xmrig | dfd4971014dbd0c18c2fa8982469a020d49d78658abdf37e354ff0d08238a4fe

Analysis

max time kernel
69s
max time network
38s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27-04-2024 22:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
Size

2.2MB
MD5

03bf00e7d9c75885bb67ab8317869682
SHA1

ea60c8affb37fa6cb069aacdb9ff7e360ff58b6f
SHA256

dfd4971014dbd0c18c2fa8982469a020d49d78658abdf37e354ff0d08238a4fe
SHA512

6ed009386a370af00159186f4af2df7252d4e4c2f064437dd62c0a8da6e5371b4a00bab9eb977e5079de6c1d34a54beae9d1703389b44a74f2a279882613bfaa
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfT:NABw

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 43 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/3328-42-0x00007FF75C620000-0x00007FF75CA12000-memory.dmp	xmrig
behavioral2/memory/3560-65-0x00007FF6747C0000-0x00007FF674BB2000-memory.dmp	xmrig
behavioral2/memory/5020-73-0x00007FF7EA260000-0x00007FF7EA652000-memory.dmp	xmrig
behavioral2/memory/1628-75-0x00007FF705140000-0x00007FF705532000-memory.dmp	xmrig
behavioral2/memory/4416-78-0x00007FF77C190000-0x00007FF77C582000-memory.dmp	xmrig
behavioral2/memory/4040-80-0x00007FF636170000-0x00007FF636562000-memory.dmp	xmrig
behavioral2/memory/3032-81-0x00007FF6A2E00000-0x00007FF6A31F2000-memory.dmp	xmrig
behavioral2/memory/4508-79-0x00007FF71E460000-0x00007FF71E852000-memory.dmp	xmrig
behavioral2/memory/1364-74-0x00007FF639730000-0x00007FF639B22000-memory.dmp	xmrig
behavioral2/memory/1404-69-0x00007FF772090000-0x00007FF772482000-memory.dmp	xmrig
behavioral2/memory/4316-34-0x00007FF73CF60000-0x00007FF73D352000-memory.dmp	xmrig
behavioral2/memory/2132-97-0x00007FF670B90000-0x00007FF670F82000-memory.dmp	xmrig
behavioral2/memory/668-135-0x00007FF714170000-0x00007FF714562000-memory.dmp	xmrig
behavioral2/memory/2296-140-0x00007FF69DFA0000-0x00007FF69E392000-memory.dmp	xmrig
behavioral2/memory/556-150-0x00007FF7E5F20000-0x00007FF7E6312000-memory.dmp	xmrig
behavioral2/memory/4188-146-0x00007FF628B30000-0x00007FF628F22000-memory.dmp	xmrig
behavioral2/memory/3236-132-0x00007FF604D80000-0x00007FF605172000-memory.dmp	xmrig
behavioral2/memory/3432-1389-0x00007FF60A3D0000-0x00007FF60A7C2000-memory.dmp	xmrig
behavioral2/memory/3404-2064-0x00007FF67EC70000-0x00007FF67F062000-memory.dmp	xmrig
behavioral2/memory/1560-2086-0x00007FF767C30000-0x00007FF768022000-memory.dmp	xmrig
behavioral2/memory/4360-2087-0x00007FF6FACD0000-0x00007FF6FB0C2000-memory.dmp	xmrig
behavioral2/memory/3696-2099-0x00007FF753D60000-0x00007FF754152000-memory.dmp	xmrig
behavioral2/memory/4316-2101-0x00007FF73CF60000-0x00007FF73D352000-memory.dmp	xmrig
behavioral2/memory/4416-2103-0x00007FF77C190000-0x00007FF77C582000-memory.dmp	xmrig
behavioral2/memory/3328-2105-0x00007FF75C620000-0x00007FF75CA12000-memory.dmp	xmrig
behavioral2/memory/4508-2107-0x00007FF71E460000-0x00007FF71E852000-memory.dmp	xmrig
behavioral2/memory/3560-2109-0x00007FF6747C0000-0x00007FF674BB2000-memory.dmp	xmrig
behavioral2/memory/1628-2117-0x00007FF705140000-0x00007FF705532000-memory.dmp	xmrig
behavioral2/memory/3032-2116-0x00007FF6A2E00000-0x00007FF6A31F2000-memory.dmp	xmrig
behavioral2/memory/1364-2121-0x00007FF639730000-0x00007FF639B22000-memory.dmp	xmrig
behavioral2/memory/4040-2120-0x00007FF636170000-0x00007FF636562000-memory.dmp	xmrig
behavioral2/memory/1404-2114-0x00007FF772090000-0x00007FF772482000-memory.dmp	xmrig
behavioral2/memory/5020-2112-0x00007FF7EA260000-0x00007FF7EA652000-memory.dmp	xmrig
behavioral2/memory/3404-2158-0x00007FF67EC70000-0x00007FF67F062000-memory.dmp	xmrig
behavioral2/memory/2132-2159-0x00007FF670B90000-0x00007FF670F82000-memory.dmp	xmrig
behavioral2/memory/3236-2162-0x00007FF604D80000-0x00007FF605172000-memory.dmp	xmrig
behavioral2/memory/1560-2167-0x00007FF767C30000-0x00007FF768022000-memory.dmp	xmrig
behavioral2/memory/4360-2166-0x00007FF6FACD0000-0x00007FF6FB0C2000-memory.dmp	xmrig
behavioral2/memory/3696-2169-0x00007FF753D60000-0x00007FF754152000-memory.dmp	xmrig
behavioral2/memory/2296-2164-0x00007FF69DFA0000-0x00007FF69E392000-memory.dmp	xmrig
behavioral2/memory/4188-2171-0x00007FF628B30000-0x00007FF628F22000-memory.dmp	xmrig
behavioral2/memory/668-2173-0x00007FF714170000-0x00007FF714562000-memory.dmp	xmrig
behavioral2/memory/556-2194-0x00007FF7E5F20000-0x00007FF7E6312000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

Processes:

MwSLfkG.exeHUSmstH.exePGRFfky.exeoJiicFf.exeBJsdFHh.exeOYXkeQk.exeJPHEoLX.exeXpIPltu.execKAJsSJ.exeryTSXpS.exeTduDdNZ.exejAaYgbD.exeIkSnaJw.exeTuDzhYF.exemcsVVGx.exejCNMijz.exeNvevjzl.exemimzELt.exeerkkoga.exeTAhRURY.exeKishkmQ.exezsmfThy.exegacddwX.exemEDStFn.exenEgkHtH.exeaIHspxh.exexaxVdyr.exeibzCOPj.exeZDPPEvl.exexZarDoa.exeROZoAJW.exervDJUWz.exeKpPfQzV.exezRsQiYY.exeOnkWOLc.exeDBkFnNl.exeOFKoGGF.exemTRKgso.exebmjiviu.exezLabmna.exePvjvzLg.exeqpOqtra.exeiTZuAKo.exehlcVPfk.exeUouUmpb.exeAmHZqMR.exehzhueGG.exeWzTzrOF.exeCeyruWE.exeobUGkII.exeGlJfKTy.exeibSqOOb.exeFnGDnMQ.exeLtimQxB.exepzHecND.execGBiwdz.exeNvlqAiJ.exeKcAdvTA.exeSwWwwqQ.exexPivKYf.exebcaiWVo.exemaVozbW.exeWpEmHFA.exepAJtrOI.exe

pid	process
4416	MwSLfkG.exe
4316	HUSmstH.exe
3328	PGRFfky.exe
4508	oJiicFf.exe
3560	BJsdFHh.exe
4040	OYXkeQk.exe
1404	JPHEoLX.exe
5020	XpIPltu.exe
1364	cKAJsSJ.exe
1628	ryTSXpS.exe
3032	TduDdNZ.exe
3404	jAaYgbD.exe
2132	IkSnaJw.exe
1560	TuDzhYF.exe
4360	mcsVVGx.exe
2296	jCNMijz.exe
3696	Nvevjzl.exe
3236	mimzELt.exe
4188	erkkoga.exe
668	TAhRURY.exe
556	KishkmQ.exe
3596	zsmfThy.exe
4448	gacddwX.exe
2436	mEDStFn.exe
4244	nEgkHtH.exe
2108	aIHspxh.exe
4168	xaxVdyr.exe
4872	ibzCOPj.exe
4576	ZDPPEvl.exe
744	xZarDoa.exe
4920	ROZoAJW.exe
2636	rvDJUWz.exe
4584	KpPfQzV.exe
2016	zRsQiYY.exe
3676	OnkWOLc.exe
1324	DBkFnNl.exe
4116	OFKoGGF.exe
716	mTRKgso.exe
4104	bmjiviu.exe
2008	zLabmna.exe
2344	PvjvzLg.exe
904	qpOqtra.exe
4268	iTZuAKo.exe
3624	hlcVPfk.exe
1736	UouUmpb.exe
5092	AmHZqMR.exe
4540	hzhueGG.exe
2096	WzTzrOF.exe
1456	CeyruWE.exe
1832	obUGkII.exe
4196	GlJfKTy.exe
2860	ibSqOOb.exe
2068	FnGDnMQ.exe
4452	LtimQxB.exe
4900	pzHecND.exe
528	cGBiwdz.exe
4132	NvlqAiJ.exe
3396	KcAdvTA.exe
1928	SwWwwqQ.exe
4424	xPivKYf.exe
3324	bcaiWVo.exe
2856	maVozbW.exe
2808	WpEmHFA.exe
2228	pAJtrOI.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3432-0-0x00007FF60A3D0000-0x00007FF60A7C2000-memory.dmp	upx
C:\Windows\System\MwSLfkG.exe	upx
C:\Windows\System\HUSmstH.exe	upx
C:\Windows\System\PGRFfky.exe	upx
C:\Windows\System\oJiicFf.exe	upx
C:\Windows\System\BJsdFHh.exe	upx
behavioral2/memory/3328-42-0x00007FF75C620000-0x00007FF75CA12000-memory.dmp	upx
C:\Windows\System\OYXkeQk.exe	upx
C:\Windows\System\cKAJsSJ.exe	upx
behavioral2/memory/3560-65-0x00007FF6747C0000-0x00007FF674BB2000-memory.dmp	upx
behavioral2/memory/5020-73-0x00007FF7EA260000-0x00007FF7EA652000-memory.dmp	upx
behavioral2/memory/1628-75-0x00007FF705140000-0x00007FF705532000-memory.dmp	upx
behavioral2/memory/4416-78-0x00007FF77C190000-0x00007FF77C582000-memory.dmp	upx
behavioral2/memory/4040-80-0x00007FF636170000-0x00007FF636562000-memory.dmp	upx
behavioral2/memory/3032-81-0x00007FF6A2E00000-0x00007FF6A31F2000-memory.dmp	upx
behavioral2/memory/4508-79-0x00007FF71E460000-0x00007FF71E852000-memory.dmp	upx
C:\Windows\System\TduDdNZ.exe	upx
behavioral2/memory/1364-74-0x00007FF639730000-0x00007FF639B22000-memory.dmp	upx
C:\Windows\System\ryTSXpS.exe	upx
behavioral2/memory/1404-69-0x00007FF772090000-0x00007FF772482000-memory.dmp	upx
C:\Windows\System\XpIPltu.exe	upx
C:\Windows\System\JPHEoLX.exe	upx
behavioral2/memory/4316-34-0x00007FF73CF60000-0x00007FF73D352000-memory.dmp	upx
C:\Windows\System\jAaYgbD.exe	upx
behavioral2/memory/3404-90-0x00007FF67EC70000-0x00007FF67F062000-memory.dmp	upx
C:\Windows\System\IkSnaJw.exe	upx
behavioral2/memory/2132-97-0x00007FF670B90000-0x00007FF670F82000-memory.dmp	upx
C:\Windows\System\mcsVVGx.exe	upx
C:\Windows\System\TAhRURY.exe	upx
C:\Windows\System\erkkoga.exe	upx
C:\Windows\System\Nvevjzl.exe	upx
behavioral2/memory/3696-120-0x00007FF753D60000-0x00007FF754152000-memory.dmp	upx
C:\Windows\System\jCNMijz.exe	upx
C:\Windows\System\mimzELt.exe	upx
behavioral2/memory/4360-111-0x00007FF6FACD0000-0x00007FF6FB0C2000-memory.dmp	upx
C:\Windows\System\TuDzhYF.exe	upx
behavioral2/memory/1560-100-0x00007FF767C30000-0x00007FF768022000-memory.dmp	upx
behavioral2/memory/668-135-0x00007FF714170000-0x00007FF714562000-memory.dmp	upx
C:\Windows\System\KishkmQ.exe	upx
behavioral2/memory/2296-140-0x00007FF69DFA0000-0x00007FF69E392000-memory.dmp	upx
behavioral2/memory/556-150-0x00007FF7E5F20000-0x00007FF7E6312000-memory.dmp	upx
C:\Windows\System\zsmfThy.exe	upx
C:\Windows\System\nEgkHtH.exe	upx
C:\Windows\System\mEDStFn.exe	upx
C:\Windows\System\gacddwX.exe	upx
behavioral2/memory/4188-146-0x00007FF628B30000-0x00007FF628F22000-memory.dmp	upx
behavioral2/memory/3236-132-0x00007FF604D80000-0x00007FF605172000-memory.dmp	upx
C:\Windows\System\aIHspxh.exe	upx
C:\Windows\System\xaxVdyr.exe	upx
C:\Windows\System\xZarDoa.exe	upx
C:\Windows\System\KpPfQzV.exe	upx
C:\Windows\System\rvDJUWz.exe	upx
C:\Windows\System\ROZoAJW.exe	upx
C:\Windows\System\ibzCOPj.exe	upx
C:\Windows\System\ZDPPEvl.exe	upx
behavioral2/memory/3432-1389-0x00007FF60A3D0000-0x00007FF60A7C2000-memory.dmp	upx
behavioral2/memory/3404-2064-0x00007FF67EC70000-0x00007FF67F062000-memory.dmp	upx
behavioral2/memory/1560-2086-0x00007FF767C30000-0x00007FF768022000-memory.dmp	upx
behavioral2/memory/4360-2087-0x00007FF6FACD0000-0x00007FF6FB0C2000-memory.dmp	upx
behavioral2/memory/3696-2099-0x00007FF753D60000-0x00007FF754152000-memory.dmp	upx
behavioral2/memory/4316-2101-0x00007FF73CF60000-0x00007FF73D352000-memory.dmp	upx
behavioral2/memory/4416-2103-0x00007FF77C190000-0x00007FF77C582000-memory.dmp	upx
behavioral2/memory/3328-2105-0x00007FF75C620000-0x00007FF75CA12000-memory.dmp	upx
behavioral2/memory/4508-2107-0x00007FF71E460000-0x00007FF71E852000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service
T1102

Processes:

flow ioc

4 raw.githubusercontent.com

flow	ioc
4	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

Processes:

03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\System\BsnkkAS.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\tlPZgnT.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\jYAEDnw.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\lWVxebb.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\kpaJXgJ.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\BabtPzN.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\DdUPkvQ.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\QFBUTsZ.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\aqupBcT.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\dTBsAdj.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\IOMNcOS.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\EtLKUAd.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\HABQbvd.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\vHpgPke.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\AmHZqMR.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\XAwygAo.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\AkjpIBl.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\Johzxpb.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\PBieOhK.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\xiUcgvF.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\ztdNwTq.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\AbgoZnI.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\LtimQxB.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\GjrgyWD.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\YWOHsnK.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\dklYrcK.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\OeOLVcd.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\DALpfBG.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\xokHrHq.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\JCTnRBn.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\dFnHvws.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\bRJTfrt.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\MEKQrlH.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\TOvpcKd.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\DVOhPbO.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\PsQeqSQ.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\jWAsBFk.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\PtQgJIS.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\OXkWvdB.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\xKGsqBt.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\DfqWYef.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\CIcFwmY.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\gCxElEe.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\EkMpWRZ.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\bItvsCs.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\dxCVkwY.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\BhKJzYV.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\WjgMtuu.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\MgTtFhB.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\zdQZlvc.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\MXCgDgr.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\qxEHwnc.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\gdBSFrE.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\VFFhhZa.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\vvsEwqK.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\tjofzok.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\LxcwNCf.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\VunbKMe.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\KmooWRq.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\ixhjjUE.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\eFUeFbk.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\xlznbXI.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\cAyWpAM.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
File created	C:\Windows\System\HsQMqpA.exe	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1380 powershell.exe
1380 powershell.exe

pid	process
1380	powershell.exe
1380	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exe03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	1380	powershell.exe
Token: SeLockMemoryPrivilege	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe

description	pid	process	target process
PID 3432 wrote to memory of 1380	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	powershell.exe
PID 3432 wrote to memory of 1380	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	powershell.exe
PID 3432 wrote to memory of 4416	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	MwSLfkG.exe
PID 3432 wrote to memory of 4416	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	MwSLfkG.exe
PID 3432 wrote to memory of 4316	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	HUSmstH.exe
PID 3432 wrote to memory of 4316	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	HUSmstH.exe
PID 3432 wrote to memory of 3328	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	PGRFfky.exe
PID 3432 wrote to memory of 3328	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	PGRFfky.exe
PID 3432 wrote to memory of 4508	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	oJiicFf.exe
PID 3432 wrote to memory of 4508	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	oJiicFf.exe
PID 3432 wrote to memory of 3560	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	BJsdFHh.exe
PID 3432 wrote to memory of 3560	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	BJsdFHh.exe
PID 3432 wrote to memory of 4040	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	OYXkeQk.exe
PID 3432 wrote to memory of 4040	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	OYXkeQk.exe
PID 3432 wrote to memory of 1404	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	JPHEoLX.exe
PID 3432 wrote to memory of 1404	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	JPHEoLX.exe
PID 3432 wrote to memory of 5020	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	XpIPltu.exe
PID 3432 wrote to memory of 5020	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	XpIPltu.exe
PID 3432 wrote to memory of 1364	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	cKAJsSJ.exe
PID 3432 wrote to memory of 1364	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	cKAJsSJ.exe
PID 3432 wrote to memory of 1628	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	ryTSXpS.exe
PID 3432 wrote to memory of 1628	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	ryTSXpS.exe
PID 3432 wrote to memory of 3032	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	TduDdNZ.exe
PID 3432 wrote to memory of 3032	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	TduDdNZ.exe
PID 3432 wrote to memory of 3404	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	jAaYgbD.exe
PID 3432 wrote to memory of 3404	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	jAaYgbD.exe
PID 3432 wrote to memory of 2132	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	IkSnaJw.exe
PID 3432 wrote to memory of 2132	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	IkSnaJw.exe
PID 3432 wrote to memory of 1560	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	TuDzhYF.exe
PID 3432 wrote to memory of 1560	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	TuDzhYF.exe
PID 3432 wrote to memory of 2296	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	jCNMijz.exe
PID 3432 wrote to memory of 2296	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	jCNMijz.exe
PID 3432 wrote to memory of 4360	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	mcsVVGx.exe
PID 3432 wrote to memory of 4360	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	mcsVVGx.exe
PID 3432 wrote to memory of 3696	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	Nvevjzl.exe
PID 3432 wrote to memory of 3696	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	Nvevjzl.exe
PID 3432 wrote to memory of 3236	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	mimzELt.exe
PID 3432 wrote to memory of 3236	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	mimzELt.exe
PID 3432 wrote to memory of 4188	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	erkkoga.exe
PID 3432 wrote to memory of 4188	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	erkkoga.exe
PID 3432 wrote to memory of 668	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	TAhRURY.exe
PID 3432 wrote to memory of 668	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	TAhRURY.exe
PID 3432 wrote to memory of 556	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	KishkmQ.exe
PID 3432 wrote to memory of 556	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	KishkmQ.exe
PID 3432 wrote to memory of 3596	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	zsmfThy.exe
PID 3432 wrote to memory of 3596	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	zsmfThy.exe
PID 3432 wrote to memory of 4448	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	gacddwX.exe
PID 3432 wrote to memory of 4448	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	gacddwX.exe
PID 3432 wrote to memory of 2436	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	mEDStFn.exe
PID 3432 wrote to memory of 2436	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	mEDStFn.exe
PID 3432 wrote to memory of 4244	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	nEgkHtH.exe
PID 3432 wrote to memory of 4244	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	nEgkHtH.exe
PID 3432 wrote to memory of 2108	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	aIHspxh.exe
PID 3432 wrote to memory of 2108	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	aIHspxh.exe
PID 3432 wrote to memory of 4168	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	xaxVdyr.exe
PID 3432 wrote to memory of 4168	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	xaxVdyr.exe
PID 3432 wrote to memory of 4872	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	ibzCOPj.exe
PID 3432 wrote to memory of 4872	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	ibzCOPj.exe
PID 3432 wrote to memory of 4576	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	ZDPPEvl.exe
PID 3432 wrote to memory of 4576	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	ZDPPEvl.exe
PID 3432 wrote to memory of 744	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	xZarDoa.exe
PID 3432 wrote to memory of 744	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	xZarDoa.exe
PID 3432 wrote to memory of 4920	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	ROZoAJW.exe
PID 3432 wrote to memory of 4920	3432	03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe	ROZoAJW.exe

C:\Users\Admin\AppData\Local\Temp\03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03bf00e7d9c75885bb67ab8317869682_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1380
- C:\Windows\System\MwSLfkG.exe
  C:\Windows\System\MwSLfkG.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\HUSmstH.exe
  C:\Windows\System\HUSmstH.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\PGRFfky.exe
  C:\Windows\System\PGRFfky.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\oJiicFf.exe
  C:\Windows\System\oJiicFf.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\BJsdFHh.exe
  C:\Windows\System\BJsdFHh.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\OYXkeQk.exe
  C:\Windows\System\OYXkeQk.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\JPHEoLX.exe
  C:\Windows\System\JPHEoLX.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\XpIPltu.exe
  C:\Windows\System\XpIPltu.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\cKAJsSJ.exe
  C:\Windows\System\cKAJsSJ.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\ryTSXpS.exe
  C:\Windows\System\ryTSXpS.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\TduDdNZ.exe
  C:\Windows\System\TduDdNZ.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\jAaYgbD.exe
  C:\Windows\System\jAaYgbD.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\IkSnaJw.exe
  C:\Windows\System\IkSnaJw.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\TuDzhYF.exe
  C:\Windows\System\TuDzhYF.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\jCNMijz.exe
  C:\Windows\System\jCNMijz.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\mcsVVGx.exe
  C:\Windows\System\mcsVVGx.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\Nvevjzl.exe
  C:\Windows\System\Nvevjzl.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\mimzELt.exe
  C:\Windows\System\mimzELt.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\erkkoga.exe
  C:\Windows\System\erkkoga.exe
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Windows\System\TAhRURY.exe
  C:\Windows\System\TAhRURY.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\KishkmQ.exe
  C:\Windows\System\KishkmQ.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\zsmfThy.exe
  C:\Windows\System\zsmfThy.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\gacddwX.exe
  C:\Windows\System\gacddwX.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\mEDStFn.exe
  C:\Windows\System\mEDStFn.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\nEgkHtH.exe
  C:\Windows\System\nEgkHtH.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\aIHspxh.exe
  C:\Windows\System\aIHspxh.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\xaxVdyr.exe
  C:\Windows\System\xaxVdyr.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\ibzCOPj.exe
  C:\Windows\System\ibzCOPj.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\ZDPPEvl.exe
  C:\Windows\System\ZDPPEvl.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\xZarDoa.exe
  C:\Windows\System\xZarDoa.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\ROZoAJW.exe
  C:\Windows\System\ROZoAJW.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\rvDJUWz.exe
  C:\Windows\System\rvDJUWz.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\KpPfQzV.exe
  C:\Windows\System\KpPfQzV.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\zRsQiYY.exe
  C:\Windows\System\zRsQiYY.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\OnkWOLc.exe
  C:\Windows\System\OnkWOLc.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System\DBkFnNl.exe
  C:\Windows\System\DBkFnNl.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\OFKoGGF.exe
  C:\Windows\System\OFKoGGF.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System\mTRKgso.exe
  C:\Windows\System\mTRKgso.exe
  2⤵
  - Executes dropped EXE
  PID:716
- C:\Windows\System\bmjiviu.exe
  C:\Windows\System\bmjiviu.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\zLabmna.exe
  C:\Windows\System\zLabmna.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\PvjvzLg.exe
  C:\Windows\System\PvjvzLg.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\qpOqtra.exe
  C:\Windows\System\qpOqtra.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\iTZuAKo.exe
  C:\Windows\System\iTZuAKo.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\hlcVPfk.exe
  C:\Windows\System\hlcVPfk.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\UouUmpb.exe
  C:\Windows\System\UouUmpb.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\AmHZqMR.exe
  C:\Windows\System\AmHZqMR.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\hzhueGG.exe
  C:\Windows\System\hzhueGG.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\WzTzrOF.exe
  C:\Windows\System\WzTzrOF.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\CeyruWE.exe
  C:\Windows\System\CeyruWE.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\obUGkII.exe
  C:\Windows\System\obUGkII.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\GlJfKTy.exe
  C:\Windows\System\GlJfKTy.exe
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Windows\System\ibSqOOb.exe
  C:\Windows\System\ibSqOOb.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\FnGDnMQ.exe
  C:\Windows\System\FnGDnMQ.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\LtimQxB.exe
  C:\Windows\System\LtimQxB.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\pzHecND.exe
  C:\Windows\System\pzHecND.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\cGBiwdz.exe
  C:\Windows\System\cGBiwdz.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\NvlqAiJ.exe
  C:\Windows\System\NvlqAiJ.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System\KcAdvTA.exe
  C:\Windows\System\KcAdvTA.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Windows\System\SwWwwqQ.exe
  C:\Windows\System\SwWwwqQ.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\xPivKYf.exe
  C:\Windows\System\xPivKYf.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\bcaiWVo.exe
  C:\Windows\System\bcaiWVo.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\maVozbW.exe
  C:\Windows\System\maVozbW.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\WpEmHFA.exe
  C:\Windows\System\WpEmHFA.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\pAJtrOI.exe
  C:\Windows\System\pAJtrOI.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\MHjFGyx.exe
  C:\Windows\System\MHjFGyx.exe
  2⤵
  PID:2912
- C:\Windows\System\ICPBaZh.exe
  C:\Windows\System\ICPBaZh.exe
  2⤵
  PID:2512
- C:\Windows\System\Nqghqwh.exe
  C:\Windows\System\Nqghqwh.exe
  2⤵
  PID:2124
- C:\Windows\System\JKTlJuk.exe
  C:\Windows\System\JKTlJuk.exe
  2⤵
  PID:1840
- C:\Windows\System\UhjNogD.exe
  C:\Windows\System\UhjNogD.exe
  2⤵
  PID:1500
- C:\Windows\System\ZbhPFSE.exe
  C:\Windows\System\ZbhPFSE.exe
  2⤵
  PID:3180
- C:\Windows\System\YaxdQhy.exe
  C:\Windows\System\YaxdQhy.exe
  2⤵
  PID:1724
- C:\Windows\System\LhXDKFm.exe
  C:\Windows\System\LhXDKFm.exe
  2⤵
  PID:1480
- C:\Windows\System\MiOnOaq.exe
  C:\Windows\System\MiOnOaq.exe
  2⤵
  PID:2424
- C:\Windows\System\YWLRcBx.exe
  C:\Windows\System\YWLRcBx.exe
  2⤵
  PID:4056
- C:\Windows\System\YdLqbrw.exe
  C:\Windows\System\YdLqbrw.exe
  2⤵
  PID:4464
- C:\Windows\System\JuwunHy.exe
  C:\Windows\System\JuwunHy.exe
  2⤵
  PID:4568
- C:\Windows\System\eyqMPCg.exe
  C:\Windows\System\eyqMPCg.exe
  2⤵
  PID:4572
- C:\Windows\System\ygCVqaz.exe
  C:\Windows\System\ygCVqaz.exe
  2⤵
  PID:1620
- C:\Windows\System\MXCgDgr.exe
  C:\Windows\System\MXCgDgr.exe
  2⤵
  PID:3976
- C:\Windows\System\CpIYmlS.exe
  C:\Windows\System\CpIYmlS.exe
  2⤵
  PID:4228
- C:\Windows\System\ZIzYhzF.exe
  C:\Windows\System\ZIzYhzF.exe
  2⤵
  PID:820
- C:\Windows\System\LHcerlE.exe
  C:\Windows\System\LHcerlE.exe
  2⤵
  PID:4560
- C:\Windows\System\GzPeXBL.exe
  C:\Windows\System\GzPeXBL.exe
  2⤵
  PID:2744
- C:\Windows\System\zYPaRud.exe
  C:\Windows\System\zYPaRud.exe
  2⤵
  PID:4396
- C:\Windows\System\MbIckwZ.exe
  C:\Windows\System\MbIckwZ.exe
  2⤵
  PID:4580
- C:\Windows\System\gRHNVcz.exe
  C:\Windows\System\gRHNVcz.exe
  2⤵
  PID:5132
- C:\Windows\System\oBxyulN.exe
  C:\Windows\System\oBxyulN.exe
  2⤵
  PID:5156
- C:\Windows\System\USAxcvv.exe
  C:\Windows\System\USAxcvv.exe
  2⤵
  PID:5172
- C:\Windows\System\FiPSKAT.exe
  C:\Windows\System\FiPSKAT.exe
  2⤵
  PID:5200
- C:\Windows\System\nglIAxx.exe
  C:\Windows\System\nglIAxx.exe
  2⤵
  PID:5224
- C:\Windows\System\iJdDBAi.exe
  C:\Windows\System\iJdDBAi.exe
  2⤵
  PID:5244
- C:\Windows\System\hEoLVyl.exe
  C:\Windows\System\hEoLVyl.exe
  2⤵
  PID:5288
- C:\Windows\System\yIIcjrl.exe
  C:\Windows\System\yIIcjrl.exe
  2⤵
  PID:5336
- C:\Windows\System\umcRAyS.exe
  C:\Windows\System\umcRAyS.exe
  2⤵
  PID:5392
- C:\Windows\System\zoNCVVP.exe
  C:\Windows\System\zoNCVVP.exe
  2⤵
  PID:5412
- C:\Windows\System\pSznZXr.exe
  C:\Windows\System\pSznZXr.exe
  2⤵
  PID:5436
- C:\Windows\System\NGBNHDN.exe
  C:\Windows\System\NGBNHDN.exe
  2⤵
  PID:5480
- C:\Windows\System\oNuESUh.exe
  C:\Windows\System\oNuESUh.exe
  2⤵
  PID:5504
- C:\Windows\System\BqxPnfK.exe
  C:\Windows\System\BqxPnfK.exe
  2⤵
  PID:5528
- C:\Windows\System\UPQssQA.exe
  C:\Windows\System\UPQssQA.exe
  2⤵
  PID:5552
- C:\Windows\System\oaMkVIU.exe
  C:\Windows\System\oaMkVIU.exe
  2⤵
  PID:5604
- C:\Windows\System\pHXlsUl.exe
  C:\Windows\System\pHXlsUl.exe
  2⤵
  PID:5652
- C:\Windows\System\ndvNecd.exe
  C:\Windows\System\ndvNecd.exe
  2⤵
  PID:5672
- C:\Windows\System\rSOrYzb.exe
  C:\Windows\System\rSOrYzb.exe
  2⤵
  PID:5696
- C:\Windows\System\hCkPIDh.exe
  C:\Windows\System\hCkPIDh.exe
  2⤵
  PID:5716
- C:\Windows\System\tWlMkJo.exe
  C:\Windows\System\tWlMkJo.exe
  2⤵
  PID:5744
- C:\Windows\System\SHVrtlC.exe
  C:\Windows\System\SHVrtlC.exe
  2⤵
  PID:5768
- C:\Windows\System\fKgEhzf.exe
  C:\Windows\System\fKgEhzf.exe
  2⤵
  PID:5788
- C:\Windows\System\OqfOkuZ.exe
  C:\Windows\System\OqfOkuZ.exe
  2⤵
  PID:5816
- C:\Windows\System\cLvZxSW.exe
  C:\Windows\System\cLvZxSW.exe
  2⤵
  PID:5836
- C:\Windows\System\NxeKVaT.exe
  C:\Windows\System\NxeKVaT.exe
  2⤵
  PID:5856
- C:\Windows\System\RFtZvzS.exe
  C:\Windows\System\RFtZvzS.exe
  2⤵
  PID:5884
- C:\Windows\System\qNnUtgt.exe
  C:\Windows\System\qNnUtgt.exe
  2⤵
  PID:5904
- C:\Windows\System\JdfuVOx.exe
  C:\Windows\System\JdfuVOx.exe
  2⤵
  PID:5932
- C:\Windows\System\uwQZzfN.exe
  C:\Windows\System\uwQZzfN.exe
  2⤵
  PID:5952
- C:\Windows\System\GJXWBKt.exe
  C:\Windows\System\GJXWBKt.exe
  2⤵
  PID:5976
- C:\Windows\System\eRxRKXy.exe
  C:\Windows\System\eRxRKXy.exe
  2⤵
  PID:5992
- C:\Windows\System\aTbEzCQ.exe
  C:\Windows\System\aTbEzCQ.exe
  2⤵
  PID:6052
- C:\Windows\System\PYTVfGk.exe
  C:\Windows\System\PYTVfGk.exe
  2⤵
  PID:6080
- C:\Windows\System\nnnCEzV.exe
  C:\Windows\System\nnnCEzV.exe
  2⤵
  PID:6100
- C:\Windows\System\IkCyphs.exe
  C:\Windows\System\IkCyphs.exe
  2⤵
  PID:6116
- C:\Windows\System\JrRwRss.exe
  C:\Windows\System\JrRwRss.exe
  2⤵
  PID:436
- C:\Windows\System\SEdecog.exe
  C:\Windows\System\SEdecog.exe
  2⤵
  PID:5192
- C:\Windows\System\iPCawbM.exe
  C:\Windows\System\iPCawbM.exe
  2⤵
  PID:5168
- C:\Windows\System\wLFvekz.exe
  C:\Windows\System\wLFvekz.exe
  2⤵
  PID:5216
- C:\Windows\System\QFBUTsZ.exe
  C:\Windows\System\QFBUTsZ.exe
  2⤵
  PID:5332
- C:\Windows\System\LxANhzz.exe
  C:\Windows\System\LxANhzz.exe
  2⤵
  PID:5428
- C:\Windows\System\WDwCwtk.exe
  C:\Windows\System\WDwCwtk.exe
  2⤵
  PID:5488
- C:\Windows\System\fmhjChK.exe
  C:\Windows\System\fmhjChK.exe
  2⤵
  PID:5572
- C:\Windows\System\CtiOPAc.exe
  C:\Windows\System\CtiOPAc.exe
  2⤵
  PID:5688
- C:\Windows\System\ozOnlfF.exe
  C:\Windows\System\ozOnlfF.exe
  2⤵
  PID:5776
- C:\Windows\System\qZERSIc.exe
  C:\Windows\System\qZERSIc.exe
  2⤵
  PID:5804
- C:\Windows\System\xSBLSkm.exe
  C:\Windows\System\xSBLSkm.exe
  2⤵
  PID:5756
- C:\Windows\System\wofhdLm.exe
  C:\Windows\System\wofhdLm.exe
  2⤵
  PID:5896
- C:\Windows\System\VoGeFTv.exe
  C:\Windows\System\VoGeFTv.exe
  2⤵
  PID:5924
- C:\Windows\System\rmkohkW.exe
  C:\Windows\System\rmkohkW.exe
  2⤵
  PID:6028
- C:\Windows\System\KzxJtCR.exe
  C:\Windows\System\KzxJtCR.exe
  2⤵
  PID:6140
- C:\Windows\System\tjofzok.exe
  C:\Windows\System\tjofzok.exe
  2⤵
  PID:5236
- C:\Windows\System\uZvGrgf.exe
  C:\Windows\System\uZvGrgf.exe
  2⤵
  PID:5404
- C:\Windows\System\dGFnTEX.exe
  C:\Windows\System\dGFnTEX.exe
  2⤵
  PID:5548
- C:\Windows\System\QGdnOCZ.exe
  C:\Windows\System\QGdnOCZ.exe
  2⤵
  PID:5784
- C:\Windows\System\EMcDsxX.exe
  C:\Windows\System\EMcDsxX.exe
  2⤵
  PID:5880
- C:\Windows\System\TLnryzt.exe
  C:\Windows\System\TLnryzt.exe
  2⤵
  PID:5920
- C:\Windows\System\PfNCysT.exe
  C:\Windows\System\PfNCysT.exe
  2⤵
  PID:6088
- C:\Windows\System\VkTUgws.exe
  C:\Windows\System\VkTUgws.exe
  2⤵
  PID:5368
- C:\Windows\System\YUlOGzb.exe
  C:\Windows\System\YUlOGzb.exe
  2⤵
  PID:4908
- C:\Windows\System\ikklpZA.exe
  C:\Windows\System\ikklpZA.exe
  2⤵
  PID:5960
- C:\Windows\System\XAwygAo.exe
  C:\Windows\System\XAwygAo.exe
  2⤵
  PID:5564
- C:\Windows\System\TxmhDRq.exe
  C:\Windows\System\TxmhDRq.exe
  2⤵
  PID:6152
- C:\Windows\System\XwICNQT.exe
  C:\Windows\System\XwICNQT.exe
  2⤵
  PID:6172
- C:\Windows\System\XJLrzaI.exe
  C:\Windows\System\XJLrzaI.exe
  2⤵
  PID:6196
- C:\Windows\System\MtTtJMW.exe
  C:\Windows\System\MtTtJMW.exe
  2⤵
  PID:6244
- C:\Windows\System\luGPFbJ.exe
  C:\Windows\System\luGPFbJ.exe
  2⤵
  PID:6264
- C:\Windows\System\hbRqiXp.exe
  C:\Windows\System\hbRqiXp.exe
  2⤵
  PID:6300
- C:\Windows\System\BsnkkAS.exe
  C:\Windows\System\BsnkkAS.exe
  2⤵
  PID:6320
- C:\Windows\System\fbmcOCN.exe
  C:\Windows\System\fbmcOCN.exe
  2⤵
  PID:6348
- C:\Windows\System\XiQTYZa.exe
  C:\Windows\System\XiQTYZa.exe
  2⤵
  PID:6372
- C:\Windows\System\xlznbXI.exe
  C:\Windows\System\xlznbXI.exe
  2⤵
  PID:6388
- C:\Windows\System\TiNhTFb.exe
  C:\Windows\System\TiNhTFb.exe
  2⤵
  PID:6416
- C:\Windows\System\xxdvKLz.exe
  C:\Windows\System\xxdvKLz.exe
  2⤵
  PID:6436
- C:\Windows\System\QKLmIAD.exe
  C:\Windows\System\QKLmIAD.exe
  2⤵
  PID:6484
- C:\Windows\System\jnaqoOC.exe
  C:\Windows\System\jnaqoOC.exe
  2⤵
  PID:6516
- C:\Windows\System\BhbaXdn.exe
  C:\Windows\System\BhbaXdn.exe
  2⤵
  PID:6540
- C:\Windows\System\gkZDeso.exe
  C:\Windows\System\gkZDeso.exe
  2⤵
  PID:6568
- C:\Windows\System\bHlAXoa.exe
  C:\Windows\System\bHlAXoa.exe
  2⤵
  PID:6616
- C:\Windows\System\PmhjoAA.exe
  C:\Windows\System\PmhjoAA.exe
  2⤵
  PID:6640
- C:\Windows\System\ajvomPp.exe
  C:\Windows\System\ajvomPp.exe
  2⤵
  PID:6664
- C:\Windows\System\nFFpdJJ.exe
  C:\Windows\System\nFFpdJJ.exe
  2⤵
  PID:6688
- C:\Windows\System\BLVKmnc.exe
  C:\Windows\System\BLVKmnc.exe
  2⤵
  PID:6728
- C:\Windows\System\dTBsAdj.exe
  C:\Windows\System\dTBsAdj.exe
  2⤵
  PID:6756
- C:\Windows\System\PLkWRfR.exe
  C:\Windows\System\PLkWRfR.exe
  2⤵
  PID:6780
- C:\Windows\System\ZibHzUT.exe
  C:\Windows\System\ZibHzUT.exe
  2⤵
  PID:6800
- C:\Windows\System\VbLyxNA.exe
  C:\Windows\System\VbLyxNA.exe
  2⤵
  PID:6828
- C:\Windows\System\UnwkCZF.exe
  C:\Windows\System\UnwkCZF.exe
  2⤵
  PID:6848
- C:\Windows\System\IOMNcOS.exe
  C:\Windows\System\IOMNcOS.exe
  2⤵
  PID:6872
- C:\Windows\System\xnGdSfP.exe
  C:\Windows\System\xnGdSfP.exe
  2⤵
  PID:6900
- C:\Windows\System\hKsshzd.exe
  C:\Windows\System\hKsshzd.exe
  2⤵
  PID:6928
- C:\Windows\System\PNtnqHm.exe
  C:\Windows\System\PNtnqHm.exe
  2⤵
  PID:6944
- C:\Windows\System\rEHmGmZ.exe
  C:\Windows\System\rEHmGmZ.exe
  2⤵
  PID:6964
- C:\Windows\System\VZNCExR.exe
  C:\Windows\System\VZNCExR.exe
  2⤵
  PID:6996
- C:\Windows\System\rUSchqz.exe
  C:\Windows\System\rUSchqz.exe
  2⤵
  PID:7012
- C:\Windows\System\xIhNHdk.exe
  C:\Windows\System\xIhNHdk.exe
  2⤵
  PID:7028
- C:\Windows\System\MUDUHsD.exe
  C:\Windows\System\MUDUHsD.exe
  2⤵
  PID:7100
- C:\Windows\System\PoznXIv.exe
  C:\Windows\System\PoznXIv.exe
  2⤵
  PID:7124
- C:\Windows\System\yEbhPFV.exe
  C:\Windows\System\yEbhPFV.exe
  2⤵
  PID:7160
- C:\Windows\System\moQVTgs.exe
  C:\Windows\System\moQVTgs.exe
  2⤵
  PID:6208
- C:\Windows\System\PTeJLys.exe
  C:\Windows\System\PTeJLys.exe
  2⤵
  PID:6260
- C:\Windows\System\CVZdjPj.exe
  C:\Windows\System\CVZdjPj.exe
  2⤵
  PID:6368
- C:\Windows\System\jLeKlmG.exe
  C:\Windows\System\jLeKlmG.exe
  2⤵
  PID:6384
- C:\Windows\System\lQqTkHm.exe
  C:\Windows\System\lQqTkHm.exe
  2⤵
  PID:6460
- C:\Windows\System\zkgXvRD.exe
  C:\Windows\System\zkgXvRD.exe
  2⤵
  PID:6524
- C:\Windows\System\YThtQKQ.exe
  C:\Windows\System\YThtQKQ.exe
  2⤵
  PID:6652
- C:\Windows\System\FjrUHct.exe
  C:\Windows\System\FjrUHct.exe
  2⤵
  PID:6684
- C:\Windows\System\WtrUXtk.exe
  C:\Windows\System\WtrUXtk.exe
  2⤵
  PID:6740
- C:\Windows\System\cBhXKpM.exe
  C:\Windows\System\cBhXKpM.exe
  2⤵
  PID:6844
- C:\Windows\System\WYwIJGV.exe
  C:\Windows\System\WYwIJGV.exe
  2⤵
  PID:6868
- C:\Windows\System\qskDEOs.exe
  C:\Windows\System\qskDEOs.exe
  2⤵
  PID:6864
- C:\Windows\System\ttenGCy.exe
  C:\Windows\System\ttenGCy.exe
  2⤵
  PID:6936
- C:\Windows\System\yJILoyr.exe
  C:\Windows\System\yJILoyr.exe
  2⤵
  PID:6984
- C:\Windows\System\cbkfIFp.exe
  C:\Windows\System\cbkfIFp.exe
  2⤵
  PID:7076
- C:\Windows\System\EoMquTv.exe
  C:\Windows\System\EoMquTv.exe
  2⤵
  PID:7116
- C:\Windows\System\chnuOBX.exe
  C:\Windows\System\chnuOBX.exe
  2⤵
  PID:5300
- C:\Windows\System\puVvDvR.exe
  C:\Windows\System\puVvDvR.exe
  2⤵
  PID:6256
- C:\Windows\System\AqDAdND.exe
  C:\Windows\System\AqDAdND.exe
  2⤵
  PID:6512
- C:\Windows\System\wCRMBZu.exe
  C:\Windows\System\wCRMBZu.exe
  2⤵
  PID:6604
- C:\Windows\System\dLnIPwE.exe
  C:\Windows\System\dLnIPwE.exe
  2⤵
  PID:6764
- C:\Windows\System\yZYKmdh.exe
  C:\Windows\System\yZYKmdh.exe
  2⤵
  PID:6972
- C:\Windows\System\dOwspEo.exe
  C:\Windows\System\dOwspEo.exe
  2⤵
  PID:6188
- C:\Windows\System\jWAsBFk.exe
  C:\Windows\System\jWAsBFk.exe
  2⤵
  PID:6428
- C:\Windows\System\DFXEIbW.exe
  C:\Windows\System\DFXEIbW.exe
  2⤵
  PID:6588
- C:\Windows\System\oOnyzvy.exe
  C:\Windows\System\oOnyzvy.exe
  2⤵
  PID:6280
- C:\Windows\System\RNWKUWx.exe
  C:\Windows\System\RNWKUWx.exe
  2⤵
  PID:7112
- C:\Windows\System\vMzTpZw.exe
  C:\Windows\System\vMzTpZw.exe
  2⤵
  PID:7192
- C:\Windows\System\OeOLVcd.exe
  C:\Windows\System\OeOLVcd.exe
  2⤵
  PID:7228
- C:\Windows\System\JVRUicK.exe
  C:\Windows\System\JVRUicK.exe
  2⤵
  PID:7252
- C:\Windows\System\Vkscica.exe
  C:\Windows\System\Vkscica.exe
  2⤵
  PID:7284
- C:\Windows\System\BpxQOrF.exe
  C:\Windows\System\BpxQOrF.exe
  2⤵
  PID:7324
- C:\Windows\System\AkjpIBl.exe
  C:\Windows\System\AkjpIBl.exe
  2⤵
  PID:7348
- C:\Windows\System\kEzCDTW.exe
  C:\Windows\System\kEzCDTW.exe
  2⤵
  PID:7364
- C:\Windows\System\tlPZgnT.exe
  C:\Windows\System\tlPZgnT.exe
  2⤵
  PID:7384
- C:\Windows\System\CEnXQev.exe
  C:\Windows\System\CEnXQev.exe
  2⤵
  PID:7408
- C:\Windows\System\YKKwHig.exe
  C:\Windows\System\YKKwHig.exe
  2⤵
  PID:7440
- C:\Windows\System\autCOmo.exe
  C:\Windows\System\autCOmo.exe
  2⤵
  PID:7468
- C:\Windows\System\BNxoeZb.exe
  C:\Windows\System\BNxoeZb.exe
  2⤵
  PID:7500
- C:\Windows\System\Johzxpb.exe
  C:\Windows\System\Johzxpb.exe
  2⤵
  PID:7520
- C:\Windows\System\nwcxujY.exe
  C:\Windows\System\nwcxujY.exe
  2⤵
  PID:7552
- C:\Windows\System\eZQyGGd.exe
  C:\Windows\System\eZQyGGd.exe
  2⤵
  PID:7572
- C:\Windows\System\fsimtcv.exe
  C:\Windows\System\fsimtcv.exe
  2⤵
  PID:7620
- C:\Windows\System\HRPzcoF.exe
  C:\Windows\System\HRPzcoF.exe
  2⤵
  PID:7664
- C:\Windows\System\EkMpWRZ.exe
  C:\Windows\System\EkMpWRZ.exe
  2⤵
  PID:7684
- C:\Windows\System\sjrDDKo.exe
  C:\Windows\System\sjrDDKo.exe
  2⤵
  PID:7700
- C:\Windows\System\dohpelP.exe
  C:\Windows\System\dohpelP.exe
  2⤵
  PID:7724
- C:\Windows\System\VHmtRpo.exe
  C:\Windows\System\VHmtRpo.exe
  2⤵
  PID:7748
- C:\Windows\System\CYIWGsK.exe
  C:\Windows\System\CYIWGsK.exe
  2⤵
  PID:7776
- C:\Windows\System\gdBSFrE.exe
  C:\Windows\System\gdBSFrE.exe
  2⤵
  PID:7816
- C:\Windows\System\mJHRrqe.exe
  C:\Windows\System\mJHRrqe.exe
  2⤵
  PID:7896
- C:\Windows\System\ttsgZbH.exe
  C:\Windows\System\ttsgZbH.exe
  2⤵
  PID:7948
- C:\Windows\System\ihtfUhl.exe
  C:\Windows\System\ihtfUhl.exe
  2⤵
  PID:7972
- C:\Windows\System\WeFTUUz.exe
  C:\Windows\System\WeFTUUz.exe
  2⤵
  PID:7988
- C:\Windows\System\NKVrdNQ.exe
  C:\Windows\System\NKVrdNQ.exe
  2⤵
  PID:8020
- C:\Windows\System\XeNsFzz.exe
  C:\Windows\System\XeNsFzz.exe
  2⤵
  PID:8040
- C:\Windows\System\eFUeFbk.exe
  C:\Windows\System\eFUeFbk.exe
  2⤵
  PID:8056
- C:\Windows\System\xsnbhYw.exe
  C:\Windows\System\xsnbhYw.exe
  2⤵
  PID:8076
- C:\Windows\System\TwLmoir.exe
  C:\Windows\System\TwLmoir.exe
  2⤵
  PID:8100
- C:\Windows\System\uzVRvLR.exe
  C:\Windows\System\uzVRvLR.exe
  2⤵
  PID:8132
- C:\Windows\System\TfuinID.exe
  C:\Windows\System\TfuinID.exe
  2⤵
  PID:8152
- C:\Windows\System\IjfqIXc.exe
  C:\Windows\System\IjfqIXc.exe
  2⤵
  PID:7216
- C:\Windows\System\IaJGRzZ.exe
  C:\Windows\System\IaJGRzZ.exe
  2⤵
  PID:7320
- C:\Windows\System\TacsOZt.exe
  C:\Windows\System\TacsOZt.exe
  2⤵
  PID:7360
- C:\Windows\System\bItvsCs.exe
  C:\Windows\System\bItvsCs.exe
  2⤵
  PID:7376
- C:\Windows\System\dYJaJes.exe
  C:\Windows\System\dYJaJes.exe
  2⤵
  PID:7404
- C:\Windows\System\srtDHEY.exe
  C:\Windows\System\srtDHEY.exe
  2⤵
  PID:7508
- C:\Windows\System\uXJvPWd.exe
  C:\Windows\System\uXJvPWd.exe
  2⤵
  PID:7592
- C:\Windows\System\VlzaeBK.exe
  C:\Windows\System\VlzaeBK.exe
  2⤵
  PID:7672
- C:\Windows\System\qxMsDJy.exe
  C:\Windows\System\qxMsDJy.exe
  2⤵
  PID:7716
- C:\Windows\System\XDspXmQ.exe
  C:\Windows\System\XDspXmQ.exe
  2⤵
  PID:7856
- C:\Windows\System\KypFmAC.exe
  C:\Windows\System\KypFmAC.exe
  2⤵
  PID:7836
- C:\Windows\System\OByEOub.exe
  C:\Windows\System\OByEOub.exe
  2⤵
  PID:7932
- C:\Windows\System\ZPfAnxg.exe
  C:\Windows\System\ZPfAnxg.exe
  2⤵
  PID:7876
- C:\Windows\System\pptWUYl.exe
  C:\Windows\System\pptWUYl.exe
  2⤵
  PID:7960
- C:\Windows\System\FuOQgij.exe
  C:\Windows\System\FuOQgij.exe
  2⤵
  PID:8052
- C:\Windows\System\GwIZUxl.exe
  C:\Windows\System\GwIZUxl.exe
  2⤵
  PID:8144
- C:\Windows\System\ZluTcCY.exe
  C:\Windows\System\ZluTcCY.exe
  2⤵
  PID:7200
- C:\Windows\System\TttPehN.exe
  C:\Windows\System\TttPehN.exe
  2⤵
  PID:7264
- C:\Windows\System\qjnXrAX.exe
  C:\Windows\System\qjnXrAX.exe
  2⤵
  PID:7432
- C:\Windows\System\QehWUqS.exe
  C:\Windows\System\QehWUqS.exe
  2⤵
  PID:7548
- C:\Windows\System\VfgmiNg.exe
  C:\Windows\System\VfgmiNg.exe
  2⤵
  PID:7696
- C:\Windows\System\jYAEDnw.exe
  C:\Windows\System\jYAEDnw.exe
  2⤵
  PID:7808
- C:\Windows\System\sCUKjCT.exe
  C:\Windows\System\sCUKjCT.exe
  2⤵
  PID:7944
- C:\Windows\System\dxCVkwY.exe
  C:\Windows\System\dxCVkwY.exe
  2⤵
  PID:8096
- C:\Windows\System\YilVbdL.exe
  C:\Windows\System\YilVbdL.exe
  2⤵
  PID:7464
- C:\Windows\System\BhKJzYV.exe
  C:\Windows\System\BhKJzYV.exe
  2⤵
  PID:7692
- C:\Windows\System\tYBceXf.exe
  C:\Windows\System\tYBceXf.exe
  2⤵
  PID:7844
- C:\Windows\System\WjgMtuu.exe
  C:\Windows\System\WjgMtuu.exe
  2⤵
  PID:7476
- C:\Windows\System\vdxNzEE.exe
  C:\Windows\System\vdxNzEE.exe
  2⤵
  PID:8196
- C:\Windows\System\fqUKxVM.exe
  C:\Windows\System\fqUKxVM.exe
  2⤵
  PID:8216
- C:\Windows\System\IEpiPzi.exe
  C:\Windows\System\IEpiPzi.exe
  2⤵
  PID:8232
- C:\Windows\System\bbrIaqw.exe
  C:\Windows\System\bbrIaqw.exe
  2⤵
  PID:8268
- C:\Windows\System\zrLMOzS.exe
  C:\Windows\System\zrLMOzS.exe
  2⤵
  PID:8308
- C:\Windows\System\OlbgVzO.exe
  C:\Windows\System\OlbgVzO.exe
  2⤵
  PID:8352
- C:\Windows\System\MHMlMov.exe
  C:\Windows\System\MHMlMov.exe
  2⤵
  PID:8384
- C:\Windows\System\EtLKUAd.exe
  C:\Windows\System\EtLKUAd.exe
  2⤵
  PID:8404
- C:\Windows\System\RtlhYgd.exe
  C:\Windows\System\RtlhYgd.exe
  2⤵
  PID:8444
- C:\Windows\System\ZiBlTYv.exe
  C:\Windows\System\ZiBlTYv.exe
  2⤵
  PID:8464
- C:\Windows\System\WKPMIao.exe
  C:\Windows\System\WKPMIao.exe
  2⤵
  PID:8488
- C:\Windows\System\KvNxbBL.exe
  C:\Windows\System\KvNxbBL.exe
  2⤵
  PID:8528
- C:\Windows\System\ddusaIQ.exe
  C:\Windows\System\ddusaIQ.exe
  2⤵
  PID:8544
- C:\Windows\System\DtjHgfk.exe
  C:\Windows\System\DtjHgfk.exe
  2⤵
  PID:8584
- C:\Windows\System\GNPgQvW.exe
  C:\Windows\System\GNPgQvW.exe
  2⤵
  PID:8612
- C:\Windows\System\wjQmqGd.exe
  C:\Windows\System\wjQmqGd.exe
  2⤵
  PID:8628
- C:\Windows\System\MmPkpya.exe
  C:\Windows\System\MmPkpya.exe
  2⤵
  PID:8656
- C:\Windows\System\uaLtZxI.exe
  C:\Windows\System\uaLtZxI.exe
  2⤵
  PID:8676
- C:\Windows\System\sgcHExz.exe
  C:\Windows\System\sgcHExz.exe
  2⤵
  PID:8700
- C:\Windows\System\sIOvtCF.exe
  C:\Windows\System\sIOvtCF.exe
  2⤵
  PID:8740
- C:\Windows\System\ZyfxBmA.exe
  C:\Windows\System\ZyfxBmA.exe
  2⤵
  PID:8776
- C:\Windows\System\ghQyxMN.exe
  C:\Windows\System\ghQyxMN.exe
  2⤵
  PID:8800
- C:\Windows\System\LxcwNCf.exe
  C:\Windows\System\LxcwNCf.exe
  2⤵
  PID:8840
- C:\Windows\System\dHgibCZ.exe
  C:\Windows\System\dHgibCZ.exe
  2⤵
  PID:8856
- C:\Windows\System\HuDorHX.exe
  C:\Windows\System\HuDorHX.exe
  2⤵
  PID:8876
- C:\Windows\System\KmvslsH.exe
  C:\Windows\System\KmvslsH.exe
  2⤵
  PID:8924
- C:\Windows\System\ikMbhzO.exe
  C:\Windows\System\ikMbhzO.exe
  2⤵
  PID:8940
- C:\Windows\System\kqGSLBg.exe
  C:\Windows\System\kqGSLBg.exe
  2⤵
  PID:8960
- C:\Windows\System\PBieOhK.exe
  C:\Windows\System\PBieOhK.exe
  2⤵
  PID:8988
- C:\Windows\System\XmBqaqa.exe
  C:\Windows\System\XmBqaqa.exe
  2⤵
  PID:9016
- C:\Windows\System\csWHMru.exe
  C:\Windows\System\csWHMru.exe
  2⤵
  PID:9044
- C:\Windows\System\PZSiflV.exe
  C:\Windows\System\PZSiflV.exe
  2⤵
  PID:9068
- C:\Windows\System\YFxLEYs.exe
  C:\Windows\System\YFxLEYs.exe
  2⤵
  PID:9112
- C:\Windows\System\lWVxebb.exe
  C:\Windows\System\lWVxebb.exe
  2⤵
  PID:9136
- C:\Windows\System\FfCvQyD.exe
  C:\Windows\System\FfCvQyD.exe
  2⤵
  PID:9168
- C:\Windows\System\hVQKZDw.exe
  C:\Windows\System\hVQKZDw.exe
  2⤵
  PID:9188
- C:\Windows\System\LBXEHSX.exe
  C:\Windows\System\LBXEHSX.exe
  2⤵
  PID:9212
- C:\Windows\System\zEiLqdH.exe
  C:\Windows\System\zEiLqdH.exe
  2⤵
  PID:7868
- C:\Windows\System\AfyDnmG.exe
  C:\Windows\System\AfyDnmG.exe
  2⤵
  PID:8288
- C:\Windows\System\KOlbgbs.exe
  C:\Windows\System\KOlbgbs.exe
  2⤵
  PID:8348
- C:\Windows\System\QFTceRY.exe
  C:\Windows\System\QFTceRY.exe
  2⤵
  PID:8380
- C:\Windows\System\eyNVJJL.exe
  C:\Windows\System\eyNVJJL.exe
  2⤵
  PID:8480
- C:\Windows\System\qdTWkqY.exe
  C:\Windows\System\qdTWkqY.exe
  2⤵
  PID:8512
- C:\Windows\System\REAFOpT.exe
  C:\Windows\System\REAFOpT.exe
  2⤵
  PID:8580
- C:\Windows\System\MxFlwde.exe
  C:\Windows\System\MxFlwde.exe
  2⤵
  PID:8640
- C:\Windows\System\UbWeugd.exe
  C:\Windows\System\UbWeugd.exe
  2⤵
  PID:8688
- C:\Windows\System\iUbBdoC.exe
  C:\Windows\System\iUbBdoC.exe
  2⤵
  PID:8724
- C:\Windows\System\sKjWoYi.exe
  C:\Windows\System\sKjWoYi.exe
  2⤵
  PID:8788
- C:\Windows\System\oCPrLAc.exe
  C:\Windows\System\oCPrLAc.exe
  2⤵
  PID:8852
- C:\Windows\System\jQChhLf.exe
  C:\Windows\System\jQChhLf.exe
  2⤵
  PID:8920
- C:\Windows\System\hpGjwly.exe
  C:\Windows\System\hpGjwly.exe
  2⤵
  PID:8996
- C:\Windows\System\mNjbXRB.exe
  C:\Windows\System\mNjbXRB.exe
  2⤵
  PID:9052
- C:\Windows\System\UfxrEaI.exe
  C:\Windows\System\UfxrEaI.exe
  2⤵
  PID:9132
- C:\Windows\System\SHdqrjS.exe
  C:\Windows\System\SHdqrjS.exe
  2⤵
  PID:9208
- C:\Windows\System\iBfcGPR.exe
  C:\Windows\System\iBfcGPR.exe
  2⤵
  PID:8256
- C:\Windows\System\NJlUsgJ.exe
  C:\Windows\System\NJlUsgJ.exe
  2⤵
  PID:8424
- C:\Windows\System\jSSbwZD.exe
  C:\Windows\System\jSSbwZD.exe
  2⤵
  PID:8576
- C:\Windows\System\kMOcrdI.exe
  C:\Windows\System\kMOcrdI.exe
  2⤵
  PID:8836
- C:\Windows\System\yrJKASk.exe
  C:\Windows\System\yrJKASk.exe
  2⤵
  PID:8900
- C:\Windows\System\cBZCSYG.exe
  C:\Windows\System\cBZCSYG.exe
  2⤵
  PID:9100
- C:\Windows\System\JCTnRBn.exe
  C:\Windows\System\JCTnRBn.exe
  2⤵
  PID:8072
- C:\Windows\System\dNSTMKm.exe
  C:\Windows\System\dNSTMKm.exe
  2⤵
  PID:8392
- C:\Windows\System\SfaTNSI.exe
  C:\Windows\System\SfaTNSI.exe
  2⤵
  PID:1044
- C:\Windows\System\TSLVdfl.exe
  C:\Windows\System\TSLVdfl.exe
  2⤵
  PID:8684
- C:\Windows\System\SEApvgJ.exe
  C:\Windows\System\SEApvgJ.exe
  2⤵
  PID:3804
- C:\Windows\System\kpaJXgJ.exe
  C:\Windows\System\kpaJXgJ.exe
  2⤵
  PID:3040
- C:\Windows\System\yUFELkA.exe
  C:\Windows\System\yUFELkA.exe
  2⤵
  PID:9240
- C:\Windows\System\gCxElEe.exe
  C:\Windows\System\gCxElEe.exe
  2⤵
  PID:9260
- C:\Windows\System\HABQbvd.exe
  C:\Windows\System\HABQbvd.exe
  2⤵
  PID:9304
- C:\Windows\System\JlEVQom.exe
  C:\Windows\System\JlEVQom.exe
  2⤵
  PID:9336
- C:\Windows\System\WbkCDZA.exe
  C:\Windows\System\WbkCDZA.exe
  2⤵
  PID:9352
- C:\Windows\System\RLeBcjR.exe
  C:\Windows\System\RLeBcjR.exe
  2⤵
  PID:9376
- C:\Windows\System\unijttO.exe
  C:\Windows\System\unijttO.exe
  2⤵
  PID:9412
- C:\Windows\System\gNDRWlh.exe
  C:\Windows\System\gNDRWlh.exe
  2⤵
  PID:9432
- C:\Windows\System\TupjrRh.exe
  C:\Windows\System\TupjrRh.exe
  2⤵
  PID:9468
- C:\Windows\System\TNIKBpL.exe
  C:\Windows\System\TNIKBpL.exe
  2⤵
  PID:9512
- C:\Windows\System\fqedoqm.exe
  C:\Windows\System\fqedoqm.exe
  2⤵
  PID:9528
- C:\Windows\System\SyoDyKU.exe
  C:\Windows\System\SyoDyKU.exe
  2⤵
  PID:9580
- C:\Windows\System\pYhYUOy.exe
  C:\Windows\System\pYhYUOy.exe
  2⤵
  PID:9608
- C:\Windows\System\CqOZyAK.exe
  C:\Windows\System\CqOZyAK.exe
  2⤵
  PID:9628
- C:\Windows\System\nfoYGgc.exe
  C:\Windows\System\nfoYGgc.exe
  2⤵
  PID:9648
- C:\Windows\System\zvgjvLu.exe
  C:\Windows\System\zvgjvLu.exe
  2⤵
  PID:9688
- C:\Windows\System\HvbZUeS.exe
  C:\Windows\System\HvbZUeS.exe
  2⤵
  PID:9724
- C:\Windows\System\EDtcIoO.exe
  C:\Windows\System\EDtcIoO.exe
  2⤵
  PID:9740
- C:\Windows\System\GzXWVuX.exe
  C:\Windows\System\GzXWVuX.exe
  2⤵
  PID:9764
- C:\Windows\System\FdJZoKX.exe
  C:\Windows\System\FdJZoKX.exe
  2⤵
  PID:9784
- C:\Windows\System\FqVDihI.exe
  C:\Windows\System\FqVDihI.exe
  2⤵
  PID:9804
- C:\Windows\System\QuzPUyo.exe
  C:\Windows\System\QuzPUyo.exe
  2⤵
  PID:9832
- C:\Windows\System\PtQgJIS.exe
  C:\Windows\System\PtQgJIS.exe
  2⤵
  PID:9872
- C:\Windows\System\BabtPzN.exe
  C:\Windows\System\BabtPzN.exe
  2⤵
  PID:9900
- C:\Windows\System\ccCnvaR.exe
  C:\Windows\System\ccCnvaR.exe
  2⤵
  PID:9924
- C:\Windows\System\MqzNfqx.exe
  C:\Windows\System\MqzNfqx.exe
  2⤵
  PID:9944
- C:\Windows\System\wtwkZsj.exe
  C:\Windows\System\wtwkZsj.exe
  2⤵
  PID:9972
- C:\Windows\System\uiADPBv.exe
  C:\Windows\System\uiADPBv.exe
  2⤵
  PID:9996
- C:\Windows\System\dFnHvws.exe
  C:\Windows\System\dFnHvws.exe
  2⤵
  PID:10016
- C:\Windows\System\QjuUZBq.exe
  C:\Windows\System\QjuUZBq.exe
  2⤵
  PID:10036
- C:\Windows\System\RiakJfI.exe
  C:\Windows\System\RiakJfI.exe
  2⤵
  PID:10068
- C:\Windows\System\xTjAIdC.exe
  C:\Windows\System\xTjAIdC.exe
  2⤵
  PID:10136
- C:\Windows\System\afCjUoN.exe
  C:\Windows\System\afCjUoN.exe
  2⤵
  PID:10164
- C:\Windows\System\JSmOxrv.exe
  C:\Windows\System\JSmOxrv.exe
  2⤵
  PID:10196
- C:\Windows\System\lBDSypQ.exe
  C:\Windows\System\lBDSypQ.exe
  2⤵
  PID:10212
- C:\Windows\System\OXkWvdB.exe
  C:\Windows\System\OXkWvdB.exe
  2⤵
  PID:10232
- C:\Windows\System\DPjBBUJ.exe
  C:\Windows\System\DPjBBUJ.exe
  2⤵
  PID:9224
- C:\Windows\System\CgiAYPs.exe
  C:\Windows\System\CgiAYPs.exe
  2⤵
  PID:9252
- C:\Windows\System\UmeMyHY.exe
  C:\Windows\System\UmeMyHY.exe
  2⤵
  PID:9324
- C:\Windows\System\bRJTfrt.exe
  C:\Windows\System\bRJTfrt.exe
  2⤵
  PID:9428
- C:\Windows\System\oCKuwTv.exe
  C:\Windows\System\oCKuwTv.exe
  2⤵
  PID:9548
- C:\Windows\System\jetzyxv.exe
  C:\Windows\System\jetzyxv.exe
  2⤵
  PID:9576
- C:\Windows\System\FQVmSZF.exe
  C:\Windows\System\FQVmSZF.exe
  2⤵
  PID:9624
- C:\Windows\System\RdtqXxR.exe
  C:\Windows\System\RdtqXxR.exe
  2⤵
  PID:9720
- C:\Windows\System\hlNZixf.exe
  C:\Windows\System\hlNZixf.exe
  2⤵
  PID:5076
- C:\Windows\System\KDeiJqC.exe
  C:\Windows\System\KDeiJqC.exe
  2⤵
  PID:2448
- C:\Windows\System\wiZTiWI.exe
  C:\Windows\System\wiZTiWI.exe
  2⤵
  PID:880
- C:\Windows\System\UqoPjbr.exe
  C:\Windows\System\UqoPjbr.exe
  2⤵
  PID:9824
- C:\Windows\System\SFgQjDp.exe
  C:\Windows\System\SFgQjDp.exe
  2⤵
  PID:9880
- C:\Windows\System\VeiUkJo.exe
  C:\Windows\System\VeiUkJo.exe
  2⤵
  PID:9912
- C:\Windows\System\ycLTWje.exe
  C:\Windows\System\ycLTWje.exe
  2⤵
  PID:10012
- C:\Windows\System\DrnhXIO.exe
  C:\Windows\System\DrnhXIO.exe
  2⤵
  PID:9988
- C:\Windows\System\VdKYihZ.exe
  C:\Windows\System\VdKYihZ.exe
  2⤵
  PID:10128
- C:\Windows\System\zkLsZak.exe
  C:\Windows\System\zkLsZak.exe
  2⤵
  PID:10180
- C:\Windows\System\lgWqFge.exe
  C:\Windows\System\lgWqFge.exe
  2⤵
  PID:10204
- C:\Windows\System\xPoogNu.exe
  C:\Windows\System\xPoogNu.exe
  2⤵
  PID:9232
- C:\Windows\System\FZoLIAx.exe
  C:\Windows\System\FZoLIAx.exe
  2⤵
  PID:9392
- C:\Windows\System\WcMOkRi.exe
  C:\Windows\System\WcMOkRi.exe
  2⤵
  PID:9636
- C:\Windows\System\JclowWp.exe
  C:\Windows\System\JclowWp.exe
  2⤵
  PID:908
- C:\Windows\System\DdUPkvQ.exe
  C:\Windows\System\DdUPkvQ.exe
  2⤵
  PID:9892
- C:\Windows\System\imzyxRH.exe
  C:\Windows\System\imzyxRH.exe
  2⤵
  PID:10152
- C:\Windows\System\xiUcgvF.exe
  C:\Windows\System\xiUcgvF.exe
  2⤵
  PID:10228
- C:\Windows\System\TbKbBGv.exe
  C:\Windows\System\TbKbBGv.exe
  2⤵
  PID:1416
- C:\Windows\System\ErEoCoF.exe
  C:\Windows\System\ErEoCoF.exe
  2⤵
  PID:60
- C:\Windows\System\xokHrHq.exe
  C:\Windows\System\xokHrHq.exe
  2⤵
  PID:9328
- C:\Windows\System\McnoNmG.exe
  C:\Windows\System\McnoNmG.exe
  2⤵
  PID:8760
- C:\Windows\System\HfwLVzN.exe
  C:\Windows\System\HfwLVzN.exe
  2⤵
  PID:10252
- C:\Windows\System\tbYMikf.exe
  C:\Windows\System\tbYMikf.exe
  2⤵
  PID:10292
- C:\Windows\System\TKfKHfa.exe
  C:\Windows\System\TKfKHfa.exe
  2⤵
  PID:10312
- C:\Windows\System\gBqBXEh.exe
  C:\Windows\System\gBqBXEh.exe
  2⤵
  PID:10340
- C:\Windows\System\FFAZlHy.exe
  C:\Windows\System\FFAZlHy.exe
  2⤵
  PID:10364
- C:\Windows\System\vHpgPke.exe
  C:\Windows\System\vHpgPke.exe
  2⤵
  PID:10388
- C:\Windows\System\FiisgKu.exe
  C:\Windows\System\FiisgKu.exe
  2⤵
  PID:10508
- C:\Windows\System\TzfmMNC.exe
  C:\Windows\System\TzfmMNC.exe
  2⤵
  PID:10524
- C:\Windows\System\MWjOSxJ.exe
  C:\Windows\System\MWjOSxJ.exe
  2⤵
  PID:10544
- C:\Windows\System\mMOGXNs.exe
  C:\Windows\System\mMOGXNs.exe
  2⤵
  PID:10576
- C:\Windows\System\QejwZNh.exe
  C:\Windows\System\QejwZNh.exe
  2⤵
  PID:10592
- C:\Windows\System\hCjFVlU.exe
  C:\Windows\System\hCjFVlU.exe
  2⤵
  PID:10608
- C:\Windows\System\fRbFnha.exe
  C:\Windows\System\fRbFnha.exe
  2⤵
  PID:10624
- C:\Windows\System\omxQlFv.exe
  C:\Windows\System\omxQlFv.exe
  2⤵
  PID:10644
- C:\Windows\System\SLwQSdl.exe
  C:\Windows\System\SLwQSdl.exe
  2⤵
  PID:10664
- C:\Windows\System\LdIFtvm.exe
  C:\Windows\System\LdIFtvm.exe
  2⤵
  PID:10712
- C:\Windows\System\BPMoNIU.exe
  C:\Windows\System\BPMoNIU.exe
  2⤵
  PID:10732
- C:\Windows\System\iLgqJyV.exe
  C:\Windows\System\iLgqJyV.exe
  2⤵
  PID:10844
- C:\Windows\System\aqupBcT.exe
  C:\Windows\System\aqupBcT.exe
  2⤵
  PID:10864
- C:\Windows\System\RFctTAk.exe
  C:\Windows\System\RFctTAk.exe
  2⤵
  PID:10888
- C:\Windows\System\MgTtFhB.exe
  C:\Windows\System\MgTtFhB.exe
  2⤵
  PID:10928
- C:\Windows\System\owXbWmm.exe
  C:\Windows\System\owXbWmm.exe
  2⤵
  PID:10952
- C:\Windows\System\cAyWpAM.exe
  C:\Windows\System\cAyWpAM.exe
  2⤵
  PID:10976
- C:\Windows\System\McofVno.exe
  C:\Windows\System\McofVno.exe
  2⤵
  PID:10996
- C:\Windows\System\ztdNwTq.exe
  C:\Windows\System\ztdNwTq.exe
  2⤵
  PID:11024
- C:\Windows\System\DLRenbZ.exe
  C:\Windows\System\DLRenbZ.exe
  2⤵
  PID:11056
- C:\Windows\System\hNcBDFg.exe
  C:\Windows\System\hNcBDFg.exe
  2⤵
  PID:11076
- C:\Windows\System\HsQMqpA.exe
  C:\Windows\System\HsQMqpA.exe
  2⤵
  PID:11100
- C:\Windows\System\iooHFwk.exe
  C:\Windows\System\iooHFwk.exe
  2⤵
  PID:11116
- C:\Windows\System\YWOHsnK.exe
  C:\Windows\System\YWOHsnK.exe
  2⤵
  PID:11144
- C:\Windows\System\IUHpXlb.exe
  C:\Windows\System\IUHpXlb.exe
  2⤵
  PID:11168
- C:\Windows\System\wNMqBMI.exe
  C:\Windows\System\wNMqBMI.exe
  2⤵
  PID:11208
- C:\Windows\System\mTkrvWc.exe
  C:\Windows\System\mTkrvWc.exe
  2⤵
  PID:11232
- C:\Windows\System\jbQWakb.exe
  C:\Windows\System\jbQWakb.exe
  2⤵
  PID:10276
- C:\Windows\System\aFljLyr.exe
  C:\Windows\System\aFljLyr.exe
  2⤵
  PID:10332
- C:\Windows\System\nXBHqWw.exe
  C:\Windows\System\nXBHqWw.exe
  2⤵
  PID:10416
- C:\Windows\System\KtYyWDY.exe
  C:\Windows\System\KtYyWDY.exe
  2⤵
  PID:10472
- C:\Windows\System\POVMrys.exe
  C:\Windows\System\POVMrys.exe
  2⤵
  PID:10428
- C:\Windows\System\TIsXDEe.exe
  C:\Windows\System\TIsXDEe.exe
  2⤵
  PID:10396
- C:\Windows\System\ZPyhkFw.exe
  C:\Windows\System\ZPyhkFw.exe
  2⤵
  PID:10460
- C:\Windows\System\mFKjFea.exe
  C:\Windows\System\mFKjFea.exe
  2⤵
  PID:10536
- C:\Windows\System\QPnrkZS.exe
  C:\Windows\System\QPnrkZS.exe
  2⤵
  PID:10584
- C:\Windows\System\XYHhXnP.exe
  C:\Windows\System\XYHhXnP.exe
  2⤵
  PID:10704
- C:\Windows\System\KJoLyKB.exe
  C:\Windows\System\KJoLyKB.exe
  2⤵
  PID:10688
- C:\Windows\System\AuxdkiE.exe
  C:\Windows\System\AuxdkiE.exe
  2⤵
  PID:10760
- C:\Windows\System\cntoiQd.exe
  C:\Windows\System\cntoiQd.exe
  2⤵
  PID:10832
- C:\Windows\System\wlkiRYw.exe
  C:\Windows\System\wlkiRYw.exe
  2⤵
  PID:10880
- C:\Windows\System\kIlYhyQ.exe
  C:\Windows\System\kIlYhyQ.exe
  2⤵
  PID:10988
- C:\Windows\System\bXNWdZi.exe
  C:\Windows\System\bXNWdZi.exe
  2⤵
  PID:11132
- C:\Windows\System\VunbKMe.exe
  C:\Windows\System\VunbKMe.exe
  2⤵
  PID:11244
- C:\Windows\System\MEKQrlH.exe
  C:\Windows\System\MEKQrlH.exe
  2⤵
  PID:11216
- C:\Windows\System\aYTqMyP.exe
  C:\Windows\System\aYTqMyP.exe
  2⤵
  PID:10268
- C:\Windows\System\xscmFmm.exe
  C:\Windows\System\xscmFmm.exe
  2⤵
  PID:10356
- C:\Windows\System\FdKvmcm.exe
  C:\Windows\System\FdKvmcm.exe
  2⤵
  PID:10412
- C:\Windows\System\hoJmndC.exe
  C:\Windows\System\hoJmndC.exe
  2⤵
  PID:10572
- C:\Windows\System\nhzukfw.exe
  C:\Windows\System\nhzukfw.exe
  2⤵
  PID:10620
- C:\Windows\System\sRCKNjW.exe
  C:\Windows\System\sRCKNjW.exe
  2⤵
  PID:11004
- C:\Windows\System\qnQMvmN.exe
  C:\Windows\System\qnQMvmN.exe
  2⤵
  PID:10884
- C:\Windows\System\lXdIOdk.exe
  C:\Windows\System\lXdIOdk.exe
  2⤵
  PID:11220
- C:\Windows\System\cKLYyCg.exe
  C:\Windows\System\cKLYyCg.exe
  2⤵
  PID:10384
- C:\Windows\System\BYtjTDB.exe
  C:\Windows\System\BYtjTDB.exe
  2⤵
  PID:10496
- C:\Windows\System\TrjGWJm.exe
  C:\Windows\System\TrjGWJm.exe
  2⤵
  PID:10856
- C:\Windows\System\ZqIHayw.exe
  C:\Windows\System\ZqIHayw.exe
  2⤵
  PID:11228
- C:\Windows\System\DIFYRxN.exe
  C:\Windows\System\DIFYRxN.exe
  2⤵
  PID:11200
- C:\Windows\System\CBqWczQ.exe
  C:\Windows\System\CBqWczQ.exe
  2⤵
  PID:11276
- C:\Windows\System\SdlJjub.exe
  C:\Windows\System\SdlJjub.exe
  2⤵
  PID:11292
- C:\Windows\System\IkDaNCr.exe
  C:\Windows\System\IkDaNCr.exe
  2⤵
  PID:11336
- C:\Windows\System\HoZntYW.exe
  C:\Windows\System\HoZntYW.exe
  2⤵
  PID:11368
- C:\Windows\System\tXxOclm.exe
  C:\Windows\System\tXxOclm.exe
  2⤵
  PID:11400
- C:\Windows\System\RrLferA.exe
  C:\Windows\System\RrLferA.exe
  2⤵
  PID:11420
- C:\Windows\System\NekHVZD.exe
  C:\Windows\System\NekHVZD.exe
  2⤵
  PID:11448
- C:\Windows\System\KLiiFSX.exe
  C:\Windows\System\KLiiFSX.exe
  2⤵
  PID:11468
- C:\Windows\System\IpvCClv.exe
  C:\Windows\System\IpvCClv.exe
  2⤵
  PID:11496
- C:\Windows\System\TOvpcKd.exe
  C:\Windows\System\TOvpcKd.exe
  2⤵
  PID:11520
- C:\Windows\System\CLVXfFR.exe
  C:\Windows\System\CLVXfFR.exe
  2⤵
  PID:11548
- C:\Windows\System\iudXPIu.exe
  C:\Windows\System\iudXPIu.exe
  2⤵
  PID:11584
- C:\Windows\System\QboMqUE.exe
  C:\Windows\System\QboMqUE.exe
  2⤵
  PID:11608
- C:\Windows\System\IsLGFEO.exe
  C:\Windows\System\IsLGFEO.exe
  2⤵
  PID:11636
- C:\Windows\System\jTTNIDw.exe
  C:\Windows\System\jTTNIDw.exe
  2⤵
  PID:11660
- C:\Windows\System\gNTFrmc.exe
  C:\Windows\System\gNTFrmc.exe
  2⤵
  PID:11680
- C:\Windows\System\smgpPuT.exe
  C:\Windows\System\smgpPuT.exe
  2⤵
  PID:11716
- C:\Windows\System\ApVAOhE.exe
  C:\Windows\System\ApVAOhE.exe
  2⤵
  PID:11768
- C:\Windows\System\mAgmAYU.exe
  C:\Windows\System\mAgmAYU.exe
  2⤵
  PID:11792
- C:\Windows\System\HdveGmD.exe
  C:\Windows\System\HdveGmD.exe
  2⤵
  PID:11812
- C:\Windows\System\vgRYZEI.exe
  C:\Windows\System\vgRYZEI.exe
  2⤵
  PID:11832
- C:\Windows\System\VGvgSbq.exe
  C:\Windows\System\VGvgSbq.exe
  2⤵
  PID:11880
- C:\Windows\System\wdUKJoE.exe
  C:\Windows\System\wdUKJoE.exe
  2⤵
  PID:11908
- C:\Windows\System\TcdEfdC.exe
  C:\Windows\System\TcdEfdC.exe
  2⤵
  PID:11928
- C:\Windows\System\WPLGtrU.exe
  C:\Windows\System\WPLGtrU.exe
  2⤵
  PID:11952
- C:\Windows\System\sAAqary.exe
  C:\Windows\System\sAAqary.exe
  2⤵
  PID:11992
- C:\Windows\System\nzBQBbX.exe
  C:\Windows\System\nzBQBbX.exe
  2⤵
  PID:12012
- C:\Windows\System\GzsxKHG.exe
  C:\Windows\System\GzsxKHG.exe
  2⤵
  PID:12036
- C:\Windows\System\tzhHVAQ.exe
  C:\Windows\System\tzhHVAQ.exe
  2⤵
  PID:12052
- C:\Windows\System\jnkpJWR.exe
  C:\Windows\System\jnkpJWR.exe
  2⤵
  PID:12076
- C:\Windows\System\vVrVmNh.exe
  C:\Windows\System\vVrVmNh.exe
  2⤵
  PID:12096
- C:\Windows\System\rXGdehM.exe
  C:\Windows\System\rXGdehM.exe
  2⤵
  PID:12124
- C:\Windows\System\LVMMZHV.exe
  C:\Windows\System\LVMMZHV.exe
  2⤵
  PID:12144
- C:\Windows\System\MHjTJea.exe
  C:\Windows\System\MHjTJea.exe
  2⤵
  PID:12168
- C:\Windows\System\weaBTpn.exe
  C:\Windows\System\weaBTpn.exe
  2⤵
  PID:12220
- C:\Windows\System\NqPcLzt.exe
  C:\Windows\System\NqPcLzt.exe
  2⤵
  PID:12244
- C:\Windows\System\IwLZEJc.exe
  C:\Windows\System\IwLZEJc.exe
  2⤵
  PID:12264
- C:\Windows\System\nSRVUdy.exe
  C:\Windows\System\nSRVUdy.exe
  2⤵
  PID:11328
- C:\Windows\System\fbEnGvm.exe
  C:\Windows\System\fbEnGvm.exe
  2⤵
  PID:11408
- C:\Windows\System\emvvXqA.exe
  C:\Windows\System\emvvXqA.exe
  2⤵
  PID:11504
- C:\Windows\System\lhHvZcV.exe
  C:\Windows\System\lhHvZcV.exe
  2⤵
  PID:11516
- C:\Windows\System\DVOhPbO.exe
  C:\Windows\System\DVOhPbO.exe
  2⤵
  PID:11540
- C:\Windows\System\xKGsqBt.exe
  C:\Windows\System\xKGsqBt.exe
  2⤵
  PID:11628
- C:\Windows\System\TMDpFoZ.exe
  C:\Windows\System\TMDpFoZ.exe
  2⤵
  PID:11708
- C:\Windows\System\SivdJtk.exe
  C:\Windows\System\SivdJtk.exe
  2⤵
  PID:11752
- C:\Windows\System\QSqluRV.exe
  C:\Windows\System\QSqluRV.exe
  2⤵
  PID:11804
- C:\Windows\System\rxmaOfz.exe
  C:\Windows\System\rxmaOfz.exe
  2⤵
  PID:11920
- C:\Windows\System\JOQAYjn.exe
  C:\Windows\System\JOQAYjn.exe
  2⤵
  PID:12004
- C:\Windows\System\zdQZlvc.exe
  C:\Windows\System\zdQZlvc.exe
  2⤵
  PID:12048
- C:\Windows\System\wnVeZuL.exe
  C:\Windows\System\wnVeZuL.exe
  2⤵
  PID:12104
- C:\Windows\System\VGdbNtv.exe
  C:\Windows\System\VGdbNtv.exe
  2⤵
  PID:12204
- C:\Windows\System\vRtBqMj.exe
  C:\Windows\System\vRtBqMj.exe
  2⤵
  PID:12208
- C:\Windows\System\eEtkFaB.exe
  C:\Windows\System\eEtkFaB.exe
  2⤵
  PID:11300
- C:\Windows\System\kGRGhFk.exe
  C:\Windows\System\kGRGhFk.exe
  2⤵
  PID:11288
- C:\Windows\System\WTITRNw.exe
  C:\Windows\System\WTITRNw.exe
  2⤵
  PID:11436
- C:\Windows\System\wVqxVWR.exe
  C:\Windows\System\wVqxVWR.exe
  2⤵
  PID:11760
- C:\Windows\System\CIobqRN.exe
  C:\Windows\System\CIobqRN.exe
  2⤵
  PID:11800
- C:\Windows\System\qIqrCEH.exe
  C:\Windows\System\qIqrCEH.exe
  2⤵
  PID:12120
- C:\Windows\System\njmnsJg.exe
  C:\Windows\System\njmnsJg.exe
  2⤵
  PID:12184
- C:\Windows\System\JLgaEvw.exe
  C:\Windows\System\JLgaEvw.exe
  2⤵
  PID:11484
- C:\Windows\System\RNLUIWf.exe
  C:\Windows\System\RNLUIWf.exe
  2⤵
  PID:10552
- C:\Windows\System\duNggeW.exe
  C:\Windows\System\duNggeW.exe
  2⤵
  PID:11976
- C:\Windows\System\nrzNIWu.exe
  C:\Windows\System\nrzNIWu.exe
  2⤵
  PID:3080
- C:\Windows\System\ljDnbZB.exe
  C:\Windows\System\ljDnbZB.exe
  2⤵
  PID:11488
- C:\Windows\System\UiRddZo.exe
  C:\Windows\System\UiRddZo.exe
  2⤵
  PID:11764
- C:\Windows\System\VThYbnE.exe
  C:\Windows\System\VThYbnE.exe
  2⤵
  PID:12236
- C:\Windows\System\DALpfBG.exe
  C:\Windows\System\DALpfBG.exe
  2⤵
  PID:12304
- C:\Windows\System\kQVyOeu.exe
  C:\Windows\System\kQVyOeu.exe
  2⤵
  PID:12324
- C:\Windows\System\KmooWRq.exe
  C:\Windows\System\KmooWRq.exe
  2⤵
  PID:12344
- C:\Windows\System\BuFSdCh.exe
  C:\Windows\System\BuFSdCh.exe
  2⤵
  PID:12372
- C:\Windows\System\BcBbJIF.exe
  C:\Windows\System\BcBbJIF.exe
  2⤵
  PID:12412
- C:\Windows\System\AShlGDl.exe
  C:\Windows\System\AShlGDl.exe
  2⤵
  PID:12440
- C:\Windows\System\DqgGXRc.exe
  C:\Windows\System\DqgGXRc.exe
  2⤵
  PID:12464
- C:\Windows\System\ZdtnftW.exe
  C:\Windows\System\ZdtnftW.exe
  2⤵
  PID:12484
- C:\Windows\System\vycCDGU.exe
  C:\Windows\System\vycCDGU.exe
  2⤵
  PID:12536
- C:\Windows\System\DfqWYef.exe
  C:\Windows\System\DfqWYef.exe
  2⤵
  PID:12572
- C:\Windows\System\zXnNJym.exe
  C:\Windows\System\zXnNJym.exe
  2⤵
  PID:12612
- C:\Windows\System\blYzhrQ.exe
  C:\Windows\System\blYzhrQ.exe
  2⤵
  PID:12632
- C:\Windows\System\tQMMcPc.exe
  C:\Windows\System\tQMMcPc.exe
  2⤵
  PID:12664
- C:\Windows\System\VAmpTSP.exe
  C:\Windows\System\VAmpTSP.exe
  2⤵
  PID:12680
- C:\Windows\System\abNlRUY.exe
  C:\Windows\System\abNlRUY.exe
  2⤵
  PID:12720
- C:\Windows\System\MkYYCba.exe
  C:\Windows\System\MkYYCba.exe
  2⤵
  PID:12740
- C:\Windows\System\hFqwZAs.exe
  C:\Windows\System\hFqwZAs.exe
  2⤵
  PID:12768
- C:\Windows\System\Gqsvwif.exe
  C:\Windows\System\Gqsvwif.exe
  2⤵
  PID:12796
- C:\Windows\System\CIcFwmY.exe
  C:\Windows\System\CIcFwmY.exe
  2⤵
  PID:12816
- C:\Windows\System\SxvAgPf.exe
  C:\Windows\System\SxvAgPf.exe
  2⤵
  PID:12844
- C:\Windows\System\OmtvVjH.exe
  C:\Windows\System\OmtvVjH.exe
  2⤵
  PID:12872
- C:\Windows\System\RQPmjAl.exe
  C:\Windows\System\RQPmjAl.exe
  2⤵
  PID:12892
- C:\Windows\System\AcJjjXc.exe
  C:\Windows\System\AcJjjXc.exe
  2⤵
  PID:12940
- C:\Windows\System\PTdcULs.exe
  C:\Windows\System\PTdcULs.exe
  2⤵
  PID:12960
- C:\Windows\System\NYLqTyf.exe
  C:\Windows\System\NYLqTyf.exe
  2⤵
  PID:12984
- C:\Windows\System\jyuAhDk.exe
  C:\Windows\System\jyuAhDk.exe
  2⤵
  PID:13000
- C:\Windows\System\tqMdHDg.exe
  C:\Windows\System\tqMdHDg.exe
  2⤵
  PID:13048
- C:\Windows\System\pkXXHix.exe
  C:\Windows\System\pkXXHix.exe
  2⤵
  PID:13072
- C:\Windows\System\LUlGLLD.exe
  C:\Windows\System\LUlGLLD.exe
  2⤵
  PID:13108
- C:\Windows\System\dXwIRbl.exe
  C:\Windows\System\dXwIRbl.exe
  2⤵
  PID:13132
- C:\Windows\System\yJtpswp.exe
  C:\Windows\System\yJtpswp.exe
  2⤵
  PID:13160
- C:\Windows\System\PsQeqSQ.exe
  C:\Windows\System\PsQeqSQ.exe
  2⤵
  PID:13180
- C:\Windows\System\xKgOIJN.exe
  C:\Windows\System\xKgOIJN.exe
  2⤵
  PID:13208
- C:\Windows\System\kibqomZ.exe
  C:\Windows\System\kibqomZ.exe
  2⤵
  PID:13224
- C:\Windows\System\IndSyHd.exe
  C:\Windows\System\IndSyHd.exe
  2⤵
  PID:13248
- C:\Windows\System\BMdqiZJ.exe
  C:\Windows\System\BMdqiZJ.exe
  2⤵
  PID:13304
- C:\Windows\System\MzJAskV.exe
  C:\Windows\System\MzJAskV.exe
  2⤵
  PID:12400
- C:\Windows\System\dklYrcK.exe
  C:\Windows\System\dklYrcK.exe
  2⤵
  PID:12448
- C:\Windows\System\AjYSCHe.exe
  C:\Windows\System\AjYSCHe.exe
  2⤵
  PID:12496
- C:\Windows\System\YtkuCQz.exe
  C:\Windows\System\YtkuCQz.exe
  2⤵
  PID:12548
- C:\Windows\System\VDkfuEs.exe
  C:\Windows\System\VDkfuEs.exe
  2⤵
  PID:12592
- C:\Windows\System\hXJNIVd.exe
  C:\Windows\System\hXJNIVd.exe
  2⤵
  PID:12628
- C:\Windows\System\xoUXSSM.exe
  C:\Windows\System\xoUXSSM.exe
  2⤵
  PID:12692
- C:\Windows\System\qQAyrPD.exe
  C:\Windows\System\qQAyrPD.exe
  2⤵
  PID:12812
- C:\Windows\System\YTSTqdO.exe
  C:\Windows\System\YTSTqdO.exe
  2⤵
  PID:12900
- C:\Windows\System\JCrMgyM.exe
  C:\Windows\System\JCrMgyM.exe
  2⤵
  PID:12956
- C:\Windows\System\XhzrblM.exe
  C:\Windows\System\XhzrblM.exe
  2⤵
  PID:13060
- C:\Windows\System\oAWfenv.exe
  C:\Windows\System\oAWfenv.exe
  2⤵
  PID:13104
- C:\Windows\System\ySNrAqt.exe
  C:\Windows\System\ySNrAqt.exe
  2⤵
  PID:13172
- C:\Windows\System\wetJrmr.exe
  C:\Windows\System\wetJrmr.exe
  2⤵
  PID:13196
- C:\Windows\System\gdPjnBp.exe
  C:\Windows\System\gdPjnBp.exe
  2⤵
  PID:13240
- C:\Windows\System\eJjgpyN.exe
  C:\Windows\System\eJjgpyN.exe
  2⤵
  PID:12380
- C:\Windows\System\kTChibt.exe
  C:\Windows\System\kTChibt.exe
  2⤵
  PID:12480
- C:\Windows\System\DkKVsJn.exe
  C:\Windows\System\DkKVsJn.exe
  2⤵
  PID:12504
- C:\Windows\System\YfyPJgh.exe
  C:\Windows\System\YfyPJgh.exe
  2⤵
  PID:12656
- C:\Windows\System\DXesIsZ.exe
  C:\Windows\System\DXesIsZ.exe
  2⤵
  PID:12784
- C:\Windows\System\lJsgrGd.exe
  C:\Windows\System\lJsgrGd.exe
  2⤵
  PID:13056
- C:\Windows\System\qgPKgfM.exe
  C:\Windows\System\qgPKgfM.exe
  2⤵
  PID:13140
- C:\Windows\System\xyLnBca.exe
  C:\Windows\System\xyLnBca.exe
  2⤵
  PID:12336
- C:\Windows\System\qswuyMw.exe
  C:\Windows\System\qswuyMw.exe
  2⤵
  PID:12524
- C:\Windows\System\ySgVByM.exe
  C:\Windows\System\ySgVByM.exe
  2⤵
  PID:12736
- C:\Windows\System\qxFGGJL.exe
  C:\Windows\System\qxFGGJL.exe
  2⤵
  PID:13036
- C:\Windows\System\lVQnaKP.exe
  C:\Windows\System\lVQnaKP.exe
  2⤵
  PID:13264
- C:\Windows\System\cKPoXLo.exe
  C:\Windows\System\cKPoXLo.exe
  2⤵
  PID:13320
- C:\Windows\System\BfGAjVz.exe
  C:\Windows\System\BfGAjVz.exe
  2⤵
  PID:13360
- C:\Windows\System\OggESLn.exe
  C:\Windows\System\OggESLn.exe
  2⤵
  PID:13392
- C:\Windows\System\xSNAknL.exe
  C:\Windows\System\xSNAknL.exe
  2⤵
  PID:13436
- C:\Windows\System\JQYYVXg.exe
  C:\Windows\System\JQYYVXg.exe
  2⤵
  PID:13464
- C:\Windows\System\eRARYhS.exe
  C:\Windows\System\eRARYhS.exe
  2⤵
  PID:13496
- C:\Windows\System\dLVssKW.exe
  C:\Windows\System\dLVssKW.exe
  2⤵
  PID:13520
- C:\Windows\System\NepNEqS.exe
  C:\Windows\System\NepNEqS.exe
  2⤵
  PID:13540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iv41as3f.4za.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BJsdFHh.exe

Filesize
2.2MB

MD5
4558de5f1b3bdcfc42bdfc74aec7b85e

SHA1
fb2839d47854e79e24b3bb6ccf5bb81c806fb6c5

SHA256
89e0a0e8e8ec1d59b6398bf87800a0f9e73dcd56a5735443aaeee5776ee037ab

SHA512
1029896bc753f345e3226f1103223e81873844b864cbca947df0b6f5e84cdab9de038d30ae3e0d06402baa124ab08f234fc75334f41dd5af81e608f40f584d43

Download Submit
C:\Windows\System\HUSmstH.exe

Filesize
2.2MB

MD5
1393c74f43a3441f700a64abf9eac888

SHA1
f8cc989a0c3f4b85c8f61089f3f11f0e709b610e

SHA256
c9de7504742e3d43568441bf8f1aa75e621de17aa2a0d3180b3e3881e727f751

SHA512
396e7b9d67de3bb06cbc40c40bcf406505883bf5434cafc71fe6c4b9a5d9281b8ea999c1d6e812d2c9c4064c6916ee5e6a0451cccddbcad57a3df511a527d2f4

Download Submit
C:\Windows\System\IkSnaJw.exe

Filesize
2.2MB

MD5
1292224f578e7d7a06542922197193f0

SHA1
e5b930b36d0281c5331dc1d34be4ee18588a0193

SHA256
a77c1959cecce2ecf29383482ed95141c9c07455346cdd0a6d3ed9bfe064276c

SHA512
497ccdaaaab1f0010284d0f55439d664bf80e3d9f474b2ed33512768443da81950ecc66d166335ff33977fa31bd7e62e5b5335c524eccfe0eda85af2e6bcfc46

Download Submit
C:\Windows\System\JPHEoLX.exe

Filesize
2.2MB

MD5
81d20961e99e0f3f6bfa6a8515b72ca9

SHA1
c88cd00c247973f62701711b7301124c36a67c1f

SHA256
7b47a61e987e8757c3dc4331b47365ded0d15b24ca80f260fda91424a67d903d

SHA512
b3f730c1650084bc7fff95c1f290a0724ed74d883e423d860211f433a92406d481b2bda975b21fc2db935138ec9cbad83022e76e54ef4a8af0c995fb0d5d6199

Download Submit
C:\Windows\System\KishkmQ.exe

Filesize
2.2MB

MD5
e753f493f82ce6b40a6600bfa2fab1da

SHA1
e2cc0708c4c591bdfcc4cf99b20f928e3734c8b6

SHA256
e09a6144696186b52a1fa86b21e135402c21201c930d01cf24149888c0584dbd

SHA512
321f75db9e184dec7308de7890556ddac5da8f4f89567ea3122aaa1c6c0bfbedac807c2fa5a0aa2c91097650fffc292a82ef9c1bf10069d723391575aef89960

Download Submit
C:\Windows\System\KpPfQzV.exe

Filesize
2.2MB

MD5
56725ff72565f1bc2ced6d64b504b854

SHA1
b0574cb3c6e22953c2c5a6a05c1b212de75081bd

SHA256
ca409fd549c2c9023c211290318f286ddecbb6841741615c7a51ad8f494cee70

SHA512
9a439551e5345e1659e0fdf3a290596b92170c1c49e1b9ebb5b76dd9bd514637c7bbe5d314a91d10baee69f2613f1cf1a1fd61b4a043dd19a6e064a5eda99708

Download Submit
C:\Windows\System\MwSLfkG.exe

Filesize
2.2MB

MD5
03c050b385cbe9df41dab41c07fb3661

SHA1
f8d3032a617fb3a8f17f8a24012ffe702186187a

SHA256
2dd97af31fec4bcc5ed9fb6b4e31f2a438b7b4a10c79d1ee2e3fb25782d1a2f1

SHA512
e96b647ff8f3b91b756ae2df55f9a72f153a93c1853e415993d6542119d417c6e362fe29995d3da0fe50e5a753b79e9e0c7fcc088489fed696c0a29eb59ff7fb

Download Submit
C:\Windows\System\Nvevjzl.exe

Filesize
2.2MB

MD5
d8b497e9d9760126089771d3b3e1d66c

SHA1
508d0f857f8f2b482037a94da746161b6d4102a2

SHA256
17fc110883858e1b7c7da67740855662b7f708d12f1d169a2d9a41dbb69acebf

SHA512
81a91f36ef473e11fca42faa20b82f563cfd1beaabe98db2878cb6b89609f351fc439932ecf05013a386552dfa0e9b655b7b494f89fedd6e5daabccba0426f28

Download Submit
C:\Windows\System\OYXkeQk.exe

Filesize
2.2MB

MD5
54ba01effcb351c1443c9ffd014caf2f

SHA1
414e2343918fe236b72244fd2cb03301698d16c6

SHA256
4e03d1222698d1c49d8027841e924f71906f80b8a1d92f784ccce14f17f1ff2b

SHA512
4661d576813b98109738f616b6f83da43e76e8f73d3afaef5519988990523fe5077a7805495a1a5b0d74f1a8096c90f1e33fe6c21571d5e5fbeb7baf0c93b3c7

Download Submit
C:\Windows\System\PGRFfky.exe

Filesize
2.2MB

MD5
7a0caccdba5bcd05a231a2fa16b8d2a7

SHA1
da0b5e03a93abf33039afab014bc1f487bd0a6e0

SHA256
aff52b5c594ab34a65593930f0947eac49ba03ee6fbd66ec16997c6a6aaedbce

SHA512
422d6c03462d0070a3895d420ff2021b99c1bc4c88274c4fa370a928f2a39614470ba1c4e4de710df1ad5de3f5197627c4f3e87353c959523c65a9d0018692d8

Download Submit
C:\Windows\System\ROZoAJW.exe

Filesize
2.2MB

MD5
bb0fd8bb57826edbb0bfa5e7b9423114

SHA1
185412ff977618e378e4d279014f9cea37f0f063

SHA256
b4cb5c2a69eb5925cfba928f525a197677507c7ad0b959f13840fd5c9b480cee

SHA512
b63d38fa35701a147acfd70515b1bf7c84dc4953f1bb515c0ae472c344a0aa7a06a27a27bad50eeee1a1153291e1c17a1d10ed9200c0fdf81f022f003680e515

Download Submit
C:\Windows\System\TAhRURY.exe

Filesize
2.2MB

MD5
1d687f4af86303161b75e6f09469ebb0

SHA1
efb19c6f622d09a842d0aa5e5cb44c47b5dcef4a

SHA256
b183e77cf9f52a918f81bc97ec98779ba839701630f3fe27c69e5a7b306742b2

SHA512
fa5e2bae378542b2e96ba0702f6661dcf7c0e91b863bb8581fc46f5ae40572446e3336a5b5942d1d9af623ad119d382510625e7ee1de4990b3d3817c86ad04e9

Download Submit
C:\Windows\System\TduDdNZ.exe

Filesize
2.2MB

MD5
038a2cc482d0853b86f2c5f9f2e0a159

SHA1
8b9c7dfb3683bac29b530d84bc1398c881dba276

SHA256
5ee99906d71b27cad05c9b6fadb9675f4097ee0749c5f4a62bbc7fb8ef483ceb

SHA512
77a12aa12056e6dd8a672978ce9af0035fa561279e1d0c02fe028561bb2f6ad225a78cfdb17944a6c04f484028e734a3d68f92a543e9fd6ed9e3909836f6cc31

Download Submit
C:\Windows\System\TuDzhYF.exe

Filesize
2.2MB

MD5
3b29dd7a603d7cdfb8dc48964ddcffc3

SHA1
3f512de1cb5032a294de79dad572ae1a10005519

SHA256
89efe578a08352e1e4b9e7760187d77e08c6615f02f94aa63b3264c9461cdb9c

SHA512
865ffc74df0b4a7895da6a6f213b6c3637c42ffec96f0c7943534962c7a4fa961e7908de4ec6d32e1fa85e05959cd93906cd1d7d7382e251974f0c4288d165ab

Download Submit
C:\Windows\System\XpIPltu.exe

Filesize
2.2MB

MD5
1b9c48d1829645a2a27eb593a9faabba

SHA1
5a572913ef4193ffe9fea4b8121232301769baac

SHA256
d71821211d6a2201cd678b16ca70ce28913c88f8f0bfa62ecfc60be8cd94bc5b

SHA512
b40f7e485e76a2a16954063254e8a76e04c80dce7ae48945fcf52c9b913e8b52020c592f1c65e899c14e27957c51326e21ffef11f130756008c115b20a0992f7

Download Submit
C:\Windows\System\ZDPPEvl.exe

Filesize
2.2MB

MD5
3acad96e3d2c073f982202c14abedd83

SHA1
377c47a6dc5b13891de25b3a7031a0852469670c

SHA256
73cac458d57551437d7cd2f058f41723159017e4e97ef2c402ee8e8b4e9f8683

SHA512
fa752fea0b211cc88a9608149b5942a1b085bb6cff021bed01048ea2330966d20db9f6709db855736d4f0943d4078d9f1bede6854de89f3fb61da1b246fc2ee7

Download Submit
C:\Windows\System\aIHspxh.exe

Filesize
2.2MB

MD5
9ac248ea22ef1c93c7b727ea6538b51e

SHA1
fbcd2d9aff0a9b88921772a5093b86f3d66738cf

SHA256
2e2e8b3edc44535d4633bd97c76ffaaa9d31241f220a62e1b958d3307e12eeab

SHA512
4c12a00f2520e971408c99201960cf96c9e940886d46870ddba98d103c89e17f7f0f23a4fcfdd7c7b2221076fcd6964333b0a853149fbf97df5f446fc306a536

Download Submit
C:\Windows\System\cKAJsSJ.exe

Filesize
2.2MB

MD5
e9c6b1349fec9594097f8d6b9d825637

SHA1
e6132f6d8c80a60344403c57b44618b55e186e42

SHA256
7c9be8d4198dbfc77127919e727d9e25e7b0680914923def36e4c395135ed72b

SHA512
838ca35262a485e59dae93023044034d1bc7a6e0ecbccb3704cafe7fdf16b8e9340661ecb5ac091cf9854a460c0e7df1d24b72768c63752660d0530ecda76267

Download Submit
C:\Windows\System\erkkoga.exe

Filesize
2.2MB

MD5
f0752715fe6c3b2ac5287af7f9c9825c

SHA1
36cb458fba854d16a6eb3bcee63d4d6599a8da77

SHA256
75d0f39a770ca1711334986c18f59cadb12f2ac58d9089016aa3440e9c112e3b

SHA512
c9279262083b423b4c5154ddb768df3b13640c2ddae54ab9076e7c5ec79ab9d8fa2561e1cf844f4ac362e6eccc333b06c8412b7a409297ab50401dad2f080c40

Download Submit
C:\Windows\System\gacddwX.exe

Filesize
2.2MB

MD5
b92af77fac2785089586bd56e8e0863d

SHA1
9c208e62c4dae6ffb9f21d3e3dc6812a6f34a4ef

SHA256
90030949104c05f49167004120cdf48bc50c922fb19820c7fdebffc0ce40c7db

SHA512
4bbb8d8284940cf329d861fe6dc90ad63d07433d7e1ea78541e73da3c5810e98863b851b897faaf94efa83006c1a808e418263c833e26aea0a94faa0c949a34f

Download Submit
C:\Windows\System\ibzCOPj.exe

Filesize
2.2MB

MD5
ae0381bc407883af96dbe6070e7f875c

SHA1
cc393a95fd0b93937fc7d5ae843ad42a15c92acb

SHA256
38f6b8821fea7838252411a0c91941e9748a4951996a6612b13b2c3122ac8e46

SHA512
9c3dc6127564308df06c82ad3d3f1343eb3ec0a608fd09787b154e6658650b63cc64ca3334d3e3c964a86639d39fceafd549f2624cc1ef4cd116ce800194adbe

Download Submit
C:\Windows\System\jAaYgbD.exe

Filesize
2.2MB

MD5
b020abef3f27902aa0bc6a5a9af2a0a4

SHA1
9d58e5e8bb249ecbb4f94f048bfd63aa0c8843c6

SHA256
23ee563db581cf49064cc23dde84ee7a0f5fa52df94837ed282b81648d954926

SHA512
859b2742bc194d6ccbd6c0fa34fb9dcb21c1927f36753ca44d7218f5034155b06eead647cc3564df0a49eef0f7cbe5e6806787017d3a764668553f9ba78471be

Download Submit
C:\Windows\System\jCNMijz.exe

Filesize
2.2MB

MD5
dc6672aa487023708cbde19ce1bc0d28

SHA1
183a4170be696999a3abe9b9a726813c626b6b29

SHA256
216f5c4a6e0bd715dddb2e08062cbe2b4474bebb658251a3cc3579459ef2b4cd

SHA512
209da84fa2517d56896781feabcfee11bd41009448862931060991615e75d01764cf6e9b7deb04e163fca6e46fc5c75ed8f471652b4e4ed5d47daebb261c15a4

Download Submit
C:\Windows\System\mEDStFn.exe

Filesize
2.2MB

MD5
d553fda7dcc13ab0041792404427d879

SHA1
a65007a0d08b6ffe0c36fd70ac9ae9f94420b746

SHA256
a9d6ef4d07100ba059b2a39d6746ce86739fc3b02b00763341e28f8ea1b294de

SHA512
cac4acb779df7ad9be5639b71a2d2844128138424a209674041461bf9a34039aa041df68eb56cef2f130787e5cd866a9f0baee87b6c8c7e140caf94f681cd5d9

Download Submit
C:\Windows\System\mcsVVGx.exe

Filesize
2.2MB

MD5
07cc1375ca3a02ed16de8681ca94f196

SHA1
f0e8a19c13f9bab3750e8cff284bf7870c682045

SHA256
65992f93ce932e6df3b00ced1099589e0de91fd82afd9b3c2eb1c0195017ca8a

SHA512
39f5516418a1c91503b6ab9393dbb45215433980ca7ae8a445d58b741eb99b1353ba0b072839848894f682938b55045814b3872ecc4391048679e39923ee9075

Download Submit
C:\Windows\System\mimzELt.exe

Filesize
2.2MB

MD5
0cbfeab2a69b702882f3391ee8bc9b60

SHA1
6b2869be9d55bc5a04a61ceb3c1fe7d41038b1d5

SHA256
bd253cbd76040d6a48d6e17e68aaf3070ae633515fd7db0ceda6bcf85be1d8e4

SHA512
a0fbb3745f7d36af3cd3d27d8cfa0b892c6c6da91d8762f0a305f204f183981597c0a90683c3e135711bec34ea329e8dcdff43c6eea36f31f2add762f698c7e2

Download Submit
C:\Windows\System\nEgkHtH.exe

Filesize
2.2MB

MD5
9265f3bd88096fa2948c0c318c46e816

SHA1
d99516077196e1224c4514932e41da85597a9f6d

SHA256
9370cbd7b41161a5fda688412acaa0a07988d615bb3506bbe1008448c9301e27

SHA512
f7ade083c3ba9b831abb9f5a430c8beb3bf3c9aa9ac345a34a9fb03502602e007568fcf8ad13b7697be129f952a1132d1c3069429a99ae33e7cbabf7c16377f7

Download Submit
C:\Windows\System\oJiicFf.exe

Filesize
2.2MB

MD5
81cf2f57a2040a7f172986b724433b05

SHA1
fffb7204aa633ff5ff6c6a7d88c5704fc7c3a013

SHA256
a3ec3f0c589406ccaff42ccc5fef0895e550b40752a7d5c3f0e05904492f4bbd

SHA512
b3706cc5f7d91b297ba0114c8b7ece95d66157dd5eb01d2d196a71086bd9612e3995ae8de7fd178aaf41e277a1691df6a130a951dd2182cf949fb4b744d7d988

Download Submit
C:\Windows\System\rvDJUWz.exe

Filesize
2.2MB

MD5
c117c6e9e75340c7c532a1766dff0ae0

SHA1
940ba956f3b64fb72e924cd35cb7b8a9d795345c

SHA256
91863eeeac0fa5a086482e48e92ee4390955589bf501d11ff45feefc523f540b

SHA512
906a391d6763edbbac2733714e8464677db1c56cfc55ffa442ac62caf003cfcb38253f78e89bb4db249b68ff6f0bc82ef463259cecd2e45e1b24309b3b3e5247

Download Submit
C:\Windows\System\ryTSXpS.exe

Filesize
2.2MB

MD5
644c75a7ebf66769c44e30494036d56e

SHA1
4ba5e18e5e38fa3c90fb32171ca72d41188332a8

SHA256
3fc20d5778918bdcdb52f17c1ed080c915efe1c36b55a8b7e3bbd7fab02c819d

SHA512
66451d880f40b860fbd7e29e38986bbb20d70ce7ec223ac96799e4df4a27d65d73b7011dc324f08c1827210e20fd347144db0dda82c11e0ca8696b62814ad05a

Download Submit
C:\Windows\System\xZarDoa.exe

Filesize
2.2MB

MD5
d61e4946feb8fde24b11e0dd96a47298

SHA1
5b3dec8452c678cb47d420c6b31c2362ebab6bb0

SHA256
e1278c2ac53a4c9917c845bf4e0a45cc3bf75c4ffa44d802f8d4e2873abc36cc

SHA512
f223e2ae725cf31c293aac27c022242d81080ce03cd1d5cbf529357bdb21d55772bdc8261e5b473d6a1a05b2dfb9d3f236245a78c93495c05ae08aa173e35dac

Download Submit
C:\Windows\System\xaxVdyr.exe

Filesize
2.2MB

MD5
b63e0079f0762ce594df9d6d51c4ae5e

SHA1
ce338fd9f41496b97a4e0d43e5f327f6b5834b8a

SHA256
b985bbdc3a54656cbba0911bcbca3698c06da467750606c33b8ea91ecae13a10

SHA512
9b60eb20fc978e3a0e46f3e9f9b08ceeba0ee9e77ebac857c357ef80e709cb13944abf058d2e0a2b0f3e9abdbcc0fbc4fcc1a8f1fc22dfa0c181283220b677e1

Download Submit
C:\Windows\System\zsmfThy.exe

Filesize
2.2MB

MD5
28dfe08bbe7a828b91343d2c0a3e89b5

SHA1
c0b4166eb40e2299cd15bf686c8d884e2720dc3b

SHA256
2e7e0a4ad0946aface5c575c91e24cc7747c8e5ea18bd6c22a6a64e1588643c7

SHA512
4ca7580c99be9a5109acfd434d795820b3b1f24aa5a82f5e40873199a860733d647d84fca3a78f59d7b55db15bc71c620288c504942a63a31417f02ef453873a

Download Submit
memory/556-150-0x00007FF7E5F20000-0x00007FF7E6312000-memory.dmp

Filesize
3.9MB

Download
memory/556-2194-0x00007FF7E5F20000-0x00007FF7E6312000-memory.dmp

Filesize
3.9MB

Download
memory/668-135-0x00007FF714170000-0x00007FF714562000-memory.dmp

Filesize
3.9MB

Download
memory/668-2173-0x00007FF714170000-0x00007FF714562000-memory.dmp

Filesize
3.9MB

Download
memory/1364-2121-0x00007FF639730000-0x00007FF639B22000-memory.dmp

Filesize
3.9MB

Download
memory/1364-74-0x00007FF639730000-0x00007FF639B22000-memory.dmp

Filesize
3.9MB

Download
memory/1380-1185-0x00007FFEF46D0000-0x00007FFEF5191000-memory.dmp

Filesize
10.8MB

Download
memory/1380-835-0x00007FFEF46D0000-0x00007FFEF5191000-memory.dmp

Filesize
10.8MB

Download
memory/1380-27-0x00007FFEF46D0000-0x00007FFEF5191000-memory.dmp

Filesize
10.8MB

Download
memory/1380-29-0x000001DAC4A20000-0x000001DAC4A30000-memory.dmp

Filesize
64KB

Download
memory/1380-28-0x000001DAC4A20000-0x000001DAC4A30000-memory.dmp

Filesize
64KB

Download
memory/1380-32-0x000001DADF1E0000-0x000001DADF202000-memory.dmp

Filesize
136KB

Download
memory/1404-69-0x00007FF772090000-0x00007FF772482000-memory.dmp

Filesize
3.9MB

Download
memory/1404-2114-0x00007FF772090000-0x00007FF772482000-memory.dmp

Filesize
3.9MB

Download
memory/1560-2167-0x00007FF767C30000-0x00007FF768022000-memory.dmp

Filesize
3.9MB

Download
memory/1560-100-0x00007FF767C30000-0x00007FF768022000-memory.dmp

Filesize
3.9MB

Download
memory/1560-2086-0x00007FF767C30000-0x00007FF768022000-memory.dmp

Filesize
3.9MB

Download
memory/1628-75-0x00007FF705140000-0x00007FF705532000-memory.dmp

Filesize
3.9MB

Download
memory/1628-2117-0x00007FF705140000-0x00007FF705532000-memory.dmp

Filesize
3.9MB

Download
memory/2132-2159-0x00007FF670B90000-0x00007FF670F82000-memory.dmp

Filesize
3.9MB

Download
memory/2132-97-0x00007FF670B90000-0x00007FF670F82000-memory.dmp

Filesize
3.9MB

Download
memory/2296-140-0x00007FF69DFA0000-0x00007FF69E392000-memory.dmp

Filesize
3.9MB

Download
memory/2296-2164-0x00007FF69DFA0000-0x00007FF69E392000-memory.dmp

Filesize
3.9MB

Download
memory/3032-81-0x00007FF6A2E00000-0x00007FF6A31F2000-memory.dmp

Filesize
3.9MB

Download
memory/3032-2116-0x00007FF6A2E00000-0x00007FF6A31F2000-memory.dmp

Filesize
3.9MB

Download
memory/3236-132-0x00007FF604D80000-0x00007FF605172000-memory.dmp

Filesize
3.9MB

Download
memory/3236-2162-0x00007FF604D80000-0x00007FF605172000-memory.dmp

Filesize
3.9MB

Download
memory/3328-42-0x00007FF75C620000-0x00007FF75CA12000-memory.dmp

Filesize
3.9MB

Download
memory/3328-2105-0x00007FF75C620000-0x00007FF75CA12000-memory.dmp

Filesize
3.9MB

Download
memory/3404-2064-0x00007FF67EC70000-0x00007FF67F062000-memory.dmp

Filesize
3.9MB

Download
memory/3404-2158-0x00007FF67EC70000-0x00007FF67F062000-memory.dmp

Filesize
3.9MB

Download
memory/3404-90-0x00007FF67EC70000-0x00007FF67F062000-memory.dmp

Filesize
3.9MB

Download
memory/3432-1389-0x00007FF60A3D0000-0x00007FF60A7C2000-memory.dmp

Filesize
3.9MB

Download
memory/3432-1-0x000001CBC46C0000-0x000001CBC46D0000-memory.dmp

Filesize
64KB

Download
memory/3432-0-0x00007FF60A3D0000-0x00007FF60A7C2000-memory.dmp

Filesize
3.9MB

Download
memory/3560-65-0x00007FF6747C0000-0x00007FF674BB2000-memory.dmp

Filesize
3.9MB

Download
memory/3560-2109-0x00007FF6747C0000-0x00007FF674BB2000-memory.dmp

Filesize
3.9MB

Download
memory/3696-120-0x00007FF753D60000-0x00007FF754152000-memory.dmp

Filesize
3.9MB

Download
memory/3696-2169-0x00007FF753D60000-0x00007FF754152000-memory.dmp

Filesize
3.9MB

Download
memory/3696-2099-0x00007FF753D60000-0x00007FF754152000-memory.dmp

Filesize
3.9MB

Download
memory/4040-2120-0x00007FF636170000-0x00007FF636562000-memory.dmp

Filesize
3.9MB

Download
memory/4040-80-0x00007FF636170000-0x00007FF636562000-memory.dmp

Filesize
3.9MB

Download
memory/4188-146-0x00007FF628B30000-0x00007FF628F22000-memory.dmp

Filesize
3.9MB

Download
memory/4188-2171-0x00007FF628B30000-0x00007FF628F22000-memory.dmp

Filesize
3.9MB

Download
memory/4316-34-0x00007FF73CF60000-0x00007FF73D352000-memory.dmp

Filesize
3.9MB

Download
memory/4316-2101-0x00007FF73CF60000-0x00007FF73D352000-memory.dmp

Filesize
3.9MB

Download
memory/4360-2166-0x00007FF6FACD0000-0x00007FF6FB0C2000-memory.dmp

Filesize
3.9MB

Download
memory/4360-111-0x00007FF6FACD0000-0x00007FF6FB0C2000-memory.dmp

Filesize
3.9MB

Download
memory/4360-2087-0x00007FF6FACD0000-0x00007FF6FB0C2000-memory.dmp

Filesize
3.9MB

Download
memory/4416-78-0x00007FF77C190000-0x00007FF77C582000-memory.dmp

Filesize
3.9MB

Download
memory/4416-2103-0x00007FF77C190000-0x00007FF77C582000-memory.dmp

Filesize
3.9MB

Download
memory/4508-79-0x00007FF71E460000-0x00007FF71E852000-memory.dmp

Filesize
3.9MB

Download
memory/4508-2107-0x00007FF71E460000-0x00007FF71E852000-memory.dmp

Filesize
3.9MB

Download
memory/5020-2112-0x00007FF7EA260000-0x00007FF7EA652000-memory.dmp

Filesize
3.9MB

Download
memory/5020-73-0x00007FF7EA260000-0x00007FF7EA652000-memory.dmp

Filesize
3.9MB

Download