xmrig | de210bff4326ff0038ddc33ecd4549ef192eeeb9af4cd83cb445302705b79291

Analysis

max time kernel
123s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 04:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
Size

2.2MB
MD5

0904a2f9a94832e19841c04549e8916c
SHA1

741d79802d5258eaa32632dd898ea0a613f6f162
SHA256

de210bff4326ff0038ddc33ecd4549ef192eeeb9af4cd83cb445302705b79291
SHA512

5e04f0bca352ec16d4c800b5033dc2870a49cec690ed5d734ded694e817d5a1e86e0a70fd47960ee227f3155ee80a72b72c56028c4bbff70e302f38951b8180f
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfn:NABM

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 42 IoCs

miner

resource	yara_rule
behavioral2/memory/4684-25-0x00007FF78ACD0000-0x00007FF78B0C2000-memory.dmp	xmrig
behavioral2/memory/2964-33-0x00007FF699BC0000-0x00007FF699FB2000-memory.dmp	xmrig
behavioral2/memory/368-523-0x00007FF75DA90000-0x00007FF75DE82000-memory.dmp	xmrig
behavioral2/memory/3740-525-0x00007FF679250000-0x00007FF679642000-memory.dmp	xmrig
behavioral2/memory/1992-86-0x00007FF7A1ED0000-0x00007FF7A22C2000-memory.dmp	xmrig
behavioral2/memory/4360-530-0x00007FF653260000-0x00007FF653652000-memory.dmp	xmrig
behavioral2/memory/464-554-0x00007FF6EBD70000-0x00007FF6EC162000-memory.dmp	xmrig
behavioral2/memory/536-564-0x00007FF795280000-0x00007FF795672000-memory.dmp	xmrig
behavioral2/memory/3512-604-0x00007FF6BEC70000-0x00007FF6BF062000-memory.dmp	xmrig
behavioral2/memory/2280-636-0x00007FF6A3290000-0x00007FF6A3682000-memory.dmp	xmrig
behavioral2/memory/4864-642-0x00007FF78EBE0000-0x00007FF78EFD2000-memory.dmp	xmrig
behavioral2/memory/384-621-0x00007FF6B8440000-0x00007FF6B8832000-memory.dmp	xmrig
behavioral2/memory/4532-586-0x00007FF6B34C0000-0x00007FF6B38B2000-memory.dmp	xmrig
behavioral2/memory/3112-550-0x00007FF679670000-0x00007FF679A62000-memory.dmp	xmrig
behavioral2/memory/2796-546-0x00007FF67FD90000-0x00007FF680182000-memory.dmp	xmrig
behavioral2/memory/4268-534-0x00007FF64A5B0000-0x00007FF64A9A2000-memory.dmp	xmrig
behavioral2/memory/2716-531-0x00007FF6162C0000-0x00007FF6166B2000-memory.dmp	xmrig
behavioral2/memory/2268-2683-0x00007FF7C19C0000-0x00007FF7C1DB2000-memory.dmp	xmrig
behavioral2/memory/3840-2684-0x00007FF6A1B50000-0x00007FF6A1F42000-memory.dmp	xmrig
behavioral2/memory/2108-2685-0x00007FF7E53A0000-0x00007FF7E5792000-memory.dmp	xmrig
behavioral2/memory/3052-2686-0x00007FF7139E0000-0x00007FF713DD2000-memory.dmp	xmrig
behavioral2/memory/1992-2689-0x00007FF7A1ED0000-0x00007FF7A22C2000-memory.dmp	xmrig
behavioral2/memory/4684-2691-0x00007FF78ACD0000-0x00007FF78B0C2000-memory.dmp	xmrig
behavioral2/memory/2964-2693-0x00007FF699BC0000-0x00007FF699FB2000-memory.dmp	xmrig
behavioral2/memory/368-2696-0x00007FF75DA90000-0x00007FF75DE82000-memory.dmp	xmrig
behavioral2/memory/3052-2697-0x00007FF7139E0000-0x00007FF713DD2000-memory.dmp	xmrig
behavioral2/memory/2268-2699-0x00007FF7C19C0000-0x00007FF7C1DB2000-memory.dmp	xmrig
behavioral2/memory/3740-2701-0x00007FF679250000-0x00007FF679642000-memory.dmp	xmrig
behavioral2/memory/2108-2707-0x00007FF7E53A0000-0x00007FF7E5792000-memory.dmp	xmrig
behavioral2/memory/3840-2709-0x00007FF6A1B50000-0x00007FF6A1F42000-memory.dmp	xmrig
behavioral2/memory/4268-2705-0x00007FF64A5B0000-0x00007FF64A9A2000-memory.dmp	xmrig
behavioral2/memory/4360-2704-0x00007FF653260000-0x00007FF653652000-memory.dmp	xmrig
behavioral2/memory/2280-2713-0x00007FF6A3290000-0x00007FF6A3682000-memory.dmp	xmrig
behavioral2/memory/4864-2715-0x00007FF78EBE0000-0x00007FF78EFD2000-memory.dmp	xmrig
behavioral2/memory/2796-2717-0x00007FF67FD90000-0x00007FF680182000-memory.dmp	xmrig
behavioral2/memory/2716-2711-0x00007FF6162C0000-0x00007FF6166B2000-memory.dmp	xmrig
behavioral2/memory/4532-2719-0x00007FF6B34C0000-0x00007FF6B38B2000-memory.dmp	xmrig
behavioral2/memory/3112-2732-0x00007FF679670000-0x00007FF679A62000-memory.dmp	xmrig
behavioral2/memory/536-2730-0x00007FF795280000-0x00007FF795672000-memory.dmp	xmrig
behavioral2/memory/384-2729-0x00007FF6B8440000-0x00007FF6B8832000-memory.dmp	xmrig
behavioral2/memory/3512-2727-0x00007FF6BEC70000-0x00007FF6BF062000-memory.dmp	xmrig
behavioral2/memory/464-2724-0x00007FF6EBD70000-0x00007FF6EC162000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
7	552	powershell.exe
9	552	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1992	cpcTvlH.exe
4684	ErLixiP.exe
368	qmKJPne.exe
3052	mBdFhxl.exe
2964	OBiclHy.exe
3740	NeigiUZ.exe
2268	pbHyAcA.exe
4360	eJozPKn.exe
3840	zobhpLu.exe
2716	EEdaavx.exe
2108	bVbEMBS.exe
4268	wQNkZzw.exe
2280	IefjoJm.exe
4864	uipUUOo.exe
2796	NLnsytv.exe
3112	jrZSoTY.exe
464	IAMNFLh.exe
536	cAJIRfT.exe
4532	HKHaDWd.exe
3512	wtZdWfG.exe
384	qlxaGBA.exe
1056	itsIOgH.exe
1996	nuRLMby.exe
1072	OXFONwv.exe
1328	OduKvWa.exe
1548	HOMWXiT.exe
556	NjYMBaA.exe
3748	RAbpANt.exe
3764	aRohank.exe
5076	CaEHbnm.exe
3956	xpBqllL.exe
3228	ZyfXmde.exe
3772	ASiEKoM.exe
1504	rcsPNOr.exe
3276	Vzggmhf.exe
1096	peztWfL.exe
2040	MPHeBPb.exe
1676	jimkLni.exe
764	PsEVFws.exe
5108	bPRJNZT.exe
2900	qfGdBmD.exe
1884	yVAiRsP.exe
4400	dqswNLi.exe
4932	ObQimzR.exe
4732	YBbxoYi.exe
4216	HNKxuPP.exe
3892	pAvyqzg.exe
776	NKbJbTg.exe
3148	VSZhrXN.exe
3456	hOPzYCt.exe
1700	pPspfXl.exe
4228	lYeabaL.exe
3880	GypuYjX.exe
4836	FuDTaRu.exe
2844	nXVlUTA.exe
4964	KTItWJM.exe
632	dqvqzHP.exe
4716	iBkxgqO.exe
3616	jPOrEfw.exe
820	KwcjePG.exe
4976	oOfcVMx.exe
4584	cVQabYP.exe
1424	BnYDGtr.exe
948	kFbNksX.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2276-0-0x00007FF746F10000-0x00007FF747302000-memory.dmp	upx
behavioral2/files/0x000c000000023b33-5.dat	upx
behavioral2/files/0x000d000000023b8c-8.dat	upx
behavioral2/files/0x000a000000023b91-7.dat	upx
behavioral2/memory/4684-25-0x00007FF78ACD0000-0x00007FF78B0C2000-memory.dmp	upx
behavioral2/files/0x000a000000023b96-42.dat	upx
behavioral2/files/0x000a000000023b94-48.dat	upx
behavioral2/files/0x000a000000023b98-55.dat	upx
behavioral2/memory/3840-58-0x00007FF6A1B50000-0x00007FF6A1F42000-memory.dmp	upx
behavioral2/files/0x000a000000023b95-51.dat	upx
behavioral2/memory/2268-49-0x00007FF7C19C0000-0x00007FF7C1DB2000-memory.dmp	upx
behavioral2/files/0x000a000000023b97-47.dat	upx
behavioral2/files/0x000a000000023b92-38.dat	upx
behavioral2/files/0x000a000000023b93-34.dat	upx
behavioral2/memory/2964-33-0x00007FF699BC0000-0x00007FF699FB2000-memory.dmp	upx
behavioral2/memory/3052-30-0x00007FF7139E0000-0x00007FF713DD2000-memory.dmp	upx
behavioral2/files/0x000a000000023b99-57.dat	upx
behavioral2/files/0x000a000000023b9b-90.dat	upx
behavioral2/files/0x000a000000023ba0-108.dat	upx
behavioral2/files/0x000a000000023ba1-118.dat	upx
behavioral2/files/0x000a000000023ba3-128.dat	upx
behavioral2/files/0x000a000000023ba7-148.dat	upx
behavioral2/memory/368-523-0x00007FF75DA90000-0x00007FF75DE82000-memory.dmp	upx
behavioral2/memory/3740-525-0x00007FF679250000-0x00007FF679642000-memory.dmp	upx
behavioral2/files/0x000a000000023bae-183.dat	upx
behavioral2/files/0x000a000000023bac-181.dat	upx
behavioral2/files/0x000a000000023bad-178.dat	upx
behavioral2/files/0x000a000000023bab-174.dat	upx
behavioral2/files/0x000a000000023baa-169.dat	upx
behavioral2/files/0x000a000000023ba9-163.dat	upx
behavioral2/files/0x000a000000023ba8-159.dat	upx
behavioral2/files/0x000a000000023ba6-151.dat	upx
behavioral2/files/0x000a000000023ba5-146.dat	upx
behavioral2/files/0x000a000000023ba4-141.dat	upx
behavioral2/files/0x000a000000023ba2-131.dat	upx
behavioral2/files/0x000b000000023b9c-121.dat	upx
behavioral2/files/0x000a000000023b9f-111.dat	upx
behavioral2/files/0x000b000000023b8e-106.dat	upx
behavioral2/files/0x000b000000023b9d-101.dat	upx
behavioral2/files/0x000a000000023b9e-99.dat	upx
behavioral2/memory/1992-86-0x00007FF7A1ED0000-0x00007FF7A22C2000-memory.dmp	upx
behavioral2/files/0x000a000000023b9a-83.dat	upx
behavioral2/memory/2108-78-0x00007FF7E53A0000-0x00007FF7E5792000-memory.dmp	upx
behavioral2/memory/4360-530-0x00007FF653260000-0x00007FF653652000-memory.dmp	upx
behavioral2/memory/464-554-0x00007FF6EBD70000-0x00007FF6EC162000-memory.dmp	upx
behavioral2/memory/536-564-0x00007FF795280000-0x00007FF795672000-memory.dmp	upx
behavioral2/memory/3512-604-0x00007FF6BEC70000-0x00007FF6BF062000-memory.dmp	upx
behavioral2/memory/2280-636-0x00007FF6A3290000-0x00007FF6A3682000-memory.dmp	upx
behavioral2/memory/4864-642-0x00007FF78EBE0000-0x00007FF78EFD2000-memory.dmp	upx
behavioral2/memory/384-621-0x00007FF6B8440000-0x00007FF6B8832000-memory.dmp	upx
behavioral2/memory/4532-586-0x00007FF6B34C0000-0x00007FF6B38B2000-memory.dmp	upx
behavioral2/memory/3112-550-0x00007FF679670000-0x00007FF679A62000-memory.dmp	upx
behavioral2/memory/2796-546-0x00007FF67FD90000-0x00007FF680182000-memory.dmp	upx
behavioral2/memory/4268-534-0x00007FF64A5B0000-0x00007FF64A9A2000-memory.dmp	upx
behavioral2/memory/2716-531-0x00007FF6162C0000-0x00007FF6166B2000-memory.dmp	upx
behavioral2/memory/2268-2683-0x00007FF7C19C0000-0x00007FF7C1DB2000-memory.dmp	upx
behavioral2/memory/3840-2684-0x00007FF6A1B50000-0x00007FF6A1F42000-memory.dmp	upx
behavioral2/memory/2108-2685-0x00007FF7E53A0000-0x00007FF7E5792000-memory.dmp	upx
behavioral2/memory/3052-2686-0x00007FF7139E0000-0x00007FF713DD2000-memory.dmp	upx
behavioral2/memory/1992-2689-0x00007FF7A1ED0000-0x00007FF7A22C2000-memory.dmp	upx
behavioral2/memory/4684-2691-0x00007FF78ACD0000-0x00007FF78B0C2000-memory.dmp	upx
behavioral2/memory/2964-2693-0x00007FF699BC0000-0x00007FF699FB2000-memory.dmp	upx
behavioral2/memory/368-2696-0x00007FF75DA90000-0x00007FF75DE82000-memory.dmp	upx
behavioral2/memory/3052-2697-0x00007FF7139E0000-0x00007FF713DD2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	raw.githubusercontent.com
7	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\qmKJPne.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\vUXMJWk.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\dWjhvWc.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\hOPzYCt.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\eYpkfkh.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\fWLMgdn.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\pQxfVrs.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\OlZOfEU.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\qRPJfCZ.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\OHkxRDk.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\IIBfurE.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\mpcwdQy.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\bcuaAjX.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\WzrTzEp.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\xgjplcv.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\CCwtUWw.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\GwHkUVN.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\WyVNTes.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\jgnepWp.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\cVQabYP.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\qOyNuAi.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\czlwTyU.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\EaePanW.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\MLoJEqT.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\WGdCmhD.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\pCYfCJR.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\TMmEYLA.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\yBlqfxW.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\QKFSmmW.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\FrsZPLj.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\qxxETaz.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\MnQexXf.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\vnlyZJw.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\RVFYqgc.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\aRxhpdr.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\IFpxuBN.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\IiPgRNK.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\QpyMcoj.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\OLTtOHF.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\QoZgpmX.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\PcGhJCN.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\gXAJyrB.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\ZyfXmde.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\khiVmKX.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\oChwGtd.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\NZJgEvY.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\HYRrlXK.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\UPOxYGN.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\CrivHQx.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\fAzpmkP.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\kEqeNQM.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\LIgXbqO.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\FEuVAWD.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\RJiphLp.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\NKbJbTg.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\JLxVgeD.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\nwFhSLT.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\yZoelCF.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\xxDAuvV.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\AbbYLFs.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\OMuEkvv.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\mmvVUWW.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\TBcMsHe.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
File created	C:\Windows\System\iamJMrB.exe	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
552	powershell.exe
552	powershell.exe
552	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	552	powershell.exe
Token: SeLockMemoryPrivilege	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 552	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	85
PID 2276 wrote to memory of 552	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	85
PID 2276 wrote to memory of 1992	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	86
PID 2276 wrote to memory of 1992	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	86
PID 2276 wrote to memory of 4684	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	87
PID 2276 wrote to memory of 4684	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	87
PID 2276 wrote to memory of 2964	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	88
PID 2276 wrote to memory of 2964	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	88
PID 2276 wrote to memory of 368	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	89
PID 2276 wrote to memory of 368	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	89
PID 2276 wrote to memory of 3052	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	90
PID 2276 wrote to memory of 3052	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	90
PID 2276 wrote to memory of 3740	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	91
PID 2276 wrote to memory of 3740	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	91
PID 2276 wrote to memory of 2268	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	92
PID 2276 wrote to memory of 2268	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	92
PID 2276 wrote to memory of 4360	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	93
PID 2276 wrote to memory of 4360	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	93
PID 2276 wrote to memory of 3840	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	94
PID 2276 wrote to memory of 3840	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	94
PID 2276 wrote to memory of 2716	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	95
PID 2276 wrote to memory of 2716	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	95
PID 2276 wrote to memory of 2108	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	96
PID 2276 wrote to memory of 2108	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	96
PID 2276 wrote to memory of 4268	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	97
PID 2276 wrote to memory of 4268	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	97
PID 2276 wrote to memory of 2280	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	98
PID 2276 wrote to memory of 2280	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	98
PID 2276 wrote to memory of 4864	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	99
PID 2276 wrote to memory of 4864	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	99
PID 2276 wrote to memory of 2796	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	100
PID 2276 wrote to memory of 2796	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	100
PID 2276 wrote to memory of 3112	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	101
PID 2276 wrote to memory of 3112	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	101
PID 2276 wrote to memory of 464	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	102
PID 2276 wrote to memory of 464	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	102
PID 2276 wrote to memory of 536	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	103
PID 2276 wrote to memory of 536	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	103
PID 2276 wrote to memory of 4532	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	104
PID 2276 wrote to memory of 4532	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	104
PID 2276 wrote to memory of 3512	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	105
PID 2276 wrote to memory of 3512	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	105
PID 2276 wrote to memory of 384	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	106
PID 2276 wrote to memory of 384	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	106
PID 2276 wrote to memory of 1056	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	107
PID 2276 wrote to memory of 1056	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	107
PID 2276 wrote to memory of 1996	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	108
PID 2276 wrote to memory of 1996	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	108
PID 2276 wrote to memory of 1072	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	109
PID 2276 wrote to memory of 1072	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	109
PID 2276 wrote to memory of 1328	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	110
PID 2276 wrote to memory of 1328	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	110
PID 2276 wrote to memory of 1548	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	111
PID 2276 wrote to memory of 1548	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	111
PID 2276 wrote to memory of 556	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	112
PID 2276 wrote to memory of 556	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	112
PID 2276 wrote to memory of 3748	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	113
PID 2276 wrote to memory of 3748	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	113
PID 2276 wrote to memory of 3764	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	114
PID 2276 wrote to memory of 3764	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	114
PID 2276 wrote to memory of 5076	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	115
PID 2276 wrote to memory of 5076	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	115
PID 2276 wrote to memory of 3956	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	116
PID 2276 wrote to memory of 3956	2276	0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0904a2f9a94832e19841c04549e8916c_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:552
- C:\Windows\System\cpcTvlH.exe
  C:\Windows\System\cpcTvlH.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\ErLixiP.exe
  C:\Windows\System\ErLixiP.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\OBiclHy.exe
  C:\Windows\System\OBiclHy.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\qmKJPne.exe
  C:\Windows\System\qmKJPne.exe
  2⤵
  - Executes dropped EXE
  PID:368
- C:\Windows\System\mBdFhxl.exe
  C:\Windows\System\mBdFhxl.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\NeigiUZ.exe
  C:\Windows\System\NeigiUZ.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\pbHyAcA.exe
  C:\Windows\System\pbHyAcA.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\eJozPKn.exe
  C:\Windows\System\eJozPKn.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\zobhpLu.exe
  C:\Windows\System\zobhpLu.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\EEdaavx.exe
  C:\Windows\System\EEdaavx.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\bVbEMBS.exe
  C:\Windows\System\bVbEMBS.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\wQNkZzw.exe
  C:\Windows\System\wQNkZzw.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\IefjoJm.exe
  C:\Windows\System\IefjoJm.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\uipUUOo.exe
  C:\Windows\System\uipUUOo.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\NLnsytv.exe
  C:\Windows\System\NLnsytv.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\jrZSoTY.exe
  C:\Windows\System\jrZSoTY.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\IAMNFLh.exe
  C:\Windows\System\IAMNFLh.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\cAJIRfT.exe
  C:\Windows\System\cAJIRfT.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\HKHaDWd.exe
  C:\Windows\System\HKHaDWd.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\wtZdWfG.exe
  C:\Windows\System\wtZdWfG.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\qlxaGBA.exe
  C:\Windows\System\qlxaGBA.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\itsIOgH.exe
  C:\Windows\System\itsIOgH.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\nuRLMby.exe
  C:\Windows\System\nuRLMby.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\OXFONwv.exe
  C:\Windows\System\OXFONwv.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\OduKvWa.exe
  C:\Windows\System\OduKvWa.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\HOMWXiT.exe
  C:\Windows\System\HOMWXiT.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\NjYMBaA.exe
  C:\Windows\System\NjYMBaA.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\RAbpANt.exe
  C:\Windows\System\RAbpANt.exe
  2⤵
  - Executes dropped EXE
  PID:3748
- C:\Windows\System\aRohank.exe
  C:\Windows\System\aRohank.exe
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Windows\System\CaEHbnm.exe
  C:\Windows\System\CaEHbnm.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\xpBqllL.exe
  C:\Windows\System\xpBqllL.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\ZyfXmde.exe
  C:\Windows\System\ZyfXmde.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\ASiEKoM.exe
  C:\Windows\System\ASiEKoM.exe
  2⤵
  - Executes dropped EXE
  PID:3772
- C:\Windows\System\rcsPNOr.exe
  C:\Windows\System\rcsPNOr.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\Vzggmhf.exe
  C:\Windows\System\Vzggmhf.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\peztWfL.exe
  C:\Windows\System\peztWfL.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\MPHeBPb.exe
  C:\Windows\System\MPHeBPb.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\jimkLni.exe
  C:\Windows\System\jimkLni.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\PsEVFws.exe
  C:\Windows\System\PsEVFws.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\bPRJNZT.exe
  C:\Windows\System\bPRJNZT.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\qfGdBmD.exe
  C:\Windows\System\qfGdBmD.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\yVAiRsP.exe
  C:\Windows\System\yVAiRsP.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\dqswNLi.exe
  C:\Windows\System\dqswNLi.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\ObQimzR.exe
  C:\Windows\System\ObQimzR.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\YBbxoYi.exe
  C:\Windows\System\YBbxoYi.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\HNKxuPP.exe
  C:\Windows\System\HNKxuPP.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System\pAvyqzg.exe
  C:\Windows\System\pAvyqzg.exe
  2⤵
  - Executes dropped EXE
  PID:3892
- C:\Windows\System\NKbJbTg.exe
  C:\Windows\System\NKbJbTg.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\VSZhrXN.exe
  C:\Windows\System\VSZhrXN.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\hOPzYCt.exe
  C:\Windows\System\hOPzYCt.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\pPspfXl.exe
  C:\Windows\System\pPspfXl.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\lYeabaL.exe
  C:\Windows\System\lYeabaL.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\GypuYjX.exe
  C:\Windows\System\GypuYjX.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\FuDTaRu.exe
  C:\Windows\System\FuDTaRu.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\nXVlUTA.exe
  C:\Windows\System\nXVlUTA.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\KTItWJM.exe
  C:\Windows\System\KTItWJM.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\dqvqzHP.exe
  C:\Windows\System\dqvqzHP.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\iBkxgqO.exe
  C:\Windows\System\iBkxgqO.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\jPOrEfw.exe
  C:\Windows\System\jPOrEfw.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\KwcjePG.exe
  C:\Windows\System\KwcjePG.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\oOfcVMx.exe
  C:\Windows\System\oOfcVMx.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\cVQabYP.exe
  C:\Windows\System\cVQabYP.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\BnYDGtr.exe
  C:\Windows\System\BnYDGtr.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\kFbNksX.exe
  C:\Windows\System\kFbNksX.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\jHrwfvX.exe
  C:\Windows\System\jHrwfvX.exe
  2⤵
  PID:212
- C:\Windows\System\TNhZUQO.exe
  C:\Windows\System\TNhZUQO.exe
  2⤵
  PID:1320
- C:\Windows\System\SlnkyAE.exe
  C:\Windows\System\SlnkyAE.exe
  2⤵
  PID:4024
- C:\Windows\System\vnEpVHJ.exe
  C:\Windows\System\vnEpVHJ.exe
  2⤵
  PID:2696
- C:\Windows\System\KZyyjmv.exe
  C:\Windows\System\KZyyjmv.exe
  2⤵
  PID:3216
- C:\Windows\System\DVJySzf.exe
  C:\Windows\System\DVJySzf.exe
  2⤵
  PID:4208
- C:\Windows\System\DPaESDI.exe
  C:\Windows\System\DPaESDI.exe
  2⤵
  PID:3400
- C:\Windows\System\URtkzrE.exe
  C:\Windows\System\URtkzrE.exe
  2⤵
  PID:4408
- C:\Windows\System\JjSbOSN.exe
  C:\Windows\System\JjSbOSN.exe
  2⤵
  PID:5124
- C:\Windows\System\vzmcInm.exe
  C:\Windows\System\vzmcInm.exe
  2⤵
  PID:5156
- C:\Windows\System\zsqYmJi.exe
  C:\Windows\System\zsqYmJi.exe
  2⤵
  PID:5184
- C:\Windows\System\BRmCfmm.exe
  C:\Windows\System\BRmCfmm.exe
  2⤵
  PID:5212
- C:\Windows\System\NUZbPUN.exe
  C:\Windows\System\NUZbPUN.exe
  2⤵
  PID:5240
- C:\Windows\System\XWDbRGA.exe
  C:\Windows\System\XWDbRGA.exe
  2⤵
  PID:5268
- C:\Windows\System\droxsro.exe
  C:\Windows\System\droxsro.exe
  2⤵
  PID:5296
- C:\Windows\System\kcbefJQ.exe
  C:\Windows\System\kcbefJQ.exe
  2⤵
  PID:5324
- C:\Windows\System\WzHjTGH.exe
  C:\Windows\System\WzHjTGH.exe
  2⤵
  PID:5352
- C:\Windows\System\FXdQNQz.exe
  C:\Windows\System\FXdQNQz.exe
  2⤵
  PID:5376
- C:\Windows\System\CGwVeHu.exe
  C:\Windows\System\CGwVeHu.exe
  2⤵
  PID:5408
- C:\Windows\System\rGAXcrS.exe
  C:\Windows\System\rGAXcrS.exe
  2⤵
  PID:5440
- C:\Windows\System\USPHzHy.exe
  C:\Windows\System\USPHzHy.exe
  2⤵
  PID:5468
- C:\Windows\System\MhiDUxg.exe
  C:\Windows\System\MhiDUxg.exe
  2⤵
  PID:5496
- C:\Windows\System\GFdjOUF.exe
  C:\Windows\System\GFdjOUF.exe
  2⤵
  PID:5524
- C:\Windows\System\DIpgqgx.exe
  C:\Windows\System\DIpgqgx.exe
  2⤵
  PID:5552
- C:\Windows\System\tTeqHsx.exe
  C:\Windows\System\tTeqHsx.exe
  2⤵
  PID:5580
- C:\Windows\System\BlpWDSS.exe
  C:\Windows\System\BlpWDSS.exe
  2⤵
  PID:5608
- C:\Windows\System\IJnjpiF.exe
  C:\Windows\System\IJnjpiF.exe
  2⤵
  PID:5636
- C:\Windows\System\yHxplHq.exe
  C:\Windows\System\yHxplHq.exe
  2⤵
  PID:5660
- C:\Windows\System\QREqNcY.exe
  C:\Windows\System\QREqNcY.exe
  2⤵
  PID:5684
- C:\Windows\System\PwZDDCd.exe
  C:\Windows\System\PwZDDCd.exe
  2⤵
  PID:5720
- C:\Windows\System\YGFcwKr.exe
  C:\Windows\System\YGFcwKr.exe
  2⤵
  PID:5748
- C:\Windows\System\yPeTJIa.exe
  C:\Windows\System\yPeTJIa.exe
  2⤵
  PID:5776
- C:\Windows\System\IwPQZTL.exe
  C:\Windows\System\IwPQZTL.exe
  2⤵
  PID:5808
- C:\Windows\System\Hnkmvod.exe
  C:\Windows\System\Hnkmvod.exe
  2⤵
  PID:5840
- C:\Windows\System\LgvxiZU.exe
  C:\Windows\System\LgvxiZU.exe
  2⤵
  PID:5868
- C:\Windows\System\Idjkmtw.exe
  C:\Windows\System\Idjkmtw.exe
  2⤵
  PID:5896
- C:\Windows\System\JLYlctL.exe
  C:\Windows\System\JLYlctL.exe
  2⤵
  PID:5928
- C:\Windows\System\qOyNuAi.exe
  C:\Windows\System\qOyNuAi.exe
  2⤵
  PID:5952
- C:\Windows\System\oLuFYSh.exe
  C:\Windows\System\oLuFYSh.exe
  2⤵
  PID:5980
- C:\Windows\System\jddyQMc.exe
  C:\Windows\System\jddyQMc.exe
  2⤵
  PID:6012
- C:\Windows\System\spdNONS.exe
  C:\Windows\System\spdNONS.exe
  2⤵
  PID:6040
- C:\Windows\System\WQqnwxq.exe
  C:\Windows\System\WQqnwxq.exe
  2⤵
  PID:6068
- C:\Windows\System\BBgQREj.exe
  C:\Windows\System\BBgQREj.exe
  2⤵
  PID:6096
- C:\Windows\System\JLxVgeD.exe
  C:\Windows\System\JLxVgeD.exe
  2⤵
  PID:6124
- C:\Windows\System\GNgaRaI.exe
  C:\Windows\System\GNgaRaI.exe
  2⤵
  PID:1384
- C:\Windows\System\OojpuvH.exe
  C:\Windows\System\OojpuvH.exe
  2⤵
  PID:1000
- C:\Windows\System\xRFulTk.exe
  C:\Windows\System\xRFulTk.exe
  2⤵
  PID:4592
- C:\Windows\System\dTyPYii.exe
  C:\Windows\System\dTyPYii.exe
  2⤵
  PID:4320
- C:\Windows\System\AuiPPoB.exe
  C:\Windows\System\AuiPPoB.exe
  2⤵
  PID:5196
- C:\Windows\System\TkLXYKo.exe
  C:\Windows\System\TkLXYKo.exe
  2⤵
  PID:5252
- C:\Windows\System\HhoItjt.exe
  C:\Windows\System\HhoItjt.exe
  2⤵
  PID:5312
- C:\Windows\System\liwzbYg.exe
  C:\Windows\System\liwzbYg.exe
  2⤵
  PID:5372
- C:\Windows\System\MrjxbSS.exe
  C:\Windows\System\MrjxbSS.exe
  2⤵
  PID:5452
- C:\Windows\System\bLjdWYl.exe
  C:\Windows\System\bLjdWYl.exe
  2⤵
  PID:5508
- C:\Windows\System\gtslaIx.exe
  C:\Windows\System\gtslaIx.exe
  2⤵
  PID:5564
- C:\Windows\System\AqeXWLG.exe
  C:\Windows\System\AqeXWLG.exe
  2⤵
  PID:5624
- C:\Windows\System\PbKgHdi.exe
  C:\Windows\System\PbKgHdi.exe
  2⤵
  PID:5696
- C:\Windows\System\FQRLcni.exe
  C:\Windows\System\FQRLcni.exe
  2⤵
  PID:5744
- C:\Windows\System\yhqolwr.exe
  C:\Windows\System\yhqolwr.exe
  2⤵
  PID:5824
- C:\Windows\System\CqSYHhg.exe
  C:\Windows\System\CqSYHhg.exe
  2⤵
  PID:5884
- C:\Windows\System\YQSXjkV.exe
  C:\Windows\System\YQSXjkV.exe
  2⤵
  PID:5920
- C:\Windows\System\YuZvGXf.exe
  C:\Windows\System\YuZvGXf.exe
  2⤵
  PID:5996
- C:\Windows\System\xqhQsvd.exe
  C:\Windows\System\xqhQsvd.exe
  2⤵
  PID:6052
- C:\Windows\System\JGmTBdF.exe
  C:\Windows\System\JGmTBdF.exe
  2⤵
  PID:6108
- C:\Windows\System\MKZAjkE.exe
  C:\Windows\System\MKZAjkE.exe
  2⤵
  PID:2408
- C:\Windows\System\xbhQKxU.exe
  C:\Windows\System\xbhQKxU.exe
  2⤵
  PID:3584
- C:\Windows\System\FwtpBXt.exe
  C:\Windows\System\FwtpBXt.exe
  2⤵
  PID:5148
- C:\Windows\System\LjJWrzl.exe
  C:\Windows\System\LjJWrzl.exe
  2⤵
  PID:5284
- C:\Windows\System\TVXbXQR.exe
  C:\Windows\System\TVXbXQR.exe
  2⤵
  PID:5400
- C:\Windows\System\jumLfqC.exe
  C:\Windows\System\jumLfqC.exe
  2⤵
  PID:3796
- C:\Windows\System\XKYctBy.exe
  C:\Windows\System\XKYctBy.exe
  2⤵
  PID:5600
- C:\Windows\System\iHcqSBE.exe
  C:\Windows\System\iHcqSBE.exe
  2⤵
  PID:5784
- C:\Windows\System\GwHkUVN.exe
  C:\Windows\System\GwHkUVN.exe
  2⤵
  PID:5912
- C:\Windows\System\myEXger.exe
  C:\Windows\System\myEXger.exe
  2⤵
  PID:2800
- C:\Windows\System\LbmSCPA.exe
  C:\Windows\System\LbmSCPA.exe
  2⤵
  PID:6084
- C:\Windows\System\rQimlVI.exe
  C:\Windows\System\rQimlVI.exe
  2⤵
  PID:3852
- C:\Windows\System\hGklLdj.exe
  C:\Windows\System\hGklLdj.exe
  2⤵
  PID:1420
- C:\Windows\System\urrvqWx.exe
  C:\Windows\System\urrvqWx.exe
  2⤵
  PID:5344
- C:\Windows\System\atDJhVr.exe
  C:\Windows\System\atDJhVr.exe
  2⤵
  PID:3096
- C:\Windows\System\AUGuFxc.exe
  C:\Windows\System\AUGuFxc.exe
  2⤵
  PID:5736
- C:\Windows\System\HkNAihX.exe
  C:\Windows\System\HkNAihX.exe
  2⤵
  PID:5968
- C:\Windows\System\FrbALXv.exe
  C:\Windows\System\FrbALXv.exe
  2⤵
  PID:1952
- C:\Windows\System\SyLtjOK.exe
  C:\Windows\System\SyLtjOK.exe
  2⤵
  PID:4224
- C:\Windows\System\MxzYmjO.exe
  C:\Windows\System\MxzYmjO.exe
  2⤵
  PID:4904
- C:\Windows\System\WiOEHXX.exe
  C:\Windows\System\WiOEHXX.exe
  2⤵
  PID:6136
- C:\Windows\System\ETMZDit.exe
  C:\Windows\System\ETMZDit.exe
  2⤵
  PID:4316
- C:\Windows\System\iKfxUBW.exe
  C:\Windows\System\iKfxUBW.exe
  2⤵
  PID:4524
- C:\Windows\System\PNGDBJa.exe
  C:\Windows\System\PNGDBJa.exe
  2⤵
  PID:3344
- C:\Windows\System\WyVNTes.exe
  C:\Windows\System\WyVNTes.exe
  2⤵
  PID:4452
- C:\Windows\System\IeuLoQd.exe
  C:\Windows\System\IeuLoQd.exe
  2⤵
  PID:5708
- C:\Windows\System\bXKSuUC.exe
  C:\Windows\System\bXKSuUC.exe
  2⤵
  PID:6156
- C:\Windows\System\pwazPpw.exe
  C:\Windows\System\pwazPpw.exe
  2⤵
  PID:6200
- C:\Windows\System\LJOVCMn.exe
  C:\Windows\System\LJOVCMn.exe
  2⤵
  PID:6236
- C:\Windows\System\SfymyIF.exe
  C:\Windows\System\SfymyIF.exe
  2⤵
  PID:6256
- C:\Windows\System\RJcgkGc.exe
  C:\Windows\System\RJcgkGc.exe
  2⤵
  PID:6280
- C:\Windows\System\ccLHzWW.exe
  C:\Windows\System\ccLHzWW.exe
  2⤵
  PID:6300
- C:\Windows\System\SJOEvOe.exe
  C:\Windows\System\SJOEvOe.exe
  2⤵
  PID:6324
- C:\Windows\System\YzeCcPn.exe
  C:\Windows\System\YzeCcPn.exe
  2⤵
  PID:6340
- C:\Windows\System\Jqgxzqp.exe
  C:\Windows\System\Jqgxzqp.exe
  2⤵
  PID:6364
- C:\Windows\System\khiVmKX.exe
  C:\Windows\System\khiVmKX.exe
  2⤵
  PID:6380
- C:\Windows\System\anKlNMZ.exe
  C:\Windows\System\anKlNMZ.exe
  2⤵
  PID:6404
- C:\Windows\System\fTptJRc.exe
  C:\Windows\System\fTptJRc.exe
  2⤵
  PID:6424
- C:\Windows\System\IsITLcr.exe
  C:\Windows\System\IsITLcr.exe
  2⤵
  PID:6444
- C:\Windows\System\ABWkpRX.exe
  C:\Windows\System\ABWkpRX.exe
  2⤵
  PID:6464
- C:\Windows\System\LQuAjzH.exe
  C:\Windows\System\LQuAjzH.exe
  2⤵
  PID:6484
- C:\Windows\System\VzFAABg.exe
  C:\Windows\System\VzFAABg.exe
  2⤵
  PID:6508
- C:\Windows\System\dAZfCDo.exe
  C:\Windows\System\dAZfCDo.exe
  2⤵
  PID:6528
- C:\Windows\System\XwlTSNa.exe
  C:\Windows\System\XwlTSNa.exe
  2⤵
  PID:6544
- C:\Windows\System\YYhwply.exe
  C:\Windows\System\YYhwply.exe
  2⤵
  PID:6652
- C:\Windows\System\YEzfjmh.exe
  C:\Windows\System\YEzfjmh.exe
  2⤵
  PID:6668
- C:\Windows\System\gDadprl.exe
  C:\Windows\System\gDadprl.exe
  2⤵
  PID:6688
- C:\Windows\System\dLBurqT.exe
  C:\Windows\System\dLBurqT.exe
  2⤵
  PID:6772
- C:\Windows\System\OEljYpH.exe
  C:\Windows\System\OEljYpH.exe
  2⤵
  PID:6788
- C:\Windows\System\OJXbFYn.exe
  C:\Windows\System\OJXbFYn.exe
  2⤵
  PID:6808
- C:\Windows\System\oChwGtd.exe
  C:\Windows\System\oChwGtd.exe
  2⤵
  PID:6840
- C:\Windows\System\LakjDlY.exe
  C:\Windows\System\LakjDlY.exe
  2⤵
  PID:6860
- C:\Windows\System\OfPJrzt.exe
  C:\Windows\System\OfPJrzt.exe
  2⤵
  PID:6892
- C:\Windows\System\sKlGPfd.exe
  C:\Windows\System\sKlGPfd.exe
  2⤵
  PID:6988
- C:\Windows\System\gESFHhe.exe
  C:\Windows\System\gESFHhe.exe
  2⤵
  PID:7024
- C:\Windows\System\yVeeQTm.exe
  C:\Windows\System\yVeeQTm.exe
  2⤵
  PID:7064
- C:\Windows\System\TBcMsHe.exe
  C:\Windows\System\TBcMsHe.exe
  2⤵
  PID:7080
- C:\Windows\System\rlbyimi.exe
  C:\Windows\System\rlbyimi.exe
  2⤵
  PID:7148
- C:\Windows\System\VfSCgmZ.exe
  C:\Windows\System\VfSCgmZ.exe
  2⤵
  PID:6140
- C:\Windows\System\EOOTEWO.exe
  C:\Windows\System\EOOTEWO.exe
  2⤵
  PID:6272
- C:\Windows\System\gtNZDuD.exe
  C:\Windows\System\gtNZDuD.exe
  2⤵
  PID:6320
- C:\Windows\System\KEevaFQ.exe
  C:\Windows\System\KEevaFQ.exe
  2⤵
  PID:6416
- C:\Windows\System\UeyEFRs.exe
  C:\Windows\System\UeyEFRs.exe
  2⤵
  PID:6500
- C:\Windows\System\DLnGzXm.exe
  C:\Windows\System\DLnGzXm.exe
  2⤵
  PID:6348
- C:\Windows\System\TjODcVC.exe
  C:\Windows\System\TjODcVC.exe
  2⤵
  PID:6376
- C:\Windows\System\AMJAuLu.exe
  C:\Windows\System\AMJAuLu.exe
  2⤵
  PID:6436
- C:\Windows\System\FsISVrV.exe
  C:\Windows\System\FsISVrV.exe
  2⤵
  PID:6480
- C:\Windows\System\QgFPhmv.exe
  C:\Windows\System\QgFPhmv.exe
  2⤵
  PID:6796
- C:\Windows\System\kgmdhwh.exe
  C:\Windows\System\kgmdhwh.exe
  2⤵
  PID:6616
- C:\Windows\System\aIDTEMv.exe
  C:\Windows\System\aIDTEMv.exe
  2⤵
  PID:6636
- C:\Windows\System\BhlAYPJ.exe
  C:\Windows\System\BhlAYPJ.exe
  2⤵
  PID:6888
- C:\Windows\System\gSvIOlA.exe
  C:\Windows\System\gSvIOlA.exe
  2⤵
  PID:6908
- C:\Windows\System\tCgctDG.exe
  C:\Windows\System\tCgctDG.exe
  2⤵
  PID:6756
- C:\Windows\System\CBveKSe.exe
  C:\Windows\System\CBveKSe.exe
  2⤵
  PID:6952
- C:\Windows\System\PBsIkPO.exe
  C:\Windows\System\PBsIkPO.exe
  2⤵
  PID:6972
- C:\Windows\System\AsieAQc.exe
  C:\Windows\System\AsieAQc.exe
  2⤵
  PID:7008
- C:\Windows\System\JsEPyvY.exe
  C:\Windows\System\JsEPyvY.exe
  2⤵
  PID:3992
- C:\Windows\System\zGyDWJv.exe
  C:\Windows\System\zGyDWJv.exe
  2⤵
  PID:6912
- C:\Windows\System\ekmbXzT.exe
  C:\Windows\System\ekmbXzT.exe
  2⤵
  PID:6220
- C:\Windows\System\BwmPRqf.exe
  C:\Windows\System\BwmPRqf.exe
  2⤵
  PID:6224
- C:\Windows\System\duaPBMT.exe
  C:\Windows\System\duaPBMT.exe
  2⤵
  PID:6432
- C:\Windows\System\iamJMrB.exe
  C:\Windows\System\iamJMrB.exe
  2⤵
  PID:6580
- C:\Windows\System\mVKhurN.exe
  C:\Windows\System\mVKhurN.exe
  2⤵
  PID:6660
- C:\Windows\System\jxyzsqM.exe
  C:\Windows\System\jxyzsqM.exe
  2⤵
  PID:6780
- C:\Windows\System\YmizcZs.exe
  C:\Windows\System\YmizcZs.exe
  2⤵
  PID:7000
- C:\Windows\System\mjYJKCg.exe
  C:\Windows\System\mjYJKCg.exe
  2⤵
  PID:6732
- C:\Windows\System\dgJCZCF.exe
  C:\Windows\System\dgJCZCF.exe
  2⤵
  PID:6268
- C:\Windows\System\zJUSyjK.exe
  C:\Windows\System\zJUSyjK.exe
  2⤵
  PID:6836
- C:\Windows\System\VrWOwHk.exe
  C:\Windows\System\VrWOwHk.exe
  2⤵
  PID:7116
- C:\Windows\System\yARNHzS.exe
  C:\Windows\System\yARNHzS.exe
  2⤵
  PID:6316
- C:\Windows\System\yYTLaSR.exe
  C:\Windows\System\yYTLaSR.exe
  2⤵
  PID:6460
- C:\Windows\System\ymCcgaX.exe
  C:\Windows\System\ymCcgaX.exe
  2⤵
  PID:7176
- C:\Windows\System\pwYUdRB.exe
  C:\Windows\System\pwYUdRB.exe
  2⤵
  PID:7200
- C:\Windows\System\oJKjium.exe
  C:\Windows\System\oJKjium.exe
  2⤵
  PID:7216
- C:\Windows\System\kWbjLZO.exe
  C:\Windows\System\kWbjLZO.exe
  2⤵
  PID:7236
- C:\Windows\System\RlsxqYx.exe
  C:\Windows\System\RlsxqYx.exe
  2⤵
  PID:7284
- C:\Windows\System\WWpKCoT.exe
  C:\Windows\System\WWpKCoT.exe
  2⤵
  PID:7300
- C:\Windows\System\tNxSroI.exe
  C:\Windows\System\tNxSroI.exe
  2⤵
  PID:7332
- C:\Windows\System\ujaLfxc.exe
  C:\Windows\System\ujaLfxc.exe
  2⤵
  PID:7352
- C:\Windows\System\PrYVGTX.exe
  C:\Windows\System\PrYVGTX.exe
  2⤵
  PID:7384
- C:\Windows\System\XGaFcZn.exe
  C:\Windows\System\XGaFcZn.exe
  2⤵
  PID:7404
- C:\Windows\System\rCfsMNL.exe
  C:\Windows\System\rCfsMNL.exe
  2⤵
  PID:7428
- C:\Windows\System\ViATZyz.exe
  C:\Windows\System\ViATZyz.exe
  2⤵
  PID:7452
- C:\Windows\System\cSofdwa.exe
  C:\Windows\System\cSofdwa.exe
  2⤵
  PID:7524
- C:\Windows\System\BSjBdRk.exe
  C:\Windows\System\BSjBdRk.exe
  2⤵
  PID:7560
- C:\Windows\System\JpltPll.exe
  C:\Windows\System\JpltPll.exe
  2⤵
  PID:7588
- C:\Windows\System\luDMBvn.exe
  C:\Windows\System\luDMBvn.exe
  2⤵
  PID:7608
- C:\Windows\System\GDEfJje.exe
  C:\Windows\System\GDEfJje.exe
  2⤵
  PID:7648
- C:\Windows\System\LgsqXvS.exe
  C:\Windows\System\LgsqXvS.exe
  2⤵
  PID:7664
- C:\Windows\System\MVNUklI.exe
  C:\Windows\System\MVNUklI.exe
  2⤵
  PID:7704
- C:\Windows\System\hbHPYOT.exe
  C:\Windows\System\hbHPYOT.exe
  2⤵
  PID:7728
- C:\Windows\System\OuqukJo.exe
  C:\Windows\System\OuqukJo.exe
  2⤵
  PID:7748
- C:\Windows\System\ubkpQtr.exe
  C:\Windows\System\ubkpQtr.exe
  2⤵
  PID:7764
- C:\Windows\System\ZVQlcnx.exe
  C:\Windows\System\ZVQlcnx.exe
  2⤵
  PID:7788
- C:\Windows\System\arHJUsb.exe
  C:\Windows\System\arHJUsb.exe
  2⤵
  PID:7808
- C:\Windows\System\HHUtXCk.exe
  C:\Windows\System\HHUtXCk.exe
  2⤵
  PID:7860
- C:\Windows\System\sfkimxn.exe
  C:\Windows\System\sfkimxn.exe
  2⤵
  PID:7880
- C:\Windows\System\HaLNwtO.exe
  C:\Windows\System\HaLNwtO.exe
  2⤵
  PID:7900
- C:\Windows\System\SFYDNiR.exe
  C:\Windows\System\SFYDNiR.exe
  2⤵
  PID:7924
- C:\Windows\System\ZviCMoK.exe
  C:\Windows\System\ZviCMoK.exe
  2⤵
  PID:7964
- C:\Windows\System\JNSHwcH.exe
  C:\Windows\System\JNSHwcH.exe
  2⤵
  PID:8004
- C:\Windows\System\aDXyPKd.exe
  C:\Windows\System\aDXyPKd.exe
  2⤵
  PID:8036
- C:\Windows\System\gUHFtmK.exe
  C:\Windows\System\gUHFtmK.exe
  2⤵
  PID:8060
- C:\Windows\System\wPKtScG.exe
  C:\Windows\System\wPKtScG.exe
  2⤵
  PID:8076
- C:\Windows\System\NKmNRWE.exe
  C:\Windows\System\NKmNRWE.exe
  2⤵
  PID:8104
- C:\Windows\System\bYFmGra.exe
  C:\Windows\System\bYFmGra.exe
  2⤵
  PID:8132
- C:\Windows\System\YnGmDGR.exe
  C:\Windows\System\YnGmDGR.exe
  2⤵
  PID:8152
- C:\Windows\System\UvVeYOK.exe
  C:\Windows\System\UvVeYOK.exe
  2⤵
  PID:8176
- C:\Windows\System\IiPgRNK.exe
  C:\Windows\System\IiPgRNK.exe
  2⤵
  PID:6708
- C:\Windows\System\TorkIWi.exe
  C:\Windows\System\TorkIWi.exe
  2⤵
  PID:7192
- C:\Windows\System\BuAoIJU.exe
  C:\Windows\System\BuAoIJU.exe
  2⤵
  PID:7296
- C:\Windows\System\QnRGHZN.exe
  C:\Windows\System\QnRGHZN.exe
  2⤵
  PID:7380
- C:\Windows\System\GfWUpaR.exe
  C:\Windows\System\GfWUpaR.exe
  2⤵
  PID:7348
- C:\Windows\System\OEnpVOw.exe
  C:\Windows\System\OEnpVOw.exe
  2⤵
  PID:7472
- C:\Windows\System\WftZPVl.exe
  C:\Windows\System\WftZPVl.exe
  2⤵
  PID:7556
- C:\Windows\System\Tcwjdfa.exe
  C:\Windows\System\Tcwjdfa.exe
  2⤵
  PID:7604
- C:\Windows\System\xiQOeFV.exe
  C:\Windows\System\xiQOeFV.exe
  2⤵
  PID:7760
- C:\Windows\System\CnouKDx.exe
  C:\Windows\System\CnouKDx.exe
  2⤵
  PID:7844
- C:\Windows\System\fTXDpAL.exe
  C:\Windows\System\fTXDpAL.exe
  2⤵
  PID:7920
- C:\Windows\System\upsfKSt.exe
  C:\Windows\System\upsfKSt.exe
  2⤵
  PID:4956
- C:\Windows\System\WZNFDHs.exe
  C:\Windows\System\WZNFDHs.exe
  2⤵
  PID:8000
- C:\Windows\System\uigBLMy.exe
  C:\Windows\System\uigBLMy.exe
  2⤵
  PID:8084
- C:\Windows\System\AlYEZwT.exe
  C:\Windows\System\AlYEZwT.exe
  2⤵
  PID:8144
- C:\Windows\System\JTwZjFd.exe
  C:\Windows\System\JTwZjFd.exe
  2⤵
  PID:8120
- C:\Windows\System\yuqhfSB.exe
  C:\Windows\System\yuqhfSB.exe
  2⤵
  PID:7252
- C:\Windows\System\roWPupa.exe
  C:\Windows\System\roWPupa.exe
  2⤵
  PID:7320
- C:\Windows\System\CnKigRj.exe
  C:\Windows\System\CnKigRj.exe
  2⤵
  PID:7540
- C:\Windows\System\wXHtyxv.exe
  C:\Windows\System\wXHtyxv.exe
  2⤵
  PID:7700
- C:\Windows\System\CGTycoL.exe
  C:\Windows\System\CGTycoL.exe
  2⤵
  PID:7872
- C:\Windows\System\egoHuyT.exe
  C:\Windows\System\egoHuyT.exe
  2⤵
  PID:7888
- C:\Windows\System\uUiFTLE.exe
  C:\Windows\System\uUiFTLE.exe
  2⤵
  PID:8112
- C:\Windows\System\kJrGNbl.exe
  C:\Windows\System\kJrGNbl.exe
  2⤵
  PID:7420
- C:\Windows\System\KSnqMMi.exe
  C:\Windows\System\KSnqMMi.exe
  2⤵
  PID:7684
- C:\Windows\System\xFFTdYT.exe
  C:\Windows\System\xFFTdYT.exe
  2⤵
  PID:7292
- C:\Windows\System\NZJgEvY.exe
  C:\Windows\System\NZJgEvY.exe
  2⤵
  PID:8204
- C:\Windows\System\VSeDJrX.exe
  C:\Windows\System\VSeDJrX.exe
  2⤵
  PID:8244
- C:\Windows\System\ofYYLTm.exe
  C:\Windows\System\ofYYLTm.exe
  2⤵
  PID:8260
- C:\Windows\System\vbmbGsZ.exe
  C:\Windows\System\vbmbGsZ.exe
  2⤵
  PID:8288
- C:\Windows\System\eYpkfkh.exe
  C:\Windows\System\eYpkfkh.exe
  2⤵
  PID:8336
- C:\Windows\System\DVrHcNP.exe
  C:\Windows\System\DVrHcNP.exe
  2⤵
  PID:8360
- C:\Windows\System\kSjWhTN.exe
  C:\Windows\System\kSjWhTN.exe
  2⤵
  PID:8380
- C:\Windows\System\eYGjwuU.exe
  C:\Windows\System\eYGjwuU.exe
  2⤵
  PID:8400
- C:\Windows\System\QnspxeD.exe
  C:\Windows\System\QnspxeD.exe
  2⤵
  PID:8432
- C:\Windows\System\jjZbaUI.exe
  C:\Windows\System\jjZbaUI.exe
  2⤵
  PID:8452
- C:\Windows\System\ssOqNrd.exe
  C:\Windows\System\ssOqNrd.exe
  2⤵
  PID:8472
- C:\Windows\System\EDhtgZu.exe
  C:\Windows\System\EDhtgZu.exe
  2⤵
  PID:8504
- C:\Windows\System\gzgmQTj.exe
  C:\Windows\System\gzgmQTj.exe
  2⤵
  PID:8540
- C:\Windows\System\lqomfhA.exe
  C:\Windows\System\lqomfhA.exe
  2⤵
  PID:8576
- C:\Windows\System\VVWkyvb.exe
  C:\Windows\System\VVWkyvb.exe
  2⤵
  PID:8604
- C:\Windows\System\hnuLIIy.exe
  C:\Windows\System\hnuLIIy.exe
  2⤵
  PID:8620
- C:\Windows\System\lEyNXFS.exe
  C:\Windows\System\lEyNXFS.exe
  2⤵
  PID:8636
- C:\Windows\System\wvaCbxU.exe
  C:\Windows\System\wvaCbxU.exe
  2⤵
  PID:8656
- C:\Windows\System\BuEBDaa.exe
  C:\Windows\System\BuEBDaa.exe
  2⤵
  PID:8716
- C:\Windows\System\aIrvpYz.exe
  C:\Windows\System\aIrvpYz.exe
  2⤵
  PID:8736
- C:\Windows\System\ERKXIxf.exe
  C:\Windows\System\ERKXIxf.exe
  2⤵
  PID:8760
- C:\Windows\System\TKQOHJA.exe
  C:\Windows\System\TKQOHJA.exe
  2⤵
  PID:8776
- C:\Windows\System\ncOOtFX.exe
  C:\Windows\System\ncOOtFX.exe
  2⤵
  PID:8828
- C:\Windows\System\QKjXOMS.exe
  C:\Windows\System\QKjXOMS.exe
  2⤵
  PID:8856
- C:\Windows\System\cfSStVh.exe
  C:\Windows\System\cfSStVh.exe
  2⤵
  PID:8876
- C:\Windows\System\pmXiDPB.exe
  C:\Windows\System\pmXiDPB.exe
  2⤵
  PID:8904
- C:\Windows\System\WfdHDNY.exe
  C:\Windows\System\WfdHDNY.exe
  2⤵
  PID:8928
- C:\Windows\System\QAxPmPc.exe
  C:\Windows\System\QAxPmPc.exe
  2⤵
  PID:8948
- C:\Windows\System\qoQYsmd.exe
  C:\Windows\System\qoQYsmd.exe
  2⤵
  PID:8980
- C:\Windows\System\bVgzeTh.exe
  C:\Windows\System\bVgzeTh.exe
  2⤵
  PID:9020
- C:\Windows\System\ViKkVdl.exe
  C:\Windows\System\ViKkVdl.exe
  2⤵
  PID:9048
- C:\Windows\System\tUDeRkX.exe
  C:\Windows\System\tUDeRkX.exe
  2⤵
  PID:9076
- C:\Windows\System\AwxwQrL.exe
  C:\Windows\System\AwxwQrL.exe
  2⤵
  PID:9096
- C:\Windows\System\yexuHhO.exe
  C:\Windows\System\yexuHhO.exe
  2⤵
  PID:9128
- C:\Windows\System\ZXxxiLR.exe
  C:\Windows\System\ZXxxiLR.exe
  2⤵
  PID:9168
- C:\Windows\System\pGEDWZF.exe
  C:\Windows\System\pGEDWZF.exe
  2⤵
  PID:9188
- C:\Windows\System\mWiXFbK.exe
  C:\Windows\System\mWiXFbK.exe
  2⤵
  PID:7780
- C:\Windows\System\inAWzsO.exe
  C:\Windows\System\inAWzsO.exe
  2⤵
  PID:8256
- C:\Windows\System\XOGUOBS.exe
  C:\Windows\System\XOGUOBS.exe
  2⤵
  PID:8304
- C:\Windows\System\iguNQAm.exe
  C:\Windows\System\iguNQAm.exe
  2⤵
  PID:8412
- C:\Windows\System\tFazlwi.exe
  C:\Windows\System\tFazlwi.exe
  2⤵
  PID:8428
- C:\Windows\System\izPsGYB.exe
  C:\Windows\System\izPsGYB.exe
  2⤵
  PID:8468
- C:\Windows\System\fWLMgdn.exe
  C:\Windows\System\fWLMgdn.exe
  2⤵
  PID:8568
- C:\Windows\System\liWSvIy.exe
  C:\Windows\System\liWSvIy.exe
  2⤵
  PID:8616
- C:\Windows\System\QKFSmmW.exe
  C:\Windows\System\QKFSmmW.exe
  2⤵
  PID:8744
- C:\Windows\System\NKezOCc.exe
  C:\Windows\System\NKezOCc.exe
  2⤵
  PID:8732
- C:\Windows\System\IMonArs.exe
  C:\Windows\System\IMonArs.exe
  2⤵
  PID:8804
- C:\Windows\System\OBmekPv.exe
  C:\Windows\System\OBmekPv.exe
  2⤵
  PID:8868
- C:\Windows\System\jIiKHnH.exe
  C:\Windows\System\jIiKHnH.exe
  2⤵
  PID:8968
- C:\Windows\System\bcmMRYH.exe
  C:\Windows\System\bcmMRYH.exe
  2⤵
  PID:9028
- C:\Windows\System\mdoACNA.exe
  C:\Windows\System\mdoACNA.exe
  2⤵
  PID:9064
- C:\Windows\System\XUWGkyv.exe
  C:\Windows\System\XUWGkyv.exe
  2⤵
  PID:9136
- C:\Windows\System\sXNrvBh.exe
  C:\Windows\System\sXNrvBh.exe
  2⤵
  PID:9184
- C:\Windows\System\OeGUUOX.exe
  C:\Windows\System\OeGUUOX.exe
  2⤵
  PID:8196
- C:\Windows\System\RkyKukg.exe
  C:\Windows\System\RkyKukg.exe
  2⤵
  PID:8368
- C:\Windows\System\QuLhzJv.exe
  C:\Windows\System\QuLhzJv.exe
  2⤵
  PID:8496
- C:\Windows\System\OmwczYI.exe
  C:\Windows\System\OmwczYI.exe
  2⤵
  PID:8652
- C:\Windows\System\THDFwcP.exe
  C:\Windows\System\THDFwcP.exe
  2⤵
  PID:8956
- C:\Windows\System\VpmNqYp.exe
  C:\Windows\System\VpmNqYp.exe
  2⤵
  PID:9108
- C:\Windows\System\wzythmY.exe
  C:\Windows\System\wzythmY.exe
  2⤵
  PID:9212
- C:\Windows\System\VZirerI.exe
  C:\Windows\System\VZirerI.exe
  2⤵
  PID:8356
- C:\Windows\System\EJXDzlc.exe
  C:\Windows\System\EJXDzlc.exe
  2⤵
  PID:8912
- C:\Windows\System\OmHMZBl.exe
  C:\Windows\System\OmHMZBl.exe
  2⤵
  PID:8224
- C:\Windows\System\QiWtIXe.exe
  C:\Windows\System\QiWtIXe.exe
  2⤵
  PID:8768
- C:\Windows\System\waEZkVm.exe
  C:\Windows\System\waEZkVm.exe
  2⤵
  PID:9224
- C:\Windows\System\Woghfsk.exe
  C:\Windows\System\Woghfsk.exe
  2⤵
  PID:9268
- C:\Windows\System\WKpUSTC.exe
  C:\Windows\System\WKpUSTC.exe
  2⤵
  PID:9284
- C:\Windows\System\FIAZiph.exe
  C:\Windows\System\FIAZiph.exe
  2⤵
  PID:9308
- C:\Windows\System\RQdJrXB.exe
  C:\Windows\System\RQdJrXB.exe
  2⤵
  PID:9324
- C:\Windows\System\NluZcPw.exe
  C:\Windows\System\NluZcPw.exe
  2⤵
  PID:9344
- C:\Windows\System\VDgNEMo.exe
  C:\Windows\System\VDgNEMo.exe
  2⤵
  PID:9360
- C:\Windows\System\PiHsHWY.exe
  C:\Windows\System\PiHsHWY.exe
  2⤵
  PID:9376
- C:\Windows\System\jDMoJAt.exe
  C:\Windows\System\jDMoJAt.exe
  2⤵
  PID:9404
- C:\Windows\System\eMNweFy.exe
  C:\Windows\System\eMNweFy.exe
  2⤵
  PID:9440
- C:\Windows\System\qHkspPx.exe
  C:\Windows\System\qHkspPx.exe
  2⤵
  PID:9492
- C:\Windows\System\EJtODMY.exe
  C:\Windows\System\EJtODMY.exe
  2⤵
  PID:9524
- C:\Windows\System\ONDAwwd.exe
  C:\Windows\System\ONDAwwd.exe
  2⤵
  PID:9544
- C:\Windows\System\NRwqOLR.exe
  C:\Windows\System\NRwqOLR.exe
  2⤵
  PID:9572
- C:\Windows\System\XVVTwdP.exe
  C:\Windows\System\XVVTwdP.exe
  2⤵
  PID:9636
- C:\Windows\System\hFcKosF.exe
  C:\Windows\System\hFcKosF.exe
  2⤵
  PID:9664
- C:\Windows\System\ulnmidf.exe
  C:\Windows\System\ulnmidf.exe
  2⤵
  PID:9688
- C:\Windows\System\gpzciLy.exe
  C:\Windows\System\gpzciLy.exe
  2⤵
  PID:9716
- C:\Windows\System\IJdgpud.exe
  C:\Windows\System\IJdgpud.exe
  2⤵
  PID:9744
- C:\Windows\System\nFYlKWY.exe
  C:\Windows\System\nFYlKWY.exe
  2⤵
  PID:9788
- C:\Windows\System\dYhiwwH.exe
  C:\Windows\System\dYhiwwH.exe
  2⤵
  PID:9812
- C:\Windows\System\cJHCUeu.exe
  C:\Windows\System\cJHCUeu.exe
  2⤵
  PID:9832
- C:\Windows\System\HKPCapM.exe
  C:\Windows\System\HKPCapM.exe
  2⤵
  PID:9872
- C:\Windows\System\jKuBhqC.exe
  C:\Windows\System\jKuBhqC.exe
  2⤵
  PID:9896
- C:\Windows\System\ybmMTvd.exe
  C:\Windows\System\ybmMTvd.exe
  2⤵
  PID:9916
- C:\Windows\System\yTsOEAf.exe
  C:\Windows\System\yTsOEAf.exe
  2⤵
  PID:10016
- C:\Windows\System\JikpiSw.exe
  C:\Windows\System\JikpiSw.exe
  2⤵
  PID:10040
- C:\Windows\System\UUpYPAj.exe
  C:\Windows\System\UUpYPAj.exe
  2⤵
  PID:10060
- C:\Windows\System\UMMLmOq.exe
  C:\Windows\System\UMMLmOq.exe
  2⤵
  PID:10076
- C:\Windows\System\SOrYSEz.exe
  C:\Windows\System\SOrYSEz.exe
  2⤵
  PID:10100
- C:\Windows\System\sxugphE.exe
  C:\Windows\System\sxugphE.exe
  2⤵
  PID:10168
- C:\Windows\System\IIBfurE.exe
  C:\Windows\System\IIBfurE.exe
  2⤵
  PID:10192
- C:\Windows\System\DJhTFCW.exe
  C:\Windows\System\DJhTFCW.exe
  2⤵
  PID:10216
- C:\Windows\System\ivvZFBQ.exe
  C:\Windows\System\ivvZFBQ.exe
  2⤵
  PID:10236
- C:\Windows\System\KnwRIaY.exe
  C:\Windows\System\KnwRIaY.exe
  2⤵
  PID:9196
- C:\Windows\System\WJyHaWp.exe
  C:\Windows\System\WJyHaWp.exe
  2⤵
  PID:9396
- C:\Windows\System\PrQWHUt.exe
  C:\Windows\System\PrQWHUt.exe
  2⤵
  PID:9332
- C:\Windows\System\YDVbDrg.exe
  C:\Windows\System\YDVbDrg.exe
  2⤵
  PID:9432
- C:\Windows\System\tcdDLtE.exe
  C:\Windows\System\tcdDLtE.exe
  2⤵
  PID:9508
- C:\Windows\System\hQqjyvp.exe
  C:\Windows\System\hQqjyvp.exe
  2⤵
  PID:9564
- C:\Windows\System\NvwStNk.exe
  C:\Windows\System\NvwStNk.exe
  2⤵
  PID:9624
- C:\Windows\System\dxJssqV.exe
  C:\Windows\System\dxJssqV.exe
  2⤵
  PID:9680
- C:\Windows\System\gANzQGN.exe
  C:\Windows\System\gANzQGN.exe
  2⤵
  PID:9732
- C:\Windows\System\iNAhoVm.exe
  C:\Windows\System\iNAhoVm.exe
  2⤵
  PID:9804
- C:\Windows\System\xvnZlrA.exe
  C:\Windows\System\xvnZlrA.exe
  2⤵
  PID:9860
- C:\Windows\System\EcZflTp.exe
  C:\Windows\System\EcZflTp.exe
  2⤵
  PID:9908
- C:\Windows\System\tICPiEl.exe
  C:\Windows\System\tICPiEl.exe
  2⤵
  PID:10048
- C:\Windows\System\WPMXwzQ.exe
  C:\Windows\System\WPMXwzQ.exe
  2⤵
  PID:9976
- C:\Windows\System\AGveMDW.exe
  C:\Windows\System\AGveMDW.exe
  2⤵
  PID:9944
- C:\Windows\System\WdHGjhS.exe
  C:\Windows\System\WdHGjhS.exe
  2⤵
  PID:10136
- C:\Windows\System\jGnwrdi.exe
  C:\Windows\System\jGnwrdi.exe
  2⤵
  PID:10176
- C:\Windows\System\ecXWiEk.exe
  C:\Windows\System\ecXWiEk.exe
  2⤵
  PID:9276
- C:\Windows\System\WsleVaU.exe
  C:\Windows\System\WsleVaU.exe
  2⤵
  PID:9356
- C:\Windows\System\DtWXKVz.exe
  C:\Windows\System\DtWXKVz.exe
  2⤵
  PID:9560
- C:\Windows\System\eTUhltU.exe
  C:\Windows\System\eTUhltU.exe
  2⤵
  PID:9712
- C:\Windows\System\ykpUeGq.exe
  C:\Windows\System\ykpUeGq.exe
  2⤵
  PID:9948
- C:\Windows\System\KYnmJaE.exe
  C:\Windows\System\KYnmJaE.exe
  2⤵
  PID:9996
- C:\Windows\System\ZozIDmE.exe
  C:\Windows\System\ZozIDmE.exe
  2⤵
  PID:9972
- C:\Windows\System\nwFhSLT.exe
  C:\Windows\System\nwFhSLT.exe
  2⤵
  PID:10184
- C:\Windows\System\YMEBIBK.exe
  C:\Windows\System\YMEBIBK.exe
  2⤵
  PID:8924
- C:\Windows\System\WYiUYSF.exe
  C:\Windows\System\WYiUYSF.exe
  2⤵
  PID:9504
- C:\Windows\System\dJIUWUJ.exe
  C:\Windows\System\dJIUWUJ.exe
  2⤵
  PID:9964
- C:\Windows\System\jYSOOxB.exe
  C:\Windows\System\jYSOOxB.exe
  2⤵
  PID:10068
- C:\Windows\System\PTEYWHV.exe
  C:\Windows\System\PTEYWHV.exe
  2⤵
  PID:9500
- C:\Windows\System\cygnWBj.exe
  C:\Windows\System\cygnWBj.exe
  2⤵
  PID:9416
- C:\Windows\System\abmaBAP.exe
  C:\Windows\System\abmaBAP.exe
  2⤵
  PID:10256
- C:\Windows\System\ZQKZMxV.exe
  C:\Windows\System\ZQKZMxV.exe
  2⤵
  PID:10280
- C:\Windows\System\JiaDCup.exe
  C:\Windows\System\JiaDCup.exe
  2⤵
  PID:10300
- C:\Windows\System\PWNfPVz.exe
  C:\Windows\System\PWNfPVz.exe
  2⤵
  PID:10348
- C:\Windows\System\fBTIazg.exe
  C:\Windows\System\fBTIazg.exe
  2⤵
  PID:10384
- C:\Windows\System\kyBLrCx.exe
  C:\Windows\System\kyBLrCx.exe
  2⤵
  PID:10416
- C:\Windows\System\IcpeMEW.exe
  C:\Windows\System\IcpeMEW.exe
  2⤵
  PID:10444
- C:\Windows\System\hblTcIG.exe
  C:\Windows\System\hblTcIG.exe
  2⤵
  PID:10460
- C:\Windows\System\ficMTFG.exe
  C:\Windows\System\ficMTFG.exe
  2⤵
  PID:10484
- C:\Windows\System\jNbuStQ.exe
  C:\Windows\System\jNbuStQ.exe
  2⤵
  PID:10500
- C:\Windows\System\uBZUCvu.exe
  C:\Windows\System\uBZUCvu.exe
  2⤵
  PID:10548
- C:\Windows\System\SoVpfFc.exe
  C:\Windows\System\SoVpfFc.exe
  2⤵
  PID:10564
- C:\Windows\System\OJObYDS.exe
  C:\Windows\System\OJObYDS.exe
  2⤵
  PID:10588
- C:\Windows\System\HjzHSqI.exe
  C:\Windows\System\HjzHSqI.exe
  2⤵
  PID:10620
- C:\Windows\System\JyTZldI.exe
  C:\Windows\System\JyTZldI.exe
  2⤵
  PID:10636
- C:\Windows\System\SeQhwGk.exe
  C:\Windows\System\SeQhwGk.exe
  2⤵
  PID:10688
- C:\Windows\System\mpcwdQy.exe
  C:\Windows\System\mpcwdQy.exe
  2⤵
  PID:10716
- C:\Windows\System\zPrcpYD.exe
  C:\Windows\System\zPrcpYD.exe
  2⤵
  PID:10740
- C:\Windows\System\hQVODEK.exe
  C:\Windows\System\hQVODEK.exe
  2⤵
  PID:10756
- C:\Windows\System\MFOzMOF.exe
  C:\Windows\System\MFOzMOF.exe
  2⤵
  PID:10780
- C:\Windows\System\JTHAUhY.exe
  C:\Windows\System\JTHAUhY.exe
  2⤵
  PID:10812
- C:\Windows\System\hfPRTZz.exe
  C:\Windows\System\hfPRTZz.exe
  2⤵
  PID:10832
- C:\Windows\System\jtfpnKh.exe
  C:\Windows\System\jtfpnKh.exe
  2⤵
  PID:10868
- C:\Windows\System\pDHPccN.exe
  C:\Windows\System\pDHPccN.exe
  2⤵
  PID:10940
- C:\Windows\System\QpyMcoj.exe
  C:\Windows\System\QpyMcoj.exe
  2⤵
  PID:10960
- C:\Windows\System\TRYjTlz.exe
  C:\Windows\System\TRYjTlz.exe
  2⤵
  PID:10984
- C:\Windows\System\tSIXhVY.exe
  C:\Windows\System\tSIXhVY.exe
  2⤵
  PID:11004
- C:\Windows\System\kCHCkZc.exe
  C:\Windows\System\kCHCkZc.exe
  2⤵
  PID:11024
- C:\Windows\System\ZcvlxGE.exe
  C:\Windows\System\ZcvlxGE.exe
  2⤵
  PID:11052
- C:\Windows\System\BKQmyZR.exe
  C:\Windows\System\BKQmyZR.exe
  2⤵
  PID:11092
- C:\Windows\System\DpDxhkh.exe
  C:\Windows\System\DpDxhkh.exe
  2⤵
  PID:11120
- C:\Windows\System\qdeQcjt.exe
  C:\Windows\System\qdeQcjt.exe
  2⤵
  PID:11140
- C:\Windows\System\NFoTXBT.exe
  C:\Windows\System\NFoTXBT.exe
  2⤵
  PID:11184
- C:\Windows\System\LvsXJrD.exe
  C:\Windows\System\LvsXJrD.exe
  2⤵
  PID:11200
- C:\Windows\System\tWbRfKG.exe
  C:\Windows\System\tWbRfKG.exe
  2⤵
  PID:11220
- C:\Windows\System\GRVMJoB.exe
  C:\Windows\System\GRVMJoB.exe
  2⤵
  PID:11260
- C:\Windows\System\WXmZODu.exe
  C:\Windows\System\WXmZODu.exe
  2⤵
  PID:10288
- C:\Windows\System\FkLUwID.exe
  C:\Windows\System\FkLUwID.exe
  2⤵
  PID:10324
- C:\Windows\System\lsjSKLf.exe
  C:\Windows\System\lsjSKLf.exe
  2⤵
  PID:10400
- C:\Windows\System\FsshagF.exe
  C:\Windows\System\FsshagF.exe
  2⤵
  PID:10480
- C:\Windows\System\noyrrEr.exe
  C:\Windows\System\noyrrEr.exe
  2⤵
  PID:10572
- C:\Windows\System\KBwIPYe.exe
  C:\Windows\System\KBwIPYe.exe
  2⤵
  PID:10556
- C:\Windows\System\sWBjOOj.exe
  C:\Windows\System\sWBjOOj.exe
  2⤵
  PID:10696
- C:\Windows\System\EBxndvf.exe
  C:\Windows\System\EBxndvf.exe
  2⤵
  PID:10712
- C:\Windows\System\nxJwhCc.exe
  C:\Windows\System\nxJwhCc.exe
  2⤵
  PID:10804
- C:\Windows\System\cRLRchm.exe
  C:\Windows\System\cRLRchm.exe
  2⤵
  PID:10852
- C:\Windows\System\iEkVeOw.exe
  C:\Windows\System\iEkVeOw.exe
  2⤵
  PID:10892
- C:\Windows\System\ASpmLVY.exe
  C:\Windows\System\ASpmLVY.exe
  2⤵
  PID:10976
- C:\Windows\System\PADoGOC.exe
  C:\Windows\System\PADoGOC.exe
  2⤵
  PID:11020
- C:\Windows\System\YOoBahk.exe
  C:\Windows\System\YOoBahk.exe
  2⤵
  PID:11040
- C:\Windows\System\ftvoTqD.exe
  C:\Windows\System\ftvoTqD.exe
  2⤵
  PID:11132
- C:\Windows\System\GFIiDGt.exe
  C:\Windows\System\GFIiDGt.exe
  2⤵
  PID:4748
- C:\Windows\System\szyKKJK.exe
  C:\Windows\System\szyKKJK.exe
  2⤵
  PID:11256
- C:\Windows\System\lMuncbV.exe
  C:\Windows\System\lMuncbV.exe
  2⤵
  PID:10248
- C:\Windows\System\TFkrSBt.exe
  C:\Windows\System\TFkrSBt.exe
  2⤵
  PID:10436
- C:\Windows\System\mBzBxFo.exe
  C:\Windows\System\mBzBxFo.exe
  2⤵
  PID:10616
- C:\Windows\System\QjhyBwq.exe
  C:\Windows\System\QjhyBwq.exe
  2⤵
  PID:10732
- C:\Windows\System\aPKOsvs.exe
  C:\Windows\System\aPKOsvs.exe
  2⤵
  PID:10908
- C:\Windows\System\XytwMUZ.exe
  C:\Windows\System\XytwMUZ.exe
  2⤵
  PID:10956
- C:\Windows\System\CRckiqY.exe
  C:\Windows\System\CRckiqY.exe
  2⤵
  PID:844
- C:\Windows\System\SArOLJi.exe
  C:\Windows\System\SArOLJi.exe
  2⤵
  PID:11168
- C:\Windows\System\fLsSzNF.exe
  C:\Windows\System\fLsSzNF.exe
  2⤵
  PID:10252
- C:\Windows\System\mzDAyFn.exe
  C:\Windows\System\mzDAyFn.exe
  2⤵
  PID:10584
- C:\Windows\System\bdCKHjv.exe
  C:\Windows\System\bdCKHjv.exe
  2⤵
  PID:10880
- C:\Windows\System\fcPZLAq.exe
  C:\Windows\System\fcPZLAq.exe
  2⤵
  PID:10996
- C:\Windows\System\geFXnsT.exe
  C:\Windows\System\geFXnsT.exe
  2⤵
  PID:11276
- C:\Windows\System\LRGODnD.exe
  C:\Windows\System\LRGODnD.exe
  2⤵
  PID:11304
- C:\Windows\System\nhAZDbp.exe
  C:\Windows\System\nhAZDbp.exe
  2⤵
  PID:11324
- C:\Windows\System\hslsaYT.exe
  C:\Windows\System\hslsaYT.exe
  2⤵
  PID:11352
- C:\Windows\System\oykkOTq.exe
  C:\Windows\System\oykkOTq.exe
  2⤵
  PID:11380
- C:\Windows\System\ilVVgPw.exe
  C:\Windows\System\ilVVgPw.exe
  2⤵
  PID:11404
- C:\Windows\System\LHnbMJH.exe
  C:\Windows\System\LHnbMJH.exe
  2⤵
  PID:11420
- C:\Windows\System\GbfCLAi.exe
  C:\Windows\System\GbfCLAi.exe
  2⤵
  PID:11448
- C:\Windows\System\NyOlCAX.exe
  C:\Windows\System\NyOlCAX.exe
  2⤵
  PID:11468
- C:\Windows\System\GnEOyup.exe
  C:\Windows\System\GnEOyup.exe
  2⤵
  PID:11488
- C:\Windows\System\LlKQiBP.exe
  C:\Windows\System\LlKQiBP.exe
  2⤵
  PID:11524
- C:\Windows\System\bstocAF.exe
  C:\Windows\System\bstocAF.exe
  2⤵
  PID:11548
- C:\Windows\System\NvEzEHr.exe
  C:\Windows\System\NvEzEHr.exe
  2⤵
  PID:11604
- C:\Windows\System\dzMxodF.exe
  C:\Windows\System\dzMxodF.exe
  2⤵
  PID:11624
- C:\Windows\System\nrPTolQ.exe
  C:\Windows\System\nrPTolQ.exe
  2⤵
  PID:11648
- C:\Windows\System\miHbQZH.exe
  C:\Windows\System\miHbQZH.exe
  2⤵
  PID:11692
- C:\Windows\System\mtiZvEI.exe
  C:\Windows\System\mtiZvEI.exe
  2⤵
  PID:11712
- C:\Windows\System\xkIyltW.exe
  C:\Windows\System\xkIyltW.exe
  2⤵
  PID:11736
- C:\Windows\System\JcrXggI.exe
  C:\Windows\System\JcrXggI.exe
  2⤵
  PID:11792
- C:\Windows\System\yZoelCF.exe
  C:\Windows\System\yZoelCF.exe
  2⤵
  PID:11816
- C:\Windows\System\SsaiULC.exe
  C:\Windows\System\SsaiULC.exe
  2⤵
  PID:11836
- C:\Windows\System\qRZkXQz.exe
  C:\Windows\System\qRZkXQz.exe
  2⤵
  PID:11860
- C:\Windows\System\zCpyXxk.exe
  C:\Windows\System\zCpyXxk.exe
  2⤵
  PID:11880
- C:\Windows\System\pAulRvE.exe
  C:\Windows\System\pAulRvE.exe
  2⤵
  PID:11916
- C:\Windows\System\CXRummV.exe
  C:\Windows\System\CXRummV.exe
  2⤵
  PID:11936
- C:\Windows\System\lNnReax.exe
  C:\Windows\System\lNnReax.exe
  2⤵
  PID:11988
- C:\Windows\System\CBFSvYL.exe
  C:\Windows\System\CBFSvYL.exe
  2⤵
  PID:12008
- C:\Windows\System\AQoolaU.exe
  C:\Windows\System\AQoolaU.exe
  2⤵
  PID:12028
- C:\Windows\System\jAyczBC.exe
  C:\Windows\System\jAyczBC.exe
  2⤵
  PID:12052
- C:\Windows\System\WFfLWfg.exe
  C:\Windows\System\WFfLWfg.exe
  2⤵
  PID:12088
- C:\Windows\System\OAkleNK.exe
  C:\Windows\System\OAkleNK.exe
  2⤵
  PID:12108
- C:\Windows\System\BIpTRBr.exe
  C:\Windows\System\BIpTRBr.exe
  2⤵
  PID:12168
- C:\Windows\System\EriRjRx.exe
  C:\Windows\System\EriRjRx.exe
  2⤵
  PID:12196
- C:\Windows\System\GkrOjvd.exe
  C:\Windows\System\GkrOjvd.exe
  2⤵
  PID:12216
- C:\Windows\System\CdSFvMO.exe
  C:\Windows\System\CdSFvMO.exe
  2⤵
  PID:12244
- C:\Windows\System\siUnjeX.exe
  C:\Windows\System\siUnjeX.exe
  2⤵
  PID:10520
- C:\Windows\System\mtUrNzT.exe
  C:\Windows\System\mtUrNzT.exe
  2⤵
  PID:11032
- C:\Windows\System\kHdFNpY.exe
  C:\Windows\System\kHdFNpY.exe
  2⤵
  PID:1684
- C:\Windows\System\SGYyZME.exe
  C:\Windows\System\SGYyZME.exe
  2⤵
  PID:11360
- C:\Windows\System\YuqpBKu.exe
  C:\Windows\System\YuqpBKu.exe
  2⤵
  PID:11476
- C:\Windows\System\YbNNQNu.exe
  C:\Windows\System\YbNNQNu.exe
  2⤵
  PID:11412
- C:\Windows\System\SkRwbjV.exe
  C:\Windows\System\SkRwbjV.exe
  2⤵
  PID:11512
- C:\Windows\System\ddZLovI.exe
  C:\Windows\System\ddZLovI.exe
  2⤵
  PID:11568
- C:\Windows\System\uVXOVqb.exe
  C:\Windows\System\uVXOVqb.exe
  2⤵
  PID:11704
- C:\Windows\System\GTkySyl.exe
  C:\Windows\System\GTkySyl.exe
  2⤵
  PID:11808
- C:\Windows\System\edhvjqL.exe
  C:\Windows\System\edhvjqL.exe
  2⤵
  PID:11824
- C:\Windows\System\ZPYkQtW.exe
  C:\Windows\System\ZPYkQtW.exe
  2⤵
  PID:2592
- C:\Windows\System\uESQxHD.exe
  C:\Windows\System\uESQxHD.exe
  2⤵
  PID:11876
- C:\Windows\System\JhiyXoA.exe
  C:\Windows\System\JhiyXoA.exe
  2⤵
  PID:11980
- C:\Windows\System\LIhEUTP.exe
  C:\Windows\System\LIhEUTP.exe
  2⤵
  PID:12048
- C:\Windows\System\JRPCRZu.exe
  C:\Windows\System\JRPCRZu.exe
  2⤵
  PID:12144
- C:\Windows\System\xtkvByV.exe
  C:\Windows\System\xtkvByV.exe
  2⤵
  PID:12212
- C:\Windows\System\TXmXwPP.exe
  C:\Windows\System\TXmXwPP.exe
  2⤵
  PID:12256
- C:\Windows\System\IGVARuP.exe
  C:\Windows\System\IGVARuP.exe
  2⤵
  PID:12284
- C:\Windows\System\zegNbtK.exe
  C:\Windows\System\zegNbtK.exe
  2⤵
  PID:3792
- C:\Windows\System\CkPeIJt.exe
  C:\Windows\System\CkPeIJt.exe
  2⤵
  PID:11344
- C:\Windows\System\UFvTtos.exe
  C:\Windows\System\UFvTtos.exe
  2⤵
  PID:11708
- C:\Windows\System\PSxxsil.exe
  C:\Windows\System\PSxxsil.exe
  2⤵
  PID:11800
- C:\Windows\System\PPdCBZw.exe
  C:\Windows\System\PPdCBZw.exe
  2⤵
  PID:12000
- C:\Windows\System\jGSBbAC.exe
  C:\Windows\System\jGSBbAC.exe
  2⤵
  PID:12024
- C:\Windows\System\xMWgEdA.exe
  C:\Windows\System\xMWgEdA.exe
  2⤵
  PID:5096
- C:\Windows\System\xuvtsxo.exe
  C:\Windows\System\xuvtsxo.exe
  2⤵
  PID:11484
- C:\Windows\System\DFgdhim.exe
  C:\Windows\System\DFgdhim.exe
  2⤵
  PID:11332
- C:\Windows\System\DyrvcEv.exe
  C:\Windows\System\DyrvcEv.exe
  2⤵
  PID:12060
- C:\Windows\System\bLxJtRV.exe
  C:\Windows\System\bLxJtRV.exe
  2⤵
  PID:12324
- C:\Windows\System\HLGJbTy.exe
  C:\Windows\System\HLGJbTy.exe
  2⤵
  PID:12368
- C:\Windows\System\pyitYRh.exe
  C:\Windows\System\pyitYRh.exe
  2⤵
  PID:12384
- C:\Windows\System\PboRwvN.exe
  C:\Windows\System\PboRwvN.exe
  2⤵
  PID:12408
- C:\Windows\System\bMmrVYo.exe
  C:\Windows\System\bMmrVYo.exe
  2⤵
  PID:12472
- C:\Windows\System\jeaAZYw.exe
  C:\Windows\System\jeaAZYw.exe
  2⤵
  PID:12504
- C:\Windows\System\uavkGsq.exe
  C:\Windows\System\uavkGsq.exe
  2⤵
  PID:12548
- C:\Windows\System\fBQDYUT.exe
  C:\Windows\System\fBQDYUT.exe
  2⤵
  PID:12584
- C:\Windows\System\vbnpEZc.exe
  C:\Windows\System\vbnpEZc.exe
  2⤵
  PID:12604
- C:\Windows\System\gGlpmxp.exe
  C:\Windows\System\gGlpmxp.exe
  2⤵
  PID:12636
- C:\Windows\System\TEWtClc.exe
  C:\Windows\System\TEWtClc.exe
  2⤵
  PID:12660
- C:\Windows\System\YqkeenQ.exe
  C:\Windows\System\YqkeenQ.exe
  2⤵
  PID:12684
- C:\Windows\System\Stgpery.exe
  C:\Windows\System\Stgpery.exe
  2⤵
  PID:12728
- C:\Windows\System\dsdyKOu.exe
  C:\Windows\System\dsdyKOu.exe
  2⤵
  PID:12760
- C:\Windows\System\PvSvitj.exe
  C:\Windows\System\PvSvitj.exe
  2⤵
  PID:12780
- C:\Windows\System\sdSEfBx.exe
  C:\Windows\System\sdSEfBx.exe
  2⤵
  PID:12828
- C:\Windows\System\ZafyPSM.exe
  C:\Windows\System\ZafyPSM.exe
  2⤵
  PID:12844
- C:\Windows\System\YlfEKqq.exe
  C:\Windows\System\YlfEKqq.exe
  2⤵
  PID:12864
- C:\Windows\System\JQvGReY.exe
  C:\Windows\System\JQvGReY.exe
  2⤵
  PID:12888
- C:\Windows\System\rjWgRpp.exe
  C:\Windows\System\rjWgRpp.exe
  2⤵
  PID:12916
- C:\Windows\System\cUgaean.exe
  C:\Windows\System\cUgaean.exe
  2⤵
  PID:12960
- C:\Windows\System\GHMpBTh.exe
  C:\Windows\System\GHMpBTh.exe
  2⤵
  PID:12984
- C:\Windows\System\KhROQtm.exe
  C:\Windows\System\KhROQtm.exe
  2⤵
  PID:13004
- C:\Windows\System\nOJJayJ.exe
  C:\Windows\System\nOJJayJ.exe
  2⤵
  PID:13028
- C:\Windows\System\JRceYov.exe
  C:\Windows\System\JRceYov.exe
  2⤵
  PID:13048
- C:\Windows\System\CJciYac.exe
  C:\Windows\System\CJciYac.exe
  2⤵
  PID:13104
- C:\Windows\System\zWamBXn.exe
  C:\Windows\System\zWamBXn.exe
  2⤵
  PID:13128
- C:\Windows\System\PNuHETn.exe
  C:\Windows\System\PNuHETn.exe
  2⤵
  PID:13156
- C:\Windows\System\wEPXksJ.exe
  C:\Windows\System\wEPXksJ.exe
  2⤵
  PID:13180
- C:\Windows\System\lAIClfr.exe
  C:\Windows\System\lAIClfr.exe
  2⤵
  PID:13200
- C:\Windows\System\abzzVNL.exe
  C:\Windows\System\abzzVNL.exe
  2⤵
  PID:13220
- C:\Windows\System\EeIrzxM.exe
  C:\Windows\System\EeIrzxM.exe
  2⤵
  PID:13256
- C:\Windows\System\ZCsncRm.exe
  C:\Windows\System\ZCsncRm.exe
  2⤵
  PID:13300
- C:\Windows\System\VgWafnc.exe
  C:\Windows\System\VgWafnc.exe
  2⤵
  PID:11320
- C:\Windows\System\JfSUVro.exe
  C:\Windows\System\JfSUVro.exe
  2⤵
  PID:11680
- C:\Windows\System\CEUujFP.exe
  C:\Windows\System\CEUujFP.exe
  2⤵
  PID:11572
- C:\Windows\System\uUcqiRc.exe
  C:\Windows\System\uUcqiRc.exe
  2⤵
  PID:12316
- C:\Windows\System\LXyJvby.exe
  C:\Windows\System\LXyJvby.exe
  2⤵
  PID:12600
- C:\Windows\System\KzsFbEO.exe
  C:\Windows\System\KzsFbEO.exe
  2⤵
  PID:12620
- C:\Windows\System\fkjdWQj.exe
  C:\Windows\System\fkjdWQj.exe
  2⤵
  PID:12296
- C:\Windows\System\lKrywju.exe
  C:\Windows\System\lKrywju.exe
  2⤵
  PID:1928
- C:\Windows\System\cAosNAv.exe
  C:\Windows\System\cAosNAv.exe
  2⤵
  PID:12428
- C:\Windows\System\jBvZOKl.exe
  C:\Windows\System\jBvZOKl.exe
  2⤵
  PID:4900
- C:\Windows\System\sPRefBS.exe
  C:\Windows\System\sPRefBS.exe
  2⤵
  PID:12540
- C:\Windows\System\FGDWAgd.exe
  C:\Windows\System\FGDWAgd.exe
  2⤵
  PID:5080
- C:\Windows\System\bZhdXVI.exe
  C:\Windows\System\bZhdXVI.exe
  2⤵
  PID:12496
- C:\Windows\System\gnjrkpn.exe
  C:\Windows\System\gnjrkpn.exe
  2⤵
  PID:12612
- C:\Windows\System\jKiGiiS.exe
  C:\Windows\System\jKiGiiS.exe
  2⤵
  PID:12668
- C:\Windows\System\ptjpYnZ.exe
  C:\Windows\System\ptjpYnZ.exe
  2⤵
  PID:12704
- C:\Windows\System\WZVZCYX.exe
  C:\Windows\System\WZVZCYX.exe
  2⤵
  PID:12836
- C:\Windows\System\qvUmbZl.exe
  C:\Windows\System\qvUmbZl.exe
  2⤵
  PID:12860
- C:\Windows\System\FrsZPLj.exe
  C:\Windows\System\FrsZPLj.exe
  2⤵
  PID:12936
- C:\Windows\System\vkyQmPX.exe
  C:\Windows\System\vkyQmPX.exe
  2⤵
  PID:12968
- C:\Windows\System\KCqJTON.exe
  C:\Windows\System\KCqJTON.exe
  2⤵
  PID:13164
- C:\Windows\System\oaUEeBy.exe
  C:\Windows\System\oaUEeBy.exe
  2⤵
  PID:13072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_du0hofaq.0g1.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ASiEKoM.exe

Filesize
2.2MB

MD5
71b6071bf1a1a93d802cfbe773a29a04

SHA1
974eb53d899c173a2ca099b5a39f5f032a15388c

SHA256
82abc8426a52d3b7f6d2da0794a11c76b9cc5f5eb47363edf4a5ae0ae4709d54

SHA512
7ecbef5ff304df79d511b4ab9d463a54e33a902d9065caf6c875e5424eec943bd72ee22b17f072cde9984cc7b6279cdd4ec84255658a5db703a62f37e2b54001

Download Submit
C:\Windows\System\CaEHbnm.exe

Filesize
2.2MB

MD5
2780d90e7b477aacebbdbc192e7e6bef

SHA1
e02a167c400f307bdd30e62f9bb0aa1eb083d3cd

SHA256
a2b134134e5e0c7b92387d2278131499bdc8cbd33a017c00062e0981e15ffaa7

SHA512
33aa163502a2b8de2b24637cb2383c9161d9b2d84fa95043142ff41ccc604b9ae1b28d5aec139feaf08e2a983f2f09a23d94b69b252cc8a7d86bfcd1b1e8869d

Download Submit
C:\Windows\System\EEdaavx.exe

Filesize
2.2MB

MD5
c60fa5e569067535f9e12f9827994fcb

SHA1
9143fcb528607bedc310478a6c6b12f0b939ffa3

SHA256
e39d0c25bc3406c9dc3fdfe42a817a108b8dffe91721d987619afac3074ad5d1

SHA512
54d447f85f07d829cd8726e94a9e550c1e8d58f93ff699edc89b6ebd9fb1759f574b3423b9b79b417b1a0735f173b3e58afcd366fc89643256a16c26c6f0d395

Download Submit
C:\Windows\System\ErLixiP.exe

Filesize
2.2MB

MD5
fdaa2b037611d56bcbecd3f174cf7170

SHA1
94fdf2e6195af940c79a03d5ffea7fc08a645b49

SHA256
086f65f4336f3042ffe01e4f9a4488dd93b3255d638a0446a0686ac256f7706c

SHA512
99792dad11809a867f8b887af50d13b18c88c2bc1629bba077436f1b30c052286e30193f2e05d38339a12ceaff87cbef457916d35977ed83920c1b065df42059

Download Submit
C:\Windows\System\HKHaDWd.exe

Filesize
2.2MB

MD5
42d4323ae753bf74e755fa125643ac65

SHA1
5dcccf4f9e9209b94ee1cbd56bc4caccf7a23cc9

SHA256
e0afcb1331ecae9595a1d5b3a0fd17431657b08a3313b1eb9e0eb88a30a86dcb

SHA512
2060ded0a7024e6ad26bed7688c18f661f474c09cf994376a68b5f859e2e53ca4db37301fd05f9b3b8657abebe76523e937ef646efaa5d6bd7fe81e9102742c9

Download Submit
C:\Windows\System\HOMWXiT.exe

Filesize
2.2MB

MD5
98ba873ef3043645f0ea3cb36e6c2c9b

SHA1
095dd743b77e8c74beba060c0be91093b15726e8

SHA256
ad0babbcf5462bba1df7b62a1dce7678fad7f1f2bad6b0a58ef23536d0628199

SHA512
c472ea9f5ee961c4c6ef6c4029c145a49ff0d9436542774292af336fe4e6de6c31ede040086cf14b917104a4a6e3a75fc64d7cf6c636ab0a97e5dc1f03890190

Download Submit
C:\Windows\System\IAMNFLh.exe

Filesize
2.2MB

MD5
b035827fe34550c440e0095d3abcdd43

SHA1
88af4dfd549da2231ffae79f09530295d3d32b82

SHA256
65944ac0fad7c15b80a99bdadc3335b73099b1a575bd356075fc10e35c256fd0

SHA512
097223ffb7c53b17a5835a9f38b3387eef3b65b60c406f10fee444a4b1c852f51e6851b3202476c647b243b8cc44aec73a359e7d3a8cb8461113affb08a776f0

Download Submit
C:\Windows\System\IefjoJm.exe

Filesize
2.2MB

MD5
e78b00f6e62212f7cfd86f445f9f22a3

SHA1
c0f8e32916a2258904f5c29b7cc6f7551bffd48e

SHA256
c409aa274623306a771c35d72a095ed840801cef8a5fcc346a1c7c20ccc6d25e

SHA512
41c8c1f1db779ee89e20981f6247b8bb7ab221a3a4d9089100541750b78d8aa882cd19c7a4c706cb21bb09abd2a2774a8fd00af932b23387b51ecb72f8a23f1b

Download Submit
C:\Windows\System\NLnsytv.exe

Filesize
2.2MB

MD5
ebecf9e3bbda2ac1c165fc1ce91f97d7

SHA1
39fec10d77a8ca014b86d6119cb6af490fd3c4b1

SHA256
468217aaf0649a981b020480668ee9b0318ec71d2c72a75f68d5449e669d29bd

SHA512
3d9787549a6ce0404978e17d5bb0dee0ac8fc9628af801659a1b5a20b3547fcd4ddb6e3f74f76a6d517ae98b1b1d45dd76b1fdd46354ca105303aca4b74160d8

Download Submit
C:\Windows\System\NeigiUZ.exe

Filesize
2.2MB

MD5
7e8a577c1901f2cf50c28846b45c78d4

SHA1
65ca4ea194f3bb2c427e19a11f2ab5a233086948

SHA256
b6b763ea625a79087ffca020e1f848d34c9ff219e30136b86eb75f7066f838ba

SHA512
37f7cd82933c70fde7921e24d932de7039d5ef9f954a06c55f7b94552a6ac81416f87be79a332788e9489ea1fbff76927d7081487a51ccfd396b381a81dc41ab

Download Submit
C:\Windows\System\NjYMBaA.exe

Filesize
2.2MB

MD5
c657a853f98b0b7075ac801f6f29007f

SHA1
1a86db8baeec058845452967a0dd6944b97fdefc

SHA256
183bf6926c28f1b707d4c2548d1ab33aa043a17828488e872818a80cb96c5a9f

SHA512
ce01310f9dc74c8930cb06cad32083aaf92e81dfe279428fb049aa5cb07a48a307b314fcec5f5b58e4ddddaff2eeee9bcdea3d8229d03ed5e8c5a5f2106ecf8a

Download Submit
C:\Windows\System\OBiclHy.exe

Filesize
2.2MB

MD5
e5a06264ba9582a4988e0c7a18314d27

SHA1
85d8d7e0c6bb0481d3f33052eb539886ce1bb1ba

SHA256
1fca8c8307bbd4b124a532105db789539cce02c77dbff40189cab1700eaed581

SHA512
a267311c68becf6fab6cf570d596e88ecb2d02fa463344d221cc798ad0f6ae4c9794168a3df84aa1f647807460483fa759a8c7d051f244ee23df06224d67f995

Download Submit
C:\Windows\System\OXFONwv.exe

Filesize
2.2MB

MD5
42ddfeea133f38afec7760c8bfc8a77c

SHA1
80de7137a85220ecc6ee0285f4d58cdef3d79d5f

SHA256
c45cb23a0a41ec7e6eeede4eeca9e1d1b8d585e359359b00840c0c16691a3445

SHA512
88ce76921e7beac08a68c60caef6f5e255f00802b730447759dca0c92f5d2dd6ae184005885c764a0506a0d07bec6b6ae8f363746f7a19d5b164a9bdeea88713

Download Submit
C:\Windows\System\OduKvWa.exe

Filesize
2.2MB

MD5
9db8c275b10ed22b77039089d8e0b861

SHA1
07321870096638e9b94e3597349b027b6f166e0c

SHA256
56e5516b38952d2267ac5d6dce86956d76a295d101f59bae962dc5c57fb8acd6

SHA512
7cba3c8d249f613832e6e3a68e9c4cd19cadb43a7ce7bc14ffae86aed6bc2e4cf6b66078a08d6ed59fe0b01394df652014ecbe0db59bf25e7ba4091e63430014

Download Submit
C:\Windows\System\RAbpANt.exe

Filesize
2.2MB

MD5
1f8e91a3dd486c60174c402ea66dc112

SHA1
7dc5ea3b79c16fa371b26612cd3600c573ec4848

SHA256
79b5c12172f5cb4e0cb324c88e763e8af228e50821e1fa307a08d4273ec22ce8

SHA512
c90f536cb4c9378fcda67159da75d78cdb76190e7b1faf696c41288e088e4d4d485a56610b3e82a8a4af795f4b3b8deb86053ac74fec8a27d660ce33d67be6b3

Download Submit
C:\Windows\System\ZyfXmde.exe

Filesize
2.2MB

MD5
d715b4f88631652c94b0033816f75cd4

SHA1
9272d4b56d546cf47e8228c3df54ef9afe84982e

SHA256
2d05248d1ab39154b5cb886829bbc4913747fc22e754c72b81bdb1f70437bbd9

SHA512
79cae229be199f0b3f47c326aaa9110496b0658666718abe820c8233260b899ebdb195aef45c2dc4b72972ae7fb445caa53415fb01bf6e33cdddbd3362fe4241

Download Submit
C:\Windows\System\aRohank.exe

Filesize
2.2MB

MD5
9eeb45601e7d94acad32bd886f56ee04

SHA1
92cc455d98ef45d2523e27404b29017c0c1b932f

SHA256
917d95315b64a5b23245e83357bee7ca3079afea63446db7a897bc8a57566d33

SHA512
56487310e59bd3040ee08248e4f3c2b2fc32b7f9301256dc57d7f52f344f7825f81f809d7fc40e69f9113453254f9f199f9d2f72caa89cc08ae80f1591e4d1c6

Download Submit
C:\Windows\System\bVbEMBS.exe

Filesize
2.2MB

MD5
70dad1fc9e17b6c76437bad05a704a94

SHA1
923de30c53cfe8bf35e11ca875f3e2f6d8561313

SHA256
94d4ca335d17dbc4b349b223d73afd233ed6bedec05b2d36849260c5aa349aae

SHA512
8780d5e9d8db04626d9ed98240200b915b7c7986885ad9c916c0ee6537c56f1cfa86d85514cf6bf39d802577f3c471d0b84152e3f45a55e27838cd9a9139971e

Download Submit
C:\Windows\System\cAJIRfT.exe

Filesize
2.2MB

MD5
64522288f7033e4ba32079cac067128e

SHA1
65f81e6411ef694e6dd3385a8304a4c0cbc43687

SHA256
99a53275d2413666e50fd0fb61b7f245f1c71cf2eacbc5bba4f5261dc62941e5

SHA512
33f269a0eda47feb3895e7c1fff0f790333747a6bcb5481bd8fb290d2f9aea8e6acaba6331670456aabd09967bac73a956b8ccaa21f15b3484b7343e15c71992

Download Submit
C:\Windows\System\cpcTvlH.exe

Filesize
2.2MB

MD5
b0fc657cde0cfc3d0811ce0962b1eeca

SHA1
ebc3a30cb7ed2c4cabb4170bbb2ff854c6cc5db1

SHA256
7d190e4177e774bff1c2839e758f7033f1c09cf7cd54654cbe6d52eaa3612487

SHA512
110b2b241c00cb476898120b7d35437d77abc01b0e18857c73baf7140d83801a68d4d3ad17e10273498c29c15761d87637e5eba7f44e05393702f3692c0e52f5

Download Submit
C:\Windows\System\eJozPKn.exe

Filesize
2.2MB

MD5
af3fcb52d5d1b12b7492fa4b9769464e

SHA1
86a5d456d363f77ca4cc5a188cedbe51f9ed0d5e

SHA256
a217181dd623459098f07d592ba5774ca16d30dd597f6d6399ac9cbddd1f24b3

SHA512
90ce4fe63ec0634ee9f594d991672eee1f593189223d4cf99df4286303d773bda9f5c6299b8fee5011707389fd82d0625358752083c56559657be855bab9c5bd

Download Submit
C:\Windows\System\itsIOgH.exe

Filesize
2.2MB

MD5
c924d06bc62e88c8530460640fbd46c0

SHA1
57591054e2efd6471c477a650bef0201cbad0ff1

SHA256
c68c8086b45eab0f6e37104b11b9870f21efe1e0e1a0919cdd7c0612cb88f05d

SHA512
1917022fb7b850c3b521286366b74bcc18c890a90f084d30a9d6052472988b7f903a1e73914b370ea4a1dfad28525f7f2773587118b332b4157047765c6b2cd6

Download Submit
C:\Windows\System\jrZSoTY.exe

Filesize
2.2MB

MD5
abd350b1589753acadf646b298a8e0b8

SHA1
1532ed4444224f5189d7108f44b09f3e0ab6b0fc

SHA256
ada046906024e0d22435e39742ec4db435634f985f1e4f6fe1bde347319e23fc

SHA512
0205f2572ba0b7f3c3a82b9287c32266dbf53ba294968758eb4c6501cc72f7e6018a1583b60d60ac96aaf46b1b22ac01fd9ab96c2e3ab1a736e5238ada9ad9e6

Download Submit
C:\Windows\System\knICKEj.exe

Filesize
8B

MD5
1855a32bc20d82a1da2b5edf8967f4e6

SHA1
25928e56f89ec28b56047592b93000c1d36e2a23

SHA256
197265335822dae03e837ac88a16d32bf68b201da4bc921af00edba259c1267c

SHA512
6ba43273aa11ef21001bd21641b2cb12d306e904aaff29ff56a8c7b3eadaaec0f04afabf47cd7eb2a1a7b9c79f098b4d11d9a442d2048486e96355d7914a5e67

Download Submit
C:\Windows\System\mBdFhxl.exe

Filesize
2.2MB

MD5
968060ae7b1451658f827a3a3fbb918d

SHA1
b59454df7f8e878524a1d04d3749cd314ebc0784

SHA256
502923cf2f2ca1924162036ed0e65b5d67d3505c1479e7b9c77497f863546a25

SHA512
6f85fdbb690048f014814f6271565af7eee08cb08c706f1dde77d2a4fd8b0b3421a855c917c6b8090416608807fbe907fcbaba0998e771f39603828beb91414e

Download Submit
C:\Windows\System\nuRLMby.exe

Filesize
2.2MB

MD5
8db266e9c1a2b871f4b3245e7a9944df

SHA1
c2b5f2f983f1d43645576eec07c9467e948c9b7c

SHA256
15200e960cb176a231147256e2e5a35ebe7fbf721dfbdcf1647b4082690c2a8d

SHA512
b538a82dd9db76b97019acada476e4b8c1bcfadd5579e5974f1b6115cab6204d4edf4dfd989a89e66b2f8ea5d161a41a46219a9e99149442058d7cbb71139799

Download Submit
C:\Windows\System\pbHyAcA.exe

Filesize
2.2MB

MD5
53a7a2508bb5f00a0535be4613729e17

SHA1
2d5467cbd1e21af02607fa9e8bb77934cadbbe6f

SHA256
564e677316ed9a0dc4069406143f75bdc83a0ca6a3f3d29027bfa2760d55f802

SHA512
a1eb31aed8c2946980f9bac8ce781d8251c999d38d70096c12d15ddc3cbb7a37255e66d6ae91ee479e596fe69e5cff7eef7b7bc5762a07fee966a0308bdd0db8

Download Submit
C:\Windows\System\qlxaGBA.exe

Filesize
2.2MB

MD5
32a7191328ea15b8e25d718c5a5c0f7d

SHA1
f204d104fe9d6313e7c64335e7944784dcbf3509

SHA256
dce99fc552a09a7939a1ba70b035407500b6235a63465992e749691ee4f48144

SHA512
9fbd47bc178fc722901c650d60c54213e68274f5679ad334869409df95a7a0bd4b5331f3ba35205b0d60b192ba3f2b2e27670445603744151c0c00b6caef64ed

Download Submit
C:\Windows\System\qmKJPne.exe

Filesize
2.2MB

MD5
f20ba1a4ff017ae15240d4822e59c9be

SHA1
483085631c146273cdb580a37f370a50b342f41f

SHA256
4280bb7ff3a6f40a077213a233ebdce8f27b4889eb311890f1d9d32499669f66

SHA512
37aba1223e91cb1d65c94c616d0ffdd4230a82511d0dc389556bafd9a9b70ab02cc9e01006f73437170b43b8aaab9a4abe346abdc757b579edd9b832ec86656f

Download Submit
C:\Windows\System\uipUUOo.exe

Filesize
2.2MB

MD5
4f8f71d2cebb1b2f5223ae8435ff08a2

SHA1
fe03779cd395fdcfeb2d395c11a9063a915f9170

SHA256
7887a0519dadff24f3e587f8c6763acade6bb33ece1aa81bf9ff74aeb42aa9ad

SHA512
85dbfc2f1e47b4931c2daec02866ae7cefdf68532428d1b4ed271780b656e1752c1cf5a5745749502c80963a089b4767ba148f80ffeabc88c96785e7b5b54686

Download Submit
C:\Windows\System\wQNkZzw.exe

Filesize
2.2MB

MD5
2a77bb25e708569c206444009f3527bb

SHA1
7c82972201234f1ad2fb9ac174e5f9853a1135b3

SHA256
5d5fbb49d4ccd4d53f1185a1f882207985319baa9f7b74cece6737d7f64c4e6a

SHA512
1dfdbbf0914b9fb28927e437c2f8fe35f1b9363a81faa9f454200f0e61562ff44b7caef4512730980e326b471f8915128ae9bf90abbb7e7cfc394714070715db

Download Submit
C:\Windows\System\wtZdWfG.exe

Filesize
2.2MB

MD5
7fdddfcb762c1c6f1412d783f8afcaee

SHA1
99dda75f9930c7d46c1720e74ae42c53628d81da

SHA256
ffa2a0f453c2db4b4d1ce62768439b5b7b679e73c92938c3b084928f52f7117c

SHA512
48e06f81b74ec85ea4ab76146112f1b96e12b8b4bf818b359f4b274a1999810adf010756ff9f92dce34c317e3e300ae4ebdf807d628a521d2f0851ec0fe216f9

Download Submit
C:\Windows\System\xpBqllL.exe

Filesize
2.2MB

MD5
adc66628c77262bf088030461677ed1d

SHA1
bd185c5f4b51ffe01bd208f2a3af60d9f1afc563

SHA256
596da9dedcdc4567a3054212a225089ea519f4d3154063704e4fc8c604a05a09

SHA512
bdf233e82972c52724d1f71a206538c44ba4a1aedfc778261647b6b66a7bb152d9e838e7115dcfe1bd764fd541e148721e4f926dae8eb3905f6f8d43fc72c9cd

Download Submit
C:\Windows\System\zobhpLu.exe

Filesize
2.2MB

MD5
93335542acf59fda85d7602fe617d737

SHA1
37f07d19847613ceabe490d22b44ea0a1c80daf3

SHA256
43b1081b6a8d309b33c7d78898e06263c86f97e70d9f49be5f76cf92b596008d

SHA512
c6b7d8584adb5d3594a47b089adc14e0156c998f0573345015e7bb967c86e927edad7f389dfd8682ccd3d8111dc867bda4cf45eeffc50c0afc9cb913120ab130

Download Submit
memory/368-523-0x00007FF75DA90000-0x00007FF75DE82000-memory.dmp

Filesize
3.9MB

Download
memory/368-2696-0x00007FF75DA90000-0x00007FF75DE82000-memory.dmp

Filesize
3.9MB

Download
memory/384-2729-0x00007FF6B8440000-0x00007FF6B8832000-memory.dmp

Filesize
3.9MB

Download
memory/384-621-0x00007FF6B8440000-0x00007FF6B8832000-memory.dmp

Filesize
3.9MB

Download
memory/464-554-0x00007FF6EBD70000-0x00007FF6EC162000-memory.dmp

Filesize
3.9MB

Download
memory/464-2724-0x00007FF6EBD70000-0x00007FF6EC162000-memory.dmp

Filesize
3.9MB

Download
memory/536-564-0x00007FF795280000-0x00007FF795672000-memory.dmp

Filesize
3.9MB

Download
memory/536-2730-0x00007FF795280000-0x00007FF795672000-memory.dmp

Filesize
3.9MB

Download
memory/552-360-0x000001E262280000-0x000001E262A26000-memory.dmp

Filesize
7.6MB

Download
memory/552-21-0x000001E246F50000-0x000001E246F60000-memory.dmp

Filesize
64KB

Download
memory/552-72-0x000001E261620000-0x000001E261642000-memory.dmp

Filesize
136KB

Download
memory/552-20-0x000001E246F50000-0x000001E246F60000-memory.dmp

Filesize
64KB

Download
memory/552-18-0x00007FFE957D0000-0x00007FFE96291000-memory.dmp

Filesize
10.8MB

Download
memory/1992-86-0x00007FF7A1ED0000-0x00007FF7A22C2000-memory.dmp

Filesize
3.9MB

Download
memory/1992-2689-0x00007FF7A1ED0000-0x00007FF7A22C2000-memory.dmp

Filesize
3.9MB

Download
memory/2108-2707-0x00007FF7E53A0000-0x00007FF7E5792000-memory.dmp

Filesize
3.9MB

Download
memory/2108-78-0x00007FF7E53A0000-0x00007FF7E5792000-memory.dmp

Filesize
3.9MB

Download
memory/2108-2685-0x00007FF7E53A0000-0x00007FF7E5792000-memory.dmp

Filesize
3.9MB

Download
memory/2268-2699-0x00007FF7C19C0000-0x00007FF7C1DB2000-memory.dmp

Filesize
3.9MB

Download
memory/2268-2683-0x00007FF7C19C0000-0x00007FF7C1DB2000-memory.dmp

Filesize
3.9MB

Download
memory/2268-49-0x00007FF7C19C0000-0x00007FF7C1DB2000-memory.dmp

Filesize
3.9MB

Download
memory/2276-0-0x00007FF746F10000-0x00007FF747302000-memory.dmp

Filesize
3.9MB

Download
memory/2276-1-0x0000022A09530000-0x0000022A09540000-memory.dmp

Filesize
64KB

Download
memory/2280-2713-0x00007FF6A3290000-0x00007FF6A3682000-memory.dmp

Filesize
3.9MB

Download
memory/2280-636-0x00007FF6A3290000-0x00007FF6A3682000-memory.dmp

Filesize
3.9MB

Download
memory/2716-2711-0x00007FF6162C0000-0x00007FF6166B2000-memory.dmp

Filesize
3.9MB

Download
memory/2716-531-0x00007FF6162C0000-0x00007FF6166B2000-memory.dmp

Filesize
3.9MB

Download
memory/2796-546-0x00007FF67FD90000-0x00007FF680182000-memory.dmp

Filesize
3.9MB

Download
memory/2796-2717-0x00007FF67FD90000-0x00007FF680182000-memory.dmp

Filesize
3.9MB

Download
memory/2964-33-0x00007FF699BC0000-0x00007FF699FB2000-memory.dmp

Filesize
3.9MB

Download
memory/2964-2693-0x00007FF699BC0000-0x00007FF699FB2000-memory.dmp

Filesize
3.9MB

Download
memory/3052-2697-0x00007FF7139E0000-0x00007FF713DD2000-memory.dmp

Filesize
3.9MB

Download
memory/3052-2686-0x00007FF7139E0000-0x00007FF713DD2000-memory.dmp

Filesize
3.9MB

Download
memory/3052-30-0x00007FF7139E0000-0x00007FF713DD2000-memory.dmp

Filesize
3.9MB

Download
memory/3112-2732-0x00007FF679670000-0x00007FF679A62000-memory.dmp

Filesize
3.9MB

Download
memory/3112-550-0x00007FF679670000-0x00007FF679A62000-memory.dmp

Filesize
3.9MB

Download
memory/3512-604-0x00007FF6BEC70000-0x00007FF6BF062000-memory.dmp

Filesize
3.9MB

Download
memory/3512-2727-0x00007FF6BEC70000-0x00007FF6BF062000-memory.dmp

Filesize
3.9MB

Download
memory/3740-2701-0x00007FF679250000-0x00007FF679642000-memory.dmp

Filesize
3.9MB

Download
memory/3740-525-0x00007FF679250000-0x00007FF679642000-memory.dmp

Filesize
3.9MB

Download
memory/3840-2709-0x00007FF6A1B50000-0x00007FF6A1F42000-memory.dmp

Filesize
3.9MB

Download
memory/3840-2684-0x00007FF6A1B50000-0x00007FF6A1F42000-memory.dmp

Filesize
3.9MB

Download
memory/3840-58-0x00007FF6A1B50000-0x00007FF6A1F42000-memory.dmp

Filesize
3.9MB

Download
memory/4268-2705-0x00007FF64A5B0000-0x00007FF64A9A2000-memory.dmp

Filesize
3.9MB

Download
memory/4268-534-0x00007FF64A5B0000-0x00007FF64A9A2000-memory.dmp

Filesize
3.9MB

Download
memory/4360-530-0x00007FF653260000-0x00007FF653652000-memory.dmp

Filesize
3.9MB

Download
memory/4360-2704-0x00007FF653260000-0x00007FF653652000-memory.dmp

Filesize
3.9MB

Download
memory/4532-586-0x00007FF6B34C0000-0x00007FF6B38B2000-memory.dmp

Filesize
3.9MB

Download
memory/4532-2719-0x00007FF6B34C0000-0x00007FF6B38B2000-memory.dmp

Filesize
3.9MB

Download
memory/4684-25-0x00007FF78ACD0000-0x00007FF78B0C2000-memory.dmp

Filesize
3.9MB

Download
memory/4684-2691-0x00007FF78ACD0000-0x00007FF78B0C2000-memory.dmp

Filesize
3.9MB

Download
memory/4864-642-0x00007FF78EBE0000-0x00007FF78EFD2000-memory.dmp

Filesize
3.9MB

Download
memory/4864-2715-0x00007FF78EBE0000-0x00007FF78EFD2000-memory.dmp

Filesize
3.9MB

Download