xmrig | 2a6cb2bc6ed7fb1c69704f1cb471e89a202ebe86d1df6777aa39baa87b311592

Analysis

max time kernel
8s
max time network
43s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 15:45

Sharing

Copy URL Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
Size

2.2MB
MD5

0a19272e52c01b3a18c999f29c0c2229
SHA1

ca17d1f4dfddd5cced17e51e368c3e365c5df522
SHA256

2a6cb2bc6ed7fb1c69704f1cb471e89a202ebe86d1df6777aa39baa87b311592
SHA512

ec08c9513a747f57f407ab4954867909cfc48713c4b106e487ad3db5d3b3e8b3073ff408266f4812e6730cf26c62df6ce20b5328d94f8476d89ea8803e090de0
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aDq:NABr

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 16 IoCs

miner

resource	yara_rule
behavioral2/memory/2852-12-0x00007FF608650000-0x00007FF608A42000-memory.dmp	xmrig
behavioral2/memory/4980-205-0x00007FF63EBA0000-0x00007FF63EF92000-memory.dmp	xmrig
behavioral2/memory/2364-220-0x00007FF720100000-0x00007FF7204F2000-memory.dmp	xmrig
behavioral2/memory/828-231-0x00007FF752910000-0x00007FF752D02000-memory.dmp	xmrig
behavioral2/memory/2500-243-0x00007FF7D1E80000-0x00007FF7D2272000-memory.dmp	xmrig
behavioral2/memory/4400-246-0x00007FF634890000-0x00007FF634C82000-memory.dmp	xmrig
behavioral2/memory/624-250-0x00007FF66F930000-0x00007FF66FD22000-memory.dmp	xmrig
behavioral2/memory/4492-249-0x00007FF6ACE50000-0x00007FF6AD242000-memory.dmp	xmrig
behavioral2/memory/3228-248-0x00007FF663A00000-0x00007FF663DF2000-memory.dmp	xmrig
behavioral2/memory/1540-247-0x00007FF61B250000-0x00007FF61B642000-memory.dmp	xmrig
behavioral2/memory/1064-242-0x00007FF774380000-0x00007FF774772000-memory.dmp	xmrig
behavioral2/memory/3688-238-0x00007FF712EB0000-0x00007FF7132A2000-memory.dmp	xmrig
behavioral2/memory/2044-230-0x00007FF74A800000-0x00007FF74ABF2000-memory.dmp	xmrig
behavioral2/memory/5012-186-0x00007FF658880000-0x00007FF658C72000-memory.dmp	xmrig
behavioral2/memory/4508-161-0x00007FF7046C0000-0x00007FF704AB2000-memory.dmp	xmrig
behavioral2/memory/3116-158-0x00007FF6B6B30000-0x00007FF6B6F22000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
9	4340	powershell.exe
11	4340	powershell.exe

Executes dropped EXE 50 IoCs

pid	Process
2852	rUMUgAp.exe
3172	yyqPToq.exe
4400	pvEEQVO.exe
2060	mWqpeLi.exe
2692	uUvXDxY.exe
1540	ZxaESZs.exe
3124	dQDigVS.exe
3228	yNpbnNO.exe
4000	wJQqqcR.exe
3116	CWLwxeE.exe
4508	LcpLAVB.exe
5012	eajNQzn.exe
4492	CNkydmD.exe
4980	dqhgqbP.exe
2364	lQcIhVu.exe
2044	SfTzFDX.exe
828	LgXyPkh.exe
3688	bWNTMbe.exe
1064	wUPrxTs.exe
2500	RbtoAja.exe
624	agwEnEQ.exe
4632	NKCQUAM.exe
3064	RxYSfRx.exe
3196	jTsgKBz.exe
4692	lTZeWAB.exe
4300	sLGnIdi.exe
1920	YgJNHEh.exe
1416	eprJZIp.exe
4316	TIxekSd.exe
1592	SPsgqGX.exe
1612	FepyTZE.exe
1932	pjLlnoE.exe
412	iOSBmXR.exe
2432	bgLnkzW.exe
1448	oBXNMQD.exe
1232	LcYIEFA.exe
3480	xBkmBkk.exe
2644	sKaVivt.exe
4224	kOaeQMV.exe
4328	MqJfDDc.exe
3856	SkJyCun.exe
4904	OtTNBiB.exe
2216	NQYeuUz.exe
2508	BHzncfE.exe
3436	hHKLCSG.exe
4456	lIhBfYp.exe
4292	ZcIcoxg.exe
4228	DCOcHax.exe
2320	LWHwLar.exe
4704	jdCnrWw.exe

UPX packed file 59 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/216-0-0x00007FF6F7C90000-0x00007FF6F8082000-memory.dmp	upx
behavioral2/files/0x000e000000023b8a-5.dat	upx
behavioral2/files/0x000b000000023b99-15.dat	upx
behavioral2/memory/2852-12-0x00007FF608650000-0x00007FF608A42000-memory.dmp	upx
behavioral2/files/0x000a000000023b9d-8.dat	upx
behavioral2/files/0x000a000000023b9e-19.dat	upx
behavioral2/memory/2060-47-0x00007FF6E11A0000-0x00007FF6E1592000-memory.dmp	upx
behavioral2/files/0x000a000000023ba6-61.dat	upx
behavioral2/files/0x000a000000023ba8-75.dat	upx
behavioral2/files/0x000a000000023ba9-111.dat	upx
behavioral2/files/0x0031000000023bb4-135.dat	upx
behavioral2/files/0x000a000000023baf-167.dat	upx
behavioral2/memory/4980-205-0x00007FF63EBA0000-0x00007FF63EF92000-memory.dmp	upx
behavioral2/memory/2364-220-0x00007FF720100000-0x00007FF7204F2000-memory.dmp	upx
behavioral2/memory/828-231-0x00007FF752910000-0x00007FF752D02000-memory.dmp	upx
behavioral2/memory/2500-243-0x00007FF7D1E80000-0x00007FF7D2272000-memory.dmp	upx
behavioral2/memory/4400-246-0x00007FF634890000-0x00007FF634C82000-memory.dmp	upx
behavioral2/memory/624-250-0x00007FF66F930000-0x00007FF66FD22000-memory.dmp	upx
behavioral2/memory/4492-249-0x00007FF6ACE50000-0x00007FF6AD242000-memory.dmp	upx
behavioral2/memory/3228-248-0x00007FF663A00000-0x00007FF663DF2000-memory.dmp	upx
behavioral2/memory/1540-247-0x00007FF61B250000-0x00007FF61B642000-memory.dmp	upx
behavioral2/memory/1064-242-0x00007FF774380000-0x00007FF774772000-memory.dmp	upx
behavioral2/memory/3688-238-0x00007FF712EB0000-0x00007FF7132A2000-memory.dmp	upx
behavioral2/memory/2044-230-0x00007FF74A800000-0x00007FF74ABF2000-memory.dmp	upx
behavioral2/files/0x000a000000023bc0-189.dat	upx
behavioral2/memory/5012-186-0x00007FF658880000-0x00007FF658C72000-memory.dmp	upx
behavioral2/files/0x000a000000023bbf-183.dat	upx
behavioral2/files/0x0031000000023bb6-182.dat	upx
behavioral2/files/0x000b000000023b9a-181.dat	upx
behavioral2/files/0x0031000000023bb5-178.dat	upx
behavioral2/files/0x000a000000023bbc-177.dat	upx
behavioral2/files/0x000a000000023bbb-176.dat	upx
behavioral2/files/0x000a000000023bba-175.dat	upx
behavioral2/files/0x000a000000023bb1-171.dat	upx
behavioral2/files/0x000a000000023bb0-169.dat	upx
behavioral2/files/0x000a000000023bac-165.dat	upx
behavioral2/files/0x000a000000023bb9-164.dat	upx
behavioral2/files/0x000a000000023bb7-162.dat	upx
behavioral2/memory/4508-161-0x00007FF7046C0000-0x00007FF704AB2000-memory.dmp	upx
behavioral2/memory/3116-158-0x00007FF6B6B30000-0x00007FF6B6F22000-memory.dmp	upx
behavioral2/files/0x000a000000023bb3-157.dat	upx
behavioral2/files/0x000a000000023bb2-138.dat	upx
behavioral2/files/0x000a000000023bb8-163.dat	upx
behavioral2/memory/4000-127-0x00007FF629A40000-0x00007FF629E32000-memory.dmp	upx
behavioral2/files/0x000a000000023bae-117.dat	upx
behavioral2/files/0x000a000000023bad-113.dat	upx
behavioral2/files/0x000a000000023ba3-107.dat	upx
behavioral2/files/0x000a000000023bab-130.dat	upx
behavioral2/files/0x000a000000023ba7-120.dat	upx
behavioral2/memory/3124-99-0x00007FF78CCB0000-0x00007FF78D0A2000-memory.dmp	upx
behavioral2/files/0x000a000000023baa-103.dat	upx
behavioral2/files/0x000a000000023ba1-73.dat	upx
behavioral2/files/0x000a000000023ba5-68.dat	upx
behavioral2/files/0x000a000000023ba2-65.dat	upx
behavioral2/memory/2692-64-0x00007FF771190000-0x00007FF771582000-memory.dmp	upx
behavioral2/files/0x000a000000023ba4-56.dat	upx
behavioral2/files/0x000a000000023b9f-44.dat	upx
behavioral2/files/0x000a000000023ba0-53.dat	upx
behavioral2/memory/3172-26-0x00007FF7DE510000-0x00007FF7DE902000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Windows directory 51 IoCs

description	ioc	Process
File created	C:\Windows\System\dQDigVS.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
File created	C:\Windows\System\RbtoAja.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
File created	C:\Windows\System\OtTNBiB.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
File created	C:\Windows\System\hHKLCSG.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
File created	C:\Windows\System\rUMUgAp.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
File created	C:\Windows\System\wJQqqcR.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
File created	C:\Windows\System\SfTzFDX.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
File created	C:\Windows\System\oBXNMQD.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
File created	C:\Windows\System\LWHwLar.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
File created	C:\Windows\System\YgJNHEh.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
File created	C:\Windows\System\eajNQzn.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
File created	C:\Windows\System\FepyTZE.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
File created	C:\Windows\System\NQYeuUz.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
File created	C:\Windows\System\BHzncfE.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
File created	C:\Windows\System\wUPrxTs.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
File created	C:\Windows\System\NKCQUAM.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
File created	C:\Windows\System\SPsgqGX.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
File created	C:\Windows\System\MqJfDDc.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
File created	C:\Windows\System\SkJyCun.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
File created	C:\Windows\System\aCwlpqA.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
File created	C:\Windows\System\dqhgqbP.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
File created	C:\Windows\System\lTZeWAB.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
File created	C:\Windows\System\sLGnIdi.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
File created	C:\Windows\System\pjLlnoE.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
File created	C:\Windows\System\jdCnrWw.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
File created	C:\Windows\System\RxYSfRx.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
File created	C:\Windows\System\ZcIcoxg.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
File created	C:\Windows\System\yNpbnNO.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
File created	C:\Windows\System\lIhBfYp.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
File created	C:\Windows\System\LcpLAVB.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
File created	C:\Windows\System\jTsgKBz.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
File created	C:\Windows\System\eprJZIp.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
File created	C:\Windows\System\LcYIEFA.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
File created	C:\Windows\System\yyqPToq.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
File created	C:\Windows\System\pvEEQVO.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
File created	C:\Windows\System\uUvXDxY.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
File created	C:\Windows\System\CWLwxeE.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
File created	C:\Windows\System\DCOcHax.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
File created	C:\Windows\System\kOaeQMV.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
File created	C:\Windows\System\CNkydmD.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
File created	C:\Windows\System\agwEnEQ.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
File created	C:\Windows\System\TIxekSd.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
File created	C:\Windows\System\iOSBmXR.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
File created	C:\Windows\System\xBkmBkk.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
File created	C:\Windows\System\sKaVivt.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
File created	C:\Windows\System\mWqpeLi.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
File created	C:\Windows\System\ZxaESZs.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
File created	C:\Windows\System\lQcIhVu.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
File created	C:\Windows\System\LgXyPkh.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
File created	C:\Windows\System\bWNTMbe.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
File created	C:\Windows\System\bgLnkzW.exe	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4340	powershell.exe
4340	powershell.exe
4340	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
Token: SeDebugPrivilege	4340	powershell.exe
Token: SeLockMemoryPrivilege	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 216 wrote to memory of 4340	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	85
PID 216 wrote to memory of 4340	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	85
PID 216 wrote to memory of 2852	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	86
PID 216 wrote to memory of 2852	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	86
PID 216 wrote to memory of 3172	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	87
PID 216 wrote to memory of 3172	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	87
PID 216 wrote to memory of 2060	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	88
PID 216 wrote to memory of 2060	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	88
PID 216 wrote to memory of 4400	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	89
PID 216 wrote to memory of 4400	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	89
PID 216 wrote to memory of 1540	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	90
PID 216 wrote to memory of 1540	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	90
PID 216 wrote to memory of 2692	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	91
PID 216 wrote to memory of 2692	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	91
PID 216 wrote to memory of 3124	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	92
PID 216 wrote to memory of 3124	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	92
PID 216 wrote to memory of 3228	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	93
PID 216 wrote to memory of 3228	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	93
PID 216 wrote to memory of 4000	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	94
PID 216 wrote to memory of 4000	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	94
PID 216 wrote to memory of 3116	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	95
PID 216 wrote to memory of 3116	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	95
PID 216 wrote to memory of 4508	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	96
PID 216 wrote to memory of 4508	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	96
PID 216 wrote to memory of 5012	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	97
PID 216 wrote to memory of 5012	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	97
PID 216 wrote to memory of 2364	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	98
PID 216 wrote to memory of 2364	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	98
PID 216 wrote to memory of 4492	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	99
PID 216 wrote to memory of 4492	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	99
PID 216 wrote to memory of 4980	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	100
PID 216 wrote to memory of 4980	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	100
PID 216 wrote to memory of 2044	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	101
PID 216 wrote to memory of 2044	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	101
PID 216 wrote to memory of 828	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	102
PID 216 wrote to memory of 828	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	102
PID 216 wrote to memory of 3688	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	103
PID 216 wrote to memory of 3688	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	103
PID 216 wrote to memory of 1064	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	104
PID 216 wrote to memory of 1064	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	104
PID 216 wrote to memory of 2500	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	105
PID 216 wrote to memory of 2500	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	105
PID 216 wrote to memory of 624	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	106
PID 216 wrote to memory of 624	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	106
PID 216 wrote to memory of 4632	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	107
PID 216 wrote to memory of 4632	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	107
PID 216 wrote to memory of 3064	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	108
PID 216 wrote to memory of 3064	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	108
PID 216 wrote to memory of 3196	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	109
PID 216 wrote to memory of 3196	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	109
PID 216 wrote to memory of 4692	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	110
PID 216 wrote to memory of 4692	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	110
PID 216 wrote to memory of 4300	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	111
PID 216 wrote to memory of 4300	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	111
PID 216 wrote to memory of 1920	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	112
PID 216 wrote to memory of 1920	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	112
PID 216 wrote to memory of 2432	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	113
PID 216 wrote to memory of 2432	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	113
PID 216 wrote to memory of 1448	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	114
PID 216 wrote to memory of 1448	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	114
PID 216 wrote to memory of 1416	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	115
PID 216 wrote to memory of 1416	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	115
PID 216 wrote to memory of 4316	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	116
PID 216 wrote to memory of 4316	216	0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0a19272e52c01b3a18c999f29c0c2229_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4340
- C:\Windows\System\rUMUgAp.exe
  C:\Windows\System\rUMUgAp.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\yyqPToq.exe
  C:\Windows\System\yyqPToq.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\mWqpeLi.exe
  C:\Windows\System\mWqpeLi.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\pvEEQVO.exe
  C:\Windows\System\pvEEQVO.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\ZxaESZs.exe
  C:\Windows\System\ZxaESZs.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\uUvXDxY.exe
  C:\Windows\System\uUvXDxY.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\dQDigVS.exe
  C:\Windows\System\dQDigVS.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\yNpbnNO.exe
  C:\Windows\System\yNpbnNO.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\wJQqqcR.exe
  C:\Windows\System\wJQqqcR.exe
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Windows\System\CWLwxeE.exe
  C:\Windows\System\CWLwxeE.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\LcpLAVB.exe
  C:\Windows\System\LcpLAVB.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\eajNQzn.exe
  C:\Windows\System\eajNQzn.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\lQcIhVu.exe
  C:\Windows\System\lQcIhVu.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\CNkydmD.exe
  C:\Windows\System\CNkydmD.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\dqhgqbP.exe
  C:\Windows\System\dqhgqbP.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\SfTzFDX.exe
  C:\Windows\System\SfTzFDX.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\LgXyPkh.exe
  C:\Windows\System\LgXyPkh.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\bWNTMbe.exe
  C:\Windows\System\bWNTMbe.exe
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Windows\System\wUPrxTs.exe
  C:\Windows\System\wUPrxTs.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\RbtoAja.exe
  C:\Windows\System\RbtoAja.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\agwEnEQ.exe
  C:\Windows\System\agwEnEQ.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\NKCQUAM.exe
  C:\Windows\System\NKCQUAM.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\RxYSfRx.exe
  C:\Windows\System\RxYSfRx.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\jTsgKBz.exe
  C:\Windows\System\jTsgKBz.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\lTZeWAB.exe
  C:\Windows\System\lTZeWAB.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\sLGnIdi.exe
  C:\Windows\System\sLGnIdi.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\YgJNHEh.exe
  C:\Windows\System\YgJNHEh.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\bgLnkzW.exe
  C:\Windows\System\bgLnkzW.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\oBXNMQD.exe
  C:\Windows\System\oBXNMQD.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\eprJZIp.exe
  C:\Windows\System\eprJZIp.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\TIxekSd.exe
  C:\Windows\System\TIxekSd.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\SPsgqGX.exe
  C:\Windows\System\SPsgqGX.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\FepyTZE.exe
  C:\Windows\System\FepyTZE.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\pjLlnoE.exe
  C:\Windows\System\pjLlnoE.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\iOSBmXR.exe
  C:\Windows\System\iOSBmXR.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\LcYIEFA.exe
  C:\Windows\System\LcYIEFA.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\xBkmBkk.exe
  C:\Windows\System\xBkmBkk.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\sKaVivt.exe
  C:\Windows\System\sKaVivt.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\kOaeQMV.exe
  C:\Windows\System\kOaeQMV.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\MqJfDDc.exe
  C:\Windows\System\MqJfDDc.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\SkJyCun.exe
  C:\Windows\System\SkJyCun.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\OtTNBiB.exe
  C:\Windows\System\OtTNBiB.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\NQYeuUz.exe
  C:\Windows\System\NQYeuUz.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\BHzncfE.exe
  C:\Windows\System\BHzncfE.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\hHKLCSG.exe
  C:\Windows\System\hHKLCSG.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\lIhBfYp.exe
  C:\Windows\System\lIhBfYp.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\ZcIcoxg.exe
  C:\Windows\System\ZcIcoxg.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\DCOcHax.exe
  C:\Windows\System\DCOcHax.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\LWHwLar.exe
  C:\Windows\System\LWHwLar.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\jdCnrWw.exe
  C:\Windows\System\jdCnrWw.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\aCwlpqA.exe
  C:\Windows\System\aCwlpqA.exe
  2⤵
  PID:2496
- C:\Windows\System\DlermCd.exe
  C:\Windows\System\DlermCd.exe
  2⤵
  PID:4960
- C:\Windows\System\FYnPKtC.exe
  C:\Windows\System\FYnPKtC.exe
  2⤵
  PID:2464
- C:\Windows\System\psshtHo.exe
  C:\Windows\System\psshtHo.exe
  2⤵
  PID:3568
- C:\Windows\System\ZxdhueC.exe
  C:\Windows\System\ZxdhueC.exe
  2⤵
  PID:2964
- C:\Windows\System\ZZLyBqM.exe
  C:\Windows\System\ZZLyBqM.exe
  2⤵
  PID:2640
- C:\Windows\System\lsWePCi.exe
  C:\Windows\System\lsWePCi.exe
  2⤵
  PID:2672
- C:\Windows\System\yFSEwqA.exe
  C:\Windows\System\yFSEwqA.exe
  2⤵
  PID:4620
- C:\Windows\System\EUXoQMo.exe
  C:\Windows\System\EUXoQMo.exe
  2⤵
  PID:4100
- C:\Windows\System\FnYVsLr.exe
  C:\Windows\System\FnYVsLr.exe
  2⤵
  PID:4452
- C:\Windows\System\VJAyUIL.exe
  C:\Windows\System\VJAyUIL.exe
  2⤵
  PID:3596
- C:\Windows\System\mgCbKNI.exe
  C:\Windows\System\mgCbKNI.exe
  2⤵
  PID:1692
- C:\Windows\System\zmGUnaB.exe
  C:\Windows\System\zmGUnaB.exe
  2⤵
  PID:3652
- C:\Windows\System\xWpaJDS.exe
  C:\Windows\System\xWpaJDS.exe
  2⤵
  PID:536
- C:\Windows\System\hxNjROa.exe
  C:\Windows\System\hxNjROa.exe
  2⤵
  PID:3420
- C:\Windows\System\zwwHKqO.exe
  C:\Windows\System\zwwHKqO.exe
  2⤵
  PID:3768
- C:\Windows\System\NJukxhp.exe
  C:\Windows\System\NJukxhp.exe
  2⤵
  PID:4304
- C:\Windows\System\KCPajZf.exe
  C:\Windows\System\KCPajZf.exe
  2⤵
  PID:760
- C:\Windows\System\wEhXBEs.exe
  C:\Windows\System\wEhXBEs.exe
  2⤵
  PID:1276
- C:\Windows\System\gVMqgAe.exe
  C:\Windows\System\gVMqgAe.exe
  2⤵
  PID:4360
- C:\Windows\System\MOHUIVv.exe
  C:\Windows\System\MOHUIVv.exe
  2⤵
  PID:3388
- C:\Windows\System\uBSiMjk.exe
  C:\Windows\System\uBSiMjk.exe
  2⤵
  PID:3040
- C:\Windows\System\WlvQRCB.exe
  C:\Windows\System\WlvQRCB.exe
  2⤵
  PID:4776
- C:\Windows\System\iloTtBw.exe
  C:\Windows\System\iloTtBw.exe
  2⤵
  PID:1304
- C:\Windows\System\aLZXWZh.exe
  C:\Windows\System\aLZXWZh.exe
  2⤵
  PID:4612
- C:\Windows\System\RgWyQDo.exe
  C:\Windows\System\RgWyQDo.exe
  2⤵
  PID:3268
- C:\Windows\System\MiTPqFn.exe
  C:\Windows\System\MiTPqFn.exe
  2⤵
  PID:2240
- C:\Windows\System\TBvvJEv.exe
  C:\Windows\System\TBvvJEv.exe
  2⤵
  PID:4640
- C:\Windows\System\ORfXnha.exe
  C:\Windows\System\ORfXnha.exe
  2⤵
  PID:4752
- C:\Windows\System\sprSBIV.exe
  C:\Windows\System\sprSBIV.exe
  2⤵
  PID:2176
- C:\Windows\System\jLgUvLT.exe
  C:\Windows\System\jLgUvLT.exe
  2⤵
  PID:2148
- C:\Windows\System\USwxvdw.exe
  C:\Windows\System\USwxvdw.exe
  2⤵
  PID:3520
- C:\Windows\System\QbuJrvG.exe
  C:\Windows\System\QbuJrvG.exe
  2⤵
  PID:3144
- C:\Windows\System\obvqFOG.exe
  C:\Windows\System\obvqFOG.exe
  2⤵
  PID:1992
- C:\Windows\System\UGvHWql.exe
  C:\Windows\System\UGvHWql.exe
  2⤵
  PID:5052
- C:\Windows\System\WSTqeIm.exe
  C:\Windows\System\WSTqeIm.exe
  2⤵
  PID:4932
- C:\Windows\System\NvmoEog.exe
  C:\Windows\System\NvmoEog.exe
  2⤵
  PID:3360
- C:\Windows\System\CoiEHDy.exe
  C:\Windows\System\CoiEHDy.exe
  2⤵
  PID:4556
- C:\Windows\System\PqyQWYa.exe
  C:\Windows\System\PqyQWYa.exe
  2⤵
  PID:2304
- C:\Windows\System\lPhUOFV.exe
  C:\Windows\System\lPhUOFV.exe
  2⤵
  PID:5152
- C:\Windows\System\gBTYWoM.exe
  C:\Windows\System\gBTYWoM.exe
  2⤵
  PID:5176
- C:\Windows\System\mFdnxtF.exe
  C:\Windows\System\mFdnxtF.exe
  2⤵
  PID:5200
- C:\Windows\System\enHlxjS.exe
  C:\Windows\System\enHlxjS.exe
  2⤵
  PID:5224
- C:\Windows\System\TATygMv.exe
  C:\Windows\System\TATygMv.exe
  2⤵
  PID:5252
- C:\Windows\System\Yuvcsex.exe
  C:\Windows\System\Yuvcsex.exe
  2⤵
  PID:5276
- C:\Windows\System\vZMAOWg.exe
  C:\Windows\System\vZMAOWg.exe
  2⤵
  PID:5300
- C:\Windows\System\mGsNpDA.exe
  C:\Windows\System\mGsNpDA.exe
  2⤵
  PID:5328
- C:\Windows\System\cydiQip.exe
  C:\Windows\System\cydiQip.exe
  2⤵
  PID:5352
- C:\Windows\System\alBTEyF.exe
  C:\Windows\System\alBTEyF.exe
  2⤵
  PID:5376
- C:\Windows\System\gueNxJZ.exe
  C:\Windows\System\gueNxJZ.exe
  2⤵
  PID:5400
- C:\Windows\System\sypfIKo.exe
  C:\Windows\System\sypfIKo.exe
  2⤵
  PID:5424
- C:\Windows\System\GOFEptq.exe
  C:\Windows\System\GOFEptq.exe
  2⤵
  PID:5452
- C:\Windows\System\SRfObCZ.exe
  C:\Windows\System\SRfObCZ.exe
  2⤵
  PID:5468
- C:\Windows\System\lqCDGzn.exe
  C:\Windows\System\lqCDGzn.exe
  2⤵
  PID:5496
- C:\Windows\System\GNqyhOR.exe
  C:\Windows\System\GNqyhOR.exe
  2⤵
  PID:5516
- C:\Windows\System\WayPdgM.exe
  C:\Windows\System\WayPdgM.exe
  2⤵
  PID:5540
- C:\Windows\System\cGVsQvi.exe
  C:\Windows\System\cGVsQvi.exe
  2⤵
  PID:5564
- C:\Windows\System\eqoZnRA.exe
  C:\Windows\System\eqoZnRA.exe
  2⤵
  PID:5588
- C:\Windows\System\xEAbxaQ.exe
  C:\Windows\System\xEAbxaQ.exe
  2⤵
  PID:5612
- C:\Windows\System\FZwDWwj.exe
  C:\Windows\System\FZwDWwj.exe
  2⤵
  PID:5632
- C:\Windows\System\EqsDSsG.exe
  C:\Windows\System\EqsDSsG.exe
  2⤵
  PID:5648
- C:\Windows\System\BGYtkGV.exe
  C:\Windows\System\BGYtkGV.exe
  2⤵
  PID:5676
- C:\Windows\System\EEXpNpt.exe
  C:\Windows\System\EEXpNpt.exe
  2⤵
  PID:5696
- C:\Windows\System\GEhugUP.exe
  C:\Windows\System\GEhugUP.exe
  2⤵
  PID:5724
- C:\Windows\System\vlqPNvD.exe
  C:\Windows\System\vlqPNvD.exe
  2⤵
  PID:5748
- C:\Windows\System\BQOJJFt.exe
  C:\Windows\System\BQOJJFt.exe
  2⤵
  PID:5776
- C:\Windows\System\CdMUxeW.exe
  C:\Windows\System\CdMUxeW.exe
  2⤵
  PID:5804
- C:\Windows\System\OcLavjS.exe
  C:\Windows\System\OcLavjS.exe
  2⤵
  PID:5828
- C:\Windows\System\zTklWCs.exe
  C:\Windows\System\zTklWCs.exe
  2⤵
  PID:5844
- C:\Windows\System\uyRTwxR.exe
  C:\Windows\System\uyRTwxR.exe
  2⤵
  PID:5876
- C:\Windows\System\dtgyTFe.exe
  C:\Windows\System\dtgyTFe.exe
  2⤵
  PID:5896
- C:\Windows\System\iYDgidh.exe
  C:\Windows\System\iYDgidh.exe
  2⤵
  PID:5916
- C:\Windows\System\LEDtPfF.exe
  C:\Windows\System\LEDtPfF.exe
  2⤵
  PID:5936
- C:\Windows\System\rmmPsDA.exe
  C:\Windows\System\rmmPsDA.exe
  2⤵
  PID:5960
- C:\Windows\System\EfAXTPi.exe
  C:\Windows\System\EfAXTPi.exe
  2⤵
  PID:5980
- C:\Windows\System\dhzFRTc.exe
  C:\Windows\System\dhzFRTc.exe
  2⤵
  PID:6004
- C:\Windows\System\IvDlwBt.exe
  C:\Windows\System\IvDlwBt.exe
  2⤵
  PID:6028
- C:\Windows\System\JeHkJCW.exe
  C:\Windows\System\JeHkJCW.exe
  2⤵
  PID:6052
- C:\Windows\System\SIzhMsu.exe
  C:\Windows\System\SIzhMsu.exe
  2⤵
  PID:6072
- C:\Windows\System\czyZWuA.exe
  C:\Windows\System\czyZWuA.exe
  2⤵
  PID:6096
- C:\Windows\System\qpdTdqi.exe
  C:\Windows\System\qpdTdqi.exe
  2⤵
  PID:6124
- C:\Windows\System\osovutH.exe
  C:\Windows\System\osovutH.exe
  2⤵
  PID:3984
- C:\Windows\System\OCkSxxH.exe
  C:\Windows\System\OCkSxxH.exe
  2⤵
  PID:3760
- C:\Windows\System\LhOPMPT.exe
  C:\Windows\System\LhOPMPT.exe
  2⤵
  PID:4488
- C:\Windows\System\YyWBvaB.exe
  C:\Windows\System\YyWBvaB.exe
  2⤵
  PID:3720
- C:\Windows\System\EVUKdIo.exe
  C:\Windows\System\EVUKdIo.exe
  2⤵
  PID:1252
- C:\Windows\System\IPYebwJ.exe
  C:\Windows\System\IPYebwJ.exe
  2⤵
  PID:4476
- C:\Windows\System\JLpHGLi.exe
  C:\Windows\System\JLpHGLi.exe
  2⤵
  PID:4872
- C:\Windows\System\vbNZUeT.exe
  C:\Windows\System\vbNZUeT.exe
  2⤵
  PID:5244
- C:\Windows\System\xAMZLby.exe
  C:\Windows\System\xAMZLby.exe
  2⤵
  PID:5308
- C:\Windows\System\tHOUPKB.exe
  C:\Windows\System\tHOUPKB.exe
  2⤵
  PID:3220
- C:\Windows\System\xXivuqP.exe
  C:\Windows\System\xXivuqP.exe
  2⤵
  PID:3092
- C:\Windows\System\JWXeqMA.exe
  C:\Windows\System\JWXeqMA.exe
  2⤵
  PID:5408
- C:\Windows\System\pHvOWgH.exe
  C:\Windows\System\pHvOWgH.exe
  2⤵
  PID:5444
- C:\Windows\System\dhXeTGg.exe
  C:\Windows\System\dhXeTGg.exe
  2⤵
  PID:5476
- C:\Windows\System\UBztDAQ.exe
  C:\Windows\System\UBztDAQ.exe
  2⤵
  PID:5552
- C:\Windows\System\fuUAZhT.exe
  C:\Windows\System\fuUAZhT.exe
  2⤵
  PID:5600
- C:\Windows\System\PRaYNiB.exe
  C:\Windows\System\PRaYNiB.exe
  2⤵
  PID:5640
- C:\Windows\System\AFyLhOA.exe
  C:\Windows\System\AFyLhOA.exe
  2⤵
  PID:5692
- C:\Windows\System\fFlqJMd.exe
  C:\Windows\System\fFlqJMd.exe
  2⤵
  PID:5796
- C:\Windows\System\FuWdHCA.exe
  C:\Windows\System\FuWdHCA.exe
  2⤵
  PID:5840
- C:\Windows\System\QdYJgjY.exe
  C:\Windows\System\QdYJgjY.exe
  2⤵
  PID:5904
- C:\Windows\System\VnMtVMg.exe
  C:\Windows\System\VnMtVMg.exe
  2⤵
  PID:5932
- C:\Windows\System\JEYzQSd.exe
  C:\Windows\System\JEYzQSd.exe
  2⤵
  PID:5704
- C:\Windows\System\arYbhGY.exe
  C:\Windows\System\arYbhGY.exe
  2⤵
  PID:5744
- C:\Windows\System\GNbaonA.exe
  C:\Windows\System\GNbaonA.exe
  2⤵
  PID:5788
- C:\Windows\System\LNHLKYC.exe
  C:\Windows\System\LNHLKYC.exe
  2⤵
  PID:5864
- C:\Windows\System\tCECTYM.exe
  C:\Windows\System\tCECTYM.exe
  2⤵
  PID:5124
- C:\Windows\System\SVbpLxx.exe
  C:\Windows\System\SVbpLxx.exe
  2⤵
  PID:5928
- C:\Windows\System\ObwsvYw.exe
  C:\Windows\System\ObwsvYw.exe
  2⤵
  PID:5420
- C:\Windows\System\Nrhjyxk.exe
  C:\Windows\System\Nrhjyxk.exe
  2⤵
  PID:5460
- C:\Windows\System\GYnwLHE.exe
  C:\Windows\System\GYnwLHE.exe
  2⤵
  PID:6068
- C:\Windows\System\dFYQeQL.exe
  C:\Windows\System\dFYQeQL.exe
  2⤵
  PID:5572
- C:\Windows\System\TvKSlit.exe
  C:\Windows\System\TvKSlit.exe
  2⤵
  PID:6152
- C:\Windows\System\NqaBYeF.exe
  C:\Windows\System\NqaBYeF.exe
  2⤵
  PID:6168
- C:\Windows\System\RluJjMM.exe
  C:\Windows\System\RluJjMM.exe
  2⤵
  PID:6188
- C:\Windows\System\YmHNtEk.exe
  C:\Windows\System\YmHNtEk.exe
  2⤵
  PID:6212
- C:\Windows\System\RizTxpj.exe
  C:\Windows\System\RizTxpj.exe
  2⤵
  PID:6236
- C:\Windows\System\GLzxOzu.exe
  C:\Windows\System\GLzxOzu.exe
  2⤵
  PID:6264
- C:\Windows\System\EmhCyRU.exe
  C:\Windows\System\EmhCyRU.exe
  2⤵
  PID:6284
- C:\Windows\System\RjfkDjz.exe
  C:\Windows\System\RjfkDjz.exe
  2⤵
  PID:6312
- C:\Windows\System\YjmyYHS.exe
  C:\Windows\System\YjmyYHS.exe
  2⤵
  PID:6328
- C:\Windows\System\fOXEsQb.exe
  C:\Windows\System\fOXEsQb.exe
  2⤵
  PID:6352
- C:\Windows\System\NYdhTYw.exe
  C:\Windows\System\NYdhTYw.exe
  2⤵
  PID:6376
- C:\Windows\System\mWilbSB.exe
  C:\Windows\System\mWilbSB.exe
  2⤵
  PID:6396
- C:\Windows\System\YeakBFP.exe
  C:\Windows\System\YeakBFP.exe
  2⤵
  PID:6416
- C:\Windows\System\dZQmxYG.exe
  C:\Windows\System\dZQmxYG.exe
  2⤵
  PID:6436
- C:\Windows\System\XIHGLwv.exe
  C:\Windows\System\XIHGLwv.exe
  2⤵
  PID:6456
- C:\Windows\System\IojqyvM.exe
  C:\Windows\System\IojqyvM.exe
  2⤵
  PID:6476
- C:\Windows\System\FZgLWdA.exe
  C:\Windows\System\FZgLWdA.exe
  2⤵
  PID:6500
- C:\Windows\System\adRDAho.exe
  C:\Windows\System\adRDAho.exe
  2⤵
  PID:6520
- C:\Windows\System\UBEyUvF.exe
  C:\Windows\System\UBEyUvF.exe
  2⤵
  PID:6548
- C:\Windows\System\KMULwjh.exe
  C:\Windows\System\KMULwjh.exe
  2⤵
  PID:6572
- C:\Windows\System\tkfZHnD.exe
  C:\Windows\System\tkfZHnD.exe
  2⤵
  PID:6596
- C:\Windows\System\ynjRRHh.exe
  C:\Windows\System\ynjRRHh.exe
  2⤵
  PID:6620
- C:\Windows\System\JDARUWQ.exe
  C:\Windows\System\JDARUWQ.exe
  2⤵
  PID:6648
- C:\Windows\System\FPKvbNA.exe
  C:\Windows\System\FPKvbNA.exe
  2⤵
  PID:6672
- C:\Windows\System\RyxgfwJ.exe
  C:\Windows\System\RyxgfwJ.exe
  2⤵
  PID:6696
- C:\Windows\System\qSDBOdn.exe
  C:\Windows\System\qSDBOdn.exe
  2⤵
  PID:6716
- C:\Windows\System\anhPTRL.exe
  C:\Windows\System\anhPTRL.exe
  2⤵
  PID:6740
- C:\Windows\System\elaawZQ.exe
  C:\Windows\System\elaawZQ.exe
  2⤵
  PID:6760
- C:\Windows\System\oKcjiLo.exe
  C:\Windows\System\oKcjiLo.exe
  2⤵
  PID:6796
- C:\Windows\System\JpafGiW.exe
  C:\Windows\System\JpafGiW.exe
  2⤵
  PID:6820
- C:\Windows\System\fqIIOQE.exe
  C:\Windows\System\fqIIOQE.exe
  2⤵
  PID:6840
- C:\Windows\System\GxTAKoo.exe
  C:\Windows\System\GxTAKoo.exe
  2⤵
  PID:6868
- C:\Windows\System\XIvrvOn.exe
  C:\Windows\System\XIvrvOn.exe
  2⤵
  PID:6884
- C:\Windows\System\nhTPRBb.exe
  C:\Windows\System\nhTPRBb.exe
  2⤵
  PID:6904
- C:\Windows\System\SXJMTOI.exe
  C:\Windows\System\SXJMTOI.exe
  2⤵
  PID:6928
- C:\Windows\System\twOeYiC.exe
  C:\Windows\System\twOeYiC.exe
  2⤵
  PID:6952
- C:\Windows\System\VyYzWyN.exe
  C:\Windows\System\VyYzWyN.exe
  2⤵
  PID:6968
- C:\Windows\System\bLbyEyU.exe
  C:\Windows\System\bLbyEyU.exe
  2⤵
  PID:6996
- C:\Windows\System\ruKZXiZ.exe
  C:\Windows\System\ruKZXiZ.exe
  2⤵
  PID:7020
- C:\Windows\System\XHIrnqm.exe
  C:\Windows\System\XHIrnqm.exe
  2⤵
  PID:7052
- C:\Windows\System\NqfUUXi.exe
  C:\Windows\System\NqfUUXi.exe
  2⤵
  PID:7076
- C:\Windows\System\ZwIBxNJ.exe
  C:\Windows\System\ZwIBxNJ.exe
  2⤵
  PID:7096
- C:\Windows\System\AnUKPUO.exe
  C:\Windows\System\AnUKPUO.exe
  2⤵
  PID:7116
- C:\Windows\System\sZozErj.exe
  C:\Windows\System\sZozErj.exe
  2⤵
  PID:7140
- C:\Windows\System\cpebEps.exe
  C:\Windows\System\cpebEps.exe
  2⤵
  PID:7164
- C:\Windows\System\isPeoNl.exe
  C:\Windows\System\isPeoNl.exe
  2⤵
  PID:6000
- C:\Windows\System\jJaRgtB.exe
  C:\Windows\System\jJaRgtB.exe
  2⤵
  PID:4700
- C:\Windows\System\VNFQkxc.exe
  C:\Windows\System\VNFQkxc.exe
  2⤵
  PID:5220
- C:\Windows\System\zpzxgJU.exe
  C:\Windows\System\zpzxgJU.exe
  2⤵
  PID:1008
- C:\Windows\System\crUQcod.exe
  C:\Windows\System\crUQcod.exe
  2⤵
  PID:5548
- C:\Windows\System\ilhycYa.exe
  C:\Windows\System\ilhycYa.exe
  2⤵
  PID:5620
- C:\Windows\System\WgrJddm.exe
  C:\Windows\System\WgrJddm.exe
  2⤵
  PID:5820
- C:\Windows\System\FyegiVO.exe
  C:\Windows\System\FyegiVO.exe
  2⤵
  PID:6208
- C:\Windows\System\cHBFSlR.exe
  C:\Windows\System\cHBFSlR.exe
  2⤵
  PID:6276
- C:\Windows\System\vVjiuua.exe
  C:\Windows\System\vVjiuua.exe
  2⤵
  PID:5736
- C:\Windows\System\XRdUpfW.exe
  C:\Windows\System\XRdUpfW.exe
  2⤵
  PID:6372
- C:\Windows\System\nyTBlVT.exe
  C:\Windows\System\nyTBlVT.exe
  2⤵
  PID:6472
- C:\Windows\System\OUSKIrj.exe
  C:\Windows\System\OUSKIrj.exe
  2⤵
  PID:6556
- C:\Windows\System\ENHwMUl.exe
  C:\Windows\System\ENHwMUl.exe
  2⤵
  PID:5392
- C:\Windows\System\YLsJVZQ.exe
  C:\Windows\System\YLsJVZQ.exe
  2⤵
  PID:6684
- C:\Windows\System\cFTxUAQ.exe
  C:\Windows\System\cFTxUAQ.exe
  2⤵
  PID:6776
- C:\Windows\System\TLLYKbM.exe
  C:\Windows\System\TLLYKbM.exe
  2⤵
  PID:6892
- C:\Windows\System\WroIpqN.exe
  C:\Windows\System\WroIpqN.exe
  2⤵
  PID:6948
- C:\Windows\System\OBadVMW.exe
  C:\Windows\System\OBadVMW.exe
  2⤵
  PID:7188
- C:\Windows\System\qiveviZ.exe
  C:\Windows\System\qiveviZ.exe
  2⤵
  PID:7216
- C:\Windows\System\xXeEpRU.exe
  C:\Windows\System\xXeEpRU.exe
  2⤵
  PID:7240
- C:\Windows\System\NuYVTDc.exe
  C:\Windows\System\NuYVTDc.exe
  2⤵
  PID:7260
- C:\Windows\System\HqgjSLK.exe
  C:\Windows\System\HqgjSLK.exe
  2⤵
  PID:7284
- C:\Windows\System\jDEFFAK.exe
  C:\Windows\System\jDEFFAK.exe
  2⤵
  PID:7312
- C:\Windows\System\bcnXinf.exe
  C:\Windows\System\bcnXinf.exe
  2⤵
  PID:7328
- C:\Windows\System\JzsxMLT.exe
  C:\Windows\System\JzsxMLT.exe
  2⤵
  PID:7348
- C:\Windows\System\wtQZmeV.exe
  C:\Windows\System\wtQZmeV.exe
  2⤵
  PID:7372
- C:\Windows\System\vSufFCl.exe
  C:\Windows\System\vSufFCl.exe
  2⤵
  PID:7392
- C:\Windows\System\UzdSkZY.exe
  C:\Windows\System\UzdSkZY.exe
  2⤵
  PID:7416
- C:\Windows\System\CNDFvNl.exe
  C:\Windows\System\CNDFvNl.exe
  2⤵
  PID:7440
- C:\Windows\System\SIGOSZS.exe
  C:\Windows\System\SIGOSZS.exe
  2⤵
  PID:7460
- C:\Windows\System\jSvUcxm.exe
  C:\Windows\System\jSvUcxm.exe
  2⤵
  PID:7484
- C:\Windows\System\zrjCccb.exe
  C:\Windows\System\zrjCccb.exe
  2⤵
  PID:7508
- C:\Windows\System\vMyWiDx.exe
  C:\Windows\System\vMyWiDx.exe
  2⤵
  PID:7536
- C:\Windows\System\nvBXjQn.exe
  C:\Windows\System\nvBXjQn.exe
  2⤵
  PID:7556
- C:\Windows\System\pZobCwv.exe
  C:\Windows\System\pZobCwv.exe
  2⤵
  PID:7576
- C:\Windows\System\hKxeQKX.exe
  C:\Windows\System\hKxeQKX.exe
  2⤵
  PID:7600
- C:\Windows\System\TpTdwHG.exe
  C:\Windows\System\TpTdwHG.exe
  2⤵
  PID:7620
- C:\Windows\System\xLbxubV.exe
  C:\Windows\System\xLbxubV.exe
  2⤵
  PID:7640
- C:\Windows\System\rdRwTSS.exe
  C:\Windows\System\rdRwTSS.exe
  2⤵
  PID:7664
- C:\Windows\System\XowThOc.exe
  C:\Windows\System\XowThOc.exe
  2⤵
  PID:7684
- C:\Windows\System\DOELjRs.exe
  C:\Windows\System\DOELjRs.exe
  2⤵
  PID:7712
- C:\Windows\System\hbhLfsZ.exe
  C:\Windows\System\hbhLfsZ.exe
  2⤵
  PID:7736
- C:\Windows\System\wBGVwMy.exe
  C:\Windows\System\wBGVwMy.exe
  2⤵
  PID:7756
- C:\Windows\System\zEOpSJl.exe
  C:\Windows\System\zEOpSJl.exe
  2⤵
  PID:7776
- C:\Windows\System\HQQnLri.exe
  C:\Windows\System\HQQnLri.exe
  2⤵
  PID:7796
- C:\Windows\System\FSyqrpH.exe
  C:\Windows\System\FSyqrpH.exe
  2⤵
  PID:7824
- C:\Windows\System\RCtToDE.exe
  C:\Windows\System\RCtToDE.exe
  2⤵
  PID:7844
- C:\Windows\System\AsYjTAG.exe
  C:\Windows\System\AsYjTAG.exe
  2⤵
  PID:7868
- C:\Windows\System\QMhAkkZ.exe
  C:\Windows\System\QMhAkkZ.exe
  2⤵
  PID:7896
- C:\Windows\System\dRaajRo.exe
  C:\Windows\System\dRaajRo.exe
  2⤵
  PID:7916
- C:\Windows\System\GNbSajD.exe
  C:\Windows\System\GNbSajD.exe
  2⤵
  PID:7936
- C:\Windows\System\iQNZSuB.exe
  C:\Windows\System\iQNZSuB.exe
  2⤵
  PID:7960
- C:\Windows\System\SnScdpl.exe
  C:\Windows\System\SnScdpl.exe
  2⤵
  PID:7984
- C:\Windows\System\fMMJcnS.exe
  C:\Windows\System\fMMJcnS.exe
  2⤵
  PID:8008
- C:\Windows\System\dSlxNnM.exe
  C:\Windows\System\dSlxNnM.exe
  2⤵
  PID:8036
- C:\Windows\System\LVjmzRr.exe
  C:\Windows\System\LVjmzRr.exe
  2⤵
  PID:8056
- C:\Windows\System\bNqrpMu.exe
  C:\Windows\System\bNqrpMu.exe
  2⤵
  PID:8084
- C:\Windows\System\OunPLwb.exe
  C:\Windows\System\OunPLwb.exe
  2⤵
  PID:8112
- C:\Windows\System\ezPSEDf.exe
  C:\Windows\System\ezPSEDf.exe
  2⤵
  PID:8132
- C:\Windows\System\fSewjvX.exe
  C:\Windows\System\fSewjvX.exe
  2⤵
  PID:8152
- C:\Windows\System\HBnsKax.exe
  C:\Windows\System\HBnsKax.exe
  2⤵
  PID:8180
- C:\Windows\System\UiakwSc.exe
  C:\Windows\System\UiakwSc.exe
  2⤵
  PID:7008
- C:\Windows\System\mHpNXpG.exe
  C:\Windows\System\mHpNXpG.exe
  2⤵
  PID:7084
- C:\Windows\System\QOMhhUi.exe
  C:\Windows\System\QOMhhUi.exe
  2⤵
  PID:6392
- C:\Windows\System\ExIaJRY.exe
  C:\Windows\System\ExIaJRY.exe
  2⤵
  PID:2316
- C:\Windows\System\uciBLjI.exe
  C:\Windows\System\uciBLjI.exe
  2⤵
  PID:5952
- C:\Windows\System\rAuJFtL.exe
  C:\Windows\System\rAuJFtL.exe
  2⤵
  PID:6592
- C:\Windows\System\FGTSMIn.exe
  C:\Windows\System\FGTSMIn.exe
  2⤵
  PID:6184
- C:\Windows\System\RkHtVgo.exe
  C:\Windows\System\RkHtVgo.exe
  2⤵
  PID:6640
- C:\Windows\System\bcScCLx.exe
  C:\Windows\System\bcScCLx.exe
  2⤵
  PID:5320
- C:\Windows\System\kUfMwJf.exe
  C:\Windows\System\kUfMwJf.exe
  2⤵
  PID:6568
- C:\Windows\System\YpuBuBu.exe
  C:\Windows\System\YpuBuBu.exe
  2⤵
  PID:6228
- C:\Windows\System\AGFPpcW.exe
  C:\Windows\System\AGFPpcW.exe
  2⤵
  PID:6680
- C:\Windows\System\KHquGll.exe
  C:\Windows\System\KHquGll.exe
  2⤵
  PID:6900
- C:\Windows\System\sqdfqsZ.exe
  C:\Windows\System\sqdfqsZ.exe
  2⤵
  PID:7272
- C:\Windows\System\widOCoW.exe
  C:\Windows\System\widOCoW.exe
  2⤵
  PID:7160
- C:\Windows\System\LHcaUNe.exe
  C:\Windows\System\LHcaUNe.exe
  2⤵
  PID:5492
- C:\Windows\System\TPDtpBG.exe
  C:\Windows\System\TPDtpBG.exe
  2⤵
  PID:6492
- C:\Windows\System\ULSkxjr.exe
  C:\Windows\System\ULSkxjr.exe
  2⤵
  PID:6512
- C:\Windows\System\DSvsoVc.exe
  C:\Windows\System\DSvsoVc.exe
  2⤵
  PID:6180
- C:\Windows\System\lOpFBPj.exe
  C:\Windows\System\lOpFBPj.exe
  2⤵
  PID:6768
- C:\Windows\System\ylprsOn.exe
  C:\Windows\System\ylprsOn.exe
  2⤵
  PID:8200
- C:\Windows\System\tPmMMjs.exe
  C:\Windows\System\tPmMMjs.exe
  2⤵
  PID:8220
- C:\Windows\System\UMuBuJp.exe
  C:\Windows\System\UMuBuJp.exe
  2⤵
  PID:8240
- C:\Windows\System\BygxWyx.exe
  C:\Windows\System\BygxWyx.exe
  2⤵
  PID:8264
- C:\Windows\System\bLysJiR.exe
  C:\Windows\System\bLysJiR.exe
  2⤵
  PID:8288
- C:\Windows\System\wrccZue.exe
  C:\Windows\System\wrccZue.exe
  2⤵
  PID:8308
- C:\Windows\System\VYoUxsQ.exe
  C:\Windows\System\VYoUxsQ.exe
  2⤵
  PID:8332
- C:\Windows\System\ghqTukC.exe
  C:\Windows\System\ghqTukC.exe
  2⤵
  PID:8352
- C:\Windows\System\KHhUGDk.exe
  C:\Windows\System\KHhUGDk.exe
  2⤵
  PID:8384
- C:\Windows\System\XMnmQMr.exe
  C:\Windows\System\XMnmQMr.exe
  2⤵
  PID:8404
- C:\Windows\System\IVDWdIz.exe
  C:\Windows\System\IVDWdIz.exe
  2⤵
  PID:8424
- C:\Windows\System\bUzllhl.exe
  C:\Windows\System\bUzllhl.exe
  2⤵
  PID:8448
- C:\Windows\System\aAwyIwA.exe
  C:\Windows\System\aAwyIwA.exe
  2⤵
  PID:8472
- C:\Windows\System\ECUEOgb.exe
  C:\Windows\System\ECUEOgb.exe
  2⤵
  PID:8496
- C:\Windows\System\qoXcWbb.exe
  C:\Windows\System\qoXcWbb.exe
  2⤵
  PID:8516
- C:\Windows\System\xAEoFwd.exe
  C:\Windows\System\xAEoFwd.exe
  2⤵
  PID:8536
- C:\Windows\System\pWKtAHf.exe
  C:\Windows\System\pWKtAHf.exe
  2⤵
  PID:8564
- C:\Windows\System\yOprlsJ.exe
  C:\Windows\System\yOprlsJ.exe
  2⤵
  PID:8588
- C:\Windows\System\qjhTUNY.exe
  C:\Windows\System\qjhTUNY.exe
  2⤵
  PID:8604
- C:\Windows\System\KbbgDfP.exe
  C:\Windows\System\KbbgDfP.exe
  2⤵
  PID:8624
- C:\Windows\System\JrmyJUZ.exe
  C:\Windows\System\JrmyJUZ.exe
  2⤵
  PID:8640
- C:\Windows\System\sieMsvY.exe
  C:\Windows\System\sieMsvY.exe
  2⤵
  PID:8664
- C:\Windows\System\tSfoFsL.exe
  C:\Windows\System\tSfoFsL.exe
  2⤵
  PID:8688
- C:\Windows\System\blcqaKe.exe
  C:\Windows\System\blcqaKe.exe
  2⤵
  PID:8712
- C:\Windows\System\sbYfABH.exe
  C:\Windows\System\sbYfABH.exe
  2⤵
  PID:8740
- C:\Windows\System\LKhYHMq.exe
  C:\Windows\System\LKhYHMq.exe
  2⤵
  PID:8764
- C:\Windows\System\KLlRzMh.exe
  C:\Windows\System\KLlRzMh.exe
  2⤵
  PID:8796
- C:\Windows\System\AbmSmRU.exe
  C:\Windows\System\AbmSmRU.exe
  2⤵
  PID:8820
- C:\Windows\System\gJAtZdN.exe
  C:\Windows\System\gJAtZdN.exe
  2⤵
  PID:8844
- C:\Windows\System\VuywiYh.exe
  C:\Windows\System\VuywiYh.exe
  2⤵
  PID:8872
- C:\Windows\System\wprTraK.exe
  C:\Windows\System\wprTraK.exe
  2⤵
  PID:8900
- C:\Windows\System\cnZxlyA.exe
  C:\Windows\System\cnZxlyA.exe
  2⤵
  PID:8920
- C:\Windows\System\SOHhZYu.exe
  C:\Windows\System\SOHhZYu.exe
  2⤵
  PID:8944
- C:\Windows\System\SlgURfa.exe
  C:\Windows\System\SlgURfa.exe
  2⤵
  PID:8972
- C:\Windows\System\ArjoICw.exe
  C:\Windows\System\ArjoICw.exe
  2⤵
  PID:8996
- C:\Windows\System\mVhXFEB.exe
  C:\Windows\System\mVhXFEB.exe
  2⤵
  PID:9024
- C:\Windows\System\pCLYHcC.exe
  C:\Windows\System\pCLYHcC.exe
  2⤵
  PID:9044
- C:\Windows\System\IORxfSx.exe
  C:\Windows\System\IORxfSx.exe
  2⤵
  PID:9072
- C:\Windows\System\vtVVlEm.exe
  C:\Windows\System\vtVVlEm.exe
  2⤵
  PID:9100
- C:\Windows\System\lBODYDc.exe
  C:\Windows\System\lBODYDc.exe
  2⤵
  PID:9120
- C:\Windows\System\EWiAPgN.exe
  C:\Windows\System\EWiAPgN.exe
  2⤵
  PID:9144
- C:\Windows\System\UhZXWAD.exe
  C:\Windows\System\UhZXWAD.exe
  2⤵
  PID:9172
- C:\Windows\System\cbbsiTn.exe
  C:\Windows\System\cbbsiTn.exe
  2⤵
  PID:9192
- C:\Windows\System\XVIdsFL.exe
  C:\Windows\System\XVIdsFL.exe
  2⤵
  PID:7636
- C:\Windows\System\gqyQIpK.exe
  C:\Windows\System\gqyQIpK.exe
  2⤵
  PID:7692
- C:\Windows\System\SCYFCrd.exe
  C:\Windows\System\SCYFCrd.exe
  2⤵
  PID:6848
- C:\Windows\System\HVQAcMa.exe
  C:\Windows\System\HVQAcMa.exe
  2⤵
  PID:6668
- C:\Windows\System\YhtVvPg.exe
  C:\Windows\System\YhtVvPg.exe
  2⤵
  PID:7816
- C:\Windows\System\JHLXjAl.exe
  C:\Windows\System\JHLXjAl.exe
  2⤵
  PID:6936
- C:\Windows\System\kIGUZhd.exe
  C:\Windows\System\kIGUZhd.exe
  2⤵
  PID:7852
- C:\Windows\System\qVgJhme.exe
  C:\Windows\System\qVgJhme.exe
  2⤵
  PID:7252
- C:\Windows\System\sNWKFst.exe
  C:\Windows\System\sNWKFst.exe
  2⤵
  PID:7980
- C:\Windows\System\qyrfBar.exe
  C:\Windows\System\qyrfBar.exe
  2⤵
  PID:8024
- C:\Windows\System\yVYNbct.exe
  C:\Windows\System\yVYNbct.exe
  2⤵
  PID:8128
- C:\Windows\System\MItIFWL.exe
  C:\Windows\System\MItIFWL.exe
  2⤵
  PID:6344
- C:\Windows\System\jbHFZpK.exe
  C:\Windows\System\jbHFZpK.exe
  2⤵
  PID:7424
- C:\Windows\System\pRjlXBe.exe
  C:\Windows\System\pRjlXBe.exe
  2⤵
  PID:6444
- C:\Windows\System\OcVwZij.exe
  C:\Windows\System\OcVwZij.exe
  2⤵
  PID:7472
- C:\Windows\System\dpPXhHf.exe
  C:\Windows\System\dpPXhHf.exe
  2⤵
  PID:7520
- C:\Windows\System\PrODCJe.exe
  C:\Windows\System\PrODCJe.exe
  2⤵
  PID:7308
- C:\Windows\System\LdwXkps.exe
  C:\Windows\System\LdwXkps.exe
  2⤵
  PID:6368
- C:\Windows\System\jFpkEDv.exe
  C:\Windows\System\jFpkEDv.exe
  2⤵
  PID:7632
- C:\Windows\System\TSFvosX.exe
  C:\Windows\System\TSFvosX.exe
  2⤵
  PID:7728
- C:\Windows\System\eJazxHr.exe
  C:\Windows\System\eJazxHr.exe
  2⤵
  PID:6752
- C:\Windows\System\peybFGx.exe
  C:\Windows\System\peybFGx.exe
  2⤵
  PID:7184
- C:\Windows\System\deuKskE.exe
  C:\Windows\System\deuKskE.exe
  2⤵
  PID:8612
- C:\Windows\System\pdGekYD.exe
  C:\Windows\System\pdGekYD.exe
  2⤵
  PID:9232
- C:\Windows\System\NviEnpB.exe
  C:\Windows\System\NviEnpB.exe
  2⤵
  PID:9256
- C:\Windows\System\jmeUnBL.exe
  C:\Windows\System\jmeUnBL.exe
  2⤵
  PID:9284
- C:\Windows\System\oEgwXaX.exe
  C:\Windows\System\oEgwXaX.exe
  2⤵
  PID:9304
- C:\Windows\System\AVrImkw.exe
  C:\Windows\System\AVrImkw.exe
  2⤵
  PID:9324
- C:\Windows\System\CikpZyH.exe
  C:\Windows\System\CikpZyH.exe
  2⤵
  PID:9348
- C:\Windows\System\jxlTamC.exe
  C:\Windows\System\jxlTamC.exe
  2⤵
  PID:9372
- C:\Windows\System\nDWxyfR.exe
  C:\Windows\System\nDWxyfR.exe
  2⤵
  PID:9392
- C:\Windows\System\GaEGGIr.exe
  C:\Windows\System\GaEGGIr.exe
  2⤵
  PID:9408
- C:\Windows\System\NhdQONO.exe
  C:\Windows\System\NhdQONO.exe
  2⤵
  PID:9424
- C:\Windows\System\fjXhsfl.exe
  C:\Windows\System\fjXhsfl.exe
  2⤵
  PID:9440
- C:\Windows\System\UOVKmRl.exe
  C:\Windows\System\UOVKmRl.exe
  2⤵
  PID:9456
- C:\Windows\System\pjSfuHz.exe
  C:\Windows\System\pjSfuHz.exe
  2⤵
  PID:9476
- C:\Windows\System\rklnKme.exe
  C:\Windows\System\rklnKme.exe
  2⤵
  PID:9500
- C:\Windows\System\hqafXtl.exe
  C:\Windows\System\hqafXtl.exe
  2⤵
  PID:9520
- C:\Windows\System\DOYOukb.exe
  C:\Windows\System\DOYOukb.exe
  2⤵
  PID:9544
- C:\Windows\System\yUdlGzi.exe
  C:\Windows\System\yUdlGzi.exe
  2⤵
  PID:9572
- C:\Windows\System\yWJVMvI.exe
  C:\Windows\System\yWJVMvI.exe
  2⤵
  PID:9596
- C:\Windows\System\VCYSAFJ.exe
  C:\Windows\System\VCYSAFJ.exe
  2⤵
  PID:9616
- C:\Windows\System\TMOBJvT.exe
  C:\Windows\System\TMOBJvT.exe
  2⤵
  PID:9644
- C:\Windows\System\cPfMnjN.exe
  C:\Windows\System\cPfMnjN.exe
  2⤵
  PID:9672
- C:\Windows\System\hcAnOdK.exe
  C:\Windows\System\hcAnOdK.exe
  2⤵
  PID:9692
- C:\Windows\System\JjORKdq.exe
  C:\Windows\System\JjORKdq.exe
  2⤵
  PID:9720
- C:\Windows\System\INNiuxW.exe
  C:\Windows\System\INNiuxW.exe
  2⤵
  PID:9736
- C:\Windows\System\wVDvRQv.exe
  C:\Windows\System\wVDvRQv.exe
  2⤵
  PID:9756
- C:\Windows\System\eztlUsX.exe
  C:\Windows\System\eztlUsX.exe
  2⤵
  PID:9780
- C:\Windows\System\kOHbhZP.exe
  C:\Windows\System\kOHbhZP.exe
  2⤵
  PID:9808
- C:\Windows\System\TLHWEgE.exe
  C:\Windows\System\TLHWEgE.exe
  2⤵
  PID:9832
- C:\Windows\System\QYzKRJc.exe
  C:\Windows\System\QYzKRJc.exe
  2⤵
  PID:9856
- C:\Windows\System\zyWQQqR.exe
  C:\Windows\System\zyWQQqR.exe
  2⤵
  PID:9876
- C:\Windows\System\fiJVPlN.exe
  C:\Windows\System\fiJVPlN.exe
  2⤵
  PID:9900
- C:\Windows\System\HzACCwp.exe
  C:\Windows\System\HzACCwp.exe
  2⤵
  PID:9924
- C:\Windows\System\AKsMiEB.exe
  C:\Windows\System\AKsMiEB.exe
  2⤵
  PID:9948
- C:\Windows\System\TGOqwvV.exe
  C:\Windows\System\TGOqwvV.exe
  2⤵
  PID:9972
- C:\Windows\System\zDQCoJS.exe
  C:\Windows\System\zDQCoJS.exe
  2⤵
  PID:10000
- C:\Windows\System\YHIeTvT.exe
  C:\Windows\System\YHIeTvT.exe
  2⤵
  PID:10040
- C:\Windows\System\TTVvmes.exe
  C:\Windows\System\TTVvmes.exe
  2⤵
  PID:10064
- C:\Windows\System\LIeEDpI.exe
  C:\Windows\System\LIeEDpI.exe
  2⤵
  PID:10088
- C:\Windows\System\cbUSMeO.exe
  C:\Windows\System\cbUSMeO.exe
  2⤵
  PID:10108
- C:\Windows\System\KWlLXpC.exe
  C:\Windows\System\KWlLXpC.exe
  2⤵
  PID:10128
- C:\Windows\System\XJttBFv.exe
  C:\Windows\System\XJttBFv.exe
  2⤵
  PID:10148
- C:\Windows\System\TQGZofB.exe
  C:\Windows\System\TQGZofB.exe
  2⤵
  PID:10168
- C:\Windows\System\pPgXFsr.exe
  C:\Windows\System\pPgXFsr.exe
  2⤵
  PID:10192
- C:\Windows\System\NAGtybX.exe
  C:\Windows\System\NAGtybX.exe
  2⤵
  PID:10216
- C:\Windows\System\TLhVlLm.exe
  C:\Windows\System\TLhVlLm.exe
  2⤵
  PID:7904
- C:\Windows\System\iJvMeaO.exe
  C:\Windows\System\iJvMeaO.exe
  2⤵
  PID:7932
- C:\Windows\System\emTmcab.exe
  C:\Windows\System\emTmcab.exe
  2⤵
  PID:8772
- C:\Windows\System\SDHTQZv.exe
  C:\Windows\System\SDHTQZv.exe
  2⤵
  PID:7324
- C:\Windows\System\NsWWWKc.exe
  C:\Windows\System\NsWWWKc.exe
  2⤵
  PID:7368
- C:\Windows\System\sYDbLUi.exe
  C:\Windows\System\sYDbLUi.exe
  2⤵
  PID:6992
- C:\Windows\System\cWhADpZ.exe
  C:\Windows\System\cWhADpZ.exe
  2⤵
  PID:6388
- C:\Windows\System\rPlLXMB.exe
  C:\Windows\System\rPlLXMB.exe
  2⤵
  PID:7448
- C:\Windows\System\VyaJSnz.exe
  C:\Windows\System\VyaJSnz.exe
  2⤵
  PID:9084
- C:\Windows\System\RVIclDt.exe
  C:\Windows\System\RVIclDt.exe
  2⤵
  PID:6832
- C:\Windows\System\hXHptUA.exe
  C:\Windows\System\hXHptUA.exe
  2⤵
  PID:7132
- C:\Windows\System\QkGkqVJ.exe
  C:\Windows\System\QkGkqVJ.exe
  2⤵
  PID:7612
- C:\Windows\System\MIVBxpp.exe
  C:\Windows\System\MIVBxpp.exe
  2⤵
  PID:7584
- C:\Windows\System\DtCLTuS.exe
  C:\Windows\System\DtCLTuS.exe
  2⤵
  PID:8252
- C:\Windows\System\DhutJxe.exe
  C:\Windows\System\DhutJxe.exe
  2⤵
  PID:7388
- C:\Windows\System\JfjRXSR.exe
  C:\Windows\System\JfjRXSR.exe
  2⤵
  PID:8456
- C:\Windows\System\AYJOQGa.exe
  C:\Windows\System\AYJOQGa.exe
  2⤵
  PID:8468
- C:\Windows\System\qkKJCkw.exe
  C:\Windows\System\qkKJCkw.exe
  2⤵
  PID:8512
- C:\Windows\System\vWTTxoV.exe
  C:\Windows\System\vWTTxoV.exe
  2⤵
  PID:8580
- C:\Windows\System\mLRPCBW.exe
  C:\Windows\System\mLRPCBW.exe
  2⤵
  PID:8416
- C:\Windows\System\NqNJuxz.exe
  C:\Windows\System\NqNJuxz.exe
  2⤵
  PID:8680
- C:\Windows\System\TqBlvog.exe
  C:\Windows\System\TqBlvog.exe
  2⤵
  PID:9248
- C:\Windows\System\YkMkHQs.exe
  C:\Windows\System\YkMkHQs.exe
  2⤵
  PID:9296
- C:\Windows\System\qYfdgwu.exe
  C:\Windows\System\qYfdgwu.exe
  2⤵
  PID:10248
- C:\Windows\System\rYjkyVw.exe
  C:\Windows\System\rYjkyVw.exe
  2⤵
  PID:10268
- C:\Windows\System\vTdAdnW.exe
  C:\Windows\System\vTdAdnW.exe
  2⤵
  PID:10288
- C:\Windows\System\TTRrDbJ.exe
  C:\Windows\System\TTRrDbJ.exe
  2⤵
  PID:10312
- C:\Windows\System\XhuHite.exe
  C:\Windows\System\XhuHite.exe
  2⤵
  PID:10336
- C:\Windows\System\DApcELh.exe
  C:\Windows\System\DApcELh.exe
  2⤵
  PID:10364
- C:\Windows\System\kJQSiOm.exe
  C:\Windows\System\kJQSiOm.exe
  2⤵
  PID:10388
- C:\Windows\System\wwDQXrC.exe
  C:\Windows\System\wwDQXrC.exe
  2⤵
  PID:10416
- C:\Windows\System\ibVuWcd.exe
  C:\Windows\System\ibVuWcd.exe
  2⤵
  PID:10444
- C:\Windows\System\ZklsFeH.exe
  C:\Windows\System\ZklsFeH.exe
  2⤵
  PID:10468
- C:\Windows\System\yYKUDfJ.exe
  C:\Windows\System\yYKUDfJ.exe
  2⤵
  PID:10496
- C:\Windows\System\MFDreFw.exe
  C:\Windows\System\MFDreFw.exe
  2⤵
  PID:10524
- C:\Windows\System\lPEkCoJ.exe
  C:\Windows\System\lPEkCoJ.exe
  2⤵
  PID:10548
- C:\Windows\System\MtscnCj.exe
  C:\Windows\System\MtscnCj.exe
  2⤵
  PID:10564
- C:\Windows\System\LAZCkbV.exe
  C:\Windows\System\LAZCkbV.exe
  2⤵
  PID:10588
- C:\Windows\System\XATxNCJ.exe
  C:\Windows\System\XATxNCJ.exe
  2⤵
  PID:10612
- C:\Windows\System\xmHUbsv.exe
  C:\Windows\System\xmHUbsv.exe
  2⤵
  PID:10636
- C:\Windows\System\TmEPzyD.exe
  C:\Windows\System\TmEPzyD.exe
  2⤵
  PID:10660
- C:\Windows\System\jAjQLWz.exe
  C:\Windows\System\jAjQLWz.exe
  2⤵
  PID:10684
- C:\Windows\System\hTszYjI.exe
  C:\Windows\System\hTszYjI.exe
  2⤵
  PID:10704
- C:\Windows\System\ESHkDel.exe
  C:\Windows\System\ESHkDel.exe
  2⤵
  PID:10728
- C:\Windows\System\VwJSLCa.exe
  C:\Windows\System\VwJSLCa.exe
  2⤵
  PID:10748
- C:\Windows\System\FmdfsuY.exe
  C:\Windows\System\FmdfsuY.exe
  2⤵
  PID:10772
- C:\Windows\System\MhYwsit.exe
  C:\Windows\System\MhYwsit.exe
  2⤵
  PID:10796
- C:\Windows\System\cXPezxZ.exe
  C:\Windows\System\cXPezxZ.exe
  2⤵
  PID:10824
- C:\Windows\System\JClQZYD.exe
  C:\Windows\System\JClQZYD.exe
  2⤵
  PID:10844
- C:\Windows\System\ZxSDDoL.exe
  C:\Windows\System\ZxSDDoL.exe
  2⤵
  PID:10868
- C:\Windows\System\BOiKOlq.exe
  C:\Windows\System\BOiKOlq.exe
  2⤵
  PID:10892
- C:\Windows\System\gANvttr.exe
  C:\Windows\System\gANvttr.exe
  2⤵
  PID:10916
- C:\Windows\System\HlBlZIM.exe
  C:\Windows\System\HlBlZIM.exe
  2⤵
  PID:10952
- C:\Windows\System\hgoPBGA.exe
  C:\Windows\System\hgoPBGA.exe
  2⤵
  PID:10976
- C:\Windows\System\rSWWYiB.exe
  C:\Windows\System\rSWWYiB.exe
  2⤵
  PID:11004
- C:\Windows\System\MAbbDWr.exe
  C:\Windows\System\MAbbDWr.exe
  2⤵
  PID:11020
- C:\Windows\System\NYeIVpS.exe
  C:\Windows\System\NYeIVpS.exe
  2⤵
  PID:11056
- C:\Windows\System\XPtivZO.exe
  C:\Windows\System\XPtivZO.exe
  2⤵
  PID:11080
- C:\Windows\System\bbOdVOn.exe
  C:\Windows\System\bbOdVOn.exe
  2⤵
  PID:11104
- C:\Windows\System\xICfmNF.exe
  C:\Windows\System\xICfmNF.exe
  2⤵
  PID:11120
- C:\Windows\System\uPZfeIG.exe
  C:\Windows\System\uPZfeIG.exe
  2⤵
  PID:11144
- C:\Windows\System\koexDmr.exe
  C:\Windows\System\koexDmr.exe
  2⤵
  PID:11184
- C:\Windows\System\ffoROnL.exe
  C:\Windows\System\ffoROnL.exe
  2⤵
  PID:11212
- C:\Windows\System\DXgvaxW.exe
  C:\Windows\System\DXgvaxW.exe
  2⤵
  PID:11232
- C:\Windows\System\bTriunJ.exe
  C:\Windows\System\bTriunJ.exe
  2⤵
  PID:11248
- C:\Windows\System\LhIhBcW.exe
  C:\Windows\System\LhIhBcW.exe
  2⤵
  PID:9420
- C:\Windows\System\ribrNzI.exe
  C:\Windows\System\ribrNzI.exe
  2⤵
  PID:8812
- C:\Windows\System\cLjkNlU.exe
  C:\Windows\System\cLjkNlU.exe
  2⤵
  PID:9556
- C:\Windows\System\PnHfIdL.exe
  C:\Windows\System\PnHfIdL.exe
  2⤵
  PID:9604
- C:\Windows\System\VRVAoIa.exe
  C:\Windows\System\VRVAoIa.exe
  2⤵
  PID:9656
- C:\Windows\System\ccJhfQi.exe
  C:\Windows\System\ccJhfQi.exe
  2⤵
  PID:7764
- C:\Windows\System\mZtSjLW.exe
  C:\Windows\System\mZtSjLW.exe
  2⤵
  PID:7200
- C:\Windows\System\qatSCwC.exe
  C:\Windows\System\qatSCwC.exe
  2⤵
  PID:7072
- C:\Windows\System\mqNYafR.exe
  C:\Windows\System\mqNYafR.exe
  2⤵
  PID:10036
- C:\Windows\System\hRrPoFF.exe
  C:\Windows\System\hRrPoFF.exe
  2⤵
  PID:10228
- C:\Windows\System\Pnhffke.exe
  C:\Windows\System\Pnhffke.exe
  2⤵
  PID:8780
- C:\Windows\System\GzvtZMN.exe
  C:\Windows\System\GzvtZMN.exe
  2⤵
  PID:9060
- C:\Windows\System\MljvPmq.exe
  C:\Windows\System\MljvPmq.exe
  2⤵
  PID:9080
- C:\Windows\System\EbqaVaY.exe
  C:\Windows\System\EbqaVaY.exe
  2⤵
  PID:11268
- C:\Windows\System\tqdneGQ.exe
  C:\Windows\System\tqdneGQ.exe
  2⤵
  PID:11296
- C:\Windows\System\NFGHBJI.exe
  C:\Windows\System\NFGHBJI.exe
  2⤵
  PID:11316
- C:\Windows\System\BryBTzj.exe
  C:\Windows\System\BryBTzj.exe
  2⤵
  PID:11344
- C:\Windows\System\zXUVPAn.exe
  C:\Windows\System\zXUVPAn.exe
  2⤵
  PID:11364
- C:\Windows\System\zyAUvCp.exe
  C:\Windows\System\zyAUvCp.exe
  2⤵
  PID:11396
- C:\Windows\System\vvMxmYo.exe
  C:\Windows\System\vvMxmYo.exe
  2⤵
  PID:11416
- C:\Windows\System\NQCqKso.exe
  C:\Windows\System\NQCqKso.exe
  2⤵
  PID:11440
- C:\Windows\System\iwryeDF.exe
  C:\Windows\System\iwryeDF.exe
  2⤵
  PID:11460
- C:\Windows\System\bxiMHpz.exe
  C:\Windows\System\bxiMHpz.exe
  2⤵
  PID:11484
- C:\Windows\System\mydDIGA.exe
  C:\Windows\System\mydDIGA.exe
  2⤵
  PID:11508
- C:\Windows\System\qdWIJSX.exe
  C:\Windows\System\qdWIJSX.exe
  2⤵
  PID:11532
- C:\Windows\System\hxZFNyp.exe
  C:\Windows\System\hxZFNyp.exe
  2⤵
  PID:11564
- C:\Windows\System\kMtjJor.exe
  C:\Windows\System\kMtjJor.exe
  2⤵
  PID:11588
- C:\Windows\System\PmGKCAo.exe
  C:\Windows\System\PmGKCAo.exe
  2⤵
  PID:11608
- C:\Windows\System\bqBPQDh.exe
  C:\Windows\System\bqBPQDh.exe
  2⤵
  PID:11632
- C:\Windows\System\uCuNlye.exe
  C:\Windows\System\uCuNlye.exe
  2⤵
  PID:11652
- C:\Windows\System\jLhCfaD.exe
  C:\Windows\System\jLhCfaD.exe
  2⤵
  PID:11676
- C:\Windows\System\FvjIjee.exe
  C:\Windows\System\FvjIjee.exe
  2⤵
  PID:11704
- C:\Windows\System\BgHtkCl.exe
  C:\Windows\System\BgHtkCl.exe
  2⤵
  PID:11724
- C:\Windows\System\aVykluB.exe
  C:\Windows\System\aVykluB.exe
  2⤵
  PID:11740
- C:\Windows\System\rPnhEAu.exe
  C:\Windows\System\rPnhEAu.exe
  2⤵
  PID:11756
- C:\Windows\System\ZuHsiIV.exe
  C:\Windows\System\ZuHsiIV.exe
  2⤵
  PID:11776
- C:\Windows\System\AUulesV.exe
  C:\Windows\System\AUulesV.exe
  2⤵
  PID:11796
- C:\Windows\System\gTknZzY.exe
  C:\Windows\System\gTknZzY.exe
  2⤵
  PID:11812
- C:\Windows\System\qEzoGwl.exe
  C:\Windows\System\qEzoGwl.exe
  2⤵
  PID:11828
- C:\Windows\System\HPYSGJJ.exe
  C:\Windows\System\HPYSGJJ.exe
  2⤵
  PID:11852
- C:\Windows\System\THmLcqK.exe
  C:\Windows\System\THmLcqK.exe
  2⤵
  PID:11876
- C:\Windows\System\UwafzfL.exe
  C:\Windows\System\UwafzfL.exe
  2⤵
  PID:11900
- C:\Windows\System\mNjwKrA.exe
  C:\Windows\System\mNjwKrA.exe
  2⤵
  PID:11928
- C:\Windows\System\szbmtLv.exe
  C:\Windows\System\szbmtLv.exe
  2⤵
  PID:11948
- C:\Windows\System\tfLMXVC.exe
  C:\Windows\System\tfLMXVC.exe
  2⤵
  PID:11980
- C:\Windows\System\RGTVdiW.exe
  C:\Windows\System\RGTVdiW.exe
  2⤵
  PID:12000
- C:\Windows\System\woKyLhL.exe
  C:\Windows\System\woKyLhL.exe
  2⤵
  PID:12032
- C:\Windows\System\jttNMCF.exe
  C:\Windows\System\jttNMCF.exe
  2⤵
  PID:12068
- C:\Windows\System\NNhIeRv.exe
  C:\Windows\System\NNhIeRv.exe
  2⤵
  PID:12100
- C:\Windows\System\vjHgOKc.exe
  C:\Windows\System\vjHgOKc.exe
  2⤵
  PID:12128
- C:\Windows\System\dCvePyW.exe
  C:\Windows\System\dCvePyW.exe
  2⤵
  PID:12160
- C:\Windows\System\dUKroWU.exe
  C:\Windows\System\dUKroWU.exe
  2⤵
  PID:12184
- C:\Windows\System\DVLTZGb.exe
  C:\Windows\System\DVLTZGb.exe
  2⤵
  PID:12204
- C:\Windows\System\CKaSGvA.exe
  C:\Windows\System\CKaSGvA.exe
  2⤵
  PID:12224
- C:\Windows\System\KNuGQoZ.exe
  C:\Windows\System\KNuGQoZ.exe
  2⤵
  PID:12248
- C:\Windows\System\nmMwzEf.exe
  C:\Windows\System\nmMwzEf.exe
  2⤵
  PID:12272
- C:\Windows\System\mbchPbV.exe
  C:\Windows\System\mbchPbV.exe
  2⤵
  PID:7788
- C:\Windows\System\MrbhnQv.exe
  C:\Windows\System\MrbhnQv.exe
  2⤵
  PID:7672
- C:\Windows\System\xRhhNis.exe
  C:\Windows\System\xRhhNis.exe
  2⤵
  PID:7408
- C:\Windows\System\PVKGmna.exe
  C:\Windows\System\PVKGmna.exe
  2⤵
  PID:9356
- C:\Windows\System\WHosFkM.exe
  C:\Windows\System\WHosFkM.exe
  2⤵
  PID:9388
- C:\Windows\System\hlVilbP.exe
  C:\Windows\System\hlVilbP.exe
  2⤵
  PID:9492
- C:\Windows\System\DVymbei.exe
  C:\Windows\System\DVymbei.exe
  2⤵
  PID:10408
- C:\Windows\System\IRcilzN.exe
  C:\Windows\System\IRcilzN.exe
  2⤵
  PID:10440
- C:\Windows\System\jdcfVEj.exe
  C:\Windows\System\jdcfVEj.exe
  2⤵
  PID:4504
- C:\Windows\System\uRfQzqN.exe
  C:\Windows\System\uRfQzqN.exe
  2⤵
  PID:9708
- C:\Windows\System\TqwRZRF.exe
  C:\Windows\System\TqwRZRF.exe
  2⤵
  PID:10816
- C:\Windows\System\PyfCnKc.exe
  C:\Windows\System\PyfCnKc.exe
  2⤵
  PID:10840
- C:\Windows\System\rcdDERy.exe
  C:\Windows\System\rcdDERy.exe
  2⤵
  PID:11016
- C:\Windows\System\wojZmTH.exe
  C:\Windows\System\wojZmTH.exe
  2⤵
  PID:9920
- C:\Windows\System\cmNuIUZ.exe
  C:\Windows\System\cmNuIUZ.exe
  2⤵
  PID:11072
- C:\Windows\System\gApKgZC.exe
  C:\Windows\System\gApKgZC.exe
  2⤵
  PID:11128
- C:\Windows\System\hQiNIyH.exe
  C:\Windows\System\hQiNIyH.exe
  2⤵
  PID:9168
- C:\Windows\System\nzqBLEi.exe
  C:\Windows\System\nzqBLEi.exe
  2⤵
  PID:10072
- C:\Windows\System\HnFBhXD.exe
  C:\Windows\System\HnFBhXD.exe
  2⤵
  PID:8064
- C:\Windows\System\vSUFCub.exe
  C:\Windows\System\vSUFCub.exe
  2⤵
  PID:9612
- C:\Windows\System\erWhhDF.exe
  C:\Windows\System\erWhhDF.exe
  2⤵
  PID:12308
- C:\Windows\System\JXzuQax.exe
  C:\Windows\System\JXzuQax.exe
  2⤵
  PID:12324
- C:\Windows\System\YNvSrFV.exe
  C:\Windows\System\YNvSrFV.exe
  2⤵
  PID:12348
- C:\Windows\System\XXEsGIe.exe
  C:\Windows\System\XXEsGIe.exe
  2⤵
  PID:12372
- C:\Windows\System\japLNZI.exe
  C:\Windows\System\japLNZI.exe
  2⤵
  PID:12400
- C:\Windows\System\tTRIxeS.exe
  C:\Windows\System\tTRIxeS.exe
  2⤵
  PID:12420
- C:\Windows\System\FLSjiLL.exe
  C:\Windows\System\FLSjiLL.exe
  2⤵
  PID:12452
- C:\Windows\System\YErGxJP.exe
  C:\Windows\System\YErGxJP.exe
  2⤵
  PID:12472
- C:\Windows\System\rUASzjW.exe
  C:\Windows\System\rUASzjW.exe
  2⤵
  PID:12500
- C:\Windows\System\oiAMkmi.exe
  C:\Windows\System\oiAMkmi.exe
  2⤵
  PID:12520
- C:\Windows\System\WulnOHt.exe
  C:\Windows\System\WulnOHt.exe
  2⤵
  PID:12548
- C:\Windows\System\LpksdnT.exe
  C:\Windows\System\LpksdnT.exe
  2⤵
  PID:12572
- C:\Windows\System\EGvGeTR.exe
  C:\Windows\System\EGvGeTR.exe
  2⤵
  PID:12600
- C:\Windows\System\tUoIwwc.exe
  C:\Windows\System\tUoIwwc.exe
  2⤵
  PID:12616
- C:\Windows\System\uGVTWfU.exe
  C:\Windows\System\uGVTWfU.exe
  2⤵
  PID:12632
- C:\Windows\System\tUGmSnx.exe
  C:\Windows\System\tUGmSnx.exe
  2⤵
  PID:12652
- C:\Windows\System\DaDDJbs.exe
  C:\Windows\System\DaDDJbs.exe
  2⤵
  PID:12668
- C:\Windows\System\gnGOJeO.exe
  C:\Windows\System\gnGOJeO.exe
  2⤵
  PID:12684
- C:\Windows\System\XMITcRK.exe
  C:\Windows\System\XMITcRK.exe
  2⤵
  PID:13048
- C:\Windows\System\zIuLzeJ.exe
  C:\Windows\System\zIuLzeJ.exe
  2⤵
  PID:13072
- C:\Windows\System\WFTreDU.exe
  C:\Windows\System\WFTreDU.exe
  2⤵
  PID:13104
- C:\Windows\System\CkCOtqU.exe
  C:\Windows\System\CkCOtqU.exe
  2⤵
  PID:13124
- C:\Windows\System\HxShVkb.exe
  C:\Windows\System\HxShVkb.exe
  2⤵
  PID:13148
- C:\Windows\System\pcZdIzM.exe
  C:\Windows\System\pcZdIzM.exe
  2⤵
  PID:13168
- C:\Windows\System\ebVIrgl.exe
  C:\Windows\System\ebVIrgl.exe
  2⤵
  PID:13200
- C:\Windows\System\XoaNfof.exe
  C:\Windows\System\XoaNfof.exe
  2⤵
  PID:13220
- C:\Windows\System\dlGEliV.exe
  C:\Windows\System\dlGEliV.exe
  2⤵
  PID:13244
- C:\Windows\System\TypXAMu.exe
  C:\Windows\System\TypXAMu.exe
  2⤵
  PID:13264
- C:\Windows\System\ZjFTior.exe
  C:\Windows\System\ZjFTior.exe
  2⤵
  PID:13288
- C:\Windows\System\NgzMngg.exe
  C:\Windows\System\NgzMngg.exe
  2⤵
  PID:13308
- C:\Windows\System\ErgEAgO.exe
  C:\Windows\System\ErgEAgO.exe
  2⤵
  PID:400
- C:\Windows\System\WikvhGl.exe
  C:\Windows\System\WikvhGl.exe
  2⤵
  PID:7004
- C:\Windows\System\xDTIdUj.exe
  C:\Windows\System\xDTIdUj.exe
  2⤵
  PID:9112
- C:\Windows\System\fanARSH.exe
  C:\Windows\System\fanARSH.exe
  2⤵
  PID:11284
- C:\Windows\System\mhmQsry.exe
  C:\Windows\System\mhmQsry.exe
  2⤵
  PID:11356
- C:\Windows\System\DviaWUD.exe
  C:\Windows\System\DviaWUD.exe
  2⤵
  PID:12556
- C:\Windows\System\gmhYBuL.exe
  C:\Windows\System\gmhYBuL.exe
  2⤵
  PID:12584
- C:\Windows\System\ctEkwVX.exe
  C:\Windows\System\ctEkwVX.exe
  2⤵
  PID:10256
- C:\Windows\System\nibnYGs.exe
  C:\Windows\System\nibnYGs.exe
  2⤵
  PID:12728
- C:\Windows\System\FVrgbGN.exe
  C:\Windows\System\FVrgbGN.exe
  2⤵
  PID:11628
- C:\Windows\System\TDbqJIl.exe
  C:\Windows\System\TDbqJIl.exe
  2⤵
  PID:11752
- C:\Windows\System\nbxCZBW.exe
  C:\Windows\System\nbxCZBW.exe
  2⤵
  PID:11968
- C:\Windows\System\hKiwFIr.exe
  C:\Windows\System\hKiwFIr.exe
  2⤵
  PID:12020
- C:\Windows\System\lQQkHhz.exe
  C:\Windows\System\lQQkHhz.exe
  2⤵
  PID:12108
- C:\Windows\System\QJZonyC.exe
  C:\Windows\System\QJZonyC.exe
  2⤵
  PID:12200
- C:\Windows\System\HJSnbSp.exe
  C:\Windows\System\HJSnbSp.exe
  2⤵
  PID:12220
- C:\Windows\System\EIGbNse.exe
  C:\Windows\System\EIGbNse.exe
  2⤵
  PID:9208
- C:\Windows\System\TviBssk.exe
  C:\Windows\System\TviBssk.exe
  2⤵
  PID:9404
- C:\Windows\System\dvRyLGE.exe
  C:\Windows\System\dvRyLGE.exe
  2⤵
  PID:4268
- C:\Windows\System\LEIgmCi.exe
  C:\Windows\System\LEIgmCi.exe
  2⤵
  PID:11572
- C:\Windows\System\BLOdaoU.exe
  C:\Windows\System\BLOdaoU.exe
  2⤵
  PID:10320
- C:\Windows\System\moHTwTa.exe
  C:\Windows\System\moHTwTa.exe
  2⤵
  PID:1956
- C:\Windows\System\ScQhvtU.exe
  C:\Windows\System\ScQhvtU.exe
  2⤵
  PID:11244
- C:\Windows\System\KumrZPa.exe
  C:\Windows\System\KumrZPa.exe
  2⤵
  PID:9036
- C:\Windows\System\fHkSZdQ.exe
  C:\Windows\System\fHkSZdQ.exe
  2⤵
  PID:8672
- C:\Windows\System\xnpxOkN.exe
  C:\Windows\System\xnpxOkN.exe
  2⤵
  PID:7104
- C:\Windows\System\BzpmeIP.exe
  C:\Windows\System\BzpmeIP.exe
  2⤵
  PID:12676
- C:\Windows\System\nRspPwf.exe
  C:\Windows\System\nRspPwf.exe
  2⤵
  PID:10716
- C:\Windows\System\nuBMfBG.exe
  C:\Windows\System\nuBMfBG.exe
  2⤵
  PID:13012
- C:\Windows\System\sSmOYfL.exe
  C:\Windows\System\sSmOYfL.exe
  2⤵
  PID:9416
- C:\Windows\System\njvXXZr.exe
  C:\Windows\System\njvXXZr.exe
  2⤵
  PID:12300
- C:\Windows\System\HmcJrsa.exe
  C:\Windows\System\HmcJrsa.exe
  2⤵
  PID:11992
- C:\Windows\System\onQJzLC.exe
  C:\Windows\System\onQJzLC.exe
  2⤵
  PID:10972
- C:\Windows\System\GMXzbVx.exe
  C:\Windows\System\GMXzbVx.exe
  2⤵
  PID:11624
- C:\Windows\System\VpEjWan.exe
  C:\Windows\System\VpEjWan.exe
  2⤵
  PID:10608
- C:\Windows\System\tygeCVu.exe
  C:\Windows\System\tygeCVu.exe
  2⤵
  PID:12492
- C:\Windows\System\qkMLejw.exe
  C:\Windows\System\qkMLejw.exe
  2⤵
  PID:8636
- C:\Windows\System\KyjjwRF.exe
  C:\Windows\System\KyjjwRF.exe
  2⤵
  PID:12960
- C:\Windows\System\AYFqlgt.exe
  C:\Windows\System\AYFqlgt.exe
  2⤵
  PID:13144
- C:\Windows\System\jIojahw.exe
  C:\Windows\System\jIojahw.exe
  2⤵
  PID:10104
- C:\Windows\System\DeXsDWk.exe
  C:\Windows\System\DeXsDWk.exe
  2⤵
  PID:12296
- C:\Windows\System\xsJfpie.exe
  C:\Windows\System\xsJfpie.exe
  2⤵
  PID:11500
- C:\Windows\System\OmCnNgI.exe
  C:\Windows\System\OmCnNgI.exe
  2⤵
  PID:11960
- C:\Windows\System\yhKfrqm.exe
  C:\Windows\System\yhKfrqm.exe
  2⤵
  PID:10520
- C:\Windows\System\bMzbpJL.exe
  C:\Windows\System\bMzbpJL.exe
  2⤵
  PID:3804
- C:\Windows\System\CMrmOEp.exe
  C:\Windows\System\CMrmOEp.exe
  2⤵
  PID:4332
- C:\Windows\System\jAonveU.exe
  C:\Windows\System\jAonveU.exe
  2⤵
  PID:13132
- C:\Windows\System\hqTnQpA.exe
  C:\Windows\System\hqTnQpA.exe
  2⤵
  PID:11240
- C:\Windows\System\hUHOmoz.exe
  C:\Windows\System\hUHOmoz.exe
  2⤵
  PID:9884
- C:\Windows\System\UsuadtI.exe
  C:\Windows\System\UsuadtI.exe
  2⤵
  PID:3696
- C:\Windows\System\AVIEUbg.exe
  C:\Windows\System\AVIEUbg.exe
  2⤵
  PID:12852
- C:\Windows\System\RtrAvfq.exe
  C:\Windows\System\RtrAvfq.exe
  2⤵
  PID:9272
- C:\Windows\System\qegmvJU.exe
  C:\Windows\System\qegmvJU.exe
  2⤵
  PID:10804
- C:\Windows\System\yDZwTJD.exe
  C:\Windows\System\yDZwTJD.exe
  2⤵
  PID:13240
- C:\Windows\System\uUoMuyz.exe
  C:\Windows\System\uUoMuyz.exe
  2⤵
  PID:9908
- C:\Windows\System\GimzEfe.exe
  C:\Windows\System\GimzEfe.exe
  2⤵
  PID:13092
- C:\Windows\System\inKUnoZ.exe
  C:\Windows\System\inKUnoZ.exe
  2⤵
  PID:10876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LA4X8NGR\home-993d2c38b2c1[1].css

Filesize
11KB

MD5
6328d6d9a6b00ce7f992230b97b17c1f

SHA1
88837b802bdde407e37e92641072ea2eeec95556

SHA256
c9d9b80794cebd7d97daf52f7f0ce0e31bcf7a6f65a6e07851c688d67f10dba8

SHA512
993d2c38b2c15499aebdb39c1f9c21d0501d4c2a5973caec65be9ddc3ddfd6e46d06449e7483daa4fa9afa17cb81ff27a391519a64629169eb15c52911aab2c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vz0ggaa1.l2c.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\CNkydmD.exe

Filesize
2.2MB

MD5
17b68026c4d913f1446da2386e9e9878

SHA1
15775f3c9ee27a6bf7e938caacb009bbcd09c811

SHA256
8d50b886d5ec50882b1c88ba770ed28864ec0a00fe8ae18a5b0386916bbf7cd2

SHA512
2eff640bba5ce79f8c332026b939b6346071dc7f7c16a9f350b30a9cd397d43fec97a0797d688812fd3cd3b3739b8e2b8c38cff3bf194cb806801408f4a3390d

Download Submit
C:\Windows\System\CWLwxeE.exe

Filesize
2.2MB

MD5
33d0b85d482a225d3ca9bb8e95a51a45

SHA1
844a0283825f0c8ad84186fd40d5b37814e2655f

SHA256
b50c8f9c138fe4ca912e2e489519814fa71c05c11987bdb635abf807447b565c

SHA512
81b6fdd9864382cdda1f6f70789561eb385c6969fa94ab600c4e49c202f176e61cf74442968fa467408d12274700ab3385122bfc8d3d416335b7b0de904bdfc2

Download Submit
C:\Windows\System\FepyTZE.exe

Filesize
2.2MB

MD5
e421cebd46a09d6060230c152b933593

SHA1
3394852af76afdbb095ed29ccebc42274aff30cc

SHA256
37815aaeb32d06abdb76c09bb2f6d979ef2ff197302e6b010e449db4386c5027

SHA512
dc3e6f9c116e6b0dee21bd1c260a398126cd3d9c1afb8093edeab71cf538543211df80884fd4cd337b9af124622d16068a97cce4244c2dbb792b589fedb559fc

Download Submit
C:\Windows\System\LcYIEFA.exe

Filesize
2.2MB

MD5
054ca342eca874fb004363d3eb5942a1

SHA1
c4a4524ac054c051befa3e325e86dee74c2f9f79

SHA256
f0026652ad63235672c9ccf90778c3f78c6e7d89c8bf4e04936500c8e68dc0a1

SHA512
57a9a4593589e828230165b92f7bf2141f36b64437bca6c0e93b12b0d7273e1e6260434c38e406cf4d55e29b4d5feb4878a6aae3d8b48dfa0b2afa11cf2e3761

Download Submit
C:\Windows\System\LcpLAVB.exe

Filesize
2.2MB

MD5
7c469347f50db680a7f3698b9e170f49

SHA1
2bf7490dd648576e6ba7adb319c250f47ad4d7ec

SHA256
025548735ce4ae550d9abf2230be5327914568c572792c6067fe12e56a06596a

SHA512
2b503eeddf820df7bcd54bd5aa25362b9e759b705e1e9fd2f359183c8ce9ee25c055bae048c2837cbbe909a561e54d981fffd7e0a3855434be719124a1825bd6

Download Submit
C:\Windows\System\LgXyPkh.exe

Filesize
2.2MB

MD5
5cda952f19d50cefbe4af96a14a80a20

SHA1
304706a42f53bde37471e0850f23c666d2343ea0

SHA256
9ddd67964dc5237ef7f2c19f41093f1b1cfe6793e433057bc862a60d0113638c

SHA512
3679aa7fb49eea717a2724559800996cb38ac9d8553a510ca4ead79005af87d3b02f5ee970b78ae97faef9921bbe65c8b586c01b5b4d8382fcc6a02d52a2c1e5

Download Submit
C:\Windows\System\NKCQUAM.exe

Filesize
2.2MB

MD5
51ed8b8fb8c302993d2d9387cb2f356f

SHA1
6793229eae93a2bf311858e7f9ff7da6bb847ee0

SHA256
698c0039d278d610044193fec2aa24867e82b4e339e789178a9e9fb23f16e138

SHA512
ba05341a9c9b6a09751c1bb624255f8ee432fb51a0fb9b66e3994facc6a8250e010b74681c7c2f9c916fe333980a22112861d39a69f1f6cf303ea3611c66d759

Download Submit
C:\Windows\System\RbtoAja.exe

Filesize
2.2MB

MD5
3dfbfc505058a55f24b953f649563c8c

SHA1
642a5c4a1092206c3b93eab837eb7c680eeff700

SHA256
a8084dbbbbc7a738955fd7e3c2a001a47061a7fe9b89ebf6b441ea8bf4e8f41f

SHA512
9d3451b0d8c92a6a72c4243b87e8d8060b16dd2adfc9ebeef0b85d8d25dbf2deb6d35ef8f9b5d3455b8fbe7dc64df048d03adfbb605715e7b88a26f5ff871c7a

Download Submit
C:\Windows\System\RxYSfRx.exe

Filesize
2.2MB

MD5
043a3514ff6582a116849fc66ad882f0

SHA1
f910372fcaeede2323d5ade045edda991e859442

SHA256
4dde20cb9a2a64af70347609b9c7e8e1e7ecaef3117bc91c7e488c822c709497

SHA512
a678609255d54b828aa2d8bd3f6bceb518dbd363745182fb1d62c379101ee79753cf4177e600f825cfdc3cd8e150819684acd7e8caadab2574512a071fff3833

Download Submit
C:\Windows\System\SPsgqGX.exe

Filesize
2.2MB

MD5
2a6e18d006a79d2e6f28c6f6c770db94

SHA1
930032580984be5aab90e8a7d54b046b1c288bfe

SHA256
21cdc593a38691513cf4c9301e6a30e6107f0c69b153567914545344357fc41b

SHA512
c04d2c27376b6d550f32e4afee90ab965ee28c3fc422ebdeed6df71d901fcaa0a4003b487c4b48e08d3db82b9d7ab6f6e64562330a57e8687fd2e79ca06190c6

Download Submit
C:\Windows\System\SfTzFDX.exe

Filesize
2.2MB

MD5
3fb2c081b160f791444fc8d2a27c3130

SHA1
17a0a9d06009719ee188f0115d0fbdfcc0b0c9df

SHA256
66b2f6b4bc707856579736c068a5815194594e082ebee3df6fb3e31d9875ad57

SHA512
79b58858540953d651225e1ece5de52848e859dfe1c661f6e5bfbf1b1b32bbcb82f45c27afb04902f5653c13bbeee239a3cf47da9fa66b1b887bd69191c9a212

Download Submit
C:\Windows\System\TIxekSd.exe

Filesize
2.2MB

MD5
29ae117e209912f44e1ea9bdd4ca8627

SHA1
732b5b944e50a44792b8f866b369270fb7c44b33

SHA256
ddde9b3ccdafc39bb0ee8e964d758c84fb450bd35270f1d36f4b4555713a3166

SHA512
d489d6fa1e47e0e165dc4dcc67724952606ae626953186f57ebab629dba5911fdc1fbf32ef6fd0fddee0cc5525a18545222a60d46e3b3e506cf8f3083f3e2c4e

Download Submit
C:\Windows\System\YgJNHEh.exe

Filesize
2.2MB

MD5
47d5d66c1fc600e84b65389ead249b56

SHA1
f32a12f129d89039eb18b84a7b67848992c22053

SHA256
84602bd66ca71eeeeb9e308e98bc14e3f052986fd711afdffbfd1e86f73b3a2c

SHA512
e381c6bd639746d4c367c99e528f9aece6408bcdf4871512b42f799325ebe79add6146ace66d0b9bffa922b8fc13b85648755b26d8909bc431e30a49a9d638ec

Download Submit
C:\Windows\System\ZxaESZs.exe

Filesize
2.2MB

MD5
2361dab8dd9bd4aaf61ad4e6c9ec0d79

SHA1
395803235cd10287ca2014e3df26ba0c57db0a68

SHA256
9b656c2ac48bda3a04fff588e7cd9bfe7628b3a0196eb96c2f5c7b125c86745f

SHA512
a34ae8160691a1afd274214ff047ae9ef6ffa9efa5c05a20343577950fb2a6c06b7f143bd689ea70ef61044fdf684505f702c8297c8af1eface65613153c3c5e

Download Submit
C:\Windows\System\agwEnEQ.exe

Filesize
2.2MB

MD5
66bac6c7f62a2c98f127274f8d640e4e

SHA1
9f112a48c160752aae5e104e1267b47377a63695

SHA256
c293dbdb0fabc23046867ffad44055bc94cae314e63d8a53ec385f667598ae90

SHA512
894603461ba0838d5faa6bde6ddb5e101985cb9565272a6c988969a21b109778e0ad5989a12aaaffb9a197f79783258995172c3793c3ac9e0c09e625e56e4d5b

Download Submit
C:\Windows\System\bWNTMbe.exe

Filesize
2.2MB

MD5
01a39a45060e529a77e72bd893b32319

SHA1
820fdb3ae51d4dc7c1898fb493922a0504ac6863

SHA256
0389866bb578616803545678294ae6e5cbaa13998de27f89262740ea71dc185c

SHA512
e411cc7ba08d886e997475560a6cb66fd200290d17060f28be4c1605eda0526ddee9d90fa95556fe16c6be4d30bd9b8c9eb084a06f1443f65620c766bff2562c

Download Submit
C:\Windows\System\bgLnkzW.exe

Filesize
2.2MB

MD5
2b87445ced8fb77e5f34db609492a169

SHA1
6d8f1207744d68d7f57f9417a15c1e90d6032c6f

SHA256
e2e29ec629cc18ecdb8eb7d4dd795b1eadd96d789f45008e15dcbd7a4c95c771

SHA512
29eaec80a7902d4735ec50b9fa22c16465ca932860a5c35761601c41a62b00f0e01eed1ce98a6948e50ca6f7c94c24dc2aeafd13a9da8e57415652f3214bbe50

Download Submit
C:\Windows\System\dQDigVS.exe

Filesize
2.2MB

MD5
6eaf1644e7a701ce080abe42a717aca9

SHA1
ba165cc794cccdd86823f41d212f1ad3c53bcda8

SHA256
7caaf2805332dcda66e470feb2686431054dbcb714f3eeb7bcbc4b61d4f07a21

SHA512
6aef37845b23bf65cd53d6855df880eb97b752dfc837d1f755cceac0831b7c8f260b5873496bf5e5ee48b0a8135db0ee5906f78de5814e475e3010e0d62bce7a

Download Submit
C:\Windows\System\dqhgqbP.exe

Filesize
2.2MB

MD5
1372d12311c47709592617ba629dfb77

SHA1
5ebae015b751695f2687bfabd31f78eb8a4aaf9c

SHA256
1e813d28219f48ce751a77934658cafc07d2b40109e2a501c80f0513dd652a30

SHA512
c96e681cd4abfe0ae67f561fa975965f39e7d3d261ad7772a9e81c0a2dec561215ebff0ee63fc00b34162e6d0a065b217def8c8f347fe3d1fb8ea9af0a5db173

Download Submit
C:\Windows\System\eajNQzn.exe

Filesize
2.2MB

MD5
59251b7a97fc33f64c23dacf547a8140

SHA1
521db66cb2ef0f6eb8fae4e669956009a1a58eb9

SHA256
8f64cce254d6b3f48dc5142b9f19487c0ac49ff34a7a4ceb07e03df4dd631bad

SHA512
228fc593563e7a2a01cd5d1b480c55ed66fbf7e32a8741f9efd64fd9bf1b80a4523c136955a72ecee6c62e85afb432bc6ca00d31669362061b8f6132fa110b46

Download Submit
C:\Windows\System\eprJZIp.exe

Filesize
2.2MB

MD5
477893e06c94a97fe2cba57c6c947ce8

SHA1
33c639f36f390f9776f1c2cd94d047614e87acb3

SHA256
d6b2543c7f5f1e8397d4df08517470de9a4b22192ea7a9b1250213e831168912

SHA512
768ed925b5c5844bb6229f19514646dbb3e908605dd8f28b0e7b2621f40ddaf25a0d9f1e383a421afad014f04a7bf547e35df33a099432eed471f19b77008a84

Download Submit
C:\Windows\System\iOSBmXR.exe

Filesize
2.2MB

MD5
2e45d90208f14f3234d431ab4cfe7d65

SHA1
18b0dd1e05d4ece2319a82b6fec6888bb59c25db

SHA256
66bcd7a12c12862f790aa513e109eafa7bf407cf22ad4a834087b22795f67567

SHA512
9341ba11b72589e0b48844e6c4b5fd06133d8cdf0cd8113acaf8e145c396ef00c70543e95195e4cfe5fcbc426af055b5ec9a4e169f82a7fd58205a25856f35a4

Download Submit
C:\Windows\System\jTsgKBz.exe

Filesize
2.2MB

MD5
7a6bbba5694cecb9f0e21e138f062083

SHA1
8d008420f81bca31e06b1c213d166464b0c00da7

SHA256
ece62450bbf0b5e2799084f6454f64ed0856a7bf7dc6277148b3dd6135681875

SHA512
48a0dcf6e9314e2443940103cb69f49c1031c810bbbff3c4fbaf357ab2e7d54d4a752379c3f51c075b1e868be43b925bcad0bd0e2b19245fb5bbc1a58f3abd36

Download Submit
C:\Windows\System\lQcIhVu.exe

Filesize
2.2MB

MD5
12a2adbf5652b152126eb793d46e9fff

SHA1
e22757d2369f3222897ea0adf15990039727d1c8

SHA256
760519d0e239185453a025ea063baab19cb2e0a1f225c206e6dd11821652f769

SHA512
30f24d6ff4a65222c38716d83b2fe5ce6efb2ad9c9611f2bc891cc3d72a1967105796563a7c70cce2a911b0c03d416b877b40890dc3bfa33589a96173d0f55c9

Download Submit
C:\Windows\System\lTZeWAB.exe

Filesize
2.2MB

MD5
d69f0d53f3f587ba99aa4afc6a2a0639

SHA1
7e82c05b80d741bf16582be87bb7cfbd1d72f4ba

SHA256
e7f6932ee409eb4a00501f9825e80f89dfc389a4955f2773aa465e96a79ed957

SHA512
c9cd17ab5c7dc0af241765757ac8a33b12f86d3a70e6618b406d63720ec15b792e01c7e025326c85f674d64e7ff8457ce08931ef5cd0fdf3eec178c88b9c3df7

Download Submit
C:\Windows\System\mWqpeLi.exe

Filesize
2.2MB

MD5
cc5c0c50f4b42a3569557cc368a6dd9e

SHA1
e50759a6790da69b760c517e5633efe782b6457b

SHA256
dac83597e04c464606d4d72a4b48765c8ac9fc6f52a284f568732b7d880bc414

SHA512
6db6103b610689b9cd7a720349341ea90657090d0fe674938497e0736639056a8989ec6b1cf1021c26ce62568464e063df26df01199ffe9ca28049060a71c4c6

Download Submit
C:\Windows\System\oBXNMQD.exe

Filesize
2.2MB

MD5
993676a645412cade4586c01c6c540d9

SHA1
6c28ee69875cf202f75574fe9e7ab83f9b841a9c

SHA256
9bd1b1d7838d266712c9b3616e2022f602d170ca0499419af0166720f2d5bf5a

SHA512
304a0b74358d27024dd037c5aab25818ab88fba575570cfb5c3a1c5ca7b03663071b448f2d637b59bc39b0e31c0e78372ee94276cfe89da0c4833ac2431925b4

Download Submit
C:\Windows\System\pjLlnoE.exe

Filesize
2.2MB

MD5
ad9d353e6ef77650ec709360c9f14fbd

SHA1
12b59b810266b67bdf7257d1111b31e9411284c5

SHA256
ad6e7efa294884c1641167e29fe99054e5440955e9cd032c8930f350d171b384

SHA512
5affef0874e7c1ed1690a4b55de0752088709d86c03cd21dee2225066d2a5467c9252b5f4f5f26adfe52a154047b9b418c68a2fb454d402f845f835e1bd4241d

Download Submit
C:\Windows\System\pvEEQVO.exe

Filesize
2.2MB

MD5
d22f62f0b0df15463a00219e11c32703

SHA1
441e22c53ad2f806ad97cd00da4845ef38b1e8fa

SHA256
407954602470e495501585fac9551a8c0b56bada0f1ec80494df55ccf5213209

SHA512
138ab7c18517d913a452e687d8f10bf4340dcf02b5813622f8b3711d267f6d7c7d4ee49781c70030ec23e5dc85d1a6ba12c96b9ce1fb85b8331812783b78cb60

Download Submit
C:\Windows\System\rUMUgAp.exe

Filesize
2.2MB

MD5
9f0a94b4ce86d529508f5623a3103d18

SHA1
a84a28342516a6bcd89467ce6147017adabe91f1

SHA256
7336bb6dce07764cf1c22b35688a90ef0cf0991a073ef9cca6cb4b489d825c78

SHA512
02d7a57f3827fe6e313835571853f94aadc8371999b657960baba996a3f3a3ce772c82c460dc598da2c79a1c6ab391f59f2cb3a704c871ef62855c1bd0286fa4

Download Submit
C:\Windows\System\sLGnIdi.exe

Filesize
2.2MB

MD5
7e122b1bf80ec653554d4f5015f24819

SHA1
bbf52e7c62458fdf589cb7992b23c11c2f508f28

SHA256
f36a7d9817a8381480c9e11dbad6e71ca2906b3d9715d1715f0396245f0d9481

SHA512
f35c5c47d4e28c930d40d464c79aecfa3c714958071ba3209b28c2fea433bba66b55e55010017f42965bdb463537520b6711d26ca1a2b6dbffcd97f31cb4f5a0

Download Submit
C:\Windows\System\uUvXDxY.exe

Filesize
2.2MB

MD5
026f1ba34955997a2cf242a0ff3272c3

SHA1
1051263a5bdae0f881b98bc48f73c334f7a08e8c

SHA256
5dd95eeefe136a7c2d5c03b6fb1de84f6ea27c19322aa41e0a1076b2afc04b5c

SHA512
ba86449dd180b114247da5f9caa52dcb5503a1d7f60ac853dd943da65ef8ef43485a6feb954d5176ccaf2982815ca530f4cfb8b397c022a02c0affe0eb6a804c

Download Submit
C:\Windows\System\wJQqqcR.exe

Filesize
2.2MB

MD5
2103eaa6e8700bd9e6a12921250fac80

SHA1
8f9ae49fbec28b396adb3620e8a743b89118f16f

SHA256
58db58c98a2ed6d4622b69d33ed8293e823cdc12ebae1c4dd7f8badb465615ea

SHA512
8273c77f5c93b944329b640f56c14129717078bcf0156f7ffd70a17408caf754dbea4a65c926d792b37d5587526bdc290a8396fd34ee9a58a61c4097e5787014

Download Submit
C:\Windows\System\wUPrxTs.exe

Filesize
2.2MB

MD5
2dfe50a4440a59110b5f8d5c70df60e8

SHA1
ef92fe82d8fa998183ca4b359b967c24b0c6ba4d

SHA256
2d814290233abb4ff5574a93c45233a2366b573548f9f0101db0c8e9642c7c01

SHA512
9f6bb6c29999454fffc0e9a892b6f7cc1a705fe76797506734a0cf616a48a3058fafa32f7ce0fcc865373327c8c269cf90c9ad2ddc39ba4d7e09ed19ca98e488

Download Submit
C:\Windows\System\xBkmBkk.exe

Filesize
2.2MB

MD5
2e30afeca1e0b6c537c3d0272b3ebe8c

SHA1
f7871db9069ee442f054d338143ad2cc5155b8c8

SHA256
ec44291ea4974152ad5e3bfd4c56f6679ca201c7cfdc716264dc56c5e4fa4300

SHA512
9a49aa5f2187958206c0798c363e1a6f2431c464cce4367202ecf1f70eae69683afab730c5596f2bffd86eaa9738e992ff3a6d8960975a44cdae2d62f6b886f1

Download Submit
C:\Windows\System\yNpbnNO.exe

Filesize
2.2MB

MD5
cd70aba8d25a42a68eec123c7ebb1314

SHA1
1ff0ba5c22e44a59dd6ea28ede2dfe2a7537548d

SHA256
097c03971c4f73b1111fc5f3c2fa5b69e896505aa63b8df0311777be4dcdc929

SHA512
23b5e44b9562ef230828f651be8c28b7ccf0d96b87a53cb48e2a87dc7add9f45c6acaf6b2733330bdc7ab19cfeedee3909635009261f04d8c52db3465797d101

Download Submit
C:\Windows\System\yyqPToq.exe

Filesize
2.2MB

MD5
a3b29a5f58bce16b06031a5a62deef55

SHA1
26324c2a6c1755c845954f8fd944a1e5fd1fb7c9

SHA256
7b16e5f68a4ee41d8dba34d1739ef7d35b4048e8a84ad4a6d231445760e30aae

SHA512
e6185dcccc9e1fbb59d2288228fcc431a79344d0240b9a69ca90d07406dcce2d7ea25a254a4ed6f2e9e7ae34b0216b17998520991e4166b4e6baa38b68bd9f39

Download Submit
memory/216-0-0x00007FF6F7C90000-0x00007FF6F8082000-memory.dmp

Filesize
3.9MB

Download
memory/216-1-0x0000028925790000-0x00000289257A0000-memory.dmp

Filesize
64KB

Download
memory/624-250-0x00007FF66F930000-0x00007FF66FD22000-memory.dmp

Filesize
3.9MB

Download
memory/828-231-0x00007FF752910000-0x00007FF752D02000-memory.dmp

Filesize
3.9MB

Download
memory/1064-242-0x00007FF774380000-0x00007FF774772000-memory.dmp

Filesize
3.9MB

Download
memory/1540-247-0x00007FF61B250000-0x00007FF61B642000-memory.dmp

Filesize
3.9MB

Download
memory/2044-230-0x00007FF74A800000-0x00007FF74ABF2000-memory.dmp

Filesize
3.9MB

Download
memory/2060-47-0x00007FF6E11A0000-0x00007FF6E1592000-memory.dmp

Filesize
3.9MB

Download
memory/2364-220-0x00007FF720100000-0x00007FF7204F2000-memory.dmp

Filesize
3.9MB

Download
memory/2500-243-0x00007FF7D1E80000-0x00007FF7D2272000-memory.dmp

Filesize
3.9MB

Download
memory/2692-64-0x00007FF771190000-0x00007FF771582000-memory.dmp

Filesize
3.9MB

Download
memory/2852-12-0x00007FF608650000-0x00007FF608A42000-memory.dmp

Filesize
3.9MB

Download
memory/3116-158-0x00007FF6B6B30000-0x00007FF6B6F22000-memory.dmp

Filesize
3.9MB

Download
memory/3124-99-0x00007FF78CCB0000-0x00007FF78D0A2000-memory.dmp

Filesize
3.9MB

Download
memory/3172-26-0x00007FF7DE510000-0x00007FF7DE902000-memory.dmp

Filesize
3.9MB

Download
memory/3228-248-0x00007FF663A00000-0x00007FF663DF2000-memory.dmp

Filesize
3.9MB

Download
memory/3688-238-0x00007FF712EB0000-0x00007FF7132A2000-memory.dmp

Filesize
3.9MB

Download
memory/4000-127-0x00007FF629A40000-0x00007FF629E32000-memory.dmp

Filesize
3.9MB

Download
memory/4340-195-0x00000224D2190000-0x00000224D21B2000-memory.dmp

Filesize
136KB

Download
memory/4340-16-0x00000224D21F0000-0x00000224D2200000-memory.dmp

Filesize
64KB

Download
memory/4340-17-0x00000224D21F0000-0x00000224D2200000-memory.dmp

Filesize
64KB

Download
memory/4340-245-0x00007FFD04870000-0x00007FFD05331000-memory.dmp

Filesize
10.8MB

Download
memory/4340-251-0x00000224D3090000-0x00000224D3836000-memory.dmp

Filesize
7.6MB

Download
memory/4400-246-0x00007FF634890000-0x00007FF634C82000-memory.dmp

Filesize
3.9MB

Download
memory/4492-249-0x00007FF6ACE50000-0x00007FF6AD242000-memory.dmp

Filesize
3.9MB

Download
memory/4508-161-0x00007FF7046C0000-0x00007FF704AB2000-memory.dmp

Filesize
3.9MB

Download
memory/4980-205-0x00007FF63EBA0000-0x00007FF63EF92000-memory.dmp

Filesize
3.9MB

Download
memory/5012-186-0x00007FF658880000-0x00007FF658C72000-memory.dmp

Filesize
3.9MB

Download