xmrig | aa4580cb70460325397704e4af30a2cec8f9e10af3b80dde7dcda003c34b7220

Analysis

max time kernel
82s
max time network
59s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 06:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
Size

1.9MB
MD5

06fdd98f6381d55cd6abebab21d180f2
SHA1

7dc4b51ff5a62b1fa55c1afcfaff66d55bbceeb2
SHA256

aa4580cb70460325397704e4af30a2cec8f9e10af3b80dde7dcda003c34b7220
SHA512

5b8df6d3c18d5893a1a4de97e313258c992f8b17d1e7c52417f2bcd34cc03f2d0731985c2a74ea4ab99fb011b648772f01092f272670017f01c24d2fe9edc6a9
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+Us:NABv

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 42 IoCs

miner

resource	yara_rule
behavioral2/memory/752-11-0x00007FF645100000-0x00007FF6454F2000-memory.dmp	xmrig
behavioral2/memory/4472-38-0x00007FF790FD0000-0x00007FF7913C2000-memory.dmp	xmrig
behavioral2/memory/2152-57-0x00007FF733D60000-0x00007FF734152000-memory.dmp	xmrig
behavioral2/memory/4056-478-0x00007FF7ADB70000-0x00007FF7ADF62000-memory.dmp	xmrig
behavioral2/memory/2120-479-0x00007FF67B9C0000-0x00007FF67BDB2000-memory.dmp	xmrig
behavioral2/memory/400-480-0x00007FF667740000-0x00007FF667B32000-memory.dmp	xmrig
behavioral2/memory/3320-482-0x00007FF777600000-0x00007FF7779F2000-memory.dmp	xmrig
behavioral2/memory/4844-481-0x00007FF7DDBA0000-0x00007FF7DDF92000-memory.dmp	xmrig
behavioral2/memory/4692-485-0x00007FF6F2BB0000-0x00007FF6F2FA2000-memory.dmp	xmrig
behavioral2/memory/4460-498-0x00007FF7E62A0000-0x00007FF7E6692000-memory.dmp	xmrig
behavioral2/memory/4404-494-0x00007FF7FBE60000-0x00007FF7FC252000-memory.dmp	xmrig
behavioral2/memory/2548-491-0x00007FF692070000-0x00007FF692462000-memory.dmp	xmrig
behavioral2/memory/5116-501-0x00007FF773C50000-0x00007FF774042000-memory.dmp	xmrig
behavioral2/memory/856-507-0x00007FF75AC10000-0x00007FF75B002000-memory.dmp	xmrig
behavioral2/memory/3216-532-0x00007FF689B00000-0x00007FF689EF2000-memory.dmp	xmrig
behavioral2/memory/968-535-0x00007FF6CC510000-0x00007FF6CC902000-memory.dmp	xmrig
behavioral2/memory/3476-529-0x00007FF69D8F0000-0x00007FF69DCE2000-memory.dmp	xmrig
behavioral2/memory/5012-513-0x00007FF7EB3D0000-0x00007FF7EB7C2000-memory.dmp	xmrig
behavioral2/memory/4748-510-0x00007FF7A80F0000-0x00007FF7A84E2000-memory.dmp	xmrig
behavioral2/memory/4012-540-0x00007FF6EA160000-0x00007FF6EA552000-memory.dmp	xmrig
behavioral2/memory/3492-2343-0x00007FF634AF0000-0x00007FF634EE2000-memory.dmp	xmrig
behavioral2/memory/752-2345-0x00007FF645100000-0x00007FF6454F2000-memory.dmp	xmrig
behavioral2/memory/4472-2347-0x00007FF790FD0000-0x00007FF7913C2000-memory.dmp	xmrig
behavioral2/memory/2152-2349-0x00007FF733D60000-0x00007FF734152000-memory.dmp	xmrig
behavioral2/memory/4056-2353-0x00007FF7ADB70000-0x00007FF7ADF62000-memory.dmp	xmrig
behavioral2/memory/3492-2352-0x00007FF634AF0000-0x00007FF634EE2000-memory.dmp	xmrig
behavioral2/memory/968-2355-0x00007FF6CC510000-0x00007FF6CC902000-memory.dmp	xmrig
behavioral2/memory/2548-2367-0x00007FF692070000-0x00007FF692462000-memory.dmp	xmrig
behavioral2/memory/400-2360-0x00007FF667740000-0x00007FF667B32000-memory.dmp	xmrig
behavioral2/memory/4460-2373-0x00007FF7E62A0000-0x00007FF7E6692000-memory.dmp	xmrig
behavioral2/memory/5116-2375-0x00007FF773C50000-0x00007FF774042000-memory.dmp	xmrig
behavioral2/memory/856-2377-0x00007FF75AC10000-0x00007FF75B002000-memory.dmp	xmrig
behavioral2/memory/4404-2372-0x00007FF7FBE60000-0x00007FF7FC252000-memory.dmp	xmrig
behavioral2/memory/4692-2366-0x00007FF6F2BB0000-0x00007FF6F2FA2000-memory.dmp	xmrig
behavioral2/memory/4012-2364-0x00007FF6EA160000-0x00007FF6EA552000-memory.dmp	xmrig
behavioral2/memory/2120-2362-0x00007FF67B9C0000-0x00007FF67BDB2000-memory.dmp	xmrig
behavioral2/memory/4844-2358-0x00007FF7DDBA0000-0x00007FF7DDF92000-memory.dmp	xmrig
behavioral2/memory/3320-2369-0x00007FF777600000-0x00007FF7779F2000-memory.dmp	xmrig
behavioral2/memory/3476-2399-0x00007FF69D8F0000-0x00007FF69DCE2000-memory.dmp	xmrig
behavioral2/memory/5012-2400-0x00007FF7EB3D0000-0x00007FF7EB7C2000-memory.dmp	xmrig
behavioral2/memory/4748-2381-0x00007FF7A80F0000-0x00007FF7A84E2000-memory.dmp	xmrig
behavioral2/memory/3216-2380-0x00007FF689B00000-0x00007FF689EF2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
752	PZClkHr.exe
4472	oiavWIT.exe
2152	AybTkYb.exe
3492	axuCLoa.exe
968	poKvJPs.exe
4056	jNkWWVy.exe
4012	DsDKLfv.exe
2120	qnUJSnq.exe
400	eJORyAY.exe
4844	gffgJtV.exe
3320	vHpkrdI.exe
4692	xBVtbFR.exe
2548	iXRHaki.exe
4404	HVOnXQP.exe
4460	Gjocajg.exe
5116	IjLgpjE.exe
856	IcGQvIF.exe
4748	OCJoOTd.exe
5012	fKQHdZx.exe
3476	dNYnCbo.exe
3216	dndpnoE.exe
548	HRhSJVY.exe
1592	DVUbQle.exe
4448	xZlRySq.exe
2144	nQAyWth.exe
1584	MrlBkYh.exe
1436	LPXFCjQ.exe
2460	aUUbnoN.exe
4700	CCoDAnL.exe
4264	ncTWgHL.exe
3588	LjHcWUK.exe
4696	dNFNDgN.exe
2948	XEWckKU.exe
1428	XUZwvag.exe
1996	pLiioBo.exe
4276	eHwdPEz.exe
264	amyXIFm.exe
116	QdJjWnP.exe
1948	SxLBaXt.exe
4360	QYjOkXK.exe
4356	ELlkLBd.exe
1856	BLCoTIn.exe
3036	ORnkDyX.exe
2812	MgjQqRK.exe
3524	GzqORxD.exe
4868	crMiHyl.exe
3316	UNXNLWk.exe
1276	dNTqAND.exe
4488	OnLmsvH.exe
4832	ahJPCCP.exe
3256	qJtiBgW.exe
3968	ZgYCtyY.exe
2036	RZpHuQa.exe
2684	XcrzLYW.exe
1348	nitqOPr.exe
1400	czSlfET.exe
2284	MAxaoMI.exe
992	eunCKja.exe
1396	wUcSalO.exe
4344	BpLMAQY.exe
2300	cnHomru.exe
3236	VXxSvDx.exe
3096	JwkVtAI.exe
4864	RwVCeTI.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5108-0-0x00007FF6AEEA0000-0x00007FF6AF292000-memory.dmp	upx
behavioral2/files/0x000a000000023ba5-10.dat	upx
behavioral2/memory/752-11-0x00007FF645100000-0x00007FF6454F2000-memory.dmp	upx
behavioral2/files/0x000e000000023b99-6.dat	upx
behavioral2/files/0x000a000000023ba6-8.dat	upx
behavioral2/files/0x000a000000023ba7-30.dat	upx
behavioral2/memory/4472-38-0x00007FF790FD0000-0x00007FF7913C2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba8-41.dat	upx
behavioral2/files/0x000a000000023bab-64.dat	upx
behavioral2/files/0x000a000000023baf-68.dat	upx
behavioral2/files/0x000a000000023bac-66.dat	upx
behavioral2/files/0x000a000000023bb0-73.dat	upx
behavioral2/files/0x000a000000023bb1-91.dat	upx
behavioral2/files/0x000a000000023bbd-151.dat	upx
behavioral2/files/0x000a000000023bc1-173.dat	upx
behavioral2/files/0x000a000000023bc4-180.dat	upx
behavioral2/files/0x000a000000023bc2-178.dat	upx
behavioral2/files/0x000a000000023bc3-175.dat	upx
behavioral2/files/0x000a000000023bc0-168.dat	upx
behavioral2/files/0x000a000000023bbf-163.dat	upx
behavioral2/files/0x000a000000023bbe-158.dat	upx
behavioral2/files/0x000a000000023bbc-146.dat	upx
behavioral2/files/0x000a000000023bbb-140.dat	upx
behavioral2/files/0x000a000000023bba-136.dat	upx
behavioral2/files/0x000a000000023bb9-131.dat	upx
behavioral2/files/0x000a000000023bb8-126.dat	upx
behavioral2/files/0x0031000000023bb7-121.dat	upx
behavioral2/files/0x0031000000023bb6-116.dat	upx
behavioral2/files/0x0031000000023bb5-111.dat	upx
behavioral2/files/0x000a000000023bb4-106.dat	upx
behavioral2/files/0x000a000000023bb3-101.dat	upx
behavioral2/files/0x000a000000023bb2-96.dat	upx
behavioral2/files/0x000b000000023bae-85.dat	upx
behavioral2/files/0x000b000000023bad-81.dat	upx
behavioral2/files/0x000a000000023baa-62.dat	upx
behavioral2/memory/2152-57-0x00007FF733D60000-0x00007FF734152000-memory.dmp	upx
behavioral2/files/0x000a000000023ba9-33.dat	upx
behavioral2/memory/3492-29-0x00007FF634AF0000-0x00007FF634EE2000-memory.dmp	upx
behavioral2/memory/4056-478-0x00007FF7ADB70000-0x00007FF7ADF62000-memory.dmp	upx
behavioral2/memory/2120-479-0x00007FF67B9C0000-0x00007FF67BDB2000-memory.dmp	upx
behavioral2/memory/400-480-0x00007FF667740000-0x00007FF667B32000-memory.dmp	upx
behavioral2/memory/3320-482-0x00007FF777600000-0x00007FF7779F2000-memory.dmp	upx
behavioral2/memory/4844-481-0x00007FF7DDBA0000-0x00007FF7DDF92000-memory.dmp	upx
behavioral2/memory/4692-485-0x00007FF6F2BB0000-0x00007FF6F2FA2000-memory.dmp	upx
behavioral2/memory/4460-498-0x00007FF7E62A0000-0x00007FF7E6692000-memory.dmp	upx
behavioral2/memory/4404-494-0x00007FF7FBE60000-0x00007FF7FC252000-memory.dmp	upx
behavioral2/memory/2548-491-0x00007FF692070000-0x00007FF692462000-memory.dmp	upx
behavioral2/memory/5116-501-0x00007FF773C50000-0x00007FF774042000-memory.dmp	upx
behavioral2/memory/856-507-0x00007FF75AC10000-0x00007FF75B002000-memory.dmp	upx
behavioral2/memory/3216-532-0x00007FF689B00000-0x00007FF689EF2000-memory.dmp	upx
behavioral2/memory/968-535-0x00007FF6CC510000-0x00007FF6CC902000-memory.dmp	upx
behavioral2/memory/3476-529-0x00007FF69D8F0000-0x00007FF69DCE2000-memory.dmp	upx
behavioral2/memory/5012-513-0x00007FF7EB3D0000-0x00007FF7EB7C2000-memory.dmp	upx
behavioral2/memory/4748-510-0x00007FF7A80F0000-0x00007FF7A84E2000-memory.dmp	upx
behavioral2/memory/4012-540-0x00007FF6EA160000-0x00007FF6EA552000-memory.dmp	upx
behavioral2/memory/3492-2343-0x00007FF634AF0000-0x00007FF634EE2000-memory.dmp	upx
behavioral2/memory/752-2345-0x00007FF645100000-0x00007FF6454F2000-memory.dmp	upx
behavioral2/memory/4472-2347-0x00007FF790FD0000-0x00007FF7913C2000-memory.dmp	upx
behavioral2/memory/2152-2349-0x00007FF733D60000-0x00007FF734152000-memory.dmp	upx
behavioral2/memory/4056-2353-0x00007FF7ADB70000-0x00007FF7ADF62000-memory.dmp	upx
behavioral2/memory/3492-2352-0x00007FF634AF0000-0x00007FF634EE2000-memory.dmp	upx
behavioral2/memory/968-2355-0x00007FF6CC510000-0x00007FF6CC902000-memory.dmp	upx
behavioral2/memory/2548-2367-0x00007FF692070000-0x00007FF692462000-memory.dmp	upx
behavioral2/memory/400-2360-0x00007FF667740000-0x00007FF667B32000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\YAcZGhe.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\pLiioBo.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\AVKzghE.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\FPHaVAd.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\PdUmcJu.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\wKGAwsE.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\LyMESWe.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\KazEDLq.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\BuCJIjr.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\AybTkYb.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\PMJrFWT.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\rOmkvcx.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\dqmNzoz.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\XpMpxSI.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\oogtLSG.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\BStZTlu.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\eunCKja.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\gSxlTJm.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\BdEAtBu.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\gbtLWep.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\VXxSvDx.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\upkrSwD.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\rVhdGkS.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\ORtZPuw.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\FuGfUpx.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\bRnmxBz.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\maFNcGc.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\AExMNoP.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\YlciVEG.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\jBCQZkp.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\ItGJfjM.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\dKBGOeB.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\hMnMyDM.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\GtQpdgq.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\KvlZYZf.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\LlEWEdW.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\IYryXqg.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\JzoBYOg.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\BaxUovd.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\nCongNh.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\SYxlnzX.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\dxGKlNU.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\SxtdbJg.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\esonPbi.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\Gjocajg.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\DGaqPPV.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\lgQYqcF.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\DPjZDIo.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\TuzxOtb.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\sAyIiWT.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\RYKSArA.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\tWjTMjA.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\nCIrlGC.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\AyrRIar.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\ZaOvtHg.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\atRWhcP.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\OnLmsvH.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\acCgIJC.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\RuVqWBC.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\LdpBdFQ.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\AffwRce.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\ouDqzXB.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\VVCIaUY.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
File created	C:\Windows\System\sQKWdmj.exe	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2156	powershell.exe
2156	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2156	powershell.exe
Token: SeLockMemoryPrivilege	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 2156	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	86
PID 5108 wrote to memory of 2156	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	86
PID 5108 wrote to memory of 752	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	87
PID 5108 wrote to memory of 752	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	87
PID 5108 wrote to memory of 4472	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	88
PID 5108 wrote to memory of 4472	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	88
PID 5108 wrote to memory of 2152	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	89
PID 5108 wrote to memory of 2152	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	89
PID 5108 wrote to memory of 3492	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	90
PID 5108 wrote to memory of 3492	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	90
PID 5108 wrote to memory of 968	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	91
PID 5108 wrote to memory of 968	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	91
PID 5108 wrote to memory of 4056	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	92
PID 5108 wrote to memory of 4056	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	92
PID 5108 wrote to memory of 4012	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	93
PID 5108 wrote to memory of 4012	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	93
PID 5108 wrote to memory of 2120	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	94
PID 5108 wrote to memory of 2120	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	94
PID 5108 wrote to memory of 400	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	95
PID 5108 wrote to memory of 400	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	95
PID 5108 wrote to memory of 4844	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	96
PID 5108 wrote to memory of 4844	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	96
PID 5108 wrote to memory of 3320	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	97
PID 5108 wrote to memory of 3320	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	97
PID 5108 wrote to memory of 4692	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	98
PID 5108 wrote to memory of 4692	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	98
PID 5108 wrote to memory of 2548	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	99
PID 5108 wrote to memory of 2548	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	99
PID 5108 wrote to memory of 4404	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	100
PID 5108 wrote to memory of 4404	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	100
PID 5108 wrote to memory of 4460	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	101
PID 5108 wrote to memory of 4460	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	101
PID 5108 wrote to memory of 5116	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	102
PID 5108 wrote to memory of 5116	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	102
PID 5108 wrote to memory of 856	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	103
PID 5108 wrote to memory of 856	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	103
PID 5108 wrote to memory of 4748	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	104
PID 5108 wrote to memory of 4748	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	104
PID 5108 wrote to memory of 5012	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	105
PID 5108 wrote to memory of 5012	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	105
PID 5108 wrote to memory of 3476	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	106
PID 5108 wrote to memory of 3476	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	106
PID 5108 wrote to memory of 3216	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	107
PID 5108 wrote to memory of 3216	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	107
PID 5108 wrote to memory of 548	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	108
PID 5108 wrote to memory of 548	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	108
PID 5108 wrote to memory of 1592	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	109
PID 5108 wrote to memory of 1592	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	109
PID 5108 wrote to memory of 4448	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	110
PID 5108 wrote to memory of 4448	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	110
PID 5108 wrote to memory of 2144	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	111
PID 5108 wrote to memory of 2144	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	111
PID 5108 wrote to memory of 1584	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	112
PID 5108 wrote to memory of 1584	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	112
PID 5108 wrote to memory of 1436	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	113
PID 5108 wrote to memory of 1436	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	113
PID 5108 wrote to memory of 2460	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	114
PID 5108 wrote to memory of 2460	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	114
PID 5108 wrote to memory of 4700	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	115
PID 5108 wrote to memory of 4700	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	115
PID 5108 wrote to memory of 4264	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	116
PID 5108 wrote to memory of 4264	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	116
PID 5108 wrote to memory of 3588	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	117
PID 5108 wrote to memory of 3588	5108	06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe	117

C:\Users\Admin\AppData\Local\Temp\06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\06fdd98f6381d55cd6abebab21d180f2_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2156
- C:\Windows\System\PZClkHr.exe
  C:\Windows\System\PZClkHr.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\oiavWIT.exe
  C:\Windows\System\oiavWIT.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\AybTkYb.exe
  C:\Windows\System\AybTkYb.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\axuCLoa.exe
  C:\Windows\System\axuCLoa.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\poKvJPs.exe
  C:\Windows\System\poKvJPs.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\jNkWWVy.exe
  C:\Windows\System\jNkWWVy.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\DsDKLfv.exe
  C:\Windows\System\DsDKLfv.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\qnUJSnq.exe
  C:\Windows\System\qnUJSnq.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\eJORyAY.exe
  C:\Windows\System\eJORyAY.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\gffgJtV.exe
  C:\Windows\System\gffgJtV.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\vHpkrdI.exe
  C:\Windows\System\vHpkrdI.exe
  2⤵
  - Executes dropped EXE
  PID:3320
- C:\Windows\System\xBVtbFR.exe
  C:\Windows\System\xBVtbFR.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\iXRHaki.exe
  C:\Windows\System\iXRHaki.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\HVOnXQP.exe
  C:\Windows\System\HVOnXQP.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\Gjocajg.exe
  C:\Windows\System\Gjocajg.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\IjLgpjE.exe
  C:\Windows\System\IjLgpjE.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\IcGQvIF.exe
  C:\Windows\System\IcGQvIF.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\OCJoOTd.exe
  C:\Windows\System\OCJoOTd.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\fKQHdZx.exe
  C:\Windows\System\fKQHdZx.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\dNYnCbo.exe
  C:\Windows\System\dNYnCbo.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\dndpnoE.exe
  C:\Windows\System\dndpnoE.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\HRhSJVY.exe
  C:\Windows\System\HRhSJVY.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\DVUbQle.exe
  C:\Windows\System\DVUbQle.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\xZlRySq.exe
  C:\Windows\System\xZlRySq.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\nQAyWth.exe
  C:\Windows\System\nQAyWth.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\MrlBkYh.exe
  C:\Windows\System\MrlBkYh.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\LPXFCjQ.exe
  C:\Windows\System\LPXFCjQ.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\aUUbnoN.exe
  C:\Windows\System\aUUbnoN.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\CCoDAnL.exe
  C:\Windows\System\CCoDAnL.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\ncTWgHL.exe
  C:\Windows\System\ncTWgHL.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\LjHcWUK.exe
  C:\Windows\System\LjHcWUK.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\dNFNDgN.exe
  C:\Windows\System\dNFNDgN.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\XEWckKU.exe
  C:\Windows\System\XEWckKU.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\XUZwvag.exe
  C:\Windows\System\XUZwvag.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\pLiioBo.exe
  C:\Windows\System\pLiioBo.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\eHwdPEz.exe
  C:\Windows\System\eHwdPEz.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\amyXIFm.exe
  C:\Windows\System\amyXIFm.exe
  2⤵
  - Executes dropped EXE
  PID:264
- C:\Windows\System\QdJjWnP.exe
  C:\Windows\System\QdJjWnP.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\SxLBaXt.exe
  C:\Windows\System\SxLBaXt.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\QYjOkXK.exe
  C:\Windows\System\QYjOkXK.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\ELlkLBd.exe
  C:\Windows\System\ELlkLBd.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\BLCoTIn.exe
  C:\Windows\System\BLCoTIn.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\ORnkDyX.exe
  C:\Windows\System\ORnkDyX.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\MgjQqRK.exe
  C:\Windows\System\MgjQqRK.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\GzqORxD.exe
  C:\Windows\System\GzqORxD.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\crMiHyl.exe
  C:\Windows\System\crMiHyl.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\UNXNLWk.exe
  C:\Windows\System\UNXNLWk.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System\dNTqAND.exe
  C:\Windows\System\dNTqAND.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\OnLmsvH.exe
  C:\Windows\System\OnLmsvH.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\ahJPCCP.exe
  C:\Windows\System\ahJPCCP.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\qJtiBgW.exe
  C:\Windows\System\qJtiBgW.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\ZgYCtyY.exe
  C:\Windows\System\ZgYCtyY.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\RZpHuQa.exe
  C:\Windows\System\RZpHuQa.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\XcrzLYW.exe
  C:\Windows\System\XcrzLYW.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\nitqOPr.exe
  C:\Windows\System\nitqOPr.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\czSlfET.exe
  C:\Windows\System\czSlfET.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\MAxaoMI.exe
  C:\Windows\System\MAxaoMI.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\eunCKja.exe
  C:\Windows\System\eunCKja.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\wUcSalO.exe
  C:\Windows\System\wUcSalO.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\BpLMAQY.exe
  C:\Windows\System\BpLMAQY.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\cnHomru.exe
  C:\Windows\System\cnHomru.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\VXxSvDx.exe
  C:\Windows\System\VXxSvDx.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\JwkVtAI.exe
  C:\Windows\System\JwkVtAI.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\RwVCeTI.exe
  C:\Windows\System\RwVCeTI.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\RjxnHEU.exe
  C:\Windows\System\RjxnHEU.exe
  2⤵
  PID:1616
- C:\Windows\System\hVEzYgl.exe
  C:\Windows\System\hVEzYgl.exe
  2⤵
  PID:3556
- C:\Windows\System\tIxIfXD.exe
  C:\Windows\System\tIxIfXD.exe
  2⤵
  PID:2644
- C:\Windows\System\AEOojHF.exe
  C:\Windows\System\AEOojHF.exe
  2⤵
  PID:4876
- C:\Windows\System\GRFxZjV.exe
  C:\Windows\System\GRFxZjV.exe
  2⤵
  PID:4316
- C:\Windows\System\wtBMSfb.exe
  C:\Windows\System\wtBMSfb.exe
  2⤵
  PID:2768
- C:\Windows\System\GJHIyRC.exe
  C:\Windows\System\GJHIyRC.exe
  2⤵
  PID:5140
- C:\Windows\System\mpFjYqJ.exe
  C:\Windows\System\mpFjYqJ.exe
  2⤵
  PID:5168
- C:\Windows\System\BeBvkEr.exe
  C:\Windows\System\BeBvkEr.exe
  2⤵
  PID:5196
- C:\Windows\System\dVLMbuQ.exe
  C:\Windows\System\dVLMbuQ.exe
  2⤵
  PID:5224
- C:\Windows\System\AExMNoP.exe
  C:\Windows\System\AExMNoP.exe
  2⤵
  PID:5252
- C:\Windows\System\duHDzXb.exe
  C:\Windows\System\duHDzXb.exe
  2⤵
  PID:5288
- C:\Windows\System\uiTQczl.exe
  C:\Windows\System\uiTQczl.exe
  2⤵
  PID:5316
- C:\Windows\System\AuDsaEI.exe
  C:\Windows\System\AuDsaEI.exe
  2⤵
  PID:5348
- C:\Windows\System\LIsFyvW.exe
  C:\Windows\System\LIsFyvW.exe
  2⤵
  PID:5376
- C:\Windows\System\WfpwbMT.exe
  C:\Windows\System\WfpwbMT.exe
  2⤵
  PID:5404
- C:\Windows\System\RjCeGgr.exe
  C:\Windows\System\RjCeGgr.exe
  2⤵
  PID:5432
- C:\Windows\System\joxwTlQ.exe
  C:\Windows\System\joxwTlQ.exe
  2⤵
  PID:5460
- C:\Windows\System\uNJGDTl.exe
  C:\Windows\System\uNJGDTl.exe
  2⤵
  PID:5488
- C:\Windows\System\acCgIJC.exe
  C:\Windows\System\acCgIJC.exe
  2⤵
  PID:5516
- C:\Windows\System\RuVqWBC.exe
  C:\Windows\System\RuVqWBC.exe
  2⤵
  PID:5544
- C:\Windows\System\oKrpOSL.exe
  C:\Windows\System\oKrpOSL.exe
  2⤵
  PID:5572
- C:\Windows\System\LsOXhUr.exe
  C:\Windows\System\LsOXhUr.exe
  2⤵
  PID:5600
- C:\Windows\System\qYQngyy.exe
  C:\Windows\System\qYQngyy.exe
  2⤵
  PID:5628
- C:\Windows\System\OrtWgVq.exe
  C:\Windows\System\OrtWgVq.exe
  2⤵
  PID:5656
- C:\Windows\System\ZqwyEHP.exe
  C:\Windows\System\ZqwyEHP.exe
  2⤵
  PID:5684
- C:\Windows\System\ecGiORO.exe
  C:\Windows\System\ecGiORO.exe
  2⤵
  PID:5712
- C:\Windows\System\nbQHILF.exe
  C:\Windows\System\nbQHILF.exe
  2⤵
  PID:5740
- C:\Windows\System\PErjeFY.exe
  C:\Windows\System\PErjeFY.exe
  2⤵
  PID:5768
- C:\Windows\System\NMiBkQv.exe
  C:\Windows\System\NMiBkQv.exe
  2⤵
  PID:5796
- C:\Windows\System\QhAiena.exe
  C:\Windows\System\QhAiena.exe
  2⤵
  PID:5824
- C:\Windows\System\yDIYtCe.exe
  C:\Windows\System\yDIYtCe.exe
  2⤵
  PID:5852
- C:\Windows\System\yzMqRsB.exe
  C:\Windows\System\yzMqRsB.exe
  2⤵
  PID:5880
- C:\Windows\System\zgARkwv.exe
  C:\Windows\System\zgARkwv.exe
  2⤵
  PID:5908
- C:\Windows\System\saUYGVy.exe
  C:\Windows\System\saUYGVy.exe
  2⤵
  PID:5936
- C:\Windows\System\eqvzqZv.exe
  C:\Windows\System\eqvzqZv.exe
  2⤵
  PID:5964
- C:\Windows\System\gqglFxz.exe
  C:\Windows\System\gqglFxz.exe
  2⤵
  PID:5992
- C:\Windows\System\LdpBdFQ.exe
  C:\Windows\System\LdpBdFQ.exe
  2⤵
  PID:6020
- C:\Windows\System\gAWiBdS.exe
  C:\Windows\System\gAWiBdS.exe
  2⤵
  PID:6048
- C:\Windows\System\KEqSZba.exe
  C:\Windows\System\KEqSZba.exe
  2⤵
  PID:6076
- C:\Windows\System\yeTYdkO.exe
  C:\Windows\System\yeTYdkO.exe
  2⤵
  PID:6104
- C:\Windows\System\GzdgnRL.exe
  C:\Windows\System\GzdgnRL.exe
  2⤵
  PID:6132
- C:\Windows\System\UlabaZm.exe
  C:\Windows\System\UlabaZm.exe
  2⤵
  PID:60
- C:\Windows\System\QPbkirD.exe
  C:\Windows\System\QPbkirD.exe
  2⤵
  PID:5076
- C:\Windows\System\xjYMSvw.exe
  C:\Windows\System\xjYMSvw.exe
  2⤵
  PID:2268
- C:\Windows\System\cDWKxtR.exe
  C:\Windows\System\cDWKxtR.exe
  2⤵
  PID:5128
- C:\Windows\System\zSziiQq.exe
  C:\Windows\System\zSziiQq.exe
  2⤵
  PID:5184
- C:\Windows\System\cktGfCW.exe
  C:\Windows\System\cktGfCW.exe
  2⤵
  PID:5240
- C:\Windows\System\dmmJtxS.exe
  C:\Windows\System\dmmJtxS.exe
  2⤵
  PID:5284
- C:\Windows\System\OgiBLOQ.exe
  C:\Windows\System\OgiBLOQ.exe
  2⤵
  PID:5340
- C:\Windows\System\LCLzHxL.exe
  C:\Windows\System\LCLzHxL.exe
  2⤵
  PID:5416
- C:\Windows\System\XaKIFUD.exe
  C:\Windows\System\XaKIFUD.exe
  2⤵
  PID:3972
- C:\Windows\System\tXXonVk.exe
  C:\Windows\System\tXXonVk.exe
  2⤵
  PID:5528
- C:\Windows\System\dKBGOeB.exe
  C:\Windows\System\dKBGOeB.exe
  2⤵
  PID:5564
- C:\Windows\System\yDZynhD.exe
  C:\Windows\System\yDZynhD.exe
  2⤵
  PID:5644
- C:\Windows\System\fDWVJeF.exe
  C:\Windows\System\fDWVJeF.exe
  2⤵
  PID:5700
- C:\Windows\System\mlQJTgo.exe
  C:\Windows\System\mlQJTgo.exe
  2⤵
  PID:5756
- C:\Windows\System\IjUvvvw.exe
  C:\Windows\System\IjUvvvw.exe
  2⤵
  PID:5836
- C:\Windows\System\zQxTbDE.exe
  C:\Windows\System\zQxTbDE.exe
  2⤵
  PID:5896
- C:\Windows\System\eKpvxCX.exe
  C:\Windows\System\eKpvxCX.exe
  2⤵
  PID:5948
- C:\Windows\System\bSOGsXd.exe
  C:\Windows\System\bSOGsXd.exe
  2⤵
  PID:6008
- C:\Windows\System\KwlgfWI.exe
  C:\Windows\System\KwlgfWI.exe
  2⤵
  PID:6064
- C:\Windows\System\fiAbzxY.exe
  C:\Windows\System\fiAbzxY.exe
  2⤵
  PID:6092
- C:\Windows\System\rRXwiNs.exe
  C:\Windows\System\rRXwiNs.exe
  2⤵
  PID:5036
- C:\Windows\System\muTByGX.exe
  C:\Windows\System\muTByGX.exe
  2⤵
  PID:1204
- C:\Windows\System\gdtirkO.exe
  C:\Windows\System\gdtirkO.exe
  2⤵
  PID:5212
- C:\Windows\System\eDfItRe.exe
  C:\Windows\System\eDfItRe.exe
  2⤵
  PID:5312
- C:\Windows\System\OkQHwZN.exe
  C:\Windows\System\OkQHwZN.exe
  2⤵
  PID:5448
- C:\Windows\System\DUqCogJ.exe
  C:\Windows\System\DUqCogJ.exe
  2⤵
  PID:2648
- C:\Windows\System\IRFTcGW.exe
  C:\Windows\System\IRFTcGW.exe
  2⤵
  PID:4968
- C:\Windows\System\LyMESWe.exe
  C:\Windows\System\LyMESWe.exe
  2⤵
  PID:5980
- C:\Windows\System\LeodAoa.exe
  C:\Windows\System\LeodAoa.exe
  2⤵
  PID:1004
- C:\Windows\System\SXpOajj.exe
  C:\Windows\System\SXpOajj.exe
  2⤵
  PID:1440
- C:\Windows\System\etsvoqD.exe
  C:\Windows\System\etsvoqD.exe
  2⤵
  PID:6116
- C:\Windows\System\KPXUCOW.exe
  C:\Windows\System\KPXUCOW.exe
  2⤵
  PID:5160
- C:\Windows\System\JnVtUoq.exe
  C:\Windows\System\JnVtUoq.exe
  2⤵
  PID:3604
- C:\Windows\System\XbqjErk.exe
  C:\Windows\System\XbqjErk.exe
  2⤵
  PID:4492
- C:\Windows\System\HkraBuD.exe
  C:\Windows\System\HkraBuD.exe
  2⤵
  PID:820
- C:\Windows\System\flYWXRe.exe
  C:\Windows\System\flYWXRe.exe
  2⤵
  PID:5612
- C:\Windows\System\iEVLoFf.exe
  C:\Windows\System\iEVLoFf.exe
  2⤵
  PID:2716
- C:\Windows\System\ObROxWv.exe
  C:\Windows\System\ObROxWv.exe
  2⤵
  PID:1836
- C:\Windows\System\GIWbULT.exe
  C:\Windows\System\GIWbULT.exe
  2⤵
  PID:4920
- C:\Windows\System\yvLokhB.exe
  C:\Windows\System\yvLokhB.exe
  2⤵
  PID:5788
- C:\Windows\System\BCIubcm.exe
  C:\Windows\System\BCIubcm.exe
  2⤵
  PID:3652
- C:\Windows\System\KUDyVTA.exe
  C:\Windows\System\KUDyVTA.exe
  2⤵
  PID:5268
- C:\Windows\System\nzUBfCq.exe
  C:\Windows\System\nzUBfCq.exe
  2⤵
  PID:5668
- C:\Windows\System\weVNaqF.exe
  C:\Windows\System\weVNaqF.exe
  2⤵
  PID:5752
- C:\Windows\System\LgZBhji.exe
  C:\Windows\System\LgZBhji.exe
  2⤵
  PID:5728
- C:\Windows\System\suOXUkl.exe
  C:\Windows\System\suOXUkl.exe
  2⤵
  PID:6188
- C:\Windows\System\UaQBefF.exe
  C:\Windows\System\UaQBefF.exe
  2⤵
  PID:6244
- C:\Windows\System\RYKSArA.exe
  C:\Windows\System\RYKSArA.exe
  2⤵
  PID:6272
- C:\Windows\System\TqfgLYq.exe
  C:\Windows\System\TqfgLYq.exe
  2⤵
  PID:6288
- C:\Windows\System\wlUGfDl.exe
  C:\Windows\System\wlUGfDl.exe
  2⤵
  PID:6328
- C:\Windows\System\JEcycOs.exe
  C:\Windows\System\JEcycOs.exe
  2⤵
  PID:6352
- C:\Windows\System\grtNfxT.exe
  C:\Windows\System\grtNfxT.exe
  2⤵
  PID:6384
- C:\Windows\System\BgJpZgu.exe
  C:\Windows\System\BgJpZgu.exe
  2⤵
  PID:6400
- C:\Windows\System\UCedLAF.exe
  C:\Windows\System\UCedLAF.exe
  2⤵
  PID:6424
- C:\Windows\System\cNpubWW.exe
  C:\Windows\System\cNpubWW.exe
  2⤵
  PID:6452
- C:\Windows\System\cHfycWQ.exe
  C:\Windows\System\cHfycWQ.exe
  2⤵
  PID:6496
- C:\Windows\System\cmSHdow.exe
  C:\Windows\System\cmSHdow.exe
  2⤵
  PID:6524
- C:\Windows\System\asMpxeM.exe
  C:\Windows\System\asMpxeM.exe
  2⤵
  PID:6540
- C:\Windows\System\IOdMVKY.exe
  C:\Windows\System\IOdMVKY.exe
  2⤵
  PID:6568
- C:\Windows\System\UvAEBxp.exe
  C:\Windows\System\UvAEBxp.exe
  2⤵
  PID:6592
- C:\Windows\System\OROhFcu.exe
  C:\Windows\System\OROhFcu.exe
  2⤵
  PID:6624
- C:\Windows\System\CBEFTxR.exe
  C:\Windows\System\CBEFTxR.exe
  2⤵
  PID:6648
- C:\Windows\System\nzRilKl.exe
  C:\Windows\System\nzRilKl.exe
  2⤵
  PID:6672
- C:\Windows\System\GDXKUHl.exe
  C:\Windows\System\GDXKUHl.exe
  2⤵
  PID:6708
- C:\Windows\System\DGaqPPV.exe
  C:\Windows\System\DGaqPPV.exe
  2⤵
  PID:6736
- C:\Windows\System\NmMFixN.exe
  C:\Windows\System\NmMFixN.exe
  2⤵
  PID:6780
- C:\Windows\System\ySljRiD.exe
  C:\Windows\System\ySljRiD.exe
  2⤵
  PID:6812
- C:\Windows\System\wjidpTz.exe
  C:\Windows\System\wjidpTz.exe
  2⤵
  PID:6840
- C:\Windows\System\UBMIxiB.exe
  C:\Windows\System\UBMIxiB.exe
  2⤵
  PID:6856
- C:\Windows\System\zuxdKYj.exe
  C:\Windows\System\zuxdKYj.exe
  2⤵
  PID:6880
- C:\Windows\System\DVAhryZ.exe
  C:\Windows\System\DVAhryZ.exe
  2⤵
  PID:6912
- C:\Windows\System\tkOqbxJ.exe
  C:\Windows\System\tkOqbxJ.exe
  2⤵
  PID:6928
- C:\Windows\System\vxTvWwg.exe
  C:\Windows\System\vxTvWwg.exe
  2⤵
  PID:6968
- C:\Windows\System\rMfIrvl.exe
  C:\Windows\System\rMfIrvl.exe
  2⤵
  PID:6996
- C:\Windows\System\WbuDOmq.exe
  C:\Windows\System\WbuDOmq.exe
  2⤵
  PID:7020
- C:\Windows\System\HPxSRpJ.exe
  C:\Windows\System\HPxSRpJ.exe
  2⤵
  PID:7076
- C:\Windows\System\aYjklBL.exe
  C:\Windows\System\aYjklBL.exe
  2⤵
  PID:7100
- C:\Windows\System\HbXBXKp.exe
  C:\Windows\System\HbXBXKp.exe
  2⤵
  PID:7116
- C:\Windows\System\KzbWXnu.exe
  C:\Windows\System\KzbWXnu.exe
  2⤵
  PID:7140
- C:\Windows\System\irsevIi.exe
  C:\Windows\System\irsevIi.exe
  2⤵
  PID:7160
- C:\Windows\System\Bjamgyr.exe
  C:\Windows\System\Bjamgyr.exe
  2⤵
  PID:1464
- C:\Windows\System\OArXUXc.exe
  C:\Windows\System\OArXUXc.exe
  2⤵
  PID:6156
- C:\Windows\System\tCuPbYk.exe
  C:\Windows\System\tCuPbYk.exe
  2⤵
  PID:5812
- C:\Windows\System\YklzvQe.exe
  C:\Windows\System\YklzvQe.exe
  2⤵
  PID:6284
- C:\Windows\System\loilIvE.exe
  C:\Windows\System\loilIvE.exe
  2⤵
  PID:6336
- C:\Windows\System\dpppqHT.exe
  C:\Windows\System\dpppqHT.exe
  2⤵
  PID:6348
- C:\Windows\System\nMOJepL.exe
  C:\Windows\System\nMOJepL.exe
  2⤵
  PID:6444
- C:\Windows\System\glEriHm.exe
  C:\Windows\System\glEriHm.exe
  2⤵
  PID:6536
- C:\Windows\System\ecvnFlD.exe
  C:\Windows\System\ecvnFlD.exe
  2⤵
  PID:6604
- C:\Windows\System\SehPpwe.exe
  C:\Windows\System\SehPpwe.exe
  2⤵
  PID:6664
- C:\Windows\System\WqZrhgS.exe
  C:\Windows\System\WqZrhgS.exe
  2⤵
  PID:6728
- C:\Windows\System\TiMwTdY.exe
  C:\Windows\System\TiMwTdY.exe
  2⤵
  PID:6772
- C:\Windows\System\RlNqjTQ.exe
  C:\Windows\System\RlNqjTQ.exe
  2⤵
  PID:6872
- C:\Windows\System\GYsuhDE.exe
  C:\Windows\System\GYsuhDE.exe
  2⤵
  PID:6892
- C:\Windows\System\IHnxvru.exe
  C:\Windows\System\IHnxvru.exe
  2⤵
  PID:6924
- C:\Windows\System\IwOyRpo.exe
  C:\Windows\System\IwOyRpo.exe
  2⤵
  PID:6988
- C:\Windows\System\HhKJxPf.exe
  C:\Windows\System\HhKJxPf.exe
  2⤵
  PID:7012
- C:\Windows\System\xzvurvm.exe
  C:\Windows\System\xzvurvm.exe
  2⤵
  PID:7064
- C:\Windows\System\dyHlVuE.exe
  C:\Windows\System\dyHlVuE.exe
  2⤵
  PID:7112
- C:\Windows\System\WCTOItb.exe
  C:\Windows\System\WCTOItb.exe
  2⤵
  PID:7152
- C:\Windows\System\GsXZrqF.exe
  C:\Windows\System\GsXZrqF.exe
  2⤵
  PID:6196
- C:\Windows\System\pjHfxex.exe
  C:\Windows\System\pjHfxex.exe
  2⤵
  PID:6252
- C:\Windows\System\lqpVnJq.exe
  C:\Windows\System\lqpVnJq.exe
  2⤵
  PID:6344
- C:\Windows\System\mefNXIs.exe
  C:\Windows\System\mefNXIs.exe
  2⤵
  PID:6560
- C:\Windows\System\eVlmGpT.exe
  C:\Windows\System\eVlmGpT.exe
  2⤵
  PID:6616
- C:\Windows\System\wMqNKlN.exe
  C:\Windows\System\wMqNKlN.exe
  2⤵
  PID:6820
- C:\Windows\System\BhxeFTg.exe
  C:\Windows\System\BhxeFTg.exe
  2⤵
  PID:6864
- C:\Windows\System\dRTMwNC.exe
  C:\Windows\System\dRTMwNC.exe
  2⤵
  PID:332
- C:\Windows\System\liHCNEp.exe
  C:\Windows\System\liHCNEp.exe
  2⤵
  PID:2444
- C:\Windows\System\YqvxUBR.exe
  C:\Windows\System\YqvxUBR.exe
  2⤵
  PID:7148
- C:\Windows\System\TFFsvbT.exe
  C:\Windows\System\TFFsvbT.exe
  2⤵
  PID:6920
- C:\Windows\System\YlciVEG.exe
  C:\Windows\System\YlciVEG.exe
  2⤵
  PID:7180
- C:\Windows\System\KmiSxge.exe
  C:\Windows\System\KmiSxge.exe
  2⤵
  PID:7224
- C:\Windows\System\eYesXJd.exe
  C:\Windows\System\eYesXJd.exe
  2⤵
  PID:7256
- C:\Windows\System\TImrFPT.exe
  C:\Windows\System\TImrFPT.exe
  2⤵
  PID:7296
- C:\Windows\System\qmtVFBC.exe
  C:\Windows\System\qmtVFBC.exe
  2⤵
  PID:7320
- C:\Windows\System\YinaMqh.exe
  C:\Windows\System\YinaMqh.exe
  2⤵
  PID:7340
- C:\Windows\System\stbdFtS.exe
  C:\Windows\System\stbdFtS.exe
  2⤵
  PID:7364
- C:\Windows\System\RdkqBIp.exe
  C:\Windows\System\RdkqBIp.exe
  2⤵
  PID:7408
- C:\Windows\System\QOlPUGt.exe
  C:\Windows\System\QOlPUGt.exe
  2⤵
  PID:7432
- C:\Windows\System\KFkPAdj.exe
  C:\Windows\System\KFkPAdj.exe
  2⤵
  PID:7448
- C:\Windows\System\oAWlovc.exe
  C:\Windows\System\oAWlovc.exe
  2⤵
  PID:7488
- C:\Windows\System\rmdRJZt.exe
  C:\Windows\System\rmdRJZt.exe
  2⤵
  PID:7508
- C:\Windows\System\MhKDOTG.exe
  C:\Windows\System\MhKDOTG.exe
  2⤵
  PID:7532
- C:\Windows\System\VxfwTJx.exe
  C:\Windows\System\VxfwTJx.exe
  2⤵
  PID:7552
- C:\Windows\System\lgQYqcF.exe
  C:\Windows\System\lgQYqcF.exe
  2⤵
  PID:7580
- C:\Windows\System\hMnMyDM.exe
  C:\Windows\System\hMnMyDM.exe
  2⤵
  PID:7604
- C:\Windows\System\dvJQtqP.exe
  C:\Windows\System\dvJQtqP.exe
  2⤵
  PID:7624
- C:\Windows\System\saRUtFM.exe
  C:\Windows\System\saRUtFM.exe
  2⤵
  PID:7648
- C:\Windows\System\dydRUrZ.exe
  C:\Windows\System\dydRUrZ.exe
  2⤵
  PID:7676
- C:\Windows\System\UOrJpei.exe
  C:\Windows\System\UOrJpei.exe
  2⤵
  PID:7716
- C:\Windows\System\ccpEFEx.exe
  C:\Windows\System\ccpEFEx.exe
  2⤵
  PID:7744
- C:\Windows\System\AoYKmXn.exe
  C:\Windows\System\AoYKmXn.exe
  2⤵
  PID:7764
- C:\Windows\System\vyvfdtd.exe
  C:\Windows\System\vyvfdtd.exe
  2⤵
  PID:7816
- C:\Windows\System\YEwtVbK.exe
  C:\Windows\System\YEwtVbK.exe
  2⤵
  PID:7852
- C:\Windows\System\sxGdNWe.exe
  C:\Windows\System\sxGdNWe.exe
  2⤵
  PID:7872
- C:\Windows\System\esFzAzm.exe
  C:\Windows\System\esFzAzm.exe
  2⤵
  PID:7896
- C:\Windows\System\drNyhpP.exe
  C:\Windows\System\drNyhpP.exe
  2⤵
  PID:7916
- C:\Windows\System\VVCIaUY.exe
  C:\Windows\System\VVCIaUY.exe
  2⤵
  PID:7968
- C:\Windows\System\bgpMHso.exe
  C:\Windows\System\bgpMHso.exe
  2⤵
  PID:8004
- C:\Windows\System\arXywbE.exe
  C:\Windows\System\arXywbE.exe
  2⤵
  PID:8020
- C:\Windows\System\fgKtnmA.exe
  C:\Windows\System\fgKtnmA.exe
  2⤵
  PID:8044
- C:\Windows\System\VYzQaLT.exe
  C:\Windows\System\VYzQaLT.exe
  2⤵
  PID:8064
- C:\Windows\System\uXlVlOr.exe
  C:\Windows\System\uXlVlOr.exe
  2⤵
  PID:8108
- C:\Windows\System\LpXjXRx.exe
  C:\Windows\System\LpXjXRx.exe
  2⤵
  PID:8132
- C:\Windows\System\OoSzbbu.exe
  C:\Windows\System\OoSzbbu.exe
  2⤵
  PID:8152
- C:\Windows\System\PIJvxQu.exe
  C:\Windows\System\PIJvxQu.exe
  2⤵
  PID:6420
- C:\Windows\System\DHNQWta.exe
  C:\Windows\System\DHNQWta.exe
  2⤵
  PID:6520
- C:\Windows\System\lSPtcdb.exe
  C:\Windows\System\lSPtcdb.exe
  2⤵
  PID:7220
- C:\Windows\System\fYmhnOh.exe
  C:\Windows\System\fYmhnOh.exe
  2⤵
  PID:7304
- C:\Windows\System\yoSenNf.exe
  C:\Windows\System\yoSenNf.exe
  2⤵
  PID:6704
- C:\Windows\System\feGapul.exe
  C:\Windows\System\feGapul.exe
  2⤵
  PID:7444
- C:\Windows\System\sPVMzjr.exe
  C:\Windows\System\sPVMzjr.exe
  2⤵
  PID:7468
- C:\Windows\System\JRZShxm.exe
  C:\Windows\System\JRZShxm.exe
  2⤵
  PID:7496
- C:\Windows\System\DzFDQUk.exe
  C:\Windows\System\DzFDQUk.exe
  2⤵
  PID:7656
- C:\Windows\System\KHXuMqv.exe
  C:\Windows\System\KHXuMqv.exe
  2⤵
  PID:7668
- C:\Windows\System\jaAaNeR.exe
  C:\Windows\System\jaAaNeR.exe
  2⤵
  PID:7728
- C:\Windows\System\AVKzghE.exe
  C:\Windows\System\AVKzghE.exe
  2⤵
  PID:7700
- C:\Windows\System\mAEmxtM.exe
  C:\Windows\System\mAEmxtM.exe
  2⤵
  PID:7756
- C:\Windows\System\vPTcHQq.exe
  C:\Windows\System\vPTcHQq.exe
  2⤵
  PID:7992
- C:\Windows\System\zOLbvst.exe
  C:\Windows\System\zOLbvst.exe
  2⤵
  PID:8016
- C:\Windows\System\voJbkrZ.exe
  C:\Windows\System\voJbkrZ.exe
  2⤵
  PID:8080
- C:\Windows\System\CEzNhxy.exe
  C:\Windows\System\CEzNhxy.exe
  2⤵
  PID:8124
- C:\Windows\System\XTSeyUy.exe
  C:\Windows\System\XTSeyUy.exe
  2⤵
  PID:6180
- C:\Windows\System\KGfaGfD.exe
  C:\Windows\System\KGfaGfD.exe
  2⤵
  PID:7236
- C:\Windows\System\CrBNitg.exe
  C:\Windows\System\CrBNitg.exe
  2⤵
  PID:7400
- C:\Windows\System\NqyyxLA.exe
  C:\Windows\System\NqyyxLA.exe
  2⤵
  PID:7576
- C:\Windows\System\PUUpRSX.exe
  C:\Windows\System\PUUpRSX.exe
  2⤵
  PID:7736
- C:\Windows\System\GsmqGBe.exe
  C:\Windows\System\GsmqGBe.exe
  2⤵
  PID:7704
- C:\Windows\System\SVqnJPK.exe
  C:\Windows\System\SVqnJPK.exe
  2⤵
  PID:8036
- C:\Windows\System\enFpgGD.exe
  C:\Windows\System\enFpgGD.exe
  2⤵
  PID:8160
- C:\Windows\System\kYokimE.exe
  C:\Windows\System\kYokimE.exe
  2⤵
  PID:7384
- C:\Windows\System\DPjZDIo.exe
  C:\Windows\System\DPjZDIo.exe
  2⤵
  PID:7520
- C:\Windows\System\PZzVAIm.exe
  C:\Windows\System\PZzVAIm.exe
  2⤵
  PID:8116
- C:\Windows\System\miAmzTw.exe
  C:\Windows\System\miAmzTw.exe
  2⤵
  PID:7504
- C:\Windows\System\tNXAdiH.exe
  C:\Windows\System\tNXAdiH.exe
  2⤵
  PID:7988
- C:\Windows\System\jtVCptW.exe
  C:\Windows\System\jtVCptW.exe
  2⤵
  PID:8224
- C:\Windows\System\UZZCBPV.exe
  C:\Windows\System\UZZCBPV.exe
  2⤵
  PID:8256
- C:\Windows\System\MTUWLqY.exe
  C:\Windows\System\MTUWLqY.exe
  2⤵
  PID:8276
- C:\Windows\System\jQIjHHG.exe
  C:\Windows\System\jQIjHHG.exe
  2⤵
  PID:8296
- C:\Windows\System\wHfWWwE.exe
  C:\Windows\System\wHfWWwE.exe
  2⤵
  PID:8324
- C:\Windows\System\jUcuUZo.exe
  C:\Windows\System\jUcuUZo.exe
  2⤵
  PID:8352
- C:\Windows\System\rLMtZLb.exe
  C:\Windows\System\rLMtZLb.exe
  2⤵
  PID:8372
- C:\Windows\System\pTjPGvJ.exe
  C:\Windows\System\pTjPGvJ.exe
  2⤵
  PID:8408
- C:\Windows\System\axyxMEX.exe
  C:\Windows\System\axyxMEX.exe
  2⤵
  PID:8452
- C:\Windows\System\IDxJtIs.exe
  C:\Windows\System\IDxJtIs.exe
  2⤵
  PID:8476
- C:\Windows\System\dHAKmyH.exe
  C:\Windows\System\dHAKmyH.exe
  2⤵
  PID:8500
- C:\Windows\System\ForQADk.exe
  C:\Windows\System\ForQADk.exe
  2⤵
  PID:8540
- C:\Windows\System\ifvdkyw.exe
  C:\Windows\System\ifvdkyw.exe
  2⤵
  PID:8564
- C:\Windows\System\zcRDyKz.exe
  C:\Windows\System\zcRDyKz.exe
  2⤵
  PID:8588
- C:\Windows\System\AffwRce.exe
  C:\Windows\System\AffwRce.exe
  2⤵
  PID:8604
- C:\Windows\System\YRpJoZJ.exe
  C:\Windows\System\YRpJoZJ.exe
  2⤵
  PID:8628
- C:\Windows\System\cmTwsdS.exe
  C:\Windows\System\cmTwsdS.exe
  2⤵
  PID:8644
- C:\Windows\System\dMdgFxV.exe
  C:\Windows\System\dMdgFxV.exe
  2⤵
  PID:8664
- C:\Windows\System\nCcjGvD.exe
  C:\Windows\System\nCcjGvD.exe
  2⤵
  PID:8688
- C:\Windows\System\SFYxNIh.exe
  C:\Windows\System\SFYxNIh.exe
  2⤵
  PID:8732
- C:\Windows\System\lJPSatt.exe
  C:\Windows\System\lJPSatt.exe
  2⤵
  PID:8756
- C:\Windows\System\WypZgBN.exe
  C:\Windows\System\WypZgBN.exe
  2⤵
  PID:8776
- C:\Windows\System\qdeYKLW.exe
  C:\Windows\System\qdeYKLW.exe
  2⤵
  PID:8800
- C:\Windows\System\DAVOPKG.exe
  C:\Windows\System\DAVOPKG.exe
  2⤵
  PID:8840
- C:\Windows\System\fmNUWPK.exe
  C:\Windows\System\fmNUWPK.exe
  2⤵
  PID:8860
- C:\Windows\System\TEBcavz.exe
  C:\Windows\System\TEBcavz.exe
  2⤵
  PID:8884
- C:\Windows\System\zCGDTtE.exe
  C:\Windows\System\zCGDTtE.exe
  2⤵
  PID:8904
- C:\Windows\System\lFkGVMJ.exe
  C:\Windows\System\lFkGVMJ.exe
  2⤵
  PID:8940
- C:\Windows\System\vhHjCWx.exe
  C:\Windows\System\vhHjCWx.exe
  2⤵
  PID:8980
- C:\Windows\System\tZAfEQw.exe
  C:\Windows\System\tZAfEQw.exe
  2⤵
  PID:9008
- C:\Windows\System\tApSzfI.exe
  C:\Windows\System\tApSzfI.exe
  2⤵
  PID:9044
- C:\Windows\System\XmXnqEs.exe
  C:\Windows\System\XmXnqEs.exe
  2⤵
  PID:9092
- C:\Windows\System\wzElCxp.exe
  C:\Windows\System\wzElCxp.exe
  2⤵
  PID:9124
- C:\Windows\System\DybuoLA.exe
  C:\Windows\System\DybuoLA.exe
  2⤵
  PID:9140
- C:\Windows\System\nWFQHut.exe
  C:\Windows\System\nWFQHut.exe
  2⤵
  PID:9164
- C:\Windows\System\RtYSLYT.exe
  C:\Windows\System\RtYSLYT.exe
  2⤵
  PID:9184
- C:\Windows\System\tpuFTXa.exe
  C:\Windows\System\tpuFTXa.exe
  2⤵
  PID:8220
- C:\Windows\System\bQPjgDE.exe
  C:\Windows\System\bQPjgDE.exe
  2⤵
  PID:8272
- C:\Windows\System\uDbvvVQ.exe
  C:\Windows\System\uDbvvVQ.exe
  2⤵
  PID:8332
- C:\Windows\System\qcGTHRr.exe
  C:\Windows\System\qcGTHRr.exe
  2⤵
  PID:8344
- C:\Windows\System\JPzmhHE.exe
  C:\Windows\System\JPzmhHE.exe
  2⤵
  PID:8392
- C:\Windows\System\JqXlISp.exe
  C:\Windows\System\JqXlISp.exe
  2⤵
  PID:8492
- C:\Windows\System\HnQCDGj.exe
  C:\Windows\System\HnQCDGj.exe
  2⤵
  PID:8576
- C:\Windows\System\LZaliJt.exe
  C:\Windows\System\LZaliJt.exe
  2⤵
  PID:8620
- C:\Windows\System\GtQpdgq.exe
  C:\Windows\System\GtQpdgq.exe
  2⤵
  PID:8684
- C:\Windows\System\JzoBYOg.exe
  C:\Windows\System\JzoBYOg.exe
  2⤵
  PID:8740
- C:\Windows\System\pSDmWSS.exe
  C:\Windows\System\pSDmWSS.exe
  2⤵
  PID:8784
- C:\Windows\System\PIWkYzg.exe
  C:\Windows\System\PIWkYzg.exe
  2⤵
  PID:8816
- C:\Windows\System\vcDNyvi.exe
  C:\Windows\System\vcDNyvi.exe
  2⤵
  PID:8976
- C:\Windows\System\ebhoszG.exe
  C:\Windows\System\ebhoszG.exe
  2⤵
  PID:9036
- C:\Windows\System\VyuLiNK.exe
  C:\Windows\System\VyuLiNK.exe
  2⤵
  PID:7864
- C:\Windows\System\qJsjhcv.exe
  C:\Windows\System\qJsjhcv.exe
  2⤵
  PID:8612
- C:\Windows\System\zWsyqkx.exe
  C:\Windows\System\zWsyqkx.exe
  2⤵
  PID:8496
- C:\Windows\System\aQvYThZ.exe
  C:\Windows\System\aQvYThZ.exe
  2⤵
  PID:8572
- C:\Windows\System\ddoTVmC.exe
  C:\Windows\System\ddoTVmC.exe
  2⤵
  PID:9104
- C:\Windows\System\dsHIutp.exe
  C:\Windows\System\dsHIutp.exe
  2⤵
  PID:9160
- C:\Windows\System\tjXAPST.exe
  C:\Windows\System\tjXAPST.exe
  2⤵
  PID:9000
- C:\Windows\System\BStZTlu.exe
  C:\Windows\System\BStZTlu.exe
  2⤵
  PID:8404
- C:\Windows\System\BIZovQQ.exe
  C:\Windows\System\BIZovQQ.exe
  2⤵
  PID:9072
- C:\Windows\System\aHxVNKj.exe
  C:\Windows\System\aHxVNKj.exe
  2⤵
  PID:8868
- C:\Windows\System\WeEQEFf.exe
  C:\Windows\System\WeEQEFf.exe
  2⤵
  PID:8936
- C:\Windows\System\VhztVFW.exe
  C:\Windows\System\VhztVFW.exe
  2⤵
  PID:8216
- C:\Windows\System\rwpLRQw.exe
  C:\Windows\System\rwpLRQw.exe
  2⤵
  PID:9068
- C:\Windows\System\CjghzcT.exe
  C:\Windows\System\CjghzcT.exe
  2⤵
  PID:5000
- C:\Windows\System\fdzClBt.exe
  C:\Windows\System\fdzClBt.exe
  2⤵
  PID:9224
- C:\Windows\System\nAvySpx.exe
  C:\Windows\System\nAvySpx.exe
  2⤵
  PID:9244
- C:\Windows\System\gwlaZrW.exe
  C:\Windows\System\gwlaZrW.exe
  2⤵
  PID:9268
- C:\Windows\System\mqoBmXk.exe
  C:\Windows\System\mqoBmXk.exe
  2⤵
  PID:9300
- C:\Windows\System\EpEZzGf.exe
  C:\Windows\System\EpEZzGf.exe
  2⤵
  PID:9348
- C:\Windows\System\RvBAvXN.exe
  C:\Windows\System\RvBAvXN.exe
  2⤵
  PID:9368
- C:\Windows\System\FuGfUpx.exe
  C:\Windows\System\FuGfUpx.exe
  2⤵
  PID:9408
- C:\Windows\System\HjgukfC.exe
  C:\Windows\System\HjgukfC.exe
  2⤵
  PID:9432
- C:\Windows\System\wRLMZhZ.exe
  C:\Windows\System\wRLMZhZ.exe
  2⤵
  PID:9464
- C:\Windows\System\ArKzxxj.exe
  C:\Windows\System\ArKzxxj.exe
  2⤵
  PID:9516
- C:\Windows\System\uIrpPtP.exe
  C:\Windows\System\uIrpPtP.exe
  2⤵
  PID:9540
- C:\Windows\System\OUIpaVA.exe
  C:\Windows\System\OUIpaVA.exe
  2⤵
  PID:9564
- C:\Windows\System\jUQuHeC.exe
  C:\Windows\System\jUQuHeC.exe
  2⤵
  PID:9584
- C:\Windows\System\PHlomRH.exe
  C:\Windows\System\PHlomRH.exe
  2⤵
  PID:9616
- C:\Windows\System\DUUkbtL.exe
  C:\Windows\System\DUUkbtL.exe
  2⤵
  PID:9640
- C:\Windows\System\YhmtGYH.exe
  C:\Windows\System\YhmtGYH.exe
  2⤵
  PID:9656
- C:\Windows\System\ftytPvJ.exe
  C:\Windows\System\ftytPvJ.exe
  2⤵
  PID:9676
- C:\Windows\System\LxFPsLF.exe
  C:\Windows\System\LxFPsLF.exe
  2⤵
  PID:9724
- C:\Windows\System\aORcjbe.exe
  C:\Windows\System\aORcjbe.exe
  2⤵
  PID:9740
- C:\Windows\System\jPiLOZr.exe
  C:\Windows\System\jPiLOZr.exe
  2⤵
  PID:9764
- C:\Windows\System\uoHCkun.exe
  C:\Windows\System\uoHCkun.exe
  2⤵
  PID:9792
- C:\Windows\System\TzHZjGr.exe
  C:\Windows\System\TzHZjGr.exe
  2⤵
  PID:9812
- C:\Windows\System\xlRmeEe.exe
  C:\Windows\System\xlRmeEe.exe
  2⤵
  PID:9832
- C:\Windows\System\HcBfTzH.exe
  C:\Windows\System\HcBfTzH.exe
  2⤵
  PID:9884
- C:\Windows\System\QeCiRGb.exe
  C:\Windows\System\QeCiRGb.exe
  2⤵
  PID:9948
- C:\Windows\System\ujqNtNI.exe
  C:\Windows\System\ujqNtNI.exe
  2⤵
  PID:9968
- C:\Windows\System\DgeLlzu.exe
  C:\Windows\System\DgeLlzu.exe
  2⤵
  PID:9984
- C:\Windows\System\qvfKJrr.exe
  C:\Windows\System\qvfKJrr.exe
  2⤵
  PID:10008
- C:\Windows\System\sJmoylN.exe
  C:\Windows\System\sJmoylN.exe
  2⤵
  PID:10052
- C:\Windows\System\eTKehUH.exe
  C:\Windows\System\eTKehUH.exe
  2⤵
  PID:10092
- C:\Windows\System\ymRyzsV.exe
  C:\Windows\System\ymRyzsV.exe
  2⤵
  PID:10108
- C:\Windows\System\ErDoNmU.exe
  C:\Windows\System\ErDoNmU.exe
  2⤵
  PID:10136
- C:\Windows\System\vgcgTEm.exe
  C:\Windows\System\vgcgTEm.exe
  2⤵
  PID:10156
- C:\Windows\System\BaxUovd.exe
  C:\Windows\System\BaxUovd.exe
  2⤵
  PID:10180
- C:\Windows\System\ykcrJya.exe
  C:\Windows\System\ykcrJya.exe
  2⤵
  PID:10196
- C:\Windows\System\Wnbxope.exe
  C:\Windows\System\Wnbxope.exe
  2⤵
  PID:8532
- C:\Windows\System\ZfOTlhx.exe
  C:\Windows\System\ZfOTlhx.exe
  2⤵
  PID:9296
- C:\Windows\System\uvvSyqF.exe
  C:\Windows\System\uvvSyqF.exe
  2⤵
  PID:9320
- C:\Windows\System\PMJrFWT.exe
  C:\Windows\System\PMJrFWT.exe
  2⤵
  PID:9332
- C:\Windows\System\fkbEUbB.exe
  C:\Windows\System\fkbEUbB.exe
  2⤵
  PID:9400
- C:\Windows\System\FDweghL.exe
  C:\Windows\System\FDweghL.exe
  2⤵
  PID:9456
- C:\Windows\System\JSnTtrd.exe
  C:\Windows\System\JSnTtrd.exe
  2⤵
  PID:9532
- C:\Windows\System\RgvxDec.exe
  C:\Windows\System\RgvxDec.exe
  2⤵
  PID:9572
- C:\Windows\System\DWlZciL.exe
  C:\Windows\System\DWlZciL.exe
  2⤵
  PID:9664
- C:\Windows\System\lieXYUO.exe
  C:\Windows\System\lieXYUO.exe
  2⤵
  PID:9712
- C:\Windows\System\xoCYRBb.exe
  C:\Windows\System\xoCYRBb.exe
  2⤵
  PID:9828
- C:\Windows\System\ZWbWlzL.exe
  C:\Windows\System\ZWbWlzL.exe
  2⤵
  PID:9868
- C:\Windows\System\zoKQzWJ.exe
  C:\Windows\System\zoKQzWJ.exe
  2⤵
  PID:9960
- C:\Windows\System\ZuLYWQz.exe
  C:\Windows\System\ZuLYWQz.exe
  2⤵
  PID:9976
- C:\Windows\System\OluMHIo.exe
  C:\Windows\System\OluMHIo.exe
  2⤵
  PID:10040
- C:\Windows\System\XgdhQIL.exe
  C:\Windows\System\XgdhQIL.exe
  2⤵
  PID:10164
- C:\Windows\System\JGSRIjl.exe
  C:\Windows\System\JGSRIjl.exe
  2⤵
  PID:10236
- C:\Windows\System\hlzaqRL.exe
  C:\Windows\System\hlzaqRL.exe
  2⤵
  PID:9236
- C:\Windows\System\NQFQdUj.exe
  C:\Windows\System\NQFQdUj.exe
  2⤵
  PID:9444
- C:\Windows\System\ylsCIFI.exe
  C:\Windows\System\ylsCIFI.exe
  2⤵
  PID:9476
- C:\Windows\System\HiYjFwT.exe
  C:\Windows\System\HiYjFwT.exe
  2⤵
  PID:9708
- C:\Windows\System\bynHkeN.exe
  C:\Windows\System\bynHkeN.exe
  2⤵
  PID:9732
- C:\Windows\System\kAtBovb.exe
  C:\Windows\System\kAtBovb.exe
  2⤵
  PID:9872
- C:\Windows\System\DqVhbsi.exe
  C:\Windows\System\DqVhbsi.exe
  2⤵
  PID:10028
- C:\Windows\System\WjSgAcR.exe
  C:\Windows\System\WjSgAcR.exe
  2⤵
  PID:10152
- C:\Windows\System\SCLCcmF.exe
  C:\Windows\System\SCLCcmF.exe
  2⤵
  PID:8292
- C:\Windows\System\VIXbLYT.exe
  C:\Windows\System\VIXbLYT.exe
  2⤵
  PID:9416
- C:\Windows\System\vaQbmcp.exe
  C:\Windows\System\vaQbmcp.exe
  2⤵
  PID:9904
- C:\Windows\System\rLTqEmL.exe
  C:\Windows\System\rLTqEmL.exe
  2⤵
  PID:10248
- C:\Windows\System\mdpYlHJ.exe
  C:\Windows\System\mdpYlHJ.exe
  2⤵
  PID:10300
- C:\Windows\System\ftiKFwt.exe
  C:\Windows\System\ftiKFwt.exe
  2⤵
  PID:10340
- C:\Windows\System\PIenfmG.exe
  C:\Windows\System\PIenfmG.exe
  2⤵
  PID:10388
- C:\Windows\System\QJbxFdU.exe
  C:\Windows\System\QJbxFdU.exe
  2⤵
  PID:10408
- C:\Windows\System\tObjqUK.exe
  C:\Windows\System\tObjqUK.exe
  2⤵
  PID:10436
- C:\Windows\System\uLZsjYj.exe
  C:\Windows\System\uLZsjYj.exe
  2⤵
  PID:10464
- C:\Windows\System\QMdleQH.exe
  C:\Windows\System\QMdleQH.exe
  2⤵
  PID:10488
- C:\Windows\System\hUKksMq.exe
  C:\Windows\System\hUKksMq.exe
  2⤵
  PID:10528
- C:\Windows\System\FpVQWId.exe
  C:\Windows\System\FpVQWId.exe
  2⤵
  PID:10548
- C:\Windows\System\oiAEDCu.exe
  C:\Windows\System\oiAEDCu.exe
  2⤵
  PID:10584
- C:\Windows\System\OtGZWih.exe
  C:\Windows\System\OtGZWih.exe
  2⤵
  PID:10604
- C:\Windows\System\VXdcRdO.exe
  C:\Windows\System\VXdcRdO.exe
  2⤵
  PID:10632
- C:\Windows\System\VaGWtQJ.exe
  C:\Windows\System\VaGWtQJ.exe
  2⤵
  PID:10660
- C:\Windows\System\GHEyrbU.exe
  C:\Windows\System\GHEyrbU.exe
  2⤵
  PID:10688
- C:\Windows\System\DwXnoXl.exe
  C:\Windows\System\DwXnoXl.exe
  2⤵
  PID:10704
- C:\Windows\System\RAxJerU.exe
  C:\Windows\System\RAxJerU.exe
  2⤵
  PID:10724
- C:\Windows\System\YFMDfHt.exe
  C:\Windows\System\YFMDfHt.exe
  2⤵
  PID:10744
- C:\Windows\System\RgwMGOU.exe
  C:\Windows\System\RgwMGOU.exe
  2⤵
  PID:10780
- C:\Windows\System\naqBZYi.exe
  C:\Windows\System\naqBZYi.exe
  2⤵
  PID:10832
- C:\Windows\System\fkIajtG.exe
  C:\Windows\System\fkIajtG.exe
  2⤵
  PID:10852
- C:\Windows\System\YRQFYbd.exe
  C:\Windows\System\YRQFYbd.exe
  2⤵
  PID:10888
- C:\Windows\System\nLsisKm.exe
  C:\Windows\System\nLsisKm.exe
  2⤵
  PID:10912
- C:\Windows\System\IKSLYAZ.exe
  C:\Windows\System\IKSLYAZ.exe
  2⤵
  PID:10936
- C:\Windows\System\APGLpMj.exe
  C:\Windows\System\APGLpMj.exe
  2⤵
  PID:10972
- C:\Windows\System\ediZNvq.exe
  C:\Windows\System\ediZNvq.exe
  2⤵
  PID:10992
- C:\Windows\System\KItNrLr.exe
  C:\Windows\System\KItNrLr.exe
  2⤵
  PID:11020
- C:\Windows\System\rOmkvcx.exe
  C:\Windows\System\rOmkvcx.exe
  2⤵
  PID:11056
- C:\Windows\System\OcCnQsD.exe
  C:\Windows\System\OcCnQsD.exe
  2⤵
  PID:11096
- C:\Windows\System\OeuLVxB.exe
  C:\Windows\System\OeuLVxB.exe
  2⤵
  PID:11116
- C:\Windows\System\OlHSHCC.exe
  C:\Windows\System\OlHSHCC.exe
  2⤵
  PID:11140
- C:\Windows\System\vOmmlkl.exe
  C:\Windows\System\vOmmlkl.exe
  2⤵
  PID:11168
- C:\Windows\System\GuIQXUM.exe
  C:\Windows\System\GuIQXUM.exe
  2⤵
  PID:11192
- C:\Windows\System\VCwNwFN.exe
  C:\Windows\System\VCwNwFN.exe
  2⤵
  PID:11236
- C:\Windows\System\XkFRHAn.exe
  C:\Windows\System\XkFRHAn.exe
  2⤵
  PID:9940
- C:\Windows\System\wSrCEkx.exe
  C:\Windows\System\wSrCEkx.exe
  2⤵
  PID:10212
- C:\Windows\System\NKOteQy.exe
  C:\Windows\System\NKOteQy.exe
  2⤵
  PID:10308
- C:\Windows\System\WjgNlMf.exe
  C:\Windows\System\WjgNlMf.exe
  2⤵
  PID:10336
- C:\Windows\System\IaXeUgI.exe
  C:\Windows\System\IaXeUgI.exe
  2⤵
  PID:10292
- C:\Windows\System\RnxOeLL.exe
  C:\Windows\System\RnxOeLL.exe
  2⤵
  PID:10400
- C:\Windows\System\DnmDDeP.exe
  C:\Windows\System\DnmDDeP.exe
  2⤵
  PID:10472
- C:\Windows\System\gnZmgyb.exe
  C:\Windows\System\gnZmgyb.exe
  2⤵
  PID:10508
- C:\Windows\System\mocHVUL.exe
  C:\Windows\System\mocHVUL.exe
  2⤵
  PID:10568
- C:\Windows\System\WFhJjED.exe
  C:\Windows\System\WFhJjED.exe
  2⤵
  PID:10668
- C:\Windows\System\FrEmXSg.exe
  C:\Windows\System\FrEmXSg.exe
  2⤵
  PID:10696
- C:\Windows\System\NSBJdvu.exe
  C:\Windows\System\NSBJdvu.exe
  2⤵
  PID:10772
- C:\Windows\System\TuzxOtb.exe
  C:\Windows\System\TuzxOtb.exe
  2⤵
  PID:10828
- C:\Windows\System\pFUAjZg.exe
  C:\Windows\System\pFUAjZg.exe
  2⤵
  PID:10900
- C:\Windows\System\MRELcle.exe
  C:\Windows\System\MRELcle.exe
  2⤵
  PID:10948
- C:\Windows\System\RALdecT.exe
  C:\Windows\System\RALdecT.exe
  2⤵
  PID:11068
- C:\Windows\System\GxlXgEN.exe
  C:\Windows\System\GxlXgEN.exe
  2⤵
  PID:11112
- C:\Windows\System\TeMlShj.exe
  C:\Windows\System\TeMlShj.exe
  2⤵
  PID:11176
- C:\Windows\System\CoApAMV.exe
  C:\Windows\System\CoApAMV.exe
  2⤵
  PID:11220
- C:\Windows\System\jJfYMPM.exe
  C:\Windows\System\jJfYMPM.exe
  2⤵
  PID:10456
- C:\Windows\System\SAOtAhj.exe
  C:\Windows\System\SAOtAhj.exe
  2⤵
  PID:10480
- C:\Windows\System\IgmpSzp.exe
  C:\Windows\System\IgmpSzp.exe
  2⤵
  PID:10564
- C:\Windows\System\ayucLfJ.exe
  C:\Windows\System\ayucLfJ.exe
  2⤵
  PID:10740
- C:\Windows\System\DdrXecB.exe
  C:\Windows\System\DdrXecB.exe
  2⤵
  PID:11012
- C:\Windows\System\cwixXZC.exe
  C:\Windows\System\cwixXZC.exe
  2⤵
  PID:11212
- C:\Windows\System\HgIOopz.exe
  C:\Windows\System\HgIOopz.exe
  2⤵
  PID:11184
- C:\Windows\System\ByqzhQr.exe
  C:\Windows\System\ByqzhQr.exe
  2⤵
  PID:10380
- C:\Windows\System\upkrSwD.exe
  C:\Windows\System\upkrSwD.exe
  2⤵
  PID:10600
- C:\Windows\System\QgmFBhx.exe
  C:\Windows\System\QgmFBhx.exe
  2⤵
  PID:10860
- C:\Windows\System\JJAqGJh.exe
  C:\Windows\System\JJAqGJh.exe
  2⤵
  PID:10732
- C:\Windows\System\hVDanAj.exe
  C:\Windows\System\hVDanAj.exe
  2⤵
  PID:10932
- C:\Windows\System\nVDjWjX.exe
  C:\Windows\System\nVDjWjX.exe
  2⤵
  PID:10628
- C:\Windows\System\EIOJDun.exe
  C:\Windows\System\EIOJDun.exe
  2⤵
  PID:11312
- C:\Windows\System\EACJnQb.exe
  C:\Windows\System\EACJnQb.exe
  2⤵
  PID:11344
- C:\Windows\System\xLFupWh.exe
  C:\Windows\System\xLFupWh.exe
  2⤵
  PID:11368
- C:\Windows\System\CJUYffA.exe
  C:\Windows\System\CJUYffA.exe
  2⤵
  PID:11404
- C:\Windows\System\lGFkIOS.exe
  C:\Windows\System\lGFkIOS.exe
  2⤵
  PID:11440
- C:\Windows\System\EByZKvc.exe
  C:\Windows\System\EByZKvc.exe
  2⤵
  PID:11460
- C:\Windows\System\YUSemdx.exe
  C:\Windows\System\YUSemdx.exe
  2⤵
  PID:11500
- C:\Windows\System\NOJJwqq.exe
  C:\Windows\System\NOJJwqq.exe
  2⤵
  PID:11516
- C:\Windows\System\hbMRsvx.exe
  C:\Windows\System\hbMRsvx.exe
  2⤵
  PID:11536
- C:\Windows\System\oeQGshB.exe
  C:\Windows\System\oeQGshB.exe
  2⤵
  PID:11552
- C:\Windows\System\fipYIcp.exe
  C:\Windows\System\fipYIcp.exe
  2⤵
  PID:11576
- C:\Windows\System\zSiBOhO.exe
  C:\Windows\System\zSiBOhO.exe
  2⤵
  PID:11624
- C:\Windows\System\kXjJFvr.exe
  C:\Windows\System\kXjJFvr.exe
  2⤵
  PID:11644
- C:\Windows\System\EWHFnUR.exe
  C:\Windows\System\EWHFnUR.exe
  2⤵
  PID:11724
- C:\Windows\System\KAWTlqd.exe
  C:\Windows\System\KAWTlqd.exe
  2⤵
  PID:11740
- C:\Windows\System\UJNGHSM.exe
  C:\Windows\System\UJNGHSM.exe
  2⤵
  PID:11768
- C:\Windows\System\nZIpfsH.exe
  C:\Windows\System\nZIpfsH.exe
  2⤵
  PID:11792
- C:\Windows\System\PHWTvco.exe
  C:\Windows\System\PHWTvco.exe
  2⤵
  PID:11812
- C:\Windows\System\FSxKKry.exe
  C:\Windows\System\FSxKKry.exe
  2⤵
  PID:11828
- C:\Windows\System\DFTPwpe.exe
  C:\Windows\System\DFTPwpe.exe
  2⤵
  PID:11868
- C:\Windows\System\KgNEtsT.exe
  C:\Windows\System\KgNEtsT.exe
  2⤵
  PID:11888
- C:\Windows\System\IicrFpE.exe
  C:\Windows\System\IicrFpE.exe
  2⤵
  PID:11916
- C:\Windows\System\FBpSCNu.exe
  C:\Windows\System\FBpSCNu.exe
  2⤵
  PID:11940
- C:\Windows\System\sQKWdmj.exe
  C:\Windows\System\sQKWdmj.exe
  2⤵
  PID:11964
- C:\Windows\System\KvlZYZf.exe
  C:\Windows\System\KvlZYZf.exe
  2⤵
  PID:11996
- C:\Windows\System\QUBuazK.exe
  C:\Windows\System\QUBuazK.exe
  2⤵
  PID:12024
- C:\Windows\System\kFwddDB.exe
  C:\Windows\System\kFwddDB.exe
  2⤵
  PID:12064
- C:\Windows\System\FCryKMJ.exe
  C:\Windows\System\FCryKMJ.exe
  2⤵
  PID:12104
- C:\Windows\System\QOoQWOc.exe
  C:\Windows\System\QOoQWOc.exe
  2⤵
  PID:12120
- C:\Windows\System\Ztplqlh.exe
  C:\Windows\System\Ztplqlh.exe
  2⤵
  PID:12144
- C:\Windows\System\JzXzIOw.exe
  C:\Windows\System\JzXzIOw.exe
  2⤵
  PID:12184
- C:\Windows\System\xIzudEi.exe
  C:\Windows\System\xIzudEi.exe
  2⤵
  PID:12200
- C:\Windows\System\ZlKZMUP.exe
  C:\Windows\System\ZlKZMUP.exe
  2⤵
  PID:12244
- C:\Windows\System\tlFLoRB.exe
  C:\Windows\System\tlFLoRB.exe
  2⤵
  PID:12268
- C:\Windows\System\TFEDkaw.exe
  C:\Windows\System\TFEDkaw.exe
  2⤵
  PID:11132
- C:\Windows\System\wRkeEyB.exe
  C:\Windows\System\wRkeEyB.exe
  2⤵
  PID:11304
- C:\Windows\System\omzbbXc.exe
  C:\Windows\System\omzbbXc.exe
  2⤵
  PID:11360
- C:\Windows\System\nlnjFAe.exe
  C:\Windows\System\nlnjFAe.exe
  2⤵
  PID:11416
- C:\Windows\System\MbumlZU.exe
  C:\Windows\System\MbumlZU.exe
  2⤵
  PID:11448
- C:\Windows\System\tYOEwQt.exe
  C:\Windows\System\tYOEwQt.exe
  2⤵
  PID:11508
- C:\Windows\System\HMznvGC.exe
  C:\Windows\System\HMznvGC.exe
  2⤵
  PID:11676
- C:\Windows\System\FXHvEhP.exe
  C:\Windows\System\FXHvEhP.exe
  2⤵
  PID:11704
- C:\Windows\System\SxuIrbi.exe
  C:\Windows\System\SxuIrbi.exe
  2⤵
  PID:11756
- C:\Windows\System\mviVJei.exe
  C:\Windows\System\mviVJei.exe
  2⤵
  PID:11844
- C:\Windows\System\kwkmEYR.exe
  C:\Windows\System\kwkmEYR.exe
  2⤵
  PID:11860
- C:\Windows\System\uSMmMid.exe
  C:\Windows\System\uSMmMid.exe
  2⤵
  PID:11956
- C:\Windows\System\etctVUb.exe
  C:\Windows\System\etctVUb.exe
  2⤵
  PID:11988
- C:\Windows\System\suqeapo.exe
  C:\Windows\System\suqeapo.exe
  2⤵
  PID:12044
- C:\Windows\System\DLCRgNu.exe
  C:\Windows\System\DLCRgNu.exe
  2⤵
  PID:12136
- C:\Windows\System\apWWZvj.exe
  C:\Windows\System\apWWZvj.exe
  2⤵
  PID:12192
- C:\Windows\System\lWFWknC.exe
  C:\Windows\System\lWFWknC.exe
  2⤵
  PID:12264
- C:\Windows\System\SoxSsZd.exe
  C:\Windows\System\SoxSsZd.exe
  2⤵
  PID:10332
- C:\Windows\System\iJSELUd.exe
  C:\Windows\System\iJSELUd.exe
  2⤵
  PID:11388
- C:\Windows\System\GdtqquS.exe
  C:\Windows\System\GdtqquS.exe
  2⤵
  PID:11568
- C:\Windows\System\dMulfCa.exe
  C:\Windows\System\dMulfCa.exe
  2⤵
  PID:11280
- C:\Windows\System\xVCYxcj.exe
  C:\Windows\System\xVCYxcj.exe
  2⤵
  PID:11984
- C:\Windows\System\NKisuny.exe
  C:\Windows\System\NKisuny.exe
  2⤵
  PID:12208
- C:\Windows\System\iPvdJtE.exe
  C:\Windows\System\iPvdJtE.exe
  2⤵
  PID:11328
- C:\Windows\System\DyiMFCk.exe
  C:\Windows\System\DyiMFCk.exe
  2⤵
  PID:11732
- C:\Windows\System\LufEaRc.exe
  C:\Windows\System\LufEaRc.exe
  2⤵
  PID:11476
- C:\Windows\System\aYhZFVh.exe
  C:\Windows\System\aYhZFVh.exe
  2⤵
  PID:1280
- C:\Windows\System\PGOpUBU.exe
  C:\Windows\System\PGOpUBU.exe
  2⤵
  PID:12284
- C:\Windows\System\kVdcFPr.exe
  C:\Windows\System\kVdcFPr.exe
  2⤵
  PID:3468
- C:\Windows\System\LlEWEdW.exe
  C:\Windows\System\LlEWEdW.exe
  2⤵
  PID:12308
- C:\Windows\System\lOUHjxO.exe
  C:\Windows\System\lOUHjxO.exe
  2⤵
  PID:12332
- C:\Windows\System\fhaofjT.exe
  C:\Windows\System\fhaofjT.exe
  2⤵
  PID:12372
- C:\Windows\System\giTMmco.exe
  C:\Windows\System\giTMmco.exe
  2⤵
  PID:12408
- C:\Windows\System\IyOVMtq.exe
  C:\Windows\System\IyOVMtq.exe
  2⤵
  PID:12436
- C:\Windows\System\iWBCOGz.exe
  C:\Windows\System\iWBCOGz.exe
  2⤵
  PID:12464
- C:\Windows\System\lHVFFuw.exe
  C:\Windows\System\lHVFFuw.exe
  2⤵
  PID:12492
- C:\Windows\System\QqXezSk.exe
  C:\Windows\System\QqXezSk.exe
  2⤵
  PID:12516
- C:\Windows\System\fyGjXJp.exe
  C:\Windows\System\fyGjXJp.exe
  2⤵
  PID:12556
- C:\Windows\System\HOKgAIP.exe
  C:\Windows\System\HOKgAIP.exe
  2⤵
  PID:12576
- C:\Windows\System\dPCsIDG.exe
  C:\Windows\System\dPCsIDG.exe
  2⤵
  PID:12600
- C:\Windows\System\LyNQEMK.exe
  C:\Windows\System\LyNQEMK.exe
  2⤵
  PID:12636
- C:\Windows\System\OtADWiQ.exe
  C:\Windows\System\OtADWiQ.exe
  2⤵
  PID:12656
- C:\Windows\System\UeWRjlw.exe
  C:\Windows\System\UeWRjlw.exe
  2⤵
  PID:12676
- C:\Windows\System\txhOdmS.exe
  C:\Windows\System\txhOdmS.exe
  2⤵
  PID:12704
- C:\Windows\System\cnwtvql.exe
  C:\Windows\System\cnwtvql.exe
  2⤵
  PID:12732
- C:\Windows\System\mxyeUKH.exe
  C:\Windows\System\mxyeUKH.exe
  2⤵
  PID:12752
- C:\Windows\System\OEptifZ.exe
  C:\Windows\System\OEptifZ.exe
  2⤵
  PID:12776
- C:\Windows\System\pfKiyWw.exe
  C:\Windows\System\pfKiyWw.exe
  2⤵
  PID:12796
- C:\Windows\System\OYLzsnB.exe
  C:\Windows\System\OYLzsnB.exe
  2⤵
  PID:12828
- C:\Windows\System\KyMgySO.exe
  C:\Windows\System\KyMgySO.exe
  2⤵
  PID:12872
- C:\Windows\System\fcSbOox.exe
  C:\Windows\System\fcSbOox.exe
  2⤵
  PID:12900
- C:\Windows\System\xkoLEGv.exe
  C:\Windows\System\xkoLEGv.exe
  2⤵
  PID:12920
- C:\Windows\System\mImZmOt.exe
  C:\Windows\System\mImZmOt.exe
  2⤵
  PID:12952
- C:\Windows\System\QvpjOnx.exe
  C:\Windows\System\QvpjOnx.exe
  2⤵
  PID:12972
- C:\Windows\System\TRjLogq.exe
  C:\Windows\System\TRjLogq.exe
  2⤵
  PID:12992
- C:\Windows\System\FPHaVAd.exe
  C:\Windows\System\FPHaVAd.exe
  2⤵
  PID:13016
- C:\Windows\System\NnScqQU.exe
  C:\Windows\System\NnScqQU.exe
  2⤵
  PID:13048
- C:\Windows\System\IlCkqzw.exe
  C:\Windows\System\IlCkqzw.exe
  2⤵
  PID:13076
- C:\Windows\System\BwVixBH.exe
  C:\Windows\System\BwVixBH.exe
  2⤵
  PID:13100
- C:\Windows\System\nlhTKCY.exe
  C:\Windows\System\nlhTKCY.exe
  2⤵
  PID:13120
- C:\Windows\System\UDkWfJv.exe
  C:\Windows\System\UDkWfJv.exe
  2⤵
  PID:13140
- C:\Windows\System\sPeUHFQ.exe
  C:\Windows\System\sPeUHFQ.exe
  2⤵
  PID:13172
- C:\Windows\System\NzZVAZs.exe
  C:\Windows\System\NzZVAZs.exe
  2⤵
  PID:13208
- C:\Windows\System\wvrkwvH.exe
  C:\Windows\System\wvrkwvH.exe
  2⤵
  PID:13236
- C:\Windows\System\bYqlfts.exe
  C:\Windows\System\bYqlfts.exe
  2⤵
  PID:13308
- C:\Windows\System\XtdeChu.exe
  C:\Windows\System\XtdeChu.exe
  2⤵
  PID:12340
- C:\Windows\System\rSHZPES.exe
  C:\Windows\System\rSHZPES.exe
  2⤵
  PID:12396
- C:\Windows\System\WQnpgBk.exe
  C:\Windows\System\WQnpgBk.exe
  2⤵
  PID:12424
- C:\Windows\System\GSwAVMB.exe
  C:\Windows\System\GSwAVMB.exe
  2⤵
  PID:12488
- C:\Windows\System\oIOXJBh.exe
  C:\Windows\System\oIOXJBh.exe
  2⤵
  PID:12540
- C:\Windows\System\hQhsEFC.exe
  C:\Windows\System\hQhsEFC.exe
  2⤵
  PID:3876
- C:\Windows\System\OmXQwxM.exe
  C:\Windows\System\OmXQwxM.exe
  2⤵
  PID:12860
- C:\Windows\System\kKsiBoB.exe
  C:\Windows\System\kKsiBoB.exe
  2⤵
  PID:13220
- C:\Windows\System\rVhdGkS.exe
  C:\Windows\System\rVhdGkS.exe
  2⤵
  PID:13188
- C:\Windows\System\XoOriSP.exe
  C:\Windows\System\XoOriSP.exe
  2⤵
  PID:13252
- C:\Windows\System\lMWIviS.exe
  C:\Windows\System\lMWIviS.exe
  2⤵
  PID:12300
- C:\Windows\System\wNlnSMV.exe
  C:\Windows\System\wNlnSMV.exe
  2⤵
  PID:2236
- C:\Windows\System\BGkGKwB.exe
  C:\Windows\System\BGkGKwB.exe
  2⤵
  PID:12568
- C:\Windows\System\bKtIlqA.exe
  C:\Windows\System\bKtIlqA.exe
  2⤵
  PID:12668
- C:\Windows\System\sWeduOm.exe
  C:\Windows\System\sWeduOm.exe
  2⤵
  PID:12740
- C:\Windows\System\oiZywpu.exe
  C:\Windows\System\oiZywpu.exe
  2⤵
  PID:12824
- C:\Windows\System\qTwZEWd.exe
  C:\Windows\System\qTwZEWd.exe
  2⤵
  PID:12968
- C:\Windows\System\vDqHsgu.exe
  C:\Windows\System\vDqHsgu.exe
  2⤵
  PID:12944
- C:\Windows\System\vctqiDK.exe
  C:\Windows\System\vctqiDK.exe
  2⤵
  PID:13132
- C:\Windows\System\bLAdtTy.exe
  C:\Windows\System\bLAdtTy.exe
  2⤵
  PID:13084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_boexr4ey.f2y.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AybTkYb.exe

Filesize
1.9MB

MD5
4d11ae02e7d3bbb00450037b845ab4bc

SHA1
08283b69d882ce598dd4e92f48cdbd475668bce9

SHA256
292e2093a8aa52725a95ec32e5acd9b1b4d7361632c7855f18317b771709614a

SHA512
ce5b498f6a523160d77b0c5bb3e87c6dd30c7f4ab48003a18915549207443337475c265fe8494c587b3b14d5a9e4ba43285748f939ecd7a7188080da7e616305

Download Submit
C:\Windows\System\CCoDAnL.exe

Filesize
1.9MB

MD5
e7a8df29fd5ffdc36eb5a268775c0422

SHA1
2120b1ed973a3843e3d57fed8cffe9f406b242a9

SHA256
608546842eb6b3e708a05892515a1956ad7c179ca2a6e475dff8e8f3ada4c424

SHA512
78217762833d441854785d5b2914cfd8dbd2afacf57414541ea475635a06da295986007ccc774f3cc662a1a7e147ab06c25902695f353f7441913e7923f53f9b

Download Submit
C:\Windows\System\DVUbQle.exe

Filesize
1.9MB

MD5
87f9ab2563e95024e7ab3c86f5a2c8be

SHA1
2c43fb9dc6fc2ff31d6bf47540908e18ca7dceac

SHA256
159abcceb5f481e29fad17de876f1d3514436174040c951056a9dfe081c73837

SHA512
f97ece12b4bdca84d28b8860095016a1595ff2243ae5bfab0be3af435942f743067780afab5aa9832981eb22b0061818b8ddacf7fcc179785fd1fb8570069d72

Download Submit
C:\Windows\System\DsDKLfv.exe

Filesize
1.9MB

MD5
6fc40db2e7751a49c582f360189f306e

SHA1
fc48762de5a00c7aa8461aba58d07cfd64057a58

SHA256
56dc640dade465246f00661a7d1c3182876d6e9958e801f42f2f130902e6b52e

SHA512
d43130a9373cbc830ef8b126bae88107781e39577cc31eb54307949a8c7e4eb1bf67af2905e200aa7befbc6dc96d4cda1348206a43f390fef69b94b291d094d0

Download Submit
C:\Windows\System\Gjocajg.exe

Filesize
1.9MB

MD5
c60560b7ff2619df06c34a65c957ad33

SHA1
cf72a4cb62fc495d07cd27101d61b06909bc22ef

SHA256
f6d7cb0509eaaceada82700b2984edd42f452698e71c9e2a94c5c7933dc91cb3

SHA512
879a5fbe39d704a9b77da9c3959b2d081dbaf76a1c30f385ec4c3b5fc8f89d0ce1a29f90ad7090e2c17c8f4e7e2a3fe0164e99d75fcaa73e2e1a8e0fda29b790

Download Submit
C:\Windows\System\HRhSJVY.exe

Filesize
1.9MB

MD5
e32500fbe40148e2af4dc272b54f2529

SHA1
ea60a8b4de902fd41bab26cf33d475ad0ad34dd6

SHA256
f8edd0bfd9a7089f7f9bf0e85f4608b47daabcf271599488373f8858befce683

SHA512
b4e6a7539021e147a6ae183e2ce5d5b6c4542ed855edb54b7abb6b1d36912fb2e97668d5fe0eb6453f24e5552fb8aaf6c1f9fec965a9742c257b90383f797a1b

Download Submit
C:\Windows\System\HVOnXQP.exe

Filesize
1.9MB

MD5
80acea61a65d92aeea67fe0c1323e7a8

SHA1
2d9475b886f8f309e897a38d0b26de1e80abae7b

SHA256
b22d97ea2b484190cb5a2afdbd953caa73a4a4ee2d95779cd7c08a27a27346bf

SHA512
22dafd75ab2a9104dba5e3a3c9562c2ec5bf89a26874920e6065aedebab1a038f82fa1595ec7a170691b6a69784ce3f67feedddd72937806eae45baeeadd3ab6

Download Submit
C:\Windows\System\IcGQvIF.exe

Filesize
1.9MB

MD5
0c1af5d88f6615257ae5b278f836fe95

SHA1
042e171a85a28f491a789b2a21d702ae06860424

SHA256
5f575777460a5afab09c122fd064ff48639ed5390eaa6a9df24b79294bb31cea

SHA512
2a686e0b9c01e1f7017604bc6fb93be4c039e74beda3716321e2f16929cb8edb09a8d8cd048b74496977e8a5cac842330163ccb4171ebcef0695fbc04c1e63fa

Download Submit
C:\Windows\System\IjLgpjE.exe

Filesize
1.9MB

MD5
e9040f88be2686877a9025ec03bbcebf

SHA1
2bfd97641a35ee7f9db518351b816a1110c1a7a5

SHA256
addc4e1040b4be3ef276ec676a7c02c269bb2350eb68f99235b81dc7e470a675

SHA512
d350324c146e4d8acbc81fd57f68dd804585359086cdf57a9968ae3f29b73b9352e65f638f30bededda97b256df36f1ae9c6d4a87a5f9acf43aaf085ca672337

Download Submit
C:\Windows\System\LPXFCjQ.exe

Filesize
1.9MB

MD5
f8e9114cabd4a5339ec40cfba0675dee

SHA1
8c748d55a526b00ed6531218b481d0a9dcdd2293

SHA256
d5c6ab9e0c2f6ddd1091049bbc9402a101aafa5790f12c3fa2831609ed473aa1

SHA512
2289c46d4cf648669a0a3e4e5db1f469fc9485978126a8de9a49fea955e1628701f43d6d4cc5d78bdbb2f68940d376c1449a5f258152294fca8d3fb925b21e49

Download Submit
C:\Windows\System\LjHcWUK.exe

Filesize
1.9MB

MD5
e865d944bb174e0d1d9759ea785de336

SHA1
8ce99364af388f8cad6565f653130bfe77a251d4

SHA256
493a68011c5d90aafcf161ad4ad0e9c7d6a5d22cd648b9de16c2cce03380235d

SHA512
fe8aae1d1799e54503a70a505589eaf3e2d8cb7dd2046b1b4faf4293800e722ada0d717ff82a346b6d54093f9362a4c3097878072d524472266a96596d37df3d

Download Submit
C:\Windows\System\MrlBkYh.exe

Filesize
1.9MB

MD5
216ebcad5f400d1eb9d7b7aa17e784e0

SHA1
25690e6289f73edb93681ec28c8c73d69220aecd

SHA256
b27da7923950a2daae449aab5314e8ecfeba2eb7195674304d37182cfbbb5ad6

SHA512
123936fc649398f62fe69c4d95ea9e41c3d14abaeffee4e679f6e573ff4a7daa91884bc90c787b68a70417743299d6c1bbfbc4cfe2ac65189770f826b545e0fe

Download Submit
C:\Windows\System\OCJoOTd.exe

Filesize
1.9MB

MD5
bfbcea553212c290b344361c3da099ba

SHA1
451e1ab15bc48589638545d829f65f2e07682a48

SHA256
949a8e64d9d05de4a9955c7c2ca7d2f708a62455b0489912a1aefb660bc9666c

SHA512
06336ff5edd0aaf899d67e4b87bb6b88e1784217d2e1c9fe70246d765a2e8e3fa6b4067ee6a479e2eae125022f7dd7fd52bfa4fce3230893c845686dc763dc07

Download Submit
C:\Windows\System\PZClkHr.exe

Filesize
1.9MB

MD5
6cf7d8f07ee17c2be1293860a41f168d

SHA1
d046aaa9b2aa6d020547567692379b52b503e82a

SHA256
6404c3c66fc358b8cf00e21f5955541724eaa33b564f7b9ae3a1eb1823b7433e

SHA512
cf1667dbf019484dbe5030cde5b1ec16d65088a95f4f6b8ad1c677d97990814ee12bb9e3dbfe0f7363cd7859a511f09789f2c5132d1cd8985886f1fe2b9fa9cd

Download Submit
C:\Windows\System\SLCphcl.exe

Filesize
8B

MD5
a8f2921c80c15a3d426e5fdff8a56196

SHA1
4dc21bf95e22427a9dafcd4930e81b62e77d5fda

SHA256
7e9bbeeba45dae16f8c444596ee4180d7313e899e46fa6263fde6904f32d92a1

SHA512
996666f646b1878ee129a778184f9520541ee458797b8bfaefed6e1f152a5436e0ff19d28744463b706ffe3e24e429f5af102aa1e7733dbeeb6210754c828802

Download Submit
C:\Windows\System\XEWckKU.exe

Filesize
1.9MB

MD5
a1b1f8ecb2ac3ce78ea5e0b6149625e6

SHA1
f62f8362d42304980134d602c7f32c7a61916134

SHA256
a33e88579f34ad1a3eddde18d45d08c880bee5f5ab2eee436585f05121456a45

SHA512
8fc4206d7247f315b77b0a0d79ede3e2e2a8b9362b0735141dee348a9a2d2c51dbc6b7213c7653f601f592c660c2a010894ecd8c2a4e6d1e055a438a756e0cc3

Download Submit
C:\Windows\System\aUUbnoN.exe

Filesize
1.9MB

MD5
4ff4e2708e8fbb738a2a479b2ee743aa

SHA1
41b6b570c1c74ca72699cb8ec443383e8a2ebfec

SHA256
5149830cb8902962d1870dd69607f20816377db4057937d07d890b0f6f3e3ccd

SHA512
e54884baae7acbe9a3099d844364d6dbac5f8f6c3d3f8ff70e2a5116d6173c9322c5d8de4f7ea482fa356da35d24454e1311a1bae868cdc600f1fd44bc976ab3

Download Submit
C:\Windows\System\axuCLoa.exe

Filesize
1.9MB

MD5
f76423bf7e23b57aa4a36b85b3058c6b

SHA1
9d19fad923a9abf315957235234e87f6f26c4a0a

SHA256
40e0d1777959741bcbdaaca532b828e41123cef9a63588f74af5130d71a76003

SHA512
b24094c4fea43f7de389ddccb3444935cd11d0d44784cb25867095b90ef9b3140126673111d9cdb3949bd1043472888e98f3629218f88de25f3c5a46dadc2f3b

Download Submit
C:\Windows\System\dNFNDgN.exe

Filesize
1.9MB

MD5
6944e00a2f34736e323ee70ee0cc4599

SHA1
932cefab6ddf5f0f95c828249143b9edb6c0c37c

SHA256
55beb5f7934ed34d0abed2ff31b5ccb738b3b60a0865f356a3048a3137afaecd

SHA512
57dc15eb3267619994c31fcec0a8ed89f4561e0fa12451063da203639918cba4f9beb57b712ec647aad6a9e638679a8042b2d265c59174b18460faae1dc935cf

Download Submit
C:\Windows\System\dNYnCbo.exe

Filesize
1.9MB

MD5
2a264b65477184ec4b0525a808cd142c

SHA1
1e160f3e88235f1bd74de6f27a293d12ed0c9ac9

SHA256
db935d5708893fdf22c556b85c4036524bc5a792f420c060b0442da4a869c530

SHA512
2e278900a68e53d45be45c21f1e2869fbb018c1b282ee2d86c373d4180891eb7109ec06b9cfac417d086b2d09817bcd43af1c6efdf045ac097fe3b7bf991756a

Download Submit
C:\Windows\System\dndpnoE.exe

Filesize
1.9MB

MD5
79a6be060ab121ce71aa93ab90348a82

SHA1
2ec3f509ce0e98cbada9d87b2d23fd70c2b03ffd

SHA256
f601eb1f4a52d9a9c114808e94ee84868d05639349cd78879e8a7931c3a5c154

SHA512
312b5960689bdbb205e0bdebe60331c0d0d76c360b2efe6939a614736bdfd37f1c41e6b572a88232485befe4df9e4ddaf83ea222a23ab69f0c7da4bdafd0db4b

Download Submit
C:\Windows\System\eJORyAY.exe

Filesize
1.9MB

MD5
f5098527664586e22cf154f734928b0e

SHA1
79a3fb233c5e7ce7609a7dc6895a9867cbe192e3

SHA256
d82f94998d3085ad195fe18a5f14ba32611e82687644a5d60ec8ea1121ae8ef1

SHA512
470977abb053db42f405fa1163c88d8a372d100fc85a0b9f586757b5e37df45dd67cfc57b96ad899584f3ca25e5d4f6891d07ee2e0e3ebc8780f46d2aa7b2c48

Download Submit
C:\Windows\System\fKQHdZx.exe

Filesize
1.9MB

MD5
f896be4ee5580a4071f7748e205cfd5e

SHA1
ef19c1342b3d5ff87825aba2e1b0d6880af9f692

SHA256
094b7a4dda0cd9fc029ed6b201882a1d41b95be783acba069233237a16649cb1

SHA512
f4fe3b2a9858172f136219c184662927906e2fa8d57ae5b5d5ef609311aa1ea6042e0ae4289e920635a37a97e956f395698e4f7076b8ec53fd98ecd27cb81844

Download Submit
C:\Windows\System\gffgJtV.exe

Filesize
1.9MB

MD5
47713e727504c38315899a1caefbe3c8

SHA1
4792c0ceee36a6b2b4cee4f937f6bc19f5eba391

SHA256
bcd82e97cce37b27f5b366dcd2830893b6c7599b1feac26a4b95716eaf0ea3d8

SHA512
6fc4de110a7a0de32087262c0108c49db70411ca769e04b9f1b7e34362d438bc436dfa5632859d793821a41b5dbf1204a4b96da477c158ce9c78258ed51af960

Download Submit
C:\Windows\System\iXRHaki.exe

Filesize
1.9MB

MD5
49703aa7b14aad79f36410ab41bb87c0

SHA1
ed18eb06085c382c6279ccefc64f2b81f9a77817

SHA256
5240be282996ea61c9d479b8501e9a6a885e58a3f8c8c4915ffb76bc5f517962

SHA512
3f58c66a1b98df6cacb9cf19a3feda2cc1234f221e5408674676a4ff781ca80967f1db2596317773c1229050aef53949c07a4fd8202456bdb52e3ae2f610ecd9

Download Submit
C:\Windows\System\jNkWWVy.exe

Filesize
1.9MB

MD5
26dea2634b6b338f9c153f6ff5467f00

SHA1
0fdce64d7e1544236a30b23473ae79ce5c210168

SHA256
37728306615d97b4dcab1c7df69db267ac464bcad8b77292e61387c5738748c8

SHA512
d5e0ea7baa8fbed5d114da4bed3c7913a7016831af36ba665adf8b2f1606a926b3446719d1a7bf02011d8575d4c5cb192feba7d6a781ca0f20960bce4b481ca8

Download Submit
C:\Windows\System\nQAyWth.exe

Filesize
1.9MB

MD5
ee6f15c79773f9d2018317ea9a0d2754

SHA1
207f0c6f99a6255081ab3d4847caed435ed3ba3d

SHA256
8ba05078e829e8b187b899151013b1749f89ca42a29aa68b32756a7acfe1cb68

SHA512
5f4fdfe55f705ee08c5a533c2cc5673b8eacd88a4db1841d9e96590bb301ea6b4b0c3fcb736d0ddab844c52c08bb0a81a5db9dfc4e60377d17b51648a8d8b713

Download Submit
C:\Windows\System\ncTWgHL.exe

Filesize
1.9MB

MD5
75cc9fcaa74e0020ef1f496bfa49fd58

SHA1
cc8917f5c2cec08c96bc7155812dd5b91ec7afed

SHA256
e28cf564ae10e64ce78c616ebdc7758978c23dc8fa78fe875a036ae75d0ed4e5

SHA512
47865f5f2b4f2d2ec2583b7c07083dcb672baef9dcb292bd190859fb81aedc0ff06c34b8717b376e51585724c4ee1c52111950b728abaf307767bfa931a8a966

Download Submit
C:\Windows\System\oiavWIT.exe

Filesize
1.9MB

MD5
ba554f41a2c8c7603b01ab0b7f0c6294

SHA1
599b3a0f193c5220cac1fb25048bedceb125faf5

SHA256
9475c499201a46e36de4c695f7958897bd17637272e4e92e1df87a1138060609

SHA512
ea79f14e16c8f260132e72d089443e5bfbd876314ac1e1e8a93eda30534a3674713a1eb98be49f8ae8a33837cb990bc55985191be9ba705000e70f626dda2e4c

Download Submit
C:\Windows\System\poKvJPs.exe

Filesize
1.9MB

MD5
86c574cb0a59c1fd01ef661fa9dc8985

SHA1
9a22a6df14a46810393b7b35d66452332257a365

SHA256
da0343fb44b196b672381b46296e487c77aa0951c0a9161620460bbd89fadbd7

SHA512
2ca2c73c9833b61b7473ccfd7ceb1e0b5c3ad5b5e8921f6a682c2e29dfab760714792a6d9d7a82d79322e8634d57c1e2b5a6204cb1d5618839d6aa668ea065cb

Download Submit
C:\Windows\System\qnUJSnq.exe

Filesize
1.9MB

MD5
50507dd76ba76974feee6d316bcf14d6

SHA1
2c1bea16642a2543ac79a58cde90425170810c14

SHA256
62462d687b4aafb54bd5bc931c3c1d92d662a4d366f2ceba80e40c643adb7156

SHA512
f9dd79b39704597dc0864d905cbcb634636712c625672b91bef163ecfdd8d59747fcd2b0ba533feae09ce071633a6813567265cabee55887563114f37e0f52f0

Download Submit
C:\Windows\System\vHpkrdI.exe

Filesize
1.9MB

MD5
6596415db6ecd5c1cb5f8edd01ed33af

SHA1
a53f5f6178ee9f61ceff35ef05f120caa6bd3649

SHA256
4c6f5507b4ea77e4d1bdaec6c3e19c458e7d37f55c7a7f7e2049fe9493279ea5

SHA512
74aa6e5fd5208c6d6368e9c206aa3f6ceb7a3d3fbaabc7f1457767c1de9ef53630dd396fdbe1eabf849db616bfe8280aea0070be8b7a1e3e3fb9ffb8ad248e01

Download Submit
C:\Windows\System\xBVtbFR.exe

Filesize
1.9MB

MD5
0c3f36b265f19ef3e6ba26fd42d89b74

SHA1
25c77d96e38b3892f59d12bfb8ac0d61ad8cb31e

SHA256
729e15f108c5d172de47d768e292154e1dc5d8908f713788c55c97525fd0f695

SHA512
43824bd7ee0bdd5cc55726250ecbd5d0810db7ee16bc981923edca1a0bf6efca391f6aecea1af2d2c35a4f16f6020190b593acfa7e395a5ebbd1eb0ba5f39a15

Download Submit
C:\Windows\System\xZlRySq.exe

Filesize
1.9MB

MD5
a8f9e94deac8ec772b8b64dde6574a66

SHA1
f8d9029cf622514f8aa910b22535e0b277363bda

SHA256
9b631c9f092767745696204ee18edfd6c19a9e8dd51fdcd89af7f80c9d338308

SHA512
58b2858f72a6875c9457aa0330b6ea60234a3368b20de60e26e0cebc078e576e11d5e3c2fff8f16b0e370c8d980493745db0f6a3aabe1a2ffe2bc30ee349f4e3

Download Submit
memory/400-2360-0x00007FF667740000-0x00007FF667B32000-memory.dmp

Filesize
3.9MB

Download
memory/400-480-0x00007FF667740000-0x00007FF667B32000-memory.dmp

Filesize
3.9MB

Download
memory/752-11-0x00007FF645100000-0x00007FF6454F2000-memory.dmp

Filesize
3.9MB

Download
memory/752-2345-0x00007FF645100000-0x00007FF6454F2000-memory.dmp

Filesize
3.9MB

Download
memory/856-2377-0x00007FF75AC10000-0x00007FF75B002000-memory.dmp

Filesize
3.9MB

Download
memory/856-507-0x00007FF75AC10000-0x00007FF75B002000-memory.dmp

Filesize
3.9MB

Download
memory/968-2355-0x00007FF6CC510000-0x00007FF6CC902000-memory.dmp

Filesize
3.9MB

Download
memory/968-535-0x00007FF6CC510000-0x00007FF6CC902000-memory.dmp

Filesize
3.9MB

Download
memory/2120-2362-0x00007FF67B9C0000-0x00007FF67BDB2000-memory.dmp

Filesize
3.9MB

Download
memory/2120-479-0x00007FF67B9C0000-0x00007FF67BDB2000-memory.dmp

Filesize
3.9MB

Download
memory/2152-57-0x00007FF733D60000-0x00007FF734152000-memory.dmp

Filesize
3.9MB

Download
memory/2152-2349-0x00007FF733D60000-0x00007FF734152000-memory.dmp

Filesize
3.9MB

Download
memory/2156-24-0x00007FFFE4020000-0x00007FFFE4AE1000-memory.dmp

Filesize
10.8MB

Download
memory/2156-26-0x000001AD29130000-0x000001AD29140000-memory.dmp

Filesize
64KB

Download
memory/2156-25-0x000001AD29130000-0x000001AD29140000-memory.dmp

Filesize
64KB

Download
memory/2156-54-0x000001AD290D0000-0x000001AD290F2000-memory.dmp

Filesize
136KB

Download
memory/2548-491-0x00007FF692070000-0x00007FF692462000-memory.dmp

Filesize
3.9MB

Download
memory/2548-2367-0x00007FF692070000-0x00007FF692462000-memory.dmp

Filesize
3.9MB

Download
memory/3216-532-0x00007FF689B00000-0x00007FF689EF2000-memory.dmp

Filesize
3.9MB

Download
memory/3216-2380-0x00007FF689B00000-0x00007FF689EF2000-memory.dmp

Filesize
3.9MB

Download
memory/3320-482-0x00007FF777600000-0x00007FF7779F2000-memory.dmp

Filesize
3.9MB

Download
memory/3320-2369-0x00007FF777600000-0x00007FF7779F2000-memory.dmp

Filesize
3.9MB

Download
memory/3476-529-0x00007FF69D8F0000-0x00007FF69DCE2000-memory.dmp

Filesize
3.9MB

Download
memory/3476-2399-0x00007FF69D8F0000-0x00007FF69DCE2000-memory.dmp

Filesize
3.9MB

Download
memory/3492-29-0x00007FF634AF0000-0x00007FF634EE2000-memory.dmp

Filesize
3.9MB

Download
memory/3492-2352-0x00007FF634AF0000-0x00007FF634EE2000-memory.dmp

Filesize
3.9MB

Download
memory/3492-2343-0x00007FF634AF0000-0x00007FF634EE2000-memory.dmp

Filesize
3.9MB

Download
memory/4012-2364-0x00007FF6EA160000-0x00007FF6EA552000-memory.dmp

Filesize
3.9MB

Download
memory/4012-540-0x00007FF6EA160000-0x00007FF6EA552000-memory.dmp

Filesize
3.9MB

Download
memory/4056-2353-0x00007FF7ADB70000-0x00007FF7ADF62000-memory.dmp

Filesize
3.9MB

Download
memory/4056-478-0x00007FF7ADB70000-0x00007FF7ADF62000-memory.dmp

Filesize
3.9MB

Download
memory/4404-494-0x00007FF7FBE60000-0x00007FF7FC252000-memory.dmp

Filesize
3.9MB

Download
memory/4404-2372-0x00007FF7FBE60000-0x00007FF7FC252000-memory.dmp

Filesize
3.9MB

Download
memory/4460-2373-0x00007FF7E62A0000-0x00007FF7E6692000-memory.dmp

Filesize
3.9MB

Download
memory/4460-498-0x00007FF7E62A0000-0x00007FF7E6692000-memory.dmp

Filesize
3.9MB

Download
memory/4472-2347-0x00007FF790FD0000-0x00007FF7913C2000-memory.dmp

Filesize
3.9MB

Download
memory/4472-38-0x00007FF790FD0000-0x00007FF7913C2000-memory.dmp

Filesize
3.9MB

Download
memory/4692-485-0x00007FF6F2BB0000-0x00007FF6F2FA2000-memory.dmp

Filesize
3.9MB

Download
memory/4692-2366-0x00007FF6F2BB0000-0x00007FF6F2FA2000-memory.dmp

Filesize
3.9MB

Download
memory/4748-2381-0x00007FF7A80F0000-0x00007FF7A84E2000-memory.dmp

Filesize
3.9MB

Download
memory/4748-510-0x00007FF7A80F0000-0x00007FF7A84E2000-memory.dmp

Filesize
3.9MB

Download
memory/4844-2358-0x00007FF7DDBA0000-0x00007FF7DDF92000-memory.dmp

Filesize
3.9MB

Download
memory/4844-481-0x00007FF7DDBA0000-0x00007FF7DDF92000-memory.dmp

Filesize
3.9MB

Download
memory/5012-513-0x00007FF7EB3D0000-0x00007FF7EB7C2000-memory.dmp

Filesize
3.9MB

Download
memory/5012-2400-0x00007FF7EB3D0000-0x00007FF7EB7C2000-memory.dmp

Filesize
3.9MB

Download
memory/5108-1-0x000001CAC9140000-0x000001CAC9150000-memory.dmp

Filesize
64KB

Download
memory/5108-0-0x00007FF6AEEA0000-0x00007FF6AF292000-memory.dmp

Filesize
3.9MB

Download
memory/5116-501-0x00007FF773C50000-0x00007FF774042000-memory.dmp

Filesize
3.9MB

Download
memory/5116-2375-0x00007FF773C50000-0x00007FF774042000-memory.dmp

Filesize
3.9MB

Download