xmrig | 3a5e3851835ce40cdd5b8c787427d5ae04f65a41c360b08801b3a64db4cb2264

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 11:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
Size 2.1MB
Sample240427-nkkewsab21
SHA256 3a5e3851835ce40cdd5b8c787427d5ae04f65a41c360b08801b3a64db4cb2264
MD5 0325e277907376a4fd7e53e43d0089fb
SHA1 c476b4fab21b5b75d51aaeed61d1f97ccf55825e
SHA512 94822f63d46d0828f275708ce5c2c022c655721d9a0d6ab6227be3269568df9e8e53afa4715e344cdfbd3cbb5b82779989ae3f5161cd91431d3b26a0214f0d99
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrB:NABC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 39 IoCs

miner

resource	yara_rule
behavioral2/memory/1572-285-0x00007FF786F60000-0x00007FF787352000-memory.dmp	xmrig
behavioral2/memory/3336-297-0x00007FF6DF9A0000-0x00007FF6DFD92000-memory.dmp	xmrig
behavioral2/memory/4996-307-0x00007FF746070000-0x00007FF746462000-memory.dmp	xmrig
behavioral2/memory/3112-312-0x00007FF752080000-0x00007FF752472000-memory.dmp	xmrig
behavioral2/memory/2376-311-0x00007FF70E040000-0x00007FF70E432000-memory.dmp	xmrig
behavioral2/memory/4112-310-0x00007FF6BC890000-0x00007FF6BCC82000-memory.dmp	xmrig
behavioral2/memory/624-308-0x00007FF63FFF0000-0x00007FF6403E2000-memory.dmp	xmrig
behavioral2/memory/3124-305-0x00007FF6A2BE0000-0x00007FF6A2FD2000-memory.dmp	xmrig
behavioral2/memory/5344-303-0x00007FF6174F0000-0x00007FF6178E2000-memory.dmp	xmrig
behavioral2/memory/2452-281-0x00007FF6BA780000-0x00007FF6BAB72000-memory.dmp	xmrig
behavioral2/memory/3928-247-0x00007FF65F820000-0x00007FF65FC12000-memory.dmp	xmrig
behavioral2/memory/2288-194-0x00007FF787800000-0x00007FF787BF2000-memory.dmp	xmrig
behavioral2/memory/2236-193-0x00007FF6BC450000-0x00007FF6BC842000-memory.dmp	xmrig
behavioral2/memory/5724-191-0x00007FF614460000-0x00007FF614852000-memory.dmp	xmrig
behavioral2/memory/5200-168-0x00007FF6B2680000-0x00007FF6B2A72000-memory.dmp	xmrig
behavioral2/memory/4380-137-0x00007FF6D4D70000-0x00007FF6D5162000-memory.dmp	xmrig
behavioral2/memory/552-129-0x00007FF66A8C0000-0x00007FF66ACB2000-memory.dmp	xmrig
behavioral2/memory/4476-128-0x00007FF6120E0000-0x00007FF6124D2000-memory.dmp	xmrig
behavioral2/memory/868-109-0x00007FF6EC7F0000-0x00007FF6ECBE2000-memory.dmp	xmrig
behavioral2/memory/3672-79-0x00007FF74A610000-0x00007FF74AA02000-memory.dmp	xmrig
behavioral2/memory/3120-29-0x00007FF6D63A0000-0x00007FF6D6792000-memory.dmp	xmrig
behavioral2/memory/552-4725-0x00007FF66A8C0000-0x00007FF66ACB2000-memory.dmp	xmrig
behavioral2/memory/4112-4743-0x00007FF6BC890000-0x00007FF6BCC82000-memory.dmp	xmrig
behavioral2/memory/3124-4802-0x00007FF6A2BE0000-0x00007FF6A2FD2000-memory.dmp	xmrig
behavioral2/memory/5344-4818-0x00007FF6174F0000-0x00007FF6178E2000-memory.dmp	xmrig
behavioral2/memory/3112-4814-0x00007FF752080000-0x00007FF752472000-memory.dmp	xmrig
behavioral2/memory/2376-4811-0x00007FF70E040000-0x00007FF70E432000-memory.dmp	xmrig
behavioral2/memory/4996-4819-0x00007FF746070000-0x00007FF746462000-memory.dmp	xmrig
behavioral2/memory/3336-4815-0x00007FF6DF9A0000-0x00007FF6DFD92000-memory.dmp	xmrig
behavioral2/memory/1572-4799-0x00007FF786F60000-0x00007FF787352000-memory.dmp	xmrig
behavioral2/memory/2452-4797-0x00007FF6BA780000-0x00007FF6BAB72000-memory.dmp	xmrig
behavioral2/memory/3928-4783-0x00007FF65F820000-0x00007FF65FC12000-memory.dmp	xmrig
behavioral2/memory/2288-4773-0x00007FF787800000-0x00007FF787BF2000-memory.dmp	xmrig
behavioral2/memory/4476-4765-0x00007FF6120E0000-0x00007FF6124D2000-memory.dmp	xmrig
behavioral2/memory/2236-4761-0x00007FF6BC450000-0x00007FF6BC842000-memory.dmp	xmrig
behavioral2/memory/5724-4752-0x00007FF614460000-0x00007FF614852000-memory.dmp	xmrig
behavioral2/memory/5200-4749-0x00007FF6B2680000-0x00007FF6B2A72000-memory.dmp	xmrig
behavioral2/memory/3672-4746-0x00007FF74A610000-0x00007FF74AA02000-memory.dmp	xmrig
behavioral2/memory/1484-5060-0x00007FF6883C0000-0x00007FF6887B2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3120	jzVnduM.exe
624	WOwGXWc.exe
3672	RTpaEcp.exe
868	agsMzaQ.exe
4112	BFQoaqb.exe
4476	fjyBiou.exe
552	UOAyssj.exe
4380	NxzLUvM.exe
5200	KpbDCsA.exe
5724	iuMMWjW.exe
2236	mpROhnO.exe
2288	XcLkOKh.exe
3928	DSLPosC.exe
2452	GkYiiAt.exe
2376	KnJLjdd.exe
3112	CNGEmBh.exe
1572	IXAxfdu.exe
3336	jjkrgIM.exe
5344	PByXVJu.exe
3124	cVHxEBI.exe
4996	rbWbcSY.exe
1488	XHgonDD.exe
5400	gunSbSA.exe
2588	XhBkwGB.exe
4920	zOesOZN.exe
3680	edeQeKp.exe
1548	OoFAspt.exe
5604	DYDsgGL.exe
5640	oYwVSZj.exe
4980	UbamQud.exe
5636	EyJljGj.exe
2332	ZaDfVgD.exe
5168	DnXzcHj.exe
1620	UUDREOV.exe
5004	ATApzBq.exe
1236	WPjkAXg.exe
2284	aIPgnXM.exe
4784	fMRwHYv.exe
5356	UKCeNXx.exe
4948	PkmeatE.exe
4156	qCJWUMM.exe
3540	BuLWWdR.exe
264	PeGtYgm.exe
3292	ticrWrS.exe
3108	UbXXkCl.exe
3200	TAUTKlV.exe
3564	WuPxdAf.exe
1900	BdTJBef.exe
2896	JcYpjBU.exe
4320	cgiUvcW.exe
5816	DBZTJJg.exe
4480	rMBdNjK.exe
6020	AIHpbXb.exe
6084	SiXgtrM.exe
5256	DCcoxkt.exe
2520	XEomARa.exe
2036	zBeazTL.exe
3368	FfimKCl.exe
1100	kXJaiWn.exe
5328	WuwhpUL.exe
2276	jucEjnv.exe
5756	XDPRuiZ.exe
5360	DcNYzNv.exe
4444	bbvKjVy.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1484-0-0x00007FF6883C0000-0x00007FF6887B2000-memory.dmp	upx
behavioral2/files/0x000a000000023b8e-31.dat	upx
behavioral2/files/0x000a000000023b93-40.dat	upx
behavioral2/files/0x000a000000023b95-54.dat	upx
behavioral2/files/0x000a000000023b96-84.dat	upx
behavioral2/files/0x000a000000023b9a-113.dat	upx
behavioral2/files/0x000a000000023ba0-141.dat	upx
behavioral2/files/0x000a000000023baa-178.dat	upx
behavioral2/memory/1572-285-0x00007FF786F60000-0x00007FF787352000-memory.dmp	upx
behavioral2/memory/3336-297-0x00007FF6DF9A0000-0x00007FF6DFD92000-memory.dmp	upx
behavioral2/memory/4996-307-0x00007FF746070000-0x00007FF746462000-memory.dmp	upx
behavioral2/memory/3112-312-0x00007FF752080000-0x00007FF752472000-memory.dmp	upx
behavioral2/memory/2376-311-0x00007FF70E040000-0x00007FF70E432000-memory.dmp	upx
behavioral2/memory/4112-310-0x00007FF6BC890000-0x00007FF6BCC82000-memory.dmp	upx
behavioral2/memory/624-308-0x00007FF63FFF0000-0x00007FF6403E2000-memory.dmp	upx
behavioral2/memory/3124-305-0x00007FF6A2BE0000-0x00007FF6A2FD2000-memory.dmp	upx
behavioral2/memory/5344-303-0x00007FF6174F0000-0x00007FF6178E2000-memory.dmp	upx
behavioral2/memory/2452-281-0x00007FF6BA780000-0x00007FF6BAB72000-memory.dmp	upx
behavioral2/memory/3928-247-0x00007FF65F820000-0x00007FF65FC12000-memory.dmp	upx
behavioral2/memory/2288-194-0x00007FF787800000-0x00007FF787BF2000-memory.dmp	upx
behavioral2/memory/2236-193-0x00007FF6BC450000-0x00007FF6BC842000-memory.dmp	upx
behavioral2/memory/5724-191-0x00007FF614460000-0x00007FF614852000-memory.dmp	upx
behavioral2/files/0x000a000000023bac-190.dat	upx
behavioral2/files/0x000a000000023bab-189.dat	upx
behavioral2/files/0x000a000000023ba9-177.dat	upx
behavioral2/files/0x000a000000023ba8-176.dat	upx
behavioral2/files/0x000a000000023ba7-175.dat	upx
behavioral2/files/0x000a000000023ba5-174.dat	upx
behavioral2/files/0x000b000000023b88-171.dat	upx
behavioral2/memory/5200-168-0x00007FF6B2680000-0x00007FF6B2A72000-memory.dmp	upx
behavioral2/files/0x000a000000023ba6-162.dat	upx
behavioral2/files/0x000a000000023ba4-158.dat	upx
behavioral2/files/0x000a000000023ba3-157.dat	upx
behavioral2/files/0x000a000000023ba2-153.dat	upx
behavioral2/files/0x000a000000023ba1-148.dat	upx
behavioral2/memory/4380-137-0x00007FF6D4D70000-0x00007FF6D5162000-memory.dmp	upx
behavioral2/files/0x000a000000023b99-135.dat	upx
behavioral2/files/0x000a000000023b9c-131.dat	upx
behavioral2/files/0x000a000000023b9f-140.dat	upx
behavioral2/memory/552-129-0x00007FF66A8C0000-0x00007FF66ACB2000-memory.dmp	upx
behavioral2/memory/4476-128-0x00007FF6120E0000-0x00007FF6124D2000-memory.dmp	upx
behavioral2/files/0x000a000000023b98-122.dat	upx
behavioral2/files/0x000a000000023b9b-116.dat	upx
behavioral2/memory/868-109-0x00007FF6EC7F0000-0x00007FF6ECBE2000-memory.dmp	upx
behavioral2/files/0x000a000000023b9d-133.dat	upx
behavioral2/files/0x000a000000023b9e-104.dat	upx
behavioral2/files/0x000a000000023b97-103.dat	upx
behavioral2/memory/3672-79-0x00007FF74A610000-0x00007FF74AA02000-memory.dmp	upx
behavioral2/files/0x000a000000023b8f-71.dat	upx
behavioral2/files/0x000a000000023b94-68.dat	upx
behavioral2/files/0x000a000000023b90-61.dat	upx
behavioral2/files/0x000a000000023b8b-56.dat	upx
behavioral2/files/0x000a000000023b92-51.dat	upx
behavioral2/files/0x000a000000023b91-46.dat	upx
behavioral2/files/0x000a000000023b8d-26.dat	upx
behavioral2/files/0x000a000000023b8c-20.dat	upx
behavioral2/files/0x000b000000023b87-12.dat	upx
behavioral2/memory/3120-29-0x00007FF6D63A0000-0x00007FF6D6792000-memory.dmp	upx
behavioral2/memory/552-4725-0x00007FF66A8C0000-0x00007FF66ACB2000-memory.dmp	upx
behavioral2/memory/4112-4743-0x00007FF6BC890000-0x00007FF6BCC82000-memory.dmp	upx
behavioral2/memory/3124-4802-0x00007FF6A2BE0000-0x00007FF6A2FD2000-memory.dmp	upx
behavioral2/memory/5344-4818-0x00007FF6174F0000-0x00007FF6178E2000-memory.dmp	upx
behavioral2/memory/3112-4814-0x00007FF752080000-0x00007FF752472000-memory.dmp	upx
behavioral2/memory/2376-4811-0x00007FF70E040000-0x00007FF70E432000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\XHkfpWd.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\WoJgaKA.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\nweyLtw.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\VfVtQPr.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\WvpEniM.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\PnSSVuo.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\PXrqrcV.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\QIJrcxG.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\saJzzIV.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\pnyHVZk.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\bWOFLAw.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\vNfbPAV.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\BfIhCDa.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\GUlzQeI.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\gZagiAW.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\ikNsSbk.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\iuMMWjW.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\xqBMGyI.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\odeCVOP.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\UwjmcVR.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\wHaoEKd.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\ZRruzOg.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\kjRrKha.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\lowYakZ.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\ARtdULa.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\xkGZEGX.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\iVrSyCf.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\cnqrnSs.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\WMMcUBN.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\ihDSYVc.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\SpJZTpH.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\adqJgHn.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\Loofzag.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\pwzgJUk.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\GkElpBU.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\ZCzPxqQ.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\SkAhYUs.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\tHFTjdg.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\hOrORdr.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\tndObjQ.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\BSWHgQR.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\QwdSKHJ.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\BRKULVo.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\GoJikKV.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\mTHsyTu.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\qhPBENT.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\HQsARKO.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\duQxoMS.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\OOLcenO.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\HVmRXBk.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\Vxlxqfx.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\izCFmxG.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\RrwQmHa.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\wHzzuIS.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\CQGKhyg.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\vMiBSUf.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\KZNBzLf.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\eEQDOfy.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\KRSAaLx.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\nfFwldh.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\DnWrIhe.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\EHrQhJc.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\SkUKOXi.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
File created	C:\Windows\System\XGKLAIN.exe	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1052	powershell.exe
1052	powershell.exe
1052	powershell.exe
1052	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1052	powershell.exe
Token: SeLockMemoryPrivilege	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1484 wrote to memory of 1052	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	86
PID 1484 wrote to memory of 1052	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	86
PID 1484 wrote to memory of 3120	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	87
PID 1484 wrote to memory of 3120	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	87
PID 1484 wrote to memory of 3672	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	88
PID 1484 wrote to memory of 3672	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	88
PID 1484 wrote to memory of 624	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	89
PID 1484 wrote to memory of 624	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	89
PID 1484 wrote to memory of 868	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	90
PID 1484 wrote to memory of 868	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	90
PID 1484 wrote to memory of 4112	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	91
PID 1484 wrote to memory of 4112	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	91
PID 1484 wrote to memory of 4476	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	92
PID 1484 wrote to memory of 4476	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	92
PID 1484 wrote to memory of 5724	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	93
PID 1484 wrote to memory of 5724	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	93
PID 1484 wrote to memory of 552	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	94
PID 1484 wrote to memory of 552	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	94
PID 1484 wrote to memory of 4380	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	95
PID 1484 wrote to memory of 4380	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	95
PID 1484 wrote to memory of 5200	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	96
PID 1484 wrote to memory of 5200	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	96
PID 1484 wrote to memory of 2236	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	97
PID 1484 wrote to memory of 2236	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	97
PID 1484 wrote to memory of 2288	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	98
PID 1484 wrote to memory of 2288	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	98
PID 1484 wrote to memory of 3928	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	99
PID 1484 wrote to memory of 3928	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	99
PID 1484 wrote to memory of 2452	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	100
PID 1484 wrote to memory of 2452	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	100
PID 1484 wrote to memory of 2376	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	101
PID 1484 wrote to memory of 2376	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	101
PID 1484 wrote to memory of 4996	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	102
PID 1484 wrote to memory of 4996	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	102
PID 1484 wrote to memory of 3112	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	103
PID 1484 wrote to memory of 3112	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	103
PID 1484 wrote to memory of 1572	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	104
PID 1484 wrote to memory of 1572	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	104
PID 1484 wrote to memory of 3336	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	105
PID 1484 wrote to memory of 3336	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	105
PID 1484 wrote to memory of 5344	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	106
PID 1484 wrote to memory of 5344	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	106
PID 1484 wrote to memory of 3124	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	107
PID 1484 wrote to memory of 3124	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	107
PID 1484 wrote to memory of 1488	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	108
PID 1484 wrote to memory of 1488	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	108
PID 1484 wrote to memory of 5400	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	109
PID 1484 wrote to memory of 5400	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	109
PID 1484 wrote to memory of 2588	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	110
PID 1484 wrote to memory of 2588	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	110
PID 1484 wrote to memory of 4920	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	111
PID 1484 wrote to memory of 4920	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	111
PID 1484 wrote to memory of 3680	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	112
PID 1484 wrote to memory of 3680	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	112
PID 1484 wrote to memory of 1548	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	113
PID 1484 wrote to memory of 1548	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	113
PID 1484 wrote to memory of 5604	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	114
PID 1484 wrote to memory of 5604	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	114
PID 1484 wrote to memory of 5640	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	115
PID 1484 wrote to memory of 5640	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	115
PID 1484 wrote to memory of 4980	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	116
PID 1484 wrote to memory of 4980	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	116
PID 1484 wrote to memory of 5636	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	117
PID 1484 wrote to memory of 5636	1484	0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe	117

C:\Users\Admin\AppData\Local\Temp\0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0325e277907376a4fd7e53e43d0089fb_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1052
- C:\Windows\System\jzVnduM.exe
  C:\Windows\System\jzVnduM.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\RTpaEcp.exe
  C:\Windows\System\RTpaEcp.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\WOwGXWc.exe
  C:\Windows\System\WOwGXWc.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\agsMzaQ.exe
  C:\Windows\System\agsMzaQ.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\BFQoaqb.exe
  C:\Windows\System\BFQoaqb.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\fjyBiou.exe
  C:\Windows\System\fjyBiou.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\iuMMWjW.exe
  C:\Windows\System\iuMMWjW.exe
  2⤵
  - Executes dropped EXE
  PID:5724
- C:\Windows\System\UOAyssj.exe
  C:\Windows\System\UOAyssj.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\NxzLUvM.exe
  C:\Windows\System\NxzLUvM.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\KpbDCsA.exe
  C:\Windows\System\KpbDCsA.exe
  2⤵
  - Executes dropped EXE
  PID:5200
- C:\Windows\System\mpROhnO.exe
  C:\Windows\System\mpROhnO.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\XcLkOKh.exe
  C:\Windows\System\XcLkOKh.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\DSLPosC.exe
  C:\Windows\System\DSLPosC.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\GkYiiAt.exe
  C:\Windows\System\GkYiiAt.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\KnJLjdd.exe
  C:\Windows\System\KnJLjdd.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\rbWbcSY.exe
  C:\Windows\System\rbWbcSY.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\CNGEmBh.exe
  C:\Windows\System\CNGEmBh.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\IXAxfdu.exe
  C:\Windows\System\IXAxfdu.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\jjkrgIM.exe
  C:\Windows\System\jjkrgIM.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\PByXVJu.exe
  C:\Windows\System\PByXVJu.exe
  2⤵
  - Executes dropped EXE
  PID:5344
- C:\Windows\System\cVHxEBI.exe
  C:\Windows\System\cVHxEBI.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\XHgonDD.exe
  C:\Windows\System\XHgonDD.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\gunSbSA.exe
  C:\Windows\System\gunSbSA.exe
  2⤵
  - Executes dropped EXE
  PID:5400
- C:\Windows\System\XhBkwGB.exe
  C:\Windows\System\XhBkwGB.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\zOesOZN.exe
  C:\Windows\System\zOesOZN.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\edeQeKp.exe
  C:\Windows\System\edeQeKp.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System\OoFAspt.exe
  C:\Windows\System\OoFAspt.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\DYDsgGL.exe
  C:\Windows\System\DYDsgGL.exe
  2⤵
  - Executes dropped EXE
  PID:5604
- C:\Windows\System\oYwVSZj.exe
  C:\Windows\System\oYwVSZj.exe
  2⤵
  - Executes dropped EXE
  PID:5640
- C:\Windows\System\UbamQud.exe
  C:\Windows\System\UbamQud.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\EyJljGj.exe
  C:\Windows\System\EyJljGj.exe
  2⤵
  - Executes dropped EXE
  PID:5636
- C:\Windows\System\ZaDfVgD.exe
  C:\Windows\System\ZaDfVgD.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\DnXzcHj.exe
  C:\Windows\System\DnXzcHj.exe
  2⤵
  - Executes dropped EXE
  PID:5168
- C:\Windows\System\UUDREOV.exe
  C:\Windows\System\UUDREOV.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\ATApzBq.exe
  C:\Windows\System\ATApzBq.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\WPjkAXg.exe
  C:\Windows\System\WPjkAXg.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\aIPgnXM.exe
  C:\Windows\System\aIPgnXM.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\fMRwHYv.exe
  C:\Windows\System\fMRwHYv.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\UKCeNXx.exe
  C:\Windows\System\UKCeNXx.exe
  2⤵
  - Executes dropped EXE
  PID:5356
- C:\Windows\System\PkmeatE.exe
  C:\Windows\System\PkmeatE.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\qCJWUMM.exe
  C:\Windows\System\qCJWUMM.exe
  2⤵
  - Executes dropped EXE
  PID:4156
- C:\Windows\System\BuLWWdR.exe
  C:\Windows\System\BuLWWdR.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\PeGtYgm.exe
  C:\Windows\System\PeGtYgm.exe
  2⤵
  - Executes dropped EXE
  PID:264
- C:\Windows\System\ticrWrS.exe
  C:\Windows\System\ticrWrS.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\UbXXkCl.exe
  C:\Windows\System\UbXXkCl.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\TAUTKlV.exe
  C:\Windows\System\TAUTKlV.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\WuPxdAf.exe
  C:\Windows\System\WuPxdAf.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\BdTJBef.exe
  C:\Windows\System\BdTJBef.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\JcYpjBU.exe
  C:\Windows\System\JcYpjBU.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\cgiUvcW.exe
  C:\Windows\System\cgiUvcW.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\DBZTJJg.exe
  C:\Windows\System\DBZTJJg.exe
  2⤵
  - Executes dropped EXE
  PID:5816
- C:\Windows\System\rMBdNjK.exe
  C:\Windows\System\rMBdNjK.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\AIHpbXb.exe
  C:\Windows\System\AIHpbXb.exe
  2⤵
  - Executes dropped EXE
  PID:6020
- C:\Windows\System\SiXgtrM.exe
  C:\Windows\System\SiXgtrM.exe
  2⤵
  - Executes dropped EXE
  PID:6084
- C:\Windows\System\kKTiNPZ.exe
  C:\Windows\System\kKTiNPZ.exe
  2⤵
  PID:3924
- C:\Windows\System\DCcoxkt.exe
  C:\Windows\System\DCcoxkt.exe
  2⤵
  - Executes dropped EXE
  PID:5256
- C:\Windows\System\XEomARa.exe
  C:\Windows\System\XEomARa.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\zBeazTL.exe
  C:\Windows\System\zBeazTL.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\FfimKCl.exe
  C:\Windows\System\FfimKCl.exe
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Windows\System\kXJaiWn.exe
  C:\Windows\System\kXJaiWn.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\WuwhpUL.exe
  C:\Windows\System\WuwhpUL.exe
  2⤵
  - Executes dropped EXE
  PID:5328
- C:\Windows\System\jucEjnv.exe
  C:\Windows\System\jucEjnv.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\XDPRuiZ.exe
  C:\Windows\System\XDPRuiZ.exe
  2⤵
  - Executes dropped EXE
  PID:5756
- C:\Windows\System\DcNYzNv.exe
  C:\Windows\System\DcNYzNv.exe
  2⤵
  - Executes dropped EXE
  PID:5360
- C:\Windows\System\bbvKjVy.exe
  C:\Windows\System\bbvKjVy.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\aCXaVra.exe
  C:\Windows\System\aCXaVra.exe
  2⤵
  PID:3128
- C:\Windows\System\mBMZoIq.exe
  C:\Windows\System\mBMZoIq.exe
  2⤵
  PID:6112
- C:\Windows\System\lYKyFVM.exe
  C:\Windows\System\lYKyFVM.exe
  2⤵
  PID:1152
- C:\Windows\System\SclhgrO.exe
  C:\Windows\System\SclhgrO.exe
  2⤵
  PID:6088
- C:\Windows\System\qjNCslh.exe
  C:\Windows\System\qjNCslh.exe
  2⤵
  PID:1604
- C:\Windows\System\hYKuins.exe
  C:\Windows\System\hYKuins.exe
  2⤵
  PID:1588
- C:\Windows\System\jIkRpfU.exe
  C:\Windows\System\jIkRpfU.exe
  2⤵
  PID:5652
- C:\Windows\System\yqwkZMu.exe
  C:\Windows\System\yqwkZMu.exe
  2⤵
  PID:4720
- C:\Windows\System\laMYgTB.exe
  C:\Windows\System\laMYgTB.exe
  2⤵
  PID:4308
- C:\Windows\System\HnzpJni.exe
  C:\Windows\System\HnzpJni.exe
  2⤵
  PID:5188
- C:\Windows\System\MdtbpPe.exe
  C:\Windows\System\MdtbpPe.exe
  2⤵
  PID:1968
- C:\Windows\System\nSYcEcJ.exe
  C:\Windows\System\nSYcEcJ.exe
  2⤵
  PID:3392
- C:\Windows\System\kEWAiXf.exe
  C:\Windows\System\kEWAiXf.exe
  2⤵
  PID:384
- C:\Windows\System\sRYBJWQ.exe
  C:\Windows\System\sRYBJWQ.exe
  2⤵
  PID:780
- C:\Windows\System\hZiYDKs.exe
  C:\Windows\System\hZiYDKs.exe
  2⤵
  PID:3416
- C:\Windows\System\yUNHZBp.exe
  C:\Windows\System\yUNHZBp.exe
  2⤵
  PID:1976
- C:\Windows\System\hgHLpoJ.exe
  C:\Windows\System\hgHLpoJ.exe
  2⤵
  PID:1612
- C:\Windows\System\qzYfxAz.exe
  C:\Windows\System\qzYfxAz.exe
  2⤵
  PID:4832
- C:\Windows\System\MfTkDBp.exe
  C:\Windows\System\MfTkDBp.exe
  2⤵
  PID:4400
- C:\Windows\System\YuJLLmZ.exe
  C:\Windows\System\YuJLLmZ.exe
  2⤵
  PID:992
- C:\Windows\System\eCQpFWQ.exe
  C:\Windows\System\eCQpFWQ.exe
  2⤵
  PID:4860
- C:\Windows\System\sikRsJA.exe
  C:\Windows\System\sikRsJA.exe
  2⤵
  PID:4120
- C:\Windows\System\DwvRmBw.exe
  C:\Windows\System\DwvRmBw.exe
  2⤵
  PID:4904
- C:\Windows\System\FEdNhNC.exe
  C:\Windows\System\FEdNhNC.exe
  2⤵
  PID:5668
- C:\Windows\System\vOyojum.exe
  C:\Windows\System\vOyojum.exe
  2⤵
  PID:2708
- C:\Windows\System\lgSnWTU.exe
  C:\Windows\System\lgSnWTU.exe
  2⤵
  PID:4588
- C:\Windows\System\NiEQJHe.exe
  C:\Windows\System\NiEQJHe.exe
  2⤵
  PID:6136
- C:\Windows\System\BzjYDJl.exe
  C:\Windows\System\BzjYDJl.exe
  2⤵
  PID:5276
- C:\Windows\System\AnOIqcJ.exe
  C:\Windows\System\AnOIqcJ.exe
  2⤵
  PID:1876
- C:\Windows\System\aIyjtqA.exe
  C:\Windows\System\aIyjtqA.exe
  2⤵
  PID:6012
- C:\Windows\System\LxHpQkg.exe
  C:\Windows\System\LxHpQkg.exe
  2⤵
  PID:2268
- C:\Windows\System\NtOEyID.exe
  C:\Windows\System\NtOEyID.exe
  2⤵
  PID:3920
- C:\Windows\System\fFuAuYV.exe
  C:\Windows\System\fFuAuYV.exe
  2⤵
  PID:4084
- C:\Windows\System\YpuvNyc.exe
  C:\Windows\System\YpuvNyc.exe
  2⤵
  PID:5252
- C:\Windows\System\zwKwqNA.exe
  C:\Windows\System\zwKwqNA.exe
  2⤵
  PID:2232
- C:\Windows\System\gwfOsdY.exe
  C:\Windows\System\gwfOsdY.exe
  2⤵
  PID:1712
- C:\Windows\System\QgtzZXs.exe
  C:\Windows\System\QgtzZXs.exe
  2⤵
  PID:5016
- C:\Windows\System\IQLMaTO.exe
  C:\Windows\System\IQLMaTO.exe
  2⤵
  PID:4536
- C:\Windows\System\Zcpzjvk.exe
  C:\Windows\System\Zcpzjvk.exe
  2⤵
  PID:3460
- C:\Windows\System\fnNCiSG.exe
  C:\Windows\System\fnNCiSG.exe
  2⤵
  PID:5456
- C:\Windows\System\SUTwUpj.exe
  C:\Windows\System\SUTwUpj.exe
  2⤵
  PID:3024
- C:\Windows\System\xogReeT.exe
  C:\Windows\System\xogReeT.exe
  2⤵
  PID:768
- C:\Windows\System\eqCWfki.exe
  C:\Windows\System\eqCWfki.exe
  2⤵
  PID:1644
- C:\Windows\System\PmiWEJL.exe
  C:\Windows\System\PmiWEJL.exe
  2⤵
  PID:2200
- C:\Windows\System\qTZsbPW.exe
  C:\Windows\System\qTZsbPW.exe
  2⤵
  PID:5840
- C:\Windows\System\OlAFqrM.exe
  C:\Windows\System\OlAFqrM.exe
  2⤵
  PID:2412
- C:\Windows\System\hruSOzw.exe
  C:\Windows\System\hruSOzw.exe
  2⤵
  PID:6116
- C:\Windows\System\MxYlZEq.exe
  C:\Windows\System\MxYlZEq.exe
  2⤵
  PID:1868
- C:\Windows\System\ALvNuGw.exe
  C:\Windows\System\ALvNuGw.exe
  2⤵
  PID:1944
- C:\Windows\System\eLHdmYh.exe
  C:\Windows\System\eLHdmYh.exe
  2⤵
  PID:4916
- C:\Windows\System\uKzPqhz.exe
  C:\Windows\System\uKzPqhz.exe
  2⤵
  PID:3452
- C:\Windows\System\dltQkho.exe
  C:\Windows\System\dltQkho.exe
  2⤵
  PID:4888
- C:\Windows\System\DaAPDgS.exe
  C:\Windows\System\DaAPDgS.exe
  2⤵
  PID:3872
- C:\Windows\System\pBWwImt.exe
  C:\Windows\System\pBWwImt.exe
  2⤵
  PID:4952
- C:\Windows\System\WYoAgen.exe
  C:\Windows\System\WYoAgen.exe
  2⤵
  PID:5240
- C:\Windows\System\yGaWgib.exe
  C:\Windows\System\yGaWgib.exe
  2⤵
  PID:6100
- C:\Windows\System\BWmzqcZ.exe
  C:\Windows\System\BWmzqcZ.exe
  2⤵
  PID:4652
- C:\Windows\System\xMbNfhp.exe
  C:\Windows\System\xMbNfhp.exe
  2⤵
  PID:4936
- C:\Windows\System\XwFNNLm.exe
  C:\Windows\System\XwFNNLm.exe
  2⤵
  PID:2964
- C:\Windows\System\imBLPLf.exe
  C:\Windows\System\imBLPLf.exe
  2⤵
  PID:6124
- C:\Windows\System\XqnqnJH.exe
  C:\Windows\System\XqnqnJH.exe
  2⤵
  PID:5264
- C:\Windows\System\ECZsXTI.exe
  C:\Windows\System\ECZsXTI.exe
  2⤵
  PID:4808
- C:\Windows\System\yztLAqa.exe
  C:\Windows\System\yztLAqa.exe
  2⤵
  PID:3244
- C:\Windows\System\bROgUbl.exe
  C:\Windows\System\bROgUbl.exe
  2⤵
  PID:872
- C:\Windows\System\ZkffnYx.exe
  C:\Windows\System\ZkffnYx.exe
  2⤵
  PID:4448
- C:\Windows\System\dxUuyHu.exe
  C:\Windows\System\dxUuyHu.exe
  2⤵
  PID:4492
- C:\Windows\System\AauArRm.exe
  C:\Windows\System\AauArRm.exe
  2⤵
  PID:2804
- C:\Windows\System\dXKTDGG.exe
  C:\Windows\System\dXKTDGG.exe
  2⤵
  PID:1564
- C:\Windows\System\pAqidOP.exe
  C:\Windows\System\pAqidOP.exe
  2⤵
  PID:3360
- C:\Windows\System\FxKrpgQ.exe
  C:\Windows\System\FxKrpgQ.exe
  2⤵
  PID:6108
- C:\Windows\System\dmktwoG.exe
  C:\Windows\System\dmktwoG.exe
  2⤵
  PID:6104
- C:\Windows\System\oWfoUNo.exe
  C:\Windows\System\oWfoUNo.exe
  2⤵
  PID:5032
- C:\Windows\System\jENecck.exe
  C:\Windows\System\jENecck.exe
  2⤵
  PID:1676
- C:\Windows\System\GEYCiWI.exe
  C:\Windows\System\GEYCiWI.exe
  2⤵
  PID:2144
- C:\Windows\System\mIamHNG.exe
  C:\Windows\System\mIamHNG.exe
  2⤵
  PID:1276
- C:\Windows\System\SHhZNWS.exe
  C:\Windows\System\SHhZNWS.exe
  2⤵
  PID:5852
- C:\Windows\System\IuBIxus.exe
  C:\Windows\System\IuBIxus.exe
  2⤵
  PID:4396
- C:\Windows\System\OlpOIbn.exe
  C:\Windows\System\OlpOIbn.exe
  2⤵
  PID:1764
- C:\Windows\System\VPNrupm.exe
  C:\Windows\System\VPNrupm.exe
  2⤵
  PID:3268
- C:\Windows\System\jqilOiF.exe
  C:\Windows\System\jqilOiF.exe
  2⤵
  PID:5848
- C:\Windows\System\QRSKBKK.exe
  C:\Windows\System\QRSKBKK.exe
  2⤵
  PID:2304
- C:\Windows\System\HGEXhGv.exe
  C:\Windows\System\HGEXhGv.exe
  2⤵
  PID:2028
- C:\Windows\System\BWajyYY.exe
  C:\Windows\System\BWajyYY.exe
  2⤵
  PID:3592
- C:\Windows\System\PSfbuNO.exe
  C:\Windows\System\PSfbuNO.exe
  2⤵
  PID:3644
- C:\Windows\System\ljTFLFo.exe
  C:\Windows\System\ljTFLFo.exe
  2⤵
  PID:3556
- C:\Windows\System\pnyHVZk.exe
  C:\Windows\System\pnyHVZk.exe
  2⤵
  PID:1680
- C:\Windows\System\RoRbOro.exe
  C:\Windows\System\RoRbOro.exe
  2⤵
  PID:2960
- C:\Windows\System\oVrqamH.exe
  C:\Windows\System\oVrqamH.exe
  2⤵
  PID:4056
- C:\Windows\System\SqupUNU.exe
  C:\Windows\System\SqupUNU.exe
  2⤵
  PID:2364
- C:\Windows\System\epyHBQd.exe
  C:\Windows\System\epyHBQd.exe
  2⤵
  PID:3900
- C:\Windows\System\Qtznhwd.exe
  C:\Windows\System\Qtznhwd.exe
  2⤵
  PID:5208
- C:\Windows\System\whehlDU.exe
  C:\Windows\System\whehlDU.exe
  2⤵
  PID:5424
- C:\Windows\System\YyEGCmN.exe
  C:\Windows\System\YyEGCmN.exe
  2⤵
  PID:4468
- C:\Windows\System\ZgBABhc.exe
  C:\Windows\System\ZgBABhc.exe
  2⤵
  PID:5012
- C:\Windows\System\zwrIrKw.exe
  C:\Windows\System\zwrIrKw.exe
  2⤵
  PID:5452
- C:\Windows\System\kMuXKgr.exe
  C:\Windows\System\kMuXKgr.exe
  2⤵
  PID:4736
- C:\Windows\System\llNchAv.exe
  C:\Windows\System\llNchAv.exe
  2⤵
  PID:4960
- C:\Windows\System\KWgODkG.exe
  C:\Windows\System\KWgODkG.exe
  2⤵
  PID:3296
- C:\Windows\System\QLWDXCR.exe
  C:\Windows\System\QLWDXCR.exe
  2⤵
  PID:5148
- C:\Windows\System\kXkNlSJ.exe
  C:\Windows\System\kXkNlSJ.exe
  2⤵
  PID:2872
- C:\Windows\System\GzvJhKw.exe
  C:\Windows\System\GzvJhKw.exe
  2⤵
  PID:6120
- C:\Windows\System\oMNViYb.exe
  C:\Windows\System\oMNViYb.exe
  2⤵
  PID:5568
- C:\Windows\System\vEqBSHF.exe
  C:\Windows\System\vEqBSHF.exe
  2⤵
  PID:6160
- C:\Windows\System\tpHVLrY.exe
  C:\Windows\System\tpHVLrY.exe
  2⤵
  PID:6176
- C:\Windows\System\hCQqqrX.exe
  C:\Windows\System\hCQqqrX.exe
  2⤵
  PID:6208
- C:\Windows\System\GpdPNmt.exe
  C:\Windows\System\GpdPNmt.exe
  2⤵
  PID:6224
- C:\Windows\System\kspseqx.exe
  C:\Windows\System\kspseqx.exe
  2⤵
  PID:6248
- C:\Windows\System\JEBaNiH.exe
  C:\Windows\System\JEBaNiH.exe
  2⤵
  PID:6276
- C:\Windows\System\ZAzVTWv.exe
  C:\Windows\System\ZAzVTWv.exe
  2⤵
  PID:6296
- C:\Windows\System\DGavdaY.exe
  C:\Windows\System\DGavdaY.exe
  2⤵
  PID:6316
- C:\Windows\System\CVpRnrO.exe
  C:\Windows\System\CVpRnrO.exe
  2⤵
  PID:6348
- C:\Windows\System\rMaBFrY.exe
  C:\Windows\System\rMaBFrY.exe
  2⤵
  PID:6372
- C:\Windows\System\fOMvevU.exe
  C:\Windows\System\fOMvevU.exe
  2⤵
  PID:6396
- C:\Windows\System\Tgxsnll.exe
  C:\Windows\System\Tgxsnll.exe
  2⤵
  PID:6416
- C:\Windows\System\WDnXhHb.exe
  C:\Windows\System\WDnXhHb.exe
  2⤵
  PID:6448
- C:\Windows\System\hpmgVVj.exe
  C:\Windows\System\hpmgVVj.exe
  2⤵
  PID:6464
- C:\Windows\System\JYIEQRs.exe
  C:\Windows\System\JYIEQRs.exe
  2⤵
  PID:6496
- C:\Windows\System\SVHaWOl.exe
  C:\Windows\System\SVHaWOl.exe
  2⤵
  PID:6516
- C:\Windows\System\QGrYEvL.exe
  C:\Windows\System\QGrYEvL.exe
  2⤵
  PID:6540
- C:\Windows\System\hhWOWqn.exe
  C:\Windows\System\hhWOWqn.exe
  2⤵
  PID:6560
- C:\Windows\System\KLtUqoA.exe
  C:\Windows\System\KLtUqoA.exe
  2⤵
  PID:6588
- C:\Windows\System\YlbCcvT.exe
  C:\Windows\System\YlbCcvT.exe
  2⤵
  PID:6608
- C:\Windows\System\GyuQFQx.exe
  C:\Windows\System\GyuQFQx.exe
  2⤵
  PID:6624
- C:\Windows\System\ArOilRp.exe
  C:\Windows\System\ArOilRp.exe
  2⤵
  PID:6660
- C:\Windows\System\sjoTNLj.exe
  C:\Windows\System\sjoTNLj.exe
  2⤵
  PID:6680
- C:\Windows\System\RbkizYm.exe
  C:\Windows\System\RbkizYm.exe
  2⤵
  PID:6704
- C:\Windows\System\HStPxZG.exe
  C:\Windows\System\HStPxZG.exe
  2⤵
  PID:6724
- C:\Windows\System\xCDdHOO.exe
  C:\Windows\System\xCDdHOO.exe
  2⤵
  PID:6748
- C:\Windows\System\eIodGnS.exe
  C:\Windows\System\eIodGnS.exe
  2⤵
  PID:6768
- C:\Windows\System\fYcrcZY.exe
  C:\Windows\System\fYcrcZY.exe
  2⤵
  PID:6792
- C:\Windows\System\kmaIvdt.exe
  C:\Windows\System\kmaIvdt.exe
  2⤵
  PID:6808
- C:\Windows\System\ePabLUo.exe
  C:\Windows\System\ePabLUo.exe
  2⤵
  PID:6832
- C:\Windows\System\podOlkJ.exe
  C:\Windows\System\podOlkJ.exe
  2⤵
  PID:6852
- C:\Windows\System\ycDUSoF.exe
  C:\Windows\System\ycDUSoF.exe
  2⤵
  PID:6872
- C:\Windows\System\SkUKOXi.exe
  C:\Windows\System\SkUKOXi.exe
  2⤵
  PID:6896
- C:\Windows\System\uQMuDTF.exe
  C:\Windows\System\uQMuDTF.exe
  2⤵
  PID:6924
- C:\Windows\System\EuFZsPU.exe
  C:\Windows\System\EuFZsPU.exe
  2⤵
  PID:6940
- C:\Windows\System\kWtYjEz.exe
  C:\Windows\System\kWtYjEz.exe
  2⤵
  PID:6968
- C:\Windows\System\ItAAUPt.exe
  C:\Windows\System\ItAAUPt.exe
  2⤵
  PID:6988
- C:\Windows\System\nvWcyWN.exe
  C:\Windows\System\nvWcyWN.exe
  2⤵
  PID:7012
- C:\Windows\System\nmekmpM.exe
  C:\Windows\System\nmekmpM.exe
  2⤵
  PID:7044
- C:\Windows\System\SUEqDsZ.exe
  C:\Windows\System\SUEqDsZ.exe
  2⤵
  PID:7064
- C:\Windows\System\MJbSNiJ.exe
  C:\Windows\System\MJbSNiJ.exe
  2⤵
  PID:7092
- C:\Windows\System\sOpRufJ.exe
  C:\Windows\System\sOpRufJ.exe
  2⤵
  PID:7108
- C:\Windows\System\WOAjdlJ.exe
  C:\Windows\System\WOAjdlJ.exe
  2⤵
  PID:7128
- C:\Windows\System\MWUdrqZ.exe
  C:\Windows\System\MWUdrqZ.exe
  2⤵
  PID:7152
- C:\Windows\System\LgWJVoS.exe
  C:\Windows\System\LgWJVoS.exe
  2⤵
  PID:4604
- C:\Windows\System\EScAieu.exe
  C:\Windows\System\EScAieu.exe
  2⤵
  PID:3952
- C:\Windows\System\ZWfwvQj.exe
  C:\Windows\System\ZWfwvQj.exe
  2⤵
  PID:5268
- C:\Windows\System\DjOgEZL.exe
  C:\Windows\System\DjOgEZL.exe
  2⤵
  PID:3408
- C:\Windows\System\HQqfaun.exe
  C:\Windows\System\HQqfaun.exe
  2⤵
  PID:2968
- C:\Windows\System\DXStarE.exe
  C:\Windows\System\DXStarE.exe
  2⤵
  PID:1128
- C:\Windows\System\oPFYvVE.exe
  C:\Windows\System\oPFYvVE.exe
  2⤵
  PID:6256
- C:\Windows\System\WWmMIrb.exe
  C:\Windows\System\WWmMIrb.exe
  2⤵
  PID:6332
- C:\Windows\System\zjHFvxf.exe
  C:\Windows\System\zjHFvxf.exe
  2⤵
  PID:5376
- C:\Windows\System\yIFeMkd.exe
  C:\Windows\System\yIFeMkd.exe
  2⤵
  PID:3320
- C:\Windows\System\xKfjpUI.exe
  C:\Windows\System\xKfjpUI.exe
  2⤵
  PID:4488
- C:\Windows\System\EORHQQc.exe
  C:\Windows\System\EORHQQc.exe
  2⤵
  PID:5488
- C:\Windows\System\ugjNDOg.exe
  C:\Windows\System\ugjNDOg.exe
  2⤵
  PID:6388
- C:\Windows\System\guECgRX.exe
  C:\Windows\System\guECgRX.exe
  2⤵
  PID:2792
- C:\Windows\System\SXLQYSi.exe
  C:\Windows\System\SXLQYSi.exe
  2⤵
  PID:6172
- C:\Windows\System\jsxeFJT.exe
  C:\Windows\System\jsxeFJT.exe
  2⤵
  PID:6220
- C:\Windows\System\ecsBWwZ.exe
  C:\Windows\System\ecsBWwZ.exe
  2⤵
  PID:6556
- C:\Windows\System\nGMFbIw.exe
  C:\Windows\System\nGMFbIw.exe
  2⤵
  PID:6288
- C:\Windows\System\QDHGIWX.exe
  C:\Windows\System\QDHGIWX.exe
  2⤵
  PID:6580
- C:\Windows\System\ZqRFhRj.exe
  C:\Windows\System\ZqRFhRj.exe
  2⤵
  PID:6620
- C:\Windows\System\GkElpBU.exe
  C:\Windows\System\GkElpBU.exe
  2⤵
  PID:7120
- C:\Windows\System\LSarrxJ.exe
  C:\Windows\System\LSarrxJ.exe
  2⤵
  PID:7072
- C:\Windows\System\DUEesrA.exe
  C:\Windows\System\DUEesrA.exe
  2⤵
  PID:6700
- C:\Windows\System\qjdlIQN.exe
  C:\Windows\System\qjdlIQN.exe
  2⤵
  PID:7192
- C:\Windows\System\KgSpYgF.exe
  C:\Windows\System\KgSpYgF.exe
  2⤵
  PID:7208
- C:\Windows\System\ljTQXxs.exe
  C:\Windows\System\ljTQXxs.exe
  2⤵
  PID:7232
- C:\Windows\System\hnvkSFb.exe
  C:\Windows\System\hnvkSFb.exe
  2⤵
  PID:7260
- C:\Windows\System\BOZtqqg.exe
  C:\Windows\System\BOZtqqg.exe
  2⤵
  PID:7280
- C:\Windows\System\nHYRhxL.exe
  C:\Windows\System\nHYRhxL.exe
  2⤵
  PID:7300
- C:\Windows\System\jBBnUel.exe
  C:\Windows\System\jBBnUel.exe
  2⤵
  PID:7324
- C:\Windows\System\AdQmOpm.exe
  C:\Windows\System\AdQmOpm.exe
  2⤵
  PID:7348
- C:\Windows\System\uyKtRUq.exe
  C:\Windows\System\uyKtRUq.exe
  2⤵
  PID:7372
- C:\Windows\System\WOEnDAn.exe
  C:\Windows\System\WOEnDAn.exe
  2⤵
  PID:7396
- C:\Windows\System\smzqrnL.exe
  C:\Windows\System\smzqrnL.exe
  2⤵
  PID:7412
- C:\Windows\System\ThhtnSa.exe
  C:\Windows\System\ThhtnSa.exe
  2⤵
  PID:7440
- C:\Windows\System\YACuKGE.exe
  C:\Windows\System\YACuKGE.exe
  2⤵
  PID:7460
- C:\Windows\System\JknSQqE.exe
  C:\Windows\System\JknSQqE.exe
  2⤵
  PID:7476
- C:\Windows\System\UbIOEzY.exe
  C:\Windows\System\UbIOEzY.exe
  2⤵
  PID:7504
- C:\Windows\System\ugYTfNM.exe
  C:\Windows\System\ugYTfNM.exe
  2⤵
  PID:7524
- C:\Windows\System\JCqsZXC.exe
  C:\Windows\System\JCqsZXC.exe
  2⤵
  PID:7544
- C:\Windows\System\tnBCJVz.exe
  C:\Windows\System\tnBCJVz.exe
  2⤵
  PID:7568
- C:\Windows\System\CkOZkAt.exe
  C:\Windows\System\CkOZkAt.exe
  2⤵
  PID:7588
- C:\Windows\System\pbOYtRG.exe
  C:\Windows\System\pbOYtRG.exe
  2⤵
  PID:7608
- C:\Windows\System\zPdgFWI.exe
  C:\Windows\System\zPdgFWI.exe
  2⤵
  PID:7636
- C:\Windows\System\TlJsrOn.exe
  C:\Windows\System\TlJsrOn.exe
  2⤵
  PID:7656
- C:\Windows\System\HYmlJtw.exe
  C:\Windows\System\HYmlJtw.exe
  2⤵
  PID:7680
- C:\Windows\System\CPIdaQI.exe
  C:\Windows\System\CPIdaQI.exe
  2⤵
  PID:7700
- C:\Windows\System\bcDyLMb.exe
  C:\Windows\System\bcDyLMb.exe
  2⤵
  PID:7724
- C:\Windows\System\EhNQNof.exe
  C:\Windows\System\EhNQNof.exe
  2⤵
  PID:7748
- C:\Windows\System\zCmcrrE.exe
  C:\Windows\System\zCmcrrE.exe
  2⤵
  PID:7772
- C:\Windows\System\SVxIPlf.exe
  C:\Windows\System\SVxIPlf.exe
  2⤵
  PID:7792
- C:\Windows\System\vuyryNx.exe
  C:\Windows\System\vuyryNx.exe
  2⤵
  PID:7812
- C:\Windows\System\VezUKBI.exe
  C:\Windows\System\VezUKBI.exe
  2⤵
  PID:7836
- C:\Windows\System\RweETBa.exe
  C:\Windows\System\RweETBa.exe
  2⤵
  PID:7864
- C:\Windows\System\TwcZJsW.exe
  C:\Windows\System\TwcZJsW.exe
  2⤵
  PID:7880
- C:\Windows\System\lESntPA.exe
  C:\Windows\System\lESntPA.exe
  2⤵
  PID:7900
- C:\Windows\System\GQbAflE.exe
  C:\Windows\System\GQbAflE.exe
  2⤵
  PID:7924
- C:\Windows\System\zUiBAMR.exe
  C:\Windows\System\zUiBAMR.exe
  2⤵
  PID:7948
- C:\Windows\System\wgFgDQM.exe
  C:\Windows\System\wgFgDQM.exe
  2⤵
  PID:7964
- C:\Windows\System\yJFZISz.exe
  C:\Windows\System\yJFZISz.exe
  2⤵
  PID:7980
- C:\Windows\System\WDOCOYC.exe
  C:\Windows\System\WDOCOYC.exe
  2⤵
  PID:8008
- C:\Windows\System\SMxucQA.exe
  C:\Windows\System\SMxucQA.exe
  2⤵
  PID:8028
- C:\Windows\System\PHqRlXe.exe
  C:\Windows\System\PHqRlXe.exe
  2⤵
  PID:8052
- C:\Windows\System\vNHYlAF.exe
  C:\Windows\System\vNHYlAF.exe
  2⤵
  PID:8080
- C:\Windows\System\qAYyaEs.exe
  C:\Windows\System\qAYyaEs.exe
  2⤵
  PID:8108
- C:\Windows\System\szJuqNf.exe
  C:\Windows\System\szJuqNf.exe
  2⤵
  PID:8128
- C:\Windows\System\iMdKaUb.exe
  C:\Windows\System\iMdKaUb.exe
  2⤵
  PID:8148
- C:\Windows\System\JpbYdoO.exe
  C:\Windows\System\JpbYdoO.exe
  2⤵
  PID:8172
- C:\Windows\System\qUsLGQf.exe
  C:\Windows\System\qUsLGQf.exe
  2⤵
  PID:6688
- C:\Windows\System\HMaYUDw.exe
  C:\Windows\System\HMaYUDw.exe
  2⤵
  PID:6776
- C:\Windows\System\VMfbCkV.exe
  C:\Windows\System\VMfbCkV.exe
  2⤵
  PID:6800
- C:\Windows\System\YTdKMvn.exe
  C:\Windows\System\YTdKMvn.exe
  2⤵
  PID:6844
- C:\Windows\System\jTpfged.exe
  C:\Windows\System\jTpfged.exe
  2⤵
  PID:856
- C:\Windows\System\Xjjwvys.exe
  C:\Windows\System\Xjjwvys.exe
  2⤵
  PID:6644
- C:\Windows\System\TlNSHqX.exe
  C:\Windows\System\TlNSHqX.exe
  2⤵
  PID:7104
- C:\Windows\System\RqXKqwo.exe
  C:\Windows\System\RqXKqwo.exe
  2⤵
  PID:6744
- C:\Windows\System\rHabnpD.exe
  C:\Windows\System\rHabnpD.exe
  2⤵
  PID:7244
- C:\Windows\System\kRgQlaW.exe
  C:\Windows\System\kRgQlaW.exe
  2⤵
  PID:7296
- C:\Windows\System\yERGoeT.exe
  C:\Windows\System\yERGoeT.exe
  2⤵
  PID:2668
- C:\Windows\System\jSOjFop.exe
  C:\Windows\System\jSOjFop.exe
  2⤵
  PID:6240
- C:\Windows\System\dDHWEmN.exe
  C:\Windows\System\dDHWEmN.exe
  2⤵
  PID:6892
- C:\Windows\System\ZSAnqNt.exe
  C:\Windows\System\ZSAnqNt.exe
  2⤵
  PID:4336
- C:\Windows\System\HuESBRn.exe
  C:\Windows\System\HuESBRn.exe
  2⤵
  PID:7388
- C:\Windows\System\emHUWFf.exe
  C:\Windows\System\emHUWFf.exe
  2⤵
  PID:3624
- C:\Windows\System\ZoVSJOk.exe
  C:\Windows\System\ZoVSJOk.exe
  2⤵
  PID:6980
- C:\Windows\System\eKvpBTe.exe
  C:\Windows\System\eKvpBTe.exe
  2⤵
  PID:7644
- C:\Windows\System\nOjbLFP.exe
  C:\Windows\System\nOjbLFP.exe
  2⤵
  PID:4148
- C:\Windows\System\shSZcQb.exe
  C:\Windows\System\shSZcQb.exe
  2⤵
  PID:7140
- C:\Windows\System\VaYaozQ.exe
  C:\Windows\System\VaYaozQ.exe
  2⤵
  PID:7908
- C:\Windows\System\tClzOCv.exe
  C:\Windows\System\tClzOCv.exe
  2⤵
  PID:7200
- C:\Windows\System\ioNDAtj.exe
  C:\Windows\System\ioNDAtj.exe
  2⤵
  PID:6156
- C:\Windows\System\XcjSTdI.exe
  C:\Windows\System\XcjSTdI.exe
  2⤵
  PID:6328
- C:\Windows\System\eKCafVM.exe
  C:\Windows\System\eKCafVM.exe
  2⤵
  PID:6168
- C:\Windows\System\DUuNadL.exe
  C:\Windows\System\DUuNadL.exe
  2⤵
  PID:8212
- C:\Windows\System\oQfKPKp.exe
  C:\Windows\System\oQfKPKp.exe
  2⤵
  PID:8232
- C:\Windows\System\FkzKTek.exe
  C:\Windows\System\FkzKTek.exe
  2⤵
  PID:8256
- C:\Windows\System\vLHufez.exe
  C:\Windows\System\vLHufez.exe
  2⤵
  PID:8276
- C:\Windows\System\BiAESbZ.exe
  C:\Windows\System\BiAESbZ.exe
  2⤵
  PID:8300
- C:\Windows\System\OPvFKED.exe
  C:\Windows\System\OPvFKED.exe
  2⤵
  PID:8336
- C:\Windows\System\qFCmtNX.exe
  C:\Windows\System\qFCmtNX.exe
  2⤵
  PID:8352
- C:\Windows\System\ISpVVGD.exe
  C:\Windows\System\ISpVVGD.exe
  2⤵
  PID:8376
- C:\Windows\System\JCsEYEU.exe
  C:\Windows\System\JCsEYEU.exe
  2⤵
  PID:8400
- C:\Windows\System\oJfTMVW.exe
  C:\Windows\System\oJfTMVW.exe
  2⤵
  PID:8420
- C:\Windows\System\BrKKwRf.exe
  C:\Windows\System\BrKKwRf.exe
  2⤵
  PID:8440
- C:\Windows\System\BuuTDWx.exe
  C:\Windows\System\BuuTDWx.exe
  2⤵
  PID:8456
- C:\Windows\System\aZiWMGi.exe
  C:\Windows\System\aZiWMGi.exe
  2⤵
  PID:8488
- C:\Windows\System\btifMbx.exe
  C:\Windows\System\btifMbx.exe
  2⤵
  PID:8508
- C:\Windows\System\NAAAKnJ.exe
  C:\Windows\System\NAAAKnJ.exe
  2⤵
  PID:8528
- C:\Windows\System\GBkaCCn.exe
  C:\Windows\System\GBkaCCn.exe
  2⤵
  PID:8548
- C:\Windows\System\pFehlBx.exe
  C:\Windows\System\pFehlBx.exe
  2⤵
  PID:8564
- C:\Windows\System\lKvFGEz.exe
  C:\Windows\System\lKvFGEz.exe
  2⤵
  PID:8584
- C:\Windows\System\mkaVayQ.exe
  C:\Windows\System\mkaVayQ.exe
  2⤵
  PID:8608
- C:\Windows\System\FdpzqIA.exe
  C:\Windows\System\FdpzqIA.exe
  2⤵
  PID:8632
- C:\Windows\System\GKmiMdJ.exe
  C:\Windows\System\GKmiMdJ.exe
  2⤵
  PID:8652
- C:\Windows\System\ThfifKA.exe
  C:\Windows\System\ThfifKA.exe
  2⤵
  PID:8684
- C:\Windows\System\cNXOBuZ.exe
  C:\Windows\System\cNXOBuZ.exe
  2⤵
  PID:8700
- C:\Windows\System\jYpfKUr.exe
  C:\Windows\System\jYpfKUr.exe
  2⤵
  PID:8720
- C:\Windows\System\UjaxLfz.exe
  C:\Windows\System\UjaxLfz.exe
  2⤵
  PID:8740
- C:\Windows\System\FKsOeve.exe
  C:\Windows\System\FKsOeve.exe
  2⤵
  PID:8764
- C:\Windows\System\lGiPbQG.exe
  C:\Windows\System\lGiPbQG.exe
  2⤵
  PID:8784
- C:\Windows\System\aKYIhQj.exe
  C:\Windows\System\aKYIhQj.exe
  2⤵
  PID:8808
- C:\Windows\System\mhZOjYT.exe
  C:\Windows\System\mhZOjYT.exe
  2⤵
  PID:8828
- C:\Windows\System\xoWKxLQ.exe
  C:\Windows\System\xoWKxLQ.exe
  2⤵
  PID:8852
- C:\Windows\System\iHHPboU.exe
  C:\Windows\System\iHHPboU.exe
  2⤵
  PID:8880
- C:\Windows\System\aKkMCRJ.exe
  C:\Windows\System\aKkMCRJ.exe
  2⤵
  PID:8900
- C:\Windows\System\hIilZhz.exe
  C:\Windows\System\hIilZhz.exe
  2⤵
  PID:8916
- C:\Windows\System\jVATjTg.exe
  C:\Windows\System\jVATjTg.exe
  2⤵
  PID:8932
- C:\Windows\System\UlCUEpD.exe
  C:\Windows\System\UlCUEpD.exe
  2⤵
  PID:8956
- C:\Windows\System\FSgbeQB.exe
  C:\Windows\System\FSgbeQB.exe
  2⤵
  PID:8980
- C:\Windows\System\XYNtrOS.exe
  C:\Windows\System\XYNtrOS.exe
  2⤵
  PID:9004
- C:\Windows\System\LLwQbzS.exe
  C:\Windows\System\LLwQbzS.exe
  2⤵
  PID:9032
- C:\Windows\System\QIOYhkd.exe
  C:\Windows\System\QIOYhkd.exe
  2⤵
  PID:9052
- C:\Windows\System\JtscLAV.exe
  C:\Windows\System\JtscLAV.exe
  2⤵
  PID:9080
- C:\Windows\System\QHVyGoH.exe
  C:\Windows\System\QHVyGoH.exe
  2⤵
  PID:9100
- C:\Windows\System\FRmQZtM.exe
  C:\Windows\System\FRmQZtM.exe
  2⤵
  PID:9128
- C:\Windows\System\qkwdoWp.exe
  C:\Windows\System\qkwdoWp.exe
  2⤵
  PID:9148
- C:\Windows\System\oBxIzIj.exe
  C:\Windows\System\oBxIzIj.exe
  2⤵
  PID:9172
- C:\Windows\System\euwEXPA.exe
  C:\Windows\System\euwEXPA.exe
  2⤵
  PID:9196
- C:\Windows\System\laTJUUa.exe
  C:\Windows\System\laTJUUa.exe
  2⤵
  PID:8184
- C:\Windows\System\xEmcKwP.exe
  C:\Windows\System\xEmcKwP.exe
  2⤵
  PID:6524
- C:\Windows\System\jTRRwtb.exe
  C:\Windows\System\jTRRwtb.exe
  2⤵
  PID:7004
- C:\Windows\System\pfBBFYR.exe
  C:\Windows\System\pfBBFYR.exe
  2⤵
  PID:6204
- C:\Windows\System\QxTNcgJ.exe
  C:\Windows\System\QxTNcgJ.exe
  2⤵
  PID:7556
- C:\Windows\System\ZLDJMYJ.exe
  C:\Windows\System\ZLDJMYJ.exe
  2⤵
  PID:7580
- C:\Windows\System\IdkuUEI.exe
  C:\Windows\System\IdkuUEI.exe
  2⤵
  PID:6880
- C:\Windows\System\xCXBhsn.exe
  C:\Windows\System\xCXBhsn.exe
  2⤵
  PID:7832
- C:\Windows\System\vzPNhly.exe
  C:\Windows\System\vzPNhly.exe
  2⤵
  PID:7596
- C:\Windows\System\ApSKGKq.exe
  C:\Windows\System\ApSKGKq.exe
  2⤵
  PID:7172
- C:\Windows\System\acxflAu.exe
  C:\Windows\System\acxflAu.exe
  2⤵
  PID:7936
- C:\Windows\System\iHyFiBK.exe
  C:\Windows\System\iHyFiBK.exe
  2⤵
  PID:8020
- C:\Windows\System\PQCtfmj.exe
  C:\Windows\System\PQCtfmj.exe
  2⤵
  PID:8092
- C:\Windows\System\YgCJpDC.exe
  C:\Windows\System\YgCJpDC.exe
  2⤵
  PID:7332
- C:\Windows\System\FLQhUJK.exe
  C:\Windows\System\FLQhUJK.exe
  2⤵
  PID:8156
- C:\Windows\System\nNbGdGA.exe
  C:\Windows\System\nNbGdGA.exe
  2⤵
  PID:4800
- C:\Windows\System\Yckxogn.exe
  C:\Windows\System\Yckxogn.exe
  2⤵
  PID:8248
- C:\Windows\System\WAdlVtT.exe
  C:\Windows\System\WAdlVtT.exe
  2⤵
  PID:8292
- C:\Windows\System\vkcwXnk.exe
  C:\Windows\System\vkcwXnk.exe
  2⤵
  PID:7428
- C:\Windows\System\gxRxKgv.exe
  C:\Windows\System\gxRxKgv.exe
  2⤵
  PID:9316
- C:\Windows\System\fMTQYFK.exe
  C:\Windows\System\fMTQYFK.exe
  2⤵
  PID:9332
- C:\Windows\System\NOodqpM.exe
  C:\Windows\System\NOodqpM.exe
  2⤵
  PID:9348
- C:\Windows\System\gCPUjku.exe
  C:\Windows\System\gCPUjku.exe
  2⤵
  PID:9364
- C:\Windows\System\dngoeNV.exe
  C:\Windows\System\dngoeNV.exe
  2⤵
  PID:9384
- C:\Windows\System\GfXcehQ.exe
  C:\Windows\System\GfXcehQ.exe
  2⤵
  PID:9404
- C:\Windows\System\acURWtt.exe
  C:\Windows\System\acURWtt.exe
  2⤵
  PID:9436
- C:\Windows\System\hoghWJX.exe
  C:\Windows\System\hoghWJX.exe
  2⤵
  PID:9472
- C:\Windows\System\hwBFGNb.exe
  C:\Windows\System\hwBFGNb.exe
  2⤵
  PID:9496
- C:\Windows\System\FCdVKLm.exe
  C:\Windows\System\FCdVKLm.exe
  2⤵
  PID:9516
- C:\Windows\System\LcsayhC.exe
  C:\Windows\System\LcsayhC.exe
  2⤵
  PID:9540
- C:\Windows\System\aDlwgDL.exe
  C:\Windows\System\aDlwgDL.exe
  2⤵
  PID:9572
- C:\Windows\System\MeZccyJ.exe
  C:\Windows\System\MeZccyJ.exe
  2⤵
  PID:9604
- C:\Windows\System\ZhIyCtP.exe
  C:\Windows\System\ZhIyCtP.exe
  2⤵
  PID:9628
- C:\Windows\System\YvAIVdu.exe
  C:\Windows\System\YvAIVdu.exe
  2⤵
  PID:9652
- C:\Windows\System\LQqNRXk.exe
  C:\Windows\System\LQqNRXk.exe
  2⤵
  PID:9672
- C:\Windows\System\MoQjgQa.exe
  C:\Windows\System\MoQjgQa.exe
  2⤵
  PID:9700
- C:\Windows\System\ylPrqdB.exe
  C:\Windows\System\ylPrqdB.exe
  2⤵
  PID:9720
- C:\Windows\System\vgFujyj.exe
  C:\Windows\System\vgFujyj.exe
  2⤵
  PID:9748
- C:\Windows\System\rPnlWpV.exe
  C:\Windows\System\rPnlWpV.exe
  2⤵
  PID:9800
- C:\Windows\System\nWRtNxA.exe
  C:\Windows\System\nWRtNxA.exe
  2⤵
  PID:9824
- C:\Windows\System\VjrjjMU.exe
  C:\Windows\System\VjrjjMU.exe
  2⤵
  PID:9848
- C:\Windows\System\XKBwqvY.exe
  C:\Windows\System\XKBwqvY.exe
  2⤵
  PID:9880
- C:\Windows\System\PvsvKSw.exe
  C:\Windows\System\PvsvKSw.exe
  2⤵
  PID:9908
- C:\Windows\System\crLBNVE.exe
  C:\Windows\System\crLBNVE.exe
  2⤵
  PID:9928
- C:\Windows\System\FQPNkZr.exe
  C:\Windows\System\FQPNkZr.exe
  2⤵
  PID:9948
- C:\Windows\System\TNqkqcu.exe
  C:\Windows\System\TNqkqcu.exe
  2⤵
  PID:9968
- C:\Windows\System\GpvjZKF.exe
  C:\Windows\System\GpvjZKF.exe
  2⤵
  PID:9996
- C:\Windows\System\vulQibW.exe
  C:\Windows\System\vulQibW.exe
  2⤵
  PID:10028
- C:\Windows\System\mHUTHfQ.exe
  C:\Windows\System\mHUTHfQ.exe
  2⤵
  PID:10060
- C:\Windows\System\DgqRJyJ.exe
  C:\Windows\System\DgqRJyJ.exe
  2⤵
  PID:10088
- C:\Windows\System\lJRfIgl.exe
  C:\Windows\System\lJRfIgl.exe
  2⤵
  PID:10124
- C:\Windows\System\ZnmLtve.exe
  C:\Windows\System\ZnmLtve.exe
  2⤵
  PID:10148
- C:\Windows\System\ByNfUBg.exe
  C:\Windows\System\ByNfUBg.exe
  2⤵
  PID:10172
- C:\Windows\System\UxUhjzd.exe
  C:\Windows\System\UxUhjzd.exe
  2⤵
  PID:10192
- C:\Windows\System\JKpXNQK.exe
  C:\Windows\System\JKpXNQK.exe
  2⤵
  PID:10220
- C:\Windows\System\oklBFBa.exe
  C:\Windows\System\oklBFBa.exe
  2⤵
  PID:7188
- C:\Windows\System\xoxcPTQ.exe
  C:\Windows\System\xoxcPTQ.exe
  2⤵
  PID:8576
- C:\Windows\System\zyXSsgn.exe
  C:\Windows\System\zyXSsgn.exe
  2⤵
  PID:8648
- C:\Windows\System\SVprNus.exe
  C:\Windows\System\SVprNus.exe
  2⤵
  PID:8392
- C:\Windows\System\JzsKRpP.exe
  C:\Windows\System\JzsKRpP.exe
  2⤵
  PID:8892
- C:\Windows\System\fmQCxIB.exe
  C:\Windows\System\fmQCxIB.exe
  2⤵
  PID:9024
- C:\Windows\System\RCXWePN.exe
  C:\Windows\System\RCXWePN.exe
  2⤵
  PID:9088
- C:\Windows\System\dxmUllk.exe
  C:\Windows\System\dxmUllk.exe
  2⤵
  PID:8428
- C:\Windows\System\IJFYgWG.exe
  C:\Windows\System\IJFYgWG.exe
  2⤵
  PID:9040
- C:\Windows\System\wFMYPCd.exe
  C:\Windows\System\wFMYPCd.exe
  2⤵
  PID:7540
- C:\Windows\System\jtDCVAW.exe
  C:\Windows\System\jtDCVAW.exe
  2⤵
  PID:7616
- C:\Windows\System\yGEtGwx.exe
  C:\Windows\System\yGEtGwx.exe
  2⤵
  PID:8500
- C:\Windows\System\TXsJTNX.exe
  C:\Windows\System\TXsJTNX.exe
  2⤵
  PID:8244
- C:\Windows\System\cPkxtBx.exe
  C:\Windows\System\cPkxtBx.exe
  2⤵
  PID:3780
- C:\Windows\System\elUcpYe.exe
  C:\Windows\System\elUcpYe.exe
  2⤵
  PID:10244
- C:\Windows\System\otrmXqX.exe
  C:\Windows\System\otrmXqX.exe
  2⤵
  PID:10268
- C:\Windows\System\YOyNJtD.exe
  C:\Windows\System\YOyNJtD.exe
  2⤵
  PID:10288
- C:\Windows\System\jWzrscM.exe
  C:\Windows\System\jWzrscM.exe
  2⤵
  PID:10308
- C:\Windows\System\nxUnMUC.exe
  C:\Windows\System\nxUnMUC.exe
  2⤵
  PID:10332
- C:\Windows\System\GVJGSNm.exe
  C:\Windows\System\GVJGSNm.exe
  2⤵
  PID:10356
- C:\Windows\System\ryaxdPf.exe
  C:\Windows\System\ryaxdPf.exe
  2⤵
  PID:10384
- C:\Windows\System\gGdcbgS.exe
  C:\Windows\System\gGdcbgS.exe
  2⤵
  PID:10408
- C:\Windows\System\cOtXqzz.exe
  C:\Windows\System\cOtXqzz.exe
  2⤵
  PID:10428
- C:\Windows\System\RhWIVfo.exe
  C:\Windows\System\RhWIVfo.exe
  2⤵
  PID:10456
- C:\Windows\System\DUkHszm.exe
  C:\Windows\System\DUkHszm.exe
  2⤵
  PID:10480
- C:\Windows\System\eVFOmbq.exe
  C:\Windows\System\eVFOmbq.exe
  2⤵
  PID:10504
- C:\Windows\System\iaWknZW.exe
  C:\Windows\System\iaWknZW.exe
  2⤵
  PID:10528
- C:\Windows\System\kDtXODl.exe
  C:\Windows\System\kDtXODl.exe
  2⤵
  PID:10548
- C:\Windows\System\OhxRVkM.exe
  C:\Windows\System\OhxRVkM.exe
  2⤵
  PID:10564
- C:\Windows\System\kzuerSh.exe
  C:\Windows\System\kzuerSh.exe
  2⤵
  PID:10584
- C:\Windows\System\dwIsWfC.exe
  C:\Windows\System\dwIsWfC.exe
  2⤵
  PID:10600
- C:\Windows\System\ajhawLV.exe
  C:\Windows\System\ajhawLV.exe
  2⤵
  PID:10616
- C:\Windows\System\EkIdiiS.exe
  C:\Windows\System\EkIdiiS.exe
  2⤵
  PID:10632
- C:\Windows\System\CaVGlDc.exe
  C:\Windows\System\CaVGlDc.exe
  2⤵
  PID:10656
- C:\Windows\System\txPvzCb.exe
  C:\Windows\System\txPvzCb.exe
  2⤵
  PID:10680
- C:\Windows\System\WbeSETu.exe
  C:\Windows\System\WbeSETu.exe
  2⤵
  PID:10704
- C:\Windows\System\bgXCnOO.exe
  C:\Windows\System\bgXCnOO.exe
  2⤵
  PID:10724
- C:\Windows\System\ETGTEzM.exe
  C:\Windows\System\ETGTEzM.exe
  2⤵
  PID:10748
- C:\Windows\System\kdfbiTW.exe
  C:\Windows\System\kdfbiTW.exe
  2⤵
  PID:10768
- C:\Windows\System\MmxnThw.exe
  C:\Windows\System\MmxnThw.exe
  2⤵
  PID:10792
- C:\Windows\System\FjskdMe.exe
  C:\Windows\System\FjskdMe.exe
  2⤵
  PID:10816
- C:\Windows\System\wHzzuIS.exe
  C:\Windows\System\wHzzuIS.exe
  2⤵
  PID:10844
- C:\Windows\System\kRSGIXf.exe
  C:\Windows\System\kRSGIXf.exe
  2⤵
  PID:10868
- C:\Windows\System\XMdetLi.exe
  C:\Windows\System\XMdetLi.exe
  2⤵
  PID:10896
- C:\Windows\System\wZcNKXa.exe
  C:\Windows\System\wZcNKXa.exe
  2⤵
  PID:10920
- C:\Windows\System\KlGBIQA.exe
  C:\Windows\System\KlGBIQA.exe
  2⤵
  PID:10940
- C:\Windows\System\QQDInUT.exe
  C:\Windows\System\QQDInUT.exe
  2⤵
  PID:10972
- C:\Windows\System\xoPeFhy.exe
  C:\Windows\System\xoPeFhy.exe
  2⤵
  PID:10992
- C:\Windows\System\nurVkvZ.exe
  C:\Windows\System\nurVkvZ.exe
  2⤵
  PID:11012
- C:\Windows\System\wPEOhmp.exe
  C:\Windows\System\wPEOhmp.exe
  2⤵
  PID:11040
- C:\Windows\System\CKNJegb.exe
  C:\Windows\System\CKNJegb.exe
  2⤵
  PID:11064
- C:\Windows\System\GhKAApX.exe
  C:\Windows\System\GhKAApX.exe
  2⤵
  PID:11084
- C:\Windows\System\lZihyLU.exe
  C:\Windows\System\lZihyLU.exe
  2⤵
  PID:11112
- C:\Windows\System\USxVrAy.exe
  C:\Windows\System\USxVrAy.exe
  2⤵
  PID:11136
- C:\Windows\System\wrNqehE.exe
  C:\Windows\System\wrNqehE.exe
  2⤵
  PID:11164
- C:\Windows\System\yLsyYBv.exe
  C:\Windows\System\yLsyYBv.exe
  2⤵
  PID:11188
- C:\Windows\System\rvMEKzD.exe
  C:\Windows\System\rvMEKzD.exe
  2⤵
  PID:11208
- C:\Windows\System\RrTEDyr.exe
  C:\Windows\System\RrTEDyr.exe
  2⤵
  PID:11232
- C:\Windows\System\NvYRKIS.exe
  C:\Windows\System\NvYRKIS.exe
  2⤵
  PID:11260
- C:\Windows\System\TfDOiWP.exe
  C:\Windows\System\TfDOiWP.exe
  2⤵
  PID:9416
- C:\Windows\System\xnXgjYM.exe
  C:\Windows\System\xnXgjYM.exe
  2⤵
  PID:9480
- C:\Windows\System\RoCIntR.exe
  C:\Windows\System\RoCIntR.exe
  2⤵
  PID:9548
- C:\Windows\System\zFvvHYi.exe
  C:\Windows\System\zFvvHYi.exe
  2⤵
  PID:10448
- C:\Windows\System\FswtmAD.exe
  C:\Windows\System\FswtmAD.exe
  2⤵
  PID:9644
- C:\Windows\System\IhFDTDg.exe
  C:\Windows\System\IhFDTDg.exe
  2⤵
  PID:9836
- C:\Windows\System\sAsouqT.exe
  C:\Windows\System\sAsouqT.exe
  2⤵
  PID:9988
- C:\Windows\System\ECxMSRV.exe
  C:\Windows\System\ECxMSRV.exe
  2⤵
  PID:5608
- C:\Windows\System\mWALoeZ.exe
  C:\Windows\System\mWALoeZ.exe
  2⤵
  PID:8992
- C:\Windows\System\zeWOEHl.exe
  C:\Windows\System\zeWOEHl.exe
  2⤵
  PID:7484
- C:\Windows\System\YEhhqxf.exe
  C:\Windows\System\YEhhqxf.exe
  2⤵
  PID:10420
- C:\Windows\System\IvVnrHS.exe
  C:\Windows\System\IvVnrHS.exe
  2⤵
  PID:10624
- C:\Windows\System\DDFDqGh.exe
  C:\Windows\System\DDFDqGh.exe
  2⤵
  PID:11272
- C:\Windows\System\gECCBzt.exe
  C:\Windows\System\gECCBzt.exe
  2⤵
  PID:11292
- C:\Windows\System\TeuxsNT.exe
  C:\Windows\System\TeuxsNT.exe
  2⤵
  PID:11320
- C:\Windows\System\NXKiyUF.exe
  C:\Windows\System\NXKiyUF.exe
  2⤵
  PID:11344
- C:\Windows\System\HySDEhk.exe
  C:\Windows\System\HySDEhk.exe
  2⤵
  PID:11368
- C:\Windows\System\BlUEMCp.exe
  C:\Windows\System\BlUEMCp.exe
  2⤵
  PID:11396
- C:\Windows\System\IAoHXvT.exe
  C:\Windows\System\IAoHXvT.exe
  2⤵
  PID:11420
- C:\Windows\System\NEcRyRZ.exe
  C:\Windows\System\NEcRyRZ.exe
  2⤵
  PID:11440
- C:\Windows\System\FmbUZEm.exe
  C:\Windows\System\FmbUZEm.exe
  2⤵
  PID:11468
- C:\Windows\System\tixFVcQ.exe
  C:\Windows\System\tixFVcQ.exe
  2⤵
  PID:11496
- C:\Windows\System\ITVddwW.exe
  C:\Windows\System\ITVddwW.exe
  2⤵
  PID:11524
- C:\Windows\System\mouEWxY.exe
  C:\Windows\System\mouEWxY.exe
  2⤵
  PID:11556
- C:\Windows\System\gNtywLz.exe
  C:\Windows\System\gNtywLz.exe
  2⤵
  PID:11584
- C:\Windows\System\cEwsbxm.exe
  C:\Windows\System\cEwsbxm.exe
  2⤵
  PID:11604
- C:\Windows\System\RwQkkhZ.exe
  C:\Windows\System\RwQkkhZ.exe
  2⤵
  PID:11628
- C:\Windows\System\GoJikKV.exe
  C:\Windows\System\GoJikKV.exe
  2⤵
  PID:11656
- C:\Windows\System\SaBdSWW.exe
  C:\Windows\System\SaBdSWW.exe
  2⤵
  PID:11684
- C:\Windows\System\uTJZpbW.exe
  C:\Windows\System\uTJZpbW.exe
  2⤵
  PID:11712
- C:\Windows\System\IBrWEfp.exe
  C:\Windows\System\IBrWEfp.exe
  2⤵
  PID:11748
- C:\Windows\System\KugnfNQ.exe
  C:\Windows\System\KugnfNQ.exe
  2⤵
  PID:11776
- C:\Windows\System\DGGsHVc.exe
  C:\Windows\System\DGGsHVc.exe
  2⤵
  PID:11808
- C:\Windows\System\UeXUjXE.exe
  C:\Windows\System\UeXUjXE.exe
  2⤵
  PID:11880
- C:\Windows\System\QvFaRlV.exe
  C:\Windows\System\QvFaRlV.exe
  2⤵
  PID:11900
- C:\Windows\System\XuAlqWh.exe
  C:\Windows\System\XuAlqWh.exe
  2⤵
  PID:11920
- C:\Windows\System\xGJeBpI.exe
  C:\Windows\System\xGJeBpI.exe
  2⤵
  PID:11948
- C:\Windows\System\dZMHWwR.exe
  C:\Windows\System\dZMHWwR.exe
  2⤵
  PID:11968
- C:\Windows\System\XnNbzdc.exe
  C:\Windows\System\XnNbzdc.exe
  2⤵
  PID:11988
- C:\Windows\System\mEUtBKt.exe
  C:\Windows\System\mEUtBKt.exe
  2⤵
  PID:12040
- C:\Windows\System\pFEUDid.exe
  C:\Windows\System\pFEUDid.exe
  2⤵
  PID:12068
- C:\Windows\System\NKQxLzd.exe
  C:\Windows\System\NKQxLzd.exe
  2⤵
  PID:12092
- C:\Windows\System\qEImbZv.exe
  C:\Windows\System\qEImbZv.exe
  2⤵
  PID:12124
- C:\Windows\System\MXhFGTY.exe
  C:\Windows\System\MXhFGTY.exe
  2⤵
  PID:12140
- C:\Windows\System\CQGKhyg.exe
  C:\Windows\System\CQGKhyg.exe
  2⤵
  PID:12156
- C:\Windows\System\lIDQHow.exe
  C:\Windows\System\lIDQHow.exe
  2⤵
  PID:12176
- C:\Windows\System\ADEotSD.exe
  C:\Windows\System\ADEotSD.exe
  2⤵
  PID:12196
- C:\Windows\System\EcKQVxE.exe
  C:\Windows\System\EcKQVxE.exe
  2⤵
  PID:12216
- C:\Windows\System\dUnzCBK.exe
  C:\Windows\System\dUnzCBK.exe
  2⤵
  PID:12240
- C:\Windows\System\holWevm.exe
  C:\Windows\System\holWevm.exe
  2⤵
  PID:12256
- C:\Windows\System\ZpAFCag.exe
  C:\Windows\System\ZpAFCag.exe
  2⤵
  PID:12272
- C:\Windows\System\yMRrBJV.exe
  C:\Windows\System\yMRrBJV.exe
  2⤵
  PID:8952
- C:\Windows\System\QHMyGxn.exe
  C:\Windows\System\QHMyGxn.exe
  2⤵
  PID:7628
- C:\Windows\System\qOCqyDH.exe
  C:\Windows\System\qOCqyDH.exe
  2⤵
  PID:9068
- C:\Windows\System\PJLJtbB.exe
  C:\Windows\System\PJLJtbB.exe
  2⤵
  PID:10500
- C:\Windows\System\drTRQJi.exe
  C:\Windows\System\drTRQJi.exe
  2⤵
  PID:10464
- C:\Windows\System\EwgrGLL.exe
  C:\Windows\System\EwgrGLL.exe
  2⤵
  PID:10912
- C:\Windows\System\OajPFJL.exe
  C:\Windows\System\OajPFJL.exe
  2⤵
  PID:9212
- C:\Windows\System\KcIBeOb.exe
  C:\Windows\System\KcIBeOb.exe
  2⤵
  PID:9224
- C:\Windows\System\fSkKGxv.exe
  C:\Windows\System\fSkKGxv.exe
  2⤵
  PID:11128
- C:\Windows\System\AnOvaXR.exe
  C:\Windows\System\AnOvaXR.exe
  2⤵
  PID:11204
- C:\Windows\System\RoWcXqy.exe
  C:\Windows\System\RoWcXqy.exe
  2⤵
  PID:9396
- C:\Windows\System\YOFjlCW.exe
  C:\Windows\System\YOFjlCW.exe
  2⤵
  PID:11224
- C:\Windows\System\kxLtOGu.exe
  C:\Windows\System\kxLtOGu.exe
  2⤵
  PID:10512
- C:\Windows\System\XWrblpP.exe
  C:\Windows\System\XWrblpP.exe
  2⤵
  PID:10672
- C:\Windows\System\dmaRkSC.exe
  C:\Windows\System\dmaRkSC.exe
  2⤵
  PID:6956
- C:\Windows\System\FRCOWjg.exe
  C:\Windows\System\FRCOWjg.exe
  2⤵
  PID:11364
- C:\Windows\System\VasWMbU.exe
  C:\Windows\System\VasWMbU.exe
  2⤵
  PID:8124
- C:\Windows\System\OAlzNFk.exe
  C:\Windows\System\OAlzNFk.exe
  2⤵
  PID:9376
- C:\Windows\System\euMVyek.exe
  C:\Windows\System\euMVyek.exe
  2⤵
  PID:11644
- C:\Windows\System\DCkvPiZ.exe
  C:\Windows\System\DCkvPiZ.exe
  2⤵
  PID:9716
- C:\Windows\System\gZdxaFX.exe
  C:\Windows\System\gZdxaFX.exe
  2⤵
  PID:9916
- C:\Windows\System\EeEfHtf.exe
  C:\Windows\System\EeEfHtf.exe
  2⤵
  PID:9360
- C:\Windows\System\xgReRAo.exe
  C:\Windows\System\xgReRAo.exe
  2⤵
  PID:12296
- C:\Windows\System\fFyNYMz.exe
  C:\Windows\System\fFyNYMz.exe
  2⤵
  PID:12316
- C:\Windows\System\tIPeiIE.exe
  C:\Windows\System\tIPeiIE.exe
  2⤵
  PID:12344
- C:\Windows\System\JDRhlYu.exe
  C:\Windows\System\JDRhlYu.exe
  2⤵
  PID:12364
- C:\Windows\System\LzfNbCG.exe
  C:\Windows\System\LzfNbCG.exe
  2⤵
  PID:12388
- C:\Windows\System\zVWdBcQ.exe
  C:\Windows\System\zVWdBcQ.exe
  2⤵
  PID:12408
- C:\Windows\System\vMiBSUf.exe
  C:\Windows\System\vMiBSUf.exe
  2⤵
  PID:12424
- C:\Windows\System\rmABrbJ.exe
  C:\Windows\System\rmABrbJ.exe
  2⤵
  PID:12440
- C:\Windows\System\AJqCUon.exe
  C:\Windows\System\AJqCUon.exe
  2⤵
  PID:12456
- C:\Windows\System\OitNRQr.exe
  C:\Windows\System\OitNRQr.exe
  2⤵
  PID:12480
- C:\Windows\System\biXWsAy.exe
  C:\Windows\System\biXWsAy.exe
  2⤵
  PID:12496
- C:\Windows\System\WmBmuXA.exe
  C:\Windows\System\WmBmuXA.exe
  2⤵
  PID:12512
- C:\Windows\System\yGTnzRv.exe
  C:\Windows\System\yGTnzRv.exe
  2⤵
  PID:12544
- C:\Windows\System\NSpJhoU.exe
  C:\Windows\System\NSpJhoU.exe
  2⤵
  PID:12560
- C:\Windows\System\aJqHBWj.exe
  C:\Windows\System\aJqHBWj.exe
  2⤵
  PID:12580
- C:\Windows\System\tClXGwC.exe
  C:\Windows\System\tClXGwC.exe
  2⤵
  PID:12608
- C:\Windows\System\NEIqIMy.exe
  C:\Windows\System\NEIqIMy.exe
  2⤵
  PID:12628
- C:\Windows\System\wHataoX.exe
  C:\Windows\System\wHataoX.exe
  2⤵
  PID:12652
- C:\Windows\System\fHjuTvJ.exe
  C:\Windows\System\fHjuTvJ.exe
  2⤵
  PID:12672
- C:\Windows\System\PNGiUtw.exe
  C:\Windows\System\PNGiUtw.exe
  2⤵
  PID:12688
- C:\Windows\System\czpVaUP.exe
  C:\Windows\System\czpVaUP.exe
  2⤵
  PID:12712
- C:\Windows\System\fbfxkWo.exe
  C:\Windows\System\fbfxkWo.exe
  2⤵
  PID:12732
- C:\Windows\System\XEMYGdL.exe
  C:\Windows\System\XEMYGdL.exe
  2⤵
  PID:12752
- C:\Windows\System\MVjpglE.exe
  C:\Windows\System\MVjpglE.exe
  2⤵
  PID:12780
- C:\Windows\System\bmTWrbf.exe
  C:\Windows\System\bmTWrbf.exe
  2⤵
  PID:12816
- C:\Windows\System\bvPKdGm.exe
  C:\Windows\System\bvPKdGm.exe
  2⤵
  PID:12844
- C:\Windows\System\wsUzXgK.exe
  C:\Windows\System\wsUzXgK.exe
  2⤵
  PID:12864
- C:\Windows\System\oHmeUHi.exe
  C:\Windows\System\oHmeUHi.exe
  2⤵
  PID:12888
- C:\Windows\System\lifucRZ.exe
  C:\Windows\System\lifucRZ.exe
  2⤵
  PID:12908
- C:\Windows\System\RRqXIfI.exe
  C:\Windows\System\RRqXIfI.exe
  2⤵
  PID:12928
- C:\Windows\System\PZXtbKS.exe
  C:\Windows\System\PZXtbKS.exe
  2⤵
  PID:12944
- C:\Windows\System\GwFwyPf.exe
  C:\Windows\System\GwFwyPf.exe
  2⤵
  PID:12960
- C:\Windows\System\IyWENtj.exe
  C:\Windows\System\IyWENtj.exe
  2⤵
  PID:12980
- C:\Windows\System\LOVjjpc.exe
  C:\Windows\System\LOVjjpc.exe
  2⤵
  PID:12996
- C:\Windows\System\eIHhDNf.exe
  C:\Windows\System\eIHhDNf.exe
  2⤵
  PID:13016
- C:\Windows\System\YLqrCEl.exe
  C:\Windows\System\YLqrCEl.exe
  2⤵
  PID:13032
- C:\Windows\System\TFqxpyI.exe
  C:\Windows\System\TFqxpyI.exe
  2⤵
  PID:13048
- C:\Windows\System\hRTUPtZ.exe
  C:\Windows\System\hRTUPtZ.exe
  2⤵
  PID:13064
- C:\Windows\System\daTNEfY.exe
  C:\Windows\System\daTNEfY.exe
  2⤵
  PID:13084
- C:\Windows\System\PMIqnFI.exe
  C:\Windows\System\PMIqnFI.exe
  2⤵
  PID:13104
- C:\Windows\System\uZcNtCJ.exe
  C:\Windows\System\uZcNtCJ.exe
  2⤵
  PID:13136
- C:\Windows\System\CUyOsmK.exe
  C:\Windows\System\CUyOsmK.exe
  2⤵
  PID:13160
- C:\Windows\System\IROPbLM.exe
  C:\Windows\System\IROPbLM.exe
  2⤵
  PID:13188
- C:\Windows\System\TgTFFOb.exe
  C:\Windows\System\TgTFFOb.exe
  2⤵
  PID:13216
- C:\Windows\System\cGAIqZb.exe
  C:\Windows\System\cGAIqZb.exe
  2⤵
  PID:13240
- C:\Windows\System\qubEcRo.exe
  C:\Windows\System\qubEcRo.exe
  2⤵
  PID:13256
- C:\Windows\System\CbmUxbQ.exe
  C:\Windows\System\CbmUxbQ.exe
  2⤵
  PID:13284
- C:\Windows\System\gbpvoDt.exe
  C:\Windows\System\gbpvoDt.exe
  2⤵
  PID:13304
- C:\Windows\System\wpykXEG.exe
  C:\Windows\System\wpykXEG.exe
  2⤵
  PID:11124
- C:\Windows\System\CXiLOaN.exe
  C:\Windows\System\CXiLOaN.exe
  2⤵
  PID:9612
- C:\Windows\System\xEXOzvA.exe
  C:\Windows\System\xEXOzvA.exe
  2⤵
  PID:12104
- C:\Windows\System\xRqXiyi.exe
  C:\Windows\System\xRqXiyi.exe
  2⤵
  PID:12280
- C:\Windows\System\aOBaUOe.exe
  C:\Windows\System\aOBaUOe.exe
  2⤵
  PID:9860
- C:\Windows\System\Lnhreqa.exe
  C:\Windows\System\Lnhreqa.exe
  2⤵
  PID:11516
- C:\Windows\System\ovsEXii.exe
  C:\Windows\System\ovsEXii.exe
  2⤵
  PID:12056
- C:\Windows\System\qenjLQG.exe
  C:\Windows\System\qenjLQG.exe
  2⤵
  PID:12920
- C:\Windows\System\jGKGCuL.exe
  C:\Windows\System\jGKGCuL.exe
  2⤵
  PID:13176
- C:\Windows\System\qEmeJjc.exe
  C:\Windows\System\qEmeJjc.exe
  2⤵
  PID:9728
- C:\Windows\System\MspkXuM.exe
  C:\Windows\System\MspkXuM.exe
  2⤵
  PID:10592
- C:\Windows\System\iEYkjgW.exe
  C:\Windows\System\iEYkjgW.exe
  2⤵
  PID:12332
- C:\Windows\System\zJxVkeB.exe
  C:\Windows\System\zJxVkeB.exe
  2⤵
  PID:13276
- C:\Windows\System\RSPevMN.exe
  C:\Windows\System\RSPevMN.exe
  2⤵
  PID:11200
- C:\Windows\System\ZCzPxqQ.exe
  C:\Windows\System\ZCzPxqQ.exe
  2⤵
  PID:2680
- C:\Windows\System\PuunJdQ.exe
  C:\Windows\System\PuunJdQ.exe
  2⤵
  PID:10276
- C:\Windows\System\YOkWUcH.exe
  C:\Windows\System\YOkWUcH.exe
  2⤵
  PID:2808
- C:\Windows\System\zUjEHuD.exe
  C:\Windows\System\zUjEHuD.exe
  2⤵
  PID:12572
- C:\Windows\System\ECfUaDG.exe
  C:\Windows\System\ECfUaDG.exe
  2⤵
  PID:11484
- C:\Windows\System\HWKOTcj.exe
  C:\Windows\System\HWKOTcj.exe
  2⤵
  PID:10716
- C:\Windows\System\vzmiqpN.exe
  C:\Windows\System\vzmiqpN.exe
  2⤵
  PID:12404
- C:\Windows\System\etzeKvC.exe
  C:\Windows\System\etzeKvC.exe
  2⤵
  PID:12008
- C:\Windows\System\FfuMNth.exe
  C:\Windows\System\FfuMNth.exe
  2⤵
  PID:11564
- C:\Windows\System\yNgGHsC.exe
  C:\Windows\System\yNgGHsC.exe
  2⤵
  PID:12336
- C:\Windows\System\YlfJOXH.exe
  C:\Windows\System\YlfJOXH.exe
  2⤵
  PID:1248
- C:\Windows\System\PWcDzwr.exe
  C:\Windows\System\PWcDzwr.exe
  2⤵
  PID:12132
- C:\Windows\System\TCmNOzR.exe
  C:\Windows\System\TCmNOzR.exe
  2⤵
  PID:12360
- C:\Windows\System\INoqdJW.exe
  C:\Windows\System\INoqdJW.exe
  2⤵
  PID:12700
- C:\Windows\System\ZcPhZgz.exe
  C:\Windows\System\ZcPhZgz.exe
  2⤵
  PID:10740
- C:\Windows\System\nArQDbY.exe
  C:\Windows\System\nArQDbY.exe
  2⤵
  PID:10396
- C:\Windows\System\xCtdDnR.exe
  C:\Windows\System\xCtdDnR.exe
  2⤵
  PID:13132
- C:\Windows\System\DycbXYg.exe
  C:\Windows\System\DycbXYg.exe
  2⤵
  PID:8484
- C:\Windows\System\navofTq.exe
  C:\Windows\System\navofTq.exe
  2⤵
  PID:12824
- C:\Windows\System\uZKsWGG.exe
  C:\Windows\System\uZKsWGG.exe
  2⤵
  PID:12836
- C:\Windows\System\ZOevIPJ.exe
  C:\Windows\System\ZOevIPJ.exe
  2⤵
  PID:13264
- C:\Windows\System\cAoUINU.exe
  C:\Windows\System\cAoUINU.exe
  2⤵
  PID:12312
- C:\Windows\System\KqPugLj.exe
  C:\Windows\System\KqPugLj.exe
  2⤵
  PID:4556
- C:\Windows\System\HVClyso.exe
  C:\Windows\System\HVClyso.exe
  2⤵
  PID:11056
- C:\Windows\System\hoGeZFV.exe
  C:\Windows\System\hoGeZFV.exe
  2⤵
  PID:9324
- C:\Windows\System\lTEaXVH.exe
  C:\Windows\System\lTEaXVH.exe
  2⤵
  PID:12792
- C:\Windows\System\dSDULDT.exe
  C:\Windows\System\dSDULDT.exe
  2⤵
  PID:12828
- C:\Windows\System\bAAcvMe.exe
  C:\Windows\System\bAAcvMe.exe
  2⤵
  PID:4428
- C:\Windows\System\NtPvJjJ.exe
  C:\Windows\System\NtPvJjJ.exe
  2⤵
  PID:13080
- C:\Windows\System\MSvmWcd.exe
  C:\Windows\System\MSvmWcd.exe
  2⤵
  PID:11912
- C:\Windows\System\ATuLZqe.exe
  C:\Windows\System\ATuLZqe.exe
  2⤵
  PID:1648
- C:\Windows\System\QvDJSeV.exe
  C:\Windows\System\QvDJSeV.exe
  2⤵
  PID:1220
- C:\Windows\System\IyNyYSL.exe
  C:\Windows\System\IyNyYSL.exe
  2⤵
  PID:756
- C:\Windows\System\SKHOBgd.exe
  C:\Windows\System\SKHOBgd.exe
  2⤵
  PID:3724
- C:\Windows\System\POlOwcS.exe
  C:\Windows\System\POlOwcS.exe
  2⤵
  PID:12432
- C:\Windows\System\gKvDthe.exe
  C:\Windows\System\gKvDthe.exe
  2⤵
  PID:1304
- C:\Windows\System\QEGlKBb.exe
  C:\Windows\System\QEGlKBb.exe
  2⤵
  PID:6032
- C:\Windows\System\vtVQhys.exe
  C:\Windows\System\vtVQhys.exe
  2⤵
  PID:10144
- C:\Windows\System\GUlzQeI.exe
  C:\Windows\System\GUlzQeI.exe
  2⤵
  PID:12796
- C:\Windows\System\oEkOlWJ.exe
  C:\Windows\System\oEkOlWJ.exe
  2⤵
  PID:10732
- C:\Windows\System\cJIiUun.exe
  C:\Windows\System\cJIiUun.exe
  2⤵
  PID:820
- C:\Windows\System\sbLKvac.exe
  C:\Windows\System\sbLKvac.exe
  2⤵
  PID:10104
- C:\Windows\System\tIERJxn.exe
  C:\Windows\System\tIERJxn.exe
  2⤵
  PID:12748
- C:\Windows\System\jMAXleg.exe
  C:\Windows\System\jMAXleg.exe
  2⤵
  PID:5648
- C:\Windows\System\xYdlXfL.exe
  C:\Windows\System\xYdlXfL.exe
  2⤵
  PID:1436
- C:\Windows\System\QZiHCLD.exe
  C:\Windows\System\QZiHCLD.exe
  2⤵
  PID:5788
- C:\Windows\System\oEWkfAf.exe
  C:\Windows\System\oEWkfAf.exe
  2⤵
  PID:12372
- C:\Windows\System\OnWLAAv.exe
  C:\Windows\System\OnWLAAv.exe
  2⤵
  PID:3440
- C:\Windows\System\PeynPqb.exe
  C:\Windows\System\PeynPqb.exe
  2⤵
  PID:5172
- C:\Windows\System\duxtmuK.exe
  C:\Windows\System\duxtmuK.exe
  2⤵
  PID:10280
- C:\Windows\System\NFjRlOz.exe
  C:\Windows\System\NFjRlOz.exe
  2⤵
  PID:3208
- C:\Windows\System\eoOMPeh.exe
  C:\Windows\System\eoOMPeh.exe
  2⤵
  PID:4496
- C:\Windows\System\WzPuThk.exe
  C:\Windows\System\WzPuThk.exe
  2⤵
  PID:13300
- C:\Windows\System\tvZgSVI.exe
  C:\Windows\System\tvZgSVI.exe
  2⤵
  PID:3876
- C:\Windows\System\yxaCEXr.exe
  C:\Windows\System\yxaCEXr.exe
  2⤵
  PID:6060
- C:\Windows\System\LEflSbd.exe
  C:\Windows\System\LEflSbd.exe
  2⤵
  PID:776
- C:\Windows\System\fvgamge.exe
  C:\Windows\System\fvgamge.exe
  2⤵
  PID:860
- C:\Windows\System\MnnJfri.exe
  C:\Windows\System\MnnJfri.exe
  2⤵
  PID:2408
- C:\Windows\System\ZbmamTp.exe
  C:\Windows\System\ZbmamTp.exe
  2⤵
  PID:13328
- C:\Windows\System\hCYRCoB.exe
  C:\Windows\System\hCYRCoB.exe
  2⤵
  PID:13400
- C:\Windows\System\qUyLQEO.exe
  C:\Windows\System\qUyLQEO.exe
  2⤵
  PID:13556
- C:\Windows\System\mhCxXTk.exe
  C:\Windows\System\mhCxXTk.exe
  2⤵
  PID:13584
- C:\Windows\System\IfEiyBd.exe
  C:\Windows\System\IfEiyBd.exe
  2⤵
  PID:13600
- C:\Windows\System\egSbJdW.exe
  C:\Windows\System\egSbJdW.exe
  2⤵
  PID:13616
- C:\Windows\System\RzrbOJP.exe
  C:\Windows\System\RzrbOJP.exe
  2⤵
  PID:13632
- C:\Windows\System\FIfcfGE.exe
  C:\Windows\System\FIfcfGE.exe
  2⤵
  PID:13656
- C:\Windows\System\fmCpiFz.exe
  C:\Windows\System\fmCpiFz.exe
  2⤵
  PID:13684
- C:\Windows\System\mMMtkcv.exe
  C:\Windows\System\mMMtkcv.exe
  2⤵
  PID:13704
- C:\Windows\System\cIpVBjC.exe
  C:\Windows\System\cIpVBjC.exe
  2⤵
  PID:13736
- C:\Windows\System\vpeEfVI.exe
  C:\Windows\System\vpeEfVI.exe
  2⤵
  PID:13756
- C:\Windows\System\VLzXQDW.exe
  C:\Windows\System\VLzXQDW.exe
  2⤵
  PID:13772
- C:\Windows\System\BjNjdoJ.exe
  C:\Windows\System\BjNjdoJ.exe
  2⤵
  PID:13796
- C:\Windows\System\CqUrQfM.exe
  C:\Windows\System\CqUrQfM.exe
  2⤵
  PID:13848
- C:\Windows\System\PyHVvmY.exe
  C:\Windows\System\PyHVvmY.exe
  2⤵
  PID:13876
- C:\Windows\System\ayWpfMz.exe
  C:\Windows\System\ayWpfMz.exe
  2⤵
  PID:14004
- C:\Windows\System\lDdGpmO.exe
  C:\Windows\System\lDdGpmO.exe
  2⤵
  PID:14032
- C:\Windows\System\QSAWJcx.exe
  C:\Windows\System\QSAWJcx.exe
  2⤵
  PID:14048
- C:\Windows\System\siqYtbQ.exe
  C:\Windows\System\siqYtbQ.exe
  2⤵
  PID:14092
- C:\Windows\System\PQUZLrJ.exe
  C:\Windows\System\PQUZLrJ.exe
  2⤵
  PID:14152
- C:\Windows\System\dLGuIzF.exe
  C:\Windows\System\dLGuIzF.exe
  2⤵
  PID:14176
- C:\Windows\System\IdcvRqV.exe
  C:\Windows\System\IdcvRqV.exe
  2⤵
  PID:14248
- C:\Windows\System\FifOuiJ.exe
  C:\Windows\System\FifOuiJ.exe
  2⤵
  PID:14264
- C:\Windows\System\jnxNmYA.exe
  C:\Windows\System\jnxNmYA.exe
  2⤵
  PID:4344
- C:\Windows\System\qXJXheW.exe
  C:\Windows\System\qXJXheW.exe
  2⤵
  PID:3156
- C:\Windows\System\bmWbYqF.exe
  C:\Windows\System\bmWbYqF.exe
  2⤵
  PID:1084
- C:\Windows\System\xSorRAH.exe
  C:\Windows\System\xSorRAH.exe
  2⤵
  PID:4776
- C:\Windows\System\BPIpOsz.exe
  C:\Windows\System\BPIpOsz.exe
  2⤵
  PID:4412
- C:\Windows\System\TfiCyMo.exe
  C:\Windows\System\TfiCyMo.exe
  2⤵
  PID:13344
- C:\Windows\System\AyYloHZ.exe
  C:\Windows\System\AyYloHZ.exe
  2⤵
  PID:13364
- C:\Windows\System\ylnuYGD.exe
  C:\Windows\System\ylnuYGD.exe
  2⤵
  PID:13428
- C:\Windows\System\udPnDzU.exe
  C:\Windows\System\udPnDzU.exe
  2⤵
  PID:13416
- C:\Windows\System\qKSldcb.exe
  C:\Windows\System\qKSldcb.exe
  2⤵
  PID:13544
- C:\Windows\System\viknuTW.exe
  C:\Windows\System\viknuTW.exe
  2⤵
  PID:4836
- C:\Windows\System\jiOMqyY.exe
  C:\Windows\System\jiOMqyY.exe
  2⤵
  PID:6028
- C:\Windows\System\SoUuwIb.exe
  C:\Windows\System\SoUuwIb.exe
  2⤵
  PID:3232
- C:\Windows\System\sUafGlA.exe
  C:\Windows\System\sUafGlA.exe
  2⤵
  PID:13592
- C:\Windows\System\bAMGJNg.exe
  C:\Windows\System\bAMGJNg.exe
  2⤵
  PID:2112
- C:\Windows\System\OCBXZsN.exe
  C:\Windows\System\OCBXZsN.exe
  2⤵
  PID:13868
- C:\Windows\System\mixtsIb.exe
  C:\Windows\System\mixtsIb.exe
  2⤵
  PID:13724
- C:\Windows\System\gxrkPRX.exe
  C:\Windows\System\gxrkPRX.exe
  2⤵
  PID:13752
- C:\Windows\System\OtasbWG.exe
  C:\Windows\System\OtasbWG.exe
  2⤵
  PID:13836
- C:\Windows\System\opcTUwA.exe
  C:\Windows\System\opcTUwA.exe
  2⤵
  PID:536
- C:\Windows\System\xyWzuky.exe
  C:\Windows\System\xyWzuky.exe
  2⤵
  PID:13984
- C:\Windows\System\GXsDSZp.exe
  C:\Windows\System\GXsDSZp.exe
  2⤵
  PID:14068
- C:\Windows\System\CsHejeD.exe
  C:\Windows\System\CsHejeD.exe
  2⤵
  PID:14020
- C:\Windows\System\DwirWrx.exe
  C:\Windows\System\DwirWrx.exe
  2⤵
  PID:14044
- C:\Windows\System\shLBtCt.exe
  C:\Windows\System\shLBtCt.exe
  2⤵
  PID:3104
- C:\Windows\System\DpVbwsD.exe
  C:\Windows\System\DpVbwsD.exe
  2⤵
  PID:3868
- C:\Windows\System\GjittlX.exe
  C:\Windows\System\GjittlX.exe
  2⤵
  PID:14232
- C:\Windows\System\SfGLBHO.exe
  C:\Windows\System\SfGLBHO.exe
  2⤵
  PID:14276
- C:\Windows\System\fkYQTMh.exe
  C:\Windows\System\fkYQTMh.exe
  2⤵
  PID:228
- C:\Windows\System\pjnHiKc.exe
  C:\Windows\System\pjnHiKc.exe
  2⤵
  PID:13524
- C:\Windows\System\YveqsbH.exe
  C:\Windows\System\YveqsbH.exe
  2⤵
  PID:13680
- C:\Windows\System\PkIKBfS.exe
  C:\Windows\System\PkIKBfS.exe
  2⤵
  PID:13624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_aw3h34nb.wpj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_aw3h34nb.wpj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

ATApzBq.exe

Path C:\Windows\System\ATApzBq.exe
Size 2.1MB
SHA256 d653453da18ed3c3409bf7b0277dc4d97b504bd983c80dcc2b7a4a51cb73555e
MD5 0a7d948fe555528cf90341fe51b8a4f0
SHA1 78fb4d89e392e7a08dfde76825d645d310165228
SHA512 f3e4c1ac5ead8fb62ce92be80830f67ee918005d9fe71c4f0e9a0f9d54102aa3a3f02f50a6d51777c2a0f5ac4769a083220620820b763201f6e845065670a203
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrm:NABh
MD5 SHA1 SHA512 SSDEEP

Submit Download

BFQoaqb.exe

Path C:\Windows\System\BFQoaqb.exe
Size 2.1MB
SHA256 87139ff414f7a47e65dd3409efdc23e6a36c94b80340bca86aa086a94edc2f9d
MD5 51044bc9b8bb890795a6d9d02f78370b
SHA1 a1b5911d4712827e9f8333e862f79636e9e762b8
SHA512 20060e16f597768d9e9a5f890bf9b87f19b74150bb998ebd6f6a59f7225375158d16e739fe226c04a7741d5fba5c43a37d42a1359c960b2071403b1e18cf523a
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qro:NABL
MD5 SHA1 SHA512 SSDEEP

Submit Download

CNGEmBh.exe

Path C:\Windows\System\CNGEmBh.exe
Size 2.1MB
SHA256 f0f4708f16b1ca2ef4f5b48cdd50df3bb997f28388325446a53ffd3aadf1af67
MD5 2d9d63df3f54e2034a8ee70913f6a481
SHA1 0b2e8674b33ed7805bf1912c7e5ed92fe2cbd718
SHA512 96f21bbfc910055b50c3165e0941c99fc476f3df60424a2f9a86fd3699b9bfcb37b03060857744bb25370cef5f1cb0dcf5cdac0ebcd3bb1cc4cca88925e8f9b3
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrN:NABa
MD5 SHA1 SHA512 SSDEEP

Submit Download

DSLPosC.exe

Path C:\Windows\System\DSLPosC.exe
Size 2.1MB
SHA256 9303a49efa1af6b65077490463b5b9790801a055f9cdbce72be2e93edd06eaf6
MD5 805870469a024786c9e936ebc944c97a
SHA1 542c1149e536764e5a309a21b325de124f0c0155
SHA512 9fd21a92a8a1914f049ca91cddede8aa920f64b47d50aea7fcd1c844e8cdc4b5631035a9f90cd295276676a39a6c81756eaf21f8bcd0fe0c2d739f5a3dcf0892
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrR:NABG
MD5 SHA1 SHA512 SSDEEP

Submit Download

DYDsgGL.exe

Path C:\Windows\System\DYDsgGL.exe
Size 2.1MB
SHA256 f9353b11f2fc412ad36e08e9fd0d8adf8afee584a80cd8e0a5c3a83a15ae249d
MD5 09f9ab07e66667b5b6ced90d72ccfb8a
SHA1 a994345d5dd0f687610e9e68f9eeaba6808c1fa0
SHA512 2a80f9c5f26c6bcf68b5c3156ea865cbb044ff9eb240ba83a1138c633c4552ddd2c6c75b9c5a395fd2bcf927a980f33656737bab92a45f88078275018dcf9a4b
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrw:NABd
MD5 SHA1 SHA512 SSDEEP

Submit Download

DnXzcHj.exe

Path C:\Windows\System\DnXzcHj.exe
Size 2.1MB
SHA256 e55fe2cc1b6c9a629ff9889accda02d0884902be8c673a80a36614b5fa166fb4
MD5 83ceae1219b6abdf7351c4f59f161f95
SHA1 60d8203ba3ade4309feb264d9304c18964213729
SHA512 8da97447ae46d3f7d179b14c6a06de06880311cc9efa81f5ba92fcf2832912b9c544ed1b6d541355dce887533703e50deddbc4c755e63aafad93552c18ad1fbe
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrI:NAB/
MD5 SHA1 SHA512 SSDEEP

Submit Download

EyJljGj.exe

Path C:\Windows\System\EyJljGj.exe
Size 2.1MB
SHA256 977b0e6b4320f243290b91fa41edbf29fe17cb13ee0713dbec930fc70cf89202
MD5 45756130386cd7f069b9aee913acb97e
SHA1 d021b7d998127ac36752c1a0010503fcb1b91464
SHA512 f751a9523d24ae61ad9d96384ae9e8b3a1a5cae93f3b4165f8a4474e8857d50419e79d11105b5d674d5eb6f109f479655138a96019108ddff51ebfebf68ca9f4
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrDB:NABW
MD5 SHA1 SHA512 SSDEEP

Submit Download

GkYiiAt.exe

Path C:\Windows\System\GkYiiAt.exe
Size 2.1MB
SHA256 e17d6f1cb3244b1ead0357825922b1301d7a365fa556a4fd5a70ec89b69a116f
MD5 f0578dcefeb3ade024a1a90f536c06da
SHA1 4f8c1a38ecf3929db155c567f06363d86ca30046
SHA512 6835f73b8fb23a7e2905fdd45b52f3b19ffa889abe1df150fed77f05c0aa18164630ec8113bafb4da9966eb3c0425fa648b33d24d33b65a61b8da37ac56ea5f7
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrf:NAB2
MD5 SHA1 SHA512 SSDEEP

Submit Download

IXAxfdu.exe

Path C:\Windows\System\IXAxfdu.exe
Size 2.1MB
SHA256 f3f1855fca0bbbe16c8ccf479e720ee048afcc79c5e96a6094dbd3c11330ba4d
MD5 7d375dece409884e22326143b5f9314c
SHA1 627d268b66e42913d43ccd782894b1c492a7fd1b
SHA512 f40588ef81f2933925ec1325caef74d00961d143be6f98ef09f91c297e17adef0853e3d2fbb56cf292fd228357f61f64a6a7725770e7a4296d5ced6aa27baf5d
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrQ:NABt
MD5 SHA1 SHA512 SSDEEP

Submit Download

KnJLjdd.exe

Path C:\Windows\System\KnJLjdd.exe
Size 2.1MB
SHA256 f17ec979c3b737a28b1ff32e0431671fd4da001b3c92b4ab74224e4097ae030b
MD5 bdcedbbdb9809c372acb68f8453d6199
SHA1 726a57dc3279d7108c934d2c57c33bc990091eb2
SHA512 1d5335314ebc9fc8a5707b211f92ca3b53b6bcd3f32615bf433346487535a217d2f9ba990db0b5bfba270964bbba18d97877bbca6cfd9752546a1972953f1bda
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrt:NABK
MD5 SHA1 SHA512 SSDEEP

Submit Download

KpbDCsA.exe

Path C:\Windows\System\KpbDCsA.exe
Size 2.1MB
SHA256 371961a5183a7c46dfdfbd16e99bff0ddfba84e81588deacc606dadde0626c8d
MD5 d5a1635ea72d049418e716dc891307f6
SHA1 4785abbbce996d01c2382a96862f502c155dc0b1
SHA512 0ca464c7d721035f0cd099972d4edfc2cbfbc0824601c7345ec0061095a7cf56744a03015af3d97e7338841adb6982a34996c668272b1b4fc9aa71427987cc76
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrG:NAB3
MD5 SHA1 SHA512 SSDEEP

Submit Download

NAkbxuI.exe

Path C:\Windows\System\NAkbxuI.exe
Size 8B
SHA256 413c20c52ba69478c63daee39bcd70926f09cbc71ce3aa1577802440938b324a
MD5 408407fe49e2a1bd1de2fb4f4e1c1e4e
SHA1 6781f0ed16b9f9a0e8a861848782ae1a9b183885
SHA512 51204da6f17b6725f4e9b8b9381f34a7ed365926b3780a3bfe9e8d70ab81ec8caad96b3f0838e87a0f0c0c6baeed1ea2ea2f5c7ee1fa6a13b720a1ec69c3f3fd
MD5 SHA1 SHA512

Submit Download

NxzLUvM.exe

Path C:\Windows\System\NxzLUvM.exe
Size 2.1MB
SHA256 6925db9b80cf809e0e2f14739a8e0d4f7b76437ce51518575de1cdf72a0be4e2
MD5 0bc875d3b618efcdd12eb79479ba75f7
SHA1 473fcc7556091566128420ce9f251eb21fcbb6d5
SHA512 e09c85d39dc2247f765b7001e08c09daec54bafd49b3a138c05b633a675e9c5a9481077f511b1bc77dd0c4302282fed97416b58701ef2e09bcd1d5d2699af821
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrk:NABz
MD5 SHA1 SHA512 SSDEEP

Submit Download

OoFAspt.exe

Path C:\Windows\System\OoFAspt.exe
Size 2.1MB
SHA256 db321507b88a9829ef8535c1f3afe05ecccd2411832535795c4ba79ce27dff38
MD5 52f66b0c8b2302ca59535e8be2852532
SHA1 c194dfa4267b73be39bebc8267244d62a6bbcf37
SHA512 20d713c70657be344d7aa457f114bfe0b216c624d31461b5590c6a99928b4afae15997f5b8230b96b080e4b2f561a944aa3f0a33d5d5850bfa4e12fd617df35d
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrb:NABQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

PByXVJu.exe

Path C:\Windows\System\PByXVJu.exe
Size 2.1MB
SHA256 73ca7d328d6b38c4b387c6b6ae43ca0bfd92740e3f2b3aa9dab7632c282f4ac8
MD5 891fdbd97c73b8481c57dda0465bcce7
SHA1 0b0cf009b3868d195da74306d67d22617dbe4772
SHA512 81a7a958455d616259fcbd9d3eb47a530007b09774f2dd3e4874bd392d00dc7488a827d9370a205de3e2639b25822b3642e531365b04ed46533aefb7427d3b21
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrs:NAB1
MD5 SHA1 SHA512 SSDEEP

Submit Download

RTpaEcp.exe

Path C:\Windows\System\RTpaEcp.exe
Size 2.1MB
SHA256 8d66028a56f1bcfa74dca92aefa38635aa8762c34a928154de24a9b24ed0bb9a
MD5 f1f6cf18a4f13aaef5e13bf41fb3e5f6
SHA1 b7d727e6c11aa1df52110e1594729bd39f63b56c
SHA512 bd8437c86875e8b7e306cd8f92fa0f43c01fa09df1c7d5b51b9fe0c87e5a1651d585c564833112e1500e72f7a4029e798120968b3d5877e65d804ba85ae2cd75
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrp:NABw
MD5 SHA1 SHA512 SSDEEP

Submit Download

UOAyssj.exe

Path C:\Windows\System\UOAyssj.exe
Size 2.1MB
SHA256 046a9f45ff9fd35a7535eaed512b08e842d2c3b5f67c0920b1e7f563e62c0983
MD5 2807121d360e13bd7a811987bedc83b2
SHA1 31b14d218d1b0708657ba15c9881e471a30c4098
SHA512 04166e1bc47b6d503b30becb5ee230ac43b226381fd0c8e981d42c4df0d677ab85a8657fbec9ed651d969858398592960a8044a96edd49c36742a18072203de5
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qr0:NABJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

UUDREOV.exe

Path C:\Windows\System\UUDREOV.exe
Size 2.1MB
SHA256 275aa3f93168f9b1105158120093cb61c568cc22a115219628aa6dc8cb13f84e
MD5 c05f398824792cbb30b24603c0f0ccfe
SHA1 dc397f0e728bc77a60c4696b5eaf5044a9ec19fa
SHA512 f90160ed0c107d40e3a19c910b4a89463a225e0c4495645f11baf77440e797d5808ac3c0b03e914df4a0bd5522a84d7f9eed6042991194cfd9be0a471cd90cbd
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrh:NABA
MD5 SHA1 SHA512 SSDEEP

Submit Download

UbamQud.exe

Path C:\Windows\System\UbamQud.exe
Size 2.1MB
SHA256 543f2b166491aedb1a0ba73cbf1a9745bcb83e395e6236d21878808b43e60e6f
MD5 4902e335143ca63e31f326b84f302bac
SHA1 096d00ce6341fc64f6238af8dbd3cd8e88bedccd
SHA512 7f73ec58e267ef1a68d226c602b40665ff6a151d78def79d3d8879ce418003fdfd3fc222668932db778eabb004612c48f5d2809bdd219073f45405334ada761a
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qr1:NAB4
MD5 SHA1 SHA512 SSDEEP

Submit Download

WOwGXWc.exe

Path C:\Windows\System\WOwGXWc.exe
Size 2.1MB
SHA256 a667421907878a0fd425e6032faf04d698ebb2c385976e604bc108176bbf70f5
MD5 9b189684078f270c3c07a790a639440a
SHA1 b473740679b5da68b38dc262acf7012749d45e7f
SHA512 a0cb759fc5b55caa56ad6c1ab4fa50039553abbaa1b4aa22a16c2988f0fc88770402d2e817cd4b448e541d7c4894a315a7abca445497851bdf67c38df6a761ba
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qri:NABt
MD5 SHA1 SHA512 SSDEEP

Submit Download

WPjkAXg.exe

Path C:\Windows\System\WPjkAXg.exe
Size 2.1MB
SHA256 611e49820c625be7a704ed7ed8fe678969c26e70ea431b3de77df177162167b9
MD5 6ed391df5cb71ebda5b7f33f8dc6276a
SHA1 04d9b589c990eac9d61f10d2255d70b4cd90dd83
SHA512 e997717105e5d76270b4f7c91057d61f658fd41f8866bf660d974ac91997a7c2fca8ba2ecbb4fcc86263c9b2b58005b1f82f354db595c0119613fc7bf3741bf8
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qr0:NABt
MD5 SHA1 SHA512 SSDEEP

Submit Download

XHgonDD.exe

Path C:\Windows\System\XHgonDD.exe
Size 2.1MB
SHA256 1a005214a20205e4dc89f0c325f3f7985570788d6bc28fc0fd8b5d71fa7745f1
MD5 f04f570686a2136e8b01e488d7f332d6
SHA1 166642e7b3bc0b468516b60c18b5c1de87a1c6e6
SHA512 d1b11007caeeb80660d625929c43f24fcd4c617961ad00a207f5c632064d1dc9d481d385c84f144225e14b56f4aabcf52c737eb26e2a7322f38dc206bfbd6011
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrX:NABS
MD5 SHA1 SHA512 SSDEEP

Submit Download

XcLkOKh.exe

Path C:\Windows\System\XcLkOKh.exe
Size 2.1MB
SHA256 7452069a0372ad058cb40e53cf0c38450ed2e97a231f5e33b081ca23d6969dea
MD5 4050d564e980daa6db093e54216ae034
SHA1 f20c107adf6295e8cb638992e829bf11485c5448
SHA512 9b56b4c9c709b8c9f987685758d478f36a2f7ddb848e4eaf485ad2cf799471b512d66b2fac0e4b1ea72300d9b561f5ef7b3473fd73867fb8ff1eea1720117a73
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qr+:NABr
MD5 SHA1 SHA512 SSDEEP

Submit Download

XhBkwGB.exe

Path C:\Windows\System\XhBkwGB.exe
Size 2.1MB
SHA256 9cbac128eae73307cadf10f4e007acc024cd8a02a6d1a878f60524078cfd1797
MD5 08f03c7d3bc839dd27aa6a3e86c7b209
SHA1 7c53d26c5dac1924e708b71b5ff578a3a9234abb
SHA512 396ee65cecc70cf59d1b90f8b976828daee47d31678d498e80ec1845a08ab3d4369a3531b5953203a74769ace3e3a6e166fbbd7c325d92576cba0d42b0715be7
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qr3:NABO
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZaDfVgD.exe

Path C:\Windows\System\ZaDfVgD.exe
Size 2.1MB
SHA256 00990b05719820ccb0dc773818a7b9c3afbec930211b23a0823b986d660da71a
MD5 0ba09ba0b34f0addd522d7f9d9851ed9
SHA1 48f89b763526f938f49040dd0870c1f38a56e09c
SHA512 df0f56719551ed623f447abd8ae518ad526a17ef19dfb425b5cf7250181883fa17c696f6cddd0b40132988e4a0159b95e2dce08740b2343a0f77b1c4f6c0ce81
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qr7:NABy
MD5 SHA1 SHA512 SSDEEP

Submit Download

agsMzaQ.exe

Path C:\Windows\System\agsMzaQ.exe
Size 2.1MB
SHA256 c567dc150cf50bfbe0f6b395e5810a867049f613ae05e4822880ad67e3f1c5b7
MD5 277243c74973bf256415d5ae3f02eaef
SHA1 955fcf7630c48fcd430c6745babc738c2342098f
SHA512 28c012e0512fffb99c587b92c809ed36957579d6267674fcfe3fc07195529c872f3abfd89c22582061ab1879af04f99e551daf8b31842f6af8b753159403ffe6
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrj:NABe
MD5 SHA1 SHA512 SSDEEP

Submit Download

cVHxEBI.exe

Path C:\Windows\System\cVHxEBI.exe
Size 2.1MB
SHA256 21540e25ed725b35025366e7b19f6bae1af05f2e419e23b2e96c52251a0f7005
MD5 ce9b2b0137899fb433dbccf289484300
SHA1 2ce8c540867c8903a4c2727cedfa581b1708be18
SHA512 d1b5b2bb0e9f6f79b4e81004e84b198d39870f1f4f71e4232c9aacc45fbaa58502a525610fda5022a2bee33d86cbf0d37f8aaacb8832d032d510726a7ca63233
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrZ:NAB6
MD5 SHA1 SHA512 SSDEEP

Submit Download

edeQeKp.exe

Path C:\Windows\System\edeQeKp.exe
Size 2.1MB
SHA256 fc3cc7830dd43685b06949ee509a098a3bf728b33e9466ec13326dc089a37932
MD5 19354d8ec2135f87d9653138af6b72b9
SHA1 e687cd9bed87d01618e29b0f5e0c069a2a1a3402
SHA512 6941f00b07be697d4cf15b27e0b669baf91450886f135dbe9c6e212f5c7c4b5d257ad1455adf3b791f26b829ea3513535d61397f1190a87787db47064cc32b40
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrh:NABU
MD5 SHA1 SHA512 SSDEEP

Submit Download

fjyBiou.exe

Path C:\Windows\System\fjyBiou.exe
Size 2.1MB
SHA256 17516300c41f5c4e943ad1d91d86a7279c3ccb83dfb6596b445925d03077cff3
MD5 da20b5681156611abd39b4384757971e
SHA1 73e026216a4004a2248d86a5d90be31097e48a6a
SHA512 7c4982a707d64915838f27e84f718740c1e3fdb801908c6653af5419b2aa0c921dfa52f3edab4c84dcad97d50f1cee93d01723ec839e9d8135d2466ce5f8923e
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrL:NABC
MD5 SHA1 SHA512 SSDEEP

Submit Download

gunSbSA.exe

Path C:\Windows\System\gunSbSA.exe
Size 2.1MB
SHA256 670a9ff3cd96884eadd0de739cbfd86e32117207938a98f1f721f71ae735a724
MD5 30722f58fa450cd0e934522d71bf7673
SHA1 913cc2b57a4a5cd466c327d9bbc7db02c85aa645
SHA512 81a5f1da2b9bff1c0e84fe0cbd03649970124790e72ec33a2b94c9ae7db3299fde80dd7dd38ef7449292de94d2c21dc529c323d615c6d4474c18613fed07be88
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qri:NABp
MD5 SHA1 SHA512 SSDEEP

Submit Download

iuMMWjW.exe

Path C:\Windows\System\iuMMWjW.exe
Size 2.1MB
SHA256 e66d155a7a1f01959090d044ea100a1e823022009a18ffe71430b22212e3b190
MD5 4e7eece94aeb1231e80d732059b28df4
SHA1 a16045c49a404dcc7e812187ea25325936aa47f8
SHA512 e9ae3fb0632cc02fca6d32840e9ec29138301c2558fd056bdd950af68ed3f67842f13a9bd1e9b5082d6a05f48c20b46311f64c552179cea08294a2be0dced367
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrc:NABL
MD5 SHA1 SHA512 SSDEEP

Submit Download

jjkrgIM.exe

Path C:\Windows\System\jjkrgIM.exe
Size 2.1MB
SHA256 97745970c2eee76ac431fd2f684094aec9ac6a90a1475bae8788f0346b00204b
MD5 9128372e32a456414f568a008a064fe4
SHA1 1d2736b39f6d883592523326f5df8cc9c973c51b
SHA512 b32e27cd9469fa639b6a648fa390e5288ff255b909b9177f9e2f9faef7de91a191578761293d3e120899e43bedce2e142dacff918f5d7161dbf78ed947d91543
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrZ:NABS
MD5 SHA1 SHA512 SSDEEP

Submit Download

jzVnduM.exe

Path C:\Windows\System\jzVnduM.exe
Size 2.1MB
SHA256 2cc57f582c0900a0ba98d61b25b0215618a60cd73ed373ba13075ba423fd7a3f
MD5 65357d12934b4733ba8efe4338bdf62f
SHA1 7da6caee0a6bfefba5e66a140a782493ef122190
SHA512 06be462eab653ea8d5144b0881cb70bd42c4df23835da26e1399fa67395286acc685ea23c8ba068794e9bfa2c5e5c90f285c8c54565ee896741d22280811575e
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrJ:NABa
MD5 SHA1 SHA512 SSDEEP

Submit Download

mpROhnO.exe

Path C:\Windows\System\mpROhnO.exe
Size 2.1MB
SHA256 03d53e0c5c09067592cf73df92b43077eda4d2d26ee39a6cb45d1f9bc65b391a
MD5 066377bc6060aa483dedc75100b91924
SHA1 f5bc849460079eeff0cd1820de5d80a028f974a1
SHA512 bd5a63d156e4c208dd790b9061e9587335c0fc24604738696aee18e8bd1c57a133d469839e2c202984061cbdf085a4245d9648b8fefeb0596be477ce8bf9e032
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrg:NAB7
MD5 SHA1 SHA512 SSDEEP

Submit Download

oYwVSZj.exe

Path C:\Windows\System\oYwVSZj.exe
Size 2.1MB
SHA256 d662f60eaccf9855868292e2d8f6ef789dd04aa41db6a679a2058426f106d8a0
MD5 33be93d54b4a5bb0e4a19cd7006f7f78
SHA1 f481d2b94b12301226406d920ea7f9577c5cf8ae
SHA512 69d20a64f44fb47a2ad83656a28836e122b6d46cda293958684fd3d3a7ae49c945a621179c017633462cc7c200c45686a520d9dd5b7a4cf5a813a27e7d9984bb
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrhc:NABl
MD5 SHA1 SHA512 SSDEEP

Submit Download

rbWbcSY.exe

Path C:\Windows\System\rbWbcSY.exe
Size 2.1MB
SHA256 42d8f579c5cf5c76477aab4ef603c06fe712b459aa63e084e42b0924b98fa1e7
MD5 1a3541a51733f59fb57a017159c58d54
SHA1 2bf287ed6bff39beebf303c0ab5d13ed9e80dbfc
SHA512 ee659cbe1fd51750fc3bf9e24b808539562abd9b171d583b3203373db801a4a13e0644b5b48a274b9e99675db8b359dcc59202ba50654b6766ebc1eb46eb223f
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qre:NABL
MD5 SHA1 SHA512 SSDEEP

Submit Download

zOesOZN.exe

Path C:\Windows\System\zOesOZN.exe
Size 2.1MB
SHA256 a1008c198b170e3c2eeed5ade8f91b4ba16b44a85a1050a8cee47554d88b147e
MD5 7c7bd75f69cdcfbd753beea7ca6d9ce9
SHA1 3216f6e542fe3c910b59548fbee8eff75102125c
SHA512 55064d56dae8ff9f6f48af188fd5f743dd6261101041b059921b045e18bcf802688305172f914546d8a4187f5b882cdf89c66c04e98f46ab26f7b5704e54a39c
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrl:NABS
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/552-4725-0x00007FF66A8C0000-0x00007FF66ACB2000-memory.dmp

Download

memory/552-129-0x00007FF66A8C0000-0x00007FF66ACB2000-memory.dmp

Download

memory/624-308-0x00007FF63FFF0000-0x00007FF6403E2000-memory.dmp

Download

memory/868-109-0x00007FF6EC7F0000-0x00007FF6ECBE2000-memory.dmp

Download

memory/1052-66-0x00007FFA10840000-0x00007FFA11301000-memory.dmp

Download

memory/1052-67-0x0000022A787A0000-0x0000022A787B0000-memory.dmp

Download

memory/1052-213-0x0000022A78710000-0x0000022A78732000-memory.dmp

Download

memory/1052-110-0x0000022A787A0000-0x0000022A787B0000-memory.dmp

Download

memory/1484-0-0x00007FF6883C0000-0x00007FF6887B2000-memory.dmp

Download

memory/1484-5060-0x00007FF6883C0000-0x00007FF6887B2000-memory.dmp

Download

memory/1484-1-0x0000026348140000-0x0000026348150000-memory.dmp

Download

memory/1572-4799-0x00007FF786F60000-0x00007FF787352000-memory.dmp

Download

memory/1572-285-0x00007FF786F60000-0x00007FF787352000-memory.dmp

Download

memory/2236-193-0x00007FF6BC450000-0x00007FF6BC842000-memory.dmp

Download

memory/2236-4761-0x00007FF6BC450000-0x00007FF6BC842000-memory.dmp

Download

memory/2288-194-0x00007FF787800000-0x00007FF787BF2000-memory.dmp

Download

memory/2288-4773-0x00007FF787800000-0x00007FF787BF2000-memory.dmp

Download

memory/2376-311-0x00007FF70E040000-0x00007FF70E432000-memory.dmp

Download

memory/2376-4811-0x00007FF70E040000-0x00007FF70E432000-memory.dmp

Download

memory/2452-281-0x00007FF6BA780000-0x00007FF6BAB72000-memory.dmp

Download

memory/2452-4797-0x00007FF6BA780000-0x00007FF6BAB72000-memory.dmp

Download

memory/3112-312-0x00007FF752080000-0x00007FF752472000-memory.dmp

Download

memory/3112-4814-0x00007FF752080000-0x00007FF752472000-memory.dmp

Download

memory/3120-29-0x00007FF6D63A0000-0x00007FF6D6792000-memory.dmp

Download

memory/3124-305-0x00007FF6A2BE0000-0x00007FF6A2FD2000-memory.dmp

Download

memory/3124-4802-0x00007FF6A2BE0000-0x00007FF6A2FD2000-memory.dmp

Download

memory/3336-4815-0x00007FF6DF9A0000-0x00007FF6DFD92000-memory.dmp

Download

memory/3336-297-0x00007FF6DF9A0000-0x00007FF6DFD92000-memory.dmp

Download

memory/3672-79-0x00007FF74A610000-0x00007FF74AA02000-memory.dmp

Download

memory/3672-4746-0x00007FF74A610000-0x00007FF74AA02000-memory.dmp

Download

memory/3928-4783-0x00007FF65F820000-0x00007FF65FC12000-memory.dmp

Download

memory/3928-247-0x00007FF65F820000-0x00007FF65FC12000-memory.dmp

Download

memory/4112-4743-0x00007FF6BC890000-0x00007FF6BCC82000-memory.dmp

Download

memory/4112-310-0x00007FF6BC890000-0x00007FF6BCC82000-memory.dmp

Download

memory/4380-137-0x00007FF6D4D70000-0x00007FF6D5162000-memory.dmp

Download

memory/4476-128-0x00007FF6120E0000-0x00007FF6124D2000-memory.dmp

Download

memory/4476-4765-0x00007FF6120E0000-0x00007FF6124D2000-memory.dmp

Download

memory/4996-4819-0x00007FF746070000-0x00007FF746462000-memory.dmp

Download

memory/4996-307-0x00007FF746070000-0x00007FF746462000-memory.dmp

Download

memory/5200-168-0x00007FF6B2680000-0x00007FF6B2A72000-memory.dmp

Download

memory/5200-4749-0x00007FF6B2680000-0x00007FF6B2A72000-memory.dmp

Download

memory/5344-303-0x00007FF6174F0000-0x00007FF6178E2000-memory.dmp

Download

memory/5344-4818-0x00007FF6174F0000-0x00007FF6178E2000-memory.dmp

Download

memory/5724-4752-0x00007FF614460000-0x00007FF614852000-memory.dmp

Download

memory/5724-191-0x00007FF614460000-0x00007FF614852000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads