xmrig | 560dacb7555916aa65d2f60024b7ed8eae20c459e02b578ef0e9c3119b019e59

Analysis

max time kernel
62s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 02:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
Size

1.9MB
MD5

08dc521ead9c498aa81c1515f6fd725f
SHA1

788a2d82426892d4a64e9f60f9ee779a664668af
SHA256

560dacb7555916aa65d2f60024b7ed8eae20c459e02b578ef0e9c3119b019e59
SHA512

cdca73a0542eadd192d1bc827a7c58fd3b30ed37a79669053d26eea41d8e3dd0b0e4d53eb069507fe636692757c1a4f36aad65d8d6e0a6c04babdf95d9dca02c
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+UQe:NABS

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 42 IoCs

miner

resource	yara_rule
behavioral2/memory/4664-71-0x00007FF6D0AA0000-0x00007FF6D0E92000-memory.dmp	xmrig
behavioral2/memory/4712-81-0x00007FF6A71D0000-0x00007FF6A75C2000-memory.dmp	xmrig
behavioral2/memory/1228-143-0x00007FF64C8F0000-0x00007FF64CCE2000-memory.dmp	xmrig
behavioral2/memory/2640-162-0x00007FF778F00000-0x00007FF7792F2000-memory.dmp	xmrig
behavioral2/memory/3516-156-0x00007FF7CE730000-0x00007FF7CEB22000-memory.dmp	xmrig
behavioral2/memory/2328-155-0x00007FF6FE6D0000-0x00007FF6FEAC2000-memory.dmp	xmrig
behavioral2/memory/3788-149-0x00007FF707770000-0x00007FF707B62000-memory.dmp	xmrig
behavioral2/memory/1260-137-0x00007FF778AF0000-0x00007FF778EE2000-memory.dmp	xmrig
behavioral2/memory/2996-131-0x00007FF748A10000-0x00007FF748E02000-memory.dmp	xmrig
behavioral2/memory/768-125-0x00007FF7BBEE0000-0x00007FF7BC2D2000-memory.dmp	xmrig
behavioral2/memory/2804-124-0x00007FF7D5400000-0x00007FF7D57F2000-memory.dmp	xmrig
behavioral2/memory/2288-120-0x00007FF686B20000-0x00007FF686F12000-memory.dmp	xmrig
behavioral2/memory/1940-114-0x00007FF7DB120000-0x00007FF7DB512000-memory.dmp	xmrig
behavioral2/memory/1976-108-0x00007FF607950000-0x00007FF607D42000-memory.dmp	xmrig
behavioral2/memory/2044-104-0x00007FF67A200000-0x00007FF67A5F2000-memory.dmp	xmrig
behavioral2/memory/4064-97-0x00007FF69AEA0000-0x00007FF69B292000-memory.dmp	xmrig
behavioral2/memory/3868-83-0x00007FF710290000-0x00007FF710682000-memory.dmp	xmrig
behavioral2/memory/2504-60-0x00007FF60EFC0000-0x00007FF60F3B2000-memory.dmp	xmrig
behavioral2/memory/3304-2615-0x00007FF7D1F90000-0x00007FF7D2382000-memory.dmp	xmrig
behavioral2/memory/60-2616-0x00007FF79C3C0000-0x00007FF79C7B2000-memory.dmp	xmrig
behavioral2/memory/5096-2617-0x00007FF68E8A0000-0x00007FF68EC92000-memory.dmp	xmrig
behavioral2/memory/3304-2620-0x00007FF7D1F90000-0x00007FF7D2382000-memory.dmp	xmrig
behavioral2/memory/1940-2622-0x00007FF7DB120000-0x00007FF7DB512000-memory.dmp	xmrig
behavioral2/memory/60-2626-0x00007FF79C3C0000-0x00007FF79C7B2000-memory.dmp	xmrig
behavioral2/memory/2504-2625-0x00007FF60EFC0000-0x00007FF60F3B2000-memory.dmp	xmrig
behavioral2/memory/2288-2636-0x00007FF686B20000-0x00007FF686F12000-memory.dmp	xmrig
behavioral2/memory/768-2642-0x00007FF7BBEE0000-0x00007FF7BC2D2000-memory.dmp	xmrig
behavioral2/memory/4064-2640-0x00007FF69AEA0000-0x00007FF69B292000-memory.dmp	xmrig
behavioral2/memory/1976-2644-0x00007FF607950000-0x00007FF607D42000-memory.dmp	xmrig
behavioral2/memory/2044-2638-0x00007FF67A200000-0x00007FF67A5F2000-memory.dmp	xmrig
behavioral2/memory/4664-2634-0x00007FF6D0AA0000-0x00007FF6D0E92000-memory.dmp	xmrig
behavioral2/memory/4712-2633-0x00007FF6A71D0000-0x00007FF6A75C2000-memory.dmp	xmrig
behavioral2/memory/2804-2629-0x00007FF7D5400000-0x00007FF7D57F2000-memory.dmp	xmrig
behavioral2/memory/3868-2631-0x00007FF710290000-0x00007FF710682000-memory.dmp	xmrig
behavioral2/memory/2328-2662-0x00007FF6FE6D0000-0x00007FF6FEAC2000-memory.dmp	xmrig
behavioral2/memory/3788-2664-0x00007FF707770000-0x00007FF707B62000-memory.dmp	xmrig
behavioral2/memory/1260-2653-0x00007FF778AF0000-0x00007FF778EE2000-memory.dmp	xmrig
behavioral2/memory/1228-2648-0x00007FF64C8F0000-0x00007FF64CCE2000-memory.dmp	xmrig
behavioral2/memory/2640-2655-0x00007FF778F00000-0x00007FF7792F2000-memory.dmp	xmrig
behavioral2/memory/2996-2647-0x00007FF748A10000-0x00007FF748E02000-memory.dmp	xmrig
behavioral2/memory/3516-2668-0x00007FF7CE730000-0x00007FF7CEB22000-memory.dmp	xmrig
behavioral2/memory/5096-2880-0x00007FF68E8A0000-0x00007FF68EC92000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3304	mHTJHLC.exe
1940	nBFoBNs.exe
60	PpcZLHD.exe
2504	XjHBTOk.exe
4664	fMkhHig.exe
2288	dMBCkpr.exe
4712	ygFtzOI.exe
3868	cZGKhaB.exe
2804	OxiHCSk.exe
4064	ysdyuqt.exe
2044	AIksfpF.exe
768	pcCfGIY.exe
1976	WtQRjNi.exe
2996	sdYdOeF.exe
5096	hPIMynG.exe
1260	GerTsOx.exe
1228	izYtKfK.exe
3788	XJjFKoL.exe
2328	FntXcNI.exe
3516	ePmJaEz.exe
2640	weSRAqA.exe
4660	uzzuGmc.exe
4224	tZjQbuv.exe
2352	GAuyeVu.exe
1348	MiOffkR.exe
536	FGgsGeR.exe
4088	udAxJcm.exe
4472	hjIQSVq.exe
3624	ebYkAKa.exe
2116	VSlwejE.exe
4852	hVfDYqE.exe
3608	wUKaidX.exe
3512	VhfXEuu.exe
4592	goCEEyl.exe
5024	JkJmESS.exe
452	zoBgJYi.exe
2564	MFPxEvd.exe
64	sXyLIyN.exe
1440	VTUsxdb.exe
4680	jEhODdN.exe
944	cQJXSxp.exe
1224	xDvAOsl.exe
4252	tnIahPp.exe
1640	jGmrePw.exe
4364	PpRBWjk.exe
1404	UYuIOTd.exe
4240	kdcnBQs.exe
2228	ljKNHos.exe
2696	EmCpeyu.exe
4936	HcxsMIy.exe
2252	bXHAUtT.exe
2192	aFHLgbb.exe
1956	pqaHJGl.exe
4884	ETuxFYf.exe
5032	spjKqmg.exe
388	bPlafXB.exe
2920	kDfkrue.exe
748	IzPTxGc.exe
2568	SKsgKrm.exe
1716	ygyrJKY.exe
1020	RuBCJqX.exe
3700	eKnqkoH.exe
3024	mIRLuva.exe
2796	PsOjCFG.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/220-0-0x00007FF6F5470000-0x00007FF6F5862000-memory.dmp	upx
behavioral2/files/0x000c000000023b4c-5.dat	upx
behavioral2/files/0x000b000000023ba6-10.dat	upx
behavioral2/files/0x000a000000023baa-16.dat	upx
behavioral2/files/0x000a000000023bab-40.dat	upx
behavioral2/files/0x000a000000023bb2-46.dat	upx
behavioral2/memory/4664-71-0x00007FF6D0AA0000-0x00007FF6D0E92000-memory.dmp	upx
behavioral2/memory/4712-81-0x00007FF6A71D0000-0x00007FF6A75C2000-memory.dmp	upx
behavioral2/files/0x0031000000023bb5-98.dat	upx
behavioral2/files/0x0031000000023bb7-106.dat	upx
behavioral2/files/0x000b000000023ba7-121.dat	upx
behavioral2/memory/1228-143-0x00007FF64C8F0000-0x00007FF64CCE2000-memory.dmp	upx
behavioral2/files/0x000a000000023bbf-152.dat	upx
behavioral2/files/0x000a000000023bc3-183.dat	upx
behavioral2/files/0x000a000000023bc7-195.dat	upx
behavioral2/files/0x000a000000023bc5-193.dat	upx
behavioral2/files/0x000a000000023bc6-190.dat	upx
behavioral2/files/0x000a000000023bc4-188.dat	upx
behavioral2/files/0x000a000000023bc2-178.dat	upx
behavioral2/files/0x000a000000023bc1-173.dat	upx
behavioral2/files/0x000a000000023bc0-168.dat	upx
behavioral2/memory/2640-162-0x00007FF778F00000-0x00007FF7792F2000-memory.dmp	upx
behavioral2/files/0x000a000000023bbe-157.dat	upx
behavioral2/memory/3516-156-0x00007FF7CE730000-0x00007FF7CEB22000-memory.dmp	upx
behavioral2/memory/2328-155-0x00007FF6FE6D0000-0x00007FF6FEAC2000-memory.dmp	upx
behavioral2/files/0x000a000000023bbd-150.dat	upx
behavioral2/memory/3788-149-0x00007FF707770000-0x00007FF707B62000-memory.dmp	upx
behavioral2/files/0x000b000000023bb9-144.dat	upx
behavioral2/files/0x000a000000023bbc-138.dat	upx
behavioral2/memory/1260-137-0x00007FF778AF0000-0x00007FF778EE2000-memory.dmp	upx
behavioral2/memory/2996-131-0x00007FF748A10000-0x00007FF748E02000-memory.dmp	upx
behavioral2/files/0x000b000000023bba-126.dat	upx
behavioral2/memory/768-125-0x00007FF7BBEE0000-0x00007FF7BC2D2000-memory.dmp	upx
behavioral2/memory/2804-124-0x00007FF7D5400000-0x00007FF7D57F2000-memory.dmp	upx
behavioral2/memory/2288-120-0x00007FF686B20000-0x00007FF686F12000-memory.dmp	upx
behavioral2/files/0x000a000000023bbb-116.dat	upx
behavioral2/memory/1940-114-0x00007FF7DB120000-0x00007FF7DB512000-memory.dmp	upx
behavioral2/files/0x000a000000023bb8-112.dat	upx
behavioral2/memory/5096-109-0x00007FF68E8A0000-0x00007FF68EC92000-memory.dmp	upx
behavioral2/memory/1976-108-0x00007FF607950000-0x00007FF607D42000-memory.dmp	upx
behavioral2/memory/2044-104-0x00007FF67A200000-0x00007FF67A5F2000-memory.dmp	upx
behavioral2/files/0x0031000000023bb6-100.dat	upx
behavioral2/memory/4064-97-0x00007FF69AEA0000-0x00007FF69B292000-memory.dmp	upx
behavioral2/memory/3868-83-0x00007FF710290000-0x00007FF710682000-memory.dmp	upx
behavioral2/files/0x000a000000023bb4-79.dat	upx
behavioral2/files/0x000a000000023bb3-77.dat	upx
behavioral2/files/0x000a000000023bb1-73.dat	upx
behavioral2/files/0x000a000000023bb0-65.dat	upx
behavioral2/memory/2504-60-0x00007FF60EFC0000-0x00007FF60F3B2000-memory.dmp	upx
behavioral2/files/0x000a000000023bae-55.dat	upx
behavioral2/files/0x000a000000023bac-53.dat	upx
behavioral2/files/0x000a000000023bad-50.dat	upx
behavioral2/memory/60-49-0x00007FF79C3C0000-0x00007FF79C7B2000-memory.dmp	upx
behavioral2/files/0x000a000000023baf-57.dat	upx
behavioral2/memory/3304-6-0x00007FF7D1F90000-0x00007FF7D2382000-memory.dmp	upx
behavioral2/memory/3304-2615-0x00007FF7D1F90000-0x00007FF7D2382000-memory.dmp	upx
behavioral2/memory/60-2616-0x00007FF79C3C0000-0x00007FF79C7B2000-memory.dmp	upx
behavioral2/memory/5096-2617-0x00007FF68E8A0000-0x00007FF68EC92000-memory.dmp	upx
behavioral2/memory/3304-2620-0x00007FF7D1F90000-0x00007FF7D2382000-memory.dmp	upx
behavioral2/memory/1940-2622-0x00007FF7DB120000-0x00007FF7DB512000-memory.dmp	upx
behavioral2/memory/60-2626-0x00007FF79C3C0000-0x00007FF79C7B2000-memory.dmp	upx
behavioral2/memory/2504-2625-0x00007FF60EFC0000-0x00007FF60F3B2000-memory.dmp	upx
behavioral2/memory/2288-2636-0x00007FF686B20000-0x00007FF686F12000-memory.dmp	upx
behavioral2/memory/768-2642-0x00007FF7BBEE0000-0x00007FF7BC2D2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\paYoeSK.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\eqNprJq.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\IcBfStP.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\WJTEQfq.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\zweTiSm.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\cIjTSOd.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\bTDxveS.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\bFhGXWf.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\PQvCpTH.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\oVAtsor.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\DdYqMsS.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\nQOqtkm.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\PzeEjNg.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\VtGKEvx.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\xOFgrIy.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\FHIUWtQ.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\VowHyFa.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\KCAjiLT.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\bZWFllI.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\CbptOde.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\CWgWlqm.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\TEAgedi.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\xvoivqr.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\QrtDmrC.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\VCXNsYG.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\BHmXeFr.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\cRzIOnc.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\lkItRAR.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\jYJMLzm.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\SCRgVCg.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\WqFqbiw.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\UoCPAVG.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\fouWnFH.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\ldCWzgJ.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\gZulrEp.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\xRdZFlA.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\DZfqeFI.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\SmKedpv.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\LWfSHtw.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\RvAVkGH.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\jEhODdN.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\PJSrOzN.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\UrqndWC.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\CPtGpSO.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\qzDlYMU.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\NyQHIUZ.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\GcsLFmc.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\eZKTgKh.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\OFUlVjs.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\qOBYKMQ.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\aSCEmAl.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\SsKNDle.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\TOjJRtv.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\olWouoL.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\HFDiObX.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\NaVuveI.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\ebVgoQi.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\vBqoqwz.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\XxoVODR.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\YiUPJoq.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\KqbecGR.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\ZbYSzAA.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\mOOcKWM.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\dxlAeoe.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1204	powershell.exe
1204	powershell.exe
1204	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
Token: SeDebugPrivilege	1204	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 220 wrote to memory of 1204	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	85
PID 220 wrote to memory of 1204	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	85
PID 220 wrote to memory of 3304	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	86
PID 220 wrote to memory of 3304	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	86
PID 220 wrote to memory of 1940	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	87
PID 220 wrote to memory of 1940	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	87
PID 220 wrote to memory of 60	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	88
PID 220 wrote to memory of 60	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	88
PID 220 wrote to memory of 2504	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	89
PID 220 wrote to memory of 2504	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	89
PID 220 wrote to memory of 4664	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	90
PID 220 wrote to memory of 4664	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	90
PID 220 wrote to memory of 2288	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	91
PID 220 wrote to memory of 2288	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	91
PID 220 wrote to memory of 4712	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	92
PID 220 wrote to memory of 4712	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	92
PID 220 wrote to memory of 3868	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	93
PID 220 wrote to memory of 3868	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	93
PID 220 wrote to memory of 2804	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	94
PID 220 wrote to memory of 2804	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	94
PID 220 wrote to memory of 4064	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	95
PID 220 wrote to memory of 4064	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	95
PID 220 wrote to memory of 2044	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	96
PID 220 wrote to memory of 2044	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	96
PID 220 wrote to memory of 768	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	97
PID 220 wrote to memory of 768	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	97
PID 220 wrote to memory of 1976	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	98
PID 220 wrote to memory of 1976	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	98
PID 220 wrote to memory of 2996	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	99
PID 220 wrote to memory of 2996	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	99
PID 220 wrote to memory of 5096	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	100
PID 220 wrote to memory of 5096	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	100
PID 220 wrote to memory of 1260	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	101
PID 220 wrote to memory of 1260	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	101
PID 220 wrote to memory of 1228	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	102
PID 220 wrote to memory of 1228	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	102
PID 220 wrote to memory of 3788	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	103
PID 220 wrote to memory of 3788	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	103
PID 220 wrote to memory of 2328	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	104
PID 220 wrote to memory of 2328	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	104
PID 220 wrote to memory of 3516	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	105
PID 220 wrote to memory of 3516	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	105
PID 220 wrote to memory of 2640	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	106
PID 220 wrote to memory of 2640	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	106
PID 220 wrote to memory of 4660	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	107
PID 220 wrote to memory of 4660	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	107
PID 220 wrote to memory of 4224	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	108
PID 220 wrote to memory of 4224	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	108
PID 220 wrote to memory of 2352	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	109
PID 220 wrote to memory of 2352	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	109
PID 220 wrote to memory of 1348	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	110
PID 220 wrote to memory of 1348	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	110
PID 220 wrote to memory of 536	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	111
PID 220 wrote to memory of 536	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	111
PID 220 wrote to memory of 4088	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	112
PID 220 wrote to memory of 4088	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	112
PID 220 wrote to memory of 4472	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	113
PID 220 wrote to memory of 4472	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	113
PID 220 wrote to memory of 3624	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	114
PID 220 wrote to memory of 3624	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	114
PID 220 wrote to memory of 2116	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	115
PID 220 wrote to memory of 2116	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	115
PID 220 wrote to memory of 4852	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	116
PID 220 wrote to memory of 4852	220	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1204
- C:\Windows\System\mHTJHLC.exe
  C:\Windows\System\mHTJHLC.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System\nBFoBNs.exe
  C:\Windows\System\nBFoBNs.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\PpcZLHD.exe
  C:\Windows\System\PpcZLHD.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\XjHBTOk.exe
  C:\Windows\System\XjHBTOk.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\fMkhHig.exe
  C:\Windows\System\fMkhHig.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\dMBCkpr.exe
  C:\Windows\System\dMBCkpr.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\ygFtzOI.exe
  C:\Windows\System\ygFtzOI.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\cZGKhaB.exe
  C:\Windows\System\cZGKhaB.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\OxiHCSk.exe
  C:\Windows\System\OxiHCSk.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\ysdyuqt.exe
  C:\Windows\System\ysdyuqt.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\AIksfpF.exe
  C:\Windows\System\AIksfpF.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\pcCfGIY.exe
  C:\Windows\System\pcCfGIY.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\WtQRjNi.exe
  C:\Windows\System\WtQRjNi.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\sdYdOeF.exe
  C:\Windows\System\sdYdOeF.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\hPIMynG.exe
  C:\Windows\System\hPIMynG.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\GerTsOx.exe
  C:\Windows\System\GerTsOx.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\izYtKfK.exe
  C:\Windows\System\izYtKfK.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\XJjFKoL.exe
  C:\Windows\System\XJjFKoL.exe
  2⤵
  - Executes dropped EXE
  PID:3788
- C:\Windows\System\FntXcNI.exe
  C:\Windows\System\FntXcNI.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\ePmJaEz.exe
  C:\Windows\System\ePmJaEz.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\weSRAqA.exe
  C:\Windows\System\weSRAqA.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\uzzuGmc.exe
  C:\Windows\System\uzzuGmc.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\tZjQbuv.exe
  C:\Windows\System\tZjQbuv.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\GAuyeVu.exe
  C:\Windows\System\GAuyeVu.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\MiOffkR.exe
  C:\Windows\System\MiOffkR.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\FGgsGeR.exe
  C:\Windows\System\FGgsGeR.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\udAxJcm.exe
  C:\Windows\System\udAxJcm.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\hjIQSVq.exe
  C:\Windows\System\hjIQSVq.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\ebYkAKa.exe
  C:\Windows\System\ebYkAKa.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\VSlwejE.exe
  C:\Windows\System\VSlwejE.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\hVfDYqE.exe
  C:\Windows\System\hVfDYqE.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\wUKaidX.exe
  C:\Windows\System\wUKaidX.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\VhfXEuu.exe
  C:\Windows\System\VhfXEuu.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\goCEEyl.exe
  C:\Windows\System\goCEEyl.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\JkJmESS.exe
  C:\Windows\System\JkJmESS.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\zoBgJYi.exe
  C:\Windows\System\zoBgJYi.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\MFPxEvd.exe
  C:\Windows\System\MFPxEvd.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\sXyLIyN.exe
  C:\Windows\System\sXyLIyN.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\VTUsxdb.exe
  C:\Windows\System\VTUsxdb.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\jEhODdN.exe
  C:\Windows\System\jEhODdN.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\cQJXSxp.exe
  C:\Windows\System\cQJXSxp.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\xDvAOsl.exe
  C:\Windows\System\xDvAOsl.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\tnIahPp.exe
  C:\Windows\System\tnIahPp.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\jGmrePw.exe
  C:\Windows\System\jGmrePw.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\PpRBWjk.exe
  C:\Windows\System\PpRBWjk.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\UYuIOTd.exe
  C:\Windows\System\UYuIOTd.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\kdcnBQs.exe
  C:\Windows\System\kdcnBQs.exe
  2⤵
  - Executes dropped EXE
  PID:4240
- C:\Windows\System\ljKNHos.exe
  C:\Windows\System\ljKNHos.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\EmCpeyu.exe
  C:\Windows\System\EmCpeyu.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\HcxsMIy.exe
  C:\Windows\System\HcxsMIy.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\bXHAUtT.exe
  C:\Windows\System\bXHAUtT.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\aFHLgbb.exe
  C:\Windows\System\aFHLgbb.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\pqaHJGl.exe
  C:\Windows\System\pqaHJGl.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\ETuxFYf.exe
  C:\Windows\System\ETuxFYf.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\spjKqmg.exe
  C:\Windows\System\spjKqmg.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\bPlafXB.exe
  C:\Windows\System\bPlafXB.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\kDfkrue.exe
  C:\Windows\System\kDfkrue.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\IzPTxGc.exe
  C:\Windows\System\IzPTxGc.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\SKsgKrm.exe
  C:\Windows\System\SKsgKrm.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\ygyrJKY.exe
  C:\Windows\System\ygyrJKY.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\RuBCJqX.exe
  C:\Windows\System\RuBCJqX.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\eKnqkoH.exe
  C:\Windows\System\eKnqkoH.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System\mIRLuva.exe
  C:\Windows\System\mIRLuva.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\PsOjCFG.exe
  C:\Windows\System\PsOjCFG.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\qyMDQfk.exe
  C:\Windows\System\qyMDQfk.exe
  2⤵
  PID:3792
- C:\Windows\System\PsFaBqf.exe
  C:\Windows\System\PsFaBqf.exe
  2⤵
  PID:1076
- C:\Windows\System\WDEmPpL.exe
  C:\Windows\System\WDEmPpL.exe
  2⤵
  PID:4360
- C:\Windows\System\sHFjhHS.exe
  C:\Windows\System\sHFjhHS.exe
  2⤵
  PID:4912
- C:\Windows\System\TVlnDOW.exe
  C:\Windows\System\TVlnDOW.exe
  2⤵
  PID:5040
- C:\Windows\System\pdsprwp.exe
  C:\Windows\System\pdsprwp.exe
  2⤵
  PID:2556
- C:\Windows\System\QUvDhFj.exe
  C:\Windows\System\QUvDhFj.exe
  2⤵
  PID:1732
- C:\Windows\System\CCEXRxJ.exe
  C:\Windows\System\CCEXRxJ.exe
  2⤵
  PID:4292
- C:\Windows\System\YqnxVWg.exe
  C:\Windows\System\YqnxVWg.exe
  2⤵
  PID:3120
- C:\Windows\System\IscdeLU.exe
  C:\Windows\System\IscdeLU.exe
  2⤵
  PID:4960
- C:\Windows\System\fywmgvb.exe
  C:\Windows\System\fywmgvb.exe
  2⤵
  PID:5144
- C:\Windows\System\atBuUyO.exe
  C:\Windows\System\atBuUyO.exe
  2⤵
  PID:5172
- C:\Windows\System\pRsTzHN.exe
  C:\Windows\System\pRsTzHN.exe
  2⤵
  PID:5204
- C:\Windows\System\ezWsSRh.exe
  C:\Windows\System\ezWsSRh.exe
  2⤵
  PID:5232
- C:\Windows\System\LXMkUMx.exe
  C:\Windows\System\LXMkUMx.exe
  2⤵
  PID:5256
- C:\Windows\System\nKzYCOC.exe
  C:\Windows\System\nKzYCOC.exe
  2⤵
  PID:5284
- C:\Windows\System\WxXsKMX.exe
  C:\Windows\System\WxXsKMX.exe
  2⤵
  PID:5312
- C:\Windows\System\HdibXFJ.exe
  C:\Windows\System\HdibXFJ.exe
  2⤵
  PID:5340
- C:\Windows\System\NFKqimG.exe
  C:\Windows\System\NFKqimG.exe
  2⤵
  PID:5368
- C:\Windows\System\RUgvalu.exe
  C:\Windows\System\RUgvalu.exe
  2⤵
  PID:5396
- C:\Windows\System\SUFefNN.exe
  C:\Windows\System\SUFefNN.exe
  2⤵
  PID:5424
- C:\Windows\System\CfQXsAh.exe
  C:\Windows\System\CfQXsAh.exe
  2⤵
  PID:5452
- C:\Windows\System\rhhZtbt.exe
  C:\Windows\System\rhhZtbt.exe
  2⤵
  PID:5480
- C:\Windows\System\fzSYKoG.exe
  C:\Windows\System\fzSYKoG.exe
  2⤵
  PID:5508
- C:\Windows\System\aLdAkvZ.exe
  C:\Windows\System\aLdAkvZ.exe
  2⤵
  PID:5536
- C:\Windows\System\sMroGAU.exe
  C:\Windows\System\sMroGAU.exe
  2⤵
  PID:5564
- C:\Windows\System\CuPcTqN.exe
  C:\Windows\System\CuPcTqN.exe
  2⤵
  PID:5592
- C:\Windows\System\KoGpUNg.exe
  C:\Windows\System\KoGpUNg.exe
  2⤵
  PID:5620
- C:\Windows\System\osCCjwA.exe
  C:\Windows\System\osCCjwA.exe
  2⤵
  PID:5648
- C:\Windows\System\fouWnFH.exe
  C:\Windows\System\fouWnFH.exe
  2⤵
  PID:5676
- C:\Windows\System\BApAuxh.exe
  C:\Windows\System\BApAuxh.exe
  2⤵
  PID:5704
- C:\Windows\System\DYzKLAW.exe
  C:\Windows\System\DYzKLAW.exe
  2⤵
  PID:5732
- C:\Windows\System\tZeGDIs.exe
  C:\Windows\System\tZeGDIs.exe
  2⤵
  PID:5760
- C:\Windows\System\tIWXeJv.exe
  C:\Windows\System\tIWXeJv.exe
  2⤵
  PID:5788
- C:\Windows\System\qXFIenH.exe
  C:\Windows\System\qXFIenH.exe
  2⤵
  PID:5816
- C:\Windows\System\cYhbwzI.exe
  C:\Windows\System\cYhbwzI.exe
  2⤵
  PID:5844
- C:\Windows\System\npxLMXR.exe
  C:\Windows\System\npxLMXR.exe
  2⤵
  PID:5872
- C:\Windows\System\hxvUjDP.exe
  C:\Windows\System\hxvUjDP.exe
  2⤵
  PID:5900
- C:\Windows\System\gqDVWXH.exe
  C:\Windows\System\gqDVWXH.exe
  2⤵
  PID:5960
- C:\Windows\System\KfLyRmC.exe
  C:\Windows\System\KfLyRmC.exe
  2⤵
  PID:5980
- C:\Windows\System\sDWwhdm.exe
  C:\Windows\System\sDWwhdm.exe
  2⤵
  PID:5996
- C:\Windows\System\zyTjpWi.exe
  C:\Windows\System\zyTjpWi.exe
  2⤵
  PID:6020
- C:\Windows\System\PJEwRRF.exe
  C:\Windows\System\PJEwRRF.exe
  2⤵
  PID:6048
- C:\Windows\System\uulMrgc.exe
  C:\Windows\System\uulMrgc.exe
  2⤵
  PID:6068
- C:\Windows\System\yaMVbAI.exe
  C:\Windows\System\yaMVbAI.exe
  2⤵
  PID:6096
- C:\Windows\System\ckEaVme.exe
  C:\Windows\System\ckEaVme.exe
  2⤵
  PID:6124
- C:\Windows\System\WJTEQfq.exe
  C:\Windows\System\WJTEQfq.exe
  2⤵
  PID:1104
- C:\Windows\System\ceLHVNH.exe
  C:\Windows\System\ceLHVNH.exe
  2⤵
  PID:2760
- C:\Windows\System\XdLtDeH.exe
  C:\Windows\System\XdLtDeH.exe
  2⤵
  PID:4300
- C:\Windows\System\nyzzSso.exe
  C:\Windows\System\nyzzSso.exe
  2⤵
  PID:1420
- C:\Windows\System\wCDZdcw.exe
  C:\Windows\System\wCDZdcw.exe
  2⤵
  PID:3404
- C:\Windows\System\fvjyQlF.exe
  C:\Windows\System\fvjyQlF.exe
  2⤵
  PID:5132
- C:\Windows\System\HXGoQag.exe
  C:\Windows\System\HXGoQag.exe
  2⤵
  PID:5196
- C:\Windows\System\DMZnEWL.exe
  C:\Windows\System\DMZnEWL.exe
  2⤵
  PID:5268
- C:\Windows\System\YspBDvE.exe
  C:\Windows\System\YspBDvE.exe
  2⤵
  PID:5328
- C:\Windows\System\pIJqNNp.exe
  C:\Windows\System\pIJqNNp.exe
  2⤵
  PID:5388
- C:\Windows\System\lbkXixo.exe
  C:\Windows\System\lbkXixo.exe
  2⤵
  PID:5440
- C:\Windows\System\WpHXGxN.exe
  C:\Windows\System\WpHXGxN.exe
  2⤵
  PID:5504
- C:\Windows\System\BvhHkuq.exe
  C:\Windows\System\BvhHkuq.exe
  2⤵
  PID:5576
- C:\Windows\System\cswXCaj.exe
  C:\Windows\System\cswXCaj.exe
  2⤵
  PID:5636
- C:\Windows\System\wJKreIJ.exe
  C:\Windows\System\wJKreIJ.exe
  2⤵
  PID:5696
- C:\Windows\System\NHMWLGM.exe
  C:\Windows\System\NHMWLGM.exe
  2⤵
  PID:5752
- C:\Windows\System\DPCOhES.exe
  C:\Windows\System\DPCOhES.exe
  2⤵
  PID:5828
- C:\Windows\System\wIFrLaD.exe
  C:\Windows\System\wIFrLaD.exe
  2⤵
  PID:5888
- C:\Windows\System\SWuyvaR.exe
  C:\Windows\System\SWuyvaR.exe
  2⤵
  PID:5956
- C:\Windows\System\BaIYKwm.exe
  C:\Windows\System\BaIYKwm.exe
  2⤵
  PID:6016
- C:\Windows\System\zsruwYU.exe
  C:\Windows\System\zsruwYU.exe
  2⤵
  PID:6084
- C:\Windows\System\BsTIVzv.exe
  C:\Windows\System\BsTIVzv.exe
  2⤵
  PID:6140
- C:\Windows\System\dpNlnrx.exe
  C:\Windows\System\dpNlnrx.exe
  2⤵
  PID:2476
- C:\Windows\System\ynLbbbf.exe
  C:\Windows\System\ynLbbbf.exe
  2⤵
  PID:2560
- C:\Windows\System\BFuaFqQ.exe
  C:\Windows\System\BFuaFqQ.exe
  2⤵
  PID:5184
- C:\Windows\System\CudttVL.exe
  C:\Windows\System\CudttVL.exe
  2⤵
  PID:5308
- C:\Windows\System\vbQBjCD.exe
  C:\Windows\System\vbQBjCD.exe
  2⤵
  PID:3256
- C:\Windows\System\FaJxNxA.exe
  C:\Windows\System\FaJxNxA.exe
  2⤵
  PID:5548
- C:\Windows\System\MQWgVlh.exe
  C:\Windows\System\MQWgVlh.exe
  2⤵
  PID:5664
- C:\Windows\System\PXVSoyi.exe
  C:\Windows\System\PXVSoyi.exe
  2⤵
  PID:5800
- C:\Windows\System\aQyOWPp.exe
  C:\Windows\System\aQyOWPp.exe
  2⤵
  PID:5864
- C:\Windows\System\spEpAQP.exe
  C:\Windows\System\spEpAQP.exe
  2⤵
  PID:5992
- C:\Windows\System\MrxDEda.exe
  C:\Windows\System\MrxDEda.exe
  2⤵
  PID:3956
- C:\Windows\System\wMhVMkn.exe
  C:\Windows\System\wMhVMkn.exe
  2⤵
  PID:4668
- C:\Windows\System\xVLthxG.exe
  C:\Windows\System\xVLthxG.exe
  2⤵
  PID:404
- C:\Windows\System\sRMBfvr.exe
  C:\Windows\System\sRMBfvr.exe
  2⤵
  PID:5496
- C:\Windows\System\YutFVHn.exe
  C:\Windows\System\YutFVHn.exe
  2⤵
  PID:5728
- C:\Windows\System\eCiQbFc.exe
  C:\Windows\System\eCiQbFc.exe
  2⤵
  PID:6172
- C:\Windows\System\ukGXqiG.exe
  C:\Windows\System\ukGXqiG.exe
  2⤵
  PID:6200
- C:\Windows\System\pxSWQAZ.exe
  C:\Windows\System\pxSWQAZ.exe
  2⤵
  PID:6228
- C:\Windows\System\wvnLxEe.exe
  C:\Windows\System\wvnLxEe.exe
  2⤵
  PID:6256
- C:\Windows\System\qlpuOhq.exe
  C:\Windows\System\qlpuOhq.exe
  2⤵
  PID:6284
- C:\Windows\System\MESTqGH.exe
  C:\Windows\System\MESTqGH.exe
  2⤵
  PID:6312
- C:\Windows\System\hyYFzLk.exe
  C:\Windows\System\hyYFzLk.exe
  2⤵
  PID:6340
- C:\Windows\System\DCVbRKn.exe
  C:\Windows\System\DCVbRKn.exe
  2⤵
  PID:6368
- C:\Windows\System\KXdMYYI.exe
  C:\Windows\System\KXdMYYI.exe
  2⤵
  PID:6396
- C:\Windows\System\sxSpOAT.exe
  C:\Windows\System\sxSpOAT.exe
  2⤵
  PID:6424
- C:\Windows\System\RznuZut.exe
  C:\Windows\System\RznuZut.exe
  2⤵
  PID:6452
- C:\Windows\System\mwMYRXp.exe
  C:\Windows\System\mwMYRXp.exe
  2⤵
  PID:6480
- C:\Windows\System\DATesVd.exe
  C:\Windows\System\DATesVd.exe
  2⤵
  PID:6508
- C:\Windows\System\dGizLJI.exe
  C:\Windows\System\dGizLJI.exe
  2⤵
  PID:6536
- C:\Windows\System\TMFLIOH.exe
  C:\Windows\System\TMFLIOH.exe
  2⤵
  PID:6564
- C:\Windows\System\bKjbctU.exe
  C:\Windows\System\bKjbctU.exe
  2⤵
  PID:6592
- C:\Windows\System\cGutsRA.exe
  C:\Windows\System\cGutsRA.exe
  2⤵
  PID:6620
- C:\Windows\System\QIRFEBy.exe
  C:\Windows\System\QIRFEBy.exe
  2⤵
  PID:6648
- C:\Windows\System\BstXxMI.exe
  C:\Windows\System\BstXxMI.exe
  2⤵
  PID:6672
- C:\Windows\System\DOWPNBx.exe
  C:\Windows\System\DOWPNBx.exe
  2⤵
  PID:6700
- C:\Windows\System\ipmqiFw.exe
  C:\Windows\System\ipmqiFw.exe
  2⤵
  PID:6728
- C:\Windows\System\Mbcwtxf.exe
  C:\Windows\System\Mbcwtxf.exe
  2⤵
  PID:6760
- C:\Windows\System\KoqzIss.exe
  C:\Windows\System\KoqzIss.exe
  2⤵
  PID:6788
- C:\Windows\System\zuMuyoy.exe
  C:\Windows\System\zuMuyoy.exe
  2⤵
  PID:6816
- C:\Windows\System\UWlgOgt.exe
  C:\Windows\System\UWlgOgt.exe
  2⤵
  PID:6844
- C:\Windows\System\ArBqcSg.exe
  C:\Windows\System\ArBqcSg.exe
  2⤵
  PID:6872
- C:\Windows\System\nNWOWEy.exe
  C:\Windows\System\nNWOWEy.exe
  2⤵
  PID:6896
- C:\Windows\System\TyWrRhC.exe
  C:\Windows\System\TyWrRhC.exe
  2⤵
  PID:6924
- C:\Windows\System\UguwjrS.exe
  C:\Windows\System\UguwjrS.exe
  2⤵
  PID:6956
- C:\Windows\System\CtOkrwR.exe
  C:\Windows\System\CtOkrwR.exe
  2⤵
  PID:6984
- C:\Windows\System\ZHhXFBX.exe
  C:\Windows\System\ZHhXFBX.exe
  2⤵
  PID:7012
- C:\Windows\System\UlSNpsz.exe
  C:\Windows\System\UlSNpsz.exe
  2⤵
  PID:7036
- C:\Windows\System\tKcLCzK.exe
  C:\Windows\System\tKcLCzK.exe
  2⤵
  PID:7068
- C:\Windows\System\hzAiznn.exe
  C:\Windows\System\hzAiznn.exe
  2⤵
  PID:7092
- C:\Windows\System\zelfRVL.exe
  C:\Windows\System\zelfRVL.exe
  2⤵
  PID:7120
- C:\Windows\System\TsneinW.exe
  C:\Windows\System\TsneinW.exe
  2⤵
  PID:1900
- C:\Windows\System\NHTaOYO.exe
  C:\Windows\System\NHTaOYO.exe
  2⤵
  PID:5248
- C:\Windows\System\xnNlbfs.exe
  C:\Windows\System\xnNlbfs.exe
  2⤵
  PID:1688
- C:\Windows\System\ZaNotlL.exe
  C:\Windows\System\ZaNotlL.exe
  2⤵
  PID:856
- C:\Windows\System\VzcChTX.exe
  C:\Windows\System\VzcChTX.exe
  2⤵
  PID:4640
- C:\Windows\System\vhnyxsE.exe
  C:\Windows\System\vhnyxsE.exe
  2⤵
  PID:6248
- C:\Windows\System\VruoLKs.exe
  C:\Windows\System\VruoLKs.exe
  2⤵
  PID:3364
- C:\Windows\System\hwiBkeX.exe
  C:\Windows\System\hwiBkeX.exe
  2⤵
  PID:6416
- C:\Windows\System\nDXDNoO.exe
  C:\Windows\System\nDXDNoO.exe
  2⤵
  PID:6468
- C:\Windows\System\DbqXYTN.exe
  C:\Windows\System\DbqXYTN.exe
  2⤵
  PID:6500
- C:\Windows\System\KoAAAkB.exe
  C:\Windows\System\KoAAAkB.exe
  2⤵
  PID:6580
- C:\Windows\System\UbulqXK.exe
  C:\Windows\System\UbulqXK.exe
  2⤵
  PID:4560
- C:\Windows\System\qhsfUYi.exe
  C:\Windows\System\qhsfUYi.exe
  2⤵
  PID:6632
- C:\Windows\System\qGiXCPL.exe
  C:\Windows\System\qGiXCPL.exe
  2⤵
  PID:6688
- C:\Windows\System\sIjnPVp.exe
  C:\Windows\System\sIjnPVp.exe
  2⤵
  PID:6724
- C:\Windows\System\aGzDdxS.exe
  C:\Windows\System\aGzDdxS.exe
  2⤵
  PID:3412
- C:\Windows\System\OkygGro.exe
  C:\Windows\System\OkygGro.exe
  2⤵
  PID:6804
- C:\Windows\System\vGUHceJ.exe
  C:\Windows\System\vGUHceJ.exe
  2⤵
  PID:6832
- C:\Windows\System\NWmIShh.exe
  C:\Windows\System\NWmIShh.exe
  2⤵
  PID:6884
- C:\Windows\System\uwJccEY.exe
  C:\Windows\System\uwJccEY.exe
  2⤵
  PID:6968
- C:\Windows\System\roDmNdM.exe
  C:\Windows\System\roDmNdM.exe
  2⤵
  PID:7004
- C:\Windows\System\jWphltB.exe
  C:\Windows\System\jWphltB.exe
  2⤵
  PID:4436
- C:\Windows\System\UCeNQsN.exe
  C:\Windows\System\UCeNQsN.exe
  2⤵
  PID:7088
- C:\Windows\System\pVndvpY.exe
  C:\Windows\System\pVndvpY.exe
  2⤵
  PID:2036
- C:\Windows\System\NBCPicq.exe
  C:\Windows\System\NBCPicq.exe
  2⤵
  PID:2084
- C:\Windows\System\suqaCuF.exe
  C:\Windows\System\suqaCuF.exe
  2⤵
  PID:396
- C:\Windows\System\bSvBxqg.exe
  C:\Windows\System\bSvBxqg.exe
  2⤵
  PID:4860
- C:\Windows\System\fQhGnDW.exe
  C:\Windows\System\fQhGnDW.exe
  2⤵
  PID:7112
- C:\Windows\System\sqXfDmm.exe
  C:\Windows\System\sqXfDmm.exe
  2⤵
  PID:5412
- C:\Windows\System\AGheqws.exe
  C:\Windows\System\AGheqws.exe
  2⤵
  PID:6160
- C:\Windows\System\wEdxoIw.exe
  C:\Windows\System\wEdxoIw.exe
  2⤵
  PID:6296
- C:\Windows\System\YbgrZMs.exe
  C:\Windows\System\YbgrZMs.exe
  2⤵
  PID:6556
- C:\Windows\System\QRaHvPh.exe
  C:\Windows\System\QRaHvPh.exe
  2⤵
  PID:1876
- C:\Windows\System\TSDMdGI.exe
  C:\Windows\System\TSDMdGI.exe
  2⤵
  PID:6772
- C:\Windows\System\uorHlQZ.exe
  C:\Windows\System\uorHlQZ.exe
  2⤵
  PID:6940
- C:\Windows\System\PGDpSgo.exe
  C:\Windows\System\PGDpSgo.exe
  2⤵
  PID:7000
- C:\Windows\System\uNuqKPz.exe
  C:\Windows\System\uNuqKPz.exe
  2⤵
  PID:4288
- C:\Windows\System\OqkpiOT.exe
  C:\Windows\System\OqkpiOT.exe
  2⤵
  PID:7032
- C:\Windows\System\eZCftdq.exe
  C:\Windows\System\eZCftdq.exe
  2⤵
  PID:1444
- C:\Windows\System\Kuxkcul.exe
  C:\Windows\System\Kuxkcul.exe
  2⤵
  PID:6216
- C:\Windows\System\qdvmrFY.exe
  C:\Windows\System\qdvmrFY.exe
  2⤵
  PID:6440
- C:\Windows\System\hKZDxDB.exe
  C:\Windows\System\hKZDxDB.exe
  2⤵
  PID:6860
- C:\Windows\System\VwjSIhz.exe
  C:\Windows\System\VwjSIhz.exe
  2⤵
  PID:2344
- C:\Windows\System\sbOLekj.exe
  C:\Windows\System\sbOLekj.exe
  2⤵
  PID:4452
- C:\Windows\System\XoviKfK.exe
  C:\Windows\System\XoviKfK.exe
  2⤵
  PID:6720
- C:\Windows\System\hkXtvZX.exe
  C:\Windows\System\hkXtvZX.exe
  2⤵
  PID:5932
- C:\Windows\System\CbtofAk.exe
  C:\Windows\System\CbtofAk.exe
  2⤵
  PID:7188
- C:\Windows\System\hPjwffP.exe
  C:\Windows\System\hPjwffP.exe
  2⤵
  PID:7216
- C:\Windows\System\yLOsthn.exe
  C:\Windows\System\yLOsthn.exe
  2⤵
  PID:7260
- C:\Windows\System\sSlaEVC.exe
  C:\Windows\System\sSlaEVC.exe
  2⤵
  PID:7276
- C:\Windows\System\oEqhbbi.exe
  C:\Windows\System\oEqhbbi.exe
  2⤵
  PID:7296
- C:\Windows\System\KqDSTwz.exe
  C:\Windows\System\KqDSTwz.exe
  2⤵
  PID:7324
- C:\Windows\System\hymoigw.exe
  C:\Windows\System\hymoigw.exe
  2⤵
  PID:7348
- C:\Windows\System\Okttqba.exe
  C:\Windows\System\Okttqba.exe
  2⤵
  PID:7368
- C:\Windows\System\XGdOwNZ.exe
  C:\Windows\System\XGdOwNZ.exe
  2⤵
  PID:7416
- C:\Windows\System\yfBdclg.exe
  C:\Windows\System\yfBdclg.exe
  2⤵
  PID:7452
- C:\Windows\System\DYudvqC.exe
  C:\Windows\System\DYudvqC.exe
  2⤵
  PID:7500
- C:\Windows\System\mRgtQue.exe
  C:\Windows\System\mRgtQue.exe
  2⤵
  PID:7524
- C:\Windows\System\YaYskCf.exe
  C:\Windows\System\YaYskCf.exe
  2⤵
  PID:7544
- C:\Windows\System\lEsjyjC.exe
  C:\Windows\System\lEsjyjC.exe
  2⤵
  PID:7588
- C:\Windows\System\dSzKlJG.exe
  C:\Windows\System\dSzKlJG.exe
  2⤵
  PID:7604
- C:\Windows\System\qaNzSXy.exe
  C:\Windows\System\qaNzSXy.exe
  2⤵
  PID:7644
- C:\Windows\System\uqtrFRD.exe
  C:\Windows\System\uqtrFRD.exe
  2⤵
  PID:7664
- C:\Windows\System\hFJKPKE.exe
  C:\Windows\System\hFJKPKE.exe
  2⤵
  PID:7692
- C:\Windows\System\xxaFvij.exe
  C:\Windows\System\xxaFvij.exe
  2⤵
  PID:7720
- C:\Windows\System\nuxCXQz.exe
  C:\Windows\System\nuxCXQz.exe
  2⤵
  PID:7760
- C:\Windows\System\sBedFky.exe
  C:\Windows\System\sBedFky.exe
  2⤵
  PID:7776
- C:\Windows\System\jumohiK.exe
  C:\Windows\System\jumohiK.exe
  2⤵
  PID:7796
- C:\Windows\System\DeOFOsd.exe
  C:\Windows\System\DeOFOsd.exe
  2⤵
  PID:7824
- C:\Windows\System\YLvGOKg.exe
  C:\Windows\System\YLvGOKg.exe
  2⤵
  PID:7852
- C:\Windows\System\nJRUnaM.exe
  C:\Windows\System\nJRUnaM.exe
  2⤵
  PID:7884
- C:\Windows\System\gKgWmSZ.exe
  C:\Windows\System\gKgWmSZ.exe
  2⤵
  PID:7900
- C:\Windows\System\etVNLHg.exe
  C:\Windows\System\etVNLHg.exe
  2⤵
  PID:7924
- C:\Windows\System\kllQEJP.exe
  C:\Windows\System\kllQEJP.exe
  2⤵
  PID:7976
- C:\Windows\System\JanAuOX.exe
  C:\Windows\System\JanAuOX.exe
  2⤵
  PID:8000
- C:\Windows\System\FfXvaYO.exe
  C:\Windows\System\FfXvaYO.exe
  2⤵
  PID:8016
- C:\Windows\System\iMcoUaE.exe
  C:\Windows\System\iMcoUaE.exe
  2⤵
  PID:8060
- C:\Windows\System\eFqrtpV.exe
  C:\Windows\System\eFqrtpV.exe
  2⤵
  PID:8080
- C:\Windows\System\VtLqCJx.exe
  C:\Windows\System\VtLqCJx.exe
  2⤵
  PID:8096
- C:\Windows\System\KjUZkuB.exe
  C:\Windows\System\KjUZkuB.exe
  2⤵
  PID:8120
- C:\Windows\System\KjagZzK.exe
  C:\Windows\System\KjagZzK.exe
  2⤵
  PID:8184
- C:\Windows\System\qAGVkxv.exe
  C:\Windows\System\qAGVkxv.exe
  2⤵
  PID:6244
- C:\Windows\System\iiVkjjp.exe
  C:\Windows\System\iiVkjjp.exe
  2⤵
  PID:7204
- C:\Windows\System\qBMQiEM.exe
  C:\Windows\System\qBMQiEM.exe
  2⤵
  PID:7248
- C:\Windows\System\TUGhlyM.exe
  C:\Windows\System\TUGhlyM.exe
  2⤵
  PID:7268
- C:\Windows\System\zGKOYEL.exe
  C:\Windows\System\zGKOYEL.exe
  2⤵
  PID:7360
- C:\Windows\System\YDRLvCW.exe
  C:\Windows\System\YDRLvCW.exe
  2⤵
  PID:7484
- C:\Windows\System\uRyikeP.exe
  C:\Windows\System\uRyikeP.exe
  2⤵
  PID:7536
- C:\Windows\System\iIMZlbN.exe
  C:\Windows\System\iIMZlbN.exe
  2⤵
  PID:7596
- C:\Windows\System\wCVcvuD.exe
  C:\Windows\System\wCVcvuD.exe
  2⤵
  PID:7636
- C:\Windows\System\OPAOjVZ.exe
  C:\Windows\System\OPAOjVZ.exe
  2⤵
  PID:7688
- C:\Windows\System\HKMIPgu.exe
  C:\Windows\System\HKMIPgu.exe
  2⤵
  PID:7752
- C:\Windows\System\KqbecGR.exe
  C:\Windows\System\KqbecGR.exe
  2⤵
  PID:7804
- C:\Windows\System\tyNyOeL.exe
  C:\Windows\System\tyNyOeL.exe
  2⤵
  PID:7864
- C:\Windows\System\HnkmqSq.exe
  C:\Windows\System\HnkmqSq.exe
  2⤵
  PID:7892
- C:\Windows\System\DLOLMPV.exe
  C:\Windows\System\DLOLMPV.exe
  2⤵
  PID:7992
- C:\Windows\System\JhVNuuD.exe
  C:\Windows\System\JhVNuuD.exe
  2⤵
  PID:8068
- C:\Windows\System\JrcGQBZ.exe
  C:\Windows\System\JrcGQBZ.exe
  2⤵
  PID:8140
- C:\Windows\System\fElfPhh.exe
  C:\Windows\System\fElfPhh.exe
  2⤵
  PID:7284
- C:\Windows\System\fWeaeFZ.exe
  C:\Windows\System\fWeaeFZ.exe
  2⤵
  PID:7396
- C:\Windows\System\ToVRXFv.exe
  C:\Windows\System\ToVRXFv.exe
  2⤵
  PID:7600
- C:\Windows\System\WTEkNgY.exe
  C:\Windows\System\WTEkNgY.exe
  2⤵
  PID:7660
- C:\Windows\System\BMMmzza.exe
  C:\Windows\System\BMMmzza.exe
  2⤵
  PID:7820
- C:\Windows\System\DLbIeOF.exe
  C:\Windows\System\DLbIeOF.exe
  2⤵
  PID:8108
- C:\Windows\System\tnoulVh.exe
  C:\Windows\System\tnoulVh.exe
  2⤵
  PID:7304
- C:\Windows\System\YDezReS.exe
  C:\Windows\System\YDezReS.exe
  2⤵
  PID:7448
- C:\Windows\System\cHonvcU.exe
  C:\Windows\System\cHonvcU.exe
  2⤵
  PID:7968
- C:\Windows\System\hFCvwPz.exe
  C:\Windows\System\hFCvwPz.exe
  2⤵
  PID:7180
- C:\Windows\System\slqVMIg.exe
  C:\Windows\System\slqVMIg.exe
  2⤵
  PID:7832
- C:\Windows\System\xcRLLlB.exe
  C:\Windows\System\xcRLLlB.exe
  2⤵
  PID:8220
- C:\Windows\System\FgHCOsX.exe
  C:\Windows\System\FgHCOsX.exe
  2⤵
  PID:8240
- C:\Windows\System\EwSncON.exe
  C:\Windows\System\EwSncON.exe
  2⤵
  PID:8284
- C:\Windows\System\UFunKha.exe
  C:\Windows\System\UFunKha.exe
  2⤵
  PID:8328
- C:\Windows\System\kKGuQyd.exe
  C:\Windows\System\kKGuQyd.exe
  2⤵
  PID:8344
- C:\Windows\System\frBFepH.exe
  C:\Windows\System\frBFepH.exe
  2⤵
  PID:8368
- C:\Windows\System\dWjCBFW.exe
  C:\Windows\System\dWjCBFW.exe
  2⤵
  PID:8384
- C:\Windows\System\kBfPKOq.exe
  C:\Windows\System\kBfPKOq.exe
  2⤵
  PID:8412
- C:\Windows\System\sCHJYBN.exe
  C:\Windows\System\sCHJYBN.exe
  2⤵
  PID:8456
- C:\Windows\System\TdgnERS.exe
  C:\Windows\System\TdgnERS.exe
  2⤵
  PID:8488
- C:\Windows\System\dLlZkdF.exe
  C:\Windows\System\dLlZkdF.exe
  2⤵
  PID:8504
- C:\Windows\System\oIaAXTg.exe
  C:\Windows\System\oIaAXTg.exe
  2⤵
  PID:8548
- C:\Windows\System\mJJjKSH.exe
  C:\Windows\System\mJJjKSH.exe
  2⤵
  PID:8568
- C:\Windows\System\DBfvSfT.exe
  C:\Windows\System\DBfvSfT.exe
  2⤵
  PID:8588
- C:\Windows\System\mzPTAqS.exe
  C:\Windows\System\mzPTAqS.exe
  2⤵
  PID:8616
- C:\Windows\System\vvzXQDh.exe
  C:\Windows\System\vvzXQDh.exe
  2⤵
  PID:8636
- C:\Windows\System\DbTgLDk.exe
  C:\Windows\System\DbTgLDk.exe
  2⤵
  PID:8664
- C:\Windows\System\kNFxTIY.exe
  C:\Windows\System\kNFxTIY.exe
  2⤵
  PID:8704
- C:\Windows\System\UFunuil.exe
  C:\Windows\System\UFunuil.exe
  2⤵
  PID:8764
- C:\Windows\System\XwmLhIv.exe
  C:\Windows\System\XwmLhIv.exe
  2⤵
  PID:8784
- C:\Windows\System\egkWAxZ.exe
  C:\Windows\System\egkWAxZ.exe
  2⤵
  PID:8808
- C:\Windows\System\AMQbtFD.exe
  C:\Windows\System\AMQbtFD.exe
  2⤵
  PID:8840
- C:\Windows\System\JOqFoUh.exe
  C:\Windows\System\JOqFoUh.exe
  2⤵
  PID:8876
- C:\Windows\System\jEKlnnn.exe
  C:\Windows\System\jEKlnnn.exe
  2⤵
  PID:8896
- C:\Windows\System\ySrYMPr.exe
  C:\Windows\System\ySrYMPr.exe
  2⤵
  PID:8924
- C:\Windows\System\XNeNviZ.exe
  C:\Windows\System\XNeNviZ.exe
  2⤵
  PID:8952
- C:\Windows\System\eerlylV.exe
  C:\Windows\System\eerlylV.exe
  2⤵
  PID:8992
- C:\Windows\System\Kkvyyhc.exe
  C:\Windows\System\Kkvyyhc.exe
  2⤵
  PID:9012
- C:\Windows\System\qWocQBa.exe
  C:\Windows\System\qWocQBa.exe
  2⤵
  PID:9036
- C:\Windows\System\MmOeeio.exe
  C:\Windows\System\MmOeeio.exe
  2⤵
  PID:9052
- C:\Windows\System\oDGlNdH.exe
  C:\Windows\System\oDGlNdH.exe
  2⤵
  PID:9072
- C:\Windows\System\MPahvoW.exe
  C:\Windows\System\MPahvoW.exe
  2⤵
  PID:9096
- C:\Windows\System\xaqmmrW.exe
  C:\Windows\System\xaqmmrW.exe
  2⤵
  PID:9124
- C:\Windows\System\bnLZklq.exe
  C:\Windows\System\bnLZklq.exe
  2⤵
  PID:9148
- C:\Windows\System\RQNNdSW.exe
  C:\Windows\System\RQNNdSW.exe
  2⤵
  PID:9188
- C:\Windows\System\GwPyheH.exe
  C:\Windows\System\GwPyheH.exe
  2⤵
  PID:9208
- C:\Windows\System\nqSMCIG.exe
  C:\Windows\System\nqSMCIG.exe
  2⤵
  PID:8208
- C:\Windows\System\fLAXVYE.exe
  C:\Windows\System\fLAXVYE.exe
  2⤵
  PID:8272
- C:\Windows\System\bFBgQqq.exe
  C:\Windows\System\bFBgQqq.exe
  2⤵
  PID:8336
- C:\Windows\System\xLgHwQN.exe
  C:\Windows\System\xLgHwQN.exe
  2⤵
  PID:8356
- C:\Windows\System\KcHdFyw.exe
  C:\Windows\System\KcHdFyw.exe
  2⤵
  PID:8444
- C:\Windows\System\BXfyUdw.exe
  C:\Windows\System\BXfyUdw.exe
  2⤵
  PID:8564
- C:\Windows\System\zPKKvWt.exe
  C:\Windows\System\zPKKvWt.exe
  2⤵
  PID:8580
- C:\Windows\System\isrymxi.exe
  C:\Windows\System\isrymxi.exe
  2⤵
  PID:8672
- C:\Windows\System\beTZone.exe
  C:\Windows\System\beTZone.exe
  2⤵
  PID:8744
- C:\Windows\System\DGuuCbl.exe
  C:\Windows\System\DGuuCbl.exe
  2⤵
  PID:8800
- C:\Windows\System\JDGfqly.exe
  C:\Windows\System\JDGfqly.exe
  2⤵
  PID:8048
- C:\Windows\System\hICNRyt.exe
  C:\Windows\System\hICNRyt.exe
  2⤵
  PID:8916
- C:\Windows\System\dABVwnQ.exe
  C:\Windows\System\dABVwnQ.exe
  2⤵
  PID:9020
- C:\Windows\System\cMNkjql.exe
  C:\Windows\System\cMNkjql.exe
  2⤵
  PID:9044
- C:\Windows\System\VgOJFVh.exe
  C:\Windows\System\VgOJFVh.exe
  2⤵
  PID:9108
- C:\Windows\System\gaZiDkI.exe
  C:\Windows\System\gaZiDkI.exe
  2⤵
  PID:9200
- C:\Windows\System\pirdfBo.exe
  C:\Windows\System\pirdfBo.exe
  2⤵
  PID:8312
- C:\Windows\System\hRrItRb.exe
  C:\Windows\System\hRrItRb.exe
  2⤵
  PID:8408
- C:\Windows\System\NFLHksu.exe
  C:\Windows\System\NFLHksu.exe
  2⤵
  PID:8472
- C:\Windows\System\xNagfRD.exe
  C:\Windows\System\xNagfRD.exe
  2⤵
  PID:8736
- C:\Windows\System\JolyyEA.exe
  C:\Windows\System\JolyyEA.exe
  2⤵
  PID:8884
- C:\Windows\System\mWgtoPX.exe
  C:\Windows\System\mWgtoPX.exe
  2⤵
  PID:9004
- C:\Windows\System\vOSOtYO.exe
  C:\Windows\System\vOSOtYO.exe
  2⤵
  PID:9104
- C:\Windows\System\caYIOFx.exe
  C:\Windows\System\caYIOFx.exe
  2⤵
  PID:8624
- C:\Windows\System\JAuoBaf.exe
  C:\Windows\System\JAuoBaf.exe
  2⤵
  PID:9028
- C:\Windows\System\jzlSAOR.exe
  C:\Windows\System\jzlSAOR.exe
  2⤵
  PID:7580
- C:\Windows\System\hGofZPN.exe
  C:\Windows\System\hGofZPN.exe
  2⤵
  PID:8480
- C:\Windows\System\HaUUVRP.exe
  C:\Windows\System\HaUUVRP.exe
  2⤵
  PID:9248
- C:\Windows\System\kJszQUN.exe
  C:\Windows\System\kJszQUN.exe
  2⤵
  PID:9272
- C:\Windows\System\PpXZAxC.exe
  C:\Windows\System\PpXZAxC.exe
  2⤵
  PID:9292
- C:\Windows\System\sidgNYJ.exe
  C:\Windows\System\sidgNYJ.exe
  2⤵
  PID:9392
- C:\Windows\System\VAMMlQt.exe
  C:\Windows\System\VAMMlQt.exe
  2⤵
  PID:9448
- C:\Windows\System\mdaqRkc.exe
  C:\Windows\System\mdaqRkc.exe
  2⤵
  PID:9464
- C:\Windows\System\WjxLIuP.exe
  C:\Windows\System\WjxLIuP.exe
  2⤵
  PID:9484
- C:\Windows\System\lWJeTfV.exe
  C:\Windows\System\lWJeTfV.exe
  2⤵
  PID:9536
- C:\Windows\System\UMydVgR.exe
  C:\Windows\System\UMydVgR.exe
  2⤵
  PID:9576
- C:\Windows\System\ZOMHnSX.exe
  C:\Windows\System\ZOMHnSX.exe
  2⤵
  PID:9592
- C:\Windows\System\abhskjc.exe
  C:\Windows\System\abhskjc.exe
  2⤵
  PID:9664
- C:\Windows\System\XPVwFct.exe
  C:\Windows\System\XPVwFct.exe
  2⤵
  PID:9704
- C:\Windows\System\UofSJWw.exe
  C:\Windows\System\UofSJWw.exe
  2⤵
  PID:9728
- C:\Windows\System\fVAMeQA.exe
  C:\Windows\System\fVAMeQA.exe
  2⤵
  PID:9752
- C:\Windows\System\sMDIPGK.exe
  C:\Windows\System\sMDIPGK.exe
  2⤵
  PID:9784
- C:\Windows\System\pagDNSy.exe
  C:\Windows\System\pagDNSy.exe
  2⤵
  PID:9824
- C:\Windows\System\jTJRfHl.exe
  C:\Windows\System\jTJRfHl.exe
  2⤵
  PID:9840
- C:\Windows\System\LRuAyqR.exe
  C:\Windows\System\LRuAyqR.exe
  2⤵
  PID:9860
- C:\Windows\System\cirvwcZ.exe
  C:\Windows\System\cirvwcZ.exe
  2⤵
  PID:9884
- C:\Windows\System\mmAdgGI.exe
  C:\Windows\System\mmAdgGI.exe
  2⤵
  PID:9928
- C:\Windows\System\hzKDAWN.exe
  C:\Windows\System\hzKDAWN.exe
  2⤵
  PID:9948
- C:\Windows\System\LhDGofE.exe
  C:\Windows\System\LhDGofE.exe
  2⤵
  PID:9964
- C:\Windows\System\WgjUzYn.exe
  C:\Windows\System\WgjUzYn.exe
  2⤵
  PID:9988
- C:\Windows\System\KQUGTnd.exe
  C:\Windows\System\KQUGTnd.exe
  2⤵
  PID:10032
- C:\Windows\System\oVBcrXq.exe
  C:\Windows\System\oVBcrXq.exe
  2⤵
  PID:10056
- C:\Windows\System\HOwpIDc.exe
  C:\Windows\System\HOwpIDc.exe
  2⤵
  PID:10088
- C:\Windows\System\xFiejUy.exe
  C:\Windows\System\xFiejUy.exe
  2⤵
  PID:10112
- C:\Windows\System\RPuasXw.exe
  C:\Windows\System\RPuasXw.exe
  2⤵
  PID:10136
- C:\Windows\System\QjDyzSX.exe
  C:\Windows\System\QjDyzSX.exe
  2⤵
  PID:10168
- C:\Windows\System\CGdZMCd.exe
  C:\Windows\System\CGdZMCd.exe
  2⤵
  PID:10188
- C:\Windows\System\TjafISP.exe
  C:\Windows\System\TjafISP.exe
  2⤵
  PID:10212
- C:\Windows\System\YtEssoF.exe
  C:\Windows\System\YtEssoF.exe
  2⤵
  PID:10232
- C:\Windows\System\IdkeaYa.exe
  C:\Windows\System\IdkeaYa.exe
  2⤵
  PID:8700
- C:\Windows\System\FHPXArl.exe
  C:\Windows\System\FHPXArl.exe
  2⤵
  PID:9256
- C:\Windows\System\HzRTGDH.exe
  C:\Windows\System\HzRTGDH.exe
  2⤵
  PID:9320
- C:\Windows\System\MHDLoqS.exe
  C:\Windows\System\MHDLoqS.exe
  2⤵
  PID:9352
- C:\Windows\System\mdUiTNX.exe
  C:\Windows\System\mdUiTNX.exe
  2⤵
  PID:9440
- C:\Windows\System\hLVOBVe.exe
  C:\Windows\System\hLVOBVe.exe
  2⤵
  PID:9460
- C:\Windows\System\ANsgVJt.exe
  C:\Windows\System\ANsgVJt.exe
  2⤵
  PID:9612
- C:\Windows\System\yUxImgY.exe
  C:\Windows\System\yUxImgY.exe
  2⤵
  PID:9544
- C:\Windows\System\FRddXDu.exe
  C:\Windows\System\FRddXDu.exe
  2⤵
  PID:9572
- C:\Windows\System\Bayunmv.exe
  C:\Windows\System\Bayunmv.exe
  2⤵
  PID:2980
- C:\Windows\System\sngVaJW.exe
  C:\Windows\System\sngVaJW.exe
  2⤵
  PID:9700
- C:\Windows\System\DeagztC.exe
  C:\Windows\System\DeagztC.exe
  2⤵
  PID:9740
- C:\Windows\System\CBKsAKy.exe
  C:\Windows\System\CBKsAKy.exe
  2⤵
  PID:9852
- C:\Windows\System\HNMrAJG.exe
  C:\Windows\System\HNMrAJG.exe
  2⤵
  PID:9868
- C:\Windows\System\FLgUbhL.exe
  C:\Windows\System\FLgUbhL.exe
  2⤵
  PID:9936
- C:\Windows\System\REKRlcH.exe
  C:\Windows\System\REKRlcH.exe
  2⤵
  PID:10008
- C:\Windows\System\iuERukh.exe
  C:\Windows\System\iuERukh.exe
  2⤵
  PID:10084
- C:\Windows\System\JnWVgcI.exe
  C:\Windows\System\JnWVgcI.exe
  2⤵
  PID:10204
- C:\Windows\System\nJUZgzc.exe
  C:\Windows\System\nJUZgzc.exe
  2⤵
  PID:10164
- C:\Windows\System\bKeIXGv.exe
  C:\Windows\System\bKeIXGv.exe
  2⤵
  PID:9268
- C:\Windows\System\cMqVVtI.exe
  C:\Windows\System\cMqVVtI.exe
  2⤵
  PID:9372
- C:\Windows\System\DxgrVlX.exe
  C:\Windows\System\DxgrVlX.exe
  2⤵
  PID:9456
- C:\Windows\System\lUifeUM.exe
  C:\Windows\System\lUifeUM.exe
  2⤵
  PID:9552
- C:\Windows\System\cPmELUM.exe
  C:\Windows\System\cPmELUM.exe
  2⤵
  PID:9628
- C:\Windows\System\JefkzVt.exe
  C:\Windows\System\JefkzVt.exe
  2⤵
  PID:9804
- C:\Windows\System\sLuptQH.exe
  C:\Windows\System\sLuptQH.exe
  2⤵
  PID:9960
- C:\Windows\System\cjHweTd.exe
  C:\Windows\System\cjHweTd.exe
  2⤵
  PID:9972
- C:\Windows\System\vtayBmT.exe
  C:\Windows\System\vtayBmT.exe
  2⤵
  PID:10160
- C:\Windows\System\PPaczXL.exe
  C:\Windows\System\PPaczXL.exe
  2⤵
  PID:9360
- C:\Windows\System\UcUgQnF.exe
  C:\Windows\System\UcUgQnF.exe
  2⤵
  PID:6112
- C:\Windows\System\lVQEKTn.exe
  C:\Windows\System\lVQEKTn.exe
  2⤵
  PID:10048
- C:\Windows\System\WOdTaQf.exe
  C:\Windows\System\WOdTaQf.exe
  2⤵
  PID:9508
- C:\Windows\System\rVJLWLy.exe
  C:\Windows\System\rVJLWLy.exe
  2⤵
  PID:10272
- C:\Windows\System\rfvlHDX.exe
  C:\Windows\System\rfvlHDX.exe
  2⤵
  PID:10292
- C:\Windows\System\igLoCXt.exe
  C:\Windows\System\igLoCXt.exe
  2⤵
  PID:10312
- C:\Windows\System\mlRbRkI.exe
  C:\Windows\System\mlRbRkI.exe
  2⤵
  PID:10344
- C:\Windows\System\zQFwmVS.exe
  C:\Windows\System\zQFwmVS.exe
  2⤵
  PID:10380
- C:\Windows\System\xEgbpHY.exe
  C:\Windows\System\xEgbpHY.exe
  2⤵
  PID:10424
- C:\Windows\System\RbFazyq.exe
  C:\Windows\System\RbFazyq.exe
  2⤵
  PID:10444
- C:\Windows\System\mxzqBaR.exe
  C:\Windows\System\mxzqBaR.exe
  2⤵
  PID:10464
- C:\Windows\System\vpkEoss.exe
  C:\Windows\System\vpkEoss.exe
  2⤵
  PID:10492
- C:\Windows\System\eHngwfb.exe
  C:\Windows\System\eHngwfb.exe
  2⤵
  PID:10520
- C:\Windows\System\izZZPeW.exe
  C:\Windows\System\izZZPeW.exe
  2⤵
  PID:10568
- C:\Windows\System\VNixUbP.exe
  C:\Windows\System\VNixUbP.exe
  2⤵
  PID:10588
- C:\Windows\System\HWpOgsb.exe
  C:\Windows\System\HWpOgsb.exe
  2⤵
  PID:10612
- C:\Windows\System\eziGzKG.exe
  C:\Windows\System\eziGzKG.exe
  2⤵
  PID:10652
- C:\Windows\System\FdUzEJf.exe
  C:\Windows\System\FdUzEJf.exe
  2⤵
  PID:10668
- C:\Windows\System\moInOob.exe
  C:\Windows\System\moInOob.exe
  2⤵
  PID:10708
- C:\Windows\System\JHOmODa.exe
  C:\Windows\System\JHOmODa.exe
  2⤵
  PID:10724
- C:\Windows\System\jJxJbIU.exe
  C:\Windows\System\jJxJbIU.exe
  2⤵
  PID:10744
- C:\Windows\System\tvEAxOj.exe
  C:\Windows\System\tvEAxOj.exe
  2⤵
  PID:10776
- C:\Windows\System\cNCinQO.exe
  C:\Windows\System\cNCinQO.exe
  2⤵
  PID:10804
- C:\Windows\System\OcPkuuZ.exe
  C:\Windows\System\OcPkuuZ.exe
  2⤵
  PID:10828
- C:\Windows\System\lBgHgPn.exe
  C:\Windows\System\lBgHgPn.exe
  2⤵
  PID:10848
- C:\Windows\System\RxCiyTe.exe
  C:\Windows\System\RxCiyTe.exe
  2⤵
  PID:10892
- C:\Windows\System\gOVDpzV.exe
  C:\Windows\System\gOVDpzV.exe
  2⤵
  PID:10920
- C:\Windows\System\ulzgjcK.exe
  C:\Windows\System\ulzgjcK.exe
  2⤵
  PID:10944
- C:\Windows\System\gvmIBqo.exe
  C:\Windows\System\gvmIBqo.exe
  2⤵
  PID:10964
- C:\Windows\System\YHUfqHn.exe
  C:\Windows\System\YHUfqHn.exe
  2⤵
  PID:10988
- C:\Windows\System\fAuacpS.exe
  C:\Windows\System\fAuacpS.exe
  2⤵
  PID:11036
- C:\Windows\System\HgGveaR.exe
  C:\Windows\System\HgGveaR.exe
  2⤵
  PID:11080
- C:\Windows\System\HJEOjXV.exe
  C:\Windows\System\HJEOjXV.exe
  2⤵
  PID:11096
- C:\Windows\System\lFjRvxh.exe
  C:\Windows\System\lFjRvxh.exe
  2⤵
  PID:11124
- C:\Windows\System\aXAObYH.exe
  C:\Windows\System\aXAObYH.exe
  2⤵
  PID:11144
- C:\Windows\System\pejwAdl.exe
  C:\Windows\System\pejwAdl.exe
  2⤵
  PID:11176
- C:\Windows\System\UuQDIzH.exe
  C:\Windows\System\UuQDIzH.exe
  2⤵
  PID:11196
- C:\Windows\System\hCxGEiN.exe
  C:\Windows\System\hCxGEiN.exe
  2⤵
  PID:11216
- C:\Windows\System\DahQgAQ.exe
  C:\Windows\System\DahQgAQ.exe
  2⤵
  PID:11256
- C:\Windows\System\BMOgjuZ.exe
  C:\Windows\System\BMOgjuZ.exe
  2⤵
  PID:9880
- C:\Windows\System\VPjxGKv.exe
  C:\Windows\System\VPjxGKv.exe
  2⤵
  PID:10308
- C:\Windows\System\oZkLvgC.exe
  C:\Windows\System\oZkLvgC.exe
  2⤵
  PID:10332
- C:\Windows\System\yzLwfAS.exe
  C:\Windows\System\yzLwfAS.exe
  2⤵
  PID:10404
- C:\Windows\System\eWgcqng.exe
  C:\Windows\System\eWgcqng.exe
  2⤵
  PID:10460
- C:\Windows\System\ouUNPSg.exe
  C:\Windows\System\ouUNPSg.exe
  2⤵
  PID:10576
- C:\Windows\System\JVrAjWJ.exe
  C:\Windows\System\JVrAjWJ.exe
  2⤵
  PID:10660
- C:\Windows\System\rywgtXe.exe
  C:\Windows\System\rywgtXe.exe
  2⤵
  PID:2788
- C:\Windows\System\tnqNlSI.exe
  C:\Windows\System\tnqNlSI.exe
  2⤵
  PID:10800
- C:\Windows\System\JPjdZEi.exe
  C:\Windows\System\JPjdZEi.exe
  2⤵
  PID:10840
- C:\Windows\System\mMDkyBX.exe
  C:\Windows\System\mMDkyBX.exe
  2⤵
  PID:10888
- C:\Windows\System\yvlXPsA.exe
  C:\Windows\System\yvlXPsA.exe
  2⤵
  PID:10936
- C:\Windows\System\NmxwLEi.exe
  C:\Windows\System\NmxwLEi.exe
  2⤵
  PID:11024
- C:\Windows\System\tzwAFPT.exe
  C:\Windows\System\tzwAFPT.exe
  2⤵
  PID:11056
- C:\Windows\System\TNiTJNB.exe
  C:\Windows\System\TNiTJNB.exe
  2⤵
  PID:11152
- C:\Windows\System\gBGWrOk.exe
  C:\Windows\System\gBGWrOk.exe
  2⤵
  PID:11140
- C:\Windows\System\fnjJaBa.exe
  C:\Windows\System\fnjJaBa.exe
  2⤵
  PID:11212
- C:\Windows\System\yuhavTu.exe
  C:\Windows\System\yuhavTu.exe
  2⤵
  PID:10280
- C:\Windows\System\lvaxUSQ.exe
  C:\Windows\System\lvaxUSQ.exe
  2⤵
  PID:10532
- C:\Windows\System\RkEltpv.exe
  C:\Windows\System\RkEltpv.exe
  2⤵
  PID:10584
- C:\Windows\System\Tauczzy.exe
  C:\Windows\System\Tauczzy.exe
  2⤵
  PID:10716
- C:\Windows\System\nLUndDA.exe
  C:\Windows\System\nLUndDA.exe
  2⤵
  PID:10868
- C:\Windows\System\pDFHzEX.exe
  C:\Windows\System\pDFHzEX.exe
  2⤵
  PID:1012
- C:\Windows\System\fNrBEHS.exe
  C:\Windows\System\fNrBEHS.exe
  2⤵
  PID:11192
- C:\Windows\System\lscmHho.exe
  C:\Windows\System\lscmHho.exe
  2⤵
  PID:10072
- C:\Windows\System\AnFZXWT.exe
  C:\Windows\System\AnFZXWT.exe
  2⤵
  PID:10692
- C:\Windows\System\HPLvrLN.exe
  C:\Windows\System\HPLvrLN.exe
  2⤵
  PID:11076
- C:\Windows\System\tpBYySB.exe
  C:\Windows\System\tpBYySB.exe
  2⤵
  PID:11292
- C:\Windows\System\BjsHueH.exe
  C:\Windows\System\BjsHueH.exe
  2⤵
  PID:11312
- C:\Windows\System\STeBsgN.exe
  C:\Windows\System\STeBsgN.exe
  2⤵
  PID:11332
- C:\Windows\System\WrIPMPC.exe
  C:\Windows\System\WrIPMPC.exe
  2⤵
  PID:11368
- C:\Windows\System\NiexyAK.exe
  C:\Windows\System\NiexyAK.exe
  2⤵
  PID:11396
- C:\Windows\System\clIhlKe.exe
  C:\Windows\System\clIhlKe.exe
  2⤵
  PID:11424
- C:\Windows\System\ZppjNTZ.exe
  C:\Windows\System\ZppjNTZ.exe
  2⤵
  PID:11452
- C:\Windows\System\nBaELlA.exe
  C:\Windows\System\nBaELlA.exe
  2⤵
  PID:11480
- C:\Windows\System\yrOCCyO.exe
  C:\Windows\System\yrOCCyO.exe
  2⤵
  PID:11508
- C:\Windows\System\XiReqRw.exe
  C:\Windows\System\XiReqRw.exe
  2⤵
  PID:11524
- C:\Windows\System\WmaCHie.exe
  C:\Windows\System\WmaCHie.exe
  2⤵
  PID:11548
- C:\Windows\System\PvTGiFx.exe
  C:\Windows\System\PvTGiFx.exe
  2⤵
  PID:11580
- C:\Windows\System\LDvsRIj.exe
  C:\Windows\System\LDvsRIj.exe
  2⤵
  PID:11628
- C:\Windows\System\jZvjted.exe
  C:\Windows\System\jZvjted.exe
  2⤵
  PID:11668
- C:\Windows\System\LBKwXGF.exe
  C:\Windows\System\LBKwXGF.exe
  2⤵
  PID:11684
- C:\Windows\System\yLNUAsn.exe
  C:\Windows\System\yLNUAsn.exe
  2⤵
  PID:11712
- C:\Windows\System\QtewyCh.exe
  C:\Windows\System\QtewyCh.exe
  2⤵
  PID:11740
- C:\Windows\System\YFqDQVr.exe
  C:\Windows\System\YFqDQVr.exe
  2⤵
  PID:11768
- C:\Windows\System\LNhthNO.exe
  C:\Windows\System\LNhthNO.exe
  2⤵
  PID:11796
- C:\Windows\System\wCvuSBZ.exe
  C:\Windows\System\wCvuSBZ.exe
  2⤵
  PID:11820
- C:\Windows\System\RcJNvSi.exe
  C:\Windows\System\RcJNvSi.exe
  2⤵
  PID:11840
- C:\Windows\System\PVhMxKJ.exe
  C:\Windows\System\PVhMxKJ.exe
  2⤵
  PID:11872
- C:\Windows\System\ZoTAkDv.exe
  C:\Windows\System\ZoTAkDv.exe
  2⤵
  PID:11900
- C:\Windows\System\jrWjnJL.exe
  C:\Windows\System\jrWjnJL.exe
  2⤵
  PID:11928
- C:\Windows\System\PWYobtK.exe
  C:\Windows\System\PWYobtK.exe
  2⤵
  PID:11948
- C:\Windows\System\HdHLeeK.exe
  C:\Windows\System\HdHLeeK.exe
  2⤵
  PID:11972
- C:\Windows\System\MeEIpRX.exe
  C:\Windows\System\MeEIpRX.exe
  2⤵
  PID:11996
- C:\Windows\System\VdlENrm.exe
  C:\Windows\System\VdlENrm.exe
  2⤵
  PID:12020
- C:\Windows\System\QXPTRFS.exe
  C:\Windows\System\QXPTRFS.exe
  2⤵
  PID:12068
- C:\Windows\System\NevSepF.exe
  C:\Windows\System\NevSepF.exe
  2⤵
  PID:12092
- C:\Windows\System\agmnaqa.exe
  C:\Windows\System\agmnaqa.exe
  2⤵
  PID:12116
- C:\Windows\System\vwQKAnK.exe
  C:\Windows\System\vwQKAnK.exe
  2⤵
  PID:12132
- C:\Windows\System\GcvoBEO.exe
  C:\Windows\System\GcvoBEO.exe
  2⤵
  PID:12152
- C:\Windows\System\QmOhTPe.exe
  C:\Windows\System\QmOhTPe.exe
  2⤵
  PID:12176
- C:\Windows\System\mOOcKWM.exe
  C:\Windows\System\mOOcKWM.exe
  2⤵
  PID:12196
- C:\Windows\System\cAcBKKM.exe
  C:\Windows\System\cAcBKKM.exe
  2⤵
  PID:12252
- C:\Windows\System\xXQWWRZ.exe
  C:\Windows\System\xXQWWRZ.exe
  2⤵
  PID:10328
- C:\Windows\System\csJhsuG.exe
  C:\Windows\System\csJhsuG.exe
  2⤵
  PID:692
- C:\Windows\System\eevfMNQ.exe
  C:\Windows\System\eevfMNQ.exe
  2⤵
  PID:11352
- C:\Windows\System\EVKoizA.exe
  C:\Windows\System\EVKoizA.exe
  2⤵
  PID:11436
- C:\Windows\System\AAMckxR.exe
  C:\Windows\System\AAMckxR.exe
  2⤵
  PID:11488
- C:\Windows\System\xSaHUFe.exe
  C:\Windows\System\xSaHUFe.exe
  2⤵
  PID:11516
- C:\Windows\System\mTUmYuZ.exe
  C:\Windows\System\mTUmYuZ.exe
  2⤵
  PID:11472
- C:\Windows\System\brFcEoo.exe
  C:\Windows\System\brFcEoo.exe
  2⤵
  PID:11600
- C:\Windows\System\GUhOIQI.exe
  C:\Windows\System\GUhOIQI.exe
  2⤵
  PID:11700
- C:\Windows\System\EnnEqVl.exe
  C:\Windows\System\EnnEqVl.exe
  2⤵
  PID:11756
- C:\Windows\System\QYBjQsP.exe
  C:\Windows\System\QYBjQsP.exe
  2⤵
  PID:11812
- C:\Windows\System\LGSSuBr.exe
  C:\Windows\System\LGSSuBr.exe
  2⤵
  PID:11888
- C:\Windows\System\ViPihdC.exe
  C:\Windows\System\ViPihdC.exe
  2⤵
  PID:11860
- C:\Windows\System\daMMDwo.exe
  C:\Windows\System\daMMDwo.exe
  2⤵
  PID:12052
- C:\Windows\System\RwOlkyl.exe
  C:\Windows\System\RwOlkyl.exe
  2⤵
  PID:12056
- C:\Windows\System\ohztawZ.exe
  C:\Windows\System\ohztawZ.exe
  2⤵
  PID:12104
- C:\Windows\System\lhXKYRw.exe
  C:\Windows\System\lhXKYRw.exe
  2⤵
  PID:12144
- C:\Windows\System\SzdcPFW.exe
  C:\Windows\System\SzdcPFW.exe
  2⤵
  PID:12244
- C:\Windows\System\zzQssmK.exe
  C:\Windows\System\zzQssmK.exe
  2⤵
  PID:12264
- C:\Windows\System\ZYmEsPm.exe
  C:\Windows\System\ZYmEsPm.exe
  2⤵
  PID:10812
- C:\Windows\System\fklSrLb.exe
  C:\Windows\System\fklSrLb.exe
  2⤵
  PID:11444
- C:\Windows\System\mRXDmNh.exe
  C:\Windows\System\mRXDmNh.exe
  2⤵
  PID:11520
- C:\Windows\System\VgWnvok.exe
  C:\Windows\System\VgWnvok.exe
  2⤵
  PID:1564
- C:\Windows\System\CmBXTLN.exe
  C:\Windows\System\CmBXTLN.exe
  2⤵
  PID:11616
- C:\Windows\System\iDwVHbI.exe
  C:\Windows\System\iDwVHbI.exe
  2⤵
  PID:11984
- C:\Windows\System\rffrYuA.exe
  C:\Windows\System\rffrYuA.exe
  2⤵
  PID:3916
- C:\Windows\System\mJhWSxS.exe
  C:\Windows\System\mJhWSxS.exe
  2⤵
  PID:12192
- C:\Windows\System\hXihcDV.exe
  C:\Windows\System\hXihcDV.exe
  2⤵
  PID:11384
- C:\Windows\System\NsDkiyU.exe
  C:\Windows\System\NsDkiyU.exe
  2⤵
  PID:4732
- C:\Windows\System\VVxquzD.exe
  C:\Windows\System\VVxquzD.exe
  2⤵
  PID:11836
- C:\Windows\System\grPPOBV.exe
  C:\Windows\System\grPPOBV.exe
  2⤵
  PID:12284
- C:\Windows\System\gJhWVfj.exe
  C:\Windows\System\gJhWVfj.exe
  2⤵
  PID:11572
- C:\Windows\System\LnPYNrS.exe
  C:\Windows\System\LnPYNrS.exe
  2⤵
  PID:12316
- C:\Windows\System\BcDoZKw.exe
  C:\Windows\System\BcDoZKw.exe
  2⤵
  PID:12336
- C:\Windows\System\ACdcAgz.exe
  C:\Windows\System\ACdcAgz.exe
  2⤵
  PID:12368
- C:\Windows\System\dErJxPQ.exe
  C:\Windows\System\dErJxPQ.exe
  2⤵
  PID:12412
- C:\Windows\System\WsRumAQ.exe
  C:\Windows\System\WsRumAQ.exe
  2⤵
  PID:12436
- C:\Windows\System\sycZBHp.exe
  C:\Windows\System\sycZBHp.exe
  2⤵
  PID:12460
- C:\Windows\System\mRiiLhs.exe
  C:\Windows\System\mRiiLhs.exe
  2⤵
  PID:12484
- C:\Windows\System\KHgEMGN.exe
  C:\Windows\System\KHgEMGN.exe
  2⤵
  PID:12504
- C:\Windows\System\YfmhbpH.exe
  C:\Windows\System\YfmhbpH.exe
  2⤵
  PID:12564
- C:\Windows\System\upOvsTN.exe
  C:\Windows\System\upOvsTN.exe
  2⤵
  PID:12588
- C:\Windows\System\hSquCLo.exe
  C:\Windows\System\hSquCLo.exe
  2⤵
  PID:12612
- C:\Windows\System\reXfxRG.exe
  C:\Windows\System\reXfxRG.exe
  2⤵
  PID:12644
- C:\Windows\System\clfQuOP.exe
  C:\Windows\System\clfQuOP.exe
  2⤵
  PID:12680
- C:\Windows\System\WWRBqwt.exe
  C:\Windows\System\WWRBqwt.exe
  2⤵
  PID:12704
- C:\Windows\System\eburYxz.exe
  C:\Windows\System\eburYxz.exe
  2⤵
  PID:12720
- C:\Windows\System\wpykKdM.exe
  C:\Windows\System\wpykKdM.exe
  2⤵
  PID:12768
- C:\Windows\System\ihhqxnB.exe
  C:\Windows\System\ihhqxnB.exe
  2⤵
  PID:12784
- C:\Windows\System\QwXiBdv.exe
  C:\Windows\System\QwXiBdv.exe
  2⤵
  PID:12820
- C:\Windows\System\vzukLRQ.exe
  C:\Windows\System\vzukLRQ.exe
  2⤵
  PID:12848
- C:\Windows\System\duHhSOr.exe
  C:\Windows\System\duHhSOr.exe
  2⤵
  PID:12876
- C:\Windows\System\IaKexDw.exe
  C:\Windows\System\IaKexDw.exe
  2⤵
  PID:12900
- C:\Windows\System\BHmXeFr.exe
  C:\Windows\System\BHmXeFr.exe
  2⤵
  PID:12920
- C:\Windows\System\oJHnJuI.exe
  C:\Windows\System\oJHnJuI.exe
  2⤵
  PID:12944
- C:\Windows\System\YaxGDwd.exe
  C:\Windows\System\YaxGDwd.exe
  2⤵
  PID:12964
- C:\Windows\System\pvIXDNN.exe
  C:\Windows\System\pvIXDNN.exe
  2⤵
  PID:12980
- C:\Windows\System\rqEoIUg.exe
  C:\Windows\System\rqEoIUg.exe
  2⤵
  PID:13020
- C:\Windows\System\jpHwIKb.exe
  C:\Windows\System\jpHwIKb.exe
  2⤵
  PID:13064
- C:\Windows\System\koGYjgR.exe
  C:\Windows\System\koGYjgR.exe
  2⤵
  PID:13088
- C:\Windows\System\zQZHfyJ.exe
  C:\Windows\System\zQZHfyJ.exe
  2⤵
  PID:13128
- C:\Windows\System\wRfjUyT.exe
  C:\Windows\System\wRfjUyT.exe
  2⤵
  PID:13144
- C:\Windows\System\XvbDJZo.exe
  C:\Windows\System\XvbDJZo.exe
  2⤵
  PID:13280
- C:\Windows\System\XiOJzZz.exe
  C:\Windows\System\XiOJzZz.exe
  2⤵
  PID:13296
- C:\Windows\System\GTopZNX.exe
  C:\Windows\System\GTopZNX.exe
  2⤵
  PID:12560
- C:\Windows\System\ZJqNxXO.exe
  C:\Windows\System\ZJqNxXO.exe
  2⤵
  PID:12660
- C:\Windows\System\NwdRvzq.exe
  C:\Windows\System\NwdRvzq.exe
  2⤵
  PID:12716
- C:\Windows\System\bPWpxfD.exe
  C:\Windows\System\bPWpxfD.exe
  2⤵
  PID:12776
- C:\Windows\System\iHDjbjz.exe
  C:\Windows\System\iHDjbjz.exe
  2⤵
  PID:12816
- C:\Windows\System\ADZIlZM.exe
  C:\Windows\System\ADZIlZM.exe
  2⤵
  PID:12872
- C:\Windows\System\KgexrWf.exe
  C:\Windows\System\KgexrWf.exe
  2⤵
  PID:12976
- C:\Windows\System\ypODcAB.exe
  C:\Windows\System\ypODcAB.exe
  2⤵
  PID:12100
- C:\Windows\System\sfBHhng.exe
  C:\Windows\System\sfBHhng.exe
  2⤵
  PID:13112
- C:\Windows\System\QrVOPdH.exe
  C:\Windows\System\QrVOPdH.exe
  2⤵
  PID:13136
- C:\Windows\System\TSeqjeU.exe
  C:\Windows\System\TSeqjeU.exe
  2⤵
  PID:13188
- C:\Windows\System\VeVYhHC.exe
  C:\Windows\System\VeVYhHC.exe
  2⤵
  PID:13216
- C:\Windows\System\iCmhoGF.exe
  C:\Windows\System\iCmhoGF.exe
  2⤵
  PID:13236
- C:\Windows\System\yBOrqKS.exe
  C:\Windows\System\yBOrqKS.exe
  2⤵
  PID:13288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_utsxj3lo.leb.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AIksfpF.exe

Filesize
1.9MB

MD5
bfaebeafb35eac5d77e187fe9ce38fb6

SHA1
de9ba31058d3af3a45d3930008d8fb37ec1ba951

SHA256
b866faee8c0a4d1ca55daed4b378f1829de77b70ffa343095793294f24cd90e8

SHA512
bd163ab977a3637e18c2516613d3439a9ee7bc7d2bf8397e8a364064e01f9de5048c4ef41200c87369f4157b7ee4e61655a780d3c6751b1fe6f878bf9d778b3c

Download Submit
C:\Windows\System\FGgsGeR.exe

Filesize
1.9MB

MD5
c574215d691f016a6170b1adae795fea

SHA1
d6570ad4acf1a59e432f1827ac56e6a3801334fd

SHA256
1bda3a7c32bcb1a797fdcb109fa28de08918f9b40b9f8275951f1827db392dc1

SHA512
8b7d12722f27622d94654d4057c469f6170540ef972429405d05a7e7e941101486dac29ab991caf1700ed116126cc6d7a72f95b2e59b9b24ed7cdefc3c5a552c

Download Submit
C:\Windows\System\FntXcNI.exe

Filesize
1.9MB

MD5
74351662d7244a1e4c17cdef6f422de2

SHA1
691b593448e2d11b1fc076f899fdf5e661cbc72b

SHA256
957a5bcf45e8425b6260197a62ba7ee644e833d21e325d88976ffa5e2fd38e94

SHA512
6cb8f3b685ca6d81511657f450057996baed1e7075982bbfde55f45fc9736a97500f7258fa2fa6847ff45a74f0ae39b7f038dcb4826716b28ff912a5cf9c1714

Download Submit
C:\Windows\System\GAuyeVu.exe

Filesize
1.9MB

MD5
2e968bc4dd392d0bfcf513bec3dcbcb9

SHA1
97e8769a48312524baef1ce82deb87c08ddf4464

SHA256
3acd97b04479e37e4eb6250a80ab3be62a1f6d23638a8f68777c50cd93302d2c

SHA512
84a2289e6f1caf34deebe45d69657a952474a8a6649923cd9e5e9324a8f83fe980ce445e41f954999bdac984cc929c4c071adb462638580e23e716822972a90d

Download Submit
C:\Windows\System\GerTsOx.exe

Filesize
1.9MB

MD5
0b1592d0a69afa7cdbabcbd85f3844f9

SHA1
fa55501cee89c6905ca592ccf1e74d1f2efc27fa

SHA256
d3681c17389e9d2eb64d91a0d13190fc51546716341c61b7f00ff4d560821f50

SHA512
0a9958ae211bc9bfe7ae3965dff90bd2e2285d6897120b73995348de6eb30d0f4d9154f424aea43e22016febf8e975aee7963b276998b7bf2a80545ebc3f1688

Download Submit
C:\Windows\System\MiOffkR.exe

Filesize
1.9MB

MD5
cdd4999334e0fcdd03e17378b26ef8d0

SHA1
078070443dfbee2736e31dd752db5ee6d7bd3f47

SHA256
9c79534ccfac00d697d815f6b9bb24689995bb006eebcc5c68b969d6d6e2353d

SHA512
219f7a866ac0d2a7048ddb4f23868b9fc72d67283897fb668d3e4bc61f339aba2a3effdeea8d756876e8b5c622a1f6fe1872bb87c0bc604bc239c7d0e52ad7be

Download Submit
C:\Windows\System\OxiHCSk.exe

Filesize
1.9MB

MD5
290c5335d642d4e059722511a54cd2ca

SHA1
48e3c6389f995a404f05ee9eaf8e5851367cf07d

SHA256
cc55b2d65876e133e39533baaf0a3af3ad858b0a208bc5f624e588e4d2c0552e

SHA512
0b7425b4073b075ccfbcc6caf2035747225e11791c784dfb476e068dabf611bbe5657750d85148acae25675b5251748e8abaab37ef7c1dc5fb22d963f50002f9

Download Submit
C:\Windows\System\PpcZLHD.exe

Filesize
1.9MB

MD5
700b55ae0b9f6b3c8f4ff82c4cece764

SHA1
50bbbc3d63df170896c94d4a011565b9dfccd10e

SHA256
0e43be60f883d66255e9b0cea069206440be5d83434a87e1886977512e8d585a

SHA512
d703133521daa551f376e45791fe78de5b23edb8991ff3310d5fbc3cb956c57308981076e5967bd2d5255c7383aeba0f87d69f846f8741ad0769051f5013e5e7

Download Submit
C:\Windows\System\VSlwejE.exe

Filesize
1.9MB

MD5
03cbf482190c33533b8922fa8e4a8f2b

SHA1
3c087d7759afafab492cb64f49b16353c069d4d1

SHA256
c6a87b651050c5241bb1ff9ef913f7e66b89c747a4f8e2700ab2bdc7b8aa1cec

SHA512
1f88e9a36f6771b059859f5e46241b52a0ad6546a6ce8ba9eb311339927cb695d15ce6c6f6d382a02f1b3784d42fd7438705f27c0f6a91c2705d90fa9e665778

Download Submit
C:\Windows\System\VhfXEuu.exe

Filesize
1.9MB

MD5
277e49d06dbacc98e1a1dbc96159576b

SHA1
fd0d8a8b42110a6dd147797e6e1f8102e0a4aa60

SHA256
f384b7e98d17708837aaf920d22360a7382a0c757abdbc5545a765cfe1568f44

SHA512
a3afcec7f4aaaeb6708ca1f9bd7bc1aef86aab534b2138870726feadb255dd0048b2d7089f5611dbeca1974013a8bb44f9cc17886a342b3872a6b7bddc04e8a6

Download Submit
C:\Windows\System\WtQRjNi.exe

Filesize
1.9MB

MD5
630fd7bba11ed5918994c411024b0438

SHA1
cb84e94b29b263420ef13d67f438c306894f4108

SHA256
306b2e4b056fcfa068bc4f1e610698b477ca3069c80b67aa1b62fba75a2cb3e4

SHA512
a4b0f0cad4e04df38834ab366e5a3d491f3d39c71c272cdbefa6ada9fb8c88bbe2c2dc169f6263b4683d98c0f57e15fd3caeb59a365a4b0ef3dff191f4b80076

Download Submit
C:\Windows\System\XJjFKoL.exe

Filesize
1.9MB

MD5
cdcbc76e598f6b5de2d890902ec3325b

SHA1
a38221ff1f02fa1d20512caeec3ff1ab7c2a6fff

SHA256
aee7971b0b5ca6b37f654b6ee26bb5c8362bd5a95c60cbc6e7cdeaa3891aec0f

SHA512
89a03f3363bf19725d875bc05e3565d791a9dbdecbd4f77183dcd606a41874b42a1e323cab2d3aff241d5f240d4730ca425c64f506837594aff373109647a4c0

Download Submit
C:\Windows\System\XjHBTOk.exe

Filesize
1.9MB

MD5
4b3fa441250fd97b33a9043aae72958f

SHA1
31ce5f6e4fff5727a8b92f735cf85978f20499df

SHA256
16667eb66860a5b51eaf54671330945e8056ba6c2192894fb0b36f2fc6220c2a

SHA512
4d45fb30579d35f9400832161f5babf1bde34344659cacbc8793fbc441f34e02b7e9dfcc2ec1fc05a0c766cd67f2ce4d62c0cc51fa3011dfcadeec9ffa60ca0d

Download Submit
C:\Windows\System\cZGKhaB.exe

Filesize
1.9MB

MD5
7b3bb7e03483cff38264c5b6fec7df0e

SHA1
b1ed80340fda29797a26915bb3b2969ac707ad40

SHA256
86b8ec15567129cd9558c4fa89e3fcd18ed3a1afa992a8de285341a36b2cecb9

SHA512
29f3a5989e93ff495d0a63138a4baf9ee87d8c07354a344609bea9881980cc0194c87dd028fb253332a09acd4b61f855c3798d4d1c800cc9b68c90eabd4f9de9

Download Submit
C:\Windows\System\dMBCkpr.exe

Filesize
1.9MB

MD5
ee8098288bbfd45d2ef2562b761d51ad

SHA1
13f59a71cf8eb4c6ed31ad103cb616e4683c3701

SHA256
50a89f8ccf5617961738ca87772c1c674fe62044cadce1529121e1e9ff2d9b7e

SHA512
bc46d32a40ec1a77d89bbdd1b26151f12b19c0db19e8c385d38f89dc02d5f9c7036f97296ee75bcbaa4189a0512879b23305c169a58dc6bb4bc69496bb1cf32c

Download Submit
C:\Windows\System\ePmJaEz.exe

Filesize
1.9MB

MD5
b156360bcdbb494f695cf90770d157ac

SHA1
c7b890262d07df58aa0841166ae1f85e9c8d34d2

SHA256
6bfc0877c2d226cf04cf0005c5d08298d5e44e4901148bfc887cacd86a362497

SHA512
7273be4a80ebaffa18a42a189f337d21d7dfe01d6d5789a3464fba3aa4a3cb0a1759f195cd1c316c2e12b64bebe2210dbba799e09c980a668b0b41ead240fbe8

Download Submit
C:\Windows\System\ebYkAKa.exe

Filesize
1.9MB

MD5
2d1b182d51b3a7a7ecefb11ba2e49a19

SHA1
87eafbcdf017b2419d04d81f3fea11bca817ac9c

SHA256
c3b164e04b34d71507b2306ce40e9cfe02330b82d3c2eb068a73b4e0e6ba5ac7

SHA512
17d50490b1a4b65ba849f6041c8d8be8d19eb3651bbd6283e1f789e9be07dccdeb31e4739ef8649635c19829710e190c43bf01395af5362dd532f6159eccc901

Download Submit
C:\Windows\System\fMkhHig.exe

Filesize
1.9MB

MD5
e3417722b13f25acf2ca233eaf869ea9

SHA1
53ae50c557aa0cbe73c82346d0502e8581a92ab6

SHA256
6b4b07f34d86ff6874ba07cdb5606173913442a12a5c5b88b8286a4ec057ec7f

SHA512
90a66f7dab222c4134cab2c44fd109d11124326c368c52b2d6e0ad02914864a51d4af9c9fdbdeff7d366d1ba708a6b0d1b1ebf8230dfe5bdb779d5a7f74199ca

Download Submit
C:\Windows\System\hPIMynG.exe

Filesize
1.9MB

MD5
637cbb7d88100d3e39c1afac3c4ae803

SHA1
a2d354d9d4b3712583eb1652007abf0bb867900d

SHA256
676aad687f17301c54fe2db5603e608731603410af4b436939fb7b0719af753e

SHA512
e2796f6d88eeeadaa8202495409a9ada62f93f04ae7b827c0342a71260e3dd37ed3006fe09f06d1f108f5aba0e1bef78fd53567ca483ac00b1533ce1d831cb8a

Download Submit
C:\Windows\System\hVfDYqE.exe

Filesize
1.9MB

MD5
5cb63de50c1535d1003e77e916304f22

SHA1
fba9e39b52f3da1337500933f3cde9a11885af02

SHA256
2be9527f30db7876efa55c8d28c682b0e4520b97cbc9985bee59f6f365969507

SHA512
f87d001418f518a3d53f3c325ce2d09d84abaac69af787ad06d1c1e0e2be2baa85c60251d35aa054cf264c5fb49fb8776c35ead9692ac22cb0e7a8be4371dce9

Download Submit
C:\Windows\System\hjIQSVq.exe

Filesize
1.9MB

MD5
2e6c3dc2a9511b5c59516023d5cafb1a

SHA1
6bcc515a5585d6f438b661efceea71bd71d1b2dd

SHA256
3891b36e171e101351b5ab683060d297644dd042b27a704c450931638d7f3a25

SHA512
70f0409c8fec378b3c345bfc403474e20ae2e78bec2adcab7eb32886f16a89313f30ee9cfc6654746b881af20b26df5d851f3736e2c7e66017af898725041f8f

Download Submit
C:\Windows\System\izYtKfK.exe

Filesize
1.9MB

MD5
335155d30e52c625fc5ca04f15280dbb

SHA1
a8f7a38ede8f3eaff8e0fdbc218c4fd72fc62334

SHA256
f5f4c0d4e3432bfb6bff0f5341356557f4db0e2367c592c346673636b249e873

SHA512
ef4d53f3d421b2b2c4f2f9992c2f619b53926de9e6c37fdf40b204b4cec6787abc4aa73defd6490111f4d740b713048f4bd693d77ad279b329217578d571b4f8

Download Submit
C:\Windows\System\mHTJHLC.exe

Filesize
1.9MB

MD5
2ab91c57546077638a2e13a3917744ec

SHA1
97dbf9f59ce79402782856328f4ce60b2c1273e0

SHA256
b8ee882eab211ba69acd772a59fc15e03e731bd40e004bc9556b6a797828db6a

SHA512
4ed60b2f93d3a0ba9913733f97b6ec377a14f918d306653499a2ecd1637e262dd3fa34272f4d2c19417a6a66bb9827bf348fbf0964ead2869931d23824d237e7

Download Submit
C:\Windows\System\nBFoBNs.exe

Filesize
1.9MB

MD5
352cc5f7eba6ce99dee74e1e74443250

SHA1
16dee7a34c2b4668903e121c799e3c2bdc076af3

SHA256
c609c4e6e11ce97cad350b8d42dc3b7cd3dfd02c155aa1b74520af19744dc1eb

SHA512
125ace284ee10ca37407526c8e2b91c67ad7ec9da54fb6637f5df28dbec69006a8a43405f3994de47184403e158eaf2d3df500f7c55d289923e0250a9afe402f

Download Submit
C:\Windows\System\pcCfGIY.exe

Filesize
1.9MB

MD5
f9923c908f0b4bafa57d822b3b3a4d78

SHA1
bb3d0ad12ffae4856c02a6a5a9ce654be1d99206

SHA256
6e625f3cf1b5ecb309e062deea66fa08cd9b7ed16418e45fae1aedd445bc4671

SHA512
5c90a27c3e097da1bdb86e106e961959381d556170d8e2d6b6eed399f5c633e0216f743e5157af193e11b6734492580dea84f0f822bd5853ce63f16633b51972

Download Submit
C:\Windows\System\sdYdOeF.exe

Filesize
1.9MB

MD5
80c22c8386aa8f6ee1a3e6876917c1f8

SHA1
79d9fbd6436d36a46825963cc7625a60bad198d0

SHA256
0a89d0c2928ceee9ca414720a7a687b5e552111048418a52250eb6d239050693

SHA512
1208f1fa30a31ab1f9c2d508f382af8bb5ac734ebd8d3794000a01b10f66dc32c5dfca2f2b2102099740d5f01cede1575dc6e71022dd350c340a50a469156187

Download Submit
C:\Windows\System\tZjQbuv.exe

Filesize
1.9MB

MD5
43aa8e2df0eccfce0aba5c78328ef654

SHA1
5c55863c11e7bee58f858fd8fc483dcc48bb4fe5

SHA256
b798135e1b7aa0b74d36963ae7f21e602c504b7aac23f0426df74b6bbf357657

SHA512
cd4879c15ccdc25e96dc093a282f10a3b547a683c6d36979318cb9b68a50017800e2f7ca40268453e9424503955c7bb3b8fc2ff997f1af098faad1671e014fb2

Download Submit
C:\Windows\System\udAxJcm.exe

Filesize
1.9MB

MD5
5c16ca508edb0a50de458daca068182d

SHA1
348c3ce2378c6e2905883b2442788b2bba67e8be

SHA256
752f1a532c2bfcdf37e5d45670c026a213c8e76bb15b6324017c5d3035016978

SHA512
8d4104094e2eddb08bb4b3b86a62a4d1bd91814c9de446784f388f36b15956f865ee051b9df721f32eb340dbc24bbfb9019f4d828e71793c07679c187c056eb0

Download Submit
C:\Windows\System\uzzuGmc.exe

Filesize
1.9MB

MD5
99aebff5a32daa6b064d4698b7a1b2f9

SHA1
80737d752cd9e4ccb856866fe4684bc97dfcc8d6

SHA256
f82812ae95ab678184d1a9e6bd7abf6c38526080871b1080e98eaa803bbfea58

SHA512
fce00fe097a67ac2a184664c9dbc5098ecc7c05c00a2f6f04171551d94aec7b0e87d9ea13d8e4420fdcae0288099f2a382e7aa17e3a4e79821e87a9fabe10537

Download Submit
C:\Windows\System\vkRLeKD.exe

Filesize
8B

MD5
a8f2921c80c15a3d426e5fdff8a56196

SHA1
4dc21bf95e22427a9dafcd4930e81b62e77d5fda

SHA256
7e9bbeeba45dae16f8c444596ee4180d7313e899e46fa6263fde6904f32d92a1

SHA512
996666f646b1878ee129a778184f9520541ee458797b8bfaefed6e1f152a5436e0ff19d28744463b706ffe3e24e429f5af102aa1e7733dbeeb6210754c828802

Download Submit
C:\Windows\System\wUKaidX.exe

Filesize
1.9MB

MD5
d224948822e333177cab5708e0bd988f

SHA1
3366d92a0cc4f2d7bc47cddc555a9e29ea6a4506

SHA256
b76c718560fd9c388f0d417a3268a83a5d384877f9eebc0f927b50f66d1996cb

SHA512
8b5a303bba78b4f6f8760491e2a3b53df6fe6e539654a5c336eb112799d17becb03e682617f6525f6c4aed588dd61d071184af8845864a3afe3bbb4a64bff2a4

Download Submit
C:\Windows\System\weSRAqA.exe

Filesize
1.9MB

MD5
fdfc78c293a96f2dcf745a708be3e5a8

SHA1
75f3c84adbc5aa19a7248a0247fab7318dea57c2

SHA256
5631c6382a3652a3155d618a7cad747c7181d85d7bf1542a91cafad2e9a0df7d

SHA512
3870e0f246e3eaafd731a8a8fab49cf783f261bd1781bb245c3913fbb80d040a148420e39d66c85ff6af97846df876128283208e884c7f354b6e090b8d6dea55

Download Submit
C:\Windows\System\ygFtzOI.exe

Filesize
1.9MB

MD5
80927be53f7f896106d17dfc54d7d193

SHA1
505864c4133f108c6d80c6099cf6f77de29a337c

SHA256
58a1c4db8eba83424d0a0683b511e8b0621f9788938f928bf3ef20601f51acfe

SHA512
9b7494df5ae71fb8c80fb6e913f77dde8e033eb13af7e2b4fa8750d63ad0472eac75876e244b54ffea2f34f5e5ff9cc64b12b063a093293c359e4b0a3439b1ca

Download Submit
C:\Windows\System\ysdyuqt.exe

Filesize
1.9MB

MD5
afe0dcb6890f41515bb34e83cc64f41c

SHA1
f998c1df5ba64cc4c449f39acac0ab85d323f183

SHA256
d03e8a7d2d0c08546d4189549f0bb6bad9fa0675bc3ed497d7bb7281526c4e71

SHA512
23281af2c26979ed2b70d4649444a150a2a220ea8a618e093160a0289a6aca3ad5230fd4b1f5fc073e98cd1b0931dc607dcad3dd2e2bd843fa046735d9006e55

Download Submit
memory/60-2616-0x00007FF79C3C0000-0x00007FF79C7B2000-memory.dmp

Filesize
3.9MB

Download
memory/60-2626-0x00007FF79C3C0000-0x00007FF79C7B2000-memory.dmp

Filesize
3.9MB

Download
memory/60-49-0x00007FF79C3C0000-0x00007FF79C7B2000-memory.dmp

Filesize
3.9MB

Download
memory/220-0-0x00007FF6F5470000-0x00007FF6F5862000-memory.dmp

Filesize
3.9MB

Download
memory/220-1-0x000002375BF30000-0x000002375BF40000-memory.dmp

Filesize
64KB

Download
memory/768-125-0x00007FF7BBEE0000-0x00007FF7BC2D2000-memory.dmp

Filesize
3.9MB

Download
memory/768-2642-0x00007FF7BBEE0000-0x00007FF7BC2D2000-memory.dmp

Filesize
3.9MB

Download
memory/1204-26-0x00007FFC94990000-0x00007FFC95451000-memory.dmp

Filesize
10.8MB

Download
memory/1204-33-0x0000020D1D260000-0x0000020D1D270000-memory.dmp

Filesize
64KB

Download
memory/1204-93-0x0000020D35B20000-0x0000020D35B42000-memory.dmp

Filesize
136KB

Download
memory/1228-2648-0x00007FF64C8F0000-0x00007FF64CCE2000-memory.dmp

Filesize
3.9MB

Download
memory/1228-143-0x00007FF64C8F0000-0x00007FF64CCE2000-memory.dmp

Filesize
3.9MB

Download
memory/1260-2653-0x00007FF778AF0000-0x00007FF778EE2000-memory.dmp

Filesize
3.9MB

Download
memory/1260-137-0x00007FF778AF0000-0x00007FF778EE2000-memory.dmp

Filesize
3.9MB

Download
memory/1940-114-0x00007FF7DB120000-0x00007FF7DB512000-memory.dmp

Filesize
3.9MB

Download
memory/1940-2622-0x00007FF7DB120000-0x00007FF7DB512000-memory.dmp

Filesize
3.9MB

Download
memory/1976-108-0x00007FF607950000-0x00007FF607D42000-memory.dmp

Filesize
3.9MB

Download
memory/1976-2644-0x00007FF607950000-0x00007FF607D42000-memory.dmp

Filesize
3.9MB

Download
memory/2044-104-0x00007FF67A200000-0x00007FF67A5F2000-memory.dmp

Filesize
3.9MB

Download
memory/2044-2638-0x00007FF67A200000-0x00007FF67A5F2000-memory.dmp

Filesize
3.9MB

Download
memory/2288-120-0x00007FF686B20000-0x00007FF686F12000-memory.dmp

Filesize
3.9MB

Download
memory/2288-2636-0x00007FF686B20000-0x00007FF686F12000-memory.dmp

Filesize
3.9MB

Download
memory/2328-2662-0x00007FF6FE6D0000-0x00007FF6FEAC2000-memory.dmp

Filesize
3.9MB

Download
memory/2328-155-0x00007FF6FE6D0000-0x00007FF6FEAC2000-memory.dmp

Filesize
3.9MB

Download
memory/2504-60-0x00007FF60EFC0000-0x00007FF60F3B2000-memory.dmp

Filesize
3.9MB

Download
memory/2504-2625-0x00007FF60EFC0000-0x00007FF60F3B2000-memory.dmp

Filesize
3.9MB

Download
memory/2640-2655-0x00007FF778F00000-0x00007FF7792F2000-memory.dmp

Filesize
3.9MB

Download
memory/2640-162-0x00007FF778F00000-0x00007FF7792F2000-memory.dmp

Filesize
3.9MB

Download
memory/2804-2629-0x00007FF7D5400000-0x00007FF7D57F2000-memory.dmp

Filesize
3.9MB

Download
memory/2804-124-0x00007FF7D5400000-0x00007FF7D57F2000-memory.dmp

Filesize
3.9MB

Download
memory/2996-131-0x00007FF748A10000-0x00007FF748E02000-memory.dmp

Filesize
3.9MB

Download
memory/2996-2647-0x00007FF748A10000-0x00007FF748E02000-memory.dmp

Filesize
3.9MB

Download
memory/3304-2620-0x00007FF7D1F90000-0x00007FF7D2382000-memory.dmp

Filesize
3.9MB

Download
memory/3304-2615-0x00007FF7D1F90000-0x00007FF7D2382000-memory.dmp

Filesize
3.9MB

Download
memory/3304-6-0x00007FF7D1F90000-0x00007FF7D2382000-memory.dmp

Filesize
3.9MB

Download
memory/3516-2668-0x00007FF7CE730000-0x00007FF7CEB22000-memory.dmp

Filesize
3.9MB

Download
memory/3516-156-0x00007FF7CE730000-0x00007FF7CEB22000-memory.dmp

Filesize
3.9MB

Download
memory/3788-149-0x00007FF707770000-0x00007FF707B62000-memory.dmp

Filesize
3.9MB

Download
memory/3788-2664-0x00007FF707770000-0x00007FF707B62000-memory.dmp

Filesize
3.9MB

Download
memory/3868-2631-0x00007FF710290000-0x00007FF710682000-memory.dmp

Filesize
3.9MB

Download
memory/3868-83-0x00007FF710290000-0x00007FF710682000-memory.dmp

Filesize
3.9MB

Download
memory/4064-2640-0x00007FF69AEA0000-0x00007FF69B292000-memory.dmp

Filesize
3.9MB

Download
memory/4064-97-0x00007FF69AEA0000-0x00007FF69B292000-memory.dmp

Filesize
3.9MB

Download
memory/4664-71-0x00007FF6D0AA0000-0x00007FF6D0E92000-memory.dmp

Filesize
3.9MB

Download
memory/4664-2634-0x00007FF6D0AA0000-0x00007FF6D0E92000-memory.dmp

Filesize
3.9MB

Download
memory/4712-81-0x00007FF6A71D0000-0x00007FF6A75C2000-memory.dmp

Filesize
3.9MB

Download
memory/4712-2633-0x00007FF6A71D0000-0x00007FF6A75C2000-memory.dmp

Filesize
3.9MB

Download
memory/5096-109-0x00007FF68E8A0000-0x00007FF68EC92000-memory.dmp

Filesize
3.9MB

Download
memory/5096-2617-0x00007FF68E8A0000-0x00007FF68EC92000-memory.dmp

Filesize
3.9MB

Download
memory/5096-2880-0x00007FF68E8A0000-0x00007FF68EC92000-memory.dmp

Filesize
3.9MB

Download