xmrig | 94d2e14ba7653b9cafa62dbccc9bc71edb5eab298870eab575e6a20810efdb36

Analysis

max time kernel
134s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 06:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
Size

2.2MB
MD5

0fe4d3b007fe17b20efe4fb4025035d3
SHA1

5842479aa87807438b9267759c77b7ecd41111e1
SHA256

94d2e14ba7653b9cafa62dbccc9bc71edb5eab298870eab575e6a20810efdb36
SHA512

ebb6f8553d7de2f6c8127d17d99a298b59ee0b2d300a95132b19a207f0b3a703c4278a7e17c8471f26a0cf88a84c2bee2f68720f7f10e647d6165f7e34890dcf
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfK:NABL

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 37 IoCs

miner

resource	yara_rule
behavioral2/memory/1924-39-0x00007FF62A260000-0x00007FF62A652000-memory.dmp	xmrig
behavioral2/memory/5064-83-0x00007FF770C30000-0x00007FF771022000-memory.dmp	xmrig
behavioral2/memory/3192-167-0x00007FF7B61A0000-0x00007FF7B6592000-memory.dmp	xmrig
behavioral2/memory/3096-107-0x00007FF75DC10000-0x00007FF75E002000-memory.dmp	xmrig
behavioral2/memory/1012-98-0x00007FF621C50000-0x00007FF622042000-memory.dmp	xmrig
behavioral2/memory/4676-97-0x00007FF61C500000-0x00007FF61C8F2000-memory.dmp	xmrig
behavioral2/memory/2456-94-0x00007FF6826C0000-0x00007FF682AB2000-memory.dmp	xmrig
behavioral2/memory/3616-92-0x00007FF6F7AB0000-0x00007FF6F7EA2000-memory.dmp	xmrig
behavioral2/memory/3568-85-0x00007FF70AD10000-0x00007FF70B102000-memory.dmp	xmrig
behavioral2/memory/3612-84-0x00007FF7B22D0000-0x00007FF7B26C2000-memory.dmp	xmrig
behavioral2/memory/2320-70-0x00007FF75D630000-0x00007FF75DA22000-memory.dmp	xmrig
behavioral2/memory/5060-63-0x00007FF670C40000-0x00007FF671032000-memory.dmp	xmrig
behavioral2/memory/2752-57-0x00007FF7E79B0000-0x00007FF7E7DA2000-memory.dmp	xmrig
behavioral2/memory/384-33-0x00007FF760430000-0x00007FF760822000-memory.dmp	xmrig
behavioral2/memory/4432-2927-0x00007FF650540000-0x00007FF650932000-memory.dmp	xmrig
behavioral2/memory/924-2928-0x00007FF75D680000-0x00007FF75DA72000-memory.dmp	xmrig
behavioral2/memory/224-2929-0x00007FF670360000-0x00007FF670752000-memory.dmp	xmrig
behavioral2/memory/1948-2930-0x00007FF6BE760000-0x00007FF6BEB52000-memory.dmp	xmrig
behavioral2/memory/1620-2931-0x00007FF6B6A80000-0x00007FF6B6E72000-memory.dmp	xmrig
behavioral2/memory/1452-2932-0x00007FF76A3B0000-0x00007FF76A7A2000-memory.dmp	xmrig
behavioral2/memory/2320-2934-0x00007FF75D630000-0x00007FF75DA22000-memory.dmp	xmrig
behavioral2/memory/3568-2936-0x00007FF70AD10000-0x00007FF70B102000-memory.dmp	xmrig
behavioral2/memory/1012-2938-0x00007FF621C50000-0x00007FF622042000-memory.dmp	xmrig
behavioral2/memory/3616-2940-0x00007FF6F7AB0000-0x00007FF6F7EA2000-memory.dmp	xmrig
behavioral2/memory/4676-2943-0x00007FF61C500000-0x00007FF61C8F2000-memory.dmp	xmrig
behavioral2/memory/2456-2944-0x00007FF6826C0000-0x00007FF682AB2000-memory.dmp	xmrig
behavioral2/memory/3096-2946-0x00007FF75DC10000-0x00007FF75E002000-memory.dmp	xmrig
behavioral2/memory/540-2948-0x00007FF68C600000-0x00007FF68C9F2000-memory.dmp	xmrig
behavioral2/memory/4432-2952-0x00007FF650540000-0x00007FF650932000-memory.dmp	xmrig
behavioral2/memory/4716-2951-0x00007FF6AFBA0000-0x00007FF6AFF92000-memory.dmp	xmrig
behavioral2/memory/924-2955-0x00007FF75D680000-0x00007FF75DA72000-memory.dmp	xmrig
behavioral2/memory/224-2958-0x00007FF670360000-0x00007FF670752000-memory.dmp	xmrig
behavioral2/memory/1948-2956-0x00007FF6BE760000-0x00007FF6BEB52000-memory.dmp	xmrig
behavioral2/memory/1452-2965-0x00007FF76A3B0000-0x00007FF76A7A2000-memory.dmp	xmrig
behavioral2/memory/4084-2966-0x00007FF7FE470000-0x00007FF7FE862000-memory.dmp	xmrig
behavioral2/memory/3192-2963-0x00007FF7B61A0000-0x00007FF7B6592000-memory.dmp	xmrig
behavioral2/memory/1620-2960-0x00007FF6B6A80000-0x00007FF6B6E72000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
8	3904	powershell.exe
10	3904	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3904	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4412	fHtOxQN.exe
5064	rejZTMH.exe
384	TbaJgow.exe
1924	EYiQZDJ.exe
2752	GLcUkto.exe
5060	lBXDwhQ.exe
3612	pKpwMur.exe
2320	chmNPnl.exe
3568	dfOgFCD.exe
3616	MVgAaFM.exe
1012	xKdyqDF.exe
2456	xqhVDGP.exe
4676	RPYsVxd.exe
3096	WWKMlVa.exe
540	HHUslmU.exe
4716	ftVterq.exe
4432	BURPkgT.exe
924	yWlQDTZ.exe
224	cTqaqqh.exe
1948	MXPwaJj.exe
1620	duueKAr.exe
1452	JxGQddN.exe
4084	DZnYFBp.exe
3192	NPrXYab.exe
2380	ItFOkkM.exe
4620	GXNSpvX.exe
3772	UDZzSVc.exe
3652	icZLekI.exe
1852	cUWAkdW.exe
3500	CcdXIkf.exe
4992	qzFTANz.exe
4276	ZnUjFHt.exe
3524	zcmViPg.exe
4644	ABDavOX.exe
1960	kGrBevN.exe
2500	cEaMSkc.exe
2020	rTRBdFo.exe
2904	MaHubCc.exe
3104	vmgrWsr.exe
4420	CHRMyOX.exe
4388	lOysyFn.exe
3344	dAVKMOW.exe
1368	SFZFpoY.exe
3436	PVJegxF.exe
3228	GlsfxfB.exe
2084	TRtSnHC.exe
3232	Ymxxhlg.exe
516	NzXknza.exe
2712	WKeUDYo.exe
1476	hVgBzdX.exe
4072	aBZAtCF.exe
4668	WBWGEKP.exe
888	evvdtkc.exe
1260	ptVRmWL.exe
2520	njaHWhR.exe
4888	xZhHCSa.exe
3988	rAHRygZ.exe
5116	oDEhpCh.exe
3432	rrLqPXn.exe
3300	IPmDwEf.exe
2584	DPcbULH.exe
2364	pGXFNJS.exe
1672	riNGrhx.exe
3872	FLIMdda.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3656-0-0x00007FF659540000-0x00007FF659932000-memory.dmp	upx
behavioral2/files/0x000b000000023b91-5.dat	upx
behavioral2/files/0x000a000000023b97-19.dat	upx
behavioral2/files/0x000a000000023b98-24.dat	upx
behavioral2/files/0x000a000000023b96-27.dat	upx
behavioral2/files/0x000a000000023b99-35.dat	upx
behavioral2/memory/1924-39-0x00007FF62A260000-0x00007FF62A652000-memory.dmp	upx
behavioral2/files/0x000a000000023b9b-43.dat	upx
behavioral2/files/0x000a000000023ba0-73.dat	upx
behavioral2/files/0x000a000000023ba1-80.dat	upx
behavioral2/memory/5064-83-0x00007FF770C30000-0x00007FF771022000-memory.dmp	upx
behavioral2/files/0x000b000000023b9f-86.dat	upx
behavioral2/files/0x000a000000023ba2-93.dat	upx
behavioral2/files/0x000b000000023b9e-104.dat	upx
behavioral2/files/0x000a000000023ba3-121.dat	upx
behavioral2/files/0x000a000000023ba6-129.dat	upx
behavioral2/memory/1620-149-0x00007FF6B6A80000-0x00007FF6B6E72000-memory.dmp	upx
behavioral2/files/0x000a000000023ba9-156.dat	upx
behavioral2/files/0x000a000000023bb3-200.dat	upx
behavioral2/files/0x000a000000023bb1-198.dat	upx
behavioral2/files/0x000a000000023bb2-195.dat	upx
behavioral2/files/0x000a000000023bb0-193.dat	upx
behavioral2/files/0x000a000000023baf-188.dat	upx
behavioral2/files/0x000a000000023bae-183.dat	upx
behavioral2/files/0x000a000000023bad-178.dat	upx
behavioral2/files/0x000a000000023bac-173.dat	upx
behavioral2/files/0x000a000000023bab-168.dat	upx
behavioral2/memory/3192-167-0x00007FF7B61A0000-0x00007FF7B6592000-memory.dmp	upx
behavioral2/files/0x000a000000023baa-162.dat	upx
behavioral2/memory/4084-161-0x00007FF7FE470000-0x00007FF7FE862000-memory.dmp	upx
behavioral2/memory/1452-155-0x00007FF76A3B0000-0x00007FF76A7A2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba8-150.dat	upx
behavioral2/files/0x000a000000023ba7-144.dat	upx
behavioral2/memory/1948-143-0x00007FF6BE760000-0x00007FF6BEB52000-memory.dmp	upx
behavioral2/memory/224-137-0x00007FF670360000-0x00007FF670752000-memory.dmp	upx
behavioral2/files/0x000a000000023ba5-132.dat	upx
behavioral2/files/0x000a000000023ba4-127.dat	upx
behavioral2/memory/924-126-0x00007FF75D680000-0x00007FF75DA72000-memory.dmp	upx
behavioral2/memory/4432-120-0x00007FF650540000-0x00007FF650932000-memory.dmp	upx
behavioral2/memory/4716-114-0x00007FF6AFBA0000-0x00007FF6AFF92000-memory.dmp	upx
behavioral2/memory/540-113-0x00007FF68C600000-0x00007FF68C9F2000-memory.dmp	upx
behavioral2/files/0x000b000000023b92-108.dat	upx
behavioral2/memory/3096-107-0x00007FF75DC10000-0x00007FF75E002000-memory.dmp	upx
behavioral2/memory/1012-98-0x00007FF621C50000-0x00007FF622042000-memory.dmp	upx
behavioral2/memory/4676-97-0x00007FF61C500000-0x00007FF61C8F2000-memory.dmp	upx
behavioral2/memory/2456-94-0x00007FF6826C0000-0x00007FF682AB2000-memory.dmp	upx
behavioral2/memory/3616-92-0x00007FF6F7AB0000-0x00007FF6F7EA2000-memory.dmp	upx
behavioral2/memory/3568-85-0x00007FF70AD10000-0x00007FF70B102000-memory.dmp	upx
behavioral2/memory/3612-84-0x00007FF7B22D0000-0x00007FF7B26C2000-memory.dmp	upx
behavioral2/files/0x000a000000023b9d-81.dat	upx
behavioral2/memory/2320-70-0x00007FF75D630000-0x00007FF75DA22000-memory.dmp	upx
behavioral2/files/0x000a000000023b9c-67.dat	upx
behavioral2/memory/5060-63-0x00007FF670C40000-0x00007FF671032000-memory.dmp	upx
behavioral2/files/0x000a000000023b9a-59.dat	upx
behavioral2/memory/2752-57-0x00007FF7E79B0000-0x00007FF7E7DA2000-memory.dmp	upx
behavioral2/memory/384-33-0x00007FF760430000-0x00007FF760822000-memory.dmp	upx
behavioral2/files/0x000a000000023b95-32.dat	upx
behavioral2/memory/4412-6-0x00007FF6009B0000-0x00007FF600DA2000-memory.dmp	upx
behavioral2/memory/4432-2927-0x00007FF650540000-0x00007FF650932000-memory.dmp	upx
behavioral2/memory/924-2928-0x00007FF75D680000-0x00007FF75DA72000-memory.dmp	upx
behavioral2/memory/224-2929-0x00007FF670360000-0x00007FF670752000-memory.dmp	upx
behavioral2/memory/1948-2930-0x00007FF6BE760000-0x00007FF6BEB52000-memory.dmp	upx
behavioral2/memory/1620-2931-0x00007FF6B6A80000-0x00007FF6B6E72000-memory.dmp	upx
behavioral2/memory/1452-2932-0x00007FF76A3B0000-0x00007FF76A7A2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\vNPMvuE.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\dVbFmzs.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\XsajVVx.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\swvZkXx.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\RUBZEHY.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\nitjlcU.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\zdhhasp.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\EFhxowE.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\PgvPJYX.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\cPfMiXz.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\oPtdYJV.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\BeZNWcF.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\MXKgBgU.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\WYgNWPx.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\aNHNwIa.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\ZUQWalu.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\DIdLJKz.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\fBbiRBq.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\uFJKqEW.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\qzFTANz.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\svCSYkD.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\BsFrllU.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\GYvCvHW.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\rnlfJOl.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\xTdzIga.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\XbRgrTT.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\JxGQddN.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\qqDimKb.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\XjCMNmb.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\kIyoQfw.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\dxQRMIa.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\OTVTAGl.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\pLozGLD.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\OWqkzLJ.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\VvsvDhh.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\UNkSZPX.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\wMPPjPJ.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\ryEbxcV.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\NjXyCyf.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\vlYQgGU.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\PTwHVpg.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\NMswFwk.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\BJYtiVs.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\RkXAsrM.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\aoputIV.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\kTrGyei.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\icZLekI.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\ZwqAION.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\fVwzBps.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\BkCzKwh.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\eGVGYJq.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\LIRGqAz.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\fOVOVYA.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\YxQuxMY.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\ekyhcfs.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\EKYQTOi.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\IJoCJPO.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\xhbjeaU.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\lgLnekJ.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\gGPCimP.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\dEkBJQU.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\klSCtMt.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\OrHtYLl.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
File created	C:\Windows\System\hotkkyJ.exe	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3904	powershell.exe
3904	powershell.exe
3904	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3904	powershell.exe
Token: SeLockMemoryPrivilege	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3656 wrote to memory of 3904	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	84
PID 3656 wrote to memory of 3904	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	84
PID 3656 wrote to memory of 4412	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	85
PID 3656 wrote to memory of 4412	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	85
PID 3656 wrote to memory of 5064	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	86
PID 3656 wrote to memory of 5064	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	86
PID 3656 wrote to memory of 2752	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	87
PID 3656 wrote to memory of 2752	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	87
PID 3656 wrote to memory of 384	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	88
PID 3656 wrote to memory of 384	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	88
PID 3656 wrote to memory of 1924	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	89
PID 3656 wrote to memory of 1924	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	89
PID 3656 wrote to memory of 5060	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	90
PID 3656 wrote to memory of 5060	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	90
PID 3656 wrote to memory of 3612	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	91
PID 3656 wrote to memory of 3612	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	91
PID 3656 wrote to memory of 2320	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	92
PID 3656 wrote to memory of 2320	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	92
PID 3656 wrote to memory of 3568	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	93
PID 3656 wrote to memory of 3568	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	93
PID 3656 wrote to memory of 3616	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	94
PID 3656 wrote to memory of 3616	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	94
PID 3656 wrote to memory of 1012	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	95
PID 3656 wrote to memory of 1012	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	95
PID 3656 wrote to memory of 2456	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	96
PID 3656 wrote to memory of 2456	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	96
PID 3656 wrote to memory of 4676	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	97
PID 3656 wrote to memory of 4676	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	97
PID 3656 wrote to memory of 3096	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	98
PID 3656 wrote to memory of 3096	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	98
PID 3656 wrote to memory of 540	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	99
PID 3656 wrote to memory of 540	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	99
PID 3656 wrote to memory of 4716	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	100
PID 3656 wrote to memory of 4716	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	100
PID 3656 wrote to memory of 4432	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	101
PID 3656 wrote to memory of 4432	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	101
PID 3656 wrote to memory of 924	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	102
PID 3656 wrote to memory of 924	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	102
PID 3656 wrote to memory of 224	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	103
PID 3656 wrote to memory of 224	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	103
PID 3656 wrote to memory of 1948	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	104
PID 3656 wrote to memory of 1948	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	104
PID 3656 wrote to memory of 1620	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	105
PID 3656 wrote to memory of 1620	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	105
PID 3656 wrote to memory of 1452	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	106
PID 3656 wrote to memory of 1452	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	106
PID 3656 wrote to memory of 4084	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	107
PID 3656 wrote to memory of 4084	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	107
PID 3656 wrote to memory of 3192	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	108
PID 3656 wrote to memory of 3192	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	108
PID 3656 wrote to memory of 2380	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	109
PID 3656 wrote to memory of 2380	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	109
PID 3656 wrote to memory of 4620	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	110
PID 3656 wrote to memory of 4620	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	110
PID 3656 wrote to memory of 3772	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	111
PID 3656 wrote to memory of 3772	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	111
PID 3656 wrote to memory of 3652	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	112
PID 3656 wrote to memory of 3652	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	112
PID 3656 wrote to memory of 1852	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	113
PID 3656 wrote to memory of 1852	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	113
PID 3656 wrote to memory of 3500	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	114
PID 3656 wrote to memory of 3500	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	114
PID 3656 wrote to memory of 4992	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	115
PID 3656 wrote to memory of 4992	3656	0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0fe4d3b007fe17b20efe4fb4025035d3_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3904
- C:\Windows\System\fHtOxQN.exe
  C:\Windows\System\fHtOxQN.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\rejZTMH.exe
  C:\Windows\System\rejZTMH.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\GLcUkto.exe
  C:\Windows\System\GLcUkto.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\TbaJgow.exe
  C:\Windows\System\TbaJgow.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\EYiQZDJ.exe
  C:\Windows\System\EYiQZDJ.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\lBXDwhQ.exe
  C:\Windows\System\lBXDwhQ.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\pKpwMur.exe
  C:\Windows\System\pKpwMur.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\chmNPnl.exe
  C:\Windows\System\chmNPnl.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\dfOgFCD.exe
  C:\Windows\System\dfOgFCD.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\MVgAaFM.exe
  C:\Windows\System\MVgAaFM.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\xKdyqDF.exe
  C:\Windows\System\xKdyqDF.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\xqhVDGP.exe
  C:\Windows\System\xqhVDGP.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\RPYsVxd.exe
  C:\Windows\System\RPYsVxd.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\WWKMlVa.exe
  C:\Windows\System\WWKMlVa.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\HHUslmU.exe
  C:\Windows\System\HHUslmU.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\ftVterq.exe
  C:\Windows\System\ftVterq.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\BURPkgT.exe
  C:\Windows\System\BURPkgT.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\yWlQDTZ.exe
  C:\Windows\System\yWlQDTZ.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\cTqaqqh.exe
  C:\Windows\System\cTqaqqh.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\MXPwaJj.exe
  C:\Windows\System\MXPwaJj.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\duueKAr.exe
  C:\Windows\System\duueKAr.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\JxGQddN.exe
  C:\Windows\System\JxGQddN.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\DZnYFBp.exe
  C:\Windows\System\DZnYFBp.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\NPrXYab.exe
  C:\Windows\System\NPrXYab.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\ItFOkkM.exe
  C:\Windows\System\ItFOkkM.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\GXNSpvX.exe
  C:\Windows\System\GXNSpvX.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\UDZzSVc.exe
  C:\Windows\System\UDZzSVc.exe
  2⤵
  - Executes dropped EXE
  PID:3772
- C:\Windows\System\icZLekI.exe
  C:\Windows\System\icZLekI.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\cUWAkdW.exe
  C:\Windows\System\cUWAkdW.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\CcdXIkf.exe
  C:\Windows\System\CcdXIkf.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\qzFTANz.exe
  C:\Windows\System\qzFTANz.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\ZnUjFHt.exe
  C:\Windows\System\ZnUjFHt.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\zcmViPg.exe
  C:\Windows\System\zcmViPg.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\ABDavOX.exe
  C:\Windows\System\ABDavOX.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\kGrBevN.exe
  C:\Windows\System\kGrBevN.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\cEaMSkc.exe
  C:\Windows\System\cEaMSkc.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\rTRBdFo.exe
  C:\Windows\System\rTRBdFo.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\MaHubCc.exe
  C:\Windows\System\MaHubCc.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\vmgrWsr.exe
  C:\Windows\System\vmgrWsr.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\CHRMyOX.exe
  C:\Windows\System\CHRMyOX.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\lOysyFn.exe
  C:\Windows\System\lOysyFn.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\dAVKMOW.exe
  C:\Windows\System\dAVKMOW.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System\SFZFpoY.exe
  C:\Windows\System\SFZFpoY.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\PVJegxF.exe
  C:\Windows\System\PVJegxF.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\GlsfxfB.exe
  C:\Windows\System\GlsfxfB.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\TRtSnHC.exe
  C:\Windows\System\TRtSnHC.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\Ymxxhlg.exe
  C:\Windows\System\Ymxxhlg.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\NzXknza.exe
  C:\Windows\System\NzXknza.exe
  2⤵
  - Executes dropped EXE
  PID:516
- C:\Windows\System\WKeUDYo.exe
  C:\Windows\System\WKeUDYo.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\hVgBzdX.exe
  C:\Windows\System\hVgBzdX.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\aBZAtCF.exe
  C:\Windows\System\aBZAtCF.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\WBWGEKP.exe
  C:\Windows\System\WBWGEKP.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\evvdtkc.exe
  C:\Windows\System\evvdtkc.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\ptVRmWL.exe
  C:\Windows\System\ptVRmWL.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\njaHWhR.exe
  C:\Windows\System\njaHWhR.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\xZhHCSa.exe
  C:\Windows\System\xZhHCSa.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\rAHRygZ.exe
  C:\Windows\System\rAHRygZ.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\oDEhpCh.exe
  C:\Windows\System\oDEhpCh.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\rrLqPXn.exe
  C:\Windows\System\rrLqPXn.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\IPmDwEf.exe
  C:\Windows\System\IPmDwEf.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\DPcbULH.exe
  C:\Windows\System\DPcbULH.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\pGXFNJS.exe
  C:\Windows\System\pGXFNJS.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\riNGrhx.exe
  C:\Windows\System\riNGrhx.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\FLIMdda.exe
  C:\Windows\System\FLIMdda.exe
  2⤵
  - Executes dropped EXE
  PID:3872
- C:\Windows\System\HvDRxMt.exe
  C:\Windows\System\HvDRxMt.exe
  2⤵
  PID:1372
- C:\Windows\System\vmKhTud.exe
  C:\Windows\System\vmKhTud.exe
  2⤵
  PID:3484
- C:\Windows\System\hoUftfX.exe
  C:\Windows\System\hoUftfX.exe
  2⤵
  PID:4320
- C:\Windows\System\cbpHeOv.exe
  C:\Windows\System\cbpHeOv.exe
  2⤵
  PID:5152
- C:\Windows\System\svCSYkD.exe
  C:\Windows\System\svCSYkD.exe
  2⤵
  PID:5176
- C:\Windows\System\qAvdUNF.exe
  C:\Windows\System\qAvdUNF.exe
  2⤵
  PID:5204
- C:\Windows\System\UiTstfZ.exe
  C:\Windows\System\UiTstfZ.exe
  2⤵
  PID:5236
- C:\Windows\System\Ywgbvun.exe
  C:\Windows\System\Ywgbvun.exe
  2⤵
  PID:5264
- C:\Windows\System\pLozGLD.exe
  C:\Windows\System\pLozGLD.exe
  2⤵
  PID:5288
- C:\Windows\System\cKmyIzN.exe
  C:\Windows\System\cKmyIzN.exe
  2⤵
  PID:5316
- C:\Windows\System\hdzAwLL.exe
  C:\Windows\System\hdzAwLL.exe
  2⤵
  PID:5344
- C:\Windows\System\JsALWxR.exe
  C:\Windows\System\JsALWxR.exe
  2⤵
  PID:5372
- C:\Windows\System\pOSYtPV.exe
  C:\Windows\System\pOSYtPV.exe
  2⤵
  PID:5400
- C:\Windows\System\ZPVFMMJ.exe
  C:\Windows\System\ZPVFMMJ.exe
  2⤵
  PID:5432
- C:\Windows\System\JVwtFtA.exe
  C:\Windows\System\JVwtFtA.exe
  2⤵
  PID:5460
- C:\Windows\System\NgkeBaf.exe
  C:\Windows\System\NgkeBaf.exe
  2⤵
  PID:5492
- C:\Windows\System\RGJAzzO.exe
  C:\Windows\System\RGJAzzO.exe
  2⤵
  PID:5516
- C:\Windows\System\YRkOhkw.exe
  C:\Windows\System\YRkOhkw.exe
  2⤵
  PID:5544
- C:\Windows\System\IOYxqlI.exe
  C:\Windows\System\IOYxqlI.exe
  2⤵
  PID:5572
- C:\Windows\System\nfoGCjA.exe
  C:\Windows\System\nfoGCjA.exe
  2⤵
  PID:5600
- C:\Windows\System\rPwZSTe.exe
  C:\Windows\System\rPwZSTe.exe
  2⤵
  PID:5628
- C:\Windows\System\OWqkzLJ.exe
  C:\Windows\System\OWqkzLJ.exe
  2⤵
  PID:5656
- C:\Windows\System\UwbnNZI.exe
  C:\Windows\System\UwbnNZI.exe
  2⤵
  PID:5684
- C:\Windows\System\nJtoRdb.exe
  C:\Windows\System\nJtoRdb.exe
  2⤵
  PID:5712
- C:\Windows\System\JERowlA.exe
  C:\Windows\System\JERowlA.exe
  2⤵
  PID:5744
- C:\Windows\System\nrkjKCC.exe
  C:\Windows\System\nrkjKCC.exe
  2⤵
  PID:5796
- C:\Windows\System\QaYEflo.exe
  C:\Windows\System\QaYEflo.exe
  2⤵
  PID:5820
- C:\Windows\System\bxJEyfe.exe
  C:\Windows\System\bxJEyfe.exe
  2⤵
  PID:5836
- C:\Windows\System\qqDimKb.exe
  C:\Windows\System\qqDimKb.exe
  2⤵
  PID:5860
- C:\Windows\System\DxBrbXi.exe
  C:\Windows\System\DxBrbXi.exe
  2⤵
  PID:5892
- C:\Windows\System\gDqezbK.exe
  C:\Windows\System\gDqezbK.exe
  2⤵
  PID:5920
- C:\Windows\System\xsdZFVr.exe
  C:\Windows\System\xsdZFVr.exe
  2⤵
  PID:5944
- C:\Windows\System\CCYOhjU.exe
  C:\Windows\System\CCYOhjU.exe
  2⤵
  PID:5976
- C:\Windows\System\HNnUENz.exe
  C:\Windows\System\HNnUENz.exe
  2⤵
  PID:5996
- C:\Windows\System\HYfSICC.exe
  C:\Windows\System\HYfSICC.exe
  2⤵
  PID:6024
- C:\Windows\System\PTwHVpg.exe
  C:\Windows\System\PTwHVpg.exe
  2⤵
  PID:6048
- C:\Windows\System\VvsvDhh.exe
  C:\Windows\System\VvsvDhh.exe
  2⤵
  PID:6080
- C:\Windows\System\QjKWeNZ.exe
  C:\Windows\System\QjKWeNZ.exe
  2⤵
  PID:6108
- C:\Windows\System\UeMmVzo.exe
  C:\Windows\System\UeMmVzo.exe
  2⤵
  PID:6132
- C:\Windows\System\NCENCuW.exe
  C:\Windows\System\NCENCuW.exe
  2⤵
  PID:2420
- C:\Windows\System\xOrGhvJ.exe
  C:\Windows\System\xOrGhvJ.exe
  2⤵
  PID:1128
- C:\Windows\System\bmnYSwG.exe
  C:\Windows\System\bmnYSwG.exe
  2⤵
  PID:4508
- C:\Windows\System\IqLrmLl.exe
  C:\Windows\System\IqLrmLl.exe
  2⤵
  PID:4188
- C:\Windows\System\gLBMKCG.exe
  C:\Windows\System\gLBMKCG.exe
  2⤵
  PID:1644
- C:\Windows\System\qdrCeuS.exe
  C:\Windows\System\qdrCeuS.exe
  2⤵
  PID:5160
- C:\Windows\System\okyHFPg.exe
  C:\Windows\System\okyHFPg.exe
  2⤵
  PID:5216
- C:\Windows\System\YDRQZEA.exe
  C:\Windows\System\YDRQZEA.exe
  2⤵
  PID:5284
- C:\Windows\System\xrRpBRL.exe
  C:\Windows\System\xrRpBRL.exe
  2⤵
  PID:5360
- C:\Windows\System\WaNmqHg.exe
  C:\Windows\System\WaNmqHg.exe
  2⤵
  PID:5420
- C:\Windows\System\bkHydHo.exe
  C:\Windows\System\bkHydHo.exe
  2⤵
  PID:5500
- C:\Windows\System\aPbldeZ.exe
  C:\Windows\System\aPbldeZ.exe
  2⤵
  PID:5564
- C:\Windows\System\EpnMkkl.exe
  C:\Windows\System\EpnMkkl.exe
  2⤵
  PID:5616
- C:\Windows\System\uVtAoyT.exe
  C:\Windows\System\uVtAoyT.exe
  2⤵
  PID:5696
- C:\Windows\System\pZtOMAI.exe
  C:\Windows\System\pZtOMAI.exe
  2⤵
  PID:5760
- C:\Windows\System\FbMNEkC.exe
  C:\Windows\System\FbMNEkC.exe
  2⤵
  PID:5828
- C:\Windows\System\wrLmQWj.exe
  C:\Windows\System\wrLmQWj.exe
  2⤵
  PID:5880
- C:\Windows\System\GAdmsmT.exe
  C:\Windows\System\GAdmsmT.exe
  2⤵
  PID:5936
- C:\Windows\System\iBeihvI.exe
  C:\Windows\System\iBeihvI.exe
  2⤵
  PID:6008
- C:\Windows\System\ZAgUPWm.exe
  C:\Windows\System\ZAgUPWm.exe
  2⤵
  PID:6068
- C:\Windows\System\TlcASgA.exe
  C:\Windows\System\TlcASgA.exe
  2⤵
  PID:6124
- C:\Windows\System\iRikfdq.exe
  C:\Windows\System\iRikfdq.exe
  2⤵
  PID:3928
- C:\Windows\System\oIVdfqY.exe
  C:\Windows\System\oIVdfqY.exe
  2⤵
  PID:4416
- C:\Windows\System\klerJLF.exe
  C:\Windows\System\klerJLF.exe
  2⤵
  PID:428
- C:\Windows\System\DScFcqM.exe
  C:\Windows\System\DScFcqM.exe
  2⤵
  PID:5256
- C:\Windows\System\tApfowq.exe
  C:\Windows\System\tApfowq.exe
  2⤵
  PID:5356
- C:\Windows\System\qBehpCa.exe
  C:\Windows\System\qBehpCa.exe
  2⤵
  PID:5532
- C:\Windows\System\EltDPjN.exe
  C:\Windows\System\EltDPjN.exe
  2⤵
  PID:5648
- C:\Windows\System\KhTHlPg.exe
  C:\Windows\System\KhTHlPg.exe
  2⤵
  PID:5764
- C:\Windows\System\QlIkaOQ.exe
  C:\Windows\System\QlIkaOQ.exe
  2⤵
  PID:5912
- C:\Windows\System\topHfsH.exe
  C:\Windows\System\topHfsH.exe
  2⤵
  PID:6040
- C:\Windows\System\aPQPBMw.exe
  C:\Windows\System\aPQPBMw.exe
  2⤵
  PID:5048
- C:\Windows\System\DbYjEDM.exe
  C:\Windows\System\DbYjEDM.exe
  2⤵
  PID:5244
- C:\Windows\System\vgOMfTn.exe
  C:\Windows\System\vgOMfTn.exe
  2⤵
  PID:5328
- C:\Windows\System\xWaIBDo.exe
  C:\Windows\System\xWaIBDo.exe
  2⤵
  PID:6148
- C:\Windows\System\VUPXowr.exe
  C:\Windows\System\VUPXowr.exe
  2⤵
  PID:6180
- C:\Windows\System\nLFAWoU.exe
  C:\Windows\System\nLFAWoU.exe
  2⤵
  PID:6204
- C:\Windows\System\NRVVPyj.exe
  C:\Windows\System\NRVVPyj.exe
  2⤵
  PID:6232
- C:\Windows\System\UbfZAmK.exe
  C:\Windows\System\UbfZAmK.exe
  2⤵
  PID:6260
- C:\Windows\System\lAvlVnl.exe
  C:\Windows\System\lAvlVnl.exe
  2⤵
  PID:6288
- C:\Windows\System\EiMaDjo.exe
  C:\Windows\System\EiMaDjo.exe
  2⤵
  PID:6316
- C:\Windows\System\rtrLdWO.exe
  C:\Windows\System\rtrLdWO.exe
  2⤵
  PID:6344
- C:\Windows\System\vPnloHH.exe
  C:\Windows\System\vPnloHH.exe
  2⤵
  PID:6372
- C:\Windows\System\UoCggea.exe
  C:\Windows\System\UoCggea.exe
  2⤵
  PID:6400
- C:\Windows\System\oqBVatS.exe
  C:\Windows\System\oqBVatS.exe
  2⤵
  PID:6428
- C:\Windows\System\djctksY.exe
  C:\Windows\System\djctksY.exe
  2⤵
  PID:6452
- C:\Windows\System\CAubtRb.exe
  C:\Windows\System\CAubtRb.exe
  2⤵
  PID:6480
- C:\Windows\System\PgGMqiX.exe
  C:\Windows\System\PgGMqiX.exe
  2⤵
  PID:6508
- C:\Windows\System\myPCQJV.exe
  C:\Windows\System\myPCQJV.exe
  2⤵
  PID:6540
- C:\Windows\System\BsFrllU.exe
  C:\Windows\System\BsFrllU.exe
  2⤵
  PID:6564
- C:\Windows\System\zXklFaR.exe
  C:\Windows\System\zXklFaR.exe
  2⤵
  PID:6596
- C:\Windows\System\UNkSZPX.exe
  C:\Windows\System\UNkSZPX.exe
  2⤵
  PID:6620
- C:\Windows\System\XXYkZZK.exe
  C:\Windows\System\XXYkZZK.exe
  2⤵
  PID:6652
- C:\Windows\System\xkOdqlX.exe
  C:\Windows\System\xkOdqlX.exe
  2⤵
  PID:6676
- C:\Windows\System\bchinBH.exe
  C:\Windows\System\bchinBH.exe
  2⤵
  PID:6704
- C:\Windows\System\gQaoCxG.exe
  C:\Windows\System\gQaoCxG.exe
  2⤵
  PID:6732
- C:\Windows\System\eIYOHAV.exe
  C:\Windows\System\eIYOHAV.exe
  2⤵
  PID:6764
- C:\Windows\System\fOhhJDl.exe
  C:\Windows\System\fOhhJDl.exe
  2⤵
  PID:6788
- C:\Windows\System\yssDHFF.exe
  C:\Windows\System\yssDHFF.exe
  2⤵
  PID:6820
- C:\Windows\System\nBVAHmK.exe
  C:\Windows\System\nBVAHmK.exe
  2⤵
  PID:6848
- C:\Windows\System\hotkkyJ.exe
  C:\Windows\System\hotkkyJ.exe
  2⤵
  PID:6876
- C:\Windows\System\TMkOoui.exe
  C:\Windows\System\TMkOoui.exe
  2⤵
  PID:6900
- C:\Windows\System\WqYEWIc.exe
  C:\Windows\System\WqYEWIc.exe
  2⤵
  PID:6932
- C:\Windows\System\vMzMLFZ.exe
  C:\Windows\System\vMzMLFZ.exe
  2⤵
  PID:6960
- C:\Windows\System\RcwTVMA.exe
  C:\Windows\System\RcwTVMA.exe
  2⤵
  PID:6988
- C:\Windows\System\EgCrkZI.exe
  C:\Windows\System\EgCrkZI.exe
  2⤵
  PID:7016
- C:\Windows\System\aEtCpOt.exe
  C:\Windows\System\aEtCpOt.exe
  2⤵
  PID:7044
- C:\Windows\System\uatmOTN.exe
  C:\Windows\System\uatmOTN.exe
  2⤵
  PID:7068
- C:\Windows\System\zjYxfik.exe
  C:\Windows\System\zjYxfik.exe
  2⤵
  PID:7100
- C:\Windows\System\mcGNZmV.exe
  C:\Windows\System\mcGNZmV.exe
  2⤵
  PID:7124
- C:\Windows\System\PkJCnYj.exe
  C:\Windows\System\PkJCnYj.exe
  2⤵
  PID:7152
- C:\Windows\System\vAYZROp.exe
  C:\Windows\System\vAYZROp.exe
  2⤵
  PID:5672
- C:\Windows\System\Kgrqehb.exe
  C:\Windows\System\Kgrqehb.exe
  2⤵
  PID:5972
- C:\Windows\System\LgnzQJY.exe
  C:\Windows\System\LgnzQJY.exe
  2⤵
  PID:1456
- C:\Windows\System\ebsfeTh.exe
  C:\Windows\System\ebsfeTh.exe
  2⤵
  PID:5476
- C:\Windows\System\CtKLgLF.exe
  C:\Windows\System\CtKLgLF.exe
  2⤵
  PID:6196
- C:\Windows\System\BaklgSP.exe
  C:\Windows\System\BaklgSP.exe
  2⤵
  PID:6252
- C:\Windows\System\ynzQVVI.exe
  C:\Windows\System\ynzQVVI.exe
  2⤵
  PID:6308
- C:\Windows\System\snArDuu.exe
  C:\Windows\System\snArDuu.exe
  2⤵
  PID:6364
- C:\Windows\System\qMJBTys.exe
  C:\Windows\System\qMJBTys.exe
  2⤵
  PID:6420
- C:\Windows\System\msWqcXw.exe
  C:\Windows\System\msWqcXw.exe
  2⤵
  PID:1940
- C:\Windows\System\qZXtnIK.exe
  C:\Windows\System\qZXtnIK.exe
  2⤵
  PID:1436
- C:\Windows\System\BCsovei.exe
  C:\Windows\System\BCsovei.exe
  2⤵
  PID:2916
- C:\Windows\System\DVfCFHl.exe
  C:\Windows\System\DVfCFHl.exe
  2⤵
  PID:6668
- C:\Windows\System\MEZrkFm.exe
  C:\Windows\System\MEZrkFm.exe
  2⤵
  PID:6696
- C:\Windows\System\tveJcdY.exe
  C:\Windows\System\tveJcdY.exe
  2⤵
  PID:6752
- C:\Windows\System\sMPmpCn.exe
  C:\Windows\System\sMPmpCn.exe
  2⤵
  PID:6832
- C:\Windows\System\AZemJIh.exe
  C:\Windows\System\AZemJIh.exe
  2⤵
  PID:6920
- C:\Windows\System\JgpoJQt.exe
  C:\Windows\System\JgpoJQt.exe
  2⤵
  PID:6952
- C:\Windows\System\tqFLMIY.exe
  C:\Windows\System\tqFLMIY.exe
  2⤵
  PID:7000
- C:\Windows\System\FRwOxDq.exe
  C:\Windows\System\FRwOxDq.exe
  2⤵
  PID:7028
- C:\Windows\System\HqLzTAb.exe
  C:\Windows\System\HqLzTAb.exe
  2⤵
  PID:7060
- C:\Windows\System\LhbycLR.exe
  C:\Windows\System\LhbycLR.exe
  2⤵
  PID:920
- C:\Windows\System\QfuDdSI.exe
  C:\Windows\System\QfuDdSI.exe
  2⤵
  PID:3360
- C:\Windows\System\qKDHnDD.exe
  C:\Windows\System\qKDHnDD.exe
  2⤵
  PID:7120
- C:\Windows\System\CNMAucY.exe
  C:\Windows\System\CNMAucY.exe
  2⤵
  PID:5556
- C:\Windows\System\fFAikFw.exe
  C:\Windows\System\fFAikFw.exe
  2⤵
  PID:6120
- C:\Windows\System\zuHkkLY.exe
  C:\Windows\System\zuHkkLY.exe
  2⤵
  PID:6176
- C:\Windows\System\VxrrTFv.exe
  C:\Windows\System\VxrrTFv.exe
  2⤵
  PID:432
- C:\Windows\System\JSQyLbv.exe
  C:\Windows\System\JSQyLbv.exe
  2⤵
  PID:6448
- C:\Windows\System\voaMKmN.exe
  C:\Windows\System\voaMKmN.exe
  2⤵
  PID:3108
- C:\Windows\System\JgiSUjV.exe
  C:\Windows\System\JgiSUjV.exe
  2⤵
  PID:2924
- C:\Windows\System\wkEYowL.exe
  C:\Windows\System\wkEYowL.exe
  2⤵
  PID:2276
- C:\Windows\System\nseUZWm.exe
  C:\Windows\System\nseUZWm.exe
  2⤵
  PID:1172
- C:\Windows\System\SoSbqZk.exe
  C:\Windows\System\SoSbqZk.exe
  2⤵
  PID:628
- C:\Windows\System\cShRscL.exe
  C:\Windows\System\cShRscL.exe
  2⤵
  PID:6640
- C:\Windows\System\hmYgaPN.exe
  C:\Windows\System\hmYgaPN.exe
  2⤵
  PID:6840
- C:\Windows\System\AmZpgNj.exe
  C:\Windows\System\AmZpgNj.exe
  2⤵
  PID:4876
- C:\Windows\System\HmIwGnk.exe
  C:\Windows\System\HmIwGnk.exe
  2⤵
  PID:7032
- C:\Windows\System\DnJhMqG.exe
  C:\Windows\System\DnJhMqG.exe
  2⤵
  PID:756
- C:\Windows\System\wVMdIvt.exe
  C:\Windows\System\wVMdIvt.exe
  2⤵
  PID:7084
- C:\Windows\System\drYkPOA.exe
  C:\Windows\System\drYkPOA.exe
  2⤵
  PID:5416
- C:\Windows\System\hMXUZrf.exe
  C:\Windows\System\hMXUZrf.exe
  2⤵
  PID:6332
- C:\Windows\System\ayLySEe.exe
  C:\Windows\System\ayLySEe.exe
  2⤵
  PID:1488
- C:\Windows\System\QfljyEW.exe
  C:\Windows\System\QfljyEW.exe
  2⤵
  PID:5000
- C:\Windows\System\AsFAKeN.exe
  C:\Windows\System\AsFAKeN.exe
  2⤵
  PID:4372
- C:\Windows\System\dESXRTX.exe
  C:\Windows\System\dESXRTX.exe
  2⤵
  PID:6664
- C:\Windows\System\MmWkwVr.exe
  C:\Windows\System\MmWkwVr.exe
  2⤵
  PID:2572
- C:\Windows\System\wMPPjPJ.exe
  C:\Windows\System\wMPPjPJ.exe
  2⤵
  PID:5188
- C:\Windows\System\DTVoVmT.exe
  C:\Windows\System\DTVoVmT.exe
  2⤵
  PID:6472
- C:\Windows\System\aATtXZC.exe
  C:\Windows\System\aATtXZC.exe
  2⤵
  PID:5856
- C:\Windows\System\WQNCpGk.exe
  C:\Windows\System\WQNCpGk.exe
  2⤵
  PID:7172
- C:\Windows\System\OzuHcfD.exe
  C:\Windows\System\OzuHcfD.exe
  2⤵
  PID:7196
- C:\Windows\System\yBwCpgB.exe
  C:\Windows\System\yBwCpgB.exe
  2⤵
  PID:7216
- C:\Windows\System\weCoTCU.exe
  C:\Windows\System\weCoTCU.exe
  2⤵
  PID:7252
- C:\Windows\System\pTZtade.exe
  C:\Windows\System\pTZtade.exe
  2⤵
  PID:7268
- C:\Windows\System\ubymSTY.exe
  C:\Windows\System\ubymSTY.exe
  2⤵
  PID:7300
- C:\Windows\System\AHZQGnU.exe
  C:\Windows\System\AHZQGnU.exe
  2⤵
  PID:7348
- C:\Windows\System\hitpyLG.exe
  C:\Windows\System\hitpyLG.exe
  2⤵
  PID:7372
- C:\Windows\System\RjkOTjg.exe
  C:\Windows\System\RjkOTjg.exe
  2⤵
  PID:7396
- C:\Windows\System\gdUGXDL.exe
  C:\Windows\System\gdUGXDL.exe
  2⤵
  PID:7420
- C:\Windows\System\oHlyPBg.exe
  C:\Windows\System\oHlyPBg.exe
  2⤵
  PID:7440
- C:\Windows\System\pdKoxPb.exe
  C:\Windows\System\pdKoxPb.exe
  2⤵
  PID:7484
- C:\Windows\System\iqPQrQl.exe
  C:\Windows\System\iqPQrQl.exe
  2⤵
  PID:7500
- C:\Windows\System\Vqsssbz.exe
  C:\Windows\System\Vqsssbz.exe
  2⤵
  PID:7548
- C:\Windows\System\YQyqVtU.exe
  C:\Windows\System\YQyqVtU.exe
  2⤵
  PID:7568
- C:\Windows\System\arLbFSL.exe
  C:\Windows\System\arLbFSL.exe
  2⤵
  PID:7592
- C:\Windows\System\LcAevfK.exe
  C:\Windows\System\LcAevfK.exe
  2⤵
  PID:7616
- C:\Windows\System\cdRYJMk.exe
  C:\Windows\System\cdRYJMk.exe
  2⤵
  PID:7636
- C:\Windows\System\HCKBmew.exe
  C:\Windows\System\HCKBmew.exe
  2⤵
  PID:7660
- C:\Windows\System\ftXlsfe.exe
  C:\Windows\System\ftXlsfe.exe
  2⤵
  PID:7692
- C:\Windows\System\CRKsQON.exe
  C:\Windows\System\CRKsQON.exe
  2⤵
  PID:7712
- C:\Windows\System\ZWaqdEt.exe
  C:\Windows\System\ZWaqdEt.exe
  2⤵
  PID:7744
- C:\Windows\System\cncwSIf.exe
  C:\Windows\System\cncwSIf.exe
  2⤵
  PID:7792
- C:\Windows\System\BxiafWn.exe
  C:\Windows\System\BxiafWn.exe
  2⤵
  PID:7816
- C:\Windows\System\VcPbSxD.exe
  C:\Windows\System\VcPbSxD.exe
  2⤵
  PID:7864
- C:\Windows\System\QAEGQrv.exe
  C:\Windows\System\QAEGQrv.exe
  2⤵
  PID:7892
- C:\Windows\System\xNXxpRP.exe
  C:\Windows\System\xNXxpRP.exe
  2⤵
  PID:7912
- C:\Windows\System\KClNRRu.exe
  C:\Windows\System\KClNRRu.exe
  2⤵
  PID:7932
- C:\Windows\System\cBKbvCJ.exe
  C:\Windows\System\cBKbvCJ.exe
  2⤵
  PID:7960
- C:\Windows\System\LVPfbhY.exe
  C:\Windows\System\LVPfbhY.exe
  2⤵
  PID:7980
- C:\Windows\System\ZrJAIVb.exe
  C:\Windows\System\ZrJAIVb.exe
  2⤵
  PID:8004
- C:\Windows\System\cWTesoe.exe
  C:\Windows\System\cWTesoe.exe
  2⤵
  PID:8028
- C:\Windows\System\TWVyQTn.exe
  C:\Windows\System\TWVyQTn.exe
  2⤵
  PID:8056
- C:\Windows\System\ZwqAION.exe
  C:\Windows\System\ZwqAION.exe
  2⤵
  PID:8084
- C:\Windows\System\jKezCmb.exe
  C:\Windows\System\jKezCmb.exe
  2⤵
  PID:8100
- C:\Windows\System\SSfkbbc.exe
  C:\Windows\System\SSfkbbc.exe
  2⤵
  PID:8116
- C:\Windows\System\Alqzrow.exe
  C:\Windows\System\Alqzrow.exe
  2⤵
  PID:8172
- C:\Windows\System\apEtuBD.exe
  C:\Windows\System\apEtuBD.exe
  2⤵
  PID:7208
- C:\Windows\System\oSocTju.exe
  C:\Windows\System\oSocTju.exe
  2⤵
  PID:7192
- C:\Windows\System\fzqvmBv.exe
  C:\Windows\System\fzqvmBv.exe
  2⤵
  PID:7280
- C:\Windows\System\BKnaROv.exe
  C:\Windows\System\BKnaROv.exe
  2⤵
  PID:7380
- C:\Windows\System\yYJSAwF.exe
  C:\Windows\System\yYJSAwF.exe
  2⤵
  PID:7432
- C:\Windows\System\JorqkMe.exe
  C:\Windows\System\JorqkMe.exe
  2⤵
  PID:7540
- C:\Windows\System\xDJPBAK.exe
  C:\Windows\System\xDJPBAK.exe
  2⤵
  PID:7576
- C:\Windows\System\JGzEaqB.exe
  C:\Windows\System\JGzEaqB.exe
  2⤵
  PID:7632
- C:\Windows\System\KyYBcie.exe
  C:\Windows\System\KyYBcie.exe
  2⤵
  PID:7752
- C:\Windows\System\LvoyBLJ.exe
  C:\Windows\System\LvoyBLJ.exe
  2⤵
  PID:7784
- C:\Windows\System\lWsJseT.exe
  C:\Windows\System\lWsJseT.exe
  2⤵
  PID:7780
- C:\Windows\System\TxdBnai.exe
  C:\Windows\System\TxdBnai.exe
  2⤵
  PID:7900
- C:\Windows\System\cfasqui.exe
  C:\Windows\System\cfasqui.exe
  2⤵
  PID:7976
- C:\Windows\System\xfypqdv.exe
  C:\Windows\System\xfypqdv.exe
  2⤵
  PID:8064
- C:\Windows\System\EvjlKkp.exe
  C:\Windows\System\EvjlKkp.exe
  2⤵
  PID:8020
- C:\Windows\System\BqDqKSC.exe
  C:\Windows\System\BqDqKSC.exe
  2⤵
  PID:8164
- C:\Windows\System\zGGFrYt.exe
  C:\Windows\System\zGGFrYt.exe
  2⤵
  PID:7296
- C:\Windows\System\gGxzAhe.exe
  C:\Windows\System\gGxzAhe.exe
  2⤵
  PID:7516
- C:\Windows\System\kZoagDE.exe
  C:\Windows\System\kZoagDE.exe
  2⤵
  PID:7736
- C:\Windows\System\OWFLDPd.exe
  C:\Windows\System\OWFLDPd.exe
  2⤵
  PID:7668
- C:\Windows\System\hiQhdYf.exe
  C:\Windows\System\hiQhdYf.exe
  2⤵
  PID:7928
- C:\Windows\System\sKIfmLH.exe
  C:\Windows\System\sKIfmLH.exe
  2⤵
  PID:8012
- C:\Windows\System\oCIINRo.exe
  C:\Windows\System\oCIINRo.exe
  2⤵
  PID:8112
- C:\Windows\System\jfqQsTB.exe
  C:\Windows\System\jfqQsTB.exe
  2⤵
  PID:7852
- C:\Windows\System\UqNvjNE.exe
  C:\Windows\System\UqNvjNE.exe
  2⤵
  PID:8068
- C:\Windows\System\TIcnEzt.exe
  C:\Windows\System\TIcnEzt.exe
  2⤵
  PID:7360
- C:\Windows\System\bQcUNQG.exe
  C:\Windows\System\bQcUNQG.exe
  2⤵
  PID:8224
- C:\Windows\System\PnZLxhM.exe
  C:\Windows\System\PnZLxhM.exe
  2⤵
  PID:8252
- C:\Windows\System\GeNvEfY.exe
  C:\Windows\System\GeNvEfY.exe
  2⤵
  PID:8272
- C:\Windows\System\JxUFQvD.exe
  C:\Windows\System\JxUFQvD.exe
  2⤵
  PID:8292
- C:\Windows\System\CSRrKOr.exe
  C:\Windows\System\CSRrKOr.exe
  2⤵
  PID:8320
- C:\Windows\System\YnjdfZV.exe
  C:\Windows\System\YnjdfZV.exe
  2⤵
  PID:8368
- C:\Windows\System\ddyyZBY.exe
  C:\Windows\System\ddyyZBY.exe
  2⤵
  PID:8384
- C:\Windows\System\DYqLBRY.exe
  C:\Windows\System\DYqLBRY.exe
  2⤵
  PID:8404
- C:\Windows\System\VkzEgwu.exe
  C:\Windows\System\VkzEgwu.exe
  2⤵
  PID:8440
- C:\Windows\System\RUKwGch.exe
  C:\Windows\System\RUKwGch.exe
  2⤵
  PID:8468
- C:\Windows\System\LGBZzVd.exe
  C:\Windows\System\LGBZzVd.exe
  2⤵
  PID:8488
- C:\Windows\System\CTKqDkf.exe
  C:\Windows\System\CTKqDkf.exe
  2⤵
  PID:8512
- C:\Windows\System\wtnyjOz.exe
  C:\Windows\System\wtnyjOz.exe
  2⤵
  PID:8536
- C:\Windows\System\mkpBLzz.exe
  C:\Windows\System\mkpBLzz.exe
  2⤵
  PID:8560
- C:\Windows\System\oRtoWPU.exe
  C:\Windows\System\oRtoWPU.exe
  2⤵
  PID:8604
- C:\Windows\System\npfgWaP.exe
  C:\Windows\System\npfgWaP.exe
  2⤵
  PID:8628
- C:\Windows\System\HbZyVNy.exe
  C:\Windows\System\HbZyVNy.exe
  2⤵
  PID:8652
- C:\Windows\System\AuUoilt.exe
  C:\Windows\System\AuUoilt.exe
  2⤵
  PID:8672
- C:\Windows\System\junvZrv.exe
  C:\Windows\System\junvZrv.exe
  2⤵
  PID:8692
- C:\Windows\System\DnPUJTW.exe
  C:\Windows\System\DnPUJTW.exe
  2⤵
  PID:8716
- C:\Windows\System\HpNksgf.exe
  C:\Windows\System\HpNksgf.exe
  2⤵
  PID:8736
- C:\Windows\System\fLDdBNV.exe
  C:\Windows\System\fLDdBNV.exe
  2⤵
  PID:8768
- C:\Windows\System\ErQTcNt.exe
  C:\Windows\System\ErQTcNt.exe
  2⤵
  PID:8812
- C:\Windows\System\NsvCBZA.exe
  C:\Windows\System\NsvCBZA.exe
  2⤵
  PID:8856
- C:\Windows\System\cGMEPGx.exe
  C:\Windows\System\cGMEPGx.exe
  2⤵
  PID:8876
- C:\Windows\System\yMyvFGk.exe
  C:\Windows\System\yMyvFGk.exe
  2⤵
  PID:8912
- C:\Windows\System\vhhdiyv.exe
  C:\Windows\System\vhhdiyv.exe
  2⤵
  PID:8940
- C:\Windows\System\HdQcMMs.exe
  C:\Windows\System\HdQcMMs.exe
  2⤵
  PID:8968
- C:\Windows\System\bUMFnpG.exe
  C:\Windows\System\bUMFnpG.exe
  2⤵
  PID:9000
- C:\Windows\System\raThoBh.exe
  C:\Windows\System\raThoBh.exe
  2⤵
  PID:9032
- C:\Windows\System\kXqitdx.exe
  C:\Windows\System\kXqitdx.exe
  2⤵
  PID:9052
- C:\Windows\System\JOHcTCp.exe
  C:\Windows\System\JOHcTCp.exe
  2⤵
  PID:9080
- C:\Windows\System\rLPiapx.exe
  C:\Windows\System\rLPiapx.exe
  2⤵
  PID:9124
- C:\Windows\System\PAQEwNf.exe
  C:\Windows\System\PAQEwNf.exe
  2⤵
  PID:9148
- C:\Windows\System\UKyGYuP.exe
  C:\Windows\System\UKyGYuP.exe
  2⤵
  PID:9164
- C:\Windows\System\GSrAPyL.exe
  C:\Windows\System\GSrAPyL.exe
  2⤵
  PID:9184
- C:\Windows\System\GAnADDM.exe
  C:\Windows\System\GAnADDM.exe
  2⤵
  PID:9212
- C:\Windows\System\NaKDPjH.exe
  C:\Windows\System\NaKDPjH.exe
  2⤵
  PID:8200
- C:\Windows\System\nzMPaDU.exe
  C:\Windows\System\nzMPaDU.exe
  2⤵
  PID:8268
- C:\Windows\System\UUPbEHU.exe
  C:\Windows\System\UUPbEHU.exe
  2⤵
  PID:8376
- C:\Windows\System\HhQsCXp.exe
  C:\Windows\System\HhQsCXp.exe
  2⤵
  PID:8480
- C:\Windows\System\hMCfCJm.exe
  C:\Windows\System\hMCfCJm.exe
  2⤵
  PID:8508
- C:\Windows\System\brwTzRS.exe
  C:\Windows\System\brwTzRS.exe
  2⤵
  PID:8600
- C:\Windows\System\FmGDqST.exe
  C:\Windows\System\FmGDqST.exe
  2⤵
  PID:8640
- C:\Windows\System\qzMUxid.exe
  C:\Windows\System\qzMUxid.exe
  2⤵
  PID:8700
- C:\Windows\System\tweuvyN.exe
  C:\Windows\System\tweuvyN.exe
  2⤵
  PID:8688
- C:\Windows\System\ryrFkvK.exe
  C:\Windows\System\ryrFkvK.exe
  2⤵
  PID:8840
- C:\Windows\System\dfgqydt.exe
  C:\Windows\System\dfgqydt.exe
  2⤵
  PID:8884
- C:\Windows\System\IzoMAzC.exe
  C:\Windows\System\IzoMAzC.exe
  2⤵
  PID:8952
- C:\Windows\System\zdhhasp.exe
  C:\Windows\System\zdhhasp.exe
  2⤵
  PID:8988
- C:\Windows\System\CJZcIRy.exe
  C:\Windows\System\CJZcIRy.exe
  2⤵
  PID:9044
- C:\Windows\System\twADSmj.exe
  C:\Windows\System\twADSmj.exe
  2⤵
  PID:9136
- C:\Windows\System\QqVhiZO.exe
  C:\Windows\System\QqVhiZO.exe
  2⤵
  PID:9156
- C:\Windows\System\QSKLOgl.exe
  C:\Windows\System\QSKLOgl.exe
  2⤵
  PID:8232
- C:\Windows\System\ReLwWtd.exe
  C:\Windows\System\ReLwWtd.exe
  2⤵
  PID:8412
- C:\Windows\System\KYWsxwV.exe
  C:\Windows\System\KYWsxwV.exe
  2⤵
  PID:8592
- C:\Windows\System\LtyaicD.exe
  C:\Windows\System\LtyaicD.exe
  2⤵
  PID:8728
- C:\Windows\System\sDertqt.exe
  C:\Windows\System\sDertqt.exe
  2⤵
  PID:9016
- C:\Windows\System\SMbVHpf.exe
  C:\Windows\System\SMbVHpf.exe
  2⤵
  PID:9176
- C:\Windows\System\NbTvHSc.exe
  C:\Windows\System\NbTvHSc.exe
  2⤵
  PID:8264
- C:\Windows\System\yyksNrU.exe
  C:\Windows\System\yyksNrU.exe
  2⤵
  PID:8456
- C:\Windows\System\PoUtmrL.exe
  C:\Windows\System\PoUtmrL.exe
  2⤵
  PID:9076
- C:\Windows\System\SRCljeg.exe
  C:\Windows\System\SRCljeg.exe
  2⤵
  PID:8524
- C:\Windows\System\GGBVEfA.exe
  C:\Windows\System\GGBVEfA.exe
  2⤵
  PID:9220
- C:\Windows\System\XXykyox.exe
  C:\Windows\System\XXykyox.exe
  2⤵
  PID:9240
- C:\Windows\System\SnPldMM.exe
  C:\Windows\System\SnPldMM.exe
  2⤵
  PID:9280
- C:\Windows\System\tZVjpcQ.exe
  C:\Windows\System\tZVjpcQ.exe
  2⤵
  PID:9300
- C:\Windows\System\xBxFuMU.exe
  C:\Windows\System\xBxFuMU.exe
  2⤵
  PID:9316
- C:\Windows\System\SAAhBOL.exe
  C:\Windows\System\SAAhBOL.exe
  2⤵
  PID:9340
- C:\Windows\System\OCvlmXo.exe
  C:\Windows\System\OCvlmXo.exe
  2⤵
  PID:9360
- C:\Windows\System\pxeQFPe.exe
  C:\Windows\System\pxeQFPe.exe
  2⤵
  PID:9416
- C:\Windows\System\cbCpMCu.exe
  C:\Windows\System\cbCpMCu.exe
  2⤵
  PID:9448
- C:\Windows\System\lWGMJby.exe
  C:\Windows\System\lWGMJby.exe
  2⤵
  PID:9468
- C:\Windows\System\OLXstNr.exe
  C:\Windows\System\OLXstNr.exe
  2⤵
  PID:9488
- C:\Windows\System\KPXKtcR.exe
  C:\Windows\System\KPXKtcR.exe
  2⤵
  PID:9536
- C:\Windows\System\lqXPlJg.exe
  C:\Windows\System\lqXPlJg.exe
  2⤵
  PID:9556
- C:\Windows\System\qOcKdeJ.exe
  C:\Windows\System\qOcKdeJ.exe
  2⤵
  PID:9584
- C:\Windows\System\mOtBosU.exe
  C:\Windows\System\mOtBosU.exe
  2⤵
  PID:9608
- C:\Windows\System\yeiHFiW.exe
  C:\Windows\System\yeiHFiW.exe
  2⤵
  PID:9656
- C:\Windows\System\xIvGKIc.exe
  C:\Windows\System\xIvGKIc.exe
  2⤵
  PID:9696
- C:\Windows\System\QGToEdD.exe
  C:\Windows\System\QGToEdD.exe
  2⤵
  PID:9712
- C:\Windows\System\cNUoVHB.exe
  C:\Windows\System\cNUoVHB.exe
  2⤵
  PID:9728
- C:\Windows\System\agbVYIc.exe
  C:\Windows\System\agbVYIc.exe
  2⤵
  PID:9744
- C:\Windows\System\oIpcWKL.exe
  C:\Windows\System\oIpcWKL.exe
  2⤵
  PID:9784
- C:\Windows\System\uXLNIxd.exe
  C:\Windows\System\uXLNIxd.exe
  2⤵
  PID:9868
- C:\Windows\System\jcIfxaw.exe
  C:\Windows\System\jcIfxaw.exe
  2⤵
  PID:9904
- C:\Windows\System\xVIDHFO.exe
  C:\Windows\System\xVIDHFO.exe
  2⤵
  PID:9928
- C:\Windows\System\UONjMKp.exe
  C:\Windows\System\UONjMKp.exe
  2⤵
  PID:9960
- C:\Windows\System\niDNhAv.exe
  C:\Windows\System\niDNhAv.exe
  2⤵
  PID:9980
- C:\Windows\System\QeteNzm.exe
  C:\Windows\System\QeteNzm.exe
  2⤵
  PID:10020
- C:\Windows\System\mFrFfmK.exe
  C:\Windows\System\mFrFfmK.exe
  2⤵
  PID:10044
- C:\Windows\System\FMOkwSp.exe
  C:\Windows\System\FMOkwSp.exe
  2⤵
  PID:10068
- C:\Windows\System\SlCUJEU.exe
  C:\Windows\System\SlCUJEU.exe
  2⤵
  PID:10092
- C:\Windows\System\mGWsTGY.exe
  C:\Windows\System\mGWsTGY.exe
  2⤵
  PID:10120
- C:\Windows\System\TQlcPUU.exe
  C:\Windows\System\TQlcPUU.exe
  2⤵
  PID:10156
- C:\Windows\System\fjALGyB.exe
  C:\Windows\System\fjALGyB.exe
  2⤵
  PID:10176
- C:\Windows\System\xQrGZss.exe
  C:\Windows\System\xQrGZss.exe
  2⤵
  PID:10224
- C:\Windows\System\tcCgYoo.exe
  C:\Windows\System\tcCgYoo.exe
  2⤵
  PID:8140
- C:\Windows\System\AZnFGEZ.exe
  C:\Windows\System\AZnFGEZ.exe
  2⤵
  PID:9268
- C:\Windows\System\WyAqyUS.exe
  C:\Windows\System\WyAqyUS.exe
  2⤵
  PID:9324
- C:\Windows\System\BdpmGLd.exe
  C:\Windows\System\BdpmGLd.exe
  2⤵
  PID:9332
- C:\Windows\System\dDYYhAo.exe
  C:\Windows\System\dDYYhAo.exe
  2⤵
  PID:9392
- C:\Windows\System\TxriuJL.exe
  C:\Windows\System\TxriuJL.exe
  2⤵
  PID:9456
- C:\Windows\System\XrIICCM.exe
  C:\Windows\System\XrIICCM.exe
  2⤵
  PID:9552
- C:\Windows\System\PywyIPq.exe
  C:\Windows\System\PywyIPq.exe
  2⤵
  PID:9652
- C:\Windows\System\bvEvnDz.exe
  C:\Windows\System\bvEvnDz.exe
  2⤵
  PID:9592
- C:\Windows\System\AGQvcru.exe
  C:\Windows\System\AGQvcru.exe
  2⤵
  PID:9708
- C:\Windows\System\hbugTiM.exe
  C:\Windows\System\hbugTiM.exe
  2⤵
  PID:9644
- C:\Windows\System\gtScFXh.exe
  C:\Windows\System\gtScFXh.exe
  2⤵
  PID:9808
- C:\Windows\System\VqKSqQU.exe
  C:\Windows\System\VqKSqQU.exe
  2⤵
  PID:9920
- C:\Windows\System\pseTAMi.exe
  C:\Windows\System\pseTAMi.exe
  2⤵
  PID:10000
- C:\Windows\System\qUQkOiy.exe
  C:\Windows\System\qUQkOiy.exe
  2⤵
  PID:10036
- C:\Windows\System\HAprqrb.exe
  C:\Windows\System\HAprqrb.exe
  2⤵
  PID:10084
- C:\Windows\System\KvcmlZC.exe
  C:\Windows\System\KvcmlZC.exe
  2⤵
  PID:10144
- C:\Windows\System\heVGgvR.exe
  C:\Windows\System\heVGgvR.exe
  2⤵
  PID:8660
- C:\Windows\System\iIiZByF.exe
  C:\Windows\System\iIiZByF.exe
  2⤵
  PID:9356
- C:\Windows\System\VXibiNc.exe
  C:\Windows\System\VXibiNc.exe
  2⤵
  PID:9404
- C:\Windows\System\ekyhcfs.exe
  C:\Windows\System\ekyhcfs.exe
  2⤵
  PID:9528
- C:\Windows\System\NHrmliL.exe
  C:\Windows\System\NHrmliL.exe
  2⤵
  PID:9548
- C:\Windows\System\iPBrSXB.exe
  C:\Windows\System\iPBrSXB.exe
  2⤵
  PID:10008
- C:\Windows\System\iBZiRzO.exe
  C:\Windows\System\iBZiRzO.exe
  2⤵
  PID:9900
- C:\Windows\System\USCpatK.exe
  C:\Windows\System\USCpatK.exe
  2⤵
  PID:9988
- C:\Windows\System\jXkBKgm.exe
  C:\Windows\System\jXkBKgm.exe
  2⤵
  PID:10148
- C:\Windows\System\pIkzKWP.exe
  C:\Windows\System\pIkzKWP.exe
  2⤵
  PID:9288
- C:\Windows\System\nzAqpAc.exe
  C:\Windows\System\nzAqpAc.exe
  2⤵
  PID:10220
- C:\Windows\System\etXSfQX.exe
  C:\Windows\System\etXSfQX.exe
  2⤵
  PID:9352
- C:\Windows\System\aOymjrl.exe
  C:\Windows\System\aOymjrl.exe
  2⤵
  PID:9824
- C:\Windows\System\buSBPDh.exe
  C:\Windows\System\buSBPDh.exe
  2⤵
  PID:10264
- C:\Windows\System\oytcQFn.exe
  C:\Windows\System\oytcQFn.exe
  2⤵
  PID:10284
- C:\Windows\System\UmVvxei.exe
  C:\Windows\System\UmVvxei.exe
  2⤵
  PID:10308
- C:\Windows\System\FHLxFPz.exe
  C:\Windows\System\FHLxFPz.exe
  2⤵
  PID:10332
- C:\Windows\System\MNfRibB.exe
  C:\Windows\System\MNfRibB.exe
  2⤵
  PID:10352
- C:\Windows\System\UzqFhBl.exe
  C:\Windows\System\UzqFhBl.exe
  2⤵
  PID:10376
- C:\Windows\System\lNzPXvR.exe
  C:\Windows\System\lNzPXvR.exe
  2⤵
  PID:10412
- C:\Windows\System\EPtVhtZ.exe
  C:\Windows\System\EPtVhtZ.exe
  2⤵
  PID:10440
- C:\Windows\System\YgKqgyM.exe
  C:\Windows\System\YgKqgyM.exe
  2⤵
  PID:10468
- C:\Windows\System\hnvMMrB.exe
  C:\Windows\System\hnvMMrB.exe
  2⤵
  PID:10516
- C:\Windows\System\JrLPFxi.exe
  C:\Windows\System\JrLPFxi.exe
  2⤵
  PID:10556
- C:\Windows\System\pTNvdSd.exe
  C:\Windows\System\pTNvdSd.exe
  2⤵
  PID:10572
- C:\Windows\System\fRmVVkN.exe
  C:\Windows\System\fRmVVkN.exe
  2⤵
  PID:10592
- C:\Windows\System\lcDZfZP.exe
  C:\Windows\System\lcDZfZP.exe
  2⤵
  PID:10616
- C:\Windows\System\ifxvcfd.exe
  C:\Windows\System\ifxvcfd.exe
  2⤵
  PID:10636
- C:\Windows\System\VkeJnxe.exe
  C:\Windows\System\VkeJnxe.exe
  2⤵
  PID:10660
- C:\Windows\System\cYPCjQV.exe
  C:\Windows\System\cYPCjQV.exe
  2⤵
  PID:10684
- C:\Windows\System\NNeoakM.exe
  C:\Windows\System\NNeoakM.exe
  2⤵
  PID:10716
- C:\Windows\System\yRuPwUD.exe
  C:\Windows\System\yRuPwUD.exe
  2⤵
  PID:10736
- C:\Windows\System\kZUdCqZ.exe
  C:\Windows\System\kZUdCqZ.exe
  2⤵
  PID:10764
- C:\Windows\System\AlUUGez.exe
  C:\Windows\System\AlUUGez.exe
  2⤵
  PID:10808
- C:\Windows\System\yjToMRQ.exe
  C:\Windows\System\yjToMRQ.exe
  2⤵
  PID:10832
- C:\Windows\System\oYDZGQO.exe
  C:\Windows\System\oYDZGQO.exe
  2⤵
  PID:10872
- C:\Windows\System\UZYmumY.exe
  C:\Windows\System\UZYmumY.exe
  2⤵
  PID:10892
- C:\Windows\System\pauunLQ.exe
  C:\Windows\System\pauunLQ.exe
  2⤵
  PID:10940
- C:\Windows\System\WSyTuYv.exe
  C:\Windows\System\WSyTuYv.exe
  2⤵
  PID:10968
- C:\Windows\System\NOSUUHG.exe
  C:\Windows\System\NOSUUHG.exe
  2⤵
  PID:10988
- C:\Windows\System\xlGddrd.exe
  C:\Windows\System\xlGddrd.exe
  2⤵
  PID:11024
- C:\Windows\System\gzNNalU.exe
  C:\Windows\System\gzNNalU.exe
  2⤵
  PID:11072
- C:\Windows\System\DfrCgnv.exe
  C:\Windows\System\DfrCgnv.exe
  2⤵
  PID:11092
- C:\Windows\System\ibtspoS.exe
  C:\Windows\System\ibtspoS.exe
  2⤵
  PID:11112
- C:\Windows\System\kOPYZuw.exe
  C:\Windows\System\kOPYZuw.exe
  2⤵
  PID:11140
- C:\Windows\System\bGYpGiK.exe
  C:\Windows\System\bGYpGiK.exe
  2⤵
  PID:11164
- C:\Windows\System\AhlinQm.exe
  C:\Windows\System\AhlinQm.exe
  2⤵
  PID:11180
- C:\Windows\System\exMvcaL.exe
  C:\Windows\System\exMvcaL.exe
  2⤵
  PID:11236
- C:\Windows\System\kixprgK.exe
  C:\Windows\System\kixprgK.exe
  2⤵
  PID:10248
- C:\Windows\System\hpndjYw.exe
  C:\Windows\System\hpndjYw.exe
  2⤵
  PID:10280
- C:\Windows\System\XjCMNmb.exe
  C:\Windows\System\XjCMNmb.exe
  2⤵
  PID:10324
- C:\Windows\System\aXfdlTx.exe
  C:\Windows\System\aXfdlTx.exe
  2⤵
  PID:10368
- C:\Windows\System\gOChGKi.exe
  C:\Windows\System\gOChGKi.exe
  2⤵
  PID:10436
- C:\Windows\System\TcNnfcN.exe
  C:\Windows\System\TcNnfcN.exe
  2⤵
  PID:10512
- C:\Windows\System\rLhZowr.exe
  C:\Windows\System\rLhZowr.exe
  2⤵
  PID:10588
- C:\Windows\System\QsiFtSB.exe
  C:\Windows\System\QsiFtSB.exe
  2⤵
  PID:10676
- C:\Windows\System\pAihrva.exe
  C:\Windows\System\pAihrva.exe
  2⤵
  PID:10696
- C:\Windows\System\WEEWuPh.exe
  C:\Windows\System\WEEWuPh.exe
  2⤵
  PID:10704
- C:\Windows\System\twnmCMO.exe
  C:\Windows\System\twnmCMO.exe
  2⤵
  PID:10888
- C:\Windows\System\yPTRHwa.exe
  C:\Windows\System\yPTRHwa.exe
  2⤵
  PID:10924
- C:\Windows\System\SfbYhAd.exe
  C:\Windows\System\SfbYhAd.exe
  2⤵
  PID:4472
- C:\Windows\System\svDKjvx.exe
  C:\Windows\System\svDKjvx.exe
  2⤵
  PID:11020
- C:\Windows\System\aQnTaEg.exe
  C:\Windows\System\aQnTaEg.exe
  2⤵
  PID:11080
- C:\Windows\System\bjGHYmg.exe
  C:\Windows\System\bjGHYmg.exe
  2⤵
  PID:11148
- C:\Windows\System\kPqLOmA.exe
  C:\Windows\System\kPqLOmA.exe
  2⤵
  PID:9704
- C:\Windows\System\fVOPtqf.exe
  C:\Windows\System\fVOPtqf.exe
  2⤵
  PID:10420
- C:\Windows\System\xKyszlH.exe
  C:\Windows\System\xKyszlH.exe
  2⤵
  PID:10496
- C:\Windows\System\VzvMFEN.exe
  C:\Windows\System\VzvMFEN.exe
  2⤵
  PID:10672
- C:\Windows\System\ICOysCy.exe
  C:\Windows\System\ICOysCy.exe
  2⤵
  PID:10732
- C:\Windows\System\ITEOsKG.exe
  C:\Windows\System\ITEOsKG.exe
  2⤵
  PID:10860
- C:\Windows\System\hluGrHp.exe
  C:\Windows\System\hluGrHp.exe
  2⤵
  PID:11056
- C:\Windows\System\WmdqjLM.exe
  C:\Windows\System\WmdqjLM.exe
  2⤵
  PID:11208
- C:\Windows\System\EFhxowE.exe
  C:\Windows\System\EFhxowE.exe
  2⤵
  PID:10504
- C:\Windows\System\ORWoYQa.exe
  C:\Windows\System\ORWoYQa.exe
  2⤵
  PID:10744
- C:\Windows\System\ZafAdFx.exe
  C:\Windows\System\ZafAdFx.exe
  2⤵
  PID:10856
- C:\Windows\System\NpnIdrv.exe
  C:\Windows\System\NpnIdrv.exe
  2⤵
  PID:10300
- C:\Windows\System\NNCeEjv.exe
  C:\Windows\System\NNCeEjv.exe
  2⤵
  PID:10820
- C:\Windows\System\SnekLXe.exe
  C:\Windows\System\SnekLXe.exe
  2⤵
  PID:11312
- C:\Windows\System\JAxVNVU.exe
  C:\Windows\System\JAxVNVU.exe
  2⤵
  PID:11332
- C:\Windows\System\DVSrBox.exe
  C:\Windows\System\DVSrBox.exe
  2⤵
  PID:11356
- C:\Windows\System\NMJTyHV.exe
  C:\Windows\System\NMJTyHV.exe
  2⤵
  PID:11372
- C:\Windows\System\cceeEDE.exe
  C:\Windows\System\cceeEDE.exe
  2⤵
  PID:11392
- C:\Windows\System\MszvUwQ.exe
  C:\Windows\System\MszvUwQ.exe
  2⤵
  PID:11440
- C:\Windows\System\UzVUmUV.exe
  C:\Windows\System\UzVUmUV.exe
  2⤵
  PID:11456
- C:\Windows\System\UeThdCi.exe
  C:\Windows\System\UeThdCi.exe
  2⤵
  PID:11476
- C:\Windows\System\JWMxnDn.exe
  C:\Windows\System\JWMxnDn.exe
  2⤵
  PID:11500
- C:\Windows\System\pbAQGZb.exe
  C:\Windows\System\pbAQGZb.exe
  2⤵
  PID:11540
- C:\Windows\System\zJVpUdv.exe
  C:\Windows\System\zJVpUdv.exe
  2⤵
  PID:11564
- C:\Windows\System\cfZZPlg.exe
  C:\Windows\System\cfZZPlg.exe
  2⤵
  PID:11596
- C:\Windows\System\aErzXsc.exe
  C:\Windows\System\aErzXsc.exe
  2⤵
  PID:11616
- C:\Windows\System\DBWPljH.exe
  C:\Windows\System\DBWPljH.exe
  2⤵
  PID:11640
- C:\Windows\System\jcGFajY.exe
  C:\Windows\System\jcGFajY.exe
  2⤵
  PID:11672
- C:\Windows\System\zspBFvG.exe
  C:\Windows\System\zspBFvG.exe
  2⤵
  PID:11688
- C:\Windows\System\iOukzFc.exe
  C:\Windows\System\iOukzFc.exe
  2⤵
  PID:11712
- C:\Windows\System\mHvwJnh.exe
  C:\Windows\System\mHvwJnh.exe
  2⤵
  PID:11736
- C:\Windows\System\SMchLNl.exe
  C:\Windows\System\SMchLNl.exe
  2⤵
  PID:11756
- C:\Windows\System\fVRJdSx.exe
  C:\Windows\System\fVRJdSx.exe
  2⤵
  PID:11780
- C:\Windows\System\ZNJBfra.exe
  C:\Windows\System\ZNJBfra.exe
  2⤵
  PID:11844
- C:\Windows\System\RUTrRNw.exe
  C:\Windows\System\RUTrRNw.exe
  2⤵
  PID:11892
- C:\Windows\System\ZQDYiQX.exe
  C:\Windows\System\ZQDYiQX.exe
  2⤵
  PID:11920
- C:\Windows\System\RKeodyo.exe
  C:\Windows\System\RKeodyo.exe
  2⤵
  PID:11960
- C:\Windows\System\sHfTvnD.exe
  C:\Windows\System\sHfTvnD.exe
  2⤵
  PID:11984
- C:\Windows\System\eGDilJT.exe
  C:\Windows\System\eGDilJT.exe
  2⤵
  PID:12000
- C:\Windows\System\gDbgYbz.exe
  C:\Windows\System\gDbgYbz.exe
  2⤵
  PID:12024
- C:\Windows\System\kBuayvG.exe
  C:\Windows\System\kBuayvG.exe
  2⤵
  PID:12056
- C:\Windows\System\mWOCPai.exe
  C:\Windows\System\mWOCPai.exe
  2⤵
  PID:12096
- C:\Windows\System\TDXrOlf.exe
  C:\Windows\System\TDXrOlf.exe
  2⤵
  PID:12124
- C:\Windows\System\VDKcwbn.exe
  C:\Windows\System\VDKcwbn.exe
  2⤵
  PID:12144
- C:\Windows\System\cFsvkNI.exe
  C:\Windows\System\cFsvkNI.exe
  2⤵
  PID:12172
- C:\Windows\System\VGcpetQ.exe
  C:\Windows\System\VGcpetQ.exe
  2⤵
  PID:12200
- C:\Windows\System\vNDcvnG.exe
  C:\Windows\System\vNDcvnG.exe
  2⤵
  PID:12248
- C:\Windows\System\YkQokzS.exe
  C:\Windows\System\YkQokzS.exe
  2⤵
  PID:12272
- C:\Windows\System\kEMJmhl.exe
  C:\Windows\System\kEMJmhl.exe
  2⤵
  PID:10584
- C:\Windows\System\RonACBR.exe
  C:\Windows\System\RonACBR.exe
  2⤵
  PID:11300
- C:\Windows\System\SvvEJZy.exe
  C:\Windows\System\SvvEJZy.exe
  2⤵
  PID:11400
- C:\Windows\System\nTzInXh.exe
  C:\Windows\System\nTzInXh.exe
  2⤵
  PID:11420
- C:\Windows\System\EsfCGzD.exe
  C:\Windows\System\EsfCGzD.exe
  2⤵
  PID:11484
- C:\Windows\System\SjBOMSn.exe
  C:\Windows\System\SjBOMSn.exe
  2⤵
  PID:11468
- C:\Windows\System\jDkQWuu.exe
  C:\Windows\System\jDkQWuu.exe
  2⤵
  PID:11556
- C:\Windows\System\afauaEU.exe
  C:\Windows\System\afauaEU.exe
  2⤵
  PID:11604
- C:\Windows\System\fVwzBps.exe
  C:\Windows\System\fVwzBps.exe
  2⤵
  PID:636
- C:\Windows\System\vNPMvuE.exe
  C:\Windows\System\vNPMvuE.exe
  2⤵
  PID:11724
- C:\Windows\System\UVbvuUY.exe
  C:\Windows\System\UVbvuUY.exe
  2⤵
  PID:4572
- C:\Windows\System\iMlayBD.exe
  C:\Windows\System\iMlayBD.exe
  2⤵
  PID:11876
- C:\Windows\System\NMswFwk.exe
  C:\Windows\System\NMswFwk.exe
  2⤵
  PID:3376
- C:\Windows\System\hIyWELk.exe
  C:\Windows\System\hIyWELk.exe
  2⤵
  PID:11952
- C:\Windows\System\FVuvpmH.exe
  C:\Windows\System\FVuvpmH.exe
  2⤵
  PID:12040
- C:\Windows\System\GYvCvHW.exe
  C:\Windows\System\GYvCvHW.exe
  2⤵
  PID:12120
- C:\Windows\System\PPhOyCB.exe
  C:\Windows\System\PPhOyCB.exe
  2⤵
  PID:12168
- C:\Windows\System\QgcPIRo.exe
  C:\Windows\System\QgcPIRo.exe
  2⤵
  PID:12164
- C:\Windows\System\TqZUHZQ.exe
  C:\Windows\System\TqZUHZQ.exe
  2⤵
  PID:12260
- C:\Windows\System\ItGrAjS.exe
  C:\Windows\System\ItGrAjS.exe
  2⤵
  PID:2588
- C:\Windows\System\EKYQTOi.exe
  C:\Windows\System\EKYQTOi.exe
  2⤵
  PID:4712
- C:\Windows\System\stqjdsY.exe
  C:\Windows\System\stqjdsY.exe
  2⤵
  PID:11652
- C:\Windows\System\QQPsvhy.exe
  C:\Windows\System\QQPsvhy.exe
  2⤵
  PID:11744
- C:\Windows\System\ywbitJL.exe
  C:\Windows\System\ywbitJL.exe
  2⤵
  PID:11840
- C:\Windows\System\VegrIyt.exe
  C:\Windows\System\VegrIyt.exe
  2⤵
  PID:12020
- C:\Windows\System\KSluwXo.exe
  C:\Windows\System\KSluwXo.exe
  2⤵
  PID:12012
- C:\Windows\System\pORfCln.exe
  C:\Windows\System\pORfCln.exe
  2⤵
  PID:12140
- C:\Windows\System\BwBDSAK.exe
  C:\Windows\System\BwBDSAK.exe
  2⤵
  PID:5112
- C:\Windows\System\lmQEEbL.exe
  C:\Windows\System\lmQEEbL.exe
  2⤵
  PID:11588
- C:\Windows\System\XvxejuZ.exe
  C:\Windows\System\XvxejuZ.exe
  2⤵
  PID:11508
- C:\Windows\System\juHGkaF.exe
  C:\Windows\System\juHGkaF.exe
  2⤵
  PID:4968
- C:\Windows\System\RzyCZVm.exe
  C:\Windows\System\RzyCZVm.exe
  2⤵
  PID:12320
- C:\Windows\System\hWxxmRm.exe
  C:\Windows\System\hWxxmRm.exe
  2⤵
  PID:12340
- C:\Windows\System\YnKzcpT.exe
  C:\Windows\System\YnKzcpT.exe
  2⤵
  PID:12356
- C:\Windows\System\Pzrpwnj.exe
  C:\Windows\System\Pzrpwnj.exe
  2⤵
  PID:12376
- C:\Windows\System\ntrPjHd.exe
  C:\Windows\System\ntrPjHd.exe
  2⤵
  PID:12400
- C:\Windows\System\zrEsqKz.exe
  C:\Windows\System\zrEsqKz.exe
  2⤵
  PID:12428
- C:\Windows\System\ZpiiPTk.exe
  C:\Windows\System\ZpiiPTk.exe
  2⤵
  PID:12444
- C:\Windows\System\GPDqVMA.exe
  C:\Windows\System\GPDqVMA.exe
  2⤵
  PID:12472
- C:\Windows\System\jskpgds.exe
  C:\Windows\System\jskpgds.exe
  2⤵
  PID:12492
- C:\Windows\System\IXqHPZG.exe
  C:\Windows\System\IXqHPZG.exe
  2⤵
  PID:12540
- C:\Windows\System\Qfsever.exe
  C:\Windows\System\Qfsever.exe
  2⤵
  PID:12560
- C:\Windows\System\rTbLQOv.exe
  C:\Windows\System\rTbLQOv.exe
  2⤵
  PID:12580
- C:\Windows\System\wpNobFf.exe
  C:\Windows\System\wpNobFf.exe
  2⤵
  PID:12612
- C:\Windows\System\TefYMtI.exe
  C:\Windows\System\TefYMtI.exe
  2⤵
  PID:12632
- C:\Windows\System\NqzeAVA.exe
  C:\Windows\System\NqzeAVA.exe
  2⤵
  PID:12668
- C:\Windows\System\jRcFSxI.exe
  C:\Windows\System\jRcFSxI.exe
  2⤵
  PID:12712
- C:\Windows\System\cTwxXRM.exe
  C:\Windows\System\cTwxXRM.exe
  2⤵
  PID:12740
- C:\Windows\System\jtMSKbM.exe
  C:\Windows\System\jtMSKbM.exe
  2⤵
  PID:12760
- C:\Windows\System\uUOLfDd.exe
  C:\Windows\System\uUOLfDd.exe
  2⤵
  PID:12780
- C:\Windows\System\qLqUexh.exe
  C:\Windows\System\qLqUexh.exe
  2⤵
  PID:12804
- C:\Windows\System\yAckXtn.exe
  C:\Windows\System\yAckXtn.exe
  2⤵
  PID:12824
- C:\Windows\System\dOkkZeY.exe
  C:\Windows\System\dOkkZeY.exe
  2⤵
  PID:12860
- C:\Windows\System\lKOwiXI.exe
  C:\Windows\System\lKOwiXI.exe
  2⤵
  PID:12916
- C:\Windows\System\ZZBKSAO.exe
  C:\Windows\System\ZZBKSAO.exe
  2⤵
  PID:12960
- C:\Windows\System\uWnvfjh.exe
  C:\Windows\System\uWnvfjh.exe
  2⤵
  PID:12980
- C:\Windows\System\PgvPJYX.exe
  C:\Windows\System\PgvPJYX.exe
  2⤵
  PID:13008
- C:\Windows\System\IvYikdO.exe
  C:\Windows\System\IvYikdO.exe
  2⤵
  PID:13236
- C:\Windows\System\oNBPwCd.exe
  C:\Windows\System\oNBPwCd.exe
  2⤵
  PID:13252
- C:\Windows\System\TolPQzZ.exe
  C:\Windows\System\TolPQzZ.exe
  2⤵
  PID:13268
- C:\Windows\System\YAWIfnR.exe
  C:\Windows\System\YAWIfnR.exe
  2⤵
  PID:13300
- C:\Windows\System\thutNff.exe
  C:\Windows\System\thutNff.exe
  2⤵
  PID:12104
- C:\Windows\System\VLOwkVr.exe
  C:\Windows\System\VLOwkVr.exe
  2⤵
  PID:12348
- C:\Windows\System\OqKbgZT.exe
  C:\Windows\System\OqKbgZT.exe
  2⤵
  PID:12332
- C:\Windows\System\yNemRdD.exe
  C:\Windows\System\yNemRdD.exe
  2⤵
  PID:12384
- C:\Windows\System\lVNauic.exe
  C:\Windows\System\lVNauic.exe
  2⤵
  PID:13112
- C:\Windows\System\UBVxckZ.exe
  C:\Windows\System\UBVxckZ.exe
  2⤵
  PID:12468
- C:\Windows\System\FnLTAAC.exe
  C:\Windows\System\FnLTAAC.exe
  2⤵
  PID:12480
- C:\Windows\System\QhhcJOI.exe
  C:\Windows\System\QhhcJOI.exe
  2⤵
  PID:12552
- C:\Windows\System\hBriREE.exe
  C:\Windows\System\hBriREE.exe
  2⤵
  PID:12556
- C:\Windows\System\FzQLgpf.exe
  C:\Windows\System\FzQLgpf.exe
  2⤵
  PID:12624
- C:\Windows\System\YxgGPaq.exe
  C:\Windows\System\YxgGPaq.exe
  2⤵
  PID:12660
- C:\Windows\System\dkHiUMI.exe
  C:\Windows\System\dkHiUMI.exe
  2⤵
  PID:12700
- C:\Windows\System\YqJTyav.exe
  C:\Windows\System\YqJTyav.exe
  2⤵
  PID:12752
- C:\Windows\System\BhgncbV.exe
  C:\Windows\System\BhgncbV.exe
  2⤵
  PID:3624
- C:\Windows\System\bijQmXZ.exe
  C:\Windows\System\bijQmXZ.exe
  2⤵
  PID:12728
- C:\Windows\System\MJYjVsp.exe
  C:\Windows\System\MJYjVsp.exe
  2⤵
  PID:12820
- C:\Windows\System\hrqHAvw.exe
  C:\Windows\System\hrqHAvw.exe
  2⤵
  PID:12816
- C:\Windows\System\dMdLKwD.exe
  C:\Windows\System\dMdLKwD.exe
  2⤵
  PID:12972
- C:\Windows\System\atzjqBR.exe
  C:\Windows\System\atzjqBR.exe
  2⤵
  PID:12652
- C:\Windows\System\JAyxWTu.exe
  C:\Windows\System\JAyxWTu.exe
  2⤵
  PID:13108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5yyqwfi1.z4u.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BURPkgT.exe

Filesize
2.2MB

MD5
1cbeeb4d624d86a2dc22db7887f6ac03

SHA1
fd5b7b7b5e58766c9e7fcac76858e6518e4fdf5f

SHA256
02c25bdf60ec0d67492c9ead264de4b5ce31cc42940ce5fa3ce21a78d3a329cd

SHA512
bfd3bbac0e428ebeb3a7a7fed9ec1c70421912c60fb1135b868c6bc5372681457b631b2b68bfc616031c357fdcb6d51f0f0e25252311f74e0b574b9792dbac1e

Download Submit
C:\Windows\System\CcdXIkf.exe

Filesize
2.2MB

MD5
5122abf5678d94b2efec900e854d430d

SHA1
02ae358908bac51588247780ead1733b6a60af1a

SHA256
d8b209274dee9db001a09b6a4f52d1896090b69984e702d6ac7fdb2acc6506f1

SHA512
a6b3c22efccbc737132e1e4cd6b0b3baa54fb4c314eb07e6f0fd67da384679fb9d89557094e5922758a033919454124f21e9aed0c687f173a5855b3d36d74419

Download Submit
C:\Windows\System\DZnYFBp.exe

Filesize
2.2MB

MD5
ed7c6936c9c60e40e91e6db2f05335c9

SHA1
4635ed3a4d02054877263967927ac378b6312fb0

SHA256
9393908347639e3f89b6bd2ee49a47add73f3c607f59c6c4e489edc0f51f3c0b

SHA512
42e3aa8e493cfb851a33aa9eb998df78a993cba8fab98d0a830a9ed4bfaf788842f289621de3367ee294b5c7e67b630ee6a56116f9512f461d935a55778a9a95

Download Submit
C:\Windows\System\EYiQZDJ.exe

Filesize
2.2MB

MD5
0d46e8509e501e88e51e90279c3abe58

SHA1
c9de81f19724a7dfa0120bc9750976d90debb892

SHA256
7d089a72fc26973f16baab240ab333e288307a9784736e7df24642e4a758b464

SHA512
45801cd7aba48f272e8c1b0d5808e4835a8a32f4bf3ef79d7148cb14431ce01485ae4048637115bd854e7802733c673bd544723326a8ef3ab26bd1e333e662e6

Download Submit
C:\Windows\System\GLcUkto.exe

Filesize
2.2MB

MD5
d6c2e1aba662665f54674f0c3d99b529

SHA1
773f4e5643efad23f8e91f2862a58ac3046e9351

SHA256
1ce46b6f94ab7b14502e3214ed00593ce9be213e1469ed896310cf5ba81aa79f

SHA512
f334632253b6107a6322e924004a0467109e7e15de9dfdbc7a1823d15f9c42efc6867e6de638677148c5e8a4d29672bbc8e32571348b3988cc1d8875b25531d7

Download Submit
C:\Windows\System\GXNSpvX.exe

Filesize
2.2MB

MD5
10646a06dbac1515c3976f87aaeaa181

SHA1
098bd4f7dc989ecb6f392d8ec98af491ea530e39

SHA256
794049314bb76a235d6924ac9b035166ab4d20b702743b69311d5b8fee51dfdc

SHA512
35c4078c4cec1ac0719e78bcf65b885f91d356a6fcd30b2ddf02c35ebb1654a77dd819bef34bdac74e39120ff212a5fd6ccbc39e73130b72090ac0f18f68c04b

Download Submit
C:\Windows\System\HHUslmU.exe

Filesize
2.2MB

MD5
d3fb5397b230358828b5da4927c894c9

SHA1
e24fb6469b1f206188ec2b020156d0a26bb41e4a

SHA256
1c9268dca34194eae0c376beafa63a9ae07287c951e9055722cbacf91eed2ac9

SHA512
4ff4d951947db09909fd19f2e0af2ade0142026d4a0dae836a91d0276b2298cab88b333dad8253c0da277c81c6c246cb346ad03cb75554eeeccb8dd06461823e

Download Submit
C:\Windows\System\ItFOkkM.exe

Filesize
2.2MB

MD5
2d820e6dbc4399518f1f2f943e4b97c1

SHA1
9c3c5ea0cdac173468c363e314e9381d915015fc

SHA256
a35775764c942d499b1b7e1ab918fc5013949cbe15fe9788e50544065d3a2c26

SHA512
b956edd2724b17737575b1ad244c47e06800d23dc66c2195a44f018b13060aaad3dc36b91b8ff55c30a2126697b4e4f1531b6277eb483e8252470f93d5ab7aad

Download Submit
C:\Windows\System\JxGQddN.exe

Filesize
2.2MB

MD5
9e4ce8a686dc88f6cbf71ccbb3aa0042

SHA1
05672851b69e983a74dc3cc689cea6371ce31ebc

SHA256
46d48d7d216aefe5bea053debc4262df5ba6b109b0bee9fd9edee4b3e66773fc

SHA512
463682f7fea29afec417ae5ce75327fdb51fd0415e56ccc824f76f1af8ba02f5504e1c0fba1b820465c156fa76e73c295e2b51be878bb7a0dd216b6206e65f08

Download Submit
C:\Windows\System\MVgAaFM.exe

Filesize
2.2MB

MD5
0449122fd8b41328d9ecb62d93420822

SHA1
468da13e6cdfa38eae7be62fa439260f57ce5971

SHA256
3e439bf67460f8da911cf7bbb0702754bfbb1eea0c9c90cce6c7eb72ccd2a7fb

SHA512
28a1bf2b7023d8406ca6d93c2ceff1584fb2cd0d9130e1df5c51649f52876cea5dec7f3467175a9de5dd53a98d3af3916b004fb07c75db25ae5046d433ce887a

Download Submit
C:\Windows\System\MXPwaJj.exe

Filesize
2.2MB

MD5
ea30d2931cc632f97796f593b9cd0a70

SHA1
a523e3b0fc57efc99b9500b7714b09d190b8a4ff

SHA256
178deff0760a841759934de0868d2638b78a236cfa6d608819c6ccf84b2fb41e

SHA512
5f715eccc67ceec214043e4403acb138092e600d52f43f81d78b98dc98fe812f1715db8f018769211905bfb705b5233efe76da096c06631cc023be64aa286fa8

Download Submit
C:\Windows\System\NPrXYab.exe

Filesize
2.2MB

MD5
1ca9ed82aa4750eda462f60b4ff26be9

SHA1
ca13ff235e02c031fb077503df7c668ec9285b4e

SHA256
f82813a1dc2f715e3e59656831f62b81fa6319344cc436787d5902f65ea789b9

SHA512
08b394a1032a2c59192bb22ad5a9c343bf0d80ae92ab2e2437f53927eb54301ab157badcdfcf52966a4207e748e2eed99b57a30c4fff5fa52812c82dce1c7175

Download Submit
C:\Windows\System\RPYsVxd.exe

Filesize
2.2MB

MD5
7ebc3e9944cc6e59bdf26dc41d59f638

SHA1
5efdbe08a3529bd0b3275c4334c28795977aaf7b

SHA256
a7cbc09c2b530dc4a66bfd9b090cb551366f93f1862c6f358b5c22e9d6a50d4c

SHA512
60e5c3593baafec4efe7fd02335b2a2af2e5bd6414b18f1ca632627db6b9dbbdc41098502525b35d21a5e40a757c2c65be580e973a884266d1e1b8480609f80a

Download Submit
C:\Windows\System\TbaJgow.exe

Filesize
2.2MB

MD5
971cb3dd829997a61da184be77f2497d

SHA1
6605dc38755e049807ddf0edf3a91f83c30a70a4

SHA256
4424c63fafd8334c1a129051cfafdca576ee39f7b6071270648901ad541fa815

SHA512
2f7259b0ff8c477923cef52123c4e2c3791c9b5e51e85e359c62a37f0d9cbe318763796c2aa1de2edebaee0c333d8ef8e863f701cd01c591b2d9b516d36f1422

Download Submit
C:\Windows\System\UDZzSVc.exe

Filesize
2.2MB

MD5
9cbcdeb3347d6ba5a293d1737c05701c

SHA1
a1dc8212ab58849eacaa4fcbb380b308c5603762

SHA256
43cc43d472bab1364ced0cad7760665a6136275661ee37bfe89a3cbeee64f375

SHA512
a02accbc9eda8bf71671fa5b86e8dcc8bb83af657f3231e713873c82895ac28a5eca91ac24e26fa9614e6339ae60155ec39734a1ef866b5f1f6c649c854b5b6f

Download Submit
C:\Windows\System\WWKMlVa.exe

Filesize
2.2MB

MD5
556f1df89233d19e43acc1ba219af5ba

SHA1
49229252b6013a881004fb7744034d11dddeb469

SHA256
40ecc44c0126af4d63c3acd4ccb6a477d2415118bc6cc55acd3f49c041c35f9b

SHA512
d84306e93adae066afb9b54c4c8a3be3277a3612e2acb83320a47e4c5705b274bbd3c0843cf6c09e3b4a246a6c1600ccb7452330cd2d0cc655c9ef0494aac9f0

Download Submit
C:\Windows\System\ZnUjFHt.exe

Filesize
2.2MB

MD5
4816c0839c9ed7b58aef900130e9ac1b

SHA1
52c3f34d829686028e07050dd3cdf4344866b5dd

SHA256
80d21657b4c734a7b7f570a22bb12ea493f5864765c7a2be94884fb2f506f98f

SHA512
e31cea4d6c0035a65ae24cc852e91849f0293084c68145e96eb8f2e4c3a644e8ff5ccbe3c3babca31a798a03aa532c48accdad413c7217a29e776133a0b2e182

Download Submit
C:\Windows\System\cTqaqqh.exe

Filesize
2.2MB

MD5
5a753090b1b0dc74cb9076be16ceb15f

SHA1
b4ab1ffb0de6c4935aa4e34927b9a710abdf50f8

SHA256
34957427f5c7fa667d9a8f3a7faa4968f7173e33c91411b14a3d1ff235fca456

SHA512
26868a271813f08e21d4f0ad0267052bfce7966809a57b7599d660e52ed818258433fb2650fcce8defd8a20aff4544f9e5a4b18db122104e1797b73a88141968

Download Submit
C:\Windows\System\cUWAkdW.exe

Filesize
2.2MB

MD5
1d225ac7eba505a0794d7a1bc062fd11

SHA1
6def8753e36ef86bf1fb7070bbfb9b587d25cec6

SHA256
bfc0453e35aa245b1d79d9550c636701a23ebe3326c5a953922f90b941b57a2c

SHA512
7bd8a346878fd539dccaf23f8fa0785458b9369872feef2539e4bd449e7bc12a8e4a4c3263290f2c03dc1b7551683e2bb3aba1656275cd6020ff5d3119c2ea6a

Download Submit
C:\Windows\System\chmNPnl.exe

Filesize
2.2MB

MD5
a853b7b59f05db5510ba1ec4838d8f1d

SHA1
2493a09a97159c6f6b3b401c5d9f42ec42c7b91d

SHA256
f6d5d7bd71ad10e02c7c5d5fb5f69fc4410a677c1bb01968743979a067b0110a

SHA512
db58404e3e73006a8a62ab73583e4ad4aeee07318a71a4dbefe884c4e03375eaa21bdad4b2749b845594bdb3873d420552eb95315dd2164386482f80f169cd24

Download Submit
C:\Windows\System\dfOgFCD.exe

Filesize
2.2MB

MD5
cd8d71d4ed6c9fc37f1a28106feaf34e

SHA1
2fb254901d5449fa6519e1d0895a5ca73841b3e7

SHA256
dde408a33411c381ea2f4aef7b5bdce89ee84d9e9ea0200f8230ee3efd3aee27

SHA512
33dbedc586f22a816568d0f4969350e809d331a031a201b11c3c7cfb905d0f8bc2ff5c9068258e298e9124ea5bc2c55aa6aefca59d3f9828c746139da6a65db4

Download Submit
C:\Windows\System\duueKAr.exe

Filesize
2.2MB

MD5
47098510940f37cb3e6b90fae663f576

SHA1
7ff29886125067f77bad9d5722160f9edc66273c

SHA256
c8b82c8eef36f2920f89be55d89017b83ed1b37aa17a64d812daaea5fa56c263

SHA512
e52bced6729350f43eedc97d7f31e0868dc0834b233aa295f92681a73d00aa2b4169a257348ed5fee6ed34338eef583ab0cb565e014c80b71bc9be4edc70cda8

Download Submit
C:\Windows\System\fHtOxQN.exe

Filesize
2.2MB

MD5
cd4ec8b20e6f25862df9963615c575e2

SHA1
934c8336540736f359033ed590eb8d25772c13ae

SHA256
5c656797b34529c78894423810cfd902c7db5aace9e2582ee37f3abfe7237ce6

SHA512
173753c145236bfdeacae5e8de62cba4a2357c31ddcbdb21f987627f915b54f627af584ab78a1123a1b69790e0ccbdc40e6adce340170093592d8621f053c272

Download Submit
C:\Windows\System\ftVterq.exe

Filesize
2.2MB

MD5
7f97790c6c50b62552ec76cf0db4246d

SHA1
9523962f9d2bbbe32cd67ba19e11faafa6417a8a

SHA256
df5acd7ab07d77f0194cc9d28e9d72fdb00f1a6515c3b8ff58135188b26b58d5

SHA512
7478f37da4a4535ca967ff93b380be6940447797f04c0335e636bbbe066afe51bbde972f61f3b452b995dd45072428e6314d3cce312ebf4a9130fb0720c1d692

Download Submit
C:\Windows\System\icZLekI.exe

Filesize
2.2MB

MD5
99f44db5e9c8339f88715ab9e1c9e008

SHA1
dae7e82fdc592f62107089fbb0e4d38036fb41fa

SHA256
ab29605ddc6777c7a4b0be1f25ec050af9692dd927563a3a6a9abc0b6c9290fd

SHA512
b49872d4f51bb9b5def156e27c89a2d481507030c666e9a2e597da46f0cd2ec086fdc12d02a55db78ca9d5672cacbf2de21a7f704d10d63424a7af0eceb7f73b

Download Submit
C:\Windows\System\lBXDwhQ.exe

Filesize
2.2MB

MD5
9fb4c0197876f68157917114b6ad8970

SHA1
2f5e55d49d04b25bdd5dc77685d9185ec59caa06

SHA256
d4441ad68a44d0cf49ade5253f8089d45afb9a255768b935aad3dab4ba774e58

SHA512
6dabfb8f6c38b3e7b4634e6bb1935add558341154b408d509fbc0b8fd3a620634836cf396ae9590f300d7be907a967ca0e49e873c06e12fbadc1e67a77b6830f

Download Submit
C:\Windows\System\pKpwMur.exe

Filesize
2.2MB

MD5
6db3f98f778d840b416ceb4bb4079a5c

SHA1
f5896844caf178140b37eb05c6cf7a91bcd1a1d4

SHA256
60a895db9dce1478f75fe79960af733d3eb8228a4bafca6bc947c36e88ea334f

SHA512
f849405bf4acf263a5676ac8e17bb35af0922d296715ed5ce8ba86ef71828bad65e9daaa11a3896e4723d3cfe657c53ad9fe789422b38823c1fca2b307d09277

Download Submit
C:\Windows\System\qzFTANz.exe

Filesize
2.2MB

MD5
44c2d1cc1de26aa7e1a8d919c84eba3d

SHA1
f91e4dda5c36ee6cbad9b8da3a09baad1628245c

SHA256
7641471672688e74c36cec9fbfec74970892235cd1dd0c27aae01e83e95e0d18

SHA512
aa583d354a3e86c51b1190cc95a90c5b0b573dc0b4e31bb928afa00e36086ec0f3f7565aea90b084e669789c7c1cb6fad6617fde321e45a62f07133ffff9b096

Download Submit
C:\Windows\System\rejZTMH.exe

Filesize
2.2MB

MD5
e9bd48bd604733a369e0fed0d66b85df

SHA1
96c049920fe4d9bfaa6ddb05f4dee0bbfaed3535

SHA256
32176967d08b53538ef6292b8f614de27eb73bbe04115839c54b7e542dd26017

SHA512
10a312ad39d460902ffcaf67905c461c36e6c3d46b3ce8dbc4ccc3cf5f89b7d931f7269551a3d4b5be898d302f6d882ba990dbff209156840f0721c012e1825f

Download Submit
C:\Windows\System\xKdyqDF.exe

Filesize
2.2MB

MD5
94439486d3249fa63dffda24637e16f6

SHA1
2db540715fa2b379b58c793e23c46589ed8f6301

SHA256
a05b2d6b468ece1180a367c6bb7b219f1e19b66b521623cd4239f6fefa4e69cd

SHA512
aeff6a449de05c7b0f3c50ec5f3c8c9341bcea23c956c51f48d63e4f32d501a4fbf67ff0b4a5b40633dbe39d35e8031cd5f93804e37f35dbd126b83fa7a69c26

Download Submit
C:\Windows\System\xqhVDGP.exe

Filesize
2.2MB

MD5
f6a52bc47111e6f76fb3bd45f270d673

SHA1
e6a2efb974b14c84a057f68266b7016947faab87

SHA256
1f6be0aa96c69560ab361ba5a7b6279b0cdc3e223459735eba8f551a9119edf9

SHA512
e15b295e0966b4d3311f5a3b462427117c735fa62aef462e5d07b7466e24ffde5c1ec102e09a13100e04db698325701f3b7939147e71d45bf0f8ed2c8766e079

Download Submit
C:\Windows\System\yWlQDTZ.exe

Filesize
2.2MB

MD5
5dc6c225823197c3d47e308fc3399bb8

SHA1
e7b4b446caa96ac50516ebdf0a5cc0674e9c7a42

SHA256
b7b55a484397189be8edca279ff0b5ec701750cc4955032582a67ef2841926c4

SHA512
72d0128b42ceb5acaf62179b3e43dfd256356aded135487d87b5d9a5ba954468e506475351339b27f99c9d29fc09d398d6a2cbae270b955ec2e94cc3aa008946

Download Submit
C:\Windows\System\zcmViPg.exe

Filesize
2.2MB

MD5
10b0a9a3c1b4ac7d4ce4e60d5761ee66

SHA1
d918a46483b79c0fae31c8724f0cb709b64e18db

SHA256
1dad4d4d5208cd268192d89e922222ad39469fc0730f5a977ed0f3f8ae46303c

SHA512
66af9ca6d73277abb81958a0cf7abbd8b96449fe2571bc9ea5999fbbd24a7428e4338883a6f3198be00bbb75671248c4576a769ba5c2d128c8626d37a3fd79be

Download Submit
memory/224-2929-0x00007FF670360000-0x00007FF670752000-memory.dmp

Filesize
3.9MB

Download
memory/224-137-0x00007FF670360000-0x00007FF670752000-memory.dmp

Filesize
3.9MB

Download
memory/224-2958-0x00007FF670360000-0x00007FF670752000-memory.dmp

Filesize
3.9MB

Download
memory/384-33-0x00007FF760430000-0x00007FF760822000-memory.dmp

Filesize
3.9MB

Download
memory/540-2948-0x00007FF68C600000-0x00007FF68C9F2000-memory.dmp

Filesize
3.9MB

Download
memory/540-113-0x00007FF68C600000-0x00007FF68C9F2000-memory.dmp

Filesize
3.9MB

Download
memory/924-2928-0x00007FF75D680000-0x00007FF75DA72000-memory.dmp

Filesize
3.9MB

Download
memory/924-126-0x00007FF75D680000-0x00007FF75DA72000-memory.dmp

Filesize
3.9MB

Download
memory/924-2955-0x00007FF75D680000-0x00007FF75DA72000-memory.dmp

Filesize
3.9MB

Download
memory/1012-2938-0x00007FF621C50000-0x00007FF622042000-memory.dmp

Filesize
3.9MB

Download
memory/1012-98-0x00007FF621C50000-0x00007FF622042000-memory.dmp

Filesize
3.9MB

Download
memory/1452-2965-0x00007FF76A3B0000-0x00007FF76A7A2000-memory.dmp

Filesize
3.9MB

Download
memory/1452-2932-0x00007FF76A3B0000-0x00007FF76A7A2000-memory.dmp

Filesize
3.9MB

Download
memory/1452-155-0x00007FF76A3B0000-0x00007FF76A7A2000-memory.dmp

Filesize
3.9MB

Download
memory/1620-2931-0x00007FF6B6A80000-0x00007FF6B6E72000-memory.dmp

Filesize
3.9MB

Download
memory/1620-149-0x00007FF6B6A80000-0x00007FF6B6E72000-memory.dmp

Filesize
3.9MB

Download
memory/1620-2960-0x00007FF6B6A80000-0x00007FF6B6E72000-memory.dmp

Filesize
3.9MB

Download
memory/1924-39-0x00007FF62A260000-0x00007FF62A652000-memory.dmp

Filesize
3.9MB

Download
memory/1948-2930-0x00007FF6BE760000-0x00007FF6BEB52000-memory.dmp

Filesize
3.9MB

Download
memory/1948-143-0x00007FF6BE760000-0x00007FF6BEB52000-memory.dmp

Filesize
3.9MB

Download
memory/1948-2956-0x00007FF6BE760000-0x00007FF6BEB52000-memory.dmp

Filesize
3.9MB

Download
memory/2320-70-0x00007FF75D630000-0x00007FF75DA22000-memory.dmp

Filesize
3.9MB

Download
memory/2320-2934-0x00007FF75D630000-0x00007FF75DA22000-memory.dmp

Filesize
3.9MB

Download
memory/2456-2944-0x00007FF6826C0000-0x00007FF682AB2000-memory.dmp

Filesize
3.9MB

Download
memory/2456-94-0x00007FF6826C0000-0x00007FF682AB2000-memory.dmp

Filesize
3.9MB

Download
memory/2752-57-0x00007FF7E79B0000-0x00007FF7E7DA2000-memory.dmp

Filesize
3.9MB

Download
memory/3096-2946-0x00007FF75DC10000-0x00007FF75E002000-memory.dmp

Filesize
3.9MB

Download
memory/3096-107-0x00007FF75DC10000-0x00007FF75E002000-memory.dmp

Filesize
3.9MB

Download
memory/3192-167-0x00007FF7B61A0000-0x00007FF7B6592000-memory.dmp

Filesize
3.9MB

Download
memory/3192-2963-0x00007FF7B61A0000-0x00007FF7B6592000-memory.dmp

Filesize
3.9MB

Download
memory/3568-85-0x00007FF70AD10000-0x00007FF70B102000-memory.dmp

Filesize
3.9MB

Download
memory/3568-2936-0x00007FF70AD10000-0x00007FF70B102000-memory.dmp

Filesize
3.9MB

Download
memory/3612-84-0x00007FF7B22D0000-0x00007FF7B26C2000-memory.dmp

Filesize
3.9MB

Download
memory/3616-2940-0x00007FF6F7AB0000-0x00007FF6F7EA2000-memory.dmp

Filesize
3.9MB

Download
memory/3616-92-0x00007FF6F7AB0000-0x00007FF6F7EA2000-memory.dmp

Filesize
3.9MB

Download
memory/3656-1-0x000001EF64380000-0x000001EF64390000-memory.dmp

Filesize
64KB

Download
memory/3656-0-0x00007FF659540000-0x00007FF659932000-memory.dmp

Filesize
3.9MB

Download
memory/3904-77-0x00007FFE2B310000-0x00007FFE2BDD1000-memory.dmp

Filesize
10.8MB

Download
memory/3904-8-0x00007FFE2B313000-0x00007FFE2B315000-memory.dmp

Filesize
8KB

Download
memory/3904-30-0x00007FFE2B310000-0x00007FFE2BDD1000-memory.dmp

Filesize
10.8MB

Download
memory/3904-423-0x00000218EE550000-0x00000218EECF6000-memory.dmp

Filesize
7.6MB

Download
memory/3904-58-0x00000218ED910000-0x00000218ED932000-memory.dmp

Filesize
136KB

Download
memory/4084-2966-0x00007FF7FE470000-0x00007FF7FE862000-memory.dmp

Filesize
3.9MB

Download
memory/4084-161-0x00007FF7FE470000-0x00007FF7FE862000-memory.dmp

Filesize
3.9MB

Download
memory/4412-6-0x00007FF6009B0000-0x00007FF600DA2000-memory.dmp

Filesize
3.9MB

Download
memory/4432-2927-0x00007FF650540000-0x00007FF650932000-memory.dmp

Filesize
3.9MB

Download
memory/4432-2952-0x00007FF650540000-0x00007FF650932000-memory.dmp

Filesize
3.9MB

Download
memory/4432-120-0x00007FF650540000-0x00007FF650932000-memory.dmp

Filesize
3.9MB

Download
memory/4676-2943-0x00007FF61C500000-0x00007FF61C8F2000-memory.dmp

Filesize
3.9MB

Download
memory/4676-97-0x00007FF61C500000-0x00007FF61C8F2000-memory.dmp

Filesize
3.9MB

Download
memory/4716-2951-0x00007FF6AFBA0000-0x00007FF6AFF92000-memory.dmp

Filesize
3.9MB

Download
memory/4716-114-0x00007FF6AFBA0000-0x00007FF6AFF92000-memory.dmp

Filesize
3.9MB

Download
memory/5060-63-0x00007FF670C40000-0x00007FF671032000-memory.dmp

Filesize
3.9MB

Download
memory/5064-83-0x00007FF770C30000-0x00007FF771022000-memory.dmp

Filesize
3.9MB

Download