤵
  PID:5308
- C:\Windows\System\axrfdru.exe
  C:\Windows\System\axrfdru.exe
  2⤵
  PID:5340
- C:\Windows\System\kaSDJpE.exe
  C:\Windows\System\kaSDJpE.exe
  2⤵
  PID:5368
- C:\Windows\System\kyMjQzr.exe
  C:\Windows\System\kyMjQzr.exe
  2⤵
  PID:5400
- C:\Windows\System\QpCyTvh.exe
  C:\Windows\System\QpCyTvh.exe
  2⤵
  PID:5428
- C:\Windows\System\aoopCgQ.exe
  C:\Windows\System\aoopCgQ.exe
  2⤵
  PID:5452
- C:\Windows\System\KqIPhQB.exe
  C:\Windows\System\KqIPhQB.exe
  2⤵
  PID:5476
- C:\Windows\System\zljbmqi.exe
  C:\Windows\System\zljbmqi.exe
  2⤵
  PID:5516
- C:\Windows\System\noOoIYS.exe
  C:\Windows\System\noOoIYS.exe
  2⤵
  PID:5552
- C:\Windows\System\ATovDWD.exe
  C:\Windows\System\ATovDWD.exe
  2⤵
  PID:5568
- C:\Windows\System\wOEdpgR.exe
  C:\Windows\System\wOEdpgR.exe
  2⤵
  PID:5584
- C:\Windows\System\kEHCKQj.exe
  C:\Windows\System\kEHCKQj.exe
  2⤵
  PID:5612
- C:\Windows\System\TxHkXbK.exe
  C:\Windows\System\TxHkXbK.exe
  2⤵
  PID:5632
- C:\Windows\System\FKkDsPw.exe
  C:\Windows\System\FKkDsPw.exe
  2⤵
  PID:5648
- C:\Windows\System\iAqlhNK.exe
  C:\Windows\System\iAqlhNK.exe
  2⤵
  PID:5688
- C:\Windows\System\DdtgTKt.exe
  C:\Windows\System\DdtgTKt.exe
  2⤵
  PID:5712
- C:\Windows\System\VpjjKNa.exe
  C:\Windows\System\VpjjKNa.exe
  2⤵
  PID:5740
- C:\Windows\System\PZCBZEP.exe
  C:\Windows\System\PZCBZEP.exe
  2⤵
  PID:5756
- C:\Windows\System\hQVcnmV.exe
  C:\Windows\System\hQVcnmV.exe
  2⤵
  PID:5776
- C:\Windows\System\hzSxYvJ.exe
  C:\Windows\System\hzSxYvJ.exe
  2⤵
  PID:5804
- C:\Windows\System\RAkYcdk.exe
  C:\Windows\System\RAkYcdk.exe
  2⤵
  PID:5832
- C:\Windows\System\CQbxYpb.exe
  C:\Windows\System\CQbxYpb.exe
  2⤵
  PID:5908
- C:\Windows\System\hOLaUvZ.exe
  C:\Windows\System\hOLaUvZ.exe
  2⤵
  PID:5924
- C:\Windows\System\CRcGVJb.exe
  C:\Windows\System\CRcGVJb.exe
  2⤵
  PID:5948
- C:\Windows\System\UkjlcGx.exe
  C:\Windows\System\UkjlcGx.exe
  2⤵
  PID:5992
- C:\Windows\System\msieUoY.exe
  C:\Windows\System\msieUoY.exe
  2⤵
  PID:6016
- C:\Windows\System\efAMXzt.exe
  C:\Windows\System\efAMXzt.exe
  2⤵
  PID:6036
- C:\Windows\System\ZAsNrzC.exe
  C:\Windows\System\ZAsNrzC.exe
  2⤵
  PID:6064
- C:\Windows\System\xhplbUz.exe
  C:\Windows\System\xhplbUz.exe
  2⤵
  PID:6084
- C:\Windows\System\wTRbsAM.exe
  C:\Windows\System\wTRbsAM.exe
  2⤵
  PID:6108
- C:\Windows\System\eQShxHW.exe
  C:\Windows\System\eQShxHW.exe
  2⤵
  PID:6136
- C:\Windows\System\pQsrHgY.exe
  C:\Windows\System\pQsrHgY.exe
  2⤵
  PID:116
- C:\Windows\System\jxzoroF.exe
  C:\Windows\System\jxzoroF.exe
  2⤵
  PID:1608
- C:\Windows\System\OWIDtlf.exe
  C:\Windows\System\OWIDtlf.exe
  2⤵
  PID:5124
- C:\Windows\System\ZYxuOEa.exe
  C:\Windows\System\ZYxuOEa.exe
  2⤵
  PID:836
- C:\Windows\System\KbkuahU.exe
  C:\Windows\System\KbkuahU.exe
  2⤵
  PID:5236
- C:\Windows\System\MZbJtOn.exe
  C:\Windows\System\MZbJtOn.exe
  2⤵
  PID:1464
- C:\Windows\System\TugWDfw.exe
  C:\Windows\System\TugWDfw.exe
  2⤵
  PID:2264
- C:\Windows\System\StEIjlY.exe
  C:\Windows\System\StEIjlY.exe
  2⤵
  PID:4680
- C:\Windows\System\tLeByut.exe
  C:\Windows\System\tLeByut.exe
  2⤵
  PID:5416
- C:\Windows\System\okVHfBz.exe
  C:\Windows\System\okVHfBz.exe
  2⤵
  PID:3460
- C:\Windows\System\WRvGOfH.exe
  C:\Windows\System\WRvGOfH.exe
  2⤵
  PID:5500
- C:\Windows\System\iGFUnFa.exe
  C:\Windows\System\iGFUnFa.exe
  2⤵
  PID:3096
- C:\Windows\System\XphyVAe.exe
  C:\Windows\System\XphyVAe.exe
  2⤵
  PID:5576
- C:\Windows\System\ufgfAVN.exe
  C:\Windows\System\ufgfAVN.exe
  2⤵
  PID:5644
- C:\Windows\System\QJfElqS.exe
  C:\Windows\System\QJfElqS.exe
  2⤵
  PID:5684
- C:\Windows\System\TxZKyxS.exe
  C:\Windows\System\TxZKyxS.exe
  2⤵
  PID:5696
- C:\Windows\System\qbSDRgX.exe
  C:\Windows\System\qbSDRgX.exe
  2⤵
  PID:5812
- C:\Windows\System\VrQlBqD.exe
  C:\Windows\System\VrQlBqD.exe
  2⤵
  PID:5860
- C:\Windows\System\yqhOgwl.exe
  C:\Windows\System\yqhOgwl.exe
  2⤵
  PID:5916
- C:\Windows\System\OyAtklJ.exe
  C:\Windows\System\OyAtklJ.exe
  2⤵
  PID:6076
- C:\Windows\System\ydfIBFK.exe
  C:\Windows\System\ydfIBFK.exe
  2⤵
  PID:6120
- C:\Windows\System\yWJDWOs.exe
  C:\Windows\System\yWJDWOs.exe
  2⤵
  PID:6124
- C:\Windows\System\mHXZPUx.exe
  C:\Windows\System\mHXZPUx.exe
  2⤵
  PID:5212
- C:\Windows\System\Kyeannk.exe
  C:\Windows\System\Kyeannk.exe
  2⤵
  PID:5352
- C:\Windows\System\DCxNkmW.exe
  C:\Windows\System\DCxNkmW.exe
  2⤵
  PID:5564
- C:\Windows\System\heXeKhl.exe
  C:\Windows\System\heXeKhl.exe
  2⤵
  PID:5540
- C:\Windows\System\cbMgzxt.exe
  C:\Windows\System\cbMgzxt.exe
  2⤵
  PID:5772
- C:\Windows\System\cJLSAtw.exe
  C:\Windows\System\cJLSAtw.exe
  2⤵
  PID:5792
- C:\Windows\System\MfXDBlg.exe
  C:\Windows\System\MfXDBlg.exe
  2⤵
  PID:6012
- C:\Windows\System\HiZwfsr.exe
  C:\Windows\System\HiZwfsr.exe
  2⤵
  PID:2336
- C:\Windows\System\MHPgSeA.exe
  C:\Windows\System\MHPgSeA.exe
  2⤵
  PID:648
- C:\Windows\System\pVpJADF.exe
  C:\Windows\System\pVpJADF.exe
  2⤵
  PID:4760
- C:\Windows\System\FANWeMs.exe
  C:\Windows\System\FANWeMs.exe
  2⤵
  PID:5468
- C:\Windows\System\CAJOOlO.exe
  C:\Windows\System\CAJOOlO.exe
  2⤵
  PID:5604
- C:\Windows\System\lwQdAsr.exe
  C:\Windows\System\lwQdAsr.exe
  2⤵
  PID:6044
- C:\Windows\System\haOzyuv.exe
  C:\Windows\System\haOzyuv.exe
  2⤵
  PID:6156
- C:\Windows\System\tABkDrE.exe
  C:\Windows\System\tABkDrE.exe
  2⤵
  PID:6184
- C:\Windows\System\PKyARGO.exe
  C:\Windows\System\PKyARGO.exe
  2⤵
  PID:6244
- C:\Windows\System\vBRHCKi.exe
  C:\Windows\System\vBRHCKi.exe
  2⤵
  PID:6260
- C:\Windows\System\LwUWuYz.exe
  C:\Windows\System\LwUWuYz.exe
  2⤵
  PID:6320
- C:\Windows\System\kyAjPhI.exe
  C:\Windows\System\kyAjPhI.exe
  2⤵
  PID:6340
- C:\Windows\System\lCwrNeW.exe
  C:\Windows\System\lCwrNeW.exe
  2⤵
  PID:6368
- C:\Windows\System\JqtIJri.exe
  C:\Windows\System\JqtIJri.exe
  2⤵
  PID:6388
- C:\Windows\System\Bxuwbfc.exe
  C:\Windows\System\Bxuwbfc.exe
  2⤵
  PID:6432
- C:\Windows\System\UCDcFTi.exe
  C:\Windows\System\UCDcFTi.exe
  2⤵
  PID:6452
- C:\Windows\System\VgTAdMi.exe
  C:\Windows\System\VgTAdMi.exe
  2⤵
  PID:6480
- C:\Windows\System\jjFxWoc.exe
  C:\Windows\System\jjFxWoc.exe
  2⤵
  PID:6504
- C:\Windows\System\nMDcPPK.exe
  C:\Windows\System\nMDcPPK.exe
  2⤵
  PID:6524
- C:\Windows\System\KAadHdx.exe
  C:\Windows\System\KAadHdx.exe
  2⤵
  PID:6568
- C:\Windows\System\xUhoUcY.exe
  C:\Windows\System\xUhoUcY.exe
  2⤵
  PID:6588
- C:\Windows\System\ywRClgU.exe
  C:\Windows\System\ywRClgU.exe
  2⤵
  PID:6612
- C:\Windows\System\wqXFKMq.exe
  C:\Windows\System\wqXFKMq.exe
  2⤵
  PID:6632
- C:\Windows\System\YNQwQRg.exe
  C:\Windows\System\YNQwQRg.exe
  2⤵
  PID:6684
- C:\Windows\System\rQNzFuf.exe
  C:\Windows\System\rQNzFuf.exe
  2⤵
  PID:6704
- C:\Windows\System\eEWCUsL.exe
  C:\Windows\System\eEWCUsL.exe
  2⤵
  PID:6732
- C:\Windows\System\anjingb.exe
  C:\Windows\System\anjingb.exe
  2⤵
  PID:6752
- C:\Windows\System\TPgdrGY.exe
  C:\Windows\System\TPgdrGY.exe
  2⤵
  PID:6804
- C:\Windows\System\LItVKeR.exe
  C:\Windows\System\LItVKeR.exe
  2⤵
  PID:6832
- C:\Windows\System\YoXzoIo.exe
  C:\Windows\System\YoXzoIo.exe
  2⤵
  PID:6864
- C:\Windows\System\VoeryTt.exe
  C:\Windows\System\VoeryTt.exe
  2⤵
  PID:6884
- C:\Windows\System\aMYFGQi.exe
  C:\Windows\System\aMYFGQi.exe
  2⤵
  PID:6904
- C:\Windows\System\DVBLdHb.exe
  C:\Windows\System\DVBLdHb.exe
  2⤵
  PID:6940
- C:\Windows\System\arqiyLR.exe
  C:\Windows\System\arqiyLR.exe
  2⤵
  PID:6980
- C:\Windows\System\ODyYXii.exe
  C:\Windows\System\ODyYXii.exe
  2⤵
  PID:7008
- C:\Windows\System\feMtvhK.exe
  C:\Windows\System\feMtvhK.exe
  2⤵
  PID:7036
- C:\Windows\System\rYGUbRV.exe
  C:\Windows\System\rYGUbRV.exe
  2⤵
  PID:7068
- C:\Windows\System\zYpsvKV.exe
  C:\Windows\System\zYpsvKV.exe
  2⤵
  PID:7088
- C:\Windows\System\BmqyKBL.exe
  C:\Windows\System\BmqyKBL.exe
  2⤵
  PID:7108
- C:\Windows\System\rCIRGsu.exe
  C:\Windows\System\rCIRGsu.exe
  2⤵
  PID:7132
- C:\Windows\System\TehgXHb.exe
  C:\Windows\System\TehgXHb.exe
  2⤵
  PID:5720
- C:\Windows\System\ZNYatpq.exe
  C:\Windows\System\ZNYatpq.exe
  2⤵
  PID:5208
- C:\Windows\System\yvKPApM.exe
  C:\Windows\System\yvKPApM.exe
  2⤵
  PID:5496
- C:\Windows\System\EvDcaMQ.exe
  C:\Windows\System\EvDcaMQ.exe
  2⤵
  PID:6256
- C:\Windows\System\NVNrXYw.exe
  C:\Windows\System\NVNrXYw.exe
  2⤵
  PID:6280
- C:\Windows\System\sQKwNdK.exe
  C:\Windows\System\sQKwNdK.exe
  2⤵
  PID:6356
- C:\Windows\System\LGtgxmU.exe
  C:\Windows\System\LGtgxmU.exe
  2⤵
  PID:6364
- C:\Windows\System\HurgrAQ.exe
  C:\Windows\System\HurgrAQ.exe
  2⤵
  PID:6448
- C:\Windows\System\yNZlExK.exe
  C:\Windows\System\yNZlExK.exe
  2⤵
  PID:6536
- C:\Windows\System\xSaibkh.exe
  C:\Windows\System\xSaibkh.exe
  2⤵
  PID:6580
- C:\Windows\System\pXJrGmD.exe
  C:\Windows\System\pXJrGmD.exe
  2⤵
  PID:6720
- C:\Windows\System\ZuFJKNz.exe
  C:\Windows\System\ZuFJKNz.exe
  2⤵
  PID:6764
- C:\Windows\System\dcmBQru.exe
  C:\Windows\System\dcmBQru.exe
  2⤵
  PID:6824
- C:\Windows\System\jwVBzQb.exe
  C:\Windows\System\jwVBzQb.exe
  2⤵
  PID:6856
- C:\Windows\System\XehZObX.exe
  C:\Windows\System\XehZObX.exe
  2⤵
  PID:6956
- C:\Windows\System\xzkhQmJ.exe
  C:\Windows\System\xzkhQmJ.exe
  2⤵
  PID:7020
- C:\Windows\System\Hflfwwb.exe
  C:\Windows\System\Hflfwwb.exe
  2⤵
  PID:7116
- C:\Windows\System\LwOdJaa.exe
  C:\Windows\System\LwOdJaa.exe
  2⤵
  PID:7100
- C:\Windows\System\mqjGGZZ.exe
  C:\Windows\System\mqjGGZZ.exe
  2⤵
  PID:7164
- C:\Windows\System\ZLVGZHl.exe
  C:\Windows\System\ZLVGZHl.exe
  2⤵
  PID:6224
- C:\Windows\System\bumHwJz.exe
  C:\Windows\System\bumHwJz.exe
  2⤵
  PID:6332
- C:\Windows\System\aTzODbl.exe
  C:\Windows\System\aTzODbl.exe
  2⤵
  PID:6384
- C:\Windows\System\mesScKn.exe
  C:\Windows\System\mesScKn.exe
  2⤵
  PID:6628
- C:\Windows\System\wfAucnK.exe
  C:\Windows\System\wfAucnK.exe
  2⤵
  PID:6924
- C:\Windows\System\LMZVkPw.exe
  C:\Windows\System\LMZVkPw.exe
  2⤵
  PID:6272
- C:\Windows\System\pHezhun.exe
  C:\Windows\System\pHezhun.exe
  2⤵
  PID:6624
- C:\Windows\System\KJcOgYV.exe
  C:\Windows\System\KJcOgYV.exe
  2⤵
  PID:3628
- C:\Windows\System\rqnlinG.exe
  C:\Windows\System\rqnlinG.exe
  2⤵
  PID:7080
- C:\Windows\System\fgcEPdG.exe
  C:\Windows\System\fgcEPdG.exe
  2⤵
  PID:6724
- C:\Windows\System\oMZVZxH.exe
  C:\Windows\System\oMZVZxH.exe
  2⤵
  PID:7148
- C:\Windows\System\LqDqZCh.exe
  C:\Windows\System\LqDqZCh.exe
  2⤵
  PID:7196
- C:\Windows\System\rFVSlMu.exe
  C:\Windows\System\rFVSlMu.exe
  2⤵
  PID:7224
- C:\Windows\System\BQmkksu.exe
  C:\Windows\System\BQmkksu.exe
  2⤵
  PID:7248
- C:\Windows\System\BOkZOaQ.exe
  C:\Windows\System\BOkZOaQ.exe
  2⤵
  PID:7272
- C:\Windows\System\GdnWLRS.exe
  C:\Windows\System\GdnWLRS.exe
  2⤵
  PID:7296
- C:\Windows\System\opWNbOg.exe
  C:\Windows\System\opWNbOg.exe
  2⤵
  PID:7312
- C:\Windows\System\teMaGaa.exe
  C:\Windows\System\teMaGaa.exe
  2⤵
  PID:7376
- C:\Windows\System\SyunBDN.exe
  C:\Windows\System\SyunBDN.exe
  2⤵
  PID:7396
- C:\Windows\System\DlRZumm.exe
  C:\Windows\System\DlRZumm.exe
  2⤵
  PID:7416
- C:\Windows\System\WymezIS.exe
  C:\Windows\System\WymezIS.exe
  2⤵
  PID:7436
- C:\Windows\System\mpgBwwB.exe
  C:\Windows\System\mpgBwwB.exe
  2⤵
  PID:7508
- C:\Windows\System\vDlcUjC.exe
  C:\Windows\System\vDlcUjC.exe
  2⤵
  PID:7524
- C:\Windows\System\WUGHZqT.exe
  C:\Windows\System\WUGHZqT.exe
  2⤵
  PID:7548
- C:\Windows\System\gUQAlgE.exe
  C:\Windows\System\gUQAlgE.exe
  2⤵
  PID:7568
- C:\Windows\System\GuqKCzP.exe
  C:\Windows\System\GuqKCzP.exe
  2⤵
  PID:7588
- C:\Windows\System\YFygqET.exe
  C:\Windows\System\YFygqET.exe
  2⤵
  PID:7604
- C:\Windows\System\rBYwLRN.exe
  C:\Windows\System\rBYwLRN.exe
  2⤵
  PID:7644
- C:\Windows\System\rRELYZL.exe
  C:\Windows\System\rRELYZL.exe
  2⤵
  PID:7668
- C:\Windows\System\oSQZgGe.exe
  C:\Windows\System\oSQZgGe.exe
  2⤵
  PID:7696
- C:\Windows\System\EaAosFw.exe
  C:\Windows\System\EaAosFw.exe
  2⤵
  PID:7736
- C:\Windows\System\Vfaudza.exe
  C:\Windows\System\Vfaudza.exe
  2⤵
  PID:7764
- C:\Windows\System\nCxNjug.exe
  C:\Windows\System\nCxNjug.exe
  2⤵
  PID:7800
- C:\Windows\System\XnNqHXV.exe
  C:\Windows\System\XnNqHXV.exe
  2⤵
  PID:7816
- C:\Windows\System\ChBRdsD.exe
  C:\Windows\System\ChBRdsD.exe
  2⤵
  PID:7836
- C:\Windows\System\XpVLShQ.exe
  C:\Windows\System\XpVLShQ.exe
  2⤵
  PID:7880
- C:\Windows\System\NYPAeui.exe
  C:\Windows\System\NYPAeui.exe
  2⤵
  PID:7904
- C:\Windows\System\wRdTYmm.exe
  C:\Windows\System\wRdTYmm.exe
  2⤵
  PID:7936
- C:\Windows\System\WSKGdji.exe
  C:\Windows\System\WSKGdji.exe
  2⤵
  PID:7984
- C:\Windows\System\lcjnANa.exe
  C:\Windows\System\lcjnANa.exe
  2⤵
  PID:8000
- C:\Windows\System\pVTuUJb.exe
  C:\Windows\System\pVTuUJb.exe
  2⤵
  PID:8020
- C:\Windows\System\KdnrSjN.exe
  C:\Windows\System\KdnrSjN.exe
  2⤵
  PID:8044
- C:\Windows\System\LbbYryL.exe
  C:\Windows\System\LbbYryL.exe
  2⤵
  PID:8064
- C:\Windows\System\sJvrzxG.exe
  C:\Windows\System\sJvrzxG.exe
  2⤵
  PID:8084
- C:\Windows\System\SgfZKoU.exe
  C:\Windows\System\SgfZKoU.exe
  2⤵
  PID:8152
- C:\Windows\System\NBUQkvD.exe
  C:\Windows\System\NBUQkvD.exe
  2⤵
  PID:8168
- C:\Windows\System\gnOCeDo.exe
  C:\Windows\System\gnOCeDo.exe
  2⤵
  PID:5392
- C:\Windows\System\HQiuhnB.exe
  C:\Windows\System\HQiuhnB.exe
  2⤵
  PID:7220
- C:\Windows\System\KIVxlZx.exe
  C:\Windows\System\KIVxlZx.exe
  2⤵
  PID:7280
- C:\Windows\System\UFWOUAn.exe
  C:\Windows\System\UFWOUAn.exe
  2⤵
  PID:7392
- C:\Windows\System\BdVNmnv.exe
  C:\Windows\System\BdVNmnv.exe
  2⤵
  PID:7424
- C:\Windows\System\BCePxzi.exe
  C:\Windows\System\BCePxzi.exe
  2⤵
  PID:7496
- C:\Windows\System\EfHLZxy.exe
  C:\Windows\System\EfHLZxy.exe
  2⤵
  PID:7536
- C:\Windows\System\BEWeqgr.exe
  C:\Windows\System\BEWeqgr.exe
  2⤵
  PID:7640
- C:\Windows\System\saolQvp.exe
  C:\Windows\System\saolQvp.exe
  2⤵
  PID:7716
- C:\Windows\System\EcTUFDM.exe
  C:\Windows\System\EcTUFDM.exe
  2⤵
  PID:7772
- C:\Windows\System\jDxNsRw.exe
  C:\Windows\System\jDxNsRw.exe
  2⤵
  PID:2220
- C:\Windows\System\HrSgUZZ.exe
  C:\Windows\System\HrSgUZZ.exe
  2⤵
  PID:7872
- C:\Windows\System\vLafTHk.exe
  C:\Windows\System\vLafTHk.exe
  2⤵
  PID:7916
- C:\Windows\System\EcDvaXE.exe
  C:\Windows\System\EcDvaXE.exe
  2⤵
  PID:7960
- C:\Windows\System\GKnepgl.exe
  C:\Windows\System\GKnepgl.exe
  2⤵
  PID:8028
- C:\Windows\System\sRuNUWN.exe
  C:\Windows\System\sRuNUWN.exe
  2⤵
  PID:8132
- C:\Windows\System\xsfJDAX.exe
  C:\Windows\System\xsfJDAX.exe
  2⤵
  PID:8164
- C:\Windows\System\HNjGvEm.exe
  C:\Windows\System\HNjGvEm.exe
  2⤵
  PID:8188
- C:\Windows\System\gAPCQnT.exe
  C:\Windows\System\gAPCQnT.exe
  2⤵
  PID:7240
- C:\Windows\System\yRAzxjd.exe
  C:\Windows\System\yRAzxjd.exe
  2⤵
  PID:7756
- C:\Windows\System\cVPOxIv.exe
  C:\Windows\System\cVPOxIv.exe
  2⤵
  PID:7832
- C:\Windows\System\wEpHlPV.exe
  C:\Windows\System\wEpHlPV.exe
  2⤵
  PID:7896
- C:\Windows\System\NSECXJQ.exe
  C:\Windows\System\NSECXJQ.exe
  2⤵
  PID:8092
- C:\Windows\System\icFsilU.exe
  C:\Windows\System\icFsilU.exe
  2⤵
  PID:7188
- C:\Windows\System\oaDXvuj.exe
  C:\Windows\System\oaDXvuj.exe
  2⤵
  PID:7580
- C:\Windows\System\hkpnvuV.exe
  C:\Windows\System\hkpnvuV.exe
  2⤵
  PID:7448
- C:\Windows\System\UGZqUwG.exe
  C:\Windows\System\UGZqUwG.exe
  2⤵
  PID:996
- C:\Windows\System\SnJKQhu.exe
  C:\Windows\System\SnJKQhu.exe
  2⤵
  PID:8116
- C:\Windows\System\ihHHMgB.exe
  C:\Windows\System\ihHHMgB.exe
  2⤵
  PID:7712
- C:\Windows\System\MUIbdBO.exe
  C:\Windows\System\MUIbdBO.exe
  2⤵
  PID:8200
- C:\Windows\System\fsvDvaR.exe
  C:\Windows\System\fsvDvaR.exe
  2⤵
  PID:8228
- C:\Windows\System\CYTKBat.exe
  C:\Windows\System\CYTKBat.exe
  2⤵
  PID:8252
- C:\Windows\System\pWiHOXa.exe
  C:\Windows\System\pWiHOXa.exe
  2⤵
  PID:8272
- C:\Windows\System\OWlVQot.exe
  C:\Windows\System\OWlVQot.exe
  2⤵
  PID:8296
- C:\Windows\System\gAVVEfH.exe
  C:\Windows\System\gAVVEfH.exe
  2⤵
  PID:8336
- C:\Windows\System\TiXqFLr.exe
  C:\Windows\System\TiXqFLr.exe
  2⤵
  PID:8372
- C:\Windows\System\zDApPxC.exe
  C:\Windows\System\zDApPxC.exe
  2⤵
  PID:8388
- C:\Windows\System\QCwxPUf.exe
  C:\Windows\System\QCwxPUf.exe
  2⤵
  PID:8416
- C:\Windows\System\yCsdRVr.exe
  C:\Windows\System\yCsdRVr.exe
  2⤵
  PID:8436
- C:\Windows\System\rvKwMDT.exe
  C:\Windows\System\rvKwMDT.exe
  2⤵
  PID:8464
- C:\Windows\System\wXYCNXk.exe
  C:\Windows\System\wXYCNXk.exe
  2⤵
  PID:8528
- C:\Windows\System\zTQeemF.exe
  C:\Windows\System\zTQeemF.exe
  2⤵
  PID:8544
- C:\Windows\System\yBaUclh.exe
  C:\Windows\System\yBaUclh.exe
  2⤵
  PID:8564
- C:\Windows\System\wDesvoX.exe
  C:\Windows\System\wDesvoX.exe
  2⤵
  PID:8588
- C:\Windows\System\WCHtJSR.exe
  C:\Windows\System\WCHtJSR.exe
  2⤵
  PID:8608
- C:\Windows\System\WhrJeFk.exe
  C:\Windows\System\WhrJeFk.exe
  2⤵
  PID:8636
- C:\Windows\System\FRimcpj.exe
  C:\Windows\System\FRimcpj.exe
  2⤵
  PID:8672
- C:\Windows\System\woTMoFL.exe
  C:\Windows\System\woTMoFL.exe
  2⤵
  PID:8716
- C:\Windows\System\ToZyrCC.exe
  C:\Windows\System\ToZyrCC.exe
  2⤵
  PID:8744
- C:\Windows\System\VKLbOux.exe
  C:\Windows\System\VKLbOux.exe
  2⤵
  PID:8772
- C:\Windows\System\LCaUomb.exe
  C:\Windows\System\LCaUomb.exe
  2⤵
  PID:8792
- C:\Windows\System\tmXWMhK.exe
  C:\Windows\System\tmXWMhK.exe
  2⤵
  PID:8816
- C:\Windows\System\gIzqEil.exe
  C:\Windows\System\gIzqEil.exe
  2⤵
  PID:8840
- C:\Windows\System\tHECxnh.exe
  C:\Windows\System\tHECxnh.exe
  2⤵
  PID:8868
- C:\Windows\System\pTcQElC.exe
  C:\Windows\System\pTcQElC.exe
  2⤵
  PID:8896
- C:\Windows\System\xLqJNAX.exe
  C:\Windows\System\xLqJNAX.exe
  2⤵
  PID:8916
- C:\Windows\System\cVRCLUI.exe
  C:\Windows\System\cVRCLUI.exe
  2⤵
  PID:8944
- C:\Windows\System\FFgWKii.exe
  C:\Windows\System\FFgWKii.exe
  2⤵
  PID:8964
- C:\Windows\System\atMobYn.exe
  C:\Windows\System\atMobYn.exe
  2⤵
  PID:8988
- C:\Windows\System\eWvTpPm.exe
  C:\Windows\System\eWvTpPm.exe
  2⤵
  PID:9036
- C:\Windows\System\PPxRUVW.exe
  C:\Windows\System\PPxRUVW.exe
  2⤵
  PID:9076
- C:\Windows\System\OScrvHI.exe
  C:\Windows\System\OScrvHI.exe
  2⤵
  PID:9100
- C:\Windows\System\figUGkX.exe
  C:\Windows\System\figUGkX.exe
  2⤵
  PID:9120
- C:\Windows\System\qlTXNaU.exe
  C:\Windows\System\qlTXNaU.exe
  2⤵
  PID:9144
- C:\Windows\System\YlXyEjP.exe
  C:\Windows\System\YlXyEjP.exe
  2⤵
  PID:9164
- C:\Windows\System\OEpylKS.exe
  C:\Windows\System\OEpylKS.exe
  2⤵
  PID:2580
- C:\Windows\System\DKwJIFa.exe
  C:\Windows\System\DKwJIFa.exe
  2⤵
  PID:8196
- C:\Windows\System\wRTKHle.exe
  C:\Windows\System\wRTKHle.exe
  2⤵
  PID:8244
- C:\Windows\System\VWuTUPM.exe
  C:\Windows\System\VWuTUPM.exe
  2⤵
  PID:8332
- C:\Windows\System\BoLrfGq.exe
  C:\Windows\System\BoLrfGq.exe
  2⤵
  PID:8404
- C:\Windows\System\mmORbbJ.exe
  C:\Windows\System\mmORbbJ.exe
  2⤵
  PID:8480
- C:\Windows\System\ccYodLO.exe
  C:\Windows\System\ccYodLO.exe
  2⤵
  PID:8492
- C:\Windows\System\QlkYeXN.exe
  C:\Windows\System\QlkYeXN.exe
  2⤵
  PID:8556
- C:\Windows\System\idktsmy.exe
  C:\Windows\System\idktsmy.exe
  2⤵
  PID:8628
- C:\Windows\System\pEmWMYx.exe
  C:\Windows\System\pEmWMYx.exe
  2⤵
  PID:8712
- C:\Windows\System\KeRIPNZ.exe
  C:\Windows\System\KeRIPNZ.exe
  2⤵
  PID:8764
- C:\Windows\System\fLHfJJL.exe
  C:\Windows\System\fLHfJJL.exe
  2⤵
  PID:7676
- C:\Windows\System\tXyzAHg.exe
  C:\Windows\System\tXyzAHg.exe
  2⤵
  PID:8856
- C:\Windows\System\YHZLDrZ.exe
  C:\Windows\System\YHZLDrZ.exe
  2⤵
  PID:8904
- C:\Windows\System\xQHixPJ.exe
  C:\Windows\System\xQHixPJ.exe
  2⤵
  PID:8976
- C:\Windows\System\dHfZEod.exe
  C:\Windows\System\dHfZEod.exe
  2⤵
  PID:9072
- C:\Windows\System\bkijVVn.exe
  C:\Windows\System\bkijVVn.exe
  2⤵
  PID:9136
- C:\Windows\System\VrNMweb.exe
  C:\Windows\System\VrNMweb.exe
  2⤵
  PID:9140
- C:\Windows\System\iHHwZxA.exe
  C:\Windows\System\iHHwZxA.exe
  2⤵
  PID:8224
- C:\Windows\System\CYUbdBs.exe
  C:\Windows\System\CYUbdBs.exe
  2⤵
  PID:8280
- C:\Windows\System\SHeXgyl.exe
  C:\Windows\System\SHeXgyl.exe
  2⤵
  PID:8524
- C:\Windows\System\oVTZmxb.exe
  C:\Windows\System\oVTZmxb.exe
  2⤵
  PID:8644
- C:\Windows\System\dsWRuez.exe
  C:\Windows\System\dsWRuez.exe
  2⤵
  PID:8736
- C:\Windows\System\lsHLBEr.exe
  C:\Windows\System\lsHLBEr.exe
  2⤵
  PID:8952
- C:\Windows\System\WTFAXtK.exe
  C:\Windows\System\WTFAXtK.exe
  2⤵
  PID:9092
- C:\Windows\System\VXAGAlS.exe
  C:\Windows\System\VXAGAlS.exe
  2⤵
  PID:8316
- C:\Windows\System\zCQQxXP.exe
  C:\Windows\System\zCQQxXP.exe
  2⤵
  PID:8808
- C:\Windows\System\bDdckjW.exe
  C:\Windows\System\bDdckjW.exe
  2⤵
  PID:9028
- C:\Windows\System\ArKlzkh.exe
  C:\Windows\System\ArKlzkh.exe
  2⤵
  PID:544
- C:\Windows\System\dHnEYqo.exe
  C:\Windows\System\dHnEYqo.exe
  2⤵
  PID:8688
- C:\Windows\System\kgEpIqy.exe
  C:\Windows\System\kgEpIqy.exe
  2⤵
  PID:8876
- C:\Windows\System\yBnhlNG.exe
  C:\Windows\System\yBnhlNG.exe
  2⤵
  PID:2664
- C:\Windows\System\vpyEUfN.exe
  C:\Windows\System\vpyEUfN.exe
  2⤵
  PID:9240
- C:\Windows\System\ENMPaDl.exe
  C:\Windows\System\ENMPaDl.exe
  2⤵
  PID:9264
- C:\Windows\System\exFFdIg.exe
  C:\Windows\System\exFFdIg.exe
  2⤵
  PID:9328
- C:\Windows\System\DCXQyPp.exe
  C:\Windows\System\DCXQyPp.exe
  2⤵
  PID:9360
- C:\Windows\System\ZQDOChi.exe
  C:\Windows\System\ZQDOChi.exe
  2⤵
  PID:9388
- C:\Windows\System\ENMYjwE.exe
  C:\Windows\System\ENMYjwE.exe
  2⤵
  PID:9420
- C:\Windows\System\XZAeydP.exe
  C:\Windows\System\XZAeydP.exe
  2⤵
  PID:9452
- C:\Windows\System\DKKduQO.exe
  C:\Windows\System\DKKduQO.exe
  2⤵
  PID:9472
- C:\Windows\System\VlsBTQr.exe
  C:\Windows\System\VlsBTQr.exe
  2⤵
  PID:9488
- C:\Windows\System\QzVTNOx.exe
  C:\Windows\System\QzVTNOx.exe
  2⤵
  PID:9536
- C:\Windows\System\QzIisLP.exe
  C:\Windows\System\QzIisLP.exe
  2⤵
  PID:9568
- C:\Windows\System\oFYkeoi.exe
  C:\Windows\System\oFYkeoi.exe
  2⤵
  PID:9596
- C:\Windows\System\tKSVflt.exe
  C:\Windows\System\tKSVflt.exe
  2⤵
  PID:9636
- C:\Windows\System\fXAyLDH.exe
  C:\Windows\System\fXAyLDH.exe
  2⤵
  PID:9660
- C:\Windows\System\dozCafj.exe
  C:\Windows\System\dozCafj.exe
  2⤵
  PID:9680
- C:\Windows\System\QpIsikl.exe
  C:\Windows\System\QpIsikl.exe
  2⤵
  PID:9708
- C:\Windows\System\AMfjDXZ.exe
  C:\Windows\System\AMfjDXZ.exe
  2⤵
  PID:9732
- C:\Windows\System\KnlxzxF.exe
  C:\Windows\System\KnlxzxF.exe
  2⤵
  PID:9760
- C:\Windows\System\xsknFkY.exe
  C:\Windows\System\xsknFkY.exe
  2⤵
  PID:9780
- C:\Windows\System\xbGdNMV.exe
  C:\Windows\System\xbGdNMV.exe
  2⤵
  PID:9800
- C:\Windows\System\HrEDool.exe
  C:\Windows\System\HrEDool.exe
  2⤵
  PID:9828
- C:\Windows\System\HIgTbRn.exe
  C:\Windows\System\HIgTbRn.exe
  2⤵
  PID:9880
- C:\Windows\System\BCThElD.exe
  C:\Windows\System\BCThElD.exe
  2⤵
  PID:9904
- C:\Windows\System\TCeKlSL.exe
  C:\Windows\System\TCeKlSL.exe
  2⤵
  PID:9944
- C:\Windows\System\aZfhKUg.exe
  C:\Windows\System\aZfhKUg.exe
  2⤵
  PID:9964
- C:\Windows\System\WjVgjju.exe
  C:\Windows\System\WjVgjju.exe
  2⤵
  PID:10000
- C:\Windows\System\TeSzcTr.exe
  C:\Windows\System\TeSzcTr.exe
  2⤵
  PID:10016
- C:\Windows\System\PPTMPHF.exe
  C:\Windows\System\PPTMPHF.exe
  2⤵
  PID:10036
- C:\Windows\System\FfSdvZE.exe
  C:\Windows\System\FfSdvZE.exe
  2⤵
  PID:10060
- C:\Windows\System\JCkXRiP.exe
  C:\Windows\System\JCkXRiP.exe
  2⤵
  PID:10132
- C:\Windows\System\XqnIRoB.exe
  C:\Windows\System\XqnIRoB.exe
  2⤵
  PID:10160
- C:\Windows\System\vmjOdzv.exe
  C:\Windows\System\vmjOdzv.exe
  2⤵
  PID:10176
- C:\Windows\System\eaTllqU.exe
  C:\Windows\System\eaTllqU.exe
  2⤵
  PID:10208
- C:\Windows\System\VJXOyBt.exe
  C:\Windows\System\VJXOyBt.exe
  2⤵
  PID:10224
- C:\Windows\System\uXlJDAK.exe
  C:\Windows\System\uXlJDAK.exe
  2⤵
  PID:8268
- C:\Windows\System\xVbYQDD.exe
  C:\Windows\System\xVbYQDD.exe
  2⤵
  PID:9276
- C:\Windows\System\KbVZqdM.exe
  C:\Windows\System\KbVZqdM.exe
  2⤵
  PID:9344
- C:\Windows\System\PhUcIXk.exe
  C:\Windows\System\PhUcIXk.exe
  2⤵
  PID:9416
- C:\Windows\System\uWTVmFX.exe
  C:\Windows\System\uWTVmFX.exe
  2⤵
  PID:9460
- C:\Windows\System\SsbDCRm.exe
  C:\Windows\System\SsbDCRm.exe
  2⤵
  PID:9528
- C:\Windows\System\VMsKHOo.exe
  C:\Windows\System\VMsKHOo.exe
  2⤵
  PID:9584
- C:\Windows\System\HTbSqeY.exe
  C:\Windows\System\HTbSqeY.exe
  2⤵
  PID:9632
- C:\Windows\System\jXWghOV.exe
  C:\Windows\System\jXWghOV.exe
  2⤵
  PID:9676
- C:\Windows\System\GIpVMGF.exe
  C:\Windows\System\GIpVMGF.exe
  2⤵
  PID:9748
- C:\Windows\System\dWiujmS.exe
  C:\Windows\System\dWiujmS.exe
  2⤵
  PID:9796
- C:\Windows\System\MzWRMkp.exe
  C:\Windows\System\MzWRMkp.exe
  2⤵
  PID:9896
- C:\Windows\System\JQJMESQ.exe
  C:\Windows\System\JQJMESQ.exe
  2⤵
  PID:9976
- C:\Windows\System\rpdxNpc.exe
  C:\Windows\System\rpdxNpc.exe
  2⤵
  PID:10056
- C:\Windows\System\QGnPquS.exe
  C:\Windows\System\QGnPquS.exe
  2⤵
  PID:10120
- C:\Windows\System\SGDYWNB.exe
  C:\Windows\System\SGDYWNB.exe
  2⤵
  PID:10192
- C:\Windows\System\lwmoKIA.exe
  C:\Windows\System\lwmoKIA.exe
  2⤵
  PID:10204
- C:\Windows\System\fANozgo.exe
  C:\Windows\System\fANozgo.exe
  2⤵
  PID:9336
- C:\Windows\System\IzYVZol.exe
  C:\Windows\System\IzYVZol.exe
  2⤵
  PID:9560
- C:\Windows\System\FOcBUhj.exe
  C:\Windows\System\FOcBUhj.exe
  2⤵
  PID:9616
- C:\Windows\System\nWYYvXk.exe
  C:\Windows\System\nWYYvXk.exe
  2⤵
  PID:9696
- C:\Windows\System\PVFDLHc.exe
  C:\Windows\System\PVFDLHc.exe
  2⤵
  PID:9744
- C:\Windows\System\UsnpVNX.exe
  C:\Windows\System\UsnpVNX.exe
  2⤵
  PID:9988
- C:\Windows\System\GxTDtRH.exe
  C:\Windows\System\GxTDtRH.exe
  2⤵
  PID:10172
- C:\Windows\System\eLyuqCR.exe
  C:\Windows\System\eLyuqCR.exe
  2⤵
  PID:9296
- C:\Windows\System\xDMaGlO.exe
  C:\Windows\System\xDMaGlO.exe
  2⤵
  PID:2688
- C:\Windows\System\wrhCPlf.exe
  C:\Windows\System\wrhCPlf.exe
  2⤵
  PID:9656
- C:\Windows\System\IFzuhGU.exe
  C:\Windows\System\IFzuhGU.exe
  2⤵
  PID:10220
- C:\Windows\System\VpqUMeK.exe
  C:\Windows\System\VpqUMeK.exe
  2⤵
  PID:10272
- C:\Windows\System\RvGXzou.exe
  C:\Windows\System\RvGXzou.exe
  2⤵
  PID:10292
- C:\Windows\System\PQhMcYN.exe
  C:\Windows\System\PQhMcYN.exe
  2⤵
  PID:10316
- C:\Windows\System\PDzgGCJ.exe
  C:\Windows\System\PDzgGCJ.exe
  2⤵
  PID:10360
- C:\Windows\System\frZVgLC.exe
  C:\Windows\System\frZVgLC.exe
  2⤵
  PID:10384
- C:\Windows\System\DBuufsg.exe
  C:\Windows\System\DBuufsg.exe
  2⤵
  PID:10412
- C:\Windows\System\tYIZiRI.exe
  C:\Windows\System\tYIZiRI.exe
  2⤵
  PID:10428
- C:\Windows\System\jQbKEYx.exe
  C:\Windows\System\jQbKEYx.exe
  2⤵
  PID:10456
- C:\Windows\System\sRPZmmi.exe
  C:\Windows\System\sRPZmmi.exe
  2⤵
  PID:10484
- C:\Windows\System\QPSMiii.exe
  C:\Windows\System\QPSMiii.exe
  2⤵
  PID:10504
- C:\Windows\System\tmvYgCZ.exe
  C:\Windows\System\tmvYgCZ.exe
  2⤵
  PID:10528
- C:\Windows\System\mXAwwRH.exe
  C:\Windows\System\mXAwwRH.exe
  2⤵
  PID:10560
- C:\Windows\System\mOlEEeU.exe
  C:\Windows\System\mOlEEeU.exe
  2⤵
  PID:10584
- C:\Windows\System\xFCpUBx.exe
  C:\Windows\System\xFCpUBx.exe
  2⤵
  PID:10608
- C:\Windows\System\TItSdzc.exe
  C:\Windows\System\TItSdzc.exe
  2⤵
  PID:10628
- C:\Windows\System\ghsZeuo.exe
  C:\Windows\System\ghsZeuo.exe
  2⤵
  PID:10656
- C:\Windows\System\JdPJOsZ.exe
  C:\Windows\System\JdPJOsZ.exe
  2⤵
  PID:10680
- C:\Windows\System\WRGTBcI.exe
  C:\Windows\System\WRGTBcI.exe
  2⤵
  PID:10748
- C:\Windows\System\DtSQERS.exe
  C:\Windows\System\DtSQERS.exe
  2⤵
  PID:10768
- C:\Windows\System\RJIwXnF.exe
  C:\Windows\System\RJIwXnF.exe
  2⤵
  PID:10796
- C:\Windows\System\StsARcy.exe
  C:\Windows\System\StsARcy.exe
  2⤵
  PID:10824
- C:\Windows\System\CMdSvtE.exe
  C:\Windows\System\CMdSvtE.exe
  2⤵
  PID:10852
- C:\Windows\System\owUqmUc.exe
  C:\Windows\System\owUqmUc.exe
  2⤵
  PID:10876
- C:\Windows\System\qdbTVel.exe
  C:\Windows\System\qdbTVel.exe
  2⤵
  PID:10912
- C:\Windows\System\RGVXAtZ.exe
  C:\Windows\System\RGVXAtZ.exe
  2⤵
  PID:10940
- C:\Windows\System\ojSKSKn.exe
  C:\Windows\System\ojSKSKn.exe
  2⤵
  PID:10960
- C:\Windows\System\tgdwXul.exe
  C:\Windows\System\tgdwXul.exe
  2⤵
  PID:10980
- C:\Windows\System\LuWLdcP.exe
  C:\Windows\System\LuWLdcP.exe
  2⤵
  PID:11008
- C:\Windows\System\atAfrNV.exe
  C:\Windows\System\atAfrNV.exe
  2⤵
  PID:11028
- C:\Windows\System\euHGYJm.exe
  C:\Windows\System\euHGYJm.exe
  2⤵
  PID:11052
- C:\Windows\System\zWhFGDk.exe
  C:\Windows\System\zWhFGDk.exe
  2⤵
  PID:11080
- C:\Windows\System\duvnAqD.exe
  C:\Windows\System\duvnAqD.exe
  2⤵
  PID:11100
- C:\Windows\System\kMvHCZg.exe
  C:\Windows\System\kMvHCZg.exe
  2⤵
  PID:11128
- C:\Windows\System\etujlBn.exe
  C:\Windows\System\etujlBn.exe
  2⤵
  PID:11148
- C:\Windows\System\BVLhhAD.exe
  C:\Windows\System\BVLhhAD.exe
  2⤵
  PID:11200
- C:\Windows\System\iKDJRDa.exe
  C:\Windows\System\iKDJRDa.exe
  2⤵
  PID:11228
- C:\Windows\System\Gdrhyfi.exe
  C:\Windows\System\Gdrhyfi.exe
  2⤵
  PID:11252
- C:\Windows\System\FJQWmxA.exe
  C:\Windows\System\FJQWmxA.exe
  2⤵
  PID:10288
- C:\Windows\System\KvQiHLZ.exe
  C:\Windows\System\KvQiHLZ.exe
  2⤵
  PID:10440
- C:\Windows\System\FiEHRTg.exe
  C:\Windows\System\FiEHRTg.exe
  2⤵
  PID:10520
- C:\Windows\System\AceDJtP.exe
  C:\Windows\System\AceDJtP.exe
  2⤵
  PID:10644
- C:\Windows\System\xdMiKIE.exe
  C:\Windows\System\xdMiKIE.exe
  2⤵
  PID:10792
- C:\Windows\System\NjOjubH.exe
  C:\Windows\System\NjOjubH.exe
  2⤵
  PID:10900
- C:\Windows\System\QbFAFHu.exe
  C:\Windows\System\QbFAFHu.exe
  2⤵
  PID:11020
- C:\Windows\System\dQmggjq.exe
  C:\Windows\System\dQmggjq.exe
  2⤵
  PID:11096
- C:\Windows\System\FKjthjK.exe
  C:\Windows\System\FKjthjK.exe
  2⤵
  PID:11144
- C:\Windows\System\lviKIoj.exe
  C:\Windows\System\lviKIoj.exe
  2⤵
  PID:11260
- C:\Windows\System\RetyJpP.exe
  C:\Windows\System\RetyJpP.exe
  2⤵
  PID:10356
- C:\Windows\System\ItcJBlm.exe
  C:\Windows\System\ItcJBlm.exe
  2⤵
  PID:11216
- C:\Windows\System\arKpVjk.exe
  C:\Windows\System\arKpVjk.exe
  2⤵
  PID:10300
- C:\Windows\System\OrvEKJR.exe
  C:\Windows\System\OrvEKJR.exe
  2⤵
  PID:10380
- C:\Windows\System\jHSqReP.exe
  C:\Windows\System\jHSqReP.exe
  2⤵
  PID:10516
- C:\Windows\System\dhfJCRl.exe
  C:\Windows\System\dhfJCRl.exe
  2⤵
  PID:10616
- C:\Windows\System\PiriyCu.exe
  C:\Windows\System\PiriyCu.exe
  2⤵
  PID:10716
- C:\Windows\System\NsjhDaT.exe
  C:\Windows\System\NsjhDaT.exe
  2⤵
  PID:11024
- C:\Windows\System\jLoJiDD.exe
  C:\Windows\System\jLoJiDD.exe
  2⤵
  PID:10976
- C:\Windows\System\xUbBeGE.exe
  C:\Windows\System\xUbBeGE.exe
  2⤵
  PID:11240
- C:\Windows\System\vlSXIfW.exe
  C:\Windows\System\vlSXIfW.exe
  2⤵
  PID:10376
- C:\Windows\System\koAfUrG.exe
  C:\Windows\System\koAfUrG.exe
  2⤵
  PID:10576
- C:\Windows\System\SkLXAMY.exe
  C:\Windows\System\SkLXAMY.exe
  2⤵
  PID:10664
- C:\Windows\System\eEPQmez.exe
  C:\Windows\System\eEPQmez.exe
  2⤵
  PID:10424
- C:\Windows\System\KzXHZOg.exe
  C:\Windows\System\KzXHZOg.exe
  2⤵
  PID:10244
- C:\Windows\System\Qgglger.exe
  C:\Windows\System\Qgglger.exe
  2⤵
  PID:10476
- C:\Windows\System\dftTSgs.exe
  C:\Windows\System\dftTSgs.exe
  2⤵
  PID:11280
- C:\Windows\System\GcNYKVU.exe
  C:\Windows\System\GcNYKVU.exe
  2⤵
  PID:11300
- C:\Windows\System\acHRaBq.exe
  C:\Windows\System\acHRaBq.exe
  2⤵
  PID:11348
- C:\Windows\System\QlyPAGW.exe
  C:\Windows\System\QlyPAGW.exe
  2⤵
  PID:11368
- C:\Windows\System\mugacAg.exe
  C:\Windows\System\mugacAg.exe
  2⤵
  PID:11384
- C:\Windows\System\dcgRrTN.exe
  C:\Windows\System\dcgRrTN.exe
  2⤵
  PID:11404
- C:\Windows\System\beehBBp.exe
  C:\Windows\System\beehBBp.exe
  2⤵
  PID:11424
- C:\Windows\System\doxTHRh.exe
  C:\Windows\System\doxTHRh.exe
  2⤵
  PID:11500
- C:\Windows\System\gJJpJZo.exe
  C:\Windows\System\gJJpJZo.exe
  2⤵
  PID:11520
- C:\Windows\System\cSnjfSH.exe
  C:\Windows\System\cSnjfSH.exe
  2⤵
  PID:11556
- C:\Windows\System\igZPGBl.exe
  C:\Windows\System\igZPGBl.exe
  2⤵
  PID:11572
- C:\Windows\System\KWVsEGN.exe
  C:\Windows\System\KWVsEGN.exe
  2⤵
  PID:11592
- C:\Windows\System\DPlbEQY.exe
  C:\Windows\System\DPlbEQY.exe
  2⤵
  PID:11628
- C:\Windows\System\tVcSMud.exe
  C:\Windows\System\tVcSMud.exe
  2⤵
  PID:11664
- C:\Windows\System\eFZswIz.exe
  C:\Windows\System\eFZswIz.exe
  2⤵
  PID:11696
- C:\Windows\System\xzGiQAa.exe
  C:\Windows\System\xzGiQAa.exe
  2⤵
  PID:11720
- C:\Windows\System\eyuRMei.exe
  C:\Windows\System\eyuRMei.exe
  2⤵
  PID:11764
- C:\Windows\System\wyQzXRe.exe
  C:\Windows\System\wyQzXRe.exe
  2⤵
  PID:11784
- C:\Windows\System\WoSZfAL.exe
  C:\Windows\System\WoSZfAL.exe
  2⤵
  PID:11804
- C:\Windows\System\pmvYZMj.exe
  C:\Windows\System\pmvYZMj.exe
  2⤵
  PID:11848
- C:\Windows\System\kwrJyQT.exe
  C:\Windows\System\kwrJyQT.exe
  2⤵
  PID:11868
- C:\Windows\System\RdfJZpF.exe
  C:\Windows\System\RdfJZpF.exe
  2⤵
  PID:11900
- C:\Windows\System\jGpWHNO.exe
  C:\Windows\System\jGpWHNO.exe
  2⤵
  PID:11920
- C:\Windows\System\VRRzlPh.exe
  C:\Windows\System\VRRzlPh.exe
  2⤵
  PID:11952
- C:\Windows\System\vhkTjAg.exe
  C:\Windows\System\vhkTjAg.exe
  2⤵
  PID:11976
- C:\Windows\System\BQQHqon.exe
  C:\Windows\System\BQQHqon.exe
  2⤵
  PID:12004
- C:\Windows\System\rykunaH.exe
  C:\Windows\System\rykunaH.exe
  2⤵
  PID:12044
- C:\Windows\System\GCBUzqA.exe
  C:\Windows\System\GCBUzqA.exe
  2⤵
  PID:12064
- C:\Windows\System\XldzJxW.exe
  C:\Windows\System\XldzJxW.exe
  2⤵
  PID:12088
- C:\Windows\System\zjUDwbL.exe
  C:\Windows\System\zjUDwbL.exe
  2⤵
  PID:12112
- C:\Windows\System\MJSqGtZ.exe
  C:\Windows\System\MJSqGtZ.exe
  2⤵
  PID:12128
- C:\Windows\System\spdjSzl.exe
  C:\Windows\System\spdjSzl.exe
  2⤵
  PID:12172
- C:\Windows\System\XowjSqU.exe
  C:\Windows\System\XowjSqU.exe
  2⤵
  PID:12192
- C:\Windows\System\tjYFZRm.exe
  C:\Windows\System\tjYFZRm.exe
  2⤵
  PID:12236
- C:\Windows\System\Ekfvhww.exe
  C:\Windows\System\Ekfvhww.exe
  2⤵
  PID:12256
- C:\Windows\System\gyyAgmS.exe
  C:\Windows\System\gyyAgmS.exe
  2⤵
  PID:11060
- C:\Windows\System\mwwjNBz.exe
  C:\Windows\System\mwwjNBz.exe
  2⤵
  PID:11328
- C:\Windows\System\bKHtgfT.exe
  C:\Windows\System\bKHtgfT.exe
  2⤵
  PID:11380
- C:\Windows\System\RyvTdft.exe
  C:\Windows\System\RyvTdft.exe
  2⤵
  PID:11416
- C:\Windows\System\ywnJSUh.exe
  C:\Windows\System\ywnJSUh.exe
  2⤵
  PID:11488
- C:\Windows\System\ozPaKth.exe
  C:\Windows\System\ozPaKth.exe
  2⤵
  PID:11532
- C:\Windows\System\ujyUBxi.exe
  C:\Windows\System\ujyUBxi.exe
  2⤵
  PID:11564
- C:\Windows\System\GZgRSrq.exe
  C:\Windows\System\GZgRSrq.exe
  2⤵
  PID:2388
- C:\Windows\System\IdbRUif.exe
  C:\Windows\System\IdbRUif.exe
  2⤵
  PID:4004
- C:\Windows\System\FgPkrwW.exe
  C:\Windows\System\FgPkrwW.exe
  2⤵
  PID:3432
- C:\Windows\System\ekpsOaA.exe
  C:\Windows\System\ekpsOaA.exe
  2⤵
  PID:11740
- C:\Windows\System\ESHzwWR.exe
  C:\Windows\System\ESHzwWR.exe
  2⤵
  PID:11688
- C:\Windows\System\hhqBKtG.exe
  C:\Windows\System\hhqBKtG.exe
  2⤵
  PID:11800
- C:\Windows\System\gpXoNYt.exe
  C:\Windows\System\gpXoNYt.exe
  2⤵
  PID:11860
- C:\Windows\System\AgbvHvC.exe
  C:\Windows\System\AgbvHvC.exe
  2⤵
  PID:11892
- C:\Windows\System\vjqiNKc.exe
  C:\Windows\System\vjqiNKc.exe
  2⤵
  PID:11988
- C:\Windows\System\unORjYQ.exe
  C:\Windows\System\unORjYQ.exe
  2⤵
  PID:12020
- C:\Windows\System\YtqCSne.exe
  C:\Windows\System\YtqCSne.exe
  2⤵
  PID:12156
- C:\Windows\System\DknaVXW.exe
  C:\Windows\System\DknaVXW.exe
  2⤵
  PID:12228
- C:\Windows\System\QgZiWQX.exe
  C:\Windows\System\QgZiWQX.exe
  2⤵
  PID:12268
- C:\Windows\System\ZDzvPzL.exe
  C:\Windows\System\ZDzvPzL.exe
  2⤵
  PID:11356
- C:\Windows\System\DOSVrag.exe
  C:\Windows\System\DOSVrag.exe
  2⤵
  PID:11444
- C:\Windows\System\mcSgTBC.exe
  C:\Windows\System\mcSgTBC.exe
  2⤵
  PID:11208
- C:\Windows\System\EoufFQo.exe
  C:\Windows\System\EoufFQo.exe
  2⤵
  PID:224
- C:\Windows\System\uYAEyBk.exe
  C:\Windows\System\uYAEyBk.exe
  2⤵
  PID:4236
- C:\Windows\System\pBwAcan.exe
  C:\Windows\System\pBwAcan.exe
  2⤵
  PID:11832
- C:\Windows\System\rDumqsS.exe
  C:\Windows\System\rDumqsS.exe
  2⤵
  PID:11964
- C:\Windows\System\SZMWvex.exe
  C:\Windows\System\SZMWvex.exe
  2⤵
  PID:12080
- C:\Windows\System\TGQXjeu.exe
  C:\Windows\System\TGQXjeu.exe
  2⤵
  PID:12100
- C:\Windows\System\HXJVWzN.exe
  C:\Windows\System\HXJVWzN.exe
  2⤵
  PID:11296
- C:\Windows\System\KINuiCJ.exe
  C:\Windows\System\KINuiCJ.exe
  2⤵
  PID:11472
- C:\Windows\System\oNAUQeL.exe
  C:\Windows\System\oNAUQeL.exe
  2⤵
  PID:11708
- C:\Windows\System\CWGzjpw.exe
  C:\Windows\System\CWGzjpw.exe
  2⤵
  PID:11276
- C:\Windows\System\QyFTkKK.exe
  C:\Windows\System\QyFTkKK.exe
  2⤵
  PID:11540
- C:\Windows\System\BBdtaYc.exe
  C:\Windows\System\BBdtaYc.exe
  2⤵
  PID:11968
- C:\Windows\System\unnvJQE.exe
  C:\Windows\System\unnvJQE.exe
  2⤵
  PID:11776
- C:\Windows\System\tGqrfTI.exe
  C:\Windows\System\tGqrfTI.exe
  2⤵
  PID:12308
- C:\Windows\System\eVVkpXP.exe
  C:\Windows\System\eVVkpXP.exe
  2⤵
  PID:12340
- C:\Windows\System\bkDbyyD.exe
  C:\Windows\System\bkDbyyD.exe
  2⤵
  PID:12364
- C:\Windows\System\qEuzSmu.exe
  C:\Windows\System\qEuzSmu.exe
  2⤵
  PID:12408
- C:\Windows\System\FmRfMrl.exe
  C:\Windows\System\FmRfMrl.exe
  2⤵
  PID:12440
- C:\Windows\System\PFFAeic.exe
  C:\Windows\System\PFFAeic.exe
  2⤵
  PID:12460
- C:\Windows\System\GqGIQAH.exe
  C:\Windows\System\GqGIQAH.exe
  2⤵
  PID:12480
- C:\Windows\System\iXUSVrk.exe
  C:\Windows\System\iXUSVrk.exe
  2⤵
  PID:12532
- C:\Windows\System\awnUSVT.exe
  C:\Windows\System\awnUSVT.exe
  2⤵
  PID:12552
- C:\Windows\System\umcFKXk.exe
  C:\Windows\System\umcFKXk.exe
  2⤵
  PID:12580
- C:\Windows\System\PFdXeNy.exe
  C:\Windows\System\PFdXeNy.exe
  2⤵
  PID:12604
- C:\Windows\System\cqhYNKk.exe
  C:\Windows\System\cqhYNKk.exe
  2⤵
  PID:12624
- C:\Windows\System\odTBxht.exe
  C:\Windows\System\odTBxht.exe
  2⤵
  PID:12648
- C:\Windows\System\zVXEVUA.exe
  C:\Windows\System\zVXEVUA.exe
  2⤵
  PID:12684
- C:\Windows\System\JUUSgjc.exe
  C:\Windows\System\JUUSgjc.exe
  2⤵
  PID:12716
- C:\Windows\System\LlGrQQm.exe
  C:\Windows\System\LlGrQQm.exe
  2⤵
  PID:12744
- C:\Windows\System\Wwneext.exe
  C:\Windows\System\Wwneext.exe
  2⤵
  PID:12796
- C:\Windows\System\eRoTYkH.exe
  C:\Windows\System\eRoTYkH.exe
  2⤵
  PID:12816
- C:\Windows\System\MmrVRGi.exe
  C:\Windows\System\MmrVRGi.exe
  2⤵
  PID:12840
- C:\Windows\System\DNBiwcT.exe
  C:\Windows\System\DNBiwcT.exe
  2⤵
  PID:12868
- C:\Windows\System\BfgPnwr.exe
  C:\Windows\System\BfgPnwr.exe
  2⤵
  PID:12900
- C:\Windows\System\ayMeyhZ.exe
  C:\Windows\System\ayMeyhZ.exe
  2⤵
  PID:12932
- C:\Windows\System\icDIubv.exe
  C:\Windows\System\icDIubv.exe
  2⤵
  PID:12952
- C:\Windows\System\bNLsuBw.exe
  C:\Windows\System\bNLsuBw.exe
  2⤵
  PID:12992
- C:\Windows\System\OyNPUea.exe
  C:\Windows\System\OyNPUea.exe
  2⤵
  PID:13020
- C:\Windows\System\CqgaQbl.exe
  C:\Windows\System\CqgaQbl.exe
  2⤵
  PID:13040
- C:\Windows\System\Vnmslgi.exe
  C:\Windows\System\Vnmslgi.exe
  2⤵
  PID:13060
- C:\Windows\System\fmeYVYl.exe
  C:\Windows\System\fmeYVYl.exe
  2⤵
  PID:13088
- C:\Windows\System\SWHwTaK.exe
  C:\Windows\System\SWHwTaK.exe
  2⤵
  PID:13120
- C:\Windows\System\XOBLfeS.exe
  C:\Windows\System\XOBLfeS.exe
  2⤵
  PID:13140
- C:\Windows\System\OyeFrZs.exe
  C:\Windows\System\OyeFrZs.exe
  2⤵
  PID:13164
- C:\Windows\System\okOqukD.exe
  C:\Windows\System\okOqukD.exe
  2⤵
  PID:13184
- C:\Windows\System\tyvJiow.exe
  C:\Windows\System\tyvJiow.exe
  2⤵
  PID:13224
- C:\Windows\System\prEhGIm.exe
  C:\Windows\System\prEhGIm.exe
  2⤵
  PID:13268
- C:\Windows\System\jcnrDQv.exe
  C:\Windows\System\jcnrDQv.exe
  2⤵
  PID:13288
- C:\Windows\System\dNjkqwp.exe
  C:\Windows\System\dNjkqwp.exe
  2⤵
  PID:13304
- C:\Windows\System\jmvCVVX.exe
  C:\Windows\System\jmvCVVX.exe
  2⤵
  PID:12304
- C:\Windows\System\lGaPxvV.exe
  C:\Windows\System\lGaPxvV.exe
  2⤵
  PID:12396
- C:\Windows\System\XjXZTeO.exe
  C:\Windows\System\XjXZTeO.exe
  2⤵
  PID:12516
- C:\Windows\System\KimEsdD.exe
  C:\Windows\System\KimEsdD.exe
  2⤵
  PID:12548
- C:\Windows\System\sgbeqJc.exe
  C:\Windows\System\sgbeqJc.exe
  2⤵
  PID:12616
- C:\Windows\System\gPEqFrD.exe
  C:\Windows\System\gPEqFrD.exe
  2⤵
  PID:12644
- C:\Windows\System\bnPYHtN.exe
  C:\Windows\System\bnPYHtN.exe
  2⤵
  PID:12760
- C:\Windows\System\afwyRnU.exe
  C:\Windows\System\afwyRnU.exe
  2⤵
  PID:12812
- C:\Windows\System\KPeXAku.exe
  C:\Windows\System\KPeXAku.exe
  2⤵
  PID:13016
- C:\Windows\System\PchnqnT.exe
  C:\Windows\System\PchnqnT.exe
  2⤵
  PID:12968
- C:\Windows\System\rCBuoHG.exe
  C:\Windows\System\rCBuoHG.exe
  2⤵
  PID:13028
- C:\Windows\System\GCzCejp.exe
  C:\Windows\System\GCzCejp.exe
  2⤵
  PID:3184
- C:\Windows\System\AsMPGzq.exe
  C:\Windows\System\AsMPGzq.exe
  2⤵
  PID:13220
- C:\Windows\System\PdFmqsh.exe
  C:\Windows\System\PdFmqsh.exe
  2⤵
  PID:12476
- C:\Windows\System\iuMpxIs.exe
  C:\Windows\System\iuMpxIs.exe
  2⤵
  PID:12540
- C:\Windows\System\ewOmKJj.exe
  C:\Windows\System\ewOmKJj.exe
  2⤵
  PID:12512
- C:\Windows\System\AHLAeRU.exe
  C:\Windows\System\AHLAeRU.exe
  2⤵
  PID:12636
- C:\Windows\System\dYixPyx.exe
  C:\Windows\System\dYixPyx.exe
  2⤵
  PID:13284
- C:\Windows\System\ZflJpqD.exe
  C:\Windows\System\ZflJpqD.exe
  2⤵
  PID:12924
- C:\Windows\System\WgnsNTu.exe
  C:\Windows\System\WgnsNTu.exe
  2⤵
  PID:12788
- C:\Windows\System\EUCFbqq.exe
  C:\Windows\System\EUCFbqq.exe
  2⤵
  PID:12560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hxrhh2tk.jls.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AWPlgzL.exe

Filesize
2.3MB

MD5
35a73e3806b0210a6c0241c7904cf385

SHA1
be535516fea1c830fdc416b7bf255c6880ef689f

SHA256
7a9a67305267b853d5a8425e412d518b89ff5bcacefc30f54d761d62f56d3a8e

SHA512
ce148423a7f34545a4ca4d46467eb0529c031d339f9615157177816ceab94ec9e0e74a9c7d5fc142c260d9db02e2b950d41d299cd82b3f5d64e3f666a5b4d1ea

Download Submit
C:\Windows\System\BPpdZNh.exe

Filesize
2.3MB

MD5
c6781e1ee4ba84b3c843234b4e1a950e

SHA1
7e45e92c6beddba74ee9ca6522cc23188429d7ff

SHA256
d1b2537410bb346f818572263878cfc63c34ee9203c7457b28b2f77bf909b4c1

SHA512
e804dabe80f28ef6b8fce553dcd2609a4d84aaccc6ee8ef1cc1bfdd4e56034b3e0826718cde6790933022a8f89910de9d6270cd094bcb5145ced9d0336c80f59

Download Submit
C:\Windows\System\DDaeSoD.exe

Filesize
2.3MB

MD5
e4392aa88c1918c5f061388edfa57bb4

SHA1
eaa2e7dc98db51e9dde7e093007f464ab11cb47e

SHA256
fcc95569498bd6e5997dd1ebc9c983294eb935d0959407f0a85988d874f87a26

SHA512
7bf6a598421086127e915151302e18232d21e6ad42efcd6c2ffb652ad1a3c81ef6e6103ee647c54bcc9fc03f5ee571465692fe892c707e9961bf53f88b83ea3a

Download Submit
C:\Windows\System\DWVYdzD.exe

Filesize
2.3MB

MD5
8a3ed622995a77b625f91fe069a995d0

SHA1
85acae907c23d9bcb97e1b8e52eda40624a3fcfb

SHA256
a85673876ca57cf0884f0fa55ca9ea7e2ba7c6477eba9ea5d2b7075fd3a96f56

SHA512
7175eb75c4a8beca4ee6c2ce697d49642b1a8bda5d9f239edae9ed7e9546abcb8ac5d31d37f13b6c96f7e956e39b89af4ca5304f0d404453837d1b43d10811ec

Download Submit
C:\Windows\System\GIjXrPK.exe

Filesize
2.3MB

MD5
62d405fbc9762aed2cc694ac211d56c0

SHA1
61e312b8c08e4597726a07ef5f5cddd1cba5c2d3

SHA256
d259c8b066d19924d9514a7adddf25ac850b63d3672a2195db446da5e0cb6d14

SHA512
f625a073313d1552c18d8d480465a70c1d6d00560cd2c3e67556e839e3449faab34e9706c5cc4308a57209ac14e0c29e376b861d3604770e23f2aa0b6ab187a6

Download Submit
C:\Windows\System\GUxuMGI.exe

Filesize
2.3MB

MD5
7ba64ebb4823a4b7e1236f9d0b5a8bf2

SHA1
5ba9aac825f3ed3a215a3bddea2bfc68430388d9

SHA256
234d82387191016741c5a88bc66f4e1994f6deed61f4560febdc03adff22f61c

SHA512
55ebcccbd0555b48da7a91e9fbc176af5f15eaef87d7145fe93cbeb64aa8493c9519610a6cfa8397e630faca0ca4490908ac9d5c36abd07537703eadf2c24fbc

Download Submit
C:\Windows\System\GXoRxNt.exe

Filesize
2.3MB

MD5
fe88704b9c5e3cc247e32fd9a9b65b9b

SHA1
b14e97c7b0c3ca88be74ff5aea5c2420acad29ab

SHA256
4f6db605c4cb6cd3370af9bb0ac21c1030c6cf17095e364ad0fe5223b4b0e1a0

SHA512
cf4e44d8482aa93d1bd928326224c24a3b13c77858179ba831f856696fc3a1d124f5f1a09fba3dcdfeec4287224a878ce2399577f5f8aee51419f9bdd97245ce

Download Submit
C:\Windows\System\HFpSkue.exe

Filesize
2.3MB

MD5
d6d7abe4a2d176e005e21bcfbe00dd4d

SHA1
cf98d37951e3a63780bae7c6751cdb80c82acc66

SHA256
2b66bce671f4ba60ba8f1b91524ce7a7871aed4a7343a3407988dfb2f0da1fda

SHA512
6ed47de7671b38538392dd817711b10d8fe6d513bb8101ca22ca23b341affa738f35c4343f418efc665c858742f064ba9b02eb76a721951c4e013db165960f1b

Download Submit
C:\Windows\System\JQFxqTd.exe

Filesize
2.3MB

MD5
4b00595b32a52643aad1e12a54d0dd59

SHA1
e927b593b25a6b4b85929624872c5226a3bdd233

SHA256
b02cfe71ced27022404b256fff8816bd48961183bea0e97d402c749348faf48c

SHA512
53387932f428141773d4aa5e9b5a4215e4573ffd4eeaf1b53bde4c4657aa530d6aa5faf9c15258fad74ad4727b6f95943dc00ee73c106a5c0c4fb2e1d53df771

Download Submit
C:\Windows\System\KeNJeOI.exe

Filesize
2.3MB

MD5
a084619239cae6eb4b3b701595b5480b

SHA1
de4777a227c0236771ce3194cf8db8f07495c552

SHA256
512e92a34e706fd18305638c7360381ff0e6d7264fd2c60daca86ab212165bba

SHA512
2ed0cdf4f8bb7efbc8d48b41aed962cb1b7890ed0724ea01c2804c0fce413d98b1e4f3b7897cc466435920de368b1cf2ab9d11ad0fb0a6e2cbd418d6c03493dc

Download Submit
C:\Windows\System\MXZLQoh.exe

Filesize
2.3MB

MD5
dc861948a74ae2b66d42542a98199360

SHA1
a1858a836bf062d1877b0c9f6cbad1f5a354bdbb

SHA256
5103c7271cac802586fa7e06c665697e018a33ce422ab218fa0b2b7c294e5743

SHA512
c51990496050b867b15ad06f1eda9a0bf6db32c11862cb44cf5eb54152a70738e79c27848e3c32a2c1b14da2d48328a321734192b0f51ee7b4e9f8599a3fc63e

Download Submit
C:\Windows\System\RTyzDMk.exe

Filesize
2.3MB

MD5
81dc43ce163cac6e66a939530778314d

SHA1
e76da35a392442bd7230baea5ab2928f358c067f

SHA256
a162711e4e337f7352a85400a71c41d3e9476efd13142b3b192ea50e3fdea7e0

SHA512
5d604bac42420954bf5cc133e317c5483606f93786e22993dd471252023d51092bd1addfdd66b7c6fa0b04762b9c622b27c50870145e3005758b473f96353c9c

Download Submit
C:\Windows\System\SFmlUTD.exe

Filesize
2.3MB

MD5
c90541538b947572c7b144ee19a73bb4

SHA1
2889770c707bf4ea528258cb5c88de43752cc85f

SHA256
e23b5924bd13d97765a7409c8434bbd41d216a00bccca1148f1fbd79afb8e32b

SHA512
2df19a49bb87305fc05e403fc381ed727c4aacf00432053ef9f07aef8ac8c38ada1b42a0c002a88a507ec34076658810a846f912880fb33ec1497a9134fc22f3

Download Submit
C:\Windows\System\TKZxSbq.exe

Filesize
2.3MB

MD5
37f304007ea43654a4597f1a6d13bffe

SHA1
66e60ff0e83fe264673524abc3dd5e02a397e3c6

SHA256
7bc94032f0f1c9af4e2d27e2fa193b752b866b95928b378567fe469552fc3207

SHA512
dca459d065d94427a9d8e87f9a706adebee0ea597c253f6e6df006fe0c5768ec6eb20324832cb494c1c3a213fa1b6432510a2d3c5f593d4f7139d7654b3a4b2d

Download Submit
C:\Windows\System\UOfNoqo.exe

Filesize
2.3MB

MD5
708125b3efd911046d8da23eaa5c0bf7

SHA1
2514740d4bc97a1d262b81917e5e8274d66f3c4a

SHA256
dfe4a41fafc1b5fb9bf112351715d497765fdb958e1d0524d7a965256bf7368d

SHA512
6847cc19cdcf453c7209ff0c07edc04eed75b5fd1098586ddbe51e809d9d8a133772ab712b206842231b86a25e17d9b4dec80ab9499e131c0b700482ec30463a

Download Submit
C:\Windows\System\UPVjmYW.exe

Filesize
2.3MB

MD5
ec2a7a18435f9a6b326a2a3c2855e0b1

SHA1
756b21c2794b8e68399391987a1a204438c9377a

SHA256
4fb9863df29ca40b74b54b0c2c4612dd54603a739ba3c27997289faf03be0a86

SHA512
325030bfb8af89d8b60f83f280c16e0b690cc59e39be3e2cb94098046ba91f32b9a6f8c0923f5757b7636c9d7ba52604c60fc8e3f1dd08a03e62abcf18d75c01

Download Submit
C:\Windows\System\YBtHlJc.exe

Filesize
2.3MB

MD5
db992806d1b64ade9931e88bf9d70bab

SHA1
8e2f1eb16a2d1e11ec578657c4047eaa65659302

SHA256
4c9a2983cdfe173ac0a0b5ab4081726b5bb0928202c100d52ec1b6da46e1c982

SHA512
b13733a97070f5c05eeb292adebc0b7f236adfb082fe615e593a72b7e6ebd597a28ec8aca79cbbc4cccf39dc156f972d8f69e92b3d4debf924c6da4a9a63fdae

Download Submit
C:\Windows\System\dUEVdKH.exe

Filesize
2.3MB

MD5
ad59c8d0aad366c1dc9259e509d60fb2

SHA1
e143a803a616f70101d539dc7da442631fe07150

SHA256
4f2bd9db53e89b147965f896682d1a5718dea694b65152f7d67ad7e5c22e89e5

SHA512
c291c0d32fdb13e1859e26909c22baa4aa15280f33dee608c2fd386d20c025ad237bc7f02beadb3e69eaa445ebdd36d3adc17c3304ef4c6f54ac281652c2864c

Download Submit
C:\Windows\System\ekLIJCU.exe

Filesize
8B

MD5
92dce7fd7ec69f225baee909f1f20d27

SHA1
0fe748b20df273698767537e59de10e23a351a61

SHA256
3a8d52b801fd1c8bd120153342611f7386eb5ce0ad255d57304ec96ec9b31a84

SHA512
1e58e425b780ebf633a365e2d3edf8bb342f5bfe09e8d802b0d4dd60a53770b35758c32e598b9a4f78c23d6a0841ec0499f88be809f17838167d0c02b8f0c743

Download Submit
C:\Windows\System\fJOANME.exe

Filesize
2.3MB

MD5
321d9867e4912a534197bdc84c03c4de

SHA1
b1b7a3925fe78cb2a45be57e7f0c56a213afa0b7

SHA256
ec7585f534cae25d5e956d37a84f0e423eab12e97137fc263873f4feb1034cac

SHA512
f15c1da11bc815abb245969f9a0cd4a376b20d684c35da536ed4bf19deee7e968aead8127a35e785925cbb40deaeb87071b63982e2f26195130ca8b2dda579d7

Download Submit
C:\Windows\System\hBQblYO.exe

Filesize
2.3MB

MD5
231cb89d439a372a0623efea48bef7aa

SHA1
900012590468e2093a176161c91a0cd99503ef98

SHA256
286874fc0098634325531e4f35ba08d62f05b4d288e21c2ebfa0dfd0c018b162

SHA512
840e7878d848ac32aa02eaae86db945a95577e18752a5dc39d266df9347159ca0d12b2f7be9a3e44d745597a9cf41d4f0ac4da9ec40b0ccaf92e3cd5d25702e4

Download Submit
C:\Windows\System\iRjLwsg.exe

Filesize
2.3MB

MD5
febe8ff04e15ad69e8d0ffff300aeb3b

SHA1
ea70a7cc7c662a423f0197f3e86e39eb4710ed94

SHA256
62eb78ffcdac2c8b2bbc8cec83c0eb906900fa0476c45d9f2be81d468a275096

SHA512
de4271f40dd522f073c44aa38bc2e47b2a880d3d640fb87aa483328335f7296327e99d10d15fd6c2d7db3641cae85ee8828ed246e4d92d37f3f611bdb154d311

Download Submit
C:\Windows\System\iyjyWfS.exe

Filesize
2.3MB

MD5
d8fe07c523c18b72bbcb7ab33a2a2451

SHA1
1ce9f726d368b1aed07f7596eda05e666b92a1a0

SHA256
2cc5702ce70290f372a36e260d9f27e72760544606c111614b1f5383fb921d07

SHA512
8913ef204850b441c18d5c1c38c34c65b1a4da2612a420410562ada9c1f14aaf1717c26338a737a954abc697a0e8f7a0b8c625dfdbdaf869a83791430e02ba59

Download Submit
C:\Windows\System\lFJAfyl.exe

Filesize
2.3MB

MD5
5fcc9b933f56364c795c2a3073cf255b

SHA1
f423e850e20cc993a70cffd35b93f140d1f088ff

SHA256
7cbc90f4d4292e7b04dc799e83e4179b64284c1157baf43948f8c4f5482f1add

SHA512
26c4629ca0f152f107d6e5731ea8517c3b6b83cae4b08db5b96a0395774239ade2fd46270255092a8493accd0c4d5c9051eec1f06abf307b0ae0b3d097957651

Download Submit
C:\Windows\System\pGCaKhV.exe

Filesize
2.3MB

MD5
32fd41e3258621b6ebf65484bf8b40f5

SHA1
58bd575e25a63ee5c5ffa147978eeb17ec62d6cb

SHA256
2443ea3d0151995c4536d7e5aee1a362256f646521417328f8c624b8b3a959c0

SHA512
c211f53fd718923e9a1bef1d50b0a49c40a7c811f8172c24db65b44490f8d3bdc5caff29cf6640c5fd7108f7281d6c21913aa2235ef1886a4e6281b5b09463b1

Download Submit
C:\Windows\System\prfWXsp.exe

Filesize
2.3MB

MD5
f5e45c7e93b37b6c68c5155a074d2685

SHA1
3c96cbfc7350307140bea01b6141a8ff45f9a3a4

SHA256
682726b3a60fa2c927db3b7efac8961d9d172be88676555dec18e89f6dcd3ec9

SHA512
c7342d4fcf57722c59e2ed6ed95ab3a610cf2f87a03c672b571af7897c7daf7a7b183317a827511bd0b86ab36ada6ebc11248eda677ecb2403245efe054eb095

Download Submit
C:\Windows\System\rbIXzof.exe

Filesize
2.3MB

MD5
37d1c2bc8353a8999fcf79e3e068192e

SHA1
d7c46dd3012274ecf9e2f228f201e74f52481147

SHA256
92c94dbd8b0b2749fc145abce6e00ffaebd037e9d992555825802cd77f2750b6

SHA512
c00953f4849e5f38cc6b0a5f30e249939ab71a279617cfa5308dd28577d1e530e14ea9f35ee6712f1a95949a21655e5370842e273e9c5c563b5e6df29e632aaf

Download Submit
C:\Windows\System\rdxvFpy.exe

Filesize
2.3MB

MD5
700b6606041753ca74b9aa65ceb57375

SHA1
c3cb6de1eea7b7b4d59fce6db62c36606555649e

SHA256
076e304f08db854188aa76db55b2eb71493d290b14639fb18db3c3cd15c3f077

SHA512
03a9ee82ec3bba3ff2e63499a923c1659150d708ff7ac292e9fa6f227892ed16d5a7a2ea577ce271621205b3b8010db4b74c5689f3f29487b6627533fd334486

Download Submit
C:\Windows\System\sEkyfPZ.exe

Filesize
2.3MB

MD5
b9191d520fd0d7f52e16201797f52356

SHA1
3025b6089eda2e73d37d1b248300ac76e4fb9a09

SHA256
7da1126a14bb0a01a2870d4161a247a7ab0303e1363aca43bf84ee8b58469dd7

SHA512
413f1a56c4ac88de3cbe7c0e5f37686ec8ac04f50d372aa0fa1c59aa896b8ac9658dafe4c5690bd9067b487de920654b96bb753aedf84d7fc78062b10d4b89cf

Download Submit
C:\Windows\System\tOkmeAs.exe

Filesize
2.3MB

MD5
4ec3fa3095cb77bcf68b4ca48bcaad20

SHA1
5aa013c0ee0939cf41b0e96ad71445abb1a95fd9

SHA256
5e2c832d419ace8b67628618184aed8b35185023c4016ed2e750d16753bc57c2

SHA512
10a587320dbd14d2ec51acaa0e45f78d2b8bfa05996ed730b45a5020a495da14af8bfa4eb433568d41377de285a88d899fd1d23ebbc6976c4949844e0effc0d0

Download Submit
C:\Windows\System\uUvdPeF.exe

Filesize
2.3MB

MD5
68762eeb082a801683a35055ad7721d4

SHA1
c4dcaff861e5e37568ccbaa3bc94ab93af9272f2

SHA256
673c3c46269c91b038d18688591e9af6be8a0ce4d351613fabce72beaf066831

SHA512
df990d51009b673e8f451f551ca562f13dd0edb454b3b1ca9f28782d9255a281fe6d005ad8498b12e5cb1418ded2117f088400c703bda84f539928c4e213d90f

Download Submit
C:\Windows\System\vBrVnPc.exe

Filesize
2.3MB

MD5
3141f430dc0b9256326d2c76b2421a47

SHA1
700db89c2de563ebec5c3d8d765ad372d9e76186

SHA256
fd062c678957d31077cdd6d78c1610c20f6f9992ed4caf2287d56c949ddf733a

SHA512
066b54f8fcc1da4cacf70d5cf02afbe99cdba1a6531e83af5134e167dd773695022f07cee1e41fd6b5a4b619bef58f2e496c5035a23429f1c4128866c68d55d4

Download Submit
C:\Windows\System\xwZSUrD.exe

Filesize
2.3MB

MD5
025ebfcb55ad2ce1018a7877fcd56a20

SHA1
e871c4523fbb069d8c034296d7d9cf4f752257ce

SHA256
48b85d542aa019da29811a58e5e4234be8546a5b155863eaa215e9859b432de7

SHA512
9b3b100a8f15d53b7ea66dcad05897b60326574c4555d4966bd136ee079f91a2b8fd64265b1bb4e3a2bf3988dadb1f1d33093d8f2881f00bf4018b8969bf2f24

Download Submit
C:\Windows\System\zPTptnV.exe

Filesize
2.3MB

MD5
ac208e8646fccdad5febe4ca045b6234

SHA1
d7644723316f7366fc181bf6eeb08dc3345d9f06

SHA256
594773a2a4d260198f153c405b28f16457a1a6cde071f75f049c338572dd980e

SHA512
9a66a559518f80b86838768d45b55ba09d4f0e4edd45988a29c755e6d1c101c794c65dc404d5bff3df5172fa9d71b7085ff676a8b15f2992d53592a83a9bd537

Download Submit
memory/536-83-0x00007FF741040000-0x00007FF741432000-memory.dmp

Filesize
3.9MB

Download
memory/948-3782-0x00007FF777330000-0x00007FF777722000-memory.dmp

Filesize
3.9MB

Download
memory/948-136-0x00007FF777330000-0x00007FF777722000-memory.dmp

Filesize
3.9MB

Download
memory/1552-32-0x00007FF6E3700000-0x00007FF6E3AF2000-memory.dmp

Filesize
3.9MB

Download
memory/1708-149-0x00007FF7B20E0000-0x00007FF7B24D2000-memory.dmp

Filesize
3.9MB

Download
memory/2024-107-0x00007FF7753D0000-0x00007FF7757C2000-memory.dmp

Filesize
3.9MB

Download
memory/2152-47-0x00007FF7CCA80000-0x00007FF7CCE72000-memory.dmp

Filesize
3.9MB

Download
memory/2268-2477-0x00007FF605B00000-0x00007FF605EF2000-memory.dmp

Filesize
3.9MB

Download
memory/2268-57-0x00007FF605B00000-0x00007FF605EF2000-memory.dmp

Filesize
3.9MB

Download
memory/2288-102-0x00007FF61C900000-0x00007FF61CCF2000-memory.dmp

Filesize
3.9MB

Download
memory/2376-106-0x00007FF79CEC0000-0x00007FF79D2B2000-memory.dmp

Filesize
3.9MB

Download
memory/2376-3341-0x00007FF79CEC0000-0x00007FF79D2B2000-memory.dmp

Filesize
3.9MB

Download
memory/2780-40-0x00007FF6DE030000-0x00007FF6DE422000-memory.dmp

Filesize
3.9MB

Download
memory/2900-103-0x00007FF7426C0000-0x00007FF742AB2000-memory.dmp

Filesize
3.9MB

Download
memory/3068-100-0x00007FF7EB4C0000-0x00007FF7EB8B2000-memory.dmp

Filesize
3.9MB

Download
memory/3416-109-0x00007FF78EF40000-0x00007FF78F332000-memory.dmp

Filesize
3.9MB

Download
memory/3416-3780-0x00007FF78EF40000-0x00007FF78F332000-memory.dmp

Filesize
3.9MB

Download
memory/3532-121-0x00007FF661C70000-0x00007FF662062000-memory.dmp

Filesize
3.9MB

Download
memory/3648-77-0x00007FF6DF010000-0x00007FF6DF402000-memory.dmp

Filesize
3.9MB

Download
memory/3772-0-0x00007FF61C4E0000-0x00007FF61C8D2000-memory.dmp

Filesize
3.9MB

Download
memory/3772-1-0x000001C7F6340000-0x000001C7F6350000-memory.dmp

Filesize
64KB

Download
memory/3856-145-0x00007FF74E2D0000-0x00007FF74E6C2000-memory.dmp

Filesize
3.9MB

Download
memory/3976-90-0x00007FF7780F0000-0x00007FF7784E2000-memory.dmp

Filesize
3.9MB

Download
memory/4084-84-0x00007FF75C290000-0x00007FF75C682000-memory.dmp

Filesize
3.9MB

Download
memory/4372-66-0x000002EAFDA10000-0x000002EAFDA32000-memory.dmp

Filesize
136KB

Download
memory/4372-1634-0x00007FFA894D0000-0x00007FFA89F91000-memory.dmp

Filesize
10.8MB

Download
memory/4372-24-0x00007FFA894D0000-0x00007FFA89F91000-memory.dmp

Filesize
10.8MB

Download
memory/4372-25-0x000002EAFDA90000-0x000002EAFDAA0000-memory.dmp

Filesize
64KB

Download
memory/4372-26-0x000002EAFDA90000-0x000002EAFDAA0000-memory.dmp

Filesize
64KB

Download
memory/4892-130-0x00007FF7EC480000-0x00007FF7EC872000-memory.dmp

Filesize
3.9MB

Download
memory/5024-108-0x00007FF6A7990000-0x00007FF6A7D82000-memory.dmp

Filesize
3.9MB

Download
memory/5060-96-0x00007FF6FF8D0000-0x00007FF6FFCC2000-memory.dmp

Filesize
3.9MB

Download