xmrig | 2dcb3b067ba5d037cc367dd6749534130cd62a986ac0dac78fcf895fc69942ac

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30-04-2024 01:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
Size

1.9MB
MD5

08c135bf6deb09a8683bf9c4a099c1be
SHA1

f81ef61cb07030da178bb28005d5214f909a0135
SHA256

2dcb3b067ba5d037cc367dd6749534130cd62a986ac0dac78fcf895fc69942ac
SHA512

7b096f02b1e1151cf7335cf21cf223c463dcddb9b758769378910be507afe612e13723b82e3ac6db299dfb52975af3f4774a1a152b6fdbbf795abe2c86ba3910
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1g:NABH

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 40 IoCs

miner

resource	yara_rule
behavioral2/memory/420-112-0x00007FF7386A0000-0x00007FF738A92000-memory.dmp	xmrig
behavioral2/memory/3016-138-0x00007FF6F62B0000-0x00007FF6F66A2000-memory.dmp	xmrig
behavioral2/memory/1544-169-0x00007FF712D50000-0x00007FF713142000-memory.dmp	xmrig
behavioral2/memory/64-176-0x00007FF72ADF0000-0x00007FF72B1E2000-memory.dmp	xmrig
behavioral2/memory/3096-175-0x00007FF7D6920000-0x00007FF7D6D12000-memory.dmp	xmrig
behavioral2/memory/2528-166-0x00007FF67DFC0000-0x00007FF67E3B2000-memory.dmp	xmrig
behavioral2/memory/4700-151-0x00007FF60ACA0000-0x00007FF60B092000-memory.dmp	xmrig
behavioral2/memory/3396-144-0x00007FF714710000-0x00007FF714B02000-memory.dmp	xmrig
behavioral2/memory/4960-132-0x00007FF73C080000-0x00007FF73C472000-memory.dmp	xmrig
behavioral2/memory/4444-131-0x00007FF7FD960000-0x00007FF7FDD52000-memory.dmp	xmrig
behavioral2/memory/2484-121-0x00007FF735640000-0x00007FF735A32000-memory.dmp	xmrig
behavioral2/memory/4648-101-0x00007FF61A6A0000-0x00007FF61AA92000-memory.dmp	xmrig
behavioral2/memory/2692-88-0x00007FF75D2A0000-0x00007FF75D692000-memory.dmp	xmrig
behavioral2/memory/720-85-0x00007FF763250000-0x00007FF763642000-memory.dmp	xmrig
behavioral2/memory/2544-84-0x00007FF773110000-0x00007FF773502000-memory.dmp	xmrig
behavioral2/memory/1976-47-0x00007FF622430000-0x00007FF622822000-memory.dmp	xmrig
behavioral2/memory/2428-43-0x00007FF752C30000-0x00007FF753022000-memory.dmp	xmrig
behavioral2/memory/2368-2722-0x00007FF6E8210000-0x00007FF6E8602000-memory.dmp	xmrig
behavioral2/memory/2812-2985-0x00007FF66A880000-0x00007FF66AC72000-memory.dmp	xmrig
behavioral2/memory/2428-3680-0x00007FF752C30000-0x00007FF753022000-memory.dmp	xmrig
behavioral2/memory/2368-3682-0x00007FF6E8210000-0x00007FF6E8602000-memory.dmp	xmrig
behavioral2/memory/420-3688-0x00007FF7386A0000-0x00007FF738A92000-memory.dmp	xmrig
behavioral2/memory/720-3690-0x00007FF763250000-0x00007FF763642000-memory.dmp	xmrig
behavioral2/memory/4848-3693-0x00007FF7FC0B0000-0x00007FF7FC4A2000-memory.dmp	xmrig
behavioral2/memory/2692-3698-0x00007FF75D2A0000-0x00007FF75D692000-memory.dmp	xmrig
behavioral2/memory/4984-3700-0x00007FF67FB40000-0x00007FF67FF32000-memory.dmp	xmrig
behavioral2/memory/2484-3696-0x00007FF735640000-0x00007FF735A32000-memory.dmp	xmrig
behavioral2/memory/2544-3694-0x00007FF773110000-0x00007FF773502000-memory.dmp	xmrig
behavioral2/memory/1976-3687-0x00007FF622430000-0x00007FF622822000-memory.dmp	xmrig
behavioral2/memory/4648-3685-0x00007FF61A6A0000-0x00007FF61AA92000-memory.dmp	xmrig
behavioral2/memory/4444-3702-0x00007FF7FD960000-0x00007FF7FDD52000-memory.dmp	xmrig
behavioral2/memory/2812-3718-0x00007FF66A880000-0x00007FF66AC72000-memory.dmp	xmrig
behavioral2/memory/3016-3728-0x00007FF6F62B0000-0x00007FF6F66A2000-memory.dmp	xmrig
behavioral2/memory/4700-3725-0x00007FF60ACA0000-0x00007FF60B092000-memory.dmp	xmrig
behavioral2/memory/64-3722-0x00007FF72ADF0000-0x00007FF72B1E2000-memory.dmp	xmrig
behavioral2/memory/4960-3713-0x00007FF73C080000-0x00007FF73C472000-memory.dmp	xmrig
behavioral2/memory/1544-3712-0x00007FF712D50000-0x00007FF713142000-memory.dmp	xmrig
behavioral2/memory/3096-3709-0x00007FF7D6920000-0x00007FF7D6D12000-memory.dmp	xmrig
behavioral2/memory/3396-3708-0x00007FF714710000-0x00007FF714B02000-memory.dmp	xmrig
behavioral2/memory/2528-3723-0x00007FF67DFC0000-0x00007FF67E3B2000-memory.dmp	xmrig

Blocklisted process makes network request 8 IoCs

flow	pid	Process
3	4016	powershell.exe
7	4016	powershell.exe
9	4016	powershell.exe
10	4016	powershell.exe
14	4016	powershell.exe
15	4016	powershell.exe
17	4016	powershell.exe
20	4016	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2428	CmkjBAx.exe
2368	UbVDcpK.exe
1976	lAuvcIj.exe
4648	PUjnnYB.exe
4848	irHqRHS.exe
4984	YBwBvdw.exe
2544	FFLqRUg.exe
420	pcVhdFa.exe
720	defUQQp.exe
2484	hcfGauE.exe
2692	qJvWUUC.exe
4444	zoJUIeV.exe
2812	yMyptFt.exe
4960	dZbqMEp.exe
1544	wDsgZGA.exe
3016	OHedGYD.exe
3096	zgVJYcg.exe
3396	oGVorep.exe
4700	xFbZPvA.exe
2528	NTJVrLg.exe
64	MDjNBbX.exe
924	naEksKk.exe
920	ebdDmJP.exe
756	pfEUtIS.exe
4432	ZyIzTla.exe
2768	NURxTTK.exe
2752	MNRYvbw.exe
4536	zJUEffd.exe
788	EtqWarZ.exe
3272	NmfrHXc.exe
2920	brnjsvl.exe
4296	sQmKLbg.exe
2992	SFJFFje.exe
4860	XmhIVCh.exe
544	CamALrO.exe
2188	KjiIDGk.exe
4900	GuRWFyW.exe
4264	mzXfYme.exe
2592	HaplqWt.exe
1624	CAfbXTP.exe
1072	WSKXCRq.exe
3028	OKPmsYb.exe
2128	KhHLdfh.exe
1096	dZSNHyl.exe
4440	whHxesH.exe
5020	bLLhyhj.exe
4212	hFrDOhP.exe
3648	sVIVDPh.exe
4820	ztzTqPD.exe
3568	aQrVhIF.exe
3436	RcaKMQW.exe
3444	piBIUWF.exe
4520	HotwEQR.exe
4424	YZVNeVq.exe
5036	nrbzQnY.exe
5040	prgaLWR.exe
2312	KsxpMsB.exe
1192	KHTMegv.exe
3688	nWncTxp.exe
2032	earoGJe.exe
2840	smNpUjx.exe
1468	yyCzmke.exe
2112	gfPqnxN.exe
4688	zxEReaK.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023491-15.dat	upx
behavioral2/files/0x0008000000023490-41.dat	upx
behavioral2/files/0x0007000000023495-56.dat	upx
behavioral2/files/0x0007000000023493-58.dat	upx
behavioral2/files/0x0007000000023498-80.dat	upx
behavioral2/memory/2812-92-0x00007FF66A880000-0x00007FF66AC72000-memory.dmp	upx
behavioral2/files/0x0007000000023499-95.dat	upx
behavioral2/memory/420-112-0x00007FF7386A0000-0x00007FF738A92000-memory.dmp	upx
behavioral2/files/0x000700000002349e-125.dat	upx
behavioral2/memory/3016-138-0x00007FF6F62B0000-0x00007FF6F66A2000-memory.dmp	upx
behavioral2/files/0x00070000000234a2-149.dat	upx
behavioral2/files/0x000800000002348c-157.dat	upx
behavioral2/memory/1544-169-0x00007FF712D50000-0x00007FF713142000-memory.dmp	upx
behavioral2/files/0x00070000000234a9-182.dat	upx
behavioral2/files/0x00070000000234ac-197.dat	upx
behavioral2/files/0x00070000000234aa-193.dat	upx
behavioral2/files/0x00070000000234ab-192.dat	upx
behavioral2/files/0x00070000000234aa-189.dat	upx
behavioral2/files/0x00070000000234a8-183.dat	upx
behavioral2/files/0x00070000000234a7-180.dat	upx
behavioral2/memory/64-176-0x00007FF72ADF0000-0x00007FF72B1E2000-memory.dmp	upx
behavioral2/memory/3096-175-0x00007FF7D6920000-0x00007FF7D6D12000-memory.dmp	upx
behavioral2/memory/2528-166-0x00007FF67DFC0000-0x00007FF67E3B2000-memory.dmp	upx
behavioral2/files/0x00070000000234a5-164.dat	upx
behavioral2/files/0x00070000000234a6-163.dat	upx
behavioral2/files/0x00070000000234a4-161.dat	upx
behavioral2/memory/4700-151-0x00007FF60ACA0000-0x00007FF60B092000-memory.dmp	upx
behavioral2/files/0x00070000000234a3-145.dat	upx
behavioral2/memory/3396-144-0x00007FF714710000-0x00007FF714B02000-memory.dmp	upx
behavioral2/files/0x00070000000234a0-142.dat	upx
behavioral2/files/0x00070000000234a1-136.dat	upx
behavioral2/memory/4960-132-0x00007FF73C080000-0x00007FF73C472000-memory.dmp	upx
behavioral2/memory/4444-131-0x00007FF7FD960000-0x00007FF7FDD52000-memory.dmp	upx
behavioral2/files/0x000700000002349f-127.dat	upx
behavioral2/files/0x000700000002349d-124.dat	upx
behavioral2/files/0x00070000000234a2-133.dat	upx
behavioral2/memory/2484-121-0x00007FF735640000-0x00007FF735A32000-memory.dmp	upx
behavioral2/files/0x000700000002349b-114.dat	upx
behavioral2/files/0x000700000002349c-102.dat	upx
behavioral2/memory/4648-101-0x00007FF61A6A0000-0x00007FF61AA92000-memory.dmp	upx
behavioral2/files/0x000700000002349a-89.dat	upx
behavioral2/memory/2692-88-0x00007FF75D2A0000-0x00007FF75D692000-memory.dmp	upx
behavioral2/memory/720-85-0x00007FF763250000-0x00007FF763642000-memory.dmp	upx
behavioral2/memory/4984-78-0x00007FF67FB40000-0x00007FF67FF32000-memory.dmp	upx
behavioral2/files/0x0007000000023497-75.dat	upx
behavioral2/files/0x0007000000023496-74.dat	upx
behavioral2/memory/2544-84-0x00007FF773110000-0x00007FF773502000-memory.dmp	upx
behavioral2/files/0x0007000000023492-66.dat	upx
behavioral2/memory/4848-59-0x00007FF7FC0B0000-0x00007FF7FC4A2000-memory.dmp	upx
behavioral2/files/0x0007000000023495-62.dat	upx
behavioral2/files/0x000800000002348f-54.dat	upx
behavioral2/files/0x0007000000023494-51.dat	upx
behavioral2/memory/1976-47-0x00007FF622430000-0x00007FF622822000-memory.dmp	upx
behavioral2/memory/2428-43-0x00007FF752C30000-0x00007FF753022000-memory.dmp	upx
behavioral2/memory/2368-33-0x00007FF6E8210000-0x00007FF6E8602000-memory.dmp	upx
behavioral2/files/0x000800000002348e-23.dat	upx
behavioral2/files/0x0007000000023305-6.dat	upx
behavioral2/memory/552-0-0x00007FF7E1B20000-0x00007FF7E1F12000-memory.dmp	upx
behavioral2/memory/2368-2722-0x00007FF6E8210000-0x00007FF6E8602000-memory.dmp	upx
behavioral2/memory/2812-2985-0x00007FF66A880000-0x00007FF66AC72000-memory.dmp	upx
behavioral2/memory/2428-3680-0x00007FF752C30000-0x00007FF753022000-memory.dmp	upx
behavioral2/memory/2368-3682-0x00007FF6E8210000-0x00007FF6E8602000-memory.dmp	upx
behavioral2/memory/420-3688-0x00007FF7386A0000-0x00007FF738A92000-memory.dmp	upx
behavioral2/memory/720-3690-0x00007FF763250000-0x00007FF763642000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\XtXAmVZ.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\iAHFjBn.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\UGTspTJ.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\ipHUVRS.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\MFOqUMh.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\RkNleNN.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\VLxSAsS.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\KjZaxkv.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\tdUsAkt.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\mUnuaxe.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\BbLyuht.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\piTREmq.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\thCmViT.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\LrnoRwi.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\gxjEfnT.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\TxcTYUc.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\AqcxZgh.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\SGtginb.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\SSlLcFb.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\PblbsNd.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\IdwxQlI.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\QCRZfsu.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\QPRxAsm.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\fnmFndf.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\leHmXFJ.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\YdUYbvf.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\pcVhdFa.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\xNuTUWV.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\wWdOViZ.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\OSghRnE.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\ISjKvhZ.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\jsETfGn.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\qpMCyfp.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\Hsmngdr.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\YyEpZsX.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\PIZgrpX.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\FgyEGev.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\VgKQuFz.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\xJnyOCy.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\kvVixXO.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\erAuKgc.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\ucPOVAY.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\sTIDpUP.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\BWWrNVZ.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\VnVfhIc.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\eppMKzA.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\lETNXqd.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\WNmYBuB.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\hApNsjc.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\fwbWKlS.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\WjvMsyB.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\FMCtdAe.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\uHPrnDe.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\GsEXLpb.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\nNXypCx.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\OYLnaMz.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\bMgFcTm.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\ETlmyiI.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\RPZchgf.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\JBduwdI.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\nRvqfhF.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\CkWDwYB.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\anJAGyM.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
File created	C:\Windows\System\OWrMEaP.exe	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4016	powershell.exe
4016	powershell.exe
4016	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
Token: SeDebugPrivilege	4016	powershell.exe
Token: SeLockMemoryPrivilege	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 4016	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	83
PID 552 wrote to memory of 4016	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	83
PID 552 wrote to memory of 2428	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	84
PID 552 wrote to memory of 2428	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	84
PID 552 wrote to memory of 2368	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	85
PID 552 wrote to memory of 2368	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	85
PID 552 wrote to memory of 1976	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	86
PID 552 wrote to memory of 1976	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	86
PID 552 wrote to memory of 4648	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	87
PID 552 wrote to memory of 4648	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	87
PID 552 wrote to memory of 4984	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	88
PID 552 wrote to memory of 4984	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	88
PID 552 wrote to memory of 4848	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	89
PID 552 wrote to memory of 4848	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	89
PID 552 wrote to memory of 2544	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	90
PID 552 wrote to memory of 2544	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	90
PID 552 wrote to memory of 420	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	91
PID 552 wrote to memory of 420	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	91
PID 552 wrote to memory of 720	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	92
PID 552 wrote to memory of 720	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	92
PID 552 wrote to memory of 2484	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	93
PID 552 wrote to memory of 2484	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	93
PID 552 wrote to memory of 2692	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	94
PID 552 wrote to memory of 2692	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	94
PID 552 wrote to memory of 4444	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	95
PID 552 wrote to memory of 4444	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	95
PID 552 wrote to memory of 2812	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	96
PID 552 wrote to memory of 2812	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	96
PID 552 wrote to memory of 4960	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	97
PID 552 wrote to memory of 4960	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	97
PID 552 wrote to memory of 1544	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	98
PID 552 wrote to memory of 1544	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	98
PID 552 wrote to memory of 3016	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	99
PID 552 wrote to memory of 3016	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	99
PID 552 wrote to memory of 3096	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	100
PID 552 wrote to memory of 3096	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	100
PID 552 wrote to memory of 3396	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	101
PID 552 wrote to memory of 3396	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	101
PID 552 wrote to memory of 4700	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	102
PID 552 wrote to memory of 4700	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	102
PID 552 wrote to memory of 64	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	103
PID 552 wrote to memory of 64	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	103
PID 552 wrote to memory of 2528	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	104
PID 552 wrote to memory of 2528	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	104
PID 552 wrote to memory of 924	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	105
PID 552 wrote to memory of 924	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	105
PID 552 wrote to memory of 920	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	106
PID 552 wrote to memory of 920	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	106
PID 552 wrote to memory of 756	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	107
PID 552 wrote to memory of 756	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	107
PID 552 wrote to memory of 4432	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	108
PID 552 wrote to memory of 4432	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	108
PID 552 wrote to memory of 2768	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	109
PID 552 wrote to memory of 2768	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	109
PID 552 wrote to memory of 2752	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	110
PID 552 wrote to memory of 2752	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	110
PID 552 wrote to memory of 4536	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	111
PID 552 wrote to memory of 4536	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	111
PID 552 wrote to memory of 788	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	112
PID 552 wrote to memory of 788	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	112
PID 552 wrote to memory of 3272	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	113
PID 552 wrote to memory of 3272	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	113
PID 552 wrote to memory of 2920	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	114
PID 552 wrote to memory of 2920	552	08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe	114

C:\Users\Admin\AppData\Local\Temp\08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\08c135bf6deb09a8683bf9c4a099c1be_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4016
- C:\Windows\System\CmkjBAx.exe
  C:\Windows\System\CmkjBAx.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\UbVDcpK.exe
  C:\Windows\System\UbVDcpK.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\lAuvcIj.exe
  C:\Windows\System\lAuvcIj.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\PUjnnYB.exe
  C:\Windows\System\PUjnnYB.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\YBwBvdw.exe
  C:\Windows\System\YBwBvdw.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\irHqRHS.exe
  C:\Windows\System\irHqRHS.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\FFLqRUg.exe
  C:\Windows\System\FFLqRUg.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\pcVhdFa.exe
  C:\Windows\System\pcVhdFa.exe
  2⤵
  - Executes dropped EXE
  PID:420
- C:\Windows\System\defUQQp.exe
  C:\Windows\System\defUQQp.exe
  2⤵
  - Executes dropped EXE
  PID:720
- C:\Windows\System\hcfGauE.exe
  C:\Windows\System\hcfGauE.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\qJvWUUC.exe
  C:\Windows\System\qJvWUUC.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\zoJUIeV.exe
  C:\Windows\System\zoJUIeV.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\yMyptFt.exe
  C:\Windows\System\yMyptFt.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\dZbqMEp.exe
  C:\Windows\System\dZbqMEp.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\wDsgZGA.exe
  C:\Windows\System\wDsgZGA.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\OHedGYD.exe
  C:\Windows\System\OHedGYD.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\zgVJYcg.exe
  C:\Windows\System\zgVJYcg.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\oGVorep.exe
  C:\Windows\System\oGVorep.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Windows\System\xFbZPvA.exe
  C:\Windows\System\xFbZPvA.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\MDjNBbX.exe
  C:\Windows\System\MDjNBbX.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\NTJVrLg.exe
  C:\Windows\System\NTJVrLg.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\naEksKk.exe
  C:\Windows\System\naEksKk.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\ebdDmJP.exe
  C:\Windows\System\ebdDmJP.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\pfEUtIS.exe
  C:\Windows\System\pfEUtIS.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\ZyIzTla.exe
  C:\Windows\System\ZyIzTla.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\NURxTTK.exe
  C:\Windows\System\NURxTTK.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\MNRYvbw.exe
  C:\Windows\System\MNRYvbw.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\zJUEffd.exe
  C:\Windows\System\zJUEffd.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\EtqWarZ.exe
  C:\Windows\System\EtqWarZ.exe
  2⤵
  - Executes dropped EXE
  PID:788
- C:\Windows\System\NmfrHXc.exe
  C:\Windows\System\NmfrHXc.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\brnjsvl.exe
  C:\Windows\System\brnjsvl.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\sQmKLbg.exe
  C:\Windows\System\sQmKLbg.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\SFJFFje.exe
  C:\Windows\System\SFJFFje.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\XmhIVCh.exe
  C:\Windows\System\XmhIVCh.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\CamALrO.exe
  C:\Windows\System\CamALrO.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\KjiIDGk.exe
  C:\Windows\System\KjiIDGk.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\GuRWFyW.exe
  C:\Windows\System\GuRWFyW.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\mzXfYme.exe
  C:\Windows\System\mzXfYme.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\HaplqWt.exe
  C:\Windows\System\HaplqWt.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\CAfbXTP.exe
  C:\Windows\System\CAfbXTP.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\WSKXCRq.exe
  C:\Windows\System\WSKXCRq.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\OKPmsYb.exe
  C:\Windows\System\OKPmsYb.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\KhHLdfh.exe
  C:\Windows\System\KhHLdfh.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\dZSNHyl.exe
  C:\Windows\System\dZSNHyl.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\whHxesH.exe
  C:\Windows\System\whHxesH.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\bLLhyhj.exe
  C:\Windows\System\bLLhyhj.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\hFrDOhP.exe
  C:\Windows\System\hFrDOhP.exe
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Windows\System\sVIVDPh.exe
  C:\Windows\System\sVIVDPh.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\ztzTqPD.exe
  C:\Windows\System\ztzTqPD.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\aQrVhIF.exe
  C:\Windows\System\aQrVhIF.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\RcaKMQW.exe
  C:\Windows\System\RcaKMQW.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\piBIUWF.exe
  C:\Windows\System\piBIUWF.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\HotwEQR.exe
  C:\Windows\System\HotwEQR.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\YZVNeVq.exe
  C:\Windows\System\YZVNeVq.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\nrbzQnY.exe
  C:\Windows\System\nrbzQnY.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\prgaLWR.exe
  C:\Windows\System\prgaLWR.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\KsxpMsB.exe
  C:\Windows\System\KsxpMsB.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\KHTMegv.exe
  C:\Windows\System\KHTMegv.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\nWncTxp.exe
  C:\Windows\System\nWncTxp.exe
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Windows\System\earoGJe.exe
  C:\Windows\System\earoGJe.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\smNpUjx.exe
  C:\Windows\System\smNpUjx.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\yyCzmke.exe
  C:\Windows\System\yyCzmke.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\gfPqnxN.exe
  C:\Windows\System\gfPqnxN.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\zxEReaK.exe
  C:\Windows\System\zxEReaK.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\ExFHHhI.exe
  C:\Windows\System\ExFHHhI.exe
  2⤵
  PID:4476
- C:\Windows\System\tldUdZw.exe
  C:\Windows\System\tldUdZw.exe
  2⤵
  PID:4760
- C:\Windows\System\hhnJutl.exe
  C:\Windows\System\hhnJutl.exe
  2⤵
  PID:1028
- C:\Windows\System\cVxEOpE.exe
  C:\Windows\System\cVxEOpE.exe
  2⤵
  PID:3188
- C:\Windows\System\dbFOFUz.exe
  C:\Windows\System\dbFOFUz.exe
  2⤵
  PID:5016
- C:\Windows\System\YdiSRda.exe
  C:\Windows\System\YdiSRda.exe
  2⤵
  PID:1432
- C:\Windows\System\KECxEDR.exe
  C:\Windows\System\KECxEDR.exe
  2⤵
  PID:4496
- C:\Windows\System\dHLAhNz.exe
  C:\Windows\System\dHLAhNz.exe
  2⤵
  PID:4532
- C:\Windows\System\FetVrLV.exe
  C:\Windows\System\FetVrLV.exe
  2⤵
  PID:2864
- C:\Windows\System\WgQUOhP.exe
  C:\Windows\System\WgQUOhP.exe
  2⤵
  PID:2760
- C:\Windows\System\gwbvhLn.exe
  C:\Windows\System\gwbvhLn.exe
  2⤵
  PID:1984
- C:\Windows\System\sKWScdX.exe
  C:\Windows\System\sKWScdX.exe
  2⤵
  PID:4320
- C:\Windows\System\UDJQCyG.exe
  C:\Windows\System\UDJQCyG.exe
  2⤵
  PID:1844
- C:\Windows\System\ofDmIbB.exe
  C:\Windows\System\ofDmIbB.exe
  2⤵
  PID:5156
- C:\Windows\System\KanFrGs.exe
  C:\Windows\System\KanFrGs.exe
  2⤵
  PID:5176
- C:\Windows\System\qxUqMxF.exe
  C:\Windows\System\qxUqMxF.exe
  2⤵
  PID:5220
- C:\Windows\System\sdjYyfA.exe
  C:\Windows\System\sdjYyfA.exe
  2⤵
  PID:5240
- C:\Windows\System\VsDnUWE.exe
  C:\Windows\System\VsDnUWE.exe
  2⤵
  PID:5264
- C:\Windows\System\mUnuaxe.exe
  C:\Windows\System\mUnuaxe.exe
  2⤵
  PID:5312
- C:\Windows\System\OgojhfV.exe
  C:\Windows\System\OgojhfV.exe
  2⤵
  PID:5348
- C:\Windows\System\lheVoNM.exe
  C:\Windows\System\lheVoNM.exe
  2⤵
  PID:5376
- C:\Windows\System\sHUTkBd.exe
  C:\Windows\System\sHUTkBd.exe
  2⤵
  PID:5416
- C:\Windows\System\AeeVmCe.exe
  C:\Windows\System\AeeVmCe.exe
  2⤵
  PID:5444
- C:\Windows\System\BGrlNcg.exe
  C:\Windows\System\BGrlNcg.exe
  2⤵
  PID:5460
- C:\Windows\System\ZGoEWqI.exe
  C:\Windows\System\ZGoEWqI.exe
  2⤵
  PID:5484
- C:\Windows\System\TeVWkvQ.exe
  C:\Windows\System\TeVWkvQ.exe
  2⤵
  PID:5512
- C:\Windows\System\XxvUWyT.exe
  C:\Windows\System\XxvUWyT.exe
  2⤵
  PID:5528
- C:\Windows\System\cqOScgQ.exe
  C:\Windows\System\cqOScgQ.exe
  2⤵
  PID:5548
- C:\Windows\System\RJeCDMs.exe
  C:\Windows\System\RJeCDMs.exe
  2⤵
  PID:5592
- C:\Windows\System\pncDPcK.exe
  C:\Windows\System\pncDPcK.exe
  2⤵
  PID:5612
- C:\Windows\System\QkWjZPu.exe
  C:\Windows\System\QkWjZPu.exe
  2⤵
  PID:5648
- C:\Windows\System\bqILgHf.exe
  C:\Windows\System\bqILgHf.exe
  2⤵
  PID:5668
- C:\Windows\System\QXdgscx.exe
  C:\Windows\System\QXdgscx.exe
  2⤵
  PID:5692
- C:\Windows\System\dcGupqY.exe
  C:\Windows\System\dcGupqY.exe
  2⤵
  PID:5712
- C:\Windows\System\PzPOzxJ.exe
  C:\Windows\System\PzPOzxJ.exe
  2⤵
  PID:5732
- C:\Windows\System\LAzVXLz.exe
  C:\Windows\System\LAzVXLz.exe
  2⤵
  PID:5820
- C:\Windows\System\WWwRTwF.exe
  C:\Windows\System\WWwRTwF.exe
  2⤵
  PID:5896
- C:\Windows\System\IUhPmcm.exe
  C:\Windows\System\IUhPmcm.exe
  2⤵
  PID:5916
- C:\Windows\System\zzRNoDA.exe
  C:\Windows\System\zzRNoDA.exe
  2⤵
  PID:5936
- C:\Windows\System\oDUbZwh.exe
  C:\Windows\System\oDUbZwh.exe
  2⤵
  PID:5956
- C:\Windows\System\ggBucmk.exe
  C:\Windows\System\ggBucmk.exe
  2⤵
  PID:5976
- C:\Windows\System\zkvCByV.exe
  C:\Windows\System\zkvCByV.exe
  2⤵
  PID:5996
- C:\Windows\System\sBBXvFU.exe
  C:\Windows\System\sBBXvFU.exe
  2⤵
  PID:6020
- C:\Windows\System\YjswLDw.exe
  C:\Windows\System\YjswLDw.exe
  2⤵
  PID:6044
- C:\Windows\System\nwaAlTe.exe
  C:\Windows\System\nwaAlTe.exe
  2⤵
  PID:6064
- C:\Windows\System\tqnzVSl.exe
  C:\Windows\System\tqnzVSl.exe
  2⤵
  PID:6120
- C:\Windows\System\rngoZMD.exe
  C:\Windows\System\rngoZMD.exe
  2⤵
  PID:1668
- C:\Windows\System\guwZyfC.exe
  C:\Windows\System\guwZyfC.exe
  2⤵
  PID:3344
- C:\Windows\System\MVwlGhz.exe
  C:\Windows\System\MVwlGhz.exe
  2⤵
  PID:5192
- C:\Windows\System\UXogFYN.exe
  C:\Windows\System\UXogFYN.exe
  2⤵
  PID:5208
- C:\Windows\System\sLmgGTg.exe
  C:\Windows\System\sLmgGTg.exe
  2⤵
  PID:5252
- C:\Windows\System\jWYltmH.exe
  C:\Windows\System\jWYltmH.exe
  2⤵
  PID:5468
- C:\Windows\System\KwwjBRV.exe
  C:\Windows\System\KwwjBRV.exe
  2⤵
  PID:5576
- C:\Windows\System\lgcUXrz.exe
  C:\Windows\System\lgcUXrz.exe
  2⤵
  PID:5604
- C:\Windows\System\vgtXvGB.exe
  C:\Windows\System\vgtXvGB.exe
  2⤵
  PID:5744
- C:\Windows\System\nmugBDo.exe
  C:\Windows\System\nmugBDo.exe
  2⤵
  PID:5640
- C:\Windows\System\dsSQLYN.exe
  C:\Windows\System\dsSQLYN.exe
  2⤵
  PID:5748
- C:\Windows\System\rTJDALw.exe
  C:\Windows\System\rTJDALw.exe
  2⤵
  PID:5912
- C:\Windows\System\ZtnCqUf.exe
  C:\Windows\System\ZtnCqUf.exe
  2⤵
  PID:1168
- C:\Windows\System\RFRLCIT.exe
  C:\Windows\System\RFRLCIT.exe
  2⤵
  PID:6080
- C:\Windows\System\PqhCrRB.exe
  C:\Windows\System\PqhCrRB.exe
  2⤵
  PID:5328
- C:\Windows\System\EtsQKju.exe
  C:\Windows\System\EtsQKju.exe
  2⤵
  PID:5292
- C:\Windows\System\hrcSSOP.exe
  C:\Windows\System\hrcSSOP.exe
  2⤵
  PID:5424
- C:\Windows\System\hizhcRz.exe
  C:\Windows\System\hizhcRz.exe
  2⤵
  PID:5236
- C:\Windows\System\nyALYCm.exe
  C:\Windows\System\nyALYCm.exe
  2⤵
  PID:5676
- C:\Windows\System\QvqjvLk.exe
  C:\Windows\System\QvqjvLk.exe
  2⤵
  PID:5628
- C:\Windows\System\IZrPADs.exe
  C:\Windows\System\IZrPADs.exe
  2⤵
  PID:5792
- C:\Windows\System\NktwKSa.exe
  C:\Windows\System\NktwKSa.exe
  2⤵
  PID:5992
- C:\Windows\System\ZgmbDiF.exe
  C:\Windows\System\ZgmbDiF.exe
  2⤵
  PID:5880
- C:\Windows\System\TRItFbS.exe
  C:\Windows\System\TRItFbS.exe
  2⤵
  PID:6056
- C:\Windows\System\ciLmqOG.exe
  C:\Windows\System\ciLmqOG.exe
  2⤵
  PID:4888
- C:\Windows\System\kugMuPx.exe
  C:\Windows\System\kugMuPx.exe
  2⤵
  PID:5848
- C:\Windows\System\eYhZtDZ.exe
  C:\Windows\System\eYhZtDZ.exe
  2⤵
  PID:5804
- C:\Windows\System\CUWWrjQ.exe
  C:\Windows\System\CUWWrjQ.exe
  2⤵
  PID:1660
- C:\Windows\System\ZeuiQNB.exe
  C:\Windows\System\ZeuiQNB.exe
  2⤵
  PID:6060
- C:\Windows\System\RRgrrYw.exe
  C:\Windows\System\RRgrrYw.exe
  2⤵
  PID:5492
- C:\Windows\System\pdnxkKe.exe
  C:\Windows\System\pdnxkKe.exe
  2⤵
  PID:2608
- C:\Windows\System\kvQCjuV.exe
  C:\Windows\System\kvQCjuV.exe
  2⤵
  PID:5708
- C:\Windows\System\ZDrCbhY.exe
  C:\Windows\System\ZDrCbhY.exe
  2⤵
  PID:5984
- C:\Windows\System\REVNDVB.exe
  C:\Windows\System\REVNDVB.exe
  2⤵
  PID:4976
- C:\Windows\System\VlSuWhr.exe
  C:\Windows\System\VlSuWhr.exe
  2⤵
  PID:5952
- C:\Windows\System\wfgbWDx.exe
  C:\Windows\System\wfgbWDx.exe
  2⤵
  PID:5808
- C:\Windows\System\vEKMKZw.exe
  C:\Windows\System\vEKMKZw.exe
  2⤵
  PID:3340
- C:\Windows\System\cQyUHXS.exe
  C:\Windows\System\cQyUHXS.exe
  2⤵
  PID:6164
- C:\Windows\System\PbDXqpm.exe
  C:\Windows\System\PbDXqpm.exe
  2⤵
  PID:6192
- C:\Windows\System\itqhLAq.exe
  C:\Windows\System\itqhLAq.exe
  2⤵
  PID:6224
- C:\Windows\System\usorsoh.exe
  C:\Windows\System\usorsoh.exe
  2⤵
  PID:6264
- C:\Windows\System\fStzNtY.exe
  C:\Windows\System\fStzNtY.exe
  2⤵
  PID:6284
- C:\Windows\System\STuoNYJ.exe
  C:\Windows\System\STuoNYJ.exe
  2⤵
  PID:6300
- C:\Windows\System\UwYDuBE.exe
  C:\Windows\System\UwYDuBE.exe
  2⤵
  PID:6320
- C:\Windows\System\gpAdGQE.exe
  C:\Windows\System\gpAdGQE.exe
  2⤵
  PID:6352
- C:\Windows\System\lxBDURr.exe
  C:\Windows\System\lxBDURr.exe
  2⤵
  PID:6372
- C:\Windows\System\WRiMkHJ.exe
  C:\Windows\System\WRiMkHJ.exe
  2⤵
  PID:6420
- C:\Windows\System\hjbifhY.exe
  C:\Windows\System\hjbifhY.exe
  2⤵
  PID:6436
- C:\Windows\System\xEKOJsf.exe
  C:\Windows\System\xEKOJsf.exe
  2⤵
  PID:6464
- C:\Windows\System\NJaiuIr.exe
  C:\Windows\System\NJaiuIr.exe
  2⤵
  PID:6496
- C:\Windows\System\njPTXVY.exe
  C:\Windows\System\njPTXVY.exe
  2⤵
  PID:6532
- C:\Windows\System\JletZeY.exe
  C:\Windows\System\JletZeY.exe
  2⤵
  PID:6548
- C:\Windows\System\DMcBTwh.exe
  C:\Windows\System\DMcBTwh.exe
  2⤵
  PID:6572
- C:\Windows\System\xKKtlVR.exe
  C:\Windows\System\xKKtlVR.exe
  2⤵
  PID:6600
- C:\Windows\System\ZOvNptB.exe
  C:\Windows\System\ZOvNptB.exe
  2⤵
  PID:6628
- C:\Windows\System\vESOmyl.exe
  C:\Windows\System\vESOmyl.exe
  2⤵
  PID:6644
- C:\Windows\System\fiHEVkL.exe
  C:\Windows\System\fiHEVkL.exe
  2⤵
  PID:6704
- C:\Windows\System\QqxcUTw.exe
  C:\Windows\System\QqxcUTw.exe
  2⤵
  PID:6724
- C:\Windows\System\ffeAhgS.exe
  C:\Windows\System\ffeAhgS.exe
  2⤵
  PID:6744
- C:\Windows\System\yCWQanF.exe
  C:\Windows\System\yCWQanF.exe
  2⤵
  PID:6764
- C:\Windows\System\ESuQGWh.exe
  C:\Windows\System\ESuQGWh.exe
  2⤵
  PID:6784
- C:\Windows\System\oUbipIX.exe
  C:\Windows\System\oUbipIX.exe
  2⤵
  PID:6804
- C:\Windows\System\JyxlNjO.exe
  C:\Windows\System\JyxlNjO.exe
  2⤵
  PID:6864
- C:\Windows\System\jXVErbL.exe
  C:\Windows\System\jXVErbL.exe
  2⤵
  PID:6916
- C:\Windows\System\aTXgKQz.exe
  C:\Windows\System\aTXgKQz.exe
  2⤵
  PID:6940
- C:\Windows\System\OrwadVd.exe
  C:\Windows\System\OrwadVd.exe
  2⤵
  PID:7020
- C:\Windows\System\aIKyATm.exe
  C:\Windows\System\aIKyATm.exe
  2⤵
  PID:7036
- C:\Windows\System\ceBcNrv.exe
  C:\Windows\System\ceBcNrv.exe
  2⤵
  PID:7064
- C:\Windows\System\mLNzsUv.exe
  C:\Windows\System\mLNzsUv.exe
  2⤵
  PID:7096
- C:\Windows\System\uddaNuk.exe
  C:\Windows\System\uddaNuk.exe
  2⤵
  PID:7116
- C:\Windows\System\nUjkOlp.exe
  C:\Windows\System\nUjkOlp.exe
  2⤵
  PID:7144
- C:\Windows\System\faoKHOn.exe
  C:\Windows\System\faoKHOn.exe
  2⤵
  PID:3416
- C:\Windows\System\wiwVpqu.exe
  C:\Windows\System\wiwVpqu.exe
  2⤵
  PID:6204
- C:\Windows\System\iuQakmZ.exe
  C:\Windows\System\iuQakmZ.exe
  2⤵
  PID:6244
- C:\Windows\System\YbMZQDZ.exe
  C:\Windows\System\YbMZQDZ.exe
  2⤵
  PID:6280
- C:\Windows\System\PPGaKMy.exe
  C:\Windows\System\PPGaKMy.exe
  2⤵
  PID:6344
- C:\Windows\System\iPGKmBq.exe
  C:\Windows\System\iPGKmBq.exe
  2⤵
  PID:6400
- C:\Windows\System\RhGNJjo.exe
  C:\Windows\System\RhGNJjo.exe
  2⤵
  PID:6460
- C:\Windows\System\BFdUjJv.exe
  C:\Windows\System\BFdUjJv.exe
  2⤵
  PID:6636
- C:\Windows\System\GykNpah.exe
  C:\Windows\System\GykNpah.exe
  2⤵
  PID:6656
- C:\Windows\System\biDxHef.exe
  C:\Windows\System\biDxHef.exe
  2⤵
  PID:6700
- C:\Windows\System\GDTqKGa.exe
  C:\Windows\System\GDTqKGa.exe
  2⤵
  PID:6816
- C:\Windows\System\uJBFwwt.exe
  C:\Windows\System\uJBFwwt.exe
  2⤵
  PID:6716
- C:\Windows\System\ukCraDN.exe
  C:\Windows\System\ukCraDN.exe
  2⤵
  PID:6740
- C:\Windows\System\hasjagp.exe
  C:\Windows\System\hasjagp.exe
  2⤵
  PID:6892
- C:\Windows\System\LJinCDI.exe
  C:\Windows\System\LJinCDI.exe
  2⤵
  PID:6924
- C:\Windows\System\vSXyiyk.exe
  C:\Windows\System\vSXyiyk.exe
  2⤵
  PID:7032
- C:\Windows\System\aTDUaRx.exe
  C:\Windows\System\aTDUaRx.exe
  2⤵
  PID:7056
- C:\Windows\System\XSabSSW.exe
  C:\Windows\System\XSabSSW.exe
  2⤵
  PID:6188
- C:\Windows\System\VwIyTsG.exe
  C:\Windows\System\VwIyTsG.exe
  2⤵
  PID:6172
- C:\Windows\System\LIHxhjY.exe
  C:\Windows\System\LIHxhjY.exe
  2⤵
  PID:6332
- C:\Windows\System\NAbrwqT.exe
  C:\Windows\System\NAbrwqT.exe
  2⤵
  PID:6368
- C:\Windows\System\cNFeTgB.exe
  C:\Windows\System\cNFeTgB.exe
  2⤵
  PID:6556
- C:\Windows\System\XnonVXA.exe
  C:\Windows\System\XnonVXA.exe
  2⤵
  PID:6812
- C:\Windows\System\owWWOcn.exe
  C:\Windows\System\owWWOcn.exe
  2⤵
  PID:6928
- C:\Windows\System\YhfZEJx.exe
  C:\Windows\System\YhfZEJx.exe
  2⤵
  PID:6736
- C:\Windows\System\YOMOuNg.exe
  C:\Windows\System\YOMOuNg.exe
  2⤵
  PID:7060
- C:\Windows\System\XaLouSC.exe
  C:\Windows\System\XaLouSC.exe
  2⤵
  PID:7140
- C:\Windows\System\jrHfmYe.exe
  C:\Windows\System\jrHfmYe.exe
  2⤵
  PID:6452
- C:\Windows\System\tiBgdzE.exe
  C:\Windows\System\tiBgdzE.exe
  2⤵
  PID:6616
- C:\Windows\System\mQJnHPN.exe
  C:\Windows\System\mQJnHPN.exe
  2⤵
  PID:6612
- C:\Windows\System\XSKssTf.exe
  C:\Windows\System\XSKssTf.exe
  2⤵
  PID:7028
- C:\Windows\System\MZLKUHq.exe
  C:\Windows\System\MZLKUHq.exe
  2⤵
  PID:6684
- C:\Windows\System\oaxyQDK.exe
  C:\Windows\System\oaxyQDK.exe
  2⤵
  PID:7088
- C:\Windows\System\BHELNBv.exe
  C:\Windows\System\BHELNBv.exe
  2⤵
  PID:7172
- C:\Windows\System\IimVOlq.exe
  C:\Windows\System\IimVOlq.exe
  2⤵
  PID:7200
- C:\Windows\System\EPdbOGf.exe
  C:\Windows\System\EPdbOGf.exe
  2⤵
  PID:7232
- C:\Windows\System\bufpUJV.exe
  C:\Windows\System\bufpUJV.exe
  2⤵
  PID:7256
- C:\Windows\System\kaBzGke.exe
  C:\Windows\System\kaBzGke.exe
  2⤵
  PID:7296
- C:\Windows\System\gnvWGCi.exe
  C:\Windows\System\gnvWGCi.exe
  2⤵
  PID:7320
- C:\Windows\System\lkdqDcn.exe
  C:\Windows\System\lkdqDcn.exe
  2⤵
  PID:7340
- C:\Windows\System\ddftRGC.exe
  C:\Windows\System\ddftRGC.exe
  2⤵
  PID:7392
- C:\Windows\System\IdwxQlI.exe
  C:\Windows\System\IdwxQlI.exe
  2⤵
  PID:7424
- C:\Windows\System\tkXdFkF.exe
  C:\Windows\System\tkXdFkF.exe
  2⤵
  PID:7440
- C:\Windows\System\ydzpknS.exe
  C:\Windows\System\ydzpknS.exe
  2⤵
  PID:7476
- C:\Windows\System\xrNhVjy.exe
  C:\Windows\System\xrNhVjy.exe
  2⤵
  PID:7496
- C:\Windows\System\xcQyIyC.exe
  C:\Windows\System\xcQyIyC.exe
  2⤵
  PID:7540
- C:\Windows\System\oeCoemT.exe
  C:\Windows\System\oeCoemT.exe
  2⤵
  PID:7564
- C:\Windows\System\yyFiswr.exe
  C:\Windows\System\yyFiswr.exe
  2⤵
  PID:7588
- C:\Windows\System\bFvoJwg.exe
  C:\Windows\System\bFvoJwg.exe
  2⤵
  PID:7620
- C:\Windows\System\gzibFKR.exe
  C:\Windows\System\gzibFKR.exe
  2⤵
  PID:7640
- C:\Windows\System\jFdGDNe.exe
  C:\Windows\System\jFdGDNe.exe
  2⤵
  PID:7660
- C:\Windows\System\TkIFtSn.exe
  C:\Windows\System\TkIFtSn.exe
  2⤵
  PID:7688
- C:\Windows\System\jEtTzJW.exe
  C:\Windows\System\jEtTzJW.exe
  2⤵
  PID:7732
- C:\Windows\System\SqDOdEs.exe
  C:\Windows\System\SqDOdEs.exe
  2⤵
  PID:7752
- C:\Windows\System\kXzEWxh.exe
  C:\Windows\System\kXzEWxh.exe
  2⤵
  PID:7772
- C:\Windows\System\WpfvCyk.exe
  C:\Windows\System\WpfvCyk.exe
  2⤵
  PID:7820
- C:\Windows\System\tyRsgIE.exe
  C:\Windows\System\tyRsgIE.exe
  2⤵
  PID:7844
- C:\Windows\System\mBLcnQq.exe
  C:\Windows\System\mBLcnQq.exe
  2⤵
  PID:7864
- C:\Windows\System\zfvQoqV.exe
  C:\Windows\System\zfvQoqV.exe
  2⤵
  PID:7884
- C:\Windows\System\xNuTUWV.exe
  C:\Windows\System\xNuTUWV.exe
  2⤵
  PID:7912
- C:\Windows\System\vFayeze.exe
  C:\Windows\System\vFayeze.exe
  2⤵
  PID:7956
- C:\Windows\System\iXkybzs.exe
  C:\Windows\System\iXkybzs.exe
  2⤵
  PID:7972
- C:\Windows\System\VqYCwiA.exe
  C:\Windows\System\VqYCwiA.exe
  2⤵
  PID:7996
- C:\Windows\System\gUhFFOk.exe
  C:\Windows\System\gUhFFOk.exe
  2⤵
  PID:8024
- C:\Windows\System\GyjvSWL.exe
  C:\Windows\System\GyjvSWL.exe
  2⤵
  PID:8056
- C:\Windows\System\tnZkhJW.exe
  C:\Windows\System\tnZkhJW.exe
  2⤵
  PID:8096
- C:\Windows\System\Zydxgvg.exe
  C:\Windows\System\Zydxgvg.exe
  2⤵
  PID:8124
- C:\Windows\System\QAIGcDw.exe
  C:\Windows\System\QAIGcDw.exe
  2⤵
  PID:7240
- C:\Windows\System\xjjbATO.exe
  C:\Windows\System\xjjbATO.exe
  2⤵
  PID:7276
- C:\Windows\System\BWgqCwf.exe
  C:\Windows\System\BWgqCwf.exe
  2⤵
  PID:7352
- C:\Windows\System\JfYGjGs.exe
  C:\Windows\System\JfYGjGs.exe
  2⤵
  PID:7436
- C:\Windows\System\RtcvMQO.exe
  C:\Windows\System\RtcvMQO.exe
  2⤵
  PID:7492
- C:\Windows\System\hwZBuGR.exe
  C:\Windows\System\hwZBuGR.exe
  2⤵
  PID:7512
- C:\Windows\System\iKgrPPM.exe
  C:\Windows\System\iKgrPPM.exe
  2⤵
  PID:7560
- C:\Windows\System\VLGMVpj.exe
  C:\Windows\System\VLGMVpj.exe
  2⤵
  PID:7608
- C:\Windows\System\FbnmWJK.exe
  C:\Windows\System\FbnmWJK.exe
  2⤵
  PID:7636
- C:\Windows\System\OeFXFdY.exe
  C:\Windows\System\OeFXFdY.exe
  2⤵
  PID:7728
- C:\Windows\System\xvLoKyY.exe
  C:\Windows\System\xvLoKyY.exe
  2⤵
  PID:7796
- C:\Windows\System\ydpSUYN.exe
  C:\Windows\System\ydpSUYN.exe
  2⤵
  PID:7856
- C:\Windows\System\MZzZVgd.exe
  C:\Windows\System\MZzZVgd.exe
  2⤵
  PID:7992
- C:\Windows\System\GYzaLbk.exe
  C:\Windows\System\GYzaLbk.exe
  2⤵
  PID:8036
- C:\Windows\System\bUKXpNK.exe
  C:\Windows\System\bUKXpNK.exe
  2⤵
  PID:8044
- C:\Windows\System\ashMsSE.exe
  C:\Windows\System\ashMsSE.exe
  2⤵
  PID:8160
- C:\Windows\System\GbqnIiD.exe
  C:\Windows\System\GbqnIiD.exe
  2⤵
  PID:6680
- C:\Windows\System\aQYoCsn.exe
  C:\Windows\System\aQYoCsn.exe
  2⤵
  PID:8144
- C:\Windows\System\GzzTaii.exe
  C:\Windows\System\GzzTaii.exe
  2⤵
  PID:8136
- C:\Windows\System\yvpmxWx.exe
  C:\Windows\System\yvpmxWx.exe
  2⤵
  PID:7244
- C:\Windows\System\SrQtZwS.exe
  C:\Windows\System\SrQtZwS.exe
  2⤵
  PID:8148
- C:\Windows\System\JOMzAxY.exe
  C:\Windows\System\JOMzAxY.exe
  2⤵
  PID:7416
- C:\Windows\System\gnrNAAv.exe
  C:\Windows\System\gnrNAAv.exe
  2⤵
  PID:7580
- C:\Windows\System\HVwkWRB.exe
  C:\Windows\System\HVwkWRB.exe
  2⤵
  PID:7724
- C:\Windows\System\ifaXAWZ.exe
  C:\Windows\System\ifaXAWZ.exe
  2⤵
  PID:7860
- C:\Windows\System\FxZewck.exe
  C:\Windows\System\FxZewck.exe
  2⤵
  PID:7968
- C:\Windows\System\HMogVXW.exe
  C:\Windows\System\HMogVXW.exe
  2⤵
  PID:8116
- C:\Windows\System\PurbsoY.exe
  C:\Windows\System\PurbsoY.exe
  2⤵
  PID:7248
- C:\Windows\System\HzAOiIL.exe
  C:\Windows\System\HzAOiIL.exe
  2⤵
  PID:7272
- C:\Windows\System\nlOzAya.exe
  C:\Windows\System\nlOzAya.exe
  2⤵
  PID:7600
- C:\Windows\System\FdebtvB.exe
  C:\Windows\System\FdebtvB.exe
  2⤵
  PID:7764
- C:\Windows\System\EeYZUfS.exe
  C:\Windows\System\EeYZUfS.exe
  2⤵
  PID:8104
- C:\Windows\System\GZNxhUI.exe
  C:\Windows\System\GZNxhUI.exe
  2⤵
  PID:7360
- C:\Windows\System\tEidrzH.exe
  C:\Windows\System\tEidrzH.exe
  2⤵
  PID:7408
- C:\Windows\System\PnFvPfq.exe
  C:\Windows\System\PnFvPfq.exe
  2⤵
  PID:2772
- C:\Windows\System\mOplnrU.exe
  C:\Windows\System\mOplnrU.exe
  2⤵
  PID:7800
- C:\Windows\System\yAAGGIc.exe
  C:\Windows\System\yAAGGIc.exe
  2⤵
  PID:8204
- C:\Windows\System\mldamgn.exe
  C:\Windows\System\mldamgn.exe
  2⤵
  PID:8228
- C:\Windows\System\rRYjxBk.exe
  C:\Windows\System\rRYjxBk.exe
  2⤵
  PID:8272
- C:\Windows\System\oCAykao.exe
  C:\Windows\System\oCAykao.exe
  2⤵
  PID:8292
- C:\Windows\System\mOwevgn.exe
  C:\Windows\System\mOwevgn.exe
  2⤵
  PID:8312
- C:\Windows\System\etpWTim.exe
  C:\Windows\System\etpWTim.exe
  2⤵
  PID:8340
- C:\Windows\System\nFbPahW.exe
  C:\Windows\System\nFbPahW.exe
  2⤵
  PID:8360
- C:\Windows\System\CdkalTw.exe
  C:\Windows\System\CdkalTw.exe
  2⤵
  PID:8380
- C:\Windows\System\jerEUdP.exe
  C:\Windows\System\jerEUdP.exe
  2⤵
  PID:8408
- C:\Windows\System\vQDhbej.exe
  C:\Windows\System\vQDhbej.exe
  2⤵
  PID:8432
- C:\Windows\System\GqcsrDf.exe
  C:\Windows\System\GqcsrDf.exe
  2⤵
  PID:8484
- C:\Windows\System\NEetTMo.exe
  C:\Windows\System\NEetTMo.exe
  2⤵
  PID:8524
- C:\Windows\System\jEsBLwY.exe
  C:\Windows\System\jEsBLwY.exe
  2⤵
  PID:8544
- C:\Windows\System\wyYqtWt.exe
  C:\Windows\System\wyYqtWt.exe
  2⤵
  PID:8568
- C:\Windows\System\crDKlRU.exe
  C:\Windows\System\crDKlRU.exe
  2⤵
  PID:8584
- C:\Windows\System\FgyEGev.exe
  C:\Windows\System\FgyEGev.exe
  2⤵
  PID:8604
- C:\Windows\System\VEpanvg.exe
  C:\Windows\System\VEpanvg.exe
  2⤵
  PID:8628
- C:\Windows\System\twiMDCp.exe
  C:\Windows\System\twiMDCp.exe
  2⤵
  PID:8648
- C:\Windows\System\SJlSyLC.exe
  C:\Windows\System\SJlSyLC.exe
  2⤵
  PID:8692
- C:\Windows\System\nAGbxZv.exe
  C:\Windows\System\nAGbxZv.exe
  2⤵
  PID:8712
- C:\Windows\System\kMPbspH.exe
  C:\Windows\System\kMPbspH.exe
  2⤵
  PID:8736
- C:\Windows\System\MIasTSg.exe
  C:\Windows\System\MIasTSg.exe
  2⤵
  PID:8836
- C:\Windows\System\tXmTvkX.exe
  C:\Windows\System\tXmTvkX.exe
  2⤵
  PID:8860
- C:\Windows\System\NdccJvB.exe
  C:\Windows\System\NdccJvB.exe
  2⤵
  PID:8880
- C:\Windows\System\uIXzwtU.exe
  C:\Windows\System\uIXzwtU.exe
  2⤵
  PID:8900
- C:\Windows\System\BsnjThj.exe
  C:\Windows\System\BsnjThj.exe
  2⤵
  PID:8940
- C:\Windows\System\DNnhgJa.exe
  C:\Windows\System\DNnhgJa.exe
  2⤵
  PID:8956
- C:\Windows\System\SSaqMCw.exe
  C:\Windows\System\SSaqMCw.exe
  2⤵
  PID:8984
- C:\Windows\System\hTRiTna.exe
  C:\Windows\System\hTRiTna.exe
  2⤵
  PID:9008
- C:\Windows\System\uQwdURY.exe
  C:\Windows\System\uQwdURY.exe
  2⤵
  PID:9028
- C:\Windows\System\TMjAbFK.exe
  C:\Windows\System\TMjAbFK.exe
  2⤵
  PID:9052
- C:\Windows\System\isvvzNM.exe
  C:\Windows\System\isvvzNM.exe
  2⤵
  PID:9076
- C:\Windows\System\ghewRIz.exe
  C:\Windows\System\ghewRIz.exe
  2⤵
  PID:9096
- C:\Windows\System\FtAgOxk.exe
  C:\Windows\System\FtAgOxk.exe
  2⤵
  PID:9116
- C:\Windows\System\BRHcBAQ.exe
  C:\Windows\System\BRHcBAQ.exe
  2⤵
  PID:9136
- C:\Windows\System\QERTxOB.exe
  C:\Windows\System\QERTxOB.exe
  2⤵
  PID:9156
- C:\Windows\System\SCvnTbs.exe
  C:\Windows\System\SCvnTbs.exe
  2⤵
  PID:9180
- C:\Windows\System\JgwxgVo.exe
  C:\Windows\System\JgwxgVo.exe
  2⤵
  PID:8216
- C:\Windows\System\XEbXJDE.exe
  C:\Windows\System\XEbXJDE.exe
  2⤵
  PID:8372
- C:\Windows\System\JuObhuX.exe
  C:\Windows\System\JuObhuX.exe
  2⤵
  PID:8392
- C:\Windows\System\DrDyZwn.exe
  C:\Windows\System\DrDyZwn.exe
  2⤵
  PID:8444
- C:\Windows\System\KGOWqJb.exe
  C:\Windows\System\KGOWqJb.exe
  2⤵
  PID:8580
- C:\Windows\System\vUwOTNe.exe
  C:\Windows\System\vUwOTNe.exe
  2⤵
  PID:8600
- C:\Windows\System\wnIMvPX.exe
  C:\Windows\System\wnIMvPX.exe
  2⤵
  PID:8768
- C:\Windows\System\UHrFNuK.exe
  C:\Windows\System\UHrFNuK.exe
  2⤵
  PID:8796
- C:\Windows\System\epcuRsd.exe
  C:\Windows\System\epcuRsd.exe
  2⤵
  PID:8892
- C:\Windows\System\LyRlfyZ.exe
  C:\Windows\System\LyRlfyZ.exe
  2⤵
  PID:8932
- C:\Windows\System\hlIcgpx.exe
  C:\Windows\System\hlIcgpx.exe
  2⤵
  PID:9072
- C:\Windows\System\DOBsUqK.exe
  C:\Windows\System\DOBsUqK.exe
  2⤵
  PID:9068
- C:\Windows\System\zoivPoT.exe
  C:\Windows\System\zoivPoT.exe
  2⤵
  PID:9164
- C:\Windows\System\QaQXcUy.exe
  C:\Windows\System\QaQXcUy.exe
  2⤵
  PID:3232
- C:\Windows\System\qokGPnG.exe
  C:\Windows\System\qokGPnG.exe
  2⤵
  PID:8252
- C:\Windows\System\axeWkBf.exe
  C:\Windows\System\axeWkBf.exe
  2⤵
  PID:8428
- C:\Windows\System\IkptssS.exe
  C:\Windows\System\IkptssS.exe
  2⤵
  PID:8508
- C:\Windows\System\PYOZDKC.exe
  C:\Windows\System\PYOZDKC.exe
  2⤵
  PID:8704
- C:\Windows\System\EkeeSoY.exe
  C:\Windows\System\EkeeSoY.exe
  2⤵
  PID:8876
- C:\Windows\System\BBLLCaO.exe
  C:\Windows\System\BBLLCaO.exe
  2⤵
  PID:9020
- C:\Windows\System\XmxnnOC.exe
  C:\Windows\System\XmxnnOC.exe
  2⤵
  PID:9040
- C:\Windows\System\lVBFTQX.exe
  C:\Windows\System\lVBFTQX.exe
  2⤵
  PID:9088
- C:\Windows\System\PTIefDX.exe
  C:\Windows\System\PTIefDX.exe
  2⤵
  PID:8952
- C:\Windows\System\dRsTzOY.exe
  C:\Windows\System\dRsTzOY.exe
  2⤵
  PID:9132
- C:\Windows\System\ReEtTcM.exe
  C:\Windows\System\ReEtTcM.exe
  2⤵
  PID:9212
- C:\Windows\System\AHJLIns.exe
  C:\Windows\System\AHJLIns.exe
  2⤵
  PID:9244
- C:\Windows\System\dUSHSca.exe
  C:\Windows\System\dUSHSca.exe
  2⤵
  PID:9268
- C:\Windows\System\iIyzNZV.exe
  C:\Windows\System\iIyzNZV.exe
  2⤵
  PID:9288
- C:\Windows\System\YzBPhdH.exe
  C:\Windows\System\YzBPhdH.exe
  2⤵
  PID:9316
- C:\Windows\System\SmRcZKE.exe
  C:\Windows\System\SmRcZKE.exe
  2⤵
  PID:9364
- C:\Windows\System\dVYQLad.exe
  C:\Windows\System\dVYQLad.exe
  2⤵
  PID:9388
- C:\Windows\System\zcLWuKU.exe
  C:\Windows\System\zcLWuKU.exe
  2⤵
  PID:9416
- C:\Windows\System\nIEtxbL.exe
  C:\Windows\System\nIEtxbL.exe
  2⤵
  PID:9436
- C:\Windows\System\miCiALr.exe
  C:\Windows\System\miCiALr.exe
  2⤵
  PID:9476
- C:\Windows\System\yGzXfNV.exe
  C:\Windows\System\yGzXfNV.exe
  2⤵
  PID:9500
- C:\Windows\System\taVbpwo.exe
  C:\Windows\System\taVbpwo.exe
  2⤵
  PID:9520
- C:\Windows\System\HWsKHYq.exe
  C:\Windows\System\HWsKHYq.exe
  2⤵
  PID:9540
- C:\Windows\System\lTuZkNc.exe
  C:\Windows\System\lTuZkNc.exe
  2⤵
  PID:9576
- C:\Windows\System\hztRIel.exe
  C:\Windows\System\hztRIel.exe
  2⤵
  PID:9596
- C:\Windows\System\YFOwIeE.exe
  C:\Windows\System\YFOwIeE.exe
  2⤵
  PID:9616
- C:\Windows\System\HpKrUJG.exe
  C:\Windows\System\HpKrUJG.exe
  2⤵
  PID:9640
- C:\Windows\System\wULrSQe.exe
  C:\Windows\System\wULrSQe.exe
  2⤵
  PID:9660
- C:\Windows\System\yXaAAHl.exe
  C:\Windows\System\yXaAAHl.exe
  2⤵
  PID:9680
- C:\Windows\System\HrGTtuN.exe
  C:\Windows\System\HrGTtuN.exe
  2⤵
  PID:9708
- C:\Windows\System\NfluNnO.exe
  C:\Windows\System\NfluNnO.exe
  2⤵
  PID:9752
- C:\Windows\System\PTtojzM.exe
  C:\Windows\System\PTtojzM.exe
  2⤵
  PID:9780
- C:\Windows\System\ZpwTWhu.exe
  C:\Windows\System\ZpwTWhu.exe
  2⤵
  PID:9836
- C:\Windows\System\UFHauDR.exe
  C:\Windows\System\UFHauDR.exe
  2⤵
  PID:9856
- C:\Windows\System\sLiQiXS.exe
  C:\Windows\System\sLiQiXS.exe
  2⤵
  PID:9896
- C:\Windows\System\uDApDwD.exe
  C:\Windows\System\uDApDwD.exe
  2⤵
  PID:9912
- C:\Windows\System\CGKWYLl.exe
  C:\Windows\System\CGKWYLl.exe
  2⤵
  PID:9940
- C:\Windows\System\QolTMDy.exe
  C:\Windows\System\QolTMDy.exe
  2⤵
  PID:9956
- C:\Windows\System\JEwqHEm.exe
  C:\Windows\System\JEwqHEm.exe
  2⤵
  PID:10000
- C:\Windows\System\OWThOxB.exe
  C:\Windows\System\OWThOxB.exe
  2⤵
  PID:10024
- C:\Windows\System\yrnrNnS.exe
  C:\Windows\System\yrnrNnS.exe
  2⤵
  PID:10044
- C:\Windows\System\eYVdtjN.exe
  C:\Windows\System\eYVdtjN.exe
  2⤵
  PID:10064
- C:\Windows\System\uUIssUf.exe
  C:\Windows\System\uUIssUf.exe
  2⤵
  PID:10080
- C:\Windows\System\sTIDpUP.exe
  C:\Windows\System\sTIDpUP.exe
  2⤵
  PID:10100
- C:\Windows\System\ALdqJYg.exe
  C:\Windows\System\ALdqJYg.exe
  2⤵
  PID:10120
- C:\Windows\System\pZBBDLS.exe
  C:\Windows\System\pZBBDLS.exe
  2⤵
  PID:10164
- C:\Windows\System\dUsLBBS.exe
  C:\Windows\System\dUsLBBS.exe
  2⤵
  PID:10184
- C:\Windows\System\dyLFLdz.exe
  C:\Windows\System\dyLFLdz.exe
  2⤵
  PID:10208
- C:\Windows\System\UVrIdJV.exe
  C:\Windows\System\UVrIdJV.exe
  2⤵
  PID:10236
- C:\Windows\System\jUVKnNN.exe
  C:\Windows\System\jUVKnNN.exe
  2⤵
  PID:8732
- C:\Windows\System\rTvklgu.exe
  C:\Windows\System\rTvklgu.exe
  2⤵
  PID:9224
- C:\Windows\System\kBumyGO.exe
  C:\Windows\System\kBumyGO.exe
  2⤵
  PID:9312
- C:\Windows\System\BOIgQjT.exe
  C:\Windows\System\BOIgQjT.exe
  2⤵
  PID:9380
- C:\Windows\System\VlSACKk.exe
  C:\Windows\System\VlSACKk.exe
  2⤵
  PID:9460
- C:\Windows\System\rnBWYgR.exe
  C:\Windows\System\rnBWYgR.exe
  2⤵
  PID:9536
- C:\Windows\System\ETrcrgJ.exe
  C:\Windows\System\ETrcrgJ.exe
  2⤵
  PID:9632
- C:\Windows\System\OCIluxJ.exe
  C:\Windows\System\OCIluxJ.exe
  2⤵
  PID:9744
- C:\Windows\System\veeilig.exe
  C:\Windows\System\veeilig.exe
  2⤵
  PID:9828
- C:\Windows\System\ghIJECh.exe
  C:\Windows\System\ghIJECh.exe
  2⤵
  PID:9872
- C:\Windows\System\ytHMPoW.exe
  C:\Windows\System\ytHMPoW.exe
  2⤵
  PID:9932
- C:\Windows\System\kalZlQA.exe
  C:\Windows\System\kalZlQA.exe
  2⤵
  PID:4908
- C:\Windows\System\SxjRhyo.exe
  C:\Windows\System\SxjRhyo.exe
  2⤵
  PID:10008
- C:\Windows\System\hVmIkAZ.exe
  C:\Windows\System\hVmIkAZ.exe
  2⤵
  PID:10092
- C:\Windows\System\dMTMHcM.exe
  C:\Windows\System\dMTMHcM.exe
  2⤵
  PID:10076
- C:\Windows\System\THJtwjg.exe
  C:\Windows\System\THJtwjg.exe
  2⤵
  PID:10200
- C:\Windows\System\WNoNwQF.exe
  C:\Windows\System\WNoNwQF.exe
  2⤵
  PID:10228
- C:\Windows\System\lPJSYup.exe
  C:\Windows\System\lPJSYup.exe
  2⤵
  PID:9240
- C:\Windows\System\qEYgdaz.exe
  C:\Windows\System\qEYgdaz.exe
  2⤵
  PID:9432
- C:\Windows\System\tgnHvZD.exe
  C:\Windows\System\tgnHvZD.exe
  2⤵
  PID:9556
- C:\Windows\System\yofZOnK.exe
  C:\Windows\System\yofZOnK.exe
  2⤵
  PID:9672
- C:\Windows\System\TRNxURd.exe
  C:\Windows\System\TRNxURd.exe
  2⤵
  PID:9800
- C:\Windows\System\OKSrkiQ.exe
  C:\Windows\System\OKSrkiQ.exe
  2⤵
  PID:2036
- C:\Windows\System\wvZsWKd.exe
  C:\Windows\System\wvZsWKd.exe
  2⤵
  PID:10136
- C:\Windows\System\QrkTcUU.exe
  C:\Windows\System\QrkTcUU.exe
  2⤵
  PID:9252
- C:\Windows\System\kxePPKS.exe
  C:\Windows\System\kxePPKS.exe
  2⤵
  PID:9704
- C:\Windows\System\IAdxOVX.exe
  C:\Windows\System\IAdxOVX.exe
  2⤵
  PID:460
- C:\Windows\System\FsoYkyT.exe
  C:\Windows\System\FsoYkyT.exe
  2⤵
  PID:9652
- C:\Windows\System\RkNleNN.exe
  C:\Windows\System\RkNleNN.exe
  2⤵
  PID:10140
- C:\Windows\System\nPerrLw.exe
  C:\Windows\System\nPerrLw.exe
  2⤵
  PID:10280
- C:\Windows\System\CecgTzX.exe
  C:\Windows\System\CecgTzX.exe
  2⤵
  PID:10296
- C:\Windows\System\dJxPwRY.exe
  C:\Windows\System\dJxPwRY.exe
  2⤵
  PID:10320
- C:\Windows\System\EVvJSUh.exe
  C:\Windows\System\EVvJSUh.exe
  2⤵
  PID:10348
- C:\Windows\System\mOGQonK.exe
  C:\Windows\System\mOGQonK.exe
  2⤵
  PID:10376
- C:\Windows\System\FQpCrvx.exe
  C:\Windows\System\FQpCrvx.exe
  2⤵
  PID:10400
- C:\Windows\System\iQkjICG.exe
  C:\Windows\System\iQkjICG.exe
  2⤵
  PID:10440
- C:\Windows\System\PjKUiRH.exe
  C:\Windows\System\PjKUiRH.exe
  2⤵
  PID:10464
- C:\Windows\System\BZStizw.exe
  C:\Windows\System\BZStizw.exe
  2⤵
  PID:10488
- C:\Windows\System\IHKQkDN.exe
  C:\Windows\System\IHKQkDN.exe
  2⤵
  PID:10508
- C:\Windows\System\PrdzJaT.exe
  C:\Windows\System\PrdzJaT.exe
  2⤵
  PID:10528
- C:\Windows\System\ORmSHQw.exe
  C:\Windows\System\ORmSHQw.exe
  2⤵
  PID:10576
- C:\Windows\System\RHcVoSg.exe
  C:\Windows\System\RHcVoSg.exe
  2⤵
  PID:10600
- C:\Windows\System\KheELJS.exe
  C:\Windows\System\KheELJS.exe
  2⤵
  PID:10644
- C:\Windows\System\EdDfsoK.exe
  C:\Windows\System\EdDfsoK.exe
  2⤵
  PID:10672
- C:\Windows\System\HWzwzYI.exe
  C:\Windows\System\HWzwzYI.exe
  2⤵
  PID:10700
- C:\Windows\System\VJaASBi.exe
  C:\Windows\System\VJaASBi.exe
  2⤵
  PID:10724
- C:\Windows\System\wryFXTn.exe
  C:\Windows\System\wryFXTn.exe
  2⤵
  PID:10748
- C:\Windows\System\auKYXMP.exe
  C:\Windows\System\auKYXMP.exe
  2⤵
  PID:10768
- C:\Windows\System\wgggqGT.exe
  C:\Windows\System\wgggqGT.exe
  2⤵
  PID:10792
- C:\Windows\System\TmyxkGr.exe
  C:\Windows\System\TmyxkGr.exe
  2⤵
  PID:10824
- C:\Windows\System\GPuEYht.exe
  C:\Windows\System\GPuEYht.exe
  2⤵
  PID:10852
- C:\Windows\System\juNYfAg.exe
  C:\Windows\System\juNYfAg.exe
  2⤵
  PID:10880
- C:\Windows\System\wQaAMjZ.exe
  C:\Windows\System\wQaAMjZ.exe
  2⤵
  PID:10904
- C:\Windows\System\BifoqEt.exe
  C:\Windows\System\BifoqEt.exe
  2⤵
  PID:10920
- C:\Windows\System\ZlFkWIc.exe
  C:\Windows\System\ZlFkWIc.exe
  2⤵
  PID:10948
- C:\Windows\System\UvLmCvF.exe
  C:\Windows\System\UvLmCvF.exe
  2⤵
  PID:10964
- C:\Windows\System\fnRrFzr.exe
  C:\Windows\System\fnRrFzr.exe
  2⤵
  PID:10988
- C:\Windows\System\khXhZSA.exe
  C:\Windows\System\khXhZSA.exe
  2⤵
  PID:11008
- C:\Windows\System\LmKzfGo.exe
  C:\Windows\System\LmKzfGo.exe
  2⤵
  PID:11068
- C:\Windows\System\mUkhTwb.exe
  C:\Windows\System\mUkhTwb.exe
  2⤵
  PID:11084
- C:\Windows\System\RZfMKMy.exe
  C:\Windows\System\RZfMKMy.exe
  2⤵
  PID:11120
- C:\Windows\System\CCaMuNo.exe
  C:\Windows\System\CCaMuNo.exe
  2⤵
  PID:11136
- C:\Windows\System\GtYwuir.exe
  C:\Windows\System\GtYwuir.exe
  2⤵
  PID:11160
- C:\Windows\System\MzRtpGO.exe
  C:\Windows\System\MzRtpGO.exe
  2⤵
  PID:11180
- C:\Windows\System\wgsVdDF.exe
  C:\Windows\System\wgsVdDF.exe
  2⤵
  PID:11204
- C:\Windows\System\EpqJiEq.exe
  C:\Windows\System\EpqJiEq.exe
  2⤵
  PID:11232
- C:\Windows\System\gCVebjN.exe
  C:\Windows\System\gCVebjN.exe
  2⤵
  PID:11252
- C:\Windows\System\ygUoGRg.exe
  C:\Windows\System\ygUoGRg.exe
  2⤵
  PID:10248
- C:\Windows\System\azCPQWZ.exe
  C:\Windows\System\azCPQWZ.exe
  2⤵
  PID:10364
- C:\Windows\System\UxXJoaL.exe
  C:\Windows\System\UxXJoaL.exe
  2⤵
  PID:10396
- C:\Windows\System\lTEZOUk.exe
  C:\Windows\System\lTEZOUk.exe
  2⤵
  PID:10456
- C:\Windows\System\OVrbNig.exe
  C:\Windows\System\OVrbNig.exe
  2⤵
  PID:10540
- C:\Windows\System\XOqGQbC.exe
  C:\Windows\System\XOqGQbC.exe
  2⤵
  PID:10788
- C:\Windows\System\xqYuYGu.exe
  C:\Windows\System\xqYuYGu.exe
  2⤵
  PID:10832
- C:\Windows\System\MYtMBgl.exe
  C:\Windows\System\MYtMBgl.exe
  2⤵
  PID:10872
- C:\Windows\System\JsjKRcj.exe
  C:\Windows\System\JsjKRcj.exe
  2⤵
  PID:10876
- C:\Windows\System\sMXfBks.exe
  C:\Windows\System\sMXfBks.exe
  2⤵
  PID:10936
- C:\Windows\System\AvXzgIL.exe
  C:\Windows\System\AvXzgIL.exe
  2⤵
  PID:1996
- C:\Windows\System\XTTBgMv.exe
  C:\Windows\System\XTTBgMv.exe
  2⤵
  PID:10996
- C:\Windows\System\jLllCBY.exe
  C:\Windows\System\jLllCBY.exe
  2⤵
  PID:11100
- C:\Windows\System\TrAOlfr.exe
  C:\Windows\System\TrAOlfr.exe
  2⤵
  PID:11132
- C:\Windows\System\Cnojaam.exe
  C:\Windows\System\Cnojaam.exe
  2⤵
  PID:11216
- C:\Windows\System\jYSXlda.exe
  C:\Windows\System\jYSXlda.exe
  2⤵
  PID:10372
- C:\Windows\System\WXZMjlf.exe
  C:\Windows\System\WXZMjlf.exe
  2⤵
  PID:10620
- C:\Windows\System\BCOYimd.exe
  C:\Windows\System\BCOYimd.exe
  2⤵
  PID:10660
- C:\Windows\System\TKTPMZw.exe
  C:\Windows\System\TKTPMZw.exe
  2⤵
  PID:10900
- C:\Windows\System\DaAkLgx.exe
  C:\Windows\System\DaAkLgx.exe
  2⤵
  PID:10984
- C:\Windows\System\rPZEFSC.exe
  C:\Windows\System\rPZEFSC.exe
  2⤵
  PID:11196
- C:\Windows\System\UcNzjeA.exe
  C:\Windows\System\UcNzjeA.exe
  2⤵
  PID:10520
- C:\Windows\System\uAoOgrp.exe
  C:\Windows\System\uAoOgrp.exe
  2⤵
  PID:10432
- C:\Windows\System\SlkfZGc.exe
  C:\Windows\System\SlkfZGc.exe
  2⤵
  PID:10840
- C:\Windows\System\OSghRnE.exe
  C:\Windows\System\OSghRnE.exe
  2⤵
  PID:10960
- C:\Windows\System\CUmcDjW.exe
  C:\Windows\System\CUmcDjW.exe
  2⤵
  PID:11212
- C:\Windows\System\udluHZY.exe
  C:\Windows\System\udluHZY.exe
  2⤵
  PID:11292
- C:\Windows\System\PAIfsMa.exe
  C:\Windows\System\PAIfsMa.exe
  2⤵
  PID:11324
- C:\Windows\System\AIYjNNE.exe
  C:\Windows\System\AIYjNNE.exe
  2⤵
  PID:11356
- C:\Windows\System\CItLuCy.exe
  C:\Windows\System\CItLuCy.exe
  2⤵
  PID:11384
- C:\Windows\System\AAJZPpS.exe
  C:\Windows\System\AAJZPpS.exe
  2⤵
  PID:11412
- C:\Windows\System\GdAbqVe.exe
  C:\Windows\System\GdAbqVe.exe
  2⤵
  PID:11432
- C:\Windows\System\vJHyPUS.exe
  C:\Windows\System\vJHyPUS.exe
  2⤵
  PID:11448
- C:\Windows\System\zrHZsZD.exe
  C:\Windows\System\zrHZsZD.exe
  2⤵
  PID:11488
- C:\Windows\System\XrjgsVh.exe
  C:\Windows\System\XrjgsVh.exe
  2⤵
  PID:11516
- C:\Windows\System\nMIbeBG.exe
  C:\Windows\System\nMIbeBG.exe
  2⤵
  PID:11532
- C:\Windows\System\ZyQtnET.exe
  C:\Windows\System\ZyQtnET.exe
  2⤵
  PID:11564
- C:\Windows\System\YzfANmc.exe
  C:\Windows\System\YzfANmc.exe
  2⤵
  PID:11588
- C:\Windows\System\xuZIwlQ.exe
  C:\Windows\System\xuZIwlQ.exe
  2⤵
  PID:11608
- C:\Windows\System\TSKTZkb.exe
  C:\Windows\System\TSKTZkb.exe
  2⤵
  PID:11628
- C:\Windows\System\DIqtoWP.exe
  C:\Windows\System\DIqtoWP.exe
  2⤵
  PID:11648
- C:\Windows\System\CeomKzY.exe
  C:\Windows\System\CeomKzY.exe
  2⤵
  PID:11672
- C:\Windows\System\btstNTe.exe
  C:\Windows\System\btstNTe.exe
  2⤵
  PID:11720
- C:\Windows\System\mCZwyDt.exe
  C:\Windows\System\mCZwyDt.exe
  2⤵
  PID:11748
- C:\Windows\System\pgUvBRK.exe
  C:\Windows\System\pgUvBRK.exe
  2⤵
  PID:11768
- C:\Windows\System\BqKhpdM.exe
  C:\Windows\System\BqKhpdM.exe
  2⤵
  PID:11800
- C:\Windows\System\xytDEjw.exe
  C:\Windows\System\xytDEjw.exe
  2⤵
  PID:11828
- C:\Windows\System\hwkBmRh.exe
  C:\Windows\System\hwkBmRh.exe
  2⤵
  PID:11864
- C:\Windows\System\VzmkotT.exe
  C:\Windows\System\VzmkotT.exe
  2⤵
  PID:11900
- C:\Windows\System\CdDuBFq.exe
  C:\Windows\System\CdDuBFq.exe
  2⤵
  PID:11924
- C:\Windows\System\GWkiXTw.exe
  C:\Windows\System\GWkiXTw.exe
  2⤵
  PID:11952
- C:\Windows\System\RqcPJoz.exe
  C:\Windows\System\RqcPJoz.exe
  2⤵
  PID:12000
- C:\Windows\System\pMrqMwu.exe
  C:\Windows\System\pMrqMwu.exe
  2⤵
  PID:12024
- C:\Windows\System\aoMwoYA.exe
  C:\Windows\System\aoMwoYA.exe
  2⤵
  PID:12044
- C:\Windows\System\xRTKKGO.exe
  C:\Windows\System\xRTKKGO.exe
  2⤵
  PID:12084
- C:\Windows\System\ZVLAGKU.exe
  C:\Windows\System\ZVLAGKU.exe
  2⤵
  PID:12100
- C:\Windows\System\tDsPLbO.exe
  C:\Windows\System\tDsPLbO.exe
  2⤵
  PID:12124
- C:\Windows\System\wuUQNLM.exe
  C:\Windows\System\wuUQNLM.exe
  2⤵
  PID:12168
- C:\Windows\System\XROhaUW.exe
  C:\Windows\System\XROhaUW.exe
  2⤵
  PID:12184
- C:\Windows\System\PeMrhnZ.exe
  C:\Windows\System\PeMrhnZ.exe
  2⤵
  PID:12208
- C:\Windows\System\KEPQvWF.exe
  C:\Windows\System\KEPQvWF.exe
  2⤵
  PID:12232
- C:\Windows\System\qdFzexq.exe
  C:\Windows\System\qdFzexq.exe
  2⤵
  PID:12248
- C:\Windows\System\jnkKDXD.exe
  C:\Windows\System\jnkKDXD.exe
  2⤵
  PID:12272
- C:\Windows\System\eoLkteK.exe
  C:\Windows\System\eoLkteK.exe
  2⤵
  PID:11308
- C:\Windows\System\vsxrinw.exe
  C:\Windows\System\vsxrinw.exe
  2⤵
  PID:11420
- C:\Windows\System\FacHCZJ.exe
  C:\Windows\System\FacHCZJ.exe
  2⤵
  PID:11440
- C:\Windows\System\zuSAPFY.exe
  C:\Windows\System\zuSAPFY.exe
  2⤵
  PID:11528
- C:\Windows\System\HCrGHEn.exe
  C:\Windows\System\HCrGHEn.exe
  2⤵
  PID:11580
- C:\Windows\System\EVuOJNw.exe
  C:\Windows\System\EVuOJNw.exe
  2⤵
  PID:11620
- C:\Windows\System\gZkBGnj.exe
  C:\Windows\System\gZkBGnj.exe
  2⤵
  PID:11664
- C:\Windows\System\cHrgQMA.exe
  C:\Windows\System\cHrgQMA.exe
  2⤵
  PID:11696
- C:\Windows\System\cLCGHSx.exe
  C:\Windows\System\cLCGHSx.exe
  2⤵
  PID:11756
- C:\Windows\System\uxjxUfK.exe
  C:\Windows\System\uxjxUfK.exe
  2⤵
  PID:11816
- C:\Windows\System\grwOrIp.exe
  C:\Windows\System\grwOrIp.exe
  2⤵
  PID:11948
- C:\Windows\System\kYalKAh.exe
  C:\Windows\System\kYalKAh.exe
  2⤵
  PID:2636
- C:\Windows\System\xdsgIdE.exe
  C:\Windows\System\xdsgIdE.exe
  2⤵
  PID:12008
- C:\Windows\System\OaUaVtB.exe
  C:\Windows\System\OaUaVtB.exe
  2⤵
  PID:12036
- C:\Windows\System\IENDyqc.exe
  C:\Windows\System\IENDyqc.exe
  2⤵
  PID:12092
- C:\Windows\System\ISjKvhZ.exe
  C:\Windows\System\ISjKvhZ.exe
  2⤵
  PID:12152
- C:\Windows\System\LRTkxpK.exe
  C:\Windows\System\LRTkxpK.exe
  2⤵
  PID:11152
- C:\Windows\System\ZjJbpee.exe
  C:\Windows\System\ZjJbpee.exe
  2⤵
  PID:11344
- C:\Windows\System\vlBBXbI.exe
  C:\Windows\System\vlBBXbI.exe
  2⤵
  PID:11428
- C:\Windows\System\NuyojAe.exe
  C:\Windows\System\NuyojAe.exe
  2⤵
  PID:11604
- C:\Windows\System\RZYQeqK.exe
  C:\Windows\System\RZYQeqK.exe
  2⤵
  PID:11736
- C:\Windows\System\ygVciRv.exe
  C:\Windows\System\ygVciRv.exe
  2⤵
  PID:5032
- C:\Windows\System\hGdKNID.exe
  C:\Windows\System\hGdKNID.exe
  2⤵
  PID:12020
- C:\Windows\System\KClqKeO.exe
  C:\Windows\System\KClqKeO.exe
  2⤵
  PID:12080
- C:\Windows\System\XbfHkBW.exe
  C:\Windows\System\XbfHkBW.exe
  2⤵
  PID:11392
- C:\Windows\System\PStcElx.exe
  C:\Windows\System\PStcElx.exe
  2⤵
  PID:11692
- C:\Windows\System\qRcZUHl.exe
  C:\Windows\System\qRcZUHl.exe
  2⤵
  PID:11920
- C:\Windows\System\ORVUCjr.exe
  C:\Windows\System\ORVUCjr.exe
  2⤵
  PID:12056
- C:\Windows\System\NkmRUah.exe
  C:\Windows\System\NkmRUah.exe
  2⤵
  PID:11916
- C:\Windows\System\pvYcDwC.exe
  C:\Windows\System\pvYcDwC.exe
  2⤵
  PID:12332
- C:\Windows\System\lZpFQoC.exe
  C:\Windows\System\lZpFQoC.exe
  2⤵
  PID:12352
- C:\Windows\System\kLvbjAQ.exe
  C:\Windows\System\kLvbjAQ.exe
  2⤵
  PID:12372
- C:\Windows\System\yOOtPCT.exe
  C:\Windows\System\yOOtPCT.exe
  2⤵
  PID:12404
- C:\Windows\System\hQHNVGS.exe
  C:\Windows\System\hQHNVGS.exe
  2⤵
  PID:12432
- C:\Windows\System\NoMouaR.exe
  C:\Windows\System\NoMouaR.exe
  2⤵
  PID:12460
- C:\Windows\System\lzthIYn.exe
  C:\Windows\System\lzthIYn.exe
  2⤵
  PID:12488
- C:\Windows\System\QwMxvLv.exe
  C:\Windows\System\QwMxvLv.exe
  2⤵
  PID:12516
- C:\Windows\System\FiGRdcw.exe
  C:\Windows\System\FiGRdcw.exe
  2⤵
  PID:12536
- C:\Windows\System\TfhUudj.exe
  C:\Windows\System\TfhUudj.exe
  2⤵
  PID:12576
- C:\Windows\System\IdSdpbi.exe
  C:\Windows\System\IdSdpbi.exe
  2⤵
  PID:12600
- C:\Windows\System\zXMTfxS.exe
  C:\Windows\System\zXMTfxS.exe
  2⤵
  PID:12620
- C:\Windows\System\OerGqfw.exe
  C:\Windows\System\OerGqfw.exe
  2⤵
  PID:12636
- C:\Windows\System\IhQyuka.exe
  C:\Windows\System\IhQyuka.exe
  2⤵
  PID:12676
- C:\Windows\System\ZeYwrFJ.exe
  C:\Windows\System\ZeYwrFJ.exe
  2⤵
  PID:12728
- C:\Windows\System\VHBbHge.exe
  C:\Windows\System\VHBbHge.exe
  2⤵
  PID:12756
- C:\Windows\System\PlxiIsy.exe
  C:\Windows\System\PlxiIsy.exe
  2⤵
  PID:12784
- C:\Windows\System\DVmtDop.exe
  C:\Windows\System\DVmtDop.exe
  2⤵
  PID:12812
- C:\Windows\System\kNECoDs.exe
  C:\Windows\System\kNECoDs.exe
  2⤵
  PID:12840
- C:\Windows\System\KsRaIeK.exe
  C:\Windows\System\KsRaIeK.exe
  2⤵
  PID:12860
- C:\Windows\System\EDdvbmW.exe
  C:\Windows\System\EDdvbmW.exe
  2⤵
  PID:12880
- C:\Windows\System\UOTJeVw.exe
  C:\Windows\System\UOTJeVw.exe
  2⤵
  PID:12904
- C:\Windows\System\gZyqfDS.exe
  C:\Windows\System\gZyqfDS.exe
  2⤵
  PID:12924
- C:\Windows\System\ZpBtaEN.exe
  C:\Windows\System\ZpBtaEN.exe
  2⤵
  PID:12972
- C:\Windows\System\jiRUtOg.exe
  C:\Windows\System\jiRUtOg.exe
  2⤵
  PID:13120
- C:\Windows\System\EyjNWBI.exe
  C:\Windows\System\EyjNWBI.exe
  2⤵
  PID:13156
- C:\Windows\System\jKeBnWS.exe
  C:\Windows\System\jKeBnWS.exe
  2⤵
  PID:13180
- C:\Windows\System\eaereuX.exe
  C:\Windows\System\eaereuX.exe
  2⤵
  PID:13200
- C:\Windows\System\fwlbNuy.exe
  C:\Windows\System\fwlbNuy.exe
  2⤵
  PID:13220
- C:\Windows\System\tDULsdc.exe
  C:\Windows\System\tDULsdc.exe
  2⤵
  PID:12988
- C:\Windows\System\NPeyiSm.exe
  C:\Windows\System\NPeyiSm.exe
  2⤵
  PID:13028
- C:\Windows\System\oNvyhtR.exe
  C:\Windows\System\oNvyhtR.exe
  2⤵
  PID:13068
- C:\Windows\System\HSEvWgr.exe
  C:\Windows\System\HSEvWgr.exe
  2⤵
  PID:13112
- C:\Windows\System\PlTtRjf.exe
  C:\Windows\System\PlTtRjf.exe
  2⤵
  PID:13128
- C:\Windows\System\wFnBNOA.exe
  C:\Windows\System\wFnBNOA.exe
  2⤵
  PID:13132
- C:\Windows\System\ScHzVOe.exe
  C:\Windows\System\ScHzVOe.exe
  2⤵
  PID:3936
- C:\Windows\System\mVGGrmU.exe
  C:\Windows\System\mVGGrmU.exe
  2⤵
  PID:13240
- C:\Windows\System\yuxKLIW.exe
  C:\Windows\System\yuxKLIW.exe
  2⤵
  PID:12964
- C:\Windows\System\yzbtaXM.exe
  C:\Windows\System\yzbtaXM.exe
  2⤵
  PID:13032
- C:\Windows\System\oYKjkcA.exe
  C:\Windows\System\oYKjkcA.exe
  2⤵
  PID:13088
- C:\Windows\System\tufjyjg.exe
  C:\Windows\System\tufjyjg.exe
  2⤵
  PID:13164
- C:\Windows\System\TRSvmRW.exe
  C:\Windows\System\TRSvmRW.exe
  2⤵
  PID:13216
- C:\Windows\System\fnmFndf.exe
  C:\Windows\System\fnmFndf.exe
  2⤵
  PID:13284
- C:\Windows\System\cvKTYKC.exe
  C:\Windows\System\cvKTYKC.exe
  2⤵
  PID:12240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WOBB13N1\home-993d2c38b2c1[1].css

Filesize
11KB

MD5
6328d6d9a6b00ce7f992230b97b17c1f

SHA1
88837b802bdde407e37e92641072ea2eeec95556

SHA256
c9d9b80794cebd7d97daf52f7f0ce0e31bcf7a6f65a6e07851c688d67f10dba8

SHA512
993d2c38b2c15499aebdb39c1f9c21d0501d4c2a5973caec65be9ddc3ddfd6e46d06449e7483daa4fa9afa17cb81ff27a391519a64629169eb15c52911aab2c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rbv3vemm.bdh.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\CmkjBAx.exe

Filesize
1.9MB

MD5
1273398afcee65b52b18a0f10bc2a5c4

SHA1
88bff6bcce82853c6bea7eb9054d3e192088b8c4

SHA256
a5aff4748023941768ef471e79dddb2023f5f8651c3cc0eaddb798a88e59f761

SHA512
6ba9afcc272ae4ceb924a0e951504d62fa42a9bd2e57aece9e4cfbe57b63eef086ac5b19a620840b91a6415be13be21020f87b495ac5f27c1bc0d016478958f9

Download Submit
C:\Windows\System\EtqWarZ.exe

Filesize
1.9MB

MD5
9b81c7971970dee58df241b362efb569

SHA1
dc725e6820f34d0e9c0b811388ce44b0364e003d

SHA256
42818c20c74b701414a517cf494e7c26419046964e1ee8d44974531c562cd983

SHA512
2690be62c76061695fbbc521dcac2afb4effb43cf06d1d9c8ecc17ec762b9a13ff7ea9ac0a0fa5b7172edf98da90430794ab86a5ce886ad5973f2dd43f608121

Download Submit
C:\Windows\System\FFLqRUg.exe

Filesize
1.9MB

MD5
c2d6c80dec9b14a85086f1c35402a65e

SHA1
df8d5256c035b04cbe4a6971a237b8448ce46dfb

SHA256
cc85d10a62a99dc7f450f5f2087b72a3bd34ec3c1f897ae5a1ebde75f85e6315

SHA512
1cb1238b9e4b2d4c34967512501e409e671d6213457f76d40b3ce107e4d63d8705208b5eb8dd722b2fde893284490dcd60090d7e4dcf23caf77979388548f276

Download Submit
C:\Windows\System\MDjNBbX.exe

Filesize
1.9MB

MD5
94c71f8cb9f93082ffdbcd7613afbda0

SHA1
d0970b44c18b9e1ecda26b83810cb91a42da1ca6

SHA256
e6a28efeb8b5ec6ab1e18fe3828ac89561035dc6bc4162934f370b10137d24b9

SHA512
ff467e9ebe49ce83400ea00e720bd10281c8e841ae73541a7b1852f3f55c9d709d244fbb26bdcaada2f20a6d1c515478a4e046b1df2b73b1106042d71e6888c9

Download Submit
C:\Windows\System\MNRYvbw.exe

Filesize
1.9MB

MD5
91f8828ba536d4054601bae0f3b3f265

SHA1
d6e082fc9ee903e458ca1987d800bc270112109e

SHA256
068cf4d70b19ba97a9f27a8d29a488150e5d5fbcafc0d744422c51c4689f755b

SHA512
18da860e5de7d0226f3115b8942003c38d0119e62931a5ece76973522101a2667ed63d434871d5408e0adb293aaada30435b2f37ba9c6071fa38b7afc1a004fd

Download Submit
C:\Windows\System\NTJVrLg.exe

Filesize
1.9MB

MD5
e471069574ee1d833afff51101cea22a

SHA1
6122b4c7611e146f999420b78ad530256613f809

SHA256
e5b1268650f492b85b72053e0828dde07cbdbaf6863d7a8dd0b1c62157ea3df4

SHA512
90b8b3293d9b9cd1b5e83a6d1fc5b0cdc80302e0a25d5d9bbb6f2e3572f1f7ba3d4d215969d63281d1154047e30059aac640cefe6529ea0b43d0ef56af2aca2a

Download Submit
C:\Windows\System\NURxTTK.exe

Filesize
1.9MB

MD5
d0b1f0e5bed8381b8b520d4fe28df913

SHA1
b4de9d356508aec55ac91e829773f7ad54ba6719

SHA256
39666b33ce6d8b3ecb63fd3672acaa5947550015bb455a4d64716952f9431cce

SHA512
6842a6aca2a02bed55857489b669182d53f21cf228d353f77e59be1074848fa82b953d44a31158b20b0c5d29caf4d0e4da3c389e07355db7342b9f4994efd1b8

Download Submit
C:\Windows\System\NmfrHXc.exe

Filesize
1.9MB

MD5
8ea54ed98107f999c77d2bc788d9c3f2

SHA1
8e0dcc2c6ee7021bbff673b32230a830c023c89a

SHA256
3469d5df22a6615964e39558402aded32bf5cd4784375bd3f7c39de95112cb9f

SHA512
cb7a846184930809bad0bb776ae5984a14aaf6f94cbe4c6ace2454512086519bfc54e8c74fea92c0eb213a5e54f4f4828ce9d20f672ed82b769284510905d82d

Download Submit
C:\Windows\System\OHedGYD.exe

Filesize
1.9MB

MD5
383a3bf3083d1ae81058cac9db48dad4

SHA1
ba3caf72c187c9dbd607199be05624877d31f05c

SHA256
adc75e28bf8f5271eecde78fefb6e612f8248bd86389b19ed42beaecee7bde74

SHA512
4166399f5d1417065c2e7302729e38e7ebaf834139ef197eae6726f0d3d9f58052ec93582fd79e1d4c58897d53585703ec55f63c59fa2a3dd7cc2bb0b97c3ed7

Download Submit
C:\Windows\System\PUjnnYB.exe

Filesize
1.9MB

MD5
13548883af61ae91648f90152d5b1310

SHA1
b629963153f8464c8c732472fd13408524c74073

SHA256
c78913fca0de75b1553fc51da2703a3a9495fa8adbff94170b95114cb6de4feb

SHA512
610cf1d5bc4646ec07bd2b49677bffe9f6afdcbc9be302380b13b050c304ee26ffde8e5cdb0c2bdd32d1eabea00ace4dfcb2cebd6105851b2e097ebd216572cd

Download Submit
C:\Windows\System\SFJFFje.exe

Filesize
1.9MB

MD5
8c6be44d07e8d6365f01ce94a24c4803

SHA1
f3f40fd4ad81c82006bbe4f0a0a3b40af57357a7

SHA256
a77b67aa63933258cc2db2dead2a7789214fcd3a34641c4ea0aa0ee1a933e78c

SHA512
97f9e699aa6659bcd29ea3faa34f775b2c4723ddf1833990068a94d30c341118c2baad9715960be1ee9a29f9e54f3d21afc9831b598aca0a50eaf5c6a3279469

Download Submit
C:\Windows\System\UbVDcpK.exe

Filesize
1.9MB

MD5
553a6ad69981fa70846d0db022e91197

SHA1
cb3ecd27a32d40c1547ed27638ad09fdc44b1c55

SHA256
d930e04f86b1c13fd573b37e03afbc4727e9a2fdb4c4f7d27fa64812dfbfc5b3

SHA512
51a5d7f91f2fd0d47f26257d83df951db69ded0020aaeefea11f98511b8038a6eb972550559be5a070656f533cda1f54be5a921de5a52cff1a9ad25f9e0c0d06

Download Submit
C:\Windows\System\YBwBvdw.exe

Filesize
1.9MB

MD5
907bf71c5e191171f424c8c7d078c88b

SHA1
39ad06302412d04cf34a39a6721d1bc0f339ac59

SHA256
6b917e2230e4e78bb3dd4379a2b775db99c2edbc8bae281cd7615da7041acf27

SHA512
039643afa5b79fc7af8091e416c697f90fd2772f304cb310465eaa0e7146e15edcb42c56784b0e2b47781c7e38f8d7be173641d68edcbab797695631ae754a75

Download Submit
C:\Windows\System\ZyIzTla.exe

Filesize
1.9MB

MD5
98eb04ec144772962af5b985919205d2

SHA1
b095aa772fb3ad1cc29f3baaf8ddfec315b09c8d

SHA256
cdbdb6fdf7950d80ee973d5394082a8b52a6f5a0246e08bbc92d67b4a674d724

SHA512
17b9c2048ab978cb27314aa5b9c9f078e6ca0598009216e3244b37230cd5e638474c7670122385229f9e52e5f67d23c510ea7e8d59c8d948baae87b9b03632cb

Download Submit
C:\Windows\System\brnjsvl.exe

Filesize
1.8MB

MD5
f4f83bdf29e8f085aa3ca87a9b6ccf0b

SHA1
686357596c9d790625c707e8970e0a97ea0acda7

SHA256
31a60e32944ff7983dd5808fe130ef57cb3299260c7a3b60a770f68b9c526fb6

SHA512
7c7bcfb7425f77e9047d5a7e8071c36f2bbfebd5e5ffab042e5288162da6361898d91319ce228b2af4e96562332f84e2d86aee81543b196bb9838f6c27961266

Download Submit
C:\Windows\System\brnjsvl.exe

Filesize
1.9MB

MD5
cc994454fe670e077bbdc30920e26328

SHA1
b2d127afa8f41a5a9912601fce4b85745cd97ec8

SHA256
3f95a07692b2ab4e2bae0438b471e011fc8e2c8ca683a85e6371a57a48876131

SHA512
989a079f632f41a6cd07897ec032ecf15b40554de65124b8d222f1dddde4b365274bd589b3f75f40a95bff4af3c09a07ab60f492b42d7aa7c29dbc397bd8cd31

Download Submit
C:\Windows\System\dZbqMEp.exe

Filesize
1.9MB

MD5
b8c46450315d0397c8871beea3fe2603

SHA1
3d89587fff911c206a2de99923e3d20c3d0b344a

SHA256
c29a984af7716c498d6d3497f966991156a2d44a433a6ea02f47b59def38ae4d

SHA512
7dd9922e104d4e8a416b7614e8466747c7baa93eaf1344779a53346270b319603aa44eb5963ed3e6bd5cd096f7340c0da810698e7f7c96b35abb92e54e780a96

Download Submit
C:\Windows\System\defUQQp.exe

Filesize
1.2MB

MD5
59838366570477b829d7be3ada460f97

SHA1
5a8fe8086b777898b24ccb8bb79e2f0735306e2b

SHA256
3da1ad457c09cf39711abb5a48faa3635088e65d8a2cfb267e46060398e18fb4

SHA512
90dcf54c35d0c85ec13b9350ad6c43e65d8464a3a92966c80c94fd7e40e131d122bdc61e50f32d69ed0b1d22cf599c5bfec1dd55842748fddf0a18865eb0ba0f

Download Submit
C:\Windows\System\defUQQp.exe

Filesize
1.9MB

MD5
fc768d773ef4516d952f75e75d6726cd

SHA1
8ee4c8251445fb486e5e825224a9f655628f5c51

SHA256
c5802b7a018a8b6ca9aef29dcdab9ebbd00f4ccb1dfad9382c161d32b785a97d

SHA512
c38bef589c2e549a4de654770885d06d21e8d04c289cd740a63c0bbd4d6143f439962cdb800298940283cb0c4d65d9b0701ed6404b4125197514bdb9d36df1cf

Download Submit
C:\Windows\System\ebdDmJP.exe

Filesize
1.9MB

MD5
5d1849e54d036485439b6ee546c35188

SHA1
c2926d5f11cfa23462edab91499fea67ab0bcef9

SHA256
2ca8c98b030e02d4c315f55ed43c0860c5b876d634248c1e13c5965ef4324dd0

SHA512
67a427e1b0ecc945ea042fd02b97c561a3eeac9a5cdbd29304188742bb6bda9aef9c6f1bd313d8046e80dacb513dee96ed87af91eda48f238e52ce3053cc96c1

Download Submit
C:\Windows\System\hcfGauE.exe

Filesize
1.4MB

MD5
47e03875c2ad2368171958e756b068ef

SHA1
ea6400dc226b2a01bd2af78f2b7a53aeaf1bd871

SHA256
1b555dd6cd03785e3b5fe14bc4e52796f8057d39097f1c11f56507c73cdfe885

SHA512
92c1979231afcd3b6010edd4a67dc2a19b7fbbae0a72e33205ff73411b4d0e7d02f4baaa94d52ef516dcc37eecc41344c5638addb99effc4643b9d37df8b4249

Download Submit
C:\Windows\System\irHqRHS.exe

Filesize
1.9MB

MD5
d3e307a02b47c058acda28289e0e767d

SHA1
92b8844dcf91df6d729c57e454ef481d8249c54f

SHA256
6da2dc10913d1c0ea2dce94d6ff6b6f79b315afffc095b25bc3e10528c94ed87

SHA512
0544525cebac68cfbe12d7f521c1a8a6383775979c54abadb1bf1bdf0fab78b2ba488602c1dd140db627f88f8d43bdf2c89eecd376da7432bcb965ca17bd9ec8

Download Submit
C:\Windows\System\lAuvcIj.exe

Filesize
1.9MB

MD5
44e0c64a7c2e7ecdfeeb16cbb5a0db99

SHA1
afdcc8f2ad0f74d8c6e39eea470665f5058b1387

SHA256
73cf474fe31161d4e3094b38f1bbf890e35a4f7ad50bc8bd4236060e3519fe96

SHA512
760ee80123c8e37e25b351e48b723920bf487ce68ce258c38aaa38bbcfac8e1fa1c64dc18c416b6bf8f3d316f28675e90c243c80065803e746c342819cd8729e

Download Submit
C:\Windows\System\naEksKk.exe

Filesize
1.1MB

MD5
195933aae9cbff537c7e255588dc1a74

SHA1
a11d78964cf21ad972c809a3b1e71a23448d3f80

SHA256
82de77274a8511984459eb5e4cf788b1be16bb55849c27b549c6077c4d4d5396

SHA512
a98cf91304911b1587975b3ec74599b5e4c434684d3bc43e087ce399431f296f68f1b783d4bcaf38bd153ac0c30b095f088e45cb29d43b5ed86f435ebd53cb92

Download Submit
C:\Windows\System\naEksKk.exe

Filesize
1.9MB

MD5
fa2b79f6e1b8146e91a67083d68c9b2c

SHA1
e0ce41f6325c70659a2192b5a4d8c7bcf2fb8860

SHA256
07b609dcae6166c76a7d6bc8ea5248c42a7f11824690759787eada714c4e7b0c

SHA512
dbb98743a5f4d96e6badd5503f4a52e34e72a0c25298f542cf608e9ebaa907f1b7513e5a61d94e9dfd07e3e0281dfe91fc29a14163693942ad24fdc71f5a7f49

Download Submit
C:\Windows\System\oGVorep.exe

Filesize
1.9MB

MD5
accaf9db48fe07de31cc0fb65b535dbc

SHA1
4187ed4e5a4990951bd418adce78fb0eedf0f038

SHA256
a48f6871b3bd644b9821c96199e0425ee07ecfd26e1bb42c96c67e73a7d1d7ae

SHA512
dc5449ecc5675675dd85db622231419341d2ba6de49e543c0afd18659f338277c9c0369a41fb6989412b7ca2f1f3b1797c503130820ea0074651f43efb8b1844

Download Submit
C:\Windows\System\pcVhdFa.exe

Filesize
1.9MB

MD5
5c5e58ce5bc2e51c00fc01d0e3672c97

SHA1
a654a3d6c3be1a8643cb1ef38f4bed72db6bd3e6

SHA256
076253fe9508a5d444305682f86df84990111cf65620a2496d42463981763e2b

SHA512
dad178ce8f734d8de0f071f8e23b3eead1ae6e292eb9b2c111835c4d4f9d26467f2d6a9e643d4f8d5a3addc8c66e1b26cd6e4b717e3504218a910fec977efb0c

Download Submit
C:\Windows\System\pfEUtIS.exe

Filesize
1.9MB

MD5
296285b8baf4334f169b046925a54398

SHA1
8729253fa76b42a3d2292dad80fa3efa35573c0b

SHA256
48b8d7ea4e22ce0b481f9704824eab49809a403b1ac99d74945e9dd249f1a8bc

SHA512
df4fca34b329515543e2e9eb7367d5f2a57fff574c17d886dadae3a31ddddc7dd346939c195e378b12690dbb518b9700082c82ce31318dee54604358b9cc66b7

Download Submit
C:\Windows\System\qJvWUUC.exe

Filesize
1.9MB

MD5
651cd8823dcb2f18e5d624312ec0452c

SHA1
62da3ff081582d4209dd0faccc7c4bf77125bc58

SHA256
2369541cc100b9e28d535b85bc0ca5a121d652dcf72ebdcc6503b9b8b08c6cc7

SHA512
09d2aab7e03884f9bb269810cc94c88de3c33fc28336b2a63f95e7561babc25defffc587b884a2df163ac3b14e17ac7155b31a904853858fd4cc8dd7e8515fd3

Download Submit
C:\Windows\System\sQmKLbg.exe

Filesize
1.9MB

MD5
c4da7ea32d309f890aac7f80b41294e7

SHA1
078b1126d0dcb8ac615d01ed4114cb7925c2aa86

SHA256
d7e3c777d3d826464e25abb573b386c9a65904b763a8900bc6b331611e62a1db

SHA512
28b55595627e7088c29e74ae363bc9ae44be9879b877971cbaa197088ef37475c21e1fceacca769089ad000a9f69e10f3669ccd47f93391fcff0a75352544c9e

Download Submit
C:\Windows\System\vScyndt.exe

Filesize
8B

MD5
9e16362b7eef9ff59cf4576b688fec20

SHA1
58714a79316bdda8b345ca47c2a7e8087e024871

SHA256
cb157cd47cb9ddacb8fa194262e9cc1364ca68490d93ad041938e77ef90ead7c

SHA512
53056e2e9a952538e1c61538c2bad2166adaf2d4a03d0e97e211329cd7f80967988343aa21690b08c2f1ad6d3fabfdc6095392f57b127d575de79d724d1a09de

Download Submit
C:\Windows\System\wDsgZGA.exe

Filesize
1.9MB

MD5
9643b13ba18769f229ea1d8b8e61c6a9

SHA1
cbc289be52a6f3d79a5bb1fc2ef946edbc1dd27c

SHA256
4c185658cabfddbedf6f48206bd8e4f2bff7fb8cc4509450c1585a2c46a2f728

SHA512
c8e66f898da3083516a5d1085c95507355fd5482f2d6e875b572f7ac4e7d94ab76e275737812d41e3e91b60f8d3a42c7e66f61e5f99bf4821555655c2106d897

Download Submit
C:\Windows\System\xFbZPvA.exe

Filesize
1.9MB

MD5
a4c8ca98d54d0608eaaa4f0741753fa8

SHA1
1adcc1818d0ab7a7d46aed0318e84e4b74676ffc

SHA256
01ddc3f2dd27a03e3e036e5b7403325a722aba87dc1f7e7c6573f6894e49ae4f

SHA512
c9ba3308b879c190470d07751dc105afaede825b773243dc120b0fadbee96414a29a703d55504cb1f4e99748bac19f26b32d239a12bb8253755863486516ca4a

Download Submit
C:\Windows\System\yMyptFt.exe

Filesize
1.9MB

MD5
0584f12851a4ccf5b2ba1eb3834632cf

SHA1
88cadc6b02b458a878372c6310d90e932a470b4a

SHA256
20a249637be1ebb37bf16707e51c0798610c81c395987a5bf4c2ad0f89782dc6

SHA512
1579892cba839b7feb7a7cb7c9a8e3d15759282a9704cd7cb133aa8526b5147b6de831827fc93d622d3677dc15c9d2794b078c01d3bcba5958bd5cfe208bcc16

Download Submit
C:\Windows\System\zJUEffd.exe

Filesize
1.9MB

MD5
60448830798d6e44bb6572903a6da051

SHA1
6620f1b900c7afffea42581faa5c7018fddc7769

SHA256
ca5c46e6ac0324366d0746c1c61a1109c8a0c6141aa03a6e2c70bc04bb34b1d4

SHA512
7d94710380207d0f7c8da7e63f0b75864ddc81ec8d3331de3ba9ac45ad21f9113ed6beab52422d1f6d2566211a118dd26d07396344c3e51016a08ef49558f231

Download Submit
C:\Windows\System\zgVJYcg.exe

Filesize
1.9MB

MD5
a8266d4b6773caa1ff4fad357f56cb0f

SHA1
d428a667eeabb65ea8aafe1e6908ebe8966f3db3

SHA256
c1e3cd7992c019ff1107fa8d647fefed063f68d0a35e6845283508d746369fc4

SHA512
b09ef2e7bc0bfbcf82dfdada3cd6b01eeac3ebcd15448a27bddf7f4eee0f79829d1e93904ca5aff0ec6b40fa8e4721678563d65623d659cdcc647a4885a62d25

Download Submit
C:\Windows\System\zoJUIeV.exe

Filesize
1.9MB

MD5
4f83355e36865563b6f016e0ae52e23e

SHA1
a32fe709ca6e2df005d0f64d9fb187214260be25

SHA256
8dd9259752317a6b2de9b76b205eb7b53a9c4cadb4a153183cda612e145ec39c

SHA512
11467b985946f5380e5ca69864b8f5719e086b6ba0aac77332fae5749a410c00dda0b125da92fcef5095311b283a260d7f80c4d91623f04618b7d9c5353cd342

Download Submit
memory/64-3722-0x00007FF72ADF0000-0x00007FF72B1E2000-memory.dmp

Filesize
3.9MB

Download
memory/64-176-0x00007FF72ADF0000-0x00007FF72B1E2000-memory.dmp

Filesize
3.9MB

Download
memory/420-112-0x00007FF7386A0000-0x00007FF738A92000-memory.dmp

Filesize
3.9MB

Download
memory/420-3688-0x00007FF7386A0000-0x00007FF738A92000-memory.dmp

Filesize
3.9MB

Download
memory/552-1-0x0000029D3CC00000-0x0000029D3CC10000-memory.dmp

Filesize
64KB

Download
memory/552-0-0x00007FF7E1B20000-0x00007FF7E1F12000-memory.dmp

Filesize
3.9MB

Download
memory/720-85-0x00007FF763250000-0x00007FF763642000-memory.dmp

Filesize
3.9MB

Download
memory/720-3690-0x00007FF763250000-0x00007FF763642000-memory.dmp

Filesize
3.9MB

Download
memory/1544-169-0x00007FF712D50000-0x00007FF713142000-memory.dmp

Filesize
3.9MB

Download
memory/1544-3712-0x00007FF712D50000-0x00007FF713142000-memory.dmp

Filesize
3.9MB

Download
memory/1976-47-0x00007FF622430000-0x00007FF622822000-memory.dmp

Filesize
3.9MB

Download
memory/1976-3687-0x00007FF622430000-0x00007FF622822000-memory.dmp

Filesize
3.9MB

Download
memory/2368-3682-0x00007FF6E8210000-0x00007FF6E8602000-memory.dmp

Filesize
3.9MB

Download
memory/2368-33-0x00007FF6E8210000-0x00007FF6E8602000-memory.dmp

Filesize
3.9MB

Download
memory/2368-2722-0x00007FF6E8210000-0x00007FF6E8602000-memory.dmp

Filesize
3.9MB

Download
memory/2428-3680-0x00007FF752C30000-0x00007FF753022000-memory.dmp

Filesize
3.9MB

Download
memory/2428-43-0x00007FF752C30000-0x00007FF753022000-memory.dmp

Filesize
3.9MB

Download
memory/2484-3696-0x00007FF735640000-0x00007FF735A32000-memory.dmp

Filesize
3.9MB

Download
memory/2484-121-0x00007FF735640000-0x00007FF735A32000-memory.dmp

Filesize
3.9MB

Download
memory/2528-3723-0x00007FF67DFC0000-0x00007FF67E3B2000-memory.dmp

Filesize
3.9MB

Download
memory/2528-166-0x00007FF67DFC0000-0x00007FF67E3B2000-memory.dmp

Filesize
3.9MB

Download
memory/2544-84-0x00007FF773110000-0x00007FF773502000-memory.dmp

Filesize
3.9MB

Download
memory/2544-3694-0x00007FF773110000-0x00007FF773502000-memory.dmp

Filesize
3.9MB

Download
memory/2692-88-0x00007FF75D2A0000-0x00007FF75D692000-memory.dmp

Filesize
3.9MB

Download
memory/2692-3698-0x00007FF75D2A0000-0x00007FF75D692000-memory.dmp

Filesize
3.9MB

Download
memory/2812-3718-0x00007FF66A880000-0x00007FF66AC72000-memory.dmp

Filesize
3.9MB

Download
memory/2812-92-0x00007FF66A880000-0x00007FF66AC72000-memory.dmp

Filesize
3.9MB

Download
memory/2812-2985-0x00007FF66A880000-0x00007FF66AC72000-memory.dmp

Filesize
3.9MB

Download
memory/3016-3728-0x00007FF6F62B0000-0x00007FF6F66A2000-memory.dmp

Filesize
3.9MB

Download
memory/3016-138-0x00007FF6F62B0000-0x00007FF6F66A2000-memory.dmp

Filesize
3.9MB

Download
memory/3096-3709-0x00007FF7D6920000-0x00007FF7D6D12000-memory.dmp

Filesize
3.9MB

Download
memory/3096-175-0x00007FF7D6920000-0x00007FF7D6D12000-memory.dmp

Filesize
3.9MB

Download
memory/3396-144-0x00007FF714710000-0x00007FF714B02000-memory.dmp

Filesize
3.9MB

Download
memory/3396-3708-0x00007FF714710000-0x00007FF714B02000-memory.dmp

Filesize
3.9MB

Download
memory/4016-2967-0x0000015F5AA40000-0x0000015F5AA50000-memory.dmp

Filesize
64KB

Download
memory/4016-218-0x0000015F5B8B0000-0x0000015F5C056000-memory.dmp

Filesize
7.6MB

Download
memory/4016-26-0x0000015F5AA40000-0x0000015F5AA50000-memory.dmp

Filesize
64KB

Download
memory/4016-8-0x0000015F428E0000-0x0000015F42902000-memory.dmp

Filesize
136KB

Download
memory/4016-25-0x0000015F5AA40000-0x0000015F5AA50000-memory.dmp

Filesize
64KB

Download
memory/4016-24-0x00007FFD7C500000-0x00007FFD7CFC1000-memory.dmp

Filesize
10.8MB

Download
memory/4444-131-0x00007FF7FD960000-0x00007FF7FDD52000-memory.dmp

Filesize
3.9MB

Download
memory/4444-3702-0x00007FF7FD960000-0x00007FF7FDD52000-memory.dmp

Filesize
3.9MB

Download
memory/4648-101-0x00007FF61A6A0000-0x00007FF61AA92000-memory.dmp

Filesize
3.9MB

Download
memory/4648-3685-0x00007FF61A6A0000-0x00007FF61AA92000-memory.dmp

Filesize
3.9MB

Download
memory/4700-3725-0x00007FF60ACA0000-0x00007FF60B092000-memory.dmp

Filesize
3.9MB

Download
memory/4700-151-0x00007FF60ACA0000-0x00007FF60B092000-memory.dmp

Filesize
3.9MB

Download
memory/4848-3693-0x00007FF7FC0B0000-0x00007FF7FC4A2000-memory.dmp

Filesize
3.9MB

Download
memory/4848-59-0x00007FF7FC0B0000-0x00007FF7FC4A2000-memory.dmp

Filesize
3.9MB

Download
memory/4960-3713-0x00007FF73C080000-0x00007FF73C472000-memory.dmp

Filesize
3.9MB

Download
memory/4960-132-0x00007FF73C080000-0x00007FF73C472000-memory.dmp

Filesize
3.9MB

Download
memory/4984-3700-0x00007FF67FB40000-0x00007FF67FF32000-memory.dmp

Filesize
3.9MB

Download
memory/4984-78-0x00007FF67FB40000-0x00007FF67FF32000-memory.dmp

Filesize
3.9MB

Download