xmrig | 8259a54199c3442abcff6f2c0ec29c46c849e1ecb68e2986cf5c8a3117189d95

Analysis

max time kernel
150s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 17:33 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
Size

2.7MB
MD5

3b48fb1a67165967e314b2431c7ffb35
SHA1

9b3b7dd90dc02955acc53dd2d7a1436237eaa958
SHA256

8259a54199c3442abcff6f2c0ec29c46c849e1ecb68e2986cf5c8a3117189d95
SHA512

f7fbc25706a6f8ca348576bdfb692c07e33adb38bab28735600657bbdab41a45e6559805d744808904fde53abab11415ecefc53042a8466337793534c90513f6
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5I/9:NABW

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 45 IoCs

miner

resource	yara_rule
behavioral2/memory/4804-39-0x00007FF69A100000-0x00007FF69A4F2000-memory.dmp	xmrig
behavioral2/memory/4672-108-0x00007FF724850000-0x00007FF724C42000-memory.dmp	xmrig
behavioral2/memory/3436-125-0x00007FF7C6D20000-0x00007FF7C7112000-memory.dmp	xmrig
behavioral2/memory/2724-217-0x00007FF7DEB10000-0x00007FF7DEF02000-memory.dmp	xmrig
behavioral2/memory/1544-226-0x00007FF74ECA0000-0x00007FF74F092000-memory.dmp	xmrig
behavioral2/memory/2968-238-0x00007FF7DD2C0000-0x00007FF7DD6B2000-memory.dmp	xmrig
behavioral2/memory/2020-130-0x00007FF6AAE50000-0x00007FF6AB242000-memory.dmp	xmrig
behavioral2/memory/4504-129-0x00007FF6634D0000-0x00007FF6638C2000-memory.dmp	xmrig
behavioral2/memory/4896-128-0x00007FF6C0340000-0x00007FF6C0732000-memory.dmp	xmrig
behavioral2/memory/2012-127-0x00007FF7C0F90000-0x00007FF7C1382000-memory.dmp	xmrig
behavioral2/memory/2408-126-0x00007FF6AC270000-0x00007FF6AC662000-memory.dmp	xmrig
behavioral2/memory/4904-123-0x00007FF755F80000-0x00007FF756372000-memory.dmp	xmrig
behavioral2/memory/4608-121-0x00007FF63F6D0000-0x00007FF63FAC2000-memory.dmp	xmrig
behavioral2/memory/1636-120-0x00007FF634F40000-0x00007FF635332000-memory.dmp	xmrig
behavioral2/memory/4364-119-0x00007FF649C40000-0x00007FF64A032000-memory.dmp	xmrig
behavioral2/memory/2760-116-0x00007FF7CCFE0000-0x00007FF7CD3D2000-memory.dmp	xmrig
behavioral2/memory/1352-115-0x00007FF7FB480000-0x00007FF7FB872000-memory.dmp	xmrig
behavioral2/memory/1140-103-0x00007FF659AE0000-0x00007FF659ED2000-memory.dmp	xmrig
behavioral2/memory/3804-92-0x00007FF779130000-0x00007FF779522000-memory.dmp	xmrig
behavioral2/memory/668-83-0x00007FF698CB0000-0x00007FF6990A2000-memory.dmp	xmrig
behavioral2/memory/4252-34-0x00007FF60DE60000-0x00007FF60E252000-memory.dmp	xmrig
behavioral2/memory/940-31-0x00007FF7D0E20000-0x00007FF7D1212000-memory.dmp	xmrig
behavioral2/memory/2676-12-0x00007FF7F1EF0000-0x00007FF7F22E2000-memory.dmp	xmrig
behavioral2/memory/4252-2891-0x00007FF60DE60000-0x00007FF60E252000-memory.dmp	xmrig
behavioral2/memory/3436-2893-0x00007FF7C6D20000-0x00007FF7C7112000-memory.dmp	xmrig
behavioral2/memory/668-2898-0x00007FF698CB0000-0x00007FF6990A2000-memory.dmp	xmrig
behavioral2/memory/4804-2906-0x00007FF69A100000-0x00007FF69A4F2000-memory.dmp	xmrig
behavioral2/memory/1140-2922-0x00007FF659AE0000-0x00007FF659ED2000-memory.dmp	xmrig
behavioral2/memory/4672-2933-0x00007FF724850000-0x00007FF724C42000-memory.dmp	xmrig
behavioral2/memory/2408-2927-0x00007FF6AC270000-0x00007FF6AC662000-memory.dmp	xmrig
behavioral2/memory/1352-2937-0x00007FF7FB480000-0x00007FF7FB872000-memory.dmp	xmrig
behavioral2/memory/3804-2909-0x00007FF779130000-0x00007FF779522000-memory.dmp	xmrig
behavioral2/memory/2020-2951-0x00007FF6AAE50000-0x00007FF6AB242000-memory.dmp	xmrig
behavioral2/memory/1544-3021-0x00007FF74ECA0000-0x00007FF74F092000-memory.dmp	xmrig
behavioral2/memory/2724-2998-0x00007FF7DEB10000-0x00007FF7DEF02000-memory.dmp	xmrig
behavioral2/memory/2760-2960-0x00007FF7CCFE0000-0x00007FF7CD3D2000-memory.dmp	xmrig
behavioral2/memory/4896-2970-0x00007FF6C0340000-0x00007FF6C0732000-memory.dmp	xmrig
behavioral2/memory/4608-2969-0x00007FF63F6D0000-0x00007FF63FAC2000-memory.dmp	xmrig
behavioral2/memory/4504-2947-0x00007FF6634D0000-0x00007FF6638C2000-memory.dmp	xmrig
behavioral2/memory/4904-2946-0x00007FF755F80000-0x00007FF756372000-memory.dmp	xmrig
behavioral2/memory/4364-2957-0x00007FF649C40000-0x00007FF64A032000-memory.dmp	xmrig
behavioral2/memory/2012-2956-0x00007FF7C0F90000-0x00007FF7C1382000-memory.dmp	xmrig
behavioral2/memory/1636-2941-0x00007FF634F40000-0x00007FF635332000-memory.dmp	xmrig
behavioral2/memory/4104-3025-0x00007FF7D2E80000-0x00007FF7D3272000-memory.dmp	xmrig
behavioral2/memory/2968-3032-0x00007FF7DD2C0000-0x00007FF7DD6B2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	2004	powershell.exe
8	2004	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2004	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2676	ObIWUOc.exe
940	QLXhcTB.exe
4252	zcdQIeo.exe
4804	oBIJDzf.exe
668	rmzShrx.exe
3436	KzUIrJf.exe
3804	rgXqXnA.exe
1140	pDBKDgp.exe
2408	YouBYqF.exe
4672	GuLcUVn.exe
1352	SyXzieR.exe
2760	ctQYgGE.exe
2012	dGRsdre.exe
4364	wmajwyu.exe
1636	yWTOQwm.exe
4608	eygkDNp.exe
4104	oNmhXGv.exe
4896	nnvdnTU.exe
4504	MmohQFQ.exe
4904	yfckBqg.exe
2020	PgQjQEo.exe
2724	NnAgdMT.exe
2968	HUmaEwl.exe
1544	DwiwfXU.exe
3476	oCZoSiR.exe
5020	paFRhuc.exe
3016	XJsXqhO.exe
3064	TpIvClq.exe
4680	aTheYWm.exe
2964	tzIwZGV.exe
4568	EhQMdoN.exe
4684	EoSpvQA.exe
692	cbkALMv.exe
1224	ZIlFrwY.exe
2176	XZnlFIJ.exe
3864	EDWvtQp.exe
3352	UjPSmNJ.exe
3052	ZwLUXCc.exe
4148	ixwficI.exe
4880	gSVeJUi.exe
756	IDQFEjy.exe
4972	NLPYQkG.exe
2840	SWQifSF.exe
3508	SetmLSE.exe
4320	JHiVBjJ.exe
4768	ZcmntkJ.exe
556	TcwUfSJ.exe
4984	moUeDrO.exe
1512	uZjzSwJ.exe
4564	JYdkUlu.exe
2292	iZfZwxk.exe
4776	jOvshMq.exe
4544	psXeXgH.exe
4144	IsCYqVo.exe
452	zfkKJDR.exe
5004	TXVWIcr.exe
1464	cqGAqUY.exe
2756	InerzVk.exe
32	byPQQVn.exe
3404	LFRFjDs.exe
4292	modBPDk.exe
388	xvRVpuM.exe
4236	oIxmZQT.exe
3660	bMmDtfy.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2824-0-0x00007FF7DD900000-0x00007FF7DDCF2000-memory.dmp	upx
behavioral2/files/0x0007000000023413-8.dat	upx
behavioral2/files/0x0007000000023414-20.dat	upx
behavioral2/files/0x0007000000023415-30.dat	upx
behavioral2/memory/4804-39-0x00007FF69A100000-0x00007FF69A4F2000-memory.dmp	upx
behavioral2/files/0x0007000000023417-45.dat	upx
behavioral2/files/0x000700000002341b-53.dat	upx
behavioral2/files/0x000700000002341c-60.dat	upx
behavioral2/files/0x000700000002341d-77.dat	upx
behavioral2/files/0x000700000002341e-95.dat	upx
behavioral2/memory/4672-108-0x00007FF724850000-0x00007FF724C42000-memory.dmp	upx
behavioral2/files/0x0007000000023424-117.dat	upx
behavioral2/memory/4104-122-0x00007FF7D2E80000-0x00007FF7D3272000-memory.dmp	upx
behavioral2/memory/3436-125-0x00007FF7C6D20000-0x00007FF7C7112000-memory.dmp	upx
behavioral2/files/0x000700000002342b-165.dat	upx
behavioral2/files/0x000700000002342a-162.dat	upx
behavioral2/files/0x0007000000023431-193.dat	upx
behavioral2/memory/2724-217-0x00007FF7DEB10000-0x00007FF7DEF02000-memory.dmp	upx
behavioral2/memory/1544-226-0x00007FF74ECA0000-0x00007FF74F092000-memory.dmp	upx
behavioral2/memory/2968-238-0x00007FF7DD2C0000-0x00007FF7DD6B2000-memory.dmp	upx
behavioral2/files/0x0007000000023437-209.dat	upx
behavioral2/files/0x0007000000023436-208.dat	upx
behavioral2/files/0x0007000000023435-207.dat	upx
behavioral2/files/0x0007000000023434-204.dat	upx
behavioral2/files/0x0007000000023433-203.dat	upx
behavioral2/files/0x0007000000023427-199.dat	upx
behavioral2/files/0x0007000000023432-196.dat	upx
behavioral2/files/0x0007000000023430-192.dat	upx
behavioral2/files/0x0007000000023429-183.dat	upx
behavioral2/files/0x000700000002342f-182.dat	upx
behavioral2/files/0x000700000002342e-179.dat	upx
behavioral2/files/0x0008000000023428-176.dat	upx
behavioral2/files/0x0007000000023425-174.dat	upx
behavioral2/files/0x000700000002342d-171.dat	upx
behavioral2/files/0x000700000002342c-168.dat	upx
behavioral2/memory/2020-130-0x00007FF6AAE50000-0x00007FF6AB242000-memory.dmp	upx
behavioral2/memory/4504-129-0x00007FF6634D0000-0x00007FF6638C2000-memory.dmp	upx
behavioral2/memory/4896-128-0x00007FF6C0340000-0x00007FF6C0732000-memory.dmp	upx
behavioral2/memory/2012-127-0x00007FF7C0F90000-0x00007FF7C1382000-memory.dmp	upx
behavioral2/memory/2408-126-0x00007FF6AC270000-0x00007FF6AC662000-memory.dmp	upx
behavioral2/memory/4904-123-0x00007FF755F80000-0x00007FF756372000-memory.dmp	upx
behavioral2/memory/4608-121-0x00007FF63F6D0000-0x00007FF63FAC2000-memory.dmp	upx
behavioral2/memory/1636-120-0x00007FF634F40000-0x00007FF635332000-memory.dmp	upx
behavioral2/memory/4364-119-0x00007FF649C40000-0x00007FF64A032000-memory.dmp	upx
behavioral2/memory/2760-116-0x00007FF7CCFE0000-0x00007FF7CD3D2000-memory.dmp	upx
behavioral2/memory/1352-115-0x00007FF7FB480000-0x00007FF7FB872000-memory.dmp	upx
behavioral2/files/0x0008000000023410-113.dat	upx
behavioral2/files/0x0007000000023423-111.dat	upx
behavioral2/files/0x0007000000023422-109.dat	upx
behavioral2/files/0x0007000000023421-104.dat	upx
behavioral2/memory/1140-103-0x00007FF659AE0000-0x00007FF659ED2000-memory.dmp	upx
behavioral2/files/0x0007000000023420-99.dat	upx
behavioral2/files/0x000700000002341f-97.dat	upx
behavioral2/memory/3804-92-0x00007FF779130000-0x00007FF779522000-memory.dmp	upx
behavioral2/memory/668-83-0x00007FF698CB0000-0x00007FF6990A2000-memory.dmp	upx
behavioral2/files/0x000700000002341a-64.dat	upx
behavioral2/files/0x0007000000023419-58.dat	upx
behavioral2/files/0x0007000000023418-55.dat	upx
behavioral2/files/0x0007000000023416-42.dat	upx
behavioral2/memory/4252-34-0x00007FF60DE60000-0x00007FF60E252000-memory.dmp	upx
behavioral2/memory/940-31-0x00007FF7D0E20000-0x00007FF7D1212000-memory.dmp	upx
behavioral2/files/0x0008000000023412-18.dat	upx
behavioral2/memory/2676-12-0x00007FF7F1EF0000-0x00007FF7F22E2000-memory.dmp	upx
behavioral2/files/0x000600000002328f-6.dat	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
4	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\lLoxLEK.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\aVYgZtj.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\YuEJsVj.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\cfZcIan.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\PBBSrZH.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\BELbaTe.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\gAHqcKO.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\mvDbGlo.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\NQjmCPG.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\jhOQpwK.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\YExuKly.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\MiukxLe.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\KDlZGtl.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\YBaPrGn.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\Zxcjayi.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\hiHACdr.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\WEXvUew.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\yCsqMhz.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\ihDkiSv.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\gufAMiL.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\WvoRTZK.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\PzuwUmO.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\urlXJmy.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\uYvwhLG.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\ttUMFWX.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\YKnDMpx.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\RwTEbGP.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\bTnqSjJ.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\qLuTiML.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\NGazYLs.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\lusVoMJ.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\emAvRxR.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\kMxqgVg.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\maEHNvX.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\tkpqpeV.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\FQBEzjI.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\oMjUKuq.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\MmcLOJW.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\RiWcpwt.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\TnWmuTH.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\CxeUkLv.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\MySNLYz.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\EUGjAwy.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\RMBBmOY.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\erSxEyP.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\zoDbPoR.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\OtjdfPj.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\LCrrnEc.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\xfYREBq.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\mrYkrzc.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\DfJobmQ.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\hadItOp.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\WFsEhBK.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\dDXuGiZ.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\owdtRtl.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\zUqrIKB.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\nHUCOzz.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\JVYfQQL.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\WdosiHC.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\sGCEQHT.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\nILwnih.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\LIdGyEp.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\YqrgzJC.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
File created	C:\Windows\System\YSXpzdz.exe	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
Token: SeDebugPrivilege	2004	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 2004	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	84
PID 2824 wrote to memory of 2004	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	84
PID 2824 wrote to memory of 2676	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	85
PID 2824 wrote to memory of 2676	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	85
PID 2824 wrote to memory of 940	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	86
PID 2824 wrote to memory of 940	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	86
PID 2824 wrote to memory of 4252	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	87
PID 2824 wrote to memory of 4252	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	87
PID 2824 wrote to memory of 4804	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	88
PID 2824 wrote to memory of 4804	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	88
PID 2824 wrote to memory of 668	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	89
PID 2824 wrote to memory of 668	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	89
PID 2824 wrote to memory of 3436	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	90
PID 2824 wrote to memory of 3436	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	90
PID 2824 wrote to memory of 3804	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	91
PID 2824 wrote to memory of 3804	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	91
PID 2824 wrote to memory of 1140	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	92
PID 2824 wrote to memory of 1140	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	92
PID 2824 wrote to memory of 2408	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	93
PID 2824 wrote to memory of 2408	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	93
PID 2824 wrote to memory of 4672	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	94
PID 2824 wrote to memory of 4672	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	94
PID 2824 wrote to memory of 1352	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	95
PID 2824 wrote to memory of 1352	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	95
PID 2824 wrote to memory of 2760	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	96
PID 2824 wrote to memory of 2760	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	96
PID 2824 wrote to memory of 2012	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	97
PID 2824 wrote to memory of 2012	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	97
PID 2824 wrote to memory of 4364	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	98
PID 2824 wrote to memory of 4364	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	98
PID 2824 wrote to memory of 1636	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	99
PID 2824 wrote to memory of 1636	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	99
PID 2824 wrote to memory of 4608	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	100
PID 2824 wrote to memory of 4608	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	100
PID 2824 wrote to memory of 4104	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	101
PID 2824 wrote to memory of 4104	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	101
PID 2824 wrote to memory of 4896	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	102
PID 2824 wrote to memory of 4896	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	102
PID 2824 wrote to memory of 4504	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	103
PID 2824 wrote to memory of 4504	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	103
PID 2824 wrote to memory of 4904	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	104
PID 2824 wrote to memory of 4904	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	104
PID 2824 wrote to memory of 2020	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	105
PID 2824 wrote to memory of 2020	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	105
PID 2824 wrote to memory of 2724	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	106
PID 2824 wrote to memory of 2724	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	106
PID 2824 wrote to memory of 2968	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	107
PID 2824 wrote to memory of 2968	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	107
PID 2824 wrote to memory of 1544	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	108
PID 2824 wrote to memory of 1544	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	108
PID 2824 wrote to memory of 3476	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	109
PID 2824 wrote to memory of 3476	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	109
PID 2824 wrote to memory of 5020	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	110
PID 2824 wrote to memory of 5020	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	110
PID 2824 wrote to memory of 3016	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	111
PID 2824 wrote to memory of 3016	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	111
PID 2824 wrote to memory of 3064	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	112
PID 2824 wrote to memory of 3064	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	112
PID 2824 wrote to memory of 4680	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	113
PID 2824 wrote to memory of 4680	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	113
PID 2824 wrote to memory of 2964	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	114
PID 2824 wrote to memory of 2964	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	114
PID 2824 wrote to memory of 4568	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	115
PID 2824 wrote to memory of 4568	2824	3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2004
- C:\Windows\System\ObIWUOc.exe
  C:\Windows\System\ObIWUOc.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\QLXhcTB.exe
  C:\Windows\System\QLXhcTB.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\zcdQIeo.exe
  C:\Windows\System\zcdQIeo.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\oBIJDzf.exe
  C:\Windows\System\oBIJDzf.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\rmzShrx.exe
  C:\Windows\System\rmzShrx.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\KzUIrJf.exe
  C:\Windows\System\KzUIrJf.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\rgXqXnA.exe
  C:\Windows\System\rgXqXnA.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\pDBKDgp.exe
  C:\Windows\System\pDBKDgp.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\YouBYqF.exe
  C:\Windows\System\YouBYqF.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\GuLcUVn.exe
  C:\Windows\System\GuLcUVn.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\SyXzieR.exe
  C:\Windows\System\SyXzieR.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\ctQYgGE.exe
  C:\Windows\System\ctQYgGE.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\dGRsdre.exe
  C:\Windows\System\dGRsdre.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\wmajwyu.exe
  C:\Windows\System\wmajwyu.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\yWTOQwm.exe
  C:\Windows\System\yWTOQwm.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\eygkDNp.exe
  C:\Windows\System\eygkDNp.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\oNmhXGv.exe
  C:\Windows\System\oNmhXGv.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\nnvdnTU.exe
  C:\Windows\System\nnvdnTU.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\MmohQFQ.exe
  C:\Windows\System\MmohQFQ.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\yfckBqg.exe
  C:\Windows\System\yfckBqg.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\PgQjQEo.exe
  C:\Windows\System\PgQjQEo.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\NnAgdMT.exe
  C:\Windows\System\NnAgdMT.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\HUmaEwl.exe
  C:\Windows\System\HUmaEwl.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\DwiwfXU.exe
  C:\Windows\System\DwiwfXU.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\oCZoSiR.exe
  C:\Windows\System\oCZoSiR.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\paFRhuc.exe
  C:\Windows\System\paFRhuc.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\XJsXqhO.exe
  C:\Windows\System\XJsXqhO.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\TpIvClq.exe
  C:\Windows\System\TpIvClq.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\aTheYWm.exe
  C:\Windows\System\aTheYWm.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\tzIwZGV.exe
  C:\Windows\System\tzIwZGV.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\EhQMdoN.exe
  C:\Windows\System\EhQMdoN.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\EoSpvQA.exe
  C:\Windows\System\EoSpvQA.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\cbkALMv.exe
  C:\Windows\System\cbkALMv.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\ZIlFrwY.exe
  C:\Windows\System\ZIlFrwY.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\XZnlFIJ.exe
  C:\Windows\System\XZnlFIJ.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\EDWvtQp.exe
  C:\Windows\System\EDWvtQp.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System\UjPSmNJ.exe
  C:\Windows\System\UjPSmNJ.exe
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Windows\System\ZwLUXCc.exe
  C:\Windows\System\ZwLUXCc.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\ixwficI.exe
  C:\Windows\System\ixwficI.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\gSVeJUi.exe
  C:\Windows\System\gSVeJUi.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\IDQFEjy.exe
  C:\Windows\System\IDQFEjy.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\NLPYQkG.exe
  C:\Windows\System\NLPYQkG.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\SWQifSF.exe
  C:\Windows\System\SWQifSF.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\SetmLSE.exe
  C:\Windows\System\SetmLSE.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\JHiVBjJ.exe
  C:\Windows\System\JHiVBjJ.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\ZcmntkJ.exe
  C:\Windows\System\ZcmntkJ.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\TcwUfSJ.exe
  C:\Windows\System\TcwUfSJ.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\moUeDrO.exe
  C:\Windows\System\moUeDrO.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\uZjzSwJ.exe
  C:\Windows\System\uZjzSwJ.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\JYdkUlu.exe
  C:\Windows\System\JYdkUlu.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\iZfZwxk.exe
  C:\Windows\System\iZfZwxk.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\jOvshMq.exe
  C:\Windows\System\jOvshMq.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\psXeXgH.exe
  C:\Windows\System\psXeXgH.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\IsCYqVo.exe
  C:\Windows\System\IsCYqVo.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\zfkKJDR.exe
  C:\Windows\System\zfkKJDR.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\TXVWIcr.exe
  C:\Windows\System\TXVWIcr.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\cqGAqUY.exe
  C:\Windows\System\cqGAqUY.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\InerzVk.exe
  C:\Windows\System\InerzVk.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\byPQQVn.exe
  C:\Windows\System\byPQQVn.exe
  2⤵
  - Executes dropped EXE
  PID:32
- C:\Windows\System\TDXGQKM.exe
  C:\Windows\System\TDXGQKM.exe
  2⤵
  PID:4048
- C:\Windows\System\LFRFjDs.exe
  C:\Windows\System\LFRFjDs.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\modBPDk.exe
  C:\Windows\System\modBPDk.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\xvRVpuM.exe
  C:\Windows\System\xvRVpuM.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\oIxmZQT.exe
  C:\Windows\System\oIxmZQT.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System\bMmDtfy.exe
  C:\Windows\System\bMmDtfy.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\dTDirbV.exe
  C:\Windows\System\dTDirbV.exe
  2⤵
  PID:5080
- C:\Windows\System\KjSjXQX.exe
  C:\Windows\System\KjSjXQX.exe
  2⤵
  PID:3540
- C:\Windows\System\xWSCSKK.exe
  C:\Windows\System\xWSCSKK.exe
  2⤵
  PID:1012
- C:\Windows\System\cZuwYhr.exe
  C:\Windows\System\cZuwYhr.exe
  2⤵
  PID:2024
- C:\Windows\System\laqUbFO.exe
  C:\Windows\System\laqUbFO.exe
  2⤵
  PID:1348
- C:\Windows\System\eFywQVH.exe
  C:\Windows\System\eFywQVH.exe
  2⤵
  PID:1340
- C:\Windows\System\IrrAQjy.exe
  C:\Windows\System\IrrAQjy.exe
  2⤵
  PID:1724
- C:\Windows\System\bsgHhHP.exe
  C:\Windows\System\bsgHhHP.exe
  2⤵
  PID:3164
- C:\Windows\System\UKbxwFz.exe
  C:\Windows\System\UKbxwFz.exe
  2⤵
  PID:3892
- C:\Windows\System\IvQslaj.exe
  C:\Windows\System\IvQslaj.exe
  2⤵
  PID:3932
- C:\Windows\System\gDSsfXa.exe
  C:\Windows\System\gDSsfXa.exe
  2⤵
  PID:2288
- C:\Windows\System\ZVfaDSe.exe
  C:\Windows\System\ZVfaDSe.exe
  2⤵
  PID:2592
- C:\Windows\System\okMMWlw.exe
  C:\Windows\System\okMMWlw.exe
  2⤵
  PID:1356
- C:\Windows\System\nRQcUvz.exe
  C:\Windows\System\nRQcUvz.exe
  2⤵
  PID:2884
- C:\Windows\System\vKEhaIu.exe
  C:\Windows\System\vKEhaIu.exe
  2⤵
  PID:2708
- C:\Windows\System\jceHEVO.exe
  C:\Windows\System\jceHEVO.exe
  2⤵
  PID:3088
- C:\Windows\System\NtkAdOr.exe
  C:\Windows\System\NtkAdOr.exe
  2⤵
  PID:512
- C:\Windows\System\xOEAwQg.exe
  C:\Windows\System\xOEAwQg.exe
  2⤵
  PID:2696
- C:\Windows\System\bEWlLBZ.exe
  C:\Windows\System\bEWlLBZ.exe
  2⤵
  PID:4464
- C:\Windows\System\gFfyFYR.exe
  C:\Windows\System\gFfyFYR.exe
  2⤵
  PID:4476
- C:\Windows\System\tAwmcyX.exe
  C:\Windows\System\tAwmcyX.exe
  2⤵
  PID:3108
- C:\Windows\System\JDIKjZW.exe
  C:\Windows\System\JDIKjZW.exe
  2⤵
  PID:2232
- C:\Windows\System\aHJAbiA.exe
  C:\Windows\System\aHJAbiA.exe
  2⤵
  PID:3144
- C:\Windows\System\fpnIEel.exe
  C:\Windows\System\fpnIEel.exe
  2⤵
  PID:3576
- C:\Windows\System\NtbNBWo.exe
  C:\Windows\System\NtbNBWo.exe
  2⤵
  PID:4592
- C:\Windows\System\juaGWFw.exe
  C:\Windows\System\juaGWFw.exe
  2⤵
  PID:1508
- C:\Windows\System\ViZdbVe.exe
  C:\Windows\System\ViZdbVe.exe
  2⤵
  PID:4100
- C:\Windows\System\KxbyGYm.exe
  C:\Windows\System\KxbyGYm.exe
  2⤵
  PID:1436
- C:\Windows\System\QgdaQJB.exe
  C:\Windows\System\QgdaQJB.exe
  2⤵
  PID:772
- C:\Windows\System\mljjleP.exe
  C:\Windows\System\mljjleP.exe
  2⤵
  PID:1420
- C:\Windows\System\wteXwKn.exe
  C:\Windows\System\wteXwKn.exe
  2⤵
  PID:4468
- C:\Windows\System\aGZWPTN.exe
  C:\Windows\System\aGZWPTN.exe
  2⤵
  PID:2464
- C:\Windows\System\ubdEmoN.exe
  C:\Windows\System\ubdEmoN.exe
  2⤵
  PID:3824
- C:\Windows\System\oLsJYOc.exe
  C:\Windows\System\oLsJYOc.exe
  2⤵
  PID:3348
- C:\Windows\System\wGSpfKP.exe
  C:\Windows\System\wGSpfKP.exe
  2⤵
  PID:4484
- C:\Windows\System\DvcHnRK.exe
  C:\Windows\System\DvcHnRK.exe
  2⤵
  PID:4916
- C:\Windows\System\pdntpRf.exe
  C:\Windows\System\pdntpRf.exe
  2⤵
  PID:5132
- C:\Windows\System\KxbkFDk.exe
  C:\Windows\System\KxbkFDk.exe
  2⤵
  PID:5152
- C:\Windows\System\eRXNmPv.exe
  C:\Windows\System\eRXNmPv.exe
  2⤵
  PID:5172
- C:\Windows\System\obPuSwy.exe
  C:\Windows\System\obPuSwy.exe
  2⤵
  PID:5200
- C:\Windows\System\QzkAvxA.exe
  C:\Windows\System\QzkAvxA.exe
  2⤵
  PID:5220
- C:\Windows\System\lkyRRTp.exe
  C:\Windows\System\lkyRRTp.exe
  2⤵
  PID:5248
- C:\Windows\System\mvPMXfA.exe
  C:\Windows\System\mvPMXfA.exe
  2⤵
  PID:5272
- C:\Windows\System\wFrIUOa.exe
  C:\Windows\System\wFrIUOa.exe
  2⤵
  PID:5300
- C:\Windows\System\htsqAcg.exe
  C:\Windows\System\htsqAcg.exe
  2⤵
  PID:5320
- C:\Windows\System\BYYCGMG.exe
  C:\Windows\System\BYYCGMG.exe
  2⤵
  PID:5352
- C:\Windows\System\gBBPtsJ.exe
  C:\Windows\System\gBBPtsJ.exe
  2⤵
  PID:5372
- C:\Windows\System\iWNezqY.exe
  C:\Windows\System\iWNezqY.exe
  2⤵
  PID:5392
- C:\Windows\System\HFpQyXW.exe
  C:\Windows\System\HFpQyXW.exe
  2⤵
  PID:5420
- C:\Windows\System\GASVsTh.exe
  C:\Windows\System\GASVsTh.exe
  2⤵
  PID:5444
- C:\Windows\System\fdLIGmr.exe
  C:\Windows\System\fdLIGmr.exe
  2⤵
  PID:5468
- C:\Windows\System\nhrACWe.exe
  C:\Windows\System\nhrACWe.exe
  2⤵
  PID:5488
- C:\Windows\System\uXtmgXL.exe
  C:\Windows\System\uXtmgXL.exe
  2⤵
  PID:5520
- C:\Windows\System\BOSUSBw.exe
  C:\Windows\System\BOSUSBw.exe
  2⤵
  PID:5540
- C:\Windows\System\BgcHjyv.exe
  C:\Windows\System\BgcHjyv.exe
  2⤵
  PID:5564
- C:\Windows\System\ultQVBa.exe
  C:\Windows\System\ultQVBa.exe
  2⤵
  PID:5588
- C:\Windows\System\YPWWhva.exe
  C:\Windows\System\YPWWhva.exe
  2⤵
  PID:5612
- C:\Windows\System\LgvmWvs.exe
  C:\Windows\System\LgvmWvs.exe
  2⤵
  PID:5644
- C:\Windows\System\iMdqCzG.exe
  C:\Windows\System\iMdqCzG.exe
  2⤵
  PID:5668
- C:\Windows\System\yZfKEVs.exe
  C:\Windows\System\yZfKEVs.exe
  2⤵
  PID:5692
- C:\Windows\System\JECmEjZ.exe
  C:\Windows\System\JECmEjZ.exe
  2⤵
  PID:5716
- C:\Windows\System\FpfQETu.exe
  C:\Windows\System\FpfQETu.exe
  2⤵
  PID:5732
- C:\Windows\System\RiWcpwt.exe
  C:\Windows\System\RiWcpwt.exe
  2⤵
  PID:5756
- C:\Windows\System\zoBhMJk.exe
  C:\Windows\System\zoBhMJk.exe
  2⤵
  PID:5780
- C:\Windows\System\FoyGPqz.exe
  C:\Windows\System\FoyGPqz.exe
  2⤵
  PID:5808
- C:\Windows\System\aNyRWSH.exe
  C:\Windows\System\aNyRWSH.exe
  2⤵
  PID:5840
- C:\Windows\System\bSMUwrg.exe
  C:\Windows\System\bSMUwrg.exe
  2⤵
  PID:5860
- C:\Windows\System\jSElfaC.exe
  C:\Windows\System\jSElfaC.exe
  2⤵
  PID:5880
- C:\Windows\System\rxNBMTb.exe
  C:\Windows\System\rxNBMTb.exe
  2⤵
  PID:5904
- C:\Windows\System\OFpHAJl.exe
  C:\Windows\System\OFpHAJl.exe
  2⤵
  PID:5928
- C:\Windows\System\uBJdYbr.exe
  C:\Windows\System\uBJdYbr.exe
  2⤵
  PID:5952
- C:\Windows\System\KEULzBZ.exe
  C:\Windows\System\KEULzBZ.exe
  2⤵
  PID:5976
- C:\Windows\System\cnnpRJc.exe
  C:\Windows\System\cnnpRJc.exe
  2⤵
  PID:6004
- C:\Windows\System\YyPLpdq.exe
  C:\Windows\System\YyPLpdq.exe
  2⤵
  PID:6020
- C:\Windows\System\UYpwEtg.exe
  C:\Windows\System\UYpwEtg.exe
  2⤵
  PID:6048
- C:\Windows\System\vngXGcv.exe
  C:\Windows\System\vngXGcv.exe
  2⤵
  PID:6072
- C:\Windows\System\QtTJqCd.exe
  C:\Windows\System\QtTJqCd.exe
  2⤵
  PID:6092
- C:\Windows\System\HDfmSlD.exe
  C:\Windows\System\HDfmSlD.exe
  2⤵
  PID:6116
- C:\Windows\System\SnPVCHE.exe
  C:\Windows\System\SnPVCHE.exe
  2⤵
  PID:3572
- C:\Windows\System\tfTqnSg.exe
  C:\Windows\System\tfTqnSg.exe
  2⤵
  PID:5084
- C:\Windows\System\GdEiPgg.exe
  C:\Windows\System\GdEiPgg.exe
  2⤵
  PID:4852
- C:\Windows\System\ckPdESK.exe
  C:\Windows\System\ckPdESK.exe
  2⤵
  PID:2336
- C:\Windows\System\JoMubmm.exe
  C:\Windows\System\JoMubmm.exe
  2⤵
  PID:2268
- C:\Windows\System\PHAHuru.exe
  C:\Windows\System\PHAHuru.exe
  2⤵
  PID:4332
- C:\Windows\System\isRomLd.exe
  C:\Windows\System\isRomLd.exe
  2⤵
  PID:5260
- C:\Windows\System\ofzoRQO.exe
  C:\Windows\System\ofzoRQO.exe
  2⤵
  PID:5124
- C:\Windows\System\YLXfWAR.exe
  C:\Windows\System\YLXfWAR.exe
  2⤵
  PID:5348
- C:\Windows\System\JQOaRYh.exe
  C:\Windows\System\JQOaRYh.exe
  2⤵
  PID:5400
- C:\Windows\System\uOEPKJm.exe
  C:\Windows\System\uOEPKJm.exe
  2⤵
  PID:5168
- C:\Windows\System\EcoAeEf.exe
  C:\Windows\System\EcoAeEf.exe
  2⤵
  PID:5212
- C:\Windows\System\wvLoWju.exe
  C:\Windows\System\wvLoWju.exe
  2⤵
  PID:5256
- C:\Windows\System\gRUYPpu.exe
  C:\Windows\System\gRUYPpu.exe
  2⤵
  PID:5728
- C:\Windows\System\XNACCdI.exe
  C:\Windows\System\XNACCdI.exe
  2⤵
  PID:5512
- C:\Windows\System\cxAmjms.exe
  C:\Windows\System\cxAmjms.exe
  2⤵
  PID:5936
- C:\Windows\System\CIJAOmc.exe
  C:\Windows\System\CIJAOmc.exe
  2⤵
  PID:5432
- C:\Windows\System\BQiwAcy.exe
  C:\Windows\System\BQiwAcy.exe
  2⤵
  PID:5652
- C:\Windows\System\BHnhpLv.exe
  C:\Windows\System\BHnhpLv.exe
  2⤵
  PID:6132
- C:\Windows\System\XEwMPPI.exe
  C:\Windows\System\XEwMPPI.exe
  2⤵
  PID:5824
- C:\Windows\System\QwDbUNB.exe
  C:\Windows\System\QwDbUNB.exe
  2⤵
  PID:5872
- C:\Windows\System\XhTTQRM.exe
  C:\Windows\System\XhTTQRM.exe
  2⤵
  PID:5900
- C:\Windows\System\FqYWSGE.exe
  C:\Windows\System\FqYWSGE.exe
  2⤵
  PID:5996
- C:\Windows\System\ZJEdRHE.exe
  C:\Windows\System\ZJEdRHE.exe
  2⤵
  PID:6148
- C:\Windows\System\WmwQzOh.exe
  C:\Windows\System\WmwQzOh.exe
  2⤵
  PID:6168
- C:\Windows\System\HfrEFUh.exe
  C:\Windows\System\HfrEFUh.exe
  2⤵
  PID:6192
- C:\Windows\System\lllzmXT.exe
  C:\Windows\System\lllzmXT.exe
  2⤵
  PID:6216
- C:\Windows\System\qogofkn.exe
  C:\Windows\System\qogofkn.exe
  2⤵
  PID:6236
- C:\Windows\System\uJTslSH.exe
  C:\Windows\System\uJTslSH.exe
  2⤵
  PID:6256
- C:\Windows\System\tNHWuwb.exe
  C:\Windows\System\tNHWuwb.exe
  2⤵
  PID:6284
- C:\Windows\System\FjPpVOv.exe
  C:\Windows\System\FjPpVOv.exe
  2⤵
  PID:6304
- C:\Windows\System\jcdcLhG.exe
  C:\Windows\System\jcdcLhG.exe
  2⤵
  PID:6328
- C:\Windows\System\MriaCxa.exe
  C:\Windows\System\MriaCxa.exe
  2⤵
  PID:6352
- C:\Windows\System\HWpVVae.exe
  C:\Windows\System\HWpVVae.exe
  2⤵
  PID:6372
- C:\Windows\System\WolrJRH.exe
  C:\Windows\System\WolrJRH.exe
  2⤵
  PID:6400
- C:\Windows\System\sIFcENT.exe
  C:\Windows\System\sIFcENT.exe
  2⤵
  PID:6424
- C:\Windows\System\ajNiuOv.exe
  C:\Windows\System\ajNiuOv.exe
  2⤵
  PID:6440
- C:\Windows\System\bYiYJbe.exe
  C:\Windows\System\bYiYJbe.exe
  2⤵
  PID:6464
- C:\Windows\System\IFZEFix.exe
  C:\Windows\System\IFZEFix.exe
  2⤵
  PID:6488
- C:\Windows\System\IVGMMdx.exe
  C:\Windows\System\IVGMMdx.exe
  2⤵
  PID:6512
- C:\Windows\System\KQKLLAV.exe
  C:\Windows\System\KQKLLAV.exe
  2⤵
  PID:6536
- C:\Windows\System\YkYnWfP.exe
  C:\Windows\System\YkYnWfP.exe
  2⤵
  PID:6564
- C:\Windows\System\LZgrEUW.exe
  C:\Windows\System\LZgrEUW.exe
  2⤵
  PID:6584
- C:\Windows\System\VzSHkop.exe
  C:\Windows\System\VzSHkop.exe
  2⤵
  PID:6612
- C:\Windows\System\pIUcShn.exe
  C:\Windows\System\pIUcShn.exe
  2⤵
  PID:6640
- C:\Windows\System\YQUdmWh.exe
  C:\Windows\System\YQUdmWh.exe
  2⤵
  PID:6660
- C:\Windows\System\ollIjEp.exe
  C:\Windows\System\ollIjEp.exe
  2⤵
  PID:6684
- C:\Windows\System\xKvcSWy.exe
  C:\Windows\System\xKvcSWy.exe
  2⤵
  PID:6712
- C:\Windows\System\hivsYyI.exe
  C:\Windows\System\hivsYyI.exe
  2⤵
  PID:6732
- C:\Windows\System\YoFPlBU.exe
  C:\Windows\System\YoFPlBU.exe
  2⤵
  PID:6752
- C:\Windows\System\kPEtWFd.exe
  C:\Windows\System\kPEtWFd.exe
  2⤵
  PID:6780
- C:\Windows\System\UIpxhrg.exe
  C:\Windows\System\UIpxhrg.exe
  2⤵
  PID:6808
- C:\Windows\System\xSQzAtB.exe
  C:\Windows\System\xSQzAtB.exe
  2⤵
  PID:6836
- C:\Windows\System\FRVQioz.exe
  C:\Windows\System\FRVQioz.exe
  2⤵
  PID:6860
- C:\Windows\System\VTZiLrg.exe
  C:\Windows\System\VTZiLrg.exe
  2⤵
  PID:6880
- C:\Windows\System\RFWvymm.exe
  C:\Windows\System\RFWvymm.exe
  2⤵
  PID:6912
- C:\Windows\System\lJqNRaW.exe
  C:\Windows\System\lJqNRaW.exe
  2⤵
  PID:6936
- C:\Windows\System\aQxaUlq.exe
  C:\Windows\System\aQxaUlq.exe
  2⤵
  PID:6964
- C:\Windows\System\yepLKsq.exe
  C:\Windows\System\yepLKsq.exe
  2⤵
  PID:6984
- C:\Windows\System\WemIJIZ.exe
  C:\Windows\System\WemIJIZ.exe
  2⤵
  PID:7004
- C:\Windows\System\gplqIEZ.exe
  C:\Windows\System\gplqIEZ.exe
  2⤵
  PID:7032
- C:\Windows\System\reHqNuC.exe
  C:\Windows\System\reHqNuC.exe
  2⤵
  PID:7056
- C:\Windows\System\QCbDNkl.exe
  C:\Windows\System\QCbDNkl.exe
  2⤵
  PID:7080
- C:\Windows\System\TYnZdQm.exe
  C:\Windows\System\TYnZdQm.exe
  2⤵
  PID:7100
- C:\Windows\System\yWVIpKc.exe
  C:\Windows\System\yWVIpKc.exe
  2⤵
  PID:7128
- C:\Windows\System\kRCSoNV.exe
  C:\Windows\System\kRCSoNV.exe
  2⤵
  PID:7148
- C:\Windows\System\dHLaGWa.exe
  C:\Windows\System\dHLaGWa.exe
  2⤵
  PID:5240
- C:\Windows\System\tIFxFgY.exe
  C:\Windows\System\tIFxFgY.exe
  2⤵
  PID:5748
- C:\Windows\System\jMYgRRK.exe
  C:\Windows\System\jMYgRRK.exe
  2⤵
  PID:2504
- C:\Windows\System\nblfzKF.exe
  C:\Windows\System\nblfzKF.exe
  2⤵
  PID:4380
- C:\Windows\System\yloyuFz.exe
  C:\Windows\System\yloyuFz.exe
  2⤵
  PID:5604
- C:\Windows\System\qhDlglt.exe
  C:\Windows\System\qhDlglt.exe
  2⤵
  PID:5972
- C:\Windows\System\UtpgSeX.exe
  C:\Windows\System\UtpgSeX.exe
  2⤵
  PID:6044
- C:\Windows\System\EnuADTj.exe
  C:\Windows\System\EnuADTj.exe
  2⤵
  PID:6176
- C:\Windows\System\CIcovEA.exe
  C:\Windows\System\CIcovEA.exe
  2⤵
  PID:6228
- C:\Windows\System\fsRYRjX.exe
  C:\Windows\System\fsRYRjX.exe
  2⤵
  PID:6312
- C:\Windows\System\ETiAOmE.exe
  C:\Windows\System\ETiAOmE.exe
  2⤵
  PID:6348
- C:\Windows\System\IGdBROc.exe
  C:\Windows\System\IGdBROc.exe
  2⤵
  PID:4860
- C:\Windows\System\qtPOyzu.exe
  C:\Windows\System\qtPOyzu.exe
  2⤵
  PID:5316
- C:\Windows\System\PxnaMLI.exe
  C:\Windows\System\PxnaMLI.exe
  2⤵
  PID:6500
- C:\Windows\System\yIPrDrK.exe
  C:\Windows\System\yIPrDrK.exe
  2⤵
  PID:4304
- C:\Windows\System\AmJrIXq.exe
  C:\Windows\System\AmJrIXq.exe
  2⤵
  PID:6252
- C:\Windows\System\aNZlxeu.exe
  C:\Windows\System\aNZlxeu.exe
  2⤵
  PID:6380
- C:\Windows\System\FJTKSAO.exe
  C:\Windows\System\FJTKSAO.exe
  2⤵
  PID:6472
- C:\Windows\System\cqKKzul.exe
  C:\Windows\System\cqKKzul.exe
  2⤵
  PID:7092
- C:\Windows\System\lISZpor.exe
  C:\Windows\System\lISZpor.exe
  2⤵
  PID:7136
- C:\Windows\System\eWnDAgg.exe
  C:\Windows\System\eWnDAgg.exe
  2⤵
  PID:5660
- C:\Windows\System\ltxrwhX.exe
  C:\Windows\System\ltxrwhX.exe
  2⤵
  PID:6848
- C:\Windows\System\JYxsAVM.exe
  C:\Windows\System\JYxsAVM.exe
  2⤵
  PID:6420
- C:\Windows\System\rrpuTAj.exe
  C:\Windows\System\rrpuTAj.exe
  2⤵
  PID:6928
- C:\Windows\System\oltUFYg.exe
  C:\Windows\System\oltUFYg.exe
  2⤵
  PID:7000
- C:\Windows\System\llYsBFl.exe
  C:\Windows\System\llYsBFl.exe
  2⤵
  PID:7064
- C:\Windows\System\yCDjFnt.exe
  C:\Windows\System\yCDjFnt.exe
  2⤵
  PID:7184
- C:\Windows\System\wzTPxyW.exe
  C:\Windows\System\wzTPxyW.exe
  2⤵
  PID:7212
- C:\Windows\System\JoMJBxE.exe
  C:\Windows\System\JoMJBxE.exe
  2⤵
  PID:7244
- C:\Windows\System\SDwLyvB.exe
  C:\Windows\System\SDwLyvB.exe
  2⤵
  PID:7264
- C:\Windows\System\aHiokhA.exe
  C:\Windows\System\aHiokhA.exe
  2⤵
  PID:7288
- C:\Windows\System\MSCxpPT.exe
  C:\Windows\System\MSCxpPT.exe
  2⤵
  PID:7316
- C:\Windows\System\gQHJTrp.exe
  C:\Windows\System\gQHJTrp.exe
  2⤵
  PID:7340
- C:\Windows\System\ITLlJHq.exe
  C:\Windows\System\ITLlJHq.exe
  2⤵
  PID:7368
- C:\Windows\System\SEnIzLq.exe
  C:\Windows\System\SEnIzLq.exe
  2⤵
  PID:7388
- C:\Windows\System\NpRbUQj.exe
  C:\Windows\System\NpRbUQj.exe
  2⤵
  PID:7412
- C:\Windows\System\PveHkfn.exe
  C:\Windows\System\PveHkfn.exe
  2⤵
  PID:7444
- C:\Windows\System\zYfEMyu.exe
  C:\Windows\System\zYfEMyu.exe
  2⤵
  PID:7464
- C:\Windows\System\VUnuDmv.exe
  C:\Windows\System\VUnuDmv.exe
  2⤵
  PID:7488
- C:\Windows\System\nXdkirP.exe
  C:\Windows\System\nXdkirP.exe
  2⤵
  PID:7516
- C:\Windows\System\MMWULpv.exe
  C:\Windows\System\MMWULpv.exe
  2⤵
  PID:7536
- C:\Windows\System\qwUvKYQ.exe
  C:\Windows\System\qwUvKYQ.exe
  2⤵
  PID:7564
- C:\Windows\System\ssHZEhr.exe
  C:\Windows\System\ssHZEhr.exe
  2⤵
  PID:7584
- C:\Windows\System\XMYUMPn.exe
  C:\Windows\System\XMYUMPn.exe
  2⤵
  PID:7608
- C:\Windows\System\PlRKsaR.exe
  C:\Windows\System\PlRKsaR.exe
  2⤵
  PID:7640
- C:\Windows\System\ZoAcVOa.exe
  C:\Windows\System\ZoAcVOa.exe
  2⤵
  PID:7660
- C:\Windows\System\uTKCQdd.exe
  C:\Windows\System\uTKCQdd.exe
  2⤵
  PID:7684
- C:\Windows\System\JgKroro.exe
  C:\Windows\System\JgKroro.exe
  2⤵
  PID:7708
- C:\Windows\System\MUWuuoF.exe
  C:\Windows\System\MUWuuoF.exe
  2⤵
  PID:7728
- C:\Windows\System\hEgEQPe.exe
  C:\Windows\System\hEgEQPe.exe
  2⤵
  PID:7756
- C:\Windows\System\rqlSllF.exe
  C:\Windows\System\rqlSllF.exe
  2⤵
  PID:7780
- C:\Windows\System\wlRmxBg.exe
  C:\Windows\System\wlRmxBg.exe
  2⤵
  PID:7804
- C:\Windows\System\UeCRxwc.exe
  C:\Windows\System\UeCRxwc.exe
  2⤵
  PID:7828
- C:\Windows\System\pdpXaUT.exe
  C:\Windows\System\pdpXaUT.exe
  2⤵
  PID:7860
- C:\Windows\System\WmVPqIy.exe
  C:\Windows\System\WmVPqIy.exe
  2⤵
  PID:7884
- C:\Windows\System\RYvbHOq.exe
  C:\Windows\System\RYvbHOq.exe
  2⤵
  PID:7904
- C:\Windows\System\SzSwGjt.exe
  C:\Windows\System\SzSwGjt.exe
  2⤵
  PID:7928
- C:\Windows\System\uQJwZzT.exe
  C:\Windows\System\uQJwZzT.exe
  2⤵
  PID:7956
- C:\Windows\System\ByuARJY.exe
  C:\Windows\System\ByuARJY.exe
  2⤵
  PID:7976
- C:\Windows\System\xyWAMQh.exe
  C:\Windows\System\xyWAMQh.exe
  2⤵
  PID:8004
- C:\Windows\System\UPwxVwJ.exe
  C:\Windows\System\UPwxVwJ.exe
  2⤵
  PID:8028
- C:\Windows\System\LdogbRN.exe
  C:\Windows\System\LdogbRN.exe
  2⤵
  PID:8044
- C:\Windows\System\tzLFhYI.exe
  C:\Windows\System\tzLFhYI.exe
  2⤵
  PID:8072
- C:\Windows\System\LaJCsxG.exe
  C:\Windows\System\LaJCsxG.exe
  2⤵
  PID:8096
- C:\Windows\System\NCZVJHB.exe
  C:\Windows\System\NCZVJHB.exe
  2⤵
  PID:8120
- C:\Windows\System\UVCwVGH.exe
  C:\Windows\System\UVCwVGH.exe
  2⤵
  PID:8140
- C:\Windows\System\lkBmGVV.exe
  C:\Windows\System\lkBmGVV.exe
  2⤵
  PID:8160
- C:\Windows\System\aBplIhp.exe
  C:\Windows\System\aBplIhp.exe
  2⤵
  PID:8184
- C:\Windows\System\fxTJswc.exe
  C:\Windows\System\fxTJswc.exe
  2⤵
  PID:2196
- C:\Windows\System\hYEEVXr.exe
  C:\Windows\System\hYEEVXr.exe
  2⤵
  PID:5572
- C:\Windows\System\Cddwuoi.exe
  C:\Windows\System\Cddwuoi.exe
  2⤵
  PID:5228
- C:\Windows\System\yysDrEt.exe
  C:\Windows\System\yysDrEt.exe
  2⤵
  PID:6672
- C:\Windows\System\gEfHkzn.exe
  C:\Windows\System\gEfHkzn.exe
  2⤵
  PID:6344
- C:\Windows\System\ZhJLNBQ.exe
  C:\Windows\System\ZhJLNBQ.exe
  2⤵
  PID:5800
- C:\Windows\System\febUViK.exe
  C:\Windows\System\febUViK.exe
  2⤵
  PID:6844
- C:\Windows\System\zVMVzby.exe
  C:\Windows\System\zVMVzby.exe
  2⤵
  PID:6908
- C:\Windows\System\tgfWYaL.exe
  C:\Windows\System\tgfWYaL.exe
  2⤵
  PID:6980
- C:\Windows\System\lIazKaQ.exe
  C:\Windows\System\lIazKaQ.exe
  2⤵
  PID:7076
- C:\Windows\System\NWIdRDZ.exe
  C:\Windows\System\NWIdRDZ.exe
  2⤵
  PID:7144
- C:\Windows\System\XzMuWHV.exe
  C:\Windows\System\XzMuWHV.exe
  2⤵
  PID:7220
- C:\Windows\System\tAmUBcm.exe
  C:\Windows\System\tAmUBcm.exe
  2⤵
  PID:7160
- C:\Windows\System\ZpZbFFR.exe
  C:\Windows\System\ZpZbFFR.exe
  2⤵
  PID:7496
- C:\Windows\System\QnlSwRR.exe
  C:\Windows\System\QnlSwRR.exe
  2⤵
  PID:7528
- C:\Windows\System\exYCWTf.exe
  C:\Windows\System\exYCWTf.exe
  2⤵
  PID:7556
- C:\Windows\System\uKPCFwI.exe
  C:\Windows\System\uKPCFwI.exe
  2⤵
  PID:5948
- C:\Windows\System\VUYaZUN.exe
  C:\Windows\System\VUYaZUN.exe
  2⤵
  PID:7936
- C:\Windows\System\BEYoNrI.exe
  C:\Windows\System\BEYoNrI.exe
  2⤵
  PID:8012
- C:\Windows\System\GybBDLx.exe
  C:\Windows\System\GybBDLx.exe
  2⤵
  PID:5268
- C:\Windows\System\lLoxLEK.exe
  C:\Windows\System\lLoxLEK.exe
  2⤵
  PID:8212
- C:\Windows\System\qMksLhl.exe
  C:\Windows\System\qMksLhl.exe
  2⤵
  PID:8236
- C:\Windows\System\DyFUwRG.exe
  C:\Windows\System\DyFUwRG.exe
  2⤵
  PID:8256
- C:\Windows\System\lWhCQoG.exe
  C:\Windows\System\lWhCQoG.exe
  2⤵
  PID:8276
- C:\Windows\System\JIqKOid.exe
  C:\Windows\System\JIqKOid.exe
  2⤵
  PID:8300
- C:\Windows\System\kezXTOX.exe
  C:\Windows\System\kezXTOX.exe
  2⤵
  PID:8320
- C:\Windows\System\aJZQWCE.exe
  C:\Windows\System\aJZQWCE.exe
  2⤵
  PID:8344
- C:\Windows\System\hOQKoeD.exe
  C:\Windows\System\hOQKoeD.exe
  2⤵
  PID:8372
- C:\Windows\System\kuBNyIR.exe
  C:\Windows\System\kuBNyIR.exe
  2⤵
  PID:8392
- C:\Windows\System\SCfJphe.exe
  C:\Windows\System\SCfJphe.exe
  2⤵
  PID:8412
- C:\Windows\System\WiTjWmR.exe
  C:\Windows\System\WiTjWmR.exe
  2⤵
  PID:8436
- C:\Windows\System\NzPFnpu.exe
  C:\Windows\System\NzPFnpu.exe
  2⤵
  PID:8460
- C:\Windows\System\pFQepBb.exe
  C:\Windows\System\pFQepBb.exe
  2⤵
  PID:8480
- C:\Windows\System\ReBdblF.exe
  C:\Windows\System\ReBdblF.exe
  2⤵
  PID:8504
- C:\Windows\System\SXnfbjX.exe
  C:\Windows\System\SXnfbjX.exe
  2⤵
  PID:8528
- C:\Windows\System\eJfJfFS.exe
  C:\Windows\System\eJfJfFS.exe
  2⤵
  PID:8560
- C:\Windows\System\bdXSmSZ.exe
  C:\Windows\System\bdXSmSZ.exe
  2⤵
  PID:8584
- C:\Windows\System\JmKtYVE.exe
  C:\Windows\System\JmKtYVE.exe
  2⤵
  PID:8616
- C:\Windows\System\YDQUQKu.exe
  C:\Windows\System\YDQUQKu.exe
  2⤵
  PID:8640
- C:\Windows\System\dObcCnS.exe
  C:\Windows\System\dObcCnS.exe
  2⤵
  PID:8660
- C:\Windows\System\LseBDTn.exe
  C:\Windows\System\LseBDTn.exe
  2⤵
  PID:8676
- C:\Windows\System\yhRBPIx.exe
  C:\Windows\System\yhRBPIx.exe
  2⤵
  PID:8692
- C:\Windows\System\qqhPETO.exe
  C:\Windows\System\qqhPETO.exe
  2⤵
  PID:8716
- C:\Windows\System\mcMGBKL.exe
  C:\Windows\System\mcMGBKL.exe
  2⤵
  PID:8740
- C:\Windows\System\WmCuNam.exe
  C:\Windows\System\WmCuNam.exe
  2⤵
  PID:8768
- C:\Windows\System\QjlGgEW.exe
  C:\Windows\System\QjlGgEW.exe
  2⤵
  PID:8796
- C:\Windows\System\BRfCSGc.exe
  C:\Windows\System\BRfCSGc.exe
  2⤵
  PID:8820
- C:\Windows\System\eelmERv.exe
  C:\Windows\System\eelmERv.exe
  2⤵
  PID:8844
- C:\Windows\System\SXgfUSI.exe
  C:\Windows\System\SXgfUSI.exe
  2⤵
  PID:8872
- C:\Windows\System\tgMEsdS.exe
  C:\Windows\System\tgMEsdS.exe
  2⤵
  PID:8892
- C:\Windows\System\KtYITbH.exe
  C:\Windows\System\KtYITbH.exe
  2⤵
  PID:8916
- C:\Windows\System\dPWIQdR.exe
  C:\Windows\System\dPWIQdR.exe
  2⤵
  PID:8944
- C:\Windows\System\thHXUVl.exe
  C:\Windows\System\thHXUVl.exe
  2⤵
  PID:8964
- C:\Windows\System\oYqXphN.exe
  C:\Windows\System\oYqXphN.exe
  2⤵
  PID:8988
- C:\Windows\System\JeELFQb.exe
  C:\Windows\System\JeELFQb.exe
  2⤵
  PID:9012
- C:\Windows\System\psEVztB.exe
  C:\Windows\System\psEVztB.exe
  2⤵
  PID:9044
- C:\Windows\System\wcGUcan.exe
  C:\Windows\System\wcGUcan.exe
  2⤵
  PID:9064
- C:\Windows\System\kSGEMfP.exe
  C:\Windows\System\kSGEMfP.exe
  2⤵
  PID:9088
- C:\Windows\System\yFbBVmy.exe
  C:\Windows\System\yFbBVmy.exe
  2⤵
  PID:9112
- C:\Windows\System\ekGTxqa.exe
  C:\Windows\System\ekGTxqa.exe
  2⤵
  PID:9132
- C:\Windows\System\UOSDjpd.exe
  C:\Windows\System\UOSDjpd.exe
  2⤵
  PID:9156
- C:\Windows\System\tXOZxnI.exe
  C:\Windows\System\tXOZxnI.exe
  2⤵
  PID:9180
- C:\Windows\System\vncVEPT.exe
  C:\Windows\System\vncVEPT.exe
  2⤵
  PID:9204
- C:\Windows\System\cAoGVEe.exe
  C:\Windows\System\cAoGVEe.exe
  2⤵
  PID:6320
- C:\Windows\System\roQRIVk.exe
  C:\Windows\System\roQRIVk.exe
  2⤵
  PID:7352
- C:\Windows\System\gObXFSl.exe
  C:\Windows\System\gObXFSl.exe
  2⤵
  PID:6604
- C:\Windows\System\CeFeCpS.exe
  C:\Windows\System\CeFeCpS.exe
  2⤵
  PID:6720
- C:\Windows\System\VUiqSWK.exe
  C:\Windows\System\VUiqSWK.exe
  2⤵
  PID:7580
- C:\Windows\System\ACiVFxU.exe
  C:\Windows\System\ACiVFxU.exe
  2⤵
  PID:7656
- C:\Windows\System\NJooevP.exe
  C:\Windows\System\NJooevP.exe
  2⤵
  PID:7744
- C:\Windows\System\KKYJKYO.exe
  C:\Windows\System\KKYJKYO.exe
  2⤵
  PID:6960
- C:\Windows\System\IOfPlHK.exe
  C:\Windows\System\IOfPlHK.exe
  2⤵
  PID:5924
- C:\Windows\System\pENHYkz.exe
  C:\Windows\System\pENHYkz.exe
  2⤵
  PID:7796
- C:\Windows\System\kuKMzfG.exe
  C:\Windows\System\kuKMzfG.exe
  2⤵
  PID:6972
- C:\Windows\System\NyZZfvx.exe
  C:\Windows\System\NyZZfvx.exe
  2⤵
  PID:8136
- C:\Windows\System\GhpTHFw.exe
  C:\Windows\System\GhpTHFw.exe
  2⤵
  PID:8204
- C:\Windows\System\jRWFkWc.exe
  C:\Windows\System\jRWFkWc.exe
  2⤵
  PID:7324
- C:\Windows\System\yuOipZJ.exe
  C:\Windows\System\yuOipZJ.exe
  2⤵
  PID:6596
- C:\Windows\System\YIpqrBI.exe
  C:\Windows\System\YIpqrBI.exe
  2⤵
  PID:7428
- C:\Windows\System\kMxqgVg.exe
  C:\Windows\System\kMxqgVg.exe
  2⤵
  PID:8316
- C:\Windows\System\XtohPqv.exe
  C:\Windows\System\XtohPqv.exe
  2⤵
  PID:6824
- C:\Windows\System\hrwJAOW.exe
  C:\Windows\System\hrwJAOW.exe
  2⤵
  PID:6876
- C:\Windows\System\kqeOidG.exe
  C:\Windows\System\kqeOidG.exe
  2⤵
  PID:8420
- C:\Windows\System\OJHgunh.exe
  C:\Windows\System\OJHgunh.exe
  2⤵
  PID:8452
- C:\Windows\System\puXHLZo.exe
  C:\Windows\System\puXHLZo.exe
  2⤵
  PID:6060
- C:\Windows\System\xFrSlhW.exe
  C:\Windows\System\xFrSlhW.exe
  2⤵
  PID:8512
- C:\Windows\System\HPQBwQz.exe
  C:\Windows\System\HPQBwQz.exe
  2⤵
  PID:8520
- C:\Windows\System\kDXUDVX.exe
  C:\Windows\System\kDXUDVX.exe
  2⤵
  PID:6412
- C:\Windows\System\algrCsJ.exe
  C:\Windows\System\algrCsJ.exe
  2⤵
  PID:8112
- C:\Windows\System\DNMMOjs.exe
  C:\Windows\System\DNMMOjs.exe
  2⤵
  PID:7800
- C:\Windows\System\sYLYINI.exe
  C:\Windows\System\sYLYINI.exe
  2⤵
  PID:8228
- C:\Windows\System\apLDBOS.exe
  C:\Windows\System\apLDBOS.exe
  2⤵
  PID:8804
- C:\Windows\System\qmqcFJO.exe
  C:\Windows\System\qmqcFJO.exe
  2⤵
  PID:8248
- C:\Windows\System\aQfQFGL.exe
  C:\Windows\System\aQfQFGL.exe
  2⤵
  PID:9244
- C:\Windows\System\jPcaszm.exe
  C:\Windows\System\jPcaszm.exe
  2⤵
  PID:9264
- C:\Windows\System\jfvRiOd.exe
  C:\Windows\System\jfvRiOd.exe
  2⤵
  PID:9292
- C:\Windows\System\gDXOglr.exe
  C:\Windows\System\gDXOglr.exe
  2⤵
  PID:9320
- C:\Windows\System\gEEKUqk.exe
  C:\Windows\System\gEEKUqk.exe
  2⤵
  PID:9340
- C:\Windows\System\dHqiXkX.exe
  C:\Windows\System\dHqiXkX.exe
  2⤵
  PID:9364
- C:\Windows\System\FjmGfIo.exe
  C:\Windows\System\FjmGfIo.exe
  2⤵
  PID:9388
- C:\Windows\System\cnjgZKk.exe
  C:\Windows\System\cnjgZKk.exe
  2⤵
  PID:9412
- C:\Windows\System\WGWFSIl.exe
  C:\Windows\System\WGWFSIl.exe
  2⤵
  PID:9436
- C:\Windows\System\bWbbWVQ.exe
  C:\Windows\System\bWbbWVQ.exe
  2⤵
  PID:9460
- C:\Windows\System\MJBcQfb.exe
  C:\Windows\System\MJBcQfb.exe
  2⤵
  PID:9488
- C:\Windows\System\KvsMstd.exe
  C:\Windows\System\KvsMstd.exe
  2⤵
  PID:9512
- C:\Windows\System\zFgHmHT.exe
  C:\Windows\System\zFgHmHT.exe
  2⤵
  PID:9536
- C:\Windows\System\POvXcEZ.exe
  C:\Windows\System\POvXcEZ.exe
  2⤵
  PID:9568
- C:\Windows\System\LbHXofF.exe
  C:\Windows\System\LbHXofF.exe
  2⤵
  PID:9588
- C:\Windows\System\HiKlhwg.exe
  C:\Windows\System\HiKlhwg.exe
  2⤵
  PID:9608
- C:\Windows\System\xPiGrMe.exe
  C:\Windows\System\xPiGrMe.exe
  2⤵
  PID:9632
- C:\Windows\System\PEyucNn.exe
  C:\Windows\System\PEyucNn.exe
  2⤵
  PID:9656
- C:\Windows\System\murVEGj.exe
  C:\Windows\System\murVEGj.exe
  2⤵
  PID:9684
- C:\Windows\System\lZUCOHK.exe
  C:\Windows\System\lZUCOHK.exe
  2⤵
  PID:9720
- C:\Windows\System\BeQtoLh.exe
  C:\Windows\System\BeQtoLh.exe
  2⤵
  PID:9736
- C:\Windows\System\niSjpAB.exe
  C:\Windows\System\niSjpAB.exe
  2⤵
  PID:9760
- C:\Windows\System\xaqibOX.exe
  C:\Windows\System\xaqibOX.exe
  2⤵
  PID:9784
- C:\Windows\System\FtDRZXn.exe
  C:\Windows\System\FtDRZXn.exe
  2⤵
  PID:9808
- C:\Windows\System\tWiYhqE.exe
  C:\Windows\System\tWiYhqE.exe
  2⤵
  PID:9832
- C:\Windows\System\RTomGRd.exe
  C:\Windows\System\RTomGRd.exe
  2⤵
  PID:9860
- C:\Windows\System\vEBQeWf.exe
  C:\Windows\System\vEBQeWf.exe
  2⤵
  PID:9888
- C:\Windows\System\RUhsotY.exe
  C:\Windows\System\RUhsotY.exe
  2⤵
  PID:9908
- C:\Windows\System\RblNuPs.exe
  C:\Windows\System\RblNuPs.exe
  2⤵
  PID:9932
- C:\Windows\System\mZzEhMl.exe
  C:\Windows\System\mZzEhMl.exe
  2⤵
  PID:9956
- C:\Windows\System\lNHVRJk.exe
  C:\Windows\System\lNHVRJk.exe
  2⤵
  PID:9980
- C:\Windows\System\VRPHWRm.exe
  C:\Windows\System\VRPHWRm.exe
  2⤵
  PID:10008
- C:\Windows\System\NoyFWUG.exe
  C:\Windows\System\NoyFWUG.exe
  2⤵
  PID:10028
- C:\Windows\System\ZxPVdKI.exe
  C:\Windows\System\ZxPVdKI.exe
  2⤵
  PID:10048
- C:\Windows\System\HZfaDuI.exe
  C:\Windows\System\HZfaDuI.exe
  2⤵
  PID:10068
- C:\Windows\System\cYZOWUv.exe
  C:\Windows\System\cYZOWUv.exe
  2⤵
  PID:10092
- C:\Windows\System\zPHyHwB.exe
  C:\Windows\System\zPHyHwB.exe
  2⤵
  PID:10116
- C:\Windows\System\UJYTjxL.exe
  C:\Windows\System\UJYTjxL.exe
  2⤵
  PID:10136
- C:\Windows\System\wZWmbrq.exe
  C:\Windows\System\wZWmbrq.exe
  2⤵
  PID:10152
- C:\Windows\System\eFXWWTx.exe
  C:\Windows\System\eFXWWTx.exe
  2⤵
  PID:10168
- C:\Windows\System\LNWUmZy.exe
  C:\Windows\System\LNWUmZy.exe
  2⤵
  PID:10184
- C:\Windows\System\aZDeqku.exe
  C:\Windows\System\aZDeqku.exe
  2⤵
  PID:10204
- C:\Windows\System\acNwbTj.exe
  C:\Windows\System\acNwbTj.exe
  2⤵
  PID:10236
- C:\Windows\System\wLXhWeG.exe
  C:\Windows\System\wLXhWeG.exe
  2⤵
  PID:8292
- C:\Windows\System\PZUqBZg.exe
  C:\Windows\System\PZUqBZg.exe
  2⤵
  PID:9008
- C:\Windows\System\wDQtlCK.exe
  C:\Windows\System\wDQtlCK.exe
  2⤵
  PID:8340
- C:\Windows\System\lunnpRh.exe
  C:\Windows\System\lunnpRh.exe
  2⤵
  PID:9196
- C:\Windows\System\CwJZYIu.exe
  C:\Windows\System\CwJZYIu.exe
  2⤵
  PID:6368
- C:\Windows\System\WVqnodS.exe
  C:\Windows\System\WVqnodS.exe
  2⤵
  PID:7876
- C:\Windows\System\UhPfwry.exe
  C:\Windows\System\UhPfwry.exe
  2⤵
  PID:8472
- C:\Windows\System\hMREdba.exe
  C:\Windows\System\hMREdba.exe
  2⤵
  PID:8152
- C:\Windows\System\cFiocJd.exe
  C:\Windows\System\cFiocJd.exe
  2⤵
  PID:8268
- C:\Windows\System\dWNNKoC.exe
  C:\Windows\System\dWNNKoC.exe
  2⤵
  PID:6456
- C:\Windows\System\VFAjTLE.exe
  C:\Windows\System\VFAjTLE.exe
  2⤵
  PID:8552
- C:\Windows\System\WIAIOER.exe
  C:\Windows\System\WIAIOER.exe
  2⤵
  PID:7992
- C:\Windows\System\iqkNuUw.exe
  C:\Windows\System\iqkNuUw.exe
  2⤵
  PID:8668
- C:\Windows\System\zHMXLBY.exe
  C:\Windows\System\zHMXLBY.exe
  2⤵
  PID:8712
- C:\Windows\System\IawqPuK.exe
  C:\Windows\System\IawqPuK.exe
  2⤵
  PID:8628
- C:\Windows\System\ZiocjuB.exe
  C:\Windows\System\ZiocjuB.exe
  2⤵
  PID:800
- C:\Windows\System\mpoJEQg.exe
  C:\Windows\System\mpoJEQg.exe
  2⤵
  PID:8904
- C:\Windows\System\mfehfSp.exe
  C:\Windows\System\mfehfSp.exe
  2⤵
  PID:9332
- C:\Windows\System\YJABahK.exe
  C:\Windows\System\YJABahK.exe
  2⤵
  PID:8336
- C:\Windows\System\bwvpPkI.exe
  C:\Windows\System\bwvpPkI.exe
  2⤵
  PID:9428
- C:\Windows\System\erSxEyP.exe
  C:\Windows\System\erSxEyP.exe
  2⤵
  PID:9496
- C:\Windows\System\BXeJmvF.exe
  C:\Windows\System\BXeJmvF.exe
  2⤵
  PID:9164
- C:\Windows\System\vfleolj.exe
  C:\Windows\System\vfleolj.exe
  2⤵
  PID:9532
- C:\Windows\System\bhDEKSO.exe
  C:\Windows\System\bhDEKSO.exe
  2⤵
  PID:6748
- C:\Windows\System\DknvifZ.exe
  C:\Windows\System\DknvifZ.exe
  2⤵
  PID:9652
- C:\Windows\System\PxYAuUq.exe
  C:\Windows\System\PxYAuUq.exe
  2⤵
  PID:9816
- C:\Windows\System\yhhJIxR.exe
  C:\Windows\System\yhhJIxR.exe
  2⤵
  PID:8356
- C:\Windows\System\IgGUJBG.exe
  C:\Windows\System\IgGUJBG.exe
  2⤵
  PID:9928
- C:\Windows\System\DbSIgmI.exe
  C:\Windows\System\DbSIgmI.exe
  2⤵
  PID:10244
- C:\Windows\System\ZLuBBAj.exe
  C:\Windows\System\ZLuBBAj.exe
  2⤵
  PID:10264
- C:\Windows\System\LpaLSGR.exe
  C:\Windows\System\LpaLSGR.exe
  2⤵
  PID:10296
- C:\Windows\System\qeLibTM.exe
  C:\Windows\System\qeLibTM.exe
  2⤵
  PID:10316
- C:\Windows\System\aafkzES.exe
  C:\Windows\System\aafkzES.exe
  2⤵
  PID:10340
- C:\Windows\System\TZwNEIs.exe
  C:\Windows\System\TZwNEIs.exe
  2⤵
  PID:10364
- C:\Windows\System\nFAeIax.exe
  C:\Windows\System\nFAeIax.exe
  2⤵
  PID:10388
- C:\Windows\System\olsghVi.exe
  C:\Windows\System\olsghVi.exe
  2⤵
  PID:10408
- C:\Windows\System\ZUlmVtj.exe
  C:\Windows\System\ZUlmVtj.exe
  2⤵
  PID:10432
- C:\Windows\System\cUaRXgL.exe
  C:\Windows\System\cUaRXgL.exe
  2⤵
  PID:10452
- C:\Windows\System\CGijUqM.exe
  C:\Windows\System\CGijUqM.exe
  2⤵
  PID:10472
- C:\Windows\System\DPFXvCc.exe
  C:\Windows\System\DPFXvCc.exe
  2⤵
  PID:10496
- C:\Windows\System\IGwyCxP.exe
  C:\Windows\System\IGwyCxP.exe
  2⤵
  PID:10516
- C:\Windows\System\NJCjeen.exe
  C:\Windows\System\NJCjeen.exe
  2⤵
  PID:10532
- C:\Windows\System\zITxSWA.exe
  C:\Windows\System\zITxSWA.exe
  2⤵
  PID:10548
- C:\Windows\System\BoEkVJk.exe
  C:\Windows\System\BoEkVJk.exe
  2⤵
  PID:10564
- C:\Windows\System\sCGqGxJ.exe
  C:\Windows\System\sCGqGxJ.exe
  2⤵
  PID:10588
- C:\Windows\System\TBuxuAg.exe
  C:\Windows\System\TBuxuAg.exe
  2⤵
  PID:10612
- C:\Windows\System\qScCePS.exe
  C:\Windows\System\qScCePS.exe
  2⤵
  PID:10640
- C:\Windows\System\jZWVRba.exe
  C:\Windows\System\jZWVRba.exe
  2⤵
  PID:10660
- C:\Windows\System\tXykzqR.exe
  C:\Windows\System\tXykzqR.exe
  2⤵
  PID:10684
- C:\Windows\System\mnifOMD.exe
  C:\Windows\System\mnifOMD.exe
  2⤵
  PID:10712
- C:\Windows\System\vPyhtRF.exe
  C:\Windows\System\vPyhtRF.exe
  2⤵
  PID:10732
- C:\Windows\System\ZpmTzCu.exe
  C:\Windows\System\ZpmTzCu.exe
  2⤵
  PID:10756
- C:\Windows\System\EtaCFaV.exe
  C:\Windows\System\EtaCFaV.exe
  2⤵
  PID:10788
- C:\Windows\System\KKZgSpl.exe
  C:\Windows\System\KKZgSpl.exe
  2⤵
  PID:10808
- C:\Windows\System\gkvhYTY.exe
  C:\Windows\System\gkvhYTY.exe
  2⤵
  PID:10832
- C:\Windows\System\AXocEMj.exe
  C:\Windows\System\AXocEMj.exe
  2⤵
  PID:10856
- C:\Windows\System\ZfsfrdF.exe
  C:\Windows\System\ZfsfrdF.exe
  2⤵
  PID:10880
- C:\Windows\System\mRHGarp.exe
  C:\Windows\System\mRHGarp.exe
  2⤵
  PID:10900
- C:\Windows\System\UWiXvea.exe
  C:\Windows\System\UWiXvea.exe
  2⤵
  PID:10924
- C:\Windows\System\XzSWKJN.exe
  C:\Windows\System\XzSWKJN.exe
  2⤵
  PID:10956
- C:\Windows\System\aeAKzBo.exe
  C:\Windows\System\aeAKzBo.exe
  2⤵
  PID:10976
- C:\Windows\System\jkzHuSL.exe
  C:\Windows\System\jkzHuSL.exe
  2⤵
  PID:10996
- C:\Windows\System\BzjIzOV.exe
  C:\Windows\System\BzjIzOV.exe
  2⤵
  PID:11020
- C:\Windows\System\HMKvmuZ.exe
  C:\Windows\System\HMKvmuZ.exe
  2⤵
  PID:11040
- C:\Windows\System\MNXvnPM.exe
  C:\Windows\System\MNXvnPM.exe
  2⤵
  PID:11064
- C:\Windows\System\VvugaBU.exe
  C:\Windows\System\VvugaBU.exe
  2⤵
  PID:11084
- C:\Windows\System\piTmveg.exe
  C:\Windows\System\piTmveg.exe
  2⤵
  PID:11112
- C:\Windows\System\luWxVKC.exe
  C:\Windows\System\luWxVKC.exe
  2⤵
  PID:11136
- C:\Windows\System\QdsIgJa.exe
  C:\Windows\System\QdsIgJa.exe
  2⤵
  PID:11156
- C:\Windows\System\kJKkwwY.exe
  C:\Windows\System\kJKkwwY.exe
  2⤵
  PID:11180
- C:\Windows\System\oRuYjyn.exe
  C:\Windows\System\oRuYjyn.exe
  2⤵
  PID:11204
- C:\Windows\System\wqsVLhK.exe
  C:\Windows\System\wqsVLhK.exe
  2⤵
  PID:11232
- C:\Windows\System\tzlIfaO.exe
  C:\Windows\System\tzlIfaO.exe
  2⤵
  PID:11256
- C:\Windows\System\twjBhJq.exe
  C:\Windows\System\twjBhJq.exe
  2⤵
  PID:10080
- C:\Windows\System\LOhGtAI.exe
  C:\Windows\System\LOhGtAI.exe
  2⤵
  PID:8104
- C:\Windows\System\iyKVwXM.exe
  C:\Windows\System\iyKVwXM.exe
  2⤵
  PID:8836
- C:\Windows\System\adQpVkx.exe
  C:\Windows\System\adQpVkx.exe
  2⤵
  PID:1672
- C:\Windows\System\irOeWoH.exe
  C:\Windows\System\irOeWoH.exe
  2⤵
  PID:8984
- C:\Windows\System\oOhgQtN.exe
  C:\Windows\System\oOhgQtN.exe
  2⤵
  PID:9032
- C:\Windows\System\NOnjKCl.exe
  C:\Windows\System\NOnjKCl.exe
  2⤵
  PID:9308
- C:\Windows\System\LUhwHiq.exe
  C:\Windows\System\LUhwHiq.exe
  2⤵
  PID:6276
- C:\Windows\System\NJlSrmY.exe
  C:\Windows\System\NJlSrmY.exe
  2⤵
  PID:7236
- C:\Windows\System\iXgGogg.exe
  C:\Windows\System\iXgGogg.exe
  2⤵
  PID:9084
- C:\Windows\System\tecfAMu.exe
  C:\Windows\System\tecfAMu.exe
  2⤵
  PID:5388
- C:\Windows\System\MGtZrKm.exe
  C:\Windows\System\MGtZrKm.exe
  2⤵
  PID:9616
- C:\Windows\System\NUplnDk.exe
  C:\Windows\System\NUplnDk.exe
  2⤵
  PID:5532
- C:\Windows\System\nnMGqtP.exe
  C:\Windows\System\nnMGqtP.exe
  2⤵
  PID:7736
- C:\Windows\System\qUyOVNL.exe
  C:\Windows\System\qUyOVNL.exe
  2⤵
  PID:9704
- C:\Windows\System\qwYIVOT.exe
  C:\Windows\System\qwYIVOT.exe
  2⤵
  PID:9284
- C:\Windows\System\aKZCrQg.exe
  C:\Windows\System\aKZCrQg.exe
  2⤵
  PID:9848
- C:\Windows\System\yUimAtc.exe
  C:\Windows\System\yUimAtc.exe
  2⤵
  PID:9176
- C:\Windows\System\XdvbZES.exe
  C:\Windows\System\XdvbZES.exe
  2⤵
  PID:9884
- C:\Windows\System\QZMjEhV.exe
  C:\Windows\System\QZMjEhV.exe
  2⤵
  PID:9916
- C:\Windows\System\CftjLvK.exe
  C:\Windows\System\CftjLvK.exe
  2⤵
  PID:8312
- C:\Windows\System\WLWTQQC.exe
  C:\Windows\System\WLWTQQC.exe
  2⤵
  PID:7116
- C:\Windows\System\eBTrhmP.exe
  C:\Windows\System\eBTrhmP.exe
  2⤵
  PID:10260
- C:\Windows\System\eMzlFFS.exe
  C:\Windows\System\eMzlFFS.exe
  2⤵
  PID:10280
- C:\Windows\System\UhmMQzE.exe
  C:\Windows\System\UhmMQzE.exe
  2⤵
  PID:10324
- C:\Windows\System\NQQXcua.exe
  C:\Windows\System\NQQXcua.exe
  2⤵
  PID:11292
- C:\Windows\System\KwhiRly.exe
  C:\Windows\System\KwhiRly.exe
  2⤵
  PID:11312
- C:\Windows\System\GLPKdjT.exe
  C:\Windows\System\GLPKdjT.exe
  2⤵
  PID:11332
- C:\Windows\System\FDVrbXe.exe
  C:\Windows\System\FDVrbXe.exe
  2⤵
  PID:11356
- C:\Windows\System\kUblWUV.exe
  C:\Windows\System\kUblWUV.exe
  2⤵
  PID:11736
- C:\Windows\System\rhqTnNK.exe
  C:\Windows\System\rhqTnNK.exe
  2⤵
  PID:11760
- C:\Windows\System\jqCnsJA.exe
  C:\Windows\System\jqCnsJA.exe
  2⤵
  PID:11784
- C:\Windows\System\NbkOjMc.exe
  C:\Windows\System\NbkOjMc.exe
  2⤵
  PID:11808
- C:\Windows\System\ZLgeLzs.exe
  C:\Windows\System\ZLgeLzs.exe
  2⤵
  PID:11828
- C:\Windows\System\FWaHElQ.exe
  C:\Windows\System\FWaHElQ.exe
  2⤵
  PID:11844
- C:\Windows\System\hKAVfeJ.exe
  C:\Windows\System\hKAVfeJ.exe
  2⤵
  PID:11860
- C:\Windows\System\IJUPilm.exe
  C:\Windows\System\IJUPilm.exe
  2⤵
  PID:11876
- C:\Windows\System\rJmCcTT.exe
  C:\Windows\System\rJmCcTT.exe
  2⤵
  PID:11892
- C:\Windows\System\KcJqJnq.exe
  C:\Windows\System\KcJqJnq.exe
  2⤵
  PID:11908
- C:\Windows\System\WTTVkpN.exe
  C:\Windows\System\WTTVkpN.exe
  2⤵
  PID:11924
- C:\Windows\System\TOfRVHv.exe
  C:\Windows\System\TOfRVHv.exe
  2⤵
  PID:11940
- C:\Windows\System\GywpZlW.exe
  C:\Windows\System\GywpZlW.exe
  2⤵
  PID:11964
- C:\Windows\System\QKuyzxD.exe
  C:\Windows\System\QKuyzxD.exe
  2⤵
  PID:11988
- C:\Windows\System\iKFHlOE.exe
  C:\Windows\System\iKFHlOE.exe
  2⤵
  PID:12008
- C:\Windows\System\eBOJDhR.exe
  C:\Windows\System\eBOJDhR.exe
  2⤵
  PID:12024
- C:\Windows\System\ieNShiU.exe
  C:\Windows\System\ieNShiU.exe
  2⤵
  PID:12044
- C:\Windows\System\IThdSNj.exe
  C:\Windows\System\IThdSNj.exe
  2⤵
  PID:12064
- C:\Windows\System\GNEslfj.exe
  C:\Windows\System\GNEslfj.exe
  2⤵
  PID:12084
- C:\Windows\System\BNpXoDP.exe
  C:\Windows\System\BNpXoDP.exe
  2⤵
  PID:12104
- C:\Windows\System\TIfBPOl.exe
  C:\Windows\System\TIfBPOl.exe
  2⤵
  PID:12128
- C:\Windows\System\qoMzzQL.exe
  C:\Windows\System\qoMzzQL.exe
  2⤵
  PID:12156
- C:\Windows\System\MxkMlWU.exe
  C:\Windows\System\MxkMlWU.exe
  2⤵
  PID:12176
- C:\Windows\System\NIDMHvN.exe
  C:\Windows\System\NIDMHvN.exe
  2⤵
  PID:12200
- C:\Windows\System\NRkvCZf.exe
  C:\Windows\System\NRkvCZf.exe
  2⤵
  PID:12220
- C:\Windows\System\WpCNYOM.exe
  C:\Windows\System\WpCNYOM.exe
  2⤵
  PID:12240
- C:\Windows\System\rvouhlm.exe
  C:\Windows\System\rvouhlm.exe
  2⤵
  PID:12280
- C:\Windows\System\wImwpDw.exe
  C:\Windows\System\wImwpDw.exe
  2⤵
  PID:10336
- C:\Windows\System\QjFHeYU.exe
  C:\Windows\System\QjFHeYU.exe
  2⤵
  PID:10100
- C:\Windows\System\QquTcRq.exe
  C:\Windows\System\QquTcRq.exe
  2⤵
  PID:10124
- C:\Windows\System\UDRNVyf.exe
  C:\Windows\System\UDRNVyf.exe
  2⤵
  PID:8960
- C:\Windows\System\cjwekjb.exe
  C:\Windows\System\cjwekjb.exe
  2⤵
  PID:10896
- C:\Windows\System\theSBvz.exe
  C:\Windows\System\theSBvz.exe
  2⤵
  PID:11132
- C:\Windows\System\hxmJYyi.exe
  C:\Windows\System\hxmJYyi.exe
  2⤵
  PID:9780
- C:\Windows\System\yKBlAMS.exe
  C:\Windows\System\yKBlAMS.exe
  2⤵
  PID:8884
- C:\Windows\System\pOmKrHk.exe
  C:\Windows\System\pOmKrHk.exe
  2⤵
  PID:9964
- C:\Windows\System\MwsketR.exe
  C:\Windows\System\MwsketR.exe
  2⤵
  PID:10060
- C:\Windows\System\roZmBEe.exe
  C:\Windows\System\roZmBEe.exe
  2⤵
  PID:11300
- C:\Windows\System\olYsxHH.exe
  C:\Windows\System\olYsxHH.exe
  2⤵
  PID:10132
- C:\Windows\System\oUecEjP.exe
  C:\Windows\System\oUecEjP.exe
  2⤵
  PID:11364
- C:\Windows\System\RtjfHZD.exe
  C:\Windows\System\RtjfHZD.exe
  2⤵
  PID:10440
- C:\Windows\System\yYGpqip.exe
  C:\Windows\System\yYGpqip.exe
  2⤵
  PID:11384
- C:\Windows\System\YXvzGCU.exe
  C:\Windows\System\YXvzGCU.exe
  2⤵
  PID:10468
- C:\Windows\System\cSJRgwv.exe
  C:\Windows\System\cSJRgwv.exe
  2⤵
  PID:10512
- C:\Windows\System\DLwZOOE.exe
  C:\Windows\System\DLwZOOE.exe
  2⤵
  PID:10220
- C:\Windows\System\ekPiPFW.exe
  C:\Windows\System\ekPiPFW.exe
  2⤵
  PID:10648
- C:\Windows\System\tWroGiu.exe
  C:\Windows\System\tWroGiu.exe
  2⤵
  PID:11520
- C:\Windows\System\UGasUnl.exe
  C:\Windows\System\UGasUnl.exe
  2⤵
  PID:9584
- C:\Windows\System\ojNbSGC.exe
  C:\Windows\System\ojNbSGC.exe
  2⤵
  PID:7836
- C:\Windows\System\CYYKFEG.exe
  C:\Windows\System\CYYKFEG.exe
  2⤵
  PID:12300
- C:\Windows\System\xdXGXLM.exe
  C:\Windows\System\xdXGXLM.exe
  2⤵
  PID:12316
- C:\Windows\System\iTEZSdc.exe
  C:\Windows\System\iTEZSdc.exe
  2⤵
  PID:12332
- C:\Windows\System\fRHqBVI.exe
  C:\Windows\System\fRHqBVI.exe
  2⤵
  PID:12348
- C:\Windows\System\aGxPPEu.exe
  C:\Windows\System\aGxPPEu.exe
  2⤵
  PID:12364
- C:\Windows\System\rliAfIQ.exe
  C:\Windows\System\rliAfIQ.exe
  2⤵
  PID:12380
- C:\Windows\System\FLDIuyb.exe
  C:\Windows\System\FLDIuyb.exe
  2⤵
  PID:12400
- C:\Windows\System\CRoMpwp.exe
  C:\Windows\System\CRoMpwp.exe
  2⤵
  PID:12416
- C:\Windows\System\ktfyjdS.exe
  C:\Windows\System\ktfyjdS.exe
  2⤵
  PID:12436
- C:\Windows\System\NWwyksp.exe
  C:\Windows\System\NWwyksp.exe
  2⤵
  PID:12452
- C:\Windows\System\FcAHSTE.exe
  C:\Windows\System\FcAHSTE.exe
  2⤵
  PID:12472
- C:\Windows\System\dSkfkjw.exe
  C:\Windows\System\dSkfkjw.exe
  2⤵
  PID:12496
- C:\Windows\System\XuQQWjF.exe
  C:\Windows\System\XuQQWjF.exe
  2⤵
  PID:12516
- C:\Windows\System\FEsgOrc.exe
  C:\Windows\System\FEsgOrc.exe
  2⤵
  PID:12536
- C:\Windows\System\UYTLfGW.exe
  C:\Windows\System\UYTLfGW.exe
  2⤵
  PID:12556
- C:\Windows\System\jKFbXYB.exe
  C:\Windows\System\jKFbXYB.exe
  2⤵
  PID:12572
- C:\Windows\System\FNtqPUx.exe
  C:\Windows\System\FNtqPUx.exe
  2⤵
  PID:12596
- C:\Windows\System\emFkcac.exe
  C:\Windows\System\emFkcac.exe
  2⤵
  PID:12612
- C:\Windows\System\ZQUZxaA.exe
  C:\Windows\System\ZQUZxaA.exe
  2⤵
  PID:12636
- C:\Windows\System\CesDUjQ.exe
  C:\Windows\System\CesDUjQ.exe
  2⤵
  PID:13244
- C:\Windows\System\qdqMtSM.exe
  C:\Windows\System\qdqMtSM.exe
  2⤵
  PID:13304
- C:\Windows\System\FEANhZF.exe
  C:\Windows\System\FEANhZF.exe
  2⤵
  PID:12672
- C:\Windows\System\QiXixgi.exe
  C:\Windows\System\QiXixgi.exe
  2⤵
  PID:13124
- C:\Windows\System\CBmQDZs.exe
  C:\Windows\System\CBmQDZs.exe
  2⤵
  PID:13168
- C:\Windows\System\cmmJofe.exe
  C:\Windows\System\cmmJofe.exe
  2⤵
  PID:13192
- C:\Windows\System\CdXKpax.exe
  C:\Windows\System\CdXKpax.exe
  2⤵
  PID:13208
- C:\Windows\System\XmNOoxd.exe
  C:\Windows\System\XmNOoxd.exe
  2⤵
  PID:13232
- C:\Windows\System\falEehQ.exe
  C:\Windows\System\falEehQ.exe
  2⤵
  PID:13268
- C:\Windows\System\rbUuaJw.exe
  C:\Windows\System\rbUuaJw.exe
  2⤵
  PID:10764
- C:\Windows\System\VYEnUtX.exe
  C:\Windows\System\VYEnUtX.exe
  2⤵
  PID:10508
- C:\Windows\System\rzyYvDM.exe
  C:\Windows\System\rzyYvDM.exe
  2⤵
  PID:12840
- C:\Windows\System\EqeXJmy.exe
  C:\Windows\System\EqeXJmy.exe
  2⤵
  PID:12856
- C:\Windows\System\zWpAPXK.exe
  C:\Windows\System\zWpAPXK.exe
  2⤵
  PID:12880
- C:\Windows\System\FDXijtv.exe
  C:\Windows\System\FDXijtv.exe
  2⤵
  PID:9212
- C:\Windows\System\BtqWBZu.exe
  C:\Windows\System\BtqWBZu.exe
  2⤵
  PID:12920
- C:\Windows\System\sdmhCpP.exe
  C:\Windows\System\sdmhCpP.exe
  2⤵
  PID:12956
- C:\Windows\System\LQlGpvr.exe
  C:\Windows\System\LQlGpvr.exe
  2⤵
  PID:12980
- C:\Windows\System\yNHZEnE.exe
  C:\Windows\System\yNHZEnE.exe
  2⤵
  PID:11552
- C:\Windows\System\umvZxte.exe
  C:\Windows\System\umvZxte.exe
  2⤵
  PID:10872
- C:\Windows\System\BccwKdh.exe
  C:\Windows\System\BccwKdh.exe
  2⤵
  PID:13184
- C:\Windows\System\axpVHJn.exe
  C:\Windows\System\axpVHJn.exe
  2⤵
  PID:10848
- C:\Windows\System\nEQhFwe.exe
  C:\Windows\System\nEQhFwe.exe
  2⤵
  PID:10740
- C:\Windows\System\ZbXjTse.exe
  C:\Windows\System\ZbXjTse.exe
  2⤵
  PID:13280
- C:\Windows\System\sAlqAsr.exe
  C:\Windows\System\sAlqAsr.exe
  2⤵
  PID:10916
- C:\Windows\System\DsYFVJx.exe
  C:\Windows\System\DsYFVJx.exe
  2⤵
  PID:4452
- C:\Windows\System\HTzPaiv.exe
  C:\Windows\System\HTzPaiv.exe
  2⤵
  PID:2320
- C:\Windows\System\TOXwJHl.exe
  C:\Windows\System\TOXwJHl.exe
  2⤵
  PID:10040
- C:\Windows\System\roPVQjz.exe
  C:\Windows\System\roPVQjz.exe
  2⤵
  PID:11600
- C:\Windows\System\UxldLbv.exe
  C:\Windows\System\UxldLbv.exe
  2⤵
  PID:8132
- C:\Windows\System\MHcsEga.exe
  C:\Windows\System\MHcsEga.exe
  2⤵
  PID:12096
- C:\Windows\System\zmugSsE.exe
  C:\Windows\System\zmugSsE.exe
  2⤵
  PID:8784
- C:\Windows\System\FQKTQPh.exe
  C:\Windows\System\FQKTQPh.exe
  2⤵
  PID:9424
- C:\Windows\System\DciVXpM.exe
  C:\Windows\System\DciVXpM.exe
  2⤵
  PID:11076
- C:\Windows\System\kNCDAse.exe
  C:\Windows\System\kNCDAse.exe
  2⤵
  PID:9976
- C:\Windows\System\qHEuwsY.exe
  C:\Windows\System\qHEuwsY.exe
  2⤵
  PID:8688
- C:\Windows\System\ZKnXkoT.exe
  C:\Windows\System\ZKnXkoT.exe
  2⤵
  PID:11192
- C:\Windows\System\oVkjhMx.exe
  C:\Windows\System\oVkjhMx.exe
  2⤵
  PID:12392
- C:\Windows\System\YKbMLiO.exe
  C:\Windows\System\YKbMLiO.exe
  2⤵
  PID:12072
- C:\Windows\System\MXARXlf.exe
  C:\Windows\System\MXARXlf.exe
  2⤵
  PID:8388
- C:\Windows\System\lbSptSI.exe
  C:\Windows\System\lbSptSI.exe
  2⤵
  PID:8500
- C:\Windows\System\yKAXLiX.exe
  C:\Windows\System\yKAXLiX.exe
  2⤵
  PID:5712
- C:\Windows\System\sSOeAeD.exe
  C:\Windows\System\sSOeAeD.exe
  2⤵
  PID:11920
- C:\Windows\System\wEGuAIC.exe
  C:\Windows\System\wEGuAIC.exe
  2⤵
  PID:10016
- C:\Windows\System\UCJJuTv.exe
  C:\Windows\System\UCJJuTv.exe
  2⤵
  PID:11544
- C:\Windows\System\WdQwDBc.exe
  C:\Windows\System\WdQwDBc.exe
  2⤵
  PID:9056
- C:\Windows\System\gJJudqH.exe
  C:\Windows\System\gJJudqH.exe
  2⤵
  PID:12788
- C:\Windows\System\SqALJhl.exe
  C:\Windows\System\SqALJhl.exe
  2⤵
  PID:12804
- C:\Windows\System\rHxvjHV.exe
  C:\Windows\System\rHxvjHV.exe
  2⤵
  PID:10668
- C:\Windows\System\bwVuFzJ.exe
  C:\Windows\System\bwVuFzJ.exe
  2⤵
  PID:8328
- C:\Windows\System\UPkBmzg.exe
  C:\Windows\System\UPkBmzg.exe
  2⤵
  PID:12340
- C:\Windows\System\jSkUjqb.exe
  C:\Windows\System\jSkUjqb.exe
  2⤵
  PID:3396
- C:\Windows\System\oYJnlds.exe
  C:\Windows\System\oYJnlds.exe
  2⤵
  PID:3272
- C:\Windows\System\IsylSFm.exe
  C:\Windows\System\IsylSFm.exe
  2⤵
  PID:13224
- C:\Windows\System\yjYIVAH.exe
  C:\Windows\System\yjYIVAH.exe
  2⤵
  PID:8448
- C:\Windows\System\wlJucee.exe
  C:\Windows\System\wlJucee.exe
  2⤵
  PID:12852
- C:\Windows\System\gujnCNC.exe
  C:\Windows\System\gujnCNC.exe
  2⤵
  PID:10932
- C:\Windows\System\BBwQnvG.exe
  C:\Windows\System\BBwQnvG.exe
  2⤵
  PID:372
- C:\Windows\System\NwrkmVG.exe
  C:\Windows\System\NwrkmVG.exe
  2⤵
  PID:11032
- C:\Windows\System\roVwtlx.exe
  C:\Windows\System\roVwtlx.exe
  2⤵
  PID:10044
- C:\Windows\System\LiTJoND.exe
  C:\Windows\System\LiTJoND.exe
  2⤵
  PID:12828
- C:\Windows\System\CTkCtZt.exe
  C:\Windows\System\CTkCtZt.exe
  2⤵
  PID:13164
- C:\Windows\System\bscBIYA.exe
  C:\Windows\System\bscBIYA.exe
  2⤵
  PID:8852
- C:\Windows\System\UlpBXGT.exe
  C:\Windows\System\UlpBXGT.exe
  2⤵
  PID:12148
- C:\Windows\System\qonFcSh.exe
  C:\Windows\System\qonFcSh.exe
  2⤵
  PID:7348
- C:\Windows\System\ZpZmAfn.exe
  C:\Windows\System\ZpZmAfn.exe
  2⤵
  PID:10804
- C:\Windows\System\TFGZuXh.exe
  C:\Windows\System\TFGZuXh.exe
  2⤵
  PID:2596
- C:\Windows\System\bujjRMF.exe
  C:\Windows\System\bujjRMF.exe
  2⤵
  PID:4744
- C:\Windows\System\cWVRztT.exe
  C:\Windows\System\cWVRztT.exe
  2⤵
  PID:12272
- C:\Windows\System\pVKSFiE.exe
  C:\Windows\System\pVKSFiE.exe
  2⤵
  PID:2428
- C:\Windows\System\ZmuzEsF.exe
  C:\Windows\System\ZmuzEsF.exe
  2⤵
  PID:10656
- C:\Windows\System\zGVNVep.exe
  C:\Windows\System\zGVNVep.exe
  2⤵
  PID:11792
- C:\Windows\System\dqaTPKP.exe
  C:\Windows\System\dqaTPKP.exe
  2⤵
  PID:5096
- C:\Windows\System\biBfYhM.exe
  C:\Windows\System\biBfYhM.exe
  2⤵
  PID:1664
- C:\Windows\System\kYzHEIS.exe
  C:\Windows\System\kYzHEIS.exe
  2⤵
  PID:11580
- C:\Windows\System\MjOYoBJ.exe
  C:\Windows\System\MjOYoBJ.exe
  2⤵
  PID:13008
- C:\Windows\System\NXknUGM.exe
  C:\Windows\System\NXknUGM.exe
  2⤵
  PID:5852
- C:\Windows\System\xsvWxKl.exe
  C:\Windows\System\xsvWxKl.exe
  2⤵
  PID:11196
- C:\Windows\System\ujHVMcV.exe
  C:\Windows\System\ujHVMcV.exe
  2⤵
  PID:4800
- C:\Windows\System\MaGSFFp.exe
  C:\Windows\System\MaGSFFp.exe
  2⤵
  PID:5456
- C:\Windows\System\IphnPUj.exe
  C:\Windows\System\IphnPUj.exe
  2⤵
  PID:3356
- C:\Windows\System\PFiRMcG.exe
  C:\Windows\System\PFiRMcG.exe
  2⤵
  PID:4888
- C:\Windows\System\beuRvXf.exe
  C:\Windows\System\beuRvXf.exe
  2⤵
  PID:12812
- C:\Windows\System\IKBphve.exe
  C:\Windows\System\IKBphve.exe
  2⤵
  PID:12836
- C:\Windows\System\OgiQxcs.exe
  C:\Windows\System\OgiQxcs.exe
  2⤵
  PID:13108
- C:\Windows\System\YFTMTox.exe
  C:\Windows\System\YFTMTox.exe
  2⤵
  PID:13152
- C:\Windows\System\QyqYQpT.exe
  C:\Windows\System\QyqYQpT.exe
  2⤵
  PID:4752
- C:\Windows\System\qQlDbfR.exe
  C:\Windows\System\qQlDbfR.exe
  2⤵
  PID:10828
- C:\Windows\System\wQdNHYu.exe
  C:\Windows\System\wQdNHYu.exe
  2⤵
  PID:2244
- C:\Windows\System\LnxJmhf.exe
  C:\Windows\System\LnxJmhf.exe
  2⤵
  PID:12904
- C:\Windows\System\VxpseYI.exe
  C:\Windows\System\VxpseYI.exe
  2⤵
  PID:11776
- C:\Windows\System\nrHlsZc.exe
  C:\Windows\System\nrHlsZc.exe
  2⤵
  PID:12820
- C:\Windows\System\QqWJZhk.exe
  C:\Windows\System\QqWJZhk.exe
  2⤵
  PID:4540
- C:\Windows\System\dTMTxKx.exe
  C:\Windows\System\dTMTxKx.exe
  2⤵
  PID:11144
- C:\Windows\System\wjKjwvA.exe
  C:\Windows\System\wjKjwvA.exe
  2⤵
  PID:428
- C:\Windows\System\vbwYHuw.exe
  C:\Windows\System\vbwYHuw.exe
  2⤵
  PID:12892
- C:\Windows\System\yUivdBh.exe
  C:\Windows\System\yUivdBh.exe
  2⤵
  PID:12992
- C:\Windows\System\wrmNPiA.exe
  C:\Windows\System\wrmNPiA.exe
  2⤵
  PID:2984
- C:\Windows\System\BIlfDYW.exe
  C:\Windows\System\BIlfDYW.exe
  2⤵
  PID:12376
- C:\Windows\System\kmlvAKo.exe
  C:\Windows\System\kmlvAKo.exe
  2⤵
  PID:5284
- C:\Windows\System\TZMITCI.exe
  C:\Windows\System\TZMITCI.exe
  2⤵
  PID:13176
- C:\Windows\System\RmoflRy.exe
  C:\Windows\System\RmoflRy.exe
  2⤵
  PID:7676
- C:\Windows\System\HLwNZGU.exe
  C:\Windows\System\HLwNZGU.exe
  2⤵
  PID:13228
- C:\Windows\System\JiHdpPL.exe
  C:\Windows\System\JiHdpPL.exe
  2⤵
  PID:13324
- C:\Windows\System\bXZJply.exe
  C:\Windows\System\bXZJply.exe
  2⤵
  PID:13372
- C:\Windows\System\IeUCOzm.exe
  C:\Windows\System\IeUCOzm.exe
  2⤵
  PID:13392
- C:\Windows\System\sPZdpua.exe
  C:\Windows\System\sPZdpua.exe
  2⤵
  PID:13416
- C:\Windows\System\ZwKBPBE.exe
  C:\Windows\System\ZwKBPBE.exe
  2⤵
  PID:13440
- C:\Windows\System\RIyihqn.exe
  C:\Windows\System\RIyihqn.exe
  2⤵
  PID:13472
- C:\Windows\System\QUvwFCj.exe
  C:\Windows\System\QUvwFCj.exe
  2⤵
  PID:13496
- C:\Windows\System\fprYNto.exe
  C:\Windows\System\fprYNto.exe
  2⤵
  PID:13520
- C:\Windows\System\pxgSeHV.exe
  C:\Windows\System\pxgSeHV.exe
  2⤵
  PID:13544
- C:\Windows\System\yGUkEoZ.exe
  C:\Windows\System\yGUkEoZ.exe
  2⤵
  PID:13572
- C:\Windows\System\ELpHZPD.exe
  C:\Windows\System\ELpHZPD.exe
  2⤵
  PID:13860
- C:\Windows\System\MTjHXhu.exe
  C:\Windows\System\MTjHXhu.exe
  2⤵
  PID:14192
- C:\Windows\System\MOvudMp.exe
  C:\Windows\System\MOvudMp.exe
  2⤵
  PID:2956
- C:\Windows\System\gCBFCTF.exe
  C:\Windows\System\gCBFCTF.exe
  2⤵
  PID:4552
- C:\Windows\System\DTDicfd.exe
  C:\Windows\System\DTDicfd.exe
  2⤵
  PID:4740
- C:\Windows\System\DXTxztH.exe
  C:\Windows\System\DXTxztH.exe
  2⤵
  PID:11724
- C:\Windows\System\YiySLMI.exe
  C:\Windows\System\YiySLMI.exe
  2⤵
  PID:13344
- C:\Windows\System\lXLFamO.exe
  C:\Windows\System\lXLFamO.exe
  2⤵
  PID:13340
- C:\Windows\System\byJGjAm.exe
  C:\Windows\System\byJGjAm.exe
  2⤵
  PID:13452
- C:\Windows\System\uXYzFqU.exe
  C:\Windows\System\uXYzFqU.exe
  2⤵
  PID:13508
- C:\Windows\System\qVcivaD.exe
  C:\Windows\System\qVcivaD.exe
  2⤵
  PID:13616
- C:\Windows\System\zonLCLn.exe
  C:\Windows\System\zonLCLn.exe
  2⤵
  PID:1020
- C:\Windows\System\XBQRvRN.exe
  C:\Windows\System\XBQRvRN.exe
  2⤵
  PID:13680
- C:\Windows\System\iAfiJMI.exe
  C:\Windows\System\iAfiJMI.exe
  2⤵
  PID:13756
- C:\Windows\System\JJQJZAf.exe
  C:\Windows\System\JJQJZAf.exe
  2⤵
  PID:13808
- C:\Windows\System\KmFGDSj.exe
  C:\Windows\System\KmFGDSj.exe
  2⤵
  PID:13804
- C:\Windows\System\byUwmhY.exe
  C:\Windows\System\byUwmhY.exe
  2⤵
  PID:13856
- C:\Windows\System\QLFAcDE.exe
  C:\Windows\System\QLFAcDE.exe
  2⤵
  PID:13900
- C:\Windows\System\RwiNmbm.exe
  C:\Windows\System\RwiNmbm.exe
  2⤵
  PID:13924
- C:\Windows\System\eyjKecR.exe
  C:\Windows\System\eyjKecR.exe
  2⤵
  PID:13932
- C:\Windows\System\cftQWmt.exe
  C:\Windows\System\cftQWmt.exe
  2⤵
  PID:13972
- C:\Windows\System\yIRaTgT.exe
  C:\Windows\System\yIRaTgT.exe
  2⤵
  PID:3188
- C:\Windows\System\JSakOxp.exe
  C:\Windows\System\JSakOxp.exe
  2⤵
  PID:2892
- C:\Windows\System\uuOcHyO.exe
  C:\Windows\System\uuOcHyO.exe
  2⤵
  PID:14012
- C:\Windows\System\jpYitVs.exe
  C:\Windows\System\jpYitVs.exe
  2⤵
  PID:14020
- C:\Windows\System\JHxbGJa.exe
  C:\Windows\System\JHxbGJa.exe
  2⤵
  PID:14044
- C:\Windows\System\zqzKaEX.exe
  C:\Windows\System\zqzKaEX.exe
  2⤵
  PID:14068
- C:\Windows\System\ZKiCFRn.exe
  C:\Windows\System\ZKiCFRn.exe
  2⤵
  PID:14080
- C:\Windows\System\KtuVKfu.exe
  C:\Windows\System\KtuVKfu.exe
  2⤵
  PID:14100
- C:\Windows\System\stIkhzk.exe
  C:\Windows\System\stIkhzk.exe
  2⤵
  PID:14120
- C:\Windows\System\VufUAYe.exe
  C:\Windows\System\VufUAYe.exe
  2⤵
  PID:14140
- C:\Windows\System\UfOhWrh.exe
  C:\Windows\System\UfOhWrh.exe
  2⤵
  PID:14148
- C:\Windows\System\ZaKyTKA.exe
  C:\Windows\System\ZaKyTKA.exe
  2⤵
  PID:13504
- C:\Windows\System\qLuTiML.exe
  C:\Windows\System\qLuTiML.exe
  2⤵
  PID:11324
- C:\Windows\System\vvuVYOB.exe
  C:\Windows\System\vvuVYOB.exe
  2⤵
  PID:14176
- C:\Windows\System\sjOKDTW.exe
  C:\Windows\System\sjOKDTW.exe
  2⤵
  PID:11624
- C:\Windows\System\omtGzow.exe
  C:\Windows\System\omtGzow.exe
  2⤵
  PID:3224
- C:\Windows\System\cYeNaCj.exe
  C:\Windows\System\cYeNaCj.exe
  2⤵
  PID:14204
- C:\Windows\System\AAVAVnq.exe
  C:\Windows\System\AAVAVnq.exe
  2⤵
  PID:14228
- C:\Windows\System\vmXsSdf.exe
  C:\Windows\System\vmXsSdf.exe
  2⤵
  PID:14252
- C:\Windows\System\gskXyHU.exe
  C:\Windows\System\gskXyHU.exe
  2⤵
  PID:14268
- C:\Windows\System\iRWDasV.exe
  C:\Windows\System\iRWDasV.exe
  2⤵
  PID:14288
- C:\Windows\System\LYiznpW.exe
  C:\Windows\System\LYiznpW.exe
  2⤵
  PID:14316
- C:\Windows\System\QlqAKnL.exe
  C:\Windows\System\QlqAKnL.exe
  2⤵
  PID:4820
- C:\Windows\System\PQYUlwr.exe
  C:\Windows\System\PQYUlwr.exe
  2⤵
  PID:3468
- C:\Windows\System\qkLxKXY.exe
  C:\Windows\System\qkLxKXY.exe
  2⤵
  PID:13564
- C:\Windows\System\BMMwLHO.exe
  C:\Windows\System\BMMwLHO.exe
  2⤵
  PID:13636
- C:\Windows\System\usDfjTh.exe
  C:\Windows\System\usDfjTh.exe
  2⤵
  PID:3896
- C:\Windows\System\jSzWane.exe
  C:\Windows\System\jSzWane.exe
  2⤵
  PID:4840
- C:\Windows\System\PQJipTt.exe
  C:\Windows\System\PQJipTt.exe
  2⤵
  PID:13996
- C:\Windows\System\HcnalEc.exe
  C:\Windows\System\HcnalEc.exe
  2⤵
  PID:2608
- C:\Windows\System\NIVPXKN.exe
  C:\Windows\System\NIVPXKN.exe
  2⤵
  PID:13584
- C:\Windows\System\WAMkIvx.exe
  C:\Windows\System\WAMkIvx.exe
  2⤵
  PID:4228
- C:\Windows\System\VBjFGJf.exe
  C:\Windows\System\VBjFGJf.exe
  2⤵
  PID:13776
- C:\Windows\System\AThOcbb.exe
  C:\Windows\System\AThOcbb.exe
  2⤵
  PID:13652
- C:\Windows\System\asWVoLN.exe
  C:\Windows\System\asWVoLN.exe
  2⤵
  PID:552
- C:\Windows\System\hpTFByx.exe
  C:\Windows\System\hpTFByx.exe
  2⤵
  PID:13712
- C:\Windows\System\WtsRawS.exe
  C:\Windows\System\WtsRawS.exe
  2⤵
  PID:1740
- C:\Windows\System\hoimoTn.exe
  C:\Windows\System\hoimoTn.exe
  2⤵
  PID:14008
- C:\Windows\System\TvYkWsS.exe
  C:\Windows\System\TvYkWsS.exe
  2⤵
  PID:13792
- C:\Windows\System\ibRFBwX.exe
  C:\Windows\System\ibRFBwX.exe
  2⤵
  PID:13800
- C:\Windows\System\sGncaEn.exe
  C:\Windows\System\sGncaEn.exe
  2⤵
  PID:13848
- C:\Windows\System\cwaFAsL.exe
  C:\Windows\System\cwaFAsL.exe
  2⤵
  PID:13752
- C:\Windows\System\RbRHpsL.exe
  C:\Windows\System\RbRHpsL.exe
  2⤵
  PID:5052
- C:\Windows\System\AKKQuAJ.exe
  C:\Windows\System\AKKQuAJ.exe
  2⤵
  PID:4264
- C:\Windows\System\NCUpjoH.exe
  C:\Windows\System\NCUpjoH.exe
  2⤵
  PID:4416
- C:\Windows\System\pvbyWuD.exe
  C:\Windows\System\pvbyWuD.exe
  2⤵
  PID:14064
- C:\Windows\System\RflNpZI.exe
  C:\Windows\System\RflNpZI.exe
  2⤵
  PID:2720
- C:\Windows\System\GMyclRg.exe
  C:\Windows\System\GMyclRg.exe
  2⤵
  PID:14276
- C:\Windows\System\OTShBar.exe
  C:\Windows\System\OTShBar.exe
  2⤵
  PID:14096
- C:\Windows\System\FVnwnVt.exe
  C:\Windows\System\FVnwnVt.exe
  2⤵
  PID:1720
- C:\Windows\System\tDDPaYT.exe
  C:\Windows\System\tDDPaYT.exe
  2⤵
  PID:3340
- C:\Windows\System\hVPMuUI.exe
  C:\Windows\System\hVPMuUI.exe
  2⤵
  PID:13948
- C:\Windows\System\MXBFzBd.exe
  C:\Windows\System\MXBFzBd.exe
  2⤵
  PID:14156
- C:\Windows\System\USemakj.exe
  C:\Windows\System\USemakj.exe
  2⤵
  PID:14280
- C:\Windows\System\WUIawHe.exe
  C:\Windows\System\WUIawHe.exe
  2⤵
  PID:4616
- C:\Windows\System\uJqhmzk.exe
  C:\Windows\System\uJqhmzk.exe
  2⤵
  PID:11748
- C:\Windows\System\miOObld.exe
  C:\Windows\System\miOObld.exe
  2⤵
  PID:14256
- C:\Windows\System\SNULsbl.exe
  C:\Windows\System\SNULsbl.exe
  2⤵
  PID:1088
- C:\Windows\System\rqhopwS.exe
  C:\Windows\System\rqhopwS.exe
  2⤵
  PID:4816
- C:\Windows\System\olYsJDu.exe
  C:\Windows\System\olYsJDu.exe
  2⤵
  PID:13332
- C:\Windows\System\yzPNyjA.exe
  C:\Windows\System\yzPNyjA.exe
  2⤵
  PID:1540
- C:\Windows\System\zzGBiiI.exe
  C:\Windows\System\zzGBiiI.exe
  2⤵
  PID:4232
- C:\Windows\System\YkhjCJC.exe
  C:\Windows\System\YkhjCJC.exe
  2⤵
  PID:13872
- C:\Windows\System\rWiKJKb.exe
  C:\Windows\System\rWiKJKb.exe
  2⤵
  PID:13844
- C:\Windows\System\qrlUgUa.exe
  C:\Windows\System\qrlUgUa.exe
  2⤵
  PID:1788
- C:\Windows\System\bbUgASQ.exe
  C:\Windows\System\bbUgASQ.exe
  2⤵
  PID:1752
- C:\Windows\System\flMgBAe.exe
  C:\Windows\System\flMgBAe.exe
  2⤵
  PID:808
- C:\Windows\System\ZNdyCoi.exe
  C:\Windows\System\ZNdyCoi.exe
  2⤵
  PID:3492
- C:\Windows\System\CziLyJU.exe
  C:\Windows\System\CziLyJU.exe
  2⤵
  PID:1096
- C:\Windows\System\PtHVEbY.exe
  C:\Windows\System\PtHVEbY.exe
  2⤵
  PID:3388
- C:\Windows\System\omuDInx.exe
  C:\Windows\System\omuDInx.exe
  2⤵
  PID:13820
- C:\Windows\System\DQTfsAw.exe
  C:\Windows\System\DQTfsAw.exe
  2⤵
  PID:4140
- C:\Windows\System\PJpoBiu.exe
  C:\Windows\System\PJpoBiu.exe
  2⤵
  PID:3324
- C:\Windows\System\WqQegYh.exe
  C:\Windows\System\WqQegYh.exe
  2⤵
  PID:2220
- C:\Windows\System\vGJUajN.exe
  C:\Windows\System\vGJUajN.exe
  2⤵
  PID:2076
- C:\Windows\System\aMXxOvp.exe
  C:\Windows\System\aMXxOvp.exe
  2⤵
  PID:3948
- C:\Windows\System\DACJCJc.exe
  C:\Windows\System\DACJCJc.exe
  2⤵
  PID:2828
- C:\Windows\System\dDXuGiZ.exe
  C:\Windows\System\dDXuGiZ.exe
  2⤵
  PID:12428
- C:\Windows\System\ZjmnFdB.exe
  C:\Windows\System\ZjmnFdB.exe
  2⤵
  PID:448
- C:\Windows\System\KoVZuuv.exe
  C:\Windows\System\KoVZuuv.exe
  2⤵
  PID:1392
- C:\Windows\System\CtKNNVh.exe
  C:\Windows\System\CtKNNVh.exe
  2⤵
  PID:2952
- C:\Windows\System\HDFxowr.exe
  C:\Windows\System\HDFxowr.exe
  2⤵
  PID:3680
- C:\Windows\System\xbuYJwX.exe
  C:\Windows\System\xbuYJwX.exe
  2⤵
  PID:5196
- C:\Windows\System\itXRkbo.exe
  C:\Windows\System\itXRkbo.exe
  2⤵
  PID:432
- C:\Windows\System\fLbwrcO.exe
  C:\Windows\System\fLbwrcO.exe
  2⤵
  PID:14236
- C:\Windows\System\BANfjWs.exe
  C:\Windows\System\BANfjWs.exe
  2⤵
  PID:5504
- C:\Windows\System\DEOatKC.exe
  C:\Windows\System\DEOatKC.exe
  2⤵
  PID:5608
- C:\Windows\System\eZvqdak.exe
  C:\Windows\System\eZvqdak.exe
  2⤵
  PID:5380
- C:\Windows\System\qvfVcoL.exe
  C:\Windows\System\qvfVcoL.exe
  2⤵
  PID:5408
- C:\Windows\System\eAGOQbA.exe
  C:\Windows\System\eAGOQbA.exe
  2⤵
  PID:5620
- C:\Windows\System\BHwoTkD.exe
  C:\Windows\System\BHwoTkD.exe
  2⤵
  PID:5460
- C:\Windows\System\zNpQPYA.exe
  C:\Windows\System\zNpQPYA.exe
  2⤵
  PID:5296
- C:\Windows\System\sqJQaBH.exe
  C:\Windows\System\sqJQaBH.exe
  2⤵
  PID:5836
- C:\Windows\System\BdufhtE.exe
  C:\Windows\System\BdufhtE.exe
  2⤵
  PID:6068
- C:\Windows\System\tQpXRhb.exe
  C:\Windows\System\tQpXRhb.exe
  2⤵
  PID:5628
- C:\Windows\System\KSsWDxb.exe
  C:\Windows\System\KSsWDxb.exe
  2⤵
  PID:1388
- C:\Windows\System\bWdazZL.exe
  C:\Windows\System\bWdazZL.exe
  2⤵
  PID:1800
- C:\Windows\System\wduvOZx.exe
  C:\Windows\System\wduvOZx.exe
  2⤵
  PID:5516
- C:\Windows\System\DEGxXwC.exe
  C:\Windows\System\DEGxXwC.exe
  2⤵
  PID:5868
- C:\Windows\System\lHQuzua.exe
  C:\Windows\System\lHQuzua.exe
  2⤵
  PID:5704
- C:\Windows\System\VIrtWHA.exe
  C:\Windows\System\VIrtWHA.exe
  2⤵
  PID:14428
- C:\Windows\System\OGRVoOl.exe
  C:\Windows\System\OGRVoOl.exe
  2⤵
  PID:14460
- C:\Windows\System\kqmjOeK.exe
  C:\Windows\System\kqmjOeK.exe
  2⤵
  PID:14476
- C:\Windows\System\CVdDgyR.exe
  C:\Windows\System\CVdDgyR.exe
  2⤵
  PID:14500
- C:\Windows\System\VwAkRUZ.exe
  C:\Windows\System\VwAkRUZ.exe
  2⤵
  PID:14524
- C:\Windows\System\gXsBXZX.exe
  C:\Windows\System\gXsBXZX.exe
  2⤵
  PID:14552
- C:\Windows\System\YkybzhH.exe
  C:\Windows\System\YkybzhH.exe
  2⤵
  PID:14576
- C:\Windows\System\HucWUuX.exe
  C:\Windows\System\HucWUuX.exe
  2⤵
  PID:14612
- C:\Windows\System\YeFWSij.exe
  C:\Windows\System\YeFWSij.exe
  2⤵
  PID:14708
- C:\Windows\System\QgQPqYS.exe
  C:\Windows\System\QgQPqYS.exe
  2⤵
  PID:14796
- C:\Windows\System\VohFUrk.exe
  C:\Windows\System\VohFUrk.exe
  2⤵
  PID:14844
- C:\Windows\System\RgoCiwA.exe
  C:\Windows\System\RgoCiwA.exe
  2⤵
  PID:14868
- C:\Windows\System\NagCkgM.exe
  C:\Windows\System\NagCkgM.exe
  2⤵
  PID:14904
- C:\Windows\System\PFFCPBI.exe
  C:\Windows\System\PFFCPBI.exe
  2⤵
  PID:14936
- C:\Windows\System\uxnYqKY.exe
  C:\Windows\System\uxnYqKY.exe
  2⤵
  PID:14960
- C:\Windows\System\Wqklomh.exe
  C:\Windows\System\Wqklomh.exe
  2⤵
  PID:14984
- C:\Windows\System\EKGfEJr.exe
  C:\Windows\System\EKGfEJr.exe
  2⤵
  PID:15020
- C:\Windows\System\ccKTBpN.exe
  C:\Windows\System\ccKTBpN.exe
  2⤵
  PID:15040
- C:\Windows\System\jQrVMGU.exe
  C:\Windows\System\jQrVMGU.exe
  2⤵
  PID:15072
- C:\Windows\System\vjEQsum.exe
  C:\Windows\System\vjEQsum.exe
  2⤵
  PID:15176
- C:\Windows\System\nWwmYHJ.exe
  C:\Windows\System\nWwmYHJ.exe
  2⤵
  PID:15200
- C:\Windows\System\JmvtwbT.exe
  C:\Windows\System\JmvtwbT.exe
  2⤵
  PID:15216
- C:\Windows\System\hDHbDbe.exe
  C:\Windows\System\hDHbDbe.exe
  2⤵
  PID:15256
- C:\Windows\System\MqZaYGr.exe
  C:\Windows\System\MqZaYGr.exe
  2⤵
  PID:15276
- C:\Windows\System\iVIDiZR.exe
  C:\Windows\System\iVIDiZR.exe
  2⤵
  PID:15308
- C:\Windows\System\vnIwGCO.exe
  C:\Windows\System\vnIwGCO.exe
  2⤵
  PID:15332
- C:\Windows\System\BNFTOiT.exe
  C:\Windows\System\BNFTOiT.exe
  2⤵
  PID:1112
- C:\Windows\System\DrLinPt.exe
  C:\Windows\System\DrLinPt.exe
  2⤵
  PID:13836
- C:\Windows\System\tqNxcLM.exe
  C:\Windows\System\tqNxcLM.exe
  2⤵
  PID:14340
- C:\Windows\System\ckGSoQp.exe
  C:\Windows\System\ckGSoQp.exe
  2⤵
  PID:5632
- C:\Windows\System\MRQtPlU.exe
  C:\Windows\System\MRQtPlU.exe
  2⤵
  PID:5788
- C:\Windows\System\bCOkUTQ.exe
  C:\Windows\System\bCOkUTQ.exe
  2⤵
  PID:4520
- C:\Windows\System\TVMkGkI.exe
  C:\Windows\System\TVMkGkI.exe
  2⤵
  PID:14508
- C:\Windows\System\azgSoTN.exe
  C:\Windows\System\azgSoTN.exe
  2⤵
  PID:14520
- C:\Windows\System\xDFxpia.exe
  C:\Windows\System\xDFxpia.exe
  2⤵
  PID:988
- C:\Windows\System\QtJdsAG.exe
  C:\Windows\System\QtJdsAG.exe
  2⤵
  PID:14600
- C:\Windows\System\wqLOemD.exe
  C:\Windows\System\wqLOemD.exe
  2⤵
  PID:14648
- C:\Windows\System\DecRAqw.exe
  C:\Windows\System\DecRAqw.exe
  2⤵
  PID:14624
- C:\Windows\System\wiusKUe.exe
  C:\Windows\System\wiusKUe.exe
  2⤵
  PID:14736
- C:\Windows\System\Blrqqhv.exe
  C:\Windows\System\Blrqqhv.exe
  2⤵
  PID:6384
- C:\Windows\System\anTStbW.exe
  C:\Windows\System\anTStbW.exe
  2⤵
  PID:14852
- C:\Windows\System\reOZJLo.exe
  C:\Windows\System\reOZJLo.exe
  2⤵
  PID:14892
- C:\Windows\System\HafTPaq.exe
  C:\Windows\System\HafTPaq.exe
  2⤵
  PID:6212
- C:\Windows\System\aIFSVUU.exe
  C:\Windows\System\aIFSVUU.exe
  2⤵
  PID:14956
- C:\Windows\System\xRcYgsG.exe
  C:\Windows\System\xRcYgsG.exe
  2⤵
  PID:14992
- C:\Windows\System\aletgJf.exe
  C:\Windows\System\aletgJf.exe
  2⤵
  PID:15012
- C:\Windows\System\hKENtKW.exe
  C:\Windows\System\hKENtKW.exe
  2⤵
  PID:15056
- C:\Windows\System\lQStnBQ.exe
  C:\Windows\System\lQStnBQ.exe
  2⤵
  PID:15124
- C:\Windows\System\EKiPHTD.exe
  C:\Windows\System\EKiPHTD.exe
  2⤵
  PID:15172
- C:\Windows\System\vJisryb.exe
  C:\Windows\System\vJisryb.exe
  2⤵
  PID:15192
- C:\Windows\System\DAuaXzL.exe
  C:\Windows\System\DAuaXzL.exe
  2⤵
  PID:7164
- C:\Windows\System\jpbLZYU.exe
  C:\Windows\System\jpbLZYU.exe
  2⤵
  PID:6668
- C:\Windows\System\gSfGfBP.exe
  C:\Windows\System\gSfGfBP.exe
  2⤵
  PID:6764
- C:\Windows\System\cQKAcQc.exe
  C:\Windows\System\cQKAcQc.exe
  2⤵
  PID:15344
- C:\Windows\System\zuEMJFp.exe
  C:\Windows\System\zuEMJFp.exe
  2⤵
  PID:5940
- C:\Windows\System\bZSrnOH.exe
  C:\Windows\System\bZSrnOH.exe
  2⤵
  PID:3472
- C:\Windows\System\pekdAKr.exe
  C:\Windows\System\pekdAKr.exe
  2⤵
  PID:14404
- C:\Windows\System\otUEjNe.exe
  C:\Windows\System\otUEjNe.exe
  2⤵
  PID:6828
- C:\Windows\System\VzASnPz.exe
  C:\Windows\System\VzASnPz.exe
  2⤵
  PID:14440
- C:\Windows\System\XGyfaOD.exe
  C:\Windows\System\XGyfaOD.exe
  2⤵
  PID:7068
- C:\Windows\System\NeSMwuO.exe
  C:\Windows\System\NeSMwuO.exe
  2⤵
  PID:5580
- C:\Windows\System\scwDgBD.exe
  C:\Windows\System\scwDgBD.exe
  2⤵
  PID:5584
- C:\Windows\System\ctLrZSk.exe
  C:\Windows\System\ctLrZSk.exe
  2⤵
  PID:14696
- C:\Windows\System\gBJvdBx.exe
  C:\Windows\System\gBJvdBx.exe
  2⤵
  PID:14672
- C:\Windows\System\RkFFBUA.exe
  C:\Windows\System\RkFFBUA.exe
  2⤵
  PID:5148
- C:\Windows\System\TqzKofM.exe
  C:\Windows\System\TqzKofM.exe
  2⤵
  PID:14784
- C:\Windows\System\gOygjPA.exe
  C:\Windows\System\gOygjPA.exe
  2⤵
  PID:6636
- C:\Windows\System\qGcrWxs.exe
  C:\Windows\System\qGcrWxs.exe
  2⤵
  PID:7228
- C:\Windows\System\kJgyWPW.exe
  C:\Windows\System\kJgyWPW.exe
  2⤵
  PID:14824
- C:\Windows\System\EFpoCgW.exe
  C:\Windows\System\EFpoCgW.exe
  2⤵
  PID:15104
- C:\Windows\System\uXYGPkw.exe
  C:\Windows\System\uXYGPkw.exe
  2⤵
  PID:7328
- C:\Windows\System\AbdfmAo.exe
  C:\Windows\System\AbdfmAo.exe
  2⤵
  PID:6032
- C:\Windows\System\gsQLSoC.exe
  C:\Windows\System\gsQLSoC.exe
  2⤵
  PID:6296
- C:\Windows\System\NCmkKZr.exe
  C:\Windows\System\NCmkKZr.exe
  2⤵
  PID:6452
- C:\Windows\System\ogbAfib.exe
  C:\Windows\System\ogbAfib.exe
  2⤵
  PID:6896
- C:\Windows\System\qJwCCsj.exe
  C:\Windows\System\qJwCCsj.exe
  2⤵
  PID:6476
- C:\Windows\System\QvldprL.exe
  C:\Windows\System\QvldprL.exe
  2⤵
  PID:6856
- C:\Windows\System\PfrGISs.exe
  C:\Windows\System\PfrGISs.exe
  2⤵
  PID:6416
- C:\Windows\System\yrkfiZn.exe
  C:\Windows\System\yrkfiZn.exe
  2⤵
  PID:6000
- C:\Windows\System\parJBGX.exe
  C:\Windows\System\parJBGX.exe
  2⤵
  PID:6900
- C:\Windows\System\BVXIaEJ.exe
  C:\Windows\System\BVXIaEJ.exe
  2⤵
  PID:12504
- C:\Windows\System\amhcJRk.exe
  C:\Windows\System\amhcJRk.exe
  2⤵
  PID:7028
- C:\Windows\System\SzeyOLy.exe
  C:\Windows\System\SzeyOLy.exe
  2⤵
  PID:6552
- C:\Windows\System\QsBfRkk.exe
  C:\Windows\System\QsBfRkk.exe
  2⤵
  PID:7072
- C:\Windows\System\HzAVTLP.exe
  C:\Windows\System\HzAVTLP.exe
  2⤵
  PID:4576
- C:\Windows\System\pinzhDj.exe
  C:\Windows\System\pinzhDj.exe
  2⤵
  PID:15356
- C:\Windows\System\upaYpGr.exe
  C:\Windows\System\upaYpGr.exe
  2⤵
  PID:7044
- C:\Windows\System\HEvqvlu.exe
  C:\Windows\System\HEvqvlu.exe
  2⤵
  PID:4492
- C:\Windows\System\JRmdHYl.exe
  C:\Windows\System\JRmdHYl.exe
  2⤵
  PID:7912
- C:\Windows\System\qGNXjBY.exe
  C:\Windows\System\qGNXjBY.exe
  2⤵
  PID:14400
- C:\Windows\System\BbSJgLb.exe
  C:\Windows\System\BbSJgLb.exe
  2⤵
  PID:7364
- C:\Windows\System\CKqcUqt.exe
  C:\Windows\System\CKqcUqt.exe
  2⤵
  PID:14496
- C:\Windows\System\eZjpXdO.exe
  C:\Windows\System\eZjpXdO.exe
  2⤵
  PID:14728
- C:\Windows\System\uyrBXpw.exe
  C:\Windows\System\uyrBXpw.exe
  2⤵
  PID:14768
- C:\Windows\System\nryzrQo.exe
  C:\Windows\System\nryzrQo.exe
  2⤵
  PID:6724
- C:\Windows\System\aVgIchz.exe
  C:\Windows\System\aVgIchz.exe
  2⤵
  PID:8308
- C:\Windows\System\gQzduxf.exe
  C:\Windows\System\gQzduxf.exe
  2⤵
  PID:6708
- C:\Windows\System\uRZlEZT.exe
  C:\Windows\System\uRZlEZT.exe
  2⤵
  PID:5312
- C:\Windows\System\YrJHmSC.exe
  C:\Windows\System\YrJHmSC.exe
  2⤵
  PID:8600
- C:\Windows\System\puOhrEr.exe
  C:\Windows\System\puOhrEr.exe
  2⤵
  PID:5764
- C:\Windows\System\ebcvHnz.exe
  C:\Windows\System\ebcvHnz.exe
  2⤵
  PID:14980
- C:\Windows\System\yjDfhSP.exe
  C:\Windows\System\yjDfhSP.exe
  2⤵
  PID:8536
- C:\Windows\System\bUmfFbI.exe
  C:\Windows\System\bUmfFbI.exe
  2⤵
  PID:8488
- C:\Windows\System\OtRSzEk.exe
  C:\Windows\System\OtRSzEk.exe
  2⤵
  PID:8428
- C:\Windows\System\gswRvSD.exe
  C:\Windows\System\gswRvSD.exe
  2⤵
  PID:8648
- C:\Windows\System\DSPDAKo.exe
  C:\Windows\System\DSPDAKo.exe
  2⤵
  PID:15048
- C:\Windows\System\HhrpRnI.exe
  C:\Windows\System\HhrpRnI.exe
  2⤵
  PID:15144
- C:\Windows\System\lGkNNVj.exe
  C:\Windows\System\lGkNNVj.exe
  2⤵
  PID:8832
- C:\Windows\System\cBHzQWL.exe
  C:\Windows\System\cBHzQWL.exe
  2⤵
  PID:7400
- C:\Windows\System\szNQfRJ.exe
  C:\Windows\System\szNQfRJ.exe
  2⤵
  PID:7620
- C:\Windows\System\FBLftgi.exe
  C:\Windows\System\FBLftgi.exe
  2⤵
  PID:8900
- C:\Windows\System\jOmHXOr.exe
  C:\Windows\System\jOmHXOr.exe
  2⤵
  PID:3140
- C:\Windows\System\yVTJHRX.exe
  C:\Windows\System\yVTJHRX.exe
  2⤵
  PID:6460
- C:\Windows\System\jFmzJRU.exe
  C:\Windows\System\jFmzJRU.exe
  2⤵
  PID:8976
- C:\Windows\System\wscwbXT.exe
  C:\Windows\System\wscwbXT.exe
  2⤵
  PID:15324
- C:\Windows\System\jgTZenK.exe
  C:\Windows\System\jgTZenK.exe
  2⤵
  PID:15328
- C:\Windows\System\pviKtal.exe
  C:\Windows\System\pviKtal.exe
  2⤵
  PID:7916
- C:\Windows\System\mfpcsdw.exe
  C:\Windows\System\mfpcsdw.exe
  2⤵
  PID:9564
- C:\Windows\System\jsYOlCt.exe
  C:\Windows\System\jsYOlCt.exe
  2⤵
  PID:5560
- C:\Windows\System\FjpnhKb.exe
  C:\Windows\System\FjpnhKb.exe
  2⤵
  PID:9708
- C:\Windows\System\GnfHvWb.exe
  C:\Windows\System\GnfHvWb.exe
  2⤵
  PID:7792
- C:\Windows\System\MPimOus.exe
  C:\Windows\System\MPimOus.exe
  2⤵
  PID:5992
- C:\Windows\System\zovzCcc.exe
  C:\Windows\System\zovzCcc.exe
  2⤵
  PID:9076
- C:\Windows\System\xafxAmV.exe
  C:\Windows\System\xafxAmV.exe
  2⤵
  PID:7252
- C:\Windows\System\BMPkPJL.exe
  C:\Windows\System\BMPkPJL.exe
  2⤵
  PID:10216
- C:\Windows\System\lUdmdKx.exe
  C:\Windows\System\lUdmdKx.exe
  2⤵
  PID:8468
- C:\Windows\System\lwotSam.exe
  C:\Windows\System\lwotSam.exe
  2⤵
  PID:6064
- C:\Windows\System\vjoilCT.exe
  C:\Windows\System\vjoilCT.exe
  2⤵
  PID:5368
- C:\Windows\System\FKrjcwA.exe
  C:\Windows\System\FKrjcwA.exe
  2⤵
  PID:14792
- C:\Windows\System\pgXLzkE.exe
  C:\Windows\System\pgXLzkE.exe
  2⤵
  PID:9376
- C:\Windows\System\CEBagpZ.exe
  C:\Windows\System\CEBagpZ.exe
  2⤵
  PID:9252
- C:\Windows\System\VONzjFB.exe
  C:\Windows\System\VONzjFB.exe
  2⤵
  PID:9520
- C:\Windows\System\AepsLhb.exe
  C:\Windows\System\AepsLhb.exe
  2⤵
  PID:8208
- C:\Windows\System\oieYsjf.exe
  C:\Windows\System\oieYsjf.exe
  2⤵
  PID:8856
- C:\Windows\System\PozpIso.exe
  C:\Windows\System\PozpIso.exe
  2⤵
  PID:9040
- C:\Windows\System\ZvmbuPw.exe
  C:\Windows\System\ZvmbuPw.exe
  2⤵
  PID:13348
- C:\Windows\System\HIEiyzK.exe
  C:\Windows\System\HIEiyzK.exe
  2⤵
  PID:9000
- C:\Windows\System\FWvAMKW.exe
  C:\Windows\System\FWvAMKW.exe
  2⤵
  PID:9348
- C:\Windows\System\rlEcyPE.exe
  C:\Windows\System\rlEcyPE.exe
  2⤵
  PID:9948
- C:\Windows\System\ZNPtkZx.exe
  C:\Windows\System\ZNPtkZx.exe
  2⤵
  PID:6112
- C:\Windows\System\oupimse.exe
  C:\Windows\System\oupimse.exe
  2⤵
  PID:10352
- C:\Windows\System\QReWPmB.exe
  C:\Windows\System\QReWPmB.exe
  2⤵
  PID:9772
- C:\Windows\System\xLnGLYd.exe
  C:\Windows\System\xLnGLYd.exe
  2⤵
  PID:14372
- C:\Windows\System\YGGNwVQ.exe
  C:\Windows\System\YGGNwVQ.exe
  2⤵
  PID:9716
- C:\Windows\System\smsxiDv.exe
  C:\Windows\System\smsxiDv.exe
  2⤵
  PID:10372
- C:\Windows\System\fSVXdeq.exe
  C:\Windows\System\fSVXdeq.exe
  2⤵
  PID:9576
- C:\Windows\System\RcjmOMW.exe
  C:\Windows\System\RcjmOMW.exe
  2⤵
  PID:7940
- C:\Windows\System\uqAQKWy.exe
  C:\Windows\System\uqAQKWy.exe
  2⤵
  PID:10004
- C:\Windows\System\MySNLYz.exe
  C:\Windows\System\MySNLYz.exe
  2⤵
  PID:14864
- C:\Windows\System\RUjwkbC.exe
  C:\Windows\System\RUjwkbC.exe
  2⤵
  PID:8544
- C:\Windows\System\YHbUmHK.exe
  C:\Windows\System\YHbUmHK.exe
  2⤵
  PID:14976
- C:\Windows\System\ybxUnca.exe
  C:\Windows\System\ybxUnca.exe
  2⤵
  PID:9236
- C:\Windows\System\URWCVis.exe
  C:\Windows\System\URWCVis.exe
  2⤵
  PID:6696
- C:\Windows\System\EgIxBEf.exe
  C:\Windows\System\EgIxBEf.exe
  2⤵
  PID:9168
- C:\Windows\System\nGqtBKe.exe
  C:\Windows\System\nGqtBKe.exe
  2⤵
  PID:11200
- C:\Windows\System\AhktnSU.exe
  C:\Windows\System\AhktnSU.exe
  2⤵
  PID:8748
- C:\Windows\System\qMlgoie.exe
  C:\Windows\System\qMlgoie.exe
  2⤵
  PID:7544
- C:\Windows\System\ipUtTqe.exe
  C:\Windows\System\ipUtTqe.exe
  2⤵
  PID:10276
- C:\Windows\System\WPuuikp.exe
  C:\Windows\System\WPuuikp.exe
  2⤵
  PID:5192
- C:\Windows\System\IGTcQqi.exe
  C:\Windows\System\IGTcQqi.exe
  2⤵
  PID:9140
- C:\Windows\System\cSSzqqs.exe
  C:\Windows\System\cSSzqqs.exe
  2⤵
  PID:6872
- C:\Windows\System\oyaUAgw.exe
  C:\Windows\System\oyaUAgw.exe
  2⤵
  PID:10484
- C:\Windows\System\RNEjbEU.exe
  C:\Windows\System\RNEjbEU.exe
  2⤵
  PID:10192
- C:\Windows\System\XAGhyzP.exe
  C:\Windows\System\XAGhyzP.exe
  2⤵
  PID:10600
- C:\Windows\System\WCpGBBV.exe
  C:\Windows\System\WCpGBBV.exe
  2⤵
  PID:14816
- C:\Windows\System\PFmKlyi.exe
  C:\Windows\System\PFmKlyi.exe
  2⤵
  PID:11352
- C:\Windows\System\VaqJUIp.exe
  C:\Windows\System\VaqJUIp.exe
  2⤵
  PID:10744
- C:\Windows\System\omgelRa.exe
  C:\Windows\System\omgelRa.exe
  2⤵
  PID:4788
- C:\Windows\System\BKOQKnO.exe
  C:\Windows\System\BKOQKnO.exe
  2⤵
  PID:10888
- C:\Windows\System\FAqgGdD.exe
  C:\Windows\System\FAqgGdD.exe
  2⤵
  PID:10768
- C:\Windows\System\vXBVGqY.exe
  C:\Windows\System\vXBVGqY.exe
  2⤵
  PID:8060
- C:\Windows\System\gSjdQLb.exe
  C:\Windows\System\gSjdQLb.exe
  2⤵
  PID:7040
- C:\Windows\System\siFPwJM.exe
  C:\Windows\System\siFPwJM.exe
  2⤵
  PID:9620
- C:\Windows\System\oIeRGtr.exe
  C:\Windows\System\oIeRGtr.exe
  2⤵
  PID:11072
- C:\Windows\System\qzVqFJc.exe
  C:\Windows\System\qzVqFJc.exe
  2⤵
  PID:6624
- C:\Windows\System\quVNShJ.exe
  C:\Windows\System\quVNShJ.exe
  2⤵
  PID:9240
- C:\Windows\System\FmtcZFV.exe
  C:\Windows\System\FmtcZFV.exe
  2⤵
  PID:11664
- C:\Windows\System\cxaMuGE.exe
  C:\Windows\System\cxaMuGE.exe
  2⤵
  PID:7968
- C:\Windows\System\CkldrkM.exe
  C:\Windows\System\CkldrkM.exe
  2⤵
  PID:11124
- C:\Windows\System\PDRKjsv.exe
  C:\Windows\System\PDRKjsv.exe
  2⤵
  PID:14436
- C:\Windows\System\ABQrZXG.exe
  C:\Windows\System\ABQrZXG.exe
  2⤵
  PID:6952
- C:\Windows\System\fuMzKLC.exe
  C:\Windows\System\fuMzKLC.exe
  2⤵
  PID:8792
- C:\Windows\System\mGqwvRW.exe
  C:\Windows\System\mGqwvRW.exe
  2⤵
  PID:9304
- C:\Windows\System\VfhBnry.exe
  C:\Windows\System\VfhBnry.exe
  2⤵
  PID:10968
- C:\Windows\System\TMSdsoh.exe
  C:\Windows\System\TMSdsoh.exe
  2⤵
  PID:8000
- C:\Windows\System\cuLMAnT.exe
  C:\Windows\System\cuLMAnT.exe
  2⤵
  PID:11956
- C:\Windows\System\SbkjNQZ.exe
  C:\Windows\System\SbkjNQZ.exe
  2⤵
  PID:12040
- C:\Windows\System\UtukNDe.exe
  C:\Windows\System\UtukNDe.exe
  2⤵
  PID:9628
- C:\Windows\System\rMyPfoR.exe
  C:\Windows\System\rMyPfoR.exe
  2⤵
  PID:8776
- C:\Windows\System\clFPyWs.exe
  C:\Windows\System\clFPyWs.exe
  2⤵
  PID:8632
- C:\Windows\System\ydCwkFX.exe
  C:\Windows\System\ydCwkFX.exe
  2⤵
  PID:7308
- C:\Windows\System\kbdDKbC.exe
  C:\Windows\System\kbdDKbC.exe
  2⤵
  PID:10000
- C:\Windows\System\pYPXhSC.exe
  C:\Windows\System\pYPXhSC.exe
  2⤵
  PID:5772
- C:\Windows\System\DYpcgnL.exe
  C:\Windows\System\DYpcgnL.exe
  2⤵
  PID:12152
- C:\Windows\System\uYYDJvT.exe
  C:\Windows\System\uYYDJvT.exe
  2⤵
  PID:10428
- C:\Windows\System\BinfqmJ.exe
  C:\Windows\System\BinfqmJ.exe
  2⤵
  PID:12268
- C:\Windows\System\jApBAbZ.exe
  C:\Windows\System\jApBAbZ.exe
  2⤵
  PID:15408
- C:\Windows\System\bNqaJFd.exe
  C:\Windows\System\bNqaJFd.exe
  2⤵
  PID:15424
- C:\Windows\System\hVXRIiG.exe
  C:\Windows\System\hVXRIiG.exe
  2⤵
  PID:15456
- C:\Windows\System\YMKmqxI.exe
  C:\Windows\System\YMKmqxI.exe
  2⤵
  PID:15480
- C:\Windows\System\vrodEHN.exe
  C:\Windows\System\vrodEHN.exe
  2⤵
  PID:15504
- C:\Windows\System\kRoekst.exe
  C:\Windows\System\kRoekst.exe
  2⤵
  PID:15536
- C:\Windows\System\QUzTRLK.exe
  C:\Windows\System\QUzTRLK.exe
  2⤵
  PID:15560
- C:\Windows\System\RNvTMvi.exe
  C:\Windows\System\RNvTMvi.exe
  2⤵
  PID:15592
- C:\Windows\System\JkxFoxK.exe
  C:\Windows\System\JkxFoxK.exe
  2⤵
  PID:15624

Network

DNS

raw.githubusercontent.com

powershell.exe

Remote address:

8.8.8.8:53

Request

raw.githubusercontent.com

IN A

Response

raw.githubusercontent.com

IN A

185.199.108.133

raw.githubusercontent.com

IN A

185.199.110.133

raw.githubusercontent.com

IN A

185.199.111.133

raw.githubusercontent.com

IN A

185.199.109.133
DNS

8.8.8.8.in-addr.arpa

Remote address:

8.8.8.8:53

Request

8.8.8.8.in-addr.arpa

IN PTR

Response

8.8.8.8.in-addr.arpa

IN PTR

dnsgoogle
GET

https://raw.githubusercontent.com/

powershell.exe

Remote address:

185.199.108.133:443

Request

GET / HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1237
Host: raw.githubusercontent.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Connection: keep-alive
Content-Length: 0
Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
Location: https://github.com/
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-XSS-Protection: 1; mode=block
X-GitHub-Request-Id: 0BD0:17E061:6B0163:861C4B:6640F6A8
Accept-Ranges: bytes
Date: Sun, 12 May 2024 17:34:29 GMT
Via: 1.1 varnish
X-Served-By: cache-lcy-eglc8600090-LCY
X-Cache: HIT
X-Cache-Hits: 1
X-Timer: S1715535270.860916,VS0,VE1
Vary: Authorization,Accept-Encoding,Origin
Access-Control-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
X-Fastly-Request-ID: 477a6a2a19faf287a3c05fb6b081f6794fe4dde8
Expires: Sun, 12 May 2024 17:39:29 GMT
Source-Age: 1789
DNS

133.108.199.185.in-addr.arpa

Remote address:

8.8.8.8:53

Request

133.108.199.185.in-addr.arpa

IN PTR

Response

133.108.199.185.in-addr.arpa

IN PTR

cdn-185-199-108-133githubcom
DNS

github.com

powershell.exe

Remote address:

8.8.8.8:53

Request

github.com

IN A

Response

github.com

IN A

20.26.156.215
DNS

215.156.26.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

215.156.26.20.in-addr.arpa

IN PTR

Response
DNS

157.123.68.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

157.123.68.40.in-addr.arpa

IN PTR

Response
DNS

249.197.17.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

249.197.17.2.in-addr.arpa

IN PTR

Response

249.197.17.2.in-addr.arpa

IN PTR

a2-17-197-249deploystaticakamaitechnologiescom

3.120.98.217:8080

3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe

260 B
5
185.199.108.133:443

https://raw.githubusercontent.com/

tls, http

powershell.exe

927 B
5.0kB
10
9

HTTP Request

GET https://raw.githubusercontent.com/

HTTP Response

301
3.120.98.217:8080

3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe

260 B
5
20.26.156.215:443

github.com

tls

powershell.exe

494 B
3.5kB
7
5
3.120.98.217:8080

3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe

260 B
5
3.120.98.217:8080

3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe

260 B
5
3.120.98.217:8080

3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe

260 B
5
3.120.98.217:8080

3b48fb1a67165967e314b2431c7ffb35_JaffaCakes118.exe

208 B
4

8.8.8.8:53

raw.githubusercontent.com

dns

powershell.exe

71 B
135 B
1
1

DNS Request

raw.githubusercontent.com

DNS Response

185.199.108.133

185.199.110.133

185.199.111.133

185.199.109.133
8.8.8.8:53

8.8.8.8.in-addr.arpa

dns

66 B
90 B
1
1

DNS Request

8.8.8.8.in-addr.arpa
8.8.8.8:53

133.108.199.185.in-addr.arpa

dns

74 B
118 B
1
1

DNS Request

133.108.199.185.in-addr.arpa
8.8.8.8:53

github.com

dns

powershell.exe

56 B
72 B
1
1

DNS Request

github.com

DNS Response

20.26.156.215
8.8.8.8:53

215.156.26.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

215.156.26.20.in-addr.arpa
8.8.8.8:53

157.123.68.40.in-addr.arpa

dns

72 B
146 B
1
1

DNS Request

157.123.68.40.in-addr.arpa
8.8.8.8:53

249.197.17.2.in-addr.arpa

dns

71 B
135 B
1
1

DNS Request

249.197.17.2.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nehfj55s.5b3.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\CHhoVgF.exe

Filesize
18B

MD5
bb03964bb6999f8b59a80d882e7357fc

SHA1
dad034dc7f0131858f69e6358b06741426882979

SHA256
aafca8c5a26ca0a4f2343a68b34cbab73ab7ce8111d1499b75478b370965e892

SHA512
30a183dbbd5795ca8cc218d9efd2598cd95794b3e4640491c47059add19a9447791634cafdcff0b93cee0ce61b3582de4f2649241eb02c5150703db59892bf7d

Download Submit
C:\Windows\System\DwiwfXU.exe

Filesize
2.7MB

MD5
9ecc0139b5e40d66d97852984c91eece

SHA1
7773aa29e708b6b8d83fad942032a4524ba5a6d5

SHA256
5b4bb0ab2d990a00364531163bdc316181da48984977de66d02b62793c720ab5

SHA512
82f51500f973d54a848d7527bc0bd0e0cf18d2e400741cce83cb4f9e6fccd111f60fa45639465db8197fa066b961601b69f57464e34549a6a873059b9359eac4

Download Submit
C:\Windows\System\EDWvtQp.exe

Filesize
2.8MB

MD5
5459e0a4e2c78755d583b5873a47930b

SHA1
4caa446ea369f59651f012087e8ca524d9984be4

SHA256
17225ebff7b8d19fb6afdafc3c84c0d25fd7e35f35be639326718ed9d588940c

SHA512
b0b076b45d7f104865c704cdfdbd187637c2a16a91aac26a9c6d05e5c9a1a5871ba84f98089a516751cab21db961767a5ed2d62cabe33dfd94428bbbcc151256

Download Submit
C:\Windows\System\EhQMdoN.exe

Filesize
2.7MB

MD5
e9c58ac454577535d1d29ff452252f7c

SHA1
1a9115549369adf89f044350d7e4a327ddf463f1

SHA256
01a5ffae36d788901a5c9bf01874e71d1852d871bf6ae2f8eaceecd424fcec3b

SHA512
883d77999e9af9c28672ce5d63081a64f71ef48564ce6b1ccf75d6a5cb6d8331a3f60873711deba19dfa12f08eacc2472e846fc29f445ea6bb8d9fb05fa9861c

Download Submit
C:\Windows\System\EoSpvQA.exe

Filesize
2.7MB

MD5
035aca6cd5d972c1a3fa2ecc479e2d52

SHA1
8dab17b4dbc79cdabc79854705c319a33c8465a6

SHA256
54ab5f416f32b3f25705cbbd0d2cc4213dd5ba73999e032bb8f8dd81524fd7e5

SHA512
b0beb2bfa2e7cd3f4f844cf3305954dafc2c2efd936bfc5089f7e5c95286e9900216c4ff8b2697c9846950b6f1057138cf527709ff14dbc019bf35259d04ada0

Download Submit
C:\Windows\System\GuLcUVn.exe

Filesize
2.7MB

MD5
92c4dc612b142e406f1402300036d05a

SHA1
5b586d0deeb7e8f77278294b25c637127ccb3cd3

SHA256
bd85aefda9d189b5eaf86855be713f66ed3a5118553747bfff496395aef25dc3

SHA512
0791aa3e8cc7be46b2fedc825f6ea4a7c6c32e64829b8375973cf2dee32dbc765d95b2862b79b2192235a5e2cc84e86532311185fdde51a61dbbf3b4a6bf9bf6

Download Submit
C:\Windows\System\HUmaEwl.exe

Filesize
2.7MB

MD5
35fa395719afbbc15b61f4b32df1f70e

SHA1
3586c3533b8f066cc812b87eebc9c1f4188f5b32

SHA256
a6a9d70af16beb50b9ecbbe88c359aff3431e21ec7d17a71ad9fdce2139d350d

SHA512
839ce4ed288976ccc8b5c7ebe5e36053a8d884a7676b918dd0c31a65ac70627236e3b420adb0bc01f68d332553b651c75b266b73c3304955e0ee29e684babf30

Download Submit
C:\Windows\System\KzUIrJf.exe

Filesize
2.7MB

MD5
2c74735255ca0144f70ddc77e68f50a7

SHA1
b0e299d963946a35344a886768472fbb4e762120

SHA256
2ff71b400d71320fcb598b98bf1d37e5837e25dba83fb060277d4e2edc56c28f

SHA512
4675ac61ed9cde9f021efd5b04a6a0e0f561939aa75fa735e65796941ac11a956e608ef89146bd29336857f26eda2e334e2a9382b4504e0ce3f5df9c1310ef5a

Download Submit
C:\Windows\System\MmohQFQ.exe

Filesize
2.7MB

MD5
36a502fa0eae03d3d315d3a749682c72

SHA1
a7d05109351875abd520a5384144ae264c20049f

SHA256
46347fed259a6707e8b154f527551fca56c328417d24055016da20f58621c35c

SHA512
8d46e58e11c57c98f28afe9f91e009891103e13c5a900da5e98723005355a308a321757806a1282b4a6636e2c08b460fae3f143788b3c94c27a81aeb8e734cc1

Download Submit
C:\Windows\System\NnAgdMT.exe

Filesize
2.7MB

MD5
ba94a16388afd927bf7185f790d64ac7

SHA1
d33e2436af20738727a7d5e2dc6e9ac87330609f

SHA256
134ef24dd74787f9e4815131424a28d366beeb89f8a89a40e2afe4dafc121ee4

SHA512
ea45fca4d143f17cd1110c8d8df033da490fcb6e79d4f0cac5b46563e5d8d695b304af8fc8d036f8817ff33ac7e475491bf629cc3c378ce9635f690667433209

Download Submit
C:\Windows\System\ObIWUOc.exe

Filesize
2.7MB

MD5
1a4cdc4d7bda79e32dca02a0c3c7e4dd

SHA1
7c708ea8e43184d245b677756062324bbfcdbd09

SHA256
ca44d35f41082645619268b7639c82d7431476f24e04ff1e091e98dce3bf2da6

SHA512
484ae78ee344f0b5735907c2ae8c1a4ee93450d6857fa11d41bff984cd487c21d71793f57f6e2d91c3760b6d84a75360fc9c9a82ee53ec245a3d32ffeacb4926

Download Submit
C:\Windows\System\PgQjQEo.exe

Filesize
2.7MB

MD5
dbb4053ab4a7877fd49d237c4071a35a

SHA1
89289c350c6ced0ade9a06b1c85c8f6de3d30845

SHA256
7762998a5428be1efd7bddc7eb739396e4e56f2f0b132ac74e3065d9a2356183

SHA512
ea4a32a83bcb6a90df52c2365e6b6090fa9d96189a22511fb5932beddb51cca345928120990ee3b350ea21f88da8bc2d0aec304a648cf6717a3981a7084c8d69

Download Submit
C:\Windows\System\QLXhcTB.exe

Filesize
2.7MB

MD5
8eb2985278f4f863c745b0fabe9c4fe3

SHA1
4949c1a51bb80f38d11c10d556ab1f09431b0bea

SHA256
f19fd2c79a52349c4ee382c0ff2b475003a7ae4c3c53cd5b5a0df8ea3336f3f3

SHA512
5962dd1bc4dec4a61e2524d45ab62009f41131aeb895112ccacc89b54e29392f63c2c589ab4cd4eb9045b34220b6d3e1491f63d9c977ac713c08514e4f156185

Download Submit
C:\Windows\System\SyXzieR.exe

Filesize
2.7MB

MD5
9f5f6cf11aec88b76b95cb0f085d7f08

SHA1
b4565a23bd45c08d1af22ec3e17d8eacd2d3d19c

SHA256
bbd5f53238ba03d3decf9e3f70100bf12593f8ea6a6c5254b9b162d5659a5862

SHA512
beaa8115f7bb639e2b298178aef6c45f0b8cc3e36e83d230a655ab65bd8e7102462c29c48ff70c9c59b358ccf954d09e24b5d7ac0242efa21037b1743447fbd6

Download Submit
C:\Windows\System\TpIvClq.exe

Filesize
2.7MB

MD5
757f764d22c910956541b9db262db17f

SHA1
a7badd282e2d43c95c837322cf5138c6ed88e2f3

SHA256
d4f369ffaa08510d16b91e91b0faed4905eb00cb077876c8ce63f0e7e24c3f85

SHA512
bfc8b11f96988e220052c1876f0a07367c108ee95e23e79ba480da8648daf2d09dce9030d2d816cedf5ddfb2fa13f7fe01d2e3b7ce22b9d8bd199f1cfb9576b3

Download Submit
C:\Windows\System\UjPSmNJ.exe

Filesize
2.8MB

MD5
11f07357a1c54a6167d1d0f00a3c088b

SHA1
5a097e0f4922a9f2192ecc33b2d622492c6a8df6

SHA256
caa7135c3918b5d1c0310f98a9e396b2678dd95627a8a40fd08e3011b23676a0

SHA512
218c81236e3a2e8a44b93deb8b4b59f3472de0e551a8425a62e4d2f663db3f79d1438d0dc3afcce0c83b56196035bffda67a4c60ce36be9181c313962b268f47

Download Submit
C:\Windows\System\XJsXqhO.exe

Filesize
2.7MB

MD5
51637aea394336e35d3ec7f7c6088bf4

SHA1
22f18e67482405ecd1e22db64c78cd39bc03ead4

SHA256
59864aa3e90a0e679c8b268d75f82448918c9c87bdab53fe9b42e23c97ce642c

SHA512
0965b78655cc647280af3206f495400f5d47d08c9b3d9d48cf3860fe7e1182622bbbf281550c5440e00f66d9bb8cf0efeaa5787d3c22f87fe85b2b8805a5672c

Download Submit
C:\Windows\System\XZnlFIJ.exe

Filesize
2.8MB

MD5
1d0dafa6d934801b21a591c13547b2e0

SHA1
fd4200880f7c11b340aebcabae123c0efde29bd7

SHA256
901acaf45ce99045881723486591fbbfcf4db76a7b34c35f4f262b053101df4e

SHA512
12c7dda836925e7dd64847b6993bf014d20f694a27ced211426da4df920e2559e79d34c798c1c659a3ea8cfef26e7323cc6881c1b553f2119ba9f166491a9f62

Download Submit
C:\Windows\System\YouBYqF.exe

Filesize
2.7MB

MD5
2e70f2f53c3850579077561b64b6fd67

SHA1
eba4881f296f81b358d437d62f3de4a0c9dba3d4

SHA256
0d9e34ed41776fd3ec209c826a511cd897ebc548006b0b34eb46060d841c08d4

SHA512
3c8b3b60d4bdeef27d139b9ff1324f0bee168607dc89ddcd1b3c34084d658441e0a483dd5a8a543fc5078bf00663f7d93a478ed665ec6fb33f45c3e1dd7b9add

Download Submit
C:\Windows\System\ZIlFrwY.exe

Filesize
2.8MB

MD5
7415f4c2c0ababe7c64a8e249fe5a114

SHA1
5fc2611330ed60e9eee0c64bc1f759e3d835fe42

SHA256
beb4948051ef91cf3498adae8766be4e381bb6ce91345c260a0571d3315b3c46

SHA512
763a0c3b78c7eea290b3e41a84a1456244a91309aee4c75f47bb556b5e50ffa9a02491f0f0ad0d11e3e81968ec9a026f4db1b88d2f0f503dd8fe9c812014c2f5

Download Submit
C:\Windows\System\ZwLUXCc.exe

Filesize
2.8MB

MD5
8827dc62a661f32ce4738512849e111d

SHA1
bcbdf41c662093bd0cfd7677cbd6f5b732301ea9

SHA256
77ace58597633442d6746afebcf66fd29f9351e9d94fceb65c512c98f861b628

SHA512
204e49eb2266ff7500635a19b72df3718d4a93fad49629fd3028fbcdc69d52c341267320a3f2f63f157b0dae87a390caf0eefbfd226f4a53f07958272d256b0f

Download Submit
C:\Windows\System\aTheYWm.exe

Filesize
2.7MB

MD5
c53d892f6523359691962a8fd9b12d14

SHA1
a30c4ede185d410daa7fce45bc98932b58ea8182

SHA256
fb58de0bb083e7fc1d01ae688bc7e4fe56efef1c1c429242a3e46dd2775cef50

SHA512
ee0272ab7a707dde9c7adb79009e1289b741ad19f236daf327850c1c26d353253de92c0f5536ed2fe4831fa3e65ec2af744bc154a2c7121cde5c5eda45d40d90

Download Submit
C:\Windows\System\cbkALMv.exe

Filesize
2.7MB

MD5
57e617fffd085396f2d3b4e10de0543a

SHA1
4fbd5fcf0cdfd47452d281e70573e8ad2792d203

SHA256
61e5da0bfb51545610a216bbabd48bea7bb9064df0def314c117bece3d678460

SHA512
d3564d90d18c66363525f8a97d07288a0519c6f4961fdbe761ca4649334a94ac0569658f2187809bbb64bffdb3955d830f0882ce87adb14712e7752b165f81c8

Download Submit
C:\Windows\System\ctQYgGE.exe

Filesize
2.7MB

MD5
f9b4f4d251a1ab5d4bad407e421edcc4

SHA1
c5898c8847470e795729fa69a61eb22e76f89ea1

SHA256
70f7612dad24ef333d5b03e23f72a884b3000f9cb24f683d1e1d5d398d149f98

SHA512
4602ca139684df5489f450a676f75f9274bf851a1ca9c0de61d2843f1d943a5e8f1b34e0d9e9d0337dd409feeb32e4f2a2692ac4faddffa9836113ed85c400fd

Download Submit
C:\Windows\System\dGRsdre.exe

Filesize
2.7MB

MD5
d1415bd742d9c57337006529684ebb87

SHA1
9c6b8623fd153644dc6129f034996f0e14052d21

SHA256
0398d2b4f8fc16b9b0b086151cd8e2a713c8e01bc86c1f2c23c2329a287d2eb7

SHA512
1a4e6424749eba700803b0f10a2c38c0b619e24c60bdba7af8addc3a9358e704fb342fb54a8867cf78cf94add14a0972c54aec97c2e9d45ecce2cac1474712a5

Download Submit
C:\Windows\System\eygkDNp.exe

Filesize
2.7MB

MD5
bbfc9ef394b2e565ced6efeed7dd75b9

SHA1
24f395233984717e59b56939e8538b7a6970f82a

SHA256
f1bf202c4d187009b0772b1deb445a4cc7f12b9e2cfae286733bba77ca25a569

SHA512
ec05ef1d1ea824f8e7b540767a6ac257a23b94b15a566af19bc69cd83cede29134f26264b0649f60f168b9d0a4ba901ada8ced86d712f460e8f9a4caecdbbe40

Download Submit
C:\Windows\System\fOWvpOr.exe

Filesize
8B

MD5
2f610ed4fd34c7b93dede1793521baba

SHA1
5daae5f3b2625b6a326bfb1be39046cb371fc4a6

SHA256
d587df361f44238ccf5a60428309780a9b6bde224606e4679c94364299985684

SHA512
367244af67370594aa8df8799be42b55afcd8abd950bf66980b9cb155b499d06ebcadc359f153586f1736d1a5dd7bea12b69a39d93e67441419399282c1888bb

Download Submit
C:\Windows\System\ixwficI.exe

Filesize
2.8MB

MD5
ae8a6f15e60e090a9764256ebf172829

SHA1
8397cd0065e6e23f685a57bdd825db9888118aa0

SHA256
f7845df3278c7454930a5390d6b954e0844cd68da3fa608b306220dc5a246ab8

SHA512
ab18bc74e82c551222daa3e12762e264df0e1134cbaedcb63d8d61e30b4624220c2d4d6c2a96e6d6800b84f24cb63dd630293179e9f049601599d22407b9e44e

Download Submit
C:\Windows\System\nnvdnTU.exe

Filesize
2.7MB

MD5
b40b4d4c052e58f377ce666745f88dcc

SHA1
9cb483f2da03c50c4a15c5db0ed2fca5394ceb0d

SHA256
ec75f46b8a0e8fce0c43090aecdcc2c2175ec34eacef3b2e4cf3dec69469b846

SHA512
870962488c7921489924076defcd6989bc785aeb4f4b860552c7c99088dc03ede2b2bf7a60d55126ffeaa2d26b4b41a3ca379f1a9db206c1ff14dc5d4052e8e4

Download Submit
C:\Windows\System\oBIJDzf.exe

Filesize
2.7MB

MD5
4decf2651f248f4a2298b5717e59b590

SHA1
a2072599da35565dd18b6aa75b690f07ecb1d8c4

SHA256
84ccf1d00a57bae170d420fa32c3b78d2a487fe096c72373620b3418cd400036

SHA512
c2b5e54954f802482d55e6be9fe53c288dca8306baa7d388ce59f483937c7be38fc737692078beb01ce6f5a7dd0fc8352f39c88987da1dbdf1b80572958cbd1b

Download Submit
C:\Windows\System\oCZoSiR.exe

Filesize
2.7MB

MD5
fa215c34d30b09e198e9ecc7cd109017

SHA1
3ff8f6c3b480e53d54668121f6552b0d8c1247ce

SHA256
70d8842d1206117455fa971bb0984fc89ac7db84cd5062036a07aaaaec36282a

SHA512
4adc1649fd7dd861bb46fb701b3eeba78939b032b753b5d5d6efefb27a6513a14f2f299c4f84159337e861618bf6ad0f6ebb5be5f99f0f8517b9c5c2ba587c3c

Download Submit
C:\Windows\System\oNmhXGv.exe

Filesize
2.7MB

MD5
bf0d427bf9cbdc62d296ba135206d901

SHA1
8428aaa53fda2c89b4e40a9a7b3add4c73c87221

SHA256
ac0b9d6d56e8b19f9081f6a23d540ecfa150ceed90def71b7b6890df81be2120

SHA512
10496b4874e690d45277db666cbae0b9e3aa98099fd0718dabfbd00c73a0b1be2aab17bd85f9d9bce6ff7e58ad4439e1660ba17ed48e6c6c095a9afb769ce1b8

Download Submit
C:\Windows\System\pDBKDgp.exe

Filesize
2.7MB

MD5
4d5e59e7430d0445ddd8d6713787a9ca

SHA1
7713aeb0c8d90c187beb9c803281339608100f2f

SHA256
1733f7698eeaa4b891ad877d23f885d095c31fc610e11fe1f159bc600b2a9ae5

SHA512
0361243c0c1aa9b3076da3cd4519f680005754ff5ac3dc015dd06887cc3b8eb17b244b80455129c4d708b237fe63844f7d4ffd1a7a0f0c9ca81ba57cea7231e6

Download Submit
C:\Windows\System\paFRhuc.exe

Filesize
2.7MB

MD5
120609a5d12d225cb5f4c7811b0a5e5d

SHA1
0ef38b9aa908b3fdf5950317fbcca4aabc0479cb

SHA256
9a242eca8f018a056cf7eea446e119d075f1f2a9a5c470f79265f77ee72841e4

SHA512
62787bab531aa8f8f9671907483caa635010a4df811757a9dad7c3c83b48ac0236fa6e690746101923043d322ecc02fe6cea996cc1bb9fc28b6e18dc2214ddfb

Download Submit
C:\Windows\System\rgXqXnA.exe

Filesize
2.7MB

MD5
8a5fe125f274b1367317d97b640adfab

SHA1
b96a490fe6b5536919354bb0b6660da54eb9b103

SHA256
bbd712e2c0f84d607b9dfaf69d3e5f8a4d85992baeca6a3180dcc5b45dbeff09

SHA512
5f33c663222f7c399d8e8b252a72eadebe5a674d2b672cd3735cfe94d8cd35d5e1702bffc8055551853e4d74b6b7f6bdd775e9f99ee97a517c991f3c4e1d0f5f

Download Submit
C:\Windows\System\rmzShrx.exe

Filesize
2.7MB

MD5
8129d4055a895214d99a6daebf91644f

SHA1
09f6fa79c3bc2aedb30a9c1c8c0fa60ca481fef1

SHA256
3abc01c6e33c903380072566ea87e68a75e32091530d787e8fbaa95de01929f6

SHA512
4c2ded8448588db3e96acd6d8c82bcad52b8a873e5fca2fef7b795148118c36b2c857e2f13c0d05dae28e55deeb701a4e23e4755d46148d1a5fdeead3849939c

Download Submit
C:\Windows\System\tzIwZGV.exe

Filesize
2.7MB

MD5
08959a2b0bce93838d5e69401f1b79f6

SHA1
07a2fd20d9c9bd8ed70460b978126322fd05a274

SHA256
ca2801c68a0bcb8efaa1771102934dbfebbbc94aa16dd498ceeb583bed05836a

SHA512
ee0a5a0f0a925dc2c432fa88c7234222ec4f50f8b05d680d1dfe9516018a773710a917f3f1456a2e92bd6ee73cd13eb88efef4b897930f593478f35e93c2281e

Download Submit
C:\Windows\System\wmajwyu.exe

Filesize
2.7MB

MD5
7b1c055278c3d27234e4285154f5560d

SHA1
15f0c0d15fde187677995da8ce31e5e527faf89b

SHA256
189bbc39f9e46d238adb01cd099ad48c9ae38a77b6064fa6f58e138c8f334bd5

SHA512
eedbd6249ae142e3494f855d2407f318aee530afd7e2f5e6b8f55116b46e901be519e4dafe4c38ad4eddc97d64e9bc888819e1e02568489f06360c583ccb9eff

Download Submit
C:\Windows\System\yWTOQwm.exe

Filesize
2.7MB

MD5
089ff4741b36dce2fd2be88f10c79673

SHA1
755a47670a537f111f242fcb725f1c43ba95fbe9

SHA256
8107d84861d14d69e35a8c3e751e62bfbb99f286ecec4cfd7e0d6f3ab2bbf556

SHA512
c19bf2afaee2ca3e1e9787e42f28660dce4db98d7b9535bbe818228f2e062c886920df8b0cccefcb66fddceb8e00788c3cf7ffeb94578410220d3ae893046e9b

Download Submit
C:\Windows\System\yfckBqg.exe

Filesize
2.7MB

MD5
923750da0110361eb1f7dc1eee15e32a

SHA1
385c450c03f680fd117ebb96ed4e27e5e51dec88

SHA256
ee736fbab4c381f664e477518638a76007c12b596d44e202665cc9d7d808963d

SHA512
aef662547457d285502bd80a0c21588ed0250e9248d8da4b9e422b3275c62da041e49b2a6e177ef60b77f19171a0a97f5caf9fc0895ba4664fac0051e5cbf6e9

Download Submit
C:\Windows\System\zcdQIeo.exe

Filesize
2.7MB

MD5
18eca68cb7de03baa169ac611e8787de

SHA1
94acf03f9d2b2a231899b1db57f3b1f50c45e120

SHA256
96eb67a75950b50b104ce7d555d4ce8e7719ceab59363c72d4a98329fb4d3e7f

SHA512
67541ec12fcfd03623e5c270822cf2aa3df2020bff5aebea937c3e0bfad14c749c687d1f0ed755c1c0fe2b9a4590ee8a1dab644ad7f17b25d56890683be78ce6

Download Submit
memory/668-2898-0x00007FF698CB0000-0x00007FF6990A2000-memory.dmp

Filesize
3.9MB

Download
memory/668-83-0x00007FF698CB0000-0x00007FF6990A2000-memory.dmp

Filesize
3.9MB

Download
memory/940-31-0x00007FF7D0E20000-0x00007FF7D1212000-memory.dmp

Filesize
3.9MB

Download
memory/1140-103-0x00007FF659AE0000-0x00007FF659ED2000-memory.dmp

Filesize
3.9MB

Download
memory/1140-2922-0x00007FF659AE0000-0x00007FF659ED2000-memory.dmp

Filesize
3.9MB

Download
memory/1352-115-0x00007FF7FB480000-0x00007FF7FB872000-memory.dmp

Filesize
3.9MB

Download
memory/1352-2937-0x00007FF7FB480000-0x00007FF7FB872000-memory.dmp

Filesize
3.9MB

Download
memory/1544-226-0x00007FF74ECA0000-0x00007FF74F092000-memory.dmp

Filesize
3.9MB

Download
memory/1544-3021-0x00007FF74ECA0000-0x00007FF74F092000-memory.dmp

Filesize
3.9MB

Download
memory/1636-120-0x00007FF634F40000-0x00007FF635332000-memory.dmp

Filesize
3.9MB

Download
memory/1636-2941-0x00007FF634F40000-0x00007FF635332000-memory.dmp

Filesize
3.9MB

Download
memory/2004-133-0x0000029771230000-0x0000029771252000-memory.dmp

Filesize
136KB

Download
memory/2004-124-0x00007FF8E44D0000-0x00007FF8E4F91000-memory.dmp

Filesize
10.8MB

Download
memory/2004-74-0x00007FF8E44D0000-0x00007FF8E4F91000-memory.dmp

Filesize
10.8MB

Download
memory/2004-13-0x00007FF8E44D3000-0x00007FF8E44D5000-memory.dmp

Filesize
8KB

Download
memory/2012-2956-0x00007FF7C0F90000-0x00007FF7C1382000-memory.dmp

Filesize
3.9MB

Download
memory/2012-127-0x00007FF7C0F90000-0x00007FF7C1382000-memory.dmp

Filesize
3.9MB

Download
memory/2020-2951-0x00007FF6AAE50000-0x00007FF6AB242000-memory.dmp

Filesize
3.9MB

Download
memory/2020-130-0x00007FF6AAE50000-0x00007FF6AB242000-memory.dmp

Filesize
3.9MB

Download
memory/2408-2927-0x00007FF6AC270000-0x00007FF6AC662000-memory.dmp

Filesize
3.9MB

Download
memory/2408-126-0x00007FF6AC270000-0x00007FF6AC662000-memory.dmp

Filesize
3.9MB

Download
memory/2676-12-0x00007FF7F1EF0000-0x00007FF7F22E2000-memory.dmp

Filesize
3.9MB

Download
memory/2724-217-0x00007FF7DEB10000-0x00007FF7DEF02000-memory.dmp

Filesize
3.9MB

Download
memory/2724-2998-0x00007FF7DEB10000-0x00007FF7DEF02000-memory.dmp

Filesize
3.9MB

Download
memory/2760-2960-0x00007FF7CCFE0000-0x00007FF7CD3D2000-memory.dmp

Filesize
3.9MB

Download
memory/2760-116-0x00007FF7CCFE0000-0x00007FF7CD3D2000-memory.dmp

Filesize
3.9MB

Download
memory/2824-0-0x00007FF7DD900000-0x00007FF7DDCF2000-memory.dmp

Filesize
3.9MB

Download
memory/2824-1-0x00000287C9A50000-0x00000287C9A60000-memory.dmp

Filesize
64KB

Download
memory/2968-3032-0x00007FF7DD2C0000-0x00007FF7DD6B2000-memory.dmp

Filesize
3.9MB

Download
memory/2968-238-0x00007FF7DD2C0000-0x00007FF7DD6B2000-memory.dmp

Filesize
3.9MB

Download
memory/3436-2893-0x00007FF7C6D20000-0x00007FF7C7112000-memory.dmp

Filesize
3.9MB

Download
memory/3436-125-0x00007FF7C6D20000-0x00007FF7C7112000-memory.dmp

Filesize
3.9MB

Download
memory/3804-92-0x00007FF779130000-0x00007FF779522000-memory.dmp

Filesize
3.9MB

Download
memory/3804-2909-0x00007FF779130000-0x00007FF779522000-memory.dmp

Filesize
3.9MB

Download
memory/4104-122-0x00007FF7D2E80000-0x00007FF7D3272000-memory.dmp

Filesize
3.9MB

Download
memory/4104-3025-0x00007FF7D2E80000-0x00007FF7D3272000-memory.dmp

Filesize
3.9MB

Download
memory/4252-2891-0x00007FF60DE60000-0x00007FF60E252000-memory.dmp

Filesize
3.9MB

Download
memory/4252-34-0x00007FF60DE60000-0x00007FF60E252000-memory.dmp

Filesize
3.9MB

Download
memory/4364-119-0x00007FF649C40000-0x00007FF64A032000-memory.dmp

Filesize
3.9MB

Download
memory/4364-2957-0x00007FF649C40000-0x00007FF64A032000-memory.dmp

Filesize
3.9MB

Download
memory/4504-129-0x00007FF6634D0000-0x00007FF6638C2000-memory.dmp

Filesize
3.9MB

Download
memory/4504-2947-0x00007FF6634D0000-0x00007FF6638C2000-memory.dmp

Filesize
3.9MB

Download
memory/4608-2969-0x00007FF63F6D0000-0x00007FF63FAC2000-memory.dmp

Filesize
3.9MB

Download
memory/4608-121-0x00007FF63F6D0000-0x00007FF63FAC2000-memory.dmp

Filesize
3.9MB

Download
memory/4672-2933-0x00007FF724850000-0x00007FF724C42000-memory.dmp

Filesize
3.9MB

Download
memory/4672-108-0x00007FF724850000-0x00007FF724C42000-memory.dmp

Filesize
3.9MB

Download
memory/4804-39-0x00007FF69A100000-0x00007FF69A4F2000-memory.dmp

Filesize
3.9MB

Download
memory/4804-2906-0x00007FF69A100000-0x00007FF69A4F2000-memory.dmp

Filesize
3.9MB

Download
memory/4896-2970-0x00007FF6C0340000-0x00007FF6C0732000-memory.dmp

Filesize
3.9MB

Download
memory/4896-128-0x00007FF6C0340000-0x00007FF6C0732000-memory.dmp

Filesize
3.9MB

Download
memory/4904-2946-0x00007FF755F80000-0x00007FF756372000-memory.dmp

Filesize
3.9MB

Download
memory/4904-123-0x00007FF755F80000-0x00007FF756372000-memory.dmp

Filesize
3.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.