xmrig | b4c4210659a5c758dea647b8d1570d552d4d4b42559d19a04132fb791e6fcbba

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/05/2024, 01:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
Size

1.9MB
MD5

0ad9836af1cefd4ab562d5150fdb76c4
SHA1

77fc8c90a82cd746ca321c168398838f13e09f61
SHA256

b4c4210659a5c758dea647b8d1570d552d4d4b42559d19a04132fb791e6fcbba
SHA512

3df5805aeaf06fd52472240bb68789f444823164887d51f6c31829bf33c6b62a678c8a6de5b0f231f81693672349038e0310aa1780840ce25b1e0251e7f025db
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1G:NABn

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 42 IoCs

miner

resource	yara_rule
behavioral2/memory/1300-32-0x00007FF7368D0000-0x00007FF736CC2000-memory.dmp	xmrig
behavioral2/memory/1456-54-0x00007FF7EB0F0000-0x00007FF7EB4E2000-memory.dmp	xmrig
behavioral2/memory/2984-76-0x00007FF731D10000-0x00007FF732102000-memory.dmp	xmrig
behavioral2/memory/2824-311-0x00007FF7076C0000-0x00007FF707AB2000-memory.dmp	xmrig
behavioral2/memory/4532-318-0x00007FF737950000-0x00007FF737D42000-memory.dmp	xmrig
behavioral2/memory/2556-327-0x00007FF749490000-0x00007FF749882000-memory.dmp	xmrig
behavioral2/memory/2940-328-0x00007FF6816F0000-0x00007FF681AE2000-memory.dmp	xmrig
behavioral2/memory/2052-329-0x00007FF7C8DA0000-0x00007FF7C9192000-memory.dmp	xmrig
behavioral2/memory/5060-330-0x00007FF65A650000-0x00007FF65AA42000-memory.dmp	xmrig
behavioral2/memory/3384-92-0x00007FF73A460000-0x00007FF73A852000-memory.dmp	xmrig
behavioral2/memory/1356-86-0x00007FF7354C0000-0x00007FF7358B2000-memory.dmp	xmrig
behavioral2/memory/3948-79-0x00007FF6D2060000-0x00007FF6D2452000-memory.dmp	xmrig
behavioral2/memory/5044-85-0x00007FF66E640000-0x00007FF66EA32000-memory.dmp	xmrig
behavioral2/memory/1800-75-0x00007FF62B470000-0x00007FF62B862000-memory.dmp	xmrig
behavioral2/memory/3976-66-0x00007FF7B18F0000-0x00007FF7B1CE2000-memory.dmp	xmrig
behavioral2/memory/3684-65-0x00007FF616350000-0x00007FF616742000-memory.dmp	xmrig
behavioral2/memory/3200-27-0x00007FF782A50000-0x00007FF782E42000-memory.dmp	xmrig
behavioral2/memory/1196-2492-0x00007FF60E3A0000-0x00007FF60E792000-memory.dmp	xmrig
behavioral2/memory/4988-2688-0x00007FF767BD0000-0x00007FF767FC2000-memory.dmp	xmrig
behavioral2/memory/3388-2689-0x00007FF692580000-0x00007FF692972000-memory.dmp	xmrig
behavioral2/memory/1956-2717-0x00007FF64DDB0000-0x00007FF64E1A2000-memory.dmp	xmrig
behavioral2/memory/1300-2743-0x00007FF7368D0000-0x00007FF736CC2000-memory.dmp	xmrig
behavioral2/memory/1800-2744-0x00007FF62B470000-0x00007FF62B862000-memory.dmp	xmrig
behavioral2/memory/3200-2741-0x00007FF782A50000-0x00007FF782E42000-memory.dmp	xmrig
behavioral2/memory/1456-2746-0x00007FF7EB0F0000-0x00007FF7EB4E2000-memory.dmp	xmrig
behavioral2/memory/2984-2749-0x00007FF731D10000-0x00007FF732102000-memory.dmp	xmrig
behavioral2/memory/3948-2750-0x00007FF6D2060000-0x00007FF6D2452000-memory.dmp	xmrig
behavioral2/memory/3684-2752-0x00007FF616350000-0x00007FF616742000-memory.dmp	xmrig
behavioral2/memory/3976-2754-0x00007FF7B18F0000-0x00007FF7B1CE2000-memory.dmp	xmrig
behavioral2/memory/5044-2756-0x00007FF66E640000-0x00007FF66EA32000-memory.dmp	xmrig
behavioral2/memory/1196-2758-0x00007FF60E3A0000-0x00007FF60E792000-memory.dmp	xmrig
behavioral2/memory/1356-2760-0x00007FF7354C0000-0x00007FF7358B2000-memory.dmp	xmrig
behavioral2/memory/3384-2762-0x00007FF73A460000-0x00007FF73A852000-memory.dmp	xmrig
behavioral2/memory/4988-2764-0x00007FF767BD0000-0x00007FF767FC2000-memory.dmp	xmrig
behavioral2/memory/3388-2768-0x00007FF692580000-0x00007FF692972000-memory.dmp	xmrig
behavioral2/memory/1956-2766-0x00007FF64DDB0000-0x00007FF64E1A2000-memory.dmp	xmrig
behavioral2/memory/2824-2770-0x00007FF7076C0000-0x00007FF707AB2000-memory.dmp	xmrig
behavioral2/memory/4532-2772-0x00007FF737950000-0x00007FF737D42000-memory.dmp	xmrig
behavioral2/memory/2940-2776-0x00007FF6816F0000-0x00007FF681AE2000-memory.dmp	xmrig
behavioral2/memory/2556-2775-0x00007FF749490000-0x00007FF749882000-memory.dmp	xmrig
behavioral2/memory/2052-2778-0x00007FF7C8DA0000-0x00007FF7C9192000-memory.dmp	xmrig
behavioral2/memory/5060-2784-0x00007FF65A650000-0x00007FF65AA42000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	3720	powershell.exe
5	3720	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1800	qVBEbae.exe
3200	qvWMoww.exe
1300	XbwsUya.exe
1456	nVtmJEP.exe
2984	fjAoKqC.exe
3948	ZVbemZb.exe
3684	XjiaYOg.exe
3976	kFLJZnq.exe
5044	NqcXkxe.exe
1196	QWWSlvH.exe
1356	TZEKfKa.exe
3384	yobyWVW.exe
4988	OTmOzwu.exe
1956	zzvegPS.exe
3388	jlYMIfv.exe
2824	YQKeDJr.exe
4532	sGvAMaS.exe
2556	EVxkUXt.exe
2940	vCdXbFH.exe
2052	urUKKyi.exe
5060	xLQlxSg.exe
4724	dGitzGw.exe
3512	HxgHKUG.exe
576	hLejyvb.exe
3868	HASBhZp.exe
516	ylXBVXm.exe
4120	rEkauzf.exe
1940	yIexMqT.exe
1396	dJdePNx.exe
3652	dIpLytu.exe
3992	tksVOzX.exe
4224	FfgBtTV.exe
2156	dBMVsmG.exe
3612	yYewfqf.exe
3328	wqImDos.exe
1324	LEWfeRm.exe
3544	yRWMYvi.exe
4416	WGRgHUD.exe
4800	BpZeuiG.exe
4828	CMKBGRY.exe
2140	AdRbzMG.exe
116	WehKhxp.exe
3444	KtfuHXl.exe
4396	EgHcsGI.exe
1348	IObAakI.exe
4584	AePlMEA.exe
2032	CEAZrKK.exe
2936	NZNVcyb.exe
2744	cGzSLeB.exe
4044	vjfYwVX.exe
5028	oNDyjfK.exe
3376	hubFTpD.exe
3496	yQPCXTM.exe
4440	QhWtwoq.exe
1432	EWVXVVy.exe
1524	OBrPwEy.exe
4668	tMgnRfJ.exe
1232	GXilIJq.exe
4512	XWTyisZ.exe
852	ZLbknhl.exe
5100	XaiQTEN.exe
3048	UYIuJvG.exe
1076	jRiYsYb.exe
1016	piAOBQp.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4664-0-0x00007FF600D60000-0x00007FF601152000-memory.dmp	upx
behavioral2/files/0x00070000000233ef-6.dat	upx
behavioral2/files/0x00080000000233eb-8.dat	upx
behavioral2/files/0x00080000000233ee-12.dat	upx
behavioral2/files/0x00070000000233f0-20.dat	upx
behavioral2/memory/1300-32-0x00007FF7368D0000-0x00007FF736CC2000-memory.dmp	upx
behavioral2/memory/1456-54-0x00007FF7EB0F0000-0x00007FF7EB4E2000-memory.dmp	upx
behavioral2/files/0x00070000000233f4-62.dat	upx
behavioral2/files/0x00080000000233f6-67.dat	upx
behavioral2/memory/2984-76-0x00007FF731D10000-0x00007FF732102000-memory.dmp	upx
behavioral2/files/0x00070000000233f8-80.dat	upx
behavioral2/memory/3388-100-0x00007FF692580000-0x00007FF692972000-memory.dmp	upx
behavioral2/files/0x00080000000233ec-104.dat	upx
behavioral2/files/0x00070000000233ff-126.dat	upx
behavioral2/files/0x0007000000023402-149.dat	upx
behavioral2/files/0x0007000000023405-156.dat	upx
behavioral2/files/0x0007000000023409-176.dat	upx
behavioral2/files/0x000700000002340a-189.dat	upx
behavioral2/memory/2824-311-0x00007FF7076C0000-0x00007FF707AB2000-memory.dmp	upx
behavioral2/memory/4532-318-0x00007FF737950000-0x00007FF737D42000-memory.dmp	upx
behavioral2/memory/2556-327-0x00007FF749490000-0x00007FF749882000-memory.dmp	upx
behavioral2/memory/2940-328-0x00007FF6816F0000-0x00007FF681AE2000-memory.dmp	upx
behavioral2/memory/2052-329-0x00007FF7C8DA0000-0x00007FF7C9192000-memory.dmp	upx
behavioral2/memory/5060-330-0x00007FF65A650000-0x00007FF65AA42000-memory.dmp	upx
behavioral2/files/0x000700000002340c-191.dat	upx
behavioral2/files/0x000700000002340b-186.dat	upx
behavioral2/files/0x0007000000023408-179.dat	upx
behavioral2/files/0x0007000000023407-174.dat	upx
behavioral2/files/0x0007000000023406-169.dat	upx
behavioral2/files/0x0007000000023404-159.dat	upx
behavioral2/files/0x0007000000023403-154.dat	upx
behavioral2/files/0x0007000000023401-144.dat	upx
behavioral2/files/0x0007000000023400-139.dat	upx
behavioral2/files/0x00070000000233fe-129.dat	upx
behavioral2/files/0x00070000000233fd-124.dat	upx
behavioral2/files/0x00070000000233fc-119.dat	upx
behavioral2/files/0x00070000000233fb-112.dat	upx
behavioral2/files/0x00070000000233fa-102.dat	upx
behavioral2/memory/1956-101-0x00007FF64DDB0000-0x00007FF64E1A2000-memory.dmp	upx
behavioral2/files/0x00070000000233f9-98.dat	upx
behavioral2/memory/4988-97-0x00007FF767BD0000-0x00007FF767FC2000-memory.dmp	upx
behavioral2/memory/3384-92-0x00007FF73A460000-0x00007FF73A852000-memory.dmp	upx
behavioral2/memory/1356-86-0x00007FF7354C0000-0x00007FF7358B2000-memory.dmp	upx
behavioral2/files/0x00070000000233f7-81.dat	upx
behavioral2/memory/3948-79-0x00007FF6D2060000-0x00007FF6D2452000-memory.dmp	upx
behavioral2/memory/5044-85-0x00007FF66E640000-0x00007FF66EA32000-memory.dmp	upx
behavioral2/memory/1800-75-0x00007FF62B470000-0x00007FF62B862000-memory.dmp	upx
behavioral2/files/0x00080000000233f5-72.dat	upx
behavioral2/memory/1196-70-0x00007FF60E3A0000-0x00007FF60E792000-memory.dmp	upx
behavioral2/memory/3976-66-0x00007FF7B18F0000-0x00007FF7B1CE2000-memory.dmp	upx
behavioral2/memory/3684-65-0x00007FF616350000-0x00007FF616742000-memory.dmp	upx
behavioral2/files/0x00070000000233f3-52.dat	upx
behavioral2/files/0x00070000000233f2-51.dat	upx
behavioral2/files/0x00070000000233f1-45.dat	upx
behavioral2/memory/3200-27-0x00007FF782A50000-0x00007FF782E42000-memory.dmp	upx
behavioral2/memory/1196-2492-0x00007FF60E3A0000-0x00007FF60E792000-memory.dmp	upx
behavioral2/memory/4988-2688-0x00007FF767BD0000-0x00007FF767FC2000-memory.dmp	upx
behavioral2/memory/3388-2689-0x00007FF692580000-0x00007FF692972000-memory.dmp	upx
behavioral2/memory/1956-2717-0x00007FF64DDB0000-0x00007FF64E1A2000-memory.dmp	upx
behavioral2/memory/1300-2743-0x00007FF7368D0000-0x00007FF736CC2000-memory.dmp	upx
behavioral2/memory/1800-2744-0x00007FF62B470000-0x00007FF62B862000-memory.dmp	upx
behavioral2/memory/3200-2741-0x00007FF782A50000-0x00007FF782E42000-memory.dmp	upx
behavioral2/memory/1456-2746-0x00007FF7EB0F0000-0x00007FF7EB4E2000-memory.dmp	upx
behavioral2/memory/2984-2749-0x00007FF731D10000-0x00007FF732102000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ZAsSRQN.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\mAwuXft.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\vIvCMGz.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\hMzglda.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\gUzIgbA.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\XaiQTEN.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\nACMwJI.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\tnzsmUL.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\ugepNmq.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\BjCxpCq.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\zxdHJzv.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\KRBqjkb.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\xJeXUVk.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\wXzCraC.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\uJzzuqG.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\NXqAChe.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\WkESGQg.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\zTqRgyy.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\StTnczk.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\BnrEUQh.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\LhFptIF.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\KIuzJZJ.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\LYeELgS.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\HWtTdOy.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\OrEzJAs.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\ohvMxYU.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\qSLftYO.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\moNTPrd.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\lZoNPun.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\xfutNLO.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\xiUVkIx.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\UbyslzT.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\agZfHMO.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\avAgSCR.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\sGvAMaS.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\qKIWIfY.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\oNDyjfK.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\XWTyisZ.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\FmUGywu.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\eOtqzSA.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\wtsFHbf.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\kJkAPoH.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\IgecaDt.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\Vhcpnib.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\OBrPwEy.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\PlTcBwg.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\QJEEgsJ.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\EsopMXl.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\vJtywDY.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\hsoEXvi.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\lMislla.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\qNeqAnN.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\YQKeDJr.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\pkrPgUi.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\CJCClMa.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\DrWJals.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\PmMKden.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\XJcTMPA.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\dipgmwd.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\fQXkiOX.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\XGXYcof.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\QEwwfzW.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\wnuSutV.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\lvoBLXD.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3720	powershell.exe
3720	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
Token: SeDebugPrivilege	3720	powershell.exe
Token: SeLockMemoryPrivilege	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 3720	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	82
PID 4664 wrote to memory of 3720	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	82
PID 4664 wrote to memory of 3200	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	83
PID 4664 wrote to memory of 3200	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	83
PID 4664 wrote to memory of 1800	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	84
PID 4664 wrote to memory of 1800	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	84
PID 4664 wrote to memory of 1300	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	85
PID 4664 wrote to memory of 1300	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	85
PID 4664 wrote to memory of 1456	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	86
PID 4664 wrote to memory of 1456	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	86
PID 4664 wrote to memory of 2984	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	87
PID 4664 wrote to memory of 2984	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	87
PID 4664 wrote to memory of 3948	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	88
PID 4664 wrote to memory of 3948	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	88
PID 4664 wrote to memory of 3684	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	89
PID 4664 wrote to memory of 3684	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	89
PID 4664 wrote to memory of 3976	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	90
PID 4664 wrote to memory of 3976	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	90
PID 4664 wrote to memory of 5044	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	91
PID 4664 wrote to memory of 5044	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	91
PID 4664 wrote to memory of 1196	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	92
PID 4664 wrote to memory of 1196	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	92
PID 4664 wrote to memory of 1356	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	93
PID 4664 wrote to memory of 1356	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	93
PID 4664 wrote to memory of 3384	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	94
PID 4664 wrote to memory of 3384	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	94
PID 4664 wrote to memory of 4988	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	95
PID 4664 wrote to memory of 4988	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	95
PID 4664 wrote to memory of 1956	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	96
PID 4664 wrote to memory of 1956	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	96
PID 4664 wrote to memory of 3388	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	97
PID 4664 wrote to memory of 3388	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	97
PID 4664 wrote to memory of 2824	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	98
PID 4664 wrote to memory of 2824	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	98
PID 4664 wrote to memory of 4532	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	99
PID 4664 wrote to memory of 4532	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	99
PID 4664 wrote to memory of 2556	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	100
PID 4664 wrote to memory of 2556	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	100
PID 4664 wrote to memory of 2940	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	101
PID 4664 wrote to memory of 2940	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	101
PID 4664 wrote to memory of 2052	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	102
PID 4664 wrote to memory of 2052	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	102
PID 4664 wrote to memory of 5060	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	103
PID 4664 wrote to memory of 5060	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	103
PID 4664 wrote to memory of 4724	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	104
PID 4664 wrote to memory of 4724	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	104
PID 4664 wrote to memory of 3512	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	105
PID 4664 wrote to memory of 3512	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	105
PID 4664 wrote to memory of 576	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	106
PID 4664 wrote to memory of 576	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	106
PID 4664 wrote to memory of 3868	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	107
PID 4664 wrote to memory of 3868	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	107
PID 4664 wrote to memory of 516	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	108
PID 4664 wrote to memory of 516	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	108
PID 4664 wrote to memory of 4120	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	109
PID 4664 wrote to memory of 4120	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	109
PID 4664 wrote to memory of 1940	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	110
PID 4664 wrote to memory of 1940	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	110
PID 4664 wrote to memory of 1396	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	111
PID 4664 wrote to memory of 1396	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	111
PID 4664 wrote to memory of 3652	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	112
PID 4664 wrote to memory of 3652	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	112
PID 4664 wrote to memory of 3992	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	113
PID 4664 wrote to memory of 3992	4664	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	113

C:\Users\Admin\AppData\Local\Temp\0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3720
- C:\Windows\System\qvWMoww.exe
  C:\Windows\System\qvWMoww.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\qVBEbae.exe
  C:\Windows\System\qVBEbae.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\XbwsUya.exe
  C:\Windows\System\XbwsUya.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\nVtmJEP.exe
  C:\Windows\System\nVtmJEP.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\fjAoKqC.exe
  C:\Windows\System\fjAoKqC.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\ZVbemZb.exe
  C:\Windows\System\ZVbemZb.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\XjiaYOg.exe
  C:\Windows\System\XjiaYOg.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\kFLJZnq.exe
  C:\Windows\System\kFLJZnq.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\NqcXkxe.exe
  C:\Windows\System\NqcXkxe.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\QWWSlvH.exe
  C:\Windows\System\QWWSlvH.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\TZEKfKa.exe
  C:\Windows\System\TZEKfKa.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\yobyWVW.exe
  C:\Windows\System\yobyWVW.exe
  2⤵
  - Executes dropped EXE
  PID:3384
- C:\Windows\System\OTmOzwu.exe
  C:\Windows\System\OTmOzwu.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\zzvegPS.exe
  C:\Windows\System\zzvegPS.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\jlYMIfv.exe
  C:\Windows\System\jlYMIfv.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\YQKeDJr.exe
  C:\Windows\System\YQKeDJr.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\sGvAMaS.exe
  C:\Windows\System\sGvAMaS.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\EVxkUXt.exe
  C:\Windows\System\EVxkUXt.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\vCdXbFH.exe
  C:\Windows\System\vCdXbFH.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\urUKKyi.exe
  C:\Windows\System\urUKKyi.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\xLQlxSg.exe
  C:\Windows\System\xLQlxSg.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\dGitzGw.exe
  C:\Windows\System\dGitzGw.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\HxgHKUG.exe
  C:\Windows\System\HxgHKUG.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\hLejyvb.exe
  C:\Windows\System\hLejyvb.exe
  2⤵
  - Executes dropped EXE
  PID:576
- C:\Windows\System\HASBhZp.exe
  C:\Windows\System\HASBhZp.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\ylXBVXm.exe
  C:\Windows\System\ylXBVXm.exe
  2⤵
  - Executes dropped EXE
  PID:516
- C:\Windows\System\rEkauzf.exe
  C:\Windows\System\rEkauzf.exe
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\System\yIexMqT.exe
  C:\Windows\System\yIexMqT.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\dJdePNx.exe
  C:\Windows\System\dJdePNx.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\dIpLytu.exe
  C:\Windows\System\dIpLytu.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\tksVOzX.exe
  C:\Windows\System\tksVOzX.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\FfgBtTV.exe
  C:\Windows\System\FfgBtTV.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\dBMVsmG.exe
  C:\Windows\System\dBMVsmG.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\yYewfqf.exe
  C:\Windows\System\yYewfqf.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\wqImDos.exe
  C:\Windows\System\wqImDos.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\LEWfeRm.exe
  C:\Windows\System\LEWfeRm.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\yRWMYvi.exe
  C:\Windows\System\yRWMYvi.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\WGRgHUD.exe
  C:\Windows\System\WGRgHUD.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\BpZeuiG.exe
  C:\Windows\System\BpZeuiG.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\CMKBGRY.exe
  C:\Windows\System\CMKBGRY.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\AdRbzMG.exe
  C:\Windows\System\AdRbzMG.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\WehKhxp.exe
  C:\Windows\System\WehKhxp.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\KtfuHXl.exe
  C:\Windows\System\KtfuHXl.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\EgHcsGI.exe
  C:\Windows\System\EgHcsGI.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\IObAakI.exe
  C:\Windows\System\IObAakI.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\AePlMEA.exe
  C:\Windows\System\AePlMEA.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\CEAZrKK.exe
  C:\Windows\System\CEAZrKK.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\NZNVcyb.exe
  C:\Windows\System\NZNVcyb.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\cGzSLeB.exe
  C:\Windows\System\cGzSLeB.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\vjfYwVX.exe
  C:\Windows\System\vjfYwVX.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\oNDyjfK.exe
  C:\Windows\System\oNDyjfK.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\hubFTpD.exe
  C:\Windows\System\hubFTpD.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\yQPCXTM.exe
  C:\Windows\System\yQPCXTM.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\QhWtwoq.exe
  C:\Windows\System\QhWtwoq.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\EWVXVVy.exe
  C:\Windows\System\EWVXVVy.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\OBrPwEy.exe
  C:\Windows\System\OBrPwEy.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\tMgnRfJ.exe
  C:\Windows\System\tMgnRfJ.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\GXilIJq.exe
  C:\Windows\System\GXilIJq.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\XWTyisZ.exe
  C:\Windows\System\XWTyisZ.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\ZLbknhl.exe
  C:\Windows\System\ZLbknhl.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\XaiQTEN.exe
  C:\Windows\System\XaiQTEN.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\UYIuJvG.exe
  C:\Windows\System\UYIuJvG.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\jRiYsYb.exe
  C:\Windows\System\jRiYsYb.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\piAOBQp.exe
  C:\Windows\System\piAOBQp.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\QUQGbWI.exe
  C:\Windows\System\QUQGbWI.exe
  2⤵
  PID:4192
- C:\Windows\System\sALttcj.exe
  C:\Windows\System\sALttcj.exe
  2⤵
  PID:4936
- C:\Windows\System\FnLYwpM.exe
  C:\Windows\System\FnLYwpM.exe
  2⤵
  PID:2312
- C:\Windows\System\rtrfquV.exe
  C:\Windows\System\rtrfquV.exe
  2⤵
  PID:3152
- C:\Windows\System\SXYQUuC.exe
  C:\Windows\System\SXYQUuC.exe
  2⤵
  PID:2624
- C:\Windows\System\ZIICRRr.exe
  C:\Windows\System\ZIICRRr.exe
  2⤵
  PID:4276
- C:\Windows\System\zeoGTbz.exe
  C:\Windows\System\zeoGTbz.exe
  2⤵
  PID:956
- C:\Windows\System\OCqIAnK.exe
  C:\Windows\System\OCqIAnK.exe
  2⤵
  PID:2728
- C:\Windows\System\AdMYdlf.exe
  C:\Windows\System\AdMYdlf.exe
  2⤵
  PID:3448
- C:\Windows\System\MEacrDC.exe
  C:\Windows\System\MEacrDC.exe
  2⤵
  PID:3264
- C:\Windows\System\vpRhNBZ.exe
  C:\Windows\System\vpRhNBZ.exe
  2⤵
  PID:4000
- C:\Windows\System\qwjUlap.exe
  C:\Windows\System\qwjUlap.exe
  2⤵
  PID:3892
- C:\Windows\System\uyPjzfJ.exe
  C:\Windows\System\uyPjzfJ.exe
  2⤵
  PID:3568
- C:\Windows\System\urKsZwr.exe
  C:\Windows\System\urKsZwr.exe
  2⤵
  PID:1424
- C:\Windows\System\Bbbxfci.exe
  C:\Windows\System\Bbbxfci.exe
  2⤵
  PID:1696
- C:\Windows\System\ybJynSi.exe
  C:\Windows\System\ybJynSi.exe
  2⤵
  PID:4336
- C:\Windows\System\EhrbYeq.exe
  C:\Windows\System\EhrbYeq.exe
  2⤵
  PID:2304
- C:\Windows\System\rLzuFIy.exe
  C:\Windows\System\rLzuFIy.exe
  2⤵
  PID:2088
- C:\Windows\System\rrPXMVK.exe
  C:\Windows\System\rrPXMVK.exe
  2⤵
  PID:2524
- C:\Windows\System\mkhemkf.exe
  C:\Windows\System\mkhemkf.exe
  2⤵
  PID:4680
- C:\Windows\System\MIfddcb.exe
  C:\Windows\System\MIfddcb.exe
  2⤵
  PID:1820
- C:\Windows\System\eEpSjQO.exe
  C:\Windows\System\eEpSjQO.exe
  2⤵
  PID:384
- C:\Windows\System\XGxtngT.exe
  C:\Windows\System\XGxtngT.exe
  2⤵
  PID:3336
- C:\Windows\System\IHzzsWP.exe
  C:\Windows\System\IHzzsWP.exe
  2⤵
  PID:3936
- C:\Windows\System\cxaYwcw.exe
  C:\Windows\System\cxaYwcw.exe
  2⤵
  PID:1596
- C:\Windows\System\AGYaLHQ.exe
  C:\Windows\System\AGYaLHQ.exe
  2⤵
  PID:1688
- C:\Windows\System\UbyslzT.exe
  C:\Windows\System\UbyslzT.exe
  2⤵
  PID:4900
- C:\Windows\System\pfVZQfA.exe
  C:\Windows\System\pfVZQfA.exe
  2⤵
  PID:2036
- C:\Windows\System\GGShuOt.exe
  C:\Windows\System\GGShuOt.exe
  2⤵
  PID:1136
- C:\Windows\System\nEjswxB.exe
  C:\Windows\System\nEjswxB.exe
  2⤵
  PID:5140
- C:\Windows\System\GoRwSez.exe
  C:\Windows\System\GoRwSez.exe
  2⤵
  PID:5164
- C:\Windows\System\zfzuvTL.exe
  C:\Windows\System\zfzuvTL.exe
  2⤵
  PID:5180
- C:\Windows\System\ccQTGPl.exe
  C:\Windows\System\ccQTGPl.exe
  2⤵
  PID:5208
- C:\Windows\System\HSjyJox.exe
  C:\Windows\System\HSjyJox.exe
  2⤵
  PID:5224
- C:\Windows\System\xFnjWcj.exe
  C:\Windows\System\xFnjWcj.exe
  2⤵
  PID:5264
- C:\Windows\System\VLKYSFs.exe
  C:\Windows\System\VLKYSFs.exe
  2⤵
  PID:5304
- C:\Windows\System\Suczkto.exe
  C:\Windows\System\Suczkto.exe
  2⤵
  PID:5328
- C:\Windows\System\UUgZirP.exe
  C:\Windows\System\UUgZirP.exe
  2⤵
  PID:5344
- C:\Windows\System\lvoBLXD.exe
  C:\Windows\System\lvoBLXD.exe
  2⤵
  PID:5372
- C:\Windows\System\AglJiBN.exe
  C:\Windows\System\AglJiBN.exe
  2⤵
  PID:5388
- C:\Windows\System\KXKqxod.exe
  C:\Windows\System\KXKqxod.exe
  2⤵
  PID:5408
- C:\Windows\System\fknIosC.exe
  C:\Windows\System\fknIosC.exe
  2⤵
  PID:5460
- C:\Windows\System\rWWUwUG.exe
  C:\Windows\System\rWWUwUG.exe
  2⤵
  PID:5500
- C:\Windows\System\hsscckN.exe
  C:\Windows\System\hsscckN.exe
  2⤵
  PID:5552
- C:\Windows\System\Twzvqnt.exe
  C:\Windows\System\Twzvqnt.exe
  2⤵
  PID:5576
- C:\Windows\System\jGWRFuv.exe
  C:\Windows\System\jGWRFuv.exe
  2⤵
  PID:5620
- C:\Windows\System\fcafptl.exe
  C:\Windows\System\fcafptl.exe
  2⤵
  PID:5636
- C:\Windows\System\IMmUyhV.exe
  C:\Windows\System\IMmUyhV.exe
  2⤵
  PID:5664
- C:\Windows\System\iTpBOxl.exe
  C:\Windows\System\iTpBOxl.exe
  2⤵
  PID:5704
- C:\Windows\System\IrZXiSk.exe
  C:\Windows\System\IrZXiSk.exe
  2⤵
  PID:5732
- C:\Windows\System\EQRXIrS.exe
  C:\Windows\System\EQRXIrS.exe
  2⤵
  PID:5760
- C:\Windows\System\LwXJOak.exe
  C:\Windows\System\LwXJOak.exe
  2⤵
  PID:5796
- C:\Windows\System\evAiFHx.exe
  C:\Windows\System\evAiFHx.exe
  2⤵
  PID:5816
- C:\Windows\System\QZHObAH.exe
  C:\Windows\System\QZHObAH.exe
  2⤵
  PID:5844
- C:\Windows\System\zPvwbZV.exe
  C:\Windows\System\zPvwbZV.exe
  2⤵
  PID:5860
- C:\Windows\System\xTzQKKW.exe
  C:\Windows\System\xTzQKKW.exe
  2⤵
  PID:5888
- C:\Windows\System\POQNNfy.exe
  C:\Windows\System\POQNNfy.exe
  2⤵
  PID:5936
- C:\Windows\System\RppZYTs.exe
  C:\Windows\System\RppZYTs.exe
  2⤵
  PID:5956
- C:\Windows\System\CWvsKAn.exe
  C:\Windows\System\CWvsKAn.exe
  2⤵
  PID:5984
- C:\Windows\System\kBWCJTQ.exe
  C:\Windows\System\kBWCJTQ.exe
  2⤵
  PID:6028
- C:\Windows\System\SWLRWtI.exe
  C:\Windows\System\SWLRWtI.exe
  2⤵
  PID:6064
- C:\Windows\System\qTCFgHX.exe
  C:\Windows\System\qTCFgHX.exe
  2⤵
  PID:6084
- C:\Windows\System\mrCjvBb.exe
  C:\Windows\System\mrCjvBb.exe
  2⤵
  PID:6108
- C:\Windows\System\UnNZZua.exe
  C:\Windows\System\UnNZZua.exe
  2⤵
  PID:6128
- C:\Windows\System\CtewkNq.exe
  C:\Windows\System\CtewkNq.exe
  2⤵
  PID:3016
- C:\Windows\System\tFgAUCx.exe
  C:\Windows\System\tFgAUCx.exe
  2⤵
  PID:5128
- C:\Windows\System\RNODDkf.exe
  C:\Windows\System\RNODDkf.exe
  2⤵
  PID:5188
- C:\Windows\System\oBiMeaO.exe
  C:\Windows\System\oBiMeaO.exe
  2⤵
  PID:5284
- C:\Windows\System\ghCOmuL.exe
  C:\Windows\System\ghCOmuL.exe
  2⤵
  PID:5400
- C:\Windows\System\oIFHuej.exe
  C:\Windows\System\oIFHuej.exe
  2⤵
  PID:5492
- C:\Windows\System\LfIzlBq.exe
  C:\Windows\System\LfIzlBq.exe
  2⤵
  PID:5544
- C:\Windows\System\vlpxTqY.exe
  C:\Windows\System\vlpxTqY.exe
  2⤵
  PID:5632
- C:\Windows\System\LjiWsuY.exe
  C:\Windows\System\LjiWsuY.exe
  2⤵
  PID:5676
- C:\Windows\System\CnFdpzh.exe
  C:\Windows\System\CnFdpzh.exe
  2⤵
  PID:5724
- C:\Windows\System\Bbljgsx.exe
  C:\Windows\System\Bbljgsx.exe
  2⤵
  PID:5792
- C:\Windows\System\DAEWaFg.exe
  C:\Windows\System\DAEWaFg.exe
  2⤵
  PID:5836
- C:\Windows\System\oPuLfdK.exe
  C:\Windows\System\oPuLfdK.exe
  2⤵
  PID:5932
- C:\Windows\System\RXNIreI.exe
  C:\Windows\System\RXNIreI.exe
  2⤵
  PID:5976
- C:\Windows\System\QYXgleJ.exe
  C:\Windows\System\QYXgleJ.exe
  2⤵
  PID:6008
- C:\Windows\System\zksAnrP.exe
  C:\Windows\System\zksAnrP.exe
  2⤵
  PID:3396
- C:\Windows\System\YHMqJcB.exe
  C:\Windows\System\YHMqJcB.exe
  2⤵
  PID:2136
- C:\Windows\System\AeBCDRv.exe
  C:\Windows\System\AeBCDRv.exe
  2⤵
  PID:1452
- C:\Windows\System\qFZVsJK.exe
  C:\Windows\System\qFZVsJK.exe
  2⤵
  PID:5340
- C:\Windows\System\ngMXwoj.exe
  C:\Windows\System\ngMXwoj.exe
  2⤵
  PID:5628
- C:\Windows\System\lMislla.exe
  C:\Windows\System\lMislla.exe
  2⤵
  PID:5700
- C:\Windows\System\EJRoxcG.exe
  C:\Windows\System\EJRoxcG.exe
  2⤵
  PID:5824
- C:\Windows\System\mPvYClj.exe
  C:\Windows\System\mPvYClj.exe
  2⤵
  PID:6004
- C:\Windows\System\FgySPAk.exe
  C:\Windows\System\FgySPAk.exe
  2⤵
  PID:6120
- C:\Windows\System\eqrAMNf.exe
  C:\Windows\System\eqrAMNf.exe
  2⤵
  PID:5232
- C:\Windows\System\sYldJvE.exe
  C:\Windows\System\sYldJvE.exe
  2⤵
  PID:5404
- C:\Windows\System\HccxLxX.exe
  C:\Windows\System\HccxLxX.exe
  2⤵
  PID:444
- C:\Windows\System\NJmJuJp.exe
  C:\Windows\System\NJmJuJp.exe
  2⤵
  PID:5172
- C:\Windows\System\AJOHRgd.exe
  C:\Windows\System\AJOHRgd.exe
  2⤵
  PID:5612
- C:\Windows\System\yfyRwiA.exe
  C:\Windows\System\yfyRwiA.exe
  2⤵
  PID:6156
- C:\Windows\System\fTAXIin.exe
  C:\Windows\System\fTAXIin.exe
  2⤵
  PID:6184
- C:\Windows\System\fQJBxxS.exe
  C:\Windows\System\fQJBxxS.exe
  2⤵
  PID:6208
- C:\Windows\System\BCiKqZX.exe
  C:\Windows\System\BCiKqZX.exe
  2⤵
  PID:6232
- C:\Windows\System\OuMWghX.exe
  C:\Windows\System\OuMWghX.exe
  2⤵
  PID:6268
- C:\Windows\System\FaVbqzm.exe
  C:\Windows\System\FaVbqzm.exe
  2⤵
  PID:6316
- C:\Windows\System\DdvlpXQ.exe
  C:\Windows\System\DdvlpXQ.exe
  2⤵
  PID:6336
- C:\Windows\System\RoMkxrY.exe
  C:\Windows\System\RoMkxrY.exe
  2⤵
  PID:6364
- C:\Windows\System\hhkqSTu.exe
  C:\Windows\System\hhkqSTu.exe
  2⤵
  PID:6392
- C:\Windows\System\xMIsVqv.exe
  C:\Windows\System\xMIsVqv.exe
  2⤵
  PID:6408
- C:\Windows\System\kdfkNQn.exe
  C:\Windows\System\kdfkNQn.exe
  2⤵
  PID:6432
- C:\Windows\System\RFsKxGn.exe
  C:\Windows\System\RFsKxGn.exe
  2⤵
  PID:6452
- C:\Windows\System\OgXgIps.exe
  C:\Windows\System\OgXgIps.exe
  2⤵
  PID:6468
- C:\Windows\System\pIAeglN.exe
  C:\Windows\System\pIAeglN.exe
  2⤵
  PID:6492
- C:\Windows\System\SvpsqDO.exe
  C:\Windows\System\SvpsqDO.exe
  2⤵
  PID:6536
- C:\Windows\System\NXqAChe.exe
  C:\Windows\System\NXqAChe.exe
  2⤵
  PID:6560
- C:\Windows\System\KGSLtZp.exe
  C:\Windows\System\KGSLtZp.exe
  2⤵
  PID:6580
- C:\Windows\System\kLEOKWb.exe
  C:\Windows\System\kLEOKWb.exe
  2⤵
  PID:6604
- C:\Windows\System\WxWeEMk.exe
  C:\Windows\System\WxWeEMk.exe
  2⤵
  PID:6620
- C:\Windows\System\svNpGaX.exe
  C:\Windows\System\svNpGaX.exe
  2⤵
  PID:6644
- C:\Windows\System\MBCJAPG.exe
  C:\Windows\System\MBCJAPG.exe
  2⤵
  PID:6704
- C:\Windows\System\VZaHFHb.exe
  C:\Windows\System\VZaHFHb.exe
  2⤵
  PID:6772
- C:\Windows\System\RqRGnlr.exe
  C:\Windows\System\RqRGnlr.exe
  2⤵
  PID:6792
- C:\Windows\System\hXYgofX.exe
  C:\Windows\System\hXYgofX.exe
  2⤵
  PID:6812
- C:\Windows\System\TANUgjT.exe
  C:\Windows\System\TANUgjT.exe
  2⤵
  PID:6836
- C:\Windows\System\fIaanYG.exe
  C:\Windows\System\fIaanYG.exe
  2⤵
  PID:6884
- C:\Windows\System\RXudBUY.exe
  C:\Windows\System\RXudBUY.exe
  2⤵
  PID:6904
- C:\Windows\System\hPKDeAu.exe
  C:\Windows\System\hPKDeAu.exe
  2⤵
  PID:6924
- C:\Windows\System\BQgcToy.exe
  C:\Windows\System\BQgcToy.exe
  2⤵
  PID:6968
- C:\Windows\System\ykfUXNq.exe
  C:\Windows\System\ykfUXNq.exe
  2⤵
  PID:6984
- C:\Windows\System\YffBEeu.exe
  C:\Windows\System\YffBEeu.exe
  2⤵
  PID:7008
- C:\Windows\System\wMTQtqN.exe
  C:\Windows\System\wMTQtqN.exe
  2⤵
  PID:7044
- C:\Windows\System\NaORBib.exe
  C:\Windows\System\NaORBib.exe
  2⤵
  PID:7064
- C:\Windows\System\pkrPgUi.exe
  C:\Windows\System\pkrPgUi.exe
  2⤵
  PID:7092
- C:\Windows\System\NKMQqWX.exe
  C:\Windows\System\NKMQqWX.exe
  2⤵
  PID:7112
- C:\Windows\System\MBObHGb.exe
  C:\Windows\System\MBObHGb.exe
  2⤵
  PID:7136
- C:\Windows\System\jbQJqrs.exe
  C:\Windows\System\jbQJqrs.exe
  2⤵
  PID:7156
- C:\Windows\System\kVAIPPY.exe
  C:\Windows\System\kVAIPPY.exe
  2⤵
  PID:6196
- C:\Windows\System\glKCnLq.exe
  C:\Windows\System\glKCnLq.exe
  2⤵
  PID:6176
- C:\Windows\System\oIQncdZ.exe
  C:\Windows\System\oIQncdZ.exe
  2⤵
  PID:6292
- C:\Windows\System\ovQMqRN.exe
  C:\Windows\System\ovQMqRN.exe
  2⤵
  PID:6332
- C:\Windows\System\vpchsQD.exe
  C:\Windows\System\vpchsQD.exe
  2⤵
  PID:6424
- C:\Windows\System\SJDpbVn.exe
  C:\Windows\System\SJDpbVn.exe
  2⤵
  PID:6484
- C:\Windows\System\qVZQtdv.exe
  C:\Windows\System\qVZQtdv.exe
  2⤵
  PID:6516
- C:\Windows\System\nzngrXO.exe
  C:\Windows\System\nzngrXO.exe
  2⤵
  PID:6680
- C:\Windows\System\oWpkSDC.exe
  C:\Windows\System\oWpkSDC.exe
  2⤵
  PID:6780
- C:\Windows\System\srLhpCi.exe
  C:\Windows\System\srLhpCi.exe
  2⤵
  PID:6832
- C:\Windows\System\IVJyfvU.exe
  C:\Windows\System\IVJyfvU.exe
  2⤵
  PID:6880
- C:\Windows\System\hrmvryM.exe
  C:\Windows\System\hrmvryM.exe
  2⤵
  PID:6900
- C:\Windows\System\wxMDBdr.exe
  C:\Windows\System\wxMDBdr.exe
  2⤵
  PID:7020
- C:\Windows\System\tihGkcB.exe
  C:\Windows\System\tihGkcB.exe
  2⤵
  PID:7100
- C:\Windows\System\EOanhjT.exe
  C:\Windows\System\EOanhjT.exe
  2⤵
  PID:6152
- C:\Windows\System\WLpKQRO.exe
  C:\Windows\System\WLpKQRO.exe
  2⤵
  PID:6164
- C:\Windows\System\DBBzxhA.exe
  C:\Windows\System\DBBzxhA.exe
  2⤵
  PID:6264
- C:\Windows\System\DYBgcCF.exe
  C:\Windows\System\DYBgcCF.exe
  2⤵
  PID:6428
- C:\Windows\System\chHBtjC.exe
  C:\Windows\System\chHBtjC.exe
  2⤵
  PID:6548
- C:\Windows\System\VOqzxlV.exe
  C:\Windows\System\VOqzxlV.exe
  2⤵
  PID:2220
- C:\Windows\System\xDLUbcz.exe
  C:\Windows\System\xDLUbcz.exe
  2⤵
  PID:6784
- C:\Windows\System\dnRQVie.exe
  C:\Windows\System\dnRQVie.exe
  2⤵
  PID:4836
- C:\Windows\System\EXptrcs.exe
  C:\Windows\System\EXptrcs.exe
  2⤵
  PID:7080
- C:\Windows\System\moNTPrd.exe
  C:\Windows\System\moNTPrd.exe
  2⤵
  PID:6240
- C:\Windows\System\dipgmwd.exe
  C:\Windows\System\dipgmwd.exe
  2⤵
  PID:6384
- C:\Windows\System\dDfivdo.exe
  C:\Windows\System\dDfivdo.exe
  2⤵
  PID:6260
- C:\Windows\System\xmiogJm.exe
  C:\Windows\System\xmiogJm.exe
  2⤵
  PID:6856
- C:\Windows\System\EZKDGKl.exe
  C:\Windows\System\EZKDGKl.exe
  2⤵
  PID:7208
- C:\Windows\System\kSXPgEF.exe
  C:\Windows\System\kSXPgEF.exe
  2⤵
  PID:7240
- C:\Windows\System\xcinzMy.exe
  C:\Windows\System\xcinzMy.exe
  2⤵
  PID:7260
- C:\Windows\System\FYMBYtU.exe
  C:\Windows\System\FYMBYtU.exe
  2⤵
  PID:7284
- C:\Windows\System\vzPxXXT.exe
  C:\Windows\System\vzPxXXT.exe
  2⤵
  PID:7316
- C:\Windows\System\SgGKmRj.exe
  C:\Windows\System\SgGKmRj.exe
  2⤵
  PID:7356
- C:\Windows\System\mXxgdLg.exe
  C:\Windows\System\mXxgdLg.exe
  2⤵
  PID:7380
- C:\Windows\System\lpfZVEE.exe
  C:\Windows\System\lpfZVEE.exe
  2⤵
  PID:7408
- C:\Windows\System\TdZjJJI.exe
  C:\Windows\System\TdZjJJI.exe
  2⤵
  PID:7436
- C:\Windows\System\KlIMCrG.exe
  C:\Windows\System\KlIMCrG.exe
  2⤵
  PID:7464
- C:\Windows\System\qFFFlOa.exe
  C:\Windows\System\qFFFlOa.exe
  2⤵
  PID:7492
- C:\Windows\System\AXnvfqI.exe
  C:\Windows\System\AXnvfqI.exe
  2⤵
  PID:7512
- C:\Windows\System\zBDyQHv.exe
  C:\Windows\System\zBDyQHv.exe
  2⤵
  PID:7532
- C:\Windows\System\WYYyxJx.exe
  C:\Windows\System\WYYyxJx.exe
  2⤵
  PID:7576
- C:\Windows\System\miMhylh.exe
  C:\Windows\System\miMhylh.exe
  2⤵
  PID:7612
- C:\Windows\System\UQYlOfR.exe
  C:\Windows\System\UQYlOfR.exe
  2⤵
  PID:7636
- C:\Windows\System\lZoNPun.exe
  C:\Windows\System\lZoNPun.exe
  2⤵
  PID:7660
- C:\Windows\System\SaEJVYo.exe
  C:\Windows\System\SaEJVYo.exe
  2⤵
  PID:7688
- C:\Windows\System\FoBfWKI.exe
  C:\Windows\System\FoBfWKI.exe
  2⤵
  PID:7716
- C:\Windows\System\jHCaVwt.exe
  C:\Windows\System\jHCaVwt.exe
  2⤵
  PID:7736
- C:\Windows\System\WZWNhTN.exe
  C:\Windows\System\WZWNhTN.exe
  2⤵
  PID:7780
- C:\Windows\System\JgSdOKJ.exe
  C:\Windows\System\JgSdOKJ.exe
  2⤵
  PID:7804
- C:\Windows\System\gIAoOZi.exe
  C:\Windows\System\gIAoOZi.exe
  2⤵
  PID:7832
- C:\Windows\System\FJvximi.exe
  C:\Windows\System\FJvximi.exe
  2⤵
  PID:7860
- C:\Windows\System\TChPjXi.exe
  C:\Windows\System\TChPjXi.exe
  2⤵
  PID:7880
- C:\Windows\System\asOwxrT.exe
  C:\Windows\System\asOwxrT.exe
  2⤵
  PID:7900
- C:\Windows\System\QloYzqO.exe
  C:\Windows\System\QloYzqO.exe
  2⤵
  PID:7928
- C:\Windows\System\nkYaCbt.exe
  C:\Windows\System\nkYaCbt.exe
  2⤵
  PID:7944
- C:\Windows\System\koptnmN.exe
  C:\Windows\System\koptnmN.exe
  2⤵
  PID:7984
- C:\Windows\System\QDlWAZu.exe
  C:\Windows\System\QDlWAZu.exe
  2⤵
  PID:8020
- C:\Windows\System\EpJQWvj.exe
  C:\Windows\System\EpJQWvj.exe
  2⤵
  PID:8076
- C:\Windows\System\YjmCAzv.exe
  C:\Windows\System\YjmCAzv.exe
  2⤵
  PID:8092
- C:\Windows\System\fceVAWm.exe
  C:\Windows\System\fceVAWm.exe
  2⤵
  PID:8120
- C:\Windows\System\RxxAYtU.exe
  C:\Windows\System\RxxAYtU.exe
  2⤵
  PID:8144
- C:\Windows\System\ECzlCHG.exe
  C:\Windows\System\ECzlCHG.exe
  2⤵
  PID:8168
- C:\Windows\System\uVDToFg.exe
  C:\Windows\System\uVDToFg.exe
  2⤵
  PID:8188
- C:\Windows\System\rYbFFkF.exe
  C:\Windows\System\rYbFFkF.exe
  2⤵
  PID:7172
- C:\Windows\System\IucpLNd.exe
  C:\Windows\System\IucpLNd.exe
  2⤵
  PID:7220
- C:\Windows\System\BpqVLlW.exe
  C:\Windows\System\BpqVLlW.exe
  2⤵
  PID:7296
- C:\Windows\System\Zxtarol.exe
  C:\Windows\System\Zxtarol.exe
  2⤵
  PID:7336
- C:\Windows\System\TFsGDSH.exe
  C:\Windows\System\TFsGDSH.exe
  2⤵
  PID:7352
- C:\Windows\System\EaJjiKc.exe
  C:\Windows\System\EaJjiKc.exe
  2⤵
  PID:7424
- C:\Windows\System\bkokrgf.exe
  C:\Windows\System\bkokrgf.exe
  2⤵
  PID:7552
- C:\Windows\System\ZrgPtCG.exe
  C:\Windows\System\ZrgPtCG.exe
  2⤵
  PID:7628
- C:\Windows\System\NNMeRqQ.exe
  C:\Windows\System\NNMeRqQ.exe
  2⤵
  PID:7752
- C:\Windows\System\eSPLJpZ.exe
  C:\Windows\System\eSPLJpZ.exe
  2⤵
  PID:7796
- C:\Windows\System\FqCkqkD.exe
  C:\Windows\System\FqCkqkD.exe
  2⤵
  PID:7868
- C:\Windows\System\nACMwJI.exe
  C:\Windows\System\nACMwJI.exe
  2⤵
  PID:7896
- C:\Windows\System\MiUrCob.exe
  C:\Windows\System\MiUrCob.exe
  2⤵
  PID:7940
- C:\Windows\System\nKviWvz.exe
  C:\Windows\System\nKviWvz.exe
  2⤵
  PID:8068
- C:\Windows\System\CBqtcIT.exe
  C:\Windows\System\CBqtcIT.exe
  2⤵
  PID:8160
- C:\Windows\System\wfJzrkF.exe
  C:\Windows\System\wfJzrkF.exe
  2⤵
  PID:8164
- C:\Windows\System\fmZkqpR.exe
  C:\Windows\System\fmZkqpR.exe
  2⤵
  PID:7256
- C:\Windows\System\OrduaML.exe
  C:\Windows\System\OrduaML.exe
  2⤵
  PID:7348
- C:\Windows\System\QfOGONA.exe
  C:\Windows\System\QfOGONA.exe
  2⤵
  PID:7524
- C:\Windows\System\uTsNKwk.exe
  C:\Windows\System\uTsNKwk.exe
  2⤵
  PID:7732
- C:\Windows\System\DaomToI.exe
  C:\Windows\System\DaomToI.exe
  2⤵
  PID:7892
- C:\Windows\System\tLABjhR.exe
  C:\Windows\System\tLABjhR.exe
  2⤵
  PID:7996
- C:\Windows\System\OwfMArF.exe
  C:\Windows\System\OwfMArF.exe
  2⤵
  PID:8044
- C:\Windows\System\GMcWcsY.exe
  C:\Windows\System\GMcWcsY.exe
  2⤵
  PID:8152
- C:\Windows\System\SFsvVWb.exe
  C:\Windows\System\SFsvVWb.exe
  2⤵
  PID:7332
- C:\Windows\System\ETKuluf.exe
  C:\Windows\System\ETKuluf.exe
  2⤵
  PID:7584
- C:\Windows\System\lpGcBTn.exe
  C:\Windows\System\lpGcBTn.exe
  2⤵
  PID:8140
- C:\Windows\System\YYMnUCt.exe
  C:\Windows\System\YYMnUCt.exe
  2⤵
  PID:8220
- C:\Windows\System\mbLJmju.exe
  C:\Windows\System\mbLJmju.exe
  2⤵
  PID:8248
- C:\Windows\System\KVgkuEf.exe
  C:\Windows\System\KVgkuEf.exe
  2⤵
  PID:8292
- C:\Windows\System\VtzLSCz.exe
  C:\Windows\System\VtzLSCz.exe
  2⤵
  PID:8308
- C:\Windows\System\FivJMaM.exe
  C:\Windows\System\FivJMaM.exe
  2⤵
  PID:8356
- C:\Windows\System\vaKPOcA.exe
  C:\Windows\System\vaKPOcA.exe
  2⤵
  PID:8380
- C:\Windows\System\ucDQSnB.exe
  C:\Windows\System\ucDQSnB.exe
  2⤵
  PID:8408
- C:\Windows\System\JYlzwxP.exe
  C:\Windows\System\JYlzwxP.exe
  2⤵
  PID:8436
- C:\Windows\System\EfaXSNq.exe
  C:\Windows\System\EfaXSNq.exe
  2⤵
  PID:8456
- C:\Windows\System\FmUGywu.exe
  C:\Windows\System\FmUGywu.exe
  2⤵
  PID:8488
- C:\Windows\System\eqexJdQ.exe
  C:\Windows\System\eqexJdQ.exe
  2⤵
  PID:8504
- C:\Windows\System\aqpRElf.exe
  C:\Windows\System\aqpRElf.exe
  2⤵
  PID:8528
- C:\Windows\System\HNoIfcF.exe
  C:\Windows\System\HNoIfcF.exe
  2⤵
  PID:8572
- C:\Windows\System\fIqvEoY.exe
  C:\Windows\System\fIqvEoY.exe
  2⤵
  PID:8592
- C:\Windows\System\RRUwCJm.exe
  C:\Windows\System\RRUwCJm.exe
  2⤵
  PID:8612
- C:\Windows\System\zlMHUob.exe
  C:\Windows\System\zlMHUob.exe
  2⤵
  PID:8660
- C:\Windows\System\FWpTHZl.exe
  C:\Windows\System\FWpTHZl.exe
  2⤵
  PID:8680
- C:\Windows\System\NtiXaYj.exe
  C:\Windows\System\NtiXaYj.exe
  2⤵
  PID:8720
- C:\Windows\System\LhFptIF.exe
  C:\Windows\System\LhFptIF.exe
  2⤵
  PID:8744
- C:\Windows\System\fBrmxQi.exe
  C:\Windows\System\fBrmxQi.exe
  2⤵
  PID:8772
- C:\Windows\System\dzDPqoG.exe
  C:\Windows\System\dzDPqoG.exe
  2⤵
  PID:8800
- C:\Windows\System\SKaRDLi.exe
  C:\Windows\System\SKaRDLi.exe
  2⤵
  PID:8820
- C:\Windows\System\TZRWfpB.exe
  C:\Windows\System\TZRWfpB.exe
  2⤵
  PID:8848
- C:\Windows\System\PFXWnfH.exe
  C:\Windows\System\PFXWnfH.exe
  2⤵
  PID:8876
- C:\Windows\System\HEaYBZe.exe
  C:\Windows\System\HEaYBZe.exe
  2⤵
  PID:8896
- C:\Windows\System\ipGHpJw.exe
  C:\Windows\System\ipGHpJw.exe
  2⤵
  PID:8936
- C:\Windows\System\uofvdJb.exe
  C:\Windows\System\uofvdJb.exe
  2⤵
  PID:8960
- C:\Windows\System\kYhleDu.exe
  C:\Windows\System\kYhleDu.exe
  2⤵
  PID:8980
- C:\Windows\System\pkcJwEr.exe
  C:\Windows\System\pkcJwEr.exe
  2⤵
  PID:9048
- C:\Windows\System\VnCREPS.exe
  C:\Windows\System\VnCREPS.exe
  2⤵
  PID:9068
- C:\Windows\System\xYTrhlv.exe
  C:\Windows\System\xYTrhlv.exe
  2⤵
  PID:9088
- C:\Windows\System\UHJwatI.exe
  C:\Windows\System\UHJwatI.exe
  2⤵
  PID:9112
- C:\Windows\System\VUkKzgq.exe
  C:\Windows\System\VUkKzgq.exe
  2⤵
  PID:9140
- C:\Windows\System\mKMpewZ.exe
  C:\Windows\System\mKMpewZ.exe
  2⤵
  PID:9160
- C:\Windows\System\cpQddEa.exe
  C:\Windows\System\cpQddEa.exe
  2⤵
  PID:9192
- C:\Windows\System\dENlHCJ.exe
  C:\Windows\System\dENlHCJ.exe
  2⤵
  PID:7776
- C:\Windows\System\VgpwQFE.exe
  C:\Windows\System\VgpwQFE.exe
  2⤵
  PID:8200
- C:\Windows\System\iVFIoRm.exe
  C:\Windows\System\iVFIoRm.exe
  2⤵
  PID:8284
- C:\Windows\System\LpQXMvk.exe
  C:\Windows\System\LpQXMvk.exe
  2⤵
  PID:8332
- C:\Windows\System\eAxAwyk.exe
  C:\Windows\System\eAxAwyk.exe
  2⤵
  PID:8400
- C:\Windows\System\RkyctvZ.exe
  C:\Windows\System\RkyctvZ.exe
  2⤵
  PID:8452
- C:\Windows\System\nHNBrUI.exe
  C:\Windows\System\nHNBrUI.exe
  2⤵
  PID:8480
- C:\Windows\System\VOgaysA.exe
  C:\Windows\System\VOgaysA.exe
  2⤵
  PID:8544
- C:\Windows\System\TDchmaA.exe
  C:\Windows\System\TDchmaA.exe
  2⤵
  PID:8588
- C:\Windows\System\sMRHqYk.exe
  C:\Windows\System\sMRHqYk.exe
  2⤵
  PID:8708
- C:\Windows\System\CpAaPNz.exe
  C:\Windows\System\CpAaPNz.exe
  2⤵
  PID:8760
- C:\Windows\System\OhlJcqQ.exe
  C:\Windows\System\OhlJcqQ.exe
  2⤵
  PID:8816
- C:\Windows\System\aUfhFcX.exe
  C:\Windows\System\aUfhFcX.exe
  2⤵
  PID:8856
- C:\Windows\System\vFjsIbY.exe
  C:\Windows\System\vFjsIbY.exe
  2⤵
  PID:8892
- C:\Windows\System\LZOUvrl.exe
  C:\Windows\System\LZOUvrl.exe
  2⤵
  PID:9000
- C:\Windows\System\OOaOGxb.exe
  C:\Windows\System\OOaOGxb.exe
  2⤵
  PID:9036
- C:\Windows\System\VHJQJkT.exe
  C:\Windows\System\VHJQJkT.exe
  2⤵
  PID:9080
- C:\Windows\System\xVRBHLd.exe
  C:\Windows\System\xVRBHLd.exe
  2⤵
  PID:9136
- C:\Windows\System\nigwEwW.exe
  C:\Windows\System\nigwEwW.exe
  2⤵
  PID:8048
- C:\Windows\System\HavpkLX.exe
  C:\Windows\System\HavpkLX.exe
  2⤵
  PID:8472
- C:\Windows\System\ZqcUmCN.exe
  C:\Windows\System\ZqcUmCN.exe
  2⤵
  PID:8780
- C:\Windows\System\lXIgaYv.exe
  C:\Windows\System\lXIgaYv.exe
  2⤵
  PID:8888
- C:\Windows\System\RCblgRC.exe
  C:\Windows\System\RCblgRC.exe
  2⤵
  PID:9084
- C:\Windows\System\ACJSkbH.exe
  C:\Windows\System\ACJSkbH.exe
  2⤵
  PID:7848
- C:\Windows\System\CyLXbQF.exe
  C:\Windows\System\CyLXbQF.exe
  2⤵
  PID:8444
- C:\Windows\System\MoMMHlc.exe
  C:\Windows\System\MoMMHlc.exe
  2⤵
  PID:8752
- C:\Windows\System\kgaCPRO.exe
  C:\Windows\System\kgaCPRO.exe
  2⤵
  PID:7204
- C:\Windows\System\akJGMDL.exe
  C:\Windows\System\akJGMDL.exe
  2⤵
  PID:8432
- C:\Windows\System\xWSCeSR.exe
  C:\Windows\System\xWSCeSR.exe
  2⤵
  PID:9252
- C:\Windows\System\hLukXuY.exe
  C:\Windows\System\hLukXuY.exe
  2⤵
  PID:9272
- C:\Windows\System\hBZFUNS.exe
  C:\Windows\System\hBZFUNS.exe
  2⤵
  PID:9316
- C:\Windows\System\LvlFTJM.exe
  C:\Windows\System\LvlFTJM.exe
  2⤵
  PID:9340
- C:\Windows\System\AkOisEV.exe
  C:\Windows\System\AkOisEV.exe
  2⤵
  PID:9364
- C:\Windows\System\lPUmjdn.exe
  C:\Windows\System\lPUmjdn.exe
  2⤵
  PID:9396
- C:\Windows\System\BCEvdwK.exe
  C:\Windows\System\BCEvdwK.exe
  2⤵
  PID:9416
- C:\Windows\System\XuGYzBJ.exe
  C:\Windows\System\XuGYzBJ.exe
  2⤵
  PID:9448
- C:\Windows\System\oBeqNEZ.exe
  C:\Windows\System\oBeqNEZ.exe
  2⤵
  PID:9464
- C:\Windows\System\hecYiGt.exe
  C:\Windows\System\hecYiGt.exe
  2⤵
  PID:9492
- C:\Windows\System\eaDAEJy.exe
  C:\Windows\System\eaDAEJy.exe
  2⤵
  PID:9520
- C:\Windows\System\vrmGGEm.exe
  C:\Windows\System\vrmGGEm.exe
  2⤵
  PID:9548
- C:\Windows\System\QgprIPd.exe
  C:\Windows\System\QgprIPd.exe
  2⤵
  PID:9592
- C:\Windows\System\maBGOXA.exe
  C:\Windows\System\maBGOXA.exe
  2⤵
  PID:9616
- C:\Windows\System\pUwbJVN.exe
  C:\Windows\System\pUwbJVN.exe
  2⤵
  PID:9648
- C:\Windows\System\OssdjJw.exe
  C:\Windows\System\OssdjJw.exe
  2⤵
  PID:9668
- C:\Windows\System\YjdNUIV.exe
  C:\Windows\System\YjdNUIV.exe
  2⤵
  PID:9712
- C:\Windows\System\duFJLeW.exe
  C:\Windows\System\duFJLeW.exe
  2⤵
  PID:9736
- C:\Windows\System\srRnwoH.exe
  C:\Windows\System\srRnwoH.exe
  2⤵
  PID:9764
- C:\Windows\System\UjnSQGc.exe
  C:\Windows\System\UjnSQGc.exe
  2⤵
  PID:9784
- C:\Windows\System\zXlrbio.exe
  C:\Windows\System\zXlrbio.exe
  2⤵
  PID:9820
- C:\Windows\System\fmmZhaK.exe
  C:\Windows\System\fmmZhaK.exe
  2⤵
  PID:9836
- C:\Windows\System\wFgiBqv.exe
  C:\Windows\System\wFgiBqv.exe
  2⤵
  PID:9860
- C:\Windows\System\zPbOYwp.exe
  C:\Windows\System\zPbOYwp.exe
  2⤵
  PID:9888
- C:\Windows\System\auUsLLA.exe
  C:\Windows\System\auUsLLA.exe
  2⤵
  PID:9908
- C:\Windows\System\YhzGffH.exe
  C:\Windows\System\YhzGffH.exe
  2⤵
  PID:9936
- C:\Windows\System\uLAzsMN.exe
  C:\Windows\System\uLAzsMN.exe
  2⤵
  PID:9956
- C:\Windows\System\VXaKwIz.exe
  C:\Windows\System\VXaKwIz.exe
  2⤵
  PID:10004
- C:\Windows\System\LFdlNUv.exe
  C:\Windows\System\LFdlNUv.exe
  2⤵
  PID:10028
- C:\Windows\System\zYJBQPU.exe
  C:\Windows\System\zYJBQPU.exe
  2⤵
  PID:10048
- C:\Windows\System\NjpvofE.exe
  C:\Windows\System\NjpvofE.exe
  2⤵
  PID:10088
- C:\Windows\System\jfgzGMm.exe
  C:\Windows\System\jfgzGMm.exe
  2⤵
  PID:10116
- C:\Windows\System\kEdBLdT.exe
  C:\Windows\System\kEdBLdT.exe
  2⤵
  PID:10164
- C:\Windows\System\pmVRHku.exe
  C:\Windows\System\pmVRHku.exe
  2⤵
  PID:10188
- C:\Windows\System\QAWTFrK.exe
  C:\Windows\System\QAWTFrK.exe
  2⤵
  PID:10216
- C:\Windows\System\TFYiAAu.exe
  C:\Windows\System\TFYiAAu.exe
  2⤵
  PID:9220
- C:\Windows\System\MseLPWq.exe
  C:\Windows\System\MseLPWq.exe
  2⤵
  PID:9288
- C:\Windows\System\fzIdprK.exe
  C:\Windows\System\fzIdprK.exe
  2⤵
  PID:9336
- C:\Windows\System\vNmujBV.exe
  C:\Windows\System\vNmujBV.exe
  2⤵
  PID:9380
- C:\Windows\System\fhDdsxk.exe
  C:\Windows\System\fhDdsxk.exe
  2⤵
  PID:9428
- C:\Windows\System\XTgYQcW.exe
  C:\Windows\System\XTgYQcW.exe
  2⤵
  PID:9460
- C:\Windows\System\jNtFcNb.exe
  C:\Windows\System\jNtFcNb.exe
  2⤵
  PID:9540
- C:\Windows\System\PlTcBwg.exe
  C:\Windows\System\PlTcBwg.exe
  2⤵
  PID:9656
- C:\Windows\System\hbkVsNr.exe
  C:\Windows\System\hbkVsNr.exe
  2⤵
  PID:9704
- C:\Windows\System\IRDVavK.exe
  C:\Windows\System\IRDVavK.exe
  2⤵
  PID:9752
- C:\Windows\System\HRbvaEh.exe
  C:\Windows\System\HRbvaEh.exe
  2⤵
  PID:9832
- C:\Windows\System\geQxBPP.exe
  C:\Windows\System\geQxBPP.exe
  2⤵
  PID:9852
- C:\Windows\System\JFVpLQt.exe
  C:\Windows\System\JFVpLQt.exe
  2⤵
  PID:9924
- C:\Windows\System\ruklOdi.exe
  C:\Windows\System\ruklOdi.exe
  2⤵
  PID:9996
- C:\Windows\System\mAzCEEV.exe
  C:\Windows\System\mAzCEEV.exe
  2⤵
  PID:10060
- C:\Windows\System\rrGiCMK.exe
  C:\Windows\System\rrGiCMK.exe
  2⤵
  PID:10180
- C:\Windows\System\uGrbYyf.exe
  C:\Windows\System\uGrbYyf.exe
  2⤵
  PID:10236
- C:\Windows\System\CJcglXE.exe
  C:\Windows\System\CJcglXE.exe
  2⤵
  PID:3508
- C:\Windows\System\ZmDfNjl.exe
  C:\Windows\System\ZmDfNjl.exe
  2⤵
  PID:9432
- C:\Windows\System\gQyfOwg.exe
  C:\Windows\System\gQyfOwg.exe
  2⤵
  PID:9544
- C:\Windows\System\OHJGNdM.exe
  C:\Windows\System\OHJGNdM.exe
  2⤵
  PID:9684
- C:\Windows\System\KFsTRwZ.exe
  C:\Windows\System\KFsTRwZ.exe
  2⤵
  PID:9880
- C:\Windows\System\nZjtzZv.exe
  C:\Windows\System\nZjtzZv.exe
  2⤵
  PID:9900
- C:\Windows\System\XeTWyja.exe
  C:\Windows\System\XeTWyja.exe
  2⤵
  PID:10040
- C:\Windows\System\oCcfkXb.exe
  C:\Windows\System\oCcfkXb.exe
  2⤵
  PID:9308
- C:\Windows\System\YCfFGZX.exe
  C:\Windows\System\YCfFGZX.exe
  2⤵
  PID:9636
- C:\Windows\System\KwmeAUb.exe
  C:\Windows\System\KwmeAUb.exe
  2⤵
  PID:9640
- C:\Windows\System\MxnYWvj.exe
  C:\Windows\System\MxnYWvj.exe
  2⤵
  PID:10160
- C:\Windows\System\KIzCTgw.exe
  C:\Windows\System\KIzCTgw.exe
  2⤵
  PID:10244
- C:\Windows\System\xfutNLO.exe
  C:\Windows\System\xfutNLO.exe
  2⤵
  PID:10268
- C:\Windows\System\khKpPWl.exe
  C:\Windows\System\khKpPWl.exe
  2⤵
  PID:10288
- C:\Windows\System\seQgFpF.exe
  C:\Windows\System\seQgFpF.exe
  2⤵
  PID:10316
- C:\Windows\System\JVYHFQI.exe
  C:\Windows\System\JVYHFQI.exe
  2⤵
  PID:10340
- C:\Windows\System\okhAbNt.exe
  C:\Windows\System\okhAbNt.exe
  2⤵
  PID:10356
- C:\Windows\System\WASDfmK.exe
  C:\Windows\System\WASDfmK.exe
  2⤵
  PID:10376
- C:\Windows\System\sJBpUcB.exe
  C:\Windows\System\sJBpUcB.exe
  2⤵
  PID:10452
- C:\Windows\System\rlpGLyd.exe
  C:\Windows\System\rlpGLyd.exe
  2⤵
  PID:10476
- C:\Windows\System\rJfmQxu.exe
  C:\Windows\System\rJfmQxu.exe
  2⤵
  PID:10496
- C:\Windows\System\gDlYPKN.exe
  C:\Windows\System\gDlYPKN.exe
  2⤵
  PID:10524
- C:\Windows\System\INcwhYy.exe
  C:\Windows\System\INcwhYy.exe
  2⤵
  PID:10552
- C:\Windows\System\wLyUlSm.exe
  C:\Windows\System\wLyUlSm.exe
  2⤵
  PID:10572
- C:\Windows\System\ppLRskj.exe
  C:\Windows\System\ppLRskj.exe
  2⤵
  PID:10592
- C:\Windows\System\eWkpObu.exe
  C:\Windows\System\eWkpObu.exe
  2⤵
  PID:10620
- C:\Windows\System\YadJRhQ.exe
  C:\Windows\System\YadJRhQ.exe
  2⤵
  PID:10636
- C:\Windows\System\qtypYUH.exe
  C:\Windows\System\qtypYUH.exe
  2⤵
  PID:10664
- C:\Windows\System\KNHsDrO.exe
  C:\Windows\System\KNHsDrO.exe
  2⤵
  PID:10684
- C:\Windows\System\KMFFIDw.exe
  C:\Windows\System\KMFFIDw.exe
  2⤵
  PID:10716
- C:\Windows\System\ImeqoSy.exe
  C:\Windows\System\ImeqoSy.exe
  2⤵
  PID:10760
- C:\Windows\System\KVWHFRj.exe
  C:\Windows\System\KVWHFRj.exe
  2⤵
  PID:10796
- C:\Windows\System\BeZzGfo.exe
  C:\Windows\System\BeZzGfo.exe
  2⤵
  PID:10832
- C:\Windows\System\yFyPWxN.exe
  C:\Windows\System\yFyPWxN.exe
  2⤵
  PID:10852
- C:\Windows\System\lKOfnpB.exe
  C:\Windows\System\lKOfnpB.exe
  2⤵
  PID:10912
- C:\Windows\System\aaBQCmH.exe
  C:\Windows\System\aaBQCmH.exe
  2⤵
  PID:10936
- C:\Windows\System\ROaAkcE.exe
  C:\Windows\System\ROaAkcE.exe
  2⤵
  PID:10988
- C:\Windows\System\CYcSapt.exe
  C:\Windows\System\CYcSapt.exe
  2⤵
  PID:11012
- C:\Windows\System\KIuzJZJ.exe
  C:\Windows\System\KIuzJZJ.exe
  2⤵
  PID:11040
- C:\Windows\System\tyxKklJ.exe
  C:\Windows\System\tyxKklJ.exe
  2⤵
  PID:11064
- C:\Windows\System\MkNEsIJ.exe
  C:\Windows\System\MkNEsIJ.exe
  2⤵
  PID:11088
- C:\Windows\System\ZjPGSzI.exe
  C:\Windows\System\ZjPGSzI.exe
  2⤵
  PID:11116
- C:\Windows\System\moUsEXr.exe
  C:\Windows\System\moUsEXr.exe
  2⤵
  PID:11144
- C:\Windows\System\YTYmHnt.exe
  C:\Windows\System\YTYmHnt.exe
  2⤵
  PID:11168
- C:\Windows\System\UwuaXXa.exe
  C:\Windows\System\UwuaXXa.exe
  2⤵
  PID:11200
- C:\Windows\System\EOFvGEs.exe
  C:\Windows\System\EOFvGEs.exe
  2⤵
  PID:10304
- C:\Windows\System\HRCNLIL.exe
  C:\Windows\System\HRCNLIL.exe
  2⤵
  PID:10472
- C:\Windows\System\zFFZWFN.exe
  C:\Windows\System\zFFZWFN.exe
  2⤵
  PID:10560
- C:\Windows\System\SJecAhM.exe
  C:\Windows\System\SJecAhM.exe
  2⤵
  PID:10608
- C:\Windows\System\OuliRqA.exe
  C:\Windows\System\OuliRqA.exe
  2⤵
  PID:10532
- C:\Windows\System\SKLayRw.exe
  C:\Windows\System\SKLayRw.exe
  2⤵
  PID:10656
- C:\Windows\System\WDGZwSo.exe
  C:\Windows\System\WDGZwSo.exe
  2⤵
  PID:10612
- C:\Windows\System\UtMNSra.exe
  C:\Windows\System\UtMNSra.exe
  2⤵
  PID:10712
- C:\Windows\System\gDjwbHF.exe
  C:\Windows\System\gDjwbHF.exe
  2⤵
  PID:10768
- C:\Windows\System\vniYFdz.exe
  C:\Windows\System\vniYFdz.exe
  2⤵
  PID:10788
- C:\Windows\System\OXchYzl.exe
  C:\Windows\System\OXchYzl.exe
  2⤵
  PID:10824
- C:\Windows\System\rEqnWlt.exe
  C:\Windows\System\rEqnWlt.exe
  2⤵
  PID:10868
- C:\Windows\System\qBPsvZF.exe
  C:\Windows\System\qBPsvZF.exe
  2⤵
  PID:11008
- C:\Windows\System\ltKrAxw.exe
  C:\Windows\System\ltKrAxw.exe
  2⤵
  PID:9804
- C:\Windows\System\dmZIGlG.exe
  C:\Windows\System\dmZIGlG.exe
  2⤵
  PID:10208
- C:\Windows\System\YcDDKIk.exe
  C:\Windows\System\YcDDKIk.exe
  2⤵
  PID:10252
- C:\Windows\System\OZqQlgA.exe
  C:\Windows\System\OZqQlgA.exe
  2⤵
  PID:11252
- C:\Windows\System\vGwojSG.exe
  C:\Windows\System\vGwojSG.exe
  2⤵
  PID:10420
- C:\Windows\System\xiUVkIx.exe
  C:\Windows\System\xiUVkIx.exe
  2⤵
  PID:10368
- C:\Windows\System\teuomCT.exe
  C:\Windows\System\teuomCT.exe
  2⤵
  PID:10464
- C:\Windows\System\KuNaxxP.exe
  C:\Windows\System\KuNaxxP.exe
  2⤵
  PID:10676
- C:\Windows\System\vDApdyr.exe
  C:\Windows\System\vDApdyr.exe
  2⤵
  PID:10932
- C:\Windows\System\XdqKybq.exe
  C:\Windows\System\XdqKybq.exe
  2⤵
  PID:11160
- C:\Windows\System\zzcPRIZ.exe
  C:\Windows\System\zzcPRIZ.exe
  2⤵
  PID:10280
- C:\Windows\System\qNhJIks.exe
  C:\Windows\System\qNhJIks.exe
  2⤵
  PID:11240
- C:\Windows\System\JxVDPnK.exe
  C:\Windows\System\JxVDPnK.exe
  2⤵
  PID:10632
- C:\Windows\System\oQYihpj.exe
  C:\Windows\System\oQYihpj.exe
  2⤵
  PID:10680
- C:\Windows\System\swDVpBh.exe
  C:\Windows\System\swDVpBh.exe
  2⤵
  PID:9876
- C:\Windows\System\lLspDZB.exe
  C:\Windows\System\lLspDZB.exe
  2⤵
  PID:11228
- C:\Windows\System\WEMkQhY.exe
  C:\Windows\System\WEMkQhY.exe
  2⤵
  PID:9728
- C:\Windows\System\rhdHGZy.exe
  C:\Windows\System\rhdHGZy.exe
  2⤵
  PID:11272
- C:\Windows\System\hkkcuBC.exe
  C:\Windows\System\hkkcuBC.exe
  2⤵
  PID:11300
- C:\Windows\System\tfmMOxr.exe
  C:\Windows\System\tfmMOxr.exe
  2⤵
  PID:11340
- C:\Windows\System\GkNdLzD.exe
  C:\Windows\System\GkNdLzD.exe
  2⤵
  PID:11372
- C:\Windows\System\yWAyWAH.exe
  C:\Windows\System\yWAyWAH.exe
  2⤵
  PID:11404
- C:\Windows\System\WmvEuCB.exe
  C:\Windows\System\WmvEuCB.exe
  2⤵
  PID:11420
- C:\Windows\System\PxBdOwf.exe
  C:\Windows\System\PxBdOwf.exe
  2⤵
  PID:11456
- C:\Windows\System\agZfHMO.exe
  C:\Windows\System\agZfHMO.exe
  2⤵
  PID:11488
- C:\Windows\System\NCKYQUK.exe
  C:\Windows\System\NCKYQUK.exe
  2⤵
  PID:11520
- C:\Windows\System\eyKTpDu.exe
  C:\Windows\System\eyKTpDu.exe
  2⤵
  PID:11544
- C:\Windows\System\daRvAJn.exe
  C:\Windows\System\daRvAJn.exe
  2⤵
  PID:11568
- C:\Windows\System\SFWggQl.exe
  C:\Windows\System\SFWggQl.exe
  2⤵
  PID:11632
- C:\Windows\System\ZObWuhK.exe
  C:\Windows\System\ZObWuhK.exe
  2⤵
  PID:11652
- C:\Windows\System\PHtAYNT.exe
  C:\Windows\System\PHtAYNT.exe
  2⤵
  PID:11676
- C:\Windows\System\hqYoZSo.exe
  C:\Windows\System\hqYoZSo.exe
  2⤵
  PID:11696
- C:\Windows\System\OmNqKJr.exe
  C:\Windows\System\OmNqKJr.exe
  2⤵
  PID:11736
- C:\Windows\System\fQXkiOX.exe
  C:\Windows\System\fQXkiOX.exe
  2⤵
  PID:11760
- C:\Windows\System\DafwTey.exe
  C:\Windows\System\DafwTey.exe
  2⤵
  PID:11788
- C:\Windows\System\uPvTEHf.exe
  C:\Windows\System\uPvTEHf.exe
  2⤵
  PID:11820
- C:\Windows\System\szgHuNY.exe
  C:\Windows\System\szgHuNY.exe
  2⤵
  PID:11840
- C:\Windows\System\QeiNByB.exe
  C:\Windows\System\QeiNByB.exe
  2⤵
  PID:11860
- C:\Windows\System\ZAsSRQN.exe
  C:\Windows\System\ZAsSRQN.exe
  2⤵
  PID:11908
- C:\Windows\System\lzjiJpH.exe
  C:\Windows\System\lzjiJpH.exe
  2⤵
  PID:11932
- C:\Windows\System\TwPWakV.exe
  C:\Windows\System\TwPWakV.exe
  2⤵
  PID:11952
- C:\Windows\System\yUFFPot.exe
  C:\Windows\System\yUFFPot.exe
  2⤵
  PID:11992
- C:\Windows\System\gfRUobn.exe
  C:\Windows\System\gfRUobn.exe
  2⤵
  PID:12016
- C:\Windows\System\PowmJvl.exe
  C:\Windows\System\PowmJvl.exe
  2⤵
  PID:12040
- C:\Windows\System\GtvhJAl.exe
  C:\Windows\System\GtvhJAl.exe
  2⤵
  PID:12064
- C:\Windows\System\dleKjTO.exe
  C:\Windows\System\dleKjTO.exe
  2⤵
  PID:12084
- C:\Windows\System\XMYirEQ.exe
  C:\Windows\System\XMYirEQ.exe
  2⤵
  PID:12108
- C:\Windows\System\MWigqEo.exe
  C:\Windows\System\MWigqEo.exe
  2⤵
  PID:12136
- C:\Windows\System\tLKANbb.exe
  C:\Windows\System\tLKANbb.exe
  2⤵
  PID:12184
- C:\Windows\System\ftfPcmO.exe
  C:\Windows\System\ftfPcmO.exe
  2⤵
  PID:12212
- C:\Windows\System\ZxBYpaz.exe
  C:\Windows\System\ZxBYpaz.exe
  2⤵
  PID:12236
- C:\Windows\System\EAZDyLG.exe
  C:\Windows\System\EAZDyLG.exe
  2⤵
  PID:12264
- C:\Windows\System\aOjzufO.exe
  C:\Windows\System\aOjzufO.exe
  2⤵
  PID:12280
- C:\Windows\System\vAkkqNY.exe
  C:\Windows\System\vAkkqNY.exe
  2⤵
  PID:11296
- C:\Windows\System\VLqbJAf.exe
  C:\Windows\System\VLqbJAf.exe
  2⤵
  PID:11364
- C:\Windows\System\EEiEjkJ.exe
  C:\Windows\System\EEiEjkJ.exe
  2⤵
  PID:11440
- C:\Windows\System\aEyFOVd.exe
  C:\Windows\System\aEyFOVd.exe
  2⤵
  PID:11500
- C:\Windows\System\Lnzfhbe.exe
  C:\Windows\System\Lnzfhbe.exe
  2⤵
  PID:11600
- C:\Windows\System\xPeWyVO.exe
  C:\Windows\System\xPeWyVO.exe
  2⤵
  PID:11644
- C:\Windows\System\SeNCqph.exe
  C:\Windows\System\SeNCqph.exe
  2⤵
  PID:11716
- C:\Windows\System\LYeELgS.exe
  C:\Windows\System\LYeELgS.exe
  2⤵
  PID:11796
- C:\Windows\System\bGySyzi.exe
  C:\Windows\System\bGySyzi.exe
  2⤵
  PID:11808
- C:\Windows\System\VNHMGSG.exe
  C:\Windows\System\VNHMGSG.exe
  2⤵
  PID:11828
- C:\Windows\System\GxDybkE.exe
  C:\Windows\System\GxDybkE.exe
  2⤵
  PID:11904
- C:\Windows\System\QaIDXPG.exe
  C:\Windows\System\QaIDXPG.exe
  2⤵
  PID:11972
- C:\Windows\System\bFUCytB.exe
  C:\Windows\System\bFUCytB.exe
  2⤵
  PID:12052
- C:\Windows\System\uNTlzpe.exe
  C:\Windows\System\uNTlzpe.exe
  2⤵
  PID:12124
- C:\Windows\System\pfwYqNI.exe
  C:\Windows\System\pfwYqNI.exe
  2⤵
  PID:12160
- C:\Windows\System\XbqzCey.exe
  C:\Windows\System\XbqzCey.exe
  2⤵
  PID:12232
- C:\Windows\System\pZLLzgS.exe
  C:\Windows\System\pZLLzgS.exe
  2⤵
  PID:11104
- C:\Windows\System\aArmvdG.exe
  C:\Windows\System\aArmvdG.exe
  2⤵
  PID:11480
- C:\Windows\System\enBdvpd.exe
  C:\Windows\System\enBdvpd.exe
  2⤵
  PID:4624
- C:\Windows\System\pwMVjFv.exe
  C:\Windows\System\pwMVjFv.exe
  2⤵
  PID:3664
- C:\Windows\System\XWqIchh.exe
  C:\Windows\System\XWqIchh.exe
  2⤵
  PID:11604
- C:\Windows\System\AVCrkSb.exe
  C:\Windows\System\AVCrkSb.exe
  2⤵
  PID:11732
- C:\Windows\System\YGTwtoy.exe
  C:\Windows\System\YGTwtoy.exe
  2⤵
  PID:11868
- C:\Windows\System\jUkExVR.exe
  C:\Windows\System\jUkExVR.exe
  2⤵
  PID:11988
- C:\Windows\System\svqNVgS.exe
  C:\Windows\System\svqNVgS.exe
  2⤵
  PID:11224
- C:\Windows\System\qbhrkpV.exe
  C:\Windows\System\qbhrkpV.exe
  2⤵
  PID:11556
- C:\Windows\System\vOYxUca.exe
  C:\Windows\System\vOYxUca.exe
  2⤵
  PID:12080
- C:\Windows\System\jYTXbnH.exe
  C:\Windows\System\jYTXbnH.exe
  2⤵
  PID:11396
- C:\Windows\System\PzCkJax.exe
  C:\Windows\System\PzCkJax.exe
  2⤵
  PID:396
- C:\Windows\System\WMMkJVp.exe
  C:\Windows\System\WMMkJVp.exe
  2⤵
  PID:11564
- C:\Windows\System\wMFhmNi.exe
  C:\Windows\System\wMFhmNi.exe
  2⤵
  PID:12316
- C:\Windows\System\JISlsjQ.exe
  C:\Windows\System\JISlsjQ.exe
  2⤵
  PID:12348
- C:\Windows\System\EnhRBuN.exe
  C:\Windows\System\EnhRBuN.exe
  2⤵
  PID:12372
- C:\Windows\System\vNHXpbT.exe
  C:\Windows\System\vNHXpbT.exe
  2⤵
  PID:12400
- C:\Windows\System\fxpkTgY.exe
  C:\Windows\System\fxpkTgY.exe
  2⤵
  PID:12428
- C:\Windows\System\qagHafn.exe
  C:\Windows\System\qagHafn.exe
  2⤵
  PID:12456
- C:\Windows\System\dpfogwR.exe
  C:\Windows\System\dpfogwR.exe
  2⤵
  PID:12484
- C:\Windows\System\RRqFsDK.exe
  C:\Windows\System\RRqFsDK.exe
  2⤵
  PID:12516
- C:\Windows\System\NrwYdFB.exe
  C:\Windows\System\NrwYdFB.exe
  2⤵
  PID:12544
- C:\Windows\System\NLYZmqS.exe
  C:\Windows\System\NLYZmqS.exe
  2⤵
  PID:12564
- C:\Windows\System\GmOtFBV.exe
  C:\Windows\System\GmOtFBV.exe
  2⤵
  PID:12584
- C:\Windows\System\UamTpeE.exe
  C:\Windows\System\UamTpeE.exe
  2⤵
  PID:12608
- C:\Windows\System\dqsIOaZ.exe
  C:\Windows\System\dqsIOaZ.exe
  2⤵
  PID:12632
- C:\Windows\System\WkESGQg.exe
  C:\Windows\System\WkESGQg.exe
  2⤵
  PID:12692
- C:\Windows\System\qkUtLhx.exe
  C:\Windows\System\qkUtLhx.exe
  2⤵
  PID:12712
- C:\Windows\System\FDToWsR.exe
  C:\Windows\System\FDToWsR.exe
  2⤵
  PID:12744
- C:\Windows\System\YUZYZon.exe
  C:\Windows\System\YUZYZon.exe
  2⤵
  PID:12772
- C:\Windows\System\YZqMGuF.exe
  C:\Windows\System\YZqMGuF.exe
  2⤵
  PID:12792
- C:\Windows\System\yzgrCBC.exe
  C:\Windows\System\yzgrCBC.exe
  2⤵
  PID:12832
- C:\Windows\System\HTTEoxP.exe
  C:\Windows\System\HTTEoxP.exe
  2⤵
  PID:12856
- C:\Windows\System\jlqWHkd.exe
  C:\Windows\System\jlqWHkd.exe
  2⤵
  PID:12876
- C:\Windows\System\MsDAUyy.exe
  C:\Windows\System\MsDAUyy.exe
  2⤵
  PID:12896
- C:\Windows\System\pLRllax.exe
  C:\Windows\System\pLRllax.exe
  2⤵
  PID:12940
- C:\Windows\System\XSOstPV.exe
  C:\Windows\System\XSOstPV.exe
  2⤵
  PID:12968
- C:\Windows\System\uyTncom.exe
  C:\Windows\System\uyTncom.exe
  2⤵
  PID:13000
- C:\Windows\System\XSkunIA.exe
  C:\Windows\System\XSkunIA.exe
  2⤵
  PID:13024
- C:\Windows\System\BfQgQvL.exe
  C:\Windows\System\BfQgQvL.exe
  2⤵
  PID:13044
- C:\Windows\System\wueyuYk.exe
  C:\Windows\System\wueyuYk.exe
  2⤵
  PID:13064
- C:\Windows\System\CJCClMa.exe
  C:\Windows\System\CJCClMa.exe
  2⤵
  PID:13108
- C:\Windows\System\zEHmGnA.exe
  C:\Windows\System\zEHmGnA.exe
  2⤵
  PID:13136
- C:\Windows\System\ocpuqMw.exe
  C:\Windows\System\ocpuqMw.exe
  2⤵
  PID:13156
- C:\Windows\System\RJRGyzY.exe
  C:\Windows\System\RJRGyzY.exe
  2⤵
  PID:13176
- C:\Windows\System\ibfKaKW.exe
  C:\Windows\System\ibfKaKW.exe
  2⤵
  PID:13204
- C:\Windows\System\xKZfsjh.exe
  C:\Windows\System\xKZfsjh.exe
  2⤵
  PID:13236
- C:\Windows\System\LvsPcWi.exe
  C:\Windows\System\LvsPcWi.exe
  2⤵
  PID:13260
- C:\Windows\System\ToMNOaj.exe
  C:\Windows\System\ToMNOaj.exe
  2⤵
  PID:13280
- C:\Windows\System\rCVzDWe.exe
  C:\Windows\System\rCVzDWe.exe
  2⤵
  PID:13300
- C:\Windows\System\yldmhQD.exe
  C:\Windows\System\yldmhQD.exe
  2⤵
  PID:12296
- C:\Windows\System\ykntmHy.exe
  C:\Windows\System\ykntmHy.exe
  2⤵
  PID:12336
- C:\Windows\System\mFcMBjB.exe
  C:\Windows\System\mFcMBjB.exe
  2⤵
  PID:12468
- C:\Windows\System\yMaGpWO.exe
  C:\Windows\System\yMaGpWO.exe
  2⤵
  PID:12508
- C:\Windows\System\XoUCPND.exe
  C:\Windows\System\XoUCPND.exe
  2⤵
  PID:12532
- C:\Windows\System\zxvSHAD.exe
  C:\Windows\System\zxvSHAD.exe
  2⤵
  PID:12868
- C:\Windows\System\IhPAFMv.exe
  C:\Windows\System\IhPAFMv.exe
  2⤵
  PID:13040
- C:\Windows\System\FLoQrir.exe
  C:\Windows\System\FLoQrir.exe
  2⤵
  PID:13036
- C:\Windows\System\QCIyQzC.exe
  C:\Windows\System\QCIyQzC.exe
  2⤵
  PID:13128
- C:\Windows\System\rEOXtVU.exe
  C:\Windows\System\rEOXtVU.exe
  2⤵
  PID:13224
- C:\Windows\System\DiWLrJR.exe
  C:\Windows\System\DiWLrJR.exe
  2⤵
  PID:7768
- C:\Windows\System\zEwfLxJ.exe
  C:\Windows\System\zEwfLxJ.exe
  2⤵
  PID:5260
- C:\Windows\System\KwPRXWD.exe
  C:\Windows\System\KwPRXWD.exe
  2⤵
  PID:13168
- C:\Windows\System\xntbSmL.exe
  C:\Windows\System\xntbSmL.exe
  2⤵
  PID:13244
- C:\Windows\System\xcIGyky.exe
  C:\Windows\System\xcIGyky.exe
  2⤵
  PID:12752
- C:\Windows\System\cGmbaXy.exe
  C:\Windows\System\cGmbaXy.exe
  2⤵
  PID:12984
- C:\Windows\System\gIeElqY.exe
  C:\Windows\System\gIeElqY.exe
  2⤵
  PID:13060
- C:\Windows\System\PELZKWW.exe
  C:\Windows\System\PELZKWW.exe
  2⤵
  PID:12892
- C:\Windows\System\hLmRxGS.exe
  C:\Windows\System\hLmRxGS.exe
  2⤵
  PID:5660
- C:\Windows\System\iLJpfhR.exe
  C:\Windows\System\iLJpfhR.exe
  2⤵
  PID:12312
- C:\Windows\System\qvtceuP.exe
  C:\Windows\System\qvtceuP.exe
  2⤵
  PID:12480
- C:\Windows\System\qMcSGiR.exe
  C:\Windows\System\qMcSGiR.exe
  2⤵
  PID:12560
- C:\Windows\System\cqlxJwm.exe
  C:\Windows\System\cqlxJwm.exe
  2⤵
  PID:12628
- C:\Windows\System\GaSNMAc.exe
  C:\Windows\System\GaSNMAc.exe
  2⤵
  PID:4352
- C:\Windows\System\RuzDuvs.exe
  C:\Windows\System\RuzDuvs.exe
  2⤵
  PID:3880
- C:\Windows\System\wBViciT.exe
  C:\Windows\System\wBViciT.exe
  2⤵
  PID:4612
- C:\Windows\System\BJcHTxv.exe
  C:\Windows\System\BJcHTxv.exe
  2⤵
  PID:12552
- C:\Windows\System\kgSNgfw.exe
  C:\Windows\System\kgSNgfw.exe
  2⤵
  PID:13268
- C:\Windows\System\wXzCraC.exe
  C:\Windows\System\wXzCraC.exe
  2⤵
  PID:12976
- C:\Windows\System\YmwYjLy.exe
  C:\Windows\System\YmwYjLy.exe
  2⤵
  PID:4460
- C:\Windows\System\UCajxnv.exe
  C:\Windows\System\UCajxnv.exe
  2⤵
  PID:13016
- C:\Windows\System\abxZTYk.exe
  C:\Windows\System\abxZTYk.exe
  2⤵
  PID:3056
- C:\Windows\System\zITiIYj.exe
  C:\Windows\System\zITiIYj.exe
  2⤵
  PID:12872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n0ojjnno.ngy.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\EVxkUXt.exe

Filesize
1.9MB

MD5
bd486d8f636667ea465b0a0bdc822174

SHA1
810f599c2e11b86c5bc23688dab378bb7a68f48b

SHA256
71dc912b0d7fa9e4171fb0193349ba6cc81fccaad81451564056010efaad4f08

SHA512
9929287fe4e6511ffb4d0b7928290998b18df6becd9a95871a766cf3c21300f1d034b4ab267e35a8771e1044a4709c53d34383038058a52f1fbbd27964db0a18

Download Submit
C:\Windows\System\FfgBtTV.exe

Filesize
1.9MB

MD5
23436ef51541d38496189acdac7395b0

SHA1
5c1154497fb79ba5a828d3c8af594e7854a4b2b1

SHA256
2ce1d18806522a05a5edb7805188c9556a78eae7ab6718676284bf15a54154ea

SHA512
482f2a9d2cb71c9b0da77ae3cd61c156f505fa9388c5ee8a2ec02037745298f066595b2b10a7df2a583b62d07879778c67f870c19f2ea3c41137f45e870775e9

Download Submit
C:\Windows\System\HASBhZp.exe

Filesize
1.9MB

MD5
d100934ad1cf8ca2df2e5648986d5098

SHA1
3fc0131d6f16e6e8a242dc95e8b42920f138a2f0

SHA256
f79ae4d3387a1870ba09351724359806f859f36904b78f3fc9ef4d61407f3395

SHA512
d240a196bad338104d014881ff6b5a0e0fc75020cb08b66296ef6cedfa018a80cd81c61b2ebb8fbd16f02a5b4604d9551bc3f6638390e6656464f3a4cb77662e

Download Submit
C:\Windows\System\HxgHKUG.exe

Filesize
1.9MB

MD5
e3fccfac2350a74ef5c397b23f4e3837

SHA1
908bcabf281504c1d9d501e8724e7a12e3842815

SHA256
6545e2cc7ca85b15666d6cc306057add47de3b3018f72aa7686ed0ee76f836a9

SHA512
24b14bf801b968a34ebb81bf25e9f3fdeb9a648f266147a158798448e2cff0300edf568ed53e8ce5a724bc2b811e5c6b24e0267bb1feea1b6777009907d1e05f

Download Submit
C:\Windows\System\NqcXkxe.exe

Filesize
1.9MB

MD5
9389af27540b1a991b0a8e567cf5a19b

SHA1
f2ac33ea5e8e8533cf4caf086bd31acd01bef744

SHA256
1f559d2b1b9e75d801eeaca87c7523254023b63e621ea51325c52d60d1a2c70c

SHA512
2139eda89e7490d84059c6e0cccd4d867d0b291e694b60ca032209da34b7d6597203c1329ab87ae06217300cdf7f641c0ed18f3113254eb5c33658874f60f07a

Download Submit
C:\Windows\System\OTmOzwu.exe

Filesize
1.9MB

MD5
c58e7fbfcf90a471e3b2765d9d5046b7

SHA1
51ca5b7b65ab57ce25225f4db1ec51d0365d2dff

SHA256
87a021ec6611ff9300dbeed958df3272e6a5b333abf80b6b28b96c7970e6e703

SHA512
a341ab27f36999d510a7985ea9e2b0f25df82692845e1f401a18899e6d0760737d42f28783d8dbb660b53078b1b672f65432879877b884176b026dbfdad136c6

Download Submit
C:\Windows\System\QWWSlvH.exe

Filesize
1.9MB

MD5
de36bcb69114a5af79e773b7f4930efe

SHA1
adf54f9b6879c8e574ce5a1940a267c77c9e71f3

SHA256
b49c4f446df7c9ea109266b430fff7445f1e2fb0098506b40f6cbc5a87178978

SHA512
eed50f853b34893dfa10b7ffc7945898c46f36165983e91b6ca92bc38b22bd65e45efadc28882354505ff65fe7385bb51491ef0b71d48bfc2099a63efa037361

Download Submit
C:\Windows\System\TZEKfKa.exe

Filesize
1.9MB

MD5
9a97f7f4149d6d109298760857bc7a02

SHA1
c4c3f8369a9feef0c159a4a1fa8135c383f07a40

SHA256
ced1adc0d49cf4485bda7386d37275b8738412bd97680b49ac96c8a398393403

SHA512
048424200b39cedd224f40d124f994d52f58118b06158b9cec70c060faaee93d482254867bdbba47dd408f285ff53ec683710f7414eb2fe8aa57ec26bd1605d7

Download Submit
C:\Windows\System\XbwsUya.exe

Filesize
1.9MB

MD5
d805d3f1ce44dd43e6b312eff894fe43

SHA1
2dc3995a114134a72404cb16ba0ae4029eb48efd

SHA256
80d1ebeea4a5d968e8859a2ff1b6a4f5c4ee2c58a2141014bc5c255886b16a4e

SHA512
98397143b415553919f2a9b0cc8ad1bcb29c4640e45f9ae3a5aa55f4b09b9fe40cf1cf6b524962e668e2d015aa3ac59ea09167c7c4ede29689322f34aa58fe02

Download Submit
C:\Windows\System\XjiaYOg.exe

Filesize
1.9MB

MD5
2278406ae3746263a51580f23ccb346f

SHA1
8ab410c00b145371ecb865b0d750106a75353ee7

SHA256
260f1d865306c3c66c833988fe6047b6fbdb81c4c6e7426bf4a1dadc9bcbfdb7

SHA512
521c05fdd2cdfbd801f607dcd87b53b4cb7cac31ce6bf713f03d1c7a77e1497c797ae4c72ebae3eae4fcd51842e6b1bd9ab56580b47aa774c1062ba53723d785

Download Submit
C:\Windows\System\YQKeDJr.exe

Filesize
1.9MB

MD5
789878d06c96b002b74a65fcb1f52032

SHA1
14c3d34594685b331418a44cd84c532abbbe7668

SHA256
4419d99d9b33cf97bcfba8d9044afcecc37083ae70df2ebb2455a53a12d57a37

SHA512
4a2fe04412812779b5d2b177b0460a30574f1b63f284191e33f2e8c9170f68ba1e1137515fe805683fc926c899d0f9a493f10306f5017928bf2f189a64eb6bf6

Download Submit
C:\Windows\System\ZVbemZb.exe

Filesize
1.9MB

MD5
322aca63c79a4d364da4e7b493d3ef6f

SHA1
a72d160b8812bbdd8f6e25f3c84d6ed4b829f827

SHA256
2d8ac5454ee9c4eac18c956212da95696b8fe870df22f0b9b7ec6d646725622c

SHA512
fe5572856ec691a743ec0f0180ba12de8f90b06ab3c2a76d22519124a3c3474e028efafd5135517fa198d80f94d0f7260a3502153b671593c7572c67e07a0e3f

Download Submit
C:\Windows\System\dBMVsmG.exe

Filesize
1.9MB

MD5
c926c8f709d39d8fbebc3a00020d16de

SHA1
581be898b933581c18d649ff23a7984c86acf000

SHA256
0a83892bef43918cc0458472a719e403eab662c170898dea45cbf922454fb6fc

SHA512
cd56de618921c9736398c21d8914bf1b8efce385e14e9cda147310e149f54a6d1a248ab69a68c5d6d645aa25b31a9560beff9b439fe4d2a8db799420a4203262

Download Submit
C:\Windows\System\dGitzGw.exe

Filesize
1.9MB

MD5
ab44700e473c98b5cb1a18188bb9cb8d

SHA1
8a6608a9a6a14e338ae3ba6aeab0ac39d086fab8

SHA256
47ba877383509d5ae767917459d6af486dca72e8414881a8e8ce250a10a1e562

SHA512
a46b5f448fceec9963910488e6664fbb2aa6a25797faa518b36167955ec58e722f54062dce1d533a78ec34ecc36ea5993fa64e51a03419b56458464f4b57d68b

Download Submit
C:\Windows\System\dIpLytu.exe

Filesize
1.9MB

MD5
d9c9be4e2d6633d80f24350d8a7b2a4f

SHA1
e8123f875639a73f38f66685edac34e641d626e0

SHA256
0110ce21e033bd888064fb6e625709577e4a3b0e43fa02e4093927fd66308700

SHA512
43bca049a166230da8ed1d71e417946edabe4ee932b3587def8b947d4b1c261f218e9a6115268ade96099c15b4de9afed5d115f4d291be40f678516c2a0d5d58

Download Submit
C:\Windows\System\dJdePNx.exe

Filesize
1.9MB

MD5
3d2550b2e7734cb8a4bdb7f93b01f7a3

SHA1
cbfa9a07ed90778a432c380b1c0ec936525cf702

SHA256
0254a5589601c325352e7e7da3076340ba77d4e43a78248f3f719272a2c4e010

SHA512
bc3630176f7dabe2e9799c06983671792498aacf2e22c7826c30b0c9752ac5268a4ce84b87e513d62ed0cbdca674284f2ed79094cc81db6ab9eafbd09a08de98

Download Submit
C:\Windows\System\fjAoKqC.exe

Filesize
1.9MB

MD5
4a6eb2c2019da402525ba10878dcf5fd

SHA1
cef79846f7d9f766359a27e5f5aa0709478b7527

SHA256
555470ff5150b05a304110108ffa14e8752de0de65272982c06e4f35572a3f92

SHA512
c9fff2f27e0ed16eea2345f6f0b29cdc2c1a35de442e684d9a9054073c4d4717dd8016ed6b6470a7e69a0418d04a6fada51fac2367c4b37e51ca4d83b9cf84d1

Download Submit
C:\Windows\System\hLejyvb.exe

Filesize
1.9MB

MD5
54488a5f0308f1f1017abf87da84c3f8

SHA1
1e73791d3e2983d07bfe077f7192516b7cd049cb

SHA256
022996fd7ed604d764768014049c439776c3de402f259d216420de496870b548

SHA512
14f77633b39440e0d13aee796915d2c9dca8462cb70ca0d9babfd590610d9d5983dc511405769151db614ccb594c70f5d7642a6044343d907551801427a49621

Download Submit
C:\Windows\System\jlYMIfv.exe

Filesize
1.9MB

MD5
65a8c640aff9887a1c29d1922cccb004

SHA1
e54f47ae3a2a0eb2065837414dc9598ca2491aca

SHA256
1200c5d26b79a468d6c375e607d6e6d4e317bfeaba97c87eb123a93b7f3ca1ad

SHA512
aa6f2d4ad73e77c7d4e76c86f11fe8cfc9b712dd48fa823634073030a68543efd445209beb89cb8258e52884fc4e44d217c87f9b389584a2598936fbf4d6b057

Download Submit
C:\Windows\System\kFLJZnq.exe

Filesize
1.9MB

MD5
5bda00185b8675c2754d63ea9a5ea3c0

SHA1
a34014a4439a6335c7b807883f4e61c03ea4383e

SHA256
91df7f1f2af19178ab08d64d141de744ca2a9123efeccd59289126f1d8d282c1

SHA512
ca69a03f2298dd6d03b993acd72792e43c643d9e0bbfeba540af42c26548993cbf0219d47c6d674c12e9acff80c391632e1b279c7226446d35c597644a42f49b

Download Submit
C:\Windows\System\nVtmJEP.exe

Filesize
1.9MB

MD5
1c15696009890ee8be29192135e42557

SHA1
50b13a025135aa7e3544fbb30740e105c33ac94b

SHA256
3338dc2fdf5617c1ba07d78588000cd41c1c180288082bdaedf97235b2a00927

SHA512
7cedbe425e332e270a9d80d0980bc4636222346ecb7dadd990a127e9897a53bd0ecf9c11a5d7edac4b7279540f7acd6e6995e6b5cbab923c1408b782df551cf9

Download Submit
C:\Windows\System\qVBEbae.exe

Filesize
1.9MB

MD5
b51c1d4878bda42a6f6d36a827c0d53f

SHA1
e2dd4dca7d6ae7a0e1981bf9f7eae399de6ac691

SHA256
e0cb581afe209a3c3085d5efeec99ac1d3f8c7a266941bd7f15b752d507da2b6

SHA512
b772a4e5812af1f24e7a665db7eb8baa19117582272c042001a91227502cc9919384101449159d9bb741d1316dba3e5b6e27368b2069ed27d121650af588ee82

Download Submit
C:\Windows\System\qvWMoww.exe

Filesize
1.9MB

MD5
363b5eb1801b2389d3afdf5afc651cd6

SHA1
ee18c0a23f39dada56d687ed9f76c7fcb05ad34d

SHA256
d904b9256c20cf24013be42fd5575eae947c6665f2d72611942e4e5c21d7fd4d

SHA512
0aba8576858c79bd8a546bbd1ef1b19a33ce35a3f87c3140132a424320bacda9cbd8f1b437cc70084995c31dc2d08f4f0cd679f032c9413d4c77d0d8908443b0

Download Submit
C:\Windows\System\rEkauzf.exe

Filesize
1.9MB

MD5
4cdc7d5cb2aa68d5d90aa853e246831d

SHA1
3c380a7067f3c2effefe8e0508af9ac41b61f40f

SHA256
5241d53bd5289973c24286da79b9d2810ee9ea625cbfde4fcd912b202b3ba9b7

SHA512
cda0fe8ecaf0e9aa9bc0b257780249ca63b4adcaf49f3e2b6bdf72b1dd1740fbf9afe54bf0883358530af212c00c7d26ca514adc0cb14865646dd1a8d995c66c

Download Submit
C:\Windows\System\sGvAMaS.exe

Filesize
1.9MB

MD5
17aecde0ecfb5e6c18975491f8cfe7eb

SHA1
bae2be12516dbb06d217f97748a4361db960b271

SHA256
7b1891a8f639902bdd3829f2f208b92182bebaad0815bb003c2982a445c363c8

SHA512
4151ac7634f892ebda8390905fd9c1fdd43e71437a415155d09c042de2f81690aa6c413f3335dd4de611785f5314e5032cf492f303c4a1e7fd749c4f76c92061

Download Submit
C:\Windows\System\tksVOzX.exe

Filesize
1.9MB

MD5
6885c878b21bc4f88ad12d00e6218767

SHA1
dd314c44572c3ea1806ea2d245d391c0d9f39d0c

SHA256
ab004027e0dafc7dd435a344ba4e35f8edb52e84b3d3cedec4f8340f0c07c991

SHA512
3d10cbdddf438f9dece43f6b94fd6c84e7650c1ad0b78065eed2a44247ef5b8f13fb67d33e0b054c527ac798c42f4979ba9b9dd591f11a4b92d3f1b76fa693ae

Download Submit
C:\Windows\System\urUKKyi.exe

Filesize
1.9MB

MD5
93615c2aef2aa44abcc213fe92c2efac

SHA1
7d5f9555fb250aaf79b1e2a62c4a231990f9df9f

SHA256
153db728f013891e847c63716769f465577b80c177329328baa9778620495056

SHA512
81e3b3a35dfbdb13767c4d6713f8e889bd3d2308125b1c642b341305d369ef4af99f5f07e1947657e1f44b500b1043eb6eb6c20d68f4ee50f05780dee3dcbbb8

Download Submit
C:\Windows\System\vCdXbFH.exe

Filesize
1.9MB

MD5
8a19506f37ee6a4a846013bac03298b7

SHA1
9c1f9e66422512fd1b40922667a319eae55f95f1

SHA256
2ac2336974dfe762cc87c539095694ed80db7e3e8da5b0555f92a19588247db5

SHA512
2232f1016d67b9557faa4a194eb38a9ddaf7f0804f57919dfeca7d1a5cc6a8b31b0ab4c96619255fca6b3fbbde804ea5e32ffc3f29ea5db78202424fce8b206a

Download Submit
C:\Windows\System\xLQlxSg.exe

Filesize
1.9MB

MD5
551628779413ec3ef3078afbb5e30953

SHA1
eff25fe0b218f7ae2e768c2b79d1b20f1fda9327

SHA256
9679a9787a5f7684101ede2947fa356fe7246226b3ca0e26f8e41bc4a77bad1e

SHA512
eda382a53ef60c42d87bc36b6932fe3f90946fd75fdea3ab4cc2b745783e4196dfec73566fdc39473c8553ba76079f3d4a3297be5eef7d802f4fbbe92fa7b766

Download Submit
C:\Windows\System\yIexMqT.exe

Filesize
1.9MB

MD5
74c970c49f802a03c8bb6a762e810d67

SHA1
b02d3c59d9bcad72d9616000119f915867f89f48

SHA256
10cdfbb0d782bfffc2108304a7f6a6c5de3f5b11b62ee156a3aeb2dd8015be07

SHA512
8676ddda41bd7ff62e246c753624fd1e38a7bc9c70a18a90f22878eea6f595e313d5d9ebf268912e6f17dc3ad80b455da51c838425af3981cd4db7f83a189471

Download Submit
C:\Windows\System\ylXBVXm.exe

Filesize
1.9MB

MD5
2ba0965012d34f553e4ba9331e61d3e3

SHA1
0ace5e13da808b4819d8d6d36809caa4ede77a5a

SHA256
f4ca84a84affcab86f2ff786ccecbaf86d6088840b56980c967ea94462a42d64

SHA512
b96ba80bfe7ee7592fb43aa933d0a95f2ed937a07ecdfbdecd647edc5ec866553bbc670879bfd25580e66bfe7f846eb7689a6300ca91a15653f9ffcafe1c4294

Download Submit
C:\Windows\System\yobyWVW.exe

Filesize
1.9MB

MD5
23237f074aed156603af70fdbd414e46

SHA1
14454babeed9bb63d3b3a5cbc1074206f6fea013

SHA256
36cf0d3843bde254991ec24946c036f5d79ab29eb4d04e13797a951ed6aed8e1

SHA512
0496319c3cf886c6855fcbe27fdad16b0caf16b2c291fc258bca717cc62ba4b3695cdfb66e267c46235f41b3604929d10b67d2b8503a7da6c0ee4086df334ada

Download Submit
C:\Windows\System\zzvegPS.exe

Filesize
1.9MB

MD5
dfbcaa9cf3b8733964dcf17ed2e39144

SHA1
b36c8732077b9b0caf799dc7c2dc435cfe200fb7

SHA256
eefec34c2554e0e6ded81a803c97213b3c1798e0afbf9f720579f1481ff8990c

SHA512
7f1a3030b8c2424216cb465bbff309e13e160912357282bda68d0a02c1674ed90f7d2f022f96a38dbf16880b622afc84b63fa58acfeb2b12d299d06405f22b7c

Download Submit
memory/1196-2492-0x00007FF60E3A0000-0x00007FF60E792000-memory.dmp

Filesize
3.9MB

Download
memory/1196-2758-0x00007FF60E3A0000-0x00007FF60E792000-memory.dmp

Filesize
3.9MB

Download
memory/1196-70-0x00007FF60E3A0000-0x00007FF60E792000-memory.dmp

Filesize
3.9MB

Download
memory/1300-32-0x00007FF7368D0000-0x00007FF736CC2000-memory.dmp

Filesize
3.9MB

Download
memory/1300-2743-0x00007FF7368D0000-0x00007FF736CC2000-memory.dmp

Filesize
3.9MB

Download
memory/1356-2760-0x00007FF7354C0000-0x00007FF7358B2000-memory.dmp

Filesize
3.9MB

Download
memory/1356-86-0x00007FF7354C0000-0x00007FF7358B2000-memory.dmp

Filesize
3.9MB

Download
memory/1456-2746-0x00007FF7EB0F0000-0x00007FF7EB4E2000-memory.dmp

Filesize
3.9MB

Download
memory/1456-54-0x00007FF7EB0F0000-0x00007FF7EB4E2000-memory.dmp

Filesize
3.9MB

Download
memory/1800-2744-0x00007FF62B470000-0x00007FF62B862000-memory.dmp

Filesize
3.9MB

Download
memory/1800-75-0x00007FF62B470000-0x00007FF62B862000-memory.dmp

Filesize
3.9MB

Download
memory/1956-2717-0x00007FF64DDB0000-0x00007FF64E1A2000-memory.dmp

Filesize
3.9MB

Download
memory/1956-101-0x00007FF64DDB0000-0x00007FF64E1A2000-memory.dmp

Filesize
3.9MB

Download
memory/1956-2766-0x00007FF64DDB0000-0x00007FF64E1A2000-memory.dmp

Filesize
3.9MB

Download
memory/2052-329-0x00007FF7C8DA0000-0x00007FF7C9192000-memory.dmp

Filesize
3.9MB

Download
memory/2052-2778-0x00007FF7C8DA0000-0x00007FF7C9192000-memory.dmp

Filesize
3.9MB

Download
memory/2556-327-0x00007FF749490000-0x00007FF749882000-memory.dmp

Filesize
3.9MB

Download
memory/2556-2775-0x00007FF749490000-0x00007FF749882000-memory.dmp

Filesize
3.9MB

Download
memory/2824-311-0x00007FF7076C0000-0x00007FF707AB2000-memory.dmp

Filesize
3.9MB

Download
memory/2824-2770-0x00007FF7076C0000-0x00007FF707AB2000-memory.dmp

Filesize
3.9MB

Download
memory/2940-328-0x00007FF6816F0000-0x00007FF681AE2000-memory.dmp

Filesize
3.9MB

Download
memory/2940-2776-0x00007FF6816F0000-0x00007FF681AE2000-memory.dmp

Filesize
3.9MB

Download
memory/2984-2749-0x00007FF731D10000-0x00007FF732102000-memory.dmp

Filesize
3.9MB

Download
memory/2984-76-0x00007FF731D10000-0x00007FF732102000-memory.dmp

Filesize
3.9MB

Download
memory/3200-27-0x00007FF782A50000-0x00007FF782E42000-memory.dmp

Filesize
3.9MB

Download
memory/3200-2741-0x00007FF782A50000-0x00007FF782E42000-memory.dmp

Filesize
3.9MB

Download
memory/3384-2762-0x00007FF73A460000-0x00007FF73A852000-memory.dmp

Filesize
3.9MB

Download
memory/3384-92-0x00007FF73A460000-0x00007FF73A852000-memory.dmp

Filesize
3.9MB

Download
memory/3388-2768-0x00007FF692580000-0x00007FF692972000-memory.dmp

Filesize
3.9MB

Download
memory/3388-100-0x00007FF692580000-0x00007FF692972000-memory.dmp

Filesize
3.9MB

Download
memory/3388-2689-0x00007FF692580000-0x00007FF692972000-memory.dmp

Filesize
3.9MB

Download
memory/3684-2752-0x00007FF616350000-0x00007FF616742000-memory.dmp

Filesize
3.9MB

Download
memory/3684-65-0x00007FF616350000-0x00007FF616742000-memory.dmp

Filesize
3.9MB

Download
memory/3720-21-0x00007FF91B480000-0x00007FF91BF41000-memory.dmp

Filesize
10.8MB

Download
memory/3720-46-0x000001B0C9EE0000-0x000001B0C9F02000-memory.dmp

Filesize
136KB

Download
memory/3720-325-0x000001B0CCBB0000-0x000001B0CD356000-memory.dmp

Filesize
7.6MB

Download
memory/3720-23-0x000001B0C9F90000-0x000001B0C9FA0000-memory.dmp

Filesize
64KB

Download
memory/3720-22-0x000001B0C9F90000-0x000001B0C9FA0000-memory.dmp

Filesize
64KB

Download
memory/3948-2750-0x00007FF6D2060000-0x00007FF6D2452000-memory.dmp

Filesize
3.9MB

Download
memory/3948-79-0x00007FF6D2060000-0x00007FF6D2452000-memory.dmp

Filesize
3.9MB

Download
memory/3976-2754-0x00007FF7B18F0000-0x00007FF7B1CE2000-memory.dmp

Filesize
3.9MB

Download
memory/3976-66-0x00007FF7B18F0000-0x00007FF7B1CE2000-memory.dmp

Filesize
3.9MB

Download
memory/4532-318-0x00007FF737950000-0x00007FF737D42000-memory.dmp

Filesize
3.9MB

Download
memory/4532-2772-0x00007FF737950000-0x00007FF737D42000-memory.dmp

Filesize
3.9MB

Download
memory/4664-1-0x00000271D6690000-0x00000271D66A0000-memory.dmp

Filesize
64KB

Download
memory/4664-0-0x00007FF600D60000-0x00007FF601152000-memory.dmp

Filesize
3.9MB

Download
memory/4988-2688-0x00007FF767BD0000-0x00007FF767FC2000-memory.dmp

Filesize
3.9MB

Download
memory/4988-2764-0x00007FF767BD0000-0x00007FF767FC2000-memory.dmp

Filesize
3.9MB

Download
memory/4988-97-0x00007FF767BD0000-0x00007FF767FC2000-memory.dmp

Filesize
3.9MB

Download
memory/5044-85-0x00007FF66E640000-0x00007FF66EA32000-memory.dmp

Filesize
3.9MB

Download
memory/5044-2756-0x00007FF66E640000-0x00007FF66EA32000-memory.dmp

Filesize
3.9MB

Download
memory/5060-330-0x00007FF65A650000-0x00007FF65AA42000-memory.dmp

Filesize
3.9MB

Download
memory/5060-2784-0x00007FF65A650000-0x00007FF65AA42000-memory.dmp

Filesize
3.9MB

Download